From a9d474652f740fbdbf4c0e29158e26508d17a01a Mon Sep 17 00:00:00 2001 From: Maximilian Bosch Date: Tue, 18 Feb 2020 15:26:12 +0100 Subject: [PATCH 01/11] python3Packages.signedjson: 1.0.0 -> 1.1.0 (cherry picked from commit 500375e338098e26f23f962f41ad10f4b317a50f) --- pkgs/development/python-modules/signedjson/default.nix | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/pkgs/development/python-modules/signedjson/default.nix b/pkgs/development/python-modules/signedjson/default.nix index 33a615fefd46..1214730dad87 100644 --- a/pkgs/development/python-modules/signedjson/default.nix +++ b/pkgs/development/python-modules/signedjson/default.nix @@ -4,19 +4,20 @@ , canonicaljson , unpaddedbase64 , pynacl +, typing-extensions }: buildPythonPackage rec { pname = "signedjson"; - version = "1.0.0"; + version = "1.1.0"; src = fetchgit { url = "https://github.com/matrix-org/python-signedjson.git"; rev = "refs/tags/v${version}"; - sha256 = "0b8xxhc3npd4567kqapfp4gs7m0h057xam3an7424az262ind82n"; + sha256 = "18s388hm3babnvakbbgfqk0jzq25nnznvhygywd3azp9b4yzmd5c"; }; - propagatedBuildInputs = [ canonicaljson unpaddedbase64 pynacl ]; + propagatedBuildInputs = [ canonicaljson unpaddedbase64 pynacl typing-extensions ]; meta = with stdenv.lib; { homepage = https://pypi.org/project/signedjson/; From dce33f1a2d491489ad044259c7d06d8870a205fb Mon Sep 17 00:00:00 2001 From: Maximilian Bosch Date: Mon, 16 Mar 2020 11:54:43 +0100 Subject: [PATCH 02/11] matrix-synapse: 1.9.1 -> 1.11.1 Contains only the version update from 8be61f7a36f403c15e1a242e129be7375aafaa85, the module-changes are not needed on 19.09 since the database is always configured properly here. --- pkgs/servers/matrix-synapse/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/servers/matrix-synapse/default.nix b/pkgs/servers/matrix-synapse/default.nix index 926999ce7f1b..20081e25d431 100644 --- a/pkgs/servers/matrix-synapse/default.nix +++ b/pkgs/servers/matrix-synapse/default.nix @@ -23,11 +23,11 @@ let in buildPythonApplication rec { pname = "matrix-synapse"; - version = "1.9.1"; + version = "1.11.1"; src = fetchPypi { inherit pname version; - sha256 = "13csf18dchm75vw251a7h57diag94vw6rhg8kkkbpi35cibn0cz2"; + sha256 = "0xd4bxsmk67r6pfj5lh0hn36r8z51mxsl39fjfrfdidvl1qqbxnk"; }; patches = [ From 311c3fdcbef493ff3f6586e07e2b79df936580d4 Mon Sep 17 00:00:00 2001 From: Florian Klink Date: Mon, 16 Mar 2020 00:28:24 +0100 Subject: [PATCH 03/11] nextcloud: 16.0.8 -> 16.0.9 includes fix for nC-SA-2020-015. See https://github.com/nextcloud/server/issues/19976, the SA currently has a typo - adressed in https://github.com/nextcloud/security-advisories/pull/21. --- pkgs/servers/nextcloud/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/servers/nextcloud/default.nix b/pkgs/servers/nextcloud/default.nix index 1e7bfc7835db..9472bd3475ed 100644 --- a/pkgs/servers/nextcloud/default.nix +++ b/pkgs/servers/nextcloud/default.nix @@ -2,11 +2,11 @@ stdenv.mkDerivation rec { pname = "nextcloud"; - version = "16.0.8"; + version = "16.0.9"; src = fetchurl { url = "https://download.nextcloud.com/server/releases/${pname}-${version}.tar.bz2"; - sha256 = "0c5z46936pxsmh5isgj5d8pcj1sy9hcqdi55awz5axs7h5cvabr5"; + sha256 = "0ds9awn4fqjizf4pz35aa9rg1pf3mrghbbp2wyyzb73zk0n10dg1"; }; installPhase = '' From 4f69f2c9afc3e95edd72dfcb15ce1169adcf4450 Mon Sep 17 00:00:00 2001 From: obadz <3359345+obadz@users.noreply.github.com> Date: Tue, 17 Mar 2020 11:28:28 +0000 Subject: [PATCH 04/11] opensmtpd: mark as insecure due to CVE-2020-8794 / #80978 --- pkgs/servers/mail/opensmtpd/default.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/pkgs/servers/mail/opensmtpd/default.nix b/pkgs/servers/mail/opensmtpd/default.nix index 22744b36d432..93d3055eb26e 100644 --- a/pkgs/servers/mail/opensmtpd/default.nix +++ b/pkgs/servers/mail/opensmtpd/default.nix @@ -65,6 +65,7 @@ stdenv.mkDerivation rec { license = licenses.isc; platforms = platforms.linux; maintainers = with maintainers; [ rickynils obadz ekleog ]; + knownVulnerabilities = [ "CVE-2020-8794" ]; }; passthru.tests = { basic-functionality-and-dovecot-interaction = nixosTests.opensmtpd; From 7db6a853c3dc9716cbc77fbbc846b225d3542c76 Mon Sep 17 00:00:00 2001 From: Florian Klink Date: Fri, 8 Nov 2019 15:08:17 +0100 Subject: [PATCH 05/11] opensmtpd: 6.4.2p1 -> 6.6.1p1 The substitition in smtpd/parse.y isn't necessary anymore. The hardcoded /usr/libexec/ has been replaced by a PATH_LIBEXEC #define, which will be set properly by the build system. (cherry picked from commit 96588508bb91b457d823229291582a7df5e2dcd3) --- pkgs/servers/mail/opensmtpd/default.nix | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/pkgs/servers/mail/opensmtpd/default.nix b/pkgs/servers/mail/opensmtpd/default.nix index 93d3055eb26e..736c2a706f1c 100644 --- a/pkgs/servers/mail/opensmtpd/default.nix +++ b/pkgs/servers/mail/opensmtpd/default.nix @@ -4,14 +4,14 @@ stdenv.mkDerivation rec { pname = "opensmtpd"; - version = "6.4.2p1"; + version = "6.6.1p1"; nativeBuildInputs = [ autoconf automake libtool bison ]; buildInputs = [ libasr libevent zlib libressl db pam ]; src = fetchurl { url = "https://www.opensmtpd.org/archives/${pname}-${version}.tar.gz"; - sha256 = "0pgv080ai7d98l9340jadp9wjiaqj2qvgpqhilcz0kps2mdiawbd"; + sha256 = "1ngil8j13m2rq07g94j4yjr6zmaimzy8wbfr17shi7rxnazys6zb"; }; patches = [ @@ -26,8 +26,6 @@ stdenv.mkDerivation rec { # See https://github.com/OpenSMTPD/OpenSMTPD/issues/885 for the `sh bootstrap` # requirement postPatch = '' - substituteInPlace smtpd/parse.y \ - --replace "/usr/libexec/" "$out/libexec/opensmtpd/" substituteInPlace mk/smtpctl/Makefile.am --replace "chgrp" "true" substituteInPlace mk/smtpctl/Makefile.am --replace "chmod 2555" "chmod 0555" sh bootstrap From 3ecd571fe6c3f99af081d7910aaca55308503fe4 Mon Sep 17 00:00:00 2001 From: Franz Pletz Date: Wed, 29 Jan 2020 02:58:32 +0100 Subject: [PATCH 06/11] opensmtpd: 6.6.1p1 -> 6.6.2p1 Fixes critical vulnerability: https://www.mail-archive.com/misc@opensmtpd.org/msg04850.html (cherry picked from commit 7b9bd595cdb661a7302fbefa6703cd76d0cb61e9) --- pkgs/servers/mail/opensmtpd/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/servers/mail/opensmtpd/default.nix