• Unable to apply errata EN-26:15 (OpenSSL)

    From dev@dev@nicolas-provost.fr to muc.lists.freebsd.stable on Thu Jun 11 14:55:02 2026
    From Newsgroup: muc.lists.freebsd.stable

    I'm trying to apply errata EN-26:15 on a 15.0 fresh tree, with all other erratas and advisories already applied except SA-26:35 (also OpenSSL related, which seems to depend on EN-26:15). Using patch --dry-run < ... I'm getting some errors when target file is "+++/dev/null" (first file concerned is crypto/openssl/util/check-format-commit.sh.orig). I checked the patch signature. Any idea ??



    --
    Posted automagically by a mail2news gateway at muc.de e.V.
    Please direct questions, flames, donations, etc. to news-admin@muc.de
    --- Synchronet 3.22a-Linux NewsLink 1.2
  • From Dave Cottlehuber@dch@FreeBSD.org to muc.lists.freebsd.stable on Fri Jun 12 09:17:36 2026
    From Newsgroup: muc.lists.freebsd.stable

    On Thu, 11 Jun 2026, at 12:55, dev@nicolas-provost.fr wrote:
    I'm trying to apply errata EN-26:15 on a 15.0 fresh tree, with all
    other erratas and advisories already applied except SA-26:35 (also
    OpenSSL related, which seems to depend on EN-26:15). Using patch
    --dry-run < ... I'm getting some errors when target file is
    "+++/dev/null" (first file concerned is crypto/openssl/util/check-format-commit.sh.orig). I checked the patch signature. Any idea ??

    Hi Nicolas

    I'm not sure how you fetched your tree but this is probably simplest
    using git these days and have all the patches nicely lined up for you
    in one lazy move.

    https://cgit.freebsd.org/src/log/?h=releng/15.0 shows a specific tag
    & branch, we can use this directly, thanks secteam@ !

    Assuming you want that in /usr/src:

    $ git clone --single-branch -b releng/15.0 https://git.freebsd.org/src.git /usr/src

    wrt your original issue, here's what I did to repro, I will follow this up.

    A+
    Dave

    ```
    $ fetch https://download.freebsd.org/releases/amd64/15.0-RELEASE/src.txz
    $ tar xzf src.txz -C /tmp
    $ cd /tmp/usr/src
    $ fetch https://security.FreeBSD.org/patches/EN-26:15/openssl-15.0.patch -o - | patch --dry-run
    ```

    Patching file crypto/openssl/tools/c_rehash.in using Plan A...
    Hunk #1 succeeded at 192.
    Hmm... The next patch looks like a unified diff to me...
    The text leading up to this was:
    --------------------------
    |--- crypto/openssl/util/check-format-commit.sh.orig
    |+++ /dev/null
    --------------------------
    File to patch:
    No file found--skip this patch? [y]
    Skipping patch...
    Hunk #1 ignored at 0.
    1 out of 1 hunks ignored
    Hmm... The next patch looks like a unified diff to me...
    The text leading up to this was:
    --------------------------
    |--- crypto/openssl/util/check-format-test-negatives.c.orig
    |+++ /dev/null
    --------------------------
    File to patch:
    No file found--skip this patch? [y]
    Skipping patch...
    Hunk #1 ignored at 0.
    1 out of 1 hunks ignored
    Hmm... The next patch looks like a unified diff to me...
    The text leading up to this was:
    --------------------------
    |--- crypto/openssl/util/check-format-test-positives.c.orig
    |+++ /dev/null
    --------------------------
    File to patch:
    No file found--skip this patch? [y]
    Skipping patch...
    patch: **** malformed patch at line 618620: */
    dch@o01 /t/u/src>


    --
    Posted automagically by a mail2news gateway at muc.de e.V.
    Please direct questions, flames, donations, etc. to news-admin@muc.de
    --- Synchronet 3.22a-Linux NewsLink 1.2
  • From freebsd@freebsd@oldach.net (Helge Oldach) to muc.lists.freebsd.stable on Fri Jun 12 19:11:01 2026
    From Newsgroup: muc.lists.freebsd.stable

    Dave Cottlehuber wrote on Fri, 12 Jun 2026 11:17:36 +0200 (CEST):
    $ git clone --single-branch -b releng/15.0 https://git.freebsd.org/src.git /usr/src

    At the risk of stating the obvious, the EN-26:15 patch is already included here.

