a/kernel-generic-5.4.6-x86_64-2.txz: Rebuilt.
a/kernel-huge-5.4.6-x86_64-2.txz: Rebuilt.
a/kernel-modules-5.4.6-x86_64-2.txz: Rebuilt.
ap/vim-8.2.0050-x86_64-1.txz: Upgraded.
d/kernel-headers-5.4.6-x86-2.txz: Rebuilt.
k/kernel-source-5.4.6-noarch-2.txz: Rebuilt.
Apparently MODULE_SIG was enabled by SECURITY_LOCKDOWN_LSM. We'll turn both
of those off to avoid needlessly tainting the kernel.
-LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY n
-LOCK_DOWN_KERNEL_FORCE_INTEGRITY n
-LOCK_DOWN_KERNEL_FORCE_NONE y
-MODULE_SIG_ALL n
-MODULE_SIG_FORCE n
-MODULE_SIG_FORMAT y
-MODULE_SIG_HASH "sha256"
-MODULE_SIG_KEY "certs/signing_key.pem"
-MODULE_SIG_SHA1 n
-MODULE_SIG_SHA224 n
-MODULE_SIG_SHA256 y
-MODULE_SIG_SHA384 n
-MODULE_SIG_SHA512 n
-SECURITY_LOCKDOWN_LSM_EARLY y
MODULE_SIG y -> n
SECURITY_LOCKDOWN_LSM y -> n
l/imagemagick-7.0.9_12-x86_64-1.txz: Upgraded.
l/libcap-2.29-x86_64-1.txz: Upgraded.
xap/vim-gvim-8.2.0050-x86_64-1.txz: Upgraded.
isolinux/initrd.img: Rebuilt.
kernels/*: Rebuilt.
usb-and-pxe-installers/usbboot.img: Rebuilt.
a/kernel-generic-5.4.6-x86_64-1.txz: Upgraded.
a/kernel-huge-5.4.6-x86_64-1.txz: Upgraded.
a/kernel-modules-5.4.6-x86_64-1.txz: Upgraded.
a/procps-ng-3.3.16-x86_64-2.txz: Rebuilt.
Patched to hardcode the pgrep command string buffer size to 4096 as was done
in the previous release. This avoids an allocation error when the stack size
is unlimited. Thanks to Jeroslaw Siebert.
a/xfsprogs-5.4.0-x86_64-1.txz: Upgraded.
d/kernel-headers-5.4.6-x86-1.txz: Upgraded.
k/kernel-source-5.4.6-noarch-1.txz: Upgraded.
l/QScintilla-2.11.4-x86_64-1.txz: Upgraded.
n/dhcpcd-8.1.4-x86_64-1.txz: Upgraded.
n/lftp-4.9.0-x86_64-1.txz: Upgraded.
xap/hexchat-2.14.3-x86_64-1.txz: Upgraded.
isolinux/initrd.img: Rebuilt.
kernels/*: Upgraded.
usb-and-pxe-installers/usbboot.img: Rebuilt.
a/aaa_elflibs-15.0-x86_64-17.txz: Rebuilt.
Upgraded: libcap.so.2.28, libelf-0.178.so, libglib-2.0.so.0.6200.4,
libgmodule-2.0.so.0.6200.4, libgobject-2.0.so.0.6200.4,
libgthread-2.0.so.0.6200.4, libidn2.so.0.3.7, libpcre2-8.so.0.9.0,
libtdb.so.1.4.3.
Added: libffi.so.6.0.4, libffi.so.7.1.0.
a/file-5.38-x86_64-2.txz: Rebuilt.
Patched to fix ELF shared libraries misidentified as "statically linked."
a/kernel-firmware-20191220_6871bff-noarch-1.txz: Upgraded.
a/openssl10-solibs-1.0.2u-x86_64-1.txz: Upgraded.
(* Security fix *)
d/guile-2.2.6-x86_64-2.txz: Rebuilt.
