Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package opam for openSUSE:Factory checked in at 2026-07-17 01:39:37 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/opam (Old) and /work/SRC/openSUSE:Factory/.opam.new.24530 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "opam" Fri Jul 17 01:39:37 2026 rev:22 rq:1365591 version:2.5.2 Changes: -------- --- /work/SRC/openSUSE:Factory/opam/opam.changes 2026-04-17 21:05:33.701047473 +0200 +++ /work/SRC/openSUSE:Factory/.opam.new.24530/opam.changes 2026-07-17 01:41:38.981537327 +0200 @@ -1,0 +2,6 @@ +Tue Jul 7 07:07:07 UTC 2026 - [email protected] + +- Update to version 2.5.2 (CVE-2026-57825) + see included CHANGES file for details + +------------------------------------------------------------------- Old: ---- opam-2.5.1.tar.xz New: ---- opam-2.5.2.tar.xz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ opam.spec ++++++ --- /var/tmp/diff_new_pack.LHQCn0/_old 2026-07-17 01:41:39.541556236 +0200 +++ /var/tmp/diff_new_pack.LHQCn0/_new 2026-07-17 01:41:39.541556236 +0200 @@ -17,10 +17,11 @@ Name: opam -Version: 2.5.1 +Version: 2.5.2 Release: 0 Summary: Source-based package manager for OCaml License: LGPL-2.1-only WITH OCaml-LGPL-linking-exception +ExclusiveArch: aarch64 ppc64le riscv64 s390x x86_64 URL: https://opam.ocaml.org/ Source: %name-%version.tar.xz BuildRequires: autoconf ++++++ _service ++++++ --- /var/tmp/diff_new_pack.LHQCn0/_old 2026-07-17 01:41:39.577557451 +0200 +++ /var/tmp/diff_new_pack.LHQCn0/_new 2026-07-17 01:41:39.581557586 +0200 @@ -39,7 +39,7 @@ <param name="exclude">src_ext</param> <param name="exclude">tests</param> <param name="filename">opam</param> - <param name="revision">6218d0c4c022106034a93c8ecb5b80fa213d7356</param> + <param name="revision">ad0564f20c6306bc83085fe663cab903fe887208</param> <param name="scm">git</param> <param name="submodules">disable</param> <param name="url">https://github.com/ocaml/opam.git</param> ++++++ opam-2.5.1.tar.xz -> opam-2.5.2.tar.xz ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/opam-2.5.1/CHANGES new/opam-2.5.2/CHANGES --- old/opam-2.5.1/CHANGES 2026-04-15 21:19:31.000000000 +0200 +++ new/opam-2.5.2/CHANGES 2026-07-08 20:34:02.000000000 +0200 @@ -3,6 +3,27 @@ are not marked). Those prefixed with "(+)" are new command/option (since 2.1.0~alpha2). +2.5.2: +* Fix a bug that allowed a package to install files anywhere on the system + using a symlink to an external directory without warning the user and + asking for their permission: CVE-2026-57825 / OSEC-2026-10. + [#7005 @NathanReb] +* Re-allow `..` in `.install` files, partially reverts 2.5.1's #6879 + [#7008 @kit-ty-kate - fix ocaml/dune#14393] +* Stop the installation process via .install file from creating unnecessary + intermediate directories for paths that contain `..` [#7015 @kit-ty-kate] +* Improve and extend the testsuite + [#6953 #7011 #7008 #7005 @NathanReb @rjbou @kit-ty-kate] +* API changes in `opam-core`: + * `OpamFilename.{,dir_}starts_with`: Fix a bug where `foo/bar` would be + considered a prefix of `foo/bar-baz` [#6953 @NathanReb - fix #6948] + * `OpamFilename.{,dir_}starts_with`: `/` and `\` are now equivalent on + Windows [#6953 @NathanReb] + * `OpamFilename.starts_with`: `starts_with "a/b" "a/b"` no longer returns + `true` [#6953 @NathanReb] + * `OpamSystem.real_path`: fix a bug where paths after a non existent + directory where not resolve [#7011 @kit-ty-kate - fix #7010] + 2.5.1: * Invalidate .install fields containing destination filepath trying to escape their scope [#6897 @kit-ty-kate - report by @andrew] * Fix a string injection from the depexts field to nix-build, when `os-family=nixos` [#6894 @RyanGibb] diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/opam-2.5.1/configure.ac new/opam-2.5.2/configure.ac --- old/opam-2.5.1/configure.ac 2026-04-15 21:19:31.000000000 +0200 +++ new/opam-2.5.2/configure.ac 2026-07-08 20:34:02.000000000 +0200 @@ -1,5 +1,5 @@ dnl The line below must be formatted AC_INIT([opam],[VERSION]) with no extra spaces -AC_INIT([opam],[2.5.1]) +AC_INIT([opam],[2.5.2]) AC_COPYRIGHT(Copyright 2012-2019 OcamlPro SAS) AC_CONFIG_MACRO_DIR([m4]) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/opam-2.5.1/opam-client.opam new/opam-2.5.2/opam-client.opam --- old/opam-2.5.1/opam-client.opam 2026-04-15 21:19:31.000000000 +0200 +++ new/opam-2.5.2/opam-client.opam 2026-07-08 20:34:02.000000000 +0200 @@ -1,5 +1,5 @@ opam-version: "2.0" -version: "2.5.1" +version: "2.5.2" synopsis: "Client library for opam 2.5" description: """ Actions on the opam root, switches, installations, and front-end. diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/opam-2.5.1/opam-core.opam new/opam-2.5.2/opam-core.opam --- old/opam-2.5.1/opam-core.opam 2026-04-15 21:19:31.000000000 +0200 +++ new/opam-2.5.2/opam-core.opam 2026-07-08 20:34:02.000000000 +0200 @@ -1,5 +1,5 @@ opam-version: "2.0" -version: "2.5.1" +version: "2.5.2" synopsis: "Core library for opam 2.5" description: "Small standard library extensions, and generic system interaction modules used by opam." diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/opam-2.5.1/opam-devel.opam new/opam-2.5.2/opam-devel.opam --- old/opam-2.5.1/opam-devel.opam 2026-04-15 21:19:31.000000000 +0200 +++ new/opam-2.5.2/opam-devel.opam 2026-07-08 20:34:02.000000000 +0200 @@ -1,5 +1,5 @@ opam-version: "2.0" -version: "2.5.1" +version: "2.5.2" synopsis: "Bootstrapped development binary for opam 2.5" description: """ This package compiles (bootstraps) opam. For consistency and safety of the installation, the binaries are not installed into the PATH, but into lib/opam-devel, from where the user can manually install them system-wide. diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/opam-2.5.1/opam-format.opam new/opam-2.5.2/opam-format.opam --- old/opam-2.5.1/opam-format.opam 2026-04-15 21:19:31.000000000 +0200 +++ new/opam-2.5.2/opam-format.opam 2026-07-08 20:34:02.000000000 +0200 @@ -1,5 +1,5 @@ opam-version: "2.0" -version: "2.5.1" +version: "2.5.2" synopsis: "Format library for opam 2.5" description: """ Definition of opam datastructures and its file interface. diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/opam-2.5.1/opam-installer.opam new/opam-2.5.2/opam-installer.opam --- old/opam-2.5.1/opam-installer.opam 2026-04-15 21:19:31.000000000 +0200 +++ new/opam-2.5.2/opam-installer.opam 2026-07-08 20:34:02.000000000 +0200 @@ -1,5 +1,5 @@ opam-version: "2.0" -version: "2.5.1" +version: "2.5.2" synopsis: "Installation of files to a prefix, following opam conventions" description: """ opam-installer is a small tool that can read *.install files, as defined by opam [1], and execute them to install or remove package files without going through opam. diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/opam-2.5.1/opam-repository.opam new/opam-2.5.2/opam-repository.opam --- old/opam-2.5.1/opam-repository.opam 2026-04-15 21:19:31.000000000 +0200 +++ new/opam-2.5.2/opam-repository.opam 2026-07-08 20:34:02.000000000 +0200 @@ -1,5 +1,5 @@ opam-version: "2.0" -version: "2.5.1" +version: "2.5.2" synopsis: "Repository library for opam 2.5" description: """ This library includes repository and remote sources handling, including curl/wget, rsync, git, mercurial, darcs backends. diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/opam-2.5.1/opam-solver.opam new/opam-2.5.2/opam-solver.opam --- old/opam-2.5.1/opam-solver.opam 2026-04-15 21:19:31.000000000 +0200 +++ new/opam-2.5.2/opam-solver.opam 2026-07-08 20:34:02.000000000 +0200 @@ -1,5 +1,5 @@ opam-version: "2.0" -version: "2.5.1" +version: "2.5.2" synopsis: "Solver library for opam 2.5" description: """ Solver and Cudf interaction. This library is based on the Cudf and Dose libraries, and handles calls to the external solver from opam. diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/opam-2.5.1/opam-state.opam new/opam-2.5.2/opam-state.opam --- old/opam-2.5.1/opam-state.opam 2026-04-15 21:19:31.000000000 +0200 +++ new/opam-2.5.2/opam-state.opam 2026-07-08 20:34:02.000000000 +0200 @@ -1,5 +1,5 @@ opam-version: "2.0" -version: "2.5.1" +version: "2.5.2" synopsis: "State library for opam 2.5" description: """ Handling of the ~/.opam hierarchy, repository and switch states. diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/opam-2.5.1/src/client/opamAction.ml new/opam-2.5.2/src/client/opamAction.ml --- old/opam-2.5.1/src/client/opamAction.ml 2026-04-15 21:19:31.000000000 +0200 +++ new/opam-2.5.2/src/client/opamAction.ml 2026-07-08 20:34:02.000000000 +0200 @@ -25,6 +25,7 @@ if not (OpamFilename.exists_dir build_dir) then [], None else let root = st.switch_global.root in let switch_prefix = OpamPath.Switch.root root st.switch in + let switch_meta = OpamPath.Switch.meta root st.switch in let file_wo_prefix f = OpamFilename.remove_prefix switch_prefix f in let name = nv.name in @@ -100,7 +101,7 @@ else (base, false) in let src_file = OpamFilename.create build_dir base.c in - let dst_file = match dst with + let unsafe_dst_file = match dst with | None -> OpamFilename.create dst_dir (OpamFilename.basename src_file) | Some d -> if append && not (OpamFilename.Base.check_suffix d ".exe") then @@ -108,11 +109,27 @@ (OpamFilename.Base.add_extension d "exe") else OpamFilename.create dst_dir d in + let dst_file = + OpamFilename.of_string + (OpamSystem.real_path (OpamFilename.to_string unsafe_dst_file)) + in let file = file_wo_prefix dst_file in let inst warning = if append then warning (OpamFilename.to_string src_file) `Add_exe; let check, warn = check ~src:build_dir ~dst:dst_dir base in - if check then + let escapes = + not (OpamFilename.starts_with switch_prefix dst_file) + || (OpamFilename.starts_with switch_meta dst_file) + in + if escapes then + (OpamConsole.error + "package %s attempted to install a file outside allowed \ + destination directories: %s -> %s." + (OpamPackage.Name.to_string name) + (OpamFilename.to_string unsafe_dst_file) + (OpamFilename.to_string dst_file); + failwith ".install file escaping allowed directories") + else if check then OpamFilename.install ~warning ~exec ~src:src_file ~dst:dst_file (); warn in diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/opam-2.5.1/src/core/opamCompat.ml new/opam-2.5.2/src/core/opamCompat.ml --- old/opam-2.5.1/src/core/opamCompat.ml 2026-04-15 21:19:31.000000000 +0200 +++ new/opam-2.5.2/src/core/opamCompat.ml 2026-07-08 20:34:02.000000000 +0200 @@ -81,15 +81,11 @@ (** NOTE: OCaml >= 4.13 *) let realpath s = - let getchdir s = - let p = - try Sys.getcwd () - with Sys_error _ -> Filename.get_temp_dir_name () - in - Unix.chdir s; - p - in - try getchdir (getchdir s) with Unix.Unix_error _ -> s + let orig_cwd = Sys.getcwd () in + Unix.chdir s; + let r = Unix.getcwd () in + Sys.chdir orig_cwd; + r include Unix end diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/opam-2.5.1/src/core/opamFilename.ml new/opam-2.5.2/src/core/opamFilename.ml --- old/opam-2.5.1/src/core/opamFilename.ml 2026-04-15 21:19:31.000000000 +0200 +++ new/opam-2.5.2/src/core/opamFilename.ml 2026-07-08 20:34:02.000000000 +0200 @@ -344,11 +344,23 @@ with Unix.Unix_error _ -> OpamSystem.internal_error "%s does not exist." (to_string file) -let starts_with dirname filename = - OpamCompat.String.starts_with ~prefix:(Dir.to_string dirname) (to_string filename) +let cmpable_dir_string dir = + match OpamSystem.forward_to_back (Dir.to_string dir) with + | "" -> "" + | d -> Filename.concat d "" -let dir_starts_with pfx dir = - OpamCompat.String.starts_with ~prefix:(Dir.to_string pfx) (Dir.to_string dir) +let cmpable_file_string file = + OpamSystem.forward_to_back (to_string file) + +let starts_with prefix filename = + let prefix = cmpable_dir_string prefix in + let dir = cmpable_file_string filename in + OpamCompat.String.starts_with ~prefix dir + +let dir_starts_with prefix dir = + let prefix = cmpable_dir_string prefix in + let dir = cmpable_dir_string dir in + OpamCompat.String.starts_with ~prefix dir let remove_prefix prefix filename = let prefix = diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/opam-2.5.1/src/core/opamSystem.ml new/opam-2.5.2/src/core/opamSystem.ml --- old/opam-2.5.1/src/core/opamSystem.ml 2026-04-15 21:19:31.000000000 +0200 +++ new/opam-2.5.2/src/core/opamSystem.ml 2026-07-08 20:34:02.000000000 +0200 @@ -55,28 +55,21 @@ let (/) = Filename.concat -let real_path p = - (* if Filename.is_relative p then *) - match (try Some (Sys.is_directory p) with Sys_error _ -> None) with - | None -> - let rec resolve dir = - if Sys.file_exists dir then OpamCompat.Unix.realpath dir else - let parent = Filename.dirname dir in - if dir = parent then dir - else Filename.concat (resolve parent) (Filename.basename dir) - in - let p = - if Filename.is_relative p then Filename.concat (Sys.getcwd ()) p - else p - in - resolve p - | Some true -> OpamCompat.Unix.realpath p - | Some false -> - let dir = OpamCompat.Unix.realpath (Filename.dirname p) in - match Filename.basename p with - | "." -> dir - | base -> dir / base - (* else p *) +let rec real_path p = + try OpamCompat.Unix.realpath p with + | Unix.Unix_error _ when p = "." -> + raise (Sys_error "No such file or directory") + | Unix.Unix_error _ -> + let dirname = Filename.dirname p in + match Filename.basename p with + | "." -> real_path dirname + | ".." -> + let dirname = real_path dirname in + if String.equal (Filename.dirname dirname) dirname then + raise (Sys_error "Invalid path") + else + Filename.dirname dirname + | x -> real_path dirname / x let temp_basename prefix = Printf.sprintf "%s-%d-%06x" prefix (OpamStubs.getpid ()) (Random.int 0xFFFFFF) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/opam-2.5.1/src/format/opamFile.ml new/opam-2.5.2/src/format/opamFile.ml --- old/opam-2.5.1/src/format/opamFile.ml 2026-04-15 21:19:31.000000000 +0200 +++ new/opam-2.5.2/src/format/opamFile.ml 2026-07-08 20:34:02.000000000 +0200 @@ -3730,9 +3730,7 @@ (Pp.opt @@ Pp.singleton -| Pp.V.string -| Pp.pp ~name:"rel-filename" (fun ~pos s -> - if OpamFilename.might_escape ~sep:`Unspecified s then - Pp.bad_format ~pos "%s references its parent directory." s - else if Filename.is_relative s then + if Filename.is_relative s then OpamFilename.Base.of_string s else Pp.bad_format ~pos "%s is an absolute filename." s)
