libssh vulnerability

[Leo Famulari <leo@famulari.name>]

[-- Attachment #1: Type: text/plain, Size: 1080 bytes --]

On Sat, Oct 20, 2018 at 01:17:48PM -0700, Chris Marusich wrote:
> Will this change trigger many rebuilds?  It has many dependents:
> 
> --8<---------------cut here---------------start------------->8---
> $ guix refresh -l libssh2
> Building the following 1321 packages would ensure 3307 dependent
> packages are rebuilt: [...]
> --8<---------------cut here---------------end--------------->8---

It's true that libssh2 has too many dependents to update without a
graft. However, libssh, which is what was changed, only has a handful of
dependents, which is convenient for us :)

------
$ guix refresh -l libssh
Building the following 9 packages would ensure 12 dependent packages are rebuilt: kodi@18.0_alpha-8.ec16dbc wireshark@2.6.4 guile2.0-guix@0.15.0-5.1d0be47 cuirass@0.0.1-20.fe2b73c emacs-guix@0.5 gwl@0.1.1 hpcguix-web@0.0.1-3.53e09ea guile2.2-ssh@0.11.3 tmate@2.2.1
------

It's confusing, but libssh and libssh2 are totally separate projects.
And for the record, they are also not related to OpenSSH, which is the
one we all know and use directly.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]