Version bump by Ferenc Erki closes bug #525582. Mitigation and bump for cross-site...

Package-Manager: portage-2.2.15/cvs/Linux x86_64
Manifest-Sign-Key: 0xB5058F9A

diff --git a/app-misc/elasticsearch/ChangeLog b/app-misc/elasticsearch/ChangeLog
index 6f6abe8350087506090149b4de2d34cdc6fe3334..b3ca9b199bf8046b52be18d3da0d9b2998a90ef8 100644 (file)
--- a/app-misc/elasticsearch/ChangeLog
+++ b/app-misc/elasticsearch/ChangeLog
@@ -1,6 +1,15 @@
 # ChangeLog for app-misc/elasticsearch
-# Copyright 1999-2014 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/app-misc/elasticsearch/ChangeLog,v 1.7 2014/10/06 14:36:26 chainsaw Exp $
+# Copyright 1999-2015 Gentoo Foundation; Distributed under the GPL v2
+# $Header: /var/cvsroot/gentoo-x86/app-misc/elasticsearch/ChangeLog,v 1.8 2015/01/05 11:12:33 chainsaw Exp $
+
+*elasticsearch-1.4.0 (05 Jan 2015)
+*elasticsearch-1.3.2-r2 (05 Jan 2015)
+
+  05 Jan 2015; Tony Vroon <chainsaw@gentoo.org> -elasticsearch-1.3.2.ebuild,
+  -elasticsearch-1.3.2-r1.ebuild, +elasticsearch-1.3.2-r2.ebuild,
+  +elasticsearch-1.4.0.ebuild, +files/1.3.2-http_cors_disable.patch:
+  Version bump by Ferenc Erki closes bug #525582. Mitigation and bump for
+  cross-site scripting vulnerability by Ferenci Erki for security bug 524682.
 
 *elasticsearch-1.3.2-r1 (06 Oct 2014)
 

diff --git a/app-misc/elasticsearch/Manifest b/app-misc/elasticsearch/Manifest
index 5087bd92f3214866608febaa216996f6f0459f75..6f64d2abafc321f0ad6cbca6d02214d97621fe4e 100644 (file)
--- a/app-misc/elasticsearch/Manifest
+++ b/app-misc/elasticsearch/Manifest
@@ -1,6 +1,7 @@
 -----BEGIN PGP SIGNED MESSAGE-----
 Hash: SHA256
 
