Per-Vendor Patch-Finding Information

This page lists how to find and extract patches from various open source-providing vendors, such as distributors of Linux, *BSD, and other related operating systems. See the general Vendor information page for details on where to find security announcements.

When adding to this page, please include the following vendor information:

1. how to find source packages for a given release
2. how to extract a patch from a given version of software

As well, please keep this list in alphabetical order.

• Package searching can be done via http://packages.debian.org/. Additionally, each version of a package is stored in the Debian Source Snapshots.
• Workflow to extract differences:
  • Download and unpack desired version, read “debian/changelog” for previous version number
  • Download previous version
  • Look for patches, using one of several methods:
    • “debian/changelog” may mention new patches to be found in “debian/patches”
    • use “debdiff” between the two ”.dsc” files to extract the delta between packages
    • gunzip the two “diff.gz” files, and use “interdiff” to extract the delta between packages
• Auto-extracted patches: http://patch-tracking.debian.net/.
• kernel issues are tracked in an svn repository with references to fixes in both debian and upstream releases

• ViewCVS:
  • http://cvs.fedoraproject.org/viewcvs/rpms/<PACKAGE>

• Most patches for a given package can be found at http://sources.gentoo.org/<CATEGORY>/<PACKAGE>/files/
• Some packages require lots of patches, in which case patchsets in the form of tarballs are provided. These are usually created using patches at
  • http://sources.gentoo.org/gentoo/src/patchsets/<PACKAGE>/<VERSION>/
  • http://overlays.gentoo.org/<PROJECT>

• http://svn.mandriva.com/cgi-bin/viewvc.cgi/packages/updates/
• Workflow:
  • rpm2cpio fn.rpm | cpio –make-directories –extract

• Source code repository: http://www.openbsd.org/cgi-bin/cvsweb
• Main source tree: 3rd party packages included in the main source tree have vendor branches allowing to extract local patches.
• Ports tree: patches are stored in patches sub-directory of each port.

• Every advisory includes a list of new source-rpm (suffix: .src.rpm) files for example:
  • http://download.opensuse.org/pub/opensuse/update/10.3/rpm/src/postgresql-8.2.6-0.1.src.rpm
• Sources by SUSE distribution:
  • Factory (current development): http://download.opensuse.org/distribution/SL-OSS-factory/inst-source/suse/src/
  • openSUSE 10.3 updates: http://download.opensuse.org/pub/opensuse/update/10.3/rpm/src/
  • openSUSE 10.2 updates: ftp://ftp.suse.com/pub/suse/update/10.2/rpm/src/
  • SUSE Linux 10.1 updates: ftp://ftp.suse.com/pub/suse/update/10.1/rpm/src/

• Sources for SUSE Linux Enterprise distributions (requires Novell account with a maintenance contract in place):
  • SLES 9 updates: https://you.novell.com/update/i386/update/SUSE-CORE/9/sources/
  • SLES 10 updates: (trying to find a good way -MarcusMeissner)

• Download this file using a web-browser or command-line tools like wget or curl.
• The patches are part of the source-rpm file and can be extracted by one of the following ways:
  • rpm2cpio postgresql-8.2.6-0.1.src.rpm | cpio –make-directories –extract
  • alien -t postgresql-8.2.6-0.1.src.rpm && tar xvzf postgresql-8.2.6.tgz

• CVSweb:
  • http://cvsweb.openwall.com/cgi/cvsweb.cgi/Owl/packages/
• anoncvs (also available over SSH):
  • cvs -z3 -d :pserver:anoncvs:anoncvs@anoncvs.owl.openwall.com:/cvs co Owl/packages
• native.tar.gz files (around 2 MB) are available off our FTP mirrors separately for each branch of Owl - these contain just our own stuff and patches to third-party software that we package (same as those available via CVSweb and anoncvs)

• Source PiSi packages (PiSi is the package manager of Pardus) for released updates are available on Pardus Repositories: http://packages.pardus.org.tr
  • For Devel (current development): http://packages.pardus.org.tr/info/devel/sources.html
  • For Pardus 2007: http://packages.pardus.org.tr/info/2007/sources.html

• Svn: http://svn.pardus.org.tr/pardus
  • Svn Web: http://svn.pardus.org.tr/viewcvs/?root=pardus

• Workflow:
  • Go to Devel repository for the latest update (Go to Pardus 2007 repository for updates to older versions or backports of the fix)
  • Browse to the package name and click
  • You can see all applied patches and release history at the end of the page.

• Source RPMs for released updates are available on Red Hat FTP server: ftp://ftp.redhat.com/pub/redhat/linux/
  • GA versions and updates for RHEL5: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/
  • Updates for RHEL2.1 - RHEL4: ftp://ftp.redhat.com/pub/redhat/linux/updates/enterprise/
• Direct links to SRPMs can be found in advisories sent to the following mailing lists:
  • http://www.redhat.com/archives/rhsa-announce/ (all products, only as of November 2007)
  • http://www.redhat.com/archives/enterprise-watch-list/ (current and past advisories)
• Workflow:
  • rpm2cpio fn.rpm | cpio –make-directories –extract –preserve-modification-time

• Go to http://conary-commits.rpath.com/conary/
• Browse to the package name (click on the “source” link under the correct package)
• Choose the appropriate version. If you don't know the version, but want the latest version on a particular branch, choose the first link that contains that branch name.
• Click “show files”
• Click on a particular file to view its contents. Note that not all patches contained in the source are necessarily applied. To see which are applied, and under what conditions, look at the relevant addPatch() line in the recipe.

• Ubuntu generally maintains two versions of a given package for each release: original release and current update. (Superseded updates do not stay published, so only deltas between the “release” version and the most recently updated package version are available.)
  • Searching and files lists can be found via http://packages.ubuntu.com/.
  • Package histories can be found via Launchpad: https://launchpad.net/distros/ubuntu/+source/PKGNAME. Following a specific version link will show URLs for the “orig.tar.gz/diff.gz/dsc” files.
  • Extracted patches of packages: http://patches.ubuntu.com.
• Workflow for extraction is the same as ”Debian” above.