aboutsummaryrefslogtreecommitdiff
path: root/etc
diff options
context:
space:
mode:
Diffstat (limited to 'etc')
-rw-r--r--etc/guix-daemon.service.in4
-rw-r--r--etc/guix-publish.service.in4
-rw-r--r--etc/news.scm71
-rwxr-xr-xetc/teams.scm4
-rw-r--r--etc/time-travel-manifest.scm24
5 files changed, 89 insertions, 18 deletions
diff --git a/etc/guix-daemon.service.in b/etc/guix-daemon.service.in
index 9dbc3b5678..5e75379b5e 100644
--- a/etc/guix-daemon.service.in
+++ b/etc/guix-daemon.service.in
@@ -9,8 +9,8 @@ Description=Build daemon for GNU Guix
ExecStart=@localstatedir@/guix/profiles/per-user/root/current-guix/bin/guix-daemon \
--build-users-group=guixbuild --discover=no
Environment='GUIX_LOCPATH=@localstatedir@/guix/profiles/per-user/root/guix-profile/lib/locale' LC_ALL=en_US.utf8
-StandardOutput=syslog
-StandardError=syslog
+StandardOutput=journal
+StandardError=journal
# Work around a nasty systemd ‘feature’ that kills the entire process tree
# (including the daemon!) if any child, such as cc1plus, runs out of memory.
diff --git a/etc/guix-publish.service.in b/etc/guix-publish.service.in
index b8fd3b4c03..0d82e73d94 100644
--- a/etc/guix-publish.service.in
+++ b/etc/guix-publish.service.in
@@ -11,8 +11,8 @@ After=guix-daemon.service
[Service]
ExecStart=@localstatedir@/guix/profiles/per-user/root/current-guix/bin/guix publish --user=nobody --port=8181
Environment='GUIX_LOCPATH=@localstatedir@/guix/profiles/per-user/root/guix-profile/lib/locale' LC_ALL=en_US.utf8
-StandardOutput=syslog
-StandardError=syslog
+StandardOutput=journal
+StandardError=journal
# Despite the name, this is rate-limited: a broken daemon will eventually fail.
Restart=always
diff --git a/etc/news.scm b/etc/news.scm
index b4e8697bf7..9443475455 100644
--- a/etc/news.scm
+++ b/etc/news.scm
@@ -1,6 +1,6 @@
;; GNU Guix news, for use by 'guix pull'.
;;
-;; Copyright © 2019-2023 Ludovic Courtès <ludo@gnu.org>
+;; Copyright © 2019-2024 Ludovic Courtès <ludo@gnu.org>
;; Copyright © 2019–2021 Tobias Geerinckx-Rice <me@tobias.gr>
;; Copyright © 2019, 2020 Miguel Ángel Arruga Vivas <rosen644835@gmail.com>
;; Copyright © 2019, 2020 Konrad Hinsen <konrad.hinsen@fastmail.net>
@@ -103,6 +103,75 @@ configuré et étendu avec des fichiers de configuration de matériel (appelés
(zh "現可使用 eudev 的硬件配置文件(@dfn{hwdb})設置及拓展
@code{udev-service-type}。")))
+ (entry (commit "ff1251de0bc327ec478fc66a562430fbf35aef42")
+ (title
+ (en "Daemon vulnerability allowing store corruption has been fixed")
+ (de "Schwachstelle im Daemon behoben, durch die der Store verfälscht werden konnte")
+ (fr "Une faille du démon permettant de corrompre le dépôt a été corrigée"))
+ (body
+ (en "A vulnerability in the build daemon, @command{guix-daemon}, was
+identified and fixed. The vulnerability would allow unprivileged users to
+corrupt the result of @dfn{fixed-output derivations} such as source code
+tarballs and Git checkouts, which in turn could lead to local privilege
+escalation.
+
+This bug is fixed and Guix System users are advised to upgrade their system,
+with a command along the lines of:
+
+@example
+sudo guix system reconfigure /run/current-system/configuration.scm
+sudo herd restart guix-daemon
+@end example
+
+If you are using Guix on another distro, run @command{info \"(guix) Upgrading
+Guix\"} or visit
+@uref{https://guix.gnu.org/manual/devel/en/html_node/Upgrading-Guix.html} to
+learn how to upgrade Guix.
+
+See @uref{https://issues.guix.gnu.org/69728} for more information on this
+issue.")
+ (de "Eine Sicherheitslücke im Erstellungs-Daemon,
+@command{guix-daemon}, wurde gefunden und geschlossen. Sie hatte es
+unprivilegierten Nutzern ermöglicht, das Ergebnis einer @dfn{Ableitung mit
+fester Ausgabe}, wie Quellcode-Tarballs und Git-Checkouts, zu manipulieren.
+So war eine lokale Rechteausweitung möglich.
