SOURCES/DBI-1.643-Catch-warning.patch

@@ -0,0 +1,48 @@
+From 2eda0ec996d0a9357885acd442c72ac206adb7b3 Mon Sep 17 00:00:00 2001
+From: "H.Merijn Brand - Tux" <linux@tux.freedom.nl>
+Date: Wed, 28 Oct 2020 15:09:01 +0100
+Subject: [PATCH] Catch warning
+
+---
+ t/51dbm_file.t | 16 ++++++++++------
+ 1 file changed, 10 insertions(+), 6 deletions(-)
+
+diff --git a/t/51dbm_file.t b/t/51dbm_file.t
+index 686a3d2..0ae910c 100644
+--- a/t/51dbm_file.t
++++ b/t/51dbm_file.t
+@@ -18,21 +18,25 @@ do "./t/lib.pl";
+ {
+     # test issue reported in RT#99508
+     my @msg;
+-    eval {
+-	local $SIG{__DIE__} = sub { push @msg, @_ };
+-	my $dbh = DBI->connect ("dbi:DBM:f_dir=./hopefully-doesnt-existst;sql_identifier_case=1;RaiseError=1");
++    my $dbh = eval {
++	local $SIG{__WARN__} = sub { push @msg, @_ };
++	local $SIG{__DIE__}  = sub { push @msg, @_ };
++	DBI->connect ("dbi:DBM:f_dir=./hopefully-doesnt-existst;sql_identifier_case=1;RaiseError=1");
+     };
++    is ($dbh, undef, "Connect failed");
+     like ("@msg", qr{.*hopefully-doesnt-existst.*}, "Cannot open from non-existing directory with attributes in DSN");
+ 
+     @msg = ();
+-    eval {
+-	local $SIG{__DIE__} = sub { push @msg, @_ };
+-	my $dbh = DBI->connect ("dbi:DBM:", , undef, undef, {
++    $dbh = eval {
++	local $SIG{__WARN__} = sub { push @msg, @_ };
++	local $SIG{__DIE__}  = sub { push @msg, @_ };
++	DBI->connect ("dbi:DBM:", , undef, undef, {
+ 	    f_dir               => "./hopefully-doesnt-existst",
+ 	    sql_identifier_case => 1,
+ 	    RaiseError          => 1,
+ 	});
+     };
++    is ($dbh, undef, "Connect failed");
+     like ("@msg", qr{.*hopefully-doesnt-existst}, "Cannot open from non-existing directory with attributes in HASH");
+ }
+ 
+-- 
+2.41.0
+

SOURCES/DBI-1.643-Document-the-new-behavior-for-f_dir.patch

@@ -0,0 +1,29 @@
+From c71b64a678bcd708c7b75ee2bef5a360c836444c Mon Sep 17 00:00:00 2001
+From: "H.Merijn Brand - Tux" <linux@tux.freedom.nl>
+Date: Wed, 28 Oct 2020 15:57:17 +0100
+Subject: [PATCH] Document the new behavior for f_dir
+
+These changes also warrant a version increase
+---
+ lib/DBD/File.pm | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/lib/DBD/File.pm b/lib/DBD/File.pm
+index baffefa..afbff26 100644
+--- a/lib/DBD/File.pm
++++ b/lib/DBD/File.pm
+@@ -1062,6 +1062,11 @@ directory) when the dbh attribute is set.
+ 
+   f_dir => "/data/foo/csv",
+ 
++If C<f_dir> is set to a non-existing location, the connection will fail.
++See CVE-2014-10401 for reasoning. Because of this, folders to use cannot
++be created after the connection, but must exist before the connection is
++initiated.
++
+ See L<KNOWN BUGS AND LIMITATIONS>.
+ 
+ =head4 f_dir_search
+-- 
+2.41.0
+

SOURCES/DBI-1.643-Fix-for-CVE-2014-10401.patch

@@ -0,0 +1,165 @@
+From 32398bff24f054f4e9b48b97ecb70ce72267296c Mon Sep 17 00:00:00 2001
+From: Jens Rehsack <sno@netbsd.org>
+Date: Tue, 6 Oct 2020 06:50:37 +0200
+Subject: [PATCH 1/3] DBD/File,DBI/DBD/SqlEngine: bump copyright year
+
+Bump copyright years for both since there has been done work in meantime ...
+including intended f_dir= fix for CVE-2014-10401
+
+Signed-off-by: Jens Rehsack <sno@netbsd.org>
+---
+ lib/DBD/File.pm          | 4 ++--
+ lib/DBI/DBD/SqlEngine.pm | 4 ++--
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/lib/DBD/File.pm b/lib/DBD/File.pm
+index dd4312b..fb14e9a 100644
+--- a/lib/DBD/File.pm
++++ b/lib/DBD/File.pm
+@@ -9,7 +9,7 @@
+ #
+ #  The original author is Jochen Wiedmann.
+ #
+-#  Copyright (C) 2009-2013 by H.Merijn Brand & Jens Rehsack
++#  Copyright (C) 2009-2020 by H.Merijn Brand & Jens Rehsack
+ #  Copyright (C) 2004 by Jeff Zucker
+ #  Copyright (C) 1998 by Jochen Wiedmann
+ #
+@@ -1430,7 +1430,7 @@ The original author is Jochen Wiedmann.
+ 
+ =head1 COPYRIGHT AND LICENSE
+ 
+- Copyright (C) 2009-2013 by H.Merijn Brand & Jens Rehsack
++ Copyright (C) 2009-2020 by H.Merijn Brand & Jens Rehsack
+  Copyright (C) 2004-2009 by Jeff Zucker
+  Copyright (C) 1998-2004 by Jochen Wiedmann
+ 
+diff --git a/lib/DBI/DBD/SqlEngine.pm b/lib/DBI/DBD/SqlEngine.pm
+index fb755ab..8e933f7 100644
+--- a/lib/DBI/DBD/SqlEngine.pm
++++ b/lib/DBI/DBD/SqlEngine.pm
+@@ -9,7 +9,7 @@
+ #
+ #  The original author is Jochen Wiedmann.
+ #
+-#  Copyright (C) 2009-2013 by H.Merijn Brand & Jens Rehsack
++#  Copyright (C) 2009-2020 by H.Merijn Brand & Jens Rehsack
+ #  Copyright (C) 2004 by Jeff Zucker
+ #  Copyright (C) 1998 by Jochen Wiedmann
+ #
+@@ -2216,7 +2216,7 @@ The original authors are Jochen Wiedmann and Jeff Zucker.
+ 
+ =head1 COPYRIGHT AND LICENSE
+ 
+- Copyright (C) 2009-2013 by H.Merijn Brand & Jens Rehsack
++ Copyright (C) 2009-2020 by H.Merijn Brand & Jens Rehsack
+  Copyright (C) 2004-2009 by Jeff Zucker
+  Copyright (C) 1998-2004 by Jochen Wiedmann
+ 
+-- 
+2.41.0
+
+
+From 27b10b5c3aacabc091046beaba478e671bb6111c Mon Sep 17 00:00:00 2001
+From: Jens Rehsack <sno@netbsd.org>
+Date: Tue, 6 Oct 2020 08:23:55 +0200
+Subject: [PATCH 2/3] t/51dbm_file.t: add test from RT#99508
+
+Add test with f_dir="something-not-existing" as reported in RT#99508
+to verify when it's fixed for real.
+
+Signed-off-by: Jens Rehsack <sno@netbsd.org>
+---
+ t/51dbm_file.t | 23 +++++++++++++++++++++++
+ 1 file changed, 23 insertions(+)
+
+diff --git a/t/51dbm_file.t b/t/51dbm_file.t
+index d9824cf..686a3d2 100644
+--- a/t/51dbm_file.t
++++ b/t/51dbm_file.t
+@@ -15,6 +15,27 @@ use DBI;
+ 
+ do "./t/lib.pl";
+ 
++{
++    # test issue reported in RT#99508
++    my @msg;
