qt5.qtwebengine: mark vulnerable#435067
Conversation
LordGrimmauld
added
the
1.severity: security
nixpkgs-ci
bot
added
10.rebuild-linux: 11-100
|
pyside users to check whether they need webengine:
None need webengine. Can't check rcu and pyside tools doesn't matter. |
| qtlocation, | ||
| qtsvg, | ||
| qttools, | ||
| qtwebengine, |
There was a problem hiding this comment.
👍 from my side
The impact should be rather small. According to subsurface's CMakeLists.txt, this should only disable the internal manual and printing support.
We can re-enable qtwebengine once subsurface builds with recent Qt 6 versions.
There was a problem hiding this comment.
on the version we have, qtwebengine is not used at all
There was a problem hiding this comment.
Indeed, seems like the cmake cannot find it. This should be the code.
There was a problem hiding this comment.
Careful: we are on commit 38a0050ac33566dfd34bf94cf1d7ac66034e4118, which only supports qtwebkit: https://github.com/subsurface/subsurface/blob/38a0050ac33566dfd34bf94cf1d7ac66034e4118/CMakeLists.txt#L249-L275
qtwebkit is the predecessor to qtwebengine, and even worse in terms of security, see e.g. https://blogs.gnome.org/mcatanzaro/2022/11/04/stop-using-qtwebkit/
qtwebengine is not supported at all for the version we have. Not even for qt6, where it is just blanket-disabled. We'd need to update the package to use a modern version and qt6 to make use of qtwebengine.
There was a problem hiding this comment.
This commit is interesting :)
K900
left a comment
K900
left a comment
There was a problem hiding this comment.
LGTM overall, would be nice to have a full list of things that are affected.
nixpkgs-ci
bot
added
the
12.approvals: 1
fabianhjr
added
12.approvals: 2
29 packages updated:
71 packages removed:
|
|
|
So deactivate it by default to fix build following NixOS#435067
|
My unstable config is failing to build as well. I tried running nixos-rebuild with --show-trace as per @gepbird #360897 (comment), but this didn't give me anything useful to work with. How can I find the package that is causing the breakage for me? Command output is attached. Edit: On the third readthrough I found teamspeak mentioned in line 1000, which also appears in the list of impacted packages above. Is there a more easily understandable way to look for the build dependencies of your installed packages? |
Motivated by qt5.qtwebengine being marked vulnerable (NixOS#435067): - Move package from pkgs/data/documentation to pkgs/by-name/ze/zeal - Switch from Qt5 to Qt6 as the default - Remove zeal-qt5 and zeal-qt6 variants in favor of single Qt6 version - Add aliases for deprecated Qt-specific variants
I found https://github.com/utdemir/nix-tree to be useful for this; with default settings, a search for 'qtwebengine' revealed Notepadqq. |
|
Successfully created backport PR for |
github-actions
bot
added
the
8.has: port to stable
Motivated by qt5.qtwebengine being marked vulnerable (#435067): - Move package from pkgs/data/documentation to pkgs/by-name/ze/zeal - Switch from Qt5 to Qt6 as the default - Remove zeal-qt5 and zeal-qt6 variants in favor of single Qt6 version - Add aliases for deprecated Qt-specific variants (cherry picked from commit 0e805d8)
due to NixOS#435067 Signed-off-by: Florian Brandes <[email protected]>
due to NixOS#435067 Signed-off-by: Florian Brandes <[email protected]>
webengine is optional: ``` extensions/PythonQt_QtAll/PythonQt_QtAll.pro 24: qtHaveModule(webenginewidgets):CONFIG += PythonQtWebEngineWidgets ``` So disable it by default to fix build following NixOS#435067
webengine is optional: ``` extensions/PythonQt_QtAll/PythonQt_QtAll.pro 24: qtHaveModule(webenginewidgets):CONFIG += PythonQtWebEngineWidgets ``` So disable it by default to fix build following NixOS#435067
|
This pull request has been mentioned on NixOS Discourse. There might be relevant details there: |
It was broken after qtwebengine (and qtwebview) got tagged insecure in NixOS#435067
webengine is optional: ``` extensions/PythonQt_QtAll/PythonQt_QtAll.pro 24: qtHaveModule(webenginewidgets):CONFIG += PythonQtWebEngineWidgets ``` So disable it by default to fix build following NixOS#435067
10 participants
Things done
passthru.tests.nixpkgs-reviewon this PR. See nixpkgs-review usage../result/bin/.Add a 👍 reaction to pull requests you find important.