+
+Der Fehler ist behoben und wir raten Nutzern von Guix System, ihr System zu
+aktualisieren mit einem Befehl wie:
+
+@example
+sudo guix system reconfigure /run/current-system/configuration.scm
+sudo herd restart guix-daemon
+@end example
+
+Wenn Sie Guix auf einer anderen Distribution verwenden, erfahren Sie mit dem
+Befehl @command{info \"(guix.de) Aktualisieren von Guix\"} oder auf
+@uref{https://guix.gnu.org/manual/devel/de/html_node/Aktualisieren-von-Guix.html},
+wie Sie Guix aktualisieren.
+
+Siehe @uref{https://issues.guix.gnu.org/69728} für mehr Informationen zu dem
+Fehler.")
+ (fr "Une faille de sécurité du démon de compilation,
+@command{guix-daemon}, a été identifiée et corrigée. La faille permettait à
+un·e utilisateur·rice sans privilège de corrompre le résultat d'une
+@dfn{dérivation à sortie fixe} telle qu'une archive ou un @i{checkout} Git, ce
+qui peut ensuite permettre une élévation locale de privilèges.
+
+Ce problème est corrigé et les utilisateur·rices de Guix System sont invité·es
+à mettre à jour leur système avec une commande telle que :
+
+@example
+sudo guix system reconfigure /run/current-system/configuration.scm
+sudo herd restart guix-daemon
+@end example
+
+Pour voir comment mettre à jour Guix sur une autre distribution, lancer
+@command{info \"(guix.fr) Mettre à niveau Guix\"} ou visiter
+@uref{https://guix.gnu.org/manual/devel/fr/html_node/Mettre-a-niveau-Guix.html}.
+
+Voir @uref{https://issues.guix.gnu.org/69728} pour plus d'informations sur
+cette anomalie.")))
+
(entry (commit "10a193596368443f441077525ebbddf787d91e4b")
(title
(en "Linux-libre 4.14 removed due to end of upstream support")
diff --git a/etc/teams.scm b/etc/teams.scm
index ac2886a6eb..570793b539 100755
--- a/etc/teams.scm
+++ b/etc/teams.scm
@@ -587,6 +587,10 @@ GLib/GIO, GTK, GStreamer and Webkit."
"andreas@enge.fr")
lxqt science tex)
+(define-member (person "Tanguy Le Carrour"
+ "tanguy@bioneland.org")
+ python home)
+
(define-member (person "Tobias Geerinckx-Rice"
"me@tobias.gr")
core kernel mentors)
diff --git a/etc/time-travel-manifest.scm b/etc/time-travel-manifest.scm
index 80c4c7c346..039ca89889 100644
--- a/etc/time-travel-manifest.scm
+++ b/etc/time-travel-manifest.scm
@@ -66,21 +66,19 @@
(define %release-commits
;; Release commits: the list of version/commit pairs.
+ ;;
+ ;; Note: To merely compute the derivation of these revisions, we need to be
+ ;; able to build their dependencies. Some of them no longer build from
+ ;; source due to time traps like <https://issues.guix.gnu.org/58650>; those
+ ;; need to be built beforehand in a virtual build machine running "in the
+ ;; past".
'(("1.4.0" . "8e2f32cee982d42a79e53fc1e9aa7b8ff0514714")
("1.3.0" . "a0178d34f582b50e9bdbb0403943129ae5b560ff")
-
- ;; FIXME: To merely compute the derivation of these revisions, we need to
- ;; be able to build their dependencies. However, pre-built binaries are
- ;; currently missing and some of these no longer build from source due to
- ;; time bombs like <https://issues.guix.gnu.org/58650>. Thus, comment
- ;; them output until we have substitutes for these old things.
-
- ;; ("1.2.0" . "a099685659b4bfa6b3218f84953cbb7ff9e88063")
- ;; ("1.1.0" . "d62c9b2671be55ae0305bebfda17b595f33797f2")
- ;; ("1.0.1" . "d68de958b60426798ed62797ff7c96c327a672ac")
- ;; ("1.0.0" . "6298c3ffd9654d3231a6f25390b056483e8f407c")
- ;; ("0.16.0" . "4a0b87f0ec5b6c2dcf82b372dd20ca7ea6acdd9c")
- ))
+ ("1.2.0" . "a099685659b4bfa6b3218f84953cbb7ff9e88063")
+ ("1.1.0" . "d62c9b2671be55ae0305bebfda17b595f33797f2")
+ ("1.0.1" . "d68de958b60426798ed62797ff7c96c327a672ac")
+ ("1.0.0" . "6298c3ffd9654d3231a6f25390b056483e8f407c")
+ ("0.16.0" . "4a0b87f0ec5b6c2dcf82b372dd20ca7ea6acdd9c")))
(manifest
(map (match-lambda