Skip to content

[Zlib_jll] Update to v1.2.12+3#44810

Merged
giordano merged 1 commit intoJuliaLang:masterfrom
giordano:mg/update-zlib
Apr 4, 2022
Merged

[Zlib_jll] Update to v1.2.12+3#44810
giordano merged 1 commit intoJuliaLang:masterfrom
giordano:mg/update-zlib

Conversation

@giordano
Copy link
Member

@giordano giordano commented Mar 31, 2022 •
edited
Loading

Follow up to JuliaPackaging/Yggdrasil#4692.

Note: this is the first build of the real upstream version 1.2.12 which was
released a few days ago.

Usual memo to self:

  • update the version number in stdlib/Zlib_jll/Project.toml
  • update the version number in deps/zlib.version
  • refresh checksums with make -f contrib/refresh_checksums.mk -j zlib

CC: @eschnett

@giordano giordano added external dependencies Involves LLVM, OpenBLAS, or other linked libraries JLLs labels Mar 31, 2022
@giordano giordano requested a review from staticfloat March 31, 2022 16:03
@giordano
[Zlib_jll] Update to v1.2.12+3
87b5db3 
Note: this is the first build of the real upstream version 1.2.12 which was
released a few days ago.
@eschnett
Copy link
Contributor

eschnett commented Mar 31, 2022

This is a security update for zlib. It would make sense to backport these changes.

@giordano giordano added backport 1.6 Change should be backported to release-1.6 backport 1.7 backport 1.8 Change should be backported to release-1.8 labels Mar 31, 2022
@giordano giordano merged commit 81e7cfc into JuliaLang:master Apr 4, 2022
@giordano giordano deleted the mg/update-zlib branch April 4, 2022 20:11
@tkf tkf mentioned this pull request Apr 5, 2022
Closed
@eschnett
Copy link
Contributor

eschnett commented Apr 6, 2022

How is backporting handled? Do people scan closed PRs for backport tags?

@giordano
Copy link
Member Author

giordano commented Apr 6, 2022

I believe @KristofferC has a script which does that automatically

@KristofferC KristofferC mentioned this pull request Apr 19, 2022
Merged
40 tasks
KristofferC pushed a commit that referenced this pull request Apr 19, 2022
@giordano @KristofferC
[Zlib_jll] Update to v1.2.12+3 (#44810)
5b8d99a 
Note: this is the first build of the real upstream version 1.2.12 which was
released a few days ago.

(cherry picked from commit 81e7cfc)
KristofferC pushed a commit that referenced this pull request Apr 19, 2022
@giordano @KristofferC
[Zlib_jll] Update to v1.2.12+3 (#44810)
2a0f4de 
Note: this is the first build of the real upstream version 1.2.12 which was
released a few days ago.

(cherry picked from commit 81e7cfc)
@KristofferC KristofferC mentioned this pull request Apr 19, 2022
Merged
67 tasks
@nsslh
Copy link

nsslh commented May 9, 2022 •
edited
Loading

Please add the security label.

Edit: @KristofferC I suggested this based on Discourse discussion where you mentioned that this could be considered a security update. I guess you're referring to the out-of-bounds fix, although I can't find a CVE for it.

Edit: Found it. I think it's CVE-2018-25032 [High].

@giordano giordano added the security System security concerns and vulnerabilities label May 10, 2022
This was referenced May 11, 2022
Closed
Merged
@fxcoudert
Copy link
Contributor

fxcoudert commented May 20, 2022

@giordano quick question: why is ZLIB_VER in deps/Versions.make still 1.2.11? Is that a mistake that should be updated, or should that line be removed entirely? I do not understand the difference between deps/Versions.make and deps/zlib.version?

@giordano
Copy link
Member Author

giordano commented May 20, 2022

That's a good question to which I don't have a definitive answer. deps/zlib.mk fetches the source with the function git-external:

julia/deps/zlib.mk

Line 5 in dea9805

$(eval $(call git-external,zlib,ZLIB,,,$(SRCCACHE)))
which reads deps/zlib.version and uses the variables defined there:

julia/deps/tools/git-external.mk

Lines 24 to 26 in dea9805

include $$(SRCDIR)/$1.version
$2_SHA1 := $$(strip $$($2_SHA1))
$2_BRANCH := $$(strip $$($2_BRANCH))
So I think that the version number in deps/Versions.make is not really used, but judging by the comments at the top of the file the variable still needs to be defined?

@fxcoudert fxcoudert mentioned this pull request May 21, 2022
Merged
KristofferC pushed a commit that referenced this pull request May 23, 2022
@giordano
[Zlib_jll] Update to v1.2.12+3 (#44810)
0baebd8 
Note: this is the first build of the real upstream version 1.2.12 which was
released a few days ago.

(cherry picked from commit 81e7cfc)
KristofferC pushed a commit that referenced this pull request May 23, 2022
@giordano
[Zlib_jll] Update to v1.2.12+3 (#44810)
4f793bb 
Note: this is the first build of the real upstream version 1.2.12 which was
released a few days ago.

(cherry picked from commit 81e7cfc)
@KristofferC KristofferC removed backport 1.8 Change should be backported to release-1.8 backport 1.7 labels May 26, 2022
@KristofferC KristofferC removed the backport 1.6 Change should be backported to release-1.6 label Jul 6, 2022
KristofferC pushed a commit that referenced this pull request Dec 21, 2022
@giordano
[Zlib_jll] Update to v1.2.12+3 (#44810)
67e8d6b 
Note: this is the first build of the real upstream version 1.2.12 which was
released a few days ago.

(cherry picked from commit 81e7cfc)
staticfloat pushed a commit that referenced this pull request Dec 23, 2022
@giordano @staticfloat
[Zlib_jll] Update to v1.2.12+3 (#44810)
95c1492 
Note: this is the first build of the real upstream version 1.2.12 which was
released a few days ago.

(cherry picked from commit 81e7cfc)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@staticfloat staticfloat staticfloat approved these changes

Assignees

No one assigned

Labels

external dependencies Involves LLVM, OpenBLAS, or other linked libraries JLLs security System security concerns and vulnerabilities

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

6 participants

@giordano @eschnett @nsslh @fxcoudert @staticfloat @KristofferC