GNU bug report logs - #27220
OpenLDAP changes for core-updates

Previous Next

To add a comment to this bug, you must first unarchive it, by sending
a message to control AT debbugs.gnu.org, with unarchive 27220 in the body.
You can then email your comments to 27220 AT debbugs.gnu.org in the normal way.

Toggle the display of automated, internal messages from the tracker.

Message #5 received at submit <at> debbugs.gnu.org (full text, mbox):

From: Leo Famulari <leo <at> famulari.name>
To: guix-patches <at> gnu.org
Subject: OpenLDAP changes for core-updates
Date: Sat, 3 Jun 2017 17:28:19 -0400

[Message part 1 (text/plain, inline)]

These patches remove the OpenLDAP graft, update it to the latest version, and
adjust some of libldap's libtool .la files to avoid needing to propagate
cyrus-sasl. That fixes this issue I found while testing the latest version of
ncmpcpp:

https://github.com/arybczak/ncmpcpp/issues/217

[signature.asc (application/pgp-signature, inline)]

Message #8 received at 27220 <at> debbugs.gnu.org (full text, mbox):

From: Leo Famulari <leo <at> famulari.name>
To: 27220 <at> debbugs.gnu.org
Subject: [PATCH 2/3] gnu: openldap: Use modify-phases.
Date: Sat,  3 Jun 2017 17:30:21 -0400

* gnu/packages/openldap.scm (openldap)[arguments]: Use modify-phases syntax.
---
 gnu/packages/openldap.scm | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/gnu/packages/openldap.scm b/gnu/packages/openldap.scm
index a146ef378..3fd19632b 100644
--- a/gnu/packages/openldap.scm
+++ b/gnu/packages/openldap.scm
@@ -70,10 +70,9 @@
    (arguments
     `(#:tests? #f
       #:phases
-       (alist-cons-after
-        'configure 'provide-libtool
-        (lambda _ (copy-file (which "libtool") "libtool"))
-       %standard-phases)))
+      (modify-phases %standard-phases
+        (add-after 'configure 'provide-libtool
+          (lambda _ (copy-file (which "libtool") "libtool"))))))
    (synopsis "Implementation of the Lightweight Directory Access Protocol")
    (description
     "OpenLDAP is a free implementation of the Lightweight Directory Access Protocol.")
-- 
2.13.0

Message #11 received at 27220 <at> debbugs.gnu.org (full text, mbox):

From: Leo Famulari <leo <at> famulari.name>
To: 27220 <at> debbugs.gnu.org
Subject: [PATCH 3/3] gnu: openldap: Provide path to cyrus-sasl for libtool.
Date: Sat,  3 Jun 2017 17:30:22 -0400

* gnu/packages/openldap.scm (openldap)[arguments]: Add 'patch-sasl-path' phase..
---
 gnu/packages/openldap.scm | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/gnu/packages/openldap.scm b/gnu/packages/openldap.scm
index 3fd19632b..9a68d553b 100644
--- a/gnu/packages/openldap.scm
+++ b/gnu/packages/openldap.scm
@@ -72,7 +72,17 @@
       #:phases
       (modify-phases %standard-phases
         (add-after 'configure 'provide-libtool
-          (lambda _ (copy-file (which "libtool") "libtool"))))))
+          (lambda _ (copy-file (which "libtool") "libtool")))
+        (add-after 'install 'patch-sasl-path
+          ;; Give -L arguments for cyrus-sasl to avoid propagation.
+          (lambda* (#:key inputs outputs #:allow-other-keys)
+            (let ((out (assoc-ref outputs "out"))
+                  (sasl (assoc-ref inputs "cyrus-sasl")))
+              (substitute* (map (lambda (f) (string-append out "/" f))
+                                '("lib/libldap.la" "lib/libldap_r.la"))
+                (("-lsasl2" lib)
+                 (string-append "-L" sasl "/lib " lib)))
+              #t))))))
    (synopsis "Implementation of the Lightweight Directory Access Protocol")
    (description
     "OpenLDAP is a free implementation of the Lightweight Directory Access Protocol.")
-- 
2.13.0

