Subject: bug#29046: closed (Re: [bug#29046] [PATCH] gnu: linux-libre: Change URL to HTTPS.)

From: [email-masked] (GNU bug Tracking System)
Date: Sun, 12 Nov 2017 20:49:02 +0000

Your bug report

#29046: [PATCH] gnu: linux-libre: Update to 4.13.10 and change URL to HTTPS.

which was filed against the guix-patches package, has been closed.

The explanation is attached below, along with your original report.
If you require more details, please reply to [email-masked].

-- 
29046: http://debbugs.gnu.org/cgi/bugreport.cgi?bug=29046
GNU Bug Tracking System
Contact [email-masked] with problems

Subject: Re: [bug#29046] [PATCH] gnu: linux-libre: Change URL to HTTPS.
From: Leo Famulari <[email-masked]>
To: Mark H Weaver <[email-masked]>
Cc: [email-masked], Ludovic Courtès <[email-masked]>, Rutger Helling <[email-masked]>
Date: Sun, 12 Nov 2017 15:48:04 -0500
List-Id: <debbugs-submit.debbugs.gnu.org>

On Tue, Nov 07, 2017 at 02:05:24PM -0500, Mark H Weaver wrote:
> Is an active attack needed to determine which file we are downloading
> from linux-libre.fsfla.org?  I think not.  The IP address of that host
> reverse resolves to "linux-libre.fsfla.org", which makes it obvious.
> The title of the paper Ludovic cited above makes the point:

I should clarify that by "active attacker" I mean someone who is doing
anything beyond simply recording the traffic. So, if they are making
lists of file sizes of different kernel tarballs, or keeping a database
of which sites you visited, keyed by your IP / identity, that's
"active".

> Anyway, having said this, if using HTTPS for linux-libre downloads makes
> you sleep better at night, I'm okay with it.

It doesn't affect my rest, but I assume you are speaking metaphorically.
So, I pushed the change as 8420c7a3565b6a984cdd95336f66d555edc87d90.

Thanks Rutger!

Subject: [PATCH] gnu: linux-libre: Update to 4.13.10 and change URL to HTTPS.
From: Rutger Helling <[email-masked]>
To: [email-masked]
Date: Sat, 28 Oct 2017 23:15:16 +0200
List-Id: <debbugs-submit.debbugs.gnu.org>

Hey Guix, 

here's a patch to update linux-libre and change the URL to HTTPS.

From 3faa493a607907d6fb571e6c0e3eb391af7a5aec Mon Sep 17 00:00:00 2001
From: Rutger Helling <[email-masked]>
Date: Sat, 28 Oct 2017 22:36:16 +0200
Subject: [PATCH] gnu: linux-libre: Update to 4.13.10 and change URL to HTTPS.

* gnu/packages/linux.scm (linux-libre): Update to 4.13.10 and change URL to HTTPS.
---
 gnu/packages/linux.scm | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/gnu/packages/linux.scm b/gnu/packages/linux.scm
index 49665e24d..831c26884 100644
--- a/gnu/packages/linux.scm
+++ b/gnu/packages/linux.scm
@@ -140,7 +140,7 @@ defconfig.  Return the appropiate make target if applicable, otherwise return
 (define (linux-libre-urls version)
   "Return a list of URLs for Linux-Libre VERSION."
   (list (string-append
-         "http://linux-libre.fsfla.org/pub/linux-libre/releases/"
+         "https://linux-libre.fsfla.org/pub/linux-libre/releases/"
          version "-gnu/linux-libre-" version "-gnu.tar.xz")
 
         ;; XXX: Work around <http://bugs.gnu.org/14851>.
@@ -368,8 +368,8 @@ It has been modified to remove all non-free binary blobs.")
 
 (define %intel-compatible-systems '("x86_64-linux" "i686-linux"))
 
-(define %linux-libre-version "4.13.9")
-(define %linux-libre-hash "1ymsdvm4djh7hg2wmn2v11w380i0ss9nkp4slfrgihdvn6yp5gbv")
+(define %linux-libre-version "4.13.10")
+(define %linux-libre-hash "0y1p5b1rxpbr3apvqqv589qwzfyzjpdrzysfj4h17s0k4gy6c5p8")
 
 (define-public linux-libre
   (make-linux-libre %linux-libre-version
-- 
2.14.3