Hello,

I pushed ‘wip-grafts’, a branch that implements “grafts.”

Normally security updates deep in the DAG, such as an update of Bash or
libc, cause a rebuild of everything, which can some time, as we’ve seen
lately.

The idea of grafts is to graft the fixed package on any packages users
may want to install.  So, suppose there’s a libc fix; when installing
IceCat, you’ll just be starting from the (pre-built) IceCat, and an
additional derivation will patch the files in it to replace references
to the old libc with references to the fixed libc (in practice this only
works if the file name of the old and fixed libc have the same length.)

‘wip-grafts’ adds a ‘graft’ field to package records.  In the example
above, we’d just add a ‘graft’ field to glibc, pointing to the fixed
glibc, and the graft would just be automagically applied.  The branch
has an example of that with Bash: