nathan/nixpkgs
1
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2026-09-29 19:30:11 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'staging-22.05' into staging-next-22.05

Browse Source
This commit is contained in:
Vladimír Čunát
2022-08-31 12:13:10 +02:00
parent ec0c5b3376 838e102f80
commit d5f435b411
17 changed files with 112 additions and 137 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
pkgs/applications/editors/vim/common.nix
View File

@@ -1,12 +1,12 @@
{ lib, fetchFromGitHub }:
rec {
version = "9.0.0115";
version = "9.0.0244";
src = fetchFromGitHub {
owner = "vim";
repo = "vim";
rev = "v${version}";
sha256 = "sha256-McotjgjN+ze1jdaAxkdJGTqIIIuOlHENriHdMrYSf5w=";
sha256 = "sha256-l6fLM6+tc1Wy1mjNPa/s73GKhhGBLz3OXUJgJN1wuxY=";
};
enableParallelBuilding = true;

29
pkgs/applications/networking/sync/rsync/base.nix
View File

@@ -1,29 +0,0 @@
{ lib, fetchurl, fetchpatch }:
rec {
version = "3.2.3";
src = fetchurl {
# signed with key 0048 C8B0 26D4 C96F 0E58 9C2F 6C85 9FB1 4B96 A8C5
url = "mirror://samba/rsync/src/rsync-${version}.tar.gz";
sha256 = "03p5dha9g9krq61mdbcrjkpz5nglri0009ks2vs9k97f9i83rk5y";
};
upstreamPatchTarball = fetchurl {
# signed with key 0048 C8B0 26D4 C96F 0E58 9C2F 6C85 9FB1 4B96 A8C5
url = "mirror://samba/rsync/rsync-patches-${version}.tar.gz";
sha256 = "1wj21v57v135n6fnmlm2dxmb9lhrrg62jgkggldp1gb7d6s4arny";
};
extraPatches = [
(fetchpatch {
name = "CVE-2020-14387.patch";
url = "https://git.samba.org/?p=rsync.git;a=patch;h=c3f7414;hp=4c4fce51072c9189cfb11b52aa54fed79f5741bd";
sha256 = "000lyx48lns84p53nsdlr45mb9558lrvnsz3yic0y3z6h2izv82x";
})
];
meta = with lib; {
description = "Fast incremental file transfer utility";
homepage = "https://rsync.samba.org/";
license = licenses.gpl3Plus;
platforms = platforms.unix;
};
}

44
pkgs/applications/networking/sync/rsync/default.nix
View File

@@ -1,7 +1,6 @@
{ lib
, stdenv
, fetchurl
, fetchpatch
, perl
, libiconv
, zlib
@@ -16,24 +15,27 @@
, xxHash
, enableZstd ? true
, zstd
, enableCopyDevicesPatch ? false
, nixosTests
, enableCopyDevicesPatch ? false
}:
let
base = import ./base.nix { inherit lib fetchurl fetchpatch; };
mkDerivation = lib.warnIf
enableCopyDevicesPatch
"enableCopyDevicesPatch in pkgs.rsync is not needed anymore"
stdenv.mkDerivation;
in
stdenv.mkDerivation rec {
mkDerivation rec {
pname = "rsync";
version = base.version;
version = "3.2.5";
mainSrc = base.src;
src = fetchurl {
# signed with key 0048 C8B0 26D4 C96F 0E58 9C2F 6C85 9FB1 4B96 A8C5
url = "mirror://samba/rsync/src/rsync-${version}.tar.gz";
sha256 = "sha256-KsTSFjXN95GGe8N3w1ym3af1DZGaWL5FBX/VFgDGmro=";
};
patchesSrc = base.upstreamPatchTarball;
srcs = [ mainSrc ] ++ lib.optional enableCopyDevicesPatch patchesSrc;
patches = lib.optional enableCopyDevicesPatch "./patches/copy-devices.diff"
++ base.extraPatches;
nativeBuildInputs = [ perl ];
buildInputs = [ libiconv zlib popt ]
++ lib.optional enableACLs acl
@@ -41,7 +43,6 @@ stdenv.mkDerivation rec {
++ lib.optional enableLZ4 lz4
++ lib.optional enableOpenSSL openssl
++ lib.optional enableXXHash xxHash;
nativeBuildInputs = [ perl ];
configureFlags = [
"--with-nobody-group=nogroup"
@@ -49,20 +50,15 @@ stdenv.mkDerivation rec {
# disable the included zlib explicitly as it otherwise still compiles and
# links them even.
"--with-included-zlib=no"
]
# Work around issue with cross-compilation:
# configure.sh: error: cannot run test program while cross compiling
# Remove once 3.2.4 or more recent is released.
# The following PR should fix the cross-compilation issue.
# Test using `nix-build -A pkgsCross.aarch64-multiplatform.rsync`.
# https://github.com/WayneD/rsync/commit/b7fab6f285ff0ff3816b109a8c3131b6ded0b484
++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform) "--enable-simd=no"
;
];
passthru.tests = { inherit (nixosTests) rsyncd; };
meta = base.meta // {
description = "A fast incremental file transfer utility";
maintainers = with lib.maintainers; [ ehmry kampfschlaefer ];
meta = with lib; {
description = "Fast incremental file transfer utility";
homepage = "https://rsync.samba.org/";
license = licenses.gpl3Plus;
platforms = platforms.unix;
maintainers = with lib.maintainers; [ ehmry kampfschlaefer ivan ];
};
}

12
pkgs/applications/networking/sync/rsync/rrsync.nix
View File

@@ -1,13 +1,8 @@
{ lib, stdenv, fetchurl, perl, rsync, fetchpatch }:
let
base = import ./base.nix { inherit lib fetchurl fetchpatch; };
in
stdenv.mkDerivation {
pname = "rrsync";
version = base.version;
src = base.src;
inherit (rsync) version src;
buildInputs = [ rsync perl ];
@@ -16,7 +11,7 @@ stdenv.mkDerivation {
dontConfigure = true;
dontBuild = true;
patches = base.extraPatches;
inherit (rsync) patches;
postPatch = ''
substituteInPlace support/rrsync --replace /usr/bin/rsync ${rsync}/bin/rsync
@@ -28,8 +23,7 @@ stdenv.mkDerivation {
chmod a+x $out/bin/rrsync
'';
meta = base.meta // {
meta = rsync.meta // {
description = "A helper to run rsync-only environments from ssh-logins";
maintainers = [ lib.maintainers.kampfschlaefer ];
};
}

4
pkgs/development/compilers/go/1.17.nix
View File

@@ -60,11 +60,11 @@ in
stdenv.mkDerivation rec {
pname = "go";
version = "1.17.10";
version = "1.17.13";
src = fetchurl {
url = "https://dl.google.com/go/go${version}.src.tar.gz";
sha256 = "sha256-KZ5VrzDxVpGwFdjc+OyuckEkElaeWy7OIDYXU6RW8vk=";
sha256 = "sha256-oaSLI6+yBvlee7qpuJjZZfkIJvbx0fwMHXhK2gzTAP0=";
};
strictDeps = true;

4
pkgs/development/compilers/go/1.18.nix
View File

@@ -60,11 +60,11 @@ in
stdenv.mkDerivation rec {
pname = "go";
version = "1.18.2";
version = "1.18.5";
src = fetchurl {
url = "https://go.dev/dl/go${version}.src.tar.gz";
sha256 = "sha256-LETQPqLDQJITerkZumAvLCYaA40I60aFKKPzoo5WZ+I=";
sha256 = "sha256-mSDTMGoaxTbN0seW1ss8VLxVnCJvw8w5wy8eC9f1DSo=";
};
strictDeps = true;

