开源软件构建与测试

We truncated the diff of some files because they were too big. If you want to see the full diff for every file, click here.

Changes of Revision 2

_service:tar_scm:emacs.spec Changed

@@ -1,10 +1,14 @@
 %global _hardened_build 1
 %bcond_with bootstrap
 
+%if "0%{?product_family}" != "0"
+%bcond_without bootstrap
+%endif
+
 Name: emacs
 Epoch: 1
-Version: 27.2
-Release: 5
+Version: 28.2
+Release: 4
 Summary: An extensible GNU text editor
 License: GPLv3+ and CC0-1.0
 URL: http://www.gnu.org/software/emacs
@@ -16,11 +20,22 @@
 Source5: emacs.service
 Source6: emacs.desktop
 Source7: emacs-terminal.desktop
-Source8: %{name}.appdata.xml
 
+#patch from fedora
+#https://src.fedoraproject.org/rpms/emacs/blob/rawhide/f/emacs-spellchecker.patch
 Patch6001: emacs-spellchecker.patch
+#https://src.fedoraproject.org/rpms/emacs/blob/rawhide/f/emacs-system-crypto-policies.patch
 Patch6002: emacs-system-crypto-policies.patch
-Patch6003: backport-emacs-glibc-2.34.patch
+
+Patch6003: backport-CVE-2022-45939.patch
+Patch6004: backport-CVE-2022-48337.patch
+Patch6005: backport-CVE-2022-48338.patch
+Patch6006: backport-CVE-2022-48339.patch
+Patch6007:	 backport-CVE-2023-27985.patch
+Patch6008:	 backport-CVE-2023-27986.patch
+Patch6009: backport-0001-CVE-2023-28617.patch
+Patch6010: backport-0002-CVE-2023-28617.patch
+
 Patch9000: emacs-deal-taboo-words.patch
 
 BuildRequires: gcc atk-devel cairo-devel freetype-devel fontconfig-devel dbus-devel giflib-devel
@@ -153,9 +168,12 @@
 ln -s ../../%{name}/%{version}/etc/NEWS doc
 
 %build
+%ifarch loongarch64
+%_update_config_guess
+%_update_config_sub
+%endif
 export CFLAGS="-DMAIL_USE_LOCKF $RPM_OPT_FLAGS -fPIE"
 
-%if !%{with bootstrap}
 # Build GTK+ binary
 mkdir build-gtk && cd build-gtk
 ln -s ../configure .
@@ -171,6 +189,7 @@
 cd ..
 
 # Build Lucid binary
+%if !%{with bootstrap}
 mkdir build-lucid && cd build-lucid
 ln -s ../configure .
 
@@ -260,10 +279,6 @@
 install -d %{buildroot}/%{_datadir}/pkgconfig
 install -p -m 0644 emacs.pc %{buildroot}/%{_datadir}/pkgconfig
 
-mkdir -p %{buildroot}/%{_datadir}/appdata
-cp -a %SOURCE8 %{buildroot}/%{_datadir}/appdata
-rm %{buildroot}/%{_datadir}/metainfo/emacs.appdata.xml
-
 install -d %{buildroot}%{_rpmconfigdir}/macros.d
 install -p -m 0644 macros.emacs %{buildroot}%{_rpmconfigdir}/macros.d/
 
@@ -283,6 +298,10 @@
 desktop-file-install --dir=%{buildroot}%{_datadir}/applications \
 %SOURCE7
 
+# We don't ship the client variants yet
+rm %{buildroot}%{_datadir}/applications/emacsclient.desktop
+rm %{buildroot}%{_datadir}/applications/emacsclient-mail.desktop
+
 rm -f *-filelist {common,el}-*-files
 
 ( TOPDIR=${PWD}
@@ -343,9 +362,10 @@
 %license etc/COPYING
 %attr(0755,-,-) %ghost %{_bindir}/emacs
 %{_bindir}/emacs-%{version}
-%{_datadir}/appdata/%{name}.appdata.xml
 %{_datadir}/icons/hicolor/*
 %{_datadir}/applications/emacs.desktop
+%{_datadir}/applications/emacs-mail.desktop
+%{_metainfodir}/%{name}.metainfo.xml
 
 %files devel
 %{_includedir}/emacs-module.h
@@ -399,6 +419,27 @@
 %{_mandir}/*/*
 
 %changelog
+* Fri Mar 24 2023 zhangpan <zhangpan103@h-partners.com> - 1:28.2-4
+- fix CVE-2023-28617
+
+* Wed Mar 15 2023 yanglongkang <yanglongkang@h-partners.com> - 1:28.2-3
+- fix CVE-2023-27985 CVE-2023-27986
+
+* Wed Feb 22 2023 zhangpan <zhangpan103@h-partners.com> - 1:28.2-2
+- fix CVE-2022-48337 CVE-2022-48338 CVE-2022-48339
+
+* Thu Feb 02 2023 zhouwenpei <zhouwenpei1@h-partners.com> - 1:28.2-1
+- update to 28.2
+
+* Thu Dec 01 2022 wangkerong <wangkerong@h-partners.com> - 1:27.2-8
+- fix CVE-2022-45939
+
+* Fri Nov 18 2022 Wenlong Zhang<zhangwenlong@loongson.cn> - 1:27.2-7
+- add loongarch support for emacs
+
+* Fri Aug 26 2022 zhujunhao <zhujunhao11@huawei.com> - 1:27.2-6
+- close bootstrap with product_family
+
 * Sat Jun 11 2022 wangkeorng <wangkeorng@huawei.com> - 1:27.2-5
 - delete macro in changelog

