1
0
Fork 1
mirror of https://github.com/NixOS/nixpkgs.git synced 2024-12-12 15:47:28 +00:00
Commit graph

1784 commits

Author SHA1 Message Date
Eelco Dolstra 1efedc6c4c firefox-esr: 45.2.0 -> 45.3.0 2016-08-19 13:26:20 +02:00
Eelco Dolstra 360ee2f0b9 firefox: 48.0 -> 48.0.1 2016-08-19 13:25:43 +02:00
taku0 0cd039b40e firefox-bin: 48.0 -> 48.0.1 2016-08-19 03:12:15 +09:00
Gábor Lehel 5bef9b271c vivaldi: 1.2 -> 1.3 2016-08-18 15:13:39 +02:00
Nikolay Amiantov 1c5399626a qutebrowser: don't depend on qtmultimedia
It's not needed now that qtwebkit uses gstreamer backend
2016-08-17 20:30:50 +03:00
Nikolay Amiantov 1d53115765 qutebrowser: use qtwebkit-plugins 2016-08-17 20:20:35 +03:00
Robin Gloster 33e1c78ae3 Merge remote-tracking branch 'upstream/master' into hardened-stdenv 2016-08-16 07:54:01 +00:00
Nikolay Amiantov 9b4a7984a4 qutebrowser: add shared files and cleanup 2016-08-15 11:38:53 +03:00
Mike Cooper b5194d7b9a firefox-bin: Add libxcb to build inputs (#17700)
This is needed for future versions of Firefox, and makes external
packaging of prerelease versions of Firefox much easier.
2016-08-15 01:03:19 +02:00
Ram Kromberg 7802a0f14b midori: update to current webkitgtk (#17731) 2016-08-14 21:49:19 +00:00
Robin Gloster b7787d932e Merge remote-tracking branch 'upstream/master' into hardened-stdenv 2016-08-12 09:46:53 +00:00
Eelco Dolstra 8877b93649 firefox: 47.0.1 -> 48.0 2016-08-11 16:09:00 +02:00
obadz 3822c56e1e chromium: minor fixups
cc @aszlig
2016-08-10 02:35:59 +01:00
obadz 20f009d56d chromium: split the sandbox into a seperate output (take 2)
Fixup of 231ed9e
2016-08-06 14:42:13 +01:00
obadz 231ed9edd9 chromium: split the sandbox into a separate output
Related to #17460 and 66d5edf
Triggers a rebuild of Chromium
2016-08-06 10:29:56 +01:00
obadz 66d5edf654 chromium: add nixos module security.chromiumSuidSandbox
Closes #17460

Changed the wrapper derivation to produce a second output containing the sandbox.
Add a launch wrapper to try and locate the sandbox (either in /var/setuid-wrappers or in /nix/store).
This launch wrapper also sheds libredirect.so from LD_PRELOAD as Chromium does not tolerate it.

Does not trigger a Chromium rebuild.

cc @cleverca22 @joachifm @jasom
2016-08-06 10:27:47 +01:00
obadz d6528a1b7f chromium: fixup commit 33557ac
Helps with #17460

@cleverca22 saw calls to SetuidSandboxHost::GetSandboxBinaryPath so we
patch this function instead.

cc @joachifm
2016-08-05 10:55:48 +01:00
obadz 33557acb36 chromium: add ability to control which sandbox is used
First step towards addressing #17460

In order to be able to run the SUID sandbox, which is good for security
and required to run Chromium with any kind of reasonable sandboxing when
using grsecurity kernels, we want to be able to control where the
sandbox comes from in the Chromium wrapper. This commit patches the
appropriate bit of source and adds the same old sandbox to the wrapper
(so it should be a no-op)
2016-08-04 20:37:35 +01:00
Benjamin Staffin 78e5e61bbe Update google-chrome versions
The previous download links were all broken.

Stable: 51.0.2704.103 -> 52.0.2743.116
Beta:   52.0.2743.41  -> 53.0.2785.34
Dev:    53.0.2767.4   -> 54.0.2816.0
2016-08-04 00:22:58 -04:00
Rok Garbas 2a4312d92b
firefox-beta-bin: 48.0b9 -> 49.0b1 2016-08-03 19:39:46 +02:00
Robin Gloster 1b979d8384 Merge remote-tracking branch 'upstream/master' into hardened-stdenv 2016-08-03 13:34:44 +00:00
mimadrid 4a06ece723
qutebrowser: 0.8.1 -> 0.8.2 2016-08-03 11:02:02 +02:00
Tuomas Tynkkynen 21f17d69f6 treewide: Add lots of meta.platforms
Build-tested on x86_64 Linux & Mac.
2016-08-02 21:42:43 +03:00
Tuomas Tynkkynen 2258b21e4b treewide: Add lots of platforms to packages with no meta
Build-tested on x86_64 Linux and on Darwin.
2016-08-02 21:17:44 +03:00
Tuomas Tynkkynen 59ce911810 treewide: Some EOF-whitespace fixes 2016-08-02 21:17:44 +03:00
taku0 47024938a2 firefox-bin: 47.0.1 -> 48.0 (#17452) 2016-08-02 16:55:55 +02:00
Robin Gloster 63c7b4f9a7 Merge remote-tracking branch 'upstream/master' into hardened-stdenv 2016-07-31 20:51:34 +00:00
Miguel Madrid 94549d4fab qutebrowser: 0.8.0 -> 0.8.1 (#17302) 2016-07-27 15:50:29 +01:00
Gabriel Ebner 7fce7c5a07 qutebrowser: 0.7.0 -> 0.8.0 2016-07-26 14:53:59 +02:00
Ram Kromberg 5685968ca6 midori: 0.5.8 -> 0.5.11 (#17142) 2016-07-25 21:25:42 +01:00
Kranium Gikos Mendoza a5d1c8d471 bluejeans: 2.160.63.8 -> 2.160.66.8 (#17232) 2016-07-25 20:53:32 +01:00
Robin Gloster 1f04b4a566 Merge remote-tracking branch 'upstream/master' into hardened-stdenv 2016-07-21 00:56:43 +00:00
Rok Garbas f5dca01b50 firefox-bin: 48.0b7 -> 48.0b9 2016-07-21 00:59:56 +02:00
Rok Garbas 0558ae3057 firefox-bin: libpulseaudio.dev is needed otherwise firefox doesn't start 2016-07-21 00:56:38 +02:00
Frederik Rietdijk bae6ad8efa uzbl: fix build
See also #16740.
2016-07-19 15:06:42 +02:00
Robin Gloster 203846b9de Merge remote-tracking branch 'upstream/master' into hardened-stdenv 2016-07-19 10:37:02 +00:00
Rok Garbas a377c71280 firefox-bin: 48.0b1 -> 48.0b7
* removed firefox-developer-bin
* extend firefox-bin expression to accept sources as input so
  firefox-developer-bin can be packaged outside nixpkgs
* generate_sources.rb now includes full urls in the output
2016-07-16 13:04:04 +02:00
Robin Gloster 5185bc1773 Merge remote-tracking branch 'upstream/master' into hardened-stdenv 2016-07-15 14:41:01 +00:00
Ram Kromberg 6046702e5e flashplayer: 11.2.202.626 -> 11.2.202.632 2016-07-14 12:42:26 +03:00
zimbatm a265ad2842 firefox-developer-bin: fix hashes (#16860)
the nightly tend to get replaced in-place on the FTP and so benefit from
an update script as well
2016-07-11 13:40:58 +02:00
Oliver Charles 65ac26e28a Merge pull request #16841 from womfoo/bump/bluejeans-2.160.63.8
bluejeans: 2.160.49.8 -> 2.160.63.8
2016-07-11 10:00:18 +01:00
Kranium Gikos Mendoza 5da05eef62 bluejeans: 2.160.49.8 -> 2.160.63.8 2016-07-10 23:52:23 +08:00
Tobias Geerinckx-Rice 921d3321f5
trezor-bridge: mark as broken
Cool, a bitcoin wallet app silently changes its hash.

