[darwin] Security fixes #38865

matthewbauer · 2018-04-12T19:14:04Z

These are some unobjectionable commits split off from #38624. Will merge if it doesn't cause a mass rebuild.

now build directory is "Products/Release/"

moves swift-corelibs-corefoundation to own dir also adds libdispatch

darwin.dtrace-xcode contains the dtrace bin

Fixes NixOS#37838

need $wrapper/usr/bin to exist for some SDK stuff

LnL7

What are the implications of the xcbuild changes? Everything else looks like stuff we could backport.

matthewbauer · 2018-04-12T19:20:19Z

Two things are happening with xcbuild:

Don't pass NIX_* flags directly to xcbuild. They are already handled by the CC wrapper.
Set SYMROOT and OBJROOT directly so we don't have to guess what the "hash" will be.

Not sure of all of the things this could break- so probably don't backport any of them (although I don't think dtrace stuff would work without the xcbuild changes).

GrahamcOfBorg · 2018-04-12T19:26:01Z

Success on x86_64-darwin (full log)

Attempted: antlr, pbzx, xcbuild

Partial log (click to expand)

/bin/echo "installation done"
installation done
post-installation fixup
strip is /nix/store/kdff2gim6417493yha769kh00n63lnrw-cctools-binutils-darwin/bin/strip
stripping (with command strip and flags -S) in /nix/store/iydvypslm2gx6b1zqsr3hjlhivy5l3q7-antlr-2.7.7/lib  /nix/store/iydvypslm2gx6b1zqsr3hjlhivy5l3q7-antlr-2.7.7/bin  /nix/store/iydvypslm2gx6b1zqsr3hjlhivy5l3q7-antlr-2.7.7/sbin
patching script interpreter paths in /nix/store/iydvypslm2gx6b1zqsr3hjlhivy5l3q7-antlr-2.7.7
/nix/store/iydvypslm2gx6b1zqsr3hjlhivy5l3q7-antlr-2.7.7/bin/antlr: interpreter directive changed from "/bin/sh" to "/nix/store/r8bx3qf1bpncb14i9gzma4vr089pc3pv-bash-4.4-p19/bin/sh"
/nix/store/iydvypslm2gx6b1zqsr3hjlhivy5l3q7-antlr-2.7.7/bin/antlr-config: interpreter directive changed from "/bin/sh" to "/nix/store/r8bx3qf1bpncb14i9gzma4vr089pc3pv-bash-4.4-p19/bin/sh"
/nix/store/iydvypslm2gx6b1zqsr3hjlhivy5l3q7-antlr-2.7.7/sbin/pyantlr.sh: interpreter directive changed from "/usr/bin/env python" to "/nix/store/10f4qxb00wk9j6cicd9h1qzwqgnc36ji-python-2.7.14/bin/python"
moving /nix/store/iydvypslm2gx6b1zqsr3hjlhivy5l3q7-antlr-2.7.7/sbin/* to /nix/store/iydvypslm2gx6b1zqsr3hjlhivy5l3q7-antlr-2.7.7/bin

GrahamcOfBorg · 2018-04-12T19:26:43Z

Success on x86_64-linux (full log)

Attempted: antlr, pbzx, xcbuild

Partial log (click to expand)

installing
post-installation fixup
shrinking RPATHs of ELF executables and libraries in /nix/store/669xmxd5qfj2fawk67smr4789r800nba-xcbuild-wrapper-0.1.2-pre
strip is /nix/store/j75dgadrff2d1fyc4fczmcgqkid2imdx-binutils-2.30/bin/strip
stripping (with command strip and flags -S) in /nix/store/669xmxd5qfj2fawk67smr4789r800nba-xcbuild-wrapper-0.1.2-pre/bin
patching script interpreter paths in /nix/store/669xmxd5qfj2fawk67smr4789r800nba-xcbuild-wrapper-0.1.2-pre
checking for references to /tmp/nix-build-xcbuild-wrapper-0.1.2-pre.drv-0 in /nix/store/669xmxd5qfj2fawk67smr4789r800nba-xcbuild-wrapper-0.1.2-pre...
/nix/store/jvni0rrzgx60vgfm9zra8gi4664cl576-antlr-2.7.7
/nix/store/fnfj6d239v75g5wd9agk17qdfd5pmz30-pbzx-1.0.2
/nix/store/669xmxd5qfj2fawk67smr4789r800nba-xcbuild-wrapper-0.1.2-pre

GrahamcOfBorg · 2018-04-12T19:29:25Z

Success on aarch64-linux (full log)

Attempted: pbzx, xcbuild

The following builds were skipped because they don't evaluate on aarch64-linux: antlr

Partial log (click to expand)

building '/nix/store/30nm0ya7yq65bfhki1fyl7hk478irskf-xcbuild-wrapper-0.1.2-pre.drv'...
installing
post-installation fixup
shrinking RPATHs of ELF executables and libraries in /nix/store/9g9mag7w2qmljc73xzrjh7zq2a7qhphg-xcbuild-wrapper-0.1.2-pre
strip is /nix/store/j7d4mr0ikv974ig7yzhknpsq288js4bs-binutils-2.30/bin/strip
stripping (with command strip and flags -S) in /nix/store/9g9mag7w2qmljc73xzrjh7zq2a7qhphg-xcbuild-wrapper-0.1.2-pre/bin
patching script interpreter paths in /nix/store/9g9mag7w2qmljc73xzrjh7zq2a7qhphg-xcbuild-wrapper-0.1.2-pre
checking for references to /build in /nix/store/9g9mag7w2qmljc73xzrjh7zq2a7qhphg-xcbuild-wrapper-0.1.2-pre...
/nix/store/jmmpjmkvv6f7m88d2zyh673m6a6c9m8x-pbzx-1.0.2
/nix/store/9g9mag7w2qmljc73xzrjh7zq2a7qhphg-xcbuild-wrapper-0.1.2-pre

LnL7 · 2018-04-12T20:02:19Z

I think this might have broken pinentry.

