Includes fixes for CVE-2025-6424, CVE-2025-6425, CVE-2025-6426,
CVE-2025-6429, and CVE-2025-6430.
* gnu/packages/gnuzilla.scm (mozilla-115-compare-locales)
(mozilla-115-locale, mozilla-115-locales, update-mozilla-115-locales)
(all-mozilla-115-locales, %icecat-115-base-version)
(%icecat-115-version %icecat-115-build-id, icecat-115-source): New
bindings, retaining the previous meanings (before this commit) of
mozilla-compare-locales, mozilla-locale, mozilla-locales,
update-mozilla-locales, all-mozilla-locales, %icecat-base-version,
%icecat-version, %icecat-build-id, and icecat-source, respectively.
(mozilla-locale, mozilla-locales, update-mozilla-locales)
(all-mozilla-locales): Remove bindings.
(mozilla-compare-locales): Switch to new Github URL.
(mozilla-l10n): New variable.
(%icecat-locales): Move definition above "%icecat-base-version".
Add new locales "sat" and "skr".
(%icecat-base-version, %icecat-version, %icecat-build-id): Update.
(icecat-source): Update 'gnuzilla-commit' and hashes.
Remove 'upstream-icecat-base-version' local variable
and associated comments. Modify the code
within (with-directory-excursion "l10n" ...) to adapt to new
upstream handling of locales.
(icecat-minimal) [inputs]: Switch from 'ffmpeg-5' to 'ffmpeg'.
Update the comment on why we are still using the bundled NSS.
[native-inputs]: Switch from 'rust-cbindgen-0.24' to 'rust-cbindgen'.
[arguments]: Add "--enable-rust-simd" to configure-flags.
Adapt 'remove-cargo-frozen-flag' phase to work on IceCat 128.
(comm-source->locales+changeset): Use 'update-mozilla-115-locales'.
(icedove-source): Use 'icecat-115-source'.
* gnu/packages/patches/icecat-use-system-wide-dir.patch,
gnu/packages/patches/icecat-compare-paths.patch: Adapt to IceCat 128.
* gnu/packages/patches/icecat-102-makeicecat.patch: Delete file
* gnu/local.mk (dist_patch_DATA): Remove it.
Previously, the builder of a fixed-output derivation could communicate with an
external process via an abstract Unix-domain socket. In particular, it could
send an open file descriptor to the store, granting write access to some of
its output files in the store provided the derivation build fails—the fix for
CVE-2024-27297 did not address this specific case. It could also send an open
file descriptor to a setuid program, which could then be executed using
execveat to gain the privileges of the build user.
With this change, fixed-output derivations other than “builtin:download”
and “builtin:git-download” always run in a separate network namespace
and have network access provided by a TAP device backed by slirp4netns,
thereby closing the abstract Unix-domain socket channel.
* nix/libstore/globals.hh (Settings)[useHostLoopback, slirp4netns]: new
fields.
* config-daemon.ac (SLIRP4NETNS): new C preprocessor definition.
* nix/libstore/globals.cc (Settings::Settings): initialize them to defaults.
* nix/nix-daemon/guix-daemon.cc (options): add --isolate-host-loopback option.
* doc/guix.texi: document it.
* nix/libstore/build.cc (DerivationGoal)[slirp]: New field.
(setupTap, setupTapAction, waitForSlirpReadyAction, enableRouteLocalnetAction,
prepareSlirpChrootAction, spawnSlirp4netns, haveGlobalIPv6Address,
remapIdsTo0Action): New functions.
(initializeUserNamespace): allow the guest UID and GID to be specified.
(DerivationGoal::killChild): When ‘slirp’ is not -1, call ‘kill’.
(DerivationGoal::startBuilder): Unconditionally add CLONE_NEWNET to FLAGS.
When ‘fixedOutput’ is true, spawn ‘slirp4netns’.
When ‘fixedOutput’ and ‘useChroot’ are true, add setupTapAction,
waitForSlirpReadyAction, and enableRouteLocalnetAction to builder setup
phases.
Create a /etc/resolv.conf for fixed-output derivations that directs them to
slirp4netns's dns address.
When settings.useHostLoopback is true, supply fixed-output derivations with a
/etc/hosts that resolves "localhost" to slirp4netns's address for accessing
the host loopback.
* nix/libutil/util.cc (keepOnExec, decodeOctalEscaped, sendFD, receiveFD,
findProgram): New functions.
* nix/libutil/util.hh (keepOnExec, decodeOctalEscaped, sendFD, receiveFD,
findProgram): New declarations.
* gnu/packages/package-management.scm (guix): add slirp4netns input for linux
targets.
* tests/derivations.scm (builder-network-isolated?): new variable.
("fixed-output derivation, network access, localhost", "fixed-output
derivation, network access, external host"):
skip test case if fixed output derivations are isolated from the network.
Change-Id: Ia3fea2ab7add56df66800071cf15cdafe7bfab96
Signed-off-by: John Kehayias <john.kehayias@protonmail.com>
* gnu/packages/python-xyz.scm (python-bitstruct): Update to 8.21.0.
[build-system]: Use pyproject.
[native-inputs]: Add python-pytest, python-setuptools-next, and
python-wheel.
[description]: Start from a new line, apply fill-column indentation.
Change-Id: I669b99d5687d173e9d9667d3e7339a2d5bf62006
* gnu/packages/emacs-xyz.scm (emacs-defaultencrypt): New variable.
(emacs-default-encrypt): Mark it as deprecated by the above.
Change-Id: I391e8edb489aa463344401fd691727734a47e428
Signed-off-by: Andreas Enge <andreas@enge.fr>
