nordic-dev.net/nixpkgs
nordic-dev.net/nixpkgs
2
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2024-11-25 16:33:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

Use general hardening flag toggle lists

Browse Source 
The following parameters are now available:

  * hardeningDisable
    To disable specific hardening flags
  * hardeningEnable
    To enable specific hardening flags

Only the cc-wrapper supports this right now, but these may be reused by
other wrappers, builders or setup hooks.

cc-wrapper supports the following flags:

  * fortify
  * stackprotector
  * pie (disabled by default)
  * pic
  * strictoverflow
  * format
  * relro
  * bindnow
This commit is contained in:
Franz Pletz 2016-02-26 18:38:15 +01:00
parent a2e449e43e
commit aff1f4ab94
309 changed files with 366 additions and 373 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
pkgs/applications/audio/QmidiNet/default.nix
View File

@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
sha256 = "1a1pj4w74wj1gcfv4a0vzcglmr5sw0xp0y56w8rk3ig4k11xi8sa"; sha256 = "1a1pj4w74wj1gcfv4a0vzcglmr5sw0xp0y56w8rk3ig4k11xi8sa";
}; };
hardening_format = false; hardeningDisable = [ "format" ];
buildInputs = [ qt4 alsaLib libjack2 ]; buildInputs = [ qt4 alsaLib libjack2 ];

2
pkgs/applications/audio/aacgain/default.nix
View File

@ -10,7 +10,7 @@ stdenv.mkDerivation {
sha256 = "07hl432vsscqg01b6wr99qmsj4gbx0i02x4k565432y6zpfmaxm0"; sha256 = "07hl432vsscqg01b6wr99qmsj4gbx0i02x4k565432y6zpfmaxm0";
}; };
hardening_format = false; hardeningDisable = [ "format" ];
configurePhase = '' configurePhase = ''
cd mp4v2 cd mp4v2

2
pkgs/applications/audio/cdparanoia/default.nix
View File

@ -8,7 +8,7 @@ stdenv.mkDerivation rec {
sha256 = "1pv4zrajm46za0f6lv162iqffih57a8ly4pc69f7y0gfyigb8p80"; sha256 = "1pv4zrajm46za0f6lv162iqffih57a8ly4pc69f7y0gfyigb8p80";
}; };
hardening_format = false; hardeningDisable = [ "format" ];
preConfigure = "unset CC"; preConfigure = "unset CC";

2
pkgs/applications/audio/csound/default.nix
View File

@ -16,7 +16,7 @@ stdenv.mkDerivation {
enableParallelBuilding = true; enableParallelBuilding = true;
hardening_format = false; hardeningDisable = [ "format" ];
src = fetchurl { src = fetchurl {
url = mirror://sourceforge/csound/Csound6.04.tar.gz; url = mirror://sourceforge/csound/Csound6.04.tar.gz;

2
pkgs/applications/audio/freewheeling/default.nix
View File

@ -19,7 +19,7 @@ stdenv.mkDerivation {
patches = [ ./am_path_sdl.patch ./xml.patch ]; patches = [ ./am_path_sdl.patch ./xml.patch ];
hardening_format = false; hardeningDisable = [ "format" ];
meta = { meta = {
description = "A live looping instrument with JACK and MIDI support"; description = "A live looping instrument with JACK and MIDI support";

2
pkgs/applications/audio/jack-capture/default.nix
View File

@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
cp jack_capture $out/bin/ cp jack_capture $out/bin/
''; '';
hardening_format = false; hardeningDisable = [ "format" ];
meta = with stdenv.lib; { meta = with stdenv.lib; {
description = "A program for recording soundfiles with jack"; description = "A program for recording soundfiles with jack";

2
pkgs/applications/audio/lingot/default.nix
View File

@ -8,7 +8,7 @@ stdenv.mkDerivation {
sha256 = "0ygras6ndw2fylwxx86ac11pcr2y2bcfvvgiwrh92z6zncx254gc"; sha256 = "0ygras6ndw2fylwxx86ac11pcr2y2bcfvvgiwrh92z6zncx254gc";
}; };
hardening_format = false; hardeningDisable = [ "format" ];
buildInputs = [ pkgconfig intltool gtk alsaLib libglade ]; buildInputs = [ pkgconfig intltool gtk alsaLib libglade ];

2
pkgs/applications/audio/mi2ly/default.nix
View File

@ -21,7 +21,7 @@ stdenv.mkDerivation {
sourceRoot="."; sourceRoot=".";
hardening_format = false; hardeningDisable = [ "format" ];
buildPhase = "./cc"; buildPhase = "./cc";
installPhase = '' installPhase = ''

2
pkgs/applications/audio/mp3info/default.nix
View File

@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
buildInputs = [ ncurses pkgconfig gtk ]; buildInputs = [ ncurses pkgconfig gtk ];
hardening_format = false; hardeningDisable = [ "format" ];
configurePhase = configurePhase =
'' sed -i Makefile \ '' sed -i Makefile \

2
pkgs/applications/audio/mp3val/default.nix
View File

@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
install -Dv mp3val "$out/bin/mp3val" install -Dv mp3val "$out/bin/mp3val"
''; '';
hardening_fortify = false; hardeningDisable = [ "fortify" ];
meta = { meta = {
description = "A tool for validating and repairing MPEG audio streams"; description = "A tool for validating and repairing MPEG audio streams";

2
pkgs/applications/audio/mpg321/default.nix
View File

@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
sha256 = "0ki8mh76bbmdh77qsiw682dvi8y468yhbdabqwg05igmwc1wqvq5"; sha256 = "0ki8mh76bbmdh77qsiw682dvi8y468yhbdabqwg05igmwc1wqvq5";
}; };
hardening_format = false; hardeningDisable = [ "format" ];
configureFlags = [ configureFlags = [
("--enable-alsa=" + (if stdenv.isLinux then "yes" else "no")) ("--enable-alsa=" + (if stdenv.isLinux then "yes" else "no"))

3
pkgs/applications/audio/musescore/default.nix
View File

@ -13,8 +13,7 @@ stdenv.mkDerivation rec {
sha256 = "12a83v4i830gj76z5744034y1vvwzgy27mjbjp508yh9bd328yqw"; sha256 = "12a83v4i830gj76z5744034y1vvwzgy27mjbjp508yh9bd328yqw";
}; };
hardening_bindnow = false; hardeningDisable = [ "relro" "bindnow" ];
hardening_relro = false;
makeFlags = [ makeFlags = [
"PREFIX=$(out)" "PREFIX=$(out)"

2
pkgs/applications/audio/pd-plugins/cyclone/default.nix
View File

@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
buildInputs = [ puredata ]; buildInputs = [ puredata ];
hardening_format = false; hardeningDisable = [ "format" ];
patchPhase = '' patchPhase = ''
for file in `grep -r -l g_canvas.h` for file in `grep -r -l g_canvas.h`

