jiebi/CodeConvo huggingface dataset:
Change:
claims that 3.17.5 is not vulnerable, and we have 3.17.7 already (.6 on 14.12). The default kernel is 3.14.27, which was released two days ago, so it's likely patched as well (I'll pick that bump to releases).
The default kernel on 14.04 was most likely vulnerable, so I updated it.
All our kernels are up to date, so they should be safe.

Discussion:
import ./generic.nix ( rec { <del> version = "3.4.2"; </del> <ins> version = "3.4.4"; </ins> testing = false; preConfigure = ''

src = fetchurl { url = "mirror://kernel/linux/kernel/v3.x/${if testing then "testing/" else ""}linux-${version}.tar.xz"; <del> sha256 = "0pd96g1qcp2wgdnvk79hljjrpr6xjk0159lks47n181a3yirzf4x"; </del> <ins> sha256 = "0l4h7amhsmgpnii8rgwi32nd7ajsifk2xckjd39pfzwdifacw5yw"; </ins> }; config = configWithPlatform stdenv.platform;
Change:
Commit was cherry-picked on , upgrading Linux to . This broke the Linux kernel build (): Correspondingly Hydra at has 656 newly failing jobs. does not have the issue, but all newer kernels do, e.g. the current . From I suspect the fix in newer branches is commit . Don't know yet what the corresponding transformation on in is. We should immediately either fix this using the same transformation as in commit or revert the upgrade, so that people still using don't suffer from this. (It is officially EOL but the fact that there was a kernel backport shows that some still care / are migrating.) CC
I have a fix
PR at
Should be fixed once the mentioned PR is built.

Discussion:
NFS_V4_SECURITY_LABEL y ''} CIFS_XATTR y <del> CIFS_POSIX y </del> <ins> CIFS_POSIX? y </ins> CIFS_FSCACHE y CIFS_STATS y CIFS_WEAK_PW_HASH y
Change:
youtube-dl on January 15, 2019 at 7:25 PM UTC. N/A Please run and paste the results. N/A

Discussion:
# The websites youtube-dl deals with are a very moving target. That means that # downloads break constantly. Because of that, updates should always be backported # to the latest stable release. <del> version = "2019.01.10"; </del> <ins> version = "2019.01.16"; </ins> src = fetchurl { url = "https://yt-dl.org/downloads/${version}/${pname}-${version}.tar.gz"; <del> sha256 = "07r1y06697vhbkbf8pix4cnybaqmlf1wb2df5glj2xv8nl6f51gd"; </del> <ins> sha256 = "1dhbr5n0l6dgjp1620jp30kaizrzagacrj64gd9pwy1916kjm7si"; </ins> }; nativeBuildInputs = [ makeWrapper ];
Change:
Commit introduced to the configuration of . This causes to no longer work, with the following message: Run , where is a truecrypt volume. system: host os: multi-user?: sandbox: version: channels(root): nixpkgs:
The issue for re-enabling kernel_crypto is
It also breaks
Thank you for your contributions. This has been automatically marked as stale because it has had no activity for 180 days. If this is still important to you, we ask that you leave a comment below. Your comment can be as simple as "still important to me". This lets people see that at least one person still cares about this. Someone will have to do this at most twice a year if there is no other activity. Here are suggestions that might help resolve this more quickly: for maintainers and people that previously touched the related code and @ mention them in a comment. on the . on the on .
still important to me
I marked this as stale due to inactivity. &rarr;
are you sure this is still an issue? This seems to have been solved by . e.g. cryptsetup benchmark works just fine on my machine.
I did not check and do not care anymore. Thanks!

Discussion:
default = [ "aes" "aes_generic" "blowfish" "twofish" "serpent" "cbc" "xts" "lrw" "sha1" "sha256" "sha512" <ins> "af_alg" "algif_skcipher" </ins> (if pkgs.stdenv.hostPlatform.system == "x86_64-linux" then "aes_x86_64" else "aes_i586") ];

}; }; <del> makeLuksRootTest = name: luksFormatOpts: makeInstallerTest "luksroot-format2" </del> <ins> makeLuksRootTest = name: luksFormatOpts: makeInstallerTest name </ins> { createPartitions = '' $machine->succeed( "flock /dev/vda parted --script /dev/vda -- mklabel msdos"

NIX_LDFLAGS = "-lgcc_s"; configureFlags = [ <del> "--disable-kernel_crypto" </del> "--enable-cryptsetup-reencrypt" "--with-crypto_backend=openssl" ] ++ stdenv.lib.optional enablePython "--enable-python";
Change:
is a dead URL now, so the reference for this dependency needs to be updated i think please let me know if i can take other measures to circumvent or resolve the issue
You can quickly work around this e.g. by (re-run your failing build afterwards).
I guess is something completely different, and I see no other URL which could be upstream. Let's use Gentoo mirrors for now.

