osm-gps-map: patch libsoup 2.4 → 3.0 by trespaul · Pull Request #429473 · NixOS/nixpkgs

trespaul · 2025-07-29T22:00:34Z

libsoup-2.4 is EOL and vulnerable (#427813), yet some packages still depend on it (#360897). osm-gps-map is one, but although libsoup-3.0 is used in its dev branch, the project's development has slowed (the last update being in 2021), so we can't expect a release soon.

Until then, this change follows the lead of Debian, which has patched-in support for libsoup-3.0 from upstream. (Thanks to @yapxuan for pointing this out.)

I used the two patches from the Debian repo, but removed the part of the one patch which patches the CI config in the .github folder, which is not included in the tarball release from which nix builds.

I also added a patch to change the configure file. I just manually replaced the occurrences of libsoup-2.4 and SOUP24 with libsoup-3.0 and SOUP30 respectively. I'm not well versed in autoconf or building C projects in general, so this is maybe a kludge, but it seems to work. I'd appreciate if someone more experienced / knowledgable could let me know if there's a more appropriate way to do this.

I built darktable against this version, and the map widget works.

Closes #429268.
Contributes to progress of #360897.

Things done

Add a 👍 reaction to pull requests you find important.

trespaul · 2025-07-29T22:20:56Z

`nixpkgs-review` result

Generated using nixpkgs-review.

Command: nixpkgs-review pr 429473
Commit: b3637bbb29caf2f32cba140e8bd5b09ef27106e6

`x86_64-linux`

⏩ 1 package marked as broken and skipped:

ansel

✅ 7 packages built:

darktable
gramps
gramps.dist
osm-gps-map
osm-gps-map.dev
osm-gps-map.doc
photoprism

LordGrimmauld · 2025-07-30T06:53:22Z

can't we do the following to exclude .github:

(fetchpatch2 {
  url = "...";
  hash = "...";
  excludes = [ ".github/*" ];
})

Then we wouldn't need to vendor these patches, assuming the rest merges cleanly.

LordGrimmauld · 2025-07-30T06:56:09Z

That said we can't fetch entire unmerged PRs. Fetching patches from debian is fine if the url is stable (pinned to a commit digest as well as a sha hash in nix). Fetching patches from github pull requests that are not yet merged, you need to fetch the actual commits, and even those sometimes get garbage-collected.

trespaul · 2025-07-30T10:16:17Z

I changed it to fetch the patches out of the Debian repo's 1.2.0-4 release tag. Should it instead reference by the commit hash? I.e., https://salsa.debian.org/debian-gis-team/osm-gps-map/-/raw/d2224755698c9f57c18273601fe6239a0d290684/debian/patches/0001-Drop-support-for-libsoup-older-than-2.42.patch?

d2224 is where they added the patch (this was two years ago and is merged into their master and 1.2.0-4, so no risk of getting garbage-collected hopefully — I'm not sure what unmerged PRs you were referring to).

LordGrimmauld · 2025-07-30T10:17:59Z

Debian tags tend to be stable, this is fine

LordGrimmauld · 2025-07-30T10:18:58Z

An issue i have now spotted:

darktable> Package libsoup-3.0 was not found in the pkg-config search path.
darktable> Perhaps you should add the directory containing `libsoup-3.0.pc'
darktable> to the PKG_CONFIG_PATH environment variable

This suggests the patch to the package config file doesn't actually do anything, this is problematic as it means pkg-config things break

LordGrimmauld · 2025-07-30T10:19:03Z

`nixpkgs-review` result

Generated using nixpkgs-review.