2
pkgs/applications/audio/pd-plugins/maxlib/default.nix
View File

@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
buildInputs = [ puredata ]; buildInputs = [ puredata ];
hardening_format = false; hardeningDisable = [ "format" ];
patchPhase = '' patchPhase = ''
for i in ${puredata}/include/pd/*; do for i in ${puredata}/include/pd/*; do

2
pkgs/applications/audio/pd-plugins/mrpeach/default.nix
View File

@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
buildInputs = [ puredata ]; buildInputs = [ puredata ];
hardening_format = false; hardeningDisable = [ "format" ];
patchPhase = '' patchPhase = ''
for D in net osc for D in net osc

2
pkgs/applications/audio/rakarrack/default.nix
View File

@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
sha256 = "1rpf63pdn54c4yg13k7cb1w1c7zsvl97c4qxcpz41c8l91xd55kn"; sha256 = "1rpf63pdn54c4yg13k7cb1w1c7zsvl97c4qxcpz41c8l91xd55kn";
}; };
hardening_format = false; hardeningDisable = [ "format" ];
patches = [ ./fltk-path.patch ]; patches = [ ./fltk-path.patch ];

2
pkgs/applications/audio/zynaddsubfx/default.nix
View File

@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
buildInputs = [ alsaLib libjack2 fftw fltk13 libjpeg minixml zlib liblo ]; buildInputs = [ alsaLib libjack2 fftw fltk13 libjpeg minixml zlib liblo ];
nativeBuildInputs = [ cmake pkgconfig ]; nativeBuildInputs = [ cmake pkgconfig ];
hardening_format = false; hardeningDisable = [ "format" ];
meta = with stdenv.lib; { meta = with stdenv.lib; {
description = "High quality software synthesizer"; description = "High quality software synthesizer";

2
pkgs/applications/editors/ht/default.nix
View File

@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
ncurses ncurses
]; ];
hardening_format = false; hardeningDisable = [ "format" ];
meta = with lib; { meta = with lib; {
description = "File editor/viewer/analyzer for executables"; description = "File editor/viewer/analyzer for executables";

2
pkgs/applications/editors/leafpad/default.nix
View File

@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
buildInputs = [ intltool pkgconfig gtk ]; buildInputs = [ intltool pkgconfig gtk ];
hardening_format = false; hardeningDisable = [ "format" ];
configureFlags = [ configureFlags = [
"--enable-chooser" "--enable-chooser"

2
pkgs/applications/graphics/cinepaint/default.nix
View File

@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
libXext libXpm libXau libXxf86vm pixman libpthreadstubs fltk libXext libXpm libXau libXxf86vm pixman libpthreadstubs fltk
]; ];
hardening_format = false; hardeningDisable = [ "format" ];
patches = [ ./install.patch ]; patches = [ ./install.patch ];

2
pkgs/applications/graphics/giv/default.nix
View File

@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
sha256 = "1q0806b66ajppxbv1i71wx5d3ydc1h3hsz23m6g4g80dhiai7dly"; sha256 = "1q0806b66ajppxbv1i71wx5d3ydc1h3hsz23m6g4g80dhiai7dly";
}; };
hardening_format = false; hardeningDisable = [ "format" ];
prePatch = '' prePatch = ''
sed -i s,/usr/bin/perl,${perl}/bin/perl, doc/eperl sed -i s,/usr/bin/perl,${perl}/bin/perl, doc/eperl

2
pkgs/applications/graphics/gqview/default.nix
View File

@ -15,7 +15,7 @@ stdenv.mkDerivation {
buildInputs = [pkgconfig gtk libpng]; buildInputs = [pkgconfig gtk libpng];
hardening_format = false; hardeningDisable = [ "format" ];
meta = { meta = {
description = "A fast image viewer"; description = "A fast image viewer";

2
pkgs/applications/graphics/meshlab/default.nix
View File

@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
patches = [ ./include-unistd.diff ]; patches = [ ./include-unistd.diff ];
hardening_format = false; hardeningDisable = [ "format" ];
buildPhase = '' buildPhase = ''
mkdir -p "$out/include" mkdir -p "$out/include"

2
pkgs/applications/graphics/qtpfsgui/default.nix
View File

@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
buildInputs = [ qt4 exiv2 openexr fftwSinglePrec libtiff ]; buildInputs = [ qt4 exiv2 openexr fftwSinglePrec libtiff ];
hardening_format = false; hardeningDisable = [ "format" ];
configurePhase = '' configurePhase = ''
export CPATH="${ilmbase}/include/OpenEXR:$CPATH" export CPATH="${ilmbase}/include/OpenEXR:$CPATH"

2
pkgs/applications/graphics/tesseract/default.nix
View File

@ -38,7 +38,7 @@ stdenv.mkDerivation rec {
buildInputs = [ autoconf automake libtool leptonica libpng libtiff ]; buildInputs = [ autoconf automake libtool leptonica libpng libtiff ];
hardening_format = false; hardeningDisable = [ "format" ];
preConfigure = '' preConfigure = ''
./autogen.sh ./autogen.sh

2
pkgs/applications/graphics/xfig/default.nix
View File

@ -16,7 +16,7 @@ stdenv.mkDerivation {
nativeBuildInputs = [ imake makeWrapper ]; nativeBuildInputs = [ imake makeWrapper ];
hardening_format = false; hardeningDisable = [ "format" ];
NIX_CFLAGS_COMPILE = "-I${libXpm}/include/X11"; NIX_CFLAGS_COMPILE = "-I${libXpm}/include/X11";

2
pkgs/applications/inferno/default.nix
View File

@ -46,7 +46,7 @@ stdenv.mkDerivation rec {
--set INFERNO_ROOT "$out/share/inferno" --set INFERNO_ROOT "$out/share/inferno"
''; '';
hardening_fortify = false; hardeningDisable = [ "fortify" ];
meta = { meta = {
description = "A compact distributed operating system for building cross-platform distributed systems"; description = "A compact distributed operating system for building cross-platform distributed systems";

2
pkgs/applications/misc/epdfview/default.nix
View File

@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
buildInputs = [ pkgconfig gtk poppler ]; buildInputs = [ pkgconfig gtk poppler ];
hardening_format = false; hardeningDisable = [ "format" ];
patches = [ (fetchpatch { patches = [ (fetchpatch {
name = "epdfview-0.1.8-glib2-headers.patch"; name = "epdfview-0.1.8-glib2-headers.patch";

2
pkgs/applications/misc/gkrellm/default.nix
View File

@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
buildInputs = [gettext pkgconfig glib gtk libX11 libSM libICE]; buildInputs = [gettext pkgconfig glib gtk libX11 libSM libICE];
hardening_format = false; hardeningDisable = [ "format" ];
# Makefiles are patched to fix references to `/usr/X11R6' and to add # Makefiles are patched to fix references to `/usr/X11R6' and to add
# `-lX11' to make sure libX11's store path is in the RPATH. # `-lX11' to make sure libX11's store path is in the RPATH.

