code:
Create a shared version of the MUMPS library.

Index: mumps/src/Makefile
===================================================================
--- mumps.orig/src/Makefile
+++ mumps/src/Makefile
@@ -23,8 +23,10 @@ z:

 include $(topdir)/Makefile.inc

-mumps_lib:    $(libdir)/libmumps_common$(PLAT)$(LIBEXT) \
-              $(libdir)/lib$(ARITH)mumps$(PLAT)$(LIBEXT)
+mumps_lib:    $(libdir)/libmumps_common$(PLAT).a \
+              $(libdir)/libmumps_common$(PLAT).so \
+              $(libdir)/lib$(ARITH)mumps$(PLAT).a \
+              $(libdir)/lib$(ARITH)mumps$(PLAT).so

 OBJS_COMMON_MOD = \
         lr_common.o \
@@ -167,14 +169,22 @@ OBJS_OTHER = \
         $(ARITH)tools.o\
         $(ARITH)type3_root.o

-$(libdir)/libmumps_common$(PLAT)$(LIBEXT):      $(OBJS_COMMON_MOD) $(OBJS_COMMON_OTHER)
-	$(AR)$@ $?
+$(libdir)/libmumps_common$(PLAT).a:      $(OBJS_COMMON_MOD) $(OBJS_COMMON_OTHER)
+	$(AR) $@ $?
 	$(RANLIB) $@

-$(libdir)/lib$(ARITH)mumps$(PLAT)$(LIBEXT):    $(OBJS_MOD) $(OBJS_OTHER)
-	$(AR)$@ $?
+$(libdir)/libmumps_common$(PLAT).so:      $(OBJS_COMMON_MOD) $(OBJS_COMMON_OTHER)
+	$(FC) -shared $^ -Wl,-soname,libmumps_common$(PLAT)-5.2.1.so -L$(libdir) $(LORDERINGS) -lpthread $(MPIFLIB) $(MPICLIB) $(LEXTRAS) -o $(libdir)/libmumps_common$(PLAT)-5.2.1.so -Wl,-z,defs
+	ln -s libmumps_common$(PLAT)-5.2.1.so $@
+
+$(libdir)/lib$(ARITH)mumps$(PLAT).a:    $(OBJS_MOD) $(OBJS_OTHER)
+	$(AR) $@ $?
 	$(RANLIB) $@

+$(libdir)/lib$(ARITH)mumps$(PLAT).so:    $(OBJS_MOD) $(OBJS_OTHER)
+	$(FC) -shared $^ -Wl,-soname,lib$(ARITH)mumps$(PLAT)-5.2.1.so -L$(libdir) -lmumps_common$(PLAT) $(LORDERINGS) $(MPIFLIB) $(LEXTRAS) $(LIBBLAS) $(SCALAP) $(LAPACK) -o $(libdir)/lib$(ARITH)mumps$(PLAT)-5.2.1.so -Wl,-z,defs
+	ln -s lib$(ARITH)mumps$(PLAT)-5.2.1.so $@
+
 # Dependencies between modules:
 $(ARITH)mumps_load.o:		$(ARITH)mumps_comm_buffer.o \
 				$(ARITH)mumps_struc_def.o \
@@ -290,13 +300,13 @@ $(OBJS_OTHER):$(OBJS_COMMON_MOD) $(OBJS_

 .SUFFIXES: .c .F .o
 .F.o:
-	$(FC) $(OPTF) $(INCS) $(IORDERINGSF) $(ORDERINGSF) -I. -I../include -c $*.F $(OUTF)$*.o
+	$(FC) $(OPTF) $(INCS) $(IORDERINGSF) $(ORDERINGSF) -I. -I../include -fPIC -c $*.F $(OUTF)$*.o
 .c.o:
-	$(CC) $(OPTC) $(INCS) -I../include $(CDEFS) $(IORDERINGSC) $(ORDERINGSC) -c $*.c $(OUTC)$*.o
+	$(CC) $(OPTC) $(INCS) -I../include $(CDEFS) $(IORDERINGSC) $(ORDERINGSC) -fPIC -c $*.c $(OUTC)$*.o

 $(ARITH)mumps_c.o:	mumps_c.c
 	$(CC) $(OPTC) $(INCS) $(CDEFS) -DMUMPS_ARITH=MUMPS_ARITH_$(ARITH) \
-	      $(IORDERINGSC) $(ORDERINGSC) -I../include -c mumps_c.c $(OUTC)$@
+	      $(IORDERINGSC) $(ORDERINGSC) -I../include -fPIC -c mumps_c.c $(OUTC)$@

 clean:


code:
Create static and shared versions of the PORD library.

Index: mumps/PORD/lib/Makefile
===================================================================
--- mumps.orig/PORD/lib/Makefile
+++ mumps/PORD/lib/Makefile
@@ -9,7 +9,7 @@

 INCLUDES = -I../include

-COPTIONS = $(INCLUDES) $(CFLAGS) $(OPTFLAGS)
+COPTIONS = $(INCLUDES) $(CFLAGS) $(OPTFLAGS) -fPIC

 OBJS = graph.o gbipart.o gbisect.o ddcreate.o ddbisect.o nestdiss.o \
        multisector.o gelim.o bucket.o tree.o \
@@ -24,12 +24,16 @@ OBJS = graph.o gbipart.o gbisect.o ddcre
 .c.o:
 	$(CC) $(COPTIONS) -c $*.c $(OUTC)$*.o

-libpord$(LIBEXT):$(OBJS)
-	$(AR)$@ $(OBJS)
+libpord$(PLAT).a:$(OBJS)
+	$(AR) $@ $(OBJS)
 	$(RANLIB) $@

+libpord$(PLAT).so: $(OBJS)
+	$(CC) -shared $(OBJS) -Wl,-soname,libpord$(PLAT)-5.2.1.so -o libpord$(PLAT)-5.2.1.so -Wl,-z,defs
+	ln -s libpord$(PLAT)-5.2.1.so $@
+
 clean:
 	rm -f *.o

 realclean:
-	rm -f *.o libpord.a
+	rm -f *.o libpord*.a *.so
Index: mumps/Makefile
===================================================================
--- mumps.orig/Makefile
+++ mumps/Makefile
@@ -54,7 +54,7 @@ dexamples:	d
 multi_example:	s d c z
 	(cd examples ; $(MAKE) multi)

-requiredobj: Makefile.inc $(LIBSEQNEEDED) $(libdir)/libpord$(PLAT)$(LIBEXT)
+requiredobj: Makefile.inc $(LIBSEQNEEDED) $(libdir)/libpord$(PLAT).a $(libdir)/libpord$(PLAT).so

 # dummy MPI library (sequential version)

@@ -62,19 +62,25 @@ libseqneeded:
 	(cd libseq; $(MAKE))

 # Build the libpord.a library and copy it into $(topdir)/lib
-$(libdir)/libpord$(PLAT)$(LIBEXT):
+$(libdir)/libpord$(PLAT).a:
 	if [ "$(LPORDDIR)" != "" ] ; then \
 	  cd $(LPORDDIR); \
 	  $(MAKE) CC="$(CC)" CFLAGS="$(OPTC)" AR="$(AR)" RANLIB="$(RANLIB)" OUTC="$(OUTC)" LIBEXT=$(LIBEXT); \
 	fi;
 	if [ "$(LPORDDIR)" != "" ] ; then \
-	  cp $(LPORDDIR)/libpord$(LIBEXT) $@; \
+	  cp $(LPORDDIR)/libpord$(PLAT).a $@; \
 	fi;

+$(libdir)/libpord$(PLAT).so:
+	if [ "$(LPORDDIR)" != "" ] ; then \
+	cd $(LPORDDIR); make CC="$(CC)" CFLAGS="$(OPTC)" AR="$(AR)" ARFUNCT= RANLIB="$(RANLIB)" libpord$(PLAT).so; fi;
+	if [ "$(LPORDDIR)" != "" ] ; then \
+	cp -a $(LPORDDIR)/libpord*.so lib/; fi;
+
 clean:
 	(cd src; $(MAKE) clean)
 	(cd examples; $(MAKE) clean)
-	(cd $(libdir); $(RM) *$(PLAT)$(LIBEXT))
+	(cd $(libdir); $(RM) *$(PLAT).a *$(PLAT).so)
 	(cd libseq; $(MAKE) clean)
 	if [ "$(LPORDDIR)" != "" ] ; then \
 	  cd $(LPORDDIR); $(MAKE) realclean; \

repo_name: maximed/guix

license: mit


code:
This patch came from https://git.ghostscript.com/?p=mupdf.git;a=patch;h=cee7cefc610d42fd383b3c80c12cbc675443176a
and fixes CVE-2021-3407.

From cee7cefc610d42fd383b3c80c12cbc675443176a Mon Sep 17 00:00:00 2001
From: Robin Watts <Robin.Watts@artifex.com>
Date: Fri, 22 Jan 2021 17:05:15 +0000
Subject: [PATCH] Bug 703366: Fix double free of object during linearization.

This appears to happen because we parse an illegal object from
a broken file and assign it to object 0, which is defined to
be free.

Here, we fix the parsing code so this can't happen.
---
 source/pdf/pdf-parse.c | 6 ++++++
 source/pdf/pdf-xref.c  | 2 ++
 2 files changed, 8 insertions(+)

diff --git a/source/pdf/pdf-parse.c b/source/pdf/pdf-parse.c
index 7abc8c3d4..5761c3351 100644
--- a/source/pdf/pdf-parse.c
+++ b/source/pdf/pdf-parse.c
@@ -749,6 +749,12 @@ pdf_parse_ind_obj(fz_context *ctx, pdf_document *doc,
 		fz_throw(ctx, FZ_ERROR_SYNTAX, "expected generation number (%d ? obj)", num);
 	}
 	gen = buf->i;
+	if (gen < 0 || gen >= 65536)
+	{
+		if (try_repair)
+			*try_repair = 1;
+		fz_throw(ctx, FZ_ERROR_SYNTAX, "invalid generation number (%d)", gen);
+	}

 	tok = pdf_lex(ctx, file, buf);
 	if (tok != PDF_TOK_OBJ)
diff --git a/source/pdf/pdf-xref.c b/source/pdf/pdf-xref.c
index 1b2bdcd59..30197b4b8 100644
--- a/source/pdf/pdf-xref.c
+++ b/source/pdf/pdf-xref.c
@@ -1190,6 +1190,8 @@ pdf_read_new_xref(fz_context *ctx, pdf_document *doc, pdf_lexbuf *buf)
 	{
 		ofs = fz_tell(ctx, doc->file);
 		trailer = pdf_parse_ind_obj(ctx, doc, doc->file, buf, &num, &gen, &stm_ofs, NULL);
+		if (num == 0)
+			fz_throw(ctx, FZ_ERROR_GENERIC, "Trailer object number cannot be 0\n");
 	}
 	fz_catch(ctx)
 	{
--
2.17.1


code:
From: Tobias Geerinckx-Rice <me@tobias.gr>
Date: Tue, 24 Nov 2020 10:29:28 +0000
Subject: [PATCH] gnu: mupdf: Fix linkage.

Replace broken linkage to ‘build/shared-release/libmupdf.so’ with the
proper ‘-L$(libdir) -lmupdf’ incantation, and fix libmupdf.so's mode.

--- mupdf-1.18.0-source.org/Makefile
+++ mupdf-1.18.0-source/Makefile
@@ -61,7 +61,7 @@
 ifdef RANLIB
   RANLIB_CMD = $(QUIET_RANLIB) $(RANLIB) $@
 endif
-LINK_CMD = $(QUIET_LINK) $(MKTGTDIR) ; $(CC) $(LDFLAGS) -o $@ $^ $(LIBS)
+LINK_CMD = $(QUIET_LINK) $(MKTGTDIR) ; $(CC) $(LDFLAGS) -o $@ $(subst $(MUPDF_LIB),-L$(libdir) -L$(OUT) -lmupdf,$^) $(LIBS)
 TAGS_CMD = $(QUIET_TAGS) ctags -R --c-kinds=+p
 WINDRES_CMD = $(QUIET_WINDRES) $(MKTGTDIR) ; $(WINDRES) $< $@
 OBJCOPY_CMD = $(QUIET_OBJCOPY) $(MKTGTDIR) ; $(LD) -r -b binary -z noexecstack -o $@ $<
@@ -364,7 +364,7 @@ install: libs apps
 	install -m 644 include/mupdf/pdf/*.h $(DESTDIR)$(incdir)/mupdf/pdf

 	install -d $(DESTDIR)$(libdir)
-	install -m 644 $(INSTALL_LIBS) $(DESTDIR)$(libdir)
+	install -m 755 $(INSTALL_LIBS) $(DESTDIR)$(libdir)

 	install -d $(DESTDIR)$(bindir)
 	install -m 755 $(TOOL_APPS) $(VIEW_APPS) $(DESTDIR)$(bindir)


code:
Mupen64Plus supports a single data directory and a single plugin directory in
its configuration, yet we need data and plugin files from a variety of
packages.  The best way to deal with this is to install all packages from
which data and plugin files are needed into one's profile, and point the
configuration there.  Hence, the ui-console package provides propagated inputs
for packages with the most important data and plugin files, and this patch
provides the user instructions on what needs to be done in order to have
Mupen64Plus find the relevant data and plugins.

--- a/src/plugin.c
+++ b/src/plugin.c
@@ -122,6 +122,22 @@ m64p_error PluginSearchLoad(m64p_handle ConfigUI)
     {
         const char *plugindir = (*ConfigGetParamString)(ConfigUI, "PluginDir");
         lib_filelist = osal_library_search(plugindir);
+        /* Guix specific */
+        if (lib_filelist == NULL)
+        {
+            DebugMessage(M64MSG_ERROR, "No plugins found in PluginDir path: %s", plugindir);
+            DebugMessage(M64MSG_ERROR,
+                         "\n\n"
+                         "*********************************\n"
+                         "*** Notice for GNU Guix users ***\n"
+                         "*********************************\n"
+                         "\n"
+                         "You might want to edit your mupen64plus.cfg (in $XDG_CONFIG_HOME by default)\n"
+                         "and set SharedDataPath to /path/to/my_guix_profile/share/mupen64plus and\n"
+                         "PluginDir to /path/to/my_guix_profile/lib/mupen64plus so that data and plugins\n"
+                         "are found.\n"
+                         "\n");
+        }
     }

     /* if still no plugins found, search some common system folders */


code:
From 21507b3600c616bca7049004eb518cf11f45f299 Mon Sep 17 00:00:00 2001
From: "Anthony J. Bentley" <anthony@cathet.us>
Date: Sun, 7 Jun 2015 02:41:28 -0600
Subject: [PATCH] Correct the path to the GLEW header.

