From mboxrd@z Thu Jan 1 00:00:00 1970 Return-path: Received: from gallifrey.ext.pengutronix.de ([2001:67c:670:201:5054:ff:fe8d:eefb] helo=[IPv6:::1]) by metis.ext.pengutronix.de with esmtp (Exim 4.92) (envelope-from ) id 1krK0j-00089I-QM for rauc@pengutronix.de; Mon, 21 Dec 2020 13:09:57 +0100 Message-ID: <2b5c2f5e05fb3306aa208ee3c8d9db7f61c9c2ec.camel@pengutronix.de> From: Enrico =?ISO-8859-1?Q?J=F6rns?= Date: Mon, 21 Dec 2020 13:09:57 +0100 MIME-Version: 1.0 Subject: [RAUC] [ANNOUNCE] RAUC v1.5 released (includes fix for CVE-2020-25860) List-Id: RAUC Project - Discussion List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Errors-To: rauc-bounces@pengutronix.de Sender: "RAUC" To: rauc@pengutronix.de SGkgUkFVQyB1c2VycywKCnRvZGF5IGEgbmV3IFJBVUMgcmVsZWFzZSB3YXMgcHVibGlzaGVkIHRo YXQgeW91IHNob3VsZCBwYXkgYXR0ZW50aW9uIHRvCihldmVuIGlmIGl0IGlzIHJpZ2h0IGJlZm9y ZSBDaHJpc3RtYXMpLiBCZXNpZGVzIHNvbWUgb3RoZXIgbWlub3IgYnVnCmZpeGVzIGFuZCBlbmhh bmNlbWVudHMgaXRzIG1haW4gcHVycG9zZSBpcyB0byBwcm92aWRlIGEgZml4IGZvciB0aGUKdnVs bmVyYWJpbGl0eSBDVkUtMjAyMC0yNTg2MCB0aGF0IHdhcyBwdWJsaXNoZWQgdG9kYXk6Cmh0dHBz Oi8vY3ZlLm1pdHJlLm9yZy9jZ2ktYmluL2N2ZW5hbWUuY2dpP25hbWU9Q1ZFLTIwMjAtMjU4NjAK ClBsZWFzZSByZWFkIHRoZSBhZHZpc29yeSBjYXJlZnVsbHkgdG8gZXZhbHVhdGUgaWYgdGhpcyBh ZmZlY3RlcyB5b3VyCnN5c3RlbSBhbmQgdXBncmFkZSB0byBSQVVDIHYxLjUgaWYgbmVjZXNzYXJ5 OgpodHRwczovL2dpdGh1Yi5jb20vcmF1Yy9yYXVjL3NlY3VyaXR5L2Fkdmlzb3JpZXMvR0hTQS1j Z2YzLWg2Mmotdzl2dgoKQmVzaWRlIHRoZSBtaXRpZ2F0aW9uLCB0aGUgcmVsZWFzZSBhbHNvIGlu dHJvZHVjZXMgdGhlIG5ldyAidmVyaXR5IgpidW5kbGUgZm9ybWF0ICh0aGUgb2xkIGZvcm1hdCBp cyBub3cgY2FsbGVkICJwbGFpbiIpLiBUaGUgdmVyaXR5IGZvcm1hdAp3YXMgYWRkZWQgdG8gcHJl cGFyZSBmb3IgZnV0dXJlIHVzZSBjYXNlcyAoc3VjaCBhcyBuZXR3b3JrIHN0cmVhbWluZwphbmQg ZW5jcnlwdGlvbiksIGZvciBiZXR0ZXIgcGFyYWxsZWxpemF0aW9uIG9mIGluc3RhbGxhdGlvbiB3 aXRoIGhhc2gKdmVyaWZpY2F0aW9uIGFuZCB0byBkZXRlY3QgbW9kaWZpY2F0aW9uIG9mIHRoZSBi