Skip to content

chore: update changelog to 6.1.92#1127

Merged
mhduiy merged 1 commit into
linuxdeepin:masterfrom
mhduiy:dev-changelog-6.1.92
May 25, 2026
Merged

chore: update changelog to 6.1.92#1127
mhduiy merged 1 commit into
linuxdeepin:masterfrom
mhduiy:dev-changelog-6.1.92

Conversation

@mhduiy
Copy link
Copy Markdown
Contributor

@mhduiy mhduiy commented May 25, 2026 •
edited by sourcery-ai Bot
Loading

更新说明

自动更新 changelog 到版本 6.1.92

变更内容

  • 更新 debian/changelog

版本信息

  • 新版本: 6.1.92
  • 目标分支: master

Summary by Sourcery

Build:

  • Adjust Debian packaging metadata to reflect version 6.1.92.

@mhduiy
chore: bump version to 6.1.92
8ce2b0b 
update changelog to 6.1.92

Log: update changelog to 6.1.92
@sourcery-ai
Copy link
Copy Markdown

sourcery-ai Bot commented May 25, 2026

Reviewer's guide (collapsed on small PRs)

Reviewer's Guide

Updates the Debian package changelog to reflect new release version 6.1.92 targeting master.

File-Level Changes

Change Details Files
Update Debian changelog metadata for release 6.1.92.
  • Add or update the top changelog entry to version 6.1.92.
  • Ensure the changelog entry targets the master distribution/branch.
  • Adjust associated release notes text to match the new version, if present.
 debian/changelog
Tips and commands

Interacting with Sourcery

  • Trigger a new review: Comment @sourcery-ai review on the pull request.
  • Continue discussions: Reply directly to Sourcery's review comments.
  • Generate a GitHub issue from a review comment: Ask Sourcery to create an
    issue from a review comment by replying to it. You can also reply to a
    review comment with @sourcery-ai issue to create an issue from it.
  • Generate a pull request title: Write @sourcery-ai anywhere in the pull
    request title to generate a title at any time. You can also comment
    @sourcery-ai title on the pull request to (re-)generate the title at any time.
  • Generate a pull request summary: Write @sourcery-ai summary anywhere in
    the pull request body to generate a PR summary at any time exactly where you
    want it. You can also comment @sourcery-ai summary on the pull request to
    (re-)generate the summary at any time.
  • Generate reviewer's guide: Comment @sourcery-ai guide on the pull
    request to (re-)generate the reviewer's guide at any time.
  • Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
    pull request to resolve all Sourcery comments. Useful if you've already
    addressed all the comments and don't want to see them anymore.
  • Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
    request to dismiss all existing Sourcery reviews. Especially useful if you
    want to start fresh with a new review - don't forget to comment
    @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

  • Enable or disable review features such as the Sourcery-generated pull request
    summary, the reviewer's guide, and others.
  • Change the review language.
  • Add, remove or edit custom review instructions.
  • Adjust other review settings.

Getting Help

@github-actions
Copy link
Copy Markdown

github-actions Bot commented May 25, 2026

TAG Bot

TAG: 6.1.92
EXISTED: no
DISTRIBUTION: unstable

sourcery-ai[bot]
sourcery-ai Bot reviewed May 25, 2026
View reviewed changes
Copy link
Copy Markdown

@sourcery-ai sourcery-ai Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hey - I've reviewed your changes and they look great!

Sourcery is free for open source - if you like our reviews please consider sharing them ✨
Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.

@deepin-ci-robot
Copy link
Copy Markdown

deepin-ci-robot commented May 25, 2026

deepin pr auto review

你好！我是CodeGeeX。我已经仔细审查了你提供的 Git Diff 内容。

本次提交主要是对 debian/changelog 文件的更新，记录了 dde-daemon (6.1.92) 版本的变更日志。虽然这只是一个变更日志文件，但其中透露的代码改动信息非常关键，尤其是涉及用户名验证、密码哈希处理和密码修改接口的部分。

