diff --git a/doc/languages-frameworks/haskell.section.md b/doc/languages-frameworks/haskell.section.md
index d9246994676d..f81c1b77d84e 100644
--- a/doc/languages-frameworks/haskell.section.md
+++ b/doc/languages-frameworks/haskell.section.md
@@ -260,6 +260,14 @@ the same package with the `previousIntermediates` argument to support
incremental builds. See [“Incremental builds”](#haskell-incremental-builds) for
more information. Defaults to `false`.
+`dontConvertCabalFileToUnix`
+: By default, `haskellPackages.mkDerivation` converts the `.cabal` file of a
+given package to Unix line endings.
+This is intended to work around
+[Hackage converting revised `.cabal` files to DOS line endings](https://github.com/haskell/hackage-server/issues/316)
+which frequently causes patches to stop applying.
+You can pass `true` to disable this behavior.
+
`enableLibraryProfiling`
: Whether to enable [profiling][profiling] for libraries contained in the
package. Enabled by default if supported.
@@ -1249,8 +1257,8 @@ it does for the unstable branches.
### Why is topic X not covered in this section? Why is section Y missing? {#haskell-why-not-covered}
We have been working on [moving the nixpkgs Haskell documentation back into the
-nixpkgs manual](https://github.com/NixOS/nixpkgs/issues/121403). Since this
-process has not been completed yet, you may find some topics missing here
+nixpkgs manual](https://github.com/NixOS/nixpkgs/issues/121403).
+Since this process has not been completed yet, you may find some topics missing here
covered in the old [haskell4nix docs](https://haskell4nix.readthedocs.io/).
If you feel any important topic is not documented at all, feel free to comment
diff --git a/doc/redirects.json b/doc/redirects.json
index 4ba879f51d2b..b472d4fd1e13 100644
--- a/doc/redirects.json
+++ b/doc/redirects.json
@@ -119,6 +119,12 @@
"inkscape-plugins": [
"index.html#inkscape-plugins"
],
+ "libcxxhardeningextensive": [
+ "index.html#libcxxhardeningextensive"
+ ],
+ "libcxxhardeningfast": [
+ "index.html#libcxxhardeningfast"
+ ],
"julec-hook": [
"index.html#julec-hook"
],
@@ -247,6 +253,9 @@
"sec-building-packages-with-llvm-using-clang-stdenv": [
"index.html#sec-building-packages-with-llvm-using-clang-stdenv"
],
+ "sec-darwin-availability-checks": [
+ "index.html#sec-darwin-availability-checks"
+ ],
"sec-darwin-libcxx-deployment-targets": [
"index.html#sec-darwin-libcxx-deployment-targets"
],
@@ -1224,7 +1233,8 @@
"index.html#sec-purity-in-nixpkgs"
],
"sec-hardening-in-nixpkgs": [
- "index.html#sec-hardening-in-nixpkgs"
+ "index.html#sec-hardening-in-nixpkgs",
+ "index.html#pie"
],
"sec-hardening-flags-enabled-by-default": [
"index.html#sec-hardening-flags-enabled-by-default"
@@ -1259,9 +1269,6 @@
"sec-hardening-flags-disabled-by-default": [
"index.html#sec-hardening-flags-disabled-by-default"
],
- "pie": [
- "index.html#pie"
- ],
"shadowstack": [
"index.html#shadowstack"
],
diff --git a/doc/release-notes/rl-2511.section.md b/doc/release-notes/rl-2511.section.md
index ddb0f3a36b34..86a73b8f2d6e 100644
--- a/doc/release-notes/rl-2511.section.md
+++ b/doc/release-notes/rl-2511.section.md
@@ -12,6 +12,18 @@
- The default GHC version has been updated from 9.8 to 9.10.
`haskellPackages` correspondingly uses Stackage LTS 24 (instead of LTS 23) as a baseline.
+- **This release of Nixpkgs requires macOS Sonoma 14.0 or newer, as announced in the 25.05 release notes.**
+ The default SDK is now 14.4, but the minimum version is 14.0.
+ cc-wrapper will enforce that availability annotations are used or an appropriate deployment target is set.
+ See the Darwin platform notes for details.
+
+- **We expect to drop support for `x86_64-darwin` by Nixpkgs 26.11,** in light of Apple’s announcement that macOS 26 will be the final version to support Intel Macs.
+ When support is fully removed, we will no longer build packages for the platform or guarantee that it can build at all.
+ This may happen in stages, depending on our available build and maintenance resources and decisions made by projects we rely on.
+
+ By the time of 26.11’s release, Homebrew will offer only limited [Tier 3](https://docs.brew.sh/Support-Tiers#tier-3) support for the platform, but MacPorts will likely continue to support it for a long time.
+ We also recommend users consider installing NixOS, which should continue to run on essentially all Intel Macs, especially after Apple stops security support for macOS 26 in 2028.
+
- Darwin has switched to using the system libc++. This was done for improved compatibility and to avoid ODR violations.
If a newer C++ library feature is not available on the default deployment target, you will need to increase the deployment target.
See the Darwin platform documentation for more details.
@@ -49,6 +61,8 @@
- GHC 8.6, 8.10, 9.0, 9.2, and their package sets have been removed.
+- The `haskellPackages.mkDerivation` builder now converts packages' cabal files to Unix line endings before `patchPhase`. This behavior can be disabled using `dontConvertCabalFileToUnix`.
+
- `webkitgtk_4_0` has been removed because it depends on an unmaintained version of security-critical libsoup library (`libsoup_2`) and the support will be [dropped upstream soon](https://webkitgtk.org/2025/10/07/webkitgtk-soup2-deprecation.html).
- Support for bootstrapping native GHC compilers on 32‐bit ARM and little‐endian 64‐bit PowerPC has been dropped.
@@ -102,6 +116,8 @@
- `forgejo` main program has been renamed to `bin/forgejo` from the previous `bin/gitea`.
+- the "pie" hardening flag has been removed. compilers are expected to enable PIE by default, as has been common practice since 2016 outside of nixpkgs. If a package needs "pie" disabled pass `-no-pie` in `CFLAGS`. It is unlikely this will be necessary in many cases; due to the prevalance of default PIE toolchains most packages incompatible with PIE already pass no-pie.
+
- `wayclip` now uses the `ext-data-control-v1` Wayland protocol instead of `wlr-data-control-unstable-v1`.
- `cudaPackages.cudatoolkit-legacy-runfile` has been removed.
@@ -215,9 +231,10 @@
- `podofo` has been updated from `0.9.8` to `1.0.0`. These releases are by nature very incompatible due to major API changes. The legacy versions can be found under `podofo_0_10` and `podofo_0_9`.
