diff --git a/appendices/dependencies.xml b/appendices/dependencies.xml index 1d4a0abac..54b3d65e0 100644 --- a/appendices/dependencies.xml +++ b/appendices/dependencies.xml @@ -970,8 +970,8 @@ &dependencies; Bash, Binutils, Coreutils, Diffutils, Findutils, Gawk, GCC, - Gettext, Glibc, GMP, Grep, M4, Make, MPC, MPFR, Patch, Perl, Sed, - Tar, Texinfo, and Zstd + Gettext, Glibc, GMP, Grep, Libxcrypt, M4, Make, MPC, MPFR, Patch, + Perl, Sed, Tar, Texinfo, and Zstd @@ -1885,6 +1885,47 @@ + + Libxcrypt + + + &dependencies; + + Bash, Binutils, Coreutils, Diffutils, Gawk, GCC, Glibc, Grep, + Make, and Sed + + + + + &runtime; + + Glibc + + + + + &testsuites; + + None + + + + + &before; + + GCC, Perl, Python, + and Shadow, and Systemd + + + + + &external; + + None + + + Linux @@ -2455,14 +2496,14 @@ &dependencies; Bash, Binutils, Coreutils, Gawk, GCC, GDBM, Glibc, Grep, Groff, - Make, Sed, and Zlib + Libxcrypt, Make, Sed, and Zlib &runtime; - GDBM and Glibc + GDBM, Glibc, and Libxcrypt @@ -2621,7 +2662,7 @@ &dependencies; Bash, Binutils, Coreutils, Expat, GCC, Gdbm, Gettext, Glibc, - Grep, Libffi, Make, Ncurses, OpenSSL, Pkgconf, Sed, and + Grep, Libffi, Libxcrypt, Make, Ncurses, OpenSSL, Pkgconf, Sed, and Util-linux @@ -2629,8 +2670,8 @@ &runtime; - Bzip2, Expat, Gdbm, Glibc, Libffi, Ncurses, OpenSSL, and - Zlib + Bzip2, Expat, Gdbm, Glibc, Libffi, Libxcrypt, Ncurses, + OpenSSL, and Zlib @@ -2745,14 +2786,14 @@ &dependencies; Acl, Attr, Bash, Binutils, Coreutils, Diffutils, Findutils, Gawk, - GCC, Gettext, Glibc, Grep, Libcap, Make, and Sed + GCC, Gettext, Glibc, Grep, Libcap, Libxcrypt, Make, and Sed &runtime; - Glibc + Glibc and Libxcrypt @@ -2826,15 +2867,15 @@ &dependencies; Acl, Attr, Bash, Binutils, Coreutils, Diffutils, Expat, Gawk, - GCC, Glibc, Gperf, Grep, Jinja2, Libcap, Meson, Pkgconf, Sed, - Util-linux, and Zstd + GCC, Glibc, Gperf, Grep, Jinja2, Libcap, Libxcrypt, Meson, + Pkgconf, Sed, Util-linux, and Zstd &runtime; - Acl, Attr, Glibc, Libcap, and Util-linux + Acl, Attr, Glibc, Libcap, Libxcrypt, and Util-linux diff --git a/chapter01/changelog.xml b/chapter01/changelog.xml index a19eabb35..f2533e88f 100644 --- a/chapter01/changelog.xml +++ b/chapter01/changelog.xml @@ -40,6 +40,24 @@ appropriate for the entry or if needed the entire day's listitem. --> + + 2023-07-02 + + + [xry111] - Add libxcrypt-4.4.35. Fixes + #5280. + + + [xry111] - Update to iproute2-6.4.0. Fixes + #5277. + + + [xry111] - Update to linux-6.4.1. Fixes + #5276. + + + + 2023-07-01 diff --git a/chapter01/whatsnew.xml b/chapter01/whatsnew.xml index 302f2d43f..68ec876ab 100644 --- a/chapter01/whatsnew.xml +++ b/chapter01/whatsnew.xml @@ -304,6 +304,10 @@ Added: + + Libxcrypt-&libxcrypt-version; + + Pkgconf-&flit-core-version; diff --git a/chapter03/packages.xml b/chapter03/packages.xml index 7740f25ce..478e9e11e 100644 --- a/chapter03/packages.xml +++ b/chapter03/packages.xml @@ -477,6 +477,15 @@ + + Libxcrypt (&libxcrypt-version;) - &libxcrypt-size;: + + Home page: + Download: + MD5 sum: &libxcrypt-md5; + + + Linux (&linux-version;) - &linux-size;: diff --git a/chapter05/glibc.xml b/chapter05/glibc.xml index 0339a7b22..9b67096c9 100644 --- a/chapter05/glibc.xml +++ b/chapter05/glibc.xml @@ -94,6 +94,7 @@ cd build --build=$(../scripts/config.guess) \ --enable-kernel=&min-kernel; \ --with-headers=$LFS/usr/include \ + --disable-crypt \ libc_cv_slibdir=/usr/lib ../configure \ --prefix=/usr \ diff --git a/chapter06/gcc-pass2.xml b/chapter06/gcc-pass2.xml index ba1a4b7a2..10a698ccd 100644 --- a/chapter06/gcc-pass2.xml +++ b/chapter06/gcc-pass2.xml @@ -104,6 +104,7 @@ cd build --disable-libatomic \ --disable-libgomp \ --disable-libquadmath \ + --disable-libsanitizer \ --disable-libssp \ --disable-libvtv \ --enable-languages=c,c++ @@ -176,6 +177,19 @@ cd build + + --disable-libsanitizer + + Disable GCC sanitizer runtime libraries. They are not + needed for the temporary installation. This switch is necessary + to build GCC without + libcrypt installed for + the target. In it was + implied by --disable-libstdcxx, but now we + have to explicitly pass it. + + + Compile the package: diff --git a/chapter08/chapter08.xml b/chapter08/chapter08.xml index a8652a30b..6b037e1cc 100644 --- a/chapter08/chapter08.xml +++ b/chapter08/chapter08.xml @@ -37,6 +37,7 @@ + diff --git a/chapter08/glibc.xml b/chapter08/glibc.xml index 4f16d5e21..cbb4b5816 100644 --- a/chapter08/glibc.xml +++ b/chapter08/glibc.xml @@ -79,6 +79,7 @@ cd build --enable-kernel=&min-kernel; \ --enable-stack-protector=strong \ --with-headers=/usr/include \ + --disable-crypt \ libc_cv_slibdir=/usr/lib ../configure --prefix=/usr \ --disable-werror \ @@ -646,7 +647,7 @@ readelf -l a.out | grep '/ld-linux-x32' ld-linux-x86-64.so.2, ld-linux.so.2, libBrokenLocale.{a,so}, libanl.{a,so}, libc.{a,so}, libc_nonshared.a, libc_malloc_debug.so, - libcrypt.{a,so}, libdl.{a,so.2}, libg.a, libm.{a,so}, + libdl.{a,so.2}, libg.a, libm.{a,so}, libmcheck.a, libmemusage.so, libmvec.{a,so}, libnsl.so.1, libnss_compat.so, libnss_dns.so, libnss_files.so, libnss_hesiod.so, libpcprofile.so, libpthread.{a,so.0}, @@ -952,16 +953,6 @@ readelf -l a.out | grep '/ld-linux-x32' - - libcrypt - - The cryptography library - - libcrypt - - - - libdl diff --git a/chapter08/libxcrypt.xml b/chapter08/libxcrypt.xml new file mode 100644 index 000000000..3fb59941d --- /dev/null +++ b/chapter08/libxcrypt.xml @@ -0,0 +1,148 @@ + + + %general-entities; +]> + + + + + + libxcrypt + &libxcrypt-version; +
&libxcrypt-url;
+ + + Libxcrypt-&libxcrypt-version; + + + Libxcrypt + + + + + + <para>The Libxcrypt package contains a modern library for one-way + hashing of passwords.</para> + + <segmentedlist> + <segtitle>&buildtime;</segtitle> + <segtitle>&diskspace;</segtitle> + + <seglistitem> + <seg>&libxcrypt-fin-sbu;</seg> + <seg>&libxcrypt-fin-du;</seg> + </seglistitem> + </segmentedlist> + + </sect2> + + <sect2 role="installation"> + <title>Installation of Libxcrypt + + Prepare Libxcrypt for compilation: + +./configure --prefix=/usr \ + --enable-hashes=strong,glibc \ + --enable-obsolete-api=no \ + --disable-static \ + --disable-failure-tokens + + + The meaning of the new configure options: + + + --enable-hashes=strong,glibc + + Build strong hash algorithms recommended for security use + cases, and the hash algorithms provided by traditional Glibc + libcrypt for + compatibility. + + + + + --enable-obsolete-api=no + + Disable obsolete API functions. They are not needed for + a modern Linux system built from source. + + + + + --disable-failure-tokens + + Disable failure token feature. It's needed for + compatibility with the traditional hash libraries of some + platforms, but a Linux system based on Glibc does not need + it. + + + + + Compile the package: + +make + + To test the results, issue: + +make check + + Install the package: + +make install + + + + The instructions above disabled obsolete API functions since + no package installed by compiling from sources would link against + them at runtime. However, the only known binary-only applications + that link against these functions require ABI version 1. If you must + have such functions because of some binary-only application or to be + to be compliant with LSB, build the package again with the following + commands: + +make distclean +./configure --prefix=/usr \ + --enable-hashes=strong,glibc \ + --enable-obsolete-api=glibc \ + --disable-static \ + --disable-failure-tokens +make +cp -av .libs/libcrypt.so.1* /usr/lib + + + + + + Contents of Libxcrypt + + + Installed libraries + + + libcrypt.so + + + + + Short Descriptions + + + + + libcrypt + + Contains functions to hash passwords + + libcrypt + + + + + + + + + diff --git a/chapter08/shadow.xml b/chapter08/shadow.xml index 93d1f3f7e..0f34d70ac 100644 --- a/chapter08/shadow.xml +++ b/chapter08/shadow.xml @@ -60,11 +60,10 @@ find man -name Makefile.in -exec sed -i 's/getspnam\.3 / /' {} \; find man -name Makefile.in -exec sed -i 's/passwd\.5 / /' {} \; Instead of using the default - crypt method, use the more secure - SHA-512 method of password encryption, which also - allows passwords longer than 8 characters. In addition, set the number of - rounds to 500,000 instead of the default 5000, which is much too low to - prevent brute force password attacks. It is also necessary to change + crypt method, use the much more secure + YESCRYPT method of password encryption, which also + allows passwords longer than 8 characters. + It is also necessary to change the obsolete /var/spool/mail location for user mailboxes that Shadow uses by default to the /var/mail location used currently. And, @@ -81,10 +80,9 @@ find man -name Makefile.in -exec sed -i 's/passwd\.5 / /' {} \; -sed -e 's:#ENCRYPT_METHOD DES:ENCRYPT_METHOD SHA512:' \ - -e 's@#\(SHA_CRYPT_..._ROUNDS 5000\)@\100@' \ - -e 's:/var/spool/mail:/var/mail:' \ - -e '/PATH=/{s@/sbin:@@;s@/bin:@@}' \ +sed -e 's:#ENCRYPT_METHOD DES:ENCRYPT_METHOD YESCRYPT:' \ + -e 's:/var/spool/mail:/var/mail:' \ + -e '/PATH=/{s@/sbin:@@;s@/bin:@@}' \ -i etc/login.defs @@ -106,8 +104,9 @@ find man -name Makefile.in -exec sed -i 's/passwd\.5 / /' {} \;Prepare Shadow for compilation: touch /usr/bin/passwd -./configure --sysconfdir=/etc \ - --disable-static \ +./configure --sysconfdir=/etc \ + --disable-static \ + --with-{b,yes}crypt \ --with-group-name-max-length=32 @@ -122,6 +121,21 @@ find man -name Makefile.in -exec sed -i 's/passwd\.5 / /' {} \; + + + --with-{b,yes}crypt + + The shell expands this to two switches, + --with-bcrypt and + --with-yescrypt. They allow shadow to use + the Bcrypt