From 4484cc91ac0ff8e41739eeeaecbd62e6b4dc88d8 Mon Sep 17 00:00:00 2001 From: Infinidoge Date: Sun, 4 Feb 2024 05:57:16 -0500 Subject: [PATCH 1/9] openjdk: mark openjdk19 and openjdk20 as EOL --- pkgs/development/compilers/openjdk/meta.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkgs/development/compilers/openjdk/meta.nix b/pkgs/development/compilers/openjdk/meta.nix index 74383ddef783..adf7ccf8a1b9 100644 --- a/pkgs/development/compilers/openjdk/meta.nix +++ b/pkgs/development/compilers/openjdk/meta.nix @@ -5,7 +5,7 @@ lib: version: with lib; { maintainers = with maintainers; [ edwtjo ]; platforms = [ "i686-linux" "x86_64-linux" "aarch64-linux" "armv7l-linux" "armv6l-linux" "powerpc64le-linux" ]; mainProgram = "java"; - knownVulnerabilities = optionals (builtins.elem (versions.major version) [ "12" "13" "14" "15" "16" "18" ]) [ + knownVulnerabilities = optionals (builtins.elem (versions.major version) [ "12" "13" "14" "15" "16" "18" "19" "20" ]) [ "This OpenJDK version has reached its end of life." ]; } From d3307e2d2fe1378ddbb4117e2eff2033db3fdb86 Mon Sep 17 00:00:00 2001 From: Infinidoge Date: Sun, 4 Feb 2024 04:54:35 -0500 Subject: [PATCH 2/9] openjdk: add infinidoge as maintainer --- pkgs/development/compilers/openjdk/meta.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkgs/development/compilers/openjdk/meta.nix b/pkgs/development/compilers/openjdk/meta.nix index adf7ccf8a1b9..5078b77bfdd8 100644 --- a/pkgs/development/compilers/openjdk/meta.nix +++ b/pkgs/development/compilers/openjdk/meta.nix @@ -2,7 +2,7 @@ lib: version: with lib; { homepage = "https://openjdk.java.net/"; license = licenses.gpl2Only; description = "The open-source Java Development Kit"; - maintainers = with maintainers; [ edwtjo ]; + maintainers = with maintainers; [ edwtjo infinidoge ]; platforms = [ "i686-linux" "x86_64-linux" "aarch64-linux" "armv7l-linux" "armv6l-linux" "powerpc64le-linux" ]; mainProgram = "java"; knownVulnerabilities = optionals (builtins.elem (versions.major version) [ "12" "13" "14" "15" "16" "18" "19" "20" ]) [ From 332f5d3de8f43e0f34854606f736fca0bf15aadd Mon Sep 17 00:00:00 2001 From: Infinidoge Date: Sun, 4 Feb 2024 06:30:14 -0500 Subject: [PATCH 3/9] openjdk16-bootstrap: remove from all-packages This isn't used in any other packages, and the main version itself is currently marked as insecure. There isn't really a reason to keep it around in all-packages. It can still be accessed under javaPackages.compilers.openjdk16-bootstrap --- pkgs/top-level/all-packages.nix | 2 -- 1 file changed, 2 deletions(-) diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index 8126fabe5d66..41de7590dcb6 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -16094,8 +16094,6 @@ with pkgs; jdk17 = openjdk17; jdk17_headless = openjdk17_headless; - openjdk16-bootstrap = javaPackages.compiler.openjdk16-bootstrap; - openjdk19 = javaPackages.compiler.openjdk19; openjdk19_headless = javaPackages.compiler.openjdk19.headless; jdk19 = openjdk19; From 936fd7cb3bb68a04362695eb1772fe871c9fd930 Mon Sep 17 00:00:00 2001 From: Infinidoge Date: Sun, 4 Feb 2024 07:09:56 -0500 Subject: [PATCH 4/9] openjfx: build openjfx20 with openjdk20 --- pkgs/development/compilers/openjdk/openjfx/20.nix | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/pkgs/development/compilers/openjdk/openjfx/20.nix b/pkgs/development/compilers/openjdk/openjfx/20.nix index 10b44be546e9..4ba9ea707eb1 100644 --- a/pkgs/development/compilers/openjdk/openjfx/20.nix +++ b/pkgs/development/compilers/openjdk/openjfx/20.nix @@ -1,5 +1,5 @@ { stdenv, lib, fetchFromGitHub, writeText, openjdk17_headless -, openjdk19_headless, gradle_7, pkg-config, perl, cmake, gperf, gtk2, gtk3, libXtst +, openjdk20_headless, gradle_7, pkg-config, perl, cmake, gperf, gtk2, gtk3, libXtst , libXxf86vm, glib, alsa-lib, ffmpeg_4, python3, ruby, fetchurl, runCommand , withMedia ? true , withWebKit ? false @@ -49,7 +49,7 @@ let config = writeText "gradle.properties" ('' CONF = Release - JDK_HOME = ${openjdk19_headless.home} + JDK_HOME = ${openjdk20_headless.home} '' + args.gradleProperties or ""); buildPhase = '' @@ -111,14 +111,14 @@ in makePackage { postFixup = '' # Remove references to bootstrap. - export openjdkOutPath='${openjdk19_headless.outPath}' + export openjdkOutPath='${openjdk20_headless.outPath}' find "$out" -name \*.so | while read lib; do new_refs="$(patchelf --print-rpath "$lib" | perl -pe 's,:?\Q$ENV{openjdkOutPath}\E[^:]*,,')" patchelf --set-rpath "$new_refs" "$lib" done ''; - disallowedReferences = [ openjdk17_headless openjdk19_headless ]; + disallowedReferences = [ openjdk17_headless openjdk20_headless ]; passthru.deps = deps; From bc1d332e1ea4c782f49181a0e034873c13618b17 Mon Sep 17 00:00:00 2001 From: Infinidoge Date: Sun, 4 Feb 2024 06:49:11 -0500 Subject: [PATCH 5/9] openjfx: build openjfx21 with openjdk21 --- pkgs/development/compilers/openjdk/openjfx/21.nix | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/pkgs/development/compilers/openjdk/openjfx/21.nix b/pkgs/development/compilers/openjdk/openjfx/21.nix index 071420100e97..34693b3f921c 100644 --- a/pkgs/development/compilers/openjdk/openjfx/21.nix +++ b/pkgs/development/compilers/openjdk/openjfx/21.nix @@ -1,5 +1,5 @@ { stdenv, lib, fetchFromGitHub, writeText, openjdk17_headless -, openjdk19_headless, gradle_7, pkg-config, perl, cmake, gperf, gtk2, gtk3, libXtst +, openjdk21_headless, gradle_7, pkg-config, perl, cmake, gperf, gtk2, gtk3, libXtst , libXxf86vm, glib, alsa-lib, ffmpeg_4, python3, ruby, fetchurl, runCommand , withMedia ? true , withWebKit ? false @@ -49,7 +49,7 @@ let config = writeText "gradle.properties" ('' CONF = Release - JDK_HOME = ${openjdk19_headless.home} + JDK_HOME = ${openjdk21_headless.home} '' + args.gradleProperties or ""); buildPhase = '' @@ -111,14 +111,14 @@ in makePackage { postFixup = '' # Remove references to bootstrap. - export openjdkOutPath='${openjdk19_headless.outPath}' + export openjdkOutPath='${openjdk21_headless.outPath}' find "$out" -name \*.so | while read lib; do new_refs="$(patchelf --print-rpath "$lib" | perl -pe 's,:?\Q$ENV{openjdkOutPath}\E[^:]*,,')" patchelf --set-rpath "$new_refs" "$lib" done ''; - disallowedReferences = [ openjdk17_headless openjdk19_headless ]; + disallowedReferences = [ openjdk17_headless openjdk21_headless ]; passthru.deps = deps; From e397de45febd4090e40f61a42318a279d969bb55 Mon Sep 17 00:00:00 2001 From: Infinidoge Date: Sun, 4 Feb 2024 16:08:41 -0500 Subject: [PATCH 6/9] openjfx: mark EOL releases as vulnerable --- pkgs/development/compilers/openjdk/openjfx/19.nix | 3 +++ pkgs/development/compilers/openjdk/openjfx/20.nix | 3 +++ 2 files changed, 6 insertions(+) diff --git