[bug#27769] [PATCH] gnu: pcre: Update replacement to 8.41 [fixes CVE-2017-{7244, 7245, 7246}].

[bug#27769] [PATCH] gnu: pcre: Update replacement to 8.41 [fixes CVE-2017-{7244, 7245, 7246}].

[Leo Famulari]

* gnu/packages/pcre.scm (pcre)[replacement]: Update to pcre-8.41.
(pcre/fixed): Replace with ...
(pcre-8.41): ... new variable.
---
 gnu/packages/pcre.scm | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/gnu/packages/pcre.scm b/gnu/packages/pcre.scm
index 67a8db1c7..8dd509931 100644
--- a/gnu/packages/pcre.scm
+++ b/gnu/packages/pcre.scm
@@ -34,7 +34,7 @@
   (package
    (name "pcre")
    (version "8.40")
-   (replacement pcre/fixed)
+   (replacement pcre-8.41)
    (source (origin
             (method url-fetch)
             (uri (list
@@ -72,12 +72,20 @@ POSIX regular expression API.")
    (license license:bsd-3)
    (home-page "http://www.pcre.org/")))
 
-(define pcre/fixed
+(define pcre-8.41
   (package
     (inherit pcre)
+    (version "8.41")
     (source (origin
-              (inherit (package-source pcre))
-              (patches (search-patches "pcre-CVE-2017-7186.patch"))))))
+              (method url-fetch)
+              (uri (list (string-append "mirror://sourceforge/pcre/pcre/"
+                                        version "/pcre-" version ".tar.bz2")
+                         (string-append "ftp://ftp.csx.cam.ac.uk"
+                                        "/pub/software/programming/pcre/"
+                                        "pcre-" version ".tar.bz2")))
+              (sha256
+               (base32
+                "0c5m469p5pd7jip621ipq6hbgh7128lzh7xndllfgh77ban7wb76"))))))
 
 (define-public pcre2
   (package
-- 
2.13.3

[bug#27769] [PATCH] gnu: pcre: Update replacement to 8.41 [fixes CVE-2017-{7244, 7245, 7246}].

[Ludovic Courtès]

Leo Famulari <leo@famulari.name> skribis:

> * gnu/packages/pcre.scm (pcre)[replacement]: Update to pcre-8.41.
> (pcre/fixed): Replace with ...
> (pcre-8.41): ... new variable.

LGTM!

> -              (patches (search-patches "pcre-CVE-2017-7186.patch"))))))

Should we remove this patch as well?

For ‘core-updates’, I suggest we keep 8.41 it as a graft.  WDYT?

Thank you!

Ludo’.

bug#27769: [PATCH] gnu: pcre: Update replacement to 8.41 [fixes CVE-2017-{7244, 7245, 7246}].

[Leo Famulari]

[-- Attachment #1: Type: text/plain, Size: 536 bytes --]

On Thu, Jul 20, 2017 at 10:35:28AM +0200, Ludovic Courtès wrote:
> > -              (patches (search-patches "pcre-CVE-2017-7186.patch"))))))
> 
> Should we remove this patch as well?

Yes! I was rushing to finish this at the end of the night and I sent a
preliminary version of this change by mistake :/

> For ‘core-updates’, I suggest we keep 8.41 it as a graft.  WDYT?

Agreed, I think we should not make any more big changes on that branch
unless we have to.

Pushed as 426b0b898f70a58133d80779980f163a5761686e.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]