Rebased to version 1.2.18.4

CVE-2016-5008: Setting empty VNC password allows access to unauthorized users (bz #1351516)

0001-tests-extend-workaround-for-gnutls-private-key-loadi.patch

@@ -1,36 +0,0 @@
-From 3433180ec89195aef3c434d8c8d44d55b0bd6466 Mon Sep 17 00:00:00 2001
-From: "Daniel P. Berrange" <berrange@redhat.com>
-Date: Tue, 4 Aug 2015 12:26:15 +0100
-Subject: [PATCH] tests: extend workaround for gnutls private key loading
- failure
-
-In gnutls 3.4.3 there is a regression in the loading of private
-keys via gnutls_x509_privkey_import. We already have a workaround
-to deal with failures on older gnutls, but the error code that
-the new gnutls returns is different. Extend the workaround so that
-is checks for GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE too.
-
-See also gnutls https://bugzilla.redhat.com/show_bug.cgi?id=1250020
-
-Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
----
- tests/virnettlshelpers.c | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/tests/virnettlshelpers.c b/tests/virnettlshelpers.c
-index 6e667d1..531d0b9 100644
---- a/tests/virnettlshelpers.c
-+++ b/tests/virnettlshelpers.c
-@@ -84,7 +84,8 @@ static gnutls_x509_privkey_t testTLSLoadKey(void)
- 
-     if ((err = gnutls_x509_privkey_import(key, &data,
-                                           GNUTLS_X509_FMT_PEM)) < 0) {
--        if (err != GNUTLS_E_BASE64_UNEXPECTED_HEADER_ERROR) {
-+        if (err != GNUTLS_E_BASE64_UNEXPECTED_HEADER_ERROR &&
-+            err != GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE) {
-             VIR_WARN("Failed to import key %s", gnutls_strerror(err));
-             abort();
-         }
--- 
-2.4.3
-

libvirt.spec

@@ -2,7 +2,7 @@
 
 # This spec file assumes you are building for Fedora 13 or newer,
 # or for RHEL 5 or newer. It may need some tweaks for other distros.
-# If neither fedora nor rhel was defined, try to guess them from %{dist}
+# If neither fedora nor rhel was defined, try to guess them from dist
 %if !0%{?rhel} && !0%{?fedora}
 %{expand:%(echo "%{?dist}" | \
   sed -ne 's/^\.el\([0-9]\+\).*/%%define rhel \1/p')}
@@ -13,13 +13,13 @@
 # Default to skipping autoreconf.  Distros can change just this one line
 # (or provide a command-line override) if they backport any patches that
 # touch configure.ac or Makefile.am.
-%{!?enable_autotools:%define enable_autotools 0}
+%{!?enable_autotools:%global enable_autotools 0}
 
 # A client only build will create a libvirt.so only containing
 # the generic RPC driver, and test driver and no libvirtd
 # Default to a full server + client build, but with the possibility
 # of a command-line or ~/.rpmmacros override for client-only.
-%{!?client_only:%define client_only 0}
+%{!?client_only:%global client_only 0}
 
 # Now turn off server build in certain cases
 
@@ -344,12 +344,6 @@
 %endif
 
 
-# Advertise OVMF and AAVMF from nightly firmware repo
-%if 0%{?fedora}
-    %define with_loader_nvram --with-loader-nvram="/usr/share/edk2.git/ovmf-x64/OVMF_CODE-pure-efi.fd:/usr/share/edk2.git/ovmf-x64/OVMF_VARS-pure-efi.fd:/usr/share/edk2.git/aarch64/QEMU_EFI-pflash.raw:/usr/share/edk2.git/aarch64/vars-template-pflash.raw"
-%endif
-
-
 # The RHEL-5 Xen package has some feature backports. This
 # flag is set to enable use of those special bits on RHEL-5
 %if 0%{?rhel} == 5
@@ -377,7 +371,7 @@
 
