From a20e31bf09daf629f36c6b773044663d04d6c536 Mon Sep 17 00:00:00 2001 From: Scott Worley Date: Mon, 7 Jun 2021 15:59:24 -0700 Subject: [PATCH 1/2] opentoonz: 1.4.0 -> 1.5.0 (The qtbase diamond-dependency problem was resolved in 4bac8a7a0098) --- .../graphics/opentoonz/default.nix | 6 ++-- .../graphics/opentoonz/libtiff.nix | 36 ++++++++++++++----- .../graphics/opentoonz/source.nix | 6 ++-- pkgs/top-level/all-packages.nix | 9 +++-- 4 files changed, 40 insertions(+), 17 deletions(-) diff --git a/pkgs/applications/graphics/opentoonz/default.nix b/pkgs/applications/graphics/opentoonz/default.nix index 14a130d7f412..7fd9606f3abc 100644 --- a/pkgs/applications/graphics/opentoonz/default.nix +++ b/pkgs/applications/graphics/opentoonz/default.nix @@ -1,6 +1,6 @@ { boost, cmake, fetchFromGitHub, freeglut, freetype, glew, libjpeg, libmypaint -, libpng, libtiff, libusb1, lz4, xz, lzo, openblas, pkg-config, qtbase -, qtmultimedia, qtscript, lib, stdenv, superlu, wrapQtAppsHook, }: +, libpng, libtiff, libusb1, lz4, xz, lzo, openblas, opencv, pkg-config, qtbase +, qtmultimedia, qtscript, qtserialport, lib, stdenv, superlu, wrapQtAppsHook, }: let source = import ./source.nix { inherit fetchFromGitHub; }; in stdenv.mkDerivation rec { inherit (source) src; @@ -24,9 +24,11 @@ in stdenv.mkDerivation rec { xz lzo openblas + opencv qtbase qtmultimedia qtscript + qtserialport superlu ]; diff --git a/pkgs/applications/graphics/opentoonz/libtiff.nix b/pkgs/applications/graphics/opentoonz/libtiff.nix index 6663c47553e3..4ab6a44a39b3 100644 --- a/pkgs/applications/graphics/opentoonz/libtiff.nix +++ b/pkgs/applications/graphics/opentoonz/libtiff.nix @@ -2,20 +2,38 @@ # opentoonz requires its own modified version of libtiff. We still build it as # a separate package # 1. For visibility for tools like vulnix, and -# 2. To avoid a diamond-dependency problem with qt linking the normal libtiff -# and opentoonz linking qt and this modified libtiff, we build a qt against -# this modified libtiff as well. +# 2. To avoid a diamond-dependency problem with opencv linking the normal libtiff +# and opentoonz linking opencv and this modified libtiff, we build an opencv +# against this modified libtiff as well. +# +# We use a separate mkDerivation rather than a minimal libtiff.overrideAttrs +# because the main libtiff builds with cmake and this version of libtiff was +# forked before libtiff gained CMake build capability (added in libtiff-4.0.5). + +{ lib, fetchFromGitHub, stdenv, pkg-config, zlib, libjpeg, xz, libtiff, }: -{ fetchFromGitHub, libtiff }: let source = import ./source.nix { inherit fetchFromGitHub; }; -in libtiff.overrideAttrs (old: { - inherit (source) src; + +in stdenv.mkDerivation { + pname = "libtiff"; version = source.versions.libtiff + "-opentoonz"; - postUnpack = (old.postUnpack or "") + '' + + inherit (source) src; + outputs = [ "bin" "dev" "out" "man" "doc" ]; + + nativeBuildInputs = [ pkg-config ]; + propagatedBuildInputs = [ zlib libjpeg xz ]; + + postUnpack = '' sourceRoot="$sourceRoot/thirdparty/tiff-${source.versions.libtiff}" ''; + # opentoonz uses internal libtiff headers - postInstall = (old.postInstall or "") + '' + postInstall = '' cp libtiff/{tif_config,tif_dir,tiffiop}.h $dev/include ''; -}) + + meta = libtiff.meta // { + maintainers = with lib.maintainers; [ chkno ]; + }; +} diff --git a/pkgs/applications/graphics/opentoonz/source.nix b/pkgs/applications/graphics/opentoonz/source.nix index 7378d2f5f965..27a4b8c0b0d2 100644 --- a/pkgs/applications/graphics/opentoonz/source.nix +++ b/pkgs/applications/graphics/opentoonz/source.nix @@ -3,14 +3,14 @@ { fetchFromGitHub, }: rec { versions = { - opentoonz = "1.4.0"; - libtiff = "4.0.3"; + opentoonz = "1.5.0"; + libtiff = "4.0.3"; # The version in thirdparty/tiff-* }; src = fetchFromGitHub { owner = "opentoonz"; repo = "opentoonz"; rev = "v${versions.opentoonz}"; - sha256 = "0vgclx2yydsm5i2smff3fj8m750nhf35wfhva37kywgws01s189b"; + sha256 = "1rw30ksw3zjph1cwxkfvqj0330v8wd4333gn0fdf3cln1w0549lk"; }; } diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index 228dd0da0bf0..4d56fb58ab60 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -27591,9 +27591,12 @@ with pkgs; opentimestamps-client = python3Packages.callPackage ../tools/misc/opentimestamps-client {}; - opentoonz = (qt514.overrideScope' (_: _: { - libtiff = callPackage ../applications/graphics/opentoonz/libtiff.nix { }; - })).callPackage ../applications/graphics/opentoonz { }; + opentoonz = let + opentoonz-libtiff = callPackage ../applications/graphics/opentoonz/libtiff.nix { }; + in qt5.callPackage ../applications/graphics/opentoonz { + libtiff = opentoonz-libtiff; + opencv = opencv.override { libtiff = opentoonz-libtiff; }; + }; opentabletdriver = callPackage ../tools/X11/opentabletdriver { }; From 920c5cd2b4993e245e5fd32ba9648a2bef54afbe Mon Sep 17 00:00:00 2001 From: Scott Worley Date: Thu, 23 Dec 2021 15:05:51 -0800 Subject: [PATCH 2/2] opentoonz-libtiff: Note knownVulnerabilities --- .../applications/graphics/opentoonz/libtiff.nix | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/pkgs/applications/graphics/opentoonz/libtiff.nix b/pkgs/applications/graphics/opentoonz/libtiff.nix index 4ab6a44a39b3..43ba1592ccc2 100644 --- a/pkgs/applications/graphics/opentoonz/libtiff.nix +++ b/pkgs/applications/graphics/opentoonz/libtiff.nix @@ -34,6 +34,23 @@ in stdenv.mkDerivation { ''; meta = libtiff.meta // { + knownVulnerabilities = ['' + Do not open untrusted files with Opentoonz: + Opentoonz uses an old custom fork of tibtiff from 2012 that is known to + be affected by at least these 50 vulnerabilities: + CVE-2012-4564 CVE-2013-4232 CVE-2013-4243 CVE-2013-4244 CVE-2014-8127 + CVE-2014-8128 CVE-2014-8129 CVE-2014-8130 CVE-2014-9330 CVE-2015-1547 + CVE-2015-8781 CVE-2015-8782 CVE-2015-8783 CVE-2015-8784 CVE-2015-8870 + CVE-2016-3620 CVE-2016-3621 CVE-2016-3623 CVE-2016-3624 CVE-2016-3625 + CVE-2016-3631 CVE-2016-3632 CVE-2016-3633 CVE-2016-3634 CVE-2016-3658 + CVE-2016-3945 CVE-2016-3990 CVE-2016-3991 CVE-2016-5102 CVE-2016-5314 + CVE-2016-5315 CVE-2016-5316 CVE-2016-5318 CVE-2016-5319 CVE-2016-5321 + CVE-2016-5322 CVE-2016-5323 CVE-2016-6223 CVE-2016-9453 CVE-2016-9532 + CVE-2017-9935 CVE-2017-9937 CVE-2018-10963 CVE-2018-5360 + CVE-2019-14973 CVE-2019-17546 CVE-2020-35521 CVE-2020-35522 + CVE-2020-35523 CVE-2020-35524 + More info at https://github.com/opentoonz/opentoonz/issues/4193 + '']; maintainers = with lib.maintainers; [ chkno ]; }; }