curl-impersonate-ff: drop by samestep · Pull Request #457684 · NixOS/nixpkgs

samestep · 2025-11-02T01:35:24Z

Tracking: Build Failures with CMake 4 #445447

Closes #450649. See #455108 (comment).

cc @deliciouslytyped

Things done

Add a 👍 reaction to pull requests you find important.

pkgs/by-name/cu/curl-impersonate/package.nix

pkgs/top-level/all-packages.nix

pyrox0 · 2025-11-02T05:36:06Z

Agreeing with the comments emily made, though also since this is a breaking change it needs to wait until after 25.11 branch-off. Changes LGTM once suggestions are implemented though.

emilazy · 2025-11-02T05:49:44Z

I think that since curl-impersonate-ff suffers from many serious vulnerabilities, is unmaintained upstream for years, and our packaged curl-impersonate can replace its functionality, we should be fine to get a freeze exemption for this. curl-impersonate-ff is a leaf package so the potential blast radius is very low. cc @leona-ya @jopejoe1

emilazy · 2025-11-02T05:50:19Z

Also given that the build has been broken since CMake 4 anyway there is really no point carrying it into 25.11.

leona-ya

Could you add a throw alias for this package. Otherwise (and also as discussed in NixOS Security on Matrix) I'm happy to drop this package for 25.11

samestep · 2025-11-02T23:27:59Z

Could you add a throw alias for this package. Otherwise (and also as discussed in NixOS Security on Matrix) I'm happy to drop this package for 25.11

@leona-ya done!

GGG-KILLER · 2025-11-03T00:31:53Z

It seems pkgs/development/python-modules/curl-cffi/default.nix needs to be updated as it points to curl-impersonate-chrome.

samestep · 2025-11-03T00:38:55Z

@GGG-KILLER done, thanks! Apologies for the oversight.

MultisampledNight

Thank you! ^^

GGG-KILLER · 2025-11-03T01:04:34Z

Currently running nixosTests.curl-impersonate to ensure nothing broke (it shouldn't have, but just for my paranoia's sake), I'd appreciate if merging waited for it

GGG-KILLER · 2025-11-03T01:38:52Z

`nixpkgs-review` result

Generated using nixpkgs-review.

Command: nixpkgs-review pr 457684 --package nixosTests.curl-impersonate
Commit: 27f6954f514f6de4127943e7ae84355b89b5b91a

`x86_64-linux`

❌ 1 package failed to build:

nixosTests.curl-impersonate

Error logs: `x86_64-linux`

nixosTests.curl-impersonate

curl # + cd tests
curl # + pytest . --install-dir ../usr --capture-interface eth1 --exitfirst -k 'not test_http2_headers'
curl # Traceback (most recent call last):
curl #   File "/nix/store/mkwsb9vjm5h3r1i51y81yq28acrd5gvx-python3.13-pytest-8.4.2/bin/pytest", line 5, in <module>
curl #     from pytest import console_main
curl # ModuleNotFoundError: No module named 'pytest'
curl: output: 
!!! Test "Run curl-impersonate tests" failed with error: "command `/nix/store/lbnnmbqapi9rlxanmq1ib9gzm9lnzpfr-curl-impersonate-test` failed (exit code 1)"
!!! Traceback (most recent call last):
!!!   File "<string>", line 14, in <module>
!!!     curl.succeed("/nix/store/lbnnmbqapi9rlxanmq1ib9gzm9lnzpfr-curl-impersonate-test")
!!! 
!!! RequestedAssertionFailed: command `/nix/store/lbnnmbqapi9rlxanmq1ib9gzm9lnzpfr-curl-impersonate-test` failed (exit code 1)
cleanup
kill machine (pid 9)
qemu-system-x86_64: terminating on signal 15 from pid 6 (/nix/store/cfapjd2rvqrpry4grb0kljnp8bvnvfxz-python3-3.13.8/bin/python3.13)
kill machine (pid 32)
qemu-system-x86_64: terminating on signal 15 from pid 6 (/nix/store/cfapjd2rvqrpry4grb0kljnp8bvnvfxz-python3-3.13.8/bin/python3.13)
kill vlan (pid 7)
(finished: cleanup, in 0.01 seconds)

GGG-KILLER

Figured out what broke nixosTests.curl-impersonate, seems simple to fix at least 😅

GGG-KILLER · 2025-11-03T03:07:33Z

pkgs/by-name/cu/curl-impersonate/package.nix

  passthru = {
-    curl-impersonate-ff = callPackage ./firefox { };
-    curl-impersonate-chrome = callPackage ./chrome { };
+    deps = callPackage ./deps.nix { };
+
+    updateScript = ./update.sh;

-    inherit (passthru.curl-impersonate-chrome) src;
+    # Find the correct boringssl source file
+    boringssl-source = builtins.head (
+      lib.attrValues (lib.filterAttrs (name: _: lib.strings.hasPrefix "boringssl-" name) passthru.deps)
+    );
+    boringssl-go-modules =
+      (buildGoModule {
+        inherit (passthru.boringssl-source) name;
+
+        src = passthru.boringssl-source;
+        vendorHash = "sha256-HepiJhj7OsV7iQHlM2yi5BITyAM04QqWRX28Rj7sRKk=";
+
+        nativeBuildInputs = [ unzip ];
+
+        proxyVendor = true;
+      }).goModules;
+  };


A few passthrus here are missing from the original package, more specifically src and tests, which breaks nixosTests.curl-impersonate

Hmm... @GGG-KILLER I added those just now but it doesn't seem to have fixed it; this still fails for me:

nix-build -A nixosTests.curl-impersonate

Weird, let me check what's wrong with it now

Okay, I figured out, it is an error with the test itself now, all good!