_service:tar_scm:backport-0001-CVE-2023-28617.patch Added

@@ -0,0 +1,32 @@
+From 8f8ec2ccf3f5ef8f38d68ec84a7e4739c45db485 Mon Sep 17 00:00:00 2001
+From: Xi Lu <lx@shellcodes.org>
+Date: Sat, 18 Feb 2023 18:03:28 +0800
+Subject: * lisp/ob-latex.el (org-babel-execute:latex): Fix command injection
+ vulnerability
+
+Link: https://orgmode.org/list/tencent_5C4D5D0DEFDDBBFC66F855703927E60C7706@qq.com
+
+TINYCHANGE
+
+Reference:https://git.savannah.gnu.org/cgit/emacs/org-mode.git/commit/?id=8f8ec2ccf3f5ef8f38d68ec84a7e4739c45db485
+Conflict:NA
+
+---
+ lisp/org/ob-latex.el | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/lisp/org/ob-latex.el b/lisp/org/ob-latex.el
+index 428907a..a0154bf 100644
+--- a/lisp/org/ob-latex.el
++++ b/lisp/org/ob-latex.el
+@@ -180,7 +180,7 @@ This function is called by `org-babel-execute-src-block'."
+ 	 tmp-pdf
+ (list org-babel-latex-pdf-svg-process)
+ extension err-msg log-buf)))
+- (shell-command (format "mv %s %s" img-out out-file)))))
++ (rename-file img-out out-file t))))
+ ((string-suffix-p ".tikz" out-file)
+ 	 (when (file-exists-p out-file) (delete-file out-file))
+ 	 (with-temp-file out-file
+-- 
+cgit v1.1

_service:tar_scm:backport-0002-CVE-2023-28617.patch Added

@@ -0,0 +1,46 @@
+From a8006ea580ed74f27f974d60b598143b04ad1741 Mon Sep 17 00:00:00 2001
+From: Xi Lu <lx@shellcodes.org>
+Date: Sat, 11 Mar 2023 18:53:37 +0800
+Subject: * lisp/ob-latex.el: Fix command injection vulnerability
+
+(org-babel-execute:latex):
+Replaced the `(shell-command "mv BAR NEWBAR")' with `rename-file'.
+
+TINYCHANGE
+
+Reference:https://git.savannah.gnu.org/cgit/emacs/org-mode.git/commit/?id=a8006ea580ed74f27f974d60b598143b04ad1741
+Conflict:NA
+
+---
+ lisp/org/ob-latex.el | 13 +++++--------
+ 1 file changed, 5 insertions(+), 8 deletions(-)
+
+diff --git a/lisp/org/ob-latex.el b/lisp/org/ob-latex.el
+index a2c24b3..ce39628 100644
+--- a/lisp/org/ob-latex.el
++++ b/lisp/org/ob-latex.el
+@@ -218,17 +218,14 @@ This function is called by `org-babel-execute-src-block'."
+ 	 (if (string-suffix-p ".svg" out-file)
+ 		(progn
+ 		 (shell-command "pwd")
+-		 (shell-command (format "mv %s %s"
+-					 (concat (file-name-sans-extension tex-file) "-1.svg")
+-					 out-file)))
++ (rename-file (concat (file-name-sans-extension tex-file) "-1.svg")
++ out-file t))
+ 	 (error "SVG file produced but HTML file requested")))
+ 	 ((file-exists-p (concat (file-name-sans-extension tex-file) ".html"))
+ 	 (if (string-suffix-p ".html" out-file)
+-		(shell-command "mv %s %s"
+-			 (concat (file-name-sans-extension tex-file)
+-				 ".html")
+-			 out-file)
+-	 (error "HTML file produced but SVG file requested")))))
++ (rename-file (concat (file-name-sans-extension tex-file) ".html")
++ out-file t)
++ (error "HTML file produced but SVG file requested")))))
+ 	 ((or (string= "pdf" extension) imagemagick)
+ 	 (with-temp-file tex-file
+ 	 (require 'ox-latex)
+-- 
+cgit v1.1

