# Inkscape possible domain compromise
**URL:** https://discourse.nixos.org/t/inkscape-possible-domain-compromise/32008
**Category:** Security
**Created:** [August 21, 2023, 2:09pm UTC](https://discourse.nixos.org/t/inkscape-possible-domain-compromise/32008 "2023-08-21T14:09:58Z")
**Posts on this page:** 11
**Page:** 1
### Author:  [@waffle8946](https://discourse.nixos.org/u/waffle8946)
#### Post date: [August 21, 2023, 2:09pm UTC](https://discourse.nixos.org/t/inkscape-possible-domain-compromise/32008/1 "2023-08-21T14:09:58Z")
[https://github.com/NixOS/nixpkgs/blob/c7623219fccf46b36370140d777ba61c85c9bb8d/pkgs/applications/graphics/inkscape/default.nix](https://github.com/NixOS/nixpkgs/blob/c7623219fccf46b36370140d777ba61c85c9bb8d/pkgs/applications/graphics/inkscape/default.nix) fetches from `https://media.inkscape.org/dl/resources/file/inkscape-${version}.tar.xz`, but visiting `https://media.inkscape.org/dl/resources/file/` serves some sort of html page containing spam unrelated to Inkscape (excerpt below):
```html
DAFTAR 1 AKUN UNTUK SEMUA JENIS GAME SLOT ONLINE
```
Is there a process to mark a package as possibly insecure without any existing CVE?
---
### Author:  [@Lyndeno](https://discourse.nixos.org/u/Lyndeno)
#### Post date: [August 21, 2023, 4:01pm UTC](https://discourse.nixos.org/t/inkscape-possible-domain-compromise/32008/2 "2023-08-21T16:01:15Z")
I think the source sha256 would prevent it from being downloaded in this case wouldn’t it? Unless the sha256 was obtained from a bad file.
---
### Author:  [@Artturin](https://discourse.nixos.org/u/Artturin)
#### Post date: [August 21, 2023, 4:03pm UTC](https://discourse.nixos.org/t/inkscape-possible-domain-compromise/32008/3 "2023-08-21T16:03:43Z")
Yep, the reason the package builds now is that the tar is cached in [cache.nixos.org](http://cache.nixos.org).
---
### Author:  [@sirphobos](https://discourse.nixos.org/u/sirphobos)
#### Post date: [August 21, 2023, 8:53pm UTC](https://discourse.nixos.org/t/inkscape-possible-domain-compromise/32008/4 "2023-08-21T20:53:07Z")
was inkscape’s site hacked? If that is true - is there some official news on that? What else is compromised in that case?
judging from the text it does seem to be related to some shady “slot machine” apk …
---
### Author:  [@waffle8946](https://discourse.nixos.org/u/waffle8946)
#### Post date: [August 22, 2023, 3:39am UTC](https://discourse.nixos.org/t/inkscape-possible-domain-compromise/32008/5 "2023-08-22T03:39:27Z")
My concern is that there is a PR to bump version ([inkscape: 1.2.2 -\> 1.3, lib2geom: 1.2.2 -\> 1.3 by leiserfg · Pull Request #245431 · NixOS/nixpkgs · GitHub](https://github.com/NixOS/nixpkgs/pull/245431)), and I don’t know how we establish that this is “safe” code, as even the GitLab release ([Releases · Inkscape / inkscape · GitLab](https://gitlab.com/inkscape/inkscape/-/releases)) points back to the Inkscape domain (see the link “tarball from Inkscape website” which they consider to be the actual release).
The tarball does at least match the `sha256` checksum posted on GitLab, so maybe this concern is superfluous, but I figured better report it than not.
---
### Author:  [@vcunat](https://discourse.nixos.org/u/vcunat)
#### Post date: [August 22, 2023, 5:22am UTC](https://discourse.nixos.org/t/inkscape-possible-domain-compromise/32008/6 "2023-08-22T05:22:10Z")
Reporting is great, but I rather think it should be done upstream in this case.
---
### Author:  [@waffle8946](https://discourse.nixos.org/u/waffle8946)
#### Post date: [August 22, 2023, 3:00pm UTC](https://discourse.nixos.org/t/inkscape-possible-domain-compromise/32008/7 "2023-08-22T15:00:37Z")
That’s already been done, the question is what should be done in the meantime in nixpkgs. Do we simply wait on the version bump then until they make some public statement? And how do we handle if someone has overrides set and don’t know about this issue?
---
### Author:  [@TLATER](https://discourse.nixos.org/u/TLATER)
#### Post date: [August 22, 2023, 3:09pm UTC](https://discourse.nixos.org/t/inkscape-possible-domain-compromise/32008/8 "2023-08-22T15:09:21Z")
> [@waffle8946](#):
>
> Do we simply wait on the version bump then until they make some public statement?
I think that’s prudent.
> [@waffle8946](#):
>
> And how do we handle if someone has overrides set and don’t know about this issue?
What override would get them a potentially malicious update without spotting this themselves? If they rely on older versions they’re still protected by the hash, and if they deliberately upgrade to 1.3 they’re in the hands of upstream.
---
### Author:  [@vcunat](https://discourse.nixos.org/u/vcunat)
#### Post date: [August 22, 2023, 7:14pm UTC](https://discourse.nixos.org/t/inkscape-possible-domain-compromise/32008/9 "2023-08-22T19:14:36Z")
It seems like the version we have was secure? If that’s so, it’s secured by sha256 like others, so I don’t see any issue here. And in the meantime I expect upstream to resolve the situation.
---
### Author:  [@doctormo](https://discourse.nixos.org/u/doctormo)
#### Post date: [August 22, 2023, 9:34pm UTC](https://discourse.nixos.org/t/inkscape-possible-domain-compromise/32008/10 "2023-08-22T21:34:25Z")
Sorry about the index.html file, that was placed on our server a long while ago, and while the resource database entry was cleared out a long time ago, the file hung around on the file system and the fastly cache dutifully continued to mirror it.
I’ve cleared out the html file, reset the fastly cache (for both / and index.html) and done sanity checks on all the files, the web server and various intrusion possibilities which are all negative. This file was uploaded via the gallery uploads on the website which anyone could do. An index file now stands in the way to prevent it happening again.
If you want to verify the source tarball, I always recommend checking against the gpg signature uploaded to the releases app here [Inkscape 1.3 - Source : Archive : xz tarball | Inkscape](https://inkscape.org/release/inkscape-1.3/source/archive/xz/dl/) and verify it against the gitlab sha which you’ve already done for extra paranoia points.
Sorry about the issue.
- Martin Owens, Volunteer Website Administrator and Inkscape programmer
---
### Author:  [@waffle8946](https://discourse.nixos.org/u/waffle8946)
#### Post date: [August 23, 2023, 6:19am UTC](https://discourse.nixos.org/t/inkscape-possible-domain-compromise/32008/11 "2023-08-23T06:19:47Z")
Wasn’t aware of the gallery upload feature, glad it’s sorted!