maint.mk: _sc_search_regexp, sc_vulnerable_makefile_CVE-2009-4029: fix

[gnulib.git] / ChangeLog

diff --git a/ChangeLog b/ChangeLog
index 785f92f..c3da46b 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,54 @@
+2012-07-09  Jim Meyering  <meyering@redhat.com>
+
+       maint.mk: _sc_search_regexp, sc_vulnerable_makefile_CVE-2009-4029: fix
+       Bugs in both of those conspired to make the
+       sc_vulnerable_makefile_CVE-2009-4029 rule 99% useless.
+       _sc_search_regexp's handling of non-empty $in_files would filter
+       out any offending file names.  sc_vulnerable_makefile_CVE-2009-4029's
+       choice of in_files value meant there would be no match in most
+       projects, due to the presence of two or more Makefile.in files.
+       * top/maint.mk (_sc_search_regexp) [in_vc_files,in_files]: Clarify.
+       Fix a bug in how a non-empty $$in_files was processed:
+       (sc_vulnerable_makefile_CVE-2009-4029): Fix erroneous use of in_files:
+       in spite of the name, it's a regexp, not a list of file names.
+
+2012-07-09  Paul Eggert  <eggert@cs.ucla.edu>
+
+       getloadavg, getopt: fix commentary re configure.in
+       Autoconf is deprecating the name 'configure.in', so change it to
+       to the new name 'configure.ac' in a couple of places.
+       * lib/getloadavg.c: configure.in -> configure.ac, in comment.
+       * m4/getopt.m4 (gl_GETOPT_IFELSE, gl_GETOPT_SUBSTITUTE_HEADER)
+       (gl_PREREQ_GETOPT): Remove obsolete commentary re Emacs configure.in.
+       Emacs has renamed it to configure.ac, and it no longer refers
+       to these macros anyway.
+
+       timespec: mark functions with const attributes
+       * lib/timespec.h (timespec_add, timespec_sub, dtotimespec):
+       Mark with _GL_ATTRIBUTE_CONST.
+
+2012-07-07  Ludovic Courtès  <ludo@gnu.org>
+
+       canonicalize[-lgpl]: handle "guessing" values when cross-building
+       * m4/canonicalize.m4 (gl_FUNC_CANONICALIZE_FILENAME_MODE)
+       (gl_CANONICALIZE_LGPL): Check whether $gl_cv_func_realpath_works
+       matches "*yes" instead of just "yes".  Regression introduced in commit
+       e0bcf6626cde8dad4bfbdc4045c744f0cd8b9e24.
+
+2012-07-07  Ludovic Courtès  <ludo@gnu.org>
+           Bruno Haible  <bruno@clisp.org>
+
+       canonicalize: make the right guess when cross-compiling to GNU
+       * m4/canonicalize.m4 (gl_FUNC_REALPATH_WORKS): Match also "gnu*" to
+       determine whether cross-compiling to glibc systems, so as to
+       include GNU/Hurd.
+
+2012-07-06  Paul Eggert  <eggert@cs.ucla.edu>
+
+       timespec-sub: avoid duplicate include
+       * lib/timespec-sub.c: Do not include <config.h> twice.
+       Reported by Juanma Barranquero.
+
 2012-07-06  Akim Demaille  <akim@lrde.epita.fr>
 
        bootstrap: use a more consistent error reporting scheme