DANE: avoid info leak by checking TLSA dnssec before connecting to MX

[exim.git] / release-process / scripts / mk_exim_release

diff --git a/release-process/scripts/mk_exim_release b/release-process/scripts/mk_exim_release
index 17b034e4eba356972f47d256f0e728089bc5ca2e..6e4767bd27941ff0722daf0ebdb93064965e4c61 100755 (executable)
--- a/release-process/scripts/mk_exim_release
+++ b/release-process/scripts/mk_exim_release
@@ -24,12 +24,13 @@ sub get_and_check_version {
 
     # make sure this looks like a real release version
     # which should (currently) be 4.xx[.y] or 4.xx[.y]_RCx
-    unless ( $release =~ /^(?<release>(?<major>4\.\d\d)(?:\.(?<minor>\d+))?(?:_RC\d+)?)$/ ) {
+    unless ( $release =~ /^(?<release>(?<major>4\.\d\d)(?:\.(?<minor>\d+))?(?<rc>_RC\d+)?)$/ ) {
         croak "The given version number does not look right - $release";
     }
     $context->{release}  = $+{release};
     $context->{major} = $+{major};
     $context->{minor} = $+{minor};
+    $context->{candidatev} = $+{rc};
 
     ($context->{trelease} = $+{release}) =~ s/_RC\d+//;
 }
@@ -134,11 +135,18 @@ sub make_version_script {
     # Thus we've to provide the version.sh, based on the info we have
     # about the release. If reversion finds this, it doesn't try to find
     # it's own way to get a valid version number from the git.
+    #
+    # 4.89 series: the logic here did not handle _RC<N> thus breaking RC
+    # status in versions.  nb: candidatev in context should be same as $variant
+    # in local context.
+    my $stamp = $context->{minor} ? '_'.$context->{minor} : '';
+    $stamp .= $context->{candidatev} if $context->{candidatev};
+    #
     open(my $v, '>', 'version.sh') or die "Can't open '>version.sh' $!\n";
     print {$v} <<__;
 # initial version automatically generated from $0
 EXIM_RELEASE_VERSION=$context->{major}
-EXIM_VARIANT_VERSION=@{[$context->{minor}?'_'.$context->{minor}:'']}
+EXIM_VARIANT_VERSION=$stamp
 EXIM_COMPILE_NUMBER=0
 __
     close($v);
@@ -235,6 +243,7 @@ sub move_text_docs_into_pkg {
 
     # move generated documents from docbook stuff
     foreach my $file (qw/exim.8 spec.txt filter.txt/) {
+        die "Empty file \"$file\"\n" if -z File::Spec->catfile( $old_docdir, $file );
         move( File::Spec->catfile( $old_docdir, $file ), File::Spec->catfile( $new_docdir, $file ) );
     }
 
@@ -360,21 +369,36 @@ sub create_tar_files {
         }
     }
 
+    # We ideally do not want local system user information in release tarballs;
+    # those are artifacts of use of tar for backups and have no place in
+    # software release packaging; if someone extracts as root, then they should
+    # get sane file ownerships.
+    my $ownership = "";
+    if (`tar --help 2>&1` =~ /^\s*--owner=/m) {
+        $ownership .= " --owner=$context->{tar_perms}{user} --group=$context->{tar_perms}{group}";
+        # on this GNU tar, --numeric-owner works during creation too
+        $ownership .= " --numeric-owner";
+    }
+
+    # See also environment variables set in main, tuning compression levels
+    my @COMPRESSIONS = (
+        # compressors-dict-key, file-extension, flags-as-string
+        [ "gzip", "gz", "--gzip" ],
+        [ "bzip2", "bz2", "--bzip2" ],
+        [ "lzip", "lz", "--lzip" ],
+        [ "xz", "xz", "--xz" ],
+    );
+
     foreach my $dir ( glob( File::Spec->catdir( $pkgdirs, ( 'exim*-' . $context->{release} ) ) ) ) {
         my $dirname = ( File::Spec->splitdir($dir) )[-1];
-        if ($context->{compressors}{gzip}) {
-            print "Creating: ${pkgs}/${dirname}.tar.gz\n" if ($verbose || $debug);
-            system("$tar cf  ${pkgs}/${dirname}.tar.gz  --gzip  -C ${pkgdirs} ${dirname}")
-        }
-        if ($context->{compressors}{bzip2}) {
-            print "Creating: ${pkgs}/${dirname}.tar.bz2\n" if ($verbose || $debug);
-            system("$tar cf  ${pkgs}/${dirname}.tar.bz2 --bzip2 -C ${pkgdirs} ${dirname}")
-        }
-        if ($context->{compressors}{lzip}) {
-            print "Creating: ${pkgs}/${dirname}.tar.lz\n" if ($verbose || $debug);
-            system("$tar cf  ${pkgs}/${dirname}.tar.lz  --lzip  -C ${pkgdirs} ${dirname}")
+        foreach my $comp (@COMPRESSIONS) {
+            my ($compkey, $extension, $flags) = @{$comp};
+            next unless $context->{compressors}{$compkey};
+            print "Creating: ${pkgs}/${dirname}.tar.${extension}\n" if ($verbose || $debug);
+            system("$tar cf  ${pkgs}/${dirname}.tar.${extension} ${flags} ${ownership} -C ${pkgdirs} ${dirname}");
         }
     }
+
 }
 
 # ------------------------------------------------------------------
@@ -389,10 +413,15 @@ MAIN: {
         tmp_dir     => File::Temp->newdir(),
         webgen_base => "$FindBin::Bin/../../../exim-website",
         tar_cmd     => 'tar',
+        tar_perms   => {
+                user    => '0',
+                group   => '0',
+        },
         make_cmd    => 'make',
         compressors => {
                 gzip    => 1,
                 bzip2   => 1,
+                xz      => 1,
                 lzip    => 0,
         },
         build_docs   => 1,
@@ -401,6 +430,13 @@ MAIN: {
     my $delete;
     my $cleanup = 1;
     ##$ENV{'PATH'} = '/opt/local/bin:' . $ENV{'PATH'};
+    # We are creating files for mass distribution, so work harder to make smaller files.
+    $ENV{'GZIP'} = '-9';
+    $ENV{'BZIP2'} = '-9';
+    # xz documents minimum file sizes for levels higher than -6 to be useful and each
+    # requires more RAM on the decompressing system.  Exim tarball currently 24MiB so
+    # using -8.
+    $ENV{'XZ_DEFAULTS'} = '-8';
 
     GetOptions(
         'directory=s'   => \$context->{directory},