Document the fact that we include fixes for CVE-2018-5154, CVE-2018-5155,
CVE-2018-5157, CVE-2018-5158, CVE-2018-5159, CVE-2018-5168, CVE-2018-5178,
and 9/10 changesets for CVE-2018-5150.
* gnu/packages/gnuzilla.scm (icecat)[source]: Relabel patches to reflect CVE
assignments.
* gnu/packages/patches/icecat-bug-1452075.patch: Rename to...
* gnu/packages/patches/icecat-CVE-2018-5157-and-CVE-2018-5158.patch: ...this.
* gnu/local.mk (dist_patch_DATA): Rename it.
* gnu/packages/patches/libutils-add-includes.patch: New file.
* gnu/packages/patches/libutils-remove-damaging-includes.patch: New file.
* gnu/packages/android.scm (android-platform-system-core): Use them.
(android-libutils): New variable.
* gnu/local.mk: Add them.
* gnu/packages/android.scm (android-libziparchive): New variable.
* gnu/packages/patches/libziparchive-add-includes.patch: New file.
* gnu/local.mk (dist_patch_DATA): Add it.
* gnu/packages/patches/wesnoth-fix-std-bad-cast.patch: New file.
* gnu/local.mk (dist_patch_DATA): Register it.
* gnu/packages/games.scm (wesnoth): Update to 1.14.0.
[source]: Add wesnoth-fix-std-bad-cast.patch to patches.
[arguments]: Remove "-DENABLE_STRICT_COMPILATION=OFF" configure flag.
[inputs]: Remove sdl-image, sdl-mixer, sdl-net and sdl-ttf. Add openssl and
sdl-union of sdl2, sdl2-image, sdl2-mixer and sdl2-ttf.
[home-page]: Use HTTPS URI.
(wesnoth-server)[inputs]: Remove sdl-net. Add icu4c, openssl and sdl2.
[arguments]: Remove delete-data phase. Since wesnoth 1.14.0, configure flag
"-DENABLE_GAME=OFF" disables installation of game assets.
* gnu/packages/patches/strace-kernel-4.16.patch: New file.
* gnu/local.mk (dist_patch_DATA): Register it.
* gnu/packages/linux.scm (strace)][source](patches): New field.
* gnu/packages/gimp.scm (gegl): Update to 0.4.
[inputs]: Move babl and glib to propagated-inputs.
[propagated-inputs]: Add json-glib.
[arguments]: Re-enable the tests and remove the obsolete 'pre-build'
phase.
[source]: Use HTTPS URL.
* gnu/packages/patches/gegl-CVE-2012-4433.patch: Delete file.
* gnu/local.mk (dist_patch_DATA): Remove it.
* gnu/packages/networking.scm (amule): New public variable.
* gnu/packages/patches/amule_crypto-6.patch: New file.
* gnu/local.mk (dist_patch_DATA): Add it.
Signed-off-by: Ludovic Courtès <ludo@gnu.org>
* gnu/packages/gnuzilla.scm (icecat)[source]: Add selected fixes
from the upstream mozilla-esr52 repository.
* gnu/packages/patches/icecat-bug-1452075.patch: New file.
* gnu/local.mk (dist_patch_DATA): Add it.
* gnu/package/java.scm (java-apache-ivy): New variable.
* gnu/packages/patches/java-apache-ivy-port-to-latest-bouncycastle.patch:
New file.
* gnu/local.mk (dist_patch_DATA): Add it.
* gnu/packages/patches/qemu-CVE-2018-7550.patch: New file.
* gnu/local.mk (dist_patch_DATA): Add it.
* gnu/packages/virtualization.scm (qemu)[source]: Use it.
* gnu/packages/music.scm (libmygpo-qt): Update to 1.1.0.
[source]: Remove 'patches'.
[arguments]: Do not set BUILD_WITH_QT4=OFF, it is the default.
* gnu/packages/patches/libmygpo-qt-fix-jsoncreatortest.patch: Remove.
* gnu/local.mk (dist_patch_DATA): Adjust.
Signed-off-by: Marius Bakke <mbakke@fastmail.com>
* gnu/packages/patches/sharutils-CVE-2018-1000097.patch: New file.
* gnu/local.mk (dist_patch_DATA): Register it.
* gnu/packages/compression.scm (sharutils)[source](patches): Use it.
* gnu/packages/patches/mupen64plus-video-z64-glew-correct-path.patch: New file.
* gnu/local.mk (dist_patch_DATA): Add it.
* gnu/packages/emulators.scm (mupen64plus-video-z64)[source]: Use it.
* gnu/packages/patches/datamash-arm-tests.patch: New file.
* gnu/local.mk (dist_patch_DATA): Add it.
* gnu/packages/datamash.scm (datamash)[source]: Use it.
* gnu/packages/patches/boost-fix-icu-build.patch: New file.
* gnu/local.mk (dist_patch_DATA): Add it.
* gnu/packages/boost.scm (boost)[source]: Add the patch.
[arguments]: In the custom configure phase, pass --with-icu=[...]
to ./bootstrap.sh
* gnu/packages/patches/glibc-reinstate-prlimit64-fallback.patch: New file.
* gnu/packages/base.scm (glibc/linux)[source]: Use it.
* gnu/local.mk (dist_patch_DATA): Add it.
* gnu/packages/bioinformatics.scm (delly): New variable.
* gnu/packages/patches/delly-use-system-libraries.patch: New file.
* gnu/local.mk: Include delly-use-system-libraries.patch.
Signed-off-by: Leo Famulari <leo@famulari.name>
* gnu/packages/patches/elogind-glibc-2.27.patch: New file.
* gnu/local.mk (dist_patch_DATA): Add it.
* gnu/packages/freedesktop.scm (elogind)[source]: Add patch.
[arguments]: Replace the bootstrap phase with what was previously the
autogen phase.
* gnu/packages/patches/make-glibc-compat.patch: New file.
* gnu/local.mk (dist_patch_DATA): Register it.
* gnu/packages/base.scm (gnu-make)[source](patches): Use it.
* gnu/packages/patches/guile-gdbm-ffi-support-gdbm-1.14.patch: New file.
* gnu/local.mk (dist_patch_DATA): Add it.
* gnu/packages/guile.scm (guile-gdbm-ffi)[inputs]: Move above arguments. Add
the patch, and the 'patch' program.
[propagated-inputs]: Move above arguments.
[arguments]: In the builder, add code to apply the patch.
* gnu/packages/patches/util-linux-CVE-2018-7738.patch: New file.
* gnu/local.mk (dist_patch_DATA): Add it.
* gnu/packages/linux.scm (util-linux)[replacement]: New field.
(util-linux/fixed): New variable.
* gnu/packages/patches/shadow-CVE-2018-7169.patch: New file.
* gnu/local.mk (dist_patch_DATA): Add it.
* gnu/packages/admin.scm (shadow)[source]: Use it.
* gnu/packages/patches/java-jeromq-fix-tests.patch: New file.
* gnu/local.mk (dist_patch_DATA): Add it.
* gnu/packages/java.scm (java-jeromq)[source](patches): Add it.
[arguments](#test-exclude): Disable more failing tests.
Rename the function and move the declaration from gif_lib.h to
gif_lib_private.h to solve conflicts when some .c-file #includes
both stdlib.h and gif_lib.h.
See also https://sourceforge.net/p/giflib/bugs/110/
* gnu/packages/patches/giflib-make-reallocarray-private.patch: New
file
* gnu/local.mk (dist_patch_DATA): Register it.
* gnu/packages/image.scm(giflib)[source](patches): New field.
* gnu/packages/patches/gnome-todo-libical-compat.patch: New file.
* gnu/local.mk (dist_patch_DATA): Register it.
* gnu/packages/gnome.scm (gnome-todo)[source](patches): Use it.
* gnu/packages/php.scm (php)[inputs]: Use gd-for-php.
(gd-for-php): New private variable.
* gnu/packages/patches/gd-CVE-2018-5711.patch: New file.
* gnu/local.mk (dist_patch_DATA): Add it.
* gnu/packages/patches/glibc-allow-kernel-2.6.32.patch: New file.
* gnu/local.mk (dist_patch_DATA): Add it.
* gnu/packages/base.scm (glibc/linux)[replacement]: New field.
(glibc-2.26-patched): New variable.
* gnu/packages/patches/wavpack-CVE-2018-6767.patch: New file.
* gnu/local.mk (dist_patch_DATA): Register it.
* gnu/packages/audio.scm (wavpack)[source](patches): Add it.
* gnu/packages/patches/json-glib-fix-tests-32bit.patch: New file.
* gnu/local.mk (dist_patch_DATA): Register it.
* gnu/packages/gnome.scm (json-glib)[source](patches): New field.
* gnu/packages/patches/password-store-gnupg-compat.patch: New file.
* gnu/local.mk (dist_patch_DATA): Add it.
* gnu/packages/password-utils.scm (password-store)[source]: Use it.
This release claims to fix 2 vulnerabilities:
- ‘an integer overflow vulnerability in the TIFF decoder’
(CVE-2017-1000229, previously patched in Guix), and
- ‘a buffer overflow vulnerability in the GIF decoder’.
* gnu/packages/image.scm (optipng): Update to 0.7.7.
[source]: Remove patch.
[arguments]: Substitute INVOKE for SYSTEM* and end phase with #t.
* gnu/packages/patches/optipng-CVE-2017-1000229.patch: Delete file.
* gnu/local.mk (dist_patch_DATA): Remove it.
* gnu/packages/patches/htop-fix-process-tree.patch: New file.
* gnu/local.mk (dist_patch_DATA): Add it.
* gnu/packages/admin.scm (htop)[source]: Use it.
* gnu/packages/patches/freetype-CVE-2018-6942.patch: New file.
* gnu/local.mk (dist_patch_DATA): Register it.
* gnu/packages/fontutils.scm (freetype)[replacement]: New field.
(freetype/fixed): New variable.
Transfer the applicable NixOS patches as of 2018-01-19:
- Not adopted: We don't change the .cmake.in and .prf, but use config
mechanisms provided by th Qt build system.
- src/corelib/tools/qtimezoneprivate_tz.cpp: Adopted patch: Use $TZDIR to
search for time-zone data. Thus avoid depending on package "tzdata", which
often introduces changes with near-immediate effects, so it's important to
be able to update it fast.
- src/corelib/kernel/qcoreapplication.cpp: Not adopted: NixOS adds plugin
paths derived from PATH. We do not need this, since we already have
native-search-path QT_PLUGIN_PATH.
- src/network/kernel/qdnslookup_unix.cpp,
src/network/kernel/qhostinfo_unix.cpp: Transferred: Use hard-coded path to
libresolv.
- src/network/ssl/qsslcontext_openssl.cpp: Not adopted: NixOS changes a
conditional compilation for Qt 5.9 (but leaves it unchanged for Qt 5.10) to
fix compilation with libressl. But Qt does not support libressl anway, see
config.tests/openssl/openssl.cpp in qtbase 5.9.4.
- src/plugins/platforminputcontexts/compose/generator/qtablegenerator.cpp:
Transferred: Use hard-coded path to libx11.
- src/plugins/platforms/xcb/gl_integrations/xcb_glx/qglxintegration.cpp:
Transferred: Use hard-coded path to mess's libGL, no need for a fall-back.
- src/plugins/platforms/xcb/qxcbcursor.cpp: Transferred: Use hard-coded path
to Xcursor.
- src/plugins/platformthemes/gtk3/main.cpp: Not adopted: NixOS changes
$XDG_DATA_DIRS and $GIO_EXTRA_MODULES in the code. We already have a
search-path-specification for this.
- src/testlib/qtestassert.h: Decided not to adopt this for guix.
* gnu/packages/patches/qtbase-use-TZDIR.patch: New file.
* gnu/local.mk (dist_patch_DATA): Add it.
* gnu/packages/qt.scm (qtbase): Add comment. [source]: Use new patch.
[arguments]<#:phases>'patch-paths': New phase.
This was causing segfaults in the MH test suite when building with
glibc 2.26 on x86_64.
* gnu/packages/patches/mailutils-uninitialized-memory.patch: New file.
* gnu/local.mk (dist_patch_DATA): Add it.
* gnu/packages/mail.scm (mailutils)[source](patches, snippet): New
fields.
[native-inputs]: New field.
* gnu/packages/patches/gcc-4.9-libsanitizer-fix.patch: New file.
* gnu/packages/gcc.scm (gcc-4.9)[source](patches): Add it.
* gnu/local.mk (dist_patch_DATA): Add it.
* gnu/packages/patches/python-waitress-fix-tests.patch: New file.
* gnu/local.mk (dist_patch_DATA): Register it.
* gnu/packages/python.scm (python-waitress): Update to 1.1.0.
[source](patches): New field.
This fixes the security issues described at
https://www.ruby-lang.org/en/news/2018/02/17/multiple-vulnerabilities-in-
rubygems/
* gnu/packages/patches/ruby-rubygems-276-for-ruby24.patch: New file.
* gnu/packages/ruby.scm (ruby-2.4.3)[source]: Use it.
* gnu/local.mk (dist_patch_DATA): Add it.
* gnu/packages/patches/ghc-8.0-fall-back-to-madv_dontneed.patch: New file.
* gnu/local.mk (dist_patch_DATA): Add it.
* gnu/packages/haskell.scm (ghc-8): Use it.
* gnu/packages/patches/ghc-8.0-fall-back-to-madv_dontneed.patch: New file.
* gnu/local.mk (dist_patch_DATA): Add it.
* gnu/packages/haskell.scm (ghc-8): Use it.
Add a patch by Ludovic Courtès <ludo@gnu.org> from the upstream
shepherd repository to partially fix <https://bugs.gnu.org/30299>.
* gnu/packages/patches/shepherd-herd-status-sorted.patch: New file.
* gnu/local.mk (dist_patch_DATA): Add it.
* gnu/packages/admin.scm (shepherd)[source]: Add patch.
* gnu/packages/patches/libtasn1-CVE-2018-6003.patch: New file.
* gnu/local.mk (dist_patch_DATA): Add it.
* gnu/packages/tls.scm (libtasn1/fixed)[source]: Use it.
* gnu/packages/patches/emacs-browse-at-remote-cgit-gnu.patch: New file.
* gnu/local.mk (dist_patch_DATA): Add it.
* gnu/packages/emacs.scm (emacs-browse-at-remote)[source](patches): Use it.
Clementine has a button in the preference menu that allows downloading a
binary blob to add support for Spofify. Let's remove this button. It turns
out this is the only part of the code base that uses crypto++, let's remove
this dependency too.
* gnu/packages/music.scm (clementine)[arguments]: Remove crypto++ support. Set
HAVE_SPOTIFY_DOWNLOADER to FALSE.
[inputs]: Remove crypto++ input.
* gnu/packages/patches/clementine-remove-crypto++-dependency.patch: New file.
* gnu/local.mk (dist_patch_DATA): Add it.
Signed-off-by: Leo Famulari <leo@famulari.name>
* gnu/packages/patches/icecat-use-system-harfbuzz.patch,
gnu/packages/patches/icecat-use-system-graphite2.patch: New files.
* gnu/local.mk (dist_patch_DATA): Add them.
* gnu/packages/gnuzilla.scm (icecat)[source]: Add patches. Delete
"gfx/harfbuzz" and "gfx/graphite2" in the snippet.
[inputs]: Add harfbuzz and graphite2.
[arguments]: Add "--with-system-harfbuzz" and "--with-system-graphite2" to
configure-flags.
* gnu/packages/mpi.scm (hwloc-2.0): New variable.
* gnu/packages/patches/hwloc-tests-without-sysfs.patch: New file.
* gnu/local.mk (dist_patch_DATA): Add it.
* gnu/packages/patches/p7zip-CVE-2017-17969.patch: New file.
* gnu/local.mk (dist_patch_DATA): Add it.
* gnu/packages/compression.scm (p7zip)[source]: Use it.
python-axolotl has been failing since March,
https://hydra.gnu.org/job/gnu/master/python-axolotl-0.1.35.x86_64-linux
This also fixes the OMEMO and OTR plugins for Gajim work.
* gnu/packages/patches/python-axolotl-AES-fix.patch: New file.
* gnu/local.mk (dist_patch_DATA): Add it.
* gnu/packages/python-crypto.scm (python-axolotl): Upgrade to 0.1.39.
[source]: Use the patch.
Signed-off-by: Ludovic Courtès <ludo@gnu.org>
* gnu/packages/version-control.scm (reposurgeon): Update to 3.43.
[source]: Add a patch needed to build the package.
[arguments]: Add ‘patch-inputs’ phase.
[native-inputs]: Replace docbook-xml-4.1.2 with the latest docbook-xml.
[inputs]: Add tzdata.
* gnu/packages/patches/reposurgeon-add-missing-docbook-files.patch:
New file.
* gnu/local.mk (dist_patch_DATA): Add it.
