From 2a0418651616093e029782030d1a75d57a51294c Mon Sep 17 00:00:00 2001 From: Robert Scott Date: Sun, 26 Sep 2021 17:04:45 +0100 Subject: [PATCH 01/10] wasm-pack: mandate libressl_3_2 newer versions not yet supported --- pkgs/top-level/all-packages.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index ffec1ea5c52f..ea8482019864 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -32365,6 +32365,7 @@ with pkgs; wasm-pack = callPackage ../development/tools/wasm-pack { inherit (darwin.apple_sdk.frameworks) Security; + libressl = libressl_3_2; }; wavegain = callPackage ../applications/audio/wavegain { }; From 6a709d4e697733adf4703f2b09f2d1813d8256d7 Mon Sep 17 00:00:00 2001 From: Robert Scott Date: Sun, 26 Sep 2021 12:20:02 +0100 Subject: [PATCH 02/10] libressl: 3.2.5 -> 3.4.0, leaving libressl_3_2 available --- pkgs/development/libraries/libressl/default.nix | 10 +++++++++- pkgs/top-level/all-packages.nix | 5 +++-- 2 files changed, 12 insertions(+), 3 deletions(-) diff --git a/pkgs/development/libraries/libressl/default.nix b/pkgs/development/libraries/libressl/default.nix index fb362ebbad2f..4dad527105a5 100644 --- a/pkgs/development/libraries/libressl/default.nix +++ b/pkgs/development/libraries/libressl/default.nix @@ -1,4 +1,8 @@ -{ stdenv, fetchurl, lib, cmake, cacert, fetchpatch +{ stdenv +, fetchurl +, lib +, cmake +, cacert , buildShared ? !stdenv.hostPlatform.isStatic }: @@ -67,4 +71,8 @@ in { version = "3.2.5"; sha256 = "1zkwrs3b19s1ybz4q9hrb7pqsbsi8vxcs44qanfy11fkc7ynb2kr"; }; + libressl_3_4 = generic { + version = "3.4.0"; + sha256 = "1lhn76nd59p1dfd27b4636zj6wh3f5xsi8b3sxqnl820imsswbp5"; + }; } diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index ea8482019864..7cd31e0f6b97 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -18403,11 +18403,12 @@ with pkgs; openvdb = callPackage ../development/libraries/openvdb {}; inherit (callPackages ../development/libraries/libressl { }) - libressl_3_2; + libressl_3_2 + libressl_3_4; # Please keep this pointed to the latest version. See also # https://discourse.nixos.org/t/nixpkgs-policy-regarding-libraries-available-in-multiple-versions/7026/2 - libressl = libressl_3_2; + libressl = libressl_3_4; boringssl = callPackage ../development/libraries/boringssl { }; From 0f88e9ff053dddbb03e4c7cc87c49648e75492f7 Mon Sep 17 00:00:00 2001 From: Robert Scott Date: Sun, 3 Oct 2021 15:59:46 +0100 Subject: [PATCH 03/10] libressl: enable tests --- pkgs/development/libraries/libressl/default.nix | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/pkgs/development/libraries/libressl/default.nix b/pkgs/development/libraries/libressl/default.nix index 4dad527105a5..23bc088ba11f 100644 --- a/pkgs/development/libraries/libressl/default.nix +++ b/pkgs/development/libraries/libressl/default.nix @@ -7,6 +7,9 @@ }: let + ldLibPathEnvName = if stdenv.isDarwin + then "DYLD_LIBRARY_PATH" + else "LD_LIBRARY_PATH"; generic = { version, sha256, patches ? [] }: stdenv.mkDerivation rec { pname = "libressl"; @@ -46,6 +49,15 @@ let substituteInPlace ./tls/tls_config.c --replace '"/etc/ssl/cert.pem"' '"${cacert}/etc/ssl/certs/ca-bundle.crt"' ''; + doCheck = true; + preCheck = '' + export