c.f. https://rustsec.org/advisories/RUSTSEC-2023-0020.html The last release of the "const-cstr" crate was on 2018-02-10. This is also the last day on which code changes happened in the project's git repo on GitHub. The project is now a read-only archive. The code has some issues that violate Rust soundness rules and can lead to panics when parsing untrusted data. The const_str and cstr crates are listed as possible alternatives. Reproducible: Always
The const-cstr crate dependency was dropped upstream in libblkio 1.3.0.
There is no Fedora libblkio 1.3.0 package yet because I was waiting for dependencies with the right version to become available in Fedora. I've moved this BZ back to ASSIGNED for now. Once libblkio 1.3.0 is packaged in Fedora this issue will be solved.
Since 1.3.0 has been shipped in Rawhide, can we close this now?
(In reply to Stefan Hajnoczi from comment #1) > The const-cstr crate dependency was dropped upstream in libblkio 1.3.0. It wasn't dropped from the spec file though: https://src.fedoraproject.org/rpms/libblkio/blob/rawhide/f/libblkio.spec#_45 Note that the %cargo_generate_buildrequires macro now supports workspaces, you should be able to use it instead of hard-coding the Rust dependencies.
Just for the sake of moving this bug along I did a scratch build which removes the const-cstr build dependency: https://koji.fedoraproject.org/koji/taskinfo?taskID=104829509 If successful I guess we should push this change, close the bug, and look at using %cargo_generate_buildrequires in future.
F40: https://koji.fedoraproject.org/koji/taskinfo?taskID=104830518 F39: https://koji.fedoraproject.org/koji/taskinfo?taskID=104830783
FEDORA-2023-fbe9134000 has been submitted as an update to Fedora 40. https://bodhi.fedoraproject.org/updates/FEDORA-2023-fbe9134000
FEDORA-2023-fbe9134000 has been pushed to the Fedora 40 stable repository. If problem still persists, please make note of it in this bug report.
FEDORA-2023-a39b6b6db7 has been submitted as an update to Fedora 39. https://bodhi.fedoraproject.org/updates/FEDORA-2023-a39b6b6db7
FEDORA-2023-a39b6b6db7 has been pushed to the Fedora 39 stable repository. If problem still persists, please make note of it in this bug report.