[ANNOUNCEMENT] Updated: wget-1.16-1

[ANNOUNCEMENT] Updated: wget-1.16-1

[Eric Blake (cygwin)]

[-- Attachment #1: Type: text/plain, Size: 1592 bytes --]

A new release of wget, 1.16-1, will be available soon for download from
your favorite mirror, leaving 1.15-1 as previous.

NEWS:
=====
This is a new upstream release, which includes a fix for CVE-2014-4877
to avoid an attack through symlinks.

See also the package documentation in /usr/share/doc/wget/.

DESCRIPTION:
============
GNU Wget is a file retrieval utility which can use either the HTTP,
HTTPS, or FTP protocols. Wget features include the ability to work in
the background while you're logged out, recursive retrieval of
directories, file name wildcard matching, remote file timestamp storage
and comparison, use of Rest with FTP servers and Range with HTTP servers
to retrieve files over slow or unstable connections, support for Proxy
servers, and configurability.

UPDATE:
=======
To update your installation, click on the "Install Cygwin now" link on
the http://cygwin.com/ web page. This downloads setup.exe to your
system. Save it and run setup, answer the questions and pick up 'wget'
from the 'Web' category.

DOWNLOAD:
=========
Note that downloads from cygwin.com aren't allowed due to bandwidth
limitations.  This means that you will need to find a mirror which has
this update, please choose the one nearest to you:
http://cygwin.com/mirrors.html

QUESTIONS:
==========
If you want to make a point or ask a question the Cygwin mailing list is
the appropriate place.

-- 
Eric Blake
volunteer cygwin wget package maintainer

For more details on this list (including unsubscription), see:
http://sourceware.org/lists.html



[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 539 bytes --]

Re: [ANNOUNCEMENT] Updated: wget-1.16-1

[Steven Penny]

On Mon, Oct 27, 2014 at 11:06 PM, Eric Blake (cygwin) wrote:
> A new release of wget, 1.16-1, will be available soon for download from
> your favorite mirror, leaving 1.15-1 as previous.

Can we roll this back? Notice if the filename and eta fields use full width at
same time, it breaks the output

$ wget --limit-rate=1 cygwin.com/snapshots/x86/cygwin1-20141027.dbg.xz
converted
'http://cygwin.com/snapshots/x86/cygwin1-20141027.dbg.xz' (ANSI_X3.4-1968) ->
'http://cygwin.com/snapshots/x86/cygwin1-20141027.dbg.xz' (UTF-8)
--2014-11-04 12:30:18--  http://cygwin.com/snapshots/x86/cygwin1-20141027.dbg.xz

Resolving cygwin.com (cygwin.com)... 209.132.180.131
Connecting to cygwin.com (cygwin.com)|209.132.180.131|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 3164408 (3.0M) [application/x-xz]
Saving to: 'cygwin1-20141027.dbg.xz'

win1-20141027.dbg.x   0%[                      ]       3  1.00 B/s   eta 36d 17h
cygwin1-20141027.db   0%[                      ]       4  1.00 B/s   eta 36d 16h
ygwin1-20141027.dbg   0%[                      ]       5  1.00 B/s   eta 36d 15h
gwin1-20141027.dbg.   0%[                      ]       6  1.00 B/s   eta 36d 15h

This is a known issue
http://lists.gnu.org/archive/html/bug-wget/2014-10/msg00169

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple

Re: [ANNOUNCEMENT] Updated: wget-1.16-1

[Eric Blake]

[-- Attachment #1: Type: text/plain, Size: 853 bytes --]

On 11/04/2014 07:38 PM, Steven Penny wrote:
> On Mon, Oct 27, 2014 at 11:06 PM, Eric Blake (cygwin) wrote:
>> A new release of wget, 1.16-1, will be available soon for download from
>> your favorite mirror, leaving 1.15-1 as previous.
> 
> Can we roll this back? Notice if the filename and eta fields use full width at
> same time, it breaks the output

No. I will not roll back to the pre-CVE state.  But when 1.17 comes out,
I'll update to that.

> 
> This is a known issue
> http://lists.gnu.org/archive/html/bug-wget/2014-10/msg00169

That thread also suggested that you could work around some of the
regression by setting up your config file to automatically add
--no-scroll if that is the new behavior you don't like.

-- 
Eric Blake   eblake redhat com    +1-919-301-3266
Libvirt virtualization library http://libvirt.org


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 539 bytes --]

Re: [ANNOUNCEMENT] Updated: wget-1.16-1

[Steven Penny]

On Wed, Nov 5, 2014 at 1:27 AM, Eric Blake wrote:
> That thread also suggested that you could work around some of the
> regression by setting up your config file to automatically add
> --no-scroll if that is the new behavior you don't like.

I should have mentioned, that does not fix it.

$ wget --limit-rate=1 --progress=bar:noscroll \
cygwin.com/snapshots/x86/cygwin1-20141027.dbg.xz
--2014-11-05 12:08:45--  http://cygwin.com/snapshots/x86/cygwin1-20141027.dbg.xz

Resolving cygwin.com (cygwin.com)... 209.132.180.131
Connecting to cygwin.com (cygwin.com)|209.132.180.131|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 3164408 (3.0M) [application/x-xz]
Saving to: ‘cygwin1-20141027.dbg.xz.1’

cygwin1-20141027.db   0%[                      ]       4  1.00 B/s   eta 36d 14h
cygwin1-20141027.db   0%[                      ]       5  1.00 B/s   eta 36d 14h
cygwin1-20141027.db   0%[                      ]       6  1.00 B/s   eta 36d 14h
cygwin1-20141027.db   0%[                      ]       7  1.00 B/s   eta 36d 15h

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple