libupnp: 1.12.0 -> 1.14.0

[ardumont]

Trying to package gerbera (upnp media server) which requires at least that
dependency version in its build recipe.

• Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS linux)
• Built on platform(s)
  • NixOS,
  • macOS
  • other: debian with nix
• Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
• Tested compilation of all pkgs that depend on this change using nixpkgs-review pr 93048 [1]
• Tested execution of all binary files (usually in ./result/bin/)
• Impact on package closure size: + 1352 (33560928 -> 33562280)
• Ensured that relevant documentation is up to date
• Fits CONTRIBUTING.md.

[1] 3 packages broke with this, last one (obs-ndi is in the same state as master, needs a license to build):

$ nix-shell -p nixpkgs-review --run "nixpkgs-review pr 93048"
...
6 package marked as broken and skipped:
libsForQt5.vlc libsForQt512.vlc libsForQt514.vlc retroshare retroshare06 ring-daemon

4 package failed to build:
amule amuleDaemon gmrender-resurrect obs-ndi

Those 3 are fixed with the following PR:

• amule, amuleDaemon: amule: 2.3.2 -> unstable-20201006 #99893
• gmrender-resurrect: gmrender-resurrect: Make build against libupnp 1.14 ok #99899

[risicle]

libupnp itself builds happily on macos 10.14 (all reverse dependencies on macos are marked broken).

[risicle]

Actually I've noticed libupnp 1.14.0 is now out, and it fixes https://nvd.nist.gov/vuln/detail/CVE-2020-13848 so it'd be useful to rebase & update this PR.

[ardumont]

Actually I've noticed libupnp 1.14.0 is now out, and it fixes https://nvd.nist.gov/vuln/detail/CVE-2020-13848 so it'd be useful to
rebase & update this PR.

thanks for the heads up, i'll check and adapt.

[timokau]

nix-review tells me that this breaks three packages that built previously: amule, amuleDaemon and gmrender-resurrect.

[ardumont]

nix-review tells me that this breaks three packages that built previously: amule, amuleDaemon and gmrender-resurrect.

Do you have some links about the proper way to deal with those package breaks?
Thanks for your time.

Cheers,

[timokau]

If you have some time to spare, you could have a look at the build log and see if there is anything obvious that needs fixing. It could also be helpful to check out the upstream bug ticker, or if there are any new releases available that might be compatible.

If you do not have the spare time right now, you can ping the maintainers of the broken packages here and give them ~a week to respond. They can then fix the issue, or if they don't respond you can mark the packages as broken.

[ardumont]

I concur:

$ nix-shell -p nixpkgs-review --run "nixpkgs-review pr 93048"
...
6 package marked as broken and skipped:
libsForQt5.vlc libsForQt512.vlc libsForQt514.vlc retroshare retroshare06 ring-daemon

4 package failed to build:
amule amuleDaemon gmrender-resurrect obs-ndi

I checked against a more recent master build which render the same results (so i updated that diff).

[ardumont]

#99893 fixes amule and amuleDaemon by bumping the version

[ardumont]

obs-ndi

That's because it requires to validate a license for the build, it does not relate to this.
(It's in the same state as the master branch)

[ardumont]

gmrender-resurrect

I looked into that one as well and a PR is already opened to fix
the build against libupnp 1.14 upstream [1]

[1] hzeller/gmrender-resurrect#214

[ardumont]

gmrender-resurrect
I looked into that one as well and a PR is already opened to fix
the build against libupnp 1.14 upstream [1]

[1] hzeller/gmrender-resurrect#214

And there we go, #99899 should fix that last one.

[ardumont]

Updated the summary with the other PR references.

[timokau]

nixpkgs-review is happy now that #99893 and #99899 are in. Thanks!

[ardumont]

\o/ Awesome \m/

Cheers,