117550 2006-01-03 01:13 0000 glsa-check can not resolve all glsa entries that upgraded. 2007-07-27 21:39:49 0000 1 1 1 Unclassified Portage Development Tools 2.0 x86 Linux RESOLVED FIXED InSVN P2 normal --- 170220 1 ethembilgin@yahoo.com tools-portage@gentoo.org Anonymous.Pseudonym.88@gmail.com ethembilgin@yahoo.com 2006-01-03 01:13:57 0000 glsa-check can not determine same fixes. phpmyadmin was listed more then once. one of glsa have can but others remained. awstats 6.5 installed. glsa requires 6.4. before awstats upgrade awstats was 6.3. thinking to upgrade awstats due to glsa entry. glsa-check -p 200508-07 200510-16 200510-21 200512-03 WARNING: This tool is completely new and not very tested, so it should not be used on production systems. It's mainly a test tool for the new GLSA release and distribution system, it's functionality will later be merged into emerge and equery. Please read http://www.gentoo.org/proj/en/portage/glsa-integration.xml before using this tool AND before reporting a bug. Checking GLSA 200508-07 The following updates will be performed for this GLSA: net-www/awstats-6.5 (6.4) ********************************************************************** Checking GLSA 200510-16 The following updates will be performed for this GLSA: dev-db/phpmyadmin-2.7.0_p1 (2.7.0_p1) ********************************************************************** Checking GLSA 200510-21 The following updates will be performed for this GLSA: dev-db/phpmyadmin-2.7.0_p1 (2.7.0_p1) ********************************************************************** Checking GLSA 200512-03 The following updates will be performed for this GLSA: dev-db/phpmyadmin-2.7.0_p1 (2.7.0_p1) emerge --info Portage 2.0.53 (default-linux/x86/2005.0, gcc-3.3.6, glibc-2.3.5-r2, 2.6.12-gentoo-r6 i686) ================================================================= System uname: 2.6.12-gentoo-r6 i686 Intel(R) Xeon(TM) CPU 2.80GHz Gentoo Base System version 1.6.13 dev-lang/python: 2.3.5-r2 sys-apps/sandbox: 1.2.12 sys-devel/autoconf: 2.13, 2.59-r6 sys-devel/automake: 1.4_p6, 1.5, 1.6.3, 1.7.9-r1, 1.8.5-r3, 1.9.6-r1 sys-devel/binutils: 2.15.92.0.2-r10 sys-devel/libtool: 1.5.18-r1 virtual/os-headers: 2.6.11-r2 ACCEPT_KEYWORDS="x86" AUTOCLEAN="yes" CBUILD="i386-pc-linux-gnu" CFLAGS="-O2 -mcpu=pentium4 -march=pentium4 -fomit-frame-pointer -pipe" CHOST="i386-pc-linux-gnu" CONFIG_PROTECT="/etc /usr/kde/2/share/config /usr/kde/3.4/env /usr/kde/3.4/share/config /usr/kde/3.4/shutdown /usr/kde/3/share/config /usr/lib/X11/xkb /usr/share/config /var/bind /var/qmail/control" CONFIG_PROTECT_MASK="/etc/gconf /etc/terminfo /etc/env.d" CXXFLAGS="-O2 -mcpu=pentium4 -march=pentium4 -fomit-frame-pointer -pipe" DISTDIR="/usr/portage/distfiles" FEATURES="autoconfig distlocks sandbox sfperms strict" GENTOO_MIRRORS="http://ftp.ankara.edu.tr/gentoo/ http://ftp-stud.fht-esslingen.de/pub/Mirrors/gentoo/" MAKEOPTS="-j3" PKGDIR="/usr/portage/packages" PORTAGE_TMPDIR="/var/tmp" PORTDIR="/usr/portage" SYNC="rsync://rsync.gentoo.org/gentoo-portage" USE="x86 