#47144 - security patching of 'patch' package

Package	Source(s)		Maintainer(s)
guix		PTS Buildd Popcon

Message #41 received at 47144@debbugs.gnu.org (full text, mbox, reply):

Received: (at 47144) by debbugs.gnu.org; 31 May 2024 16:37:41 +0000
From debbugs-submit-bounces@debbugs.gnu.org Fri May 31 12:37:41 2024
Received: from localhost ([127.0.0.1]:55251 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.84_2)
	(envelope-from <debbugs-submit-bounces@debbugs.gnu.org>)
	id 1sD5Ft-00011z-QD
	for submit@debbugs.gnu.org; Fri, 31 May 2024 12:37:40 -0400
Received: from mail-wm1-f53.google.com ([209.85.128.53]:39811)
 by debbugs.gnu.org with esmtp (Exim 4.84_2)
 (envelope-from <zimon.toutoune@gmail.com>) id 1sD5Fp-00011W-L2
 for 47144@debbugs.gnu.org; Fri, 31 May 2024 12:37:22 -0400
Received: by mail-wm1-f53.google.com with SMTP id
 5b1f17b1804b1-42111cf1ca1so3006305e9.3
 for <47144@debbugs.gnu.org>; Fri, 31 May 2024 09:37:10 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
 d=gmail.com; s=20230601; t=1717173365; x=1717778165; darn=debbugs.gnu.org;
 h=content-transfer-encoding:mime-version:message-id:date:references
 :in-reply-to:subject:cc:to:from:from:to:cc:subject:date:message-id
 :reply-to; bh=txeQ0ljwGVTJuhWD5rpMd88GLxJ84rjjnTubQ4s26nY=;
 b=Naeuicqyqi+PGW7MOr3e8nXdrKliDc4v+T8vWNvZ5+Yw55duYtPRNGZNj+V4dmUICk
 xnj5mTOxSFPOsdAnbRtZqAfCmftppXeaLM6U5arai1TbbwHKXPgRXIiaNyGehYRgTX6j
 u9ou3NGah1GkUTYRKJHo5jiUqAjewyiFwJPIanKh5qUX3DwYP9CHvaHTtg3WjCzLpejG
 m0SyF1NnYWaLGxJOSbWTvveozsjRksMkigGWA12UXYw7j0k4KzYJKFcWFH37cQqq/v7M
 nwM55FRRJNoThkV7Wd9CHmPPdH/BXVWiegKGPn7x2j0IeWD9qH1aF1DhnsvNX7fvzF4X
 Ehrg==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
 d=1e100.net; s=20230601; t=1717173365; x=1717778165;
 h=content-transfer-encoding:mime-version:message-id:date:references
 :in-reply-to:subject:cc:to:from:x-gm-message-state:from:to:cc
 :subject:date:message-id:reply-to;
 bh=txeQ0ljwGVTJuhWD5rpMd88GLxJ84rjjnTubQ4s26nY=;
 b=By1Ds/1rcWcWp5T4WbapNaNgqhb8hlwqJpgSeP8x90w29V+U6oYb7ihntdfgWx3MYO
 uo5fxQJehQJs14IFhZPQv/EVwKfxocTUEsnxEbto/+JKjN1KpOvTLeToBOWIaScZQRjh
 0Kbpo/t/2I554hAl1gmjwcLEUbpC0T8WY1l2CJtx+iVwGyzxwNeLFSkr6C5nQSCdKE9F
 jqwkpxbYODcYSfel1j0T+TWt1aOrUM0Yflem/nACzj84uPCSnXvBRnN77Lq9c71myUkx
 pX+NdXbR8I3U7wATWcfhichKPWwjbac/38fREqDBQ3cQjxy2+NRtCa8eE7xMALspzRPQ
 Yg7g==
X-Forwarded-Encrypted: i=1;
 AJvYcCX/GtPDFmZeLxK7IKxUDx1Bx62tszuAoudTz8KMiC174sbnLWyojlplE2ExkCc0RNWijsZUoLUGxBq2ZtIGFVdI2BSsJHM=
X-Gm-Message-State: AOJu0YzXrEDuXax6rXynuSzmgQzuoAXNovsk7NfPC2b5BWNidn7lDfCe
 XGD4oXDTZOZooPaPod7Z+C+svrkfnLoYFuA1AIW+mKIORZi5BbCh
X-Google-Smtp-Source: AGHT+IE16lqpvcN8P6mQqpxvpy0Q57qbCe6L5rKAjDmcbBWi6exs/oG0aHC2h7B3Vn2tc4rca+deVQ==
X-Received: by 2002:a05:600c:1c1d:b0:41f:9c43:574f with SMTP id
 5b1f17b1804b1-4212e0c3a8amr19787645e9.3.1717173364780; 
 Fri, 31 May 2024 09:36:04 -0700 (PDT)
Received: from lili ([81.185.168.12]) by smtp.gmail.com with ESMTPSA id
 5b1f17b1804b1-42127069305sm60289125e9.22.2024.05.31.09.36.03
 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
 Fri, 31 May 2024 09:36:04 -0700 (PDT)
From: Simon Tournier <zimon.toutoune@gmail.com>
To: Maxim Cournoyer <maxim.cournoyer@gmail.com>, 47144@debbugs.gnu.org
Subject: Re: bug#47144: [PATCH 3/3] gnu: patch: Graft to latest commit
 [security fixes].
In-Reply-To: <5eda21a09360653b198f1b0d7f52cf531dc97485.1717124361.git.maxim.cournoyer@gmail.com>
References: <28b457771ab0e7ad87cb65600a5898f68be5074a.1717124361.git.maxim.cournoyer@gmail.com>
 <5eda21a09360653b198f1b0d7f52cf531dc97485.1717124361.git.maxim.cournoyer@gmail.com>
Date: Fri, 31 May 2024 18:13:00 +0200
Message-ID: <87zfs62c4z.fsf@gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
X-Spam-Score: 0.0 (/)
X-Debbugs-Envelope-To: 47144
Cc: Mark H Weaver <mhw@netris.org>,
 Ludovic Courtès <ludo@gnu.org>,
 Vivien Kraus <vivien@planete-kraus.eu>,
 Maxim Cournoyer <maxim.cournoyer@gmail.com>, Leo Famulari <leo@famulari.name>
X-BeenThere: debbugs-submit@debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request@debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit@debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request@debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request@debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces@debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces@debbugs.gnu.org>
X-Spam-Score: -1.0 (-)

Hi Maxim,

On Thu, 30 May 2024 at 22:59, Maxim Cournoyer <maxim.cournoyer@gmail.com> wrote:

> +      (source (origin
> +                (inherit (package-source patch))
> +                (method git-fetch)
> +                (uri (git-reference
> +                      (url "https://git.savannah.gnu.org/git/patch.git")
> +                      (commit commit)))
> +                (file-name (git-file-name name version))
> +                (sha256
> +                 (base32
> +                  "1bk38169c0xh01b0q0zmnrjqz8k9byz3arp4q7q66sn6xwf94nvz"))))

If I read correctly, (package-source patch) reads:

--8<---------------cut here---------------start------------->8---
    (source (origin
              (method url-fetch)
              (uri (string-append "mirror://gnu/patch/patch-"
                                  version ".tar.xz"))
              (sha256
               (base32
                "1zfqy4rdcy279vwn2z1kbv19dcfw25d2aqy9nzvdkq5bjzd0nqdc"))
              (patches (search-patches "patch-hurd-path-max.patch"))))
--8<---------------cut here---------------end--------------->8---

Therefore the only thing that is copied is the ’patches’ field.  Right?

I think it would easy the readability to avoid ’inherit’ and plainly
write ’patches’.


Cheers,
simon

Display info messages

Send a report that this bug log contains spam.

debbugs.gnu.org maintainers <help-debbugs@gnu.org>. Last modified: Sat Dec 21 17:02:01 2024; Machine Name: wallace-server

GNU bug tracking system

Debbugs is free software and licensed under the terms of the GNU Public License version 2. The current version can be obtained from https://bugs.debian.org/debbugs-source/.

#47144 security patching of 'patch' package