diff --git a/hive.nix b/hive.nix index a71e90d..39935e9 100644 --- a/hive.nix +++ b/hive.nix @@ -3,14 +3,21 @@ let users = import ./users; sources = import ./npins; id_sylvain = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCvi5VUsDrwS4XqQQfFFIx1JoRDPVdtChUQWqKFbPFtP8gH51woXiKtKRbDebL0z/EmkdYKxxIkzixHTR5xQXjo8JiFZbwldZi5IvMr3x//ad9sVyOhmbRx1DXLKjyOdWyo+w0vORvbEDu2lHktfSvhHGrvUHfFc3EY+cAl7IImgGEeGNPruAuNkN90Lth9QgwJVsdOEs9j7hwwKtpfMMETL5tkW34Nu7io03+SaPxwi2xLuWTdTklfZ7GWYtG2w/hFkzDbkW97rp5dxB1HO58cPqyRlqyfhZFpiUmWlyuMba3Tip6JarCa52IpFffEIDR0CSeh5CFPoeppo/TPDiXDie370TjjQpxJiG+9PobBhmChH5FmQ/lksffI/WimqpVO7Ixf5cYiHN5Z0mgJgZsXwI3YPICQLA8ebSKHA8+mdmkunDmCBRaBj1qEgkp/UoYqXT6BjBm07nOsnL+3SG/yfx4fLotgWtdm2mkjEAG+OGVR7G3Vk/POxn0EqX7Z+gU= sylvain@idefix"; + mkNixpkgsSrc = (import sources.nix-patches { patchFile = ./patches; }).mkNixpkgsSrc; in { - meta.nixpkgs = (import sources.nix-patches { patchFile = ./patches; }).mkNixpkgsSrc { - src = sources.nixpkgs; - version = "unstable"; - }; - meta.specialArgs = { - inherit mods users sources; + meta = { + nixpkgs = mkNixpkgsSrc { + src = sources.nixpkgs; + version = "unstable"; + }; + nodeNixpkgs."kat-mail-test" = mkNixpkgsSrc { + src = sources.nixpkgs; + version = "betamail"; + }; + specialArgs = { + inherit mods users sources; + }; }; defaults = { diff --git a/patches/default.nix b/patches/default.nix index bf48857..ecef88c 100644 --- a/patches/default.nix +++ b/patches/default.nix @@ -5,4 +5,10 @@ path = ./nginx-fallback.patch; } ]; + betamail = [ + { + _type = "static"; + path = ./procmail_322.patch; + } + ]; } diff --git a/patches/procmail_322.patch b/patches/procmail_322.patch new file mode 100644 index 0000000..270bab1 --- /dev/null +++ b/patches/procmail_322.patch @@ -0,0 +1,80 @@ + +From f4fb2d56f2d1cd4e0f1062358e436bfb34c6a1c9 Mon Sep 17 00:00:00 2001 +From: catvayor +Date: Fri, 26 Jul 2024 20:59:03 +0200 +Subject: [PATCH] revert update of procmail + +--- + .../misc/procmail/CVE-2014-3618.patch | 18 ++++++++++++++++++ + pkgs/applications/misc/procmail/default.nix | 19 +++++++++---------- + 2 files changed, 27 insertions(+), 10 deletions(-) + create mode 100644 pkgs/applications/misc/procmail/CVE-2014-3618.patch + +diff --git a/pkgs/applications/misc/procmail/CVE-2014-3618.patch b/pkgs/applications/misc/procmail/CVE-2014-3618.patch +new file mode 100644 +index 000000000000..e3aa5600e40e +--- /dev/null ++++ b/pkgs/applications/misc/procmail/CVE-2014-3618.patch +@@ -0,0 +1,18 @@ ++From http://seclists.org/oss-sec/2014/q3/495 (with whitespace corrected). ++ ++--- a/src/formisc.c 2013-08-04 00:13:33.000000000 -0700 +++++ b/src/formisc.c 2014-09-03 11:42:25.986002396 -0700 ++@@ -84,12 +84,11 @@ ++ case '"':*target++=delim='"';start++; ++ } ++ ;{ int i; ++- do +++ while(*start) ++ if((i= *target++= *start++)==delim) /* corresponding delimiter? */ ++ break; ++ else if(i=='\\'&&*start) /* skip quoted character */ ++ *target++= *start++; ++- while(*start); /* anything? */ ++ } ++ hitspc=2; ++ } +diff --git a/pkgs/applications/misc/procmail/default.nix b/pkgs/applications/misc/procmail/default.nix +index 3bd280766b16..865904f75d46 100644 +--- a/pkgs/applications/misc/procmail/default.nix ++++ b/pkgs/applications/misc/procmail/default.nix +@@ -2,20 +2,19 @@ + + stdenv.mkDerivation rec { + pname = "procmail"; +- version = "3.24"; ++ version = "3.22"; + + src = fetchurl { +- url = "https://github.com/BuGlessRB/procmail/archive/refs/tags/v${version}.tar.gz"; +- sha256 = "UU6kMzOXg+ld+TIeeUdx5Ih7mCOsVf2yRpcCz2m9OYk="; ++ url = "ftp://ftp.fu-berlin.de/pub/unix/mail/procmail/procmail-${version}.tar.gz"; ++ sha256 = "05z1c803n5cppkcq99vkyd5myff904lf9sdgynfqngfk9nrpaz08"; + }; + + patches = [ +- # Fix clang-16 and gcc-14 build failures: +- # https://github.com/BuGlessRB/procmail/pull/7 +- (fetchpatch { +- name = "clang-16.patch"; +- url = "https://github.com/BuGlessRB/procmail/commit/8cfd570fd14c8fb9983859767ab1851bfd064b64.patch"; +- hash = "sha256-CaQeDKwF0hNOrxioBj7EzkCdJdsq44KwkfA9s8xK88g="; ++ ./CVE-2014-3618.patch ++ (fetchurl { ++ url = "https://sources.debian.org/data/main/p/procmail/3.22-26/debian/patches/30"; ++ sha256 = "11zmz1bj0v9pay3ldmyyg7473b80h89gycrhndsgg9q50yhcqaaq"; ++ name = "CVE-2017-16844"; + }) + ]; + +@@ -45,7 +44,7 @@ stdenv.mkDerivation rec { + + meta = with lib; { + description = "Mail processing and filtering utility"; +- homepage = "https://github.com/BuGlessRB/procmail/"; ++ homepage = "http://www.procmail.org/"; + license = licenses.gpl2; + platforms = platforms.unix; + maintainers = with maintainers; [ gebner ]; +-- +2.45.1