From e0503a5fa7ac6f74888ef4c34d8183a5b418b807 Mon Sep 17 00:00:00 2001 From: Kate Date: Wed, 8 Jul 2026 17:23:04 +0100 Subject: [PATCH] Release 2.5.2 --- CHANGES | 21 +++++++++++++++++++++ configure | 18 +++++++++--------- configure.ac | 2 +- master_changes.md | 12 ------------ opam-client.opam | 2 +- opam-core.opam | 2 +- opam-devel.opam | 2 +- opam-format.opam | 2 +- opam-installer.opam | 2 +- opam-repository.opam | 2 +- opam-solver.opam | 2 +- opam-state.opam | 2 +- 12 files changed, 39 insertions(+), 30 deletions(-) diff --git a/CHANGES b/CHANGES index c4dee4ef527..23ce5644ea7 100644 --- a/CHANGES +++ b/CHANGES @@ -3,6 +3,27 @@ repositories (changes that are automatically handled by the format upgrade tools are not marked). Those prefixed with "(+)" are new command/option (since 2.1.0~alpha2). +2.5.2: +* Fix a bug that allowed a package to install files anywhere on the system + using a symlink to an external directory without warning the user and + asking for their permission: CVE-2026-57825 / OSEC-2026-10. + [#7005 @NathanReb] +* Re-allow `..` in `.install` files, partially reverts 2.5.1's #6879 + [#7008 @kit-ty-kate - fix ocaml/dune#14393] +* Stop the installation process via .install file from creating unnecessary + intermediate directories for paths that contain `..` [#7015 @kit-ty-kate] +* Improve and extend the testsuite + [#6953 #7011 #7008 #7005 @NathanReb @rjbou @kit-ty-kate] +* API changes in `opam-core`: + * `OpamFilename.{,dir_}starts_with`: Fix a bug where `foo/bar` would be + considered a prefix of `foo/bar-baz` [#6953 @NathanReb - fix #6948] + * `OpamFilename.{,dir_}starts_with`: `/` and `\` are now equivalent on + Windows [#6953 @NathanReb] + * `OpamFilename.starts_with`: `starts_with "a/b" "a/b"` no longer returns + `true` [#6953 @NathanReb] + * `OpamSystem.real_path`: fix a bug where paths after a non existent + directory where not resolve [#7011 @kit-ty-kate - fix #7010] + 2.5.1: * Invalidate .install fields containing destination filepath trying to escape their scope [#6897 @kit-ty-kate - report by @andrew] * Fix a string injection from the depexts field to nix-build, when `os-family=nixos` [#6894 @RyanGibb] diff --git a/configure b/configure index ee2a8dff5fd..3b1f44c0c14 100755 --- a/configure +++ b/configure @@ -1,6 +1,6 @@ #! /bin/sh # Guess values for system-dependent variables and create Makefiles. -# Generated by GNU Autoconf 2.71 for opam 2.5.1. +# Generated by GNU Autoconf 2.71 for opam 2.5.2. # # # Copyright (C) 1992-1996, 1998-2017, 2020-2021 Free Software Foundation, @@ -609,8 +609,8 @@ MAKEFLAGS= # Identity of this package. PACKAGE_NAME='opam' PACKAGE_TARNAME='opam' -PACKAGE_VERSION='2.5.1' -PACKAGE_STRING='opam 2.5.1' +PACKAGE_VERSION='2.5.2' +PACKAGE_STRING='opam 2.5.2' PACKAGE_BUGREPORT='' PACKAGE_URL='' @@ -1301,7 +1301,7 @@ if test "$ac_init_help" = "long"; then # Omit some internal or obsolete options to make the list less imposing. # This message is too long to be a string in the A/UX 3.1 sh. cat <<_ACEOF -\`configure' configures opam 2.5.1 to adapt to many kinds of systems. +\`configure' configures opam 2.5.2 to adapt to many kinds of systems. Usage: $0 [OPTION]... [VAR=VALUE]... @@ -1363,7 +1363,7 @@ fi if test -n "$ac_init_help"; then case $ac_init_help in - short | recursive ) echo "Configuration of opam 2.5.1:";; + short | recursive ) echo "Configuration of opam 2.5.2:";; esac cat <<\_ACEOF @@ -1480,7 +1480,7 @@ fi test -n "$ac_init_help" && exit $ac_status if $ac_init_version; then cat <<\_ACEOF -opam configure 2.5.1 +opam configure 2.5.2 generated by GNU Autoconf 2.71 Copyright (C) 2021 Free Software Foundation, Inc. @@ -1597,7 +1597,7 @@ cat >config.log <<_ACEOF This file contains any messages produced by compilers while running configure, to aid debugging if configure makes a mistake. -It was created by opam $as_me 2.5.1, which was +It was created by opam $as_me 2.5.2, which was generated by GNU Autoconf 2.71. Invocation command line was $ $0$ac_configure_args_raw @@ -7666,7 +7666,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1 # report actual input values of CONFIG_FILES etc. instead of their # values after options handling. ac_log=" -This file was extended by opam $as_me 2.5.1, which was +This file was extended by opam $as_me 2.5.2, which was generated by GNU Autoconf 2.71. Invocation command line was CONFIG_FILES = $CONFIG_FILES @@ -7721,7 +7721,7 @@ ac_cs_config_escaped=`printf "%s\n" "$ac_cs_config" | sed "s/^ //; s/'/'\\\\\\\\ cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 ac_cs_config='$ac_cs_config_escaped' ac_cs_version="\\ -opam config.status 2.5.1 +opam config.status 2.5.2 configured by $0, generated by GNU Autoconf 2.71, with options \\"\$ac_cs_config\\" diff --git a/configure.ac b/configure.ac index 105cf0387e3..08cecacb0d4 100644 --- a/configure.ac +++ b/configure.ac @@ -1,5 +1,5 @@ dnl The line below must be formatted AC_INIT([opam],[VERSION]) with no extra spaces -AC_INIT([opam],[2.5.1]) +AC_INIT([opam],[2.5.2]) AC_COPYRIGHT(Copyright 2012-2019 OcamlPro SAS) AC_CONFIG_MACRO_DIR([m4]) diff --git a/master_changes.md b/master_changes.md index d85db4e4869..85d5aab9514 100644 --- a/master_changes.md +++ b/master_changes.md @@ -21,7 +21,6 @@ users) ## Config report ## Actions - * Stop the installation process via .install file from creating unnecessary intermediate directories for paths that contain `..` [#7015 @kit-ty-kate] ## Install @@ -100,16 +99,11 @@ users) ## Internal: Windows ## Test - * Add `opamUnit` as a basic unit test framework [#6953 @NathanReb] - * Add unit tests for `OpamFilename.starts_with` and `dir_starts_with` in `tests/lib/core` [#6953 @NathanReb] - * Add unit test for `OpamSystem.real_path` [#7011 @rjbou] ## Benchmarks ## Reftests ### Tests - * Add a test showing the behaviour of .install files containing destination filepath trying to escape their scope [#6897 #7008 @rjbou @kit-ty-kate] - * Add a test ensuring installing files through a .install file can't escape the opam switch (CVE-2026-57825) [#7005 @NathanReb] ### Engine @@ -118,8 +112,6 @@ users) ## Doc ## Security fixes - * Invalidate .install fields containing absolute destination filepath except when in the `misc` field [#6897 #7008 @kit-ty-kate] - * Fix a bug that allowed a package to install files anywhere on the system using a symlink to an external directory without warning the user and asking for their permission: CVE-2026-57825. [#7005 @NathanReb] # API updates ## opam-client @@ -133,7 +125,3 @@ users) ## opam-format ## opam-core - * `OpamFilename.{,dir_}starts_with`: Fix a bug where `foo/bar` would be considered a prefix of `foo/bar-baz` [#6953 @NathanReb - fix #6948] - * `OpamFilename.