PREVIOUS_${ldLibPathEnvName}=$${ldLibPathEnvName} + export ${ldLibPathEnvName}="$${ldLibPathEnvName}:$(realpath tls/):$(realpath ssl/):$(realpath crypto/)" + ''; + postCheck = '' + export ${ldLibPathEnvName}=$PREVIOUS_${ldLibPathEnvName} + ''; + outputs = [ "bin" "dev" "out" "man" "nc" ]; postFixup = '' From 01cc988d9669f29855d82175a4614d90aa4bfe75 Mon Sep 17 00:00:00 2001 From: Robert Scott Date: Sun, 3 Oct 2021 16:00:33 +0100 Subject: [PATCH 04/10] libressl_3_2, libressl_3_4: add patch for CVE-2021-41581 --- .../libraries/libressl/CVE-2021-41581.patch | 53 +++++++++++++++++++ .../libraries/libressl/default.nix | 7 +++ 2 files changed, 60 insertions(+) create mode 100644 pkgs/development/libraries/libressl/CVE-2021-41581.patch diff --git a/pkgs/development/libraries/libressl/CVE-2021-41581.patch b/pkgs/development/libraries/libressl/CVE-2021-41581.patch new file mode 100644 index 000000000000..244792567192 --- /dev/null +++ b/pkgs/development/libraries/libressl/CVE-2021-41581.patch @@ -0,0 +1,53 @@ +Based on upstream https://github.com/openbsd/src/commit/62ceddea5b1d64a1a362bbb7071d9e15adcde6b1 +with paths switched to apply to libressl-portable and CVS header +hunk removed. + +--- a/crypto/x509/x509_constraints.c ++++ b/crypto/x509/x509_constraints.c +@@ -339,16 +339,16 @@ + if (c == '.') + goto bad; + } +- if (wi > DOMAIN_PART_MAX_LEN) +- goto bad; + if (accept) { ++ if (wi >= DOMAIN_PART_MAX_LEN) ++ goto bad; + working[wi++] = c; + accept = 0; + continue; + } + if (candidate_local != NULL) { + /* We are looking for the domain part */ +- if (wi > DOMAIN_PART_MAX_LEN) ++ if (wi >= DOMAIN_PART_MAX_LEN) + goto bad; + working[wi++] = c; + if (i == len - 1) { +@@ -363,7 +363,7 @@ + continue; + } + /* We are looking for the local part */ +- if (wi > LOCAL_PART_MAX_LEN) ++ if (wi >= LOCAL_PART_MAX_LEN) + break; + + if (quoted) { +@@ -383,6 +383,8 @@ + */ + if (c == 9) + goto bad; ++ if (wi >= LOCAL_PART_MAX_LEN) ++ goto bad; + working[wi++] = c; + continue; /* all's good inside our quoted string */ + } +@@ -412,6 +414,8 @@ + } + if (!local_part_ok(c)) + goto bad; ++ if (wi >= LOCAL_PART_MAX_LEN) ++ goto bad; + working[wi++] = c; + } + if (candidate_local == NULL || candidate_domain == NULL) diff --git a/pkgs/development/libraries/libressl/default.nix b/pkgs/development/libraries/libressl/default.nix index 23bc088ba11f..d70672f63ac3 100644 --- a/pkgs/development/libraries/libressl/default.nix +++ b/pkgs/development/libraries/libressl/default.nix @@ -3,6 +3,7 @@ , lib , cmake , cacert +, fetchpatch , buildShared ? !stdenv.hostPlatform.isStatic }: @@ -82,9 +83,15 @@ in { libressl_3_2 = generic { version = "3.2.5"; sha256 = "1zkwrs3b19s1ybz4q9hrb7pqsbsi8vxcs44qanfy11fkc7ynb2kr"; + patches = [ + ./CVE-2021-41581.patch + ]; }; libressl_3_4 = generic { version = "3.4.0"; sha256 = "1lhn76nd59p1dfd27b4636zj6wh3f5xsi8b3sxqnl820imsswbp5"; + patches = [ + ./CVE-2021-41581.patch + ]; }; } From 8f6b280826df38eb6eabdf9c0028a93ffa24dc1d Mon Sep 17 00:00:00 2001 From: Smitty Date: Wed, 13 Oct 2021 17:43:05 -0400 Subject: [PATCH 05/10] maintainers: add smitop --- maintainers/maintainer-list.nix | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix index 8174b36839d4..eeff5cd1a21c 100644 --- a/maintainers/maintainer-list.nix +++ b/maintainers/maintainer-list.nix @@ -10484,6 +10484,13 @@ githubId = 4477729; name = "Sergey Mironov"; }; + smitop = { + name = "Smitty van Bodegom"; + email = "me@smitop.com"; + matrix = "@smitop:kde.org"; + github = "Smittyvb"; + githubId = 10530973; + }; sna = { email = "abouzahra.9@wright.edu"; github = "s-na"; From 16ffcc8f547182986c39c8becc8853ea1e02c301 Mon Sep 17 00:00:00 2001 From: Smitty Date: Sat, 16 Oct 2021 14:09:20 -0400 Subject: [PATCH 06/10] qcoro: init at 0.3.0 --- pkgs/development/libraries/qcoro/default.nix | 38 ++++++++++++++++++++ pkgs/top-level/qt5-packages.nix | 2 ++ 2 files changed, 40 insertions(+) create mode 100644 pkgs/development/libraries/qcoro/default.nix diff --git a/pkgs/development/libraries/qcoro/default.nix b/pkgs/development/libraries/qcoro/default.nix new file mode 100644 index 000000000000..62608e390f8b --- /dev/null +++ b/pkgs/development/libraries/qcoro/default.nix @@ -0,0 +1,38 @@ +{ lib +, mkDerivation +, fetchFromGitHub +, cmake +, libpthreadstubs +, qtbase +}: + +mkDerivation rec { + pname = "qcoro"; + version = "0.3.0"; + + src = fetchFromGitHub { + owner = "danvratil"; + repo = "qcoro"; + rev = "v${version}"; + sha256 = "09543hpy590dndmlxmcm8c58m97blhaii4wbjr655qxdanhhxgzi"; + }; + + outputs = [ "out" "dev" ]; + + nativeBuildInputs = [ + cmake + ]; + + buildInputs = [ + qtbase + libpthreadstubs + ]; + + meta = with lib; { + description = "Library for using C++20 coroutines in connection with certain asynchronous Qt actions"; + homepage = "https://github.com/danvratil/qcoro"; + license = licenses.mit; + maintainers = with maintainers; [ smitop ]; + platforms = platforms.linux; + }; +} diff --git a/pkgs/top-level/qt5-packages.nix b/pkgs/top-level/qt5-packages.nix index a5adec5d78f6..21d11d339f3a 100644 --- a/pkgs/top-level/qt5-packages.nix +++ b/pkgs/top-level/qt5-packages.nix @@ -174,6 +174,8 @@ in (kdeFrameworks // plasmaMobileGear // plasma5 // plasma5.thirdParty // kdeGea qca-qt5 = callPackage ../development/libraries/qca-qt5 { }; + qcoro = callPackage ../development/libraries/qcoro { }; + qcsxcad = callPackage ../development/libraries/science/electronics/qcsxcad { }; qmltermwidget = callPackage ../development/libraries/qmltermwidget { From 9a5345698dc85bb4076116e0e9fea29898cc8946 Mon Sep 17 00:00:00 2001 From: Alexander Sosedkin Date: Sun, 17 Oct 2021 16:13:45 +0200 Subject: [PATCH 07/10] tinycc: fix pkgsStatic.tinycc (musl) --- pkgs/development/compilers/tinycc/default.nix | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/pkgs/development/compilers/tinycc/default.nix b/pkgs/development/compilers/tinycc/default.nix index bb08b113ad50..90cd702de92a 100644 --- a/pkgs/development/compilers/tinycc/default.nix +++ b/pkgs/development/compilers/tinycc/default.nix @@ -19,12 +19,15 @@ stdenv.mkDerivation rec { ''; configureFlags = [ - "--cc=cc" + "--cc=${stdenv.cc.targetPrefix}cc" + "--ar=${stdenv.cc.targetPrefix}ar" "--crtprefix=${lib.getLib stdenv.cc.libc}/lib" "--sysincludepaths=${lib.getDev stdenv.cc.libc}/include:{B}/include" "--libpaths=${lib.getLib stdenv.cc.libc}/lib" # build cross