!110 [sync] PR-104: Fix CVE-2024-24575,CVE-2024-24577

From: @openeuler-sync-bot Reviewed-by: @wk333 Signed-off-by: @wk333
Fix CVE-2024-24575,CVE-2024-24577
2024-02-18 01:11:08 +00:00 · 2024-02-18 09:04:32 +08:00 · 2023-07-31 01:20:18 +00:00 · 2023-07-30 22:59:52 +08:00 · 2023-05-12 02:09:18 +00:00 · 2023-05-11 19:06:22 +08:00
14 changed files with 385 additions and 136 deletions
--- a/0001-Use-lld-provided-by-system-for-wasm.patch
+++ b/0001-Use-lld-provided-by-system-for-wasm.patch
@ -0,0 +1,26 @@
+From b521511174b1a08dddfac243604d649b71cc7386 Mon Sep 17 00:00:00 2001
+From: Ivan Mironov <mironov.ivan@gmail.com>
+Date: Sun, 8 Dec 2019 17:23:08 +0500
+Subject: [PATCH] Use lld provided by system for wasm
+
+---
+ compiler/rustc_target/src/spec/wasm_base.rs | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/compiler/rustc_target/src/spec/wasm_base.rs b/compiler/rustc_target/src/spec/wasm_base.rs
+index de7b7374af31..eebbe616e9b6 100644
+--- a/compiler/rustc_target/src/spec/wasm_base.rs
+++ b/compiler/rustc_target/src/spec/wasm_base.rs
+@@ -99,8 +99,7 @@ pub fn options() -> TargetOptions {
+         // arguments just yet
+         limit_rdylib_exports: false,
+ 
+-        // we use the LLD shipped with the Rust toolchain by default
+-        linker: Some("rust-lld".into()),
+        linker: Some("lld".into()),
+         lld_flavor: LldFlavor::Wasm,
+         linker_is_gnu: false,
+ 
+-- 
+2.35.1
+
--- a/0001-rustc_transmute-fix-big-endian-discriminants.patch
+++ b/0001-rustc_transmute-fix-big-endian-discriminants.patch
@ -0,0 +1,53 @@
+From 2946828fcb8e2e68a16839dfcf4319bf119f8acd Mon Sep 17 00:00:00 2001
+From: Josh Stone <jistone@redhat.com>
+Date: Tue, 20 Sep 2022 13:03:43 -0700
+Subject: [PATCH] rustc_transmute: fix big-endian discriminants
+
+(cherry picked from commit a72666ed56ec5f1b6d254c7020cf86143edc6dbd)
+---
+ compiler/rustc_transmute/src/layout/tree.rs | 22 +++++++++++++++------
+ 1 file changed, 16 insertions(+), 6 deletions(-)
+
+diff --git a/compiler/rustc_transmute/src/layout/tree.rs b/compiler/rustc_transmute/src/layout/tree.rs
+index 70b3ba02b05b..e4fcde35ed37 100644
+--- a/compiler/rustc_transmute/src/layout/tree.rs
+++ b/compiler/rustc_transmute/src/layout/tree.rs
+@@ -402,7 +402,7 @@ fn from_repr_c_variant(
+                 .unwrap();
+                 tracing::trace!(?discr_layout, "computed discriminant layout");
+                 variant_layout = variant_layout.extend(discr_layout).unwrap().0;
+-                tree = tree.then(Self::from_disr(discr, tcx, layout_summary.discriminant_size));
+                tree = tree.then(Self::from_discr(discr, tcx, layout_summary.discriminant_size));
+             }
+ 
+             // Next come fields.
+@@ -442,11 +442,21 @@ fn from_repr_c_variant(
+             Ok(tree)
+         }
+ 
+-        pub fn from_disr(discr: Discr<'tcx>, tcx: TyCtxt<'tcx>, size: usize) -> Self {
+-            // FIXME(@jswrenn): I'm certain this is missing needed endian nuance.
+-            let bytes = discr.val.to_ne_bytes();
+-            let bytes = &bytes[..size];
+-            Self::Seq(bytes.into_iter().copied().map(|b| Self::from_bits(b)).collect())
+        pub fn from_discr(discr: Discr<'tcx>, tcx: TyCtxt<'tcx>, size: usize) -> Self {
+            use rustc_target::abi::Endian;
+
+            let bytes: [u8; 16];
+            let bytes = match tcx.data_layout.endian {
+                Endian::Little => {
+                    bytes = discr.val.to_le_bytes();
+                    &bytes[..size]
+                }
+                Endian::Big => {
+                    bytes = discr.val.to_be_bytes();
+                    &bytes[bytes.len() - size..]
+                }
+            };
+            Self::Seq(bytes.iter().map(|&b| Self::from_bits(b)).collect())
+         }
+     }
+ 
+-- 
+2.37.3
+
--- a/CVE-2024-24575.patch
+++ b/CVE-2024-24575.patch
@ -0,0 +1,50 @@
+From c9d31b711e8906cf248566f43142f20b03e20cbf Mon Sep 17 00:00:00 2001
+From: Edward Thomson <ethomson@edwardthomson.com>
+Date: Fri, 17 Nov 2023 16:54:47 +0000
+Subject: [PATCH] revparse: fix parsing bug for trailing `@`
+
+Origin: https://github.com/libgit2/libgit2/commit/c9d31b711e8906cf248566f43142f20b03e20cbf
+
+When parsing a revspec that ends with a trailing `@`, explicitly stop
+parsing. Introduce a sentinel variable to explicitly stop parsing.
+
+Prior to this, we would set `spec` to `HEAD`, but were looping on the
+value of `spec[pos]`, so we would continue walking the (new) `spec`
+at offset `pos`, looking for a NUL. This is obviously an out-of-bounds
+read.
+
+Credit to Michael Rodler (@f0rki) and Amazon AWS Security.
+---
+ vendor/libgit2-sys/libgit2/src/revparse.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/vendor/libgit2-sys/libgit2/src/revparse.c b/vendor/libgit2-sys/libgit2/src/revparse.c
+index 964afe378da..06d92f82bf2 100644
+--- a/vendor/libgit2-sys/libgit2/src/revparse.c
+++ b/vendor/libgit2-sys/libgit2/src/revparse.c
+@@ -701,6 +701,7 @@ static int revparse(
+ 	git_object *base_rev = NULL;
+ 
+ 	bool should_return_reference = true;
+	bool parsed = false;
+ 
+ 	GIT_ASSERT_ARG(object_out);
+ 	GIT_ASSERT_ARG(reference_out);
+@@ -710,7 +711,7 @@ static int revparse(
+ 	*object_out = NULL;
+ 	*reference_out = NULL;
+ 
+-	while (spec[pos]) {
+	while (!parsed && spec[pos]) {
+ 		switch (spec[pos]) {
+ 		case '^':
+ 			should_return_reference = false;
+@@ -817,6 +818,8 @@ static int revparse(
+ 				break;
+ 			} else if (spec[pos+1] == '\0') {
+ 				spec = "HEAD";
+				identifier_len = 4;
+				parsed = true;
+ 				break;
+ 			}
+ 			/* fall through */
--- a/CVE-2024-24577.patch
+++ b/CVE-2024-24577.patch
@ -0,0 +1,51 @@
+From eb4c1716cd92bf56f2770653a915d5fc01eab8f3 Mon Sep 17 00:00:00 2001
+From: Edward Thomson <ethomson@edwardthomson.com>
+Date: Sat, 16 Dec 2023 11:19:07 +0000
+Subject: [PATCH] index: correct index has_dir_name check
+
+Origin: https://github.com/libgit2/libgit2/commit/eb4c1716cd92bf56f2770653a915d5fc01eab8f3
+
+`has_dir_name` is used to check for directory/file collisions,
+and attempts to determine whether the index contains a file with
+a directory name that is a proper subset of the new index entry
+that we're trying to add.
+
+To determine directory name, the function would walk the path string
+backwards to identify a `/`, stopping at the end of the string. However,
+the function assumed that the strings did not start with a `/`. If the
+paths contain only a single `/` at the beginning of the string, then the
+function would continue the loop, erroneously, when they should have
+stopped at the first character.
+
+Correct the order of the tests to terminate properly.
+
+Credit to Michael Rodler (@f0rki) and Amazon AWS Security.
+
+---
+ vendor/libgit2-sys/libgit2/src/index.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/vendor/libgit2-sys/libgit2/src/index.c b/vendor/libgit2-sys/libgit2/src/index.c
+index 7ebe075..7862273 100644
+--- a/vendor/libgit2-sys/libgit2/src/index.c
+++ b/vendor/libgit2-sys/libgit2/src/index.c
+@@ -1155,10 +1155,14 @@ static int has_dir_name(git_index *index,
+ 		size_t len, pos;
+ 
+ 		for (;;) {
+-			if (*--slash == '/')
+-				break;
+			slash--;
+
+ 			if (slash <= entry->path)
+ 				return 0;
+
+
+			if (*slash == '/')
+				break;
+ 		}
+ 		len = slash - name;
+ 
+-- 
+2.23.0
+
--- a/5
+++ b/5
@ -0,0 +1,5 @@
+[source.crates-io]
+replace-with = 'ustc'
+
+[source.ustc]
+registry = "sparse+https://mirrors.ustc.edu.cn/crates.io-index/"
--- a/cargo-config.csh
+++ b/cargo-config.csh
@ -0,0 +1,5 @@
+# Copy cargo config from skel if it is not exist
+if ( ! -e "$HOME/.cargo/config.toml" ) then
+        mkdir -p $HOME/.cargo
+        cp -f /etc/skel/.cargo/config.toml $HOME/.cargo
+endif
--- a/cargo-config.sh
+++ b/cargo-config.sh
@ -0,0 +1,5 @@
+# Copy cargo config from skel if it is not exist
+if [ ! -f "$HOME/.cargo/config.toml" ] ; then
+        mkdir -p $HOME/.cargo
+        cp -f /etc/skel/.cargo/config.toml $HOME/.cargo
+fi
--- a/omit-bootstrap-lib-deadcode-warning.patch
+++ b/omit-bootstrap-lib-deadcode-warning.patch
@ -1,10 +0,0 @@
--- a/src/bootstrap/lib.rs
-+++ a/src/bootstrap/lib.rs
-@@ -273,6 +273,7 @@
-         RefCell<HashMap<TargetSelection, HashMap<String, (&'static str, PathBuf, Vec<String>)>>>,
- }
- 
-+#[allow(dead_code)]
- #[derive(Debug)]
- struct Crate {
-     name: Interned<String>,
--- a/rust.spec
+++ b/rust.spec
@ -1,9 +1,7 @@
-%global rust_arches x86_64 i686 armv7hl aarch64 ppc64 ppc64le s390x
-%{!?channel: %global channel stable}
-%global bootstrap_rust 1.57.0
-%global bootstrap_cargo 1.57.0
-%global bootstrap_channel 1.57.0
-%global bootstrap_date 2022-02-27
+%global bootstrap_rust 1.63.0
+%global bootstrap_cargo 1.63.0
+%global bootstrap_channel 1.63.0
+%global bootstrap_date 2022-08-11
 %bcond_with llvm_static
 %bcond_with bundled_llvm
 %bcond_without bundled_libgit2
@ -11,25 +9,31 @@
 %bcond_without curl_http2
 %bcond_without lldb
 Name:                rust
-Version:             1.58.1
-Release:             1
+Version:             1.64.0
+Release:             3
 Summary:             The Rust Programming Language
 License:             (ASL 2.0 or MIT) and (BSD and MIT)
 URL:                 https://www.rust-lang.org
-ExclusiveArch:       %{rust_arches}
-%if "%{channel}" == "stable"
-%global rustc_package rustc-%{version}-src
-%else
-%global rustc_package rustc-%{channel}-src
-%endif
-Source0:             https://static.rust-lang.org/dist/%{rustc_package}.tar.gz
+Source0:             https://static.rust-lang.org/dist/rustc-%{version}-src.tar.xz
+# SOURCE1-3: use local mirror for speed up
+Source1:             cargo-config
+Source2:             cargo-config.sh
+Source3:             cargo-config.csh

-Patch0000:           rustc-1.58.1-disable-libssh2.patch
-Patch0001:           rustc-1.58.1-disable-http2.patch
+Patch0000:           rustc-1.60.0-disable-libssh2.patch
+Patch0001:           rustc-1.63.0-disable-http2.patch
 Patch0002:           clippy-driver-usage-should-user-friendly.patch
 Patch0003:           cargo-help-clippy-should-have-description-to-user.patch
 Patch0004:           fix-a-println-wrong-format.patch
-Patch0005:	   omit-bootstrap-lib-deadcode-warning.patch
+# By default, rust tries to use "rust-lld" as a linker for WebAssembly.
+Patch0005:           0001-Use-lld-provided-by-system-for-wasm.patch
+# Set a substitute-path in rust-gdb for standard library sources.
+Patch0006:           rustc-1.61.0-rust-gdb-substitute-path.patch
+# https://github.com/rust-lang/rust/pull/102076
+Patch0007:           0001-rustc_transmute-fix-big-endian-discriminants.patch
+Patch0008:           CVE-2024-24575.patch
+Patch0009:           CVE-2024-24577.patch
+
 %{lua: function rust_triple(arch)
  local abi = "gnu"
  if arch == "armv7hl" then
@ -103,7 +107,7 @@ BuildRequires:       %{llvm}-static libffi-devel
 %endif
 %endif
 BuildRequires:       procps-ng
-BuildRequires:       ninja-build
+BuildRequires:       ninja-build libstdc++-static
 Provides:            rustc = %{version}-%{release}
 Provides:            rustc%{?_isa} = %{version}-%{release}
 Requires:            %{name}-std-static%{?_isa} = %{version}-%{release}
@ -180,7 +184,7 @@ Conflicts:           rustfmt-preview < 1.0.0
 A tool for formatting Rust code according to style guidelines.

 %package -n rls
-Summary:             Rust Language Server for IDE integration
+Summary:             Rust Language Server for IDE integration (deprecated)
 %if %with bundled_libgit2
 Provides:            bundled(libgit2) = 1.1.0
 %endif
@ -192,8 +196,16 @@ Conflicts:           rls-preview < 1.31.6
 %description -n rls
 The Rust Language Server provides a server that runs in the background,
 providing IDEs, editors, and other tools with information about Rust programs.
-It supports functionality such as 'goto definition', symbol search,
-reformatting, and code completion, and enables renaming and refactorings.
+RLS is being deprecated in favor of rust-analyzer, and may be removed in the future.
+https://blog.rust-lang.org/2022/07/01/RLS-deprecation.html
+
+%package analyzer
+Summary:        Rust implementation of the Language Server Protocol
+
+%description analyzer
+rust-analyzer is an implementation of Language Server Protocol for the Rust
+programming language. It provides features like completion and goto definition
+for many code editors, including VS Code, Emacs and Vim.

 %package -n clippy
 Summary:             Lints to catch common mistakes and improve your Rust code
@ -236,7 +248,7 @@ Man pages and other related help documents for rust.
 test -f '%{local_rust_root}/bin/cargo'
 test -f '%{local_rust_root}/bin/rustc'
 %endif
-%setup -q -n %{rustc_package}
+%setup -q -n rustc-%{version}-src
 %if %with disabled_libssh2
 %patch0000 -p1
 %endif
@ -251,6 +263,10 @@ sed -i.try-python -e '/^try python3 /i try "%{python}" "$@"' ./configure
 %patch0003 -p1
 %patch0004 -p1
 %patch0005 -p1
+%patch0006 -p1
+%patch0007 -p1
+%patch0008 -p1
+%patch0009 -p1
 rm -rf vendor/curl-sys/curl/
 rm -rf vendor/jemalloc-sys/jemalloc/
 rm -rf vendor/libssh2-sys/libssh2/
@ -312,11 +328,11 @@ fi
  --disable-rpath \
  %{enable_debuginfo} \
  --enable-extended \
-  --tools=analysis,cargo,clippy,rls,rustfmt,src \
+  --tools=analysis,cargo,clippy,rls,rust-analyzer,rustfmt,src \
  --enable-vendor \
  --enable-verbose-tests \
  %{?codegen_units_std} \
-  --release-channel=%{channel}
+  --release-channel=stable
 %{python} ./x.py build -j "$ncpus" --stage 2
 %{python} ./x.py doc --stage 2

@ -354,6 +370,12 @@ find %{buildroot}%{_docdir}/%{name}/html -type f -exec chmod -x '{}' '+'
 mkdir -p %{buildroot}%{_datadir}/cargo/registry
 mkdir -p %{buildroot}%{_docdir}/cargo
 ln -sT ../rust/html/cargo/ %{buildroot}%{_docdir}/cargo/html
+
+# install default config for cargo mirror
+install -m 0644 -D -p %{SOURCE1} %{buildroot}%{_sysconfdir}/skel/.cargo/config.toml
+install -m 0644 -D -p %{SOURCE2} %{buildroot}%{_sysconfdir}/profile.d/cargo-config.sh
+install -m 0644 -D -p %{SOURCE3} %{buildroot}%{_sysconfdir}/profile.d/cargo-config.csh
+
 %if %without lldb
 rm -f %{buildroot}%{_bindir}/rust-lldb
 rm -f %{buildroot}%{rustlibdir}/etc/lldb_*
@ -366,6 +388,7 @@ export %{rust_env}
 %{python} ./x.py test --no-fail-fast --stage 2 cargo || :
 %{python} ./x.py test --no-fail-fast --stage 2 clippy || :
 %{python} ./x.py test --no-fail-fast --stage 2 rls || :
+%{python} ./x.py test --no-fail-fast --stage 2 rust-analyzer || :
 %{python} ./x.py test --no-fail-fast --stage 2 rustfmt || :
 %ldconfig_scriptlets

@ -379,6 +402,7 @@ export %{rust_env}
 %dir %{rustlibdir}
 %dir %{rustlibdir}/%{rust_triple}
 %dir %{rustlibdir}/%{rust_triple}/lib
+%{_libexecdir}/rust-analyzer-proc-macro-srv
 %{rustlibdir}/%{rust_triple}/lib/*.so
 %dir %{rustlibdir}/%{rust_musl_triple}
 %dir %{rustlibdir}/%{rust_musl_triple}/lib
@ -414,6 +438,8 @@ export %{rust_env}
 %files -n cargo
 %license src/tools/cargo/LICENSE-APACHE src/tools/cargo/LICENSE-MIT src/tools/cargo/LICENSE-THIRD-PARTY
 %doc src/tools/cargo/README.md
+%config(noreplace) %{_sysconfdir}/skel/.cargo/config.toml
+%{_sysconfdir}/profile.d/cargo-config.*
 %{_bindir}/cargo
 %{_libexecdir}/cargo*
 %{_sysconfdir}/bash_completion.d/cargo
@ -432,6 +458,11 @@ export %{rust_env}
 %doc src/tools/rls/{README.md,COPYRIGHT,debugging.md}
 %license src/tools/rls/LICENSE-{APACHE,MIT}