Changelog: https://github.com/podofo/podofo/blob/1.0.0/CHANGELOG.md, API-Migration-Guide: https://github.com/podofo/podofo/blob/1.0.0/API-MIGRATION.md.
-- NetBox was updated to `>= 4.3.0`. Have a look at the breaking changes
- of the [4.3 release](https://github.com/netbox-community/netbox/releases/tag/v4.2.0),
- make the required changes to your database, if needed, then upgrade by setting `services.netbox.package = pkgs.netbox_4_3;` in your configuration.
+- NetBox was updated to `>= 4.4.0`. Have a look at the breaking changes
+ of the [4.3 release](https://github.com/netbox-community/netbox/releases/tag/v4.3.0)
+ and the [4.4 release](https://github.com/netbox-community/netbox/releases/tag/v4.4.0),
+ make the required changes to your database, if needed, then upgrade by setting `services.netbox.package = pkgs.netbox_4_4;` in your configuration.
- `privatebin` has been updated to `2.0.0`. This release changes configuration defaults including switching the template and removing legacy features. See the [v2.0.0 changelog entry](https://github.com/PrivateBin/PrivateBin/releases/tag/2.0.0) for details on how to upgrade.
@@ -269,6 +286,8 @@
- Added `gitConfig` and `gitConfigFile` option to the nixpkgs `config`, to allow for setting a default `gitConfigFile` for all `fetchgit` invocations.
+- Added `npmRegistryOverrides` and `npmRegistryOverridesString` option to the nixpkgs `config`, to allow for setting a default `npmRegistryOverridesString` for all `fetchNpmDeps` invocations.
+
- The `dockerTools.streamLayeredImage` builder now uses a better algorithm for generating layered docker images, such that much more sharing is possible when the number of store paths exceeds the layer limit. It gives each of the largest store paths its own layer and adds dependencies to those layers when they aren't used elsewhere.
- The systemd initrd will now respect `x-systemd.wants` and `x-systemd.requires` for reliably unlocking multi-disk bcachefs volumes.
@@ -288,7 +307,7 @@
- `idris2` supports being instantiated with a package environment with `idris.withPackages (p: [ ])`
-- New hardening flags, `strictflexarrays1` and `strictflexarrays3` were made available, corresponding to the gcc/clang options `-fstrict-flex-arrays=1` and `-fstrict-flex-arrays=3` respectively.
+- New hardening flags `strictflexarrays1`, `strictflexarrays3`, `glibcxxassertions`, `libcxxhardeningfast` and `libcxxhardeningextensive` were made available.
- `gramps` has been updated to 6.0.0
Upstream recommends [backing up your Family Trees](https://gramps-project.org/wiki/index.php/Gramps_6.0_Wiki_Manual_-_Manage_Family_Trees#Backing_up_a_Family_Tree) before upgrading.
@@ -313,8 +332,6 @@
and beware that the migration may take several hours depending on your library size and state.
The process must not be interrupted.
-- A new hardening flag, `glibcxxassertions` was made available, corresponding to the glibc `_GLIBCXX_ASSERTIONS` option.
-
- `versionCheckHook`: Packages that previously relied solely on `pname` to locate the program used to version check, but have a differing `meta.mainProgram` entry, might now fail.
@@ -331,6 +348,8 @@
- `nix-prefetch-git`: Added a `--no-add-path` argument to disable adding the path to the store; this is useful when working with a [read-only store](https://nix.dev/manual/nix/2.28/command-ref/new-cli/nix3-help-stores#store-experimental-local-overlay-store-read-only).
+- `fetchNpmDeps`: Add `npmRegistryOverridesString` argument to pass NPM registry overrides to the fetcher.
+
- `sftpman` has been updated to version 2, a rewrite in Rust which is mostly backward compatible but does include some changes to the CLI.
For more information, [check the project's README](https://github.com/spantaleev/sftpman-rs#is-sftpman-v2-compatible-with-sftpman-v1).
diff --git a/doc/stdenv/platform-notes.chapter.md b/doc/stdenv/platform-notes.chapter.md
index 06662bbc76fa..99d7cf33fa48 100644
--- a/doc/stdenv/platform-notes.chapter.md
+++ b/doc/stdenv/platform-notes.chapter.md
@@ -47,6 +47,17 @@ See below for how to use a newer deployment target.
For example, `std::print` depends on features that are only available on macOS 13.3 or newer.
To make them available, set the deployment target to 13.3 using `darwinMinVersionHook`.
+#### Package fails to build due to missing API availability checks {#sec-darwin-availability-checks}
+
+This is normally a bug in the package or a misconfigured deployment target.
+* If it is using an API from a newer release (e.g., from macOS 26.0 while targeting macOS 14.0), it needs to use an availability check.
+ The code should be patched to use [`__builtin_available`](https://clang.llvm.org/docs/LanguageExtensions.html#objective-c-available).
+ Note that while the linked documentation is for Objective-C, it is applicable to C and C++ except that you use `__builtin_available` in place of `@available`.
+* If the package intends to require the newer platform (i.e., it does not support running on older versions with reduced functionality), use `darwinMinVersionHook` to set the deployment target to the required version.
+ See below for how to use a newer deployment target.
+* If the package actually handles this through some other mechanism (e.g., MoltenVK relies on the running platform’s MSL version), the error can be suppressed.
+ To suppress the error, add `-Wno-error=unguarded-availability` to `env.NIX_CFLAGS_COMPILE`.
+
#### Package requires a non-default SDK or fails to build due to missing frameworks or symbols {#sec-darwin-troubleshooting-using-sdks}
In some cases, you may have to use a non-default SDK.
@@ -106,13 +117,10 @@ The following is a list of Xcode versions, the SDK version in Nixpkgs, and the a
Check your package’s documentation (platform support or installation instructions) to find which Xcode or SDK version to use.
Generally, only the last SDK release for a major version is packaged.
-| Xcode version | SDK version | Nixpkgs attribute |
-|--------------------|--------------------|------------------------------|
-| 12.0–12.5.1 | 11.3 | `apple-sdk_11` / `apple-sdk` |
-| 13.0–13.4.1 | 12.3 | `apple-sdk_12` |
-| 14.0–14.3.1 | 13.3 | `apple-sdk_13` |
-| 15.0–15.4 | 14.4 | `apple-sdk_14` |
-| 16.0 | 15.0 | `apple-sdk_15` |
+| Xcode version | SDK version | Nixpkgs attribute |
+|--------------------|--------------------|-------------------------------|
+| 15.0–15.4 | 14.4 | `apple-sdk_14` / `apple-sdk` |
+| 16.0 | 15.0 | `apple-sdk_15` |
#### Darwin Default SDK versions {#sec-darwin-troubleshooting-darwin-defaults}
diff --git a/doc/stdenv/stdenv.chapter.md b/doc/stdenv/stdenv.chapter.md
index 24536c35b2c3..2a0b239740c0 100644
--- a/doc/stdenv/stdenv.chapter.md
+++ b/doc/stdenv/stdenv.chapter.md
@@ -1631,19 +1631,6 @@ The following flags are disabled by default and should be enabled with `hardenin
This flag adds the `-fno-strict-aliasing` compiler option, which prevents the compiler from assuming code has been written strictly following the standard in regards to pointer aliasing and therefore performing optimizations that may be unsafe for code that has not followed these rules.
