nix - Debian Package Tracker

general

source: nix (main)
version: 2.24.9+dfsg-2
maintainer: Jordan Justen (DMD)
arch: all any
std-ver: 4.7.0
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

oldstable: 2.3.7+dfsg1-1
stable: 2.8.0-1.1
testing: 2.24.9+dfsg-2
unstable: 2.24.9+dfsg-2
exp: 2.25.4+dfsg-1

versioned links

2.3.7+dfsg1-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.8.0-1.1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.24.9+dfsg-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.25.4+dfsg-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

nix-bin (2 bugs: 0, 2, 0, 0)
nix-setup-systemd (2 bugs: 0, 1, 1, 0)

action needed

A new upstream version is available: 2.26.1 high

A new upstream version 2.26.1 is available, you should consider packaging it.

Created: 2024-11-03 Last update: 2025-02-01 07:31

The VCS repository is not up to date, push the missing commits. high

vcswatch reports that the current version of the package is not in its VCS.
Either you need to push your commits and/or your tags, or the information about the package's VCS are out of date. A common cause of the latter issue when using the Git VCS is not specifying the correct branch when the packaging is not in the default one (remote HEAD branch), which is usually "master" but can be modified in salsa.debian.org in the project's general settings with the "Default Branch" field). Alternatively the Vcs-Git field in debian/control can contain a "-b <branch-name>" suffix to indicate what branch is used for the Debian packaging.

Created: 2025-01-16 Last update: 2025-02-01 07:00

1 security issue in trixie high

There is 1 open security issue in trixie.

1 important issue:

CVE-2024-36050: Nix through 2.22.1 mishandles certain usage of hash caches, which makes it easier for attackers to replace current source code with attacker-controlled source code by luring a maintainer into accepting a malicious pull request.

Created: 2024-03-13 Last update: 2024-11-24 17:32

1 security issue in sid high

There is 1 open security issue in sid.

1 important issue:

CVE-2024-36050: Nix through 2.22.1 mishandles certain usage of hash caches, which makes it easier for attackers to replace current source code with attacker-controlled source code by luring a maintainer into accepting a malicious pull request.

Created: 2024-03-13 Last update: 2024-11-24 17:32

lintian reports 95 warnings normal

Lintian reports 95 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2024-10-31 Last update: 2024-10-31 04:33

4 low-priority security issues in bookworm low

There are 4 open security issues in bookworm.

4 issues left for the package maintainer to handle:

CVE-2024-27297: (needs triaging) Nix is a package manager for Linux and other Unix systems. A fixed-output derivations on Linux can send file descriptors to files in the Nix store to another program running on the host (or another fixed-output derivation) via Unix domain sockets in the abstract namespace. This allows to modify the output of the derivation, after Nix has registered the path as "valid" and immutable in the Nix database. In particular, this allows the output of fixed-output derivations to be modified from their expected content. This issue has been addressed in versions 2.3.18 2.18.2 2.19.4 and 2.20.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVE-2024-36050: (postponed; to be fixed through a stable update) Nix through 2.22.1 mishandles certain usage of hash caches, which makes it easier for attackers to replace current source code with attacker-controlled source code by luring a maintainer into accepting a malicious pull request.
CVE-2024-38531: (needs triaging) Nix is a package manager for Linux and other Unix systems that makes package management reliable and reproducible. A build process has access to and can change the permissions of the build directory. After creating a setuid binary in a globally accessible location, a malicious local user can assume the permissions of a Nix daemon worker and hijack all future builds. This issue was patched in version(s) 2.23.1, 2.22.2, 2.21.3, 2.20.7, 2.19.5 and 2.18.4.
CVE-2024-47174: (needs triaging) Nix is a package manager for Linux and other Unix systems. Starting in version 1.11 and prior to versions 2.18.8 and 2.24.8, `<nix/fetchurl.nix>` did not verify TLS certificates on HTTPS connections. This could lead to connection details such as full URLs or credentials leaking in case of a man-in-the-middle (MITM) attack. `<nix/fetchurl.nix>` is also known as the builtin derivation builder `builtin:fetchurl`. It's not to be confused with the evaluation-time function `builtins.fetchurl`, which was not affected by this issue. A user may be affected by the risk of leaking credentials if they have a `netrc` file for authentication, or rely on derivations with `impureEnvVars` set to use credentials from the environment. In addition, the commonplace trust-on-first-use (TOFU) technique of updating dependencies by specifying an invalid hash and obtaining it from a remote store was also vulnerable to a MITM injecting arbitrary store objects. This also applied to the impure derivations experimental feature. Note that this may also happen when using Nixpkgs fetchers to obtain new hashes when not using the fake hash method, although that mechanism is not implemented in Nix itself but rather in Nixpkgs using a fixed-output derivation. The behavior was introduced in version 1.11 to make it consistent with the Nixpkgs `pkgs.fetchurl` and to make `<nix/fetchurl.nix>` work in the derivation builder sandbox, which back then did not have access to the CA bundles by default. Nowadays, CA bundles are bind-mounted on Linux. This issue has been fixed in Nix 2.18.8 and 2.24.8. As a workaround, implement (authenticated) fetching with `pkgs.fetchurl` from Nixpkgs, using `impureEnvVars` and `curlOpts` as needed.

