{"bugs":[{"bugid":971264,"firstseen":"2026-03-16T17:53:46.930413","severity":"normal","status":"IN_PROGRESS","summary":"<www-servers\/vinyl-cache-8.0.1: Varnish Cache absolute form parsing deficiency (CVE-2026-34475)"},{"bugid":971753,"firstseen":"2026-03-29T21:02:50.919164","severity":"normal","status":"IN_PROGRESS","summary":">=www-servers\/vinyl-cache-9.0.0: mask selinux until sec-policy\/selinux-varnishd updated"}],"categories":[{"categoryid":1490,"name":"acct-group","summary":"The acct-group category contains packages for system groups."},{"categoryid":1491,"name":"acct-user","summary":"The acct-user category contains packages for system users."},{"categoryid":1486,"name":"app-metrics","summary":"The app-metrics category contains software generating, transforming or consuming application, service and system metrics."},{"categoryid":450,"name":"dev-lang","summary":"The dev-lang category contains various programming language implementations and related tools."},{"categoryid":393,"name":"dev-libs","summary":"The dev-libs category contains various miscellaneous programming libraries."},{"categoryid":336,"name":"dev-python","summary":"The dev-python category contains packages whose primary purpose is to provide Python modules, extensions and bindings, as well as tools and utilities useful for development in the Python programming language."},{"categoryid":441,"name":"sec-policy","summary":"The sec-policy category contains security policies for access control systems such as SELinux."},{"categoryid":380,"name":"sys-devel","summary":"The sys-devel category contains various core system development tools and libraries."},{"categoryid":381,"name":"sys-libs","summary":"The sys-libs category contains various system-level libraries."},{"categoryid":396,"name":"virtual","summary":"The virtual category contains packages which satisfy virtual dependencies."},{"categoryid":379,"name":"www-servers","summary":"The www-servers category contains web server packages."}],"changelog":[{"authoremail":"repomirrorci@gentoo.org","authorname":"Repository mirror & CI","commitid":"d7303360a7aeb09f3292b591692c149cae26d921","committime":"2026-04-01T12:45:54","packageid":78886,"repoid":1,"summary":"Merge updates from master"},{"authoremail":"bacs@librecast.net","authorname":"Brett A C Sheffield","body":"This fix was applied to 8.0.1 but wasn't carried forward to 9.0.0.\n\ne655150e9eb8 (\"www-servers\/varnish: fix python shebang once\")\n\nWe call fix-python-shebangs in src_prepare as some python programs are\nused during configure (wflags.py) and build.\n\nWe skip vmodtool.py as this gets handled later in src_install by\npython_replicate_script.\n\nBug: https:\/\/bugs.gentoo.org\/971373\nCloses: https:\/\/bugs.gentoo.org\/971848\nFixes: 629470dfcf6579213ebeb53ca0adfbe643de692b\nSigned-off-by: Brett A C Sheffield <bacs@librecast.net>\nPart-of: https:\/\/codeberg.org\/gentoo\/gentoo\/pulls\/478\nMerges: https:\/\/codeberg.org\/gentoo\/gentoo\/pulls\/478\nSigned-off-by: Sam James <sam@gentoo.org>","commitid":"0dae1b505a1491a487caf33fbe97b8247711627b","committime":"2026-04-01T07:54:58","packageid":78886,"repoid":1,"summary":"www-servers\/vinyl-cache: apply shebang fix to 9.0.0"},{"authoremail":"repomirrorci@gentoo.org","authorname":"Repository mirror & CI","commitid":"cb1e1ea48ba87ecf00806bfa664b4bc6ff6c110d","committime":"2026-03-31T16:31:01","packageid":78886,"repoid":1,"summary":"Merge updates from master"},{"authoremail":"bacs@librecast.net","authorname":"Brett A C Sheffield","body":"9.0.0 is the first release with the name change to vinyl-cache. All\nbinary names, directory paths, user and group etc. have changed.