diff --git a/backport-fix-CVE-2021-39365.patch b/backport-fix-CVE-2021-39365.patch deleted file mode 100644 index 87c331b..0000000 --- a/backport-fix-CVE-2021-39365.patch +++ /dev/null @@ -1,32 +0,0 @@ -From cd2472e506dafb1bb8ae510e34ad4797f63e263e Mon Sep 17 00:00:00 2001 -From: Bastien Nocera -Date: Mon, 21 Jun 2021 15:00:14 +0200 -Subject: [PATCH] net: Fix TLS cert validation not being done for any network - call - -The default SoupSessionAsync behaviour does not perform any TLS certificate -validation, unless the ssl-use-system-ca-file property is set to true. - -See https://blogs.gnome.org/mcatanzaro/2021/05/25/reminder-soupsessionsync-and-soupsessionasync-default-to-no-tls-certificate-verification/ - -This mitigates CVE-2016-20011. - -Closes: #146 ---- - libs/net/grl-net-wc.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/libs/net/grl-net-wc.c b/libs/net/grl-net-wc.c -index 9bd4922..1193d4b 100644 ---- a/libs/net/grl-net-wc.c -+++ b/libs/net/grl-net-wc.c -@@ -314,6 +314,7 @@ grl_net_wc_init (GrlNetWc *wc) - wc->priv = grl_net_wc_get_instance_private (wc); - - wc->priv->session = soup_session_async_new (); -+ g_object_set (G_OBJECT (wc->priv->session), "ssl-use-system-ca-file", TRUE, NULL); - wc->priv->pending = g_queue_new (); - - set_thread_context (wc); --- -2.27.0 diff --git a/grilo-0.3.13.tar.xz b/grilo-0.3.13.tar.xz deleted file mode 100644 index 2bc06bc..0000000 Binary files a/grilo-0.3.13.tar.xz and /dev/null differ diff --git a/grilo-0.3.14.tar.xz b/grilo-0.3.14.tar.xz new file mode 100644 index 0000000..0c021b3 Binary files /dev/null and b/grilo-0.3.14.tar.xz differ diff --git a/grilo.spec b/grilo.spec index 16681c3..e2dcc9d 100644 --- a/grilo.spec +++ b/grilo.spec @@ -1,17 +1,13 @@ -# first two digits of version %define release_version %(echo %{version} | awk -F. '{print $1"."$2}') Name: grilo -Version: 0.3.13 -Release: 2 +Version: 0.3.14 +Release: 1 Summary: A framework for browsing and searching media content - License: LGPLv2+ URL: https://wiki.gnome.org/Projects/Grilo Source0: https://download.gnome.org/sources/grilo/%{release_version}/grilo-%{version}.tar.xz -Patch6000: backport-fix-CVE-2021-39365.patch - BuildRequires: chrpath glib2-devel gettext gobject-introspection-devel >= 0.9.0 BuildRequires: gtk-doc gtk3-devel liboauth-devel libsoup-devel libxml2-devel BuildRequires: meson totem-pl-parser-devel vala >= 0.27.1 libxslt @@ -51,36 +47,37 @@ install the %{name}-devel package if you want to develop applications that use %install %meson_install -mkdir -p %{buildroot}%{_libdir}/grilo-%{release_version}/ -mkdir -p %{buildroot}%{_datadir}/grilo-%{release_version}/plugins/ +mkdir -p $RPM_BUILD_ROOT%{_libdir}/grilo-%{release_version}/ +mkdir -p $RPM_BUILD_ROOT%{_datadir}/grilo-%{release_version}/plugins/ %find_lang grilo %ldconfig_scriptlets %files -f grilo.lang -%doc NEWS AUTHORS -%{_bindir}/*-0.3 -%{_libdir}/*-0.3.so.* -%dir %{_libdir}/grilo-0.3/ -%{_libdir}/girepository-1.0/*-0.3.typelib -%dir %{_datadir}/grilo-0.3/plugins/ +%license COPYING +%{_bindir}/* +%{_libdir}/*.so.* +%{_libdir}/grilo-0.3/ +%{_libdir}/girepository-1.0/ +%{_datadir}/grilo-0.3/ %license COPYING %files devel -%{_includedir}/grilo-0.3/*.h -%{_includedir}/grilo-0.3/net/*.h -%{_includedir}/grilo-0.3/pls/*.h +%{_includedir}/grilo-0.3/ %{_libdir}/pkgconfig/*.pc -%{_datadir}/gir-1.0/*.gir -%{_datadir}/vala/vapi/* +%{_datadir}/gir-1.0/ +%{_datadir}/vala/ %{_libdir}/*.so %files help -%doc README.md TODO -%{_mandir}/man1/*.gz +%doc AUTHORS NEWS README.md TODO +%{_mandir}/man1/*.1* %{_datadir}/gtk-doc/html/grilo/ %changelog +* Mon Mar 28 2022 lin zhang - 0.3.14-1 +- Update to 0.3.14 + * Mon Sep 13 2021 yangcheng - 0.3.13-2 - Type:CVE - CVE:CVE-2021-39365