diff --git a/nixos/modules/installer/tools/nixos-enter.sh b/nixos/modules/installer/tools/nixos-enter.sh index 00883205e8b5..8854329ccab7 100644 --- a/nixos/modules/installer/tools/nixos-enter.sh +++ b/nixos/modules/installer/tools/nixos-enter.sh @@ -62,32 +62,32 @@ mount --rbind /sys "$mountPoint/sys" # modified from https://github.com/archlinux/arch-install-scripts/blob/bb04ab435a5a89cd5e5ee821783477bc80db797f/arch-chroot.in#L26-L52 chroot_add_resolv_conf() { - local chrootdir=$1 resolv_conf=$1/etc/resolv.conf + local chrootDir="$1" resolvConf="$1/etc/resolv.conf" [[ -e /etc/resolv.conf ]] || return 0 # Handle resolv.conf as a symlink to somewhere else. - if [[ -L $chrootdir/etc/resolv.conf ]]; then + if [[ -L "$resolvConf" ]]; then # readlink(1) should always give us *something* since we know at this point # it's a symlink. For simplicity, ignore the case of nested symlinks. - # We also ignore the possibility if `../`s escaping the root. - resolv_conf=$(readlink "$chrootdir/etc/resolv.conf") - if [[ $resolv_conf = /* ]]; then - resolv_conf=$chrootdir$resolv_conf + # We also ignore the possibility of `../`s escaping the root. + resolvConf="$(readlink "$resolvConf")" + if [[ "$resolvConf" = /* ]]; then + resolvConf="$chrootDir$resolvConf" else - resolv_conf=$chrootdir/etc/$resolv_conf + resolvConf="$chrootDir/etc/$resolvConf" fi fi # ensure file exists to bind mount over - if [[ ! -f $resolv_conf ]]; then - install -Dm644 /dev/null "$resolv_conf" || return 1 + if [[ ! -f "$resolvConf" ]]; then + install -Dm644 /dev/null "$resolvConf" || return 1 fi - mount --bind /etc/resolv.conf "$resolv_conf" + mount --bind /etc/resolv.conf "$resolvConf" } -chroot_add_resolv_conf "$mountPoint" || print "ERROR: failed to set up resolv.conf" +chroot_add_resolv_conf "$mountPoint" || echo "$0: failed to set up resolv.conf" >&2 ( # If silent, write both stdout and stderr of activation script to /dev/null diff --git a/pkgs/applications/graphics/hydrus/default.nix b/pkgs/applications/graphics/hydrus/default.nix index 8608344af740..44b83b68e6b9 100644 --- a/pkgs/applications/graphics/hydrus/default.nix +++ b/pkgs/applications/graphics/hydrus/default.nix @@ -10,14 +10,14 @@ python3Packages.buildPythonPackage rec { pname = "hydrus"; - version = "480"; + version = "481"; format = "other"; src = fetchFromGitHub { owner = "hydrusnetwork"; repo = "hydrus"; - rev = "v${version}"; - sha256 = "sha256-TZQY9wFXJFJtMAw2N+mlfVymewL96rn0Lza9jnDOGNA="; + rev = "refs/tags/v${version}"; + sha256 = "sha256-6I4vLJj5WzC2bCtQYnoLGOL6N6pKFU+PZQqaOqhZhWU="; }; nativeBuildInputs = [ diff --git a/pkgs/applications/virtualization/podman/default.nix b/pkgs/applications/virtualization/podman/default.nix index 235578b965c2..2f33d28e8927 100644 --- a/pkgs/applications/virtualization/podman/default.nix +++ b/pkgs/applications/virtualization/podman/default.nix @@ -13,6 +13,7 @@ , systemd , go-md2man , nixosTests +, fetchpatch }: buildGoModule rec { @@ -26,6 +27,15 @@ buildGoModule rec { sha256 = "sha256-SZHonZdUTJisFMjvUBst1HErvKWEcYZYhK++G+S4sEg="; }; + patches = [ + # Fix for capabilities bug: https://github.com/advisories/GHSA-qvf8-p83w-v58j + (fetchpatch { + name = "CVE-2022-27649.patch"; + url = "https://github.com/containers/podman/commit/aafa80918a245edcbdaceb1191d749570f1872d0.patch"; + sha256 = "sha256-d/5PGQ8yjLaE+6Sqo8p0yHe+mbrENFsbsaDXOF7cMsU="; + }) + ]; + vendorSha256 = null; doCheck = false; diff --git a/pkgs/development/libraries/libde265/default.nix b/pkgs/development/libraries/libde265/default.nix index bbbcdc3f0544..762fe1765fd2 100644 --- a/pkgs/development/libraries/libde265/default.nix +++ b/pkgs/development/libraries/libde265/default.nix @@ -1,4 +1,4 @@ -{ lib, stdenv, fetchFromGitHub, autoreconfHook, pkg-config }: +{ lib, stdenv, fetchFromGitHub, fetchpatch, autoreconfHook, pkg-config }: stdenv.mkDerivation rec { version = "1.0.8"; @@ -11,6 +11,14 @@ stdenv.mkDerivation rec { sha256 = "1dzflqbk248lz5ws0ni5acmf32b3rmnq5gsfaz7691qqjxkl1zml"; }; + patches = [ + (fetchpatch { + name = "CVE-2022-1253.patch"; + url = "https://github.com/strukturag/libde265/commit/8e89fe0e175d2870c39486fdd09250b230ec10b8.patch"; + sha256 = "sha256-F1BOWFx9oXR2trM22atyD3AJ5x6vVfURQ/PTlYP2Ibg="; + }) + ]; + nativeBuildInputs = [ autoreconfHook pkg-config ]; enableParallelBuilding = true; @@ -22,5 +30,4 @@ stdenv.mkDerivation rec { platforms = lib.platforms.unix; maintainers = with lib.maintainers; [ gebner ]; }; - } diff --git a/pkgs/os-specific/linux/microcode/intel.nix b/pkgs/os-specific/linux/microcode/intel.nix index fcc8395750f7..647b7484fc6f 100644 --- a/pkgs/os-specific/linux/microcode/intel.nix +++ b/pkgs/os-specific/linux/microcode/intel.nix @@ -2,13 +2,13 @@ stdenv.mkDerivation rec { pname = "microcode-intel"; - version = "20220419"; + version = "20220510"; src = fetchFromGitHub { owner = "intel"; repo = "Intel-Linux-Processor-Microcode-Data-Files"; rev = "microcode-${version}"; - sha256 = "sha256-i3OhOEqyK6gJfRIPewPGb4/6k6lO0atmedEqJ2e+66U="; + sha256 = "sha256-x+8qyC7YP7co/7qLhaAtjMtyeANaZJ/r41iFl1Mut+M="; }; nativeBuildInputs = [ iucode-tool libarchive ]; diff --git a/pkgs/tools/inputmethods/droidmote/default.nix b/pkgs/tools/inputmethods/droidmote/default.nix new file mode 100644 index 000000000000..24c2bcee8cdc --- /dev/null +++ b/pkgs/tools/inputmethods/droidmote/default.nix @@ -0,0 +1,61 @@ +{ lib, stdenv, fetchurl, autoPatchelfHook }: + +let + srcs = { + x86_64-linux = fetchurl { + urls = [ + "https://videomap.it/script/dms-ubuntu-x64" + "https://archive.org/download/videomap/dms-ubuntu-x64" + ]; + sha256 = "1x7pp6k27lr206a8j2pn0wf4wjb0zi28s0g1g3rb08jmr8fh1jnh"; + }; + i686-linux = fetchurl { + urls = [ + "https://videomap.it/script/dms-ubuntu-x32" + "https://archive.org/download/videomap/dms-ubuntu-x32" + ]; + sha256 = "1d62d7jz50wzk5rqqm3xab66jdzi9i1j6mwxf7r7nsgm6j5zz8r4"; + }; + aarch64-linux = fetchurl { + urls = [ + "https://videomap.it/script/dms-ubuntu-arm64" + "https://archive.org/download/videomap/dms-ubuntu-arm64" + ]; + sha256 = "1l1x7iqbxn6zsh3d37yb5x15qsxlwy3cz8g2g8vnzkgaafw9vva0"; + }; + armv7l-linux = fetchurl { + urls = [ + "https://videomap.it/script/dms-ubuntu-arm" + "https://archive.org/download/videomap/dms-ubuntu-arm" + ]; + sha256 = "1i7q9mylzvbsfydv4xf83nyqkh0nh01612jrqm93q1w6d0k2zvcd"; + }; + }; +in +stdenv.mkDerivation rec { + pname = "droidmote"; + version = "3.0.6"; + + src = srcs.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}"); + + dontUnpack = true; + dontBuild = true; + + nativeBuildInputs = [ autoPatchelfHook ]; + + installPhase = '' + runHook preInstall + + install -m755 -D $src $out/bin/droidmote + + runHook postInstall + ''; + + meta = with lib; { + description = "Control your computer from your couch"; + homepage = "https://www.videomap.it/"; + license = licenses.unfree; + maintainers = with maintainers; [ atila ]; + platforms = lib.attrNames srcs; + }; +} diff --git a/pkgs/tools/security/clamav/default.nix b/pkgs/tools/security/clamav/default.nix index 754574ef33db..8d43f454c081 100644 --- a/pkgs/tools/security/clamav/default.nix +++ b/pkgs/tools/security/clamav/default.nix @@ -5,11 +5,11 @@ stdenv.mkDerivation rec { pname = "clamav"; - version = "0.103.5"; + version = "0.103.6"; src = fetchurl { url = "https://www.clamav.net/downloads/production/${pname}-${version}.tar.gz"; - sha256 = "sha256-HnSx4dKoqQVkScMT9Ippg7nVug1vte8LK+atPIQaVCY="; + sha256 = "sha256-qqEuPcGfHTI7HFDXoQ+or1V+Q5AUnoZNWb3jm2rZujM="; }; # don't install sample config files into the absolute sysconfdir folder diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index 032c8583ca83..a61d1e431c34 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -1675,6 +1675,8 @@ with pkgs; droidcam = callPackage ../applications/video/droidcam { }; + droidmote = callPackage ../tools/inputmethods/droidmote { }; + ecdsautils = callPackage ../tools/security/ecdsautils { }; echidna = haskell.lib.compose.justStaticExecutables (haskellPackages.callPackage (../tools/security/echidna) { });