Command: nixpkgs-review pr 429473
Commit: 530c9a4d4c7d8f0b3535ce9a8a3cc8d0044914cd

`x86_64-linux`

⏩ 1 package marked as broken and skipped:

ansel

✅ 7 packages built:

darktable
gramps
gramps.dist
osm-gps-map
osm-gps-map.dev
osm-gps-map.doc
photoprism

LordGrimmauld · 2025-07-30T10:19:32Z

(darktable builds, but disables osm-gps-maps support, which is not what we want)

LordGrimmauld · 2025-07-30T10:20:39Z

Though i am a little confused as to why this is happening:

$ cat /nix/store/n6r94zlh00s40yys0kqbw2jbm77sl9yd-osm-gps-map-1.2.0-dev/lib/pkgconfig/osmgpsmap-1.0.pc
prefix=/nix/store/88inpapcg7r22m87br6s8l4mfdi575hk-osm-gps-map-1.2.0
exec_prefix=${prefix}
libdir=/nix/store/88inpapcg7r22m87br6s8l4mfdi575hk-osm-gps-map-1.2.0/lib
includedir=/nix/store/n6r94zlh00s40yys0kqbw2jbm77sl9yd-osm-gps-map-1.2.0-dev/include

Name: osm-gps-map
Description: Moving map widget using openstreet map data
Version: 1.2.0
Requires: gtk+-3.0
Requires.private: libsoup-3.0
Libs: -L${libdir} -losmgpsmap-1.0
Cflags: -I${includedir}/osmgpsmap-1.0

it should be fine....

LordGrimmauld · 2025-07-30T10:29:01Z

Of course this issue can be bypassed by just supplying libsoup as propagatedBuildInput, but that is a bit of a cheat:

diff --git a/pkgs/by-name/os/osm-gps-map/package.nix b/pkgs/by-name/os/osm-gps-map/package.nix
index ac31cbf184fb..3f6c429655c7 100644
--- a/pkgs/by-name/os/osm-gps-map/package.nix
+++ b/pkgs/by-name/os/osm-gps-map/package.nix
@@ -36,11 +36,6 @@ stdenv.mkDerivation (finalAttrs: {
     })
     # 3. fix autoconf checks
     ./port-configure-to-libsoup3.patch
-
-    # libsoup is only used internally
-    # it should only be listed as private requirement
-    # https://github.com/nzjrs/osm-gps-map/pull/108
-    ./dont-require-libsoup.patch
   ];
 
   outputs = [
@@ -58,11 +53,11 @@ stdenv.mkDerivation (finalAttrs: {
   buildInputs = [
     cairo
     glib
-    libsoup_3
   ];
 
   propagatedBuildInputs = [
     gtk3
+    libsoup_3
   ];
 
   meta = {

You might want to look into what darktable is doing though.

LordGrimmauld · 2025-07-30T10:31:39Z

Actually, scratch that, it seems darktable is doing weird stuff:tm: and osm-gps-maps support gets enabled despite those log messages. Oh well, fine by me! I guess you don't have to do anything then. I'll do one last build and run it, then you get my approve.

trespaul · 2025-07-30T10:32:26Z

When I build darktable it includes map support:

nix-build ./nixpkgs -A darktable

...
Successfully managed to find version 5.2.0 in the output of the command /nix/store/hhj4cci8q6z97425qdcvf4xzpi1x9cm7-darktable-5.2.0/bin/darktable --version
darktable 5.2.0
Copyright (C) 2012-2025 Johannes Hanika and other contributors.

Compile options:
  Bit depth              -> 64 bit
  Debug                  -> DISABLED
  SSE2 optimizations     -> ENABLED
  OpenMP                 -> ENABLED
  OpenCL                 -> ENABLED
  Lua                    -> ENABLED  - API version 9.5.0
  Colord                 -> ENABLED
  gPhoto2                -> ENABLED
  OSMGpsMap              -> ENABLED  - map view is available
  GMIC                   -> ENABLED  - Compressed LUTs are supported
  GraphicsMagick         -> ENABLED
  ImageMagick            -> DISABLED
  libavif                -> DISABLED
  libheif                -> ENABLED
  libjxl                 -> ENABLED
  LibRaw                 -> ENABLED  - Version 0.22.0-Devel202502
  OpenJPEG               -> ENABLED
  OpenEXR                -> ENABLED
  WebP                   -> ENABLED

and in the built darktable the map tab is visible and functional.

