gnu: pam-krb5: Update to 4.11.

* gnu/packages/admin.scm (pam-krb5): Update to 4.11.
[source]<patches>: Remove "pam-krb5-CVE-2020-10595.patch".
[arguments]: Use GEXPs.
<#:phases>: Update "disable-tests" phase.  Disable "module/long" tests.
* gnu/packages/patches/pam-krb5-CVE-2020-10595.patch: Remove.
* gnu/local.mk (dist_patch_DATA): Deregister it.

Change-Id: I7663b0281a07dbc46cd4f61c8285ca662f64213e

3 files changed, 14 insertions, 56 deletions

diff --git a/gnu/local.mk b/gnu/local.mk
index 552bb86d1ec..288f4791c8e 100644
--- a/gnu/local.mk
+++ b/gnu/local.mk
@@ -2088,7 +2088,6 @@ dist_patch_DATA =						\
   %D%/packages/patches/pnet-fix-off-by-one.patch                \
   %D%/packages/patches/pnet-newer-libgc-fix.patch               \
   %D%/packages/patches/pnet-newer-texinfo-fix.patch             \
-  %D%/packages/patches/pam-krb5-CVE-2020-10595.patch            \
   %D%/packages/patches/password-store-tree-compat.patch         \
   %D%/packages/patches/pciutils-hurd64.patch                    \
   %D%/packages/patches/pcsxr-find-harfbuzz.patch                        \
diff --git a/gnu/packages/admin.scm b/gnu/packages/admin.scm
index 8e9db5e66ea..6b0876c95cc 100644
--- a/gnu/packages/admin.scm
+++ b/gnu/packages/admin.scm
@@ -4242,7 +4242,7 @@ per-user clean-up when the user logs out.")
 (define-public pam-krb5
   (package
     (name "pam-krb5")
-    (version "4.8")
+    (version "4.11")
     (source (origin
               (method url-fetch)
               (uri
@@ -4252,22 +4252,23 @@ per-user clean-up when the user logs out.")
                       (string-append
                         "https://archives.eyrie.org/software/ARCHIVE/"
                         "pam-krb5/pam-krb5-" version ".tar.xz")))
-              (patches (search-patches "pam-krb5-CVE-2020-10595.patch"))
               (sha256
                (base32
-                "1qjp8i1s9bz7g6kiqrkzzkxn5pfspa4sy53b6z40fqmdf9przdfb"))))
+                "1a16506j35475mps9v3srh54fxcdvypw5gjlmf9vdbwrpykns998"))))
     (build-system gnu-build-system)
     (arguments
-     `(#:phases
-       (modify-phases %standard-phases
-         (add-before 'configure 'disable-tests
-           (lambda _
-             ;; The build container seems to interfere with some tests.
-             (substitute* "tests/TESTS"
-               (("module/basic\n")  ""))
-             (substitute* "tests/TESTS"
-               (("pam-util/vector\n")  ""))
-             #t)))))
+     (list
+      #:phases
+      #~(modify-phases %standard-phases
+          (add-before 'configure 'disable-tests
+            (lambda _
+              ;; The build container seems to interfere with some tests.
+              (substitute* "tests/TESTS"
+                (("module/basic +valgrind\n")  ""))
+              (substitute* "tests/TESTS"
+                (("module/long +valgrind\n")  ""))
+              (substitute* "tests/TESTS"
+                (("pam-util/vector +valgrind\n")  "")))))))
     (inputs
      (list linux-pam mit-krb5))
     (native-inputs
diff --git a/gnu/packages/patches/pam-krb5-CVE-2020-10595.patch b/gnu/packages/patches/pam-krb5-CVE-2020-10595.patch
deleted file mode 100644
index 4ca061230fa..00000000000
--- a/gnu/packages/patches/pam-krb5-CVE-2020-10595.patch
+++ /dev/null
@@ -1,42 +0,0 @@
-Fix CVE-2020-10595:
-
-https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10595
-
-Patch copied from upstream advisory:
-
-https://seclists.org/oss-sec/2020/q1/128
-
-diff --git a/prompting.c b/prompting.c
-index e985d95..d81054f 100644
---- a/prompting.c
-+++ b/prompting.c
-@@ -314,26 +314,27 @@ pamk5_prompter_krb5(krb5_context context UNUSED, void *data, const char *name,
-     /*
-      * Reuse pam_prompts as a starting index and copy the data into the reply
-      * area of the krb5_prompt structs.
-      */
-     pam_prompts = 0;
-     if (name != NULL && !args->silent)
-         pam_prompts++;
-     if (banner != NULL && !args->silent)
-         pam_prompts++;
-     for (i = 0; i < num_prompts; i++, pam_prompts++) {
--        size_t len;
-+        size_t len, allowed;
-
-         if (resp[pam_prompts].resp == NULL)
-             goto cleanup;
-         len = strlen(resp[pam_prompts].resp);
--        if (len > prompts[i].reply->length)
-+        allowed = prompts[i].reply->length;
-+        if (allowed == 0 || len > allowed - 1)
-             goto cleanup;
-
-         /*
-          * The trailing nul is not included in length, but other applications
-          * expect it to be there.  Therefore, we copy one more byte than the
-          * actual length of the password, but set length to just the length of
-          * the password.
-          */
-         memcpy(prompts[i].reply->data, resp[pam_prompts].resp, len + 1);
-         prompts[i].reply->length = (unsigned int) len;