and Yescrypt algorithms implemented by + Libxcrypt for hashing passwords. + These algorithms are more secure (in particular, much more + resistant to GPU-based attacks) than the traditional SHA + algorithms. + + + --with-group-name-max-length=32 diff --git a/gen-changelog.py b/gen-changelog.py index 2932dd9ec..e7ee1d7e7 100755 --- a/gen-changelog.py +++ b/gen-changelog.py @@ -83,9 +83,9 @@ for (s, act) in [(upd, "Update to "), (add, "Add ")]: out = act + pkgver if pkgver in ticket: out += ' (#' + ticket[pkgver] + ')' - print(out) + print("-", out) for i in rem: - print("Remove", i) + print("-", "Remove", i) print("---------------------") diff --git a/lfs-latest-git.php b/lfs-latest-git.php index 06887b0bd..140ac6492 100644 --- a/lfs-latest-git.php +++ b/lfs-latest-git.php @@ -12,12 +12,10 @@ $exceptions = array(); $regex = array(); //$regex[ 'bzip2' ] = "/^.*current version is ([\d\.]+).*$/"; -$regex[ 'check' ] = "/^.*Check (\d[\d\.]+\d).*$/"; $regex[ 'intltool' ] = "/^.*Latest version is (\d[\d\.]+\d).*$/"; $regex[ 'less' ] = "/^.*current released version is less-(\d+).*$/"; $regex[ 'mpfr' ] = "/^mpfr-([\d\.]+)\.tar.*$/"; $regex[ 'Python' ] = "/^.*Latest Python 3.*Python (3[\d\.]+\d).*$/"; -$regex[ 'systemd' ] = "/^.*systemd v([\d]+)$/"; //$regex[ 'sysvinit' ] = "/^.*sysvinit-([\d\.]+)dsf\.tar.*$/"; $regex[ 'tzdata' ] = "/^.*tzdata([\d]+[a-z]).*$/"; $regex[ 'xz' ] = "/^.*xz-([\d\.]*\d).*$/"; @@ -69,17 +67,7 @@ function find_even_max( $lines, $regex_match, $regex_replace ) function http_get_file( $url ) { - if ( ! preg_match( "/sourceforge/", $url ) && - ! preg_match( "/mpfr/", $url ) && - ! preg_match( "/psmisc/", $url ) ) - { - exec( "curl --location --silent --max-time 30 $url", $dir ); - - $s = implode( "\n", $dir ); - $dir = strip_tags( $s ); - return explode( "\n", $dir ); - } - else if ( preg_match( "/mpfr/", $url ) ) + if ( preg_match( "/mpfr/", $url ) ) { # There seems to be a problem with the mpfs certificate exec( "curl --location --silent --insecure --max-time 30 $url", $dir ); @@ -87,11 +75,19 @@ function http_get_file( $url ) $dir = strip_tags( $s ); return explode( "\n", $dir ); } - else + + if ( preg_match( "/sourceforge/", $url ) || + preg_match( "/psmisc/", $url ) ) { exec( "lynx -dump $url 2>/dev/null", $lines ); return $lines; } + + exec( "curl --location --silent --max-time 30 $url", $dir ); + + $s = implode( "\n", $dir ); + $dir = strip_tags( $s ); + return explode( "\n", $dir ); } function max_parent( $dirpath, $prefix ) @@ -110,6 +106,11 @@ function max_parent( $dirpath, $prefix ) return "$dirpath/$max"; } +function github( $path ) +{ + return "https://api.github.com/repos/$path/releases/latest"; +} + function get_packages( $package, $dirpath ) { global $exceptions; @@ -117,39 +118,40 @@ function get_packages( $package, $dirpath ) //if ( $package != "psmisc" ) return 0; // debug -if ( $package == "bc" ) $dirpath = "https://github.com/gavinhoward/bc/releases"; -if ( $package == "check" ) $dirpath = "https://github.com/libcheck/check/releases"; +if ( $package == "bc" ) $dirpath = github("gavinhoward/bc"); +if ( $package == "check" ) $dirpath = github("libcheck/check"); if ( $package == "e2fsprogs" ) $dirpath = "https://sourceforge.net/projects/e2fsprogs/files/e2fsprogs"; if ( $package == "expat" ) $dirpath = "https://sourceforge.net/projects/expat/files"; if ( $package == "elfutils" ) $dirpath = "https://sourceware.org/ftp/elfutils"; if ( $package == "expect" ) $dirpath = "https://sourceforge.net/projects/expect/files"; -if ( $package == "eudev" ) $dirpath = "https://github.com/eudev-project/eudev/releases"; +if ( $package == "eudev" ) $dirpath = github("eudev-project/eudev"); if ( $package == "file" ) $dirpath = "https://github.com/file/file/tags"; -if ( $package == "flex" ) $dirpath = "https://github.com/westes/flex/releases"; +if ( $package == "flex" ) $dirpath = github("westes/flex"); if ( $package == "flit_core" ) $dirpath = "https://pypi.org/project/flit-core/"; if ( $package == "gcc" ) $dirpath = max_parent( $dirpath, "gcc-" ); -if ( $package == "iana-etc" ) $dirpath = "https://github.com/Mic92/iana-etc/releases"; +if ( $package == "iana-etc" ) $dirpath = github("Mic92/iana-etc"); if ( $package == "intltool" ) $dirpath = "https://launchpad.net/intltool/trunk"; -if ( $package == "libffi" ) $dirpath = "https://github.com/libffi/libffi/releases"; -if ( $package == "meson" ) $dirpath = "https://github.com/mesonbuild/meson/releases"; +if ( $package == "libffi" ) $dirpath = github("libffi/libffi"); +if ( $package == "libxcrypt" ) $dirpath = github("besser82/libxcrypt"); +if ( $package == "meson" ) $dirpath = github("mesonbuild/meson"); if ( $package == "mpc" ) $dirpath = "https://ftp.gnu.org/gnu/mpc"; if ( $package == "mpfr" ) $dirpath = "https://mpfr.loria.fr/mpfr-current"; if ( $package == "ncurses" ) $dirpath = "https://invisible-mirror.net/archives/ncurses"; -if ( $package == "ninja" ) $dirpath = "https://github.com/ninja-build/ninja/releases"; +if ( $package == "ninja" ) $dirpath = github("ninja-build/ninja"); if ( $package == "procps-ng" ) $dirpath = "https://gitlab.com/procps-ng/procps/-/tags"; if ( $package == "psmisc" ) $dirpath = "https://gitlab.com/psmisc/psmisc/-/tags"; if ( $package == "Python" ) $dirpath = "https://www.python.org/downloads/source/"; -if ( $package == "shadow" ) $dirpath = "https://github.com/shadow-maint/shadow/releases"; -if ( $package == "sysvinit" ) $dirpath = "https://github.com/slicer69/sysvinit/releases"; +if ( $package == "shadow" ) $dirpath = github("shadow-maint/shadow"); +if ( $package == "sysvinit" ) $dirpath = github("slicer69/sysvinit"); if ( $package == "MarkupSafe" ) $dirpath = "https://pypi.python.org/pypi/MarkupSafe/"; if ( $package == "Jinja" ) $dirpath = "https://pypi.python.org/pypi/Jinja2/"; -if ( $package == "systemd" ) $dirpath = "https://github.com/systemd/systemd/releases"; +if ( $package == "systemd" ) $dirpath = github("systemd/systemd"); //if ( $package == "tcl" ) $dirpath = "https://sourceforge.net/projects/tcl/files"; if ( $package == "tcl" ) $dirpath = "https://www.tcl.tk/software/tcltk/download.html"; if ( $package == "util-linux" ) $dirpath = max_parent( $dirpath, "v." ); if ( $package == "vim" ) $dirpath = "https://github.com/vim/vim/tags"; if ( $package == "wheel" ) $dirpath = "https://pypi.org/project/wheel/#files"; -if ( $package == "zstd" ) $dirpath = "https://github.com/facebook/zstd/releases"; +if ( $package == "zstd" ) $dirpath = github("facebook/zstd"); // Check for ftp if ( preg_match( "/^ftp/", $dirpath ) ) @@ -259,27 +261,12 @@ if ( $package == "zstd" ) $dirpath = "https://github.com/facebook/zstd/rel if ( $package == "e2fsprogs" ) return find_max( $lines, "/v\d/", "/^.