Merge branch 'nixos-unstable' of https://github.com/NixOS/nixpkgs

Conflicts:
	nixpkgs/nixos/modules/config/console.nix
	nixpkgs/nixos/modules/services/mail/mailman.nix
	nixpkgs/nixos/modules/services/mail/public-inbox.nix
	nixpkgs/nixos/modules/services/mail/rss2email.nix
	nixpkgs/nixos/modules/services/networking/ssh/sshd.nix
	nixpkgs/pkgs/applications/networking/instant-messengers/dino/default.nix
	nixpkgs/pkgs/applications/networking/irc/weechat/default.nix
	nixpkgs/pkgs/applications/window-managers/sway/default.nix
	nixpkgs/pkgs/build-support/go/module.nix
	nixpkgs/pkgs/build-support/rust/build-rust-package/default.nix
	nixpkgs/pkgs/development/interpreters/python/default.nix
	nixpkgs/pkgs/development/node-packages/overrides.nix
	nixpkgs/pkgs/development/tools/b4/default.nix
	nixpkgs/pkgs/servers/dict/dictd-db.nix
	nixpkgs/pkgs/servers/mail/public-inbox/default.nix
	nixpkgs/pkgs/tools/security/pinentry/default.nix
	nixpkgs/pkgs/tools/text/unoconv/default.nix
	nixpkgs/pkgs/top-level/all-packages.nix

2 files changed, 84 insertions, 8 deletions

diff --git a/nixpkgs/pkgs/development/libraries/libde265/default.nix b/nixpkgs/pkgs/development/libraries/libde265/default.nix
index 762fe1765fd2..c7a5a85ae6b6 100644
--- a/nixpkgs/pkgs/development/libraries/libde265/default.nix
+++ b/nixpkgs/pkgs/development/libraries/libde265/default.nix
@@ -1,21 +1,40 @@
-{ lib, stdenv, fetchFromGitHub, fetchpatch, autoreconfHook, pkg-config }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, fetchpatch
+, autoreconfHook
+, pkg-config
 
-stdenv.mkDerivation rec {
-  version = "1.0.8";
+, callPackage
+
+# for passthru.tests
+, imagemagick
+, libheif
+, imlib2Full
+, gst_all_1
+}:
+
+stdenv.mkDerivation (finalAttrs: rec {
+  version = "1.0.11";
   pname = "libde265";
 
   src = fetchFromGitHub {
     owner = "strukturag";
     repo = "libde265";
     rev = "v${version}";
-    sha256 = "1dzflqbk248lz5ws0ni5acmf32b3rmnq5gsfaz7691qqjxkl1zml";
+    sha256 = "sha256-0aRUh5h49fnjBjy42A5fWYHnhnQ4CFoeSIXZilZewW8=";
   };
 
   patches = [
     (fetchpatch {
-      name = "CVE-2022-1253.patch";
-      url = "https://github.com/strukturag/libde265/commit/8e89fe0e175d2870c39486fdd09250b230ec10b8.patch";
-      sha256 = "sha256-F1BOWFx9oXR2trM22atyD3AJ5x6vVfURQ/PTlYP2Ibg=";
+      name = "CVE-2023-27102.patch";
+      url = "https://github.com/strukturag/libde265/commit/0b1752abff97cb542941d317a0d18aa50cb199b1.patch";
+      sha256 = "sha256-q0NKuk2r5RQT9MJpRO3CTPj6VqYRBnffs9yZ+GM+lNc=";
+    })
+    (fetchpatch {
+      name = "CVE-2023-27103.patch";
+      url = "https://github.com/strukturag/libde265/commit/d6bf73e765b7a23627bfd7a8645c143fd9097995.patch";
+      sha256 = "sha256-vxciVzSuVCVDpdz+TKg2tMWp2ArubYji5GLaR9VP4F0=";
     })
   ];
 
@@ -23,6 +42,15 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
+  passthru.tests = {
+    inherit imagemagick libheif imlib2Full;
+    inherit (gst_all_1) gst-plugins-bad;
+
+    test-corpus-decode = callPackage ./test-corpus-decode.nix {
+      libde265 = finalAttrs.finalPackage;
+    };
+  };
+
   meta = {
     homepage = "https://github.com/strukturag/libde265";
     description = "Open h.265 video codec implementation";
@@ -30,4 +58,4 @@ stdenv.mkDerivation rec {
     platforms = lib.platforms.unix;
     maintainers = with lib.maintainers; [ gebner ];
   };
-}
+})
diff --git a/nixpkgs/pkgs/development/libraries/libde265/test-corpus-decode.nix b/nixpkgs/pkgs/development/libraries/libde265/test-corpus-decode.nix
new file mode 100644
index 000000000000..763c93e6a993
--- /dev/null
+++ b/nixpkgs/pkgs/development/libraries/libde265/test-corpus-decode.nix
@@ -0,0 +1,48 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, libde265
+}:
+
+stdenv.mkDerivation {
+  pname = "libde265-test-corpus-decode";
+  version = "unstable-2020-02-19";
+
+  src = fetchFromGitHub {
+    owner = "strukturag";
+    repo = "libde265-data";
+    rev = "bdfdfdbe682f514c5185c270c74eac42731a7fa8";
+    sha256 = "sha256-fOgu7vMoyH30Zzbkfm4a6JVDZtYLO/0R2syC2Wux+Z8=";
+  };
+
+  dontConfigure = true;
+  dontBuild = true;
+
+  doCheck = true;
+  nativeCheckInputs = [ libde265 ];
+  # based on invocations in https://github.com/strukturag/libde265/blob/0b1752abff97cb542941d317a0d18aa50cb199b1/scripts/ci-run.sh
+  checkPhase = ''
+    echo "Single-threaded:"
+    find . -name '*.bin' | while read f; do
+      echo "Decoding $f"
+      dec265 -q -c $f
+      dec265 -0 -q -c $f
+      dec265 -q --disable-deblocking --disable-sao $f
+    done
+    echo "Multi-threaded:"
+    find RandomAccess/ -name '*.bin' | while read f; do
+      echo "Decoding $f"
+      dec265 -t 4 -q -c $f
+      dec265 -t 4 -0 -q -c $f
+      dec265 -t 4 -q --disable-deblocking --disable-sao $f
+    done
+  '';
+  # a larger corpus of files can be found
+  # as an ubuntu package libde265-teststreams @
+  # https://launchpad.net/~strukturag/+archive/ubuntu/libde265/+packages
+  # but it is *much* larger
+
+  installPhase = ''
+    touch $out
+  '';
+}