Commit Graph

2 Commits

Author SHA1 Message Date
Shilong Liu
4280a2365d
[CG-Fix-CVE-2021-44906] Patching on thrift.0.14.1 for package minimist (#10555) (#10650)
* [CG-Fix-CVE-2021-44906] Patching on thrift.0.14.1 for package minimist

Signed-off-by: richardyu-ms <richard.yu@microsoft.com>

* add more information in patch

Signed-off-by: richardyu-ms <richard.yu@microsoft.com>

* Update 0003-Remove-minimist-packages.patch

* change the thrift 0.14.1 to package download

Signed-off-by: richardyu-ms <richard.yu@microsoft.com>

* use the series file for patching

* fix a code defect

Co-authored-by: Richard.Yu <richard.yu@microsoft.com>
2022-04-23 13:55:52 +08:00
Yang Wang
bb743fa156
[202111]Bump Thrift version from 0.13.0 to 0.14.1 and typo fixed (#10528)
* Bump Thrift version from 0.13.0 to 0.14.1 (#9881)

#### Why I did it
To bump the Thrift version to 0.14.1 
- To avoid [CVE-2020-13949](https://nvd.nist.gov/vuln/detail/CVE-2020-13949) 
- to fix some dependencies issues

#### How I did it
- rename `src/thrfit_0_13_0` to `src/thrift_2` to remove version number in the path. (`src/thrift` contains rules to build thrift 0.11.0  )
- Add thrift sources as submodule as there are no prepared debian packages for version >0.13.0 on [debian.org](https://packages.debian.org/search?searchon=sourcenames&keywords=thrift)
- Added patches with fixes for original thrift debian rules:(remove unneeded packages, fix multi job build)
#### How to verify it
```
BLDENV=buster make -f Makefile.work target/debs/buster/libthrift-dev_0.14.1_amd64.deb
```

* Correct thrift 0141 typo fix (#10199)

Correct libsaithrift dependency package name from
LIBTHRIFT_DEV_0_14_1 THRIFT_COMPILER_0_14_1 to
LIBTHRIFT_0_14_1_DEV THRIFT_0_14_1_COMPILER

How I did it
How to verify it
Test Done:

make BLDENV=buster SAITHRIFT_V2=y -f Makefile.work target/debs/buster/saiserverv2_0.9.4_amd64.deb

Co-authored-by: Myron Sosyak <myronx.sosyak@intel.com>
2022-04-12 16:21:24 +08:00