Upstream changelog:
- SECURITY UPDATE: In previous versions of libfuse it was possible to
for unprivileged users to specify the allow_other option even when
this was forbidden in /etc/fuse.conf. The vulnerability is present
only on systems where SELinux is active (including in permissive
mode).
- libfuse no longer segfaults when fuse_interrupted() is called outside
the event loop.
- The fusermount binary has been hardened in several ways to reduce
potential attack surface. Most importantly, mountpoints and mount
options must now match a hard-coded whitelist. It is expected that
this whitelist covers all regular use-cases.
- Fixed rename deadlock on FreeBSD.
Upstream changelog:
- SECURITY UPDATE: In previous versions of libfuse it was possible to
for unprivileged users to specify the allow_other option even when
this was forbidden in /etc/fuse.conf. The vulnerability is present
only on systems where SELinux is active (including in permissive
mode).
- The fusermount binary has been hardened in several ways to reduce
potential attack surface. Most importantly, mountpoints and mount
options must now match a hard-coded whitelist. It is expected that
this whitelist covers all regular use-cases.
- Added a test of seekdir to test_syscalls.
- Fixed readdir bug when non-zero offsets are given to filler and the
filesystem client, after reading a whole directory, re-reads it from a
non-zero offset e. g. by calling seekdir followed by readdir.
Use example package `zerobin` instead of `bepasty-server` which
is no longer part of python-packages.
This fixes the examples for current nixpkgs versions.
1. Use the same approach like in the overlay example:
Override `python` instead of `pythonPackages` so that
`python.pkgs` refers to the new package set like `pythonPackages`.
This also fixes a bug in the original example where
`pkgs.fetchgit` was not in scope.
Add an extra example to illustrate how to override just a
package set.
2. Fix mix-up between `super` and `self` in the explanation text.
Also, simplify the explanation.
If I have a patch I want to apply to weechat, I can't do that with
overrideAttrs like I can with almost every other package, because that
only applies to the wrapper derivation. For other wrapped packages, one
can usually call the wrapper with any version of the derivation, but the
weechat derivation didn't expose a wrapper creation function.
Taking inspiration from other packages, particularly Firefox, I
extracted the wrapper into its own function, made the default weechat
derivation use that, and added weechat-unwrapped.
Now I can add my custom patch like this:
(wrapWeechat
(weechat-unwrapped.overrideAttrs (oldAttrs: {
patches = [
(fetchpatch {
url = "https://github.com/weechat/weechat/commit/55767f5f116db3cb56cf85f52aa80feff45b6abf.patch?full_index=1";
sha256 = "1pkcdsby57diqds1y5hhl0fr4i8j0zax32jb0gqd36siki3lza3d";
})
];
}))
{ configure =
{ availablePlugins, ... }:
{
plugins = with availablePlugins; [
(python.withPackages (packages: with packages; [ potr websocket_client ]))
];
};
})
There is a small backward incompatibility here: previously, it was
possible to get an unwrapped weechat like this:
weechat.override { configure = null; }
This didn't seem too important to keep around since it was also possible
to get an unwrapped weechat in a much more obvious way:
weechat.unwrapped
I could probably make it so that the first way still worked, if that
behavior turns out to really have been important.
Daiderd Jordan