-#### `pie` {#pie}
-
-This flag is disabled by default for normal `glibc` based NixOS package builds, but enabled by default for
-
- - `musl`-based package builds, except on Aarch64 and Aarch32, where there are issues.
-
- - Statically-linked for OpenBSD builds, where it appears to be required to get a working binary.
-
-Adds the `-fPIE` compiler and `-pie` linker options. Position Independent Executables are needed to take advantage of Address Space Layout Randomization, supported by modern kernel versions. While ASLR can already be enforced for data areas in the stack and heap (brk and mmap), the code areas must be compiled as position-independent. Shared libraries already do this with the `pic` flag, so they gain ASLR automatically, but binary .text regions need to be build with `pie` to gain ASLR. When this happens, ROP attacks are much harder since there are no static locations to bounce off of during a memory corruption attack.
-
-Static libraries need to be compiled with `-fPIE` so that executables can link them in with the `-pie` linker option.
-If the libraries lack `-fPIE`, you will get the error `recompile with -fPIE`.
-
#### `strictflexarrays1` {#strictflexarrays1}
This flag adds the `-fstrict-flex-arrays=1` compiler option, which reduces the cases the compiler treats as "flexible arrays" to those declared with length `[1]`, `[0]` or (the correct) `[]`. This increases the coverage of fortify checks, because such arrays declared as the trailing element of a structure can normally not have their intended length determined by the compiler.
@@ -1688,6 +1675,18 @@ Adds the `-D_GLIBCXX_ASSERTIONS` compiler flag. This flag only has an effect on
These checks may have an impact on performance in some cases.
+#### `libcxxhardeningfast` {#libcxxhardeningfast}
+
+Adds the `-D_LIBCPP_HARDENING_MODE=_LIBCPP_HARDENING_MODE_FAST` compiler flag. This flag only has an effect on libc++ targets, and when defined, enables a set of assertions that prevent undefined behavior caused by violating preconditions of the standard library. libc++ provides several hardening modes, and this "fast" mode contains a set of security-critical checks that can be done with relatively little overhead in constant time.
+
+Disabling `libcxxhardeningfast` implies disablement of checks from `libcxxhardeningextensive`.
+
+#### `libcxxhardeningextensive` {#libcxxhardeningextensive}
+
+Adds the `-D_LIBCPP_HARDENING_MODE=_LIBCPP_HARDENING_MODE_EXTENSIVE` compiler flag. This flag only has an effect on libc++ targets, and when defined, enables a set of assertions that prevent undefined behavior caused by violating preconditions of the standard library. libc++ provides several hardening modes, and this "extensive" mode adds checks for undefined behavior that incur relatively little overhead but aren’t security-critical. The additional rigour impacts performance more than fast mode: benchmarking is recommended to determine if it is acceptable for a particular application.
+
+Enabling this flag implies enablement of checks from `libcxxhardeningfast`. Disabling this flag does not imply disablement of checks from `libcxxhardeningfast`.
+
#### `pacret` {#pacret}
This flag adds the `-mbranch-protection=pac-ret` compiler option on aarch64-linux targets. This uses ARM v8.3's Pointer Authentication feature to sign function return pointers before adding them to the stack. The pointer's authenticity is then validated before returning to its destination. This dramatically increases the difficulty of ROP exploitation techniques.
diff --git a/lib/systems/default.nix b/lib/systems/default.nix
index 96bde04151ae..cd1448d811fa 100644
--- a/lib/systems/default.nix
+++ b/lib/systems/default.nix
@@ -360,8 +360,8 @@ let
null;
# The canonical name for this attribute is darwinSdkVersion, but some
# platforms define the old name "sdkVer".
- darwinSdkVersion = final.sdkVer or "11.3";
- darwinMinVersion = final.darwinSdkVersion;
+ darwinSdkVersion = final.sdkVer or "14.4";
+ darwinMinVersion = "14.0";
darwinMinVersionVariable =
if final.isMacOS then
"MACOSX_DEPLOYMENT_TARGET"
diff --git a/nixos/modules/services/web-apps/netbox.nix b/nixos/modules/services/web-apps/netbox.nix
index c61f217b4b68..440c0e89a389 100644
--- a/nixos/modules/services/web-apps/netbox.nix
+++ b/nixos/modules/services/web-apps/netbox.nix
@@ -109,10 +109,10 @@ in
package = lib.mkOption {
type = lib.types.package;
default =
- if lib.versionAtLeast config.system.stateVersion "25.11" then pkgs.netbox_4_3 else pkgs.netbox_4_2;
+ if lib.versionAtLeast config.system.stateVersion "25.11" then pkgs.netbox_4_4 else pkgs.netbox_4_2;
defaultText = lib.literalExpression ''
if lib.versionAtLeast config.system.stateVersion "25.11"
- then pkgs.netbox_4_3
+ then pkgs.netbox_4_4
else pkgs.netbox_4_2;
'';
description = ''
