Updated package needed for mercurial 3.7.3 security update

Updated package needed for mercurial 3.7.3 security update

[Andy Moreton]

Hi,

The current package is for mercurial 3.5.1, but upstream have released
3.7.3 as a security release, with fixes for:

CVE-2016-3630 Mercurial: remote code execution in binary delta decoding
CVE-2016-3068 Mercurial: arbitrary code execution with Git subrepos
CVE-2016-3069 Mercurial: arbitrary code execution when converting Git repos

Release announcement is here:
http://permalink.gmane.org/gmane.comp.version-control.mercurial.general/37523

Can the cygwin mercurial maintainer please issue an updated package.

Thanks,

    AndyM


--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple

Re: Security update needed for mercurial

[Andy Moreton]

On Sat 02 Apr 2016, Andy Moreton wrote:

> Hi,
>
> The current package is for mercurial 3.5.1, but upstream have released
> 3.7.3 as a security release, with fixes for:
>
> CVE-2016-3630 Mercurial: remote code execution in binary delta decoding
> CVE-2016-3068 Mercurial: arbitrary code execution with Git subrepos
> CVE-2016-3069 Mercurial: arbitrary code execution when converting Git repos
>
> Release announcement is here:
> http://permalink.gmane.org/gmane.comp.version-control.mercurial.general/37523
>
> Can the cygwin mercurial maintainer please issue an updated package.
>

Is the mercurial maintainer still reading the list ?

    AndyM


--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple

Re: Security update needed for mercurial

[Corinna Vinschen]

[-- Attachment #1: Type: text/plain, Size: 971 bytes --]

On Apr 19 17:30, Andy Moreton wrote:
> On Sat 02 Apr 2016, Andy Moreton wrote:
> 
> > Hi,
> >
> > The current package is for mercurial 3.5.1, but upstream have released

Actually the Cygwin mercurial package is at 3.6.3.

> > 3.7.3 as a security release, with fixes for:
> >
> > CVE-2016-3630 Mercurial: remote code execution in binary delta decoding
> > CVE-2016-3068 Mercurial: arbitrary code execution with Git subrepos
> > CVE-2016-3069 Mercurial: arbitrary code execution when converting Git repos
> >
> > Release announcement is here:
> > http://permalink.gmane.org/gmane.comp.version-control.mercurial.general/37523
> >
> > Can the cygwin mercurial maintainer please issue an updated package.
> >
> 
> Is the mercurial maintainer still reading the list ?

I CCed him.


Thanks,
Corinna

-- 
Corinna Vinschen                  Please, send mails regarding Cygwin to
Cygwin Maintainer                 cygwin AT cygwin DOT com
Red Hat

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 819 bytes --]

Re: Security update needed for mercurial (upload error: doesn't follow naming convention)

[Jari Aalto]

> 3.7.3 as a security release, with fixes for:
>
> CVE-2016-3630 Mercurial: remote code execution in binary delta decoding
> CVE-2016-3068 Mercurial: arbitrary code execution with Git subrepos
> CVE-2016-3069 Mercurial: arbitrary code execution when converting Git repos

New release uploaded, but I got this message (x64)?

ERROR: tar file 'mercurial-3.7.3.tar.gz' in package 'mercurial' doesn't follow naming convention
ERROR: error while reading uploaded packages for Jari Aalto

Jari

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple

Re: Security update needed for mercurial (upload error: doesn't follow naming convention)

[Corinna Vinschen]

[-- Attachment #1: Type: text/plain, Size: 817 bytes --]

On Apr 20 19:56, Jari Aalto wrote:
> > 3.7.3 as a security release, with fixes for:
> >
> > CVE-2016-3630 Mercurial: remote code execution in binary delta decoding
> > CVE-2016-3068 Mercurial: arbitrary code execution with Git subrepos
> > CVE-2016-3069 Mercurial: arbitrary code execution when converting Git repos
> 
> New release uploaded, but I got this message (x64)?
> 
> ERROR: tar file 'mercurial-3.7.3.tar.gz' in package 'mercurial' doesn't follow naming convention
> ERROR: error while reading uploaded packages for Jari Aalto

Our new calm tool (courtesy Jon Turney) now checks packages for
validity.  Shouldn't that be 3.7.3-1?


Corinna

-- 
Corinna Vinschen                  Please, send mails regarding Cygwin to
Cygwin Maintainer                 cygwin AT cygwin DOT com
Red Hat

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 819 bytes --]

Re: Security update needed for mercurial (upload error: doesn't follow naming convention)

[Jon Turney]

On 20/04/2016 17:56, Jari Aalto wrote:
>> 3.7.3 as a security release, with fixes for:
>>
>> CVE-2016-3630 Mercurial: remote code execution in binary delta decoding
>> CVE-2016-3068 Mercurial: arbitrary code execution with Git subrepos
>> CVE-2016-3069 Mercurial: arbitrary code execution when converting Git repos
>
> New release uploaded, but I got this message (x64)?

Thanks.

> ERROR: tar file 'mercurial-3.7.3.tar.gz' in package 'mercurial' doesn't follow naming convention
> ERROR: error while reading uploaded packages for Jari Aalto

Yes, you seem to have uploaded:

mercurial-3.7.3.tar.gz       - upstream tar file
mercurial-3.7.3-1.tar.xz     - cygwin binary package
mercurial-3.7.3-1-src.tar.xz - cygwin source package containing the 
upstream tar file and build script

The behaviour of upset was to accept mercurial-3.7.3.tar.gz as a binary 
package file, fortunately of a version preceding 3.7.3-1.

This was never correct, so it's now reported as an error.

I have removed the upstream tar files to allow the upload to proceed.


--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple

Re: Security update needed for mercurial (upload error: doesn't follow naming convention)

[Warren Young]

On Apr 20, 2016, at 10:56 AM, Jari Aalto <jari.aalto@cante.net> wrote:
> 
>> 3.7.3 as a security release, with fixes for:
>> 
>> CVE-2016-3630 Mercurial: remote code execution in binary delta decoding
>> CVE-2016-3068 Mercurial: arbitrary code execution with Git subrepos
>> CVE-2016-3069 Mercurial: arbitrary code execution when converting Git repos
> 
> New release uploaded, but I got this message (x64)?
> 
> ERROR: tar file 'mercurial-3.7.3.tar.gz' in package 'mercurial' doesn't follow naming convention
> ERROR: error while reading uploaded packages for Jari Aalto

I take from that that you are not using cygport for that package?  This sort of detail is one of the things that cygport takes care of for you.
--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple