Package init
This commit is contained in:
overweight
commit
c65c33446a
49
CVE-2019-10216.patch
Normal file
49
CVE-2019-10216.patch
Normal file
@ -0,0 +1,49 @@
|
|||||||
|
From 5b85ddd19a8420a1bd2d5529325be35d78e94234 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Chris Liddell <chris.liddell@artifex.com>
|
||||||
|
Date: Fri, 2 Aug 2019 15:18:26 +0100
|
||||||
|
Subject: [PATCH] Bug 701394: protect use of .forceput with executeonly
|
||||||
|
|
||||||
|
---
|
||||||
|
Resource/Init/gs_type1.ps | 14 +++++++-------
|
||||||
|
1 file changed, 7 insertions(+), 7 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/Resource/Init/gs_type1.ps b/Resource/Init/gs_type1.ps
|
||||||
|
index 6c7735b..a039cce 100644
|
||||||
|
--- a/Resource/Init/gs_type1.ps
|
||||||
|
+++ b/Resource/Init/gs_type1.ps
|
||||||
|
@@ -118,25 +118,25 @@
|
||||||
|
( to be the same as glyph: ) print 1 index //== exec } if
|
||||||
|
3 index exch 3 index .forceput
|
||||||
|
% scratch(string) RAGL(dict) AGL(dict) CharStrings(dict) cstring gname
|
||||||
|
- }
|
||||||
|
+ }executeonly
|
||||||
|
{pop} ifelse
|
||||||
|
- } forall
|
||||||
|
+ } executeonly forall
|
||||||
|
pop pop
|
||||||
|
- }
|
||||||
|
+ } executeonly
|
||||||
|
{
|
||||||
|
pop pop pop
|
||||||
|
} ifelse
|
||||||
|
- }
|
||||||
|
+ } executeonly
|
||||||
|
{
|
||||||
|
% scratch(string) RAGL(dict) AGL(dict) CharStrings(dict) cstring gname
|
||||||
|
pop pop
|
||||||
|
} ifelse
|
||||||
|
- } forall
|
||||||
|
+ } executeonly forall
|
||||||
|
3 1 roll pop pop
|
||||||
|
- } if
|
||||||
|
+ } executeonly if
|
||||||
|
pop
|
||||||
|
dup /.AGLprocessed~GS //true .forceput
|
||||||
|
- } if
|
||||||
|
+ } executeonly if
|
||||||
|
|
||||||
|
%% We need to excute the C .buildfont1 in a stopped context so that, if there
|
||||||
|
%% are errors we can put the stack back sanely and exit. Otherwise callers won't
|
||||||
|
--
|
||||||
|
1.8.3.1
|
||||||
|
|
||||||
22
ghostscript-9.23-100-run-dvipdf-securely.patch
Normal file
22
ghostscript-9.23-100-run-dvipdf-securely.patch
Normal file
@ -0,0 +1,22 @@
|
|||||||
|
From 91c9c6d17d445781ee572c281b8b9d75d96f9df8 Mon Sep 17 00:00:00 2001
|
||||||
|
From: "David Kaspar [Dee'Kej]" <dkaspar@redhat.com>
|
||||||
|
Date: Fri, 7 Oct 2016 13:57:01 +0200
|
||||||
|
Subject: [PATCH] Make sure 'dvipdf' is being run securely
|
||||||
|
|
||||||
|
---
|
||||||
|
lib/dvipdf | 2 +-
|
||||||
|
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||||
|
|
||||||
|
diff --git a/lib/dvipdf b/lib/dvipdf
|
||||||
|
index 802aeab..c92dfb0 100755
|
||||||
|
--- a/lib/dvipdf
|
||||||
|
+++ b/lib/dvipdf
|
||||||
|
@@ -43,4 +43,4 @@ fi
|
||||||
|
|
||||||
|
# We have to include the options twice because -I only takes effect if it
|
||||||
|
# appears before other options.
|
||||||
|
-exec dvips -Ppdf $DVIPSOPTIONS -q -f "$infile" | $GS_EXECUTABLE $OPTIONS -q -P- -dSAFER -dNOPAUSE -dBATCH -sDEVICE=pdfwrite -sstdout=%stderr -sOutputFile="$outfile" $OPTIONS -c .setpdfwrite -
|
||||||
|
