From 84ea2f024f9ecd5fc422b01c33ca859556875af6 Mon Sep 17 00:00:00 2001 From: Robert Scott Date: Tue, 29 Nov 2022 22:45:53 +0000 Subject: [PATCH 1/4] qemu: add patches for CVE-2022-4172 & CVE-2022-4144 --- .../virtualization/qemu/default.nix | 25 +++++++++++++++++++ 1 file changed, 25 insertions(+) diff --git a/pkgs/applications/virtualization/qemu/default.nix b/pkgs/applications/virtualization/qemu/default.nix index 46bbc3b914b9..e0c875c1a379 100644 --- a/pkgs/applications/virtualization/qemu/default.nix +++ b/pkgs/applications/virtualization/qemu/default.nix @@ -117,6 +117,31 @@ stdenv.mkDerivation rec { url = "https://gitlab.com/qemu-project/qemu/-/commit/d307040b18bfcb1393b910f1bae753d5c12a4dc7.patch"; sha256 = "sha256-YPhm580lBNuAv7G1snYccKZ2V5ycdV8Ri8mTw5jjFBc="; }) + (fetchpatch { + name = "CVE-2022-4172.patch"; + url = "https://gitlab.com/qemu-project/qemu/-/commit/defb70980f6bed36100b74e84220f1764c0dd544.patch"; + sha256 = "sha256-8HGe3UQB9/8mwYwSmv1vlDUCCfiqFGjk+Pf6Ibvbn9E="; + }) + (fetchpatch { + name = "CVE-2022-4144.part-1.patch"; + url = "https://gitlab.com/qemu-project/qemu/-/commit/61c34fc194b776ecadc39fb26b061331107e5599.patch"; + sha256 = "sha256-g4NGE8P7+lLyL2XAtXt8xSLsrPnvDyi7vbRPTQXgSSE="; + }) + (fetchpatch { + name = "CVE-2022-4144.part-2.patch"; + url = "https://gitlab.com/qemu-project/qemu/-/commit/b1901de83a9456cde26fc755f71ca2b7b3ef50fc.patch"; + sha256 = "sha256-rTFGzrH+ksx1oytMAym9CJJ9VJ5fX8MTjL4wo5/V94s="; + }) + (fetchpatch { + name = "CVE-2022-4144.part-3.patch"; + url = "https://gitlab.com/qemu-project/qemu/-/commit/8efec0ef8bbc1e75a7ebf6e325a35806ece9b39f.patch"; + sha256 = "sha256-Xhe1HyYO6FFGQomwYhmlB+UBKLV6U/A9Rl46C5qhS4M="; + }) + (fetchpatch { + name = "CVE-2022-4144.part-4.patch"; + url = "https://gitlab.com/qemu-project/qemu/-/commit/6dbbf055148c6f1b7d8a3251a65bd6f3d1e1f622.patch"; + sha256 = "sha256-fd2tqcih17LdaECAGhIOpRg8dXSbDa7C4M3hHxhisBE="; + }) ] ++ lib.optional nixosTestRunner ./force-uid0-on-9p.patch; From 2fdefae0d0d721220c7d1443c948c491e7c79b27 Mon Sep 17 00:00:00 2001 From: Gabriella Gonzalez Date: Fri, 23 Dec 2022 13:37:05 -0600 Subject: [PATCH 2/4] darwin.builder: Fix supported platforms See: https://github.com/NixOS/nixpkgs/issues/108984#issuecomment-1364263324 Before this change the supported platforms were unspecified, so it would default to being only built on `x86_64-linux`. This fixes that so that hydra.nixos.org builds and caches the Darwin build products instead (cherry picked from commit 0b9b09eee60cd63b3be6b859efae4a41670a18b8) --- nixos/modules/profiles/macos-builder.nix | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/nixos/modules/profiles/macos-builder.nix b/nixos/modules/profiles/macos-builder.nix index 895dd04cb485..77f3224a7294 100644 --- a/nixos/modules/profiles/macos-builder.nix +++ b/nixos/modules/profiles/macos-builder.nix @@ -1,4 +1,4 @@ -{ config, pkgs, ... }: +{ config, lib, pkgs, ... }: let keysDirectory = "/var/keys"; @@ -71,8 +71,7 @@ in hostPkgs = config.virtualisation.host.pkgs; - in - hostPkgs.writeShellScriptBin "create-builder" '' + script = hostPkgs.writeShellScriptBin "create-builder" '' KEYS="''${KEYS:-./keys}" ${hostPkgs.coreutils}/bin/mkdir --parent "''${KEYS}" PRIVATE_KEY="''${KEYS}/${user}_${keyType}" @@ -87,6 +86,13 @@ in KEYS="$(nix-store --add "$KEYS")" ${config.system.build.vm}/bin/run-nixos-vm ''; + in + script.overrideAttrs (old: { + meta = (old.meta or { }) // { + platforms = lib.platforms.darwin; + }; + }); + system.stateVersion = "22.05"; users.users."${user}"= { From 09dcf2cc77f376bdb55876a25ae365601bfbc8c3 Mon Sep 17 00:00:00 2001 From: Shadaj Laddad Date: Thu, 17 Nov 2022 18:04:31 -0800 Subject: [PATCH 3/4] openvscode-server: 1.69.2 -> 1.73.1 (cherry picked from commit 793aa60fad0d207b05460dbecca9e01a61315500) --- pkgs/servers/openvscode-server/default.nix | 21 +++++++-------------- 1 file changed, 7 insertions(+), 14 deletions(-) diff --git a/pkgs/servers/openvscode-server/default.nix b/pkgs/servers/openvscode-server/default.nix index 4953ac8592c2..e4f558c790b2 100644 --- a/pkgs/servers/openvscode-server/default.nix +++ b/pkgs/servers/openvscode-server/default.nix @@ -1,12 +1,12 @@ { lib, stdenv, fetchFromGitHub, makeWrapper, runCommand , cacert, moreutils, jq, git, pkg-config, yarn, python3 -, esbuild, nodejs-14_x, libsecret, xorg, ripgrep +, esbuild, nodejs-16_x-openssl_1_1, libsecret, xorg, ripgrep , AppKit, Cocoa, Security, cctools }: let system = stdenv.hostPlatform.system; - nodejs = nodejs-14_x; + nodejs = nodejs-16_x-openssl_1_1; yarn' = yarn.override { inherit nodejs; }; defaultYarnOpts = [ "frozen-lockfile" "non-interactive" "no-progress"]; @@ -27,13 +27,13 @@ let in stdenv.mkDerivation rec { pname = "openvscode-server"; - version = "1.69.2"; + version = "1.73.1"; src = fetchFromGitHub { owner = "gitpod-io"; repo = "openvscode-server"; rev = "openvscode-server-v${version}"; - sha256 = "e2vEEZg2H37oFRN+0kZnWW5RU2ma2JJR66XLFDNEOXc="; + sha256 = "DZWAzNRRRZ/eElwRGvSK7TxstKK6X1Tj+uAxD4SOScQ="; }; yarnCache = stdenv.mkDerivation { @@ -56,16 +56,9 @@ in stdenv.mkDerivation rec { outputHashMode = "recursive"; outputHashAlgo = "sha256"; - outputHash = "sha256-5wOR7rKzGLE8EAlGd4CkrFUsUOEJOdwuNWQzEdbAL+g="; + outputHash = "sha256-7UBXigQj7c+fuHPIM5BbRe02DuL+cs6VbQ/D84Yk8i4="; }; - # Extract the Node.js source code which is used to compile packages with - # native bindings - nodeSources = runCommand "node-sources" {} '' - tar --no-same-owner --no-same-permissions -xf ${nodejs.src} - mv node-* $out - ''; - nativeBuildInputs = [ nodejs yarn' python3 pkg-config makeWrapper git jq moreutils ]; @@ -102,9 +95,9 @@ in stdenv.mkDerivation rec { # set offline mirror to yarn cache we created in previous steps yarn --offline config set yarn-offline-mirror "${yarnCache}" - '' + lib.optionalString stdenv.isLinux '' + # set nodedir, so we can build binaries later - npm config set nodedir "${nodeSources}" + npm config set nodedir "${nodejs}" ''; buildPhase = '' From efc77a915e599133a2877f7cec3f7d0d69378ea3 Mon Sep 17 00:00:00 2001 From: Maximilian Bosch Date: Fri, 23 Dec 2022 15:11:10 +0100 Subject: [PATCH 4/4] element-{web,desktop}: 1.11.16 -> 1.11.17 ChangeLog web: https://github.com/vector-im/element-web/releases/tag/v1.11.17 ChangeLog desktop: https://github.com/vector-im/element-desktop/releases/tag/v1.11.17 (cherry picked from commit 89e70a483602c8e8abd382cf91576341af991688) --- .../networking/instant-messengers/element/pin.json | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/pkgs/applications/networking/instant-messengers/element/pin.json b/pkgs/applications/networking/instant-messengers/element/pin.json index c92532b74b82..64a164c9b01e 100644 --- a/pkgs/applications/networking/instant-messengers/element/pin.json +++ b/pkgs/applications/networking/instant-messengers/element/pin.json @@ -1,7 +1,7 @@ { - "version": "1.11.16", - "desktopSrcHash": "EeED62HRpaWN91yxcDvwwNUWmDRU38lyT5ba1S4go6Q=", - "desktopYarnHash": "1f0bghcbzab2dkvxmvhhc0dzyk3js09v2sh93gsjsq9mkhld1k0w", - "webSrcHash": "T6UcGNm4i+Nc4Yk/mVFc4L9jxWQtOpjps1ZtEhilHW0=", - "webYarnHash": "1jyzym34lzadniqrysbm1m5agw03hzw6ymmdxpbay38afrhrciyk" + "version": "1.11.17", + "desktopSrcHash": "VB7p/ThiwphcCd3loSwQ61TthR2ji0nX6l32Jrgv/NE=", + "desktopYarnHash": "15jsznsqxvi1bs26pmb7zfrybl071k3g3g6i0pm34mzs2r9nvrii", + "webSrcHash": "YeXsDyyoQnWNDnfx/7fMHooi48ST+LiA5ACy0gBnQaQ=", + "webYarnHash": "1zniyg869glhajcmcgq34qwmhb4jq2hbjqhhz6a79p892yx97chp" }