Discussion:
import ./generic.nix ( rec { <del> version = "3.4.2"; </del> <ins> version = "3.4.4"; </ins> testing = false; preConfigure = ''

src = fetchurl { url = "mirror://kernel/linux/kernel/v3.x/${if testing then "testing/" else ""}linux-${version}.tar.xz"; <del> sha256 = "0pd96g1qcp2wgdnvk79hljjrpr6xjk0159lks47n181a3yirzf4x"; </del> <ins> sha256 = "0l4h7amhsmgpnii8rgwi32nd7ajsifk2xckjd39pfzwdifacw5yw"; </ins> }; config = configWithPlatform stdenv.platform;
Change:
The module is not found, resulting in this error on boot: I think this is because defaults to but the corresponding kernel modules don't seem to be compiled anywhere. Or at least not anywhere I could find. On nixos, set to True (the default), , reboot, then run
I run into this same issue.
I've made a change that should hopefully fix this () but I have yet to test it.
Are we sure this is a complete fix? I don't know much about sound daemons on Linux, but I did run across (emphasis ): Perhaps we also need to check before inserting into at I don't know if this is necessary, or really how to test it, but if the Arch wiki is correct, it seems like inserting this module risks breaking pulseaudio.
(FWIW, was to six years ago in )
Good point. I'd say should probably default to false regardless of pulseaudio — the OSS emulation hasn't actually been working for a while, and it can be done in a more versatile (e.g. not blocking other sound) way in user space using .

Discussion:
SND_HDA_RECONFIG    = yes; # Support reconfiguration of jack functions # Support configuring jack functions via fw mechanism at boot SND_HDA_PATCH_LOADER = yes; <ins> SND_OSSEMUL         = yes; </ins> SND_USB_CAIAQ_INPUT = yes; # Enable PSS mixer (Beethoven ADSP-16 and other compatible) PSS_MIXER           = whenOlder "4.12" yes;
Change:
Operations like File -Open crashes DrRacket with the error EDIT: I installed from unstable Install Start Presssystem: host os: multi-user?: sandbox: version: channels(root): channels(simendsjo): nixpkgs:
I strongly suspect it needs . I can take a quick look.

Discussion:
, disableDocs ? false , CoreFoundation , gsettings-desktop-schemas <ins> , wrapGAppsHook </ins> }: let

(stdenv.lib.optionalString stdenv.isDarwin "-framework CoreFoundation") ]; <del> buildInputs = [ fontconfig libffi libtool makeWrapper sqlite gsettings-desktop-schemas gtk3 ] </del> <ins> nativeBuildInputs = [ wrapGAppsHook ]; buildInputs = [ fontconfig libffi libtool sqlite gsettings-desktop-schemas gtk3 ] </ins> ++ stdenv.lib.optionals stdenv.isDarwin [ libiconv CoreFoundation ]; preConfigure = ''

done mkdir src/build cd src/build <ins> gappsWrapperArgs+=("--prefix" "LD_LIBRARY_PATH" ":" $LD_LIBRARY_PATH) </ins> ''; shared = if stdenv.isDarwin then "dylib" else "shared";

enableParallelBuilding = false; <del> postInstall = '' for p in $(ls $out/bin/) ; do wrapProgram $out/bin/$p  --prefix LD_LIBRARY_PATH ":" "${LD_LIBRARY_PATH}"  --prefix XDG_DATA_DIRS ":" "$GSETTINGS_SCHEMAS_PATH"; done ''; </del> meta = with stdenv.lib; { description = "A programmable programming language";
Change:
is not valid. The needs to be .
Thanks for opening this! I noticed this too but forgot to make an issue. So this is part of the macOS section? I think the issue is whether you are using GNU coreutils or Apple's filecmds. Apple's filecmds needs the lower case: while GNU's coreutils needs the upper case. I propose just rewriting the instructions so that it reads: To require the least assumptions.
That's exactly the same? I'd try to detect the operating system and based on that render the version of interest with a link to other operating systems and show the operating system dependent version. Or, simpler: . Additionally, I would display the version of the command pointing at the latest graphical stable iso.
I guess the intention is to avoid using nix-installed , as that would be GNU one even if on macOS. I'm against that approach. Detection like this is bad for "portability". It's better to be explicit and provide system-specific section like we do now. The line you refer to is in sub-section titled "On macOS".
Fix in

