It's a release candidate but it works with new WebKitGTK and we don't build old
one anymore because of vulnerabilities.
(cherry picked from commit 4a6ba21bdd)
For some reason, between Linux 4.4.19 and 4.4.20, the atkbd and libps2
kernel modules lost their dependency on i8042 in modules.dep, causing
i8042 not to be included in the initrd. This breaks keyboard in the
initrd, in turn breaking LUKS.
This only happens on the 16.03 branch; on 16.09, it appears i8042 is
pulled into the initrd anyway (through some other dependency,
presumably). But let's include it explicitly.
http://hydra.nixos.org/build/40468431
(cherry picked from commit e6088f77be)
Per #17143 on GitHub, `gnome-maps` currently fails due to missing
Webkit2. Adding `webkitgtk` to `buildInputs` fixes the issue.
(cherry picked from commit ecd41c19b8)
[Bjørn: orig commit was for GNOME 3.20, I backported it to 3.18 (trivial).]
The test runner would import all modules to check whether they might
have tests.
On a Linux system it would load the Tornado module that depends on
kqueue, which is BSD only, and fail.
(cherry picked from commit 6876eab511)
Using types.str doesn't work if you want to mkBefore/mkAfter across
different module definitions, because it only allows for one definition
for the same priority.
This is especially useful if you deploy Hetzner machines via NixOps,
because the physical specification already defines localCommands.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
(cherry picked from commit 97801380b0)
The define CURL_STRICTER is only set if CURL_NO_OLDIES is set, but that breaks
compatibility with this package. Defining CURL_STRICTER is enough to fix the
build.
(cherry picked from commit 46790f360d)
Let's make sure we indent using two spaces, because the unpackPhase was
indented using four spaces.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
(cherry picked from commit 8f08399671)
The patch for kernel version 3.18 is already applied upstream, so we
don't need it any longer.
Without i686-build-failure.patch, the build for i686-linux fails because
it references rdtscl(), which is no longer available in Linux 4.3.0.
Patch for missing rdtscl() is from Arch Linux:
https://aur.archlinux.org/cgit/aur.git/tree/002-rdtscl.patch?h=broadcom-wl-ck
I've tested building against 32 and 64 bit Linux versions 3.18.36,
4.4.16 and 4.7.0.
The hashes were verified using the ones from the AUR (using the 16 bit
hashes of course):
$ nix-hash --type sha256 --to-base16 1kaqa2dw3nb8k23ffvx46g8jj3wdhz8xa6jp1v3wb35cjfr712sg
4f8b70b293ac8cc5c70e571ad5d1878d0f29d133a46fe7869868d9c19b5058cd
$ nix-hash --type sha256 --to-base16 1gj485qqr190idilacpxwgqyw21il03zph2rddizgj7fbd6pfyaz
5f79774d5beec8f7636b59c0fb07a03108eef1e3fd3245638b20858c714144be
AUR hashes can be found at:
https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=broadcom-wl&id=9d6f10b1b7745fbf5d140ac749e2253caf70daa8#n26
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
Cc: @phreedom, @vcunat
(cherry picked from commit bd7ce1581d)
(cherry picked from commit 93d8ab8007)
I checked with kdenlive people, and they say that we should always use the
latest mlt possible; that it should not be any problem, and provide only
improvements.
(cherry picked from commit 9f9cac34d3)
- Pass -Wno-error=pedantic to work around ISO C violations
- Build with X11 unconditionally (also rely on pkgconfig for
detection, --enable-x11 does not work)
- Build against evemu
(cherry picked from commit 3f5d7c7e04)
Merging the branch where I added it, which has some steps
forward/backward.
The changes for master (applications-16.04) are slightly different,
and although I tried to port it there, kdenlive just crashes on start.
Someone should port it there.
Similar to #14272, but fixes 4.5 build rather than generic.
- Ignores errors due to strict-overflow warnings
- Strips clang-only '-Wno-format-pedantic' flag out since this build
uses gcc
(cherry picked from commit 16bd51fc0d)
Fixes https://hydra.nixos.org/build/37879354/nixlog/1/raw
CGI.pm was removed from Perl core in v5.22, breaking the gitweb.cgi
script and thus NixOS' services.lighttpd.gitweb. Nixpkgs switched to
Perl 5.22 with a85ba820a4 ("perl: Make 5.22 the default").
Fix it by bringing in the Perl CGI module (and dependency HTMLParser).
The closure size of "nix-build -A git" increase by 1 MiB, to 201 MiB.
(cherry picked from commit e7ef33c50a)
I'm unable to provide reasonable support for grsecurity on the 16.03 release
branch. Mark as broken to more accurately reflect the current state of
affairs. Also disable the grsecurity test.
If sombody wishes to maintain grsecurity on 16.03, please revert this commit.
Closes https://github.com/NixOS/nixpkgs/issues/17061
ecryptfs: add nixos/tests/ecryptfs.nix
(cherry picked from commit ab6fc29719)
ecryptfs: test bug from #16766
(cherry picked from commit d781bf94c1)
ecryptfs: add test to release (#16910)
Would have caught regression #16766
(cherry picked from commit f76a8fbbac)
ecryptfs: add test to release-combined.nix
(cherry picked from commit de80d0544c)
Security fixes:
- Message printout was vulnerable to format string injection
- dropbearconvert import of OpenSSH keys could run arbitrary code
as the local dropbearconvert user when parsing malicious key
files
- dbclient could run arbitrary code as the local dbclient user if
particular -m or -c arguments are provided
- dbclient or dropbear server could expose process memory to the
running user if compiled with DEBUG_TRACE and running with -v
Fixes:
- Fix port forwarding failure when connecting to domains that have
both IPv4 and IPv6 addresses. The bug was introduced in 2015.68
- Fix 100% CPU use while waiting for rekey to complete
(cherry picked from commit 7c84bd121a)
Problems include buffer overflows, null pointer dereferences, and
other bugfixes.
- CVE-2016-3477
- CVE-2016-3521
- CVE-2016-3615
- CVE-2016-5440
Details:
https://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-50.html
backporting @grahamc's work to release-16.03
Some recent perl version introduced "keys" to return the keys
in random order. As some of the packages are solved by "provides" and
based on the order, this randomness affects what packages get into the
closure.
This problem may be in other nix perl scripts.
(cherry picked from commit 202ebf794c)
This can fail randomly with
CC systemkey.o
In file included from systemkey.c:47:0:
systemkey-args.h:1:1: error: unterminated comment
/* -*- buffer-read-only: t -*- vi: set ro:
which is presumably caused by a race with the generation step above:
autogen systemkey-args.def
http://hydra.nixos.org/build/37878764#tabs-buildsteps
(cherry picked from commit 024cb9eecd)
The 3.4.x test suite contains a certificate that expired June 29,
leading to:
FAIL: name-constraints
======================
...
Chain verification output: Not verified. The certificate is NOT trusted. The certificate chain uses expired certificate.
This patch adds a dependency on the LWP perl module so that Slic3r can
make HTTP connections to Octoprint and send G-code to a remote printer.
(cherry picked from commit f303a072c0)
The hiddev CVE patch, added in
10ba79450b
breaks the grsecurity kernel build. For now, the simplest solution is to set
kernel patches applied to the grsec base kernel explicitly rather than
inheriting patches from linux_4_5.
Fixes https://github.com/NixOS/nixpkgs/issues/17061
A disabled systemd service with a "startAt" attribute, like this:
systemd.services.foo-service = {
enable = false;
startAt = "*-*-* 05:15:00";
...
};
will cause the following errors in the system journal:
systemd[1]: foo-service.timer: Refusing to start, unit to trigger not loaded.
systemd[1]: Failed to start foo-service.timer.
Fix it by not generating the corresponding timer unit when the service
is disabled.
(cherry picked from commit 2eb8aab42c)
Currently NixOS creates the swapfile (with the specified size) only if
it doesn't already exist. Changing the swapfile size afterwards will not
have any effect.
This commit changes that so the swapfile will be recreated whenever
swapDevices.*.size is changed (or more precisely, whenever the actual
file size differs from the configured one), allowing both growing and
shrinking the swapfile.
The service unit has "restartIfChanged = false", so we don't have to
worry about the swapfile being in use at the time this code is run (you
have to reboot for swapfile changes).
fallocate doesn't shrink files, use truncate for that. truncate can also
be used to grow files, but it creates "holes" in the file which doesn't
work with swapfiles.
(cherry picked from commit b30852ed41)
':' is currently used as separator in /boot/grub/state for the list of
devices GRUB should be installed to. The problem is that ':' itself may
appear in a device path:
/dev/disk/by-id/usb-SanDisk_Cruzer_20043512300546C0B317-0:0
With such a path, NixOS will install GRUB *every* time, because it
thinks the configuration differs from the state file (due to the wrong
list split). Fix it by using ',' as separator.
For existing systems with GRUB installed on multiple devices, this
change means that GRUB will be installed one extra time.
(cherry picked from commit aeb516c741)
Bugfix release, backwards compatible:
https://github.com/lathiat/avahi/releases/tag/v0.6.32
* Update src URL to github (the latest release is only available there).
* Change "$(mkdir_p)" to "$(MKDIR_P)" in the patch to keep it working
(apply'able).
(cherry picked from commit 79ed40cd69)
Currently pencil won't start, due to incompatible firefox version:
$ pencil
Error: Platform version '47.0.1' is not compatible with
minVersion >= 36.0
See https://github.com/prikhi/pencil/issues/840.
(cherry picked from commit 5b6e3a3ed1)
This fixes the following error when trying to run wxPython applications:
libgobject-2.0.so.0: cannot open shared object file: No such file or directory
This only applies to 16.03. The master branch is not affected.
Fixes issue when upgrading from very old NixOS systems that don't have
systemd-escape in $PATH:
$ sudo nixos-rebuild switch
...
building the system configuration...
updating GRUB 2 menu...
Can't exec "systemd-escape": No such file or directory at /nix/var/nix/profiles/system/bin/switch-to-configuration line 264.
Unable to escape /!
(cherry picked from commit 9050077cff)
Fixed for all available 4.x series kernels.
From CVE-2016-5829:
Multiple heap-based buffer overflows in the hiddev_ioctl_usage function
in drivers/hid/usbhid/hiddev.c in the Linux kernel through 4.6.3 allow
local users to cause a denial of service or possibly have unspecified
other impact via a crafted (1) HIDIOCGUSAGES or (2) HIDIOCSUSAGES ioctl
call.
(cherry picked from commit dde259dfb5)
The ddclient daemon requires that the configuration file is only
accessible by the ddclient user. This since it typically contains login
information.
(cherry picked from commit 9f4775dbb5)
The shairport-sync service currently fails to start with the error
shairport avahi_entry_group_new failed
This problem seems to have been introduced by
cdd7310a50
After some trial and error I concluded that the attached commit is a minimal
fix.
(cherry picked from commit 5f3c4bd11e)
(cherry picked from commit 13c6b9ba85)
[Bjørn: Without this commit, zim fails to start:
"ERROR: Failed running: $PWD/zim", where $PWD is the (expanded) current
working directory. Fix by making sys.argv[0] an absolute path to zim.]
This fixed a problem I had when running ElasticSearch in an LXC
container, and it doesn't hurt using a dedicated group instead of
nogroup anyway.
(cherry picked from commit 9facb7078b)
Instead of showing this output from "nixos-rebuild switch":
warning: not applying GID change of group ‘munin’
warning: not applying UID change of user ‘ntp’
print this:
warning: not applying GID change of group ‘munin’ (95 -> 102)
warning: not applying UID change of user ‘ntp’ (3 -> 179)
This makes it possible for users to take action and fixup the UIDs/GIDs
that NixOS won't touch.
(cherry picked from commit 6e528893a8)
Fixes this (line wrapped):
$ gnome-control-center
[... click on the "Color" item ...]
(gnome-control-center:3977): color-cc-panel-WARNING **: \
The name org.freedesktop.ColorManager was not provided by any .service files
With this patch applied, the above warnings are not printed and the GUI
shows some devices that can be managed (my printer and display). Without
this patch the GUI is empty (non-functional).
(cups will also complain in the journal with a similar message when
doing print jobs, without this patch.)
(cherry picked from commit 66ee7a4c46)
(cherry picked from commit 4e58b33dee)
[Bjørn: Add ./services/x11/colord.nix to module-list.nix, was missing in
the above commit. (It was added as part of 776845bbeb
("xiccd: init at 0.2.2") though.)
]
* Add missing modules (fixes warnings and errors).
* Step 1 to unbreak starting Xvfb by making xpra invoke it with
valid log dir ($HOME/.xpra). Without this fix, it is invoked with
~/.xpra, which Xvfb doesn't know how to interpret and uses it
literally (fail). Step 2 will be fixing an Xvfb permission issue:
"xf86OpenConsole: Cannot open virtual console 1 (Permission denied)".
* Use XPRA_INSTALL_PREFIX to make it find its icons.
(cherry picked from commit 6d48539fdb)
This patch fixes an issue introduced by b897f825942b63ab790cad9ed66c8a79cbb3fc2d
where the bundled tor fails to run.
The error message claims that it cannot communicate with tor, but what actually
happens is that tor never runs at all, because it is invoked with a non-existent
rc file. Specifying an absolute path to the torrc-defaults file fixes the
problem. For good measure, we specify an absolute path to the tor executable
itself as well; we want as little autodetection logic as possible.
Note that users of torbrowser *must* remove the existing `~/.torbrowser4` folder
for this to take effect, otherwise torbrowser will continue to use extension
data from the previous release (this is why some existing users were able to
successfully use the new torbrowser version, see
https://github.com/NixOS/nixpkgs/pull/15854).
(cherry picked from commit 961164a8a7)
...by adding system-config-printer to services.dbus.packages (if
services.printing.enable is true).
Without this patch, trying to add a printer will result in a little dialog
saying "Failed to add new printer" and gnome-control-center will print this to
the terminal (line wrapped):
(gnome-control-center:3546): printers-cc-panel-WARNING **: \
GDBus.Error:org.freedesktop.DBus.Error.ServiceUnknown: \
The name org.fedoraproject.Config.Printing was not provided by any .service files
system-config-printer supplies the "org.fedoraproject.Config.Printing" dbus
service, thus fixing the problem.
(cherry picked from commit a156a8ab1a)
The service file refers to /usr/bin/... instead of a Nix store path.
Fix it.
The original fix was wrongly removed in commit 03353ce6ff
("system-config-printer: 1.3.12 -> 1 5.7"). We can remove this fixup on
the _next_ upstream release.
(cherry picked from commit b741df943f)
stable 51.0.2704.63 => 51.0.2704.103
beta 51.0.2704.63 => 52.0.2743.41
dev 52.0.2743.10 => 53.0.2767.4
This addresses 15 security fixes, including:
* High CVE-2015-1696: Cross-origin bypass in Extension bindings. Credit to
anonymous.
* High CVE-2015-1697: Cross-origin bypass in Blink. Credit to Mariusz
Mlynski.
* Medium CVE-2016-1698: Information leak in Extension bindings. Credit to
Rob Wu.
* Medium CVE-2016-1699: Parameter sanitization failure in DevTools. Credit
to Gregory Panakkal.
* Medium CVE-2016-1700: Use-after-free in Extensions. Credit to Rob Wu.
* Medium CVE-2016-1701: Use-after-free in Autofill. Credit to Rob Wu.
* Medium CVE-2016-1702: Out-of-bounds read in Skia. Credit to cloudfuzzer.
See: http://googlechromereleases.blogspot.com/2016/06/stable-channel-update.html
(cherry picked from commit 1f1f0f049b)
Reason: 18 Security fixes for the stable channel.
The user only has to agree on the terms and conditions before
downloading the file. We might as well give him access to the full URL
by default.
(cherry picked from commit a6593a16f7)
Programming tools for Atmel SAM3/7/9 ARM-based microcontrollers.
(I've only runtime tested the 64-bit binary, not the 32-bit one.)
(cherry picked from commit fbde3a7452,
plus removing ".lib" from "stdenv.cc.cc.lib" to be compatible with
release-16.03.)
Add Debian patches (with fetchpatch) to make things work. Among other
things, the patches port the application from V4L to V4L2.
This increases the closure size from 729 MiB to 730 MiB.
(cherry picked from commit 65ccda5b96)
This is the original pull request plus some commits from me to bring all
channels to the latest versions, because the fixed security
vulnerabilites might not be fixed in the dev version we had before.
I've tested the whole changeset on my Hydra at:
https://headcounter.org/hydra/eval/322006
Thanks to @srp for the initial commit and thus implicitly also for the
security notice.
Cc: @abbradar
(backported from commit b5f95a5303)
Reason: Lots of security fixes (see e2d067d)
Fixes
Cannot do `initialize' in Term::ReadLine::Gnu at /nix/store/8kld1l6cn75lh0csw8wq6zbccallkr73-nixos-test-driver/bin/.nixos-test-driver-wrapped line 115.
when running NixOS VM tests interactively.
(cherry picked from commit 012313f253)
If an option value is not a list, you now get
The option value `bla' in `file.nix' is not a list.
rather than
value is a string while a list was expected, at .../nixpkgs/lib/lists.nix:49:56
(cherry picked from commit b056948c00)
The existence of $root/var/lib/private/host-notify as a socket
prevented a bind mount:
container foo[8083]: Failed to create mount point /var/lib/containers/foo/var/lib/private/host-notify: No such device or address
(cherry picked from commit b37d6d8996)
Screenshot and annotation tool.
The application may complain about missing GConf dbus service[1], but it
still works (and remembers its settings, AFAICT).
[1]: The error message is (line wrapped):
GConf Error: Failed to contact configuration server; the most
common cause is a missing or misconfigured D-Bus session bus daemon. See
http://projects.gnome.org/gconf/ for information. (Details - 1: GetIOR
failed: GDBus.Error:org.freedesktop.DBus.Error.ServiceUnknown: The name
org.gnome.GConf was not provided by any .service files)
(cherry picked from commit 0b3b45c5a7)
shutter is a screenshot and annotation GUI tool, coming to Nix soon.
This commit adds its needed perl dependencies:
Gnome2, Gnome2Canvas, Gnome2VFS, Gnome2Wnck, GooCanvas,
Gtk2AppIndicator, Gtk2ImageView, Gtk2Unique, ProcSimple
All expressions are created with nix-generate-from-cpan and manual
tweaks to (propagated)buildInputs and meta.license.
(cherry picked from commit 444afc43ac)
I'm not updating to the 2.x version yet, because the only dependee of
this package is 'shutter' (which I'm about to package) and it doesn't
support 2.x.
(cherry picked from commit b9f30bdc20)
... by reverting an upstream commit
/cc #15697.
I should make some distro pay me for digging into such things :-)
(cherry picked from commit 3069606108)
iproute is required for blocking via null routes; without it, rules
based on routes.conf will fail.
Closes#15638
(cherry picked from commit 77028b1e8d)
The motivation is using sudo in chroot nix builds, a somewhat
special edge case I have and pulling system path into chroot
yields to some very nasty bug like
https://github.com/NixOS/nixpkgs/issues/15581
Previously:
$ cat /var/setuid-wrappers/sudo.real
/nix/store/3sm04dzh0994r86xqxy52jjc0lqnkn65-system-path/bin/sudo
After the change:
$ cat /var/setuid-wrappers/sudo.real
/nix/store/4g9sxbzy8maxf1v217ikp69c0c3q12as-sudo-1.8.15/bin/sudo
The 0.x versions is for Qt 4, whereas the new 1.x is for Qt 5. We'll
update to the Qt 5 version later. Upstream currently makes simultaneous
releases of both Qt 4 and 5 branches.
(cherry picked from commit cc41cb30e3)
Cherry-picking directly from master is now unsafe (ref. parent commit),
because fetchgit on master branch creates different hashes than on
release-16.03. (And I didn't notice until building on a *different*
machine, because on my first machine, the source was already
downloaded...)
When enableRootTrustAnchor is set to false, there is really no point in
initializing the root key before starting unbound.
Fixes#15605.
(cherry picked from commit bf0e745597)
Fixes this build error:
dynamic_fmt.o: In function `DynamicFunc__crypt_md5_to_input_raw_Overwrite_NoLen':
.../john-1.8.0-jumbo-1/src/dynamic_fmt.c:4989: undefined reference to `MD5_body_for_thread'
Upstream issue:
https://github.com/magnumripper/JohnTheRipper/issues/1093
(cherry picked from commit d5656873d7)
This changes cygwin stdenv, but I don't think it will hurt much people.
This allows mkDerivation to get "dontRebase=true" to skip the usual cygwin
rebase. This is required, if we are using this stdenv to build DLLs for win32
inside x86_64-cygwin, because /bin/rebase crashes at finding an arch mismatch.
Additionally, we don't need any rebase for libraries built by visual studio and
meant for visual studio (my use case).
I'm using nix in x86_64-cygwin to build libraries with visual studio, both for
x86_64 and x86.
(cherry picked from commit f6f5c185ca)
Note, CVE-2015-1283 is already patched in expat version 2.1.1 but, as
explained in the patch, the fix was insufficient.
(cherry picked from commit 34cf7934c3)
[This is a re-application of the patch that was originally written for
GNOME 3.16. It was lost during the transition to GNOME 3.18.]
Silly ./configure, it looks for dbus file from gnome-shell in the
installation tree of the package it is configuring. Fix by copying the
needed file from gnome-shell before ./configure is run.
This change makes gnome-shell a build time dependency (not runtime).
(cherry picked from commit ca717d0d65)
Changelog:
http://support.saleae.com/hc/en-us/articles/210245593-Saleae-Logic-Beta-Software-Changelog
(Yes, the changelog title contains the word 'beta', but as of version
1.2.9 the beta branding is removed from the software as the beta branch
was merged to master.)
This software update is required for newer logic analysers (e.g. Logic
Pro 8). (The original Logic is still supported, although it's difficult
to find info about it on their website.)
v1.2.9 grew new dependencies: libxcb, zlib, pciutils, xkeyboardconfig.
The LD_PRELOAD library hack, used to divert writes from
$out/Settings/settings.xml to $HOME/.saleae-logic-settings.xml, has been
updated. The new software writes more paths
($out/{Settings,Errors,Databases,Calibration}) and uses a few extra
library calls to access those paths
(open,openat,stat,access,unlink,...). So instead of single file
redirect, the library now redirects accesses to all those directories,
mirrored in $HOME/.saleae-logic/. (Existing
$HOME/.saleae-logic-settings.xml files will be automatically migrated to
$HOME/.saleae-logic/Settings/settings.xml.)
(cherry picked from commit 314b1fbf0c)
[release-16.03 backport note: s/stdenv.cc.cc.lib/stdenv.cc.cc/ to fix
error: attribute ‘lib’ missing, at .../saleae-logic/default.nix:19:65]
Also revert to using the grsecurity-scrape mirror; relying on upstream
just isn't viable. Lately, updates have been so frequent that a new
version is released before Hydra even gets around to building the
previous one.
(cherry picked from commit 6194e9d801)
The chroot caps restriction disallows chroot'ed processes from running
any command that requires `CAP_SYS_ADMIN`, breaking `nixos-rebuild`. See
e.g., https://github.com/NixOS/nixpkgs/issues/15293
This significantly weakens chroot protections, but to break
nixos-rebuild out of the box is too severe.
(cherry picked from commit d4d7bfe07b)
From now on, only the testing branch of grsecurity will be supported.
Additionally, use only patches from upstream.
It's impossible to provide meaningful support for grsecurity stable.
First, because building and testing \(m \times n \times z) [1], packages
is infeasible. Second, because stable patches are only available from
upstream for-pay, making us reliant on third-parties for patches. In
addition to creating yet more work for the maintainers, using stable
patches provided by a third-party goes against the wishes of upstream.
nixpkgs provides the tools necessary to build grsecurity kernels for any
version the user chooses, however, provided they pay for, or otherwise
acquire, the patch themselves.
Eventually, we'll want to remove the now obsolete top-level attributes,
but leave them in for now to smoothe migration (they have been removed
from top-level/release.nix, though, because it makes no sense to have
them there).
[1]: where \(m\) is the number of grsecurity flavors, \(n\) is the
number of kernel versions, and z is the size of the `linuxPackages` set
(cherry picked from commit 0bd31bce10)
Requirement without ordering implies parallel execution; it is crucial
that sysctl tunables are finalized before the lock is engaged, however.
(cherry picked from commit 60a27781d6)
Overview of the updated versions:
beta: 50.0.2661.49 -> 51.0.2704.47
dev: 51.0.2693.2 -> 52.0.2729.3
It has been a while since we had a major Chromium update that compiled
and worked without troubles, but version 52 builds and the VM tests are
successful as well:
https://headcounter.org/hydra/eval/320335
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
(cherry picked from commit ad2c8d3510)
Reason: 50.0.2661.102 fixes a bunch of security vulnerabilities and
we want to have them fixed in beta/dev as well.
This addresses the following security fixes:
* High CVE-2016-1667: Same origin bypass in DOM. Credit to
Mariusz Mlynski.
* High CVE-2016-1668: Same origin bypass in Blink V8 bindings. Credit
to Mariusz Mlynski.
* High CVE-2016-1669: Buffer overflow in V8. Credit to Choongwoo Han.
* Medium CVE-2016-1670: Race condition in loader. Credit to anonymous.
* Medium CVE-2016-1671: Directory traversal using the file scheme on
Android. Credit to Jann Horn.
See: http://googlechromereleases.blogspot.com/2016/05/stable-channel-update.html
Signed-off-by: Scott R. Parish <srparish@gmail.com>
Tested-by: aszlig <aszlig@redmoonstudios.org>
Closes: #15446
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
(cherry picked from commit 5ebf20db0f)
Release announcement, 2016-01-30:
https://www.sigrok.org/blog/major-sigrok-releases-libsigrok-libsigrokdecode-sigrok-cli-pulseview
I first tried updating the projects in separate commits. But later I
found cyclic dependencies, that would break git bisect, so I ended up
squashing the commits:
* libsigrok: 0.3.0 -> 0.4.0
Enable building libsigrokcxx.so, the C++ bindings for libsigrok, by
adding doxygen, glibmm and python as build deps. This is needed for
Pulseview >= 0.3.0. Also update the firmware (sigrok-firmware-fx2lafw)
while at it.
* libsigrokdecode: 0.3.0 -> 0.4.0
* sigrok-cli: 0.5.0 -> 0.6.0
* pulseview: 0.2.0 -> 0.3.0
New dependency: glibmm (due to libsigrokcxx.pc from libsigrok).
Note that collectd is incompatible with the new libsigrok release, so
I let it use the old one (0.3.0).
(cherry picked from commit 300e495101)
The current URL is broken, upstream has moved the download from .../files/ to
.../files_legacy/. But after fixing that, starting hashcat results in:
$ ./result/bin/hashcat
ERROR: this copy of hashcat is outdated. Get a more recent version.
So just update to latest.
New releases are on github, the license is now MIT and there are build
system changes.
(cherry picked from commit 800042b310)
Still using GTK+ 2 for now, since apparently building with GTK+ 3
still requires GTK+ 2, increasing the closure size. (#15008)
(cherry picked from commit 930d243ea4)
It wants it to detect if there are filesystems present in block devices, in
case of pvcreate. Otherwise it complaints "lvm built without blkid support" and
lacks the feature of detecting/wiping.
(cherry picked from commit 2f35e223b1)
I fixed an easy conflict.
Otherwise, mountd was started exporting directories before local-fs was ready,
and it failed to start nfsd on missing fs.
(cherry picked from commit 9f6afb7d78)
It takes some extra 13MB (and in dev, not out), but allows perf to show kernel
symbols when profiling. I think it is worth it.
In my NixOS, I refer to it in the system derivation, for easy telling to perf
through /run/booted-system/vmlinux:
system.extraSystemBuilderCmds = ''
ln -s ${config.boot.kernelPackages.kernel.dev}/vmlinux $out/vmlinux
'';
(cherry picked from commit 53a4582552)
Fixes changes after #14080 where the updated hash was missing.
Put the source in a common file so there is only one place to update.
(cherry picked from commit 23b9d037de)
Backported from master to facilitate future updates.
Merges pull request #15275:
This addresses #15226 and fixes killing of processes before
switching from the initrd to the real root.
Right now, the pkill that is issued not only kills user space
processes but also sends a SIGKILL to kernel threads as well.
Usually these threads ignore signals, but some of these processes do
handle signals, like for example the md module, which happened in
#15226.
It also adds a small check for the swraid installer test and a
standalone test which checks on just that problem, so in the future
this shouldn't happen again.
This has been acked by @edolstra on IRC.
The reason I'm merging this to 16.03 is that this branch fixes#15226
and thus also fixes mdraid setups out there.
Tested using the boot-stage1.nix NixOS test against release-16.03.
As @edolstra pointed out that the kernel module might be painful to
maintain. I strongly disagree because it's only a small module and it's
good to have such a canary in the tests no matter how the bootup process
looks like, so I'm going the masochistic route and try to maintain it.
If it *really* becomes too much maintenance burden, we can still drop or
disable kcanary.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
We don't want to push out a channel update whenever this test fails,
because that might have unexpected and confused side effects and it
*really* means that stage 1 of our boot up is broken.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
We already have a small regression test for #15226 within the swraid
installer test. Unfortunately, we only check there whether the md
kthread got signalled but not whether other rampaging processes are
still alive that *should* have been killed.
So in order to do this we provide multiple canary processes which are
checked after the system has booted up:
* canary1: It's a simple forking daemon which just sleeps until it's
going to be killed. Of course we expect this process to not
be alive anymore after boot up.
* canary2: Similar to canary1, but tries to mimick a kthread to make
sure that it's going to be properly killed at the end of
stage 1.
* canary3: Like canary2, but this time using a @ in front of its
command name to actually prevent it from being killed.
* kcanary: This one is a real kthread and it runs until killed, which
shouldn't be the case.
Tested with and without 67223ee and everything works as expected, at
least on my machine.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
This is a regression test for #15226, so that the test will fail once we
accidentally kill one or more of the md kthreads (aka: if safe mode is
enabled).
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
Unfortunately, pkill doesn't distinguish between kernel and user space
processes, so we need to make sure we don't accidentally kill kernel
threads.
Normally, a kernel thread ignores all signals, but there are a few that
do. A quick grep on the kernel source tree (as of kernel 4.6.0) shows
the following source files which use allow_signal():
drivers/isdn/mISDN/l1oip_core.c
drivers/md/md.c
drivers/misc/mic/cosm/cosm_scif_server.c
drivers/misc/mic/cosm_client/cosm_scif_client.c
drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
drivers/staging/rtl8188eu/core/rtw_cmd.c
drivers/staging/rtl8712/rtl8712_cmd.c
drivers/target/iscsi/iscsi_target.c
drivers/target/iscsi/iscsi_target_login.c
drivers/target/iscsi/iscsi_target_nego.c
drivers/usb/atm/usbatm.c
drivers/usb/gadget/function/f_mass_storage.c
fs/jffs2/background.c
fs/lockd/clntlock.c
fs/lockd/svc.c
fs/nfs/nfs4state.c
fs/nfsd/nfssvc.c
While not all of these are necessarily kthreads and some functionality
may still be unimpeded, it's still quite harmful and can cause
unexpected side-effects, especially because some of these kthreads are
storage-related (which we obviously don't want to kill during bootup).
During discussion at #15226, @dezgeg suggested the following
implementation:
for pid in $(pgrep -v -f '@'); do
if [ "$(cat /proc/$pid/cmdline)" != "" ]; then
kill -9 "$pid"
fi
done
This has a few downsides:
* User space processes which use an empty string in their command line
won't be killed.
* It results in errors during bootup because some shell-related
processes are already terminated (maybe it's pgrep itself, haven't
checked).
* The @ is searched within the full command line, not just at the
beginning of the string. Of course, we already had this until now, so
it's not a problem of his implementation.
I posted an alternative implementation which doesn't suffer from the
first point, but even that one wasn't sufficient:
for pid in $(pgrep -v -f '^@'); do
readlink "/proc/$pid/exe" &> /dev/null || continue
echo "$pid"
done | xargs kill -9
This one spawns a subshell, which would be included in the processes to
kill and actually kills itself during the process.
So what we have now is even checking whether the shell process itself is
in the list to kill and avoids killing it just to be sure.
Also, we don't spawn a subshell anymore and use /proc/$pid/exe to
distinguish between user space and kernel processes like in the comments
of the following StackOverflow answer:
http://stackoverflow.com/a/12231039
We don't need to take care of terminating processes, because what we
actually want IS to terminate the processes.
The only point where this (and any previous) approach falls short if we
have processes that act like fork bombs, because they might spawn
additional processes between the pgrep and the killing. We can only
address this with process/control groups and this still won't save us
because the root user can escape from that as well.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
Fixes: #15226
Patch drivers/crypto/qat/qat_common/Makefile so that qat_asym_algs.o
explicitly depends on headers qat_rsaprivkey-asn1.h and qat_rsapubkey-asn1.h
(cherry picked from commit 4788ec1372)
This should fix evaluation of 4.5 kernel. I forgot to pick this one.
* Perform HTTP HEAD request instead of full GET (lighter weight)
* Don't log output of curl to the journal (it's noise/debug)
* Use explicit http:// URL scheme
* Reduce poll interval from 10s to 2s (respond to state changes
quicker). Probably not relevant on boot (lots of services compete for
the CPU), but online service restarts/reloads should be quicker.
* Pass --fail to curl (should be more robust against false positives)
* Use 4 space indent for shell code.
(cherry picked from commit 78b6e8c319)
The current postStart code holds Jenkins off the "started" state until
Jenkins becomes idle. But it should be enough to wait until Jenkins
start handling HTTP requests to consider it "started".
More reasons why the current approach is bad and we should remove it,
from @coreyoconnor in
https://github.com/NixOS/nixpkgs/issues/14991#issuecomment-216572571:
1. Repeatedly curling for a specific human-readable string to
determine "Active" is fragile. For instance, what happens when jenkins
is localized?
2. The time jenkins takes to initializes is variable. This (at least
used to) depend on the number of jobs and any plugin upgrades requested.
3. Jenkins can be requested to restart from the UI. Which will not
affect the status of the service. This means that the service being
"active" does not imply jenkins is initialized. Downstream services
cannot assume jenkins is initialized if the service is active. Might
as well accept that and remove the initialized test from service
startup.
