diff --git a/.gitlab/issue_templates/Default.md b/.gitlab/issue_templates/Default.md new file mode 100644 index 0000000..cc992fc --- /dev/null +++ b/.gitlab/issue_templates/Default.md @@ -0,0 +1,52 @@ +## Bug Report Template + +> **If you have a question or are not sure about what you are about to post, please use the forums instead.** +> **Also, check for possible duplicate reports here or in the forum before submitting this issue.** + +--- + +### 1. Affected Package revision / version + + + +--- + +### 2. Steps to Reproduce + + + +1. ... +2. ... +3. ... + +--- + +### 3. Current Behavior + + + +--- + +### 4. Expected Behavior *(optional)* + + + +--- + +### 5. Workaround *(optional)* + + + +--- + +### 6. Suggestions, Investigation and Possible Causes *(optional)* + + + +--- + +### 7. Other Tests *(optional)* + + + +--- diff --git a/helpers/DATA/apparmor-profiles-extra/70aed868a4ed76d74eecf3b210ce7bf3098ffab4.patch b/helpers/DATA/apparmor-profiles-extra/70aed868a4ed76d74eecf3b210ce7bf3098ffab4.patch new file mode 100644 index 0000000..1b8ad3b --- /dev/null +++ b/helpers/DATA/apparmor-profiles-extra/70aed868a4ed76d74eecf3b210ce7bf3098ffab4.patch @@ -0,0 +1,38 @@ +From 70aed868a4ed76d74eecf3b210ce7bf3098ffab4 Mon Sep 17 00:00:00 2001 +From: Jacob K +Date: Wed, 12 Feb 2025 12:19:24 -0600 +Subject: [PATCH] Add some lines from Atril's profile to fix the screen reader + +--- + profiles/usr.bin.pidgin | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/profiles/usr.bin.pidgin b/profiles/usr.bin.pidgin +index 5e18702..085301c 100644 +--- a/profiles/usr.bin.pidgin ++++ b/profiles/usr.bin.pidgin +@@ -8,6 +8,7 @@ + #include + #include + #include ++ #include + #include + #include + #include +@@ -82,6 +83,13 @@ + owner @{PROC}/@{pid}/auxv r, + owner @{PROC}/@{pid}/fd/ r, + ++ # These lines were copied from Atril's profile to make the screen reader functional ++ owner /{,var/}run/user/*/at-spi2-*/ rw, ++ owner /{,var/}run/user/*/at-spi2-*/** rw, ++ # Allow access to the non-abstract D-Bus socket used by at-spi > 2.42.0 ++ # https://gitlab.gnome.org/GNOME/at-spi2-core/-/issues/43 ++ owner /{,var/}run/user/*/at-spi/bus* rw, ++ + # Site-specific additions and overrides. See local/README for details. + #include + } +-- +2.25.1 + diff --git a/helpers/DATA/apparmor/b5a7641dd3502fcfb897d3b96e197628b674ce3c.patch b/helpers/DATA/apparmor/b5a7641dd3502fcfb897d3b96e197628b674ce3c.patch index 2a2194f..451e869 100644 --- a/helpers/DATA/apparmor/b5a7641dd3502fcfb897d3b96e197628b674ce3c.patch +++ b/helpers/DATA/apparmor/b5a7641dd3502fcfb897d3b96e197628b674ce3c.patch @@ -17,7 +17,7 @@ index 01493260d..dd783992d 100644 /etc/wildmidi/wildmidi.cfg r, +# pipewire -+/usr/share/pipewire/client.conf r, ++/usr/share/pipewire/client{,-rt}.conf r, + # Include additions to the abstraction include if exists diff --git a/helpers/DATA/atril/apparmor-profile b/helpers/DATA/atril/apparmor-profile new file mode 100644 index 0000000..6cbe53e --- /dev/null +++ b/helpers/DATA/atril/apparmor-profile @@ -0,0 +1,350 @@ +# vim:syntax=apparmor + +# evince is not written with application confinement in mind and is designed to +# operate within a trusted desktop session where anything running within the +# user's session is trusted. That said, evince will often process untrusted +# input (PDFs, images, etc). Ideally evince would be written in such a way that +# image processing is separate from the main process and that processing +# happens in a restrictive sandbox, but unfortunately that is not currently the +# case. Because evince will process untrusted input, this profile aims to +# provide some hardening, but considering evince's design and other factors such +# as X, gsettings, accessibility, translations, DBus session and system +# services, etc, complete confinement is not possible. + +#include + +/usr/bin/atril { + #include + #include + #include + #include + #include + #include + #include + + #include + #include + #include + #include + #include + + # allow atril to spawn browsers distributed as snaps (LP: #1794064) + #include + + # For now, let atril talk to any session services over dbus. We can + # blacklist any problematic ones (but note, evince uses libsecret :\) + #include + + #include + dbus (receive) bus=system, + # Allow getting information from various system services + dbus (send) + bus=system + member="Get*" + peer=(label=unconfined), + # Allow talking to avahi with whatever polkit allows + dbus (send) + bus=system + interface="org.freedesktop.Avahi{,.