GNU bug report logs

#47144 security patching of 'patch' package

PackageSource(s)Maintainer(s)
guix PTS Buildd Popcon
Full log

Message #77 received at 47144@debbugs.gnu.org (full text, mbox, reply):

Received: (at 47144) by debbugs.gnu.org; 5 Jun 2024 01:26:13 +0000
From debbugs-submit-bounces@debbugs.gnu.org Tue Jun 04 21:26:13 2024
Received: from localhost ([127.0.0.1]:41215 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.84_2)
	(envelope-from <debbugs-submit-bounces@debbugs.gnu.org>)
	id 1sEfPo-0007FC-6X
	for submit@debbugs.gnu.org; Tue, 04 Jun 2024 21:26:13 -0400
Received: from mail-yw1-f181.google.com ([209.85.128.181]:59852)
 by debbugs.gnu.org with esmtp (Exim 4.84_2)
 (envelope-from <maxim.cournoyer@gmail.com>) id 1sEfPk-0007ED-IJ
 for 47144@debbugs.gnu.org; Tue, 04 Jun 2024 21:26:10 -0400
Received: by mail-yw1-f181.google.com with SMTP id
 00721157ae682-62a0873c6e4so65090067b3.3
 for <47144@debbugs.gnu.org>; Tue, 04 Jun 2024 18:25:54 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
 d=gmail.com; s=20230601; t=1717550688; x=1718155488; darn=debbugs.gnu.org;
 h=content-transfer-encoding:mime-version:references:in-reply-to
 :message-id:date:subject:cc:to:from:from:to:cc:subject:date
 :message-id:reply-to;
 bh=2TbQm5uouq+AgGZASD/tOSuurtpedKIx2xqIQOjHWoE=;
 b=gAQBkGhsWI29sUTtJlzREeeMyfC1KB147NoMzrq/wA1asMa+4L+2PAPlGWryGxsqPD
 5dN/En53w7mmFgzIlsjgu/MK7lP6K2wXPpYxi9mKsEqsa/fT06SAFgZIvP0WSzkrGQTI
 h7kWSvDO2v79lXHvLCOZ1prll99orL2gB4Mi4qlJ38lO4VGsn7EU5GAvC+XP4rn+XYpM
 1uvs2e4Vk5Lt8RA+KHY8y9XX6LzhUNqLisLgvmmulePPzx/HWgo3LSAEg9zGWhqWXPac
 a13/3PHKrJTn9hDrdcXT0eUKuzl9o76BIlpT04gtmuc3EAycwTUbG4I5DpFbP2ER/H3H
 6BMw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
 d=1e100.net; s=20230601; t=1717550688; x=1718155488;
 h=content-transfer-encoding:mime-version:references:in-reply-to
 :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc
 :subject:date:message-id:reply-to;
 bh=2TbQm5uouq+AgGZASD/tOSuurtpedKIx2xqIQOjHWoE=;
 b=BCzimBzetl0xWWKAEpO2KGW50kbzCmE6IE2nnss9Gz6BPgfhp90f7nyCqwPtXJkor+
 KAKoVY84KYcdGQKquUZGGytzZGJQryWzxuYnRqcXHUW8kKXEfPkr3MxoLrb6QVBDr4Dm
 7EQd/DEdo4m9ISfwgLQ7Lrkry0jYwCLDC5hQ6wBqXfYROUJisCI+KFd+1INZH36v6vpH
