Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package virtiofsd for openSUSE:Factory checked in at 2026-07-17 18:47:00 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/virtiofsd (Old) and /work/SRC/openSUSE:Factory/.virtiofsd.new.24530 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "virtiofsd" Fri Jul 17 18:47:00 2026 rev:14 rq:1365937 version:1.14.0 Changes: -------- --- /work/SRC/openSUSE:Factory/virtiofsd/virtiofsd.changes 2026-03-06 18:16:28.518878484 +0100 +++ /work/SRC/openSUSE:Factory/.virtiofsd.new.24530/virtiofsd.changes 2026-07-17 18:47:13.804696885 +0200 @@ -1,0 +2,44 @@ +Wed Jul 15 08:33:02 UTC 2026 - Dario Faggioli <[email protected]> + +- Update to version 1.14.0: + * Bump version to v1.14.0 + * passthrough: only clear capabilities on regular files + * Track the file type on HandleData + * read_dir: add tests for u64 cookie fallback path + * read_dir: handle u64 directory cookies that exceed i64::MAX + * passthrough: add negotiation modes to --security-label + * passthrough: add negotiation modes to --posix-acl + * vhost_user: exit gracefully on queue processing errors + * vhost_user: extract process_message() from queue processing loops + * deps: bump vhost 0.15->0.16, vhost-user-backend 0.21->0.22 + * passthrough: remove redundant inode lookups in open_inode() + * server: do not reject oversized readdir requests + * server: reject malformed extension lengths with a minimal local check + * passthrough: avoid panic in setxattr on non-UTF-8 names + * Support multiple supplementary groups + * Update rust-vmm dependencies + * seccomp: Don't allow newfstatat syscall on sparc64 + * README: --announce-submounts is enabled by default + * sandbox: only canonicalize shared_dir for chroot + * sandbox: fix pivot_root to relative paths + +------------------------------------------------------------------- +Thu Mar 12 16:01:43 UTC 2026 - Dario Faggioli <[email protected]> + +- Add explicit handling of (and checking that is has + actually been handled) bsc#1257912 (CVE-2026-25727). + Patch added: + * update-time-0.3.47.patch + +- Service file cleanup and refactoring + +- Update to version 1.13.3: + * Bump version to v1.13.3 + * Allow readv() seccomp + * Allow pwritev() seccomp + * Extend traits methods to support ReadvFlag + * Replace preadv64() with preadv2() + * Update pwritev2() flags + * Add Intellij IDEA configuration to .gitignore + +------------------------------------------------------------------- Old: ---- vendor.tar.xz virtiofsd-1.13.2.tar.xz New: ---- _servicedata update-time-0.3.47.patch vendor.tar.zst virtiofsd-1.14.0.obscpio virtiofsd.obsinfo ----------(New B)---------- New: Patch added: * update-time-0.3.47.patch ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ virtiofsd.spec ++++++ --- /var/tmp/diff_new_pack.HG27I2/_old 2026-07-17 18:47:14.876733192 +0200 +++ /var/tmp/diff_new_pack.HG27I2/_new 2026-07-17 18:47:14.880733327 +0200 @@ -23,15 +23,16 @@ %endif Name: virtiofsd -Version: 1.13.2 +Version: 1.14.0 Release: 0 Summary: A vhost-user virtio-fs device backend written in Rust Group: Development/Libraries/Rust License: Apache-2.0 URL: https://gitlab.com/virtio-fs/virtiofsd Source0: %{name}-%{version}.tar.xz -Source1: vendor.tar.xz +Source1: vendor.tar.zst Source2: 50-virtiofsd.json +Patch0: update-time-0.3.47.patch BuildRequires: cargo BuildRequires: cargo-packaging BuildRequires: libcap-ng-devel @@ -48,6 +49,18 @@ # the definition of libexecdir macro on SLE and Tumbleweed (bsc#1219772) sed -i 's#@@LIBEXECDIR@@#%{_virtiofsd_libexecdir}#' %{SOURCE2} +# Special checks for making sure that bsc#1257912 (CVE-2026-25727) +# has been correctly handled. +TIME_VERSION=$(awk '/^name = "time"/{flag=1} flag && /^version =/{print $3; exit}' Cargo.lock | tr -d '"') +MIN_TIME_VERSION="0.3.47" +HIGHEST=$(printf "%s\n%s" "$MIN_TIME_VERSION" "$TIME_VERSION" | sort -V | tail -n1) +if [ "$HIGHEST" != "$TIME_VERSION" ]; then + echo "=== ERROR! bsc#1257912 (CVE-2026-25727) not handled properly." + echo " The time crate is at version $TIME_VERSION. It must be at least $MIN_TIME_VERSION." + echo " Check the changelog of the patch update-time-0.3.47.patch and follow the instructions" + exit 1 +fi + %build %{cargo_build} ++++++ _service ++++++ --- /var/tmp/diff_new_pack.HG27I2/_old 2026-07-17 18:47:14.936735224 +0200 +++ /var/tmp/diff_new_pack.HG27I2/_new 2026-07-17 18:47:14.940735360 +0200 @@ -1,28 +1,26 @@ <services> - <service name="obs_scm" mode="disabled"> + <service name="obs_scm" mode="manual"> <param name="url">https://gitlab.com/virtio-fs/virtiofsd.git</param> <param name="scm">git</param> <param name="filename">virtiofsd</param> - <param name="revision">v1.13.2</param> + <param name="revision">v1.14.0</param> <param name="versionformat">@PARENT_TAG@</param> <param name="versionrewrite-pattern">[v]?([^\+]+)(.*)</param> <param name="versionrewrite-replacement">\1</param> <param name="changesgenerate">enable</param> </service> - - <service name="set_version" mode="disabled"/> - - <service name="tar" mode="disabled"/> - - <service name="recompress" mode="disabled"> - <param name="file">*.tar</param> - <param name="compression">xz</param> + <service name="set_version" mode="manual"/> + <service name="cargo_vendor" mode="manual"> + <param name="srcdir">virtiofsd</param> + <param name="update">false</param> </service> - - <service name="cargo_vendor" mode="disabled"> + <service name="cargo_audit" mode="manual"> <param name="srcdir">virtiofsd</param> + </service> + <service name="tar" mode="buildtime"/> + <service name="recompress" mode="buildtime"> + <param name="file">*.tar</param> <param name="compression">xz</param> - <param name="update">true</param> </service> </services> ++++++ _servicedata ++++++ <servicedata> <service name="tar_scm"> <param name="url">https://gitlab.com/virtio-fs/virtiofsd.git</param> <param name="changesrevision">c2540f8db14caba81c1e37fba23fc7bf2cd7f0dd</param></service></servicedata> (No newline at EOF) ++++++ update-time-0.3.47.patch ++++++ >From 97efc05058a832dd8ec1c67ed047ede49110218f Mon Sep 17 00:00:00 2001 From: Dario Faggioli <[email protected]> Date: Wed, 15 Jul 2026 12:49:07 +0200 Subject: [PATCH] [PATCH] Update the time crate (bsc#1257912, CVE-2026-25727) Update the time crate to version 0.3.47 to deal with bsc#1257912, CVE-2026-25727. Of course, this does not work if the vendor.tar.zst. So, in order for this patch to be effective, the package maintainers need to run the following commands (in the package sources): osc service manualrun cd virtiofsd patch -p1 < ../update-time-0.3.47.patch mkdir .cargo cargo vendor > .cargo/config.toml tar -I zstd -cf vendor.tar.zst vendor/ .cargo/ mv vendor.tar.zst .. Signed-off-by: Dario Faggioli <[email protected]> --- Cargo.lock | 65 +++++++++++++++++++++++++++++++++++++++++++++++++----- 1 file changed, 