apache2 apm arts audiofile avi berkdb bitmap-fonts bzip2 cdr crypt cups curl eds emboss encode expat foomaticdb fortran gd gdbm gif gmp gpm gstreamer gtk2 idn imap imlib ipv6 java jpeg lcms libg++ libwww mad maildir memlimit mhash mikmod mng motif mp3 mpeg mpm-prefork mysql ncurses nls ogg oggvorbis opengl oss pam pcre pdflib perl php png postgres python quicktime readline sasl sdl spell ssl tcpd tiff truetype truetype-fonts type1-fonts udev vhosts vorbis xml2 xmms xv zlib userland_GNU kernel_linux elibc_glibc" Unset: ASFLAGS, CTARGET, LANG, LC_ALL, LDFLAGS, LINGUAS, PORTDIR_OVERLAY ethembilgin@yahoo.com 2006-01-03 01:14:58 0000 emerge -pv gentoolkit These are the packages that I would merge, in order: Calculating dependencies ...done! [ebuild R ] app-portage/gentoolkit-0.2.0-r3 0 kB Total size of downloads: 0 kB jakub@gentoo.org 2006-01-03 01:27:16 0000 (In reply to comment #1) > Calculating dependencies ...done! > [ebuild R ] app-portage/gentoolkit-0.2.0-r3 0 kB Try with latest gentoolkit version (0.2.2_pre1) and reopen if it still does not work. ethembilgin@yahoo.com 2006-01-03 01:51:21 0000 As it is production server environment. I do not prefer use masked packages. I emerged 0.2.2_pre1 emerge -pv gentoolkit These are the packages that I would merge, in order: Calculating dependencies ...done! [ebuild R ] app-portage/gentoolkit-0.2.2_pre1 0 kB Total size of downloads: 0 kB glsa-check -p 200508-07 200510-16 200510-21 200512-03 Checking GLSA 200508-07 The following updates will be performed for this GLSA: net-www/awstats-6.5 (6.4) Checking GLSA 200510-16 The following updates will be performed for this GLSA: dev-db/phpmyadmin-2.7.0_p1 (2.7.0_p1) Checking GLSA 200510-21 The following updates will be performed for this GLSA: dev-db/phpmyadmin-2.7.0_p1 (2.7.0_p1) Checking GLSA 200512-03 The following updates will be performed for this GLSA: dev-db/phpmyadmin-2.7.0_p1 (2.7.0_p1) jakub@gentoo.org 2006-01-03 10:48:31 0000 *** Bug 117632 has been marked as a duplicate of this bug. *** Anonymous.Pseudonym.88@gmail.com 2006-01-03 11:36:52 0000 Using gentoolkit-0.2.2_pre1 it still has the same trouble not re-installing 200411-38 and 200506-14 everytime (Both install Blackdown jdk 1.4.2.02) glsa-check -p 200411-38 200506-14 Checking GLSA 200411-38 The following updates will be performed for this GLSA: dev-java/blackdown-jdk-1.4.2.02 (1.4.2.02) Checking GLSA 200506-14 The following updates will be performed for this GLSA: dev-java/blackdown-jdk-1.4.2.02 (1.4.2.02) emerge info Portage 2.0.53 (default-linux/amd64/2005.1, gcc-3.4.4, glibc-2.3.5-r2, 2.6.14-gentoo-r5 x86_64) ================================================================= System uname: 2.6.14-gentoo-r5 x86_64 AMD Athlon(tm) 64 Processor 3500+ Gentoo Base System version 1.6.13 ccache version 2.3 [enabled] dev-lang/python: 2.3.5-r2, 2.4.2 sys-apps/sandbox: 1.2.12 sys-devel/autoconf: 2.13, 