From 70ff32c47bea3ea8634ae97989d6a78aff0db014 Mon Sep 17 00:00:00 2001 From: Fernando Rodrigues Date: Fri, 16 Aug 2024 07:07:11 +0000 Subject: [PATCH] xen: only add maintainers if version is security-supported This prevents users browsing the package in search.nixos.org from messaging maintainers about an EOL Xen. Signed-off-by: Fernando Rodrigues --- .../virtualization/xen/generic/default.nix | 11 +++++++++-- pkgs/applications/virtualization/xen/update.sh | 2 +- 2 files changed, 10 insertions(+), 3 deletions(-) diff --git a/pkgs/applications/virtualization/xen/generic/default.nix b/pkgs/applications/virtualization/xen/generic/default.nix index fbd343ce057d..d273f9b1f381 100644 --- a/pkgs/applications/virtualization/xen/generic/default.nix +++ b/pkgs/applications/virtualization/xen/generic/default.nix @@ -97,12 +97,16 @@ let which ]; + # Inherit attributes from a versionDefinition. inherit (versionDefinition) pname; inherit (versionDefinition) branch; inherit (versionDefinition) version; inherit (versionDefinition) latest; inherit (versionDefinition) pkg; + # Mark versions older than minSupportedVersion as EOL. + minSupportedVersion = "4.16"; + ## Pre-fetched Source Handling ## # Main attribute set for sources needed to build tools and firmwares. @@ -700,11 +704,14 @@ stdenv.mkDerivation (finalAttrs: { # Development headers in $dev/include. mit ]; - maintainers = with lib.maintainers; [ sigmasquadron ]; + # This automatically removes maintainers from EOL versions of Xen, so we aren't bothered about versions we don't explictly support. + maintainers = lib.lists.optionals (lib.strings.versionAtLeast version minSupportedVersion) ( + with lib.maintainers; [ sigmasquadron ] + ); mainProgram = "xl"; # Evaluates to x86_64-linux. platforms = lib.lists.intersectLists lib.platforms.linux lib.platforms.x86_64; - knownVulnerabilities = lib.lists.optionals (lib.strings.versionOlder version "4.16") [ + knownVulnerabilities = lib.lists.optionals (lib.strings.versionOlder version minSupportedVersion) [ "Xen ${version} is no longer supported by the Xen Security Team. See https://xenbits.xenproject.org/docs/unstable/support-matrix.html" ]; }; diff --git a/pkgs/applications/virtualization/xen/update.sh b/pkgs/applications/virtualization/xen/update.sh index ade935aafc89..6ac8ba5a825c 100755 --- a/pkgs/applications/virtualization/xen/update.sh +++ b/pkgs/applications/virtualization/xen/update.sh @@ -31,7 +31,7 @@ latestVersion=$(echo "$versionList" | tr ' ' '\n' | tail --lines=1) branchList=($(echo "$versionList" | tr ' ' '\n' | sed s/\.[0-9]*$//g | awk '!seen[$0]++')) # Figure out which versions we're actually going to install. -minSupportedBranch="$(grep " knownVulnerabilities = lib.lists.optionals (lib.strings.versionOlder version " "$xenPath"/generic/default.nix | sed s/' knownVulnerabilities = lib.lists.optionals (lib.strings.versionOlder version "'//g | sed s/'") \['//g)" +minSupportedBranch="$(grep " minSupportedVersion = " "$xenPath"/generic/default.nix | sed s/' minSupportedVersion = "'//g | sed s/'";'//g)" supportedBranches=($(for version in "${branchList[@]}"; do if [ "$(printf '%s\n' "$minSupportedBranch" "$version" | sort -V | head -n1)" = "$minSupportedBranch" ]; then echo "$version"; fi; done)) supportedVersions=($(for version in "${supportedBranches[@]}"; do echo "$versionList" | tr ' ' '\n' | grep "$version" | tail --lines=1; done))