+exec dvips -R -Ppdf $DVIPSOPTIONS -q -f "$infile" | $GS_EXECUTABLE $OPTIONS -q -P- -dSAFER -dNOPAUSE -dBATCH -sDEVICE=pdfwrite -sstdout=%stderr -sOutputFile="$outfile" $OPTIONS -c .setpdfwrite -
|
||||||
|
--
|
||||||
|
2.14.3
|
||||||
|
|
||||||
BIN
ghostscript-9.27.tar.xz
Normal file
BIN
ghostscript-9.27.tar.xz
Normal file
Binary file not shown.
190
ghostscript.spec
Normal file
190
ghostscript.spec
Normal file
@ -0,0 +1,190 @@
|
|||||||
|
%global _hardened_build 1
|
||||||
|
# override the default location of documentation or license files
|
||||||
|
# in 'ghostscript' instead of in 'libgs'
|
||||||
|
%global _docdir_fmt %{name}
|
||||||
|
# download version
|
||||||
|
%global version_short %(echo "%{version}" | tr -d '.')
|
||||||
|
# Obtain the location of Google Droid fonts directory
|
||||||
|
%global google_droid_fontpath %%(dirname $(fc-list : file | grep "DroidSansFallback"))
|
||||||
|
|
||||||
|
Name: ghostscript
|
||||||
|
Version: 9.27
|
||||||
|
Release: 3
|
||||||
|
Summary: An interpreter for PostScript and PDF files
|
||||||
|
License: AGPLv3+
|
||||||
|
URL: https://ghostscript.com/
|
||||||
|
Source0: https://github.com/ArtifexSoftware/ghostpdl-downloads/releases/download/gs%{version_short}/ghostscript-%{version}.tar.xz
|
||||||
|
|
||||||
|
# Downstream patches
|
||||||
|
Patch100: ghostscript-9.23-100-run-dvipdf-securely.patch
|
||||||
|
|
||||||
|
# Patch6000 from http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=5b85ddd19
|
||||||
|
Patch6000: CVE-2019-10216.patch
|
||||||
|
|
||||||
|
BuildRequires: automake gcc
|
||||||
|
BuildRequires: adobe-mappings-cmap-devel adobe-mappings-pdf-devel
|
||||||
|
BuildRequires: google-droid-sans-fonts urw-base35-fonts-devel
|
||||||
|
BuildRequires: cups-devel dbus-devel fontconfig-devel
|
||||||
|
BuildRequires: lcms2-devel libidn-devel libijs-devel libjpeg-turbo-devel
|
||||||
|
BuildRequires: libpng-devel libpaper-devel libtiff-devel openjpeg2-devel
|
||||||
|
BuildRequires: zlib-devel gtk3-devel libXt-devel
|
||||||
|
BuildRequires: jbig2dec-devel >= 0.16
|
||||||
|
|
||||||
|
Requires: adobe-mappings-cmap
|
||||||
|
Requires: adobe-mappings-cmap-lang
|
||||||
|
Requires: adobe-mappings-pdf
|
||||||
|
Requires: google-droid-sans-fonts
|
||||||
|
Requires: urw-base35-fonts
|
||||||
|
|
||||||
|
Obsoletes: %{name}-doc < %{version}-%{release}
|
||||||
|
Obsoletes: %{name}-x11 < %{version}-%{release}
|
||||||
|
Obsoletes: %{name}-gtk < %{version}-%{release}
|
||||||
|
Obsoletes: %{name}-tools-printing < %{version}-%{release}
|
||||||
|
Obsoletes: %{name}-tools-fonts < %{version}-%{release}
|
||||||
|
Obsoletes: libgs < %{version}-%{release}
|
||||||
|
Provides: %{name}-doc
|
||||||
|
Provides: %{name}-x11
|
||||||
|
Provides: %{name}-gtk
|
||||||
|
Provides: %{name}-tools-printing
|
||||||
|
Provides: %{name}-tools-fonts
|
||||||
|
Provides: libgs
|
||||||
|
Provides: %{name}-core
|
||||||
|
|
||||||
|
%description
|
||||||
|
Ghostscript is an interpreter for PostScript™ and Portable Document Format (PDF) files.