a/pkgs/development/compilers/openjdk/openjfx/19.nix b/pkgs/development/compilers/openjdk/openjfx/19.nix index 6f173db8327c..2100f962917a 100644 --- a/pkgs/development/compilers/openjdk/openjfx/19.nix +++ b/pkgs/development/compilers/openjdk/openjfx/19.nix @@ -141,5 +141,8 @@ in makePackage { description = "The next-generation Java client toolkit"; maintainers = with maintainers; [ abbradar ]; platforms = platforms.unix; + knownVulnerabilities = [ + "This OpenJFX version has reached its end of life." + ]; }; } diff --git a/pkgs/development/compilers/openjdk/openjfx/20.nix b/pkgs/development/compilers/openjdk/openjfx/20.nix index 4ba9ea707eb1..648f470a004d 100644 --- a/pkgs/development/compilers/openjdk/openjfx/20.nix +++ b/pkgs/development/compilers/openjdk/openjfx/20.nix @@ -128,5 +128,8 @@ in makePackage { description = "The next-generation Java client toolkit"; maintainers = with maintainers; [ abbradar ]; platforms = platforms.unix; + knownVulnerabilities = [ + "This OpenJFX version has reached its end of life." + ]; }; } From d8e578b4f965d225e22d44429e22dd405f81f154 Mon Sep 17 00:00:00 2001 From: Infinidoge Date: Sun, 4 Feb 2024 06:29:53 -0500 Subject: [PATCH 7/9] corretto: use version as rev --- pkgs/development/compilers/corretto/19.nix | 4 ++-- pkgs/development/compilers/corretto/21.nix | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/pkgs/development/compilers/corretto/19.nix b/pkgs/development/compilers/corretto/19.nix index ea1fcc1aee1b..5aac4daa6f06 100644 --- a/pkgs/development/compilers/corretto/19.nix +++ b/pkgs/development/compilers/corretto/19.nix @@ -10,7 +10,7 @@ }: let - corretto = import ./mk-corretto.nix { + corretto = import ./mk-corretto.nix rec { inherit lib stdenv rsync runCommand testers; jdk = jdk19; gradle = gradle_7; @@ -18,7 +18,7 @@ let src = fetchFromGitHub { owner = "corretto"; repo = "corretto-19"; - rev = "72f064a1d716272bd17d4e425d4a264b2c2c7d36"; + rev = version; sha256 = "sha256-mEj/MIbdXU0+fF5RhqjPuSeyclstesGaXB0e48YlKuw="; }; }; diff --git a/pkgs/development/compilers/corretto/21.nix b/pkgs/development/compilers/corretto/21.nix index fed3aa05f7a0..9656ace73cef 100644 --- a/pkgs/development/compilers/corretto/21.nix +++ b/pkgs/development/compilers/corretto/21.nix @@ -10,7 +10,7 @@ }: let - corretto = import ./mk-corretto.nix { + corretto = import ./mk-corretto.nix rec { inherit lib stdenv rsync runCommand testers; jdk = jdk21; gradle = gradle_7; @@ -18,7 +18,7 @@ let src = fetchFromGitHub { owner = "corretto"; repo = "corretto-21"; - rev = "97b366227b4dc8f5a89bbedea88b0b18c9e21886"; + rev = version; sha256 = "sha256-V8UDyukDCQVTWUg4IpSKoY0qnnQ5fePbm3rxcw06Vr0="; }; }; From 0da3bbed9dfb69c0a0d943e857604b5f7870e37c Mon Sep 17 00:00:00 2001 From: Infinidoge Date: Sun, 4 Feb 2024 06:28:46 -0500 Subject: [PATCH 8/9] corretto: remove unnecessary inputs --- pkgs/development/compilers/corretto/11.nix | 3 +-- pkgs/development/compilers/corretto/17.nix | 3 +-- pkgs/development/compilers/corretto/19.nix | 3 +-- 3 files changed, 3 insertions(+), 6 deletions(-) diff --git a/pkgs/development/compilers/corretto/11.nix b/pkgs/development/compilers/corretto/11.nix index 06de7a7bbdf8..8f39be6fddc9 100644 --- a/pkgs/development/compilers/corretto/11.nix +++ b/pkgs/development/compilers/corretto/11.nix @@ -1,5 +1,4 @@ -{ corretto11 -, fetchFromGitHub +{ fetchFromGitHub , gradle_7 , jdk11 , lib diff --git a/pkgs/development/compilers/corretto/17.nix b/pkgs/development/compilers/corretto/17.nix index 308750356c2a..be79aef0c244 100644 --- a/pkgs/development/compilers/corretto/17.nix +++ b/pkgs/development/compilers/corretto/17.nix @@ -1,5 +1,4 @@ -{ corretto17 -, fetchFromGitHub +{ fetchFromGitHub , gradle_7 , jdk17 , lib diff --git a/pkgs/development/compilers/corretto/19.nix b/pkgs/development/compilers/corretto/19.nix index 5aac4daa6f06..0674b63f21df 100644 --- a/pkgs/development/compilers/corretto/19.nix +++ b/pkgs/development/compilers/corretto/19.nix @@ -1,5 +1,4 @@ -{ corretto19 -, fetchFromGitHub +{ fetchFromGitHub , gradle_7 , jdk19 , lib From ccbada92bb68c3593bf2bbde855fdc9f908c7068 Mon Sep 17 00:00:00 2001 From: Infinidoge Date: Sun, 4 Feb 2024 13:53:39 -0500 Subject: [PATCH 9/9] adoptopenjdk-bin: mark EOL releases as vulnerable --- .../compilers/adoptopenjdk-bin/jdk15-darwin.nix | 8 ++++---- .../compilers/adoptopenjdk-bin/jdk15-linux.nix | 8 ++++---- .../compilers/adoptopenjdk-bin/jdk16-darwin.nix | 8 ++++---- .../compilers/adoptopenjdk-bin/jdk16-linux.nix | 8 ++++---- 4 files changed, 16 insertions(+), 16 deletions(-) diff --git a/pkgs/development/compilers/adoptopenjdk-bin/jdk15-darwin.nix b/pkgs/development/compilers/adoptopenjdk-bin/jdk15-darwin.nix index b9d706653065..369822fa1ef7 100644 --- a/pkgs/development/compilers/adoptopenjdk-bin/jdk15-darwin.nix +++ b/pkgs/development/compilers/adoptopenjdk-bin/jdk15-darwin.nix @@ -4,8 +4,8 @@ let sources = lib.importJSON ./sources.json; in { - jdk-hotspot = import ./jdk-darwin-base.nix { sourcePerArch = sources.openjdk15.mac.jdk.hotspot; }; - jre-hotspot = import ./jdk-darwin-base.nix { sourcePerArch = sources.openjdk15.mac.jre.hotspot; }; - jdk-openj9 = import ./jdk-darwin-base.nix { sourcePerArch = sources.openjdk15.mac.jdk.openj9; }; - jre-openj9 = import ./jdk-darwin-base.nix { sourcePerArch = sources.openjdk15.mac.jre.openj9; }; + jdk-hotspot = import ./jdk-darwin-base.nix { sourcePerArch = sources.openjdk15.mac.jdk.hotspot; knownVulnerabilities = [ "Support ended" ]; }; + jre-hotspot = import ./jdk-darwin-base.nix { sourcePerArch = sources.openjdk15.mac.jre.hotspot; knownVulnerabilities = [ "Support ended" ]; }; + jdk-openj9 = import ./jdk-darwin-base.nix { sourcePerArch = sources.openjdk15.mac.jdk.openj9; knownVulnerabilities = [ "Support ended" ]; }; + jre-openj9 = import ./jdk-darwin-base.nix { sourcePerArch = sources.openjdk15.mac.jre.openj9; knownVulnerabilities = [ "Support ended" ]; }; } diff --git a/pkgs/development/compilers/adoptopenjdk-bin/jdk15-linux.nix b/pkgs/development/compilers/adoptopenjdk-bin/jdk15-linux.nix index 7c6d1d36021e..52641c690bf0 100644 --- a/pkgs/development/compilers/adoptopenjdk-bin/jdk15-linux.nix +++ b/pkgs/development/compilers/adoptopenjdk-bin/jdk15-linux.nix @@ -5,8 +5,8 @@ let sources = lib.importJSON ./sources.json; in { - jdk-hotspot = import ./jdk-linux-base.nix { sourcePerArch = sources.openjdk15.${variant}.jdk.hotspot; }; - jre-hotspot = import ./jdk-linux-base.nix { sourcePerArch = sources.openjdk15.${variant}.jre.hotspot; }; - jdk-openj9 = import ./jdk-linux-base.nix { sourcePerArch = sources.openjdk15.${variant}.jdk.openj9; }; - jre-openj9 = import ./jdk-linux-base.nix { sourcePerArch = sources.openjdk15.