*}", + # Allow talking to colord with whatever polkit allows + dbus (send) + bus=system + interface="org.freedesktop.ColorManager{,.*}", + + # Terminals for using console applications. These abstractions should ideally + # have 'ix' to restrict access to what only atril is allowed to do + #include + + # By default, we won't support launching a terminal program in Xterm or + # KDE's konsole. It opens up too many unnecessary files for most users. + # People who need this functionality can uncomment the following: + ##include + ##include + + /usr/bin/atril rmPx, + /usr/bin/atril-previewer Px, + /usr/bin/yelp Cx -> sanitized_helper, + /usr/bin/bug-buddy px, + # 'Show Containing Folder' (LP: #1022962) + /usr/bin/nautilus Cx -> sanitized_helper, # Gnome + /usr/bin/pcmanfm Cx -> sanitized_helper, # LXDE + /usr/bin/krusader Cx -> sanitized_helper, # KDE + /usr/bin/thunar Cx -> sanitized_helper, # XFCE + + # Print Dialog + /usr/lib/@{multiarch}/libproxy/*/pxgsettings Cx -> sanitized_helper, + + # For Xubuntu to launch the browser + #include + + # For text attachments + /usr/bin/gedit ixr, + + # For Send to + /usr/bin/nautilus-sendto Cx -> sanitized_helper, + + # GLib desktop launch helper (used under the hood by g_app_info_launch) + /usr/lib/@{multiarch}/glib-[0-9]*/gio-launch-desktop rmix, + /usr/bin/env ixr, + + # allow directory listings (ie 'r' on directories) so browsing via the file + # dialog works + / r, + /**/ r, + + # This is need for saving files in your home directory without an extension. + # Changing this to '@{HOME}/** r' makes it require an extension and more + # secure (but with 'rw', we still have abstractions/private-files-strict in + # effect). + owner @{HOME}/** rw, + owner /media/** rw, + owner @{HOME}/.local/share/gvfs-metadata/** l, + owner /{,var/}run/user/*/gvfs-metadata/** l, + + # Maybe add to an abstraction? + /etc/dconf/** r, + owner @{HOME}/.cache/dconf/user rw, + owner @{HOME}/.config/dconf/user r, + owner @{HOME}/.config/enchant/* rk, + owner /{,var/}run/user/*/dconf/ w, + owner /{,var/}run/user/*/dconf/user rw, + owner /{,var/}run/user/*/dconf-service/keyfile/ w, + owner /{,var/}run/user/*/dconf-service/keyfile/user rw, + + owner /{,var/}run/user/*/at-spi2-*/ rw, + owner /{,var/}run/user/*/at-spi2-*/** rw, + + # Allow access to the non-abstract D-Bus socket used by at-spi > 2.42.0 + # https://gitlab.gnome.org/GNOME/at-spi2-core/-/issues/43 + owner /{,var/}run/user/*/at-spi/bus* rw, + + # from http://live.gnome.org/Evince/SupportedDocumentFormats. Allow + # read and write for all supported file formats + /**.[aA][iI] rw, + /**.[bB][mM][pP] rw, + /**.[dD][jJ][vV][uU] rw, + /**.[dD][vV][iI] rw, + /**.[gG][iI][fF] rw, + /**.[jJ][pP][gG] rw, + /**.[jJ][pP][eE][gG] rw, + /**.[oO][dD][pP] rw, + /**.[fFpP][dD][fF] rw, + /**.[pP][nN][mM] rw, + /**.[pP][nN][gG] rw, + /**.[pP][sS] rw, + /**.[eE][pP][sS] rw, + /**.[tT][iI][fF] rw, + /**.[tT][iI][fF][fF] rw, + /**.[xX][pP][mM] rw, + /**.[gG][zZ] rw, + /**.[bB][zZ]2 rw, + /**.[cC][bB][rRzZ7] rw, + /**.[xX][zZ] rw, + + # atril creates a temporary stream file like '.goutputstream-XXXXXX' in the + # directory a file is saved. This allows that behavior. + owner /**/.goutputstream-* w, + + # allow atril to spawn browsers distributed as snaps (LP: #1794064) + /{,snap/core/[0-9]*/,snap/snapd/[0-9]*/}usr/bin/snap mrCx -> snap_browsers, +} + +/usr/bin/atril-previewer { + #include + #include + #include + #include + #include + #include + #include + + #include + #include + #include + #include + #include + + # For now, let atril talk to any session services over dbus. We can + # blacklist any problematic ones (but note, evince uses libsecret :\) + #include + + #include + dbus (receive) bus=system, + # Allow getting information from various system services + dbus (send) + bus=system + member="Get*" + peer=(label=unconfined), + # Allow talking to avahi with whatever polkit allows + dbus (send) + bus=system + interface="org.freedesktop.Avahi{,.