mirror of
https://gitlab.com/buildroot.org/buildroot.git
synced 2026-08-01 21:23:51 -09:00
c9659fd9e8
In Buildroot there are multiple way to apply patches on a package [1]
- Adding `.patch` file in the package directory.
- Define `<pkg>_PATCH` variable with the location of the patch tar.gz.
It used to download Debian patches tarball.
- Implement custom patching logic with `PRE`/`POST` patches hooks.
To make the CycloneDX SBOM generation not dependant on downloading the
packages, the two last options have the downside of not appearing on the
generated SBOM.
The heirloom-mailx package is downloading a tarball from the Debian
mirror with the `<pkg>_PATCH` method [2].
To improve the tracking of the patched vulnerabilities for the
heirloom-mailx package this commit import the patches previously
downloaded with the `_PATCH` variable in the Buildroot tree. This allows
to add the `CVE:` trailer [3] on the patches that fix vulnerabilities to
better track which patch is fixing the vulnerability.
[1] https://buildroot.org/downloads/manual/manual.html#patch-policy
[2] http://snapshot.debian.org/archive/debian/20150815T155609Z/pool/main/h/heirloom-mailx/heirloom-mailx_12.5-5.debian.tar.xz
[3] 1167d0ff3d docs/manual: mention CVE trailer
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
56 lines
1.5 KiB
Diff
56 lines
1.5 KiB
Diff
From aad28d30af6c3a74c522dd61943788e908860c84 Mon Sep 17 00:00:00 2001
|
|
From: Adam Duskett <aduskett@gmail.com>
|
|
Date: Fri, 4 Aug 2017 07:22:47 -0400
|
|
Subject: [PATCH] fix libressl support
|
|
|
|
heirloom-mailx has two small issues when compiling against LibreSSL:
|
|
- RAND_egd is used (LibreSSL does not support RAND_egd)
|
|
Solution: "Guard" the code calling RAND_egd
|
|
|
|
- SSLv3_client_method function is used (LibreSSL does not support SSLv3)
|
|
Solution: "Guard" the code with #ifndef OPENSSL_NO_SSL3
|
|
|
|
Upstream: N/A
|
|
Signed-off-by: Adam Duskett <aduskett@gmail.com>
|
|
---
|
|
openssl.c | 7 +++++++
|
|
1 file changed, 7 insertions(+)
|
|
|
|
diff --git a/openssl.c b/openssl.c
|
|
index 44fe4e5..c4a1bb7 100644
|
|
--- a/openssl.c
|
|
+++ b/openssl.c
|
|
@@ -137,11 +137,13 @@ ssl_rand_init(void)
|
|
|
|
if ((cp = value("ssl-rand-egd")) != NULL) {
|
|
cp = expand(cp);
|
|
+#ifndef OPENSSL_NO_EGD
|
|
if (RAND_egd(cp) == -1) {
|
|
fprintf(stderr, catgets(catd, CATSET, 245,
|
|
"entropy daemon at \"%s\" not available\n"),
|
|
cp);
|
|
} else
|
|
+#endif
|
|
state = 1;
|
|
} else if ((cp = value("ssl-rand-file")) != NULL) {
|
|
cp = expand(cp);
|
|
@@ -216,10 +218,15 @@ ssl_select_method(const char *uhp)
|
|
|
|
cp = ssl_method_string(uhp);
|
|
if (cp != NULL) {
|
|
+ #ifndef OPENSSL_NO_SSL3
|
|
if (equal(cp, "ssl3"))
|
|
method = SSLv3_client_method();
|
|
else if (equal(cp, "tls1"))
|
|
method = TLSv1_client_method();
|
|
+ #else
|
|
+ if (equal(cp, "tls1"))
|
|
+ method = TLSv1_client_method();
|
|
+ #endif
|
|
else {
|
|
fprintf(stderr, catgets(catd, CATSET, 244,
|
|
"Invalid SSL method \"%s\"\n"), cp);
|
|
--
|
|
2.13.3
|
|
|