nordic-dev.net/nixpkgs
nordic-dev.net/nixpkgs
2
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2024-12-29 17:14:33 +00:00
Code Issues Packages Projects Releases Wiki Activity
f61e9f4a53
nixpkgs/pkgs/os-specific/linux/kernel/hardened/patches.json

Ignoring revisions in .git-blame-ignore-revs. Click here to bypass and see the normal blame view.

63 lines
2.8 KiB
JSON
Raw Normal View History

linux_*_hardened: use linux-hardened patch set This is an updated version of the former upstream, https://github.com/AndroidHardeningArchive/linux-hardened, and provides a minimal set of additional hardening patches on top of upstream. The patch already incorporates many of our hardened profile defaults, and releases are timely (Linux 5.5.15 and 5.6.2 were released on 2020-04-02; linux-hardened patches for them came out on 2020-04-03 and 2020-04-04 respectively).
2020-04-04 21:47:13 +00:00
{
linux_*_hardened: index patches by major kernel version This will avoid breaking the build whenever a non-major kernel update happens. In the update script, we map each kernel version to the latest patch for the latest kernel version less than or equal to what we have packaged.
2020-04-23 17:43:44 +00:00
"4.14": {
linux: build hardened kernel with matching releases Until now we merged kernel updates even if no hardened versions were available yet. On one hand we don't want to delay patch-level updates, on the other hand users of hardened kernels have frequent breakage now[1]. This change aims to provide a solution this issue: * The hardened patchset now references the kernel version it's released for (including a sha256 hash for the fixed-output path of the source tarball). * The `hardenedKernelFor`-function doesn't just append hardened patches now, but also overrides version & src to match the kernel version the patch was built & tested for. Refs #140281 [1] https://hydra.nixos.org/job/nixos/trunk-combined/nixpkgs.linuxPackages_hardened.kernel.x86_64-linux/all
2021-10-09 12:48:27 +00:00
"patch": {
"extra": "-hardened1",
linux/hardened/patches/4.14: 4.14.281-hardened1 -> 4.14.282-hardened1
2022-06-10 18:19:14 +00:00
"name": "linux-hardened-4.14.282-hardened1.patch",
"sha256": "0f7av5llr1ccx0k6z2p2spaqk4jfaw9555gf59303zgxsvakavmi",
"url": "https://github.com/anthraxx/linux-hardened/releases/download/4.14.282-hardened1/linux-hardened-4.14.282-hardened1.patch"
linux: build hardened kernel with matching releases Until now we merged kernel updates even if no hardened versions were available yet. On one hand we don't want to delay patch-level updates, on the other hand users of hardened kernels have frequent breakage now[1]. This change aims to provide a solution this issue: * The hardened patchset now references the kernel version it's released for (including a sha256 hash for the fixed-output path of the source tarball). * The `hardenedKernelFor`-function doesn't just append hardened patches now, but also overrides version & src to match the kernel version the patch was built & tested for. Refs #140281 [1] https://hydra.nixos.org/job/nixos/trunk-combined/nixpkgs.linuxPackages_hardened.kernel.x86_64-linux/all
2021-10-09 12:48:27 +00:00
},
linux/hardened/patches/4.14: 4.14.281-hardened1 -> 4.14.282-hardened1
2022-06-10 18:19:14 +00:00
"sha256": "18sp2qvk8dkjrlxwf4d470282m9wyvhajvyys9vs94rh1i3whdv6",
"version": "4.14.282"
linux/hardened-patches/5.6.6: init at 5.6.6.a
2020-04-22 00:12:17 +00:00
},
linux_*_hardened: index patches by major kernel version This will avoid breaking the build whenever a non-major kernel update happens. In the update script, we map each kernel version to the latest patch for the latest kernel version less than or equal to what we have packaged.
