Includes fixes for CVE-2018-5104, CVE-2018-5097, CVE-2018-5099, and the
remaining 7 out of 21 changesets for CVE-2018-5089.
* gnu/packages/gnuzilla.scm (icecat)[source]: Add selected fixes from the
upstream mozilla-esr52 repository. Remove the local spectre mitigation patch
in favor of the (identical) changeset from upstream.
* gnu/packages/patches/icecat-bug-1427870-spectre-mitigation.patch: Delete.
* gnu/local.mk (dist_patch_DATA): Remove it.
* gnu/packages/patches/libsndfile-CVE-2017-12562.patch: New file.
* gnu/local.mk (dist_patch_DATA): Add it.
* gnu/packages/pulseaudio.scm (libsndfile)[replacement]: New field.
(libsndfile/fixed): New variable.
* gnu/packages/patches/rtags-separate-rct.patch: New file.
* gnu/local.mk (dist_patch_DATA): Add it.
* gnu/packages/code.scm (rtags): Dependencies no longer bundled.
[source]: Use tarball release. Use the patch to link rct.
Substitute corresponding headers.
[native-inputs]: Add new dependencies.
[inputs]: Likewise.
Signed-off-by: Ludovic Courtès <ludo@gnu.org>
* gnu/packages/patches/rct-add-missing-headers.patch: New file.
* gnu/local.mk (dist_patch_DATA): Add it.
* gnu/packages/cpp.scm (rct): Use the patch, enable RTTI.
[source]: Use the patch to add missing headers from installation.
[arguments]: Enable RTTI in configure-flags.
Signed-off-by: Ludovic Courtès <ludo@gnu.org>
* gnu/packages/patches/libexif-CVE-2016-6328.patch: New file.
* gnu/local.mk (dist_patch_DATA): Add it.
* gnu/packages/photo.scm (libexif)[source]: Use it.
* gnu/packages/parallel.scm (slurm): Update to 17.11.2.
[source]: Replace patch with less fragile SUBSTITUTE* in a snippet.
[arguments]: Rename ‘autogen’ phase to ‘autoconf’. Use INVOKE.
* gnu/packages/patches/slurm-configure-remove-nonfree-contribs.patch:
Delete file.
* gnu/local.mk (dist_patch_DATA): Remove it.
* gnu/packages/lxde.scm (lxterminal): Update to 0.3.1.
[source]: Remove patch for fixed CVE.
[arguments]: No longer skip test suite which appear to be fixed.
* gnu/packages/patches/lxterminal-CVE-2016-10369.patch: Delete file.
* gnu/local.mk (dist_patch_DATA): Remove it.
* gnu/packages/patches/opencascade-oce-glibc-2.26.patch: New file.
* gnu/local.mk (dist_patch_DATA): Add it.
* gnu/packages/maths.scm (opencascade-oce)[source]: Use it.
* gnu/packages/patches/libgnomeui-utf8.patch: New file.
* gnu/local.mk (dist_patch_DATA): Add it.
* gnu/packages/gnome.scm (libgnomeui)[source]: Use it.
* gnu/packages/patches/libxml2-CVE-2017-15412.patch: New file.
* gnu/local.mk (dist_patch_DATA): Add it.
* gnu/packages/xml.scm (libxml2/fixed)[source]: Use it.
* gnu/packages/patches/icecat-glibc-2.26.patch: New file.
* gnu/packages/gnuzilla.scm (icecat)[source](patches): Add it.
* gnu/local.mk (dist_patch_DATA): Add it.
* gnu/packages/patches/libgnome-encoding.patch: New file.
* gnu/packages/gnome.scm (libgnome)[source]: Use it.
* gnu/local.mk (dist_patch_DATA): Add it.
* gnu/packages/patches/transmission-fix-dns-rebinding-vuln.patch: New file.
* gnu/local.mk (dist_patch_DATA): Add it.
* gnu/packages/bittorrent.scm (transmission)[source]: Use it.
* gnu/packages/patches/nfs-utils-missing-headers.patch: New file.
* gnu/local.mk (dist_patch_DATA): Add it.
* gnu/packages/nfs.scm (nfs-utils)[source]: Use it.
* gnu/packages/gnuzilla.scm (icecat)[source]: Add more fixes from the
upstream mozilla-esr52 repository, plus a backported mitigation for
Spectre from Firefox 57.0.4.
* gnu/packages/patches/icecat-bug-1427870-spectre-mitigation.patch:
New file.
* gnu/local.mk (dist_patch_DATA): Add it.
* gnu/packages/patches/potrace-tests.patch: New file.
* gnu/local.mk (dist_patch_DATA): Add it.
