From 50c332ebd9f0235785d5077756f3ba27fbbcff4e Mon Sep 17 00:00:00 2001 From: Tobias Mayer Date: Sun, 28 Jul 2024 16:33:28 +0200 Subject: [PATCH 1/3] rapidjson: 1.1.0 -> unstable-2024-04-09, rapidjson-unstable: drop The last oficial release of rapidjson is 8 years old, development has continued without releases since then. The old version is affected by CVE-2024-38517. https://www.opencve.io/cve/CVE-2024-38517 --- .../libraries/rapidjson/default.nix | 89 +++++++++++-------- .../libraries/rapidjson/unstable.nix | 80 ----------------- pkgs/development/rocm-modules/5/default.nix | 2 - pkgs/development/rocm-modules/6/default.nix | 2 - pkgs/top-level/aliases.nix | 1 + pkgs/top-level/all-packages.nix | 2 - 6 files changed, 53 insertions(+), 123 deletions(-) delete mode 100644 pkgs/development/libraries/rapidjson/unstable.nix diff --git a/pkgs/development/libraries/rapidjson/default.nix b/pkgs/development/libraries/rapidjson/default.nix index edd427da725d..dcec1e25f700 100644 --- a/pkgs/development/libraries/rapidjson/default.nix +++ b/pkgs/development/libraries/rapidjson/default.nix @@ -1,65 +1,80 @@ { lib , stdenv , fetchFromGitHub -, fetchpatch -, pkg-config , cmake +, doxygen +, graphviz , gtest , valgrind +, buildDocs ? true +, buildTests ? !stdenv.hostPlatform.isStatic && !stdenv.isDarwin +, buildExamples ? true }: -stdenv.mkDerivation rec { +stdenv.mkDerivation (finalAttrs: { pname = "rapidjson"; - version = "1.1.0"; + version = "unstable-2024-04-09"; + + outputs = [ + "out" + ] ++ lib.optionals buildDocs [ + "doc" + ] ++ lib.optionals buildExamples [ + "example" + ]; src = fetchFromGitHub { owner = "Tencent"; repo = "rapidjson"; - rev = "v${version}"; - sha256 = "1jixgb8w97l9gdh3inihz7avz7i770gy2j2irvvlyrq3wi41f5ab"; + rev = "ab1842a2dae061284c0a62dca1cc6d5e7e37e346"; + hash = "sha256-kAGVJfDHEUV2qNR1LpnWq3XKBJy4hD3Swh6LX5shJpM="; }; - patches = [ - (fetchpatch { - url = "https://src.fedoraproject.org/rpms/rapidjson/raw/48402da9f19d060ffcd40bf2b2e6987212c58b0c/f/rapidjson-1.1.0-c++20.patch"; - sha256 = "1qm62iad1xfsixv1li7qy475xc7gc04hmi2q21qdk6l69gk7mf82"; - }) - (fetchpatch { - name = "do-not-include-gtest-src-dir.patch"; - url = "https://git.alpinelinux.org/aports/plain/community/rapidjson/do-not-include-gtest-src-dir.patch?id=9e5eefc7a5fcf5938a8dc8a3be8c75e9e6809909"; - hash = "sha256-BjSZEwfCXA/9V+kxQ/2JPWbc26jQn35CfN8+8NW24s4="; - }) - # One of these three tests reports memcpy overlap after update to glibc-2.38 - ./test-skip-valgrind.diff + patches = lib.optionals buildTests [ + ./0000-unstable-use-nixpkgs-gtest.patch + # https://github.com/Tencent/rapidjson/issues/2214 + ./0001-unstable-valgrind-suppress-failures.patch ]; - postPatch = '' - find -name CMakeLists.txt | xargs \ - sed -i -e "s/-Werror//g" -e "s/-march=native//g" - ''; + nativeBuildInputs = [ + cmake + ] ++ lib.optionals buildDocs [ + doxygen + graphviz + ]; - nativeBuildInputs = [ pkg-config cmake ]; - - # for tests, adding gtest to checkInputs does not work - # https://github.com/NixOS/nixpkgs/pull/212200 - buildInputs = [ gtest ]; cmakeFlags = [ - "-DGTEST_SOURCE_DIR=${gtest.dev}/include" - - # Build rapidjson with std=c++17 so gtest 1.13.0+ works - # https://github.com/NixOS/nixpkgs/pull/282245#issuecomment-1951796902 - "-DRAPIDJSON_BUILD_CXX11=OFF" - "-DRAPIDJSON_BUILD_CXX17=ON" + (lib.cmakeBool "RAPIDJSON_BUILD_DOC" buildDocs) + (lib.cmakeBool "RAPIDJSON_BUILD_TESTS" buildTests) + (lib.cmakeBool "RAPIDJSON_BUILD_EXAMPLES" buildExamples) + # gtest 1.13+ requires C++14 or later. + (lib.cmakeBool "RAPIDJSON_BUILD_CXX11" false) + (lib.cmakeBool "RAPIDJSON_BUILD_CXX17" true) + ] ++ lib.optionals buildTests [ + (lib.cmakeFeature "GTEST_INCLUDE_DIR" "${lib.getDev gtest}") ]; - nativeCheckInputs = [ valgrind ]; - doCheck = !stdenv.hostPlatform.isStatic && !stdenv.isDarwin; + doCheck = buildTests; + + nativeCheckInputs = [ + gtest + valgrind + ]; + + postInstall = lib.optionalString buildExamples '' + mkdir -p $example/bin + + find bin -type f -executable \ + -not -name "perftest" \ + -not -name "unittest" \ + -exec cp -a {} $example/bin \; + ''; meta = with lib; { description = "Fast JSON parser/generator for C++ with both SAX/DOM style API"; homepage = "http://rapidjson.org/"; license = licenses.mit; platforms = platforms.unix; - maintainers = with maintainers; [ dotlambda ]; + maintainers = with maintainers; [ dotlambda Madouura tobim ]; }; -} +}) diff --git a/pkgs/development/libraries/rapidjson/unstable.nix b/pkgs/development/libraries/rapidjson/unstable.nix deleted file mode 100644 index fd7ffe61ba39..000000000000 --- a/pkgs/development/libraries/rapidjson/unstable.nix +++ /dev/null @@ -1,80 +0,0 @@ -{ lib -, stdenv -, fetchFromGitHub -, cmake -, doxygen -, graphviz -, gtest -, valgrind -, buildDocs ? true -, buildTests ? !stdenv.hostPlatform.isStatic && !stdenv.isDarwin -, buildExamples ? true -}: - -stdenv.mkDerivation (finalAttrs: { - pname = "rapidjson"; - version = "unstable-2023-09-28"; - - outputs = [ - "out" - ] ++ lib.optionals buildDocs [ - "doc" - ] ++ lib.optionals buildExamples [ - "example" - ]; - - src = fetchFromGitHub { - owner = "Tencent"; - repo = "rapidjson"; - rev = "f9d53419e912910fd8fa57d5705fa41425428c35"; - hash = "sha256-rl7iy14jn1K2I5U2DrcZnoTQVEGEDKlxmdaOCF/3hfY="; - }; - - patches = lib.optionals buildTests [ - ./0000-unstable-use-nixpkgs-gtest.patch - # https://github.com/Tencent/rapidjson/issues/2214 - ./0001-unstable-valgrind-suppress-failures.patch - ]; - - nativeBuildInputs = [ - cmake - ] ++ lib.optionals buildDocs [ - doxygen - graphviz - ]; - - cmakeFlags = [ - (lib.cmakeBool "RAPIDJSON_BUILD_DOC" buildDocs) - (lib.cmakeBool "RAPIDJSON_BUILD_TESTS" buildTests) - (lib.cmakeBool "RAPIDJSON_BUILD_EXAMPLES" buildExamples) - # gtest 1.13+ requires C++14 or later. - (lib.cmakeBool "RAPIDJSON_BUILD_CXX11" false) - (lib.cmakeBool "RAPIDJSON_BUILD_CXX17" true) - ] ++ lib.optionals buildTests [ - (lib.cmakeFeature "GTEST_INCLUDE_DIR" "${lib.getDev gtest}") - ]; - - doCheck = buildTests; - - nativeCheckInputs = [ - gtest - valgrind - ]; - - postInstall = lib.optionalString buildExamples '' - mkdir -p $example/bin - - find bin -type f -executable \ - -not -name "perftest" \ - -not -name "unittest" \ - -exec cp -a {} $example/bin \; - ''; - - meta = with lib; { - description = "Fast JSON parser/generator for C++ with both SAX/DOM style API"; - homepage = "http://rapidjson.org/"; - license = licenses.mit; - platforms = platforms.unix; - maintainers = with maintainers; [ Madouura ]; - }; -}) diff --git a/pkgs/development/rocm-modules/5/default.nix b/pkgs/development/rocm-modules/5/default.nix index 7f48c4d034ce..c1ffd01c8061 100644 --- a/pkgs/development/rocm-modules/5/default.nix +++ b/pkgs/development/rocm-modules/5/default.nix @@ -10,7 +10,6 @@ , opencv , ffmpeg_4 , libjpeg_turbo -, rapidjson-unstable }: let @@ -304,7 +303,6 @@ in rec { inherit (llvm) clang openmp; opencv = opencv.override { enablePython = true; }; ffmpeg = ffmpeg_4; - rapidjson = rapidjson-unstable; stdenv = llvm.rocmClangStdenv; # Unfortunately, rocAL needs a custom libjpeg-turbo until further notice diff --git a/pkgs/development/rocm-modules/6/default.nix b/pkgs/development/rocm-modules/6/default.nix index ad7ff7d1d1ed..6825a8bf860d 100644 --- a/pkgs/development/rocm-modules/6/default.nix +++ b/pkgs/development/rocm-modules/6/default.nix @@ -10,7 +10,6 @@ , opencv , ffmpeg_4 , libjpeg_turbo -, rapidjson-unstable }: let @@ -303,7 +302,6 @@ in rec { inherit (llvm) clang openmp; opencv = opencv.override { enablePython = true; }; ffmpeg = ffmpeg_4; - rapidjson = rapidjson-unstable; stdenv = llvm.rocmClangStdenv; # Unfortunately, rocAL needs a custom libjpeg-turbo until further notice diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix index c10305494b1d..b6be6867a493 100644 --- a/pkgs/top-level/aliases.nix +++ b/pkgs/top-level/aliases.nix @@ -1232,6 +1232,7 @@ mapAliases ({ radicle-upstream = throw "'radicle-upstream' was sunset, see "; # Added 2024-05-04 railway-travel = diebahn; # Added 2024-04-01 rambox-pro = rambox; # Added 2022-12-12 + rapidjson-unstable = lib.warn "'rapidjson-unstable' has been renamed to 'rapidjson'" rapidjson; # Added 2024-07-28 rarian = throw "rarian has been removed as unused"; # Added 2023-07-05 rccl = throw "'rccl' has been replaced with 'rocmPackages.rccl'"; # Added 2023-10-08 rdc = throw "'rdc' has been replaced with 'rocmPackages.rdc'"; # Added 2023-10-08 diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index c9ce5f68c609..329190fa2120 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -23659,8 +23659,6 @@ with pkgs; rapidjson = callPackage ../development/libraries/rapidjson { }; - rapidjson-unstable = callPackage ../development/libraries/rapidjson/unstable.nix { }; - rapidxml = callPackage ../development/libraries/rapidxml { }; rapidyaml = callPackage ../development/libraries/rapidyaml {}; From 17bedbfc7cedde9df2db9fec1782f25b7d0fba9c Mon Sep 17 00:00:00 2001 From: Tobias Mayer Date: Mon, 29 Jul 2024 06:23:49 +0200 Subject: [PATCH 2/3] rapidjson: remove questionable options --- .../libraries/rapidjson/default.nix | 19 ++----------------- 1 file changed, 2 insertions(+), 17 deletions(-) diff --git a/pkgs/development/libraries/rapidjson/default.nix b/pkgs/development/libraries/rapidjson/default.nix index dcec1e25f700..97c76cf9e530 100644 --- a/pkgs/development/libraries/rapidjson/default.nix +++ b/pkgs/development/libraries/rapidjson/default.nix @@ -6,9 +6,7 @@ , graphviz , gtest , valgrind -, buildDocs ? true , buildTests ? !stdenv.hostPlatform.isStatic && !stdenv.isDarwin -, buildExamples ? true }: stdenv.mkDerivation (finalAttrs: { @@ -17,10 +15,7 @@ stdenv.mkDerivation (finalAttrs: { outputs = [ "out" - ] ++ lib.optionals buildDocs [ "doc" - ] ++ lib.optionals