tjh.dev
1{ lib, stdenv, fetchgit, fetchpatch, autoreconfHook }:
2
3stdenv.mkDerivation rec {
4 version = "1.2.20";
5 pname = "libtar";
6
7 # Maintenance repo for libtar (Arch Linux uses this)
8 src = fetchgit {
9 url = "git://repo.or.cz/libtar.git";
10 rev = "refs/tags/v${version}";
11 sha256 = "1pjsqnqjaqgkzf1j8m6y5h76bwprffsjjj6gk8rh2fjsha14rqn9";
12 };
13
14 patches = let
15 fp = name: sha256:
16 fetchpatch {
17 url = "https://sources.debian.net/data/main/libt/libtar/1.2.20-4/debian/patches/${name}.patch";
18 inherit sha256;
19 };
20 in [
21 (fetchpatch {
22 name = "no_static_buffers.patch";
23 url = "https://src.fedoraproject.org/rpms/libtar/raw/e25b692fc7ceaa387dafb865b472510754f51bd2/f/libtar-1.2.20-no-static-buffer.patch";
24 sha256 = "sha256-QcWOgdkNlALb+YDVneT1zCNAMf4d8IUm2kUUUy2VvJs=";
25 })
26 (fp "no_maxpathlen" "11riv231wpbdb1cm4nbdwdsik97wny5sxcwdgknqbp61ibk572b7")
27 (fp "CVE-2013-4420" "0d010190bqgr2ggy02qwxvjaymy9a22jmyfwdfh4086v876cbxpq")
28 (fp "th_get_size-unsigned-int" "1ravbs5yrfac98mnkrzciw9hd2fxq4dc07xl3wx8y2pv1bzkwm41")
29 (fetchpatch {
30 name = "CVE-2021-33643_CVE-2021-33644.patch";
31 url = "https://src.fedoraproject.org/rpms/libtar/raw/e25b692fc7ceaa387dafb865b472510754f51bd2/f/libtar-1.2.20-CVE-2021-33643-CVE-2021-33644.patch";
32 sha256 = "sha256-HdjotTvKJNntkdcV+kR08Ht/MyNeB6qUT0qo67BBOVA=";
33 })
34 (fetchpatch {
35 name = "CVE-2021-33645_CVE-2021-33646_CVE-2021-33640.patch";
36 url = "https://src.fedoraproject.org/rpms/libtar/raw/e25b692fc7ceaa387dafb865b472510754f51bd2/f/libtar-1.2.20-CVE-2021-33645-CVE-2021-33646.patch";
37 sha256 = "sha256-p9DEFAL5Y+Ldy5c9Wj9h/BSg4TDxIxCjCQJD+wGQ7oI=";
38 })
39 ];
40
41 nativeBuildInputs = [ autoreconfHook ];
42 buildInputs = [ ];
43
44 meta = with lib; {
45 description = "C library for manipulating POSIX tar files";
46 homepage = "https://repo.or.cz/libtar";
47 license = licenses.bsd3;
48 platforms = with platforms; linux ++ darwin;
49 maintainers = [ maintainers.bjornfor ];
50 };
51}