9ac42658f9
Dashs noexec flag `-n` did not work as documented, which could result in code being inadvertently executed.
37 lines
1.2 KiB
Nix
37 lines
1.2 KiB
Nix
{ stdenv, buildPackages, autoreconfHook, fetchurl }:
|
|
|
|
stdenv.mkDerivation rec {
|
|
pname = "dash";
|
|
version = "0.5.11.2";
|
|
|
|
src = fetchurl {
|
|
url = "http://gondor.apana.org.au/~herbert/dash/files/${pname}-${version}.tar.gz";
|
|
sha256 = "0pvdpm1cgfbc25ramn4305a0158yq031q1ain4dc972rnxl7vyq0";
|
|
};
|
|
|
|
hardeningDisable = [ "format" ];
|
|
|
|
# Temporary fix until a proper one is accepted upstream
|
|
patches = [
|
|
(fetchurl {
|
|
# Dash executes code when noexec ("-n") is specified
|
|
# https://www.openwall.com/lists/oss-security/2020/11/11/3
|
|
url = "https://git.kernel.org/pub/scm/utils/dash/dash.git/patch/?id=29d6f2148f10213de4e904d515e792d2cf8c968e";
|
|
sha256 = "08q90bx36ixwlcj331dh7420qyj8i0qh1cc1gljrhd83fhl9w0y5";
|
|
})
|
|
] ++ stdenv.lib.optional stdenv.isDarwin ./0001-fix-dirent64-et-al-on-darwin.patch;
|
|
depsBuildBuild = [ buildPackages.stdenv.cc ];
|
|
nativeBuildInputs = stdenv.lib.optional stdenv.isDarwin autoreconfHook;
|
|
|
|
meta = with stdenv.lib; {
|
|
homepage = "http://gondor.apana.org.au/~herbert/dash/";
|
|
description = "A POSIX-compliant implementation of /bin/sh that aims to be as small as possible";
|
|
platforms = platforms.unix;
|
|
license = with licenses; [ bsd3 gpl2 ];
|
|
};
|
|
|
|
passthru = {
|
|
shellPath = "/bin/dash";
|
|
};
|
|
}
|