From 7f666309eec3f69eacb338e015b8f1daa7cb9586 Mon Sep 17 00:00:00 2001 From: Robert Hensing Date: Thu, 1 Feb 2024 15:14:36 +0100 Subject: [PATCH 1/3] nix/boehmgc-nix: add patch for nix 2.20 --- pkgs/tools/package-management/nix/default.nix | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) diff --git a/pkgs/tools/package-management/nix/default.nix b/pkgs/tools/package-management/nix/default.nix index b72bc3c1d8aa5..0c6ffb953e204 100644 --- a/pkgs/tools/package-management/nix/default.nix +++ b/pkgs/tools/package-management/nix/default.nix @@ -17,8 +17,19 @@ let boehmgc-nix_2_3 = boehmgc.override { enableLargeConfig = true; }; boehmgc-nix = boehmgc-nix_2_3.overrideAttrs (drv: { - # Part of the GC solution in https://github.com/NixOS/nix/pull/4944 - patches = (drv.patches or [ ]) ++ [ ./patches/boehmgc-coroutine-sp-fallback.patch ]; + patches = (drv.patches or [ ]) ++ [ + # Part of the GC solution in https://github.com/NixOS/nix/pull/4944 + ./patches/boehmgc-coroutine-sp-fallback.patch + + # Required since 2.20, and has always been a valid change + # Awaiting 8.2 patch release of https://github.com/ivmai/bdwgc/commit/d1d4194c010bff2dc9237223319792cae834501c + # or master release of https://github.com/ivmai/bdwgc/commit/86b3bf0c95b66f718c3cb3d35fd7387736c2a4d7 + (fetchpatch { + name = "boehmgc-traceable_allocator-public.diff"; + url = "https://github.com/NixOS/nix/raw/2.20.0/dep-patches/boehmgc-traceable_allocator-public.diff"; + hash = "sha256-FLsHY/JS46neiSyyQkVpbHZEFvWSCzWrFQu1CC71sh4="; + }) + ]; }); # old nix fails to build with newer aws-sdk-cpp and the patch doesn't apply From 56bf13f5f1484d6d79a67e77e2b1c7860174aacc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= Date: Wed, 31 Jan 2024 13:42:10 +0100 Subject: [PATCH 2/3] nixVersions.nix_2_20: init at 2.20.5 Changelog: https://github.com/NixOS/nix/blob/2.20.5/doc/manual/src/release-notes/rl-2.20.md --- pkgs/tools/package-management/nix/common.nix | 12 ++++-------- pkgs/tools/package-management/nix/default.nix | 5 +++++ 2 files changed, 9 insertions(+), 8 deletions(-) diff --git a/pkgs/tools/package-management/nix/common.nix b/pkgs/tools/package-management/nix/common.nix index 77a6bca3e9fb4..ead04407001f4 100644 --- a/pkgs/tools/package-management/nix/common.nix +++ b/pkgs/tools/package-management/nix/common.nix @@ -15,14 +15,8 @@ let atLeast210 = lib.versionAtLeast version "2.10pre"; atLeast213 = lib.versionAtLeast version "2.13pre"; atLeast214 = lib.versionAtLeast version "2.14pre"; + atLeast220 = lib.versionAtLeast version "2.20pre"; atLeast221 = lib.versionAtLeast version "2.21pre"; - # Major.minor versions unaffected by CVE-2024-27297 - unaffectedByFodSandboxEscape = [ - "2.3" - "2.18" - "2.19" - "2.20" - ]; in { stdenv , autoconf-archive @@ -48,6 +42,7 @@ in , lib , libarchive , libcpuid +, libgit2 , libsodium , libxml2 , libxslt @@ -126,6 +121,8 @@ self = stdenv.mkDerivation { gtest libarchive lowdown + ] ++ lib.optionals atLeast220 [ + libgit2 ] ++ lib.optionals stdenv.isDarwin [ Security ] ++ lib.optionals (stdenv.isx86_64) [ @@ -257,7 +254,6 @@ self = stdenv.mkDerivation { platforms = platforms.unix; outputsToInstall = [ "out" ] ++ optional enableDocumentation "man"; mainProgram = "nix"; - knownVulnerabilities = lib.optional (!builtins.elem (lib.versions.majorMinor version) unaffectedByFodSandboxEscape && !atLeast221) "CVE-2024-27297"; }; }; in self diff --git a/pkgs/tools/package-management/nix/default.nix b/pkgs/tools/package-management/nix/default.nix index 0c6ffb953e204..c59eb400b03b3 100644 --- a/pkgs/tools/package-management/nix/default.nix +++ b/pkgs/tools/package-management/nix/default.nix @@ -258,6 +258,11 @@ in lib.makeExtensible (self: ({ ]; }; + nix_2_20 = common { + version = "2.20.5"; + hash = "sha256-bfFe38BkoQws7om4gBtBWoNTLkt9piMXdLLoHYl+vBQ="; + }; + # The minimum Nix version supported by Nixpkgs # Note that some functionality *might* have been backported into this Nix version, # making this package an inaccurate representation of what features are available From 96974aceab6e5019942710dd5d1fdf0455066bc5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= Date: Wed, 31 Jan 2024 13:42:30 +0100 Subject: [PATCH 3/3] nixVersions.unstable: 2.19 -> 2.20 --- pkgs/tools/package-management/nix/default.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkgs/tools/package-management/nix/default.nix b/pkgs/tools/package-management/nix/default.nix index c59eb400b03b3..92c988ea5d087 100644 --- a/pkgs/tools/package-management/nix/default.nix +++ b/pkgs/tools/package-management/nix/default.nix @@ -282,7 +282,7 @@ in lib.makeExtensible (self: ({ stable = addFallbackPathsCheck self.nix_2_18; - unstable = self.nix_2_19; + unstable = self.nix_2_20; } // lib.optionalAttrs config.allowAliases { nix_2_4 = throw "nixVersions.nix_2_4 has been removed";