2
pkgs/applications/misc/grip/default.nix
View File

@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
buildInputs = [ gtk glib pkgconfig libgnome libgnomeui vte curl cdparanoia buildInputs = [ gtk glib pkgconfig libgnome libgnomeui vte curl cdparanoia
libid3tag ncurses libtool ]; libid3tag ncurses libtool ];
hardening_format = false; hardeningDisable = [ "format" ];
meta = { meta = {
description = "GTK+-based audio CD player/ripper"; description = "GTK+-based audio CD player/ripper";

2
pkgs/applications/misc/k2pdfopt/default.nix
View File

@ -31,7 +31,7 @@ in stdenv.mkDerivation rec {
openjpeg freetype jbig2dec djvulibre openssl ]; openjpeg freetype jbig2dec djvulibre openssl ];
NIX_LDFLAGS = "-lX11 -lXext"; NIX_LDFLAGS = "-lX11 -lXext";
hardening_format = false; hardeningDisable = [ "format" ];
k2_pa = ./k2pdfopt.patch; k2_pa = ./k2pdfopt.patch;
tess_pa = ./tesseract.patch; tess_pa = ./tesseract.patch;

2
pkgs/applications/misc/navit/default.nix
View File

@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
sha256 = "1xx62l5srfhh9cfi7n3pxj8hpcgr1rpa0hzfmbrqadzv09z36723"; sha256 = "1xx62l5srfhh9cfi7n3pxj8hpcgr1rpa0hzfmbrqadzv09z36723";
}; };
hardening_format = false; hardeningDisable = [ "format" ];
# 'cvs' is only for the autogen # 'cvs' is only for the autogen
buildInputs = [ pkgconfig gtk SDL fontconfig freetype imlib2 SDL_image mesa buildInputs = [ pkgconfig gtk SDL fontconfig freetype imlib2 SDL_image mesa

2
pkgs/applications/misc/posterazor/default.nix
View File

@ -8,7 +8,7 @@ stdenv.mkDerivation rec {
sha256 = "1dqpdk8zl0smdg4fganp3hxb943q40619qmxjlga9jhjc01s7fq5"; sha256 = "1dqpdk8zl0smdg4fganp3hxb943q40619qmxjlga9jhjc01s7fq5";
}; };
hardening_format = false; hardeningDisable = [ "format" ];
buildInputs = [ cmake unzip pkgconfig libXpm fltk13 freeimage ]; buildInputs = [ cmake unzip pkgconfig libXpm fltk13 freeimage ];

2
pkgs/applications/misc/sdcv/default.nix
View File

@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
sha256 = "1cnyv7gd1qvz8ma8545d3aq726wxrx4km7ykl97831irx5wz0r51"; sha256 = "1cnyv7gd1qvz8ma8545d3aq726wxrx4km7ykl97831irx5wz0r51";
}; };
hardening_format = false; hardeningDisable = [ "format" ];
patches = ( if stdenv.isDarwin patches = ( if stdenv.isDarwin
then [ ./sdcv.cpp.patch-darwin ./utils.hpp.patch ] then [ ./sdcv.cpp.patch-darwin ./utils.hpp.patch ]

2
pkgs/applications/misc/tasknc/default.nix
View File

@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
sha256 = "0max5schga9hmf3vfqk2ic91dr6raxglyyjcqchzla280kxn5c28"; sha256 = "0max5schga9hmf3vfqk2ic91dr6raxglyyjcqchzla280kxn5c28";
}; };
hardening_format = false; hardeningDisable = [ "format" ];
# #
# I know this is ugly, but the Makefile does strange things in this package, # I know this is ugly, but the Makefile does strange things in this package,

2
pkgs/applications/misc/vym/default.nix
View File

@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
buildInputs = [ pkgconfig qt4 ]; buildInputs = [ pkgconfig qt4 ];
hardening_format = false; hardeningDisable = [ "format" ];
configurePhase = '' configurePhase = ''
qmake PREFIX="$out" qmake PREFIX="$out"

2
pkgs/applications/misc/wordnet/default.nix
View File

@ -10,7 +10,7 @@ stdenv.mkDerivation {
buildInputs = [tcl tk xlibsWrapper makeWrapper]; buildInputs = [tcl tk xlibsWrapper makeWrapper];
hardening_format = false; hardeningDisable = [ "format" ];
patchPhase = '' patchPhase = ''
sed "13i#define USE_INTERP_RESULT 1" -i src/stubs.c sed "13i#define USE_INTERP_RESULT 1" -i src/stubs.c

2
pkgs/applications/networking/browsers/vimprobable2/default.nix
View File

@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
buildInputs = [ makeWrapper gtk libsoup libX11 perl pkgconfig webkit gsettings_desktop_schemas ]; buildInputs = [ makeWrapper gtk libsoup libX11 perl pkgconfig webkit gsettings_desktop_schemas ];
hardening_format = false; hardeningDisable = [ "format" ];
installFlags = "PREFIX=/ DESTDIR=$(out)"; installFlags = "PREFIX=/ DESTDIR=$(out)";

2
pkgs/applications/networking/browsers/w3m/default.nix
View File

@ -50,7 +50,7 @@ stdenv.mkDerivation rec {
ln -s $out/libexec/w3m/w3mimgdisplay $out/bin ln -s $out/libexec/w3m/w3mimgdisplay $out/bin
''; '';
hardening_format = false; hardeningDisable = [ "format" ];
configureFlags = "--with-ssl=${openssl} --with-gc=${boehmgc}" configureFlags = "--with-ssl=${openssl} --with-gc=${boehmgc}"
+ optionalString graphicsSupport " --enable-image=${optionalString x11Support "x11,"}fb"; + optionalString graphicsSupport " --enable-image=${optionalString x11Support "x11,"}fb";

2
pkgs/applications/networking/instant-messengers/silc-client/default.nix
View File

@ -19,7 +19,7 @@ stdenv.mkDerivation {
dontDisableStatic = true; dontDisableStatic = true;
hardening_format = false; hardeningDisable = [ "format" ];
configureFlags = "--with-ncurses=${ncurses}"; configureFlags = "--with-ncurses=${ncurses}";

