Re: Needed: tooling to detect references to buggy */stable packages (was: Re: [PATCHES] ImageMagick security updates without grafting)

2021-04-05 Thread Maxime Devos
On Sun, 2021-04-04 at 16:14 -0400, Mark H Weaver wrote: > Maxime Devo wrote: > > * In some places we have the following pattern: > > > > [...] > I don't understand this. Why would it need to be made unconditional? I don't understand either anymore. > [...] > > At the present time, I'm more in

Re: Needed: tooling to detect references to buggy */stable packages (was: Re: [PATCHES] ImageMagick security updates without grafting)

2021-04-04 Thread Mark H Weaver
Hi Maxime, Maxime Devos writes: > On Sun, 2021-03-28 at 18:33 -0400, Mark H Weaver wrote: >> Earlier, I wrote: >> > One thing to be very careful about is to only use 'gtk-doc/stable', >> > 'dblatex/stable', and 'imagemagick/stable' in native-inputs, and >> > moreover to make sure that no referen

Re: [PATCHES] ImageMagick security updates without grafting

2021-03-30 Thread Mark H Weaver
Mark H Weaver writes: > Maxime Devos writes: > >> guix build $PACKAGES >> # maybe guix build $PACKAGES --no-grafts? >> guix graph --type=references $PACKAGES >> # ^ look in output for "imagemagick". > > For the record, it seems that this command gives false positives. Sorry, I was mistaken here

Re: [PATCHES] ImageMagick security updates without grafting

2021-03-29 Thread Mark H Weaver
Hi Maxime, Maxime Devos writes: > On Sun, 2021-03-28 at 17:37 -0400, Mark H Weaver wrote: >> One thing to be very careful about is to only use 'gtk-doc/stable', >> 'dblatex/stable', and 'imagemagick/stable' in native-inputs, and >> moreover to make sure that no references to these */stable packa

Re: Needed: tooling to detect references to buggy */stable packages (was: Re: [PATCHES] ImageMagick security updates without grafting)

2021-03-29 Thread Ricardo Wurmus
Mark H Weaver writes: > Earlier, I wrote: >> One thing to be very careful about is to only use 'gtk-doc/stable', >> 'dblatex/stable', and 'imagemagick/stable' in native-inputs, and >> moreover to make sure that no references to these */stable packages >> remain in any package outputs. >> >> Of

Re: Needed: tooling to detect references to buggy */stable packages (was: Re: [PATCHES] ImageMagick security updates without grafting)

2021-03-28 Thread Maxime Devos
On Sun, 2021-03-28 at 18:33 -0400, Mark H Weaver wrote: > Earlier, I wrote: > > One thing to be very careful about is to only use 'gtk-doc/stable', > > 'dblatex/stable', and 'imagemagick/stable' in native-inputs, and > > moreover to make sure that no references to these */stable packages > > remain

Needed: tooling to detect references to buggy */stable packages (was: Re: [PATCHES] ImageMagick security updates without grafting)

2021-03-28 Thread Mark H Weaver
Earlier, I wrote: > One thing to be very careful about is to only use 'gtk-doc/stable', > 'dblatex/stable', and 'imagemagick/stable' in native-inputs, and > moreover to make sure that no references to these */stable packages > remain in any package outputs. > > Of course, if any package retains ref

Re: [PATCHES] ImageMagick security updates without grafting

2021-03-28 Thread Maxime Devos
On Sun, 2021-03-28 at 17:37 -0400, Mark H Weaver wrote: > Maxime Devos writes: > > > On Sat, 2021-03-27 at 20:01 -0400, Mark H Weaver wrote: > > > [...] > > > Maxime wrote: > > > > What does ‘guix refresh --list-dependent imagemagick@6.9.11-48’ > > > > output now? > > > When I last checked, it re

Re: [PATCHES] ImageMagick security updates without grafting

2021-03-28 Thread Mark H Weaver
Maxime Devos writes: > On Sat, 2021-03-27 at 20:01 -0400, Mark H Weaver wrote: >> [...] >> Maxime wrote: >> > What does ‘guix refresh --list-dependent imagemagick@6.9.11-48’ >> > output now? > >> When I last checked, it reported on the order of 2400 dependent package >> rebuilds. > > I should hav

Re: [PATCHES] ImageMagick security updates without grafting

2021-03-28 Thread Maxime Devos
On Sat, 2021-03-27 at 20:01 -0400, Mark H Weaver wrote: > [...] > Maxime wrote: > > What does ‘guix refresh --list-dependent imagemagick@6.9.11-48’ > > output now? > When I last checked, it reported on the order of 2400 dependent package > rebuilds. I should have written imagemagick@6.9.12-4 here

Re: [PATCHES] ImageMagick security updates without grafting

2021-03-27 Thread Mark H Weaver
Hi Maxime, Maxime Devos writes: > This approach (& patches) look good to me. Thanks for looking. > What does ‘guix refresh --list-dependent imagemagick@6.9.11-48’ > output now? When I last checked, it reported on the order of 2400 dependent package rebuilds. > If it there are many dependent p

Re: [PATCHES] ImageMagick security updates without grafting

2021-03-27 Thread Maxime Devos
On Sat, 2021-03-27 at 09:09 -0400, Mark H Weaver wrote: > Hello Guix, > > Here's a proposed patch set that will henceforth enable us to freely > update ImageMagick (and dblatex, and gtk-doc) on our 'master' branch > without grafts. This is done by adding variables 'imagemagick/stable', > 'dblatex

[PATCHES] ImageMagick security updates without grafting

2021-03-27 Thread Mark H Weaver
Hello Guix, Here's a proposed patch set that will henceforth enable us to freely update ImageMagick (and dblatex, and gtk-doc) on our 'master' branch without grafts. This is done by adding variables 'imagemagick/stable', 'dblatex/stable', and 'gtk-doc/stable', which are then used as 'native-input