From debbugs-submit-bounces@debbugs.gnu.org Sat Sep 29 15:23:19 2018 Received: (at submit) by debbugs.gnu.org; 29 Sep 2018 19:23:19 +0000 Received: from localhost ([127.0.0.1]:59166 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1g6Kpj-0007ES-Fe for submit@debbugs.gnu.org; Sat, 29 Sep 2018 15:23:19 -0400 Received: from eggs.gnu.org ([208.118.235.92]:39160) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1g6Kph-0007EE-BV for submit@debbugs.gnu.org; Sat, 29 Sep 2018 15:23:17 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1g6KpZ-0005ci-SB for submit@debbugs.gnu.org; Sat, 29 Sep 2018 15:23:12 -0400 X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on eggs.gnu.org X-Spam-Level: X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00 autolearn=disabled version=3.3.2 Received: from lists.gnu.org ([2001:4830:134:3::11]:33130) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1g6KpZ-0005cY-Nw for submit@debbugs.gnu.org; Sat, 29 Sep 2018 15:23:09 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:48769) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1g6KpY-0007yz-5r for bug-guix@gnu.org; Sat, 29 Sep 2018 15:23:09 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1g6KpU-0005ZZ-8x for bug-guix@gnu.org; Sat, 29 Sep 2018 15:23:08 -0400 Received: from out3-smtp.messagingengine.com ([66.111.4.27]:36177) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1g6KpU-0005Z3-4C for bug-guix@gnu.org; Sat, 29 Sep 2018 15:23:04 -0400 Received: from compute4.internal (compute4.nyi.internal [10.202.2.44]) by mailout.nyi.internal (Postfix) with ESMTP id C34BF21908; Sat, 29 Sep 2018 15:23:03 -0400 (EDT) Received: from mailfrontend1 ([10.202.2.162]) by compute4.internal (MEProxy); Sat, 29 Sep 2018 15:23:03 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=famulari.name; h=content-type:date:from:message-id:mime-version:subject:to :x-me-sender:x-me-sender:x-sasl-enc; s=mesmtp; bh=3L6G3wMgGzN/Bz YF4ciLXHjaV5lv3p+NmXpbWzh8eIM=; b=G1zN81qcnJaoweCigynFqyJ2Yd/Cv0 mcIW2966MZ6w90S2Be2/GS1x6ohTCqBEXw1J5G+FNd09uL1Lupxe1qKXp8slbyp8 aNgmRCETlil9t9hfazEfE4uCFguZAE2+60PpiPDts4v3qzLdyLgxmVoFEDNk29rJ BD5+NkUepracg= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=content-type:date:from:message-id :mime-version:subject:to:x-me-sender:x-me-sender:x-sasl-enc; s= fm3; bh=3L6G3wMgGzN/BzYF4ciLXHjaV5lv3p+NmXpbWzh8eIM=; b=IDyTGlV0 jlqnczWb5sikNf+5N7uLVlkUsc41fpc2U2ZH+TeI/ebzg84n6g/gVtzCiGa/wgKs cuizcB0kLjYtsbJqyWqA4I1FIB/PA8d1ezSYorK90nHpnQZDC7lQftAQdmwGJl1/ pdq+8hMyNHoQLlt/Undo+uYRMQISJIrdWv2CwhSttlIei6rT/zHmOsQ4dkYz0BGX UIxlJrmvZeK+TdGG7hF8BUkRNFhu9nc213XZBNKjhgLdYc3kFVjIS9Zlfxe/3PhS 7GM0OdC0Ngu1jnAC51bbCwa7MEv8O+Gt8mSRIg7dwNeREKf1JLXUl3cmn+Vf4AoT lpr1DHEVKXN4CA== X-ME-Proxy: X-ME-Sender: Received: from localhost (50-207-9-203-static.hfc.comcastbusiness.net [50.207.9.203]) by mail.messagingengine.com (Postfix) with ESMTPA id DD93DE47C0 for ; Sat, 29 Sep 2018 15:23:02 -0400 (EDT) Date: Sat, 29 Sep 2018 15:23:02 -0400 From: Leo Famulari To: bug-guix@gnu.org Subject: Python-3 CVE-2018-14647 Message-ID: <20180929192302.GB17619@jasmine.lan> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="hQiwHBbRI9kgIhsi" Content-Disposition: inline User-Agent: Mutt/1.10.1 (2018-07-13) X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.6.x X-Received-From: 2001:4830:134:3::11 X-Spam-Score: -4.1 (----) X-Debbugs-Envelope-To: submit X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -5.1 (-----) --hQiwHBbRI9kgIhsi Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Our Python 3.6.5 package is vulnerable to CVE-2018-14647, fixed in CPython commit f7666e828cc3d5873136473ea36ba2013d624fa1, released in v3.6.7rc1: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14647 --hQiwHBbRI9kgIhsi Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEsFFZSPHn08G5gDigJkb6MLrKfwgFAluv0RUACgkQJkb6MLrK fwhC8g/9FJn7ZtbzMjV7/tMRoKpZ5g4l+V//Cy0DZcPavo57zuWb4gt10cSuwU2s T+il2zfeRqoTq+jkJa2onLQD1YV5/xyo4b86lBiXWo11+2eMoFtXR92wiH+HbBus 7Tm9YfC8/GJ4vL0ka7o5/ddn0/pQ9m3SDH1lOEJFEgbd48fz4zmgvVZjaFbvssne T5E8IMc5u1v5Vf9ipwxwH/DXajLS2eMH+QTHPNFV9AHYuXUkBFcWw/dCRMowIqKA vzJbneDjrE2yRa46LHzjLkvumqJgnLOZAuNbiB+hPhtGddlG1hemcMrtlVTpjryJ jJFONd5tG0t28XPMXejDxgn9rJiWVPf6QbcqYSdOwnaCVOUh36FNVBACCeDzLOx9 mw8HDK8idjv/byhFY2KjQVRS/vICCa5Elmyrvr8bEDJMGJ9gZb3maFWNs0WJuo9A cPSY5JQZatoF1ydnxX1oFIWC9MIhuOktJB6BXjAuwlSzi0Xiyeu3StWFv8Z5tg4j