buildExamples [ - "example" ]; src = fetchFromGitHub { @@ -38,15 +33,14 @@ stdenv.mkDerivation (finalAttrs: { nativeBuildInputs = [ cmake - ] ++ lib.optionals buildDocs [ doxygen graphviz ]; cmakeFlags = [ - (lib.cmakeBool "RAPIDJSON_BUILD_DOC" buildDocs) + (lib.cmakeBool "RAPIDJSON_BUILD_DOC" true) (lib.cmakeBool "RAPIDJSON_BUILD_TESTS" buildTests) - (lib.cmakeBool "RAPIDJSON_BUILD_EXAMPLES" buildExamples) + (lib.cmakeBool "RAPIDJSON_BUILD_EXAMPLES" true) # gtest 1.13+ requires C++14 or later. (lib.cmakeBool "RAPIDJSON_BUILD_CXX11" false) (lib.cmakeBool "RAPIDJSON_BUILD_CXX17" true) @@ -61,15 +55,6 @@ stdenv.mkDerivation (finalAttrs: { valgrind ]; - postInstall = lib.optionalString buildExamples '' - mkdir -p $example/bin - - find bin -type f -executable \ - -not -name "perftest" \ - -not -name "unittest" \ - -exec cp -a {} $example/bin \; - ''; - meta = with lib; { description = "Fast JSON parser/generator for C++ with both SAX/DOM style API"; homepage = "http://rapidjson.org/"; From 11ff4aefaeb5132904f05267db01a74705f2226c Mon Sep 17 00:00:00 2001 From: Tobias Mayer Date: Mon, 29 Jul 2024 07:38:02 +0200 Subject: [PATCH 3/3] rapidjson: additional cleanup --- .../libraries/rapidjson/default.nix | 32 +++++++++++++------ ...patch => suppress-valgrind-failures.patch} | 0 .../rapidjson/test-skip-valgrind.diff | 7 ---- ...gs-gtest.patch => use-nixpkgs-gtest.patch} | 28 ++++++++++------ 4 files changed, 41 insertions(+), 26 deletions(-) rename pkgs/development/libraries/rapidjson/{0001-unstable-valgrind-suppress-failures.patch => suppress-valgrind-failures.patch} (100%) delete mode 100644 pkgs/development/libraries/rapidjson/test-skip-valgrind.diff rename pkgs/development/libraries/rapidjson/{0000-unstable-use-nixpkgs-gtest.patch => use-nixpkgs-gtest.patch} (62%) diff --git a/pkgs/development/libraries/rapidjson/default.nix b/pkgs/development/libraries/rapidjson/default.nix index 97c76cf9e530..9aa239458502 100644 --- a/pkgs/development/libraries/rapidjson/default.nix +++ b/pkgs/development/libraries/rapidjson/default.nix @@ -6,7 +6,6 @@ , graphviz , gtest , valgrind -, buildTests ? !stdenv.hostPlatform.isStatic && !stdenv.isDarwin }: stdenv.mkDerivation (finalAttrs: { @@ -25,33 +24,48 @@ stdenv.mkDerivation (finalAttrs: { hash = "sha256-kAGVJfDHEUV2qNR1LpnWq3XKBJy4hD3Swh6LX5shJpM="; }; - patches = lib.optionals buildTests [ - ./0000-unstable-use-nixpkgs-gtest.patch + patches = [ + ./use-nixpkgs-gtest.patch # https://github.com/Tencent/rapidjson/issues/2214 - ./0001-unstable-valgrind-suppress-failures.patch + ./suppress-valgrind-failures.patch ]; + postPatch = '' + for f in doc/Doxyfile.*; do + substituteInPlace $f \ + --replace-fail "WARN_IF_UNDOCUMENTED = YES" "WARN_IF_UNDOCUMENTED = NO" + done + ''; + nativeBuildInputs = [ cmake doxygen graphviz ]; + buildInputs = [ + gtest + ]; + + strictDeps = true; + cmakeFlags = [ (lib.cmakeBool "RAPIDJSON_BUILD_DOC" true) - (lib.cmakeBool "RAPIDJSON_BUILD_TESTS" buildTests) + (lib.cmakeBool "RAPIDJSON_BUILD_TESTS" true) (lib.cmakeBool "RAPIDJSON_BUILD_EXAMPLES" true) # gtest 1.13+ requires C++14 or later. (lib.cmakeBool "RAPIDJSON_BUILD_CXX11" false) (lib.cmakeBool "RAPIDJSON_BUILD_CXX17" true) - ] ++ lib.optionals buildTests [ - (lib.cmakeFeature "GTEST_INCLUDE_DIR" "${lib.getDev gtest}") + # Prevent -march=native + (lib.cmakeBool "RAPIDJSON_ENABLE_INSTRUMENTATION_OPT" false) + # Disable -Werror by using build type specific flags, which are + # added after general CMAKE_CXX_FLAGS. + (lib.cmakeFeature "CMAKE_CXX_FLAGS_RELEASE" "-Wno-error") ]; - doCheck = buildTests; + doCheck = !