Message #14 received at 27220 <at> debbugs.gnu.org (full text, mbox):

From: Leo Famulari <leo <at> famulari.name>
To: 27220 <at> debbugs.gnu.org
Subject: [PATCH 1/3] gnu: openldap: Update to 2.4.45.
Date: Sat,  3 Jun 2017 17:30:20 -0400

* gnu/packages/openldap.scm (openldap): Update to 2.4.45.
[replacement]: Remove field.
[home-page], [source]: Use HTTPS URLs for home-page and the USA mirror.
(openldap/fixed): Remove variable.
* gnu/packages/patches/openldap-CVE-2017-9287.patch: Delete file.
* gnu/local.mk (dist_patch_DATA): Remove it.
---
 gnu/local.mk                                      |  1 -
 gnu/packages/openldap.scm                         | 17 +++--------
 gnu/packages/patches/openldap-CVE-2017-9287.patch | 37 -----------------------
 3 files changed, 4 insertions(+), 51 deletions(-)
 delete mode 100644 gnu/packages/patches/openldap-CVE-2017-9287.patch

diff --git a/gnu/local.mk b/gnu/local.mk
index 8b73f7e64..060079352 100644
--- a/gnu/local.mk
+++ b/gnu/local.mk
@@ -842,7 +842,6 @@ dist_patch_DATA =						\
   %D%/packages/patches/openexr-missing-samples.patch		\
   %D%/packages/patches/openjpeg-CVE-2016-9850-CVE-2016-9851.patch		\
   %D%/packages/patches/openjpeg-CVE-2016-9572-CVE-2016-9573.patch		\
-  %D%/packages/patches/openldap-CVE-2017-9287.patch		\
   %D%/packages/patches/openocd-nrf52.patch			\
   %D%/packages/patches/openssl-runpath.patch			\
   %D%/packages/patches/openssl-1.1.0-c-rehash-in.patch		\
diff --git a/gnu/packages/openldap.scm b/gnu/packages/openldap.scm
index 24bf603c4..a146ef378 100644
--- a/gnu/packages/openldap.scm
+++ b/gnu/packages/openldap.scm
@@ -40,8 +40,7 @@
 (define-public openldap
   (package
    (name "openldap")
-   (replacement openldap/fixed)
-   (version "2.4.44")
+   (version "2.4.45")
    (source (origin
             (method url-fetch)
 
@@ -51,14 +50,14 @@
                         "ftp://mirror.switch.ch/mirror/OpenLDAP/"
                         "openldap-release/openldap-" version ".tgz")
                        (string-append
-                        "ftp://ftp.OpenLDAP.org/pub/OpenLDAP/"
+                        "https://www.openldap.org/software/download/OpenLDAP/"
                         "openldap-release/openldap-" version ".tgz")
                        (string-append
                         "ftp://ftp.dti.ad.jp/pub/net/OpenLDAP/"
                         "openldap-release/openldap-" version ".tgz")))
             (sha256
              (base32
-              "0044p20hx07fwgw2mbwj1fkx04615hhs1qyx4mawj2bhqvrnppnp"))))
+              "091qvwk5dkcpp17ziabcnh3rg3m7qwzw2pihfcd1d5fdxgywzmnd"))))
    (build-system gnu-build-system)
    (inputs `(("bdb" ,bdb-5.3)
              ("cyrus-sasl" ,cyrus-sasl)
@@ -79,15 +78,7 @@
    (description
     "OpenLDAP is a free implementation of the Lightweight Directory Access Protocol.")
    (license openldap2.8)
-   (home-page "http://www.openldap.org/")))
-
-(define openldap/fixed
-  (package
-    (inherit openldap)
-    (source
-      (origin
-        (inherit (package-source openldap))
-        (patches (search-patches "openldap-CVE-2017-9287.patch"))))))
+   (home-page "https://www.openldap.org/")))
 
