Bug 251385

Summary: devel/binutils: Update to 2.37
Product: Ports & Packages Reporter: Jose Fernando Lopez Fernandez <jflopezfernandez>
Component: Individual Port(s)Assignee: Fernando Apesteguía <fernape>
Status: Closed FIXED    
Severity: Affects Many People CC: arrowd, fernape, grahamperrin, jflopezfernandez, lwhsu, ports-secteam, yasu
Priority: Normal Keywords: security
Version: LatestFlags: koobs: maintainer-feedback? (yasu)
fernape: maintainer-feedback-
antoine: exp-run+
Hardware: Any   
OS: Any   
URL: https://sourceware.org/git/?p=binutils-gdb.git;a=blob;f=ChangeLog;h=641d82c5358c863fbaba07a61e14a135c5785959;hb=116a737f438d03a1bd6aa706b6ea0b4022f3b7e2
Bug Depends on: 256133, 257640, 257982    
Bug Blocks: 255368    
Attachments:
Description Flags
Patch to update devel/binutils to upstream version 2.35.1
jflopezfernandez: maintainer-approval+
Revised patch updating devel/binutils port to 2.35.1
none
First attempt to update devel/binutils to 2.36.1
none
Upddate devel/binutils to 2.36.1 (2nd version)
none
Update devel/binutils to 2.36.1 (3rd version)
none
Update devel/binutils to 2.36.1 (4th version)
none
Update devel/binutils to 2.36.1 (5th version)
none
Update devel/binutils to 2.37
none
Patch with small adjustments
fernape: maintainer-approval? (jflopezfernandez)
Updated patch file
none
Updated patch file
none
Updated patch file none

Description Jose Fernando Lopez Fernandez 2020-11-25 17:04:24 UTC
Created attachment 219971 [details]
Patch to update devel/binutils to upstream version 2.35.1

Good morning,

This is my first submission as the official maintainer of this port; any and all feedback is both welcome and appreciated.

Changes:

 * The 0b398d6, gas-configure, and libctf_swap patches were no longer required, as their changes have already been incorporated into the upstream branch.

Notes:

The patches for the s390* and aarch64 platforms required manual edits, but I made sure to copy over the changes exactly as they were in the previous version. However, I am not familiar with those platforms, nor do I have access to them to be able to test the changes, so please reach out to me with any problems.

You can email me at jflopezfernandez@gmail.com.
Comment 1 Fernando Apesteguía freebsd_committer 2020-11-25 18:24:20 UTC
^Triage: [tags] in issue Titles are deprecated.

^Triage: Simplifying title

^Triage: If there is a changelog or release notes URL available for this version, please add it to the URL field.

^Triage: Maintainer-feedback flag (+) not required unless requested (?) first.

There are some warnings from linters. Some of the are false positives, others are not.

Q/A:  Makefile: [141]: possible direct use of command "rm" found. use ${RM} instead.
 Makefile: new ports should not set PORTREVISION.
 Makefile: new ports should not set PORTEPOCH.
 Makefile: unless this is a master port, MAINTAINER has to be set by "=", not by "?=".
 Makefile: unless this is a master port, COMMENT has to be set by "=", not by "?=".
 Makefile: "PKGNAMEPREFIX" has to appear earlier.
 Makefile: "BROKEN_mips" has to appear earlier.
 Makefile: "BUILD_DEPENDS" has to appear earlier.
 Makefile: "USES" has to appear earlier.

^Triage: Please confirm this change passes QA (portlint, poudriere at least).
--
https://www.freebsd.org/doc/en/books/porters-handbook/testing.html

Q/A: PORTREVISION should be removed


Thanks!
Comment 2 Jose Fernando Lopez Fernandez 2020-11-25 20:49:57 UTC
(In reply to Fernando Apesteguía from comment #1)

Good afternoon, thank you so much for your reply. I apologize for the errors; I will submit a corrected patch once the necessary modifications have been made.

