Staging next with systemd privacy fix #107086

FRidh · 2020-12-17T06:46:33Z

Motivation for this change

Includes channel blocking fixes for systemd. Let's hope it won't break anything else.

https://hydra.nixos.org/job/nixpkgs/staging-next/unstable#tabs-constituents

Things done

Fixes NixOS/nix#2517 See also: boostorg/context#72 boostorg/fiber#193 These issues have been resolved by: boostorg/context#106 boostorg/context@d4608a4 which is merged into boost as of v1.71.0. This feature was introduced (with the bug) in boost v1.61 and was fixed in v1.71. So we apply the patch to all versions in that range.

upstream decided to make this non-configurable... Lets' revert to the version before.

The order of the entries in the manifest generated while installing rustc depends on the (parallel) build, so let's sort it to make it deterministic. Also remove install.log from the output. Co-Authored-By: Jörg Thalheim <[email protected]>

Fixes CVE-2020-29385 https://ftp.gnome.org/pub/GNOME/sources/gdk-pixbuf/2.42/gdk-pixbuf-2.42.2.news

topgrade: 6.0.1 -> 6.0.2

systemd: fix pc files

Fixes: CVE-2020-1971 Closes: #106218

openssh: fix static build

openbazaar-client: 2.4.8 -> 2.4.9

openssl: 1.1.1h -> 1.1.1i

https://curl.se/docs/CVE-2020-8284.html https://curl.se/docs/CVE-2020-8285.html https://curl.se/docs/CVE-2020-8286.html Fixes: CVE-2020-8284, CVE-2020-8285, CVE-2020-8286

gdk-pixbuf: 2.42.0 → 2.42.2

Backward incompatible changes: - Support for Python 3.5 has been removed due to low usage and maintenance burden. - The GCM and AESGCM now require 64-bit to 1024-bit (8 byte to 128 byte) initialization vectors. This change is to conform with an upcoming OpenSSL release that will no longer support sizes outside this window. - When deserializing asymmetric keys we now raise ValueError rather than UnsupportedAlgorithm when an unsupported cipher is used. This change is to conform with an upcoming OpenSSL release that will no longer distinguish between error types. - We no longer allow loading of finite field Diffie-Hellman parameters of less than 512 bits in length. This change is to conform with an upcoming OpenSSL release that no longer supports smaller sizes. These keys were already wildly insecure and should not have been used in any application outside of testing.

FRidh · 2020-12-21T19:56:54Z

I think we should revert the cc wrapper and bintools changes instead. Everything else looked fine. Stdenv changes need to be tested better before being merged into staging.

Emantor · 2020-12-21T20:02:26Z

I think we should revert the cc wrapper and bintools changes instead. Everything else looked fine. Stdenv changes need to be tested better before being merged into staging.

TBH, that would also be my preference, the fix for the dynamicLinker for darwin feels more like a hack to me.

vcunat · 2020-12-21T20:26:03Z

Depends if that's the only cause for a large rebuild (or for risk of regressions). IIRC systemd by itself doesn't cause such a huge rebuild (in comparison to stdenv stuff).

vcunat · 2020-12-21T20:52:09Z

Stdenv changes need to be tested better before being merged into staging.

32-bit cases are easy to miss (and considered rather minor generally) and darwin is hard to test for most people 🤷🏽

flokli · 2020-12-21T21:07:58Z

I think we should revert the cc wrapper and bintools changes instead. Everything else looked fine. Stdenv changes need to be tested better before being merged into staging.

I agree with @FRidh here. Let's revert the cc wrapper and bintools changes, run another hydra evaluation, and get channels unblocked.

The other changes can be re-introduced in a followup PR, and be more thoroughly tested.

This reverts commit 241c391, reversing changes made to ab8c2b2. These toolchain changes are too problematic, so reverting for now; see #107086 (comment)

This reverts commit ccfd26e. These toolchain changes are too problematic, so reverting for now; see #107086 (comment)

…..." This reverts commit 0f25eb3, reversing changes made to df91ae1. These toolchain changes are too problematic, so reverting for now; see #107086 (comment)

vcunat · 2020-12-21T22:07:20Z

Done.

$ ./maintainers/scripts/rebuild-amount.sh 583470209f9d5
  25938 x86_64-darwin
  30435 x86_64-linux

^^ this amount of darwin rebuilds will surely take several days, but perhaps we can afford to merge before that finishes.

