Bug 263647

Summary: databases/hiredis: Update to 1.0.2 (includes security fix)
Product: Ports & Packages Reporter: Sascha Biberhofer <ports>
Component: Individual Port(s)Assignee: Jimmy Olgeni <olgeni>
Status: Closed FIXED    
Severity: Affects Only Me CC: olgeni
Priority: --- Flags: bugzilla: maintainer-feedback? (olgeni)
Version: Latest   
Hardware: Any   
OS: Any   
URL: https://github.com/redis/hiredis/releases/tag/v1.0.2
Bug Depends on:    
Bug Blocks: 263649    
Attachments:
Description Flags
databases/hiredis: Update to 1.0.2 ports: maintainer-approval? (olgeni)

Description Sascha Biberhofer 2022-04-29 08:17:04 UTC 
Created attachment 233574 [details]
databases/hiredis: Update to 1.0.2

The current version of databases/hiredis in ports is both ancient and vulnerable (see [1]).

The attached patch should update our port to the most recent release. I've also added and enabled an openssl option by default and added a test target (which requires a running redis server to pass completely).

The port builds and passes testing here, but I'd be grateful for any feedback. I also think that we might need some additional QA for ports depending on this one, as it's a big jump with at least a few breaking changes (see the upgrading notes in [2]). 

At least databases/py-hiredis will also require updating to still build with this new version and I'll submit an update for this in as an independent issue. I'll also submit a vuxml entry as a seperate issue.


Cheers,
Sascha

[1] https://github.com/redis/hiredis/security/advisories/GHSA-hfm9-39pp-55p2
[2] https://github.com/redis/hiredis/blob/master/README.md
Comment 1 Sascha Biberhofer 2022-04-29 09:04:32 UTC 
For quick reference: I've filed the vuxml entry as bug 263648. :)
Comment 2 commit-hook freebsd_committer freebsd_triage 2022-04-29 19:37:28 UTC 
A commit in branch main references this bug:

URL: https://cgit.FreeBSD.org/ports/commit/?id=ea22326bc83adc9044979bdb6887270ecc57e718

commit ea22326bc83adc9044979bdb6887270ecc57e718
Author:     Jimmy Olgeni <olgeni@FreeBSD.org>
AuthorDate: 2022-04-29 13:59:14 +0000
Commit:     Jimmy Olgeni <olgeni@FreeBSD.org>
CommitDate: 2022-04-29 19:35:58 +0000

    databases/hiredis: update to version 1.0.2

    PR:             263647
    Reported by:    Sascha Biberhofer
    Security:       CVE-2021-32765

 databases/hiredis/Makefile  | 10 ++++++++--
 databases/hiredis/distinfo  |  5 +++--
 databases/hiredis/pkg-plist |  8 +++++++-
 3 files changed, 18 insertions(+), 5 deletions(-)
Comment 3 Jimmy Olgeni freebsd_committer freebsd_triage 2022-05-02 07:34:42 UTC 
Good to go :)