Bug 246337 - graphics/ImageMagick7: Update to 7.0.10-24 with fixed vulnerability
Summary: graphics/ImageMagick7: Update to 7.0.10-24 with fixed vulnerability
Status: Closed FIXED
Alias: None
Product: Ports & Packages
Classification: Unclassified
Component: Individual Port(s) (show other bugs)
Version: Latest
Hardware: Any Any
: --- Affects Some People
Assignee: Koop Mast
URL: https://imagemagick.org/script/change...
Keywords: buildisok
Depends on:
Blocks:
 
Reported: 2020-05-09 17:39 UTC by Vladimir Druzenko
Modified: 2020-07-28 13:04 UTC (History)
4 users (show)

See Also:
bugzilla: maintainer-feedback? (kwm)
vvd: maintainer-feedback?


Attachments
Update to 7.0.10-11 (1.21 KB, patch)
2020-05-09 17:39 UTC, Vladimir Druzenko
no flags Details | Diff
Update to 7.0.10-11 (976 bytes, patch)
2020-05-09 23:08 UTC, Vladimir Druzenko
no flags Details | Diff
Update to 7.0.10-14 (1.04 KB, patch)
2020-05-24 04:10 UTC, Vladimir Druzenko
no flags Details | Diff
Update to 7.0.10-24 with fixed vulnerability (1.04 KB, patch)
2020-07-19 07:48 UTC, Vladimir Druzenko
no flags Details | Diff
Update to 7.0.10-24 with fixed vulnerability (1.78 KB, patch)
2020-07-20 07:29 UTC, Vladimir Druzenko
no flags Details | Diff
Update to 7.0.10-24 with fixed vulnerability (2.46 KB, patch)
2020-07-28 10:14 UTC, Vladimir Druzenko
vvd: maintainer-approval?
Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Vladimir Druzenko freebsd_committer freebsd_triage 2020-05-09 17:39:26 UTC
Created attachment 214320 [details]
Update to 7.0.10-11

Tested on 12.1 amd64.
Comment 1 Daniel Engberg freebsd_committer freebsd_triage 2020-05-09 19:12:17 UTC
MASTER_SITES needs a refresh (several mirrors are broken), please adress that.
https://imagemagick.org/script/mirror.php

I think a good idea would be to place a few mirrors and use mainsite as fallback to offload main site. Both nluug.nl and umu.se also supports https :-)

Does "make test" throw any errors and if so any difference compared to current version in tree?

Did you try building it with Poudriere?

Any reason why --enable-reproducible-build shouldn't be enabled?
Comment 2 Daniel Engberg freebsd_committer freebsd_triage 2020-05-09 19:14:01 UTC
...place a few mirrors in front

Sorry about that typo
Comment 3 Vladimir Druzenko freebsd_committer freebsd_triage 2020-05-09 19:24:48 UTC
(In reply to daniel.engberg.lists from comment #1)
Are these questions to me?
I'm just create patch for update version.
Comment 4 Daniel Engberg freebsd_committer freebsd_triage 2020-05-09 19:46:08 UTC
It's much easier (and faster) process if you can provide as much information as possible and fix issues.

Did you try "make test" and/or build it using Poudriere?
"By tested" you mean building and runtime?
Comment 5 Vladimir Druzenko freebsd_committer freebsd_triage 2020-05-09 19:56:44 UTC
(In reply to daniel.engberg.lists from comment #4)
> Did you try "make test"
No.
> and/or build it using Poudriere?
No.
> "By tested" you mean building and runtime?
Build + run several self tests in console, something like:
$ convert logo: logo.pdf
$ convert logo.pdf logo.png

I'm not maintainer of this port - just user with knowledge how to update it.