 Summary: Library providing a simple virtualization API
 Name: libvirt
-Version: 1.2.18
+Version: 1.2.18.4
 Release: 1%{?dist}%{?extra_release}
 License: LGPLv2+
 Group: Development/Libraries
@@ -388,7 +382,6 @@ URL: http://libvirt.org/
     %define mainturl stable_updates/
 %endif
 Source: http://libvirt.org/sources/%{?mainturl}libvirt-%{version}.tar.gz
-Patch1: 0001-tests-extend-workaround-for-gnutls-private-key-loadi.patch
 
 %if %{with_libvirtd}
 Requires: libvirt-daemon = %{version}-%{release}
@@ -1194,7 +1187,6 @@ namespaces.
 Summary: Libraries, includes, etc. to compile with the libvirt library
 Group: Development/Libraries
 Requires: %{name}-client = %{version}-%{release}
-Requires: %{name}-docs = %{version}-%{release}
 Requires: pkgconfig
 
 %description devel
@@ -1257,6 +1249,7 @@ if [ $COUNT -gt 0 ]; then
 fi
 echo "Applied $COUNT patches"
 rm -f $PATCHLIST
+rm -rf .git
 
 %build
 %if ! %{with_xen}
@@ -1471,6 +1464,18 @@ rm -f $PATCHLIST
     %endif
 %endif
 
+%if 0%{?fedora}
+    # Nightly firmware repo x86/OVMF
+    LOADERS="/usr/share/edk2.git/ovmf-x64/OVMF_CODE-pure-efi.fd:/usr/share/edk2.git/ovmf-x64/OVMF_VARS-pure-efi.fd"
+    # Nightly firmware repo aarch64/AAVMF
+    LOADERS="$LOADERS:/usr/share/edk2.git/aarch64/QEMU_EFI-pflash.raw:/usr/share/edk2.git/aarch64/vars-template-pflash.raw"
+    # Fedora official x86/OVMF
+    LOADERS="$LOADERS:/usr/share/edk2/ovmf/OVMF_CODE.fd:/usr/share/edk2/ovmf/OVMF_VARS.fd"
+    # Fedora official aarch64/AAVMF
+    LOADERS="$LOADERS:/usr/share/edk2/aarch64/QEMU_EFI-pflash.raw:/usr/share/edk2/aarch64/vars-template-pflash.raw"
+    %define with_loader_nvram --with-loader-nvram="$LOADERS"
+%endif
+
 # place macros above and build commands below this comment
 
 %if 0%{?enable_autotools}
@@ -1800,6 +1805,14 @@ if test $1 -eq 1 && test ! -f %{_sysconfdir}/libvirt/qemu/networks/default.xml ;
          < %{_datadir}/libvirt/networks/default.xml \
          > %{_sysconfdir}/libvirt/qemu/networks/default.xml
     ln -s ../default.xml %{_sysconfdir}/libvirt/qemu/networks/autostart/default.xml
+
+    # Make sure libvirt picks up the new network defininiton
+        %if %{with_systemd}
+    /bin/systemctl try-restart libvirtd.service >/dev/null 2>&1 ||:
+        %else
+    /sbin/service libvirtd condrestart > /dev/null 2>&1 || :
+        %endif
+
 fi
     %endif
 
@@ -1897,7 +1910,8 @@ exit 0
 
 %files docs
 %defattr(-, root, root)
-%doc AUTHORS ChangeLog.gz NEWS README TODO libvirt-docs/*
+%doc AUTHORS ChangeLog.gz NEWS README TODO
+%doc libvirt-docs/*
 
 # API docs
 %dir %{_datadir}/gtk-doc/html/libvirt/
@@ -1905,6 +1919,15 @@ exit 0
 %doc %{_datadir}/gtk-doc/html/libvirt/*.html
 %doc %{_datadir}/gtk-doc/html/libvirt/*.png
 %doc %{_datadir}/gtk-doc/html/libvirt/*.css
+%doc examples/hellolibvirt
+%doc examples/object-events
+%doc examples/dominfo
+%doc examples/domsuspend
+%doc examples/dommigrate
+%doc examples/openauth
+%doc examples/xml
+%doc examples/systemtap
+
 