Fixes#14991.
(cherry picked from commit 51e5beca42)
The plugin was looking for pvr.hts.so.2.2.13, so as only pvr.hts.so was copied, the plugin would not load. This symlinks all variants of the name to the addons folder.
This allows them to be found by find-tarballs.nix (which can only see
fetchurl dependencies if they are attributes, not if they're part of a
string context).
(cherry picked from commit be8fc33164)
A continuation of commit 23489b34c0
("Bring back $SSL_CERT_FILE"). Quoting that commit message:
Commit 9f358f809d removed
$SSL_CERT_FILE, which is fine for binaries linking against the current
OpenSSL package, but not old binaries (e.g. those installed via
nix-env). So let's keep $SSL_CERT_FILE for a while longer.
The above patch is only applied to 'release-16.03', so do the same for
this one.
Typo introduced at c3b4dd920b50d6fd7625ada250d042b47fbd0217; went
undetected because the checksum was not changed.
Reported by m4t__ on IRC
(cherry picked from commit 68691d31b1)
The pre-sleep service exits if any command fails. Unloading facetimehd
without it being loaded blocks subsequent commands from running.
Note: `modprobe -r` works a bit better when unloading unused modules,
and is preferrable to `rmmod`. However, the facetimehd module does not
support suspending. In this case, it seems preferable to forcefully
unload the module. `modprobe` does not support a `--force` flag when
removing, so we are left with `rmmod`.
See:
- https://github.com/NixOS/nixpkgs/pull/14883
- https://github.com/patjak/bcwc_pcie/wiki#known-issues
It is deprecated doesn't handle compressed modules, unlike its modern
counterpart kmod.
Add a compatibility alias to kmod for now in case someone is depending
on this in their scripts.
The pre-sleep service exits if any command fails. Unloading facetimehd
without it being loaded blocks subsequent commands from running.
Note: `modprobe -r` works a bit better when unloading unused modules,
and is preferrable to `rmmod`. However, the facetimehd module does not
support suspending. In this case, it seems preferable to forcefully
unload the module. `modprobe` does not support a `--force` flag when
removing, so we are left with `rmmod`.
See:
- https://github.com/NixOS/nixpkgs/pull/14883
- https://github.com/patjak/bcwc_pcie/wiki#known-issues
fixes#13507
On June 8 (e8655ee) tortoisehg changed the way
it computes the `/usr/share` directory in a way that
invalidated the assumptions behind the use
of substituteInPlace in postUnpack.
(cherry picked from commit a4ce0e233b)
Extracting headers from a grsecurity patched kernel triggers additional
build steps that require gcc plugins. For this to work, we'd need to
add gmp, libmpfr, and libmpc to the build inputs as well as run `make
prepare` before installing the headers (lest the build fail due to
missing files).
Out-of-tree modules use kernel.dev and user space should use the Linux
API headers used to build libc, not headers extracted from random
kernels, so fixing this for grsecurity is pointless.
(cherry picked from commit 893186f4fd)
`cp`, `grep`, `chmod`, `sed` executables
no longer found when upgrading from nixos
15.09 to 16.03. Fixed by use of wrapper
script that brings these executables into
`PATH`.
Also fix lpd binaries on 64 bits machines
by use of `callPackage_i686`.
It was failing with a `Read-only filesystem` failure due to the systemd
service option `ReadWriteDirectories` not being correctly configured.
Fixes#14132
(cherry picked from commit f5951c55f7)
By setting `-DDISABLE_ADVANCE_SIMD=TRUE` pcsx2 will be compiled with predefined
SIMD flags instead of `-march=native`. This makes the resulting binary more
portable. Further this seems to be needed to make pcsx2 compile with gcc5.
(cherry picked from commit cc1cef3abc)
Continuation of 79c3c16dcb. Systemd 229
sets the default RLIMIT_CORE to infinity, causing systems to be
littered with core dumps when systemd.coredump.enable is disabled.
This restores the 15.09 soft limit of 0 and hard limit of infinity.
(cherry picked from commit 840f3230a2)
Fixes the following security issues:
* CVE-2015-5370 (Multiple errors in DCE-RPC code)
* CVE-2016-2110 (Man in the middle attacks possible with NTLMSSP)
* CVE-2016-2111 (NETLOGON Spoofing Vulnerability)
* CVE-2016-2112 (LDAP client and server don't enforce integrity)
* CVE-2016-2113 (Missing TLS certificate validation)
* CVE-2016-2114 ("server signing = mandatory" not enforced)
* CVE-2016-2115 (SMB IPC traffic is not integrity protected)
* CVE-2016-2118 (SAMR and LSA man in the middle attacks possible)
See http://badlock.org/ for details.
(cherry picked from commit 192dc27dc3)
Works around failure with gcc5, see
https://hydra.nixos.org/build/34273319/nixlog/1/raw
Not a real fix, but a working build is better than nothing ...
I have tested that the program at least runs: it fails to load a few
plugins, tho, have no idea to what extent that affects use
Couldn't load plugin 'ricevideo.so':
/nix/store/...-mupen64plus-1.5/share/mupen64plus/plugins/ricevideo.so:
undefined symbol: glCombinerInputNV
Couldn't load plugin 'glN64.so':
/nix/store/...-mupen64plus-1.5/share/mupen64plus/plugins/glN64.so:
undefined symbol: glCombinerInputNV
(cherry picked from commit 9a55b76db1)
This fixes CVE-2016-1283, which allows remote attackers to cause
a denial of service (heap-based buffer overflow) or possibly
have unspecified other impact via a crafted regular expression.
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1283
(cherry picked from commit 1e2fe7e07d)
At some point we probably want to replace this with a curated list
of configurations or even an upstreamed repository of examples, but
for now this is just noise.
