From ee416c7d3859eafc031d1eb61218dc4d7f9cdfb4 Mon Sep 17 00:00:00 2001 From: Michael Weiss Date: Thu, 28 Apr 2022 20:18:50 +0200 Subject: [PATCH 01/10] ungoogled-chromium: 100.0.4896.127 -> 101.0.4951.41 (cherry picked from commit 3084d18e448d2fa6fae43053119c1ef43068b0dc) --- .../networking/browsers/chromium/common.nix | 12 +----------- .../browsers/chromium/upstream-info.json | 16 ++++++++-------- 2 files changed, 9 insertions(+), 19 deletions(-) diff --git a/pkgs/applications/networking/browsers/chromium/common.nix b/pkgs/applications/networking/browsers/chromium/common.nix index 167545379211..3a9e07187e2d 100644 --- a/pkgs/applications/networking/browsers/chromium/common.nix +++ b/pkgs/applications/networking/browsers/chromium/common.nix @@ -61,13 +61,6 @@ let url = "https://chromium.googlesource.com/chromium/tools/build/+/e77882e0dde52c2ccf33c5570929b75b4a2a2522/recipes/recipe_modules/chromium/resources/clang-format?format=TEXT"; sha256 = "0ic3hn65dimgfhakli1cyf9j3cxcqsf1qib706ihfhmlzxf7256l"; }; - # https://webrtc-review.googlesource.com/c/src/+/255601 - webrtcWaylandScreenshareCoredumpFix = fetchurl { - # PipeWire capturer: check existence of cursor metadata - name = "webrtc-wayland-screenshare-coredump-fix.patch"; - url = "https://webrtc-review.googlesource.com/changes/src~255601/revisions/2/patch?download"; - hash = "sha256-PHGwEoYhMa+ZL2ner10FwdGUWUxsVr+HWuZOAEugYDY="; - }; # The additional attributes for creating derivations based on the chromium # source tree. @@ -169,9 +162,7 @@ let ./patches/widevine-79.patch ]; - postPatch = optionalString (versionRange "100" "101") '' - base64 --decode ${webrtcWaylandScreenshareCoredumpFix} | patch -p1 -d third_party/webrtc - '' + '' + postPatch = '' # remove unused third-party for lib in ${toString gnSystemLibraries}; do if [ -d "third_party/$lib" ]; then @@ -288,7 +279,6 @@ let enable_widevine = true; # Provides the enable-webrtc-pipewire-capturer flag to support Wayland screen capture: rtc_use_pipewire = true; - } // optionalAttrs (chromiumVersionAtLeast "101") { # Disable PGO because the profile data requires a newer compiler version (LLVM 14 isn't sufficient): chrome_pgo_phase = 0; } // optionalAttrs proprietaryCodecs { diff --git a/pkgs/applications/networking/browsers/chromium/upstream-info.json b/pkgs/applications/networking/browsers/chromium/upstream-info.json index 13ee6f5f85cd..3a806895a231 100644 --- a/pkgs/applications/networking/browsers/chromium/upstream-info.json +++ b/pkgs/applications/networking/browsers/chromium/upstream-info.json @@ -45,19 +45,19 @@ } }, "ungoogled-chromium": { - "version": "100.0.4896.127", - "sha256": "0kgq38dy9mjyc44556i9gxhlsgd7dfvv1xi1ibk92b4p7i2y6427", - "sha256bin64": "0mm6lix14bf4ca440dyccnq54z0qvn5c886ghfyzy2q0bqzbq4nh", + "version": "101.0.4951.41", + "sha256": "0dzsbr309n70jg7fpq2qfnrgcm4553akvdmnzhss1fc85s467609", + "sha256bin64": "12nzzsp4040mwc7jah5w0p58ckv8s16wv6ylf6vlmfby06a4xlkq", "deps": { "gn": { - "version": "2022-01-21", + "version": "2022-03-14", "url": "https://gn.googlesource.com/gn", - "rev": "0725d7827575b239594fbc8fd5192873a1d62f44", - "sha256": "1dzdvcn2r5c9giknvasf3y5y4901kav7igivjvrpww66ywsj8fzr" + "rev": "bd99dbf98cbdefe18a4128189665c5761263bcfb", + "sha256": "0nql15ckjqkm001xajq3qyn4h4q80i7x6dm9zinxxr1a8q5lppx3" }, "ungoogled-patches": { - "rev": "100.0.4896.127-1", - "sha256": "192kyhr0fa97csciv5kp496y9zwcsknwlrmdr4jic3rvv8ig1q9y" + "rev": "101.0.4951.41-1", + "sha256": "19m31bd04yvba3w5iymkxfjnmilas3cfp383m9fl6pd4wwhy9md0" } } } From 5eecadd4bf2236072a95a7da222783927f01297a Mon Sep 17 00:00:00 2001 From: Maximilian Bosch Date: Thu, 28 Apr 2022 12:12:23 +0200 Subject: [PATCH 02/10] linux: 4.14.276 -> 4.14.277 (cherry picked from commit 2cd2c891f927122ad38fcb4d0905d62c49a6ef9e) --- pkgs/os-specific/linux/kernel/linux-4.14.