_service:tar_scm:backport-CVE-2022-45939.patch Added

@@ -0,0 +1,272 @@
+From d48bb4874bc6cd3e69c7a15fc3c91cc141025c51 Mon Sep 17 00:00:00 2001
+From: lu4nx <lx@shellcodes.org>
+Date: Fri, 25 Nov 2022 14:38:29 +0800
+Subject: Fixed ctags local command execute vulnerability
+
+* lib-src/etags.c:
+
+(clean_matched_file_tag): New function
+(do_move_file): New function
+(readline_internal):
+Add `leave_cr` parameter, if true, include the \r character
+
+* test/manual/etags/CTAGS.good_crlf: New file
+* test/manual/etags/CTAGS.good_update: New file
+* test/manual/etags/crlf: New file
+* test/manual/etags/Makefile: Add `ctags -u` test cases
+
+Conflict:Removed test case related code, so the patch is over 9000 lines, it's too big
+Reference:https://git.savannah.gnu.org/cgit/emacs.git/commit/?id=d48bb4874bc6cd3e69c7a15fc3c91cc141025c51
+---
+ lib-src/etags.c | 149 +-
+ 1 files changed, 113 insertions(+), 36 deletions(-)
+
+diff --git a/lib-src/etags.c b/lib-src/etags.c
+index 3107c7b..b6f51df 100644
+--- a/lib-src/etags.c
++++ b/lib-src/etags.c
+@@ -375,7 +375,7 @@ static void just_read_file (FILE *);
+ 
+ static language *get_language_from_langname (const char *);
+ static void readline (linebuffer *, FILE *);
+-static ptrdiff_t readline_internal (linebuffer *, FILE *, char const *);
++static ptrdiff_t readline_internal (linebuffer *, FILE *, char const *, const bool);
+ static bool nocase_tail (const char *);
+ static void get_tag (char *, char **);
+ static void get_lispy_tag (char *);
+@@ -399,7 +399,9 @@ static void free_fdesc (fdesc *);
+ static void pfnote (char *, bool, char *, ptrdiff_t, intmax_t, intmax_t);
+ static void invalidate_nodes (fdesc *, node **);
+ static void put_entries (node *);
++static void clean_matched_file_tag (char const * const, char const * const);
+ 
++static void do_move_file (const char *, const char *);
+ static char *concat (const char *, const char *, const char *);
+ static char *skip_spaces (char *);
+ static char *skip_non_spaces (char *);
+@@ -1332,7 +1334,7 @@ main (int argc, char **argv)
+ 		 if (parsing_stdin)
+ 		 fatal ("cannot parse standard input "
+ 			 "AND read file names from it");
+-		 while (readline_internal (&filename_lb, stdin, "-") > 0)
++		 while (readline_internal (&filename_lb, stdin, "-", false) > 0)
+ 		 process_file_name (filename_lb.buffer, lang);
+ 		}
+ 	 else
+@@ -1380,9 +1382,6 @@ main (int argc, char **argv)
+ /* From here on, we are in (CTAGS && !cxref_style) */
+ if (update)
+ {
+- char *cmd =
+-	xmalloc (strlen (tagfile) + whatlen_max +
+-		 sizeof "mv..OTAGS;grep -Fv '\t\t' OTAGS >;rm OTAGS");
+ for (i = 0; i < current_arg; ++i)
+ 	{
+ 	 switch (argbufferi.arg_type)
+@@ -1393,17 +1392,8 @@ main (int argc, char **argv)
+ 	 default:
+ 	 continue;		/* the for loop */
+ 	 }
+-	 char *z = stpcpy (cmd, "mv ");
+-	 z = stpcpy (z, tagfile);
+-	 z = stpcpy (z, " OTAGS;grep -Fv '\t");
+-	 z = stpcpy (z, argbufferi.what);
+-	 z = stpcpy (z, "\t' OTAGS >");
+-	 z = stpcpy (z, tagfile);
+-	 strcpy (z, ";rm OTAGS");
+-	 if (system (cmd) != EXIT_SUCCESS)
+-	 fatal ("failed to execute shell command");
++ clean_matched_file_tag (tagfile, argbufferi.what);
+ 	}
+- free (cmd);
+ append_to_tagfile = true;
+ }
+ 
+@@ -1448,6 +1438,51 @@ main (int argc, char **argv)
+ return EXIT_SUCCESS;
