Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[staging-20.09] libass: 0.14.0 -> 0.15.0 #105597

Merged
merged 1 commit into from Dec 8, 2020
Merged

[staging-20.09] libass: 0.14.0 -> 0.15.0 #105597

merged 1 commit into from Dec 8, 2020

Conversation

mweinelt
Copy link
Member

@mweinelt mweinelt commented Dec 1, 2020

Motivation for this change

Fix CVE-2020-26682 on 20.09. Unfortunately the version of libass in stable is 3y old and the patch has multiple failing hunks, so I think its the better choice to backport 0.15.0. https://github.com/libass/libass/releases/tag/0.15.0

Harfbuzz is now being required unconditionally as per
https://github.com/libass/libass/releases/tag/0.15.0

Fixes: CVE-2020-26682
(cherry picked from commit 8b8130f26ad043ac9721b3fafab500ce8bb39d06)

Closes: #102801

Things done
  • Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS linux)
  • Built on platform(s)
    • NixOS
    • macOS
    • other Linux distributions
  • Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
  • Tested compilation of all pkgs that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review wip"
  • Tested execution of all binary files (usually in ./result/bin/)
  • Determined the impact on package closure size (by running nix path-info -S before and after)
  • Ensured that relevant documentation is up to date
  • Fits CONTRIBUTING.md.

@mweinelt
libass: 0.14.0 -> 0.15.0
88fa661 
Harfbuzz is now being required unconditionally as per
https://github.com/libass/libass/releases/tag/0.15.0

Fixes: CVE-2020-26682
(cherry picked from commit 8b8130f)

Closes: NixOS#102801
@FRidh
Copy link
Member

FRidh commented Dec 2, 2020 •
edited

@mweinelt I notice you're quite active with backports to 20.09, which is great! I strongly recommend merging these in batches, and leaving several days in between. Hydra tracks this branch and will do rebuilds about daily. I created a staging stable project for this purpose.

@mweinelt
Copy link
Member Author

mweinelt commented Dec 2, 2020

Duly noted. Thanks for the guidance.

@mweinelt mweinelt added this to Ready in Staging (stable) Dec 2, 2020
@mweinelt mweinelt merged commit 5969999 into NixOS:staging-20.09 Dec 8, 2020
Staging (stable) automation moved this from Ready to Done Dec 8, 2020
@mweinelt mweinelt deleted the 20.09/libass branch December 8, 2020 16:53
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@lukegb lukegb lukegb approved these changes

@codyopel codyopel Awaiting requested review from codyopel

Assignees
No one assigned
Labels
1.severity: security 10.rebuild-darwin: 101-500 10.rebuild-linux: 501-1000 10.rebuild-linux: 501+
Projects
Staging (stable)
  
Done
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
3 participants
@mweinelt @FRidh @lukegb