++    eval {
++	local $SIG{__DIE__} = sub { push @msg, @_ };
++	my $dbh = DBI->connect ("dbi:DBM:f_dir=./hopefully-doesnt-existst;sql_identifier_case=1;RaiseError=1");
++    };
++    like ("@msg", qr{.*hopefully-doesnt-existst.*}, "Cannot open from non-existing directory with attributes in DSN");
++
++    @msg = ();
++    eval {
++	local $SIG{__DIE__} = sub { push @msg, @_ };
++	my $dbh = DBI->connect ("dbi:DBM:", , undef, undef, {
++	    f_dir               => "./hopefully-doesnt-existst",
++	    sql_identifier_case => 1,
++	    RaiseError          => 1,
++	});
++    };
++    like ("@msg", qr{.*hopefully-doesnt-existst}, "Cannot open from non-existing directory with attributes in HASH");
++}
++
+ my $dir = test_dir();
+ 
+ my $dbh = DBI->connect( 'dbi:DBM:', undef, undef, {
+@@ -23,6 +44,8 @@ my $dbh = DBI->connect( 'dbi:DBM:', undef, undef, {
+     }
+ );
+ 
++ok( $dbh, "Connect with driver attributes in hash" );
++
+ ok( $dbh->do(q/drop table if exists FRED/), 'drop table' );
+ 
+ my $dirfext = $^O eq 'VMS' ? '.sdbm_dir' : '.dir';
+-- 
+2.41.0
+
+
+From 19d0fb169eed475e1c053e99036b8668625cfa94 Mon Sep 17 00:00:00 2001
+From: Jens Rehsack <sno@netbsd.org>
+Date: Tue, 6 Oct 2020 10:22:17 +0200
+Subject: [PATCH 3/3] lib/DBD/File.pm: fix CVE-2014-10401
+
+Dig into the root cause of RT#99508 - which resulted in CVE-2014-10401 - and
+figure out that DBI->parse_dsn is the wrong helper to parse our attributes in
+DSN, since in DBD::dr::connect only the "dbname" remains from DSN which causes
+parse_dsn to bailout.
+
+Parsing on our own similar to parse_dsn shows the way out.
+
+Signed-off-by: Jens Rehsack <sno@netbsd.org>
+---
+ lib/DBD/File.pm | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/lib/DBD/File.pm b/lib/DBD/File.pm
+index fb14e9a..f55076f 100644
+--- a/lib/DBD/File.pm
++++ b/lib/DBD/File.pm
+@@ -109,7 +109,11 @@ sub connect
+     # We do not (yet) care about conflicting attributes here
+     # my $dbh = DBI->connect ("dbi:CSV:f_dir=test", undef, undef, { f_dir => "text" });
+     # will test here that both test and text should exist
+-    if (my $attr_hash = (DBI->parse_dsn ($dbname))[3]) {
++    #
++    # Parsing on our own similar to parse_dsn to find attributes in 'dbname' parameter.
++    if ($dbname) {
++	my @attrs = split /;/ => $dbname;
++	my $attr_hash = { map { split /\s*=>?\s*|\s*,\s*/, $_} @attrs };
+ 	if (defined $attr_hash->{f_dir} && ! -d $attr_hash->{f_dir}) {
+ 	    my $msg = "No such directory '$attr_hash->{f_dir}";
+ 	    $drh->set_err (2, $msg);
+@@ -120,7 +124,6 @@ sub connect
+     if ($attr and defined $attr->{f_dir} && ! -d $attr->{f_dir}) {
+ 	my $msg = "No such directory '$attr->{f_dir}";
+ 	$drh->set_err (2, $msg);
+-	$attr->{RaiseError} and croak $msg;
+ 	return;
+ 	}
+ 
+-- 
+2.41.0
+