Thank you again for your help,
Jose
Comment 3 Fernando Apesteguía freebsd_committer 2020-11-25 21:37:51 UTC
(In reply to Jose Fernando Lopez Fernandez from comment #2)

No need to apologise :-)

Just FYI, 

portlint, portclippy and portfmt are tools in ports that can help you with maintaining ports.
Comment 4 Jose Fernando Lopez Fernandez 2020-11-26 07:25:07 UTC
Created attachment 219991 [details]
Revised patch updating devel/binutils port to 2.35.1

(In reply to Fernando Apesteguía from comment #3)

This revised patch contains nearly all of the requested modifications, with the sole exception being the portlint changes. I was able to fix all but three of the warnings ("BROKEN", "BUILD_DEPENDS", and "USES"), as they rely on the particular flavor of the package the user is building. I believe page 209 of the Porter's Handbook makes a specific allowance for this case, but please do let me know if this is not correct.

All other portlint warnings have been fixed, and the package passes all QA tests and builds successfully with poudriere.

Thank you again for all of your help, and please do let me know if I have missed anything.

Jose

Change log for GNU binutils version 2.35.1:
https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;a=blob_plain;f=binutils/NEWS;hb=refs/tags/binutils-2_35_1
Comment 5 Fernando Apesteguía freebsd_committer 2020-11-26 11:48:48 UTC
(In reply to Jose Fernando Lopez Fernandez from comment #4)

Hi Jose,

Unfortunately, the port does not build. It fails at the patch phase:

===>  Applying FreeBSD patches for binutils-2.35.1,1 from /usr/ports/devel/binutils/files
Ignoring previously applied (or reversed) patch.
1 out of 1 hunks ignored--saving rejects to binutils/coffdump.c.rej
Ignoring previously applied (or reversed) patch.
1 out of 1 hunks ignored--saving rejects to binutils/srconv.c.rej
Ignoring previously applied (or reversed) patch.
1 out of 1 hunks ignored--saving rejects to binutils/sysdump.c.rej
===>  FAILED Applying FreeBSD patch-0b398d6.diff
===> FAILED to apply cleanly FreeBSD patch(es)  patch-0b398d6.diff
*** Error code 1

Stop.
make: stopped in /usr/ports/devel/binutils

Would you have a look at it?
Comment 6 Jose Fernando Lopez Fernandez 2020-11-28 07:02:25 UTC
Hi, Fernando,

I will figure out what I did wrong first thing tomorrow morning. I promise future updates will not be this tedious; I am determined to get this right, but I am very embarrassed to have wasted so much of your time.

Thank you again, and I look forward to having an answer for you tomorrow morning.
Jose
Comment 7 Fernando Apesteguía freebsd_committer 2020-11-28 16:54:17 UTC
(In reply to Jose Fernando Lopez Fernandez from comment #6)

There is no rush :-)

Maintaining ports can be challenging, specially the complex ones.
Comment 8 Yasuhiro Kimura freebsd_committer 2021-05-13 02:32:00 UTC
Created attachment 224892 [details]
First attempt to update devel/binutils to 2.36.1

My first attempt to update devel/binutils.

Current status is:

1. Build succeeds with following conditions

Ports tree: ports caced2ad007d of main
Host OS: 13.0-RELEASE amd64
Options settings: everything is default
Flavors: all but mips64

2. No run-time test at all yet

My working repository:

https://github.com/yasuhirokimura/freebsd-ports/tree/binutils_work
Comment 9 Yasuhiro Kimura freebsd_committer 2021-05-13 07:39:27 UTC
Created attachment 224894 [details]
Upddate devel/binutils to 2.36.1 (2nd version)
Comment 10 Yasuhiro Kimura freebsd_committer 2021-05-13 07:40:48 UTC
(In reply to Yasuhiro Kimura from comment #9)

Updated patch fixes build error of mips64 flavor. So now build succeeds with all flavors.
Comment 11 Yasuhiro Kimura freebsd_committer 2021-05-15 08:32:39 UTC
Created attachment 224961 [details]
Update devel/binutils to 2.36.1 (3rd version)

Fix `make check-plist` when STATIC option is ON.
Comment 12 Tobias Kortkamp freebsd_committer 2021-05-15 09:35:29 UTC
Comment on attachment 224961 [details]
Update devel/binutils to 2.36.1 (3rd version)

> +lib/bfd-plugins/libdep.a

This file is problematic since it causes conflicts across all the
binutils flavors but you need to be able to install them at the
same time.
Comment 13 Fernando Apesteguía freebsd_committer 2021-05-19 06:49:39 UTC
(In reply to Tobias Kortkamp from comment #12)
Has any of you been able to make test?

It fails in an i386 jail with:

pr20308_gd.o:function test_gd: error: missing expected TLS relocation
pr20308_ld.o:function test_ld: error: missing expected TLS relocation
cc: error: linker command failed with exit code 1 (use -v to see invocation)

and in amd64 with:

c++: error: unsupported argument '-madd-bnd-prefix' to option 'Wa,'
Comment 14 Yasuhiro Kimura freebsd_committer 2021-07-02 08:46:12 UTC
Created attachment 226164 [details]
Update devel/binutils to 2.36.1 (4th version)

* Add upstream patches
* Fix build error with `make test`
Comment 15 Fernando Apesteguía freebsd_committer 2021-07-04 17:44:34 UTC
(In reply to Yasuhiro Kimura from comment #14)

Testing... 

Thanks for the update.

Jose Fernando, did you have time to test some of these?

Cheers!
Comment 16 Fernando Apesteguía freebsd_committer 2021-07-09 10:17:03 UTC
Hi Yasuhiro,

Sorry for the late response. This update fails to build:

(pod2man --center="GNU Development Tools" --release="binutils-2.36.1" --section=1 as.pod | \
        sed -e '/^.if n .na/d' > as.1.T$$ && \
        mv -f as.1.T$$ as.1) || \
        (rm -f as.1.T$$ && exit 1)
/bin/sh: pod2man: not found
rm -f as.pod
/wrkdirs/usr/ports/devel/binutils/work-native/binutils-2.36.1/missing: makeinfo: not found
WARNING: 'makeinfo' is missing on your system.
         You should only need it if you modified a '.texi' file, or
         any other file indirectly affecting the aspect of the manual.
         You might want to install the Texinfo package:
         <http://www.gnu.org/software/texinfo/>
         The spurious makeinfo call might also be the consequence of
         using a buggy 'make' (AIX, DU, IRIX), in which case you might
         want to install GNU make:
         <http://www.gnu.org/software/make/>
gmake[5]: *** [Makefile:508: as.info] Error 127
gmake[5]: Leaving directory '/wrkdirs/usr/ports/devel/binutils/work-native/binutils-2.36.1/gas/doc'
gmake[4]: *** [Makefile:1275: all-recursive] Error 1
gmake[4]: Leaving directory '/wrkdirs/usr/ports/devel/binutils/work-native/binutils-2.36.1/gas'
gmake[3]: *** [Makefile:817: all] Error 2
gmake[3]: Leaving directory '/wrkdirs/usr/ports/devel/binutils/work-native/binutils-2.36.1/gas'
gmake[2]: *** [Makefile:4939: all-gas] Error 2
gmake[2]: Leaving directory '/wrkdirs/usr/ports/devel/binutils/work-native/binutils-2.36.1'
gmake[1]: *** [Makefile:853: all] Error 2
gmake[1]: Leaving directory '/wrkdirs/usr/ports/devel/binutils/work-native/binutils-2.36.1'
===> Compilation failed unexpectedly.
Try to set MAKE_JOBS_UNSAFE=yes and rebuild before reporting the failure to
the maintainer.
*** Error code 1
Comment 17 Yasuhiro Kimura freebsd_committer 2021-07-12 08:03:51 UTC
Created attachment 226384 [details]
Update devel/binutils to 2.36.1 (5th version)

* Fix build with poudriere
* Add more upstream patch
Comment 18 Yasuhiro Kimura freebsd_committer 2021-07-12 08:04:37 UTC
(In reply to Fernando Apesteguía from comment #16)

Fixed with latest patch. Sorry for breakage.
Comment 19 Gleb Popov freebsd_committer 2021-07-15 15:44:35 UTC
There is a ton of added patches. Were are they coming from?
Comment 20 Yasuhiro Kimura freebsd_committer 2021-07-19 21:07:57 UTC
Created attachment 226557 [details]
Update devel/binutils to 2.37

Update to 2.37.

