Fall 2020 security package update #4211

th0ma7 · 2020-10-09T11:08:50Z

Issue for tracking all packages needing publishing following major updates to openssl, glib, gnutls & libgcrypt adressing multiple security issues namely:

Related PR:

~~openssl: update to version 1.1.1h #4155: Update openssl~~ (merged)
~~glib, gnutls and libgcrypt security updates #4010: Update glib, gnutls & libgcrypt~~ (merged)
~~Update & fix build of ruTorrent #4209: Update ruTorrent~~ (merged, see Package updates below)
~~Update synocli net #4195: Update synocli-net~~ (merged)
~~tvheadend: Update to git hash 9ed76c0 from Oct 11th 2020 #4218 Update to tvheadend~~ (merged)
~~Update mosquitto (todo: create new PR after merge of sourceforge.net toolchain & kernel location change #4115)~~

Indirectly related PR:

~~make all-supported and all-default #4200: Update to make all-supported with parallel build to ease publishing~~ (merged)
~~bitlbee: Remove obsolete package #4208: Remove bitlbee~~ (merged)

Package updates

Packages with new revision due to openssl update (PR #4155)

First stage

Before or in parallel with updated packages above

python3
python

Second Stage

Packages with new revision due to `glib`,`gnutls` or `libgcrypt` (PR #4010)

Packages with new revision due to `rutorrent` update (PR #4209)

mediainfo
rutorrent (BUG: service does not start)

To be confirmed (issue #3666)

mono

Packages set for removal (PR #4208)

bitlbee

The text was updated successfully, but these errors were encountered:

th0ma7 · 2020-10-09T11:11:21Z

Proposal:

Merge all PR starting with openssl: update to version 1.1.1h #4155 with rebasing for all subsequent to confirm proper github-action builds
As @hgy59 is proposing to start with a first block for python and python3 (with or without affiliated packages)?
I would suggest a second block including the classic 4x related to ffmpeg (e.g. chromaprint, comskip and tvheadend)
Perhaps releasing a few other "trivial" packages?
A pause for a week to confirm no major blockers emerge
Publish the remaining

Thoughts?

hgy59 · 2020-10-10T16:31:45Z

1. Merge all PR starting with #4155 with rebasing for all subsequent to confirm proper github-action builds

Before this, we should merge #4191 to fix the Makefile of openssl 1.0.1 and then rebase #4155 before continuing with the proposed list.

I do not expect to publish mosquitto with the outdated openssl version, but I would like to see a working cross/openssl on the master before we switch to openssl 1.1.1.

ymartin59 · 2020-10-12T18:23:25Z

So do I understand well it is worth waiting for glib/gnutls/libgcrypt merge before building and testing again python+python3?
From my point of view, there is no need to deliver Python related application packages.

th0ma7 · 2020-10-12T19:13:34Z

Exactly as there are sub-dependencies that relies on this. But everything is building beautifully currently and addressing the last remaining bits such as spk package rev & changelogs.

hgy59 · 2020-10-12T20:02:34Z

@ymartin59 I published synocli-net to the repo about 20 hours ago. It is shown in the web page but in the package center of my diskstations still the old version 1.4-4 is shown. And yes, I have activated the packages. Is there anything else that is missing or do we need to wait for a "cache update"?

th0ma7 · 2020-10-12T20:10:03Z

I noticed from time to time that it can take as much as 48h+ to finally see the new packages...
Note that synocli-net is also indirectly affected by #4010 as well. Although not convinced is worth pushing another update...

ymartin59 · 2020-10-12T21:06:12Z

There is a chance both combination of Package Center refresh period and Fastly caching configuration delay availability in users' DSM

ymartin59 · 2020-10-12T21:11:02Z

I think Mono also requires another build #3666

ymartin59 · 2020-10-14T12:49:57Z

@th0ma7 When building fossil-scm, openssl PLIST libraries have not been included into package... No idea if it is a transient error when building, or if it is a trouble with build chain changes.

th0ma7 · 2020-10-14T16:34:13Z

I've just check with the tvheadend package I built this morning and everything looks good?

