search

processone / ejabberd

Robust, Ubiquitous and Massively Scalable Messaging Platform (XMPP, MQTT, SIP Server)
https://www.process-one.net/en/ejabberd/
Other
6.11k stars 1.51k forks source link

make-binaries: Bump zlib to 1.2.13 #3945

Closed nosnilmot closed 1 year ago

nosnilmot commented 1 year ago

Update zlib to 1.2.13 to address CVE-2022-37434

Also change zlib download to use archive URL so builds do not fail when specified version is no longer the current version, and therefore no longer available to download at default location

And reduce log output:

coveralls commented 1 year ago

Coverage Status

Coverage decreased (-0.002%) to 33.426% when pulling ed678f58d35a71ca693e4744961ede306524d029 on nosnilmot:bump-zlib into a1cfae8c981e8e957eb79bfda94cc45ccf35b316 on processone:master.

weiss commented 1 year ago

Thanks.

You're editing the crosstool-NG configuration to update their zlib version as well. Is that necessary to make the build succeed? Otherwise I'd suggest omitting that change (the toolchain's zlib isn't actually used by the resulting binaries).

nosnilmot commented 1 year ago

You're editing the crosstool-NG configuration to update their zlib version as well. Is that necessary to make the build succeed? Otherwise I'd suggest omitting that change (the toolchain's zlib isn't actually used by the resulting binaries).

yes, it is necessary, otherwise crosstool-ng also fails to download zlib-1.2.12 because it's also looking for it at https://zlib.net/zlib-1.2.12.tar.xz (https://github.com/crosstool-ng/crosstool-ng/issues/1832). I could omit the CT_ZLIB_VERSION change and just update CT_ZLIB_MIRRORS to get 1.2.12 from the archives (fossils) but if making changes in that area we might as well use the version that does not have a vulnerability :)

weiss commented 1 year ago

Ok, thanks 👍🏻