diff options
Diffstat (limited to 'source/xap/imagemagick')
| -rw-r--r-- | source/xap/imagemagick/doinst.sh | 17 | ||||
| -rwxr-xr-x | source/xap/imagemagick/imagemagick.SlackBuild | 52 | ||||
| -rw-r--r-- | source/xap/imagemagick/policy.xml.diff | 33 |
3 files changed, 89 insertions, 13 deletions
diff --git a/source/xap/imagemagick/doinst.sh b/source/xap/imagemagick/doinst.sh new file mode 100644 index 000000000..a78c00608 --- /dev/null +++ b/source/xap/imagemagick/doinst.sh @@ -0,0 +1,17 @@ +#!/bin/sh +config() { + NEW="$1" + OLD="`dirname $NEW`/`basename $NEW .new`" + # If there's no config file by that name, mv it over: + if [ ! -r $OLD ]; then + mv $NEW $OLD + elif [ "`cat $OLD | md5sum`" = "`cat $NEW | md5sum`" ]; then # toss the redundant copy + rm $NEW + fi + # Otherwise, we leave the .new copy for the admin to consider... +} + +# Process all .new config files: +for file in etc/ImageMagick*/*.new ; do + config $file +done diff --git a/source/xap/imagemagick/imagemagick.SlackBuild b/source/xap/imagemagick/imagemagick.SlackBuild index aca05857d..49797da04 100755 --- a/source/xap/imagemagick/imagemagick.SlackBuild +++ b/source/xap/imagemagick/imagemagick.SlackBuild @@ -1,6 +1,6 @@ #!/bin/sh -# Copyright 2008, 2009, 2010, 2011, 2012, 2013 Patrick J. Volkerding, Sebeka, MN, USA +# Copyright 2008, 2009, 2010, 2011, 2012, 2013, 2015, 2016 Patrick J. Volkerding, Sebeka, MN, USA # All rights reserved. # # Redistribution and use of this script, with or without modification, is @@ -28,20 +28,21 @@ BUILD=${BUILD:-1} # This is a bit messy, so we'll explain it well. :-) -# This is the base version number, which is needed to cd into the source tree -BASEVER=6.8.6-10 - # This is the version number used in the source tarball filename -FILEVER=6.8.6-10 +FILEVER=6.9.4-9 + +# This is the base version number, which is needed to cd into the source tree. +# Normally this is the same as $FILEVER, but allow setting it here if needed. +BASEVER=$FILEVER # This is the version number used in the package, where a version number cannot -# contain a '-' -PKGVER=6.8.6_10 +# contain a '-'. We'll try to autogenerate this one. +PKGVER=$(echo $FILEVER | tr - _) # Automatically determine the architecture we're building on: if [ -z "$ARCH" ]; then case "$( uname -m )" in - i?86) export ARCH=i486 ;; + i?86) export ARCH=i586 ;; arm*) export ARCH=arm ;; # Unless $ARCH is already set, use uname -m for all other archs: *) export ARCH=$( uname -m ) ;; @@ -50,8 +51,8 @@ fi NUMJOBS=${NUMJOBS:-" -j7 "} -if [ "$ARCH" = "i486" ]; then - SLKCFLAGS="-O2 -march=i486 -mtune=i686" +if [ "$ARCH" = "i586" ]; then + SLKCFLAGS="-O2 -march=i586 -mtune=i686" LIBDIRSUFFIX="" elif [ "$ARCH" = "s390" ]; then SLKCFLAGS="-O2" @@ -79,9 +80,12 @@ mkdir -p $TMP $PKG cd $TMP rm -rf ImageMagick-$BASEVER -tar xvf $CWD/ImageMagick-$FILEVER.tar.?z* || exit 1 +tar xvf $CWD/ImageMagick-$FILEVER.tar.xz || exit 1 cd ImageMagick-$BASEVER || exit 1 +# Harden the default settings in policy.xml to prevent security issues: +zcat $CWD/policy.xml.diff.gz | patch -p1 --verbose || exit 1 + chown -R root:root . find . \ \( -perm 777 -o -perm 775 -o -perm 711 -o -perm 555 -o -perm 511 \) \ @@ -109,6 +113,7 @@ CXXFLAGS="$SLKCFLAGS" \ --disable-openmp \ --enable-static=no \ --enable-shared \ + --with-gcc-arch=$ARCH \ --with-perl \ --with-rsvg \ --build=$ARCH-slackware-linux || exit 1 @@ -153,7 +158,27 @@ rmdir $PKG/usr/share/man find $PKG | xargs file | grep -e "executable" -e "shared object" | grep ELF \ | cut -f 1 -d : | xargs strip --strip-unneeded 2> /dev/null -gzip -9 $PKG/usr/man/man?