From 572550596752fe6f69b2c07f5a928889df223fe7 Mon Sep 17 00:00:00 2001 From: Vladimír Čunát Date: Sat, 6 May 2017 11:57:02 +0200 Subject: mesa: maintenance 17.0.4 -> 17.0.5 --- pkgs/development/libraries/mesa/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'pkgs/development/libraries') diff --git a/pkgs/development/libraries/mesa/default.nix b/pkgs/development/libraries/mesa/default.nix index e9edda698f44..a8516b623142 100644 --- a/pkgs/development/libraries/mesa/default.nix +++ b/pkgs/development/libraries/mesa/default.nix @@ -67,7 +67,7 @@ let in let - version = "17.0.4"; + version = "17.0.5"; branch = head (splitString "." version); driverLink = "/run/opengl-driver" + optionalString stdenv.isi686 "-32"; in @@ -82,7 +82,7 @@ stdenv.mkDerivation { "ftp://ftp.freedesktop.org/pub/mesa/older-versions/${branch}.x/${version}/mesa-${version}.tar.xz" "https://launchpad.net/mesa/trunk/${version}/+download/mesa-${version}.tar.xz" ]; - sha256 = "1269dc8545a193932a0779b2db5bce9be4a5f6813b98c38b93b372be8362a346"; + sha256 = "668efa445d2f57a26e5c096b1965a685733a3b57d9c736f9d6460263847f9bfe"; }; prePatch = "patchShebangs ."; -- cgit 1.4.1 From 1c9ed32a343f4016a4b85bc3e179fc49e286e5c2 Mon Sep 17 00:00:00 2001 From: Marc Nickert Date: Fri, 12 May 2017 17:27:18 +0200 Subject: libtiff: security 4.0.7-5 -> 4.0.7-6 (Debian patches) Taken from PR #25742, only adding extra comment. --- pkgs/development/libraries/libtiff/default.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'pkgs/development/libraries') diff --git a/pkgs/development/libraries/libtiff/default.nix b/pkgs/development/libraries/libtiff/default.nix index c67057031490..a23e37040352 100644 --- a/pkgs/development/libraries/libtiff/default.nix +++ b/pkgs/development/libraries/libtiff/default.nix @@ -12,10 +12,10 @@ stdenv.mkDerivation rec { }; prePatch =let - # https://lwn.net/Vulnerabilities/711777/ + # https://lwn.net/Vulnerabilities/711777/ and more patched in *-6 -> *-7 debian = fetchurl { - url = http://http.debian.net/debian/pool/main/t/tiff/tiff_4.0.7-5.debian.tar.xz; - sha256 = "1ribxdn89wx3nllcyh7ql3dx6wpr1h7z3waglz1w7dklxm43q67l"; + url = http://http.debian.net/debian/pool/main/t/tiff/tiff_4.0.7-6.debian.tar.xz; + sha256 = "9c9048c28205bdbeb5ba36c7a194d0cd604bd137c70961607bfc8a079be5fa31"; }; in '' tar xf '${debian}' -- cgit 1.4.1 From fcdb4b51f852a5654e101f2035e55f129562658d Mon Sep 17 00:00:00 2001 From: Vladimír Čunát Date: Sun, 14 May 2017 14:36:54 +0200 Subject: mesa: maintenance 17.0.5 -> 17.0.6 --- pkgs/development/libraries/mesa/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'pkgs/development/libraries') diff --git a/pkgs/development/libraries/mesa/default.nix b/pkgs/development/libraries/mesa/default.nix index a8516b623142..b6ca7a0a4766 100644 --- a/pkgs/development/libraries/mesa/default.nix +++ b/pkgs/development/libraries/mesa/default.nix @@ -67,7 +67,7 @@ let in let - version = "17.0.5"; + version = "17.0.6"; branch = head (splitString "." version); driverLink = "/run/opengl-driver" + optionalString stdenv.isi686 "-32"; in @@ -82,7 +82,7 @@ stdenv.mkDerivation { "ftp://ftp.freedesktop.org/pub/mesa/older-versions/${branch}.x/${version}/mesa-${version}.tar.xz" "https://launchpad.net/mesa/trunk/${version}/+download/mesa-${version}.tar.xz" ]; - sha256 = "668efa445d2f57a26e5c096b1965a685733a3b57d9c736f9d6460263847f9bfe"; + sha256 = "17d60jjzg4ddm95gk2cqx0xz6b9anmmz6ax4majwr3gis2yg7v49"; }; prePatch = "patchShebangs ."; -- cgit 1.4.1 From b0d2de45cddcd1e4578bfae121e606f89b00fc5e Mon Sep 17 00:00:00 2001 From: Vladimír Čunát Date: Sun, 14 May 2017 14:59:55 +0200 Subject: freetype: fix CVE-2017-{8105,8287} by upstream patches I copied the patches, as the changelog changes would certainly conflict. --- .../libraries/freetype/cve-2017-8105.patch | 27 ++++++++++++++++++++++ .../libraries/freetype/cve-2017-8287.patch | 22 ++++++++++++++++++ pkgs/development/libraries/freetype/default.nix | 3 +++ 3 files changed, 52 insertions(+) create mode 100644 pkgs/development/libraries/freetype/cve-2017-8105.patch create mode 100644 pkgs/development/libraries/freetype/cve-2017-8287.patch (limited to 'pkgs/development/libraries') diff --git a/pkgs/development/libraries/freetype/cve-2017-8105.patch b/pkgs/development/libraries/freetype/cve-2017-8105.patch new file mode 100644 index 000000000000..dc4327a52a88 --- /dev/null +++ b/pkgs/development/libraries/freetype/cve-2017-8105.patch @@ -0,0 +1,27 @@ +http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=f958c48ee43 + +diff --git a/src/psaux/t1decode.c b/src/psaux/t1decode.c +index af7b465..7dd4513 100644 +--- a/src/psaux/t1decode.c ++++ b/src/psaux/t1decode.c +@@ -780,10 +780,19 @@ + /* point without adding any point to the outline */ + idx = decoder->num_flex_vectors++; + if ( idx > 0 && idx < 7 ) ++ { ++ /* in malformed fonts it is possible to have other */ ++ /* opcodes in the middle of a flex (which don't */ ++ /* increase `num_flex_vectors'); we thus have to */ ++ /* check whether we can add a point */ ++ if ( FT_SET_ERROR( t1_builder_check_points( builder, 1 ) ) ) ++ goto Syntax_Error; ++ + t1_builder_add_point( builder, + x, + y, + (FT_Byte)( idx == 3 || idx == 6 ) ); ++ } + } + break; + + diff --git a/pkgs/development/libraries/freetype/cve-2017-8287.patch b/pkgs/development/libraries/freetype/cve-2017-8287.patch new file mode 100644 index 000000000000..7ccf4f3278b7 --- /dev/null +++ b/pkgs/development/libraries/freetype/cve-2017-8287.patch @@ -0,0 +1,22 @@ +http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=3774fc08b + +diff --git a/src/psaux/psobjs.c b/src/psaux/psobjs.c +index d18e821..0baf836 100644 +--- a/src/psaux/psobjs.c ++++ b/src/psaux/psobjs.c +@@ -1718,6 +1718,14 @@ + first = outline->n_contours <= 1 + ? 0 : outline->contours[outline->n_contours - 2] + 1; + ++ /* in malformed fonts it can happen that a contour was started */ ++ /* but no points were added */ ++ if ( outline->n_contours && first == outline->n_points ) ++ { ++ outline->n_contours--; ++ return; ++ } ++ + /* We must not include the last point in the path if it */ + /* is located on the first point. */ + if ( outline->n_points > 1 ) + diff --git a/pkgs/development/libraries/freetype/default.nix b/pkgs/development/libraries/freetype/default.nix index 287a07424407..9b2c6fe11e15 100644 --- a/pkgs/development/libraries/freetype/default.nix +++ b/pkgs/development/libraries/freetype/default.nix @@ -48,6 +48,9 @@ in stdenv.mkDerivation { ./pcf-config-long-family-names.patch ./disable-pcf-long-family-names.patch ./enable-table-validation.patch + # remove the two CVE patches after updating to >= 2.8 + ./cve-2017-8105.patch + ./cve-2017-8287.patch ] ++ optional useEncumberedCode ./enable-subpixel-rendering.patch; -- cgit 1.4.1 From c68a24120815411e82224d6c96ff287cb79c11ac Mon Sep 17 00:00:00 2001 From: mimadrid Date: Mon, 15 May 2017 19:32:35 +0200 Subject: gnutls: 3.5.11 -> 3.5.12 --- pkgs/development/libraries/gnutls/3.5.