+ }
+ 
++/*
++ * Equivalent to: mv tags OTAGS;grep -Fv ' filename ' OTAGS >tags;rm OTAGS
++ */
++static void
++clean_matched_file_tag (const char* tagfile, const char* match_file_name)
++{
++ FILE *otags_f = fopen ("OTAGS", "wb");
++ FILE *tag_f = fopen (tagfile, "rb");
++
++ if (otags_f == NULL)
++ pfatal ("OTAGS");
++
++ if (tag_f == NULL)
++ pfatal (tagfile);
++
++ int buf_len = strlen (match_file_name) + sizeof ("\t\t ") + 1;
++ char *buf = xmalloc (buf_len);
++ snprintf (buf, buf_len, "\t%s\t", match_file_name);
++
++ linebuffer line;
++ linebuffer_init (&line);
++ while (readline_internal (&line, tag_f, tagfile, true) > 0)
++ {
++ if (ferror (tag_f))
++ pfatal (tagfile);
++
++ if (strstr (line.buffer, buf) == NULL)
++ {
++ fprintf (otags_f, "%s\n", line.buffer);
++ if (ferror (tag_f))
++ pfatal (tagfile);
++ }
++ }
++ free (buf);
++ free (line.buffer);
++
++ if (fclose (otags_f) == EOF)
++ pfatal ("OTAGS");
++
++ if (fclose (tag_f) == EOF)
++ pfatal (tagfile);
++
++ do_move_file ("OTAGS", tagfile);
++ return;
++}
+ 
+ /*
+ * Return a compressor given the file name. If EXTPTR is non-zero,
+@@ -1831,7 +1866,7 @@ find_entries (FILE *inf)
+ 
+ /* Else look for sharp-bang as the first two characters. */
+ if (parser == NULL
+- && readline_internal (&lb, inf, infilename) > 0
++ && readline_internal (&lb, inf, infilename, false) > 0
+ && lb.len >= 2
+ && lb.buffer0 == '#'
+ && lb.buffer1 == '!')
+@@ -6878,7 +6913,7 @@ analyze_regex (char *regex_arg)
+ 	if (regexfp == NULL)
+ 	 pfatal (regexfile);
+ 	linebuffer_init (&regexbuf);
+-	while (readline_internal (&regexbuf, regexfp, regexfile) > 0)
++	while (readline_internal (&regexbuf, regexfp, regexfile, false) > 0)
+ 	 analyze_regex (regexbuf.buffer);
+ 	free (regexbuf.buffer);
+ 	if (fclose (regexfp) != 0)
+@@ -7226,11 +7261,13 @@ get_lispy_tag (register char *bp)
+ 
+ /*
+ * Read a line of text from `stream' into `lbp', excluding the
+- * newline or CR-NL, if any. Return the number of characters read from
+- * `stream', which is the length of the line including the newline.
++ * newline or CR-NL (if `leave_cr` is false), if any. Return the
++ * number of characters read from `stream', which is the length
++ * of the line including the newline.
+ *
+- * On DOS or Windows we do not count the CR character, if any before the
+- * NL, in the returned length; this mirrors the behavior of Emacs on those
++ * On DOS or Windows, if `leave_cr` is false, we do not count the
++ * CR character, if any before the NL, in the returned length;
++ * this mirrors the behavior of Emacs on those
+ * platforms (for text files, it translates CR-NL to NL as it reads in the
+ * file).
+ *
+@@ -7238,7 +7275,7 @@ get_lispy_tag (register char *bp)
+ * appended to `filebuf'.
+ */
+ static ptrdiff_t
+-readline_internal (linebuffer *lbp, FILE *stream, char const *filename)
++readline_internal (linebuffer *lbp, FILE *stream, char const *filename, const bool leave_cr)
+ {
+ char *buffer = lbp->buffer;
+ char *p = lbp->buffer;
+@@ -7268,19 +7305,19 @@ readline_internal (linebuffer *lbp, FILE *stream, char const *filename)
+ 	 break;
+ 	}
+ if (c == '\n')
+-	{
+-	 if (p > buffer && p-1 == '\r')
+-	 {
+-	 p -= 1;
+-	 chars_deleted = 2;
+-	 }
+-	 else
+-	 {
+-	 chars_deleted = 1;
+-	 }
+-	 *p = '\0';
+-	 break;
+-	}
++ {

