Maximilian Bosch f47c57802e linux: build hardened kernel with matching releases ... Until now we merged kernel updates even if no hardened versions were available yet. On one hand we don't want to delay patch-level updates, on the other hand users of hardened kernels have frequent breakage now[1]. This change aims to provide a solution this issue: * The hardened patchset now references the kernel version it's released for (including a sha256 hash for the fixed-output path of the source tarball). * The `hardenedKernelFor`-function doesn't just append hardened patches now, but also overrides version & src to match the kernel version the patch was built & tested for. Refs #140281 [1] https://hydra.nixos.org/job/nixos/trunk-combined/nixpkgs.linuxPackages_hardened.kernel.x86_64-linux/all (cherry picked from commit bb5aa0109b6db98a2e0a7ba88f5e0287e2374384)		2021-10-28 22:26:22 +02:00
..
915resolution	…
acpi	…
acpi-call	acpi_call: 1.2.1 -> 1.2.2	2021-08-24 19:37:18 +00:00
acpid	…
acpitool	…
afuse	afuse: add darwin build	2021-04-20 00:51:47 +09:00
akvcam	…
alsa-firmware	…
alsa-lib	…
alsa-oss	…
alsa-plugins	…
alsa-tools	…
alsa-topology-conf	…
alsa-ucm-conf	…
alsa-utils	…
amdgpu-pro	…
anbox	linuxPackages.anbox: 2019-11-15 -> 2020-06-14, mark broken for kernels	2021-05-13 11:23:14 -07:00
android-udev-rules	android-udev-rules: 20210425 -> 20210501	2021-05-17 14:02:36 -07:00
apparmor	Merge master into staging-next	2021-05-08 06:20:05 +00:00
aseq2json	…
asus-wmi-sensors	…
atop	atop: use substituteInPlace instead of sed	2021-05-17 13:58:50 +02:00
audit	audit: use hostPlatform.isStatic instead of targetPlatform.isStatic	2021-06-25 17:54:58 +00:00
autofs	kerberos: deprecate alias	2021-04-04 03:18:56 +02:00
batman-adv	batman-adv: 2021.0 -> 2021.1	2021-05-22 00:31:57 +02:00
bbswitch	…
bcc	Merge branch 'master' into staging-next	2021-05-09 09:31:55 +02:00
beefi	…
bionic-prebuilt	bionic: use fetchzip for everything (#123010)	2021-05-16 01:24:27 -04:00
blktrace	…
bluez	bluez: Disable kernel dependent test-mesh-crypto	2021-09-02 18:02:37 +00:00
bolt	…
bpftools	bpftools: fix	2021-07-29 09:42:48 +00:00
bpftrace	linuxPackages.bpftrace: 0.12.0 -> 0.12.1	2021-05-17 13:44:33 -07:00
bridge-utils	…
brillo	…
broadcom-sta	…
btfs	btfs: add darwin build	2021-04-20 00:51:41 +09:00
busybox	Merge #129412: makeself: disable tests for now	2021-07-06 21:55:52 +02:00
cachefilesd	…
can-isotp	…
can-utils	…
catfs	treewide: fix cargoSha256/cargoHash	2021-05-08 00:36:37 -07:00
checkpolicy	…
checksec	…
chromium-xorg-conf	…
cifs-utils	cifs-utils: 6.12 -> 6.13	2021-04-28 03:03:12 +00:00
compsize	compsize: use upstream's installer	2021-03-29 13:15:18 +08:00
conky	conky: 1.12.1 -> 1.12.2	2021-04-25 21:14:42 +00:00
conntrack-tools	…
consoletools	…
conspy	…
cpufrequtils	…
cpuid	…
cpupower	…
cpuset	…
