Re: [PATCH]: gnu: gnurl: Update to 7.50.1.

[ng0 <ng0@we.make.ritual.n0.is>]

Leo Famulari <leo@famulari.name> writes:

> On Sun, Aug 14, 2016 at 09:18:11AM +0000, ng0 wrote:
>> ng0 <ng0@we.make.ritual.n0.is> writes:
>> > ng0 <ng0@we.make.ritual.n0.is> writes:
>> >> Leo Famulari <leo@famulari.name> writes:
>> >>> Can you add a comment explaining why test1139 is disabled? Just saying
>> >>> that it won't work doesn't tell those reading the package why it is
>> >>> disabled.
>> >>
>> >> My assumption: files or lines of code are searched which will not exist
>> >> in gnurl. If this is not just us (sadly in Gentoo i have test/checks
>> >> disabled for this package), I will fix this upstream.
>> >> If your perl knowledge is better look at the failing test yourself. This
>> >> is my best judgment with the little perl knowledge I have.
>> >> It was just ruling out what could cause the test failure.
>> >
>> > Is this okay?
>> 
>> Can someone tell me if this is okay or if it needs further changes?
>> I'd like to update this.
>
> Okay, I think it should updated too, considering that gnurl is a cURL
> fork, and that the latest release of cURL fixed these bugs:
>
> CVE-2016-5419:
> https://curl.haxx.se/docs/adv_20160803A.html
> CVE-2016-5420:
> https://curl.haxx.se/docs/adv_20160803B.html
> CVE-2016-5421:
> https://curl.haxx.se/docs/adv_20160803C.html
>
> Pushed as 5f9d5905745.

Thanks,

> Will you file a bug report with the gnurl developers about this failing
> test and reply to this email with a link to the bug report?

yes I will do so and see who can fix it.

> Ideally, the package update commit would include a link to the upstream
> bug report about the failing test, but I'm not going to wait for the
> link to update this.

I see, I thought this should just be placed into comments in the package
definition. Makes sense to include it in the commit message.

> If a Guix package is passing its entire test suite, we should react to
> new tests failures proactively. That means that we should try to
> understand the problem, and work with the upstream developers to fix the
> problem.

-- 
♥Ⓐ  ng0
For non-prism friendly talk find me on http://www.psyced.org