From mboxrd@z Thu Jan 1 00:00:00 1970 From: David Craven Subject: Re: libtiff security update (multiple CVEs) Date: Thu, 25 Aug 2016 18:29:19 +0200 Message-ID: <87eg5cg6cg.fsf@craven.ch> References: <20160823194434.GA21964@jasmine> Mime-Version: 1.0 Content-Type: text/plain Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:33018) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bcxX0-0002h5-Ld for guix-devel@gnu.org; Thu, 25 Aug 2016 12:29:36 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1bcxWu-0002uB-OY for guix-devel@gnu.org; Thu, 25 Aug 2016 12:29:30 -0400 Received: from mail-wm0-x231.google.com ([2a00:1450:400c:c09::231]:36681) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bcxWt-0002sw-FG for guix-devel@gnu.org; Thu, 25 Aug 2016 12:29:24 -0400 Received: by mail-wm0-x231.google.com with SMTP id q128so246381212wma.1 for ; Thu, 25 Aug 2016 09:29:22 -0700 (PDT) In-Reply-To: <20160823194434.GA21964@jasmine> List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: "Guix-devel" To: Leo Famulari Cc: guix-devel LGTM. I didn't look at the patches, but adding a libtiff/fixed package and using the replacement field in libtiff is my understanding of how security updates should be done.