Packages

Our current dokuwiki 20170219_b-1 has two serious CVE.

Error message attached after the first installation

This package contains vague terminology “Open Source”:

community/dokuwiki 20170219_b-1
    Simple to use and highly versatile Open Source wiki software

According to:
https://www.gnu.org/distros/free-system-distribution-guidelines.html

We shall avoid vague terminology such as “Open Source”, please see here:
https://www.gnu.org/philosophy/words-to-avoid.html#Open

It would be good example to set to have proper description of packages without using “Open Source”.

eg.

Simple to use and highly versatile free wiki software

Adapt package in accordance with the Hyperbola Packaging Guidelines to follow the Hyperbola Social Contract .

Description:

• needs OpenRC init script and contains systemd files

Additional info:

• dovecot 2.2.29.1-1

dovecot /usr/lib/systemd/system/dovecot.service
dovecot /usr/lib/systemd/system/dovecot.socket
dovecot /usr/lib/tmpfiles.d/dovecot.conf

Steps to reproduce:

• none

Rebuild package against libressl, since it depends on openssl.

$ pacman -Si dovecot
Repository      : community
Name            : dovecot
Version         : 2.2.29.1-1
Description     : An IMAP and POP3 server written with security primarily in mind
Architecture    : x86_64
URL             : http://dovecot.org/
Licenses        : LGPL
Groups          : None
Provides        : imap-server  pop3-server
Depends On      : krb5  openssl  sqlite  libmariadbclient  postgresql-libs  bzip2  lz4  expat  curl  pam
Optional Deps   : libldap: ldap plugin
                  xz: imap zlib plugin
                  clucene: alternative FTS indexer
Conflicts With  : None
Replaces        : None
Download Size   : 2.67 MiB
Installed Size  : 10.60 MiB
Packager        : Johannes Löthberg <johannes@kyriasis.com>
Build Date      : Mon 01 May 2017 09:28:36 AM -03
Validated By    : MD5 Sum  SHA-256 Sum  Signature

The package appears in parabola’s pcr repository. I modified the AUR PKGBUILD to compile the last stable version (and the installation works fine). Please add this package to the official repos.

https://aur.archlinux.org/packages/dreamchess-git/ https://www.parabola.nu/packages/pcr/x86_64/dreamchess-git/

User enumeration in Dropbear 2018.76 and earlier
http://lists.ucc.gu.uwa.edu.au/pipermail/dropbear/2018q3/002108.html

Patch: https://secure.ucc.asn.au/hg/dropbear/rev/5d2d1021ca00

This package contains vague terminology “Content”:

community/drupal 8.3.2-1
    A PHP-based content management platform

According to:
https://www.gnu.org/distros/free-system-distribution-guidelines.html

We shall avoid vague terminology such as “Content”, please see here:
https://www.gnu.org/philosophy/words-to-avoid.html#Content

It would be good example to set to have proper description of packages without using “Content”.

eg.

A PHP-based web site revision system platform

Description:

community/drupal 8.3.2-1
    A PHP-based content management platform

The description is vague. Content is not HTML page alone. Then even text editor could be called “content management”.

See:
https://www.gnu.org/philosophy/words-to-avoid.html#Content

In most cases, that term really refers to a system for updating pages on a web site. For that, we recommend the term “web site revision system” (WRS).

This package contains vague terminology “Open Source”:

community/dsdp 5.8-1
    A free open source implementation of an interior-point method for semidefinite programming

According to:
https://www.gnu.org/distros/free-system-distribution-guidelines.html

We shall avoid vague terminology such as “Open Source”, please see here:
https://www.gnu.org/philosophy/words-to-avoid.html#Open

It would be good example to set to have proper description of packages without using “Open Source”.

eg.

A free software implementation of an interior-point method for semidefinite programming

Rebuild package against libressl, since it depends on openssl.

$ pacman -Si dsniff
Repository      : community
Name            : dsniff
Version         : 2.4b1-26
Description     : Collection of tools for network auditing and penetration testing
Architecture    : x86_64
URL             : http://www.monkey.org/~dugsong/dsniff/
Licenses        : BSD
Groups          : None
Provides        : None
Depends On      : libpcap  openssl  libxmu  glib2  libnet  libnids
Optional Deps   : None
Conflicts With  : None
Replaces        : None
Download Size   : 88.60 KiB
Installed Size  : 318.00 KiB
Packager        : Antonio Rojas <arojas@archlinux.org>
Build Date      : Fri 03 Mar 2017 06:01:45 PM -03
Validated By    : MD5 Sum  SHA-256 Sum  Signature

Adapt package in accordance with the Hyperbola Packaging Guidelines to follow the Hyperbola Social Contract .

Rebuild package against libressl, since it depends on openssl.

$ pacman -Si dspam
Repository      : community
Name            : dspam
Version         : 3.10.2-14
Description     : A scalable, open-source statistical anti-spam filter
Architecture    : x86_64
URL             : http://dspam.nuclearelephant.com/
Licenses        : GPL
Groups          : None
Provides        : None
Depends On      : readline  libcap  ncurses  zlib  openssl
Optional Deps   : libmariadbclient: MariaDB support
                  postgresql-libs: PostgreSQL support
                  db: BerkeleyDB support
                  sqlite: SQLite support
                  clamav: ClamAV support
                  libldap: external lookup support
Conflicts With  : None
Replaces        : None
Download Size   : 304.10 KiB
Installed Size  : 1678.00 KiB
Packager        : Sergej Pupykin <pupykin.s+arch@gmail.com>
Build Date      : Tue 24 Jan 2017 08:30:55 AM -03
Validated By    : MD5 Sum  SHA-256 Sum  Signature

This package contains vague terminology “Open Source”:

community/dspam 3.10.2-14
    A scalable, open-source statistical anti-spam filter

According to:
https://www.gnu.org/distros/free-system-distribution-guidelines.html

We shall avoid vague terminology such as “Open Source”, please see here:
https://www.gnu.org/philosophy/words-to-avoid.html#Open

It would be good example to set to have proper description of packages without using “Open Source”.

eg.

A scalable, free-software statistical anti-spam filter

Adapt package in accordance with the Hyperbola Packaging Guidelines to follow the Hyperbola Social Contract .

Adapt package in accordance with the Hyperbola Packaging Guidelines to follow the Hyperbola Social Contract .

Rebuild package against libressl, since it depends on openssl.

$ pacman -Si easy-rsa
Repository      : extra
Name            : easy-rsa
Version         : 3.0.1-1
Description     : Simple shell based CA utility
Architecture    : any
URL             : https://github.com/OpenVPN/easy-rsa
Licenses        : custom
Groups          : None
Provides        : None
Depends On      : openssl  sh
Optional Deps   : None
Conflicts With  : None
Replaces        : None
Download Size   : 27.96 KiB
Installed Size  : 80.00 KiB
Packager        : Christian Hesse <arch@eworm.de>
Build Date      : Fri 15 Jul 2016 02:56:51 PM -03
Validated By    : MD5 Sum  SHA-256 Sum  Signature

Description:

community/ecryptfs-utils 111-2
     Enterprise-class stacked cryptographic filesystem for Linux

See:
https://www.gnu.org/philosophy/words-to-avoid.html#Linux

Even though I am not sure for this package. It needs review if this description is correct.

Adapt package in accordance with the Hyperbola Packaging Guidelines to follow the Hyperbola Social Contract .

Adapt package in accordance with the Hyperbola Packaging Guidelines to follow the Hyperbola Social Contract .

Rebuild package against libressl, since it depends on openssl.

$ pacman -Si efitools
Repository      : extra
Name            : efitools
Version         : 1.7.0.5.g0649468-1
Description     : Tools for manipulating UEFI secure boot platforms
Architecture    : x86_64
URL             : http://git.kernel.org/cgit/linux/kernel/git/jejb/efitools.git
Licenses        : GPL  LGPL2.1
Groups          : None
Provides        : None
Depends On      : openssl
Optional Deps   : None
Conflicts With  : None
Replaces        : prebootloader
Download Size   : 145.71 KiB
Installed Size  : 1081.00 KiB
Packager        : Jan Alexander Steffens (heftig) <jan.steffens@gmail.com>
Build Date      : Fri 24 Mar 2017 03:39:39 PM -03
Validated By    : MD5 Sum  SHA-256 Sum  Signature

Adapt package in accordance with the Hyperbola Packaging Guidelines to follow the Hyperbola Social Contract .

Rebuild package against libressl, since it depends on openssl.

$ pacman -Si ejabberd
Repository      : community
Name            : ejabberd
Version         : 17.04-1
Description     : Jabber server written in Erlang
Architecture    : x86_64
URL             : http://www.ejabberd.im/
Licenses        : GPL
Groups          : None
Provides        : None
Depends On      : expat  openssl  zlib  erlang-nox  pam  iproute2  erlang-unixodbc  libyaml  sqlite
Optional Deps   : None
Conflicts With  : None
Replaces        : None
Download Size   : 10.12 MiB
Installed Size  : 18.50 MiB
Packager        : Sergej Pupykin <pupykin.s+arch@gmail.com>
Build Date      : Mon 24 Apr 2017 12:28:55 PM -03
Validated By    : MD5 Sum  SHA-256 Sum  Signature

Our current version is vulnerable

Old clients (like the one packages by Hyperbola) no longer work due to changes in Electrum:

https://github.com/kyuupichan/electrumx/pull/760

The fix is to use a newer version.