CC maintainer @ehmry
2016-07-06 19:42:45 +02:00
Miguel Madrid 87be90336f links2: 2.12 -> 2.13 (#16756) 2016-07-06 19:40:05 +02:00
taku0 a10ddb582e firefox-bin: 47.0 -> 47.0.1 (#16599) 2016-06-30 23:39:45 +02:00
Eelco Dolstra 0967b0d303 firefox-esr: Fix build
http://hydra.nixos.org/build/36668046
2016-06-29 17:23:03 +02:00
Eelco Dolstra 0c832dceb2 firefox-esr: 45.1.1 -> 45.2.0 2016-06-29 16:08:26 +02:00
Eelco Dolstra 653be3c802 firefox: 47.0 -> 47.0.1 2016-06-29 16:06:50 +02:00
zimbatm e25933ac6e Merge pull request #16410 from womfoo/conkeror
conkeror: 1.0pre-20160130 -> 1.0.3
2016-06-22 21:47:13 +01:00
Marius Bakke 4a7d31a392 treewide: remove double quotes from wrappers
Close #14753; see that for context.
2016-06-22 11:12:27 +02:00
Kranium Gikos Mendoza ac680eed2b conkeror: 1.0pre-20160130 -> 1.0.3 2016-06-22 07:14:03 +08:00
aszlig 9728554c4f
Merge pull request #16099 (Chromium update)
The changes contain an update of the stable channel (along with beta and
dev as well) fixing 18 security vulnerabilities:

http://googlechromereleases.blogspot.de/2016/06/stable-channel-update.html
http://googlechromereleases.blogspot.de/2016/06/stable-channel-update_6.html
http://googlechromereleases.blogspot.de/2016/06/stable-channel-update_16.html

I've built and tested this at the following evaluation on my Hydra:

https://headcounter.org/hydra/eval/324449
2016-06-20 18:43:41 +02:00
Bjørn Forsman bd01fad0ed Captialize meta.description of all packages
In line with the Nixpkgs manual.

A mechanical change, done with this command:

  find pkgs -name "*.nix" | \
      while read f; do \
          sed -e 's/description\s*=\s*"\([a-z]\)/description = "\u\1/' -i "$f"; \
      done

I manually skipped some:

* Descriptions starting with an abbreviation, a user name or package name
* Frequently generated expressions (haskell-packages.nix)
2016-06-20 13:55:52 +02:00
Scott R. Parish 1f1f0f049b chromium: Update to latest stable, beta, and dev channels
stable 51.0.2704.63 => 51.0.2704.103
beta   51.0.2704.63 => 52.0.2743.41
dev    52.0.2743.10 => 53.0.2767.4

This addresses 15 security fixes, including:

 * High   CVE-2015-1696: Cross-origin bypass in Extension bindings. Credit to
                         anonymous.
 * High   CVE-2015-1697: Cross-origin bypass in Blink. Credit to Mariusz
                         Mlynski.
 * Medium CVE-2016-1698: Information leak in Extension bindings. Credit to
                         Rob Wu.
 * Medium CVE-2016-1699: Parameter sanitization failure in DevTools. Credit
                         to Gregory Panakkal.
 * Medium CVE-2016-1700: Use-after-free in Extensions. Credit to Rob Wu.
 * Medium CVE-2016-1701: Use-after-free in Autofill. Credit to Rob Wu.
 * Medium CVE-2016-1702: Out-of-bounds read in Skia. Credit to cloudfuzzer.

See: http://googlechromereleases.blogspot.com/2016/06/stable-channel-update.html
2016-06-19 19:50:45 -07:00
Gabriel Ebner 9988488fc6 qutebrowser: use makeQtWrapper
Fixes #15597.
2016-06-19 14:42:13 +02:00
Gabriel Ebner 5862c38d9d qutebrowser: 0.6.2 -> 0.7.0 2016-06-19 14:08:09 +02:00
taku0 c802f56639 flashplayer: 11.2.202.621 -> 11.2.202.626 2016-06-16 21:24:38 +09:00
Arseniy Seroka d4876168e2 Merge pull request #16140 from hiberno/update-vivaldi
vivaldi: 1.1 -> 1.2
2016-06-11 22:32:38 +03:00
Arseniy Seroka 263edf8897 Merge pull request #16147 from womfoo/bluejeans
bluejeans: 2.155.17.5 -> 2.160.49-8
2016-06-11 22:31:46 +03:00
Christian Lask da0b516a5f vivaldi: 1.1 -> 1.2 2016-06-11 09:55:32 +02:00
Kranium Gikos Mendoza 1497998a40 bluejeans: 2.155.17.5 -> 2.160.49-8 2016-06-11 06:29:52 +08:00
Robin Gloster 8031cba2ab Merge remote-tracking branch 'upstream/master' into hardened-stdenv 2016-06-10 09:27:04 +00:00
Christian Lask 527077f02c qutebrowser: 0.6.1 -> 0.6.2 2016-06-10 10:11:59 +02:00
Rok Garbas 4c96860b53 firefox-bin: 47.0b9 -> 48.0b1, 48.0a2 -> 49.0a2 2016-06-10 04:24:27 +02:00
Joachim Fasting ccf7048307 Merge pull request #16057 from taku0/firefox-bin-47.0
firefox-bin: 46.0.1 -> 47.0
2016-06-08 17:20:24 +02:00
Michael Raskin d88aa14c6e Firefox: 46.0.1 -> 47.0 2016-06-08 17:09:12 +02:00
taku0 697437c8e7 firefox-bin: 46.0.1 -> 47.0 2016-06-07 03:23:43 +09:00
Tuomas Tynkkynen bac26e08db Fix lots of fetchgit hashes (fallout from #15469) 2016-06-03 17:17:08 +03:00
Robin Gloster 2d382f3d98 Merge remote-tracking branch 'upstream/master' into hardened-stdenv 2016-05-30 19:39:34 +00:00
Rok Garbas ea3f1ff7f0 firefox-bin: 47.0b8 -> 47.0b9 2016-05-30 11:27:45 +02:00
aszlig 79d18eb604
chromium: Update dev channel to v52.0.2743.10
With this update we need to rebase the nix_plugin_paths patch, which was
done by @srp and I took it from his comment at:

https://github.com/NixOS/nixpkgs/pull/15762#issuecomment-222230677

Other than that, using libjpeg from nixpkgs fails to link:

https://headcounter.org/hydra/build/1114273

Rather than just using versionAtLeast to check for >= version 52, we're
matching on the explicit version number. That way we can make sure that
we (try to) build with system libjpeg again so we can keep it out of the
overall Chromium build time.

Built and tested using the VM tests on my Hydra at:

https://headcounter.org/hydra/eval/322006

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2016-05-28 19:15:39 +02:00
aszlig c7a3645e7b
chromium: Remove stuff for versions <= v51
We're already on version 52, so there really is no need to keep all
those conditionals and old patches anymore.

Tested dropping the unconditional build_fixes_46.patch via the Chromium
VM tests.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2016-05-28 19:04:22 +02:00
aszlig 0f4095ec50
chromium: Fix hash for beta Debian package
I'm not sure how the wrong hash ended up being there, but I've checked
the hash from three different machines (and networks) just to be sure I
didn't make a mistake.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2016-05-28 18:57:15 +02:00
Scott R. Parish e2d067d760
chromium: Update to latest stable and beta channel
Overview of updated versions:

stable: 50.0.2661.102 -> 51.0.2704.63
beta: 51.0.2704.47 -> 51.0.2704.63

I tried to update dev, but couldn't get it to compile, it was failing
with a "'isnan' was not declared in this scope.

