From 2e6f1475b560ab747455c37dc2ca6ea7cddbdfb9 Mon Sep 17 00:00:00 2001 From: ajs124 Date: Tue, 9 Aug 2022 00:23:19 +0200 Subject: [PATCH 01/25] libwebp: 1.2.3 -> 1.2.4 (cherry picked from commit e3d4450eff5e6a7044311fbd3d7e162b2d68289c) --- pkgs/development/libraries/libwebp/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/libraries/libwebp/default.nix b/pkgs/development/libraries/libwebp/default.nix index 48b91ffa159c..2a0dc4012d4f 100644 --- a/pkgs/development/libraries/libwebp/default.nix +++ b/pkgs/development/libraries/libwebp/default.nix @@ -15,13 +15,13 @@ stdenv.mkDerivation rec { pname = "libwebp"; - version = "1.2.3"; + version = "1.2.4"; src = fetchFromGitHub { owner = "webmproject"; repo = pname; rev = "v${version}"; - hash = "sha256-t27d+eJR4iTHSLlI3J7RqHgsWACThjsI9O6R2Zb9F1g="; + hash = "sha256-XX6qOWlIl8TqOQMiGpmmDVKwQnM1taG6lrqq1ZFVk5s="; }; prePatch = "patchShebangs ."; From 14d0bff3fe2f1766c68b529b28c5a7748bdaccf1 Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Fri, 19 Aug 2022 00:11:08 +0200 Subject: [PATCH 02/25] nss: Drop nss-pem patchset MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The patch url went 404 and other distros¹ have discarded it as well in favor of packaging nss-pem² [1] https://gitweb.gentoo.org/repo/gentoo.git/commit/dev-libs/nss?id=5eca3e02c87163b3c541cdee893830d201abfb86 [2] https://github.com/kdudka/nss-pem (cherry picked from commit 7f01443ef1cf09be0dd772af0a58409a4a02ccb1) --- pkgs/development/libraries/nss/generic.nix | 12 ------------ 1 file changed, 12 deletions(-) diff --git a/pkgs/development/libraries/nss/generic.nix b/pkgs/development/libraries/nss/generic.nix index 9a3d7bdfe270..cbd52df317c9 100644 --- a/pkgs/development/libraries/nss/generic.nix +++ b/pkgs/development/libraries/nss/generic.nix @@ -18,11 +18,6 @@ }: let - nssPEM = fetchurl { - url = "http://dev.gentoo.org/~polynomial-c/mozilla/nss-3.15.4-pem-support-20140109.patch.xz"; - sha256 = "10ibz6y0hknac15zr6dw4gv9nb5r5z9ym6gq18j3xqx7v7n3vpdw"; - }; - underscoreVersion = lib.replaceStrings [ "." ] [ "_" ] version; in stdenv.mkDerivation rec { @@ -44,13 +39,6 @@ stdenv.mkDerivation rec { propagatedBuildInputs = [ nspr ]; prePatch = '' - # strip the trailing whitespace from the patch line and the renamed CKO_NETSCAPE_ enum to CKO_NSS_ - xz -d < ${nssPEM} | sed \ - -e 's/-DIRS = builtins $/-DIRS = . builtins/g' \ - -e 's/CKO_NETSCAPE_/CKO_NSS_/g' \ - -e 's/CKT_NETSCAPE_/CKT_NSS_/g' \ - | patch -p1 - patchShebangs nss for f in nss/coreconf/config.gypi nss/build.sh nss/coreconf/config.gypi; do From 59081b1618fbd147465bf6a2e02c69a2d37c060f Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Fri, 19 Aug 2022 00:17:15 +0200 Subject: [PATCH 03/25] nss: Drop ckpem patch It's usefulness is not clear to us maintainers. (cherry picked from commit df214678dcf8444d290e835c6039a48cefed65b9) --- pkgs/development/libraries/nss/ckpem.patch | 11 ----------- pkgs/development/libraries/nss/generic.nix | 1 - 2 files changed, 12 deletions(-) delete mode 100644 pkgs/development/libraries/nss/ckpem.patch diff --git a/pkgs/development/libraries/nss/ckpem.patch b/pkgs/development/libraries/nss/ckpem.patch deleted file mode 100644 index c1a65a6c0b28..000000000000 --- a/pkgs/development/libraries/nss/ckpem.patch +++ /dev/null @@ -1,11 +0,0 @@ ---- nss/lib/ckfw/pem/ckpem.h 2018-01-03 13:36:12.000000000 -0800 -+++ nss/lib/ckfw/pem/ckpem.h 2018-01-03 13:36:20.000000000 -0800 -@@ -156,8 +156,6 @@ - NSS_EXTERN_DATA pemInternalObject nss_pem_data[]; - NSS_EXTERN_DATA const PRUint32 nss_pem_nObjects; - -- PRBool logged_in; -- - /* our raw object data array */ - NSS_EXTERN_DATA pemInternalObject nss_pem_data[]; - NSS_EXTERN_DATA const PRUint32 nss_pem_nObjects; diff --git a/pkgs/development/libraries/nss/generic.nix b/pkgs/development/libraries/nss/generic.nix index cbd52df317c9..28edb44f1cd6 100644 --- a/pkgs/development/libraries/nss/generic.nix +++ b/pkgs/development/libraries/nss/generic.nix @@ -55,7 +55,6 @@ stdenv.mkDerivation rec { else ./85_security_load_3.77+.patch ) - ./ckpem.patch ./fix-cross-compilation.patch ]; From 40007f53ebcca690bf6dc040f72f70b8dff15a9b Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Fri, 19 Aug 2022 15:16:13 +0200 Subject: [PATCH 04/25] nss: migrate manual patching into postPatch (cherry picked from commit 0badc2389af6f730d2acab4cb66554ddab39b57a) --- pkgs/development/libraries/nss/generic.nix | 20 +++++++++----------- 1 file changed, 9 insertions(+), 11 deletions(-) diff --git a/pkgs/development/libraries/nss/generic.nix b/pkgs/development/libraries/nss/generic.nix index 28edb44f1cd6..bcc290dd2076 100644 --- a/pkgs/development/libraries/nss/generic.nix +++ b/pkgs/development/libraries/nss/generic.nix @@ -38,16 +38,6 @@ stdenv.mkDerivation rec { propagatedBuildInputs = [ nspr ]; - prePatch = '' - patchShebangs nss - - for f in nss/coreconf/config.gypi nss/build.sh nss/coreconf/config.gypi; do - substituteInPlace "$f" --replace "/usr/bin/env" "${buildPackages.coreutils}/bin/env" - done - - substituteInPlace nss/coreconf/config.gypi --replace "/usr/bin/grep" "${buildPackages.coreutils}/bin/env grep" - ''; - patches = [ # Based on http://patch-tracker.debian.org/patch/series/dl/nss/2:3.15.4-1/85_security_load.patch (if (lib.versionOlder version "3.77") then @@ -60,7 +50,15 @@ stdenv.mkDerivation rec { patchFlags = [ "-p0" ]; - postPatch = lib.optionalString stdenv.hostPlatform.isDarwin '' + postPatch = '' + patchShebangs nss + + for f in nss/coreconf/config.gypi nss/build.sh nss/coreconf/config.gypi; do + substituteInPlace "$f" --replace "/usr/bin/env" "${buildPackages.coreutils}/bin/env" + done + + substituteInPlace nss/coreconf/config.gypi --replace "/usr/bin/grep" "${buildPackages.coreutils}/bin/env grep" + '' + lib.optionalString stdenv.hostPlatform.isDarwin '' substituteInPlace nss/coreconf/Darwin.mk --replace '@executable_path/$(notdir $@)' "$out/lib/\$(notdir \$@)" substituteInPlace nss/coreconf/config.gypi --replace "'DYLIB_INSTALL_NAME_BASE': '@executable_path'" "'DYLIB_INSTALL_NAME_BASE': '$out/lib'" ''; From 8030f694c22182d08b56734af0d34108de703174 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= Date: Wed, 1 Jun 2022 23:39:04 +0200 Subject: [PATCH 05/25] go_1_17: 1.17.10 -> 1.17.13 (cherry picked from commit 47016de7effddab56c374598de8de7c704543c84) (cherry picked from commit 6b6a73f53e600267d4016775270a2e770178d4e6) (cherry picked from commit 8fb01fab4f38dbcf6e5e55a786aef0d77fe28865) Fixes CVE-2022-1705, CVE-2022-32148, CVE-2022-30631, CVE-2022-30633, CVE-2022-28131, CVE-2022-30635, CVE-2022-30632, CVE-2022-30630, CVE-2022-1962 --- pkgs/development/compilers/go/1.17.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/compilers/go/1.17.nix b/pkgs/development/compilers/go/1.17.nix index a2c0d3d16b91..e2db700494e9 100644 --- a/pkgs/development/compilers/go/1.17.nix +++ b/pkgs/development/compilers/go/1.17.nix @@ -60,11 +60,11 @@ in stdenv.mkDerivation rec { pname = "go"; - version = "1.17.10"; + version = "1.17.13"; src = fetchurl { url = "https://dl.google.com/go/go${version}.src.tar.gz"; - sha256 = "sha256-KZ5VrzDxVpGwFdjc+OyuckEkElaeWy7OIDYXU6RW8vk="; + sha256 = "sha256-oaSLI6+yBvlee7qpuJjZZfkIJvbx0fwMHXhK2gzTAP0="; }; strictDeps = true; From d945c63e8cf7c7f073002613aa7ff8759af119aa Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= Date: Wed, 1 Jun 2022 23:39:23 +0200 Subject: [PATCH 06/25] go_1_18: 1.18.2 -> 1.18.5 (cherry picked from commit 6e7fb72f0f91273f308285347128915025eb58c1) (cherry picked from commit e4f3664e623e8d2a2e1adf0e28fbaf6f2e281999) (cherry picked from commit eba5f13c08cd9fda50b4cf0e6499b7e39e729bc4) Fixes CVE-2022-1705, CVE-2022-32148, CVE-2022-30631, CVE-2022-30633, CVE-2022-28131, CVE-2022-30635, CVE-2022-30632, CVE-2022-30630, CVE-2022-1962 --- pkgs/development/compilers/go/1.18.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/compilers/go/1.18.nix b/pkgs/development/compilers/go/1.18.nix index 6f6e690e3545..d36cbc5e3c29 100644 --- a/pkgs/development/compilers/go/1.18.nix +++ b/pkgs/development/compilers/go/1.18.nix @@ -60,11 +60,11 @@ in stdenv.mkDerivation rec { pname = "go"; - version = "1.18.2"; + version = "1.18.5"; src = fetchurl { url = "https://go.dev/dl/go${version}.src.tar.gz"; - sha256 = "sha256-LETQPqLDQJITerkZumAvLCYaA40I60aFKKPzoo5WZ+I="; + sha256 = "sha256-mSDTMGoaxTbN0seW1ss8VLxVnCJvw8w5wy8eC9f1DSo="; }; strictDeps = true; From 0b0657d43a30e6181d1b73131d76e4a746d4b9f2 Mon Sep 17 00:00:00 2001 From: Thomas Gerbet Date: Fri, 27 May 2022 11:00:35 +0200 Subject: [PATCH 07/25] rsync: 3.2.3 -> 3.2.4 https://download.samba.org/pub/rsync/NEWS#3.2.4 (cherry picked from commit 3de6800173403ce2ebf8f13e0a424bfd8d3abdb6) --- pkgs/applications/networking/sync/rsync/base.nix | 13 +++---------- pkgs/applications/networking/sync/rsync/default.nix | 13 ++----------- pkgs/applications/networking/sync/rsync/rrsync.nix | 2 -- 3 files changed, 5 insertions(+), 23 deletions(-) diff --git a/pkgs/applications/networking/sync/rsync/base.nix b/pkgs/applications/networking/sync/rsync/base.nix index 39ce5d3a7ea5..27358c3ef590 100644 --- a/pkgs/applications/networking/sync/rsync/base.nix +++ b/pkgs/applications/networking/sync/rsync/base.nix @@ -1,24 +1,17 @@ { lib, fetchurl, fetchpatch }: rec { - version = "3.2.3"; + version = "3.2.4"; src = fetchurl { # signed with key 0048 C8B0 26D4 C96F 0E58 9C2F 6C85 9FB1 4B96 A8C5 url = "mirror://samba/rsync/src/rsync-${version}.tar.gz"; - sha256 = "03p5dha9g9krq61mdbcrjkpz5nglri0009ks2vs9k97f9i83rk5y"; + sha256 = "sha256-b3YYONCAUrC2V5z39nN9k+R/AfTaBMXSTTRHt/Kl+tE="; }; upstreamPatchTarball = fetchurl { # signed with key 0048 C8B0 26D4 C96F 0E58 9C2F 6C85 9FB1 4B96 A8C5 url = "mirror://samba/rsync/rsync-patches-${version}.tar.gz"; - sha256 = "1wj21v57v135n6fnmlm2dxmb9lhrrg62jgkggldp1gb7d6s4arny"; + sha256 = "sha256-cKWXWQr2xhzz0F1mNCn/n2D/4k5E+cc6TNxp69wTIqQ="; }; - extraPatches = [ - (fetchpatch { - name = "CVE-2020-14387.patch"; - url = "https://git.samba.org/?p=rsync.git;a=patch;h=c3f7414;hp=4c4fce51072c9189cfb11b52aa54fed79f5741bd"; - sha256 = "000lyx48lns84p53nsdlr45mb9558lrvnsz3yic0y3z6h2izv82x"; - }) - ]; meta = with lib; { description = "Fast incremental file transfer utility"; diff --git a/pkgs/applications/networking/sync/rsync/default.nix b/pkgs/applications/networking/sync/rsync/default.nix index dc3e8b25e70a..29016bc14af2 100644 --- a/pkgs/applications/networking/sync/rsync/default.nix +++ b/pkgs/applications/networking/sync/rsync/default.nix @@ -32,8 +32,7 @@ stdenv.mkDerivation rec { patchesSrc = base.upstreamPatchTarball; srcs = [ mainSrc ] ++ lib.optional enableCopyDevicesPatch patchesSrc; - patches = lib.optional enableCopyDevicesPatch "./patches/copy-devices.diff" - ++ base.extraPatches; + patches = lib.optional enableCopyDevicesPatch "./patches/copy-devices.diff"; buildInputs = [ libiconv zlib popt ] ++ lib.optional enableACLs acl @@ -49,15 +48,7 @@ stdenv.mkDerivation rec { # disable the included zlib explicitly as it otherwise still compiles and # links them even. "--with-included-zlib=no" - ] - # Work around issue with cross-compilation: - # configure.sh: error: cannot run test program while cross compiling - # Remove once 3.2.4 or more recent is released. - # The following PR should fix the cross-compilation issue. - # Test using `nix-build -A pkgsCross.aarch64-multiplatform.rsync`. - # https://github.com/WayneD/rsync/commit/b7fab6f285ff0ff3816b109a8c3131b6ded0b484 - ++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform) "--enable-simd=no" - ; + ]; passthru.tests = { inherit (nixosTests) rsyncd; }; diff --git a/pkgs/applications/networking/sync/rsync/rrsync.nix b/pkgs/applications/networking/sync/rsync/rrsync.nix index e55f7fc1fba6..bb83a9e3cd4e 100644 --- a/pkgs/applications/networking/sync/rsync/rrsync.nix +++ b/pkgs/applications/networking/sync/rsync/rrsync.nix @@ -16,8 +16,6 @@ stdenv.mkDerivation { dontConfigure = true; dontBuild = true; - patches = base.extraPatches; - postPatch = '' substituteInPlace support/rrsync --replace /usr/bin/rsync ${rsync}/bin/rsync ''; From a14a0f0299a1c09288539efb390c39f7e90e46e1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= Date: Fri, 27 May 2022 15:39:03 +0200 Subject: [PATCH 08/25] rsync: adopt, greatly simplify package (cherry picked from commit 9e1c94057ca6152b32e7860b76b8f340a0e18f7c) --- .../networking/sync/rsync/base.nix | 22 ----------- .../networking/sync/rsync/default.nix | 39 +++++++++++++------ .../networking/sync/rsync/rrsync.nix | 12 ++---- 3 files changed, 31 insertions(+), 42 deletions(-) delete mode 100644 pkgs/applications/networking/sync/rsync/base.nix diff --git a/pkgs/applications/networking/sync/rsync/base.nix b/pkgs/applications/networking/sync/rsync/base.nix deleted file mode 100644 index 27358c3ef590..000000000000 --- a/pkgs/applications/networking/sync/rsync/base.nix +++ /dev/null @@ -1,22 +0,0 @@ -{ lib, fetchurl, fetchpatch }: - -rec { - version = "3.2.4"; - src = fetchurl { - # signed with key 0048 C8B0 26D4 C96F 0E58 9C2F 6C85 9FB1 4B96 A8C5 - url = "mirror://samba/rsync/src/rsync-${version}.tar.gz"; - sha256 = "sha256-b3YYONCAUrC2V5z39nN9k+R/AfTaBMXSTTRHt/Kl+tE="; - }; - upstreamPatchTarball = fetchurl { - # signed with key 0048 C8B0 26D4 C96F 0E58 9C2F 6C85 9FB1 4B96 A8C5 - url = "mirror://samba/rsync/rsync-patches-${version}.tar.gz"; - sha256 = "sha256-cKWXWQr2xhzz0F1mNCn/n2D/4k5E+cc6TNxp69wTIqQ="; - }; - - meta = with lib; { - description = "Fast incremental file transfer utility"; - homepage = "https://rsync.samba.org/"; - license = licenses.gpl3Plus; - platforms = platforms.unix; - }; -} diff --git a/pkgs/applications/networking/sync/rsync/default.nix b/pkgs/applications/networking/sync/rsync/default.nix index 29016bc14af2..f47c9c75367d 100644 --- a/pkgs/applications/networking/sync/rsync/default.nix +++ b/pkgs/applications/networking/sync/rsync/default.nix @@ -20,27 +20,32 @@ , nixosTests }: -let - base = import ./base.nix { inherit lib fetchurl fetchpatch; }; -in stdenv.mkDerivation rec { pname = "rsync"; - version = base.version; + version = "3.2.4"; - mainSrc = base.src; + srcs = [ + (fetchurl { + # signed with key 0048 C8B0 26D4 C96F 0E58 9C2F 6C85 9FB1 4B96 A8C5 + url = "mirror://samba/rsync/src/rsync-${version}.tar.gz"; + sha256 = "sha256-b3YYONCAUrC2V5z39nN9k+R/AfTaBMXSTTRHt/Kl+tE="; + }) + ] ++ lib.optional enableCopyDevicesPatch (fetchurl { + # signed with key 0048 C8B0 26D4 C96F 0E58 9C2F 6C85 9FB1 4B96 A8C5 + url = "mirror://samba/rsync/rsync-patches-${version}.tar.gz"; + sha256 = "1wj21v57v135n6fnm2m2dxmb9lhrrg62jgkggldp1gb7d6s4arny"; + }); - patchesSrc = base.upstreamPatchTarball; - - srcs = [ mainSrc ] ++ lib.optional enableCopyDevicesPatch patchesSrc; patches = lib.optional enableCopyDevicesPatch "./patches/copy-devices.diff"; + nativeBuildInputs = [ perl ]; + buildInputs = [ libiconv zlib popt ] ++ lib.optional enableACLs acl ++ lib.optional enableZstd zstd ++ lib.optional enableLZ4 lz4 ++ lib.optional enableOpenSSL openssl ++ lib.optional enableXXHash xxHash; - nativeBuildInputs = [ perl ]; configureFlags = [ "--with-nobody-group=nogroup" @@ -48,12 +53,22 @@ stdenv.mkDerivation rec { # disable the included zlib explicitly as it otherwise still compiles and # links them even. "--with-included-zlib=no" - ]; + ] + # Work around issue with cross-compilation: + # configure.sh: error: cannot run test program while cross compiling + # Remove once 3.2.4 or more recent is released. + # The following PR should fix the cross-compilation issue. + # Test using `nix-build -A pkgsCross.aarch64-multiplatform.rsync`. + # https://github.com/WayneD/rsync/commit/b7fab6f285ff0ff3816b109a8c3131b6ded0b484 + ++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform) "--enable-simd=no"; passthru.tests = { inherit (nixosTests) rsyncd; }; - meta = base.meta // { - description = "A fast incremental file transfer utility"; + meta = with lib; { + description = "Fast incremental file transfer utility"; + homepage = "https://rsync.samba.org/"; + license = licenses.gpl3Plus; + platforms = platforms.unix; maintainers = with lib.maintainers; [ ehmry kampfschlaefer ]; }; } diff --git a/pkgs/applications/networking/sync/rsync/rrsync.nix b/pkgs/applications/networking/sync/rsync/rrsync.nix index bb83a9e3cd4e..d1e6b6ad96eb 100644 --- a/pkgs/applications/networking/sync/rsync/rrsync.nix +++ b/pkgs/applications/networking/sync/rsync/rrsync.nix @@ -1,13 +1,8 @@ { lib, stdenv, fetchurl, perl, rsync, fetchpatch }: -let - base = import ./base.nix { inherit lib fetchurl fetchpatch; }; -in stdenv.mkDerivation { pname = "rrsync"; - version = base.version; - - src = base.src; + inherit (rsync) version srcs; buildInputs = [ rsync perl ]; @@ -16,6 +11,8 @@ stdenv.mkDerivation { dontConfigure = true; dontBuild = true; + inherit (rsync) patches; + postPatch = '' substituteInPlace support/rrsync --replace /usr/bin/rsync ${rsync}/bin/rsync ''; @@ -26,8 +23,7 @@ stdenv.mkDerivation { chmod a+x $out/bin/rrsync ''; - meta = base.meta // { + meta = rsync.meta // { description = "A helper to run rsync-only environments from ssh-logins"; - maintainers = [ lib.maintainers.kampfschlaefer ]; }; } From 15b48fe3baad25ccac3229b52f76edc574c68150 Mon Sep 17 00:00:00 2001 From: Ivan Kozik Date: Sat, 20 Aug 2022 03:51:09 +0000 Subject: [PATCH 09/25] rsync: 3.2.4 -> 3.2.5 This release fixes CVE-2022-29154: https://download.samba.org/pub/rsync/NEWS#3.2.5 Remove enableCopyDevicesPatch because --copy-devices was included in rsync 3.2.4: https://download.samba.org/pub/rsync/NEWS#3.2.4:~:text=Added%20the%20%2D%2Dcopy%2Ddevices%20option (cherry picked from commit 457e2672066c8dc0df2df1a3193139c659581639) --- .../networking/sync/rsync/default.nix | 22 +++++-------------- .../networking/sync/rsync/rrsync.nix | 2 +- 2 files changed, 7 insertions(+), 17 deletions(-) diff --git a/pkgs/applications/networking/sync/rsync/default.nix b/pkgs/applications/networking/sync/rsync/default.nix index f47c9c75367d..d7ddd4cd0d3a 100644 --- a/pkgs/applications/networking/sync/rsync/default.nix +++ b/pkgs/applications/networking/sync/rsync/default.nix @@ -1,7 +1,6 @@ { lib , stdenv , fetchurl -, fetchpatch , perl , libiconv , zlib @@ -16,27 +15,18 @@ , xxHash , enableZstd ? true , zstd -, enableCopyDevicesPatch ? false , nixosTests }: stdenv.mkDerivation rec { pname = "rsync"; - version = "3.2.4"; + version = "3.2.5"; - srcs = [ - (fetchurl { - # signed with key 0048 C8B0 26D4 C96F 0E58 9C2F 6C85 9FB1 4B96 A8C5 - url = "mirror://samba/rsync/src/rsync-${version}.tar.gz"; - sha256 = "sha256-b3YYONCAUrC2V5z39nN9k+R/AfTaBMXSTTRHt/Kl+tE="; - }) - ] ++ lib.optional enableCopyDevicesPatch (fetchurl { + src = fetchurl { # signed with key 0048 C8B0 26D4 C96F 0E58 9C2F 6C85 9FB1 4B96 A8C5 - url = "mirror://samba/rsync/rsync-patches-${version}.tar.gz"; - sha256 = "1wj21v57v135n6fnm2m2dxmb9lhrrg62jgkggldp1gb7d6s4arny"; - }); - - patches = lib.optional enableCopyDevicesPatch "./patches/copy-devices.diff"; + url = "mirror://samba/rsync/src/rsync-${version}.tar.gz"; + sha256 = "sha256-KsTSFjXN95GGe8N3w1ym3af1DZGaWL5FBX/VFgDGmro="; + }; nativeBuildInputs = [ perl ]; @@ -69,6 +59,6 @@ stdenv.mkDerivation rec { homepage = "https://rsync.samba.org/"; license = licenses.gpl3Plus; platforms = platforms.unix; - maintainers = with lib.maintainers; [ ehmry kampfschlaefer ]; + maintainers = with lib.maintainers; [ ehmry kampfschlaefer ivan ]; }; } diff --git a/pkgs/applications/networking/sync/rsync/rrsync.nix b/pkgs/applications/networking/sync/rsync/rrsync.nix index d1e6b6ad96eb..a85df8fa4682 100644 --- a/pkgs/applications/networking/sync/rsync/rrsync.nix +++ b/pkgs/applications/networking/sync/rsync/rrsync.nix @@ -2,7 +2,7 @@ stdenv.mkDerivation { pname = "rrsync"; - inherit (rsync) version srcs; + inherit (rsync) version src; buildInputs = [ rsync perl ]; From 596c06d7b00f9aa851598fbe3d4d963d3604380b Mon Sep 17 00:00:00 2001 From: Maximilian Bosch Date: Mon, 22 Aug 2022 13:26:33 +0200 Subject: [PATCH 10/25] minio: patch