[bug#61576] [PATCH 00/21] Allow USB redirection as an unprivileged user in in GNOME Boxes

[bug#61576] [PATCH 00/21] Allow USB redirection as an unprivileged user in in GNOME Boxes

[Maxim Cournoyer]

Hi,

This series makes the USB redirection feature of GNOME Boxes works as
intended, as your normal user.  It also add features and updates our spice-gtk
package and bring GNOME Boxes to its latest version.

Thanks!


Maxim Cournoyer (21):
  gnu: spice-gtk: Fix indentation and normalize field order.
  gnu: spice-gtk: Remove input labels.
  gnu: spice-gtk: Use gexps.
  gnu: spice-gtk: Update to 0.42.
  gnu: spice-gtk: Propagate libjpeg-turbo, lz4, opus, and usbredir.
  gnu: spice-protocol: Update to 0.14.4.
  gnu: usbredir: Update to 0.13.0.
  gnu: virglrenderer: Update to 0.7.0.
  gnu: libcacard: Remove obsolete configure flags.
  gnu: spice: Update to 0.15.1.
  gnu: spice-vdagent: Update to 0.22.1.
  gnu: usbutils: Update to 015.
  gnu: phodav: Propagate glib, libsoup and libxml2.
  gnu: spice-gtk: Enable support for polkit, webdav and others.
  gnu: osinfo-db: Use libsoup 3.
  gnu: gnome-boxes: Update to 43.3.
  services: gnome-polkit-settings: Add spice-gtk.
  services: desktop: Extract a new gnome-package procedure.
  services: gnome-desktop-service-type: Extend
    setuid-program-service-type.
  gnu: gnome-boxes: Mention extra configuration requirements.
  gnu: spice-gtk: Adjust the default file name of the ACL helper binary.

 gnu/local.mk                                  |   2 -
 gnu/packages/gnome.scm                        |  37 +--
 gnu/packages/linux.scm                        |   4 +-
 .../patches/spice-vdagent-glib-2.68.patch     | 112 ---------
 .../patches/virglrenderer-CVE-2017-6386.patch |  54 -----
 gnu/packages/spice.scm                        | 220 +++++++++---------
 gnu/packages/virtualization.scm               |   2 +-
 gnu/services/desktop.scm                      |  68 ++++--
 8 files changed, 183 insertions(+), 316 deletions(-)
 delete mode 100644 gnu/packages/patches/spice-vdagent-glib-2.68.patch
 delete mode 100644 gnu/packages/patches/virglrenderer-CVE-2017-6386.patch


base-commit: c3dd743b9a7bc9bb72718957680dfe9a618cb138
-- 
2.39.1

[bug#61576] [PATCH 01/21] gnu: spice-gtk: Fix indentation and normalize field order.

[Maxim Cournoyer]

* gnu/packages/spice.scm (spice-gtk): Fix indentation.  Move and re-order
inputs below arguments.
---

 gnu/packages/spice.scm | 120 ++++++++++++++++++++---------------------
 1 file changed, 58 insertions(+), 62 deletions(-)

diff --git a/gnu/packages/spice.scm b/gnu/packages/spice.scm
index 2be724c455..139ef4867e 100644
--- a/gnu/packages/spice.scm
+++ b/gnu/packages/spice.scm
@@ -141,73 +141,69 @@ (define-public spice-gtk
     (source (origin
               (method url-fetch)
               (uri (string-append
-                "https://spice-space.org/download/gtk/"
-                "spice-gtk-" version ".tar.bz2"))
+                    "https://spice-space.org/download/gtk/"
+                    "spice-gtk-" version ".tar.bz2"))
               (sha256
                (base32
                 "1drvj8y35gnxbnrxsipwi15yh0vs9ixzv4wslz6r3lra8w3bfa0z"))))
     (build-system gnu-build-system)
-    (propagated-inputs
-      (list gstreamer
-            gst-plugins-base
-            gst-plugins-good
-            spice-protocol
-            ;; These are required by the pkg-config files.
-            gtk+
-            pixman
-            openssl-1.1))
-    (inputs
-      `(("glib-networking" ,glib-networking)
-        ("gobject-introspection" ,gobject-introspection)
-        ("json-glib" ,json-glib)
-        ("libepoxy" ,libepoxy)
-        ("libjpeg" ,libjpeg-turbo)
-        ("libxcb" ,libxcb)
-        ("lz4" ,lz4)
-        ("mesa" ,mesa)
-        ("pulseaudio" ,pulseaudio)
-        ("python" ,python)
-        ("opus" ,opus)
-        ("usbredir" ,usbredir)))
-    (native-inputs
-      `(("glib:bin" ,glib "bin")
-        ("intltool" ,intltool)
-        ("pkg-config" ,pkg-config)
-        ("vala" ,vala)))
     (arguments
-      `(#:configure-flags
-        '("--enable-gstaudio"
-          "--enable-gstvideo"
-          "--enable-pulse"
-          "--enable-vala"
-          "--enable-introspection")
-        #:phases
-         (modify-phases %standard-phases
-           (add-before 'check 'disable-session-test
-             (lambda _
-               ;; XXX: Disable session tests, because they require USB support,
-               ;; which is not available in the build container.
-               (substitute* "tests/Makefile"
-                 (("test-session\\$\\(EXEEXT\\) ") ""))
-               #t))
-           (add-after 'install 'patch-la-files
-             (lambda* (#:key inputs outputs #:allow-other-keys)
-               (let ((out (assoc-ref outputs "out"))
-                     (libjpeg (assoc-ref inputs "libjpeg")))
-                 ;; Add an absolute reference for libjpeg in the .la files
-                 ;; so it does not have to be propagated.
-                 (substitute* (find-files (string-append out "/lib") "\\.la$")
-                   (("-ljpeg")
-                    (string-append "-L" libjpeg "/lib -ljpeg")))
-                 #t)))
-           (add-after
-            'install 'wrap-spicy
-            (lambda* (#:key inputs outputs #:allow-other-keys)
-              (let ((out             (assoc-ref outputs "out"))
-                    (gst-plugin-path (getenv "GST_PLUGIN_SYSTEM_PATH")))
-                (wrap-program (string-append out "/bin/spicy")
-                  `("GST_PLUGIN_SYSTEM_PATH" ":" prefix (,gst-plugin-path))))
-              #t)))))
+     `(#:configure-flags '("--enable-gstaudio"
+                           "--enable-gstvideo"
+                           "--enable-pulse"
+                           "--enable-vala"
+                           "--enable-introspection")
+       #:phases
+       (modify-phases %standard-phases
+         (add-before 'check 'disable-session-test
+           (lambda _
+             ;; XXX: Disable session tests, because they require USB support,
+             ;; which is not available in the build container.
+             (substitute* "tests/Makefile"
+               (("test-session\\$\\(EXEEXT\\) ") ""))))
+         (add-after 'install 'patch-la-files
+           (lambda* (#:key inputs outputs #:allow-other-keys)
+             (let ((out (assoc-ref outputs "out"))
+                   (libjpeg (assoc-ref inputs "libjpeg")))
+               ;; Add an absolute reference for libjpeg in the .la files
+               ;; so it does not have to be propagated.
+               (substitute* (find-files (string-append out "/lib") "\\.la$")
+                 (("-ljpeg")
+                  (string-append "-L" libjpeg "/lib -ljpeg"))))))
+         (add-after 'install 'wrap-spicy
+           (lambda* (#:key inputs outputs #:allow-other-keys)
+             (let ((out             (assoc-ref outputs "out"))
+                   (gst-plugin-path (getenv "GST_PLUGIN_SYSTEM_PATH")))
+               (wrap-program (string-append out "/bin/spicy")
+                 `("GST_PLUGIN_SYSTEM_PATH" ":"
+                   prefix (,gst-plugin-path)))))))))
+    (native-inputs
+     `(("glib:bin" ,glib "bin")
+       ("intltool" ,intltool)
+       ("pkg-config" ,pkg-config)
+       ("vala" ,vala)))
+    (inputs
+     `(("glib-networking" ,glib-networking)
+       ("gobject-introspection" ,gobject-introspection)
+       ("json-glib" ,json-glib)
+       ("libepoxy" ,libepoxy)
+       ("libjpeg" ,libjpeg-turbo)
+       ("libxcb" ,libxcb)
+       ("lz4" ,lz4)
+       ("mesa" ,mesa)
+       ("pulseaudio" ,pulseaudio)
+       ("python" ,python)
+       ("opus" ,opus)
+       ("usbredir" ,usbredir)))
+    (propagated-inputs
+     (list gstreamer
+           gst-plugins-base
+           gst-plugins-good
+           spice-protocol
+           ;; These are required by the pkg-config files.
+           gtk+
+           pixman
+           openssl-1.1))
     (synopsis "Gtk client and libraries for SPICE remote desktop servers")
     (description "Gtk client and libraries for SPICE remote desktop servers.")
     (home-page "https://www.spice-space.org")
-- 
2.39.1

[bug#61576] [PATCH 02/21] gnu: spice-gtk: Remove input labels.

[Maxim Cournoyer]

* gnu/packages/spice.scm (spice-gtk): Remove input labels.
---

 gnu/packages/spice.scm | 32 ++++++++++++++++----------------
 1 file changed, 16 insertions(+), 16 deletions(-)

diff --git a/gnu/packages/spice.scm b/gnu/packages/spice.scm
index 139ef4867e..c513e3db13 100644
--- a/gnu/packages/spice.scm
+++ b/gnu/packages/spice.scm
@@ -178,23 +178,23 @@ (define-public spice-gtk
                  `("GST_PLUGIN_SYSTEM_PATH" ":"
                    prefix (,gst-plugin-path)))))))))
     (native-inputs
-     `(("glib:bin" ,glib "bin")
-       ("intltool" ,intltool)
-       ("pkg-config" ,pkg-config)
-       ("vala" ,vala)))
+     (list `(,glib "bin")
+           intltool
+           pkg-config
+           vala))
     (inputs
-     `(("glib-networking" ,glib-networking)
-       ("gobject-introspection" ,gobject-introspection)
-       ("json-glib" ,json-glib)
-       ("libepoxy" ,libepoxy)
-       ("libjpeg" ,libjpeg-turbo)
-       ("libxcb" ,libxcb)
-       ("lz4" ,lz4)
-       ("mesa" ,mesa)
-       ("pulseaudio" ,pulseaudio)
-       ("python" ,python)
-       ("opus" ,opus)
-       ("usbredir" ,usbredir)))
+     (list glib-networking
+           gobject-introspection
+           json-glib
+           libepoxy
+           libjpeg-turbo
+           libxcb
+           lz4
+           mesa
+           pulseaudio
+           python
+           opus
+           usbredir))
     (propagated-inputs
      (list gstreamer
            gst-plugins-base
-- 
2.39.1

[bug#61576] [PATCH 03/21] gnu: spice-gtk: Use gexps.

[Maxim Cournoyer]

* gnu/packages/spice.scm (spice-gtk) [arguments]: Streamline and use gexps.
---

 gnu/packages/spice.scm | 59 +++++++++++++++++++++---------------------
 1 file changed, 29 insertions(+), 30 deletions(-)

diff --git a/gnu/packages/spice.scm b/gnu/packages/spice.scm
index c513e3db13..3d625a063a 100644
--- a/gnu/packages/spice.scm
+++ b/gnu/packages/spice.scm
@@ -3,7 +3,7 @@
 ;;; Copyright © 2018–2021 Tobias Geerinckx-Rice <me@tobias.gr>
 ;;; Copyright © 2019 Rutger Helling <rhelling@mykolab.com>
 ;;; Copyright © 2019, 2020, 2022 Marius Bakke <marius@gnu.org>
-;;; Copyright © 2022 Maxim Cournoyer <maxim.cournoyer@gmail.com>
+;;; Copyright © 2022, 2023 Maxim Cournoyer <maxim.cournoyer@gmail.com>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -148,35 +148,34 @@ (define-public spice-gtk
                 "1drvj8y35gnxbnrxsipwi15yh0vs9ixzv4wslz6r3lra8w3bfa0z"))))
     (build-system gnu-build-system)
     (arguments
-     `(#:configure-flags '("--enable-gstaudio"
-                           "--enable-gstvideo"
-                           "--enable-pulse"
-                           "--enable-vala"
-                           "--enable-introspection")
-       #:phases
-       (modify-phases %standard-phases
-         (add-before 'check 'disable-session-test
-           (lambda _
-             ;; XXX: Disable session tests, because they require USB support,
-             ;; which is not available in the build container.
-             (substitute* "tests/Makefile"
-               (("test-session\\$\\(EXEEXT\\) ") ""))))
-         (add-after 'install 'patch-la-files
-           (lambda* (#:key inputs outputs #:allow-other-keys)
-             (let ((out (assoc-ref outputs "out"))
-                   (libjpeg (assoc-ref inputs "libjpeg")))
-               ;; Add an absolute reference for libjpeg in the .la files
-               ;; so it does not have to be propagated.
-               (substitute* (find-files (string-append out "/lib") "\\.la$")
-                 (("-ljpeg")
-                  (string-append "-L" libjpeg "/lib -ljpeg"))))))
-         (add-after 'install 'wrap-spicy
-           (lambda* (#:key inputs outputs #:allow-other-keys)
-             (let ((out             (assoc-ref outputs "out"))
-                   (gst-plugin-path (getenv "GST_PLUGIN_SYSTEM_PATH")))
-               (wrap-program (string-append out "/bin/spicy")
-                 `("GST_PLUGIN_SYSTEM_PATH" ":"
-                   prefix (,gst-plugin-path)))))))))
+     (list
+      #:configure-flags #~(list "--enable-gstaudio"
+                                "--enable-gstvideo"
+                                "--enable-pulse"
+                                "--enable-vala"
+                                "--enable-introspection")
+      #:phases
+      #~(modify-phases %standard-phases
+          (add-before 'check 'disable-session-test
+            (lambda _
+              ;; XXX: Disable session tests, because they require USB support,
+              ;; which is not available in the build container.
+              (substitute* "tests/Makefile"
+                (("test-session\\$\\(EXEEXT\\) ") ""))))
+          (add-after 'install 'patch-la-files
+            (lambda _
+              ;; Add an absolute reference for libjpeg in the .la files
+              ;; so it does not have to be propagated.
+              (substitute* (find-files (string-append #$output "/lib")
+                                       "\\.la$")
+                (("-ljpeg")
+                 (string-append "-L" #$(this-package-input "libjpeg-turbo")
+                                "/lib -ljpeg")))))
+          (add-after 'install 'wrap-spicy
+            (lambda* (#:key outputs #:allow-other-keys)
+              (wrap-program (search-input-file outputs "bin/spicy")
+                `("GST_PLUGIN_SYSTEM_PATH" ":"
+                  prefix (,(getenv "GST_PLUGIN_SYSTEM_PATH")))))))))
     (native-inputs
      (list `(,glib "bin")
            intltool
-- 
2.39.1

[bug#61576] [PATCH 04/21] gnu: spice-gtk: Update to 0.42.

[Maxim Cournoyer]

* gnu/packages/spice.scm (spice-gtk): Update to 0.42.
[build-system]: Use meson-build-system.
[arguments]: Remove configure-flags.
Rename disable-session-test phase to disable-problematic-tests, and adjust.
Remove the patch-la-files phase.
[native-inputs]: Add python, python-pyparsing and python-six.
[inputs]: Remove python.
---

 gnu/packages/spice.scm | 41 +++++++++++++++++------------------------
 1 file changed, 17 insertions(+), 24 deletions(-)

diff --git a/gnu/packages/spice.scm b/gnu/packages/spice.scm
index 3d625a063a..f67a049176 100644
--- a/gnu/packages/spice.scm
+++ b/gnu/packages/spice.scm
@@ -41,6 +41,8 @@ (define-module (gnu packages spice)
   #:use-module (gnu packages pkg-config)
   #:use-module (gnu packages pulseaudio)
   #:use-module (gnu packages python)
+  #:use-module (gnu packages python-build)
+  #:use-module (gnu packages python-xyz)
   #:use-module (gnu packages security-token)
   #:use-module (gnu packages tls)
   #:use-module (gnu packages virtualization)
@@ -137,40 +139,29 @@ (define-public spice-protocol
 (define-public spice-gtk
   (package
     (name "spice-gtk")
-    (version "0.37")
+    (version "0.42")
     (source (origin
               (method url-fetch)
               (uri (string-append
                     "https://spice-space.org/download/gtk/"
-                    "spice-gtk-" version ".tar.bz2"))
+                    "spice-gtk-" version ".tar.xz"))
               (sha256
                (base32
-                "1drvj8y35gnxbnrxsipwi15yh0vs9ixzv4wslz6r3lra8w3bfa0z"))))
-    (build-system gnu-build-system)
+                "0n3s1rn7yzs28hnl9k6ql3a90qlv8w16djqj32m1zb8i31zi304k"))))
+    (build-system meson-build-system)
     (arguments
      (list
-      #:configure-flags #~(list "--enable-gstaudio"
-                                "--enable-gstvideo"
-                                "--enable-pulse"
-                                "--enable-vala"
-                                "--enable-introspection")
       #:phases
       #~(modify-phases %standard-phases
-          (add-before 'check 'disable-session-test
-            (lambda _
-              ;; XXX: Disable session tests, because they require USB support,
-              ;; which is not available in the build container.
-              (substitute* "tests/Makefile"
-                (("test-session\\$\\(EXEEXT\\) ") ""))))
-          (add-after 'install 'patch-la-files
+          (add-after 'unpack 'disable-problematic-tests
             (lambda _
-              ;; Add an absolute reference for libjpeg in the .la files
-              ;; so it does not have to be propagated.
-              (substitute* (find-files (string-append #$output "/lib")
-                                       "\\.la$")
-                (("-ljpeg")
-                 (string-append "-L" #$(this-package-input "libjpeg-turbo")
-                                "/lib -ljpeg")))))
+              ;; XXX: Disable the session and cd-emu tests, because they
+              ;; require USB support, which is not available in the build
+              ;; container.
+              (substitute* "tests/meson.build"
+                ((".*'session.c',.*") "")
+                (("tests_sources \\+= 'cd-emu.c'" all)
+                 (string-append "# " all)))))
           (add-after 'install 'wrap-spicy
             (lambda* (#:key outputs #:allow-other-keys)
               (wrap-program (search-input-file outputs "bin/spicy")
@@ -180,6 +171,9 @@ (define-public spice-gtk
      (list `(,glib "bin")
            intltool
            pkg-config
+           python
+           python-pyparsing
+           python-six
            vala))
     (inputs
      (list glib-networking
@@ -191,7 +185,6 @@ (define-public spice-gtk
            lz4
            mesa
            pulseaudio
-           python
            opus
            usbredir))
     (propagated-inputs
-- 
2.39.1

[bug#61576] [PATCH 05/21] gnu: spice-gtk: Propagate libjpeg-turbo, lz4, opus, and usbredir.

[Maxim Cournoyer]

* gnu/packages/spice.scm (spice-gtk)
[inputs]: Move libjpeg-turbo, lz4, opus, and usbredir to...
[propagated-inputs]: ... here.
---

 gnu/packages/spice.scm | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/gnu/packages/spice.scm b/gnu/packages/spice.scm
index f67a049176..2309287bbb 100644
--- a/gnu/packages/spice.scm
+++ b/gnu/packages/spice.scm
@@ -180,22 +180,23 @@ (define-public spice-gtk
            gobject-introspection
            json-glib
            libepoxy
-           libjpeg-turbo
            libxcb
-           lz4
            mesa
-           pulseaudio
-           opus
-           usbredir))
+           pulseaudio))
     (propagated-inputs
      (list gstreamer
            gst-plugins-base
            gst-plugins-good
            spice-protocol
-           ;; These are required by the pkg-config files.
+           ;; These are required by the pkg-config files (needed for example
+           ;; when building GNOME Boxes).
            gtk+
+           openssl-1.1
+           opus
+           libjpeg-turbo
+           lz4
            pixman
-           openssl-1.1))
+           usbredir))
     (synopsis "Gtk client and libraries for SPICE remote desktop servers")
     (description "Gtk client and libraries for SPICE remote desktop servers.")
     (home-page "https://www.spice-space.org")
-- 
2.39.1

[bug#61576] [PATCH 06/21] gnu: spice-protocol: Update to 0.14.4.

[Maxim Cournoyer]

* gnu/packages/spice.scm (spice-protocol): Update to 0.14.4.
[arguments]: Use gexps.
---

 gnu/packages/spice.scm | 24 +++++++++++-------------
 1 file changed, 11 insertions(+), 13 deletions(-)

diff --git a/gnu/packages/spice.scm b/gnu/packages/spice.scm
index 2309287bbb..44bcd5156b 100644
--- a/gnu/packages/spice.scm
+++ b/gnu/packages/spice.scm
@@ -109,26 +109,24 @@ (define-public virglrenderer
 (define-public spice-protocol
   (package
     (name "spice-protocol")
-    (version "0.14.3")
+    (version "0.14.4")
     (source (origin
               (method url-fetch)
               (uri (string-append
-                "https://www.spice-space.org/download/releases/"
-                "spice-protocol-" version ".tar.xz"))
+                    "https://www.spice-space.org/download/releases/"
+                    "spice-protocol-" version ".tar.xz"))
               (sha256
                (base32
-                "0yj8k7gcirrsf21w0q6146n5g4nzn2pqky4p90n5760m5ayfb1pr"))))
+                "04nr2w6ymy5jinfi3lj6205yd5h0swss3ykxqk7l3m4z1mhvmzq4"))))
     (build-system meson-build-system)
     (arguments
-     `(#:phases
-       (modify-phases %standard-phases
-         (add-after 'unpack 'install-documentation
-           (lambda* (#:key outputs #:allow-other-keys)
-             (let* ((out (assoc-ref outputs "out"))
-                    (doc (string-append out "/share/doc/"
-                                        ,name "-" ,version)))
-               (install-file "COPYING" doc)
-               #t))))))
+     (list #:phases
+           #~(modify-phases %standard-phases
+               (add-after 'unpack 'install-documentation
+                 (lambda _
+                   (install-file "COPYING"
+                                 (string-append #$output "/share/doc/"
+                                                #$name "-" #$version)))))))
     (synopsis "Protocol headers for the SPICE protocol")
     (description "SPICE (the Simple Protocol for Independent Computing
 Environments) is a remote-display system built for virtual environments
-- 
2.39.1

[bug#61576] [PATCH 07/21] gnu: usbredir: Update to 0.13.0.

[Maxim Cournoyer]

* gnu/packages/spice.scm (usbredir): Update to 0.13.0.
[inputs]: Add glib.
[native-inputs]: Remove autoconf, automake, and libtool.
---

 gnu/packages/spice.scm | 13 ++++++-------
 1 file changed, 6 insertions(+), 7 deletions(-)

diff --git a/gnu/packages/spice.scm b/gnu/packages/spice.scm
index 44bcd5156b..fc63b7228f 100644
--- a/gnu/packages/spice.scm
+++ b/gnu/packages/spice.scm
@@ -62,19 +62,18 @@ (define-public usbredir
   (package
     (name "usbredir")
     (home-page "https://spice-space.org")
-    (version "0.9.0")
+    (version "0.13.0")
     (source (origin
               (method url-fetch)
               (uri (string-append home-page "/download/" name "/" name "-"
                                   version ".tar.xz"))
               (sha256
                (base32
-                "19jnpzlanq0a1m5lmlcsp50wxf7icxvpvclx7hnf0zxw8azngqd3"))))
-    (build-system gnu-build-system)
-    (propagated-inputs
-     (list libusb))
-    (native-inputs
-     (list autoconf automake libtool pkg-config))
+                "0vn4gnd8nmnrvvj2rm7akf4sbcslmdk3v22k9kmxxrha5jhgm9jb"))))
+    (build-system meson-build-system)
+    (propagated-inputs (list libusb))
+    (inputs (list glib))
+    (native-inputs (list pkg-config))
     (synopsis "Tools for sending USB device traffic over a network")
     (description
      "Usbredir is a network protocol for sending USB device traffic over a
-- 
2.39.1

[bug#61576] [PATCH 08/21] gnu: virglrenderer: Update to 0.7.0.

[Maxim Cournoyer]

* gnu/packages/spice.scm (virglrenderer): Update to 0.7.0.  Remove
patch. Re-indent and sort inputs.
* gnu/packages/patches/virglrenderer-CVE-2017-6386.patch: Delete file.
* gnu/local.mk (dist_patch_DATA): De-register it.
---

 gnu/local.mk                                  |  1 -
 .../patches/virglrenderer-CVE-2017-6386.patch | 54 -------------------
 gnu/packages/spice.scm                        | 11 ++--
 3 files changed, 4 insertions(+), 62 deletions(-)
 delete mode 100644 gnu/packages/patches/virglrenderer-CVE-2017-6386.patch

diff --git a/gnu/local.mk b/gnu/local.mk
index 5fcbdd4586..19bb32c95e 100644
--- a/gnu/local.mk
+++ b/gnu/local.mk
@@ -1985,7 +1985,6 @@ dist_patch_DATA =						\
   %D%/packages/patches/vboot-utils-skip-test-workbuf.patch	\
   %D%/packages/patches/vinagre-newer-freerdp.patch             \
   %D%/packages/patches/vinagre-newer-rdp-parameters.patch      \
-  %D%/packages/patches/virglrenderer-CVE-2017-6386.patch 	\
   %D%/packages/patches/virtuoso-ose-remove-pre-built-jar-files.patch	\
   %D%/packages/patches/vsearch-unbundle-cityhash.patch		\
   %D%/packages/patches/vte-CVE-2012-2738-pt1.patch			\
diff --git a/gnu/packages/patches/virglrenderer-CVE-2017-6386.patch b/gnu/packages/patches/virglrenderer-CVE-2017-6386.patch
deleted file mode 100644
index bd3bf106bf..0000000000
--- a/gnu/packages/patches/virglrenderer-CVE-2017-6386.patch
+++ /dev/null
@@ -1,54 +0,0 @@
-Fix CVE-2017-6386 (memory leak introduced by fix for CVE-2017-5994).
-
-https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5994
-
-Patch copied from upstream source repository:
-
-https://cgit.freedesktop.org/virglrenderer/commit/?id=737c3350850ca4dbc5633b3bdb4118176ce59920
-
-From 737c3350850ca4dbc5633b3bdb4118176ce59920 Mon Sep 17 00:00:00 2001
-From: Dave Airlie <airlied@redhat.com>
-Date: Tue, 28 Feb 2017 14:52:09 +1000
-Subject: renderer: fix memory leak in vertex elements state create
-
-Reported-by: Li Qiang
-Free the vertex array in error path.
-This was introduced by this commit:
-renderer: fix heap overflow in vertex elements state create.
-
-I rewrote the code to not require the allocation in the first
-place if we have an error, seems nicer.
-
-Signed-off-by: Dave Airlie <airlied@redhat.com>
-
-diff --git a/src/vrend_renderer.c b/src/vrend_renderer.c
-index 1bca7ad..e5d9f5c 100644
---- a/src/vrend_renderer.c
-+++ b/src/vrend_renderer.c
-@@ -1648,18 +1648,19 @@ int vrend_create_vertex_elements_state(struct vrend_context *ctx,
-                                        unsigned num_elements,
-                                        const struct pipe_vertex_element *elements)
- {
--   struct vrend_vertex_element_array *v = CALLOC_STRUCT(vrend_vertex_element_array);
-+   struct vrend_vertex_element_array *v;
-    const struct util_format_description *desc;
-    GLenum type;
-    int i;
-    uint32_t ret_handle;
- 
--   if (!v)
--      return ENOMEM;
--
-    if (num_elements > PIPE_MAX_ATTRIBS)
-       return EINVAL;
- 
-+   v = CALLOC_STRUCT(vrend_vertex_element_array);
-+   if (!v)
-+      return ENOMEM;
-+
-    v->count = num_elements;
-    for (i = 0; i < num_elements; i++) {
-       memcpy(&v->elements[i].base, &elements[i], sizeof(struct pipe_vertex_element));
--- 
-cgit v0.10.2
-
diff --git a/gnu/packages/spice.scm b/gnu/packages/spice.scm
index fc63b7228f..46bb9844f2 100644
--- a/gnu/packages/spice.scm
+++ b/gnu/packages/spice.scm
@@ -84,21 +84,18 @@ (define-public usbredir
 (define-public virglrenderer
   (package
     (name "virglrenderer")
-    (version "0.6.0")
+    (version "0.7.0")
     (source (origin
               (method url-fetch)
               (uri (string-append
                 "https://www.freedesktop.org/software/virgl/"
                 "virglrenderer-" version ".tar.bz2"))
-              (patches (search-patches "virglrenderer-CVE-2017-6386.patch"))
               (sha256
                (base32
-                "06kf0q4l52gzx5p63l8850hff8pmhp7xv1hk8zgx2apbw18y6jd5"))))
+                "041agg1d6i8hg250y30f08n3via0hs9rbijxdrfifb8ara805v0m"))))
     (build-system gnu-build-system)
-    (inputs
-      (list libepoxy mesa eudev))
-    (native-inputs
-      (list pkg-config))
+    (inputs (list eudev libepoxy mesa))
+    (native-inputs (list pkg-config))
     (synopsis "Virtual 3D GPU library")
     (description "A virtual 3D GPU library that enables a virtualized operating
 system to use the host GPU to accelerate 3D rendering.")
-- 
2.39.1

[bug#61576] [PATCH 09/21] gnu: libcacard: Remove obsolete configure flags.

[Maxim Cournoyer]

* gnu/packages/spice.scm (libcacard) [arguments]: Delete field.
[propagated-inputs]: Reword comment.
---

 gnu/packages/spice.scm | 14 ++++----------
 1 file changed, 4 insertions(+), 10 deletions(-)

diff --git a/gnu/packages/spice.scm b/gnu/packages/spice.scm
index 46bb9844f2..191495b5fc 100644
--- a/gnu/packages/spice.scm
+++ b/gnu/packages/spice.scm
@@ -329,17 +329,11 @@ (define-public libcacard
                (base32
                 "1rrjlclm6ad63gah1fa4yfwrz4z6vgq2yrybbvzvvdbxrgl4vgzv"))))
     (build-system meson-build-system)
-    (arguments
-     (list #:configure-flags
-           ;; XXX: For some reason NSS is not automatically added on RUNPATH
-           ;; with newer versions of Meson (after 0.60).
-           #~(list (string-append "-Dc_link_args=-Wl,-rpath="
-                                  (search-input-directory
-                                   %build-inputs "lib/nss")))))
     (propagated-inputs
-     (list glib ; Requires: in the pkg-config file
-           nss ; Requires.private: in the pkg-config
-           pcsc-lite))       ; file
+     ;; The following inputs are required in the pkg-config file.
+     (list glib
+           nss
+           pcsc-lite))
     (native-inputs
      (list openssl
            `(,nss "bin")
-- 
2.39.1

[bug#61576] [PATCH 10/21] gnu: spice: Update to 0.15.1.