cpustat	…
cramfsprogs	…
cramfsswap	…
crda	…
criu	…
cryptodev	cryptodev: 1.11 -> 1.12	2021-05-08 10:06:52 -07:00
cryptsetup	…
cshatag	…
dbus-broker	dbus-broker: 22 -> 28	2021-05-04 11:43:34 +04:00
ddcci	…
device-tree	…
devmem2	…
digimend	…
directvnc	…
disk-indicator	…
displaylink	displaylink: 5.3.1 -> 5.4.0	2021-04-19 08:34:48 +02:00
dlm	treewide: fix cargoSha256/cargoHash	2021-05-08 00:36:37 -07:00
dmidecode	…
dmraid	…
dmtcp	dmtcp: stay with python2	2021-03-25 12:22:50 +01:00
dpdk	dpdk: 20.05 -> 21.02	2021-05-24 09:18:26 +02:00
dpdk-kmods	dpdk-kmods: init at 2021-04-21	2021-06-13 09:40:56 +00:00
drbd	…
dropwatch	dropwatch. 1.5.1 -> 1.5.3 (#119989)	2021-04-21 06:28:39 +01:00
dstat	dstat: add changelog	2021-04-01 17:59:47 +02:00
e1000e	…
earlyoom	…
ebtables	…
edac-utils	…
ell	ell: 0.38 -> 0.40	2021-05-13 21:50:35 +02:00
ena	linuxPackages.ena: 2.4.1 -> 2.5.0	2021-05-19 12:48:30 +08:00
erofs-utils	…
eudev	…
evdi	linuxPackages.evdi: unstable-2021-06-11 -> unstable-2021-07-7	2021-08-04 17:24:51 +03:00
eventstat	eventstat: 0.04.11 -> 0.04.12	2021-05-08 17:14:59 -07:00
exfat	…
extrace	…
facetimehd	…
fatrace	fatrace: 0.16.2 -> 0.16.3	2021-05-16 02:47:06 -04:00
fbterm	…
ffado	…
firejail	…
firmware	firmwareLinuxNonfree: 2021-08-18 -> 2021-09-19	2021-10-01 06:27:23 +00:00
flashbench	Drop maintainership for some packages	2021-04-18 09:00:18 +02:00
fnotifystat	…
forkstat	…
forktty	…
freefall	…
fscrypt	fscrypt-experimental: 0.2.9 -> 0.3.0 (#118243)	2021-04-02 11:56:01 +02:00
fscryptctl	…
fswebcam	…
ftop	…
fuse	fusePackages: don't manually enableParallelBuilding	2021-05-12 11:57:35 +00:00
fwts	…
fxload	…
g15daemon	treewide: convert all links git.archlinux.org to github.com/archlinux/svntogit-*	2021-07-18 09:17:54 +00:00
gcadapter-oc-kmod	…
gfxtablet	…
gobi_loader	…
gogoclient	iproute: deprecate alias	2021-04-04 01:43:46 +02:00
google-authenticator	…
gpu-switch	…
gradm	gradm: 3.1-202012071814 -> 3.1-202102241600	2021-05-14 10:39:48 -04:00
greetd	treewide: fix cargoSha256/cargoHash	2021-05-08 00:36:37 -07:00
gtkgreet	gtkgreet: init at 0.7	2021-03-22 10:16:31 +01:00
guvcview	…
hd-idle	…
hdapsd	…
hdparm	hdparm: 9.60 -> 9.61	2021-05-19 10:54:07 -07:00
health-check	…
hibernate	…
hid-nintendo	linuxPackages.hid-nintendo: init at 3.1	2021-05-17 21:23:47 -07:00
hostapd	hostapd: add patch for CVE-2021-30004	2021-04-13 19:32:22 +02:00
hwdata	Revert "Revert "hwdata: 0.344 -> 0.347""	2021-05-16 16:37:13 +02:00
hyperv-daemons	iproute: deprecate alias	2021-04-04 01:43:46 +02:00
i2c-tools	i2c-tools: switch to fetchgit and separate man	2021-05-08 13:23:36 -07:00
i7z	…
i810switch	…
ifenslave	…
ifmetric	…
iio-sensor-proxy	…
ima-evm-utils	…
input-utils	…
intel-compute-runtime	…
intel-ocl	…
intel-speed-select	…
iomelt	…
ioport	…
iotop	…
iproute	iproute2: 5.11.0 -> 5.12.0	2021-04-28 18:06:48 +00:00
ipsec-tools	kerberos: deprecate alias	2021-04-04 03:18:56 +02:00
ipset	…
iptables	…
iptstate	…
iputils	apparmor: fix profile building on darwin	2021-05-14 17:37:33 +02:00
ipvsadm	…
irqbalance	…
isgx	linuxPackages.isgx: limit to x86_64	2021-04-21 23:39:53 +02:00
it87	…
iw	…
iwd	iwd: 1.12 -> 1.14	2021-05-13 21:51:29 +02:00
ixgbevf	…
jfbview	…
jool	…
joycond	joycond: init at unstable-2021-03-27	2021-04-04 18:17:00 +02:00
jujuutils	…
kbd	kbd: update search-paths.patch	2021-07-23 11:51:10 +02:00
kbdlight	…
kernel	linux: build hardened kernel with matching releases	2021-10-28 22:26:22 +02:00
kernel-headers	bionic: use fetchzip for everything (#123010)	2021-05-16 01:24:27 -04:00
kexectools	…
keyutils	…
klibc	klibc: 2.0.8 -> 2.0.9	2021-05-08 17:09:38 -07:00
kmod	…
kmod-blacklist-ubuntu	…
kmod-debian-aliases	…
kmscon	…
kmscube	…
latencytop	…
ldm	…
ledger-udev-rules	…
libaio	…
libatasmart	…
libbpf	…
libcap	libcap: use correct runtime shell	2021-04-11 09:46:37 +02:00
libcap-ng	…
libcgroup	libcgroup: 0.41 -> 0.42.2	2021-05-22 15:21:31 +02:00
libevdevc	…
libfabric	libfabric: 1.12.0 -> 1.12.1	2021-04-04 21:37:05 +00:00
libgestures	…
libnl	libnl: python is optional	2021-04-03 17:06:08 +02:00
libpsm2	…
libratbag	…
libselinux	libselinux: fix build with musl (#119472)	2021-04-15 23:18:51 +02:00
libsemanage	…
libsepol	libsepol: fix static build	2021-05-02 20:51:51 +02:00
libsmbios	…
libudev0-shim	…
libvolume_id	…
libwebcam	…
light	…
lightum	…
linuxptp	linuxptp: 3.1 -> 3.1.1	2021-07-10 11:29:04 +00:00
lksctp-tools	…
lm-sensors	lm_sensors: add meta.mainProgram	2021-04-29 14:51:50 +02:00
lockdep	…
logitech-udev-rules	logitech-udev-rules: truly minor permission fix	2021-05-16 11:04:34 +08:00
lsb-release	…
lsiutil	…
lsscsi	lsscsi: 0.31 -> 0.32	2021-05-17 10:57:40 -07:00
lttng-modules	…
lvm2	lvm2: 2.03.11 -> 2.03.12	2021-05-15 08:55:27 -07:00
lxc	lxc: 4.0.8 -> 4.0.9	2021-05-05 04:20:00 +00:00
lxcfs	lxcfs: 4.0.7 -> 4.0.8	2021-05-01 22:46:06 +00:00
macchanger	macchanger: apply patches from Debian	2021-04-04 21:34:59 +02:00
mba6x_bl	…
mbp-modules/mbp2018-bridge-drv	mbp2018-bridge-drv: fix source	2021-05-11 10:08:53 +02:00
mbpfan	…
mcelog	…
mdadm	…
mdevd	mdevd: init at 0.1.3.0	2021-04-11 10:22:29 +00:00
metastore	…
microcode	microcodeIntel: 20210216 -> 20210608	2021-06-16 13:12:03 -07:00
mingetty	…
miraclecast	miraclecast: don't manually enableParallelBuilding	2021-05-12 11:57:35 +00:00
mkinitcpio-nfs-utils	…
mmc-utils	mmc-utils: 2019-10-04 -> 2021-05-11	2021-05-15 04:32:28 -04:00
molly-guard	…
msr-tools	…
mstpd	…
multipath-tools	…
musl	musl: 1.2.1 -> 1.2.2	2021-03-23 15:45:23 +00:00
musl-fts	…
musl-obstack	…
mwprocapture	Update pkgs/os-specific/linux/mwprocapture/default.nix	2021-06-28 08:37:52 -07:00
mxu11x0	…
ndiswrapper	…
net-tools	…
