Change:
, CVSSv3=7.8 (nixos-20.03) Scanned versions: nixos-20.03: . May contain false positives.
See also:
PR for unstable: PR for 20.03:
This is still an issue.
oops, sorry
We only use config files. We could probably just delete everything but from the derivation, or remove it from top-level.
Yeah, but we still ship the fontconfig binary in nixpkgs. Is there any reason we still need to provide config files parse-able by 2.10.x fontconfig implementations?
I doubt there is much of a reason these days, nobody will be running programs compiled against fontconfig 2.10. I just do not want to remove it now so that possible breakage caused by is not mixed with potential downfall from removing the unversioned path.
is a new attempt to address this.

Discussion:
There are no functional changes, however this may require updating some configurations to use correct types for all attributes. </para> </listitem> <ins> <listitem> <para> The <literal>fontconfig</literal> module stopped generating fontconfig 2.10.x config and cache. Fontconfig 2.10.x was removed from Nixpkgs - it hasn't been used in any nixpkgs package anymore. </para> </listitem> </ins> </itemizedlist> </section> </section>

/* <del> NixOS support 2 fontconfig versions, "support" and "latest". - "latest" refers to default fontconfig package (pkgs.fontconfig). configuration files are linked to /etc/fonts/VERSION/conf.d/ - "support" refers to supportPkg (pkgs."fontconfig_${supportVersion}"). configuration files are linked to /etc/fonts/conf.d/ </del> <ins> Configuration files are linked to /etc/fonts/${pkgs.fontconfig.configVersion}/conf.d/ </ins> This module generates a package containing configuration files and link it in /etc/fonts.

cfg = config.fonts.fontconfig; fcBool = x: "<bool>" + (boolToString x) + "</bool>"; <del> # back-supported fontconfig version and package # version is used for font cache generation supportVersion = "210"; supportPkg     = pkgs."fontconfig_${supportVersion}"; # latest fontconfig version and package # version is used for configuration folder name, /etc/fonts/VERSION/ # note: format differs from supportVersion and can not be used with makeCacheConf latestVersion  = pkgs.fontconfig.configVersion; latestPkg      = pkgs.fontconfig; # supported version fonts.conf supportFontsConf = pkgs.makeFontsConf { fontconfig = supportPkg; fontDirectories = config.fonts.fonts; }; </del> <ins> pkg = pkgs.fontconfig; </ins> # configuration file to read fontconfig cache <del> # version dependent </del> # priority 0 <del> cacheConfSupport = makeCacheConf { version = supportVersion; }; cacheConfLatest  = makeCacheConf {}; </del> <ins> cacheConf  = makeCacheConf {}; </ins> <del> # generate the font cache setting file for a fontconfig version # use latest when no version is passed </del> <ins> # generate the font cache setting file </ins> # When cross-compiling, we can’t generate the cache, so we skip the # <cachedir> part. fontconfig still works but is a little slower in # looking things up. <del> makeCacheConf = { version ? null }: </del> <ins> makeCacheConf = { }: </ins> let <del> fcPackage = if version == null then "fontconfig" else "fontconfig_${version}"; </del> makeCache = fontconfig: pkgs.makeFontsCache { inherit fontconfig; fontDirectories = config.fonts.fonts; }; <del> cache     = makeCache pkgs.${fcPackage}; cache32   = makeCache pkgs.pkgsi686Linux.${fcPackage}; </del> <ins> cache     = makeCache pkgs.fontconfig; cache32   = makeCache pkgs.pkgsi686Linux.fontconfig; </ins> in pkgs.writeText "fc-00-nixos-cache.conf" '' <?xml version='1.0'?>