2.59-r6 sys-devel/automake: 1.4_p6, 1.5, 1.6.3, 1.7.9-r1, 1.8.5-r3, 1.9.6-r1 sys-devel/binutils: 2.16.1 sys-devel/libtool: 1.5.20 virtual/os-headers: 2.6.11-r2 ACCEPT_KEYWORDS="amd64" AUTOCLEAN="yes" CBUILD="x86_64-pc-linux-gnu" CFLAGS="-O2 -mtune=k8 -pipe -fomit-frame-pointer" CHOST="x86_64-pc-linux-gnu" CONFIG_PROTECT="/etc /usr/kde/2/share/config /usr/kde/3.3/env /usr/kde/3.3/share/config /usr/kde/3.3/shutdown /usr/kde/3.4/env /usr/kde/3.4/share/config /usr/kde/3.4/shutdown /usr/kde/3/share/config /usr/lib/X11/xkb /usr/lib64/mozilla/defaults/pref /usr/share/config /var/qmail/control" CONFIG_PROTECT_MASK="/etc/gconf /etc/terminfo /etc/env.d" CXXFLAGS="-O2 -mtune=k8 -pipe -fomit-frame-pointer" DISTDIR="/usr/portage/distfiles" FEATURES="autoconfig buildpkg ccache distlocks sandbox sfperms strict" GENTOO_MIRRORS="ftp://sunsite.ualberta.ca/pub/unix/Linux/gentoo/ ftp://gentoo.risq.qc.ca/ ftp://gentoo.agsn.ca/ http://gentoo.mirrored.ca/ ftp://gentoo.mirrored.ca/ http://gentoo.osuosl.org/ ftp://sunsite.ualberta.ca/pub/unix/Linux/gentoo/" MAKEOPTS="-j2" PKGDIR="/usr/portage/packages" PORTAGE_TMPDIR="/home/tmp" PORTDIR="/usr/portage" PORTDIR_OVERLAY="/usr/local/portage" SYNC="rsync://rsync.gentoo.org/gentoo-portage" USE="X acpi alsa amd64 audiofile avi berkdb bitmap-fonts bonobo bzip2 cdr crypt cups curl dbus divx4linux doc dvd dvdr eds emboss encode esd exif expat fam ffmpeg flac foomaticdb fortran gd gdbm gif glut gnome gphoto2 gpm gstreamer gtk gtk2 gtkhtml guile hal idn imagemagick imlib ipv6 java jpeg kde lcms lzw lzw-tiff mad mng mozilla mp3 mpeg ncurses nls nocd nptl offensive ogg oggvorbis opengl oss pam pcre pdflib perl png python qt quicktime readline real recode samba scanner sdl spell ssl tcltk tcpd tiff truetype truetype-fonts type1-fonts udev unicode usb userlocales vorbis xine xml xml2 xmms xpm xv zlib userland_GNU kernel_linux elibc_glibc" Unset: ASFLAGS, CTARGET, LANG, LC_ALL, LDFLAGS, LINGUAS genone@gentoo.org 2006-01-06 11:24:49 0000 Can anyone confirm this with --fix instead of --pretend (can't check myself right now). If not, someone with >=gentoolkit-0.2.1 please try the following EMERGE_OPTS="-p" glsa-check -f <glsa-list> and post the output here. Anonymous.Pseudonym.88@gmail.com 2006-01-06 11:52:36 0000 EMERGE_OPTS="-p" glsa-check -f 200411-38 200506-14 fixing 200411-38 >>> merging dev-java/blackdown-jdk-1.4.2.02 These are the packages that I would merge, in order: Calculating dependencies ...done! [ebuild R ] dev-java/blackdown-jdk-1.4.2.02 fixing 200506-14 >>> merging dev-java/blackdown-jdk-1.4.2.02 These are the packages that I would merge, in order: Calculating dependencies ...done! [ebuild R ] dev-java/blackdown-jdk-1.4.2.02 fuzzyray@gentoo.org 2006-01-06 13:38:08 0000 This is defintely related to slotting. I used blackdown-jdk to reproduce and I had to completely unmerge blackdown-jdk in order to reproduce. Simply installing 1.4.1-r1 with 1.4.2.02 already installed didn't cause the problem