Leo Famulari schreef op zo 09-05-2021 om 10:07 [-0400]:
> On Sun, May 09, 2021 at 02:53:09PM +0200, Sebastian Pipping wrote:
> > The related soversions are:
> > 
> >   2.2. 9 = 7:11:6 -> libexpatso.1.6.11 (GUIX today)
> >   2.2.10 = 7:12:6 -> libexpatso.1.6.12
> >   2.3. 0 = 8: 0:7 -> libexpatso.1.7.0 (GUIX W.I.P.)
> >   2.4. 0 = 9: 0:8 -> libexpatso.1.8.0 (upcoming)
> 
> Alright, in this case we'll need to cherry-pick the relevant bug fixes.

I don't think so, because ...

> See the manual section Security Updates for this note:
> 
> "Other restrictions may apply: for instance, when adding a graft to a
> package providing a shared library, the original shared library and its
> replacement must have the same SONAME [...]

They do have the same SONAME.

$ guix build expat@2.3.0 expat@2.2.9 --no-grafts
> /gnu/store/imh5xxqw10dql4crlngbbjh4r24raf4j-expat-2.2.9
> /gnu/store/nc1yqjbrb5xalaycz70l8sk88xjnapy5-expat-2.3.0

$ objdump -x /gnu/store/imh5xxqw10dql4crlngbbjh4r24raf4j-expat-2.2.9/lib/libexpat.so.1 | grep -F SONAME
>   SONAME               libexpat.so.1
$ objdump -x /gnu/store/nc1yqjbrb5xalaycz70l8sk88xjnapy5-expat-2.3.0/lib/libexpat.so.1 | grep -F SONAME
>   SONAME               libexpat.so.1

>  and be binary-compatible."

The .6.11 and .8.0 are not part of the SONAME.

Greetings,
Maxime.