xen: add security patches #25839

hydrapolic · 2022-06-09T20:07:17Z

4.15.2 boot tested on amd64
4.16.1 compile tested on ~amd64 with gcc-12

gentoo-repo-qa-bot · 2022-06-09T20:20:57Z

Pull request CI report

Report generated at: 2022-06-09 20:20 UTC
Newest commit scanned: 1ba4932
Status: ✅ good

There are existing issues already. Please look into the report to make sure none of them affect the packages in question:
https://qa-reports.gentoo.org/output/gentoo-ci/ff2f67da71/output.html

gentoo-repo-qa-bot · 2022-06-09T20:36:12Z

Pull request CI report

Report generated at: 2022-06-09 20:36 UTC
Newest commit scanned: 49f1cbf
Status: ✅ good

There are existing issues already. Please look into the report to make sure none of them affect the packages in question:
https://qa-reports.gentoo.org/output/gentoo-ci/7e40419b05/output.html

Flowdalic · 2022-06-10T08:45:53Z

Thanks. I think we can drop xen-tools-4.15.0-disable-werror.patch from the gentoo-patches due to

gentoo/app-emulation/xen-tools/xen-tools-4.16.0-r4.ebuild

Lines 420 to 426 in de194ec

    
           # Remove -Werror 
        
           find . -type f \( -name Makefile -o -name "*.mk" \) \ 
        
           	 -exec sed -i \ 
        
           	 -e 's/-Werror //g' \ 
        
           	 -e '/^CFLAGS *+= -Werror$/d' \ 
        
           	 -e 's/, "-Werror"//' \ 
        
           	 {} + || die

and I also wonder if we shouldn't simply replace xen-tools-4.16.0-qemu-bridge.patch with a sed in qemu-xen/.

thesamesam · 2022-06-10T08:56:06Z

Can one of you look at https://bugs.gentoo.org/845099 too please, while discussing Werror?

Flowdalic · 2022-06-10T22:10:14Z

Can one of you look at https://bugs.gentoo.org/845099 too please, while discussing Werror?

Right now, my best idea would be to mimic what sys-firmware/ipxe is doing and set NO_WERROR=1 when compiling ipxe.

Flowdalic · 2022-06-13T15:02:48Z

@hydrapolic friendly ping :)

hydrapolic · 2022-06-18T02:51:18Z

Sure, will do guys, just a bit busy with non-computer stuff. I'll also address https://xenbits.xen.org/xsa/advisory-404.html

Closes: https://bugs.gentoo.org/845099 Signed-off-by: Tomáš Mózes <hydrapolic@gmail.com>

Signed-off-by: Tomáš Mózes <hydrapolic@gmail.com>

Fixes: XSA-401,XSA-402,XSA-404 Bug: https://bugs.gentoo.org/850802 Signed-off-by: Tomáš Mózes <hydrapolic@gmail.com>

Signed-off-by: Tomáš Mózes <hydrapolic@gmail.com>

hydrapolic · 2022-06-28T11:06:10Z

Thanks. I think we can drop xen-tools-4.15.0-disable-werror.patch from the gentoo-patches due to

gentoo/app-emulation/xen-tools/xen-tools-4.16.0-r4.ebuild

Lines 420 to 426 in de194ec

# Remove -Werror

find . -type f $ -name Makefile -o -name "*.mk" $ \

-exec sed -i \

-e 's/-Werror //g' \

-e '/^CFLAGS *+= -Werror$/d' \

-e 's/, "-Werror"//' \

{} + || die

and I also wonder if we shouldn't simply replace xen-tools-4.16.0-qemu-bridge.patch with a sed in qemu-xen/.

Dropped xen-tools-4.15.0-disable-werror.patch for 4.16.1

hydrapolic · 2022-06-28T11:06:39Z

Can one of you look at https://bugs.gentoo.org/845099 too please, while discussing Werror?

Right now, my best idea would be to mimic what sys-firmware/ipxe is doing and set NO_WERROR=1 when compiling ipxe.

