diffoscope before 256 allows directory traversal via an embedded
filename in a GPG file. Contents of any file, such as ../.ssh/id_rsa,
may be disclosed to an attacker. This occurs because the value of the
gpg --use-embedded-filenames option is trusted.
Reference:
https://nvd.nist.gov/vuln/detail/CVE-2024-25711
Upstream patches:
458f7f04bc
(From OE-Core rev: da4977e9414361a30eb322d1456a664515b35693)
Signed-off-by: Jiaying Song <jiaying.song.cn@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
An automated conversion using scripts/contrib/convert-spdx-licenses.py to
convert to use the standard SPDX license identifiers. Two recipes in meta-selftest
were not converted as they're that way specifically for testing. A change in
linux-firmware was also skipped and may need a more manual tweak.
(From OE-Core rev: ceda3238cdbf1beb216ae9ddb242470d5dfc25e0)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Changelog:
=========
* Support both variants of "odt2txt", including the one provided by unoconv.
(Closes: reproducible-builds/diffoscope#298)
* Add external tool reference on Arch Linux for xb-tool.
(From OE-Core rev: 763c44e30c20ebcd4199d41fa76dae3d3b4ec5c3)
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Changelog:
[Chris Lamb]
Don't raise a traceback if we cannot de-marshal Python bytecode to support
Python 3.7 loading newer .pyc files.
(Closes: reproducible-builds/diffoscope#284)
Fix Python tests under Python 3.7 with file 5.39+.
[Vagrant Cascadian]
Skip Python bytecode testing when "file" is older than 5.39.
[Roland Clobus]
Detect whether the GNU_BUILD_ID field has been modified.
(From OE-Core rev: b9c59b5d2ac29544c1877f50ec10d2126339d814)
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This is the result of automated script conversion:
scripts/contrib/convert-overrides.py <oe-core directory>
converting the metadata to use ":" as the override character instead of "_".
(From OE-Core rev: 42344347be29f0997cc2f7636d9603b1fe1875ae)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Reversal of global setting in previous commit necessitates
a local fix, otherwise, this happens:
File "/home/pokybuild/yocto-worker/reproducible-debian/build/build-st-52142/tmp/work/x86_64-linux/diffoscope-native/172-r0/recipe-sysroot-native/usr/lib/python3.9/ctypes/__init__.py", line 392, in __getitem__
func = self._FuncPtr((name_or_ordinal, self))
AttributeError: nativepython3: undefined symbol: archive_errno
(From OE-Core rev: 87884d9938829d5ae5d250f483c749e00cd83322)
Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
In particular 170 includes rpm header fixes which stop the webpages
for rpm diffs breaking web browsers and are important in the context
of the autobuilder.
(From OE-Core rev: 275738c3f2116de9b812b46e00d80b4de6975d7f)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This includes a fix for the 'hang' on larger diffs with html output
as seen on the autobuilder.
(From OE-Core rev: cac4ed44b302a3effd0ed6729cbf65817824604e)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The python3-rpm package is required for diffoscope to diff RPM packages
(From OE-Core rev: 5331d9c63022c5434b4c70d404c7546316a6f9f1)
Signed-off-by: Joshua Watt <JPEWhacker@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
diffoscope uses libmagic and it was searching in file-native's sysroot
for the magic file. Wrap it and set MAGIC in the environment to
ensure the file is found correctly and avoid build failures.
(From OE-Core rev: 3488a8316891829892bd41a1caacaeeef73da7ef)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
[ Chris Lamb ]
* Truncate jsondiff differences at 512 bytes lest they consume the
entire page.
* Wrap our external call to cmp(1) with a profile (to match the internal
profiling).
* Add a note regarding the specific ordering of the new
all_tools_are_listed test.
[ Dimitrios Apostolou ]
* Performance improvements:
- Improve speed of has_same_content by spawning cmp(1) less
frequently.
- Log whenever the external cmp(1) command is spawn.ed
- Avoid invoking external diff for identical, short outputs.
* Rework handling of temporary files:
- Clean up temporary directories as we go along, instead of at the
end.
- Delete FIFO files when the FIFO feeder's context manager exits.
[ Mattia Rizzolo ]
* Fix a number of potential crashes in --list-debian-substvars,
including explicitly listing lipo and otool as external tools.
- Remove redundant code and let object destructors clean up after
themselves.
[ Conrad Ratschan ]
* Add a comparator for Flattened Image Trees (FIT) files, a boot image
format used by U-Boot.
(From OE-Core rev: 65feaffe9857029fa230935cb0c3e8e6f2815776)
Signed-off-by: Joshua Watt <JPEWhacker@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This includes the following changes:
Version 159:
* Show "ordering differences only" in strings(1) output.
(Closes: reproducible-builds/diffoscope#216)
* Don't alias output from "os.path.splitext" to variables that we do not end
up using.
* Don't raise exceptions when cleaning up after a guestfs cleanup failure.
* Make "Command" subclass a new generic Operation class.
Version 160:
* Check that pgpdump is actually installed before attempting to run it.
Thanks to Gianfranco Costamagna (locutusofborg). (Closes: #969753)
* Add some documentation for the EXTERNAL_TOOLS dictionary.
* Ensure we check FALLBACK_FILE_EXTENSION_SUFFIX, otherwise we run pgpdump
against all files that are recognised by file(1) as "data".