以下是我基于这些变更信息，从语法逻辑、代码质量、代码性能和代码安全四个维度提出的审查意见和改进建议：

1. 代码安全 - 🔴 高风险关注点

Changelog 中提到了三项与安全高度相关的改动，需要特别审查其实现代码：

  • fix(users): harden password hash handling in ModifyPasswd (加固密码哈希处理)
    • 审查建议：必须确保代码中使用了强健的哈希算法（如 SHA-512/yescrypt/bcrypt），绝对避免使用已被淘汰的算法（如 MD5、DES）。
    • 改进意见：检查 ModifyPasswd 中是否对传入的哈希值做了严格的格式校验（对应了新增的 isValidCryptHash 测试）。防止恶意用户通过 DBus 接口注入非法的哈希字符串（例如尝试将哈希降级为 MD5 或注入空哈希）。
  • fix: revert SetPassword disable, restore with admin auth (恢复 SetPassword 并要求管理员认证)
    • 审查建议：上一个版本（6.1.91）直接禁用了 SetPassword DBus 方法，说明该接口可能存在严重的提权或注入漏洞（如 changelog 提到的 chpasswd injection）。现在恢复该接口并加入管理员认证，必须确保认证逻辑是不可绕过的。
    • 改进意见：确保在执行 SetPassword 前，通过 PolicyKit 进行了严格的权限校验（例如要求 org.freedesktop.policykit.exec 的授权），且校验失败时直接返回 PermissionDenied 错误，不执行任何底层操作。
  • test(users): add validation tests for isValidUsername and isValidCryptHash (新增验证测试)
    • 审查建议：用户名验证是防止提权攻击的关键。Linux 系统对用户名有严格限制（通常只允许小写字母、数字、下划线、连字符，且必须以字母开头，长度受限）。
    • 改进意见：确保 isValidUsername 严格过滤了特殊字符（如 ;, |, $, \x00 等），防止在后续调用系统命令（如 useradd, passwd 等）时发生命令注入。确保 isValidCryptHash 严格匹配 $id$salt$hash 的格式。

2. 语法逻辑 - 🟡 中风险关注点

  • fix: correct display mode in event log for single screen (修复单屏事件日志显示模式)
    • 审查建议：这类 Bug 通常是因为逻辑判断时只考虑了多屏情况，而忽略了单屏（或空屏）的边界条件。
    • 改进意见：检查相关代码中获取屏幕数量的逻辑，是否对 0 或 1 块屏幕的情况做了正确的 If-Else 或 Switch-Case 处理，避免出现数组越界或空指针引用。

3. 代码质量 - 🟢 建议优化

  • refactor: rename display transition config (重命名显示过渡配置)
    • 审查建议：重命名通常是为了提高代码可读性或统一命名规范。
    • 改进意见：确保这是一次全局一致的替换，没有遗漏的旧命名残留。同时，如果该配置项是暴露给外部（如 DBus 接口或配置文件）的，重命名可能会导致向后兼容性问题，需要确认是否提供了兼容层或进行了版本升级说明。
  • Changelog 格式规范：
    • 当前 Changelog 中中英文混排（第5条包含中文“修复单屏时事件日志显示模式错误”）。虽然这在内部项目中可能被允许，但 Debian 官方的打包规范通常建议 Changelog 使用纯英文。
    • 改进意见：建议统一语言，如果是面向社区的版本，最好将中文翻译为英文，如：fix: correct display mode in event log for single screen configuration。

4. 代码性能 - ⚪ 常规关注

  • 本次 Changelog 涉及的改动主要是逻辑修复和安全加固，通常不会引入性能瓶颈。
  • 审查建议：只需留意 isValidCryptHash 和 isValidUsername 这类验证函数，它们可能会被频繁调用，应确保其内部实现使用的是高效的正则表达式匹配或长度判断，避免复杂的字符串遍历或外部进程调用。

总结：
由于本次输入仅为 debian/changelog，我无法直接审查 C/Go 等源代码的具体实现。强烈建议您将涉及 ModifyPasswd、SetPassword、isValidUsername 和 isValidCryptHash 的代码 Diff 也一并提供，因为这些函数是系统安全的高危区域（尤其是修复了 chpasswd injection 之后），我需要审查其具体实现代码以确保安全加固真正生效。

如果您有具体的代码文件 Diff，欢迎补充，我将为您进行更深度的代码级审查！

@deepin-ci-robot
Copy link
Copy Markdown

deepin-ci-robot commented May 25, 2026

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: fly602, mhduiy, xionglinlin

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@mhduiy mhduiy merged commit a4d35f2 into linuxdeepin:master May 25, 2026
17 of 19 checks passed
@deepin-bot
Copy link
Copy Markdown
Contributor

deepin-bot Bot commented May 25, 2026

TAG Bot

✅ Tag created successfully

📋 Tag Details
  • Tag Name: 6.1.92
  • Tag SHA: 2794fe28918de44acd1055ce5e10908aa526f7d4
  • Commit SHA: 8ce2b0b720f750b5019c353d6316467635dbf382
  • Tag Message: 
    Release dde-daemon 6.1.92
  • Tagger:
    • Name: mhduiy
  • Distribution: unstable

This was referenced May 25, 2026
Open
Open
Open
Open
Open
Open
Open
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@sourcery-ai sourcery-ai[bot] sourcery-ai[bot] left review comments

@fly602 fly602 fly602 approved these changes

@xionglinlin xionglinlin xionglinlin approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@mhduiy @deepin-ci-robot @fly602 @xionglinlin