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index bcb00f3b067f..3bb260977e7a 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -1006,6 +1006,7 @@ in
netbox-upgrade = runTest ./web-apps/netbox-upgrade.nix;
netbox_4_2 = handleTest ./web-apps/netbox/default.nix { netbox = pkgs.netbox_4_2; };
netbox_4_3 = handleTest ./web-apps/netbox/default.nix { netbox = pkgs.netbox_4_3; };
+ netbox_4_4 = handleTest ./web-apps/netbox/default.nix { netbox = pkgs.netbox_4_4; };
netdata = runTest ./netdata.nix;
networking.networkd = handleTest ./networking/networkd-and-scripted.nix { networkd = true; };
networking.networkmanager = handleTest ./networking/networkmanager.nix { };
diff --git a/nixos/tests/login.nix b/nixos/tests/login.nix
index ab80b8aaabf0..bd0d3b7bc005 100644
--- a/nixos/tests/login.nix
+++ b/nixos/tests/login.nix
@@ -48,13 +48,12 @@
machine.wait_for_file("/home/alice/done")
with subtest("Systemd gives and removes device ownership as needed"):
- # Change back to /dev/snd/timer after systemd-258.1
- machine.succeed("getfacl /dev/dri/card0 | grep -q alice")
+ machine.succeed("getfacl /dev/snd/timer | grep -q alice")
machine.send_key("alt-f1")
machine.wait_until_succeeds("[ $(fgconsole) = 1 ]")
- machine.fail("getfacl /dev/dri/card0 | grep -q alice")
+ machine.fail("getfacl /dev/snd/timer | grep -q alice")
machine.succeed("chvt 2")
- machine.wait_until_succeeds("getfacl /dev/dri/card0 | grep -q alice")
+ machine.wait_until_succeeds("getfacl /dev/snd/timer | grep -q alice")
with subtest("Virtual console logout"):
machine.send_chars("exit\n")
diff --git a/nixos/tests/web-apps/netbox-upgrade.nix b/nixos/tests/web-apps/netbox-upgrade.nix
index 29b553829dcb..5b60e8939ccb 100644
--- a/nixos/tests/web-apps/netbox-upgrade.nix
+++ b/nixos/tests/web-apps/netbox-upgrade.nix
@@ -1,7 +1,7 @@
{ lib, pkgs, ... }:
let
- oldNetbox = "netbox_4_2";
- newNetbox = "netbox_4_3";
+ oldNetbox = "netbox_4_3";
+ newNetbox = "netbox_4_4";
apiVersion =
version:
diff --git a/nixos/tests/web-apps/netbox/testScript.py b/nixos/tests/web-apps/netbox/testScript.py
index 7d0f9bff10c7..f6c2c9821e12 100644
--- a/nixos/tests/web-apps/netbox/testScript.py
+++ b/nixos/tests/web-apps/netbox/testScript.py
@@ -61,7 +61,7 @@ def compare(a: str, b: str):
return 0
with subtest("Home screen loads"):
- machine.succeed(
+ machine.wait_until_succeeds(
"curl -sSfL http://[::1]:8001 | grep '
Home | NetBox'"
)
diff --git a/pkgs/applications/audio/magnetophonDSP/VoiceOfFaust/default.nix b/pkgs/applications/audio/magnetophonDSP/VoiceOfFaust/default.nix
index 8a2974b8517b..220d3fe68d53 100644
--- a/pkgs/applications/audio/magnetophonDSP/VoiceOfFaust/default.nix
+++ b/pkgs/applications/audio/magnetophonDSP/VoiceOfFaust/default.nix
@@ -32,10 +32,6 @@ stdenv.mkDerivation rec {
faust2lv2
];
- # ld: crtbegin.o: relocation R_X86_64_32 against hidden symbol `__TMC_END__' can not be used when making a PIE object
- # ld: failed to set dynamic section sizes: bad value
- hardeningDisable = [ "pie" ];
-
enableParallelBuilding = true;
dontWrapQtApps = true;
diff --git a/pkgs/applications/editors/vim/common.nix b/pkgs/applications/editors/vim/common.nix
index de4362946baa..eb20cd063c8e 100644
--- a/pkgs/applications/editors/vim/common.nix
+++ b/pkgs/applications/editors/vim/common.nix
@@ -1,6 +1,6 @@
{ lib, fetchFromGitHub }:
rec {
- version = "9.1.1833";
+ version = "9.1.1869";
outputs = [
"out"
@@ -11,7 +11,7 @@ rec {
owner = "vim";
repo = "vim";
rev = "v${version}";
- hash = "sha256-bcHTwrJt7ERsIYydCj+Um4AY7sREtkdkqlEA0OdgnuM=";
+ hash = "sha256-AHx4AHsJAsEE5LRzKgBeV3LoCaoHUB+0/gq7kOHObMk=";
};
enableParallelBuilding = true;
diff --git a/pkgs/applications/emulators/wine/base.nix b/pkgs/applications/emulators/wine/base.nix
index 9ac68c4ffcea..4665547f501d 100644
--- a/pkgs/applications/emulators/wine/base.nix
+++ b/pkgs/applications/emulators/wine/base.nix
@@ -40,12 +40,6 @@ let
};
} ./setup-hook-darwin.sh;
- # Using the 14.4 SDK allows Wine to use `os_sync_wait_on_address` for its futex implementation on Darwin.
- # It does an availability check, so older systems will still work.
- darwinFrameworks = lib.optionals stdenv.hostPlatform.isDarwin (
- toBuildInputs pkgArches (pkgs: [ pkgs.apple-sdk_14 ])
- );
-
# Building Wine with these flags isn’t supported on Darwin. Using any of them will result in an evaluation failures
# because they will put Darwin in `meta.badPlatforms`.
darwinUnsupportedFlags = [
@@ -168,7 +162,6 @@ stdenv.mkDerivation (
pkgs.libGL
pkgs.libdrm
]
- ++ lib.optionals stdenv.hostPlatform.isDarwin darwinFrameworks
++ lib.optionals x11Support (
with pkgs.xorg;
[
@@ -213,11 +206,7 @@ stdenv.mkDerivation (
# LD_LIBRARY_PATH.
NIX_LDFLAGS = toString (
map (path: "-rpath " + path) (
- map (x: "${lib.getLib x}/lib") (
- [ stdenv.cc.cc ]
- # Avoid adding rpath references to non-existent framework `lib` paths.
- ++ lib.subtractLists darwinFrameworks finalAttrs.buildInputs
- )
+ map (x: "${lib.getLib x}/lib") [ stdenv.cc.cc ]
# libpulsecommon.so is linked but not found otherwise
++ lib.optionals supportFlags.pulseaudioSupport (
map (x: "${lib.getLib x}/lib/pulseaudio") (toBuildInputs pkgArches (pkgs: [ pkgs.libpulseaudio ]))
diff --git a/pkgs/applications/networking/cluster/linkerd/generic.nix b/pkgs/applications/networking/cluster/linkerd/generic.nix
index ef5835bcd6db..20f07da27e2b 100644
--- a/pkgs/applications/networking/cluster/linkerd/generic.nix
+++ b/pkgs/applications/networking/cluster/linkerd/generic.nix
@@ -31,11 +31,6 @@ buildGoModule rec {
env GOFLAGS="" go generate ./jaeger/static
env GOFLAGS="" go generate ./multicluster/static
env GOFLAGS="" go generate ./viz/static
-
- # Necessary for building Musl
- if [[ $NIX_HARDENING_ENABLE =~ "pie" ]]; then
- export GOFLAGS="-buildmode=pie $GOFLAGS"
- fi
'';
tags = [
diff --git a/pkgs/applications/networking/irc/weechat/default.nix b/pkgs/applications/networking/irc/weechat/default.nix
index 3cea1541e636..f7c4235b16a8 100644
--- a/pkgs/applications/networking/irc/weechat/default.nix
+++ b/pkgs/applications/networking/irc/weechat/default.nix
@@ -158,8 +158,6 @@ stdenv.mkDerivation rec {
++ lib.concatMap (p: p.buildInputs) enabledPlugins
++ extraBuildInputs;
- hardeningEnable = [ "pie" ];
-
env.NIX_CFLAGS_COMPILE =
"-I${python}/include/${python.libPrefix}"
# Fix '_res_9_init: undefined symbol' error
diff --git a/pkgs/applications/networking/sync/rsync/default.nix b/pkgs/applications/networking/sync/rsync/default.nix
index c38d5913d2ea..4dccabbf7fbf 100644
--- a/pkgs/applications/networking/sync/rsync/default.nix
+++ b/pkgs/applications/networking/sync/rsync/default.nix
@@ -19,7 +19,6 @@
enableZstd ? true,
zstd,
nixosTests,
- fakeroot,
}:
stdenv.mkDerivation rec {
@@ -58,9 +57,6 @@ stdenv.mkDerivation rec {
++ lib.optional enableOpenSSL openssl
++ lib.optional enableXXHash xxHash;
- # fakeroot doesn't work well on darwin anymore, apparently
- checkInputs = lib.optionals (!stdenv.isDarwin) [ fakeroot ];
-
configureFlags = [
(lib.enableFeature enableLZ4 "lz4")
(lib.enableFeature enableOpenSSL "openssl")
diff --git a/pkgs/applications/office/pdfmixtool/default.nix b/pkgs/applications/office/pdfmixtool/default.nix
deleted file mode 100644
index f19bd4dadf93..000000000000
--- a/pkgs/applications/office/pdfmixtool/default.nix
+++ /dev/null
@@ -1,60 +0,0 @@
-{
- lib,
- mkDerivation,
- fetchFromGitLab,
- fetchpatch,
- fetchpatch2,
- cmake,
- pkg-config,
- qtbase,
- qttools,
- qpdf,
- podofo,
- imagemagick,
-}:
-
-mkDerivation rec {
- pname = "pdfmixtool";
- version = "1.1.1";
-
- src = fetchFromGitLab {
- owner = "scarpetta";
- repo = "pdfmixtool";
- rev = "v${version}";
- hash = "sha256-fgtRKUG6J/CM6cXUTHWAPemqL8loWZT3wZmGdRHldq8=";
- };
-
- nativeBuildInputs = [
- cmake
- pkg-config
- ];
-
- buildInputs = [
- imagemagick
- qtbase
- qttools
- qpdf
- podofo
- ];
-
- patches = [
- # fix incompatibility with qpdf11.3.0 usage of c++17 - delete this patch when we reach pdfmixtool version > v1.1.1
- (fetchpatch {
- url = "https://gitlab.com/scarpetta/pdfmixtool/-/commit/bd5f78c3a4d977d9b0c74302ce2521c737189b43.diff";
- hash = "sha256-h2g5toFqgEEnObd2TYQms1a1WFTgN7VsIHyy0Uyq4/I=";
- })
- # https://gitlab.com/scarpetta/pdfmixtool/-/merge_requests/14
- (fetchpatch2 {
- url = "https://gitlab.com/scarpetta/pdfmixtool/-/commit/268291317ccd1805dc1c801ff88641ba06c6a7f0.patch";
- hash = "sha256-56bDoFtE+IOQHcV9xPfyrgYYFvTfB0QiLIfRl91irb0=";
- })
- ];
-
- meta = with lib; {
- description = "Application to split, merge, rotate and mix PDF files";
- mainProgram = "pdfmixtool";
- homepage = "https://gitlab.com/scarpetta/pdfmixtool";
- license = licenses.gpl3Only;
- maintainers = with maintainers; [ onny ];
- };
-}
diff --git a/pkgs/applications/version-management/git/default.nix b/pkgs/applications/version-management/git/default.nix
index 0e3fd51885d6..5ca46db3dcf9 100644
--- a/pkgs/applications/version-management/git/default.nix
+++ b/pkgs/applications/version-management/git/default.nix
@@ -60,7 +60,7 @@ assert sendEmailSupport -> perlSupport;
assert svnSupport -> perlSupport;
let
- version = "2.51.0";
+ version = "2.51.2";
svn = subversionClient.override { perlBindings = perlSupport; };
gitwebPerlLibs = with perlPackages; [
CGI
@@ -89,7 +89,7 @@ stdenv.mkDerivation (finalAttrs: {
}.tar.xz"
else
"https://www.kernel.org/pub/software/scm/git/git-${version}.tar.xz";
- hash = "sha256-YKfCJRzC5YjVzYe65WcmBhfG3gwi3KnNv8TH0riZC2I=";
+ hash = "sha256-Iz1xQ6LVjmB1Xu6bdvVZ7HPqKzwpf1tQMWKs6VlmtOM=";
};
outputs = [ "out" ] ++ lib.optional withManual "doc";
@@ -489,6 +489,12 @@ stdenv.mkDerivation (finalAttrs: {
disable_test t5319-multi-pack-index
disable_test t6421-merge-partial-clone
disable_test t7504-commit-msg-hook
+ disable_test t5515-fetch-merge-logic
+ disable_test t4104-apply-boundary
+ disable_test t7002-mv-sparse-checkout
+ disable_test t4122-apply-symlink-inside
+ disable_test t7513-interpret-trailers
+ disable_test t2200-add-update
# Fails reproducibly on ZFS on Linux with formD normalization
disable_test t0021-conversion
diff --git a/pkgs/applications/virtualization/qemu/default.nix b/pkgs/applications/virtualization/qemu/default.nix
index fb46fb38a925..41eb546cff0d 100644
--- a/pkgs/applications/virtualization/qemu/default.nix
+++ b/pkgs/applications/virtualization/qemu/default.nix
@@ -32,8 +32,6 @@
socat,
libslirp,
libcbor,
- apple-sdk_13,
- darwinMinVersionHook,
guestAgentSupport ?
(with stdenv.hostPlatform; isLinux || isNetBSD || isOpenBSD || isSunOS || isWindows) && !minimal,
numaSupport ? stdenv.hostPlatform.isLinux && !stdenv.hostPlatform.isAarch32 && !minimal,
@@ -128,14 +126,6 @@ assert lib.assertMsg (
let
hexagonSupport = hostCpuTargets == null || lib.elem "hexagon" hostCpuTargets;
-
- # needed in buildInputs and depsBuildBuild
- # check log for warnings eg: `warning: 'hv_vm_config_get_max_ipa_size' is only available on macOS 13.0`
- # to indicate if min version needs to get bumped.