Touch ./pinentry-mac-dhxutgwbgiovlqgwbodflwnujcsw/Build/Products/Release/pinentry-mac.app
    cd /private/tmp/nix-build-pinentry-mac-0.9.4.drv-0/source
    /usr/bin/touch -c ./pinentry-mac-dhxutgwbgiovlqgwbodflwnujcsw/Build/Products/Release/pinentry-mac.app

** BUILD SUCCEEDED **
installing
mv: cannot stat 'Products/Release/pinentry-mac.app': No such file or directory
builder for '/nix/store/r32yi5r0q50aznbig5yj10z7rhp1irgz-pinentry-mac-0.9.4.drv' failed with exit code 1

matthewbauer · 2018-04-12T20:04:27Z

Okay. I forgot it doesn't use xcbuild. Fixing should be easy though, just export these two: SYMROOT="$PWD/Products"; OBJROOT="$PWD/Intermediates";

Release: https://github.com/quarkusio/quarkus/releases/tag/3.2.11.Final Complete changelog NixOS#35659 - Fix File handling as a JAX-RS body parameter NixOS#37153 - Bump smallrye-jwt version to 4.4.0 NixOS#38233 - Bump resteasy.version from 6.2.6.Final to 6.2.7.Final NixOS#38236 - Adding a decorator causes bytecode error NixOS#38362 - Register JDBC RowSet required bundle NixOS#38370 - Include RowSet properties file in native image NixOS#38429 - Replace {project-name} attribute in document title for downstream NixOS#38430 - Avoid dots in config doc ids as it's causing issues for downstream NixOS#38580 - Make the Forwarded Parser syntax parsing case-insensitive NixOS#38648 - More documentation adjustments for new downstream tooling NixOS#38649 - Use [[anchor]] format consistently NixOS#38748 - Sanitize app.dekorate.io/vcs-url kubernetes annotation NixOS#38755 - Log when a RestEasy Reactive client close method is called NixOS#38785 - ArC: fix interception when some methods return void NixOS#38865 - Update commons-compress version to mitigate CVE-2024-25710

matthewbauer added 16 commits April 9, 2018 18:35

antlr: supports darwin

e51405d

xcbuild: add framework product

a77de95

xcbuild: set SYMROOT and OBJROOT

7c1e397

treewide: change install references for xcbuild

65562e4

now build directory is "Products/Release/"

pbzx: init at 1.0.2

c3ce4ee

swift-corelibs: init

72f8df9

moves swift-corelibs-corefoundation to own dir also adds libdispatch

CoreSymbolication: init

d625fec

darling: init

0b83326

dtrace: add xcode drv

4a515ed

darwin.dtrace-xcode contains the dtrace bin

libsecurity_utilities: fixup

c468b30

libsecurity_codesigning: init

71b53c0

security_systemkeychain: init

77ac9c5

Fixes NixOS#37838

xcbuild: fix wrapper

d5dc446

need $wrapper/usr/bin to exist for some SDK stuff

SmartCardServices: init

d227d1e

dtrace: patch impurities

aa21f9c

libsecurity_apple_x509: add more symbols

59bcd12

GrahamcOfBorg added the 6.topic: darwin Running or building packages on Darwin label Apr 12, 2018

LnL7 approved these changes Apr 12, 2018

View reviewed changes

GrahamcOfBorg added 8.has: clean-up 8.has: package (new) 10.rebuild-darwin: 501+ 10.rebuild-linux: 1-10 labels Apr 12, 2018

matthewbauer merged commit 29bc523 into NixOS:master Apr 12, 2018

matthewbauer deleted the darwin-security-fixes branch February 22, 2019 04:34

thefloweringash mentioned this pull request Mar 8, 2021

Native support for Apple Silicon #105026

Merged

21 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[darwin] Security fixes #38865

[darwin] Security fixes #38865

matthewbauer commented Apr 12, 2018

LnL7 left a comment

matthewbauer commented Apr 12, 2018

GrahamcOfBorg commented Apr 12, 2018

GrahamcOfBorg commented Apr 12, 2018

GrahamcOfBorg commented Apr 12, 2018

LnL7 commented Apr 12, 2018

matthewbauer commented Apr 12, 2018 •

edited

[darwin] Security fixes #38865

[darwin] Security fixes #38865

Conversation

matthewbauer commented Apr 12, 2018

LnL7 left a comment

Choose a reason for hiding this comment

matthewbauer commented Apr 12, 2018

GrahamcOfBorg commented Apr 12, 2018

GrahamcOfBorg commented Apr 12, 2018

GrahamcOfBorg commented Apr 12, 2018

LnL7 commented Apr 12, 2018

matthewbauer commented Apr 12, 2018 • edited

matthewbauer commented Apr 12, 2018 •

edited