 (define-public nss-pam-ldapd
   (package
diff --git a/gnu/packages/patches/openldap-CVE-2017-9287.patch b/gnu/packages/patches/openldap-CVE-2017-9287.patch
deleted file mode 100644
index 5ca2a60c6..000000000
--- a/gnu/packages/patches/openldap-CVE-2017-9287.patch
+++ /dev/null
@@ -1,37 +0,0 @@
-Fix CVE-2017-9287:
-
-https://www.openldap.org/its/?findid=8655
-https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9287
-
-Patch copied from upstream source repository:
-
-https://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=commit;h=0cee1ffb6021b1aae3fcc9581699da1c85a6dd6e
-
-From 0cee1ffb6021b1aae3fcc9581699da1c85a6dd6e Mon Sep 17 00:00:00 2001
-From: Ryan Tandy <ryan <at> nardis.ca>
-Date: Wed, 17 May 2017 20:07:39 -0700
-Subject: [PATCH] ITS#8655 fix double free on paged search with pagesize 0
-
-Fixes a double free when a search includes the Paged Results control
-with a page size of 0 and the search base matches the filter.
----
- servers/slapd/back-mdb/search.c | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/servers/slapd/back-mdb/search.c b/servers/slapd/back-mdb/search.c
-index 301d1a498c..43442aa242 100644
---- a/servers/slapd/back-mdb/search.c
-+++ b/servers/slapd/back-mdb/search.c
-@@ -1066,7 +1066,8 @@ notfound:
- 			/* check size limit */
- 			if ( get_pagedresults(op) > SLAP_CONTROL_IGNORED ) {
- 				if ( rs->sr_nentries >= ((PagedResultsState *)op->o_pagedresults_state)->ps_size ) {
--					mdb_entry_return( op, e );
-+					if (e != base)
-+						mdb_entry_return( op, e );
- 					e = NULL;
- 					send_paged_response( op, rs, &lastid, tentries );
- 					goto done;
--- 
-2.13.0
-
-- 
2.13.0

Message #17 received at 27220 <at> debbugs.gnu.org (full text, mbox):

From: Marius Bakke <mbakke <at> fastmail.com>
To: Leo Famulari <leo <at> famulari.name>, 27220 <at> debbugs.gnu.org
Subject: Re: bug#27220: [PATCH 1/3] gnu: openldap: Update to 2.4.45.
Date: Sun, 04 Jun 2017 15:33:29 +0200

[Message part 1 (text/plain, inline)]

Leo Famulari <leo <at> famulari.name> writes:

> * gnu/packages/openldap.scm (openldap): Update to 2.4.45.
> [replacement]: Remove field.
> [home-page], [source]: Use HTTPS URLs for home-page and the USA mirror.
> (openldap/fixed): Remove variable.
> * gnu/packages/patches/openldap-CVE-2017-9287.patch: Delete file.
> * gnu/local.mk (dist_patch_DATA): Remove it.

LGTM.

[signature.asc (application/pgp-signature, inline)]

Message #20 received at 27220 <at> debbugs.gnu.org (full text, mbox):

From: Marius Bakke <mbakke <at> fastmail.com>
To: Leo Famulari <leo <at> famulari.name>, 27220 <at> debbugs.gnu.org
Subject: Re: bug#27220: [PATCH 2/3] gnu: openldap: Use modify-phases.
Date: Sun, 04 Jun 2017 15:33:51 +0200

[Message part 1 (text/plain, inline)]

Leo Famulari <leo <at> famulari.name> writes:

