Bug 15598

Summary:	rpm: Since the fix for CVE-2014-9620, file will print a "warning" that it only processed 256 notes (pterjan)
Product:	Mageia	Reporter:	Oden Eriksson <oe>
Component:	RPM Packages	Assignee:	QA Team <qa-bugs>
Status:	RESOLVED FIXED	QA Contact:
Severity:	major
Priority:	High	CC:	geiger.david68210, sysadmin-bugs, thierry.vignaud
Version:	4	Keywords:	PATCH, validated_update
Target Milestone:	---
Hardware:	i586
OS:	Linux
URL:	http://svnweb.mageia.org/packages?view=revision&revision=819447
Whiteboard:	has_procedure advisory MGA4-32-OK MGA4-64-OK
Source RPM:	rpm	CVE:
Status comment:

Description Oden Eriksson 2015-03-31 09:22:29 CEST

This problem was fixed in cauldron with:

* Sat Feb 14 2015 pterjan <pterjan> 1:4.12.0.1-20.mga5
+ Revision: 814948
- Don't fail the build when file reports to many notes in an ELF

And fixed for mga4 with rpm-4.11.1-9.1.mga4.

Hit the bug when trying to build mariadb-5.5.42:

[...]
stat: cannot stat '/home/iurt/rpmbuild/BUILDROOT/mariadb-5.5.42-1.mga4.x86_64/usr/sbin/mysqld,': No such file or directory
stat: cannot stat 'too': No such file or directory
stat: cannot stat 'many': No such file or directory
stat: cannot stat 'notes': No such file or directory
stat: cannot stat '(256)': No such file or directory
[...]

https://bugs.mageia.org/show_bug.cgi?id=15592#c1

Reproducible: 

Steps to Reproduce:

Oden Eriksson 2015-03-31 09:22:49 CEST

Blocks: (none) => 15592

Oden Eriksson 2015-03-31 09:23:54 CEST

Priority: Normal => High
Blocks: 15592 => (none)

Thierry Vignaud 2015-03-31 13:18:40 CEST

Keywords: (none) => PATCH
URL: (none) => http://svnweb.mageia.org/packages?view=revision&revision=819447
CC: (none) => thierry.vignaud

Comment 1 Oden Eriksson 2015-03-31 15:09:58 CEST

So, it's a regression with http://advisories.mageia.org/MGASA-2015-0030.html

FYI. MBS2 is using file-5.22

Comment 2 David Walser 2015-03-31 15:10:20 CEST

Building certain packages (mariadb in mga4 SVN, java-1.8.0-openjdk from Cauldron) fails until this rpm patch is installed.

We need to push this update before we can build the mariadb update for Bug 15592.

Advisory:
----------------------------------------

With the fix for CVE-2015-9620 in the file package (MGASA-2015-0030), when
building RPMs, sometimes the build will fail if the file command reports too
many ELF notes on one of the binaries in the RPM package being built. The rpm
package has been patched to work around these failures.

References:
http://advisories.mageia.org/MGASA-2015-0030.html
http://rpm.org/ticket/887
----------------------------------------

Updated packages in core/updates_testing:
----------------------------------------
rpm-4.11.1-9.1.mga4
librpmbuild3-4.11.1-9.1.mga4
librpmsign3-4.11.1-9.1.mga4
librpm3-4.11.1-9.1.mga4
librpm-devel-4.11.1-9.1.mga4
rpm-build-4.11.1-9.1.mga4
rpm-sign-4.11.1-9.1.mga4
python-rpm-4.11.1-9.1.mga4

from rpm-4.11.1-9.1.mga4.src.rpm

Assignee: bugsquad => qa-bugs
Summary: Since the fix for CVE-2014-9620, file will print a "warning" that it only processed 256 notes (pterjan) => rpm: Since the fix for CVE-2014-9620, file will print a "warning" that it only processed 256 notes (pterjan)

Comment 3 David Walser 2015-03-31 21:56:25 CEST

I checked mariadb out from Mageia 4 SVN (mgarepo co -d 4 mariadb) and built it locally with the updated rpm packages installed and it built fine on Mageia 4 i586.

Note that building mariadb requires over 4GB of free disk space.

Whiteboard: (none) => has_procedure MGA4-32-OK

Comment 4 David GEIGER 2015-03-31 23:18:03 CEST

Tested mga4_64,

Testing complete for rpm-4.11.1-9.1.mga4, Ok for me no regression found and seems to work properly.

Also I did do same successful test as David on comment 3.


$ bm -l mariadb.spec
+ umask 022
+ cd /home/david/mgarepo/mariadb/BUILD
+ cd mariadb-5.5.42
+ /usr/bin/rm -rf /home/david/mgarepo/mariadb/BUILDROOT/mariadb-5.5.42-1.mga4.x86_64
+ exit 0
succeeded!

CC: (none) => geiger.david68210
Whiteboard: has_procedure MGA4-32-OK => has_procedure MGA4-32-OK MGA4-64-OK

Comment 5 claire robinson 2015-04-01 18:36:40 CEST

Validating. Advisory uploaded.

Please push to 4 updates

Thanks

Keywords: (none) => validated_update
Whiteboard: has_procedure MGA4-32-OK MGA4-64-OK => has_procedure advisory MGA4-32-OK MGA4-64-OK
CC: (none) => sysadmin-bugs

Comment 6 Mageia Robot 2015-04-01 18:58:06 CEST

An update for this issue has been pushed to Mageia Updates repository.

http://advisories.mageia.org/MGAA-2015-0032.html

Status: NEW => RESOLVED
Resolution: (none) => FIXED