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'pkgs/development/libraries') diff --git a/pkgs/development/libraries/gnutls/3.5.nix b/pkgs/development/libraries/gnutls/3.5.nix index 77ecd4957f75..8071cd4b46be 100644 --- a/pkgs/development/libraries/gnutls/3.5.nix +++ b/pkgs/development/libraries/gnutls/3.5.nix @@ -1,11 +1,11 @@ { callPackage, fetchurl, libunistring, ... } @ args: callPackage ./generic.nix (args // rec { - version = "3.5.11"; + version = "3.5.12"; src = fetchurl { url = "ftp://ftp.gnutls.org/gcrypt/gnutls/v3.5/gnutls-${version}.tar.xz"; - sha256 = "13z2dxxyrsb7gfpl1k2kafqh2zaigi872y5xgykhs9cyaz2mqxji"; + sha256 = "1jspvrmydqgz30c1ji94b55gr2dynz7p96p4y8fkhad0xajkkjv3"; }; # Skip two tests introduced in 3.5.11. Probable reasons of failure: -- cgit 1.4.1 From 65ede052fa9f005efcdb2e852315a0e6f02ce92d Mon Sep 17 00:00:00 2001 From: Vladimír Čunát Date: Tue, 16 May 2017 16:35:52 +0200 Subject: treewide: fixup packages with RPATH problems --- pkgs/applications/science/math/calc/default.nix | 3 +++ pkgs/development/compilers/bigloo/default.nix | 3 +++ pkgs/development/compilers/swift/default.nix | 3 +++ pkgs/development/libraries/libftdi/default.nix | 3 +++ pkgs/games/klavaro/default.nix | 3 +++ pkgs/os-specific/linux/libsmbios/default.nix | 3 +++ pkgs/tools/security/ssdeep/default.nix | 3 +++ 7 files changed, 21 insertions(+) (limited to 'pkgs/development/libraries') diff --git a/pkgs/applications/science/math/calc/default.nix b/pkgs/applications/science/math/calc/default.nix index 19f769e4365c..b8ed7ffac3cd 100644 --- a/pkgs/applications/science/math/calc/default.nix +++ b/pkgs/applications/science/math/calc/default.nix @@ -34,6 +34,9 @@ stdenv.mkDerivation rec { wrapProgram $out/bin/calc --prefix LD_LIBRARY_PATH : $out/lib ''; + # Hack to avoid TMPDIR in RPATHs. + preFixup = ''rm -rf "$(pwd)" ''; + meta = { description = "C-style arbitrary precision calculator"; homepage = http://www.isthe.com/chongo/tech/comp/calc/; diff --git a/pkgs/development/compilers/bigloo/default.nix b/pkgs/development/compilers/bigloo/default.nix index 3599ff750c26..bf2272a75c17 100644 --- a/pkgs/development/compilers/bigloo/default.nix +++ b/pkgs/development/compilers/bigloo/default.nix @@ -32,6 +32,9 @@ stdenv.mkDerivation rec { checkTarget = "test"; + # Hack to avoid TMPDIR in RPATHs. + preFixup = ''rm -rf "$(pwd)" ''; + meta = { description = "Efficient Scheme compiler"; homepage = http://www-sop.inria.fr/indes/fp/Bigloo/; diff --git a/pkgs/development/compilers/swift/default.nix b/pkgs/development/compilers/swift/default.nix index 4b918c9e32a9..839ecdbeb652 100644 --- a/pkgs/development/compilers/swift/default.nix +++ b/pkgs/development/compilers/swift/default.nix @@ -253,6 +253,9 @@ stdenv.mkDerivation rec { ln -s ${binutils}/bin/ar $out/bin/ar ''; + # Hack to avoid TMPDIR in RPATHs. + preFixup = ''rm -rf "$(pwd)" ''; + meta = with stdenv.lib; { description = "The Swift Programming Language"; homepage = "https://github.com/apple/swift"; diff --git a/pkgs/development/libraries/libftdi/default.nix