_service:tar_scm:backport-CVE-2022-48337.patch Added

@@ -0,0 +1,107 @@
+From 01a4035c869b91c153af9a9132c87adb7669ea1c Mon Sep 17 00:00:00 2001
+From: lu4nx <lx@shellcodes.org>
+Date: Tue, 6 Dec 2022 15:42:40 +0800
+Subject: Fix etags local command injection vulnerability
+
+* lib-src/etags.c: (escape_shell_arg_string): New function.
+(process_file_name): Use it to quote file names passed to the
+shell. (Bug#59817)
+
+Reference:https://git.savannah.gnu.org/cgit/emacs.git/commit/?id=01a4035c869b91c153af9a9132c87adb7669ea1c
+Conflict:NA
+---
+ lib-src/etags.c | 63 ++++++++++++++++++++++++++++++++++++++++++++++++++++-----
+ 1 file changed, 58 insertions(+), 5 deletions(-)
+
+diff --git a/lib-src/etags.c b/lib-src/etags.c
+index d1d2085..ba0092c 100644
+--- a/lib-src/etags.c
++++ b/lib-src/etags.c
+@@ -401,6 +401,7 @@ static void invalidate_nodes (fdesc *, node **);
+ static void put_entries (node *);
+ static void clean_matched_file_tag (char const * const, char const * const);
+ 
++static char *escape_shell_arg_string (char *);
+ static void do_move_file (const char *, const char *);
+ static char *concat (const char *, const char *, const char *);
+ static char *skip_spaces (char *);
+@@ -1713,13 +1714,16 @@ process_file_name (char *file, language *lang)
+ else
+ 	{
+ #if MSDOS || defined (DOS_NT)
+-	 char *cmd1 = concat (compr->command, " \"", real_name);
+-	 char *cmd = concat (cmd1, "\" > ", tmp_name);
++ int buf_len = strlen (compr->command) + strlen (" \"\" > \"\"") + strlen (real_name) + strlen (tmp_name) + 1;
++ char *cmd = xmalloc (buf_len);
++ snprintf (cmd, buf_len, "%s \"%s\" > \"%s\"", compr->command, real_name, tmp_name);
+ #else
+-	 char *cmd1 = concat (compr->command, " '", real_name);
+-	 char *cmd = concat (cmd1, "' > ", tmp_name);
++ char *new_real_name = escape_shell_arg_string (real_name);
++ char *new_tmp_name = escape_shell_arg_string (tmp_name);
++ int buf_len = strlen (compr->command) + strlen (" > ") + strlen (new_real_name) + strlen (new_tmp_name) + 1;
++ char *cmd = xmalloc (buf_len);
++ snprintf (cmd, buf_len, "%s %s > %s", compr->command, new_real_name, new_tmp_name);
+ #endif
+-	 free (cmd1);
+ 	 inf = (system (cmd) == -1
+ 		 ? NULL
+ 		 : fopen (tmp_name, "r" FOPEN_BINARY));
+@@ -7707,6 +7711,55 @@ etags_mktmp (void)
+ return templt;
+ }
+ 
++/*
++ * Adds single quotes around a string, if found single quotes, escaped it.
++ * Return a newly-allocated string.
++ *
++ * For example:
++ * escape_shell_arg_string("test.txt") => 'test.txt'
++ * escape_shell_arg_string("'test.txt") => ''\''test.txt'
++ */
++static char *
++escape_shell_arg_string (char *str)
++{
++ char *p = str;
++ int need_space = 2; /* ' at begin and end */
++
++ while (*p != '\0')
++ {
++ if (*p == '\'')
++ need_space += 4; /* ' to '\'', length is 4 */
++ else
++ need_space++;
++
++ p++;
++ }
++
++ char *new_str = xnew (need_space + 1, char);
++ new_str0 = '\'';
++ new_strneed_space-1 = '\'';
++
++ int i = 1; /* skip first byte */
++ p = str;
++ while (*p != '\0')
++ {
++ new_stri = *p;
++ if (*p == '\'')
++ {
++ new_stri+1 = '\\';
++ new_stri+2 = '\'';
++ new_stri+3 = '\'';
++ i += 3;
++ }
++
++ i++;
++ p++;
++ }
++
++ new_strneed_space = '\0';
++ return new_str;
++}
++
+ static void
+ do_move_file(const char *src_file, const char *dst_file)
+ {
+-- 
+cgit v1.1

_service:tar_scm:backport-CVE-2022-48338.patch Added

@@ -0,0 +1,29 @@
+From 9a3b08061feea14d6f37685ca1ab8801758bfd1c Mon Sep 17 00:00:00 2001
+From: Xi Lu <lx@shellcodes.org>
+Date: Fri, 23 Dec 2022 12:52:48 +0800
+Subject: Fix ruby-mode.el local command injection vulnerability (bug#60268)
+
+* lisp/progmodes/ruby-mode.el
+(ruby-find-library-file): Fix local command injection vulnerability.
+
+Reference:https://git.savannah.gnu.org/cgit/emacs.git/commit/?id=9a3b08061feea14d6f37685ca1ab8801758bfd1c
+Conflict:NA
+---
+ lisp/progmodes/ruby-mode.el | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/lisp/progmodes/ruby-mode.el b/lisp/progmodes/ruby-mode.el
+index 1f3e9b6..a4aa619 100644
+--- a/lisp/progmodes/ruby-mode.el
++++ b/lisp/progmodes/ruby-mode.el
+@@ -1899,7 +1899,7 @@ or `gem' statement around point."
+ (setq feature-name (read-string "Feature name: " init))))
+ (let ((out
+ (substring
+- (shell-command-to-string (concat "gem which " feature-name))
++ (shell-command-to-string (concat "gem which " (shell-quote-argument feature-name)))
+ 0 -1)))
+ (if (string-match-p "\\`ERROR" out)
+ (user-error "%s" out)
+-- 
+cgit v1.1

