Re: Handling ‘file’ CVE

[Eric Bavier]

Ludovic Courtès writes:

> Eric Bavier <address@hidden> skribis:
>
>> Mark H Weaver writes:
>>
>>> Finally, 'file' is a propagated-input for 'intltool', which means that
>>> if anyone installs 'intltool' in their profile, they will have the buggy
>>> 'file' in their PATH.
>>
>> The attached patch might be enough to fix this.
>>
>> +    (arguments
>> +     `(#:phases (alist-cons-after
>> +                 'unpack 'patch-file-references
>> +                 (lambda _
>> +                   (substitute* "intltool-update.in"
>> +                     (("`file") (string-append "`" (which "file"))))))))
>
> Should use (string-append (assoc-ref inputs "file") "/bin/file") to work
> correctly in a cross-compilation context.

I thought that might need to be done, but couldn't think why.  Thanks
for providing the reason ;)

> Also, the last argument to ‘alist-cons-after’ is missing.

I noticed that soon after I emailed the patch. 

> Could you push the updated patch to ‘core-updates’?  We’ll see how where
> it takes us.

Will do.

> The main limitation here is that it takes almost a week for the MIPS
> machine to rebuild everything (~2 days for Intel), and I’d like
> everything to be built on the D-day.

That would be nice, yes.

-- 
Eric Bavier

Please avoid sending me Word or PowerPoint attachments.
See http://www.gnu.org/philosophy/no-word-attachments.html