[bug#74060] [PATCH] gnu: Remove allegro-5.0. [security fixes]

[Nicolas Graves]

On 2024-11-11 21:37, Maxim Cournoyer wrote:

> Hi!
>
> Nicolas Graves <ngraves@ngraves.fr> writes:
>
>> This package has no dependencies in Guix, is unsupported (see
>> https://liballeg.org/old.html) and is vulnerable to CVE-2021-36489.
>>
>> * gnu/packages/game-development.scm (allegro-5.0): Delete variable.
>> * gnu/local.mk: Deregister patch.
>> * gnu/packages/patches/allegro-mesa-18.2.5-and-later.patch: Delete file.
>
> We also have an allegro-4.0 variable; is this one not vulnerable?
> https://nvd.nist.gov/vuln/detail/CVE-2021-36489 suggest it is (up to
> 5.2.6).

If it is removable easily, we should remove it yes.  I might have
forgotten this one.

They are indeed unsupported versions, I reported that upstream in
https://github.com/liballeg/allegro5/issues/1587
which confirmed that these versions won't receive security patches.

-- 
Best regards,
Nicolas Graves