IRC channel logs

2014-10-29.log

back to list of logs

<nkar>mark_weaver, Steap_, jxself, davexunit, bavier, or anyone else: if you have time, wget needs to be updated https://community.rapid7.com/community/metasploit/blog/2014/10/28/r7-2014-15-gnu-wget-ftp-symlink-arbitrary-filesystem-access
<bavier>looks like wget 1.16 upgrade is going to be non-trivial
<davexunit>:(
<bavier>the new libpsl dependency isn't a problem, configuration falls back to the legacy cookie checks
<bavier>but the test suite fails horribly
<davexunit>package libpsl?
<bavier>looks like tests in 1.15 that were skipped are now flagged as failing
<bavier>many fail with a "Can't locate HTTP/Daemon.pm in @INC" message
<bavier>the rest print the message "Not running test: Wget under test doesn't support IDN/IRI", but fail nonetheless
<bavier>anyhow, I'd hate to make an upgrade for a CVE only to disable the testsuite
<civodul>Hey, Guix!
<davexunit>hey civodul
<civodul>alezost: what would you think of adding pretty-sha-path-mode to the repo?
<alezost>civodul: do you mean to add it as a guix package?
<civodul>alezost: no, i mean to add it in the emacs/ directory
*civodul just did a little bit of guix.el hacking :-)
<davexunit>oooh fun
<alezost>civodul: actually I don't think it is worth, but ok if you think it will be useful ther. And to just install it as other *.el files?
<alezost>civodul: what hacking?
<alezost>civodul: by "just install" I mean to list it in “emacs.am” along with others
<civodul>alezost: yes, install it along with the others, and mention it in emacs.texi
<civodul>dunno, i think it could be useful
<civodul>but it's more a matter of where you prefer to keep it
<civodul>i have it enabled globally all the time now :-)
<civodul>(the hacking i did is what i posted to the list)
<alezost>civodul: ok, as it's just a single additional file, it wouldn't make a harm. I'll send a patch for that.
<civodul>cool!
<alezost>civodul: ah, I've found your patch, but don't you see additional empty lines after output names? (I know how to fix it) Also I would make a variable for a user to choose which variant he prefers. I'll send my comments later.
<bavier>civodul: I like the patch
<civodul>cool :-)
<civodul>alezost: ah yes, i see those empty lines
<alezost>civodul: you can see "empty lines" side effect in a more fancy style in a "generation info": press "i" on any generation in *Guix Generation List*
<bavier>I've almost got wget-1.16 building
<nully>civodul:
<nully>mark_weaver:
<nully>hydra.gnu.org may have slow disks for the next 12 hours while the raid arrays under it resync.
<nully>just a heads up :D
<civodul>nully: ok, thanks for the heads-up!
<bavier>ok, wget-1.16 building and passing tests ;)
<mark_weaver>nully: okay, tahnks!
<mark_weaver>*thanks
<civodul>alezost: right
<civodul>i was unaware of 'i' in the generation list
<civodul>nice
<civodul>bavier: congrats!
<bavier>I had to package two new perl modules for wget's tests, and add some other inputs
<bavier>I'll send a patch to the list.
<alezost>civodul: yeah, I think I was the only one who knew about that :-) It's not very useful, it was just easy to add.
<alezost>civodul: Just in case: it's also possible to describe several packages/generations by marking them (with "m") before pressing RET (or "i" for a list of generations)
<civodul>ooh!
<civodul>didn't know either :-)
<civodul>with page breaks
<civodul>cool!
<alezost>civodul: page break is just a default; it may be changed with `guix-info-delimiter' var
<civodul>ah ah, everything can be changed :-)
<mark_weaver>civodul: I built the ath9k-htc firmware from source, but it required some patching.
<mark_weaver>I've been meaning to write a guix package for it, but haven't yet gotten around to it.
<mark_weaver>I cross-built it from my Yeeloong.
<mark_weaver>hmm, someone mentioned a security hole in wget here on #guix
<mark_weaver> https://community.rapid7.com/community/metasploit/blog/2014/10/28/r7-2014-15-gnu-wget-ftp-symlink-arbitrary-filesystem-access
<mark_weaver>and then bavier ran into difficulties updating it :-(
<bavier>mark_weaver: yes, but all is well now
<mark_weaver>ah, good!
*mark_weaver is still catching up
<civodul>mark_weaver: i added the ath9k-htc packate just yesterday
<civodul>*package
<civodul>then i tweaked udev-service etc. to load the firmware, but things didn't go well
<civodul>needs more investigation
<mark_weaver>I've never tried the ath9k-htc on a bare guix install, only on my Yeeloong which still uses an old hand-built udev.
<civodul>ok
<mark_weaver>hmm, I suspect that our icecat needs updating. http://www.debian.org/security/2014/dsa-3050
<mark_weaver>though I'm not sure
<mark_weaver>I don't have time to look into it today
<mark_weaver>ugh, and our wpa_supplicant: http://www.debian.org/security/2014/dsa-3052
<mark_weaver>although it sounds like the wpa bug can only be exploited if you run one of the _cli programs.
<mark_weaver>libtasn also
<mark_weaver>actually, looks like the libtasn vulnerabilities should be fixed in the version we have (4.1).
<mark_weaver>*libtasn1
<mark_weaver>I think our icecat is probably up-to-date as well. sorry for the noise
<civodul>mark_weaver: :-)
<civodul>thanks for being careful
<civodul>i think i don't have a good information flow for security vulnerabilities
<civodul>i need to adjust
<civodul>davexunit: an idea that came across: it would be neat if 'guix environment' supported --target
<civodul>because setting up a cross-compilation environment is typically something that's otherwise difficult to do
<davexunit>civodul: ooh, good idea!