Skip to Content.
Sympa Menu

sm-commit - [SM-Commit] GIT changes to master grimoire by Thomas Orgis (13377fddd81b7c828d6e33f974af7b03c17bed84)

sm-commit AT lists.ibiblio.org

Subject: Source Mage code commit list

List archive

Chronological Thread  
  • From: Thomas Orgis <scm AT sourcemage.org>
  • To: sm-commit AT lists.ibiblio.org
  • Subject: [SM-Commit] GIT changes to master grimoire by Thomas Orgis (13377fddd81b7c828d6e33f974af7b03c17bed84)
  • Date: Tue, 2 Jan 2024 09:32:49 +0000

GIT changes to master grimoire by Thomas Orgis <sobukus AT sourcemage.org>:

dev/null |binary
disk/lvm/BUILD | 2 +-
disk/lvm/HISTORY | 3 +++
libs/libdrm/DETAILS | 6 +-----
libs/libdrm/HISTORY | 5 +++++
5 files changed, 10 insertions(+), 6 deletions(-)

New commits:
commit 13377fddd81b7c828d6e33f974af7b03c17bed84
Author: Thomas Orgis <sobukus AT sourcemage.org>
Commit: Thomas Orgis <sobukus AT sourcemage.org>

libdrm: un-break by dropping GPG signature

The used key was missing from drm.gpg, apparently (at least for my gpg
command ... where did Treeve get the key from?!). We discussed this again
and again: Relying on upstream sigs is bad. At least we'd need to also
verify the hash of the sig.

Otherwise, the file can be changed by upstream or attacker with access
to a key at will. And regarding access to a key: We accumulate key after
key and increase the attack surface for compromising one of them.

Thinking again: Maybe the key just expired right now. That is the other
reason: Upstream sigs break at predetermined times whent he keys expire
and gpg refuses to check using them!

DO NOT USE UPSTREAM GPG. We should really purge that. Now.

Upstream signatures should be checked once by the developer doing an
update, locally. Then the hash enters the grimoire. This is stable and
as trustworthy as we can get.

Now we need that spell that installs and updates a database (with wrapper
script) of upstream keys for mages to use.

commit a4185e43ce05dc4ba690002bb69c93bb5f237656
Author: Thomas Orgis <sobukus AT sourcemage.org>
Commit: Thomas Orgis <sobukus AT sourcemage.org>

lvm2: un-break build

diff --git a/disk/lvm/BUILD b/disk/lvm/BUILD
index cd39f99..b20fe09 100755
--- a/disk/lvm/BUILD
+++ b/disk/lvm/BUILD
@@ -1,4 +1,4 @@
-LDFLAGS+="-fuse-ld=bfd" &&
+LDFLAGS+=" -fuse-ld=bfd" &&
./configure --build=$BUILD \
--prefix=$INSTALL_ROOT/usr \
--sbindir=$INSTALL_ROOT/sbin \
diff --git a/disk/lvm/HISTORY b/disk/lvm/HISTORY
index d255d32..8645f6f 100644
--- a/disk/lvm/HISTORY
+++ b/disk/lvm/HISTORY
@@ -1,3 +1,6 @@
+2024-01-02 Thomas Orgis <sobukus AT sourcemage.org>
+ * BUILD: Un-break build with non-empty LDFLAGS (as-needed, anyone?).
+
2023-12-23 Treeve Jelbert <treeve AT sourcemage.org>
* DETAILS: version 2.03.23
* BUILD: don not use gold linker
diff --git a/libs/libdrm/DETAILS b/libs/libdrm/DETAILS
index 754ef60..a778739 100755
--- a/libs/libdrm/DETAILS
+++ b/libs/libdrm/DETAILS
@@ -12,11 +12,7 @@ else
VERSION=2.4.119
SOURCE=${SPELL}-${VERSION}.tar.xz
SOURCE_URL[0]=https://dri.freedesktop.org/${SPELL}/${SOURCE}
-# Watch: https://dri.freedesktop.org/libdrm/
- SOURCE2=$SOURCE.sig
- SOURCE2_URL[0]=${SOURCE_URL[0]}.sig
- SOURCE_GPG=drm.gpg:$SOURCE.sig:UPSTREAM_KEY
- SOURCE2_IGNORE=signature
+
SOURCE_HASH=sha512:c8dd7665e85c01a67fcce1c1c614bc05a3ec311f31cae7de5fb1cd27d0f11f1801be63de3fa3e33b2f505544fd4b1bc292965c5e8de46a3beaaedb10334945ca
SOURCE_DIRECTORY="$BUILD_DIRECTORY/$SPELL-$VERSION"
fi
WEB_SITE=http://dri.freedesktop.org/
diff --git a/libs/libdrm/HISTORY b/libs/libdrm/HISTORY
index b19c8ab..c18127a 100644
--- a/libs/libdrm/HISTORY
+++ b/libs/libdrm/HISTORY
@@ -1,3 +1,8 @@
+2024-01-02 Thomas Orgis <sobukus AT sourcmage.org>
+ * DETAILS: Signature key not found in drm.gpg, switch to
+ hash computed from https download.
+ * drm.gpg: gone
+
2023-12-22 Treeve Jelbert <treeve AT sourcemage.org>
* DETAILS: version 2.4.119

diff --git a/libs/libdrm/drm.gpg b/libs/libdrm/drm.gpg
deleted file mode 100644
index 96cd64a..0000000
Binary files a/libs/libdrm/drm.gpg and /dev/null differ



  • [SM-Commit] GIT changes to master grimoire by Thomas Orgis (13377fddd81b7c828d6e33f974af7b03c17bed84), Thomas Orgis, 01/02/2024

Archive powered by MHonArc 2.6.24.

Top of Page