From 330781f750f43525c24fa2c18c9942374aff1b60 Mon Sep 17 00:00:00 2001 From: Ivan Kozik Date: Wed, 8 Jan 2020 03:55:55 +0000 Subject: [PATCH 1/3] chromium: 79.0.3945.88 -> 79.0.3945.117 CVE-TBD: Use after free in audio https://chromereleases.googleblog.com/2020/01/stable-channel-update-for-desktop.html (cherry picked from commit b8fa6dd0ac818b5c00a48ff89454ec1ae8e6f6c2) --- .../browsers/chromium/upstream-info.nix | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/pkgs/applications/networking/browsers/chromium/upstream-info.nix b/pkgs/applications/networking/browsers/chromium/upstream-info.nix index 6a4e46e74bde..85f3aa824c36 100644 --- a/pkgs/applications/networking/browsers/chromium/upstream-info.nix +++ b/pkgs/applications/networking/browsers/chromium/upstream-info.nix @@ -1,18 +1,18 @@ # This file is autogenerated from update.sh in the same directory. { beta = { - sha256 = "1j9zfbyil16yhf6hzrd0ssy9k49jx468dbmgzhc20l1548fif62g"; - sha256bin64 = "1jfsswjqzdif6824p9a6raw5j9309y61c80kgfq23247vr514ky9"; - version = "79.0.3945.88"; - }; - dev = { sha256 = "1fbs6llrhm9jkzmk3v3a84d9is6g96kysy91hvpb0bw8f7anl969"; - sha256bin64 = "04fscphs4w6jb1kdc25jc568r3k4x3nmg0apggjfnbdwzb5zkmf2"; + sha256bin64 = "026gb4ypgidywvs4a031d0alv6fdphmlfybvgir4a73z8q263s26"; version = "80.0.3987.16"; }; + dev = { + sha256 = "1bczkk2q4fk1vgx34d9qgzqz7gsf89h6gd16apwcy6063lmrsizz"; + sha256bin64 = "1ywi3x7rc4vwsg20lci37bw97873j3vvbxxv7m2nlh4nqcs5655q"; + version = "81.0.4000.3"; + }; stable = { - sha256 = "1j9zfbyil16yhf6hzrd0ssy9k49jx468dbmgzhc20l1548fif62g"; - sha256bin64 = "1k44fnn41n73j1lff4h8s8f79pw8w180n467lwff4g9izh6c2blz"; - version = "79.0.3945.88"; + sha256 = "1wafhpnaqwmmks4rs6x9m2b4jz4m4h27jch6gy71rk4hsy5hx5jd"; + sha256bin64 = "1dl43a94xd7vkx8mnp3ccgq18y624fffcfnfjhxgfc02c0c6an9l"; + version = "79.0.3945.117"; }; } From e7c07cc6a6d447b70d1903b86bfc2c13a281a5de Mon Sep 17 00:00:00 2001 From: Michael Weiss Date: Sun, 26 Jan 2020 19:02:31 +0100 Subject: [PATCH 2/3] chromium: 79.0.3945.117 -> 79.0.3945.130 https://chromereleases.googleblog.com/2020/01/stable-channel-update-for-desktop_16.html This update includes 11 security fixes. CVEs: CVE-2020-6378 CVE-2020-6379 CVE-2020-6380 CVE-2020-0601 (cherry picked from commit cccfd1092ffe6f3f757c54c2b2367ea19bc0e82c) --- .../browsers/chromium/upstream-info.nix | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/pkgs/applications/networking/browsers/chromium/upstream-info.nix b/pkgs/applications/networking/browsers/chromium/upstream-info.nix index 85f3aa824c36..73163c82ea78 100644 --- a/pkgs/applications/networking/browsers/chromium/upstream-info.nix +++ b/pkgs/applications/networking/browsers/chromium/upstream-info.nix @@ -1,18 +1,18 @@ # This file is autogenerated from update.sh in the same directory. { beta = { - sha256 = "1fbs6llrhm9jkzmk3v3a84d9is6g96kysy91hvpb0bw8f7anl969"; - sha256bin64 = "026gb4ypgidywvs4a031d0alv6fdphmlfybvgir4a73z8q263s26"; - version = "80.0.3987.16"; + sha256 = "07h3znqb1r8hgcxzm5f04xkj2r66s1rhixqyyxi4hadf7qjx02n7"; + sha256bin64 = "0r7706gxdqws8dm5859869p5h8gas6f65qz674rk18l8dbg40fzw"; + version = "80.0.3987.66"; }; dev = { - sha256 = "1bczkk2q4fk1vgx34d9qgzqz7gsf89h6gd16apwcy6063lmrsizz"; - sha256bin64 = "1ywi3x7rc4vwsg20lci37bw97873j3vvbxxv7m2nlh4nqcs5655q"; - version = "81.0.4000.3"; + sha256 = "1sm1ndq4y2d4fs4y9d5k4dcs6q2pqilv7b0ffx2nlazdrr73la3n"; + sha256bin64 = "0kr49hvk0c6pmxpm94fscxvdd6whxz1x7ic27xk86csjpjz6s5dg"; + version = "81.0.4033.2"; }; stable = { - sha256 = "1wafhpnaqwmmks4rs6x9m2b4jz4m4h27jch6gy71rk4hsy5hx5jd"; - sha256bin64 = "1dl43a94xd7vkx8mnp3ccgq18y624fffcfnfjhxgfc02c0c6an9l"; - version = "79.0.3945.117"; + sha256 = "183vz3lf1588cr9s5vlnj65qvbmz36s8cg8k7dvr64cxmcqk86an"; + sha256bin64 = "1550fs4n3lgvb80hij2yq13zkw0bjih210ylpd74n1mw9yw4ygk1"; + version = "79.0.3945.130"; }; } From 1f9158a47ab749288af8b389bd68e9bf642b3882 Mon Sep 17 00:00:00 2001 From: Andrew Childs Date: Sun, 24 Nov 2019 13:55:22 +0900 Subject: [PATCH 3/3] chromium: fix aarch64 build The skia patch no longer applies, and is no longer necessary. The current version of chromium doesn't build with gcc. This has been fixed upstream[1] and could be backported, but switching aarch64 to clang/llvm and making the build the same on all platforms is simpler. [1] https://chromium.googlesource.com/chromium/src/+/9662ec844017690d5fd56bf0f05ef6a540dd29c1 (cherry picked from commit 6ec5e745dc4f9dc5f321989fef4a5fa66a21c7b2) --- .../applications/networking/browsers/chromium/common.nix | 6 +----- .../networking/browsers/chromium/default.nix | 9 +++------ 2 files changed, 4 insertions(+), 11 deletions(-) diff --git a/pkgs/applications/networking/browsers/chromium/common.nix b/pkgs/applications/networking/browsers/chromium/common.nix index cbdea0b91dc6..c01b576f9a08 100644 --- a/pkgs/applications/networking/browsers/chromium/common.nix +++ b/pkgs/applications/networking/browsers/chromium/common.nix @@ -140,11 +140,7 @@ let ] ++ optionals (useVaapi) [ # source: https://aur.archlinux.org/cgit/aur.git/tree/vaapi-fix.patch?h=chromium-vaapi ./patches/vaapi-fix.patch - ] ++ optional stdenv.isAarch64 (fetchpatch { - url = https://raw.githubusercontent.com/OSSystems/meta-browser/e4a667deaaf9a26a3a1aeb355770d1f29da549ad/recipes-browser/chromium/files/aarch64-skia-build-fix.patch; - postFetch = "substituteInPlace $out --replace __aarch64__ SK_CPU_ARM64"; - sha256 = "018fbdzyw9rvia8m0qkk5gv8q8gl7x34rrjbn7mi1fgxdsayn22s"; - }); + ]; postPatch = '' # We want to be able to specify where the sandbox is via CHROME_DEVEL_SANDBOX diff --git a/pkgs/applications/networking/browsers/chromium/default.nix b/pkgs/applications/networking/browsers/chromium/default.nix index e3b2f0df3009..774bc7dcc58c 100644 --- a/pkgs/applications/networking/browsers/chromium/default.nix +++ b/pkgs/applications/networking/browsers/chromium/default.nix @@ -1,4 +1,4 @@ -{ newScope, config, stdenv, llvmPackages, gcc8Stdenv, llvmPackages_8 +{ newScope, config, stdenv, llvmPackages_8 , makeWrapper, ed , glib, gtk3, gnome3, gsettings-desktop-schemas , libva ? null @@ -20,11 +20,8 @@ }: let - stdenv_ = if stdenv.isAarch64 then gcc8Stdenv else llvmPackages_8.stdenv; - llvmPackages_ = if stdenv.isAarch64 then llvmPackages else llvmPackages_8; -in let - stdenv = stdenv_; - llvmPackages = llvmPackages_; + stdenv = llvmPackages_8.stdenv; + llvmPackages = llvmPackages_8; callPackage = newScope chromium;