···11+From 2bbe75fe0bc87ab4c1e16c5a18c6200224391629 Mon Sep 17 00:00:00 2001
22+From: Nicole Patricia Mazzuca <nicole@streganil.no>
33+Date: Fri, 9 May 2025 09:32:21 +0200
44+Subject: [PATCH] open: fix opening text/html messages
55+66+This fixes a bug introduced in 93bec0de8ed5ab3d6b1f01026fe2ef20fa154329:
77+aerc started using `path.Base(<part>)`, which returns `"."` on an empty
88+path, but still checked for `""` two lines later.
99+1010+On macOS, the result is that aerc attempts to open the directory:
1111+1212+```
1313+open /var/folders/vn/hs0zvdsx3vq6svvry8s1bnym0000gn/T/aerc-4229266673: is a directory
1414+```
1515+1616+Signed-off-by: Nicole Patricia Mazzuca <nicole@streganil.no>
1717+Acked-by: Robin Jarry <robin@jarry.cc>
1818+---
1919+ commands/msgview/open.go | 2 +-
2020+ 1 file changed, 1 insertion(+), 1 deletion(-)
2121+2222+diff --git a/commands/msgview/open.go b/commands/msgview/open.go
2323+index a6e43cb8da5fd49d2aa562d4c25ee2d597deefc3..7c770d4a90b771e3a18dfcb327f5e9306d5b5fa7 100644
2424+--- a/commands/msgview/open.go
2525++++ b/commands/msgview/open.go
2626+@@ -59,7 +59,7 @@ func (o Open) Execute(args []string) error {
2727+ }
2828+ filename := path.Base(part.FileName())
2929+ var tmpFile *os.File
3030+- if filename == "" {
3131++ if filename == "." {
3232+ extension := ""
3333+ if exts, _ := mime.ExtensionsByType(mimeType); len(exts) > 0 {
3434+ extension = exts[0]
+41
pkgs/by-name/ae/aerc/basename-temp-file.patch
···11+From 93bec0de8ed5ab3d6b1f01026fe2ef20fa154329 Mon Sep 17 00:00:00 2001
22+From: Robin Jarry <robin@jarry.cc>
33+Date: Wed, 9 Apr 2025 10:49:24 +0200
44+Subject: [PATCH] open: only use part basename for temp file
55+66+When an attachment part has a name such as "/tmp/55208186_AllDocs.pdf",
77+aerc creates a temp folder and tries to store the file by blindly
88+concatenating the path as follows:
99+1010+ /tmp/aerc-3444057757/tmp/55208186_AllDocs.pdf
1111+1212+And when writing to this path, it gets a "No such file or directory"
1313+error because the intermediate "tmp" subfolder isn't created.
1414+1515+Reported-by: Erik Colson <eco@ecocode.net>
1616+Signed-off-by: Robin Jarry <robin@jarry.cc>
1717+---
1818+ commands/msgview/open.go | 3 ++-
1919+ 1 file changed, 2 insertions(+), 1 deletion(-)
2020+2121+diff --git a/commands/msgview/open.go b/commands/msgview/open.go
2222+index 4293b7e4892c137a7f3fbbe79245ffb6733b2671..a6e43cb8da5fd49d2aa562d4c25ee2d597deefc3 100644
2323+--- a/commands/msgview/open.go
2424++++ b/commands/msgview/open.go
2525+@@ -5,6 +5,7 @@ import (
2626+ "io"
2727+ "mime"
2828+ "os"
2929++ "path"
3030+ "path/filepath"
3131+3232+ "git.sr.ht/~rjarry/aerc/app"
3333+@@ -56,7 +57,7 @@ func (o Open) Execute(args []string) error {
3434+ app.PushError(err.Error())
3535+ return
3636+ }
3737+- filename := part.FileName()
3838++ filename := path.Base(part.FileName())
3939+ var tmpFile *os.File
4040+ if filename == "" {
4141+ extension := ""
+8-1
pkgs/by-name/ae/aerc/package.nix
···3333 python3Packages.wrapPython
3434 ];
35353636- patches = [ ./runtime-libexec.patch ];
3636+ patches = [
3737+ ./runtime-libexec.patch
3838+3939+ # TODO remove these with the next release
4040+ # they resolve a path injection vulnerability when saving attachments (CVE-2025-49466)
4141+ ./basename-temp-file.patch
