Re: [PATCH 3/7] build: require Automake >= 1.11.6

[Stefano Lattarini]

On 08/30/2012 07:13 PM, Jim Meyering wrote:
> Stefano Lattarini wrote:
>> Now that we use AM_TESTS_ENVIRONMENT, we should require at least
>> Automake >= 1.11.2; but since all the Automake version until 1.11.5
>> are vulnerable to CVE-2012-3386:
>>
>>   <https://lists.gnu.org/archive/html/automake/2012-07/msg00023.html>
>>
>> it's even better to require 1.11.6.
>>
>> * configure.ac (AM_INIT_AUTOMAKE): Bump version requirement to 1.11.6.
>> * bootstrap.conf ($buildreq): Likewise.
> 
> Thanks.
> I'm about to push this series.
>
> The only non-grammar/typo change has been to s/6/2/ to this c-set.
> I prefer that because there is already a check in maint.mk
> for that CVE, and besides, we don't want to preclude the use of
> an automake that declares itself 1.11.2 yet that has the fix
> for that bug.
>
Makes sense.  Agreed.

> Here's the modified series.
> I'll wait for your ACK.
>
Seems good to me.

Thanks,
  Stefano