* gnu/packages/fontutils.scm (potrace)[source]: Use it.
* gnu/packages/gcc.scm (gcc@6)[source]: Add snippet to adjust
linux-unwind.h to changes in glibc@2.26. Add patch.
* gnu/packages/patches/gcc-libsanitizer-fix.patch: New file.
* gnu/local.mk (dist_patch_DATA): Register it.
* gnu/packages/patches/ao-cad-aarch64-support.patch: New patch.
* gnu/local.mk (dist_patch_DATA): Add it.
* gnu/packages/engineering.scm (ao-cad)[source]: Use it. Update snapshot to
fb288c9. Use VCS helpers for version and file-name.
[arguments]: Add 'remove-native-compilation' phase.
This patch is modified from the original patch targeting gcc@5.
* gnu/packages/patches/gcc-asan-missing-include.patch: New file.
* gnu/packages/gcc.scm (gcc@4.8)[source](patches): Add it.
* gnu/local.mk (dist_patch_DATA): Add it.
* gnu/packages/patches/fossil-CVE-2017-17459.patch: New file.
* gnu/local.mk (dist_patch_DATA): Add it.
* gnu/packages/version-control.scm (fossil)[source]: Use it.
Fixes <https://bugs.gnu.org/29782>.
Reported by Gábor Boskovits.
* gnu/packages/patches/docbook-xsl-nonrecursive-string-subst.patch: New file.
* gnu/local.mk (dist_patch_DATA): Register it.
* gnu/packages/docbook.scm (docbook-xsl)[source](patches): Use it.
[native-inputs]: Add XZ.
[arguments]: Adjust PATH accordingly.
* gnu/packages/patches/python-pillow-fix-failing-tests.patch: New file.
* gnu/local.mk (dist_patch_DATA): Add it.
* gnu/packages/python.scm (python-pillow)[source]: Use it.
* gnu/packages/patches/libgxps-CVE-2017-11590.patch: New file.
* gnu/local.mk (dist_patch_DATA): Add it.
* gnu/packages/gnome.scm (libgxps)[source]: Use it.
This is a followup to commit 2663c38826.
* gnu/packages/xml.scm (libxslt)[replacement]: New field.
(libxslt/fixed): New variable.
* gnu/packages/patches/libxslt-CVE-2017-5029.patch: New file.
* gnu/local.mk (dist_patch_DATA): Add it.
* gnu/packages/patches/libarchive-CVE-2017-14502.patch: New file.
* gnu/local.mk (dist_patch_DATA): Add it.
* gnu/packages/backup.scm (libarchive-3.3.2)[source]: Use it.
* gnu/packages/patches/libexif-CVE-2017-7544.patch: New file.
* gnu/local.mk (dist_patch_DATA): Add it.
* gnu/packages/photo.scm (feh)[source]: Use it.
* gnu/packages/patches/links-CVE-2017-11114.patch: New file.
* gnu/local.mk (dist_patch_DATA): Add it.
* gnu/packages/web-browsers.scm (links)[source]: Use it.
Previously cross-compilation would fail:
CC xvasprintf.o
xstrtol-error.c:50:16: warning: 'struct rpl_option' declared inside parameter list
int exit_status)
^
xstrtol-error.c: In function 'xstrtol_error':
xstrtol-error.c:84:5: error: invalid use of undefined type 'struct rpl_option'
* gnu/packages/patches/diffutils-getopt.patch: New file.
* gnu/packages/base.scm (diffutils)[source]: Use it.
* gnu/local.mk (dist_patch_DATA): Add it.
See <https://github.com/borgbackup/borg/issues/3444> for more information.
* gnu/packages/patches/borg-fix-archive-corruption-bug.patch: New file.
* gnu/local.mk (dist_patch_DATA): Add it.
* gnu/packages/backup.scm (borg)[source]: Use it.
* gnu/packages/video.scm (libvdpau-va-gl): New variable.
* gnu/packages/patches/libvdpau-va-gl-unbundle.patch: New file.
* gnu/local.mk (dist_patch_DATA): Register it.
* gnu/packages/patches/eigen-arm-neon-fixes.patch: New patch.
* gnu/packages/algebra.scm (eigen): Update to 3.3.4.
[source]: Use patch. Disable svd-preallocation test for BDCSVD.
[arguments]: Set "EIGEN_SEED" environment variable in check phase.
* gnu/local.mk (dist_patch_DATA): Add patch.
* gnu/packages/patches/python-scikit-learn-fix-test-non-determinism.patch:
New file.
* gnu/packages/machine-learning.scm (python-scikit-learn)[source]: Use it.
