postgresql-jdbc/postgresql-jdbc.spec
starlet-dx 1933fb7ebc Fix CVE-2024-1597
(cherry picked from commit adec29e7542b857ac69f953797d0681bfd35f944)
2024-02-26 17:35:05 +08:00

122 lines
4.7 KiB
RPMSpec

Name: postgresql-jdbc
Summary: Postgresql JDBC Driver
Version: 42.4.1
Release: 3
License: BSD
URL: http://jdbc.postgresql.org/
Source0: https://repo1.maven.org/maven2/org/postgresql/postgresql/%{version}/postgresql-%{version}-jdbc-src.tar.gz
Patch0: CVE-2022-41946.patch
# https://github.com/pgjdbc/pgjdbc/commit/e479be16967ae20af1bd57187738d5243052bbee
Patch1: CVE-2024-1597-1.patch
# https://github.com/pgjdbc/pgjdbc/commit/fe002b31f2c7dcf7e2fe75fe7fd18df4e4503abf
Patch2: CVE-2024-1597-2.patch
BuildRequires: maven-local java-comment-preprocessor properties-maven-plugin classloader-leak-test-framework
BuildRequires: maven-enforcer-plugin maven-plugin-bundle maven-plugin-build-helper java-devel >= 1.8
BuildRequires: mvn(org.apache.maven.plugins:maven-clean-plugin) mvn(com.ongres.scram:client)
BuildRequires: mvn(org.apache.maven.surefire:surefire-junit-platform)
BuildRequires: mvn(org.junit.jupiter:junit-jupiter-api)
BuildRequires: mvn(org.junit.jupiter:junit-jupiter-engine)
BuildRequires: mvn(org.junit.jupiter:junit-jupiter-params)
BuildRequires: mvn(org.junit.vintage:junit-vintage-engine)
Obsoletes: %{name}-parent-poms < 42.2.2-2
Provides: pgjdbc = %version-%release
BuildArch: noarch
%description
PostgreSQL JDBC Driver (PgJDBC for short) allows Java programs to connect to
a PostgreSQL database using standard, database independent Java code. Is an
open source JDBC driver written in Pure Java (Type 4), and communicates in
the PostgreSQL native network protocol.
%package javadoc
Summary: API docs for %{name}
%description javadoc
This package contains the API Documentation for %{name}.
%package_help
%prep
%setup -c -q
mv postgresql-%{version}-jdbc-src/* .
%patch0 -p1
%patch1 -p1
%patch2 -p1
find -type f \( -name "*.jar" -or -name "*.class" \) | xargs rm -f
%pom_xpath_remove "pom:plugin[pom:artifactId = 'maven-shade-plugin']"
%mvn_file org.postgresql:postgresql %{name}/postgresql %{name} postgresql
%mvn_package ":*{parent,versions,prevjre}*" __noinstall
%mvn_alias org.postgresql:postgresql postgresql:postgresql
install -d pgjdbc/target/generated-sources/annotations
%pom_remove_dep uk.org.webcompere:system-stubs-jupiter
# remove tests that depend on the system-stubs-jupiter
rm src/test/java/org/postgresql/test/jdbc2/DriverTest.java \
src/test/java/org/postgresql/util/OSUtilTest.java \
src/test/java/org/postgresql/util/PGPropertyPasswordParserTest.java \
src/test/java/org/postgresql/util/PGPropertyServiceParserTest.java \
src/test/java/org/postgresql/util/StubEnvironmentAndProperties.java
%build
opts="-f"
%mvn_build $opts -- -DwaffleEnabled=false \
-DosgiEnabled=false \
-DexcludePackageNames=org.postgresql.osgi:org.postgresql.sspi
%install
%mvn_install
find %{_buildrootdir} -name "%{name}.xml" | xargs sed -i '/<metadata xmlns/{n;s/<uuid>[[:alnum:]]\{8\}-[[:alnum:]]\{4\}-[[:alnum:]]\{4\}-[[:alnum:]]\{4\}-[[:alnum:]]\{12\}<\/uuid>/<uuid>cb98d437-dced-4915-8d37-d4da43bac7f5<\/uuid>/g}'
find %{_buildrootdir} -name "%{name}.xml" | xargs sed -i '/postgresql.jar<\/path>/{n;s/<uuid>[[:alnum:]]\{8\}-[[:alnum:]]\{4\}-[[:alnum:]]\{4\}-[[:alnum:]]\{4\}-[[:alnum:]]\{12\}<\/uuid>/<uuid>ea4aac95-7377-4a79-bb46-78fcebb4104d<\/uuid>/g}'
find %{_buildrootdir} -name "%{name}.xml" | xargs sed -i '/postgresql.pom<\/path>/{n;s/<uuid>[[:alnum:]]\{8\}-[[:alnum:]]\{4\}-[[:alnum:]]\{4\}-[[:alnum:]]\{4\}-[[:alnum:]]\{12\}<\/uuid>/<uuid>0142aef6-864f-4570-aa9e-364f1cd7829c<\/uuid>/g}'
find %{_buildrootdir} -name "%{name}.xml" | xargs sed -i '/pgjdbc-aggregate.pom<\/path>/{n;s/<uuid>[[:alnum:]]\{8\}-[[:alnum:]]\{4\}-[[:alnum:]]\{4\}-[[:alnum:]]\{4\}-[[:alnum:]]\{12\}<\/uuid>/<uuid>f8e1101c-f6b2-40a9-8b31-7b54e7767880<\/uuid>/g}'
%files -f .mfiles
%license LICENSE
%files javadoc -f .mfiles-javadoc
%license LICENSE
%files help
%doc README.md
%changelog
* Mon Feb 26 2024 yaoxin <yao_xin001@hoperun.com> - 42.4.1-3
- Fix CVE-2024-1597
* Fri Jun 16 2023 yaoxin <yao_xin001@hoperun.com> - 42.4.1-2
- Fix CVE-2022-41946
* Tue Aug 09 2022 yaoxin <yaoxin30@h-partners.com> - 42.4.1-1
- Update to 42.4.1 to fix CVE-2022-31197
* Wed Feb 16 2022 houyingchao <houyingchao@huawei.com> - 42.2.25-1
- Upgrade to 42.2.25
- Fix CVE-2022-21724
* Thu Dec 11 2019 caomeng<caomeng5@huawei.com> - 42.2.4-4
- Package init
* Wed Aug 21 2019 renxudong <renxudong1@huawei.com> - 42.2.4-3
- Type:enhancement
- ID:NA
- SUG:NA
- DESC:revise patch name
* Tue Aug 20 2019 huangzheng <huangzheng22@huawei.com> - 42.2.4-2
- Type:enhancement
- ID:NA
- SUG:NA
- DESC:remove sensitive information
* Sun Apr 28 2019 wangjia <wangjia55@huawei.com> - 42.2.4-1.h1
- Type:enhancement
- ID:NA
- SUG:NA
- DESC:disable the failed tests that caused by BEP to repair binary diffrence