From f2edb577e51f28d774653e98dea96f09bb46bd42 Mon Sep 17 00:00:00 2001
From: Guillaume Girol <symphorien+git@xlumurb.eu>
Date: Tue, 21 Oct 2025 12:00:00 +0000
Subject: [PATCH 1/2] nixseparatedebuginfod: 0.4.0 -> 0.4.1

Fixes CVE-2025-61557

Not-cherry-picked-because: On master, I want to remove nixseparatedebuginfod and replace it with nixseparatedebuginfod2 instead. This is done in https://github.com/NixOS/nixpkgs/pull/452053
---
 pkgs/by-name/ni/nixseparatedebuginfod/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ni/nixseparatedebuginfod/package.nix b/pkgs/by-name/ni/nixseparatedebuginfod/package.nix
index 6d518ff985f4..25c566b824b5 100644
--- a/pkgs/by-name/ni/nixseparatedebuginfod/package.nix
+++ b/pkgs/by-name/ni/nixseparatedebuginfod/package.nix
@@ -12,16 +12,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "nixseparatedebuginfod";
-  version = "0.4.0";
+  version = "0.4.1";
 
   src = fetchFromGitHub {
     owner = "symphorien";
     repo = "nixseparatedebuginfod";
     rev = "v${version}";
-    hash = "sha256-sVQ6UgQvSTEIxXPxISeTI9tqAdJlxQpLxq1h4I31r6k=";
+    hash = "sha256-z20KvspXUIr6PtVozcQDkiIzYvVAWQ9PGAZJM1eqrlY=";
   };
 
-  cargoHash = "sha256-vaCmRr1hXF0BSg/dl3LYyd7c1MdPKIv6KgDgGEzqqJQ=";
+  cargoHash = "sha256-XeeVgHlnVsRlZTx1fQz+r0ajuUZ9oOcvFio+agngDL8=";
 
   # tests need a working nix install with access to the internet
   doCheck = false;

From 8b31d8f65a4a760b8e0894932a9c5bcf7746e7a4 Mon Sep 17 00:00:00 2001
From: Guillaume Girol <symphorien+git@xlumurb.eu>
Date: Tue, 21 Oct 2025 12:00:00 +0000
Subject: [PATCH 2/2] nixosTests.nixseparatedebuginfod: fix now that nix is not
 compiled with debuginfo

Not-cherry-picked-because: On master, I want to remove nixseparatedebuginfod and replace it with nixseparatedebuginfod2 instead. This is done in https://github.com/NixOS/nixpkgs/pull/452053
---
 nixos/tests/nixseparatedebuginfod.nix | 30 +++++++++++++++------------
 1 file changed, 17 insertions(+), 13 deletions(-)

diff --git a/nixos/tests/nixseparatedebuginfod.nix b/nixos/tests/nixseparatedebuginfod.nix
index bb9f8c9f43be..9e525cd59639 100644
--- a/nixos/tests/nixseparatedebuginfod.nix
+++ b/nixos/tests/nixseparatedebuginfod.nix
@@ -1,5 +1,9 @@
 import ./make-test-python.nix (
-  { pkgs, lib, ... }:
+  {
+    pkgs,
+    lib,
+    ...
+  }:
   let
     secret-key = "key-name:/COlMSRbehSh6YSruJWjL+R0JXQUKuPEn96fIb+pLokEJUjcK/2Gv8Ai96D7JGay5gDeUTx5wdpPgNvum9YtwA==";
     public-key = "key-name:BCVI3Cv9hr/AIveg+yRmsuYA3lE8ecHaT4Db7pvWLcA=";
@@ -16,8 +20,9 @@ import ./make-test-python.nix (
           openFirewall = true;
         };
         system.extraDependencies = [
-          pkgs.nix.debug
-          pkgs.nix.src
+          pkgs.gnumake.debug
+          pkgs.gnumake.src
+          pkgs.gnumake
           pkgs.sl
         ];
       };
@@ -32,11 +37,12 @@ import ./make-test-python.nix (
         trusted-public-keys = [ public-key ];
       };
       environment.systemPackages = [
+        pkgs.gnumake
         pkgs.valgrind
         pkgs.gdb
         (pkgs.writeShellScriptBin "wait_for_indexation" ''
           set -x
-          while debuginfod-find debuginfo /run/current-system/sw/bin/nix |& grep 'File too large'; do
+          while debuginfod-find debuginfo /run/current-system/sw/bin/make |& grep 'File too large'; do
             sleep 1;
           done
         '')
@@ -57,28 +63,26 @@ import ./make-test-python.nix (
 
       # nixseparatedebuginfod needs .drv to associate executable -> source
       # on regular systems this would be provided by nixos-rebuild
-      machine.succeed("nix-instantiate '<nixpkgs>' -A nix")
+      machine.succeed("nix-instantiate ${pkgs.path} -A gnumake")
 
       machine.succeed("timeout 600 wait_for_indexation")
 
       # test debuginfod-find
-      machine.succeed("debuginfod-find debuginfo /run/current-system/sw/bin/nix")
+      machine.succeed("debuginfod-find debuginfo /run/current-system/sw/bin/make")
 
       # test that gdb can fetch source
-      out = machine.succeed("gdb /run/current-system/sw/bin/nix --batch -x ${builtins.toFile "commands" ''
+      out = machine.succeed("gdb /run/current-system/sw/bin/make --batch -x ${builtins.toFile "commands" ''
         start
         l
       ''}")
       print(out)
-      assert 'int main(' in out
+      assert 'main (int argc, char **argv, char **envp)' in out
 
       # test that valgrind can display location information
-      # this relies on the fact that valgrind complains about nix
-      # libgc helps in this regard, and we also ask valgrind to show leak kinds
-      # which are usually false positives.
-      out = machine.succeed("valgrind --leak-check=full --show-leak-kinds=all nix-env --version 2>&1")
+      # we ask valgrind to show leak kinds which are usually false positives, so taht we get a source file report.
+      out = machine.succeed("valgrind --leak-check=full --show-leak-kinds=all make --version 2>&1")
       print(out)
-      assert 'main.cc' in out
+      assert 'main.c' in out
     '';
   }
 )