+%files analyzer
+%{_bindir}/rust-analyzer
+%doc src/tools/rust-analyzer/README.md
+%license src/tools/rust-analyzer/LICENSE-{APACHE,MIT}
+
 %files -n clippy
 %{_bindir}/cargo-clippy
 %{_bindir}/clippy-driver
@ -458,7 +489,6 @@ export %{rust_env}
 %{_docdir}/%{name}/html/*.js
 %{_docdir}/%{name}/html/*.png
 %{_docdir}/%{name}/html/*.svg
-%{_docdir}/%{name}/html/*.woff
 %{_docdir}/%{name}/html/*.woff2
 %license %{_docdir}/%{name}/html/*.md
 %{_docdir}/cargo/html
@ -467,6 +497,18 @@ export %{rust_env}
 %{_mandir}/man1/cargo*.1*

 %changelog
+* Sat Feb 17 2024 wangkai <13474090681@163.com> - 1.64.0-3
+- Fix CVE-2024-24575,CVE-2024-24577
+
+* Sun Jul 30 2023 Funda Wang <fundawang@yeah.net> - 1.64.0-2
+- Use local mirror for speed up
+
+* Thu May 11 2023 wangkai <13474090681@163.com> - 1.64.0-1
+- Update to 1.64.0
+
+* Tue Nov 01 2022 wangkai <wangkai385@h-partners.com> - 1.60.0-1
+- Update to 1.60.0
+
 * Thu May 26 2022 fushanqing <fushanqing@kylinos.cn> - 1.58.1-1
 - update to 1.58.1

@ -482,19 +524,19 @@ export %{rust_env}
 * Wed Aug 04 2021 chenyanpanHW <chenyanpan@huawei.com> - 1.51.0-7
 - DESC: delete BuildRequires gdb

-* Thu 08 Jul 2021 Jiajie Li <lijiajie11@huawei.com> - 1.51.0-6
+* Thu Jul 08 2021 Jiajie Li <lijiajie11@huawei.com> - 1.51.0-6
 - Add build require of ninja and llvm

-* Thu 01 Jul 2021 Jiajie Li <lijiajie11@huawei.com> - 1.51.0-5
+* Thu Jul 01 2021 Jiajie Li <lijiajie11@huawei.com> - 1.51.0-5
 - Add support for musl target

-* Thu 24 Jun 2021 sunguoshuai <sunguoshuai@huawei.com> - 1.51.0-4
+* Thu Jun 24 2021 sunguoshuai <sunguoshuai@huawei.com> - 1.51.0-4
 - fix a println wrong format

-* Thu 24 Jun 2021 sunguoshuai <sunguoshuai@huawei.com> - 1.51.0-3
+* Thu Jun 24 2021 sunguoshuai <sunguoshuai@huawei.com> - 1.51.0-3
 - cargo help clippy should have description to user

-* Wed 23 Jun 2021 sunguoshuai <sunguoshuai@huawei.com> - 1.51.0-2
+* Wed Jun 23 2021 sunguoshuai <sunguoshuai@huawei.com> - 1.51.0-2
 - clippy-driver usage should user friendly

 * Fri May 07 2021 wangyue <wangyue92@huawei.com> - 1.51.0-1
@ -506,7 +548,7 @@ export %{rust_env}
 * Mon Sep 21 2020 Jeffery.Gao <gaojianxing@huawei.com> - 1.45.2-1
 - Update to 1.45.2

-* Mon Apr 17 2020 zhujunhao <zhujunhao8@huawei.com> - 1.29.1-4
+* Fri Apr 17 2020 zhujunhao <zhujunhao8@huawei.com> - 1.29.1-4
 - add llvm in rust