Discussion:
[..] $ diskutil unmountDisk diskN Unmount of all volumes on diskN was successful <del> $ sudo dd bs=1m if=nix.iso of=/dev/rdiskN </del> <ins> $ sudo dd bs=1000000 if=nix.iso of=/dev/rdiskN </ins> </programlisting> Using the 'raw' <command>rdiskN</command> device instead of <command>diskN</command> completes in minutes instead of hours. After
Change:
Shotwell does not store its configuration when running under nix. Specifically, on startup, it says: Is there a standard way of fixing such issue in nix? In case it's relevant, I'm not running nixos, but the nixpkgs unstable channel on a Fedora box.
Try wrapping the binary with . Also on your non-nixos system you should have dconf installed at least.
Many thanks for the tip - I can confirm that this fixes the problem. I will submit a pull request later today.
Reopening, close when the fix is committed.
Sorry for closing prematurely; closing now. Thanks again for being so helpful!
Reopening, let's make sure this one is documented.
document what? This issue is closed, we can open another one for documentation. There's already an issue for documenting GNOME stuff iirc. Mostly because the commit refers to this issue.
"Documentation for Gnome3 packaging".

Discussion:
{ fetchurl, stdenv, m4, glibc, gtk3, libexif, libgphoto2, libsoup, libxml2, vala, sqlite, webkitgtk24x , pkgconfig, gnome3, gst_all_1, which, udev, libraw, glib, json_glib, gettext, desktop_file_utils <del> , lcms2, gdk_pixbuf, librsvg, makeWrapper, gnome_doc_utils }: </del> <ins> , lcms2, gdk_pixbuf, librsvg, makeWrapper, gnome_doc_utils, hicolor_icon_theme }: </ins> # for dependencies see http://www.yorba.org/projects/shotwell/install/

preFixup = '' wrapProgram "$out/bin/shotwell"  --set GDK_PIXBUF_MODULE_FILE "$GDK_PIXBUF_MODULE_FILE"  <del> --prefix XDG_DATA_DIRS : "$XDG_ICON_DIRS:${gtk3}/share:$out/share:$GSETTINGS_SCHEMAS_PATH" </del> <ins> --prefix XDG_DATA_DIRS : "$XDG_ICON_DIRS:${gtk3}/share:$out/share:$GSETTINGS_SCHEMAS_PATH"  --prefix GIO_EXTRA_MODULES : "${gnome3.dconf}/lib/gio/modules" </ins> rm $out/share/icons/hicolor/icon-theme.cache '';

gst_all_1.gstreamer gst_all_1.gst-plugins-base gnome3.libgee which udev gnome3.gexiv2 libraw rest json_glib gettext desktop_file_utils glib lcms2 gdk_pixbuf librsvg makeWrapper gnome_doc_utils <del> gnome3.gnome_icon_theme gnome3.gnome_icon_theme_symbolic ]; </del> <ins> gnome3.gnome_icon_theme gnome3.gnome_icon_theme_symbolic hicolor_icon_theme ]; </ins> meta = with stdenv.lib; { description = "Popular photo organizer for the GNOME desktop";
Change:
We don't seem to have a sane default in openssl 1.1. Example: Compare to openssl 1.0.2 (default ATM): The problem also propagates to (and probably elsewhere). Of course, the CA path can be overridden via parameters and/or env vars, but we do need a sane default, too. With 1.0.2 we apply to get default, whereas with 1.1 I can't see any similar change. I haven't dug deep so far. I guess you won't remember why you "dropped" the patch in ? EDIT: I see the patched file has moved in upstream source tree.

Discussion:
<ins> diff --git a/include/internal/cryptlib.h b/include/internal/cryptlib.h index 329ef62..9a8df64 100644 --- a/include/internal/cryptlib.h +++ b/include/internal/cryptlib.h @@ -56,7 +56,7 @@ DEFINE_LHASH_OF(MEM); # ifndef OPENSSL_SYS_VMS #  define X509_CERT_AREA          OPENSSLDIR #  define X509_CERT_DIR           OPENSSLDIR "/certs" -#  define X509_CERT_FILE          OPENSSLDIR "/cert.pem" +#  define X509_CERT_FILE          "/nix/var/nix/profiles/default/etc/ssl/certs/ca-bundle.crt" #  define X509_PRIVATE_DIR        OPENSSLDIR "/private" #  define CTLOG_FILE              OPENSSLDIR "/ct_log_list.cnf" # else </ins>

