Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

imagemagick6: 6.9.10-68 -> 6.9.10-69, imagemagick7: 7.0.8-68 -> 7.0.9-0 #72098

Merged
merged 2 commits into from Nov 1, 2019
Merged

imagemagick6: 6.9.10-68 -> 6.9.10-69, imagemagick7: 7.0.8-68 -> 7.0.9-0 #72098

merged 2 commits into from Nov 1, 2019

Conversation

risicle
Copy link
Contributor

@risicle risicle commented Oct 27, 2019

Motivation for this change

As noted by @pacien in #71099 (comment), that security bump resulted in some breakages as a side effect. We should probably fix that.

This was because the reverse dependencies of imagemagick are unfortunately huge and I had little chance of building them all.

Things done
  • Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS)
  • Built on platform(s)
    • NixOS
    • macOS
    • other Linux distributions
  • Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
  • Tested compilation of all pkgs that depend on this change using nix-shell -p nix-review --run "nix-review wip"
  • Tested execution of all binary files (usually in ./result/bin/)
  • Determined the impact on package closure size (by running nix path-info -S before and after)
  • Ensured that relevant documentation is up to date
  • Fits CONTRIBUTING.md.
Notify maintainers

cc @

@pacien
Copy link
Contributor

pacien commented Oct 27, 2019

You were quicker than me :)

@ofborg build imagemagick
@ofborg build imagemagick7

Let's also test one of the package the previous update broke:

@ofborg build gscan2pdf

@ofborg ofborg bot requested a review from the-kenny October 27, 2019 16:10
@flokli
Copy link
Contributor

flokli commented Nov 1, 2019

@ofborg build imagemagick
@ofborg build imagemagick7
@ofborg build gscan2pdf

@flokli
Copy link
Contributor

flokli commented Nov 1, 2019

@risicle gscan2pdf still seems to fail for me:

Test Summary Report
-------------------
t/1111_save_pdf.t                           (Wstat: 512 Tests: 9 Failed: 2)
  Failed tests:  5-6
  Non-zero exit status: 2
t/232_analyse_dark.t                        (Wstat: 256 Tests: 2 Failed: 1)
  Failed test:  1
  Non-zero exit status: 1
t/357_unpaper_rtl.t                         (Wstat: 256 Tests: 3 Failed: 1)
  Failed test:  3
  Non-zero exit status: 1
t/52_process_chain_udt.t                    (Wstat: 256 Tests: 1 Failed: 1)
  Failed test:  1
  Non-zero exit status: 1
Files=231, Tests=1083, 371 wallclock secs ( 1.45 usr  0.40 sys + 180.61 cusr 79.91 csys = 262.37 CPU)
Result: FAIL
Failed 4/231 test programs. 5/1083 subtests failed.

@pacien
Copy link
Contributor

pacien commented Nov 1, 2019

Apparently ImageMagick 6.9.10-69 and 7.0.9-0 do not solve all the regressions introduced before. Maybe should we wait a bit more for the next releases?

@flokli
Copy link
Contributor

flokli commented Nov 1, 2019

Hm, I think this PR doesn't worsen the situation, gscan2pdf was already broken before, but it hopefully fixes some CVEs in between. WDYT?

This might also need backporting to 19.09.

@flokli flokli merged commit 9ebe621 into NixOS:master Nov 1, 2019
@flokli flokli mentioned this pull request Nov 1, 2019
Merged
10 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@the-kenny the-kenny Awaiting requested review from the-kenny

Assignees
No one assigned
Labels
1.severity: security 10.rebuild-darwin: 101-500 10.rebuild-linux: 101-500
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
4 participants
@risicle @pacien @flokli @veprbl