GNU bug report logs

#47144 security patching of 'patch' package

PackageSource(s)Maintainer(s)
guix PTS Buildd Popcon
Full log

Message #56 received at 47144@debbugs.gnu.org (full text, mbox, reply):

Received: (at 47144) by debbugs.gnu.org; 1 Jun 2024 12:58:41 +0000
From debbugs-submit-bounces@debbugs.gnu.org Sat Jun 01 08:58:41 2024
Received: from localhost ([127.0.0.1]:55878 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.84_2)
	(envelope-from <debbugs-submit-bounces@debbugs.gnu.org>)
	id 1sDOJl-0004iR-9E
	for submit@debbugs.gnu.org; Sat, 01 Jun 2024 08:58:41 -0400
Received: from mail-ot1-f50.google.com ([209.85.210.50]:48374)
 by debbugs.gnu.org with esmtp (Exim 4.84_2)
 (envelope-from <maxim.cournoyer@gmail.com>) id 1sDOJi-0004hp-1i
 for 47144@debbugs.gnu.org; Sat, 01 Jun 2024 08:58:39 -0400
Received: by mail-ot1-f50.google.com with SMTP id
 46e09a7af769-6f8e9d4dff3so1869455a34.0
 for <47144@debbugs.gnu.org>; Sat, 01 Jun 2024 05:58:26 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
 d=gmail.com; s=20230601; t=1717246639; x=1717851439; darn=debbugs.gnu.org;
 h=content-transfer-encoding:mime-version:references:in-reply-to
 :message-id:date:subject:cc:to:from:from:to:cc:subject:date
 :message-id:reply-to;
 bh=AEm6y6j+YVcyrI4JxP0l1uybH6IWygZEl8tfYA7Li3Y=;
 b=WjRmQqbmttEAYsmyim5vmWyLih75Xn44Ahfw5Jpa4nY3PY6HfmHKMexbVt43+IU2lj
 nrK5Sk/xwo/kas7sdOCtNdM5VfYBtvqbInqAApRJR2i2pNuM+pPvkcwqbYO/uKMCaTbg
 jr2J9E4EbYERx0/5qXH7VTXbH5Ja4XDz4aMeD6MnTNdiGdMOed0G9EgHd8VpbXFRKXhj
 uS+EInqUcck0dcU2jSTUtG1zoJKHRbV0QDxx/kAbpi+Ld7N7xHO3xWIbRqkLVT9Ts5DZ
 2qsHmLqpZijnnJYAFZ29C5ULto+XBGohZ8ALt99U132TI05wf4MhgnX+HiKqG/z4HaHD
 VQ3g==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
 d=1e100.net; s=20230601; t=1717246639; x=1717851439;
 h=content-transfer-encoding:mime-version:references:in-reply-to
 :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc
 :subject:date:message-id:reply-to;
 bh=AEm6y6j+YVcyrI4JxP0l1uybH6IWygZEl8tfYA7Li3Y=;
 b=eJfGMVr8wy7pj8UqkCpIVWaOHMqJ1GJ4SC/6mCN4NnvCa71rZWcUmhHqZdmj0PToBk
 Yvaa4vj1Eo3SQKJoK5eF8HdfyY3zufqwhkYm/1xQN11PvF8tRvpxqe/t/lI+oTDqMWA9
 4FRq8FnM8K9ADP0hFxy8QDizRztkY8x0awwUh6Dt/AEVYJnvUteWcmwotyVQ0HyDMU+O
 iSfsQDLU4oJqXNPqqfKyPmdKECA4DYCcVe8yOMyhYsHOehYAf4vq6Gz2ABbv6iii1WaH
 VB9IzqlZfr5gy3eVYt7SmLf0HuYZebIM5pbaZDYrm/lj7LeHSglR5TU3A+t7fQJFuG83
 vz7A==
X-Gm-Message-State: AOJu0Yzfg8GT+oj1EoXqkLsUL1ZwnvDU2lxJqV+H3Bw/VvpSRgYjmrBq
 EzJZ554RQHfB6KcGb93KDW4a+EyhzzvQ1lOm13d4zcZ1qTC82YSLTS90uw==
X-Google-Smtp-Source: AGHT+IHNvvRiYhE8JI5Ydq5KcUNpyIPx6dg2C4GLo4Zl1gq0H1WkrRWz74CQxvKR2ZFuYPpSQhx9nQ==
X-Received: by 2002:a05:6808:2389:b0:3ca:b21a:7936 with SMTP id
 5614622812f47-3d1e347739fmr5606264b6e.3.1717246638739; 
 Sat, 01 Jun 2024 05:57:18 -0700 (PDT)
Received: from localhost.localdomain (dsl-10-130-93.b2b2c.ca. [72.10.130.93])
 by smtp.gmail.com with ESMTPSA id
 6a1803df08f44-6ae4b40660csm14189026d6.85.2024.06.01.05.57.17
 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
 Sat, 01 Jun 2024 05:57:18 -0700 (PDT)
From: Maxim Cournoyer <maxim.cournoyer@gmail.com>
To: 47144@debbugs.gnu.org
Subject: [PATCH v2 3/3] gnu: patch: Graft to latest commit [security fixes].
Date: Sat,  1 Jun 2024 08:56:49 -0400
Message-ID: <fa71e5023e26c025307a2a11be911e4b008580d7.1717246609.git.maxim.cournoyer@gmail.com>
X-Mailer: git-send-email 2.41.0
In-Reply-To: <a3641c8501b839cb4490edca279bf15a8141b8ea.1717246609.git.maxim.cournoyer@gmail.com>
References: <a3641c8501b839cb4490edca279bf15a8141b8ea.1717246609.git.maxim.cournoyer@gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
X-Debbugs-Cc: Ludovic Courtès <ludo@gnu.org>
Content-Transfer-Encoding: 8bit
X-Spam-Score: 0.0 (/)
X-Debbugs-Envelope-To: 47144
Cc: Mark H Weaver <mhw@netris.org>,
 Ludovic Courtès <ludo@gnu.org>,
 Vivien Kraus <vivien@planete-kraus.eu>,
 Maxim Cournoyer <maxim.cournoyer@gmail.com>, Leo Famulari <leo@famulari.name>
X-BeenThere: debbugs-submit@debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request@debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit@debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request@debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request@debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces@debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces@debbugs.gnu.org>
X-Spam-Score: -1.0 (-)

