From mboxrd@z Thu Jan  1 00:00:00 1970
From: Mark H Weaver <mhw@netris.org>
Subject: Re: Handling =?utf-8?B?4oCYZmlsZeKAmQ==?= CVE
Date: Thu, 13 Nov 2014 13:03:53 -0500
Message-ID: <87egt7f052.fsf@yeeloong.lan>
References: <87389nl6wi.fsf@gnu.org> <87mw7vhwgz.fsf@gnu.org>
Mime-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
Return-path: <guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org>
Received: from eggs.gnu.org ([2001:4830:134:3::10]:51681)
	by lists.gnu.org with esmtp (Exim 4.71)
	(envelope-from <mhw@netris.org>) id 1Xoyli-0000x3-Md
	for guix-devel@gnu.org; Thu, 13 Nov 2014 13:05:24 -0500
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
	(envelope-from <mhw@netris.org>) id 1Xoylc-0001fD-Pe
	for guix-devel@gnu.org; Thu, 13 Nov 2014 13:05:18 -0500
In-Reply-To: <87mw7vhwgz.fsf@gnu.org> ("Ludovic
	\=\?utf-8\?Q\?Court\=C3\=A8s\=22'\?\=
	\=\?utf-8\?Q\?s\?\= message of "Thu, 13 Nov 2014 17:54:52 +0100")
List-Id: "Development of GNU Guix and the GNU System distribution."
	<guix-devel.gnu.org>
List-Unsubscribe: <https://lists.gnu.org/mailman/options/guix-devel>,
	<mailto:guix-devel-request@gnu.org?subject=unsubscribe>
List-Archive: <http://lists.gnu.org/archive/html/guix-devel>
List-Post: <mailto:guix-devel@gnu.org>
List-Help: <mailto:guix-devel-request@gnu.org?subject=help>
List-Subscribe: <https://lists.gnu.org/mailman/listinfo/guix-devel>,
	<mailto:guix-devel-request@gnu.org?subject=subscribe>
Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org
Sender: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org
To: Ludovic =?utf-8?Q?Court=C3=A8s?= <ludo@gnu.org>
Cc: Guix-devel <guix-devel@gnu.org>

ludo@gnu.org (Ludovic Court=C3=A8s) writes:

> ludo@gnu.org (Ludovic Court=C3=A8s) skribis:
>
>> What about this other option: make another public package, =E2=80=98file=
-5.20=E2=80=99,
>> next to =E2=80=98file=E2=80=99, such that when a user explicitly install=
s =E2=80=98file=E2=80=99, they
>> get the new one?
>
> I ended up taking that route, in commit 310081e.

FWIW, I think it would be better for 'file' to be bound to the fixed
package, and to add a 'file/fixed' that points to the old buggy one.
Then 'file/fixed' could be used in some selected places.

'file' is used as a plain input (as opposed to native-input) in several
places that make me a bit nervous, e.g. the 'transmission' bittorrent
client (is 'file' being used at runtime on downloaded files?), and also
'aegis', 'quilt', and 'cmake'.

Finally, 'file' is a propagated-input for 'intltool', which means that
if anyone installs 'intltool' in their profile, they will have the buggy
'file' in their PATH.

    Regards,
      Mark