On Thursday, December 14th, 2023 at 10:21 PM, John Kehayias <john.kehay...@protonmail.com> wrote:
> > Hi Guix, > > In light of (more) CVEs in xwayland, see > https://lists.x.org/archives/xorg-announce/2023-December/003435.html, > > with already pending security updates, see > https://issues.guix.gnu.org/67136, I would like to prioritize > > getting that fixed in master. The tricky thing is that, according to > 67136, the xwayland update needs newer xorgproto, which corresponds to > many rebuilds. (The related CVEs in xorg-server have been pushed > already as effectively minor version bumps.) > > Where is the most efficient branch for this, that could take these > rebuilds to be merged to master soon (whatever soon is for a scope of > something like 22k affected packages)? > > I was thinking to put that update and mesa, since it had a new stable > release after the current one never got updates, on mesa-updates and > merge once builds are done assuming no issues. Again, the potential > sore spot is xorgproto I would say. I could see about any other > pending/urgent related changes, but I'm not aware of any off the top > of my head and want to let this move quickly. I also don't want to > jump the queue sending other branches to rebuild everything again. This doesn't seem unreasonable to me, for picking up both the new mesa release and the latest xwayland security fixes. > I'll test things locally in the meantime, but please chime in. If I > don't hear anything too urgent I'll update the mesa-updates branch to > start builds at least. I've also cc'ed some names I think will be > knowledgeable about some current branches. > > And thanks to Kaelyn (also cc'ed) for the pending xwayland patches! You're welcome! I've been working on updating my patch set to xwayland 23.2.3, but it's been taking a while to build the update because most of the dependency stack on core-updates apparently needed rebuilding locally (presumably from a lack of recent substitutes unrelated to the xorgproto-triggered rebuilds, but that's based on my computer churning away at the build for the past day or so, and not having checked guix weather yet--I even ran into an issue with coreutils-minimal failing a test when /tmp was a btrfs partition, that I got past by mounting a tmpfs on /tmp). Cheers, Kaelyn > > Thanks! > John
