Update modulesets.

gpodder · Jul 29, 2024 · dc7e55d · dc7e55d
1 parent b9aeb15
commit dc7e55d
Show file tree

Hide file tree

Showing 7 changed files with 33 additions and 47 deletions.
diff --git a/modulesets/bootstrap.modules b/modulesets/bootstrap.modules
@@ -32,6 +32,7 @@
               href="https://github.com"
               type="tarball" />
   <!---->
+<!-- NOTE: DO NOT UPGRADE TO 5.6.x! See https://nvd.nist.gov/vuln/detail/CVE-2024-3094 -->
   <autotools id="xz"
              autogen-sh="configure"
              bootstrap="true">
@@ -53,14 +54,26 @@
             repo="ftp.gnu.org" />
   </autotools>
   <!---->
+  <autotools id="libiconv"
+             autogen-sh="configure"
+             autogenargs="--disable-debug --disable-dependency-tracking --enable-extra-encodings">
+
+    <branch module="libiconv/libiconv-1.17.tar.gz"
+            version="1.17"
+            repo="ftp.gnu.org" />
+  </autotools>
+
   <autotools id="gettext"
              autogen-sh="configure"
              autogenargs="--without-emacs --disable-java --disable-native-java --disable-libasprintf --disable-csharp --with-included-glib --with-included-libcroco">
 
-    <branch module="gettext/gettext-0.22.tar.xz"
-            version="0.22"
-            hash="sha256:0e60393a47061567b46875b249b7d2788b092d6457d656145bb0e7e6a3e26d93"
+    <branch module="gettext/gettext-0.22.3.tar.xz"
+            version="0.22.3"
+            hash="sha256:b838228b3f8823a6c1eddf07297197c4db13f7e1b173b9ef93f3f945a63080b6"
             repo="ftp.gnu.org" />
+    <dependencies>
+      <dep package="libiconv" />
+    </dependencies>
   </autotools>
   <!--
     cmakes ./configure is picky about invalid flags so we manually set it
@@ -193,6 +206,7 @@
   <metamodule id="meta-bootstrap">
     <dependencies>
       <dep package="xz" />
+      <dep package="libiconv"/>
       <dep package="gettext" />
       <dep package="cmake" />
       <dep package="autoconf-archive" />

diff --git a/modulesets/gtk-osx-network.modules b/modulesets/gtk-osx-network.modules
@@ -97,9 +97,9 @@
   </autotools>
   <!---->
   <cmake id="zlib">
-    <branch module="zlib-1.3.tar.xz"
-            version="1.3"
-            hash="sha256:8a9ba2898e1d0d774eca6ba5b4627a11e5588ba85c8851336eb38de4683050a7"
+    <branch module="zlib-1.3.1.tar.xz"
+            version="1.3.1"
+            hash="sha256:38ef96b8dfe510d42707d9c781877914792541133e1870841463bfa73f883e32"
             repo="zlib" />
   </cmake>
   <!---->

diff --git a/modulesets/gtk-osx-python.modules b/modulesets/gtk-osx-python.modules
@@ -54,6 +54,9 @@
       -->
       <dep package="openssl" />
     </dependencies>
+    <after>
+      <dep package="sqlite"/>
+    </after>
   </autotools>
   <!---->
   <meson id="pycairo">

diff --git a/modulesets/gtk-osx-random.modules b/modulesets/gtk-osx-random.modules
@@ -32,12 +32,6 @@
   <repository name="sqlite"
               href="http://www.sqlite.org/"
               type="tarball" />
-  <repository name="fossies"
-              href="https://fossies.org/linux/misc/"
-              type="tarball" />
-  <repository name="paguire"
-              href="https://releases.pagure.org/"
-              type="tarball" />
   <repository name="itstool"
               href="http://files.itstool.org/"
               type="tarball" />
@@ -159,40 +153,13 @@
     </dependencies>
   </meson>
   <!---->
-  <autotools id="getopt"
-             autogen-sh="configure"
-             supports-non-srcdir-builds="no">
-    <branch module="getopt-1.1.6.tar.gz"
-            version="1.1.6"
-            hash="sha256:d0bf1dc642a993e7388a1cddfb9409bed375c21d5278056ccca3a0acd09dc5fe"
-            repo="fossies">
-      <patch file="getopt-autotools.patch"
-             strip="1" />
-    </branch>
-  </autotools>
-  <!---->
-  <autotools id="xmlto"
-             autogen-sh="autoreconf">
-    <branch module="xmlto/xmlto-0.0.28.tar.bz2"
-            version="0.0.28"
-            hash="sha256:1130df3a7957eb9f6f0d29e4aa1c75732a7dfb6d639be013859b5c7ec5421276"
-            repo="paguire">
-      <patch file="xmlto-allow-net-access.patch"
-             strip="1" />
-    </branch>
-    <dependencies>
-      <dep package="getopt" />
-    </dependencies>
-  </autotools>
-  <!---->
   <meson id="shared-mime-info">
     <branch module="2.2/shared-mime-info-2.2.tar.bz2"
             version="2.2"
             hash="sha256:418c480019d9865f67f922dfb88de00e9f38bf971205d55cdffab50432919e61"
             repo="shared-mime-info" />
     <dependencies>
       <dep package="glib" />
-      <dep package="xmlto" />
     </dependencies>
   </meson>
   <!---->

diff --git a/modulesets/gtk-osx.modules b/modulesets/gtk-osx.modules
@@ -157,7 +157,7 @@
   </autotools>
   <!---->
   <meson id="harfbuzz-no-cairo"
-         mesonargs="-Dcoretext=enabled -Dfreetype=enabled -Ddocs=disabled -Dbenchmark=disabled -Dintrospection=disabled">
+         mesonargs="-Dcoretext=enabled -Dfreetype=enabled -Ddocs=disabled -Dbenchmark=disabled -Dintrospection=disabled -Dtests=disabled">
 
     <branch module="harfbuzz/harfbuzz/releases/download/7.3.0/harfbuzz-7.3.0.tar.xz"
             version="7.3.0"

diff --git a/modulesets/upstream-ref b/modulesets/upstream-ref
@@ -1,5 +1,7 @@
-commit a27e8ff6ac5f98b2fc2743fd64fde05775d46293
+commit a04f75957fce925d0dc89e79f34fd24e035bd48d
 Author: John Ralls <[email protected]>
-Date:   Sun Aug 20 11:01:48 2023 -0700
+Date:   Fri Mar 29 19:44:53 2024 -0700
 
-    Only set neon enabled when building on ARM.
+    Don't upgrade xz to 5.6.x
+
+    https://nvd.nist.gov/vuln/detail/CVE-2024-3094
diff --git a/pins.sh b/pins.sh
@@ -1,7 +1,7 @@
 # https://gitlab.gnome.org/GNOME/gtk-osx/-/commits/master
-# use latest commit (2023-08-20)
-PIN_GTK_OSX_COMMIT='a27e8ff6'
+# use latest commit (2024-03-30)
+PIN_GTK_OSX_COMMIT='a04f7595'
 
 # https://gitlab.gnome.org/GNOME/gtk-mac-bundler/-/commits/master
-# use latest commit (2023-08-17)
-PIN_GTK_MAC_BUNDLER_COMMIT='0a95b2d5'
+# use latest commit (2024-05-19)
+PIN_GTK_MAC_BUNDLER_COMMIT='90443a1d'