 Ol7jPCbcsD//NqwdADAn3WEe9yJUEiLlPprHiIYpyimgmZzRANBBF+9iAhOEvPjWdFtd
 fPz6TqqcToACXC14BoWsNlRsmuTMyIhQpgI1U9nciIO817V6NIGBPyOfGC6Q7C3qXXXs
 V9Ow==
X-Gm-Message-State: AOJu0Yw2h4rwh73Xja9bN0YhmNMIwrBcSR159Tiv+yyBP2YIYZW1oLGk
 qVb0fAd41HptnYJ4HilrX21WhYDDYdecEdVanUGmVofZgLVowDaU+20Y4emt
X-Google-Smtp-Source: AGHT+IFgdMjnJADOL/bafcoxEKHUwuzqbs+VAN5bKQmdNY0uVK4NzFYAZ23ByOhaiurlsyn3CvhWzA==
X-Received: by 2002:a25:d303:0:b0:dfa:6e39:95af with SMTP id
 3f1490d57ef6-dfacad0b47bmr1340124276.53.1717550687861; 
 Tue, 04 Jun 2024 18:24:47 -0700 (PDT)
Received: from localhost.localdomain (dsl-154-1.b2b2c.ca. [66.158.154.1])
 by smtp.gmail.com with ESMTPSA id
 6a1803df08f44-6ae4b429a70sm43950116d6.128.2024.06.04.18.24.47
 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
 Tue, 04 Jun 2024 18:24:47 -0700 (PDT)
From: Maxim Cournoyer <maxim.cournoyer@gmail.com>
To: 47144@debbugs.gnu.org
Subject: [PATCH v3 3/3] gnu: patch: Graft to latest commit [security fixes].
Date: Tue,  4 Jun 2024 21:24:28 -0400
Message-ID: <6637c8e33997272ab489b7f35e587c3abd77b82b.1717550623.git.maxim.cournoyer@gmail.com>
X-Mailer: git-send-email 2.45.1
In-Reply-To: <a3641c8501b839cb4490edca279bf15a8141b8ea.1717550623.git.maxim.cournoyer@gmail.com>
References: <a3641c8501b839cb4490edca279bf15a8141b8ea.1717550623.git.maxim.cournoyer@gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
X-Debbugs-Cc: Mark H Weaver <mhw@netris.org>, Ludovic Courtès <ludo@gnu.org>, Léo Le Bouter <lle-bout@zaclys.net>, Leo Famulari <leo@famulari.name>, Maxim Cournoyer <maxim.cournoyer@gmail.com>, Simon Tournier <zimon.toutoune@gmail.com>
Content-Transfer-Encoding: 8bit
X-Spam-Score: 0.0 (/)
X-Debbugs-Envelope-To: 47144
Cc: Mark H Weaver <mhw@netris.org>, Maxim Cournoyer <maxim.cournoyer@gmail.com>
X-BeenThere: debbugs-submit@debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request@debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit@debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request@debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request@debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces@debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces@debbugs.gnu.org>
X-Spam-Score: -1.0 (-)

