GNU bug report logs - #42890
[PATCH] gnu: taglib: Include patch to prevent OGG corruption.

Previous Next

Full log

View this message in rfc822 format

From: help-debbugs <at> gnu.org (GNU bug Tracking System)
To: Pierre Langlois <pierre.langlois <at> gmx.com>
Cc: tracker <at> debbugs.gnu.org
Subject: bug#42890: closed ([PATCH] gnu: taglib: Include patch to prevent
 OGG corruption.)
Date: Fri, 04 Sep 2020 11:15:02 +0000

[Message part 1 (text/plain, inline)]

Your message dated Fri, 04 Sep 2020 12:14:26 +0100
with message-id <878sdpu73h.fsf <at> gmx.com>
and subject line Re: [bug#42890] [PATCH] gnu: taglib: Include patch to prevent OGG corruption.
has caused the debbugs.gnu.org bug report #42890,
regarding [PATCH] gnu: taglib: Include patch to prevent OGG corruption.
to be marked as done.

(If you believe you have received this mail in error, please contact
help-debbugs <at> gnu.org.)


-- 
42890: http://debbugs.gnu.org/cgi/bugreport.cgi?bug=42890
GNU Bug Tracking System
Contact help-debbugs <at> gnu.org with problems

[Message part 2 (message/rfc822, inline)]

From: Pierre Langlois <pierre.langlois <at> gmx.com>
To: Guix-patches <guix-patches <at> gnu.org>
Subject: [PATCH] gnu: taglib: Include patch to prevent OGG corruption.
Date: Sun, 16 Aug 2020 16:48:19 +0100

[Message part 3 (text/plain, inline)]

Hello Guix!

As I was looking into updating clementine, I noticed it would refuse to
build with the system's taglib saying it may have a bug that corrupts
OGG files. I haven't personally encountered this bug, but I think we
should patch it anyway to be safe. It should be included in the next
release but it's unclear when this is going happen :-/

See https://github.com/taglib/taglib/issues/864 for more details. It
seems other distributions such as Archlinux also apply this fix.

Thanks!
Pierre

[0001-gnu-taglib-Include-patch-to-prevent-OGG-corruption.patch (text/x-patch, attachment)]

[Message part 5 (message/rfc822, inline)]

From: Pierre Langlois <pierre.langlois <at> gmx.com>
To: Ludovic Courtès <ludo <at> gnu.org>
Cc: Pierre Langlois <pierre.langlois <at> gmx.com>, 42890-done <at> debbugs.gnu.org,
 mail <at> brendan.scot
Subject: Re: [bug#42890] [PATCH] gnu: taglib: Include patch to prevent OGG
 corruption.
Date: Fri, 04 Sep 2020 12:14:26 +0100

[Message part 6 (text/plain, inline)]

Ludovic Courtès writes:

> Hi!
>
> Pierre Langlois <pierre.langlois <at> gmx.com> skribis:
>
>>>From 97a5d71bd50c72d2d7562a7d22baca04f4987657 Mon Sep 17 00:00:00 2001
>> From: Pierre Langlois <pierre.langlois <at> gmx.com>
>> Date: Tue, 18 Aug 2020 18:38:01 +0100
>> Subject: [PATCH] gnu: taglib: Update to 1.12-beta-1.
>>
>> This switches to a yet unreleased version of taglib, to make sure long
>> standings issues and CVEs are covered until a proper release is made upstream.
>>
>> Among these, we have:
>>
>> - CVE-2017-12678
>> - CVE-2018-11439
>> - https://github.com/taglib/taglib/issues/864
>>
>> * gnu/packges/mp3.scm (taglib): Update to 1.12-beta-1.
>> [source]: Switch to using git-fetch.
>
> It’s a good idea to add “[security fixes]” or to list CVEs in the
> subject line of the commit log.
>
> Otherwise LGTM!
>
> You can now use your new super commit powers to push it.  :-)

Whoohoo! done :-)

[signature.asc (application/pgp-signature, inline)]

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.