gnURL 7.55.0

Done

Details

4 participants

Leo Famulari
Marius Bakke
Tobias Geerinckx-Rice
ng0

Owner: unassigned

Submitted by: ng0

Severity: normal

ng0 wrote on 9 Aug 2017 18:00

Recipients:(address . guix-patches@gnu.org)

Message-ID:20170809160025.2w2theyhhrba4zsd@abyayala

Appended patch.
-- 
ng0
GnuPG: A88C8ADD129828D7EAC02E52E22F9BBFEE348588
GnuPG: https://n0is.noblogs.org/my-keys
https://www.infotropique.orghttps://krosos.org

From 13129d51ac4dd5ac7f5e7b74997297139a40be12 Mon Sep 17 00:00:00 2001

* gnu/packages/gnunet.scm (gnurl): Update to 7.55.0.

---

gnu/packages/gnunet.scm | 6 +++---

1 file changed, 3 insertions(+), 3 deletions(-)

Toggle diff (32 lines)diff --git a/gnu/packages/gnunet.scm b/gnu/packages/gnunet.scm
index 9ca2d9502..497afaf66 100644
--- a/gnu/packages/gnunet.scm
+++ b/gnu/packages/gnunet.scm
@@ -5,7 +5,7 @@
 ;;; Copyright © 2015 Efraim Flashner <efraim@flashner.co.il>
 ;;; Copyright © 2016 Ricardo Wurmus <rekado@elephly.net>
 ;;; Copyright © 2016 Mark H Weaver <mhw@netris.org>
-;;; Copyright © 2016, 2017 ng0 <ng0@no-reply.infotropique.org>
+;;; Copyright © 2016, 2017 ng0 <ng0@infotropique.org>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -186,14 +186,14 @@ and support for SSL3 and TLS.")
 (define-public gnurl
   (package
    (name "gnurl")
-   (version "7.54.1")
+   (version "7.55.0")
    (source (origin
             (method url-fetch)
             (uri (string-append "https://gnunet.org/sites/default/files/"
                                 name "-" version ".tar.bz2"))
             (sha256
              (base32
-              "0szbj352h95sgc9kbx9wzkgjksmg3g5k6cvlc7hz3wrbdh5gb0a4"))))
+              "0i9bik76rbyag3mbxbk8j383iaxs5v7lmjkn4v36ascl6bdks6vn"))))
    (build-system gnu-build-system)
    (outputs '("out"
               "doc"))                             ; 1.5 MiB of man3 pages
-- 
2.14.0

Tobias Geerinckx-Rice wrote on 9 Aug 2017 18:25

Recipients:(address . 28027-done@debbugs.gnu.org)

Message-ID:9e3ce4e5-de13-1fbb-5a6f-71d38fa218ce@tobias.gr

ng0 wrote on 09/08/17 at 18:00:

Toggle quote (7 lines)

> From 13129d51ac4dd5ac7f5e7b74997297139a40be12 Mon Sep 17 00:00:00 2001

> From: ng0 <ng0@infotropique.org>

> Date: Wed, 9 Aug 2017 15:58:43 +0000

> Subject: [PATCH] gnu: gnurl: Update to 7.55.0.

> * gnu/packages/gnunet.scm (gnurl): Update to 7.55.0.

Thanks! Pushed as 28e12d6c81cef2aca7f792f3c99037a649faa9b0.

Kind regards,

T G-R

Attachment: signature.asc

Closed

Leo Famulari wrote on 9 Aug 2017 19:48

curl security update [was Re: bug#28027: gnURL 7.55.0]

Recipients:

Message-ID:20170809174842.GA24193@jasmine.lan

On Wed, Aug 09, 2017 at 06:25:39PM +0200, Tobias Geerinckx-Rice wrote:

Toggle quote (10 lines)> ng0 wrote on 09/08/17 at 18:00:
> > From 13129d51ac4dd5ac7f5e7b74997297139a40be12 Mon Sep 17 00:00:00 2001
> > From: ng0 <ng0@infotropique.org>
> > Date: Wed, 9 Aug 2017 15:58:43 +0000
> > Subject: [PATCH] gnu: gnurl: Update to 7.55.0.
> > 
> > * gnu/packages/gnunet.scm (gnurl): Update to 7.55.0.
> 
> Thanks! Pushed as 28e12d6c81cef2aca7f792f3c99037a649faa9b0.

