[staging-20.09] shadow: 4.8 -> 4.8.1

[redvers]

https://nvd.nist.gov/vuln/detail/CVE-2019-19882
(cherry picked from commit 17d4902)

Motivation for this change

Addresses: #88398 - CVE-2019-19882

Things done

• Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS linux)
• Built on platform(s)
  • NixOS
  • macOS
  • other Linux distributions
• Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
• Tested compilation of all pkgs that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review wip"
• Tested execution of all binary files (usually in ./result/bin/)
• Determined the impact on package closure size (by running nix path-info -S before and after)
• Ensured that relevant documentation is up to date
• Fits CONTRIBUTING.md.

[jonringer]

this is a mass rebuild, please target staging-20.09

git rebase --onto=origin/staging-20.09 HEAD^
git push .. .. --force

then change target branch

[redvers]

git rebase --onto=origin/staging-20.09 HEAD^

[root@evil:/home/red/projects/nixpkgs]# git rebase --onto=origin/staging-20.09 HEAD^
fatal: Does not point to a valid commit 'origin/staging-20.09'

Sorry - I'm git impaired :/

[jonringer]

please do git remote -v, you probably just have upstream named differently from me

[redvers]

please do git remote -v, you probably just have upstream named differently from me

[root@evil:/home/red/projects/nixpkgs]# git remote -v
origin  git@github.com:redvers/nixpkgs (fetch)
origin  git@github.com:redvers/nixpkgs (push)
upstream        https://github.com/nixos/nixpkgs.git (fetch)
upstream        https://github.com/nixos/nixpkgs.git (push)

[jonringer]

ah, you cloned from your fork:

git rebase --onto=upstream/staging-20.09 HEAD^
git push .. .. --force

should work

[redvers]

ah, you cloned from your fork:

git rebase --onto=upstream/staging-20.09 HEAD^
git push .. .. --force

should work

Okay - I think we're good now?

Thanks for your due diligence.

[jonringer]

git history looks good now

[redvers]

@andir

[jonringer]

This likely wont get merged until the current staging-20.09 gets merged

[jonringer]

@GrahamcOfBorg eval

shouldn't have "package new"

[roberth]

@jonringer Hydra is not picking up on the new build timeout for GHC, blocking staging-20.09. A mass rebuild may be exactly what we need, so we get a new hash, therefore a new "Build" and possibly an increased timeout.

See also NixOS/hydra#830
and https://hydra.nixos.org/build/129420286