4242+ ./basename-temp-file-fixup.patch
4343+ ];
37443845 postPatch = ''
3946 substituteAllInPlace config/aerc.conf
···21212222let
2323 pname = "proxmox-backup-client";
2424- version = "3.3.2";
2424+ version = "3.4.2";
25252626 proxmox-backup_src = fetchgit {
2727 url = "git://git.proxmox.com/git/proxmox-backup.git";
2828- tag = "v${version}";
2828+ rev = "37f1949335cad801f7cdaa0173cc114590a37e4e";
2929 name = "proxmox-backup";
3030- hash = "sha256-0piUftzuK9e8KbOe+bc3SXWa0DlnEgk5iNGWGn4fw7Y=";
3030+ hash = "sha256-OW6GG/4IcEw8XOSSB5EoN+jyoOaL0ZtavJahnKOuAqI=";
3131 };
32323333 proxmox_src = fetchgit {
3434 url = "git://git.proxmox.com/git/proxmox.git";
3535- rev = "df6b705f564ff145faa14770db6493bc5da8cab3";
3535+ rev = "e47fdf411be61b15382bc3baa3064f1e7cb03fa2";
3636 name = "proxmox";
3737- hash = "sha256-6fQVK+G5FMPy+29hScMkvQ+MQQryYs8f8oooq1YGXbg=";
3737+ hash = "sha256-jSU00D75sx40VS8rgF+D6h120FMaD1Jfq4e8l+8D5BQ=";
3838 };
39394040 proxmox-fuse_src = fetchgit {
···6363 name = "h2";
6464 owner = "hyperium";
6565 repo = "h2";
6666- rev = "v0.4.7";
6767- hash = "sha256-GcO4321Jqt1w7jbvQKd0GXIjptyz+tlN2SuxHoBJ/9k=";
6666+ rev = "v0.4.10";
6767+ hash = "sha256-PasHCbU466ByHIbDQpMMgzjg2dMRveOButHeVSknSEQ=";
6868 };
6969-7070- aurPatchCommit = "6f83f58d54bc7186211d0cfa637c652b13e0dfee";
7169in
72707371rustPlatform.buildRustPackage {
···8583 sourceRoot = proxmox-backup_src.name;
86848785 # These patches are essentially un-upstreamable, due to being "workarounds" related to the
8888- # project structure.
8686+ # project structure and upstream/Debian-specific packaging.
8987 cargoPatches = [
9088 # A lot of Rust crates `proxmox-backup-client` depends on are only available through git (or
9189 # Debian packages). This patch redirects all these dependencies to a local, relative path, which
···9492 # `make docs` assumes that the binaries are located under `target/{debug,release}`, but due
9593 # to how `buildRustPackage` works, they get put under `target/$RUSTC_TARGET/{debug,release}`.
9694 # This patch simply fixes that up.
9797- ./0002-docs-Add-target-path-fixup-variable.patch
9595+ ./0002-docs-add-target-path-fixup-variable.patch
9896 # Need to use a patched version of the `h2` crate (with a downgraded dependency, see also postPatch).
9997 # This overrides it in the Cargo.toml as needed.
10098 ./0003-cargo-use-local-patched-h2-dependency.patch
10199 # This patch prevents the generation of the man-pages for other components inside the repo,
102100 # which would require them too be built too. Thus avoid wasting resources and just skip them.
103103- (fetchpatch {
104104- name = "0002-docs-drop-all-but-client-man-pages.patch";
105105- url = "https://aur.archlinux.org/cgit/aur.git/plain/0002-docs-drop-all-but-client-man-pages.patch?h=proxmox-backup-client&id=${aurPatchCommit}";
106106- hash = "sha256-AlIGfJZGaZl2NBVfuFxpDL6bgyvXA2Wcz7UWSrnQa24=";
107107- })
101101+ ./0004-docs-drop-all-but-client-man-pages.patch
102102+ # Upstream uses a patched version of the h2 crate (see [0]), which does not apply here.
103103+ # [0] https://git.proxmox.com/?p=debcargo-conf.git;a=blob;f=src/h2/debian/patches/add-legacy.patch;h=0913da317
104104+ ./0005-Revert-h2-switch-to-legacy-feature.patch
108105 ];
109106110107 postPatch = ''