> * gnu/packages/openldap.scm (openldap)[arguments]: Use modify-phases syntax.
> ---
>  gnu/packages/openldap.scm | 7 +++----
>  1 file changed, 3 insertions(+), 4 deletions(-)
>
> diff --git a/gnu/packages/openldap.scm b/gnu/packages/openldap.scm
> index a146ef378..3fd19632b 100644
> --- a/gnu/packages/openldap.scm
> +++ b/gnu/packages/openldap.scm
> @@ -70,10 +70,9 @@
>     (arguments
>      `(#:tests? #f
>        #:phases
> -       (alist-cons-after
> -        'configure 'provide-libtool
> -        (lambda _ (copy-file (which "libtool") "libtool"))
> -       %standard-phases)))
> +      (modify-phases %standard-phases
> +        (add-after 'configure 'provide-libtool
> +          (lambda _ (copy-file (which "libtool") "libtool"))))))

Add a #t at the end of this phase while at it.

[signature.asc (application/pgp-signature, inline)]

Message #23 received at 27220 <at> debbugs.gnu.org (full text, mbox):

From: Marius Bakke <mbakke <at> fastmail.com>
To: Leo Famulari <leo <at> famulari.name>, 27220 <at> debbugs.gnu.org
Subject: Re: bug#27220: [PATCH 3/3] gnu: openldap: Provide path to cyrus-sasl
 for	libtool.
Date: Sun, 04 Jun 2017 15:38:29 +0200

[Message part 1 (text/plain, inline)]

Leo Famulari <leo <at> famulari.name> writes:

> * gnu/packages/openldap.scm (openldap)[arguments]: Add 'patch-sasl-path' phase..
> ---
>  gnu/packages/openldap.scm | 12 +++++++++++-
>  1 file changed, 11 insertions(+), 1 deletion(-)
>
> diff --git a/gnu/packages/openldap.scm b/gnu/packages/openldap.scm
> index 3fd19632b..9a68d553b 100644
> --- a/gnu/packages/openldap.scm
> +++ b/gnu/packages/openldap.scm
> @@ -72,7 +72,17 @@
>        #:phases
>        (modify-phases %standard-phases
>          (add-after 'configure 'provide-libtool
> -          (lambda _ (copy-file (which "libtool") "libtool"))))))
> +          (lambda _ (copy-file (which "libtool") "libtool")))
> +        (add-after 'install 'patch-sasl-path
> +          ;; Give -L arguments for cyrus-sasl to avoid propagation.
> +          (lambda* (#:key inputs outputs #:allow-other-keys)
> +            (let ((out (assoc-ref outputs "out"))
> +                  (sasl (assoc-ref inputs "cyrus-sasl")))
> +              (substitute* (map (lambda (f) (string-append out "/" f))
> +                                '("lib/libldap.la" "lib/libldap_r.la"))
> +                (("-lsasl2" lib)
> +                 (string-append "-L" sasl "/lib " lib)))
> +              #t))))))

Good find. LGTM, but I wonder if it would be better to remove the static
library (and associated .la files) and instead provide an explicit
static-package. This mostly for grafting purposes.

However, I think that's a journey for another core-updates.

[signature.asc (application/pgp-signature, inline)]

Message #26 received at 27220 <at> debbugs.gnu.org (full text, mbox):

From: Leo Famulari <leo <at> famulari.name>
To: Marius Bakke <mbakke <at> fastmail.com>
Cc: 27220 <at> debbugs.gnu.org
Subject: Re: bug#27220: [PATCH 1/3] gnu: openldap: Update to 2.4.45.
Date: Sun, 4 Jun 2017 12:37:57 -0400

[Message part 1 (text/plain, inline)]

On Sun, Jun 04, 2017 at 03:33:29PM +0200, Marius Bakke wrote:
> Leo Famulari <leo <at> famulari.name> writes:
> 
> > * gnu/packages/openldap.scm (openldap): Update to 2.4.45.
> > [replacement]: Remove field.
> > [home-page], [source]: Use HTTPS URLs for home-page and the USA mirror.
> > (openldap/fixed): Remove variable.
> > * gnu/packages/patches/openldap-CVE-2017-9287.patch: Delete file.
> > * gnu/local.mk (dist_patch_DATA): Remove it.
> 
> LGTM.