As far as I can tell, at the moment the beta and stable channels are
on the same version.

The stable update addresses the following security issues:

  * High   CVE-2016-1672: Cross-origin bypass in extension bindings. Credit
                          to Mariusz Mlynski.
  * High   CVE-2016-1673: Cross-origin bypass in Blink. Credit to Mariusz
                          Mlynski.
  * High   CVE-2016-1674: Cross-origin bypass in extensions. Credit to Mariusz
                          Mlynski.
  * High   CVE-2016-1675: Cross-origin bypass in Blink. Credit to Mariusz
                          Mlynski.
  * High   CVE-2016-1676: Cross-origin bypass in extension bindings. Credit
                          to Rob Wu.
  * Medium CVE-2016-1677: Type confusion in V8. Credit to Guang Gong of
                        Qihoo 360.
  * High   CVE-2016-1678: Heap overflow in V8. Credit to Christian Holler.
  * High   CVE-2016-1679: Heap use-after-free in V8 bindings. Credit to Rob Wu.
  * High   CVE-2016-1680: Heap use-after-free in Skia. Credit to Atte Kettunen
                          of OUSPG.
  * High   CVE-2016-1681: Heap overflow in PDFium. Credit to Aleksandar Nikolic
                          of Cisco Talos.
  * Medium CVE-2016-1682: CSP bypass for ServiceWorker. Credit to
                          KingstonTime.
  * Medium CVE-2016-1683: Out-of-bounds access in libxslt. Credit to Nicolas
                          Gregoire.
  * Medium CVE-2016-1684: Integer overflow in libxslt. Credit to Nicolas
                          Gregoire.
  * Medium CVE-2016-1685: Out-of-bounds read in PDFium. Credit to Ke Liu
                          of Tencent's Xuanwu LAB.
  * Medium CVE-2016-1686: Out-of-bounds read in PDFium. Credit to Ke Liu
                          of Tencent's Xuanwu LAB.
  * Medium CVE-2016-1687: Information leak in extensions. Credit to Rob Wu.
  * Medium CVE-2016-1688: Out-of-bounds read in V8. Credit to Max Korenko.
  * Medium CVE-2016-1689: Heap buffer overflow in media. Credit to Atte
                          Kettunen of OUSPG.
  * Medium CVE-2016-1690: Heap use-after-free in Autofill. Credit to Rob Wu.
  * Low    CVE-2016-1691: Heap buffer-overflow in Skia. Credit to Atte Kettunen
                          of OUSPG.
  * Low    CVE-2016-1692: Limited cross-origin bypass in ServiceWorker. Credit
                          to Til Jasper Ullrich.
  * Low    CVE-2016-1693: HTTP Download of Software Removal Tool. Credit to
                          Khalil Zhani.
  * Low    CVE-2016-1694: HPKP pins removed on cache clearance. Credit to Ryan
                          Lester and Bryant Zadegan.

See: http://googlechromereleases.blogspot.com/2016/05/stable-channel-update_25.html
2016-05-28 18:12:39 +02:00
Vladimír Čunát 81039713fa Merge branch 'master' into staging
... to get the systemd update (rebuilding ~7k jobs).
2016-05-26 16:50:22 +02:00
Rok Garbas 1908c90412 firefox-bin: 47.0b7 -> 47.0b8 2016-05-25 11:42:40 +02:00
Rok Garbas 03f36a4141 firefox-bin: 47.0b5 -> 47.0b7 2016-05-24 12:36:23 +02:00
Vladimír Čunát c4661e9643 Merge: make dev output references explicit
This is a rebase of most commits from #14766,
resolving conflicts and a few other evaluation problems.
2016-05-22 12:09:23 +02:00
Tuomas Tynkkynen 2a73de6e6c treewide: Make explicit that 'dev' output of openssl is used 2016-05-19 10:02:23 +02:00
Tuomas Tynkkynen 825bd69b38 treewide: Make explicit that 'dev' output of boehmgc is used 2016-05-19 10:00:27 +02:00
Nikolay Amiantov 5445e521b6 firefox: restore gstreamer support for older firefox releases 2016-05-19 00:28:49 +03:00
Franz Pletz f8d481754c
Merge remote-tracking branch 'origin/master' into hardened-stdenv 2016-05-18 17:10:02 +02:00
Franz Pletz 2007e9b140
firefox: reenable libvpx as 1.5 is now available 2016-05-17 01:05:46 +02:00
Tobias Geerinckx-Rice e8db151fa3
firefox-bin: fix evaluation 2016-05-15 23:22:50 +02:00
aszlig ad2c8d3510
chromium: Update to latest beta and dev channels
Overview of the updated versions:

beta: 50.0.2661.49 -> 51.0.2704.47
dev:  51.0.2693.2  -> 52.0.2729.3

It has been a while since we had a major Chromium update that compiled
and worked without troubles, but version 52 builds and the VM tests are
successful as well:

https://headcounter.org/hydra/eval/320335

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2016-05-15 05:17:51 +02:00
Rok Garbas d4fe0f522e firefox-bin: adding developer and beta channel 2016-05-15 03:00:44 +02:00
Nikolay Amiantov e81c6c7768 firefox: upstream moved to ffmpeg from gstreamer
Sadly, they don't support using system library yet (or I was unattentive).
2016-05-15 01:06:39 +03:00
Scott R. Parish 5ebf20db0f
chromium: Update stable to 50.0.2661.102 for multiple security fixes
This addresses the following security fixes:

 * High   CVE-2016-1667: Same origin bypass in DOM. Credit to
                         Mariusz Mlynski.
 * High   CVE-2016-1668: Same origin bypass in Blink V8 bindings. Credit
                         to Mariusz Mlynski.
 * High   CVE-2016-1669: Buffer overflow in V8. Credit to Choongwoo Han.
 * Medium CVE-2016-1670: Race condition in loader. Credit to anonymous.
 * Medium CVE-2016-1671: Directory traversal using the file scheme on
                         Android. Credit to Jann Horn.

See: http://googlechromereleases.blogspot.com/2016/05/stable-channel-update.html

Signed-off-by: Scott R. Parish <srparish@gmail.com>
Tested-by: aszlig <aszlig@redmoonstudios.org>
Closes: #15446
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2016-05-14 22:04:56 +02:00
Vladimír Čunát 3e387c3e00 Merge branch 'staging'
Darwin isn't in a perfect state, in particular its bootstrap tools won't
build which will block nixpkgs channel. But on the whole it seems
acceptable.
2016-05-13 10:14:53 +02:00
taku0 cade2f36e5 flashplayer: 11.2.202.616 -> 11.2.202.621 2016-05-12 21:58:26 +09:00
Vladimír Čunát 6c2fbfbd77 Merge branch 'master' into staging 2016-05-12 04:53:38 +02:00
Eelco Dolstra 86c45ba50d google-talk-plugin: 5.4.2.0 -> 5.41.0.0 2016-05-11 20:18:30 +02:00
Kranium Gikos Mendoza a36f721630 bluejeans: 2.125.24.5 -> 2.155.17.5 2016-05-11 21:47:12 +08:00
Eelco Dolstra cb37ab146b Add mirror://mozilla scheme 2016-05-09 19:37:22 +02:00
Eelco Dolstra de22402f85 firefox-esr: 45.0.2 -> 45.1.1 2016-05-09 15:28:13 +02:00
Eelco Dolstra 02d01dc7c5 firefox: 46.0 -> 46.0.1 2016-05-09 15:27:06 +02:00
Vladimír Čunát 65a9fa8cdc Merge branch 'master' into staging 2016-05-08 21:24:48 +02:00
taku0 07a83f226e firefox-bin: fixed missing icon 2016-05-08 17:06:08 +09:00
Wei Tang 4d15758984 firefox: Fix build due to commit #ab0a0c 2016-05-08 05:58:02 +02:00
Vladimír Čunát 1dc36904d8 Merge #14920: windows improvements, mainly mingw 2016-05-05 08:30:19 +02:00
aszlig 3f7735fe65
chromium+chrome: Don't import update.nix directly
Regression introduced by f28b71023c.

