From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([209.51.188.92]:53502) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1gtMD6-0001cD-VQ for guix-patches@gnu.org; Mon, 11 Feb 2019 19:46:06 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1gtMD5-0007s3-S3 for guix-patches@gnu.org; Mon, 11 Feb 2019 19:46:04 -0500 Received: from debbugs.gnu.org ([209.51.188.43]:44987) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1gtMD5-0007rB-IP for guix-patches@gnu.org; Mon, 11 Feb 2019 19:46:03 -0500 Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.84_2) (envelope-from ) id 1gtMD3-0002q1-Ju for guix-patches@gnu.org; Mon, 11 Feb 2019 19:46:03 -0500 Subject: [bug#34446] [PATCH 1/2] gnu: runc: Update to 1.0.0-rc6 [fixes CVE-2019-5736]. Resent-Message-ID: Date: Tue, 12 Feb 2019 01:45:01 +0100 From: Danny Milosavljevic Message-ID: <20190212014501.31dcb6a8@scratchpost.org> In-Reply-To: <61ed83d852124caae74fd8cd53a9c375ee3ac80d.1549931256.git.leo@famulari.name> References: <20190211233708.GA2509@jasmine.lan> <61ed83d852124caae74fd8cd53a9c375ee3ac80d.1549931256.git.leo@famulari.name> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha256; boundary="Sig_/x04HAfNoTi04YUeUl+HIbyV"; protocol="application/pgp-signature" List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-patches-bounces+kyle=kyleam.com@gnu.org Sender: "Guix-patches" To: Leo Famulari Cc: 34446@debbugs.gnu.org --Sig_/x04HAfNoTi04YUeUl+HIbyV Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: quoted-printable On Mon, 11 Feb 2019 19:27:35 -0500 Leo Famulari wrote: > (define-public runc > (package > (name "runc") > - (version "1.0.0-rc5") > + (version "1.0.0-rc6") > (source (origin > (method url-fetch) > (uri (string-append > "https://github.com/opencontainers/runc/releases/" > "download/v" version "/runc.tar.xz")) > + (file-name (string-append name "-" version ".tar.xz")) > + (patches (search-patches "runc-CVE-2019-5736.patch")) > (sha256 > (base32 > - "081avdzwnqpk368wbaihlzsypaxpj42d7699h7jgp0fks14x4103"))= )) > + "1c7832dq70slkjh8qp2civ1wxhhdd2hrx84pq7db1mmqc9fdr3cc"))= )) > (build-system go-build-system) > (arguments > '(#:import-path "github.com/opencontainers/runc" Docker still contains some vendored dependencies, among those github.com/op= encontainers/runc, in directory "vendor", and so does containerd. It might make sense to also= remove them now. --Sig_/x04HAfNoTi04YUeUl+HIbyV Content-Type: application/pgp-signature Content-Description: OpenPGP digital signature -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEEds7GsXJ0tGXALbPZ5xo1VCwwuqUFAlxiFw0ACgkQ5xo1VCww uqVnJwf/eHV/npPpHWzXmmxBHBRIg1rBXbX8u1minq5VdWC/ZAR5glcI9in4OKeu Yxzwpe2sYiCG3XBtRvX47eVUXEAxMNt7k3D8pWi+vC9i1oPe05cVofP/qNqWnV6i oAIX2h0m04e829f3YjWfB/7dnDAg9DtlKnTIvR5AN/vYFCcERO0h38h4ZJ6k4fT0 EXj/LQXbkmrFElCfaU/h/TBAXCeBRsNDVA7/9JnEsmHjR1bz7Gw8gyvqj+8fZ2Jv 9M1UODihGeYIaM8AfKWsiLY1ashumSgzsl8qqKwtsVNKSl+zMu6ENGr6fJPIU6Nq hK+qg4mMxOSp4Ywm5dNag0p/Y861eg== =cQtd -----END PGP SIGNATURE----- --Sig_/x04HAfNoTi04YUeUl+HIbyV--