Great! Can somebody also update the curl replacement?

Leo Famulari wrote on 9 Aug 2017 20:50

Recipients:

Message-ID:20170809185007.GA1177@jasmine.lan

On Wed, Aug 09, 2017 at 01:48:42PM -0400, Leo Famulari wrote:

Toggle quote (13 lines)> On Wed, Aug 09, 2017 at 06:25:39PM +0200, Tobias Geerinckx-Rice wrote:
> > ng0 wrote on 09/08/17 at 18:00:
> > > From 13129d51ac4dd5ac7f5e7b74997297139a40be12 Mon Sep 17 00:00:00 2001
> > > From: ng0 <ng0@infotropique.org>
> > > Date: Wed, 9 Aug 2017 15:58:43 +0000
> > > Subject: [PATCH] gnu: gnurl: Update to 7.55.0.
> > > 
> > > * gnu/packages/gnunet.scm (gnurl): Update to 7.55.0.
> > 
> > Thanks! Pushed as 28e12d6c81cef2aca7f792f3c99037a649faa9b0.
> 
> Great! Can somebody also update the curl replacement?

Actually, I'll do it :)

Leo Famulari wrote on 9 Aug 2017 21:20

Recipients:

Message-ID:20170809192008.GA31762@jasmine.lan

On Wed, Aug 09, 2017 at 02:50:07PM -0400, Leo Famulari wrote:

Toggle quote (16 lines)> On Wed, Aug 09, 2017 at 01:48:42PM -0400, Leo Famulari wrote:
> > On Wed, Aug 09, 2017 at 06:25:39PM +0200, Tobias Geerinckx-Rice wrote:
> > > ng0 wrote on 09/08/17 at 18:00:
> > > > From 13129d51ac4dd5ac7f5e7b74997297139a40be12 Mon Sep 17 00:00:00 2001
> > > > From: ng0 <ng0@infotropique.org>
> > > > Date: Wed, 9 Aug 2017 15:58:43 +0000
> > > > Subject: [PATCH] gnu: gnurl: Update to 7.55.0.
> > > > 
> > > > * gnu/packages/gnunet.scm (gnurl): Update to 7.55.0.
> > > 
> > > Thanks! Pushed as 28e12d6c81cef2aca7f792f3c99037a649faa9b0.
> > 
> > Great! Can somebody also update the curl replacement?
> 
> Actually, I'll do it :)

With the attached patch, it fails to build, because the man 3 pages
aren't built and thus can't be copied into the doc output. I'm not sure
what's going on :/

From 08c84864837fdc6ca44633a05cb2ba166391a063 Mon Sep 17 00:00:00 2001
From: Leo Famulari <leo@famulari.name>
Date: Wed, 9 Aug 2017 14:42:21 -0400
Subject: [PATCH] gnu: curl: Update to 7.55.0 [fixes
 CVE-2017-{1000100,1000101,1000099}].

* gnu/packages/curl.scm (curl)[replacement]: Update to 7.55.0.
(curl-7.54.1): Replace with ...
(curl-7.55): ... new variable.
---
 gnu/packages/curl.scm | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

Toggle diff (35 lines)diff --git a/gnu/packages/curl.scm b/gnu/packages/curl.scm
index a9f219b62..82e80bf8f 100644
--- a/gnu/packages/curl.scm
+++ b/gnu/packages/curl.scm
@@ -40,7 +40,7 @@
 (define-public curl
   (package
    (name "curl")
-   (replacement curl-7.54.1)
+   (replacement curl-7.55)
    (version "7.53.0")
    (source (origin
             (method url-fetch)
@@ -121,15 +121,15 @@ tunneling, and so on.")
                                   "See COPYING in the distribution."))
    (home-page "https://curl.haxx.se/")))
 