- darwinSDK = [
- apple-sdk_13
- (darwinMinVersionHook "13")
- ];
in
stdenv.mkDerivation (finalAttrs: {
@@ -156,7 +146,6 @@ stdenv.mkDerivation (finalAttrs: {
depsBuildBuild = [
buildPackages.stdenv.cc
]
- ++ lib.optionals stdenv.buildPlatform.isDarwin darwinSDK
++ lib.optionals hexagonSupport [ pkg-config ];
nativeBuildInputs = [
@@ -205,7 +194,6 @@ stdenv.mkDerivation (finalAttrs: {
]
++ lib.optionals (!userOnly) [ curl ]
++ lib.optionals ncursesSupport [ ncurses ]
- ++ lib.optionals stdenv.hostPlatform.isDarwin darwinSDK
++ lib.optionals seccompSupport [ libseccomp ]
++ lib.optionals numaSupport [ numactl ]
++ lib.optionals alsaSupport [ alsa-lib ]
diff --git a/pkgs/build-support/bintools-wrapper/add-hardening.sh b/pkgs/build-support/bintools-wrapper/add-hardening.sh
index db9553c3fc76..6ce4faf1720b 100644
--- a/pkgs/build-support/bintools-wrapper/add-hardening.sh
+++ b/pkgs/build-support/bintools-wrapper/add-hardening.sh
@@ -15,7 +15,7 @@ for flag in @hardening_unsupported_flags@; do
done
if (( "${NIX_DEBUG:-0}" >= 1 )); then
- declare -a allHardeningFlags=(pie relro bindnow)
+ declare -a allHardeningFlags=(relro bindnow)
declare -A hardeningDisableMap=()
# Determine which flags were effectively disabled so we can report below.
@@ -36,16 +36,6 @@ fi
for flag in "${!hardeningEnableMap[@]}"; do
case $flag in
- pie)
- if [[ ! (" ${params[*]} " =~ " -shared " \
- || " ${params[*]} " =~ " -static " \
- || " ${params[*]} " =~ " -r " \
- || " ${params[*]} " =~ " -Ur " \
- || " ${params[*]} " =~ " -i ") ]]; then
- if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling LDFlags -pie >&2; fi
- hardeningLDFlags+=('-pie')
- fi
- ;;
relro)
if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling relro >&2; fi
hardeningLDFlags+=('-z' 'relro')
diff --git a/pkgs/build-support/bintools-wrapper/default.nix b/pkgs/build-support/bintools-wrapper/default.nix
index 4ceddfa59db5..8f5613e9e7bb 100644
--- a/pkgs/build-support/bintools-wrapper/default.nix
+++ b/pkgs/build-support/bintools-wrapper/default.nix
@@ -49,30 +49,15 @@
"format"
"fortify"
"fortify3"
+ "libcxxhardeningextensive"
+ "libcxxhardeningfast"
"pic"
"relro"
"stackclashprotection"
"stackprotector"
"strictoverflow"
"zerocallusedregs"
- ]
- ++ lib.optional (
- with stdenvNoCC;
- lib.any (x: x) [
- # OpenBSD static linking requires PIE
- (with targetPlatform; isOpenBSD && isStatic)
- (lib.all (x: x) [
- # Musl-based platforms will keep "pie", other platforms will not.
- # If you change this, make sure to update section `{#sec-hardening-in-nixpkgs}`
- # in the nixpkgs manual to inform users about the defaults.
- (targetPlatform.libc == "musl")
- # Except when:
- # - static aarch64, where compilation works, but produces segfaulting dynamically linked binaries.
- # - static armv7l, where compilation fails.
- (!(targetPlatform.isAarch && targetPlatform.isStatic))
- ])
- ]
- ) "pie",
+ ],
}:
assert propagateDoc -> bintools ? man;
diff --git a/pkgs/build-support/build-mozilla-mach/142-relax-apple-sdk.patch b/pkgs/build-support/build-mozilla-mach/142-relax-apple-sdk.patch
deleted file mode 100644
index c6e28f11be2f..000000000000
--- a/pkgs/build-support/build-mozilla-mach/142-relax-apple-sdk.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-diff --git a/build/moz.configure/toolchain.configure b/build/moz.configure/toolchain.configure
-index 37c00230c853..dd89bea24392 100644
---- a/build/moz.configure/toolchain.configure
-+++ b/build/moz.configure/toolchain.configure
-@@ -233,7 +233,7 @@ with only_when(host_is_osx | target_is_osx):
- )
-
- def mac_sdk_min_version():
-- return "15.5"
-+ return "15.2"
-
- @depends(
- "--with-macos-sdk",
diff --git a/pkgs/build-support/build-mozilla-mach/default.nix b/pkgs/build-support/build-mozilla-mach/default.nix
index 610bd353568a..3437e90f89d3 100644
--- a/pkgs/build-support/build-mozilla-mach/default.nix
+++ b/pkgs/build-support/build-mozilla-mach/default.nix
@@ -327,15 +327,6 @@ buildStdenv.mkDerivation {
# https://hg-edge.mozilla.org/mozilla-central/rev/aa8a29bd1fb9
./139-wayland-drag-animation.patch
]
- ++
- lib.optionals
- (
- lib.versionAtLeast version "141.0.2"
- || (lib.versionAtLeast version "140.2.0" && lib.versionOlder version "141.0")
- )
- [
- ./142-relax-apple-sdk.patch
- ]
++ extraPatches;
postPatch = ''
diff --git a/pkgs/build-support/buildenv/builder.pl b/pkgs/build-support/buildenv/builder.pl
index f2fdf36f79e5..f66acf3d5e75 100755
--- a/pkgs/build-support/buildenv/builder.pl
+++ b/pkgs/build-support/buildenv/builder.pl
@@ -15,7 +15,7 @@ $SIG{__DIE__} = sub { die "pkgs.buildEnv error: ", @_ };
my $out = $ENV{"out"};
my $extraPrefix = $ENV{"extraPrefix"};
-my @pathsToLink = split ' ', $ENV{"pathsToLink"};
+my @pathsToLink = @{decode_json $ENV{"pathsToLinkJSON"}};
sub isInPathsToLink($path) {
$path = "/" if $path eq "";
diff --git a/pkgs/build-support/buildenv/default.nix b/pkgs/build-support/buildenv/default.nix
index dbeb2a629f20..5996239a16b4 100644
--- a/pkgs/build-support/buildenv/default.nix
+++ b/pkgs/build-support/buildenv/default.nix
@@ -105,6 +105,7 @@ lib.makeOverridable (
nativeBuildInputs
buildInputs
;
+ pathsToLinkJSON = builtins.toJSON pathsToLink;
pkgs = builtins.toJSON chosenOutputs;
extraPathsFrom = lib.optional includeClosures (writeClosure pathsForClosure);