2020-04-23 17:43:44 +00:00
"4.19": {
linux: build hardened kernel with matching releases Until now we merged kernel updates even if no hardened versions were available yet. On one hand we don't want to delay patch-level updates, on the other hand users of hardened kernels have frequent breakage now[1]. This change aims to provide a solution this issue: * The hardened patchset now references the kernel version it's released for (including a sha256 hash for the fixed-output path of the source tarball). * The `hardenedKernelFor`-function doesn't just append hardened patches now, but also overrides version & src to match the kernel version the patch was built & tested for. Refs #140281 [1] https://hydra.nixos.org/job/nixos/trunk-combined/nixpkgs.linuxPackages_hardened.kernel.x86_64-linux/all
2021-10-09 12:48:27 +00:00
"patch": {
"extra": "-hardened1",
linux/hardened/patches/4.19: 4.19.245-hardened1 -> 4.19.246-hardened1
2022-06-10 18:19:16 +00:00
"name": "linux-hardened-4.19.246-hardened1.patch",
"sha256": "00827r0hiiia95z4nwvbqi1jxj5bzh8hna3d4p08gj2pvq5rwvxk",
"url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.246-hardened1/linux-hardened-4.19.246-hardened1.patch"
linux: build hardened kernel with matching releases Until now we merged kernel updates even if no hardened versions were available yet. On one hand we don't want to delay patch-level updates, on the other hand users of hardened kernels have frequent breakage now[1]. This change aims to provide a solution this issue: * The hardened patchset now references the kernel version it's released for (including a sha256 hash for the fixed-output path of the source tarball). * The `hardenedKernelFor`-function doesn't just append hardened patches now, but also overrides version & src to match the kernel version the patch was built & tested for. Refs #140281 [1] https://hydra.nixos.org/job/nixos/trunk-combined/nixpkgs.linuxPackages_hardened.kernel.x86_64-linux/all
2021-10-09 12:48:27 +00:00
},
linux/hardened/patches/4.19: 4.19.245-hardened1 -> 4.19.246-hardened1
2022-06-10 18:19:16 +00:00
"sha256": "0fmsglkvdgdmrkm53vyi9d4hvdl4py9qn1z0mni224n96rd2zb80",
"version": "4.19.246"
linux/hardened-patches/4.19.117: init at 4.19.117.a
2020-04-22 00:12:28 +00:00
},
linux/hardened/patches/5.10: init at 5.10.4.a
2020-12-31 02:18:49 +00:00
"5.10": {
linux: build hardened kernel with matching releases Until now we merged kernel updates even if no hardened versions were available yet. On one hand we don't want to delay patch-level updates, on the other hand users of hardened kernels have frequent breakage now[1]. This change aims to provide a solution this issue: * The hardened patchset now references the kernel version it's released for (including a sha256 hash for the fixed-output path of the source tarball). * The `hardenedKernelFor`-function doesn't just append hardened patches now, but also overrides version & src to match the kernel version the patch was built & tested for. Refs #140281 [1] https://hydra.nixos.org/job/nixos/trunk-combined/nixpkgs.linuxPackages_hardened.kernel.x86_64-linux/all
2021-10-09 12:48:27 +00:00
"patch": {
"extra": "-hardened1",
linux/hardened/patches/5.10: 5.10.118-hardened1 -> 5.10.121-hardened1
2022-06-10 18:19:18 +00:00
"name": "linux-hardened-5.10.121-hardened1.patch",
"sha256": "1a7mvfnm15ci81129mpvh3gn6w75bq0i1ydv02zyngk9cz5mgjc1",
"url": "https://github.com/anthraxx/linux-hardened/releases/download/5.10.121-hardened1/linux-hardened-5.10.121-hardened1.patch"
linux: build hardened kernel with matching releases Until now we merged kernel updates even if no hardened versions were available yet. On one hand we don't want to delay patch-level updates, on the other hand users of hardened kernels have frequent breakage now[1]. This change aims to provide a solution this issue: * The hardened patchset now references the kernel version it's released for (including a sha256 hash for the fixed-output path of the source tarball). * The `hardenedKernelFor`-function doesn't just append hardened patches now, but also overrides version & src to match the kernel version the patch was built & tested for. Refs #140281 [1] https://hydra.nixos.org/job/nixos/trunk-combined/nixpkgs.linuxPackages_hardened.kernel.x86_64-linux/all
2021-10-09 12:48:27 +00:00
},
linux/hardened/patches/5.10: 5.10.118-hardened1 -> 5.10.121-hardened1
2022-06-10 18:19:18 +00:00
"sha256": "1iljaaiwqg30rqb9zxrxc4l1p56q75jf0zvsrmn67z2a12sffi4h",
"version": "5.10.121"
linux/hardened/patches/5.10: init at 5.10.4.a
2020-12-31 02:18:49 +00:00
},
