Change:
, CVSSv3=5.3 (nixos-21.05, nixos-unstable) A reordering issue exists in Telegram before 7.8.1 for Android, Telegram before 7.8.3 for iOS, and Telegram Desktop before 2.8.8. An attacker can cause the server to receive messages in a different order than they were sent a client. Scanned versions: nixos-21.05: ; nixos-unstable: . Cc Cc Cc

Discussion:
with lib; let <del> tg_owt = callPackage ../tdesktop/tg_owt.nix {}; </del> <ins> tg_owt = callPackage ./tg_owt.nix {}; </ins> in mkDerivation rec { pname = "kotatogram-desktop"; version = "1.4.1";

<ins> { lib, stdenv, fetchFromGitHub, pkg-config, cmake, ninja, yasm , libjpeg, openssl, libopus, ffmpeg, alsaLib, libpulseaudio, protobuf , xorg, libXtst }: let rev = "2d804d2c9c5d05324c8ab22f2e6ff8306521b3c3"; sha256 = "0kz0i381iwsgcc3yzsq7njx3gkqja4bb9fsgc24vhg0md540qhyn"; in stdenv.mkDerivation { pname = "tg_owt"; version = "git-${rev}"; src = fetchFromGitHub { owner = "desktop-app"; repo = "tg_owt"; inherit rev sha256; fetchSubmodules = true; }; outputs = [ "out" "dev" ]; nativeBuildInputs = [ pkg-config cmake ninja yasm ]; buildInputs = [ libjpeg openssl libopus ffmpeg alsaLib libpulseaudio protobuf xorg.libX11 libXtst ]; cmakeFlags = [ # Building as a shared library isn't officially supported and currently broken: "-DBUILD_SHARED_LIBS=OFF" ]; meta.license = lib.licenses.bsd3; } </ins>

<del> { mkDerivation, lib, fetchurl, fetchpatch, callPackage </del> <ins> { mkDerivation, lib, fetchFromGitHub, callPackage, fetchpatch </ins> , pkg-config, cmake, ninja, python3, wrapGAppsHook, wrapQtAppsHook, removeReferencesTo <del> , qtbase, qtimageformats, gtk3, libsForQt5, enchant2, lz4, xxHash , dee, ffmpeg, openalSoft, minizip, libopus, alsaLib, libpulseaudio, range-v3 , tl-expected, hunspell, glibmm, webkitgtk </del> <ins> , qtbase, qtimageformats, gtk3, libsForQt5, lz4, xxHash , ffmpeg, openalSoft, minizip, libopus, alsaLib, libpulseaudio, range-v3 , tl-expected, hunspell, glibmm, webkitgtk, jemalloc , rnnoise, abseil-cpp, extra-cmake-modules </ins> # Transitive dependencies: , pcre, xorg, util-linux, libselinux, libsepol, epoxy , at-spi2-core, libXtst, libthai, libdatrie

tg_owt = callPackage ./tg_owt.nix {}; in mkDerivation rec { pname = "telegram-desktop"; <del> version = "2.7.5"; </del> <ins> version = "2.8.11"; # Note: Update via pkgs/applications/networking/instant-messengers/telegram/tdesktop/update.py </ins> # Telegram-Desktop with submodules <del> src = fetchurl { url = "https://github.com/telegramdesktop/tdesktop/releases/download/v${version}/tdesktop-${version}-full.tar.gz"; sha256 = "sha256-9GxBw5ii9Musjq7D3KMf/P5BA4h690EgXRbhynHwO98="; </del> <ins> src = fetchFromGitHub { owner = "telegramdesktop"; repo = "tdesktop"; rev = "v${version}"; fetchSubmodules = true; sha256 = "020ycgb77vx7rza590i3csrvq1zgm15rvpxqqcp0xkb4yh71i3hb"; </ins> }; <del> patches = [ # fixes issue with ffmpeg>=4.4 crashes, hasn't been upstreamed yet (fetchpatch { url = "https://raw.githubusercontent.com/gentoo/gentoo/1c91884873968997be4b0c954169d04dc839f1db/net-im/telegram-desktop/files/tdesktop-2.7.4-voice-crash.patch"; sha256 = "sha256-inLXcP70yJlkkmdeXlc3HRL7Vt+Sf00LLJG33gwBKdY="; }) (fetchpatch { url = "https://raw.githubusercontent.com/gentoo/gentoo/1c91884873968997be4b0c954169d04dc839f1db/net-im/telegram-desktop/files/tdesktop-2.7.4-voice-ffmpeg44.patch"; sha256 = "sha256-p57LipNf7BDhVvNKRuicVqx0vU6IBL/Cvr5BAfLF4Hs="; }) ]; </del> <ins> patches = [(fetchpatch { # ref: https://github.com/desktop-app/lib_webview/pull/9 url = "https://github.com/desktop-app/lib_webview/commit/75e924934eee8624020befbef1f3cb5b865d3b86.patch"; sha256 = "sha256-rN4FVK4KT+xNf9IVdcpbxMqT0+t3SINJPRRQPyMiDP0="; stripLen = 1; extraPrefix = "Telegram/lib_webview/"; })]; </ins> postPatch = '' <del> substituteInPlace Telegram/lib_spellcheck/spellcheck/platform/linux/linux_enchant.cpp  --replace '"libenchant-2.so.2"' '"${enchant2}/lib/libenchant-2.so.2"' </del> substituteInPlace Telegram/CMakeLists.txt  --replace '"''${TDESKTOP_LAUNCHER_BASENAME}.appdata.xml"' '"''${TDESKTOP_LAUNCHER_BASENAME}.metainfo.xml"'

nativeBuildInputs = [ pkg-config cmake ninja python3 wrapGAppsHook wrapQtAppsHook removeReferencesTo ]; buildInputs = [ <del> qtbase qtimageformats gtk3 libsForQt5.kwayland libsForQt5.libdbusmenu enchant2 lz4 xxHash dee ffmpeg openalSoft minizip libopus alsaLib libpulseaudio range-v3 tl-expected hunspell glibmm webkitgtk </del> <ins> qtbase qtimageformats gtk3 libsForQt5.kwayland libsForQt5.libdbusmenu lz4 xxHash ffmpeg openalSoft minizip libopus alsaLib libpulseaudio range-v3 tl-expected hunspell glibmm webkitgtk jemalloc rnnoise abseil-cpp extra-cmake-modules </ins> tg_owt # Transitive dependencies: pcre xorg.libpthreadstubs xorg.libXdmcp util-linux libselinux libsepol epoxy

passthru = { inherit tg_owt; <ins> updateScript = ./update.py; </ins> }; meta = {

<del> { lib, stdenv, fetchFromGitHub, pkg-config, cmake, ninja, yasm </del> <ins> { lib, stdenv, fetchFromGitHub, fetchpatch , pkg-config, cmake, ninja, yasm </ins> , libjpeg, openssl, libopus, ffmpeg, alsaLib, libpulseaudio, protobuf <del> , xorg, libXtst </del> <ins> , xorg, libXtst, libXcomposite, libXdamage, libXext, libXrender, libXrandr , glib, abseil-cpp, pcre, util-linuxMinimal, libselinux, libsepol, pipewire , libXi </ins> }: <del> let rev = "2d804d2c9c5d05324c8ab22f2e6ff8306521b3c3"; sha256 = "0kz0i381iwsgcc3yzsq7njx3gkqja4bb9fsgc24vhg0md540qhyn"; in stdenv.mkDerivation { </del> <ins> stdenv.mkDerivation { </ins> pname = "tg_owt"; <del> version = "git-${rev}"; </del> <ins> version = "unstable-2021-06-27"; </ins> src = fetchFromGitHub { owner = "desktop-app"; repo = "tg_owt"; <del> inherit rev sha256; </del> <ins> rev = "91d836dc84a16584c6ac52b36c04c0de504d9c34"; sha256 = "1ir4svv5mijpzr0rmx65088iikck83vhcdqrpf9dnk6yp4j9v4v2"; </ins> fetchSubmodules = true; };

buildInputs = [ libjpeg openssl libopus ffmpeg alsaLib libpulseaudio protobuf <del> xorg.libX11 libXtst </del> <ins> xorg.libX11 libXtst libXcomposite libXdamage libXext libXrender libXrandr glib abseil-cpp pcre util-linuxMinimal libselinux libsepol pipewire libXi </ins> ]; cmakeFlags = [

<del> { stdenv, lib, fetchFromGitHub, pkg-config, autoreconfHook </del> <ins> { stdenv, lib, fetchFromGitHub, fetchpatch , pkg-config, autoreconfHook </ins> , openssl, libopus, alsaLib, libpulseaudio }:

stdenv.mkDerivation rec { pname = "libtgvoip"; <del> version = "unstable-2020-03-02"; </del> <ins> version = "unstable-2021-07-13"; </ins> src = fetchFromGitHub { owner = "telegramdesktop"; repo = "libtgvoip"; <del> rev = "e422d2a80546a32ab7166a9b1058bacfc5daeefc"; sha256 = "0n6f7215k74039j0zmicjzhj6f45mq6fvkrwzyzibcrv87ib17fc"; </del> <ins> rev = "f321e7c8cc086bac6ae06fa0934aac7d9833a310"; sha256 = "1gk5nsqhbnn1cdh83b70qr3d3v2c1bncylvgn77vvj8vnyjlmnfq"; </ins> }; <ins> # To fix the build without external webrtc: patches = [ (fetchpatch { # Use methods from updated webrtc. url = "https://github.com/telegramdesktop/libtgvoip/commit/13a5fcb16b04472d808ce122abd695dbf5d206cd.patch"; sha256 = "0wapqvml3yyv5dlp2q8iih5rfvfnkngll69krhnw5xsdjy22sp7r"; revert = true; }) (fetchpatch { # Allow working with external webrtc. url = "https://github.com/telegramdesktop/libtgvoip/commit/6e82b6e45664c1f80b9039256c99bebc76d34672.patch"; sha256 = "0m87ixja70vnm80a9z4gxk0yl7n64y59smczxb88lxnj6kdgih7x"; revert = true; }) ]; </ins> outputs = [ "out" "dev" ]; nativeBuildInputs = [ pkg-config autoreconfHook ];