---
 src/glshader.cpp | 2 +-
 src/rgl.h        | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/glshader.cpp b/src/glshader.cpp
index 4729945..a8947ea 100644
--- a/src/glshader.cpp
+++ b/src/glshader.cpp
@@ -23,7 +23,7 @@
 #include <stdio.h>
 #include <string.h>
 #include "rgl_assert.h"
-#include <glew.h>
+#include <GL/glew.h>
 #if defined(__MACOSX__)
 #include <OpenGL/gl.h>
 #include <OpenGL/glext.h>
diff --git a/src/rgl.h b/src/rgl.h
index c15f93f..1748406 100644
--- a/src/rgl.h
+++ b/src/rgl.h
@@ -26,7 +26,7 @@
 #include "rgl_assert.h"
 #include "rdp.h"

-#include <glew.h>
+#include <GL/glew.h>
 #if defined(__MACOSX__)
 #include <OpenGL/gl.h>
 #elif defined(__MACOS__)


code:
Disable locales other than C and POSIX because of a compilation error.
By Danny Milosavljevic <dannym@scratchpost.org>
This patch is distributed under BSD-3 license.
See https://github.com/osresearch/heads/pull/610
diff -ruN b/source/patches/gcc-5.3.0-locale.diff guix-build-musl-cross-0.1-3.a8a6649.drv-12/source/patches/gcc-5.3.0-locale.diff
--- a/patches/gcc-5.3.0-locale.diff	1970-01-01 01:00:00.000000000 +0100
+++ b/patches/gcc-5.3.0-locale.diff	2020-05-02 14:20:47.213564509 +0200
@@ -0,0 +1,12 @@
+--- gcc-5.3.0/libstdc++-v3/config/locale/gnu/ctype_members.cc.orig	2020-05-02 14:16:31.376147000 +0200
++++ gcc-5.3.0/libstdc++-v3/config/locale/gnu/ctype_members.cc	2020-05-02 14:16:56.716279576 +0200
+@@ -47,7 +47,8 @@
+ 	this->_S_create_c_locale(this->_M_c_locale_ctype, __s);
+ 	this->_M_toupper = this->_M_c_locale_ctype->__ctype_toupper;
+ 	this->_M_tolower = this->_M_c_locale_ctype->__ctype_tolower;
+-	this->_M_table = this->_M_c_locale_ctype->__ctype_b;
++	//this->_M_table = this->_M_c_locale_ctype->__ctype_b;
++	throw 3;
+       }
+   }
+


code:
By default 'mutt' embeds configure flags and the output of 'gcc -v',
which contains the store file name of Bash and GCC.  This patch makes
sure we don't embed a reference to these in 'mutt'.

diff --git a/txt2c.sh b/txt2c.sh
index f634bb9..53845cf 100755
--- a/txt2c.sh
+++ b/txt2c.sh
@@ -21,6 +21,8 @@ txt2c_fallback () {
 	echo ";"
 }

+echo "unsigned char $1[] = \"value of '$1' not kept\";"
+exit 0
 if ./txt2c test </dev/null >/dev/null 2>&1; then
     ./txt2c "$1"
 else


code:
Patch taken from Debian sid.  Adapted to 4.2.4.6 for Guix by Tobias
Geerinckx-Rice <me@tobias.gr>.

Description: Support uncompressing and compressing soft links.
 Historically, ncompress for Debian has been built using a command line
 directly in debian/rules.  For 4.2.4.5-1, I simplified by swtching to the
 upstream Makefile.  However, that caused a regression - the Debian version of
 ncompress has always successfully handled soft links, but this stopped
 working.  To revert to the original behavior, I need to remove -DLSTAT from
 the build options, to be consistent with how the code was previously built.
Author: Kenneth J. Pronovici <pronovic@debian.org>
Bug-Debian: http://bugs.debian.org/918836
Index: ncompress/GNUmakefile
===================================================================
--- ncompress.orig/GNUmakefile
+++ ncompress/GNUmakefile
@@ -9,7 +9,7 @@ distclean: cleanup

 Makefile: Makefile.def GNUmakefile
 	sed \
-		-e 's:options= :options= -DUTIME_H -DLSTAT :' \
+		-e 's:options= :options= -DUTIME_H :' \
 		Makefile.def > Makefile

 check:


code:
--- a/libdispatch/derror.c
+++ b/libdispatch/derror.c
@@ -13,7 +13,7 @@
 #endif

 /** @internal The version string for the library, used by
  * nc_inq_libvers(). */
-static const char nc_libvers[] = PACKAGE_VERSION " of "__DATE__" "__TIME__" $";
+static const char nc_libvers[] = PACKAGE_VERSION " $";

 /**


code:
From: Tobias Geerinckx-Rice <me@tobias.gr>
Date: Thu, 28 Feb 2019 20:29:00 +0100
Subject: [PATCH] netpbm: Fix CVE-2017-2586.

Copied verbatim from Debian[0].

[0]: https://sources.debian.org/data/main/n/netpbm-free/2:10.78.05-0.1/debian/patches/netpbm-CVE-2017-2586.patch

---
diff -urNp old/converter/other/svgtopam.c new/converter/other/svgtopam.c
--- old/converter/other/svgtopam.c	2017-02-08 12:11:02.593690917 +0100
+++ new/converter/other/svgtopam.c	2017-02-08 12:13:05.192846469 +0100
@@ -676,7 +676,7 @@ stringToUint(const char *   const string

     /* TODO: move this to nstring.c */

-    if (strlen(string) == 0)
+    if (string == NULL || strlen(string) == 0)
         pm_asprintf(errorP, "Value is a null string");
     else {
         char * tailptr;


code:
From: Tobias Geerinckx-Rice <me@tobias.gr>
Date: Thu, 28 Feb 2019 20:29:00 +0100
Subject: [PATCH] netpbm: Fix CVE-2017-2587.

Copied verbatim from Debian[0].

[0]: https://sources.debian.org/data/main/n/netpbm-free/2:10.78.05-0.1/debian/patches/netpbm-CVE-2017-2587.patch

---
diff -urNp old/converter/other/svgtopam.c new/converter/other/svgtopam.c
--- old/converter/other/svgtopam.c	2017-02-08 12:11:02.593690917 +0100
+++ new/converter/other/svgtopam.c	2017-02-08 13:49:38.319029371 +0100
@@ -771,12 +771,17 @@ createCanvas(unsigned int const width,

     MALLOCVAR_NOFAIL(canvasP);

-    canvasP->width  = width;
-    canvasP->height = height;
-    canvasP->pixels = ppm_allocarray(width, height);
-    canvasP->maxval = maxval;
+    if(canvasP != NULL){
+        canvasP->width  = width;
+        canvasP->height = height;
+        canvasP->pixels = ppm_allocarray(width, height);
+        canvasP->maxval = maxval;
+
+        *canvasPP = canvasP;
+    } else {
+       pm_error("can't allocate memory for canvas");
+    }

-    *canvasPP = canvasP;
 }


code:
Increase the timeout on dictionary tests to accommodate slower machines.

--- netsurf-3.6/test/hashtable.c
+++ netsurf-3.6/test/hashtable.c
@@ -286,6 +286,7 @@
 	tcase_add_checked_fixture(tc_dict_s,
 				  dicts_hashtable_create,
 				  dict_hashtable_teardown);
+	tcase_set_timeout(tc_dict_s, 30);

 	tcase_add_test(tc_dict_s, hashtable_dict_test);

@@ -297,6 +298,7 @@
 	tcase_add_checked_fixture(tc_dict_l,
 				  dictl_hashtable_create,
 				  dict_hashtable_teardown);
+	tcase_set_timeout(tc_dict_l, 30);

 	tcase_add_test(tc_dict_l, hashtable_dict_test);


code:
Fix include directory for system utf8proc.

--- netsurf-3.10/utils/idna.c
+++ netsurf-3.10/utils/idna.c
@@ -167,7 +167,7 @@

 #ifdef WITH_UTF8PROC

-#include <libutf8proc/utf8proc.h>
+#include <utf8proc.h>

 int32_t idna_contexto[] = {
 	/* CONTEXTO codepoints which have a rule defined */


code:
Copied from upstream nettle git repository.
Removed changes to ChangeLog, to allow this patch to apply to nettle-3.5.

From 485b5e2820a057e873b1ba812fdb39cae4adf98c Mon Sep 17 00:00:00 2001
From: Niels Möller <nisse@lysator.liu.se>
Date: Mon, 17 May 2021 20:55:26 +0200
Subject: [PATCH 1/2] Change _rsa_sec_compute_root_tr to take a fix input size.

Improves consistency with _rsa_sec_compute_root, and fixes zero-input bug.
---
 ChangeLog                    | 15 +++++++++
 rsa-decrypt-tr.c             |  7 ++---
 rsa-internal.h               |  4 +--
 rsa-sec-decrypt.c            |  9 ++++--
 rsa-sign-tr.c                | 61 +++++++++++++++++-------------------
 testsuite/rsa-encrypt-test.c | 14 ++++++++-
 6 files changed, 68 insertions(+), 42 deletions(-)

diff --git a/rsa-decrypt-tr.c b/rsa-decrypt-tr.c
index 0224c0b7..927a8915 100644
--- a/rsa-decrypt-tr.c
+++ b/rsa-decrypt-tr.c
@@ -52,14 +52,13 @@ rsa_decrypt_tr(const struct rsa_public_key *pub,
   mp_size_t key_limb_size;
   int res;

-  key_limb_size = NETTLE_OCTET_SIZE_TO_LIMB_SIZE(key->size);
+  key_limb_size = mpz_size(pub->n);

   TMP_GMP_ALLOC (m, key_limb_size);
   TMP_GMP_ALLOC (em, key->size);
+  mpz_limbs_copy(m, gibberish, key_limb_size);

-  res = _rsa_sec_compute_root_tr (pub, key, random_ctx, random, m,
-				  mpz_limbs_read(gibberish),
-				  mpz_size(gibberish));
+  res = _rsa_sec_compute_root_tr (pub, key, random_ctx, random, m, m);

   mpn_get_base256 (em, key->size, m, key_limb_size);

diff --git a/rsa-internal.h b/rsa-internal.h
index b828e451..f66a7df0 100644
--- a/rsa-internal.h
+++ b/rsa-internal.h
@@ -78,11 +78,11 @@ _rsa_sec_compute_root(const struct rsa_private_key *key,
                       mp_limb_t *scratch);

 /* Safe side-channel silent variant, using RSA blinding, and checking the
- * result after CRT. */
+ * result after CRT. In-place calls, with x == m, is allowed. */
 int
 _rsa_sec_compute_root_tr(const struct rsa_public_key *pub,
 			 const struct rsa_private_key *key,
 			 void *random_ctx, nettle_random_func *random,
-			 mp_limb_t *x, const mp_limb_t *m, size_t mn);
+			 mp_limb_t *x, const mp_limb_t *m);

 #endif /* NETTLE_RSA_INTERNAL_H_INCLUDED */
diff --git a/rsa-sec-decrypt.c b/rsa-sec-decrypt.c
index 6866e7c8..fc4757a0 100644
--- a/rsa-sec-decrypt.c
+++ b/rsa-sec-decrypt.c
@@ -58,9 +58,12 @@ rsa_sec_decrypt(const struct rsa_public_key *pub,
   TMP_GMP_ALLOC (m, mpz_size(pub->n));
   TMP_GMP_ALLOC (em, key->size);

-  res = _rsa_sec_compute_root_tr (pub, key, random_ctx, random, m,
-				  mpz_limbs_read(gibberish),
-				  mpz_size(gibberish));
+  /* We need a copy because m can be shorter than key_size,
+   * but _rsa_sec_compute_root_tr expect all inputs to be
+   * normalized to a key_size long buffer length */
+  mpz_limbs_copy(m, gibberish, mpz_size(pub->n));
+
+  res = _rsa_sec_compute_root_tr (pub, key, random_ctx, random, m, m);

   mpn_get_base256 (em, key->size, m, mpz_size(pub->n));

diff --git a/rsa-sign-tr.c b/rsa-sign-tr.c
index f824c4ca..9e137c7a 100644
--- a/rsa-sign-tr.c
+++ b/rsa-sign-tr.c
@@ -131,35 +131,34 @@ int
 _rsa_sec_compute_root_tr(const struct rsa_public_key *pub,
 			 const struct rsa_private_key *key,
 			 void *random_ctx, nettle_random_func *random,
-			 mp_limb_t *x, const mp_limb_t *m, size_t mn)
+			 mp_limb_t *x, const mp_limb_t *m)
 {
+  mp_size_t nn;
   mpz_t mz;
   mpz_t xz;
   int res;

-  mpz_init(mz);
   mpz_init(xz);

-  mpn_copyi(mpz_limbs_write(mz, mn), m, mn);
-  mpz_limbs_finish(mz, mn);
+  nn = mpz_size (pub->n);

-  res = rsa_compute_root_tr(pub, key, random_ctx, random, xz, mz);
+  res = rsa_compute_root_tr(pub, key, random_ctx, random, xz,
+			    mpz_roinit_n(mz, m, nn));

   if (res)
-    mpz_limbs_copy(x, xz, mpz_size(pub->n));
+    mpz_limbs_copy(x, xz, nn);

