From 159e4dc581e367f972b450e08b3689ddf1e662ed Mon Sep 17 00:00:00 2001 From: Dmitry Kalinkin Date: Wed, 18 Jan 2023 06:27:46 -0500 Subject: [PATCH 1/4] python310Packages.pytest-benchmark: 3.4.1 -> 4.0.0 (#211015) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * python310Packages.pytest-benchmark: 3.4.1 -> 4.0.0 * python310Packages.pytest-benchmark.src: `hash` instead of `sha256` Co-authored-by: Robert Schütz Co-authored-by: Robert Schütz --- pkgs/development/python-modules/pytest-benchmark/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/python-modules/pytest-benchmark/default.nix b/pkgs/development/python-modules/pytest-benchmark/default.nix index b9def8d834af..6fd0cefb51c3 100644 --- a/pkgs/development/python-modules/pytest-benchmark/default.nix +++ b/pkgs/development/python-modules/pytest-benchmark/default.nix @@ -10,14 +10,14 @@ buildPythonPackage rec { pname = "pytest-benchmark"; - version = "3.4.1"; + version = "4.0.0"; format = "setuptools"; src = fetchFromGitHub { owner = "ionelmc"; repo = pname; rev = "v${version}"; - sha256 = "sha256-qc/8Epax5bPUZvhq42xSj6NUq0T4gbO5dDDS6omWBOU="; + hash = "sha256-f9Ty4+5PycraxoLUSa9JFusV5Cot6bBWKfOGHZIRR3o="; }; buildInputs = [ From 92535dbc02b3ab4c04cf3e36c36aec92bb04aa37 Mon Sep 17 00:00:00 2001 From: peter woodman Date: Fri, 13 Jan 2023 07:09:05 -0500 Subject: [PATCH 2/4] giflib: patch to fix CVE-2022-28506 using the same mitigation the fedora project is using --- pkgs/development/libraries/giflib/default.nix | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/pkgs/development/libraries/giflib/default.nix b/pkgs/development/libraries/giflib/default.nix index 795aeb88440e..5202dc0edabc 100644 --- a/pkgs/development/libraries/giflib/default.nix +++ b/pkgs/development/libraries/giflib/default.nix @@ -8,7 +8,13 @@ stdenv.mkDerivation rec { sha256 = "1gbrg03z1b6rlrvjyc6d41bc8j1bsr7rm8206gb1apscyii5bnii"; }; - patches = lib.optional stdenv.hostPlatform.isDarwin + patches = [ + (fetchpatch { + name = "CVE-2022-28506.patch"; + url = "https://src.fedoraproject.org/rpms/giflib/raw/2e9917bf13df114354163f0c0211eccc00943596/f/CVE-2022-28506.patch"; + sha256 = "sha256-TBemEXkuox8FdS9RvjnWcTWPaHRo4crcwSR9czrUwBY="; + }) + ] ++ lib.optional stdenv.hostPlatform.isDarwin (fetchpatch { # https://sourceforge.net/p/giflib/bugs/133/ name = "darwin-soname.patch"; From c7475c80e109b480894d641bc781a024628ec34d Mon Sep 17 00:00:00 2001 From: Alyssa Ross Date: Thu, 19 Jan 2023 15:14:48 +0000 Subject: [PATCH 3/4] libtheora: don't build examples Original motivation for this was that they use ftime(3), an obsolete function that caused the build to fail for NetBSD, but I think we should just disable them everywhere, because it's unlikely people need the compiled examples to be installed on their system. I did a search for the only useful-sounding example, png2theora, on , and the only use I found of it was blktrace, which can use either png2theora or ffmpeg. Our own blktrace package doesn't depend on libtheora anyway. OpenSUSE and Void Linux both also disable the examples. --- pkgs/development/libraries/libtheora/default.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/development/libraries/libtheora/default.nix b/pkgs/development/libraries/libtheora/default.nix index 1e88218aa0d4..0e0030558dba 100644 --- a/pkgs/development/libraries/libtheora/default.nix +++ b/pkgs/development/libraries/libtheora/default.nix @@ -17,6 +17,8 @@ stdenv.mkDerivation rec { }) ]; + configureFlags = [ "--disable-examples" ]; + outputs = [ "out" "dev" "devdoc" ]; outputDoc = "devdoc"; From d29b1ecb89246c592ce53d8a8326358edec23ab0 Mon Sep 17 00:00:00 2001 From: Artturin Date: Sat, 21 Jan 2023 17:19:38 +0200 Subject: [PATCH 4/4] make-bootstrap-tools.nix: fix for wrapped gzip --- pkgs/stdenv/darwin/make-bootstrap-tools.nix | 2 +- pkgs/stdenv/linux/make-bootstrap-tools.nix | 2 +- pkgs/tools/compression/gzip/default.nix | 1 + 3 files changed, 3 insertions(+), 2 deletions(-) diff --git a/pkgs/stdenv/darwin/make-bootstrap-tools.nix b/pkgs/stdenv/darwin/make-bootstrap-tools.nix index 5e549e48287c..2cc44b319ffa 100644 --- a/pkgs/stdenv/darwin/make-bootstrap-tools.nix +++ b/pkgs/stdenv/darwin/make-bootstrap-tools.nix @@ -71,7 +71,7 @@ in rec { cp ${gawk}/bin/gawk $out/bin cp -d ${gawk}/bin/awk $out/bin cp ${gnutar}/bin/tar $out/bin - cp ${gzip}/bin/gzip $out/bin + cp ${gzip}/bin/.gzip-wrapped $out/bin/gzip cp ${bzip2_.bin}/bin/bzip2 $out/bin cp -d ${gnumake}/bin/* $out/bin cp -d ${patch}/bin/* $out/bin diff --git a/pkgs/stdenv/linux/make-bootstrap-tools.nix b/pkgs/stdenv/linux/make-bootstrap-tools.nix index 00db2826a4f3..3aa7f6a3df53 100644 --- a/pkgs/stdenv/linux/make-bootstrap-tools.nix +++ b/pkgs/stdenv/linux/make-bootstrap-tools.nix @@ -115,7 +115,7 @@ in with pkgs; rec { cp ${gawk.out}/bin/gawk $out/bin cp -d ${gawk.out}/bin/awk $out/bin cp ${tarMinimal.out}/bin/tar $out/bin - cp ${gzip.out}/bin/gzip $out/bin + cp ${gzip.out}/bin/.gzip-wrapped $out/bin/gzip cp ${bzip2.bin}/bin/bzip2 $out/bin cp -d ${gnumake.out}/bin/* $out/bin cp -d ${patch}/bin/* $out/bin diff --git a/pkgs/tools/compression/gzip/default.nix b/pkgs/tools/compression/gzip/default.nix index 4aa52ff020f4..24f81d99da3c 100644 --- a/pkgs/tools/compression/gzip/default.nix +++ b/pkgs/tools/compression/gzip/default.nix @@ -43,6 +43,7 @@ stdenv.mkDerivation rec { '' # run gzip with "-n" when $GZIP_NO_TIMESTAMPS (set by stdenv's setup.sh) is set to stop gzip from adding timestamps # to archive headers: https://github.com/NixOS/nixpkgs/issues/86348 + # if changing so that there's no longer a .gzip-wrapped then update copy in make-bootstrap-tools.nix + '' wrapProgram $out/bin/gzip \ --add-flags "\''${GZIP_NO_TIMESTAMPS:+-n}"