Subject: Re: bug#26836: [PATCH] gnu: libarchive: Update to 3.3.1.

From: Kei Kebreau <[email-masked]>
Date: Mon, 08 May 2017 17:10:28 -0400

Leo Famulari <[email-masked]> writes:

> On Mon, May 08, 2017 at 03:07:14PM -0400, Kei Kebreau wrote:
>> Fixes CVE-2016-{10209,10350} and CVE-2017-5601.
>> 
>> * gnu/packages/backup.scm (libarchive): Update to 3.3.1.
>
> Thanks!
>
> Can you use a graft instead? Then, the commit message can be like this:
>
> gnu: libarchive: Replace with 3.3.1 [security fixes].
>
> Fixes CVE-2016-{10209,10350}, CVE-2017-5601.
>
> * gnu/packages/backup.scm (libarchive)[replacement]: New field.
> (libarchive-3.3.1): New variable.

Like the patch I've attached?
From 45d3157bb61bb8b5f26ff13feb672759b6043e6f Mon Sep 17 00:00:00 2001
From: Kei Kebreau <[email-masked]>
Date: Mon, 8 May 2017 14:58:07 -0400
Subject: [PATCH] gnu: libarchive: Replace with 3.3.1 [security fixes].
To: [email-masked]

Fixes CVE-2016-{10209,10350} and CVE-2017-5601.

* gnu/packages/backup.scm (libarchive)[replacement]: New field.
(libarchive-3.3.1): New variable.
---
 gnu/packages/backup.scm | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/gnu/packages/backup.scm b/gnu/packages/backup.scm
index f9c0a22a0..d5cb5783a 100644
--- a/gnu/packages/backup.scm
+++ b/gnu/packages/backup.scm
@@ -5,6 +5,7 @@
 ;;; Copyright © 2017 Tobias Geerinckx-Rice <[email-masked]>
 ;;; Copyright © 2017 Thomas Danckaert <[email-masked]>
 ;;; Copyright © 2017 Arun Isaac <[email-masked]>
+;;; Copyright © 2017 Kei Kebreau <[email-masked]>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -186,6 +187,7 @@ backups (called chunks) to allow easy burning to CD/DVD.")
 (define-public libarchive
   (package
     (name "libarchive")
+    (replacement libarchive-3.3.1)
     (version "3.2.2")
     (source
      (origin
@@ -241,6 +243,20 @@ archive.  In particular, note that there is currently no built-in support for
 random access nor for in-place modification.")
     (license license:bsd-2)))
 
+(define libarchive-3.3.1
+  (package
+    (inherit libarchive)
+    (name "libarchive")
+    (version "3.3.1")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (string-append "http://libarchive.org/downloads/libarchive-"
+                           version ".tar.gz"))
+       (sha256
+        (base32
+         "1rr40hxlm9vy5z2zb5w7pyfkgd1a4s061qapm83s19accb8mpji9"))))))
+
 (define-public rdup
   (package
     (name "rdup")
-- 
2.12.2