Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Track xz 👿 #530

Closed
kachick opened this issue Mar 30, 2024 · 2 comments · Fixed by #532
Closed

Track xz 👿 #530

kachick opened this issue Mar 30, 2024 · 2 comments · Fixed by #532

Comments

@kachick
Copy link
Owner

kachick commented Mar 30, 2024 •
edited
Loading

Not using, but NixOS/nixpkgs#300055 watching 👀

NixOS/nixpkgs#300028

https://www.openwall.com/lists/oss-security/2024/03/29/4

https://github.com/NixOS/nixpkgs/blob/b96bc828b81140dd3fb096b4e66a6446d6d5c9dc/doc/stdenv/stdenv.chapter.md?plain=1#L177

https://www.mail-archive.com/[email protected]/msg00567.html

https://tukaani.org/xz-backdoor/

https://gist.github.com/thesamesam/223949d5a074ebc3dce9ee78baad9e27
@kachick kachick added this to 🛸 Mar 30, 2024
@github-project-automation github-project-automation bot moved this to 😩 in 🛸 Mar 30, 2024
@kachick
Copy link
Owner Author

kachick commented Mar 31, 2024 •
edited
Loading 

> which xz
/nix/store/2zvi5q6fvrmznavnqgzc947wssilv9vy-xz-5.6.1-bin/bin/xz

1! nix-store --query --referrers "$(which xz)"
/nix/store/29jiyxdanbbfid2pxxfr9d59sabfh238-stdenv-linux
/nix/store/c8dj731bkcdzhgrpawhc8qvdgls4xfjv-stdenv-linux
/nix/store/xcmzy20fnvnp4i9qksp33bj24x2fw0r2-xz-5.6.1-dev
/nix/store/2zcbrx86gp7iqi54bczxap45rsjd4pyj-nix-shell-env
/nix/store/58liziaxxcs2x4n8qmj5p2l6l7xy8shz-nix-shell-env
/nix/store/bclw802xzak9nns0yrkqigpklkvfs4g2-nix-shell-env
/nix/store/d4vkyisx8ywspvm3krwkk4f0wzcxbf53-nix-shell-env
/nix/store/dn1v4d4ph6khc7c0ra64wrgnh9p0cz72-nix-shell-env
/nix/store/ic3cr3w4bjhw26h91lrs8ya54sgfxzjd-nix-shell-env
/nix/store/n0j5zp70c8j4gfawsinpf7gkdcq8xyv6-nix-shell-env
/nix/store/r3gc3g759clrfli9jcskf520c7x38452-powershell-7.4.1
/nix/store/skfpk02rqfxskqsryg9jv7mgwbs6dll0-nix-shell-env
/nix/store/vzc06av6dpq778wy9m8h31c0dbhan7sn-kbd-2.6.4
/nix/store/xrznh8hsch51w53rxfn7rskyndpsb3kx-nix-shell-env
/nix/store/xs3j29ghsjvd5r1z58x9biybzjmxyr9m-nix-shell-env

> nix-store --query --referrers /nix/store/vzc06av6dpq778wy9m8h31c0dbhan7sn-kbd-2.6.4
/nix/store/vzc06av6dpq778wy9m8h31c0dbhan7sn-kbd-2.6.4
/nix/store/3np3qw5y5xarl4hxbhk9vj2d5kmgqsir-systemd-255.2
/nix/store/hm5qb77x0i54rg60frps0a86r72gkq57-systemd-minimal-255.2