Your request about mirrors or other changes are for other PRs - this PR about update version only. If you want to add something to this patch - you can do it and attach it here. Or you can create separate PR{s} with your request{s}.
Comment 6 Vladimir Druzenko freebsd_committer freebsd_triage 2020-05-09 23:08:54 UTC
Created attachment 214327 [details]
Update to 7.0.10-11
Comment 7 Automation User 2020-05-24 00:17:27 UTC
Build info is available at https://gitlab.com/swills/freebsd-ports/pipelines/149007041
Comment 8 Vladimir Druzenko freebsd_committer freebsd_triage 2020-05-24 04:10:22 UTC
Created attachment 214800 [details]
Update to 7.0.10-14

While we waited, 3 new versions came out - 12, 13 and 14.
Comment 9 Vladimir Druzenko freebsd_committer freebsd_triage 2020-06-11 13:39:24 UTC
7.0.10-18 already released.
Comment 10 Vladimir Druzenko freebsd_committer freebsd_triage 2020-07-19 07:48:00 UTC
Created attachment 216563 [details]
Update to 7.0.10-24 with fixed vulnerability

2020-06-14 7.0.10-20 <quetzlzacatenango@image...>
Fix out-of-bounds vulnerability when reading sixel images (reference https://github.com/ImageMagick/ImageMagick/issues/2143).
Comment 11 Vladimir Druzenko freebsd_committer freebsd_triage 2020-07-19 08:13:40 UTC
Patch tested on 12.1 amd64: make check-plist/install, then run.
Comment 12 Vladimir Druzenko freebsd_committer freebsd_triage 2020-07-20 07:29:06 UTC
Created attachment 216595 [details]
Update to 7.0.10-24 with fixed vulnerability

This is correct file.
Comment 13 Vladimir Druzenko freebsd_committer freebsd_triage 2020-07-28 10:14:48 UTC
Created attachment 216832 [details]
Update to 7.0.10-24 with fixed vulnerability

Fixed:
====> Checking for pkg-plist issues (check-plist)
===> Parsing plist
===> Checking for items in STAGEDIR missing from pkg-plist
Error: Orphaned: %%PORTDOCS%%%%DOCSDIR%%-7/www/cite.html
Error: Orphaned: %%PORTDOCS%%%%DOCSDIR%%-7/www/defines.html
Comment 14 Vladimir Druzenko freebsd_committer freebsd_triage 2020-07-28 10:15:45 UTC
Fixed pkg-plist with DOCS option on.
Comment 15 commit-hook freebsd_committer freebsd_triage 2020-07-28 13:03:29 UTC
A commit references this bug:

Author: joneum
Date: Tue Jul 28 13:02:36 UTC 2020
New revision: 543594
URL: https://svnweb.freebsd.org/changeset/ports/543594

Log:
  Update to 7.0.10-24

  This Update fix a vulnerabiliy:
  2020-06-14 7.0.10-20 <quetzlzacatenango@image...>
  Fix out-of-bounds vulnerability when reading sixel images (reference https://github.com/ImageMagick/ImageMagick/issues/2143).

  Full Changelog: https://imagemagick.org/script/changelog.php

  PR:		246337
  Reported by:	VVD <vvd@unislabs.com>
  Approved by:	kwm (maintainer timeout)
  MFH:		2020Q3
  Sponsored by:	Netzkommune GmbH

Changes:
  head/graphics/ImageMagick7/Makefile
  head/graphics/ImageMagick7/distinfo
  head/graphics/ImageMagick7/pkg-plist
Comment 16 commit-hook freebsd_committer freebsd_triage 2020-07-28 13:04:32 UTC
A commit references this bug:

Author: joneum
Date: Tue Jul 28 13:03:40 UTC 2020
New revision: 543595
URL: https://svnweb.freebsd.org/changeset/ports/543595

Log:
  MFH: r543594

  Update to 7.0.10-24

  This Update fix a vulnerabiliy:
  2020-06-14 7.0.10-20 <quetzlzacatenango@image...>
  Fix out-of-bounds vulnerability when reading sixel images (reference https://github.com/ImageMagick/ImageMagick/issues/2143).

  Full Changelog: https://imagemagick.org/script/changelog.php

  PR:		246337
  Reported by:	VVD <vvd@unislabs.com>
  Approved by:	kwm (maintainer timeout)
  Sponsored by:	Netzkommune GmbH

  Approved by:	ports-secteam (with hat)

Changes:
_U  branches/2020Q3/
  branches/2020Q3/graphics/ImageMagick7/Makefile
  branches/2020Q3/graphics/ImageMagick7/distinfo
  branches/2020Q3/graphics/ImageMagick7/pkg-plist