* gnu/packages/patches/util-linux-CVE-2018-7738.patch: New file.
* gnu/local.mk (dist_patch_DATA): Add it.
* gnu/packages/linux.scm (util-linux)[replacement]: New field.
(util-linux/fixed): New variable.
* gnu/packages/patches/shadow-CVE-2018-7169.patch: New file.
* gnu/local.mk (dist_patch_DATA): Add it.
* gnu/packages/admin.scm (shadow)[source]: Use it.
* gnu/packages/patches/java-jeromq-fix-tests.patch: New file.
* gnu/local.mk (dist_patch_DATA): Add it.
* gnu/packages/java.scm (java-jeromq)[source](patches): Add it.
[arguments](#test-exclude): Disable more failing tests.
Rename the function and move the declaration from gif_lib.h to
gif_lib_private.h to solve conflicts when some .c-file #includes
both stdlib.h and gif_lib.h.
See also https://sourceforge.net/p/giflib/bugs/110/
* gnu/packages/patches/giflib-make-reallocarray-private.patch: New
file
* gnu/local.mk (dist_patch_DATA): Register it.
* gnu/packages/image.scm(giflib)[source](patches): New field.
* gnu/packages/patches/gnome-todo-libical-compat.patch: New file.
* gnu/local.mk (dist_patch_DATA): Register it.
* gnu/packages/gnome.scm (gnome-todo)[source](patches): Use it.
* gnu/packages/php.scm (php)[inputs]: Use gd-for-php.
(gd-for-php): New private variable.
* gnu/packages/patches/gd-CVE-2018-5711.patch: New file.
* gnu/local.mk (dist_patch_DATA): Add it.
* gnu/packages/patches/glibc-allow-kernel-2.6.32.patch: New file.
* gnu/local.mk (dist_patch_DATA): Add it.
* gnu/packages/base.scm (glibc/linux)[replacement]: New field.
(glibc-2.26-patched): New variable.
* gnu/packages/patches/wavpack-CVE-2018-6767.patch: New file.
* gnu/local.mk (dist_patch_DATA): Register it.
* gnu/packages/audio.scm (wavpack)[source](patches): Add it.
* gnu/packages/patches/json-glib-fix-tests-32bit.patch: New file.
* gnu/local.mk (dist_patch_DATA): Register it.
* gnu/packages/gnome.scm (json-glib)[source](patches): New field.
* gnu/packages/patches/password-store-gnupg-compat.patch: New file.
* gnu/local.mk (dist_patch_DATA): Add it.
* gnu/packages/password-utils.scm (password-store)[source]: Use it.
This release claims to fix 2 vulnerabilities:
- ‘an integer overflow vulnerability in the TIFF decoder’
(CVE-2017-1000229, previously patched in Guix), and
- ‘a buffer overflow vulnerability in the GIF decoder’.
* gnu/packages/image.scm (optipng): Update to 0.7.7.
[source]: Remove patch.
[arguments]: Substitute INVOKE for SYSTEM* and end phase with #t.
* gnu/packages/patches/optipng-CVE-2017-1000229.patch: Delete file.
* gnu/local.mk (dist_patch_DATA): Remove it.
* gnu/packages/patches/htop-fix-process-tree.patch: New file.
* gnu/local.mk (dist_patch_DATA): Add it.
* gnu/packages/admin.scm (htop)[source]: Use it.
* gnu/packages/patches/freetype-CVE-2018-6942.patch: New file.
* gnu/local.mk (dist_patch_DATA): Register it.
* gnu/packages/fontutils.scm (freetype)[replacement]: New field.
(freetype/fixed): New variable.
Transfer the applicable NixOS patches as of 2018-01-19:
- Not adopted: We don't change the .cmake.in and .prf, but use config
mechanisms provided by th Qt build system.
- src/corelib/tools/qtimezoneprivate_tz.cpp: Adopted patch: Use $TZDIR to
search for time-zone data. Thus avoid depending on package "tzdata", which
often introduces changes with near-immediate effects, so it's important to
be able to update it fast.
- src/corelib/kernel/qcoreapplication.cpp: Not adopted: NixOS adds plugin
paths derived from PATH. We do not need this, since we already have
native-search-path QT_PLUGIN_PATH.
- src/network/kernel/qdnslookup_unix.cpp,
src/network/kernel/qhostinfo_unix.cpp: Transferred: Use hard-coded path to
libresolv.
- src/network/ssl/qsslcontext_openssl.cpp: Not adopted: NixOS changes a
conditional compilation for Qt 5.9 (but leaves it unchanged for Qt 5.10) to
fix compilation with libressl. But Qt does not support libressl anway, see
config.tests/openssl/openssl.cpp in qtbase 5.9.4.
- src/plugins/platforminputcontexts/compose/generator/qtablegenerator.cpp:
Transferred: Use hard-coded path to libx11.
- src/plugins/platforms/xcb/gl_integrations/xcb_glx/qglxintegration.cpp:
Transferred: Use hard-coded path to mess's libGL, no need for a fall-back.
- src/plugins/platforms/xcb/qxcbcursor.cpp: Transferred: Use hard-coded path
to Xcursor.
- src/plugins/platformthemes/gtk3/main.cpp: Not adopted: NixOS changes
$XDG_DATA_DIRS and $GIO_EXTRA_MODULES in the code. We already have a
search-path-specification for this.
- src/testlib/qtestassert.h: Decided not to adopt this for guix.
* gnu/packages/patches/qtbase-use-TZDIR.patch: New file.
* gnu/local.mk (dist_patch_DATA): Add it.
* gnu/packages/qt.scm (qtbase): Add comment. [source]: Use new patch.
[arguments]<#:phases>'patch-paths': New phase.
This was causing segfaults in the MH test suite when building with
glibc 2.26 on x86_64.
* gnu/packages/patches/mailutils-uninitialized-memory.patch: New file.
* gnu/local.mk (dist_patch_DATA): Add it.
* gnu/packages/mail.scm (mailutils)[source](patches, snippet): New
fields.
[native-inputs]: New field.
Marius Bakke