Subject: bug#58901: closed (Re: bug#58901: [PATCH] gnu: luajit: Update to commit 6c4826.)

From: [email-masked] (GNU bug Tracking System)
Date: Mon, 14 Nov 2022 11:24:02 +0000

Your bug report

#58901: [PATCH] gnu: luajit: Update to commit 6c4826.

which was filed against the guix-patches package, has been closed.

The explanation is attached below, along with your original report.
If you require more details, please reply to [email-masked].

-- 
58901: https://debbugs.gnu.org/cgi/bugreport.cgi?bug=58901
GNU Bug Tracking System
Contact [email-masked] with problems

Subject: Re: bug#58901: [PATCH] gnu: luajit: Update to commit 6c4826.
From: Ludovic Courtès <[email-masked]>
To: Leo Nikkilä <[email-masked]>
Cc: [email-masked]
Date: Mon, 14 Nov 2022 12:23:40 +0100
List-Id: <debbugs-submit.debbugs.gnu.org>

Hi,

Leo Nikkilä <[email-masked]> skribis:

> Greetings, attached is a patch to update luajit to commit
> 6c4826f12c4d33b8b978004bc681eb1eef2be977.
>
> My motivation for doing this was to get Neovim to build on aarch64-linux
> again, which has been failing for a while due to incompatibilities with
> the 2.1.0-beta3 release:
>
> - https://ci.guix.gnu.org/build/1558481/details
> - https://github.com/neovim/neovim/issues/15146#issuecomment-884154715
>
> The 2.1.0-beta3 release is from 2017, and now quite dated.
>
> Unfortunately there hasn't been a tagged release in a long time, and
> dependents have resorted to various commits of the 2.1.0 branch. I chose
> this particular commit from Nixpkgs:
>
> - https://github.com/NixOS/nixpkgs/blob/3fa15c357033b1c7bdb88f34c1fb9f6427b4754c/pkgs/development/interpreters/luajit/2.1.nix
>
> In addition to fixing the Neovim build, this also fixes a vulnerability
> that has been reported in the luajit 2.1.0-beta3 release and patched in
> the development tree:
>
> - https://nvd.nist.gov/vuln/detail/CVE-2020-24372
> - https://github.com/LuaJIT/LuaJIT/issues/603
>
> I was also able to remove the luajit patch for a missing ldconfig, this
> behaviour has been fixed in upstream since January 2020:
>
> - https://github.com/LuaJIT/LuaJIT/commit/18c9cf7d3788a8f7408df45df92fc4ae3bcc0d80

That makes a lot of sense.  Finally applied, thanks!

Ludo’.

Subject: [PATCH] gnu: luajit: Update to commit 6c4826.
From: Leo Nikkilä <[email-masked]>
To: [email-masked]
Date: Sun, 30 Oct 2022 21:19:53 +0200
List-Id: <debbugs-submit.debbugs.gnu.org>

Greetings, attached is a patch to update luajit to commit
6c4826f12c4d33b8b978004bc681eb1eef2be977.

My motivation for doing this was to get Neovim to build on aarch64-linux
again, which has been failing for a while due to incompatibilities with
the 2.1.0-beta3 release:

- https://ci.guix.gnu.org/build/1558481/details
- https://github.com/neovim/neovim/issues/15146#issuecomment-884154715

The 2.1.0-beta3 release is from 2017, and now quite dated.

Unfortunately there hasn't been a tagged release in a long time, and
dependents have resorted to various commits of the 2.1.0 branch. I chose
this particular commit from Nixpkgs:

- https://github.com/NixOS/nixpkgs/blob/3fa15c357033b1c7bdb88f34c1fb9f6427b4754c/pkgs/development/interpreters/luajit/2.1.nix

In addition to fixing the Neovim build, this also fixes a vulnerability
that has been reported in the luajit 2.1.0-beta3 release and patched in
the development tree:

- https://nvd.nist.gov/vuln/detail/CVE-2020-24372
- https://github.com/LuaJIT/LuaJIT/issues/603

I was also able to remove the luajit patch for a missing ldconfig, this
behaviour has been fixed in upstream since January 2020:

- https://github.com/LuaJIT/LuaJIT/commit/18c9cf7d3788a8f7408df45df92fc4ae3bcc0d80

Here's what `guix refresh' has to say about luajit:

    $ guix refresh --list-dependent luajit
    Building the following 42 packages would ensure 62 dependent packages are rebuilt: [email-masked] [email-masked] [email-masked] [email-masked] [email-masked] [email-masked] [email-masked] [email-masked] [email-masked] [email-masked] [email-masked] [email-masked] [email-masked] [email-masked] [email-masked] [email-masked] [email-masked] [email-masked] [email-masked] [email-masked] [email-masked] [email-masked] [email-masked] [email-masked] [email-masked] [email-masked] minetest-unified-inventory@2021-12-26 [email-masked] [email-masked] [email-masked] [email-masked] [email-masked] minetest-homedecor-modpack@2022-05-18 minetest-coloredwood@2021-04-14-1 minetest-technic@2022-02-06 minetest-mobs-animal@2021-11-14 [email-masked] [email-masked] [email-masked] [email-masked] [email-masked] [email-masked]

I've tested this update by successfully building the dependent packages
on x86_64-linux and aarch64-linux, except for nginx-lua-module and
obs-websocket which have been failing on CI as well due to build errors
unrelated to luajit.