Is core-updates open for these changes to OpenLDAP? Or should I wait until the
next cycle?

[signature.asc (application/pgp-signature, inline)]

Message #29 received at 27220 <at> debbugs.gnu.org (full text, mbox):

From: Leo Famulari <leo <at> famulari.name>
To: Marius Bakke <mbakke <at> fastmail.com>
Cc: 27220 <at> debbugs.gnu.org
Subject: Re: bug#27220: [PATCH 2/3] gnu: openldap: Use modify-phases.
Date: Sun, 4 Jun 2017 12:39:47 -0400

[Message part 1 (text/plain, inline)]

On Sun, Jun 04, 2017 at 03:33:51PM +0200, Marius Bakke wrote:
> Leo Famulari <leo <at> famulari.name> writes:
> 
> > * gnu/packages/openldap.scm (openldap)[arguments]: Use modify-phases syntax.
> > ---
> >  gnu/packages/openldap.scm | 7 +++----
> >  1 file changed, 3 insertions(+), 4 deletions(-)
> >
> > diff --git a/gnu/packages/openldap.scm b/gnu/packages/openldap.scm
> > index a146ef378..3fd19632b 100644
> > --- a/gnu/packages/openldap.scm
> > +++ b/gnu/packages/openldap.scm
> > @@ -70,10 +70,9 @@
> >     (arguments
> >      `(#:tests? #f
> >        #:phases
> > -       (alist-cons-after
> > -        'configure 'provide-libtool
> > -        (lambda _ (copy-file (which "libtool") "libtool"))
> > -       %standard-phases)))
> > +      (modify-phases %standard-phases
> > +        (add-after 'configure 'provide-libtool
> > +          (lambda _ (copy-file (which "libtool") "libtool"))))))
> 
> Add a #t at the end of this phase while at it.

Okay, will do.

Looking at this phase more closely, I wonder if it's doing the right thing.
Copying libtool into the build tree? That's unusual...

[signature.asc (application/pgp-signature, inline)]

Message #32 received at 27220 <at> debbugs.gnu.org (full text, mbox):

From: Leo Famulari <leo <at> famulari.name>
To: Marius Bakke <mbakke <at> fastmail.com>
Cc: 27220 <at> debbugs.gnu.org
Subject: Re: bug#27220: [PATCH 3/3] gnu: openldap: Provide path to cyrus-sasl
 for	libtool.
Date: Sun, 4 Jun 2017 12:44:50 -0400

[Message part 1 (text/plain, inline)]

On Sun, Jun 04, 2017 at 03:38:29PM +0200, Marius Bakke wrote:
> Leo Famulari <leo <at> famulari.name> writes:
> > * gnu/packages/openldap.scm (openldap)[arguments]: Add 'patch-sasl-path' phase..

> > +        (add-after 'install 'patch-sasl-path
> > +          ;; Give -L arguments for cyrus-sasl to avoid propagation.
> > +          (lambda* (#:key inputs outputs #:allow-other-keys)
> > +            (let ((out (assoc-ref outputs "out"))
> > +                  (sasl (assoc-ref inputs "cyrus-sasl")))
> > +              (substitute* (map (lambda (f) (string-append out "/" f))
> > +                                '("lib/libldap.la" "lib/libldap_r.la"))
> > +                (("-lsasl2" lib)
> > +                 (string-append "-L" sasl "/lib " lib)))
> > +              #t))))))
> 
> Good find. LGTM, but I wonder if it would be better to remove the static
> library (and associated .la files) and instead provide an explicit
> static-package. This mostly for grafting purposes.

True. I found this while trying to build the latest ncmpcpp, which added a
dependency on curl, which depends on openldap. I copied the solution from the
hwloc package in (gnu packages mpi).

> However, I think that's a journey for another core-updates.

Yes :)

[signature.asc (application/pgp-signature, inline)]

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.