dW5kbGUgZHVyaW5nCmluc3RhbGxhdGlvbiAoQ1ZFLTIwMjAtMjU4NjApLiBUaGUgYnVuZGxlIGZv cm1hdCBpcyBkZXRlY3RlZCB3aGVuCnJlYWRpbmcgYSBidW5kbGUgYW5kIGNoZWNrZWQgYWdhaW5z dCB0aGUgc2V0IG9mIGFsbG93ZWQgZm9ybWF0cwpjb25maWd1cmVkIGluIHRoZSBzeXN0ZW0uY29u Zi4KCkFzIHRoZSBvbGQgcGxhaW4gZm9ybWF0IGRvZXMgbm90IG9mZmVyIHByb3RlY3Rpb24gYWdh aW5zdCBtb2RpZmljYXRpb24KZHVyaW5nIHRoZSBpbnN0YWxsYXRpb24gcHJvY2VzcywgUkFVQyBu b3cgdGFrZXMgb3duZXJzaGlwIG9mIHRoZSBidW5kbGUKZmlsZSwgcmVtb3ZlcyB3cml0ZSBwZXJt aXNzaW9ucyBhbmQgY2hlY2tzIGZvciBleGlzdGluZyBvcGVuIGZpbGUKZGVzY3JpcHRvcnMuIFRo aXMgaXMgaW50ZW5kZWQgYXMgYSBtaXRpZ2F0aW9uIHRvIHByb3RlY3QgYWdhaW5zdCBhCmNvbXBy b21pc2VkIHVwZGF0ZSBzZXJ2aWNlIHJ1bm5pbmcgYXMgYSBub24tcm9vdCB1c2VyLCB3aGljaCB3 b3VsZApvdGhlcndpc2UgYmUgYWJsZSB0byBtb2RpZnkgdGhlIGJ1bmRsZSBiZXR3ZWVuIHNpZ25h dHVyZSBjaGVjayBhbmQKYWN0dWFsIGJ1bmRsZSBpbnN0YWxsYXRpb24uCgpZb3UgY2FuIGZpbmQg YSBjb21wbGV0ZSBsaXN0IG9mIGFsbCAob3RoZXIpIGNoYW5nZXMgc2luY2UgdjEuNCBiZWxvdy4K CkFmdGVyIHRoZSBpbnRlZ3JhdGlvbiwgaXQgaXMgaW1wb3J0YW50IHRvIGNoZWNrIHRoYXQgdGhl IG5ldyBidW5kbGUKYWNjZXNzIHByb3RlY3Rpb24gaGFzIG5vIGZhbHNlIHBvc2l0aXZlcyB3aXRo IFJBVUMgMS41IG9uIHlvdXIgc3lzdGVtLgpPdGhlcndpc2UsIGFmdGVyIGEgc3VjY2Vzc2Z1bCB1 cGRhdGUgdG8gMS41LCBubyBmdXJ0aGVyIHVwZGF0ZXMgd291bGQKYmUgaW5zdGFsbGFibGUuCgpX ZSB3b3VsZCBhcHByZWNpYXRlIHlvdXIgZmVlZGJhY2sgb24gdGhlIG5ldyBmb3JtYXQgYW5kIHRo ZSBtaXRpZ2F0aW9uCmZpeC4gUGxlYXNlIGxldCB1cyBrbm93IGlmIHlvdSBlbmNvdW50ZXIgYW55 IHByb2JsZW1zIGR1cmluZyB1cGdyYWRpbmcKdG8gdjEuNS4KClNvIGZhciBmcm9tIG91ciBzaWRl LCBpdCB3YXMgYSBsb3Qgb2Ygd29yayBpbiB0aGUgbGFzdCB3ZWVrcywKdGh1cyB3ZSBub3cgd2lz aCB5b3UgYWxsIHJlbGF4aW5nIEhvbGlkYXlzIGFuZCBhIEhhcHB5IE5ldyBZZWFyIQpTdGF5IGhl YWx0aHkgYW5kIGRvIG5vdCBnbyBvdXRzaWRlIGlmIHlvdSBjYW4gdXBkYXRlIHJlbW90ZWx5LiA7 KQoKQmVzdCB3aXNoZXMgZnJvbSBUaGUgUkFVQyBUZWFtCgotLS0KCkNIQU5HRVM6IFJlbGVhc2Ug MS41IChyZWxlYXNlZCBEZWMgMTQsIDIwMjApCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09CgpOb3RlOgoKICBUaGlzIHZlcnNpb24gaW50cm9kdWNlcyB0aGUgbmV3 