From: Alex Vong <alexvong1995@gmail.com>
To: Ricardo Wurmus <rekado@elephly.net>
Cc: 27749@debbugs.gnu.org
Subject: [bug#27749] [PATCH] gnu: heimdal: Update to 7.4.0 [fixes CVE-2017-11103].
Date: Sat, 21 Oct 2017 17:52:58 +0800 [thread overview]
Message-ID: <87k1zon7yd.fsf@gmail.com> (raw)
In-Reply-To: <87vajbchiv.fsf@gmail.com> (Alex Vong's message of "Thu, 19 Oct 2017 22:57:12 +0800")
[-- Attachment #1.1: Type: text/plain, Size: 366 bytes --]
Hello,
This is the new patch. It is basically the first patch but with the
sqlite and libedit bundled dependecies removed. I don't know if there
are any other bundled dependencies so I am asking this on the heimdal
mailing list.
Also, since I am not a user of heimdal, we need someone to check if the
new version does work properly (as some test failures occur).
[-- Attachment #1.2: 0001-gnu-heimdal-Update-to-7.4.0.patch --]
[-- Type: text/x-diff, Size: 6463 bytes --]
From 4b2fcc8998da79aea5b09d5646569906bb447638 Mon Sep 17 00:00:00 2001
From: Alex Vong <alexvong1995@gmail.com>
Date: Tue, 18 Jul 2017 06:36:48 +0800
Subject: [PATCH] gnu: heimdal: Update to 7.4.0.
* gnu/packages/kerberos.scm (heimdal): Update to 7.4.0.
[source]: Update source uri.
[arguments]: Adjust #:configure-flags and build phases accordingly.
[inputs]: Add autoconf, automake, libtool, perl, perl-json, texinfo, unzip
and sqlite.
---
gnu/packages/kerberos.scm | 86 +++++++++++++++++++++++++++++++++++------------
1 file changed, 64 insertions(+), 22 deletions(-)
diff --git a/gnu/packages/kerberos.scm b/gnu/packages/kerberos.scm
index 801b4e44a..fde310e65 100644
--- a/gnu/packages/kerberos.scm
+++ b/gnu/packages/kerberos.scm
@@ -6,6 +6,7 @@
;;; Copyright © 2012, 2013 Nikita Karetnikov <nikita@karetnikov.org>
;;; Copyright © 2012, 2017 Ludovic Courtès <ludo@gnu.org>
;;; Copyright © 2017 Ricardo Wurmus <rekado@elephly.net>
+;;; Copyright © 2017 Alex Vong <alexvong1995@gmail.com>
;;;
;;; This file is part of GNU Guix.
;;;
@@ -145,16 +146,15 @@ secure manner through client-server mutual authentication via tickets.")
(define-public heimdal
(package
(name "heimdal")
- (version "1.5.3")
+ (version "7.4.0")
(source (origin
(method url-fetch)
- (uri (string-append "http://www.h5l.org/dist/src/heimdal-"
- version ".tar.gz"))
+ (uri (string-append "https://github.com/" name "/" name
+ "/releases/download/" name "-" version
+ "/" name "-" version ".tar.gz"))
(sha256
(base32
- "19gypf9vzfrs2bw231qljfl4cqc1riyg0ai0xmm1nd1wngnpphma"))
- (patches (search-patches "heimdal-CVE-2017-6594.patch"
- "heimdal-CVE-2017-11103.patch"))
+ "1b992ifwnr06h89f8vqp1l0z8ixh29sk9nhk99lw28dd6v6lxq9x"))
(modules '((guix build utils)))
(snippet
'(substitute* "configure"
@@ -162,33 +162,75 @@ secure manner through client-server mutual authentication via tickets.")
(("Date=.*$") "Date=2017\n")))))
(build-system gnu-build-system)
(arguments
- '(#:configure-flags (list
- ;; Work around a linker error.
- "CFLAGS=-pthread"
+ '(#:modules ((guix build gnu-build-system)
+ (guix build utils)
+ (srfi srfi-26))
+
+ #:configure-flags (list
+ (string-append "CPPFLAGS=-D_PATH_BSHELL="
+ (assoc-ref %build-inputs "bash")
+ "/bin/sh")
;; Avoid 7 MiB of .a files.
