hdf5: 1.10.6 -> 1.10.7

[dotlambda]

Motivation for this change

fix CVE-2018-13870, CVE-2018-13869, CVE-2018-17438, and CVE-2018-17435 (see https://github.com/HDFGroup/hdf5/blob/hdf5-1_10_7/release_docs/RELEASE.txt)
I'm not sure if this fixes the vulnerabilities mentioned in #88322.

Things done

• Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS linux)
• Built on platform(s)
  • NixOS
  • macOS
  • other Linux distributions
• Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
• Tested compilation of all pkgs that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review wip"
• Tested execution of all binary files (usually in ./result/bin/)
• Determined the impact on package closure size (by running nix path-info -S before and after)
• Ensured that relevant documentation is up to date
• Fits CONTRIBUTING.md.

cc @tviti @ttuegel @markuskowa

[SuperSandro2000]

/rebase-staging

[SuperSandro2000]

Actually I am not sure if this should go through staging but over 500 rebuilds when hydra has issues seems a bit much.

[markuskowa]

For security updates one could make an exception and bypass staging. However, nixpkgs-review shows ~900 rebuilds, probably making staging the right call.

[dotlambda]

I'm not sure if this fixes the vulnerabilities mentioned in #88322.

Does anyone know?

[TredwellGit]

Does not fix. https://repology.org/project/hdf5/cves?version=1.12.0

[dotlambda]

Does not fix. https://repology.org/project/hdf5/cves?version=1.12.0

Maybe the maintainers can update to a version > 1.12.0 after this is merged.

[TredwellGit]

There is no version > 1.12.0.

[risicle]

Yeah I think it's very unlikely it fixes CVE-2020-10809 - decompress.c in the 1.10 branch doesn't seem to have been given a non-trivial update since well before the CVE.

[risicle]

Looking more broadly, I don't think that CVE has been fixed anywhere, even in hdf master.

[dotlambda]

Marking it as insecure will impact a very high number of packages. What should we do?

[dotlambda]

I opened an upstream issue. I think we should merge this and discuss the remaining CVEs in the issue linked above.

[TredwellGit]

What needs to be done to get this merged?

[SuperSandro2000]

hdf5 builds locally fine.

Note:

hdf5: Ask if output path lib (4.3M) could be split with outputs = [ ... "lib" ];