*}", + # Allow talking to colord with whatever polkit allows + dbus (send) + bus=system + interface="org.freedesktop.ColorManager{,.*}", + + + # Terminals for using console applications. These abstractions should ideally + # have 'ix' to restrict access to what only atril is allowed to do + #include + + # By default, we won't support launching a terminal program in Xterm or + # KDE's konsole. It opens up too many unnecessary files for most users. + # People who need this functionality can uncomment the following: + ##include + + /usr/bin/atril-previewer mr, + /usr/bin/yelp Cx -> sanitized_helper, + /usr/bin/bug-buddy px, + + # Lenient, but remember we still have abstractions/private-files-strict in + # effect). Write is needed for 'print to file' from the previewer. + @{HOME}/ r, + @{HOME}/** rw, + + # Maybe add to an abstraction? + owner /{,var/}run/user/*/dconf/ w, + owner /{,var/}run/user/*/dconf/user rw, +} + +/usr/bin/atril-thumbnailer { + #include + #include + + #include + deny @{HOME}/.{,cache/}fontconfig/** wl, + deny @{HOME}/missfont.log wl, + + #include + dbus (receive) bus=session, + dbus (send) + bus=session + path="/org/gtk/vfs/mounttracker" + interface="org.gtk.vfs.MountTracker" + member="ListMountableInfo" + peer=(label=unconfined), + + # updating gvfs-metadata for thumbnails is unneeded, so explicitly deny it + deny dbus (send) + bus=session + path="/org/gtk/vfs/metadata" + interface="org.gtk.vfs.Metadata" + member="GetTreeFromDevice" + peer=(label=unconfined), + deny @{HOME}/.local/share/gvfs-metadata/* r, + + dbus (send) + bus=session + path="/org/gtk/vfs/Daemon" + interface="org.gtk.vfs.Daemon" + member="List*" + peer=(label=unconfined), + + # The thumbnailer doesn't need access to everything in the nameservice + # abstraction. Allow reading of /etc/passwd and /etc/group, but suppress + # logging denial of nsswitch.conf. + /etc/passwd r, + /etc/group r, + deny /etc/nsswitch.conf r, + + # TCP/UDP network access for NFS + network inet stream, + network inet6 stream, + network inet dgram, + network inet6 dgram, + + /etc/papersize r, + + /usr/bin/atril-thumbnailer mr, + + /etc/texmf/ r, + /etc/texmf/** r, + /etc/xpdf/* r, + + /usr/bin/gs-esp ixr, + # Silence these denials since 'no new privs' drops transitions to + # sanitized_helper, we don't want all those perms in the thumbnailer + # and the thumbnailer generates thumbnails without these just fine. + deny /usr/bin/mktexpk x, + deny /usr/bin/mktextfm x, + deny /usr/bin/dvipdfm x, + deny /usr/bin/dvipdfmx x, + deny /usr/bin/mkofm x, + + # supported archivers + /{usr/,}bin/gzip ixr, + /{usr/,}bin/bzip2 ixr, + /usr/bin/unrar* ixr, + /usr/bin/unzip ixr, + /usr/bin/7zr ixr, + /usr/lib/p7zip/7zr ixr, + /usr/bin/7za ixr, + /usr/lib/p7zip/7za ixr, + /usr/bin/zipnote ixr, + /{usr/,}bin/tar ixr, + /usr/bin/xz ixr, + + # miscellaneous access for the above + owner @{PROC}/@{pid}/fd/ r, + owner @{PROC}/@{pid}/mountinfo r, + /sys/devices/system/cpu/ r, + + # allow read access to anything in /usr/share, for plugins and input methods + /usr/local/share/** r, + /usr/share/** r, + /usr/lib/ghostscript/** mr, + /var/lib/ghostscript/** r, + /var/lib/texmf/** r, + + # from http://live.gnome.org/Evince/SupportedDocumentFormats. Allow + # read for all supported file formats + /**.[bB][mM][pP] r, + /**.[dD][jJ][vV][uU] r, + /**.[dD][vV][iI] r, + /**.[gG][iI][fF] r, + /**.[jJ][pP][gG] r, + /**.[jJ][pP][eE][gG] r, + /**.[oO][dD][pP] r, + /**.[fFpP][dD][fF] r, + /**.[pP][nN][mM] r, + /**.[pP][nN][gG] r, + /**.[pP][sS] r, + /**.[eE][pP][sS] r, + /**.[eE][pP][sS][fFiI23] r, + /**.[tT][iI][fF] r, + /**.