_service:tar_scm:backport-CVE-2022-48339.patch Added

@@ -0,0 +1,29 @@
+From 1b4dc4691c1f87fc970fbe568b43869a15ad0d4c Mon Sep 17 00:00:00 2001
+From: Xi Lu <lx@shellcodes.org>
+Date: Sat, 24 Dec 2022 16:28:54 +0800
+Subject: Fix htmlfontify.el command injection vulnerability.
+
+* lisp/htmlfontify.el (hfy-text-p): Fix command injection
+vulnerability. (Bug#60295)
+
+Reference:https://git.savannah.gnu.org/cgit/emacs.git/commit/?id=1b4dc4691c1f87fc970fbe568b43869a15ad0d4c
+Conflict:NA
+---
+ lisp/htmlfontify.el | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/lisp/htmlfontify.el b/lisp/htmlfontify.el
+index df4c6ab..389b929 100644
+--- a/lisp/htmlfontify.el
++++ b/lisp/htmlfontify.el
+@@ -1850,7 +1850,7 @@ Hardly bombproof, but good enough in the context in which it is being used."
+ 
+ (defun hfy-text-p (srcdir file)
+ "Is SRCDIR/FILE text? Use `hfy-istext-command' to determine this."
+- (let* ((cmd (format hfy-istext-command (expand-file-name file srcdir)))
++ (let* ((cmd (format hfy-istext-command (shell-quote-argument (expand-file-name file srcdir))))
+ (rsp (shell-command-to-string cmd)))
+ (string-match "text" rsp)))
+ 
+-- 
+cgit v1.1

_service:tar_scm:backport-CVE-2023-27985.patch Added

@@ -0,0 +1,64 @@
+From d32091199ae5de590a83f1542a01d75fba000467 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ulrich=20M=C3=BCller?= <ulm@gentoo.org>
+Date: Mon, 19 Dec 2022 16:51:20 +0100
+Subject: Fix quoted argument in emacsclient-mail.desktop Exec key
+
+Apparently the emacsclient-mail.desktop file doesn't conform to the
+Desktop Entry Specification at
+https://specifications.freedesktop.org/desktop-entry-spec/desktop-entry-spec-latest.html#exec-variables
+which says about the Exec key:
+
+| Field codes must not be used inside a quoted argument, the result of
+| field code expansion inside a quoted argument is undefined.
+
+However, the %u field code is used inside a quoted argument of the
+Exec key in both the Desktop Entry and Desktop Action new-window
+sections.
+* etc/emacsclient-mail.desktop (Exec): The Desktop Entry
+Specification does not allow field codes like %u inside a quoted
+argument. Work around it by passing %u as first parameter ($1)
+to the shell wrapper.
+* etc/emacsclient.desktop (Exec): Use `sh` rather than `placeholder`
+as the command name of the shell wrapper. (Bug#60204)
+---
+ etc/emacsclient-mail.desktop | 4 ++--
+ etc/emacsclient.desktop | 2 +-
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/etc/emacsclient-mail.desktop b/etc/emacsclient-mail.desktop
+index b575a41..91df122 100644
+--- a/etc/emacsclient-mail.desktop
++++ b/etc/emacsclient-mail.desktop
+@@ -1,7 +1,7 @@
+ Desktop Entry
+ Categories=Network;Email;
+ Comment=GNU Emacs is an extensible, customizable text editor - and more
+-Exec=sh -c "exec emacsclient --alternate-editor= --display=\\"\\$DISPLAY\\" --eval \\\$message-mailto\\\\ \\\\\\"%u\\\\\\"\\\$"
++Exec=sh -c "exec emacsclient --alternate-editor= --display=\\"\\$DISPLAY\\" --eval \\"(message-mailto \\\\\\"\\$1\\\\\\")\\"" sh %u
+ Icon=emacs
+ Name=Emacs (Mail, Client)
+ MimeType=x-scheme-handler/mailto;
+@@ -13,7 +13,7 @@ Actions=new-window;new-instance;
+ 
+ Desktop Action new-window
+ Name=New Window
+-Exec=emacsclient --alternate-editor= --create-frame --eval "(message-mailto \\"%u\\")"
++Exec=sh -c "exec emacsclient --alternate-editor= --create-frame --eval \\"(message-mailto \\\\\\"\\$1\\\\\\")\\"" sh %u
+ 
+ Desktop Action new-instance
+ Name=New Instance
+diff --git a/etc/emacsclient.desktop b/etc/emacsclient.desktop
+index 1ecdecf..a9f840c7 100644
+--- a/etc/emacsclient.desktop
++++ b/etc/emacsclient.desktop
+@@ -3,7 +3,7 @@ Name=Emacs (Client)
+ GenericName=Text Editor
+ Comment=Edit text
+ MimeType=text/english;text/plain;text/x-makefile;text/x-c++hdr;text/x-c++src;text/x-chdr;text/x-csrc;text/x-java;text/x-moc;text/x-pascal;text/x-tcl;text/x-tex;application/x-shellscript;text/x-c;text/x-c++;
+-Exec=sh -c "if -n \\"\\$*\\" ; then exec emacsclient --alternate-editor= --display=\\"\\$DISPLAY\\" \\"\\$@\\"; else exec emacsclient --alternate-editor= --create-frame; fi" placeholder %F
++Exec=sh -c "if -n \\"\\$*\\" ; then exec emacsclient --alternate-editor= --display=\\"\\$DISPLAY\\" \\"\\$@\\"; else exec emacsclient --alternate-editor= --create-frame; fi" sh %F
+ Icon=emacs
+ Type=Application
+ Terminal=false
+-- 
+cgit v1.1

