Merge pull request #66422 from stefano-m/icedtea_web-1.8.3

icedtea_web: 1.7.1 -> 1.8.3 (fixes CVE-2019-10185, CVE-2019-10181, CVE-2019-10182)

pkgs/development/compilers/icedtea-web/default.nix

@@ -1,30 +1,55 @@
-{ stdenv, fetchurl, jdk, gtk2, xulrunner, zip, pkgconfig, perl, npapi_sdk, bash, bc }:
+{ stdenv, fetchFromGitHub, cargo, rustc, autoreconfHook, jdk, glib, xulrunner, zip, pkgconfig, npapi_sdk, bash, bc }:
 
 stdenv.mkDerivation rec {
   name = "icedtea-web-${version}";
 
-  version = "1.7.1";
+  version = "1.8.3";
 
-  src = fetchurl {
-    url = "http://icedtea.wildebeest.org/download/source/${name}.tar.gz";
-    sha256 = "1b9z0i9b1dsc2qpfdzbn2fi4vi3idrhm7ig45g1ny40ymvxcwwn9";
+  src = fetchFromGitHub {
+    owner = "AdoptOpenJDK";
+    repo = "IcedTea-Web";
+    rev = name;
+    sha256 = "0bm5k11i2vgb54ch1bawsmjbwnqnp04saadwm2f2mggmmdc6b1qq";
   };
 
-  nativeBuildInputs = [ pkgconfig bc perl ];
-  buildInputs = [ gtk2 xulrunner zip npapi_sdk ];
+  nativeBuildInputs = [ autoreconfHook pkgconfig bc ];
+  buildInputs = [ cargo rustc glib xulrunner zip npapi_sdk ];
 
   preConfigure = ''
-    #patchShebangs javac.in
     configureFlagsArray+=("BIN_BASH=${bash}/bin/bash")
   '';
 
+  patches = [ ./patches/0001-make-cargo-work-with-nix-build-on-linux.patch ];
+
+  doCheck = true;
+  preCheck = ''
+    # Needed for the below rust-launcher tests to pass
+    # dirs_paths_helper::tests::check_config_files_paths
+    # dirs_paths_helper::tests::check_legacy_config_files_paths
+
+    mkdir -p $HOME/.icedtea
+    touch $HOME/.icedtea/deployment.properties
+
+    mkdir -p $XDG_CONFIG_HOME/icedtea-web
+    touch $XDG_CONFIG_HOME/icedtea-web/deployment.properties
+  '';
+
+  HOME = "/build";
+  XDG_CONFIG_HOME = "/build";
+
   configureFlags = [
+    "--with-itw-libs=DISTRIBUTION"
     "--with-jdk-home=${jdk.home}"
     "--disable-docs"
   ];
 
   mozillaPlugin = "/lib";
 
+  postInstall = ''
+    mkdir -p $out/share/applications
+    cp javaws.desktop itweb-settings.desktop policyeditor.desktop $out/share/applications
+  '';
+
   meta = {
     description = "Java web browser plugin and an implementation of Java Web Start";
     longDescription = ''
@@ -32,7 +57,7 @@ stdenv.mkDerivation rec {
       programming language and an implementation of Java Web Start, originally
       based on the NetX project.
     '';
-    homepage = http://icedtea.classpath.org/wiki/IcedTea-Web;
+    homepage = https://github.com/adoptopenjdk/icedtea-web;
     maintainers = with stdenv.lib.maintainers; [ wizeman ];
     platforms = stdenv.lib.platforms.linux;
   };

pkgs/development/compilers/icedtea-web/patches/0001-make-cargo-work-with-nix-build-on-linux.patch

@@ -0,0 +1,46 @@
+Subject: [PATCH] make cargo work with nix-build on linux
+
+---
+ .cargo/config            | 2 ++
+ rust-launcher/Cargo.lock | 4 ++++
+ rust-launcher/Cargo.toml | 7 ++++---
+ 3 files changed, 10 insertions(+), 3 deletions(-)
+ create mode 100644 .cargo/config
+ create mode 100644 rust-launcher/Cargo.lock
+
+diff --git a/.cargo/config b/.cargo/config
+new file mode 100644
+index 0000000..03ec4a2
+--- /dev/null
++++ b/.cargo/config
+@@ -0,0 +1,2 @@
++[net]
++offline=true
+diff --git a/rust-launcher/Cargo.lock b/rust-launcher/Cargo.lock
+new file mode 100644
+index 0000000..6055cc0
+--- /dev/null
++++ b/rust-launcher/Cargo.lock
+@@ -0,0 +1,4 @@
++[[package]]
++name = "launcher"
++version = "1.8.0"
++
+diff --git a/rust-launcher/Cargo.toml b/rust-launcher/Cargo.toml
+index 61ee308..5e6e91b 100644
+--- a/rust-launcher/Cargo.toml
++++ b/rust-launcher/Cargo.toml
+@@ -3,6 +3,7 @@ name = "launcher"
+ version = "1.8.0"
+ authors = ["https://icedtea.classpath.org/wiki/IcedTea-Web"]
+ 
+-[dependencies]
+-[target.'cfg(windows)'.dependencies]
+-dunce = "0.1.1"
++[workspace]
++# We need this too or cargo will fail.  Some files seem to be copied around and
++# cargo thinks we are in a workspace, so let's exclude everything.
++exclude = ["*"]
+-- 
+2.19.2
+