[Maxim Cournoyer]

* gnu/packages/spice.scm (spice): Update to 0.15.1.
---

 gnu/packages/spice.scm | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/gnu/packages/spice.scm b/gnu/packages/spice.scm
index 191495b5fc..9483a5966d 100644
--- a/gnu/packages/spice.scm
+++ b/gnu/packages/spice.scm
@@ -199,7 +199,7 @@ (define-public spice-gtk
 (define-public spice
   (package
     (name "spice")
-    (version "0.15.0")
+    (version "0.15.1")
     (source (origin
               (method url-fetch)
               (uri (string-append
@@ -207,7 +207,7 @@ (define-public spice
                 "spice-server/spice-" version ".tar.bz2"))
               (sha256
                (base32
-                "1xd0xffw0g5vvwbq4ksmm3jjfq45f9dw20xpmi82g1fj9f7wy85k"))))
+                "0ym3n60gq0kzzknk5ir8ib09cxsak9hkv7mmgsyic69jmdkszadd"))))
     (build-system gnu-build-system)
     (propagated-inputs
       (list openssl-1.1 pixman spice-protocol))
-- 
2.39.1

[bug#61576] [PATCH 11/21] gnu: spice-vdagent: Update to 0.22.1.

[Maxim Cournoyer]

* gnu/packages/spice.scm (spice-vdagent): Update to 0.22.1.
[source]: Delete patch.
* gnu/packages/patches/spice-vdagent-glib-2.68.patch: Delete file.
* gnu/local.mk (dist_patch_DATA): De-register it.
---

 gnu/local.mk                                  |   1 -
 .../patches/spice-vdagent-glib-2.68.patch     | 112 ------------------
 gnu/packages/spice.scm                        |   6 +-
 3 files changed, 2 insertions(+), 117 deletions(-)
 delete mode 100644 gnu/packages/patches/spice-vdagent-glib-2.68.patch

diff --git a/gnu/local.mk b/gnu/local.mk
index 19bb32c95e..af34225bf9 100644
--- a/gnu/local.mk
+++ b/gnu/local.mk
@@ -1868,7 +1868,6 @@ dist_patch_DATA =						\
   %D%/packages/patches/spectre-meltdown-checker-externalize-fwdb.patch \
   %D%/packages/patches/spectre-meltdown-checker-find-kernel.patch \
   %D%/packages/patches/sphinxbase-fix-doxygen.patch		\
-  %D%/packages/patches/spice-vdagent-glib-2.68.patch		\
   %D%/packages/patches/sssd-system-directories.patch		\
   %D%/packages/patches/steghide-fixes.patch			\
   %D%/packages/patches/suitesparse-mongoose-cmake.patch		\
diff --git a/gnu/packages/patches/spice-vdagent-glib-2.68.patch b/gnu/packages/patches/spice-vdagent-glib-2.68.patch
deleted file mode 100644
index cd5f13a909..0000000000
--- a/gnu/packages/patches/spice-vdagent-glib-2.68.patch
+++ /dev/null
@@ -1,112 +0,0 @@
-From 8348ef3c6121247e2b8be0641bbf3df3d55d9bff Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
-Date: Tue, 4 May 2021 13:20:47 +0400
-Subject: [PATCH] Fix g_memdup deprecation warning with glib >= 2.68
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Related to:
-https://bugzilla.redhat.com/show_bug.cgi?id=1943059
-
-Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
----
- configure.ac            | 4 ++++
- src/vdagent/vdagent.c   | 4 ++--
- src/vdagent/x11-randr.c | 2 +-
- src/vdagentd/vdagentd.c | 8 ++++----
- 4 files changed, 11 insertions(+), 7 deletions(-)
-
-diff --git a/configure.ac b/configure.ac
-index 7b2a99c..3de9b9b 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -124,6 +124,10 @@ PKG_CHECK_MODULES(ALSA, [alsa >= 1.0.22])
- PKG_CHECK_MODULES([DBUS], [dbus-1])
- PKG_CHECK_MODULES([DRM], [libdrm])
- 
-+PKG_CHECK_MODULES([GLIB], [glib-2.0 >= 2.68], [], [
-+    AC_DEFINE(g_memdup2, g_memdup, [GLib2 < 2.68 compatibility])
-+])
-+
- if test "$with_session_info" = "auto" || test "$with_session_info" = "systemd"; then
-     PKG_CHECK_MODULES([LIBSYSTEMD_LOGIN],
-                       [libsystemd >= 209],
-diff --git a/src/vdagent/vdagent.c b/src/vdagent/vdagent.c
-index 0c69907..fd08522 100644
---- a/src/vdagent/vdagent.c
-+++ b/src/vdagent/vdagent.c
-@@ -228,7 +228,7 @@ static void daemon_read_complete(UdscsConnection *conn,
-         break;
-     case VDAGENTD_AUDIO_VOLUME_SYNC: {
-         VDAgentAudioVolumeSync *avs = (VDAgentAudioVolumeSync *)data;
--        uint16_t *volume = g_memdup(avs->volume, sizeof(uint16_t) * avs->nchannels);
-+        uint16_t *volume = g_memdup2(avs->volume, sizeof(uint16_t) * avs->nchannels);
- 
-         if (avs->is_playback) {
-             vdagent_audio_playback_sync(avs->mute, avs->nchannels, volume);
-@@ -414,7 +414,7 @@ int main(int argc, char *argv[])
-     GOptionContext *context;
-     GError *error = NULL;
-     VDAgent *agent;
--    char **orig_argv = g_memdup(argv, sizeof(char*) * (argc+1));
-+    char **orig_argv = g_memdup2(argv, sizeof(char*) * (argc+1));
-     orig_argv[argc] = NULL; /* To avoid clang analyzer false-positive */
- 
-     context = g_option_context_new(NULL);
-diff --git a/src/vdagent/x11-randr.c b/src/vdagent/x11-randr.c
-index 27404a1..037aded 100644
---- a/src/vdagent/x11-randr.c
-+++ b/src/vdagent/x11-randr.c
-@@ -982,7 +982,7 @@ void vdagent_x11_set_monitor_config(struct vdagent_x11 *x11,
-                    fullscreen it will keep sending the failing config. */
-                 g_free(x11->randr.failed_conf);
-                 x11->randr.failed_conf =
--                    g_memdup(mon_config, config_size(mon_config->num_of_monitors));
-+                    g_memdup2(mon_config, config_size(mon_config->num_of_monitors));
-                 return;
-             }
-         }
-diff --git a/src/vdagentd/vdagentd.c b/src/vdagentd/vdagentd.c
-index 78378aa..3e59331 100644
---- a/src/vdagentd/vdagentd.c
-+++ b/src/vdagentd/vdagentd.c
-@@ -216,7 +216,7 @@ static void do_client_monitors(VirtioPort *vport, int port_nr,
-     vdagentd_write_xorg_conf(new_monitors);
- 
-     g_free(mon_config);
--    mon_config = g_memdup(new_monitors, size);
-+    mon_config = g_memdup2(new_monitors, size);
- 
-     /* Send monitor config to currently active agent */
-     if (active_session_conn)
-@@ -249,7 +249,7 @@ static void do_client_capabilities(VirtioPort *vport,
- {
-     capabilities_size = VD_AGENT_CAPS_SIZE_FROM_MSG_SIZE(message_header->size);
-     g_free(capabilities);
--    capabilities = g_memdup(caps->caps, capabilities_size * sizeof(uint32_t));
-+    capabilities = g_memdup2(caps->caps, capabilities_size * sizeof(uint32_t));
- 
-     if (caps->request) {
-         /* Report the previous client has disconnected. */
-@@ -647,7 +647,7 @@ static void virtio_port_read_complete(
-     case VD_AGENT_GRAPHICS_DEVICE_INFO: {
-         // store device info for re-sending when a session agent reconnects
-         g_free(device_info);
--        device_info = g_memdup(data, message_header->size);
-+        device_info = g_memdup2(data, message_header->size);
-         device_info_size = message_header->size;
-         forward_data_to_session_agent(VDAGENTD_GRAPHICS_DEVICE_INFO, data, message_header->size);
-         break;
-@@ -1090,7 +1090,7 @@ static void do_agent_xorg_resolution(UdscsConnection             *conn,
-     }
- 
-     g_free(agent_data->screen_info);
--    agent_data->screen_info = g_memdup(data, header->size);
-+    agent_data->screen_info = g_memdup2(data, header->size);
-     agent_data->width  = header->arg1;
-     agent_data->height = header->arg2;
-     agent_data->screen_count = n;
--- 
-GitLab
-
diff --git a/gnu/packages/spice.scm b/gnu/packages/spice.scm
index 9483a5966d..1654ae141e 100644
--- a/gnu/packages/spice.scm
+++ b/gnu/packages/spice.scm
@@ -253,7 +253,7 @@ (define-public spice
 (define-public spice-vdagent
   (package
     (name "spice-vdagent")
-    (version "0.21.0")
+    (version "0.22.1")
     (source (origin
               (method url-fetch)
               (uri (string-append
@@ -261,9 +261,7 @@ (define-public spice-vdagent
                 "spice-vdagent-" version ".tar.bz2"))
               (sha256
                (base32
-                "0n8jlc1pv6mkry161y656b1nk9hhhminjq6nymzmmyjl7k95ymzx"))
-              (patches
-               (search-patches "spice-vdagent-glib-2.68.patch"))))
+                "18472sqr0gibzgzi48dpcbnvm78l05qrl5wv6xywqqj7r9dd3c4k"))))
     (build-system gnu-build-system)
     (arguments
      `(#:configure-flags
-- 
2.39.1

[bug#61576] [PATCH 12/21] gnu: usbutils: Update to 015.

[Maxim Cournoyer]

* gnu/packages/linux.scm (usbutils): Update to 015.
---

 gnu/packages/linux.scm | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/gnu/packages/linux.scm b/gnu/packages/linux.scm
index 33faf8920d..1ff72d9914 100644
--- a/gnu/packages/linux.scm
+++ b/gnu/packages/linux.scm
@@ -2297,14 +2297,14 @@ (define-public procps
 (define-public usbutils
   (package
     (name "usbutils")
-    (version "014")
+    (version "015")
     (source
      (origin
       (method url-fetch)
       (uri (string-append "mirror://kernel.org/linux/utils/usb/usbutils/"
                           "usbutils-" version ".tar.xz"))
       (sha256
-       (base32 "0sgwfvr1b5w3ai1c0rmvzhk67y9vh7bq490rcxxj4q05svx9q1rs"))))
+       (base32 "0vnsdzx997v8ksi5dbsi2vc8b3mcm5b6jnmcdhszdyag3yxm3d63"))))
     (build-system gnu-build-system)
     (outputs (list "out" "python"))
     (arguments
-- 
2.39.1

[bug#61576] [PATCH 13/21] gnu: phodav: Propagate glib, libsoup and libxml2.

[Maxim Cournoyer]

* gnu/packages/gnome.scm (phodav) [inputs]: Move libsoup to...
[propagated-inputs]: ... here.  Add glib and libxml2.
---

 gnu/packages/gnome.scm | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/gnu/packages/gnome.scm b/gnu/packages/gnome.scm
index 4698b883af..8bb8372d3a 100644
--- a/gnu/packages/gnome.scm
+++ b/gnu/packages/gnome.scm
@@ -1268,8 +1268,12 @@ (define-public phodav
            pkg-config))
     (inputs
      (list avahi
-           libgudev
-           libsoup))
+           libgudev))
+    (propagated-inputs
+     ;; These inputs are required by the pkg-config file.
+     (list glib
+           libsoup
+           libxml2))
     (synopsis "WebDav server implementation using libsoup")
     (description "PhoDav was initially developed as a file-sharing mechanism for Spice,
 but it is generic enough to be reused in other projects,
-- 
2.39.1

[bug#61576] [PATCH 14/21] gnu: spice-gtk: Enable support for polkit, webdav and others.

[Maxim Cournoyer]

* gnu/packages/spice.scm (spice-gtk) [arguments]: Add the correct-polkit-dir
and fake-pkexec phases.
[inputs]: Add acl, cyrus-sasl, libcap-ng, polkit and usbutils.
[propagated-inputs]: Add libcacard and phodav.
---

 gnu/packages/spice.scm | 21 +++++++++++++++++++--
 1 file changed, 19 insertions(+), 2 deletions(-)

diff --git a/gnu/packages/spice.scm b/gnu/packages/spice.scm
index 1654ae141e..62d1d50e5b 100644
--- a/gnu/packages/spice.scm
+++ b/gnu/packages/spice.scm
@@ -22,6 +22,8 @@
 
 (define-module (gnu packages spice)
   #:use-module (gnu packages)
+  #:use-module (gnu packages acl)
+  #:use-module (gnu packages admin)
   #:use-module (gnu packages autotools)
   #:use-module (gnu packages base)
   #:use-module (gnu packages bash)
@@ -39,6 +41,7 @@ (define-module (gnu packages spice)
   #:use-module (gnu packages nss)
   #:use-module (gnu packages perl)
   #:use-module (gnu packages pkg-config)
+  #:use-module (gnu packages polkit)
   #:use-module (gnu packages pulseaudio)
   #:use-module (gnu packages python)
   #:use-module (gnu packages python-build)
@@ -156,6 +159,13 @@ (define-public spice-gtk
                 ((".*'session.c',.*") "")
                 (("tests_sources \\+= 'cd-emu.c'" all)
                  (string-append "# " all)))))
+          (add-before 'configure 'correct-polkit-dir
+            (lambda _
+              (substitute* "meson.build"
+                (("d.get_variable\\(pkgconfig: 'policydir')")
+                 (string-append "'" #$output "/share/polkit-1/actions'")))))
+          (add-before 'install 'fake-pkexec
+            (lambda _ (setenv "PKEXEC_UID" "-1")))
           (add-after 'install 'wrap-spicy
             (lambda* (#:key outputs #:allow-other-keys)
               (wrap-program (search-input-file outputs "bin/spicy")
@@ -170,13 +180,18 @@ (define-public spice-gtk
            python-six
            vala))
     (inputs
-     (list glib-networking
+     (list cyrus-sasl
+           glib-networking
            gobject-introspection
            json-glib
+           acl
+           libcap-ng
            libepoxy
            libxcb
            mesa
-           pulseaudio))
+           polkit
+           pulseaudio
+           usbutils))
     (propagated-inputs
      (list gstreamer
            gst-plugins-base
@@ -187,8 +202,10 @@ (define-public spice-gtk
            gtk+
            openssl-1.1
            opus
+           libcacard
            libjpeg-turbo
            lz4
+           phodav
            pixman
            usbredir))
     (synopsis "Gtk client and libraries for SPICE remote desktop servers")
-- 
2.39.1

[bug#61576] [PATCH 15/21] gnu: osinfo-db: Use libsoup 3.

[Maxim Cournoyer]

* gnu/packages/virtualization.scm (libosinfo) [inputs]: Replace libsoup2 with libsoup.
---

 gnu/packages/virtualization.scm | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/gnu/packages/virtualization.scm b/gnu/packages/virtualization.scm
index 64a26edb02..f50147c3d1 100644
--- a/gnu/packages/virtualization.scm
+++ b/gnu/packages/virtualization.scm
@@ -1188,7 +1188,7 @@ (define-public libosinfo
                  (format #f "path = ~s;"
                          (search-input-directory (or native-inputs inputs)
                                                  "share/osinfo")))))))))
-    (inputs (list libsoup-minimal-2 libxml2 libxslt osinfo-db))
+    (inputs (list libsoup libxml2 libxslt osinfo-db))
     (native-inputs
      (list `(,glib "bin")                ;glib-mkenums, etc.
            gobject-introspection
-- 
2.39.1

[bug#61576] [PATCH 16/21] gnu: gnome-boxes: Update to 43.3.

[Maxim Cournoyer]

* gnu/packages/gnome.scm (gnome-boxes): Update to 43.3.
[arguments]: Remove configure-flags.  Adjust disable-gtk-update-icon-cache
phase.
[inputs]: Replace gtk+ with gtk, libsoup-minimal-2 with libsoup,
webkitgtk-with-libsoup2 with webkitgtk.
[native-inputs]: Replace vala with vala-next.
---

 gnu/packages/gnome.scm | 20 +++++++++-----------
 1 file changed, 9 insertions(+), 11 deletions(-)

diff --git a/gnu/packages/gnome.scm b/gnu/packages/gnome.scm
index 8bb8372d3a..9e6f705129 100644
--- a/gnu/packages/gnome.scm
+++ b/gnu/packages/gnome.scm
@@ -12496,7 +12496,7 @@ (define-public polari
 (define-public gnome-boxes
   (package
     (name "gnome-boxes")
-    (version "42.3")
+    (version "43.3")
     (source
      (origin
        (method url-fetch)
@@ -12504,18 +12504,16 @@ (define-public gnome-boxes
                            (version-major version) "/"
                            "gnome-boxes-" version ".tar.xz"))
        (sha256
-        (base32 "1lv0bdh935qj6wkv3ixg2pcv8yrapj79z02gw4fal3rhz3xggvsn"))))
+        (base32 "14zd5ii3igy0am4zqw2jg1xshf2zxsy96yv5pss2vf6rh3svmnzf"))))
     (build-system meson-build-system)
     (arguments
      (list #:glib-or-gtk? #t
-           #:configure-flags #~(list "-Drdp=false"
-                                     (string-append "-Dc_link_args=-Wl,-rpath="
-                                                    #$output
-                                                    "/lib/gnome-boxes"))
            #:phases #~(modify-phases %standard-phases
                         (add-after 'unpack 'disable-gtk-update-icon-cache
                           (lambda _
-                            (setenv "DESTDIR" "/")))
+                            (substitute* "meson.build"
+                              (("gtk_update_icon_cache: true")
+                               "gtk_update_icon_cache: false"))))
                         (add-before 'configure 'set-qemu-file-name
                           (lambda* (#:key inputs #:allow-other-keys)
                             (substitute* "src/installed-media.vala"
@@ -12529,11 +12527,11 @@ (define-public gnome-boxes
            itstool
            pkg-config
            python
-           vala))
+           vala-next))
     (inputs
      (list glib-networking              ;for TLS support
            gsettings-desktop-schemas
-           gtk+
+           gtk
            gtk-vnc
            gtksourceview
            json-glib
@@ -12542,7 +12540,7 @@ (define-public gnome-boxes
            libhandy
            libosinfo
            libsecret
-           libsoup-minimal-2
+           libsoup
            libusb
            libvirt
            libvirt-glib
@@ -12552,7 +12550,7 @@ (define-public gnome-boxes
            spice-gtk
            tracker
            vte
-           webkitgtk-with-libsoup2))    ;for webkit2gtk-4.0
+           webkitgtk))
     (home-page "https://wiki.gnome.org/Apps/Boxes")
     (synopsis "View, access, and manage remote and virtual systems")
     (description "GNOME Boxes is a simple application to view, access, and
-- 
2.39.1

[bug#61576] [PATCH 17/21] services: gnome-polkit-settings: Add spice-gtk.

[Maxim Cournoyer]

* gnu/services/desktop.scm (gnome-polkit-settings): Add spice-gtk to the GNOME
packages providing polkit rules.
(package-direct-input-selector): Allow passing a list corresponding to the
dependency tree, so that non-propagated transitive inputs can be specified.
---

 gnu/services/desktop.scm | 23 +++++++++++++++++------
 1 file changed, 17 insertions(+), 6 deletions(-)

diff --git a/gnu/services/desktop.scm b/gnu/services/desktop.scm
index fe1f0fd20a..189334dc23 100644
--- a/gnu/services/desktop.scm
+++ b/gnu/services/desktop.scm
@@ -3,7 +3,7 @@
 ;;; Copyright © 2015 Andy Wingo <wingo@igalia.com>
 ;;; Copyright © 2015 Mark H Weaver <mhw@netris.org>
 ;;; Copyright © 2016 Sou Bunnbu <iyzsong@gmail.com>
-;;; Copyright © 2017, 2020, 2022 Maxim Cournoyer <maxim.cournoyer@gmail.com>
+;;; Copyright © 2017, 2020, 2022, 2023 Maxim Cournoyer <maxim.cournoyer@gmail.com>
 ;;; Copyright © 2017 Nikita <nikita@n0.is>
 ;;; Copyright © 2018, 2020, 2022 Efraim Flashner <efraim@flashner.co.il>
 ;;; Copyright © 2018 Ricardo Wurmus <rekado@elephly.net>
@@ -183,11 +183,19 @@ (define-module (gnu services desktop)
 (define (bool value)
   (if value "true\n" "false\n"))
 
-(define (package-direct-input-selector input)
+(define (package-direct-input-selector tree)
+  "Return a procedure that selects TREE from the inputs of PACKAGE.  If TREE
+is a list, it recursively searches it until it locates the last item of TREE."
   (lambda (package)
-    (match (assoc-ref (package-direct-inputs package) input)
-      ((package . _) package))))
-
+    (let loop ((tree (if (pair? tree)
+                         tree
+                         (list tree)))
+               (package package))
+      (if (null? tree)
+          package
+          (loop (cdr tree)
+                (car (assoc-ref (package-direct-inputs package)
+                                (car tree))))))))
 
 \f
 ;;;
@@ -1360,7 +1368,10 @@ (define (gnome-polkit-settings config)
                   '("gnome-settings-daemon"
                     "gnome-control-center"
                     "gnome-system-monitor"
-                    "gvfs")))
+                    "gvfs"
+                    ;; spice-gtk provides polkit actions for USB redirection
+                    ;; in GNOME Boxes.
+                    ("gnome-boxes" "spice-gtk"))))
 
 (define gnome-desktop-service-type
   (service-type
-- 
2.39.1

[bug#61576] [PATCH 18/21] services: desktop: Extract a new gnome-package procedure.

[Maxim Cournoyer]

* gnu/services/desktop.scm (<gnome-desktop-configuration>): Rename gnome
package accessor to gnome-desktop-configuration-gnome, to avoid name conflict.
(gnome-packages): Change first argument from a config object to a the gnome
package used.  Rename second argument from package to name.  Extract core
logic into...
(gnome-package): ... this.
(gnome-udev-rules, gnome-polkit-settings): Adjust accordingly.
(gnome-desktop-service-type): Likewise.
---

 gnu/services/desktop.scm | 43 ++++++++++++++++++++++------------------
 1 file changed, 24 insertions(+), 19 deletions(-)

diff --git a/gnu/services/desktop.scm b/gnu/services/desktop.scm
index 189334dc23..5ddfbb9e53 100644
--- a/gnu/services/desktop.scm
+++ b/gnu/services/desktop.scm
@@ -73,6 +73,7 @@ (define-module (gnu services desktop)
   #:use-module (guix utils)
   #:use-module (guix gexp)
   #:use-module (srfi srfi-1)
+  #:use-module (srfi srfi-26)
   #:use-module (ice-9 format)
   #:use-module (ice-9 match)
   #:export (<upower-configuration>
@@ -1347,31 +1348,36 @@ (define sane-service-type
 (define-record-type* <gnome-desktop-configuration> gnome-desktop-configuration
   make-gnome-desktop-configuration
   gnome-desktop-configuration?
-  (gnome gnome-package (default gnome)))
+  (gnome gnome-desktop-configuration-gnome
+         (default gnome)))
 
-(define (gnome-packages config packages)
-  "Return the list of GNOME dependencies from CONFIG which names are part of
-the given PACKAGES list."
-  (let ((gnome (gnome-package config)))
-    (map (lambda (name)
-           ((package-direct-input-selector name) gnome))
-         packages)))
+(define (gnome-package gnome name)
+  "Return the package NAME among the GNOME package inputs.  NAME can be a
+single name or a tree-like, e.g. @code{'(\"gnome-boxes\" \"spice-gtk\")} to
+denote the spice-gtk input of the gnome-boxes input of the GNOME meta-package."
+  ((package-direct-input-selector name) gnome))
+
+(define (gnome-packages gnome names)
+  "Return the package NAMES among the GNOME package inputs."
+  (map (cut gnome-package gnome <>) names))
 
 (define (gnome-udev-rules config)
   "Return the list of GNOME dependencies that provide udev rules."
-  (gnome-packages config '("gnome-settings-daemon")))
+  (let ((gnome (gnome-desktop-configuration-gnome config)))
+    (gnome-packages gnome '("gnome-settings-daemon"))))
 