ChangeLog: https://sourceware.org/git/?p=binutils-gdb.git;a=blob;f=ChangeLog;h=641d82c5358c863fbaba07a61e14a135c5785959;hb=116a737f438d03a1bd6aa706b6ea0b4022f3b7e2

Note that patch-bfd_elfxx-sparc.c fails to be applied to 2.37 because the contents of bfd/elfxx-sparc.c has changed significantly from that of 2.36.1. I tried to adjust the patch but failed and decided to removed it. If there is someone who understands this patch, please update it correctly.
Comment 21 Mark Linimon freebsd_committer freebsd_triage 2021-07-19 21:15:33 UTC
(In reply to Yasuhiro Kimura from comment #20)
At this point, speaking as one of the former sparc users, sparc is simply OBE, and thus is indeed not worth spending time getting to work.
Comment 22 Yasuhiro Kimura freebsd_committer 2021-07-20 01:38:56 UTC
(In reply to Mark Linimon from comment #21)

Thanks for comment. I leave the patch removed.
Comment 23 Kubilay Kocak freebsd_committer freebsd_triage 2021-07-20 02:28:12 UTC
(In reply to Yasuhiro Kimura from comment #20)

If sparc patch removal means the port fails to build/run, the appropriate BROKEN/IGNORE should be set, and probably referencing the patch that needs rebasing in order to remove BROKEN/IGNORE
Comment 24 Fernando Apesteguía freebsd_committer 2021-07-22 17:40:38 UTC
Created attachment 226621 [details]
Patch with small adjustments

I did some adjustments to the Makefile and re-included the SPARC patch with small changes to make so it applies cleanly.

With this, devel/binutils builds in {11.4,12.2}{amd64,i386} and 13-current amd64.
I run a poor man's exp-run and checked that some ports which have devel/binutils as a BUILD dependency build fine:

audio/ardour6
comms/libfec
devel/sdl20
Comment 25 Fernando Apesteguía freebsd_committer 2021-07-28 11:12:16 UTC
Hi there,

Has anyone given it a go? Do you think we should ask for an exp-run?

Cheers!
Comment 26 Yasuhiro Kimura freebsd_committer 2021-07-28 16:42:07 UTC
(In reply to Fernando Apesteguía from comment #25)

> Do you think we should ask for an exp-run?

Yes, I think so.
Comment 27 Fernando Apesteguía freebsd_committer 2021-07-29 06:31:21 UTC
Requesting exp-run.

There are 94 ports referencing devel/binutils in their Makefiles in different ways (BUILD_DEPENDS, RUN_DEPENDS...).

./audio/ardour6
./audio/musicpd 
./base/binutils 
./comms/libfec  
./comms/syncterm
./databases/galera
./databases/galera26
./databases/mongodb40
./databases/mongodb42
./databases/mongodb44
./databases/mongodb49
./databases/mongodb50
./devel/aarch64-none-elf-gcc
./devel/abi-compliance-checker
./devel/arduino-tools                                                                                                                                                                                                                                 
./devel/arm-none-eabi-gcc492
./devel/arm-none-eabi-newlib           
./devel/avr-gcc
./devel/avr-libc
./devel/electron12
./devel/elf-dissector
./devel/fpc-bfd
./devel/freebsd-gcc6
./devel/freebsd-gcc9
./devel/gcc-arm-embedded
./devel/gcc-msp430-ti-toolchain
./devel/gnu-efi
./devel/kcov
./devel/llvm-devel
./devel/llvm10
./devel/llvm11
./devel/llvm12
./devel/llvm70
./devel/llvm80
./devel/llvm90
./devel/mingw32-gcc
./devel/plan9port
./devel/plasma
./devel/psptoolchain-gcc-stage1
./devel/riscv64-gcc
./devel/sdl20
./editors/lazarus
./emulators/visualboyadvance-m
./emulators/vmw
./games/dxx-rebirth
./java/openjdk8
./lang/ccl
./lang/fpc
./lang/gcc10
./lang/gcc10-devel
./lang/gcc11
./lang/gcc11-devel
./lang/gcc12-devel
./lang/gcc48
./lang/gcc6-aux
./lang/gcc7
./lang/gcc8
./lang/gcc9
./lang/gcc9-devel
./lang/go
./lang/gprolog
./lang/hla
./lang/mecrisp-stellaris
./lang/mit-scheme
./lang/myrddin
./lang/ocaml
./lang/rust
./lang/rust-bootstrap
./lang/v8
./math/ldouble
./math/opensolaris-libm
./multimedia/ffmpeg
./multimedia/libde265
./multimedia/libvpx
./multimedia/libxine
./multimedia/x265
./net/ceph14
./net/dpdk
./net/zerotier
./science/libghemical
./security/afl
./security/afl++
./security/akmos
./security/nflib
./security/nss
./sysutils/opensbi
./www/chromium
./www/deno
./www/node
./www/node10
./www/node14
./www/webkit2-gtk3
./x11-toolkits/qt5-gui
./x11/pixman
Comment 28 Yasuhiro Kimura freebsd_committer 2021-07-30 12:26:42 UTC
(In reply to Fernando Apesteguía from comment #27)