* gnu/packages/base.scm (patch/fixed): New variable.
(patch) [replacement]: Graft with the above.

Fixes: https://issues.guix.gnu.org/47144
Reported-by: Mark H Weaver <mhw@netris.org>
Change-Id: I54ae41b735f5ba0ebad30ebdfaabe0ccdc3f9873
---

Changes in v2:
 - Use same version to have the same store length, a graft requirement
 - Copy the gnulib source in a phase to avoid introducing a dependency cycle

 gnu/packages/base.scm | 52 ++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 51 insertions(+), 1 deletion(-)

diff --git a/gnu/packages/base.scm b/gnu/packages/base.scm
index bbe5b8cf57..45dbf77817 100644
--- a/gnu/packages/base.scm
+++ b/gnu/packages/base.scm
@@ -19,7 +19,7 @@
 ;;; Copyright © 2021 Leo Le Bouter <lle-bout@zaclys.net>
 ;;; Copyright © 2021 Maxime Devos <maximedevos@telenet.be>
 ;;; Copyright © 2021 Guillaume Le Vaillant <glv@posteo.net>
-;;; Copyright © 2021 Maxim Cournoyer <maxim.cournoyer@gmail.com>
+;;; Copyright © 2021, 2024 Maxim Cournoyer <maxim.cournoyer@gmail.com>
 ;;; Copyright © 2022 zamfofex <zamfofex@twdb.moe>
 ;;; Copyright © 2022 John Kehayias <john.kehayias@protonmail.com>
 ;;; Copyright © 2023 Josselin Poiret <dev@jpoiret.xyz>
@@ -46,8 +46,10 @@ (define-module (gnu packages base)
   #:use-module (gnu packages acl)
   #:use-module (gnu packages algebra)
   #:use-module (gnu packages attr)
+  #:use-module (gnu packages autotools)
   #:use-module (gnu packages bash)
   #:use-module (gnu packages bison)
+  #:use-module (gnu packages build-tools)
   #:use-module (gnu packages gcc)
   #:use-module (gnu packages guile)
   #:use-module (gnu packages multiprecision)
@@ -263,6 +265,7 @@ (define-public tar
 
 (define-public patch
   (package
+    (replacement patch/fixed)
     (name "patch")
     (version "2.7.6")
     (source (origin
@@ -291,6 +294,53 @@ (define-public patch
     (license gpl3+)
     (home-page "https://savannah.gnu.org/projects/patch/")))
 
+(define patch/fixed
+  ;; The latest release is from 2018, and lacks multiple security related
+  ;; patches.  Since Fedora carries 23 patches, simply use the latest commit
+  ;; until a proper release is made.
+  (let ((revision "0")
+        (commit "f144b35425d9d7732ea5485034c1a6b7a106ab92"))
+    (package
+      (inherit patch)
+      (name "patch")
+      ;; TODO: Uncomment when ungrafting.
+      ;;(version (git-version "2.7.6" revision commit))
+      (source (origin
+                (inherit (package-source patch))
+                (method git-fetch)
+                (uri (git-reference
+                      (url "https://git.savannah.gnu.org/git/patch.git")
+                      (commit commit)))
+                ;; TODO: Uncomment when ungrafting and using the above
+                ;; 'git-version'-computed version.
+                ;;(file-name (git-file-name name version))
+                (sha256
+                 (base32
+                  "1bk38169c0xh01b0q0zmnrjqz8k9byz3arp4q7q66sn6xwf94nvz"))))
+      (arguments
+       (substitute-keyword-arguments (package-arguments patch)
+         ((#:phases phases '%standard-phases)
+          #~(modify-phases #$phases
+              (add-after 'unpack 'copy-gnulib-sources
+                (lambda _
+                  ;; XXX: We copy the source instead of using 'gnulib' as a
+                  ;; native input to avoid introducing a dependency cycle with.
+                  (copy-recursively #+gnulib "gnulib")
+                  (setenv "GNULIB_SRCDIR"
+                          (string-append (getcwd) "/gnulib/src/gnulib"))))
+              (add-after 'copy-gnulib-sources 'update-bootstrap-script
+                (lambda _
+                  (copy-file "gnulib/src/gnulib/build-aux/bootstrap"
+                             "bootstrap")))
+              (add-after 'unpack 'patch-configure.ac
+                (lambda _
+                  (substitute* "configure.ac"
+                    ;; The gnulib-provided git-version-gen script has a plain
+                    ;; shebang of #!/bin/sh; avoid using it.
+                    (("build-aux/git-version-gen" all)
+                     (string-append "sh " all)))))))))
+      (native-inputs (list autoconf automake bison ed)))))
+
 (define-public diffutils
   (package
    (name "diffutils")
-- 
2.41.0

Send a report that this bug log contains spam.

debbugs.gnu.org maintainers <help-debbugs@gnu.org>. Last modified: Sat Dec 21 16:57:52 2024; Machine Name: wallace-server

GNU bug tracking system

Debbugs is free software and licensed under the terms of the GNU Public License version 2. The current version can be obtained from https://bugs.debian.org/debbugs-source/.

Copyright © 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson, 2005-2017 Don Armstrong, and many other contributors.