<ins> diff --git a/include/internal/cryptlib.h b/include/internal/cryptlib.h index 329ef62..9a8df64 100644 --- a/include/internal/cryptlib.h +++ b/include/internal/cryptlib.h @@ -56,7 +56,7 @@ DEFINE_LHASH_OF(MEM); # ifndef OPENSSL_SYS_VMS #  define X509_CERT_AREA          OPENSSLDIR #  define X509_CERT_DIR           OPENSSLDIR "/certs" -#  define X509_CERT_FILE          OPENSSLDIR "/cert.pem" +#  define X509_CERT_FILE          "/etc/ssl/certs/ca-certificates.crt" #  define X509_PRIVATE_DIR        OPENSSLDIR "/private" #  define CTLOG_FILE              OPENSSLDIR "/ct_log_list.cnf" # else </ins>

openssl_1_1 = common { version = "1.1.1a"; sha256 = "0hcz7znzznbibpy3iyyhvlqrq44y88plxwdj32wjzgbwic7i687w"; <del> patches = [ ./1.1/nix-ssl-cert-file.patch ]; </del> <ins> patches = [ ./1.1/nix-ssl-cert-file.patch (if stdenv.hostPlatform.isDarwin then ./1.1/use-etc-ssl-certs-darwin.patch else ./1.1/use-etc-ssl-certs.patch) ]; </ins> withDocs = true; };
Change:
By default resilio listen to 0.0.0.0. I wanted to know if it would not be more reasonable to listen on 127.0.0.1 It is only an admin interface that has no influence on the other components of the application.
Perhaps. According to this article the application default is 127.0.0.1. On the other hand we have the firewall enabled by default.
ping
Yes. would be more sensible.

Discussion:
<link xlink:href="https://github.com/NixOS/nixpkgs/issues/89205">#89205</link>. </para> </listitem> <ins> <listitem> <para> In the <literal>resilio</literal> module, <xref linkend="opt-services.resilio.httpListenAddr"/> has been changed to listen to <literal>[::1]</literal> instead of <literal>0.0.0.0</literal>. </para> </listitem> </ins> </itemizedlist> </section>

httpListenAddr = mkOption { type = types.str; <del> default = "0.0.0.0"; example = "1.2.3.4"; </del> <ins> default = "[::1]"; example = "0.0.0.0"; </ins> description = '' HTTP address to bind to. '';
Change:
Get netsurf onto your machine and attempt to execute it, notice how it is broken. Specifically nothing happens, other than the terminal (ST in this case) displays a single . Trying another terminal such as Kitty or the Linux console spews a sequence of characters onto the display. Neither behavior is correct. system: host os: multi-user?: sandbox: version: channels(root): channels(sna): nixpkgs:
That's because by default it uses the framebuffer. Try edit: oh wait you tried it on the linux console, which should support the fb. forget what I said then
I do have sixel support patched into ST so it should work using the framebuffer build. I tested in ST and the Linux console and it ended up working with some problems already mentioned in the PR.
Does it still support the framebuffer? It seems to set the GTK3 as the default. When I try to build , I get the following error:
^
Framebuffer still works. What happened is . should fix your error.
This unfortunately still gave me the same error, but perhaps I didn't set the environment variable right. nix repl: NIXCFLAGSCOMPILE = "-fcommon" :l <nixpkgs:b netsurf.browser.override { uilib="framebuffer"; } The error mentions certain fonts specifically, not sure what is up with that. Thanks for the pointer though!
does that work for you? If so, we could apply the fix in nixpkgs

Discussion:
++ optional (uilib == "gtk3") gtk3 ; <ins> # Since at least 2018 AD, GCC and other compilers run in `-fno-common` mode as # default, in order to comply with C standards and also get rid of some bad # quality code. Because of this, many codebases that weren't updated need to # be patched -- or the `-fcommon` flag should be explicitly passed to the # compiler # https://gcc.gnu.org/bugzilla/show_bug.cgi?id=85678 # https://github.com/NixOS/nixpkgs/issues/54506 env.NIX_CFLAGS_COMPILE = "-fcommon"; </ins> preConfigure = '' cat <<EOF > Makefile.conf override NETSURF_GTK_RES_PATH  := $out/share/
Change:
appears to be a binary component used to help Firefox use cast to Chromecast devices:
Yes please!

