From patchwork Mon Sep 21 05:40:10 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: auh@yoctoproject.org X-Patchwork-Id: 98758 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id EDB33C982EF for ; Mon, 21 Sep 2026 05:40:16 +0000 (UTC) Received: from a27-29.smtp-out.us-west-2.amazonses.com (a27-29.smtp-out.us-west-2.amazonses.com [54.240.27.29]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.42912.1789969211180700554 for ; Sun, 20 Sep 2026 22:40:11 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@yoctoproject.org header.s=lvjh2tk576v2ro5mi6k4dt3mc6wpqbky header.b=ilCI172a; dkim=pass header.i=@amazonses.com header.s=hsbnp7p3ensaochzwyq5wwmceodymuwv header.b=vUncXjAN; spf=pass (domain: us-west-2.amazonses.com, ip: 54.240.27.29, mailfrom: 010101a0c27a9c46-a8e12820-5659-48f6-a4cb-c9cd6f59dfcd-000000@us-west-2.amazonses.com) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; s=lvjh2tk576v2ro5mi6k4dt3mc6wpqbky; d=yoctoproject.org; t=1789969210; h=Content-Type:MIME-Version:From:To:Cc:Subject:Message-Id:Date; bh=eEYOa4fCBe6vK99SQUTb6gLxaVfxqC2CxLcfXxsJSx4=; b=ilCI172aea9NdGjXY0FiUjLXFrXj18wV7H6jGr1EPvgp/bQ/mz5eUdjOAKe/t2wW JnlgU9cUdqZ2D16HpkrLzOsSQi8A5Cg96kaTxJPjy0RTtMOoc0gQxoraESuVg9GCehv BxFH84vcBuSem1Zka40/8Zy9CdvJ/JsrNzID20ic= DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; s=hsbnp7p3ensaochzwyq5wwmceodymuwv; d=amazonses.com; t=1789969210; h=Content-Type:MIME-Version:From:To:Cc:Subject:Message-Id:Date:Feedback-ID; bh=eEYOa4fCBe6vK99SQUTb6gLxaVfxqC2CxLcfXxsJSx4=; b=vUncXjANOJUPaPPYXmTB4FvNsvPmRr5GcIyFb4idtHs+xpnUlIHinvDIS+oxC0QI V6xtGgvyM+rnYQFgXYM+0FbXxwRW2cXLMR1lj/3NM4zJX9sh6tguZBeVkf3a2soZNza dsHKIMGH5XdlbtxsXQu5r3co23OTuTBCadwZjSLk= MIME-Version: 1.0 From: auh@yoctoproject.org To: Denys Dmytriyenko Cc: openembedded-core@lists.openembedded.org Subject: [AUH] gzip: upgrading to 1.15 SUCCEEDED Message-ID: <010101a0c27a9c46-a8e12820-5659-48f6-a4cb-c9cd6f59dfcd-000000@us-west-2.amazonses.com> Date: Mon, 21 Sep 2026 05:40:10 +0000 Feedback-ID: ::1.us-west-2.9np3MYPs3fEaOBysGKSlUD4KtcmPijcmS9Az2Hwf7iQ=:AmazonSES X-SES-Outgoing: 2026.09.21-54.240.27.29 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 21 Sep 2026 05:40:16 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/246282 Hello, this email is a notification from the Auto Upgrade Helper that the automatic attempt to upgrade the recipe(s) *gzip* to *1.15* has Succeeded. Next steps: - apply the patch: git am 0001-gzip-upgrade-1.14-1.15.patch - check the changes to upstream patches and summarize them in the commit message, - compile an image that contains the package - perform some basic sanity tests - amend the patch and sign it off: git commit -s --reset-author --amend - send it to the appropriate mailing list Alternatively, if you believe the recipe should not be upgraded at this time, you can fill RECIPE_NO_UPDATE_REASON in respective recipe file so that automatic upgrades would no longer be attempted. Please review the attached files for further information and build/update failures. Any problem please file a bug at https://bugzilla.yoctoproject.org/enter_bug.cgi?product=Automated%20Update%20Handler Regards, The Upgrade Helper -- >8 -- From 22d16541e944eb699afec797afde2b0d00928473 Mon Sep 17 00:00:00 2001 From: Upgrade Helper Date: Mon, 21 Sep 2026 05:20:52 +0000 Subject: [PATCH] gzip: upgrade 1.14 -> 1.15 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Source: ChangeLog 2026-09-20 Jim Meyering version 1.15 * NEWS: Record release date. 2026-09-10 Paul Eggert doc: add THANKS for bug report gzip: avoid last_component if !USE_ATFUNCS Problem reported by Bryan M. * gzip.c (atdir_set): New arg PARENTFD. All uses changed. Use the new arg to avoid passing AT_FDCWD to unlinkat when a parent directory was intended. (treat_file) [!USE_ATFUNCS]: Use ifname, not its last component. gzip: use unlinkat only when using openat This is mostly just a cleanup, but the cleanup removes a nagging issue on MS-Windowsish platforms with openat+unlinkat but where you cannot unlink a readonly file. In this case the code used plain open, but used unlinkat, which is questionable. * gzip.c (USE_ATFUNCS): Rename from TRY_OPENING_DIRECTORIES. The old name was misleading, as gzip -r opens directories even when USE_ATFUNCS is false. All uses changed. (gzip_unlinkat, unlinkat) [!USE_ATFUNCS]: New compatibility function and macro. * util.c (xunlinkat): Remove. All uses changed to use unlinkat. 2026-09-05 Paul Eggert gzip: fix undefined behavior with SIGPIPE This problem arose due to a combination of commit bb78ea465787191e8987d4b8a6594f9f23a18930 dated 2013-06-11, which defined SIGPIPE to 0 if not already defined, with commit ede0a8888a4d3d0750e1651e01f198e2faab5d59 dated 2026-05-25, which included tailor.h before all system .h files. Problem and fix reported by Collin Funk (bug#81139). * gzip.c (handled_sig): ifdef, not if, for SIGPIPE. * tailor.h (SIGPIPE): Do not #define to 0, because when we later include its #define yields undefined behavior. maint: update .gitignore files and bootstrap build: configure.ac cruft removal * configure.ac: Do not call AC_PROG_RANLIB, as we no longer use its results ourselves. Do not use AC_C_CONST or AC_TYPE_SIZE_T, as it’s safe to assume C89 now. Do not check for fcntl.h, limits.h, memory.h, time.h, as we no longer use the corresponding HAVE_FCNTL_H etc. macros. Do not check for lstat or siginterrupt, as we no longer use HAVE_LSTAT or HAVE_SIGINTERRUPT. Do not use AC_HEADER_DIRENT, as we no longer use any symbols that it defines. gzip: don’t open same dir twice when recursive Opening it multiple times can lead to races. * gzip.c (treat_file, create_outfile, open_and_stat, open_input_file): New arg parentfd. All uses changed. If nonnegative, treat it as the parent directory file descriptor, instead of dfd or syncdfd. (check_ofname): New arg atfd. All uses changed. (treat_dir): Do not close fd until after processing subsidiaries. Instead, pass it as the parent fd to subroutines. Report any streamsavedir failure. gzip: be more cautious about using AT_FDCWD Without this change, gzip was more vulnerable to attackers changing the directory hierarchy while gzip walks through it. * gzip.c (ATDIR_SET_ERROR): New constant. (atdir_set): Return it on fail [Changelog truncated as it exceeds 3000 characters; the full changelog can be found in an attachment to the AUH email] --- .../CVE-2026-41991.patch | 46 +++---------------- .../CVE-2026-41992.patch | 26 +++-------- .../wrong-path-fix.patch | 4 +- .../gzip/{gzip_1.14.bb => gzip_1.15.bb} | 2 +- 4 files changed, 16 insertions(+), 62 deletions(-) rename meta/recipes-extended/gzip/{gzip-1.14 => gzip-1.15}/CVE-2026-41991.patch (50%) rename meta/recipes-extended/gzip/{gzip-1.14 => gzip-1.15}/CVE-2026-41992.patch (65%) rename meta/recipes-extended/gzip/{gzip-1.14 => gzip-1.15}/wrong-path-fix.patch (92%) rename meta/recipes-extended/gzip/{gzip_1.14.bb => gzip_1.15.bb} (94%) diff --git a/meta/recipes-extended/gzip/gzip-1.14/CVE-2026-41991.patch b/meta/recipes-extended/gzip/gzip-1.15/CVE-2026-41991.patch similarity index 50% rename from meta/recipes-extended/gzip/gzip-1.14/CVE-2026-41991.patch rename to meta/recipes-extended/gzip/gzip-1.15/CVE-2026-41991.patch index b1a3644020..e72c3d355b 100644 --- a/meta/recipes-extended/gzip/gzip-1.14/CVE-2026-41991.patch +++ b/meta/recipes-extended/gzip/gzip-1.15/CVE-2026-41991.patch @@ -1,4 +1,4 @@ -From 661918c7c0d5acf52508107d6bcdeb72a526ce52 Mon Sep 17 00:00:00 2001 +From 286734a7f791dfb1694bf7d2d61dfae8c8105cc7 Mon Sep 17 00:00:00 2001 From: Paul Eggert Date: Thu, 16 Apr 2026 12:11:44 -0700 Subject: [PATCH] gzexe: use -C if lacking mktemp @@ -16,16 +16,14 @@ CVE: CVE-2026-41991 Upstream-Status: Backport [https://cgit.git.savannah.gnu.org/cgit/gzip.git/commit/?id=4e6f8b24ab823146ab8776f0b7fe486ab34d4269] Signed-off-by: Jaipaul Cheernam --- - NEWS | 13 +++++++++---- - gzexe.in | 1 + - zdiff.in | 7 +++---- - 3 files changed, 13 insertions(+), 8 deletions(-) + NEWS | 13 +++++++++---- + 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/NEWS b/NEWS -index 881b6b6..3a05d7e 100644 +index 75836f2..7881350 100644 --- a/NEWS +++ b/NEWS -@@ -4,10 +4,6 @@ GNU gzip NEWS -*- outline -*- +@@ -68,10 +68,6 @@ GNU gzip NEWS -*- outline -*- ** Bug fixes @@ -36,7 +34,7 @@ index 881b6b6..3a05d7e 100644 'gzip -d' no longer omits the last partial output buffer when the input ends unexpectedly on an IBM Z platform. [bug introduced in gzip-1.11] -@@ -18,6 +14,15 @@ GNU gzip NEWS -*- outline -*- +@@ -82,6 +78,15 @@ GNU gzip NEWS -*- outline -*- 'gzip -S' now rejects suffixes containing '/'. [bug present since the beginning] @@ -52,35 +50,3 @@ index 881b6b6..3a05d7e 100644 ** Changes in behavior The GZIP environment variable is now silently ignored except for the -diff --git a/gzexe.in b/gzexe.in -index 1267d6e..09a2571 100644 ---- a/gzexe.in -+++ b/gzexe.in -@@ -127,6 +127,7 @@ for i do - tmp=`mktemp "${dir}gzexeXXXXXXXXX"` - else - tmp=${dir}gzexe$$ -+ (umask 77; set -C; > "$tmp") - fi && { cp -p "$file" "$tmp" 2>/dev/null || cp "$file" "$tmp"; } || { - res=$? - printf >&2 '%s\n' "$0: cannot copy $file" -diff --git a/zdiff.in b/zdiff.in -index a8689a0..c04a8c0 100644 ---- a/zdiff.in -+++ b/zdiff.in -@@ -156,12 +156,11 @@ case $file2 in - *) TMPDIR=/tmp/;; - esac - if command -v mktemp >/dev/null 2>&1; then -- tmp=`mktemp "${TMPDIR}zdiffXXXXXXXXX"` || -- exit 2 -+ tmp=`mktemp "${TMPDIR}zdiffXXXXXXXXX"` - else -- set -C - tmp=${TMPDIR}zdiff$$ -- fi -+ (umask 77; set -C; > "$tmp") -+ fi && - 'gzip' -cdfq -- "$file2" > "$tmp" || exit 2 - gzip_status=$( - exec 4>&1 diff --git a/meta/recipes-extended/gzip/gzip-1.14/CVE-2026-41992.patch b/meta/recipes-extended/gzip/gzip-1.15/CVE-2026-41992.patch similarity index 65% rename from meta/recipes-extended/gzip/gzip-1.14/CVE-2026-41992.patch rename to meta/recipes-extended/gzip/gzip-1.15/CVE-2026-41992.patch index f55c89978d..00378dd179 100644 --- a/meta/recipes-extended/gzip/gzip-1.14/CVE-2026-41992.patch +++ b/meta/recipes-extended/gzip/gzip-1.15/CVE-2026-41992.patch @@ -1,7 +1,8 @@ -From 63dbf6b3b9e6e781df1a6a64e609b10e23969681 Mon Sep 17 00:00:00 2001 +From 3a355dd8d9bc7ec9640447e5542acaefecf3fec5 Mon Sep 17 00:00:00 2001 From: Paul Eggert Date: Wed, 15 Apr 2026 12:00:17 -0700 -Subject: =?UTF-8?q?gzip:=20don=E2=80=99t=20mishandle=20.lzh=20after=20.Z?