Revision: 1.0
--------------------------------------------------------------------------------
Package            fix-pg2shell.cbsa
                   fix-pg2shell-offline.cbsa (Evolution Box without internet)

Version            any, the installed version does not change

Required version   any

Support models     Evolution Box with Ubuntu 22.04, 24.04 or 20.04

--------------------------------------------------------------------------------
WHAT THIS PACKAGE DOES

 It closes pg2shell (CVE-2025-8714), a vulnerability that lets a crafted
 project (.cbse) run code on the Evolution Box when it is imported: a plain
 PostgreSQL dump can carry psql meta-commands that run as a shell on restore,
 and Evolution restores an imported project as a database superuser.

 Two pieces, both installed here:

  1. The PostgreSQL client (psql, pg_dump, pg_restore) is upgraded to the
     fixed version. Only the client is upgraded, with its configuration; the
     database server is not touched and is not restarted.

  2. Evolution's restore now wraps an imported project in a restricted block,
     so psql refuses the meta-commands a crafted project could carry.

 A legitimate project, old or new, imports exactly as before.

--------------------------------------------------------------------------------
NOTES

 The database is not restarted and the Evolution Box doesn't need to reboot.

 fix-pg2shell.cbsa upgrades the client from Ubuntu, so it needs internet.
 fix-pg2shell-offline.cbsa carries it and needs no internet.

 Ubuntu 20.04 needs fix-pg2shell-offline.cbsa: its postgresql-client is not in
 any Ubuntu repository (we build it), so fix-pg2shell.cbsa does not fix a 20.04
 box and says so.

--------------------------------------------------------------------------------
LIMITATIONS

 Ubuntu 14.04 (evo4) is not supported yet: on it the package changes nothing
 and says so.