-(define curl-7.54.1
+(define curl-7.55
   (package
     (inherit curl)
-    (version "7.54.1")
+    (version "7.55.0")
     (source
       (origin
         (method url-fetch)
         (uri (string-append "https://curl.haxx.se/download/curl-"
-                            version ".tar.lzma"))
+                            version ".tar.xz"))
         (sha256
          (base32
-          "0vnv3cz0s1l5cjby86hm0x6pgzqijmdm97qa9q5px200956z6yib"))))))
+          "1785vxi0jamiv9d1wr1l45g0fm9ircxdfyfzf7ld8zv0z0i8bmfd"))))))
-- 
2.14.0

ng0 wrote on 9 Aug 2017 21:54

Recipients:(name . Leo Famulari)(address . leo@famulari.name)

Message-ID:20170809195415.zfrn3m4su53vdsb7@abyayala

Leo Famulari transcribed 1.6K bytes:

Toggle quote (16 lines)> On Wed, Aug 09, 2017 at 01:48:42PM -0400, Leo Famulari wrote:
> > On Wed, Aug 09, 2017 at 06:25:39PM +0200, Tobias Geerinckx-Rice wrote:
> > > ng0 wrote on 09/08/17 at 18:00:
> > > > From 13129d51ac4dd5ac7f5e7b74997297139a40be12 Mon Sep 17 00:00:00 2001
> > > > From: ng0 <ng0@infotropique.org>
> > > > Date: Wed, 9 Aug 2017 15:58:43 +0000
> > > > Subject: [PATCH] gnu: gnurl: Update to 7.55.0.
> > > > 
> > > > * gnu/packages/gnunet.scm (gnurl): Update to 7.55.0.
> > > 
> > > Thanks! Pushed as 28e12d6c81cef2aca7f792f3c99037a649faa9b0.
> > 
> > Great! Can somebody also update the curl replacement?
> 
> Actually, I'll do it :)

Heh. Bam, faster than cURL this time :)
Should I just do cURL and gnURL? I see changes in cURL when I make new
releases for gnURL, but I'm not volunteering for doing both ;)
-- 
ng0
GnuPG: A88C8ADD129828D7EAC02E52E22F9BBFEE348588
GnuPG: https://n0is.noblogs.org/my-keys
https://www.infotropique.orghttps://krosos.org

ng0 wrote on 9 Aug 2017 22:05

Recipients:(name . Leo Famulari)(address . leo@famulari.name)

Message-ID:20170809200523.i5k5p23ebdcxvouc@abyayala

Leo Famulari transcribed 3.7K bytes:

Toggle quote (21 lines)> On Wed, Aug 09, 2017 at 02:50:07PM -0400, Leo Famulari wrote:
> > On Wed, Aug 09, 2017 at 01:48:42PM -0400, Leo Famulari wrote:
> > > On Wed, Aug 09, 2017 at 06:25:39PM +0200, Tobias Geerinckx-Rice wrote:
> > > > ng0 wrote on 09/08/17 at 18:00:
> > > > > From 13129d51ac4dd5ac7f5e7b74997297139a40be12 Mon Sep 17 00:00:00 2001
> > > > > From: ng0 <ng0@infotropique.org>
> > > > > Date: Wed, 9 Aug 2017 15:58:43 +0000
> > > > > Subject: [PATCH] gnu: gnurl: Update to 7.55.0.
> > > > > 
> > > > > * gnu/packages/gnunet.scm (gnurl): Update to 7.55.0.
> > > > 
> > > > Thanks! Pushed as 28e12d6c81cef2aca7f792f3c99037a649faa9b0.
> > > 
> > > Great! Can somebody also update the curl replacement?
> > 
> > Actually, I'll do it :)
> 
> With the attached patch, it fails to build, because the man 3 pages
> aren't built and thus can't be copied into the doc output. I'm not sure
> what's going on :/

As written on IRC: Take a look at the 2 commits after tagged 7.55.0,

if you apply both you will have a successful build. I did this manually

(by hand, not taking the commits) for gnURL release.

Toggle quote (53 lines)> From 08c84864837fdc6ca44633a05cb2ba166391a063 Mon Sep 17 00:00:00 2001
> From: Leo Famulari <leo@famulari.name>
> Date: Wed, 9 Aug 2017 14:42:21 -0400
> Subject: [PATCH] gnu: curl: Update to 7.55.0 [fixes
>  CVE-2017-{1000100,1000101,1000099}].
> 
> * gnu/packages/curl.scm (curl)[replacement]: Update to 7.55.0.
> (curl-7.54.1): Replace with ...
> (curl-7.55): ... new variable.
> ---
>  gnu/packages/curl.scm | 10 +++++-----
>  1 file changed, 5 insertions(+), 5 deletions(-)
> 
> diff --git a/gnu/packages/curl.scm b/gnu/packages/curl.scm
> index a9f219b62..82e80bf8f 100644
> --- a/gnu/packages/curl.scm
> +++ b/gnu/packages/curl.scm
> @@ -40,7 +40,7 @@
>  (define-public curl
>    (package
>     (name "curl")
> -   (replacement curl-7.54.1)
> +   (replacement curl-7.55)
>     (version "7.53.0")
>     (source (origin
>              (method url-fetch)
> @@ -121,15 +121,15 @@ tunneling, and so on.")
>                                    "See COPYING in the distribution."))
>     (home-page "https://curl.haxx.se/")))
>  
> -(define curl-7.54.1
> +(define curl-7.55
>    (package
>      (inherit curl)
> -    (version "7.54.1")
> +    (version "7.55.0")
>      (source
>        (origin
>          (method url-fetch)
>          (uri (string-append "https://curl.haxx.se/download/curl-"
> -                            version ".tar.lzma"))
> +                            version ".tar.xz"))
>          (sha256
>           (base32
> -          "0vnv3cz0s1l5cjby86hm0x6pgzqijmdm97qa9q5px200956z6yib"))))))
> +          "1785vxi0jamiv9d1wr1l45g0fm9ircxdfyfzf7ld8zv0z0i8bmfd"))))))
> -- 
> 2.14.0
> 

-- 
ng0
GnuPG: A88C8ADD129828D7EAC02E52E22F9BBFEE348588
GnuPG: https://n0is.noblogs.org/my-keys
https://www.infotropique.orghttps://krosos.org

Marius Bakke wrote on 9 Aug 2017 22:22

Re: [bug#28027] curl security update [was Re: bug#28027: gnURL 7.55.0]

Recipients:

Message-ID:87inhw4hkd.fsf@fastmail.com

ng0 <ng0@infotropique.org> writes:

Toggle quote (26 lines)> Leo Famulari transcribed 3.7K bytes:
>> On Wed, Aug 09, 2017 at 02:50:07PM -0400, Leo Famulari wrote:
>> > On Wed, Aug 09, 2017 at 01:48:42PM -0400, Leo Famulari wrote:
>> > > On Wed, Aug 09, 2017 at 06:25:39PM +0200, Tobias Geerinckx-Rice wrote:
>> > > > ng0 wrote on 09/08/17 at 18:00:
>> > > > > From 13129d51ac4dd5ac7f5e7b74997297139a40be12 Mon Sep 17 00:00:00 2001
>> > > > > From: ng0 <ng0@infotropique.org>
>> > > > > Date: Wed, 9 Aug 2017 15:58:43 +0000
>> > > > > Subject: [PATCH] gnu: gnurl: Update to 7.55.0.
>> > > > > 
>> > > > > * gnu/packages/gnunet.scm (gnurl): Update to 7.55.0.
>> > > > 
>> > > > Thanks! Pushed as 28e12d6c81cef2aca7f792f3c99037a649faa9b0.
>> > > 
>> > > Great! Can somebody also update the curl replacement?
>> > 
>> > Actually, I'll do it :)
>> 
>> With the attached patch, it fails to build, because the man 3 pages
>> aren't built and thus can't be copied into the doc output. I'm not sure
>> what's going on :/
>
> As written on IRC: Take a look at the 2 commits after tagged 7.55.0,
> if you apply both you will have a successful build. I did this manually
> (by hand, not taking the commits) for gnURL release.