* gnu/local.mk (dist_patch_DATA): Add it.
Gperf is now a hard dependency.
* gnu/packages/patches/fontconfig-remove-debug-printf.patch: New file.
* gnu/local.mk (dist_patch_DATA): Register it.
* gnu/packages/fontutils.scm (fontconfig): Update to 2.12.6.
[source]: Add 'fontconfig-remove-debug-printf.patch'.
[arguments]: Remove 'regenerate-fcobjshash' phase.
* gnu/packages/patches/jemalloc-arm-address-bits.patch: New patch.
* gnu/packages/jemalloc.scm (jemalloc)[source]: Use it.
* gnu/local.mk (dist_patch_DATA): Add it.
* gnu/packages/patches/picprog-non-intel-support.patch: New file.
* gnu/local.mk (dist_patch_DATA): Register it.
* gnu/packages/embedded.scm (picprog)[source]: Add patch.
[arguments]: Skip building the 'testport' binary.
* gnu/packages/patches/valgrind-glibc-compat.patch: New file.
* gnu/local.mk (dist_patch_DATA): Add it.
* gnu/packages/valgrind.scm (valgrind)[source](patches): Use it.
This is a follow-up to commit 9a187b39b7.
* gnu/packages/spice.scm (spice): Update to 0.14.0.
[source]: Remove obsolete patches. Use HTTPS URL.
[inputs]: Add orc.
[home-page]: Update to use https.
* gnu/packages/patches/spice-CVE-2016-9577.patch,
gnu/packages/patches/spice-CVE-2016-9578-1.patch,
gnu/packages/patches/spice-CVE-2016-9578-2.patch,
gnu/packages/patches/spice-CVE-2017-7506.patch: Delete files.
* gnu/local.mk (dist_patch_DATA): Remove them.
* gnu/packages/patches/bazaar-CVE-2017-14176.patch: New file.
* gnu/local.mk (dist_patch_DATA): Add it.
* gnu/packages/version-control.scm (bazaar)[source]: Use it.
* gnu/packages/patches/shepherd-close-fds.patch: New file.
* gnu/local.mk (dist_patch_DATA): Add it.
* gnu/packages/admin.scm (shepherd)[source]: Use it.
* gnu/packages/patches/glusterfs-use-PATH-instead-of-hardcodes.patch: New file.
* gnu/local.mk (dist_patch_DATA): Add it.
* gnu/packages/file-systems.scm (glusterfs)[source]: Use it.
* gnu/packages/bootloaders.scm (dtc)[patches]: Add dtc-32-bits-check.patch and
dtc-format-modifier.patch to fix build and tests on 32 bits platforms.
* gnu/packages/patches/dtc-32-bits-check.patch : New file.
* gnu/packages/patches/dtc-format-modifier.patch : New file.
* gnu/local.mk (dist_patch_DATA): Add two above patches.
* gnu/packages/mail.scm (exim): Update to 4.89.1.
[source]: Remove patches for fixed CVEs (all of them).
* gnu/packages/patches/exim-CVE-2017-16943.patch: Delete file...
* gnu/packages/patches/exim-CVE-2017-16944.patch: ...as well as this file...
* gnu/packages/patches/exim-CVE-2017-1000369.patch: ...and this file.
* gnu/local.mk (dist_patch_DATA): Remove all of them.
* gnu/packages/image.scm (optipng)[source](patches): New field.
* gnu/packages/patches/optipng-CVE-2017-1000229.patch: New file.
* gnu/local.mk (dist_patch_DATA): Register it.
* gnu/packages/node.scm (node): Update to 8.9.1.
[source]: Apply 'node-test-http2-server-rst-stream.patch'.
[arguments]: Skip 'doc-only' target in 'check', which attempts to use
npm to retrieve 'js-yaml' package. Remove test/doctool/test-make-doc.js.
Do not remove now-missing test case. Remove new test case that fails in
containers due to networking.
* gnu/packages/patches/node-test-http2-server-rst-stream.patch: New file.
Signed-off-by: Ludovic Courtès <ludo@gnu.org>
* gnu/packages/patches/guile-emacs-fix-configure.patch: New file.
* gnu/local.mk (dist_patch_DATA): Add it.
* gnu/packages/emacs.scm (guile-emacs): Use it. Add workaround for src/deps
dir creation. Fixes#29186.
* gnu/packages/patches/pcmanfm-CVE-2017-8934.patch: New file. This patch was
imported from Arch Linux.
* gnu/local.mk (dist_patch_DATA): Add it.
* gnu/packages/lxde.scm (pcmanfm)[source]: Use it.
