From mboxrd@z Thu Jan  1 00:00:00 1970
From: Ricardo Wurmus <rekado@elephly.net>
Subject: bug#33831: Gstreamer registry contains store references
Date: Fri, 21 Dec 2018 07:47:34 +0100
Message-ID: <87a7kzs7eh.fsf@elephly.net>
Mime-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
Return-path: <bug-guix-bounces+gcggb-bug-guix=m.gmane.org@gnu.org>
Received: from eggs.gnu.org ([2001:4830:134:3::10]:41526)
	by lists.gnu.org with esmtp (Exim 4.71)
	(envelope-from <Debian-debbugs@debbugs.gnu.org>) id 1gaPdb-0005CD-4g
	for bug-guix@gnu.org; Fri, 21 Dec 2018 13:35:07 -0500
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
	(envelope-from <Debian-debbugs@debbugs.gnu.org>) id 1gaPdW-0005aq-J8
	for bug-guix@gnu.org; Fri, 21 Dec 2018 13:35:07 -0500
Received: from debbugs.gnu.org ([208.118.235.43]:54519)
	by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16)
	(Exim 4.71) (envelope-from <Debian-debbugs@debbugs.gnu.org>)
	id 1gaPdV-0005Z9-Up
	for bug-guix@gnu.org; Fri, 21 Dec 2018 13:35:02 -0500
Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.84_2)
	(envelope-from <Debian-debbugs@debbugs.gnu.org>) id 1gaPdV-0004tU-Pu
	for bug-guix@gnu.org; Fri, 21 Dec 2018 13:35:01 -0500
Sender: "Debbugs-submit" <debbugs-submit-bounces@debbugs.gnu.org>
Resent-Message-ID: <handler.33831.B.154541728818788@debbugs.gnu.org>
Received: from eggs.gnu.org ([2001:4830:134:3::10]:41371)
	by lists.gnu.org with esmtp (Exim 4.71)
	(envelope-from <rekado@elephly.net>) id 1gaPd2-00059M-ET
	for bug-guix@gnu.org; Fri, 21 Dec 2018 13:34:33 -0500
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
	(envelope-from <rekado@elephly.net>) id 1gaPcz-00052y-6t
	for bug-guix@gnu.org; Fri, 21 Dec 2018 13:34:32 -0500
Received: from sender-of-o53.zoho.com ([135.84.80.218]:21836)
	by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32)
	(Exim 4.71) (envelope-from <rekado@elephly.net>) id 1gaPcw-00050S-TL
	for bug-guix@gnu.org; Fri, 21 Dec 2018 13:34:27 -0500
List-Id: Bug reports for GNU Guix <bug-guix.gnu.org>
List-Unsubscribe: <https://lists.gnu.org/mailman/options/bug-guix>,
	<mailto:bug-guix-request@gnu.org?subject=unsubscribe>
List-Archive: <http://lists.gnu.org/archive/html/bug-guix/>
List-Post: <mailto:bug-guix@gnu.org>
List-Help: <mailto:bug-guix-request@gnu.org?subject=help>
List-Subscribe: <https://lists.gnu.org/mailman/listinfo/bug-guix>,
	<mailto:bug-guix-request@gnu.org?subject=subscribe>
Errors-To: bug-guix-bounces+gcggb-bug-guix=m.gmane.org@gnu.org
Sender: "bug-Guix" <bug-guix-bounces+gcggb-bug-guix=m.gmane.org@gnu.org>
To: 33831@debbugs.gnu.org

The Gstreamer framework generates a binary registry of discovered
plugins in ~/.cache/gstreamer-1.0/registry.ARCH.bin (where ARCH is the
CPU architecture).

This cache contains references to store items.  Since the registry is
not under the control of Guix it may go stale, causing Gstreamer to use
old (and potentially vulnerable) plugins.  A user may delete the
registry as it will be recreated automatically.

We should aim to build the registry in a profile hook.  According to the
gst-launch man page, the GST_REGISTRY environment variable can be used
to override the defautl location of the registry file.  When the
GST_REGISTRY_UPDATE variable is set to =E2=80=9Cno=E2=80=9D, Gstreamer won=
=E2=80=99t attempt to
update the registry.

--
Ricardo


PS: IBus has the same problem.  See bug 22707.