{"action":"created","issue":{"url":"https://api.github.com/repos/NixOS/nix/issues/614","labels_url":"https://api.github.com/repos/NixOS/nix/issues/614/labels{/name}","comments_url":"https://api.github.com/repos/NixOS/nix/issues/614/comments","events_url":"https://api.github.com/repos/NixOS/nix/issues/614/events","html_url":"https://github.com/NixOS/nix/issues/614","id":102631772,"number":614,"title":"Security patches?","user":{"login":"joepie91","id":1663259,"avatar_url":"https://avatars.githubusercontent.com/u/1663259?v=3","gravatar_id":"","url":"https://api.github.com/users/joepie91","html_url":"https://github.com/joepie91","followers_url":"https://api.github.com/users/joepie91/followers","following_url":"https://api.github.com/users/joepie91/following{/other_user}","gists_url":"https://api.github.com/users/joepie91/gists{/gist_id}","starred_url":"https://api.github.com/users/joepie91/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joepie91/subscriptions","organizations_url":"https://api.github.com/users/joepie91/orgs","repos_url":"https://api.github.com/users/joepie91/repos","events_url":"https://api.github.com/users/joepie91/events{/privacy}","received_events_url":"https://api.github.com/users/joepie91/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-08-23T15:29:07Z","updated_at":"2015-08-23T20:10:42Z","closed_at":null,"body":"This is more a design question than an actual bug, but I'm not sure where else to file it.\r\n\r\nAll dependencies in Nix are immutable by default, which is desirable in almost all cases. However, there's one case where it isn't: for security patches. It's common for a vendor to release a 'security patch'; that is, a new version of a library or piece of software, that has an identical API to the previous version, but that has an internal fix to remedy a security problem.\r\n\r\nIt's generally desirable to upgrade these dependencies without requiring anything from other vendors who depend on it - patching a library once means that every application using that library is now patched, even if the application maintainers are not paying attention or are MIA. Such a patch-all strategy is practically required to keep systems secure.\r\n\r\nHow would this be accomplished with Nix? As I understand it, you cannot forcibly change the dependencies for a package, even if the API remains 100% unchanged, because dependencies are immutable and only dependents can specify upgrades. In for example the Node.js ecosystem, this is solved using semantic versioning, but Nix does not seem to offer any such equivalent."},"comment":{"url":"https://api.github.com/repos/NixOS/nix/issues/comments/133914615","html_url":"https://github.com/NixOS/nix/issues/614#issuecomment-133914615","issue_url":"https://api.github.com/repos/NixOS/nix/issues/614","id":133914615,"user":{"login":"joachifm","id":41977,"avatar_url":"https://avatars.githubusercontent.com/u/41977?v=3","gravatar_id":"","url":"https://api.github.com/users/joachifm","html_url":"https://github.com/joachifm","followers_url":"https://api.github.com/users/joachifm/followers","following_url":"https://api.github.com/users/joachifm/following{/other_user}","gists_url":"https://api.github.com/users/joachifm/gists{/gist_id}","starred_url":"https://api.github.com/users/joachifm/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joachifm/subscriptions","organizations_url":"https://api.github.com/users/joachifm/orgs","repos_url":"https://api.github.com/users/joachifm/repos","events_url":"https://api.github.com/users/joachifm/events{/privacy}","received_events_url":"https://api.github.com/users/joachifm/received_events","type":"User","site_admin":false},"created_at":"2015-08-23T20:10:42Z","updated_at":"2015-08-23T20:10:42Z","body":"It helps to think about a build recipe as a pure function `F(X)`, where `X` is a set of build inputs, whose output can be used as an input to other build recipes. Due to purity, `F` only does work the first time you call it for any given `X`, otherwise it returns a cached result. Patching source code is akin to applying `F` to a different set of inputs, thus causing it do work to produce a result. This result is likely to differ from the previous result, and so any build recipe which uses the output of `F` as an input now also has to do work to produce a result, and so on (that is, patching the source has  \"triggered\" a chain of rebuilds).\r\n\r\nTo wit, security patches are not special and do not require special handling. You should, however, ensure that you are subscribed to an active channel and use `nix-env --leq -u '*'` to update your user profile (unsure why this is not default). I suppose the only thing which is lacking is a built-in mechanism for nagging channel subscribers about upgrading."}}