_service:tar_scm:backport-CVE-2023-27986.patch Added

@@ -0,0 +1,50 @@
+From 3c1693d08b0a71d40a77e7b40c0ebc42dca2d2cc Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ulrich=20M=C3=BCller?= <ulm@gentoo.org>
+Date: Tue, 7 Mar 2023 18:25:37 +0100
+Subject: Fix Elisp code injection vulnerability in emacsclient-mail.desktop
+
+A crafted mailto URI could contain unescaped double-quote
+characters, allowing injection of Elisp code. Therefore, any
+'\' and '"' characters are replaced by '\\' and '\"', using Bash
+pattern substitution (which is not available in the POSIX shell).
+
+We want to pass literal 'u=${1//\\/\\\\}; u=${u//\"/\\\"};' in the
+bash -c command, but in the desktop entry '"', '$', and '\' must
+be escaped as '\\"', '\\$', and '\\\\', respectively (backslashes
+are expanded twice, see the Desktop Entry Specification).
+
+Reported by Gabriel Corona <gabriel.corona@free.fr>.
+
+* etc/emacsclient-mail.desktop (Exec): Escape backslash and
+double-quote characters.
+---
+ etc/emacsclient-mail.desktop | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/etc/emacsclient-mail.desktop b/etc/emacsclient-mail.desktop
+index 91df122..49c6f99 100644
+--- a/etc/emacsclient-mail.desktop
++++ b/etc/emacsclient-mail.desktop
+@@ -1,7 +1,10 @@
+ Desktop Entry
+ Categories=Network;Email;
+ Comment=GNU Emacs is an extensible, customizable text editor - and more
+-Exec=sh -c "exec emacsclient --alternate-editor= --display=\\"\\$DISPLAY\\" --eval \\"(message-mailto \\\\\\"\\$1\\\\\\")\\"" sh %u
++# We want to pass the following commands to the shell wrapper:
++# u=${1//\\/\\\\}; u=${u//\"/\\\"}; exec emacsclient --alternate-editor= --display="$DISPLAY" --eval "(message-mailto \"$u\")"
++# Special chars '"', '$', and '\' must be escaped as '\\"', '\\$', and '\\\\'.
++Exec=bash -c "u=\\${1//\\\\\\\\/\\\\\\\\\\\\\\\\}; u=\\${u//\\\\\\"/\\\\\\\\\\\\\\"}; exec emacsclient --alternate-editor= --display=\\"\\$DISPLAY\\" --eval \\"(message-mailto \\\\\\"\\$u\\\\\\")\\"" bash %u
+ Icon=emacs
+ Name=Emacs (Mail, Client)
+ MimeType=x-scheme-handler/mailto;
+@@ -13,7 +16,7 @@ Actions=new-window;new-instance;
+ 
+ Desktop Action new-window
+ Name=New Window
+-Exec=sh -c "exec emacsclient --alternate-editor= --create-frame --eval \\"(message-mailto \\\\\\"\\$1\\\\\\")\\"" sh %u
++Exec=bash -c "u=\\${1//\\\\\\\\/\\\\\\\\\\\\\\\\}; u=\\${u//\\\\\\"/\\\\\\\\\\\\\\"}; exec emacsclient --alternate-editor= --create-frame --eval \\"(message-mailto \\\\\\"\\$u\\\\\\")\\"" bash %u
+ 
+ Desktop Action new-instance
+ Name=New Instance
+-- 
+cgit v1.1

_service:tar_scm:backport-emacs-glibc-2.34.patch Deleted

@@ -1,39 +0,0 @@
-From f97e07ea807cc6d38774a3888a15091b20645ac6 Mon Sep 17 00:00:00 2001
-From: Paul Eggert <eggert@cs.ucla.edu>
-Date: Tue, 9 Mar 2021 11:22:59 -0800
-Subject: PATCH Port alternate signal stack to upcoming glibc 2.34
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
- 
-* src/sysdep.c (sigsegv_stack): Increase size to 64 KiB and align
-it to max_align_t. This copies from Gnulibâ€™s c-stack.c, and works
-around a portability bug in draft glibc 2.34, which no longer
-defines SIGSTKSZ when _GNU_SOURCE is defined.
----
- src/sysdep.c | 10 +++++++++-
- 1 file changed, 9 insertions(+), 1 deletion(-)
- 
-diff --git a/src/sysdep.c b/src/sysdep.c
-index 941b4e2fa2..24d8832b2f 100644
---- a/src/sysdep.c
-+++ b/src/sysdep.c
-@@ -1785,7 +1785,15 @@ handle_arith_signal (int sig)
- 
- /* Alternate stack used by SIGSEGV handler below. */
- 
--static unsigned char sigsegv_stackSIGSTKSZ;
-+/* Storage for the alternate signal stack.
-+ 64 KiB is not too large for Emacs, and is large enough
-+ for all known platforms. Smaller sizes may run into trouble.
-+ For example, libsigsegv 2.6 through 2.8 have a bug where some
-+ architectures use more than the Linux default of an 8 KiB alternate
-+ stack when deciding if a fault was caused by stack overflow. */
-+static max_align_t sigsegv_stack(64 * 1024
-+				 + sizeof (max_align_t) - 1)
-+				 / sizeof (max_align_t);
- 
- 
- /* Return true if SIGINFO indicates a stack overflow. */
--- 
-2.29.2
\ No newline at end of file