    $ fetch https://security.FreeBSD.org/patches/EN-26:15/openssl-15.0.patch -o - | patch --dry-run

    patch: **** malformed patch at line 618620: */

    The patch is broken. Have a look at said line, you'll notice instantly.

    Kind regards
    Helge


    --
    Posted automagically by a mail2news gateway at muc.de e.V.
    Please direct questions, flames, donations, etc. to news-admin@muc.de
    --- Synchronet 3.22a-Linux NewsLink 1.2
  • From np@dev@nicolas-provost.fr to muc.lists.freebsd.stable on Fri Jun 12 20:55:30 2026
    From Newsgroup: muc.lists.freebsd.stable

    ------PQKG9TWHV7NKSX41AMZV4P875WPJJ9
    Content-Type: text/plain;
    charset=utf-8
    Content-Transfer-Encoding: quoted-printable

    I was surprised that even gpatch would not accept this 27mb-super-patch=2E

    As I'm using fossil and not git for my tree I did not try git-patch this t= ime=2E But it seems that its content can be produced by computing a diff be= tween tags freebsd-15=2E0-p9 and freebsd-15=2E0-p10=2E

    Ideally, OpenSSL should be updated more often, not only on CVE announces=
    =2E

    Another caveat is that EN-26:15 and SA-26:35, both OpenSSL-related, were p= ublished the same day=2E

    I know that most people are using git=2E But I got once again a source tre=
    e corrupted last week (llama=2Ecpp=2Egit) without git reporting any problem= =2E=2E so I tried a different way (src=2Etxz + all patches)=2E

    I understand that git-diff is the most easy way to update that thing, but =
    it is sad that we cannot use BSD tools or the tools of the base system to u= pdate our OS=2E

    Le 12 juin 2026 19:11:01 GMT+02:00, freebsd@oldach=2Enet a =C3=A9crit :
    Dave Cottlehuber wrote on Fri, 12 Jun 2026 11:17:36 +0200 (CEST):
    $ git clone --single-branch -b releng/15=2E0 https://git=2Efreebsd=2Eor= g/src=2Egit /usr/src

    At the risk of stating the obvious, the EN-26:15 patch is already include=
    d here=2E

    $ fetch https://security=2EFreeBSD=2Eorg/patches/EN-26:15/openssl-15=2E= 0=2Epatch -o - | patch --dry-run

    patch: **** malformed patch at line 618620: */

    The patch is broken=2E Have a look at said line, you'll notice instantly=
    =2E

    Kind regards
    Helge


    ------PQKG9TWHV7NKSX41AMZV4P875WPJJ9
    Content-Type: text/html;
    charset=utf-8
    Content-Transfer-Encoding: quoted-printable

