Alex Crichton [Thu, 19 Mar 2026 21:56:51 +0000 (16:56 -0500)]
archive: Unconditionally honor PAX size (#441)
This synchronizes our behavior with most other tar parsers
(including astral-tokio-tar and Go archive/tar) ensuring
that we don't parse things differently.
The problem with parsing size in particular differently is
it's easy to craft a tar archive that appears completely differently
between two parsers. This is the case with e.g. crates.io where
astral-tokio-tar is used for validation server side, but cargo uses
the `tar` crate to upload.
With this, the two projects agree.
Signed-off-by: Colin Walters <walters@verbum.org> Co-authored-by: Colin Walters <walters@verbum.org>
FG: drop test-related changes Signed-off-by: Fabian Grünbichler <debian@fabian.gruenbichler.email> Fixes: CVE-2026-33055
Gbp-Pq: Topic vendor
Gbp-Pq: Name tar-CVE-2026-33055.patch
When unpacking a tarball containing a symlink followed by a directory
entry with the same path, unpack_dir previously used fs::metadata()
which follows symlinks. This allowed an attacker to modify permissions
on arbitrary directories outside the extraction path.
The fix uses fs::symlink_metadata() to detect symlinks and refuse to
treat them as valid existing directories.
Document more exhaustively+consistently security caveats.
Reported-by: Sergei Zimmerman <https://github.com/xokdvium> Assisted-by: OpenCode (Claude claude-opus-4-5) Signed-off-by: Colin Walters <walters@verbum.org> Co-authored-by: Colin Walters <walters@verbum.org>
FG: drop test-related changes Signed-off-by: Fabian Grünbichler <debian@fabian.gruenbichler.email> Fixes: CVE-2026-33056
Gbp-Pq: Topic vendor
Gbp-Pq: Name tar-CVE-2026-33056.patch
like Illumos in #148322, Hurd was missed when originally introducing locking
gates per target OS in #132977. building rustc on Hurd was broken as a result
since 1.91.
Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
Gbp-Pq: Topic upstream
Gbp-Pq: Name Enable-file-locking-support-for-Hurd.patch
In Rust, library filenames include a version-specific hash to help
the run-time linker find the correct version. Unlike in C/C++, the
compiler looks for all libraries matching a glob that ignores the
hash and reads embedded metadata to work out versions, etc.
The upshot is that there is no need for the usual "libfoo.so ->
libfoo-1.2.3.so" symlink common with C/C++ when building with Rust,
and no need to communicate an alternate filename to use at run-time
vs compile time. If linking to a Rust dylib from C/C++ however, a
"libfoo.so -> libfoo-$hash.so" symlink may well be useful and in
this case DT_SONAME=libfoo-$hash.so would be required. More
mundanely, various tools (eg: dpkg-shlibdeps) complain if they don't
find DT_SONAME on shared libraries in public directories.
This patch passes -Wl,-soname=$outfile when building dylibs (and
using a GNU linker).
Forwarded: no
Gbp-Pq: Topic behaviour
Gbp-Pq: Name d-rustc-add-soname.patch
Our patch to mdbook installs symlinks to systems versions of font-awesome,
highlight, etc. Upstream mdbook otherwise doesn't use symlinks, so this
doesn't affect anything else that's already generated.
Forwarded: not-needed
Gbp-Pq: Topic build
Gbp-Pq: Name d-bootstrap-install-symlinks.patch
to find dependencies on windows targets in vendored crates. you will likely
need to remove some hunks from this patch after pruning dependencies, since
hopefully a few of the crates patched during early rebasing are eliminated.
windows-bindgen and windows-metadata should not be removed, they are needed for
the build and don't pull in windows-sys and friends.
Forwarded: not-needed
Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
Gbp-Pq: Topic prune
Gbp-Pq: Name d-0021-vendor-remove-windows-dependencies.patch
Description: remove all vendoring features of crates normally shipping bundled
C libs. that C code is stripped when repacking, so the features can't work
anyway.
Forwarded: not-needed
Gbp-Pq: Topic prune
Gbp-Pq: Name d-0010-cargo-remove-vendored-c-crates.patch
Description: Use https://github.com/infinity0/mdBook/tree/debian to help you rebase
the patch on top of a newer version. . Make sure the paths here match the ones
in debian/rust-doc.links
Forwarded: not-needed
Gbp-Pq: Topic prune
Gbp-Pq: Name d-0002-mdbook-strip-embedded-libs.patch
cross_conmpile::alternate states it should only be used in test cases
after checking cross_compile::disabled(), which is missing here. these
tests fail despite setting CFG_DISABLE_CROSS_TESTS on i386, since both
the host and the alternate cross target would be i686 in that case.
Signed-off-by: Fabian Grünbichler <debian@fabian.gruenbichler.email>
Gbp-Pq: Topic cargo
Gbp-Pq: Name c-0003-tests-add-missing-cross-disabled-checks.patch
projects / rustc.git / log