(From OE-Core rev: 6433feb0705f969923d032cc289e7b210e11aa23)
Signed-off-by: Pierre-Jean Texier <pjtexier@koncepto.io>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* Improvements and bug fixes:
- Pass the absolute path when extracting members from SquashFS images as we
run the command with our working directory set to the temporary
directory. (Closes: #964365, reproducible-builds/diffoscope#189)
- Increase the minimum length of the output from strings(1) to 8 characters
to avoid unnecessary diff noise. (Re. reproducible-builds/diffoscope#148)
* Logging improvements:
- Fix the compare_files message when the file does not have a literal name.
- Reduce potential log noise by truncating the has_some_content messages.
* Codebase changes:
- Clarify use of a "null" diff in order to remember an exit code.
- Don't alias a variable when don't end up it; use "_" instead.
- Use a "NullChanges" file to represent missing data in the Debian package
comparator.
- Update some miscellaneous terms.
(From OE-Core rev: afbf68ddd20463ec7e584b481af6344482180ce0)
Signed-off-by: Joshua Watt <JPEWhacker@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This includes the following changes:
Version 149:
* Update tests for file 5.39. (Closes: reproducible-builds/diffoscope#179)
* Downgrade the tlsh warning message to an "info" level warning.
(Closes: #888237, reproducible-builds/diffoscope#29)
* Use the CSS "word-break" property over manually adding U+200B zero-width
spaces that make copy-pasting cumbersome.
(Closes: reproducible-builds/diffoscope!53)
* Codebase improvements:
- Drop some unused imports from the previous commit.
- Prevent an unnecessary .format() when rendering difference comments.
- Use a semantic "AbstractMissingType" type instead of remembering to check
for both "missing" files and missing containers.
* Allow user to mask/filter reader output via --diff-mask=REGEX.
(MR: reproducible-builds/diffoscope!51)
* Make --html-dir child pages open in new window to accommodate new web
browser content security policies.
* Fix the --new-file option when comparing directories by merging
DirectoryContainer.compare and Container.compare.
(Closes: reproducible-builds/diffoscope#180)
* Fix zsh completion for --max-page-diff-block-lines.
* Do not warn about missing tlsh during tests.
Version 150:
* Don't crash when listing entries in archives if they don't have a listed
size (such as hardlinks in .ISO files).
(Closes: reproducible-builds/diffoscope#188)
* Dump PE32+ executables (including EFI applications) using objdump.
(Closes: reproducible-builds/diffoscope#181)
* Tidy detection of JSON files due to missing call to File.recognizes that
checks against the output of file(1) which was also causing us to attempt
to parse almost every file using json.loads. (Whoops.)
* Drop accidentally-duplicated copy of the new --diff-mask tests.
* Logging improvements:
- Split out formatting of class names into a common method.
- Clarify that we are generating presenter formats in the opening logs.
* Remove objdjump(1) offsets before instructions to reduce diff noise.
(Closes: reproducible-builds/diffoscope!57)
(From OE-Core rev: 9ef1a0aa143c72d51ae52c0e1f7476743813f434)
Signed-off-by: Pierre-Jean Texier <pjtexier@koncepto.io>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This includes the following changes:
* New features:
- Add output from strings(1) to ELF binaries. It is intended this will
expose expose build paths that are hidden somewhere within the objdump(1)
output. (Closes: reproducible-builds/diffoscope#148)
- Add basic zsh shell tab-completion support.
(Closes: reproducible-builds/diffoscope#158)
* Bug fixes:
- Prevent a traceback when comparing a PDF document that does not contain
any metadata, ie. it is missing a PDF "/Info" stanza.
(Closes: reproducible-builds/diffoscope#150)
- Fix compatibility with jsondiff 1.2.0 which was causing a traceback and
log the version of jsondiff we are using to aid debugging in the future.
(Closes: reproducible-builds/diffoscope#159
- Fix an issue in GnuPG keybox handling that left filenames in the diff.
- Don't mask an existing test name; ie. ensure it is actually run.
* Reporting:
- Log all calls to subprocess.check_output by using our own wrapper utility.
(Closes: reproducible-builds/diffoscope#151)
* Code improvements:
- Replace references to "WF" with "Wagner-Fischer" for clarity.
- Drop a large number of unused imports (list_libarchive,
ContainerExtractionError, etc.)
- Don't assign exception to a variable that we do not use.
- Compare string values with the equality operator, not via "is" identity.
- Don't alias an open file to a variable when we don't use it.
- Don't alias "filter" builtin.
- Refactor many small parts of the HTML generation, dropping explicit
u"unicode" strings, tidying the generation of the "Offset X, Y lines
modified" messages, moving to PEP 498 f-strings where appropriate, etc.
- Inline a number of single-used utility methods.
(From OE-Core rev: d6350dd5cdb252216494475b87edf42e0bdfdb19)
Signed-off-by: Pierre-Jean Texier <pjtexier@koncepto.io>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Various dependencies don't build for musl so exclude this recipe too, at
least for now until the issues are resolved to avoid build failures in
world builds.
(From OE-Core rev: 085b0a3337e04e14e0d922a9028a7748dc81c4d0)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffoscope is the universal diff tool, capable of comparing many
different formats.
(From OE-Core rev: c92cf366c301a98ff1546d80d6c3a138f952252a)
Signed-off-by: Joshua Watt <JPEWhacker@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