-  mpz_clear(mz);
   mpz_clear(xz);
   return res;
 }
 #else
 /* Blinds m, by computing c = m r^e (mod n), for a random r. Also
-   returns the inverse (ri), for use by rsa_unblind. */
+   returns the inverse (ri), for use by rsa_unblind. Must have c != m,
+   no in-place operation.*/
 static void
 rsa_sec_blind (const struct rsa_public_key *pub,
                void *random_ctx, nettle_random_func *random,
-               mp_limb_t *c, mp_limb_t *ri, const mp_limb_t *m,
-               mp_size_t mn)
+               mp_limb_t *c, mp_limb_t *ri, const mp_limb_t *m)
 {
   const mp_limb_t *ep = mpz_limbs_read (pub->e);
   const mp_limb_t *np = mpz_limbs_read (pub->n);
@@ -177,15 +176,15 @@ rsa_sec_blind (const struct rsa_public_key *pub,

   /* c = m*(r^e) mod n */
   itch = mpn_sec_powm_itch(nn, ebn, nn);
-  i2 = mpn_sec_mul_itch(nn, mn);
+  i2 = mpn_sec_mul_itch(nn, nn);
   itch = MAX(itch, i2);
-  i2 = mpn_sec_div_r_itch(nn + mn, nn);
+  i2 = mpn_sec_div_r_itch(2*nn, nn);
   itch = MAX(itch, i2);
   i2 = mpn_sec_invert_itch(nn);
   itch = MAX(itch, i2);

-  TMP_GMP_ALLOC (tp, nn + mn + itch);
-  scratch = tp + nn + mn;
+  TMP_GMP_ALLOC (tp, 2*nn  + itch);
+  scratch = tp + 2*nn;

   /* ri = r^(-1) */
   do
@@ -198,9 +197,8 @@ rsa_sec_blind (const struct rsa_public_key *pub,
   while (!mpn_sec_invert (ri, tp, np, nn, 2 * nn * GMP_NUMB_BITS, scratch));

   mpn_sec_powm (c, rp, nn, ep, ebn, np, nn, scratch);
-  /* normally mn == nn, but m can be smaller in some cases */
-  mpn_sec_mul (tp, c, nn, m, mn, scratch);
-  mpn_sec_div_r (tp, nn + mn, np, nn, scratch);
+  mpn_sec_mul (tp, c, nn, m, nn, scratch);
+  mpn_sec_div_r (tp, 2*nn, np, nn, scratch);
   mpn_copyi(c, tp, nn);

   TMP_GMP_FREE (r);
@@ -208,7 +206,7 @@ rsa_sec_blind (const struct rsa_public_key *pub,
   TMP_GMP_FREE (tp);
 }

-/* m = c ri mod n */
+/* m = c ri mod n. Allows x == c. */
 static void
 rsa_sec_unblind (const struct rsa_public_key *pub,
                  mp_limb_t *x, mp_limb_t *ri, const mp_limb_t *c)
@@ -299,7 +297,7 @@ int
 _rsa_sec_compute_root_tr(const struct rsa_public_key *pub,
 			 const struct rsa_private_key *key,
 			 void *random_ctx, nettle_random_func *random,
-			 mp_limb_t *x, const mp_limb_t *m, size_t mn)
+			 mp_limb_t *x, const mp_limb_t *m)
 {
   TMP_GMP_DECL (c, mp_limb_t);
   TMP_GMP_DECL (ri, mp_limb_t);
@@ -307,7 +305,7 @@ _rsa_sec_compute_root_tr(const struct rsa_public_key *pub,
   size_t key_limb_size;
   int ret;

-  key_limb_size = NETTLE_OCTET_SIZE_TO_LIMB_SIZE(key->size);
+  key_limb_size = mpz_size(pub->n);

   /* mpz_powm_sec handles only odd moduli. If p, q or n is even, the
      key is invalid and rejected by rsa_private_key_prepare. However,
@@ -321,19 +319,18 @@ _rsa_sec_compute_root_tr(const struct rsa_public_key *pub,
     }

   assert(mpz_size(pub->n) == key_limb_size);
-  assert(mn <= key_limb_size);

   TMP_GMP_ALLOC (c, key_limb_size);
   TMP_GMP_ALLOC (ri, key_limb_size);
   TMP_GMP_ALLOC (scratch, _rsa_sec_compute_root_itch(key));

-  rsa_sec_blind (pub, random_ctx, random, x, ri, m, mn);
+  rsa_sec_blind (pub, random_ctx, random, c, ri, m);

-  _rsa_sec_compute_root(key, c, x, scratch);
+  _rsa_sec_compute_root(key, x, c, scratch);

-  ret = rsa_sec_check_root(pub, c, x);
+  ret = rsa_sec_check_root(pub, x, c);

-  rsa_sec_unblind(pub, x, ri, c);
+  rsa_sec_unblind(pub, x, ri, x);

   cnd_mpn_zero(1 - ret, x, key_limb_size);

@@ -357,17 +354,17 @@ rsa_compute_root_tr(const struct rsa_public_key *pub,
 		    mpz_t x, const mpz_t m)
 {
   TMP_GMP_DECL (l, mp_limb_t);
+  mp_size_t nn = mpz_size(pub->n);
   int res;

-  mp_size_t l_size = NETTLE_OCTET_SIZE_TO_LIMB_SIZE(key->size);
-  TMP_GMP_ALLOC (l, l_size);
+  TMP_GMP_ALLOC (l, nn);
+  mpz_limbs_copy(l, m, nn);

-  res = _rsa_sec_compute_root_tr (pub, key, random_ctx, random, l,
-				  mpz_limbs_read(m), mpz_size(m));
+  res = _rsa_sec_compute_root_tr (pub, key, random_ctx, random, l, l);
   if (res) {
-    mp_limb_t *xp = mpz_limbs_write (x, l_size);
-    mpn_copyi (xp, l, l_size);
-    mpz_limbs_finish (x, l_size);
+    mp_limb_t *xp = mpz_limbs_write (x, nn);
+    mpn_copyi (xp, l, nn);
+    mpz_limbs_finish (x, nn);
   }

   TMP_GMP_FREE (l);
diff --git a/testsuite/rsa-encrypt-test.c b/testsuite/rsa-encrypt-test.c
index 87525f78..d3bc374b 100644
--- a/testsuite/rsa-encrypt-test.c
+++ b/testsuite/rsa-encrypt-test.c
@@ -19,6 +19,7 @@ test_main(void)
   uint8_t after;

   mpz_t gibberish;
+  mpz_t zero;

   rsa_private_key_init(&key);
   rsa_public_key_init(&pub);
@@ -101,6 +102,17 @@ test_main(void)
   ASSERT(decrypted[decrypted_length] == after);
   ASSERT(decrypted[0] == 'A');

+  /* Test zero input. */
+  mpz_init_set_ui (zero, 0);
+  decrypted_length = msg_length;
+  ASSERT(!rsa_decrypt(&key, &decrypted_length, decrypted, zero));
+  ASSERT(!rsa_decrypt_tr(&pub, &key,
+			 &lfib, (nettle_random_func *) knuth_lfib_random,
+			 &decrypted_length, decrypted, zero));
+  ASSERT(!rsa_sec_decrypt(&pub, &key,
+			  &lfib, (nettle_random_func *) knuth_lfib_random,
+			  decrypted_length, decrypted, zero));
+  ASSERT(decrypted_length == msg_length);

   /* Test invalid key. */
   mpz_add_ui (key.q, key.q, 2);
@@ -112,6 +124,6 @@ test_main(void)
   rsa_private_key_clear(&key);
   rsa_public_key_clear(&pub);
   mpz_clear(gibberish);
+  mpz_clear(zero);
   free(decrypted);
 }
-
--
2.31.1


code:
Copied from upstream nettle git repository.
Removed changes to ChangeLog, to allow this patch to apply to nettle-3.5.

From 0ad0b5df315665250dfdaa4a1e087f4799edaefe Mon Sep 17 00:00:00 2001
From: Niels Möller <nisse@lysator.liu.se>
Date: Mon, 17 May 2021 22:02:47 +0200
Subject: [PATCH 2/2] Add input check to rsa_decrypt family of functions.

---
 ChangeLog                    |  8 ++++++++
 rsa-decrypt-tr.c             |  4 ++++
 rsa-decrypt.c                | 10 ++++++++++
 rsa-sec-decrypt.c            |  4 ++++
 rsa.h                        |  5 +++--
 testsuite/rsa-encrypt-test.c | 38 ++++++++++++++++++++++++++++++------
 6 files changed, 61 insertions(+), 8 deletions(-)

diff --git a/rsa-decrypt-tr.c b/rsa-decrypt-tr.c
index 927a8915..4a9e9d74 100644
--- a/rsa-decrypt-tr.c
+++ b/rsa-decrypt-tr.c
@@ -52,6 +52,10 @@ rsa_decrypt_tr(const struct rsa_public_key *pub,
   mp_size_t key_limb_size;
   int res;

+  /* First check that input is in range. */
+  if (mpz_sgn (gibberish) < 0 || mpz_cmp (gibberish, pub->n) >= 0)
+    return 0;
+
   key_limb_size = mpz_size(pub->n);

   TMP_GMP_ALLOC (m, key_limb_size);
diff --git a/rsa-decrypt.c b/rsa-decrypt.c
index 7681439d..540d8baa 100644
--- a/rsa-decrypt.c
+++ b/rsa-decrypt.c
@@ -48,6 +48,16 @@ rsa_decrypt(const struct rsa_private_key *key,
   int res;

   mpz_init(m);
+
+  /* First check that input is in range. Since we don't have the
+     public key available here, we need to reconstruct n. */
+  mpz_mul (m, key->p, key->q);
+  if (mpz_sgn (gibberish) < 0 || mpz_cmp (gibberish, m) >= 0)
+    {
+      mpz_clear (m);
+      return 0;
+    }
+
   rsa_compute_root(key, m, gibberish);

   res = pkcs1_decrypt (key->size, m, length, message);
diff --git a/rsa-sec-decrypt.c b/rsa-sec-decrypt.c
index fc4757a0..4c98958d 100644
--- a/rsa-sec-decrypt.c
+++ b/rsa-sec-decrypt.c
@@ -55,6 +55,10 @@ rsa_sec_decrypt(const struct rsa_public_key *pub,
   TMP_GMP_DECL (em, uint8_t);
   int res;

+  /* First check that input is in range. */
+  if (mpz_sgn (gibberish) < 0 || mpz_cmp (gibberish, pub->n) >= 0)
+    return 0;
+
   TMP_GMP_ALLOC (m, mpz_size(pub->n));
   TMP_GMP_ALLOC (em, key->size);

diff --git a/rsa.h b/rsa.h
index 3b10155f..2dd35a2d 100644
--- a/rsa.h
+++ b/rsa.h
@@ -428,13 +428,14 @@ rsa_sec_decrypt(const struct rsa_public_key *pub,
 	        size_t length, uint8_t *message,
 	        const mpz_t gibberish);

-/* Compute x, the e:th root of m. Calling it with x == m is allowed. */
+/* Compute x, the e:th root of m. Calling it with x == m is allowed.
+   It is required that 0 <= m < n. */
 void
 rsa_compute_root(const struct rsa_private_key *key,
 		 mpz_t x, const mpz_t m);

 /* Safer variant, using RSA blinding, and checking the result after
-   CRT. */
+   CRT. It is required that 0 <= m < n. */
 int
 rsa_compute_root_tr(const struct rsa_public_key *pub,
 		    const struct rsa_private_key *key,
diff --git a/testsuite/rsa-encrypt-test.c b/testsuite/rsa-encrypt-test.c
index d3bc374b..d1a440f6 100644
--- a/testsuite/rsa-encrypt-test.c
+++ b/testsuite/rsa-encrypt-test.c
@@ -19,11 +19,12 @@ test_main(void)
   uint8_t after;

   mpz_t gibberish;
-  mpz_t zero;
+  mpz_t bad_input;

   rsa_private_key_init(&key);
   rsa_public_key_init(&pub);
   mpz_init(gibberish);
+  mpz_init(bad_input);

   knuth_lfib_init(&lfib, 17);

@@ -103,15 +104,40 @@ test_main(void)
   ASSERT(decrypted[0] == 'A');

   /* Test zero input. */
-  mpz_init_set_ui (zero, 0);
+  mpz_set_ui (bad_input, 0);
   decrypted_length = msg_length;
-  ASSERT(!rsa_decrypt(&key, &decrypted_length, decrypted, zero));
+  ASSERT(!rsa_decrypt(&key, &decrypted_length, decrypted, bad_input));
   ASSERT(!rsa_decrypt_tr(&pub, &key,
 			 &lfib, (nettle_random_func *) knuth_lfib_random,
-			 &decrypted_length, decrypted, zero));
+			 &decrypted_length, decrypted, bad_input));
   ASSERT(!rsa_sec_decrypt(&pub, &key,
 			  &lfib, (nettle_random_func *) knuth_lfib_random,
-			  decrypted_length, decrypted, zero));
+			  decrypted_length, decrypted, bad_input));
+  ASSERT(decrypted_length == msg_length);
+
+  /* Test input that is slightly larger than n */
+  mpz_add(bad_input, gibberish, pub.n);
+  decrypted_length = msg_length;
+  ASSERT(!rsa_decrypt(&key, &decrypted_length, decrypted, bad_input));
+  ASSERT(!rsa_decrypt_tr(&pub, &key,
+			 &lfib, (nettle_random_func *) knuth_lfib_random,
+			 &decrypted_length, decrypted, bad_input));
+  ASSERT(!rsa_sec_decrypt(&pub, &key,
+			  &lfib, (nettle_random_func *) knuth_lfib_random,
+			  decrypted_length, decrypted, bad_input));
+  ASSERT(decrypted_length == msg_length);
+
+  /* Test input that is considerably larger than n */
+  mpz_mul_2exp (bad_input, pub.n, 100);
+  mpz_add (bad_input, bad_input, gibberish);
+  decrypted_length = msg_length;
+  ASSERT(!rsa_decrypt(&key, &decrypted_length, decrypted, bad_input));
+  ASSERT(!rsa_decrypt_tr(&pub, &key,
+			 &lfib, (nettle_random_func *) knuth_lfib_random,
+			 &decrypted_length, decrypted, bad_input));
+  ASSERT(!rsa_sec_decrypt(&pub, &key,
+			  &lfib, (nettle_random_func *) knuth_lfib_random,
+			  decrypted_length, decrypted, bad_input));
   ASSERT(decrypted_length == msg_length);

   /* Test invalid key. */
@@ -124,6 +150,6 @@ test_main(void)
   rsa_private_key_clear(&key);
   rsa_public_key_clear(&pub);
   mpz_clear(gibberish);
-  mpz_clear(zero);
+  mpz_clear(bad_input);
   free(decrypted);
 }
--
2.31.1


code:
Copied from upstream nettle git repository.
Removed changes to ChangeLog, to allow this patch to apply to nettle-3.5.

