From fe0a80d95435c44fc90a7eee4f0a49060778296b Mon Sep 17 00:00:00 2001 From: TredwellGit Date: Sun, 30 May 2021 02:08:18 +0000 Subject: [PATCH 1/7] lz4: patch CVE-2021-3520 and null pointer dereference (cherry picked from commit 2acd087dca93a3b589721b3ec32d13d9150684bb) --- pkgs/tools/compression/lz4/default.nix | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/pkgs/tools/compression/lz4/default.nix b/pkgs/tools/compression/lz4/default.nix index 6bc365b8e1e1..82970f4cf55a 100644 --- a/pkgs/tools/compression/lz4/default.nix +++ b/pkgs/tools/compression/lz4/default.nix @@ -13,6 +13,19 @@ stdenv.mkDerivation rec { owner = pname; }; + patches = [ + (fetchpatch { # https://github.com/lz4/lz4/pull/972 + name = "CVE-2021-3520.patch"; + url = "https://github.com/lz4/lz4/commit/8301a21773ef61656225e264f4f06ae14462bca7.patch"; + sha256 = "0r1cwpqdkdc8im0pf2r5jp7mwwn69xcw405rrk7rc0mpjcp5ydfk"; + }) + (fetchpatch { # https://github.com/lz4/lz4/pull/973 + name = "avoid-null-pointer-dereference.patch"; + url = "https://github.com/lz4/lz4/commit/29a6a1f4941e7243241fe00d6c13b749fd6b60c2.patch"; + sha256 = "0v5yl5hd3qrfm3xm7m06j4b21qwllb4cqkjn2az7x1vnzqgpf8y7"; + }) + ]; + # TODO(@Ericson2314): Separate binaries and libraries outputs = [ "bin" "out" "dev" ]; From 87afa273198a99d49f1838ab3961ab231dea3924 Mon Sep 17 00:00:00 2001 From: Andreas Rammhold Date: Wed, 18 Nov 2020 15:51:51 +0100 Subject: [PATCH 2/7] cacert: decouple from NSS to reduce rebuild amount In [#100765] @vcunat pointed out that we could decouple cacert from the NSS package to make it more rebuild friendly. Just rebuilding packages that depend on NSS seems to be about ~100. Rebuilding all the packages that depend on cacert is >9k as of this writing. This makes it much more feasible to upgrade high-profile packages that are (rightfully) pedantic on their NSS version like firefox and thunderbird. [#100765]: https://github.com/NixOS/nixpkgs/pull/100765 (cherry picked from commit 94448baf6d53714b249e91c150e8a7121508bf52) --- pkgs/data/misc/cacert/default.nix | 10 +++++++-- pkgs/data/misc/cacert/update.sh | 34 +++++++++++++++++++++++++++++++ 2 files changed, 42 insertions(+), 2 deletions(-) create mode 100755 pkgs/data/misc/cacert/update.sh diff --git a/pkgs/data/misc/cacert/default.nix b/pkgs/data/misc/cacert/default.nix index 42833cde11c1..0545c0e5efae 100644 --- a/pkgs/data/misc/cacert/default.nix +++ b/pkgs/data/misc/cacert/default.nix @@ -17,12 +17,17 @@ let sha256 = "1d4q27j1gss0186a5m8bs5dk786w07ccyq0qi6xmd2zr1a8q16wy"; }; + version = "3.57"; + underscoreVersion = builtins.replaceStrings ["."] ["_"] version; in stdenv.mkDerivation { - name = "nss-cacert-${nss.version}"; + name = "nss-cacert-${version}"; - src = nss.src; + src = fetchurl { + url = "mirror://mozilla/security/nss/releases/NSS_${underscoreVersion}_RTM/src/nss-${version}.tar.gz"; + sha256 = "55a86c01be860381d64bb4e5b94eb198df9b0f098a8af0e58c014df398bdc382"; + }; outputs = [ "out" "unbundled" ]; @@ -59,6 +64,7 @@ stdenv.mkDerivation { setupHook = ./setup-hook.sh; + passthru.updateScript = ./update.sh; passthru.tests = { # Test that building this derivation with a blacklist works, and that UTF-8 is supported. blacklist-utf8 = let diff --git a/pkgs/data/misc/cacert/update.sh b/pkgs/data/misc/cacert/update.sh new file mode 100755 index 000000000000..7bf3d46cb02f --- /dev/null +++ b/pkgs/data/misc/cacert/update.sh @@ -0,0 +1,34 @@ +#!/usr/bin/env nix-shell +#!nix-shell -i bash -p nix common-updater-scripts jq + +# Build both the cacert package and an overriden version where we use the source attribute of NSS. +# Cacert and NSS are both from the same upstream sources. They are decoupled as +# the cacert output only cares about a few infrequently changing files in the +# sources while the NSS source code changes frequently. +# +# By having cacert on a older source revision that produces the same +# certificate output as a newer version we can avoid large amounts of +# unnecessary rebuilds. +# +# As of this writing there are a few magnitudes more packages depending on +# cacert than on nss. + + +set -ex + +BASEDIR="$(dirname "$0")/../../../.." + + +CURRENT_PATH=$(nix-build --no-out-link -A cacert.out) +PATCHED_PATH=$(nix-build --no-out-link -E "with import $BASEDIR {}; (cacert.overrideAttrs (_: { inherit (nss) src version; })).out") + +# Check the hash of the etc subfolder +# We can't check the entire output as that contains the nix-support folder +# which contains the output path itself. +CURRENT_HASH=$(nix-hash "$CURRENT_PATH/etc") +PATCHED_HASH=$(nix-hash "$PATCHED_PATH/etc") + +if [[ "$CURRENT_HASH" != "$PATCHED_HASH" ]]; then + NSS_VERSION=$(nix-instantiate --json --eval -E "with import $BASEDIR {}; nss.version" | jq -r .) + update-source-version cacert "$NSS_VERSION" +fi From 1edf0c52f87044e2f5b16739ddd88f32241ebf42 Mon Sep 17 00:00:00 2001 From: Luke Granger-Brown Date: Tue, 1 Dec 2020 09:49:47 +0000 Subject: [PATCH 3/7] cacert: fix blacklist It's broken under Python 3, ironically due to the patch we're carrying. Fix it, and add a test to check it works. Fixes #93230. (cherry picked from commit b1f9e9c25935b3fbc02c23331315b75d8e43cc93) --- pkgs/data/misc/cacert/default.nix | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/pkgs/data/misc/cacert/default.nix b/pkgs/data/misc/cacert/default.nix index 0545c0e5efae..1f4a8c461392 100644 --- a/pkgs/data/misc/cacert/default.nix +++ b/pkgs/data/misc/cacert/default.nix @@ -1,5 +1,6 @@ { stdenv, fetchurl, nss, python3 , blacklist ? [] +, includeEmail ? false # Used for tests only , runCommand @@ -41,6 +42,10 @@ stdenv.mkDerivation { EOF cat ${certdata2pem} > certdata2pem.py + ${optionalString includeEmail '' + # Disable CAs used for mail signing + substituteInPlace certdata2pem.py --replace \[\'CKA_TRUST_EMAIL_PROTECTION\'\] ''' + ''} ''; buildPhase = '' From c617658898d8edef22cb74fbc0cb1c9fa57e3373 Mon Sep 17 00:00:00 2001 From: ajs124 Date: Fri, 11 Dec 2020 17:26:00 +0100 Subject: [PATCH 4/7] cacert: 3.57 -> 3.60 (cherry picked from commit 11d63553084076be269bd27ecd96e00561d78191) --- pkgs/data/misc/cacert/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/data/misc/cacert/default.nix b/pkgs/data/misc/cacert/default.nix index 1f4a8c461392..6e532df0949d 100644 --- a/pkgs/data/misc/cacert/default.nix +++ b/pkgs/data/misc/cacert/default.nix @@ -18,7 +18,7 @@ let sha256 = "1d4q27j1gss0186a5m8bs5dk786w07ccyq0qi6xmd2zr1a8q16wy"; }; - version = "3.57"; + version = "3.60"; underscoreVersion = builtins.replaceStrings ["."] ["_"] version; in @@ -27,7 +27,7 @@ stdenv.mkDerivation { src = fetchurl { url = "mirror://mozilla/security/nss/releases/NSS_${underscoreVersion}_RTM/src/nss-${version}.tar.gz"; - sha256 = "55a86c01be860381d64bb4e5b94eb198df9b0f098a8af0e58c014df398bdc382"; + sha256 = "hKvVV1q4dMU65RG9Rh5dCGjRobOE7kB1MVTN0dWQ/j0="; }; outputs = [ "out" "unbundled" ]; From 1c1d27fbf49c1b6b71f1830af8723f7b5151f89a Mon Sep 17 00:00:00 2001 From: ajs124 Date: Thu, 18 Mar 2021 18:28:29 +0100 Subject: [PATCH 5/7] cacert: 3.60 -> 3.63 (cherry picked from commit 8dbc855b491f4050a8bbde0789949d52fb9082fe) --- pkgs/data/misc/cacert/default.nix | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/pkgs/data/misc/cacert/default.nix b/pkgs/data/misc/cacert/default.nix index 6e532df0949d..fab6ab3a6a0e 100644 --- a/pkgs/data/misc/cacert/default.nix +++ b/pkgs/data/misc/cacert/default.nix @@ -18,7 +18,8 @@ let sha256 = "1d4q27j1gss0186a5m8bs5dk786w07ccyq0qi6xmd2zr1a8q16wy"; }; - version = "3.60"; + version = "3.63"; + underscoreVersion = builtins.replaceStrings ["."] ["_"] version; in @@ -27,7 +28,7 @@ stdenv.mkDerivation { src = fetchurl { url = "mirror://mozilla/security/nss/releases/NSS_${underscoreVersion}_RTM/src/nss-${version}.tar.gz"; - sha256 = "hKvVV1q4dMU65RG9Rh5dCGjRobOE7kB1MVTN0dWQ/j0="; + sha256 = "0892xbjcaw6g4rd2rs4qa37nbda248cjrgxa4faaw0licbpjyb8q"; }; outputs = [ "out" "unbundled" ]; From d1581e7c64a811ea7da91efbf8ae73e61f04d670 Mon Sep 17 00:00:00 2001 From: ajs124 Date: Tue, 1 Jun 2021 23:11:58 +0200 Subject: [PATCH 6/7] cacert: 3.63 -> 3.66 mozilla says this is CA version 2.50, up from 2.48 in nss 3.63 (cherry picked from commit e579e93b6517c29af8b84641d2ec16a064d34c8b) --- pkgs/data/misc/cacert/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/data/misc/cacert/default.nix b/pkgs/data/misc/cacert/default.nix index fab6ab3a6a0e..6bc51666c75f 100644 --- a/pkgs/data/misc/cacert/default.nix +++ b/pkgs/data/misc/cacert/default.nix @@ -18,7 +18,7 @@ let sha256 = "1d4q27j1gss0186a5m8bs5dk786w07ccyq0qi6xmd2zr1a8q16wy"; }; - version = "3.63"; + version = "3.66"; underscoreVersion = builtins.replaceStrings ["."] ["_"] version; in @@ -28,7 +28,7 @@ stdenv.mkDerivation { src = fetchurl { url = "mirror://mozilla/security/nss/releases/NSS_${underscoreVersion}_RTM/src/nss-${version}.tar.gz"; - sha256 = "0892xbjcaw6g4rd2rs4qa37nbda248cjrgxa4faaw0licbpjyb8q"; + sha256 = "1jfdnh5l4k57r2vb07s06hqi7m2qzk0d9x25lsdsrw3cflx9x9w9"; }; outputs = [ "out" "unbundled" ]; From 5dea2ca9a154cc7dca8fa7378918d39b67e8fc45 Mon Sep 17 00:00:00 2001 From: Andreas Rammhold Date: Sun, 30 May 2021 16:54:09 +0200 Subject: [PATCH 7/7] cacerts: Make updater script aware of the nss_latest attribute Usually, on the stable channel, we have a nss_latest attribute that is more up to date than the nss attribute (which is usually frozen during branch-off and only receives security updates). Cacerts are a sensitive matter and should be updated more frequently than the stable NSS package, if required. By making the update script aware of the nss_latest attribute we can prefer that when it exists. By having this change in the unstable branch of Nixpgks we can carry it from release to release without requiring more churn from those doing the stable release maintenance. (cherry picked from commit 4e318bcca19e7972d1fa8b15c4eadf85e3d5a6a1) --- pkgs/data/misc/cacert/update.sh | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/pkgs/data/misc/cacert/update.sh b/pkgs/data/misc/cacert/update.sh index 7bf3d46cb02f..1c286dc6206f 100755 --- a/pkgs/data/misc/cacert/update.sh +++ b/pkgs/data/misc/cacert/update.sh @@ -12,6 +12,14 @@ # # As of this writing there are a few magnitudes more packages depending on # cacert than on nss. +# +# If the current nixpkgs revision contains the attribute `nss_latest` that will +# be used instead of `nss`. This is done to help the stable branch maintenance +# where (usually) after branch-off during the first Firefox upgrade that +# requries a new NSS version that attribute is introduced. +# By having this change in the unstable branch we can safely carry it from +# release to release without requiring more backport churn on those doing the +# stable maintenance. set -ex @@ -20,7 +28,7 @@ BASEDIR="$(dirname "$0")/../../../.." CURRENT_PATH=$(nix-build --no-out-link -A cacert.out) -PATCHED_PATH=$(nix-build --no-out-link -E "with import $BASEDIR {}; (cacert.overrideAttrs (_: { inherit (nss) src version; })).out") +PATCHED_PATH=$(nix-build --no-out-link -E "with import $BASEDIR {}; let nss_pkg = pkgs.nss_latest or pkgs.nss; in (cacert.overrideAttrs (_: { inherit (nss_pkg) src version; })).out") # Check the hash of the etc subfolder # We can't check the entire output as that contains the nix-support folder