diff --git a/pkgs/by-name/ch/changelog-d/package.nix b/pkgs/by-name/ch/changelog-d/package.nix new file mode 100644 index 000000000000..10d4ad1ae355 --- /dev/null +++ b/pkgs/by-name/ch/changelog-d/package.nix @@ -0,0 +1,38 @@ +{ + callPackage, + lib, + haskell, + haskellPackages, +}: + +let + hsPkg = haskellPackages.changelog-d; + + addCompletions = haskellPackages.generateOptparseApplicativeCompletions ["changelog-d"]; + + haskellModifications = + lib.flip lib.pipe [ + addCompletions + haskell.lib.justStaticExecutables + ]; + + mkDerivationOverrides = finalAttrs: oldAttrs: { + + version = oldAttrs.version + "-git-${lib.strings.substring 0 7 oldAttrs.src.rev}"; + + # nix-shell ./maintainers/scripts/update.nix --argstr package changelog-d + passthru.updateScript = lib.getExe (callPackage ./updateScript.nix { }); + + # nix-build -A changelog-d.tests + passthru.tests = { + basic = callPackage ./tests/basic.nix { changelog-d = finalAttrs.finalPackage; }; + }; + + meta = oldAttrs.meta // { + homepage = "https://codeberg.org/fgaz/changelog-d"; + maintainers = [ lib.maintainers.roberth ]; + }; + + }; +in + (haskellModifications hsPkg).overrideAttrs mkDerivationOverrides diff --git a/pkgs/by-name/ch/changelog-d/tests/basic.nix b/pkgs/by-name/ch/changelog-d/tests/basic.nix new file mode 100644 index 000000000000..25d434f0729f --- /dev/null +++ b/pkgs/by-name/ch/changelog-d/tests/basic.nix @@ -0,0 +1,25 @@ +{ runCommand, changelog-d }: + +runCommand "changelog-d-basic-test" { + nativeBuildInputs = [ changelog-d ]; +} '' + mkdir changelogs + cat > changelogs/config < changelogs/a <$out + cat -n $out + echo Checking the generated output + set -x + grep -F 'Support numbers with incrementing base-10 digits' $out >/dev/null + grep -F 'https://github.com/NixOS/boondoggle/issues/1234' $out >/dev/null + set +x +'' diff --git a/pkgs/by-name/ch/changelog-d/updateScript.nix b/pkgs/by-name/ch/changelog-d/updateScript.nix new file mode 100644 index 000000000000..fae22a161b6d --- /dev/null +++ b/pkgs/by-name/ch/changelog-d/updateScript.nix @@ -0,0 +1,12 @@ +{ writeShellApplication, cabal2nix }: + +writeShellApplication { + name = "update-changelog-d"; + runtimeInputs = [ + cabal2nix + ]; + text = '' + cd pkgs/development/misc/haskell/changelog-d + cabal2nix https://codeberg.org/fgaz/changelog-d >default.nix + ''; +} diff --git a/pkgs/development/libraries/libtommath/default.nix b/pkgs/development/libraries/libtommath/default.nix index b6e129722a23..3ec1ba7b79b3 100644 --- a/pkgs/development/libraries/libtommath/default.nix +++ b/pkgs/development/libraries/libtommath/default.nix @@ -2,11 +2,11 @@ stdenv.mkDerivation rec { pname = "libtommath"; - version = "1.2.0"; + version = "1.2.1"; src = fetchurl { url = "https://github.com/libtom/libtommath/releases/download/v${version}/ltm-${version}.tar.xz"; - sha256 = "1c8q1qy88cjhdjlk3g24mra94h34c1ldvkjz0n2988c0yvn5xixp"; + sha256 = "sha256-mGAl17N0J2/uLjDpnzZJ5KwNuKAiV6N+4Q6ucqvtDR8="; }; nativeBuildInputs = [ libtool ]; diff --git a/pkgs/development/misc/haskell/changelog-d/changelog-d.nix b/pkgs/development/misc/haskell/changelog-d/changelog-d.nix deleted file mode 100644 index 7abc707540ce..000000000000 --- a/pkgs/development/misc/haskell/changelog-d/changelog-d.nix +++ /dev/null @@ -1,30 +0,0 @@ -{ mkDerivation, base, bytestring, cabal-install-parsers -, Cabal-syntax, containers, directory, fetchgit, filepath -, generic-lens-lite, lib, mtl, optparse-applicative, parsec, pretty -, regex-applicative -}: -mkDerivation { - pname = "changelog-d"; - version = "0.1"; - src = fetchgit { - url = "https://codeberg.org/fgaz/changelog-d"; - sha256 = "0r0gr3bl88am9jivic3i8lfi9l5v1dj7xx4fvw6hhy3wdx7z50z7"; - rev = "2816ddb78cec8b7fa4462c25028437ebfe3ad314"; - fetchSubmodules = true; - }; - isLibrary = false; - isExecutable = true; - libraryHaskellDepends = [ - base bytestring cabal-install-parsers Cabal-syntax containers - directory filepath generic-lens-lite mtl parsec pretty - regex-applicative - ]; - executableHaskellDepends = [ - base bytestring Cabal-syntax directory filepath - optparse-applicative - ]; - doHaddock = false; - description = "Concatenate changelog entries into a single one"; - license = lib.licenses.gpl3Plus; - mainProgram = "changelog-d"; -} diff --git a/pkgs/development/misc/haskell/changelog-d/default.nix b/pkgs/development/misc/haskell/changelog-d/default.nix index e4ba565808cf..7abc707540ce 100644 --- a/pkgs/development/misc/haskell/changelog-d/default.nix +++ b/pkgs/development/misc/haskell/changelog-d/default.nix @@ -1,51 +1,30 @@ -{ callPackage -, lib -, pkgs +{ mkDerivation, base, bytestring, cabal-install-parsers +, Cabal-syntax, containers, directory, fetchgit, filepath +, generic-lens-lite, lib, mtl, optparse-applicative, parsec, pretty +, regex-applicative }: - -(callPackage ./changelog-d.nix { }).overrideAttrs (finalAttrs: oldAttrs: { - - version = oldAttrs.version + "-git-${lib.strings.substring 0 7 oldAttrs.src.rev}"; - - passthru.updateScript = lib.getExe (pkgs.writeShellApplication { - name = "update-changelog-d"; - runtimeInputs = [ - pkgs.cabal2nix - ]; - text = '' - cd pkgs/development/misc/haskell/changelog-d - cabal2nix https://codeberg.org/fgaz/changelog-d >changelog-d.nix - ''; - }); - passthru.tests = { - basic = pkgs.runCommand "changelog-d-basic-test" { - nativeBuildInputs = [ finalAttrs.finalPackage ]; - } '' - mkdir changelogs - cat > changelogs/config < changelogs/a <$out - cat -n $out - echo Checking the generated output - set -x - grep -F 'Support numbers with incrementing base-10 digits' $out >/dev/null - grep -F 'https://github.com/NixOS/boondoggle/issues/1234' $out >/dev/null - set +x - ''; +mkDerivation { + pname = "changelog-d"; + version = "0.1"; + src = fetchgit { + url = "https://codeberg.org/fgaz/changelog-d"; + sha256 = "0r0gr3bl88am9jivic3i8lfi9l5v1dj7xx4fvw6hhy3wdx7z50z7"; + rev = "2816ddb78cec8b7fa4462c25028437ebfe3ad314"; + fetchSubmodules = true; }; - - meta = oldAttrs.meta // { - homepage = "https://codeberg.org/fgaz/changelog-d"; - maintainers = [ lib.maintainers.roberth ]; - }; - -}) + isLibrary = false; + isExecutable = true; + libraryHaskellDepends = [ + base bytestring cabal-install-parsers Cabal-syntax containers + directory filepath generic-lens-lite mtl parsec pretty + regex-applicative + ]; + executableHaskellDepends = [ + base bytestring Cabal-syntax directory filepath + optparse-applicative + ]; + doHaddock = false; + description = "Concatenate changelog entries into a single one"; + license = lib.licenses.gpl3Plus; + mainProgram = "changelog-d"; +} diff --git a/pkgs/servers/roundcube/default.nix b/pkgs/servers/roundcube/default.nix index a7e71c722fb5..959c9bf4633e 100644 --- a/pkgs/servers/roundcube/default.nix +++ b/pkgs/servers/roundcube/default.nix @@ -2,11 +2,11 @@ stdenv.mkDerivation rec { pname = "roundcube"; - version = "1.6.4"; + version = "1.6.5"; src = fetchurl { url = "https://github.com/roundcube/roundcubemail/releases/download/${version}/roundcubemail-${version}-complete.tar.gz"; - sha256 = "sha256-peq8fggo4CYYea7JCp1KbcAgPpiOFN4vk9bAYeZIkcg="; + sha256 = "sha256-Fktyy3jeidEEdB7pCQ9AJOY7+tpDlJA0hENl8/pwtf0="; }; patches = [ ./0001-Don-t-resolve-symlinks-when-trying-to-find-INSTALL_P.patch ]; diff --git a/pkgs/tools/graphics/zbar/0.23.92-CVE-2023-40889.patch b/pkgs/tools/graphics/zbar/0.23.92-CVE-2023-40889.patch new file mode 100644 index 000000000000..7b7ca5a0befa --- /dev/null +++ b/pkgs/tools/graphics/zbar/0.23.92-CVE-2023-40889.patch @@ -0,0 +1,17 @@ +Simple bounds checks for CVE-2023-40889, based on third-party +fix by Remi Meier @ +https://github.com/Raemi/zbar/commit/5e8acc6974f17e56c3ddaa5509870beb8d7a599c + +--- a/zbar/qrcode/qrdec.c ++++ b/zbar/qrcode/qrdec.c +@@ -3900,8 +3900,8 @@ void qr_reader_match_centers(qr_reader *_reader,qr_code_data_list *_qrlist, + /*TODO: We might be able to accelerate this step significantly by + considering the remaining finder centers in a more intelligent order, + based on the first finder center we just chose.*/ +- for(j=i+1;!mark[i]&&j<_ncenters;j++){ +- for(k=j+1;!mark[j]&&k<_ncenters;k++)if(!mark[k]){ ++ for(j=i+1; i < _ncenters && !mark[i]&&j<_ncenters;j++){ ++ for(k=j+1; j < _ncenters && !mark[j]&&k<_ncenters;k++)if(!mark[k]){ + qr_finder_center *c[3]; + qr_code_data qrdata; + int version; diff --git a/pkgs/tools/graphics/zbar/0.23.92-CVE-2023-40890.patch b/pkgs/tools/graphics/zbar/0.23.92-CVE-2023-40890.patch new file mode 100644 index 000000000000..3576df214ae1 --- /dev/null +++ b/pkgs/tools/graphics/zbar/0.23.92-CVE-2023-40890.patch @@ -0,0 +1,26 @@ +Simple bounds checks for CVE-2023-40890 + +--- a/zbar/decoder/databar.c ++++ b/zbar/decoder/databar.c +@@ -23,6 +23,8 @@ + + #include + #include ++#include ++#include + + #ifdef DEBUG_DATABAR + # define DEBUG_LEVEL (DEBUG_DATABAR) +@@ -691,6 +693,12 @@ lookup_sequence (databar_segment_t *seg, + fixed = -1; + s <<= 1; + dbprintf(2, "%x", s); ++ ++ if (i > 20) { ++ fprintf(stderr, "Bug: Out-of-bounds condition detected\n"); ++ exit(99); ++ } ++ + seq[i++] = s++; + seq[i++] = s; + } diff --git a/pkgs/tools/graphics/zbar/default.nix b/pkgs/tools/graphics/zbar/default.nix index 31fd9742d236..87223676f37d 100644 --- a/pkgs/tools/graphics/zbar/default.nix +++ b/pkgs/tools/graphics/zbar/default.nix @@ -1,6 +1,7 @@ { stdenv , lib , fetchFromGitHub +, fetchpatch , imagemagickBig , pkg-config , withXorg ? true @@ -42,6 +43,11 @@ stdenv.mkDerivation rec { sha256 = "sha256-VhVrngAX7pXZp+szqv95R6RGAJojp3svdbaRKigGb0w="; }; + patches = [ + ./0.23.92-CVE-2023-40889.patch + ./0.23.92-CVE-2023-40890.patch + ]; + nativeBuildInputs = [ pkg-config xmlto