Did for 4.16.1, now compiles with gcc-12.

gentoo-bot · 2022-06-28T11:08:09Z

Pull Request assignment

Submitter: @hydrapolic
Areas affected: ebuilds
Packages affected: app-emulation/xen, app-emulation/xen-tools

app-emulation/xen: @hydrapolic, @gentoo/proxy-maint, @gentoo/xen
app-emulation/xen-tools: @hydrapolic, @gentoo/proxy-maint, @gentoo/xen

Linked bugs

Bugs linked: 850802, 845099

In order to force reassignment and/or bug reference scan, please append [please reassign] to the pull request title.

Docs: Code of Conduct ● Copyright policy (expl.) ● Devmanual ● GitHub PRs ● Proxy-maint guide

gentoo-repo-qa-bot · 2022-06-28T11:24:10Z

Pull request CI report

Report generated at: 2022-06-28 11:24 UTC
Newest commit scanned: 67b1343
Status: ✅ good

There are existing issues already. Please look into the report to make sure none of them affect the packages in question:
https://qa-reports.gentoo.org/output/gentoo-ci/d2281879b2/output.html

Flowdalic

I get

echo "Name: Xenstat"; \
echo "Description: The Xenstat library for Xen hypervisor"; \
echo "Version: 4.16.0"; \
echo "Cflags: -I\${includedir} -I/data-scratch/var-tmp/portage/app-emulation/xen-tools-4.16.1/work/xen-4.16.1/tools/libs/stat/../../../tools/include"; \
echo "Libs: -L\${libdir} -Wl,-rpath-link=/data-scratch/var-tmp/portage/app-emulation/xen-tools-4.16.1/work/xen-4.16.1/tools/libs/stat/../../../tools/libs/call -Wl,-rpath-link=/data-scratch/var-tmp/portage/app-emulation/xen-tools-4.16.1/work/xen-4.16.1/tools/libs/stat/../../../tools/libs/ctrl -Wl,-rpath-link=/data-scratch/var-tmp/portage/app-emulation/xen-tools-4.16.1/work/xen-4.16.1/tools/libs/stat/../../../tools/libs/devicemodel -Wl,-rpath-link=/data-scratch/var-tmp/portage/app-emulation/xen-tools-4.16.1/work/xen-4.16.1/tools/libs/stat/../../../tools/libs/evtchn -Wl,-rpath-link=/data-scratch/var-tmp/portage/app-emulation/xen-tools-4.16.1/work/xen-4.16.1/tools/libs/stat/../../../tools/libs/foreignmemory -Wl,-rpath-link=/data-scratch/var-tmp/portage/app-emulation/xen-tools-4.16.1/work/xen-4.16.1/tools/libs/stat/../../../tools/libs/gnttab -Wl,-rpath-link=/data-scratch/var-tmp/portage/app-emulation/xen-tools-4.16.1/work/xen-4.16.1/tools/libs/stat/../../../tools/libs/stat -Wl,-rpath-link=/data-scratch/var-tmp/portage/app-emulation/xen-tools-4.16.1/work/xen-4.16.1/tools/libs/stat/../../../tools/libs/store -Wl,-rpath-link=/data-scratch/var-tmp/portage/app-emulation/xen-tools-4.16.1/work/xen-4.16.1/tools/libs/stat/../../../tools/libs/toolcore -Wl,-rpath-link=/data-scratch/var-tmp/portage/app-emulation/xen-tools-4.16.1/work/xen-4.16.1/tools/libs/stat/../../../tools/libs/toollog -lxenstat"; \
echo "Libs.private: "; \
echo "Requires.private: xencontrol,xenstore"; \
} > /data-scratch/var-tmp/portage/app-emulation/xen-tools-4.16.1/work/xen-4.16.1/tools/pkg-config/xenstat.pc
swig -python -module xenstat -Iinclude -I. -outdir bindings/swig/python -o bindings/swig/python/_xenstat.c bindings/swig/xenstat.i
make[5]: *** No rule to make target 'include/xenstat.h', needed by 'bindings/swig/python/_xenstat.so'.  Stop.
make[5]: *** Waiting for unfinished jobs....
mv headers.chk.new headers.chk
bindings/swig/xenstat.i:8: Error: Unable to find 'xenstat.h'
make[5]: *** [Makefile:63: bindings/swig/python/_xenstat.c] Error 1
make[5]: Leaving directory '/data-scratch/var-tmp/portage/app-emulation/xen-tools-4.16.1/work/xen-4.16.1/tools/libs/stat'
make[4]: *** [/data-scratch/var-tmp/portage/app-emulation/xen-tools-4.16.1/work/xen-4.16.1/tools/libs/../../tools/Rules.mk:166: subdir-all-stat] Error 2
make[4]: Leaving directory '/data-scratch/var-tmp/portage/app-emulation/xen-tools-4.16.1/work/xen-4.16.1/tools/libs'
make[3]: *** [/data-scratch/var-tmp/portage/app-emulation/xen-tools-4.16.1/work/xen-4.16.1/tools/libs/../../tools/Rules.mk:161: subdirs-all] Error 2
make[3]: Leaving directory '/data-scratch/var-tmp/portage/app-emulation/xen-tools-4.16.1/work/xen-4.16.1/tools/libs'
make[2]: *** [/data-scratch/var-tmp/portage/app-emulation/xen-tools-4.16.1/work/xen-4.16.1/tools/../tools/Rules.mk:166: subdir-all-libs] Error 2
make[2]: Leaving directory '/data-scratch/var-tmp/portage/app-emulation/xen-tools-4.16.1/work/xen-4.16.1/tools'
make[1]: *** [/data-scratch/var-tmp/portage/app-emulation/xen-tools-4.16.1/work/xen-4.16.1/tools/../tools/Rules.mk:161: subdirs-all] Error 2
make[1]: Leaving directory '/data-scratch/var-tmp/portage/app-emulation/xen-tools-4.16.1/work/xen-4.16.1/tools'
make: *** [Makefile:63: build-tools] Error 2
 * ERROR: app-emulation/xen-tools-4.16.1::gentoo failed (compile phase):

