New upstream stable version 1.24.6; fixes CVE-2021-3716.

Add myself via:

  gpg --export 'Eric Blake' | \
  gpg --no-default-keyring --keyring ./libguestfs.keyring --import

.gitignore

@@ -1,3 +1,4 @@
 /clog
 /nbdkit-*.tar.gz
 /nbdkit-*.tar.gz.sig
+/*~

0001-server-reset-meta-context-replies-on-starttls.patch

@@ -0,0 +1,39 @@
+From 814d8103fb4b581dc01dfd25d2cd81596576f211 Mon Sep 17 00:00:00 2001
+From: Eric Blake <eblake@redhat.com>
+Date: Mon, 16 Aug 2021 13:43:29 -0500
+Subject: [nbdkit PATCH] server: reset meta context replies on starttls
+
+Related to CVE-2021-3716, but not as severe.  No compliant client will
+send NBD_CMD_BLOCK_STATUS unless it first negotiates
+NBD_OPT_SET_META_CONTEXT.  If an attacker injects a premature
+SET_META_CONTEXT, either the client will never notice (because it
+never uses BLOCK_STATUS), or the client will overwrite the attacker's
+attempt with the client's own SET_META_CONTEXT request after
+encryption is enabled.  So I don't class this as having the potential
+to trigger denial-of-service due to any protocol mismatch between
+compliant client and server (I don't care what happens with
+non-compliant clients).
+
+Fixes: 26455d45 (server: protocol: Implement Block Status "base:allocation".)
+(cherry picked from commit 6c5faac6a37077cf2366388a80862bb00616d0d8)
+---
+ server/protocol-handshake-newstyle.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/server/protocol-handshake-newstyle.c b/server/protocol-handshake-newstyle.c
+index b94950e2..eb0f3961 100644
+--- a/server/protocol-handshake-newstyle.c
++++ b/server/protocol-handshake-newstyle.c
+@@ -497,6 +497,9 @@ negotiate_handshake_newstyle_options (void)
+         debug ("using TLS on this connection");
+         /* Wipe out any cached state. */
+         conn->structured_replies = false;
++        free (conn->exportname_from_set_meta_context);
++        conn->exportname_from_set_meta_context = NULL;
++        conn->meta_context_base_allocation = false;
+         for_each_backend (b) {
+           struct handle *h = get_handle (conn, b->i);
+           free (h->default_exportname);
+-- 
+2.31.1
+

copy-patches.sh

@@ -0,0 +1,55 @@
+#!/bin/bash -
+
+set -e
+
+# Maintainer script to copy patches from the git repo to the current
+# directory.  Use it like this:
+#   ./copy-patches.sh
+
+rhel_version=8.3
+
+# Check we're in the right directory.
+if [ ! -f nbdkit.spec ]; then
+    echo "$0: run this from the directory containing 'nbdkit.spec'"
+    exit 1
+fi
+
+git_checkout=$HOME/d/nbdkit-rhel-$rhel_version
+if [ ! -d $git_checkout ]; then
+    echo "$0: $git_checkout does not exist"
+    echo "This script is only for use by the maintainer when preparing a"
+    echo "nbdkit release on RHEL."
+    exit 1
+fi
+
+# Get the base version of nbdkit.
+version=`grep '^Version:' nbdkit.spec | awk '{print $2}'`
+tag="v$version"
+
+# Remove any existing patches.
+git rm -f [0-9]*.patch ||:
+rm -f [0-9]*.patch
+
+# Get the patches.
+(cd $git_checkout; rm -f [0-9]*.patch; git format-patch -N $tag)
+mv $git_checkout/[0-9]*.patch .
+
+# Remove any not to be applied.
+rm -f *NOT-FOR-RPM*.patch
+
+# Add the patches.
+git add [0-9]*.patch
+
+# Print out the patch lines.
+echo
+echo "--- Copy the following text into nbdkit.spec file"
+echo
+
+echo "# Patches."
+for f in [0-9]*.patch; do
+    n=`echo $f | awk -F- '{print $1}'`
+    echo "Patch$n:     $f"
+done
+
+echo
+echo "--- End of text"

sources

@@ -1,2 +1,2 @@
-SHA512 (nbdkit-1.5.6.tar.gz) = bacdc95b909e943e6476f24d10e7e9e2ea0b9e26362c35c604c8e1cdf361e333e47c38747b491077e9444466e014fe9f67c6db8be3a98f1f0e7bffee555c1bc0
-SHA512 (nbdkit-1.5.6.tar.gz.sig) = 96917b05005adba7333073b4ba91b3b499f76c418833344cda5a93603a84bc78421749f5ed13432323216f0b1195bf0bbebd63ba4959390568b7a4289a69d0db
+SHA512 (nbdkit-1.24.6.tar.gz) = fe96ccc0bdc9b8b35e03c9dceb3f7687d34b5b5760d525a474affd5ab425806920b33e14b037b8919463fdfb444fa9de973357bc18d42ef2cb9d3d5067b9592d
+SHA512 (nbdkit-1.24.6.tar.gz.sig) = 7de5b35f1c855a006bb8ffea6ef44e4f57df4522347f225eaec558574b31825687f1ea7f8c7f26dd6304eca9924dcf1029fce70b43431b45350131242f70a816