!NBBFPbiuttRgTqbrcY:nixos.org

NixOS Security Discussions

371 Members
Discussions around Security | Triaging happens in #security:nixos.org126 Servers

Load older messages


SenderMessageTime
2 Aug 2022
@hexa:lossy.networkhexaI'm so annoyed by that childish behavior21:14:44
@pennae:matrix.eno.space@pennae:matrix.eno.space"actions of another committer"? that's very conrete and actionable21:17:38
@winterqt:nixos.devWinter (she/her)
In reply to @hexa:lossy.network
I'm so annoyed by that childish behavior
they're still working on go stuff as of now, so maybe whatever it was got ironed out? 🤷‍♀️
21:24:29
@hexa:lossy.networkhexayeah, but at the cost of security in the stable release21:25:25
@hexa:lossy.networkhexaI have strong opinions on the matter21:25:32
@winterqt:nixos.devWinter (she/her)
In reply to @hexa:lossy.network
yeah, but at the cost of security in the stable release
wasn't it not gonna make it into stable because of the time till branch off anyways? or are you saying that bc it was also never finished so it could be backported
21:28:29
@hexa:lossy.networkhexait didn't happen because the person felt offended21:28:51
@hexa:lossy.networkhexathere was enough time21:29:11
@hexa:lossy.networkhexaanyway, have to sleep 💤21:29:35
@sandro:supersandro.deSandro 🐧minimal requirements for the go bump: https://github.com/NixOS/nixpkgs/pull/176661 https://github.com/NixOS/nixpkgs/pull/179622 I don't know if darwin requires some extra commits for the apple sdk 11.0 to properly compile but I would assume yes. Also we need to update/patch/fix probably an unknown number of golang.org/x/sys dependencies otherwise aarch64-darwin will break for some packages. I would assume the number is between 30 and 50 but I don't know.23:03:05
@sandro:supersandro.deSandro 🐧or we just ping all those packages to go 1.17 which kinda defeats the purpose. Also there are an unknown number of security fixes in golang.org/x/* dependencies.23:10:56
4 Aug 2022
@ar:is-a.catar joined the room.18:29:56
@0x4a6f:matrix.org[0x4A6F] joined the room.22:02:39
5 Aug 2022
@v0id:nltrix.net@v0id:nltrix.net

