[ptxdist] [PATCH 0/2] util-linux: Switch back to tarball download and version bump to 2.42.2

[ptxdist] [PATCH 0/2] util-linux: Switch back to tarball download and version bump to 2.42.2

[Alexander Dahl via ptxdist]

Hei hei,

before doing the version bump with security fixes, I checked release
checksums and signatures and got confused about the file
util-linux-2.42.2.tar.gz I had just downloaded.  Turns out ptxdist got
that from git.  However upstream repaired its tarball generation and now
it is possible to use meson to build from release tarball.  Thus
switching back to tarball download before doing the version bump.  See
commit messages for details.

Greets
Alex

Alexander Dahl (2):
  util-linux: Switch back from git to tarball download
  util-linux: version bump 2.42.1 -> 2.42.2

 rules/util-linux.make | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)


base-commit: 3d185e7c01807e7a2f58a89fe811ed572d267099
-- 
2.47.3

[ptxdist] [PATCH 1/2] util-linux: Switch back from git to tarball download

[Alexander Dahl via ptxdist]

Meanwhile util-linux release process checks tarballs have all the
meson.build files required, and meson build from tarball succeeds.

Rolling back url related changes from commit c7f0ce7be8df ("util-linux:
Version bump.  2.39.3 -> 2.40"), which includes switching from tar.gz to
tar.xz, thus updating checksum.  User might have some .tar.gz files from
git which are not equal to distributed .tar.gz files, but switching to
.tar.xz here should avoid checksum mismatches.

Allows for verifying tarballs against .tar.sign and comparing checksums
to other distributions again.

Link: https://github.com/util-linux/util-linux/issues/3460
Signed-off-by: Alexander Dahl <ada@thorsis.com>
---
 rules/util-linux.make | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/rules/util-linux.make b/rules/util-linux.make
index f77666d7f..bf6817c2a 100644
--- a/rules/util-linux.make
+++ b/rules/util-linux.make
@@ -16,10 +16,11 @@ PACKAGES-$(PTXCONF_UTIL_LINUX) += util-linux
 # Paths and names
 #
 UTIL_LINUX_VERSION	:= 2.42.1
-UTIL_LINUX_SHA256	:= 138a3bd9049afa5eeeea73f1e9c0ed7bddf3e55ba4ec29924965a932ec738f01
+UTIL_LINUX_SHA256	:= 82e9158eb12a9b0b569d84e1687fed9dd18fe89ccd8ef5ac3427218a7c0d7f7f
 UTIL_LINUX		:= util-linux-$(UTIL_LINUX_VERSION)
-UTIL_LINUX_SUFFIX	:= tar.gz
-UTIL_LINUX_URL		:= https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/snapshot/$(UTIL_LINUX).$(UTIL_LINUX_SUFFIX)
+UTIL_LINUX_SUFFIX	:= tar.xz
+UTIL_LINUX_BASENAME	:= v$(if $(filter 2,$(basename $(UTIL_LINUX_VERSION))),$(UTIL_LINUX_VERSION),$(basename $(UTIL_LINUX_VERSION)))
+UTIL_LINUX_URL		:= $(call ptx/mirror, KERNEL, utils/util-linux/$(UTIL_LINUX_BASENAME)/$(UTIL_LINUX).$(UTIL_LINUX_SUFFIX))
 UTIL_LINUX_SOURCE	:= $(SRCDIR)/$(UTIL_LINUX).$(UTIL_LINUX_SUFFIX)
 UTIL_LINUX_DIR		:= $(BUILDDIR)/$(UTIL_LINUX)
 UTIL_LINUX_LICENSE	:= GPL-2.0-only AND GPL-2.0-or-later AND LGPL-2.0-or-later AND BSD-3-Clause AND BSD-4-Clause AND MIT AND ISC AND public_domain
-- 
2.47.3

[ptxdist] [PATCH 2/2] util-linux: version bump 2.42.1 -> 2.42.2

[Alexander Dahl via ptxdist]

Security fixes:

 CVE-2026-53613 - mount(8) TOCTOU race on target path.
 CVE-2026-53612 - mount(8) TOCTOU race on post-mount owner/mode change.
 CVE-2026-53614 - mount(8) SUID bypass via LIBMOUNT_FORCE_MOUNT2.
 CVE-2026-27456 - mount(8) TOCTOU symlink attack via loop device (follow-up).
 libblkid: use-after-free in nested partition probing.

Link: https://www.kernel.org/pub/linux/utils/util-linux/v2.42/v2.42.2-ReleaseNotes
Signed-off-by: Alexander Dahl <ada@thorsis.com>
---
 rules/util-linux.make | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/rules/util-linux.make b/rules/util-linux.make
index bf6817c2a..33e525820 100644
--- a/rules/util-linux.make
+++ b/rules/util-linux.make
@@ -15,8 +15,8 @@ PACKAGES-$(PTXCONF_UTIL_LINUX) += util-linux
 #
 # Paths and names
 #
-UTIL_LINUX_VERSION	:= 2.42.1
-UTIL_LINUX_SHA256	:= 82e9158eb12a9b0b569d84e1687fed9dd18fe89ccd8ef5ac3427218a7c0d7f7f
+UTIL_LINUX_VERSION	:= 2.42.2
+UTIL_LINUX_SHA256	:= 03a05d3adf9602ef128f2da05b84b3205ce60c351e5737c0370f74000679ce8a
 UTIL_LINUX		:= util-linux-$(UTIL_LINUX_VERSION)
 UTIL_LINUX_SUFFIX	:= tar.xz
 UTIL_LINUX_BASENAME	:= v$(if $(filter 2,$(basename $(UTIL_LINUX_VERSION))),$(UTIL_LINUX_VERSION),$(basename $(UTIL_LINUX_VERSION)))
-- 
2.47.3