 (define (gnome-polkit-settings config)
   "Return the list of GNOME dependencies that provide polkit actions and
 rules."
-  (gnome-packages config
-                  '("gnome-settings-daemon"
-                    "gnome-control-center"
-                    "gnome-system-monitor"
-                    "gvfs"
-                    ;; spice-gtk provides polkit actions for USB redirection
-                    ;; in GNOME Boxes.
-                    ("gnome-boxes" "spice-gtk"))))
+  (let ((gnome (gnome-desktop-configuration-gnome config)))
+    (gnome-packages gnome
+                    '("gnome-settings-daemon"
+                      "gnome-control-center"
+                      "gnome-system-monitor"
+                      "gvfs"
+                      ;; spice-gtk provides polkit actions for USB redirection
+                      ;; in GNOME Boxes.
+                      ("gnome-boxes" "spice-gtk")))))
 
 (define gnome-desktop-service-type
   (service-type
@@ -1382,8 +1388,7 @@ (define gnome-desktop-service-type
           (service-extension polkit-service-type
                              gnome-polkit-settings)
           (service-extension profile-service-type
-                             (compose list
-                                      gnome-package))))
+                             (compose list gnome-desktop-configuration-gnome))))
    (default-value (gnome-desktop-configuration))
    (description "Run the GNOME desktop environment.")))
 
-- 
2.39.1

[bug#61576] [PATCH 19/21] services: gnome-desktop-service-type: Extend setuid-program-service-type.

[Maxim Cournoyer]

* gnu/services/desktop.scm (gnome-setuid-programs): New variable.
(gnome-desktop-service-type): Extend setuid-program-service-type with it.
---

 gnu/services/desktop.scm | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/gnu/services/desktop.scm b/gnu/services/desktop.scm
index 5ddfbb9e53..2034b3d099 100644
--- a/gnu/services/desktop.scm
+++ b/gnu/services/desktop.scm
@@ -1379,6 +1379,14 @@ (define (gnome-polkit-settings config)
                       ;; in GNOME Boxes.
                       ("gnome-boxes" "spice-gtk")))))
 
+(define (gnome-setuid-programs config)
+  "Return the list of GNOME setuid programs."
+  (let* ((gnome (gnome-desktop-configuration-gnome config))
+         (spice-gtk (gnome-package gnome '("gnome-boxes" "spice-gtk"))))
+    (map file-like->setuid-program
+         (list (file-append spice-gtk
+                            "/libexec/spice-client-glib-usb-acl-helper")))))
+
 (define gnome-desktop-service-type
   (service-type
    (name 'gnome-desktop)
@@ -1387,6 +1395,8 @@ (define gnome-desktop-service-type
                              gnome-udev-rules)
           (service-extension polkit-service-type
                              gnome-polkit-settings)
+          (service-extension setuid-program-service-type
+                             gnome-setuid-programs)
           (service-extension profile-service-type
                              (compose list gnome-desktop-configuration-gnome))))
    (default-value (gnome-desktop-configuration))
-- 
2.39.1

[bug#61576] [PATCH 20/21] gnu: gnome-boxes: Mention extra configuration requirements.

[Maxim Cournoyer]

* gnu/packages/gnome.scm (gnome-boxes) [description]: Mention about extending
polkit and setuid services with spice-gtk.
---

 gnu/packages/gnome.scm | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/gnu/packages/gnome.scm b/gnu/packages/gnome.scm
index 9e6f705129..3470894d4d 100644
--- a/gnu/packages/gnome.scm
+++ b/gnu/packages/gnome.scm
@@ -12545,7 +12545,7 @@ (define-public gnome-boxes
            libvirt
            libvirt-glib
            libxml2
-           qemu-minimal                           ;for qemu-img
+           qemu-minimal                 ;for qemu-img
            sparql-query
            spice-gtk
            tracker
@@ -12557,7 +12557,12 @@ (define-public gnome-boxes
 manage remote and virtual systems.  Note that this application requires the
 @code{libvirt} and @code{virtlog} daemons to run.  Use the command
 @command{info '(guix) Virtualization Services'} to learn how to configure
-these services on the Guix System.")
+these services on the Guix System.  If you do not use the GNOME desktop
+environment, you will also want to extend the @code{polkit-service-type} with
+the @code{spice-gtk} package, as well as configure the
+@file{libexec/spice-client-glib-usb-acl-helper} executable of @code{spice-gtk}
+as setuid, to make it possible to redirect USB devices as a non-privileged
+user.")
     (license (list
               ;; For data/icons/empty-boxes.png.
               license:cc-by2.0
-- 
2.39.1

[bug#61576] [PATCH 21/21] gnu: spice-gtk: Adjust the default file name of the ACL helper binary.

[Maxim Cournoyer]

* gnu/packages/spice.scm (spice-gtk)
[arguments]: Add adjust-default-acl-helper-path phase.

---

 gnu/packages/spice.scm | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/gnu/packages/spice.scm b/gnu/packages/spice.scm
index 62d1d50e5b..8d2bed38b2 100644
--- a/gnu/packages/spice.scm
+++ b/gnu/packages/spice.scm
@@ -159,6 +159,16 @@ (define-public spice-gtk
                 ((".*'session.c',.*") "")
                 (("tests_sources \\+= 'cd-emu.c'" all)
                  (string-append "# " all)))))
+          (add-after 'unpack 'adjust-default-acl-helper-path
+            (lambda _
+              ;; The USB ACL helper used to allow USB redirection as a
+              ;; non-privileged user needs to be setuid, as configured by the
+              ;; gnome-desktop-service-type.  A user can still change the
+              ;; location by specifying the SPICE_USB_ACL_BINARY environment
+              ;; variable.
+              (substitute* "src/usb-acl-helper.c"
+                (("ACL_HELPER_PATH\"/spice-client-glib-usb-acl-helper\"")
+                 "\"/run/setuid-programs/spice-client-glib-usb-acl-helper\""))))
           (add-before 'configure 'correct-polkit-dir
             (lambda _
               (substitute* "meson.build"
-- 
2.39.1

bug#61576: [PATCH 00/21] Allow USB redirection as an unprivileged user in in GNOME Boxes

[Maxim Cournoyer]

Hello,

Maxim Cournoyer <maxim.cournoyer@gmail.com> writes:

[...]

> Maxim Cournoyer (21):
>   gnu: spice-gtk: Fix indentation and normalize field order.
>   gnu: spice-gtk: Remove input labels.
>   gnu: spice-gtk: Use gexps.
>   gnu: spice-gtk: Update to 0.42.
>   gnu: spice-gtk: Propagate libjpeg-turbo, lz4, opus, and usbredir.
>   gnu: spice-protocol: Update to 0.14.4.
>   gnu: usbredir: Update to 0.13.0.
>   gnu: virglrenderer: Update to 0.7.0.
>   gnu: libcacard: Remove obsolete configure flags.
>   gnu: spice: Update to 0.15.1.
>   gnu: spice-vdagent: Update to 0.22.1.
>   gnu: usbutils: Update to 015.
>   gnu: phodav: Propagate glib, libsoup and libxml2.
>   gnu: spice-gtk: Enable support for polkit, webdav and others.
>   gnu: osinfo-db: Use libsoup 3.
>   gnu: gnome-boxes: Update to 43.3.
>   services: gnome-polkit-settings: Add spice-gtk.
>   services: desktop: Extract a new gnome-package procedure.
>   services: gnome-desktop-service-type: Extend
>     setuid-program-service-type.
>   gnu: gnome-boxes: Mention extra configuration requirements.
>   gnu: spice-gtk: Adjust the default file name of the ACL helper binary.

Applied, closing!

-- 
Thanks,
Maxim

[bug#61576] [PATCH 00/21] Allow USB redirection as an unprivileged user in in GNOME Boxes

[Maxim Cournoyer]

Test, using X-Debbugs-Cc.

-- 
Thanks,
Maxim