Recompiled against libffi-3.3.
d/llvm-9.0.1-x86_64-1.txz: Upgraded.
Compiled against libffi-3.3.
d/python-2.7.17-x86_64-2.txz: Rebuilt.
Recompiled against libffi-3.3.
d/python3-3.7.6-x86_64-1.txz: Upgraded.
Compiled against libffi-3.3.
d/ruby-2.6.5-x86_64-2.txz: Rebuilt.
Recompiled against libffi-3.3.
l/glib2-2.62.4-x86_64-2.txz: Rebuilt.
Recompiled against libffi-3.3.
l/libffi-3.3-x86_64-1.txz: Upgraded.
Shared library .so-version bump.
l/libvpx-1.8.2-x86_64-1.txz: Upgraded.
l/pygobject-2.28.7-x86_64-4.txz: Rebuilt.
Recompiled against libffi-3.3.
l/pygobject3-3.34.0-x86_64-2.txz: Rebuilt.
Recompiled against libffi-3.3.
l/sip-4.19.20-x86_64-1.txz: Upgraded.
n/cifs-utils-6.10-x86_64-1.txz: Upgraded.
n/dhcpcd-8.1.3-x86_64-1.txz: Upgraded.
n/openssl10-1.0.2u-x86_64-1.txz: Upgraded.
This update fixes a low severity security issue:
Fixed an an overflow bug in the x86_64 Montgomery squaring procedure used in
exponentiation with 512-bit moduli.
For more information, see:
https://www.openssl.org/news/secadv/20191206.txthttps://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1551
(* Security fix *)
n/p11-kit-0.23.18.1-x86_64-2.txz: Rebuilt.
Recompiled against libffi-3.3.
extra/tigervnc/tigervnc-1.10.1-x86_64-1.txz: Upgraded.
From tigervnc.org: "This is a security release to fix a number of issues
that were found by Kaspersky Lab. These issues affect both the client and
server and could theoretically allow a malicious peer to take control
over the software on the other side. No working exploit is known at this
time, and the issues require the peer to first be authenticated. We still
urge users to upgrade when possible."
(* Security fix *)
a/usb_modeswitch-2.5.2-x86_64-2.txz: Rebuilt.
Seems there's a regression in usb_modeswitch-2.6.0, so let's revert to
usb_modeswitch-2.5.2 but keep the latest usb-modeswitch-data-20191128.
Thanks to Lockywolf.
l/fuse3-3.9.0-x86_64-2.txz: Rebuilt.
Install fuse.conf as fuse.conf.new. This won't prevent an existing config
file from being overwritten with this upgrade, but it will prevent that
from happening again moving forward. Thanks to chrisVV.
a/kernel-firmware-20191215_eefb5f7-noarch-1.txz: Upgraded.
a/mcelog-167-x86_64-1.txz: Upgraded.
a/mkinitrd-1.4.11-x86_64-14.txz: Rebuilt.
Patched init to fix the case where -T and -C options are used with UUID=.
Thanks to davjohn and GazL.
ap/cups-filters-1.26.0-x86_64-1.txz: Upgraded.
d/re2c-1.3-x86_64-1.txz: Upgraded.
l/fuse3-3.9.0-x86_64-1.txz: Upgraded.
n/mutt-1.13.1-x86_64-1.txz: Upgraded.
ap/hplip-3.19.12-x86_64-1.txz: Upgraded.
ap/pamixer-1.4-x86_64-4.txz: Rebuilt.
Recompiled against boost-1.72.0.
ap/vim-8.2.0000-x86_64-1.txz: Upgraded.
d/bison-3.5-x86_64-1.txz: Upgraded.
kde/calligra-2.9.11-x86_64-33.txz: Rebuilt.
Recompiled against boost-1.72.0.
l/akonadi-1.13.0-x86_64-14.txz: Rebuilt.
Recompiled against boost-1.72.0.
l/boost-1.72.0-x86_64-1.txz: Upgraded.
Shared library .so-version bump.
l/libssh-0.9.3-x86_64-1.txz: Upgraded.
