gnu: niri: Install completions. * gnu/packages/wm.scm (niri) [arguments] <#:phases>: Install completions. [native-inputs]: Add self when cross-compiling. Change-Id: If9a6725ee13c87b5a76b959c3d6fe9804e884415
gnu: xwayland-satellite: Update to 0.7. * gnu/packages/xorg.scm (xwayland-satellite): Update to 0.7. * gnu/packages/rust-crates.scm (lookup-cargo-inputs) [xwayland-satellite]: Update entry. Change-Id: Ia39cc1808375f55f1ba0c3c4553198e4d096780f
gnu: niri: Update to 25.08. * gnu/packages/wm.scm (niri): Update to 25.08. [arguments] <#:phases>: Disable parallel testing. * gnu/packages/rust-sources.scm (rust-pipewire-0.8.0.93138d0) (rust-smithay-0.7.0.20d2dac): New variables. * gnu/packages/rust-crates.scm (lookup-cargo-inputs) [niri]: Update entry. [rust-pipewire-0.8.0.93138d0, rust-smithay-0.7.0.20d2dac]: New entries. Change-Id: I0ca02f2a8aa360cbdbe94f569e37ac175ead8d1e
gnu: qemu: Enable execlog disassembly. * gnu/packages/virtualization.scm (qemu)[inputs]: Add capstone. [arguments]<#:phases>[install-plugins]: Install contrib. Closes: #2081 Change-Id: I47365707e58a7b61e0d7195e48f819f0a1551f84
news: Add entry for the ‘content-addressed-mirrors’ security fix. * etc/news.scm: Add entry. Change-Id: Ia96a6f80d6ec557e222f2b5ee17e7c79c0eb3cbf
gnu: guix: Update to 9202921 [security]. Fixes guix/guix#2419. * gnu/packages/package-management.scm (guix): Update to 9202921. Change-Id: I7476c4e90be61a9607731731534d988eba168104
perform-download: Use (ice-9 sandbox) for mirrors. "guix perform-download" is used to implement the daemon's "download" and "git-download" builtin builders. Because these are builtins, it runs without any additional isolation beyond merely running as a build user. In such a context, allowing arbitrary user-supplied code to be evaluated will easily lead to the build user being taken over, which can then be used to corrupt future builds, enable exploitation of certain vulnerabilities, and in the case of the rootless daemon completely take over guix-daemon. Use (ice-9 sandbox) to ensure that only safe bindings are available during the evaluation of the content-addressed-mirrors file. * guix/perform-download.scm (%safe-bindings, %sandbox-module): new variables. (syntax-noop): new syntax. (eval-content-addressed-mirrors, assert-store-file, call-with-input-file/no-symlinks): new procedures. (perform-download): use assert-store-file to ensure files are in the store before being read. Use call-with-input-file/no-symlinks for opening untrusted files. Use eval-content-addressed-mirrors to evaluate the content-addressed-mirrors file. Change-Id: I8ed27a95d84dbcc7d72d0d75f172d113f8be6c79 Signed-off-by: Ludovic Courtès <ludo@gnu.org>
download: Handle content-addressed-mirrors returning #f. * guix/build/download.scm (url-fetch): don't pass the return value from a content-addressed-mirror procedure to 'string->uri' if it is #f. Change-Id: Ic4f94f86fcfebe6f2e60cb3c4330ce57886ab647 Signed-off-by: Ludovic Courtès <ludo@gnu.org>
perform-download: Ensure reading never evaluates code. Since this is used to implement the "download" and "git-download" builtins, which are run outside of any chroot, this is trusted code with respect to the user-supplied strings it reads. * guix/scripts/perform-download.scm (read/safe): new procedure. (perform-download, perform-git-download): use it. (guix-perform-download): explicitly set 'read-eval?' to #f and 'read-hash-procedures' to '(). #f is the default value of 'read-eval?' on startup, but set it anyway to be certain. Change-Id: I93cb8e32607a6f9a559a26c1cbd6b88212ead884 Signed-off-by: Ludovic Courtès <ludo@gnu.org>
gnu: sbcl-clss: Update to 0.3.1-3.cd5f603 * gnu/packages/lisp-xyz.scm (sbcl-clss): Update to 0.3.1-3.cd5f603 Change-Id: I479a79b1a1d3ac45ef31d9c02cc187fa072bf219 Signed-off-by: Omar Bassam <omar.bassam88@gmail.com> Signed-off-by: jgart <jgart@dismail.de>
gnu: lr: Update to 2.0. * gnu/packages/admin.scm (lr): Update to 2.0. [arguments]: Use GEXPs. Change-Id: I3264ccc86aa699a1e77c0388b48c801c5a4392ac
gnu: ghc-hsopenssl: Update to 0.11.7.9. * gnu/packages/haskell-crypto.scm (ghc-hsopenssl): Update to 0.11.7.9. [#:configure-flags]: New argument. Change-Id: I2719bdef7e6bbd76fe4c079d663917839a787e81
gnu: qemu: Update to 10.1.0. * gnu/packages/virtualization.scm (qemu): Update to 10.1.0. [source] <patches>: Remove qemu-disable-bios-tables-test and qemu-glibc-2.41.patch patches; add qemu-fix-test-virtio-version.patch. * gnu/packages/patches/qemu-disable-bios-tables-test.patch: Rebase. * gnu/packages/patches/qemu-disable-migration-test.patch: Delete file. * gnu/packages/patches/qemu-glibc-2.41.patch: Likewise. * gnu/packages/patches/qemu-fix-test-virtio-version.patch: New file. * gnu/local.mk (dist_patch_DATA): Update accordingly. Change-Id: I0203137a144f89dcc502d1bcb2fa6f717b7223ff
cve: Upgrade to JSON 2.0 feeds. Fixes guix/guix#2213. The 1.1-formatted-data is no longer available from NIST. * guix/cve.scm (string->date*, <cve-item>, reference-data->cve-configuration, cpe-match->cve-configuration, configuration-data->cve-configurations, json->cve-items, yearly-feed-uri, cve-item->vulnerability): Upgrade to JSON 2.0 feeds schema. (<cve>): Remove uneeded record. * tests/cve-sample.json: Update them. Remove CVE-2019-0005 (no value added, lots of lines). * tests/cve.scm (%expected-vulnerabilities): Upgrade accordingly. (json->cve-items, vulnerabilities->lookup-proc tests): Update accordingly. Signed-off-by: Ludovic Courtès <ludo@gnu.org>
gnu: wget: Graft secure package. * gnu/packages/wget.scm (wget/fixed): Add new variable. (wget): Hide package. Graft wget/fixed. Signed-off-by: Ludovic Courtès <ludo@gnu.org>
gnu: mercurial: Add package and rename former to mercurial/pinned. Mercurial currently has CVEs. IMHO, it's unsafe to carry them around in a profile. However, updating mercurial potential leads to a lot of rebuilds and I don't want to tackle this right now. As for other packages, the way forward is to add a variant of the package only used for hg-fetch, here mercurial/pinned. * gnu/packages/version-control.scm (mercurial-check-phase): Add helper variable. (mercurial): Update to 7.1. [arguments]: Use gexps. <#:phases>: Refresh them. Add phase 'add-install-to-pythonpath for running tests. Run tests after install. Add phase 'configure-check. <#:imported-modules, #:modules>: Add them for 'add-install-for-pythonpath.k [native-inputs]: Remove python-nose. Add python-setuptools-next, python-setuptools-scm-next. (mercurial/pinned): Inherit from mercurial, but build the exact same derivation as the previous mercurial variable. * guix/hg-download.scm (hg-package): Use mercurial/pinned. Signed-off-by: Ludovic Courtès <ludo@gnu.org>
gnu: subversion: Add package and rename former to subversion/pinned. Subversion currently has CVEs. IMHO, it's unsafe to carry them around in a profile. However, updating subversion potential leads to a lot of rebuilds and I don't want to tackle this right now. As for other packages, the way forward is to add a variant of the package only used for svn-fetch, here subversion/pinned. * gnu/packages/version-control.scm (subversion): Update to 1.14.5. (subversion/pinned): Inherit from subversion, but build the exact same derivation as the previous subversion variable. * guix/svn-download.scm (subversion-package): Use subversion/pinned. Signed-off-by: Ludovic Courtès <ludo@gnu.org>
gnu: guile-fibers: Provide correct ‘git-reference’. This is a followup to 6a45a2aac076e3b53b49932c28fbdde8c3e3de7a. * gnu/packages/guile-xyz.scm (guile-fibers-1.4)[source]: Add missing ‘uri’ field. Change-Id: Ie17a4e70c18c021aac9d5d88f1789c16fd4c7ad9
gnu: Add python-edps. * gnu/packages/astronomy.scm (python-edps): New variable. Change-Id: Ia7235a34575538d5532c94d0bad7e358a1e6aaa3 Signed-off-by: Sharlatan Hellseher <sharlatanus@gmail.com>
gnu: Add python-pyesorex. * gnu/packages/astronomy.scm (python-pyesorex): New variable. Change-Id: I9da8fe817fb11faab7718cfbd718622e75ef0db1 Signed-off-by: Sharlatan Hellseher <sharlatanus@gmail.com>