| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
The patches required for the 2014-12-09 Xorg CVE advisory would not
have been feasible to back-port to the 1.7 version of Xorg that we
were previously using to built against for EL5 and the generic
binaries. However, building the newer version of Xorg required
some fairly extensive re-tooling. In a nutshell, here's what was
done:
* The build is now done against Xorg X117R7, with all CVE patches
(taken from debian sources) applied. Note that this requires
updating various packages beyond the versions readily available
for EL5. This included things like automake, autoconf, libtool,
m4, and flex. Wherever possible, the EL6 rpm was used unaltered.
The most chalenging package to upgrade was libxml2, which was
necessary to supply the python26-libxml2 requirement from mesa.
* Mesa libGL is now supplied with the package, installed in the
%{_libdir}/tigervnc directory. The Xvnc binary is linked using
an rpath so that we always link against our version of libGL.
This was done to prevent linker errors with the generic binaries
in the case where the distro supplied libGL is built with
different options (in particular, kernel versions < 2.4.20 do
not support glx-tls, so the generic binaries would likely break
whenever used on newer distros that build libGL with glx-tls
turned on by default). Additionally, this allows swrast_dri.so
to be bundled without worrying about overwriting the distro
supplied library.
* A static libsha1 is built for Xorg to link against. The EL5
version of libgcrypt does not satisfy Xorg's requirements,
and linking against OpenSSL creates nearly a dozen runtime
dependencies.
|
