Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

openssl_1_1_0: Fix CVE-2017-3738 #33544

Merged
merged 1 commit into from Jan 7, 2018
Merged

Conversation

adisbladis
Copy link
Member

@adisbladis adisbladis commented Jan 6, 2018

Motivation for this change
Things done
  • Tested using sandboxing (nix.useSandbox on NixOS, or option build-use-sandbox in nix.conf on non-NixOS)
  • Built on platform(s)
    • NixOS
    • macOS
    • other Linux distributions
  • Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
  • Tested compilation of all pkgs that depend on this change using nix-shell -p nox --run "nox-review wip"
  • Tested execution of all binary files (usually in ./result/bin/)
  • Fits CONTRIBUTING.md.

@andir
Copy link
Member

andir commented Jan 6, 2018

Instead of adding yet another file to nixpkgs wouldn't it be better to fetch the patch from https://github.com/openssl/openssl/commit/5630661aecbea5fe3c4740f5fea744a1f07a6253.patch ?

@globin
Copy link
Member

globin commented Jan 7, 2018

@GrahamcOfBorg build openssl_1_1_0

Copy link

@GrahamcOfBorg GrahamcOfBorg left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Failure for system: x86_64-darwin

Hunk #4 succeeded at 1331 (offset 10 lines).
Hunk #5 succeeded at 1769 (offset -4 lines).
applying patch /nix/store/ppi54bf8q8qh0svvf0wrxxknqg0aw814-nix-ssl-cert-file.patch
patching file crypto/x509/by_file.c
Hunk #1 succeeded at 47 (offset -50 lines).
configuring
configure flags: --prefix=/nix/store/2z63585bx5d15bg6xk1cysjgsrnl7ksi-openssl-1.1.0g shared --libdir=lib --openssldir=etc/ssl
/nix/store/zsn4rc9p48hsq6a53357fmk314b0ahg4-stdenv-darwin/setup: ./Configure: /usr/bin/env: bad interpreter: Operation not permitted
builder for '/nix/store/w0fz8dz3c4ajmx7pa2pkgnhf7hgyxn9b-openssl-1.1.0g.drv' failed with exit code 126
error: build of '/nix/store/w0fz8dz3c4ajmx7pa2pkgnhf7hgyxn9b-openssl-1.1.0g.drv' failed

Copy link

@GrahamcOfBorg GrahamcOfBorg left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Success for system: x86_64-linux

patching script interpreter paths in /nix/store/3ccci7nrra2rxgz2dw39a3bz6ff70j6f-openssl-1.1.0g
checking for references to /tmp/nix-build-openssl-1.1.0g.drv-0 in /nix/store/3ccci7nrra2rxgz2dw39a3bz6ff70j6f-openssl-1.1.0g...
shrinking RPATHs of ELF executables and libraries in /nix/store/g1ql64vdhwqbwv6yyx987syk9rfi7knd-openssl-1.1.0g-man
gzipping man pages under /nix/store/g1ql64vdhwqbwv6yyx987syk9rfi7knd-openssl-1.1.0g-man/share/man/
patching script interpreter paths in /nix/store/g1ql64vdhwqbwv6yyx987syk9rfi7knd-openssl-1.1.0g-man
checking for references to /tmp/nix-build-openssl-1.1.0g.drv-0 in /nix/store/g1ql64vdhwqbwv6yyx987syk9rfi7knd-openssl-1.1.0g-man...
shrinking RPATHs of ELF executables and libraries in /nix/store/dg2x42z8ivyh49jxwi9j1id5mm6rx4xi-openssl-1.1.0g-debug
patching script interpreter paths in /nix/store/dg2x42z8ivyh49jxwi9j1id5mm6rx4xi-openssl-1.1.0g-debug
checking for references to /tmp/nix-build-openssl-1.1.0g.drv-0 in /nix/store/dg2x42z8ivyh49jxwi9j1id5mm6rx4xi-openssl-1.1.0g-debug...
/nix/store/494idiw5i3yzkrzlw17bdjaz2psgyr2k-openssl-1.1.0g-bin

Copy link

@GrahamcOfBorg GrahamcOfBorg left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Success for system: aarch64-linux

patching script interpreter paths in /nix/store/b7x8z258kzvh22y7p9l0mrh0kasj4nlb-openssl-1.1.0g
checking for references to /build in /nix/store/b7x8z258kzvh22y7p9l0mrh0kasj4nlb-openssl-1.1.0g...
shrinking RPATHs of ELF executables and libraries in /nix/store/43pg374422lm32hlp3mb672zp6drmpr4-openssl-1.1.0g-man
gzipping man pages under /nix/store/43pg374422lm32hlp3mb672zp6drmpr4-openssl-1.1.0g-man/share/man/
patching script interpreter paths in /nix/store/43pg374422lm32hlp3mb672zp6drmpr4-openssl-1.1.0g-man
checking for references to /build in /nix/store/43pg374422lm32hlp3mb672zp6drmpr4-openssl-1.1.0g-man...
shrinking RPATHs of ELF executables and libraries in /nix/store/jvvngxsq9j2mcinlxrh9brmnxajilia6-openssl-1.1.0g-debug
patching script interpreter paths in /nix/store/jvvngxsq9j2mcinlxrh9brmnxajilia6-openssl-1.1.0g-debug
checking for references to /build in /nix/store/jvvngxsq9j2mcinlxrh9brmnxajilia6-openssl-1.1.0g-debug...
/nix/store/lkhqrb2zdxc3kg38nlcphz8nmlkb2lf8-openssl-1.1.0g-bin

@globin globin merged commit 4cc3510 into NixOS:master Jan 7, 2018
@adisbladis adisbladis mentioned this pull request Jan 9, 2018
11 tasks
vcunat pushed a commit that referenced this pull request Jan 10, 2018
@vcunat
Copy link
Member

vcunat commented Jan 10, 2018

Picked to 17.09 as 5371962. (Was there a reason not to do it at once?)

@adisbladis
Copy link
Member Author

adisbladis commented Jan 10, 2018

@vcunat Thanks 👍

I just forgot to do it after the merge.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

5 participants