[Pkg-sssd-devel] [Git][sssd-team/sssd][master] 7 commits: debian/patches: Update fix-whitespace-test.diff. Add logic to ignore various...
Mike Gabriel (@sunweaver)
gitlab at salsa.debian.org
Fri Sep 4 07:36:54 BST 2026
Mike Gabriel pushed to branch master at Debian SSSD packaging / sssd
Commits:
fe564739 by Mike Gabriel at 2026-09-03T11:17:22+02:00
debian/patches: Update fix-whitespace-test.diff. Add logic to ignore various code files during the whitespace tests
- - - - -
4aeac6a3 by Mike Gabriel at 2026-09-03T11:59:48+02:00
debian/patches: Add fix-ftbfs-src-m4.diff. Fix FTBFS due to missing src/m4 Makefile target.
- - - - -
31d40edc by Mike Gabriel at 2026-09-03T12:02:10+02:00
debian/patches: Add fix-underlinking-keyutils.diff. Assure that unit tests that reference headers from libkeyutils-dev get linked against the library.
- - - - -
d60c91a2 by Mike Gabriel at 2026-09-03T12:03:02+02:00
debian/patches: Add fix-eol-flaws-in-codefiles.diff. Fix EOL and EOF issue in one file to make whitespace_test unit test happy.
- - - - -
5b8f42ef by Mike Gabriel at 2026-09-03T12:03:22+02:00
debian/patches: CVE-2026-12610: Add CVE-2026-12610.diff. PAM: fix use-after-free during p11_child processing. (Closes: #1141323).
- - - - -
d74eee21 by Mike Gabriel at 2026-09-04T08:31:02+02:00
debian/patches: CVE-2026-14474, CVE-2026-14476: Add CVE-2026-14474.diff and CVE-2026-14476.diff. sudo: warn when ldap_sudo_search_base falls back to root DN. gpo: reject path traversal in gPCFileSysPath. (Closes: #1141769).
- - - - -
b30fbccb by Mike Gabriel at 2026-09-04T08:31:02+02:00
releasing package sssd version 2.13.1-1
- - - - -
9 changed files:
- debian/changelog
- + debian/patches/CVE-2026-12610.diff
- + debian/patches/CVE-2026-14474.diff
- + debian/patches/CVE-2026-14476.diff
- + debian/patches/fix-eol-flaws-in-codefiles.diff
- + debian/patches/fix-ftbfs-src-m4.diff
- + debian/patches/fix-underlinking-keyutils.diff
- debian/patches/fix-whitespace-test.diff
- debian/patches/series
Changes:
=====================================
debian/changelog
=====================================
@@ -1,11 +1,32 @@
-sssd (2.13.1-1) UNRELEASED; urgency=medium
+sssd (2.13.1-1) unstable; urgency=medium
+ * Team upload.
+
+ [ Timo Aaltonen ]
* New upstream release.
- * patches: Drop upstreamed patch
+ - CVE-2026-6245: pam: fix out-of-bounds read in pam_passkey_child_read_data.
+ (Closes: #1134269).
+ * patches: Drop upstreamed patch.
* source: Update diff-ignore.
* control: Change maintainer address.
- -- Timo Aaltonen <tjaalton at debian.org> Thu, 07 May 2026 08:40:52 +0300
+ [ Mike Gabriel ]
+ * debian/patches:
+ + Update fix-whitespace-test.diff. Add logic to ignore various code files
+ during the whitespace tests
+ + Add fix-ftbfs-src-m4.patch. Fix FTBFS due to missing src/m4 Makefile
+ target.
+ + Add fix-underlinking-keyutils.patch. Assure that unit tests that reference
+ headers from libkeyutils-dev get linked against the library.
+ + Add fix-eol-flaws-in-codefiles.patch. Fix EOL and EOF issue in one file to
+ make whitespace_test unit test happy.
+ + CVE-2026-12610: Add CVE-2026-12610.diff. PAM: fix use-after-free during
+ p11_child processing. (Closes: #1141323).