|
||||||
|
Ghostscript consists of a PostScript interpreter layer, and a graphics library.
|
||||||
|
|
||||||
|
%package devel
|
||||||
|
Summary: Development files for Ghostscript's library
|
||||||
|
Requires: %{name} = %{version}-%{release}
|
||||||
|
|
||||||
|
Obsoletes: libgs-devel < %{version}-%{release}
|
||||||
|
Provides: libgs-devel
|
||||||
|
|
||||||
|
%description devel
|
||||||
|
This package contains development files for %{name}.
|
||||||
|
|
||||||
|
%package help
|
||||||
|
Summary: Documents for %{name}
|
||||||
|
Buildarch: noarch
|
||||||
|
Requires: man info
|
||||||
|
Requires: %{name} = %{version}-%{release}
|
||||||
|
|
||||||
|
Obsoletes: %{name}-doc < %{version}-%{release}
|
||||||
|
Provides: %{name}-doc
|
||||||
|
|
||||||
|
%description help
|
||||||
|
Man pages and other related documents for %{name}.
|
||||||
|
|
||||||
|
%package tools-dvipdf
|
||||||
|
Summary: Ghostscript's 'dvipdf' utility
|
||||||
|
Requires: %{name} = %{version}-%{release}
|
||||||
|
Requires: texlive-dvips
|
||||||
|
|
||||||
|
%description tools-dvipdf
|
||||||
|
This package provides the utility 'dvipdf' for converting of TeX DVI files into
|
||||||
|
PDF files using Ghostscript and dvips
|
||||||
|
|
||||||
|
%prep
|
||||||
|
%autosetup -N -p1
|
||||||
|
|
||||||
|
# Libraries that we already have packaged(see Build Requirements):
|
||||||
|
rm -rf cups/libs freetype ijs jbig2dec jpeg lcms2* libpng openjpeg tiff zlib
|
||||||
|
rm -rf windows
|
||||||
|
|
||||||
|
%build
|
||||||
|
%configure --enable-dynamic --disable-compile-inits --without-versioned-path \
|
||||||
|
--with-fontpath="%{urw_base35_fontpath}:%{google_droid_fontpath}:%{_datadir}/%{name}/conf.d/"