trespaul · 2025-07-30T10:38:01Z

Yeah in the darktable build log it does say

Package libsoup-3.0 was not found in the pkg-config search path.
Perhaps you should add the directory containing `libsoup-3.0.pc'
to the PKG_CONFIG_PATH environment variable
Package 'libsoup-3.0', required by 'osmgpsmap-1.0', not found
Package libsoup-3.0 was not found in the pkg-config search path.
Perhaps you should add the directory containing `libsoup-3.0.pc'
to the PKG_CONFIG_PATH environment variable
Package 'libsoup-3.0', required by 'osmgpsmap-1.0', not found
Package libsoup-3.0 was not found in the pkg-config search path.
Perhaps you should add the directory containing `libsoup-3.0.pc'
to the PKG_CONFIG_PATH environment variable
Package 'libsoup-3.0', required by 'osmgpsmap-1.0', not found
Package libsoup-3.0 was not found in the pkg-config search path.
Perhaps you should add the directory containing `libsoup-3.0.pc'
to the PKG_CONFIG_PATH environment variable
Package 'libsoup-3.0', required by 'osmgpsmap-1.0', not found

at first, but further down it says

-- The following OPTIONAL packages have been found:
...
 * OSMGpsMap
...

and ends with the success message in my previous comment. Not sure what's going on there.

LordGrimmauld · 2025-07-30T10:44:23Z

the map is there and works, so i guess mission successful.

trespaul · 2025-07-30T10:45:06Z

I rebuilt the current darktable and it also doesn't find the old libsoup:

...
Package libsoup-2.4 was not found in the pkg-config search path.
Perhaps you should add the directory containing `libsoup-2.4.pc'
to the PKG_CONFIG_PATH environment variable
Package 'libsoup-2.4', required by 'osmgpsmap-1.0', not found
Package libsoup-2.4 was not found in the pkg-config search path.
Perhaps you should add the directory containing `libsoup-2.4.pc'
to the PKG_CONFIG_PATH environment variable
Package 'libsoup-2.4', required by 'osmgpsmap-1.0', not found
Package libsoup-2.4 was not found in the pkg-config search path.
Perhaps you should add the directory containing `libsoup-2.4.pc'
to the PKG_CONFIG_PATH environment variable
Package 'libsoup-2.4', required by 'osmgpsmap-1.0', not found
Package libsoup-2.4 was not found in the pkg-config search path.
Perhaps you should add the directory containing `libsoup-2.4.pc'
to the PKG_CONFIG_PATH environment variable
Package 'libsoup-2.4', required by 'osmgpsmap-1.0', not found
...

LordGrimmauld · 2025-07-30T10:46:31Z

As long as #402543 doesn't reoccur (which it doesn't) this should be fine then.

Mic92 · 2025-07-30T15:26:45Z

pkgs/by-name/os/osm-gps-map/package.nix

+    })
+    # 2. port-to-libsoup3.patch
+    (fetchpatch2 {
+      url = "https://salsa.debian.org/debian-gis-team/osm-gps-map/-/raw/debian/1.2.0-4/debian/patches/0001-Port-to-libsoup3.patch";


Btw. those patches are also upstream: https://github.com/nzjrs/osm-gps-map/commits/master/

We were considering tracking their main branch or picking a more recent commit than the release, but then stability would have to be independently checked. We could pull the commit(s) directly, but they can't be applied as a patch on the 1.2.0 release, since the files have changed in the interim. They'd have to be rebased and merged (probably by hand), which is what I assume the Debian people did to construct their patches. Unless I'm misunderstanding what you mean (or missing something).

@Mic92 do you have any advice or recommendations that I/we should look at before resolving? If there's a better way to do this, please do let me know 🙏

denisfalqueto · 2025-08-04T10:51:27Z

This PR is very important for other packages as well. Hope this gets merged as quickly as possible. Upstream is seeking for a new maintainer, so maybe it's a waste of time to wait for a new release.

trespaul · 2025-08-07T10:41:59Z

Should we still wait for @hrdinka and @Mic92 's reviews?

phaer · 2025-08-09T22:52:01Z

Merging this, because it seems to build & run fine and security impact for other packages might be non-negligible.

