diff --git a/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml b/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml index aef16523b5ea..1e425248be0f 100644 --- a/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml +++ b/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml @@ -149,6 +149,20 @@ migration guide for more details. + + + For pkgs.python3.pkgs.ipython, its direct + dependency + pkgs.python3.pkgs.matplotlib-inline (which + is really an adapter to integrate matplotlib in ipython if it + is installed) does not depend on + pkgs.python3.pkgs.matplotlib anymore. This + is closer to a non-Nix install of ipython. This has the added + benefit to reduce the closure size of + ipython from ~400MB to ~160MB (including + ~100MB for python itself). + +
diff --git a/nixos/doc/manual/release-notes/rl-2205.section.md b/nixos/doc/manual/release-notes/rl-2205.section.md index c72f91896585..ca89732fa801 100644 --- a/nixos/doc/manual/release-notes/rl-2205.section.md +++ b/nixos/doc/manual/release-notes/rl-2205.section.md @@ -53,6 +53,13 @@ In addition to numerous new and upgraded packages, this release has the followin - The `autorestic` package has been upgraded from 1.3.0 to 1.5.0 which introduces breaking changes in config file, check [their migration guide](https://autorestic.vercel.app/migration/1.4_1.5) for more details. +- For `pkgs.python3.pkgs.ipython`, its direct dependency `pkgs.python3.pkgs.matplotlib-inline` + (which is really an adapter to integrate matplotlib in ipython if it is installed) does + not depend on `pkgs.python3.pkgs.matplotlib` anymore. + This is closer to a non-Nix install of ipython. + This has the added benefit to reduce the closure size of `ipython` from ~400MB to ~160MB + (including ~100MB for python itself). + ## Other Notable Changes {#sec-release-22.05-notable-changes} - The option [services.redis.servers](#opt-services.redis.servers) was added diff --git a/nixos/lib/make-options-doc/options-to-docbook.xsl b/nixos/lib/make-options-doc/options-to-docbook.xsl index b9ac26450514..b286f7b5e2c0 100644 --- a/nixos/lib/make-options-doc/options-to-docbook.xsl +++ b/nixos/lib/make-options-doc/options-to-docbook.xsl @@ -20,7 +20,7 @@ Configuration Options - + diff --git a/nixos/modules/services/misc/sourcehut/default.nix b/nixos/modules/services/misc/sourcehut/default.nix index c84a75b0ca02..1bd21c278e00 100644 --- a/nixos/modules/services/misc/sourcehut/default.nix +++ b/nixos/modules/services/misc/sourcehut/default.nix @@ -1,14 +1,90 @@ { config, pkgs, lib, ... }: - with lib; let + inherit (config.services) nginx postfix postgresql redis; + inherit (config.users) users groups; cfg = config.services.sourcehut; - cfgIni = cfg.settings; - settingsFormat = pkgs.formats.ini { }; + domain = cfg.settings."sr.ht".global-domain; + settingsFormat = pkgs.formats.ini { + listToValue = concatMapStringsSep "," (generators.mkValueStringDefault {}); + mkKeyValue = k: v: + if v == null then "" + else generators.mkKeyValueDefault { + mkValueString = v: + if v == true then "yes" + else if v == false then "no" + else generators.mkValueStringDefault {} v; + } "=" k v; + }; + configIniOfService = srv: settingsFormat.generate "sourcehut-${srv}-config.ini" + # Each service needs access to only a subset of sections (and secrets). + (filterAttrs (k: v: v != null) + (mapAttrs (section: v: + let srvMatch = builtins.match "^([a-z]*)\\.sr\\.ht(::.*)?$" section; in + if srvMatch == null # Include sections shared by all services + || head srvMatch == srv # Include sections for the service being configured + then v + # Enable Web links and integrations between services. + else if tail srvMatch == [ null ] && elem (head srvMatch) cfg.services + then { + inherit (v) origin; + # mansrht crashes without it + oauth-client-id = v.oauth-client-id or null; + } + # Drop sub-sections of other services + else null) + (recursiveUpdate cfg.settings { + # Those paths are mounted using BindPaths= or BindReadOnlyPaths= + # for services needing access to them. + "builds.sr.ht::worker".buildlogs = "/var/log/sourcehut/buildsrht-worker"; + "git.sr.ht".post-update-script = "/usr/bin/gitsrht-update-hook"; + "git.sr.ht".repos = "/var/lib/sourcehut/gitsrht/repos"; + "hg.sr.ht".changegroup-script = "/usr/bin/hgsrht-hook-changegroup"; + "hg.sr.ht".repos = "/var/lib/sourcehut/hgsrht/repos"; + # Making this a per service option despite being in a global section, + # so that it uses the redis-server used by the service. + "sr.ht".redis-host = cfg.${srv}.redis.host; + }))); + commonServiceSettings = srv: { + origin = mkOption { + description = "URL ${srv}.sr.ht is being served at (protocol://domain)"; + type = types.str; + default = "https://${srv}.${domain}"; + defaultText = "https://${srv}.example.com"; + }; + debug-host = mkOption { + description = "Address to bind the debug server to."; + type = with types; nullOr str; + default = null; + }; + debug-port = mkOption { + description = "Port to bind the debug server to."; + type = with types; nullOr str; + default = null; + }; + connection-string = mkOption { + description = "SQLAlchemy connection string for the database."; + type = types.str; + default = "postgresql:///localhost?user=${srv}srht&host=/run/postgresql"; + }; + migrate-on-upgrade = mkEnableOption "automatic migrations on package upgrade" // { default = true; }; + oauth-client-id = mkOption { + description = "${srv}.sr.ht's OAuth client id for meta.sr.ht."; + type = types.str; + }; + oauth-client-secret = mkOption { + description = "${srv}.sr.ht's OAuth client secret for meta.sr.ht."; + type = types.path; + apply = s: "<" + toString s; + }; + }; # Specialized python containing all the modules python = pkgs.sourcehut.python.withPackages (ps: with ps; [ gunicorn + eventlet + # For monitoring Celery: sudo -u listssrht celery --app listssrht.process -b redis+socket:///run/redis-sourcehut/redis.sock?virtual_host=5 flower + flower # Sourcehut services srht buildsrht @@ -19,72 +95,37 @@ let listssrht mansrht metasrht + # Not a python package + #pagessrht pastesrht todosrht ]); + mkOptionNullOrStr = description: mkOption { + inherit description; + type = with types; nullOr str; + default = null; + }; in { - imports = - [ - ./git.nix - ./hg.nix - ./hub.nix - ./todo.nix - ./man.nix - ./meta.nix - ./paste.nix - ./builds.nix - ./lists.nix - ./dispatch.nix - (mkRemovedOptionModule [ "services" "sourcehut" "nginx" "enable" ] '' - The sourcehut module supports `nginx` as a local reverse-proxy by default and doesn't - support other reverse-proxies officially. - - However it's possible to use an alternative reverse-proxy by - - * disabling nginx - * adjusting the relevant settings for server addresses and ports directly - - Further details about this can be found in the `Sourcehut`-section of the NixOS-manual. - '') - ]; - options.services.sourcehut = { - enable = mkOption { - type = types.bool; - default = false; - description = '' - Enable sourcehut - git hosting, continuous integration, mailing list, ticket tracking, - task dispatching, wiki and account management services - ''; - }; + enable = mkEnableOption '' + sourcehut - git hosting, continuous integration, mailing list, ticket tracking, + task dispatching, wiki and account management services + ''; services = mkOption { - type = types.nonEmptyListOf (types.enum [ "builds" "dispatch" "git" "hub" "hg" "lists" "man" "meta" "paste" "todo" ]); - default = [ "man" "meta" "paste" ]; - example = [ "builds" "dispatch" "git" "hub" "hg" "lists" "man" "meta" "paste" "todo" ]; + type = with types; listOf (enum + [ "builds" "dispatch" "git" "hg" "hub" "lists" "man" "meta" "pages" "paste" "todo" ]); + defaultText = "locally enabled services"; description = '' - Services to enable on the sourcehut network. + Services that may be displayed as links in the title bar of the Web interface. ''; }; - originBase = mkOption { + listenAddress = mkOption { type = types.str; - default = with config.networking; hostName + lib.optionalString (domain != null) ".${domain}"; - defaultText = literalExpression '' - with config.networking; hostName + optionalString (domain != null) ".''${domain}" - ''; - description = '' - Host name used by reverse-proxy and for default settings. Will host services at git."''${originBase}". For example: git.sr.ht - ''; - }; - - address = mkOption { - type = types.str; - default = "127.0.0.1"; - description = '' - Address to bind to. - ''; + default = "localhost"; + description = "Address to bind to."; }; python = mkOption { @@ -97,105 +138,1247 @@ in ''; }; - statePath = mkOption { - type = types.path; - default = "/var/lib/sourcehut"; - description = '' - Root state path for the sourcehut network. If left as the default value - this directory will automatically be created before the sourcehut server - starts, otherwise the sysadmin is responsible for ensuring the - directory exists with appropriate ownership and permissions. - ''; + minio = { + enable = mkEnableOption ''local minio integration''; + }; + + nginx = { + enable = mkEnableOption ''local nginx integration''; + virtualHost = mkOption { + type = types.attrs; + default = {}; + description = "Virtual-host configuration merged with all Sourcehut's virtual-hosts."; + }; + }; + + postfix = { + enable = mkEnableOption ''local postfix integration''; + }; + + postgresql = { + enable = mkEnableOption ''local postgresql integration''; + }; + + redis = { + enable = mkEnableOption ''local redis integration in a dedicated redis-server''; }; settings = mkOption { type = lib.types.submodule { freeformType = settingsFormat.type; + options."sr.ht" = { + global-domain = mkOption { + description = "Global domain name."; + type = types.str; + example = "example.com"; + }; + environment = mkOption { + description = "Values other than \"production\" adds a banner to each page."; + type = types.enum [ "development" "production" ]; + default = "development"; + }; + network-key = mkOption { + description = '' + An absolute file path (which should be outside the Nix-store) + to a secret key to encrypt internal messages with. Use srht-keygen network to + generate this key. It must be consistent between all services and nodes. + ''; + type = types.path; + apply = s: "<" + toString s; + }; + owner-email = mkOption { + description = "Owner's email."; + type = types.str; + default = "contact@example.com"; + }; + owner-name = mkOption { + description = "Owner's name."; + type = types.str; + default = "John Doe"; + }; + site-blurb = mkOption { + description = "Blurb for your site."; + type = types.str; + default = "the hacker's forge"; + }; + site-info = mkOption { + description = "The top-level info page for your site."; + type = types.str; + default = "https://sourcehut.org"; + }; + service-key = mkOption { + description = '' + An absolute file path (which should be outside the Nix-store) + to a key used for encrypting session cookies. Use srht-keygen service to + generate the service key. This must be shared between each node of the same + service (e.g. git1.sr.ht and git2.sr.ht), but different services may use + different keys. If you configure all of your services with the same + config.ini, you may use the same service-key for all of them. + ''; + type = types.path; + apply = s: "<" + toString s; + }; + site-name = mkOption { + description = "The name of your network of sr.ht-based sites."; + type = types.str; + default = "sourcehut"; + }; + source-url = mkOption { + description = "The source code for your fork of sr.ht."; + type = types.str; + default = "https://git.sr.ht/~sircmpwn/srht"; + }; + }; + options.mail = { + smtp-host = mkOptionNullOrStr "Outgoing SMTP host."; + smtp-port = mkOption { + description = "Outgoing SMTP port."; + type = with types; nullOr port; + default = null; + }; + smtp-user = mkOptionNullOrStr "Outgoing SMTP user."; + smtp-password = mkOptionNullOrStr "Outgoing SMTP password."; + smtp-from = mkOptionNullOrStr "Outgoing SMTP FROM."; + error-to = mkOptionNullOrStr "Address receiving application exceptions"; + error-from = mkOptionNullOrStr "Address sending application exceptions"; + pgp-privkey = mkOptionNullOrStr '' + An absolute file path (which should be outside the Nix-store) + to an OpenPGP private key. + + Your PGP key information (DO NOT mix up pub and priv here) + You must remove the password from your secret key, if present. + You can do this with gpg --edit-key [key-id], + then use the passwd command and do not enter a new password. + ''; + pgp-pubkey = mkOptionNullOrStr "OpenPGP public key."; + pgp-key-id = mkOptionNullOrStr "OpenPGP key identifier."; + }; + options.objects = { + s3-upstream = mkOption { + description = "Configure the S3-compatible object storage service."; + type = with types; nullOr str; + default = null; + }; + s3-access-key = mkOption { + description = "Access key to the S3-compatible object storage service"; + type = with types; nullOr str; + default = null; + }; + s3-secret-key = mkOption { + description = '' + An absolute file path (which should be outside the Nix-store) + to the secret key of the S3-compatible object storage service. + ''; + type = with types; nullOr path; + default = null; + apply = mapNullable (s: "<" + toString s); + }; + }; + options.webhooks = { + private-key = mkOption { + description = '' + An absolute file path (which should be outside the Nix-store) + to a base64-encoded Ed25519 key for signing webhook payloads. + This should be consistent for all *.sr.ht sites, + as this key will be used to verify signatures + from other sites in your network. + Use the srht-keygen webhook command to generate a key. + ''; + type = types.path; + apply = s: "<" + toString s; + }; + }; + + options."dispatch.sr.ht" = commonServiceSettings "dispatch" // { + }; + options."dispatch.sr.ht::github" = { + oauth-client-id = mkOptionNullOrStr "OAuth client id."; + oauth-client-secret = mkOptionNullOrStr "OAuth client secret."; + }; + options."dispatch.sr.ht::gitlab" = { + enabled = mkEnableOption "GitLab integration"; + canonical-upstream = mkOption { + type = types.str; + description = "Canonical upstream."; + default = "gitlab.com"; + }; + repo-cache = mkOption { + type = types.str; + description = "Repository cache directory."; + default = "./repo-cache"; + }; + "gitlab.com" = mkOption { + type = with types; nullOr str; + description = "GitLab id and secret."; + default = null; + example = "GitLab:application id:secret"; + }; + }; + + options."builds.sr.ht" = commonServiceSettings "builds" // { + allow-free = mkEnableOption "nonpaying users to submit builds"; + redis = mkOption { + description = "The Redis connection used for the Celery worker."; + type = types.str; + default = "redis+socket:///run/redis-sourcehut-buildsrht/redis.sock?virtual_host=2"; + }; + shell = mkOption { + description = '' + Scripts used to launch on SSH connection. + /usr/bin/master-shell on master, + /usr/bin/runner-shell on runner. + If master and worker are on the same system + set to /usr/bin/runner-shell. + ''; + type = types.enum ["/usr/bin/master-shell" "/usr/bin/runner-shell"]; + default = "/usr/bin/master-shell"; + }; + }; + options."builds.sr.ht::worker" = { + bind-address = mkOption { + description = '' + HTTP bind address for serving local build information/monitoring. + ''; + type = types.str; + default = "localhost:8080"; + }; + buildlogs = mkOption { + description = "Path to write build logs."; + type = types.str; + default = "/var/log/sourcehut/buildsrht-worker"; + }; + name = mkOption { + description = '' + Listening address and listening port + of the build runner (with HTTP port if not 80). + ''; + type = types.str; + default = "localhost:5020"; + }; + timeout = mkOption { + description = '' + Max build duration. + See . + ''; + type = types.str; + default = "3m"; + }; + }; + + options."git.sr.ht" = commonServiceSettings "git" // { + outgoing-domain = mkOption { + description = "Outgoing domain."; + type = types.str; + default = "https://git.localhost.localdomain"; + }; + post-update-script = mkOption { + description = '' + A post-update script which is installed in every git repo. + This setting is propagated to newer and existing repositories. + ''; + type = types.path; + default = "${pkgs.sourcehut.gitsrht}/bin/gitsrht-update-hook"; + defaultText = "\${pkgs.sourcehut.gitsrht}/bin/gitsrht-update-hook"; + }; + repos = mkOption { + description = '' + Path to git repositories on disk. + If changing the default, you must ensure that + the gitsrht's user as read and write access to it. + ''; + type = types.str; + default = "/var/lib/sourcehut/gitsrht/repos"; + }; + webhooks = mkOption { + description = "The Redis connection used for the webhooks worker."; + type = types.str; + default = "redis+socket:///run/redis-sourcehut-gitsrht/redis.sock?virtual_host=1"; + }; + }; + options."git.sr.ht::api" = { + internal-ipnet = mkOption { + description = '' + Set of IP subnets which are permitted to utilize internal API + authentication. This should be limited to the subnets + from which your *.sr.ht services are running. + See . + ''; + type = with types; listOf str; + default = [ "127.0.0.0/8" "::1/128" ]; + }; + }; + + options."hg.sr.ht" = commonServiceSettings "hg" // { + changegroup-script = mkOption { + description = '' + A changegroup script which is installed in every mercurial repo. + This setting is propagated to newer and existing repositories. + ''; + type = types.str; + default = "${cfg.python}/bin/hgsrht-hook-changegroup"; + defaultText = "\${cfg.python}/bin/hgsrht-hook-changegroup"; + }; + repos = mkOption { + description = '' + Path to mercurial repositories on disk. + If changing the default, you must ensure that + the hgsrht's user as read and write access to it. + ''; + type = types.str; + default = "/var/lib/sourcehut/hgsrht/repos"; + }; + srhtext = mkOptionNullOrStr '' + Path to the srht mercurial extension + (defaults to where the hgsrht code is) + ''; + clone_bundle_threshold = mkOption { + description = ".hg/store size (in MB) past which the nightly job generates clone bundles."; + type = types.ints.unsigned; + default = 50; + }; + hg_ssh = mkOption { + description = "Path to hg-ssh (if not in $PATH)."; + type = types.str; + default = "${pkgs.mercurial}/bin/hg-ssh"; + defaultText = "\${pkgs.mercurial}/bin/hg-ssh"; + }; + webhooks = mkOption { + description = "The Redis connection used for the webhooks worker."; + type = types.str; + default = "redis+socket:///run/redis-sourcehut-hgsrht/redis.sock?virtual_host=1"; + }; + }; + + options."hub.sr.ht" = commonServiceSettings "hub" // { + }; + + options."lists.sr.ht" = commonServiceSettings "lists" // { + allow-new-lists = mkEnableOption "Allow creation of new lists."; + notify-from = mkOption { + description = "Outgoing email for notifications generated by users."; + type = types.str; + default = "lists-notify@localhost.localdomain"; + }; + posting-domain = mkOption { + description = "Posting domain."; + type = types.str; + default = "lists.localhost.localdomain"; + }; + redis = mkOption { + description = "The Redis connection used for the Celery worker."; + type = types.str; + default = "redis+socket:///run/redis-sourcehut-listssrht/redis.sock?virtual_host=2"; + }; + webhooks = mkOption { + description = "The Redis connection used for the webhooks worker."; + type = types.str; + default = "redis+socket:///run/redis-sourcehut-listssrht/redis.sock?virtual_host=1"; + }; + }; + options."lists.sr.ht::worker" = { + reject-mimetypes = mkOption { + description = '' + Comma-delimited list of Content-Types to reject. Messages with Content-Types + included in this list are rejected. Multipart messages are always supported, + and each part is checked against this list. + + Uses fnmatch for wildcard expansion. + ''; + type = with types; listOf str; + default = ["text/html"]; + }; + reject-url = mkOption { + description = "Reject URL."; + type = types.str; + default = "https://man.sr.ht/lists.sr.ht/etiquette.md"; + }; + sock = mkOption { + description = '' + Path for the lmtp daemon's unix socket. Direct incoming mail to this socket. + Alternatively, specify IP:PORT and an SMTP server will be run instead. + ''; + type = types.str; + default = "/tmp/lists.sr.ht-lmtp.sock"; + }; + sock-group = mkOption { + description = '' + The lmtp daemon will make the unix socket group-read/write + for users in this group. + ''; + type = types.str; + default = "postfix"; + }; + }; + + options."man.sr.ht" = commonServiceSettings "man" // { + }; + + options."meta.sr.ht" = + removeAttrs (commonServiceSettings "meta") + ["oauth-client-id" "oauth-client-secret"] // { + api-origin = mkOption { + description = "Origin URL for API, 100 more than web."; + type = types.str; + default = "http://${cfg.listenAddress}:${toString (cfg.meta.port + 100)}"; + defaultText = ''http://:''${toString ( + 100)}''; + }; + webhooks = mkOption { + description = "The Redis connection used for the webhooks worker."; + type = types.str; + default = "redis+socket:///run/redis-sourcehut-metasrht/redis.sock?virtual_host=1"; + }; + welcome-emails = mkEnableOption "sending stock sourcehut welcome emails after signup"; + }; + options."meta.sr.ht::api" = { + internal-ipnet = mkOption { + description = '' + Set of IP subnets which are permitted to utilize internal API + authentication. This should be limited to the subnets + from which your *.sr.ht services are running. + See . + ''; + type = with types; listOf str; + default = [ "127.0.0.0/8" "::1/128" ]; + }; + }; + options."meta.sr.ht::aliases" = mkOption { + description = "Aliases for the client IDs of commonly used OAuth clients."; + type = with types; attrsOf int; + default = {}; + example = { "git.sr.ht" = 12345; }; + }; + options."meta.sr.ht::billing" = { + enabled = mkEnableOption "the billing system"; + stripe-public-key = mkOptionNullOrStr "Public key for Stripe. Get your keys at https://dashboard.stripe.com/account/apikeys"; + stripe-secret-key = mkOptionNullOrStr '' + An absolute file path (which should be outside the Nix-store) + to a secret key for Stripe. Get your keys at https://dashboard.stripe.com/account/apikeys + '' // { + apply = mapNullable (s: "<" + toString s); + }; + }; + options."meta.sr.ht::settings" = { + registration = mkEnableOption "public registration"; + onboarding-redirect = mkOption { + description = "Where to redirect new users upon registration."; + type = types.str; + default = "https://meta.localhost.localdomain"; + }; + user-invites = mkOption { + description = '' + How many invites each user is issued upon registration + (only applicable if open registration is disabled). + ''; + type = types.ints.unsigned; + default = 5; + }; + }; + + options."pages.sr.ht" = commonServiceSettings "pages" // { + gemini-certs = mkOption { + description = '' + An absolute file path (which should be outside the Nix-store) + to Gemini certificates. + ''; + type = with types; nullOr path; + default = null; + }; + max-site-size = mkOption { + description = "Maximum size of any given site (post-gunzip), in MiB."; + type = types.int; + default = 1024; + }; + user-domain = mkOption { + description = '' + Configures the user domain, if enabled. + All users are given <username>.this.domain. + ''; + type = with types; nullOr str; + default = null; + }; + }; + options."pages.sr.ht::api" = { + internal-ipnet = mkOption { + description = '' + Set of IP subnets which are permitted to utilize internal API + authentication. This should be limited to the subnets + from which your *.sr.ht services are running. + See . + ''; + type = with types; listOf str; + default = [ "127.0.0.0/8" "::1/128" ]; + }; + }; + + options."paste.sr.ht" = commonServiceSettings "paste" // { + }; + + options."todo.sr.ht" = commonServiceSettings "todo" // { + notify-from = mkOption { + description = "Outgoing email for notifications generated by users."; + type = types.str; + default = "todo-notify@localhost.localdomain"; + }; + webhooks = mkOption { + description = "The Redis connection used for the webhooks worker."; + type = types.str; + default = "redis+socket:///run/redis-sourcehut-todosrht/redis.sock?virtual_host=1"; + }; + }; + options."todo.sr.ht::mail" = { + posting-domain = mkOption { + description = "Posting domain."; + type = types.str; + default = "todo.localhost.localdomain"; + }; + sock = mkOption { + description = '' + Path for the lmtp daemon's unix socket. Direct incoming mail to this socket. + Alternatively, specify IP:PORT and an SMTP server will be run instead. + ''; + type = types.str; + default = "/tmp/todo.sr.ht-lmtp.sock"; + }; + sock-group = mkOption { + description = '' + The lmtp daemon will make the unix socket group-read/write + for users in this group. + ''; + type = types.str; + default = "postfix"; + }; + }; }; default = { }; description = '' The configuration for the sourcehut network. ''; }; - }; - config = mkIf cfg.enable { - assertions = - [ - { - assertion = with cfgIni.webhooks; private-key != null && stringLength private-key == 44; - message = "The webhook's private key must be defined and of a 44 byte length."; - } + builds = { + enableWorker = mkEnableOption '' + worker for builds.sr.ht - { - assertion = hasAttrByPath [ "meta.sr.ht" "origin" ] cfgIni && cfgIni."meta.sr.ht".origin != null; - message = "meta.sr.ht's origin must be defined."; - } - ]; + + For smaller deployments, job runners can be installed alongside the master server + but even if you only build your own software, integration with other services + may cause you to run untrusted builds + (e.g. automatic testing of patches via listssrht). + See . + + ''; - virtualisation.docker.enable = true; - environment.etc."sr.ht/config.ini".source = - settingsFormat.generate "sourcehut-config.ini" (mapAttrsRecursive - ( - path: v: if v == null then "" else v - ) - cfg.settings); + images = mkOption { + type = with types; attrsOf (attrsOf (attrsOf package)); + default = { }; + example = lib.literalExpression ''(let + # Pinning unstable to allow usage with flakes and limit rebuilds. + pkgs_unstable = builtins.fetchGit { + url = "https://github.com/NixOS/nixpkgs"; + rev = "ff96a0fa5635770390b184ae74debea75c3fd534"; + ref = "nixos-unstable"; + }; + image_from_nixpkgs = (import ("${pkgs.sourcehut.buildsrht}/lib/images/nixos/image.nix") { + pkgs = (import pkgs_unstable {}); + }); + in + { + nixos.unstable.x86_64 = image_from_nixpkgs; + } + )''; + description = '' + Images for builds.sr.ht. Each package should be distro.release.arch and point to a /nix/store/package/root.img.qcow2. + ''; + }; + }; - environment.systemPackages = [ pkgs.sourcehut.coresrht ]; + git = { + package = mkOption { + type = types.package; + default = pkgs.git; + example = literalExpression "pkgs.gitFull"; + description = '' + Git package for git.sr.ht. This can help silence collisions. + ''; + }; + fcgiwrap.preforkProcess = mkOption { + description = "Number of fcgiwrap processes to prefork."; + type = types.int; + default = 4; + }; + }; - # PostgreSQL server - services.postgresql.enable = mkOverride 999 true; - # Mail server - services.postfix.enable = mkOverride 999 true; - # Cron daemon - services.cron.enable = mkOverride 999 true; - # Redis server - services.redis.enable = mkOverride 999 true; - services.redis.bind = mkOverride 999 "127.0.0.1"; + hg = { + package = mkOption { + type = types.package; + default = pkgs.mercurial; + description = '' + Mercurial package for hg.sr.ht. This can help silence collisions. + ''; + }; + cloneBundles = mkOption { + type = types.bool; + default = false; + description = '' + Generate clonebundles (which require more disk space but