glibc

[hotaru]

glibc 2.29 is outdated and vulnerable to CVE-2019-9169.

https://github.com/archlinuxarm/PKGBUIL ... core/glibc was updated to 2.30 a while ago, but packages in the repos are still stuck on 2.29:

• https://archlinuxarm.org/packages/arm/glibc
• https://archlinuxarm.org/packages/armv6h/glibc
• https://archlinuxarm.org/packages/armv7h/glibc
• https://archlinuxarm.org/packages/aarch64/glibc

[summers]

Very strange. I grabbed a copy of the PKGBUILD a few days ago to check gcc, on an unrelated problem.

Anyway just tried building glibc and it worked without any changes, and was fine:
$this->bbcode_second_pass_code('', '[summers@odroid-c2 ~]$ ls -l /usr/lib/libc-*.so
-rwxr-xr-x 1 root root 1795424 Nov 12 20:43 /usr/lib/libc-2.30.so
')

[hotaru]

any progress on this?

[summers]

hard to say what the problem is. On my armv8 I compiled the latest glibc fine. On my armv7h I've set the glibc going, and its making good progress, so I expect it to complete.

So which target are you after? I should be able to upload either armv8 or armv7h packages, if you really need to update.

Anyway what the problem is with updating on the main arch arm, I can't say. You'll need someone on the main arm farm say what the delay is ...

[summers]

OK build on armv7h worked:
$this->bbcode_second_pass_code('', '[summers@pocketbeagle glibc]$ ls -l /usr/lib/libc-*.so
-rwxr-xr-x 1 root root 1604104 Jun 9 2019 /usr/lib/libc-2.29.so
[summers@pocketbeagle glibc]$ sudo pacman -U glibc-2.30-2-armv7h.pkg.tar.xz
[sudo] password for summers:
loading packages...
resolving dependencies...
looking for conflicting packages...

Packages (1) glibc-2.30-2

Total Installed Size: 36.64 MiB
Net Upgrade Size: -0.34 MiB

:: Proceed with installation? [Y/n]
(1/1) checking keys in keyring [######################] 100%
(1/1) checking package integrity [######################] 100%
(1/1) loading package files [######################] 100%
(1/1) checking for file conflicts [######################] 100%
(1/1) checking available disk space [######################] 100%
:: Processing package changes...
(1/1) upgrading glibc [######################] 100%
Generating locales...
Generation complete.
:: Running post-transaction hooks...
(1/4) Reloading system manager configuration...
(2/4) Creating temporary files...
(3/4) Arming ConditionNeedsUpdate...
(4/4) Updating the info directory file...
[summers@pocketbeagle glibc]$ ls -l /usr/lib/libc-*.so
-rwxr-xr-x 1 root root 1607312 Dec 15 12:08 /usr/lib/libc-2.30.so
')
I've uploaded the armv8 and armv7h to https://davidjohnsummers.uk/archarm/glibc/ so if you are happy with unofficial packages you can upgrade using these.