This fixes a security issue (low impact according to upstream):
Unsanitized location in scp could lead to unwanted command execution.
In addition, the 0.9.3 release benefited from a security audit sponsored
by the Mozilla Open Source Support program. The audit results were used
to improve the overall security and code quality of libssh.
For more information, see:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14889
(* Security fix *)
n/libqmi-1.24.2-x86_64-1.txz: Upgraded.
x/compiz-0.8.16.1-x86_64-1.txz: Upgraded.
x/mesa-19.3.0-x86_64-1.txz: Upgraded.
xap/vim-gvim-8.2.0000-x86_64-1.txz: Upgraded.
ap/mariadb-10.4.11-x86_64-1.txz: Upgraded.
d/cmake-3.16.1-x86_64-1.txz: Upgraded.
d/git-2.24.1-x86_64-1.txz: Upgraded.
l/mozjs52-52.9.0esr-x86_64-2.txz: Removed.
This was used only by polkit-0.115.
l/mozjs60-60.9.0esr-x86_64-1.txz: Added.
This is needed for polkit-0.116.
l/polkit-0.116-x86_64-1.txz: Upgraded.
n/ModemManager-1.12.2-x86_64-1.txz: Upgraded.
xap/xine-ui-0.99.12-x86_64-1.txz: Upgraded.
l/dconf-0.34.0-x86_64-2.txz: Rebuilt.
Rebuilt using the sed replacements suggested by LFS. This fixes a
subsequent build of dconf-editor.
l/glib-networking-2.62.2-x86_64-1.txz: Upgraded.
n/samba-4.11.3-x86_64-1.txz: Upgraded.
This update fixes the following security issues:
Samba AD DC zone-named record Denial of Service in DNS management server.
DelegationNotAllowed was not enforced in protocol transition on Samba AD DC.
For more information, see:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14861https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14870
(* Security fix *)
x/vulkan-sdk-1.1.126.0-x86_64-1.txz: Upgraded.
a/tcsh-6.22.02-x86_64-1.txz: Upgraded.
ap/vim-8.1.2391-x86_64-1.txz: Upgraded.
l/fuse3-3.8.0-x86_64-2.txz: Rebuilt.
rc.fuse3: Don't source /lib/lsb/init-functions unless it exists.
NOTE: FUSE seems to work fine without starting rc.fuse3, which it why it
isn't actually called from anywhere during system startup.
n/iw-5.4-x86_64-1.txz: Upgraded.
n/php-7.4.0-x86_64-2.txz: Rebuilt.
Rebuilt using --enable-gd=shared and --with-zip=shared.
Thanks to Matteo Bernardini.
xap/gv-3.7.4-x86_64-3.txz: Rebuilt.
Patched to fix save/print features when used with the latest ghostscript.
Added --enable-international build option.
Fixed broken whitespace in the bounding-box patch.
Thanks to Xsane.
xap/vim-gvim-8.1.2391-x86_64-1.txz: Upgraded.
a/hwdata-0.330-noarch-1.txz: Upgraded.
a/lvm2-2.03.07-x86_64-1.txz: Upgraded.
a/tcsh-6.22.01-x86_64-1.txz: Upgraded.
d/python-setuptools-42.0.2-x86_64-1.txz: Upgraded.
n/gnutls-3.6.11.1-x86_64-1.txz: Upgraded.
xap/gnuplot-5.2.8-x86_64-1.txz: Upgraded.
xap/mozilla-firefox-68.3.0esr-x86_64-1.txz: Upgraded.
This is a bugfix release.
For more information, see:
https://www.mozilla.org/en-US/firefox/68.3.0/releasenotes/
ap/xfsdump-3.1.8-x86_64-4.txz: Rebuilt.
Patched for new xfsprogs-5.3.0 API. Thanks to nobodino.
d/cmake-3.16.0-x86_64-1.txz: Upgraded.
n/gnupg2-2.2.18-x86_64-1.txz: Upgraded.
gpg: Prepare against chosen-prefix SHA-1 collisions in key signatures.
