Re: [Fetchmail-users] The 6.6.7.rc1 release candidate is available (security fix for NTLM protocol, possible RCE)

[Matthias A. <mat...@gm...>]

Am 14.07.26 um 20:44 schrieb Norman Ramsey:
>   > On Mon, 13 Jul 2026, Norman Ramsey wrote:
>   >
>   > > Building on Debian stable, I'm running into this build issue...
>   > >
>   > > Please advise me how to proceed.
>   >
>   > I think
>   >          rm Makefile ; configure
>   > should be sufficient. Add whatever configure options you usually use.
>
> This was sufficient; thank you.
>
> (And in the event, the system clock is fine, and the filesystem is ext4.)

Norman,

Glad you've got that solved with Andrew's help;
if you have another few minutes: would you happen to have any idea or 
even remote hunch how the situation came to pass then so I could try to 
avoid that from the packaging end?

How did you unpack the tarball? Was that "tar" on the command line or 
some graphical utility? Which, in which version?

Did you unpack source tarballs of different versions over one another 
and/or mix with Git checkouts, or mix meson and autotools builds?

In attempting to understand your situation, I found a few edge cases in 
the packaging that I want to iron out for 6.6.7.rc2/release later.

The files were created in CEST time zone (2 hours ahead/east of 
UTC/"GMT") somewhen on 2026-06-27, with a forged date back to midnight 
of beginning that same day, and in UTC display that makes it 
2026-06-26T22:00:00 sharp; I've packaged from btrfs with GNU tar 1.35. 
Anything you would have unpacked would be newer. The tarball contains 
the files with the same timestamp in lexicographical order.

> $ TZ=UTC tar -tJvf ~/Downloads/fetchmail-6.6.7.rc1.tar.xz --full-time 
> | grep -E Makefile\|config\|m4
> -rw-r--r-- root/root      8785 2026-06-26 22:00:00 
> fetchmail-6.6.7.rc1/Makefile.am
> -rw-r--r-- root/root    110915 2026-06-26 22:00:00 
> fetchmail-6.6.7.rc1/Makefile.in
> -rw-r--r-- root/root     79584 2026-06-26 22:00:00 
> fetchmail-6.6.7.rc1/aclocal.m4
> -rwxr-xr-x root/root     50853 2026-06-26 22:00:00 
> fetchmail-6.6.7.rc1/config.guess
> -rw-r--r-- root/root     11143 2026-06-26 22:00:00 
> fetchmail-6.6.7.rc1/config.h.in
> -rwxr-xr-x root/root     20196 2026-06-26 22:00:00 
> fetchmail-6.6.7.rc1/config.rpath
> -rwxr-xr-x root/root     39946 2026-06-26 22:00:00 
> fetchmail-6.6.7.rc1/config.sub
> -rwxr-xr-x root/root    500912 2026-06-26 22:00:00 
> fetchmail-6.6.7.rc1/configure
> -rw-r--r-- root/root     29698 2026-06-26 22:00:00 
> fetchmail-6.6.7.rc1/configure.ac
> drwxr-xr-x root/root         0 2026-06-26 22:00:00 fetchmail-6.6.7.rc1/m4/
> -rw-r--r-- root/root      9242 2026-06-26 22:00:00 
> fetchmail-6.6.7.rc1/m4/build-to-host.m4
> -rw-r--r-- root/root     14990 2026-06-26 22:00:00 
> fetchmail-6.6.7.rc1/m4/gettext.m4
> -rw-r--r-- root/root     17194 2026-06-26 22:00:00 
> fetchmail-6.6.7.rc1/m4/host-cpu-c-abi.m4
> -rw-r--r-- root/root     11052 2026-06-26 22:00:00 
> fetchmail-6.6.7.rc1/m4/iconv.m4
> -rw-r--r-- root/root      3560 2026-06-26 22:00:00 
> fetchmail-6.6.7.rc1/m4/intlmacosx.m4
> -rw-r--r-- root/root      5440 2026-06-26 22:00:00 
> fetchmail-6.6.7.rc1/m4/lib-ld.m4
> -rw-r--r-- root/root     35796 2026-06-26 22:00:00 
> fetchmail-6.6.7.rc1/m4/lib-link.m4
> -rw-r--r-- root/root     12582 2026-06-26 22:00:00 
> fetchmail-6.6.7.rc1/m4/lib-prefix.m4
> -rw-r--r-- root/root      1236 2026-06-26 22:00:00 
> fetchmail-6.6.7.rc1/m4/nls.m4
> -rw-r--r-- root/root     19013 2026-06-26 22:00:00 
> fetchmail-6.6.7.rc1/m4/po.m4
> -rw-r--r-- root/root      3091 2026-06-26 22:00:00 
> fetchmail-6.6.7.rc1/m4/progtest.m4
> drwxr-xr-x root/root         0 2026-06-26 22:00:00 
> fetchmail-6.6.7.rc1/m4-local/
> -rw-rw-r-- root/root      2968 2026-06-26 22:00:00 
> fetchmail-6.6.7.rc1/m4-local/ac-archive-license.txt
> -rw-r--r-- root/root      3207 2026-06-26 22:00:00 
> fetchmail-6.6.7.rc1/m4-local/ac_ma_search_package.m4
> -rw-r--r-- root/root     20250 2026-06-26 22:00:00 
> fetchmail-6.6.7.rc1/po/Makefile.in.in
> [...]