2
pkgs/applications/networking/instant-messengers/vacuum/default.nix
View File

@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
configurePhase = "qmake INSTALL_PREFIX=$out -recursive vacuum.pro"; configurePhase = "qmake INSTALL_PREFIX=$out -recursive vacuum.pro";
hardening_format = false; hardeningDisable = [ "format" ];
buildInputs = [ buildInputs = [
qt4 openssl xproto libX11 libXScrnSaver scrnsaverproto xz qt4 openssl xproto libX11 libXScrnSaver scrnsaverproto xz

2
pkgs/applications/networking/iptraf-ng/default.nix
View File

@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
--localstatedir=$out/var --sbindir=$out/bin --localstatedir=$out/var --sbindir=$out/bin
''; '';
hardening_format = false; hardeningDisable = [ "format" ];
meta = { meta = {
description = "A console-based network monitoring utility (fork of iptraf)"; description = "A console-based network monitoring utility (fork of iptraf)";

3
pkgs/applications/networking/mailreaders/alpine/default.nix
View File

@ -18,8 +18,7 @@ stdenv.mkDerivation {
ncurses tcl openssl pam kerberos openldap ncurses tcl openssl pam kerberos openldap
]; ];
hardening_format = false; hardeningDisable = [ "format" "fortify" ];
hardening_fortify = false;
configureFlags = [ configureFlags = [
"--with-ssl-include-dir=${openssl}/include/openssl" "--with-ssl-include-dir=${openssl}/include/openssl"

2
pkgs/applications/networking/mailreaders/realpine/default.nix
View File

@ -18,7 +18,7 @@ stdenv.mkDerivation {
ncurses tcl openssl pam kerberos openldap ncurses tcl openssl pam kerberos openldap
]; ];
hardening_format = false; hardeningDisable = [ "format" ];
configureFlags = [ configureFlags = [
"--with-ssl-include-dir=${openssl}/include/openssl" "--with-ssl-include-dir=${openssl}/include/openssl"

2
pkgs/applications/networking/remote/ssvnc/default.nix
View File

@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
configurePhase = "makeFlags=PREFIX=$out"; configurePhase = "makeFlags=PREFIX=$out";
hardening_format = false; hardeningDisable = [ "format" ];
postInstall = '' postInstall = ''
sed -i -e 's|exec wish|exec ${tk}/bin/wish|' $out/lib/ssvnc/util/ssvnc.tcl sed -i -e 's|exec wish|exec ${tk}/bin/wish|' $out/lib/ssvnc/util/ssvnc.tcl

2
pkgs/applications/science/electronics/caneda/default.nix
View File

@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
sha256 = "dfbcac97f5a1b41ad9a63392394f37fb294cbf78c576673c9bc4a5370957b2c8"; sha256 = "dfbcac97f5a1b41ad9a63392394f37fb294cbf78c576673c9bc4a5370957b2c8";
}; };
hardening_format = false; hardeningDisable = [ "format" ];
buildInputs = [ cmake qt4 libxml2 libxslt ]; buildInputs = [ cmake qt4 libxml2 libxslt ];

2
pkgs/applications/science/geometry/drgeo/default.nix
View File

@ -5,7 +5,7 @@ stdenv.mkDerivation rec {
name = "drgeo-${version}"; name = "drgeo-${version}";
version = "1.1.0"; version = "1.1.0";
hardening_format = false; hardeningDisable = [ "format" ];
src = fetchurl { src = fetchurl {
url = "mirror://sourceforge/ofset/${name}.tar.gz"; url = "mirror://sourceforge/ofset/${name}.tar.gz";

2
pkgs/applications/science/logic/ltl2ba/default.nix
View File

@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
sha256 = "16z0gc7a9dkarwn0l6rvg5jdhw1q4qyn4501zlchy0zxqddz0sx6"; sha256 = "16z0gc7a9dkarwn0l6rvg5jdhw1q4qyn4501zlchy0zxqddz0sx6";
}; };
hardening_format = false; hardeningDisable = [ "format" ];
preConfigure = '' preConfigure = ''
substituteInPlace Makefile \ substituteInPlace Makefile \

2
pkgs/applications/science/logic/otter/default.nix
View File

@ -18,7 +18,7 @@ stdenv.mkDerivation {
inherit (s) url sha256; inherit (s) url sha256;
}; };
hardening_format = false; hardeningDisable = [ "format" ];
buildPhase = '' buildPhase = ''
find . -name Makefile | xargs sed -i -e "s@/bin/rm@$(type -P rm)@g" find . -name Makefile | xargs sed -i -e "s@/bin/rm@$(type -P rm)@g"

2
pkgs/applications/science/logic/prover9/default.nix
View File

@ -8,7 +8,7 @@ stdenv.mkDerivation {
sha256 = "1l2i3d3h5z7nnbzilb6z92r0rbx0kh6yaxn2c5qhn3000xcfsay3"; sha256 = "1l2i3d3h5z7nnbzilb6z92r0rbx0kh6yaxn2c5qhn3000xcfsay3";
}; };
hardening_format = false; hardeningDisable = [ "format" ];
patchPhase = '' patchPhase = ''
RM=$(type -tp rm) RM=$(type -tp rm)

2
pkgs/applications/science/math/cbc/default.nix
View File

@ -12,7 +12,7 @@ stdenv.mkDerivation {
enableParallelBuilding = true; enableParallelBuilding = true;
hardening_format = false; hardeningDisable = [ "format" ];
buildInputs = [ zlib bzip2 ]; buildInputs = [ zlib bzip2 ];

2
pkgs/applications/science/math/perseus/default.nix
View File

@ -5,7 +5,7 @@ stdenv.mkDerivation {
version = "4-beta"; version = "4-beta";
buildInputs = [unzip gcc48]; buildInputs = [unzip gcc48];
hardening_stackprotector = false; hardeningDisable = [ "stackprotector" ];
src = fetchurl { src = fetchurl {
url = "http://www.sas.upenn.edu/~vnanda/source/perseus_4_beta.zip"; url = "http://www.sas.upenn.edu/~vnanda/source/perseus_4_beta.zip";

2
pkgs/applications/science/math/qalculate-gtk/default.nix
View File

@ -8,7 +8,7 @@ stdenv.mkDerivation rec {
sha256 = "0b986x5yny9vrzgxlbyg80b23mxylxv2zz8ppd9svhva6vi8xsm4"; sha256 = "0b986x5yny9vrzgxlbyg80b23mxylxv2zz8ppd9svhva6vi8xsm4";
}; };
hardening_format = false; hardeningDisable = [ "format" ];
nativeBuildInputs = [ intltool pkgconfig ]; nativeBuildInputs = [ intltool pkgconfig ];
buildInputs = [ libqalculate gtk gnome2.libglade gnome2.libgnome gnome2.scrollkeeper ]; buildInputs = [ libqalculate gtk gnome2.libglade gnome2.libgnome gnome2.scrollkeeper ];

