From 25c34477ad13af1ffd51e2cd7963ce96be08bf3c Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Mon, 21 Apr 2025 23:01:40 +0200 Subject: [PATCH 1/2] matrix-media-repo: 1.3.7 -> 1.3.8 https://github.com/t2bot/matrix-media-repo/blob/v1.3.8/CHANGELOG.md https://github.com/t2bot/matrix-media-repo/security/advisories/GHSA-rcxc-wjgw-579r https://github.com/t2bot/matrix-media-repo/security/advisories/GHSA-gp86-q8hg-fpxj https://github.com/t2bot/matrix-media-repo/security/advisories/GHSA-r6jg-jfv6-2fjv Fixes: CVE-2024-56515, CVE-2024-52791, CVE-2024-52602 (cherry picked from commit e0801dcc1290f8888b74a1a9a2fd25b4c92303d6) --- pkgs/by-name/ma/matrix-media-repo/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/ma/matrix-media-repo/package.nix b/pkgs/by-name/ma/matrix-media-repo/package.nix index f15eb89e33e8..5a4b057357cc 100644 --- a/pkgs/by-name/ma/matrix-media-repo/package.nix +++ b/pkgs/by-name/ma/matrix-media-repo/package.nix @@ -8,16 +8,16 @@ }: let pname = "matrix-media-repo"; - version = "1.3.7"; + version = "1.3.8"; src = fetchFromGitHub { owner = "t2bot"; repo = "matrix-media-repo"; rev = "v${version}"; - hash = "sha256-trVn+Mn98aJLQCpQX1+qps/uuA5+8zeDoM94eauxHO8="; + hash = "sha256-KP1ZyHqeATxk1PCLuM6lPk+GB4Rd0f7ppKVETIURx28="; }; - vendorHash = "sha256-fKDdL7C3L33caoXxlutzoND2izB5GH+5qTeojTskIUg="; + vendorHash = "sha256-+sHy4Lgufs5jdN/V9W06U4dOZrsPiX87zmR1UwGHhQg="; asset-compiler = buildGoModule { pname = "${pname}-compile_assets"; From a1c9856093c18a56b91d1d9c9968882d446e049f Mon Sep 17 00:00:00 2001 From: Thomas Gerbet Date: Thu, 8 May 2025 20:56:10 +0200 Subject: [PATCH 2/2] matrix-media-repo: downgrade the libheif Go wrapper so we can use libheif 1.18 --- .../downgrade-libheif-wrapper.diff | 28 +++++++++++++++++++ pkgs/by-name/ma/matrix-media-repo/package.nix | 16 +++++++++-- 2 files changed, 42 insertions(+), 2 deletions(-) create mode 100644 pkgs/by-name/ma/matrix-media-repo/downgrade-libheif-wrapper.diff diff --git a/pkgs/by-name/ma/matrix-media-repo/downgrade-libheif-wrapper.diff b/pkgs/by-name/ma/matrix-media-repo/downgrade-libheif-wrapper.diff new file mode 100644 index 000000000000..0878f8c66481 --- /dev/null +++ b/pkgs/by-name/ma/matrix-media-repo/downgrade-libheif-wrapper.diff @@ -0,0 +1,28 @@ +diff --git a/go.mod b/go.mod +index b228f3e..f43f43e 100644 +--- a/go.mod ++++ b/go.mod +@@ -54,7 +54,7 @@ require ( + github.com/redis/go-redis/v9 v9.7.0 + github.com/sabhiram/go-gitignore v0.0.0-20210923224102-525f6e181f06 + github.com/stretchr/testify v1.10.0 +- github.com/strukturag/libheif v1.19.5 ++ github.com/strukturag/libheif v1.18.2 + github.com/t2bot/go-leaky-bucket v1.0.0 + github.com/t2bot/go-singleflight-streams v1.0.0 + github.com/t2bot/go-typed-singleflight v0.0.3 +diff --git a/go.sum b/go.sum +index c15be35..964e40e 100644 +--- a/go.sum ++++ b/go.sum +@@ -368,8 +368,8 @@ github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO + github.com/stretchr/testify v1.8.2/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4= + github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA= + github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY= +-github.com/strukturag/libheif v1.19.5 h1:YLf0RO6mNQYeeNkFSk/Uto8EyUOCzDpLPjbEBoeV9Io= +-github.com/strukturag/libheif v1.19.5/go.mod h1:E/PNRlmVtrtj9j2AvBZlrO4dsBDu6KfwDZn7X1Ce8Ks= ++github.com/strukturag/libheif v1.18.2 h1:CrlRS7Kwl2odl4DYM/m6ay/HPXEcmQPK1xF8FxAqP7k= ++github.com/strukturag/libheif v1.18.2/go.mod h1:E/PNRlmVtrtj9j2AvBZlrO4dsBDu6KfwDZn7X1Ce8Ks= + github.com/stvp/tempredis v0.0.0-20181119212430-b82af8480203 h1:QVqDTf3h2WHt08YuiTGPZLls0Wq99X9bWd0Q5ZSBesM= + github.com/stvp/tempredis v0.0.0-20181119212430-b82af8480203/go.mod h1:oqN97ltKNihBbwlX8dLpwxCl3+HnXKV/R0e+sRLd9C8= + github.com/t2bot/go-leaky-bucket v1.0.0 h1:w16tqQj4pslBFNc8xEYvOcu5rt8QhLugx1e5TKyT9zI= diff --git a/pkgs/by-name/ma/matrix-media-repo/package.nix b/pkgs/by-name/ma/matrix-media-repo/package.nix index 5a4b057357cc..6312f06c6bcb 100644 --- a/pkgs/by-name/ma/matrix-media-repo/package.nix +++ b/pkgs/by-name/ma/matrix-media-repo/package.nix @@ -17,11 +17,22 @@ let hash = "sha256-KP1ZyHqeATxk1PCLuM6lPk+GB4Rd0f7ppKVETIURx28="; }; - vendorHash = "sha256-+sHy4Lgufs5jdN/V9W06U4dOZrsPiX87zmR1UwGHhQg="; + patches = [ + # matrix-media-repo 1.3.8+ uses a Go wrapper expecting libheif 1.19+ + # which NixOS 24.11 does not have + ./downgrade-libheif-wrapper.diff + ]; + + vendorHash = "sha256-3cmjdhL4U7tq429vUPElM5Kp203SWgZeoHM/i6Vuf7Q="; asset-compiler = buildGoModule { pname = "${pname}-compile_assets"; - inherit version src vendorHash; + inherit + version + src + patches + vendorHash + ; subPackages = [ "cmd/utilities/compile_assets" @@ -34,6 +45,7 @@ buildGoModule { pname version src + patches vendorHash ;