Merge pull request #111330 from dotlambda/libav-insecure

libav: mark as insecure

20 files changed, 63 insertions, 96 deletions

diff --git a/pkgs/applications/audio/guitarix/default.nix b/pkgs/applications/audio/guitarix/default.nix
index 69e427dd96c..7f41fa6c5f9 100644
--- a/pkgs/applications/audio/guitarix/default.nix
+++ b/pkgs/applications/audio/guitarix/default.nix
@@ -17,7 +17,6 @@
 , hicolor-icon-theme
 , intltool
 , ladspaH
-, libav
 , libjack2
 , libsndfile
 , lilv
@@ -74,7 +73,6 @@ stdenv.mkDerivation rec {
     gtk3
     gtkmm3
     ladspaH
-    libav
     libjack2
     libsndfile
     lilv
diff --git a/pkgs/applications/audio/keyfinder-cli/default.nix b/pkgs/applications/audio/keyfinder-cli/default.nix
index d6e96d90834..62db3d79690 100644
--- a/pkgs/applications/audio/keyfinder-cli/default.nix
+++ b/pkgs/applications/audio/keyfinder-cli/default.nix
@@ -1,17 +1,17 @@
-{ lib, stdenv, fetchFromGitHub, libav, libkeyfinder }:
+{ lib, stdenv, fetchFromGitHub, ffmpeg, libkeyfinder }:
 
 stdenv.mkDerivation rec {
   pname = "keyfinder-cli";
-  version = "2015-09-13";
+  version = "1.1.1";
 
   src = fetchFromGitHub {
     repo = "keyfinder-cli";
     owner = "EvanPurkhiser";
-    rev = "8579282f15ab3ebad937fed398ec5c88843be03d";
-    sha256 = "0jylykigxmsqvdny265k58vpxa4cqs1hq2f7mph1nl3apfx2shrh";
+    rev = "v${version}";
+    sha256 = "1mlcygbj3gqii3cz8jd6ks1lz612i4jp0343qjg293xm39fg47ns";
   };
 
-  buildInputs = [ libav libkeyfinder ];
+  buildInputs = [ ffmpeg libkeyfinder ];
 
   makeFlags = [ "PREFIX=$(out)" ];
 
diff --git a/pkgs/applications/audio/keyfinder/default.nix b/pkgs/applications/audio/keyfinder/default.nix
index 19433466ec3..80cd8f4d9a0 100644
--- a/pkgs/applications/audio/keyfinder/default.nix
+++ b/pkgs/applications/audio/keyfinder/default.nix
@@ -1,12 +1,12 @@
-{ lib, stdenv, fetchFromGitHub, libav_0_8, libkeyfinder, qtbase, qtxmlpatterns, qmake, taglib }:
+{ lib, mkDerivation, fetchFromGitHub, libav_0_8, libkeyfinder, qtbase, qtxmlpatterns, qmake, taglib }:
 
-stdenv.mkDerivation rec {
+mkDerivation rec {
   pname = "keyfinder";
-  version = "2.2";
+  version = "2.4";
 
   src = fetchFromGitHub {
-    sha256 = "0vjszk1h8vj2qycgbffzy6k7amg75jlvlnzwaqhz9nll2pcvw0zl";
-    rev = version;
+    sha256 = "11yhdwan7bz8nn8vxr54drckyrnlxynhx5s981i475bbccg8g7ls";
+    rev = "530034d6fe86d185f6a68b817f8db5f552f065d7"; # tag is missing
     repo = "is_KeyFinder";
     owner = "ibsh";
   };
diff --git a/pkgs/applications/audio/musly/default.nix b/pkgs/applications/audio/musly/default.nix
index 1e8d29d3770..0d10b55d329 100644
--- a/pkgs/applications/audio/musly/default.nix
+++ b/pkgs/applications/audio/musly/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, cmake, eigen, libav }:
+{ lib, stdenv, fetchFromGitHub, cmake, eigen, ffmpeg }:
 stdenv.mkDerivation {
   pname = "musly";
   version = "unstable-2017-04-26";
@@ -9,7 +9,7 @@ stdenv.mkDerivation {
     sha256 = "1q42wvdwy2pac7bhfraqqj2czw7w2m33ms3ifjl8phm7d87i8825";
   };
   nativeBuildInputs = [ cmake ];
-  buildInputs = [ eigen (libav.override { vaapiSupport = stdenv.isLinux; }) ];
+  buildInputs = [ eigen ffmpeg ];
   fixupPhase = if stdenv.isDarwin then ''
     install_name_tool -change libmusly.dylib $out/lib/libmusly.dylib $out/bin/musly
     install_name_tool -change libmusly_resample.dylib $out/lib/libmusly_resample.dylib $out/bin/musly
diff --git a/pkgs/applications/office/jabref/default.nix b/pkgs/applications/office/jabref/default.nix
index 3974e75a2f7..4eb39f4d1f8 100644
--- a/pkgs/applications/office/jabref/default.nix
+++ b/pkgs/applications/office/jabref/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchurl, makeWrapper, makeDesktopItem, wrapGAppsHook, gtk3, gsettings-desktop-schemas
-, zlib , libX11, libXext, libXi, libXrender, libXtst, libGL, alsaLib, libav, cairo, freetype, pango, gdk-pixbuf, glib }:
+, zlib , libX11, libXext, libXi, libXrender, libXtst, libGL, alsaLib, cairo, freetype, pango, gdk-pixbuf, glib }:
 
