From mboxrd@z Thu Jan 1 00:00:00 1970 From: Leo Famulari Subject: Re: Chicken security bugs [was Re: [peter@more-magic.net: Irregex packages should be updated to 0.9.6]] Date: Sun, 1 Jan 2017 17:18:59 -0500 Message-ID: <20170101221859.GA29114@jasmine> References: <20161216193319.GA12690@jasmine> <20161216193659.GA26067@jasmine> <87lgv7zs6y.fsf@openmailbox.org> <20161224063251.GA30959@jasmine> <87pokhxha8.fsf@openmailbox.org> <20161224210440.GA7145@jasmine> <87lgv4ydi8.fsf@openmailbox.org> Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="VS++wcV0S1rZb1Fb" Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:40248) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1cNoT3-0002l5-Da for guix-devel@gnu.org; Sun, 01 Jan 2017 17:19:06 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1cNoSz-0003ld-TL for guix-devel@gnu.org; Sun, 01 Jan 2017 17:19:05 -0500 Received: from out1-smtp.messagingengine.com ([66.111.4.25]:45041) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1cNoSz-0003lJ-Mp for guix-devel@gnu.org; Sun, 01 Jan 2017 17:19:01 -0500 Content-Disposition: inline In-Reply-To: <87lgv4ydi8.fsf@openmailbox.org> List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: "Guix-devel" To: Kei Kebreau Cc: guix-devel@gnu.org --VS++wcV0S1rZb1Fb Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Sat, Dec 24, 2016 at 08:59:59PM -0500, Kei Kebreau wrote: > Leo Famulari writes: >=20 > > On Sat, Dec 24, 2016 at 02:23:43PM -0500, Kei Kebreau wrote: > >> Leo Famulari writes: > >> > On Thu, Dec 22, 2016 at 02:20:37PM -0500, Kei Kebreau wrote: > >> >> Subject: [PATCH] gnu: chicken: Fix CVE-2016-{6830,6831}. > >> >>=20 > >> >> * gnu/packages/patches/chicken-CVE-2016-6830+CVE-2016-6831.patch: N= ew file. > >> >> * gnu/local.mk (dist_patch_DATA): Use it. > >> >> * gnu/packages/scheme.scm (chicken)[source]: Use it. > >> > > >> > Thank you for looking into this! > >> > > >> > Something like this patch is in CHICKEN 4.11.1: > >> > > >> > https://code.call-cc.org/cgi-bin/gitweb.cgi?p=3Dchicken-core.git;a= =3Dcommitdiff;h=3D0d20426c6da0f116606574dadadaa878b96a68ea > >> > > >> > And there is a patch for the IrRegex bug after the latest tag: > >> > > >> > https://code.call-cc.org/cgi-bin/gitweb.cgi?p=3Dchicken-core.git;a= =3Dcommitdiff;h=3D2c419f18138c17767754b36d3b706cd71a55350a > >> > > >> > Can you try updating CHICKEN and applying that IrRegex patch? > >>=20 > >> I can try, but updating to CHICKEN 4.11.1 requires a recent CHICKEN > >> binary due to its build system requirements. Do we have any objection = to > >> bootstrapping CHICKEN 4.11.1 from version 4.11.0? > > > > Interesting! > > > > I don't see why we shouldn't use 4.11.0 to bootstrap 4.11.1. > > > > Changing the build system like that seems unusual for a minor point > > release, and I don't see it documented in the 4.11.1 NEWS file: > > > > https://code.call-cc.org/cgi-bin/gitweb.cgi?p=3Dchicken-core.git;a=3Dbl= ob;f=3DNEWS;h=3D545d68583c8375bd5243ec07a53faff9ec1685a3;hb=3D116f42e7a3eab= 2a02b853fd038af3cb3aadad5c3 > > >=20 > I must have phrased that too vaguely. It's just a "building from release > tarball vs from git checkout" thing, documented in the README file of > both releases. I've been having trouble with the seemingly identical > test suite using the attached WIP patch. Perhaps the dreary wheather is > clouding my thoughts. How about using a development snapshot? http://code.call-cc.org/dev-snapshots/ --VS++wcV0S1rZb1Fb Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEsFFZSPHn08G5gDigJkb6MLrKfwgFAlhpgFIACgkQJkb6MLrK fwg/wA//QwDdOrkl94wV29wesQN8tv1GksNZAh3GrfWstMVuRTk8FJ2cFTRS6NCk AAAXCS+Ss1OlRhRszu2dC12K5Ygo879c6HxWlOxfs1kzWMPAM9+NXmxuPRY16cDL R4UrHZN5293pjdfA3WZ51YfdhGjYoOo3zfVYS/oPUCQBd2a6A933KaJIg7OfytOS ASEp6abZO9Cm+7TYt4Kxa1JNr50phUPhkw0SKzuOaY4Lw+/L9yzAsKCVwq34J8Pz yOSSfUjRTWwz8Bo9muM6blovstSPLum8Sh6TLVk0/uXCoTLeepKeqxYeoknim69S H0EjnljviGln2ICamzUXoN4PNLrLoXm4218xbgC7GOek0T0PndRyXJXjYqeBxIIV z+oBZNg9ZD9cyboUyr2MdFmdofD4UZZK8bUVOEhOcl4HmRpS/kvJJyxBjWGxtfJu OfVgfhcSjmNCa9HUWJsN5l10wGvgFj+pHEQgDWyQflxUdwGaIdTM8F4VfuaD50CK /nF9Zg2dx5gRgJd7BOBrUuel1E0QD76xEREAVFR3BeOD3ZmPoTSfhdqqIv/OjViJ mPwI9DUth8iape7OEj2riWfqQNUHj+bCDsG4Gra2VI2vqwdXy6wwP+DYF5KUEuCy 9xAsgMI04fgmdJqAKn1fqN4Xl8W2rWkK1a50Q2oNmpTcgrmikCs= =7pSd -----END PGP SIGNATURE----- --VS++wcV0S1rZb1Fb--