gnutls: 3.6.13 -> 3.6.14

[cole-h]

Fixes CVE-2020-13777 [1].

Changes: https://lists.gnupg.org/pipermail/gnutls-help/2020-June/004648.html

[1] https://nvd.nist.gov/vuln/detail/CVE-2020-13777

Motivation for this change

Saw this thread on Twitter: https://twitter.com/__agwa/status/1270054737317113857. Noticed it hadn't been updated in Nixpkgs yet, so here I am.

See https://gitlab.com/gnutls/gnutls/-/issues/1011 and the aforementioned Twitter thread for more info.

Things done

• Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS linux)
• Built on platform(s)
  • NixOS
  • macOS
  • other Linux distributions
• Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
• Tested compilation of all pkgs that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review wip"
• Tested execution of all binary files (usually in ./result/bin/)
• Determined the impact on package closure size (by running nix path-info -S before and after)
• Ensured that relevant documentation is up to date
• Fits CONTRIBUTING.md.

---

cc @vcunat (you merged/reviewed/dealt with the previous bump)

I built and tested against master; currently building against staging. Might take a while.

EDIT: Took a lot less time than I expected. Built fine and binaries still work fine.

[wamserma]

This should be fast-tracked as this currently gets a lot of press coverage.
@cole-h Could you also take care of the backport to 20.03?

[vcunat]

Naturally, I consider this a very serious issue. 20.03 binaries are already being built on the farm.

[cole-h]

@vcunat Thanks for handling the backport (I had opened this just before going to bed... lol).

[schmittlauch]

As the recent hydra evaluations of release-20.03 have all failed – at first look because of a problem with the aarch64 builders – this important security patch hasn't reached the stable channel yet.
Whom to ping for getting the build infra fixed?

[vcunat]

I can do just stuff like restarts, but even after many of them it was of no use. /cc @grahamc

[vcunat]

Now the critical aarch64 builds came through and release-20.03 updated past the gnutls update (and firefox as well).

[vcunat]

I haven't seen these abortions anymore in the past few hours, so hopefully it's solved now.

[cole-h]

Solved until it rears its ugly head again, at least. It was (probably) caused by a sick server: https://logs.nix.samueldr.com/nixos-dev/2020-06-11#1591912418-1591912502.