Merge branch 'hardened-stdenv' into staging

Closes #12895

Amazing work by @globin & @fpletz getting hardened compiler flags by
enabled default on the whole package set

2 files changed, 32 insertions, 30 deletions

diff --git a/pkgs/applications/networking/mailreaders/alpine/default.nix b/pkgs/applications/networking/mailreaders/alpine/default.nix
index f2769946f7081..424619010e3b8 100644
--- a/pkgs/applications/networking/mailreaders/alpine/default.nix
+++ b/pkgs/applications/networking/mailreaders/alpine/default.nix
@@ -1,36 +1,37 @@
 {stdenv, fetchurl, ncurses, tcl, openssl, pam, pkgconfig, gettext, kerberos
 , openldap
 }:
+
 let
-  s = 
-  rec {
-    version = "2.00";
+  version = "2.00";
+  baseName = "alpine";
+in
+stdenv.mkDerivation {
+  name = "${baseName}-${version}";
+
+  src = fetchurl {
     url = "ftp://ftp.cac.washington.edu/alpine/alpine-${version}.tar.bz2";
     sha256 = "19m2w21dqn55rhxbh5lr9qarc2fqa9wmpj204jx7a0zrb90bhpf8";
-    baseName = "alpine";
-    name = "${baseName}-${version}";
   };
+
   buildInputs = [
     ncurses tcl openssl pam kerberos openldap
   ];
-in
-stdenv.mkDerivation {
-  inherit (s) name version;
-  inherit buildInputs;
-  src = fetchurl {
-    inherit (s) url sha256;
-  };
+
+  hardeningDisable = [ "format" "fortify" ];
+
   configureFlags = [
     "--with-ssl-include-dir=${openssl.dev}/include/openssl"
     "--with-tcl-lib=${tcl.libPrefix}"
     "--with-passfile=.pine-passfile"
-    ];
+  ];
+
   preConfigure = ''
     export NIX_LDFLAGS="$NIX_LDFLAGS -lgcc_s"
   '';
+
   meta = {
-    inherit (s) version;
-    description = ''Console mail reader'';
+    description = "Console mail reader";
     license = stdenv.lib.licenses.asl20;
     maintainers = [stdenv.lib.maintainers.raskin];
     platforms = stdenv.lib.platforms.linux;
diff --git a/pkgs/applications/networking/mailreaders/realpine/default.nix b/pkgs/applications/networking/mailreaders/realpine/default.nix
index 2247398ef7822..7ba582cdb5d05 100644
--- a/pkgs/applications/networking/mailreaders/realpine/default.nix
+++ b/pkgs/applications/networking/mailreaders/realpine/default.nix
@@ -2,34 +2,35 @@
 , openldap
 }:
 let
-  s = 
-  rec {
-    version = "2.03";
+  baseName = "re-alpine";
+  version = "2.03";
+in
+stdenv.mkDerivation {
+  name = "${baseName}-${version}";
+  inherit version;
+
+  src = fetchurl {
     url = "mirror://sourceforge/re-alpine/re-alpine-${version}.tar.bz2";
     sha256 = "11xspzbk9cwmklmcw6rxsan7j71ysd4m9c7qldlc59ck595k5nbh";
-    baseName = "re-alpine";
-    name = "${baseName}-${version}";
   };
+
   buildInputs = [
     ncurses tcl openssl pam kerberos openldap
   ];
-in
-stdenv.mkDerivation {
-  inherit (s) name version;
-  inherit buildInputs;
-  src = fetchurl {
-    inherit (s) url sha256;
-  };
+
+  hardeningDisable = [ "format" ];
+
   configureFlags = [
     "--with-ssl-include-dir=${openssl.dev}/include/openssl"
     "--with-tcl-lib=${tcl.libPrefix}"
-    ];
+  ];
+
   preConfigure = ''
     export NIX_LDFLAGS="$NIX_LDFLAGS -lgcc_s"
   '';
+
   meta = {
-    inherit (s) version;
-    description = ''Console mail reader'';
+    description = "Console mail reader";
     license = stdenv.lib.licenses.asl20;
     maintainers = [stdenv.lib.maintainers.raskin];
     platforms = stdenv.lib.platforms.linux;