[bug#30827] [PATCH] gnu: util-linux: Fix CVE-2018-7738.

[Ludovic Courtès]

Hello!

Leo Famulari <address@hidden> skribis:

> * gnu/packages/patches/util-linux-CVE-2018-7738.patch: New file.
> * gnu/local.mk (dist_patch_DATA): Add it.
> * gnu/packages/linux.scm (util-linux)[replacement]: New field.
> (util-linux/fixed): New variable.

[...]

> +https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7738
> +
> +Patch copied from upstream source repository:
> +
> +https://github.com/karelzak/util-linux/commit/75f03badd7ed9f1dd951863d75e756883d3acc55

I’m late to the party, but I’m wondering in this case if, instead of
grafting, we should simply add an address@hidden package, and make
sure GuixSD uses that one in %base-packages.

That way, both GuixSD and manually installed util-linux would get the
Bash completion fix.  It’s probably OK that packages that depend on
util-linux don’t get the fixed version because users don’t get bash
completion from there.

WDYT?

Thanks,
Ludo’.