Unverified Commit 424c8636 authored by dotlambda's avatar dotlambda Committed by GitHub
Browse files

python3Packages.ecdsa: mark insecure (#454346)

parents 0ec9321d 231961af

pkgs/by-name/du/duplicity/package.nix

+0 −6
Original line number Diff line number Diff line
@@ -80,16 +80,10 @@ let 
      [

        b2sdk

        boto3

        cffi

        cryptography

        ecdsa

        idna

        pygobject3

        fasteners

        lockfile

        paramiko

        pyasn1

        pycrypto

        # Currently marked as broken.

        # pydrive2

      ]

pkgs/by-name/ki/killerbee/package.nix

+1 −0
Original line number Diff line number Diff line
@@ -22,6 +22,7 @@ python3.pkgs.buildPythonApplication rec { 
  buildInputs = [ libgcrypt ];



  dependencies = with python3.pkgs; [

    pycrypto

    pyserial

    pyusb

    rangeparser

pkgs/development/python-modules/ecdsa/default.nix

+37 −11
Original line number Diff line number Diff line 
{

  lib,

  buildPythonPackage,

  fetchPypi,

  pkgs,

  fetchFromGitHub,

  gitUpdater,

  hypothesis,

  openssl,

  pytestCheckHook,

  setuptools,

  six,

}:



buildPythonPackage rec {

  pname = "ecdsa";

  version = "0.19.1";

  format = "setuptools";

  pyproject = true;



  src = fetchPypi {

    inherit pname version;

    hash = "sha256-R4y6e2JVWGb8s7s/6YXgbey9to71VxPE5auYxX1QjmE=";

  src = fetchFromGitHub {

    owner = "tlsfuzzer";

    repo = "python-ecdsa";

    tag = "python-ecdsa-${version}";

    hash = "sha256-PjOjHQziQ9ohXH82Ocaowj/AtsXHMHDhatFPQNccyC8=";

  };



  propagatedBuildInputs = [ six ];

  # Only needed for tests

  nativeCheckInputs = [ pkgs.openssl ];

  build-system = [ setuptools ];



  meta = with lib; {

  dependencies = [ six ];



  pythonImportsCheck = [ "ecdsa" ];



  nativeCheckInputs = [

    hypothesis

    openssl # Only needed for tests

    pytestCheckHook

  ];



  passthru.updateScript = gitUpdater {

    rev-prefix = "python-ecdsa-";

  };



  meta = {

    changelog = "https://github.com/tlsfuzzer/python-ecdsa/blob/${src.tag}/NEWS";

    description = "ECDSA cryptographic signature library";

    homepage = "https://github.com/warner/python-ecdsa";

    license = licenses.mit;

    license = lib.licenses.mit;

    knownVulnerabilities = [

      # "I don't want people to use this library in production environments.

      # It's a teaching tool, it's a testing tool, it's absolutely not an

      # production grade implementation."

      # https://github.com/tlsfuzzer/python-ecdsa/issues/330

      "CVE-2024-23342"

    ];

  };

}

pkgs/development/python-modules/home-assistant-chip-core/default.nix

+1 −6
Original line number Diff line number Diff line 
{

  lib,

  buildPythonPackage,

  pythonOlder,

  aenum,

  home-assistant-chip-wheels,

  coloredlogs,
@@ -9,7 +8,6 @@ 
  cryptography,

  dacite,

  deprecation,

  ecdsa,

  ipdb,

  mobly,

  pygobject3,
@@ -22,8 +20,6 @@ buildPythonPackage rec { 
  inherit (home-assistant-chip-wheels) version;

  format = "wheel";



  disabled = pythonOlder "3.7";



  src = home-assistant-chip-wheels;



  # format=wheel needs src to be a wheel not a folder of wheels
@@ -31,13 +27,12 @@ buildPythonPackage rec { 
    src=($src/home_assistant_chip_core*.whl)

  '';



  propagatedBuildInputs = [

  dependencies = [

    aenum

    coloredlogs

    construct

    cryptography

    dacite

    ecdsa

    rich

    pyyaml

    ipdb

pkgs/development/python-modules/home-assistant-chip-wheels/default.nix

+3 −0
Original line number Diff line number Diff line
@@ -166,6 +166,9 @@ stdenv.mkDerivation rec { 
      patch -p1 < $patch

    done



    # ecdsa is insecure and only used in tests

    patch -p1 < ${./dont-import-ecdsa.patch}



    # unpin dependencies

    # there are many files to modify, in different formats

    sed -i 's/==.*$//' third_party/pigweed/repo/pw_env_setup/py/pw_env_setup/virtualenv_setup/python_base_requirements.txt