Let's now expose and use the upstream-info attribute via the main
Chromium derivation, so that other packages like the google-chrome
package doesn't need to rely on internals of the Chromium
implementation.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2016-05-04 23:12:33 +02:00
aszlig f28b71023c
chromium/updater: Don't import <nixpkgs> again
This effectively resets the attributes given at the point the main
<nixpkgs> is imported and thus for example is also reading in stuff like
~/.nixpkgs/config.nix again, which might lead to unexpected results.

We now only import <nixpkgs> now if the updater is auto-called (like in
update.sh), otherwise the required attributes are passed by callPackage
within the Chromium scope.

I remember noting about this a while ago either on IRC or on GitHub, but
I can't find it right now, so thanks to @obadz for reminding me about
this in #15225.

Tested this by running the updater and also using:

NIXPKGS_CONFIG=$(pwd)/broken.nix nix-instantiate --arg config {} -A chromium

The contents of broken.nix were:

EVALERR{

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
Fixes: #15225
2016-05-04 22:35:24 +02:00
Arseniy Seroka 9cb8abe846 Merge pull request #15208 from taku0/firefox-bin-46.0.1
firefox-bin: 45.0.2 -> 46.0.1
2016-05-04 21:38:47 +03:00
Eelco Dolstra 1f84e43239 Do some large, concurrency-capable builds on dedicated machines 2016-05-04 18:16:27 +02:00
Eelco Dolstra f2d24b9840 chromium: Disable Hydra builds of -dev and -beta
It's not the job of Nixpkgs to distribute beta versions of upstream
packages. More importantly, building these delays channel updates by
several hours, which is bad for our security fix turnaround time.
2016-05-04 18:16:27 +02:00
taku0 90f5be3133 firefox-bin: 45.0.2 -> 46.0.1 2016-05-04 14:50:17 +09:00
Tuomas Tynkkynen aadaa91379 Merge remote-tracking branch 'upstream/master' into staging
Conflicts:
	pkgs/applications/networking/browsers/vivaldi/default.nix
	pkgs/misc/emulators/wine/base.nix
2016-05-03 23:12:48 +03:00
Robin Gloster c92bca56f8 Merge remote-tracking branch 'upstream/master' into hardened-stdenv 2016-05-02 22:58:02 +00:00
Nikolay Amiantov 3a52c5fa7d firefox: fix library path
Fixes #15126
2016-05-01 12:26:39 +03:00
Nikolay Amiantov 87ebab128a replace ${stdenv.cc.cc}/lib occurences 2016-05-01 00:13:23 +03:00
Tim Steinbach 1142b402a8 vivaldi: Clean up 2016-04-29 01:19:15 +00:00
Tim Steinbach 25290a9f15 vivaldi: 1.0 -> 1.1 2016-04-28 23:54:05 +00:00
Eelco Dolstra 930d243ea4 firefox: 45.0.2 -> 46.0
Still using GTK+ 2 for now, since apparently building with GTK+ 3
still requires GTK+ 2, increasing the closure size. (#15008)
2016-04-28 13:39:12 +02:00
Arseniy Seroka 52b64cedec Merge pull request #15016 from jagajaga/eid
open-eid
2016-04-28 13:56:09 +03:00
Arseniy Seroka f6d7cefa7b
esteidfirefoxplugin: init at 3.12.1.1142 2016-04-27 11:38:09 +03:00
Nikolay Amiantov ab0a0c004e makeSearchPathOutputs: refactor to makeSearchPathOutput 2016-04-25 13:24:39 +03:00
Nikolay Amiantov bab152826f arora: move to qmake4Hook 2016-04-20 18:55:45 +03:00
Robin Gloster d020caa5b2 Merge remote-tracking branch 'upstream/master' into hardened-stdenv 2016-04-18 13:49:22 +00:00
Gabriel Ebner 4003d16d66 qutebrowser: 0.6.0 -> 0.6.1 2016-04-17 15:38:12 +02:00
Pascal Wittmann ea4f08a919 Merge pull request #14742 from mbakke/dwb
dwb: 2015-07-07 -> 2016-03-21
2016-04-15 23:12:31 +02:00
Marius Bakke 2500945b31 dwb: 2015-07-07 -> 2016-03-21 2016-04-15 21:26:17 +01:00
Moritz Ulrich 6645ae3946 google-chrome: Also add ${deps}/lib64 to $LD_LIBRARY_PATH.
...as per @abbradar's suggestion. Thanks!
2016-04-14 19:00:15 +02:00
Moritz Ulrich 0c5ed43cd4 google-chrome: Fix regression from closure-size merge.
Fixes #14695

I'm not entirely sure if including `stdenv.cc.cc` in `makeLibraryPath`
is the correct thing to do here. If it's incorrect, please feel free to
ping me.
2016-04-14 18:54:48 +02:00
Nikolay Amiantov 8b7ebaffeb replace makeSearchPath tree-wise to take care of possible multiple outputs 2016-04-13 22:09:41 +03:00
Michael Raskin f99a9c0679 nspluginwrapper: add missing libXt build input 2016-04-13 19:10:42 +02:00
Eelco Dolstra 18a6403c59 firefox-esr: 45.0.1esr -> 45.0.2esr
Also, switch to upstream SHA-512 hashes.
2016-04-13 14:11:18 +02:00
Nikolay Amiantov 5e025bc9ee vivaldi: fix evaluation 2016-04-13 14:03:41 +03:00
Vladimír Čunát 39ebb01d6e Merge branch 'staging', containing closure-size #7701 2016-04-13 09:25:28 +02:00
Franz Pletz 84edf81d71 firefox: 45.0.1 -> 45.0.2 2016-04-12 15:48:13 +02:00
taku0 c98cca3614 firefox-bin: 45.0.1 -> 45.0.2 (#14626) 2016-04-12 15:47:31 +02:00
Arseniy Seroka e02debe165 Merge pull request #14291 from otwieracz/vivaldi
vivaldi-snapshot: init at 1.0.430.3
2016-04-12 08:52:37 +03:00
Vladimír Čunát 30f14243c3 Merge branch 'master' into closure-size
Comparison to master evaluations on Hydra:
  - 1255515 for nixos
  - 1255502 for nixpkgs
2016-04-10 11:17:52 +02:00
Nikolay Amiantov d45ac41e87 flashplayer: cleanup, add comment to maintainers 2016-04-08 17:18:54 +03:00
taku0 28232c3746 flashplayer: fix build on 32-bit platform 2016-04-08 16:55:51 +03:00
taku0 03e74fb117 flashplayer: 11.2.202.577 -> 11.2.202.616 2016-04-08 22:11:29 +09:00
Gabriel Ebner ab58c22d6a Merge pull request #14528 from kragniz/qutebrowser-0.6.0
qutebrowser: 0.5.1 -> 0.6.0
2016-04-08 07:09:10 +02:00
Louis Taylor 21c78411da qutebrowser: 0.5.1 -> 0.6.0 2016-04-08 05:59:05 +01:00
Robin Gloster 3e68106afd Merge remote-tracking branch 'upstream/master' into hardened-stdenv 2016-04-07 21:52:26 +00:00
Vladimír Čunát d1df28f8e5 Merge 'staging' into closure-size
This is mainly to get the update of bootstrap tools.
Otherwise there were mysterious segfaults:
https://github.com/NixOS/nixpkgs/pull/7701#issuecomment-203389817
2016-04-07 14:40:51 +02:00
Slawomir Gonet c6345de9f9 vivaldi: init at 1.0 2016-04-07 08:05:53 +02:00
Markus Wotringer 90624dcf89 conkeror: 1.0pre-20150730 -> 1.0pre-20160130 2016-04-05 14:34:42 +02:00
Robin Gloster 696d85a62d Merge remote-tracking branch 'upstream/master' into hardened-stdenv 2016-04-03 11:01:57 +00:00
Eelco Dolstra 2f0195003e firefox-esr: Fix name
The Firefox wrapped called itself "firefox" rather than "firefox-esr".

