midchildan / dotfiles Goto Github PK

In the nix/home/modules/gnupg/default.nix file, there's a binding for the "pinentry-mac" variable that reads the value of pkgs.pinentry_mac, referencing the Nix package. However, I don't see anywhere else in this repository that ensures that the pinentry_mac package will be installed if we're using macOS and GnuPG is enabled.

The nix/home/news.nix file entry from December 2020 mentions a dotfiles.pinentry-mac module, but I don't see such a module present today.

Do we need to mention the pinentry_mac project somewhere, such as in the nix/home/profiles/essential.nix file, or maybe just in the nix/home/modules/gnupg/default.nix file?

It'd be soon possible to use flakes without Nix unstable.

TODO

• Wait for Nix 2.4 to reach the nixpkgs-unstable channel (check https://nixpk.gs/pr-tracker.html?pr=144197)
• Re-enable the "Upgrade Dependencies" workflow

Notes

On a related note, Home Manager updates would have to be deferred until Nix 2.4 reaches nixpkgs-unstable or nix-direnv would cease to work with flakes. This is due to Home Manager PR 2458.

Problem

The upstream tarball of xz was found to be backdoored. Fortunately, it reportedly doesn't affect the Nixpkgs package because the backdoor is only inserted into the binary on DEB and RPM based build environments. However, the user behind the backdoor has other commits in multiple high profile open source projects which haven't been further scrutinized yet.

TODO

• Temporarily downgrade Nixpkgs to a commit that doesn't include the compromised version of xz?
• Apply NixOS/nixpkgs#300028 (Progress)
• Apply NixOS/nixpkgs#300122 (Progress)
• Apply NixOS/nixpkgs#300114 (Progress)

References

• https://www.openwall.com/lists/oss-security/2024/03/29/
• https://discourse.nixos.org/t/cve-2024-3094-malicious-code-in-xz-5-6-0-and-5-6-1-tarballs/42405/31
• https://gist.github.com/thesamesam/223949d5a074ebc3dce9ee78baad9e27
• https://boehs.org/node/everything-i-know-about-the-xz-backdoor
• https://news.ycombinator.com/item?id=39865810