Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

libexosip: 4.1.0 -> 5.2.0 #110231

Merged
merged 1 commit into from Jan 22, 2021
Merged

libexosip: 4.1.0 -> 5.2.0 #110231

merged 1 commit into from Jan 22, 2021

Conversation

LeSuisse
Copy link
Contributor

Motivation for this change

Fix CVE-2014-10375.

Things done
  • Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS linux)
  • Built on platform(s)
    • NixOS
    • macOS
    • other Linux distributions
  • Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
  • Tested compilation of all pkgs that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review wip"
  • Tested execution of all binary files (usually in ./result/bin/)
  • Determined the impact on package closure size (by running nix path-info -S before and after)
  • Ensured that relevant documentation is up to date
  • Fits CONTRIBUTING.md.

@SuperSandro2000
Copy link
Member

SuperSandro2000 commented Jan 21, 2021 •
edited

This is a semi-automatic executed nixpkgs-review which is checked by a human on a best effort basis and does not build all packages (e.g. lumo, tensorflow or pytorch).
If you have any questions or problems please reach out to SuperSandro2000 on IRC.

Result of nixpkgs-review pr 110231 run on x86_64-linux 1

1 package failed to build and are new build failure:
3 packages built:
  • libexosip
  • liblinphone
  • linphone

Either update sipwitch, too or try to find a patch.

@LeSuisse
Copy link
Contributor Author

Either update sipwitch, too or try to find a patch.

Sorry I missed that, I do not have NIXPKGS_ALLOW_INSECURE=1 set so it seems that my local run of nixpkgs-review did not show me the issue.

I'm not sure what to do here. The breaking change in the API of libexosip (eXosip_call_build_prack) does not seem trivial to fix, the upstream project seems dead (no commits since 2015 and barely any activity on the mailing list since 2016) and the maintainer of the package has step out in 2018 (66d7126). Since liblinphone/linphone which are depending upon libexosip are still well alive maybe it is worth to drop the sipswitch package so we can move forward.
What do you think?

@SuperSandro2000
Copy link
Member

Oh, sorry I had allow insecure still on from texting earlier. I think it would be safe to mark the insecure package broken and then merge this PR.

@SuperSandro2000
Copy link
Member

@LeSuisse please fix the merge conflict.

@LeSuisse
libexosip: 4.1.0 -> 5.2.0
fdafac8 
Fix CVE-2014-10375.

sipwitch is marked as broken as it does compile with libexosip > 5.0.0
and the upstream project appears to be stalled/abandoned.
@SuperSandro2000
Copy link
Member

This is a semi-automatic executed nixpkgs-review which is checked by a human on a best effort basis and does not build all packages (e.g. lumo, tensorflow or pytorch).
If you have any questions or problems please reach out to SuperSandro2000 on IRC.

Result of nixpkgs-review pr 110231 run on x86_64-linux 1

1 package marked as broken and skipped:
  • sipwitch
3 packages built:
  • libexosip
  • liblinphone
  • linphone

@SuperSandro2000 SuperSandro2000 merged commit 8bb551b into NixOS:master Jan 22, 2021
@LeSuisse LeSuisse deleted the libexosip-5.2.0 branch January 22, 2021 17:54
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@SuperSandro2000 SuperSandro2000 SuperSandro2000 left review comments

Assignees
No one assigned
Labels
1.severity: security 10.rebuild-darwin: 0 10.rebuild-linux: 1-10
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
2 participants
@LeSuisse @SuperSandro2000