Here is a patch that fixes the doc installation:

From f93502a48b368c74ba4ed1ff573f07f59b8c91f1 Mon Sep 17 00:00:00 2001

Fixes CVE-2017-1000099, CVE-2017-1000100, and CVE-2017-100101.

See https://curl.haxx.se/docs/security.html for details.

* gnu/packages/curl.scm (curl)[replacement]: New field.

(curl-7.55.0): New variable.

---

gnu/packages/curl.scm | 27 +++++++++++++++++++++++++++

1 file changed, 27 insertions(+)

Toggle diff (58 lines)diff --git a/gnu/packages/curl.scm b/gnu/packages/curl.scm
index af15aa38c..0c551e108 100644
--- a/gnu/packages/curl.scm
+++ b/gnu/packages/curl.scm
@@ -4,6 +4,7 @@
 ;;; Copyright © 2015 Tomáš ?ech <sleep_walker@suse.cz>
 ;;; Copyright © 2015 Ludovic Courtès <ludo@gnu.org>
 ;;; Copyright © 2016, 2017 Leo Famulari <leo@famulari.name>
+;;; Copyright © 2017 Marius Bakke <mbakke@fastmail.com>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -24,6 +25,7 @@
   #:use-module ((guix licenses) #:prefix license:)
   #:use-module (guix packages)
   #:use-module (guix download)
+  #:use-module (guix utils)
   #:use-module (guix build-system gnu)
   #:use-module (gnu packages)
   #:use-module (gnu packages compression)
@@ -40,6 +42,7 @@
 (define-public curl
   (package
    (name "curl")
+   (replacement curl-7.55.0)
    (version "7.54.1")
    (source (origin
             (method url-fetch)
@@ -119,3 +122,27 @@ tunneling, and so on.")
    (license (license:non-copyleft "file://COPYING"
                                   "See COPYING in the distribution."))
    (home-page "https://curl.haxx.se/")))
+
+(define-public curl-7.55.0
+  (package
+    (inherit curl)
+    (version "7.55.0")
+    (source (origin
+              (method url-fetch)
+              (uri (string-append "https://curl.haxx.se/download/curl-"
+                                  version ".tar.xz"))
+              (sha256
+               (base32
+                "1785vxi0jamiv9d1wr1l45g0fm9ircxdfyfzf7ld8zv0z0i8bmfd"))))
+    (arguments
+     `(,@(substitute-keyword-arguments (package-arguments curl)
+           ((#:phases phases)
+            `(modify-phases ,phases
+               (add-before 'install 'fix-Makefile
+                 ;; Fix a regression in 7.55 where docs are not installed.
+                 ;; https://github.com/curl/curl/commit/a7bbbb7c368c6096802007f61f19a02e9d75285b
+                 (lambda _
+                   (substitute* "Makefile"
+                     (("install-data-hook:\n")
+                      "install-data-hook:\n\tcd docs/libcurl && $(MAKE) install\n"))
+                   #t)))))))))
-- 
2.14.0

Marius Bakke wrote on 9 Aug 2017 23:55

Recipients:

Message-ID:871sok4d9n.fsf@fastmail.com

Leo Famulari <leo@famulari.name> writes:

Toggle quote (21 lines)> On Wed, Aug 09, 2017 at 02:50:07PM -0400, Leo Famulari wrote:
>> On Wed, Aug 09, 2017 at 01:48:42PM -0400, Leo Famulari wrote:
>> > On Wed, Aug 09, 2017 at 06:25:39PM +0200, Tobias Geerinckx-Rice wrote:
>> > > ng0 wrote on 09/08/17 at 18:00:
>> > > > From 13129d51ac4dd5ac7f5e7b74997297139a40be12 Mon Sep 17 00:00:00 2001
>> > > > From: ng0 <ng0@infotropique.org>
>> > > > Date: Wed, 9 Aug 2017 15:58:43 +0000
>> > > > Subject: [PATCH] gnu: gnurl: Update to 7.55.0.
>> > > > 
>> > > > * gnu/packages/gnunet.scm (gnurl): Update to 7.55.0.
>> > > 
>> > > Thanks! Pushed as 28e12d6c81cef2aca7f792f3c99037a649faa9b0.
>> > 
>> > Great! Can somebody also update the curl replacement?
>> 
>> Actually, I'll do it :)
>
> With the attached patch, it fails to build, because the man 3 pages
> aren't built and thus can't be copied into the doc output. I'm not sure
> what's going on :/