Signed-off-by: Ludovic Courtès <ludo@gnu.org>
* gnu/packages/patches/procmail-CVE-2017-16844.patch: New file.
* gnu/local.mk (dist_patch_DATA): Add it.
* gnu/packages/mail.scm (procmail)[source]: Use it.
* gnu/packages/patches/audacity-build-with-system-portaudio.patch: New file.
* gnu/local.mk (dist_patch_DATA): Add it.
* gnu/packages/audio.scm (audacity): Update to 2.2.0.
[source]: Add patch to build with system portaudio; add snippet to remove most
bundled libraries.
[inputs]: Replace "gtk+-2" with "gtk+", replace "wxwidgets-gtk2" with
"wxwidgets"; remove "libsbsms"; add "suil" and "portmidi".
[arguments]: Adjust configure flags to avoid using bundled libraries; remove
phase "autoreconf"; add phases "fix-sbsms-check" and "use-upstream-headers".
Add fixes for CVE-2017-7830, the remaining 1/2 changesets for CVE-2017-7828,
the remaining 1/19 changesets for CVE-2017-7826, and selected other fixes.
* gnu/packages/gnuzilla.scm (icecat)[source]: Add selected fixes from the
upstream mozilla-esr52 repository.
* gnu/packages/patches/icecat-bug-1348660-pt5.patch,
gnu/packages/patches/icecat-bug-1415133.patch: New files.
* gnu/local.mk (dist_patch_DATA): Add them.
For compatibility, dependents must be updated at the same time.
* gnu/packages/web.scm (libcss): Update to 0.7.0
(nsgenbind): Update to 0.5.
(netsurf): Update to 3.7.
[arguments]: Fix binary name in .desktop. Adjust "docs" directory name.
* gnu/packages/patches/netsurf-system-utf8proc.patch: Adjust to new source.
* gnu/packages/java.scm (java-powermock-reflect): New variable.
* gnu/packages/patches/java-powermock-fix-java-files.patch: New file.
* gnu/local.mk (dist_patch_DATA): Add it.
* gnu/packages/patches/icu4c-CVE-2017-14952.patch: New file.
* gnu/local.mk (dist_patch_DATA): Add it.
* gnu/packages/icu4c.scm (icu4c)[replacement]: New field.
(icu4c-fixed): New variable.
* gnu/packages/patches/libvirt-CVE-2017-1000256.patch: New file.
* gnu/local.mk (dist_patch_DATA): Add it.
* gnu/packages/virtualization.scm (libvirt)[source]: Use it.
* gnu/packages/python.scm (python-unittest2): Update to 1.1.0.
[source]: Use PYPI-URI. Add two patches.
[arguments]: Add phase to run tests.
[propagated-inputs]: Add PYTHON-SIX and PYTHON-TRACEBACK2.
(python2-unittest2): Use 'package-with-python2'.
* gnu/packages/patches/python2-unittest2-remove-argparse.patch: Rename to ...
* gnu/packages/patches/python2-unittest2-remove-argparse.patch: ... this.
* gnu/packages/patches/python-unittest2-python3-compat.patch: New file.
* gnu/local.mk (dist_patch_DATA): Adjust accordingly.
* gnu/packages/patches/mupdf-CVE-2017-15587.patch: New file.
* gnu/local.mk (dist_patch_DATA): Add it.
* gnu/packages/pdf.scm (mupdf)[source](patches): Use it.
Fixes CVE-2017-{13078,13079,13080,13081,13082,13087,13088}.
See these announcements for more information:
https://w1.fi/security/2017-1/wpa-packet-number-reuse-with-replayed-messages.txthttps://www.krackattacks.com/
* gnu/packages/patches/wpa-supplicant-CVE-2017-13082.patch,
gnu/packages/patches/wpa-supplicant-fix-key-reuse.patch,
gnu/packages/patches/wpa-supplicant-fix-nonce-reuse.patch
gnu/packages/patches/wpa-supplicant-fix-zeroed-keys.patch,
gnu/packages/patches/wpa-supplicant-krack-followups.patch: New files.
* gnu/packages/admin.scm (wpa-supplicant-minimal)[source]: Use them.
* gnu/local.mk (dist_patch_DATA): Add them.
See <https://bugzilla.gnome.org/show_bug.cgi?id=776504> for the license change.
* gnu/packages/patches/glib-respect-datadir.patch: New file.
* gnu/local.mk (dist_patch_DATA): Register it.
* gnu/packages/glib.scm (glib): Update to 2.54.1.
[source](patches): Add 'glib-respect-datadir.patch'.
[arguments]<#:phases>: Re-enable timezone test.
[license]: Change to LGPL2.1+.