Efraim Flashner <efraim@flashner.co.il> writes:

> There's a large number of CVEs against binutils@2.28. Gentoo¹ has a nice
> long list of the CVEs, and I've put together a patch to graft a
> replacement, but I'm getting grafting errors:
> ERROR: replacement length differs from the original length "h9nqlf0c82c1sds4yzs60k7pm4f37si2-binutils-2.28" "wl5dg3dnqvk2v2ahh5iadnv1s34rsbb6-binutils-2.28.1"

This is because the replacement name is two bytes longer (.1).

To fix it, the version field of the replacement must be set to something
with equal length of "2.28".  I suppose we can use just that and
hard-code the source URL?