dramatically speed up cloning large repositories). + ''; + }; + }; - services.sourcehut.settings = { - # The name of your network of sr.ht-based sites - "sr.ht".site-name = mkDefault "sourcehut"; - # The top-level info page for your site - "sr.ht".site-info = mkDefault "https://sourcehut.org"; - # {{ site-name }}, {{ site-blurb }} - "sr.ht".site-blurb = mkDefault "the hacker's forge"; - # If this != production, we add a banner to each page - "sr.ht".environment = mkDefault "development"; - # Contact information for the site owners - "sr.ht".owner-name = mkDefault "Drew DeVault"; - "sr.ht".owner-email = mkDefault "sir@cmpwn.com"; - # The source code for your fork of sr.ht - "sr.ht".source-url = mkDefault "https://git.sr.ht/~sircmpwn/srht"; - # A secret key to encrypt session cookies with - "sr.ht".secret-key = mkDefault null; - "sr.ht".global-domain = mkDefault null; - - # Outgoing SMTP settings - mail.smtp-host = mkDefault null; - mail.smtp-port = mkDefault null; - mail.smtp-user = mkDefault null; - mail.smtp-password = mkDefault null; - mail.smtp-from = mkDefault null; - # Application exceptions are emailed to this address - mail.error-to = mkDefault null; - mail.error-from = mkDefault null; - # Your PGP key information (DO NOT mix up pub and priv here) - # You must remove the password from your secret key, if present. - # You can do this with gpg --edit-key [key-id], then use the passwd - # command and do not enter a new password. - mail.pgp-privkey = mkDefault null; - mail.pgp-pubkey = mkDefault null; - mail.pgp-key-id = mkDefault null; - - # base64-encoded Ed25519 key for signing webhook payloads. This should be - # consistent for all *.sr.ht sites, as we'll use this key to verify signatures - # from other sites in your network. - # - # Use the srht-webhook-keygen command to generate a key. - webhooks.private-key = mkDefault null; + lists = { + process = { + extraArgs = mkOption { + type = with types; listOf str; + default = [ "--loglevel DEBUG" "--pool eventlet" "--without-heartbeat" ]; + description = "Extra arguments passed to the Celery responsible for processing mails."; + }; + celeryConfig = mkOption { + type = types.lines; + default = ""; + description = "Content of the celeryconfig.py used by the Celery of listssrht-process."; + }; + }; }; }; + + config = mkIf cfg.enable (mkMerge [ + { + environment.systemPackages = [ pkgs.sourcehut.coresrht ]; + + services.sourcehut.settings = { + "git.sr.ht".outgoing-domain = mkDefault "https://git.${domain}"; + "lists.sr.ht".notify-from = mkDefault "lists-notify@${domain}"; + "lists.sr.ht".posting-domain = mkDefault "lists.${domain}"; + "meta.sr.ht::settings".onboarding-redirect = mkDefault "https://meta.${domain}"; + "todo.sr.ht".notify-from = mkDefault "todo-notify@${domain}"; + "todo.sr.ht::mail".posting-domain = mkDefault "todo.${domain}"; + }; + } + (mkIf cfg.postgresql.enable { + assertions = [ + { assertion = postgresql.enable; + message = "postgresql must be enabled and configured"; + } + ]; + }) + (mkIf cfg.postfix.enable { + assertions = [ + { assertion = postfix.enable; + message = "postfix must be enabled and configured"; + } + ]; + # Needed for sharing the LMTP sockets with JoinsNamespaceOf= + systemd.services.postfix.serviceConfig.PrivateTmp = true; + }) + (mkIf cfg.redis.enable { + services.redis.vmOverCommit = mkDefault true; + }) + (mkIf cfg.nginx.enable { + assertions = [ + { assertion = nginx.enable; + message = "nginx must be enabled and configured"; + } + ]; + # For proxyPass= in virtual-hosts for Sourcehut services. + services.nginx.recommendedProxySettings = mkDefault true; + }) + (mkIf (cfg.builds.enable || cfg.git.enable || cfg.hg.enable) { + services.openssh = { + # Note that sshd will continue to honor AuthorizedKeysFile. + # Note that you may want automatically rotate + # or link to /dev/null the following log files: + # - /var/log/gitsrht-dispatch + # - /var/log/{build,git,hg}srht-keys + # - /var/log/{git,hg}srht-shell + # - /var/log/gitsrht-update-hook + authorizedKeysCommand = ''/etc/ssh/sourcehut/subdir/srht-dispatch "%u" "%h" "%t" "%k"''; + # srht-dispatch will setuid/setgid according to [git.sr.ht::dispatch] + authorizedKeysCommandUser = "root"; + extraConfig = '' + PermitUserEnvironment SRHT_* + ''; + }; + environment.etc."ssh/sourcehut/config.ini".source = + settingsFormat.generate "sourcehut-dispatch-config.ini" + (filterAttrs (k: v: k == "git.sr.ht::dispatch") + cfg.settings); + environment.etc."ssh/sourcehut/subdir/srht-dispatch" = { + # sshd_config(5): The program must be owned by root, not writable by group or others + mode = "0755"; + source = pkgs.writeShellScript "srht-dispatch" '' + set -e + cd /etc/ssh/sourcehut/subdir + ${cfg.python}/bin/gitsrht-dispatch "$@" + ''; + }; + systemd.services.sshd = { + #path = optional cfg.git.enable [ cfg.git.package ]; + serviceConfig = { + BindReadOnlyPaths = + # Note that those /usr/bin/* paths are hardcoded in multiple places in *.sr.ht, + # for instance to get the user from the [git.sr.ht::dispatch] settings. + # *srht-keys needs to: + # - access a redis-server in [sr.ht] redis-host, + # - access the PostgreSQL server in [*.sr.ht] connection-string, + # - query metasrht-api (through the HTTP API). + # Using this has the side effect of creating empty files in /usr/bin/ + optionals cfg.builds.enable [ + "${pkgs.writeShellScript "buildsrht-keys-wrapper" '' + set -e + cd /run/sourcehut/buildsrht/subdir + set -x + exec -a "$0" ${pkgs.sourcehut.buildsrht}/bin/buildsrht-keys "$@" + ''}:/usr/bin/buildsrht-keys" + "${pkgs.sourcehut.buildsrht}/bin/master-shell:/usr/bin/master-shell" + "${pkgs.sourcehut.buildsrht}/bin/runner-shell:/usr/bin/runner-shell" + ] ++ + optionals cfg.git.enable [ + # /path/to/gitsrht-keys calls /path/to/gitsrht-shell, + # or [git.sr.ht] shell= if set. + "${pkgs.writeShellScript "gitsrht-keys-wrapper" '' + set -e + cd /run/sourcehut/gitsrht/subdir + set -x + exec -a "$0" ${pkgs.sourcehut.gitsrht}/bin/gitsrht-keys "$@" + ''}:/usr/bin/gitsrht-keys" + "${pkgs.writeShellScript "gitsrht-shell-wrapper" '' + set -e + cd /run/sourcehut/gitsrht/subdir + set -x + exec -a "$0" ${pkgs.sourcehut.gitsrht}/bin/gitsrht-shell "$@" + ''}:/usr/bin/gitsrht-shell" + "${pkgs.writeShellScript "gitsrht-update-hook" '' + set -e + test -e "''${PWD%/*}"/config.ini || + # Git hooks are run relative to their repository's directory, + # but gitsrht-update-hook looks up ../config.ini + ln -s /run/sourcehut/gitsrht/config.ini "''${PWD%/*}"/config.ini + # hooks/post-update calls /usr/bin/gitsrht-update-hook as hooks/stage-3 + # but this wrapper being a bash script, it overrides $0 with /usr/bin/gitsrht-update-hook + # hence this hack to put hooks/stage-3 back into gitsrht-update-hook's $0 + if test "''${STAGE3:+set}" + then + set -x + exec -a hooks/stage-3 ${pkgs.sourcehut.gitsrht}/bin/gitsrht-update-hook "$@" + else + export STAGE3=set + set -x + exec -a "$0" ${pkgs.sourcehut.gitsrht}/bin/gitsrht-update-hook "$@" + fi + ''}:/usr/bin/gitsrht-update-hook" + ] ++ + optionals cfg.hg.enable [ + # /path/to/hgsrht-keys calls /path/to/hgsrht-shell, + # or [hg.sr.ht] shell= if set. + "${pkgs.writeShellScript "hgsrht-keys-wrapper" '' + set -e + cd /run/sourcehut/hgsrht/subdir + set -x + exec -a "$0" ${pkgs.sourcehut.hgsrht}/bin/hgsrht-keys "$@" + ''}:/usr/bin/hgsrht-keys" + "${pkgs.writeShellScript "hgsrht-shell-wrapper" '' + set -e + cd /run/sourcehut/hgsrht/subdir + set -x + exec -a "$0" ${pkgs.sourcehut.hgsrht}/bin/hgsrht-shell "$@" + ''}:/usr/bin/hgsrht-shell" + # Mercurial's changegroup hooks are run relative to their repository's directory, + # but hgsrht-hook-changegroup looks up ./config.ini + "${pkgs.writeShellScript "hgsrht-hook-changegroup" '' + set -e + test -e "''$PWD"/config.ini || + ln -s /run/sourcehut/hgsrht/config.ini "''$PWD"/config.ini + set -x + exec -a "$0" ${cfg.python}/bin/hgsrht-hook-changegroup "$@" + ''}:/usr/bin/hgsrht-hook-changegroup" + ]; + }; + }; + }) + ]); + + imports = [ + + (import ./service.nix "builds" { + inherit configIniOfService; + srvsrht = "buildsrht"; + port = 5002; + # TODO: a celery worker on the master and worker are apparently needed + extraServices.buildsrht-worker = let + qemuPackage = pkgs.qemu_kvm; + serviceName = "buildsrht-worker"; + statePath = "/var/lib/sourcehut/${serviceName}"; + in mkIf cfg.builds.enableWorker { + path = [ pkgs.openssh pkgs.docker ]; + preStart = '' + set -x + if test -z "$(docker images -q qemu:latest 2>/dev/null)" \ + || test "$(cat ${statePath}/docker-image-qemu)" != "${qemuPackage.version}" + then + # Create and import qemu:latest image for docker + ${pkgs.dockerTools.streamLayeredImage { + name = "qemu"; + tag = "latest"; + contents = [ qemuPackage ]; + }} | docker load + # Mark down current package version + echo '${qemuPackage.version}' >${statePath}/docker-image-qemu + fi + ''; + serviceConfig = { + ExecStart = "${pkgs.sourcehut.buildsrht}/bin/builds.sr.ht-worker"; + BindPaths = [ cfg.settings."builds.sr.ht::worker".buildlogs ]; + LogsDirectory = [ "sourcehut/${serviceName}" ]; + RuntimeDirectory = [ "sourcehut/${serviceName}/subdir" ]; + StateDirectory = [ "sourcehut/${serviceName}" ]; + TimeoutStartSec = "1800s"; + # builds.sr.ht-worker looks up ../config.ini + WorkingDirectory = "-"+"/run/sourcehut/${serviceName}/subdir"; + }; + }; + extraConfig = let + image_dirs = flatten ( + mapAttrsToList (distro: revs: + mapAttrsToList (rev: archs: + mapAttrsToList (arch: image: + pkgs.runCommand "buildsrht-images" { } '' + mkdir -p $out/${distro}/${rev}/${arch} + ln -s ${image}/*.qcow2 $out/${distro}/${rev}/${arch}/root.img.qcow2 + '' + ) archs + ) revs + ) cfg.builds.images + ); + image_dir_pre = pkgs.symlinkJoin { + name = "builds.sr.ht-worker-images-pre"; + paths = image_dirs; + # FIXME: not working, apparently because ubuntu/latest is a broken link + # ++ [ "${pkgs.sourcehut.buildsrht}/lib/images" ]; + }; + image_dir = pkgs.runCommand "builds.sr.ht-worker-images" { } '' + mkdir -p $out/images + cp -Lr ${image_dir_pre}/* $out/images + ''; + in mkMerge [ + { + users.users.${cfg.builds.user}.shell = pkgs.bash; + + virtualisation.docker.enable = true; + + services.sourcehut.settings = mkMerge [ + { # Note that git.sr.ht::dispatch is not a typo, + # gitsrht-dispatch always use this section + "git.sr.ht::dispatch"."/usr/bin/buildsrht-keys" = + mkDefault "${cfg.builds.user}:${cfg.builds.group}"; + } + (mkIf cfg.builds.enableWorker { + "builds.sr.ht::worker".shell = "/usr/bin/runner-shell"; + "builds.sr.ht::worker".images = mkDefault "${image_dir}/images"; + "builds.sr.ht::worker".controlcmd = mkDefault "${image_dir}/images/control"; + }) + ]; + } + (mkIf cfg.builds.enableWorker { + users.groups = { + docker.members = [ cfg.builds.user ]; + }; + }) + (mkIf (cfg.builds.enableWorker && cfg.nginx.enable) { + # Allow nginx access to buildlogs + users.users.${nginx.user}.extraGroups = [ cfg.builds.group ]; + systemd.services.nginx = { + serviceConfig.BindReadOnlyPaths = [ cfg.settings."builds.sr.ht::worker".buildlogs ]; + }; + services.nginx.virtualHosts."logs.${domain}" = mkMerge [ { + /* FIXME: is a listen needed? + listen = with builtins; + # FIXME: not compatible with IPv6 + let address = split ":" cfg.settings."builds.sr.ht::worker".name; in + [{ addr = elemAt address 0; port = lib.toInt (elemAt address 2); }]; + */ + locations."/logs/".alias = cfg.settings."builds.sr.ht::worker".buildlogs + "/"; + } cfg.nginx.virtualHost ]; + }) + ]; + }) + + (import ./service.nix "dispatch" { + inherit configIniOfService; + port = 5005; + }) + + (import ./service.nix "git" (let + baseService = { + path = [ cfg.git.package ]; + serviceConfig.BindPaths = [ "${cfg.settings."git.sr.ht".repos}:/var/lib/sourcehut/gitsrht/repos" ]; + }; + in { + inherit configIniOfService; + mainService = mkMerge [ baseService { + serviceConfig.StateDirectory = [ "sourcehut/gitsrht" "sourcehut/gitsrht/repos" ]; + preStart = mkIf (!versionAtLeast config.system.stateVersion "22.05") (mkBefore '' + # Fix Git hooks of repositories pre-dating https://github.com/NixOS/nixpkgs/pull/133984 + ( + set +f + shopt -s nullglob + for h in /var/lib/sourcehut/gitsrht/repos/~*/*/hooks/{pre-receive,update,post-update} + do ln -fnsv /usr/bin/gitsrht-update-hook "$h"; done + ) + ''); + } ]; + port = 5001; + webhooks = true; + extraTimers.gitsrht-periodic = { + service = baseService; + timerConfig.OnCalendar = ["*:0/20"]; + }; + extraConfig = mkMerge [ + { + # https://stackoverflow.com/questions/22314298/git-push-results-in-fatal-protocol-error-bad-line-length-character-this + # Probably could use gitsrht-shell if output is restricted to just parameters... + users.users.${cfg.git.user}.shell = pkgs.bash; + services.sourcehut.settings = { + "git.sr.ht::dispatch"."/usr/bin/gitsrht-keys" = + mkDefault "${cfg.git.user}:${cfg.git.group}"; + }; + systemd.services.sshd = baseService; + } + (mkIf cfg.nginx.enable { + services.nginx.virtualHosts."git.${domain}" = { + locations."/authorize" = { + proxyPass = "http://${cfg.listenAddress}:${toString cfg.git.port}"; + extraConfig = '' + proxy_pass_request_body off; + proxy_set_header Content-Length ""; + proxy_set_header X-Original-URI $request_uri; + ''; + }; + locations."~ ^/([^/]+)/([^/]+)/(HEAD|info/refs|objects/info/.*|git-upload-pack).*$" = { + root = "/var/lib/sourcehut/gitsrht/repos"; + fastcgiParams = { + GIT_HTTP_EXPORT_ALL = ""; + GIT_PROJECT_ROOT = "$document_root"; + PATH_INFO = "$uri"; + SCRIPT_FILENAME = "${cfg.git.package}/bin/git-http-backend"; + }; + extraConfig = '' + auth_request /authorize; + fastcgi_read_timeout 500s; + fastcgi_pass unix:/run/gitsrht-fcgiwrap.sock; + gzip off; + ''; + }; + }; + systemd.sockets.gitsrht-fcgiwrap = { + before = [ "nginx.service" ]; + wantedBy = [ "sockets.target" "gitsrht.service" ]; + # This path remains accessible to nginx.service, which has no RootDirectory= + socketConfig.ListenStream = "/run/gitsrht-fcgiwrap.sock"; + socketConfig.SocketUser = nginx.user; + socketConfig.SocketMode = "600"; + }; + }) + ]; + extraServices.gitsrht-fcgiwrap = mkIf cfg.nginx.enable { + serviceConfig = { + # Socket is passed by gitsrht-fcgiwrap.socket + ExecStart = "${pkgs.fcgiwrap}/sbin/fcgiwrap -c ${toString cfg.git.fcgiwrap.preforkProcess}"; + # No need for config.ini + ExecStartPre = mkForce []; + User = null; + DynamicUser = true; + BindReadOnlyPaths = [ "${cfg.settings."git.sr.ht".repos}:/var/lib/sourcehut/gitsrht/repos" ]; + IPAddressDeny = "any"; + InaccessiblePaths = [ "-+/run/postgresql" "-+/run/redis-sourcehut" ]; + PrivateNetwork = true; + RestrictAddressFamilies = mkForce [ "none" ]; + SystemCallFilter = mkForce [ + "@system-service" + "~@aio" "~@keyring" "~@memlock" "~@privileged" "~@resources" "~@setuid" + # @timer is needed for alarm() + ]; + }; + }; + })) + + (import ./service.nix "hg" (let + baseService = { + path = [ cfg.hg.package ]; + serviceConfig.BindPaths = [ "${cfg.settings."hg.sr.ht".repos}:/var/lib/sourcehut/hgsrht/repos" ]; + }; + in { + inherit configIniOfService; + mainService = mkMerge [ baseService { + serviceConfig.StateDirectory = [ "sourcehut/hgsrht" "sourcehut/hgsrht/repos" ]; + } ]; + port = 5010; + webhooks = true; + extraTimers.hgsrht-periodic = { + service = baseService; + timerConfig.OnCalendar = ["*:0/20"]; + }; + extraTimers.hgsrht-clonebundles = mkIf cfg.hg.cloneBundles { + service = baseService; + timerConfig.OnCalendar = ["daily"]; + timerConfig.AccuracySec = "1h"; + }; + extraConfig = mkMerge [ + { + users.users.${cfg.hg.user}.shell = pkgs.bash; + services.sourcehut.settings = { + # Note that git.sr.ht::dispatch is not a typo, + # gitsrht-dispatch always uses this section. + "git.sr.ht::dispatch"."/usr/bin/hgsrht-keys" = + mkDefault "${cfg.hg.user}:${cfg.hg.group}"; + }; + systemd.services.sshd = baseService; + } + (mkIf cfg.nginx.enable { + # Allow nginx access to repositories + users.users.${nginx.user}.extraGroups = [ cfg.hg.group ]; + services.nginx.virtualHosts."hg.${domain}" = { + locations."/authorize" = { + proxyPass = "http://${cfg.listenAddress}:${toString cfg.hg.port}"; + extraConfig = '' + proxy_pass_request_body off; + proxy_set_header Content-Length ""; + proxy_set_header X-Original-URI $request_uri; + ''; + }; + # Let clients reach pull bundles. We don't really need to lock this down even for + # private repos because the bundles are named after the revision hashes... + # so someone would need to know or guess a SHA value to download anything. + # TODO: proxyPass to an hg serve service? + locations."~ ^/[~^][a-z0-9_]+/[a-zA-Z0-9_.-]+/\\.hg/bundles/.*$" = { + root = "/var/lib/nginx/hgsrht/repos"; + extraConfig = '' + auth_request /authorize; + gzip off; + ''; + }; + }; + systemd.services.nginx = { + serviceConfig.BindReadOnlyPaths = [ "${cfg.settings."hg.sr.ht".repos}:/var/lib/nginx/hgsrht/repos" ]; + }; + }) + ]; + })) + + (import ./service.nix "hub" { + inherit configIniOfService; + port = 5014; + extraConfig = { + services.nginx = mkIf cfg.nginx.enable { + virtualHosts."hub.${domain}" = mkMerge [ { + serverAliases = [ domain ]; + } cfg.nginx.virtualHost ]; + }; + }; + }) + + (import ./service.nix "lists" (let + srvsrht = "listssrht"; + in { + inherit configIniOfService; + port = 5006; + webhooks = true; + # Receive the mail from Postfix and enqueue them into Redis and PostgreSQL + extraServices.listssrht-lmtp = { + wants = [ "postfix.service" ]; + unitConfig.JoinsNamespaceOf = optional cfg.postfix.enable "postfix.service"; + serviceConfig.ExecStart = "${cfg.python}/bin/listssrht-lmtp"; + # Avoid crashing: os.chown(sock, os.getuid(), sock_gid) + serviceConfig.PrivateUsers = mkForce false; + }; + # Dequeue the mails from Redis and dispatch them + extraServices.listssrht-process = { + serviceConfig = { + preStart = '' + cp ${pkgs.writeText "${srvsrht}-webhooks-celeryconfig.py" cfg.lists.process.celeryConfig} \ + /run/sourcehut/${srvsrht}-webhooks/celeryconfig.py + ''; + ExecStart = "${cfg.python}/bin/celery --app listssrht.process worker --hostname listssrht-process@%%h " + concatStringsSep " " cfg.lists.process.extraArgs; + # Avoid crashing: os.getloadavg() + ProcSubset = mkForce "all"; + }; + }; + extraConfig = mkIf cfg.postfix.enable { + users.groups.${postfix.group}.members = [ cfg.lists.user ]; + services.sourcehut.settings."lists.sr.ht::mail".sock-group = postfix.group; + services.postfix = { + destination = [ "lists.${domain}" ]; + # FIXME: an accurate recipient list should be queried + # from the lists.sr.ht PostgreSQL database to avoid backscattering. + # But usernames are unfortunately not in that database but in meta.sr.ht. + # Note that two syntaxes are allowed: + # - ~username/list-name@lists.${domain} + # - u.username.list-name@lists.${domain} + localRecipients = [ "@lists.${domain}" ]; + transport = '' + lists.${domain} lmtp:unix:${cfg.settings."lists.sr.ht::worker".sock} + ''; + }; + }; + })) + + (import ./service.nix "man" { + inherit configIniOfService; + port = 5004; + }) + + (import ./service.nix "meta" { + inherit configIniOfService; + port = 5000; + webhooks = true; + extraServices.metasrht-api = { + serviceConfig.Restart = "always"; + serviceConfig.RestartSec = "2s"; + preStart = "set -x\n" + concatStringsSep "\n\n" (attrValues (mapAttrs (k: s: + let srvMatch = builtins.match "^([a-z]*)\\.sr\\.ht$" k; + srv = head srvMatch; + in + # Configure client(s) as "preauthorized" + optionalString (srvMatch != null && cfg.${srv}.enable && ((s.oauth-client-id or null) != null)) '' + # Configure ${srv}'s OAuth client as "preauthorized" + ${postgresql.package}/bin/psql '${cfg.settings."meta.sr.ht".connection-string}' \ + -c "UPDATE oauthclient SET preauthorized = true WHERE client_id = '${s.oauth-client-id}'" + '' + ) cfg.settings)); + serviceConfig.ExecStart = "${pkgs.sourcehut.metasrht}/bin/metasrht-api -b ${cfg.listenAddress}:${toString (cfg.meta.port + 100)}"; + }; + extraTimers.metasrht-daily.timerConfig = { + OnCalendar = ["daily"]; + AccuracySec = "1h"; + }; + extraConfig = mkMerge [ + { + assertions = [ + { assertion = let s = cfg.settings."meta.sr.ht::billing"; in + s.enabled == "yes" -> (s.stripe-public-key != null && s.stripe-secret-key != null); + message = "If meta.sr.ht::billing is enabled, the keys must be defined."; + } + ]; + environment.systemPackages = optional cfg.meta.enable + (pkgs.writeShellScriptBin "metasrht-manageuser" '' + set -eux + if test "$(${pkgs.coreutils}/bin/id -n -u)" != '${cfg.meta.user}' + then exec sudo -u '${cfg.meta.user}' "$0" "$@" + else + # In order to load config.ini + if cd /run/sourcehut/metasrht + then exec ${cfg.python}/bin/metasrht-manageuser "$@" + else cat <${stateDir}/db + fi + + ${optionalString cfg.settings.