mupdf: mark 1.17 as insecure but as still required as dependency

pkgs/applications/misc/k2pdfopt/default.nix

@@ -2,7 +2,7 @@
 , cmake, pkgconfig, zlib, libpng, makeWrapper
 , enableGSL ? true, gsl
 , enableGhostScript ? true, ghostscript
-, enableMuPDF ? true, mupdf
+, enableMuPDF ? true, mupdf_1_17
 , enableDJVU ? true, djvulibre
 , enableGOCR ? false, gocr # Disabled by default due to crashes
 , enableTesseract ? true, leptonica, tesseract4
@@ -89,7 +89,7 @@ in stdenv.mkDerivation rec {
         cp ${k2pdfopt_src}/mupdf_mod/pdf-* ./source/pdf/
       '';
     };
-    mupdf_modded = mupdf.overrideAttrs ({ patches ? [], ... }: {
+    mupdf_modded = mupdf_1_17.overrideAttrs ({ patches ? [], ... }: {
       patches = patches ++ [ mupdf_patch ];
       # This function is missing in font.c, see font-win32.c
       postPatch = ''

pkgs/applications/misc/mupdf/1.17.nix

@@ -0,0 +1,95 @@
+{ stdenv, lib, fetchurl, fetchpatch, pkgconfig, freetype, harfbuzz, openjpeg
+, jbig2dec, libjpeg , darwin
+, enableX11 ? true, libX11, libXext, libXi, libXrandr
+, enableCurl ? true, curl, openssl
+, enableGL ? true, freeglut, libGLU
+}:
+
+let
+
+  # OpenJPEG version is hardcoded in package source
+  openJpegVersion = with stdenv;
+    lib.versions.majorMinor (lib.getVersion openjpeg);
+
+
+in stdenv.mkDerivation rec {
+  version = "1.17.0";
+  pname = "mupdf";
+
+  src = fetchurl {
+    url = "https://mupdf.com/downloads/archive/${pname}-${version}-source.tar.gz";
+    sha256 = "13nl9nrcx2awz9l83mlv2psi1lmn3hdnfwxvwgwiwbxlkjl3zqq0";
+  };
+
+  patches =
+    # Use shared libraries to decrease size
+    stdenv.lib.optional (!stdenv.isDarwin) ./mupdf-1.14-shared_libs.patch
+    ++ stdenv.lib.optional stdenv.isDarwin ./darwin.patch
+  ;
+
+  postPatch = ''
+    sed -i "s/__OPENJPEG__VERSION__/${openJpegVersion}/" source/fitz/load-jpx.c
+  '';
+
+  makeFlags = [ "prefix=$(out) USE_SYSTEM_LIBS=yes" ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ freetype harfbuzz openjpeg jbig2dec libjpeg freeglut libGLU ]
+                ++ lib.optionals enableX11 [ libX11 libXext libXi libXrandr ]
+                ++ lib.optionals enableCurl [ curl openssl ]
+                ++ lib.optionals enableGL (
+                  if stdenv.isDarwin then
+                    with darwin.apple_sdk.frameworks; [ GLUT OpenGL ]
+                  else
+                    [ freeglut libGLU ])
+                ;
+  outputs = [ "bin" "dev" "out" "man" "doc" ];
+
+  preConfigure = ''
+    # Don't remove mujs because upstream version is incompatible
+    rm -rf thirdparty/{curl,freetype,glfw,harfbuzz,jbig2dec,libjpeg,openjpeg,zlib}
+  '';
+
+  postInstall = ''
+    mkdir -p "$out/lib/pkgconfig"
+    cat >"$out/lib/pkgconfig/mupdf.pc" <<EOF
+    prefix=$out
+    libdir=$out/lib
+    includedir=$out/include
+
+    Name: mupdf
+    Description: Library for rendering PDF documents
+    Version: ${version}
+    Libs: -L$out/lib -lmupdf -lmupdf-third
+    Cflags: -I$dev/include
+    EOF
+
+    moveToOutput "bin" "$bin"
+    ln -s "$bin/bin/mupdf-x11" "$bin/bin/mupdf"
+    mkdir -p $bin/share/applications
+    cat > $bin/share/applications/mupdf.desktop <<EOF
+    [Desktop Entry]
+    Type=Application
+    Version=1.0
+    Name=mupdf
+    Comment=PDF viewer
+    Exec=$bin/bin/mupdf-x11 %f
+    Terminal=false
+    MimeType=application/pdf;application/x-pdf;application/x-cbz;application/oxps;application/vnd.ms-xpsdocument;application/epub+zip
+    EOF
+  '';
+
+  enableParallelBuilding = true;
+
+  meta = with stdenv.lib; {
+    homepage = "https://mupdf.com";
+    repositories.git = "git://git.ghostscript.com/mupdf.git";
+    description = "Lightweight PDF, XPS, and E-book viewer and toolkit written in portable C";
+    license = licenses.agpl3Plus;
+    maintainers = with maintainers; [ vrthra fpletz ];
+    platforms = platforms.unix;
+    knownVulnerabilities = [
+      "CVE-2020-26519: denial of service when parsing JBIG2"
+      "CVE-2017-5991: NULL pointer dereference"
+    ];
+  };
+}