Discussion:
, google_talk_plugin, fribid, gnome3/*.gnome-shell*/ , browserpass, chrome-gnome-shell, uget-integrator, plasma-browser-integration, bukubrow , tridactyl-native <ins> , fx_cast_bridge </ins> , udev , kerberos }:

++ lib.optional (cfg.enableGnomeExtensions or false) chrome-gnome-shell ++ lib.optional (cfg.enableUgetIntegrator or false) uget-integrator ++ lib.optional (cfg.enablePlasmaBrowserIntegration or false) plasma-browser-integration <ins> ++ lib.optional (cfg.enableFXCastBridge or false) fx_cast_bridge </ins> ++ extraNativeMessagingHosts ); libs =   lib.optional stdenv.isLinux udev

<ins> { stdenv, fetchurl, dpkg }: stdenv.mkDerivation rec { pname = "fx_cast_bridge"; version = "0.0.5"; src = fetchurl { url = "https://github.com/hensm/fx_cast/releases/download/v${version}/${pname}-${version}-x64.deb"; sha256 = "1qmp1d7miq7c2q8i4bhfp5ywxdngvyi7rjl6i82is2g5nhr7gbvv"; }; nativeBuildInputs = [ dpkg ]; unpackPhase = '' runHook preUnpack dpkg-deb -xv $src ./ runHook postUnpack ''; dontBuild = true; dontPatchELF = true; installPhase = '' install -DT {opt/fx_cast,$out/bin}/${pname} install -DT {usr,$out}/lib/mozilla/native-messaging-hosts/${pname}.json substituteInPlace $out/lib/mozilla/native-messaging-hosts/${pname}.json  --replace {/opt/fx_cast,$out/bin}/${pname} ''; # See now-cli/default.nix dontStrip = true; preFixup = let libPath = stdenv.lib.makeLibraryPath [stdenv.cc.cc stdenv.cc.libc]; bin = "$out/bin/${pname}"; in '' orig_size=$(stat --printf=%s ${bin}) patchelf --set-interpreter "${stdenv.cc.bintools.dynamicLinker}" ${bin} patchelf --set-rpath ${libPath} ${bin} chmod +x ${bin} new_size=$(stat --printf=%s ${bin}) ###### zeit-pkg fixing starts here. # we're replacing plaintext js code that looks like # PAYLOAD_POSITION = '1234                  ' | 0 # [...] # PRELUDE_POSITION = '1234                  ' | 0 # ^-----20-chars-----^^------22-chars------^ # ^-- grep points here # # var_* are as described above # shift_by seems to be safe so long as all patchelf adjustments occur # before any locations pointed to by hardcoded offsets var_skip=20 var_select=22 shift_by=$(expr $new_size - $orig_size) function fix_offset { # $1 = name of variable to adjust location=$(grep -obUam1 "$1" ${bin} | cut -d: -f1) location=$(expr $location + $var_skip) value=$(dd if=${bin} iflag=count_bytes,skip_bytes skip=$location  bs=1 count=$var_select status=none) value=$(expr $shift_by + $value) echo -n $value | dd of=${bin} bs=1 seek=$location conv=notrunc } fix_offset PAYLOAD_POSITION fix_offset PRELUDE_POSITION ''; meta = with stdenv.lib; { description = "Implementation of the Chrome Sender API (Chromecast) within Firefox"; homepage = https://hensm.github.io/fx_cast/; license = licenses.mit; maintainers = with maintainers; [ dtzWill ]; }; } </ins>

fwup = callPackage ../tools/misc/fwup { }; <ins> fx_cast_bridge = callPackage ../tools/misc/fx_cast { }; </ins> fzf = callPackage ../tools/misc/fzf { }; fzf-zsh = callPackage ../shells/zsh/fzf-zsh { };
Change:
My additional modules for my awesomeWM configuration (specifically and ) stopped working after an upgrade, giving me , where XXXX is usually or . I keep these in and use them like . This fixes it for me: I'm just wondering if this should be something overriden by users or it should be made the default. If not, feel free to close this, otherwise I can open a PR. Or maybe there is a better way for me to fix this for my situation(other than using in ?
One day I will find the perfect title for this...
It's due to my commit .
Can you please use in the override? Feel free to open a PR I will merge then.