IGBgdmVyaXR5YGAgYnVuZGxlIGZvcm1hdCAodGhlIG9sZAogIGZvcm1hdCBpcyBub3cgY2FsbGVk IGBgcGxhaW5gYCkuCiAgVGhlIGBgdmVyaXR5YGAgZm9ybWF0IHdhcyBhZGRlZCB0byBwcmVwYXJl IGZvciBmdXR1cmUgdXNlIGNhc2VzIChzdWNoCiAgYXMgbmV0d29yayBzdHJlYW1pbmcgYW5kIGVu Y3J5cHRpb24pLCBmb3IgYmV0dGVyIHBhcmFsbGVsaXphdGlvbiBvZgogIGluc3RhbGxhdGlvbiB3 aXRoIGhhc2ggdmVyaWZpY2F0aW9uIGFuZCB0byBkZXRlY3QgbW9kaWZpY2F0aW9uIG9mIHRoZQog IGJ1bmRsZSBkdXJpbmcgaW5zdGFsbGF0aW9uIChDVkUtMjAyMC0yNTg2MCkuCiAgVGhlIGJ1bmRs ZSBmb3JtYXQgaXMgZGV0ZWN0ZWQgd2hlbiByZWFkaW5nIGEgYnVuZGxlIGFuZCBjaGVja2VkwqAK ICBhZ2FpbnN0IHRoZSBzZXQgb2YgYWxsb3dlZCBmb3JtYXRzIGNvbmZpZ3VyZWQgaW4gdGhlIHN5 c3RlbS5jb25mCiAgKHNlZSBodHRwczovL3JhdWMucmVhZHRoZWRvY3MuaW8vZW4vbGF0ZXN0L3Jl ZmVyZW5jZS5odG1sI3NlYy1yZWYtZm9ybWF0cykuCgogIEFzIHRoZSBvbGQgYGBwbGFpbmBgIGZv cm1hdCBkb2VzIG5vdCBvZmZlciBwcm90ZWN0aW9uIGFnYWluc3QKICBtb2RpZmljYXRpb24gZHVy aW5nIHRoZSBpbnN0YWxsYXRpb24gcHJvY2VzcywgUkFVQyBub3cgdGFrZXMgIMKgCiAgb3duZXJz aGlwIG9mIHRoZSBidW5kbGUgZmlsZSwgcmVtb3ZlcyB3cml0ZSBwZXJtaXNzaW9ucyBhbmQgY2hl Y2tzwqAKICBmb3IgZXhpc3Rpbmcgb3BlbiBmaWxlIGRlc2NyaXB0b3JzLgogIFRoaXMgaXMgaW50 ZW5kZWQgYXMgYSBtaXRpZ2F0aW9uIHRvIHByb3RlY3QgYWdhaW5zdCBhIGNvbXByb21pc2VkCiAg dXBkYXRlIHNlcnZpY2UgcnVubmluZyBhcyBhIG5vbi1yb290IHVzZXIsIHdoaWNoIHdvdWxkIG90 aGVyd2lzZSBiZQogIGFibGUgdG8gbW9kaWZ5IHRoZSBidW5kbGUgYmV0d2VlbiBzaWduYXR1cmUg Y2hlY2sgYW5kIGFjdHVhbCBidW5kbGUKICBpbnN0YWxsYXRpb24uCgogIFNlZSBodHRwczovL3Jh dWMucmVhZHRoZWRvY3MuaW8vZW4vbGF0ZXN0L2ludGVncmF0aW9uLmh0bWwjYnVuZGxlLWZvcm1h dC1taWdyYXRpb24KICBmb3IgbW9yZSBkZXRhaWxzIG9uIGhvdyB0byBzd2l0Y2ggdG8gdGhlIGBg dmVyaXR5YGAgZm9ybWF0LgoKRW5oYW5jZW1lbnRzCi0tLS0tLS0tLS0tLQoKKiBBZGQgc3VwcG9y dCBmb3IgdGhlIGBgdmVyaXR5YGAgYnVuZGxlIGZvcm1hdC4gU2VlIHRoZcKgwqDCoMKgCsKgIGh0 dHBzOi8vcmF1Yy5yZWFkdGhlZG9jcy5pby9lbi9sYXRlc3QvcmVmZXJlbmNlLmh0bWwjdmVyaXR5 LWZvcm1hdArCoCBmb3IgZGV0YWlscy4KKiBTdXBwb3J0IHJlc29sdmluZyB0aGUgYHJvb3Q9UEFS