I2oYNkRQN26Cb8T+ilUxgh6OSYvSKnKq0pfq3MoTp7TPOOszfie1VIqfEb4I1f3G 49KJTLalT2gUjrk3DZOOaZjkLVvudVzvx4XpqvoC4wBcgyr6CapbG4soHKiCGNAM +CUqTGTAxKFVGaTFUHAAvIB9a2mspY74tACHrKNM7JeWQCU79Ng= =BkNc -----END PGP SIGNATURE----- --hQiwHBbRI9kgIhsi-- From debbugs-submit-bounces@debbugs.gnu.org Wed Oct 03 16:56:54 2018 Received: (at control) by debbugs.gnu.org; 3 Oct 2018 20:56:54 +0000 Received: from localhost ([127.0.0.1]:36140 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1g7oCU-0004i5-MD for submit@debbugs.gnu.org; Wed, 03 Oct 2018 16:56:54 -0400 Received: from eggs.gnu.org ([208.118.235.92]:54403) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1g7oCT-0004hl-3S for control@debbugs.gnu.org; Wed, 03 Oct 2018 16:56:53 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1g7oCN-0001jX-0z for control@debbugs.gnu.org; Wed, 03 Oct 2018 16:56:47 -0400 X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on eggs.gnu.org X-Spam-Level: X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00 autolearn=disabled version=3.3.2 Received: from fencepost.gnu.org ([2001:4830:134:3::e]:53784) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1g7oCM-0001jB-P9 for control@debbugs.gnu.org; Wed, 03 Oct 2018 16:56:46 -0400 Received: from [2a01:e0a:1d:7270:af76:b9b:ca24:c465] (port=34150 helo=ribbon) by fencepost.gnu.org with esmtpsa (TLS1.2:RSA_AES_256_CBC_SHA1:256) (Exim 4.82) (envelope-from ) id 1g7oCM-0000Ca-DG for control@debbugs.gnu.org; Wed, 03 Oct 2018 16:56:46 -0400 Date: Wed, 03 Oct 2018 22:56:45 +0200 Message-Id: <87in2ilpf6.fsf@gnu.org> To: control@debbugs.gnu.org From: ludo@gnu.org (Ludovic =?utf-8?Q?Court=C3=A8s?=) Subject: control message for bug #32878 MIME-version: 1.0 Content-type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] X-Received-From: 2001:4830:134:3::e X-Spam-Score: -5.0 (-----) X-Debbugs-Envelope-To: control X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -6.0 (------) tags 32878 security From debbugs-submit-bounces@debbugs.gnu.org Sat Oct 06 10:51:17 2018 Received: (at 32878) by debbugs.gnu.org; 6 Oct 2018 14:51:17 +0000 Received: from localhost ([127.0.0.1]:38749 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1g8nvF-00059o-II for submit@debbugs.gnu.org; Sat, 06 Oct 2018 10:51:16 -0400 Received: from out3-smtp.messagingengine.com ([66.111.4.27]:35275) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1g8nvD-00059g-Eb for 32878@debbugs.gnu.org; Sat, 06 Oct 2018 10:51:12 -0400 Received: from compute5.internal (compute5.nyi.internal [10.202.2.45]) by mailout.nyi.internal (Postfix) with ESMTP id 390CB220E4; Sat, 6 Oct 2018 10:51:11 -0400 (EDT) Received: from mailfrontend2 ([10.202.2.163]) by compute5.internal (MEProxy); Sat, 06 Oct 2018 10:51:11 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fastmail.com; h= from:to:subject:in-reply-to:references:date:message-id :mime-version:content-type; s=fm1; bh=FhYg8vtWKknlxlykyKDHgOQf7w 0SsjwTPkT29WCD2t8=; b=G+JIrKY2q2bxYV446eBp3G7ieuBCZY1Tjg6/yoeS/g c33G6KB9wmPp3JGmGz2YLWTeesOCsQsd4QhZhN9H/AgDa2bSmD7exC1E9m1Qyuho BBsEopl1xG8PaOv36jEaHwwUc5emY4SQA0k/JQ3nWjVdAgmFEdi7CrkPoM/Y5Ujl +5trVvMbYOI8csYPBYN/O9z2KsmoBCXgVoo8/OZmioeM9CdPxZ+R64fZNfiqGnBl BJ2+bVq8v3PB7Nn53MwvXGzagqEYB4yKYk5FvD7rRp0gHnxYJysHR7+HbBAPBa2o QH+REmEboUcuCzY8SKdFSNsekXqZ6QfazzWLX4zH9I5Q== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to:x-me-proxy :x-me-proxy:x-me-sender:x-me-sender:x-sasl-enc; s=fm3; bh=FhYg8v tWKknlxlykyKDHgOQf7w0SsjwTPkT29WCD2t8=; b=nfZYJ1bM04L/+Wp4dbbpyr tss4eAJUzrEjpcWvxu8FnS9h9uz+FhGdJVuA3nVvGYFCeeX9v9KHoHFhH9imb7hg BEv3gKUwXROGaL/9tt4kYW28mxHLhqoWaUr73ED1XH13U57Nx0dq1aSsGkCTQhg9 UhuLUqz/5JDOpra1KqNy6njw2TU/XLWK+GQ/STAjpG0ZdQaGCizDf35Qv5eZtUfI /i3LkLNOy5fd6zOUqw2OUm5ADh1PZwVTA48ZO17zk3ap5iihlzBOpnIXEekAviU2 HUiPcgurxZCX6b5esiL7qmk6o/KYzaI5EqMfQSY0U3mzjt37zY+StUsmBiStmqhQ == X-ME-Sender: X-ME-Proxy: Received: from localhost (140.226.16.62.customer.cdi.no [62.16.226.140]) by mail.messagingengine.com (Postfix) with ESMTPA id 69F9B102DE; Sat, 6 Oct 2018 10:51:09 -0400 (EDT) From: Marius Bakke To: Leo Famulari , 32878@debbugs.gnu.org Subject: Re: bug#32878: Python-3 CVE-2018-14647 In-Reply-To: <20180929192302.GB17619@jasmine.lan> References: <20180929192302.GB17619@jasmine.lan> User-Agent: Notmuch/0.27 (https://notmuchmail.org) Emacs/26.1 (x86_64-pc-linux-gnu) Date: Sat, 06 Oct 2018 16:51:07 +0200 Message-ID: <87sh1ji0x0.fsf@fastmail.com> MIME-Version: 1.0 Content-Type: multipart/signed; boundary="==-=-="; micalg=pgp-sha512; protocol="application/pgp-signature" X-Spam-Score: -0.7 (/) X-Debbugs-Envelope-To: 32878 X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -1.7 (-) --==-=-= Content-Type: multipart/mixed; boundary="=-=-=" --=-=-= Content-Type: text/plain Leo Famulari writes: > Our Python 3.6.5 package is vulnerable to CVE-2018-14647, fixed in > CPython commit f7666e828cc3d5873136473ea36ba2013d624fa1, released in > v3.6.7rc1: > > https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14647 Reading , this issue seems to only affect older versions of Expat, or when using Pythons bundled one which is compiled with -DXML_POOR_ENTROPY. ...unfortunately we seem to be using the bundled version :-( This patch adds a graft for Python: --=-=-= Content-Type: text/x-patch Content-Disposition: inline; filename=0001-gnu-python-Fix-CVE-2018-14647.patch Content-Transfer-Encoding: quoted-printable From=20a60d655fd4dddb86e1c8134c675fb61af52b32af Mon Sep 17 00:00:00 2001 From: Marius Bakke Date: Sat, 6 Oct 2018 16:47:05 +0200 Subject: [PATCH] gnu: python: Fix CVE-2018-14647. * gnu/packages/patches/python-CVE-2018-14647.patch: New file. * gnu/local.mk (dist_patch_DATA): Register it. * gnu/packages/python.scm (python-3/fixed): New variable. (python-3.6)[replacement]: New field. (python-minimal, python-debug, wrap-python3): Use PACKAGE/INHERIT instead of standard inheritance. =2D-- gnu/local.mk | 1 + .../patches/python-CVE-2018-14647.patch | 61 +++++++++++++++++++ gnu/packages/python.scm | 16 +++-- 3 files changed, 74 insertions(+), 4 deletions(-) create mode 100644 gnu/packages/patches/python-CVE-2018-14647.patch diff --git a/gnu/local.mk b/gnu/local.mk index 61e5913a0..df16f85db 100644 =2D-- a/gnu/local.mk +++ b/gnu/local.mk @@ -1075,6 +1075,7 @@ dist_patch_DATA =3D \ %D%/packages/patches/python-3-deterministic-build-info.patch \ %D%/packages/patches/python-3-search-paths.patch \ %D%/packages/patches/python-3-fix-tests.patch \ + %D%/packages/patches/python-CVE-2018-14647.patch \ %D%/packages/patches/python-axolotl-AES-fix.patch \ %D%/packages/patches/python-cairocffi-dlopen-path.patch \ %D%/packages/patches/python-fix-tests.patch \ diff --git a/gnu/packages/patches/python-CVE-2018-14647.patch b/gnu/package= s/patches/python-CVE-2018-14647.patch new file mode 100644 index 000000000..24f8d2182 =2D-- /dev/null +++ b/gnu/packages/patches/python-CVE-2018-14647.patch @@ -0,0 +1,61 @@ +Fix CVE-2018-14647: +https://cve.mitre.org/cgi-bin/cvename.cgi?name=3DCVE-2018-14647 +https://bugs.python.org/issue34623 + +Taken from upstream: +https://github.com/python/cpython/commit/f7666e828cc3d5873136473ea36ba2013= d624fa1 + +diff --git Include/pyexpat.h Include/pyexpat.h +index 44259bf6d7..07020b5dc9 100644 +--- Include/pyexpat.h ++++ Include/pyexpat.h +@@ -3,7 +3,7 @@ +=20 + /* note: you must import expat.h before importing this module! */ +=20 +-#define PyExpat_CAPI_MAGIC "pyexpat.expat_CAPI 1.0" ++#define PyExpat_CAPI_MAGIC "pyexpat.expat_CAPI 1.1" + #define PyExpat_CAPSULE_NAME "pyexpat.expat_CAPI" +=20 + struct PyExpat_CAPI +@@ -48,6 +48,8 @@ struct PyExpat_CAPI + enum XML_Status (*SetEncoding)(XML_Parser parser, const XML_Char *enc= oding); + int (*DefaultUnknownEncodingHandler)( + void *encodingHandlerData, const XML_Char *name, XML_Encoding *in= fo); ++ /* might be none for expat < 2.1.0 */ ++ int (*SetHashSalt)(XML_Parser parser, unsigned long hash_salt); + /* always add new stuff to the end! */ + }; +=20 +diff --git Modules/_elementtree.c Modules/_elementtree.c +index 707ab2912b..53f05f937f 100644 +--- Modules/_elementtree.c ++++ Modules/_elementtree.c +@@ -3261,6 +3261,11 @@ _elementtree_XMLParser___init___impl(XMLParserObjec= t *self, PyObject *html, + PyErr_NoMemory(); + return -1; + } ++ /* expat < 2.1.0 has no XML_SetHashSalt() */ ++ if (EXPAT(SetHashSalt) !