 %if %{with_libvirtd}
 %files daemon
@@ -2317,20 +2340,58 @@ exit 0
 %{_datadir}/libvirt/api/libvirt-api.xml
 %{_datadir}/libvirt/api/libvirt-qemu-api.xml
 %{_datadir}/libvirt/api/libvirt-lxc-api.xml
-
-
-%doc docs/*.html docs/html docs/*.gif
+# Needed building python bindings
 %doc docs/libvirt-api.xml
-%doc examples/hellolibvirt
-%doc examples/object-events
-%doc examples/dominfo
-%doc examples/domsuspend
-%doc examples/dommigrate
-%doc examples/openauth
-%doc examples/xml
-%doc examples/systemtap
+
 
 %changelog
+* Mon Jul 18 2016 Cole Robinson <crobinso@redhat.com> - 1.2.18.4-1
+- Rebased to version 1.2.18.4
+- CVE-2016-5008: Setting empty VNC password allows access to unauthorized
+  users (bz #1351516)
+
+* Thu Jun 23 2016 Cole Robinson <crobinso@redhat.com> - 1.2.18.3-2
+- Advertise fedora edk2 firmware builds to apps (bz #1335395)
+
+* Wed May 04 2016 Cole Robinson <crobinso@redhat.com> - 1.2.18.3-1
+- Rebased to version 1.2.18.3
+- Start network after config-network RPM install (bz #867546)
+
+* Thu Mar 17 2016 Cole Robinson <crobinso@redhat.com> - 1.2.18.2-3
+- Fix lxc /proc/meminfo virtualization (bz #1300781)
+- Fix 'permission denied' errors trying to unlink disk images (bz #1289327)
+- Fix qemu:///session connect race failures (bz #1271183)
+- driver: log missing modules as INFO, not WARN (bz #1274849)
+
+* Wed Jan 20 2016 Cole Robinson <crobinso@redhat.com> - 1.2.18.2-2
+- Fix XML validation with qemu commandline passthrough (bz #1292131)
+- Fix crash in libvirt_leasehelper (bz #1202350)
+- Generate consistent systemtap tapsets regardless of host arch (bz
+  #1173641)
+- Fix qemu:///session error 'Transport endpoint is not connected' (bz
+  #1271183)
+- Fix parallel VM start/top svirt errors on kernel/initrd (bz #1269975)
+
+* Wed Dec 23 2015 Cole Robinson <crobinso@redhat.com> - 1.2.18.2-1
+- Rebased to version 1.2.18.2
+- disk backend is not removed properly when disk frontent hotplug fails (bz
+  #1265968)
+- Fix TPM cancel path on newer kernels (bz #1244895)
+- Remove timeout for libvirt-guests.service (bz #1195544)
+- CVE-2015-5313 libvirt: filesystem storage volume names path traversal flaw
+  (bz #1291433)
+- Fix VM names with non-ascii (bz #1062943)
+- Fix backwards migration with graphics listen address (bz #1276883)
+
+* Tue Oct 06 2015 Cole Robinson <crobinso@redhat.com> - 1.2.18.1-2
+- Fix qemu.conf dynamic_ownership=0 (bz #1266628)
+- Fix some spec file warnings
+
+* Mon Sep 21 2015 Cole Robinson <crobinso@redhat.com> - 1.2.18.1-1
+- Rebased to version 1.2.18.1
+- libvirt reports physical=0 for COW2 volumes on block storage (bz #1253754)
+- Fix URL installs with virt-manager/virt-install (bz #1264573)
+
 * Tue Aug  4 2015 Daniel P. Berrange <berrange@redhat.com> - 1.2.18-1
 - Update to 1.2.18 release
 

sources

@@ -1 +1 @@
-5531b44fc282c3ce0c3951c6bb692576  libvirt-1.2.18.tar.gz
+8a027dfdde5fb36059e4d7e069708a56  libvirt-1.2.18.4.tar.gz