VExBQkVMPXh4eGAga2VybmVsIGNvbW1hbmQgbGluZcKgCsKgIG9wdGlvbi4gKGJ5IEdhw6tsIFBP UlRBWSkKKiBEaXNhYmxlIHRoZSB1bm5lY2Nlc3NhcnkgU01JTUVDYXBhYmlsaXRpZXMgaW5mb3Jt YXRpb24gaW4gdGhlIGJ1bmRsZQrCoCBzaWduYXR1cmUsIHNhdmluZyB+MTAwIGJ5dGVzLgoqIFJl bW92ZSByZWR1bmRhbnQgY2hlY2tzdW0gdmVyaWZpY2F0aW9uIGZvciBzb3VyY2UgaW1hZ2VzIGR1 cmluZ8KgCsKgIGluc3RhbGxhdGlvbi4gVGhlIFJBVUMgYnVuZGxlIGlzIGFscmVhZHkgdmVyaWZp ZWQgYXQgdGhpcyBwb2ludCwgc2/CoArCoCB0aGVyZSBpcyBubyBuZWVkIHRvIHZlcmlmeSB0aGUg Y2hlY2tzdW0gb2YgZWFjaCBmaWxlIGluZGl2aWR1YWxseS7CoArCoCAoYnkgQmFzdGlhbiBLcmF1 c2UpCgpTZWN1cml0eQotLS0tLS0tLQoKKiBUYWtlIG93bmVyc2hpcCBvZiBidW5kbGUgZmlsZXMg aWYgdGhleSBhcmUgbm90IG93bmVkIGJ5IHJvb3QgYW5kwqAKwqAgcmVtb3ZlIHdyaXRlIHBlcm1p c3Npb25zLiBUaGVuIGNoZWNrIHRoYXQgbm8gd3JpdGFibGUgZmlsZcKgCsKgIGRlc2NyaXB0b3Jz IGFyZSBvcGVuIGZvciB0aGUgYnVuZGxlIGZpbGUgKHVzaW5nIHRoZSBgYEZfU0VUTEVBU0VgYMKg CsKgIGZjbnRsKS4gVGhpcyBmaXhlcyBDVkUtMjAyMC0yNTg2MC4gU2VlIHRoZSBhZHZpc29yeSBm b3IgbW9yZSBkZXRhaWxzOgrCoCBodHRwczovL2dpdGh1Yi5jb20vcmF1Yy9yYXVjL3NlY3VyaXR5 L2Fkdmlzb3JpZXMvR0hTQS1jZ2YzLWg2Mmotdzl2dgoKTm90ZToKCsKgIFRoZSBodHRwczovL2dp dGh1Yi5jb20vcmF1Yy9yYXVjLTEuNS1pbnRlZ3JhdGlvbiByZXBvc2l0b3J5IGNvbnRhaW5zwqAK wqAgZXhhbXBsZXMgdG8gc2ltcGxpZnkgaW50ZWdyYXRpbmcgdGhlIFJBVUMgdXBkYXRlIGludG8g ZXhpc3RpbmfCoArCoCBwcm9qZWN0cy4KwqAgWW91IGNhbiBzdWJzY3JpYmUgdG8KwqAgaHR0cHM6 Ly9naXRodWIuY29tL3JhdWMvcmF1Yy0xLjUtaW50ZWdyYXRpb24vaXNzdWVzLzEgdG8KwqAgcmVj ZWl2ZSBub3RpZmljYXRpb25zIG9mIGltcG9ydGFudCB1cGRhdGVzIHRvIHRoaXMgcmVwb3NpdG9y eSBhbmQgb2YKwqAgaW50ZWdyYXRpb24gaW50byB0aGUgdXBzdHJlYW0gYnVpbGQgc3lzdGVtcy4K CkJ1ZyBmaXhlcwotLS0tLS0tLS0KCiogRml4IGluc3RhbGwgaGFuZGxlciBzZWxlY3Rpb24gZm9y ICouaW1nIGZpbGVzIGZvciBib290LSogc2xvdHMgd2hlbsKgCsKgIHVzZWQgd2l0aCBjYXN5bmMu IChieSBNYXJ0aW4gU2Nod2FuKQoqIEZpeCBjaGVja2luZyBmb3IgdW5rbm93biBrZXlzIGluIHRo ZSBzbG90IGNvbmZpZ3VyYXRpb24uCiogRml4IHNvbWUgY29ybmVyIGNhc2VzIHJlbGF0ZWQgdG8g