You can find information about how to handle these issues in the security team's documentation.

Created: 2024-03-13 Last update: 2024-11-24 17:32

debian/patches: 9 patches to forward upstream low

Among the 12 debian patches available in version 2.24.9+dfsg-2 of the package, we noticed the following issues:

9 patches where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.

Created: 2023-02-26 Last update: 2024-10-30 07:01

testing migrations

This package will soon be part of the auto-libsodium transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.
This package will soon be part of the auto-libgit2 transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.

news

[rss feed]

[2025-01-16] Accepted nix 2.25.4+dfsg-1 (source) into experimental (Jordan Justen)
[2024-11-01] nix 2.24.9+dfsg-2 MIGRATED to testing (Debian testing watch)
[2024-10-29] Accepted nix 2.24.9+dfsg-2 (source) into unstable (Jordan Justen)
[2024-10-11] Accepted nix 2.24.9+dfsg-1 (source) into unstable (Jordan Justen)
[2024-10-03] nix 2.24.8+dfsg-1 MIGRATED to testing (Debian testing watch)
[2024-09-29] Accepted nix 2.24.8+dfsg-1 (source) into unstable (Jordan Justen)
[2024-08-12] nix 2.23.3+dfsg-2 MIGRATED to testing (Debian testing watch)
[2024-08-09] Accepted nix 2.23.3+dfsg-2 (source) into unstable (Jordan Justen)
[2024-07-22] nix 2.23.3+dfsg-1 MIGRATED to testing (Debian testing watch)
[2024-07-20] Accepted nix 2.23.3+dfsg-1 (source) into unstable (Jordan Justen)
[2024-06-08] nix 2.22.1+dfsg-1 MIGRATED to testing (Debian testing watch)
[2024-06-06] Accepted nix 2.22.1+dfsg-1 (source) into unstable (Jordan Justen)
[2023-10-20] nix 2.18.1+dfsg-1 MIGRATED to testing (Debian testing watch)
[2023-10-17] Accepted nix 2.18.1+dfsg-1 (source) into unstable (Jordan Justen)
[2023-10-15] nix 2.17.1+dfsg-1 MIGRATED to testing (Debian testing watch)
[2023-10-13] Accepted nix 2.17.1+dfsg-1 (source) into unstable (Jordan Justen)
[2023-08-09] nix 2.16.1+dfsg-3 MIGRATED to testing (Debian testing watch)
[2023-08-07] Accepted nix 2.16.1+dfsg-3 (source) into unstable (Jordan Justen)
[2023-07-29] Accepted nix 2.16.1+dfsg-2 (source) into unstable (Jordan Justen)
[2023-07-24] Accepted nix 2.16.1+dfsg-1 (source) into unstable (Jordan Justen)
[2022-11-08] nix 2.8.0-1.1 MIGRATED to testing (Debian testing watch)
[2022-10-15] Accepted nix 2.8.0-1.1 (source) into unstable (Michael Biebl)
[2022-05-08] nix 2.8.0-1 MIGRATED to testing (Debian testing watch)
[2022-05-05] Accepted nix 2.8.0-1 (source) into unstable (Thomas Koch)
[2022-03-29] nix 2.7.0+dfsg-5 MIGRATED to testing (Debian testing watch)
[2022-03-27] Accepted nix 2.7.0+dfsg-5 (source) into unstable (Thomas Koch)
[2022-03-26] Accepted nix 2.7.0+dfsg-4 (source) into unstable (Thomas Koch)
[2022-03-25] Accepted nix 2.7.0+dfsg-3 (source) into unstable (Thomas Koch)
[2022-03-24] Accepted nix 2.7.0+dfsg-2 (source) into unstable (Thomas Koch)
[2022-03-13] Accepted nix 2.7.0+dfsg-1 (source) into unstable (Thomas Koch)

bugs [bug history graph]

all: 6
RC: 0
I&N: 5
M&W: 1
F&P: 0
patch: 0

links

homepage
lintian (0, 95)
buildd: logs, exp, reproducibility, cross
popcon
browse source code
edit tags
other distros
security tracker
debian patches
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 2.24.9+dfsg-2ubuntu1
1 bug
patches for 2.24.9+dfsg-2ubuntu1