Re: [ptxdist] [PATCH] screen: Version bump. 5.0.0 -> 5.0.1

[Michael Olbrich <m.olbrich@pengutronix.de>]

On Fri, May 16, 2025 at 06:25:56PM +0200, Christian Melki wrote:
> Hi Michael.
> 
> Yeah. Looks like release mishaps.
> They didn't release the tarball for +72h after the announcement.
> And it seems that the first one (the one I sent) was botched.
> You can see the my (and others) complaint in these threads:
> 
> https://www.phoronix.com/forums/forum/software/general-linux-open-source/1546098-gnu-screen-5-0-1-released-due-to-several-security-vulnerabilities/page2
> 
> https://lists.gnu.org/archive/html/screen-devel/2025-05/msg00018.html
> 
> At this point I'd just update the md5 since they reused the same version
> number. Do you want me to send a new one?

I'll modify the commit, not need to send a new version.

Michael

> Regards,
> Christian
> 
> 
> On 5/16/25 9:46 AM, Michael Olbrich wrote:
> > On Thu, May 15, 2025 at 07:38:51PM +0200, Christian Melki wrote:
> >> Security and other fixes.
> >> https://lists.gnu.org/archive/html/info-gnu/2025-05/msg00002.html
> >>
> >> Security fixes:
> >> CVE-2025-46805: do NOT send signals with root privileges
> >> CVE-2025-46804: avoid file existence test information leaks
> >> CVE-2025-46803: apply safe PTY default mode of 0620
> >> CVE-2025-46802: prevent temporary 0666 mode on PTYs in attacher
> >> CVE-2025-23395: reintroduce lf_secreopen() for logfile
> >>
> >> * Forward patchset, applies cleanly.
> >>
> >> Signed-off-by: Christian Melki <christian.melki@t2data.com>
> >> ---
> >>  .../{screen-5.0.0 => screen-5.0.1}/0001-suppress_remap.patch  | 0
> >>  patches/{screen-5.0.0 => screen-5.0.1}/autogen.sh             | 0
> >>  patches/{screen-5.0.0 => screen-5.0.1}/series                 | 0
> >>  rules/screen.make                                             | 4 ++--
> >>  4 files changed, 2 insertions(+), 2 deletions(-)
> >>  rename patches/{screen-5.0.0 => screen-5.0.1}/0001-suppress_remap.patch (100%)
> >>  rename patches/{screen-5.0.0 => screen-5.0.1}/autogen.sh (100%)
> >>  rename patches/{screen-5.0.0 => screen-5.0.1}/series (100%)
> >>
> >> diff --git a/patches/screen-5.0.0/0001-suppress_remap.patch b/patches/screen-5.0.1/0001-suppress_remap.patch
> >> similarity index 100%
> >> rename from patches/screen-5.0.0/0001-suppress_remap.patch
> >> rename to patches/screen-5.0.1/0001-suppress_remap.patch
> >> diff --git a/patches/screen-5.0.0/autogen.sh b/patches/screen-5.0.1/autogen.sh
> >> similarity index 100%
> >> rename from patches/screen-5.0.0/autogen.sh
> >> rename to patches/screen-5.0.1/autogen.sh
> >> diff --git a/patches/screen-5.0.0/series b/patches/screen-5.0.1/series
> >> similarity index 100%
> >> rename from patches/screen-5.0.0/series
> >> rename to patches/screen-5.0.1/series
> >> diff --git a/rules/screen.make b/rules/screen.make
> >> index 1bac9b8b8..69a65a9b8 100644
> >> --- a/rules/screen.make
> >> +++ b/rules/screen.make
> >> @@ -14,8 +14,8 @@ PACKAGES-$(PTXCONF_SCREEN) += screen
> >>  #
> >>  # Paths and names
> >>  #
> >> -SCREEN_VERSION		:= 5.0.0
> >> -SCREEN_MD5		:= befc115989242ed4bceeff8d8bfeb4e6
> >> +SCREEN_VERSION		:= 5.0.1
> >> +SCREEN_MD5		:= 4306c5446abd48b7899a211c4d0456b2
> > 
> > Hmm, I'm getting a different md5 here. Can you check what is going on here?
> > 
> > Michael
> > 
> >>  SCREEN			:= screen-$(SCREEN_VERSION)
> >>  SCREEN_SUFFIX		:= tar.gz
> >>  SCREEN_URL		:= $(call ptx/mirror, GNU, screen/$(SCREEN).$(SCREEN_SUFFIX))
> >> -- 
> >> 2.34.1
> >>
> >>
> >>
> > 
> 
> 

-- 
Pengutronix e.K.                           |                             |
Steuerwalder Str. 21                       | http://www.pengutronix.de/  |
31137 Hildesheim, Germany                  | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |