How to patch vulnerabilities effectively?

Help
1

This is a follow-up from When does staging hit release channels? - #2 by primeos

Context

How I tried and failed

I’ve gone on doing the following in my codebase:

nixpkgs = import sources.nixpkgs {
    config = {
      packageOverrides = pkgs: {
        git = pkgs.git.overrideAttrs (oldAttrs: rec { version = "2.29.3"; });
      };
    };
  };
pkgs-20-03 = import sources.nixpkgs-20-03 {
    config = {
      packageOverrides = pkgs: {
        git = pkgs.git.overrideAttrs (oldAttrs: rec { version = "2.25.5"; });
      };
    };
  };
nixpkgs = import sources.nixpkgs-unstable {
    config = {
      packageOverrides = pkgs: {
        git = pkgs.git.overrideAttrs (oldAttrs: rec { version = "2.30.2"; });
      };
    };
  };

But it’s been maybe some 4-5 hours, and at the end:

$ which git
/nix/store/7n6jihgn1pm696jcg5zlh4gqc9rbs8ip-git-2.29.3/bin/git
$ git --version
git version 2.29.2

:expressionless:

This output from nix-store -q --graph $(nix-instantiate shell.nix) make me believe the tarballs for the vulnerable versions are feeding my derivations which merely have the patched versions in their names:

"/nix/store/d4b8sdb2m458fgkl860f51kqkwhm385w-git-2.29.2.tar.xz.drv" -> "/nix/store/nqif47iiq56zk5m7q5bgrfxqbkf2har8-git-2.29.3.drv" [color = "red"];

Aside from taking 4-5h to build, this got my disk down some 40GB, which would likely overflow the company’s cachix subscription and force my colleagues to spend hours building too.

Halp?

Are folks patching? How are they doing it? What did I get wrong?

2

All you are changing in your overrides is the version attribute, but not the sources or anything else…

Something like the following override is more likely to work as expected:

git.overrideAttrs (_: rec {
  version = "2.30.2";
  src = fetchurl {
    url = "https://www.kernel.org/pub/software/scm/git/git-${version}.tar.xz";
    sha256 = "sha256-QffZDHH5R2zTh2c/yxDOCcy+1nMyQ2pMxY168yw1X6o=";
  };
})
1 Like
3

Ohh, I thought the ${version} there would pick up the new version I overrode! Should have been suspicious when no SHA256 errors showered me in their glory.