From 7616541e6eff73353bf682c62e3a68e4fe696707 Mon Sep 17 00:00:00 2001
From: Niels Möller <nisse@lysator.liu.se>
Date: Thu, 6 May 2021 21:29:56 +0200
Subject: [PATCH] Add check that message length to _pkcs1_sec_decrypt is valid.

* pkcs1-sec-decrypt.c (_pkcs1_sec_decrypt): Check that message
length is valid, for given key size.
* testsuite/rsa-sec-decrypt-test.c (test_main): Add test cases for
calls to rsa_sec_decrypt specifying a too large message length.
---
 ChangeLog                        |  7 +++++++
 pkcs1-sec-decrypt.c              |  4 +++-
 testsuite/rsa-sec-decrypt-test.c | 17 ++++++++++++++++-
 3 files changed, 26 insertions(+), 2 deletions(-)

diff --git a/pkcs1-sec-decrypt.c b/pkcs1-sec-decrypt.c
index 4f13080e..16833691 100644
--- a/pkcs1-sec-decrypt.c
+++ b/pkcs1-sec-decrypt.c
@@ -63,7 +63,9 @@ _pkcs1_sec_decrypt (size_t length, uint8_t *message,
   volatile int ok;
   size_t i, t;

-  assert (padded_message_length >= length);
+  /* Message independent branch */
+  if (length + 11 > padded_message_length)
+    return 0;

   t = padded_message_length - length - 1;

diff --git a/testsuite/rsa-sec-decrypt-test.c b/testsuite/rsa-sec-decrypt-test.c
index fb0ed3a1..3419322e 100644
--- a/testsuite/rsa-sec-decrypt-test.c
+++ b/testsuite/rsa-sec-decrypt-test.c
@@ -55,6 +55,7 @@ rsa_decrypt_for_test(const struct rsa_public_key *pub,
 #endif

 #define PAYLOAD_SIZE 50
+#define DECRYPTED_SIZE 256
 void
 test_main(void)
 {
@@ -63,7 +64,7 @@ test_main(void)
   struct knuth_lfib_ctx random_ctx;

   uint8_t plaintext[PAYLOAD_SIZE];
-  uint8_t decrypted[PAYLOAD_SIZE];
+  uint8_t decrypted[DECRYPTED_SIZE];
   uint8_t verifybad[PAYLOAD_SIZE];
   unsigned n_size = 1024;
   mpz_t gibberish;
@@ -99,6 +100,20 @@ test_main(void)
                                     PAYLOAD_SIZE, decrypted, gibberish) == 1);
       ASSERT (MEMEQ (PAYLOAD_SIZE, plaintext, decrypted));

+      ASSERT (pub.size > 10);
+      ASSERT (pub.size <= DECRYPTED_SIZE);
+
+      /* Check that too large message length is rejected, largest
+	 valid size is pub.size - 11. */
+      ASSERT (!rsa_decrypt_for_test (&pub, &key, &random_ctx,
+				     (nettle_random_func *) knuth_lfib_random,
+				     pub.size - 10, decrypted, gibberish));
+
+      /* This case used to result in arithmetic underflow and a crash. */
+      ASSERT (!rsa_decrypt_for_test (&pub, &key, &random_ctx,
+				     (nettle_random_func *) knuth_lfib_random,
+				     pub.size, decrypted, gibberish));
+
       /* bad one */
       memcpy(decrypted, verifybad, PAYLOAD_SIZE);
       nettle_mpz_random_size(garbage, &random_ctx,
--
2.31.1


code:
From d3026a6d331298003ccc6cd9d2e20dcb7fa9ae1d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Tom=C3=A1=C5=A1=20=C4=8Cech?= <sleep_walker@gnu.org>
Date: Wed, 3 Jul 2019 13:31:54 +0200
Subject: [PATCH] respect NM_VPN_PLUGIN_DIR

---
 src/vpn/nm-vpn-manager.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/src/vpn/nm-vpn-manager.c b/src/vpn/nm-vpn-manager.c
index d063916..d779166 100644
--- a/src/vpn/nm-vpn-manager.c
+++ b/src/vpn/nm-vpn-manager.c
@@ -223,6 +223,7 @@ nm_vpn_manager_init (NMVpnManager *self)
 	GSList *infos, *info;
 	const char *conf_dir_etc = _nm_vpn_plugin_info_get_default_dir_etc ();
 	const char *conf_dir_lib = _nm_vpn_plugin_info_get_default_dir_lib ();
+	const char *conf_dir_user = _nm_vpn_plugin_info_get_default_dir_user ();

 	/* Watch the VPN directory for changes */
 	file = g_file_new_for_path (conf_dir_lib);
@@ -241,6 +242,14 @@ nm_vpn_manager_init (NMVpnManager *self)
 		                                         G_CALLBACK (vpn_dir_changed), self);
 	}

+	file = g_file_new_for_path (conf_dir_user);
+	priv->monitor_etc = g_file_monitor_directory (file, G_FILE_MONITOR_NONE, NULL, NULL);
+	g_object_unref (file);
+	if (priv->monitor_etc) {
+		priv->monitor_id_etc = g_signal_connect (priv->monitor_etc, "changed",
+		                                         G_CALLBACK (vpn_dir_changed), self);
+	}
+
 	/* first read conf_dir_lib. The name files are not really user configuration, but
 	 * plugin configuration. Hence we expect ~newer~ plugins to install their files
 	 * in /usr/lib/NetworkManager. We want to prefer those files.
@@ -255,6 +264,11 @@ nm_vpn_manager_init (NMVpnManager *self)
 		try_add_plugin (self, info->data);
 	g_slist_free_full (infos, g_object_unref);

+	infos = _nm_vpn_plugin_info_list_load_dir (conf_dir_user, TRUE, 0, NULL, NULL);
+	for (info = infos; info; info = info->next)
+		try_add_plugin (self, info->data);
+	g_slist_free_full (infos, g_object_unref);
+
 	priv->active_services = g_hash_table_new_full (nm_str_hash, g_str_equal, g_free, NULL);
 }

--
2.22.0


code:
Remove fixed search paths from autotools.

--- a/m4/package_utilies.m4	1970-01-01 01:00:01.000000000 +0100
+++ b/m4/package_utilies.m4	2020-07-07 12:41:48.871661042 +0200
@@ -23,32 +23,32 @@
     AC_PACKAGE_NEED_UTILITY($1, "$cc", cc, [C compiler])

     if test -z "$MAKE"; then
-        AC_PATH_PROG(MAKE, gmake,, /usr/bin:/usr/freeware/bin)
+        AC_PATH_PROG(MAKE, gmake)
     fi
     if test -z "$MAKE"; then
-        AC_PATH_PROG(MAKE, make,, /usr/bin)
+        AC_PATH_PROG(MAKE, make)
     fi
     make=$MAKE
     AC_SUBST(make)
     AC_PACKAGE_NEED_UTILITY($1, "$make", make, [GNU make])

     if test -z "$LIBTOOL"; then
-	AC_PATH_PROG(LIBTOOL, glibtool,, /usr/bin)
+	AC_PATH_PROG(LIBTOOL, glibtool)
     fi
     if test -z "$LIBTOOL"; then
-	AC_PATH_PROG(LIBTOOL, libtool,, /usr/bin:/usr/local/bin:/usr/freeware/bin)
+	AC_PATH_PROG(LIBTOOL, libtool)
     fi
     libtool=$LIBTOOL
     AC_SUBST(libtool)
     AC_PACKAGE_NEED_UTILITY($1, "$libtool", libtool, [GNU libtool])

     if test -z "$TAR"; then
-        AC_PATH_PROG(TAR, tar,, /usr/freeware/bin:/bin:/usr/local/bin:/usr/bin)
+        AC_PATH_PROG(TAR, tar)
     fi
     tar=$TAR
     AC_SUBST(tar)
     if test -z "$ZIP"; then
-        AC_PATH_PROG(ZIP, gzip,, /bin:/usr/local/bin:/usr/freeware/bin)
+        AC_PATH_PROG(ZIP, gzip)
     fi

     zip=$ZIP
@@ -61,25 +61,25 @@
     AC_SUBST(makedepend)

     if test -z "$AWK"; then
-        AC_PATH_PROG(AWK, awk,, /bin:/usr/bin)
+        AC_PATH_PROG(AWK, awk)
     fi
     awk=$AWK
     AC_SUBST(awk)

     if test -z "$SED"; then
-        AC_PATH_PROG(SED, sed,, /bin:/usr/bin)
+        AC_PATH_PROG(SED, sed)
     fi
     sed=$SED
     AC_SUBST(sed)

     if test -z "$ECHO"; then
-        AC_PATH_PROG(ECHO, echo,, /bin:/usr/bin)
+        AC_PATH_PROG(ECHO, echo)
     fi
     echo=$ECHO
     AC_SUBST(echo)

     if test -z "$SORT"; then
-        AC_PATH_PROG(SORT, sort,, /bin:/usr/bin)
+        AC_PATH_PROG(SORT, sort)
     fi
     sort=$SORT
     AC_SUBST(sort)


code:
diff --git a/auto/unix b/auto/unix
index 10835f6c..b5b33bb3 100644
--- a/auto/unix
+++ b/auto/unix
@@ -990,3 +990,27 @@ ngx_feature_test='struct addrinfo *res;
                   if (getaddrinfo("localhost", NULL, NULL, &res) != 0) return 1;
                   freeaddrinfo(res)'
 . auto/feature
+
+ngx_feature="SOCK_CLOEXEC support"
+ngx_feature_name="NGX_HAVE_SOCKET_CLOEXEC"
+ngx_feature_run=no
+ngx_feature_incs="#include <sys/types.h>
+                  #include <sys/socket.h>"
+ngx_feature_path=
+ngx_feature_libs=
+ngx_feature_test="int fd;
+                  fd = socket(AF_INET, SOCK_STREAM | SOCK_CLOEXEC, 0);"
+. auto/feature
+
+ngx_feature="FD_CLOEXEC support"
+ngx_feature_name="NGX_HAVE_FD_CLOEXEC"
+ngx_feature_run=no
+ngx_feature_incs="#include <sys/types.h>
+                  #include <sys/socket.h>
+                  #include <fcntl.h>"
+ngx_feature_path=
+ngx_feature_libs=
+ngx_feature_test="int fd;
+                  fd = socket(AF_INET, SOCK_STREAM, 0);
+                  fcntl(fd, F_SETFD, FD_CLOEXEC);"
+. auto/feature
diff --git a/src/core/ngx_resolver.c b/src/core/ngx_resolver.c
index cd55520c..438e0806 100644
--- a/src/core/ngx_resolver.c
+++ b/src/core/ngx_resolver.c
@@ -4466,8 +4466,14 @@ ngx_tcp_connect(ngx_resolver_connection_t *rec)
     ngx_event_t       *rev, *wev;
     ngx_connection_t  *c;

+#if (NGX_HAVE_SOCKET_CLOEXEC)
+    s = ngx_socket(rec->sockaddr->sa_family, SOCK_STREAM | SOCK_CLOEXEC, 0);
+
+#else
     s = ngx_socket(rec->sockaddr->sa_family, SOCK_STREAM, 0);

+#endif
+
     ngx_log_debug1(NGX_LOG_DEBUG_EVENT, &rec->log, 0, "TCP socket %d", s);

     if (s == (ngx_socket_t) -1) {
@@ -4494,6 +4500,15 @@ ngx_tcp_connect(ngx_resolver_connection_t *rec)
         goto failed;
     }

+#if (NGX_HAVE_FD_CLOEXEC)
+    if (ngx_cloexec(s) == -1) {
+        ngx_log_error(NGX_LOG_ALERT, &rec->log, ngx_socket_errno,
+                      ngx_cloexec_n " failed");
+
+        goto failed;
+    }
+#endif
+
     rev = c->read;
     wev = c->write;

diff --git a/src/event/ngx_event.h b/src/event/ngx_event.h
index 19fec68..8c2f01a 100644
--- a/src/event/ngx_event.h
+++ b/src/event/ngx_event.h
@@ -73,6 +73,9 @@ struct ngx_event_s {
     /* to test on worker exit */
     unsigned         channel:1;
     unsigned         resolver:1;
+#if (HAVE_SOCKET_CLOEXEC_PATCH)
+    unsigned         skip_socket_leak_check:1;
+#endif

     unsigned         cancelable:1;

diff --git a/src/event/ngx_event_accept.c b/src/event/ngx_event_accept.c
index 77563709..5827b9d0 100644
--- a/src/event/ngx_event_accept.c
+++ b/src/event/ngx_event_accept.c
@@ -62,7 +62,9 @@ ngx_event_accept(ngx_event_t *ev)

 #if (NGX_HAVE_ACCEPT4)
         if (use_accept4) {
-            s = accept4(lc->fd, &sa.sockaddr, &socklen, SOCK_NONBLOCK);
+            s = accept4(lc->fd, &sa.sockaddr, &socklen,
+                        SOCK_NONBLOCK | SOCK_CLOEXEC);
+
         } else {
             s = accept(lc->fd, &sa.sockaddr, &socklen);
         }
@@ -202,6 +204,16 @@ ngx_event_accept(ngx_event_t *ev)
                     ngx_close_accepted_connection(c);
                     return;
                 }
+
+#if (NGX_HAVE_FD_CLOEXEC)
+                if (ngx_cloexec(s) == -1) {
+                    ngx_log_error(NGX_LOG_ALERT, ev->log, ngx_socket_errno,
+                                  ngx_cloexec_n " failed");
+                    ngx_close_accepted_connection(c);
+                    return;
+                }
+#endif
+
             }
         }

diff --git a/src/event/ngx_event_connect.c b/src/event/ngx_event_connect.c
index c5bb8068..cf33b1d2 100644
--- a/src/event/ngx_event_connect.c
+++ b/src/event/ngx_event_connect.c
@@ -38,8 +38,15 @@ ngx_event_connect_peer(ngx_peer_connection_t *pc)

     type = (pc->type ? pc->type : SOCK_STREAM);