 stdenv.mkDerivation rec {
   version = "5.1";
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ makeWrapper wrapGAppsHook ];
   buildInputs = [ gsettings-desktop-schemas ] ++ systemLibs;
 
-  systemLibs = [ gtk3 zlib libX11 libXext libXi libXrender libXtst libGL alsaLib libav cairo freetype pango gdk-pixbuf glib ];
+  systemLibs = [ gtk3 zlib libX11 libXext libXi libXrender libXtst libGL alsaLib cairo freetype pango gdk-pixbuf glib ];
   systemLibPaths = lib.makeLibraryPath systemLibs;
 
   installPhase = ''
diff --git a/pkgs/applications/radio/sdrangel/default.nix b/pkgs/applications/radio/sdrangel/default.nix
index b4a6cb775cc..6f723971c8e 100644
--- a/pkgs/applications/radio/sdrangel/default.nix
+++ b/pkgs/applications/radio/sdrangel/default.nix
@@ -9,7 +9,7 @@ fftwFloat,
 glew,
 hackrf,
 lib,
-libav,
+ffmpeg,
 libiio,
 libopus,
 libpulseaudio,
@@ -44,7 +44,7 @@ mkDerivation rec {
 
   nativeBuildInputs = [ cmake pkg-config ];
   buildInputs = [
-    glew opencv3 libusb1 boost libopus limesuite libav libiio libpulseaudio
+    glew opencv3 libusb1 boost libopus limesuite ffmpeg libiio libpulseaudio
     qtbase qtwebsockets qtmultimedia rtl-sdr airspy hackrf
     fftwFloat codec2 cm256cc serialdv qtserialport
     libbladeRF uhd soapysdr-with-plugins
diff --git a/pkgs/build-support/appimage/default.nix b/pkgs/build-support/appimage/default.nix
index 6824b8215e5..2a13d107bd0 100644
--- a/pkgs/build-support/appimage/default.nix
+++ b/pkgs/build-support/appimage/default.nix
@@ -121,7 +121,6 @@ rec {
       libusb1
       udev
       dbus-glib
-      libav
       atk
       at-spi2-atk
       libudev0-shim
diff --git a/pkgs/development/compilers/graalvm/enterprise-edition.nix b/pkgs/development/compilers/graalvm/enterprise-edition.nix
index c9c5206f6da..eb3045d52ad 100644
--- a/pkgs/development/compilers/graalvm/enterprise-edition.nix
+++ b/pkgs/development/compilers/graalvm/enterprise-edition.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, requireFile, perl, unzip, glibc, zlib, bzip2, gdk-pixbuf, xorg, glib, fontconfig, freetype, cairo, pango, gtk3, gtk2, ffmpeg, libGL, atk, alsaLib, libav_0_8, setJavaClassPath }:
+{ lib, stdenv, requireFile, perl, unzip, glibc, zlib, bzip2, gdk-pixbuf, xorg, glib, fontconfig, freetype, cairo, pango, gtk3, gtk2, ffmpeg, libGL, atk, alsaLib, setJavaClassPath }:
 
 let
   common = javaVersion:
diff --git a/pkgs/development/compilers/zulu/8.nix b/pkgs/development/compilers/zulu/8.nix
index e81cc412428..2bc90539be1 100644
--- a/pkgs/development/compilers/zulu/8.nix
+++ b/pkgs/development/compilers/zulu/8.nix
@@ -1,5 +1,5 @@
 { stdenv, lib, fetchurl, unzip, makeWrapper, setJavaClassPath
-, zulu, glib, libxml2, libav_0_8, ffmpeg_3, libxslt, libGL, alsaLib
+, zulu, glib, libxml2, ffmpeg_3, libxslt, libGL, alsaLib
 , fontconfig, freetype, pango, gtk2, cairo, gdk-pixbuf, atk, xorg
 , swingSupport ? true }:
 
