www/mozilla (& consumers): add --enable-rust-simd to CONFIGURE_ARGS
from a larger diff by Leah Rowe, thanks !
this option has been turned on in upstream CI since #1261841 (but only
on x86/arm64), and allows to use simd acceleration in encoding functions
(and probably other features in rust crates..)
runtime-tested with seamonkey, firefox, firefox-esr & thunderbird on
amd64, and firefox on arm64. jca@ made sure MOZ_RUST_SIMD wasnt enabled
on riscv64.
since i'm bumping REVISION on all consumers, might aswell bump nss
dependency to 3.128.
relayctl: rename "empty" to "unavailable" in table status
The word empty suggested the table has no hosts configured. It really means
the table has no hosts currently up, so unavailable describes the state more
clearly.
OK kirill@
jujutsu: drop vendored fish completion
A user reported that bookmark and revision completions do not work in fish.
It turns out that the static completion we install in vendor_completion.d
gets in the way. jj has supported (experimental) dynamic completetions out
of the box since 0.24.0, which works without config for fish >=4.0.2
Users of fish 3 will need to "jj util completion | source" to install the
completions.
ok kn
rpki-client: split a large chunk of cms_parse_validate() into a helper
There is a huge messy part in the CMS validation code that deals with
things needing the SignerInfo (the OpenSSL version of it, that is).
All this stuff does not need cleanup at exit and is very long, boring
and meandering code which is concerned with requirements from RFC 6488
which are largely independent of the econtent validation and parsing.
So pull all this into a helper and pass in the few things we need.
The only info we want to retain is that the object is well-formed and
its signtime. Since we need to pass in the cert, we call the helper
after extraction and before validation of the signtime against the cert.
The main point is that cms_parse_validate() finally becomes somewhat
manageable in size.
ok job
Add proper program bound checks to the bpf engine
Introduce new bpf functions _bpf_lfilter and bpf_lfilter which properly
bound check the bpf program and ensure that no jump instruction goes
out of bound. The old bpf_filter and _bpf_filter functions pass a len of
zero and bypass the bound checks.
In the kernel bpf_mfilter now uses the bpf_program (which includes the len)
and by that all calls are bounded.
In userland pcap_offline_filter uses now bpf_lfilter and is bounded.
Direct calls to bpf_filter and _bpf_filter don't do bound checking and
should no longer be used. These functions will be removed from our libpcap
soon.
Fix for libpcap CVE-2026-31912.
Fix various minor things in our bpf implementation
In userland it is possible to call bpf_filter / pcap_offline_filter
with unverified bpf programs. Because of this harden bpf_filter further
by adding the following extra checks:
- Ensure that load and store operations to the scratch memory store are
always bound checked.
- Ensure that no division or modulo by zero is done.
- No longer do shift operations with a too large shift exponent. Instead
zero out the result.
- No longer call abort on unknown instructions when bpf_filter is run
in userland. Use the same return 0 as is already done in the kernel.
On top of this ensure that no unhandled instruction encoding makes it
through bpf_validate by using the same case handling as bpf_filter.
This are fixes for libpcap CVE-2026-0799, CVE-2026-6244, CVE-2026-6554,
CVE-2026-31911. None of the above CVEs are applicable to or kernel since
[2 lines not shown]
Import adwaita-xfce-icon-theme 0.0.4, from Chris Billington (thanks !)
Extension to Adwaita icon theme adding missing Xfce icons. This package
also makes Adwaita theme available to non-gnome desktops.
ok ajacoutot@
