diff --git a/pkgs/applications/networking/browsers/firefox/wrapper.nix b/pkgs/applications/networking/browsers/firefox/wrapper.nix index f705dd20cb79..16e74e73529c 100644 --- a/pkgs/applications/networking/browsers/firefox/wrapper.nix +++ b/pkgs/applications/networking/browsers/firefox/wrapper.nix @@ -149,36 +149,34 @@ let ) (lib.optionals usesNixExtensions nixExtensions); enterprisePolicies = { - policies = { - DisableAppUpdate = true; - } - // lib.optionalAttrs usesNixExtensions { - ExtensionSettings = { - "*" = { - blocked_install_message = "You can't have manual extension mixed with nix extensions"; - installation_mode = "blocked"; - }; - } - // lib.foldr ( - e: ret: - ret - // { - "${e.extid}" = { - installation_mode = "allowed"; + policies = + lib.optionalAttrs usesNixExtensions { + ExtensionSettings = { + "*" = { + blocked_install_message = "You can't have manual extension mixed with nix extensions"; + installation_mode = "blocked"; }; } - ) { } extensions; + // lib.foldr ( + e: ret: + ret + // { + "${e.extid}" = { + installation_mode = "allowed"; + }; + } + ) { } extensions; - Extensions = { - Install = lib.foldr (e: ret: ret ++ [ "${e.outPath}/${e.extid}.xpi" ]) [ ] extensions; - }; - } - // lib.optionalAttrs smartcardSupport { - SecurityDevices = { - "OpenSC PKCS#11 Module" = "opensc-pkcs11.so"; - }; - } - // extraPolicies; + Extensions = { + Install = lib.foldr (e: ret: ret ++ [ "${e.outPath}/${e.extid}.xpi" ]) [ ] extensions; + }; + } + // lib.optionalAttrs smartcardSupport { + SecurityDevices = { + "OpenSC PKCS#11 Module" = "opensc-pkcs11.so"; + }; + } + // extraPolicies; }; mozillaCfg = '' @@ -397,6 +395,9 @@ let ln -sfT "$target" "$out/$l" done + # Disable update checks + touch $out/${libDir}/is-packaged-app + cd "$out" '' diff --git a/pkgs/applications/networking/mailreaders/thunderbird/packages.nix b/pkgs/applications/networking/mailreaders/thunderbird/packages.nix index e8a2b74c4156..8a78d99b79c8 100644 --- a/pkgs/applications/networking/mailreaders/thunderbird/packages.nix +++ b/pkgs/applications/networking/mailreaders/thunderbird/packages.nix @@ -30,11 +30,12 @@ let (if lib.versionOlder version "140" then ./no-buildconfig.patch else ./no-buildconfig-tb140.patch) ]; # FIXME: let's hope that upstream will fix this soon and we can drop this hack again. - # https://bugzilla.mozilla.org/show_bug.cgi?id=2006630 + # https://bugzilla.mozilla.org/show_bug.cgi?id=2040877 extraPostPatch = - lib.optionalString (lib.versionAtLeast version "147" && lib.versionOlder version "149") + lib.optionalString (lib.versionAtLeast version "151" && lib.versionOlder version "152") '' - find . -name .cargo-checksum.json | xargs sed 's/"[^"]*\.gitmodules":"[a-z0-9]*",//g' -i + echo https://hg.mozilla.org/releases/comm-release/rev/becfb8fb2c70f1603882a2787e2170d5d8013949 >> sourcestamp.txt + echo https://hg.mozilla.org/releases/mozilla-release/rev/fc12dc911f904307729760a817deb829cbf8feb4 >> sourcestamp.txt ''; meta = { @@ -73,8 +74,8 @@ rec { thunderbird = thunderbird-latest; thunderbird-latest = common { - version = "150.0.2"; - sha512 = "3e52220ff34aa6cd1bf46a910dba1f30d0abf7d19ed7f501ffeeb8f5901b8d97fdc0adb0cceb434ef8e83c7f7b83f28024b872280237af72ff2da9d89fafe065"; + version = "151.0.1"; + sha512 = "a09c1e18faa8d7fdccf39e905542c21e817230e68c7cc6050beec048d0fec0f8eb92e51278d2ccd8d8cfa842762662235517e20238b555a4ad48ee5648dc3589"; updateScript = callPackage ./update.nix { attrPath = "thunderbirdPackages.thunderbird-latest"; diff --git a/pkgs/applications/science/logic/hol_light/default.nix b/pkgs/applications/science/logic/hol_light/default.nix index ac908ab9f8ab..4bbbb2677297 100644 --- a/pkgs/applications/science/logic/hol_light/default.nix +++ b/pkgs/applications/science/logic/hol_light/default.nix @@ -9,6 +9,7 @@ zarith, camlp5, camlp-streams, + pcre2, }: let @@ -18,6 +19,7 @@ let '' -I ${zarith}/lib/ocaml/${ocaml.version}/site-lib/zarith \ -I ${zarith}/lib/ocaml/${ocaml.version}/site-lib/stublibs \ + -I ${pcre2}/lib/ocaml/${ocaml.version}/site-lib/stublibs \ '' else lib.optionalString (num != null) '' @@ -61,6 +63,7 @@ stdenv.mkDerivation { ]; propagatedBuildInputs = [ camlp-streams + pcre2 (if use_zarith then zarith else num) ]; diff --git a/pkgs/build-support/rust/import-cargo-lock.nix b/pkgs/build-support/rust/import-cargo-lock.nix index a3cd9b825ffc..80815a179e47 100644 --- a/pkgs/build-support/rust/import-cargo-lock.nix +++ b/pkgs/build-support/rust/import-cargo-lock.nix @@ -130,7 +130,10 @@ let }; registries = { - "https://github.com/rust-lang/crates.io-index" = "https://crates.io/api/v1/crates"; + # Use static.crates.io (CDN) instead of crates.io/api to avoid the 1 req/sec + # rate limit on the API servers, which currently returns intermittent 403s. + # See https://github.com/rust-lang/crates.io/issues/13482 + "https://github.com/rust-lang/crates.io-index" = "https://static.crates.io/crates"; } // extraRegistries; diff --git a/pkgs/by-name/ce/ceph/old-python-packages/pyopenssl-Cherry-pick-fix-for-CVE-2026-27459-and-CVE-2026-27448.patch b/pkgs/by-name/ce/ceph/old-python-packages/pyopenssl-Cherry-pick-fix-for-CVE-2026-27459-and-CVE-2026-27448.patch new file mode 100644 index 000000000000..eb1c8e08ed6c --- /dev/null +++ b/pkgs/by-name/ce/ceph/old-python-packages/pyopenssl-Cherry-pick-fix-for-CVE-2026-27459-and-CVE-2026-27448.patch @@ -0,0 +1,202 @@ +From 776f2a97d34c2ccfba90c0bcb448de7792edfdb6 Mon Sep 17 00:00:00 2001 +From: Alex Gaynor +Date: Wed, 18 Feb 2026 07:46:15 -0500 +Subject: [PATCH 1/2] Fix buffer overflow in DTLS cookie generation callback + (#1479) + +The cookie generate callback copied user-returned bytes into a +fixed-size native buffer without enforcing a maximum length. A +callback returning more than DTLS1_COOKIE_LENGTH bytes would overflow +the OpenSSL-provided buffer, corrupting adjacent memory. + +Co-authored-by: Claude Opus 4.6 +--- + src/OpenSSL/SSL.py | 7 +++++++ + tests/test_ssl.py | 38 ++++++++++++++++++++++++++++++++++++++ + 2 files changed, 45 insertions(+) + +diff --git a/src/OpenSSL/SSL.py b/src/OpenSSL/SSL.py +index efbf7907e618c912d48352f74fb80a9c19b9b98b..e28e10ab81ade8d79aff0cb9232fa71b1fb5314b 100644 +--- a/src/OpenSSL/SSL.py ++++ b/src/OpenSSL/SSL.py +@@ -561,11 +561,18 @@ class _CookieGenerateCallbackHelper(_CallbackExceptionHelper): + def __init__(self, callback): + _CallbackExceptionHelper.__init__(self) + ++ max_cookie_len = getattr(_lib, "DTLS1_COOKIE_LENGTH", 255) ++ + @wraps(callback) + def wrapper(ssl, out, outlen): + try: + conn = Connection._reverse_mapping[ssl] + cookie = callback(conn) ++ if len(cookie) > max_cookie_len: ++ raise ValueError( ++ f"Cookie too long (got {len(cookie)} bytes, " ++ f"max {max_cookie_len})" ++ ) + out[0 : len(cookie)] = cookie + outlen[0] = len(cookie) + return 1 +diff --git a/tests/test_ssl.py b/tests/test_ssl.py +index 024436f064ddadbf79a3e6b78e2a9e4aeeee7ac2..5f427e92b48e57276fee7acb5ffdbaf136462cee 100644 +--- a/tests/test_ssl.py ++++ b/tests/test_ssl.py +@@ -4497,6 +4497,44 @@ class TestDTLS: + except NotImplementedError: # OpenSSL 1.1.0 and earlier + pass + ++ def test_cookie_generate_too_long(self) -> None: ++ s_ctx = Context(DTLS_METHOD) ++ ++ def generate_cookie(ssl: Connection) -> bytes: ++ return b"\x00" * 256 ++ ++ def verify_cookie(ssl: Connection, cookie: bytes) -> bool: ++ return True ++ ++ s_ctx.set_cookie_generate_callback(generate_cookie) ++ s_ctx.set_cookie_verify_callback(verify_cookie) ++ s_ctx.use_privatekey(load_privatekey(FILETYPE_PEM, server_key_pem)) ++ s_ctx.use_certificate(load_certificate(FILETYPE_PEM, server_cert_pem)) ++ s_ctx.set_options(OP_NO_QUERY_MTU) ++ s = Connection(s_ctx) ++ s.set_accept_state() ++ ++ c_ctx = Context(DTLS_METHOD) ++ c_ctx.set_options(OP_NO_QUERY_MTU) ++ c = Connection(c_ctx) ++ c.set_connect_state() ++ ++ c.set_ciphertext_mtu(1500) ++ s.set_ciphertext_mtu(1500) ++ ++ # Client sends ClientHello ++ try: ++ c.do_handshake() ++ except SSL.WantReadError: ++ pass ++ chunk = c.bio_read(self.LARGE_BUFFER) ++ s.bio_write(chunk) ++ ++ # Server tries DTLSv1_listen, which triggers cookie generation. ++ # The oversized cookie should raise ValueError. ++ with pytest.raises(ValueError, match="Cookie too long"): ++ s.DTLSv1_listen() ++ + def test_timeout(self, monkeypatch): + c_ctx = Context(DTLS_METHOD) + c = Connection(c_ctx) +-- +2.53.0 + + +From d39f020cc63c1da4d44be683f310fbc9f44f61bb Mon Sep 17 00:00:00 2001 +From: Alex Gaynor +Date: Mon, 16 Feb 2026 21:04:37 -0500 +Subject: [PATCH 2/2] Handle exceptions in set_tlsext_servername_callback + callbacks (#1478) + +When the servername callback raises an exception, call sys.excepthook +with the exception info and return SSL_TLSEXT_ERR_ALERT_FATAL to abort +the handshake. Previously, exceptions would propagate uncaught through +the CFFI callback boundary. + +https://claude.ai/code/session_01P7y1XmWkdtC5UcmZwGDvGi + +Co-authored-by: Claude +--- + src/OpenSSL/SSL.py | 9 +++++++-- + tests/test_ssl.py | 50 ++++++++++++++++++++++++++++++++++++++++++++++ + 2 files changed, 57 insertions(+), 2 deletions(-) + +diff --git a/src/OpenSSL/SSL.py b/src/OpenSSL/SSL.py +index e28e10ab81ade8d79aff0cb9232fa71b1fb5314b..a2d5f5b086b3fe27c6e30848cdd027ee60f69677 100644 +--- a/src/OpenSSL/SSL.py ++++ b/src/OpenSSL/SSL.py +@@ -1,5 +1,6 @@ + import os + import socket ++import sys + from errno import errorcode + from functools import partial, wraps + from itertools import chain, count +@@ -1444,8 +1445,12 @@ class Context: + """ + + @wraps(callback) +- def wrapper(ssl, alert, arg): +- callback(Connection._reverse_mapping[ssl]) ++ def wrapper(ssl, alert, arg): # type: ignore[no-untyped-def] ++ try: ++ callback(Connection._reverse_mapping[ssl]) ++ except Exception: ++ sys.excepthook(*sys.exc_info()) ++ return _lib.SSL_TLSEXT_ERR_ALERT_FATAL + return 0 + + self._tlsext_servername_callback = _ffi.callback( +diff --git a/tests/test_ssl.py b/tests/test_ssl.py +index 5f427e92b48e57276fee7acb5ffdbaf136462cee..d42beace175c1ea79929050ec6f88faa539ff6b4 100644 +--- a/tests/test_ssl.py ++++ b/tests/test_ssl.py +@@ -1854,6 +1854,56 @@ class TestServerNameCallback: + + assert args == [(server, b"foo1.example.com")] + ++ def test_servername_callback_exception( ++ self, monkeypatch: pytest.MonkeyPatch ++ ) -> None: ++ """ ++ When the callback passed to `Context.set_tlsext_servername_callback` ++ raises an exception, ``sys.excepthook`` is called with the exception ++ and the handshake fails with an ``Error``. ++ """ ++ exc = TypeError("server name callback failed") ++ ++ def servername(conn: Connection) -> None: ++ raise exc ++ ++ excepthook_calls: list[ ++ tuple[type[BaseException], BaseException, object] ++ ] = [] ++ ++ def custom_excepthook( ++ exc_type: type[BaseException], ++ exc_value: BaseException, ++ exc_tb: object, ++ ) -> None: ++ excepthook_calls.append((exc_type, exc_value, exc_tb)) ++ ++ context = Context(SSLv23_METHOD) ++ context.set_tlsext_servername_callback(servername) ++ ++ # Necessary to actually accept the connection ++ context.use_privatekey(load_privatekey(FILETYPE_PEM, server_key_pem)) ++ context.use_certificate( ++ load_certificate(FILETYPE_PEM, server_cert_pem) ++ ) ++ ++ # Do a little connection to trigger the logic ++ server = Connection(context, None) ++ server.set_accept_state() ++ ++ client = Connection(Context(SSLv23_METHOD), None) ++ client.set_connect_state() ++ client.set_tlsext_host_name(b"foo1.example.com") ++ ++ monkeypatch.setattr(sys, "excepthook", custom_excepthook) ++ with pytest.raises(Error): ++ interact_in_memory(server, client) ++ ++ assert len(excepthook_calls) == 1 ++ assert excepthook_calls[0][0] is TypeError ++ assert excepthook_calls[0][1] is exc ++ assert excepthook_calls[0][2] is not None ++ + + class TestApplicationLayerProtoNegotiation: + """ +-- +2.53.0 + diff --git a/pkgs/by-name/ce/ceph/package.nix b/pkgs/by-name/ce/ceph/package.nix index a39b06cb62a4..fee451951e4d 100644 --- a/pkgs/by-name/ce/ceph/package.nix +++ b/pkgs/by-name/ce/ceph/package.nix @@ -282,7 +282,9 @@ let inherit version; hash = "sha256-hBSYub7GFiOxtsR+u8AjZ8B9YODhlfGXkIF/EMyNsLc="; }; - patches = [ ]; # those two CVE patches do not apply (!) + patches = [ + ./old-python-packages/pyopenssl-Cherry-pick-fix-for-CVE-2026-27459-and-CVE-2026-27448.patch + ]; disabledTests = old.disabledTests or [ ] ++ [ "test_export_md5_digest" ]; diff --git a/pkgs/by-name/go/google-chrome/package.nix b/pkgs/by-name/go/google-chrome/package.nix index ae53d5e834c8..43c7e90c632e 100644 --- a/pkgs/by-name/go/google-chrome/package.nix +++ b/pkgs/by-name/go/google-chrome/package.nix @@ -178,11 +178,11 @@ let linux = stdenvNoCC.mkDerivation (finalAttrs: { inherit pname meta passthru; - version = "148.0.7778.178"; + version = "148.0.7778.215"; src = fetchurl { url = "https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-stable/google-chrome-stable_${finalAttrs.version}-1_amd64.deb"; - hash = "sha256-3iuKxcuwt/+BIcUqC715hbeRLhUjepNU1GbB3daIokI="; + hash = "sha256-IyKMotjgwLJ9AKAl+gE86DWd0GCtQoBjvbbvBiYULSQ="; }; # With strictDeps on, some shebangs were not being patched correctly @@ -292,11 +292,11 @@ let darwin = stdenvNoCC.mkDerivation (finalAttrs: { inherit pname meta passthru; - version = "148.0.7778.179"; + version = "148.0.7778.216"; src = fetchurl { - url = "http://dl.google.com/release2/chrome/adxxii2zvsza6zjfnjbfh6fn4tqq_148.0.7778.179/GoogleChrome-148.0.7778.179.dmg"; - hash = "sha256-QBHyF222wnaEmI79CQFOXQl5WkRNwneCYd/JFNMEEWU="; + url = "http://dl.google.com/release2/chrome/ac3wy6ujyaf3yzk7hqzmyw4nopha_148.0.7778.216/GoogleChrome-148.0.7778.216.dmg"; + hash = "sha256-NauJr7eRVb5q1s38WXijxBAhJ2RryfrrlBc9oBg5HH4="; }; dontPatch = true; diff --git a/pkgs/by-name/ht/html2pdf/package.nix b/pkgs/by-name/ht/html2pdf/package.nix index 3b92226b4059..273364ddd29e 100644 --- a/pkgs/by-name/ht/html2pdf/package.nix +++ b/pkgs/by-name/ht/html2pdf/package.nix @@ -6,6 +6,7 @@ makeWrapper, chromium, withChromium ? (lib.meta.availableOn stdenv.hostPlatform chromium), + versionCheckHook, nix-update-script, }: @@ -41,6 +42,11 @@ rustPlatform.buildRustPackage (finalAttrs: { '' ); + doInstallCheck = true; + nativeInstallCheckInputs = [ + versionCheckHook + ]; + passthru.updateScript = nix-update-script { }; meta = { diff --git a/pkgs/by-name/ja/jackett/package.nix b/pkgs/by-name/ja/jackett/package.nix index 80a9a287fb09..1bb0694ff6d9 100644 --- a/pkgs/by-name/ja/jackett/package.nix +++ b/pkgs/by-name/ja/jackett/package.nix @@ -12,13 +12,13 @@ buildDotnetModule (finalAttrs: { pname = "jackett"; - version = "0.24.1879"; + version = "0.24.1954"; src = fetchFromGitHub { owner = "jackett"; repo = "jackett"; tag = "v${finalAttrs.version}"; - hash = "sha256-gtDN77TB1AKLfqtvFPoQ3tatXB63Ajax2j1gokgHX4s="; + hash = "sha256-HuMK8nW0PRBmRYUYAr3h/hDkVhUGgQIj+7v60ChuKRw="; }; projectFile = "src/Jackett.Server/Jackett.Server.csproj"; diff --git a/pkgs/by-name/kd/kdlfmt/package.nix b/pkgs/by-name/kd/kdlfmt/package.nix index cae9a3ff470e..ca955b6792e9 100644 --- a/pkgs/by-name/kd/kdlfmt/package.nix +++ b/pkgs/by-name/kd/kdlfmt/package.nix @@ -10,16 +10,16 @@ rustPlatform.buildRustPackage (finalAttrs: { pname = "kdlfmt"; - version = "0.1.6"; + version = "0.1.7"; src = fetchFromGitHub { owner = "hougesen"; repo = "kdlfmt"; tag = "v${finalAttrs.version}"; - hash = "sha256-W4a+pPdQv6/XOS3ps1CBCLuspcSAn7FJuvkA5hesvww="; + hash = "sha256-Ftzf4gI7E5tPo8U5ZxUMqlY5+AK5IEUUAll+GsEKYpg="; }; - cargoHash = "sha256-VXg7CVsTuAvXrQNAtzlcJvd24BtS/bQYTGselh4Dzyk="; + cargoHash = "sha256-B/ir+Sf4uxQ9Fqmy6yEa3DMt0qdpfPrwD8lhUMOEUbo="; nativeBuildInputs = [ installShellFiles ]; diff --git a/pkgs/by-name/pr/pretix/package.nix b/pkgs/by-name/pr/pretix/package.nix index ade92ce1e33c..996fdccd9c3f 100644 --- a/pkgs/by-name/pr/pretix/package.nix +++ b/pkgs/by-name/pr/pretix/package.nix @@ -3,6 +3,7 @@ buildNpmPackage, fetchFromGitHub, fetchPypi, + fetchpatch, nodejs, python3, gettext, @@ -78,6 +79,13 @@ python.pkgs.buildPythonApplication rec { # Discover pretix.plugin entrypoints during build and add them into # INSTALLED_APPS, so that their static files are collected. ./plugin-build.patch + + (fetchpatch { + name = "CVE-2026-9712.patch"; + url = "https://github.com/pretix/pretix/commit/db520994041964f6ff26917bfc88dfacb2b1b5ea.patch"; + excludes = [ "src/pretix/__init__.py" ]; + hash = "sha256-NejLY78O+Ahx+dDED+GZ8nY04sxrKWCN5kBlwusyAjw="; + }) ]; pythonRelaxDeps = [ diff --git a/pkgs/by-name/un/unityhub/package.nix b/pkgs/by-name/un/unityhub/package.nix index d3da001a1040..c0d53248ed53 100644 --- a/pkgs/by-name/un/unityhub/package.nix +++ b/pkgs/by-name/un/unityhub/package.nix @@ -11,11 +11,11 @@ stdenv.mkDerivation rec { pname = "unityhub"; - version = "3.16.2"; + version = "3.16.3"; src = fetchurl { url = "https://hub-dist.unity3d.com/artifactory/hub-debian-prod-local/pool/main/u/unity/unityhub_amd64/UnityHubSetup-${version}-amd64.deb"; - hash = "sha256-SvHnIIqNfT2PhyNuKliBl7CsokZE4lrsnbhwtf+1YsA="; + hash = "sha256-Sfgzx2K+38T0v31K4SdtbMS6alAVuOyTS9O89OYjozU="; }; nativeBuildInputs = [ diff --git a/pkgs/servers/samba/4.x.nix b/pkgs/servers/samba/4.x.nix index 502dff10a6f9..6a396c0a90d4 100644 --- a/pkgs/servers/samba/4.x.nix +++ b/pkgs/servers/samba/4.x.nix @@ -79,11 +79,11 @@ let in stdenv.mkDerivation (finalAttrs: { pname = "samba"; - version = "4.22.6"; + version = "4.22.10"; src = fetchurl { url = "https://download.samba.org/pub/samba/stable/samba-${finalAttrs.version}.tar.gz"; - hash = "sha256-jmvrDM6H+zx2OvlMLcIf1HuP0C1Gs8sd6ypy35JZxCU="; + hash = "sha256-5gFDfN5IRaQueBg3nNCtX8T6UYp89ShMwKJlfnmzDDQ="; }; outputs = [ diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index 34a6493fe46e..dfa56dfa88b4 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -13661,7 +13661,7 @@ with pkgs; enableUnfree = true; }; - inherit (ocamlPackages) hol_light; + inherit (ocaml-ng.ocamlPackages_5_3) hol_light; isabelle = callPackage ../by-name/is/isabelle/package.nix { polyml = polyml.overrideAttrs { diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix index 32ecbb4d35ea..a12872f671c8 100644 --- a/pkgs/top-level/perl-packages.nix +++ b/pkgs/top-level/perl-packages.nix @@ -17053,12 +17053,12 @@ with self; }; }; - Imager = buildPerlPackage { + Imager = buildPerlPackage rec { pname = "Imager"; - version = "1.025"; + version = "1.031"; src = fetchurl { - url = "mirror://cpan/authors/id/T/TO/TONYC/Imager-1.025.tar.gz"; - hash = "sha256-TwJ1y7HgEdfz/sYE3GtgwaxvAt78KYs9A31ur3vqcFg="; + url = "mirror://cpan/authors/id/T/TO/TONYC/Imager-${version}.tar.gz"; + hash = "sha256-kL59G9/F7bfxfPgreeamYUxbAuv+Mm67b2afzaeRNAE="; }; buildInputs = [ pkgs.freetype @@ -17075,6 +17075,7 @@ with self; "${pkgs.libpng.out}/lib" ]; meta = { + changelog = "https://metacpan.org/release/TONYC/Imager-${version}/source/Changes"; description = "Perl extension for Generating 24 bit Images"; homepage = "http://imager.perl.org"; license = with lib.licenses; [