Fixes CVE-2021-22876 and CVE-2021-22890.
* gnu/packages/curl.scm (curl/fixed): New variable.
(curl)[replacement]: New field.
* gnu/packages/patches/curl-7.76-use-ssl-cert-env.patch: New file.
* gnu/local.mk (dist_patch_DATA): Add it.
* gnu/packages/curl.scm (guile-curl): Update to 0.7.
[#:modules, #:imported-modules]: Load guile-build-system for
target-guile-effective-version.
[#:configure-flags]: Use target-guile-effective-version.
[#:phases]: Add 'patch-undefined-references.
Use target-guile-effective-version.
[inputs]: Use guile-3.0.
This is a follow-up to commits 6ab31af7c7 and
e21b70accc.
* gnu/packages/curl.scm: Do not import (gnu packages groff).
* gnu/packages/linux.scm: Do not import (gnu packages attr).
This is necessary to avoid a circular dependency in the next commit.
* gnu/packages/curl.scm (curl-minimal): New public variable.
* gnu/packages/cmake.scm (cmake-minimal-bootstrap): New public variable.
* gnu/packages/image.scm (libjpeg-turbo)[arguments]: Add #:cmake.
* gnu/packages/patches/curl-use-ssl-cert-env.patch: New file.
* gnu/local.mk (dist_patch_DATA): Adjust accordingly.
* gnu/packages/curl.scm (curl)[source]: Use the patch.
[native-search-paths]: Add the new variables.
Signed-off-by: Marius Bakke <mbakke@fastmail.com>
Commit af8f7eb4f2 accidentally changed the cURL
derivation. Remove use of HIDDEN-PACKAGE and restore input order to prevent a
large number of rebuilds.
* gnu/packages/ssh.scm (libssh2-1.8.0): Move from here ...
* gnu/packages/curl.scm (libssh2-1.8.0): ... to here. Don't use
HIDDEN-PACKAGE and make it non-public.
(curl)[inputs]: Move LIBSSH2-1.8.0 where it was before af8f7eb4f2.