This contribution pulls in the patch fixing CVE-2020-35476.
The fix is also included in the 2.4.1 version but the upgrade requires
more work: a tarball with all the third party tools is no more provided.
The build process attempts to get them during the build which fail.
https://github.com/advisories/GHSA-hv53-q76c-7f8c
Semi-automatic update generated by https://github.com/ryantm/nixpkgs-update tools.
This update was made based on information from https://repology.org/metapackage/opentsdb/versions.
These checks were done:
- built on NixOS
- /nix/store/bzg1dfd5xpc3rqgi601a162vajil47r0-opentsdb-2.3.1/bin/tsdb passed the binary check.
- Warning: no invocation of /nix/store/bzg1dfd5xpc3rqgi601a162vajil47r0-opentsdb-2.3.1/bin/.tsdb-wrapped had a zero exit code or showed the expected version
- 1 of 2 passed binary check by having a zero exit code.
- 0 of 2 passed binary check by having the new version present in output.
- found 2.3.1 with grep in /nix/store/bzg1dfd5xpc3rqgi601a162vajil47r0-opentsdb-2.3.1
- directory tree listing: https://gist.github.com/b48d02ce7d61ccc9a1066feef216ebeb
- du listing: https://gist.github.com/fa09ba05d6c0f628805a900c2624ac13
Now that https://github.com/OpenTSDB/opentsdb/issues/420 is resolved
we can use the official release tarball. This includes all third
party JARs, which vastly simplifies the build expression.