@@ -15,7 +15,7 @@ let
   extension = if stdenv.isDarwin then "zip" else "tar.gz";
 
   libraries = [
-    stdenv.cc.libc glib libxml2 libav_0_8 ffmpeg_3 libxslt libGL
+    stdenv.cc.libc glib libxml2 ffmpeg_3 libxslt libGL
     xorg.libXxf86vm alsaLib fontconfig freetype pango
     gtk2 cairo gdk-pixbuf atk
   ] ++ (lib.optionals swingSupport (with xorg; [
diff --git a/pkgs/development/compilers/zulu/default.nix b/pkgs/development/compilers/zulu/default.nix
index 63b95465c27..cbfa9997b8d 100644
--- a/pkgs/development/compilers/zulu/default.nix
+++ b/pkgs/development/compilers/zulu/default.nix
@@ -1,5 +1,5 @@
 { stdenv, lib, fetchurl, unzip, makeWrapper, setJavaClassPath
-, zulu, glib, libxml2, libav_0_8, ffmpeg_3, libxslt, libGL, alsaLib
+, zulu, glib, libxml2, ffmpeg_3, libxslt, libGL, alsaLib
 , fontconfig, freetype, pango, gtk2, cairo, gdk-pixbuf, atk, xorg, zlib
 , swingSupport ? true }:
 
@@ -15,7 +15,7 @@ let
   extension = if stdenv.isDarwin then "zip" else "tar.gz";
 
   libraries = [
-    stdenv.cc.libc glib libxml2 libav_0_8 ffmpeg_3 libxslt libGL
+    stdenv.cc.libc glib libxml2 ffmpeg_3 libxslt libGL
     xorg.libXxf86vm alsaLib fontconfig freetype pango
     gtk2 cairo gdk-pixbuf atk zlib
   ] ++ (lib.optionals swingSupport (with xorg; [
diff --git a/pkgs/development/libraries/libav/default.nix b/pkgs/development/libraries/libav/default.nix
index 93d6e0d209c..ad95edb68cb 100644
--- a/pkgs/development/libraries/libav/default.nix
+++ b/pkgs/development/libraries/libav/default.nix
@@ -127,6 +127,10 @@ let
       license = with licenses; if enableUnfree then unfree #ToDo: redistributable or not?
         else if enableGPL then gpl2Plus else lgpl21Plus;
       platforms = with platforms; linux ++ darwin;
+      knownVulnerabilities =
+        lib.optional (lib.versionOlder version "12.1") "CVE-2017-9051"
+        ++ lib.optionals (lib.versionOlder version "12.3") [ "CVE-2018-5684" "CVE-2018-5766" ]
+        ++ lib.optionals (lib.versionOlder version "12.4") [ "CVE-2019-9717" "CVE-2019-9720" ];
     };
   }; # libavFun
 
diff --git a/pkgs/development/libraries/libgroove/default.nix b/pkgs/development/libraries/libgroove/default.nix
index 963bf722b2a..f14524df0dc 100644
--- a/pkgs/development/libraries/libgroove/default.nix
+++ b/pkgs/development/libraries/libgroove/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, cmake, libav, SDL2, chromaprint, libebur128 }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch, cmake, ffmpeg_3, SDL2, chromaprint, libebur128 }:
 
 stdenv.mkDerivation rec {
   version = "4.3.0";
@@ -11,10 +11,17 @@ stdenv.mkDerivation rec {
     sha256 = "1la9d9kig50mc74bxvhx6hzqv0nrci9aqdm4k2j4q0s1nlfgxipd";
   };
 
