From 387d5d25f4210a01ef9e51a4cfa6bae4ebf96405 Mon Sep 17 00:00:00 2001 From: Tom Herbers Date: Fri, 26 Jun 2026 08:31:12 +0200 Subject: [PATCH 1/2] incus: 7.1.0 -> 7.2.0 Changelog: https://github.com/lxc/incus/releases/tag/v7.2.0 Advisories: - https://github.com/lxc/incus/security/advisories/GHSA-48q5-w887-33wv (Critical) - https://github.com/lxc/incus/security/advisories/GHSA-73hr-m85f-64v9 (Critical) - https://github.com/lxc/incus/security/advisories/GHSA-vxp5-584q-c479 (Critical) - https://github.com/lxc/incus/security/advisories/GHSA-2q3f-q5pq-g8wv (Critical) - https://github.com/lxc/incus/security/advisories/GHSA-v6mj-8pf4-hhw4 (Critical) - https://github.com/lxc/incus/security/advisories/GHSA-f6m5-xw2g-xc4x (Critical) - https://github.com/lxc/incus/security/advisories/GHSA-c9f5-j9c3-mhrg (High) - https://github.com/lxc/incus/security/advisories/GHSA-64f3-v33m-w89f (High) --- pkgs/by-name/in/incus/generic.nix | 1 + pkgs/by-name/in/incus/package.nix | 14 ++++---------- 2 files changed, 5 insertions(+), 10 deletions(-) diff --git a/pkgs/by-name/in/incus/generic.nix b/pkgs/by-name/in/incus/generic.nix index d65be430f557..827280a10bab 100644 --- a/pkgs/by-name/in/incus/generic.nix +++ b/pkgs/by-name/in/incus/generic.nix @@ -121,6 +121,7 @@ buildGoModule (finalAttrs: { ''; postBuild = '' + export HOME=$(mktemp -d) # build docs mkdir -p .sphinx/deps ln -s ${buildPackages.python3.pkgs.swagger-ui-bundle.src} .sphinx/deps/swagger-ui diff --git a/pkgs/by-name/in/incus/package.nix b/pkgs/by-name/in/incus/package.nix index 8ffc9f825563..8493e9b65d56 100644 --- a/pkgs/by-name/in/incus/package.nix +++ b/pkgs/by-name/in/incus/package.nix @@ -1,14 +1,8 @@ import ./generic.nix { - hash = "sha256-g0YnvPMwk7WpYCl5VbRtHKVYoLlrk6QYhRaRRqulVQM="; - version = "7.1.0"; - vendorHash = "sha256-VqvDrjdBTblqEOY/HtoKXGRAdoTJpSWxkmgJNNPw6eQ="; - patches = fetchpatch2: [ - (fetchpatch2 { - name = "lxc-fix-environment-quoting.patch"; - url = "https://github.com/lxc/incus/commit/a1276cdb57297245496ac8c1db76b90d1fcebd3b.patch?full_index=1"; - hash = "sha256-NqEMYcDYx18KbqShKxmaK1o08c8/X4O87zXclQ36Ors="; - }) - ]; + hash = "sha256-GVCC0nV5Ghd9BroVC4ysqiTIQ3AtXIJ+EG6VbJVQBB4="; + version = "7.2.0"; + vendorHash = "sha256-0lBMQXQEf+oYlvyoFV2VTpJbY+reavCJZQkzt9UbnaI="; + patches = fetchpatch2: [ ]; nixUpdateExtraArgs = [ "--override-filename=pkgs/by-name/in/incus/package.nix" ]; From f1f19a90e66c7829957216c805f02849790462d9 Mon Sep 17 00:00:00 2001 From: Tom Herbers Date: Fri, 26 Jun 2026 08:48:25 +0200 Subject: [PATCH 2/2] incus-lts: backport 7.2 security fixes --- pkgs/by-name/in/incus/lts.nix | 50 +++++++++++++++++++++++++++++++++++ 1 file changed, 50 insertions(+) diff --git a/pkgs/by-name/in/incus/lts.nix b/pkgs/by-name/in/incus/lts.nix index 830273a7c26f..2b0318ca1a25 100644 --- a/pkgs/by-name/in/incus/lts.nix +++ b/pkgs/by-name/in/incus/lts.nix @@ -99,6 +99,56 @@ import ./generic.nix { url = "https://github.com/lxc/incus/commit/a6012422b45c86f3b1956788cff5d75c604ad838.patch?full_index=1"; hash = "sha256-u3NLKE8Rh8i6HMbJ0KNhH7gbuwIpJ1SPqiyVoiuw9Sc="; }) + (fetchpatch2 { + name = "incusd-instances_Check-source-instance-access-on-copy.patch"; + url = "https://github.com/lxc/incus/commit/1e3ffc53a10950e55de62ac1e0d612be597b84eb.patch?full_index=1"; + hash = "sha256-1foxIu1rWcK1QbpmAPoQ46Tl1mrPvoctPnDhKRTWbd0="; + }) + (fetchpatch2 { + name = "incusd-storage_Check-source-volume-access-on-copy.patch"; + url = "https://github.com/lxc/incus/commit/2e01078366e2653712719dec82318e51c6d21b28.patch?full_index=1"; + hash = "sha256-FP9v/8V0ZFLgy1tODKLJlw5f/6qJ8AMP/yme2YhYSaA="; + }) + (fetchpatch2 { + name = "incusd-images_Validate-fingerprint-on-direct-download.patch"; + url = "https://github.com/lxc/incus/commit/46d6ef232186df5535c49ca9f3597cab381f9b86.patch?full_index=1"; + hash = "sha256-R8gsvdmb7KVC6W1vFH1CojzhrGNgNiFOOTYbCrDAajg="; + }) + (fetchpatch2 { + name = "shared-validate_Reject-compression-algorithm-arguments.patch"; + url = "https://github.com/lxc/incus/commit/873a032a461df6b09b7586435b592873863a4e88.patch?full_index=1"; + hash = "sha256-QvxGxwHvswUZFst71zA12ZdxNIErl1LkaNyQdcPiglI="; + }) + (fetchpatch2 { + name = "incusd-instance_Confine-template-access-to-instance-root.patch"; + url = "https://github.com/lxc/incus/commit/cbefa31ae0da8fd96361178aed3a3c631e098fef.patch?full_index=1"; + hash = "sha256-ZOHqnlIG6LyIUO6WP76SZJKTeqoiw9qj2YByGxqGP+E="; + }) + (fetchpatch2 { + name = "incusd-instance_Enforce-project-restrictions-on-snapshot-restore.patch"; + url = "https://github.com/lxc/incus/commit/3fe3bc99891940fcd3e758d49f65a853104fcd6b.patch?full_index=1"; + hash = "sha256-j+lTbDaUjnZRY0lmaOSH4oKNAeIe5GXTwd1oM50it+Y="; + }) + (fetchpatch2 { + name = "incusd-exec_Reject-exec-output-symlink.patch"; + url = "https://github.com/lxc/incus/commit/e109655d642c7cb7c9039b7c06323000407f76dd.patch?full_index=1"; + hash = "sha256-v/H12n8u+aqm9+ZxrarBxQEQSMN1gpX13oyummGWXl8="; + }) + (fetchpatch2 { + name = "incusd_Reject-rootfs-symlink-for-instances.patch"; + url = "https://github.com/lxc/incus/commit/7e58425ca7ffeb21bb116869e71a0d002dae9e72.patch?full_index=1"; + hash = "sha256-MU+Khx+DhYQWUVs71D05PnJGamrhRXxsahtdXZeSfvU="; + }) + (fetchpatch2 { + name = "shared-logger_Add-WarnOnError-helper.patch"; + url = "https://github.com/lxc/incus/commit/1bc4d3feb8cd3bd005b7406c0d44ad3ea59400bf.patch?full_index=1"; + hash = "sha256-ima4IGl0CyL30yZVdQ2pmp9SukIzrdBftGkO/GUPB3g="; + }) + (fetchpatch2 { + name = "incus-0001-incusd-daemon_images-Add-missing-import.patch"; + url = "https://raw.githubusercontent.com/zabbly/incus/a7fd42d2f5115c4e6893b23e64209db511fff828/patches/incus-0001-incusd-daemon_images-Add-missing-import.patch"; + hash = "sha256-xtuuASy9bck+BgXbea9goNhrMV8Yme9cmFp4WNrkIdI="; + }) ]; nixUpdateExtraArgs = [ "--version-regex=^v(7\\.0\\.[0-9]+)$"