From d52e4349a8d86fec1fb9e06daab041e348e6e3e2 Mon Sep 17 00:00:00 2001 From: Robert Scott Date: Fri, 17 Nov 2023 18:35:06 +0000 Subject: [PATCH 01/10] zbar: add patches for CVE-2023-40889 & CVE-2023-40890 unfixed upstream these are both (based on) third party patches (cherry picked from commit de6c085635fb4c013d9a3a9f34b643302735dc70) --- .../zbar/0.23.92-CVE-2023-40889.patch | 17 ++++++++++++ .../zbar/0.23.92-CVE-2023-40890.patch | 26 +++++++++++++++++++ pkgs/tools/graphics/zbar/default.nix | 6 +++++ 3 files changed, 49 insertions(+) create mode 100644 pkgs/tools/graphics/zbar/0.23.92-CVE-2023-40889.patch create mode 100644 pkgs/tools/graphics/zbar/0.23.92-CVE-2023-40890.patch diff --git a/pkgs/tools/graphics/zbar/0.23.92-CVE-2023-40889.patch b/pkgs/tools/graphics/zbar/0.23.92-CVE-2023-40889.patch new file mode 100644 index 000000000000..7b7ca5a0befa --- /dev/null +++ b/pkgs/tools/graphics/zbar/0.23.92-CVE-2023-40889.patch @@ -0,0 +1,17 @@ +Simple bounds checks for CVE-2023-40889, based on third-party +fix by Remi Meier @ +https://github.com/Raemi/zbar/commit/5e8acc6974f17e56c3ddaa5509870beb8d7a599c + +--- a/zbar/qrcode/qrdec.c ++++ b/zbar/qrcode/qrdec.c +@@ -3900,8 +3900,8 @@ void qr_reader_match_centers(qr_reader *_reader,qr_code_data_list *_qrlist, + /*TODO: We might be able to accelerate this step significantly by + considering the remaining finder centers in a more intelligent order, + based on the first finder center we just chose.*/ +- for(j=i+1;!mark[i]&&j<_ncenters;j++){ +- for(k=j+1;!mark[j]&&k<_ncenters;k++)if(!mark[k]){ ++ for(j=i+1; i < _ncenters && !mark[i]&&j<_ncenters;j++){ ++ for(k=j+1; j < _ncenters && !mark[j]&&k<_ncenters;k++)if(!mark[k]){ + qr_finder_center *c[3]; + qr_code_data qrdata; + int version; diff --git a/pkgs/tools/graphics/zbar/0.23.92-CVE-2023-40890.patch b/pkgs/tools/graphics/zbar/0.23.92-CVE-2023-40890.patch new file mode 100644 index 000000000000..3576df214ae1 --- /dev/null +++ b/pkgs/tools/graphics/zbar/0.23.92-CVE-2023-40890.patch @@ -0,0 +1,26 @@ +Simple bounds checks for CVE-2023-40890 + +--- a/zbar/decoder/databar.c ++++ b/zbar/decoder/databar.c +@@ -23,6 +23,8 @@ + + #include + #include ++#include ++#include + + #ifdef DEBUG_DATABAR + # define DEBUG_LEVEL (DEBUG_DATABAR) +@@ -691,6 +693,12 @@ lookup_sequence (databar_segment_t *seg, + fixed = -1; + s <<= 1; + dbprintf(2, "%x", s); ++ ++ if (i > 20) { ++ fprintf(stderr, "Bug: Out-of-bounds condition detected\n"); ++ exit(99); ++ } ++ + seq[i++] = s++; + seq[i++] = s; + } diff --git a/pkgs/tools/graphics/zbar/default.nix b/pkgs/tools/graphics/zbar/default.nix index 31fd9742d236..87223676f37d 100644 --- a/pkgs/tools/graphics/zbar/default.nix +++ b/pkgs/tools/graphics/zbar/default.nix @@ -1,6 +1,7 @@ { stdenv , lib , fetchFromGitHub +, fetchpatch , imagemagickBig , pkg-config , withXorg ? true @@ -42,6 +43,11 @@ stdenv.mkDerivation rec { sha256 = "sha256-VhVrngAX7pXZp+szqv95R6RGAJojp3svdbaRKigGb0w="; }; + patches = [ + ./0.23.92-CVE-2023-40889.patch + ./0.23.92-CVE-2023-40890.patch + ]; + nativeBuildInputs = [ pkg-config xmlto From 4157ca4407f37d275ccc47c275ed8d855ca41608 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Sat, 16 Sep 2023 00:37:24 +0000 Subject: [PATCH 02/10] libtommath: 1.2.0 -> 1.2.1 (cherry picked from commit 3f665ee43d1c3ad8dd8991e44917ba964fccd019) --- pkgs/development/libraries/libtommath/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/libraries/libtommath/default.nix b/pkgs/development/libraries/libtommath/default.nix index b6e129722a23..3ec1ba7b79b3 100644 --- a/pkgs/development/libraries/libtommath/default.nix +++ b/pkgs/development/libraries/libtommath/default.nix @@ -2,11 +2,11 @@ stdenv.mkDerivation rec { pname = "libtommath"; - version = "1.2.0"; + version = "1.2.1"; src = fetchurl { url = "https://github.com/libtom/libtommath/releases/download/v${version}/ltm-${version}.tar.xz"; - sha256 = "1c8q1qy88cjhdjlk3g24mra94h34c1ldvkjz0n2988c0yvn5xixp"; + sha256 = "sha256-mGAl17N0J2/uLjDpnzZJ5KwNuKAiV6N+4Q6ucqvtDR8="; }; nativeBuildInputs = [ libtool ]; From 27b0eb706ecc79ce240801ece1990a68830399d9 Mon Sep 17 00:00:00 2001 From: Maximilian Bosch Date: Wed, 8 Nov 2023 21:29:13 +0100 Subject: [PATCH 03/10] roundcube: 1.6.4 -> 1.6.5 ChangeLog: https://github.com/roundcube/roundcubemail/releases/tag/1.6.5 (cherry picked from commit bb09ba5e566c83a34467f63bc8e5e6a7cf135587) --- pkgs/servers/roundcube/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/servers/roundcube/default.nix b/pkgs/servers/roundcube/default.nix index a7e71c722fb5..959c9bf4633e 100644 --- a/pkgs/servers/roundcube/default.nix +++ b/pkgs/servers/roundcube/default.nix @@ -2,11 +2,11 @@ stdenv.mkDerivation rec { pname = "roundcube"; - version = "1.6.4"; + version = "1.6.5"; src = fetchurl { url = "https://github.com/roundcube/roundcubemail/releases/download/${version}/roundcubemail-${version}-complete.tar.gz"; - sha256 = "sha256-peq8fggo4CYYea7JCp1KbcAgPpiOFN4vk9bAYeZIkcg="; + sha256 = "sha256-Fktyy3jeidEEdB7pCQ9AJOY7+tpDlJA0hENl8/pwtf0="; }; patches = [ ./0001-Don-t-resolve-symlinks-when-trying-to-find-INSTALL_P.patch ]; From 9a1fc97de4b20e6506b8b289bb33d7bb13f7af57 Mon Sep 17 00:00:00 2001 From: Robert Hensing Date: Sun, 19 Nov 2023 12:18:52 +0100 Subject: [PATCH 04/10] changelog-d: init Move the overrides to top-level (pkgs/by-name). (cherry picked from commit 2e1a0993183796f2beb47d413da25742c865a4b7) --- pkgs/by-name/ch/changelog-d/package.nix | 62 +++++++++++++++++++ .../haskell-modules/non-hackage-packages.nix | 2 +- .../misc/haskell/changelog-d/default.nix | 51 --------------- 3 files changed, 63 insertions(+), 52 deletions(-) create mode 100644 pkgs/by-name/ch/changelog-d/package.nix delete mode 100644 pkgs/development/misc/haskell/changelog-d/default.nix diff --git a/pkgs/by-name/ch/changelog-d/package.nix b/pkgs/by-name/ch/changelog-d/package.nix new file mode 100644 index 000000000000..770673714475 --- /dev/null +++ b/pkgs/by-name/ch/changelog-d/package.nix @@ -0,0 +1,62 @@ +{ + cabal2nix, + lib, + haskell, + haskellPackages, + runCommand, + writeShellApplication, +}: + +let + hsPkg = haskellPackages.changelog-d; + + haskellModifications = x: x; + + mkDerivationOverrides = finalAttrs: oldAttrs: { + + version = oldAttrs.version + "-git-${lib.strings.substring 0 7 oldAttrs.src.rev}"; + + passthru.updateScript = lib.getExe (writeShellApplication { + name = "update-changelog-d"; + runtimeInputs = [ + cabal2nix + ]; + text = '' + cd pkgs/development/misc/haskell/changelog-d + cabal2nix https://codeberg.org/fgaz/changelog-d >changelog-d.nix + ''; + }); + passthru.tests = { + basic = runCommand "changelog-d-basic-test" { + nativeBuildInputs = [ finalAttrs.finalPackage ]; + } '' + mkdir changelogs + cat > changelogs/config < changelogs/a <$out + cat -n $out + echo Checking the generated output + set -x + grep -F 'Support numbers with incrementing base-10 digits' $out >/dev/null + grep -F 'https://github.com/NixOS/boondoggle/issues/1234' $out >/dev/null + set +x + ''; + }; + + meta = oldAttrs.meta // { + homepage = "https://codeberg.org/fgaz/changelog-d"; + maintainers = [ lib.maintainers.roberth ]; + }; + + }; +in + (haskellModifications hsPkg).overrideAttrs mkDerivationOverrides diff --git a/pkgs/development/haskell-modules/non-hackage-packages.nix b/pkgs/development/haskell-modules/non-hackage-packages.nix index f5831ed3c7ab..135c16516469 100644 --- a/pkgs/development/haskell-modules/non-hackage-packages.nix +++ b/pkgs/development/haskell-modules/non-hackage-packages.nix @@ -7,7 +7,7 @@ # files. self: super: { - changelog-d = self.callPackage ../misc/haskell/changelog-d {}; + changelog-d = self.callPackage ../misc/haskell/changelog-d/changelog-d.nix {}; dconf2nix = self.callPackage ../tools/haskell/dconf2nix/dconf2nix.nix { }; diff --git a/pkgs/development/misc/haskell/changelog-d/default.nix b/pkgs/development/misc/haskell/changelog-d/default.nix deleted file mode 100644 index e4ba565808cf..000000000000 --- a/pkgs/development/misc/haskell/changelog-d/default.nix +++ /dev/null @@ -1,51 +0,0 @@ -{ callPackage -, lib -, pkgs -}: - -(callPackage ./changelog-d.nix { }).overrideAttrs (finalAttrs: oldAttrs: { - - version = oldAttrs.version + "-git-${lib.strings.substring 0 7 oldAttrs.src.rev}"; - - passthru.updateScript = lib.getExe (pkgs.writeShellApplication { - name = "update-changelog-d"; - runtimeInputs = [ - pkgs.cabal2nix - ]; - text = '' - cd pkgs/development/misc/haskell/changelog-d - cabal2nix https://codeberg.org/fgaz/changelog-d >changelog-d.nix - ''; - }); - passthru.tests = { - basic = pkgs.runCommand "changelog-d-basic-test" { - nativeBuildInputs = [ finalAttrs.finalPackage ]; - } '' - mkdir changelogs - cat > changelogs/config < changelogs/a <$out - cat -n $out - echo Checking the generated output - set -x - grep -F 'Support numbers with incrementing base-10 digits' $out >/dev/null - grep -F 'https://github.com/NixOS/boondoggle/issues/1234' $out >/dev/null - set +x - ''; - }; - - meta = oldAttrs.meta // { - homepage = "https://codeberg.org/fgaz/changelog-d"; - maintainers = [ lib.maintainers.roberth ]; - }; - -}) From e7df89785f724c714e21754c7e1424bed8014414 Mon Sep 17 00:00:00 2001 From: Robert Hensing Date: Sun, 19 Nov 2023 12:19:44 +0100 Subject: [PATCH 05/10] changelog-d: Use justStaticExecutables I couldn't get the separate bin output to work. (cherry picked from commit 9009c53c9719a509920824e480731431bb3b4622) --- pkgs/by-name/ch/changelog-d/package.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkgs/by-name/ch/changelog-d/package.nix b/pkgs/by-name/ch/changelog-d/package.nix index 770673714475..f390596b5947 100644 --- a/pkgs/by-name/ch/changelog-d/package.nix +++ b/pkgs/by-name/ch/changelog-d/package.nix @@ -10,7 +10,7 @@ let hsPkg = haskellPackages.changelog-d; - haskellModifications = x: x; + haskellModifications = haskell.lib.justStaticExecutables; mkDerivationOverrides = finalAttrs: oldAttrs: { From a387ea21573a38fca4b79b91e07c471b8b7f8572 Mon Sep 17 00:00:00 2001 From: Robert Hensing Date: Sun, 19 Nov 2023 12:24:10 +0100 Subject: [PATCH 06/10] changelog-d: Move out tests.basic (cherry picked from commit 3ce9db808b5bf6cf7e7c9c64d20c17620916c7e7) --- pkgs/by-name/ch/changelog-d/package.nix | 26 ++------------------- pkgs/by-name/ch/changelog-d/tests/basic.nix | 25 ++++++++++++++++++++ 2 files changed, 27 insertions(+), 24 deletions(-) create mode 100644 pkgs/by-name/ch/changelog-d/tests/basic.nix diff --git a/pkgs/by-name/ch/changelog-d/package.nix b/pkgs/by-name/ch/changelog-d/package.nix index f390596b5947..c855beca0fe2 100644 --- a/pkgs/by-name/ch/changelog-d/package.nix +++ b/pkgs/by-name/ch/changelog-d/package.nix @@ -1,9 +1,9 @@ { cabal2nix, + callPackage, lib, haskell, haskellPackages, - runCommand, writeShellApplication, }: @@ -27,29 +27,7 @@ let ''; }); passthru.tests = { - basic = runCommand "changelog-d-basic-test" { - nativeBuildInputs = [ finalAttrs.finalPackage ]; - } '' - mkdir changelogs - cat > changelogs/config < changelogs/a <$out - cat -n $out - echo Checking the generated output - set -x - grep -F 'Support numbers with incrementing base-10 digits' $out >/dev/null - grep -F 'https://github.com/NixOS/boondoggle/issues/1234' $out >/dev/null - set +x - ''; + basic = callPackage ./tests/basic.nix { changelog-d = finalAttrs.finalPackage; }; }; meta = oldAttrs.meta // { diff --git a/pkgs/by-name/ch/changelog-d/tests/basic.nix b/pkgs/by-name/ch/changelog-d/tests/basic.nix new file mode 100644 index 000000000000..25d434f0729f --- /dev/null +++ b/pkgs/by-name/ch/changelog-d/tests/basic.nix @@ -0,0 +1,25 @@ +{ runCommand, changelog-d }: + +runCommand "changelog-d-basic-test" { + nativeBuildInputs = [ changelog-d ]; +} '' + mkdir changelogs + cat > changelogs/config < changelogs/a <$out + cat -n $out + echo Checking the generated output + set -x + grep -F 'Support numbers with incrementing base-10 digits' $out >/dev/null + grep -F 'https://github.com/NixOS/boondoggle/issues/1234' $out >/dev/null + set +x +'' From be107d701a73bc845ef447a1ce9d61539ce12ef5 Mon Sep 17 00:00:00 2001 From: Robert Hensing Date: Sun, 19 Nov 2023 12:28:03 +0100 Subject: [PATCH 07/10] changelog-d: Move out updateScript (cherry picked from commit 25df0e640974599c813e9bb3e8a9fba28f79bd12) --- pkgs/by-name/ch/changelog-d/package.nix | 13 +------------ pkgs/by-name/ch/changelog-d/updateScript.nix | 12 ++++++++++++ 2 files changed, 13 insertions(+), 12 deletions(-) create mode 100644 pkgs/by-name/ch/changelog-d/updateScript.nix diff --git a/pkgs/by-name/ch/changelog-d/package.nix b/pkgs/by-name/ch/changelog-d/package.nix index c855beca0fe2..444e6de23357 100644 --- a/pkgs/by-name/ch/changelog-d/package.nix +++ b/pkgs/by-name/ch/changelog-d/package.nix @@ -1,10 +1,8 @@ { - cabal2nix, callPackage, lib, haskell, haskellPackages, - writeShellApplication, }: let @@ -16,16 +14,7 @@ let version = oldAttrs.version + "-git-${lib.strings.substring 0 7 oldAttrs.src.rev}"; - passthru.updateScript = lib.getExe (writeShellApplication { - name = "update-changelog-d"; - runtimeInputs = [ - cabal2nix - ]; - text = '' - cd pkgs/development/misc/haskell/changelog-d - cabal2nix https://codeberg.org/fgaz/changelog-d >changelog-d.nix - ''; - }); + passthru.updateScript = lib.getExe (callPackage ./updateScript.nix { }); passthru.tests = { basic = callPackage ./tests/basic.nix { changelog-d = finalAttrs.finalPackage; }; }; diff --git a/pkgs/by-name/ch/changelog-d/updateScript.nix b/pkgs/by-name/ch/changelog-d/updateScript.nix new file mode 100644 index 000000000000..7ef55f57f4cf --- /dev/null +++ b/pkgs/by-name/ch/changelog-d/updateScript.nix @@ -0,0 +1,12 @@ +{ writeShellApplication, cabal2nix }: + +writeShellApplication { + name = "update-changelog-d"; + runtimeInputs = [ + cabal2nix + ]; + text = '' + cd pkgs/development/misc/haskell/changelog-d + cabal2nix https://codeberg.org/fgaz/changelog-d >changelog-d.nix + ''; +} From 20970e09903c3faf5ee954e9cbae84b468c5815e Mon Sep 17 00:00:00 2001 From: Robert Hensing Date: Sun, 19 Nov 2023 12:31:22 +0100 Subject: [PATCH 08/10] haskellPackages.changelog-d: Rename file (cherry picked from commit 0ff56d503a3177e21816d9864a215ee3da3d42ac) --- pkgs/by-name/ch/changelog-d/updateScript.nix | 2 +- pkgs/development/haskell-modules/non-hackage-packages.nix | 2 +- .../misc/haskell/changelog-d/{changelog-d.nix => default.nix} | 0 3 files changed, 2 insertions(+), 2 deletions(-) rename pkgs/development/misc/haskell/changelog-d/{changelog-d.nix => default.nix} (100%) diff --git a/pkgs/by-name/ch/changelog-d/updateScript.nix b/pkgs/by-name/ch/changelog-d/updateScript.nix index 7ef55f57f4cf..fae22a161b6d 100644 --- a/pkgs/by-name/ch/changelog-d/updateScript.nix +++ b/pkgs/by-name/ch/changelog-d/updateScript.nix @@ -7,6 +7,6 @@ writeShellApplication { ]; text = '' cd pkgs/development/misc/haskell/changelog-d - cabal2nix https://codeberg.org/fgaz/changelog-d >changelog-d.nix + cabal2nix https://codeberg.org/fgaz/changelog-d >default.nix ''; } diff --git a/pkgs/development/haskell-modules/non-hackage-packages.nix b/pkgs/development/haskell-modules/non-hackage-packages.nix index 135c16516469..f5831ed3c7ab 100644 --- a/pkgs/development/haskell-modules/non-hackage-packages.nix +++ b/pkgs/development/haskell-modules/non-hackage-packages.nix @@ -7,7 +7,7 @@ # files. self: super: { - changelog-d = self.callPackage ../misc/haskell/changelog-d/changelog-d.nix {}; + changelog-d = self.callPackage ../misc/haskell/changelog-d {}; dconf2nix = self.callPackage ../tools/haskell/dconf2nix/dconf2nix.nix { }; diff --git a/pkgs/development/misc/haskell/changelog-d/changelog-d.nix b/pkgs/development/misc/haskell/changelog-d/default.nix similarity index 100% rename from pkgs/development/misc/haskell/changelog-d/changelog-d.nix rename to pkgs/development/misc/haskell/changelog-d/default.nix From 2debce25ef4d911c575e85b32c0f99c60ea2534b Mon Sep 17 00:00:00 2001 From: Robert Hensing Date: Sun, 19 Nov 2023 12:31:54 +0100 Subject: [PATCH 09/10] changelog-d: Document tests and updateScript (cherry picked from commit eb8dafd288ccfffc18ff3b6fd41f01ef896e4039) --- pkgs/by-name/ch/changelog-d/package.nix | 3 +++ 1 file changed, 3 insertions(+) diff --git a/pkgs/by-name/ch/changelog-d/package.nix b/pkgs/by-name/ch/changelog-d/package.nix index 444e6de23357..2bccb02a2eb2 100644 --- a/pkgs/by-name/ch/changelog-d/package.nix +++ b/pkgs/by-name/ch/changelog-d/package.nix @@ -14,7 +14,10 @@ let version = oldAttrs.version + "-git-${lib.strings.substring 0 7 oldAttrs.src.rev}"; + # nix-shell ./maintainers/scripts/update.nix --argstr package changelog-d passthru.updateScript = lib.getExe (callPackage ./updateScript.nix { }); + + # nix-build -A changelog-d.tests passthru.tests = { basic = callPackage ./tests/basic.nix { changelog-d = finalAttrs.finalPackage; }; }; From 27b221632df2ca284eead20401c3788e093070c7 Mon Sep 17 00:00:00 2001 From: Robert Hensing Date: Sun, 19 Nov 2023 13:17:23 +0100 Subject: [PATCH 10/10] changelog-d: Add shell completions (cherry picked from commit 9f4a3df2e739c43e116a5f37eab86d7b211111da) --- pkgs/by-name/ch/changelog-d/package.nix | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/pkgs/by-name/ch/changelog-d/package.nix b/pkgs/by-name/ch/changelog-d/package.nix index 2bccb02a2eb2..10d4ad1ae355 100644 --- a/pkgs/by-name/ch/changelog-d/package.nix +++ b/pkgs/by-name/ch/changelog-d/package.nix @@ -8,7 +8,13 @@ let hsPkg = haskellPackages.changelog-d; - haskellModifications = haskell.lib.justStaticExecutables; + addCompletions = haskellPackages.generateOptparseApplicativeCompletions ["changelog-d"]; + + haskellModifications = + lib.flip lib.pipe [ + addCompletions + haskell.lib.justStaticExecutables + ]; mkDerivationOverrides = finalAttrs: oldAttrs: {