_service:tar_scm:emacs-spellchecker.patch Changed

@@ -1,16 +1,23 @@
 diff --git a/lisp/textmodes/ispell.el b/lisp/textmodes/ispell.el
-index 1d28de7..1daec44 100644
+index 0a3a49d868..b6c0975857 100644
 --- a/lisp/textmodes/ispell.el
 +++ b/lisp/textmodes/ispell.el
-@@ -200,9 +200,9 @@
- ;; cause an error; and one of the other spelling engines below is
- ;; almost certainly installed in any case, for enchant to use.
+@@ -191,12 +191,12 @@ Must be greater than 1."
+   :type 'integer)
+ 
  (defcustom ispell-program-name
 -  (or (executable-find "aspell")
-+  (or (executable-find "hunspell")
+-      (executable-find "ispell")
++  ;; Enchant is commonly installed as `enchant-2', so use this
++  ;; name and avoid old versions of `enchant'.
++  (or (executable-find "enchant-2")
+       (executable-find "hunspell")
+-      ;; Enchant is commonly installed as `enchant-2', so use this
+-      ;; name and avoid old versions of `enchant'.
+-      (executable-find "enchant-2")
 +      (executable-find "aspell")
-       (executable-find "ispell")
--      (executable-find "hunspell")
++      (executable-find "ispell")
        "ispell")
    "Program invoked by \\ispell-word and \\ispell-region commands."
    :type 'string
+

_service Changed

_service:tar_scm:emacs-27.2.tar.xz -> _service:tar_scm:emacs-28.2.tar.xz Changed

_service:tar_scm:emacs.appdata.xml Deleted

@@ -1,64 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-
-<component type="desktop">
- <id>emacs.desktop</id>
- <metadata_license>CC0-1.0</metadata_license>
- <project_license>GPL-3.0+</project_license>
- <name>GNU Emacs</name>
- <summary>Edit text files, view pictures and binary files</summary>
- <description>
- 
- Emacs is a powerful, customizable, self-documenting, modeless
- editor. It is used primarely to edit text, including text
- documents, source code of programs, web pages and XML documents,
- but can also be used to display and edit binary files.
- 
- 
- Emacs allows efficient editing of text with shortcuts which
- allow operating on letters, words, sentences, and paragraphs as
- single units. This includes both moving around and operations
- like copying, deleting, transposing, and pasting. Macros can be
- conveniently defined to repeat sequences of commands. In
- addition, Emacs is (partially) built in a scripting language
- (elisp) which can also be used to define further functions
- extending existing capabilities.
- 
- 
- Emacs has extensive support for editing source code, including
- programmable syntax highlighting, automatic indentation, source
- code indexing, overview modes, and navigation based on language
- specific units like functions and blocks. It is also possible to
- invoke the compiler from within Emacs and easily move between
- compiler output and corresponding positions in the source.
- 
- 
- Emacs has multiple modules which provide further functionality.
- This provides the capability to read mail, news, browse
- pictures, read man and info pages, browse the web, execute
- arbitrary programs, and more, without leaving the editor.
- 
- </description>
- <screenshots>
- <screenshot type="default" height="888" width="1595">
- <image>http://in.waw.pl/~zbyszek/fedora/emacs-two-buffers.png</image>
- </screenshot>
- <screenshot height="667" width="1199">
- <image>http://in.waw.pl/~zbyszek/fedora/emacs-editing-xml.png</image>
- </screenshot>
- <screenshot height="572" width="1019">
- <image>http://in.waw.pl/~zbyszek/fedora/emacs-hexl-mode.png</image>
- </screenshot>
- <screenshot height="667" width="1199">
- <image>http://in.waw.pl/~zbyszek/fedora/emacs-showing-svg.png</image>
- </screenshot>
- <screenshot height="439" width="794">
- <image>http://in.waw.pl/~zbyszek/fedora/emacs-with-python-source.png</image>
- </screenshot>
- </screenshots>
- <url type="homepage">http://www.gnu.org/software/emacs/</url>
- <url type="bugtracker">https://www.gnu.org/software/emacs/manual/html_node/emacs/Bugs.html</url>
- <url type="donation">https://my.fsf.org/donate/</url>
- <url type="help">https://www.gnu.org/software/emacs/manual/</url>
- <update_contact>zbyszek@in.waw.pl</update_contact>
- <translation/>
-</component>