+#if (NGX_HAVE_SOCKET_CLOEXEC)
+    s = ngx_socket(pc->sockaddr->sa_family, type | SOCK_CLOEXEC, 0);
+
+#else
     s = ngx_socket(pc->sockaddr->sa_family, type, 0);

+#endif
+
+
     ngx_log_debug2(NGX_LOG_DEBUG_EVENT, pc->log, 0, "%s socket %d",
                    (type == SOCK_STREAM) ? "stream" : "dgram", s);

@@ -80,6 +87,15 @@ ngx_event_connect_peer(ngx_peer_connection_t *pc)
         goto failed;
     }

+#if (NGX_HAVE_FD_CLOEXEC)
+    if (ngx_cloexec(s) == -1) {
+        ngx_log_error(NGX_LOG_ALERT, pc->log, ngx_socket_errno,
+                      ngx_cloexec_n " failed");
+
+        goto failed;
+    }
+#endif
+
     if (pc->local) {

 #if (NGX_HAVE_TRANSPARENT_PROXY)
diff --git a/src/os/unix/ngx_process_cycle.c b/src/os/unix/ngx_process_cycle.c
index c4376a5..48e8fa8 100644
--- a/src/os/unix/ngx_process_cycle.c
+++ b/src/os/unix/ngx_process_cycle.c
@@ -1032,6 +1032,9 @@ ngx_worker_process_exit(ngx_cycle_t *cycle)
         for (i = 0; i < cycle->connection_n; i++) {
             if (c[i].fd != -1
                 && c[i].read
+#if (HAVE_SOCKET_CLOEXEC_PATCH)
+                && !c[i].read->skip_socket_leak_check
+#endif
                 && !c[i].read->accept
                 && !c[i].read->channel
                 && !c[i].read->resolver)
diff --git a/src/os/unix/ngx_socket.h b/src/os/unix/ngx_socket.h
index fcc51533..d1eebf47 100644
--- a/src/os/unix/ngx_socket.h
+++ b/src/os/unix/ngx_socket.h
@@ -38,6 +38,17 @@ int ngx_blocking(ngx_socket_t s);

 #endif

+#if (NGX_HAVE_FD_CLOEXEC)
+
+#define ngx_cloexec(s)      fcntl(s, F_SETFD, FD_CLOEXEC)
+#define ngx_cloexec_n       "fcntl(FD_CLOEXEC)"
+
+/* at least FD_CLOEXEC is required to ensure connection fd is closed
+ * after execve */
+#define HAVE_SOCKET_CLOEXEC_PATCH  1
+
+#endif
+
 int ngx_tcp_nopush(ngx_socket_t s);
 int ngx_tcp_push(ngx_socket_t s);


code:
The Guile process taking the role of PID 1 during Guix builds does not reap
zombie processes, which makes them continue responding to "kill -0".

--- a/src/testsuite/stop-server.sh	2015-02-05 11:24:00.535908842 +0100
+++ b/src/testsuite/stop-server.sh	2015-02-05 11:25:00.264351349 +0100
@@ -1,6 +1,21 @@
 #!/bin/sh
 # ngIRCd Test Suite

+process_is_alive(){
+    ! process_is_dead "$1" && ! process_is_undead "$1"
+}
+
+process_is_dead(){
+    ! kill -0 "$1"
+}
+
+process_is_undead(){
+    case $(ps -p "$1" -o state=) in
+        (Z*) true ;;
+        (*) false ;;
+    esac
+}
+
 [ -z "$srcdir" ] && srcdir=`dirname $0`

 # read in functions
@@ -24,7 +40,7 @@

 # waiting ...
 for i in 1 2 3 4 5; do
-  kill -0 $pid > /dev/null 2>&1; r=$?
+  process_is_alive $pid > /dev/null 2>&1; r=$?
   if [ $r -ne 0 ]; then
     echo " ok".
     exit 0


code:
Honour SOURCE_DATE_EPOCH for VERSION default

Merged upstream as cd3f1024a37a332f1d4fa96a817ca80dfa2a478c, but not yet in a
release. GitHub PR: https://github.com/kichik/nsis/pull/13

Python snippet from: https://reproducible-builds.org/docs/source-date-epoch/#python

diff --git a/SConstruct b/SConstruct
index e8252c9..41786f2 100755
--- a/SConstruct
+++ b/SConstruct
@@ -95,8 +95,8 @@ default_doctype = 'html'
 if defenv.WhereIs('hhc', os.environ['PATH']):
 	default_doctype = 'chm'

-from time import strftime, gmtime
-cvs_version = strftime('%d-%b-%Y.cvs', gmtime())
+import time
+cvs_version = time.strftime('%d-%b-%Y.cvs', time.gmtime(int(os.environ.get('SOURCE_DATE_EPOCH', time.time()))))

 opts = Variables()


code:
Description: Create nss.pc and nss-config
Author: Lars Wendler <polynomial-c@gentoo.org>
Source: http://sources.gentoo.org/cgi-bin/viewvc.cgi/gentoo-x86/dev-libs/nss/files/nss-3.17.1-gentoo-fixups.patch

Modifications:
  Change libdir from ${prefix}/lib64 to ${prefix}/lib/nss.
  Remove optional patching in nss/Makefile.
  Include -L$libdir in output from "nss-config --libs".

Later adapted to apply cleanly to nss-3.53.

--- nss-3.21/nss/config/Makefile
+++ nss-3.21/nss/config/Makefile
@@ -0,0 +1,40 @@
+CORE_DEPTH = ..
+DEPTH      = ..
+
+include $(CORE_DEPTH)/coreconf/config.mk
+
+NSS_MAJOR_VERSION = `grep "NSS_VMAJOR" ../lib/nss/nss.h | awk '{print $$3}'`
+NSS_MINOR_VERSION = `grep "NSS_VMINOR" ../lib/nss/nss.h | awk '{print $$3}'`
+NSS_PATCH_VERSION = `grep "NSS_VPATCH" ../lib/nss/nss.h | awk '{print $$3}'`
+PREFIX = /usr
+
+all: export libs
+
+export:
+	# Create the nss.pc file
+	mkdir -p $(DIST)/lib/pkgconfig
+	sed -e "s,@prefix@,$(PREFIX)," \
+	    -e "s,@exec_prefix@,\$${prefix}," \
+	    -e "s,@libdir@,\$${prefix}/lib/nss," \
+	    -e "s,@includedir@,\$${prefix}/include/nss," \
+	    -e "s,@NSS_MAJOR_VERSION@,$(NSS_MAJOR_VERSION),g" \
+	    -e "s,@NSS_MINOR_VERSION@,$(NSS_MINOR_VERSION)," \
+	    -e "s,@NSS_PATCH_VERSION@,$(NSS_PATCH_VERSION)," \
+	    nss.pc.in > nss.pc
+	chmod 0644 nss.pc
+	cp nss.pc $(DIST)/lib/pkgconfig
+
+	# Create the nss-config script
+	mkdir -p $(DIST)/bin
+	sed -e "s,@prefix@,$(PREFIX)," \
+	    -e "s,@NSS_MAJOR_VERSION@,$(NSS_MAJOR_VERSION)," \
+	    -e "s,@NSS_MINOR_VERSION@,$(NSS_MINOR_VERSION)," \
+	    -e "s,@NSS_PATCH_VERSION@,$(NSS_PATCH_VERSION)," \
+	    nss-config.in > nss-config
+	chmod 0755 nss-config
+	cp nss-config $(DIST)/bin
+
+libs:
+
+dummy: all export libs
+
--- nss-3.21/nss/config/nss-config.in
+++ nss-3.21/nss/config/nss-config.in
@@ -0,0 +1,145 @@
+#!/bin/sh
+
+prefix=@prefix@
+
+major_version=@NSS_MAJOR_VERSION@
+minor_version=@NSS_MINOR_VERSION@
+patch_version=@NSS_PATCH_VERSION@
+
+usage()
+{
+	cat <<EOF
+Usage: nss-config [OPTIONS] [LIBRARIES]
+Options:
+	[--prefix[=DIR]]
+	[--exec-prefix[=DIR]]
+	[--includedir[=DIR]]
+	[--libdir[=DIR]]
+	[--version]
+	[--libs]
+	[--cflags]
+Dynamic Libraries:
+	nss
+	ssl
+	smime
+	nssutil
+EOF
+	exit $1
+}
+
+if test $# -eq 0; then
+	usage 1 1>&2
+fi
+
+lib_ssl=yes
+lib_smime=yes
+lib_nss=yes
+lib_nssutil=yes
+
+while test $# -gt 0; do
+  case "$1" in
+  -*=*) optarg=`echo "$1" | sed 's/[-_a-zA-Z0-9]*=//'` ;;
+  *) optarg= ;;
+  esac
+
+  case $1 in
+    --prefix=*)
+      prefix=$optarg
+      ;;
+    --prefix)
+      echo_prefix=yes
+      ;;
+    --exec-prefix=*)
+      exec_prefix=$optarg
+      ;;
+    --exec-prefix)
+      echo_exec_prefix=yes
+      ;;
+    --includedir=*)
+      includedir=$optarg
+      ;;
+    --includedir)
+      echo_includedir=yes
+      ;;
+    --libdir=*)
+      libdir=$optarg
+      ;;
+    --libdir)
+      echo_libdir=yes
+      ;;
+    --version)
+      echo ${major_version}.${minor_version}.${patch_version}
+      ;;
+    --cflags)
+      echo_cflags=yes
+      ;;
+    --libs)
+      echo_libs=yes
+      ;;
+    ssl)
+      lib_ssl=yes
+      ;;
+    smime)
+      lib_smime=yes
+      ;;
+    nss)
+      lib_nss=yes
+      ;;
+    nssutil)
+      lib_nssutil=yes
+      ;;
+    *)
+      usage 1 1>&2
+      ;;
+  esac
+  shift
+done
+
+# Set variables that may be dependent upon other variables
+if test -z "$exec_prefix"; then
+    exec_prefix=`pkg-config --variable=exec_prefix nss`
+fi
+if test -z "$includedir"; then
+    includedir=`pkg-config --variable=includedir nss`
+fi
+if test -z "$libdir"; then
+    libdir=`pkg-config --variable=libdir nss`
+fi
+
+if test "$echo_prefix" = "yes"; then
+    echo $prefix
+fi
+
+if test "$echo_exec_prefix" = "yes"; then
+    echo $exec_prefix
+fi
+
+if test "$echo_includedir" = "yes"; then
+    echo $includedir
+fi
+
+if test "$echo_libdir" = "yes"; then
+    echo $libdir
+fi
+
+if test "$echo_cflags" = "yes"; then
+    echo -I$includedir
+fi
+
+if test "$echo_libs" = "yes"; then
+      libdirs=-L$libdir
+      if test -n "$lib_ssl"; then
+	libdirs="$libdirs -lssl${major_version}"
+      fi
+      if test -n "$lib_smime"; then
+	libdirs="$libdirs -lsmime${major_version}"
+      fi
+      if test -n "$lib_nss"; then
+	libdirs="$libdirs -lnss${major_version}"
+      fi
+      if test -n "$lib_nssutil"; then
+       libdirs="$libdirs -lnssutil${major_version}"
+      fi
+      echo $libdirs
+fi
+
--- nss-3.21/nss/config/nss.pc.in
+++ nss-3.21/nss/config/nss.pc.in
@@ -0,0 +1,12 @@
+prefix=@prefix@
+exec_prefix=@exec_prefix@
+libdir=@libdir@
+includedir=@includedir@
+
+Name: NSS
+Description: Network Security Services
+Version: @NSS_MAJOR_VERSION@.@NSS_MINOR_VERSION@.@NSS_PATCH_VERSION@
+Requires: nspr >= 4.8
+Libs: -L${libdir} -lssl3 -lsmime3 -lnss3 -lnssutil3
+Cflags: -I${includedir}
+
--- nss-3.21/nss/manifest.mn
+++ nss-3.21/nss/manifest.mn
@@ -10,7 +10,7 @@

 RELEASE = nss

-DIRS = coreconf lib cmd cpputil gtests
+DIRS = coreconf lib cmd cpputil gtests config

 lib: coreconf
 cmd: lib


code:
We've seen some tests take up to 60s to complete on a busy armhf
machine. Even a busy x86_64 machine can use more than 5s on some tests.

Increase timeouts to increase chances of a successful build.