Atemu · 2020-12-22T11:54:31Z

I was going to ask why we'd need to wait for Darwin builds as the Darwin channel would just block for a few days until they're done which wouldn't be a huge issue but I just noticed that such channel does not exist.

Is there a specific reason why we don't have one for unstable? It'd sure be convenient for cases like these.

vcunat · 2020-12-22T13:41:36Z

I'm not aware of any reason. I think I've already mentioned somewhere that it would be nice to remove this difference. There's nixpkgs-unstable channel.

archseer · 2020-12-23T03:39:44Z

I think there should be a channel per architecture target, see #83049 for similar issues with aarch64

FRidh · 2020-12-23T08:13:17Z

This is not the place to discuss what channels we should have.

flokli · 2020-12-23T10:58:53Z

@FRidh considering there's less than 500 queued jobs left for x86_64-linux, I assume this is good to merge (and we can trigger a NixOS eval afterwards?)

flokli · 2020-12-23T14:32:10Z

Okay, there's no more builds left for x86_64-linux. Let's merge this :-)

petrosagg · 2020-12-23T14:34:33Z

Sorry if this is a basic question, I'm not fully familiar with the hydra pipeline. What's left for the nixos-unstable channel to get unblocked? Will it reuse the artifacts from this build run?

flokli · 2020-12-23T14:37:43Z

nixos-unstable runs builds from master - this was in staging-next.

I just triggered https://hydra.nixos.org/jobset/nixos/unstable-small and https://hydra.nixos.org/jobset/nixos/trunk-combined, which should update the corresponding channels (once succeeded).

vcunat · 2020-12-23T17:02:38Z

All hydra jobsets populate cache.nixos.org, and same /nix/store hashes get reused.

jonringer · 2020-12-23T17:40:50Z

unfortunately, nixos.tests.installer.simpleUefiSystemdBoot is failing https://hydra.nixos.org/build/133597924/nixlog/100.

I get the same failure locally.

jakobrs · 2020-12-23T17:59:32Z

#107275 is the PR that broke the test.

Atemu · 2020-12-24T11:04:20Z

Eval complete: https://hydra.nixos.org/eval/1637149?filter=tested&compare=1637089&full=#tabs-now-succeed

Channel updated too! Thank you to everyone!

KAction and others added 30 commits October 20, 2020 00:00

keyutils: fix static build

89e9c49

openssh: fix static build

4879ea9

clang, cc-wrapper: Move --gcc-toolchain logic into CC wrapper

11302dc

systemd: fix pc files

74f96a5

upstream decided to make this non-configurable... Lets' revert to the version before.

rustc: generate deterministic manifest

b909a33

The order of the entries in the manifest generated while installing rustc depends on the (parallel) build, so let's sort it to make it deterministic. Also remove install.log from the output. Co-Authored-By: Jörg Thalheim <[email protected]>

gdk-pixbuf: 2.42.0 → 2.42.2

3141ee4

Fixes CVE-2020-29385 https://ftp.gnome.org/pub/GNOME/sources/gdk-pixbuf/2.42/gdk-pixbuf-2.42.2.news

openbazaar-client: 2.4.8 -> 2.4.9

2f0b8ff

Merge staging-next into staging

9adc06e

topgrade: 6.0.1 -> 6.0.2

7a5572b

Merge pull request #106284 from raboof/rustc-deterministic-manifest

650db4a

Merge staging-next into staging

c76c05e

Merge pull request #106328 from r-ryantm/auto-update/topgrade

fc18dfd

topgrade: 6.0.1 -> 6.0.2

Merge pull request #106044 from Mic92/systemd

3b41567

systemd: fix pc files

openssl: 1.1.1h -> 1.1.1i

76e0197

Fixes: CVE-2020-1971 Closes: #106218

Merge staging-next into staging

5ed8ad0

Merge pull request #100906 from KAction/openssh

87413f3

openssh: fix static build

Merge pull request #106310 from r-ryantm/auto-update/openbazaar-client

a258874

openbazaar-client: 2.4.8 -> 2.4.9

Merge staging-next into staging

a2f873d

Merge staging-next into staging

3339899

Merge pull request #106362 from mweinelt/openssl

00a1069

openssl: 1.1.1h -> 1.1.1i

Merge staging-next into staging

8feb00a

alephone-infinity: 20190331 -> 20200904

ec4aef3

curl: 7.73.0 -> 7.74.0

5ba7277

https://curl.se/docs/CVE-2020-8284.html https://curl.se/docs/CVE-2020-8285.html https://curl.se/docs/CVE-2020-8286.html Fixes: CVE-2020-8284, CVE-2020-8285, CVE-2020-8286