+ + CVE-2026-14474, CVE-2026-14476: Add CVE-2026-14474.diff (sudo: warn when
+ ldap_sudo_search_base falls back to root DN) and CVE-2026-14476.diff (gpo:
+ reject path traversal in gPCFileSysPath. (Closes: #1141769).
+
+ -- Mike Gabriel <sunweaver at debian.org> Thu, 03 Sep 2026 12:16:27 +0200
sssd (2.12.0-4) unstable; urgency=medium
=====================================
debian/patches/CVE-2026-12610.diff
=====================================
@@ -0,0 +1,108 @@
+From f2c69b916f5fe53a930aa39c2078b248b83bc2b4 Mon Sep 17 00:00:00 2001
+From: Alexey Tikhonov <atikhono at redhat.com>
+Date: Mon, 29 Jun 2026 21:46:46 +0200
+Subject: [PATCH] PAM: fix use-after-free during p11_child processing
+
+`pam_check_cert_send()` stored `pctx->sss_certmap_ctx` in the
+request state. If `p11_refresh_certmap_ctx()` ran while `p11_child`
+was still executing (e.g. triggered by a domain refresh), it freed
+and replaced the certmap context, leaving the request state holding
+a dangling pointer. `p11_child_done()` could later use that pointer.
+
+Fix this by passing the `pam_ctx` into `pam_check_cert_send()` and
+dereferencing `pctx->sss_certmap_ctx` at the time it is actually needed
+in `p11_child_done()`, so the current context is always used.
+
+Resolves: https://github.com/SSSD/sssd/issues/8796
+Fixes: CVE-2026-12610
+
+Assisted-By: Claude Code (Opus 4.6)
+Reviewed-by: Iker Pedrosa <ipedrosa at redhat.com>
+Reviewed-by: Sumit Bose <sbose at redhat.com>
+(cherry picked from commit fa7a55949a30fed064a28ea6f0c801fc5e8c5ba7)
+---
+ src/responder/pam/pamsrv.h | 2 +-
+ src/responder/pam/pamsrv_cmd.c | 2 +-
+ src/responder/pam/pamsrv_p11.c | 11 ++++++-----
+ 3 files changed, 8 insertions(+), 7 deletions(-)
+
+diff --git a/src/responder/pam/pamsrv.h b/src/responder/pam/pamsrv.h
+index 694b391bb16..162bfe1a435 100644
+--- a/src/responder/pam/pamsrv.h
++++ b/src/responder/pam/pamsrv.h
+@@ -153,7 +153,7 @@ struct tevent_req *pam_check_cert_send(TALLOC_CTX *mem_ctx,
+ const char *ca_db,
+ time_t timeout,
+ const char *verify_opts,
+- struct sss_certmap_ctx *sss_certmap_ctx,
++ struct pam_ctx *pctx,
+ const char *uri,
+ struct pam_data *pd);
+ errno_t pam_check_cert_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
+diff --git a/src/responder/pam/pamsrv_cmd.c b/src/responder/pam/pamsrv_cmd.c
+index cd003ff46ff..7fadf647d64 100644
+--- a/src/responder/pam/pamsrv_cmd.c
++++ b/src/responder/pam/pamsrv_cmd.c
+@@ -1945,7 +1945,7 @@ static errno_t check_cert(TALLOC_CTX *mctx,
+
+ req = pam_check_cert_send(mctx, ev,
+ pctx->ca_db, p11_child_timeout,
+- cert_verification_opts, pctx->sss_certmap_ctx,
++ cert_verification_opts, pctx,
+ uri, pd);
+ if (req == NULL) {
+ DEBUG(SSSDBG_OP_FAILURE, "pam_check_cert_send failed.\n");
+diff --git a/src/responder/pam/pamsrv_p11.c b/src/responder/pam/pamsrv_p11.c
+index 191bf40c585..29a6edc0563 100644
+--- a/src/responder/pam/pamsrv_p11.c
++++ b/src/responder/pam/pamsrv_p11.c
+@@ -749,7 +749,7 @@ static errno_t parse_p11_child_response(TALLOC_CTX *mem_ctx, uint8_t *buf,
+
+ struct pam_check_cert_state {
+ struct tevent_context *ev;
+- struct sss_certmap_ctx *sss_certmap_ctx;
++ struct pam_ctx *pctx;
