Skip to content

emacs: mark version < 30 as insecure and tell users to use emacs30#386174

Merged
jian-lin merged 1 commit intoNixOS:masterfrom
linj-fork:pr/emacs30-cve
Mar 1, 2025
Merged

emacs: mark version < 30 as insecure and tell users to use emacs30#386174
jian-lin merged 1 commit intoNixOS:masterfrom
linj-fork:pr/emacs30-cve

Conversation

@jian-lin
Copy link
Contributor

@jian-lin jian-lin commented Mar 1, 2025

related: #384575

Things done

  • Built on platform(s)
    • x86_64-linux
    • aarch64-linux
    • x86_64-darwin
    • aarch64-darwin
  • For non-Linux: Is sandboxing enabled in nix.conf? (See Nix manual)
    • sandbox = relaxed
    • sandbox = true
  • Tested, as applicable:
  • Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
  • Tested basic functionality of all binary files (usually in ./result/bin/)
  • 25.05 Release Notes (or backporting 24.11 and 25.05 Release notes)
    • (Package updates) Added a release notes entry if the change is major or breaking
    • (Module updates) Added a release notes entry if the change is significant
    • (Module addition) Added a release notes entry if adding a new NixOS module
  • Fits CONTRIBUTING.md.

Add a 👍 reaction to pull requests you find important.

@github-actions github-actions bot added the 6.topic: emacs Text editor label Mar 1, 2025
@github-actions github-actions bot added 10.rebuild-darwin: 0 This PR does not cause any packages to rebuild on Darwin. 10.rebuild-linux: 0 This PR does not cause any packages to rebuild on Linux. labels Mar 1, 2025
@jian-lin jian-lin mentioned this pull request Mar 1, 2025
Closed
13 tasks
@jian-lin jian-lin added the 1.severity: security Issues which raise a security issue, or PRs that fix one label Mar 1, 2025
@jian-lin
Copy link
Contributor Author

jian-lin commented Mar 1, 2025

Currently, emacs-macport has no maintainer and probably has more CVEs since it is only 29.1 in Nixpkgs. Hopefully, some affected users of this PR will volunteer to maintain it.

@jian-lin jian-lin merged commit f4078f4 into NixOS:master Mar 1, 2025
27 of 28 checks passed
@nixpkgs-ci
Copy link
Contributor

nixpkgs-ci bot commented Mar 1, 2025

Successfully created backport PR for release-24.11:

@nixpkgs-ci nixpkgs-ci bot mentioned this pull request Mar 1, 2025
Merged
1 task
@jian-lin jian-lin deleted the pr/emacs30-cve branch March 1, 2025 22:23
@K900
Copy link
Contributor

K900 commented Mar 2, 2025

So this broke every single package that depends on the emacs alias, like xdp-tools, and probably more.

@K900
Copy link
Contributor

K900 commented Mar 2, 2025

It also made Emacs no longer get built on Hydra: https://hydra.nixos.org/eval/1812644

@jian-lin jian-lin restored the pr/emacs30-cve branch March 2, 2025 09:53
@jian-lin
Copy link
Contributor Author

jian-lin commented Mar 2, 2025 •
edited
Loading

So this broke every single package that depends on the emacs alias, like xdp-tools, and probably more.

Yes, packages having emacs, emacs-nox or emacs-gtk in their dependency closure are transitively insecure. This is not a good user experience.

Here is the list of 75 those packages (emacs and emacs lisp packages are not included below):

Details
  • aerc
  • afew
  • afew.dist
  • afew.doc
  • afew.man
  • agda
  • alot
  • alot.dist
  • astroid
  • auctex
  • auctex.tex
  • cflow
  • cscope
  • easycrypt
  • emacs-lsp-booster
  • emacspeak
  • framac
  • i3status-rust
  • idutils
  • knot-dns
  • knot-dns.bin
  • knot-dns.dev
  • knot-resolver
  • knot-resolver.dev
  • lbdb
  • lieer
  • lieer.dist
  • mozart2
  • mozart2-binary
  • mu
  • mu.mu4e
  • muchsync
  • mujmap
  • neomutt
  • notifymuch
  • notifymuch.dist
  • notmuch
  • notmuch-addrlookup
  • notmuch-mailmover
  • notmuch.bindingconfig
  • notmuch.emacs
  • notmuch.info
  • notmuch.man
  • notmuch.vim (vimPlugins.notmuch-vim ,vimPlugins.notmuch-vim.bindingconfig ,vimPlugins.notmuch-vim.emacs ,vimPlugins.notmuch-vim.info ,vimPlugins.notmuch-vim.man ,vimPlugins.notmuch-vim.vim)
  • ocamlPackages.lambdapi
  • ovn
  • prometheus-knot-exporter
  • prometheus-knot-exporter.dist
  • pycflow2dot (python312Packages.pycflow2dot)
  • pycflow2dot.dist (python312Packages.pycflow2dot.dist)
  • python312Packages.libknot
  • python312Packages.libknot.dist
  • python312Packages.notmuch
  • python312Packages.notmuch.dist
  • python312Packages.notmuch2
  • python312Packages.notmuch2.dist
  • python313Packages.libknot
  • python313Packages.libknot.dist
  • python313Packages.notmuch
  • python313Packages.notmuch.dist
  • python313Packages.notmuch2
  • python313Packages.notmuch2.dist
  • python313Packages.pycflow2dot
  • python313Packages.pycflow2dot.dist
  • rtags
  • supercollider_scel
  • trexio
  • trexio.dev
  • tuntox
  • vimPlugins.vim-agda
  • why3
  • why3.dev
  • xdp-tools
  • xdp-tools.lib

I proposed #386348 as a workaround. To avoid staging, it lets hydra not build Emacs lisp packages, which may have a smaller impact than this PR.

BTW, since hydra evaluator now runs on a more powerful hardware, are 6347 small Emacs lisp packages still considered "massive rebuilds"? CC @vcunat @Hexa

@jian-lin jian-lin mentioned this pull request Mar 2, 2025
Merged
13 tasks
@jian-lin jian-lin deleted the pr/emacs30-cve branch March 2, 2025 13:24
GaetanLepage added a commit to nix-community/nixvim that referenced this pull request Mar 3, 2025
@GaetanLepage
tests/none-ls: disable tests relying on emacs: marked as insecure
716505f 
NixOS/nixpkgs#386174
NixOS/nixpkgs#386348
tvlbot pushed a commit to wpcarro/struct.el that referenced this pull request Mar 7, 2025
@sternenseemann
chore: emacs28 -> emacs(29)
e4570cb 
Use the default emacs attribute over the versioned emacs28 attribute. On
current canon, this implies an upgrade to Emacs 29.

Emacs < 30 has some CVEs that have never been patched in those release
series. The next channel bump will upgrade pkgs.emacs to Emacs 30, so
just using the default alias seems to be the easiest solution.

See also <NixOS/nixpkgs#386174>.

Change-Id: I1580bae138cc0801e0f3431b1a02c8a4585c2996
Reviewed-on: https://cl.tvl.fyi/c/depot/+/13216
Reviewed-by: tazjin <tazjin@tvl.su>
Autosubmit: sterni <sternenseemann@systemli.org>
Tested-by: BuildkiteCI
tvlbot pushed a commit to wpcarro/cycle.el that referenced this pull request Mar 7, 2025
@sternenseemann
chore: emacs28 -> emacs(29)
a045f0c 
Use the default emacs attribute over the versioned emacs28 attribute. On
current canon, this implies an upgrade to Emacs 29.

Emacs < 30 has some CVEs that have never been patched in those release
series. The next channel bump will upgrade pkgs.emacs to Emacs 30, so
just using the default alias seems to be the easiest solution.

See also <NixOS/nixpkgs#386174>.

Change-Id: I1580bae138cc0801e0f3431b1a02c8a4585c2996
Reviewed-on: https://cl.tvl.fyi/c/depot/+/13216
Reviewed-by: tazjin <tazjin@tvl.su>
Autosubmit: sterni <sternenseemann@systemli.org>
Tested-by: BuildkiteCI
tvlbot pushed a commit to tvlfyi/tvix that referenced this pull request Mar 11, 2025
@sternenseemann
chore(3p/sources): bump channels & overlays (2025-03-07)
4e4b2ee 
* Bump Emacs 29 to 30 to address CVEs in prior versions:
  NixOS/nixpkgs#386174

* //3p/overlays/tvl:

  - Drop upstreamed fix for buildkite-agent
  - Drop tpm2-pkcs11 patch for an issue that has been
    addressed in 1.9.1.
  - Drop Nix 2.3 patch for home-manager. An alternative
    to it has been upstreamed in
    <nix-community/home-manager#5067>.

