From c32a9d41585cdade9bc7c06949703e8ae15b82d5 Mon Sep 17 00:00:00 2001 From: Frederik Rietdijk Date: Tue, 27 Apr 2021 11:42:10 +0200 Subject: [PATCH 1/2] python2 and python3: build unoptimized bytecode again In 9d03ff52229f36ff4b4e9d0ee2db4a46b90512bb I made the CPython builds reproducible. This required not generating default unoptimized bytecode. I was under the impression the optimized bytecode would be used then, but you need to opt-in on that. Not having the default bytecode resulted in a significant performance hit. Therefore, bytecode is generated again in this commit, and thereby the builds are no longer reproducible. https://bugs.python.org/issue29708 (cherry picked from commit 23e348bfe2b161e761dd37e3be86a807f3cd6f94) --- .../interpreters/python/cpython/2.7/default.nix | 12 ++++++++---- .../interpreters/python/cpython/default.nix | 16 +++++++++++----- 2 files changed, 19 insertions(+), 9 deletions(-) diff --git a/pkgs/development/interpreters/python/cpython/2.7/default.nix b/pkgs/development/interpreters/python/cpython/2.7/default.nix index 5ee88ebb881..ad2b7fe6860 100644 --- a/pkgs/development/interpreters/python/cpython/2.7/default.nix +++ b/pkgs/development/interpreters/python/cpython/2.7/default.nix @@ -27,9 +27,9 @@ , sha256 , passthruFun , static ? false -, stripBytecode ? reproducibleBuild +, stripBytecode ? true , rebuildBytecode ? true -, reproducibleBuild ? true +, reproducibleBuild ? false , enableOptimizations ? false , pythonAttr ? "python${sourceVersion.major}${sourceVersion.minor}" }: @@ -48,6 +48,8 @@ assert lib.assertMsg (reproducibleBuild -> stripBytecode) assert lib.assertMsg (reproducibleBuild -> (!enableOptimizations)) "Deterministic builds are not achieved when optimizations are enabled."; +assert lib.assertMsg (reproducibleBuild -> (!rebuildBytecode)) + "Deterministic builds are not achieved when (default unoptimized) bytecode is created."; with lib; @@ -296,8 +298,10 @@ in with passthru; stdenv.mkDerivation ({ # First we delete all old bytecode. find $out -name "*.pyc" -delete '' + optionalString rebuildBytecode '' - # Then, we build for the two optimization levels. - # We do not build unoptimized bytecode, because its not entirely deterministic yet. + # We build 3 levels of optimized bytecode. Note the default level, without optimizations, + # is not reproducible yet. https://bugs.python.org/issue29708 + # Not creating bytecode will result in a large performance loss however, so we do build it. + find $out -name "*.py" | ${pythonForBuildInterpreter} -m compileall -q -f -x "lib2to3" -i - find $out -name "*.py" | ${pythonForBuildInterpreter} -O -m compileall -q -f -x "lib2to3" -i - find $out -name "*.py" | ${pythonForBuildInterpreter} -OO -m compileall -q -f -x "lib2to3" -i - '' + optionalString stdenv.hostPlatform.isCygwin '' diff --git a/pkgs/development/interpreters/python/cpython/default.nix b/pkgs/development/interpreters/python/cpython/default.nix index 38ee086a88f..39f2ae0c3e4 100644 --- a/pkgs/development/interpreters/python/cpython/default.nix +++ b/pkgs/development/interpreters/python/cpython/default.nix @@ -35,11 +35,11 @@ , stripTests ? false , stripTkinter ? false , rebuildBytecode ? true -, stripBytecode ? reproducibleBuild +, stripBytecode ? true , includeSiteCustomize ? true , static ? stdenv.hostPlatform.isStatic , enableOptimizations ? false -, reproducibleBuild ? true +, reproducibleBuild ? false , pythonAttr ? "python${sourceVersion.major}${sourceVersion.minor}" }: @@ -66,6 +66,9 @@ assert lib.assertMsg (reproducibleBuild -> stripBytecode) assert lib.assertMsg (reproducibleBuild -> (!enableOptimizations)) "Deterministic builds are not achieved when optimizations are enabled."; +assert lib.assertMsg (reproducibleBuild -> (!rebuildBytecode)) + "Deterministic builds are not achieved when (default unoptimized) bytecode is created."; + with lib; let @@ -396,11 +399,14 @@ in with passthru; stdenv.mkDerivation { # First we delete all old bytecode. find $out -type d -name __pycache__ -print0 | xargs -0 -I {} rm -rf "{}" '' + optionalString rebuildBytecode '' - # Then, we build for the two optimization levels. - # We do not build unoptimized bytecode, because its not entirely deterministic yet. # Python 3.7 implements PEP 552, introducing support for deterministic bytecode. - # compileall uses this checked-hash method by default when `SOURCE_DATE_EPOCH` is set. + # compileall uses the therein introduced checked-hash method by default when + # `SOURCE_DATE_EPOCH` is set. # We exclude lib2to3 because that's Python 2 code which fails + # We build 3 levels of optimized bytecode. Note the default level, without optimizations, + # is not reproducible yet. https://bugs.python.org/issue29708 + # Not creating bytecode will result in a large performance loss however, so we do build it. + find $out -name "*.py" | ${pythonForBuildInterpreter} -m compileall -q -f -x "lib2to3" -i - find $out -name "*.py" | ${pythonForBuildInterpreter} -O -m compileall -q -f -x "lib2to3" -i - find $out -name "*.py" | ${pythonForBuildInterpreter} -OO -m compileall -q -f -x "lib2to3" -i - ''; From 3142a8ca9a58c809f812ee691f2127b85b22f154 Mon Sep 17 00:00:00 2001 From: Frederik Ramcke <757280+EggBaconAndSpam@users.noreply.github.com> Date: Thu, 29 Jul 2021 14:48:00 +0200 Subject: [PATCH 2/2] cairo: add patch for CVE-2020-35492 (PR: #131949) (cherry picked from commit e591a6235d95318ad67c03d666dc8788c65025fc) --- pkgs/development/libraries/cairo/default.nix | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/pkgs/development/libraries/cairo/default.nix b/pkgs/development/libraries/cairo/default.nix index 839b7e9f40b..f8eda5224dc 100644 --- a/pkgs/development/libraries/cairo/default.nix +++ b/pkgs/development/libraries/cairo/default.nix @@ -35,6 +35,16 @@ in stdenv.mkDerivation rec { url = "https://gitlab.freedesktop.org/cairo/cairo/commit/6edf572ebb27b00d3c371ba5ae267e39d27d5b6d.patch"; sha256 = "112hgrrsmcwxh1r52brhi5lksq4pvrz4xhkzcf2iqp55jl2pb7n1"; }) + + # Fixes CVE-2020-35492; see https://github.com/NixOS/nixpkgs/issues/120364. + # CVE information: https://nvd.nist.gov/vuln/detail/CVE-2020-35492 + # Upstream PR: https://gitlab.freedesktop.org/cairo/cairo/merge_requests/85 + (fetchpatch { + name = "CVE-2020-35492.patch"; + includes = [ "src/cairo-image-compositor.c" ]; + url = "https://github.com/freedesktop/cairo/commit/78266cc8c0f7a595cfe8f3b694bfb9bcc3700b38.patch"; + sha256 = "048nzfz7rkgqb9xs0dfs56qdw7ckkxr87nbj3p0qziqdq4nb6wki"; + }) ] ++ optionals stdenv.hostPlatform.isDarwin [ # Workaround https://gitlab.freedesktop.org/cairo/cairo/-/issues/121 ./skip-configure-stderr-check.patch