{,dir_}starts_with`: `/` and `\` are now equivalent on Windows [#6953 @NathanReb] - * `OpamFilename.starts_with`: `starts_with "a/b" "a/b"` no longer returns `true` [#6953 @NathanReb] - * `OpamSystem.real_path`: fix a bug where paths after a non existent directory where not resolve [#7011 @kit-ty-kate - fix #7010] diff --git a/opam-client.opam b/opam-client.opam index f6bed14225d..aec335568aa 100644 --- a/opam-client.opam +++ b/opam-client.opam @@ -1,5 +1,5 @@ opam-version: "2.0" -version: "2.5.1" +version: "2.5.2" synopsis: "Client library for opam 2.5" description: """ Actions on the opam root, switches, installations, and front-end. diff --git a/opam-core.opam b/opam-core.opam index da7322a29f7..58027035548 100644 --- a/opam-core.opam +++ b/opam-core.opam @@ -1,5 +1,5 @@ opam-version: "2.0" -version: "2.5.1" +version: "2.5.2" synopsis: "Core library for opam 2.5" description: "Small standard library extensions, and generic system interaction modules used by opam." diff --git a/opam-devel.opam b/opam-devel.opam index 9deaddc1e79..d3a6c6b695c 100644 --- a/opam-devel.opam +++ b/opam-devel.opam @@ -1,5 +1,5 @@ opam-version: "2.0" -version: "2.5.1" +version: "2.5.2" synopsis: "Bootstrapped development binary for opam 2.5" description: """ This package compiles (bootstraps) opam. For consistency and safety of the installation, the binaries are not installed into the PATH, but into lib/opam-devel, from where the user can manually install them system-wide. diff --git a/opam-format.opam b/opam-format.opam index e5484bd7a36..b51dce3a58c 100644 --- a/opam-format.opam +++ b/opam-format.opam @@ -1,5 +1,5 @@ opam-version: "2.0" -version: "2.5.1" +version: "2.5.2" synopsis: "Format library for opam 2.5" description: """ Definition of opam datastructures and its file interface. diff --git a/opam-installer.opam b/opam-installer.opam index 97871508dae..fe9c945e8e4 100644 --- a/opam-installer.opam +++ b/opam-installer.opam @@ -1,5 +1,5 @@ opam-version: "2.0" -version: "2.5.1" +version: "2.5.2" synopsis: "Installation of files to a prefix, following opam conventions" description: """ opam-installer is a small tool that can read *.install files, as defined by opam [1], and execute them to install or remove package files without going through opam. diff --git a/opam-repository.opam b/opam-repository.opam index 4490d4aa38e..491711f3a1b 100644 --- a/opam-repository.opam +++ b/opam-repository.opam @@ -1,5 +1,5 @@ opam-version: "2.0" -version: "2.5.1" +version: "2.5.2" synopsis: "Repository library for opam 2.5" description: """ This library includes repository and remote sources handling, including curl/wget, rsync, git, mercurial, darcs backends. diff --git a/opam-solver.opam b/opam-solver.opam index 4b05fb037cb..8fad45ea74c 100644 --- a/opam-solver.opam +++ b/opam-solver.opam @@ -1,5 +1,5 @@ opam-version: "2.0" -version: "2.5.1" +version: "2.5.2" synopsis: "Solver library for opam 2.5" description: """ Solver and Cudf interaction. This library is based on the Cudf and Dose libraries, and handles calls to the external solver from opam. diff --git a/opam-state.opam b/opam-state.opam index 76b03b48f87..2f1bfdf2650 100644 --- a/opam-state.opam +++ b/opam-state.opam @@ -1,5 +1,5 @@ opam-version: "2.0" -version: "2.5.1" +version: "2.5.2" synopsis: "State library for opam 2.5" description: """ Handling of the ~/.opam hierarchy, repository and switch states.