confPkg = pkgs.runCommand "fontconfig-conf" { preferLocalBuild = true; } '' <del> support_folder=$out/etc/fonts/conf.d latest_folder=$out/etc/fonts/${latestVersion}/conf.d mkdir -p $support_folder mkdir -p $latest_folder </del> <ins> dst=$out/etc/fonts/${pkg.configVersion}/conf.d mkdir -p $dst </ins> # fonts.conf <del> ln -s ${supportFontsConf} $support_folder/../fonts.conf ln -s ${latestPkg.out}/etc/fonts/fonts.conf  $latest_folder/../fonts.conf </del> <ins> ln -s ${pkg.out}/etc/fonts/fonts.conf  $dst/../fonts.conf </ins> # fontconfig default config files <del> ln -s ${supportPkg.out}/etc/fonts/conf.d/*.conf  $support_folder/ # Latest fontconfig is configured to look for the upstream defaults inside the package. </del> <ins> ln -s ${pkg.out}/etc/fonts/conf.d/*.conf  $dst/ # update 51-local.conf path to look at local.conf rm  $dst/51-local.conf substitute ${pkg.out}/etc/fonts/conf.d/51-local.conf  $dst/51-local.conf  --replace local.conf /etc/fonts/${pkg.configVersion}/local.conf </ins> # 00-nixos-cache.conf <del> ln -s ${cacheConfSupport}  $support_folder/00-nixos-cache.conf ln -s ${cacheConfLatest}  $latest_folder/00-nixos-cache.conf </del> <ins> ln -s ${cacheConf}  $dst/00-nixos-cache.conf </ins> # 10-nixos-rendering.conf <del> ln -s ${renderConf}       $support_folder/10-nixos-rendering.conf ln -s ${renderConf}       $latest_folder/10-nixos-rendering.conf </del> <ins> ln -s ${renderConf}       $dst/10-nixos-rendering.conf </ins> # 50-user.conf ${optionalString (!cfg.includeUserConf) '' <del> rm $support_folder/50-user.conf ''} # Since latest fontconfig looks for default files inside the package, # we had to move this one elsewhere to be able to exclude it here. ${optionalString cfg.includeUserConf '' ln -s ${latestPkg.out}/etc/fonts/conf.d.bak/50-user.conf $latest_folder/50-user.conf </del> <ins> rm $dst/50-user.conf </ins> ''} # local.conf (indirect priority 51) ${optionalString (cfg.localConf != "") '' <del> ln -s ${localConf}        $support_folder/../local.conf ln -s ${localConf}        $latest_folder/../local.conf </del> <ins> ln -s ${localConf}        $dst/../local.conf </ins> ''} # 52-nixos-default-fonts.conf <del> ln -s ${defaultFontsConf} $support_folder/52-nixos-default-fonts.conf ln -s ${defaultFontsConf} $latest_folder/52-nixos-default-fonts.conf </del> <ins> ln -s ${defaultFontsConf} $dst/52-nixos-default-fonts.conf </ins> # 53-no-bitmaps.conf <del> ln -s ${rejectBitmaps} $support_folder/53-no-bitmaps.conf ln -s ${rejectBitmaps} $latest_folder/53-no-bitmaps.conf </del> <ins> ln -s ${rejectBitmaps} $dst/53-no-bitmaps.conf </ins> ${optionalString (!cfg.allowType1) '' # 53-nixos-reject-type1.conf <del> ln -s ${rejectType1} $support_folder/53-nixos-reject-type1.conf ln -s ${rejectType1} $latest_folder/53-nixos-reject-type1.conf </del> <ins> ln -s ${rejectType1} $dst/53-nixos-reject-type1.conf </ins> ''} '';

<del> { stdenv, fetchurl, pkgconfig, freetype, expat }: stdenv.mkDerivation rec { name = "fontconfig-2.10.2"; src = fetchurl { url = "http://fontconfig.org/release/${name}.tar.bz2"; sha256 = "0llraqw86jmw4vzv7inskp3xxm2gc64my08iwq5mzncgfdbfza4f"; }; outputs = [ "bin" "dev" "lib" "out" ]; # $out contains all the config propagatedBuildInputs = [ freetype ]; nativeBuildInputs = [ pkgconfig ]; buildInputs = [ expat ]; configureFlags = [ "--with-arch=${stdenv.hostPlatform.parsed.cpu.name}" "--sysconfdir=/etc" "--with-cache-dir=/var/cache/fontconfig" "--disable-docs" "--with-default-fonts=" ] ++ stdenv.lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [ "--with-arch=${stdenv.hostPlatform.parsed.cpu.name}" ]; enableParallelBuilding = true; doCheck = true; # Don't try to write to /var/cache/fontconfig at install time. installFlags = [ "sysconfdir=$(out)/etc" "fc_cachedir=$(TMPDIR)/dummy" "RUN_FC_CACHE_TEST=false" ]; passthru = { # Empty for backward compatibility, there was no versioning before 2.11 configVersion = ""; }; meta = with stdenv.lib; { description = "A library for font customization and configuration"; homepage = "http://fontconfig.org/"; license = licenses.bsd2; # custom but very bsd-like platforms = platforms.all; maintainers = [ maintainers.vcunat ]; }; } </del>

fontconfig-ultimate has been removed. The repository has been archived upstream and activity has ceased for several years. https://github.com/bohoomil/fontconfig-ultimate/issues/171. ''; <ins> # 2020-07-21 fontconfig_210 = throw '' fontconfig 2.10.x hasn't had a release in years, is vulnerable to CVE-2016-5384 and has only been used for old fontconfig caches. ''; </ins> font-droid = throw "font-droid has been deprecated by noto-fonts"; # 2019-04-12 foomatic_filters = foomatic-filters;  # 2016-08 fuse_exfat = exfat;                   # 2015-09-11

cfitsio = callPackage ../development/libraries/cfitsio { }; <del> fontconfig_210 = callPackage ../development/libraries/fontconfig/2.10.nix { }; </del> fontconfig = callPackage ../development/libraries/fontconfig { }; fontconfig-penultimate = callPackage ../data/fonts/fontconfig-penultimate {};