From mboxrd@z Thu Jan 1 00:00:00 1970 From: Leo Famulari Subject: Re: [PATCH 0/1] OpenSSL 1.1.0 Date: Sat, 3 Sep 2016 22:48:57 -0400 Message-ID: <20160904024857.GA31437@jasmine> References: <87y43albe9.fsf@gnu.org> <20160902201422.GA3701@jasmine> <8737lhm6rk.fsf@gnu.org> <20160903140613.GB12802@jasmine> <87oa45jblg.fsf@gnu.org> <20160904022049.GA30856@jasmine> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:53151) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bgNUh-0004yT-IP for guix-devel@gnu.org; Sat, 03 Sep 2016 22:49:16 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1bgNUb-0001ri-IK for guix-devel@gnu.org; Sat, 03 Sep 2016 22:49:14 -0400 Content-Disposition: inline In-Reply-To: <20160904022049.GA30856@jasmine> List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: "Guix-devel" To: Ludovic =?iso-8859-1?Q?Court=E8s?= Cc: guix-devel@gnu.org On Sat, Sep 03, 2016 at 10:20:49PM -0400, Leo Famulari wrote: > On Sat, Sep 03, 2016 at 04:34:51PM +0200, Ludovic Courtès wrote: > > Yes, but as long the ‘openssl’ refers to 1.0.x, it doesn’t really matter > > than the “openssl” package points to the latest one, no? Use can still > > run “guix package -i openssl@1.0” if they want. > > Oh, right :) > > I've attached a patch for review. By the way, if you run `guix lint`, you will see a warning about CVE-2016-2183. I think we will be unaffected; this vulnerability will only manifest if we build with "--enable-weak-ssl-ciphers". https://www.openssl.org/blog/blog/2016/08/24/sweet32/