singularity: 2.5.1 -> 2.5.2

[r-ryantm]

Semi-automatic update generated by https://github.com/ryantm/nixpkgs-update tools.

This update was made based on information from https://repology.org/metapackage/singularity/versions.

Version release notes (from GitHub)

Greetings Singularity containerizers!

This release contains fixes for a high severity security issue affecting Singularity 2.3.0 through 2.5.1 on kernels that support overlay file systems (CVE-2018-12021). A malicious user with network access to the host system (e.g. ssh) could exploit this vulnerability to access sensitive information on disk and bypass directory image restrictions like those preventing the root file system from being mounted into the container.

Singularity 2.5.2 should be installed immediately, and all previous versions of Singularity should be removed. The vulnerability addressed in this release affects kernels that support overlayfs. If you are unable to upgrade immediately, you should set enable overlay = no in singularity.conf.

In addition, this release contains a large number of bug fixes. Details follow:

Security related fixes

• Removed the option to use overlay images with singularity mount. This
  flaw could allow a malicious user accessing the host system to access
  sensitive information when coupled with persistent ext3 overlay.
• Fixed a race condition that might allow a malicious user to bypass directory
  image restrictions, like mounting the host root filesystem as a container
  image

Bug fixes

• Fix an error in malloc allocation Yubikey PBA #1620
• Honor debug flag when pulling from docker hub Update siege to 3.0.5 and add meta information #1556
• Fix a bug with passwd abort add most basic README.md #1580
• Allow user to override singularity.conf "mount home = no" with --home option
  gupnp-tools and releated packages: fix and update #1496
• Improve debugging output OpenJDK cannot be installed because of strange file collision #1535
• Fix some bugs in bind mounting chromium: Update stable channel from 31.0.1650.57 -> 32.0.1700.77 #1525
• Define PR_(S|G)ET_NO_NEW_PRIVS in user space so that these features will
  work with kernels that implement them (like Cray systems) Add node-webkit, app runtime based on Chromium and node.js #1506
• Create /dev/fd and standard streams symlinks in /dev when using minimal dev
  mount or when specifying -c/-C/--contain option Fixed a code typo in the documentation #1420
• Fixed * expansion during app runscript creation Investigate the possibility of different values of system on different OSX versions #1486

As always, please report any bugs to:
https://github.com/singularityware/singularity/issues/new

These checks were done:

• built on NixOS
• /nix/store/3igwiqi311c18w13y5r7zrgpcnzylg9l-singularity-2.5.2/bin/singularity passed the binary check.
• Warning: no invocation of /nix/store/3igwiqi311c18w13y5r7zrgpcnzylg9l-singularity-2.5.2/bin/run-singularity had a zero exit code or showed the expected version
• 1 of 2 passed binary check by having a zero exit code.
• 0 of 2 passed binary check by having the new version present in output.
• found 2.5.2 with grep in /nix/store/3igwiqi311c18w13y5r7zrgpcnzylg9l-singularity-2.5.2
• directory tree listing: https://gist.github.com/ed6db09ad43a19c6abf2d35d15ef489c
• du listing: https://gist.github.com/9bd23f4d6ee86a9eb2ba7ec5c986741d

meta.description for singularity is: '"Designed around the notion of extreme mobility of compute and reproducible science, Singularity enables users to have full control of their operating system environment"'.

cc @jbedo for testing.

This build is cached with Cachix. To use the cache follow these instructions:

One time setup in nixpkgs Git checkout:

cachix use r-ryantm
git remote add r-ryantm https://github.com/r-ryantm/nixpkgs.git

Test this build:

git fetch r-ryantm && git checkout 4bb61a3ba43bb589b6a60893af7db51ca3984c64 && nix-shell --pure -I nixpkgs=. -p singularity

[GrahamcOfBorg]

No attempt on x86_64-darwin (full log)

The following builds were skipped because they don't evaluate on x86_64-darwin: singularity

Partial log (click to expand)

a) For `nixos-rebuild` you can set
  { nixpkgs.config.allowUnsupportedSystem = true; }
in configuration.nix to override this.

b) For `nix-env`, `nix-build`, `nix-shell` or any other Nix command you can add
  { allowUnsupportedSystem = true; }
to ~/.config/nixpkgs/config.nix.

[GrahamcOfBorg]

Success on x86_64-linux (full log)

Attempted: singularity

Partial log (click to expand)

/nix/store/3igwiqi311c18w13y5r7zrgpcnzylg9l-singularity-2.5.2/libexec/singularity/handlers/archive-cpio.sh: interpreter directive changed from "/bin/bash" to "/nix/store/8zkg9ac4s4alzyf4a8kfrig1j73z66dw-bash-4.4-p23/bin/bash"
/nix/store/3igwiqi311c18w13y5r7zrgpcnzylg9l-singularity-2.5.2/libexec/singularity/handlers/image-http.sh: interpreter directive changed from "/bin/bash" to "/nix/store/8zkg9ac4s4alzyf4a8kfrig1j73z66dw-bash-4.4-p23/bin/bash"
/nix/store/3igwiqi311c18w13y5r7zrgpcnzylg9l-singularity-2.5.2/libexec/singularity/handlers/archive-tar.sh: interpreter directive changed from "/bin/bash" to "/nix/store/8zkg9ac4s4alzyf4a8kfrig1j73z66dw-bash-4.4-p23/bin/bash"
/nix/store/3igwiqi311c18w13y5r7zrgpcnzylg9l-singularity-2.5.2/libexec/singularity/helpers/image.sh: interpreter directive changed from "/bin/bash" to "/nix/store/8zkg9ac4s4alzyf4a8kfrig1j73z66dw-bash-4.4-p23/bin/bash"
/nix/store/3igwiqi311c18w13y5r7zrgpcnzylg9l-singularity-2.5.2/libexec/singularity/helpers/apps/list.sh: interpreter directive changed from "/bin/bash" to "/nix/store/8zkg9ac4s4alzyf4a8kfrig1j73z66dw-bash-4.4-p23/bin/bash"
/nix/store/3igwiqi311c18w13y5r7zrgpcnzylg9l-singularity-2.5.2/libexec/singularity/helpers/help.sh: interpreter directive changed from "/bin/bash" to "/nix/store/8zkg9ac4s4alzyf4a8kfrig1j73z66dw-bash-4.4-p23/bin/bash"
/nix/store/3igwiqi311c18w13y5r7zrgpcnzylg9l-singularity-2.5.2/libexec/singularity/helpers/check.sh: interpreter directive changed from "/bin/bash" to "/nix/store/8zkg9ac4s4alzyf4a8kfrig1j73z66dw-bash-4.4-p23/bin/bash"
/nix/store/3igwiqi311c18w13y5r7zrgpcnzylg9l-singularity-2.5.2/libexec/singularity/helpers/inspect.sh: interpreter directive changed from "/bin/bash" to "/nix/store/8zkg9ac4s4alzyf4a8kfrig1j73z66dw-bash-4.4-p23/bin/bash"
/nix/store/3igwiqi311c18w13y5r7zrgpcnzylg9l-singularity-2.5.2/bin/run-singularity: interpreter directive changed from "/bin/sh" to "/nix/store/8zkg9ac4s4alzyf4a8kfrig1j73z66dw-bash-4.4-p23/bin/sh"
/nix/store/3igwiqi311c18w13y5r7zrgpcnzylg9l-singularity-2.5.2/bin/singularity: interpreter directive changed from "/bin/bash" to "/nix/store/8zkg9ac4s4alzyf4a8kfrig1j73z66dw-bash-4.4-p23/bin/bash"

[GrahamcOfBorg]

Success on aarch64-linux (full log)

Attempted: singularity

Partial log (click to expand)

/nix/store/ywwf1d990xhybfyk2affc8a8zi3dlgp6-singularity-2.5.2/libexec/singularity/bootstrap-scripts/deffile-driver-localimage.sh: interpreter directive changed from "/bin/bash" to "/nix/store/p0vy17dp9jk2mvqsxsqnb14s3797lay7-bash-4.4-p23/bin/bash"
/nix/store/ywwf1d990xhybfyk2affc8a8zi3dlgp6-singularity-2.5.2/libexec/singularity/bootstrap-scripts/deffile-driver-docker.sh: interpreter directive changed from "/bin/bash" to "/nix/store/p0vy17dp9jk2mvqsxsqnb14s3797lay7-bash-4.4-p23/bin/bash"
/nix/store/ywwf1d990xhybfyk2affc8a8zi3dlgp6-singularity-2.5.2/libexec/singularity/bootstrap-scripts/deffile-driver-debootstrap.sh: interpreter directive changed from "/bin/bash" to "/nix/store/p0vy17dp9jk2mvqsxsqnb14s3797lay7-bash-4.4-p23/bin/bash"
/nix/store/ywwf1d990xhybfyk2affc8a8zi3dlgp6-singularity-2.5.2/libexec/singularity/bootstrap-scripts/deffile-driver-busybox.sh: interpreter directive changed from "/bin/bash" to "/nix/store/p0vy17dp9jk2mvqsxsqnb14s3797lay7-bash-4.4-p23/bin/bash"
/nix/store/ywwf1d990xhybfyk2affc8a8zi3dlgp6-singularity-2.5.2/libexec/singularity/bootstrap-scripts/deffile-driver-arch.sh: interpreter directive changed from "/bin/bash" to "/nix/store/p0vy17dp9jk2mvqsxsqnb14s3797lay7-bash-4.4-p23/bin/bash"
/nix/store/ywwf1d990xhybfyk2affc8a8zi3dlgp6-singularity-2.5.2/libexec/singularity/bootstrap-scripts/checks.sh: interpreter directive changed from "/bin/bash" to "/nix/store/p0vy17dp9jk2mvqsxsqnb14s3797lay7-bash-4.4-p23/bin/bash"
/nix/store/ywwf1d990xhybfyk2affc8a8zi3dlgp6-singularity-2.5.2/libexec/singularity/bootstrap-scripts/functions: interpreter directive changed from "/bin/bash" to "/nix/store/p0vy17dp9jk2mvqsxsqnb14s3797lay7-bash-4.4-p23/bin/bash"
/nix/store/ywwf1d990xhybfyk2affc8a8zi3dlgp6-singularity-2.5.2/bin/run-singularity: interpreter directive changed from "/bin/sh" to "/nix/store/p0vy17dp9jk2mvqsxsqnb14s3797lay7-bash-4.4-p23/bin/sh"
/nix/store/ywwf1d990xhybfyk2affc8a8zi3dlgp6-singularity-2.5.2/bin/singularity: interpreter directive changed from "/bin/bash" to "/nix/store/p0vy17dp9jk2mvqsxsqnb14s3797lay7-bash-4.4-p23/bin/bash"
/nix/store/ywwf1d990xhybfyk2affc8a8zi3dlgp6-singularity-2.5.2