Merge staging-next-23.05 into staging-23.05

pkgs/by-name/ch/changelog-d/package.nix

@@ -0,0 +1,38 @@
+{
+  callPackage,
+  lib,
+  haskell,
+  haskellPackages,
+}:
+
+let
+  hsPkg = haskellPackages.changelog-d;
+
+  addCompletions = haskellPackages.generateOptparseApplicativeCompletions ["changelog-d"];
+
+  haskellModifications =
+    lib.flip lib.pipe [
+      addCompletions
+      haskell.lib.justStaticExecutables
+    ];
+
+  mkDerivationOverrides = finalAttrs: oldAttrs: {
+
+    version = oldAttrs.version + "-git-${lib.strings.substring 0 7 oldAttrs.src.rev}";
+
+    # nix-shell ./maintainers/scripts/update.nix --argstr package changelog-d
+    passthru.updateScript = lib.getExe (callPackage ./updateScript.nix { });
+
+    # nix-build -A changelog-d.tests
+    passthru.tests = {
+      basic = callPackage ./tests/basic.nix { changelog-d = finalAttrs.finalPackage; };
+    };
+
+    meta = oldAttrs.meta // {
+      homepage = "https://codeberg.org/fgaz/changelog-d";
+      maintainers = [ lib.maintainers.roberth ];
+    };
+
+  };
+in
+  (haskellModifications hsPkg).overrideAttrs mkDerivationOverrides

pkgs/by-name/ch/changelog-d/tests/basic.nix

@@ -0,0 +1,25 @@
+{ runCommand, changelog-d }:
+
+runCommand "changelog-d-basic-test" {
+  nativeBuildInputs = [ changelog-d ];
+} ''
+  mkdir changelogs
+  cat > changelogs/config <<EOF
+  organization: NixOS
+  repository: boondoggle
+  EOF
+  cat > changelogs/a <<EOF
+  synopsis: Support numbers with incrementing base-10 digits
+  issues: #1234
+  description: {
+  This didn't work before.
+  }
+  EOF
+  changelog-d changelogs >$out
+  cat -n $out
+  echo Checking the generated output
+  set -x
+  grep -F 'Support numbers with incrementing base-10 digits' $out >/dev/null
+  grep -F 'https://github.com/NixOS/boondoggle/issues/1234' $out >/dev/null
+  set +x
+''

pkgs/by-name/ch/changelog-d/updateScript.nix

@@ -0,0 +1,12 @@
+{ writeShellApplication, cabal2nix }:
+
+writeShellApplication {
+  name = "update-changelog-d";
+  runtimeInputs = [
+    cabal2nix
+  ];
+  text = ''
+    cd pkgs/development/misc/haskell/changelog-d
+    cabal2nix https://codeberg.org/fgaz/changelog-d >default.nix
+  '';
+}

pkgs/development/libraries/libtommath/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libtommath";
-  version = "1.2.0";
+  version = "1.2.1";
 
   src = fetchurl {
     url = "https://github.com/libtom/libtommath/releases/download/v${version}/ltm-${version}.tar.xz";
-    sha256 = "1c8q1qy88cjhdjlk3g24mra94h34c1ldvkjz0n2988c0yvn5xixp";
+    sha256 = "sha256-mGAl17N0J2/uLjDpnzZJ5KwNuKAiV6N+4Q6ucqvtDR8=";
   };
 
   nativeBuildInputs = [ libtool ];

pkgs/development/misc/haskell/changelog-d/changelog-d.nix

@@ -1,30 +0,0 @@
-{ mkDerivation, base, bytestring, cabal-install-parsers
-, Cabal-syntax, containers, directory, fetchgit, filepath
-, generic-lens-lite, lib, mtl, optparse-applicative, parsec, pretty
-, regex-applicative
-}:
-mkDerivation {
-  pname = "changelog-d";
-  version = "0.1";
-  src = fetchgit {
-    url = "https://codeberg.org/fgaz/changelog-d";
-    sha256 = "0r0gr3bl88am9jivic3i8lfi9l5v1dj7xx4fvw6hhy3wdx7z50z7";
-    rev = "2816ddb78cec8b7fa4462c25028437ebfe3ad314";
-    fetchSubmodules = true;
-  };
-  isLibrary = false;
-  isExecutable = true;
-  libraryHaskellDepends = [
-    base bytestring cabal-install-parsers Cabal-syntax containers
-    directory filepath generic-lens-lite mtl parsec pretty
-    regex-applicative
-  ];
-  executableHaskellDepends = [
-    base bytestring Cabal-syntax directory filepath
-    optparse-applicative
-  ];
-  doHaddock = false;
-  description = "Concatenate changelog entries into a single one";
-  license = lib.licenses.gpl3Plus;
-  mainProgram = "changelog-d";
-}

