GNU bug report logs

#47144 security patching of 'patch' package

PackageSource(s)Maintainer(s)
guix PTS Buildd Popcon
Full log

Message #38 received at 47144@debbugs.gnu.org (full text, mbox, reply):

Received: (at 47144) by debbugs.gnu.org; 31 May 2024 03:03:18 +0000
From debbugs-submit-bounces@debbugs.gnu.org Thu May 30 23:03:18 2024
Received: from localhost ([127.0.0.1]:52897 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.84_2)
	(envelope-from <debbugs-submit-bounces@debbugs.gnu.org>)
	id 1sCsY1-0002LX-Fr
	for submit@debbugs.gnu.org; Thu, 30 May 2024 23:03:18 -0400
Received: from mail-oi1-f180.google.com ([209.85.167.180]:55346)
 by debbugs.gnu.org with esmtp (Exim 4.84_2)
 (envelope-from <maxim.cournoyer@gmail.com>) id 1sCsXx-0002L2-Hj
 for 47144@debbugs.gnu.org; Thu, 30 May 2024 23:03:16 -0400
Received: by mail-oi1-f180.google.com with SMTP id
 5614622812f47-3d1bb1c3b74so922057b6e.2
 for <47144@debbugs.gnu.org>; Thu, 30 May 2024 20:03:00 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
 d=gmail.com; s=20230601; t=1717124514; x=1717729314; darn=debbugs.gnu.org;
 h=content-transfer-encoding:mime-version:references:in-reply-to
 :message-id:date:subject:cc:to:from:from:to:cc:subject:date
 :message-id:reply-to;
 bh=N2NT4UL9+9BT+D/MYdu5/s2bc0OBSlSZ++cpaNhskjw=;
 b=FbXgeS5vAFh/PwhuSlFZ1PACwYzX+4ZY4ZHwywgFuuIHZHPNcagpWCya7XZO/WnJcD
 /yNstuZyMhSK6qqjuvTj6a0pbPDJDyZrPchf16ydQGGA/mMskuKKdL96JGJwU8Q+YS+6
 xngbaVBfyKhOEWsTewBoKF7wYTXuo4XHF6BS7Wsz6Og42NG3aGVXW4cOP0LESGUzOOav
 PD5GSAf5sfGAgHzWyvVHZDuxBK4MCmes7jbYE3sNJEWWwvrlPQL2dxg2AiiuaqcWYoWt
 4CO5j6iUeBCPgJszmK4aexcOBfX2302rZnFHDmUSlxHQ+21AlyEmt2D3tvTDYA2CuAVh
 imfQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
 d=1e100.net; s=20230601; t=1717124514; x=1717729314;
 h=content-transfer-encoding:mime-version:references:in-reply-to
 :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc
 :subject:date:message-id:reply-to;
 bh=N2NT4UL9+9BT+D/MYdu5/s2bc0OBSlSZ++cpaNhskjw=;
 b=r+bf+yADEL6/bFMn7ge3vr5T70qGopXM3304pvSolqU3rZ0jGY4pbRPJ5lkyxZWBqp
 /xytJkopRYcRnAKA7CymZgKfhxyNZ9MoF6j5hyHKsDrLZJod82oXz/xchCRXsiNvi6RG
 lJNBFwS+S3TzwUMhXo5bHh6tT80zh3bD0PkMl8YFFKSGZsXWY7v0iA+ZmxobTGBWN3qM
 1+WEpHD/NVKNey8TIqQgGjujJNaynMeSsZH/myM2TLkXwkMd5AHo0p1ObE/DliX2lbOb
 PVMLed2VCpfPZjWAYyy20JZMA0w7k7IXih5W64OwEMhqqT/qbNxYA+yOS/YXmfupGLWj
 Z7Hw==
X-Gm-Message-State: AOJu0YwO3n5ouisv69sVssK/De5a8e0Tw9yaNFIY851AYUzVMZooA9nH
 PaSqzRN+hLA7RSMq+3XGD23XHUVUqdC00LxWoL38Z081Thl8SMSH0cRfhTyr
X-Google-Smtp-Source: AGHT+IGN74TDaWEskY91DVtTxLBnZQtSIA9w2L6kzjvcZ15RESxpWYKyzWN/YnPEy5uv0ZRhQPgIBg==
X-Received: by 2002:a05:6808:1115:b0:3c9:69b9:6fa4 with SMTP id
 5614622812f47-3d1e35cbd08mr478094b6e.48.1717124513827; 
 Thu, 30 May 2024 20:01:53 -0700 (PDT)
Received: from localhost.localdomain (dsl-205-233-124-92.b2b2c.ca.
 [205.233.124.92]) by smtp.gmail.com with ESMTPSA id
 d75a77b69052e-43ff259ba48sm4036491cf.95.2024.05.30.20.01.52
 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
 Thu, 30 May 2024 20:01:53 -0700 (PDT)
From: Maxim Cournoyer <maxim.cournoyer@gmail.com>
To: 47144@debbugs.gnu.org
Subject: [PATCH 3/3] gnu: patch: Graft to latest commit [security fixes].
Date: Thu, 30 May 2024 22:59:21 -0400
Message-ID: <5eda21a09360653b198f1b0d7f52cf531dc97485.1717124361.git.maxim.cournoyer@gmail.com>
X-Mailer: git-send-email 2.41.0
In-Reply-To: <28b457771ab0e7ad87cb65600a5898f68be5074a.1717124361.git.maxim.cournoyer@gmail.com>
References: <28b457771ab0e7ad87cb65600a5898f68be5074a.1717124361.git.maxim.cournoyer@gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
X-Debbugs-Cc: Ludovic Courtès <ludo@gnu.org>
Content-Transfer-Encoding: 8bit
X-Spam-Score: 0.0 (/)
X-Debbugs-Envelope-To: 47144
Cc: Mark H Weaver <mhw@netris.org>,
 Ludovic Courtès <ludo@gnu.org>,
 Vivien Kraus <vivien@planete-kraus.eu>,
 Maxim Cournoyer <maxim.cournoyer@gmail.com>, Leo Famulari <leo@famulari.name>
X-BeenThere: debbugs-submit@debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request@debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit@debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request@debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request@debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces@debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces@debbugs.gnu.org>
X-Spam-Score: -1.0 (-)

