From 10a6847471b2a59a188f4eac4f9314f2b2dbfdf6 Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Wed, 3 Jul 2024 15:56:43 +0200 Subject: [PATCH 1/3] discourse: fix update script after nix-universal-prefetch removal Replaces nix-universal-prefetch with nurl. --- pkgs/servers/web-apps/discourse/update.py | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) diff --git a/pkgs/servers/web-apps/discourse/update.py b/pkgs/servers/web-apps/discourse/update.py index 5d17b9798b60..9d922de7c9cc 100755 --- a/pkgs/servers/web-apps/discourse/update.py +++ b/pkgs/servers/web-apps/discourse/update.py @@ -1,5 +1,5 @@ #!/usr/bin/env nix-shell -#! nix-shell -i python3 -p bundix bundler nix-update nix-universal-prefetch "python3.withPackages (ps: with ps; [ requests click click-log packaging ])" prefetch-yarn-deps +#! nix-shell -i python3 -p bundix bundler nix-update nurl "python3.withPackages (ps: with ps; [ requests click click-log packaging ])" prefetch-yarn-deps from __future__ import annotations import click @@ -301,6 +301,11 @@ def update_plugins(): name = plugin.get('name') repo_name = plugin.get('repo_name') or name + if fetcher == "fetchFromGitHub": + url = f"https://github.com/{owner}/{repo_name}" + else: + raise NotImplementedError(f"Missing URL pattern for {fetcher}") + repo = DiscourseRepo(owner=owner, repo=repo_name) # implement the plugin pinning algorithm laid out here: @@ -378,10 +383,11 @@ def update_plugins(): prev_hash = _nix_eval(f'discourse.plugins.{name}.src.outputHash') new_hash = subprocess.check_output([ - 'nix-universal-prefetch', fetcher, - '--owner', owner, - '--repo', repo_name, - '--rev', rev, + "nurl", + "--fetcher", fetcher, + "--hash", + url, + rev, ], text=True).strip("\n") click.echo(f"Update {name}, {prev_commit_sha} -> {rev} in {filename}") From b212150fa2318473b25e9dec06975da2dc547c04 Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Wed, 3 Jul 2024 16:02:33 +0200 Subject: [PATCH 2/3] discourse: 3.2.2 -> 3.2.3 https://meta.discourse.org/t/3-2-3-security-and-bug-fix-release/313392 Fixes: CVE-2024-35227, CVE-2024-35234, CVE-2024-36113, CVE-2024-36122, CVE-2024-37157 --- pkgs/servers/web-apps/discourse/default.nix | 4 +- .../web-apps/discourse/rubyEnv/Gemfile | 9 +-- .../web-apps/discourse/rubyEnv/Gemfile.lock | 23 +++--- .../web-apps/discourse/rubyEnv/gemset.nix | 72 +++++++++---------- 4 files changed, 56 insertions(+), 52 deletions(-) diff --git a/pkgs/servers/web-apps/discourse/default.nix b/pkgs/servers/web-apps/discourse/default.nix index 79d7d096f668..ed78c5d231e3 100644 --- a/pkgs/servers/web-apps/discourse/default.nix +++ b/pkgs/servers/web-apps/discourse/default.nix @@ -46,13 +46,13 @@ }@args: let - version = "3.2.2"; + version = "3.2.3"; src = fetchFromGitHub { owner = "discourse"; repo = "discourse"; rev = "v${version}"; - sha256 = "sha256-JUCFtB5BvBytO3flq9o6iI3HPmvLU358HEmE6wbBsSk="; + sha256 = "sha256-ehv81trN8eG7QRAD5ERiSql6ZRCJK9cz6VOT9OzjZhg="; }; ruby = ruby_3_2; diff --git a/pkgs/servers/web-apps/discourse/rubyEnv/Gemfile b/pkgs/servers/web-apps/discourse/rubyEnv/Gemfile index