unofficial mirror of bug-guix@gnu.org 
 help / color / mirror / code / Atom feed
From: "Ludovic Courtès" <ludo@gnu.org>
To: Jack Hill <jackhill@jackhill.us>
Cc: 47941-done@debbugs.gnu.org
Subject: bug#47941: guix lint -c cve stacktrace
Date: Thu, 22 Apr 2021 00:04:35 +0200	[thread overview]
Message-ID: <87im4f2t1o.fsf@gnu.org> (raw)
In-Reply-To: <alpine.DEB.2.21.2104211619310.8414@marsh.hcoop.net> (Jack Hill's message of "Wed, 21 Apr 2021 16:29:58 -0400 (EDT)")

Hi,

Jack Hill <jackhill@jackhill.us> skribis:

> Using guix ae5128e21eb7afa66bd7cfd7fd1bc5764d00663e, the cve lint
> check fails when fetching the CVE database as follows:
>
> $ guix lint -c cve hello
> fetching CVE database for 2021...
> Backtrace:
>           15 (primitive-load "/home/jackhill/.config/guix/current/bi…")
> In guix/ui.scm:
>   2164:12 14 (run-guix-command _ . _)
> In ice-9/boot-9.scm:
>   1736:10 13 (with-exception-handler _ _ #:unwind? _ # _)
>   1731:15 12 (with-exception-handler #<procedure 7f895ab7d000 at ic…> …)
> In srfi/srfi-1.scm:
>     634:9 11 (for-each #<procedure 7f895ab84d80 at guix/scripts/lin…> …)
> In guix/scripts/lint.scm:
>      65:4 10 (run-checkers _ _ #:store _)
> In srfi/srfi-1.scm:
>     634:9  9 (for-each #<procedure 7f895420bc00 at guix/scripts/lin…> …)
> In guix/scripts/lint.scm:
>     74:21  8 (_ _)
> In guix/lint.scm:
>    1178:4  7 (check-vulnerabilities _ _)
>    1170:9  6 (_ _)
> In unknown file:
>            5 (force #<promise #<procedure 7f895af13a88 at guix/lint.…>)
> In guix/lint.scm:
>    1153:2  4 (_)
>    1112:2  3 (call-with-networking-fail-safe _ _ _)
> In ice-9/boot-9.scm:
>   1736:10  2 (with-exception-handler _ _ #:unwind? _ # _)
>   1669:16  1 (raise-exception _ #:continuable? _)
>   1667:16  0 (raise-exception _ #:continuable? _)
>
> ice-9/boot-9.scm:1667:16: In procedure raise-exception:
> Wrong type (expecting array): #f

Fixed:

  https://git.savannah.gnu.org/cgit/guix.git/commit/?id=7dbc2fcb45fac4a0b64fef8efa8c858a047d0498

It looks like a couple of bogus CVE entries crept in.  It’s surprising
because we never encountered such issues before, so I wonder if MITRE
changed something on their side.

Thanks,
Ludo’.




      reply	other threads:[~2021-04-21 22:05 UTC|newest]

Thread overview: 2+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-04-21 20:29 bug#47941: guix lint -c cve stacktrace Jack Hill
2021-04-21 22:04 ` Ludovic Courtès [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

  List information: https://guix.gnu.org/

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=87im4f2t1o.fsf@gnu.org \
    --to=ludo@gnu.org \
    --cc=47941-done@debbugs.gnu.org \
    --cc=jackhill@jackhill.us \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
Code repositories for project(s) associated with this public inbox

	https://git.savannah.gnu.org/cgit/guix.git

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).