Branch: refs/heads/security-updates
Home: https://github.com/NixOS/nixpkgs
Commit: 8c101599189843f5df41888663b75ce26d56f363
https://github.com/NixOS/nixpkgs/commit/8c101599189843f5df41888663b75ce26d56f363
Author: Nicolas B. Pierron <[email protected]>
Date: 2016-10-01 (Sat, 01 Oct 2016)
Changed paths:
M pkgs/top-level/default.nix
Log Message:
-----------
Extract all imports out of pkgsWithOvverrides.
This change add a `packages` argument, such that we can reuse the same
function with a different set of packages.
Moving `defaultPackages` as argument would be needed for writting tests to
ensure that security fixes are applied correctly.
Commit: cff0bc1d17cf5f3539b6b9ffeafafa28705a844e
https://github.com/NixOS/nixpkgs/commit/cff0bc1d17cf5f3539b6b9ffeafafa28705a844e
Author: Nicolas B. Pierron <[email protected]>
Date: 2016-10-01 (Sat, 01 Oct 2016)
Changed paths:
M pkgs/top-level/default.nix
Log Message:
-----------
Add pkgsWithPackages function, and split pkgs expression.
Commit: 3846c865efd7479d1dd7cf22e8a88bb15362fd11
https://github.com/NixOS/nixpkgs/commit/3846c865efd7479d1dd7cf22e8a88bb15362fd11
Author: Nicolas B. Pierron <[email protected]>
Date: 2016-10-01 (Sat, 01 Oct 2016)
Changed paths:
M pkgs/top-level/default.nix
Log Message:
-----------
Move the fix-point from pkgsWithOverridesWithPackages to pkgs, and add the
unfix prefix to functions.
Commit: e2269266b05e73e69be2cb85b7237d92f69d9840
https://github.com/NixOS/nixpkgs/commit/e2269266b05e73e69be2cb85b7237d92f69d9840
Author: Nicolas B. Pierron <[email protected]>
Date: 2016-10-01 (Sat, 01 Oct 2016)
Changed paths:
M pkgs/top-level/default.nix
Log Message:
-----------
Add maybeApplyAbiCompatiblePatches, as well as the quickfixPackages argument.
Commit: 46f5555ce1a5ef6f275a2d749cc4ab7a912ec610
https://github.com/NixOS/nixpkgs/commit/46f5555ce1a5ef6f275a2d749cc4ab7a912ec610
Author: Nicolas B. Pierron <[email protected]>
Date: 2016-10-01 (Sat, 01 Oct 2016)
Changed paths:
M pkgs/top-level/default.nix
Log Message:
-----------
Add applyAbiCompatiblePatches function.
This function is in charge of compiling security updates. It does so by
taking advantage for the purity of the Nix language. It does not change any
of the hashes, even when an identical set of packages is given as argument
for the quickfixPackages.
The purity of the Nix language offer us a clean way to reason about Nixpkgs
as if this was a simple function. Thus, the following property hold true,
even when applied to a collection of packages:
let f = nixpkgsFun; in
fix f == f (f (fix f));
This property is used for building security updates, by using a variant of
the first function:
let f = nixpkgsFun; g = fixpkgsFun; in
g (fix f)
Using a fixpkgsFun function which is a function similar to nixpkgsFun, we
can generate a similar set of packages while only recompiling the fixed
packages.
The problem then becomes patching any package which are dependening on the
fixed packages. This is what the applyAbiCompatiblePatches functions do.
+-------+
| |
+---v----+ | +--------+ +--------+
| | | | | | |
| pkgs +-----> onefix +-+ +-+ recfix |
| | | | | | | |
+--------+ +--------+ | | +-----^--+
| | |
+--v--v--+ |
| | |
| abifix +----+
| |
+--------+
The loop back on pkgs is the original fix-point on the default set of
packages. Then we recompile the patched programs, in the one-fix function
call. The rec-fix is a way to probe for recompilations, by comparing the
dependencies of one-fix packages, taken from pkgs, with the dependencies of
rec-fix packages, taken from the abi-fix packages. The abi-fix packages is a
zipping function which takes one-fix packages and rec-fix packages for
patching one-fix packages. In practice, it also takes the original set of
packages, to ensure that packages have the same package name length, and
that other which depend on them can be patched safely.
Commit: fbdbd6837d50b4506ef812355deed77d9fc9a7fe
https://github.com/NixOS/nixpkgs/commit/fbdbd6837d50b4506ef812355deed77d9fc9a7fe
Author: Nicolas B. Pierron <[email protected]>
Date: 2016-10-01 (Sat, 01 Oct 2016)
Changed paths:
M pkgs/top-level/default.nix
Log Message:
-----------
Add a flag for buildfarms, to turn off the abiCompatiblePatches while running
the quick-fixes.
Commit: d527ffdb747a967ad91755c90f187610c76bdc58
https://github.com/NixOS/nixpkgs/commit/d527ffdb747a967ad91755c90f187610c76bdc58
Author: Nicolas B. Pierron <[email protected]>
Date: 2016-10-01 (Sat, 01 Oct 2016)
Changed paths:
A pkgs/test/security/static-analaysis.nix
Log Message:
-----------
Add a static analysis to report security issues.
This static analysis unroll the fix-point of Nixpkgs and number each
iteration of the fix-point. This numbering is then used to verify the
assumption made by the applyAbiCompatiblePatches function of
top=level/default.nix.
This static analysis reports 2 kinds of errors, and 1 warning.
Errors:
- Alias Original: A package defined in Nixpkgs is directly defined as a
value taken from the fix-point. This can happen for overriden packages.
This is a security issue because fixes can be ignored.
- Unpatched Inputs: An input which provided in buildInputs or
nativeBuildInputs is taken from more than one generation of Nixpkgs. This
can be caused by the Alias Original issue, or can be caused by the
function which fills the input used in buildInputs.
This is a security issue, because fixes of the dependency will not cause
this package to be recompiled.
Warning:
- Static Linking: A package dependent directly on a version of a package
which has the same generation as it-self.
This is not a security issue, but if this is not expected then this would
cause extra recompilation on the buildfarm and add delays until the fixed
versions are available.
Commit: 816d09d653ec19b49e0111a0b536d5e584134b60
https://github.com/NixOS/nixpkgs/commit/816d09d653ec19b49e0111a0b536d5e584134b60
Author: Nicolas B. Pierron <[email protected]>
Date: 2016-10-01 (Sat, 01 Oct 2016)
Changed paths:
A pkgs/test/security/check-quickfix.nix
Log Message:
-----------
Add a test case to verify that security fixes are correctly applied.
The test case create a serie of 5 test packages which are forming a chain.
It verifies that:
- Hashes are identical if the packages have no need to be recompiled nor
patched.
- Packages with fixes are recompiled.
- Packages with updated dependencies are patched, including the recompiled one.
- Hashes are correct and consistent in the final version.
- Version numbers are not updated. (abi compatible hypothesis)
- Patches carry indirect dependencies modifications.
- 2 fixed dependencies can be updates at once.
Commit: 07be72a4b38cc32cec521561b3bbb07a37d8a8fa
https://github.com/NixOS/nixpkgs/commit/07be72a4b38cc32cec521561b3bbb07a37d8a8fa
Author: Nicolas B. Pierron <[email protected]>
Date: 2016-10-01 (Sat, 01 Oct 2016)
Changed paths:
A pkgs/test/security/abifix-noop.nix
A pkgs/test/security/lib.nix
A pkgs/test/security/onefix-noop.nix
M pkgs/test/security/static-analaysis.nix
Log Message:
-----------
Add test cases to ensure that the onefix, and abifix are keeping the same
hashes if there is no fixes.
Commit: 0f724ffa74fcf94b5dbbdc21d1917f32f05fdb14
https://github.com/NixOS/nixpkgs/commit/0f724ffa74fcf94b5dbbdc21d1917f32f05fdb14
Author: Nicolas B. Pierron <[email protected]>
Date: 2016-10-01 (Sat, 01 Oct 2016)
Changed paths:
A pkgs/test/security/default.nix
M pkgs/top-level/release.nix
Log Message:
-----------
Add security test cases as release blockers.
Commit: 93fc490a8d8342cd3a994480f45350eb1db9f8d9
https://github.com/NixOS/nixpkgs/commit/93fc490a8d8342cd3a994480f45350eb1db9f8d9
Author: Nicolas B. Pierron <[email protected]>
Date: 2016-10-01 (Sat, 01 Oct 2016)
Changed paths:
M pkgs/top-level/default.nix
Log Message:
-----------
Make patchUpdatedDependencies lazier, to accept loops with override function
calls.
Commit: be10253ddc0c95bc0a51e383622167e59e143aec
https://github.com/NixOS/nixpkgs/commit/be10253ddc0c95bc0a51e383622167e59e143aec
Author: Nicolas B. Pierron <[email protected]>
Date: 2016-10-01 (Sat, 01 Oct 2016)
Changed paths:
M pkgs/test/security/static-analaysis.nix
Log Message:
-----------
Security Static Analysis: forceNativeDrv and lowPrio are not changing the
evaluation depth of the derivations.
Commit: 3abc5b9ed52bc7f19d4b2bb735d3dbf6d8f9b28d
https://github.com/NixOS/nixpkgs/commit/3abc5b9ed52bc7f19d4b2bb735d3dbf6d8f9b28d
Author: Nicolas B. Pierron <[email protected]>
Date: 2016-10-01 (Sat, 01 Oct 2016)
Changed paths:
M pkgs/top-level/all-packages.nix
Log Message:
-----------
Move callPackage functions in a small recursive set, to prevent lookup
through the pkgs argument.
Commit: b5eee2e8f2b287a8b4f5ddce07fd3e370fccebc4
https://github.com/NixOS/nixpkgs/commit/b5eee2e8f2b287a8b4f5ddce07fd3e370fccebc4
Author: Nicolas B. Pierron <[email protected]>
Date: 2016-10-01 (Sat, 01 Oct 2016)
Changed paths:
M pkgs/test/security/static-analaysis.nix
Log Message:
-----------
Security Static Analysis: filter out packages which are not changing the
generation of derivation function inputs.
Commit: 24fe53991038b0d28ff54e63bc959dbd0acac7f4
https://github.com/NixOS/nixpkgs/commit/24fe53991038b0d28ff54e63bc959dbd0acac7f4
Author: Nicolas B. Pierron <[email protected]>
Date: 2016-10-01 (Sat, 01 Oct 2016)
Changed paths:
M pkgs/top-level/all-packages.nix
Log Message:
-----------
Bootstrap the chicken package out of it-self, instead of the previous
generation.
This issues comes from the way the patches are made. When we evaluate the
chicken derivation we follow the following logic:
- Evaluate abifix.chicken.
- Zip onefix with the recfix packages.
- Apply patches to onefix.chicken and recfix.chicken.
- Evaluate recfix.chicken implies evaluating the bootstrap-chicken argument.
- Evaluating the bootstrap chicken, implies looking at the pkgs arguments of
the recfix, which is abifix.
- (loop) Thus evaluating the abifix.chicken package.
Compare: https://github.com/NixOS/nixpkgs/compare/8c1015991898^...24fe53991038_______________________________________________
nix-commits mailing list
[email protected]
http://lists.science.uu.nl/mailman/listinfo/nix-commits
