From 23cd27508f67a4a0b262728d697fa882642d64f1 Mon Sep 17 00:00:00 2001 From: Luke Granger-Brown Date: Fri, 12 May 2023 07:22:58 +0000 Subject: [PATCH] envoy: 1.25.1 -> 1.26.1 --- .../0001-nixpkgs-use-system-Python.patch | 23 +++++------ .../envoy/0002-nixpkgs-use-system-Go.patch | 40 ++++++------------- pkgs/servers/http/envoy/default.nix | 22 ++++------ 3 files changed, 30 insertions(+), 55 deletions(-) diff --git a/pkgs/servers/http/envoy/0001-nixpkgs-use-system-Python.patch b/pkgs/servers/http/envoy/0001-nixpkgs-use-system-Python.patch index 11871275f4ff..1ff1fe66f10b 100644 --- a/pkgs/servers/http/envoy/0001-nixpkgs-use-system-Python.patch +++ b/pkgs/servers/http/envoy/0001-nixpkgs-use-system-Python.patch @@ -1,6 +1,6 @@ -From 329ad7cb56e66464e5570bbb51dea0fd56c4d9ae Mon Sep 17 00:00:00 2001 +From 1b6ad143c0f5f96c42f603bb93a72f788b88b622 Mon Sep 17 00:00:00 2001 From: Luke Granger-Brown -Date: Sun, 19 Feb 2023 17:40:50 +0000 +Date: Fri, 12 May 2023 08:12:04 +0100 Subject: [PATCH 1/2] nixpkgs: use system Python --- @@ -9,11 +9,11 @@ Subject: [PATCH 1/2] nixpkgs: use system Python 2 files changed, 1 insertion(+), 16 deletions(-) diff --git a/bazel/python_dependencies.bzl b/bazel/python_dependencies.bzl -index a5c3283d0a..1c2c31ebf2 100644 +index 37c0183664..0bee5feb7e 100644 --- a/bazel/python_dependencies.bzl +++ b/bazel/python_dependencies.bzl -@@ -1,10 +1,8 @@ - load("@rules_python//python:pip.bzl", "pip_install", "pip_parse") +@@ -1,24 +1,20 @@ + load("@rules_python//python:pip.bzl", "pip_parse") -load("@python3_10//:defs.bzl", "interpreter") def envoy_python_dependencies(): @@ -23,13 +23,12 @@ index a5c3283d0a..1c2c31ebf2 100644 requirements_lock = "@envoy//tools/base:requirements.txt", extra_pip_args = ["--require-hashes"], ) -@@ -12,14 +10,12 @@ def envoy_python_dependencies(): - # TODO(phlax): switch to `pip_parse` - pip_install( - # Note: dev requirements do *not* check hashes -- python_interpreter_target = interpreter, + + pip_parse( name = "dev_pip3", - requirements = "@envoy//tools/dev:requirements.txt", +- python_interpreter_target = interpreter, + requirements_lock = "@envoy//tools/dev:requirements.txt", + extra_pip_args = ["--require-hashes"], ) pip_parse( @@ -68,5 +67,5 @@ index 9d1b31c5d6..ac5605eb30 100644 - aspect_bazel_lib_dependencies() -- -2.39.1 +2.40.0 diff --git a/pkgs/servers/http/envoy/0002-nixpkgs-use-system-Go.patch b/pkgs/servers/http/envoy/0002-nixpkgs-use-system-Go.patch index 594d51cce9dc..422f926e0164 100644 --- a/pkgs/servers/http/envoy/0002-nixpkgs-use-system-Go.patch +++ b/pkgs/servers/http/envoy/0002-nixpkgs-use-system-Go.patch @@ -1,19 +1,18 @@ -From 31d864a3b6a1a3455191e87ff680eb812f77dc3c Mon Sep 17 00:00:00 2001 +From 30e059d652bd4e352e2c1dc3c44d03a1e42ff912 Mon Sep 17 00:00:00 2001 From: Luke Granger-Brown -Date: Sun, 19 Feb 2023 17:43:03 +0000 +Date: Fri, 12 May 2023 08:13:21 +0100 Subject: [PATCH 2/2] nixpkgs: use system Go --- - bazel/dependency_imports.bzl | 29 +---------------------------- - bazel/repositories.bzl | 3 --- - bazel/repository_locations.bzl | 4 ++-- - 3 files changed, 3 insertions(+), 33 deletions(-) + bazel/dependency_imports.bzl | 29 +---------------------------- + bazel/repositories.bzl | 3 --- + 2 files changed, 1 insertion(+), 31 deletions(-) diff --git a/bazel/dependency_imports.bzl b/bazel/dependency_imports.bzl -index 7dbdb0174e..e73662ed79 100644 +index 681617f1b8..a10c560baf 100644 --- a/bazel/dependency_imports.bzl +++ b/bazel/dependency_imports.bzl -@@ -15,7 +15,7 @@ load("@aspect_bazel_lib//lib:repositories.bzl", "register_jq_toolchains", "regis +@@ -17,7 +17,7 @@ load("@aspect_bazel_lib//lib:repositories.bzl", "register_jq_toolchains", "regis load("@com_google_cel_cpp//bazel:deps.bzl", "parser_deps") # go version for rules_go @@ -22,7 +21,7 @@ index 7dbdb0174e..e73662ed79 100644 JQ_VERSION = "1.6" YQ_VERSION = "4.24.4" -@@ -25,7 +25,6 @@ def envoy_dependency_imports(go_version = GO_VERSION, jq_version = JQ_VERSION, y +@@ -27,7 +27,6 @@ def envoy_dependency_imports(go_version = GO_VERSION, jq_version = JQ_VERSION, y rules_foreign_cc_dependencies(register_default_tools = False, register_built_tools = False) go_rules_dependencies() go_register_toolchains(go_version) @@ -30,7 +29,7 @@ index 7dbdb0174e..e73662ed79 100644 gazelle_dependencies(go_sdk = "go_sdk") apple_rules_dependencies() pip_dependencies() -@@ -134,29 +133,3 @@ def envoy_dependency_imports(go_version = GO_VERSION, jq_version = JQ_VERSION, y +@@ -146,29 +145,3 @@ def envoy_dependency_imports(go_version = GO_VERSION, jq_version = JQ_VERSION, y # use_category = ["api"], # source = "https://github.com/bufbuild/protoc-gen-validate/blob/v0.6.1/dependencies.bzl#L23-L28" ) @@ -61,10 +60,10 @@ index 7dbdb0174e..e73662ed79 100644 - version = go_version, - ) diff --git a/bazel/repositories.bzl b/bazel/repositories.bzl -index fca05b6062..a2f60014cb 100644 +index 6d2cf2014c..a8375bcdef 100644 --- a/bazel/repositories.bzl +++ b/bazel/repositories.bzl -@@ -115,9 +115,6 @@ def _go_deps(skip_targets): +@@ -196,9 +196,6 @@ def _go_deps(skip_targets): if "io_bazel_rules_go" not in skip_targets: external_http_archive( name = "io_bazel_rules_go", @@ -74,21 +73,6 @@ index fca05b6062..a2f60014cb 100644 ) external_http_archive("bazel_gazelle") -diff --git a/bazel/repository_locations.bzl b/bazel/repository_locations.bzl -index e4e89d281a..fb62c4f8f3 100644 ---- a/bazel/repository_locations.bzl -+++ b/bazel/repository_locations.bzl -@@ -878,8 +878,8 @@ REPOSITORY_LOCATIONS_SPEC = dict( - project_name = "Go rules for Bazel", - project_desc = "Bazel rules for the Go language", - project_url = "https://github.com/bazelbuild/rules_go", -- version = "0.36.0", -- sha256 = "ae013bf35bd23234d1dea46b079f1e05ba74ac0321423830119d3e787ec73483", -+ version = "0.38.1", -+ sha256 = "dd926a88a564a9246713a9c00b35315f54cbd46b31a26d5d8fb264c07045f05d", - urls = ["https://github.com/bazelbuild/rules_go/releases/download/v{version}/rules_go-v{version}.zip"], - use_category = ["build", "api"], - release_date = "2022-11-23", -- -2.39.1 +2.40.0 diff --git a/pkgs/servers/http/envoy/default.nix b/pkgs/servers/http/envoy/default.nix index e7739f2fdbc1..787d80e03ac8 100644 --- a/pkgs/servers/http/envoy/default.nix +++ b/pkgs/servers/http/envoy/default.nix @@ -1,5 +1,5 @@ { lib -, bazel_5 +, bazel_6 , bazel-gazelle , buildBazelPackage , fetchFromGitHub @@ -24,19 +24,19 @@ let # However, the version string is more useful for end-users. # These are contained in a attrset of their own to make it obvious that # people should update both. - version = "1.25.1"; - rev = "bae2e9d642a6a8ae6c5d3810f77f3e888f0d97da"; + version = "1.26.1"; + rev = "c7e8e7356d3a969c1b8e4e1f2687699acd91c6a1"; }; in buildBazelPackage rec { pname = "envoy"; inherit (srcVer) version; - bazel = bazel_5; + bazel = bazel_6; src = fetchFromGitHub { owner = "envoyproxy"; repo = "envoy"; inherit (srcVer) rev; - sha256 = "sha256-qA3+bta2vXGtAYX3mg+CmSIEitk4576JQB/QLPsj9Vc="; + sha256 = "sha256-WHedup6z/9t/Jg6CBrwtDy9xv6IwO3gUuBqos4h+k2s="; postFetch = '' chmod -R +w $out @@ -80,8 +80,8 @@ buildBazelPackage rec { fetchAttrs = { sha256 = { - x86_64-linux = "sha256-koz08NWUq5Fkca++1G7WEmg24G6FuMQOgRN3+HBtNIk="; - aarch64-linux = "sha256-oSybAw58yK0BUhS8MU2Y9hRo0mU/7xT7VKU3tDW4xN0="; + x86_64-linux = "sha256-jx8RavJKlBtZQtZf4GrUkOlhM6qI4LO5lK3HRgn1vzE="; + aarch64-linux = "sha256-toEPrGVh61sHsVbhsideMmnX8uXIN+2x8LuZpczTEdw="; }.${stdenv.system} or (throw "unsupported system ${stdenv.system}"); dontUseCmakeConfigure = true; dontUseGnConfigure = true; @@ -176,13 +176,5 @@ buildBazelPackage rec { license = licenses.asl20; maintainers = with maintainers; [ lukegb ]; platforms = [ "x86_64-linux" "aarch64-linux" ]; - knownVulnerabilities = [ - "CVE-2023-27487" - "CVE-2023-27488" - "CVE-2023-27491" - "CVE-2023-27492" - "CVE-2023-27493" - "CVE-2023-27496" - ]; }; }