Per-Vendor Patch-Finding Information

This page lists how to find and extract patches from various open source-providing vendors, such as distributors of Linux, *BSD, and other related operating systems. See the general Vendor information page for details on where to find security announcements.

When adding to this page, please include the following vendor information:

1. how to find source packages for a given release
2. how to extract a patch from a given version of software

As well, please keep this list in alphabetical order.

• Package searching can be done via http://packages.altlinux.org/
• Source code for packages built from GEAR repositories:
  • http://git.altlinux.org/gears/<P>/<PACKAGE>.git
• Source code for packages built from source RPMs (automatically converted by gear-srpmimport):
  • http://git.altlinux.org/srpms/<P>/<PACKAGE>.git

• Package searching can be done via http://packages.debian.org/. Additionally, each version of a package is stored in the Debian wayback machine. It may take some time until security updates are available in either place—they can be downloaded directly from http://security.debian.org/debian-security/pool/updates/main/.
• Workflow to extract differences:
  • Download and unpack desired version, read “debian/changelog” for previous version number
  • Download previous version
  • Look for patches, using one of several methods:
    • “debian/changelog” may mention new patches to be found in “debian/patches”
    • use “debdiff” between the two ”.dsc” files to extract the delta between packages
    • gunzip the two “diff.gz” files, and use “interdiff” to extract the delta between packages
• Auto-extracted patches: http://patch-tracker.debian.org/.
• kernel issues are tracked in an svn repository with references to fixes in both debian and upstream releases
• List of packages embedding code from other projects is maintained in the secure-testing SVN repository and is linked to from the Debian Wiki
• Security tracker: http://security-tracker.debian.org/tracker/<CVE-id>

• Most patches for a given package can be found at http://git.exherbo.org/. Choose the repository, switch to the “tree” view and under packages/<category>/<package name>/files, you'll find any patches we apply.
• Some packages require lots of patches, in which case patchsets in the form of tarballs are provided. These are usually referenced inside the respective exheres in DOWNLOADS.

• cgit for dist-git repository containing .spec files and patches for all Fedora packages:
  • http://pkgs.fedoraproject.org/cgit/?p=<PACKAGE>.git
• Koji build system with all binary and source RPMs:
  • http://koji.fedoraproject.org/koji/search?match=glob&type=package&terms=<PACKAGE>
• Bodhi update system - all updates for given package in all current stable Fedora versions:
  • https://admin.fedoraproject.org/updates/<PACKAGE>

• gitweb for frugalware-current repository containing build scripts and patches for all Frugalware packages:
  • http://git.frugalware.org/gitweb/gitweb.cgi?p=frugalware-current.git;a=tree;f=source/<CATEGORY>/<PACKAGE>

• Most patches for a given package can be found in git: https://gitweb.gentoo.org/repo/gentoo.git/tree/<CATEGORY>/<PACKAGE>/files/
• Find exact category/package via https://packages.gentoo.org/ which also has direct links to gitweb.
• Some packages require lots of patches, in which case patchsets in the form of tarballs are provided. These are usually created using patches at
  • https://sources.gentoo.org/gentoo/src/patchsets/<PACKAGE>/<VERSION>/
  • A project repository on https://gitweb.gentoo.org/

• http://svn.mandriva.com/cgi-bin/viewvc.cgi/packages/updates/
• Workflow:
  • rpm2cpio fn.rpm | cpio –make-directories –extract

• WSL2 github repository: https://github.com/microsoft/WSL2-Linux-Kernel
• Azure Sphere, as well as any other sources are available at: https://3rdpartysource.microsoft.com/

• Access to product updates and fixes. (requires MontaVista account with a maintenance contract in place):https://support.mvista.com/
  • Pro 4.x, CGE 4.x, Mobilinux 4.1, Pro 5.0.24, CGE 5.1 and etc ( None MVL6 and cge 6 ).
    • Download updates using a web-browser or command line tool.

• MVL6 and CGE 6
  • Use the Montavista command-line tool

• Source code repository: http://www.openbsd.org/cgi-bin/cvsweb/
• Unofficial git mirror: http://anoncvs.estpak.ee/cgi-bin/cgit/
• Main source tree: 3rd party packages included in the main source tree have vendor branches allowing to extract local patches.
• Ports tree: patches are stored in patches sub-directory of each port. The majority of ports tree security fixes are applied to the -stable branch for the last release e.g. OPENBSD_5_0.