It seems our worked collided again. :-)

I 'ported' the earlier patch to master and will push it shortly if there

are no objections:

From 6f9bbbafd4cc857c2b093f3cced6df2e45f56aab Mon Sep 17 00:00:00 2001

Fixes CVE-2017-1000099, CVE-2017-1000100, and CVE-2017-100101.

See https://curl.haxx.se/docs/security.html for details.

* gnu/packages/curl.scm (curl)[replacement]: New field.

(curl-7.55.0): New variable.

---

gnu/packages/curl.scm | 24 +++++++++++++++++++-----

1 file changed, 19 insertions(+), 5 deletions(-)

Toggle diff (63 lines)diff --git a/gnu/packages/curl.scm b/gnu/packages/curl.scm
index a9f219b62..d6e32e438 100644
--- a/gnu/packages/curl.scm
+++ b/gnu/packages/curl.scm
@@ -4,6 +4,7 @@
 ;;; Copyright © 2015 Tomáš ?ech <sleep_walker@suse.cz>
 ;;; Copyright © 2015 Ludovic Courtès <ludo@gnu.org>
 ;;; Copyright © 2016, 2017 Leo Famulari <leo@famulari.name>
+;;; Copyright © 2017 Marius Bakke <mbakke@fastmail.com>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -24,6 +25,7 @@
   #:use-module ((guix licenses) #:prefix license:)
   #:use-module (guix packages)
   #:use-module (guix download)
+  #:use-module (guix utils)
   #:use-module (guix build-system gnu)
   #:use-module (gnu packages)
   #:use-module (gnu packages compression)
@@ -40,7 +42,7 @@
 (define-public curl
   (package
    (name "curl")
-   (replacement curl-7.54.1)
+   (replacement curl-7.55.0)
    (version "7.53.0")
    (source (origin
             (method url-fetch)
@@ -121,15 +123,27 @@ tunneling, and so on.")
                                   "See COPYING in the distribution."))
    (home-page "https://curl.haxx.se/")))
 
-(define curl-7.54.1
+(define-public curl-7.55.0
   (package
     (inherit curl)
-    (version "7.54.1")
+    (version "7.55.0")
     (source
       (origin
         (method url-fetch)
         (uri (string-append "https://curl.haxx.se/download/curl-"
-                            version ".tar.lzma"))
+                            version ".tar.xz"))
         (sha256
          (base32
-          "0vnv3cz0s1l5cjby86hm0x6pgzqijmdm97qa9q5px200956z6yib"))))))
+          "1785vxi0jamiv9d1wr1l45g0fm9ircxdfyfzf7ld8zv0z0i8bmfd"))))
+    (arguments
+     `(,@(substitute-keyword-arguments (package-arguments curl)
+           ((#:phases phases)
+            `(modify-phases ,phases
+               (add-before 'install 'fix-Makefile
+                 ;; Fix a regression in 7.55.0 where docs are not installed.
+                 ;; https://github.com/curl/curl/commit/a7bbbb7c368c6096802007f61f19a02e9d75285b
+                 (lambda _
+                   (substitute* "Makefile"
+                     (("install-data-hook:\n")
+                      "install-data-hook:\n\tcd docs/libcurl && $(MAKE) install\n"))
+                   #t)))))))))
-- 
2.14.0

Your comment

This issue is archived.

To comment on this conversation send an email to 28027@debbugs.gnu.org

To respond to this issue using the mumi CLI, first switch to it

mumi current 28027

Then, you may apply the latest patchset in this issue (with sign off)

mumi am -- -s

Or, compose a reply to this issue

mumi compose

Or, send patches to this issue

mumi send-email *.patch

is:open	open issues
is:done	closed issues
submitter:<who>	search issue submitter
author:<who>	search by message author
date:yesterday..now	search by issue date
mdate:3m..2d	search by message date