preferLocalBuild = true;
diff --git a/pkgs/build-support/cc-wrapper/add-clang-cc-cflags-before.sh b/pkgs/build-support/cc-wrapper/add-clang-cc-cflags-before.sh
index 2b7cd00783a5..865e0d054820 100644
--- a/pkgs/build-support/cc-wrapper/add-clang-cc-cflags-before.sh
+++ b/pkgs/build-support/cc-wrapper/add-clang-cc-cflags-before.sh
@@ -35,3 +35,7 @@ elif [[ $0 != *cpp ]]; then
extraBefore+=(-mabi=@explicitAbiValue@)
fi
fi
+
+if [[ "@darwinMinVersion@" ]]; then
+ extraBefore+=(-Werror=unguarded-availability)
+fi
diff --git a/pkgs/build-support/cc-wrapper/add-hardening.sh b/pkgs/build-support/cc-wrapper/add-hardening.sh
index 4fd6d4b32463..98369ff82076 100644
--- a/pkgs/build-support/cc-wrapper/add-hardening.sh
+++ b/pkgs/build-support/cc-wrapper/add-hardening.sh
@@ -25,6 +25,13 @@ if [[ -n "${hardeningEnableMap[strictflexarrays3]-}" ]]; then
hardeningEnableMap["strictflexarrays1"]=1
fi
+# libcxxhardeningextensive implies libcxxhardeningfast enablement - make explicit before
+# we filter unsupported flags because unsupporting libcxxhardeningextensive
+# doesn't mean we should unsupport libcxxhardeningfast too
+if [[ -n "${hardeningEnableMap[libcxxhardeningextensive]-}" ]]; then
+ hardeningEnableMap["libcxxhardeningfast"]=1
+fi
+
# Remove unsupported flags.
for flag in @hardening_unsupported_flags@; do
@@ -37,6 +44,10 @@ for flag in @hardening_unsupported_flags@; do
if [[ "$flag" = 'strictflexarrays1' ]] ; then
unset -v "hardeningEnableMap['strictflexarrays3']"
fi
+ # libcxxhardeningfast being unsupported implies libcxxhardeningextensive is unsupported
+ if [[ "$flag" = 'libcxxhardeningfast' ]] ; then
+ unset -v "hardeningEnableMap['libcxxhardeningextensive']"
+ fi
done
@@ -50,9 +61,14 @@ if [[ -n "${hardeningEnableMap[strictflexarrays3]-}" ]]; then
unset -v "hardeningEnableMap['strictflexarrays1']"
fi
+# now make libcxxhardeningfast and libcxxhardeningextensive mutually exclusive
+if [[ -n "${hardeningEnableMap[libcxxhardeningextensive]-}" ]]; then
+ unset -v "hardeningEnableMap['libcxxhardeningfast']"
+fi
+
if (( "${NIX_DEBUG:-0}" >= 1 )); then
- declare -a allHardeningFlags=(fortify fortify3 shadowstack stackprotector stackclashprotection nostrictaliasing pacret strictflexarrays1 strictflexarrays3 pie pic strictoverflow glibcxxassertions format trivialautovarinit zerocallusedregs)
+ declare -a allHardeningFlags=(fortify fortify3 shadowstack stackprotector stackclashprotection nostrictaliasing pacret strictflexarrays1 strictflexarrays3 pic strictoverflow libcxxhardeningfast libcxxhardeningextensive glibcxxassertions format trivialautovarinit zerocallusedregs)
declare -A hardeningDisableMap=()
# Determine which flags were effectively disabled so we can report below.
@@ -115,27 +131,26 @@ for flag in "${!hardeningEnableMap[@]}"; do
if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling glibcxxassertions >&2; fi
hardeningCFlagsBefore+=('-D_GLIBCXX_ASSERTIONS')
;;
+ libcxxhardeningfast)
+ if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling libcxxhardeningfast >&2; fi
+ hardeningCFlagsBefore+=('-D_LIBCPP_HARDENING_MODE=_LIBCPP_HARDENING_MODE_FAST')
+ ;;
+ libcxxhardeningextensive)
+ if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling libcxxhardeningextensive >&2; fi
+ hardeningCFlagsBefore+=('-D_LIBCPP_HARDENING_MODE=_LIBCPP_HARDENING_MODE_EXTENSIVE')
+ ;;
stackprotector)
if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling stackprotector >&2; fi
hardeningCFlagsBefore+=('-fstack-protector-strong' '--param' 'ssp-buffer-size=4')
;;
stackclashprotection)
- if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling stack-clash-protection >&2; fi
+ if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling stackclashprotection >&2; fi
hardeningCFlagsBefore+=('-fstack-clash-protection')
;;
nostrictaliasing)
if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling nostrictaliasing >&2; fi
hardeningCFlagsBefore+=('-fno-strict-aliasing')
;;
- pie)
- # NB: we do not use `+=` here, because PIE flags must occur before any PIC flags
- if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling CFlags -fPIE >&2; fi
- hardeningCFlagsBefore=('-fPIE' "${hardeningCFlagsBefore[@]}")
- if [[ ! (" ${params[*]} " =~ " -shared " || " ${params[*]} " =~ " -static ") ]]; then
- if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling LDFlags -pie >&2; fi
- hardeningCFlagsBefore=('-pie' "${hardeningCFlagsBefore[@]}")
- fi
- ;;
pic)
if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling pic >&2; fi
hardeningCFlagsBefore+=('-fPIC')
diff --git a/pkgs/build-support/cc-wrapper/cc-wrapper.sh b/pkgs/build-support/cc-wrapper/cc-wrapper.sh
index eb5b99643dba..246c1b1f65f6 100644
--- a/pkgs/build-support/cc-wrapper/cc-wrapper.sh
+++ b/pkgs/build-support/cc-wrapper/cc-wrapper.sh
@@ -140,6 +140,15 @@ if [ "$NIX_ENFORCE_NO_NATIVE_@suffixSalt@" = 1 ]; then
params=(${kept+"${kept[@]}"})
fi
+# Some build systems such as Bazel and SwiftPM use `clang` instead of `clang++`,
+# which will find the libc++ headers in the sysroot for C++ files.
+if [[ "$isCxx" = 0 && "@isClang@" ]]; then
+# This duplicates the behavior of a native toolchain, which can find the
+# libc++ headers but requires `-lc++` to be specified explicitly when linking.