=3D NULL) { ++ EXPAT(SetHashSalt)(self->parser, ++ (unsigned long)_Py_HashSecret.expat.hashsalt); ++ } +=20 + if (target) { + Py_INCREF(target); +diff --git Modules/pyexpat.c Modules/pyexpat.c +index 47c3e86c20..aa21d93c11 100644 +--- Modules/pyexpat.c ++++ Modules/pyexpat.c +@@ -1887,6 +1887,11 @@ MODULE_INITFUNC(void) + capi.SetStartDoctypeDeclHandler =3D XML_SetStartDoctypeDeclHandler; + capi.SetEncoding =3D XML_SetEncoding; + capi.DefaultUnknownEncodingHandler =3D PyUnknownEncodingHandler; ++#if XML_COMBINED_VERSION >=3D 20100 ++ capi.SetHashSalt =3D XML_SetHashSalt; ++#else ++ capi.SetHashSalt =3D NULL; ++#endif +=20 + /* export using capsule */ + capi_object =3D PyCapsule_New(&capi, PyExpat_CAPSULE_NAME, NULL); diff --git a/gnu/packages/python.scm b/gnu/packages/python.scm index 4703d95a2..5ee3db6bf 100644 =2D-- a/gnu/packages/python.scm +++ b/gnu/packages/python.scm @@ -357,6 +357,7 @@ data types.") (package (inherit python-2) (name "python") (version "3.6.5") + (replacement python-3/fixed) (source (origin (method url-fetch) (uri (string-append "https://www.python.org/ftp/python/" @@ -456,6 +457,14 @@ data types.") ;; Current 3.x version. (define-public python-3 python-3.6) =20 +(define python-3/fixed + (package + (inherit python-3) + (source (origin + (inherit (package-source python-3)) + (patches (append (origin-patches (package-source python-3)) + (search-patches "python-CVE-2018-14647.patc= h"))))))) + ;; Current major version. (define-public python python-3) =20 @@ -474,7 +483,7 @@ data types.") ("zlib" ,zlib))))) =20 (define-public python-minimal =2D (package (inherit python) + (package/inherit python (name "python-minimal") (outputs '("out")) =20 @@ -486,8 +495,7 @@ data types.") ("zlib" ,zlib))))) =20 (define-public python-debug =2D (package =2D (inherit python) + (package/inherit python (name "python-debug") (outputs '("out" "debug")) (build-system gnu-build-system) @@ -506,7 +514,7 @@ for more information."))) (define* (wrap-python3 python #:optional (name (string-append (package-name python) "-wrappe= r"))) =2D (package (inherit python) + (package/inherit python (name name) (source #f) (build-system trivial-build-system) =2D-=20 2.19.0 --=-=-= Content-Type: text/plain WDYT? --=-=-=-- --==-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCgAdFiEEu7At3yzq9qgNHeZDoqBt8qM6VPoFAlu4y9wACgkQoqBt8qM6 VPqnmQgApOAHt4a1wl9sCK8lyL1xwAJ3gkjAq4wjPUTK5QoTK5myv6GuWO1bCvI+ 8VbFZXCpo9a97HY/Ci9iGAmUB7Glqsyh30doG1BeDbC7zJGH4/fIAqC9vDTL/rWx z+tnQvt9PnQIrTTAQ0jZsSjLCeWaqGbI2A7s6qElpAiVF0wpuQAJqNiR9gC86g3M fFYOZxBOHAGqj+caTqdGJitDhPlFNUQnWGkYLuv5PTeN8781pHKzVezM4cnCeE5o 3XLDAM3TcZnQ6Ot66VjTPfG/vq/rz75OKzkOicT6oJHGf7zzoKkQU92lGCtxIspX 7RrIAft7S097mpSWr8uPhLqJ2pg2dA== =vUBW -----END PGP SIGNATURE----- --==-=-=-- From debbugs-submit-bounces@debbugs.gnu.org Sat Oct 06 11:26:31 2018 Received: (at 32878) by debbugs.gnu.org; 6 Oct 2018 15:26:31 +0000 Received: from localhost ([127.0.0.1]:38764 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1g8oTL-0005yj-TJ for submit@debbugs.gnu.org; Sat, 06 Oct 2018 11:26:31 -0400 Received: from out3-smtp.messagingengine.com ([66.111.4.27]:42963) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1g8oTK-0005ya-76 for 32878@debbugs.gnu.org; Sat, 06 Oct 2018 11:26:26 -0400 Received: from compute5.internal (compute5.nyi.internal [10.202.2.45]) by mailout.nyi.internal (Postfix) with ESMTP id 1DD8621FC7; Sat, 6 Oct 2018 11:26:26 -0400 (EDT) Received: from mailfrontend2 ([10.202.2.163]) by compute5.internal (MEProxy); Sat, 06 Oct 2018 11:26:26 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fastmail.com; h= from:to:subject:in-reply-to:references:date:message-id :mime-version:content-type; s=fm1; bh=aYMfJq+9BJJDp6qK0LjZ7JaFlc Z42OMy8W8n90lad58=; b=WzUSnEuj5OBiIBaYHiRUqYR8BLsNkU9fDKD+0i8k30 BHVqyAKwWbjtMbofkPiZ8DUGUBOnv6vWGLlPOln84ro4Ms16pSn9Q948HXgAPgb6 yqggOzNfW+bYKksG5hvbSJBiaqqAjwvXtEN0JA3gc7acKyFHuIs0Q0aB25zp9Spc o9bNy4cUHsmSCcOYX0dC2QLGJDfeRu7QxiSaU26sBToGB6GoiWSAYUv2JDxzMZTr ErLt+kEy2VtYxz5pZi8SutdPzLk7l3NUG8/TbaHM7+62YROxmsmX93zAgHRtj5zy p+XWm65tcc3AZBkz9EhF7uLnlLiQCKpIMJSet7Rgl0FQ== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to:x-me-proxy :x-me-proxy:x-me-sender:x-me-sender:x-sasl-enc; s=fm3; bh=aYMfJq +9BJJDp6qK0LjZ7JaFlcZ42OMy8W8n90lad58=; b=NnPiU9HpAnbige+pDKTSK5 PpdtIeLI8iBhSLspL3gO9zmKGJPZ7u34QlirpceEVSOmG//n8x0cy+NR7IJsE/1l OrtYy2fBCau4mz6ClfgAur9jotZ8P9fu3wjZm71lIHTUDPTPpwlnAGK6FWwUgDgM dKpGRjptsC1HgOoGlTSIFzz+PQ2nxxx6MW1Llwd/FbDsZs7f5thAj+iNXxvKl71j 1jrcSEESDu9PeGBjvIcHed+ur2fmsmNUSJGY0J8C+4tf0IOv5tvOQBZQpt0lfkQ+ UQUr8Cm7clvLwRCeoU44T5hV0zwY5Ad8Mya0OM/qwsiLGOA1FXC4ir8NJUWmDPyg == X-ME-Sender: X-ME-Proxy: Received: from localhost (140.226.16.62.customer.cdi.no [62.16.226.140]) by mail.messagingengine.com (Postfix) with ESMTPA id 57F1D102EE; Sat, 6 Oct 2018 11:26:23 -0400 (EDT) From: Marius Bakke To: Leo Famulari , 32878@debbugs.gnu.org Subject: Re: bug#32878: Python-3 CVE-2018-14647 