From 40c614f31e96aaa467770740af8fdc331ce88d56 Mon Sep 17 00:00:00 2001 From: Boris Nagaev Date: Wed, 29 Oct 2025 21:08:11 -0300 Subject: [PATCH 1/4] electrum: disable python-ecdsa by default Some Electrum plugins use python-ecdsa which is known to be vulnerable (CVE-2024-23342). In this commit these plugins are disabled. It is possible to re-enable it via option enablePythonEcdsa. The list of affected plugins: - ckcc-protocol - keepkey - trezor - bitbox02 --- pkgs/applications/misc/electrum/default.nix | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/pkgs/applications/misc/electrum/default.nix b/pkgs/applications/misc/electrum/default.nix index 0197aa8e1c30..ffec81f34559 100644 --- a/pkgs/applications/misc/electrum/default.nix +++ b/pkgs/applications/misc/electrum/default.nix @@ -7,6 +7,7 @@ python3, zbar, enableQt ? true, + enablePythonEcdsa ? false, callPackage, qtwayland, }: @@ -56,12 +57,16 @@ python3.pkgs.buildPythonApplication rec { electrum-ecc # plugins ledger-bitcoin + cbor2 + pyserial + ] + ++ lib.optionals enablePythonEcdsa [ + # enablePythonEcdsa gates plugins known to pull in python-ecdsa, which we + # avoid by default due to CVE-2024-23342. ckcc-protocol keepkey trezor bitbox02 - cbor2 - pyserial ] ++ lib.optionals enableQt [ pyqt6 From 4782986944a560ac1bf4c4d49f049c771e52e970 Mon Sep 17 00:00:00 2001 From: Boris Nagaev Date: Wed, 29 Oct 2025 21:32:53 -0300 Subject: [PATCH 2/4] electrum: fix building (generated protobuf files) Starting from version 4.3.1, source-only Electrum tarball excludes generated protobuf files. Build generated protobuf file from electrum/paymentrequest.proto. Tests and wrappers include protobuf dependencies to start successfully. --- pkgs/applications/misc/electrum/default.nix | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) diff --git a/pkgs/applications/misc/electrum/default.nix b/pkgs/applications/misc/electrum/default.nix index ffec81f34559..85ed65ed20d4 100644 --- a/pkgs/applications/misc/electrum/default.nix +++ b/pkgs/applications/misc/electrum/default.nix @@ -82,7 +82,11 @@ python3.pkgs.buildPythonApplication rec { "tests/test_qml_types.py" ]; - postPatch = + postPatch = '' + # Upstream tarball omits regenerated protobuf bindings in some releases. + protoc --python_out=. electrum/paymentrequest.proto + '' + + ( if enableQt then '' substituteInPlace ./electrum/qrscanner.py \ @@ -91,7 +95,8 @@ python3.pkgs.buildPythonApplication rec { else '' sed -i '/qdarkstyle/d' contrib/requirements/requirements.txt - ''; + '' + ); postInstall = lib.optionalString stdenv.hostPlatform.isLinux '' substituteInPlace $out/share/applications/electrum.desktop \ @@ -103,7 +108,15 @@ python3.pkgs.buildPythonApplication rec { wrapQtApp $out/bin/electrum ''; + preFixup = '' + makeWrapperArgs+=(--prefix PYTHONPATH : ${python3.pkgs.protobuf}/${python3.sitePackages}) + '' + + lib.optionalString enableQt '' + qtWrapperArgs+=(--prefix PYTHONPATH : ${python3.pkgs.protobuf}/${python3.sitePackages}) + ''; + nativeCheckInputs = with python3.pkgs; [ + protobuf pytestCheckHook pyaes pycryptodomex @@ -113,6 +126,7 @@ python3.pkgs.buildPythonApplication rec { # avoid homeless-shelter error in tests preCheck = '' + export PYTHONPATH=${python3.pkgs.protobuf}/${python3.sitePackages}:$PYTHONPATH export HOME="$(mktemp -d)" ''; From 6f8787b23bda2e463b91b235cfac070c9e04d681 Mon Sep 17 00:00:00 2001 From: Boris Nagaev Date: Wed, 29 Oct 2025 21:57:07 -0300 Subject: [PATCH 3/4] electrum: 4.6.0 -> 4.6.2 --- pkgs/applications/misc/electrum/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/applications/misc/electrum/default.nix b/pkgs/applications/misc/electrum/default.nix index 85ed65ed20d4..f52536212af6 100644 --- a/pkgs/applications/misc/electrum/default.nix +++ b/pkgs/applications/misc/electrum/default.nix @@ -23,12 +23,12 @@ let in python3.pkgs.buildPythonApplication rec { pname = "electrum"; - version = "4.6.0"; + version = "4.6.2"; format = "setuptools"; src = fetchurl { url = "https://download.electrum.org/${version}/Electrum-${version}.tar.gz"; - hash = "sha256-aQqZXyfqFgc1j2r836eaaayOmSzDijHlYXmF+OBw418="; + hash = "sha256-ZrwzAeeMNrs6KzLGDg5oBF7E+GGLYCVczO6R18TKRuE="; }; build-system = [ protobuf ] ++ lib.optionals enableQt [ wrapQtAppsHook ]; From b80435486ea08b09b6a07cb79aa33e639e74456f Mon Sep 17 00:00:00 2001 From: Boris Nagaev Date: Sat, 1 Nov 2025 20:29:26 -0300 Subject: [PATCH 4/4] electrum: init pyproject Switch to the PEP 517 build pipeline so we rely on the native build system rather than the deprecated setuptools path. Use pythonRelaxDepsHook to ease upstream's strict version pins and keep protobuf available at runtime. --- pkgs/applications/misc/electrum/default.nix | 23 +++++++++++++++++++-- 1 file changed, 21 insertions(+), 2 deletions(-) diff --git a/pkgs/applications/misc/electrum/default.nix b/pkgs/applications/misc/electrum/default.nix index f52536212af6..8a55b89bf897 100644 --- a/pkgs/applications/misc/electrum/default.nix +++ b/pkgs/applications/misc/electrum/default.nix @@ -24,14 +24,24 @@ in python3.pkgs.buildPythonApplication rec { pname = "electrum"; version = "4.6.2"; - format = "setuptools"; + pyproject = true; src = fetchurl { url = "https://download.electrum.org/${version}/Electrum-${version}.tar.gz"; hash = "sha256-ZrwzAeeMNrs6KzLGDg5oBF7E+GGLYCVczO6R18TKRuE="; }; - build-system = [ protobuf ] ++ lib.optionals enableQt [ wrapQtAppsHook ]; + build-system = with python3.pkgs; [ + setuptools + ]; + + nativeBuildInputs = [ + protobuf + python3.pkgs.pythonRelaxDepsHook + ] + ++ lib.optionals enableQt [ + wrapQtAppsHook + ]; buildInputs = lib.optional (stdenv.hostPlatform.isLinux && enableQt) qtwayland; dependencies = @@ -73,6 +83,15 @@ python3.pkgs.buildPythonApplication rec { qdarkstyle ]; + pythonRelaxDeps = [ + "attrs" + "dnspython" + ]; + + pythonRemoveDeps = [ + "protobuf" + ]; + checkInputs = with python3.pkgs; lib.optionals enableQt [