GGG-KILLER · 2025-11-18T11:31:32Z

Considering this is a security matter, and the aliases have been added (as @leona-ya has pointed out), is there anything else we're waiting on to merge this?

dotlambda · 2025-12-10T03:14:45Z

Please rebase to get rid of the merge commit. Should we mark the package as insecure on 25.05 and 25.11?

develop7 · 2025-12-16T12:46:33Z

@GGG-KILLER please rebase

samestep requested a review from LordGrimmauld November 2, 2025 01:35

samestep mentioned this pull request Nov 2, 2025

curl-impersonate-ff: fix build with cmake 4 #455108

Closed

13 tasks

samestep force-pushed the curl-impersonate-ff-drop branch from 114950e to 800aa1d Compare November 2, 2025 01:38

nix-owners bot requested a review from GGG-KILLER November 2, 2025 01:44

emilazy reviewed Nov 2, 2025

View reviewed changes

pkgs/by-name/cu/curl-impersonate/package.nix Outdated Show resolved Hide resolved

pkgs/top-level/all-packages.nix Show resolved Hide resolved

emilazy requested a review from pyrox0 November 2, 2025 04:14

pyrox0 added the 2.status: wait for branch‐off Waiting for the next Nixpkgs branch‐off label Nov 2, 2025

leona-ya reviewed Nov 2, 2025

View reviewed changes

leona-ya added 1.severity: security Issues which raise a security issue, or PRs that fix one and removed 2.status: wait for branch‐off Waiting for the next Nixpkgs branch‐off labels Nov 2, 2025

samestep force-pushed the curl-impersonate-ff-drop branch 2 times, most recently from a05c30e to 03535a0 Compare November 2, 2025 23:27

samestep force-pushed the curl-impersonate-ff-drop branch from 03535a0 to 27f6954 Compare November 3, 2025 00:38

nix-owners bot requested a review from chuangzhu November 3, 2025 00:43

nixpkgs-ci bot added the 6.topic: python Python is a high-level, general-purpose programming language. label Nov 3, 2025

MultisampledNight approved these changes Nov 3, 2025

View reviewed changes

nixpkgs-ci bot added the 12.approvals: 1 This PR was reviewed and approved by one person. label Nov 3, 2025

GGG-KILLER suggested changes Nov 3, 2025

View reviewed changes

samestep force-pushed the curl-impersonate-ff-drop branch from 27f6954 to 3abbc92 Compare November 3, 2025 13:57

iedame mentioned this pull request Nov 7, 2025

Build failure: curl-impersonate-ff #450649

Closed

3 tasks

GGG-KILLER approved these changes Nov 7, 2025

View reviewed changes

nixpkgs-ci bot requested review from GGG-KILLER and sarahec November 14, 2025 08:58

nixpkgs-ci bot removed the 2.status: merge conflict This PR has merge conflicts with the target branch label Nov 14, 2025

GGG-KILLER approved these changes Nov 14, 2025

View reviewed changes

nixpkgs-ci bot added the 2.status: merge conflict This PR has merge conflicts with the target branch label Dec 11, 2025

curl-impersonate-ff: drop

b6004c3

mdaniels5757 force-pushed the curl-impersonate-ff-drop branch from d0abcc7 to b6004c3 Compare December 28, 2025 02:09

nixpkgs-ci bot removed the 2.status: merge conflict This PR has merge conflicts with the target branch label Dec 28, 2025

mdaniels5757 added this pull request to the merge queue Dec 28, 2025

Merged via the queue into NixOS:master with commit ee04d5a Dec 28, 2025
26 of 30 checks passed

samestep deleted the curl-impersonate-ff-drop branch December 28, 2025 02:23

Sigmanificient mentioned this pull request Jan 3, 2026

Tracking: Build Failures with CMake 4 #445447

Open

Uh oh!

Conversation

samestep commented Nov 2, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Things done

Uh oh!

Uh oh!

Uh oh!

pyrox0 commented Nov 2, 2025

Uh oh!

emilazy commented Nov 2, 2025

Uh oh!

emilazy commented Nov 2, 2025

Uh oh!

leona-ya left a comment

Choose a reason for hiding this comment

Uh oh!

samestep commented Nov 2, 2025

Uh oh!

GGG-KILLER commented Nov 3, 2025

Uh oh!

samestep commented Nov 3, 2025

Uh oh!

MultisampledNight left a comment

Choose a reason for hiding this comment

Uh oh!

GGG-KILLER commented Nov 3, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

GGG-KILLER commented Nov 3, 2025

nixpkgs-review result

x86_64-linux

Uh oh!

GGG-KILLER left a comment

Choose a reason for hiding this comment

Uh oh!

GGG-KILLER Nov 3, 2025

Choose a reason for hiding this comment

Uh oh!

samestep Nov 3, 2025

Choose a reason for hiding this comment

Uh oh!

GGG-KILLER Nov 4, 2025

Choose a reason for hiding this comment

Uh oh!

GGG-KILLER Nov 4, 2025

Choose a reason for hiding this comment

Uh oh!

GGG-KILLER commented Nov 18, 2025

Uh oh!

dotlambda commented Dec 10, 2025

Uh oh!

develop7 commented Dec 16, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

9 participants

samestep commented Nov 2, 2025 •

edited

Loading

GGG-KILLER commented Nov 3, 2025 •

edited

Loading

`nixpkgs-review` result

`x86_64-linux`