 * Thu Dec 5 2019 wutao <wutao61@huawei.com> - 1.29.1-3
--- a/rustc-1.58.1-disable-http2.patch
+++ b/rustc-1.58.1-disable-http2.patch
@ -1,86 +0,0 @@
-From 39b90a6ca3134982d3eadf96ea2067cc7cfc6d8d Mon Sep 17 00:00:00 2001
-From: Liu Zixian <liuzixian4@huawei.com>
-Date: Sat, 22 Jan 2022 00:37:26 +0800
-Subject: [PATCH] disable http2
-
---
- Cargo.lock                                | 11 -----------
- src/tools/cargo/Cargo.toml                |  2 +-
- src/tools/cargo/src/cargo/core/package.rs | 12 +++---------
- 3 files changed, 4 insertions(+), 21 deletions(-)
-
-diff --git a/Cargo.lock b/Cargo.lock
-index 2dbf34d87..908eb2c0b 100644
--- a/Cargo.lock
-+++ b/Cargo.lock
-@@ -909,7 +909,6 @@ checksum = "d130987e6a6a34fe0889e1083022fa48cd90e6709a84be3fb8dd95801de5af20"
- dependencies = [
-  "cc",
-  "libc",
- "libnghttp2-sys",
-  "libz-sys",
-  "openssl-sys",
-  "pkg-config",
-@@ -1926,16 +1925,6 @@ version = "0.1.4"
- source = "registry+https://github.com/rust-lang/crates.io-index"
- checksum = "7fc7aa29613bd6a620df431842069224d8bc9011086b1db4c0e0cd47fa03ec9a"
- 
-[[package]]
-name = "libnghttp2-sys"
-version = "0.1.4+1.41.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "03624ec6df166e79e139a2310ca213283d6b3c30810c54844f307086d4488df1"
-dependencies = [
- "cc",
- "libc",
-]
-
- [[package]]
- name = "libz-sys"
- version = "1.1.3"
-diff --git a/src/tools/cargo/Cargo.toml b/src/tools/cargo/Cargo.toml
-index e23f4ec06..4e615767e 100644
--- a/src/tools/cargo/Cargo.toml
-+++ b/src/tools/cargo/Cargo.toml
-@@ -22,7 +22,7 @@ cargo-platform = { path = "crates/cargo-platform", version = "0.1.2" }
- cargo-util = { path = "crates/cargo-util", version = "0.1.1" }
- crates-io = { path = "crates/crates-io", version = "0.33.0" }
- crossbeam-utils = "0.8"
-curl = { version = "0.4.41", features = ["http2"] }
-+curl = { version = "0.4.41", features = [] }
- curl-sys = "0.4.50"
- env_logger = "0.9.0"
- pretty_env_logger = { version = "0.4", optional = true }
-diff --git a/src/tools/cargo/src/cargo/core/package.rs b/src/tools/cargo/src/cargo/core/package.rs
-index dd73ea25c..e1ed94321 100644
--- a/src/tools/cargo/src/cargo/core/package.rs
-+++ b/src/tools/cargo/src/cargo/core/package.rs
-@@ -419,14 +419,8 @@ impl<'cfg> PackageSet<'cfg> {
-         // Also note that pipelining is disabled as curl authors have indicated
-         // that it's buggy, and we've empirically seen that it's buggy with HTTP
-         // proxies.
-        let mut multi = Multi::new();
-        let multiplexing = config.http_config()?.multiplexing.unwrap_or(true);
-        multi
-            .pipelining(false, multiplexing)
-            .with_context(|| "failed to enable multiplexing/pipelining in curl")?;
-
-        // let's not flood crates.io with connections
-        multi.set_max_host_connections(2)?;
-+        let multi = Multi::new();
-+        let multiplexing = false;
- 
-         Ok(PackageSet {
-             packages: package_ids
-@@ -655,7 +649,7 @@ impl<'cfg> PackageSet<'cfg> {
- macro_rules! try_old_curl {
-     ($e:expr, $msg:expr) => {
-         let result = $e;
-        if cfg!(target_os = "macos") {
-+        if cfg!(any(target_os = "linux", target_os = "macos")) {
-             if let Err(e) = result {
-                 warn!("ignoring libcurl {} error: {}", $msg, e);
-             }
-- 
-2.34.1
-
--- a/rustc-1.60.0-disable-libssh2.patch
+++ b/rustc-1.60.0-disable-libssh2.patch
@ -1,6 +1,6 @@
-From ea7aff0acb25c06a76dfc99f46543937750e910e Mon Sep 17 00:00:00 2001
+From af470615d6ececcedbaf5edc4c34e18415a2cfa9 Mon Sep 17 00:00:00 2001
 From: Liu Zixian <liuzixian4@huawei.com>
-Date: Sat, 22 Jan 2022 00:36:17 +0800
+Date: Tue, 19 Apr 2022 22:26:47 +0800
 Subject: [PATCH] disable libssh2

