f238791b6a
https://sources.debian.org/data/main/u/unzip/6.0-25 is unreachable so switch to the debian archive provided by snapshot.debian.org to retrieve all debian patches at once. While at it, also update indentation in hash file and add UNZIP_IGNORE_CVES entries. The Debian patch archive we refernce brings in a large set of patches, some of them fixing CVEs. Since we only cary the Debian patch archive as a single entity, just refer to it to identify all the CVEs the individual patches there in are fixng. Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com> [yann.morin.1998@free.fr: - don't wrap _SITE line that is anyway too long even when wrapped - don't enumerate Debian patches one by one, just refere to them globally - as a consequence, reorder CVEs ] Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
30 lines
771 B
Makefile
30 lines
771 B
Makefile
################################################################################
|
|
#
|
|
# unzip
|
|
#
|
|
################################################################################
|
|
|
|
UNZIP_VERSION = 6.0
|
|
UNZIP_SOURCE = unzip_$(UNZIP_VERSION).orig.tar.gz
|
|
UNZIP_PATCH = unzip_$(UNZIP_VERSION)-26.debian.tar.xz
|
|
UNZIP_SITE = https://snapshot.debian.org/archive/debian/20210110T204103Z/pool/main/u/unzip
|
|
UNZIP_LICENSE = Info-ZIP
|
|
UNZIP_LICENSE_FILES = LICENSE
|
|
UNZIP_CPE_ID_VALID = YES
|
|
|
|
# unzip_$(UNZIP_VERSION)-26.debian.tar.xz has patches to fix:
|
|
UNZIP_IGNORE_CVES = \
|
|
CVE-2014-8139 \
|
|
CVE-2014-8140 \
|
|
CVE-2014-8141 \
|
|
CVE-2014-9636 \
|
|
CVE-2014-9913 \
|
|
CVE-2015-7696 \
|
|
CVE-2015-7697 \
|
|
CVE-2016-9844 \
|
|
CVE-2018-18384 \
|
|
CVE-2018-1000035 \
|
|
CVE-2019-13232
|
|
|
|
$(eval $(cmake-package))
|