From mboxrd@z Thu Jan 1 00:00:00 1970 From: Leo Famulari Subject: Re: [PATCH 0/1] curl: Fix CVE-2016-3739. Date: Mon, 13 Jun 2016 12:05:32 -0400 Message-ID: <20160613160532.GA14259@jasmine> References: <87inxei119.fsf@gnu.org> <20160612210232.GA5479@khazad-dum> <20160613011231.GA13522@jasmine> <87eg81cel0.fsf@gnu.org> Mime-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Transfer-Encoding: 8bit Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:48242) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bCUN7-0000aR-DY for guix-devel@gnu.org; Mon, 13 Jun 2016 12:05:54 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1bCUN2-0003Pj-A8 for guix-devel@gnu.org; Mon, 13 Jun 2016 12:05:53 -0400 Content-Disposition: inline In-Reply-To: <87eg81cel0.fsf@gnu.org> List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: "Guix-devel" To: Ludovic =?iso-8859-1?Q?Court=E8s?= Cc: guix-devel@gnu.org On Mon, Jun 13, 2016 at 05:07:23PM +0200, Ludovic Courtès wrote: > Leo Famulari skribis: > > We should definitely update curl on core-updates-next, or whatever is > > built after the current cycle, and we should not add hiawatha until the > > fixed curl is in our tree. > > Agreed on both points. Can you already push the curl update in > core-updates-next? Done as 32a8eb01e > Though I would like the default curl package to still used GnuTLS. So I > think curl-with-mbedtls will be a different package anyway. I hadn't noticed that our curl package uses GnuTLS instead of OpenSSL :)