SOURCES/DBI-1.643-Fix-for-empty-attributes-in-DSN.patch

@@ -0,0 +1,33 @@
+From 89f0d4cd38b83f0ee426a5fdf7d1ad5ea371c883 Mon Sep 17 00:00:00 2001
+From: "H.Merijn Brand - Tux" <linux@tux.freedom.nl>
+Date: Wed, 28 Oct 2020 15:03:48 +0100
+Subject: [PATCH] Fix for empty attributes in DSN
+
+dbm_type=SDBM_File;dbm_mldbm=;f_lockfile=.lck'
+                             ^
+would result in
+
+Odd number of elements in anonymous hash
+---
+ lib/DBD/File.pm | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/lib/DBD/File.pm b/lib/DBD/File.pm
+index f55076f..baffefa 100644
+--- a/lib/DBD/File.pm
++++ b/lib/DBD/File.pm
+@@ -112,8 +112,9 @@ sub connect
+     #
+     # Parsing on our own similar to parse_dsn to find attributes in 'dbname' parameter.
+     if ($dbname) {
+-	my @attrs = split /;/ => $dbname;
+-	my $attr_hash = { map { split /\s*=>?\s*|\s*,\s*/, $_} @attrs };
++	my $attr_hash = {
++	    map { (m/^\s* (\S+) \s*(?: =>? | , )\s* (\S*) \s*$/x) }
++	    split m/;/ => $dbname };
+ 	if (defined $attr_hash->{f_dir} && ! -d $attr_hash->{f_dir}) {
+ 	    my $msg = "No such directory '$attr_hash->{f_dir}";
+ 	    $drh->set_err (2, $msg);
+-- 
+2.41.0
+

SPECS/perl-DBI.spec

@@ -34,11 +34,16 @@
 
 Name:           perl-DBI
 Version:        1.643
-Release:        9%{?dist}
+Release:        26%{?dist}
 Summary:        A database access API for perl
-License:        GPL+ or Artistic
+License:        GPL-1.0-or-later OR Artistic-1.0-Perl
 URL:            http://dbi.perl.org/
 Source0:        https://cpan.metacpan.org/authors/id/T/TI/TIMB/DBI-%{version}.tar.gz
+# Backport patches to properly solve CVE-2014-10401 and CVE-2014-10402
+Patch0:         DBI-1.643-Fix-for-CVE-2014-10401.patch
+Patch1:         DBI-1.643-Fix-for-empty-attributes-in-DSN.patch
+Patch2:         DBI-1.643-Catch-warning.patch
+Patch3:         DBI-1.643-Document-the-new-behavior-for-f_dir.patch
 BuildRequires:  coreutils
 BuildRequires:  findutils
 BuildRequires:  gcc
@@ -115,7 +120,6 @@ BuildRequires:  perl(Test::Simple) >= 0.90
 BuildRequires:  perl(Test::Pod) >= 1.00
 BuildRequires:  perl(Test::Pod::Coverage) >= 1.04
 %endif
-Requires:       perl(:MODULE_COMPAT_%(eval "`perl -V:version`"; echo $version))
 %if %{with perl_DBI_enables_Clone}
 Suggests:       perl(Clone) >= 0.34
 %endif
@@ -134,6 +138,8 @@ Suggests:       perl(SQL::Statement) >= 1.402
 # Filter unwanted dependencies
 %{?perl_default_filter}
 %global __requires_exclude %{?__requires_exclude:%{__requires_exclude}|}^perl\\(RPC::\\)
+%global __requires_exclude %{__requires_exclude}|^perl\\(DBI::db\\)
+%global __requires_exclude %{__requires_exclude}|^perl\\(DBI::st\\)
 
 %description 
 DBI is a database access Application Programming Interface (API) for
@@ -144,7 +150,6 @@ database interface independent of the actual database being used.
 %if %{with perl_DBI_enables_coro}
 %package Coro
 Summary:        Asynchronous DBD::Gofer stream transport using Coro
-Requires:       perl(:MODULE_COMPAT_%(eval "`perl -V:version`"; echo $version))
 
 %description Coro
 This is an experimental asynchronous DBD::Gofer stream transport for DBI
@@ -152,8 +157,31 @@ implemented on top of Coro. The BIG WIN from using Coro is that it enables
 the use of existing DBI frameworks like DBIx::Class.
 %endif
 