f73aeecb6baa..bae9d8b9852d 100644 --- a/pkgs/servers/web-apps/discourse/rubyEnv/Gemfile +++ b/pkgs/servers/web-apps/discourse/rubyEnv/Gemfile @@ -55,8 +55,6 @@ gem "message_bus" gem "rails_multisite" -gem "fast_xs", platform: :ruby - gem "fastimage" gem "aws-sdk-s3", require: false @@ -199,8 +197,6 @@ gem "puma", require: false gem "rbtrace", require: false, platform: :mri -gem "gc_tracer", require: false, platform: :mri - # required for feed importing and embedding gem "ruby-readability", require: false @@ -269,3 +265,8 @@ gem "net-http" gem "cgi", ">= 0.3.6", require: false gem "tzinfo-data" +gem "csv", require: false + +# TODO: Can be removed once we upgrade to Rails 7.1 +gem "mutex_m" +gem "drb" diff --git a/pkgs/servers/web-apps/discourse/rubyEnv/Gemfile.lock b/pkgs/servers/web-apps/discourse/rubyEnv/Gemfile.lock index 31af98840b1c..4437a2d36817 100644 --- a/pkgs/servers/web-apps/discourse/rubyEnv/Gemfile.lock +++ b/pkgs/servers/web-apps/discourse/rubyEnv/Gemfile.lock @@ -33,7 +33,7 @@ GEM erubi (~> 1.4) rails-dom-testing (~> 2.0) rails-html-sanitizer (~> 1.1, >= 1.2.0) - actionview_precompiler (0.3.0) + actionview_precompiler (0.4.0) actionview (>= 6.0.a) active_model_serializers (0.8.4) activemodel (>= 3.0) @@ -117,6 +117,7 @@ GEM crass (1.0.6) css_parser (1.16.0) addressable + csv (3.3.0) date (3.3.4) debug_inspector (1.2.0) diff-lcs (1.5.0) @@ -130,6 +131,7 @@ GEM faker (~> 2.16) literate_randomizer docile (1.4.0) + drb (2.2.1) email_reply_trimmer (0.1.13) erubi (1.12.0) excon (0.109.0) @@ -146,16 +148,14 @@ GEM faraday-retry (2.2.0) faraday (~> 2.0) fast_blank (1.0.1) - fast_xs (0.8.0) fastimage (2.3.0) ffi (1.16.3) fspath (3.1.2) - gc_tracer (1.5.1) globalid (1.2.1) activesupport (>= 6.1) - google-protobuf (3.25.2) - google-protobuf (3.25.2-arm64-darwin) - google-protobuf (3.25.2-x86_64-darwin) + google-protobuf (3.25.3) + google-protobuf (3.25.3-arm64-darwin) + google-protobuf (3.25.3-x86_64-darwin) guess_html_encoding (0.0.11) hana (1.3.7) hashdiff (1.1.0) @@ -217,7 +217,7 @@ GEM rack (>= 1.1.3) method_source (1.0.0) mini_mime (1.1.5) - mini_portile2 (2.8.6) + mini_portile2 (2.8.7) mini_racer (0.8.0) libv8-node (~> 18.16.0.0) mini_scheduler (0.16.0) @@ -233,6 +233,7 @@ GEM multi_json (1.15.0) multi_xml (0.6.0) mustache (1.1.1) + mutex_m (0.2.0) net-http (0.4.1) uri net-imap (0.4.9.1) @@ -517,6 +518,7 @@ GEM PLATFORMS arm64-darwin-21 arm64-darwin-22 + arm64-darwin-23 ruby x86_64-darwin-22 @@ -546,11 +548,13 @@ DEPENDENCIES cose cppjieba_rb css_parser + csv diffy digest discourse-fonts discourse-seed-fu discourse_dev_assets + drb email_reply_trimmer excon execjs @@ -560,9 +564,7 @@ DEPENDENCIES faraday faraday-retry fast_blank - fast_xs fastimage - gc_tracer highline htmlentities http_accept_language @@ -591,6 +593,7 @@ DEPENDENCIES mocha multi_json mustache + mutex_m net-http net-imap net-pop @@ -661,4 +664,4 @@ DEPENDENCIES yard BUNDLED WITH - 2.5.9 + 2.5.11 diff --git a/pkgs/servers/web-apps/discourse/rubyEnv/gemset.nix b/pkgs/servers/web-apps/discourse/rubyEnv/gemset.nix index 79cba6f33bee..16474c336762 100644 --- a/pkgs/servers/web-apps/discourse/rubyEnv/gemset.nix +++ b/pkgs/servers/web-apps/discourse/rubyEnv/gemset.nix @@ -38,10 +38,10 @@ platforms = []; source = { remotes = ["https://rubygems.org"]; - sha256 = "07jyr2h87ha6k2y965rs4ywq142ddkfkhbmp0r44xg4wnffr8jbl"; + sha256 = "077d83avfm73nd0yji853jn94jpbr496apyz5zh5df61qipbvdik"; type = "gem"; }; - version = "0.3.0"; + version = "0.4.0"; }; active_model_serializers = { dependencies = ["activemodel"]; @@ -449,6 +449,16 @@ }; version = "1.16.0"; }; + csv = { + groups = ["default"]; + platforms = []; + source = { + remotes = ["https://rubygems.org"]; + sha256 = "0zfn40dvgjk1xv1z8l11hr9jfg3jncwsc9yhzsz4l4rivkpivg8b"; + type = "gem"; + }; + version = "3.3.0"; + }; date = { groups = ["default"]; platforms = []; @@ -541,6 +551,16 @@ }; version = "1.4.0"; }; + drb = { + groups = ["default"]; + platforms = []; + source = { + remotes = ["https://rubygems.org"]; + sha256 = "0h5kbj9hvg5hb3c7l425zpds0vb42phvln2knab8nmazg2zp5m79"; + type = "gem"; + }; + version = "2.2.1"; + }; email_reply_trimmer = { groups = ["default"]; platforms = []; @@ -675,22 +695,6 @@ }; version = "1.0.1"; }; - fast_xs = { - groups = ["default"]; - platforms = [{ - engine = "maglev"; - } { - engine = "rbx"; - } { - engine = "ruby"; - }]; - source = { - remotes = ["https://rubygems.org"]; - sha256 = "1iydzaqmvqq7ncxkr182aybkk6xap0cb2w9amr73vbdxi2qf3wjz"; - type = "gem"; - }; - version = "0.8.0"; - }; fastimage = { groups = ["default"]; platforms = []; @@ -725,20 +729,6 @@ }; version = "3.1.2"; }; - gc_tracer = { - groups = ["default"]; - platforms = [{ - engine = "maglev"; - } { - engine = "ruby"; - }]; - source = { - remotes = ["https://rubygems.org"]; - sha256 = "1yv3mp8lx74lfzs04fd5h4g89209iwhzpc407y35p7cmzgx6a4kv"; - type = "gem"; - }; - version = "1.5.1"; - }; globalid = { dependencies = ["activesupport"]; groups = ["default"]; @@ -755,10 +745,10 @@ platforms = []; source = { remotes = ["https://rubygems.org"]; - sha256 = "02sh4rp14wmpfv9r7xrap6xgcakg0lk6zjvq1gsi5y38swhn2blw"; + sha256 = "1mnxzcq8kmyfb9bkzqnp019d1hx1vprip3yzdkkha6b3qz5rgg9r"; type = "gem"; }; - version = "3.25.2"; + version = "3.25.3"; }; guess_html_encoding = { groups = ["default"]; @@ -1141,10 +1131,10 @@ platforms = []; source = { remotes = ["https://rubygems.org"]; - sha256 = "149r94xi6b3jbp6bv72f8383b95ndn0p5sxnq11gs1j9jadv0ajf"; + sha256 = "1q1f2sdw3y3y9mnym9dhjgsjr72sq975cfg5c4yx7gwv8nmzbvhk"; type = "gem"; }; - version = "2.8.6"; + version = "2.8.7"; }; mini_racer = { dependencies = ["libv8-node"]; @@ -1264,6 +1254,16 @@ }; version = "1.1.1"; }; + mutex_m = { + groups = ["default"]; + platforms = []; + source = { + remotes = ["https://rubygems.org"]; + sha256 = "1ma093ayps1m92q845hmpk0dmadicvifkbf05rpq9pifhin0rvxn"; + type = "gem"; + }; + version = "0.2.0"; + }; net-http = { dependencies = ["uri"]; groups = ["default"]; From c8c381efaf7e0d9ead949bfc48230ed3560a00c0 Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Wed, 3 Jul 2024 16:04:58 +0200 Subject: [PATCH 3/3] discourse.plugins.discourse-migratepassword: 1.16.3 -> 1.17.0 --- .../discourse/plugins/discourse-migratepassword/Gemfile | 1 - .../discourse/plugins/discourse-migratepassword/Gemfile.lock | 5 ++--- .../discourse/plugins/discourse-migratepassword/default.nix | 4 ++-- .../discourse/plugins/discourse-migratepassword/gemset.nix | 4 ++-- 4 files changed, 6 insertions(+), 8 deletions(-) diff --git a/pkgs/servers/web-apps/discourse/plugins/discourse-migratepassword/Gemfile b/pkgs/servers/web-apps/discourse/plugins/discourse-migratepassword/Gemfile index d2a2d943c408..ba35ee28efa9 100644 --- a/pkgs/servers/web-apps/discourse/plugins/discourse-migratepassword/Gemfile +++ b/pkgs/servers/web-apps/discourse/plugins/discourse-migratepassword/Gemfile @@ -5,6 +5,5 @@ source "https://rubygems.org" # gem "rails" gem 'bcrypt', '3.1.13' gem 'unix-crypt', '1.3.0' -gem 'ffi', '1.16.3', require: false gem 'ffi-compiler', '1.0.1', require: false gem 'argon2', '2.2.0' diff --git a/pkgs/servers/web-apps/discourse/plugins/discourse-migratepassword/Gemfile.lock b/pkgs/servers/web-apps/discourse/plugins/discourse-migratepassword/Gemfile.lock index a7bfa717ed9d..e806952546ee 100644 --- a/pkgs/servers/web-apps/discourse/plugins/discourse-migratepassword/Gemfile.lock +++ b/pkgs/servers/web-apps/discourse/plugins/discourse-migratepassword/Gemfile.lock @@ -5,7 +5,7 @@ GEM ffi (~> 1.15) ffi-compiler (~> 1.0) bcrypt (3.1.13) - ffi (1.16.3) + ffi (1.17.0) ffi-compiler (1.0.1) ffi (>= 1.0.0) rake @@ -18,9 +18,8 @@ PLATFORMS DEPENDENCIES argon2 (= 2.2.0) bcrypt (= 3.1.13) - ffi (= 1.16.3) ffi-compiler (= 1.0.1) unix-crypt (= 1.3.0) BUNDLED WITH - 2.5.9 + 2.5.11 diff --git a/pkgs/servers/web-apps/discourse/plugins/discourse-migratepassword/default.nix b/pkgs/servers/web-apps/discourse/plugins/discourse-migratepassword/default.nix index 2189ba854eb7..d220f050e20a 100644 --- a/pkgs/servers/web-apps/discourse/plugins/discourse-migratepassword/default.nix +++ b/pkgs/servers/web-apps/discourse/plugins/discourse-migratepassword/default.nix @@ -6,8 +6,8 @@ mkDiscoursePlugin { src = fetchFromGitHub { owner = "communiteq"; repo = "discourse-migratepassword"; - rev = "32d5fca6de3e8daf3869696ce835fefca1f00bfa"; - sha256 = "sha256-kNYkA6zuiuUZlPgvIvaO49P8bD+nNysEsow33xG1PnI="; + rev = "a732ae244cd4125561fd225a67bae95ef5f738d0"; + sha256 = "sha256-EO+QnFTy3PgxZ92DZBm9sP8sFAny3ZpFw+faTX32j7Q="; }; meta = with lib; { homepage = "https://github.com/communiteq/discourse-migratepassword"; diff --git a/pkgs/servers/web-apps/discourse/plugins/discourse-migratepassword/gemset.nix b/pkgs/servers/web-apps/discourse/plugins/discourse-migratepassword/gemset.nix index 49174f05d0e9..bff0d82479a3 100644 --- a/pkgs/servers/web-apps/discourse/plugins/discourse-migratepassword/gemset.nix +++ b/pkgs/servers/web-apps/discourse/plugins/discourse-migratepassword/gemset.nix @@ -25,10 +25,10 @@ platforms = []; source = { remotes = ["https://rubygems.org"]; - sha256 = "1yvii03hcgqj30maavddqamqy50h7y6xcn2wcyq72wn823zl4ckd"; + sha256 = "07139870npj59jnl8vmk39ja3gdk3fb5z9vc0lf32y2h891hwqsi"; type = "gem"; }; - version = "1.16.3"; + version = "1.17.0"; }; ffi-compiler = { dependencies = ["ffi" "rake"];