In-Reply-To: <87sh1ji0x0.fsf@fastmail.com> References: <20180929192302.GB17619@jasmine.lan> <87sh1ji0x0.fsf@fastmail.com> User-Agent: Notmuch/0.27 (https://notmuchmail.org) Emacs/26.1 (x86_64-pc-linux-gnu) Date: Sat, 06 Oct 2018 17:26:21 +0200 Message-ID: <87lg7bhzaa.fsf@fastmail.com> MIME-Version: 1.0 Content-Type: multipart/signed; boundary="==-=-="; micalg=pgp-sha512; protocol="application/pgp-signature" X-Spam-Score: -0.7 (/) X-Debbugs-Envelope-To: 32878 X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -1.7 (-) --==-=-= Content-Type: multipart/mixed; boundary="=-=-=" --=-=-= Content-Type: text/plain Content-Transfer-Encoding: quoted-printable Marius Bakke writes: > This patch adds a graft for Python: > > From a60d655fd4dddb86e1c8134c675fb61af52b32af Mon Sep 17 00:00:00 2001 > From: Marius Bakke > Date: Sat, 6 Oct 2018 16:47:05 +0200 > Subject: [PATCH] gnu: python: Fix CVE-2018-14647. > > * gnu/packages/patches/python-CVE-2018-14647.patch: New file. > * gnu/local.mk (dist_patch_DATA): Register it. > * gnu/packages/python.scm (python-3/fixed): New variable. > (python-3.6)[replacement]: New field. > (python-minimal, python-debug, wrap-python3): Use PACKAGE/INHERIT instead= of > standard inheritance. > --- > gnu/local.mk | 1 + > .../patches/python-CVE-2018-14647.patch | 61 +++++++++++++++++++ > gnu/packages/python.scm | 16 +++-- > 3 files changed, 74 insertions(+), 4 deletions(-) > create mode 100644 gnu/packages/patches/python-CVE-2018-14647.patch > > diff --git a/gnu/local.mk b/gnu/local.mk > index 61e5913a0..df16f85db 100644 > --- a/gnu/local.mk > +++ b/gnu/local.mk > @@ -1075,6 +1075,7 @@ dist_patch_DATA =3D \ > %D%/packages/patches/python-3-deterministic-build-info.patch \ > %D%/packages/patches/python-3-search-paths.patch \ > %D%/packages/patches/python-3-fix-tests.patch \ > + %D%/packages/patches/python-CVE-2018-14647.patch \ > %D%/packages/patches/python-axolotl-AES-fix.patch \ > %D%/packages/patches/python-cairocffi-dlopen-path.patch \ > %D%/packages/patches/python-fix-tests.patch \ > diff --git a/gnu/packages/patches/python-CVE-2018-14647.patch b/gnu/packa= ges/patches/python-CVE-2018-14647.patch > new file mode 100644 > index 000000000..24f8d2182 > --- /dev/null > +++ b/gnu/packages/patches/python-CVE-2018-14647.patch > @@ -0,0 +1,61 @@ > +Fix CVE-2018-14647: > +https://cve.mitre.org/cgi-bin/cvename.cgi?name=3DCVE-2018-14647 > +https://bugs.python.org/issue34623 > + > +Taken from upstream: > +https://github.com/python/cpython/commit/f7666e828cc3d5873136473ea36ba20= 13d624fa1 > + > +diff --git Include/pyexpat.h Include/pyexpat.h > +index 44259bf6d7..07020b5dc9 100644 > +--- Include/pyexpat.h > ++++ Include/pyexpat.h > +@@ -3,7 +3,7 @@ > +=20 > + /* note: you must import expat.h before importing this module! */ > +=20 > +-#define PyExpat_CAPI_MAGIC "pyexpat.expat_CAPI 1.0" > ++#define PyExpat_CAPI_MAGIC "pyexpat.expat_CAPI 1.1" > + #define PyExpat_CAPSULE_NAME "pyexpat.expat_CAPI" > +=20 > + struct PyExpat_CAPI > +@@ -48,6 +48,8 @@ struct PyExpat_CAPI > + enum XML_Status (*SetEncoding)(XML_Parser parser, const XML_Char *e= ncoding); > + int (*DefaultUnknownEncodingHandler)( > + void *encodingHandlerData, const XML_Char *name, XML_Encoding *= info); > ++ /* might be none for expat < 2.1.0 */ > ++ int (*SetHashSalt)(XML_Parser parser, unsigned long hash_salt); > + /* always add new stuff to the end! */ > + }; > +=20 > +diff --git Modules/_elementtree.c Modules/_elementtree.c > +index 707ab2912b..53f05f937f 100644 > +--- Modules/_elementtree.c > ++++ Modules/_elementtree.c > +@@ -3261,6 +3261,11 @@ _elementtree_XMLParser___init___impl(XMLParserObj= ect *self, PyObject *html, > + PyErr_NoMemory(); > + return -1; > + } > ++ /* expat < 2.1.0 has no XML_SetHashSalt() */ > ++ if (EXPAT(SetHashSalt) !