From: ludo@gnu.org (Ludovic Courtès)
To: Eric Bavier <ericbavier@gmail.com>
Cc: Guix-devel <guix-devel@gnu.org>
Subject: Re: Handling ‘file’ CVE
Date: Thu, 13 Nov 2014 21:13:03 +0100 [thread overview]
Message-ID: <87zjbu6er4.fsf@gnu.org> (raw)
In-Reply-To: <87h9y3uee3.fsf@gmail.com> (Eric Bavier's message of "Thu, 13 Nov 2014 12:47:00 -0600")
Eric Bavier <ericbavier@gmail.com> skribis:
> Mark H Weaver writes:
>
>> Finally, 'file' is a propagated-input for 'intltool', which means that
>> if anyone installs 'intltool' in their profile, they will have the buggy
>> 'file' in their PATH.
>
> The attached patch might be enough to fix this.
But ‘guix refresh -l’ says 142 packages depend on it...
> From fff25ec0451a65ccd5972d16ef96221c85084566 Mon Sep 17 00:00:00 2001
> From: Eric Bavier <bavier@member.fsf.org>
> Date: Thu, 13 Nov 2014 12:46:04 -0600
> Subject: [PATCH] gnu: intltool: Make file a regular input.
>
> * gnu/packages/glib.scm (intltool)[propagated-inputs]: Move file from here...
> [inputs]: to here.
> [arguments]: New 'patch-file-references phase.
[...]
> + (arguments
> + `(#:phases (alist-cons-after
> + 'unpack 'patch-file-references
> + (lambda _
> + (substitute* "intltool-update.in"
> + (("`file") (string-append "`" (which "file"))))))))
Should use (string-append (assoc-ref inputs "file") "/bin/file") to work
correctly in a cross-compilation context.
Also, the last argument to ‘alist-cons-after’ is missing.
Could you push the updated patch to ‘core-updates’? We’ll see how where
it takes us.
The main limitation here is that it takes almost a week for the MIPS
machine to rebuild everything (~2 days for Intel), and I’d like
everything to be built on the D-day.
Thanks,
Ludo’.
next prev parent reply other threads:[~2014-11-13 20:13 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-11-13 10:41 Handling ‘file’ CVE Ludovic Courtès
2014-11-13 13:00 ` Andreas Enge
2014-11-13 13:17 ` Ludovic Courtès
2014-11-13 16:54 ` Ludovic Courtès
2014-11-13 18:03 ` Mark H Weaver
2014-11-13 18:47 ` Eric Bavier
2014-11-13 20:13 ` Ludovic Courtès [this message]
2014-11-13 20:42 ` Eric Bavier
2014-11-13 20:43 ` Ludovic Courtès
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
List information: https://guix.gnu.org/
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87zjbu6er4.fsf@gnu.org \
--to=ludo@gnu.org \
--cc=ericbavier@gmail.com \
--cc=guix-devel@gnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this public inbox
https://git.savannah.gnu.org/cgit/guix.git
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).