--- a/nss/gtests/ssl_gtest/tls_connect.cc	2017-03-14 22:47:30.855813629 +0100
+++ b/nss/gtests/ssl_gtest/tls_connect.cc	2017-03-14 22:48:49.042335273 +0100
@@ -245,7 +245,7 @@

   ASSERT_TRUE_WAIT((client_->state() != TlsAgent::STATE_CONNECTING) &&
                        (server_->state() != TlsAgent::STATE_CONNECTING),
-                   5000);
+                   300000);
 }

 void TlsConnectTestBase::EnableExtendedMasterSecret() {
@@ -385,7 +385,7 @@
   if (failing_side == TlsAgent::CLIENT) {
     failing_agent = client_;
   }
-  ASSERT_TRUE_WAIT(failing_agent->state() == TlsAgent::STATE_ERROR, 5000);
+  ASSERT_TRUE_WAIT(failing_agent->state() == TlsAgent::STATE_ERROR, 300000);
 }

 void TlsConnectTestBase::ConfigureVersion(uint16_t version) {


code:
Fix CVE-2019-9755:

https://security-tracker.debian.org/tracker/CVE-2019-9755
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9755

Patch copied from upstream source repository:

https://sourceforge.net/p/ntfs-3g/ntfs-3g/ci/85c1634a26faa572d3c558d4cf8aaaca5202d4e9/

From 85c1634a26faa572d3c558d4cf8aaaca5202d4e9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jean-Pierre=20Andr=C3=A9?= <jean-pierre.andre@wanadoo.fr>
Date: Wed, 19 Dec 2018 15:57:50 +0100
Subject: [PATCH] Fixed reporting an error when failed to build the mountpoint

The size check was inefficient because getcwd() uses an unsigned int
argument.
---
 src/lowntfs-3g.c | 6 +++++-
 src/ntfs-3g.c    | 6 +++++-
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/src/lowntfs-3g.c b/src/lowntfs-3g.c
index 993867fa..0660439b 100644
--- a/src/lowntfs-3g.c
+++ b/src/lowntfs-3g.c
@@ -4411,7 +4411,8 @@ int main(int argc, char *argv[])
 	else {
 		ctx->abs_mnt_point = (char*)ntfs_malloc(PATH_MAX);
 		if (ctx->abs_mnt_point) {
-			if (getcwd(ctx->abs_mnt_point,
+			if ((strlen(opts.mnt_point) < PATH_MAX)
+			    && getcwd(ctx->abs_mnt_point,
 				     PATH_MAX - strlen(opts.mnt_point) - 1)) {
 				strcat(ctx->abs_mnt_point, "/");
 				strcat(ctx->abs_mnt_point, opts.mnt_point);
@@ -4419,6 +4420,9 @@ int main(int argc, char *argv[])
 			/* Solaris also wants the absolute mount point */
 				opts.mnt_point = ctx->abs_mnt_point;
 #endif /* defined(__sun) && defined (__SVR4) */
+			} else {
+				free(ctx->abs_mnt_point);
+				ctx->abs_mnt_point = (char*)NULL;
 			}
 		}
 	}
diff --git a/src/ntfs-3g.c b/src/ntfs-3g.c
index 6ce89fef..4e0912ae 100644
--- a/src/ntfs-3g.c
+++ b/src/ntfs-3g.c
@@ -4148,7 +4148,8 @@ int main(int argc, char *argv[])
 	else {
 		ctx->abs_mnt_point = (char*)ntfs_malloc(PATH_MAX);
 		if (ctx->abs_mnt_point) {
-			if (getcwd(ctx->abs_mnt_point,
+			if ((strlen(opts.mnt_point) < PATH_MAX)
+			    && getcwd(ctx->abs_mnt_point,
 				     PATH_MAX - strlen(opts.mnt_point) - 1)) {
 				strcat(ctx->abs_mnt_point, "/");
 				strcat(ctx->abs_mnt_point, opts.mnt_point);
@@ -4156,6 +4157,9 @@ int main(int argc, char *argv[])
 			/* Solaris also wants the absolute mount point */
 				opts.mnt_point = ctx->abs_mnt_point;
 #endif /* defined(__sun) && defined (__SVR4) */
+			} else {
+				free(ctx->abs_mnt_point);
+				ctx->abs_mnt_point = (char*)NULL;
 			}
 		}
 	}
--
2.21.0


code:
Make configure assume nvi can store backups in /var/tmp.

--- a/dist/configure	2014-09-01 14:46:01.075778095 +0200
+++ b/dist/configure	2014-09-01 14:52:08.411790122 +0200
@@ -21319,23 +21319,8 @@
 if test "${vi_cv_path_preserve+set}" = set; then
   echo $ECHO_N "(cached) $ECHO_C" >&6
 else
-  	dirlist="/var/preserve /var/tmp /usr/tmp"
-	vi_cv_path_preserve=no
-	for i in $dirlist; do
-		if test -d $i/vi.recover; then
-			vi_cv_path_preserve=$i/vi.recover
-			break;
-		fi
-	done
-	if test "$vi_cv_path_preserve" = no; then
-		for i in $dirlist; do
-			if test -d $i -a -w $i; then
-				vi_cv_path_preserve=$i/vi.recover
-				break;
-			fi
-		done
-
-	fi
+#	Assume /var/tmp
+	vi_cv_path_preserve=/var/tmp/vi.recover
 fi

 if test "$vi_cv_path_preserve" = no; then


code:
This patch originates from the Debian project, see https://www.debian.org/

03db4.dpatch  by  <hesso@pool.math.tu-berlin.de>

libdb4 compatibility adjustments.

In particular, this patch adds extra file permission checking and passes the
DB_CREATE flag to the first invocation of db_open on the file's database
structure, which rids us of the following message:

  BDB0635 DB_CREATE must be specified to create databases.

--- nvi-1.81.6.orig/common/msg.c	2009-02-26 14:26:58.350336128 +0100
+++ nvi-1.81.6/common/msg.c	2009-02-26 14:29:05.235335829 +0100
@@ -724,9 +724,18 @@
 		p = buf;
 	} else
 		p = file;
+	if (access(p, F_OK) != 0) {
+		if (first) {
+			first = 0;
+			return (1);
+		}
+		sp->db_error = ENOENT;
+		msgq_str(sp, M_DBERR, p, "%s");
+		return (1);
+	}
 	if ((sp->db_error = db_create(&db, 0, 0)) != 0 ||
 	    (sp->db_error = db->set_re_source(db, p)) != 0 ||
-	    (sp->db_error = db_open(db, NULL, DB_RECNO, 0, 0)) != 0) {
+	    (sp->db_error = db_open(db, NULL, DB_RECNO, DB_CREATE, 0)) != 0) {
 		if (first) {
 			first = 0;
 			return (1);


code:
This patch originates from the Debian project, see https://www.debian.org/

18dbpagesize_binpower.dpatch by  <hesso@pool.math.tu-berlin.de>

Make sure that the pagesize passed to db__set_pagesize() is a power of two.

nvi stores the content of files in BDB database structures. When initiating a
file, it picks a page size for the database to fit the file within 15 pages,
with a minimal page size of 1K and maximal of 10K.

In vanilla nvi, this size is calculated as a multiple of 1024. Modern versions
of BDB, however, require the page size of a database to be a power of two, which
this patch addresses, ridding us of the following message:

  BDB0511 page sizes must be a power-of-2

--- nvi-1.81.6.orig/common/exf.c	2009-03-09 01:48:01.695862889 +0100
+++ nvi-1.81.6/common/exf.c	2009-03-09 10:42:41.147866272 +0100
@@ -249,11 +249,10 @@
 		 * (vi should have good locality) or smaller than 1K.
 		 */
 		psize = ((sb.st_size / 15) + 1023) / 1024;
-		if (psize > 10)
-			psize = 10;
-		if (psize == 0)
-			psize = 1;
-		psize *= 1024;
+		if (psize >= 8) psize=8<<10;
+		else if (psize >= 4) psize=4<<10;
+		else if (psize >= 2) psize=2<<10;
+		else psize=1<<10;

 		F_SET(ep, F_DEVSET);
 		ep->mdev = sb.st_dev;


code:
From 6a08014b77bf435f025ecdac08396580b85f159a Mon Sep 17 00:00:00 2001
From: Jan Nieuwenhuizen <janneke@gnu.org>
Date: Sat, 8 Sep 2018 20:22:45 +0200
Subject: [PATCH] fix binary literals.

---
 module/nyacc/lex.scm | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/module/nyacc/lex.scm b/module/nyacc/lex.scm
index 2ec9895..b205212 100644
--- a/module/nyacc/lex.scm
+++ b/module/nyacc/lex.scm
@@ -345,10 +345,11 @@
 	  ((char-numeric? ch) (iter chl '$fixed ba 1 ch))
 	  ((char=? #\. ch) (iter (cons ch chl) #f ba 15 (read-char)))
 	  (else #f)))
-	((10) ;; allow x after 0
+	((10) ;; allow x, b after 0
 	 (cond
 	  ((eof-object? ch) (iter chl ty ba 5 ch))
 	  ((char=? #\x ch) (iter (cons ch chl) ty 16 1 (read-char)))
+          ((char=? #\b ch) (iter (cons ch chl) ty 2 1 (read-char)))
 	  (else (iter chl ty ba 1 ch))))
 	((15) ;; got `.' only
 	 (cond
--
2.18.0


code:
From d250434e6c8eb4f8c8cb47ef3cc6e6de8fa8f828 Mon Sep 17 00:00:00 2001
From: Alexey Abramov <levenson@mmer.org>
Date: Fri, 15 Jan 2021 17:07:17 +0100
Subject: [PATCH] Use environment variable for a default module location

diff --git a/libobs/obs-nix.c b/libobs/obs-nix.c
index 382fa0546..481ea0f14 100644
*** a/libobs/obs-nix.c
--- b/libobs/obs-nix.c
@@ -66,8 +66,19 @@

 void add_default_module_paths(void)
 {
-	for (int i = 0; i < module_patterns_size; i++)
-		obs_add_module_path(module_bin[i], module_data[i]);
+	char *bin_directory = getenv("OBS_PLUGINS_DIRECTORY");
+	char *data_directory = getenv("OBS_PLUGINS_DATA_DIRECTORY");
+	if (bin_directory && data_directory) {
+		struct dstr dstr_data_directory;
+		dstr_init_copy(&dstr_data_directory, data_directory);
+		dstr_cat(&dstr_data_directory, "/%module%");
+		obs_add_module_path(bin_directory, dstr_data_directory.array);
+		dstr_free(&dstr_data_directory);
+
+	} else {
+		for (int i = 0; i < module_patterns_size; i++)
+			obs_add_module_path(module_bin[i], module_data[i]);
+	}
 }

 /*
--
2.29.2


code:
From: Stephane Glondu <steph@glondu.net>
Date: Sun, 16 Aug 2015 20:59:14 +0200
Subject: Add a .file directive to generated .s files

When no .file directive is given, the toolchain records the filename
of the .o file, which is sometimes random, making generated objects
non-deterministic.

We use Location.input_name for adding .file directives to assembly
files. Note: when the file is preprocessed, this reference holds the
name of the temporary file. Hence, files compiled with -pp are still
not deterministic.

Bug-Debian: https://bugs.debian.org/795784
Bug-Debian: https://bugs.debian.org/796336
---
 asmcomp/amd64/emit.mlp | 1 +
 asmcomp/arm/emit.mlp   | 1 +
 asmcomp/arm64/emit.mlp | 1 +
 asmcomp/i386/emit.mlp  | 1 +
 asmcomp/power/emit.mlp | 1 +
 asmcomp/sparc/emit.mlp | 1 +
 6 files changed, 6 insertions(+)

diff --git a/asmcomp/amd64/emit.mlp b/asmcomp/amd64/emit.mlp
index d56d0f5..4d7aa30 100644
--- a/asmcomp/amd64/emit.mlp
+++ b/asmcomp/amd64/emit.mlp
@@ -794,6 +794,7 @@ let data l =
 let begin_assembly() =
   reset_debug_info();                   (* PR#5603 *)
   float_constants := [];
+  `	.file \"{emit_string (String.escaped !Location.input_name)}\"\n`;
   if !Clflags.dlcode then begin
     (* from amd64.S; could emit these constants on demand *)
     if macosx then
diff --git a/asmcomp/arm/emit.mlp b/asmcomp/arm/emit.mlp
index 4948fb2..6f30fba 100644
--- a/asmcomp/arm/emit.mlp
+++ b/asmcomp/arm/emit.mlp
@@ -892,6 +892,7 @@ let data l =

 let begin_assembly() =
   reset_debug_info();
+  `	.file \"{emit_string (String.escaped !Location.input_name)}\"\n`;
   `	.syntax	unified\n`;
   begin match !arch with
   | ARMv4   -> `	.arch	armv4t\n`
diff --git a/asmcomp/arm64/emit.mlp b/asmcomp/arm64/emit.mlp
index 750c2b2..5afbb8a 100644
--- a/asmcomp/arm64/emit.mlp
+++ b/asmcomp/arm64/emit.mlp
@@ -942,6 +942,7 @@ let data l =

 let begin_assembly() =
   reset_debug_info();
+  `	.file \"{emit_string (String.escaped !Location.input_name)}\"\n`;
   let lbl_begin = Compilenv.make_symbol (Some "data_begin") in
   `	.data\n`;
   `	.globl	{emit_symbol lbl_begin}\n`;
diff --git a/asmcomp/i386/emit.mlp b/asmcomp/i386/emit.mlp
index 98df5f9..531150f 100644
--- a/asmcomp/i386/emit.mlp
+++ b/asmcomp/i386/emit.mlp
@@ -986,6 +986,7 @@ let data l =
 let begin_assembly() =
   reset_debug_info();                   (* PR#5603 *)
   float_constants := [];
+  `	.file \"{emit_string (String.escaped !Location.input_name)}\"\n`;
   let lbl_begin = Compilenv.make_symbol (Some "data_begin") in
   `	.data\n`;
   `	.globl	{emit_symbol lbl_begin}\n`;
diff --git a/asmcomp/power/emit.mlp b/asmcomp/power/emit.mlp
index 4344085..343132b 100644
--- a/asmcomp/power/emit.mlp
+++ b/asmcomp/power/emit.mlp
@@ -887,6 +887,7 @@ let data l =
 let begin_assembly() =
   defined_functions := StringSet.empty;
   external_functions := StringSet.empty;
+  `	.file \"{emit_string (String.escaped !Location.input_name)}\"\n`;
   (* Emit the beginning of the segments *)
   let lbl_begin = Compilenv.make_symbol (Some "data_begin") in
   emit_string data_space;
diff --git a/asmcomp/sparc/emit.mlp b/asmcomp/sparc/emit.mlp
index 877a3d5..7b041e9 100644
--- a/asmcomp/sparc/emit.mlp
+++ b/asmcomp/sparc/emit.mlp
@@ -727,6 +727,7 @@ let data l =
 (* Beginning / end of an assembly file *)

 let begin_assembly() =
+  `	.file \"{emit_string (String.escaped !Location.input_name)}\"\n`;
   let lbl_begin = Compilenv.make_symbol (Some "data_begin") in
   `	.data\n`;
   `	.global	{emit_symbol lbl_begin}\n`;


code:
Adapted from upstream commit 659615c7b100a89eafe6253e7a5b9d84d0e8df74,
this patch omits the upstream changes to 'Changes' and 'VERSION'.

