From 059a21701b89919798ec75480822e6ac46800e13 Mon Sep 17 00:00:00 2001
From: David Michael <david.michael@coreos.com>
Date: Thu, 19 Oct 2017 08:42:57 -0700
Subject: [PATCH 1/2] build_library: Whitelist the binutils GLSA

---
 build_library/test_image_content.sh | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/build_library/test_image_content.sh b/build_library/test_image_content.sh
index 2189e5ec17..0e81dcfff7 100644
--- a/build_library/test_image_content.sh
+++ b/build_library/test_image_content.sh
@@ -2,10 +2,13 @@
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
-GLSA_WHITELIST="201412-09"
+GLSA_WHITELIST=(
+	201412-09 # incompatible CA certificate version numbers
+	201709-02 # updating binutils breaks amd64 Linux uncompression
+)
 
 glsa_image() {
-  if glsa-check-$BOARD -t all | grep -v "$GLSA_WHITELIST"; then
+  if glsa-check-$BOARD -t all | grep -Fvx "${GLSA_WHITELIST[@]/#/-e}"; then
     echo "The above GLSAs apply to $ROOT"
     return 1
   fi

From 20975049b3b5398ee478ba940e785bae50773d6d Mon Sep 17 00:00:00 2001
From: David Michael <david.michael@coreos.com>
Date: Thu, 19 Oct 2017 08:43:41 -0700
Subject: [PATCH 2/2] Revert "update_chroot: Avoid a portage crash while
 upgrading binutils"

The binutils update prevents Linux from uncompressing during boot,
so this is being put off until it's fixed.

This reverts commit 5e659964d0d59471880609674eb1495449d8cbec.
---
 build_library/toolchain_util.sh | 4 +---
 update_chroot                   | 3 ---
 2 files changed, 1 insertion(+), 6 deletions(-)

diff --git a/build_library/toolchain_util.sh b/build_library/toolchain_util.sh
index f046e56cea..aa44447171 100644
--- a/build_library/toolchain_util.sh
+++ b/build_library/toolchain_util.sh
@@ -194,9 +194,7 @@ get_cross_pkgs() {
 # Get portage arguments restricting toolchains to binary packages only.
 get_binonly_args() {
     local pkgs=( "${TOOLCHAIN_PKGS[@]}" $(get_cross_pkgs "$@") )
-    # XXX: Revert this binutils change after stable > 1535.
-    local tmppkgs=( ${pkgs[*]##*/binutils} )
-    echo "${tmppkgs[@]/#/--useoldpkg-atoms=}" "${pkgs[@]/#/--rebuild-exclude=}"
+    echo "${pkgs[@]/#/--useoldpkg-atoms=}" "${pkgs[@]/#/--rebuild-exclude=}"
 }
 
 ### Toolchain building utilities ###
diff --git a/update_chroot b/update_chroot
index ca145630e5..85b703d3bd 100755
--- a/update_chroot
+++ b/update_chroot
@@ -241,9 +241,6 @@ sudo -E ${EMERGE_CMD} "${EMERGE_FLAGS[@]}" \
     coreos-devel/sdk-depends world
 
 info "Removing obsolete packages"
-# XXX: Remove these binutils lines after stable > 1535.
-cats=( '<=sys-devel' "${BOARD_CHOSTS[@]/#/<=cross-}" )
-sudo -E emerge --quiet --unmerge "${cats[@]/%//binutils-2.28.0}" 2>/dev/null || :
 sudo -E ${EMERGE_CMD} --quiet --depclean @unavailable
 
 if portageq list_preserved_libs / >/dev/null; then