* gnu/packages/base.scm (patch/fixed): New variable.
(patch) [replacement]: Graft with the above.

Fixes: https://issues.guix.gnu.org/47144
Reported-by: Mark H Weaver <mhw@netris.org>
Change-Id: I54ae41b735f5ba0ebad30ebdfaabe0ccdc3f9873
---

 gnu/packages/base.scm | 44 ++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 43 insertions(+), 1 deletion(-)

diff --git a/gnu/packages/base.scm b/gnu/packages/base.scm
index bbe5b8cf57..8dcbf4b087 100644
--- a/gnu/packages/base.scm
+++ b/gnu/packages/base.scm
@@ -19,7 +19,7 @@
 ;;; Copyright © 2021 Leo Le Bouter <lle-bout@zaclys.net>
 ;;; Copyright © 2021 Maxime Devos <maximedevos@telenet.be>
 ;;; Copyright © 2021 Guillaume Le Vaillant <glv@posteo.net>
-;;; Copyright © 2021 Maxim Cournoyer <maxim.cournoyer@gmail.com>
+;;; Copyright © 2021, 2024 Maxim Cournoyer <maxim.cournoyer@gmail.com>
 ;;; Copyright © 2022 zamfofex <zamfofex@twdb.moe>
 ;;; Copyright © 2022 John Kehayias <john.kehayias@protonmail.com>
 ;;; Copyright © 2023 Josselin Poiret <dev@jpoiret.xyz>
@@ -46,8 +46,10 @@ (define-module (gnu packages base)
   #:use-module (gnu packages acl)
   #:use-module (gnu packages algebra)
   #:use-module (gnu packages attr)
+  #:use-module (gnu packages autotools)
   #:use-module (gnu packages bash)
   #:use-module (gnu packages bison)
+  #:use-module (gnu packages build-tools)
   #:use-module (gnu packages gcc)
   #:use-module (gnu packages guile)
   #:use-module (gnu packages multiprecision)
@@ -263,6 +265,7 @@ (define-public tar
 
 (define-public patch
   (package
+    (replacement patch/fixed)
     (name "patch")
     (version "2.7.6")
     (source (origin
@@ -291,6 +294,45 @@ (define-public patch
     (license gpl3+)
     (home-page "https://savannah.gnu.org/projects/patch/")))
 
+(define patch/fixed
+  ;; The latest release is from 2018, and lacks multiple security related
+  ;; patches.  Since Fedora carries 23 patches, simply use the latest commit
+  ;; until a proper release is made.
+  (let ((revision "0")
+        (commit "f144b35425d9d7732ea5485034c1a6b7a106ab92"))
+    (package
+      (inherit patch)
+      (name "patch")
+      (version (git-version "2.7.6" revision commit))
+      (source (origin
+                (inherit (package-source patch))
+                (method git-fetch)
+                (uri (git-reference
+                      (url "https://git.savannah.gnu.org/git/patch.git")
+                      (commit commit)))
+                (file-name (git-file-name name version))
+                (sha256
+                 (base32
+                  "1bk38169c0xh01b0q0zmnrjqz8k9byz3arp4q7q66sn6xwf94nvz"))))
+      (arguments
+       (substitute-keyword-arguments (package-arguments patch)
+         ((#:phases phases '%standard-phases)
+          #~(modify-phases #$phases
+              (add-after 'unpack 'update-bootstrap-script
+                (lambda* (#:key native-inputs inputs #:allow-other-keys)
+                  (copy-file (search-input-file
+                              (or native-inputs inputs)
+                              "src/gnulib/build-aux/bootstrap")
+                             "bootstrap")))
+              (add-after 'unpack 'patch-configure.ac
+                (lambda _
+                  (substitute* "configure.ac"
+                    ;; The gnulib-provided git-version-gen script has a plain
+                    ;; shebang of #!/bin/sh; avoid using it.
+                    (("build-aux/git-version-gen" all)
+                     (string-append "sh " all)))))))))
+      (native-inputs (list autoconf automake bison ed gnulib)))))
+
 (define-public diffutils
   (package
    (name "diffutils")
-- 
2.41.0

Send a report that this bug log contains spam.

debbugs.gnu.org maintainers <help-debbugs@gnu.org>. Last modified: Sat Dec 21 16:55:47 2024; Machine Name: wallace-server

GNU bug tracking system

Debbugs is free software and licensed under the terms of the GNU Public License version 2. The current version can be obtained from https://bugs.debian.org/debbugs-source/.

Copyright © 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson, 2005-2017 Don Armstrong, and many other contributors.