From 8fd84fcb870b3d55f6760ede5bb46aa57bbec64e Mon Sep 17 00:00:00 2001
From: Michael Raskin <7c6f434c@mail.ru>
Date: Mon, 1 Aug 2016 17:22:28 +0200
Subject: [PATCH] libreoffice: reinstante and use curl 7.48 before the removal
 of a required feature. CVE's not fixed because of that decision: a
 Windows-specific DLL substitution and a mbedSSL/PolarSSL specific
 insufficient certificate validation

---
 pkgs/tools/networking/curl/7.48.nix | 90 +++++++++++++++++++++++++++++
 pkgs/top-level/all-packages.nix     |  9 +++
 2 files changed, 99 insertions(+)
 create mode 100644 pkgs/tools/networking/curl/7.48.nix

diff --git a/pkgs/tools/networking/curl/7.48.nix b/pkgs/tools/networking/curl/7.48.nix
new file mode 100644
index 000000000000..d156423a5478
--- /dev/null
+++ b/pkgs/tools/networking/curl/7.48.nix
@@ -0,0 +1,90 @@
+{ stdenv, fetchurl, pkgconfig, perl
+, http2Support ? true, nghttp2
+, idnSupport ? false, libidn ? null
+, ldapSupport ? false, openldap ? null
+, zlibSupport ? false, zlib ? null
+, sslSupport ? false, openssl ? null
+, scpSupport ? false, libssh2 ? null
+, gssSupport ? false, gss ? null
+, c-aresSupport ? false, c-ares ? null
+}:
+
+assert http2Support -> nghttp2 != null;
+assert idnSupport -> libidn != null;
+assert ldapSupport -> openldap != null;
+assert zlibSupport -> zlib != null;
+assert sslSupport -> openssl != null;
+assert scpSupport -> libssh2 != null;
+assert c-aresSupport -> c-ares != null;
+
+stdenv.mkDerivation rec {
+  name = "curl-7.48.0";
+
+  src = fetchurl {
+    url = "http://curl.haxx.se/download/${name}.tar.bz2";
+    sha256 = "0ly7fbysxrdbclswcr6s7n5sfxfffzazv8blqr16sn0b44cphkl6";
+  };
+
+  outputs = [ "dev" "out" "bin" "man" "docdev" ];
+
+  nativeBuildInputs = [ pkgconfig perl ];
+
+  # Zlib and OpenSSL must be propagated because `libcurl.la' contains
+  # "-lz -lssl", which aren't necessary direct build inputs of
+  # applications that use Curl.
+  propagatedBuildInputs = with stdenv.lib;
+    optional http2Support nghttp2 ++
+    optional idnSupport libidn ++
+    optional ldapSupport openldap ++
+    optional zlibSupport zlib ++
+    optional gssSupport gss ++
+    optional c-aresSupport c-ares ++
+    optional sslSupport openssl ++
+    optional scpSupport libssh2;
+
+  # for the second line see http://curl.haxx.se/mail/tracker-2014-03/0087.html
+  preConfigure = ''
+    sed -e 's|/usr/bin|/no-such-path|g' -i.bak configure
+    rm src/tool_hugehelp.c
+  '';
+
+  configureFlags = [
+      "--with-ca-bundle=/etc/ssl/certs/ca-certificates.crt"
+      "--disable-manual"
+      ( if sslSupport then "--with-ssl=${openssl.dev}" else "--without-ssl" )
+      ( if scpSupport then "--with-libssh2=${libssh2.dev}" else "--without-libssh2" )
+      ( if ldapSupport then "--enable-ldap" else "--disable-ldap" )
+      ( if ldapSupport then "--enable-ldaps" else "--disable-ldaps" )
+      ( if idnSupport then "--with-libidn=${libidn.dev}" else "--without-libidn" )
+    ]
+    ++ stdenv.lib.optional c-aresSupport "--enable-ares=${c-ares}"
+    ++ stdenv.lib.optional gssSupport "--with-gssapi=${gss}";
+
+  CXX = "g++";
+  CXXCPP = "g++ -E";
+
+  postInstall = ''
+    moveToOutput bin/curl-config "$dev"
+    sed '/^dependency_libs/s|${libssh2.dev}|${libssh2.out}|' -i "$out"/lib/*.la
+  '';
+
+  crossAttrs = {
+    # We should refer to the cross built openssl
+    # For the 'urandom', maybe it should be a cross-system option
+    configureFlags = [
+        ( if sslSupport then "--with-ssl=${openssl.crossDrv}" else "--without-ssl" )
+        "--with-random /dev/urandom"
+      ];
+  };
+
+  passthru = {
+    inherit sslSupport openssl;
+  };
+
+  meta = with stdenv.lib; {
+    description = "A command line tool for transferring files with URL syntax";
+    homepage    = http://curl.haxx.se/;
+    maintainers = with maintainers; [ lovek323 ];
+    platforms   = platforms.all;
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index c35136b1637c..79ae2523ff69 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1235,6 +1235,14 @@ in
     scpSupport = zlibSupport && !stdenv.isSunOS && !stdenv.isCygwin;
   };
 
+  curl_7_48 = callPackage ../tools/networking/curl/7.48.nix rec {
+    fetchurl = fetchurlBoot;
+    http2Support = !stdenv.isDarwin;
+    zlibSupport = true;
+    sslSupport = zlibSupport;
+    scpSupport = zlibSupport && !stdenv.isSunOS && !stdenv.isCygwin;
+  };
+
   curl3 = callPackage ../tools/networking/curl/7.15.nix rec {
     zlibSupport = true;
     sslSupport = zlibSupport;
@@ -13720,6 +13728,7 @@ in
     harfbuzz = harfbuzz.override {
       withIcu = true; withGraphite2 = true;
     };
+    curl = curl_7_48;
   });