~/git-master/spksrc/cross/openssl$ cat PLIST | while read LINE
> do
> grep $LINE ~/git-master/spksrc/spk/tvheadend/work-apollolake-6.2.3/PLIST
> done
rsc:bin/c_rehash
bin:bin/openssl
lib:lib/engines-1.1/afalg.so
lib:lib/engines-1.1/capi.so
lib:lib/engines-1.1/padlock.so
lnk:lib/libcrypto.so
lib:lib/libcrypto.so.1.1
lnk:lib/libssl.so
lib:lib/libssl.so.1.1

Along with matching dependency tree:

~/git-master/spksrc/spk/tvheadend$ make dependency-tree
+ tvheadend
	+ busybox 1.26.2
	+ tvheadend 4.3
		+ openssl 1.1.1h
			+ zlib 1.2.11
		+ uriparser 0.9.1
		+ pcre2 10.35
		+ libiconv 1.15
		+ python 2.7.18
		...

Although just noticed that there are many many files missing!!!

$ make dependency-flat | while read DEP; do cat ../../$DEP/PLIST 2>/dev/null | while read LINE; do grep $LINE ~/git-master/spksrc/spk/tvheadend/work-apollolake-6.2.3/PLIST 2>/dev/null || echo "$LINE: ERROR"; done; done | grep ERROR | wc -l
668

th0ma7 · 2020-10-14T16:42:28Z

I just tried it against fossil-scm and indeed there is an issue out there:

$ more PLIST 
bin:bin/fossil

Dependency tree looks good (although with a duplicate zlib):

fossil-scm$ make dependency-tree
+ fossil-scm
	+ fossil-scm 2.12.1
		+ zlib 1.2.11
		+ openssl 1.1.1h
			+ zlib 1.2.11

Question is: could this affect other PLIST from other dependencies resulting into bad spk?

I recall looking into the PLIST creation and I was always getting odd results when playing with that section of the code that really needs revamping as not using the magic cookie mechanism like everywhere else. I ended-up not touching it for now. Although perhaps changing other pieces of the code elsewhere had a side effect? <<-- Must have had side effects...

Further testing:

$ make dependency-flat | while read DEP; do cat ../../$DEP/PLIST | while read LINE; do grep $LINE ~/git-master/spksrc/spk/fossil-scm/work-apollolake-6.2.3/PLIST || echo "$LINE: ERROR"; done; done
bin:bin/fossil
rsc:bin/c_rehash: ERROR
bin:bin/openssl: ERROR
lib:lib/engines-1.1/afalg.so: ERROR
lib:lib/engines-1.1/capi.so: ERROR
lib:lib/engines-1.1/padlock.so: ERROR
lnk:lib/libcrypto.so: ERROR
lib:lib/libcrypto.so.1.1: ERROR
lnk:lib/libssl.so: ERROR
lib:lib/libssl.so.1.1: ERROR
lnk:lib/libz.so: ERROR
lnk:lib/libz.so.1: ERROR
lib:lib/libz.so.1.2.11: ERROR

th0ma7 · 2020-10-14T21:02:50Z

I'll do a git-bisect and try to figure out where the issue is exactly... more to come with hopefully a fix shortly.

Investigating and issue has been on-going for quite long... really really really long... We definitively need to rework the PLIST in order to validate that each and every PLIST of all dependencies is properly processed, included and that the resulting files are all included (last part tar should tell). Further more, as mentioned previously, I had found odd-behavior when trying to rework part of that code so I never pushed upstream any changes due to unknown bugs..

Findings so far (re-using/backporting fossil-scm as it easily triggers the problem) :

bad - HEAD is now at 1c5cf293 cross/nmap: cflags are actually no longer required
bad - HEAD is now at 7f816fea openssl: update to version 1.0.2u
bad - HEAD is now at 272d8b62 wallabag: update wallabag to 2.3.8 and various fixes (#4179)
bad - HEAD is now at 0373760e python3: upgrade to 3.7.7 + homeassistant build fixes (#3953)
bad - HEAD is now at a8cbf704 incorporate fixes for mistakes with rebase
bad - HEAD is now at a52d9f65 update transmission to 3.00 (#4009)
bad - HEAD is now at fc7a6e01 fossil-scm: initial package for version 2.10 (#3909)
bad - HEAD is now at 33324b9b znc: update to 1.7.5
bad - HEAD is now at 5df16e10 synocli-file: initial package version
bad - HEAD is now at ab347af3 Update templates

