From mboxrd@z Thu Jan 1 00:00:00 1970 From: Leo Famulari Subject: libssh vulnerability Date: Sun, 21 Oct 2018 15:19:19 -0400 Message-ID: <20181021191919.GB18445@jasmine.lan> References: <87efcp74ip.fsf@dustycloud.org> <87bm7ti3hd.fsf@gnu.org> <20181017054252.GA21802@jasmine.lan> <87woqgiuiv.fsf@dustycloud.org> <87o9bope37.fsf@gmail.com> Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="A6N2fC+uXW/VQSAv" Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:60414) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1gEJRA-0001iB-3a for guix-devel@gnu.org; Sun, 21 Oct 2018 15:30:56 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1gEJG3-0004k6-JN for guix-devel@gnu.org; Sun, 21 Oct 2018 15:19:33 -0400 Received: from out3-smtp.messagingengine.com ([66.111.4.27]:36945) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1gEJG3-0004jv-4n for guix-devel@gnu.org; Sun, 21 Oct 2018 15:19:27 -0400 Content-Disposition: inline In-Reply-To: <87o9bope37.fsf@gmail.com> List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: "Guix-devel" To: Chris Marusich Cc: Guix-devel --A6N2fC+uXW/VQSAv Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Sat, Oct 20, 2018 at 01:17:48PM -0700, Chris Marusich wrote: > Will this change trigger many rebuilds? It has many dependents: >=20 > --8<---------------cut here---------------start------------->8--- > $ guix refresh -l libssh2 > Building the following 1321 packages would ensure 3307 dependent > packages are rebuilt: [...] > --8<---------------cut here---------------end--------------->8--- It's true that libssh2 has too many dependents to update without a graft. However, libssh, which is what was changed, only has a handful of dependents, which is convenient for us :) ------ $ guix refresh -l libssh Building the following 9 packages would ensure 12 dependent packages are re= built: kodi@18.0_alpha-8.ec16dbc wireshark@2.6.4 guile2.0-guix@0.15.0-5.1d0= be47 cuirass@0.0.1-20.fe2b73c emacs-guix@0.5 gwl@0.1.1 hpcguix-web@0.0.1-3.= 53e09ea guile2.2-ssh@0.11.3 tmate@2.2.1 ------ It's confusing, but libssh and libssh2 are totally separate projects. And for the record, they are also not related to OpenSSH, which is the one we all know and use directly. --A6N2fC+uXW/VQSAv Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEsFFZSPHn08G5gDigJkb6MLrKfwgFAlvM0TcACgkQJkb6MLrK fwiHYQ/+JTODqWTH2VJXxGGFNQkUhGgniUiNRb/CBpHzDBoNUmgKuLOcwA9J3DpM sizU/P8FPBMmODzM5YB7EidOsf7nweeMWYpARGmVrEUuy8lVoNprXEfb9l/euArZ rZo4N/liqWdBvhA7XIUJTMeiKGwh0mJjB9cSiXCtzDB8aJ1MKiZOjXvdGAuFQARe bLhS2Bivg8MiG1ZTC4ilEOMdmGpXZMAukQtMZ48TVBuos+UaMuqGubjxwvvSoelw gvypGSoi4wJeQks2huanT3UtN0LA4AQxjbSSzYF/am0OrlM+K6e7INpvMUO59K+H mY3rIb2ujwFZi9klzhG/IEAGfW8yRHFfJNS1EODRHYB8KuzFmMfTqJiGG7YYMtF9 Kj8AQg43rZW55H4DK2OPAz/yQ6isgDdhGDQzZw4RsI06bZLGSOjLRLTjXPDlJ8ed Sl4+kMgZrYoltV4nvjxxkShbYkIfmrbasq2vFIK9etCliY3O0n6wR0AUmdQfX+jv Q1lfhLcWWOwU8hCqhdVQ6SlcLEnOoR2a5u2VS2X7/oS36zgcrn2h6WE+LRtvCyow cYxN5+e58Pjb5wlZAmC05tT91UPylcgeUBhKpaifFREs0x2yaVhZatMtST8TrKYg h5IqbkO+uAfm2XVrfx6M8UQ38ihw23Ny1f3OTYk6yI8Wt7OUEjk= =2ntm -----END PGP SIGNATURE----- --A6N2fC+uXW/VQSAv--