Subject: bug#36699: closed (Re: [bug#36699] [PATCH 0/4] Strengthen '.guix-channel' file handling)

From: [email-masked] (GNU bug Tracking System)
Date: Fri, 19 Jul 2019 09:55:03 +0000

Your bug report

#36699: [PATCH 0/4] Strengthen '.guix-channel' file handling

which was filed against the guix-patches package, has been closed.

The explanation is attached below, along with your original report.
If you require more details, please reply to [email-masked].

-- 
36699: http://debbugs.gnu.org/cgi/bugreport.cgi?bug=36699
GNU Bug Tracking System
Contact [email-masked] with problems

Subject: Re: [bug#36699] [PATCH 0/4] Strengthen '.guix-channel' file handling
From: Ludovic Courtès <[email-masked]>
To: [email-masked]
Date: Fri, 19 Jul 2019 11:54:49 +0200
List-Id: <debbugs-submit.debbugs.gnu.org>

Hello,

Ludovic Courtès <[email-masked]> skribis:

> Ludovic Courtès (4):
>   channels: Strictly check the version of '.guix-channel'.
>   channels: Remove unneeded 'version' field of <channel-metadata>.
>   channels: Always provide a <channel-metadata> record.
>   channels: Reject directories with '..' in '.guix-channel' file.

I pushed the first three patches and discarded the last one, as
discussed with Danny.

Ludo’.

Subject: [PATCH 0/4] Strengthen '.guix-channel' file handling
From: Ludovic Courtès <[email-masked]>
To: [email-masked]
Cc: Ludovic Courtès <[email-masked]>
Date: Wed, 17 Jul 2019 01:20:16 +0200
List-Id: <debbugs-submit.debbugs.gnu.org>

Hello Guix,

These patches change ‘.guix-channel’ parsing and handling following
the same pattern as <manifest>/read-manifest/profile-manifest and
other places where we deal with serialized data structures.

The last patch addresses a potential security issue with the
‘directory’ field of ‘.guix-channel’ that hadn’t occurred to me
while reviewing it.

Thoughts?

Ludo’.

Ludovic Courtès (4):
  channels: Strictly check the version of '.guix-channel'.
  channels: Remove unneeded 'version' field of <channel-metadata>.
  channels: Always provide a <channel-metadata> record.
  channels: Reject directories with '..' in '.guix-channel' file.

 guix/channels.scm  | 102 +++++++++++++++++++++++++++++----------------
 tests/channels.scm |  81 +++++++++++++++++++++++++----------
 2 files changed, 124 insertions(+), 59 deletions(-)

-- 
2.22.0