84cd68f555
Apply patch from upstream commit f6c859061bfd7ccc2a21fcde3e9f0eb9ad98cd5e by benbjohnson that adds optional SSH host key verification to SFTP connections. This addresses CVE-2024-41254 where InsecureIgnoreHostKey() was used unconditionally, allowing potential MITM attacks. The patch adds a new `host-key-path` configuration option that allows users to specify a file containing the SSH host key for verification. When not specified, it maintains backward compatibility by falling back to the insecure behavior. Fixes: #388411
38 lines
782 B
Nix
38 lines
782 B
Nix
{
|
|
buildGoModule,
|
|
fetchFromGitHub,
|
|
lib,
|
|
nixosTests,
|
|
}:
|
|
buildGoModule rec {
|
|
pname = "litestream";
|
|
version = "0.3.13";
|
|
|
|
src = fetchFromGitHub {
|
|
owner = "benbjohnson";
|
|
repo = "litestream";
|
|
rev = "v${version}";
|
|
sha256 = "sha256-p858gK+ICKDQ+/LUiBaxF/kfrZzQAXnYMZDFU8kNCJ4=";
|
|
};
|
|
|
|
ldflags = [
|
|
"-s"
|
|
"-w"
|
|
"-X main.Version=${version}"
|
|
];
|
|
|
|
vendorHash = "sha256-sYIY3Z3VrCqbjEbQtEY7q6Jljg8jMoa2qWEB/IkDjzM=";
|
|
|
|
patches = [ ./fix-cve-2024-41254.patch ];
|
|
|
|
passthru.tests = { inherit (nixosTests) litestream; };
|
|
|
|
meta = with lib; {
|
|
description = "Streaming replication for SQLite";
|
|
mainProgram = "litestream";
|
|
license = licenses.asl20;
|
|
homepage = "https://litestream.io/";
|
|
maintainers = with maintainers; [ fbrs ];
|
|
};
|
|
}
|