This change removes all SHA-1 based key signature newer than 2019-01-19
from the web-of-trust. Note that this includes all key signatures
created with dsa1024 keys. The new option --allow-weak-key-signatures
can be used to override the new and safer behaviour.
For more information, see:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14855
(* Security fix *)
n/iproute2-5.4.0-x86_64-1.txz: Upgraded.
x/libepoxy-1.5.4-x86_64-1.txz: Upgraded.
n/bind-9.14.8-x86_64-1.txz: Upgraded.
This update fixes a security issue:
Set a limit on the number of concurrently served pipelined TCP queries.
For more information, see:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6477
(* Security fix *)
x/mesa-19.2.5-x86_64-1.txz: Upgraded.
testing/packages/kernel-generic-5.4.0_rc8-x86_64-1.txz: Upgraded.
testing/packages/kernel-headers-5.4.0_rc8-x86-1.txz: Upgraded.
testing/packages/kernel-huge-5.4.0_rc8-x86_64-1.txz: Upgraded.
testing/packages/kernel-modules-5.4.0_rc8-x86_64-1.txz: Upgraded.
testing/packages/kernel-source-5.4.0_rc8-noarch-1.txz: Upgraded.
-VBOXSF_FS m
+X86_INTEL_TSX_MODE_AUTO n
+X86_INTEL_TSX_MODE_OFF y
+X86_INTEL_TSX_MODE_ON n
ap/qpdf-9.1.0-x86_64-1.txz: Upgraded.
d/check-0.13.0-x86_64-1.txz: Added.
This is needed to build PulseAudio using Meson.
l/alsa-lib-1.2.1-x86_64-2.txz: Rebuilt.
Merge alsa-topology-conf-1.2.1 and alsa-ucm-conf-1.2.1 into the package.
l/pulseaudio-13.0-x86_64-2.txz: Rebuilt.
Rebuilt with meson. This causes esound support to be dropped, but it's
likely that nobody will care.
l/pyparsing-2.4.5-x86_64-1.txz: Upgraded.
extra/pure-alsa-system/alsa-lib-1.2.1-x86_64-2_alsa.txz: Rebuilt.
Merge alsa-topology-conf-1.2.1 and alsa-ucm-conf-1.2.1 into the package.
ap/alsa-utils-1.2.1-x86_64-1.txz: Upgraded.
l/alsa-lib-1.2.1-x86_64-1.txz: Upgraded.
l/alsa-plugins-1.2.1-x86_64-1.txz: Upgraded.
l/imagemagick-7.0.9_4-x86_64-1.txz: Upgraded.
extra/pure-alsa-system/alsa-lib-1.2.1-x86_64-1_alsa.txz: Upgraded.
extra/pure-alsa-system/alsa-plugins-1.2.1-x86_64-1_alsa.txz: Upgraded.
testing/packages/kernel-generic-5.4.0_rc7-x86_64-2.txz: Rebuilt.
testing/packages/kernel-headers-5.4.0_rc7-x86-2.txz: Rebuilt.
testing/packages/kernel-huge-5.4.0_rc7-x86_64-2.txz: Rebuilt.
testing/packages/kernel-modules-5.4.0_rc7-x86_64-2.txz: Rebuilt.
testing/packages/kernel-source-5.4.0_rc7-noarch-2.txz: Rebuilt.
CRYPTO_CRC32C_INTEL m -> y
Make modules before cleaning up the source tree. This does some magic in
Module.symvers that fixes building the NVIDIA kernel modules.
l/system-config-printer-1.5.12-x86_64-1.txz: Upgraded.
n/sshfs-3.6.0-x86_64-1.txz: Upgraded.
xap/mozilla-thunderbird-68.2.2-x86_64-1.txz: Upgraded.
This is a bugfix release.
For more information, see:
https://www.mozilla.org/en-US/thunderbird/68.2.2/releasenotes/