to exhibit itself. i.e 'glsa-check -p 200411-38 200506-14' had the following output: Checking GLSA 200411-38 The following updates will be performed for this GLSA: dev-java/blackdown-jdk-1.4.2.02 (1.4.1-r1) Checking GLSA 200506-14 The following updates will be performed for this GLSA: dev-java/blackdown-jdk-1.4.2.02 (1.4.1-r1) Steps to reproduce: 1. emerge --unmerge blackdown-jdk 2. emerge -v1 =dev-java/blackdown-jdk-1.4.1-r1 (version is affected by GLSA) 3. glsa-check -t 200411-38 200506-14 This system is affected by the following GLSA: 200506-14 4. glsa-check -f 200506-14 fixing 200506-14 >>> merging dev-java/blackdown-jdk-1.4.2.02 >>> dev-java/blackdown-jdk-1.4.2.02 merged. 5. equery list blackdown-jdk [ Searching for package 'blackdown-jdk' in all categories among: ] * installed packages [I--] [ ] dev-java/blackdown-jdk-1.4.1-r1 (1.4.1) [I--] [ ] dev-java/blackdown-jdk-1.4.2.02 (1.4.2) 6. glsa-check -p 200411-38 200506-14 Checking GLSA 200411-38 The following updates will be performed for this GLSA: dev-java/blackdown-jdk-1.4.2.02 (1.4.2.02) Checking GLSA 200506-14 The following updates will be performed for this GLSA: dev-java/blackdown-jdk-1.4.2.02 (1.4.2.02) 7. EMERGE_OPTS="-p" glsa-check -f 200411-38 200506-14 fixing 200411-38 >>> merging dev-java/blackdown-jdk-1.4.2.02 These are the packages that I would merge, in order: Calculating dependencies ...done! [ebuild R ] dev-java/blackdown-jdk-1.4.2.02 fixing 200506-14 >>> merging dev-java/blackdown-jdk-1.4.2.02 These are the packages that I would merge, in order: Calculating dependencies ...done! [ebuild R ] dev-java/blackdown-jdk-1.4.2.02 ethembilgin@yahoo.com 2006-01-09 04:28:10 0000 EMERGE_OPTS="-p" glsa-check -f 200508-07 200510-16 200510-21 200512-03 fixing 200508-07 >>> merging net-www/awstats-6.5 These are the packages that I would merge, in order: Calculating dependencies ...done! [ebuild R ] net-www/awstats-6.5 fixing 200510-16 >>> merging dev-db/phpmyadmin-2.7.0_p1 These are the packages that I would merge, in order: Calculating dependencies ...done! [ebuild R ] dev-db/phpmyadmin-2.7.0_p1 fixing 200510-21 >>> merging dev-db/phpmyadmin-2.7.0_p1 These are the packages that I would merge, in order: Calculating dependencies ...done! [ebuild R ] dev-db/phpmyadmin-2.7.0_p1 fixing 200512-03 >>> merging dev-db/phpmyadmin-2.7.0_p1 These are the packages that I would merge, in order: Calculating dependencies ...done! [ebuild R ] dev-db/phpmyadmin-2.7.0_p1 glsa-check -p 200508-07 200510-16 200510-21 200512-03 Checking GLSA 200508-07 The following updates will be performed for this GLSA: net-www/awstats-6.5 (6.4) Checking GLSA 200510-16 The following updates will be performed for this GLSA: dev-db/phpmyadmin-2.7.0_p1 (2.7.0_p1) Checking GLSA 200510-21 The following updates will be performed for this GLSA: dev-db/phpmyadmin-2.7.0_p1 (2.7.0_p1) Checking GLSA 200512-03 The following updates will be performed for this GLSA: dev-db/phpmyadmin-2.7.0_p1 (2.7.0_p1) fuzzyray@gentoo.org 2006-01-12 12:13:48 0000 Created an attachment (id=76933) glsa-check.117550.patch This patch for glsa-check and the follwing patch for glsa.py fix the problem with --pretend not correctly showing the vulnerable version(s) of the packages that are installed fuzzyray@gentoo.org 2006-01-12 12:14:27 0000 Created an attachment (id=76934) glsa.py.117550.patch Patch for glsa.py Anonymous.Pseudonym.88@gmail.com 2006-01-12 13:18:32 0000 After aplying both patches it results as: EMERGE_OPTS="-p" glsa-check -f 200411-38 200506-14 fixing 200411-38 >>> merging dev-java/blackdown-jdk-1.4.2.02 These are the packages that I would merge, in order: Calculating dependencies ...done! [ebuild UD] dev-java/blackdown-jdk-1.4.2.02 [1.4.2.03] fixing 200506-14 >>> merging dev-java/blackdown-jdk-1.4.2.02 These are the packages that I would merge, in order: Calculating dependencies ...done! [ebuild UD] dev-java/blackdown-jdk-1.4.2.02 [1.4.2.03] Here's the emerge -s blackdown-jdk dev-java/blackdown-jdk Latest version available: 1.4.2.03 Latest version installed: 1.4.2.03 Size of downloaded files: 66,770 kB Homepage: http://www.blackdown.org Description: Blackdown Java Development Kit License: sun-bcla-java-vm Still downgrades it everytime. The next emerge -uDv kicks it back up to v. 1.4.2.03. fuzzyray@gentoo.org 2006-01-12 13:36:32 0000 Run glsa-check --pretend 200411-38 200506-14 and it will tell you which version(s) of blackdown-jdk are installed and listed as vulnerable. Follow that with an emerge --unmerge =blackdown-jdk-<vulnerable version> After unmerging the vulnerable versions, glsa-check will stop trying to emerge dev-java/blackdown-jdk-1.4.2.02 to fix the vulnerability. Anonymous.Pseudonym.88@gmail.com 2006-01-12 14:05:55 0000 blackdown-jdk-1.4.02 isn't installed on my system. emerge -C blackdown-jdk-1.4.2.02 --- Couldn't find blackdown-jdk-1.4.2.02 to unmerge. >>> unmerge: No packages selected for removal. emerge -C dev-java/blackdown-jdk-1.4.2.02 --- Couldn't find dev-java/blackdown-jdk-1.4.2.02 to unmerge. >>> unmerge: No packages selected for removal. EMERGE_OPTS="-p" glsa-check -f 200411-38 200506-14 fixing 200411-38 >>> merging dev-java/blackdown-jdk-1.4.2.02 These are the packages that I would merge, in order: Calculating dependencies ...done! [ebuild UD] dev-java/blackdown-jdk-1.4.2.02 [1.4.2.03] fixing 200506-14 >>> merging dev-java/blackdown-jdk-1.4.2.02 These are the packages that I would merge, in order: Calculating dependencies ...done! [ebuild UD] dev-java/blackdown-jdk-1.4.2.02 [1.4.2.03] It still seems to think that it's the one true jdk that should be installed. java-config --jdk-home /opt/blackdown-jdk-1.4.2.03 Blah opt # ls -l total 40 drwxr-xr-x 3 root root 4096 Dec 30 17:52 OpenOffice.org drwxr-xr-x 2 root root 48 Jan 10 18:20 bin drwxr-xr-x 8 root root 48 Jan 11 17:44 blackdown-jdk-1.4.2.03 drwxr-xr-x 6 root root 32 Jan 9 08:51 blackdown-jre-1.4.2.03 drwxr-x--- 5 root games 4096 Jan 11 