Re: Handling ‘file’ CVE

[Ludovic Courtès]

Eric Bavier <address@hidden> skribis:

> Mark H Weaver writes:
>
>> Finally, 'file' is a propagated-input for 'intltool', which means that
>> if anyone installs 'intltool' in their profile, they will have the buggy
>> 'file' in their PATH.
>
> The attached patch might be enough to fix this.

But ‘guix refresh -l’ says 142 packages depend on it...

> From fff25ec0451a65ccd5972d16ef96221c85084566 Mon Sep 17 00:00:00 2001
> From: Eric Bavier <address@hidden>
> Date: Thu, 13 Nov 2014 12:46:04 -0600
> Subject: [PATCH] gnu: intltool: Make file a regular input.
>
> * gnu/packages/glib.scm (intltool)[propagated-inputs]: Move file from here...
>   [inputs]: to here.
>   [arguments]: New 'patch-file-references phase.

[...]

> +    (arguments
> +     `(#:phases (alist-cons-after
> +                 'unpack 'patch-file-references
> +                 (lambda _
> +                   (substitute* "intltool-update.in"
> +                     (("`file") (string-append "`" (which "file"))))))))

Should use (string-append (assoc-ref inputs "file") "/bin/file") to work
correctly in a cross-compilation context.

Also, the last argument to ‘alist-cons-after’ is missing.

Could you push the updated patch to ‘core-updates’?  We’ll see how where
it takes us.

The main limitation here is that it takes almost a week for the MIPS
machine to rebuild everything (~2 days for Intel), and I’d like
everything to be built on the D-day.

Thanks,
Ludo’.