https://about.gitlab.com/releases/2020/03/11/critical-security-release-gitlab-12-dot-8-dot-6-released/
(cherry picked from commit ab3b836)

(cherry picked from commit 281bd03)

[19.09] gitlab 12.8.5 -> 12.8.6

[19.09] systemd: 243.3 -> 243.7

(cherry picked from commit 243cd9f)

(cherry picked from commit 8330317)

cherry-picked 4665c94

Closes NixOS#81868

(cherry picked from commit 773462c)

(cherry picked from commit 41d8bb1)

fix CVE-2019-14866, backport

(Older version finished on Hydra.)

(Older version finished on Hydra.)

Fixes CVE-2019-14889, issue NixOS#77264.
Release notes: https://www.libssh.org/2019/12/10/libssh-0-9-3-and-libssh-0-8-8-security-release/

(cherry picked from commit 7ef8a42)

Fixes: https://nvd.nist.gov/vuln/detail/CVE-2019-17543
Release notes: https://github.com/lz4/lz4/releases/tag/v1.9.2

(cherry picked from commit 18ac6ba)

https://www.samba.org/samba/history/security.html
Tested: $ nix build -f nixos/release.nix tests.samba.x86_64-linux

(cherry picked from commit 500375e)

Contains only the version update from 8be61f7,
the module-changes are not needed on 19.09 since the database is always
configured properly here.

x86_64-linux rebuilds have finished, so let's merge
to get the security fixes early.

(cherry picked from commit 291c735)
/cc roundup NixOS#79725

includes fix for nC-SA-2020-015.

See nextcloud/server#19976, the SA currently
has a typo - adressed in
nextcloud/security-advisories#21.

[19.09] nextcloud: 16.0.8 -> 16.0.9

The substitition in smtpd/parse.y isn't necessary anymore.
The hardcoded /usr/libexec/ has been replaced by a PATH_LIBEXEC #define,
which will be set properly by the build system.

(cherry picked from commit 9658850)

Fixes critical vulnerability:
  https://www.mail-archive.com/[email protected]/msg04850.html

(cherry picked from commit 7b9bd59)

(cherry picked from commit 77da495)

Release notes aren't available at this time [1] it is likely to be
related to a recent mail to oss-security (either [2] or [3]).

[1] https://www.mail-archive.com/[email protected]/msg04888.html
[2] https://www.openwall.com/lists/oss-security/2020/02/24/5
[3] https://www.openwall.com/lists/oss-security/2020/02/24/4

(cherry picked from commit 09725e5)

This reverts commit 4f69f2c.

We backported the latest opensmtpd version.

This reverts commit f5c74e6.

Already included in the opensmtpd version.

build fails against our local libressl version

opensmtpd: 6.4.2p1 -> 6.6.4p1 [backport 19.09]

a "Low severity" [0] security issue:

> Fixed an overflow bug in the x64_64 Montgomery squaring procedure used
> in exponentiation with 512-bit moduli (CVE-2019-1551)

[0] https://www.openssl.org/news/vulnerabilities.html#y2019

(cherry picked from commit abecf82)

Since Go 1.13, `GOSUMDB` defaults to "sum.golang.org", to consult the
checksum database of the main module's go.sum.

We already use the default behavior when building `go-modules`, but Go
tries to consult the checksum database again when building the module,
and fails because since it requires `cacert` and `git` which are not
propagated when building the package.

(cherry picked from commit c5733e7)

Signed-off-by: Martin Baillie <[email protected]>
(cherry picked from commit 6e055c9)

Fixes a severe bug with subnet routing.

Signed-off-by: David Anderson <[email protected]>
(cherry picked from commit f61f686)

[19.09] openssl: 1.1.1d -> 1.1.1e

keep brave up-to-date

(cherry picked from commit 418e3e4)
Reason: Browsers should be kept up-to-date for security reasons

…_1.4.96

[19 09] brave 1.4.95 to 1.5.112

(cherry picked from commit 09f55f8)

https://lists.zx2c4.com/pipermail/wireguard/2020-March/005188.html
(cherry picked from commit e758e95)

This reverts commit 41f1484.

openssl 1.1.1e introduces breaking changes in its EOF handling.

https://chromereleases.googleblog.com/2020/03/stable-channel-update-for-desktop_18.html

This update includes 13 security fixes.

CVEs:
CVE-2020-6422 CVE-2020-6424 CVE-2020-6425 CVE-2020-6426 CVE-2020-6427
CVE-2020-6428 CVE-2020-6429 CVE-2019-20503 CVE-2020-6449

Note: The release of version 81 is currently on pause:
https://chromereleases.googleblog.com/2020/03/upcoming-chrome-and-chrome-os-releases.html
(cherry picked from commit fe60ff7)

https://lists.zx2c4.com/pipermail/wireguard/2020-March/005191.html
(cherry picked from commit 19ceeb6)

[19.09] chromium: 80.0.3987.132 -> 80.0.3987.149 (backport)

Changelog: https://github.com/nodejs/node/releases/tag/v12.15.0

Changelog: https://github.com/nodejs/node/releases/tag/v12.16.0

Changelog: https://github.com/nodejs/node/releases/tag/v12.16.1

fetchpatch can't be used here and fetchurl from GitHub
like in PR NixOS#82928 has the risk of breaking the hash later;
fortunately the patches aren't too large.

