Subject: Re: [bug#66195] [PATCH] gnu: gnutls: Replace with 3.8.1.

From: Ludovic Courtès <[email-masked]>
Date: Thu, 19 Oct 2023 22:17:41 +0200

Hi,

Christopher Baines <[email-masked]> skribis:

> The recommended way to address GNUTLS-SA-2020-07-14 / CVE-2023-0361 is to
> upgrade to 3.8.0 or later.
>
> * gnu/packages/tls.scm (gnutls-3.8.1): New variable.
> (gnutls)[replacement]: Use it.

Surprisingly, ‘guix lint -c cve gnutls’ doesn’t report anything with
3.7.7 as currently packaged.

> +(define-public gnutls-3.8.1

Maybe add a comment here with the SA and CVE references.

Then, assuming the ABIs are compatible (which can be checked with
libabigail’s abidiff), LGTM.

Thanks,
Ludo’.