Bug 12256

Summary: package tar is outdated (1.29 is 3 years old)
Product: buildroot Reporter: Dominique Tronche <dominique.tronche>
Component: Outdated packageAssignee: Carlos Santos <unixmania>
Status: RESOLVED FIXED    
Severity: normal CC: buildroot, yann.morin.1998
Priority: P5    
Version: 2019.02.6   
Target Milestone: ---   
Hardware: All   
OS: Linux   
Host: Target:
Build:
Attachments: patch for tar package update

Description Dominique Tronche 2019-10-07 09:40:04 UTC
The version of package tar 1.29 could be updated. Some more recent versions which fix CVEs exist
Comment 1 Yann E. MORIN 2019-10-07 16:38:49 UTC
We can't upgrade the version of tar without being cautious.

The host tar is used to create the archives in the VCS download backends
(git, cvs, svn, hg...) and tar 1.30 and forward have changed the wau they
generate the archives.

So, all the archives we had generated before 1.30 was released are not
bit-for-bit reproducible (even though the extracted content would be),
so the hashes we have for those archives would not match.

Hence we need to keep host-tar to 1.29.

For the target variant, this is less important of course, but so far
no one submitted a patch. It's also that we do not have many packages
for which the host and target versions are different.
Comment 2 Dominique Tronche 2019-10-08 11:36:57 UTC
Created attachment 8261 [details]
patch for tar package update

Thanks for the explanations. Attached a patch made by my colleague which keeps the host version to 1.29
Regards
Comment 3 Carlos Santos 2019-11-17 13:06:28 UTC
Please submit the patch using git send-email so it becomes visible on patchwork.
Comment 4 Dominique Tronche 2019-11-18 13:21:00 UTC
I'm on a corporate network and not part of buildroot mailing list (and don't necessarily want to be) so I'm not sure how to proceed
Comment 5 Carlos Santos 2019-11-19 01:17:53 UTC
(In reply to Dominique Tronche from comment #4)

OK, I submitted the patch after improving the commit message based on Yann's
comments:

    https://patchwork.ozlabs.org/patch/1197080/
Comment 6 Dominique Tronche 2019-11-19 08:15:19 UTC
Thanks for your help
Regards
Comment 7 Thomas Petazzoni 2020-05-19 21:45:44 UTC
We are now using tar 1.32 for the target. We had to keep tar 1.29 for the host, though.