pkgs/applications/misc/mupdf/mupdf-1.14-shared_libs.patch

@@ -0,0 +1,39 @@
+--- mupdf-1.14.0-source.orig/Makefile	2018-11-02 06:57:12.114012496 +0100
++++ mupdf-1.14.0-source/Makefile	2018-11-02 09:57:10.067945307 +0100
+@@ -20,7 +20,7 @@
+ # Do not specify CFLAGS or LIBS on the make invocation line - specify
+ # XCFLAGS or XLIBS instead. Make ignores any lines in the makefile that
+ # set a variable that was set on the command line.
+-CFLAGS += $(XCFLAGS) -Iinclude
++CFLAGS += $(XCFLAGS) -Iinclude -fPIC
+ LIBS += $(XLIBS) -lm
+ 
+ ifneq ($(threading),no)
+@@ -190,17 +190,21 @@
+ 
+ # --- Library ---
+ 
+-MUPDF_LIB = $(OUT)/libmupdf.a
+-THIRD_LIB = $(OUT)/libmupdf-third.a
+-THREAD_LIB = $(OUT)/libmupdf-threads.a
+-PKCS7_LIB = $(OUT)/libmupdf-pkcs7.a
++MUPDF_LIB = $(OUT)/libmupdf.so
++THIRD_LIB = $(OUT)/libmupdf-third.so
++THREAD_LIB = $(OUT)/libmupdf-threads.so
++PKCS7_LIB = $(OUT)/libmupdf-pkcs7.so
+ 
+-$(MUPDF_LIB) : $(MUPDF_OBJ)
++$(MUPDF_LIB) : $(MUPDF_OBJ) $(THIRD_LIB) $(THREAD_LIB)
++	$(LINK_CMD) $(THIRD_LIBS) -shared -Wl,-soname -Wl,libmupdf.so -Wl,--no-undefined
+ $(THIRD_LIB) : $(THIRD_OBJ)
++	$(LINK_CMD) -shared -Wl,-soname -Wl,libmupdf-third.so -Wl,--no-undefined
+ $(THREAD_LIB) : $(THREAD_OBJ)
++	$(LINK_CMD) -shared -Wl,-soname -Wl,libmupdf-threads.so -Wl,--no-undefined -lpthread
+ $(PKCS7_LIB) : $(PKCS7_OBJ)
++	$(LINK_CMD) -shared -Wl,-soname -Wl,libmupdf-pkcs7.so
+ 
+-INSTALL_LIBS := $(MUPDF_LIB) $(THIRD_LIB)
++INSTALL_LIBS := $(MUPDF_LIB) $(THIRD_LIB) $(THREAD_LIB) $(PKCS7_LIB)
+ 
+ # --- Main tools and viewers ---
+ 

pkgs/os-specific/linux/jfbview/default.nix

@@ -1,5 +1,5 @@
 { stdenv, fetchFromGitHub
-, freetype, harfbuzz, jbig2dec, libjpeg, libX11, mupdf, ncurses, openjpeg
+, freetype, harfbuzz, jbig2dec, libjpeg, libX11, mupdf_1_17, ncurses, openjpeg
 , openssl
 
 , imageSupport ? true, imlib2 ? null }:
@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
   hardeningDisable = [ "format" ];
 
   buildInputs = [
-    freetype harfbuzz jbig2dec libjpeg libX11 mupdf ncurses openjpeg
+    freetype harfbuzz jbig2dec libjpeg libX11 mupdf_1_17 ncurses openjpeg
     openssl
   ] ++ stdenv.lib.optionals imageSupport [
     imlib2

pkgs/top-level/all-packages.nix

@@ -22672,6 +22672,7 @@ in
   pdfsam-basic = callPackage ../applications/misc/pdfsam-basic { };
 
   mupdf = callPackage ../applications/misc/mupdf { };
+  mupdf_1_17 = callPackage ../applications/misc/mupdf/1.17.nix { };
 
   mystem = callPackage ../applications/misc/mystem { };