Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

libssh2: 1.8.0 -> 1.8.1 (SECURITY) #57884

Merged
merged 1 commit into from
Mar 19, 2019
Merged

libssh2: 1.8.0 -> 1.8.1 (SECURITY) #57884

merged 1 commit into from
Mar 19, 2019

Conversation

dtzWill
Copy link
Member

@dtzWill dtzWill commented Mar 19, 2019

Motivation for this change

Security fixes (nine!)!

Release announcement:
https://www.libssh2.org/mail/libssh2-devel-archive-2019-03/0009.shtml
Security info:
https://www.libssh2.org/mail/libssh2-devel-archive-2019-03/0010.shtml

Things done
  • Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS)
  • Built on platform(s)
    • NixOS
    • macOS
    • other Linux distributions
  • Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
  • Tested compilation of all pkgs that depend on this change using nix-shell -p nox --run "nox-review wip"
  • Tested execution of all binary files (usually in ./result/bin/)
  • Determined the impact on package closure size (by running nix path-info -S before and after)
  • Assured whether relevant documentation is up to date
  • Fits CONTRIBUTING.md.

@dtzWill
Copy link
Member Author

dtzWill commented Mar 19, 2019

cc @NixOS/backports @NixOS/security-notifications @grahamc @fpletz @domenkozar

Nix uses libssh2, FWIW.

@primeos primeos added 1.severity: security Issues which raise a security issue, or PRs that fix one 9.needs: port to stable A PR needs a backport to the stable release. labels Mar 19, 2019
@dtzWill dtzWill merged commit b9045b0 into NixOS:master Mar 19, 2019
@dtzWill dtzWill deleted the update/libssh2-1.8.1 branch March 19, 2019 14:32
@lheckemann
Copy link
Member

Aaah, shoudln't this have gone to staging?

@samueldr
Copy link
Member

samueldr commented Apr 8, 2019

Looks like either I'm missing the obvious, or this wasn't backported yet?

Should this backport be targetting staging-19.03 or go directly to release-19.03?

I think this, additionally, should be backported to 18.09 due to it being a security update.

lheckemann pushed a commit that referenced this pull request Apr 8, 2019
@dtzWill @lheckemann
libssh2: 1.8.0 -> 1.8.1 (SECURITY)
926606a 
Release announcement:
https://www.libssh2.org/mail/libssh2-devel-archive-2019-03/0009.shtml
Security info:
https://www.libssh2.org/mail/libssh2-devel-archive-2019-03/0010.shtml

(cherry picked from commit efee45b)
PR #57884
lheckemann pushed a commit that referenced this pull request Apr 8, 2019
@dtzWill @lheckemann
libssh2: 1.8.0 -> 1.8.1 (SECURITY)
a5ed214 
Release announcement:
https://www.libssh2.org/mail/libssh2-devel-archive-2019-03/0009.shtml
Security info:
https://www.libssh2.org/mail/libssh2-devel-archive-2019-03/0010.shtml

(cherry picked from commit efee45b)
PR #57884
Co-authored-by: Linus Heckemann <git@sphalerite.org>
@lheckemann
Copy link
Member

Done, good catch!

@samueldr samueldr removed the 9.needs: port to stable A PR needs a backport to the stable release. label Apr 14, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@lheckemann lheckemann lheckemann approved these changes

@NeQuissimus NeQuissimus NeQuissimus approved these changes

Assignees
No one assigned
Labels
1.severity: security Issues which raise a security issue, or PRs that fix one 10.rebuild-darwin: 501+ 10.rebuild-darwin: 5001+ 10.rebuild-darwin-stdenv This PR causes stdenv to rebuild 10.rebuild-linux: 501+ 10.rebuild-linux: 5001+
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
6 participants
@dtzWill @lheckemann @samueldr @NeQuissimus @primeos @GrahamcOfBorg