Source Mage code commit list

[Pavel Vinogradov <scm AT sourcemage.org>]

GIT changes to master grimoire by Pavel Vinogradov <public AT sourcemage.org>:

 utils/sudo/DEPENDS                                |    5 ++
 utils/sudo/DETAILS                                |    2 
 utils/sudo/HISTORY                                |    7 ++
 utils/sudo/PRE_BUILD                              |    4 +
 utils/sudo/patches/CVE-2026-96512.patch           |   53 
++++++++++++++++++++++
 utils/sudo/patches/sudo-1.9.17_p2-openssl-4.patch |   33 +++++++++++++
 6 files changed, 103 insertions(+), 1 deletion(-)

New commits:
commit 9ae84045043092a751938b65f8531cab038ec981
Author: Pavel Vinogradov <public AT sourcemage.org>
Commit: Pavel Vinogradov <public AT sourcemage.org>

    utils/sudo: SECURITY_PATCH++, fixed building with OpenSSL 4.0, optionally 
needs SSL

diff --git a/utils/sudo/DEPENDS b/utils/sudo/DEPENDS
index b1900a8..0959aa3 100755
--- a/utils/sudo/DEPENDS
+++ b/utils/sudo/DEPENDS
@@ -26,4 +26,9 @@ optional_depends SENDMAIL \
                  "--without-sendmail" \
                  "for Sendmail usage" &&
 
+optional_depends SSL \
+                 "--with-openssl" \
+                 "--without-openssl" \
+                 "for TLS and sha2 functions" &&
+
 suggest_depends TEXT-EDITOR
diff --git a/utils/sudo/DETAILS b/utils/sudo/DETAILS
index 1b3bb25..23144d6 100755
--- a/utils/sudo/DETAILS
+++ b/utils/sudo/DETAILS
@@ -1,6 +1,6 @@
            SPELL=sudo
          VERSION=1.9.17p2
-  SECURITY_PATCH=16
+  SECURITY_PATCH=17
           SOURCE=$SPELL-$VERSION.tar.gz
 SOURCE_DIRECTORY="$BUILD_DIRECTORY/$SPELL-$VERSION"
    SOURCE_URL[0]=https://www.sudo.ws/dist/$SOURCE
diff --git a/utils/sudo/HISTORY b/utils/sudo/HISTORY
index 6bc0eee..2bcd50e 100644
--- a/utils/sudo/HISTORY
+++ b/utils/sudo/HISTORY
@@ -1,3 +1,10 @@
+2026-11-01 Pavel Vinogradov <public AT sourcemage.org>
+       * DETAILS: SECURITY_PATCH++, (CVE-2026-96512)
+       * DEPENDS: added optional SSL dependency
+       * PRE_BUILD, patches/CVE-2026-96512.patch,
+         patches/sudo-1.9.17_p2-openssl-4.patch: added two patches from 
Gentoo to
+         fix vulnerability and OpenSSL 4.0 build error
+
 2025-07-26 Pavel Vinogradov <public AT sourcemage.org>
        * DETAILS: version 1.9.17p2
 
diff --git a/utils/sudo/PRE_BUILD b/utils/sudo/PRE_BUILD
new file mode 100755
index 0000000..6c5c8c9
--- /dev/null
+++ b/utils/sudo/PRE_BUILD
@@ -0,0 +1,4 @@
+default_pre_build &&
+cd "${SOURCE_DIRECTORY}" &&
+
+apply_patch_dir "patches"
diff --git a/utils/sudo/patches/CVE-2026-96512.patch 
b/utils/sudo/patches/CVE-2026-96512.patch
new file mode 100644
index 0000000..27367e8
--- /dev/null
+++ b/utils/sudo/patches/CVE-2026-96512.patch
@@ -0,0 +1,53 @@
+diff --git a/src/sudo.c b/src/sudo.c
+index 0ed053839..89d97b6e8 100644
+--- a/src/sudo.c
++++ b/src/sudo.c
+@@ -341,13 +341,48 @@ access_denied:
+     return EXIT_FAILURE;
+ }
+ 
++/*
++ * Set the time zone using tzset(3), removing the user's TZ
++ * environment variable.  The original value of TZ may still
++ * be present in the command's environment, depending on sudoers.
++ */
++static void
++set_time_zone(void)
++{
++    /* Use system time zone, not user-specified. */
++    unsetenv("TZ");
++    (void) tzset();
++}
++
+ int
+ os_init_common(int argc, char *argv[], char *envp[])
+ {
++    extern char **environ;
++    int envc;
+ #ifdef STATIC_SUDOERS_PLUGIN
+     preload_static_symbols();
+ #endif
+     gc_init();
++
++    /*
++     * Make a copy of environ[] that is distinct from envp[].
++     * This allows us to remove variables from sudo's environment
++     * while still providing the original envp to the plugins.
++     */
++    for (envc = 0; envp[envc] != NULL; envc++)
++      continue;
++    if (envc != 0) {
++      char **new_env = reallocarray(NULL, sizeof(char *), envc + 1);
++      if (new_env == NULL || !gc_add(GC_PTR, new_env)) {
++          sudo_fatalx_nodebug(U_("%s: %s"), __func__,
++              U_("unable to allocate memory"));
++      }
++      for (envc = 0; envp[envc] != NULL; envc++)
++          new_env[envc] = envp[envc];
++      new_env[envc] = NULL;
++      environ = new_env;
++    }
++
+     return 0;
+ }
+ 
diff --git a/utils/sudo/patches/sudo-1.9.17_p2-openssl-4.patch 
b/utils/sudo/patches/sudo-1.9.17_p2-openssl-4.patch
new file mode 100644
index 0000000..7649bdf
--- /dev/null
+++ b/utils/sudo/patches/sudo-1.9.17_p2-openssl-4.patch
@@ -0,0 +1,33 @@
+From f97a34bc7b390f185d544e21b0ef75db1275953e Mon Sep 17 00:00:00 2001
+From: Theo Buehler <tb AT openbsd.org>
+Date: Sat, 22 Nov 2025 12:28:50 +0100
+Subject: [PATCH] Use accessor for getting an ASN1_STRING's length
+
+OpensSSL 4 has plans to make ASN1_STRING opaque [1]. hostcheck.c's code
+mostly treats it as opaque, but accesses two lengths. This is API added
+in OpenSSL 0.9.0, so I'm not sure we need a configure check.
+
+WolfSSL only recently const corrected ASN1_STRING_length(), so maybe
+there will be a need to cast away const.
+
+[1]: https://github.com/openssl/openssl/issues/29117
+
+--- a/lib/iolog/hostcheck.c
++++ b/lib/iolog/hostcheck.c
+@@ -323,14 +323,14 @@
+ #endif
+ 
+             /* IPV4 address */
+-            if(current_name->d.iPAddress->length == 4) {
++            if(ASN1_STRING_length(current_name->d.iPAddress) == 4) {
+                 if (inet_ntop(AF_INET, san_ip, san_ip_str, INET_ADDRSTRLEN) 
== NULL) {
+                     result = MalformedCertificate;
+                     break;
+                 }
+ #if defined(HAVE_STRUCT_IN6_ADDR)
+             /* IPV6 address */
+-            } else if (current_name->d.iPAddress->length == 16) {
++            } else if (ASN1_STRING_length(current_name->d.iPAddress) == 16) 
{
+                 if (inet_ntop(AF_INET6, san_ip, san_ip_str, 
INET6_ADDRSTRLEN) == NULL) {
+                     result = MalformedCertificate;
+                     break;