From af34e394ef1808ed488f871e67e15684b8b2b8ff Mon Sep 17 00:00:00 2001 From: Patrick Steinhardt Date: Fri, 27 Jun 2025 12:53:51 +0200 Subject: [PATCH 1/2] kodiPackages.sendtokodi: 0.9.557 -> 0.9.924 --- pkgs/applications/video/kodi/addons/sendtokodi/default.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/applications/video/kodi/addons/sendtokodi/default.nix b/pkgs/applications/video/kodi/addons/sendtokodi/default.nix index 6db0cb685c9c..a3d289dac3fb 100644 --- a/pkgs/applications/video/kodi/addons/sendtokodi/default.nix +++ b/pkgs/applications/video/kodi/addons/sendtokodi/default.nix @@ -9,13 +9,13 @@ buildKodiAddon rec { pname = "sendtokodi"; namespace = "plugin.video.sendtokodi"; - version = "0.9.557"; + version = "0.9.924"; src = fetchFromGitHub { owner = "firsttris"; repo = "plugin.video.sendtokodi"; - rev = "v${version}"; - hash = "sha256-Ga+9Q7x8+sEmQmteHbSyCahZ/T/l28BAEM84w7bf7z8="; + tag = "v${version}"; + hash = "sha256-ycp5/NbRX2rcRRpbpX6LlplyxdfoIwCw39EyQDcyzOU="; }; patches = [ From d5030747200b11fd5e882dec5f4e05cf61228de8 Mon Sep 17 00:00:00 2001 From: Patrick Steinhardt Date: Fri, 27 Jun 2025 12:58:27 +0200 Subject: [PATCH 2/2] kodiPackages.sendtokodi: fix PYTHON_PATH conflict with Kodi and yt-dlp The "sendtokodi" addon bundles its own versions of "youtube-dl" and "yt-dlp". This causes two issues: - The "youtube-dl" addon is unmaintained and suspect to known vulnerabilities. - Both of these dependencies also exist as packaged versions, so the vendoring causes duplications. The first issue is being addressed by patching out support for "youtube-dl", which in any case is only really needed for supporting Python 2. The second issue is being addressed by removing the bundled version of "yt-dlp" and instead injecting our packaged version of this dependency via `PYTHON_PATH`. Using `PYTHON_PATH` creates some new problems though, because Kodi packages a bunch of Python libraries like "requests" as addons. The consequence is that we may have a conflict in our PYTHON_PATH, where dependencies may be provided both by such Kodi addons and by transitive dependencies of "yt-dlp". One obvious solution would be to stop replacing the bundled version of "yt-dlp", but that would reintroduce the second issue explained further up. Instead, fix the issue by replacing the bundled version of "yt-dlp" with the contents of the packaged version thereof. This allows us to drop the PYTHON_PATH workaround and thus resolves the conflicts. Reported-by: Aaron Andersen --- .../video/kodi/addons/sendtokodi/default.nix | 23 +++++++++---------- ...ged-yt-dlp.patch => use-yt-dlp-only.patch} | 18 +++++++-------- 2 files changed, 20 insertions(+), 21 deletions(-) rename pkgs/applications/video/kodi/addons/sendtokodi/{use-packaged-yt-dlp.patch => use-yt-dlp-only.patch} (50%) diff --git a/pkgs/applications/video/kodi/addons/sendtokodi/default.nix b/pkgs/applications/video/kodi/addons/sendtokodi/default.nix index a3d289dac3fb..1fa75900b7d4 100644 --- a/pkgs/applications/video/kodi/addons/sendtokodi/default.nix +++ b/pkgs/applications/video/kodi/addons/sendtokodi/default.nix @@ -4,6 +4,7 @@ fetchFromGitHub, kodi, inputstreamhelper, + requests, }: buildKodiAddon rec { @@ -19,27 +20,25 @@ buildKodiAddon rec { }; patches = [ - # Unconditionally depend on packaged yt-dlp. This removes the ability to - # use youtube_dl, which is unmaintained and considered vulnerable (see - # CVE-2024-38519). - ./use-packaged-yt-dlp.patch + # Use yt-dlp, only. This removes the ability to use youtube_dl, which is + # unmaintained and considered vulnerable (see CVE-2024-38519). + ./use-yt-dlp-only.patch ]; propagatedBuildInputs = [ inputstreamhelper + requests ]; postPatch = '' - # Remove vendored youtube-dl and yt-dlp libraries. - rm -r lib/ + # Remove youtube-dl, which is unmaintained and vulnerable. + rm -r lib/youtube_dl lib/youtube_dl_version + # Replace yt-dlp with our own packaged version thereof. + rm -r lib/yt_dlp + echo "${lib.strings.getVersion kodi.pythonPackages.yt-dlp}" >lib/yt_dlp_version + ln -s ${kodi.pythonPackages.yt-dlp}/${kodi.pythonPackages.python.sitePackages}/yt_dlp lib/ ''; - passthru = { - # Instead of the vendored libraries, we propagate yt-dlp via the Python - # path. - pythonPath = with kodi.pythonPackages; makePythonPath [ yt-dlp ]; - }; - meta = with lib; { homepage = "https://github.com/firsttris/plugin.video.sendtokodi"; description = "Plays various stream sites on Kodi using yt-dlp"; diff --git a/pkgs/applications/video/kodi/addons/sendtokodi/use-packaged-yt-dlp.patch b/pkgs/applications/video/kodi/addons/sendtokodi/use-yt-dlp-only.patch similarity index 50% rename from pkgs/applications/video/kodi/addons/sendtokodi/use-packaged-yt-dlp.patch rename to pkgs/applications/video/kodi/addons/sendtokodi/use-yt-dlp-only.patch index b53e1a434fff..fb889b2b2319 100644 --- a/pkgs/applications/video/kodi/addons/sendtokodi/use-packaged-yt-dlp.patch +++ b/pkgs/applications/video/kodi/addons/sendtokodi/use-yt-dlp-only.patch @@ -1,18 +1,18 @@ diff --git a/service.py b/service.py -index 024ad9a..6ef71dd 100644 +index 5d588682..99123b4b 100644 --- a/service.py +++ b/service.py -@@ -243,11 +243,8 @@ def playlistIndex(url, playlist): +@@ -323,12 +323,7 @@ if not sys.argv[2]: + xbmcaddon.Addon().openSettings() + exit() - - # Use the chosen resolver while forcing to use youtube_dl on legacy python 2 systems (dlp is python 3.6+) +-# Use the chosen resolver while forcing to use youtube_dl on legacy python 2 systems (dlp is python 3.6+) -if xbmcplugin.getSetting(int(sys.argv[1]),"resolver") == "0" or sys.version_info[0] == 2: -- from lib.youtube_dl import YoutubeDL +- from youtube_dl import YoutubeDL -else: -- from lib.yt_dlp import YoutubeDL -- +- # import lib.yt_dlp as yt_dlp +- from yt_dlp import YoutubeDL +from yt_dlp import YoutubeDL -+ + # patch broken strptime (see above) patch_strptime() -