+AUX 1.3.2-http_cors_disable.patch 784 SHA256 fe3327d8f67e7a045360febad32cc45a6d5f0c0af87d2c01cb3a44b8c064a1b5 SHA512 a636ef08bfc20c973e422baf20bd9e5fc5e741b31f6026572afba3562c024e8b4d6b0eb3bdc10f8f68430064a5bb4aa3ea5e7c1853589979c498e47617407b17 WHIRLPOOL 9cd7e62ba4edaffdc79d7d715840f2f7c01e8fce22983b975bbb01bf005e8f5875023e28d9449053c4ce2cff7b9f5b47568200cdf969a4c8d80175ba0617d677
 AUX elasticsearch.conf 428 SHA256 cabfe972ef28b30d152c022e4a0510f6ce940687a452b8dfb21c060a14af7860 SHA512 f61a75394776a9c2cac5b4dcfcaee03531808546a360a04e28d83f9bde5804bb9ffa305d3b49679a3fafdaa8c060ecbf88486ed1cdd4072af10e287e599d834d WHIRLPOOL 5fb0590f1264b3a3c1bba759c426edc72f2e2d1c2198c9d67c81a4c73b90ba123b052e8b8aea21be920a1c795b6222a592d37949ac705e81d3493dad9ce6d5b4
 AUX elasticsearch.init 2276 SHA256 bc3941c26bd98f148b757200fad3bdd68776ebf0bdb4844b47a02ef82c2384fa SHA512 5d8cb832420fc2484dcb18f98adbb1359b7129b26485bd557c7ef3260ff38ca6a7064a07f91d4824cc045046b6eedd49f19001bcaf9ff6b409b810d0e723f97c WHIRLPOOL 994c63d4026e0288e42993bb8e7eca62c383c6854e96ca4f2e5f7fa41c8b83f7822f696c9cb2f37c696862fec77cca3ca511c5669a2de9267b168c14401c18bd
 AUX elasticsearch.init2 2296 SHA256 a2abd2f6423ebc382a130b6264114d2e4b28d1ec705939f6ccc818bb7a86b491 SHA512 2439482409908774e02726f81bcf8c9d80d0c3e00c468e4ae95dbb7ae9035fd27ae47aa08b1a705ba808a5222b95b37189b1e9ab7ec89797b9f90db572b5f89f WHIRLPOOL 37a1866079dbc0ec6624b2da2da2914752d76d02ebb4764d209a716ac90f1b29014be9930ba6b5999f513b6357c9088d24db3c2b14c763e792dc1c63d2f9fe34
@@ -8,14 +9,15 @@ AUX elasticsearch.init3 2319 SHA256 cb00de8eb5d6f3ddfe48fed1fe20b527900ad79984e2
 AUX elasticsearch.service 274 SHA256 d8581135cb5f6b73245e571f0cd3cfa85c90d96474304214324958b9ee952f7e SHA512 14c0696ab1244e4afde34c0f6aaececbb5a80a75dc9ad23841adefde815c8c9a604858902bd87609d8191dfca7c4eb24f1ad2d041d50d22a789296bf43366a76 WHIRLPOOL 8df4eb48efac8353c21685bc17bd30ce8835f9f5f91f19acd3f69a42a780c69fc118f74d003429e1da9558ffad1a1e649c57521ba8219fcb262a2ffdb2e24e9c
 AUX elasticsearch.service2 279 SHA256 2a827cfa6331652e5a34bb975da52fec6d12ce0a80eacf810f62e22c5272349b SHA512 17994b7a5b0ef883034765d2b0e5c29daccb1e122b956f598d0c2b24085a0e66450fa143e3c656d75bf149a53ca497bc8c747b62ba47743aad17ae1a446d6d7d WHIRLPOOL 0c97253da7f75586c135568036f149f2465a1d73f5cb6e67b45a36832c2f54b61b0bcfd60db122c7e1ea6e7595e379dfe49a7e7bbad596840da6158a7d56dc46
 DIST elasticsearch-1.3.2.tar.gz 27949096 SHA256 7525d0a4db4f7eb791a1f8da97b081a5d8b44a2b232d8324877177bdee992ea4 SHA512 4a67531cf9927db466f70b4c572c472913533352de586f7e2c5f84ec9c7337002a0de0ee2bdb809e99b954bb8bd7d207baf723f1b53b2949702f838c85d6380a WHIRLPOOL 3b3edfefa6e49b2271ed107ecc8d2a84ab3db6834f85eb90c33fc8f9dfff4a815cbd2f3d7af2e6f6a9edfd2186508f6308bdee3846405cebf4ab89e8d13f0ffd