[tT][iI][fF][fF] r, + /**.[xX][pP][mM] r, + /**.[gG][zZ] r, + /**.[bB][zZ]2 r, + /**.[cC][bB][rRzZ7] r, + /**.[xX][zZ] r, + + owner @{HOME}/.texlive*/** r, + owner @{HOME}/.texmf*/** r, + owner @{HOME}/.local/share/{,flatpak/exports/share/}mime/** r, + owner @{HOME}/.local/share/{,flatpak/exports/share/}mime/** r, + + # With the network rules above, this allows data exfiltration for files + # not covered by private-files-strict. + @{HOME}/ r, + owner @{HOME}/[^.]** r, + owner /media/** r, + + owner /tmp/.gnome_desktop_thumbnail* w, + owner /tmp/gnome-desktop-* rw, + owner /tmp/atril-thumbnailer*/{,**} rw, + + # these happen post pivot_root + / r, + deny /missfont.log w, + + # Add apparmor rule for mate's caja - LP#1798091 + owner /tmp/.mate_desktop_thumbnail* w, + owner /tmp/mate-desktop-thumbnailer* w, + + # Fix thumbnail issue #915024 + owner @{HOME}/.cache/thumbnails/** rw, + owner /tmp/atril-thumbnailer* rw, + +} diff --git a/helpers/DATA/atril/apparmor-profile.abstraction b/helpers/DATA/atril/apparmor-profile.abstraction new file mode 100644 index 0000000..d2b8858 --- /dev/null +++ b/helpers/DATA/atril/apparmor-profile.abstraction @@ -0,0 +1,127 @@ +# vim:syntax=apparmor +# +# abstraction used by atril binaries +# + + #include + #include + #include + + @{PROC}/[0-9]*/fd/ r, + @{PROC}/[0-9]*/mountinfo r, + owner @{PROC}/[0-9]*/auxv r, + owner @{PROC}/[0-9]*/status r, + + # Doesn't seem to be required, but noisy. Maybe allow 'r' for 'b*' if needed. + # Possibly move to an abstraction if anything else needs it. + deny /run/udev/data/** r, + + # move out to the gnome abstraction if anyone else needs these + /etc/udev/udev.conf r, + /sys/devices/**/block/**/uevent r, + + # apport + /etc/default/apport r, + + # XFCE + /etc/xfce4/defaults.list r, + + # Lubuntu + /etc/xdg/lubuntu/applications/defaults.list r, + + # atril specific + /etc/ r, + /etc/fstab r, + /etc/texmf/ r, + /etc/texmf/** r, + /etc/xpdf/* r, + owner @{HOME}/.config/atril/ rw, + owner @{HOME}/.config/atril/** rwkl, + + /usr/bin/gs-esp ixr, + /usr/bin/mktexpk Cx -> sanitized_helper, + /usr/bin/mktextfm Cx -> sanitized_helper, + /usr/bin/dvipdfm Cx -> sanitized_helper, + /usr/bin/dvipdfmx Cx -> sanitized_helper, + + # gio-launch-desktop was replaced by a very small shell script + /{usr/,}bin/{dash,bash} ixr, + + # supported archivers + /{usr/,}bin/gzip ixr, + /{usr/,}bin/bzip2 ixr, + /usr/bin/unrar* ixr, + /usr/bin/unzip ixr, + /usr/bin/7zr ixr, + /usr/lib/p7zip/7zr ixr, + /usr/bin/7za ixr, + /usr/lib/p7zip/7za ixr, + /usr/bin/zipnote ixr, + /{usr/,}bin/tar ixr, + /usr/bin/xz ixr, + + # allow read access to anything in /usr/share, for plugins and input methods + /usr/local/share/** r, + /usr/share/** r, + /usr/lib/ghostscript/** mr, + /var/lib/ghostscript/** r, + /var/lib/texmf/{,**} r, + + # from http://live.gnome.org/Evince/SupportedDocumentFormats. Allow + # read for all supported file formats + /**.[aA][iI] r, + /**.[bB][mM][pP] r, + /**.[dD][jJ][vV][uU] r, + /**.[dD][vV][iI] r, + /**.[gG][iI][fF] r, + /**.[jJ][pP][gG] r, + /**.[jJ][pP][eE][gG] r, + /**.[oO][dD][pP] r, + /**.[fFpP][dD][fF] r, + /**.[pP][nN][mM] r, + /**.[pP][nN][gG] r, + /**.[pP][sS] r, + /**.[eE][pP][sS] r, + /**.[eE][pP][sS][fFiI23] r, + /**.[tT][iI][fF] r, + /**.[tT][iI][fF][fF] r, + /**.[xX][pP][mM] r, + /**.[gG][zZ] r, + /**.[bB][zZ]2 r, + /**.[cC][bB][rRzZ7] r, + /**.[xX][zZ] r, + + # Use abstractions/private-files instead of abstractions/private-files-strict + # and add the sensitive files manually to work around LP: #451422. The goal + # is to disallow access to the .mozilla folder in general, but to allow + # access to the Cache directory, which the browser may tell atril to open + # from directly. + + #include + audit deny @{HOME}/.gnupg/{,**} mrwkl, + audit deny @{HOME}/.ssh/{,**} mrwkl, + audit deny @{HOME}/.gnome2_private/{,**} mrwkl, + audit deny @{HOME}/.gnome2/ w, + audit deny @{HOME}/.gnome2/keyrings/{,**} mrwkl, + audit deny @{HOME}/.kde/{,share/,share/apps/} w, + audit deny @{HOME}/.kde/share/apps/kwallet/{,**} mrwkl, + audit deny @{HOME}/.pki/{,nssdb/} w, + audit deny @{HOME}/.pki/nssdb/{,**} wl, + + audit deny @{HOME}/.mozilla/{,**/} w, + audit deny @{HOME}/.mozilla/*/*/* mrwkl, + audit deny @{HOME}/.mozilla/**/bookmarkbackups/{,**} mrwkl, + audit deny @{HOME}/.mozilla/**/chrome/{,**} mrwkl, + audit deny @{HOME}/.mozilla/**/extensions/{,**} mrwkl, + audit deny @{HOME}/.mozilla/**/gm_scripts/{,**} mrwkl, + + audit deny @{HOME}/.config/ w, + audit deny @{HOME}/.config/chromium/{,**} mrwkl, + audit deny @{HOME}/.config/evolution/{,**} mrwkl, + audit deny @{HOME}/.evolution/{,**} mrwkl, + audit deny @{HOME}/.kde/{,share/,share/apps/} w, + audit deny @{HOME}/.kde/share/config/{,**} mrwkl, + audit deny @{HOME}/.kde/share/apps/kmail/{,**} mrwkl, + audit deny @{HOME}/.{,mozilla-}thunderbird/{,**/} w, + audit deny @{HOME}/.{,mozilla-}thunderbird/*/* mrwkl, + audit deny @{HOME}/.{,mozilla-}thunderbird/*/[^C][^a][^c][^h][^e]*/{,**} mrwkl, diff --git a/helpers/DATA/atril/atril.apport b/helpers/DATA/atril/atril.apport new file mode 100644 index 0000000..2ef92e2 --- /dev/null +++ b/helpers/DATA/atril/atril.apport @@ -0,0 +1,21 @@ +'''apport package hook for atril + +(c) 2024 Luis Guzmán +Author: +Luis Guzmán +based on evince's hook + +''' + +from apport.hookutils import * +from os import path +import re + +def add_info(report): + attach_conffiles(report, 'atril') + attach_related_packages(report, ['apparmor', 'libapparmor1', + 'libapparmor-perl', 'apparmor-utils', 'auditd', 'libaudit1']) + + attach_mac_events(report, ['/usr/bin/atril', + '/usr/bin/atril-previewer', + '/usr/bin/atril-thumbnailer']) diff --git a/helpers/DATA/atril/patches/add_install_profiles_rules.patch b/helpers/DATA/atril/patches/add_install_profiles_rules.patch new file mode 100644 index 0000000..60745dd --- /dev/null +++ b/helpers/DATA/atril/patches/add_install_profiles_rules.patch @@ -0,0 +1,29 @@ +diff --git a/debian/rules b/debian/rules +old mode 100755 +new mode 100644 +index 8a7ff87..655c574 +--- a/debian/rules ++++ b/debian/rules +@@ -52,3 +52,9 @@ override_dh_auto_configure: + + get-orig-source: + uscan --noconf --force-download --rename --download-current-version --destdir=.. ++ ++execute_after_dh_install: ++ install -m 0644 -D debian/apparmor-profile debian/atril/etc/apparmor.d/usr.bin.atril ++ install -m 0644 -D debian/apparmor-profile.abstraction debian/atril/etc/apparmor.d/abstractions/atril ++ install -m 0644 -D debian/atril.apport debian/atril/usr/share/apport/package-hooks/source_atril.py ++ dh_apparmor --profile-name=usr.bin.atril -patril + +diff --git a/debian/control b/debian/control +index f5bda53..6d72cc9 100644 +--- a/debian/control ++++ b/debian/control +@@ -9,6 +9,7 @@ Uploaders: Mike Gabriel , + Vangelis Mouhtsis , + Martin Wimpress , + Build-Depends: debhelper-compat (= 13), ++ dh-apparmor, + dpkg-dev (>= 1.16.1.1), + gobject-introspection, + intltool, diff --git a/helpers/DATA/choose-mirror/rev_Makefile.patch b/helpers/DATA/choose-mirror/rev_Makefile.patch index eab1a6d..0f38b63 100644 --- a/helpers/DATA/choose-mirror/rev_Makefile.patch +++ b/helpers/DATA/choose-mirror/rev_Makefile.patch @@ -5,7 +5,7 @@ diff -ru choose-mirror-2.78ubuntu7+10.0trisquel3/Makefile choose-mirror-2.111/Ma STRIP=strip # Derivative distributions may want to change these. --#MIRRORLISTURL=https://anonscm.debian.org/git/mirror/mirror-masterlist.git/plain/Mirrors.masterlist +-#MIRRORLISTURL=https://gitlab.trisquel.org/trisquel/trisquel-packages/-/raw/master/extra/mirrors/Mirrors.masterlist -MASTERLIST=Mirrors.masterlist.trisquel +MIRRORLISTURL=https://salsa.debian.org/mirror-team/masterlist/raw/master/Mirrors.masterlist +MASTERLIST=Mirrors.masterlist diff --git a/helpers/DATA/cron/license-info-fix.patch b/helpers/DATA/cron/license-info-fix.patch new file mode 100644 index 0000000..b6221bd --- /dev/null +++ b/helpers/DATA/cron/license-info-fix.patch @@ -0,0 +1,37 @@ +diff --git a/debian/copyright b/debian/copyright +index 3c8824f..c6ec81a 100644 +--- a/debian/copyright ++++ b/debian/copyright +@@ -38,7 +38,7 @@ License: GPL-2+ + + Files: debian/examples/crontab2english.pl + Copyright: 2001, Sean M. Burke +-License: Artistic ++License: GPL-1+ or Artistic + + License: Paul-Vixie's-license + Distribute freely, except: don't remove my name from the source or +@@ -67,6 +67,23 @@ License: GPL-2+ + On Debian systems, the complete text of the GNU General + Public License version 2 can be found in "/usr/share/common-licenses/GPL-2". + ++License: GPL-1+ ++ This package is free software; you can redistribute it and/or modify ++ it under the terms of the GNU General Public License as published by ++ the Free Software Foundation; either version 1 of the License, or ++ (at your option) any later version. ++ . ++ This package is distributed in the hope that it will be useful, ++ but WITHOUT ANY WARRANTY; without even the implied warranty of ++ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ++ GNU General Public License for more details. ++ . ++ You should have received a copy of the GNU General Public License ++ along with this program. If not, see ++ . ++ On Debian systems, the complete text of the GNU General ++ Public License version 1 can be found in "/usr/share/common-licenses/GPL-1". ++ + License: Artistic + This program is free software; you can redistribute it and/or modify it + under the terms of the "Artistic License" which comes with Debian. diff --git a/helpers/DATA/debconf-kde/patch_changes/000-fix_TPH_212_LP_1851573.patch b/helpers/DATA/debconf-kde/patch_changes/000-fix_TPH_212_LP_1851573.patch new file mode 100644 index 0000000..0727b46 --- /dev/null +++ b/helpers/DATA/debconf-kde/patch_changes/000-fix_TPH_212_LP_1851573.patch @@ -0,0 +1,33 @@ +diff --git a/tools/main.cpp b/tools/main.cpp +index 813aba5a..5f91e057 100644 +--- a/tools/main.cpp ++++ b/tools/main.cpp +@@ -37,6 +37,8 @@ + + #include + ++#include ++ + using namespace DebconfKde; + + // Handle SIGQUIT. Clients (e.g. packagekit) may use QUIT which would otherwise +@@ -73,6 +76,19 @@ static void setupQuitHandler() { + + int main(int argc, char **argv) + { ++ /* TPH: #212 | LP: #1851573 — When the helper is started through pkexec/aptdaemon ++ * the environment may arrive without $HOME. Without HOME, KConfig writes ++ * to "//.config/..." and shows a "not writable" dialog for every debconf ++ * question. Substitute the passwd entry’s home directory. ++ */ ++ const char *homeEnv = getenv("HOME"); ++ if (!homeEnv || homeEnv[0] == '\0') { ++ struct passwd *pw = getpwuid(getuid()); ++ if (pw && pw->pw_dir) { ++ setenv("HOME", pw->pw_dir, /* overwrite = */ 1); ++ } ++ } ++ + QApplication app(argc, argv); + setupQuitHandler(); + diff --git a/helpers/DATA/debootstrap/ecne b/helpers/DATA/debootstrap/ecne new file mode 120000 index 0000000..fe1d521 --- /dev/null +++ b/helpers/DATA/debootstrap/ecne @@ -0,0 +1 @@ +trisquel \ No newline at end of file diff --git a/helpers/DATA/dino-im/cve/01_ef8fb0e94ce79d5fde2943e433ad0422eb7f70ec.patch b/helpers/DATA/dino-im/cve/01_ef8fb0e94ce79d5fde2943e433ad0422eb7f70ec.patch new file mode 100644 index 0000000..0172ccd --- /dev/null +++ b/helpers/DATA/dino-im/cve/01_ef8fb0e94ce79d5fde2943e433ad0422eb7f70ec.patch @@ -0,0 +1,37 @@ +From ef8fb0e94ce79d5fde2943e433ad0422eb7f70ec Mon Sep 17 00:00:00 2001 +From: Marvin W +Date: Thu, 23 Mar 2023 10:13:30 -0600 +Subject: [PATCH] Check sender of bookmark:1 updates + +--- + xmpp-vala/src/module/xep/0402_bookmarks2.vala | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/xmpp-vala/src/module/xep/0402_bookmarks2.vala b/xmpp-vala/src/module/xep/0402_bookmarks2.vala +index 406f37f43..d1e53e6e3 100644 +--- a/xmpp-vala/src/module/xep/0402_bookmarks2.vala ++++ b/xmpp-vala/src/module/xep/0402_bookmarks2.vala +@@ -68,6 +68,11 @@ public class Module : BookmarksProvider, XmppStreamModule { + } + + private void on_pupsub_item(XmppStream stream, Jid jid, string id, StanzaNode? node) { ++ if (!jid.equals(stream.get_flag(Bind.Flag.IDENTITY).my_jid.bare_jid)) { ++ warning("Received alleged bookmarks:1 item