+%package tests
+Summary:        Tests for %{name}
+Requires:       %{name} = %{?epoch:%{epoch}:}%{version}-%{release}
+Requires:       perl-Test-Harness
+# Optional run-time:
+%if %{with perl_DBI_enables_Clone}
+Requires:       perl(Clone) >= 0.34
+%endif
+%if %{with perl_DBI_enables_DB_File}
+Requires:       perl(DB_File)
+%endif
+%if %{with perl_DBI_enables_MLDBM}
+Requires:       perl(MLDBM)
+%endif
+# Do not build-require optional Params::Util to test the fall-back code
+%if %{with perl_DBI_enables_SQL_Statement}
+Requires:       perl(SQL::Statement) >= 1.402
+%endif
+
+%description tests
+Tests from %{name}. Execute them
+with "%{_libexecdir}/%{name}/test".
+
 %prep
-%setup -q -n DBI-%{version} 
+%autosetup -p1 -n DBI-%{version}
 for F in lib/DBD/Gofer.pm; do
     iconv -f ISO-8859-1 -t UTF-8 < "$F" > "${F}.utf8"
     touch -r "$F" "${F}.utf8"
@@ -167,20 +195,27 @@ chmod 0644 ex/*
 chmod 0755 dbixs_rev.pl
 %if %{without perl_DBI_enables_coro}
 rm lib/DBD/Gofer/Transport/corostream.pm
-sed -i -e '/^lib\/DBD\/Gofer\/Transport\/corostream.pm$/d' MANIFEST
+perl -i -ne 'print $_ unless m{^lib/DBD/Gofer/Transport/corostream.pm}' MANIFEST
+
 %endif
 # Remove RPC::Pl* reverse dependencies due to security concerns,
 # CVE-2013-7284, bug #1051110
 for F in lib/Bundle/DBI.pm lib/DBD/Proxy.pm lib/DBI/ProxyServer.pm \
         dbiproxy.PL t/80proxy.t; do
     rm "$F"
-    sed -i -e '\|^'"$F"'|d' MANIFEST
+    perl -i -ne 'print $_ unless m{^\Q'"$F"'\E}' MANIFEST
 done
-sed -i -e 's/"dbiproxy$ext_pl",//' Makefile.PL
+perl -pi -e 's/"dbiproxy\$ext_pl",//' Makefile.PL
 # Remove Win32 specific files to avoid unwanted dependencies
 for F in lib/DBI/W32ODBC.pm lib/Win32/DBIODBC.pm; do
     rm "$F"
-    sed -i -e '\|^'"$F"'|d' MANIFEST
+    perl -i -ne 'print $_ unless m{^\Q'"$F"'\E}' MANIFEST
+done
+
+# Help generators to recognize Perl scripts
+for F in t/*.t t/*.pl; do
+    perl -i -MConfig -ple 'print $Config{startperl} if $. == 1 && !s{\A#!.*perl\b}{$Config{startperl}}' "$F"
+    chmod +x "$F"
 done
 
 %build
@@ -193,6 +228,27 @@ perl Makefile.PL INSTALLDIRS=vendor OPTIMIZE="%{optflags}" \
 find %{buildroot} -type f -name '*.bs' -empty -delete
 %{_fixperms} '%{buildroot}'/*
 
+# Install tests
+mkdir -p %{buildroot}%{_libexecdir}/%{name}
+cp -a t %{buildroot}%{_libexecdir}/%{name}
+rm %{buildroot}%{_libexecdir}/%{name}/t/pod*.t
+# Remove using of blib
+perl -i -ne 'print $_ unless m{^use.*blib/}' %{buildroot}%{_libexecdir}/%{name}/t/1*.t
+perl -pi -e 's/\-Mblib=\$getcwd\/blib//' %{buildroot}%{_libexecdir}/%{name}/t/85gofer.t
+cat > %{buildroot}%{_libexecdir}/%{name}/test << 'EOF'
+#!/bin/bash
+set -e
+# Some tests write into temporary files/directories. The easiest solution
+# is to copy the tests into a writable directory and execute them from there.
+DIR=$(mktemp -d)
+pushd "$DIR"
+cp -a %{_libexecdir}/%{name}/* ./
+prove -I . -j "$(getconf _NPROCESSORS_ONLN)"
+popd
+rm -rf "$DIR"
+EOF
+chmod +x %{buildroot}%{_libexecdir}/%{name}/test
+
 %check
 make test
 
