Update zmq to 4.3.4 #22961

gruve-p commented at 7:53 AM on September 13, 2021: contributor

Addresses https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13132 and https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15166

MarcoFalke added the label DrahtBot Guix build requested on Sep 13, 2021

in depends/packages/zeromq.mk:5 in be2f415b44 outdated

   0 | @@ -1,8 +1,8 @@
   1 |  package=zeromq
   2 | -$(package)_version=4.3.1
   3 | +$(package)_version=4.3.4
   4 |  $(package)_download_path=https://github.com/zeromq/libzmq/releases/download/v$($(package)_version)/
   5 |  $(package)_file_name=$(package)-$($(package)_version).tar.gz
   6 | -$(package)_sha256_hash=bcbabe1e2c7d0eec4ed612e10b94b112dd5f06fcefa994a0c79a45d835cd21eb
   7 | +$(package)_sha256_hash=c593001a89f5a85dd2ddf564805deb860e02471171b3f204944857336295c3e5

fanquake commented at 8:06 AM on September 13, 2021:

The trailing whitespace here will not only trip up the CI linter, but the package will fail to download at all. How was this tested?

gruve-p commented at 8:11 AM on September 13, 2021:

This was tested locally on another machine, will remove the trailing whitespace

fanquake commented at 8:07 AM on September 13, 2021: member

Do these effect us? We been building with CURVE authentication disabled since we updated ZeroMQ in depends to 4.1.5.

MarcoFalke commented at 8:32 AM on September 13, 2021: member

Please squash your commits according to https://github.com/bitcoin/bitcoin/blob/master/CONTRIBUTING.md#squashing-commits

Update zmq to 4.3.4 7552bae445

gruve-p force-pushed on Sep 13, 2021

hebasto commented at 11:17 AM on September 13, 2021: member

Do these effect us? We been building with CURVE authentication disabled since we updated ZeroMQ in depends to 4.1.5.

From the CVE descriptions I see no point in the libzmq update.

MarcoFalke commented at 11:24 AM on September 13, 2021: member

Are there other fixes that make the update worthwhile?

gruve-p commented at 5:52 PM on September 13, 2021: contributor

Feel free to close this PR if you see no point in the update

DrahtBot commented at 8:34 PM on September 13, 2021: member

The following sections might be updated with supplementary metadata relevant to reviewers and maintainers.

Conflicts

Reviewers, this pull request conflicts with the following ones:

#22555 (build: Fix make apk for Android w/ non-default SOURCES_PATH in depends by hebasto)
#22552 (build: Improve depends build system robustness by hebasto)

If you consider this pull request important, please also help to review the conflicting pull requests. Ideally, start with the one that should be merged first.

DrahtBot commented at 10:59 AM on September 14, 2021: member

Guix builds

File	commit 5895a502cbe42099e8b250575a593a0570aaa80e<br>(master)	commit 28e68e614a637e228d73493a7448795e7f6a88ef<br>(master and this pull)
SHA256SUMS.part	`b4723d95eba2720a...`	`7a2368a87d86406b...`
*-aarch64-linux-gnu-debug.tar.gz	`6ca55ae29ebc2260...`	`4232915f2dff16a6...`
*-aarch64-linux-gnu.tar.gz	`608798b715ac7955...`	`1b9ff3d7d0d74fe1...`
*-arm-linux-gnueabihf-debug.tar.gz	`9b9504fe37331146...`	`c150d1807a03ed3b...`
*-arm-linux-gnueabihf.tar.gz	`ae7f9c6c4e185f40...`	`9d3a19b98c8351d7...`
*-osx-unsigned.dmg	`b224275944eea053...`	`0b4d99ec4fd18ac8...`
*-osx-unsigned.tar.gz	`f131035d39edac2c...`	`ed6c07057fbccee4...`
*-osx64.tar.gz	`031c32a9116edb28...`	`5457b0268e38d239...`
*-powerpc64-linux-gnu-debug.tar.gz	`1cccbfae747d401b...`	`2a5b12a577902eae...`
*-powerpc64-linux-gnu.tar.gz	`2b5d2062427367f7...`	`935b3ca9cc5fe790...`
*-powerpc64le-linux-gnu-debug.tar.gz	`b2105f9c92f7c5e2...`	`9a0aff8d9acaf700...`
*-powerpc64le-linux-gnu.tar.gz	`2d5d380ba0f80b49...`	`a478c679ae095156...`
*-riscv64-linux-gnu-debug.tar.gz	`42dc5c51e70e9110...`	`bbaeefac4dadc54a...`
*-riscv64-linux-gnu.tar.gz	`d8a033748108dc4f...`	`adeeb311a5491686...`
*-win-unsigned.tar.gz	`28f7ab63544fbd62...`	`164aecf5ee73ab79...`
*-win64-debug.zip	`e3a1ab7788f3f8e2...`	`5f43d98111e29085...`
*-win64-setup-unsigned.exe	`6f69cc00f61ed708...`	`f6ab6118a709f71c...`
*-win64.zip	`380c47767bd441ea...`	`0a7639eec4fce5a4...`
*-x86_64-linux-gnu-debug.tar.gz	`b9d4aa26bd268aba...`	`d06d2bd75c2bcd11...`
*-x86_64-linux-gnu.tar.gz	`90e2eb8527d93ad0...`	`4da60d9eff1409bf...`
*.tar.gz	`c428aec95ee7f0d7...`	`15fd8cc4cae002d8...`
guix_build.log	`b69c500133a946e0...`	`1c14fa7c99f4d4fc...`
guix_build.log.diff		`1415932e8739f567...`

DrahtBot removed the label DrahtBot Guix build requested on Sep 14, 2021

DrahtBot added the label Build system on Sep 14, 2021

laanwj commented at 1:54 PM on September 16, 2021: member

I don't think it makes sense to track minor relases of a library here, if the changes don't affect our usage.

gruve-p closed this on Sep 20, 2021

gruve-p deleted the branch on Nov 30, 2021

DrahtBot locked this on Nov 30, 2022