I previously didn't update the hash, so was still building ghostscript-9.24
(which explained why docs were still from 9.24)
The ICC profile validation patch from #47937 is included in 9.25, so we
can strip it from the list of patches.
cc @xeji
Highlights in this release include:
This release fixes problems with argument handling, some unintended results of the security fixes to the SAFER file access restrictions (specifically accessing ICC profile files), and some additional security issues over the recent 9.24 release.
CVE-2018-16802
CVE-2018-17183
Note: The ps2epsi utility does not, and cannot call Ghostscript with the -dSAFER command line option. It should never be called with input from untrusted sources.
Security issues have been the primary focus of this release, including solving several (well publicised) real and potential exploits.
PLEASE NOTE: We strongly urge users to upgrade to this latest release to avoid these issues.
As well as Ghostscript itself, jbig2dec has had a significant amount of work improving its robustness in the face of out specification files.
IMPORTANT: We are in the process of forking LittleCMS. LCMS2 is not thread safe, and cannot be made thread safe without breaking the ABI. Our fork will be thread safe, and include performance enhancements (these changes have all be been offered and rejected upstream). We will maintain compatibility between Ghostscript and LCMS2 for a time, but not in perpetuity. Our fork will be available as its own package separately from Ghostscript (and MuPDF).
The usual round of bug fixes, compatibility changes, and incremental improvements.
* Version 4.01.17 works fine for me on NixOS, driving both a Samsung ML-2165w
and a Samsung ML-2510 printer successfully.
* Version 4.00.39 is broken. The build shows errors, but doesn't abort. The
generated binaries don't work, because they are lacking rpaths to their
library dependencies.
* Renamed old default.nix file to 1.00.37.nix. That version wasn't the default
and it feels like a bad idea to mix versioned and unversioned file names in
the same directory.
In a few cases it wasn't clear so I left them as-is.
While visiting these moved other things to nativeBuildInputs
when it was clear they were one of these cases:
* makeWrapper
* archive utilities (in order to unpack src)
* a few of these might no longer be needed but leaving for another day
The default version isn't enabled on darwin either, however it did work
at some point.
/tmp/nix-build-dolphin-emu-2018-08-17.drv-0/source/Source/Core/Core/NetPlayServer.cpp:1180:26: error: unknown type name 'lzo_uint32_t'; did you mean 'lzo_uint32'?
std::vector<u8> wrkmem(LZO1X_1_MEM_COMPRESS);
/cc ZHF #45961
Greybird is dual-licensed as GPLv2 or later and CC-BY-SA 3.0 or later.
The first is free, and the second is unfree in nixpkgs. Currently both
licenses are listed in the package derivation. And nix takes that it is
unfree. If one of the licenses in the list is unfree. nix consider
that the software is unfree. Remove the unfree one.
The darwin build fails and it's probably not particularly useful there.
utils.c:33:19: error: use of undeclared identifier 'CLOCK_MONOTONIC'
clock_gettime(CLOCK_MONOTONIC, &t);
/cc ZHF #45961
A new python script has been added to replace the aged viml-based
updater. The new updater has the following advantages:
- use rss feeds to check for updates quicker
- parallel downloads & better caching
- uses proper override mechanism instead of text substitution
- update generated files in-place instead of having to insert updated plugins manually
Automatically reading `dependencies` from the plugins directory has been
not re-implemented.
This has been mostly been used by Mark Weber's plugins, which seem to
no longer receive regular updates.
This could be implemented in future as required.
The $doc stuff needed changes, probably because of ghostscript newly
reacting to some configure flags that stdenv passes.
- share/ghostscript/9.22/doc was an ugly location for documentation,
and I didn't like their new share/ghostscript/9.24 either,
so that got changed to share/doc/ghostscript/9.24
- their process no longer installs examples, apparently,
but I don't expect that would be any problem for us
Added better practices to update_exts script.
Use `jq` instead of `grep` for more reliable JSON querying.
Check for 404 when requesting package.json information to avoid mangled
output.
Added proper failure points for missing vscode package, unknown version,
and if the code executable couldn't be found.
Switched to using a `nix-shell` shebang for even better reliability and
use the `sh` shell to be that little bit more generic.
Script is still clunky and sequential, anything more and I'd need to
write a proper program to do this and that's getting a bit silly? But
people that have a dozen or so extensions might be in for a long wait.
Be explicit about using bash
Improve the use of jq to remove unnecessary use of tr. Hat-tip coretemp.
Add some comments, finally.
Remove the `fetch` function.
Change the `get_ver` function to more accurately demonstrate what it is trying
to do, as well as add in some better error handling for non-200 http responses.
I couldn't make the bash `${param/search/replacement}` work for chopping up the
response in the `get_ver` function, hence the use of `sed`. Hopefully it all
makes a bit more sense now.
Remove github requests.
VSIXPackage is just a zip format in disguise so use a tmpdir and unpackage the
package.json file for the file in question so we can get the precise version
that we're interested in without additional redundant calls to github that may
not provide the right answer anyway.
Add trap to try to clean up the temp folders and clean up as we go.
I can't use 'fetchurl' or even 'nix-prefetch-url' because for the former we
don't yet know the hash that we're after and for the latter there isn't a way to
tie the predownloaded file into the next part of the workflow.
Prevent an unnecessary file from being extracted.
Change the unzip command to read the file we're after to stdout so we can use jq
on it directly instead of creating a file, reading it, then deleting it.
Courtesy of worldofpeace, remove the dependency on coreutils and use the
provided nix-hash function to generate the required hash.
Fix up a comment
Remove use of 'awk' and clean up individual Nix printing with cat to EOF expression.