2
pkgs/applications/science/math/yacas/default.nix
View File

@ -8,7 +8,7 @@ stdenv.mkDerivation rec {
sha256 = "1dmafm3w0lm5w211nwkfzaid1rvvmgskz7k4500pjhgdczi5sd78"; sha256 = "1dmafm3w0lm5w211nwkfzaid1rvvmgskz7k4500pjhgdczi5sd78";
}; };
hardening_format = false; hardeningDisable = [ "format" ];
# Perl is only for the documentation # Perl is only for the documentation
nativeBuildInputs = [ perl ]; nativeBuildInputs = [ perl ];

2
pkgs/applications/version-management/cvs/default.nix
View File

@ -10,7 +10,7 @@ stdenv.mkDerivation {
patches = [ ./getcwd-chroot.patch ]; patches = [ ./getcwd-chroot.patch ];
hardening_format = false; hardeningDisable = [ "format" ];
preConfigure = '' preConfigure = ''
# Apply the Debian patches. # Apply the Debian patches.

2
pkgs/applications/version-management/git-and-tools/git/default.nix
View File

@ -21,7 +21,7 @@ stdenv.mkDerivation {
sha256 = "1zkbdmh5gvxalr8l1cwnirqq5raijmp2d0s36s6qabrlvqvq2yj7"; sha256 = "1zkbdmh5gvxalr8l1cwnirqq5raijmp2d0s36s6qabrlvqvq2yj7";
}; };
hardening_format = false; hardeningDisable = [ "format" ];
patches = [ patches = [
./docbook2texi.patch ./docbook2texi.patch

2
pkgs/applications/version-management/git-and-tools/qgit/default.nix
View File

@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
buildInputs = [qt libXext libX11]; buildInputs = [qt libXext libX11];
hardening_format = false; hardeningDisable = [ "format" ];
configurePhase = "qmake PREFIX=$out"; configurePhase = "qmake PREFIX=$out";

2
pkgs/applications/version-management/redmine/default.nix
View File

@ -11,7 +11,7 @@ in stdenv.mkDerivation rec {
sha256 = "0x0zwxyj4dwbk7l64s3lgny10mjf0ba8jwrbafsm4d72sncmacv0"; sha256 = "0x0zwxyj4dwbk7l64s3lgny10mjf0ba8jwrbafsm4d72sncmacv0";
}; };
hardening_format = false; hardeningDisable = [ "format" ];
# taken from redmine (2.5.1-2~bpo70+3) in debian wheezy-backports # taken from redmine (2.5.1-2~bpo70+3) in debian wheezy-backports
# needed to separate run-time and build-time directories # needed to separate run-time and build-time directories

3
pkgs/applications/video/aegisub/default.nix
View File

@ -43,8 +43,7 @@ stdenv.mkDerivation rec {
enableParallelBuilding = true; enableParallelBuilding = true;
hardening_bindnow = false; hardeningDisable = [ "bindnow" "relro" ];
hardening_relro = false;
postInstall = "ln -s $out/bin/aegisub-* $out/bin/aegisub"; postInstall = "ln -s $out/bin/aegisub-* $out/bin/aegisub";

4
pkgs/applications/virtualization/OVMF/default.nix
View File

@ -17,9 +17,7 @@ stdenv.mkDerivation (edk2.setup "OvmfPkg/OvmfPkg${targetArch}.dsc" {
# TODO: properly include openssl for secureBoot # TODO: properly include openssl for secureBoot
buildInputs = [nasm iasl] ++ stdenv.lib.optionals (secureBoot == true) [ openssl ]; buildInputs = [nasm iasl] ++ stdenv.lib.optionals (secureBoot == true) [ openssl ];
hardening_stackprotector = false; hardeningDisable = [ "stackprotector" "pic" "fortify" ];
hardening_pic = false;
hardening_fortify = false;
unpackPhase = '' unpackPhase = ''
for file in \ for file in \

2
pkgs/applications/virtualization/bochs/default.nix
View File

@ -146,7 +146,7 @@ stdenv.mkDerivation rec {
NIX_CFLAGS_COMPILE="-I${gtk}/include/gtk-2.0/ -I${libtool}/include/"; NIX_CFLAGS_COMPILE="-I${gtk}/include/gtk-2.0/ -I${libtool}/include/";
NIX_LDFLAGS="-L${libtool}/lib"; NIX_LDFLAGS="-L${libtool}/lib";
hardening_format = false; hardeningDisable = [ "format" ];
meta = with stdenv.lib; { meta = with stdenv.lib; {
description = "An open-source IA-32 (x86) PC emulator"; description = "An open-source IA-32 (x86) PC emulator";

2
pkgs/applications/virtualization/cbfstool/default.nix
View File

@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
buildInputs = [ iasl flex bison ]; buildInputs = [ iasl flex bison ];
hardening_fortify = false; hardeningDisable = [ "fortify" ];
buildPhase = '' buildPhase = ''
export LEX=${flex}/bin/flex export LEX=${flex}/bin/flex

3
pkgs/applications/virtualization/seabios/default.nix
View File

@ -12,8 +12,7 @@ stdenv.mkDerivation rec {
buildInputs = [ iasl python ]; buildInputs = [ iasl python ];
hardening_pic = false; hardeningDisable = [ "pic" "stackprotector" ];
hardening_stackprotector = false;
configurePhase = '' configurePhase = ''
# build SeaBIOS for CSM # build SeaBIOS for CSM

2
pkgs/applications/virtualization/virtualbox/guest-additions/default.nix
View File

@ -17,7 +17,7 @@ stdenv.mkDerivation {
KERN_DIR = "${kernel.dev}/lib/modules/*/build"; KERN_DIR = "${kernel.dev}/lib/modules/*/build";
hardening_pic = false; hardeningDisable = [ "pic" ];
buildInputs = [ patchelf cdrkit makeWrapper dbus ]; buildInputs = [ patchelf cdrkit makeWrapper dbus ];

4
pkgs/applications/virtualization/xen/generic.nix
View File

@ -75,9 +75,7 @@ stdenv.mkDerivation {
pythonPath = [ pythonPackages.curses ]; pythonPath = [ pythonPackages.curses ];
hardening_stackprotector = false; hardeningDisable = [ "stackprotector" "fortify" "pic" ];
hardening_fortify = false;
hardening_pic = false;
patches = stdenv.lib.optionals ((xenserverPatched == false) && (builtins.hasAttr "xenPatches" xenConfig)) xenConfig.xenPatches; patches = stdenv.lib.optionals ((xenserverPatched == false) && (builtins.hasAttr "xenPatches" xenConfig)) xenConfig.xenPatches;

2
pkgs/applications/window-managers/stalonetray/default.nix
View File

@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
buildInputs = [ libX11 xproto ]; buildInputs = [ libX11 xproto ];
hardening_format = false; hardeningDisable = [ "format" ];
meta = with stdenv.lib; { meta = with stdenv.lib; {
description = "Stand alone tray"; description = "Stand alone tray";

41
pkgs/build-support/cc-wrapper/add-hardening Normal file
View File

@ -0,0 +1,41 @@
hardeningFlags=(fortify stackprotector pic strictoverflow format relro bindnow)
hardeningFlags+=("${hardeningEnable[@]}")
hardeningCFlags=()
hardeningLDFlags=()
if [[ ! $hardeningDisable == "all" ]]; then
for flag in "${hardeningFlags[@]}"
do
if [[ ! "$hardeningDisable" =~ "$flag" ]]; then
case $flag in
fortify)
hardeningCFlags+=('-O2' '-D_FORTIFY_SOURCE=2')
;;
stackprotector)
hardeningCFlags+=('-fstack-protector-strong')
;;
pie)
hardeningCFlags+=('-fPIE' '-pie')
;;
pic)
hardeningCFlags+=('-fPIC')
;;
strictoverflow)
hardeningCFlags+=('-fno-strict-overflow')
;;
format)
hardeningCFlags+=('-Wformat' '-Wformat-security' '-Werror=format-security')
;;
relro)
hardeningLDFlags+=('-z relro')
;;
bindnow)
hardeningLDFlags+=('-z now')
;;
*)
echo "Hardening flag unknown: $flag"
;;
esac
fi
done
fi

10
pkgs/build-support/cc-wrapper/cc-wrapper.sh
View File

@ -56,7 +56,6 @@ if [ "$nonFlagArgs" = 0 ]; then
dontLink=1 dontLink=1
fi fi
# Optionally filter out paths not refering to the store. # Optionally filter out paths not refering to the store.
params=("$@") params=("$@")
if [ "$NIX_ENFORCE_PURITY" = 1 -a -n "$NIX_STORE" ]; then if [ "$NIX_ENFORCE_PURITY" = 1 -a -n "$NIX_STORE" ]; then
@ -90,16 +89,17 @@ if [[ "@prog@" = *++ ]]; then
fi fi
fi fi
# Add the flags for the C compiler proper. source @out@/nix-support/add-hardening.sh
extraAfter=($NIX_CFLAGS_COMPILE)
extraBefore=()
# Add the flags for the C compiler proper.
extraAfter=($NIX_CFLAGS_COMPILE ${hardeningCFlags[@]})
extraBefore=()
if [ "$dontLink" != 1 ]; then if [ "$dontLink" != 1 ]; then
# Add the flags that should only be passed to the compiler when # Add the flags that should only be passed to the compiler when
# linking. # linking.
extraAfter+=($NIX_CFLAGS_LINK) extraAfter+=($NIX_CFLAGS_LINK ${hardeningLDFlags[@]})
# Add the flags that should be passed to the linker (and prevent # Add the flags that should be passed to the linker (and prevent
# `ld-wrapper' from adding NIX_LDFLAGS again). # `ld-wrapper' from adding NIX_LDFLAGS again).

1
pkgs/build-support/cc-wrapper/default.nix
View File

@ -234,6 +234,7 @@ stdenv.mkDerivation {
rm $out/nix-support/setup-hook.tmp rm $out/nix-support/setup-hook.tmp
substituteAll ${./add-flags} $out/nix-support/add-flags.sh substituteAll ${./add-flags} $out/nix-support/add-flags.sh
cp -p ${./add-hardening} $out/nix-support/add-hardening.sh
cp -p ${./utils.sh} $out/nix-support/utils.sh cp -p ${./utils.sh} $out/nix-support/utils.sh
'' ''
+ extraBuildCommands; + extraBuildCommands;

5
pkgs/build-support/cc-wrapper/ld-wrapper.sh
View File

@ -47,8 +47,9 @@ if [ "$NIX_ENFORCE_PURITY" = 1 -a -n "$NIX_STORE" \
params=("${rest[@]}") params=("${rest[@]}")
fi fi
source @out@/nix-support/add-hardening.sh
extra=() extra=(${hardeningLDFlags[@]})
extraBefore=() extraBefore=()
if [ -z "$NIX_LDFLAGS_SET" ]; then if [ -z "$NIX_LDFLAGS_SET" ]; then
@ -56,7 +57,7 @@ if [ -z "$NIX_LDFLAGS_SET" ]; then
extraBefore+=($NIX_LDFLAGS_BEFORE) extraBefore+=($NIX_LDFLAGS_BEFORE)
fi fi
extra+=($NIX_LDFLAGS_AFTER) extra+=($NIX_LDFLAGS_AFTER $NIX_LDFLAGS_HARDEN)
# Add all used dynamic libraries to the rpath. # Add all used dynamic libraries to the rpath.

2
pkgs/desktops/gnome-2/platform/libgnomecups/default.nix
View File

@ -8,7 +8,7 @@ stdenv.mkDerivation rec {
sha256 = "0a8xdaxzz2wc0n1fjcav65093gixzyac3948l8cxx1mk884yhc71"; sha256 = "0a8xdaxzz2wc0n1fjcav65093gixzyac3948l8cxx1mk884yhc71";
}; };
hardening_format = false; hardeningDisable = [ "format" ];
patches = [ ./glib.patch ./cups_1.6.patch ]; patches = [ ./glib.patch ./cups_1.6.patch ];

2
pkgs/desktops/gnome-2/platform/libgtkhtml/default.nix
View File

@ -11,5 +11,5 @@ stdenv.mkDerivation {
buildInputs = [ pkgconfig gtk gettext ]; buildInputs = [ pkgconfig gtk gettext ];
propagatedBuildInputs = [ libxml2 ]; propagatedBuildInputs = [ libxml2 ];
hardening_format = false; hardeningDisable = [ "format" ];
} }

2
pkgs/desktops/gnome-3/3.18/misc/libgda/default.nix
View File

@ -17,7 +17,7 @@ in stdenv.mkDerivation rec {
"--enable-gi-system-install=no" "--enable-gi-system-install=no"
]; ];
hardening_format = false; hardeningDisable = [ "format" ];
enableParallelBuilding = true; enableParallelBuilding = true;

2
pkgs/desktops/kde-4.14/kdebindings/qtruby.nix
View File

@ -8,7 +8,7 @@ kde {
nativeBuildInputs = [ cmake ]; nativeBuildInputs = [ cmake ];
hardening_all = false; hardeningDisable = [ "all" ];
# The patch is not ready for upstream submmission. # The patch is not ready for upstream submmission.
# I should add an option() instead. # I should add an option() instead.