c3RvcHBpbmcgdGhlIEQtQnVzIGRhZW1vbi4KKiBQcm9wYWdhdGUgZXJyb3IgaWYgdW5hYmxlIHRv IHNhdmUgbWFuaWZlc3QuIChieSBTdGVmYW4gV2FocmVuKQoqIEFwcGx5IGAtLWhhbmRsZXItYXJn c2Agb25seSBkdXJpbmcgaW5zdGFsbGF0aW9uIChhbmQgbm90IGR1cmluZ8KgCsKgIGJ1bmRsZSBj cmVhdGlvbikuCgpUZXN0aW5nCi0tLS0tLS0KCiogU2hpcCBgdGVzdC9taW5pbWFsLXRlc3QuY29u ZmAgdG8gZml4IHRlc3Rpbmcgd2hlbiBydW5uaW5nIGFzIHJvb3QuwqAKwqAgKGJ5IFV3ZSBLbGVp bmUtS8O2bmlnKQoqIEluY3JlYXNlIHVzYWdlIG9mIGdfYXV0b2ZyZWUvZ19hdXRvcHRyIGluIHRo ZSB0ZXN0IHN1aXRlLgoKQ29kZQotLS0tCgoqIFJlbW92ZSB1bnVzZWQgY29kZSBmb3Igc2lnbmVk IG1hbmlmZXN0cyAob3V0c2lkZSBvZiBhIGJ1bmRsZSkuCiogQWRkIEdfR05VQ19XQVJOX1VOVVNF RF9SRVNVTFQgdG8gbWFueSBmdW5jdGlvbnMuCgpEb2N1bWVudGF0aW9uCi0tLS0tLS0tLS0tLS0K CiogRml4IG11bHRpcGxlIHNtYWxsZXIgZXJyb3JzLiAoYnkgQ2hyaXN0b3BoIFN0ZWlnZXIsIENo cmlzdG9waGVywqAKwqAgT2JiYXJkIGFuZCBNaWNoYWVsIEhlaW1wb2xkKQoqIEltcHJvdmUgZG9j dW1lbnRhdGlvbiByZWxhdGVkIHRvIHUtYm9vdCBzY3JpcHRpbmcgYW5kIGVudmlyb25tZW50wqAK wqAgc3RvcmFnZS4KCkNvbnRyaWJ1dGlvbnMgZnJvbTogQmFzdGlhbiBLcmF1c2UsIENocmlzdG9w aCBTdGVpZ2VyLCBDaHJpc3RvcGhlcgpPYmJhcmQsIEVucmljbyBKw7ZybnMsIEdhw6tsIFBPUlRB WSwgSmFuIEzDvGJiZSwgTWFydGluIFNjaHdhbiwgTWljaGFlbApIZWltcG9sZCwgU3RlZmFuIFdh aHJlbiwgVXdlIEtsZWluZS1Lw7ZuaWcKCi0tIApQZW5ndXRyb25peCBlLksuwqDCoMKgwqDCoMKg wqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgfCBFbnJpY28gSsO2cm5z wqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqB8CkVtYmVkZGVkIExpbnV4IENvbnN1bHRp bmcgJiBTdXBwb3J0wqDCoMKgwqDCoMKgwqDCoHwgaHR0cHM6Ly93d3cucGVuZ3V0cm9uaXguZGUv IHwKU3RldWVyd2FsZGVyIFN0ci4gMjHCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKg wqDCoMKgwqDCoMKgfCBQaG9uZTogKzQ5LTUxMjEtMjA2OTE3LTE4MMKgwqB8CjMxMTM3IEhpbGRl c2hlaW0sIEdlcm1hbnnCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqB8IEZheDrC oMKgwqArNDktNTEyMS0yMDY5MTctOcKgwqDCoMKgfAoKCl9fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fClJBVUMgbWFpbGluZyBsaXN0Cg==