| Message ID | 20211216232942.31686-1-kaelyn.alexi@protonmail.com |
|---|---|
| State | Accepted |
| Headers | show |
| Series | [bug#52562] gnu: xorg-server: Update to 21.1.2. | expand |
Hi, I would like to propose this update for the 1.4.0 branch as well, as xorg-server 21.1.2 fixes four recently reported security vulnerabilities that can lead to priviledge escalation: https://lists.x.org/archives/xorg/2021-December/060842.html Cheers, Kaelyn
On Thu, Dec 16, 2021 at 11:29:50PM +0000, Kaelyn Takata via Guix-patches via wrote:
> * gnu/packages/xorg.scm (xorg-server): Update to 21.1.2.
Thanks! I am reviewing this patch now. It's not quite as simple as it
seems because we must take care to avoid changing xorg-server-for-tests,
or almost every package will have to be rebuilt.
See section 8 here for more information about how many package rebuilds are okay
for the master branch:
https://guix.gnu.org/manual/en/html_node/Submitting-Patches.html#Submitting-Patches
‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐ On Saturday, December 18th, 2021 at 12:40 PM, Leo Famulari <leo@famulari.name> wrote: > On Thu, Dec 16, 2021 at 11:29:50PM +0000, Kaelyn Takata via Guix-patches via wrote: > > > - gnu/packages/xorg.scm (xorg-server): Update to 21.1.2. > > Thanks! I am reviewing this patch now. It's not quite as simple as it > > seems because we must take care to avoid changing xorg-server-for-tests, > > or almost every package will have to be rebuilt. > > See section 8 here for more information about how many package rebuilds are okay > > for the master branch: > > https://guix.gnu.org/manual/en/html_node/Submitting-Patches.html#Submitting-Patches No worries, and take your time! I just wanted to ping the patch so that the security fixes could land before the 1.4 release. :) When I first sent it, on my machine "guix refresh --list-dependent xorg-serv" said it was 80-something packages that would be rebuilt (just checked again after typing that, and it says 82 packages would be built to ensure 137 dependet packages are rebuilt). Thanks, Kaelyn
On Sun, Dec 19, 2021 at 01:49:08AM +0000, Kaelyn wrote: > No worries, and take your time! I just wanted to ping the patch so that the security fixes could land before the 1.4 release. :) Sure, I intend to land the patch in the next day or so. > When I first sent it, on my machine "guix refresh --list-dependent xorg-serv" said it was 80-something packages that would be rebuilt (just checked again after typing that, and it says 82 packages would be built to ensure 137 dependet packages are rebuilt). Right, that's correct. But there is a also a package 'xorg-server-for-tests', which is used basically for package test suites. The idea is that it's never used "for real" and so security issues matter less. And we update that package less often. You can check on that package like this: Scheme syntax for working with "hidden" packages ----- ▼ $ guix refresh -l --expression='(@@ (gnu packages xorg) xorg-server-for-tests)' Building the following 1419 packages would ensure 3063 dependent packages are rebuilt: [...] ------
diff --git a/gnu/packages/xorg.scm b/gnu/packages/xorg.scm index 85a93dee30..204fd857c0 100644 --- a/gnu/packages/xorg.scm +++ b/gnu/packages/xorg.scm @@ -5234,7 +5234,7 @@ (define-public libxcvt (define-public xorg-server (package (name "xorg-server") - (version "21.1.1") + (version "21.1.2") (source (origin (method url-fetch) @@ -5243,7 +5243,7 @@ (define-public xorg-server "/xserver/xorg-server-" version ".tar.xz")) (sha256 (base32 - "0md7dqsc5qb30gym06c4zc2cjsdc5ps8nywk1bkcpix05kppybkq")) + "1c4dgvpv3kib8rhw37b00vc056nlb1z66c2lwzs4prz8kxmg82y2")) (patches (list ;; See: