libwebp: 1.3.0 -> 1.3.1

[ajs124]

Description of changes

https://github.com/webmproject/libwebp/releases/tag/v1.3.1

shouldn't be security relevant, because we already fixed the CVE with the patch that's dropped now

Things done

• Built on platform(s)
  • x86_64-linux
  • aarch64-linux
  • x86_64-darwin
  • aarch64-darwin
• For non-Linux: Is sandbox = true set in nix.conf? (See Nix manual)
• Tested, as applicable:
  • NixOS test(s) (look inside nixos/tests)
  • and/or package tests
  • or, for functions and "core" functionality, tests in lib/tests or pkgs/test
  • made sure NixOS tests are linked to the relevant packages
• Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
• Tested basic functionality of all binary files (usually in ./result/bin/)
• 23.11 Release Notes (or backporting 23.05 Release notes)
  • (Package updates) Added a release notes entry if the change is major or breaking
  • (Module updates) Added a release notes entry if the change is significant
  • (Module addition) Added a release notes entry if adding a new NixOS module
• Fits CONTRIBUTING.md.

[github-actions]

Successfully created backport PR for staging-23.05:

• [Backport staging-23.05] libwebp: 1.3.0 -> 1.3.1 #241036

[vcunat]

Build of chafa was broken by this, apparently. Also on 23.05. /cc maintainer: @mogorman

[vcunat]

Same with swayimg. /cc maintainer: @MatthewCroughan

[ajs124]

oops. both fail to link, because they can't find (different) symbols. I'll see if I can find anything.

[ajs124]

my pkg-config isn't very good, but there's some differences between 1.3.0 and 1.3.1 in the *.pc files webmproject/libwebp@31c28db

seems link application bugs, see e.g. artemsen/swayimg@bd3d6c8

edit: and here https://github.com/hpjansson/chafa/blob/a98c086b7b577a4870ca964b566b4ba563ef55ae/configure.ac#L153 needs patching. should probably report upstream

[vcunat]

Changing which libs get linked (by .pc) sounds slightly risky for stable backport, but maybe it will be fine to fix up the individual packages 🤔 (often just NIX_CFLAGS_COMPILE = "-lwebp"; I expect)

[ajs124]

My main motivation for the backport was the (potential) security fix. Plus, I assumed they won't have any breaking changes, since this is a patch release. But this change does indeed sound kind of risky.

[vcunat]

I agree it's surprising, given that the release notes explicitly call it "binary compatible release".

Upstream ticket for that CVE still isn't public: https://bugs.chromium.org/p/webp/issues/detail?id=603

So on 23.05 (c05ddc6) I reverted just the .pc change. For nixpkgs master we should probably fix the individual packages instead.

[ajs124]

alright. thanks for taking care of this!