[bug#28762] [PATCH] gnu: ghostscript: Replace with 9.22 [security fixes].

[Ludovic Courtès]

Leo Famulari <address@hidden> skribis:

> Fixes CVE-2017-{7948,7975,8908,9216,9610,9611,9612,9618,9619,9620,9726,9727,
> 9739,9740,9835}.
>
> * gnu/packages/ghostscript.scm (ghostscript)[replacement]: New field.
> (ghostscript-9.22): New variables.

[...]

> +(define ghostscript-9.22
> +  (package
> +    (inherit ghostscript)
> +    (version "9.22")
> +    (source
> +      (origin
> +        (method url-fetch)
> +        (uri (string-append "https://github.com/ArtifexSoftware/";
> +                            "ghostpdl-downloads/releases/download/gs"
> +                            (string-delete #\. version)
> +                            "/ghostscript-" version ".tar.xz"))
> +        (sha256
> +         (base32
> +          "1fyi4yvdj39bjgs10klr31cda1fbx1ar7a7b7yz7v68gykk65y61"))
> +        (patches (search-patches "ghostscript-runpath.patch"
> +                                 "ghostscript-no-header-creationdate.patch"
> +                                 "ghostscript-no-header-id.patch"
> +                                 "ghostscript-no-header-uuid.patch"))
> +        (modules '((guix build utils)))
> +        (snippet
> +          ;; Remove bundled libraries. The bundled OpenJPEG is a patched 
> fork so
> +          ;; we leave it, at least for now.
> +          ;; TODO Try unbundling ijs, which is developed alongside 
> Ghostscript.
> +         '(begin
> +            (for-each delete-file-recursively '("freetype" "jbig2dec" "jpeg"
> +                                                "lcms2" "libpng"
> +                                                "tiff" "zlib"))))))))

Maybe:

  (source
    (origin
      (inherit (package-source ghostscript))
      (uri …)
      (sha256 …)
      (patches …)))

It should be slightly more concise.

Otherwise LGTM, thank you!

Ludo’.