netatop	netatop: Split out path fixing and PIDFile changes to separate patches and comment	2021-05-16 22:07:24 +02:00
nfs-utils	kerberos: deprecate alias	2021-04-04 03:18:56 +02:00
nftables	…
nixos-rebuild	Merge pull request #126960 from NixOS/backport-123720-to-release-21.05	2021-08-06 16:59:35 +03:00
nmon	…
nss_ldap	…
numactl	…
numad	…
numatop	…
numworks-udev-rules	…
nvidia-x11	nvidia_x11: 470.57.02 → 470.63.01	2021-09-26 08:53:04 +02:00
nvidiabl	…
nvme-cli	nvme-cli: add mic92 as maintainer	2021-04-22 02:33:31 +02:00
nvmet-cli	…
oci-seccomp-bpf-hook	linuxPackages.oci-seccomp-bpf-hook: 1.2.2 -> 1.2.3	2021-04-27 15:13:40 +02:00
odp-dpdk	odp-dpdk: 1.22.0.0_DPDK_18.11 -> 1.27.0.0_DPDK_19.11	2021-05-24 09:18:28 +02:00
ofp	…
open-iscsi	…
open-isns	…
opengl/xorg-sys	…
openrazer	openrazer: 3.0.0 -> 3.0.1, mark broken for kernels < 4.19	2021-05-09 14:57:27 +08:00
openvswitch	openvswitch: add patch for CVE-2021-36980	2021-08-14 22:26:16 +01:00
otpw	…
pagemon	…
pam	…
pam_ccreds	…
pam_gnupg	…
pam_krb5	kerberos: deprecate alias	2021-04-04 03:18:56 +02:00
pam_ldap	…
pam_mount	…
pam_p11	…
pam_pgsql	…
pam_ssh_agent_auth	…
pam_u2f	pam_u2f: 1.1.0 -> 1.1.1	2021-06-05 11:33:09 +00:00
pam_usb	…
pax-utils	…
paxctl	…
paxtest	…
pcimem	…
pcm	…
pcmciautils	yacc: deprecate alias	2021-04-04 03:18:58 +02:00
perf-tools	…
pflask	…
phc-intel	…
piper	gnome: rename from gnome3	2021-05-08 09:47:42 +02:00
pipework	iproute: deprecate alias	2021-04-04 01:43:46 +02:00
pktgen	pktgen: 19.12.0 -> 21.05.0	2021-05-24 09:18:27 +02:00
ply	yacc: deprecate alias	2021-04-04 03:18:58 +02:00
plymouth	…
pm-utils	…
pmount	…
policycoreutils	…
pommed-light	…
power-calibrate	…
power-profiles-daemon	power-profiles-daemon: 0.1 -> 0.8.1	2021-04-05 10:04:44 +02:00
powercap	powercap: init at 0.3.1	2021-03-25 16:11:44 +01:00
powerstat	…
powertop	…
pps-tools	…
prl-tools	…
procdump	…
procps-ng	…
pscircle	…
psftools	…
psmisc	…
r8125	…
r8168	…
radeontools	…
radeontop	Drop maintainership for some packages	2021-04-18 09:00:18 +02:00
raspberrypi-eeprom	raspberrypi-eeprom: 2021-01-11 -> 2021-03-18	2021-04-05 05:54:58 +02:00
rdma-core	Merge branch 'master' into staging-next	2021-04-06 16:01:14 +02:00
read-edid	…
regionset	…
reptyr	…
rewritefs	…
rfkill	…
roccat-tools	…
rtkit	…
rtl88x2bu	linuxPackages.rtl88x2bu: switch to more maintained fork	2021-05-20 11:50:55 -07:00
rtl88xxau-aircrack	linuxPackages_5_12.rtl88xxau-aircrack: fix build	2021-05-20 17:09:53 -07:00
rtl8192eu	rtl8192eu: 20200620 -> 20210403, mark as broken for aarch64	2021-05-13 11:57:16 -07:00
rtl8723bs	…
rtl8812au	linuxPackages.rtl8812au: add myself as maintainer, cleanup	2021-05-20 09:06:36 -07:00
rtl8814au	linuxPackages.rtl8814au: move to a more maintained fork	2021-05-19 13:34:25 +08:00
rtl8821au	linuxPackages.rtl8821au: switch to a more maintained fork	2021-05-20 11:46:46 -07:00
