Skip to content

Commit 1b78ca5

Browse files
committed
Merge #2798: stdenv and a few other big updates
Stdenv-changing things: - gcc 4.8.2 -> 4.8.3 - long-running grsecurity branch Others: - pkgconfig update - CVE for libtasn1, dbus Conflicts (simple): pkgs/development/compilers/ghc/7.6.3.nix
2 parents 5e16c94 + 9757785 commit 1b78ca5

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

52 files changed

+2216
-368
lines changed

pkgs/applications/networking/browsers/chromium/browser.nix

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
1-
{ stdenv, mkChromiumDerivation }:
1+
{ stdenv, mkChromiumDerivation, arch }:
22

33
with stdenv.lib;
44

55
mkChromiumDerivation (base: rec {
66
name = "chromium-browser";
77
packageName = "chromium";
8-
buildTargets = [ "chrome" ];
8+
buildTargets = [ "mksnapshot.${arch}" "chrome" ];
99

1010
installPhase = ''
1111
ensureDir "$libExecPath"

pkgs/applications/networking/browsers/chromium/common.nix

Lines changed: 17 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,7 @@
3030

3131
, source
3232
, plugins
33+
, archInfo
3334
}:
3435

3536
buildFun:
@@ -172,13 +173,7 @@ let
172173
# enable support for the H.264 codec
173174
proprietary_codecs = true;
174175
ffmpeg_branding = "Chrome";
175-
} // optionalAttrs (stdenv.system == "x86_64-linux") {
176-
target_arch = "x64";
177-
python_arch = "x86-64";
178-
} // optionalAttrs (stdenv.system == "i686-linux") {
179-
target_arch = "ia32";
180-
python_arch = "ia32";
181-
} // (extraAttrs.gypFlags or {}));
176+
} // archInfo // (extraAttrs.gypFlags or {}));
182177

183178
configurePhase = ''
184179
# This is to ensure expansion of $out.
@@ -190,14 +185,21 @@ let
190185
buildPhase = let
191186
CC = "${gcc}/bin/gcc";
192187
CXX = "${gcc}/bin/g++";
193-
in ''
194-
CC="${CC}" CC_host="${CC}" \
195-
CXX="${CXX}" CXX_host="${CXX}" \
196-
LINK_host="${CXX}" \
197-
"${ninja}/bin/ninja" -C "${buildPath}" \
198-
-j$NIX_BUILD_CORES -l$NIX_BUILD_CORES \
199-
${concatStringsSep " " (extraAttrs.buildTargets or [])}
200-
'';
188+
buildCommand = target: ''
189+
CC="${CC}" CC_host="${CC}" \
190+
CXX="${CXX}" CXX_host="${CXX}" \
191+
LINK_host="${CXX}" \
192+
"${ninja}/bin/ninja" -C "${buildPath}" \
193+
-j$NIX_BUILD_CORES -l$NIX_BUILD_CORES \
194+
${target}
195+
196+
if [[ "${target}" == mksnapshot.* || "${target}" == "chrome" ]]; then
197+
paxmark m "${buildPath}/${target}"
198+
fi
199+
'';
200+
targets = extraAttrs.buildTargets or [];
201+
commands = map buildCommand targets;
202+
in concatStringsSep "\n" commands;
201203
};
202204

203205
# Remove some extraAttrs we supplied to the base attributes already.

pkgs/applications/networking/browsers/chromium/default.nix

Lines changed: 13 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,14 @@
1515
}:
1616

1717
let
18+
archInfo = with stdenv.lib; optionalAttrs (stdenv.system == "i686-linux") {
19+
target_arch = "ia32";
20+
python_arch = "ia32";
21+
} // optionalAttrs (stdenv.system == "x86_64-linux") {
22+
target_arch = "x64";
23+
python_arch = "x86-64";
24+
};
25+
1826
callPackage = newScope chromium;
1927

2028
chromium = {
@@ -27,10 +35,13 @@ let
2735
mkChromiumDerivation = callPackage ./common.nix {
2836
inherit enableSELinux enableNaCl useOpenSSL gnomeSupport
2937
gnomeKeyringSupport proprietaryCodecs cupsSupport
30-
pulseSupport;
38+
pulseSupport archInfo;
39+
};
40+
41+
browser = callPackage ./browser.nix {
42+
arch = archInfo.target_arch;
3143
};
3244

33-
browser = callPackage ./browser.nix { };
3445
sandbox = callPackage ./sandbox.nix { };
3546

