From b6bfe9ea6a1b19159455b34f1af4ac00ef9b94ab Mon Sep 17 00:00:00 2001
From: Tobias Geerinckx-Rice <me@tobias.gr>
Date: Sun, 15 May 2022 02:00:00 +0200
Subject: gnu: guile-git: Use libgit2-1.3.

* gnu/packages/guile.scm (guile-git)[inputs]: Substitute libgit2-1.3 for libgit2.
---
 gnu/packages/guile.scm | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

(limited to 'gnu/packages/guile.scm')

diff --git a/gnu/packages/guile.scm b/gnu/packages/guile.scm
index 79680a2c29..a9e04cb476 100644
--- a/gnu/packages/guile.scm
+++ b/gnu/packages/guile.scm
@@ -10,7 +10,7 @@
 ;;; Copyright © 2017 Andy Wingo <wingo@igalia.com>
 ;;; Copyright © 2017 Marius Bakke <mbakke@fastmail.com>
 ;;; Copyright © 2017, 2019 Mathieu Othacehe <m.othacehe@gmail.com>
-;;; Copyright © 2017 Tobias Geerinckx-Rice <me@tobias.gr>
+;;; Copyright © 2017, 2022 Tobias Geerinckx-Rice <me@tobias.gr>
 ;;; Copyright © 2017, 2018 Amirouche <amirouche@hypermove.net>
 ;;; Copyright © 2018 Danny Milosavljevic <dannym@scratchpost.org>
 ;;; Copyright © 2018 Eric Bavier <bavier@member.fsf.org>
@@ -833,7 +833,9 @@ type system, elevating types to first-class status.")
     (native-inputs
      (list pkg-config autoconf automake texinfo guile-3.0 guile-bytestructures))
     (inputs
-     (list guile-3.0 libgit2))
+     ;; libgit2@1.4.3 ‘fixed’ a git CVE it never shared, breaking Guix.  Use
+     ;; 1.3 for now; see <https://issues.guix.gnu.org/55399> for alternatives.
+     (list guile-3.0 libgit2-1.3))
     (propagated-inputs
      (list guile-bytestructures))
     (synopsis "Guile bindings for libgit2")
-- 
cgit 1.4.1