rtl8821ce	linuxPackages.rtl8821ce: mark broken for aarch64	2021-05-19 10:11:38 -07:00
rtl8821cu	linuxPackages.rtl8821cu: switch to a more maintained fork	2021-05-19 16:46:32 +08:00
rtw88	linuxPackages.rtw88: 2021-04-01 -> 2021-04-19	2021-04-21 10:03:49 +02:00
rtw89	rtw89: init at 2021-07-03 (#129325)	2021-07-10 00:57:06 +08:00
s6-linux-init	…
s6-linux-utils	…
sch_cake	…
schedtool	…
sd-switch	sd-switch: 0.2.1 -> 0.2.2	2021-05-20 17:19:22 -07:00
sdnotify-wrapper	…
sdparm	…
selinux-python	…
selinux-sandbox	…
semodule-utils	…
sepolgen	…
service-wrapper	…
setools	…
seturgent	…
shadow	shadow: add runtime-shell.patch	2021-04-11 02:42:53 +02:00
sinit	…
smem	…
smemstat	…
speedometer	…
sssd	sssd: 1.16.4 -> 1.16.5	2021-05-26 12:04:22 +02:00
statifier	…
swapview	treewide: fix cargoSha256/cargoHash	2021-05-08 00:36:37 -07:00
switcheroo-control	…
syscall_limiter	…
sysdig	…
sysfsutils	…
sysklogd	…
syslinux	treewide: convert all links git.archlinux.org to github.com/archlinux/svntogit-*	2021-07-18 09:17:54 +00:00
sysstat	…
system76	…
system76-acpi	…
system76-io	…
systemd	systemd: Patch CVE-2021-33910	2021-07-21 21:56:15 +02:00
systemd-wait	…
sysvinit	…
target-isns	…
targetcli	…
tbs	…
tcp-wrappers	…
teck-udev-rules	teck-udev-rules: init	2021-04-20 09:10:43 +02:00
thunderbolt	…
tiptop	…
tiscamera	tiscamera: 0.11.1 -> 0.13.1	2021-05-12 01:35:29 -03:00
tmon	…
tomb	…
tp_smapi	…
tpacpi-bat	…
trace-cmd	trace-cmd: 2.9-dev -> 2.9.1, kernelshark: 1.1.0 -> 1.2	2021-03-22 11:00:26 +01:00
trezor-udev-rules	…
trinity	…
tuigreet	treewide: fix cargoSha256/cargoHash	2021-05-08 00:36:37 -07:00
tunctl	…
turbostat	…
tuxedo-keyboard	linuxPackages.tuxedo-keyboard: expose all kernel modules	2021-08-30 00:58:37 +02:00
uclibc	…
udisks	…
udisks-glue	…
undervolt	…
unstick	…
untie	…
upower	…
usbguard	…
usbip	linuxPackages.usbip: clarify license	2021-04-26 00:15:44 +02:00
usbtop	…
usbutils	usbutils: 012 -> 013	2021-06-01 16:40:07 +00:00
usermount	…
util-linux	util-linux: adjust meta.license	2021-04-09 19:42:27 +00:00
uvcdynctrl	…
v4l-utils	…
v4l2loopback	linuxPackages_4_4.v4l2loopback: fix build for 4.4 kernels	2021-06-07 00:48:26 +00:00
v86d	…
vendor-reset	vendor-reset: init at unstable-2021-02-16	2021-04-06 10:49:58 +07:00
virtualbox	…
wireguard	linuxPackages_5_4.wireguard: 1.0.20210424 -> 1.0.20210606	2021-06-14 11:53:30 +00:00
wireless-tools	…
wlgreet	treewide: fix cargoSha256/cargoHash	2021-05-08 00:36:37 -07:00
wooting-udev-rules	…
wpa_supplicant	wpa_supplicant: review fixes	2021-04-16 13:28:26 +02:00
x86_energy_perf_policy	…
x86info	…
xf86-input-cmt	…
xf86-input-wacom	…
xf86-video-nested	…
xpadneo	maintainers: rename metadark -> kira-bruneau (#124035)	2021-05-22 16:47:40 +02:00
xsensors	…
zenmonitor	…
zenpower	…
zenstates	…
zfs	zfsUnstable: 2.1.0 -> 2.1.1	2021-09-21 20:33:02 +02:00
zsa-udev-rules	…