b/pkgs/development/libraries/libftdi/default.nix index 36f4a04c9df6..f0d05c0b263f 100644 --- a/pkgs/development/libraries/libftdi/default.nix +++ b/pkgs/development/libraries/libftdi/default.nix @@ -12,6 +12,9 @@ stdenv.mkDerivation rec { propagatedBuildInputs = [ libusb ]; + # Hack to avoid TMPDIR in RPATHs. + preFixup = ''rm -rf "$(pwd)" ''; + meta = { description = "A library to talk to FTDI chips using libusb"; homepage = http://www.intra2net.com/en/developer/libftdi/; diff --git a/pkgs/games/klavaro/default.nix b/pkgs/games/klavaro/default.nix index 2ca105af19d2..162543da10c4 100644 --- a/pkgs/games/klavaro/default.nix +++ b/pkgs/games/klavaro/default.nix @@ -16,6 +16,9 @@ stdenv.mkDerivation rec { --prefix LD_LIBRARY_PATH : $out/lib ''; + # Hack to avoid TMPDIR in RPATHs. + preFixup = ''rm -rf "$(pwd)" ''; + meta = { description = "Just another free touch typing tutor program"; homepage = http://klavaro.sourceforge.net/; diff --git a/pkgs/os-specific/linux/libsmbios/default.nix b/pkgs/os-specific/linux/libsmbios/default.nix index e2b675fb4ffa..eaf6d98ba9d8 100644 --- a/pkgs/os-specific/linux/libsmbios/default.nix +++ b/pkgs/os-specific/linux/libsmbios/default.nix @@ -23,6 +23,9 @@ stdenv.mkDerivation { cp -va "out/public-include/"* "$out/include/" ''; + # Hack to avoid TMPDIR in RPATHs. + preFixup = ''rm -rf "$(pwd)" ''; + meta = { homepage = "http://linux.dell.com/libsmbios/main"; description = "A library to obtain BIOS information"; diff --git a/pkgs/tools/security/ssdeep/default.nix b/pkgs/tools/security/ssdeep/default.nix index b581d8007947..0a9804a743bc 100644 --- a/pkgs/tools/security/ssdeep/default.nix +++ b/pkgs/tools/security/ssdeep/default.nix @@ -9,6 +9,9 @@ stdenv.mkDerivation rec { sha256 = "1igqy0j7jrklb8fdlrm6ald4cyl1fda5ipfl8crzyl6bax2ajk3f"; }; + # Hack to avoid TMPDIR in RPATHs. + preFixup = ''rm -rf "$(pwd)" ''; + # For some reason (probably a build system bug), the binary isn't # properly linked to $out/lib to find libfuzzy.so postFixup = stdenv.lib.optionalString (!stdenv.isDarwin) '' -- cgit 1.4.1 From f5c568446a12dbf58836925c5487e5cdad1fa578 Mon Sep 17 00:00:00 2001 From: Vladimír Čunát Date: Tue, 16 May 2017 18:11:07 +0200 Subject: qtwebkit-*: fix #25585: bad RPATH entries --- pkgs/development/libraries/qt-5/5.6/qtwebkit/default.nix | 4 ++++ pkgs/development/libraries/qt-5/5.8/qtwebkit/default.nix | 4 ++++ 2 files changed, 8 insertions(+) (limited to 'pkgs/development/libraries') diff --git a/pkgs/development/libraries/qt-5/5.6/qtwebkit/default.nix b/pkgs/development/libraries/qt-5/5.6/qtwebkit/default.nix index 915a6bcae8a8..23a45dd44ed2 100644 --- a/pkgs/development/libraries/qt-5/5.6/qtwebkit/default.nix +++ b/pkgs/development/libraries/qt-5/5.6/qtwebkit/default.nix @@ -31,5 +31,9 @@ qtSubmodule { }; in optionals flashplayerFix [ dlopen-webkit-nsplugin dlopen-webkit-gtk ] ++ [ dlopen-webkit-udev ]; + + # Hack to avoid TMPDIR in RPATHs. + preFixup = ''rm -rf "$(pwd)" && mkdir "$(pwd)" ''; + meta.maintainers = with stdenv.lib.maintainers; [ abbradar ]; } diff --git a/pkgs/development/libraries/qt-5/5.8/qtwebkit/default.nix b/pkgs/development/libraries/qt-5/5.8/qtwebkit/default.nix index 881acb442e8b..bee3786ef32e 100644 --- a/pkgs/development/libraries/qt-5/5.8/qtwebkit/default.nix +++ b/pkgs/development/libraries/qt-5/5.8/qtwebkit/default.nix @@ -39,5 +39,9 @@ qtSubmodule { in optionals flashplayerFix [ dlopen-webkit-nsplugin dlopen-webkit-gtk ] ++ optionals (!stdenv.isDarwin) [ dlopen-webkit-udev ] ++ optionals (stdenv.isDarwin) [ ./0004-icucore-darwin.patch ]; + + # Hack to avoid TMPDIR in RPATHs. + preFixup = ''rm -rf "$(pwd)" && mkdir "$(pwd)" ''; + meta.maintainers = with stdenv.lib.maintainers; [ abbradar periklis ]; } -- cgit 1.4.1 From 71a7e221d8f0def852f3a692daa3904a50523b30 Mon Sep 17 00:00:00 2001 From: Vladimír Čunát Date: Tue, 16 May 2017 16:35:52 +0200 Subject: treewide: fixup packages with RPATH problems --- pkgs/development/libraries/accounts-qt/default.nix | 3 +++ pkgs/development/libraries/libcommuni/default.nix | 3 +++ pkgs/development/libraries/libdwg/default.nix | 3 +++ 3 files changed, 9 insertions(+) (limited to 'pkgs/development/libraries') diff --git a/pkgs/development/libraries/accounts-qt/default.nix b/pkgs/development/libraries/accounts-qt/default.nix index 4f74c5fca355..a6d9a9381f9f 100644 --- a/pkgs/development/libraries/accounts-qt/default.nix +++ b/pkgs/development/libraries/accounts-qt/default.nix @@ -18,6 +18,9 @@ stdenv.mkDerivation rec { qmakeFlags="$qmakeFlags LIBDIR=$out/lib CMAKE_CONFIG_PATH=$out/lib/cmake" ''; + # Hack to avoid TMPDIR in RPATHs. + preFixup = ''rm -rf "$(pwd)" ''; + meta = with stdenv.lib; { description = "Qt library for accessing the online accounts database"; homepage = "http://code.google.com/p/accounts-sso/"; diff --git a/pkgs/development/libraries/libcommuni/default.nix b/pkgs/development/libraries/libcommuni/default.nix index 8e911a9b015f..3632fff43bde 100644 --- a/pkgs/development/libraries/libcommuni/default.nix +++ b/pkgs/development/libraries/libcommuni/default.nix @@ -25,6 +25,9 @@ stdenv.mkDerivation rec { doCheck = true; + # Hack to avoid TMPDIR in RPATHs. + preFixup = ''rm -rf "$(pwd)" ''; + meta = with stdenv.lib; { description = "A cross-platform IRC framework written with Qt"; homepage = https://communi.github.io; diff --git a/pkgs/development/libraries/libdwg/default.nix b/pkgs/development/libraries/libdwg/default.nix index 2a2dfbb0be53..5ee92b463857 100644 --- a/pkgs/development/libraries/libdwg/default.nix +++ b/pkgs/development/libraries/libdwg/default.nix @@ -12,6 +12,9 @@ stdenv.mkDerivation { hardeningDisable = [ "format" ]; + # Hack to avoid TMPDIR in RPATHs. + preFixup = ''rm -rf "$(pwd)" ''; + meta = { description = "Library reading dwg files"; homepage = http://libdwg.sourceforge.net/en/; -- cgit 1.4.1 From a19cf228d5032ad9aaaa722ef1aa82abc4814da5 Mon Sep 17 00:00:00 2001 From: John Ericson Date: Wed, 17 May 2017 19:30:19 -0400 Subject: ncurses: Break hash to simplify derivation --- pkgs/development/libraries/ncurses/default.nix | 3 --- 1 file changed, 3 deletions(-) (limited to 'pkgs/development/libraries') diff --git a/pkgs/development/libraries/ncurses/default.nix b/pkgs/development/libraries/ncurses/default.nix index 9e7f2eef46bf..46283e371aa9 100644 --- a/pkgs/development/libraries/ncurses/default.nix +++ b/pkgs/development/libraries/ncurses/default.nix @@ -65,9 +65,6 @@ stdenv.mkDerivation rec { sed -i -e 's,LIB_SUFFIX="t,LIB_SUFFIX=",' configure ''; - # Here only for native hash, remove on next mass rebuild - selfNativeBuildInput = buildPlatform == hostPlatform; - enableParallelBuilding = true; doCheck = false; -- cgit 1.4.1