3647
plugins = callPackage ./plugins.nix {

pkgs/applications/networking/browsers/firefox/default.nix

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -91,6 +91,11 @@ rec {
9191

9292
#installFlags = "SKIP_GRE_REGISTRATION=1";
9393

94+
preInstall = ''
95+
# The following is needed for startup cache creation on grsecurity kernels
96+
paxmark m ../objdir/dist/bin/xpcshell
97+
'';
98+
9499
postInstall = ''
95100
# Fix run-mozilla.sh search
96101
libDir=$(cd $out/lib && ls -d xulrunner-[0-9]*)
@@ -109,6 +114,10 @@ rec {
109114
for i in $out/lib/$libDir/*.so; do
110115
patchelf --set-rpath "$(patchelf --print-rpath "$i"):$out/lib/$libDir" $i || true
111116
done
117+
118+
# For grsecurity kernels
119+
paxmark m $out/lib/$libDir/{plugin-container,xulrunner}
120+
112121
for i in $out/lib/$libDir/{plugin-container,xulrunner,xulrunner-stub}; do
113122
wrapProgram $i --prefix LD_LIBRARY_PATH ':' "$out/lib/$libDir"
114123
done

pkgs/development/compilers/gcc/4.6/builder.sh

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ if test "$noSysDirs" = "1"; then
3333

3434
# The path to the Glibc binaries such as `crti.o'.
3535
glibc_libdir="$(cat $NIX_GCC/nix-support/orig-libc)/lib"
36-
36+
3737
else
3838
# Hack: support impure environments.
3939
extraFlags="-isystem /usr/include"
@@ -214,7 +214,7 @@ postInstall() {
214214
# previous gcc.
215215
rm -rf $out/libexec/gcc/*/*/install-tools
216216
rm -rf $out/lib/gcc/*/*/install-tools
217-
217+
218218
# More dependencies with the previous gcc or some libs (gccbug stores the build command line)
219219
rm -rf $out/bin/gccbug
220220
# Take out the bootstrap-tools from the rpath, as it's not needed at all having $out
@@ -240,6 +240,11 @@ postInstall() {
240240
fi
241241
done
242242

243+
# Disable RANDMMAP on grsec, which causes segfaults when using
244+
# precompiled headers.
245+
# See https://bugs.gentoo.org/show_bug.cgi?id=301299#c31
246+
paxmark r $out/libexec/gcc/*/*/{cc1,cc1plus}
247+
243248
eval "$postInstallGhdl"
244249
}
245250

pkgs/development/compilers/gcc/4.6/default.nix

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -99,7 +99,7 @@ let version = "4.6.3";
9999
withAbi = if gccAbi != null then " --with-abi=${gccAbi}" else "";
100100
withFpu = if gccFpu != null then " --with-fpu=${gccFpu}" else "";
101101
withFloat = if gccFloat != null then " --with-float=${gccFloat}" else "";
102-
in
102+
in
103103
(withArch +
104104
withCpu +
105105
withAbi +

pkgs/development/compilers/gcc/4.8/bug-58800.patch

Lines changed: 0 additions & 79 deletions
This file was deleted.

pkgs/development/compilers/gcc/4.8/builder.sh

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -239,6 +239,11 @@ postInstall() {
239239
fi
240240
done
241241

242+
# Disable RANDMMAP on grsec, which causes segfaults when using
243+
# precompiled headers.
244+
# See https://bugs.gentoo.org/show_bug.cgi?id=301299#c31
245+
paxmark r $out/libexec/gcc/*/*/{cc1,cc1plus}
246+
242247
eval "$postInstallGhdl"
243248
}
244249

pkgs/development/compilers/gcc/4.8/default.nix

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -54,7 +54,7 @@ assert langGo -> langCC;
5454
with stdenv.lib;
5555
with builtins;
5656

57-
let version = "4.8.2";
57+
let version = "4.8.3";
5858

5959
# Whether building a cross-compiler for GNU/Hurd.
6060
crossGNU = cross != null && cross.config == "i586-pc-gnu";
@@ -64,7 +64,7 @@ let version = "4.8.2";
6464
*/
6565
enableParallelBuilding = !profiledCompiler;
6666

67-
patches = [ ./bug-58800.patch ] # http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58800
67+
patches = []
6868
++ optional enableParallelBuilding ./parallel-bconfig.patch
6969
++ optional (cross != null) ./libstdc++-target.patch
7070
# ++ optional noSysDirs ./no-sys-dirs.patch
@@ -212,7 +212,7 @@ stdenv.mkDerivation ({
212212

213213
src = fetchurl {
214214
url = "mirror://gnu/gcc/gcc-${version}/gcc-${version}.tar.bz2";
215-
sha256 = "1j6dwgby4g3p3lz7zkss32ghr45zpdidrg8xvazvn91lqxv25p09";
215+
sha256 = "07hg10zs7gnqz58my10ch0zygizqh0z0bz6pv4pgxx45n48lz3ka";
216216
};
217217

218218
inherit patches;

pkgs/development/compilers/ghc/6.10.4.nix

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,8 @@ stdenv.mkDerivation rec {
2020
"--with-gcc=${stdenv.gcc}/bin/gcc"
2121
];
2222

23+
NIX_CFLAGS_COMPILE = "-fomit-frame-pointer";
24+
2325
meta = {
2426
inherit homepage;
2527
description = "The Glasgow Haskell Compiler";

pkgs/development/compilers/ghc/6.12.3.nix

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,8 @@ stdenv.mkDerivation rec {
2525
"--with-gcc=${stdenv.gcc}/bin/gcc"
2626
];
2727