Also eliminate a use of splitString which is evil and should never be
used.
2016-04-01 13:51:24 +02:00
Vladimír Čunát ab15a62c68 Merge branch 'master' into closure-size
Beware that stdenv doesn't build. It seems something more will be needed
than just resolution of merge conflicts.
2016-04-01 10:06:01 +02:00
Franz Pletz 2e08d8234e Merge remote-tracking branch 'origin/master' 2016-03-31 10:06:30 +02:00
aszlig ef753d210e
chromium: Update all channels to latest versions
Overview of the updated versions:

stable: 49.0.2623.87 -> 49.0.2623.110
beta:   50.0.2661.26 -> 50.0.2661.49
dev:    50.0.2661.18 -> 51.0.2693.2

Most notably, this includes a series of urgent security fixes:

 * CVE-2016-1646: Out-of-bounds read in V8. Credit to Wen Xu from
                  Tencent KeenLab.
 * CVE-2016-1647: Use-after-free in Navigation. Credit to anonymous.
 * CVE-2016-1648: Use-after-free in Extensions. Credit to anonymous.
 * CVE-2016-1649: Buffer overflow in libANGLE. Credit to lokihardt
                  working with HP's Zero Day Initiative / Pwn2Own.
 * CVE-2016-1650: Denial of service in PageCaptureSaveAsMHTMLFunction

The official release announcement with details about these fixes can be
found here:

http://googlechromereleases.blogspot.de/2016/03/stable-channel-update_24.html

Beta and stable could be also affected, although I didn't do a detailed
check whether that's the case.

As this introduces Chromium 51 as the dev version, I had to make the
following changes to make it build:

 * libexif got removed, so let's do that on our end as well.
   See https://codereview.chromium.org/1803883002 for details.
 * Chromium doesn't seem to compile with our version of libpng, so let's
   resort to the bundled libpng for now.
 * site_engagement_ui.cc uses isnan outside of std namespace, so
   we're fixing that in postPatch using sed.

I have successfully built all versions on i686-linux and x86_64-linux
and tested it using the VM tests.

Test reports can be found at the following evaluation of my Hydra:

https://headcounter.org/hydra/eval/314584

Thanks to @grahamc for reporting this.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
Reported-by: Graham Christensen <graham@grahamc.com>
Fixes: #14299
2016-03-30 15:24:39 +02:00
Robin Gloster f60c9df0ba Merge remote-tracking branch 'upstream/master' into hardened-stdenv 2016-03-28 15:16:29 +00:00
aszlig f9fff51c2a
chromium: Link using gold linker flags
I originally wanted to do this a long time (a31301d) but IIRC back then
it didn't compile. Nowadays with the splitup of the gold linking flags
and the binutils integration, it's merely just a switch to flip, so
let's do that.

Only tested it by building against the current Chromium stable version
on 64bit, because right now builds on Hydra seem to time out (because of
this?) anyway so we have nothing to lose here.

The linking time was hereby reduced from >30 minutes (I didn't measure
it exactly but looked half an hour later to the build progress and it
was *still* linking) to about a few seconds, which I guess is even
though the measurement is quite bogus a tremendous improvement
nonetheless.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2016-03-28 11:41:13 +02:00
Michael Raskin 891fa19e29 Fix Midori build 2016-03-28 00:02:10 +02:00
Vladimír Čunát ec4685cf70 firefox-esr: fix build after 574a6d34d2
We're now using only newer versions that have ./configure in the root.
${pname} isn't the correct directory name for esr versions.
2016-03-26 09:13:58 +01:00
Eelco Dolstra 574a6d34d2 firefox-esr: 38.6.1 -> 45.0.1 2016-03-25 15:03:31 +01:00
Eelco Dolstra 79d6dc91fe firefox: 45.0 -> 45.0.1 2016-03-25 15:00:50 +01:00
aszlig 4d305102e0
google-chrome: Fix fetching upstream binary
Commit aa097946d2 only fixed evaluation.

Ssince 37dbd62 however, the fetchurl call is already implied so just
changing the path will still result in fetchurl (fetchurl ...), so let's
drop the outer fetchurl.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
Cc: @msteen, @benley
2016-03-21 16:15:18 +01:00
Vladimír Čunát aa097946d2 chrome: fix evaluation after 6041cfe2af 2016-03-21 12:04:33 +01:00
aszlig 5ebd629c6f
chromium: Fix comment of upstream-info.nix
As of 6041cfe, the upstream-info.nix (back then it was called
sources.nix) is no longer in the source/ subdirectory, so we need to fix
that comment to say that the file is autogenerated from update.sh in the
*same* directory.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2016-03-20 23:10:13 +01:00
aszlig fb65a0048a
chromium: Revert working around --sysroot filter
This reverts commit 5979946c41.

I have tested this by building against the stable version of Chromium
and it seems to compile just fine, so it doesn't seem to be needed
anymore.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2016-03-20 21:05:49 +01:00
aszlig 1f497204f7
chromium: Show status about precompiling .py files
Only a aesthetics thingy, but also corrects the comment, because we're
essentially precompiling .py files, NOT the .pyc files (the latter are
the results).

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2016-03-20 18:44:56 +01:00
aszlig 4f981b4f84
chromium: Move source/default.nix into common.nix
This addresses #12794 so that we now have only a single tarball where we
base our build on instead of splitting the source into different outputs
first and then reference the outputs.

The reason I did this in the first place is that we previously built the
sandbox as a different derivation and unpacking the whole source tree
just for building the sandbox was a bit too much.

As we now have namespaces sandbox built in by default we no longer have
that derivation anymore. It still might come up however if we want to
build NaCl as a separate derivation (see #8560), but splitting the
source code into things only NaCl might require is already too much work
and doesn't weight out the benefits.

Another issue with the source splitup is that Hydra now has an output
limit for non-fixed-output derivations which we're already hitting.

Tested the build against the stable channel and it went well, but I
haven't tested running the browser.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2016-03-20 17:50:17 +01:00
aszlig 37dbd62a83
chromium: Move fetchurl calls to getChannel
We always do something like "fetchurl channelProduct", so let's move it
to getChannel directly so we can avoid those fetchurl calls all over the
place.

Also, we can still access subattributes from the fetchurl call if we
need to, so there really is no need to expose the product's attributes
directly.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2016-03-20 17:13:44 +01:00
aszlig 4984a2bf76
chromium/plugins: Break long line
Yes, I know I'm a bit nitpicky, but lines >80 chars are very ugly if you
have two windows side-by-side.

Thus no feature changes here.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2016-03-20 17:07:28 +01:00
aszlig 985df3900d
chromium/common.nix: Remove unreferenced attrs
We're going to refactor things anyway, so let's first get rid of
everything that's not used anymore.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2016-03-20 17:01:58 +01:00
aszlig 6041cfe2af
chromium/source: Move update.nix to parent dir
We now should have only the default.nix left in the source directory and
we can start to factor out the pieces into the Chromium main derivation
attributes.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2016-03-20 16:53:08 +01:00
aszlig 2d9a604907
chromium: Rename sources.nix to upstream-info.nix
The "sources.nix" also contains information about where to get binary
packages, so calling it "upstream-info.nix" fits better in terms of
naming.

