Subject: bug#73689: closed (gnu: toybox: Update to 0.8.11. [security fixes])

From: [email-masked] (GNU bug Tracking System)
Date: Fri, 11 Oct 2024 13:33:02 +0000

Your bug report

#73689: [PATCH] gnu: toybox: Update to 0.8.11. [security fixes]

which was filed against the guix-patches package, has been closed.

The explanation is attached below, along with your original report.
If you require more details, please reply to [email-masked].

-- 
73689: https://debbugs.gnu.org/cgi/bugreport.cgi?bug=73689
GNU Bug Tracking System
Contact [email-masked] with problems

Subject: gnu: toybox: Update to 0.8.11. [security fixes]
From: Sharlatan Hellseher <[email-masked]>
To: [email-masked]
Date: Fri, 11 Oct 2024 14:31:21 +0100
List-Id: <debbugs-submit.debbugs.gnu.org>

Pushed as e347386a7ff96fce644894ba2a0889d273500e11 to master.

Thanks,
Oleg

Subject: [PATCH] gnu: toybox: Update to 0.8.11. [security fixes]
From: Nicolas Graves <[email-masked]>
To: [email-masked]
Cc: Nicolas Graves <[email-masked]>
Date: Tue, 8 Oct 2024 08:19:26 +0200
List-Id: <debbugs-submit.debbugs.gnu.org>

This fixes CVE-2022-32298.

* gnu/packages/busybox.scm (toybox): Update to 0.8.11.
[arguments]<#:phases>: Adjust phase 'fix-or-skip-broken-tests.
---
 gnu/packages/busybox.scm | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/gnu/packages/busybox.scm b/gnu/packages/busybox.scm
index a8b775b944..f811a7175f 100644
--- a/gnu/packages/busybox.scm
+++ b/gnu/packages/busybox.scm
@@ -130,7 +130,7 @@ (define-public busybox
 (define-public toybox
   (package
     (name "toybox")
-    (version "0.8.7")
+    (version "0.8.11")
     (source (origin
               (method url-fetch)
               (uri (string-append
@@ -138,7 +138,7 @@ (define-public toybox
                     version ".tar.gz"))
               (sha256
                (base32
-                "150lvp7hf9ndafvmr42kb8xi86hxjd2zj4binwwhgjw2dwrvy25m"))))
+                "1p37zqxhj48klwwxl8jc2hw1x7pr2w39bfb1nx6qghaf5y1kzahm"))))
     (build-system gnu-build-system)
     (arguments
      (list #:make-flags
@@ -154,11 +154,15 @@ (define-public toybox
                  (lambda _
                    ;; Some tests expect $USER to magically be the current user.
                    (setenv "USER" (passwd:name (getpwnam (geteuid))))
+                   ;; This uses /bin/sh.
+                   (substitute* "tests/timeout.test"
+                     (("/bin/sh") (which "bash")))
                    ;; This expects directories to be exactly 4K.  They aren't!
                    (delete-file "tests/du.test")
                    ;; Delete tests that expect a root or 0 user to exist.
                    (substitute* "tests/id.test"
-                     (("^testing .*[ \\(]root.*") ""))))
+                     (("^testing .*[ \\(]root.*") ""))
+                   (delete-file "tests/tar.test")))
                (add-after 'install 'remove-usr-directory
                  (lambda* (#:key outputs #:allow-other-keys)
                    (delete-file-recursively (string-append #$output "/usr")))))
-- 
2.46.0