> nix-store --query --referrers /nix/store/r3gc3g759clrfli9jcskf520c7x38452-powershell-7.4.1
/nix/store/r3gc3g759clrfli9jcskf520c7x38452-powershell-7.4.1
/nix/store/0rx4z67fwlb2nylwfrr10dr7w13gvrm3-home-manager-path
/nix/store/18sa9hzr0qmx0f1gl5ad2150xpcpi6ay-home-manager-path
/nix/store/7n91i4is6zpl7m7sbkmrq2gmdsw2wcyl-home-manager-path
/nix/store/b3srq5nf8i6hvxvj5rxqik9zmxb8aqsy-home-manager-path
/nix/store/c12pq841bjxwbzacgk91kk7xx8ifsr9z-home-manager-path
/nix/store/c4bnbgd60jdn9j0gpal93hdbwyiwyyjn-home-manager-path
/nix/store/d2z5azv0pbiymx06d4m4h17z7bsbl8nw-home-manager-path
/nix/store/g1iy7l25hqmfdylpxl836q64cxh7ra1y-home-manager-path
/nix/store/h1jlq7rdrbw27pxa5di66nghw52xny81-home-manager-path
/nix/store/iqmdpmz67jnwmsak4kaz8xdkkqwdphwl-home-manager-path
/nix/store/j0kkdml30rykkx7i0krvsjbxmr8csbb5-home-manager-path
/nix/store/pv69kh4w7jkr59w7zm50lnj46n911wnn-home-manager-path
/nix/store/qdyx039s8ks2v4cw4fq5nlqb5kqlcgdf-home-manager-path
/nix/store/r8hp20xk170gf97gwdvryfl9mkkl3hg3-home-manager-path
/nix/store/vdrs8afjmy63yg19jh9aw7a683wq1n3v-home-manager-path
/nix/store/wc3ivxizdimadswk34pyqa1nr7cfq68a-home-manager-path
/nix/store/y6wzf37yamk88ihviwpdzxy7m104sn8v-home-manager-path
/nix/store/ywb01kqpf7azdl3147iqzgcvqn4rhyhg-home-manager-path
/nix/store/z3868r3smdfmd28csa4zc5babmva8w69-home-manager-path
/nix/store/zhhdk90imv6i3h0vav2yrrdk5igdk4r2-home-manager-path

https://github.com/NixOS/nixpkgs/blob/38baa038296954a827190f8c28b83d32444f3bfc/pkgs/shells/powershell/default.nix
https://github.com/PowerShell/PowerShell/blob/b23607ef8c14378050c27c2c21e5946196cd1d99/assets/AppImageThirdPartyNotices.txt#L393-L395

https://github.com/kachick/dotfiles/pull/496/files#diff-176ca7c5b7f41e57c139e680dc5aed7f713d247d2037fed7a2e092249b98ceefR12

This was referenced Mar 31, 2024
Closed
Merged
@kachick kachick moved this from 😩 to 💪 in 🛸 Mar 31, 2024
kachick added a commit that referenced this issue Mar 31, 2024
@kachick
Prefer stable pkgs except some dependencies
b1c3415 
Resolves #403
Fixes #530
@github-project-automation github-project-automation bot moved this from 💪 to 🎉 in 🛸 Mar 31, 2024
@kachick kachick mentioned this issue Apr 3, 2024
Merged
kachick pushed a commit that referenced this issue Apr 4, 2024
@selfup-runner
Bump nixos-unstable to avoid installing dirty xz in Nix store (#546)
0cea682 
* flake.lock: Update

Flake lock file updates:

• Updated input 'edge-nixpkgs':
    'github:NixOS/nixpkgs/d8fe5e6c92d0d190646fb9f1056741a229980089' (2024-03-29)
  → 'github:NixOS/nixpkgs/08b9151ed40350725eb40b1fe96b0b86304a654b' (2024-04-03)
• Updated input 'my-nixpkgs':
    'github:kachick/nixpkgs/10fdf47377beb102988d907e34a487dd42ad2079' (2024-03-24)
  → 'github:kachick/nixpkgs/22e9566f885fe59f3e814ae383dd54a0e326a8a3' (2024-04-03)

* Sync CI dependencies with nixpkgs

* Add workaround for typos false positive detection

* Enable check_no_dirty_xz_in_nix_store

---

Updates #530 
Updates #532
@kachick kachick mentioned this issue Apr 5, 2024
Closed
@kachick
Copy link
Owner Author

kachick commented Aug 23, 2024

How about adding https://github.com/VirusTotal/yara-x ?

kachick added a commit that referenced this issue Nov 11, 2024
@kachick
Remove old xz checker. Update GH-530
d602449
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
🛸
Archived in project
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Prefer stable nixpkgs and home-manager kachick/dotfiles
1 participant
@kachick