Change:
Steps to reproduce the behavior:  nixos-unstable Noticed when setting and rebuilding &lt;!-- Please @ people who are in the list of the offending package or module. If in doubt, check for whoever last touched something. --Please run and paste the result. Add a :+1: [reaction] to [issues you find important]. [reaction]: [issues you find important]:
You won't get a reply if you leave that empty.
I'm having the same issue I didn't notice when it happened, but I also have sambaFull
Same error whit the package .
This seems related to
That turned out not to be the issue. The actual error: In colour so that one can actually make sense of C++ error messages: ! One potential problem here: This is because of having: Switching to : Builds Removing entirely (which swiches to ): Fails on new related errors (see below) Removing and : Fails because Ceph requires lua = 5.3 and nixpkgs's default is still 5.2: CMake saysCould NOT find Lua (missing: LUAINCLUDEDIR) (Required is at least version "5.3")` Build failure with : <details</detailsI noticed Arch . But we can just use to fix the build.
PR for the

Discussion:
monA.succeed( "ceph osd pool create multi-node-test 32 32", "ceph osd pool ls | grep 'multi-node-test'", <ins> # We need to enable an application on the pool, otherwise it will # stay unhealthy in state POOL_APP_NOT_ENABLED. # Creating a CephFS would do this automatically, but we haven't done that here. # See: https://docs.ceph.com/en/reef/rados/operations/pools/#associating-a-pool-with-an-application # We use the custom application name "nixos-test" for this. "ceph osd pool application enable multi-node-test nixos-test", </ins> "ceph osd pool rename multi-node-test multi-node-other-test", "ceph osd pool ls | grep 'multi-node-other-test'", )

monA.succeed( "ceph osd pool create single-node-test 32 32", "ceph osd pool ls | grep 'single-node-test'", <ins> # We need to enable an application on the pool, otherwise it will # stay unhealthy in state POOL_APP_NOT_ENABLED. # Creating a CephFS would do this automatically, but we haven't done that here. # See: https://docs.ceph.com/en/reef/rados/operations/pools/#associating-a-pool-with-an-application # We use the custom application name "nixos-test" for this. "ceph osd pool application enable single-node-test nixos-test", </ins> "ceph osd pool rename single-node-test single-node-other-test", "ceph osd pool ls | grep 'single-node-other-test'", )

monA.wait_until_succeeds("ceph -s | grep 'mgr: ${cfg.monA.name}(active,'") monA.wait_until_succeeds("ceph -s | grep 'HEALTH_OK'") <del> # This test has been commented out due to the upstream issue with pyo3 # that has broken this dashboard # Reference: https://www.spinics.net/lists/ceph-users/msg77812.html </del> # Enable the dashboard and recheck health <del> # monA.succeed( #     "ceph mgr module enable dashboard", #     "ceph config set mgr mgr/dashboard/ssl false", #     # default is 8080 but it's better to be explicit #     "ceph config set mgr mgr/dashboard/server_port 8080", # ) # monA.wait_for_open_port(8080) # monA.wait_until_succeeds("curl -q --fail http://localhost:8080") # monA.wait_until_succeeds("ceph -s | grep 'HEALTH_OK'") </del> <ins> monA.succeed( "ceph mgr module enable dashboard", "ceph config set mgr mgr/dashboard/ssl false", # default is 8080 but it's better to be explicit "ceph config set mgr mgr/dashboard/server_port 8080", ) monA.wait_for_open_port(8080) monA.wait_until_succeeds("curl -q --fail http://localhost:8080") monA.wait_until_succeeds("ceph -s | grep 'HEALTH_OK'") </ins> ''; in { name = "basic-single-node-ceph-cluster";

, callPackage , cargo , cffi <ins> , cryptography-vectors ? (callPackage ./vectors.nix { }) </ins> , fetchPypi , hypothesis , iso8601

, setuptoolsRustBuildHook }: <del> let cryptography-vectors = callPackage ./vectors.nix { }; in </del> buildPythonPackage rec { pname = "cryptography"; version = "41.0.7"; # Also update the hash in vectors.nix

, zlib , zstd <ins> # Dependencies of overridden Python dependencies, hopefully we can remove these soon. , rustPlatform </ins> # Optional Dependencies , curl ? null , expat ? null

# Watch out for python <> boost compatibility python = python310.override { <del> packageOverrides = self: super: { </del> <ins> packageOverrides = self: super: let cryptographyOverrideVersion = "40.0.1"; in { # Ceph does not support `cryptography` > 40 yet: # * https://github.com/NixOS/nixpkgs/pull/281858#issuecomment-1899358602 # * Upstream issue: https://tracker.ceph.com/issues/63529 #   > Python Sub-Interpreter Model Used by ceph-mgr Incompatible With Python Modules Based on PyO3 # # We pin the older `cryptography` 40 here; # this also forces us to pin an older `pyopenssl` because the current one # is not compatible with older `cryptography`, see: #     https://github.com/pyca/pyopenssl/blob/d9752e44127ba36041b045417af8a0bf16ec4f1e/CHANGELOG.rst#2320-2023-05-30 cryptography = super.cryptography.overridePythonAttrs (old: rec { version = cryptographyOverrideVersion; src = fetchPypi { inherit (old) pname; version = cryptographyOverrideVersion; hash = "sha256-KAPy+LHpX2FEGZJsfm9V2CivxhTKXtYVQ4d65mjMNHI="; }; cargoDeps = rustPlatform.fetchCargoTarball { inherit src; sourceRoot = let cargoRoot = "src/rust"; in "${old.pname}-${cryptographyOverrideVersion}/${cargoRoot}"; name = "${old.pname}-${cryptographyOverrideVersion}"; hash = "sha256-gFfDTc2QWBWHBCycVH1dYlCsWQMVcRZfOBIau+njtDU="; }; patches = (old.patches or []) ++ [ # Fix https://nvd.nist.gov/vuln/detail/CVE-2023-49083 which has no upstream backport. # See https://github.com/pyca/cryptography/commit/f09c261ca10a31fe41b1262306db7f8f1da0e48a#diff-f5134bf8f3cf0a5cc8601df55e50697acc866c603a38caff98802bd8e17976c5R1893 ./python-cryptography-Cherry-pick-fix-for-CVE-2023-49083-on-cryptography-40.patch ]; # Tests would require overriding `cryptography-vectors`, which is not currently # possible/desired, see: https://github.com/NixOS/nixpkgs/pull/281858#pullrequestreview-1841421866 doCheck = false; }); # This is the most recent version of `pyopenssl` that's still compatible with `cryptography` 40. # See https://github.com/NixOS/nixpkgs/pull/281858#issuecomment-1899358602 pyopenssl = super.pyopenssl.overridePythonAttrs (old: rec { version = "23.1.1"; src = fetchPypi { pname = "pyOpenSSL"; inherit version; hash = "sha256-hBSYub7GFiOxtsR+u8AjZ8B9YODhlfGXkIF/EMyNsLc="; }; }); # Ceph does not support `kubernetes` >= 19, see: #     https://github.com/NixOS/nixpkgs/pull/281858#issuecomment-1900324090 kubernetes = super.kubernetes.overridePythonAttrs (old: rec { version = "18.20.0"; src = fetchFromGitHub { owner = "kubernetes-client"; repo = "python"; rev = "v${version}"; sha256 = "1sawp62j7h0yksmg9jlv4ik9b9i1a1w9syywc9mv8x89wibf5ql1"; fetchSubmodules = true; }; }); </ins> }; };

<ins> commit 08dbad8552ecca85d3e38072f94eb864b143d218 Author: Niklas Hambüchen <mail@nh2.me> Date:   Mon Jan 22 12:52:06 2024 +0000 Cherry-pick fix for CVE-2023-49083 Cherry-Picked-From: f09c261ca10a31fe41b1262306db7f8f1da0e48a Cherry-Picked-By: Niklas Hambüchen <mail@nh2.me> diff --git a/src/cryptography/hazmat/backends/openssl/backend.py b/src/cryptography/hazmat/backends/openssl/backend.py index a3fe1bce4..58e7207c4 100644 --- a/src/cryptography/hazmat/backends/openssl/backend.py +++ b/src/cryptography/hazmat/backends/openssl/backend.py @@ -2383,9 +2383,12 @@ class Backend: _Reasons.UNSUPPORTED_SERIALIZATION, ) +        certs: list[x509.Certificate] = [] +        if p7.d.sign == self._ffi.NULL: +            return certs + sk_x509 = p7.d.sign.cert num = self._lib.sk_X509_num(sk_x509) -        certs = [] for i in range(num): x509 = self._lib.sk_X509_value(sk_x509, i) self.openssl_assert(x509 != self._ffi.NULL) diff --git a/tests/hazmat/primitives/test_pkcs7.py b/tests/hazmat/primitives/test_pkcs7.py index 4e61c5ef5..d8170bfb9 100644 --- a/tests/hazmat/primitives/test_pkcs7.py +++ b/tests/hazmat/primitives/test_pkcs7.py @@ -89,6 +89,12 @@ class TestPKCS7Loading: mode="rb", ) +    def test_load_pkcs7_empty_certificates(self, backend): +        der = b"x30x0Bx06x09x2Ax86x48x86xF7x0Dx01x07x02" + +        certificates = pkcs7.load_der_pkcs7_certificates(der) +        assert certificates == [] + # We have no public verification API and won't be adding one until we get # some requirements from users so this function exists to give us basic </ins>

libceph = ceph.lib; inherit (callPackages ../tools/filesystems/ceph { <del> lua = lua5_4; fmt = fmt_8; </del> <ins> lua = lua5_4; # Ceph currently requires >= 5.3 # To see which `fmt` version Ceph upstream recommends, check its `src/fmt` submodule. # # Ceph does not currently build with `fmt_10`; see https://github.com/NixOS/nixpkgs/issues/281027#issuecomment-1899128557 # If we want to switch for that before upstream fixes it, use this patch: # https://github.com/NixOS/nixpkgs/pull/281858#issuecomment-1899648638 fmt = fmt_9; </ins> }) ceph ceph-client;