Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

jasper: delete from nixpkgs. #82564

Merged
merged 1 commit into from Sep 10, 2020
Merged

jasper: delete from nixpkgs. #82564

merged 1 commit into from Sep 10, 2020

Conversation

danderson
Copy link
Contributor

Motivation for this change

Fixes #55388.

JasPer is unmaintained upstream, and is accumulating unpatched CVEs. The maintainer has said to not expect improvement any time soon. Other distros have already removed this package.

Things done
  • Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS linux)
  • Built on platform(s)
    • NixOS
    • macOS
    • other Linux distributions
  • Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
  • Tested compilation of all pkgs that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review wip"
  • Tested execution of all binary files (usually in ./result/bin/)
  • Determined the impact on package closure size (by running nix path-info -S before and after)
  • Ensured that relevant documentation is up to date
  • Fits CONTRIBUTING.md.

@danderson
Copy link
Contributor Author

cc @peti to check my cabal2nix update.

@danderson
Copy link
Contributor Author

nix-review pr is in flight now, will report back if it finds problems.

@danderson
Copy link
Contributor Author

Never mind, nix-review pr needs 30G of cached packages, I only have 22G available :(.

@ofborg ofborg bot removed the 6.topic: haskell label Mar 17, 2020
@ckauhaus
Copy link
Contributor

@danderson now that 20.03 is out this should be merged to master so that we stop shipping jasper with 20.09. Would you rebase your PR?

@worldofpeace
Copy link
Contributor

Pinging for rebase again.

@danderson
Copy link
Contributor Author

Heard - thanks for the reminder. Doing this later tonight.

@jtojnar jtojnar added this to To do in Picking up garbage via automation Sep 9, 2020
@jtojnar jtojnar moved this from To do to In progress in Picking up garbage Sep 9, 2020
@danderson
jasper: remove, abandoned upstream.
3a38cef 
Jasper has been marked insecure for a while, and upstream has not
been responsive to CVEs for over a year.

Fixes #55388.

Signed-off-by: David Anderson <dave@natulte.net>
@danderson
Copy link
Contributor Author

Rebased. @ckauhaus @worldofpeace take a look, and trigger automation if any needs triggering?

@mdaiter
Copy link
Contributor

mdaiter commented Sep 9, 2020

Looks good to me! Can't run this now though.

@worldofpeace
Copy link
Contributor

Aaargh, "hsmagick" depends on jasper and it's a generated package set. I'll see what needs to be done there.

@worldofpeace
Copy link
Contributor

Probably need to drop this from cabal2nix https://github.com/NixOS/cabal2nix/blob/d3635a7eb003b08579ef41b7b41051699c369e85/src/Distribution/Nixpkgs/Haskell/FromCabal/License.hs#L112, and I think there needs to some code added somewhere to not bring in hsmagick. cc @peti

@danderson
Copy link
Contributor Author

In my original change, I'd hand-edited the haskell nix filesto clean that up as well, but was told to remove it and let haskell folks handle it downstream. Allegedly the package using jasper is already marked broken, so shouldn't be a huge deal in the interim? But I'm out of my depth here.

@worldofpeace
Copy link
Contributor

Yep, it is marked as broken https://github.com/NixOS/nixpkgs/blob/master/pkgs/development/haskell-modules/configuration-hackage2nix.yaml#L2851

worldofpeace added a commit to worldofpeace/nixpkgs that referenced this pull request Sep 9, 2020
@worldofpeace
hackage2nix: remove hsmagick
82ede05 
NixOS#82564
worldofpeace added a commit to worldofpeace/cabal2nix that referenced this pull request Sep 9, 2020
@worldofpeace
FromCabal.License: drop jasper
61b9926 
NixOS/nixpkgs#82564
This was referenced Sep 9, 2020
Merged
Closed
@worldofpeace
Copy link
Contributor

@danderson I opened NixOS/cabal2nix#469 and #97588

@ofborg ofborg bot removed the request for review from the-kenny September 9, 2020 19:56
@worldofpeace worldofpeace merged commit 50feed1 into NixOS:master Sep 10, 2020
Picking up garbage automation moved this from In progress to Done Sep 10, 2020
@OPNA2608
Copy link
Contributor

The issue originally linked in the package has been resolved since July, upstream have started being active again and the latest release is mere 9 days old. Maybe this should be reverted and the package updated instead?

https://github.com/jasper-software/jasper/releases/tag/version-2.0.20
jasper-software/jasper#208

Current state of this project:

  • all known CVEs fixed.
  • 3 people with commit rights (bottleneck solved)
  • more contributors
  • distributions notified

@worldofpeace
Copy link
Contributor

Oh, awesome 👍

Profpatsch pushed a commit to Profpatsch/cabal2nix that referenced this pull request Mar 7, 2022
@worldofpeace @Profpatsch
FromCabal.License: drop jasper
09da6ce 
NixOS/nixpkgs#82564
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@cdepillabout cdepillabout cdepillabout left review comments

@alyssais alyssais Awaiting requested review from alyssais alyssais is a code owner

@infinisil infinisil Awaiting requested review from infinisil

@mdaiter mdaiter Awaiting requested review from mdaiter

@basvandijk basvandijk Awaiting requested review from basvandijk

Assignees
No one assigned
Labels
8.has: clean-up 10.rebuild-darwin: 11-100 10.rebuild-linux: 101-500
Projects
Picking up garbage
  
Done
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

Vulnerability roundup 61: jasper-2.0.14: 1 advisory
6 participants
@danderson @ckauhaus @worldofpeace @mdaiter @OPNA2608 @cdepillabout