\n\nLink: https:\/\/vinyl-cache.org\/docs\/9.0\/whats-new\/upgrading-9.0.html\nSigned-off-by: Brett A C Sheffield <bacs@librecast.net>\nPart-of: https:\/\/codeberg.org\/gentoo\/gentoo\/pulls\/462\nSigned-off-by: Sam James <sam@gentoo.org>","commitid":"629470dfcf6579213ebeb53ca0adfbe643de692b","committime":"2026-03-17T16:08:20","packageid":78886,"repoid":1,"summary":"www-servers\/vinyl-cache: add 9.0.0"},{"authoremail":"bacs@librecast.net","authorname":"Brett A C Sheffield","body":"Varnish has changed name to Vinyl Cache.\n\nBug: https:\/\/bugs.gentoo.org\/964042\nLink: https:\/\/vinyl-cache.org\/docs\/9.0\/whats-new\/upgrading-9.0.html#name-change\nSigned-off-by: Brett A C Sheffield <bacs@librecast.net>\nPart-of: https:\/\/codeberg.org\/gentoo\/gentoo\/pulls\/462\nSigned-off-by: Sam James <sam@gentoo.org>","commitid":"679937b4f62cf2943ea2d7da87e75a657b1007b9","committime":"2026-03-17T14:46:31","packageid":78886,"repoid":1,"summary":"www-servers\/vinyl-cache: rename www-servers\/varnish"}],"dependencies":[{"block":false,"categoryid":381,"description":"Console display library","ebuildids":[894004,894005,894006],"firstseen":"2010-05-04T00:54:45.661860","maintainer":"base-system@gentoo.org","maintainername":"Gentoo Base System","name":"ncurses","packageid":45285},{"block":false,"categoryid":336,"description":"Python documentation generator","ebuildids":[894004,894005,894006],"firstseen":"2010-05-04T00:54:45.661860","maintainer":"python@gentoo.org","maintainername":"Python","name":"sphinx","packageid":46924,"summary":"Sphinx is a tool to create documentation for Python projects (or other documents consisting of multiple reStructuredText sources)."},{"block":false,"categoryid":381,"description":"Portable and efficient API to determine the call-chain of a program","ebuildids":[894004,894005,894006],"firstseen":"2010-05-04T00:54:45.661860","maintainer":"toolchain@gentoo.org","maintainername":"Gentoo Toolchain Project","name":"libunwind","packageid":47245},{"block":false,"categoryid":336,"description":"Python Documentation Utilities (reference reStructuredText impl.)","ebuildids":[894004,894005,894006],"firstseen":"2010-05-04T00:54:45.661860","maintainer":"python@gentoo.org","maintainername":"Python","name":"docutils","packageid":49200},{"block":false,"categoryid":381,"description":"Another cute console display library","ebuildids":[894004,894005,894006],"firstseen":"2010-05-04T00:54:45.661860","maintainer":"base-system@gentoo.org","maintainername":"Gentoo Base System","name":"readline","packageid":53265},{"block":false,"categoryid":393,"description":"BSD replacement for libreadline","ebuildids":[894004,894005,894006],"firstseen":"2010-05-04T00:54:45.661860","maintainer":"bsd@gentoo.org","maintainername":"BSD Project","name":"libedit","packageid":53869,"summary":"GNU Readline is cool, but BSD Readline is cooler :) Thus here is libedit by the NetBSD folks! The glibc\/bsdlibc stuff comes from the debian tarball, thanks to them too :) The patch is handcrafted with a few ideas from libedit.sf.net and a few ideas from the debian package. This patch aims to be as small as possible (so as to make future cvs snapshots cake)."},{"block":false,"categoryid":393,"description":"Jemalloc is a general-purpose scalable concurrent allocator","ebuildids":[894004],"firstseen":"2010-12-31T14:39:17.540839","maintainer":"mozilla@gentoo.org","maintainername":"Gentoo Mozilla Team","name":"jemalloc","packageid":56647},{"block":false,"categoryid":396,"description":"Virtual for the pkg-config implementation","ebuildids":[894004,894005,894006],"firstseen":"2012-05-02T14:36:48.197227","maintainer":"freedesktop-bugs@gentoo.org","maintainername":"Gentoo Freedesktop Project","name":"pkgconfig","packageid":59221},{"block":false,"categoryid":393,"description":"Perl-compatible