=3D NULL) { > ++ EXPAT(SetHashSalt)(self->parser, > ++ (unsigned long)_Py_HashSecret.expat.hashsalt= ); > ++ } > +=20 > + if (target) { > + Py_INCREF(target); > +diff --git Modules/pyexpat.c Modules/pyexpat.c > +index 47c3e86c20..aa21d93c11 100644 > +--- Modules/pyexpat.c > ++++ Modules/pyexpat.c > +@@ -1887,6 +1887,11 @@ MODULE_INITFUNC(void) > + capi.SetStartDoctypeDeclHandler =3D XML_SetStartDoctypeDeclHandler; > + capi.SetEncoding =3D XML_SetEncoding; > + capi.DefaultUnknownEncodingHandler =3D PyUnknownEncodingHandler; > ++#if XML_COMBINED_VERSION >=3D 20100 > ++ capi.SetHashSalt =3D XML_SetHashSalt; > ++#else > ++ capi.SetHashSalt =3D NULL; > ++#endif > +=20 > + /* export using capsule */ > + capi_object =3D PyCapsule_New(&capi, PyExpat_CAPSULE_NAME, NULL); > diff --git a/gnu/packages/python.scm b/gnu/packages/python.scm > index 4703d95a2..5ee3db6bf 100644 > --- a/gnu/packages/python.scm > +++ b/gnu/packages/python.scm > @@ -357,6 +357,7 @@ data types.") > (package (inherit python-2) > (name "python") > (version "3.6.5") > + (replacement python-3/fixed) > (source (origin > (method url-fetch) > (uri (string-append "https://www.python.org/ftp/python/" > @@ -456,6 +457,14 @@ data types.") > ;; Current 3.x version. > (define-public python-3 python-3.6) >=20=20 > +(define python-3/fixed > + (package > + (inherit python-3) > + (source (origin > + (inherit (package-source python-3)) > + (patches (append (origin-patches (package-source python-3)) > + (search-patches "python-CVE-2018-14647.pa= tch"))))))) > + > ;; Current major version. > (define-public python python-3) >=20=20 > @@ -474,7 +483,7 @@ data types.") > ("zlib" ,zlib))))) >=20=20 > (define-public python-minimal > - (package (inherit python) > + (package/inherit python > (name "python-minimal") > (outputs '("out")) >=20=20 > @@ -486,8 +495,7 @@ data types.") > ("zlib" ,zlib))))) >=20=20 > (define-public python-debug > - (package > - (inherit python) > + (package/inherit python > (name "python-debug") > (outputs '("out" "debug")) > (build-system gnu-build-system) > @@ -506,7 +514,7 @@ for more information."))) > (define* (wrap-python3 python > #:optional > (name (string-append (package-name python) "-wrap= per"))) > - (package (inherit python) > + (package/inherit python > (name name) > (source #f) > (build-system trivial-build-system) > --=20 > 2.19.0 Whoops, this hunk is also needed: --=-=-= Content-Type: text/x-patch Content-Disposition: inline 1 file changed, 11 insertions(+), 1 deletion(-) gnu/packages/python.scm | 12 +++++++++++- modified gnu/packages/python.scm @@ -463,7 +463,17 @@ data types.") (source (origin (inherit (package-source python-3)) (patches (append (origin-patches (package-source python-3)) - (search-patches "python-CVE-2018-14647.patch"))))))) + (search-patches "python-CVE-2018-14647.patch"))))) + (arguments + (substitute-keyword-arguments (package-arguments python-3) + ((#:phases phases) + `(modify-phases ,phases + (add-after 'unpack 'delete-broken-test + (lambda _ + ;; Delete test which fails on recent kernels: + ;; . + (delete-file "Lib/test/test_socket.py") + #t)))))))) ;; Current major version. (define-public python python-3) [back] --=-=-=-- --==-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCgAdFiEEu7At3yzq9qgNHeZDoqBt8qM6VPoFAlu41B0ACgkQoqBt8qM6 VPpp2gf+NaeW3CkR/hXBlsfrU1sRCh9e9mdCdU1dMTR5hXmDTPe1UZsQQH2euLKa Cxf1fqZH0wrU2KfvUEZNJKzi0lqQeJCUIjaT057/lBMhhnWLol6Yk4kN8WnYBAwM l7Tkc+Wq0lqrphBimz6SxbhoHtusSSVx6IzLaqaQWSxW/HocXIE5bbl2BbxvtDSp 2KGhlYJQKYv9S/s81ZjnUK4PW0DiJHknAzncOfIkJ7PUri0CltRH7dnGpSRO+9uc VCE4VUKRnEi1Z6OrGlIwpfNctOJ8ORI3LjIgSaUYUDEirqat+s2SwU/eVmnNgrtS iWZQMS4YvM9zxbU8swW9UpvHebBHAA== =f+yp -----END PGP SIGNATURE----- --==-=-=-- From debbugs-submit-bounces@debbugs.gnu.org Wed Oct 10 15:26:05 2018 Received: (at 32878) by debbugs.gnu.org; 10 Oct 2018 19:26:05 +0000 Received: from localhost ([127.0.0.1]:43866 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1gAK7Q-0001F1-Uj for submit@debbugs.gnu.org; Wed, 10 Oct 2018 15:26:05 -0400 Received: from out3-smtp.messagingengine.com ([66.111.4.27]:53997) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1gAK7P-0001Eu-Qg for 32878@debbugs.gnu.org; Wed, 10 Oct 2018 15:26:04 -0400 Received: from compute4.internal (compute4.nyi.internal [10.202.2.44]) by mailout.nyi.internal (Postfix) with ESMTP id A2C98221CC; Wed, 10 Oct 2018 15:26:03 -0400 (EDT) Received: from mailfrontend2 ([10.202.2.163]) by compute4.internal (MEProxy); Wed, 10 Oct 2018 15:26:03 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=famulari.name; h=date:from:to:cc:subject:message-id:references:mime-version :content-type:in-reply-to; s=mesmtp; bh=xaljEMfs+gRxoXKVtmfuKtp7 cKIhPbgwNicPZxMdm1M=; b=oJBMZcMGAyaChJdDvuP+05j2c9QFew/EbVdh9uE/ pmkfPKHxqnLMDRRqI1QicRiggrCa3e3I8yDH7B2QO28xnpPCGXB0YsjfC3DcZ3g5 wDniUAtDyytXo7lGEniLi0OsZ1EfU//LdFWJJ7xxsRsDpA13NiNYfQz3sEgujjlN LIs= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to:x-me-proxy :x-me-proxy:x-me-sender:x-me-sender:x-sasl-enc; s=fm1; bh=xaljEM