To the point where I downloaded the fossil-scm package online and the issue was already existing at that time:

$ tar -xvf fossil-scm.v1.f15047[apollolake-avoton-braswell-broadwell-broadwellnk-bromolow-cedarview-denverton-dockerx64-grantley-kvmx64-x86-x86_64].spk
package.tgz
INFO
scripts/
scripts/service-setup
scripts/start-stop-status
scripts/preupgrade
scripts/postuninst
scripts/installer
scripts/postupgrade
scripts/preinst
scripts/preuninst
scripts/postinst
PACKAGE_ICON.PNG
PACKAGE_ICON_256.PNG
syno_signature.asc

$ tar -zxvf package.tgz 
app/
app/images/
app/images/fossil-scm-256.png
app/images/fossil-scm-64.png
app/images/fossil-scm-24.png
app/images/fossil-scm-72.png
app/images/fossil-scm-48.png
app/images/fossil-scm-32.png
app/images/fossil-scm-16.png
bin/
bin/fossil

th0ma7 · 2020-10-14T23:39:37Z

I need help from somebody to tell me that I am completely mistaking and crazy...

fossil-scm package seems to trigger the problem, always.
At the opposite zsh works out all right.

Findings so far the issue has been going since at least March 2019.
Actually I've stopped searching at that point just because I now doubt that my method is right.
A second opinion would be much appreciated.

commit ab347af3e91141c0125a67306dde97b9f73c01c6 (HEAD)
Author: hgy59 <hpgy59@gmail.com>
Date:   Sat Mar 30 09:06:52 2019 +0100

…4211

th0ma7 · 2020-10-21T21:34:19Z

BTW @ymartin59 let me know how if you need some help to deploy other packages.
I might be able to find a few spare cycles over the week-end to help out.

th0ma7 · 2020-10-26T11:08:01Z

Foud a few cycles to publish mediainfo, done.

ymartin59 · 2020-10-31T10:39:48Z

@th0ma7 Do not hesitate to pick any package you are interested in. According to remaining list, most of them require "update" process to publish latest version.

th0ma7 · 2020-11-04T02:28:37Z

@hgy59 was links 2.21-2 (todo: move to synocli-net with #4195) completed par of the new release of synocli-net ?

th0ma7 · 2020-11-07T14:41:07Z

@hgy59 thnx for releasing ntop and lua. I was working on haproxy but work on this got lost on my failed hard drive before I was able to push my git upstream.

BenjV · 2021-08-29T09:09:52Z

There is a security alert for Openssl with a high risk classification reported.
see:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3711
and
https://www.openssl.org/news/vulnerabilities.html

This is fixed in Openssl 1.1.1l.
Is it a good idea to upgrade to this openssl version?

hgy59 · 2021-11-02T06:02:49Z

Closing this, as all remaining packages are covered by #4820.