In addition to them, ports that use either USE_BINUTILS, USE_GCC or LLD_UNSAFE also use this port.

yasu@rolling-vm-freebsd2[1157]% find /usr/ports -name Makefile -exec fgrep USE_BINUTILS {} + | sed 's/:.*//' | sort -u 
| wc -l
      32
yasu@rolling-vm-freebsd2[1158]% find /usr/ports -name Makefile -exec fgrep USE_GCC {} + | sed 's/:.*//' | sort -u | wc 
-l
     215
yasu@rolling-vm-freebsd2[1159]% find /usr/ports -name Makefile -exec fgrep LLD_UNSAFE {} + | sed 's/:.*//' | sort -u | 
wc -l  
      69
yasu@rolling-vm-freebsd2[1160]%  

So this update affects about 400 ports.
Comment 30 Fernando Apesteguía freebsd_committer 2021-08-04 16:14:15 UTC
(In reply to Antoine Brodin from comment #29)
How can I access those logs without IPv6 connectivity?
Comment 31 Antoine Brodin freebsd_committer 2021-08-04 16:22:41 UTC
(In reply to Fernando Apesteguía from comment #30)
You can login on freefall.freebsd.org and fetch the logs from there.
Comment 32 Fernando Apesteguía freebsd_committer 2021-08-04 16:27:45 UTC
(In reply to Antoine Brodin from comment #31)
Got them. Thanks!
Comment 33 Yasuhiro Kimura freebsd_committer 2021-08-04 17:22:54 UTC
(In reply to Antoine Brodin from comment #29)

Hmm, 3rd and 4th build errors are caused by the issue pointed out at comment #12. As for 1st and 2nd ones, further investigation is necessary.
Comment 34 Yasuhiro Kimura freebsd_committer 2021-08-04 20:22:03 UTC
Created attachment 226955 [details]
Updated patch file

* Remove lib/bfd-plugins/libdep.a at post-install stage if flavor isn't native
* Replace files/patch-gold_gc.h with one obtained from upstream repository

I think we can safely remove libdep.a from non-native flavors to fix the issue pointed out at comment #12 with following reasons.

* This is static library. So if commands included in this ports (ex. as, ld, readelf, etc) require it, it is statically linked to them at compile time. And it means they should work fine even if it isn't installed.
* Currently devel/binutils don't install this library with non-native flavors. So regarding building ports that requires devel/binutils, things should not get worse than before even if it isn't installed after updated to 2.37.
Comment 35 Yasuhiro Kimura freebsd_committer 2021-08-04 23:10:13 UTC
Created attachment 226959 [details]
Updated patch file

* Add 'iconv' to USES if flavor is mingw32. mingw32-windres requires it.
* Add print/openprinting/files/patch-configure.