Also, we're moving it away from the sources dir, because the latter will
soon vanish.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2016-03-20 16:48:54 +01:00
aszlig d6b11ed722
chromium/source: Move patches into its own subdir
We're going to reference the patches in the Chromium main build rather
than applying it to the sources. So as a first step, this should keep
the patches away from the "source" subdirectory so we can make it flat.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2016-03-20 16:44:34 +01:00
taku0 9aa6ca99e4 firefox-bin: 45.0 -> 45.0.1 2016-03-19 14:28:10 +09:00
Tobias Geerinckx-Rice 87ca9b9629 lynx: use full version, ‘official’ URI & lib.optionals 2016-03-18 08:03:48 +01:00
Vladimír Čunát 9be0c7d463 firefox: disable optimization hack (i686-linux)
It seems to build fine even without it, so the original reason doesn't
hold anymore:
https://github.com/NixOS/nixpkgs/commit/f4b5671b0d9e8904a4ad6b3fd85268
2016-03-16 10:05:09 +01:00
Robin Gloster 3f45f0948d Merge remote-tracking branch 'upstream/master' into hardened-stdenv 2016-03-15 01:44:24 +00:00
宋文武 93feb5d115 drop my maintainership (close #13881) 2016-03-13 18:39:01 +01:00
aszlig c6834ab527
Merge pull request #13821 (update chromium)
This is just a minor upgrade, even though the commit message says it's
to major version 50. However, the CVEs listed there are for real, see
the following announcement:

http://googlechromereleases.blogspot.de/2016/03/stable-channel-update_8.html

The summary of updated packages:

stable: 49.0.2623.75 -> 49.0.2623.87
beta:   49.0.2623.75 -> 50.0.2661.26
dev:    50.0.2661.11 -> 50.0.2661.18

I've also added two commits, fixing the chdir() in the updater and
shutting up Python precompilation errors during the preBuild phase.

Tested on my Hydra at:

https://headcounter.org/hydra/eval/312166
2016-03-13 12:23:22 +01:00
aszlig a62f100ec3
chromium/update.sh: Allow to be called out-of-tree
Changing the working directory to
pkgs/applications/networking/browsers/chromium is a bit annoying, so
let's make sure the script can be called from anywhere.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2016-03-13 12:22:18 +01:00
aszlig f7e2171937
chromium/common: Shut up about precompiling .pyc's
The errors are completely non-fatal and only cause a particular file to
be not precompiled. Unfortunately this can lead to confusion to whether
these errors are real errors or not, so let's shut it up completely
because they're *not* real errors.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2016-03-13 12:22:18 +01:00
Vladimír Čunát 4c0125bc8f chromium: fixup plugins with multiple outputs
Chromium+flash seem to work fine now.
2016-03-11 15:10:51 +01:00
Eelco Dolstra 0d6d91739f firefox: 44.0.2 -> 45.0 2016-03-11 15:10:05 +01:00
taku0 218901bdb6 flashplayer: 11.2.202.559 -> 11.2.202.577 2016-03-11 10:11:08 +09:00
Graham Christensen e54434751a chromium: 49.0.2626.75 -> 50.0.2661.26 for CVE-2016-1643 CVE-2016-1644 CVE-2016-1645 2016-03-10 14:57:29 -06:00
taku0 153468aa5e firefox-bin: 44.0.2 -> 45.0 2016-03-09 09:06:42 +09:00
Vladimír Čunát 09af15654f Merge master into closure-size
The kde-5 stuff still didn't merge well.
I hand-fixed what I saw, but there may be more problems.
2016-03-08 09:58:19 +01:00
Franz Pletz e9fc4e7db6 Merge remote-tracking branch 'origin/master' into hardened-stdenv 2016-03-07 22:08:27 +01:00
aszlig 8b97ca270e
chromium: Update all channels to latest versions
Overview of the updated versions:

stable: 48.0.2564.116 -> 49.0.2623.75
beta:   49.0.2623.63  -> 49.0.2623.75
dev:    50.0.2657.0   -> 50.0.2661.11

Stable and beta are now in par because of the release of a major stable
update.

The release addresses 26 security vulnerabilities, the following with an
assigned CVE:

 * CVE-2016-1630: Same-origin bypass in Blink. Credit to Mariusz
                  Mlynski.
 * CVE-2016-1631: Same-origin bypass in Pepper Plugin. Credit to Mariusz
                  Mlynski.
 * CVE-2016-1632: Bad cast in Extensions. Credit to anonymous.
 * CVE-2016-1633: Use-after-free in Blink. Credit to cloudfuzzer.
 * CVE-2016-1634: Use-after-free in Blink. Credit to cloudfuzzer.
 * CVE-2016-1635: Use-after-free in Blink. Credit to Rob Wu.
 * CVE-2016-1636: SRI Validation Bypass. Credit to Ryan Lester and
                  Bryant Zadegan.
 * CVE-2015-8126: Out-of-bounds access in libpng. Credit to
                  joerg.bornemann.
 * CVE-2016-1637: Information Leak in Skia. Credit to Keve Nagy.
 * CVE-2016-1638: WebAPI Bypass. Credit to Rob Wu.
 * CVE-2016-1639: Use-after-free in WebRTC. Credit to Khalil Zhani.
 * CVE-2016-1640: Origin confusion in Extensions UI. Credit to Luan
                  Herrera.
 * CVE-2016-1641: Use-after-free in Favicon. Credit to Atte Kettunen of
                  OUSPG.

The full announcement which also includes the link to the bug tracker
can be found here:

http://googlechromereleases.blogspot.de/2016/03/stable-channel-update.html

Also, the 32bit Chrome package needed for the Flash and Widevine plugins
doesn't exist anymore, because Google has dropped support for 32bit
distros, see here for the announcement:

https://groups.google.com/a/chromium.org/forum/#!topic/chromium-dev/FoE6sL-p6oU

On our end, we need to fix the patch for the plugin paths to work for
the latest dev channel. The change is very minor, because the
nix_plugin_paths_46.patch only doesn't apply because of an iOS-related
ifdef.

Built and tested on my Hydra at:

https://headcounter.org/hydra/eval/311511

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
Fixes: #13665
2016-03-05 22:53:13 +01:00
Franz Pletz cb3d27df93 Merge remote-tracking branch 'origin/master' into hardened-stdenv 2016-03-05 18:55:30 +01:00
Franz Pletz aff1f4ab94 Use general hardening flag toggle lists
The following parameters are now available:

  * hardeningDisable
    To disable specific hardening flags
  * hardeningEnable
    To enable specific hardening flags

Only the cc-wrapper supports this right now, but these may be reused by
other wrappers, builders or setup hooks.

cc-wrapper supports the following flags:

  * fortify
  * stackprotector
  * pie (disabled by default)
  * pic
  * strictoverflow
  * format
  * relro
  * bindnow
2016-03-05 18:55:26 +01:00
aszlig c3d82f0fbf
chromium/updater: Fix eval error on stdenv.is32bit
There is no stdenv.is32bit, so let's just use !stdenv.is64bit.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2016-03-05 03:16:26 +01:00
aszlig 8d5accb691
chromium/updater: Fix getting latest versions
Comparing the current version with the version in sources list and
accidentally swapping the version arguments isn't going to get very far
because every new version that will come up will then be treated as "we
already have that version".

