Subject: Re: [bug#31487] [PATCH] gnu: Add upx.

From: [email-masked] (Ludovic Courtès)
Date: Sat, 26 May 2018 22:14:22 +0200

Hello,

Pierre Neidhardt <[email-masked]> skribis:

> * gnu/packages/compression.scm (ucl): New variable.
> * gnu/packages/compression.scm (upx): New variable.

I committed both as separate patches (the convention is to have one
patch per package), slightly changed descriptions to remove “marketing
speak”, and changed licenses to ‘gpl2+’ after checking the source file
headers.

There’s one issue left though:

  $ ./pre-inst-env guix lint upx
  gnu/packages/compression.scm:2179:2: [email-masked]: probably vulnerable to CVE-2017-15056, CVE-2017-16869

Could you check whether patches are available for these?  Better be safe
than sorry!

Thank you,
Ludo’.