Control: tags 835353 + patch
Control: tags 835353 + pending

Dear maintainer,

I've prepared an NMU for pari (versioned as 2.7.6-1.1) and
uploaded it to DELAYED/5. Please feel free to tell me if I
should delay it longer.

Regards.

-- 
 .''`.  Homepage https://info.comodo.priv.at/ - OpenPGP key 0xBB3A68018649AA06
 : :' : Debian GNU/Linux user, admin, and developer -  https://www.debian.org/
 `. `'  Member of VIBE!AT & SPI, fellow of the Free Software Foundation Europe
   `-   NP: Funny Van Dannen: Hallo Heimat
diff -Nru pari-2.7.6/debian/changelog pari-2.7.6/debian/changelog
--- pari-2.7.6/debian/changelog	2016-06-21 16:15:31.000000000 +0200
+++ pari-2.7.6/debian/changelog	2016-08-31 20:55:15.000000000 +0200
@@ -1,3 +1,13 @@
+pari (2.7.6-1.1) unstable; urgency=medium
+
+  * Non-maintainer upload.
+  * Fix "FTBFS with '.' removed from perl's @INC":
+    add patch perl-no-dot-in-inc to call perl with "-I." for the scripts which
+    use a module in the same directory.
+    (Closes: #835353)
+
+ -- gregor herrmann <gre...@debian.org>  Wed, 31 Aug 2016 20:55:15 +0200
+
 pari (2.7.6-1) unstable; urgency=low
 
   * New upstream release
diff -Nru pari-2.7.6/debian/patches/perl-no-dot-in-inc pari-2.7.6/debian/patches/perl-no-dot-in-inc
--- pari-2.7.6/debian/patches/perl-no-dot-in-inc	1970-01-01 01:00:00.000000000 +0100
+++ pari-2.7.6/debian/patches/perl-no-dot-in-inc	2016-08-31 20:55:05.000000000 +0200
@@ -0,0 +1,37 @@
+Description: call perl with -I.
+ Perl has removed . from @INC; cf. CVE-2016-1238.
+ Various perl scripts in src/desc "use PARI::822;" which is below this
+ directory and isn't found anymore.
+ Update the relevant makefiles to add -I.
+Origin: vendor
+Bug-Debian: https://bugs.debian.org/835353
+Forwarded: no
+Author: gregor herrmann <gre...@debian.org>
+Last-Update: 2016-08-31
+
+--- a/config/Makefile.SH
++++ b/config/Makefile.SH
+@@ -666,7 +666,7 @@
+   esac
+ HUGELINE="$HUGELINE
+ $target: $depend
+-	f=$name-$suffix; (cd $desc && \$(PERL) $script > \$\$f) && mv $desc/\$\$f \$@"
++	f=$name-$suffix; (cd $desc && \$(PERL) -I. $script > \$\$f) && mv $desc/\$\$f \$@"
+ done
+ echo "$HUGELINE" >> $file
+ 
+--- a/config/DOC_Make.SH
++++ b/config/DOC_Make.SH
+@@ -153,10 +153,10 @@
+ 	@-$cfg/genfunclist $desc
+ 
+ $desc/\$(DESC): $src/funclist $desc/merge_822 $desc/PARI/822.pm
+-	cd $desc && \$(PERL) merge_822 ../funclist > def\$(TMPSUF)
++	cd $desc && \$(PERL) -I. merge_822 ../funclist > def\$(TMPSUF)
+ 	mv $desc/def\$(TMPSUF) \$@
+ 
+ usersch3.tex: $desc/\$(DESC) ../src/desc/doc_make usersFUNCS.tex
+-	cd ../src/desc && \$(PERL) doc_make > ../../doc/usersch3.tex
++	cd ../src/desc && \$(PERL) -I. doc_make > ../../doc/usersch3.tex
+ EOT
+ fi
diff -Nru pari-2.7.6/debian/patches/series pari-2.7.6/debian/patches/series
--- pari-2.7.6/debian/patches/series	2015-10-26 11:21:42.000000000 +0100
+++ pari-2.7.6/debian/patches/series	2016-08-31 20:45:24.000000000 +0200
@@ -1,2 +1,3 @@
 enable_build_envvar
 perl-warning-non-fatal
+perl-no-dot-in-inc

Attachment: signature.asc
Description: Digital Signature

Reply via email to