+ struct child_io_fds *io;
+ struct cert_auth_info *cert_list;
+ struct pam_data *pam_data;
+@@ -763,7 +763,7 @@ struct tevent_req *pam_check_cert_send(TALLOC_CTX *mem_ctx,
+ const char *ca_db,
+ time_t timeout,
+ const char *verify_opts,
+- struct sss_certmap_ctx *sss_certmap_ctx,
++ struct pam_ctx *pctx,
+ const char *uri,
+ struct pam_data *pd)
+ {
+@@ -791,11 +791,12 @@ struct tevent_req *pam_check_cert_send(TALLOC_CTX *mem_ctx,
+ goto done;
+ }
+
+- if (sss_certmap_ctx == NULL) {
++ if (pctx == NULL || pctx->sss_certmap_ctx == NULL) {
+ DEBUG(SSSDBG_CRIT_FAILURE, "Missing certificate matching context.\n");
+ ret = EINVAL;
+ goto done;
+ }
++ state->pctx = pctx;
+
+ state->pam_data = pd;
+
+@@ -880,7 +881,6 @@ struct tevent_req *pam_check_cert_send(TALLOC_CTX *mem_ctx,
+ }
+
+ state->ev = ev;
+- state->sss_certmap_ctx = sss_certmap_ctx;
+
+ ret = sss_child_start(state, ev,
+ P11_CHILD_PATH, extra_args, false,
+@@ -985,7 +985,8 @@ static void p11_child_done(struct tevent_req *subreq)
+
+ FD_CLOSE(state->io->read_from_child_fd);
+
+- ret = parse_p11_child_response(state, buf, buf_len, state->sss_certmap_ctx,
++ ret = parse_p11_child_response(state, buf, buf_len,
++ state->pctx->sss_certmap_ctx,
+ &state->cert_list);
+ if (ret != EOK) {
+ if (ret == ERR_P11_PIN_LOCKED) {
=====================================
debian/patches/CVE-2026-14474.diff
=====================================
@@ -0,0 +1,74 @@
+From c29afbf02acf9e235eb5283f0325ea0037c1574a Mon Sep 17 00:00:00 2001
+From: Alexey Tikhonov <atikhono at redhat.com>
+Date: Fri, 3 Jul 2026 13:25:08 +0200
+Subject: [PATCH] sudo: warn when ldap_sudo_search_base falls back to root DN
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+When ldap_sudo_search_base is not explicitly configured, SSSD falls back
+to the domain's naming context (root DN) and searches the entire LDAP
+directory tree for sudoRole objects. Any LDAP principal with write access
+to any subtree can inject a sudoRole granting arbitrary sudo privileges
+on every enrolled host.
+
+This patch adds a warning log when the fallback occurs, alerting
+administrators that their configuration searches the entire directory
+tree for sudo rules. A future hardening step would be to default to
+ou=sudoers,<base_dn> instead of the root DN.
+
+The warning approach preserves backwards compatibility while ensuring
+administrators are aware of the security implications.
+
+Based on the patch by: Ian Murphy <imurphy at redhat.com>
+Amended by: Alexey Tikhonov <atikhono at redhat.com>
+
+:fixes: CVE-2026-14474
+
+Reviewed-by: Sumit Bose <sbose at redhat.com>
+Reviewed-by: Tomáš Halman <thalman at redhat.com>
+(cherry picked from commit ff8c1b19bcdbf79b733b052a7d926bd920b1205d)
+---
+ src/providers/ldap/sdap.c | 19 +++++++++++++++++++
+ src/tests/system/tests/test_ldap.py | 2 +-
+ 2 files changed, 20 insertions(+), 1 deletion(-)
+
+--- a/src/providers/ldap/sdap.c
++++ b/src/providers/ldap/sdap.c
+@@ -1341,6 +1341,25 @@
+
+ /* Sudo */
+ if (!sdom->sudo_search_bases) {
++ /* At some point make this option mandatory,
++ * i.e. disable sudo rules lookup if 'sudo_search_bases' not set.