http://seclists.org/oss-sec/2016/q2/170
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8869
https://github.com/ocaml/ocaml/commit/659615c7b100a89eafe6253e7a5b9d84d0e8df74
---
 byterun/alloc.c  | 4 ++--
 byterun/intern.c | 2 +-
 byterun/str.c    | 4 ++--
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/byterun/alloc.c b/byterun/alloc.c
index 96a21bf..0db9947 100644
--- a/byterun/alloc.c
+++ b/byterun/alloc.c
@@ -153,7 +153,7 @@ CAMLexport int caml_convert_flag_list(value list, int *flags)
 /* [size] is a [value] representing number of words (fields) */
 CAMLprim value caml_alloc_dummy(value size)
 {
-  mlsize_t wosize = Int_val(size);
+  mlsize_t wosize = Long_val(size);

   if (wosize == 0) return Atom(0);
   return caml_alloc (wosize, 0);
@@ -169,7 +169,7 @@ CAMLprim value caml_alloc_dummy_function(value size,value arity)
 /* [size] is a [value] representing number of floats. */
 CAMLprim value caml_alloc_dummy_float (value size)
 {
-  mlsize_t wosize = Int_val(size) * Double_wosize;
+  mlsize_t wosize = Long_val(size) * Double_wosize;

   if (wosize == 0) return Atom(0);
   return caml_alloc (wosize, 0);
diff --git a/byterun/intern.c b/byterun/intern.c
index 89d13d1..7b8d049 100644
--- a/byterun/intern.c
+++ b/byterun/intern.c
@@ -291,7 +291,7 @@ static void intern_rec(value *dest)
   case OFreshOID:
     /* Refresh the object ID */
     /* but do not do it for predefined exception slots */
-    if (Int_val(Field((value)dest, 1)) >= 0)
+    if (Long_val(Field((value)dest, 1)) >= 0)
       caml_set_oo_id((value)dest);
     /* Pop item and iterate */
     sp--;
diff --git a/byterun/str.c b/byterun/str.c
index 5ad4e29..885772f 100644
--- a/byterun/str.c
+++ b/byterun/str.c
@@ -266,7 +266,7 @@ CAMLprim value caml_string_greaterequal(value s1, value s2)
 CAMLprim value caml_blit_string(value s1, value ofs1, value s2, value ofs2,
                                 value n)
 {
-  memmove(&Byte(s2, Long_val(ofs2)), &Byte(s1, Long_val(ofs1)), Int_val(n));
+  memmove(&Byte(s2, Long_val(ofs2)), &Byte(s1, Long_val(ofs1)), Long_val(n));
   return Val_unit;
 }

@@ -278,7 +278,7 @@ CAMLprim value caml_fill_string(value s, value offset, value len, value init)

 CAMLprim value caml_bitvect_test(value bv, value n)
 {
-  int pos = Int_val(n);
+  intnat pos = Long_val(n);
   return Val_int(Byte_u(bv, pos >> 3) & (1 << (pos & 7)));
 }

--
2.7.4


code:
From 0aaddfceeea3e89df196ab1846da54d09713a512 Mon Sep 17 00:00:00 2001
From: Julien Lepiller <julien@lepiller.eu>
Date: Thu, 15 Dec 2016 21:17:31 +0100
Subject: [PATCH] fix configure

---
 Makefile.in | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/Makefile.in b/Makefile.in
index d040f4c..85e0b38 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -32,6 +32,7 @@ BISECT_REPORT	= @BISECT_REPORT@
 BYTESWAP_H	= @BYTESWAP_H@

 OCAMLLIB	= @OCAMLLIB@
+BISECTLIB	= $(shell if test -z $${BISECTLIB}; then echo $(OCAMLLIB); else echo $${BISECTLIB}; fi)
 top_srcdir	= @top_srcdir@

 pkg_cil		= @OCAML_PKG_cil@
@@ -47,9 +48,9 @@ OCAMLOPTPACKAGES = $(OCAMLCPACKAGES)
 OCAMLOPTLIBS	= -linkpkg

 ifneq ($(enable_coverage),no)
-OCAMLCFLAGS     += -I +bisect -pp 'camlp4o $(OCAMLLIB)/bisect/instrument.cma'
+OCAMLCFLAGS     += -I +bisect -pp 'camlp4o $(BISECTLIB)/bisect/instrument.cma'
 OCAMLCLIBS	+= -I +bisect bisect.cma
-OCAMLOPTFLAGS   += -I +bisect -pp 'camlp4o $(OCAMLLIB)/bisect/instrument.cma'
+OCAMLOPTFLAGS   += -I +bisect -pp 'camlp4o $(BISECTLIB)/bisect/instrument.cma'
 OCAMLOPTLIBS	+= -I +bisect bisect.cmxa
 endif

@@ -110,7 +111,7 @@ bitstring_persistent.cmi: bitstring_persistent.mli
	  -I +camlp4 -pp camlp4of -c $<

 pa_bitstring.cmo: pa_bitstring.ml bitstring.cma bitstring_persistent.cma
-	$(OCAMLFIND) ocamlc bitstring.cma -I +camlp4 dynlink.cma camlp4lib.cma \
+	$(OCAMLFIND) ocamlc $(OCAMLCFLAGS) bitstring.cma -I +camlp4 dynlink.cma camlp4lib.cma \
	  -pp camlp4of -c $< -o $@

 bitstring-objinfo: bitstring_objinfo.cmo bitstring.cma bitstring_persistent.cma
@@ -133,7 +134,7 @@ byteswap.h: byteswap.in.h
 ifeq ($(enable_coverage),no)
 PP	= -pp 'camlp4o bitstring.cma bitstring_persistent.cma pa_bitstring.cmo'
 else
-PP	= -pp 'camlp4o $(OCAMLLIB)/bisect/bisect.cma bitstring.cma bitstring_persistent.cma pa_bitstring.cmo'
+PP	= -pp 'camlp4o $(BISECTLIB)/bisect/bisect.cma bitstring.cma bitstring_persistent.cma pa_bitstring.cmo'
 endif

 check: test
--
2.11.0


code:
From 3c70f2ff18650c4794556049cd4ea22a58cc719e Mon Sep 17 00:00:00 2001
From: Christophe Troestler <Christophe.Troestler@umons.ac.be>
Date: Sun, 27 Sep 2020 23:20:52 +0200
Subject: [PATCH] Do not store the Caml_ba_array_val pointer during surface
 creation

Extracted from Cairo git-tree on November 22, 2020 by
Brett Gilio <brettg@gnu.org>
---
 src/cairo_stubs.c     | 3 ++-
 tests/image_create.ml | 5 +++--
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/src/cairo_stubs.c b/src/cairo_stubs.c
index 641ee2c..200abf3 100644
--- a/src/cairo_stubs.c
+++ b/src/cairo_stubs.c
@@ -1580,6 +1580,7 @@ static cairo_status_t caml_cairo_image_bigarray_attach_proxy
                                      caml_cairo_image_bigarray_finalize);
 }

+#define b (Caml_ba_array_val(vb))
 #define SURFACE_CREATE_DATA(name)                                       \
   CAMLexport value caml_cairo_image_surface_create_for_##name           \
   (value vb, value vformat, value vwidth, value vheight, value vstride) \
@@ -1588,7 +1589,6 @@ static cairo_status_t caml_cairo_image_bigarray_attach_proxy
     CAMLlocal1(vsurf);                                                  \
     cairo_surface_t* surf;                                              \
     const int width =  Int_val(vwidth);                                 \
-    struct caml_ba_array *b = Caml_ba_array_val(vb);                    \
     cairo_status_t status;                                              \
                                                                         \
     if ((b->flags & CAML_BA_MANAGED_MASK) == CAML_BA_MAPPED_FILE)       \
@@ -1610,6 +1610,7 @@ static cairo_status_t caml_cairo_image_bigarray_attach_proxy

 SURFACE_CREATE_DATA(data8)
 SURFACE_CREATE_DATA(data32)
+#undef b

 #define SURFACE_GET_DATA(type, num_dims, dims ...)                      \
   CAMLexport value caml_cairo_image_surface_get_##type(value vsurf)     \
diff --git a/tests/image_create.ml b/tests/image_create.ml
index eec98d6..b13c206 100644
--- a/tests/image_create.ml
+++ b/tests/image_create.ml
@@ -10,6 +10,7 @@ let create() =

 let () =
   let cr = create() in
+  printf "With Cairo handle:\n%!";
   set_source_rgb cr 1. 1. 1.;
   rectangle cr 0. 0. ~w:300. ~h:300.;
   fill cr;
@@ -21,9 +22,9 @@ let () =
   show_text cr "Hello";
   Gc.compact();  Gc.compact();

-  eprintf "Write image\n%!";
+  eprintf "- Write image\n%!";
   PNG.write (get_target cr) "test_image.png";
-  eprintf "Finish surface\n%!";
+  eprintf "- Finish surface\n%!";
   Surface.finish (get_target cr);
   Gc.compact()

--
2.29.2


code:
From aeca7656f499d7f4595319858f242276920e31bb Mon Sep 17 00:00:00 2001
From: Louis Gesbert <louis.gesbert@ocamlpro.com>
Date: Sat, 2 Dec 2017 12:51:01 +0100
Subject: [PATCH] Fix for ocaml 4.06

---
 common/criteria_lexer.mll | 8 ++++----
 common/util.ml            | 2 +-
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/common/criteria_lexer.mll b/common/criteria_lexer.mll
index 71f9178..fc4eae3 100644
--- a/common/criteria_lexer.mll
+++ b/common/criteria_lexer.mll
@@ -18,7 +18,7 @@
     let c = Lexing.lexeme_char lexbuf 2 in (* the delimiter can be any character *)
     (* find the terminating delimiter *)
     let endpos =
-      try String.index_from lexbuf.lex_buffer (lexbuf.lex_start_pos + 3) c with
+      try Bytes.index_from lexbuf.lex_buffer (lexbuf.lex_start_pos + 3) c with
       |Invalid_argument _ ->
           raise (Format822.Syntax_error (
             Format822.error lexbuf "String too short"))
@@ -27,9 +27,9 @@
             Format822.error lexbuf (Printf.sprintf "cannot find: %c" c)))
     in
     let len = endpos - (lexbuf.lex_start_pos + 3) in
-    let s = String.sub lexbuf.lex_buffer (lexbuf.lex_start_pos + 3) len in
-    lexbuf.Lexing.lex_curr_pos <- lexbuf.Lexing.lex_start_pos + ((String.length s)+4);
-    s
+    let s = Bytes.sub lexbuf.lex_buffer (lexbuf.lex_start_pos + 3) len in
+    lexbuf.Lexing.lex_curr_pos <- lexbuf.Lexing.lex_start_pos + ((Bytes.length s)+4);
+    Bytes.to_string s

 }

diff --git a/common/util.ml b/common/util.ml
index 598f266..36ca3d1 100644
--- a/common/util.ml
+++ b/common/util.ml
@@ -87,7 +87,7 @@ module MakeMessages(X : sig val label : string end) = struct
   let clean label =
     try
       let s = Filename.chop_extension (Filename.basename label) in
-      String.capitalize s
+      String.capitalize_ascii s
     with Invalid_argument _ -> label

   let create ?(enabled=false) label =
--
2.11.0


code:
From b5314c20d8e3caf62fe0dc96ad937a2950158b23 Mon Sep 17 00:00:00 2001
From: Louis Gesbert <louis.gesbert@ocamlpro.com>
Date: Thu, 2 Mar 2017 12:19:56 +0100
Subject: [PATCH] Install mli, cmx, etc.

---
 Makefile | 26 +++++++++++++-------------
 1 file changed, 13 insertions(+), 13 deletions(-)

diff --git a/Makefile b/Makefile
index 09464ff..5044d7f 100644
--- a/Makefile
+++ b/Makefile
@@ -56,7 +56,7 @@ $(DOSELIBS)/cudf.%:
 	@for i in _build/cudf/cudf.*; do \
 	  if [ -e $$i ]; then \
 	  cp $$i $(DOSELIBS) ; \
-	  rm -f $(DOSELIBS)/*.mlpack $(DOSELIBS)/*.cmx ; \
+	  rm -f $(DOSELIBS)/*.mlpack ; \
 	  fi ; \
 	done

@@ -67,7 +67,7 @@ $(DOSELIBS)/common.%: common/*.ml common/*.mli
 	  if [ -e $$i ]; then \
 	  cp $$i $(DOSELIBS) ; \
 		rm $$i ;\
-	  rm -f $(DOSELIBS)/*.mlpack $(DOSELIBS)/*.cmx ; \
+	  rm -f $(DOSELIBS)/*.mlpack ; \
 	  fi ; \
 	done

@@ -78,7 +78,7 @@ $(DOSELIBS)/versioning.%: versioning/*.ml versioning/*.mli
 	  if [ -e $$i ]; then \
 	  cp $$i $(DOSELIBS) ; \
 		rm $$i ;\
-	  rm -f $(DOSELIBS)/*.mlpack $(DOSELIBS)/*.cmx ; \
+	  rm -f $(DOSELIBS)/*.mlpack ; \
 	  fi ; \
 	done

@@ -88,7 +88,7 @@ $(DOSELIBS)/algo.%: algo/*.ml algo/*.mli $(DOSELIBS)/common.%
 	  if [ -e $$i ]; then \
 	  cp $$i $(DOSELIBS) ; \
 		rm $$i ;\
-	  rm -f $(DOSELIBS)/*.mlpack $(DOSELIBS)/*.cmx ; \
+	  rm -f $(DOSELIBS)/*.mlpack ; \
 	  fi ; \
 	done

@@ -98,7 +98,7 @@ $(DOSELIBS)/debian.%: deb/*.ml deb/*.mli $(DOSELIBS)/pef.%
 	  if [ -e $$i ]; then \
 	  cp $$i $(DOSELIBS) ; \
 		rm $$i ;\
-	  rm -f $(DOSELIBS)/*.mlpack $(DOSELIBS)/*.cmx ; \
+	  rm -f $(DOSELIBS)/*.mlpack ; \
 	  fi ; \
 	done