/*.? +# Compress and link manpages, if any: +if [ -d $PKG/usr/man ]; then + ( cd $PKG/usr/man + for manpagedir in $(find . -type d -name "man*") ; do + ( cd $manpagedir + for eachpage in $( find . -type l -maxdepth 1 | grep -v '\.gz$') ; do + ln -s $( readlink $eachpage ).gz $eachpage.gz + rm $eachpage + done + gzip -9 *.? + ) + done + ) +fi + +# Move config files to .new: +( cd $PKG/etc/ImageMagick* + for file in * ; do + mv ${file} ${file}.new + done +) mkdir -p $PKG/usr mv $PKG/usr/share/doc $PKG/usr @@ -164,12 +189,13 @@ cp -a \ # If there's a ChangeLog, installing at least part of the recent history # is useful, but don't let it get totally out of control: if [ -r ChangeLog ]; then - DOCSDIR=$(echo $PKG/usr/doc/*-$VERSION) + DOCSDIR=$(echo $PKG/usr/doc/ImageMagick-*) cat ChangeLog | head -n 1000 > $DOCSDIR/ChangeLog touch -r ChangeLog $DOCSDIR/ChangeLog fi mkdir -p $PKG/install +zcat $CWD/doinst.sh.gz > $PKG/install/doinst.sh cat $CWD/slack-desc > $PKG/install/slack-desc cd $PKG diff --git a/source/xap/imagemagick/policy.xml.diff b/source/xap/imagemagick/policy.xml.diff new file mode 100644 index 000000000..dc033c1cb --- /dev/null +++ b/source/xap/imagemagick/policy.xml.diff @@ -0,0 +1,33 @@ +--- ./config/policy.xml.orig 2016-06-10 07:19:41.000000000 -0500 ++++ ./config/policy.xml 2016-06-17 17:30:47.311584022 -0500 +@@ -49,6 +49,21 @@ + exceeds policy maximum so memory limit is 1GB). + --> + <policymap> ++ <policy domain="cache" name="shared-secret" value="passphrase" stealth="true"/> ++ <!-- SECURITY: disable potentially insecure coders: --> ++ <policy domain="coder" rights="none" pattern="EPHEMERAL" /> ++ <policy domain="coder" rights="none" pattern="HTTPS" /> ++ <policy domain="coder" rights="none" pattern="MVG" /> ++ <policy domain="coder" rights="none" pattern="MSL" /> ++ <policy domain="coder" rights="none" pattern="TEXT" /> ++ <policy domain="coder" rights="none" pattern="SHOW" /> ++ <policy domain="coder" rights="none" pattern="WIN" /> ++ <policy domain="coder" rights="none" pattern="PLT" /> ++ <!-- SECURITY: prevent indirect reads: --> ++ <policy domain="path" rights="none" pattern="@*" /> ++ <!-- SECURITY: prevent pipe to shell: --> ++ <policy domain="path" rights="none" pattern="|*" /> ++ <!-- Some examples: --> + <!-- <policy domain="resource" name="temporary-path" value="/tmp"/> --> + <!-- <policy domain="resource" name="memory" value="2GiB"/> --> + <!-- <policy domain="resource" name="map" value="4GiB"/> --> +@@ -61,8 +76,4 @@ + <!-- <policy domain="resource" name="throttle" value="0"/> --> + <!-- <policy domain="resource" name="time" value="3600"/> --> + <!-- <policy domain="system" name="precision" value="6"/> --> +- <!-- <policy domain="coder" rights="none" pattern="MVG" /> --> +- <!-- <policy domain="delegate" rights="none" pattern="HTTPS" /> --> +- <!-- <policy domain="path" rights="none" pattern="@*"/> --> +- <policy domain="cache" name="shared-secret" value="passphrase" stealth="true"/> + </policymap> |