5
pkgs/development/libraries/libtiff/default.nix
View File

@@ -98,6 +98,11 @@ stdenv.mkDerivation rec {
url = "https://gitlab.com/libtiff/libtiff/-/commit/275735d0354e39c0ac1dc3c0db2120d6f31d1990.patch";
sha256 = "sha256-faKsdJjvQwNdkAKjYm4vubvZvnULt9zz4l53zBFr67s=";
})
(fetchpatch {
name = "CVE-2022-2867.CVE-2022-2868.CVE-2022-2869.patch";
url = "https://gitlab.com/libtiff/libtiff/-/commit/d46af879bc4e789f95a7828fa566f61700954393.patch";
sha256 = "sha256-LUzcYU6Tfn+5cJBh0IMaVVCzcuEIF+HJ3ic9Ng7FrK4=";
})
];
postPatch = ''

4
pkgs/development/libraries/libwebp/default.nix
View File

@@ -15,13 +15,13 @@
stdenv.mkDerivation rec {
pname = "libwebp";
version = "1.2.3";
version = "1.2.4";
src = fetchFromGitHub {
owner = "webmproject";
repo = pname;
rev = "v${version}";
hash = "sha256-t27d+eJR4iTHSLlI3J7RqHgsWACThjsI9O6R2Zb9F1g=";
hash = "sha256-XX6qOWlIl8TqOQMiGpmmDVKwQnM1taG6lrqq1ZFVk5s=";
};
prePatch = "patchShebangs .";

11
pkgs/development/libraries/nss/ckpem.patch
View File

@@ -1,11 +0,0 @@
--- nss/lib/ckfw/pem/ckpem.h 2018-01-03 13:36:12.000000000 -0800
+++ nss/lib/ckfw/pem/ckpem.h 2018-01-03 13:36:20.000000000 -0800
@@ -156,8 +156,6 @@
NSS_EXTERN_DATA pemInternalObject nss_pem_data[];
NSS_EXTERN_DATA const PRUint32 nss_pem_nObjects;
- PRBool logged_in;
-
/* our raw object data array */
NSS_EXTERN_DATA pemInternalObject nss_pem_data[];
NSS_EXTERN_DATA const PRUint32 nss_pem_nObjects;

33
pkgs/development/libraries/nss/generic.nix
View File

@@ -18,11 +18,6 @@
}:
let
nssPEM = fetchurl {
url = "http://dev.gentoo.org/~polynomial-c/mozilla/nss-3.15.4-pem-support-20140109.patch.xz";
sha256 = "10ibz6y0hknac15zr6dw4gv9nb5r5z9ym6gq18j3xqx7v7n3vpdw";
};
underscoreVersion = lib.replaceStrings [ "." ] [ "_" ] version;
in
stdenv.mkDerivation rec {
@@ -43,23 +38,6 @@ stdenv.mkDerivation rec {
propagatedBuildInputs = [ nspr ];
prePatch = ''
# strip the trailing whitespace from the patch line and the renamed CKO_NETSCAPE_ enum to CKO_NSS_
xz -d < ${nssPEM} | sed \
-e 's/-DIRS = builtins $/-DIRS = . builtins/g' \
-e 's/CKO_NETSCAPE_/CKO_NSS_/g' \
-e 's/CKT_NETSCAPE_/CKT_NSS_/g' \
| patch -p1
patchShebangs nss
for f in nss/coreconf/config.gypi nss/build.sh nss/coreconf/config.gypi; do
substituteInPlace "$f" --replace "/usr/bin/env" "${buildPackages.coreutils}/bin/env"
done
substituteInPlace nss/coreconf/config.gypi --replace "/usr/bin/grep" "${buildPackages.coreutils}/bin/env grep"
'';
patches = [
# Based on http://patch-tracker.debian.org/patch/series/dl/nss/2:3.15.4-1/85_security_load.patch
(if (lib.versionOlder version "3.77") then
@@ -67,13 +45,20 @@ stdenv.mkDerivation rec {
else
./85_security_load_3.77+.patch
)
./ckpem.patch
./fix-cross-compilation.patch
];
patchFlags = [ "-p0" ];
postPatch = lib.optionalString stdenv.hostPlatform.isDarwin ''
postPatch = ''
patchShebangs nss
for f in nss/coreconf/config.gypi nss/build.sh nss/coreconf/config.gypi; do
substituteInPlace "$f" --replace "/usr/bin/env" "${buildPackages.coreutils}/bin/env"
done
substituteInPlace nss/coreconf/config.gypi --replace "/usr/bin/grep" "${buildPackages.coreutils}/bin/env grep"
'' + lib.optionalString stdenv.hostPlatform.isDarwin ''
substituteInPlace nss/coreconf/Darwin.mk --replace '@executable_path/$(notdir $@)' "$out/lib/\$(notdir \$@)"
substituteInPlace nss/coreconf/config.gypi --replace "'DYLIB_INSTALL_NAME_BASE': '@executable_path'" "'DYLIB_INSTALL_NAME_BASE': '$out/lib'"
'';

15
pkgs/development/libraries/sqlite/CVE-2022-35737.patch Normal file
View File

@@ -0,0 +1,15 @@
diff --git a/sqlite3.c b/sqlite3.c
index eb8d7d5..3918a09 100644
--- a/sqlite3.c
+++ b/sqlite3.c
@@ -30231,8 +30231,8 @@ SQLITE_API void sqlite3_str_vappendf(
case etSQLESCAPE: /* %q: Escape ' characters */
case etSQLESCAPE2: /* %Q: Escape ' and enclose in '...' */
case etSQLESCAPE3: { /* %w: Escape " characters */
- int i, j, k, n, isnull;
- int needQuote;
+ i64 i, j, k, n;
+ int needQuote, isnull;
char ch;
char q = ((xtype==etSQLESCAPE3)?'"':'\''); /* Quote character */
char *escarg;

2
pkgs/development/libraries/sqlite/default.nix
View File

@@ -21,6 +21,8 @@ stdenv.mkDerivation rec {
sha256 = "sha256-WvB96YK6ZY/ZGgMXDJRfmclx9pVbx53zJmVENz45hpw=";
};
patches = [ ./CVE-2022-35737.patch ];
outputs = [ "bin" "dev" "out" ];
separateDebugInfo = stdenv.isLinux;

4
pkgs/development/libraries/webkitgtk/default.nix
View File

@@ -67,7 +67,7 @@
stdenv.mkDerivation rec {
pname = "webkitgtk";
version = "2.36.5";
version = "2.36.7";
outputs = [ "out" "dev" ];
@@ -75,7 +75,7 @@ stdenv.mkDerivation rec {
src = fetchurl {
url = "https://webkitgtk.org/releases/${pname}-${version}.tar.xz";
sha256 = "sha256-1VMvqITJQ9xI8ZEUc91mOrpAejs1yqewS6wUGbQeWQg=";
sha256 = "sha256-DCYM8rMvBIHQF2cN/tG2HlVJZ80GcZVgbJ+etf5zF0M=";
};
patches = lib.optionals stdenv.isLinux [

60
pkgs/os-specific/linux/kernel/hardened/patches.json
View File

@@ -2,42 +2,42 @@
"4.14": {
"patch": {
"extra": "-hardened1",
"name": "linux-hardened-4.14.290-hardened1.patch",
"sha256": "14bnps4y5k2aa0fd2g4bdbiir1w7xfrvgsqd3cfzni8zhf4xrw0l",
"url": "https://github.com/anthraxx/linux-hardened/releases/download/4.14.290-hardened1/linux-hardened-4.14.290-hardened1.patch"
"name": "linux-hardened-4.14.291-hardened1.patch",
"sha256": "04fkfk5kdbqavdg5syyv35xbc8dl5pz8vf1xsvfcv30z5rslsr2c",
"url": "https://github.com/anthraxx/linux-hardened/releases/download/4.14.291-hardened1/linux-hardened-4.14.291-hardened1.patch"
},
"sha256": "0zyxb99a7fa2l85vnzmvg2nry99clj20d4j38piqm921iqxak2j4",
"version": "4.14.290"
"sha256": "15h76l81zn733g8dc6gsymf52nz325plhminv3m4x3klwhav34zc",
"version": "4.14.291"
},
"4.19": {
"patch": {
"extra": "-hardened1",
"name": "linux-hardened-4.19.255-hardened1.patch",
"sha256": "1pi0na6gr0l56479dzny8fvb3yzvxvjbvwn7c6kxf0gdhdqjzsc9",
"url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.255-hardened1/linux-hardened-4.19.255-hardened1.patch"
"name": "linux-hardened-4.19.256-hardened1.patch",
"sha256": "1vqdv2xnfr4ccnfvdrdhj7i0yjhjf48kgc9sziz7fwnfdis8zrrf",
"url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.256-hardened1/linux-hardened-4.19.256-hardened1.patch"
},
"sha256": "0hwa3g09cmllc2z01s2jqbczpznzdp3ldngx18k5c2ac7w394fbp",
"version": "4.19.255"
"sha256": "0jgm7ydha9achbcq3a6q85wq1nz4qg7phx122jzk0mqb1339bpk7",
"version": "4.19.256"
},
"5.10": {
"patch": {
"extra": "-hardened1",
"name": "linux-hardened-5.10.137-hardened1.patch",
"sha256": "0qh94vcvrrd7kl4c32nbrw6bndvy8chkjfcip89akp7ks22w5yhp",
"url": "https://github.com/anthraxx/linux-hardened/releases/download/5.10.137-hardened1/linux-hardened-5.10.137-hardened1.patch"
"name": "linux-hardened-5.10.139-hardened1.patch",
"sha256": "03n49hfc1ck82gzjhxsidbcy02r08qqy7qbahd8zmrhpw6vdqfwi",
"url": "https://github.com/anthraxx/linux-hardened/releases/download/5.10.139-hardened1/linux-hardened-5.10.139-hardened1.patch"
},
"sha256": "1j0n2r793pkvymjc70fzqwqi6h2j1wkja2kx012ydmsk2i6wssy1",
"version": "5.10.137"
"sha256": "1wdyk1w8lr5l4d038bd44rdndxjvfcva2n51h2i38jd4fp12l00w",
"version": "5.10.139"
},
"5.15": {
"patch": {
"extra": "-hardened1",
"name": "linux-hardened-5.15.62-hardened1.patch",
"sha256": "08znbgkwsw9gl7hjcqrbj1aqysnxqj7bh8xikqvmpx54qqbk6brh",
"url": "https://github.com/anthraxx/linux-hardened/releases/download/5.15.62-hardened1/linux-hardened-5.15.62-hardened1.patch"
"name": "linux-hardened-5.15.63-hardened1.patch",
"sha256": "02lgrnr8wkkrpwj6szd45dmdz4jdj2dpvpfvy8dmrl9hc870zk7k",
"url": "https://github.com/anthraxx/linux-hardened/releases/download/5.15.63-hardened1/linux-hardened-5.15.63-hardened1.patch"
},
"sha256": "0hgiag3mvdlcr6ckfy4bdr7h4471zqi53ahfybdvdkapivg7r086",
"version": "5.15.62"
"sha256": "0hbkxgadz0vcslni4r46yc202wcnxblcfvkcph1017b2b8gcvlvd",
"version": "5.15.63"
},
"5.18": {
"patch": {
@@ -49,14 +49,24 @@
"sha256": "1mc8zhiw0v7fka64mydpdrxkrvy0jyqggq5lghw3pyqj2wjrpw6z",
"version": "5.18.19"
},
"5.19": {
"patch": {
"extra": "-hardened1",
"name": "linux-hardened-5.19.5-hardened1.patch",
"sha256": "1f6zddx6mbpdn1glz32zrf13wr6j74vpk1lx56x3zllcfshds354",
"url": "https://github.com/anthraxx/linux-hardened/releases/download/5.19.5-hardened1/linux-hardened-5.19.5-hardened1.patch"
},
"sha256": "1g9p4m9w9y0y1gk6vzqvsxzwqspbm10mmhd8n1mhal1yz721qgwc",
"version": "5.19.5"
},
"5.4": {
"patch": {
"extra": "-hardened1",
"name": "linux-hardened-5.4.210-hardened1.patch",
"sha256": "0qbz9h97m0lxa45j85sv2lhhmrlx9nv5z0bf5vdhyq6g0h7d2mm9",
"url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.210-hardened1/linux-hardened-5.4.210-hardened1.patch"
"name": "linux-hardened-5.4.211-hardened1.patch",
"sha256": "061c1c3ha88798l9q3n2dd3ankvw0hlz8f8cisxljpzfj4napk8z",
"url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.211-hardened1/linux-hardened-5.4.211-hardened1.patch"
},
"sha256": "13l8zh5balciqhi4k4328sznza30v8g871wxcqqka61cij3rc0wl",
"version": "5.4.210"
"sha256": "1v1dgsk66fi6x6v9k6hg9ik3f3b3pv7a3gk8mybmgm9cnx0k5d5z",
"version": "5.4.211"
}
}

4
pkgs/os-specific/linux/kernel/linux-5.10.nix
View File

@@ -3,7 +3,7 @@
with lib;
buildLinux (args // rec {
version = "5.10.138";
version = "5.10.139";
# modDirVersion needs to be x.y.z, will automatically add .0 if needed
modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
src = fetchurl {
url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
sha256 = "1a2vmcqzi71w88j79lxsrgyycq1l1gxp0cvh5ya4afhfisxh7819";
sha256 = "1wdyk1w8lr5l4d038bd44rdndxjvfcva2n51h2i38jd4fp12l00w";
};
} // (args.argsOverride or {}))

4
pkgs/os-specific/linux/kernel/linux-5.19.nix
View File

@@ -3,7 +3,7 @@
with lib;
buildLinux (args // rec {
version = "5.19.4";
version = "5.19.5";
# modDirVersion needs to be x.y.z, will automatically add .0 if needed
modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
src = fetchurl {
url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
sha256 = "11xzz5glbc7p3j9mhv6dvi9iv345ykpyihm8mby8vyas12bln8d9";
sha256 = "1g9p4m9w9y0y1gk6vzqvsxzwqspbm10mmhd8n1mhal1yz721qgwc";
};
} // (args.argsOverride or { }))

10
pkgs/servers/minio/default.nix
View File

@@ -1,4 +1,4 @@
{ lib, buildGoModule, fetchFromGitHub, nixosTests }:
{ lib, buildGoModule, fetchFromGitHub, nixosTests, fetchpatch }:
let
# The web client verifies, that the server version is a valid datetime string:
@@ -26,6 +26,14 @@ buildGoModule rec {
vendorSha256 = "sha256-u36oHqIxMD3HRio9A3tUt6FO1DtAcQDiC/O54ByeNyg=";
patches = [
(fetchpatch {
url = "https://github.com/minio/minio/commit/bc72e4226e669d98c8e0f3eccc9297be9251c692.patch";
name = "CVE-2022-35919.patch";
sha256 = "sha256-420jff2B1eZArUs8NncWX6dQMMTGAfF1nNjzbwo6AUI=";
})
];
doCheck = false;
subPackages = [ "." ];