nixpkgs/pkgs/development/interpreters/pure/default.nix
Anders Kaseorg 3cd8ce3bce treewide: Fix unsafe concatenation of $LD_LIBRARY_PATH
Naive concatenation of $LD_LIBRARY_PATH can result in an empty
colon-delimited segment; this tells glibc to load libraries from the
current directory, which is definitely wrong, and may be a security
vulnerability if the current directory is untrusted.  (See #67234, for
example.)  Fix this throughout the tree.

Signed-off-by: Anders Kaseorg <andersk@mit.edu>
2020-01-15 09:47:03 +01:00

45 lines
1.1 KiB
Nix

{ lib, stdenv, fetchurl, makeWrapper,
llvm, gmp, mpfr, readline, bison, flex }:
stdenv.mkDerivation rec {
baseName="pure";
version="0.68";
name="${baseName}-${version}";
src = fetchurl {
url="https://github.com/agraef/pure-lang/releases/download/${name}/${name}.tar.gz";
sha256="0px6x5ivcdbbp2pz5n1r1cwg1syadklhjw8piqhl63n91i4r7iyb";
};
buildInputs = [ bison flex makeWrapper ];
propagatedBuildInputs = [ llvm gmp mpfr readline ];
NIX_LDFLAGS = "-lLLVMJIT";
postPatch = ''
for f in expr.cc matcher.cc printer.cc symtable.cc parserdefs.hh; do
sed -i '1i\#include <stddef.h>' $f
done
'';
configureFlags = [ "--enable-release" ];
doCheck = true;
checkPhase = ''
LD_LIBRARY_PATH=$LD_LIBRARY_PATH''${LD_LIBRARY_PATH:+:}${llvm}/lib make check
'';
postInstall = ''
wrapProgram $out/bin/pure --prefix LD_LIBRARY_PATH : ${llvm}/lib
'';
meta = {
description = "A modern-style functional programming language based on term rewriting";
maintainers = with lib.maintainers;
[
raskin
asppsa
];
platforms = with lib.platforms;
linux;
license = lib.licenses.gpl3Plus;
};
}