b/pkgs/servers/mail/opensmtpd/default.nix index 736c2a706f1c..d1cb57ccda2b 100644 --- a/pkgs/servers/mail/opensmtpd/default.nix +++ b/pkgs/servers/mail/opensmtpd/default.nix @@ -4,14 +4,14 @@ stdenv.mkDerivation rec { pname = "opensmtpd"; - version = "6.6.1p1"; + version = "6.6.2p1"; nativeBuildInputs = [ autoconf automake libtool bison ]; buildInputs = [ libasr libevent zlib libressl db pam ]; src = fetchurl { url = "https://www.opensmtpd.org/archives/${pname}-${version}.tar.gz"; - sha256 = "1ngil8j13m2rq07g94j4yjr6zmaimzy8wbfr17shi7rxnazys6zb"; + sha256 = "16nz2n4s3djlasd6m6dqfwggf6igyfxzq5igny5i0qb8lnn13f33"; }; patches = [ From 7a106bd0a3fb7557d1321cee0eb14f38387f7a86 Mon Sep 17 00:00:00 2001 From: "R. RyanTM" Date: Thu, 13 Feb 2020 02:50:37 +0000 Subject: [PATCH 07/11] opensmtpd: 6.6.2p1 -> 6.6.3p1 (cherry picked from commit 77da4954da4c412145a5996517d045ef292615a0) --- pkgs/servers/mail/opensmtpd/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/servers/mail/opensmtpd/default.nix b/pkgs/servers/mail/opensmtpd/default.nix index d1cb57ccda2b..16b9f55a2916 100644 --- a/pkgs/servers/mail/opensmtpd/default.nix +++ b/pkgs/servers/mail/opensmtpd/default.nix @@ -4,14 +4,14 @@ stdenv.mkDerivation rec { pname = "opensmtpd"; - version = "6.6.2p1"; + version = "6.6.3p1"; nativeBuildInputs = [ autoconf automake libtool bison ]; buildInputs = [ libasr libevent zlib libressl db pam ]; src = fetchurl { url = "https://www.opensmtpd.org/archives/${pname}-${version}.tar.gz"; - sha256 = "16nz2n4s3djlasd6m6dqfwggf6igyfxzq5igny5i0qb8lnn13f33"; + sha256 = "1dqysjlyl0x3qzdzc9sjrla0063vpmlyq735lzf88p7wgzmw1xwy"; }; patches = [ From 521c6765215271f439b9232a5ee354d7c55b79f1 Mon Sep 17 00:00:00 2001 From: Andreas Rammhold Date: Mon, 24 Feb 2020 20:50:51 +0100 Subject: [PATCH 08/11] opensmtpd: 6.6.3p1 -> 6.6.4p1 Release notes aren't available at this time [1] it is likely to be related to a recent mail to oss-security (either [2] or [3]). [1] https://www.mail-archive.com/misc@opensmtpd.org/msg04888.html [2] https://www.openwall.com/lists/oss-security/2020/02/24/5 [3] https://www.openwall.com/lists/oss-security/2020/02/24/4 (cherry picked from commit 09725e5f9e896befcb7a1e292eae99c85a7a13b2) --- pkgs/servers/mail/opensmtpd/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/servers/mail/opensmtpd/default.nix b/pkgs/servers/mail/opensmtpd/default.nix index 16b9f55a2916..6f3bbd71b91b 100644 --- a/pkgs/servers/mail/opensmtpd/default.nix +++ b/pkgs/servers/mail/opensmtpd/default.nix @@ -4,14 +4,14 @@ stdenv.mkDerivation rec { pname = "opensmtpd"; - version = "6.6.3p1"; + version = "6.6.4p1"; nativeBuildInputs = [ autoconf automake libtool bison ]; buildInputs = [ libasr libevent zlib libressl db pam ]; src = fetchurl { url = "https://www.opensmtpd.org/archives/${pname}-${version}.tar.gz"; - sha256 = "1dqysjlyl0x3qzdzc9sjrla0063vpmlyq735lzf88p7wgzmw1xwy"; + sha256 = "1kyph9ycq0j21dl9n1sq5fns9p4gckdi0fmnf8awrcwrdcm9dyg2"; }; patches = [ From ce282f027ebe9523140134523cbe33100da03a78 