This fixes the regressed python3Packages.pyopenssl build
and should unblock both channels.

(cherry picked from commit 913e6b5)

(cherry picked from commit bf453da)

(cherry picked from commit 9e98d47)

@Frostman is not in maintainers-list.nix on 19.09.
This fails the build of the `channel` and `tarball` jobs on the small
jobset.

Follow-up of NixOS#83102

[19.09 unblock] grafana: Drop Frostman from maintainers

(cherry picked from commit f9fcf29)

The tag points to the same commit hash, so the binary
is unchanged.

Signed-off-by: David Anderson <[email protected]>
(cherry picked from commit 3fa813e)

Tailscale does not support Go 1.12.

Signed-off-by: David Anderson <[email protected]>

Moved from nixos-homepage.

(cherry picked from commit d6ec410)

(cherry picked from commit 4052f9b)

(cherry picked from commit e51c7f6)

Some changes were made after final review of the package. There was a
missing runtime dependency that was discovered after merge of the
backport

(cherry picked from commit 9fe4a63)
Reason: The dependency can make the package work or not

https://about.gitlab.com/releases/2020/03/16/gitlab-12-8-7-released/
(cherry picked from commit 3a173c1)

….2.0-with_fix

[19.09] protonvpn ng 2.2.0 to 2.2.2

(cherry picked from commit 5c47359)

[19.09] signal-desktop: 1.32.1 -> 1.32.2 (backport)

(cherry picked from commit 0e5d457)

With quotes it doesn't match the Wire's screen, causing the window to not be grouped under its icon in Gnome.

(cherry picked from commit da587da)

(cherry picked from commit 38aa1ca)

[19.09] signal-desktop: 1.32.2 -> 1.32.3 (backport)

(cherry picked from commit 8ab04fd)

(cherry picked from commit 425efa5)

tailscale: init at 0.97-0 [backport 19.09]

While our ETag patch works pretty fine if it comes to serving data off
store paths, it unfortunately broke something that might be a bit more
common, namely when using regexes to extract path components of
location directives for example.

Recently, @devhell has reported a bug with a nginx location directive
like this:

  location ~^/\~([a-z0-9_]+)(/.*)?$" {
    alias /home/$1/public_html$2;
  }

While this might look harmless at first glance, it does however cause
issues with our ETag patch. The alias directive gets broken up by nginx
like this:

  *2 http script copy: "/home/"
  *2 http script capture: "foo"
  *2 http script copy: "/public_html/"
  *2 http script capture: "bar.txt"

In our patch however, we use realpath(3) to get the canonicalised path
from ngx_http_core_loc_conf_s.root, which returns the *configured* value
from the root or alias directive. So in the example above, realpath(3)
boils down to the following syscalls:

  lstat("/home", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0
  lstat("/home/$1", 0x7ffd08da6f60) = -1 ENOENT (No such file or directory)

During my review[1] of the initial patch, I didn't actually notice that
what we're doing here is returning NGX_ERROR if the realpath(3) call
fails, which in turn causes an HTTP 500 error.

Since our patch actually made the canonicalisation (and thus additional
syscalls) necessary, we really shouldn't introduce an additional error
so let's - at least for now - silently skip return value if realpath(3)
has failed.

However since we're using the unaltered root from the config we have
another issue, consider this root:

  /nix/store/...-abcde/$1

Calling realpath(3) on this path will fail (except if there's a file
called "$1" of course), so even this fix is not enough because it
results in the ETag not being set to the store path hash.

While this is very ugly and we should fix this very soon, it's not as
serious as getting HTTP 500 errors for serving static files.

I added a small NixOS VM test, which uses the example above as a
regression test.

It seems that my memory is failing these days, since apparently I *knew*
about this issue since digging for existing issues in nixpkgs, I found
this similar pull request which I even reviewed:

NixOS#66532

However, since the comments weren't addressed and the author hasn't
responded to the pull request, I decided to keep this very commit and do
a follow-up pull request.

[1]: NixOS#48337

Signed-off-by: aszlig <[email protected]>
Reported-by: @devhell
Acked-by: @7c6f434c
Acked-by: @yorickvP
Merges: NixOS#80671
Fixes: NixOS#66532
(cherry picked from commit e1d63ad)

It seems the quoting breaks it just like in da587da

(cherry picked from commit e50bb280cbf5339ed671b0a7208e6aba4002c713)
(cherry picked from commit f8ccef5)

…-bin_release-19.09

[19.09] tor-browser-bundle-bin: 9.0.5 -> 9.0.7

(cherry picked from commit 6d28c18)

Update the checkum and the version

(cherry picked from commit fa5fc49)
Reason: Browser must be kept up-to-date