aiolabs/nix-bitcoin
1
0
Fork 0
Code Issues Pull requests Projects Releases 1 Packages Wiki Activity Actions

Merge fort-nix/nix-bitcoin#819: Update nixpkgs

Browse source 
e6e3a13dbb work around CVE-2024-23342 for pkgs `hwi`, `trezor` (Erik Arvstedt)
c4cd252753 update nixpkgs (Erik Arvstedt)

Pull request description:

ACKs for top commit:
  jonasnick:
    ACK e6e3a13dbb

Tree-SHA512: f0f5bcbe0ea28f5870aed7bd983904fe3d57aedad45955835ace1fb151f48f169977f453d41a071b60e0e27af6fc92572c629627dfc8d81012c0bb4241a7f459
This commit is contained in:
Jonas Nick 2025-11-24 12:50:16 +00:00
commit f1ebb5d2cd
No known key found for this signature in database
GPG key ID: 4861DBF262123605
6 changed files with 27 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

12
flake.lock generated
View file

@ -44,11 +44,11 @@
}, },
"nixpkgs": { "nixpkgs": {
"locked": { "locked": {
"lastModified": 1761016216, "lastModified": 1763622513,
"narHash": "sha256-G/iC4t/9j/52i/nm+0/4ybBmAF4hzR8CNHC75qEhjHo=", "narHash": "sha256-1jQnuyu82FpiSxowrF/iFK6Toh9BYprfDqfs4BB+19M=",
"owner": "NixOS", "owner": "NixOS",
"repo": "nixpkgs", "repo": "nixpkgs",
"rev": "481cf557888e05d3128a76f14c76397b7d7cc869", "rev": "c58bc7f5459328e4afac201c5c4feb7c818d604b",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -60,11 +60,11 @@
}, },
"nixpkgs-unstable": { "nixpkgs-unstable": {
"locked": { "locked": {
"lastModified": 1760965567, "lastModified": 1763618868,
"narHash": "sha256-0JDOal5P7xzzAibvD0yTE3ptyvoVOAL0rcELmDdtSKg=", "narHash": "sha256-v5afmLjn/uyD9EQuPBn7nZuaZVV9r+JerayK/4wvdWA=",
"owner": "NixOS", "owner": "NixOS",
"repo": "nixpkgs", "repo": "nixpkgs",
"rev": "cb82756ecc37fa623f8cf3e88854f9bf7f64af93", "rev": "a8d610af3f1a5fb71e23e08434d8d61a466fc942",
"type": "github" "type": "github"
}, },
"original": { "original": {

2
modules/hardware-wallets.nix
View file

@ -62,7 +62,7 @@ in {
}); });
}) })
(mkIf cfg.trezor { (mkIf cfg.trezor {
environment.systemPackages = [ pkgs.python3.pkgs.trezor ]; environment.systemPackages = [ config.nix-bitcoin.pkgs.pyPkgs.nbPython3PackagesWithUnlockedEcdsa.trezor ];
# Don't use rules from nixpkgs because we want to use our own group. # Don't use rules from nixpkgs because we want to use our own group.
services.udev.packages = lib.singleton (pkgs.writeTextFile { services.udev.packages = lib.singleton (pkgs.writeTextFile {
name = "trezord-udev-rules"; name = "trezord-udev-rules";

2
pkgs/clnrest/default.nix
View file

@ -11,7 +11,7 @@ rustPlatform.buildRustPackage rec {
inherit (clightning) src; inherit (clightning) src;
cargoHash = "sha256-UxMXBO/rpanNU8vz8y4V5wSbCNHKYmVXtoGRpOqI+A0="; cargoHash = "sha256-2xOLwj42Ua85+kn73y+5q3YmzKYMCjxLlq/UrYjiZv0=";
depsExtraArgs = { depsExtraArgs = {
nativeBuildInputs = [ unzip ]; nativeBuildInputs = [ unzip ];

1
pkgs/default.nix
View file

@ -26,6 +26,7 @@ let self = {
trustedcoin = pkgs.callPackage ./trustedcoin { }; trustedcoin = pkgs.callPackage ./trustedcoin { };
bitcoind_29 = pkgs.callPackage ./bitcoind_29 {}; bitcoind_29 = pkgs.callPackage ./bitcoind_29 {};
inherit (self.pyPkgs.nbPython3PackagesWithUnlockedEcdsa) hwi;
pyPkgs = import ./python-packages self pkgs.python3; pyPkgs = import ./python-packages self pkgs.python3;
inherit (self.pyPkgs) inherit (self.pyPkgs)

1
pkgs/pinned.nix
View file

@ -5,7 +5,6 @@ pkgs: pkgsUnstable:
elementsd elementsd
extra-container extra-container
fulcrum fulcrum
hwi
lightning-pool lightning-pool
lndconnect; lndconnect;

18
pkgs/python-packages/default.nix
View file

@ -33,4 +33,22 @@ rec {
}).pkgs; }).pkgs;
nbPython3PackagesJoinmarket = nbPython3Packages; nbPython3PackagesJoinmarket = nbPython3Packages;
# Re-enable pkgs `hwi`, `trezor` that are unaffected by `CVE-2024-23342` because
# they don't use python pkg `ecdsa` for signing.
# These packages no longer evaluate in nixpkgs after `ecdsa` was tagged with this CVE.
nbPython3PackagesWithUnlockedEcdsa = let
python3PackagesWithUnlockedEcdsa = (python3.override {
packageOverrides = self: super: {
ecdsa = super.ecdsa.overrideAttrs (old: {
meta = old.meta // {
knownVulnerabilities = builtins.filter (x: x != "CVE-2024-23342") old.meta.knownVulnerabilities;
};
});
};
}).pkgs;
in {
hwi = with python3PackagesWithUnlockedEcdsa; toPythonApplication hwi;
inherit (python3PackagesWithUnlockedEcdsa) trezor;
};
} }