|
||||||
|
%make_build so
|
||||||
|
|
||||||
|
%install
|
||||||
|
# to install necessary files without 'make_install'
|
||||||
|
make DESTDIR=%{buildroot} soinstall
|
||||||
|
|
||||||
|
# rename to 'gs' binary.
|
||||||
|
mv -f %{buildroot}%{_bindir}/{gsc,gs}
|
||||||
|
|
||||||
|
# remove files
|
||||||
|
rm -f %{buildroot}%{_bindir}/{lprsetup.sh,unix-lpr.sh}
|
||||||
|
rm -f %{buildroot}%{_docdir}/%{name}/{AUTHORS,COPYING,*.tex,*.hlp,*.txt}
|
||||||
|
rm -f %{buildroot}%{_datadir}/%{name}/doc
|
||||||
|
|
||||||
|
# move some files into html/
|
||||||
|
install -m 0755 -d %{buildroot}%{_docdir}/%{name}/html
|
||||||
|
cp doc/gsdoc.el %{buildroot}%{_docdir}/%{name}/
|
||||||
|
mv -f %{buildroot}%{_docdir}/%{name}/{*.htm*,*.el,html}
|
||||||
|
|
||||||
|
# create symlink
|
||||||
|
ln -s %{_bindir}/gs %{buildroot}%{_bindir}/ghostscript
|
||||||
|
ln -s %{_mandir}/man1/gs.1 %{buildroot}%{_mandir}/man1/ghostscript.1
|
||||||
|
|
||||||
|
# use the symlinks where possible.
|
||||||
|
ln -fs %{google_droid_fontpath}/DroidSansFallback.ttf %{buildroot}%{_datadir}/%{name}/Resource/CIDFSubst/DroidSansFallback.ttf
|
||||||
|
|
||||||
|
for font in $(basename --multiple %{buildroot}%{_datadir}/%{name}/Resource/Font/*); do
|
||||||
|
ln -fs %{urw_base35_fontpath}/${font}.t1 %{buildroot}%{_datadir}/%{name}/Resource/Font/${font}
|
||||||
|
done
|
||||||
|
|
||||||
|
# create symlink for each of the CMap files in Ghostscript's Resources/CMap folder.
|
||||||
|
for file in $(basename --multiple %{buildroot}%{_datadir}/%{name}/Resource/CMap/*); do
|
||||||
|
find %{adobe_mappings_rootpath} -type f -name ${file} -exec ln -fs {} %{buildroot}%{_datadir}/%{name}/Resource/CMap/${file} \;
|
||||||
|
done
|
||||||
|
|
||||||
|
install -m 0755 -d %{buildroot}%{_datadir}/%{name}/conf.d/
|
||||||
|
|
||||||
|
%check
|
||||||
|
make check
|
||||||
|
|
||||||
|
%pre
|
||||||
|
|
||||||
|
%preun
|
||||||
|
|
||||||
|
%post
|
||||||
|
|
||||||
|
%postun
|
||||||
|
|
||||||
|
%files
|
||||||
|
%defattr(-,root,root)
|
||||||
|
%license LICENSE doc/COPYING
|
||||||
|
%{_datadir}/%{name}/
|
||||||
|
%dir %{_datadir}/%{name}/conf.d/
|
||||||
|
%{_bindir}/gs
|
||||||
|
%{_bindir}/gsnd
|
||||||
|
%{_bindir}/ghostscript
|
||||||
|
%{_bindir}/eps2*
|
||||||
|
%{_bindir}/pdf2*
|
||||||
|
%{_bindir}/ps2*
|
||||||
|
%{_bindir}/gsx
|
||||||
|
%{_bindir}/gsbj
|
||||||
|
%{_bindir}/gsdj
|
||||||
|
%{_bindir}/gsdj500
|
||||||
|
%{_bindir}/gslj
|
||||||
|
%{_bindir}/gslp
|
||||||
|
%{_bindir}/pphs
|
||||||
|
%{_bindir}/pf2afm
|
||||||
|
%{_bindir}/pfbtopfa
|
||||||
|
%{_bindir}/printafm
|
||||||
|
%{_libdir}/libgs.so.*
|
||||||
|
%{_libdir}/%{name}/
|
||||||
|
|
||||||
|
%files devel
|
||||||
|
%{_libdir}/libgs.so
|
||||||
|
%{_includedir}/%{name}/
|
||||||
|
|
||||||
|
%files help
|
||||||
|
%{_mandir}/man1/*
|
||||||
|
%lang(de) %{_mandir}/de/man1/*
|
||||||
|
%doc %{_docdir}/%{name}/
|
||||||
|
|
||||||
|
%files tools-dvipdf
|
||||||
|
%{_bindir}/dvipdf
|
||||||
|
|
||||||
|
%changelog
|
||||||
|
* Mon Sep 23 2019 openEuler Buildteam <buildteam@openeuler.org> - 9.27-3
|
||||||
|
- fix CVE-2019-10216 and modify requires
|
||||||
|
|
||||||
|
* Mon Sep 23 2019 openEuler Buildteam <buildteam@openeuler.org> - 9.27-2
|
||||||
|
- Add subpackage tools-dvipdf
|
||||||
|
|
||||||
|
* Thu Sep 19 2019 openEuler Buildteam <buildteam@openeuler.org> - 9.27-1
|
||||||
|
- Package init
|
||||||
Loading…
x
Reference in New Issue
Block a user