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/os-specific/linux/kernel/linux-4.14.nix b/pkgs/os-specific/linux/kernel/linux-4.14.nix index 0605782003ff..b451202871e7 100644 --- a/pkgs/os-specific/linux/kernel/linux-4.14.nix +++ b/pkgs/os-specific/linux/kernel/linux-4.14.nix @@ -3,7 +3,7 @@ with lib; buildLinux (args // rec { - version = "4.14.276"; + version = "4.14.277"; # modDirVersion needs to be x.y.z, will automatically add .0 if needed modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg; @@ -13,6 +13,6 @@ buildLinux (args // rec { src = fetchurl { url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz"; - sha256 = "1rxksrmkh5raz930y9khfg85dglgphrgcvkj21n86m333pajs4mf"; + sha256 = "058vzn1gcsc194hgwrj78afawz2anm7ga8a1x5m5i4cw8p1arp73"; }; } // (args.argsOverride or {})) From 6506a8acc7ffefcaf4268aeebcc3fa20dc59229d Mon Sep 17 00:00:00 2001 From: Maximilian Bosch Date: Thu, 28 Apr 2022 12:12:39 +0200 Subject: [PATCH 03/10] linux: 4.19.239 -> 4.19.240 (cherry picked from commit f708ee02bd30bd436149e4b84e2792cb9cdb6bf6) --- pkgs/os-specific/linux/kernel/linux-4.19.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/os-specific/linux/kernel/linux-4.19.nix b/pkgs/os-specific/linux/kernel/linux-4.19.nix index 81502bde9b0e..c03c5d5afd21 100644 --- a/pkgs/os-specific/linux/kernel/linux-4.19.nix +++ b/pkgs/os-specific/linux/kernel/linux-4.19.nix @@ -3,7 +3,7 @@ with lib; buildLinux (args // rec { - version = "4.19.239"; + version = "4.19.240"; # modDirVersion needs to be x.y.z, will automatically add .0 if needed modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg; @@ -13,6 +13,6 @@ buildLinux (args // rec { src = fetchurl { url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz"; - sha256 = "0fsr9jy8d1rpg6ixp7av01pqz3vq50rgfcjd7vj16ccsdk15sz5z"; + sha256 = "1hj6vngynx6kjaczjl77jjwqq0kh0lm6jdqjvakd1cgrppaizb3j"; }; } // (args.argsOverride or {})) From 18c7742dce39c7c7a3e6a21f6144603f03e4fbc5 Mon Sep 17 00:00:00 2001 From: Maximilian Bosch Date: Thu, 28 Apr 2022 12:12:52 +0200 Subject: [PATCH 04/10] linux: 4.9.311 -> 4.9.312 (cherry picked from commit cd8c3a2b1e2012b652867f71ceaf5899ae727d62) --- pkgs/os-specific/linux/kernel/linux-4.9.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/os-specific/linux/kernel/linux-4.9.nix b/pkgs/os-specific/linux/kernel/linux-4.9.nix index 68a3e5163888..704423c6e99b 100644 --- a/pkgs/os-specific/linux/kernel/linux-4.9.nix +++ b/pkgs/os-specific/linux/kernel/linux-4.9.nix @@ -1,12 +1,12 @@ { buildPackages, fetchurl, perl, buildLinux, nixosTests, stdenv, ... } @ args: buildLinux (args // rec { - version = "4.9.311"; + version = "4.9.312"; extraMeta.branch = "4.9"; extraMeta.broken = stdenv.isAarch64; src = fetchurl { url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz"; - sha256 = "15wqwplq1qk3ni5arfigfl62zbdwhaki3vkg1lv3sln2gnpm059l"; + sha256 = "09y6wl4j3y46fza6kmssibmxspxx0i44fqrhc2cyvrm2bgxv2bzs"; }; } // (args.argsOverride or {})) From 84b239bfedef843606e52cabc62721e1eca05e10 Mon Sep 17 00:00:00 2001 From: Maximilian Bosch Date: Thu, 28 Apr 2022 12:13:07 +0200 Subject: [PATCH 05/10] linux: 5.10.112 -> 5.10.113 (cherry picked from commit f1ad14384b81237c1e63bc21b89644e3f3f68fb7) --- pkgs/os-specific/linux/kernel/linux-5.10.