/rebase-staging

Actually I am not sure if this should go through staging but over 500 rebuilds when hydra has issues seems a bit much.

For security updates one could make an exception and bypass staging. However, nixpkgs-review shows ~900 rebuilds, probably making staging the right call.

I'm not sure if this fixes the vulnerabilities mentioned in #88322.

Does anyone know?

Does not fix. https://repology.org/project/hdf5/cves?version=1.12.0

Does not fix. https://repology.org/project/hdf5/cves?version=1.12.0

Maybe the maintainers can update to a version > 1.12.0 after this is merged.

There is no version > 1.12.0.

Yeah I think it's very unlikely it fixes CVE-2020-10809 - decompress.c in the 1.10 branch doesn't seem to have been given a non-trivial update since well before the CVE.

Looking more broadly, I don't think that CVE has been fixed anywhere, even in hdf master.

Marking it as insecure will impact a very high number of packages. What should we do?

I opened an upstream issue. I think we should merge this and discuss the remaining CVEs in the issue linked above.

What needs to be done to get this merged?

hdf5 builds locally fine.

Note:

hdf5: Ask if output path lib (4.3M) could be split with outputs = [ ... "lib" ];