Skip site navigation (1)Skip section navigation (2)
Date:      Tue, 22 Jan 2019 13:55:35 +0000
From:      Glen Barber <gjb@freebsd.org>
To:        Kubilay Kocak <koobs@freebsd.org>
Cc:        ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org
Subject:   Re: svn commit: r490941 - head/security/vuxml
Message-ID:  <20190122135535.GD71665@FreeBSD.org>
In-Reply-To: <5317a569-8501-0c9c-6b7f-af34bc09ad7b@FreeBSD.org>
References:  <201901221232.x0MCWIGe082441@repo.freebsd.org> <5317a569-8501-0c9c-6b7f-af34bc09ad7b@FreeBSD.org>

next in thread | previous in thread | raw e-mail | index | archive | help

--C+ts3FVlLX8+P6JN
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Wed, Jan 23, 2019 at 12:35:05AM +1100, Kubilay Kocak wrote:
> On 22/01/2019 11:32 pm, Glen Barber wrote:
> > Author: gjb
> > Date: Tue Jan 22 12:32:18 2019
> > New Revision: 490941
> > URL: https://svnweb.freebsd.org/changeset/ports/490941
> >=20
> > Log:
> >    Attempt to fix vuxml build.
> >    Sponsored by:	The FreeBSD Foundation
> >=20
> > Modified:
> >    head/security/vuxml/vuln.xml
> >=20
> > Modified: head/security/vuxml/vuln.xml
> > =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D
> > --- head/security/vuxml/vuln.xml	Tue Jan 22 12:30:21 2019	(r490940)
> > +++ head/security/vuxml/vuln.xml	Tue Jan 22 12:32:18 2019	(r490941)
> > @@ -62,7 +62,7 @@ Notes:
> >       <topic>www/py-requests -- Information disclosure vulnerability</t=
opic>
> >       <affects>
> >         <package>
> > -	<name>py*-requests</name>
> > +	<name>py-requests</name>
> >   	<range><lt>2.20.0</lt></range>
> >         </package>
> >       </affects>
> >=20
>=20
> Hi Glen,
>=20
> This now doesn't match PKGNAME's (pyXY-requests).
>=20
> What is/was the issue exactly?
>=20

I'm not entirely sure, but the build failed with:

 /home/vuxmlbuild/vuxmlweb/dtd/vuxml-1/catalog.xml /home/vuxmlbuild/vuxmlwe=
b/dtd/xhtml-modularization/catalog.xml
 /home/vuxmlbuild/vuxmlweb/dtd/xhtml-basic/catalog.xml
 Parsing VuXML ...Application exception:
 bad package name for vid 50ad9a9a-1e28-11e9-98d7-0050562a4d7b: py*-request=
s @ho:220
 *** Error code 1

Removing the '*' stopped the build failure emails.

> It passed make validate and passed the pkg audit tests (see below) mentio=
ned
> in the file, in order to match any python version of the port, future or
> past. This at least means pkg audit understands the globbing pattern.

'pkg audit' does, yes, but that does not mean the XML parser does for
this case.

Glen


--C+ts3FVlLX8+P6JN
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEjRJAPC5sqwhs9k2jAxRYpUeP4pMFAlxHINMACgkQAxRYpUeP
4pO0wQ/+L74+kfNlSXt5bET05PjuK378oXYa8EOkc9K6mijh5VSp9MRBqCO3bWx3
iuTzoav3YEifeAopiWYCmiRz1p7bMdK1BQGau6eC0eaq35j13+ZBOjYAG3Y/4rur
aqWjUeElygxBFuZiur58gltS2EG5yVHvh5k2R/A7eRv8OZzPb8tWcxqhnqVhZTbd
gKnAXtrT25bzBy2L6L5K7auWbXzlczpKwFwJMCALr5TrWULs077ynq/qGrf27XEx
rvMnvYC5FIfUtjgUDH8A1jDEsKskOVtYrJ3kUiFhBEEG7WiVPGf7UAXLzva4GjjG
V8FIrSQYUUKVnsfu8JCAcY6ss6hab/43sWracpxS1LYjQpmyaHytw/26Gy53295x
2Nb4owIZeHQlgwawXCWq8bKJpCMe15N5bC0lILRE6uZZTQ55M4girqhh3yVYQejp
UY/vZNRX/+xVvsjck/KwEdRnbB2GCkvU5QxeJnxf8a4dc4t5vnaBrqq/NtTFQ6r/
rAIZ5U/UCZg6FmU8aYQ31I3yITI2TVUc2iLZhWNMDiKJqSeVntpzNSuHrfkDAccV
vXujl//SdRXEzNS/xpqomQozsvqJgP5Cms+JAbh1ziu5gl5aqmmIIu3P+lYrcOER
fXAV/amYesf4M8CTRqRz7Y/hIhOlDZQWnFytAJKP+HBIP3V4zxE=
=pt4u
-----END PGP SIGNATURE-----

--C+ts3FVlLX8+P6JN--



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20190122135535.GD71665>