From 781dc1edf7e85d19eab6c4b4d1e0ce5bc4e0b82f Mon Sep 17 00:00:00 2001
From: Daniel Hilst <392820+dhilst@users.noreply.github.com>
Date: Thu, 1 Oct 2026 11:41:39 -0300
Subject: [PATCH] fix(xcat-dep): openEuler ppc64le ships Net::DNS 1.40 with
 known CVEs

The openeuler-24.03-ppc64le catalog pins perl-Net-DNS-1.40-1.oe2403
from openEuler 24.03 LTS GA as a publisher input. That release has
CVE-2026-64193 and CVE-2026-64194. The GA srpm carries no fix, and
load_inputs accepts only GA rpms as publisher inputs.

Build perl-Net-DNS for this target from perl-Net-DNS/Net-DNS.spec,
the 1.57 release that rocky-10-riscv64-xcat already builds. The
catalog now declares perl-Net-DNS as an owner, load_inputs allows that
owner, and the manifest pins 1.57. The spec BuildRequires all resolve
from the openEuler 24.03 LTS OS repository.

Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
---
 lib/XCAT/NativeInputs.pm            |  2 +-
 openeuler/24.03-ppc64le.inputs.json | 22 +++++++++++-----------
 packages-manifest.conf              |  2 +-
 3 files changed, 13 insertions(+), 13 deletions(-)

diff --git a/lib/XCAT/NativeInputs.pm b/lib/XCAT/NativeInputs.pm
index 065c136..1f322e8 100644
--- a/lib/XCAT/NativeInputs.pm
+++ b/lib/XCAT/NativeInputs.pm
@@ -80,7 +80,7 @@ sub load_inputs {
         if ($type eq 'owner') {
             die "Unsupported native build owner '$name'\n" unless grep { $_ eq $name }
                 qw(goconserver grub2-xcat ipmitool-xcat syslinux-xcat xnba-undi xCAT-genesis-base
-                   perl-Crypt-Rijndael perl-Crypt-SSLeay perl-HTTP-Async perl-IO-Stty perl-Net-HTTPS-NB perl-Net-Telnet);
+                   perl-Crypt-Rijndael perl-Crypt-SSLeay perl-HTTP-Async perl-IO-Stty perl-Net-DNS perl-Net-HTTPS-NB perl-Net-Telnet);
         }
         if ($type ne 'publisher') {
             my $uid = $type eq 'owner' && ($name eq 'xnba-undi' || $name eq 'xCAT-genesis-base') ? 0 : 1000;
diff --git a/openeuler/24.03-ppc64le.inputs.json b/openeuler/24.03-ppc64le.inputs.json
index 8c0af3c..f8b0ae4 100644
--- a/openeuler/24.03-ppc64le.inputs.json
+++ b/openeuler/24.03-ppc64le.inputs.json
@@ -627,17 +627,6 @@
       "needs": [],
       "runtime": false
     },
-    {
-      "name": "perl-Net-DNS",
-      "type": "publisher",
-      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/everything/x86_64/Packages/perl-Net-DNS-1.40-1.oe2403.noarch.rpm",
-      "sha256": "c6d9932ccfaae2e515635b00204e86b5121516f5693d4fb345ae0d979bfbde23",
-      "outputs": [
-        "perl-Net-DNS"
-      ],
-      "needs": [],
-      "runtime": true
-    },
     {
       "name": "perl-Package-Generator",
       "type": "publisher",
@@ -1035,6 +1024,17 @@
       ],
       "build_uid": 1000
     },
+    {
+      "name": "perl-Net-DNS",
+      "type": "owner",
+      "outputs": [
+        "perl-Net-DNS"
+      ],
+      "needs": [
+        "procenv"
+      ],
+      "build_uid": 1000
+    },
     {
       "name": "ipmitool-xcat",
       "type": "owner",
diff --git a/packages-manifest.conf b/packages-manifest.conf
index 565d0cf..97dffa1 100644
--- a/packages-manifest.conf
+++ b/packages-manifest.conf
@@ -321,7 +321,7 @@ perl-Expect=1.35
 perl-HTML-Form=6.11
 perl-LWP-Protocol-https=6.10
 perl-Mail-Sender=0.903
-perl-Net-DNS=1.40
+perl-Net-DNS=1.57
 perl-DBD-Pg=3.18.0
 
 # [common] is NOT a build target. It describes the SHARED repository the OpenEmbedded Genesis