[SECURITY] Which packages bundle sqlite?

[SECURITY] Which packages bundle sqlite?

[Alex Vong]

[-- Attachment #1: Type: text/plain, Size: 371 bytes --]

Hello Guix,

Recently, a remote execution vulnerability is discovered in
sqlite[0][1]. Apart from updating the sqlite package, I think we need to
update all packages bundling sqlite as well. What do you think?

Cheers,
Alex

[0]: https://blade.tencent.com/magellan/index_en.html
[1]: https://www.reddit.com/r/netsec/comments/a6ab59/magellan_sqlite_remote_code_execution/

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 227 bytes --]

Re: [SECURITY] Which packages bundle sqlite?

[Alex Vong]

[-- Attachment #1: Type: text/plain, Size: 677 bytes --]

I also want to know should we graft in this case since updating sqlite
would cause ~4000s rebuilts. Besides, how to deal with packages that
inherit sqlite when grafting?
(e.g. sqlite-with-fts5 and sqlite-with-column-metadata)

Thanks,
Alex

Alex Vong <alexvong1995@gmail.com> writes:

> Hello Guix,
>
> Recently, a remote execution vulnerability is discovered in
> sqlite[0][1]. Apart from updating the sqlite package, I think we need to
> update all packages bundling sqlite as well. What do you think?
>
> Cheers,
> Alex
>
> [0]: https://blade.tencent.com/magellan/index_en.html
> [1]:
> https://www.reddit.com/r/netsec/comments/a6ab59/magellan_sqlite_remote_code_execution/

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 227 bytes --]

bug#33751: [SECURITY] Which packages bundle sqlite?

[Mark H Weaver]

Hi Alex,

This issue is being tracked at <https://bugs.gnu.org/33751>,
so it would be best to send followups regarding this issue to
<33751@debbugs.gnu.org>.

Alex Vong <alexvong1995@gmail.com> writes:

> I also want to know should we graft in this case since updating sqlite
> would cause ~4000s rebuilts.

Yes, it should be grafted.

> Besides, how to deal with packages that
> inherit sqlite when grafting?
> (e.g. sqlite-with-fts5 and sqlite-with-column-metadata)

These should be changed to use the 'package/inherit' macro.

Thanks for working on it!

      Mark

Re: [SECURITY] Which packages bundle sqlite?

[Mark H Weaver]

Hi Alex,

This issue is being tracked at <https://bugs.gnu.org/33751>,
so it would be best to send followups regarding this issue to
<33751@debbugs.gnu.org>.

Alex Vong <alexvong1995@gmail.com> writes:

> I also want to know should we graft in this case since updating sqlite
> would cause ~4000s rebuilts.

Yes, it should be grafted.

> Besides, how to deal with packages that
> inherit sqlite when grafting?
> (e.g. sqlite-with-fts5 and sqlite-with-column-metadata)

These should be changed to use the 'package/inherit' macro.

Thanks for working on it!

      Mark

bug#33751: [SECURITY] Which packages bundle sqlite?

[Alex Vong]

[-- Attachment #1: Type: text/plain, Size: 822 bytes --]

Hi Mark,

Mark H Weaver <mhw@netris.org> writes:

> Hi Alex,
>
> This issue is being tracked at <https://bugs.gnu.org/33751>,
> so it would be best to send followups regarding this issue to
> <33751@debbugs.gnu.org>.
>
Thanks for pointing me to the right place. I checked guix-patches but
not guix...

> Alex Vong <alexvong1995@gmail.com> writes:
>
>> I also want to know should we graft in this case since updating sqlite
>> would cause ~4000s rebuilts.
>
> Yes, it should be grafted.
>
>> Besides, how to deal with packages that
>> inherit sqlite when grafting?
>> (e.g. sqlite-with-fts5 and sqlite-with-column-metadata)
>
> These should be changed to use the 'package/inherit' macro.
>
I sent the patch to
<https://debbugs.gnu.org/cgi/bugreport.cgi?bug=33783>.

> Thanks for working on it!
>
>       Mark

Cheers,
Alex

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 227 bytes --]