2
pkgs/desktops/xfce/panel-plugins/xfce4-verve-plugin.nix
View File

@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
buildInputs = [ pkgconfig intltool glib exo pcre libxfce4util libxfce4ui xfce4panel xfconf gtk ]; buildInputs = [ pkgconfig intltool glib exo pcre libxfce4util libxfce4ui xfce4panel xfconf gtk ];
hardening_format = false; hardeningDisable = [ "format" ];
meta = { meta = {
homepage = "http://goodies.xfce.org/projects/panel-plugins/${p_name}"; homepage = "http://goodies.xfce.org/projects/panel-plugins/${p_name}";

3
pkgs/development/compilers/clean/default.nix
View File

@ -14,8 +14,7 @@ stdenv.mkDerivation rec {
}) })
else throw "Architecture not supported"; else throw "Architecture not supported";
hardening_format = false; hardeningDisable = [ "format" "pic" ];
hardening_pic = false;
# clm uses timestamps of dcl, icl, abc and o files to decide what must be rebuild # clm uses timestamps of dcl, icl, abc and o files to decide what must be rebuild
# and for chroot builds all of the library files will have equal timestamps. This # and for chroot builds all of the library files will have equal timestamps. This

2
pkgs/development/compilers/dev86/default.nix
View File

@ -8,7 +8,7 @@ stdenv.mkDerivation {
sha256 = "33398b87ca85e2b69e4062cf59f2f7354af46da5edcba036c6f97bae17b8d00e"; sha256 = "33398b87ca85e2b69e4062cf59f2f7354af46da5edcba036c6f97bae17b8d00e";
}; };
hardening_format = false; hardeningDisable = [ "format" ];
makeFlags = "PREFIX=$(out)"; makeFlags = "PREFIX=$(out)";

2
pkgs/development/compilers/ecl/default.nix
View File

@ -38,7 +38,7 @@ stdenv.mkDerivation {
"--enable-unicode") "--enable-unicode")
; ;
hardening_format = false; hardeningDisable = [ "format" ];
postInstall = '' postInstall = ''
sed -e 's/@[-a-zA-Z_]*@//g' -i $out/bin/ecl-config sed -e 's/@[-a-zA-Z_]*@//g' -i $out/bin/ecl-config

3
pkgs/development/compilers/edk2/default.nix
View File

@ -22,8 +22,7 @@ edk2 = stdenv.mkDerivation {
makeFlags = "-C BaseTools"; makeFlags = "-C BaseTools";
hardening_fortify = false; hardeningDisable = [ "format" "fortify" ];
hardening_format = false;
installPhase = '' installPhase = ''
mkdir -vp $out mkdir -vp $out

3
pkgs/development/compilers/gcc/4.3/default.nix
View File

@ -95,8 +95,7 @@ stdenv.mkDerivation ({
++ (optionals langVhdl [gnat]) ++ (optionals langVhdl [gnat])
; ;
hardening_format = false; hardeningDisable = [ "format" "stackprotector" ];
hardening_stackprotector = false;
configureFlags = " configureFlags = "
${if enableMultilib then "" else "--disable-multilib"} ${if enableMultilib then "" else "--disable-multilib"}

2
pkgs/development/compilers/gcc/4.4/default.nix
View File

@ -103,7 +103,7 @@ stdenv.mkDerivation ({
inherit langC langCC langFortran langJava langAda; inherit langC langCC langFortran langJava langAda;
}; };
hardening_format = false; hardeningDisable = [ "format" ];
patches = patches =
[ ./pass-cxxcpp.patch [ ./pass-cxxcpp.patch

3
pkgs/development/compilers/gcc/4.5/default.nix
View File

@ -134,8 +134,7 @@ stdenv.mkDerivation ({
inherit langC langCC langFortran langJava langAda; inherit langC langCC langFortran langJava langAda;
}; };
hardening_format = false; hardeningDisable = [ "format" ] ++ optional (name != "gnat") "all";
hardening_all = name != "gnat";
patches = patches =
[ ] [ ]

2
pkgs/development/compilers/gcc/4.6/default.nix
View File

@ -189,7 +189,7 @@ stdenv.mkDerivation ({
inherit patches enableMultilib; inherit patches enableMultilib;
hardening_format = false; hardeningDisable = [ "format" ];
postPatch = postPatch =
if (stdenv.isGNU if (stdenv.isGNU

2
pkgs/development/compilers/gcc/4.8/default.nix
View File

@ -218,7 +218,7 @@ stdenv.mkDerivation ({
inherit patches; inherit patches;
hardening_format = false; hardeningDisable = [ "format" ];
postPatch = postPatch =
if (stdenv.isGNU if (stdenv.isGNU

5
pkgs/development/compilers/gcc/4.9/default.nix
View File

@ -220,9 +220,8 @@ stdenv.mkDerivation ({
inherit patches; inherit patches;
# FIXME needs gcc 4.9 in bootstrap tools # FIXME stackprotector needs gcc 4.9 in bootstrap tools
hardening_stackprotector = false; hardeningDisable = [ "format" "stackprotector" ];
hardening_format = false;
postPatch = postPatch =
if (stdenv.isGNU if (stdenv.isGNU

2
pkgs/development/compilers/gcc/5/default.nix
View File

@ -216,7 +216,7 @@ stdenv.mkDerivation ({
sha256 = "1ny4smkp5bzs3cp8ss7pl6lk8yss0d9m4av1mvdp72r1x695akxq"; sha256 = "1ny4smkp5bzs3cp8ss7pl6lk8yss0d9m4av1mvdp72r1x695akxq";
}; };
hardening_format = false; hardeningDisable = [ "format" ];
inherit patches; inherit patches;

2
pkgs/development/compilers/gcl/default.nix
View File

@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
"--enable-ansi" "--enable-ansi"
]; ];
hardening_pic = false; hardeningDisable = [ "pic" ];
meta = { meta = {
description = "GNU Common Lisp compiler working via GCC"; description = "GNU Common Lisp compiler working via GCC";

2
pkgs/development/compilers/ghc/6.10.4.nix
View File

@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
buildInputs = [ghc libedit perl gmp]; buildInputs = [ghc libedit perl gmp];
hardening_format = false; hardeningDisable = [ "format" ];
configureFlags = [ configureFlags = [
"--with-gmp-libraries=${gmp}/lib" "--with-gmp-libraries=${gmp}/lib"

2
pkgs/development/compilers/go/1.4.nix
View File

@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
buildInputs = [ pcre ]; buildInputs = [ pcre ];
propagatedBuildInputs = lib.optional stdenv.isDarwin Security; propagatedBuildInputs = lib.optional stdenv.isDarwin Security;
hardening_all = false; hardeningDisable = [ "all" ];
# I'm not sure what go wants from its 'src', but the go installation manual # I'm not sure what go wants from its 'src', but the go installation manual
# describes an installation keeping the src. # describes an installation keeping the src.

