From 60d7923ecec0a1db1df48d6df57695ab17156707 Mon Sep 17 00:00:00 2001 From: Ruud van Asseldonk Date: Thu, 2 Oct 2025 22:50:17 +0200 Subject: [PATCH 1/3] libressl_4_0: 4.0.0 -> 4.0.1 Includes a fix for CVE-2025-9230, see the release notes at https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-4.0.1-relnotes.txt --- pkgs/development/libraries/libressl/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/libraries/libressl/default.nix b/pkgs/development/libraries/libressl/default.nix index fe8731c0a38f..ac528cfcfa01 100644 --- a/pkgs/development/libraries/libressl/default.nix +++ b/pkgs/development/libraries/libressl/default.nix @@ -133,8 +133,8 @@ in }; libressl_4_0 = generic { - version = "4.0.0"; - hash = "sha256-TYQZVfCsw9/HHQ49018oOvRhIiNQ4mhD/qlzHAJGoeQ="; + version = "4.0.1"; + hash = "sha256-IClLh3eMJidIk4Y5Q8hjWJebSZ03tJl31r+Gj3tZfL0="; # Fixes build on loongarch64 # https://github.com/libressl/portable/pull/1146 patches = [ From a0b7ed298ac2965639eb7eb2f82946d702e47962 Mon Sep 17 00:00:00 2001 From: Ruud van Asseldonk Date: Thu, 2 Oct 2025 22:50:50 +0200 Subject: [PATCH 2/3] libressl_4_1: 4.1.0 -> 4.1.1 Includes a fix for CVE-2025-9230, see the release notes at https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-4.1.1-relnotes.txt --- pkgs/development/libraries/libressl/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/libraries/libressl/default.nix b/pkgs/development/libraries/libressl/default.nix index ac528cfcfa01..e85a06aefff7 100644 --- a/pkgs/development/libraries/libressl/default.nix +++ b/pkgs/development/libraries/libressl/default.nix @@ -153,8 +153,8 @@ in }; libressl_4_1 = generic { - version = "4.1.0"; - hash = "sha256-D3HBa9NL2qzNy5al2UpJIb+2EuxuDrp6gNiFTu/Yu2E="; + version = "4.1.1"; + hash = "sha256-x/96fWddX1dzCUDlzP8dvi3NW3QFtTl+D3/9ZqXtVnk="; # Fixes build on loongarch64 # https://github.com/libressl/portable/pull/1184 postPatch = '' From 2277092388c1d317e05a8948a2657a42db0fbd7b Mon Sep 17 00:00:00 2001 From: Ruud van Asseldonk Date: Thu, 2 Oct 2025 22:57:58 +0200 Subject: [PATCH 3/3] libressl_3_9: remove unsupported package The current supported versions are 4.0 and 4.1. 3.9 is no longer supported, and has not received the fix for CVE-2025-9230 that 4.0 and 4.1 did receive. I think it's better to remove it at this point. --- pkgs/development/libraries/libressl/default.nix | 14 -------------- pkgs/top-level/all-packages.nix | 1 - 2 files changed, 15 deletions(-) diff --git a/pkgs/development/libraries/libressl/default.nix b/pkgs/development/libraries/libressl/default.nix index e85a06aefff7..af6fcb0d0672 100644 --- a/pkgs/development/libraries/libressl/default.nix +++ b/pkgs/development/libraries/libressl/default.nix @@ -118,20 +118,6 @@ let }; in { - libressl_3_9 = generic { - version = "3.9.2"; - hash = "sha256-ewMdrGSlnrbuMwT3/7ddrTOrjJ0nnIR/ksifuEYGj5c="; - - patches = [ - # Fixes build on ppc64 - # https://github.com/libressl/portable/pull/1073 - (fetchpatch { - url = "https://github.com/libressl/portable/commit/e6c7de3f03c51fbdcf5ad88bf12fe9e128521f0d.patch"; - hash = "sha256-LJy3fjbnc9h5DG3/+8bLECwJeBpPxy3hU8sPuhovmcw="; - }) - ]; - }; - libressl_4_0 = generic { version = "4.0.1"; hash = "sha256-IClLh3eMJidIk4Y5Q8hjWJebSZ03tJl31r+Gj3tZfL0="; diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index c8e36b72bd8a..40ebcf37fc32 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -8489,7 +8489,6 @@ with pkgs; zunclient = with python313Packages; toPythonApplication python-zunclient; inherit (callPackages ../development/libraries/libressl { }) - libressl_3_9 libressl_4_0 libressl_4_1 ;