Efraim Flashner <efr...@flashner.co.il> skribis: > It turns out that hydra, the automated build server for guix, has a copy of > xz that you can download if you authorize hydra to provide substitutions. > With a copy of hydra.gnu.org.pub, the command is `sudo guix archive > --authorize hydra.gnu.org.pub`. After that, instead of building everything > locally, your computer will first check to see if hydra has already built a > package and you can just download it.
Since we must have an additional URL to fetch it. I looked for mirrors on the Web for this tarball and couldn’t find one (fossies.org doesn’t have it, for instance.) Then I wanted to upload it to ftp://alpha.gnu.org/gnu/guix/mirror, but that is rejected: file rejected: xz-5.0.4.tar.gz contains a vulnerable Makefile.in CVE-2012-3386 Regenerate it with automake 1.11.6 / 1.12.2 or newer. So we need another solution. Any suggestions? Like mirror URLs I might have missed? TIA, Ludo’.
