From: John Darrington <jmd@gnu.org>
To: Kei Kebreau <kei@openmailbox.org>
Cc: guix-devel@gnu.org, 26109@debbugs.gnu.org
Subject: Re: bug#26109: [PATCH 3/7] gnu: Add dcmtk.
Date: Sat, 18 Mar 2017 13:36:31 -0400 [thread overview]
Message-ID: <20170318173630.GA14983@gnu.org> (raw)
In-Reply-To: <87mvci5ze3.fsf@openmailbox.org>
[CC guix-devel@gnu.org]
So we have to make a choice:
1. Package a released program with a known vulnerability; or
2. Package an unreleased git snapshot.
Which is the lesser evil?
J'
On Sat, Mar 18, 2017 at 12:21:40PM -0400, Kei Kebreau wrote:
> John Darrington <john@darrington.wattle.id.au> writes:
>
> > On Fri, Mar 17, 2017 at 04:42:59PM -0400, Kei Kebreau wrote:
> >
> > Judging from the description of the software, it seems like this could
> > fit in gnu/packages/image.scm.
> > Also, the linter says that this package vulnerable to
> > CVE-2015-8979. Supposedly this* upstream patch fixes it. Could you see
> > if that fix works for this package?
> >
> > * https://github.com/commontk/DCMTK/commit/1b6bb76
> >
> >
> > Unfortunately this patch doesn't go in. It seems that as well as fixing this
> > vulnerability it also makes some unrelated changes. Furthermore, it depends
> > on a whole lot of other patches which are not in this release.
> >
> > Do we have a procedure on what to do in cases like this?
> >
> > J'
>
> I don't know if we have an official procedure, though we could try using
> a later git snapshot with the security patch already integrated.
> Hopefully that provides functionality compatible to that of the stable
> release, though it's at least a five year difference between release times.
>
> http://git.cmtk.org/?p=dcmtk.git,a=tags
next parent reply other threads:[~2017-03-18 17:36 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <1489608324-23632-1-git-send-email-jmd@gnu.org>
[not found] ` <1489608324-23632-3-git-send-email-jmd@gnu.org>
[not found] ` <871stv7hyk.fsf@openmailbox.org>
[not found] ` <20170318072335.GA12217@jocasta.intra>
[not found] ` <87mvci5ze3.fsf@openmailbox.org>
2017-03-18 17:36 ` John Darrington [this message]
2017-03-21 1:47 ` bug#26109: [PATCH 3/7] gnu: Add dcmtk Kei Kebreau
2017-03-21 2:13 ` Leo Famulari
[not found] ` <20170321021240.GA29321@jasmine>
[not found] ` <20170321023043.GA455@jocasta.intra>
[not found] ` <20170321183012.GC28482@jasmine>
2017-05-15 21:07 ` Ricardo Wurmus
[not found] ` <1489608324-23632-6-git-send-email-jmd@gnu.org>
2017-03-30 13:15 ` bug#26108: [PATCH 6/7] gnu: Add mia Ricardo Wurmus
2017-03-31 5:27 ` John Darrington
2017-05-15 21:09 ` Ricardo Wurmus
[not found] ` <1489608324-23632-5-git-send-email-jmd@gnu.org>
2017-05-11 6:44 ` bug#26111: [PATCH 5/7] gnu: Add vtk version 6.3.0 Ricardo Wurmus
[not found] ` <1489608324-23632-7-git-send-email-jmd@gnu.org>
2017-06-02 16:31 ` bug#26110: [PATCH 7/7] gnu: Move vtk to image-processing.scm Ludovic Courtès
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20170318173630.GA14983@gnu.org \
--to=jmd@gnu.org \
--cc=26109@debbugs.gnu.org \
--cc=guix-devel@gnu.org \
--cc=kei@openmailbox.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this external index
https://git.savannah.gnu.org/cgit/guix.git
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.