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/os-specific/linux/kernel/linux-5.10.nix b/pkgs/os-specific/linux/kernel/linux-5.10.nix index 1dab43b9acf8..1ac78adf7c7e 100644 --- a/pkgs/os-specific/linux/kernel/linux-5.10.nix +++ b/pkgs/os-specific/linux/kernel/linux-5.10.nix @@ -3,7 +3,7 @@ with lib; buildLinux (args // rec { - version = "5.10.112"; + version = "5.10.113"; # modDirVersion needs to be x.y.z, will automatically add .0 if needed modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg; @@ -13,6 +13,6 @@ buildLinux (args // rec { src = fetchurl { url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz"; - sha256 = "19aa7fq8n75gh0vv01mpxg4cxkfpr5lj0sv6lxiyzcgbc71isv4c"; + sha256 = "1z3dd5hrdbn2axsi2n70n41q1dq2dvg7s8aph1p6yiajpc16llc2"; }; } // (args.argsOverride or {})) From ac5a478a621dd2953c242c25667f7b8b64c7b1e0 Mon Sep 17 00:00:00 2001 From: Maximilian Bosch Date: Thu, 28 Apr 2022 12:13:22 +0200 Subject: [PATCH 06/10] linux: 5.15.35 -> 5.15.36 (cherry picked from commit fd748205fac8960c7b10d6c1ab1fcd6b394e8d89) --- pkgs/os-specific/linux/kernel/linux-5.15.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/os-specific/linux/kernel/linux-5.15.nix b/pkgs/os-specific/linux/kernel/linux-5.15.nix index f5b1033c0fd6..5f0ba39e20b4 100644 --- a/pkgs/os-specific/linux/kernel/linux-5.15.nix +++ b/pkgs/os-specific/linux/kernel/linux-5.15.nix @@ -3,7 +3,7 @@ with lib; buildLinux (args // rec { - version = "5.15.35"; + version = "5.15.36"; # modDirVersion needs to be x.y.z, will automatically add .0 if needed modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg; @@ -13,6 +13,6 @@ buildLinux (args // rec { src = fetchurl { url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz"; - sha256 = "1n05c4c4ish25x483a2p5177zgda8pq7g4752n1b7chfygi5l6ha"; + sha256 = "1466557034q1fzvpy8vwj8ps3cv2q8s7z76af9y1jz4kgaqmsd1n"; }; } // (args.argsOverride or { })) From 5159008a2243b29e47a8d678754d28e70d2a6763 Mon Sep 17 00:00:00 2001 From: Maximilian Bosch Date: Thu, 28 Apr 2022 12:13:38 +0200 Subject: [PATCH 07/10] linux: 5.17.4 -> 5.17.5 (cherry picked from commit 0b6256c1b83cfd3ed4691318adb771eed30b2ae4) --- pkgs/os-specific/linux/kernel/linux-5.17.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/os-specific/linux/kernel/linux-5.17.nix b/pkgs/os-specific/linux/kernel/linux-5.17.nix index e4718bd1eed2..4c67169b706d 100644 --- a/pkgs/os-specific/linux/kernel/linux-5.17.nix +++ b/pkgs/os-specific/linux/kernel/linux-5.17.nix @@ -3,7 +3,7 @@ with lib; buildLinux (args // rec { - version = "5.17.4"; + version = "5.17.5"; # modDirVersion needs to be x.y.z, will automatically add .0 if needed modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg; @@ -13,6 +13,6 @@ buildLinux (args // rec { src = fetchurl { url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz"; - sha256 = "1ifkl1j5dimipqxwki26i4v6gav70g24456y7ynbb71sx1pdag3f"; + sha256 = "11z95wsgmj97pg77yck26l0383gncbla0zwpzv4gjdj4p62x3g4v"; }; } // (args.argsOverride or { })) From 434e6f4a00587465069eff2e6dad59d9e7365dbe Mon Sep 17 00:00:00 2001 From: Maximilian Bosch Date: Thu, 28 Apr 2022 12:13:52 +0200 Subject: [PATCH 08/10] linux: 5.4.190 -> 5.4.191 (cherry picked from commit 156229222ead25832517fc723571949b81c7ea5c) --- pkgs/os-specific/linux/kernel/linux-5.4.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/os-specific/linux/kernel/linux-5.4.nix b/pkgs/os-specific/linux/kernel/linux-5.4.nix index 2376538fbe27..073d0ef77054 100644 --- a/pkgs/os-specific/linux/kernel/linux-5.4.nix +++ b/pkgs/os-specific/linux/kernel/linux-5.4.nix @@ -3,7 +3,7 @@ with lib; buildLinux (args // rec { - version = "5.4.190"; + version = "5.4.191"; # modDirVersion needs to be x.y.z, will automatically add .0 if needed modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg; @@ -13,6 +13,6 @@ buildLinux (args // rec { src = fetchurl { url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz"; - sha256 = "157ifcl59xxj721r302hg82vmbqzx5hjrlihrc5s4maxfw3ygm41"; + sha256 = "0fharjqasvq76pciwci6qamdadpfjh2n8gdyri8fj65drmgsi318"; }; } // (args.argsOverride or {})) From 29daba88a76496d32bcd157cc4846eab59559ec0 Mon Sep 17 00:00:00 2001 From: Sumner Evans Date: Wed, 27 Apr 2022 16:22:50 -0600 Subject: [PATCH 09/10] element-{web,desktop}: 1.10.10 -> 1.10.11 (cherry picked from commit b57cd37794da4e2256ad381ed417f58ce122d9f2) --- .../instant-messengers/element/element-desktop-package.json | 3 ++- .../networking/instant-messengers/element/pin.json | 6 +++--- 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/pkgs/applications/networking/instant-messengers/element/element-desktop-package.json b/pkgs/applications/networking/instant-messengers/element/element-desktop-package.json index 960336d50a53..a244a2ab2a70 100644 --- a/pkgs/applications/networking/instant-messengers/element/element-desktop-package.json +++ b/pkgs/applications/networking/instant-messengers/element/element-desktop-package.json @@ -2,7 +2,7 @@ "name": "element-desktop", "productName": "Element", "main": "lib/electron-main.js", - "version": "1.10.10", + "version": "1.10.11", "description": "A feature-rich client for Matrix.org", "author": "Element", "repository": { @@ -89,6 +89,7 @@ }, "build": { "appId": "im.riot.app", + "asarUnpack": "**/*.node", "files": [ "package.json", { diff --git a/pkgs/applications/networking/instant-messengers/element/pin.json b/pkgs/applications/networking/instant-messengers/element/pin.json index 1b42ed12f341..70b5f7f65efa 100644 --- a/pkgs/applications/networking/instant-messengers/element/pin.json +++ b/pkgs/applications/networking/instant-messengers/element/pin.json @@ -1,6 +1,6 @@ { - "version": "1.10.10", - "desktopSrcHash": "Atgcu+K28pScYokS/lTu+/mMeEC+1yTcn3Akq+KZJNY=", + "version": "1.10.11", + "desktopSrcHash": "n74KFmHI6ZQWBEJCR55VZHS//myh2RePcJRVOmZ6XHo=", "desktopYarnHash": "0jm0i1yyfkg1ll11pb3qif1vdxx6rp0yl9kd8jg9nhsg2jzw66pr", - "webHash": "1xp0rhw3k2znwvqqikhd771l2n6xyx8npcz87m9d4cisl82lpnr0" + "webHash": "02m64bhg1ls4a5igmizkkxnqfmbfhs0xy24ycr75vxmn0zmwa3yd" } From 3f9782abb41ddd73981f8f6300ce6be3cd3d134d Mon Sep 17 00:00:00 2001 From: Robert Scott Date: Sat, 30 Apr 2022 00:11:56 +0100 Subject: [PATCH 10/10] qemu: add patches for CVE-2021-4206 & CVE-2021-4207 --- pkgs/applications/virtualization/qemu/default.nix | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/pkgs/applications/virtualization/qemu/default.nix b/pkgs/applications/virtualization/qemu/default.nix index 0ae3f84142b2..485dde9dce25 100644 --- a/pkgs/applications/virtualization/qemu/default.nix +++ b/pkgs/applications/virtualization/qemu/default.nix @@ -112,6 +112,16 @@ stdenv.mkDerivation rec { url = "https://gitlab.com/qemu-project/qemu/-/commit/8d1b247f3748ac4078524130c6d7ae42b6140aaf.patch"; sha256 = "021d6pk0kh7fxn7rnq8g7cs34qac9qy6an858fxxs31gg9yqcfkl"; }) + (fetchpatch { + name = "CVE-2021-4206.patch"; + url = "https://gitlab.com/qemu-project/qemu/-/commit/fa892e9abb728e76afcf27323ab29c57fb0fe7aa.patch"; + sha256 = "1mlfiz488h83qrmbq7zmcw92rdh82za7jz3mw5xrhhvxw9d6rr01"; + }) + (fetchpatch { + name = "CVE-2021-4207.patch"; + url = "https://gitlab.com/qemu-project/qemu/-/commit/9569f5cb5b4bffa9d3ebc8ba7da1e03830a9a895.patch"; + sha256 = "14ph53pwdcgzzizmigrz444h8a46dsilnwkv0g224qz74rwxhgxz"; + }) ] ++ lib.optional nixosTestRunner ./force-uid0-on-9p.patch ++ lib.optionals stdenv.hostPlatform.isMusl [ ./sigrtminmax.patch