Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

lz4: 1.9.1 -> 1.9.2 #82437

Merged
merged 1 commit into from Mar 12, 2020
Merged

lz4: 1.9.1 -> 1.9.2 #82437

merged 1 commit into from Mar 12, 2020

Conversation

@mmilata
Copy link
Contributor

mmilata commented Mar 12, 2020

Motivation for this change

Fixes: https://nvd.nist.gov/vuln/detail/CVE-2019-17543 (see also #73666)
Release notes: https://github.com/lz4/lz4/releases/tag/v1.9.2

Things done
  • Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS linux)
  • Built on platform(s)
    • NixOS
    • macOS
    • other Linux distributions
  • Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
  • Tested compilation of all pkgs that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review wip"
  • Tested execution of all binary files (usually in ./result/bin/)
  • Determined the impact on package closure size (by running nix path-info -S before and after)
  • Ensured that relevant documentation is up to date
  • Fits CONTRIBUTING.md.
@mmilata mmilata force-pushed the mmilata:lz4-192 branch from e44cbf0 to c1a33d3 Mar 12, 2020
@mmilata mmilata requested review from Ericson2314, FRidh and ttuegel as code owners Mar 12, 2020
@mmilata mmilata changed the base branch from master to staging Mar 12, 2020
@alyssais alyssais merged commit 18ac6ba into NixOS:staging Mar 12, 2020
15 checks passed
15 checks passed
Evaluation Performance Report Evaluator Performance Report
Details
grahamcofborg-eval ^.^!
Details
grahamcofborg-eval-check-maintainers matching changed paths to changed attrs...
Details
grahamcofborg-eval-check-meta config.nix: checkMeta = true
Details
grahamcofborg-eval-darwin nix-instantiate --arg nixpkgs { outPath=./.; revCount=999999; shortRev="ofborg"; } ./pkgs/top-level/release.nix -A darwin-tested
Details
grahamcofborg-eval-nixos nix-instantiate --arg nixpkgs { outPath=./.; revCount=999999; shortRev="ofborg"; } ./nixos/release-combined.nix -A tested
Details
grahamcofborg-eval-nixos-manual nix-instantiate --arg nixpkgs { outPath=./.; revCount=999999; shortRev="ofborg"; } ./nixos/release.nix -A manual
Details
grahamcofborg-eval-nixos-options nix-instantiate --arg nixpkgs { outPath=./.; revCount=999999; shortRev="ofborg"; } ./nixos/release.nix -A options
Details
grahamcofborg-eval-nixpkgs-manual nix-instantiate --arg nixpkgs { outPath=./.; revCount=999999; shortRev="ofborg"; } ./pkgs/top-level/release.nix -A manual
Details
grahamcofborg-eval-nixpkgs-tarball nix-instantiate --arg nixpkgs { outPath=./.; revCount=999999; shortRev="ofborg"; } ./pkgs/top-level/release.nix -A tarball
Details
grahamcofborg-eval-nixpkgs-unstable-jobset nix-instantiate --arg nixpkgs { outPath=./.; revCount=999999; shortRev="ofborg"; } ./pkgs/top-level/release.nix -A unstable
Details
grahamcofborg-eval-package-list nix-env -qa --json --file .
Details
grahamcofborg-eval-package-list-no-aliases nix-env -qa --json --file . --arg config { allowAliases = false; }
Details
lz4 on aarch64-linux Success
Details
lz4 on x86_64-linux Success
Details
@mmilata mmilata deleted the mmilata:lz4-192 branch Mar 12, 2020
@mmilata

This comment has been minimized.

Copy link
Contributor Author

mmilata commented Mar 12, 2020

@alyssais do you think this is worth backporting to 19.09 & 20.03? Upstream maintainer describes this as slim opportunity for out-of-bound write vs. CVE score 8.1 vs. lot of rebuilds.

vcunat added a commit that referenced this pull request Mar 15, 2020
vcunat added a commit that referenced this pull request Mar 15, 2020
@vcunat

This comment has been minimized.

Copy link
Member

vcunat commented Mar 15, 2020

Backported. The release notes sound safe. I see a regression reported but hopefully it won't really affect us 🤷‍♂

@vcunat vcunat mentioned this pull request Mar 15, 2020
1 of 1 task complete
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Linked issues

Successfully merging this pull request may close these issues.

None yet

3 participants
You can’t perform that action at this time.