* gnu/packages/base.scm (patch/fixed): New variable.
(patch) [replacement]: Graft with the above.

Fixes: https://issues.guix.gnu.org/47144
Reported-by: Mark H Weaver <mhw@netris.org>
Change-Id: I54ae41b735f5ba0ebad30ebdfaabe0ccdc3f9873
---

Changes in v3:
 - Do not use inheritance for patch/fixed origin

Changes in v2:
 - Use same version to have the same store length, a graft requirement
 - Copy the gnulib source in a phase to avoid introducing a dependency cycle

 gnu/packages/base.scm | 52 ++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 51 insertions(+), 1 deletion(-)

diff --git a/gnu/packages/base.scm b/gnu/packages/base.scm
index bbe5b8cf57..3246b7bd0a 100644
--- a/gnu/packages/base.scm
+++ b/gnu/packages/base.scm
@@ -19,7 +19,7 @@
 ;;; Copyright © 2021 Leo Le Bouter <lle-bout@zaclys.net>
 ;;; Copyright © 2021 Maxime Devos <maximedevos@telenet.be>
 ;;; Copyright © 2021 Guillaume Le Vaillant <glv@posteo.net>
-;;; Copyright © 2021 Maxim Cournoyer <maxim.cournoyer@gmail.com>
+;;; Copyright © 2021, 2024 Maxim Cournoyer <maxim.cournoyer@gmail.com>
 ;;; Copyright © 2022 zamfofex <zamfofex@twdb.moe>
 ;;; Copyright © 2022 John Kehayias <john.kehayias@protonmail.com>
 ;;; Copyright © 2023 Josselin Poiret <dev@jpoiret.xyz>
@@ -46,8 +46,10 @@ (define-module (gnu packages base)
   #:use-module (gnu packages acl)
   #:use-module (gnu packages algebra)
   #:use-module (gnu packages attr)
+  #:use-module (gnu packages autotools)
   #:use-module (gnu packages bash)
   #:use-module (gnu packages bison)
+  #:use-module (gnu packages build-tools)
   #:use-module (gnu packages gcc)
   #:use-module (gnu packages guile)
   #:use-module (gnu packages multiprecision)
@@ -263,6 +265,7 @@ (define-public tar
 
 (define-public patch
   (package
+    (replacement patch/fixed)
     (name "patch")
     (version "2.7.6")
     (source (origin
@@ -291,6 +294,53 @@ (define-public patch
     (license gpl3+)
     (home-page "https://savannah.gnu.org/projects/patch/")))
 
+(define patch/fixed
+  ;; The latest release is from 2018, and lacks multiple security related
+  ;; patches.  Since Fedora carries 23 patches, simply use the latest commit
+  ;; until a proper release is made.
+  (let ((revision "0")
+        (commit "f144b35425d9d7732ea5485034c1a6b7a106ab92"))
+    (package
+      (inherit patch)
+      (name "patch")
+      ;; TODO: Uncomment when ungrafting.
+      ;;(version (git-version "2.7.6" revision commit))
+      (source (origin
+                (method git-fetch)
+                (uri (git-reference
+                      (url "https://git.savannah.gnu.org/git/patch.git")
+                      (commit commit)))
+                ;; TODO: Uncomment when ungrafting and using the above
+                ;; 'git-version'-computed version.
+                ;;(file-name (git-file-name name version))
+                (sha256
+                 (base32
+                  "1bk38169c0xh01b0q0zmnrjqz8k9byz3arp4q7q66sn6xwf94nvz"))
+                (patches (search-patches "patch-hurd-path-max.patch"))))
+      (arguments
+       (substitute-keyword-arguments (package-arguments patch)
+         ((#:phases phases '%standard-phases)
+          #~(modify-phases #$phases
+              (add-after 'unpack 'copy-gnulib-sources
+                (lambda _
+                  ;; XXX: We copy the source instead of using 'gnulib' as a
+                  ;; native input to avoid introducing a dependency cycle with.
+                  (copy-recursively #+gnulib "gnulib")
+                  (setenv "GNULIB_SRCDIR"
+                          (string-append (getcwd) "/gnulib/src/gnulib"))))
+              (add-after 'copy-gnulib-sources 'update-bootstrap-script
+                (lambda _
+                  (copy-file "gnulib/src/gnulib/build-aux/bootstrap"
+                             "bootstrap")))
+              (add-after 'unpack 'patch-configure.ac
+                (lambda _
+                  (substitute* "configure.ac"
+                    ;; The gnulib-provided git-version-gen script has a plain
+                    ;; shebang of #!/bin/sh; avoid using it.
+                    (("build-aux/git-version-gen" all)
+                     (string-append "sh " all)))))))))
+      (native-inputs (list autoconf automake bison ed)))))
+
 (define-public diffutils
   (package
    (name "diffutils")
-- 
2.45.1

Send a report that this bug log contains spam.

debbugs.gnu.org maintainers <help-debbugs@gnu.org>. Last modified: Mon Dec 30 18:08:36 2024; Machine Name: wallace-server

GNU bug tracking system

Debbugs is free software and licensed under the terms of the GNU Public License version 2. The current version can be obtained from https://bugs.debian.org/debbugs-source/.

Copyright © 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson, 2005-2017 Don Armstrong, and many other contributors.