59 insertions(+), 6 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index bdbed36..9b4b054 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -223,6 +223,15 @@ version = "1.1.2" source = "registry+https://github.com/rust-lang/crates.io-index"; checksum = "7059fff8937831a9ae6f0fe4d658ffabf58f2ca96aa9dec1c889f936f705f216" +[[package]] +name = "deranged" +version = "0.5.8" +source = "registry+https://github.com/rust-lang/crates.io-index"; +checksum = "7cd812cc2bc1d69d4764bd80df88b4317eaef9e773c75226407d9bc0876b211c" +dependencies = [ + "powerfmt", +] + [[package]] name = "env_logger" version = "0.8.4" @@ -494,6 +503,12 @@ version = "2.5.0" source = "registry+https://github.com/rust-lang/crates.io-index"; checksum = "2dffe52ecf27772e601905b7522cb4ef790d2cc203488bbd0e2fe85fcb74566d" +[[package]] +name = "num-conv" +version = "0.2.0" +source = "registry+https://github.com/rust-lang/crates.io-index"; +checksum = "cf97ec579c3c42f953ef76dbf8d55ac91fb219dde70e49aa4a6b7d74e9919050" + [[package]] name = "num_cpus" version = "1.13.1" @@ -542,6 +557,12 @@ dependencies = [ "serde", ] +[[package]] +name = "powerfmt" +version = "0.2.0" +source = "registry+https://github.com/rust-lang/crates.io-index"; +checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391" + [[package]] name = "ppv-lite86" version = "0.2.20" @@ -658,18 +679,28 @@ checksum = "b0293b4b29daaf487284529cc2f5675b8e57c61f70167ba415a463651fd6a918" [[package]] name = "serde" -version = "1.0.168" +version = "1.0.228" source = "registry+https://github.com/rust-lang/crates.io-index"; -checksum = "d614f89548720367ded108b3c843be93f3a341e22d5674ca0dd5cd57f34926af" +checksum = "9a8e94ea7f378bd32cbbd37198a4a91436180c5bb472411e48b5ec2e2124ae9e" +dependencies = [ + "serde_core", + "serde_derive", +] + +[[package]] +name = "serde_core" +version = "1.0.228" +source = "registry+https://github.com/rust-lang/crates.io-index"; +checksum = "41d385c7d4ca58e59fc732af25c3983b67ac852c1a25000afe1175de458b67ad" dependencies = [ "serde_derive", ] [[package]] name = "serde_derive" -version = "1.0.168" +version = "1.0.228" source = "registry+https://github.com/rust-lang/crates.io-index"; -checksum = "d4fe589678c688e44177da4f27152ee2d190757271dc7f1d5b6b9f68d869d641" +checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79" dependencies = [ "proc-macro2", "quote", @@ -778,13 +809,35 @@ dependencies = [ [[package]] name = "time" -version = "0.3.11" +version = "0.3.47" source = "registry+https://github.com/rust-lang/crates.io-index"; -checksum = "72c91f41dcb2f096c05f0873d667dceec1087ce5bcf984ec8ffb19acddbb3217" +checksum = "743bd48c283afc0388f9b8827b976905fb217ad9e647fae3a379a9283c4def2c" dependencies = [ + "deranged", "itoa", "libc", + "num-conv", "num_threads", + "powerfmt", + "serde_core", + "time-core", + "time-macros", +] + +[[package]] +name = "time-core" +version = "0.1.8" +source = "registry+https://github.com/rust-lang/crates.io-index"; +checksum = "7694e1cfe791f8d31026952abf09c69ca6f6fa4e1a1229e18988f06a04a12dca" + +[[package]] +name = "time-macros" +version = "0.2.27" +source = "registry+https://github.com/rust-lang/crates.io-index"; +checksum = "2e70e4c5a0e0a8a4823ad65dfe1a6930e4f4d756dcd9dd7939022b5e8c501215" +dependencies = [ + "num-conv", + "time-core", ] [[package]] -- 2.55.0 ++++++ virtiofsd.obsinfo ++++++ name: virtiofsd version: 1.14.0 mtime: 1783331602 commit: c2540f8db14caba81c1e37fba23fc7bf2cd7f0dd