-EBUILD elasticsearch-1.3.2-r1.ebuild 2173 SHA256 83b59820c8feee36243f0e4cee25047c643688d0323a8d138526cd416f0d3fd4 SHA512 1352fb3877e1e9eb229a98f8dd82fb8d1a4970e46b957e0322b3911b180bff667dc0f0419e2fbd92d1f62bda5a68deb4538d360de7e1ead81b363f44020e4d5c WHIRLPOOL c9ba4efb97b721147f0c107745b7b2b4c3c49fd3a3af8f9aa8fa93974147b0b4005b6ec57ff49067f4a9df9fc9d2c233a681bc58dec7de5dc30e01cc56429d0c
-EBUILD elasticsearch-1.3.2.ebuild 2235 SHA256 b8956c61c89178db91d61d8c9a166c3058dcf3f3be50250941009bf1babe3b3f SHA512 567fbcbdf2669ef33b42c29b1774265573b855205d383f99acd47fa7926b91d93521d08c73acf21e721128e1ab1fa20a170fed53c3bd33504615c3a71ff181f7 WHIRLPOOL 0c19433233ce1bb45b94b57a6dbba9a4e99970cbfe329931e8ca06f680d2240654c16f1a274c2a00112de70aa1bc2fea31391fafdde2ea6a822b42a91a684728
-MISC ChangeLog 2125 SHA256 6019125a19c0d37338d4da4c442fbe6cfaa95a05de49f4380c260026272b8e6b SHA512 7baf8a1b2a6052a64d54c6cb91f5df431346d8cfcf90298393acf604b7be5ed10c97878687ce2b5d10d680ae63dcd0dd53acba6066000c742133b95e58467f0a WHIRLPOOL c69e8c0d5b47d6f40b8a6c3381d756ab0a45c16ce3883b649912b5366adc239dcfb7fb3b9e4fd22d61f586cff3455edc7611267ca7d73b97fe27f33d85bd2eab
+DIST elasticsearch-1.4.0.tar.gz 27730896 SHA256 b317966befa50c22595477f9bad8ce67932e4d33e08ee8fb1c6e9690afa5064a SHA512 763307f9dc65c408190b1620907573c949755fc2fb3652c8de1068a566f567fb56ace4058762d1243c64391ac25f495ccf92ebfad0af470a83d3154d3ccaec8d WHIRLPOOL 13e596fba51d5b7b5ec2950534d6655238cee56b414e4265eb463ce0de287b9155ac7c7112c9f4222b6e11589f2606f35779df9b40de13032c4c6ee2d43ed85b
+EBUILD elasticsearch-1.3.2-r2.ebuild 2250 SHA256 927dfdb53ad925abd252ae540920b2a5b5cd651e3c5523a773466756624cbd60 SHA512 cf6ad8da8d9e085d7c4ad810c34e1933f35fe6339b13dd04f0b905392668995f6d5977e20cdf886f1bab9b07f82d36c419804ae3223f035ecb700a8a7d16d87f WHIRLPOOL b6da7e2cddc723c06354625e5a54cdc6908e16352e676554f36ac076854609729d561f83737ed98c2fb002495a97c3896f998f7acec9c86d7255627abeb5ffa0
+EBUILD elasticsearch-1.4.0.ebuild 2194 SHA256 0b5df04b1b75198283321070d2f48ecd22a56481e9e66c17e122e744428de0ee SHA512 fa1ae4718fa38978c2d5970528fceae78d2d37c12a4b922e9dffd9d55deb718f84f44d7379b7a57af478bcb1db1a2e8968fc5da3253136eabcf0419b281c6860 WHIRLPOOL a4d93829f40fd82d4ed5e03574a2c4be3d860da152fa291c2695213887c6b0ac2122e4b0aaa74171549a74195089aead02a58c1941996235fd7b7a098e208819
+MISC ChangeLog 2564 SHA256 09bdb33224c9b1d7430315bf35449d1c8ba548740f06b81d3c8b62bbe3419eea SHA512 e6ee91e4eb8c9bb9114d723375e3f6b77051aa32a015a7629e762a5ac29c6ce73769046ef5f208e344cb35a46a38ff56ba41ae27e4657f3ba92d0f9997347ec3 WHIRLPOOL 1ae20e7cbbcc0749ebacfb293a3b0f2b0ee5fa2852b61e09122d0c3dd196b62f4aaba247902027a0bd23df454490d0e3f02cfe5305a35d04e84453631fac7c3b
 MISC metadata.xml 237 SHA256 88d9092fd208599a8b524cca9633d9330223e45c34a44e54b2de05edb4738ac7 SHA512 11773ab2b5adaa81f3c8f73413d2f257ea1d1624df689154ee2697412ff14ea8f9851b805c4a474b486abb0a066cfc929f91eb852a208b9536885d467df36af1 WHIRLPOOL 324b778d3103d615af41fd6d1d978beeeeb08f4823a3c81fd453464b4df2ed59b56a481ddd65b4eb740dc75b4dc69133e761199abe6d27333b1fce97d5b5a1be
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2
 