Patch source can be changed later if needed, but salsa.debian.org seems good enough to me. Especially if they are already upstreamed and so expected to be gone by next release.

wait until NixOS/nixpkgs#429473 reach unstable

nix-owners bot requested a review from hrdinka July 29, 2025 22:07

nixpkgs-ci bot added 10.rebuild-linux: 1-10 This PR causes between 1 and 10 packages to rebuild on Linux. 10.rebuild-darwin: 1-10 This PR causes between 1 and 10 packages to rebuild on Darwin. labels Jul 29, 2025

osm-gps-map: patch out libsoup 2

530c9a4

trespaul force-pushed the osm-gps-map-patch branch from b3637bb to 530c9a4 Compare July 30, 2025 09:57

trespaul mentioned this pull request Jul 30, 2025

Dependency of osm-gps-map is EOL with several CVEs darktable-org/darktable#19142

Closed

LordGrimmauld approved these changes Jul 30, 2025

View reviewed changes

nixpkgs-ci bot added the 12.approvals: 1 This PR was reviewed and approved by one person. label Jul 30, 2025

Mic92 reviewed Jul 30, 2025

View reviewed changes

AntonLydike approved these changes Aug 7, 2025

View reviewed changes

nixpkgs-ci bot added 12.approvals: 2 This PR was reviewed and approved by two persons. and removed 12.approvals: 1 This PR was reviewed and approved by one person. labels Aug 7, 2025

mBornand mentioned this pull request Aug 8, 2025

ansel: fix compilation, remove libsoup_2_4 and make improvements #432089

Merged

13 tasks

trespaul added the 1.severity: security Issues which raise a security issue, or PRs that fix one label Aug 9, 2025

phaer merged commit 1eab18d into NixOS:master Aug 9, 2025
29 of 30 checks passed

eclairevoyant mentioned this pull request Aug 10, 2025

cinny-desktop: use old libsoup2 #431935

Open

3 tasks

cafkafk mentioned this pull request Aug 10, 2025

osm-gps-map: 1.2.0 -> unstable-2025-04-17 #432585

Closed

13 tasks

iamanaws added a commit to iamanaws/dotfiles that referenced this pull request Aug 12, 2025

home(iamanaws): temporaly uninstall gramps

5583e71

wait until NixOS/nixpkgs#429473 reach unstable

Uh oh!

Conversation

trespaul commented Jul 29, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Things done

Uh oh!

trespaul commented Jul 29, 2025

nixpkgs-review result

x86_64-linux

Uh oh!

LordGrimmauld commented Jul 30, 2025

Uh oh!

LordGrimmauld commented Jul 30, 2025

Uh oh!

trespaul commented Jul 30, 2025

Uh oh!

LordGrimmauld commented Jul 30, 2025

Uh oh!

LordGrimmauld commented Jul 30, 2025

Uh oh!

LordGrimmauld commented Jul 30, 2025

nixpkgs-review result

x86_64-linux

Uh oh!

LordGrimmauld commented Jul 30, 2025

Uh oh!

LordGrimmauld commented Jul 30, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

LordGrimmauld commented Jul 30, 2025

Uh oh!

LordGrimmauld commented Jul 30, 2025

Uh oh!

trespaul commented Jul 30, 2025

Uh oh!

trespaul commented Jul 30, 2025

Uh oh!

LordGrimmauld commented Jul 30, 2025

Uh oh!

trespaul commented Jul 30, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

LordGrimmauld commented Jul 30, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Mic92 Jul 30, 2025

Choose a reason for hiding this comment

Uh oh!

trespaul Jul 30, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

trespaul Aug 1, 2025

Choose a reason for hiding this comment

Uh oh!

denisfalqueto commented Aug 4, 2025

Uh oh!

trespaul commented Aug 7, 2025

Uh oh!

phaer commented Aug 9, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

trespaul commented Jul 29, 2025 •

edited

Loading

`nixpkgs-review` result

`x86_64-linux`

`nixpkgs-review` result

`x86_64-linux`

LordGrimmauld commented Jul 30, 2025 •

edited

Loading

trespaul commented Jul 30, 2025 •

edited

Loading

LordGrimmauld commented Jul 30, 2025 •

edited

Loading

trespaul Jul 30, 2025 •

edited

Loading