On Thu, Nov 30, 2017 at 02:55:52PM +0100, Ludovic Courtès wrote: > Hi Efraim, > > Efraim Flashner <efr...@flashner.co.il> skribis: > > > It gets worse than that, our t1lib-CVE-2010-2462 is also CVE-2011-0433 > > and CVE-2011-5244.¹ > > > > I tried creating a blank patch (touch t1lib-CVE...) and adding that to > > satisfy the linter (and bookeeping) but unsuprisingly patch didn't like > > trying to apply a blank file as a patch. > > Yeah that’s no good. > > > Debian removed it after squeeze², which was Debian 6, so about 6 years > > ago. Gentoo apparently still has it³. We don't have anything that > > depends on it so I'm in favor of removing it; even the upstream homepage > > is gone. > > I don’t have an opinion. Could you poll guix-devel? > > > This doesn't deal with the possibility that patches that address > > multiple CVEs that can't be split easily and have a very long name will > > continue to occur, so the best option I can think of right now is to > > change the linter to logic like this: > > > > CVE- -> The following are all CVEs > > YYYY-ZZZZ???? -> Full CVE reference > > ZZZZ???? -> Follows the year of the previous CVE > > > > which would change t1lib-CVE-2011-1552+CVE-2011-1553+CVE-2011-1554 -> > > t1lib-CVE-2011-1552+1553+1554, > > and our under-referenced t1lib-CVE-2010-2642 -> > > t1lib-CVE-2010-2642+2011-0433+5244 > > I thought about it, but since it’s an unsual case, what about adding a > special property to packages instead? You’d write: > > (package > ;; … > (properties '((fixed-vulnerabilities "CVE-123-4567" "CVE-123-4568")))) > > ‘guix lint’ would honor this property, and that would address both cases > like this and situations where a CVE is known to no longer apply, as is > the case with unversioned CVEs¹. > > Thoughts? > > Ludo’. > > ¹ http://www.openwall.com/lists/oss-security/2017/03/15/3
I like that idea. It also allows us to mitigate a CVE without needing to specifically add a patch. I've attached my first attempt at implementing it. -- Efraim Flashner <efr...@flashner.co.il> אפרים פלשנר GPG key = A28B F40C 3E55 1372 662D 14F7 41AA E7DC CA3D 8351 Confidentiality cannot be guaranteed on emails sent or received unencrypted
From ad48d84c8659985d706cfe2f8e07314d6017611a Mon Sep 17 00:00:00 2001
From: Efraim Flashner <efr...@flashner.co.il>
Date: Thu, 30 Nov 2017 23:41:29 +0200
Subject: [PATCH 1/2] lint: 'check-vulnerabilities' also checks package
properties.
* guix/scripts/lint.scm (check-vulnerabilities): Also check for CVEs
listed as mitigated in the package properties.
---
guix/scripts/lint.scm | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/guix/scripts/lint.scm b/guix/scripts/lint.scm
index 1b43b0a63..8112595c8 100644
--- a/guix/scripts/lint.scm
+++ b/guix/scripts/lint.scm
@@ -7,6 +7,7 @@
;;; Copyright © 2016 Hartmut Goebel <h.goe...@crazy-compilers.com>
;;; Copyright © 2017 Alex Kost <alez...@gmail.com>
;;; Copyright © 2017 Tobias Geerinckx-Rice <m...@tobias.gr>
+;;; Copyright © 2017 Efraim Flashner <efr...@flashner.co.il>
;;;
;;; This file is part of GNU Guix.
;;;
@@ -881,10 +882,11 @@ the NIST server non-fatal."
(or (and=> (package-source package)
origin-patches)
'())))
+ (known-safe (assq-ref (package-properties package)
'fixed-vulnerabilities))
(unpatched (remove (lambda (vuln)
(find (cute string-contains
<> (vulnerability-id vuln))
- patches))
+ (append patches known-safe)))
vulnerabilities)))
(unless (null? unpatched)
(emit-warning package
--
2.15.0
From 3ae1af75fe7304a05ca8ac0edd8582d581108d05 Mon Sep 17 00:00:00 2001
From: Efraim Flashner <efr...@flashner.co.il>
Date: Thu, 30 Nov 2017 23:46:55 +0200
Subject: [PATCH 2/2] gnu: t1lib: Change how patched CVEs are listed.
* gnu/packages/fontutils.scm (t1lib)[source]: Change patch name.
[properties]: New field, register patched CVEs.
* gnu/packages/patches/CVE-2011-1552+CVE-2011-1553+CVE-2011-1554.patch:
Rename to CVE-2011-1552+.patch.
* gnu/local.mk (dist_patch_DATA): Change patch name.
---
gnu/local.mk | 2 +-
gnu/packages/fontutils.scm | 8 ++++++--
...E-2011-1553+CVE-2011-1554.patch => t1lib-CVE-2011-1552+.patch} | 0
3 files changed, 7 insertions(+), 3 deletions(-)
rename
gnu/packages/patches/{t1lib-CVE-2011-1552+CVE-2011-1553+CVE-2011-1554.patch =>
t1lib-CVE-2011-1552+.patch} (100%)
diff --git a/gnu/local.mk b/gnu/local.mk
index 05a86ac17..398839682 100644
--- a/gnu/local.mk
+++ b/gnu/local.mk
@@ -1079,7 +1079,7 @@ dist_patch_DATA =
\
%D%/packages/patches/synfigstudio-fix-ui-with-gtk3.patch \
%D%/packages/patches/t1lib-CVE-2010-2642.patch \
%D%/packages/patches/t1lib-CVE-2011-0764.patch \
- %D%/packages/patches/t1lib-CVE-2011-1552+CVE-2011-1553+CVE-2011-1554.patch
\
+ %D%/packages/patches/t1lib-CVE-2011-1552+.patch \
%D%/packages/patches/tar-CVE-2016-6321.patch \
%D%/packages/patches/tar-skip-unreliable-tests.patch \
%D%/packages/patches/tcl-mkindex-deterministic.patch \
diff --git a/gnu/packages/fontutils.scm b/gnu/packages/fontutils.scm
index d2306a942..2edbe31d1 100644
--- a/gnu/packages/fontutils.scm
+++ b/gnu/packages/fontutils.scm
@@ -302,9 +302,9 @@ high quality, anti-aliased and subpixel rendered text on a
display.")
(sha256 (base32
"0nbvjpnmcznib1nlgg8xckrmsw3haa154byds2h90y2g0nsjh4w2"))
(patches (search-patches
- "t1lib-CVE-2010-2642.patch"
+ "t1lib-CVE-2010-2642.patch" ; 2011-0443, 2011-5244
"t1lib-CVE-2011-0764.patch"
-
"t1lib-CVE-2011-1552+CVE-2011-1553+CVE-2011-1554.patch"))))
+ "t1lib-CVE-2011-1552+.patch")))) ; 2011-1553, 2011-1554
(build-system gnu-build-system)
(arguments
;; Making the documentation requires latex, but t1lib is also an input
@@ -323,6 +323,10 @@ describe character bitmaps. It contains the bitmap data
as well as some
metric information. But t1lib is in itself entirely independent of the
X11-system or any other graphical user interface.")
(license license:gpl2)
+ (properties `((fixed-vulnerabilities . ("CVE-2011-0433"
+ "CVE-2011-1553"
+ "CVE-2011-1554"
+ "CVE-2011-5244"))))
(home-page "http://www.t1lib.org/";)))
(define-public teckit
diff --git
a/gnu/packages/patches/t1lib-CVE-2011-1552+CVE-2011-1553+CVE-2011-1554.patch
b/gnu/packages/patches/t1lib-CVE-2011-1552+.patch
similarity index 100%
rename from
gnu/packages/patches/t1lib-CVE-2011-1552+CVE-2011-1553+CVE-2011-1554.patch
rename to gnu/packages/patches/t1lib-CVE-2011-1552+.patch
--
2.15.0
signature.asc
Description: PGP signature
