From mboxrd@z Thu Jan 1 00:00:00 1970 From: Leo Famulari Subject: Re: Chicken security bugs [was Re: [peter@more-magic.net: Irregex packages should be updated to 0.9.6]] Date: Sat, 24 Dec 2016 16:04:40 -0500 Message-ID: <20161224210440.GA7145@jasmine> References: <20161216193319.GA12690@jasmine> <20161216193659.GA26067@jasmine> <87lgv7zs6y.fsf@openmailbox.org> <20161224063251.GA30959@jasmine> <87pokhxha8.fsf@openmailbox.org> Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="y0ulUmNC+osPPQO6" Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:41574) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1cKtUq-0008Pk-8e for guix-devel@gnu.org; Sat, 24 Dec 2016 16:04:53 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1cKtUl-0003Eu-LG for guix-devel@gnu.org; Sat, 24 Dec 2016 16:04:52 -0500 Received: from out3-smtp.messagingengine.com ([66.111.4.27]:42327) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1cKtUl-0003BS-Fh for guix-devel@gnu.org; Sat, 24 Dec 2016 16:04:47 -0500 Content-Disposition: inline In-Reply-To: <87pokhxha8.fsf@openmailbox.org> List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: "Guix-devel" To: Kei Kebreau Cc: guix-devel@gnu.org --y0ulUmNC+osPPQO6 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Sat, Dec 24, 2016 at 02:23:43PM -0500, Kei Kebreau wrote: > Leo Famulari writes: > > On Thu, Dec 22, 2016 at 02:20:37PM -0500, Kei Kebreau wrote: > >> Subject: [PATCH] gnu: chicken: Fix CVE-2016-{6830,6831}. > >>=20 > >> * gnu/packages/patches/chicken-CVE-2016-6830+CVE-2016-6831.patch: New = file. > >> * gnu/local.mk (dist_patch_DATA): Use it. > >> * gnu/packages/scheme.scm (chicken)[source]: Use it. > > > > Thank you for looking into this! > > > > Something like this patch is in CHICKEN 4.11.1: > > > > https://code.call-cc.org/cgi-bin/gitweb.cgi?p=3Dchicken-core.git;a=3Dco= mmitdiff;h=3D0d20426c6da0f116606574dadadaa878b96a68ea > > > > And there is a patch for the IrRegex bug after the latest tag: > > > > https://code.call-cc.org/cgi-bin/gitweb.cgi?p=3Dchicken-core.git;a=3Dco= mmitdiff;h=3D2c419f18138c17767754b36d3b706cd71a55350a > > > > Can you try updating CHICKEN and applying that IrRegex patch? >=20 > I can try, but updating to CHICKEN 4.11.1 requires a recent CHICKEN > binary due to its build system requirements. Do we have any objection to > bootstrapping CHICKEN 4.11.1 from version 4.11.0? Interesting! I don't see why we shouldn't use 4.11.0 to bootstrap 4.11.1. Changing the build system like that seems unusual for a minor point release, and I don't see it documented in the 4.11.1 NEWS file: https://code.call-cc.org/cgi-bin/gitweb.cgi?p=3Dchicken-core.git;a=3Dblob;f= =3DNEWS;h=3D545d68583c8375bd5243ec07a53faff9ec1685a3;hb=3D116f42e7a3eab2a02= b853fd038af3cb3aadad5c3 One way or another, we should fix these bugs in our package. Thanks for taking care of it :) --y0ulUmNC+osPPQO6 Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEsFFZSPHn08G5gDigJkb6MLrKfwgFAlhe4uUACgkQJkb6MLrK fwiBdA//dDqGoQjl/SC71HmdBgV1O8RChmSNcyBOQB9QRslLjp0obcKvDsmUbdN1 fP7qwKe07z97Ae4uLVpXrxi99TS6C5fxBPHxc/EA+S0qmWueBzvACBu5Afkwf60U eWbTsH5BvWlXhToRu1jVrmYv0G+x77Xi6FysYnhDACuzT9ZajzZH7dWJ3CMOhfA9 uoJm81M+9X2xqvsUkyegUZjAw3PJvD63ZJ33GNtC0lKWP+JCZDY9Txs8iYRhhK42 qD2d0CKGkNNYrylf4Eqo/Nwhmb3fZPZDkjhVG39ufGaGOsuC8EfXoSTNolgly1E0 2YERc4BmgzsIxhtPv6FOK1XT1VR29swuzFGs3J7XWzVr9CWCJHNZCXFI6aVlKxNI RkHPt1CZQxLeS60wB5c1CaD+eh0N0FjqMdZwsYw37z2PsXT+/eBifJ0gTnXBR7oc TpGtSgcbSHJKKXhs1Xy3ev56qjVz+CcEXPjtzs11GmeyQd0doBxyYkTsjaOAHnAx uQGd0BcrGi26DimwD33N/aP7mutAK7iKAvpC2NVmZ0WZ/3Zqs5P6dkVymyqjXeVU WU9M47XaL2nBJsUm5nknQ1UgCP0Pu30L6Dvgg57WMlEZcpQJE813+GrOquHLLnpE NZ0/N+28UU0UOTkailZUHzfDP/AkbOCP/mtLum77IjWgnzFqOpA= =28gt -----END PGP SIGNATURE----- --y0ulUmNC+osPPQO6--