* //users/flokli/presentations: disable derivations that have
  been failing since the latest chromium upgrade (presumably).
  reveal-md … --print fails to export a PDF. Enabling debug
  output reveals that a timeout in pupeteer is hit.

Change-Id: Id83eb5e5fe2db77e648817c5c737b2f95b43deeb
Reviewed-on: https://cl.tvl.fyi/c/depot/+/13217
Autosubmit: sterni <sternenseemann@systemli.org>
Reviewed-by: sterni <sternenseemann@systemli.org>
Reviewed-by: flokli <flokli@flokli.de>
Reviewed-by: tazjin <tazjin@tvl.su>
Tested-by: BuildkiteCI
tvlbot pushed a commit to tvlfyi/kit that referenced this pull request Mar 11, 2025
@sternenseemann
chore(3p/sources): bump channels & overlays (2025-03-07)
cb28ed7 
* Bump Emacs 29 to 30 to address CVEs in prior versions:
  NixOS/nixpkgs#386174

* //3p/overlays/tvl:

  - Drop upstreamed fix for buildkite-agent
  - Drop tpm2-pkcs11 patch for an issue that has been
    addressed in 1.9.1.
  - Drop Nix 2.3 patch for home-manager. An alternative
    to it has been upstreamed in
    <nix-community/home-manager#5067>.

* //users/flokli/presentations: disable derivations that have
  been failing since the latest chromium upgrade (presumably).
  reveal-md … --print fails to export a PDF. Enabling debug
  output reveals that a timeout in pupeteer is hit.

Change-Id: Id83eb5e5fe2db77e648817c5c737b2f95b43deeb
Reviewed-on: https://cl.tvl.fyi/c/depot/+/13217
Autosubmit: sterni <sternenseemann@systemli.org>
Reviewed-by: sterni <sternenseemann@systemli.org>
Reviewed-by: flokli <flokli@flokli.de>
Reviewed-by: tazjin <tazjin@tvl.su>
Tested-by: BuildkiteCI
ratsclub added a commit to ratsclub/dotfiles that referenced this pull request Mar 14, 2025
@ratsclub
emacs: move to emacs 30
8aa1b62 
related to NixOS/nixpkgs#386174
flokli pushed a commit to flokli/slides that referenced this pull request Mar 23, 2025
@sternenseemann
chore(3p/sources): bump channels & overlays (2025-03-07)
4c790e4 
* Bump Emacs 29 to 30 to address CVEs in prior versions:
  NixOS/nixpkgs#386174

* //3p/overlays/tvl:

  - Drop upstreamed fix for buildkite-agent
  - Drop tpm2-pkcs11 patch for an issue that has been
    addressed in 1.9.1.
  - Drop Nix 2.3 patch for home-manager. An alternative
    to it has been upstreamed in
    <nix-community/home-manager#5067>.

* //users/flokli/presentations: disable derivations that have
  been failing since the latest chromium upgrade (presumably).
  reveal-md … --print fails to export a PDF. Enabling debug
  output reveals that a timeout in pupeteer is hit.

Change-Id: Id83eb5e5fe2db77e648817c5c737b2f95b43deeb
Reviewed-on: https://cl.tvl.fyi/c/depot/+/13217
Autosubmit: sterni <sternenseemann@systemli.org>
Reviewed-by: sterni <sternenseemann@systemli.org>
Reviewed-by: flokli <flokli@flokli.de>
Reviewed-by: tazjin <tazjin@tvl.su>
Tested-by: BuildkiteCI
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@matthewbauer matthewbauer Awaiting requested review from matthewbauer

@ttuegel ttuegel Awaiting requested review from ttuegel

@adisbladis adisbladis Awaiting requested review from adisbladis

1 more reviewer

@AndersonTorres AndersonTorres AndersonTorres approved these changes

Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

1.severity: security Issues which raise a security issue, or PRs that fix one 6.topic: emacs Text editor 10.rebuild-darwin: 0 This PR does not cause any packages to rebuild on Darwin. 10.rebuild-linux: 0 This PR does not cause any packages to rebuild on Linux.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@jian-lin @K900 @mayersj1 @AndersonTorres