++ */
++ DEBUG(SSSDBG_IMPORTANT_INFO,
++ "`ldap_sudo_search_base` is not set. SSSD will search the entire "
++ "directory tree (%s) for sudoRole objects. This may allow any "
++ "LDAP principal with write access to any subtree to inject "
++ "sudo rules granting arbitrary privileges. Set "
++ "`ldap_sudo_search_base` to restrict the search scope "
++ "(e.g., 'ou=sudoers,dc=example,dc=com').\n",
++ sdom->naming_context);
++ sss_log(SSS_LOG_ALERT,
++ "`ldap_sudo_search_base` is not set. SSSD will search the entire "
++ "directory tree (%s) for sudoRole objects. This may allow any "
++ "LDAP principal with write access to any subtree to inject "
++ "sudo rules granting arbitrary privileges. Set "
++ "`ldap_sudo_search_base` to restrict the search scope "
++ "(e.g., 'ou=sudoers,dc=example,dc=com').",
++ sdom->naming_context);
+ ret = sdap_set_search_base(opts, sdom,
+ SDAP_SUDO_SEARCH_BASE,
+ sdom->naming_context);
+--- a/src/tests/system/tests/test_ldap.py
++++ b/src/tests/system/tests/test_ldap.py
+@@ -245,7 +245,7 @@
+ client.sssd.dom("test")["ldap_search_base"] = ldap.ldap.naming_context
+
+ client.sssd.stop()
+- client.sssd.clear()
++ client.sssd.clear(logs=True)
+ client.sssd.start()
+
+ assert client.auth.ssh.password("puser1", "Secret123"), "User 'puser1' login failed!"
=====================================
debian/patches/CVE-2026-14476.diff
=====================================
@@ -0,0 +1,172 @@
+From ba207eab76ff5253662a763b9b6e9ea42f03d31b Mon Sep 17 00:00:00 2001
+From: Alexey Tikhonov <atikhono at redhat.com>
+Date: Thu, 2 Jul 2026 17:29:51 +0200
+Subject: [PATCH] gpo: reject path traversal in gPCFileSysPath
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The gPCFileSysPath LDAP attribute from AD Group Policy Objects is parsed
+by ad_gpo_extract_smb_components() which converts backslashes to forward
+slashes but does not reject ".." path traversal sequences. The resulting
+smb_path is used directly in gpo_cache_store_file() to construct a local
+filesystem path under GPO_CACHE_PATH, allowing an attacker with GPO
+write access to write files outside the cache directory.
+
+Due to differential path resolution between libsmbclient (which clamps
+".." at the SMB share root) and the kernel (which resolves ".." fully),
+the SMB download succeeds while the local file write escapes the cache.
+On systems with SELinux enforcing, this enables Kerberos configuration
+injection via /var/lib/sss/pubconf/krb5.include.d/ (sssd_public_t,
+writable by sssd_t). On systems without SELinux, this enables arbitrary
+file writes including cron job injection for root code execution.
+
+This patch adds two layers of defense:
+
+1. Reject ".." as a path component in smb_path at parse time in
+ ad_gpo_extract_smb_components(). Uses component-aware validation
+ that checks for "/..", "../", and exact ".." — not substring matching
+ which would false-positive on legitimate names containing "..".
+
+2. Validate the resolved cache path stays within GPO_CACHE_PATH in
+ gpo_cache_store_file() using realpath(), with a trailing-slash
+ prefix check to prevent prefix-collision attacks (e.g.,
+ /var/lib/sss/gpo_cache_evil/ matching /var/lib/sss/gpo_cache).
