Merge pull request #231429 from lukegb/envoy

envoy: 1.25.1 -> 1.26.1

pkgs/servers/http/envoy/0001-nixpkgs-use-system-Python.patch

@@ -1,6 +1,6 @@
-From 329ad7cb56e66464e5570bbb51dea0fd56c4d9ae Mon Sep 17 00:00:00 2001
+From 1b6ad143c0f5f96c42f603bb93a72f788b88b622 Mon Sep 17 00:00:00 2001
 From: Luke Granger-Brown <git@lukegb.com>
-Date: Sun, 19 Feb 2023 17:40:50 +0000
+Date: Fri, 12 May 2023 08:12:04 +0100
 Subject: [PATCH 1/2] nixpkgs: use system Python
 
 ---
@@ -9,11 +9,11 @@ Subject: [PATCH 1/2] nixpkgs: use system Python
  2 files changed, 1 insertion(+), 16 deletions(-)
 
 diff --git a/bazel/python_dependencies.bzl b/bazel/python_dependencies.bzl
-index a5c3283d0a..1c2c31ebf2 100644
+index 37c0183664..0bee5feb7e 100644
 --- a/bazel/python_dependencies.bzl
 +++ b/bazel/python_dependencies.bzl
-@@ -1,10 +1,8 @@
- load("@rules_python//python:pip.bzl", "pip_install", "pip_parse")
+@@ -1,24 +1,20 @@
+ load("@rules_python//python:pip.bzl", "pip_parse")
 -load("@python3_10//:defs.bzl", "interpreter")
  
  def envoy_python_dependencies():
@@ -23,13 +23,12 @@ index a5c3283d0a..1c2c31ebf2 100644
          requirements_lock = "@envoy//tools/base:requirements.txt",
          extra_pip_args = ["--require-hashes"],
      )
-@@ -12,14 +10,12 @@ def envoy_python_dependencies():
-     # TODO(phlax): switch to `pip_parse`
-     pip_install(
-         # Note: dev requirements do *not* check hashes
--        python_interpreter_target = interpreter,
+ 
+     pip_parse(
          name = "dev_pip3",
-         requirements = "@envoy//tools/dev:requirements.txt",
+-        python_interpreter_target = interpreter,
+         requirements_lock = "@envoy//tools/dev:requirements.txt",
+         extra_pip_args = ["--require-hashes"],
      )
  
      pip_parse(
@@ -68,5 +67,5 @@ index 9d1b31c5d6..ac5605eb30 100644
 -
      aspect_bazel_lib_dependencies()
 -- 
-2.39.1
+2.40.0
 

pkgs/servers/http/envoy/0002-nixpkgs-use-system-Go.patch

@@ -1,19 +1,18 @@
-From 31d864a3b6a1a3455191e87ff680eb812f77dc3c Mon Sep 17 00:00:00 2001
+From 30e059d652bd4e352e2c1dc3c44d03a1e42ff912 Mon Sep 17 00:00:00 2001
 From: Luke Granger-Brown <git@lukegb.com>
-Date: Sun, 19 Feb 2023 17:43:03 +0000
+Date: Fri, 12 May 2023 08:13:21 +0100
 Subject: [PATCH 2/2] nixpkgs: use system Go
 
 ---
- bazel/dependency_imports.bzl   | 29 +----------------------------
- bazel/repositories.bzl         |  3 ---
- bazel/repository_locations.bzl |  4 ++--
- 3 files changed, 3 insertions(+), 33 deletions(-)
+ bazel/dependency_imports.bzl | 29 +----------------------------
+ bazel/repositories.bzl       |  3 ---
+ 2 files changed, 1 insertion(+), 31 deletions(-)
 
 diff --git a/bazel/dependency_imports.bzl b/bazel/dependency_imports.bzl
-index 7dbdb0174e..e73662ed79 100644
+index 681617f1b8..a10c560baf 100644
 --- a/bazel/dependency_imports.bzl
 +++ b/bazel/dependency_imports.bzl
-@@ -15,7 +15,7 @@ load("@aspect_bazel_lib//lib:repositories.bzl", "register_jq_toolchains", "regis
+@@ -17,7 +17,7 @@ load("@aspect_bazel_lib//lib:repositories.bzl", "register_jq_toolchains", "regis
  load("@com_google_cel_cpp//bazel:deps.bzl", "parser_deps")
  
