spotify: use default libgcrypt / libpng #111227
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Instead of overriding `libgcrypt` with the (insecure) `libgcrypt_1_5` and `libpng` with `libpng12`, use the defaults for those two packages. Built and checked on my NixOS desktop machine because @dotlambda said he wouldn't check proprietary software in NixOS#111215. `spotify` was changed to use `libgcrypt_1_5` instead of `libgcrypt` in commit 165cb05 by @monocell in PR NixOS#8157 to address NixOS#8156, which found that: > the current spotify client seems to depend on `libgcrypt.so.11`. > Pretending with libgcrypt.so.20 produces an error like: > ... libgcrypt.so.11: version `GCRYPT_1.2' not found ... Given that the relevant Spotify client is more than 5 years old, I don't think we have to worry about this any more. :) This commit helps NixOS#106203, but doesn't close it because `libgcrypt_1_5` is still used in `staruml`.
10 tasks
dotlambda
added
the
9.needs: port to stable
erictapen
approved these changes
Jan 30, 2021
|
Backport in 3c0ade1. I also only built it on the release branch. |
erictapen
added
8.has: port to stable
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Instead of overriding
libgcryptwith the (insecure)libgcrypt_1_5andlibpngwithlibpng12, use the defaults for those two packages.spotifywas changed to uselibgcrypt_1_5instead oflibgcryptin commit 165cb05 by @monocell in PR #8157 to address #8156, which found that:Given that the relevant Spotify client is more than 5 years old, I don't think we have to worry about this any more. :)
Built and checked on my NixOS desktop machine because @dotlambda said he wouldn't check proprietary software in #111215.
This commit helps #106203, but doesn't close it because
libgcrypt_1_5is still used instaruml.Motivation for this change
libgcrypt_1_5has a heap overflow vulnerability; removing it is blocked on removing it fromspotifyandstaruml.Things done
sandboxinnix.confon non-NixOS linux)Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)nix-shell -p nixpkgs-review --run "nixpkgs-review wip"./result/bin/)nix path-info -Sbefore and after)