pythonPackages311.pysha3: replace with safe-pysha3

[nevivurn]

Description of changes

• Package is abandoned and vulnerable: Affected by CVE-2022-37454 tiran/pysha3#29
• It also breaks builds due to Support Python 3.11 tiran/pysha3#30
• safe-pysha3 is a drop-in replacement
  • But the package name is different and may break builds, not sure if I should delete the alias?
  • Also, safe-pysha3 no longer supports Python < 3.9.

ZHF: #230712

Things done

• Built on platform(s)
  • x86_64-linux
  • aarch64-linux
  • x86_64-darwin
  • aarch64-darwin
• For non-Linux: Is sandbox = true set in nix.conf? (See Nix manual)
• Tested, as applicable:
  • NixOS test(s) (look inside nixos/tests)
  • and/or package tests
  • or, for functions and "core" functionality, tests in lib/tests or pkgs/test
  • made sure NixOS tests are linked to the relevant packages
• Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
• Tested basic functionality of all binary files (usually in ./result/bin/)
• 23.05 Release Notes (or backporting 22.11 Release notes)
  • (Package updates) Added a release notes entry if the change is major or breaking
  • (Module updates) Added a release notes entry if the change is significant
  • (Module addition) Added a release notes entry if adding a new NixOS module
• Fits CONTRIBUTING.md.

[nevivurn]

Right, assuming the packages would have otherwise been built successfully, this breaks builds for python < 3.9. This only affects eth-hash as far as I can tell.

[wegank]

We could also remove python3Packages.manticore (and its dependency python3Packages.wasm) from nixpkgs:

nixpkgs/pkgs/development/python-modules/wasm/default.nix

Line 11 in 5dcb4a7

disabled = pythonAtLeast "3.10"; # project is abandoned, remove we whe move to py310/311

[nevivurn]

Sure thing. For future reference, is it written out anywhere which python versions are supported for a given release of nixpkgs / when it is OK to remove non-building packages?

[wegank]

I don't think that's documented, but you can usually figure it out by looking in pkgs/top-level/all-packages.nix:

  python27Packages = python27.pkgs;
  python38Packages = python38.pkgs;
  python39Packages = python39.pkgs;
  python310Packages = recurseIntoAttrs python310.pkgs;
  python311Packages = recurseIntoAttrs python311.pkgs;
  python312Packages = python312.pkgs;

Only the package sets with recurseIntoAttrs are built and cached.

[SuperSandro2000]

• But the package name is different and may break builds, not sure if I should delete the alias?

Is the import name the same?

[nevivurn]

Is the import name the same?

Yes, both pysha3 and safe-pysha3 provide sha3 (and monkey-patch hashlib). Might still require some patching in setup.py like https://github.com/NixOS/nixpkgs/blob/5c8385332672f54002e21c5fdd477c9ee50de876/pkgs/development/python-modules/manticore/default.nix#L61

[nevivurn]

rebased due to conflicts from #232892

[wegank]

Probably just deprecate it instead, if additional postPatch is needed.

[nevivurn]

Done