(stdenv.hostPlatform.isStatic || stdenv.isDarwin); nativeCheckInputs = [ - gtest valgrind ]; diff --git a/pkgs/development/libraries/rapidjson/0001-unstable-valgrind-suppress-failures.patch b/pkgs/development/libraries/rapidjson/suppress-valgrind-failures.patch similarity index 100% rename from pkgs/development/libraries/rapidjson/0001-unstable-valgrind-suppress-failures.patch rename to pkgs/development/libraries/rapidjson/suppress-valgrind-failures.patch diff --git a/pkgs/development/libraries/rapidjson/test-skip-valgrind.diff b/pkgs/development/libraries/rapidjson/test-skip-valgrind.diff deleted file mode 100644 index a791d88699ff..000000000000 --- a/pkgs/development/libraries/rapidjson/test-skip-valgrind.diff +++ /dev/null @@ -1,7 +0,0 @@ ---- a/test/unittest/CMakeLists.txt -+++ b/test/unittest/CMakeLists.txt -@@ -82,3 +81,0 @@ -- add_test(NAME valgrind_unittest -- COMMAND valgrind --leak-check=full --error-exitcode=1 ${CMAKE_RUNTIME_OUTPUT_DIRECTORY}/unittest --gtest_filter=-SIMD.* -- WORKING_DIRECTORY ${CMAKE_SOURCE_DIR}/bin) - diff --git a/pkgs/development/libraries/rapidjson/0000-unstable-use-nixpkgs-gtest.patch b/pkgs/development/libraries/rapidjson/use-nixpkgs-gtest.patch similarity index 62% rename from pkgs/development/libraries/rapidjson/0000-unstable-use-nixpkgs-gtest.patch rename to pkgs/development/libraries/rapidjson/use-nixpkgs-gtest.patch index df334cc91264..878182ea5a5f 100644 --- a/pkgs/development/libraries/rapidjson/0000-unstable-use-nixpkgs-gtest.patch +++ b/pkgs/development/libraries/rapidjson/use-nixpkgs-gtest.patch @@ -1,28 +1,33 @@ +From b9206d360c19412d185263795d67c884feab281a Mon Sep 17 00:00:00 2001 +From: Tobias Mayer +Date: Mon, 29 Jul 2024 07:26:50 +0200 +Subject: [PATCH] Use nixpkgs gtest + +--- + test/CMakeLists.txt | 24 ++++++------------------ + 1 file changed, 6 insertions(+), 18 deletions(-) + diff --git a/test/CMakeLists.txt b/test/CMakeLists.txt -index 11c1b04c..762eaa75 100644 +index 11c1b04c..3d02d475 100644 --- a/test/CMakeLists.txt +++ b/test/CMakeLists.txt -@@ -1,20 +1,14 @@ +@@ -1,20 +1,8 @@ -find_package(GTestSrc) ++find_package(GTest REQUIRED) +enable_testing() -IF(GTESTSRC_FOUND) - enable_testing() -+if (WIN32 AND (NOT CYGWIN) AND (NOT MINGW)) -+ set(gtest_disable_pthreads ON) -+ set(gtest_force_shared_crt ON) -+endif() ++set(TEST_LIBRARIES GTest::gtest GTest::gtest_main) - if (WIN32 AND (NOT CYGWIN) AND (NOT MINGW)) - set(gtest_disable_pthreads ON) - set(gtest_force_shared_crt ON) - endif() -+include_directories(SYSTEM ${GTEST_INCLUDE_DIR}) - +- - add_subdirectory(${GTEST_SOURCE_DIR} ${CMAKE_BINARY_DIR}/googletest) - include_directories(SYSTEM ${GTEST_INCLUDE_DIR}) -+set(TEST_LIBRARIES gtest gtest_main) - +- - set(TEST_LIBRARIES gtest gtest_main) - - add_custom_target(tests ALL) @@ -33,3 +38,6 @@ index 11c1b04c..762eaa75 100644 +add_custom_target(tests ALL) +add_subdirectory(perftest) +add_subdirectory(unittest) +-- +2.45.2 +