${variant}.jre.openj9; }; + jdk-hotspot = import ./jdk-linux-base.nix { sourcePerArch = sources.openjdk15.${variant}.jdk.hotspot; knownVulnerabilities = [ "Support ended" ]; }; + jre-hotspot = import ./jdk-linux-base.nix { sourcePerArch = sources.openjdk15.${variant}.jre.hotspot; knownVulnerabilities = [ "Support ended" ]; }; + jdk-openj9 = import ./jdk-linux-base.nix { sourcePerArch = sources.openjdk15.${variant}.jdk.openj9; knownVulnerabilities = [ "Support ended" ]; }; + jre-openj9 = import ./jdk-linux-base.nix { sourcePerArch = sources.openjdk15.${variant}.jre.openj9; knownVulnerabilities = [ "Support ended" ]; }; } diff --git a/pkgs/development/compilers/adoptopenjdk-bin/jdk16-darwin.nix b/pkgs/development/compilers/adoptopenjdk-bin/jdk16-darwin.nix index a7473710d14b..454e92834bb0 100644 --- a/pkgs/development/compilers/adoptopenjdk-bin/jdk16-darwin.nix +++ b/pkgs/development/compilers/adoptopenjdk-bin/jdk16-darwin.nix @@ -4,8 +4,8 @@ let sources = lib.importJSON ./sources.json; in { - jdk-hotspot = import ./jdk-darwin-base.nix { sourcePerArch = sources.openjdk16.mac.jdk.hotspot; }; - jre-hotspot = import ./jdk-darwin-base.nix { sourcePerArch = sources.openjdk16.mac.jre.hotspot; }; - jdk-openj9 = import ./jdk-darwin-base.nix { sourcePerArch = sources.openjdk16.mac.jdk.openj9; }; - jre-openj9 = import ./jdk-darwin-base.nix { sourcePerArch = sources.openjdk16.mac.jre.openj9; }; + jdk-hotspot = import ./jdk-darwin-base.nix { sourcePerArch = sources.openjdk16.mac.jdk.hotspot; knownVulnerabilities = [ "Support ended" ]; }; + jre-hotspot = import ./jdk-darwin-base.nix { sourcePerArch = sources.openjdk16.mac.jre.hotspot; knownVulnerabilities = [ "Support ended" ]; }; + jdk-openj9 = import ./jdk-darwin-base.nix { sourcePerArch = sources.openjdk16.mac.jdk.openj9; knownVulnerabilities = [ "Support ended" ]; }; + jre-openj9 = import ./jdk-darwin-base.nix { sourcePerArch = sources.openjdk16.mac.jre.openj9; knownVulnerabilities = [ "Support ended" ]; }; } diff --git a/pkgs/development/compilers/adoptopenjdk-bin/jdk16-linux.nix b/pkgs/development/compilers/adoptopenjdk-bin/jdk16-linux.nix index 3d803901d341..3a50ad669c2e 100644 --- a/pkgs/development/compilers/adoptopenjdk-bin/jdk16-linux.nix +++ b/pkgs/development/compilers/adoptopenjdk-bin/jdk16-linux.nix @@ -5,8 +5,8 @@ let sources = lib.importJSON ./sources.json; in { - jdk-hotspot = import ./jdk-linux-base.nix { sourcePerArch = sources.openjdk16.${variant}.jdk.hotspot; }; - jre-hotspot = import ./jdk-linux-base.nix { sourcePerArch = sources.openjdk16.${variant}.jre.hotspot; }; - jdk-openj9 = import ./jdk-linux-base.nix { sourcePerArch = sources.openjdk16.${variant}.jdk.openj9; }; - jre-openj9 = import ./jdk-linux-base.nix { sourcePerArch = sources.openjdk16.${variant}.jre.openj9; }; + jdk-hotspot = import ./jdk-linux-base.nix { sourcePerArch = sources.openjdk16.${variant}.jdk.hotspot; knownVulnerabilities = [ "Support ended" ]; }; + jre-hotspot = import ./jdk-linux-base.nix { sourcePerArch = sources.openjdk16.${variant}.jre.hotspot; knownVulnerabilities = [ "Support ended" ]; }; + jdk-openj9 = import ./jdk-linux-base.nix { sourcePerArch = sources.openjdk16.${variant}.jdk.openj9; knownVulnerabilities = [ "Support ended" ]; }; + jre-openj9 = import ./jdk-linux-base.nix { sourcePerArch = sources.openjdk16.${variant}.jre.openj9; knownVulnerabilities = [ "Support ended" ]; }; }