lol, still buggy

[Child 54302, MediaDecoderStateMachine #1] WARNING: Decoder=7fe34c30a800 state=DECODING_METADATA Decode metadata failed, shutting down decoder: file /var/tmp/build/firefox-4332e5e8469f/dom/media/MediaDecoderStateMachine.cpp:366
[Child 54302, MediaDecoderStateMachine #1] WARNING: Decoder=7fe34c30a800 Decode error: NS_ERROR_DOM_MEDIA_METADATA_ERR (0x806e0006) - static MP4Metadata::ResultAndByteBuffer mozilla::MP4Metadata::Metadata(mozilla::ByteStream *): Cannot parse metadata: file /var/tmp/build/firefox-4332e5e8469f/dom/media/MediaDecoderStateMachine.cpp:3562
Fontconfig warning: "/nix/store/kaacqypcv9mnqnd069ksqplxwkwmpfyn-tor-browser-bundle-bin-11.5.1/share/tor-browser/TorBrowser/Data/fontconfig/fonts.conf", line 85: unknown element "blank"
[Child 54302, MediaDecoderStateMachine #1] WARNING: Decoder=7fe34e63cc00 state=DECODING_METADATA Decode metadata failed, shutting down decoder: file /var/tmp/build/firefox-4332e5e8469f/dom/media/MediaDecoderStateMachine.cpp:366
[Child 54302, MediaDecoderStateMachine #1] WARNING: Decoder=7fe34e63cc00 Decode error: NS_ERROR_DOM_MEDIA_METADATA_ERR (0x806e0006) - static MP4Metadata::ResultAndByteBuffer mozilla::MP4Metadata::Metadata(mozilla::ByteStream *): Cannot parse metadata: file /var/tmp/build/firefox-4332e5e8469f/dom/media/MediaDecoderStateMachine.cpp:3562
[Child 54302, MediaDecoderStateMachine #1] WARNING: Decoder=7fe34dff7000 state=DECODING_METADATA Decode metadata failed, shutting down decoder: file /var/tmp/build/firefox-4332e5e8469f/dom/media/MediaDecoderStateMachine.cpp:366
[Child 54302, MediaDecoderStateMachine #1] WARNING: Decoder=7fe34dff7000 Decode error: NS_ERROR_DOM_MEDIA_METADATA_ERR (0x806e0006) - static MP4Metadata::ResultAndByteBuffer mozilla::MP4Metadata::Metadata(mozilla::ByteStream *): Cannot parse metadata: file /var/tmp/build/firefox-4332e5e8469f/dom/media/MediaDecoderStateMachine.cpp:3562
[Child 54302, MediaDecoderStateMachine #1] WARNING: Decoder=7fe34dff1400 state=DECODING_METADATA Decode metadata failed, shutting down decoder: file /var/tmp/build/firefox-4332e5e8469f/dom/media/MediaDecoderStateMachine.cpp:366
[Child 54302, MediaDecoderStateMachine #1] WARNING: Decoder=7fe34dff1400 Decode error: NS_ERROR_DOM_MEDIA_METADATA_ERR (0x806e0006) - static MP4Metadata::ResultAndByteBuffer mozilla::MP4Metadata::Metadata(mozilla::ByteStream *): Cannot parse metadata: file /var/tmp/build/firefox-4332e5e8469f/dom/media/MediaDecoderStateMachine.cpp:3562
[Child 54302, MediaDecoderStateMachine #1] WARNING: Decoder=7fe34b784c00 state=DECODING_METADATA Decode metadata failed, shutting down decoder: file /var/tmp/build/firefox-4332e5e8469f/dom/media/MediaDecoderStateMachine.cpp:366
[Child 54302, MediaDecoderStateMachine #1] WARNING: Decoder=7fe34b784c00 Decode error: NS_ERROR_DOM_MEDIA_METADATA_ERR (0x806e0006) - static MP4Metadata::ResultAndByteBuffer mozilla::MP4Metadata::Metadata(mozilla::ByteStream *): Cannot parse metadata: file /var/tmp/build/firefox-4332e5e8469f/dom/media/MediaDecoderStateMachine.cpp:3562

(/nix/store/kaacqypcv9mnqnd069ksqplxwkwmpfyn-tor-browser-bundle-bin-11.5.1/share/tor-browser/firefox:60930): GLib-WARNING **: 03:28:28.065: getpwuid_r(): failed due to: Permission denied.
Fontconfig warning: "/nix/store/kaacqypcv9mnqnd069ksqplxwkwmpfyn-tor-browser-bundle-bin-11.5.1/share/tor-browser/TorBrowser/Data/fontconfig/fonts.conf", line 85: unknown element "blank"

tor-browser-bundle-bin 11.5.1, don't depend on it, ie run in a container etc.

03:44:46
@v0id:nltrix.net@v0id:nltrix.nethttps://linux.die.net/man/3/getpwuid_r03:45:00
@winterqt:nixos.devWinter (she/her)
In reply to @sandro:supersandro.de
minimal requirements for the go bump: https://github.com/NixOS/nixpkgs/pull/176661 https://github.com/NixOS/nixpkgs/pull/179622 I don't know if darwin requires some extra commits for the apple sdk 11.0 to properly compile but I would assume yes. Also we need to update/patch/fix probably an unknown number of golang.org/x/sys dependencies otherwise aarch64-darwin will break for some packages. I would assume the number is between 30 and 50 but I don't know.
I believe the x/sys breakages are on Darwin as a whole, not just aarch64.
04:17:59
@winterqt:nixos.devWinter (she/her)(Is there a reason you say it's just aarch64? I could be wrong.)04:19:30
@sandro:supersandro.deSandro 🐧
In reply to @winterqt:nixos.dev
(Is there a reason you say it's just aarch64? I could be wrong.)
I thought it was just on M1 but it might be that it is on all darwin systems. IDK and to lazy to check.
11:41:07
6 Aug 2022
@hexa:lossy.networkhexa

can someone look into updating botan2, please?