+
+Based on the patch by: Ian Murphy <imurphy at redhat.com>
+Amended by: Alexey Tikhonov <atikhono at redhat.com>
+
+:fixes: CVE-2026-14476
+
+Reviewed-by: Sumit Bose <sbose at redhat.com>
+Reviewed-by: Tomáš Halman <thalman at redhat.com>
+---
+ src/providers/ad/ad_gpo.c | 47 +++++++++++++++++++++++++++++++
+ src/providers/ad/ad_gpo_child.c | 49 +++++++++++++++++++++++++++++++++
+ 2 files changed, 96 insertions(+)
+
+diff --git a/src/providers/ad/ad_gpo.c b/src/providers/ad/ad_gpo.c
+index 5c2f117a51c..b8562edc542 100644
+--- a/src/providers/ad/ad_gpo.c
++++ b/src/providers/ad/ad_gpo.c
+@@ -3832,6 +3832,43 @@ ad_gpo_populate_candidate_gpos(TALLOC_CTX *mem_ctx,
+ return ret;
+ }
+
++/*
++ * Check whether a path contains ".." as a path component.
++ * Returns true if traversal is detected, false if the path is safe.
++ *
++ * Checks for:
++ * - "/.." anywhere in the path (component starting with ..)
++ * - "../" at the start of the path
++ * - exact match ".." (path is just "..")
++ * - "/.." at the end of the path
++ *
++ * Does NOT match ".." as a substring of a longer component
++ * (e.g., "my..file" is allowed).
++ */
++static bool gpo_path_has_traversal(const char *path)
++{
++ const char *p;
++
++ if (path == NULL) {
++ return false;
++ }
++
++ /* Exact match */
++ if (strcmp(path, "..") == 0) return true;
++
++ /* Starts with ../ */
++ if (strncmp(path, "../", 3) == 0) return true;
++
++ /* Contains /../ or ends with /.. */
++ p = path;
++ while ((p = strstr(p, "/..")) != NULL) {
++ if (p[3] == '/' || p[3] == '\0') return true;
++ p += 3;
++ }
++
++ return false;
++}
++
+ /*
+ * This function parses the input_path into its components, replaces each
+ * back slash ('\') with a forward slash ('/'), and populates the output params.
+@@ -3908,6 +3945,16 @@ ad_gpo_extract_smb_components(TALLOC_CTX *mem_ctx,
+ goto done;
+ }
+
++ /* Reject path traversal. See function comment for what is matched. */
++ if (gpo_path_has_traversal(smb_path)) {
++ DEBUG(SSSDBG_CRIT_FAILURE,
++ "gPCFileSysPath contains path traversal component '..': "
++ "[%s]. Rejecting to prevent cache directory escape.\n",
++ smb_path);
++ ret = EINVAL;
++ goto done;
++ }
++
+ *_smb_server = talloc_asprintf(mem_ctx, "%s%s",
+ SMB_STANDARD_URI,
+ server_hostname);
+diff --git a/src/providers/ad/ad_gpo_child.c b/src/providers/ad/ad_gpo_child.c
+index b8b47b09e49..db3716fdf02 100644
+--- a/src/providers/ad/ad_gpo_child.c
++++ b/src/providers/ad/ad_gpo_child.c
+@@ -322,6 +322,55 @@ static errno_t gpo_cache_store_file(const char *smb_path,
+ goto done;
+ }
+
++ /* Defense-in-depth: verify the resolved path stays within the cache
++ * directory (when updating existing files). This catches any bypass
++ * of the ".." check in the parser, including encoding tricks, symlink
++ * attacks, or future regressions.
++ *
++ * The trailing-slash comparison prevents prefix-collision attacks:
++ * without it, a path resolving to "/var/lib/sss/gpo_cache_evil/"
++ * would incorrectly match the prefix "/var/lib/sss/gpo_cache".