CVE-2022-35919 --- pkgs/servers/minio/default.nix | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/pkgs/servers/minio/default.nix b/pkgs/servers/minio/default.nix index b4f876b30578..e07cc6c83088 100644 --- a/pkgs/servers/minio/default.nix +++ b/pkgs/servers/minio/default.nix @@ -1,4 +1,4 @@ -{ lib, buildGoModule, fetchFromGitHub, nixosTests }: +{ lib, buildGoModule, fetchFromGitHub, nixosTests, fetchpatch }: let # The web client verifies, that the server version is a valid datetime string: @@ -26,6 +26,14 @@ buildGoModule rec { vendorSha256 = "sha256-u36oHqIxMD3HRio9A3tUt6FO1DtAcQDiC/O54ByeNyg="; + patches = [ + (fetchpatch { + url = "https://github.com/minio/minio/commit/bc72e4226e669d98c8e0f3eccc9297be9251c692.patch"; + name = "CVE-2022-35919.patch"; + sha256 = "sha256-420jff2B1eZArUs8NncWX6dQMMTGAfF1nNjzbwo6AUI="; + }) + ]; + doCheck = false; subPackages = [ "." ]; From c0e6fc7e454def405c25599b3e38ab09c1ff2f75 Mon Sep 17 00:00:00 2001 From: Maximilian Bosch Date: Mon, 22 Aug 2022 14:11:13 +0200 Subject: [PATCH 11/25] libtiff: patch CVE-2022-{2867,2868,2869} --- pkgs/development/libraries/libtiff/default.nix | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/pkgs/development/libraries/libtiff/default.nix b/pkgs/development/libraries/libtiff/default.nix index f08e815d6d73..735845e28a17 100644 --- a/pkgs/development/libraries/libtiff/default.nix +++ b/pkgs/development/libraries/libtiff/default.nix @@ -98,6 +98,11 @@ stdenv.mkDerivation rec { url = "https://gitlab.com/libtiff/libtiff/-/commit/275735d0354e39c0ac1dc3c0db2120d6f31d1990.patch"; sha256 = "sha256-faKsdJjvQwNdkAKjYm4vubvZvnULt9zz4l53zBFr67s="; }) + (fetchpatch { + name = "CVE-2022-2867.CVE-2022-2868.CVE-2022-2869.patch"; + url = "https://gitlab.com/libtiff/libtiff/-/commit/d46af879bc4e789f95a7828fa566f61700954393.patch"; + sha256 = "sha256-LUzcYU6Tfn+5cJBh0IMaVVCzcuEIF+HJ3ic9Ng7FrK4="; + }) ]; postPatch = '' From 28e2f31bd69a403af604b5ed7d03b4b02025d98c Mon Sep 17 00:00:00 2001 From: Maximilian Bosch Date: Mon, 22 Aug 2022 14:45:43 +0200 Subject: [PATCH 12/25] vim: 9.0.0115 -> 9.0.0244 Fixes CVE-2022-2816, CVE-2022-2817, CVE-2022-2819, CVE-2022-2845, CVE-2022-2849, CVE-2022-2862, CVE-2022-2874, CVE-2022-2889. (cherry picked from commit 18b4b87e0fb9032feca86ccfc8caceb094121157) --- pkgs/applications/editors/vim/common.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/applications/editors/vim/common.nix b/pkgs/applications/editors/vim/common.nix index 70993d2ccb96..b47ecfe9b2e1 100644 --- a/pkgs/applications/editors/vim/common.nix +++ b/pkgs/applications/editors/vim/common.nix @@ -1,12 +1,12 @@ { lib, fetchFromGitHub }: rec { - version = "9.0.0115"; + version = "9.0.0244"; src = fetchFromGitHub { owner = "vim"; repo = "vim"; rev = "v${version}"; - sha256 = "sha256-McotjgjN+ze1jdaAxkdJGTqIIIuOlHENriHdMrYSf5w="; + sha256 = "sha256-l6fLM6+tc1Wy1mjNPa/s73GKhhGBLz3OXUJgJN1wuxY="; }; enableParallelBuilding = true; From d915be48c665cc5a2da5ddf10e33465e9770c612 Mon Sep 17 00:00:00 2001 From: Maximilian Bosch Date: Mon, 22 Aug 2022 16:12:32 +0200 Subject: [PATCH 13/25] sqlite: patch CVE-2022-35737 --- .../libraries/sqlite/CVE-2022-35737.patch | 15 +++++++++++++++ pkgs/development/libraries/sqlite/default.nix | 2 ++ 2 files changed, 17 insertions(+) create mode 100644 pkgs/development/libraries/sqlite/CVE-2022-35737.patch diff --git a/pkgs/development/libraries/sqlite/CVE-2022-35737.patch b/pkgs/development/libraries/sqlite/CVE-2022-35737.patch new file mode 100644 index 000000000000..3837353260a0 --- /dev/null +++ b/pkgs/development/libraries/sqlite/CVE-2022-35737.patch @@ -0,0 +1,15 @@ +diff --git a/sqlite3.c b/sqlite3.c +index eb8d7d5..3918a09 100644 +--- a/sqlite3.c ++++ b/sqlite3.c +@@ -30231,8 +30231,8 @@ SQLITE_API void sqlite3_str_vappendf( + case etSQLESCAPE: /* %q: Escape ' characters */ + case etSQLESCAPE2: /* %Q: Escape ' and enclose in '...' */ + case etSQLESCAPE3: { /* %w: Escape " characters */ +- int i, j, k, n, isnull; +- int needQuote; ++ i64 i, j, k, n; ++ int needQuote, isnull; + char ch; + char q = ((xtype==etSQLESCAPE3)?'"':'\''); /* Quote character */ + char *escarg; diff --git a/pkgs/development/libraries/sqlite/default.nix b/pkgs/development/libraries/sqlite/default.nix index 7677406874a5..70b8c777e978 100644 --- a/pkgs/development/libraries/sqlite/default.nix +++ b/pkgs/development/libraries/sqlite/default.nix @@ -21,6 +21,8 @@ stdenv.mkDerivation rec { sha256 = "sha256-WvB96YK6ZY/ZGgMXDJRfmclx9pVbx53zJmVENz45hpw="; }; + patches = [ ./CVE-2022-35737.patch ]; + outputs = [ "bin" "dev" "out" ]; separateDebugInfo = stdenv.isLinux; From 30b43610262008b2992e9d39fe0578f9c8c4d716 Mon Sep 17 00:00:00 2001 From: Maximilian Bosch Date: Mon, 22 Aug 2022 22:12:27 +0200 Subject: [PATCH 14/25] rsync: re-add enableCopyDevicesPatch, warn that it's obsolete --- pkgs/applications/networking/sync/rsync/default.nix | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/pkgs/applications/networking/sync/rsync/default.nix b/pkgs/applications/networking/sync/rsync/default.nix index d7ddd4cd0d3a..42596962c50a 100644 --- a/pkgs/applications/networking/sync/rsync/default.nix +++ b/pkgs/applications/networking/sync/rsync/default.nix @@ -16,9 +16,16 @@ , enableZstd ? true , zstd , nixosTests +, enableCopyDevicesPatch ? false }: -stdenv.mkDerivation rec { +let + mkDerivation = lib.warnIf + enableCopyDevicesPatch + "enableCopyDevicesPatch in pkgs.rsync is not needed anymore" + stdenv.mkDerivation; +in +mkDerivation rec { pname = "rsync"; version = "3.2.5"; From f488d002344626818814c08d0df9fafcc941dcc9 Mon Sep 17 00:00:00 2001 From: Alyssa Ross Date: Fri, 29 Jul 2022 19:57:16 +0000 Subject: [PATCH 15/25] Revert "rsync: Work around upstream cross-compilation issue" This reverts commit 49edde0905978bf3420498663c05ab4571da90a7. Our packaged rsync version now contains the fix. (cherry picked from commit bf0aa680881de6d6523b73b35b3f66977ded3c93) --- pkgs/applications/networking/sync/rsync/default.nix | 9 +-------- 1 file changed, 1 insertion(+), 8 deletions(-) diff --git a/pkgs/applications/networking/sync/rsync/default.nix b/pkgs/applications/networking/sync/rsync/default.nix index 42596962c50a..2038c0057ad8 100644 --- a/pkgs/applications/networking/sync/rsync/default.nix +++ b/pkgs/applications/networking/sync/rsync/default.nix @@ -50,14 +50,7 @@ mkDerivation rec { # disable the included zlib explicitly as it otherwise still compiles and # links them even. "--with-included-zlib=no" - ] - # Work around issue with cross-compilation: - # configure.sh: error: cannot run test program while cross compiling - # Remove once 3.2.4 or more recent is released. - # The following PR should fix the cross-compilation issue. - # Test using `nix-build -A pkgsCross.aarch64-multiplatform.rsync`. - # https://github.com/WayneD/rsync/commit/b7fab6f285ff0ff3816b109a8c3131b6ded0b484 - ++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform) "--enable-simd=no"; + ]; passthru.tests = { inherit (nixosTests) rsyncd; }; From ca8176f664a8ce0c82117e5a81ba4bcdd5722c8a Mon Sep 17 00:00:00 2001 From: superherointj <5861043+superherointj@users.noreply.github.com> Date: Mon, 29 Aug 2022 20:22:00 -0300 Subject: [PATCH 16/25] linux: 5.10.138 -> 5.10.139 (cherry picked from commit 0d7868b45f9669032c34720a8e4254ded814316f) --- pkgs/os-specific/linux/kernel/linux-5.10.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/os-specific/linux/kernel/linux-5.10.nix b/pkgs/os-specific/linux/kernel/linux-5.10.nix index d2fb4514a377..d4a38a79683b 100644 --- a/pkgs/os-specific/linux/kernel/linux-5.10.nix +++ b/pkgs/os-specific/linux/kernel/linux-5.10.nix @@ -3,7 +3,7 @@ with lib; buildLinux (args // rec { - version = "5.10.138"; + version = "5.10.139"; # modDirVersion needs to be x.y.z, will automatically add .0 if needed modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg; @@ -13,6 +13,6 @@ buildLinux (args // rec { src = fetchurl { url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz"; - sha256 = "1a2vmcqzi71w88j79lxsrgyycq1l1gxp0cvh5ya4afhfisxh7819"; + sha256 = "1wdyk1w8lr5l4d038bd44rdndxjvfcva2n51h2i38jd4fp12l00w"; }; } // (args.argsOverride or {})) From 097516ed596e5511cc6db1be17739ce90feaaebd Mon Sep 17 00:00:00 2001 From: superherointj <5861043+superherointj@users.noreply.github.com> Date: Mon, 29 Aug 2022 20:22:06 -0300 Subject: [PATCH 17/25] linux: 5.19.4 -> 5.19.5 (cherry picked from commit bb0eb96d45cfcb964a35b713b60c063ffc04ffd7) --- pkgs/os-specific/linux/kernel/linux-5.19.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/os-specific/linux/kernel/linux-5.19.nix b/pkgs/os-specific/linux/kernel/linux-5.19.nix index c9a864ddfab9..7ce20f3b6fe1 100644 --- a/pkgs/os-specific/linux/kernel/linux-5.19.nix +++ b/pkgs/os-specific/linux/kernel/linux-5.19.nix @@ -3,7 +3,7 @@ with lib; buildLinux (args // rec { - version = "5.19.4"; + version = "5.19.5"; # modDirVersion needs to be x.y.z, will automatically add .0 if needed modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg; @@ -13,6 +13,6 @@ buildLinux (args // rec { src = fetchurl { url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz"; - sha256 = "11xzz5glbc7p3j9mhv6dvi9iv345ykpyihm8mby8vyas12bln8d9"; + sha256 = "1g9p4m9w9y0y1gk6vzqvsxzwqspbm10mmhd8n1mhal1yz721qgwc"; }; } // (args.argsOverride or { })) From 6cbb917f590bca06049eae82671a8856291ec4f9 Mon Sep 17 00:00:00 2001 From: superherointj <5861043+superherointj@users.noreply.github.com> Date: Mon, 29 Aug 2022 20:22:35 -0300 Subject: [PATCH 18/25] linux/hardened/patches/4.14: 4.14.290-hardened1 -> 4.14.291-hardened1 (cherry picked from commit 3235fcb17d68a34da6492c2e3eba4d2f2a35b737) --- pkgs/os-specific/linux/kernel/hardened/patches.json | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/pkgs/os-specific/linux/kernel/hardened/patches.json b/pkgs/os-specific/linux/kernel/hardened/patches.json index 861519758f03..599381ea1afe 100644 --- a/pkgs/os-specific/linux/kernel/hardened/patches.json +++ b/pkgs/os-specific/linux/kernel/hardened/patches.json @@ -2,12 +2,12 @@ "4.14": { "patch": { "extra": "-hardened1", - "name": "linux-hardened-4.14.290-hardened1.patch", - "sha256": "14bnps4y5k2aa0fd2g4bdbiir1w7xfrvgsqd3cfzni8zhf4xrw0l", - "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.14.290-hardened1/linux-hardened-4.14.290-hardened1.patch" + "name": "linux-hardened-4.14.291-hardened1.patch", + "sha256": "04fkfk5kdbqavdg5syyv35xbc8dl5pz8vf1xsvfcv30z5rslsr2c", + "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.14.291-hardened1/linux-hardened-4.14.291-hardened1.patch" }, - "sha256": "0zyxb99a7fa2l85vnzmvg2nry99clj20d4j38piqm921iqxak2j4", - "version": "4.14.290" + "sha256": "15h76l81zn733g8dc6gsymf52nz325plhminv3m4x3klwhav34zc", + "version": "4.14.291" }, "4.19": { "patch": { From 0c8ae54351095fc23e214b0770df33eb5b0ea329 Mon Sep 17 00:00:00 2001 From: superherointj <5861043+superherointj@users.noreply.github.com> Date: Mon, 29 Aug 2022 20:22:46 -0300 Subject: [PATCH 19/25] linux/hardened/patches/4.19: 4.19.255-hardened1 -> 4.19.256-hardened1 (cherry picked from commit c963a9fd677e4b856f0e88db5f9402b327df0124) --- pkgs/os-specific/linux/kernel/hardened/patches.json | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/pkgs/os-specific/linux/kernel/hardened/patches.json b/pkgs/os-specific/linux/kernel/hardened/patches.json index 599381ea1afe..38c2e593aebb 100644 --- a/pkgs/os-specific/linux/kernel/hardened/patches.json +++ b/pkgs/os-specific/linux/kernel/hardened/patches.json @@ -12,12 +12,12 @@ "4.19": { "patch": { "extra": "-hardened1", - "name": "linux-hardened-4.19.255-hardened1.patch", - "sha256": "1pi0na6gr0l56479dzny8fvb3yzvxvjbvwn7c6kxf0gdhdqjzsc9", - "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.255-hardened1/linux-hardened-4.19.255-hardened1.patch" + "name": "linux-hardened-4.19.256-hardened1.patch", + "sha256": "1vqdv2xnfr4ccnfvdrdhj7i0yjhjf48kgc9sziz7fwnfdis8zrrf", + "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.256-hardened1/linux-hardened-4.19.256-hardened1.patch" }, - "sha256": "0hwa3g09cmllc2z01s2jqbczpznzdp3ldngx18k5c2ac7w394fbp", - "version": "4.19.255" + "sha256": "0jgm7ydha9achbcq3a6q85wq1nz4qg7phx122jzk0mqb1339bpk7", + "version": "4.19.256" }, "5.10": { "patch": { From db7fb4659ba17ef15b7d78be6ad64552bfe5c7ec Mon Sep 17 00:00:00 2001 From: superherointj <5861043+superherointj@users.noreply.github.com> Date: Mon, 29 Aug 2022 20:22:53 -0300 Subject: [PATCH 20/25] linux/hardened/patches/5.10: 5.10.137-hardened1 -> 5.10.139-hardened1 (cherry picked from commit 18e3f842ec560410fae12b571171579b5d435ad1) --- pkgs/os-specific/linux/kernel/hardened/patches.json | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/pkgs/os-specific/linux/kernel/hardened/patches.json b/pkgs/os-specific/linux/kernel/hardened/patches.json index 38c2e593aebb..83821f26005a 100644 --- a/pkgs/os-specific/linux/kernel/hardened/patches.json +++ b/pkgs/os-specific/linux/kernel/hardened/patches.json @@ -22,12 +22,12 @@ "5.10": { "patch": { "extra": "-hardened1", - "name": "linux-hardened-5.10.137-hardened1.patch", - "sha256": "0qh94vcvrrd7kl4c32nbrw6bndvy8chkjfcip89akp7ks22w5yhp", - "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.10.137-hardened1/linux-hardened-5.10.137-hardened1.patch" + "name": "linux-hardened-5.10.139-hardened1.patch", + "sha256": "03n49hfc1ck82gzjhxsidbcy02r08qqy7qbahd8zmrhpw6vdqfwi", + "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.10.139-hardened1/linux-hardened-5.10.139-hardened1.patch" }, - "sha256": "1j0n2r793pkvymjc70fzqwqi6h2j1wkja2kx012ydmsk2i6wssy1", - "version": "5.10.137" + "sha256": "1wdyk1w8lr5l4d038bd44rdndxjvfcva2n51h2i38jd4fp12l00w", + "version": "5.10.139" }, "5.15": { "patch": { From 2d02836164a7ceee8c5aee148bab7bbfd7e52c61 Mon Sep 17 00:00:00 2001 From: superherointj <5861043+superherointj@users.noreply.github.com> Date: Mon, 29 Aug 2022 20:23:01 -0300 Subject: [PATCH 21/25] linux/hardened/patches/5.15: 5.15.62-hardened1 -> 5.15.63-hardened1 (cherry picked from commit 9c522171418fb4a4941b0acc710967cf695d93e6) --- pkgs/os-specific/linux/kernel/hardened/patches.json | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/pkgs/os-specific/linux/kernel/hardened/patches.json b/pkgs/os-specific/linux/kernel/hardened/patches.json index 83821f26005a..af6e3b258a06 100644 --- a/pkgs/os-specific/linux/kernel/hardened/patches.json +++ b/pkgs/os-specific/linux/kernel/hardened/patches.json @@ -32,12 +32,12 @@ "5.15": { "patch": { "extra": "-hardened1", - "name": "linux-hardened-5.15.62-hardened1.patch", - "sha256": "08znbgkwsw9gl7hjcqrbj1aqysnxqj7bh8xikqvmpx54qqbk6brh", - "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.15.62-hardened1/linux-hardened-5.15.62-hardened1.patch" + "name": "linux-hardened-5.15.63-hardened1.patch", + "sha256": "02lgrnr8wkkrpwj6szd45dmdz4jdj2dpvpfvy8dmrl9hc870zk7k", + "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.15.63-hardened1/linux-hardened-5.15.63-hardened1.patch" }, - "sha256": "0hgiag3mvdlcr6ckfy4bdr7h4471zqi53ahfybdvdkapivg7r086", - "version": "5.15.62" + "sha256": "0hbkxgadz0vcslni4r46yc202wcnxblcfvkcph1017b2b8gcvlvd", + "version": "5.15.63" }, "5.18": { "patch": { From 9c532ab3380f208f019cf6b89d4a23274cdf71fb Mon Sep 17 00:00:00 2001 From: superherointj <5861043+superherointj@users.noreply.github.com> Date: Mon, 29 Aug 2022 20:23:08 -0300 Subject: [PATCH 22/25] linux/hardened/patches/5.19: init at 5.19.5-hardened1 (cherry picked from commit 6c64bc1513af234e55ef7fe543a2538052b2af62) --- pkgs/os-specific/linux/kernel/hardened/patches.json | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/pkgs/os-specific/linux/kernel/hardened/patches.json b/pkgs/os-specific/linux/kernel/hardened/patches.json index af6e3b258a06..6ab7ddf2b5c6 100644 --- a/pkgs/os-specific/linux/kernel/hardened/patches.json +++ b/pkgs/os-specific/linux/kernel/hardened/patches.json @@ -49,6 +49,16 @@ "sha256": "1mc8zhiw0v7fka64mydpdrxkrvy0jyqggq5lghw3pyqj2wjrpw6z", "version": "5.18.19" }, + "5.19": { + "patch": { + "extra": "-hardened1", + "name": "linux-hardened-5.19.5-hardened1.patch", + "sha256": "1f6zddx6mbpdn1glz32zrf13wr6j74vpk1lx56x3zllcfshds354", + "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.19.5-hardened1/linux-hardened-5.19.5-hardened1.patch" + }, + "sha256": "1g9p4m9w9y0y1gk6vzqvsxzwqspbm10mmhd8n1mhal1yz721qgwc", + "version": "5.19.5" + }, "5.4": { "patch": { "extra": "-hardened1", From 3bc5920e30a1046d1155b98d88805cdc82691463 Mon Sep 17 00:00:00 2001 From: superherointj <5861043+superherointj@users.noreply.github.com> Date: Mon, 29 Aug 2022 20:23:15 -0300 Subject: [PATCH 23/25] linux/hardened/patches/5.4: 5.4.210-hardened1 -> 5.4.211-hardened1 (cherry picked from commit 8720e91143440e1940a9971dc2aabc888fa0bd4c) --- pkgs/os-specific/linux/kernel/hardened/patches.json | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/pkgs/os-specific/linux/kernel/hardened/patches.json b/pkgs/os-specific/linux/kernel/hardened/patches.json index 6ab7ddf2b5c6..e7259845f491 100644 --- a/pkgs/os-specific/linux/kernel/hardened/patches.json +++ b/pkgs/os-specific/linux/kernel/hardened/patches.json @@ -62,11 +62,11 @@ "5.4": { "patch": { "extra": "-hardened1", - "name": "linux-hardened-5.4.210-hardened1.patch", - "sha256": "0qbz9h97m0lxa45j85sv2lhhmrlx9nv5z0bf5vdhyq6g0h7d2mm9", - "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.210-hardened1/linux-hardened-5.4.210-hardened1.patch" + "name": "linux-hardened-5.4.211-hardened1.patch", + "sha256": "061c1c3ha88798l9q3n2dd3ankvw0hlz8f8cisxljpzfj4napk8z", + "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.211-hardened1/linux-hardened-5.4.211-hardened1.patch" }, - "sha256": "13l8zh5balciqhi4k4328sznza30v8g871wxcqqka61cij3rc0wl", - "version": "5.4.210" + "sha256": "1v1dgsk66fi6x6v9k6hg9ik3f3b3pv7a3gk8mybmgm9cnx0k5d5z", + "version": "5.4.211" } } From 98a5d374016f62b1711273b9b34926949f3f8fef Mon Sep 17 00:00:00 2001 From: Simon Bruder Date: Wed, 10 Aug 2022 21:57:46 +0200 Subject: [PATCH 24/25] webkitgtk: 2.36.5 -> 2.36.6 Fixes #185219. (cherry picked from commit 12d647d5c8ba60c755d9dc58f3bac484a9f77b06) --- pkgs/development/libraries/webkitgtk/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/libraries/webkitgtk/default.nix b/pkgs/development/libraries/webkitgtk/default.nix index 28dbfe796252..77cd8985c67a 100644 --- a/pkgs/development/libraries/webkitgtk/default.nix +++ b/pkgs/development/libraries/webkitgtk/default.nix @@ -67,7 +67,7 @@ stdenv.mkDerivation rec { pname = "webkitgtk"; - version = "2.36.5"; + version = "2.36.6"; outputs = [ "out" "dev" ]; @@ -75,7 +75,7 @@ stdenv.mkDerivation rec { src = fetchurl { url = "https://webkitgtk.org/releases/${pname}-${version}.tar.xz"; - sha256 = "sha256-1VMvqITJQ9xI8ZEUc91mOrpAejs1yqewS6wUGbQeWQg="; + sha256 = "sha256-EZO8ghlGM2d28N+l4NylZR8eVxV+2hLaRyHSRB8kpho="; }; patches = lib.optionals stdenv.isLinux [ From 20b8998f321c45406c58556d4a69d03243da3c2c Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Tue, 30 Aug 2022 00:09:04 +0200 Subject: [PATCH 25/25] webkitgtk: 2.36.6 -> 2.36.7 https://webkitgtk.org/2022/08/24/webkitgtk2.36.7-released.html https://webkitgtk.org/security/WSA-2022-0008.html Fixes: CVE-2022-32893 (cherry picked from commit cb40cdf49a9dfb5ebaa4dbfbc564420803e5a5cb) --- pkgs/development/libraries/webkitgtk/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/libraries/webkitgtk/default.nix b/pkgs/development/libraries/webkitgtk/default.nix index 77cd8985c67a..a8190ffb3928 100644 --- a/pkgs/development/libraries/webkitgtk/default.nix +++ b/pkgs/development/libraries/webkitgtk/default.nix @@ -67,7 +67,7 @@ stdenv.mkDerivation rec { pname = "webkitgtk"; - version = "2.36.6"; + version = "2.36.7"; outputs = [ "out" "dev" ]; @@ -75,7 +75,7 @@ stdenv.mkDerivation rec { src = fetchurl { url = "https://webkitgtk.org/releases/${pname}-${version}.tar.xz"; - sha256 = "sha256-EZO8ghlGM2d28N+l4NylZR8eVxV+2hLaRyHSRB8kpho="; + sha256 = "sha256-DCYM8rMvBIHQF2cN/tG2HlVJZ80GcZVgbJ+etf5zF0M="; }; patches = lib.optionals stdenv.isLinux [