= +Subject: [PATCH] =?UTF-8?q?gzip:=20don=E2=80=99t=20mishandle=20.lzh=20afte?= + =?UTF-8?q?r=20.Z?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit @@ -14,15 +15,14 @@ Upstream-Status: Backport [https://cgit.git.savannah.gnu.org/cgit/gzip.git/commi Signed-off-by: Jaipaul Cheernam --- NEWS | 4 ++++ - THANKS | 1 + unlzh.c | 6 ++++++ - 3 files changed, 11 insertions(+) + 2 files changed, 10 insertions(+) diff --git a/NEWS b/NEWS -index 6388227..8fb8918 100644 +index a8657a8..75836f2 100644 --- a/NEWS +++ b/NEWS -@@ -4,6 +4,10 @@ GNU gzip NEWS -*- outline -*- +@@ -68,6 +68,10 @@ GNU gzip NEWS -*- outline -*- ** Bug fixes @@ -33,20 +33,8 @@ index 6388227..8fb8918 100644 'gzip -d' no longer omits the last partial output buffer when the input ends unexpectedly on an IBM Z platform. [bug introduced in gzip-1.11] -diff --git a/THANKS b/THANKS -index 4e545d9..a7d25e4 100644 ---- a/THANKS -+++ b/THANKS -@@ -186,6 +186,7 @@ Jamie Lokier u90jl@ecs.oxford.ac.uk - Richard Lloyd R.K.Lloyd@csc.liv.ac.uk - David J. MacKenzie djm@eng.umd.edu - John R MacMillan john@chance.gts.org -+Michał Majchrowicz mmajchrowicz@afine.com - Ron Male male@eso.mc.xerox.com - Jakub Martisko jamartis@redhat.com - Don R. Maszle maze@bea.lbl.gov diff --git a/unlzh.c b/unlzh.c -index 3320196..a6cf109 100644 +index 7fde9c6..2e31c27 100644 --- a/unlzh.c +++ b/unlzh.c @@ -232,6 +232,12 @@ read_c_len () diff --git a/meta/recipes-extended/gzip/gzip-1.14/wrong-path-fix.patch b/meta/recipes-extended/gzip/gzip-1.15/wrong-path-fix.patch similarity index 92% rename from meta/recipes-extended/gzip/gzip-1.14/wrong-path-fix.patch rename to meta/recipes-extended/gzip/gzip-1.15/wrong-path-fix.patch index 4d5e7a8e02..cff379d133 100644 --- a/meta/recipes-extended/gzip/gzip-1.14/wrong-path-fix.patch +++ b/meta/recipes-extended/gzip/gzip-1.15/wrong-path-fix.patch @@ -1,4 +1,4 @@ -From eda9b1d08c517acbdc5b26c24c94a3985f29c749 Mon Sep 17 00:00:00 2001 +From 885f15530d7e5442d5399b5216fcfc988eb2d721 Mon Sep 17 00:00:00 2001 From: Ming Liu Date: Fri, 21 Nov 2014 04:50:57 -0500 Subject: [PATCH] fix MakeMaker issues with using wrong SHELL/GREP @@ -20,7 +20,7 @@ Upstream-Status: Pending 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/Makefile.am b/Makefile.am -index 23e0d3e..3455878 100644 +index 6491c8b..596fd9a 100644 --- a/Makefile.am +++ b/Makefile.am @@ -95,8 +95,7 @@ SUFFIXES = .in diff --git a/meta/recipes-extended/gzip/gzip_1.14.bb b/meta/recipes-extended/gzip/gzip_1.15.bb similarity index 94% rename from meta/recipes-extended/gzip/gzip_1.14.bb rename to meta/recipes-extended/gzip/gzip_1.15.bb index d6bd36f89f..d1340c36bd 100644 --- a/meta/recipes-extended/gzip/gzip_1.14.bb +++ b/meta/recipes-extended/gzip/gzip_1.15.bb @@ -42,4 +42,4 @@ do_install_ptest() { ${B}/tests/Makefile > ${D}${PTEST_PATH}/src/tests/Makefile } -SRC_URI[sha256sum] = "613d6ea44f1248d7370c7ccdeee0dd0017a09e6c39de894b3c6f03f981191c6b" +SRC_URI[sha256sum] = "545886cf57fa88a65e967fbf705903d7fcb2567c82c7342493e82e8d7b1a210b"