@@ -108,7 +108,7 @@ $(DOSELIBS)/opam.%: opam/*.ml opam/*.mli $(DOSELIBS)/pef.%
 	  if [ -e $$i ]; then \
 	  cp $$i $(DOSELIBS) ; \
 		rm $$i ;\
-	  rm -f $(DOSELIBS)/*.mlpack $(DOSELIBS)/*.cmx ; \
+	  rm -f $(DOSELIBS)/*.mlpack ; \
 	  fi ; \
 	done

@@ -118,7 +118,7 @@ $(DOSELIBS)/npm.%: npm/*.ml npm/*.mli $(DOSELIBS)/versioning.% $(DOSELIBS)/pef.%
 	  if [ -e $$i ]; then \
 	  cp $$i $(DOSELIBS) ; \
 		rm $$i ;\
-	  rm -f $(DOSELIBS)/*.mlpack $(DOSELIBS)/*.cmx ; \
+	  rm -f $(DOSELIBS)/*.mlpack ; \
 	  fi ; \
 	done

@@ -128,7 +128,7 @@ $(DOSELIBS)/rpm.%: rpm/*.ml $(DOSELIBS)/algo.%
 	  if [ -e $$i ]; then \
 	  cp $$i $(DOSELIBS) ; \
 		rm $$i ;\
-	  rm -f $(DOSELIBS)/*.mlpack $(DOSELIBS)/*.cmx ; \
+	  rm -f $(DOSELIBS)/*.mlpack ; \
 	  fi ; \
 	done

@@ -138,7 +138,7 @@ $(DOSELIBS)/pef.%: pef/*.ml pef/*.mli
 	  if [ -e $$i ]; then \
 	  cp $$i $(DOSELIBS) ; \
 		rm $$i ;\
-	  rm -f $(DOSELIBS)/*.mlpack $(DOSELIBS)/*.cmx ; \
+	  rm -f $(DOSELIBS)/*.mlpack ; \
 	  fi ; \
 	done

@@ -148,7 +148,7 @@ $(DOSELIBS)/csw.%: opencsw/*.ml $(DOSELIBS)/versioning.%
 	  if [ -e $$i ]; then \
 	  cp $$i $(DOSELIBS) ; \
 		rm $$i ;\
-	  rm -f $(DOSELIBS)/*.mlpack $(DOSELIBS)/*.cmx ; \
+	  rm -f $(DOSELIBS)/*.mlpack ; \
 	  fi ; \
 	done

@@ -158,7 +158,7 @@ $(DOSELIBS)/doseparse.%: $(DOSELIBS)/pef.% $(DOSELIBS)/debian.%
 	  if [ -e $$i ]; then \
 	  cp $$i $(DOSELIBS) ; \
 		rm $$i ;\
-	  rm -f $(DOSELIBS)/*.mlpack $(DOSELIBS)/*.cmx $(DOSELIBS)/*.ml ; \
+	  rm -f $(DOSELIBS)/*.mlpack $(DOSELIBS)/*.ml ; \
 	  fi ; \
 	done

@@ -168,7 +168,7 @@ $(DOSELIBS)/doseparseNoRpm.%: $(DOSELIBS)/pef.% $(DOSELIBS)/debian.%
 	  if [ -e $$i ]; then \
 			cp $$i $(DOSELIBS) ;\
 			rm $$i ;\
-			rm -f $(DOSELIBS)/*.mlpack $(DOSELIBS)/*.cmx ;\
+			rm -f $(DOSELIBS)/*.mlpack ;\
 	  fi ; \
 	done

@@ -223,7 +223,7 @@ INSTALL_STUFF_ = META
 INSTALL_STUFF_ += $(wildcard _build/doselibs/*.cma _build/doselibs/*.cmi)
 INSTALL_STUFF_ += $(wildcard _build/doselibs/*.cmxa _build/doselibs/*.cmxs)
 INSTALL_STUFF_ += $(wildcard _build/doselibs/*.a)
-#INSTALL_STUFF_ += $(wildcard _build/*/*.mli)
+INSTALL_STUFF_ += $(wildcard _build/doselibs/*.mli) $(wildcard _build/doselibs/*.cmti) $(wildcard _build/doselibs/*.cmx)
 INSTALL_STUFF_ += $(wildcard _build/rpm/*.so)

 exclude_cudf = $(wildcard _build/doselibs/*cudf* _build/cudf/*)
--
2.11.0


code:
From b94cf24739818e5aff397e0a83b19ea32dc81f42 Mon Sep 17 00:00:00 2001
From: Louis Gesbert <louis.gesbert@ocamlpro.com>
Date: Tue, 6 Feb 2018 10:15:45 +0100
Subject: [PATCH 3/3] Add "unix" as dependency to dose3.common in META.in

---
 META.in | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/META.in b/META.in
index aa2cd8d..0f9d337 100644
--- a/META.in
+++ b/META.in
@@ -8,7 +8,7 @@ package "common" (
 version = "@PACKAGE_VERSION@"
 archive(byte) = "common.cma"
 archive(native) = "common.cmxa"
-requires = "extlib, re.pcre, cudf, @ZIP@, @BZ2@"
+requires = "extlib, re.pcre, cudf, unix, @ZIP@, @BZ2@"
 )

 package "algo" (
--
2.11.0


code:
--- a/configure
+++ b/configure
@@ -6552,6 +6552,3 @@ if test -n "$ac_unrecognized_opts" && test "$enable_option_checking" != no; then
   { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: unrecognized options: $ac_unrecognized_opts" >&5
 $as_echo "$as_me: WARNING: unrecognized options: $ac_unrecognized_opts" >&2;}
 fi
-
-
-make printconf


code:
From a87c3f20e846c00e53d695497dba7038edbd12f0 Mon Sep 17 00:00:00 2001
From: Valentin Lorentz <progval@progval.net>
Date: Thu, 13 Aug 2015 11:59:04 +0200
Subject: [PATCH] Enable ocamldoc to build reproducible manpages

Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=794586
Signed-off-by: Stephane Glondu <steph@glondu.net>
---
 ocamldoc/odoc_man.ml   | 15 +++++----------
 ocamldoc/odoc_misc.ml  | 12 ++++++++++--
 ocamldoc/odoc_misc.mli |  7 ++++++-
 3 files changed, 21 insertions(+), 13 deletions(-)

diff --git a/ocamldoc/odoc_man.ml b/ocamldoc/odoc_man.ml
index 615c5e172..3c85aa32a 100644
--- a/ocamldoc/odoc_man.ml
+++ b/ocamldoc/odoc_man.ml
@@ -864,14 +864,13 @@ class man =
     (** Generate the man page for the given class.*)
     method generate_for_class cl =
       Odoc_info.reset_type_names () ;
-      let date = Unix.time () in
       let file = self#file_name cl.cl_name in
       try
         let chanout = self#open_out file in
         let b = new_buf () in
         bs b (".TH \""^cl.cl_name^"\" ");
         bs b !man_section ;
-        bs b (" "^(Odoc_misc.string_of_date ~hour: false date)^" ");
+        bs b (" source: "^Odoc_misc.current_date^" ");
         bs b "OCamldoc ";
         bs b ("\""^(match !Global.title with Some t -> t | None -> "")^"\"\n");

@@ -923,14 +922,13 @@ class man =
     (** Generate the man page for the given class type.*)
     method generate_for_class_type ct =
       Odoc_info.reset_type_names () ;
-      let date = Unix.time () in
       let file = self#file_name ct.clt_name in
       try
         let chanout = self#open_out file in
         let b = new_buf () in
         bs b (".TH \""^ct.clt_name^"\" ");
         bs b !man_section ;
-        bs b (" "^(Odoc_misc.string_of_date ~hour: false date)^" ");
+        bs b (" source: "^Odoc_misc.current_date^" ");
         bs b "OCamldoc ";
         bs b ("\""^(match !Global.title with Some t -> t | None -> "")^"\"\n");

@@ -1016,14 +1014,13 @@ class man =
     (** Generate the man file for the given module type.
        @raise Failure if an error occurs.*)
     method generate_for_module_type mt =
-      let date = Unix.time () in
       let file = self#file_name mt.mt_name in
       try
         let chanout = self#open_out file in
         let b = new_buf () in
         bs b (".TH \""^mt.mt_name^"\" ");
         bs b !man_section ;
-        bs b (" "^(Odoc_misc.string_of_date ~hour: false date)^" ");
+        bs b (" source: "^Odoc_misc.current_date^" ");
         bs b "OCamldoc ";
         bs b ("\""^(match !Global.title with Some t -> t | None -> "")^"\"\n");

@@ -1099,14 +1096,13 @@ class man =
     (** Generate the man file for the given module.
        @raise Failure if an error occurs.*)
     method generate_for_module m =
-      let date = Unix.time () in
       let file = self#file_name m.m_name in
       try
         let chanout = self#open_out file in
         let b = new_buf () in
         bs b (".TH \""^m.m_name^"\" ");
         bs b !man_section ;
-        bs b (" "^(Odoc_misc.string_of_date ~hour: false date)^" ");
+        bs b (" source: "^Odoc_misc.current_date^" ");
         bs b "OCamldoc ";
         bs b ("\""^(match !Global.title with Some t -> t | None -> "")^"\"\n");

@@ -1206,14 +1202,13 @@ class man =
           | Res_const (_,f) -> f.vc_name
          )
      in
-     let date = Unix.time () in
       let file = self#file_name name in
       try
         let chanout = self#open_out file in
         let b = new_buf () in
         bs b (".TH \""^name^"\" ");
         bs b !man_section ;
-        bs b (" "^(Odoc_misc.string_of_date ~hour: false date)^" ");
+        bs b (" source: "^Odoc_misc.current_date^" ");
         bs b "OCamldoc ";
         bs b ("\""^(match !Global.title with Some t -> t | None -> "")^"\"\n");
         bs b ".SH NAME\n";
diff --git a/ocamldoc/odoc_misc.ml b/ocamldoc/odoc_misc.ml
index 4c74476da..456225f62 100644
--- a/ocamldoc/odoc_misc.ml
+++ b/ocamldoc/odoc_misc.ml
@@ -223,9 +223,9 @@ let apply_opt f v_opt =
     None -> None
   | Some v -> Some (f v)

-let string_of_date ?(hour=true) d =
+let string_of_date ?(absolute=false) ?(hour=true) d =
   let add_0 s = if String.length s < 2 then "0"^s else s in
-  let t = Unix.localtime d in
+  let t = (if absolute then Unix.gmtime else Unix.localtime) d in
   (string_of_int (t.Unix.tm_year + 1900))^"-"^
   (add_0 (string_of_int (t.Unix.tm_mon + 1)))^"-"^
   (add_0 (string_of_int t.Unix.tm_mday))^
@@ -238,6 +238,14 @@ let string_of_date ?(hour=true) d =
      ""
   )

+let current_date =
+  let time =
+    try
+      float_of_string (Sys.getenv "SOURCE_DATE_EPOCH")
+    with
+      Not_found -> Unix.time ()
+  in string_of_date ~absolute: true ~hour: false time
+

 let rec text_list_concat sep l =
   match l with
diff --git a/ocamldoc/odoc_misc.mli b/ocamldoc/odoc_misc.mli
index dd5a7fcb9..38ff0612b 100644
--- a/ocamldoc/odoc_misc.mli
+++ b/ocamldoc/odoc_misc.mli
@@ -62,7 +62,12 @@ val apply_opt : ('a -> 'b) -> 'a option -> 'b option

 (** Return a string representing a date given as a number of seconds
    since 1970. The hour is optionnaly displayed. *)
-val string_of_date : ?hour:bool -> float -> string
+val string_of_date : ?absolute:bool -> ?hour:bool -> float -> string
+
+(* Value returned by string_of_date for current time.
+ * Uses environment variable SOURCE_DATE_EPOCH if set; falls back to
+ * current timestamp otherwise. *)
+val current_date : string

 (** Return the first sentence (until the first dot) of a text.
    Don't stop in the middle of [Code], [Verbatim], [List], [Lnum],
--
2.17.1


code:
From 2e7e254160506dc00f1beabf170512a8e932934b Mon Sep 17 00:00:00 2001
From: Julien Lepiller <julien@lepiller.eu>
Date: Sat, 31 Dec 2016 15:43:38 +0100
Subject: [PATCH] fix build date in binary

---
 src/magic/omake_gen_magic.ml | 12 ++----------
 1 file changed, 2 insertions(+), 10 deletions(-)

diff --git a/src/magic/omake_gen_magic.ml b/src/magic/omake_gen_magic.ml
index b2419ba..fad52f5 100644
--- a/src/magic/omake_gen_magic.ml
+++ b/src/magic/omake_gen_magic.ml
@@ -150,7 +150,7 @@ let ir_magic = "%s"
 let obj_magic = "%s"
 let lib_dir = "%s"
 let version = "%s"
-let version_message = "OMake %s:\\n\\tbuild [%s %s %d %02d:%02d:%02d %d]\\n\\ton %s"
+let version_message = "OMake %s"
 |}
        default_save_interval
        digest_len
@@ -160,15 +160,7 @@ let version_message = "OMake %s:\\n\\tbuild [%s %s %d %02d:%02d:%02d %d]\\n\\ton
        (digest_files ".omo.magic" ".omo" omo_files)
        (String.escaped libdir)
        (String.escaped (shorten_version version))
-       (String.escaped version)
-       [|"Sun"; "Mon"; "Tue"; "Wed"; "Thu"; "Fri"; "Sat"|].(tm.tm_wday)
-       [|"Jan"; "Feb"; "Mar"; "Apr"; "May"; "Jun"; "Jul"; "Aug"; "Sep"; "Oct"; "Nov"; "Dec"|].(tm.tm_mon)
-       tm.tm_mday
-       tm.tm_hour
-       tm.tm_min
-       tm.tm_sec
-       (tm.tm_year + 1900)
-       (String.escaped (Unix.gethostname ()));
+       (String.escaped version);
   List.iter
     (fun (name,value) ->
        Printf.fprintf buf "let %s = %S\n" name value
--
2.11.0