++ */
++ {
++ char *resolved = realpath(filename, NULL);
++ if (resolved != NULL) {
++ /* Resolve GPO_CACHE_PATH too so the comparison works
++ * even when the cache path contains symlinks. */
++ char *resolved_cache = realpath(GPO_CACHE_PATH, NULL);
++ if (resolved_cache == NULL) {
++ ret = errno;
++ DEBUG(SSSDBG_CRIT_FAILURE,
++ "realpath(\"%s\") failed: [%d][%s]\n",
++ GPO_CACHE_PATH, ret, strerror(ret));
++ free(resolved);
++ goto done;
++ }
++
++ /* Check that resolved path starts with resolved cache + "/" */
++ size_t cache_len = strlen(resolved_cache);
++ bool inside = ((strlen(resolved) >= cache_len) &&
++ (strncmp(resolved, resolved_cache, cache_len) == 0) &&
++ (resolved[cache_len] == '/' || resolved[cache_len] == '\0'));
++ if (!inside) {
++ DEBUG(SSSDBG_CRIT_FAILURE,
++ "GPO cache path escapes cache directory: [%s] "
++ "resolves to [%s] which is outside [%s]. "
++ "Rejecting.\n",
++ filename, resolved, resolved_cache);
++ free(resolved_cache);
++ free(resolved);
++ ret = EINVAL;
++ goto done;
++ }
++ free(resolved_cache);
++ free(resolved);
++ }
++ /* If realpath returns NULL, the path doesn't exist yet.
++ * prepare_gpo_cache() will create it — the mkdir calls
++ * are validated by SELinux MAC policy.
++ */
++ }
++
+ tmp_name = talloc_asprintf(tmp_ctx, "%sXXXXXX", filename);
+ if (tmp_name == NULL) {
+ DEBUG(SSSDBG_CRIT_FAILURE, "talloc_asprintf failed.\n");
=====================================
debian/patches/fix-eol-flaws-in-codefiles.diff
=====================================
@@ -0,0 +1,12 @@
+Description: Fix EOL at EOF flaw to make src/test/whitespace_test happy
+Author: Mike Gabriel <mike.gabriel at das-netzwerkteam.de>
+
+--- a/src/tests/system/data/test_passkey/readme.md
++++ b/src/tests/system/data/test_passkey/readme.md
+@@ -65,4 +65,4 @@
+ Insert your passkey device, then press ENTER.
+ Enter PIN:
+ user1
+-```
+\ No newline at end of file
++```
=====================================
debian/patches/fix-ftbfs-src-m4.diff
=====================================
@@ -0,0 +1,21 @@
+Description: Avoid FTBFS due to unfound Makefile target src/m4.
+Author: Mike Gabriel <mike.gabriel at das-netzwerkteam.de>
+Abstract:
+ Without this patch, the build aborts half-way with below error message
+ ```
+ make[3]: *** No rule to make target 'src/m4', needed by 'all-am'. Stop.
+ make[3]: *** Waiting for unfinished jobs....
