From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from eggs.gnu.org ([2001:4830:134:3::10]:47251)
	by lists.gnu.org with esmtp (Exim 4.71)
	(envelope-from <Debian-debbugs@debbugs.gnu.org>) id 1fI9Sg-0007SP-9i
	for guix-patches@gnu.org; Mon, 14 May 2018 05:08:13 -0400
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
	(envelope-from <Debian-debbugs@debbugs.gnu.org>) id 1fI9Sc-0003dZ-BW
	for guix-patches@gnu.org; Mon, 14 May 2018 05:08:06 -0400
Received: from debbugs.gnu.org ([208.118.235.43]:53616)
	by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16)
	(Exim 4.71) (envelope-from <Debian-debbugs@debbugs.gnu.org>)
	id 1fI9Sc-0003dL-6l
	for guix-patches@gnu.org; Mon, 14 May 2018 05:08:02 -0400
Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.84_2)
	(envelope-from <Debian-debbugs@debbugs.gnu.org>) id 1fI9Sb-0002A2-Tg
	for guix-patches@gnu.org; Mon, 14 May 2018 05:08:01 -0400
Subject: [bug#31444] 'guix health': a tool to report vulnerable packages
Resent-Message-ID: <handler.31444.B31444.15262888468266@debbugs.gnu.org>
From: ludo@gnu.org (Ludovic =?UTF-8?Q?Court=C3=A8s?=)
References: <87fu2vjj76.fsf@gnu.org>
	<f7776a30-f164-3b78-5164-3df5d7d84718@uni-bremen.de>
Date: Mon, 14 May 2018 11:07:10 +0200
In-Reply-To: <f7776a30-f164-3b78-5164-3df5d7d84718@uni-bremen.de> (Martin
	Castillo's message of "Mon, 14 May 2018 10:06:46 +0200")
Message-ID: <87r2mea9mp.fsf@gnu.org>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
List-Id: <guix-patches.gnu.org>
List-Unsubscribe: <https://lists.gnu.org/mailman/options/guix-patches>,
	<mailto:guix-patches-request@gnu.org?subject=unsubscribe>
List-Archive: <http://lists.gnu.org/archive/html/guix-patches/>
List-Post: <mailto:guix-patches@gnu.org>
List-Help: <mailto:guix-patches-request@gnu.org?subject=help>
List-Subscribe: <https://lists.gnu.org/mailman/listinfo/guix-patches>,
	<mailto:guix-patches-request@gnu.org?subject=subscribe>
Errors-To: guix-patches-bounces+kyle=kyleam.com@gnu.org
Sender: "Guix-patches" <guix-patches-bounces+kyle=kyleam.com@gnu.org>
To: Martin Castillo <castilma@uni-bremen.de>
Cc: 31444@debbugs.gnu.org

Hello,

Martin Castillo <castilma@uni-bremen.de> skribis:

> On 14.05.2018 00:15, Ludovic Court=C3=A8s wrote:
>> [...] shadow@4.6 is available and fixes CVE-2018-7169, consider ugprading
>                                                                   ^typo
>
>> Should we satisfy ourselves with the current approach in the meantime?
>
> Release early and often would say yes. But I'm not an experienced develop=
er.

OK.

> I have the feeling that guix lint does not cache the CVEs it fetches. I
> think it should.

It does: it caches them in ~/.cache/guix/http and then uses
=E2=80=98If-Modified-Since=E2=80=99 to avoid re-fetching the database if th=
e cached copy
is up-to-date.

Now the 2018 database obviously keeps changing, so caching helps when
you=E2=80=99re running =E2=80=98guix lint=E2=80=99 several times in a row (=
say while reviewing
packages), but it doesn=E2=80=99t help much if you run it once a day or les=
s.

Also, it fetches the whole database for a year.  I think they publish
diffs as well, but using them seems tricky.

Ludo=E2=80=99.