From cc86857601da5685a30da76665914af0cd744530 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= Date: Mon, 16 Nov 2015 08:12:08 +0100 Subject: [PATCH 1/9] libpng: security and maintenance 1.6.18 -> 1.6.19 Fixes #11030, CVE-2015-{7981,8126}. --- pkgs/development/libraries/libpng/default.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/development/libraries/libpng/default.nix b/pkgs/development/libraries/libpng/default.nix index 53777a0c56f0..a2454aa02f04 100644 --- a/pkgs/development/libraries/libpng/default.nix +++ b/pkgs/development/libraries/libpng/default.nix @@ -3,11 +3,11 @@ assert zlib != null; let - version = "1.6.18"; - sha256 = "0qq96rf31483kxz32h6l6921hy6p2v2pfqfvc74km229g4xw241f"; + version = "1.6.19"; + sha256 = "1s1mmkl79ghiczi2x2rbnp6y70v4c5pr8g3icxn9h5imymbmc71i"; patch_src = fetchurl { url = "mirror://sourceforge/libpng-apng/libpng-${version}-apng.patch.gz"; - sha256 = "0g2ljh2vhclas1hacys1c4gk6l6hyy6sngb2yvdsnjz50nyq16kv"; + sha256 = "0bgqkac16yhl0zwjzq2zwkixg2l2x3a6blbk3k0wqz0lza2a6jrh"; }; whenPatched = stdenv.lib.optionalString apngSupport; From 96648a8526e8e9a8dc7d56a1572cea717ec20403 Mon Sep 17 00:00:00 2001 From: aszlig Date: Tue, 17 Nov 2015 16:16:14 +0100 Subject: [PATCH 2/9] bzip2: Get rid of the custom builder.sh. Everything the builder.sh did can be done with the generic builder which makes it easier to override attributes and also easier to read. The reason I've done this is because of #10820, which tries to override the preBuild hook, but the latter is hardcoded in the builder.sh of bzip2. I have compared the output of this against the previous version and the only things that were different were timestamps in libbz2.a. Signed-off-by: aszlig --- pkgs/tools/compression/bzip2/builder.sh | 24 -------------- pkgs/tools/compression/bzip2/default.nix | 42 +++++++++++++++++++----- 2 files changed, 33 insertions(+), 33 deletions(-) delete mode 100644 pkgs/tools/compression/bzip2/builder.sh diff --git a/pkgs/tools/compression/bzip2/builder.sh b/pkgs/tools/compression/bzip2/builder.sh deleted file mode 100644 index a598dfcf808c..000000000000 --- a/pkgs/tools/compression/bzip2/builder.sh +++ /dev/null @@ -1,24 +0,0 @@ -source $stdenv/setup -installFlags="PREFIX=$out" - -if test -n "$sharedLibrary"; then - - preBuild() { - make -f Makefile-libbz2_so - } - - preInstall() { - mkdir -p $out/lib - mv libbz2.so* $out/lib - (cd $out/lib && ln -s libbz2.so.1.0.? libbz2.so && ln -s libbz2.so.1.0.? libbz2.so.1); - } - -fi - -postInstall() { - rm $out/bin/bunzip2* $out/bin/bzcat* - ln -s bzip2 $out/bin/bunzip2 - ln -s bzip2 $out/bin/bzcat -} - -genericBuild diff --git a/pkgs/tools/compression/bzip2/default.nix b/pkgs/tools/compression/bzip2/default.nix index 74da91431a43..a485bf5eab68 100644 --- a/pkgs/tools/compression/bzip2/default.nix +++ b/pkgs/tools/compression/bzip2/default.nix @@ -1,12 +1,14 @@ { stdenv, fetchurl, linkStatic ? false }: -let version = "1.0.6"; in +let + version = "1.0.6"; -stdenv.mkDerivation { + sharedLibrary = !stdenv.isDarwin && !