pkgs/development/misc/haskell/changelog-d/default.nix

@@ -1,51 +1,30 @@
-{ callPackage
-, lib
-, pkgs
+{ mkDerivation, base, bytestring, cabal-install-parsers
+, Cabal-syntax, containers, directory, fetchgit, filepath
+, generic-lens-lite, lib, mtl, optparse-applicative, parsec, pretty
+, regex-applicative
 }:
-
-(callPackage ./changelog-d.nix { }).overrideAttrs (finalAttrs: oldAttrs: {
-
-  version = oldAttrs.version + "-git-${lib.strings.substring 0 7 oldAttrs.src.rev}";
-
-  passthru.updateScript = lib.getExe (pkgs.writeShellApplication {
-    name = "update-changelog-d";
-    runtimeInputs = [
-      pkgs.cabal2nix
-    ];
-    text = ''
-      cd pkgs/development/misc/haskell/changelog-d
-      cabal2nix https://codeberg.org/fgaz/changelog-d >changelog-d.nix
-    '';
-  });
-  passthru.tests = {
-    basic = pkgs.runCommand "changelog-d-basic-test" {
-        nativeBuildInputs = [ finalAttrs.finalPackage ];
-      } ''
-        mkdir changelogs
-        cat > changelogs/config <<EOF
-        organization: NixOS
-        repository: boondoggle
-        EOF
-        cat > changelogs/a <<EOF
-        synopsis: Support numbers with incrementing base-10 digits
-        issues: #1234
-        description: {
-        This didn't work before.
-        }
-        EOF
-        changelog-d changelogs >$out
-        cat -n $out
-        echo Checking the generated output
-        set -x
-        grep -F 'Support numbers with incrementing base-10 digits' $out >/dev/null
-        grep -F 'https://github.com/NixOS/boondoggle/issues/1234' $out >/dev/null
-        set +x
-      '';
+mkDerivation {
+  pname = "changelog-d";
+  version = "0.1";
+  src = fetchgit {
+    url = "https://codeberg.org/fgaz/changelog-d";
+    sha256 = "0r0gr3bl88am9jivic3i8lfi9l5v1dj7xx4fvw6hhy3wdx7z50z7";
+    rev = "2816ddb78cec8b7fa4462c25028437ebfe3ad314";
+    fetchSubmodules = true;
   };
-
-  meta = oldAttrs.meta // {
-    homepage = "https://codeberg.org/fgaz/changelog-d";
-    maintainers = [ lib.maintainers.roberth ];
-  };
-
-})
+  isLibrary = false;
+  isExecutable = true;
+  libraryHaskellDepends = [
+    base bytestring cabal-install-parsers Cabal-syntax containers
+    directory filepath generic-lens-lite mtl parsec pretty
+    regex-applicative
+  ];
+  executableHaskellDepends = [
+    base bytestring Cabal-syntax directory filepath
+    optparse-applicative
+  ];
+  doHaddock = false;
+  description = "Concatenate changelog entries into a single one";
+  license = lib.licenses.gpl3Plus;
+  mainProgram = "changelog-d";
+}

pkgs/servers/roundcube/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "roundcube";
-  version = "1.6.4";
+  version = "1.6.5";
 
   src = fetchurl {
     url = "https://github.com/roundcube/roundcubemail/releases/download/${version}/roundcubemail-${version}-complete.tar.gz";
-    sha256 = "sha256-peq8fggo4CYYea7JCp1KbcAgPpiOFN4vk9bAYeZIkcg=";
+    sha256 = "sha256-Fktyy3jeidEEdB7pCQ9AJOY7+tpDlJA0hENl8/pwtf0=";
   };
 
   patches = [ ./0001-Don-t-resolve-symlinks-when-trying-to-find-INSTALL_P.patch ];

pkgs/tools/graphics/zbar/0.23.92-CVE-2023-40889.patch

@@ -0,0 +1,17 @@
+Simple bounds checks for CVE-2023-40889, based on third-party
+fix by Remi Meier @
+https://github.com/Raemi/zbar/commit/5e8acc6974f17e56c3ddaa5509870beb8d7a599c
+
+--- a/zbar/qrcode/qrdec.c
++++ b/zbar/qrcode/qrdec.c
+@@ -3900,8 +3900,8 @@ void qr_reader_match_centers(qr_reader *_reader,qr_code_data_list *_qrlist,
+     /*TODO: We might be able to accelerate this step significantly by
+        considering the remaining finder centers in a more intelligent order,
+        based on the first finder center we just chose.*/
+-    for(j=i+1;!mark[i]&&j<_ncenters;j++){
+-      for(k=j+1;!mark[j]&&k<_ncenters;k++)if(!mark[k]){
++    for(j=i+1; i < _ncenters && !mark[i]&&j<_ncenters;j++){
++      for(k=j+1; j < _ncenters && !mark[j]&&k<_ncenters;k++)if(!mark[k]){
+         qr_finder_center *c[3];
+         qr_code_data      qrdata;
+         int               version;

pkgs/tools/graphics/zbar/0.23.92-CVE-2023-40890.patch

@@ -0,0 +1,26 @@
+Simple bounds checks for CVE-2023-40890
+
+--- a/zbar/decoder/databar.c
++++ b/zbar/decoder/databar.c
+@@ -23,6 +23,8 @@
+ 
+ #include <config.h>
+ #include <zbar.h>
++#include <stdlib.h>
++#include <stdio.h>
+ 
+ #ifdef DEBUG_DATABAR
+ # define DEBUG_LEVEL (DEBUG_DATABAR)
+@@ -691,6 +693,12 @@ lookup_sequence (databar_segment_t *seg,
+             fixed = -1;
+         s <<= 1;
+         dbprintf(2, "%x", s);
++
++        if (i > 20) {
++            fprintf(stderr, "Bug: Out-of-bounds condition detected\n");
++            exit(99);
++        }
++
+         seq[i++] = s++;
+         seq[i++] = s;
+     }

pkgs/tools/graphics/zbar/default.nix

@@ -1,6 +1,7 @@
 { stdenv
 , lib
 , fetchFromGitHub
+, fetchpatch
 , imagemagickBig
 , pkg-config
 , withXorg ? true
@@ -42,6 +43,11 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-VhVrngAX7pXZp+szqv95R6RGAJojp3svdbaRKigGb0w=";
   };
 
+  patches = [
+    ./0.23.92-CVE-2023-40889.patch
+    ./0.23.92-CVE-2023-40890.patch
+  ];
+
   nativeBuildInputs = [
     pkg-config
     xmlto