diff mbox series

[bug#33783] gnu: sqlite: Replace with 3.26.0 [security fixes].

Message ID 87mup31r6o.fsf@gmail.com
State Accepted
Headers show
Series [bug#33783] gnu: sqlite: Replace with 3.26.0 [security fixes]. | expand

Checks

Context Check Description
cbaines/applying patch fail Apply failed

Commit Message

Alex Vong Dec. 18, 2018, 2:53 a.m. UTC 
Tag: security

Hello,

This patch grafts sqlite to its latest version. It also changes all the
sqlite-* packages to use 'package/inherit' so that they get the
replacement as well. See <https://bugs.gnu.org/33751> for details.
Cheers,
Alex

Comments

Mark H Weaver Dec. 18, 2018, 10:22 p.m. UTC | #1 
I applied your proposed patch to my private branch and updated my x86_64
GuixSD system with GNOME 3, and my user profiles including IceCat.
Everything seems to work well, and I've verified that IceCat is using
the new sqlite.

Please push this to master.

     Thanks!
       Mark
Mark H Weaver Dec. 19, 2018, 1:10 a.m. UTC | #2 
Actually, there's one small problem with the patch: you should not use
'package/inherit' to define the replacement itself.  That leads to a
circular definition and an infinite series of replacements.  I guess the
grafting machinery copes with this somehow, but I'd prefer to avoid it.

I will soon push a slightly modified version of this patch.

      Mark
Alex Vong Dec. 19, 2018, 6:20 a.m. UTC | #3 
Mark H Weaver <mhw@netris.org> writes:

> Actually, there's one small problem with the patch: you should not use
> 'package/inherit' to define the replacement itself.  That leads to a
> circular definition and an infinite series of replacements.  I guess
> the
> grafting machinery copes with this somehow, but I'd prefer to avoid
> it.
>
I thought 'package/inherit' is a generalization of the previous
construct, but as you pointed out, it is not.

> I will soon push a slightly modified version of this patch.
>
OK!

>       Mark

Cheers,
Alex
Efraim Flashner Dec. 24, 2018, 9:35 a.m. UTC | #4 
Patch was pushed as 38abef124bc18d3834eb12352a974b6143f62e97
diff mbox series

Patch

From 9d0fae1e1fa2fc13bd794bb2dbeb89750c772cfb Mon Sep 17 00:00:00 2001
From: Alex Vong <alexvong1995@gmail.com>
Date: Tue, 18 Dec 2018 10:36:52 +0800
Subject: [PATCH] gnu: sqlite: Replace with 3.26.0 [security fixes].

Fixes <https://bugs.gnu.org/33751>.
Reported by Marius Bakke <mbakke@fastmail.com>.

* gnu/packages/databases.scm (sqlite-3.26.0): New public variable.
(sqlite)[replacement]: Use it.
(sqlite-with-fts5): Use 'package/inherit'.
(sqlite-with-column-metadata): Likewise.
---
 gnu/packages/databases.scm | 27 ++++++++++++++++++++++++---
 1 file changed, 24 insertions(+), 3 deletions(-)

diff --git a/gnu/packages/databases.scm b/gnu/packages/databases.scm
index 0fa6d451e..78d9a6739 100644
--- a/gnu/packages/databases.scm
+++ b/gnu/packages/databases.scm
@@ -24,7 +24,7 @@ 
 ;;; Copyright © 2017 Adriano Peluso <catonano@gmail.com>
 ;;; Copyright © 2017 Arun Isaac <arunisaac@systemreboot.net>
 ;;; Copyright © 2017, 2018 Tobias Geerinckx-Rice <me@tobias.gr>
-;;; Copyright © 2017 Alex Vong <alexvong1995@gmail.com>
+;;; Copyright © 2017, 2018 Alex Vong <alexvong1995@gmail.com>
 ;;; Copyright © 2017, 2018 Ben Woodcroft <donttrustben@gmail.com>
 ;;; Copyright © 2017 Rutger Helling <rhelling@mykolab.com>
 ;;; Copyright © 2017, 2018 Pierre Langlois <pierre.langlois@gmx.com>
@@ -1183,6 +1183,7 @@  changes.")
 (define-public sqlite
   (package
    (name "sqlite")
+   (replacement sqlite-3.26.0)
    (version "3.24.0")
    (source (origin
             (method url-fetch)
@@ -1219,9 +1220,29 @@  widely deployed SQL database engine in the world.  The source code for SQLite
 is in the public domain.")
    (license license:public-domain)))
 
+(define-public sqlite-3.26.0
+  (package/inherit sqlite
+    (version "3.26.0")
+    (source (origin
+              (method url-fetch)
+              (uri (let ((numeric-version
+                          (match (string-split version #\.)
+                            ((first-digit other-digits ...)
+                             (string-append first-digit
+                                            (string-pad-right
+                                             (string-concatenate
+                                              (map (cut string-pad <> 2 #\0)
+                                                   other-digits))
+                                             6 #\0))))))
+                     (string-append "https://sqlite.org/2018/sqlite-autoconf-"
+                                    numeric-version ".tar.gz")))
+              (sha256
+               (base32
+                "0pdzszb4sp73hl36siiv3p300jvfvbcdxi2rrmkwgs6inwznmajx"))))))
+
 ;; This is used by Tracker.
 (define-public sqlite-with-fts5
-  (package (inherit sqlite)
+  (package/inherit sqlite
     (name "sqlite-with-fts5")
     (arguments
      (substitute-keyword-arguments (package-arguments sqlite)
@@ -1230,7 +1251,7 @@  is in the public domain.")
 
 ;; This is used by Qt.
 (define-public sqlite-with-column-metadata
-  (package (inherit sqlite)
+  (package/inherit sqlite
     (name "sqlite-with-column-metadata")
     (arguments
      (substitute-keyword-arguments (package-arguments sqlite)
-- 
2.19.2