Nix 2.28 was the last release packaged with the monolithic
common-meson.nix expression and is no longer maintained upstream.
Drop it together with the now-unused common-meson.nix and nix-perl.nix
helpers and the storeDir/stateDir/confDir plumbing that only fed
that code path.
in https://github.com/NixOS/nixpkgs/pull/532575
we were using hardcoded line numbers to disable tests
and the patch might not apply if upstream source
reordered the tests or added/removed entries
instead we added `removeFunctionalTests` helper to
directly comment out those lines in meson.build file
The test runner's buildInputs (writableTmpDirAsHomeHook, openssl)
need to be nativeBuildInputs. In the static (cross-musl) build,
strictDeps is enabled and only nativeBuildInputs are added to PATH.
With buildInputs, openssl was not in PATH, causing
HttpsBinaryCacheStoreTest.queryPathInfo to crash.
Master already contains the GHSA-g3g9-5vj6-r3gj sandbox escape fix and
the landlock abstract socket hardening, so drop the now-redundant
downstream backports.
The 2.28.6 tarball already contains the mdbook 0.5 compatibility fix
and the GHSA-g3g9-5vj6-r3gj sandbox escape fix, so drop the
now-redundant downstream backports.
The 2.34.5 tarball already contains the GHSA-g3g9-5vj6-r3gj sandbox
escape fix and the landlock abstract socket hardening, so drop the
now-redundant downstream backports.
The 2.31.4 tarball already contains the lowdown 3.0 compatibility fix,
the GHSA-g3g9-5vj6-r3gj sandbox escape fix and the landlock abstract
socket hardening, so drop the now-redundant downstream backports.
The 2.30.4 tarball already contains the mdbook 0.5, lowdown 3.0 and
GHSA-g3g9-5vj6-r3gj fixes that were previously backported downstream,
so drop the now-redundant patches.
This addresses GHSA-g3g9-5vj6-r3gj, a vulnerability where
std::filesystem::copy_file follows symlinks when copying FOD outputs,
allowing a malicious builder to overwrite files outside the build
sandbox.
The patch puts FOD output copies in a temporary directory inside the
store (instead of the chroot) and tightens permissions on the
in-store temporary directory.
The second patch partially fixes the issue with cooperating processes being able
to communicate via abstract sockets. The fix is partial, because processes
outside the landlock domain of the sandboxed process can still connect to
a socket created by the FOD. There's no equivalent way of restricting inbound
connections. This closes the gap when there's no cooperating process on the host
(i.e. 2 separate FODs).
The patch applies landlock LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET on
kernels >= 6.12 (default on NixOS 25.11+) to deny abstract socket
connect from inside the build sandbox.
This addresses GHSA-g3g9-5vj6-r3gj, a vulnerability where
std::filesystem::copy_file follows symlinks when copying FOD outputs,
allowing a malicious builder to overwrite files outside the build
sandbox.
The patch puts FOD output copies in a temporary directory inside the
store (instead of the chroot) and tightens permissions on the
in-store temporary directory.
The second patch partially fixes the issue with cooperating processes being able
to communicate via abstract sockets. The fix is partial, because processes
outside the landlock domain of the sandboxed process can still connect to
a socket created by the FOD. There's no equivalent way of restricting inbound
connections. This closes the gap when there's no cooperating process on the host
(i.e. 2 separate FODs).
The patch applies landlock LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET on
kernels >= 6.12 (default on NixOS 25.11+) to deny abstract socket
connect from inside the build sandbox.
This addresses GHSA-g3g9-5vj6-r3gj, a vulnerability where
std::filesystem::copy_file follows symlinks when copying FOD outputs,
allowing a malicious builder to overwrite files outside the build
sandbox.
The patch puts FOD output copies in a temporary directory inside the
store (instead of the chroot) and tightens permissions on the
in-store temporary directory.
The second patch partially fixes the issue with cooperating processes being able
to communicate via abstract sockets. The fix is partial, because processes
outside the landlock domain of the sandboxed process can still connect to
a socket created by the FOD. There's no equivalent way of restricting inbound
connections. This closes the gap when there's no cooperating process on the host
(i.e. 2 separate FODs).
The patch applies landlock LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET on
kernels >= 6.12 (default on NixOS 25.11+) to deny abstract socket
connect from inside the build sandbox.
