Re: [PATCH] gnu: gnutls: Replace with 3.5.8 [fixes GNUTLS-SA-2017-{1, 2}].

[Ludovic Courtès]

Leo Famulari <address@hidden> skribis:

> On Tue, Jan 10, 2017 at 06:08:39PM -0500, Leo Famulari wrote:
>> On Tue, Jan 10, 2017 at 11:41:40PM +0100, Ludovic Courtès wrote:
>> > Leo Famulari <address@hidden> skribis:
>> > > The last time I noticed an exported replacement, I found that it was
>> > > resolved non-deterministically (using `guix build -S` in a loop), and
>> > > we made the replacement private:
>> > >
>> > > http://git.savannah.gnu.org/cgit/guix.git/commit/?id=69aa6e0995b55a38d5ce174602a107645be726d5
>> > 
>> > I can’t seem to reproduce it here, but it sounds like an interesting
>> > bug.  :-)
>> 
>> Me neither. IIRC, it would manifest at least 1/10 iterations of the
>> loop.
>
> I can reproduce it by applying the diff below on
> 88f2dd1ddf8123f628ee0b64406b6fd2a6a9f076 and running:
>
> $ while true; do ./pre-inst-env guix build gnutls -S; done
> guix build: warning: ambiguous package specification `gnutls'
> guix build: warning: choosing gnutls-3.5.4 from gnu/packages/tls.scm:139:2
> /gnu/store/kfjzkvlxjp98mcf356ay027vy5p5lsp3-gnutls-3.5.8.tar.xz
> guix build: warning: ambiguous package specification `gnutls'
> guix build: warning: choosing gnutls-3.5.4 from gnu/packages/tls.scm:216:2
> /gnu/store/kfjzkvlxjp98mcf356ay027vy5p5lsp3-gnutls-3.5.8.tar.xz
> guix build: warning: ambiguous package specification `gnutls'
> guix build: warning: choosing gnutls-3.5.4 from gnu/packages/tls.scm:216:2
> /gnu/store/kfjzkvlxjp98mcf356ay027vy5p5lsp3-gnutls-3.5.8.tar.xz
> guix build: warning: ambiguous package specification `gnutls'
> guix build: warning: choosing gnutls-3.5.4 from gnu/packages/tls.scm:139:2
> /gnu/store/kfjzkvlxjp98mcf356ay027vy5p5lsp3-gnutls-3.5.8.tar.xz

Oh, I see.  I can imagine that this has to do with the ordering of
package objects and first-class variables in the various hash tables and
vhashes involved.

I’d say it doesn’t matter much because we shouldn’t be providing two
packages with the exact same name and version in the first place (which
is what this patch does).

Ludo’.