-  patches = [ ./no-warnings-as-errors.patch ];
+  patches = [
+    ./no-warnings-as-errors.patch
+    (fetchpatch {
+      name = "update-for-ffmpeg-3.0.patch";
+      url = "https://aur.archlinux.org/cgit/aur.git/plain/0001-update-for-ffmpeg-3.0.patch?h=libgroove&id=a9f3bd2a5afd3227733414a5d54c7a2aa0a1249e";
+      sha256 = "0800drk9df1kwbv80f2ffv77xk888249fk0d961rp2a305hvyrk0";
+    })
+  ];
 
   nativeBuildInputs = [ cmake ];
-  buildInputs = [ libav SDL2 chromaprint libebur128 ];
+  buildInputs = [ ffmpeg_3 SDL2 chromaprint libebur128 ];
 
   meta = with lib; {
     description = "Streaming audio processing library";
diff --git a/pkgs/games/performous/default.nix b/pkgs/games/performous/default.nix
index b0fc9483629..dce771faec1 100644
--- a/pkgs/games/performous/default.nix
+++ b/pkgs/games/performous/default.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, fetchFromGitHub, cmake, pkg-config, gettext
 , glibmm, libxmlxx, pango, librsvg
-, SDL2, glew, boost, libav, portaudio, epoxy
+, SDL2, glew, boost, ffmpeg, portaudio, epoxy
 }:
 
 stdenv.mkDerivation rec {
@@ -27,6 +27,6 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     glibmm libxmlxx pango librsvg
-    SDL2 glew boost libav portaudio epoxy
+    SDL2 glew boost ffmpeg portaudio epoxy
   ];
 }
diff --git a/pkgs/games/steam/fhsenv.nix b/pkgs/games/steam/fhsenv.nix
index 57326667cb0..924714d802a 100644
--- a/pkgs/games/steam/fhsenv.nix
+++ b/pkgs/games/steam/fhsenv.nix
@@ -171,7 +171,7 @@ in buildFHSUserEnv rec {
     SDL2
     libusb1
     dbus-glib
-    libav
+    ffmpeg
     atk
     # Only libraries are needed from those two
     libudev0-shim
diff --git a/pkgs/misc/screensavers/electricsheep/default.nix b/pkgs/misc/screensavers/electricsheep/default.nix
index ea68e147ba7..74d9e3cffee 100644
--- a/pkgs/misc/screensavers/electricsheep/default.nix
+++ b/pkgs/misc/screensavers/electricsheep/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, autoreconfHook, wxGTK30, libav, lua5_1, curl
+{ lib, stdenv, fetchFromGitHub, autoreconfHook, wxGTK30, ffmpeg, lua5_1, curl
 , libpng, xorg, pkg-config, flam3, libgtop, boost, tinyxml, freeglut, libGLU, libGL
 , glee }:
 
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ autoreconfHook pkg-config ];
 
   buildInputs = [
-    wxGTK30 libav lua5_1 curl libpng xorg.libXrender
+    wxGTK30 ffmpeg lua5_1 curl libpng xorg.libXrender
     flam3 libgtop boost tinyxml freeglut libGLU libGL glee
   ];
 
diff --git a/pkgs/servers/gerbera/default.nix b/pkgs/servers/gerbera/default.nix
index f81cc6600f1..7736ed1a014 100644
--- a/pkgs/servers/gerbera/default.nix
+++ b/pkgs/servers/gerbera/default.nix
@@ -2,18 +2,17 @@
 , cmake, pkg-config
 # required
 , libupnp, libuuid, pugixml, libiconv, sqlite, zlib, spdlog, fmt
-, pkgs
 # options
-, enableDuktape ? true
-, enableCurl ? true
-, enableTaglib ? true
-, enableLibmagic ? true
-, enableLibmatroska ? true
-, enableAvcodec ? false
-, enableLibexif ? true
-, enableExiv2 ? false
-, enableFFmpegThumbnailer ? false
-, enableInotifyTools ? true
+, enableDuktape ? true, duktape
+, enableCurl ? true, curl
+, enableTaglib ? true, taglib
+, enableLibmagic ? true, file
+, enableLibmatroska ? true, libmatroska, libebml
+, enableAvcodec ? false, ffmpeg
+, enableLibexif ? true, libexif
+, enableExiv2 ? false, exiv2
+, enableFFmpegThumbnailer ? false, ffmpegthumbnailer
+, enableInotifyTools ? true, inotify-tools
 }:
 
