From b6d2a4294e4b9452bdc930932902a61e35382224 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= Date: Thu, 21 Mar 2024 09:38:16 +0100 Subject: [PATCH 1/2] gnutls: 3.8.3 -> 3.8.4 (medium security) https://lists.gnupg.org/pipermail/gnutls-help/2024-March/004845.html --- pkgs/development/libraries/gnutls/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/libraries/gnutls/default.nix b/pkgs/development/libraries/gnutls/default.nix index 3bef1d935564..218465747b5b 100644 --- a/pkgs/development/libraries/gnutls/default.nix +++ b/pkgs/development/libraries/gnutls/default.nix @@ -57,11 +57,11 @@ in stdenv.mkDerivation rec { pname = "gnutls"; - version = "3.8.3"; + version = "3.8.4"; src = fetchurl { url = "mirror://gnupg/gnutls/v${lib.versions.majorMinor version}/gnutls-${version}.tar.xz"; - hash = "sha256-90/FlUsn1Oxt+7Ed6ph4iLWxJCiaNwOvytoO5SD0Fz4="; + hash = "sha256-K+pOFUeU8/ABgPoqXFH+iwBax6Mc1YvUTN+n8268Ops="; }; outputs = [ "bin" "dev" "out" ] From f5487165d689a157e0c44e242a18d051e2b4f3b4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= Date: Thu, 21 Mar 2024 10:02:29 +0100 Subject: [PATCH 2/2] gnutls: revert switching compression libs to dlopen() --- pkgs/development/libraries/gnutls/default.nix | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/pkgs/development/libraries/gnutls/default.nix b/pkgs/development/libraries/gnutls/default.nix index 218465747b5b..681a810f8898 100644 --- a/pkgs/development/libraries/gnutls/default.nix +++ b/pkgs/development/libraries/gnutls/default.nix @@ -1,7 +1,7 @@ -{ config -, lib +{ lib , stdenv , fetchurl +, fetchpatch2 , zlib , lzo , libtasn1 @@ -73,6 +73,15 @@ stdenv.mkDerivation rec { patches = [ ./nix-ssl-cert-file.patch + # Revert https://gitlab.com/gnutls/gnutls/-/merge_requests/1800 + # dlopen isn't as easy in NixPkgs, as noticed in tests broken by this. + # Without getting the libs into RPATH they won't be found. + (fetchpatch2 { + name = "revert-dlopen-compression.patch"; + url = "https://gitlab.com/gnutls/gnutls/-/commit/8584908d6b679cd4e7676de437117a793e18347c.diff"; + revert = true; + hash = "sha256-r/+Gmwqy0Yc1LHL/PdPLXlErUBC5JxquLzCBAN3LuRM="; + }) ]; # Skip some tests: @@ -112,7 +121,7 @@ stdenv.mkDerivation rec { ++ lib.optional (withP11-kit) p11-kit ++ lib.optional (tpmSupport && stdenv.isLinux) trousers; - nativeBuildInputs = [ perl pkg-config texinfo ] + nativeBuildInputs = [ perl pkg-config texinfo ] ++ [ autoconf automake ] ++ lib.optionals doCheck [ which nettools util-linux ]; propagatedBuildInputs = [ nettle ]