@@ -217,13 +273,70 @@ make test
 %{perl_vendorarch}/DBD/Gofer/Transport/corostream.pm
 %endif
 
+%files tests
+%{_libexecdir}/%{name}
+
 %changelog
-* Mon Aug 09 2021 Mohan Boddu <mboddu@redhat.com> - 1.643-9
-- Rebuilt for IMA sigs, glibc 2.34, aarch64 flags
-  Related: rhbz#1991688
+* Tue Oct 29 2024 Troy Dawson <tdawson@redhat.com> - 1.643-26
+- Bump release for October 2024 mass rebuild:
+  Resolves: RHEL-64018
+
+* Fri Oct 25 2024 MSVSphere Packaging Team <packager@msvsphere-os.ru> - 1.643-25
+- Rebuilt for MSVSphere 10
+
+* Fri Aug 09 2024 Jitka Plesnikova <jplesnik@redhat.com> - 1.643-25
+- Perl 5.40 re-rebuild of bootstrapped packages
+
+* Thu Aug 08 2024 Troy Dawson <tdawson@redhat.com> - 1.643-24
+- Bump release for Aug 2024 java mass rebuild
+
+* Mon Jun 24 2024 Troy Dawson <tdawson@redhat.com> - 1.643-23
+- Bump release for June 2024 mass rebuild
+
+* Thu Jan 25 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1.643-22
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
+
+* Sun Jan 21 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1.643-21
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
+
+* Tue Sep 26 2023 Jitka Plesnikova <jplesnik@redhat.com> - 1.643-20
+- Fix CVE-2014-10401 and CVE-2014-10402
+
+* Tue Sep 19 2023 Jitka Plesnikova <jplesnik@redhat.com> - 1.643-19
+- Package tests
+
+* Thu Jul 20 2023 Fedora Release Engineering <releng@fedoraproject.org> - 1.643-18
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
+
+* Wed Jul 12 2023 Jitka Plesnikova <jplesnik@redhat.com> - 1.643-17
+- Perl 5.38 re-rebuild of bootstrapped packages
+
+* Tue Jul 11 2023 Jitka Plesnikova <jplesnik@redhat.com> - 1.643-16
+- Perl 5.38 rebuild
+
+* Fri Jan 20 2023 Fedora Release Engineering <releng@fedoraproject.org> - 1.643-15
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
+
+* Fri Jul 22 2022 Fedora Release Engineering <releng@fedoraproject.org> - 1.643-14
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
+
+* Fri Jun 03 2022 Jitka Plesnikova <jplesnik@redhat.com> - 1.643-13
+- Perl 5.36 re-rebuild of bootstrapped packages
+
+* Tue May 31 2022 Jitka Plesnikova <jplesnik@redhat.com> - 1.643-12
+- Perl 5.36 rebuild
+
+* Fri Jan 21 2022 Fedora Release Engineering <releng@fedoraproject.org> - 1.643-11
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
+
+* Thu Jul 22 2021 Fedora Release Engineering <releng@fedoraproject.org> - 1.643-10
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
+
+* Mon May 24 2021 Jitka Plesnikova <jplesnik@redhat.com> - 1.643-9
+- Perl 5.34 re-rebuild of bootstrapped packages
 
-* Fri Apr 16 2021 Mohan Boddu <mboddu@redhat.com> - 1.643-8
-- Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937
+* Fri May 21 2021 Jitka Plesnikova <jplesnik@redhat.com> - 1.643-8
+- Perl 5.34 rebuild
 
 * Wed Jan 27 2021 Fedora Release Engineering <releng@fedoraproject.org> - 1.643-7
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild