From 7fa3ff547c884e934ec92553dcc17378e82bcdb8 Mon Sep 17 00:00:00 2001 From: Robert Scott Date: Sat, 4 Feb 2023 17:29:19 +0000 Subject: [PATCH 1/7] python3Packages.apache-airflow: add patch for CVE-2023-22884 --- .../apache-airflow/2.4.3-CVE-2023-22884.patch | 218 ++++++++++++++++++ .../python-modules/apache-airflow/default.nix | 4 + 2 files changed, 222 insertions(+) create mode 100644 pkgs/development/python-modules/apache-airflow/2.4.3-CVE-2023-22884.patch diff --git a/pkgs/development/python-modules/apache-airflow/2.4.3-CVE-2023-22884.patch b/pkgs/development/python-modules/apache-airflow/2.4.3-CVE-2023-22884.patch new file mode 100644 index 000000000000..5a2f7b665966 --- /dev/null +++ b/pkgs/development/python-modules/apache-airflow/2.4.3-CVE-2023-22884.patch @@ -0,0 +1,218 @@ +Based on upstream 45dd0c484e16ff56800cc9c047f56b4a909d2d0d with +minor adjustments to apply to airflow 2.4.3 + +diff --git a/airflow/providers/apache/hive/transfers/hive_to_mysql.py b/airflow/providers/apache/hive/transfers/hive_to_mysql.py +index 9c01b3162b..041f2940a7 100644 +--- a/airflow/providers/apache/hive/transfers/hive_to_mysql.py ++++ b/airflow/providers/apache/hive/transfers/hive_to_mysql.py +@@ -53,9 +53,9 @@ class HiveToMySqlOperator(BaseOperator): + import, typically used to move data from staging to + production and issue cleanup commands. (templated) + :param bulk_load: flag to use bulk_load option. This loads mysql directly +- from a tab-delimited text file using the LOAD DATA LOCAL INFILE command. +- This option requires an extra connection parameter for the +- destination MySQL connection: {'local_infile': true}. ++ from a tab-delimited text file using the LOAD DATA LOCAL INFILE command. The MySQL ++ server must support loading local files via this command (it is disabled by default). ++ + :param hive_conf: + """ + +@@ -108,7 +108,7 @@ class HiveToMySqlOperator(BaseOperator): + output_header=False, + hive_conf=hive_conf, + ) +- mysql = self._call_preoperator() ++ mysql = self._call_preoperator(local_infile=self.bulk_load) + mysql.bulk_load(table=self.mysql_table, tmp_file=tmp_file.name) + else: + hive_results = hive.get_records(self.sql, parameters=hive_conf) +@@ -121,8 +121,8 @@ class HiveToMySqlOperator(BaseOperator): + + self.log.info("Done.") + +- def _call_preoperator(self): +- mysql = MySqlHook(mysql_conn_id=self.mysql_conn_id) ++ def _call_preoperator(self, local_infile: bool = False) -> MySqlHook: ++ mysql = MySqlHook(mysql_conn_id=self.mysql_conn_id, local_infile=local_infile) + if self.mysql_preoperator: + self.log.info("Running MySQL preoperator") + mysql.run(self.mysql_preoperator) +diff --git a/airflow/providers/mysql/hooks/mysql.py b/airflow/providers/mysql/hooks/mysql.py +index 508ae6c56c..21ddc24a0b 100644 +--- a/airflow/providers/mysql/hooks/mysql.py ++++ b/airflow/providers/mysql/hooks/mysql.py +@@ -44,8 +44,12 @@ class MySqlHook(DbApiHook): + in extras. + extras example: ``{"iam":true, "aws_conn_id":"my_aws_conn"}`` + ++ You can also add "local_infile" parameter to determine whether local_infile feature of MySQL client is ++ going to be enabled (it is disabled by default). ++ + :param schema: The MySQL database schema to connect to. + :param connection: The :ref:`MySQL connection id ` used for MySQL credentials. ++ :param local_infile: Boolean flag determining if local_infile should be used + """ + + conn_name_attr = 'mysql_conn_id' +@@ -58,6 +62,7 @@ class MySqlHook(DbApiHook): + super().__init__(*args, **kwargs) + self.schema = kwargs.pop("schema", None) + self.connection = kwargs.pop("connection", None) ++ self.local_infile = kwargs.pop("local_infile", False) + + def set_autocommit(self, conn: MySQLConnectionTypes, autocommit: bool) -> None: + """ +@@ -119,8 +124,7 @@ class MySqlHook(DbApiHook): + conn_config["cursorclass"] = MySQLdb.cursors.DictCursor + elif (conn.extra_dejson["cursor"]).lower() == 'ssdictcursor': + conn_config["cursorclass"] = MySQLdb.cursors.SSDictCursor +- local_infile = conn.extra_dejson.get('local_infile', False) +- if conn.extra_dejson.get('ssl', False): ++ if conn.extra_dejson.get("ssl", False): + # SSL parameter for MySQL has to be a dictionary and in case + # of extra/dejson we can get string if extra is passed via + # URL parameters +@@ -130,7 +134,7 @@ class MySqlHook(DbApiHook): + conn_config['ssl'] = dejson_ssl + if conn.extra_dejson.get('unix_socket'): + conn_config['unix_socket'] = conn.extra_dejson['unix_socket'] +- if local_infile: ++ if self.local_infile: + conn_config["local_infile"] = 1 + return conn_config + +@@ -143,7 +147,7 @@ class MySqlHook(DbApiHook): + 'port': int(conn.port) if conn.port else 3306, + } + +- if conn.extra_dejson.get('allow_local_infile', False): ++ if self.local_infile: + conn_config["allow_local_infile"] = True + + return conn_config +diff --git a/airflow/providers/mysql/transfers/vertica_to_mysql.py b/airflow/providers/mysql/transfers/vertica_to_mysql.py +index 595b2cb01b..a8ff591d52 100644 +--- a/airflow/providers/mysql/transfers/vertica_to_mysql.py ++++ b/airflow/providers/mysql/transfers/vertica_to_mysql.py +@@ -52,9 +52,8 @@ class VerticaToMySqlOperator(BaseOperator): + import, typically used to move data from staging to production + and issue cleanup commands. (templated) + :param bulk_load: flag to use bulk_load option. This loads MySQL directly +- from a tab-delimited text file using the LOAD DATA LOCAL INFILE command. +- This option requires an extra connection parameter for the +- destination MySQL connection: {'local_infile': true}. ++ from a tab-delimited text file using the LOAD DATA LOCAL INFILE command. The MySQL ++ server must support loading local files via this command (it is disabled by default). + """ + + template_fields: Sequence[str] = ('sql', 'mysql_table', 'mysql_preoperator', 'mysql_postoperator') +@@ -89,7 +88,7 @@ class VerticaToMySqlOperator(BaseOperator): + + def execute(self, context: 'Context'): + vertica = VerticaHook(vertica_conn_id=self.vertica_conn_id) +- mysql = MySqlHook(mysql_conn_id=self.mysql_conn_id) ++ mysql = MySqlHook(mysql_conn_id=self.mysql_conn_id, local_infile=self.bulk_load) + + if self.bulk_load: + self._bulk_load_transfer(mysql, vertica) +diff --git a/docs/apache-airflow-providers-mysql/connections/mysql.rst b/docs/apache-airflow-providers-mysql/connections/mysql.rst +index 95d8e7aaba..e8b8091b83 100644 +--- a/docs/apache-airflow-providers-mysql/connections/mysql.rst ++++ b/docs/apache-airflow-providers-mysql/connections/mysql.rst +@@ -46,9 +46,6 @@ Extra (optional) + * ``charset``: specify charset of the connection + * ``cursor``: one of ``sscursor``, ``dictcursor``, ``ssdictcursor`` . Specifies cursor class to be + used +- * ``local_infile``: controls MySQL's LOCAL capability (permitting local data loading by +- clients). See `MySQLdb docs `_ +- for details. + * ``unix_socket``: UNIX socket used instead of the default socket. + * ``ssl``: Dictionary of SSL parameters that control connecting using SSL. Those + parameters are server specific and should contain ``ca``, ``cert``, ``key``, ``capath``, +@@ -99,14 +96,7 @@ Extra (optional) + If encounter UnicodeDecodeError while working with MySQL connection, check + the charset defined is matched to the database charset. + +- For ``mysql-connector-python`` the following extras are supported: ++ For ``mysql-connector-python`` no extras are supported: + +- * ``allow_local_infile``: Whether to enable ``LOAD DATA LOCAL INFILE`` capability. +- +- Example "extras" field: +- +- .. code-block:: json +- +- { +- "allow_local_infile": true +- } ++In both cases, when you want to use ``LOAD DATA LOCAL INFILE`` SQL commands of MySQl, you need to create the ++Hook with "local_infile" parameter set to True. +diff --git a/tests/providers/apache/hive/transfers/test_hive_to_mysql.py b/tests/providers/apache/hive/transfers/test_hive_to_mysql.py +index 7e056a17ba..97c4680931 100644 +--- a/tests/providers/apache/hive/transfers/test_hive_to_mysql.py ++++ b/tests/providers/apache/hive/transfers/test_hive_to_mysql.py +@@ -44,9 +44,11 @@ class TestHiveToMySqlTransfer(TestHiveEnvironment): + def test_execute(self, mock_hive_hook, mock_mysql_hook): + HiveToMySqlOperator(**self.kwargs).execute(context={}) + +- mock_hive_hook.assert_called_once_with(hiveserver2_conn_id=self.kwargs['hiveserver2_conn_id']) +- mock_hive_hook.return_value.get_records.assert_called_once_with('sql', parameters={}) +- mock_mysql_hook.assert_called_once_with(mysql_conn_id=self.kwargs['mysql_conn_id']) ++ mock_hive_hook.assert_called_once_with(hiveserver2_conn_id=self.kwargs["hiveserver2_conn_id"]) ++ mock_hive_hook.return_value.get_records.assert_called_once_with("sql", parameters={}) ++ mock_mysql_hook.assert_called_once_with( ++ mysql_conn_id=self.kwargs["mysql_conn_id"], local_infile=False ++ ) + mock_mysql_hook.return_value.insert_rows.assert_called_once_with( + table=self.kwargs['mysql_table'], rows=mock_hive_hook.return_value.get_records.return_value + ) +@@ -81,6 +83,7 @@ class TestHiveToMySqlTransfer(TestHiveEnvironment): + + HiveToMySqlOperator(**self.kwargs).execute(context=context) + ++ mock_mysql_hook.assert_called_once_with(mysql_conn_id=self.kwargs["mysql_conn_id"], local_infile=True) + mock_tmp_file_context.assert_called_once_with() + mock_hive_hook.return_value.to_csv.assert_called_once_with( + self.kwargs['sql'], +diff --git a/tests/providers/mysql/hooks/test_mysql.py b/tests/providers/mysql/hooks/test_mysql.py +index 911b9765c5..85d01ca830 100644 +--- a/tests/providers/mysql/hooks/test_mysql.py ++++ b/tests/providers/mysql/hooks/test_mysql.py +@@ -119,7 +119,7 @@ class TestMySqlHookConn(unittest.TestCase): + + @mock.patch('MySQLdb.connect') + def test_get_conn_local_infile(self, mock_connect): +- self.connection.extra = json.dumps({'local_infile': True}) ++ self.db_hook.local_infile = True + self.db_hook.get_conn() + assert mock_connect.call_count == 1 + args, kwargs = mock_connect.call_args +@@ -208,8 +208,8 @@ class TestMySqlHookConnMySqlConnectorPython(unittest.TestCase): + @mock.patch('mysql.connector.connect') + def test_get_conn_allow_local_infile(self, mock_connect): + extra_dict = self.connection.extra_dejson +- extra_dict.update(allow_local_infile=True) + self.connection.extra = json.dumps(extra_dict) ++ self.db_hook.local_infile = True + self.db_hook.get_conn() + assert mock_connect.call_count == 1 + args, kwargs = mock_connect.call_args +@@ -391,7 +391,7 @@ class TestMySql(unittest.TestCase): + @mock.patch.dict( + 'os.environ', + { +- 'AIRFLOW_CONN_AIRFLOW_DB': 'mysql://root@mysql/airflow?charset=utf8mb4&local_infile=1', ++ "AIRFLOW_CONN_AIRFLOW_DB": "mysql://root@mysql/airflow?charset=utf8mb4", + }, + ) + def test_mysql_hook_test_bulk_load(self, client): +@@ -404,7 +404,7 @@ class TestMySql(unittest.TestCase): + f.write("\n".join(records).encode('utf8')) + f.flush() + +- hook = MySqlHook('airflow_db') ++ hook = MySqlHook("airflow_db", local_infile=True) + with closing(hook.get_conn()) as conn: + with closing(conn.cursor()) as cursor: + cursor.execute( diff --git a/pkgs/development/python-modules/apache-airflow/default.nix b/pkgs/development/python-modules/apache-airflow/default.nix index d3911f370160..bc8781fd57c9 100644 --- a/pkgs/development/python-modules/apache-airflow/default.nix +++ b/pkgs/development/python-modules/apache-airflow/default.nix @@ -223,6 +223,10 @@ buildPythonPackage rec { # above INSTALL_PROVIDERS_FROM_SOURCES = "true"; + patches = [ + ./2.4.3-CVE-2023-22884.patch + ]; + postPatch = '' substituteInPlace setup.cfg \ --replace "colorlog>=4.0.2, <5.0" "colorlog" \ From dd5e1800e4eb0c3135bdfa46c9f278e823b5a924 Mon Sep 17 00:00:00 2001 From: Ashish SHUKLA Date: Sat, 24 Dec 2022 22:17:36 +0530 Subject: [PATCH 2/7] vaultwarden: 1.26.0 -> 1.27.0 (cherry picked from commit dc837121ca314e05bdb3e98b121d3ab5c0c27487) --- pkgs/tools/security/vaultwarden/default.nix | 12 +++--------- 1 file changed, 3 insertions(+), 9 deletions(-) diff --git a/pkgs/tools/security/vaultwarden/default.nix b/pkgs/tools/security/vaultwarden/default.nix index c3240a32e53c..91e481c5ab39 100644 --- a/pkgs/tools/security/vaultwarden/default.nix +++ b/pkgs/tools/security/vaultwarden/default.nix @@ -9,22 +9,16 @@ in rustPlatform.buildRustPackage rec { pname = "vaultwarden"; - version = "1.26.0"; + version = "1.27.0"; src = fetchFromGitHub { owner = "dani-garcia"; repo = pname; rev = version; - sha256 = "sha256-LPIc1odUBvjVJty3GYYFNhile4XBWMisLUeVtWH6xgE="; + hash = "sha256-QvU1Y3syr6PZbTRebbZF4sEzI4lIj1enJe2F/gGfvQM="; }; - cargoSha256 = "sha256-IfseODaoqlPNBlVjS+9+rKXAOq29TgULMA/ogmqg0NA="; - - postPatch = '' - # Upstream specifies 1.57; nixpkgs has 1.56 which also produces a working - # vaultwarden when using RUSTC_BOOTSTRAP=1 - sed -ri 's/^rust-version = .*//g' Cargo.toml - ''; + cargoHash = "sha256-lylRGg5pzJ4sBS3bY4ObMoJ5s5kakMLTtq1VOnmS5HM"; nativeBuildInputs = [ pkg-config ]; buildInputs = with lib; [ openssl ] From 749815187facfc923a6d44d6e89379077faeb201 Mon Sep 17 00:00:00 2001 From: Ashish SHUKLA Date: Sat, 24 Dec 2022 22:21:51 +0530 Subject: [PATCH 3/7] vaultwarden.webvault: 2022.10.0 -> 2022.12.0 (cherry picked from commit c0796f7158d05e1868f217d608ee78927fa4aba6) --- pkgs/tools/security/vaultwarden/webvault.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/tools/security/vaultwarden/webvault.nix b/pkgs/tools/security/vaultwarden/webvault.nix index b2ac61fc8575..74a75e24339c 100644 --- a/pkgs/tools/security/vaultwarden/webvault.nix +++ b/pkgs/tools/security/vaultwarden/webvault.nix @@ -2,11 +2,11 @@ stdenv.mkDerivation rec { pname = "vaultwarden-webvault"; - version = "2022.10.0"; + version = "2022.12.0"; src = fetchurl { url = "https://github.com/dani-garcia/bw_web_builds/releases/download/v${version}/bw_web_v${version}.tar.gz"; - hash = "sha256-Sf1YnOikjZmloTQvdrFH/UAevQqKQEkNNrCRUhvNZfA="; + hash = "sha256-QC3/aqIF2NdJPHmwUbvJR62wsUGBrgsHJCyqBJ/0gMc="; }; buildCommand = '' From 8e02996c974a5dd55f048d7a4f57e05f1f49d106 Mon Sep 17 00:00:00 2001 From: Rhys Davies Date: Thu, 12 Jan 2023 01:48:12 -0800 Subject: [PATCH 4/7] nixos/vaultwarden: fix test (cherry picked from commit eb4891d2d3331a0a1c06098f7af1574fa671f363) --- nixos/tests/vaultwarden.nix | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/nixos/tests/vaultwarden.nix b/nixos/tests/vaultwarden.nix index 87bea6633483..1bb3ef694b92 100644 --- a/nixos/tests/vaultwarden.nix +++ b/nixos/tests/vaultwarden.nix @@ -107,7 +107,7 @@ let wait = WebDriverWait(driver, 10) - wait.until(EC.title_contains("Create Account")) + wait.until(EC.title_contains("Create account")) driver.find_element(By.CSS_SELECTOR, 'input#register-form_input_email').send_keys( '${userEmail}' @@ -122,18 +122,20 @@ let '${userPassword}' ) - driver.find_element(By.XPATH, "//button[contains(., 'Create Account')]").click() + driver.find_element(By.XPATH, "//button[contains(., 'Create account')]").click() - wait.until_not(EC.title_contains("Create Account")) + wait.until_not(EC.title_contains("Create account")) + + driver.find_element(By.XPATH, "//button[contains(., 'Continue')]").click() driver.find_element(By.CSS_SELECTOR, 'input#login_input_master-password').send_keys( '${userPassword}' ) - driver.find_element(By.XPATH, "//button[contains(., 'Log In')]").click() + driver.find_element(By.XPATH, "//button[contains(., 'Log in')]").click() - wait.until(EC.title_contains("Bitwarden Web Vault")) + wait.until(EC.title_contains("Vaultwarden Web Vault")) - driver.find_element(By.XPATH, "//button[contains(., 'Add Item')]").click() + driver.find_element(By.XPATH, "//button[contains(., 'Add item')]").click() driver.find_element(By.CSS_SELECTOR, 'input#name').send_keys( 'secrets' From 1e56d76f106e626764ee91785fe32b2342cc836e Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Wed, 8 Mar 2023 10:05:29 +0100 Subject: [PATCH 5/7] [Backport release-22.11] masscan: add patch to fix resume functionality (#220039) --- pkgs/tools/security/masscan/default.nix | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/pkgs/tools/security/masscan/default.nix b/pkgs/tools/security/masscan/default.nix index b7924936d6ca..107ffe92b2cc 100644 --- a/pkgs/tools/security/masscan/default.nix +++ b/pkgs/tools/security/masscan/default.nix @@ -1,6 +1,7 @@ { lib , stdenv , fetchFromGitHub +, fetchpatch , installShellFiles , makeWrapper , libpcap @@ -17,6 +18,15 @@ stdenv.mkDerivation rec { sha256 = "sha256-mnGC/moQANloR5ODwRjzJzBa55OEZ9QU+9WpAHxQE/g="; }; + patches = [ + # Patches the missing "--resume" functionality + (fetchpatch { + name = "resume.patch"; + url = "https://github.com/robertdavidgraham/masscan/commit/90791550bbdfac8905917a109ed74024161f14b3.patch"; + sha256 = "sha256-A7Fk3MBNxaad69MrUYg7fdMG77wba5iESDTIRigYslw="; + }) + ]; + postPatch = lib.optionalString stdenv.isDarwin '' # Fix broken install command substituteInPlace Makefile --replace "-pm755" "-pDm755" From 752859e8e81987bc39c023f9ecbeed1163e422dc Mon Sep 17 00:00:00 2001 From: Michael Weiss Date: Tue, 7 Mar 2023 23:31:15 +0100 Subject: [PATCH 6/7] chromium: 110.0.5481.177 -> 111.0.5563.64 https://chromereleases.googleblog.com/2023/03/stable-channel-update-for-desktop.html This update includes 40 security fixes. CVEs: CVE-2023-1213 CVE-2023-1214 CVE-2023-1215 CVE-2023-1216 CVE-2023-1217 CVE-2023-1218 CVE-2023-1219 CVE-2023-1220 CVE-2023-1221 CVE-2023-1222 CVE-2023-1223 CVE-2023-1224 CVE-2023-1225 CVE-2023-1226 CVE-2023-1227 CVE-2023-1228 CVE-2023-1229 CVE-2023-1230 CVE-2023-1231 CVE-2023-1232 CVE-2023-1233 CVE-2023-1234 CVE-2023-1235 CVE-2023-1236 (cherry picked from commit de134a16be5e6393b8852b4c4aa61bc623c13eb8) --- .../browsers/chromium/upstream-info.json | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/pkgs/applications/networking/browsers/chromium/upstream-info.json b/pkgs/applications/networking/browsers/chromium/upstream-info.json index b52bee2dd824..179acb5aaa26 100644 --- a/pkgs/applications/networking/browsers/chromium/upstream-info.json +++ b/pkgs/applications/networking/browsers/chromium/upstream-info.json @@ -1,8 +1,8 @@ { "stable": { - "version": "110.0.5481.177", - "sha256": "1dy9l61r3fpl40ff790dbqqvw9l1svcgd7saz4whl9wm256labvv", - "sha256bin64": "0sylaf8b0rzr82dg7safvs5dxqqib26k4j6vlm75vs99dpnlznj2", + "version": "111.0.5563.64", + "sha256": "0x20zqwq051a5j76q1c3m0ddf1hhcm6fgz3b7rqrfamjppia0p3x", + "sha256bin64": "0rnqrjnybghb4h413cw3f54ga2x76mfmf1fp2nnf59c1yml4r4vf", "deps": { "gn": { "version": "2022-12-12", @@ -12,10 +12,10 @@ } }, "chromedriver": { - "version": "110.0.5481.77", - "sha256_linux": "1bdc4n9nz3m6vv0p4qr9v65zarbnkrbh21ivpvl7y7c25m7fxl20", - "sha256_darwin": "1scv9vvy5ybgbgycyz2wrymjhdqnvz0m6lxkax107437anxixs00", - "sha256_darwin_aarch64": "0gqayzhlif6hvsmpx04mxr1bld6kirv5q1n5dg42rc16gv954dkn" + "version": "111.0.5563.41", + "sha256_linux": "160khwa4x6w9gv5vkvalwbx87r6hrql0y0xr7zvxsir1x6rklwm2", + "sha256_darwin": "0z5q9r39jd5acyd79yzrkgqkvv3phdkyq4wvdsmhnpypazg072l6", + "sha256_darwin_aarch64": "0xiagydqnywzrpqq3i7363zhiywkp8ra9ygb2q1gznb40rx98pbr" } }, "beta": { From 626c01515fe27b1e2754a6457e07f9cd3629c0be Mon Sep 17 00:00:00 2001 From: cidkidnix Date: Wed, 8 Mar 2023 11:48:13 -0600 Subject: [PATCH 7/7] buildRustCrate: add libiconv to nativeBuildInputs on darwin Fixes linker errors while building build.rs where it tries to link libiconv but cannot find it. Rust executable build for Darwin need libiconv, and indeed buildInputs already has this case handled. So why is another change needed? Suppose we are cross compiling from Darwin (the build platform) to something else, and the package has a build.rs build script. The build script is built for the build platform (Darwin) and is also a regular Rust executable, needing libiconv, but due to cross compilation (and strict deps) we need an extra nativeBuildInput. (cherry picked from commit 856936abc863e1f9b95368c4ac300b0ac82c4e03) --- pkgs/build-support/rust/build-rust-crate/default.nix | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/pkgs/build-support/rust/build-rust-crate/default.nix b/pkgs/build-support/rust/build-rust-crate/default.nix index 98030225bcbb..207790b5583e 100644 --- a/pkgs/build-support/rust/build-rust-crate/default.nix +++ b/pkgs/build-support/rust/build-rust-crate/default.nix @@ -276,7 +276,9 @@ crate_: lib.makeOverridable name = "rust_${crate.crateName}-${crate.version}${lib.optionalString buildTests_ "-test"}"; version = crate.version; depsBuildBuild = [ pkgsBuildBuild.stdenv.cc ]; - nativeBuildInputs = [ rust stdenv.cc cargo jq ] ++ (crate.nativeBuildInputs or [ ]) ++ nativeBuildInputs_; + nativeBuildInputs = [ rust stdenv.cc cargo jq ] + ++ lib.optionals stdenv.buildPlatform.isDarwin [ libiconv ] + ++ (crate.nativeBuildInputs or [ ]) ++ nativeBuildInputs_; buildInputs = lib.optionals stdenv.isDarwin [ libiconv ] ++ (crate.buildInputs or [ ]) ++ buildInputs_; dependencies = map lib.getLib dependencies_; buildDependencies = map lib.getLib buildDependencies_;