llakala:
For high-profile security issues like this, is it possible to cherry-pick a fix into nixos-unstable and nixos-25.05? Having to wait for Hydra to finish all the other builds leads to a period where the exploit is known, yet a fix isn’t accessible through the proper channels.
As the Lix blog post recommends it, if you are concerned by getting this ASAP, it’s better to bite the bullet and rebuild it yourself. Lix, for example, is very fast to rebuild.
llakala:
The packages wouldn’t be cached if they were simply cherry-picked, which would require users to build the packages locally - however, telling Hydra to “rush a build” would solve this. I’m not familiar with the internal mechanism of Hydra - but this seems like something that should be possible.
Channels were rushed out so it’s OK.
2 Likes