from %s, ignoring", jid.to_string()); ++ return; ++ } ++ + Conference conference = parse_item_node(node, id); + Flag? flag = stream.get_flag(Flag.IDENTITY); + if (flag != null) { +@@ -77,6 +82,11 @@ public class Module : BookmarksProvider, XmppStreamModule { + } + + private void on_pupsub_retract(XmppStream stream, Jid jid, string id) { ++ if (!jid.equals(stream.get_flag(Bind.Flag.IDENTITY).my_jid.bare_jid)) { ++ warning("Received alleged bookmarks:1 retract from %s, ignoring", jid.to_string()); ++ return; ++ } ++ + try { + Jid jid_parsed = new Jid(id); + Flag? flag = stream.get_flag(Flag.IDENTITY); diff --git a/helpers/DATA/distro-info-data/README.Debian.patch b/helpers/DATA/distro-info-data/README.Debian.patch index cc2243b..1d647b5 100644 --- a/helpers/DATA/distro-info-data/README.Debian.patch +++ b/helpers/DATA/distro-info-data/README.Debian.patch @@ -1,5 +1,5 @@ ---- debian/README.Debian 2019-10-17 15:10:30.000000000 -0500 -+++ debian/README.Debian_trisquel 2021-11-26 13:26:20.362971709 -0600 +--- a/debian/README.Debian 2019-10-17 15:10:30.000000000 -0500 ++++ b/debian/README.Debian 2021-11-26 13:26:20.362971709 -0600 @@ -2,7 +2,7 @@ =========== diff --git a/helpers/DATA/distro-info-data/add_trisquel_tools_py.patch b/helpers/DATA/distro-info-data/add_trisquel_tools_py.patch index 29448c1..13a196a 100644 --- a/helpers/DATA/distro-info-data/add_trisquel_tools_py.patch +++ b/helpers/DATA/distro-info-data/add_trisquel_tools_py.patch @@ -1,5 +1,5 @@ ---- lib/tools.py 2021-10-15 08:01:00.000000000 -0500 -+++ lib/tools.py 2022-04-06 12:27:07.672427372 -0500 +--- a/lib/tools.py 2021-10-15 08:01:00.000000000 -0500 ++++ a/lib/tools.py 2022-04-06 12:27:07.672427372 -0500 @@ -37,7 +37,7 @@ def main(validation_function): """Main function with command line parameter parsing.""" diff --git a/helpers/DATA/distro-info-data/add_trisquel_validate.patch b/helpers/DATA/distro-info-data/add_trisquel_validate.patch index cfaa25a..09fd9a5 100644 --- a/helpers/DATA/distro-info-data/add_trisquel_validate.patch +++ b/helpers/DATA/distro-info-data/add_trisquel_validate.patch @@ -1,5 +1,5 @@ ---- validate-csv-data 2021-10-15 08:01:00.000000000 -0500 -+++ validate-csv-data 2022-04-06 12:27:29.004706669 -0500 +--- a/validate-csv-data 2021-10-15 08:01:00.000000000 -0500 ++++ b/validate-csv-data 2022-04-06 12:27:29.004706669 -0500 @@ -27,6 +27,13 @@ diff --git a/helpers/DATA/distro-info-data/trisquel.csv b/helpers/DATA/distro-info-data/trisquel.csv index 3a0cf38..17b54c2 100644 --- a/helpers/DATA/distro-info-data/trisquel.csv +++ b/helpers/DATA/distro-info-data/trisquel.csv @@ -12,3 +12,4 @@ version,codename,series,created,release,eol,upstream 9.0 LTS,Etiona,etiona,2017-10-19,2020-10-16,2023-05-31,bionic 10.0 LTS,Nabia,nabia,2019-10-17,2021-12-16,2025-05-29,focal 11.0 LTS,Aramo,aramo,2021-10-14,2023-03-19,2027-06-01,jammy +12.0 LTS,Ecne,ecne,2023-10-12,2029-05-31,2029-05-31,noble diff --git a/helpers/DATA/emacs/patch_changes/000-add_custom_libs_imagemagic_tree-sitter_json.patch b/helpers/DATA/emacs/patch_changes/000-add_custom_libs_imagemagic_tree-sitter_json.patch new file mode 100644 index 0000000..8f9640f --- /dev/null +++ b/helpers/DATA/emacs/patch_changes/000-add_custom_libs_imagemagic_tree-sitter_json.patch @@ -0,0 +1,41 @@ +diff --git a/debian/rules b/debian/rules +index 2aaaef13..db5d184f 100755 +--- a/debian/rules ++++ b/debian/rules +@@ -297,6 +297,9 @@ confflags_gtk := $(confflags) + confflags_gtk += --with-cairo + confflags_gtk += --with-x=yes + confflags_gtk += --with-x-toolkit=gtk3 ++confflags_gtk += --with-imagemagick ++#confflags_gtk += --with-tree-sitter ++confflags_gtk += --with-json + # For those who prefer the old-style non-toolkit scrollbars, just + # change the assignment below to --without-toolkit-scroll-bars. The + # resulting emacs-gtk package will have the old scrollbars. +@@ -317,6 +320,9 @@ confflags_lucid += --with-x=yes + confflags_lucid += --with-x-toolkit=lucid + confflags_lucid += --with-toolkit-scroll-bars + confflags_lucid += --without-gsettings ++confflags_gtk += --with-imagemagick ++#confflags_gtk += --with-tree-sitter ++confflags_gtk += --with-json + + define cfg_tree + cd $(1) && \ +diff --git a/debian/control b/debian/control +index 005b695..169abfc 100644 +--- a/debian/control ++++ b/debian/control +@@ -26,10 +26,12 @@ Build-Depends: + libgpm-dev [linux-any], + libgtk-3-dev, + libharfbuzz-dev, ++ libjansson-dev, + libjpeg-dev, + liblcms2-dev, + liblockfile-dev, + libm17n-dev, ++ libmagickwand-dev, + libncurses-dev, + liboss4-salsa-dev [hurd-i386 kfreebsd-i386 kfreebsd-amd64], + libotf-dev, diff --git a/helpers/DATA/firefox/branding/content/about-wordmark.svg b/helpers/DATA/firefox/branding/content/about-wordmark.svg index 64f0cdb..57404ce 100644 --- a/helpers/DATA/firefox/branding/content/about-wordmark.svg +++ b/helpers/DATA/firefox/branding/content/about-wordmark.svg @@ -1,73 +1,11 @@ - + image/svg+xml + xmlns="http://www.w3.org/2000/svg"> + diff --git a/helpers/DATA/firefox/branding/content/aboutDialog.css b/helpers/DATA/firefox/branding/content/aboutDialog.css index 6312a59..4b16868 100644 --- a/helpers/DATA/firefox/branding/content/aboutDialog.css +++ b/helpers/DATA/firefox/branding/content/aboutDialog.css @@ -40,8 +40,9 @@ } #rightBox { - margin-left: 30px; - margin-right: 30px; + background-size: auto 64px; + margin-inline: 30px; + padding-top: 64px; } #bottomBox { diff --git a/helpers/DATA/firefox/branding/content/firefox-wordmark.svg b/helpers/DATA/firefox/branding/content/firefox-wordmark.svg index 3de7bbd..def6e54 100644 --- a/helpers/DATA/firefox/branding/content/firefox-wordmark.svg +++ b/helpers/DATA/firefox/branding/content/firefox-wordmark.svg @@ -1,78 +1,10 @@ - + image/svg+xml + width="232" + height="41" + viewBox="0 0 232 41" + xmlns="http://www.w3.org/2000/svg"> + diff --git a/helpers/DATA/firefox/default-strict.patch b/helpers/DATA/firefox/default-strict.patch index 393ea60..488f472 100644 --- a/helpers/DATA/firefox/default-strict.patch +++ b/helpers/DATA/firefox/default-strict.patch @@ -1,7 +1,8 @@ -diff -ru firefox-110.0+build1/browser/components/BrowserGlue.sys.mjs firefox-110.0+build1/browser/components/BrowserGlue.sys.mjs_fix ---- firefox-110.0+build1/browser/components/BrowserGlue.sys.mjs 2023-02-07 01:52:32.000000000 -0600 -+++ firefox-110.0+build1/browser/components/BrowserGlue.sys.mjs_fix 2023-02-07 14:52:59.465762604 -0600 -@@ -1637,6 +1637,19 @@ +diff --git a/browser/components/BrowserGlue.sys.mjs b/browser/components/BrowserGlue.sys.mjs +index 8fa6f7a..a34ab8b 100644 +--- a/browser/components/BrowserGlue.sys.mjs ++++ b/browser/components/BrowserGlue.sys.mjs +@@ -1860,6 +1860,19 @@ BrowserGlue.prototype = { } }); @@ -18,6 +19,6 @@ diff -ru firefox-110.0+build1/browser/components/BrowserGlue.sys.mjs firefox-110 + Services.prefs.setStringPref("browser.contentblocking.category", "strict"); this._updateCBCategory; + } + - // Offer to reset a user's profile if it hasn't been used for 60 days. - const OFFER_PROFILE_RESET_INTERVAL_MS = 60 * 24 * 60 * 60 * 1000; - let lastUse = Services.appinfo.replacedLockTime; + this._maybeOfferProfileReset(); + + this._checkForOldBuildUpdates(); diff --git a/helpers/DATA/firefox/patch_changes/Remove_Android_and_iOS_promotion.patch b/helpers/DATA/firefox/patch_changes/001-Remove_Android_and_iOS_promotion.patch similarity index 93% rename from helpers/DATA/firefox/patch_changes/Remove_Android_and_iOS_promotion.patch rename to helpers/DATA/firefox/patch_changes/001-Remove_Android_and_iOS_promotion.patch index 74524a7..08bca09 100644 --- a/helpers/DATA/firefox/patch_changes/Remove_Android_and_iOS_promotion.patch +++ b/helpers/DATA/firefox/patch_changes/001-Remove_Android_and_iOS_promotion.patch @@ -1,13 +1,14 @@ diff --git a/browser/components/preferences/sync.inc.xhtml b/browser/components/preferences/sync.inc.xhtml -index 7d37d26..4ebbc06 100644 +index 492491a3..0c8c462a 100644 --- a/browser/components/preferences/sync.inc.xhtml +++ b/browser/components/preferences/sync.inc.xhtml -@@ -35,22 +35,6 @@ +@@ -35,24 +35,6 @@ -