12:37 doom3 drwxr-xr-x 10 foldingathome nogroup 4096 Jan 10 08:38 foldingathome drwxr-xr-x 6 root root 32 Dec 30 17:11 java32 drwxr-xr-x 3 root root 8 Mar 12 2005 netscape drwxrwx--- 30 root games 4096 Jan 10 15:24 nwn drwxr-xr-x 5 root root 24 Jul 1 2005 rar drwxr-xr-x 17 root root 4096 Jun 19 2005 ut2004 Anonymous.Pseudonym.88@gmail.com 2006-01-12 14:26:51 0000 Unmerging all instances of blackdown-jdk and blackdown-jre and them re-emerging them fixed the problem. EMERGE_OPTS="-p" glsa-check -f 200411-38 200506-14 fixing 200411-38 fixing 200506-14 genone@gentoo.org 2007-05-30 17:30:15 0000 r403 of glsa-check has some support for checking $SLOT when selecting/displaying upgrades that should take care of this. fuzzyray@gentoo.org 2007-07-27 21:39:49 0000 Released in gentoolkit-0.2.4_pre6 76933 2006-01-12 12:13 0000 glsa-check.117550.patch glsa-check.117550.patch text/plain LS0tIC91c3IvYmluL2dsc2EtY2hlY2sJMjAwNi0wMS0wOSAxMjo0NDoyMy4wMDAwMDAwMDAgLTA2 MDAKKysrIC4vZ2xzYS1jaGVjawkyMDA2LTAxLTEyIDE0OjA2OjM3LjAwMDAwMDAwMCAtMDYwMApA QCAtMjI0LDkgKzIyNCwxMSBAQAogCQkJaWYgbWVyZ2VsaXN0OgogCQkJCXN5cy5zdGRvdXQud3Jp dGUoIlRoZSBmb2xsb3dpbmcgdXBkYXRlcyB3aWxsIGJlIHBlcmZvcm1lZCBmb3IgdGhpcyBHTFNB OlxuIikKIAkJCQlmb3IgcGtnIGluIG1lcmdlbGlzdDoKLQkJCQkJIyB3ZSBzaW1wbGlmeSBhIGJp dCBoZXJlCi0JCQkJCW9sZHZlciA9IHBvcnRhZ2UuZGJbIi8iXVsidmFydHJlZSJdLmRiYXBpLm1h dGNoKHBvcnRhZ2UuZGVwX2dldGtleShwa2cpKVstMV0KLQkJCQkJb2xkdmVyID0gb2xkdmVyW2xl bihwb3J0YWdlLmRlcF9nZXRrZXkob2xkdmVyKSkrMTpdCisJCQkJCXBrZ2xpc3QgPSBteWdsc2Eu Z2V0VnVsbmVyYWJsZVBhY2thZ2VzKHBrZykKKwkJCQkJb2xkdmVyID0gIiIKKwkJCQkJZm9yIHgg aW4gcGtnbGlzdDoKKwkJCQkJCW9sZHZlciA9IG9sZHZlciArICIsICIgKyB4W2xlbihwb3J0YWdl LmRlcF9nZXRrZXkoeCkpKzE6XQorCQkJCQlvbGR2ZXIgPSBvbGR2ZXJbMjpdCiAJCQkJCXN5cy5z dGRvdXQud3JpdGUoIiAgICAgIiArIHBrZyArICIgKCIgKyBvbGR2ZXIgKyAiKVxuIikKIAkJCWVs c2U6CiAJCQkJc3lzLnN0ZG91dC53cml0ZSgiTm90aGluZyB0byBkbyBmb3IgdGhpcyBHTFNBXG4i KQo= 76934 2006-01-12 12:14 0000 glsa.py.117550.patch glsa.py.117550.patch text/plain LS0tIC91c3IvbGliL2dlbnRvb2xraXQvcHltL2dsc2EucHkJMjAwNi0wMS0wOSAxMjo0NDoyMy4w MDAwMDAwMDAgLTA2MDAKKysrIC4vZ2xzYS5weQkyMDA2LTAxLTEyIDE0OjA1OjI5LjAwMDAwMDAw MCAtMDYwMApAQCAtNjE0LDMgKzYxNCwyNSBAQAogCQkJCWlmIHVwZGF0ZToKIAkJCQkJclZhbHVl LmFwcGVuZCh1cGRhdGUpCiAJCXJldHVybiByVmFsdWUKKworCWRlZiBnZXRWdWxuZXJhYmxlUGFj a2FnZXMoc2VsZiwgcGtnKToKKwkJIiIiCisJCVJldHVybnMgdGhlIGxpc3Qgb2YgaW5zdGFsbGVk IHZ1bG5lcmFibGUgcGFja2FnZXMuCisKKwkJQHR5cGUJCXBrZzogU3RyaW5nCisJCUBwYXJhbQkJ cGtnOiBOYW1lIG9mIHZ1bG5lcmFibGUgcGFja2FnZQorCisJCUBydHlwZToJCUxpc3Qgb2YgU3Ry aW5ncworCQlAcmV0dXJuOglsaXN0IG9mIGluc3RhbGxlZCB2dWxuZXJhYmxlIHBhY2thZ2UgdmVy c2lvbnMKKwkJIiIiCisKKwkJclZhbHVlID0gW10KKwkJcGtnID0gcG9ydGFnZS5kZXBfZ2V0a2V5 KHBrZykKKwkJZm9yIHBhdGggaW4gc2VsZi5wYWNrYWdlc1twa2ddOgorCQkJZm9yIGF0b20gaW4g cGF0aFsidnVsX2F0b21zIl06CisJCQkJcGtnbGlzdCA9IHBvcnRhZ2UuZGJbIi8iXVsidmFydHJl ZSJdLmRiYXBpLm1hdGNoKGF0b20pCisJCQkJaWYgcGtnbGlzdDoKKwkJCQkJZm9yIHggaW4gcGtn bGlzdDoKKwkJCQkJCXJWYWx1ZS5hcHBlbmQoeCkKKworCQlyZXR1cm4gclZhbHVlCg==