Hi Fedora developers,
My name is Sheng Mao and I am applying to be a new packager [0]. I am applying to be the
maintainer of package "Fossil" [1]. There are two reasons for this application:
1. Current Fossil stays on version 2.8 (Feb 2019). But it suffers FTBFS [2] since Aug 3,
2020. The deadline is Sept 28, 2020. The project is about to be orphaned and retired.
2. Upstream Fossil (< 2.10.2, < 2.11.2, < 2.12.1) [5] is vulnerable to
CVE-2020-24614 [3]. Current latest stable of Fossil (2.12.1) has a fix. But Fossil in
Fedora still doesn't have the fix [4].
I have made a pull request [6] to address these two issues. This new version requires the
dependency, SQLite-devel, being built with FTS4. The patch for SQLite to enable FTS4 is
merged and the package is distributed to stable repo [7]. I have tested the build with
copr [8].
I am new to RPM and Fedora packaging and I will do my best to deliver high quality code.
Comments and suggestions from the community will be my best help.
Thank you!
Sheng (ivzhh)
Links:
[0] My self-introduction email:
https://lists.fedoraproject.org/archives/list/fedora-join@lists.fedorapro...
[1] Fedora Package Sources:
https://src.fedoraproject.org/rpms/fossil
[2] Bug 1863577 - fossil: FTBFS in Fedora rawhide/f33:
https://bugzilla.redhat.com/show_bug.cgi?id=1863577
[3] Bug 1870790 - CVE-2020-24614 fossil: allows remote authenticated users to execute
arbitrary code:
https://bugzilla.redhat.com/show_bug.cgi?id=1870790
[4] Bug 1870789 (CVE-2020-24614) - CVE-2020-24614 fossil: allows remote authenticated
users to execute arbitrary code:
https://bugzilla.redhat.com/show_bug.cgi?id=1870789
[5] Fossil 2.12.1 Release Note:
https://fossil-scm.org/home/doc/trunk/www/changes.wiki#v2_12
[6] Upgrade to fossil 2.12.1 after adding FTS4 to system-wide sqlite (rhbz#1887106):
https://src.fedoraproject.org/rpms/fossil/pull-request/1
[7] Enable FTS4 extensions (rhbz#1887106):
https://src.fedoraproject.org/rpms/sqlite/c/f098d15dcf04f6ef5c6e5fa63db63...
[8] copr build:
https://copr.fedorainfracloud.org/coprs/ivzhh/fossil-2.12.1/