+ isCxx=1
+ cxxLibrary=0
+fi
+
if [[ "$isCxx" = 1 ]]; then
if [[ "$cxxInclude" = 1 ]]; then
#
diff --git a/pkgs/build-support/cc-wrapper/default.nix b/pkgs/build-support/cc-wrapper/default.nix
index 3c6126786fcc..f5f6d7a98be5 100644
--- a/pkgs/build-support/cc-wrapper/default.nix
+++ b/pkgs/build-support/cc-wrapper/default.nix
@@ -753,14 +753,14 @@ stdenvNoCC.mkDerivation {
# https://github.com/NixOS/nixpkgs/pull/209870#issuecomment-1500550903)
+ optionalString (libcxx == null && isClang && (useGccForLibs && gccForLibs.langCC or false)) ''
for dir in ${gccForLibs}/include/c++/*; do
- include -isystem "$dir" >> $out/nix-support/libcxx-cxxflags
+ include -cxx-isystem "$dir" >> $out/nix-support/libcxx-cxxflags
done
for dir in ${gccForLibs}/include/c++/*/${targetPlatform.config}; do
- include -isystem "$dir" >> $out/nix-support/libcxx-cxxflags
+ include -cxx-isystem "$dir" >> $out/nix-support/libcxx-cxxflags
done
''
+ optionalString (libcxx.isLLVM or false) ''
- include -isystem "${getDev libcxx}/include/c++/v1" >> $out/nix-support/libcxx-cxxflags
+ include -cxx-isystem "${getDev libcxx}/include/c++/v1" >> $out/nix-support/libcxx-cxxflags
echo "-stdlib=libc++" >> $out/nix-support/libcxx-ldflags
''
# GCC NG friendly libc++
diff --git a/pkgs/build-support/go/module.nix b/pkgs/build-support/go/module.nix
index eaeb6e075ae4..30542b1d16c6 100644
--- a/pkgs/build-support/go/module.nix
+++ b/pkgs/build-support/go/module.nix
@@ -250,6 +250,9 @@ lib.extendMkDerivation {
export GOPATH="$TMPDIR/go"
export GOPROXY=off
export GOSUMDB=off
+ if [ -f "$NIX_CC_FOR_TARGET/nix-support/dynamic-linker" ]; then
+ export GO_LDSO=$(cat $NIX_CC_FOR_TARGET/nix-support/dynamic-linker)
+ fi
cd "$modRoot"
''
+ lib.optionalString (finalAttrs.vendorHash != null) ''
@@ -266,13 +269,6 @@ lib.extendMkDerivation {
}
''
+ ''
-
- # currently pie is only enabled by default in pkgsMusl
- # this will respect the `hardening{Disable,Enable}` flags if set
- if [[ $NIX_HARDENING_ENABLE =~ "pie" ]]; then
- export GOFLAGS="-buildmode=pie $GOFLAGS"
- fi
-
runHook postConfigure
''
);
diff --git a/pkgs/build-support/node/fetch-npm-deps/default.nix b/pkgs/build-support/node/fetch-npm-deps/default.nix
index cac50cb7401a..1f5ea5a5f17b 100644
--- a/pkgs/build-support/node/fetch-npm-deps/default.nix
+++ b/pkgs/build-support/node/fetch-npm-deps/default.nix
@@ -12,6 +12,7 @@
cacert,
prefetch-npm-deps,
fetchNpmDeps,
+ config,
}:
{
@@ -68,6 +69,7 @@
hash,
forceGitDeps ? false,
forceEmptyCache ? false,
+ npmRegistryOverridesString ? "{}",
}:
testers.invalidateFetcherByDrvHash fetchNpmDeps {
inherit
@@ -75,6 +77,7 @@
hash
forceGitDeps
forceEmptyCache
+ npmRegistryOverridesString
;
src = makeTestSrc { inherit name src; };
@@ -175,6 +178,23 @@
hash = "sha256-FhxlJ0HdJMPiWe7+n1HaGLWOr/2HJEPwiS65uqXZM8Y=";
};
+
+ # Test that npmRegistryOverrides work
+ npmRegistryOverrides = makeTest {
+ name = "npm-registry-overrides";
+
+ src = fetchurl {
+ url = "https://cyberchaos.dev/yuka/trainsearch/-/raw/e3cba6427e8ecfd843d0f697251ddaf5e53c2327/package-lock.json";
+ postFetch = "sed -i 's/registry.npmjs.org/broken.link/' $out";
+ hash = "sha256-Qo24ei1d9Ql4zCLjQJ04zVgS4qhBUpew9NZrhrsBds4=";
+ };
+
+ npmRegistryOverridesString = builtins.toJSON {
+ "broken.link" = "https://registry.npmjs.org";
+ };
+
+ hash = "sha256-QGObVDd9qVtf/U78+ayP6RHVWsU+HXhg70BFblQ1PZs=";
+ };
};
meta = with lib; {
@@ -192,6 +212,9 @@
forceGitDeps ? false,
forceEmptyCache ? false,
nativeBuildInputs ? [ ],
+ # A string with a JSON attrset specifying registry mirrors, for example
+ # {"registry.example.org": "my-mirror.local/registry.example.org"}
+ npmRegistryOverridesString ? config.npmRegistryOverridesString,
...
}@args:
let
@@ -243,6 +266,8 @@
# `{ "registry.example.com": "example-registry-bearer-token", ... }`
impureEnvVars = lib.fetchers.proxyImpureEnvVars ++ [ "NIX_NPM_TOKENS" ];
+ NIX_NPM_REGISTRY_OVERRIDES = npmRegistryOverridesString;
+
SSL_CERT_FILE =
if
(
diff --git a/pkgs/build-support/node/fetch-npm-deps/src/util.rs b/pkgs/build-support/node/fetch-npm-deps/src/util.rs
index 36e2333a3e1a..835f77a2f52c 100644
--- a/pkgs/build-support/node/fetch-npm-deps/src/util.rs
+++ b/pkgs/build-support/node/fetch-npm-deps/src/util.rs
@@ -18,6 +18,22 @@ use std::{
use url::Url;
pub fn get_url(url: &Url) -> Result {
+ let url_ = url.clone();
+ let mut url = url.clone();
+ // Respect NIX_NPM_REGISTRY_OVERRIDES environment variable, which should be a JSON mapping in the shape of:
+ // `{ "registry.example.com": "my-registry.local", ... }`
+ if let Some(host) = url.host_str() {
+ if let Ok(npm_mirrors) = env::var("NIX_NPM_REGISTRY_OVERRIDES") {
+ if let Ok(mirrors) = serde_json::from_str::