th0ma7 mentioned this issue Oct 10, 2020

openssl: update to version 1.1.1h #4155

Merged

30 tasks

hgy59 mentioned this issue Oct 10, 2020

New architecture: Geminilake #3999

Closed

hgy59 pinned this issue Oct 10, 2020

th0ma7 added a commit to th0ma7/spksrc that referenced this issue Oct 15, 2020

plist.mk: Cheap fix for PLIST madness found with Issue SynoCommunity#…

dfda016

…4211

This was referenced Oct 15, 2020

plist.mk: Cheap fix for PLIST madness found with Issue #4211 #4221

Closed

PLIST fails to include all files #4222

Closed

chromaprint & comskip: Bump version & comment ffmpeg update 4.3.1 #4224

Merged

hgy59 mentioned this issue Oct 24, 2020

update gnupg #4233

Merged

3 tasks

th0ma7 mentioned this issue Oct 26, 2020

Latest Mediainfo 20.03 is reporting as 19.09 #4216

Closed

hgy59 mentioned this issue Oct 30, 2020

update synocli-file tools #4242

Merged

3 tasks

This was referenced Oct 31, 2020

native/libmysqlclient: Fix download URL to align against cross/* #4245

Merged

sslh: Update startup & configuration to work with new version #4246

Merged

hgy59 mentioned this issue Nov 2, 2020

update synocli-disk tools #4252

Merged

3 tasks

th0ma7 mentioned this issue Nov 3, 2020

Update ntopng to version 4.2 #4255

Merged

10 tasks

hgy59 mentioned this issue Dec 8, 2020

update mutt to v2.0.3 #4293

Merged

3 tasks

hgy59 mentioned this issue Dec 24, 2020

update synocli-monitor #4329

Merged

3 tasks

This was referenced Aug 29, 2021

update openssl to v1.1.1l #4819

Merged

Update OpenSSL to 1.1.1l #4820

Closed

hgy59 unpinned this issue Sep 21, 2021

hgy59 closed this as completed Nov 2, 2021

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fall 2020 security package update #4211

Fall 2020 security package update #4211

th0ma7 commented Oct 9, 2020 •

edited by hgy59

Loading

th0ma7 commented Oct 9, 2020 •

edited

Loading

hgy59 commented Oct 10, 2020 •

edited

Loading

ymartin59 commented Oct 12, 2020

th0ma7 commented Oct 12, 2020

hgy59 commented Oct 12, 2020 •

edited

Loading

th0ma7 commented Oct 12, 2020

ymartin59 commented Oct 12, 2020

ymartin59 commented Oct 12, 2020

ymartin59 commented Oct 14, 2020

th0ma7 commented Oct 14, 2020 •

edited

Loading

th0ma7 commented Oct 14, 2020 •

edited

Loading

th0ma7 commented Oct 14, 2020 •

edited

Loading

th0ma7 commented Oct 14, 2020

th0ma7 commented Oct 21, 2020

th0ma7 commented Oct 26, 2020

ymartin59 commented Oct 31, 2020

th0ma7 commented Nov 4, 2020

th0ma7 commented Nov 7, 2020

BenjV commented Aug 29, 2021

hgy59 commented Nov 2, 2021

Fall 2020 security package update #4211

Fall 2020 security package update #4211

Comments

th0ma7 commented Oct 9, 2020 • edited by hgy59 Loading

Package updates

Packages with new revision due to openssl update (PR #4155)

First stage

Second Stage

Packages with new revision due to glib,gnutls or libgcrypt (PR #4010)

Packages with new revision due to rutorrent update (PR #4209)

To be confirmed (issue #3666)

Packages set for removal (PR #4208)

th0ma7 commented Oct 9, 2020 • edited Loading

hgy59 commented Oct 10, 2020 • edited Loading

ymartin59 commented Oct 12, 2020

th0ma7 commented Oct 12, 2020

hgy59 commented Oct 12, 2020 • edited Loading

th0ma7 commented Oct 12, 2020

ymartin59 commented Oct 12, 2020

ymartin59 commented Oct 12, 2020

ymartin59 commented Oct 14, 2020

th0ma7 commented Oct 14, 2020 • edited Loading

th0ma7 commented Oct 14, 2020 • edited Loading

th0ma7 commented Oct 14, 2020 • edited Loading

th0ma7 commented Oct 14, 2020

th0ma7 commented Oct 21, 2020

th0ma7 commented Oct 26, 2020

ymartin59 commented Oct 31, 2020

th0ma7 commented Nov 4, 2020

th0ma7 commented Nov 7, 2020

BenjV commented Aug 29, 2021

hgy59 commented Nov 2, 2021

th0ma7 commented Oct 9, 2020 •

edited by hgy59

Loading

Packages with new revision due to `glib`,`gnutls` or `libgcrypt` (PR #4010)

Packages with new revision due to `rutorrent` update (PR #4209)

th0ma7 commented Oct 9, 2020 •

edited

Loading

hgy59 commented Oct 10, 2020 •

edited

Loading

hgy59 commented Oct 12, 2020 •

edited

Loading

th0ma7 commented Oct 14, 2020 •

edited

Loading

th0ma7 commented Oct 14, 2020 •

edited

Loading

th0ma7 commented Oct 14, 2020 •

edited

Loading