Re: 02/03: gnu: nghttp2: Update to 1.31.1 [fixes CVE-2018-1000168].

Re: 02/03: gnu: nghttp2: Update to 1.31.1 [fixes CVE-2018-1000168].

[Mark H Weaver]

Hi Marius,

mbakke@fastmail.com (Marius Bakke) writes:

> mbakke pushed a commit to branch master
> in repository guix.
>
> commit 65bfe30d8a4e930599603f6d835023bbd0dbcb9a
> Author: Marius Bakke <mbakke@fastmail.com>
> Date:   Thu Apr 12 19:43:31 2018 +0200
>
>     gnu: nghttp2: Update to 1.31.1 [fixes CVE-2018-1000168].
>     
>     * gnu/packages/web.scm (nghttp2): Update to 1.31.1.

Thank you for this, but it would entail far too many builds to update on
the 'master' branch.  'curl' depends on 'nghttp2'.  According to 'guix
refresh -l', it would require 2839 rebuilds on x86_64.

Would you like to fix this with a graft instead?

       Mark

Re: 02/03: gnu: nghttp2: Update to 1.31.1 [fixes CVE-2018-1000168].

[Marius Bakke]

[-- Attachment #1: Type: text/plain, Size: 890 bytes --]

Mark H Weaver <mhw@netris.org> writes:

> Hi Marius,
>
> mbakke@fastmail.com (Marius Bakke) writes:
>
>> mbakke pushed a commit to branch master
>> in repository guix.
>>
>> commit 65bfe30d8a4e930599603f6d835023bbd0dbcb9a
>> Author: Marius Bakke <mbakke@fastmail.com>
>> Date:   Thu Apr 12 19:43:31 2018 +0200
>>
>>     gnu: nghttp2: Update to 1.31.1 [fixes CVE-2018-1000168].
>>     
>>     * gnu/packages/web.scm (nghttp2): Update to 1.31.1.
>
> Thank you for this, but it would entail far too many builds to update on
> the 'master' branch.  'curl' depends on 'nghttp2'.  According to 'guix
> refresh -l', it would require 2839 rebuilds on x86_64.

On 'master', nghttp2 only has 1 dependent, the reverse curl dependency
was added in this 'core-updates'.

Since we haven't started the "full" core-updates on Hydra yet, I figured
it was okay.  What do you think?

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 487 bytes --]

Re: 02/03: gnu: nghttp2: Update to 1.31.1 [fixes CVE-2018-1000168].

[Mark H Weaver]

Marius Bakke <mbakke@fastmail.com> writes:

> Mark H Weaver <mhw@netris.org> writes:
>
>> Hi Marius,
>>
>> mbakke@fastmail.com (Marius Bakke) writes:
>>
>>> mbakke pushed a commit to branch master
>>> in repository guix.
>>>
>>> commit 65bfe30d8a4e930599603f6d835023bbd0dbcb9a
>>> Author: Marius Bakke <mbakke@fastmail.com>
>>> Date:   Thu Apr 12 19:43:31 2018 +0200
>>>
>>>     gnu: nghttp2: Update to 1.31.1 [fixes CVE-2018-1000168].
>>>     
>>>     * gnu/packages/web.scm (nghttp2): Update to 1.31.1.
>>
>> Thank you for this, but it would entail far too many builds to update on
>> the 'master' branch.  'curl' depends on 'nghttp2'.  According to 'guix
>> refresh -l', it would require 2839 rebuilds on x86_64.
>
> On 'master', nghttp2 only has 1 dependent, the reverse curl dependency
> was added in this 'core-updates'.

Ah, sorry for the mistake.  I just reverted my revert.

> Since we haven't started the "full" core-updates on Hydra yet, I figured
> it was okay.  What do you think?

Okay.  I just merged master into core-updates, so that those of us
tracking core-updates can start rebuilding it again.

     Thanks,
       Mark