From mboxrd@z Thu Jan 1 00:00:00 1970 From: Marius Bakke Subject: Re: [PATCH] gnu: ed: Replace with 1.14.1 [fixes security issues]. Date: Fri, 13 Jan 2017 14:20:27 +0100 Message-ID: <8737gn5c6c.fsf@kirby.i-did-not-set--mail-host-address--so-tickle-me> References: <20170112201353.29406-1-mbakke@fastmail.com> <20170112215005.GA13508@jasmine> <87o9zc54d8.fsf@kirby.i-did-not-set--mail-host-address--so-tickle-me> <20170112221723.GA20450@jasmine> <87r347rtv0.fsf@gnu.org> Mime-Version: 1.0 Content-Type: multipart/signed; boundary="=-=-="; micalg=pgp-sha512; protocol="application/pgp-signature" Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:41717) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1cS1mU-0001In-Ml for guix-devel@gnu.org; Fri, 13 Jan 2017 08:20:35 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1cS1mQ-0003cI-EB for guix-devel@gnu.org; Fri, 13 Jan 2017 08:20:34 -0500 In-Reply-To: <87r347rtv0.fsf@gnu.org> List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: "Guix-devel" To: Ludovic =?utf-8?Q?Court=C3=A8s?= , Leo Famulari Cc: guix-devel@gnu.org --=-=-= Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Ludovic Court=C3=A8s writes: > Leo Famulari skribis: > >> On Thu, Jan 12, 2017 at 10:56:51PM +0100, Marius Bakke wrote: >>> Leo Famulari writes: >>>=20 >>> > On Thu, Jan 12, 2017 at 09:13:53PM +0100, Marius Bakke wrote: >>> >> * gnu/packages/ed.scm (ed-1.14.1): New variable. >>> >> (ed)[replacement]: New field. >>> > >>> > Can you add a comment with a link to the bug report? >>> > >>> > https://lists.gnu.org/archive/html/bug-ed/2017-01/msg00000.html >>>=20 >>> Good find. I wonder, was this issue only present in the unreleased >>> 1.14.0? I can't reproduce it with the current Guix version. >> >> Good catch; I can only reproduce it with 1.14, and the ed maintainer >> points out that it was introduced in 1.14. >> >>> I'll wait and see what the response on oss-sec is. Maybe we can just >>> push the update to core-updates. >> >> I think it's fine for core-updates. > > With 200 dependent packages, it could even go to =E2=80=98master=E2=80=99. > > https://lists.gnu.org/archive/html/guix-devel/2016-10/msg00933.html When I first built it on 'master', Guix went ahead and downloaded the bootstrap binaries, so I suspect `guix refresh` fails to recognize the full scope of this update. 'ed' is used as a native-input for 'patch', could that be related? --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCgAdFiEEu7At3yzq9qgNHeZDoqBt8qM6VPoFAlh41BsACgkQoqBt8qM6 VPrW6AgAzJvd4t2YfEg3ziFrXHbuUp71dNYZssnonc8vksq5qkTcn+QNsdXE1P++ DjQsCb+ux+NjFBz3YAaMHUTgun9W8R+5ppQOntY6xcKoCg+iWJjs0+yJpelIm1Sl kBCT+6f9KyBCuCAegmvDV9qazvgy3yFi3D5ndmWKktFbmgN50Yhokjctsb8ms4Dq /i7X+YR9l1bpZE2qN6DJDtRshoLvFgRH/L+wzS4pOreAaecFrNttnjIs8D+8lnNg wKj5y7/JKMkj6+f0MeY9hoy4Ip3NtvYt0IgIuZ+QWww5ieqvj+w6ksys4ifKtsaQ A9ZFud6G1uwgxN0Ys22M52a3+q8OHg== =VitP -----END PGP SIGNATURE----- --=-=-=--