* gnu/packages/patches/dovecot-CVE-2017-15132.patch: New file.
* gnu/local.mk (dist_patch_DATA): Add it.
* gnu/packages/mail.scm (dovecot)[source]: Use it.
Includes fixes for CVE-2018-5104, CVE-2018-5097, CVE-2018-5099, and the
remaining 7 out of 21 changesets for CVE-2018-5089.
* gnu/packages/gnuzilla.scm (icecat)[source]: Add selected fixes from the
upstream mozilla-esr52 repository. Remove the local spectre mitigation patch
in favor of the (identical) changeset from upstream.
* gnu/packages/patches/icecat-bug-1427870-spectre-mitigation.patch: Delete.
* gnu/local.mk (dist_patch_DATA): Remove it.
* gnu/packages/patches/libsndfile-CVE-2017-12562.patch: New file.
* gnu/local.mk (dist_patch_DATA): Add it.
* gnu/packages/pulseaudio.scm (libsndfile)[replacement]: New field.
(libsndfile/fixed): New variable.
* gnu/packages/patches/rtags-separate-rct.patch: New file.
* gnu/local.mk (dist_patch_DATA): Add it.
* gnu/packages/code.scm (rtags): Dependencies no longer bundled.
[source]: Use tarball release. Use the patch to link rct.
Substitute corresponding headers.
[native-inputs]: Add new dependencies.
[inputs]: Likewise.
Signed-off-by: Ludovic Courtès <ludo@gnu.org>
* gnu/packages/patches/rct-add-missing-headers.patch: New file.
* gnu/local.mk (dist_patch_DATA): Add it.
* gnu/packages/cpp.scm (rct): Use the patch, enable RTTI.
[source]: Use the patch to add missing headers from installation.
[arguments]: Enable RTTI in configure-flags.
Signed-off-by: Ludovic Courtès <ludo@gnu.org>
This is a followup to commit e074a655dd.
* gnu/local.mk (dist_patch_DATA): Remove ninja-zero-mtime.patch and
node-test-http2-server-rst-stream.patch, which no longer exist.
* gnu/packages/patches/libexif-CVE-2016-6328.patch: New file.
* gnu/local.mk (dist_patch_DATA): Add it.
* gnu/packages/photo.scm (libexif)[source]: Use it.
* gnu/packages/parallel.scm (slurm): Update to 17.11.2.
[source]: Replace patch with less fragile SUBSTITUTE* in a snippet.
[arguments]: Rename ‘autogen’ phase to ‘autoconf’. Use INVOKE.
* gnu/packages/patches/slurm-configure-remove-nonfree-contribs.patch:
Delete file.
* gnu/local.mk (dist_patch_DATA): Remove it.
* gnu/packages/lxde.scm (lxterminal): Update to 0.3.1.
[source]: Remove patch for fixed CVE.
[arguments]: No longer skip test suite which appear to be fixed.
* gnu/packages/patches/lxterminal-CVE-2016-10369.patch: Delete file.
* gnu/local.mk (dist_patch_DATA): Remove it.
* gnu/packages/patches/opencascade-oce-glibc-2.26.patch: New file.
* gnu/local.mk (dist_patch_DATA): Add it.
* gnu/packages/maths.scm (opencascade-oce)[source]: Use it.
* gnu/packages/patches/libgnomeui-utf8.patch: New file.
* gnu/local.mk (dist_patch_DATA): Add it.
* gnu/packages/gnome.scm (libgnomeui)[source]: Use it.
* gnu/packages/patches/libxml2-CVE-2017-15412.patch: New file.
* gnu/local.mk (dist_patch_DATA): Add it.
* gnu/packages/xml.scm (libxml2/fixed)[source]: Use it.
* gnu/packages/patches/icecat-glibc-2.26.patch: New file.
* gnu/packages/gnuzilla.scm (icecat)[source](patches): Add it.
* gnu/local.mk (dist_patch_DATA): Add it.
* gnu/packages/patches/libgnome-encoding.patch: New file.
* gnu/packages/gnome.scm (libgnome)[source]: Use it.
* gnu/local.mk (dist_patch_DATA): Add it.
* gnu/packages/patches/transmission-fix-dns-rebinding-vuln.patch: New file.
* gnu/local.mk (dist_patch_DATA): Add it.
* gnu/packages/bittorrent.scm (transmission)[source]: Use it.
