From mboxrd@z Thu Jan 1 00:00:00 1970 From: ludo@gnu.org (Ludovic =?utf-8?Q?Court=C3=A8s?=) Subject: Re: GnuTLS security update Date: Sun, 11 Sep 2016 22:45:12 +0200 Message-ID: <874m5mjhd3.fsf@gnu.org> References: <20160911154108.GA13920@jasmine> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:38537) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bjBct-0005LA-V8 for guix-devel@gnu.org; Sun, 11 Sep 2016 16:45:20 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1bjBcq-0004sO-Eg for guix-devel@gnu.org; Sun, 11 Sep 2016 16:45:19 -0400 In-Reply-To: (Vincent Legoll's message of "Sun, 11 Sep 2016 18:08:27 +0200") List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: "Guix-devel" To: Vincent Legoll Cc: guix-devel Vincent Legoll skribis: > On Sun, Sep 11, 2016 at 5:41 PM, Leo Famulari wrote: >> There is a GnuTLS security advisory [0] regarding "an issue that affects >> validation of certificates using OCSP responses, which can falsely >> report a certificate as valid under certain circumstances." >> >> I updated GnuTLS on core-updates to 3.5.4, the latest release of the 3.5 >> series. >> >> For master, the naive approach of cherry-picking the patch [1] did not >> work; the test 'system-prio-file' fails consistently with that change. I >> could instead try grafting the updated version. >> >> What do you think? The authors seem to think it's a relatively minor >> issue [2], since exploiting it requires an attacker to compromise the >> certificate authority. > > Side questions (just for my curiosity's sake): > > - What does it cost (manpower, hydra build time, etc...) approximatively > to do a new release ? Many packages would need to be rebuilt: --8<---------------cut here---------------start------------->8--- $ guix refresh -l gnutls Building the following 527 packages would ensure 1169 dependent packages ar= e rebuilt: [...] --8<---------------cut here---------------end--------------->8--- > - Is it sufficiently automated ? Yes: --8<---------------cut here---------------start------------->8--- $ guix refresh gnutls /home/ludo/.config/guix/latest/gnu/packages/tls.scm:140:13: gnutls would be= upgraded from 3.5.2 to 3.5.4 --8<---------------cut here---------------end--------------->8--- > - Can we help ? Always! ;-) The question is such situations is just how to deploy the fix as fast as possible, which means avoiding a situation that would lead users to rebuild or redownload massive amounts of software just to get the upgrade. Grafts make it faster. Ludo=E2=80=99.