Changeset 80d370b

Timestamp:

04/21/2022 03:45:09 AM (2 years ago)

Author:

Thomas Trepl (Moody) <thomas@…>

Branches:

multilib

Children:

65ac2fd

Parents:

20d3801 (diff), c919b34 (diff)
Note: this is a merge changeset, the changes displayed below correspond to the merge itself.
Use the (diff) links above to see all the changes relative to each parent.

Message:

Automatic merge of trunk into multilib

Files:

• chapter03/packages.xml (modified) (2 diffs)
• packages.ent (modified) (1 diff)

chapter03/packages.xml

@@ -11 +11 @@
   <title>All Packages</title>
 
+  <note>
+    <para>Read the <ulink url='&secadv;'>security advisories</ulink>
+    before downloading packages to figure out if a newer version of any
+    package should be used to avoid security vulnerabilities.</para>
+
+    <para>The upstreams may remove old releases, especially when these
+    releases contain a security vulnerability.  If one URL below is not
+    reachable, you should read the security advisories first to figure out
+    if a newer version (with the vulnerability fixed) should be used.  If
+    not, try to download the removed package from a mirror.  Although it's
+        possible to download an old release from a mirror even if this release
+        has been removed because of a vulnerability, it's not recommended to
+        use a release known to be vulnerable for building your system.</para>
+  </note>
+
   <para>Download or otherwise obtain the following packages:</para>
 
@@ -174 +189 @@
         <para>Download: <ulink url="&expat-url;"/></para>
         <para>MD5 sum: <literal>&expat-md5;</literal></para>
-        <note>
-          <para>The upstream may remove tarballs of the specific releases of
-          <application>Expat</application> when these releases contain a
-          security vulnerability.  You should refer to
-          <ulink url='&lfs-root;lfs/advisories/'>LFS security advisories</ulink>
-          to figure out which version (with the vulnerability fixed) should
-          be used.  You may download the vulnerable version from a mirror,
-          but it's not recommended.</para>
-        </note>
       </listitem>
     </varlistentry>

packages.ent

@@ -518 +518 @@
 <!ENTITY mpfr-version "4.1.0">
 <!ENTITY mpfr-size "1,490 KB">
-<!ENTITY mpfr-url "https://www.mpfr.org/mpfr-&mpfr-version;/mpfr-&mpfr-version;.tar.xz">
+<!ENTITY mpfr-url "https://ftp.gnu.org/gnu/mpfr/mpfr-&mpfr-version;.tar.xz">
 <!ENTITY mpfr-md5 "bdd3d5efba9c17da8d83a35ec552baef">
 <!ENTITY mpfr-home "https://www.mpfr.org/">