when emerging this. Full build log at https://0x0.st/oSlA.log

Flowdalic · 2022-06-29T11:32:05Z

app-emulation/xen-tools/xen-tools-4.16.1.ebuild

@@ -464,6 +464,11 @@ src_compile() {
 		append-flags -fno-strict-overflow
 	fi

+	# bug #845099
+	if use ipxe; then
+		export NO_WERROR=1


Suggested change

export NO_WERROR=1

local -x NO_WERROR=1

IIRC using local -x instead of export restricts the scope of the variable to the current bash function and all child processes spawned by it. Whereas with export it would also be visible in e.g., src_install.

This introduces a new approach to handle Xen patching and versioning. SECURITY_VER and OVMF_VER where dropped as those have not been used in a while. We now consume the upstream patches from a repository called xen-upstream-patches, which will ultimately be hosted by Gentoo infra (e.g. available under gitweb.gentoo.org). The Gentoo patchset now lives in a repository called xen-gentoo-patches, which will also be hosted on Gentoo infra. Furthermore we now follow upstreams versioning scheme. Previously we would sell Xen 4.16.2-pre, which is from the staging-4.16 branch containing security fixes, as Xen 4.16.1. To avoid confusion, we will label the Xen versions as such, and Xen 4.16.1 will what is tagged upstream as RELEASE-4.16.1 (+ the few Gentoo specific patches). Closes: https://bugs.gentoo.org/845099 Bug: https://bugs.gentoo.org/850802 Closes: gentoo#25839 Signed-off-by: Florian Schmaus <flow@gentoo.org>

