graphicsmagick: 1.3.31 -> 1.3.32, security release #64380
Merged
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Motivation for this change
Security release fixing numerous issues. See http://www.graphicsmagick.org/NEWS.html#june-15-2019 - presumably too many to assign CVEs to.
Darwin requires an extra patch, which I've included as a cut-down version of https://sourceforge.net/p/graphicsmagick/code/ci/f30492f40f78d867b43422215057dd21de4ba447 - we weren't able to find an url-addressable endpoint in sourceforge that would give us a raw
.patch
, despite the heroic efforts of @samueldr . Without this, use of pngs is liable to raise aSIGABRT
and specifically this causeddosbox
to fail to build on darwin.As far as backporting goes - though I'm usually in favour of patching, I do imagine we're going to have to go with a full version bump for 19.03 - you just have to look at the sheer number of fixes in the release notes to see it wouldn't be practical to patch.
nox-review
build failures are the same as without the bump, tested on macos 10.13 and non-nixos linux x86_64.Things done
sandbox
innix.conf
on non-NixOS)nix-shell -p nix-review --run "nix-review wip"
./result/bin/
)nix path-info -S
before and after)