bug#27429: core-updates and shishi [was Re: bug#27429: Stack clash (CVE-2017-1000366 etc)]

[Leo Famulari]

On Thu, Jun 29, 2017 at 10:06:08PM +0200, Ludovic Courtès wrote:
> Leo, let me know when you feel that we should start a new evaluation.

First I want to ungraft today's libgcrypt and poppler replacements.

I also want to apply the attached patch so we can stop using
libgcrypt-1.5 with Shishi, and instead use the latest libgcrypt. This
patch does require us to re-bootstrap Shishi, but I think it's worth it
if it means we can drop the older libgcrypt package. Does anyone have
feedback on this patch?

I'll do some local testing of this change in the next few hours and then
start the evaluation.

0001-gnu-shishi-Build-with-latest-libgcrypt.patch
Description: Text document

signature.asc
Description: PGP signature