28+
NIX_CFLAGS_COMPILE = "-fomit-frame-pointer";
29+
2830
# required, because otherwise all symbols from HSffi.o are stripped, and
2931
# that in turn causes GHCi to abort
3032
stripDebugFlags=["-S" "--keep-file-symbols"];

pkgs/development/compilers/ghc/7.0.4.nix

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,8 @@ stdenv.mkDerivation rec {
2525
"--with-gcc=${stdenv.gcc}/bin/gcc"
2626
];
2727

28+
NIX_CFLAGS_COMPILE = "-fomit-frame-pointer";
29+
2830
# required, because otherwise all symbols from HSffi.o are stripped, and
2931
# that in turn causes GHCi to abort
3032
stripDebugFlags=["-S" "--keep-file-symbols"];

pkgs/development/compilers/ghc/7.2.2.nix

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,8 @@ stdenv.mkDerivation rec {
2525
"--with-gcc=${stdenv.gcc}/bin/gcc"
2626
];
2727

28+
NIX_CFLAGS_COMPILE = "-fomit-frame-pointer";
29+
2830
# required, because otherwise all symbols from HSffi.o are stripped, and
2931
# that in turn causes GHCi to abort
3032
stripDebugFlags=["-S" "--keep-file-symbols"];

pkgs/development/compilers/ghc/7.6.3.nix

Lines changed: 29 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,13 @@
1-
{ stdenv, fetchurl, ghc, perl, gmp, ncurses }:
1+
{ stdenv, fetchurl, ghc, perl, gmp, ncurses, binutils }:
22

3-
stdenv.mkDerivation rec {
3+
let
4+
# The "-Wa,--noexecstack" options might be needed only with GNU ld (as opposed
5+
# to the gold linker). It prevents binaries' stacks from being marked as
6+
# executable, which fails to run on a grsecurity/PaX kernel.
7+
ghcFlags = "-optc-Wa,--noexecstack -opta-Wa,--noexecstack";
8+
cFlags = "-Wa,--noexecstack";
9+
10+
in stdenv.mkDerivation rec {
411
version = "7.6.3";
512

613
name = "ghc-${version}";
@@ -12,21 +19,40 @@ stdenv.mkDerivation rec {
1219

1320
buildInputs = [ ghc perl gmp ncurses ];
1421

15-
1622
buildMK = ''
1723
libraries/integer-gmp_CONFIGURE_OPTS += --configure-option=--with-gmp-libraries="${gmp}/lib"
1824
libraries/integer-gmp_CONFIGURE_OPTS += --configure-option=--with-gmp-includes="${gmp}/include"
25+
26+
'' + stdenv.lib.optionalString stdenv.isLinux ''
27+
# Set ghcFlags for building ghc itself
28+
SRC_HC_OPTS += ${ghcFlags}
29+
SRC_CC_OPTS += ${cFlags}
1930
'';
2031

2132
preConfigure = ''
2233
echo "${buildMK}" > mk/build.mk
2334
sed -i -e 's|-isysroot /Developer/SDKs/MacOSX10.5.sdk||' configure
35+
36+
'' + stdenv.lib.optionalString stdenv.isLinux ''
37+
# Set ghcFlags for binaries that ghc builds
38+
sed -i -e 's|"\$topdir"|"\$topdir" ${ghcFlags}|' ghc/ghc.wrapper
39+
2440
'' + stdenv.lib.optionalString (!stdenv.isDarwin) ''
2541
export NIX_LDFLAGS="$NIX_LDFLAGS -rpath $out/lib/ghc-${version}"
2642
'';
2743

2844
configureFlags = "--with-gcc=${stdenv.gcc}/bin/gcc";
2945

46+
postInstall = ''
47+
# ghci uses mmap with rwx protection at it implements dynamic
48+
# linking on its own. See:
49+
# - https://bugs.gentoo.org/show_bug.cgi?id=299709
50+
# - https://ghc.haskell.org/trac/ghc/ticket/4244
51+
# Therefore, we have to pax-mark the resulting binary.
52+
# Haddock also seems to run with ghci, so mark it as well.
53+
paxmark m $out/lib/${name}/{ghc,haddock}
54+
'';
55+
3056
# required, because otherwise all symbols from HSffi.o are stripped, and
3157
# that in turn causes GHCi to abort
3258
stripDebugFlags=["-S" "--keep-file-symbols"];

pkgs/development/compilers/icedtea/default.nix

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,7 @@ with srcInfo; stdenv.mkDerivation {
5959
"--disable-downloading"
6060

6161
"--without-rhino"
62-
# Uncomment this when paxctl lands in stdenv: "--with-pax=paxctl"
62+
"--with-pax=paxctl"
6363
"--with-jdk-home=${jdkPath}"
6464
];
6565

0 commit comments

Comments
 (0)