2
pkgs/development/compilers/go/1.5.nix
View File

@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
Security Foundation Security Foundation
]; ];
hardening_all = false; hardeningDisable = [ "all" ];
# I'm not sure what go wants from its 'src', but the go installation manual # I'm not sure what go wants from its 'src', but the go installation manual
# describes an installation keeping the src. # describes an installation keeping the src.

2
pkgs/development/compilers/go/1.6.nix
View File

@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
Security Foundation Security Foundation
]; ];
hardening_all = false; hardeningDisable = [ "all" ];
# I'm not sure what go wants from its 'src', but the go installation manual # I'm not sure what go wants from its 'src', but the go installation manual
# describes an installation keeping the src. # describes an installation keeping the src.

2
pkgs/development/compilers/mkcl/default.nix
View File

@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
buildInputs = [ makeWrapper ]; buildInputs = [ makeWrapper ];
propagatedBuildInputs = [ gmp ]; propagatedBuildInputs = [ gmp ];
hardening_format = false; hardeningDisable = [ "format" ];
configureFlags = [ configureFlags = [
"GMP_CFLAGS=-I${gmp}/include" "GMP_CFLAGS=-I${gmp}/include"

2
pkgs/development/compilers/squeak/default.nix
View File

@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
enableParallelBuilding = true; enableParallelBuilding = true;
hardening_format = false; hardeningDisable = [ "format" ];
meta = with stdenv.lib; { meta = with stdenv.lib; {
description = "Smalltalk programming language and environment"; description = "Smalltalk programming language and environment";

2
pkgs/development/compilers/swi-prolog/default.nix
View File

@ -17,7 +17,7 @@ stdenv.mkDerivation {
buildInputs = [ gmp readline openssl libjpeg unixODBC libXinerama buildInputs = [ gmp readline openssl libjpeg unixODBC libXinerama
libXft libXpm libSM libXt zlib freetype pkgconfig fontconfig ]; libXft libXpm libSM libXt zlib freetype pkgconfig fontconfig ];
hardening_format = false; hardeningDisable = [ "format" ];
configureFlags = "--with-world --enable-gmp --enable-shared"; configureFlags = "--with-world --enable-gmp --enable-shared";

2
pkgs/development/compilers/teyjus/default.nix
View File

@ -12,7 +12,7 @@ stdenv.mkDerivation {
buildInputs = [ omake ocaml flex bison ]; buildInputs = [ omake ocaml flex bison ];
hardening_format = false; hardeningDisable = [ "format" ];
buildPhase = "omake all"; buildPhase = "omake all";

12
pkgs/development/haskell-modules/configuration-common.nix
View File

@ -41,11 +41,9 @@ self: super: {
options_1_2 = dontCheck super.options_1_2; options_1_2 = dontCheck super.options_1_2;
options = dontCheck super.options; options = dontCheck super.options;
statistics = dontCheck super.statistics; statistics = dontCheck super.statistics;
c2hs = pkgs.lib.overrideDerivation (dontCheck super.c2hs) (drv: { c2hs = dontCheck super.c2hs;
hardening_format = false; epanet-haskell = super.epanet-haskell.overrideDerivation (drv: {
}); hardeningDisable = [ "format" ];
epanet-haskell = pkgs.lib.overrideDerivation super.epanet-haskell (drv: {
hardening_format = false;
}); });
# The package doesn't compile with ruby 1.9, which is our default at the moment. # The package doesn't compile with ruby 1.9, which is our default at the moment.
@ -244,9 +242,7 @@ self: super: {
gio_0_13_0_3 = addPkgconfigDepend super.gio_0_13_0_3 pkgs.glib; gio_0_13_0_3 = addPkgconfigDepend super.gio_0_13_0_3 pkgs.glib;
gio_0_13_0_4 = addPkgconfigDepend super.gio_0_13_0_4 pkgs.glib; gio_0_13_0_4 = addPkgconfigDepend super.gio_0_13_0_4 pkgs.glib;
gio_0_13_1_0 = addPkgconfigDepend super.gio_0_13_1_0 pkgs.glib; gio_0_13_1_0 = addPkgconfigDepend super.gio_0_13_1_0 pkgs.glib;
glib = pkgs.lib.overrideDerivation (addPkgconfigDepend super.glib pkgs.glib) (drv: { glib = addPkgconfigDepend super.glib pkgs.glib;
hardening_fortify = false;
});
gtk3 = super.gtk3.override { inherit (pkgs) gtk3; }; gtk3 = super.gtk3.override { inherit (pkgs) gtk3; };
gtk = addPkgconfigDepend super.gtk pkgs.gtk; gtk = addPkgconfigDepend super.gtk pkgs.gtk;
gtksourceview2 = (addPkgconfigDepend super.gtksourceview2 pkgs.gtk2).override { inherit (pkgs.gnome2) gtksourceview; }; gtksourceview2 = (addPkgconfigDepend super.gtksourceview2 pkgs.gtk2).override { inherit (pkgs.gnome2) gtksourceview; };

2
pkgs/development/interpreters/clisp/2.44.1.nix
View File

@ -45,7 +45,7 @@ stdenv.mkDerivation rec {
NIX_CFLAGS_COMPILE="-O0"; NIX_CFLAGS_COMPILE="-O0";
hardening_format = false; hardeningDisable = [ "format" ];
# TODO : make mod-check fails # TODO : make mod-check fails
doCheck = false; doCheck = false;

2
pkgs/development/interpreters/erlang/R14.nix
View File

@ -22,7 +22,7 @@ stdenv.mkDerivation {
configureFlags = "--with-ssl=${openssl}"; configureFlags = "--with-ssl=${openssl}";
hardening_format = false; hardeningDisable = [ "format" ];
postInstall = let postInstall = let
manpages = fetchurl { manpages = fetchurl {

2
pkgs/development/interpreters/lush/default.nix
View File

@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
intltool gettext zlib intltool gettext zlib
]; ];
hardening_pic = false; hardeningDisable = [ "pic" ];
NIX_LDFLAGS=" -lz "; NIX_LDFLAGS=" -lz ";

2
pkgs/development/interpreters/perl/default.nix
View File

@ -72,7 +72,7 @@ let
enableParallelBuilding = true; enableParallelBuilding = true;
# FIXME needs gcc 4.9 in bootstrap tools # FIXME needs gcc 4.9 in bootstrap tools
hardening_stackprotector = false; hardeningDisable = [ "stackprotector" ];
preConfigure = preConfigure =
'' ''

Some files were not shown because too many files have changed in this diff Show More