So we're now using versionOlder and also a check whether the version is
the *same* as the one in sources.nix.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2016-03-05 02:55:00 +01:00
Robin Gloster fed49425c5 Merge remote-tracking branch 'upstream/master' into hardened-stdenv 2016-03-03 16:11:55 +00:00
Derek Gonyeo f681ceb593 uzbl: version 20120514 -> v0.9.0 2016-03-01 23:15:26 -05:00
Robin Gloster d47857c3d9 Merge remote-tracking branch 'upstream/master' into hardened-stdenv 2016-03-01 21:09:17 +00:00
Luca Bruno 5f8311775c chromium: add StartupWMClass to desktop file. Fixes #12433 2016-02-29 20:42:58 +01:00
Robin Gloster 3477e662e6 Merge remote-tracking branch 'upstream/master' into hardened-stdenv 2016-02-27 00:08:08 +00:00
aszlig 54b4912566
chromium: Regenerate sources.nix with new updater
No changes in functionality, but to make future source updates a bit
easier on the eyes when viewing the diff.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2016-02-26 20:55:17 +01:00
aszlig 28b289efa6
chromium: Refactor updater entirely in Nix
The update.sh shell script now is only a call to nix-build, which does
all the hard work of updating the Chromium source channels and the
plugins. It results in a store path with the new sources.nix that
replaces the already existing sources.nix.

Along the way, this has led to a quite massive workaround, which abuses
MD5 collisions to detect whether an URL is existing, because something
like builtins.tryEval (builtins.fetchurl url) unfortunately doesn't
work. Further explanations and implementation details are documented in
the actual implementation.

The drawback of this is that we don't have nice status messages anymore,
but on the upside we have a more robust generation of the sources.nix
file, which now also should work properly on missing upstream
sources/binaries.

This also makes it much easier to implement fetching non-GNU/Linux
versions of Chromium and we have all values from omahaproxy available as
an attribute set (see the csv2nix and channels attributes in the update
attribute).

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2016-02-26 20:55:17 +01:00
aszlig 716b79d3a5
chromium: Provide SHA256s for beta/dev plugins
As stated in the parent commit, the 32bit Chrome package is not
available upstream, so let's at least provide the SHA256 hash for the
64bit package.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2016-02-26 10:55:51 +01:00
aszlig 459642b8de
chromium/updater: Allow a single plugin arch
Until now, if we have a failure to fetch either the 32bit Debian package
or the 64bit Debian package, neither of these will be put into
sources.nix.

Unfortunately the beta/dev channels do not have a 32bit Debian package,
so even though there is a 64bit Debian package available we don't get
plugins *at* *all*.

This also introduces a nicer error message rather than just failing with
an assertion in fetchurl because we did not provide url/urls.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2016-02-26 10:55:51 +01:00
zimbatm 30891166be Merge pull request #11997 from benley/google-chrome-variants
google-chrome: add -beta and -unstable variants
2016-02-26 00:13:00 +00:00
Graham Christensen 712d59225e chromium{,Beta,Dev}: 48.0.2564.97 -> 48.0.2564.116
From the debian security mailing list:

Several vulnerabilities have been discovered in the chromium web browser.

CVE-2016-1622

    It was discovered that a maliciously crafted extension could bypass
    the Same Origin Policy.

CVE-2016-1623

    Mariusz Mlynski discovered a way to bypass the Same Origin Policy.

CVE-2016-1624

    lukezli discovered a buffer overflow issue in the Brotli library.

CVE-2016-1625

    Jann Horn discovered a way to cause the Chrome Instant feature to
    navigate to unintended destinations.

CVE-2016-1626

    An out-of-bounds read issue was discovered in the openjpeg library.

CVE-2016-1627

    It was discovered that the Developer Tools did not validate URLs.

CVE-2016-1628

    An out-of-bounds read issue was discovered in the pdfium library.

CVE-2016-1629

    A way to bypass the Same Origin Policy was discovered in Blink/WebKit,
    along with a way to escape the chromium sandbox.
2016-02-25 12:00:12 -06:00
zimbatm 7848d215f4 Merge pull request #13094 from nathan7/chromium-flash-version-jq
chromium/plugins: use jq for extracting the Flash version
2016-02-23 22:45:42 +00:00
Robin Gloster f2d5bda7c9 vimprobable2: turn off format hardening 2016-02-20 22:34:06 +00:00
Robin Gloster bc21db3692 Merge remote-tracking branch 'upstream/master' into hardened-stdenv 2016-02-19 21:16:14 +00:00
Frederik Rietdijk 4d06bf70f4 buildPythonApplication: use new function for Python applications 2016-02-19 13:16:41 +01:00
Nathan Zadoks 2610986991 chromium/plugins: use jshon for extracting the Flash version from JSON 2016-02-19 12:31:08 +01:00
zimbatm 97bbc37b6f rekonq: fix homepage url 2016-02-16 14:11:36 +00:00
zimbatm a6ac8d7915 Merge pull request #13020 from colemickens/fix-widevine
chromium/plugins: Fix widevine substitution
2016-02-16 10:14:16 +00:00
Cole Mickens a5a5c1d9cd chromium/plugins: Fix widevine substitution
Fixes: #12840
Related to: 61042a5

61042a5 changes the replaced token from $something to @something@. This
commit repeats that change in one additional location used by the
WideVine plugin
2016-02-15 18:04:16 -08:00
Franz Pletz 41698c9efa Merge branch 'master' into hardened-stdenv 2016-02-15 20:05:29 +01:00
Vladimír Čunát d039c87984 Merge branch 'master' into closure-size 2016-02-14 08:33:51 +01:00
Franz Pletz 657c56678c firefox-esr: 38.5.2esr -> 38.6.1esr 2016-02-12 08:02:31 +01:00
Franz Pletz 70925f0a92 firefox: 44.0 -> 44.0.2 2016-02-12 08:02:24 +01:00
Franz Pletz b276f4f171 Merge pull request #12945 from taku0/firefox-bin-44.0.1
firefox-bin: 44.0.1 -> 44.0.2
2016-02-12 07:55:54 +01:00
taku0 6d3f909975 firefox-bin: 44.0.1 -> 44.0.2 2016-02-12 10:15:23 +09:00
Arseniy Seroka 885acea1dd Merge pull request #12891 from taku0/firefox-bin-44.0.1
firefox-bin: 44.0 -> 44.0.1
2016-02-11 16:57:20 +03:00
Vladimír Čunát 0609154a19 wrapFirefox: add enableAdobeReader
So far we only have 32-bit package.
It will be silently missed on 64-bit ATM.
2016-02-10 23:27:28 +00:00
Vladimír Čunát 177464ade9 wrapFirefox: add enableAdobeReader
So far we only have 32-bit package.
It will be silently missed on 64-bit ATM.
2016-02-09 18:21:40 +01:00
taku0 74270469db firefox-bin: 44.0 -> 44.0.1 2016-02-10 00:03:00 +09:00
Robin Gloster 9229e9c656 Merge remote-tracking branch 'upstream/master' into hardened-stdenv 2016-02-07 11:17:57 +00:00
Vladimír Čunát d3a3aa8674 Merge #12740: multiple outputs for Qt 5 and KDE 5 2016-02-03 17:09:09 +01:00
Vladimír Čunát ae74c356d9 Merge recent 'staging' into closure-size
Let's get rid of those merge conflicts.
2016-02-03 16:57:19 +01:00
aszlig 61042a5b6a
chromium/plugins: Use @var@ for passing variables
There is already a pull request from @colemickens, who has just reversed
the variable references $flash and $flashVersion but the fix is kinda
fragile as he points out himself in #12713.

The reason the wrong substition was made is that both variables begin
with the same name and we do a simple replace instead of a more
complicated one using builtins.match.

So staying simple but to still not raising issues with other variables
that begin with the same name I'm now using @var@ instead, like we use
in substituteAll and other substituters (like the ones in CMake or
autotools) deal with it.

Note that I'm not using $var$ here to make sure it doesn't get confused
with real shell variables.

