Skip to content

[25.11] cosmic-greeter: apply upstream patch for security hardening#505350

Merged
Lassulus merged 1 commit intoNixOS:release-25.11from
a-kenji:backport-499524-to-release-25.11
Mar 31, 2026
Merged

[25.11] cosmic-greeter: apply upstream patch for security hardening#505350
Lassulus merged 1 commit intoNixOS:release-25.11from
a-kenji:backport-499524-to-release-25.11

Conversation

@a-kenji
Copy link
Copy Markdown
Member

@a-kenji a-kenji commented Mar 31, 2026 •
edited
Loading

(cherry picked from commit 64db9dd)

Things done

  • Built on platform:
    • x86_64-linux
    • aarch64-linux
    • x86_64-darwin
    • aarch64-darwin
  • Tested, as applicable:
  • Ran nixpkgs-review on this PR. See nixpkgs-review usage.
  • Tested basic functionality of all binary files, usually in ./result/bin/.
  • Nixpkgs Release Notes
    • Package update: when the change is major or breaking.
  • NixOS Release Notes
    • Module addition: when adding a new NixOS module.
    • Module update: when the change is significant.
  • Fits CONTRIBUTING.md, pkgs/README.md, maintainers/README.md and other READMEs.

github-actions[bot]
github-actions bot previously requested changes Mar 31, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

@github-actions github-actions bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This report is automatically generated by the PR / Check / cherry-pick CI workflow.

Some of the commits in this PR require the author's and reviewer's attention.

Sometimes it is not possible to cherry-pick exactly the same patch.
This most frequently happens when resolving merge conflicts.
The range-diff will help to review the resolution of conflicts.

If you need to merge this PR despite the warnings, please dismiss this review shortly before merging.

Warning

Difference between 838c3f9 and original 64db9dd may warrant inspection.

Show diff 
@@ Metadata
  ## Commit message ##
     cosmic-greeter: apply upstream patch for security hardening
 
+    (cherry picked from commit 64db9dd59be49b07d88409084dd94c1cf34b5097)
+
  ## pkgs/by-name/co/cosmic-greeter/package.nix ##
 @@
    nix-update-script,
@@ pkgs/by-name/co/cosmic-greeter/package.nix
  
  rustPlatform.buildRustPackage (finalAttrs: {
 @@ pkgs/by-name/co/cosmic-greeter/package.nix: rustPlatform.buildRustPackage (finalAttrs: {
-     hash = "sha256-U0JrxvMWzISSA0tP8moasN7iN7TfZreEwbvWZGHRn8E=";
+     hash = "sha256-HP2Dl/vEX4K3XaXtjOpN1EW6uE4RuLm2+RMLB3QvOXQ=";
    };
  
--  cargoHash = "sha256-sNJTXBInr/h8w5dhOOP9ceBYWBcJW3qGjDuaG6UTV90=";
-+  cargoHash = "sha256-J5ycaeKZsEBPcI9JH8bHsOAcXXwcx/D21GlVhJZbGwM=";
+-  cargoHash = "sha256-4yRBgFrH4RBpuvChTED+ynx+PyFumoT2Z+R1gXxF4Xc=";
++  cargoHash = "sha256-KLIUE3+iAZbNB6YPSl75I6jHwa1RBN+go5A7RFi5LxE=";
 +
 +  cargoPatches = [
 +    (fetchpatch2 {
@@ pkgs/by-name/co/cosmic-greeter/package.nix: rustPlatform.buildRustPackage (final
 +    })
 +  ];
  
-   env.VERGEN_GIT_SHA = finalAttrs.src.tag;
- 
+   env = {
+     VERGEN_GIT_COMMIT_DATE = "2025-12-05";

Hint: The full diffs are also available in the runner logs with slightly better highlighting.

@a-kenji a-kenji mentioned this pull request Mar 31, 2026
Open
@nixpkgs-ci nixpkgs-ci bot requested a review from a team March 31, 2026 13:34
@nixpkgs-ci nixpkgs-ci bot added 10.rebuild-linux: 1-10 This PR causes between 1 and 10 packages to rebuild on Linux. 10.rebuild-darwin: 0 This PR does not cause any packages to rebuild on Darwin. 11.by: package-maintainer This PR was created by a maintainer of all the package it changes. 10.rebuild-linux: 1 This PR causes 1 package to rebuild on Linux. 6.topic: COSMIC COSMIC is a software platform for designing beautiful user experiences 4.workflow: backport This targets a stable branch labels Mar 31, 2026
@nixpkgs-ci nixpkgs-ci bot added 12.approvals: 1 This PR was reviewed and approved by one person. 12.approved-by: package-maintainer This PR was reviewed and approved by a maintainer listed in any of the changed packages. labels Mar 31, 2026
@thefossguy
Copy link
Copy Markdown
Member

thefossguy commented Mar 31, 2026

I was alerted a bit when viewing the patch from GitHub's UI shows "This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository." but its not a problem because I recall pulling the commit from the PR but GitHub didn't fast-forward it, hence the change in has for the commit SHA in the PR vs in-tree.

