Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

openssl(_1_1): patch CVE-2019-1551 #84083

Merged
merged 1 commit into from Apr 2, 2020
Merged

openssl(_1_1): patch CVE-2019-1551 #84083

merged 1 commit into from Apr 2, 2020

Conversation

flokli
Copy link
Contributor

@flokli flokli commented Apr 2, 2020

fetchpatch can't be used here and fetchurl from GitHub
like in PR #82928 has the risk of breaking the hash later;
fortunately the patches aren't too large.

(cherry picked from commit 2071e3b)

Motivation for this change

#82789 (comment)

Things done
  • Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS linux)
  • Built on platform(s)
    • NixOS
    • macOS
    • other Linux distributions
  • Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
  • Tested compilation of all pkgs that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review wip"
  • Tested execution of all binary files (usually in ./result/bin/)
  • Determined the impact on package closure size (by running nix path-info -S before and after)
  • Ensured that relevant documentation is up to date
  • Fits CONTRIBUTING.md.

@flokli flokli requested review from andir and vcunat April 2, 2020 07:57
@flokli
Copy link
Contributor Author

flokli commented Apr 2, 2020

@GrahamcOfBorg build python3.pkgs.pyopenssl

@vcunat @flokli
openssl(_1_1): patch CVE-2019-1551
e48a55d 
fetchpatch can't be used here and fetchurl from GitHub
like in PR NixOS#82928 has the risk of breaking the hash later;
fortunately the patches aren't too large.

(cherry picked from commit 2071e3b)
@flokli flokli force-pushed the openssl-1.1.1d-CVE-2019-1551 branch from deba47a to e48a55d Compare April 2, 2020 08:01
@flokli flokli changed the base branch from master to staging April 2, 2020 08:01
@flokli
Copy link
Contributor Author

flokli commented Apr 2, 2020

@GrahamcOfBorg build python3.pkgs.pyopenssl

This was referenced Apr 2, 2020
Closed
Closed
@ofborg ofborg bot added 6.topic: GNOME GNOME desktop environment and its underlying platform 6.topic: nixos 6.topic: pantheon The Pantheon desktop environment 6.topic: python 6.topic: qt/kde 6.topic: rust 6.topic: xfce The Xfce Desktop Environment labels Apr 2, 2020
@flokli flokli mentioned this pull request Apr 2, 2020
Closed
@ofborg ofborg bot requested a review from peti April 2, 2020 08:14
@vcunat
Copy link
Member

vcunat commented Apr 2, 2020 •
edited

Borg's gone a bit overboard with the labels 🤕 EDIT: perhaps because of comparing against master?

@vcunat vcunat merged commit e48a55d into NixOS:staging Apr 2, 2020
@flokli flokli deleted the openssl-1.1.1d-CVE-2019-1551 branch April 2, 2020 08:27
@flokli
Copy link
Contributor Author

flokli commented Apr 2, 2020

Thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@vcunat vcunat vcunat approved these changes

@andir andir Awaiting requested review from andir

@peti peti Awaiting requested review from peti

Assignees
No one assigned
Labels
6.topic: GNOME GNOME desktop environment and its underlying platform 6.topic: nixos 6.topic: pantheon The Pantheon desktop environment 6.topic: python 6.topic: qt/kde 6.topic: rust 6.topic: xfce The Xfce Desktop Environment 8.has: changelog 8.has: clean-up 8.has: documentation 8.has: module (update) 8.has: package (new) 10.rebuild-darwin: 501+ 10.rebuild-darwin: 5001+ 10.rebuild-darwin-stdenv 10.rebuild-linux: 501+ 10.rebuild-linux: 5001+
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
2 participants
@flokli @vcunat