-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Format: 1.8 Date: Mon, 26 Aug 2024 11:43:37 +0100 Source: diffoscope Built-For-Profiles: nocheck Architecture: source Version: 240+deb12u1 Distribution: stable Urgency: medium Maintainer: Reproducible builds folks <reproducible-builds@lists.alioth.debian.org> Changed-By: Chris Lamb <lamby@debian.org> Closes: 1078883 Changes: diffoscope (240+deb12u1) stable; urgency=medium . [ Chris Lamb ] * Backport a patch by FC (Fay) Stegerman to fix a FTBFS caused by a .zip-related security fix that was included in Debian's own upload of python3.11 3.11.2-6+deb12u2 (see #1070133). Diffoscope's testsuite deliberately excercises a Mozilla-style ZIP file that has its Central Directory secton at the beginning of the file, rather than at the end. This breaks the new overlap check in Python's built-in zipfile.py library as that checks that every entry ends before the Central Directory begins. Many thanks to Fay for both the patch and related guidance. (Closes: #1078883) * Do not call marshal.loads() on precompiled Python bytecode as it is inherently unsafe. The loads() method can easily cause the CPython process running diffoscope to irretrievably crash (e.g. when presented with a newer .pyc format), and potentially permit of arbitrary code execution. Replace, for now, with a brief textual summary of the code section of .pyc files instead. For more information, see: <https://salsa.debian.org/reproducible-builds/diffoscope/-/issues/371> Checksums-Sha1: 618824e4657b53c86c5403b724286e8336228ad3 5183 diffoscope_240+deb12u1.dsc 3fc068320bad4c5e4bf98cbd1b8170549cdaa473 2442344 diffoscope_240+deb12u1.tar.xz c891561479979bc901a4863d2e38c56730b71ee5 7234 diffoscope_240+deb12u1_amd64.buildinfo Checksums-Sha256: 5107c359ec1637d82e8041160b22054123d21fcf500e9358fdcdac904c8fb1b8 5183 diffoscope_240+deb12u1.dsc 88c102de0011563bac39f8c8a5b19304e926600fd225aa6d5c108e2b0fc16adc 2442344 diffoscope_240+deb12u1.tar.xz 38711632fbf6dd0447c7817000d2bad076fbb48df0ebc167ba38cd92674e0715 7234 diffoscope_240+deb12u1_amd64.buildinfo Files: 468c71271c19c5e272b3b46827e9d743 5183 devel optional diffoscope_240+deb12u1.dsc 05e75e2b148bfa807f36454b2ec06c24 2442344 devel optional diffoscope_240+deb12u1.tar.xz cdaf26b8ffe90ba684ae089f881d870e 7234 devel optional diffoscope_240+deb12u1_amd64.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEwv5L0nHBObhsUz5GHpU+J9QxHlgFAmbW1UgACgkQHpU+J9Qx HliUgxAAhfX9w/UYU4VoZzxtSVxTrP5ZG+rsK+vo9z0aAahQD+dGWbXJniJnl8AM ahl5D+lshKpkBIDiYiDTXeLY04UjIIBEbQYZKrgjDcmm2L3Kk1/6/PCtYbR3AhrB jUyH9EKP7PH7w/+aij1BvbvOGmnNXBJzV3MbEQft8w1haE7VvZKRTVaOSoeDE/jr CKlZzKP6tfZOQyk0Iehur7e/nbxKEx5oE0QDqbu/XkPBS6ztMHzvrWMvsov7i8Jy HjIeCtvCCYLCeNQXdnKuxc1VLXuimJMJRwrdR/AI+/XN9vCfMsOiXdE0K0joQg8S 1Pn9hXzWeO2bW5uRCN6E9GtFmHUWek9UWdILX0DPGfoiWc5hvZl92pBuHrbLtYn9 lHdqKSut1Eg8szY7skLI1CD6AIriObvEFwXiVJ1fZ088rUf7pQxWHSKPKm3t7btF sPUPgEVoJ2Y0GygnVxA73/JJIh/9HXVAfEbEWAAo0MzAo62bPTof3zux/6gsRJ22 kD24ilaiRfBL5PssGwl3Qn68sK+95ZvP87pgjnjYsjWEJWFV3xfhlqFEOVtdcp09 eN0oHCXd9CTR996V/qsokvf+5z7uVnpJ6B66vxDu9nzFLEcHbt45yVLGtic2qtkr rG7HHNEeY2A5vwaHk4+Mcn5edLh11qmlipblbJxYafOTQWZmdHc= =Ywa4 -----END PGP SIGNATURE-----