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= Date: Tue, 17 Mar 2020 12:05:31 +0000 Subject: [PATCH 09/11] Revert "opensmtpd: mark as insecure due to CVE-2020-8794 / #80978" This reverts commit 4f69f2c9afc3e95edd72dfcb15ce1169adcf4450. We backported the latest opensmtpd version. --- pkgs/servers/mail/opensmtpd/default.nix | 1 - 1 file changed, 1 deletion(-) diff --git a/pkgs/servers/mail/opensmtpd/default.nix b/pkgs/servers/mail/opensmtpd/default.nix index 6f3bbd71b91b..f645a28dc64d 100644 --- a/pkgs/servers/mail/opensmtpd/default.nix +++ b/pkgs/servers/mail/opensmtpd/default.nix @@ -63,7 +63,6 @@ stdenv.mkDerivation rec { license = licenses.isc; platforms = platforms.linux; maintainers = with maintainers; [ rickynils obadz ekleog ]; - knownVulnerabilities = [ "CVE-2020-8794" ]; }; passthru.tests = { basic-functionality-and-dovecot-interaction = nixosTests.opensmtpd; From fe67f42e29b0d9c4f55f1461e1a7ac54cee4dfd9 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= Date: Tue, 17 Mar 2020 12:07:36 +0000 Subject: [PATCH 10/11] Revert "opensmtpd: apply patch for CVE-2020-7247.patch" This reverts commit f5c74e62dc87f3c73905437517453e2a63089d9a. Already included in the opensmtpd version. --- pkgs/servers/mail/opensmtpd/default.nix | 5 ----- 1 file changed, 5 deletions(-) diff --git a/pkgs/servers/mail/opensmtpd/default.nix b/pkgs/servers/mail/opensmtpd/default.nix index f645a28dc64d..76b247cfd841 100644 --- a/pkgs/servers/mail/opensmtpd/default.nix +++ b/pkgs/servers/mail/opensmtpd/default.nix @@ -16,11 +16,6 @@ stdenv.mkDerivation rec { patches = [ ./proc_path.diff # TODO: upstream to OpenSMTPD, see https://github.com/NixOS/nixpkgs/issues/54045 - (fetchurl { - name = "CVE-2020-7247.patch"; - url = "https://github.com/OpenSMTPD/OpenSMTPD/commit/d2688c097e0ff53037c7403e09426771876a3907.patch"; - sha256 = "1mr5zb7mgpapf80xrcjvvzinzyiqcd3i0z4jwj11wl3zrfq5kwwn"; - }) ]; # See https://github.com/OpenSMTPD/OpenSMTPD/issues/885 for the `sh bootstrap` From 29431a0dd4aa90e1cbd9beb854ca42e32995e51b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= Date: Tue, 17 Mar 2020 12:09:35 +0000 Subject: [PATCH 11/11] opensmtpd: build against openssl build fails against our local libressl version --- pkgs/servers/mail/opensmtpd/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/servers/mail/opensmtpd/default.nix b/pkgs/servers/mail/opensmtpd/default.nix index 76b247cfd841..83365dc099c5 100644 --- a/pkgs/servers/mail/opensmtpd/default.nix +++ b/pkgs/servers/mail/opensmtpd/default.nix @@ -1,5 +1,5 @@ { stdenv, fetchurl, autoconf, automake, libtool, bison -, libasr, libevent, zlib, libressl, db, pam, nixosTests +, libasr, libevent, zlib, openssl, db, pam, nixosTests }: stdenv.mkDerivation rec { @@ -7,7 +7,7 @@ stdenv.mkDerivation rec { version = "6.6.4p1"; nativeBuildInputs = [ autoconf automake libtool bison ]; - buildInputs = [ libasr libevent zlib libressl db pam ]; + buildInputs = [ libasr libevent zlib openssl db pam ]; src = fetchurl { url = "https://www.opensmtpd.org/archives/${pname}-${version}.tar.gz";