Subject: bug#47144: closed (Re: bug#47144: security patching of 'patch' package)

From: [email-masked] (GNU bug Tracking System)
Date: Mon, 24 Jun 2024 05:17:04 +0000

Your bug report

#47144: security patching of 'patch' package

which was filed against the guix package, has been closed.

The explanation is attached below, along with your original report.
If you require more details, please reply to [email-masked].

-- 
47144: https://debbugs.gnu.org/cgi/bugreport.cgi?bug=47144
GNU Bug Tracking System
Contact [email-masked] with problems

Subject: Re: bug#47144: security patching of 'patch' package
From: Maxim Cournoyer <[email-masked]>
To: [email-masked]
Cc: Josselin Poiret <[email-masked]>, Tobias Geerinckx-Rice <[email-masked]>, Sharlatan Hellseher <[email-masked]>, Ekaitz Zarraga <[email-masked]>, Simon Tournier <[email-masked]>, Guillaume Le Vaillant <[email-masked]>, Mark H Weaver <[email-masked]>, Ludovic Courtès <[email-masked]>, Katherine Cox-Buday <[email-masked]>, Efraim Flashner <[email-masked]>, Leo Famulari <[email-masked]>, Ricardo Wurmus <[email-masked]>, Munyoki Kilyungi <[email-masked]>, jgart <[email-masked]>, Mathieu Othacehe <[email-masked]>, Christopher Baines <
Date: Mon, 24 Jun 2024 00:43:46 -0400
List-Id: <debbugs-submit.debbugs.gnu.org>

Hi,

Maxim Cournoyer <[email-masked]> writes:

> * gnu/packages/base.scm (patch): Rename to...
> (patch/pinned): ... this.  Hide package.
> (patch): New variable.
> * gnu/packages/commencement.scm (patch-mesboot): Inherit from patch/pinned.
> (patch-boot0): Likewise.
> (%final-inputs): Replace patch with patch/pinned.
> * gnu/packages/lisp.scm (cl-asdf): Likewise.
> * guix/packages.scm (%standard-patch-inputs): Replace patch with patch/pinned.
>
> Fixes: https://issues.guix.gnu.org/47144
> Reported-by: Mark H Weaver <[email-masked]>
> Change-Id: I54ae41b735f5ba0ebad30ebdfaabe0ccdc3f9873

Applied locally and will push shortly.

-- 
Thanks,
Maxim

Subject: security patching of 'patch' package
From: Mark H Weaver <[email-masked]>
To: [email-masked]
Cc: Léo Le Bouter <[email-masked]>
Date: Sun, 14 Mar 2021 17:37:25 -0400
List-Id: <debbugs-submit.debbugs.gnu.org>

I'm forwarding this to [email-masked] so that it won't be forgotten.

       Mark

-------------------- Start of forwarded message --------------------
Subject: security patching of 'patch' package
From: Léo Le Bouter <[email-masked]>
To: [email-masked]
Date: Wed, 10 Mar 2021 04:14:35 +0100

Hello!

I could find that the 'patch' package was vulnerable to numerous CVEs
that other distros like Debian have patched. Here's the list reported
by 'guix lint -c cve patch':

[email-masked]: probably vulnerable to CVE-2019-13636, CVE-2019-13638,
CVE-2019-20633, CVE-2018-1000156, CVE-2018-20969, CVE-2018-6951, CVE-
2018-6952

Can I use latest commit from master to build 'patch' then graft
original package?

i.e. https://git.savannah.gnu.org/git/patch.git

There's not that many commits since last release, but lots of time: 
https://git.savannah.gnu.org/cgit/patch.git/log/

Thank you,
Léo
-------------------- End of forwarded message --------------------