cpio ver. bump

system/base/cpio/files/cpio-2.13-fix-no-absolute-filenames-revert-CVE-2015-1197-handling.patch

@@ -0,0 +1,47 @@
+https://sources.debian.org/patches/cpio/2.13%2Bdfsg-7.1/revert-CVE-2015-1197-handling.patch/
+https://bugs.gentoo.org/700020
+
+From: Chris Lamb <lamby@debian.org>
+Date: Sat, 1 Feb 2020 13:36:37 +0100
+Subject: Fix a regression in handling of CVE-2015-1197 &
+ --no-absolute-filenames.
+
+See:
+
+  * https://bugs.debian.org/946267
+  * https://bugs.debian.org/946469
+
+This reverts (most of): https://git.savannah.gnu.org/cgit/cpio.git/diff/?id=45b0ee2b407913c533f7ded8d6f8cbeec16ff6ca&id2=3177d660a4c62a6acb538b0f7c54ba423698889a
+--- a/src/copyin.c
++++ b/src/copyin.c
+@@ -646,8 +646,6 @@ copyin_link (struct cpio_file_stat *file_hdr, int in_file_des)
+       link_name = xstrdup (file_hdr->c_tar_linkname);
+     }
+ 
+-  cpio_safer_name_suffix (link_name, true, !no_abs_paths_flag, false);
+-  
+   res = UMASKED_SYMLINK (link_name, file_hdr->c_name,
+ 			 file_hdr->c_mode);
+   if (res < 0 && create_dir_flag)
+--- a/tests/testsuite
++++ b/tests/testsuite
+@@ -2787,7 +2787,7 @@ read at_status <"$at_status_file"
+ #AT_START_14
+ at_fn_group_banner 14 'CVE-2015-1197.at:17' \
+   "CVE-2015-1197 (--no-absolute-filenames for symlinks)" ""
+-at_xfail=no
++at_xfail=yes
+ (
+   $as_echo "14. $at_setup_line: testing $at_desc ..."
+   $at_traceon
+
+--- a/tests/CVE-2015-1197.at
++++ b/tests/CVE-2015-1197.at
+@@ -15,6 +15,7 @@
+ # along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ 
+ AT_SETUP([CVE-2015-1197 (--no-absolute-filenames for symlinks)])
++AT_XFAIL_IF([true])
+ AT_CHECK([
+ tempdir=$(pwd)/tmp
+ mkdir $tempdir

system/base/cpio/files/cpio-2.9-exitCode.patch

@@ -1,11 +1,39 @@
---- cpio-2.9/src/copyout.c.exitCode	2007-06-28 10:54:43.000000000 +0200
+Subject: [PATCH 2/7] set exit code to 1 when cpio fails to store file > 4GB
-+++ cpio-2.9/src/copyout.c	2007-07-16 16:23:05.000000000 +0200
+ (#183224)
-@@ -297,7 +297,7 @@ to_ascii (char *where, uintmax_t v, size
- static void
- field_width_error (const char *filename, const char *fieldname)
- {
--  error (0, 0, _("%s: field width not sufficient for storing %s"),
-+  error (1, 0, _("%s: field width not sufficient for storing %s"),
- 	 filename, fieldname);
- }
 
+diff --git a/src/copyout.c b/src/copyout.c
+index fa999bd..6e82f4c 100644
+--- a/src/copyout.c
++++ b/src/copyout.c
+@@ -287,7 +287,7 @@ field_width_error (const char *filename, const char *fieldname,
+ {
+   char valbuf[UINTMAX_STRSIZE_BOUND + 1];
+   char maxbuf[UINTMAX_STRSIZE_BOUND + 1];
+-  error (0, 0, _("%s: value %s %s out of allowed range 0..%s"),
++  error (1, 0, _("%s: value %s %s out of allowed range 0..%s"),
+ 	 filename, fieldname,
+ 	 STRINGIFY_BIGINT (value, valbuf),
+ 	 STRINGIFY_BIGINT (MAX_VAL_WITH_DIGITS (width - nul, LG_8),
+diff --git a/tests/CVE-2019-14866.at b/tests/CVE-2019-14866.at
+index 530365a..5a4e15c 100644
+--- a/tests/CVE-2019-14866.at
++++ b/tests/CVE-2019-14866.at
+@@ -30,6 +30,5 @@ fi
+ [0],
+ [],
+ [cpio: file: value size 17179869184 out of allowed range 0..8589934591
+-2 blocks
+ ])
+ AT_CLEANUP
+diff --git a/tests/testsuite b/tests/testsuite
+index 10531d1..d69dad9 100755
+--- a/tests/testsuite
++++ b/tests/testsuite
+@@ -2927,7 +2927,6 @@ fi
+ at_status=$? at_failed=false
+ $at_check_filter
+ echo >>"$at_stderr"; printf "%s\n" "cpio: file: value size 17179869184 out of allowed range 0..8589934591
+-2 blocks
+ " | \
+   $at_diff - "$at_stderr" || at_failed=:
+ at_fn_diff_devnull "$at_stdout" || at_failed=:

