On 2026/09/17 06:48, Ivo Marino wrote: > Hi Stuart, > > Updating to 0.8.1 is a better fix than patching the old snapshot, thanks > for checking that both CVEs are covered there and for putting the diff > together. Please go ahead.
I'll wait a while longer to see if yasuoka@ (maintainer) has any concerns about the update. (including the previous message below for easier reference to the diff) On 2026/09/15 13:32, Stuart Henderson wrote: > On 2026/09/14 18:05, Ivo Marino wrote: > > Hi, > > > > devel/cjose (0.6.1pl20260427) is affected by two real security > > issues, both already fixed upstream and both already backported > > for Debian's LTS branch: > > How about updating instead? I've confirmed that these two fixes are > included. > > Fortunately low impact here as this library is not used by other ports. Index: Makefile =================================================================== RCS file: /cvs/ports/devel/cjose/Makefile,v diff -u -p -r1.8 Makefile --- Makefile 13 May 2026 07:23:41 -0000 1.8 +++ Makefile 15 Sep 2026 12:32:15 -0000 @@ -2,10 +2,9 @@ COMMENT = Javascript Object Signing and GH_ACCOUNT = cisco GH_PROJECT = cjose -GH_COMMIT = db7d26ef2bd02572128c7cdaa4066f39af2b42da -DISTNAME = cjose-0.6.1pl20260427 +GH_TAGNAME = 0.8.1 -SHARED_LIBS = cjose 0.1 +SHARED_LIBS = cjose 0.2 CATEGORIES = devel Index: distinfo =================================================================== RCS file: /cvs/ports/devel/cjose/distinfo,v diff -u -p -r1.2 distinfo --- distinfo 13 May 2026 07:23:41 -0000 1.2 +++ distinfo 15 Sep 2026 12:32:15 -0000 @@ -1,2 +1,2 @@ -SHA256 (cjose-0.6.1pl20260427-db7d26ef.tar.gz) = //HJclJXJ+FzA9MPOKEDuDlSKhXA7yOshIXgkdu6UNM= -SIZE (cjose-0.6.1pl20260427-db7d26ef.tar.gz) = 1589696 +SHA256 (cjose-0.8.1.tar.gz) = HuhkuiFs/Cw4cmuAsIKrzuJ3JWkkGmqCLGvY0/01uK4= +SIZE (cjose-0.8.1.tar.gz) = 1643735 Index: patches/patch-Makefile_am =================================================================== RCS file: /cvs/ports/devel/cjose/patches/patch-Makefile_am,v diff -u -p -r1.2 patch-Makefile_am --- patches/patch-Makefile_am 11 Mar 2022 18:49:49 -0000 1.2 +++ patches/patch-Makefile_am 15 Sep 2026 12:32:15 -0000 @@ -8,4 +8,4 @@ Index: Makefile.am +SUBDIRS = . include src test platform EXTRA_DIST = CHANGELOG.md README.md LICENSE - pkgconfigdir = $(libdir)/pkgconfig + ACLOCAL_AMFLAGS = -I m4 Index: patches/patch-cjose_pc_in =================================================================== RCS file: patches/patch-cjose_pc_in diff -N patches/patch-cjose_pc_in --- patches/patch-cjose_pc_in 11 Mar 2022 18:49:49 -0000 1.2 +++ /dev/null 1 Jan 1970 00:00:00 -0000 @@ -1,11 +0,0 @@ -Index: cjose.pc.in ---- cjose.pc.in.orig -+++ cjose.pc.in -@@ -11,6 +11,6 @@ Name: cjose - URL: https://github.com/cisco/cjose - Description: JOSE implementation for C - Version: @VERSION@ --Requires: jansson >= 2.3, libcrypto >= 1.0.1 -+Requires: jansson >= 2.3 - Cflags: -I${includedir} - Libs: -L${libdir} -lcjose Index: patches/patch-src_Makefile_am =================================================================== RCS file: /cvs/ports/devel/cjose/patches/patch-src_Makefile_am,v diff -u -p -r1.3 patch-src_Makefile_am --- patches/patch-src_Makefile_am 13 May 2026 07:23:41 -0000 1.3 +++ patches/patch-src_Makefile_am 15 Sep 2026 12:32:15 -0000 @@ -1,13 +1,9 @@ Index: src/Makefile.am --- src/Makefile.am.orig +++ src/Makefile.am -@@ -1,7 +1,7 @@ --AM_CFLAGS =-std=gnu99 --pedantic -Wall -Werror -g -O2 -I$(top_builddir)/include -+AM_CFLAGS =-std=gnu99 --pedantic -Wall -I$(top_builddir)/include +@@ -1,4 +1,4 @@ +-AM_CFLAGS =-std=gnu99 --pedantic -Wall -Werror -g -O2 -DOPENSSL_API_COMPAT=0x10100000L -I$(top_builddir)/include ++AM_CFLAGS =-std=gnu99 --pedantic -Wall -DOPENSSL_API_COMPAT=0x10100000L -I$(top_builddir)/include lib_LTLIBRARIES=libcjose.la --libcjose_la_CPPFLAGS= -I$(topdir)/include -+libcjose_la_CPPFLAGS= -I$(top_builddir)/include - libcjose_la_LDFLAGS= -lm - libcjose_la_SOURCES=version.c \ - util.c \ + libcjose_la_CPPFLAGS= -I$(top_srcdir)/include Index: patches/patch-src_concatkdf_c =================================================================== RCS file: patches/patch-src_concatkdf_c diff -N patches/patch-src_concatkdf_c --- patches/patch-src_concatkdf_c 13 May 2026 07:23:41 -0000 1.3 +++ /dev/null 1 Jan 1970 00:00:00 -0000 @@ -1,12 +0,0 @@ -Index: src/concatkdf.c ---- src/concatkdf.c.orig -+++ src/concatkdf.c -@@ -14,7 +14,7 @@ - #include <malloc.h> - #else - #include <arpa/inet.h> --#include <alloca.h> -+#include <stdlib.h> - #endif - #include <openssl/evp.h> - #include <string.h> Index: patches/patch-test_Makefile_am =================================================================== RCS file: patches/patch-test_Makefile_am diff -N patches/patch-test_Makefile_am --- /dev/null 1 Jan 1970 00:00:00 -0000 +++ patches/patch-test_Makefile_am 15 Sep 2026 12:32:15 -0000 @@ -0,0 +1,11 @@ +Index: test/Makefile.am +--- test/Makefile.am.orig ++++ test/Makefile.am +@@ -1,6 +1,6 @@ + if HAVE_CHECK + +-AM_CPPFLAGS =-std=gnu99 --pedantic -Wall -Werror -g -O2 -DOPENSSL_API_COMPAT=0x10100000L -I$(top_builddir)/include \ ++AM_CPPFLAGS =-std=gnu99 --pedantic -Wall -DOPENSSL_API_COMPAT=0x10100000L -I$(top_builddir)/include \ + -I$(top_srcdir)/include -I$(top_builddir)/include/cjose + + AM_CPPFLAGS += @CHECK_CFLAGS@
