Merge release-23.05 into staging-next-23.05

2026-09-19 22:30:23 +00:00 · 2023-12-12 00:13:34 +00:00
parent c087a51134 fecdbce27a
commit bed99e8778
9 changed files with 110 additions and 22 deletions
--- a/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
+++ b/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
@@ -43,13 +43,13 @@ rec {

  thunderbird-115 = (buildMozillaMach rec {
    pname = "thunderbird";
-    version = "115.4.2";
+    version = "115.5.1";
    application = "comm/mail";
    applicationName = "Mozilla Thunderbird";
    binaryName = pname;
    src = fetchurl {
      url = "mirror://mozilla/thunderbird/releases/${version}/source/thunderbird-${version}.source.tar.xz";
-      sha512 = "44cedd5931edbac2ab0babfaf0e71a0262317c01fd7d71e8740bb8f54766c9b49b9e325f1d2796c3a233d4298457d8769b675213a21bef759c46086080bcc8bc";
+      sha512 = "5ddc39b3591427d283c5497f68a1d722409aba54d53342a36a259daa219d8135ecf88868b12235eb9536f46f825722cf6da2781b71a2e10b816281231394b4f9";
    };
    extraPatches = [
      # The file to be patched is different from firefox's `no-buildconfig-ffx90.patch`.
--- a/pkgs/applications/science/misc/root/default.nix
+++ b/pkgs/applications/science/misc/root/default.nix
@@ -122,12 +122,6 @@ stdenv.mkDerivation rec {

  patches = [
    ./sw_vers.patch
-  ] ++ lib.optionals (python.pkgs.pythonAtLeast "3.11") [
-    # Fix build against Python 3.11
-    (fetchpatch {
-      url = "https://github.com/root-project/root/commit/484deb056dacf768aba4954073b41105c431bffc.patch";
-      hash = "sha256-4qur2e3SxMIPgOg4IjlvuULR2BObuP7xdvs+LmNT2/s=";
-    })
  ];

  # Fix build against vanilla LLVM 9
--- a/pkgs/development/libraries/mbedtls/2.nix
+++ b/pkgs/development/libraries/mbedtls/2.nix
@@ -1,6 +1,6 @@
 { callPackage }:

 callPackage ./generic.nix {
-  version = "2.28.3";
-  hash = "sha256-w5bJErCNRZLE8rHcuZlK3bOqel97gPPMKH2cPGUR6Zw=";
+  version = "2.28.5";
+  hash = "sha256-Gl4UQMSvAwYbOi2b/AUMz+zgkOl1o0UA2VveF/3ek8o=";
 }
--- a/pkgs/development/libraries/mbedtls/3.4.0-CVE-2023-45199.patch
+++ b/pkgs/development/libraries/mbedtls/3.4.0-CVE-2023-45199.patch
@@ -0,0 +1,78 @@
+Based on upstream 130938a80403647dc22a3e15ca442a500248647b, alterations
+mostly due to ecdh_psa_peerkey being renamed xxdh_psa_peerkey upstream
+
+--- a/library/ssl_tls12_client.c
+++ b/library/ssl_tls12_client.c
+@@ -1714,7 +1714,7 @@ static int ssl_parse_server_ecdh_params(mbedtls_ssl_context *ssl,
+                                         unsigned char *end)
+ {
+     uint16_t tls_id;
+-    uint8_t ecpoint_len;
+    size_t ecpoint_len;
+     mbedtls_ssl_handshake_params *handshake = ssl->handshake;
+     psa_ecc_family_t ec_psa_family = 0;
+     size_t ec_bits = 0;
+@@ -2039,7 +2039,7 @@ static int ssl_get_ecdh_params_from_cert(mbedtls_ssl_context *ssl)
+     ret = mbedtls_ecp_point_write_binary(&peer_key->grp, &peer_key->Q,
+                                          MBEDTLS_ECP_PF_UNCOMPRESSED, &olen,
+                                          ssl->handshake->ecdh_psa_peerkey,
+-                                         MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH);
+                                         sizeof(ssl->handshake->ecdh_psa_peerkey));
+ 
+     if (ret != 0) {
+         MBEDTLS_SSL_DEBUG_RET(1, ("mbedtls_ecp_point_write_binary"), ret);
+--- a/library/ssl_tls12_server.c
+++ b/library/ssl_tls12_server.c
+@@ -3667,22 +3667,32 @@ static int ssl_parse_client_key_exchange(mbedtls_ssl_context *ssl)
+         psa_status_t status = PSA_ERROR_GENERIC_ERROR;
+         mbedtls_ssl_handshake_params *handshake = ssl->handshake;
+ 
+-        MBEDTLS_SSL_DEBUG_MSG(1, ("Read the peer's public key."));
+        MBEDTLS_SSL_DEBUG_MSG(3, ("Read the peer's public key."));
+ 
+         /*
+          * We must have at least two bytes (1 for length, at least 1 for data)
+          */
+         if (buf_len < 2) {
+-            MBEDTLS_SSL_DEBUG_MSG(1, ("Invalid buffer length"));
+-            return MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
+            MBEDTLS_SSL_DEBUG_MSG(1, ("Invalid buffer length: %" MBEDTLS_PRINTF_SIZET,
+                                      buf_len));
+            return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
+         }
+ 
+         if (data_len < 1 || data_len > buf_len) {
+-            MBEDTLS_SSL_DEBUG_MSG(1, ("Invalid data length"));
+-            return MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
+            MBEDTLS_SSL_DEBUG_MSG(1, ("Invalid data length: %" MBEDTLS_PRINTF_SIZET
+                                      " > %" MBEDTLS_PRINTF_SIZET,
+                                      data_len, buf_len));
+            return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
+         }
+ 
+         /* Store peer's ECDH public key. */
+        if (data_len > sizeof(handshake->ecdh_psa_peerkey)) {
+            MBEDTLS_SSL_DEBUG_MSG(1, ("Invalid public key length: %" MBEDTLS_PRINTF_SIZET
+                                      " > %" MBEDTLS_PRINTF_SIZET,
+                                      data_len,
+                                      sizeof(handshake->ecdh_psa_peerkey)));
+            return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
+        }
+         memcpy(handshake->ecdh_psa_peerkey, p, data_len);
+         handshake->ecdh_psa_peerkey_len = data_len;
+ 
+--- a/library/ssl_tls13_generic.c
+++ b/library/ssl_tls13_generic.c
+@@ -1447,6 +1447,12 @@ int mbedtls_ssl_tls13_read_public_ecdhe_share(mbedtls_ssl_context *ssl,
+     MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, peerkey_len);
+ 
+     /* Store peer's ECDH public key. */
+    if (peerkey_len > sizeof(handshake->ecdh_psa_peerkey)) {
+        MBEDTLS_SSL_DEBUG_MSG(1, ("Invalid public key length: %u > %" MBEDTLS_PRINTF_SIZET,
+                                  (unsigned) peerkey_len,
+                                  sizeof(handshake->ecdh_psa_peerkey)));
+        return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
+    }
+     memcpy(handshake->ecdh_psa_peerkey, p, peerkey_len);
+     handshake->ecdh_psa_peerkey_len = peerkey_len;
+ 
--- a/pkgs/development/libraries/mbedtls/3.nix
+++ b/pkgs/development/libraries/mbedtls/3.nix
@@ -1,6 +1,14 @@
-{ callPackage }:
+{ callPackage, fetchpatch }:

 callPackage ./generic.nix {
  version = "3.4.0";
  hash = "sha256-1YA4hp/VEjph5k0qJqhhH4nBbTP3Qu2pl7WpuvPkVfg=";
+  patches = [
+    ./3.4.0-CVE-2023-45199.patch
+    (fetchpatch {
+      name = "CVE-2023-43615.patch";
+      url = "https://github.com/Mbed-TLS/mbedtls/commit/faf0b8604ac49456b0cff7a34ad27485ca145cce.patch";
+      hash = "sha256-GFx+7TmhthRbwBnTgTdNhokftsGwIY7cQGhxKf3WZcE=";
+    })
+  ];
 }
--- a/pkgs/development/libraries/mbedtls/generic.nix
+++ b/pkgs/development/libraries/mbedtls/generic.nix
@@ -3,6 +3,7 @@
 , version
 , hash
 , fetchFromGitHub
+, patches ? []

 , cmake
 , ninja
@@ -14,7 +15,7 @@

 stdenv.mkDerivation rec {
  pname = "mbedtls";
-  inherit version;
+  inherit version patches;

  src = fetchFromGitHub {
    owner = "Mbed-TLS";
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -1,7 +1,7 @@
 {
    "testing": {
-        "version": "6.7-rc4",
-        "hash": "sha256:1igynlm5pv62brfkyjh6w8lzvmmy8c3g8phrn5wgdyy8svc48r8h"
+        "version": "6.7-rc5",
+        "hash": "sha256:125zdj2sxcwkfvm2ckjk3mbwfll8950bn7kr38s5pvlx2a10zv04"
    },
    "6.5": {
        "version": "6.5.13",
@@ -12,8 +12,8 @@
        "hash": "sha256:0zgj1z97jyx7wf12zrnlcp0mj4cl43ais9qsy6dh1jwylf2fq9ln"
    },
    "6.1": {
-        "version": "6.1.66",
-        "hash": "sha256:030sxwzqlf9jg57j1hvd46ffkc9yfplbk3b81faycfa2dk6n57j1"
+        "version": "6.1.67",
+        "hash": "sha256:11cjqll3b7iq3mblwyzjrd5ph8avgk23f4mw4shm8j6ai5rdndvm"
    },
    "5.15": {
        "version": "5.15.142",
@@ -36,7 +36,7 @@
        "hash": "sha256:1f4q0acbp917myjmgiy4haxp78yak5h1rj5g937r6mkykwb6nb14"
    },
    "6.6": {
-        "version": "6.6.5",
-        "hash": "sha256:17miac3h4kvj4yyf042qsmpsivpq243db5v0ay6233d6aic7k4kw"
+        "version": "6.6.6",
+        "hash": "sha256:1j14n8b012pv3r7i9p762jyabzn2nv1ranxyw5lk3c9lg68hmxzb"
    }
 }
--- a/pkgs/servers/http/couchdb/3.nix
+++ b/pkgs/servers/http/couchdb/3.nix
@@ -11,11 +11,11 @@

 stdenv.mkDerivation rec {
  pname = "couchdb";
-  version = "3.3.2";
+  version = "3.3.3";

  src = fetchurl {
    url = "mirror://apache/couchdb/source/${version}/apache-${pname}-${version}.tar.gz";
-    hash = "sha256-PWgj1C0Qzw1PhsnE/lnJkyyJ1oV4/LbEtCeNx2kwjao=";
+    hash = "sha256-eiAHtfZz1L4iolyaER2QZpGdhy3bkTWn3OwBIimb054=";
  };

  postPatch = ''
--- a/pkgs/tools/misc/yt-dlp/default.nix
+++ b/pkgs/tools/misc/yt-dlp/default.nix
@@ -9,6 +9,7 @@
 , pycryptodomex
 , websockets
 , mutagen
+, requests
 , secretstorage
 , atomicparsleySupport ? true
 , ffmpegSupport ? true
@@ -22,11 +23,11 @@ buildPythonPackage rec {
  # The websites yt-dlp deals with are a very moving target. That means that
  # downloads break constantly. Because of that, updates should always be backported
  # to the latest stable release.
-  version = "2023.10.13";
+  version = "2023.11.14";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-4CbqHENf827vEhW8TFu4xHmTi5AFSZe6mfY6RUH+Y7Q=";
+    hash = "sha256-s8JTU7oQaSLYcKWlnk1qLrhXg+vRfinsQ1vD4XZN6L4=";
  };

  propagatedBuildInputs = [
@@ -34,6 +35,7 @@ buildPythonPackage rec {
    certifi
    mutagen
    pycryptodomex
+    requests
    secretstorage  # "optional", as in not in requirements.txt, needed for `--cookies-from-browser`
    websockets
  ];
@@ -62,6 +64,11 @@ buildPythonPackage rec {
    ln -s "$out/bin/yt-dlp" "$out/bin/youtube-dl"
  '';

+  postPatch = ''
+    substituteInPlace requirements.txt \
+      --replace "requests>=2.31.0" "requests>=2.29.0"
+  '';
+
  passthru.updateScript = [ update-python-libraries (toString ./.) ];

  meta = with lib; {