Re: Chicken security bugs [was Re: [peter@more-magic.net: Irregex packages should be updated to 0.9.6]]

[Kei Kebreau <kei@openmailbox.org>]

[-- Attachment #1.1: Type: text/plain, Size: 2043 bytes --]

Leo Famulari <leo@famulari.name> writes:

> On Sat, Dec 24, 2016 at 02:23:43PM -0500, Kei Kebreau wrote:
>> Leo Famulari <leo@famulari.name> writes:
>> > On Thu, Dec 22, 2016 at 02:20:37PM -0500, Kei Kebreau wrote:
>> >> Subject: [PATCH] gnu: chicken: Fix CVE-2016-{6830,6831}.
>> >> 
>> >> * gnu/packages/patches/chicken-CVE-2016-6830+CVE-2016-6831.patch: New file.
>> >> * gnu/local.mk (dist_patch_DATA): Use it.
>> >> * gnu/packages/scheme.scm (chicken)[source]: Use it.
>> >
>> > Thank you for looking into this!
>> >
>> > Something like this patch is in CHICKEN 4.11.1:
>> >
>> > https://code.call-cc.org/cgi-bin/gitweb.cgi?p=chicken-core.git;a=commitdiff;h=0d20426c6da0f116606574dadadaa878b96a68ea
>> >
>> > And there is a patch for the IrRegex bug after the latest tag:
>> >
>> > https://code.call-cc.org/cgi-bin/gitweb.cgi?p=chicken-core.git;a=commitdiff;h=2c419f18138c17767754b36d3b706cd71a55350a
>> >
>> > Can you try updating CHICKEN and applying that IrRegex patch?
>> 
>> I can try, but updating to CHICKEN 4.11.1 requires a recent CHICKEN
>> binary due to its build system requirements. Do we have any objection to
>> bootstrapping CHICKEN 4.11.1 from version 4.11.0?
>
> Interesting!
>
> I don't see why we shouldn't use 4.11.0 to bootstrap 4.11.1.
>
> Changing the build system like that seems unusual for a minor point
> release, and I don't see it documented in the 4.11.1 NEWS file:
>
> https://code.call-cc.org/cgi-bin/gitweb.cgi?p=chicken-core.git;a=blob;f=NEWS;h=545d68583c8375bd5243ec07a53faff9ec1685a3;hb=116f42e7a3eab2a02b853fd038af3cb3aadad5c3
>

I must have phrased that too vaguely. It's just a "building from release
tarball vs from git checkout" thing, documented in the README file of
both releases. I've been having trouble with the seemingly identical
test suite using the attached WIP patch. Perhaps the dreary wheather is
clouding my thoughts.

> One way or another, we should fix these bugs in our package. Thanks for
> taking care of it :)

You're welcome!


[-- Attachment #1.2: 0001-gnu-chicken-Update-to-4.11.1.patch --]
[-- Type: text/plain, Size: 3050 bytes --]

From 61803beae802f626e85e9fe089982c18837aaa08 Mon Sep 17 00:00:00 2001
From: Kei Kebreau <kei@openmailbox.org>
Date: Sat, 24 Dec 2016 20:52:45 -0500
Subject: [PATCH] gnu: chicken: Update to 4.11.1.

* gnu/packages/scheme.scm (chicken): Update to 4.11.1.
---
 gnu/packages/scheme.scm | 49 +++++++++++++++++++++++++++++++++++++++++++++++--
 1 file changed, 47 insertions(+), 2 deletions(-)

diff --git a/gnu/packages/scheme.scm b/gnu/packages/scheme.scm
index 78f387faf..4f9718ae7 100644
--- a/gnu/packages/scheme.scm
+++ b/gnu/packages/scheme.scm
@@ -320,9 +320,9 @@ applications in many fields such as multimedia (web galleries, music players,
 mashups, office (web agendas, mail clients, ...), etc.")
     (license gpl2+)))
 
-(define-public chicken
+(define chicken-4.11.0
   (package
-    (name "chicken")
+    (name "chicken-4.11.0")
     (version "4.11.0")
     (source (origin
              (method url-fetch)
@@ -374,6 +374,51 @@ produces portable and efficient C, supports almost all of the R5RS Scheme
 language standard, and includes many enhancements and extensions.")
     (license bsd-3)))
 
+(define-public chicken
+  (package
+    (inherit chicken-4.11.0)
+    (name "chicken")
+    (version "4.11.1")
+    (source (origin
+              (method git-fetch)
+              (uri (git-reference
+                    (url "https://code.call-cc.org/git/chicken-core.git")
+                    (commit version)))
+              (sha256
+               (base32
+                "1a0jxi5k2n2dx7zn9blynd9lg45v2w4jnh24d67lqazasricgs1k"))))
+    (arguments
+     `(;; No `configure' script; run "make check" after "make install" as
+       ;; prescribed by README.
+       #:phases
+       (modify-phases %standard-phases
+         (delete 'configure)
+         (delete 'check)
+         (add-after 'install 'check
+           (assoc-ref %standard-phases 'check))
+         (add-after 'unpack 'disable-broken-tests
+           (lambda _
+             ;; The port tests fail with this error:
+             ;; Error: (line 294) invalid escape-sequence '\x o'
+             (substitute* "tests/runtests.sh"
+               (("\\$interpret -s port-tests\\.scm") ""))
+             #t)))
+
+       #:make-flags (let ((out (assoc-ref %outputs "out"))
+                          (chicken-binary
+                           (string-append
+                            (assoc-ref %build-inputs "chicken-4.11.0")
+                            "/bin/chicken")))
+                      (list "PLATFORM=linux"
+                            (string-append "PREFIX=" out)
+                            (string-append "VARDIR=" out "/var/lib")
+                            (string-append "CHICKEN=" chicken-binary)))
+
+       ;; Parallel builds are not supported, as noted in README.
+       #:parallel-build? #f))
+    (inputs
+     `(("chicken-4.11.0" ,chicken-4.11.0))))) ; necessary for building from git
+
 (define-public scheme48
   (package
     (name "scheme48")
-- 
2.11.0


[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 832 bytes --]