01/01: gnu: binutils: Fix security issues.

[Efraim Flashner]

efraim pushed a commit to branch master
in repository guix.

commit ce27857f710ff32c05f4ba19a04a695c1cc2ce20
Author: Efraim Flashner <address@hidden>
Date:   Sun Sep 17 21:13:22 2017 +0300

    gnu: binutils: Fix security issues.
    
    * gnu/packages/base.scm (binutils)[replacement]: New field.
    (binutils/fixed): New variable.
    * gnu/packages/commencement.scm (binutils-boot0, binutils-final): Use
    'package/inherit' to correctly use replacement binutils.
---
 gnu/packages/base.scm         | 14 ++++++++++++++
 gnu/packages/commencement.scm |  5 +++--
 2 files changed, 17 insertions(+), 2 deletions(-)

diff --git a/gnu/packages/base.scm b/gnu/packages/base.scm
index 1ccff1f..972ffee 100644
--- a/gnu/packages/base.scm
+++ b/gnu/packages/base.scm
@@ -394,6 +394,7 @@ change.  GNU make offers many powerful extensions over the 
standard utility.")
 
 (define-public binutils
   (package
+   (replacement binutils/fixed)
    (name "binutils")
    (version "2.28")
    (source (origin
@@ -435,6 +436,19 @@ included.")
    (license gpl3+)
    (home-page "https://www.gnu.org/software/binutils/";)))
 
+(define binutils/fixed
+  (package
+    (inherit binutils)
+    ;; 2.28.1 is two characters longer than 2.28, so grafting fails due to
+    ;; mismatched lengths of filenames, so we have to force  it to the same 
length.
+    (version "2281")
+    (source
+      (origin (inherit (package-source binutils))
+              (uri "mirror://gnu/binutils/binutils-2.28.1.tar.bz2")
+              (sha256
+               (base32
+                "1sj234nd05cdgga1r36zalvvdkvpfbr12g5mir2n8i1dwsdrj939"))))))
+
 (define* (make-ld-wrapper name #:key
                           (target (const #f))
                           binutils
diff --git a/gnu/packages/commencement.scm b/gnu/packages/commencement.scm
index 7bbe1be..ec76778 100644
--- a/gnu/packages/commencement.scm
+++ b/gnu/packages/commencement.scm
@@ -3,6 +3,7 @@
 ;;; Copyright © 2014 Andreas Enge <address@hidden>
 ;;; Copyright © 2012 Nikita Karetnikov <address@hidden>
 ;;; Copyright © 2014, 2015, 2017 Mark H Weaver <address@hidden>
+;;; Copyright © 2017 Efraim Flashner <address@hidden>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -139,7 +140,7 @@
 
 (define binutils-boot0
   (package-with-bootstrap-guile
-   (package (inherit binutils)
+   (package/inherit binutils
      (name "binutils-cross-boot0")
      (arguments
       `(#:guile ,%bootstrap-guile
@@ -667,7 +668,7 @@ exec ~a/bin/~a-~a -B~a/lib -Wl,-dynamic-linker -Wl,~a/~a 
\"address@hidden"~%"
 
 (define binutils-final
   (package-with-bootstrap-guile
-   (package (inherit binutils)
+   (package/inherit binutils
      (arguments
       `(#:guile ,%bootstrap-guile
         #:implicit-inputs? #f