"--disable-static"
;; Do not build libedit.
- (string-append
- "--with-readline-lib="
- (assoc-ref %build-inputs "readline") "/lib")
- (string-append
- "--with-readline-include="
- (assoc-ref %build-inputs "readline") "/include"))
+ (string-append "--with-readline="
+ (assoc-ref %build-inputs "readline"))
+
+ ;; Do not build sqlite.
+ (string-append "--with-sqlite3="
+ (assoc-ref %build-inputs "sqlite")))
#:phases (modify-phases %standard-phases
+ (add-after 'unpack 'pre-build
+ (lambda _
+ (for-each (lambda (file) ;fix sh paths
+ (substitute* file
+ (("/bin/sh")
+ (which "sh"))))
+ '("appl/afsutil/pagsh.c" "tools/Makefile.am"))
+ (substitute* "lib/roken/getxxyyy.c" ;set user during test
+ (("user = getenv\\(\"USER\"\\);")
+ (format #f
+ "#ifndef TEST_GETXXYYY
+#error \"TEST_GETXXYYY is not defined\"
+#endif
+user = \"~a\";
+"
+ (passwd:name (getpwuid (getuid))))))
+ #t))
+
+ (add-after 'pre-build 'autogen
+ (lambda _
+ (zero? (system* "sh" "autogen.sh"))))
+
+ ;; FIXME: figure out the complete list of bundled libraries
+ (add-after 'configure 'remove-bundled-libraries
+ (lambda _
+ (for-each delete-file-recursively
+ '("lib/libedit" "lib/sqlite"))))
+
(add-before 'check 'skip-tests
(lambda _
- ;; The test simply runs 'ftp --version && ftp --help'
- ;; but that fails in the chroot because 'ftp' tries to
- ;; do a service lookup before printing the help/version.
- (substitute* "appl/ftp/ftp/Makefile.in"
- (("^CHECK_LOCAL =.*")
- "CHECK_LOCAL = no-check-local\n"))
+ ;; skip db tests for now
+ ;; FIXME: figure out why they fail
+ (call-with-output-file "tests/db/have-db.in"
+ (cut format <> "#!~a~%exit 1~%" (which "sh")))
#t)))))
+
(native-inputs `(("e2fsprogs" ,e2fsprogs))) ;for 'compile_et'
- (inputs `(("readline" ,readline)
+ (inputs `(("autoconf" ,autoconf) ;for autogen
+ ("automake" ,automake)
+ ("libtool" ,libtool)
+ ("perl" ,perl)
+ ("perl-json" ,perl-json)
+
+ ("texinfo" ,texinfo) ;for doc
+ ("unzip" ,unzip) ;for test
+
+ ("readline" ,readline)
+ ("sqlite" ,sqlite)
("bdb" ,bdb)
("e2fsprogs" ,e2fsprogs))) ;for libcom_err
(home-page "http://www.h5l.org/")
--
2.14.2
[-- Attachment #1.3: Type: text/plain, Size: 14 bytes --]
Cheers,
Alex
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 832 bytes --]
next prev parent reply other threads:[~2017-10-21 9:54 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-07-18 8:26 [bug#27749] [PATCH] gnu: heimdal: Update to 7.4.0 [fixes CVE-2017-11103] Alex Vong
2017-07-18 15:49 ` Leo Famulari
2017-07-18 15:51 ` Leo Famulari
2017-07-18 15:53 ` Leo Famulari
2017-07-19 9:22 ` Alex Vong
2017-07-19 11:04 ` Alex Vong
2017-07-20 19:51 ` Leo Famulari
2017-10-18 21:31 ` Ricardo Wurmus
2017-10-19 14:57 ` Alex Vong
2017-10-21 9:52 ` Alex Vong [this message]
2017-11-26 22:59 ` Leo Famulari
2018-06-10 8:04 ` bug#27749: " 宋文武
2018-06-25 3:16 ` [bug#27749] " Alex Vong
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
List information: https://guix.gnu.org/
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87k1zon7yd.fsf@gmail.com \
--to=alexvong1995@gmail.com \
--cc=27749@debbugs.gnu.org \
--cc=rekado@elephly.net \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this public inbox
https://git.savannah.gnu.org/cgit/guix.git
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).