system/base/cpio/files/gentoo/cpio-2.12-non-gnu-compilers.patch

@@ -0,0 +1,11 @@
+--- cpio-2.12/src/cpiohdr.h
++++ cpio-2.12/src/cpiohdr.h
+@@ -25,6 +25,8 @@
+ 
+ # ifdef HAVE_ATTRIB_PACKED
+ #  define ATTRIB_PACKED __attribute__((packed))
++# else
++#  define ATTRIB_PACKED
+ # endif
+ 
+ # ifdef HAVE_PRAGMA_PACK

system/base/cpio/files/gentoo/cpio-2.13-fix-no-absolute-filenames-revert-CVE-2015-1197-handling.patch

@@ -0,0 +1,36 @@
+https://sources.debian.org/patches/cpio/2.13%2Bdfsg-7.1/revert-CVE-2015-1197-handling.patch/
+https://bugs.gentoo.org/700020
+
+From: Chris Lamb <lamby@debian.org>
+Date: Sat, 1 Feb 2020 13:36:37 +0100
+Subject: Fix a regression in handling of CVE-2015-1197 &
+ --no-absolute-filenames.
+
+See:
+
+  * https://bugs.debian.org/946267
+  * https://bugs.debian.org/946469
+
+This reverts (most of): https://git.savannah.gnu.org/cgit/cpio.git/diff/?id=45b0ee2b407913c533f7ded8d6f8cbeec16ff6ca&id2=3177d660a4c62a6acb538b0f7c54ba423698889a
+--- a/tests/testsuite
++++ b/tests/testsuite
+@@ -2787,7 +2787,7 @@ read at_status <"$at_status_file"
+ #AT_START_14
+ at_fn_group_banner 14 'CVE-2015-1197.at:17' \
+   "CVE-2015-1197 (--no-absolute-filenames for symlinks)" ""
+-at_xfail=no
++at_xfail=yes
+ (
+   $as_echo "14. $at_setup_line: testing $at_desc ..."
+   $at_traceon
+
+--- a/tests/CVE-2015-1197.at
++++ b/tests/CVE-2015-1197.at
+@@ -15,6 +15,7 @@
+ # along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ 
+ AT_SETUP([CVE-2015-1197 (--no-absolute-filenames for symlinks)])
++AT_XFAIL_IF([true])
+ AT_CHECK([
+ tempdir=$(pwd)/tmp
+ mkdir $tempdir

system/base/cpio/pspec.xml

@@ -12,20 +12,13 @@
         <IsA>app:console</IsA>
         <Summary>A file archival tool which can also read and write tar files</Summary>
         <Description>GNU cpio copies files into or out of a cpio or tar archive. The archive can be another file on the disk, a magnetic tape, or a pipe. GNU cpio supports the following archive formats: binary, old ASCII, new ASCII, crc, HPUX binary, HPUX old ASCII, old tar, and POSIX.1 tar.</Description>
-        <Archive sha1sum="60358408c76db354f6716724c4bcbcb6e18ab642" type="tarbz2">mirrors://gnu/cpio/cpio-2.12.tar.bz2</Archive>
+        <Archive sha1sum="db5e3845eb5475ddcb7e8915c3a1458a0c13d787" type="tarbz2">mirrors://gnu/cpio/cpio-2.15.tar.bz2</Archive>
         <BuildDependencies>
             <Dependency>texinfo</Dependency>
         </BuildDependencies>
         <Patches>
-            <!--Patch level="1">cpio-2.7-svr4compat.patch</Patch-->
+            <Patch level="1">gentoo/cpio-2.12-non-gnu-compilers.patch</Patch>
-            <Patch level="1">cpio-2.9-exitCode.patch</Patch>
+            <Patch level="1">gentoo/cpio-2.13-fix-no-absolute-filenames-revert-CVE-2015-1197-handling.patch</Patch> -->
-            <Patch level="1">CVE-2010-0624-rpatelib-overflow.patch</Patch>
-            <Patch level="1">cpio-2.12-name-overflow.patch</Patch>
-            <Patch level="1">cpio-2.12-non-gnu-compilers.patch</Patch>
-            <Patch level="1">cpio-2.12-no-overwrite-symlinks.patch</Patch>
-            <Patch level="1">cpio-2.12-svr4compat.patch</Patch>
-            <Patch level="1">CVE-2010-0624-rpatelib-overflow.patch</Patch>
-            <Patch level="1">cpio-2.12-gcc-10.patch</Patch>
         </Patches>
     </Source>
 
@@ -41,6 +34,13 @@
     </Package>
 
     <History>
+        <Update release="7">
+            <Date>2024-01-15</Date>
+            <Version>2.15</Version>
+            <Comment>Version bump.</Comment>
+            <Name>Mustafa Cinasal</Name>
+            <Email>muscnsl@gmail.com</Email>
+        </Update>
         <Update release="6">
             <Date>2020-12-09</Date>
             <Version>2.12</Version>