 with lib;
@@ -51,16 +50,16 @@ in stdenv.mkDerivation rec {
     libupnp libuuid pugixml libiconv sqlite zlib fmt.dev
     spdlog
   ]
-  ++ optionals enableDuktape [ pkgs.duktape ]
-  ++ optionals enableCurl [ pkgs.curl ]
-  ++ optionals enableTaglib [ pkgs.taglib ]
-  ++ optionals enableLibmagic [ pkgs.file ]
-  ++ optionals enableLibmatroska [ pkgs.libmatroska pkgs.libebml ]
-  ++ optionals enableAvcodec [ pkgs.libav.dev ]
-  ++ optionals enableLibexif [ pkgs.libexif ]
-  ++ optionals enableExiv2 [ pkgs.exiv2 ]
-  ++ optionals enableInotifyTools [ pkgs.inotify-tools ]
-  ++ optionals enableFFmpegThumbnailer [ pkgs.ffmpegthumbnailer ];
+  ++ optionals enableDuktape [ duktape ]
+  ++ optionals enableCurl [ curl ]
+  ++ optionals enableTaglib [ taglib ]
+  ++ optionals enableLibmagic [ file ]
+  ++ optionals enableLibmatroska [ libmatroska libebml ]
+  ++ optionals enableAvcodec [ ffmpeg.dev ]
+  ++ optionals enableLibexif [ libexif ]
+  ++ optionals enableExiv2 [ exiv2 ]
+  ++ optionals enableInotifyTools [ inotify-tools ]
+  ++ optionals enableFFmpegThumbnailer [ ffmpegthumbnailer ];
 
 
   meta = with lib; {
diff --git a/pkgs/tools/graphics/unpaper/default.nix b/pkgs/tools/graphics/unpaper/default.nix
index dd6ecb473e9..20dfe15dc6c 100644
--- a/pkgs/tools/graphics/unpaper/default.nix
+++ b/pkgs/tools/graphics/unpaper/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, pkg-config, libav, libxslt }:
+{ lib, stdenv, fetchurl, pkg-config, ffmpeg, libxslt }:
 
 stdenv.mkDerivation rec {
   pname = "unpaper";
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ libav libxslt ];
+  buildInputs = [ ffmpeg libxslt ];
 
   meta = with lib; {
     homepage = "https://www.flameeyes.eu/projects/unpaper";
diff --git a/pkgs/tools/video/untrunc/default.nix b/pkgs/tools/video/untrunc/default.nix
deleted file mode 100644
index 3ef025f5875..00000000000
--- a/pkgs/tools/video/untrunc/default.nix
+++ /dev/null
@@ -1,39 +0,0 @@
-{ lib, stdenv, gcc, libav_12, fetchFromGitHub }:
-
-stdenv.mkDerivation {
-  pname = "untrunc";
-  version = "2020.02.09";
-
-  src = fetchFromGitHub {
-    owner = "ponchio";
-    repo = "untrunc";
-    rev = "4eed44283168c727ace839ff7590092fda2e0848";
-    sha256 = "0nfj67drc6bxqlkf8a1iazqhi0w38a7rjrb2bpa74gwq6xzygvbr";
-  };
-
-  buildInputs = [ gcc libav_12 ];
-
-  # Untrunc uses the internal libav headers 'h264dec.h' and 'config.h'.
-  # The latter must be created through 'configure'.
-  libavConfiguredSrc = libav_12.overrideAttrs (oldAttrs: {
-    name = "libav-configured-src";
-    outputs = [ "out" ];
-    phases = [ "unpackPhase" "patchPhase" "configurePhase" "installPhase" ];
-    installPhase = "cp -r . $out";
-  });
-
-  buildCommand = ''
-    mkdir -p $out/bin
-    g++ -o $out/bin/untrunc \
-        -Wno-deprecated-declarations \
-        $src/file.cpp $src/main.cpp $src/track.cpp $src/atom.cpp $src/mp4.cpp \
-        -I$libavConfiguredSrc -lavformat -lavcodec -lavutil
-  '';
-
-  meta = with lib; {
-    description = "Restore a damaged (truncated) mp4, m4v, mov, 3gp video from a similar, undamaged video";
-    license = licenses.gpl2;
-    homepage = "https://github.com/ponchio/untrunc";
-    maintainers = [ maintainers.earvstedt ];
-  };
-}
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 46af571a2ee..27c2b48e66b 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -709,6 +709,7 @@ mapAliases ({
   ultrastardx-beta = ultrastardx; # added 2017-08-12
   unicorn-emu = unicorn; # added 2020-10-29
   unifiStable = unifi6; # added 2020-12-28
+  untrunc = untrunc-anthwlock; # added 2021-02-01
   usb_modeswitch = usb-modeswitch; # added 2016-05-10
   usbguard-nox = usbguard; # added 2019-09-04
   utillinux = util-linux; # added 2020-11-24
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 11dfb7c970c..9063fcce83b 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -8559,8 +8559,6 @@ in
 
   untex = callPackage ../tools/text/untex { };
 
-  untrunc = callPackage ../tools/video/untrunc { };
-
   untrunc-anthwlock = callPackage ../tools/video/untrunc-anthwlock { };
 
   up = callPackage ../tools/misc/up { };