Merge staging-next into staging

4ce8ce1

Merge branch 'staging-next' into staging

bf2f0ec

Merge pull request #106302 from NixOS/gdk-pixbuf-2.42.2

0facf25

gdk-pixbuf: 2.42.0 → 2.42.2

Merge staging-next into staging

d85d0c3

Merge staging-next into staging

4e33f29

vcunat added 3 commits December 21, 2020 22:26

Revert "Merge #107253: bintools-wrapper: fix inverted link32 check"

bf44473

This reverts commit 241c391, reversing changes made to ab8c2b2. These toolchain changes are too problematic, so reverting for now; see #107086 (comment)

Revert "bintools-wrapper: skip dynamic linker for static binaries"

363175c

This reverts commit ccfd26e. These toolchain changes are too problematic, so reverting for now; see #107086 (comment)

Revert "Merge #94582: clang, cc-wrapper: Move --gcc-toolchain logic…

ac03cfa

…..." This reverts commit 0f25eb3, reversing changes made to df91ae1. These toolchain changes are too problematic, so reverting for now; see #107086 (comment)

Merge master into staging-next

f1ccef3

ofborg bot removed the 10.rebuild-linux-stdenv This PR causes stdenv to rebuild label Dec 22, 2020

Merge master into staging-next

789fc8e

Merge master into staging-next

3aac2c1

github-actions bot added 2 commits December 22, 2020 18:27

Merge master into staging-next

e0d458e

Merge master into staging-next

28fd8e0

Merge master into staging-next

c0412cf

Merge master into staging-next

bb5bf5c

flokli merged commit e7659b6 into master Dec 23, 2020

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Staging next with systemd privacy fix #107086

Staging next with systemd privacy fix #107086

FRidh commented Dec 17, 2020 •

edited

Loading

FRidh commented Dec 21, 2020

Emantor commented Dec 21, 2020

vcunat commented Dec 21, 2020 •

edited

Loading

vcunat commented Dec 21, 2020

flokli commented Dec 21, 2020

vcunat commented Dec 21, 2020

Atemu commented Dec 22, 2020

vcunat commented Dec 22, 2020

archseer commented Dec 23, 2020

FRidh commented Dec 23, 2020

flokli commented Dec 23, 2020

flokli commented Dec 23, 2020 •

edited

Loading

petrosagg commented Dec 23, 2020 •

edited

Loading

flokli commented Dec 23, 2020

vcunat commented Dec 23, 2020

jonringer commented Dec 23, 2020

jakobrs commented Dec 23, 2020

Atemu commented Dec 24, 2020 •

edited

Loading

Staging next with systemd privacy fix #107086

Staging next with systemd privacy fix #107086

Conversation

FRidh commented Dec 17, 2020 • edited Loading

Motivation for this change

Things done

FRidh commented Dec 21, 2020

Emantor commented Dec 21, 2020

vcunat commented Dec 21, 2020 • edited Loading

vcunat commented Dec 21, 2020

flokli commented Dec 21, 2020

vcunat commented Dec 21, 2020

Atemu commented Dec 22, 2020

vcunat commented Dec 22, 2020

archseer commented Dec 23, 2020

FRidh commented Dec 23, 2020

flokli commented Dec 23, 2020

flokli commented Dec 23, 2020 • edited Loading

petrosagg commented Dec 23, 2020 • edited Loading

flokli commented Dec 23, 2020

vcunat commented Dec 23, 2020

jonringer commented Dec 23, 2020

jakobrs commented Dec 23, 2020

Atemu commented Dec 24, 2020 • edited Loading

FRidh commented Dec 17, 2020 •

edited

Loading

vcunat commented Dec 21, 2020 •

edited

Loading

flokli commented Dec 23, 2020 •

edited

Loading

petrosagg commented Dec 23, 2020 •

edited

Loading

Atemu commented Dec 24, 2020 •

edited

Loading