From c62a31ca802c2b225279c4b0360a4cfc2723ad28 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ludovic=20Court=C3=A8s?= <ludo@gnu.org>
Date: Thu, 13 Oct 2016 23:05:45 +0200
Subject: [PATCH] gnu: guile: Graft 2.0.13.

* gnu/packages/guile.scm (guile-2.0.13): New variable.
(guile-2.0)[replacement]: New field.
(guile-2.0/fixed)[properties, replacement]: New fields.
(guile-next)[replacement]: New field.
* gnu/packages/make-bootstrap.scm (%guile-static)[replacement]: New
field.
---
 gnu/packages/guile.scm          | 19 ++++++++++++++++++-
 gnu/packages/make-bootstrap.scm |  1 +
 2 files changed, 19 insertions(+), 1 deletion(-)

diff --git a/gnu/packages/guile.scm b/gnu/packages/guile.scm
index 6bb5e87a94..28a52fc70d 100644
--- a/gnu/packages/guile.scm
+++ b/gnu/packages/guile.scm
@@ -131,6 +131,7 @@ without requiring the source code to be rewritten.")
   (package
    (name "guile")
    (version "2.0.12")
+   (replacement guile-2.0.13)                 ;CVE-2016-8606 and CVE-2016-8605
    (source (origin
             (method url-fetch)
             (uri (string-append "mirror://gnu/guile/guile-" version
@@ -198,12 +199,28 @@ without requiring the source code to be rewritten.")
 (define-public guile-2.0/fixed
   ;; A package of Guile 2.0 that's rarely changed.  It is the one used
   ;; in the `base' module, and thus changing it entails a full rebuild.
-  guile-2.0)
+  (package
+    (inherit guile-2.0)
+    (properties '((hidden? . #t)))          ;people should install 'guile-2.0'
+    (replacement #f)))
+
+(define guile-2.0.13
+  (package
+    (inherit guile-2.0)
+    (version "2.0.13")
+    (source (origin
+              (method url-fetch)
+              (uri (string-append "mirror://gnu/guile/guile-" version
+                                  ".tar.xz"))
+              (sha256
+               (base32
+                "12yqkr974y91ylgw6jnmci2v90i90s7h9vxa4zk0sai8vjnz4i1p"))))))
 
 (define-public guile-next
   (package (inherit guile-2.0)
     (name "guile-next")
     (version "2.1.4")
+    (replacement #f)
     (source (origin
               (method url-fetch)
               (uri (string-append "ftp://alpha.gnu.org/gnu/guile/guile-"
diff --git a/gnu/packages/make-bootstrap.scm b/gnu/packages/make-bootstrap.scm
index 2c14e748f2..1b7352fc10 100644
--- a/gnu/packages/make-bootstrap.scm
+++ b/gnu/packages/make-bootstrap.scm
@@ -512,6 +512,7 @@ for `sh' in $PATH, and without nscd, and with static NSS modules."
                     (patches patches)))
          (guile (package (inherit guile-2.0)
                   (name (string-append (package-name guile-2.0) "-static"))
+                  (replacement #f)
                   (source source)
                   (synopsis "Statically-linked and relocatable Guile")