compilers "--enable-cross" + ] ++ lib.optionals stdenv.hostPlatform.isMusl [ + "--config-musl" ]; preConfigure = '' From 8eeae5320e741d55ec1b891853fa48419e3a5a26 Mon Sep 17 00:00:00 2001 From: Alexander Sosedkin Date: Sun, 17 Oct 2021 19:30:47 +0200 Subject: [PATCH 08/10] tinycc: simplify specifying cc/ar Co-authored-by: Artturi --- pkgs/development/compilers/tinycc/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/compilers/tinycc/default.nix b/pkgs/development/compilers/tinycc/default.nix index 90cd702de92a..b46dee899a33 100644 --- a/pkgs/development/compilers/tinycc/default.nix +++ b/pkgs/development/compilers/tinycc/default.nix @@ -19,8 +19,8 @@ stdenv.mkDerivation rec { ''; configureFlags = [ - "--cc=${stdenv.cc.targetPrefix}cc" - "--ar=${stdenv.cc.targetPrefix}ar" + "--cc=$CC" + "--ar=$AR" "--crtprefix=${lib.getLib stdenv.cc.libc}/lib" "--sysincludepaths=${lib.getDev stdenv.cc.libc}/include:{B}/include" "--libpaths=${lib.getLib stdenv.cc.libc}/lib" From cf8610c7b5e70008c4903b3cf5e3279c1e8e45e8 Mon Sep 17 00:00:00 2001 From: rnhmjoj Date: Sun, 17 Oct 2021 18:53:27 +0200 Subject: [PATCH 09/10] pythonPackages.libusb1: 1.9.3 -> 2.0.1 --- pkgs/development/python-modules/libusb1/default.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/development/python-modules/libusb1/default.nix b/pkgs/development/python-modules/libusb1/default.nix index 0d8142645e1b..ce39ec117ee0 100644 --- a/pkgs/development/python-modules/libusb1/default.nix +++ b/pkgs/development/python-modules/libusb1/default.nix @@ -2,15 +2,15 @@ buildPythonPackage rec { pname = "libusb1"; - version = "1.9.3"; + version = "2.0.1"; src = fetchPypi { inherit pname version; - sha256 = "60e6ce37be064f6e51d02b25da44230ecc9c0b1fdb6f14568c71457d963c1749"; + sha256 = "d3ba82ecf7ab6a48d21dac6697e26504670cc3522b8e5941bd28fb56cf3f6c46"; }; postPatch = '' - substituteInPlace usb1/libusb1.py --replace \ + substituteInPlace usb1/_libusb1.py --replace \ "ctypes.util.find_library(base_name)" \ "'${libusb1}/lib/libusb-1.0${stdenv.hostPlatform.extensions.sharedLibrary}'" ''; From 675c3b3d02b1c6f9750e8221fe5322245321b29c Mon Sep 17 00:00:00 2001 From: Nick Cao Date: Sun, 17 Oct 2021 00:42:18 +0800 Subject: [PATCH 10/10] meli: alpha-0.7.1 -> alpha-0.7.2 --- pkgs/applications/networking/mailreaders/meli/default.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/applications/networking/mailreaders/meli/default.nix b/pkgs/applications/networking/mailreaders/meli/default.nix index 354ab024c6d0..d0575b60653b 100644 --- a/pkgs/applications/networking/mailreaders/meli/default.nix +++ b/pkgs/applications/networking/mailreaders/meli/default.nix @@ -15,15 +15,15 @@ rustPlatform.buildRustPackage rec { pname = "meli"; - version = "alpha-0.7.1"; + version = "alpha-0.7.2"; src = fetchgit { url = "https://git.meli.delivery/meli/meli.git"; rev = version; - sha256 = "00iai2z5zydx9bw0ii0n6d7zwm5rrkj03b4ymic0ybwjahqzvyfq"; + sha256 = "sha256-cbigEJhX6vL+gHa40cxplmPsDhsqujkzQxe0Dr6+SK0="; }; - cargoSha256 = "1r54a51j91iv0ziasjygzw30vqqvqibcnwnkih5xv0ijbaly61n0"; + cargoSha256 = "sha256-ZE653OtXyZ9454bKPApmuL2kVko/hGBWEAya1L1KIoc="; cargoBuildFlags = lib.optional withNotmuch "--features=notmuch";