Bug: https://bugs.gentoo.org/850802 Signed-off-by: Florian Schmaus <flow@gentoo.org> Closes: #26217 Closes: #25839

gentoo-bot added self-maintained The PR changes only packages that are maintained by the submitter (i.e. no need to ask anybody else) assigned PR successfully assigned to the package maintainer(s). labels Jun 9, 2022

hydrapolic force-pushed the xen branch from 1ba4932 to 49f1cbf Compare June 9, 2022 20:11

hydrapolic changed the title ~~xen: add security patches~~ xen: add security patches [please reassign] Jun 9, 2022

gentoo-bot changed the title ~~xen: add security patches [please reassign]~~ xen: add security patches Jun 9, 2022

hydrapolic added 5 commits June 28, 2022 11:01

app-emulation/xen-tools: bump to 4.16.1

5fb1a46

Closes: https://bugs.gentoo.org/845099 Signed-off-by: Tomáš Mózes <hydrapolic@gmail.com>

app-emulation/xen: bump to 4.16.1

51a7544

Signed-off-by: Tomáš Mózes <hydrapolic@gmail.com>

app-emulation/xen: add upstream security patches

31de4e9

Fixes: XSA-401,XSA-402,XSA-404 Bug: https://bugs.gentoo.org/850802 Signed-off-by: Tomáš Mózes <hydrapolic@gmail.com>

app-emulation/xen-tools: drop vulnerable

50a081e

Signed-off-by: Tomáš Mózes <hydrapolic@gmail.com>

app-emulation/xen: drop vulnerable

67b1343

Signed-off-by: Tomáš Mózes <hydrapolic@gmail.com>

hydrapolic force-pushed the xen branch from 49f1cbf to 67b1343 Compare June 28, 2022 11:05

hydrapolic changed the title ~~xen: add security patches~~ xen: add security patches [please reassign] Jun 28, 2022

gentoo-bot changed the title ~~xen: add security patches [please reassign]~~ xen: add security patches Jun 28, 2022

gentoo-bot removed the assigned PR successfully assigned to the package maintainer(s). label Jun 28, 2022

thesamesam requested a review from Flowdalic June 28, 2022 12:11

Flowdalic suggested changes Jun 29, 2022

View reviewed changes

gentoo-bot closed this in b48c2d2 Jul 5, 2022

gentoo-bot pushed a commit that referenced this pull request Jul 5, 2022

app-emulation/xen: add 4.15.3

7c7d3fb

Bug: https://bugs.gentoo.org/850802 Signed-off-by: Florian Schmaus <flow@gentoo.org> Closes: #26217 Closes: #25839

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

xen: add security patches #25839

xen: add security patches #25839

hydrapolic commented Jun 9, 2022 •

edited

Loading

gentoo-repo-qa-bot commented Jun 9, 2022

gentoo-repo-qa-bot commented Jun 9, 2022

Flowdalic commented Jun 10, 2022 •

edited

Loading

thesamesam commented Jun 10, 2022

Flowdalic commented Jun 10, 2022

Flowdalic commented Jun 13, 2022

hydrapolic commented Jun 18, 2022

hydrapolic commented Jun 28, 2022

hydrapolic commented Jun 28, 2022

gentoo-bot commented Jun 28, 2022

gentoo-repo-qa-bot commented Jun 28, 2022

Flowdalic left a comment

Flowdalic Jun 29, 2022

xen: add security patches #25839

xen: add security patches #25839

Conversation

hydrapolic commented Jun 9, 2022 • edited Loading

gentoo-repo-qa-bot commented Jun 9, 2022

Pull request CI report

gentoo-repo-qa-bot commented Jun 9, 2022

Pull request CI report

Flowdalic commented Jun 10, 2022 • edited Loading

thesamesam commented Jun 10, 2022

Flowdalic commented Jun 10, 2022

Flowdalic commented Jun 13, 2022

hydrapolic commented Jun 18, 2022

hydrapolic commented Jun 28, 2022

hydrapolic commented Jun 28, 2022

gentoo-bot commented Jun 28, 2022

Pull Request assignment

Linked bugs

gentoo-repo-qa-bot commented Jun 28, 2022

Pull request CI report

Flowdalic left a comment

Choose a reason for hiding this comment

Flowdalic Jun 29, 2022

Choose a reason for hiding this comment

hydrapolic commented Jun 9, 2022 •

edited

Loading

Flowdalic commented Jun 10, 2022 •

edited

Loading