So with this fix in place, the wrapper now has the following flags:

  --ppapi-flash-path=/nix/store/.../lib/libpepflashplayer.so
  --ppapi-flash-version=20.0.0.294

Previously we had (#12710):

  --ppapi-flash-path=/nix/store/.../lib/libpepflashplayer.so
  --ppapi-flash-version=/nix/store/...-binary-plugins-flashVersion

Thanks to @colemickens for reporting and putting up a pull request.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
Fixes: #12710
Fixes: #12713
2016-02-02 17:39:08 +01:00
aszlig ff90f52375
chromium: Remove import-from-derivation again
This reverts commit f7af2272a2.

We're going to fix #12710 properly by reintroducing 38c77bb and fixing
the shell variable substitution.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2016-02-02 17:39:08 +01:00
Franz Pletz 1026673f37 firefox: 43.0.4 -> 44.0 2016-02-01 18:10:47 +01:00
Tony White 8491d0d1ca chromium: 47.0.2526.106 - > 48.0.2564.97
- Fixes CVE-2016-1612 CVE-2016-1613 CVE-2016-1614 CVE-2016-1615
  CVE-2016-1616 CVE-2016-1617 CVE-2016-1618 CVE-2016-1619 CVE-2016-1620.
- Moves chromium stable and beta channels up one version major.
  vcunat made dev channel stay for now, as it wouldn't download otherwise.
  This is most of PR #12717.
2016-02-01 12:12:07 +01:00
Thomas Tuegel 2f4087b13d google-talk-plugin: udev -> libudev 2016-01-31 21:15:03 -06:00
Franz Pletz 8ec3bce8f8 links: Remove package & deprecate for links2
This package is deprecated and superseeded by links2 which also provides the
links binary this maintaining backwards-compatibility.

Debian removed links back in 2008:

  https://packages.qa.debian.org/l/links.html

Fixes #12623.
2016-01-31 11:46:35 +01:00
Vladimír Čunát f7af2272a2 Revert "chromium: Do not rely on import-from-derivation"
This reverts commit 38c77bb72c.
In this form it causes problems #12710.
2016-01-31 10:03:57 +01:00
Robin Gloster f6d3b7a2ae switch hardening flags 2016-01-30 16:36:57 +00:00
Franz Pletz 954e9903ad Use a hardened stdenv by default 2016-01-30 16:36:57 +00:00
taku0 85f5394c5f firefox-bin: 43.0.4 -> 44.0 2016-01-27 23:34:42 +09:00
Nikolay Amiantov 5bc8f09b65 Merge pull request #12577 from zohl/flashplayer
Standalone flashplayers
2016-01-26 00:49:02 +03:00
Al Zohali d9066cd36f flashplayer-standalone: init at 11.2.202.559 2016-01-24 19:29:02 +03:00
Tuomas Tynkkynen dc8e939dbc treewide: Mass replace 'cups}/lib' to refer the 'out' output 2016-01-24 10:03:33 +02:00
Tobias Geerinckx-Rice 32d40f0f98 Remove no longer (or never) referenced patches
55 files changed, 6041 deletions. Tested with `nix-build -A tarball`.
2016-01-24 02:02:21 +01:00
Gabriel Ebner 889a05ea5b qutebrowser: 0.5.0 -> 0.5.1 2016-01-22 14:19:23 +01:00
Vladimír Čunát 0957359568 Merge branch 'staging' 2016-01-22 13:48:35 +01:00
Vladimír Čunát 3317eef084 Merge #12414: qutebrowser: fix various things 2016-01-21 11:56:50 +01:00
Vladimír Čunát 716aac2519 Merge branch 'staging' into closure-size 2016-01-19 09:55:31 +01:00
taku0 fba7544812 firefox-bin: wrap firefox-bin (close #12416) 2016-01-18 10:42:57 +01:00
aszlig 85dd89f6eb
chromium: Remove myself from maintainers
Working on Chromium really drives me nuts due to its build time, also I
really don't have quite a lot of time these days to properly maintain it
anymore.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2016-01-18 03:35:28 +01:00
aszlig 38c77bb72c
chromium: Do not rely on import-from-derivation
This has been introduced by me in 690a845 and discovered by @vcunat in
his comment over at:

690a845de9 (commitcomment-14209868)

It's really a bit ugly to have builds running during evaluation, but
back when I made that commit the reason was to avoid having to shell
quote the hell out of it (see the comment in mkPluginInfo for the
reason).

Now we propagate plugin flags and environment variables as a list of
arguments in a plain file that's appended verbatim to makeWrapper, so
it shouldn't do any builds anymore during instantiation.

I have tested this with both just WideVine and just Flash enabled as
well as both in combination and none of the plugins and the output seems
correct. However I didn't test to run Chromium with the new
implementation.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
Reported-by: Vladimír Čunát <vcunat@gmail.com>
2016-01-18 03:35:28 +01:00
Gabriel Ebner 23b3e6430e qutebrowser: 0.4.1 -> 0.5.0
Fixes #8568 by using the release tarballs.
2016-01-16 07:23:44 +01:00
Gabriel Ebner dbd3a5ff20 qutebrowser: use correct plugin versions
Since PyQt uses Qt 5.5, we need to use the Qt plugins from 5.5 as well,
and gstreamer plugins from 1.0.
2016-01-16 07:23:44 +01:00
Vladimír Čunát c29df5f8a7 firefox: fixup ${name} problems introduced in 2e78e19
Fixes #12403. I'm sorry for the problems. Thanks to @mdorman!
2016-01-15 13:32:36 +01:00
Vladimír Čunát 98218971c2 Merge #12299: make firefox-like browsers wrapped by default 2016-01-15 08:53:58 +01:00
Vladimír Čunát 2e78e19de0 firefox: put "unwrapped" into its name
I'm not certain about this, so I'm trying for firefox only.
Rationale: it might be confusing to see two firefox-${version} instances
in logs or paths, so I wanted to differentiate them.
2016-01-15 08:36:22 +01:00
Vladimír Čunát a8f1d40c1f all-packages: browserWrapper -> browser
- I chose to keep `browser-unwrapped` attributes so that it's much
  easier to override parameters for the browser (through `packageOverrides`).
- Aliases `browserWrapper` are retained for now, as usual.
2016-01-15 08:36:08 +01:00
Jakob Gillich c8b231a40c w3m: update to actively maintained debian repo
The official repository has last been updated in 2013,
meanwhile there are a lot of issues like non-existant
certificate verification. The debian repository is actively
maintained and already includes most of our custom patches,
so we use it instead.

Fixes #12257, closes #12259.

vcunat appended commit date to version.
2016-01-14 13:06:48 +01:00
Kranium Gikos Mendoza ae6686441e bluejeans: 2.100.102.8 -> 2.125.24.5 2016-01-12 12:31:13 +08:00
Vladimír Čunát 95c1429e62 wrapFirefox: move out of all-packages.nix, change defaults
- I don't think that amount of code belonged into all-packages.nix.
- Now the default name of the wrapped package is identical
  with the command that runs the browser.
- Other defaults were changed according to how the wrapper is
  (almost always) used.
- `meta` is improved: mostly inherited with priority above
  the unwrapped package.
2016-01-10 15:08:00 +01:00
Avery Glitch 440444d69d vimb: 2.9 -> 2.11 2016-01-08 10:57:32 +11:00
Eelco Dolstra 094723f0bc firefox: 43.0.3 -> 43.0.4 2016-01-07 16:14:51 +01:00
taku0 a9abdc8426 firefox-bin: 43.0.3 -> 43.0.4 2016-01-07 22:10:44 +09:00
Tobias Geerinckx-Rice 4df7006319 netsurf: remove dead package & dependencies
Not updated since 2009 (!), not working since 2013.

cc @marcweber
2016-01-06 01:46:16 +01:00