| Message ID | 20190125164802.17853-1-dannym@scratchpost.org |
|---|---|
| State | Accepted |
| Headers | show |
| Series | Add diffpdf. | expand |
| Context | Check | Description |
|---|---|---|
| cbaines/applying patch | success | Successfully applied |
| cbaines/applying patch | success | Successfully applied |
Danny Milosavljevic <dannym@scratchpost.org> writes: > * gnu/packages/pdf.scm (poppler-qt4)[version]: Downgrade to 0.61.1. > [source]: Apply CVE patch. > --- > gnu/packages/pdf.scm | 10 ++++++++++ > 1 file changed, 10 insertions(+) > > diff --git a/gnu/packages/pdf.scm b/gnu/packages/pdf.scm > index 96c0f9e3a..956e25c6d 100644 > --- a/gnu/packages/pdf.scm > +++ b/gnu/packages/pdf.scm > @@ -174,6 +174,16 @@ When present, Poppler is able to correctly render CJK and Cyrillic text.") > (define-public poppler-qt4 > (package/inherit poppler > (name "poppler-qt4") > + (version "0.61.1") > + (source (origin > + (method url-fetch) > + (uri (string-append "https://poppler.freedesktop.org/poppler-" > + version ".tar.xz")) > + (sha256 > + (base32 > + "1afdrxxkaivvviazxkg5blsf2x24sjkfj92ib0d3q5pm8dihjrhj")) > + (patches > + (append (search-patches "poppler-CVE-2018-19149.patch"))))) > (inputs `(("qt-4" ,qt-4) > ,@(package-inputs poppler))) > (synopsis "Qt4 frontend for the Poppler PDF rendering library"))) Could the previous higher version of the package not be built? Otherwise we’d have to deal with the downgrade somehow to make sure that installed packages get downgraded to this version as well.
Hi Ricardo, On Tue, 29 Jan 2019 18:05:22 +0100 Ricardo Wurmus <rekado@elephly.net> wrote: > Could the previous higher version of the package not be built? > Otherwise we’d have to deal with the downgrade somehow to make sure that > installed packages get downgraded to this version as well. It could technically be built, but it was missing the qt4 frontend because newer poppler versions had removed it from its source entirely. Nobody else uses poppler-qt4 in Guix - otherwise the client would have noticed that it did not work at all. I just needed a PDF differ which requires poppler-qt4, so I fixed poppler-qt4.
Danny Milosavljevic <dannym@scratchpost.org> writes: > * gnu/packages/pdf.scm (poppler-qt4)[version]: Downgrade to 0.61.1. > [source]: Apply CVE patch. > --- > gnu/packages/pdf.scm | 10 ++++++++++ > 1 file changed, 10 insertions(+) > > diff --git a/gnu/packages/pdf.scm b/gnu/packages/pdf.scm > index 96c0f9e3a..956e25c6d 100644 > --- a/gnu/packages/pdf.scm > +++ b/gnu/packages/pdf.scm > @@ -174,6 +174,16 @@ When present, Poppler is able to correctly render CJK and Cyrillic text.") > (define-public poppler-qt4 > (package/inherit poppler > (name "poppler-qt4") > + (version "0.61.1") > + (source (origin Since this adds a completely different source I think package/inherit is inappropriate, because we no longer want Poppler grafts applying here. That said, I would rather we abandoned this package, since Qt4 is unmaintained for a really long time now.
diff --git a/gnu/packages/pdf.scm b/gnu/packages/pdf.scm index 96c0f9e3a..956e25c6d 100644 --- a/gnu/packages/pdf.scm +++ b/gnu/packages/pdf.scm @@ -174,6 +174,16 @@ When present, Poppler is able to correctly render CJK and Cyrillic text.") (define-public poppler-qt4 (package/inherit poppler (name "poppler-qt4") + (version "0.61.1") + (source (origin + (method url-fetch) + (uri (string-append "https://poppler.freedesktop.org/poppler-" + version ".tar.xz")) + (sha256 + (base32 + "1afdrxxkaivvviazxkg5blsf2x24sjkfj92ib0d3q5pm8dihjrhj")) + (patches + (append (search-patches "poppler-CVE-2018-19149.patch"))))) (inputs `(("qt-4" ,qt-4) ,@(package-inputs poppler))) (synopsis "Qt4 frontend for the Poppler PDF rendering library")))