fs+gRxoXKVtmfuKtp7cKIhPbgwNicPZxMdm1M=; b=XWRUNmVFylG0l1TCNpUNG8 2fr0sQcFw4fxTBFIVNT8Uy/imdej++FxzanHWjduK+sVx6IN0UX/0a6cRYAP0UP5 cFni17ItmQcpkRXpb1IDEgoo6TFvffKjtvgD5wCRaEzMtNwyynnEn9uHddMutwM7 PxZ0vi2REaJx/YP+r2/iL/rqP2sTVq1gGl9UEzOaKxCGKU+ckN5rGPj3LgrbmsOO wu4jzZAufkMiJRE5IsWtxaKnIuJAMRetFT6j+uzD6PgEVWzFJjcpcOhuM5gloIR5 HqYYXkfFbrN+vI5RuVlfo3RroY/QALpwlJf3yfX/OEgqw6K5G0RmKUxzWdHx2pSQ == X-ME-Sender: X-ME-Proxy: Received: from localhost (unknown [172.58.201.64]) by mail.messagingengine.com (Postfix) with ESMTPA id 33176102ED; Wed, 10 Oct 2018 15:26:02 -0400 (EDT) Date: Wed, 10 Oct 2018 15:26:01 -0400 From: Leo Famulari To: Marius Bakke Subject: Re: bug#32878: Python-3 CVE-2018-14647 Message-ID: <20181010192601.GB22832@jasmine.lan> References: <20180929192302.GB17619@jasmine.lan> <87sh1ji0x0.fsf@fastmail.com> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="WhfpMioaduB5tiZL" Content-Disposition: inline In-Reply-To: <87sh1ji0x0.fsf@fastmail.com> User-Agent: Mutt/1.10.1 (2018-07-13) X-Spam-Score: -0.7 (/) X-Debbugs-Envelope-To: 32878 Cc: 32878@debbugs.gnu.org X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -1.7 (-) --WhfpMioaduB5tiZL Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Sat, Oct 06, 2018 at 04:51:07PM +0200, Marius Bakke wrote: > From a60d655fd4dddb86e1c8134c675fb61af52b32af Mon Sep 17 00:00:00 2001 > From: Marius Bakke > Date: Sat, 6 Oct 2018 16:47:05 +0200 > Subject: [PATCH] gnu: python: Fix CVE-2018-14647. >=20 > * gnu/packages/patches/python-CVE-2018-14647.patch: New file. > * gnu/local.mk (dist_patch_DATA): Register it. > * gnu/packages/python.scm (python-3/fixed): New variable. > (python-3.6)[replacement]: New field. > (python-minimal, python-debug, wrap-python3): Use PACKAGE/INHERIT instead= of > standard inheritance. Thanks! I did some more basic tests with this one, using the extra hunk in your other mail. I think this change is okay. --WhfpMioaduB5tiZL Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEsFFZSPHn08G5gDigJkb6MLrKfwgFAlu+UkkACgkQJkb6MLrK fwhXdw/+J+My56nC1+9G3+zL5OFyEmVWgtAxhxL3QrfcoZoZRoUtHIDo3nhuZMkm lgtAWxR6qMZA76KWyQiJ4nLo7HreyPwXMrv+jInjKFTv4ABWNjuCtQWKoFH9gVwe Jo/MRTlAzgFKzXBzi7X0XrDpxJ04oHLV/+/yt8SO//I/2O5ZFnyjoC1u4OtDdzIL vUwyWBt/GMcIeVAcolU1mC19o3VJ00TD9VbORMxXdcJRmRkHrYEZ5FxfKSelTIUL GKrm8M3VVCbAKjf17jSkQpYGqwCOhHKupoG7HhivGREAAkdbdd0loOtQ+oMplk2A VOofMA73xrKZIMz1pcVScTSwnUzW2PeU6Ci6gOVkaSkGf+eK/pi4A6vZ8cEzWi+q k2NxR/1zursvq2wxcgMFMpygfb0C9fXe0esXC1aXIy4NdfxbpKO/NmBWEZ54kVo/ 0bHEnbG1suxkBRImzPntlXiSvIhbDy6Xl80CsaK/DWbx5NkxcxK0/mji+eBEGDRl nWTUHzLkWqMLZ/uceaDnaQOxPTyIRzb/I10cxZf3C0jStEZNpLZv9KiV+RlQXx4Q ZqdrQ1cg9R2dparlN/Mbb6xfR8Frg1yj/YxswlgmK7k+k0Bk5Uc+53lrvnA+DIbW inLxXWeonI3ekii8syGctFr7I5oDYijV55t06wieb5m6d1VcGWs= =Bfcp -----END PGP SIGNATURE----- --WhfpMioaduB5tiZL-- From debbugs-submit-bounces@debbugs.gnu.org Thu Oct 11 04:04:51 2018 Received: (at 32878) by debbugs.gnu.org; 11 Oct 2018 08:04:51 +0000 Received: from localhost ([127.0.0.1]:44114 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1gAVxj-000711-Bu for submit@debbugs.gnu.org; Thu, 11 Oct 2018 04:04:51 -0400 Received: from world.peace.net ([64.112.178.59]:34698) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1gAVxh-00070g-NY for 32878@debbugs.gnu.org; Thu, 11 Oct 2018 04:04:49 -0400 Received: from mhw by world.peace.net with esmtpsa (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.89) (envelope-from ) id 1gAVxb-0001vI-AO; Thu, 11 Oct 2018 04:04:43 -0400 From: Mark H Weaver To: Leo Famulari Subject: Re: bug#32878: Python-3 CVE-2018-14647 References: <20180929192302.GB17619@jasmine.lan> <87sh1ji0x0.fsf@fastmail.com> <20181010192601.GB22832@jasmine.lan> Date: Thu, 11 Oct 2018 04:04:31 -0400 In-Reply-To: <20181010192601.GB22832@jasmine.lan> (Leo Famulari's message of "Wed, 10 Oct 2018 15:26:01 -0400") Message-ID: <87k1moykmo.fsf@netris.org> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/26.1 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain X-Spam-Score: 0.0 (/) X-Debbugs-Envelope-To: 32878 Cc: Marius Bakke , 32878@debbugs.gnu.org X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -1.0 (-) Leo Famulari writes: > On Sat, Oct 06, 2018 at 04:51:07PM +0200, Marius Bakke wrote: >> From a60d655fd4dddb86e1c8134c675fb61af52b32af Mon Sep 17 00:00:00 2001 >> From: Marius Bakke >> Date: Sat, 6 Oct 2018 16:47:05 +0200 >> Subject: [PATCH] gnu: python: Fix CVE-2018-14647. >> >> * gnu/packages/patches/python-CVE-2018-14647.patch: New file. >> * gnu/local.mk (dist_patch_DATA): Register it. >> * gnu/packages/python.scm (python-3/fixed): New variable. >> (python-3.6)[replacement]: New field. >> (python-minimal, python-debug, wrap-python3): Use PACKAGE/INHERIT instead of >> standard inheritance. > > Thanks! I did some more basic tests with this one, using the extra hunk > in your other mail. I think this change is okay. As I wrote in another thread, I added this commit (with extra hunk) to my private branch a few days ago, along with the Python-2 security fixes, updated my GuixSD GNOME 3 system and user profile, and everything seems to be working well. I think they are both ready to push to master. Thank you, Marius! Mark From debbugs-submit-bounces@debbugs.gnu.org Wed Oct 17 15:02:25 2018 Received: (at control) by debbugs.gnu.org; 17 Oct 2018 19:02:25 +0000 Received: from localhost ([127.0.0.1]:55639 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1gCr5M-0002EH-TP for submit@debbugs.gnu.org; Wed, 17 Oct 2018 15:02:25 -0400 Received: from out3-smtp.messagingengine.com ([66.111.4.27]:49789) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1gCr5L-0002E8-BA for control@debbugs.gnu.org; Wed, 17 Oct 2018 15:02:23 -0400 Received: from compute5.internal (compute5.nyi.internal [10.202.2.45]) by mailout.nyi.internal (Postfix) with ESMTP id F24E3221CB for ; Wed, 17 Oct 2018 15:02:22 -0400 (EDT) Received: from mailfrontend1 ([10.202.2.162]) by compute5.internal (MEProxy); Wed, 17 Oct 2018 15:02:22 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fastmail.com; h= from:to:subject:date:message-id:mime-version:content-type; s= fm1; bh=4ecK0zU44RDpg5lPrqD1kiWbbC8Ci+ws8tK/yMnpxzY=; b=P5+zbJKm Uoqsozo7fK5f+rGmek0SbMMSQ/7GKCEZgEdTtooEsyuniVt1NQdHzRvZiGdN+VDe voHpVL0K1LdYg2Io6R17BVKTDg0iyT7kneFVVUQGvPaT2f3jId34/xXMWuDGzyMq fSogKEv2PVeU3is4KGTXBX0TzzVlyj4iF3arrhzx4ghmOwUhBFeI97//j8HxvNU5 vMkf4vpoo1sWVG2WT46e/ym6WnR8TRJePXxzDAdu/mRksz116IjGV7dTZSfweJdK LthZymjdJql6V82uXydV7jYttowRHWW0X+H9gx8Dee0JMT4p+6fazShn9wI6I2Yn rYFGzu2p/PLmVA== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=content-type:date:from:message-id :mime-version:subject:to:x-me-proxy:x-me-proxy:x-me-sender :x-me-sender:x-sasl-enc; s=fm1; bh=4ecK0zU44RDpg5lPrqD1kiWbbC8Ci +ws8tK/yMnpxzY=; b=UmM9CTaOa3MI0X/iI4ZQzIIiinM7TNkN/rOpL+veZnnsa NFaH5ddxUO8E77OBqXda/t+grkkmInsVS/Eise+eySHg/2hTJBtdsVelQiF2QETu ONVO9tGKjkLuSU4d4Zxcx7NvF8CofvWWxDZIQCb7zndsqHK9DgWnKv6zv62+Z64t p+E2HgdyG/slsbhc2nNNBY6L2icAi1E0a/ccbcjOs/wocLxdE9hug7aeth2Z4z8O CW2Tm35YBMvty4nijbbUEH1nmQQrwXYdAIGeZw0qosfn5ytxg5BZ3VUmhTTlFJQi Pw4y6EU6qJotmxkimjScePbSs52+oygdx1Dd2AdEQ== X-ME-Sender: X-ME-Proxy: Received: from localhost (140.226.16.62.customer.cdi.no [62.16.226.140]) by mail.messagingengine.com (Postfix) with ESMTPA id 0A9DCE4071 for ; Wed, 17 Oct 2018 15:02:21 -0400 (EDT) From: Marius Bakke To: control@debbugs.gnu.org Subject: 32878 User-Agent: Notmuch/0.27 (https://notmuchmail.org) Emacs/26.1 (x86_64-pc-linux-gnu) Date: Wed, 17 Oct 2018 21:02:20 +0200 Message-ID: <87zhvcflc3.fsf@fastmail.com> MIME-Version: 1.0 Content-Type: multipart/signed; boundary="=-=-="; micalg=pgp-sha512; protocol="application/pgp-signature" X-Spam-Score: -0.7 (/) X-Debbugs-Envelope-To: control X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -1.7 (-) --=-=-= Content-Type: text/plain close 32878 90aeaee861845142843a0f988fa4ff016c723cdb thanks --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCgAdFiEEu7At3yzq9qgNHeZDoqBt8qM6VPoFAlvHhzwACgkQoqBt8qM6 VPq/Rwf/dbYQCZwBqZrmgBCbcgaNnfKMX9zxidzQV+g50+nNR4rTv7RrknqLCUmX pD1XuvuEH5lUQem0aXbTHyYhxpO9+Vi235MHf1ECR+VL1XMTZTutd5eT28jLzw4U dqxoAmp+DIA5GSeotcb++78+guomLBPCpkPereYjPxFMdOyPzCjc71+9F2spqgMF NOzk/ql8rZc7o8OR9L/5s7i4ui9g+3Sh88Ra7EFH/O1FtPsvPYNRU0P7Fytof23C KLv1nalRSuDs0hjwsrETMz+fsazmr/gcEt5eFyBwk2wsnRBH+9l+CDGWYT6Bhhs0 m+T6MaIdGyazZ8YCgqDsrWYZVDo9yA== =gbUC -----END PGP SIGNATURE----- --=-=-=-- From unknown Mon Aug 18 15:39:22 2025 Received: (at fakecontrol) by fakecontrolmessage; To: internal_control@debbugs.gnu.org From: Debbugs Internal Request Subject: Internal Control Message-Id: bug archived. Date: Thu, 15 Nov 2018 12:24:06 +0000 User-Agent: Fakemail v42.6.9 # This is a fake control message. # # The action: # bug archived. thanks # This fakemail brought to you by your local debbugs # administrator