diff --git a/pkgs/development/libraries/botan/2.0.nix b/pkgs/development/libraries/botan/2.0.nix
index 113c4a27b91..6987b6c35f0 100644
--- a/pkgs/development/libraries/botan/2.0.nix
+++ b/pkgs/development/libraries/botan/2.0.nix
@@ -1,19 +1,10 @@
 { callPackage, fetchpatch, ... } @ args:
 
 callPackage ./generic.nix (args // {
-  baseVersion = "2.18";
-  revision = "1";
-  sha256 = "0adf53drhk1hlpfih0175c9081bqpclw6p2afn51cmx849ib9izq";
+  baseVersion = "2.19";
+  revision = "2";
+  sha256 = "sha256-OvXxdhXGtc2Lgy0mn7bLTVTsZPnrCd2/Gt1Qk5QbTXU=";
   postPatch = ''
     sed -e 's@lang_flags "@&--std=c++11 @' -i src/build-data/cc/{gcc,clang}.txt
   '';
-  extraPatches = [
-    (fetchpatch {
-      name = "CVE-2021-40529.patch";
-      url = "https://github.com/randombit/botan/commit/9a23e4e3bc3966340531f2ff608fa9d33b5185a2.patch";
-      sha256 = "1ax1n2l9zh0hk35vkkywgkhzpdk76xb9apz2wm3h9kjvjs9acr3y";
-      # our source tarball doesn't include the tests
-      excludes = [ "src/tests/*" ];
-    })
-  ];
 })
11:53:47
@hexa:lossy.networkhexathis is where how I started11:53:57
@hexa:lossy.networkhexa * this is where how I started, gets me this far11:54:15
@hexa:lossy.networkhexa
botan> patching sources
botan> configuring
botan>    INFO: configure.py invoked with options "--prefix=/nix/store/n3d9lywg3c2fc97prz53rwrg7i7ccmz5-botan-2.19.2 --with-bzip2 --with-zlib --with-openssl"
botan>    INFO: Configuring to build Botan 2.19.2 (revision git:a85eaffe863a401ba312be5e1403bca80e70221e)
botan>    INFO: Running under 3.10.6 (main, Aug  1 2022, 20:38:21) [GCC 11.3.0]
botan>    INFO: Implicit --ar-command=ar due to environment variable AR
botan>    INFO: Implicit --cc-bin=g++ due to environment variable CXX
botan>    INFO: Autodetected platform information: OS="Linux" machine="x86_64" proc=""
botan>    INFO: Guessing target OS is linux (use --os to set)
botan>    INFO: Guessing target processor is a x86_64 (use --cpu to set)
botan>    INFO: Auto-detected compiler version 11.3
botan>    INFO: Auto-detected compiler arch x86_64
botan>    INFO: Target is gcc:11.3-linux-x86_64
botan>    INFO: Assuming target x86_64 is little endian
botan>   ERROR: Module not found: openssl
botan> builder for '/nix/store/617qi0bb7r7kmh50qxhb3b0w2z8nsk6a-botan-2.19.2.drv' failed with exit code 1
11:54:21
@hexa:lossy.networkhexaour version is 10 months old already 😓11:55:11
@hexa:lossy.networkhexa * our version is 15 months old already 😓 patched, but still11:55:35
@v0id:nltrix.net@v0id:nltrix.nethttps://github.com/randombit/botan/blob/master/configure.py13:40:06
@v0id:nltrix.net@v0id:nltrix.netthis one doesn't have any --with-openssl flag.13:40:13
@v0id:nltrix.net@v0id:nltrix.netmaybe they removed it.13:40:17
@v0id:nltrix.net@v0id:nltrix.neton line 567 there are definitions for thirdpart13:40:28
@v0id:nltrix.net@v0id:nltrix.net * on line 567 there are definitions for thirdparty13:40:30
@v0id:nltrix.net@v0id:nltrix.net

third_party = ['boost', 'bzip2', 'lzma', 'commoncrypto', 'sqlite3', 'zlib', 'tpm']

13:40:39

Show newer messages


Back to Room ListRoom Version: 9