regular expression library","ebuildids":[894004,894005,894006],"firstseen":"2016-08-15T13:37:20.779690","name":"libpcre2","packageid":65707}],"depending":[{"block":false,"categoryid":1486,"description":"Collects system statistics and provides mechanisms to store the values","ebuildids":[870745,870745],"firstseen":"2018-04-04T02:24:53.667663","name":"collectd","packageid":69063,"summary":"Collectd gathers statistics about the system it is running on and stores this information. Those statistics can then be used to find current performance bottlenecks (i.e. performance analysis) and predict future system load (i.e. capacity planning). Or if you just want pretty graphs of your private server and are fed up with some homegrown solution you're at the right place."}],"ebuilds":[{"archs":["~amd64","~arm","~arm64","~ppc","~ppc64","~riscv","~x86"],"ebuildid":894006,"firstseen":"2026-03-31T17:36:19.176049","license":"BSD-2 GPL-2","moddate":"2026-04-01T13:02:02","packageid":78886,"repoid":1,"slot":"0\/9","uses":["jit","python_targets_python3_11","python_targets_python3_12","python_targets_python3_13","python_targets_python3_14","selinux","static-libs","unwind"],"version":"9.0.0"},{"archs":["~amd64","~arm","~arm64","~ppc","~ppc64","~riscv","~x86"],"ebuildid":894005,"firstseen":"2026-03-31T17:36:19.176049","license":"BSD-2 GPL-2","moddate":"2026-03-31T16:36:18","packageid":78886,"repoid":1,"slot":"0\/2","uses":["jit","python_targets_python3_11","python_targets_python3_12","python_targets_python3_13","python_targets_python3_14","selinux","static-libs","unwind"],"version":"8.0.1"},{"archs":["amd64","arm64","x86","~arm","~ppc","~ppc64","~riscv"],"ebuildid":894004,"firstseen":"2026-03-31T17:36:19.176049","license":"BSD-2 GPL-2","moddate":"2026-03-31T16:36:18","packageid":78886,"repoid":1,"slot":"0\/2","uses":["jemalloc","jit","python_targets_python3_11","python_targets_python3_12","python_targets_python3_13","python_targets_python3_14","selinux","static-libs","unwind"],"version":"8.0.0"}],"masks":[],"package":{"categoryid":379,"description":"A high-performance caching HTTP reverse proxy","firstseen":"2026-03-31T17:36:19.176049","name":"vinyl-cache","packageid":78886,"summary":"Vinyl Cache (formerly known as “Varnish Cache”) is a web application accelerator also known as a caching HTTP reverse proxy. You install it in front of any server that speaks HTTP and configure it to cache the contents. Vinyl Cache is really, really fast. It typically speeds up delivery with a factor of 300-1000×, depending on your architecture."},"rdependencies":[{"block":false,"categoryid":450,"description":"An interpreted, interactive, object-oriented programming language","ebuildids":[894004,894004,894004,894004,894005,894005,894005,894005,894006,894006,894006,894006],"firstseen":"2010-05-04T00:54:45.661860","maintainer":"python@gentoo.org","maintainername":"Python","name":"python","packageid":43095},{"block":false,"categoryid":381,"description":"Console display library","ebuildids":[894004,894005,894006],"firstseen":"2010-05-04T00:54:45.661860","maintainer":"base-system@gentoo.org","maintainername":"Gentoo Base System","name":"ncurses","packageid":45285},{"block":false,"categoryid":381,"description":"Portable and efficient API to determine the call-chain of a program","ebuildids":[894004,894005,894006],"firstseen":"2010-05-04T00:54:45.661860","maintainer":"toolchain@gentoo.org","maintainername":"Gentoo Toolchain Project","name":"libunwind","packageid":47245},{"block":false,"categoryid":381,"description":"Another cute console display library","ebuildids":[894004,894005,894006],"firstseen":"2010-05-04T00:54:45.661860","maintainer":"base-system@gentoo.org","maintainername":"Gentoo