From 69e4ae56c4b0fc2fb6ae4354dec5b764a3cd01f5 Mon Sep 17 00:00:00 2001 From: Michael Weiss Date: Wed, 20 May 2020 12:17:33 +0200 Subject: [PATCH] chromium: Mark as insecure Since M81 won't receive any updates anymore and there are known vulnerabilities we should mark it as insecure so that users are aware of the risks. Updating Chromium to M83 is unfortunately too challenging for 19.09, but as of today we've already covered the one month period of security updates for "oldstable" and both 20.03 and nixos-unstable contain recent versions (i.e. users should either update to the current stable release or install Chromium from a different channel). nixos-unstable PR for M83: #88206 --- nixos/release-combined.nix | 1 - .../networking/browsers/chromium/browser.nix | 10 ++++++++++ .../networking/browsers/google-chrome/default.nix | 10 ++++++++++ 3 files changed, 20 insertions(+), 1 deletion(-) diff --git a/nixos/release-combined.nix b/nixos/release-combined.nix index 00f695949273..617a0d0ca2cb 100644 --- a/nixos/release-combined.nix +++ b/nixos/release-combined.nix @@ -65,7 +65,6 @@ in rec { (all "nixos.tests.containers-imperative") (all "nixos.tests.containers-ipv4") (all "nixos.tests.containers-ipv6") - "nixos.tests.chromium.x86_64-linux" (all "nixos.tests.firefox") (all "nixos.tests.firewall") (all "nixos.tests.fontconfig-default-fonts") diff --git a/pkgs/applications/networking/browsers/chromium/browser.nix b/pkgs/applications/networking/browsers/chromium/browser.nix index cc3962db87b0..4abb56ba2a7d 100644 --- a/pkgs/applications/networking/browsers/chromium/browser.nix +++ b/pkgs/applications/networking/browsers/chromium/browser.nix @@ -86,5 +86,15 @@ mkChromiumDerivation (base: rec { # backported to 19.09. Therefore we'll only maintain M81 for NixOS 19.09 # which will give us approx. one month of security updates / time for users # to transition to 20.03 (as per our policy). + knownVulnerabilities = [ + # Since the release of M83 the previous version isn't secure anymore. + # nixos-unstable update: https://github.com/NixOS/nixpkgs/pull/88206 + '' + This version of Chromium is no longer being updated. Consider switching + to the new stable NixOS channel or installing Chromium from a different + channel. A list of the missing security fixes can be found here: + https://chromereleases.googleblog.com/2020/05/stable-channel-update-for-desktop_19.html + '' + ]; }; }) diff --git a/pkgs/applications/networking/browsers/google-chrome/default.nix b/pkgs/applications/networking/browsers/google-chrome/default.nix index 53255ec51835..f57071c1467b 100644 --- a/pkgs/applications/networking/browsers/google-chrome/default.nix +++ b/pkgs/applications/networking/browsers/google-chrome/default.nix @@ -137,5 +137,15 @@ in stdenv.mkDerivation { license = licenses.unfree; maintainers = [ maintainers.msteen ]; platforms = [ "x86_64-linux" ]; + knownVulnerabilities = [ + # Since the release of M83 the previous version isn't secure anymore. + # nixos-unstable update: https://github.com/NixOS/nixpkgs/pull/88206 + '' + This version of Google Chrome is no longer being updated. Consider switching + to the new stable NixOS channel or installing Google Chrome from a different + channel. A list of the missing security fixes can be found here: + https://chromereleases.googleblog.com/2020/05/stable-channel-update-for-desktop_19.html + '' + ]; }; }