From 0c78085b367cd2591a7a4614669db4cfe8374e38 Mon Sep 17 00:00:00 2001 From: Gyorgy Sarvari Date: Tue, 31 Mar 2026 13:13:36 +0200 Subject: dovecot: upgrade 2.4.2 -> 2.4.3 Drop patch which is included in this release, and add a patch that adapts a lua api call to the lua version that is used in OE. License-Change: the unicode license text has been updated, there should be no material change. However while examining these changes, I noticed that some parts of the code are covered by licenses not mentined in the recipe. It should reflect all licenses now. Tis version contains fixes fox CVE-2025-59028, CVE-2025-59031, CVE-2026-24031, CVE-2026-27859, CVE-2026-27860, CVE-2026-27857, CVE-2026-27856 and CVE-2026-27855 Changelog: https://github.com/dovecot/core/blob/main/NEWS Signed-off-by: Gyorgy Sarvari Signed-off-by: Khem Raj --- .../0001-adapt-lua_newstate-to-new-api.patch | 29 ++++++++ .../0001-lib-regex-remove-LIBPCRE_LIBS-from.patch | 26 ------- .../recipes-support/dovecot/dovecot_2.4.2.bb | 82 --------------------- .../recipes-support/dovecot/dovecot_2.4.3.bb | 83 ++++++++++++++++++++++ 4 files changed, 112 insertions(+), 108 deletions(-) create mode 100644 meta-networking/recipes-support/dovecot/dovecot/0001-adapt-lua_newstate-to-new-api.patch delete mode 100644 meta-networking/recipes-support/dovecot/dovecot/0001-lib-regex-remove-LIBPCRE_LIBS-from.patch delete mode 100644 meta-networking/recipes-support/dovecot/dovecot_2.4.2.bb create mode 100644 meta-networking/recipes-support/dovecot/dovecot_2.4.3.bb diff --git a/meta-networking/recipes-support/dovecot/dovecot/0001-adapt-lua_newstate-to-new-api.patch b/meta-networking/recipes-support/dovecot/dovecot/0001-adapt-lua_newstate-to-new-api.patch new file mode 100644 index 0000000000..363361fcd5 --- /dev/null +++ b/meta-networking/recipes-support/dovecot/dovecot/0001-adapt-lua_newstate-to-new-api.patch @@ -0,0 +1,29 @@ +From 5efcbab91b510f5a2495369b729248e8bf8a5d63 Mon Sep 17 00:00:00 2001 +From: Gyorgy Sarvari +Date: Tue, 31 Mar 2026 11:05:52 +0000 +Subject: [PATCH] adapt lua_newstate to new api + +lua_newstate() in lua 5.5 has gained a new, third argument, which made +it not backwards compatible. This change adapts this call to the lua version +used in OE. + +Upstream-Status: Pending + +Signed-off-by: Gyorgy Sarvari +--- + src/lib-lua/dlua-script.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/src/lib-lua/dlua-script.c b/src/lib-lua/dlua-script.c +index 20f91ad..789d603 100644 +--- a/src/lib-lua/dlua-script.c ++++ b/src/lib-lua/dlua-script.c +@@ -253,7 +253,7 @@ static struct dlua_script *dlua_create_script(const char *name, + /* lua API says that lua_newstate will return NULL only if it's out of + memory. this cannot really happen with our allocator as it will + call i_fatal_status anyways if it runs out of memory */ +- script->L = lua_newstate(dlua_alloc, script); ++ script->L = lua_newstate(dlua_alloc, script, luaL_makeseed(NULL)); + i_assert(script->L != NULL); + script->ref = 1; + lua_atpanic(script->L, dlua_atpanic); diff --git a/meta-networking/recipes-support/dovecot/dovecot/0001-lib-regex-remove-LIBPCRE_LIBS-from.patch b/meta-networking/recipes-support/dovecot/dovecot/0001-lib-regex-remove-LIBPCRE_LIBS-from.patch deleted file mode 100644 index b872587a88..0000000000 --- a/meta-networking/recipes-support/dovecot/dovecot/0001-lib-regex-remove-LIBPCRE_LIBS-from.patch +++ /dev/null @@ -1,26 +0,0 @@ -From fd3d65c65c778cf0a2fba6487c8d0eb30b6780b7 Mon Sep 17 00:00:00 2001 -From: Aki Tuomi -Date: Fri, 31 Oct 2025 12:53:33 +0200 -Subject: [PATCH] lib-regex: Remove LIBPCRE_LIBS from test dependencies - -Was accidentically added in 49ae6e798310e5c4b96709db435a3714ea6468a8 - -Upstream-Status: Backport [https://github.com/dovecot/core/commit/fd3d65c65c778cf0a2fba6487c8d0eb30b6780b7] -Signed-off-by: Gyorgy Sarvari ---- - src/lib-regex/Makefile.am | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/src/lib-regex/Makefile.am b/src/lib-regex/Makefile.am -index 60f43d9779..9d26d27fa1 100644 ---- a/src/lib-regex/Makefile.am -+++ b/src/lib-regex/Makefile.am -@@ -34,7 +34,7 @@ test_regex_LDADD = libdregex.la \ - ../lib-test/libtest.la \ - ../lib/liblib.la \ - $(LIBPCRE_LIBS) --test_regex_DEPENDENCIES = libdregex.la $(LIBPCRE_LIBS) -+test_regex_DEPENDENCIES = libdregex.la - - check-local: - for bin in $(test_programs); do \ diff --git a/meta-networking/recipes-support/dovecot/dovecot_2.4.2.bb b/meta-networking/recipes-support/dovecot/dovecot_2.4.2.bb deleted file mode 100644 index e94306dd32..0000000000 --- a/meta-networking/recipes-support/dovecot/dovecot_2.4.2.bb +++ /dev/null @@ -1,82 +0,0 @@ -SUMMARY = "Dovecot is an open source IMAP and POP3 email server" -HOMEPAGE = "https://www.dovecot.org/" -DESCRIPTION = "Dovecot is an open source IMAP and POP3 email \ -server for Linux/UNIX-like systems, written with security primarily \ -in mind. Dovecot is an excellent choice for both small and large \ -installations. It's fast, simple to set up, requires no special \ -administration and it uses very little memory." -SECTION = "mail" -LICENSE = "LGPL-2.1-only & MIT" -LIC_FILES_CHKSUM = "file://COPYING;md5=2956560272e5b31d9d64f03111732048" - -SRC_URI = "http://dovecot.org/releases/2.4/dovecot-${PV}.tar.gz \ - file://0001-configure.ac-convert-AC_TRY_RUN-to-AC_TRY_LINK-state.patch \ - file://dovecot.service \ - file://dovecot.socket \ - file://0001-m4-Check-for-libunwind-instead-of-libunwind-generic.patch \ - file://0001-lib-regex-remove-LIBPCRE_LIBS-from.patch \ - " -SRC_URI[sha256sum] = "2cd62e4d22b9fc1c80bd38649739950f0dbda34fbc3e62624fb6842264e93c6e" - -DEPENDS = "openssl xz zlib bzip2 libcap icu libtirpc bison-native" -CFLAGS += "-I${STAGING_INCDIR}/tirpc" -LDFLAGS += "-ltirpc" - -inherit autotools pkgconfig systemd useradd gettext multilib_header - -PACKAGECONFIG ??= "${@bb.utils.filter('DISTRO_FEATURES', 'ldap pam systemd', d)}" - -PACKAGECONFIG[pam] = "--with-pam,--without-pam,libpam," -PACKAGECONFIG[systemd] = "--with-systemd,--without-systemd,systemd," -PACKAGECONFIG[ldap] = "--with-ldap=plugin,--without-ldap,openldap," -PACKAGECONFIG[lz4] = "--with-lz4,--without-lz4,lz4," - -# From native build in armv7a-hf/eglibc -CACHED_CONFIGUREVARS += "i_cv_signed_size_t=no \ - i_cv_gmtime_max_time_t=32 \ - i_cv_signed_time_t=yes \ - i_cv_mmap_plays_with_write=yes \ - i_cv_fd_passing=yes \ - i_cv_c99_vsnprintf=yes \ - lib_cv___va_copy=yes \ - lib_cv_va_copy=yes \ - lib_cv_va_val_copy=yes \ - " - -# hardcode epoll() to avoid running unsafe tests -# BSD needs kqueue and uclibc poll() -EXTRA_OECONF = " --with-ioloop=epoll" - -SYSTEMD_PACKAGES = "${PN}" -SYSTEMD_SERVICE:${PN} = "dovecot.service dovecot.socket" -SYSTEMD_AUTO_ENABLE = "disable" - -do_install:append () { - rm -rf ${D}${libdir}/dovecot/dovecot-config - install -d 755 ${D}/etc/dovecot - chmod 644 ${D}/etc/dovecot/dovecot.conf - touch ${D}/etc/dovecot/ssl-key.pem - touch ${D}/etc/dovecot/ssl-cert.pem - chmod 600 ${D}/etc/dovecot/ssl-key.pem - chmod 600 ${D}/etc/dovecot/ssl-cert.pem - if [ "${@bb.utils.filter('DISTRO_FEATURES', 'systemd', d)}" ]; then - install -m 0644 ${UNPACKDIR}/dovecot.service ${D}${systemd_unitdir}/system - sed -i -e 's#@SYSCONFDIR@#${sysconfdir}#g' ${D}${systemd_unitdir}/system/dovecot.service - sed -i -e 's#@SBINDIR@#${sbindir}#g' ${D}${systemd_unitdir}/system/dovecot.service - fi - oe_multilib_header dovecot/config.h -} - -USERADD_PACKAGES = "${PN}" -USERADD_PARAM:${PN} = "-r -d ${libexecdir} -M -s ${base_sbindir}/nologin -g dovecot dovecot; \ - -r -d ${libexecdir} -M -s ${base_sbindir}/nologin -g dovenull dovenull" -GROUPADD_PARAM:${PN} = "-f -r dovecot;-f -r dovenull" - -FILES:${PN} += "${libdir}/dovecot/*plugin.so \ - ${libdir}/dovecot/libfs_compress.so \ - ${libdir}/dovecot/libssl_iostream_openssl.so" -FILES:${PN}-staticdev += "${libdir}/dovecot/*/*.a" -FILES:${PN}-dev += "${libdir}/dovecot/libdovecot*.so" -FILES:${PN}-dbg += "${libdir}/dovecot/*/.debug" - -CVE_STATUS[CVE-2016-4983] = "not-applicable-platform: Affects only postinstall script on specific distribution." diff --git a/meta-networking/recipes-support/dovecot/dovecot_2.4.3.bb b/meta-networking/recipes-support/dovecot/dovecot_2.4.3.bb new file mode 100644 index 0000000000..a8930979ea --- /dev/null +++ b/meta-networking/recipes-support/dovecot/dovecot_2.4.3.bb @@ -0,0 +1,83 @@ +SUMMARY = "Dovecot is an open source IMAP and POP3 email server" +HOMEPAGE = "https://www.dovecot.org/" +DESCRIPTION = "Dovecot is an open source IMAP and POP3 email \ +server for Linux/UNIX-like systems, written with security primarily \ +in mind. Dovecot is an excellent choice for both small and large \ +installations. It's fast, simple to set up, requires no special \ +administration and it uses very little memory." +SECTION = "mail" +LICENSE = "LGPL-2.1-only & MIT & Unicode-3.0 & BSD-3-Clause & PD" +LIC_FILES_CHKSUM = "file://COPYING;md5=cb805cc6bdb95ba8fc2398a55fd50877" + +SRC_URI = "https://dovecot.org/releases/2.4/dovecot-${PV}.tar.gz \ + file://0001-configure.ac-convert-AC_TRY_RUN-to-AC_TRY_LINK-state.patch \ + file://dovecot.service \ + file://dovecot.socket \ + file://0001-m4-Check-for-libunwind-instead-of-libunwind-generic.patch \ + file://0001-adapt-lua_newstate-to-new-api.patch \ + " +SRC_URI[sha256sum] = "e0b30330fe51e47ecfcf641bc16041184d91bdd0ac3db789b7cef54e3a75ac9b" + +DEPENDS = "openssl xz zlib bzip2 libcap icu libtirpc bison-native" +CFLAGS += "-I${STAGING_INCDIR}/tirpc" +LDFLAGS += "-ltirpc" + +inherit autotools pkgconfig systemd useradd gettext multilib_header + +PACKAGECONFIG ??= "${@bb.utils.filter('DISTRO_FEATURES', 'ldap pam systemd', d)}" + +PACKAGECONFIG[pam] = "--with-pam,--without-pam,libpam," +PACKAGECONFIG[systemd] = "--with-systemd,--without-systemd,systemd," +PACKAGECONFIG[ldap] = "--with-ldap=plugin,--without-ldap,openldap," +PACKAGECONFIG[lua] = "--with-lua=yes, --without-lua, lua" +PACKAGECONFIG[lz4] = "--with-lz4,--without-lz4,lz4," + +# From native build in armv7a-hf/eglibc +CACHED_CONFIGUREVARS += "i_cv_signed_size_t=no \ + i_cv_gmtime_max_time_t=32 \ + i_cv_signed_time_t=yes \ + i_cv_mmap_plays_with_write=yes \ + i_cv_fd_passing=yes \ + i_cv_c99_vsnprintf=yes \ + lib_cv___va_copy=yes \ + lib_cv_va_copy=yes \ + lib_cv_va_val_copy=yes \ + " + +# hardcode epoll() to avoid running unsafe tests +# BSD needs kqueue and uclibc poll() +EXTRA_OECONF = " --with-ioloop=epoll" + +SYSTEMD_PACKAGES = "${PN}" +SYSTEMD_SERVICE:${PN} = "dovecot.service dovecot.socket" +SYSTEMD_AUTO_ENABLE = "disable" + +do_install:append () { + rm -rf ${D}${libdir}/dovecot/dovecot-config + install -d 755 ${D}/etc/dovecot + chmod 644 ${D}/etc/dovecot/dovecot.conf + touch ${D}/etc/dovecot/ssl-key.pem + touch ${D}/etc/dovecot/ssl-cert.pem + chmod 600 ${D}/etc/dovecot/ssl-key.pem + chmod 600 ${D}/etc/dovecot/ssl-cert.pem + if [ "${@bb.utils.filter('DISTRO_FEATURES', 'systemd', d)}" ]; then + install -m 0644 ${UNPACKDIR}/dovecot.service ${D}${systemd_unitdir}/system + sed -i -e 's#@SYSCONFDIR@#${sysconfdir}#g' ${D}${systemd_unitdir}/system/dovecot.service + sed -i -e 's#@SBINDIR@#${sbindir}#g' ${D}${systemd_unitdir}/system/dovecot.service + fi + oe_multilib_header dovecot/config.h +} + +USERADD_PACKAGES = "${PN}" +USERADD_PARAM:${PN} = "-r -d ${libexecdir} -M -s ${base_sbindir}/nologin -g dovecot dovecot; \ + -r -d ${libexecdir} -M -s ${base_sbindir}/nologin -g dovenull dovenull" +GROUPADD_PARAM:${PN} = "-f -r dovecot;-f -r dovenull" + +FILES:${PN} += "${libdir}/dovecot/*plugin.so \ + ${libdir}/dovecot/libfs_compress.so \ + ${libdir}/dovecot/libssl_iostream_openssl.so" +FILES:${PN}-staticdev += "${libdir}/dovecot/*/*.a" +FILES:${PN}-dev += "${libdir}/dovecot/libdovecot*.so" +FILES:${PN}-dbg += "${libdir}/dovecot/*/.debug" + +CVE_STATUS[CVE-2016-4983] = "not-applicable-platform: Affects only postinstall script on specific distribution." -- cgit v1.2.3-54-g00ecf