    <html><head></head><body><div dir=3D"auto">I was surprised that even gpatch=
    would not accept this 27mb-super-patch=2E<br><br>As I'm using fossil and n=
    ot git for my tree I did not try git-patch this time=2E But it seems that i=
    ts content can be produced by computing a diff between tags=C2=A0 freebsd-1= 5=2E0-p9 and freebsd-15=2E0-p10=2E<br><br>Ideally, OpenSSL should be update=
    d more often, not only on CVE announces=2E<br><br>Another caveat is that EN= -26:15 and SA-26:35, both OpenSSL-related, were published the same day=2E<b= r><br>I know that most people are using git=2E But I got once again a sourc=
    e tree corrupted last week (llama=2Ecpp=2Egit) without git reporting any pr= oblem=2E=2E so I tried a different way (src=2Etxz + all patches)=2E<br><br>=
    I understand that git-diff is the most easy way to update that thing, but i=
    t is sad that we cannot use BSD tools or the tools of the base system to up= date our OS=2E</div><br><br><div class=3D"gmail_quote"><div dir=3D"auto">Le=
    12 juin 2026 19:11:01 GMT+02:00, freebsd@oldach=2Enet a =C3=A9crit :</div>= <blockquote class=3D"gmail_quote" style=3D"margin: 0pt 0pt 0pt 0=2E8ex; bor= der-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
    <pre class=3D"com-fsck-k9__plain-text-message-pre"><div dir=3D"auto">Dave = Cottlehuber wrote on Fri, 12 Jun 2026 11:17:36 +0200 (CEST):<br></div><bloc= kquote class=3D"gmail_quote" style=3D"margin-bottom: 1ex; --com-fsck-k9__bl= ockquote-default-border-color: #729fcf;"><div dir=3D"auto">$ git clone --si= ngle-branch -b releng/15=2E0 <a href=3D"https://git=2Efreebsd=2Eorg/src=2Eg= it">https://git=2Efreebsd=2Eorg/src=2Egit</a> /usr/src<br></div></blockquot= e><div dir=3D"auto"><br>At the risk of stating the obvious, the EN-26:15 pa= tch is already included here=2E<br><br></div><blockquote class=3D"gmail_quo= te" style=3D"margin-bottom: 1ex; --com-fsck-k9__blockquote-default-border-c= olor: #729fcf;"><div dir=3D"auto">$ fetch <a href=3D"https://security=2EFre= eBSD=2Eorg/patches/EN-26:15/openssl-15=2E0=2Epatch">https://security=2EFree= BSD=2Eorg/patches/EN-26:15/openssl-15=2E0=2Epatch</a> -o - | patch --dry-ru= n<br></div></blockquote><div dir=3D"auto"><br></div><blockquote class=3D"gm= ail_quote" style=3D"margin-bottom: 1ex; --com-fsck-k9__blockquote-default-b= order-color: #729fcf;"><div dir=3D"auto">patch: **** malformed patch at lin=
    e 618620: */<br></div></blockquote><div dir=3D"auto"><br>The patch is brok= en=2E Have a look at said line, you'll notice instantly=2E<br><br>Kind rega= rds<br>Helge<br><br></div></pre></blockquote></div></body></html> ------PQKG9TWHV7NKSX41AMZV4P875WPJJ9--



    --
    Posted automagically by a mail2news gateway at muc.de e.V.
    Please direct questions, flames, donations, etc. to news-admin@muc.de
    --- Synchronet 3.22a-Linux NewsLink 1.2
  • From Dave Cottlehuber@dch@FreeBSD.org to muc.lists.freebsd.stable on Sat Jun 20 00:38:30 2026
    From Newsgroup: muc.lists.freebsd.stable

    On Fri, 12 Jun 2026, at 09:17, Dave Cottlehuber wrote:
    On Thu, 11 Jun 2026, at 12:55, dev@nicolas-provost.fr wrote:
    I'm trying to apply errata EN-26:15 on a 15.0 fresh tree, with all
    other erratas and advisories already applied except SA-26:35 (also
    OpenSSL related, which seems to depend on EN-26:15). Using patch
    --dry-run < ... I'm getting some errors when target file is
    "+++/dev/null" (first file concerned is
    crypto/openssl/util/check-format-commit.sh.orig). I checked the patch
    signature. Any idea ??

    Hi Nicolas

    Thanks for reporting this, the corrupted patch has been corrected in

    https://cgit.freebsd.org/doc/commit/?id=f61aa6d878b0f589275da1c7ac30cf7bf44ae71c

    and available at https://www.freebsd.org/security/advisories/FreeBSD-EN-26:15.openssl.asc

    A+
    Dave


    --
    Posted automagically by a mail2news gateway at muc.de e.V.
    Please direct questions, flames, donations, etc. to news-admin@muc.de
    --- Synchronet 3.22a-Linux NewsLink 1.2