*v(\d[\d\.]+\d).*$/" ); - if ( $package == "eudev" ) - return find_max( $lines, "/Release/", "/^.*Release (\d[\d\.]+\d).*$/" ); - if ( $package == "expect" ) return find_max( $lines, "/expect/", "/^.*expect(\d[\d\.]+\d).tar.*$/" ); if ( $package == "elfutils" ) return find_max( $lines, "/^\d/", "/^(\d[\d\.]+\d)\/.*$/" ); - if ( $package == "iana-etc" ) - return find_max( $lines, "/^\s*20\d\d/", "/^\s+(\d+).*$/" ); - - if ( $package == "meson" ) - return find_max( $lines, "/^\s+\d\./", "/^\s+([\d\.]+)$/" ); - - if ( $package == "shadow" ) - return find_max( $lines, "/^\s+\d\./", "/^\s+([\d\.]+)$/" ); - - if ( $package == "sysvinit" ) - return find_max( $lines, "/^\s+\d\./", "/^\s+([\d\.]+)$/" ); - if ( $package == "XML-Parser" ) { $max = find_max( $lines, "/$package/", "/^.*$package-([\d\._]*\d).tar.*$/" ); @@ -291,9 +278,6 @@ if ( $package == "zstd" ) $dirpath = "https://github.com/facebook/zstd/rel if ( $package == "tcl" ) return find_max( $lines, "/tcl\d/", "/^.*tcl(\d\.[\d\.]*\d)-src.*$/" ); - if ( $package == "ninja" ) - return find_max( $lines, "/^ *v\d/", "/^.*v(\d[\d\.]*\d).*$/" ); - if ( $package == "gmp" ) return find_max( $lines, "/$package/", "/^.*$package-([\d\._]*\d[a-z]?).tar.*$/" ); @@ -306,9 +290,6 @@ if ( $package == "zstd" ) $dirpath = "https://github.com/facebook/zstd/rel return str_replace( "_", ".", $max ); } - if ( $package == "libffi" ) - return find_max( $lines, "/v\d/", "/^.*v([\d\.]+)$/" ); - if ( $package == "flit_core" ) return find_max( $lines, "/flit-core /", "/^.*flit-core ([\d\.]+)$/" ); @@ -330,8 +311,8 @@ if ( $package == "zstd" ) $dirpath = "https://github.com/facebook/zstd/rel if ( $package == "vim" ) return find_max( $lines, "/v\d\./", "/^.*v([\d\.]+).*$/" ); - if ( $package == "zstd" ) - return find_max( $lines, "/Zstandard v/", "/^.*v([\d\.]+).*$/" ); + if ( preg_match( "/api.github.com/", $dirpath) ) + return ltrim(json_decode(join("", $lines))->tag_name, "v"); // Most packages are in the form $package-n.n.n // Occasionally there are dashes (e.g. 201-1) @@ -346,13 +327,15 @@ function get_current() // Fetech from git and get wget-list $current = array(); #$lfssvn = "svn://svn.linuxfromscratch.org/LFS/trunk"; - $lfsgit = "git://git.linuxfromscratch.org/lfs.git"; + $lfsgit = "https://git.linuxfromscratch.org/lfs.git"; $tmpdir = exec( "mktemp -d /tmp/lfscheck.XXXXXX" ); $cdir = getcwd(); chdir( $tmpdir ); - #exec ( "svn --quiet export $lfssvn LFS" ); - exec ( "git clone $lfsgit LFS" ); + + # git-version.sh needs the history since the rx.y tag. + exec ( "git clone $lfsgit LFS --depth 1 --branch r11.2" ); + exec ( "git -C LFS pull origin trunk" ); # Make version.ent chdir( "$tmpdir/LFS" ); diff --git a/packages.ent b/packages.ent index afc5b2134..61f4826ce 100644 --- a/packages.ent +++ b/packages.ent @@ -350,10 +350,10 @@ - - + + - + @@ -439,14 +439,22 @@ + + + + + + + + - - + + - + - +