I confirmed attached patch fixes all build errors of comment #29 with 12.2-RELEASE amd64.
Comment 36 Fernando Apesteguía freebsd_committer 2021-08-05 12:48:56 UTC
print/openprinting builds fine with the new patch and old devel/binutils. It could be patched in advance if necessary

I can confirm that all the rest of the ports build fine with new devel/binutils in {11.4,12.2}{amd64,i386} and 13.0amd64
Comment 37 Yasuhiro Kimura freebsd_committer 2021-08-05 16:41:17 UTC
Created attachment 226974 [details]
Updated patch file

Split out the patch for print/openprinting.
Comment 38 Yasuhiro Kimura freebsd_committer 2021-08-05 16:45:07 UTC
(In reply to Fernando Apesteguía from comment #36)

@fernape I have split out the patch for print/openprinting and submitted as bug #257640. So would you please commit it in advance?
Comment 39 Fernando Apesteguía freebsd_committer 2021-08-05 16:47:32 UTC
Sure thing. I was just pointing out that we could do that.

Thanks for taking the time to actually split it!
Comment 40 Antoine Brodin freebsd_committer 2021-08-10 12:49:00 UTC
Exp-run looks fine
Comment 41 commit-hook freebsd_committer 2021-08-10 16:43:24 UTC
A commit in branch main references this bug:

URL: https://cgit.FreeBSD.org/ports/commit/?id=a0e752df801309c38f6ccd64a25ae064db870ed9

commit a0e752df801309c38f6ccd64a25ae064db870ed9
Author:     Yasuhiro Kimura <yasu@utahime.org>
AuthorDate: 2021-08-05 07:14:21 +0000
Commit:     Fernando Apesteguía <fernape@FreeBSD.org>
CommitDate: 2021-08-10 16:37:30 +0000

    devel/binutils: Update to 2.37

    ChangeLog:
    https://sourceware.org/git/?p=binutils-gdb.git;a=blob;f=ChangeLog;h=641d82c5358c863fbaba07a61e14a135c5785959;hb=116a737f438d03a1bd6aa706b6ea0b4022f3b7e2

    exp-run by antoine@

    Related commit: bae65d81de99 - Fix build with upcoming  binutils

    PR:     251385
    Reported by:    jflopezfernandez@gmail.com (maintainer)
    Reviewed by:    arrowd@, koobs@, linimon@, tobik@

 devel/binutils/Makefile                            |  52 ++++-----
 devel/binutils/distinfo                            |   6 +-
 devel/binutils/files/patch-0b398d6.diff (gone)     |  65 -----------
 devel/binutils/files/patch-bfd_elfxx-sparc.c       |  12 +-
 .../binutils/files/patch-gas-configure.tgt (gone)  |  12 --
 devel/binutils/files/patch-gold_gc.h (new)         |  45 ++++++++
 .../files/patch-gold_testsuite_Makefile.in (new)   |  14 +++
 devel/binutils/files/patch-libctf_swap.h (gone)    |  34 ------
 devel/binutils/files/patch-mips64.diff             |  18 +--
 devel/binutils/files/patch-powerpc64le.patch       | 126 ---------------------
 devel/binutils/files/patch-s390x.diff              |  10 +-
 devel/binutils/pkg-plist                           |   8 +-
 devel/binutils/pkg-plist-powerpc64le               |  44 +++----
 devel/binutils/pkg-plist-riscv32-unknown-elf       |  78 +++++++++++++
 devel/binutils/pkg-plist-riscv64                   |  44 +++++++
 devel/binutils/pkg-plist-riscv64-none-elf          |  92 +++++++++++++--
 16 files changed, 340 insertions(+), 320 deletions(-)
Comment 42 Fernando Apesteguía freebsd_committer 2021-08-10 16:43:58 UTC
Committed,

Thank you all!
Comment 43 Fernando Apesteguía freebsd_committer 2021-08-10 16:44:38 UTC
Just for the record, maintainer timeout during the development of the PR
Comment 44 Li-Wen Hsu freebsd_committer 2021-08-10 17:29:53 UTC
I know this has already been committed, but I want to add a note that doing exp-run for devel/binutils upgrading might not be enough. It's part of our xtoolchain  so it's recommended to do some buildworld and buildkernel tests, with supported architectures, at least the tier 1 architectures.
Comment 45 Fernando Apesteguía freebsd_committer 2021-08-10 20:30:56 UTC
(In reply to Li-Wen Hsu from comment #44)
Thanks for the info. I wasn't aware of that.