+ ```
+
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -1838,8 +1838,7 @@
+ src/examples/logrotate \
+ src/providers/sssd_be.exports \
+ src/sss_client/COPYING \
+- src/sss_client/COPYING.LESSER \
+- src/m4
++ src/sss_client/COPYING.LESSER
+
+ dist_sssddefaultconf_DATA = \
+ src/examples/sssd.conf
=====================================
debian/patches/fix-underlinking-keyutils.diff
=====================================
@@ -0,0 +1,29 @@
+Description: Underlinking fixes for some unit tests (missing: -lkeyutils)
+Author: Mike Gabriel <mike.gabriel at das-netzwerkteam.de>
+
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -3160,6 +3160,7 @@
+ $(SSSD_LIBS) \
+ $(NDR_NBT_LIBS) \
+ $(NDR_KRB5PAC_LIBS) \
++ $(KEYUTILS_LIBS) \
+ $(KRB5_LIBS) \
+ $(SSSD_INTERNAL_LTLIBS) \
+ libsss_idmap.la \
+@@ -3604,6 +3605,7 @@
+ test_ipa_subdom_server_LDADD = \
+ $(CMOCKA_LIBS) \
+ $(SSSD_LIBS) \
++ $(KEYUTILS_LIBS) \
+ $(KRB5_LIBS) \
+ $(OPENLDAP_LIBS) \
+ $(SSSD_INTERNAL_LTLIBS) \
+@@ -4677,6 +4679,7 @@
+ $(SASL_LIBS) \
+ $(DHASH_LIBS) \
+ $(INI_CONFIG_LIBS) \
++ $(KEYUTILS_LIBS) \
+ $(KRB5_LIBS) \
+ $(NDR_NBT_LIBS) \
+ $(NDR_KRB5PAC_LIBS) \
=====================================
debian/patches/fix-whitespace-test.diff
=====================================
@@ -1,13 +1,40 @@
-diff --git a/src/tests/whitespace_test b/src/tests/whitespace_test
-index f055ed4c2..fa95494be 100755
--- a/src/tests/whitespace_test
+++ b/src/tests/whitespace_test
-@@ -16,7 +16,7 @@ fi
+@@ -20,9 +20,21 @@
+ exit 77
+ fi
++# Generate file list that contains files we want to check for whitespace flaws.
++# Ignore generated files. Won't be able to fix that anyway.
++# Ignore compiled translation files (po/*.gmo).
++# Ignore other build craft (such as stamp files).
++# Ignore packaging files (such as debian/*).
++# Ignore umockdev.script.* files (binary files).
++# Ignore cert + key files.
++# Ignore passkey mapping files.
++filelist=$(cd ${GIT_WORK_TREE} && git ls-files | grep -v -E '((|.*/)Makefile.in(|.in)|aclocal.m4|po/(.*\.gmo|stamp-po)|.*/umockdev\.script.*|.*/certificate|.*/public_keys|.*/passkey-mapping.*|debian/.*)')
++
{
# Look for lines with trailing whitespace in all files tracked by Git
- git grep -n -I '\s\+$' -- "$(git rev-parse --show-toplevel)" ||
-+ git grep --full-name -n -I '\s\+$' -- "$(git rev-parse --show-toplevel)" ||
++ cd ${GIT_WORK_TREE}
++ git grep --full-name \
++ -n -I '\s\+$' -- ${filelist} ||
# Don't fail if no such lines were found anywhere
[[ $? == 1 ]]
} |
+@@ -43,12 +55,12 @@
+ "
+
+ declare found_file=false
+-while read file; do
++for file in ${filelist}; do
+ [[ $file == "src/config/testconfigs/noparse.api.conf" ]] && continue
+ test `tail -c 1 $ABS_TOP_SRCDIR/$file` && \
+ echo "Missing new line at the eof: $file" && \
+ found_file=true
+-done < <(git ls-files)
++done
+
+ if $found_file; then
+ exit 1
=====================================
debian/patches/series
=====================================
@@ -1,2 +1,8 @@
fix-whitespace-test.diff
default-to-socket-activated-services.diff
+fix-ftbfs-src-m4.diff
+fix-underlinking-keyutils.diff
+fix-eol-flaws-in-codefiles.diff
+CVE-2026-12610.diff
+CVE-2026-14474.diff
+CVE-2026-14476.diff
View it on GitLab: https://salsa.debian.org/sssd-team/sssd/-/compare/ec28a053fa0140ac89eb3d33ff00e5aba74ad9c6...b30fbccb65846e4fef97b06b7cb547e0976f2c9b
--
View it on GitLab: https://salsa.debian.org/sssd-team/sssd/-/compare/ec28a053fa0140ac89eb3d33ff00e5aba74ad9c6...b30fbccb65846e4fef97b06b7cb547e0976f2c9b
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/pkg-sssd-devel/attachments/20260904/6c54f92e/attachment-0001.htm>
More information about the Pkg-sssd-devel
mailing list