Base System","name":"readline","packageid":53265},{"block":false,"categoryid":393,"description":"BSD replacement for libreadline","ebuildids":[894004,894005,894006],"firstseen":"2010-05-04T00:54:45.661860","maintainer":"bsd@gentoo.org","maintainername":"BSD Project","name":"libedit","packageid":53869,"summary":"GNU Readline is cool, but BSD Readline is cooler :) Thus here is libedit by the NetBSD folks! The glibc\/bsdlibc stuff comes from the debian tarball, thanks to them too :) The patch is handcrafted with a few ideas from libedit.sf.net and a few ideas from the debian package. This patch aims to be as small as possible (so as to make future cvs snapshots cake)."},{"block":false,"categoryid":380,"description":"The GNU Compiler Collection","ebuildids":[894004,894005,894006],"firstseen":"2010-05-04T00:54:45.661860","maintainer":"toolchain@gentoo.org","maintainername":"Gentoo Toolchain Project","name":"gcc","packageid":54038},{"block":false,"categoryid":393,"description":"Jemalloc is a general-purpose scalable concurrent allocator","ebuildids":[894004],"firstseen":"2010-12-31T14:39:17.540839","maintainer":"mozilla@gentoo.org","maintainername":"Gentoo Mozilla Team","name":"jemalloc","packageid":56647},{"block":false,"categoryid":441,"description":"SELinux policy for varnishd","ebuildids":[894004,894005,894006],"firstseen":"2011-02-06T14:39:29.941591","maintainer":"selinux@gentoo.org","maintainername":"SELinux Team","name":"selinux-varnishd","packageid":56935},{"block":false,"categoryid":393,"description":"Perl-compatible regular expression library","ebuildids":[894004,894005,894006],"firstseen":"2016-08-15T13:37:20.779690","name":"libpcre2","packageid":65707},{"block":false,"categoryid":1490,"description":"group for varnish","ebuildids":[894004,894005],"firstseen":"2019-12-26T17:59:23.475139","name":"varnish","packageid":70531},{"block":false,"categoryid":1491,"description":"user for varnish","ebuildids":[894004,894005],"firstseen":"2019-12-26T17:59:23.475139","name":"varnish","packageid":70532},{"block":false,"categoryid":1490,"description":"group for vinyl-cache","ebuildids":[894006],"firstseen":"2026-03-31T17:36:19.176049","name":"vinyl","packageid":78887},{"block":false,"categoryid":1491,"description":"user for vinyl-cache","ebuildids":[894006],"firstseen":"2026-03-31T17:36:19.176049","name":"vinyl","packageid":78888}],"repos":[{"branch":"master","lastcommit":"e60462fe10dc32f813ea8982c64f90447d5050e7","name":"gentoo","path":"\/usr\/portage","repoid":1,"upstream":"origin"}],"tracked":false,"urls":["https:\/\/vinyl-cache.org\/"],"uses":[{"defaultflag":true,"description":"Use dev-libs\/jemalloc for memory management","isdefault":true,"use":"jemalloc"},{"description":"Enable just-in-time compilation for improved performance. May prevent use of some PaX memory protection features in Gentoo Hardened.","isdefault":false,"use":"jit"},{"description":"!!internal use only!! Security Enhanced Linux support, this must be set by the selinux profile or breakage will occur","isdefault":false,"use":"selinux"},{"description":"Build static versions of dynamic libraries as well","isdefault":false,"use":"static-libs"},{"description":"Add support for call stack unwinding and function name resolution","isdefault":false,"use":"unwind"},{"description":"Build with Python 3.11","group":"python_targets","isdefault":false,"use":"python3_11"},{"description":"Build with Python 3.12","group":"python_targets","isdefault":false,"use":"python3_12"},{"description":"Build with Python 3.13","group":"python_targets","isdefault":false,"use":"python3_13"},{"description":"Build with Python 3.14","group":"python_targets","isdefault":false,"use":"python3_14"}]}