-iEYEAREIAAYFAlQyqOsACgkQp5vW4rUFj5p9nACfThkZZIgkRYPl8fKyQV9M52Qk
-dJIAnii2d87iG+Pc00eumi5quqkPJd9X
-=/BGO
+iEYEAREIAAYFAlSqcbIACgkQp5vW4rUFj5plJgCeMv7uOKqB+iVo3d2nbzV3hTxO
+GtQAoLqflLhHutwjNg8+QUgBZJCW9/pK
+=Ak7W
 -----END PGP SIGNATURE-----

diff --git a/app-misc/elasticsearch/elasticsearch-1.3.2.ebuild b/app-misc/elasticsearch/elasticsearch-1.3.2-r2.ebuild
similarity index 73%
rename from app-misc/elasticsearch/elasticsearch-1.3.2.ebuild
rename to app-misc/elasticsearch/elasticsearch-1.3.2-r2.ebuild
index 7da71a2f76f6f2a6589a80cb50cb0b5dadef8158..9dbce79a82dace615fc3d692a37584d0fd7430f4 100644 (file)
--- a/app-misc/elasticsearch/elasticsearch-1.3.2.ebuild
+++ b/app-misc/elasticsearch/elasticsearch-1.3.2-r2.ebuild
@@ -1,6 +1,6 @@
-# Copyright 1999-2014 Gentoo Foundation
+# Copyright 1999-2015 Gentoo Foundation
 # Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/app-misc/elasticsearch/elasticsearch-1.3.2.ebuild,v 1.2 2014/09/18 10:36:19 chainsaw Exp $
+# $Header: /var/cvsroot/gentoo-x86/app-misc/elasticsearch/elasticsearch-1.3.2-r2.ebuild,v 1.1 2015/01/05 11:12:33 chainsaw Exp $
 
 EAPI=5
 
@@ -29,11 +29,6 @@ src_prepare() {
        rm lib/sigar/libsigar-ia64-linux.so
        rm LICENSE.txt
 
-       mv bin/${MY_PN}.in.sh bin/${MY_PN}.in.sh.sample
-       for file in config/* ; do
-               mv ${file} ${file}.sample
-       done
-
        use amd64 && {
                rm lib/sigar/libsigar-x86-linux.so
        }
@@ -41,14 +36,18 @@ src_prepare() {
        use x86 && {
                rm lib/sigar/libsigar-amd64-linux.so
        }
+
+       # Security bug #524682
+       epatch "${FILESDIR}/${PV}-http_cors_disable.patch"
 }
 
 src_install() {
        dodir /etc/${MY_PN}
-       insinto /etc/${MY_PN}
-       doins bin/${MY_PN}.in.sh.sample
+
+       insinto /usr/share/doc/${P}/examples
+       doins bin/${MY_PN}.in.sh
        doins config/*
-       rm bin/${MY_PN}.in.sh.sample
+       rm bin/${MY_PN}.in.sh
        rm -rf config
 
        insinto /usr/share/${MY_PN}
@@ -57,7 +56,7 @@ src_install() {
 
        keepdir /var/{lib,log}/${MY_PN}
 
-       local rcscript=elasticsearch.init2
+       local rcscript=elasticsearch.init3
        local eshome="/usr/share/${MY_PN}"
        local jarfile="${MY_PN}-${PV}.jar"
        local esclasspath="${eshome}/lib/${jarfile}:${eshome}/lib/*:${eshome}/lib/sigar/*"
@@ -70,16 +69,17 @@ src_install() {
 
        newinitd "${T}/${rcscript}" "${MY_PN}"
        newconfd "${FILESDIR}/${MY_PN}.conf" "${MY_PN}"
-       systemd_dounit "${FILESDIR}"/${PN}.service
+       systemd_newunit "${FILESDIR}"/${PN}.service2 "${PN}.service"
 }
 
 pkg_postinst() {
        elog
        elog "You may create multiple instances of ${MY_PN} by"
-       elog "symlinking the init script ln -sf /etc/init.d/${MY_PN} /etc/init.d/${MY_PN}.instance"
+       elog "symlinking the init script:"
+       elog "ln -sf /etc/init.d/${MY_PN} /etc/init.d/${MY_PN}.instance"
        elog
-       elog "Each of the *.sample files in /etc/${MY_PN} should be copied"
-       elog "to the proper configuration directory:"
+       elog "Each of the example files in /usr/share/doc/${P}/examples"
+       elog "should be extracted to the proper configuration directory:"
        elog "/etc/${MY_PN} (for standard init)"
        elog "/etc/${MY_PN}/instance (for symlinked init)"
        elog

diff --git a/app-misc/elasticsearch/elasticsearch-1.3.2-r1.ebuild b/app-misc/elasticsearch/elasticsearch-1.4.0.ebuild
similarity index 94%
rename from app-misc/elasticsearch/elasticsearch-1.3.2-r1.ebuild
rename to app-misc/elasticsearch/elasticsearch-1.4.0.ebuild
index 9d6609ec08306c37f2734f51366888f4ea427bbb..7462dbf3efc15175db9f4d335968b5a2ed5bf7e8 100644 (file)
--- a/app-misc/elasticsearch/elasticsearch-1.3.2-r1.ebuild
+++ b/app-misc/elasticsearch/elasticsearch-1.4.0.ebuild
@@ -1,6 +1,6 @@
-# Copyright 1999-2014 Gentoo Foundation
+# Copyright 1999-2015 Gentoo Foundation
 # Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/app-misc/elasticsearch/elasticsearch-1.3.2-r1.ebuild,v 1.1 2014/10/06 14:36:26 chainsaw Exp $
+# $Header: /var/cvsroot/gentoo-x86/app-misc/elasticsearch/elasticsearch-1.4.0.ebuild,v 1.1 2015/01/05 11:12:33 chainsaw Exp $
 
 EAPI=5
 
@@ -26,6 +26,7 @@ pkg_setup() {
 
 src_prepare() {
        rm -rf lib/sigar/*{solaris,winnt,freebsd,macosx}*
+       rm -rf bin/*.{bat,exe}
        rm lib/sigar/libsigar-ia64-linux.so
        rm LICENSE.txt
 

diff --git a/app-misc/elasticsearch/files/1.3.2-http_cors_disable.patch b/app-misc/elasticsearch/files/1.3.2-http_cors_disable.patch
new file mode 100644 (file)
index 0000000..41f5872
--- /dev/null
+++ b/app-misc/elasticsearch/files/1.3.2-http_cors_disable.patch
@@ -0,0 +1,18 @@
+diff -urN config/elasticsearch.yml config_new/elasticsearch.yml
+--- config/elasticsearch.yml   2014-08-13 16:27:06.000000000 +0200
++++ config_new/elasticsearch.yml       2014-11-12 20:39:53.501990184 +0100
+@@ -383,3 +383,14 @@
+ # it unless you need it is recommended (it is disabled by default).
+ #
+ #http.jsonp.enable: true
++
++# Patched by Gentoo due to CVE-2014-6439, for details please see
++# https://bugs.gentoo.org/show_bug.cgi?id=524682
++#
++# Enable or disable cross-origin resource sharing, i.e. whether a browser
++# on another origin can do requests to Elasticsearch (defaults to true).
++#
++http.cors.enabled: false
++
++# For further http.cors.* settings, please see Elasticsearch documentation at
++# http://www.elasticsearch.org/guide/en/elasticsearch/reference/1.3/modules-http.html