 ---
@ -9,10 +9,10 @@ Subject: [PATCH] disable libssh2
 2 files changed, 1 insertion(+), 16 deletions(-)

 diff --git a/Cargo.lock b/Cargo.lock
-index 48d9fdb3d..2dbf34d87 100644
+index e3ab987b3..8baf4fbd9 100644
 --- a/Cargo.lock
 +++ b/Cargo.lock
-@@ -1915,7 +1915,6 @@ checksum = "ddbd6021eef06fb289a8f54b3c2acfdd85ff2a585dfbb24b8576325373d2152c"
+@@ -1987,7 +1987,6 @@ checksum = "ddbd6021eef06fb289a8f54b3c2acfdd85ff2a585dfbb24b8576325373d2152c"
 dependencies = [
  "cc",
  "libc",
@ -20,15 +20,15 @@ index 48d9fdb3d..2dbf34d87 100644
  "libz-sys",
  "openssl-sys",
  "pkg-config",
-@@ -1937,20 +1936,6 @@ dependencies = [
+@@ -2019,20 +2018,6 @@ dependencies = [
  "libc",
 ]
 
 -[[package]]
 -name = "libssh2-sys"
-version = "0.2.19"
+-version = "0.2.23"
 -source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ca46220853ba1c512fc82826d0834d87b06bcd3c2a42241b7de72f3d2fe17056"
+-checksum = "b094a36eb4b8b8c8a7b4b8ae43b2944502be3e59cd87687595cf6b0a71b3f4ca"
 -dependencies = [
 - "cc",
 - "libc",
@ -55,5 +55,5 @@ index 299b77a8d..a05099544 100644
 ssh = ["libgit2-sys/ssh"]
 ssh_key_from_memory = ["libgit2-sys/ssh_key_from_memory"]
 -- 
-2.34.1
+2.35.1

--- a/rustc-1.61.0-rust-gdb-substitute-path.patch
+++ b/rustc-1.61.0-rust-gdb-substitute-path.patch
@ -0,0 +1,18 @@
+--- rustc-1.61.0-src/src/etc/rust-gdb.orig	2022-05-17 18:29:36.000000000 -0700
+++ rustc-1.61.0-src/src/etc/rust-gdb	2022-05-18 11:18:13.732709661 -0700
+@@ -14,6 +14,9 @@ fi
+ RUSTC_SYSROOT="$("$RUSTC" --print=sysroot)"
+ GDB_PYTHON_MODULE_DIRECTORY="$RUSTC_SYSROOT/lib/rustlib/etc"
+ 
+RUST_STD_BUILD="@BUILDDIR@/library/"
+RUST_STD_SRC="$RUSTC_SYSROOT/lib/rustlib/src/rust/library/"
+
+ # Run GDB with the additional arguments that load the pretty printers
+ # Set the environment variable `RUST_GDB` to overwrite the call to a
+ # different/specific command (defaults to `gdb`).
+@@ -21,4 +24,5 @@ RUST_GDB="${RUST_GDB:-gdb}"
+ PYTHONPATH="$PYTHONPATH:$GDB_PYTHON_MODULE_DIRECTORY" exec ${RUST_GDB} \
+   --directory="$GDB_PYTHON_MODULE_DIRECTORY" \
+   -iex "add-auto-load-safe-path $GDB_PYTHON_MODULE_DIRECTORY" \
+  -iex "set substitute-path $RUST_STD_BUILD $RUST_STD_SRC" \
+   "$@"
--- a/rustc-1.63.0-disable-http2.patch
+++ b/rustc-1.63.0-disable-http2.patch
@ -0,0 +1,90 @@
+--- rustc-1.63.0-src/Cargo.lock.orig	2022-08-10 12:25:16.512185135 -0700
+++ rustc-1.63.0-src/Cargo.lock	2022-08-10 12:25:16.513185114 -0700
+@@ -1054,7 +1054,6 @@
+ dependencies = [
+  "cc",
+  "libc",
+- "libnghttp2-sys",
+  "libz-sys",
+  "openssl-sys",
+  "pkg-config",
+@@ -2160,16 +2159,6 @@
+ checksum = "7fc7aa29613bd6a620df431842069224d8bc9011086b1db4c0e0cd47fa03ec9a"
+ 
+ [[package]]
+-name = "libnghttp2-sys"
+-version = "0.1.4+1.41.0"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "03624ec6df166e79e139a2310ca213283d6b3c30810c54844f307086d4488df1"
+-dependencies = [
+- "cc",
+- "libc",
+-]
+-
+-[[package]]
+ name = "libz-sys"
+ version = "1.1.3"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+--- rustc-1.63.0-src/src/tools/cargo/Cargo.toml.orig	2022-08-10 12:25:16.514185093 -0700
+++ rustc-1.63.0-src/src/tools/cargo/Cargo.toml	2022-08-10 12:25:51.441455282 -0700
+@@ -22,7 +22,7 @@
+ cargo-util = { path = "crates/cargo-util", version = "0.2.1" }
+ crates-io = { path = "crates/crates-io", version = "0.34.0" }
+ crossbeam-utils = "0.8"
+-curl = { version = "0.4.43", features = ["http2"] }
+curl = { version = "0.4.43", features = [] }
+ curl-sys = "0.4.55"
+ env_logger = "0.9.0"
+ pretty_env_logger = { version = "0.4", optional = true }
+--- rustc-1.63.0-src/src/tools/cargo/src/cargo/sources/registry/http_remote.rs.orig	2022-08-08 15:47:35.000000000 -0700
+++ rustc-1.63.0-src/src/tools/cargo/src/cargo/sources/registry/http_remote.rs	2022-08-10 12:25:16.514185093 -0700
+@@ -192,16 +192,8 @@
+         }
+         self.fetch_started = true;
+ 
+-        // We've enabled the `http2` feature of `curl` in Cargo, so treat
+-        // failures here as fatal as it would indicate a build-time problem.
+-        self.multiplexing = self.config.http_config()?.multiplexing.unwrap_or(true);
+-
+-        self.multi
+-            .pipelining(false, self.multiplexing)
+-            .with_context(|| "failed to enable multiplexing/pipelining in curl")?;
+-
+-        // let's not flood the server with connections
+-        self.multi.set_max_host_connections(2)?;
+        // Multiplexing is disabled because the system libcurl doesn't support it.
+        self.multiplexing = false;
+ 
+         self.config
+             .shell()
+--- rustc-1.63.0-src/src/tools/cargo/src/cargo/core/package.rs.orig	2022-08-08 15:47:35.000000000 -0700
+++ rustc-1.63.0-src/src/tools/cargo/src/cargo/core/package.rs	2022-08-10 12:25:16.514185093 -0700
+@@ -403,16 +403,9 @@
+         sources: SourceMap<'cfg>,
+         config: &'cfg Config,
+     ) -> CargoResult<PackageSet<'cfg>> {
+-        // We've enabled the `http2` feature of `curl` in Cargo, so treat
+-        // failures here as fatal as it would indicate a build-time problem.
+-        let mut multi = Multi::new();
+-        let multiplexing = config.http_config()?.multiplexing.unwrap_or(true);
+-        multi
+-            .pipelining(false, multiplexing)
+-            .with_context(|| "failed to enable multiplexing/pipelining in curl")?;
+-
+-        // let's not flood crates.io with connections
+-        multi.set_max_host_connections(2)?;
+        // Multiplexing is disabled because the system libcurl doesn't support it.
+        let multi = Multi::new();
+        let multiplexing = false;
+ 
+         Ok(PackageSet {
+             packages: package_ids
+@@ -658,7 +651,7 @@
+ macro_rules! try_old_curl {
+     ($e:expr, $msg:expr) => {
+         let result = $e;
+-        if cfg!(target_os = "macos") {
+        if cfg!(any(target_os = "linux", target_os = "macos")) {
+             if let Err(e) = result {
+                 warn!("ignoring libcurl {} error: {}", $msg, e);
+             }
--- a/rustc-1.64.0-src.tar.xz
+++ b/rustc-1.64.0-src.tar.xz
Author	SHA1	Message	Date
openeuler-ci-bot	162b66e655	!110 [sync] PR-104: Fix CVE-2024-24575,CVE-2024-24577 From: @openeuler-sync-bot Reviewed-by: @wk333 Signed-off-by: @wk333	2024-02-18 01:11:08 +00:00
wk333	0ca8d8b4c8	Fix CVE-2024-24575,CVE-2024-24577 (cherry picked from commit bcfbc9c42ec81ad26c830bb8f30400f7c16c375e)	2024-02-18 09:04:32 +08:00
openeuler-ci-bot	848d20553a	!94 Use local mirror for speed up From: @fundawang Reviewed-by: @wk333 Signed-off-by: @wk333	2023-07-31 01:20:18 +00:00
Funda Wang	1b168183b7	Use local mirror for speed up	2023-07-30 22:59:52 +08:00
openeuler-ci-bot	4fc5bb1f00	!86 Update to 1.64.0 From: @wk333 Reviewed-by: @jingxiaolu Signed-off-by: @jingxiaolu	2023-05-12 02:09:18 +00:00
wk333	505eafa439	Update to 1.64.0	2023-05-11 19:06:22 +08:00
openeuler-ci-bot	69fcd53435	!76 Update to 1.60.0 From: @wk333 Reviewed-by: @gitee-cmd Signed-off-by: @gitee-cmd	2022-11-02 03:21:52 +00:00
wk333	3d6caa976b	Update to 1.60.0	2022-11-01 19:43:27 +08:00
openeuler-ci-bot	588b3c29e6	!72 【轻量级 PR】：fix bogus date in %changelog From: @zhangkea Reviewed-by: @jingxiaolu Signed-off-by: @jingxiaolu	2022-08-03 11:59:56 +00:00
zhangkea	bd09ec689a	fix bogus date in %changelog	2022-06-16 17:39:45 +08:00