I think a comment in the port's Makefile would be useful.
Comment 46 Yasuhiro Kimura freebsd_committer 2021-08-11 00:39:46 UTC
@fernape Would you please commit bug #256133 too? There is a vulnerability fixed with 2.36. And bug #256133 adds entry describing it to VuXML database.
Comment 47 Kubilay Kocak freebsd_committer freebsd_triage 2021-08-11 01:29:29 UTC
Recent update was:

  -PORTVERSION=	2.33.1
  +PORTVERSION=	2.37

Which fixed at least one security issue, but commit was not marked for MFH

There is a isolated patch (without update) in bug 255368
Comment 48 Kubilay Kocak freebsd_committer freebsd_triage 2021-08-11 01:31:02 UTC
^Triage: VuXML entry still needs landing.
Comment 49 Fernando Apesteguía freebsd_committer 2021-08-11 08:01:39 UTC
(In reply to Kubilay Kocak from comment #47)
If we are going to MFH this, we will need to MFH at least the print/openprinting fix:

bae65d81de99 - Fix build with upcoming  binutils

Since the update in main was seamless apart from the metioned openprinting port, I think it is safe to assume no major breakage will occur when merging this. I can only test so many ports in quarterly branches.

What do you think?
Comment 50 Fernando Apesteguía freebsd_committer 2021-08-11 08:02:50 UTC
(In reply to Kubilay Kocak from comment #48)
I will ask diizzy@ if he wants to add the VuXML entry. He is a committer now.
Comment 51 Yasuhiro Kimura freebsd_committer 2021-08-11 08:18:11 UTC
(In reply to Fernando Apesteguía from comment #49)

Possible alternative plan is to commit bug #255368 to 2021Q3 branch. It only adds upstream patch fixing vulnerability. So we need not either MHF ports bae65d81de99 or do exp-run with 2021Q3 branch. In this case patch for bug #256133 need to be updated. And I'll do it if we adopt this plan.
Comment 52 Fernando Apesteguía freebsd_committer 2021-08-11 10:06:31 UTC
(In reply to Yasuhiro Kimura from comment #51)
I'm fine with that too.

I'll let people chime in.
Comment 53 Fernando Apesteguía freebsd_committer 2021-08-13 10:43:28 UTC
I'll commit the patch that fixes de CVE (bug #255368) to 2021Q3 shortly.
Comment 54 Yasuhiro Kimura freebsd_committer 2021-08-13 10:57:57 UTC
(In reply to Fernando Apesteguía from comment #53)

Then I'll update attached patch of bug #256133 accordingly.
Comment 55 commit-hook freebsd_committer 2021-08-13 11:08:58 UTC
A commit in branch 2021Q3 references this bug:

URL: https://cgit.FreeBSD.org/ports/commit/?id=9c4ee12ed3cddad1cb19a62d05b7efe77cb896a6

commit 9c4ee12ed3cddad1cb19a62d05b7efe77cb896a6
Author:     Yasuhiro Kimura <yasu@utahime.org>
AuthorDate: 2021-08-13 10:55:57 +0000
Commit:     Fernando Apesteguía <fernape@FreeBSD.org>
CommitDate: 2021-08-13 10:55:57 +0000

    devel/binutils: Add fix for CVE-2021-3487

    The CVE is fixed in main in a0e752df8013. Merging that would mean merging other
    changes to other ports and doing more exp-runs, so we just backport the fix in
    the quarterly branch to avoid too much disruption.

    VuXML entry to be handled in PR 256133.

    PR:     255368, 251385
    Reported by:    diizzy@
    Security:       CVE-2021-3487

 devel/binutils/Makefile                        |  2 +-
 devel/binutils/files/patch-CVE-2021-3487 (new) | 75 ++++++++++++++++++++++++++
 2 files changed, 76 insertions(+), 1 deletion(-)