Commenting for documentation purposes.

@thefossguy
Copy link
Copy Markdown
Member

thefossguy commented Mar 31, 2026

nixpkgs-review result

Generated using nixpkgs-review.

Command: nixpkgs-review pr 505350 --extra-nixpkgs-config '{ allowBroken = false; }' --additional-package nixosTests.cosmic --additional-package nixosTests.cosmic-autologin --additional-package nixosTests.cosmic-noxwayland --additional-package nixosTests.cosmic-autologin-noxwayland
Commit: 838c3f9bd486dc80f164b5d2e85ff7ea5e73f347

aarch64-linux

✅ 4 tests built:
  • nixosTests.cosmic
  • nixosTests.cosmic-autologin
  • nixosTests.cosmic-autologin-noxwayland
  • nixosTests.cosmic-noxwayland
✅ 2 packages built:
  • cosmic-greeter
  • nixpkgs-manual

@thefossguy
Copy link
Copy Markdown
Member

thefossguy commented Mar 31, 2026

nixpkgs-review result

Generated using nixpkgs-review.

Command: nixpkgs-review pr 505350 --extra-nixpkgs-config '{ allowBroken = false; }' --additional-package nixosTests.cosmic-autologin-noxwayland --additional-package nixosTests.cosmic-noxwayland --additional-package nixosTests.cosmic --additional-package nixosTests.cosmic-autologin
Commit: 838c3f9bd486dc80f164b5d2e85ff7ea5e73f347

x86_64-linux

✅ 4 tests built:
  • nixosTests.cosmic
  • nixosTests.cosmic-autologin
  • nixosTests.cosmic-autologin-noxwayland
  • nixosTests.cosmic-noxwayland
✅ 2 packages built:
  • cosmic-greeter
  • nixpkgs-manual

@thefossguy
Copy link
Copy Markdown
Member

thefossguy commented Mar 31, 2026

@NixOS/nixpkgs-merge-bot

@thefossguy
Copy link
Copy Markdown
Member

thefossguy commented Mar 31, 2026

@NixOS/nixpkgs-merge-bot merge

@nixpkgs-ci
Copy link
Copy Markdown
Contributor

nixpkgs-ci bot commented Mar 31, 2026

@thefossguy wants to merge this PR.

Requirements to merge this PR with @NixOS/nixpkgs-merge-bot merge:

  • ✅ PR targets a development branch.
  • ✅ PR touches only files of packages in pkgs/by-name/.
  • ❌ PR is at least one of:
  • ✅ PR is not a draft
  • ✅ thefossguy is a member of @NixOS/nixpkgs-maintainers.
  • ✅ thefossguy is a maintainer of all touched packages.

❌ Pull Request could not be merged (#305350)

@nixpkgs-ci nixpkgs-ci bot added 12.approvals: 2 This PR was reviewed and approved by two persons. and removed 12.approvals: 1 This PR was reviewed and approved by one person. labels Mar 31, 2026
@thefossguy
Copy link
Copy Markdown
Member

thefossguy commented Mar 31, 2026

My bad, I thought Kenji was a committer. I don't have commit access either.

@Lassulus Lassulus enabled auto-merge March 31, 2026 17:48
@HeitorAugustoLN HeitorAugustoLN dismissed github-actions[bot]’s stale review March 31, 2026 18:45

Reviewed cherry-pick range-diff. Differences are expected for release-25.11

@Lassulus Lassulus added this pull request to the merge queue Mar 31, 2026
Merged via the queue into NixOS:release-25.11 with commit fd28b91 Mar 31, 2026
41 of 44 checks passed
@a-kenji a-kenji deleted the backport-499524-to-release-25.11 branch March 31, 2026 19:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@HeitorAugustoLN HeitorAugustoLN HeitorAugustoLN approved these changes

@github-actions github-actions[bot] github-actions[bot] left review comments

+2 more reviewers

@drakon64 drakon64 drakon64 approved these changes

@thefossguy thefossguy thefossguy approved these changes

Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

4.workflow: backport This targets a stable branch 6.topic: COSMIC COSMIC is a software platform for designing beautiful user experiences 10.rebuild-darwin: 0 This PR does not cause any packages to rebuild on Darwin. 10.rebuild-linux: 1-10 This PR causes between 1 and 10 packages to rebuild on Linux. 10.rebuild-linux: 1 This PR causes 1 package to rebuild on Linux. 11.by: package-maintainer This PR was created by a maintainer of all the package it changes. 12.approvals: 2 This PR was reviewed and approved by two persons. 12.approved-by: package-maintainer This PR was reviewed and approved by a maintainer listed in any of the changed packages.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@a-kenji @thefossguy @drakon64 @HeitorAugustoLN @Lassulus