Discussion:
}; awesome-3-5 = callPackage ../applications/window-managers/awesome { cairo = cairo.override { xcbSupport = true; }; <ins> luaPackages = luaPackages.override { inherit lua; }; </ins> }; awesome = awesome-3-5;
Change:
, (nixos-unstable) Scanned versions: nixos-unstable: . May contain false positives.
Still no new release from upstream. Looks like the discussion sort of fizzled out: Ubuntu and RHEL apply a patch for this, see for example:
Should be backported as well.
Looks like the patch was applied to unstable and backported to 19.09. Can we close this issue?

Discussion:
<ins> --- a/src/lapi.c +++ b/src/lapi.c @@ -1285,14 +1285,14 @@ LUA_API void *lua_upvalueid (lua_State * LUA_API void lua_upvaluejoin (lua_State *L, int fidx1, int n1, int fidx2, int n2) { -  LClosure *f1; -  UpVal **up1 = getupvalref(L, fidx1, n1, &f1); +  UpVal **up1 = getupvalref(L, fidx1, n1, NULL); /* the last parameter not needed */ UpVal **up2 = getupvalref(L, fidx2, n2, NULL); +  if (*up1 == *up2) return; /* Already joined */ +  (*up2)->refcount++; +  if (upisopen(*up2)) (*up2)->u.open.touched = 1; +  luaC_upvalbarrier(L, *up2); luaC_upvdeccount(L, *up1); *up1 = *up2; -  (*up1)->refcount++; -  if (upisopen(*up1)) (*up1)->u.open.touched = 1; -  luaC_upvalbarrier(L, *up1); } </ins>

# similar to interpreters/python/default.nix <del> { stdenv, lib, callPackage, fetchurl }: </del> <ins> { stdenv, lib, callPackage, fetchurl, fetchpatch }: </ins> let dsoPatch51 = fetchurl { url = "https://projects.archlinux.org/svntogit/packages.git/plain/trunk/lua-arch.patch?h=packages/lua51";

lua5_3 = callPackage ./interpreter.nix { sourceVersion = { major = "5"; minor = "3"; patch = "5"; }; hash = "0c2eed3f960446e1a3e4b9a1ca2f3ff893b6ce41942cf54d5dd59ab4b3b058ac"; <del> patches = lib.optionals stdenv.isDarwin [ ./5.2.darwin.patch ] ; </del> <ins> patches = lib.optionals stdenv.isDarwin [ ./5.2.darwin.patch ] ++ [ ./CVE-2019-6706.patch ]; </ins> postConfigure = lib.optionalString (!stdenv.isDarwin) '' cat ${./lua-5.3-dso.make} >> src/Makefile sed -e 's/ALL_T *= */& $(LUA_SO)/' -i src/Makefile
Change:
, (nixos-unstable) Scanned versions: nixos-unstable: . May contain false positives.
Still no new release from upstream. Looks like the discussion sort of fizzled out: Ubuntu and RHEL apply a patch for this, see for example:
Should be backported as well.
Looks like the patch was applied to unstable and backported to 19.09. Can we close this issue?

Discussion:
# similar to interpreters/python/default.nix <del> { stdenv, lib, callPackage, fetchurl }: </del> <ins> { stdenv, lib, callPackage, fetchurl, fetchpatch }: </ins> let dsoPatch51 = fetchurl { url = "https://projects.archlinux.org/svntogit/packages.git/plain/trunk/lua-arch.patch?h=packages/lua51";

name = "lua-arch.patch"; }; <ins> CVE_2019_6706 = fetchpatch { url = "https://gitlab.alpinelinux.org/alpine/aports/raw/7ad58d2fec12ba6086e2774460d4bfe9e91471a9/main/lua5.3/CVE-2019-6706-use-after-free-lua_upvaluejoin.patch"; sha256 = "11pqpwiydaw2nyjj30rn3k61apy6c4f4f5ahnnk69a9mmxig1nnc"; name = "CVE-2019-6706.patch"; }; </ins> in rec { lua5_3 = callPackage ./interpreter.nix { sourceVersion = { major = "5"; minor = "3"; patch = "5"; }; hash = "0c2eed3f960446e1a3e4b9a1ca2f3ff893b6ce41942cf54d5dd59ab4b3b058ac"; <del> patches = lib.optionals stdenv.isDarwin [ ./5.2.darwin.patch ] ; </del> <ins> patches = lib.optionals stdenv.isDarwin [ ./5.2.darwin.patch ] ++ [ CVE_2019_6706 ]; </ins> postConfigure = lib.optionalString (!stdenv.isDarwin) '' cat ${./lua-5.3-dso.make} >> src/Makefile sed -e 's/ALL_T *= */& $(LUA_SO)/' -i src/Makefile