linux/hardened/patches/5.15: init at 5.15.2-hardened1
2021-11-15 19:10:37 +00:00
"5.15": {
"patch": {
"extra": "-hardened1",
linux/hardened/patches/5.15: 5.15.43-hardened1 -> 5.15.46-hardened1
2022-06-10 18:19:21 +00:00
"name": "linux-hardened-5.15.46-hardened1.patch",
"sha256": "1ndvrr98mn40705dsfkyda9ny5r273bl9f6n1xb5ndx34j396wrh",
"url": "https://github.com/anthraxx/linux-hardened/releases/download/5.15.46-hardened1/linux-hardened-5.15.46-hardened1.patch"
linux/hardened/patches/5.15: init at 5.15.2-hardened1
2021-11-15 19:10:37 +00:00
},
linux/hardened/patches/5.15: 5.15.43-hardened1 -> 5.15.46-hardened1
2022-06-10 18:19:21 +00:00
"sha256": "0srp0wypl24gf5yz91mpk1c2kllabq6wvby1wqrrbdwvfx35figb",
"version": "5.15.46"
linux/hardened/patches/5.15: init at 5.15.2-hardened1
2021-11-15 19:10:37 +00:00
},
linux/hardened/patches/5.17: init at 5.17.5-hardened1
2022-05-05 22:22:37 +00:00
"5.17": {
"patch": {
"extra": "-hardened1",
linux/hardened/patches/5.17: 5.17.11-hardened1 -> 5.17.14-hardened1
2022-06-10 18:19:23 +00:00
"name": "linux-hardened-5.17.14-hardened1.patch",
"sha256": "017dq8ngg3mxnfffjkf1knkzii8hsf1gsi65zla34n7kjyajlchq",
"url": "https://github.com/anthraxx/linux-hardened/releases/download/5.17.14-hardened1/linux-hardened-5.17.14-hardened1.patch"
linux/hardened/patches/5.17: init at 5.17.5-hardened1
2022-05-05 22:22:37 +00:00
},
linux/hardened/patches/5.17: 5.17.11-hardened1 -> 5.17.14-hardened1
2022-06-10 18:19:23 +00:00
"sha256": "0r2skbgxzw42cn29mr7i9w7fczzxhc1lx3xvri44ljjyfdqn7r0b",
"version": "5.17.14"
linux/hardened/patches/5.17: init at 5.17.5-hardened1
2022-05-05 22:22:37 +00:00
},
linux_*_hardened: index patches by major kernel version This will avoid breaking the build whenever a non-major kernel update happens. In the update script, we map each kernel version to the latest patch for the latest kernel version less than or equal to what we have packaged.
2020-04-23 17:43:44 +00:00
"5.4": {
linux: build hardened kernel with matching releases Until now we merged kernel updates even if no hardened versions were available yet. On one hand we don't want to delay patch-level updates, on the other hand users of hardened kernels have frequent breakage now[1]. This change aims to provide a solution this issue: * The hardened patchset now references the kernel version it's released for (including a sha256 hash for the fixed-output path of the source tarball). * The `hardenedKernelFor`-function doesn't just append hardened patches now, but also overrides version & src to match the kernel version the patch was built & tested for. Refs #140281 [1] https://hydra.nixos.org/job/nixos/trunk-combined/nixpkgs.linuxPackages_hardened.kernel.x86_64-linux/all
2021-10-09 12:48:27 +00:00
"patch": {
"extra": "-hardened1",
linux/hardened/patches/5.4: 5.4.195-hardened1 -> 5.4.196-hardened1
2022-05-26 15:20:50 +00:00
"name": "linux-hardened-5.4.196-hardened1.patch",
"sha256": "11q9sadncbz84yhsai7xdbrgmcbghj0hc1lqc45767v1f3snmpyi",
"url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.196-hardened1/linux-hardened-5.4.196-hardened1.patch"
linux: build hardened kernel with matching releases Until now we merged kernel updates even if no hardened versions were available yet. On one hand we don't want to delay patch-level updates, on the other hand users of hardened kernels have frequent breakage now[1]. This change aims to provide a solution this issue: * The hardened patchset now references the kernel version it's released for (including a sha256 hash for the fixed-output path of the source tarball). * The `hardenedKernelFor`-function doesn't just append hardened patches now, but also overrides version & src to match the kernel version the patch was built & tested for. Refs #140281 [1] https://hydra.nixos.org/job/nixos/trunk-combined/nixpkgs.linuxPackages_hardened.kernel.x86_64-linux/all
2021-10-09 12:48:27 +00:00
},
linux/hardened/patches/5.4: 5.4.195-hardened1 -> 5.4.196-hardened1
2022-05-26 15:20:50 +00:00
"sha256": "1x5irgki792f21hm5146xary0260cl9r475kvw8vm9w32vyx18ig",
"version": "5.4.196"
linux_*_hardened: use linux-hardened patch set This is an updated version of the former upstream, https://github.com/AndroidHardeningArchive/linux-hardened, and provides a minimal set of additional hardening patches on top of upstream. The patch already incorporates many of our hardened profile defaults, and releases are timely (Linux 5.5.15 and 5.6.2 were released on 2020-04-02; linux-hardened patches for them came out on 2020-04-03 and 2020-04-04 respectively).
2020-04-04 21:47:13 +00:00
}
}
Reference in New Issue Copy Permalink