FixesNixOS/nixpkgs#14522
(cherry picked from commit 678e1955b1)
This fixes the segfault reported in #13942 caused by missing
libEGL.so.0 and libEGL_nvidia.so.0 symlinks.
(cherry picked from commit f3b43b8a4488d50663052a24b02abd77fc668502)
This reverts commit 83011723af. This
never worked because gcc's setup hook is never actually sourced. I
could fix this but since nobody complained, we probably don't need it.
(cherry picked from commit 60f07e8e10)
CVE-2016-3068
Blake Burkhart discovered that Mercurial allows URLs for Git
subrepositories that could result in arbitrary code execution on
clone.
CVE-2016-3069
Blake Burkhart discovered that Mercurial allows arbitrary code
execution when converting Git repositories with specially
crafted names.
CVE-2016-3630
It was discovered that Mercurial does not properly perform bounds-
checking in its binary delta decoder, which may be exploitable for
remote code execution via clone, push or pull.
(cherry picked from commit f9099deb8e)
NixOps has infrequent releases, so it's not the best place for keeping
the list of current AMIs. Putting them in Nixpkgs means that AMI
updates will be delivered as part of the NixOS channels.
(cherry picked from commit 4e356cefd7)
- make line wrapping more consistent (overlong lines)
- don't stress the manual is *only* for contributors,
as it does contain some user-guide parts, including the intro itself
- since March our Hydra publishes binaries immediately,
not waiting for channel update
(cherry picked from commit 2bbae9696a)
This reverts commit 45c218f893.
Busybox's modprobe causes numerous "Unknown symbol" errors in the
kernel log, even though the modules do appear to load correctly.
This allows to build skype without errors like this:
clang++ -Wl,-O1 -o libmng libmng.o -lmng
/nix/store/1d2abmmqvindckyq51nq9kd1yisiv54j-binutils-2.26/bin/ld: skipping incompatible /nix/store/72nklasrjg774iwxxnpyxwkzxz2j37v5-libmng-2.0.2/lib/libmng.so when searching for -lmng
/nix/store/1d2abmmqvindckyq51nq9kd1yisiv54j-binutils-2.26/bin/ld: cannot find -lmng
/nix/store/1d2abmmqvindckyq51nq9kd1yisiv54j-binutils-2.26/bin/ld: skipping incompatible /nix/store/n0y8pv4kaff7vnq7rmzwrd654gqaj0ki-glibc-2.23/lib/libm.so when searching for -lm
/nix/store/1d2abmmqvindckyq51nq9kd1yisiv54j-binutils-2.26/bin/ld: skipping incompatible /nix/store/n0y8pv4kaff7vnq7rmzwrd654gqaj0ki-glibc-2.23/lib/libm.a when searching for -lm
clang-3.7: error: linker command failed with exit code 1 (use -v to see invocation)
(cherry picked from commit 7f69d5ed8c)
Unetbootin works by altering the image and placing a boot loader on it.
For this reason, it cannot work with UEFI and the installation guides
for other distributions (incl. Debian and Fedora) recommend against
using it.
Since dd writes the image verbatim to the drive, and not just the files,
it is not necessary to change the label after using it for UEFI
installations.
vcunat: tiny changes to the PR. Close#14139.
(cherry picked from commit d6998b0674)
commit 97332d3 introduced non expanding $out/etc/zprofile in zshs compiled in PATH.
this commit reverts the change so that $out is expanded at configure time.
(cherry picked from commit 9c6a69230d)
Fixes#14256.
The Firefox wrapped called itself "firefox" rather than "firefox-esr".
Also eliminate a use of splitString which is evil and should never be
used.
(cherry picked from commit 2f0195003e)
We were using a version years old.
I picked the git version instead of the last release because the git version
has fixes not released for almost one year.
(cherry picked from commit f38d620d59)
This commit implements the changes necessary to start up a graphite carbon Cache
with twisted and start the corresponding graphiteWeb service.
Dependencies need to be included via python buildEnv to include all recursive
implicit dependencies.
Additionally cairo is a requirement of graphiteWeb and pycairo is not a standard
python package (buildPythonPackage) and therefore cannot be included via
buildEnv. It also needs cairo in the Library PATH.
(cherry picked from commit 626bfce3b8)
Signed-off-by: Domen Kožar <domen@dev.si>
This module adds support for defining a flexget service.
Due to flexget insisting on being able to write all over where it finds
its configuration file, we use a ExecStartPre hook to copy the generated
configuration file into place under the user's home. It's fairly ugly
and I'm very open to suggestions
2016-03-27 17:41:46 +08:00
501 changed files with 13936 additions and 8705 deletions
With these expressions the Nix package manager can build binary packages.
Packages, including the Nix packages collection, are distributed through
[channels](http://nixos.org/nix/manual/#sec-channels). The collection is
distributed for users of Nix on non-NixOS distributions through the channel
`nixpkgs`. Users of NixOS generally use one of the `nixos-*` channels, e.g.
`nixos-15.09`, which includes all packages and modules for the stable NixOS
15.09. The channels of the stable NixOS releases are generally only given
`nixos-16.03`, which includes all packages and modules for the stable NixOS
16.03. The purpose of stable NixOS releases are generally only given
security updates. More up to date packages and modules are available via the
`nixos-unstable` channel.
Both `nixos-unstable` and `nixpkgs` follow the `master` branch of the Nixpkgs
repository, although both do lag the `master` branch by generally [a couple of days](http://howoldis.herokuapp.com/). Updates to a channel are distributed as
soon as all tests for that channel pass, e.g. [this table](http://hydra.nixos.org/job/nixpkgs/trunk/unstable#tabs-constituents)
repository, although both do lag the `master` branch by generally
[a couple of days](http://howoldis.herokuapp.com/). Updates to a channel are
distributed as soon as all tests for that channel pass, e.g.
Some files were not shown because too many files have changed in this diff
Show More
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