• Every advisory includes a list of new source-rpm (suffix: .src.rpm) files for example:
  • http://download.opensuse.org/pub/opensuse/update/10.3/rpm/src/postgresql-8.2.6-0.1.src.rpm

• Sources for openSUSE distribution:
  • Releases: http://download.opensuse.org/pub/opensuse/source/distribution/
  • Updates: http://download.opensuse.org/pub/opensuse/update/<VERSION>/rpm/src/
  • Factory (current development): http://download.opensuse.org/pub/opensuse/factory/repo/src-oss/suse/

• Sources for SUSE Linux Enterprise distributions (requires Novell account with a maintenance contract in place):
  • SLES 9 updates: https://you.novell.com/update/i386/update/SUSE-CORE/9/sources/
  • SLES 10 updates: (trying to find a good way -MarcusMeissner)

• CVE-to-Update mapping:
  • http://support.novell.com/security/cve/<CVE-id>.html

• Download this file using a web-browser or command-line tools like wget or curl.

• The patches are part of the source-rpm file and can be extracted by one of the following ways:
  • rpm2cpio postgresql-8.2.6-0.1.src.rpm | cpio –make-directories –extract
  • alien -t postgresql-8.2.6-0.1.src.rpm && tar xvzf postgresql-8.2.6.tgz

• CVSweb:
  • http://cvsweb.openwall.com/cgi/cvsweb.cgi/Owl/packages/
• anoncvs (also available over SSH):
  • cvs -z3 -d :pserver:anoncvs:anoncvs@anoncvs.owl.openwall.com:/cvs co Owl/packages
• native.tar.gz files (around 2 MB) are available off our FTP mirrors separately for each branch of Owl - these contain just our own stuff and patches to third-party software that we package (same as those available via CVSweb and anoncvs)

• Source PiSi packages (PiSi is the package manager of Pardus) for released updates are available on Pardus Repositories: http://packages.pardus.org.tr
  • For Devel (current development): http://packages.pardus.org.tr/info/devel/sources.html
  • For Pardus 2007: http://packages.pardus.org.tr/info/2007/sources.html

• Svn: http://svn.pardus.org.tr/pardus
  • Svn Web: http://svn.pardus.org.tr/viewcvs/?root=pardus

• Workflow:
  • Go to Devel repository for the latest update (Go to Pardus 2007 repository for updates to older versions or backports of the fix)
  • Browse to the package name and click
  • You can see all applied patches and release history at the end of the page. =====

• Package information including links to package sources can be found here: ftp://ftp.netbsd.org/pub/pkgsrc/current/pkgsrc/README.html
• Patches maintained against the upstream distributions are located in the patches subdirectory of each package
• CVS history of all packages can be browsed at http://cvsweb.netbsd.org/bsdweb.cgi/pkgsrc/

• Source RPMs of released updates are available via Red Hat FTP server or CentOS Git server:
  • Red Hat Enterprise Linux 7: https://git.centos.org/summary/?r=rpms/<PACKAGE>/
  • Red Hat Enterprise Linux 5 and 6: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/
  • Red Hat Enterprise Linux 2.1, 3 and 4:
    • releases: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/
    • updates: ftp://ftp.redhat.com/pub/redhat/linux/updates/enterprise/
• Advisories including full version numbers of fixed packages are mailed to the following mailing list:
  • https://www.redhat.com/archives/rhsa-announce/
• CVE-to-Errata mapping pages:
  • https://access.redhat.com/security/cve/<CVE-id>
• Bugs in Red Hat Bugzilla have CVE id set as an alias so it can be used for direct access:
  • https://bugzilla.redhat.com/show_bug.cgi?id=<CVE-id>
• Workflow:
  • rpm2cpio fn.rpm | cpio –make-directories –extract –preserve-modification-time

• Go to http://conary-commits.rpath.com/conary/
• Browse to the package name (click on the “source” link under the correct package)
• Choose the appropriate version. If you don't know the version, but want the latest version on a particular branch, choose the first link that contains that branch name.
• Click “show files”
• Click on a particular file to view its contents. Note that not all patches contained in the source are necessarily applied. To see which are applied, and under what conditions, look at the relevant addPatch() line in the recipe.

• Ubuntu generally maintains two versions of a given package for each release: original release and current update. (Superseded updates do not stay published, so only deltas between the “release” version and the most recently updated package version are available.)
  • Searching and files lists can be found via http://packages.ubuntu.com/.
  • Package histories can be found via Launchpad: https://launchpad.net/distros/ubuntu/+source/PKGNAME. Following a specific version link will show URLs for the “orig.tar.gz/diff.gz/dsc” files.
  • Extracted patches of packages: http://patches.ubuntu.com.
• Ubuntu Security Team CVE Tracker: http://people.canonical.com/~ubuntu-security/cve/?cve=<CVE-id> (Primary source)
• Ubuntu/Launchpad CVE tracker: https://bugs.launchpad.net/bugs/cve/<CVE-id> (Secondary source, does not contain all information Ubuntu Security Team uses to track issues)
• Workflow for extraction is the same as ”Debian” above.

• Access to product updates and fixes from Wind River Support portal. (requires Wind River account with a maintenance contract in place)
  • https://support.windriver.com/olsPortal/faces/basic/portal.jspx