Your message dated Tue, 20 Dec 2011 11:03:10 +0000
with message-id <[email protected]>
and subject line Bug#652688: fixed in zathura 0.0.8.5-4
has caused the Debian Bug report #652688,
regarding zathura: Please enable additional hardening flags
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
652688: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=652688
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: zathura
Version: 0.0.8.5-3
Severity: important
Tags: patch
Dear Maintainer,
Please enable additional hardening flags. As PDF viewer zathura
reads untrusted data, thus all hardening flags are recommended.
The attached patch adds them. It works fine for me.
Regards,
Simon
-- System Information:
Debian Release: wheezy/sid
APT prefers unstable
APT policy: (500, 'unstable')
Architecture: amd64 (x86_64)
Kernel: Linux 3.1.0-1-amd64 (SMP w/8 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Versions of packages zathura depends on:
ii libc6 2.13-23
ii libcairo2 1.10.2-6.2
ii libglib2.0-0 2.30.2-4
ii libgtk2.0-0 2.24.8-2
ii libpango1.0-0 1.29.4-2
ii libpoppler-glib6 0.16.7-2+b1
zathura recommends no packages.
Versions of packages zathura suggests:
pn cups-client | lprng <none>
pn elinks [www-browser] 0.12~pre5-6
pn poppler-data <none>
-- no debconf information
diff -Nru zathura-0.0.8.5/debian/rules zathura-0.0.8.5/debian/rules
--- zathura-0.0.8.5/debian/rules 2011-11-12 15:10:36.000000000 +0100
+++ zathura-0.0.8.5/debian/rules 2011-12-13 18:23:06.000000000 +0100
@@ -1,10 +1,13 @@
#!/usr/bin/make -f
# -*- makefile -*-
+# Use hardening flags.
+dpkg_buildflags = DEB_BUILD_MAINT_OPTIONS="hardening=+all" dpkg-buildflags
+
# zathura's build system does not support CPPFLAGS yet
-export CFLAGS=$(shell dpkg-buildflags --get CPPFLAGS) $(shell dpkg-buildflags --get CFLAGS)
+export CFLAGS=$(shell $(dpkg_buildflags) --get CPPFLAGS) $(shell $(dpkg_buildflags) --get CFLAGS)
# remove unused libraries to reduce dependencies
-export LDFLAGS=-Wl,--as-needed $(shell dpkg-buildflags --get LDFLAGS)
+export LDFLAGS=-Wl,--as-needed $(shell $(dpkg_buildflags) --get LDFLAGS)
# do not strip
export SFLAGS=
# build with verbose output
--- End Message ---
--- Begin Message ---
Source: zathura
Source-Version: 0.0.8.5-4
We believe that the bug you reported is fixed in the latest version of
zathura, which is due to be installed in the Debian FTP archive:
zathura_0.0.8.5-4.debian.tar.gz
to main/z/zathura/zathura_0.0.8.5-4.debian.tar.gz
zathura_0.0.8.5-4.dsc
to main/z/zathura/zathura_0.0.8.5-4.dsc
zathura_0.0.8.5-4_amd64.deb
to main/z/zathura/zathura_0.0.8.5-4_amd64.deb
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Sebastian Ramacher <[email protected]> (supplier of updated zathura package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Format: 1.8
Date: Tue, 20 Dec 2011 11:43:33 +0100
Source: zathura
Binary: zathura
Architecture: source amd64
Version: 0.0.8.5-4
Distribution: unstable
Urgency: low
Maintainer: Sebastian Ramacher <[email protected]>
Changed-By: Sebastian Ramacher <[email protected]>
Description:
zathura - PDF viewer with a minimalistic interface
Closes: 652688
Changes:
zathura (0.0.8.5-4) unstable; urgency=low
.
* Enable all hardening flags. Thanks to Simon Ruderich for the patch.
(Closes: #652688)
Checksums-Sha1:
0fbef11296d529637f8c7652754dc9c07cc1a52e 1921 zathura_0.0.8.5-4.dsc
b6fe0267093ef8eb72d51c5b95c07f6aa31eb0f9 5356 zathura_0.0.8.5-4.debian.tar.gz
099130536dd763b6952542aa2f052d875f50c54a 53280 zathura_0.0.8.5-4_amd64.deb
Checksums-Sha256:
b90c5f0ac3dac32bb024877077fea5fe8ae7537e21f9a9e8c55f6d247237ece0 1921
zathura_0.0.8.5-4.dsc
73bd6d8236a1493b87e8a4f36d1179066900fa675b7a18aeee2db36652fb2ad8 5356
zathura_0.0.8.5-4.debian.tar.gz
c6b33ffc3a456e8df633042bd4d85065651e4e1d18475b576b8ccb1176190655 53280
zathura_0.0.8.5-4_amd64.deb
Files:
c763b21da6d9b9e9bf465485f9f08d57 1921 text optional zathura_0.0.8.5-4.dsc
91b50c9b67a9f63eb3725ff39a1f9f22 5356 text optional
zathura_0.0.8.5-4.debian.tar.gz
6613f7d318efe6673d6f599f2af9bf68 53280 text optional
zathura_0.0.8.5-4_amd64.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
iQIcBAEBCAAGBQJO8GhQAAoJEGny/FFupxmT5AQQAIMlK28zEm6ss7D6kkaDL0M7
FBgTODhDv7IX2NCJ4eu0S9YyHiqc/4j9EGPjQuRNcExTMSHLxvueur887pjIV8Ht
RSG7fQrLRJlGezTjtRFB+MqWKW/Gzee/28B4aFaF6jj9C3Y5a3W6MbRq5s4NWUhD
nugSbnBN5mPh2XxMtsT/XcJUjV3qccncACvyhRZ0vWcKUSdVc4xgk8a4X0ONmXWd
A+VDLdUxXaIUoMCDzDHIgTOqFB0mPCqJIOQksU3FpTMvIxgfF+GHR2Fbgj83Vys1
pVBswUBLgeeiYAhGvjbKBEZ7Z1/T5tjndZVfvQxEU7bWWy/IuLszgzEgn7lJpRIA
3gZKQ3JU5uPPfMf1iL618ZddkCJzLrfpDPrYQkRZyMEY+BIHiwTn948auKf7G9hj
B+iwo2G3MA/gCkA/6XVtiqX47Ex2u+sBV2ofntE3/3yy2BGhZLQOy5aPvUESqfqQ
NXyzVQUyh78FMEC4mf8qIjHXU36dkFjRZxYWkeQ4nCvCErJeI4MpOC5bWO1g0CMi
ua7FQPoVoJT/vJaJQRcdt9T0ufeYHS6NPxa4O8Hpwd2FOLF6LLZwvQBLiN/Ez3oQ
pNdRCuvRP9maZx2YnEKuA3gITjaD9Gx0jD8dtV+dj+yOvce3n9asg3h4IEKLXbSg
/oY5UgkUgh/DtT5iDzys
=QK3H
-----END PGP SIGNATURE-----
--- End Message ---
