Hi Maxim, Maxim Cournoyer <[email protected]> writes:
> It does seem like the security aspect played a role in delaying a > quicker resolution (in the form of a revert). I haven't reviewed the > severity and exploitability of the CVE that affected libxml2, but in > general I think a working system should prevail over a secure system, so > a quick revert would have been reasonable here still, while we were > prepping the ungraft on the next branch to be merged (mesa-updates) > branch. I agree, this should have been reverted (but I think this was made difficult by the fact that several commits had been stacked). > I think we need to add more guidance for grafts in our manual also, > stressing that runtime testing is necessary because grafts failures only > become apparent at runtime, won't be detected by e.g. guix build -P1 > gnome' (because the grafts mechanism does not happen inside a build, > IIUC). We could also document when package/inherit is to be used, and > detail how to test for ABI compatibility (I believe there's a tool that > can do that). I’ve been thinking about it, and it seems there’s already quite a bit in the manual, as Giovanni noted. We could add a note about libabigail’s ‘abidiff’ under “Security Updates”, and one about ‘package/inherit’. Because that’s a lot of information, an idea that came to mind is that the security team could review changes that introduce a ‘replacement’ field for ABI issues and other issues. It seems like an easy change that would catch things like attempting to rename a .so file. Thought? Thanks, Ludo’.
