On Thu, Jan 11, 2018 at 10:25:33PM +0100, Ludovic Courtès wrote:
> Hi,
> 
> Leo Famulari <leo@famulari.name> skribis:
> 
> > * gnu/packages/patches/libvorbis-CVE-2017-14632.patch,
> > gnu/packages/patches/libvorbis-CVE-2017-14633.patch: New files.
> > * gnu/local.mk (dist_patch_DATA): Add them.
> > * gnu/packages/xiph.scm (libvorbis)[replacement]: New field.
> > (libvorbis/fixed): New variable.
> 
> LGTM.

Pushed as 138c08899ba73049de8afd2b74a8cf6845a1d9e1

> On ‘core-updates’, should we perform a rebuild instead of grafting?

Yes, I merged master into core-updates and ungrafted libvorbis in
e6ebc7b13225f0eddc404b7d8e136120b962181e