[bug#33783] [PATCH] gnu: sqlite: Replace with 3.26.0 [security fixes].

[bug#33783] [PATCH] gnu: sqlite: Replace with 3.26.0 [security fixes].

[Alex Vong]

[-- Attachment #1.1: Type: text/plain, Size: 227 bytes --]

Tag: security

Hello,

This patch grafts sqlite to its latest version. It also changes all the
sqlite-* packages to use 'package/inherit' so that they get the
replacement as well. See <https://bugs.gnu.org/33751> for details.


[-- Attachment #1.2: 0001-gnu-sqlite-Replace-with-3.26.0-security-fixes.patch --]
[-- Type: text/x-diff, Size: 3242 bytes --]

From 9d0fae1e1fa2fc13bd794bb2dbeb89750c772cfb Mon Sep 17 00:00:00 2001
From: Alex Vong <alexvong1995@gmail.com>
Date: Tue, 18 Dec 2018 10:36:52 +0800
Subject: [PATCH] gnu: sqlite: Replace with 3.26.0 [security fixes].

Fixes <https://bugs.gnu.org/33751>.
Reported by Marius Bakke <mbakke@fastmail.com>.

* gnu/packages/databases.scm (sqlite-3.26.0): New public variable.
(sqlite)[replacement]: Use it.
(sqlite-with-fts5): Use 'package/inherit'.
(sqlite-with-column-metadata): Likewise.
---
 gnu/packages/databases.scm | 27 ++++++++++++++++++++++++---
 1 file changed, 24 insertions(+), 3 deletions(-)

diff --git a/gnu/packages/databases.scm b/gnu/packages/databases.scm
index 0fa6d451e..78d9a6739 100644
--- a/gnu/packages/databases.scm
+++ b/gnu/packages/databases.scm
@@ -24,7 +24,7 @@
 ;;; Copyright © 2017 Adriano Peluso <catonano@gmail.com>
 ;;; Copyright © 2017 Arun Isaac <arunisaac@systemreboot.net>
 ;;; Copyright © 2017, 2018 Tobias Geerinckx-Rice <me@tobias.gr>
-;;; Copyright © 2017 Alex Vong <alexvong1995@gmail.com>
+;;; Copyright © 2017, 2018 Alex Vong <alexvong1995@gmail.com>
 ;;; Copyright © 2017, 2018 Ben Woodcroft <donttrustben@gmail.com>
 ;;; Copyright © 2017 Rutger Helling <rhelling@mykolab.com>
 ;;; Copyright © 2017, 2018 Pierre Langlois <pierre.langlois@gmx.com>
@@ -1183,6 +1183,7 @@ changes.")
 (define-public sqlite
   (package
    (name "sqlite")
+   (replacement sqlite-3.26.0)
    (version "3.24.0")
    (source (origin
             (method url-fetch)
@@ -1219,9 +1220,29 @@ widely deployed SQL database engine in the world.  The source code for SQLite
 is in the public domain.")
    (license license:public-domain)))
 
+(define-public sqlite-3.26.0
+  (package/inherit sqlite
+    (version "3.26.0")
+    (source (origin
+              (method url-fetch)
+              (uri (let ((numeric-version
+                          (match (string-split version #\.)
+                            ((first-digit other-digits ...)
+                             (string-append first-digit
+                                            (string-pad-right
+                                             (string-concatenate
+                                              (map (cut string-pad <> 2 #\0)
+                                                   other-digits))
+                                             6 #\0))))))
+                     (string-append "https://sqlite.org/2018/sqlite-autoconf-"
+                                    numeric-version ".tar.gz")))
+              (sha256
+               (base32
+                "0pdzszb4sp73hl36siiv3p300jvfvbcdxi2rrmkwgs6inwznmajx"))))))
+
 ;; This is used by Tracker.
 (define-public sqlite-with-fts5
-  (package (inherit sqlite)
+  (package/inherit sqlite
     (name "sqlite-with-fts5")
     (arguments
      (substitute-keyword-arguments (package-arguments sqlite)
@@ -1230,7 +1251,7 @@ is in the public domain.")
 
 ;; This is used by Qt.
 (define-public sqlite-with-column-metadata
-  (package (inherit sqlite)
+  (package/inherit sqlite
     (name "sqlite-with-column-metadata")
     (arguments
      (substitute-keyword-arguments (package-arguments sqlite)
-- 
2.19.2


[-- Attachment #1.3: Type: text/plain, Size: 14 bytes --]


Cheers,
Alex

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 227 bytes --]

[bug#33783] [PATCH] gnu: sqlite: Replace with 3.26.0 [security fixes].

[Mark H Weaver]

I applied your proposed patch to my private branch and updated my x86_64
GuixSD system with GNOME 3, and my user profiles including IceCat.
Everything seems to work well, and I've verified that IceCat is using
the new sqlite.

Please push this to master.

     Thanks!
       Mark

[bug#33783] [PATCH] gnu: sqlite: Replace with 3.26.0 [security fixes].

[Mark H Weaver]

Actually, there's one small problem with the patch: you should not use
'package/inherit' to define the replacement itself.  That leads to a
circular definition and an infinite series of replacements.  I guess the
grafting machinery copes with this somehow, but I'd prefer to avoid it.

I will soon push a slightly modified version of this patch.

      Mark

[bug#33783] [PATCH] gnu: sqlite: Replace with 3.26.0 [security fixes].

[Alex Vong]

[-- Attachment #1: Type: text/plain, Size: 546 bytes --]

Mark H Weaver <mhw@netris.org> writes:

> Actually, there's one small problem with the patch: you should not use
> 'package/inherit' to define the replacement itself.  That leads to a
> circular definition and an infinite series of replacements.  I guess
> the
> grafting machinery copes with this somehow, but I'd prefer to avoid
> it.
>
I thought 'package/inherit' is a generalization of the previous
construct, but as you pointed out, it is not.

> I will soon push a slightly modified version of this patch.
>
OK!

>       Mark

Cheers,
Alex

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 227 bytes --]

bug#33783: [PATCH] gnu: sqlite: Replace with 3.26.0 [security fixes].

[Efraim Flashner]

[-- Attachment #1: Type: text/plain, Size: 275 bytes --]

Patch was pushed as 38abef124bc18d3834eb12352a974b6143f62e97

-- 
Efraim Flashner   <efraim@flashner.co.il>   אפרים פלשנר
GPG key = A28B F40C 3E55 1372 662D  14F7 41AA E7DC CA3D 8351
Confidentiality cannot be guaranteed on emails sent or received unencrypted

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]