(stdenv ? isStatic) + && stdenv.system != "i686-cygwin" && !linkStatic; + +in stdenv.mkDerivation { name = "bzip2-${version}"; - builder = ./builder.sh; - src = fetchurl { url = "http://www.bzip.org/${version}/bzip2-${version}.tar.gz"; sha256 = "1kfrc7f0ja9fdn6j1y6yir6li818npy6217hvr3wzmnmzhs8z152"; @@ -23,14 +25,36 @@ stdenv.mkDerivation { ''; }; - sharedLibrary = - !stdenv.isDarwin && !(stdenv ? isStatic) && stdenv.system != "i686-cygwin" && !linkStatic; + preBuild = stdenv.lib.optionalString sharedLibrary '' + make -f Makefile-libbz2_so + ''; - patchPhase = stdenv.lib.optionalString stdenv.isDarwin "substituteInPlace Makefile --replace 'CC=gcc' 'CC=clang'"; + preInstall = stdenv.lib.optionalString sharedLibrary '' + mkdir -p $out/lib + mv libbz2.so* $out/lib + ( cd $out/lib && + ln -s libbz2.so.1.0.? libbz2.so && + ln -s libbz2.so.1.0.? libbz2.so.1 + ) + ''; - preConfigure = "substituteInPlace Makefile --replace '$(PREFIX)/man' '$(PREFIX)/share/man'"; + installFlags = [ "PREFIX=$(out)" ]; - makeFlags = if linkStatic then "LDFLAGS=-static" else ""; + postInstall = '' + rm $out/bin/bunzip2* $out/bin/bzcat* + ln -s bzip2 $out/bin/bunzip2 + ln -s bzip2 $out/bin/bzcat + ''; + + patchPhase = stdenv.lib.optionalString stdenv.isDarwin '' + substituteInPlace Makefile --replace 'CC=gcc' 'CC=clang' + ''; + + preConfigure = '' + substituteInPlace Makefile --replace '$(PREFIX)/man' '$(PREFIX)/share/man' + ''; + + makeFlags = stdenv.lib.optional linkStatic "LDFLAGS=-static"; inherit linkStatic; From 6e9f0df8bdde24bee4a18235ed64f47c580c45d7 Mon Sep 17 00:00:00 2001 From: "William A. Kennington III" Date: Tue, 17 Nov 2015 21:09:52 -0800 Subject: [PATCH 3/9] gtk: 3.18.4 -> 3.18.5 --- pkgs/development/libraries/gtk+/3.x.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/libraries/gtk+/3.x.nix b/pkgs/development/libraries/gtk+/3.x.nix index 174f12fc68ca..248c4fa385e1 100644 --- a/pkgs/development/libraries/gtk+/3.x.nix +++ b/pkgs/development/libraries/gtk+/3.x.nix @@ -10,7 +10,7 @@ assert cupsSupport -> cups != null; let ver_maj = "3.18"; - ver_min = "4"; + ver_min = "5"; version = "${ver_maj}.${ver_min}"; in stdenv.mkDerivation rec { @@ -18,7 +18,7 @@ stdenv.mkDerivation rec { src = fetchurl { url = "mirror://gnome/sources/gtk+/${ver_maj}/gtk+-${version}.tar.xz"; - sha256 = "5400dcf280d28d24606f33d59ed48c717f7d3db425d4b6fb52e8002f0c76c7eb"; + sha256 = "107aeb9a4244ce3c044becdd6dffc32d83202595181597180d4c736302a71852"; }; nativeBuildInputs = [ pkgconfig gettext gobjectIntrospection perl ]; From b809f886c0bdbd4665fc65a4c308d38a30c368d8 Mon Sep 17 00:00:00 2001 From: "William A. Kennington III" Date: Tue, 17 Nov 2015 21:10:13 -0800 Subject: [PATCH 4/9] libinput: 1.0.1 -> 1.1.1 --- pkgs/development/libraries/libinput/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/libraries/libinput/default.nix b/pkgs/development/libraries/libinput/default.nix index ed97952940a9..430743af96ad 100644 --- a/pkgs/development/libraries/libinput/default.nix +++ b/pkgs/development/libraries/libinput/default.nix @@ -15,11 +15,11 @@ in with stdenv.lib; stdenv.mkDerivation rec { - name = "libinput-1.0.2"; + name = "libinput-1.1.1"; src = fetchurl { url = "http://www.freedesktop.org/software/libinput/${name}.tar.xz"; - sha256 = "1fggbi8w8r7mayyk7zwqrqf3ni95y2703vcpggxqq7yjdgw0bld3"; + sha256 = "05yxz3cds65zmzj98yhsrwvnkv8c7n3zs2fksjzs2fy7vlrv9qid"; }; configureFlags = [ From 020f6cfadc0d95a91e441d9f24851e3a53c6a428 Mon Sep 17 00:00:00 2001 From: "William A. Kennington III" Date: Tue, 17 Nov 2015 21:10:52 -0800 Subject: [PATCH 5/9] xorg-server: 1.17.2 -> 1.18.0 --- pkgs/servers/x11/xorg/default.nix | 6 +-- pkgs/servers/x11/xorg/fix_segfault.patch | 63 ------------------------ pkgs/servers/x11/xorg/overrides.nix | 2 +- 3 files changed, 4 insertions(+), 67 deletions(-) delete mode 100644 pkgs/servers/x11/xorg/fix_segfault.patch diff --git a/pkgs/servers/x11/xorg/default.nix b/pkgs/servers/x11/xorg/default.nix index c64a0fd86b51..c1e0ab6a8f67 100644 --- a/pkgs/servers/x11/xorg/default.nix +++ b/pkgs/servers/x11/xorg/default.nix @@ -2108,11 +2108,11 @@ let }) // {inherit ;}; xorgserver = (mkDerivation "xorgserver" { - name = "xorg-server-1.17.2"; + name = "xorg-server-1.18.0"; builder = ./builder.sh; src = fetchurl { - url = mirror://xorg/individual/xserver/xorg-server-1.17.2.tar.bz2; - sha256 = "14vr4mm0x94a9bd3sfx9mdh8qhvk48zcml3i8q1wbwi84xhj04gn"; + url = mirror://xorg/individual/xserver/xorg-server-1.18.0.tar.bz2; + sha256 = "0biimwnp17wz80nplybpi940y3dyd7hgp5fyipfwxncmjs0p0mhr"; }; buildInputs = [pkgconfig dri2proto dri3proto renderproto libdrm openssl libX11 libXau libXaw libxcb xcbutil xcbutilwm xcbutilimage xcbutilkeysyms xcbutilrenderutil libXdmcp libXfixes libxkbfile libXmu libXpm libXrender libXres libXt ]; }) // {inherit dri2proto dri3proto renderproto libdrm openssl libX11 libXau libXaw libxcb xcbutil xcbutilwm xcbutilimage xcbutilkeysyms xcbutilrenderutil libXdmcp libXfixes libxkbfile libXmu libXpm libXrender libXres libXt ;}; diff --git a/pkgs/servers/x11/xorg/fix_segfault.patch b/pkgs/servers/x11/xorg/fix_segfault.patch deleted file mode 100644 index b3a7d2ed5e00..000000000000 --- a/pkgs/servers/x11/xorg/fix_segfault.patch +++ /dev/null @@ -1,63 +0,0 @@ -From 7cc7ffd25d5e50b54cb942d07d4cb160f20ff9c5 Mon Sep 17 00:00:00 2001 -From: Martin Peres -Date: Fri, 17 Jul 2015 17:21:26 +0300 -Subject: [PATCH] os: make sure the clientsWritable fd_set is initialized - before use - -In WaitForSomething(), the fd_set clientsWritable may be used unitialized when -the boolean AnyClientsWriteBlocked is set in the WakeupHandler(). This leads to -a crash in FlushAllOutput() after x11proto's commit -2c94cdb453bc641246cc8b9a876da9799bee1ce7. - -The problem did not manifest before because both the XFD_SIZE and the maximum -number of clients were set to 256. As the connectionTranslation table was -initalized for the 256 clients to 0, the test on the index not being 0 was -aborting before dereferencing the client #0. - -As of commit 2c94cdb453bc641246cc8b9a876da9799bee1ce7 in x11proto, the XFD_SIZE -got bumped to 512. This lead the OutputPending fd_set to have any fd above 256 -to be uninitialized which in turns lead to reading an index after the end of -the ConnectionTranslation table. This index would then be used to find the -client corresponding to the fd marked as pending writes and would also result -to an out-of-bound access which would usually be the fatal one. - -Fix this by zeroing the clientsWritable fd_set at the beginning of -WaitForSomething(). In this case, the bottom part of the loop, which would -indirectly call FlushAllOutput, will not do any work but the next call to -select will result in the execution of the right codepath. This is exactly what -we want because we need to know the writable clients before handling them. In -the end, it also makes sure that the fds above MaxClient are initialized, -preventing the crash in FlushAllOutput(). - -Thanks to everyone involved in tracking this one down! - -Reported-by: Karol Herbst -Reported-by: Tobias Klausmann -Signed-off-by: Martin Peres -Tested-by: Martin Peres -Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=91316 -Cc: Ilia Mirkin -Cc: Martin Peres -Cc: Olivier Fourdan -Cc: Alan Coopersmith ---- - os/WaitFor.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/os/WaitFor.c b/os/WaitFor.c -index 431f1a6..993c14e 100644 ---- a/os/WaitFor.c -+++ b/os/WaitFor.c -@@ -158,6 +158,7 @@ WaitForSomething(int *pClientsReady) - Bool someReady = FALSE; - - FD_ZERO(&clientsReadable); -+ FD_ZERO(&clientsWritable); - - if (nready) - SmartScheduleStopTimer(); --- -2.4.5 - diff --git a/pkgs/servers/x11/xorg/overrides.nix b/pkgs/servers/x11/xorg/overrides.nix index 1339e51eb232..78be046366db 100644 --- a/pkgs/servers/x11/xorg/overrides.nix +++ b/pkgs/servers/x11/xorg/overrides.nix @@ -291,7 +291,7 @@ in dri2proto dri3proto kbproto xineramaproto resourceproto scrnsaverproto videoproto ]; # fix_segfault: https://bugs.freedesktop.org/show_bug.cgi?id=91316 - commonPatches = [ ./xorgserver-xkbcomp-path.patch ./fix_segfault.patch ]; + commonPatches = [ ./xorgserver-xkbcomp-path.patch ]; # XQuartz requires two compilations: the first to get X / XQuartz, # and the second to get Xvfb, Xnest, etc. darwinOtherX = overrideDerivation xorgserver (oldAttrs: { From b52f2f64013dcc206cac1986f7bc9f9b1badc798 Mon Sep 17 00:00:00 2001 From: "William A. Kennington III" Date: Wed, 18 Nov 2015 02:34:22 -0800 Subject: [PATCH 6/9] xorg-server: 1.18.0 -> 1.17.4 There were lots of issues with the proprietary nvidia driver on 352.63 and we don't yet have a proprietary AMD driver. --- pkgs/servers/x11/xorg/default.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/servers/x11/xorg/default.nix b/pkgs/servers/x11/xorg/default.nix index c1e0ab6a8f67..39acc25c4536 100644 --- a/pkgs/servers/x11/xorg/default.nix +++ b/pkgs/servers/x11/xorg/default.nix @@ -2108,11 +2108,11 @@ let }) // {inherit ;}; xorgserver = (mkDerivation "xorgserver" { - name = "xorg-server-1.18.0"; + name = "xorg-server-1.17.4"; builder = ./builder.sh; src = fetchurl { - url = mirror://xorg/individual/xserver/xorg-server-1.18.0.tar.bz2; - sha256 = "0biimwnp17wz80nplybpi940y3dyd7hgp5fyipfwxncmjs0p0mhr"; + url = mirror://xorg/individual/xserver/xorg-server-1.17.4.tar.bz2; + sha256 = "0mv4ilpqi5hpg182mzqn766frhi6rw48aba3xfbaj4m82v0lajqc"; }; buildInputs = [pkgconfig dri2proto dri3proto renderproto libdrm openssl libX11 libXau libXaw libxcb xcbutil xcbutilwm xcbutilimage xcbutilkeysyms xcbutilrenderutil libXdmcp libXfixes libxkbfile libXmu libXpm libXrender libXres libXt ]; }) // {inherit dri2proto dri3proto renderproto libdrm openssl libX11 libXau libXaw libxcb xcbutil xcbutilwm xcbutilimage xcbutilkeysyms xcbutilrenderutil libXdmcp libXfixes libxkbfile libXmu libXpm libXrender libXres libXt ;}; From 094c374941e68bf667719da15c655f148840ebab Mon Sep 17 00:00:00 2001 From: "Matthias C. M. Troffaes" Date: Wed, 4 Nov 2015 08:26:11 +0000 Subject: [PATCH 7/9] bzip2: fix cross build on mingw by using autoconf patch --- pkgs/tools/compression/bzip2/default.nix | 64 ++++++++---------------- 1 file changed, 20 insertions(+), 44 deletions(-) diff --git a/pkgs/tools/compression/bzip2/default.nix b/pkgs/tools/compression/bzip2/default.nix index a485bf5eab68..286ad16cc861 100644 --- a/pkgs/tools/compression/bzip2/default.nix +++ b/pkgs/tools/compression/bzip2/default.nix @@ -1,11 +1,7 @@ -{ stdenv, fetchurl, linkStatic ? false }: +{ stdenv, fetchurl, libtool, autoconf, automake, pkgconfig, gnum4 }: let version = "1.0.6"; - - sharedLibrary = !stdenv.isDarwin && !(stdenv ? isStatic) - && stdenv.system != "i686-cygwin" && !linkStatic; - in stdenv.mkDerivation { name = "bzip2-${version}"; @@ -14,50 +10,30 @@ in stdenv.mkDerivation { sha256 = "1kfrc7f0ja9fdn6j1y6yir6li818npy6217hvr3wzmnmzhs8z152"; }; + patches = [ + # original upstream for the autoconf patch is here: + # http://ftp.suse.com/pub/people/sbrabec/bzip2/for_downstream/bzip2-1.0.6-autoconfiscated.patch + # but we get the mingw-builds version of the patch, which fixes + # a few more issues + (fetchurl { + url = "https://raw.githubusercontent.com/niXman/mingw-builds/17ae841dcf6e72badad7941a06d631edaf687436/patches/bzip2/bzip2-1.0.6-autoconfiscated.patch"; + sha256 = "1flbd3i8vg9kzq0a712qcg9j2c4ymnqvgd0ldyafpzvbqj1iicnp"; + }) + ]; + + patchFlags = "-p0"; + + nativeBuildInputs = [ libtool autoconf automake gnum4 pkgconfig ]; + + preConfigure = "sh ./autogen.sh"; + crossAttrs = { - patchPhase = '' + # https://github.com/niXman/mingw-builds/blob/master/patches/bzip2/bzip2-1.0.5-slash.patch + postPatch = '' sed -i -e '//s|\\|/|' bzip2.c - sed -i -e 's/CC=gcc/CC=${stdenv.cross.config}-gcc/' \ - -e 's/AR=ar/AR=${stdenv.cross.config}-ar/' \ - -e 's/RANLIB=ranlib/RANLIB=${stdenv.cross.config}-ranlib/' \ - -e 's/bzip2recover test/bzip2recover/' \ - Makefile* ''; }; - preBuild = stdenv.lib.optionalString sharedLibrary '' - make -f Makefile-libbz2_so - ''; - - preInstall = stdenv.lib.optionalString sharedLibrary '' - mkdir -p $out/lib - mv libbz2.so* $out/lib - ( cd $out/lib && - ln -s libbz2.so.1.0.? libbz2.so && - ln -s libbz2.so.1.0.? libbz2.so.1 - ) - ''; - - installFlags = [ "PREFIX=$(out)" ]; - - postInstall = '' - rm $out/bin/bunzip2* $out/bin/bzcat* - ln -s bzip2 $out/bin/bunzip2 - ln -s bzip2 $out/bin/bzcat - ''; - - patchPhase = stdenv.lib.optionalString stdenv.isDarwin '' - substituteInPlace Makefile --replace 'CC=gcc' 'CC=clang' - ''; - - preConfigure = '' - substituteInPlace Makefile --replace '$(PREFIX)/man' '$(PREFIX)/share/man' - ''; - - makeFlags = stdenv.lib.optional linkStatic "LDFLAGS=-static"; - - inherit linkStatic; - meta = { homepage = "http://www.bzip.org"; description = "high-quality data compression program"; From 22bf2d0bf3a5f80f3c6c2bd6fd4212672e107351 Mon Sep 17 00:00:00 2001 From: "William A. Kennington III" Date: Wed, 18 Nov 2015 17:49:54 -0800 Subject: [PATCH 8/9] flex: 2.5.39 -> 2.6.0 --- .../tools/parsing/flex/{2.5.39.nix => default.nix} | 8 ++++---- pkgs/top-level/all-packages.nix | 3 +-- 2 files changed, 5 insertions(+), 6 deletions(-) rename pkgs/development/tools/parsing/flex/{2.5.39.nix => default.nix} (75%) diff --git a/pkgs/development/tools/parsing/flex/2.5.39.nix b/pkgs/development/tools/parsing/flex/default.nix similarity index 75% rename from pkgs/development/tools/parsing/flex/2.5.39.nix rename to pkgs/development/tools/parsing/flex/default.nix index 93d54803e7c7..57ce29f51753 100644 --- a/pkgs/development/tools/parsing/flex/2.5.39.nix +++ b/pkgs/development/tools/parsing/flex/default.nix @@ -1,11 +1,11 @@ { stdenv, fetchurl, bison, m4 }: -stdenv.mkDerivation { - name = "flex-2.5.39"; +stdenv.mkDerivation rec { + name = "flex-2.6.0"; src = fetchurl { - url = mirror://sourceforge/flex/flex-2.5.39.tar.bz2; - sha256 = "0zv15giw3gma03y2bzw78hjfy49vyir7vbcgnh9bb3637dgvblmd"; + url = "mirror://sourceforge/flex/${name}.tar.bz2"; + sha256 = "1sdqx63yadindzafrq1w31ajblf9gl1c301g068s20s7bbpi3ri4"; }; buildInputs = [ bison ]; diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index 8fcc8a6b4193..e1d494c8abc0 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -5613,8 +5613,7 @@ let jdepend = callPackage ../development/tools/analysis/jdepend { }; flex_2_5_35 = callPackage ../development/tools/parsing/flex/2.5.35.nix { }; - flex_2_5_39 = callPackage ../development/tools/parsing/flex/2.5.39.nix { }; - flex = flex_2_5_39; + flex = callPackage ../development/tools/parsing/flex/default.nix { }; flexcpp = callPackage ../development/tools/parsing/flexc++ { }; From 815e9f5af288b3d44a7a926469b25cf58663fe40 Mon Sep 17 00:00:00 2001 From: Pascal Wittmann Date: Fri, 20 Nov 2015 17:20:51 +0100 Subject: [PATCH 9/9] help2man: 1.47.2 -> 1.47.3 --- pkgs/development/tools/misc/help2man/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/tools/misc/help2man/default.nix b/pkgs/development/tools/misc/help2man/default.nix index 4386e7eaf741..8f687908017f 100644 --- a/pkgs/development/tools/misc/help2man/default.nix +++ b/pkgs/development/tools/misc/help2man/default.nix @@ -1,11 +1,11 @@ { stdenv, fetchurl, perl, gettext, LocaleGettext, makeWrapper }: stdenv.mkDerivation rec { - name = "help2man-1.47.2"; + name = "help2man-1.47.3"; src = fetchurl { url = "mirror://gnu/help2man/${name}.tar.xz"; - sha256 = "0z1zgw6k1fba59fii6ksfi1g2gci6i4ysa3kdfh3j475fdkn1if4"; + sha256 = "0miqq77ssk5rgsc9xlv7k5n2wk2c5wv2m1kh4zhbwrggfmjaycn2"; }; buildInputs = [ makeWrapper perl gettext LocaleGettext ];