  # go version for rules_go
@@ -22,7 +21,7 @@ index 7dbdb0174e..e73662ed79 100644
  
  JQ_VERSION = "1.6"
  YQ_VERSION = "4.24.4"
-@@ -25,7 +25,6 @@ def envoy_dependency_imports(go_version = GO_VERSION, jq_version = JQ_VERSION, y
+@@ -27,7 +27,6 @@ def envoy_dependency_imports(go_version = GO_VERSION, jq_version = JQ_VERSION, y
      rules_foreign_cc_dependencies(register_default_tools = False, register_built_tools = False)
      go_rules_dependencies()
      go_register_toolchains(go_version)
@@ -30,7 +29,7 @@ index 7dbdb0174e..e73662ed79 100644
      gazelle_dependencies(go_sdk = "go_sdk")
      apple_rules_dependencies()
      pip_dependencies()
-@@ -134,29 +133,3 @@ def envoy_dependency_imports(go_version = GO_VERSION, jq_version = JQ_VERSION, y
+@@ -146,29 +145,3 @@ def envoy_dependency_imports(go_version = GO_VERSION, jq_version = JQ_VERSION, y
          # use_category = ["api"],
          # source = "https://github.com/bufbuild/protoc-gen-validate/blob/v0.6.1/dependencies.bzl#L23-L28"
      )
@@ -61,10 +60,10 @@ index 7dbdb0174e..e73662ed79 100644
 -        version = go_version,
 -    )
 diff --git a/bazel/repositories.bzl b/bazel/repositories.bzl
-index fca05b6062..a2f60014cb 100644
+index 6d2cf2014c..a8375bcdef 100644
 --- a/bazel/repositories.bzl
 +++ b/bazel/repositories.bzl
-@@ -115,9 +115,6 @@ def _go_deps(skip_targets):
+@@ -196,9 +196,6 @@ def _go_deps(skip_targets):
      if "io_bazel_rules_go" not in skip_targets:
          external_http_archive(
              name = "io_bazel_rules_go",
@@ -74,21 +73,6 @@ index fca05b6062..a2f60014cb 100644
          )
          external_http_archive("bazel_gazelle")
  
-diff --git a/bazel/repository_locations.bzl b/bazel/repository_locations.bzl
-index e4e89d281a..fb62c4f8f3 100644
---- a/bazel/repository_locations.bzl
-+++ b/bazel/repository_locations.bzl
-@@ -878,8 +878,8 @@ REPOSITORY_LOCATIONS_SPEC = dict(
-         project_name = "Go rules for Bazel",
-         project_desc = "Bazel rules for the Go language",
-         project_url = "https://github.com/bazelbuild/rules_go",
--        version = "0.36.0",
--        sha256 = "ae013bf35bd23234d1dea46b079f1e05ba74ac0321423830119d3e787ec73483",
-+        version = "0.38.1",
-+        sha256 = "dd926a88a564a9246713a9c00b35315f54cbd46b31a26d5d8fb264c07045f05d",
-         urls = ["https://github.com/bazelbuild/rules_go/releases/download/v{version}/rules_go-v{version}.zip"],
-         use_category = ["build", "api"],
-         release_date = "2022-11-23",
 -- 
-2.39.1
+2.40.0
 

pkgs/servers/http/envoy/default.nix

@@ -1,5 +1,5 @@
 { lib
-, bazel_5
+, bazel_6
 , bazel-gazelle
 , buildBazelPackage
 , fetchFromGitHub
@@ -24,19 +24,19 @@ let
     # However, the version string is more useful for end-users.
     # These are contained in a attrset of their own to make it obvious that
     # people should update both.
-    version = "1.25.1";
-    rev = "bae2e9d642a6a8ae6c5d3810f77f3e888f0d97da";
+    version = "1.26.1";
+    rev = "c7e8e7356d3a969c1b8e4e1f2687699acd91c6a1";
   };
 in
 buildBazelPackage rec {
   pname = "envoy";
   inherit (srcVer) version;
-  bazel = bazel_5;
+  bazel = bazel_6;
   src = fetchFromGitHub {
     owner = "envoyproxy";
     repo = "envoy";
     inherit (srcVer) rev;
-    sha256 = "sha256-qA3+bta2vXGtAYX3mg+CmSIEitk4576JQB/QLPsj9Vc=";
+    sha256 = "sha256-WHedup6z/9t/Jg6CBrwtDy9xv6IwO3gUuBqos4h+k2s=";
 
     postFetch = ''
       chmod -R +w $out
@@ -80,8 +80,8 @@ buildBazelPackage rec {
 
   fetchAttrs = {
     sha256 = {
-      x86_64-linux = "sha256-koz08NWUq5Fkca++1G7WEmg24G6FuMQOgRN3+HBtNIk=";
-      aarch64-linux = "sha256-oSybAw58yK0BUhS8MU2Y9hRo0mU/7xT7VKU3tDW4xN0=";
+      x86_64-linux = "sha256-jx8RavJKlBtZQtZf4GrUkOlhM6qI4LO5lK3HRgn1vzE=";
+      aarch64-linux = "sha256-toEPrGVh61sHsVbhsideMmnX8uXIN+2x8LuZpczTEdw=";
     }.${stdenv.system} or (throw "unsupported system ${stdenv.system}");
     dontUseCmakeConfigure = true;
     dontUseGnConfigure = true;
@@ -176,13 +176,5 @@ buildBazelPackage rec {
     license = licenses.asl20;
     maintainers = with maintainers; [ lukegb ];
     platforms = [ "x86_64-linux" "aarch64-linux" ];
-    knownVulnerabilities = [
-      "CVE-2023-27487"
-      "CVE-2023-27488"
-      "CVE-2023-27491"
-      "CVE-2023-27492"
-      "CVE-2023-27493"
-      "CVE-2023-27496"
-    ];
   };
 }