${iniKey}.migrate-on-upgrade '' + # Just try all the migrations because they're not linked to the version + for sql in ${pkgs.sourcehut.pagessrht}/share/sql/migrations/*.sql; do + ${postgresql.package}/bin/psql '${cfg.settings.${iniKey}.connection-string}' -f "$sql" || true + done + ''} + + # Disable webhook + touch ${stateDir}/webhook + ''; + serviceConfig = { + ExecStart = mkForce "${pkgs.sourcehut.pagessrht}/bin/pages.sr.ht -b ${cfg.listenAddress}:${toString cfg.pages.port}"; + }; + }; + }) + + (import ./service.nix "paste" { + inherit configIniOfService; + port = 5011; + }) + + (import ./service.nix "todo" { + inherit configIniOfService; + port = 5003; + webhooks = true; + extraServices.todosrht-lmtp = { + wants = [ "postfix.service" ]; + unitConfig.JoinsNamespaceOf = optional cfg.postfix.enable "postfix.service"; + serviceConfig.ExecStart = "${cfg.python}/bin/todosrht-lmtp"; + # Avoid crashing: os.chown(sock, os.getuid(), sock_gid) + serviceConfig.PrivateUsers = mkForce false; + }; + extraConfig = mkIf cfg.postfix.enable { + users.groups.${postfix.group}.members = [ cfg.todo.user ]; + services.sourcehut.settings."todo.sr.ht::mail".sock-group = postfix.group; + services.postfix = { + destination = [ "todo.${domain}" ]; + # FIXME: an accurate recipient list should be queried + # from the todo.sr.ht PostgreSQL database to avoid backscattering. + # But usernames are unfortunately not in that database but in meta.sr.ht. + # Note that two syntaxes are allowed: + # - ~username/tracker-name@todo.${domain} + # - u.username.tracker-name@todo.${domain} + localRecipients = [ "@todo.${domain}" ]; + transport = '' + todo.${domain} lmtp:unix:${cfg.settings."todo.sr.ht::mail".sock} + ''; + }; + }; + }) + + (mkRenamedOptionModule [ "services" "sourcehut" "originBase" ] + [ "services" "sourcehut" "settings" "sr.ht" "global-domain" ]) + (mkRenamedOptionModule [ "services" "sourcehut" "address" ] + [ "services" "sourcehut" "listenAddress" ]) + + ]; + meta.doc = ./sourcehut.xml; - meta.maintainers = with maintainers; [ tomberek ]; + meta.maintainers = with maintainers; [ julm tomberek ]; } diff --git a/nixos/modules/services/misc/sourcehut/service.nix b/nixos/modules/services/misc/sourcehut/service.nix index 65b4ad020f9a..f1706ad0a6a8 100644 --- a/nixos/modules/services/misc/sourcehut/service.nix +++ b/nixos/modules/services/misc/sourcehut/service.nix @@ -1,66 +1,375 @@ -{ config, pkgs, lib }: -serviceCfg: serviceDrv: iniKey: attrs: +srv: +{ configIniOfService +, srvsrht ? "${srv}srht" # Because "buildsrht" does not follow that pattern (missing an "s"). +, iniKey ? "${srv}.sr.ht" +, webhooks ? false +, extraTimers ? {} +, mainService ? {} +, extraServices ? {} +, extraConfig ? {} +, port +}: +{ config, lib, pkgs, ... }: + +with lib; let + inherit (config.services) postgresql; + redis = config.services.redis.servers."sourcehut-${srvsrht}"; + inherit (config.users) users; cfg = config.services.sourcehut; - cfgIni = cfg.settings."${iniKey}"; - pgSuperUser = config.services.postgresql.superUser; - - setupDB = pkgs.writeScript "${serviceDrv.pname}-gen-db" '' - #! ${cfg.python}/bin/python - from ${serviceDrv.pname}.app import db - db.create() - ''; + configIni = configIniOfService srv; + srvCfg = cfg.${srv}; + baseService = serviceName: { allowStripe ? false }: extraService: let + runDir = "/run/sourcehut/${serviceName}"; + rootDir = "/run/sourcehut/chroots/${serviceName}"; + in + mkMerge [ extraService { + after = [ "network.target" ] ++ + optional cfg.postgresql.enable "postgresql.service" ++ + optional cfg.redis.enable "redis-sourcehut-${srvsrht}.service"; + requires = + optional cfg.postgresql.enable "postgresql.service" ++ + optional cfg.redis.enable "redis-sourcehut-${srvsrht}.service"; + path = [ pkgs.gawk ]; + environment.HOME = runDir; + serviceConfig = { + User = mkDefault srvCfg.user; + Group = mkDefault srvCfg.group; + RuntimeDirectory = [ + "sourcehut/${serviceName}" + # Used by *srht-keys which reads ../config.ini + "sourcehut/${serviceName}/subdir" + "sourcehut/chroots/${serviceName}" + ]; + RuntimeDirectoryMode = "2750"; + # No need for the chroot path once inside the chroot + InaccessiblePaths = [ "-+${rootDir}" ]; + # g+rx is for group members (eg. fcgiwrap or nginx) + # to read Git/Mercurial repositories, buildlogs, etc. + # o+x is for intermediate directories created by BindPaths= and like, + # as they're owned by root:root. + UMask = "0026"; + RootDirectory = rootDir; + RootDirectoryStartOnly = true; + PrivateTmp = true; + MountAPIVFS = true; + # config.ini is looked up in there, before /etc/srht/config.ini + # Note that it fails to be set in ExecStartPre= + WorkingDirectory = mkDefault ("-"+runDir); + BindReadOnlyPaths = [ + builtins.storeDir + "/etc" + "/run/booted-system" + "/run/current-system" + "/run/systemd" + ] ++ + optional cfg.postgresql.enable "/run/postgresql" ++ + optional cfg.redis.enable "/run/redis-sourcehut-${srvsrht}"; + # LoadCredential= are unfortunately not available in ExecStartPre= + # Hence this one is run as root (the +) with RootDirectoryStartOnly= + # to reach credentials wherever they are. + # Note that each systemd service gets its own ${runDir}/config.ini file. + ExecStartPre = mkBefore [("+"+pkgs.writeShellScript "${serviceName}-credentials" '' + set -x + # Replace values begining with a '<' by the content of the file whose name is after. + gawk '{ if (match($0,/^([^=]+=)<(.+)/,m)) { getline f < m[2]; print m[1] f } else print $0 }' ${configIni} | + ${optionalString (!allowStripe) "gawk '!/^stripe-secret-key=/' |"} + install -o ${srvCfg.user} -g root -m 400 /dev/stdin ${runDir}/config.ini + '')]; + # The following options are only for optimizing: + # systemd-analyze security + AmbientCapabilities = ""; + CapabilityBoundingSet = ""; + # ProtectClock= adds DeviceAllow=char-rtc r + DeviceAllow = ""; + LockPersonality = true; + MemoryDenyWriteExecute = true; + NoNewPrivileges = true; + PrivateDevices = true; + PrivateMounts = true; + PrivateNetwork = mkDefault false; + PrivateUsers = true; + ProcSubset = "pid"; + ProtectClock = true; + ProtectControlGroups = true; + ProtectHome = true; + ProtectHostname = true; + ProtectKernelLogs = true; + ProtectKernelModules = true; + ProtectKernelTunables = true; + ProtectProc = "invisible"; + ProtectSystem = "strict"; + RemoveIPC = true; + RestrictAddressFamilies = [ "AF_UNIX" "AF_INET" "AF_INET6" ]; + RestrictNamespaces = true; + RestrictRealtime = true; + RestrictSUIDSGID = true; + #SocketBindAllow = [ "tcp:${toString srvCfg.port}" "tcp:${toString srvCfg.prometheusPort}" ]; + #SocketBindDeny = "any"; + SystemCallFilter = [ + "@system-service" + "~@aio" "~@keyring" "~@memlock" "~@privileged" "~@resources" "~@timer" + "@chown" "@setuid" + ]; + SystemCallArchitectures = "native"; + }; + } ]; in -with serviceCfg; with lib; recursiveUpdate { - environment.HOME = statePath; - path = [ config.services.postgresql.package ] ++ (attrs.path or [ ]); - restartTriggers = [ config.environment.etc."sr.ht/config.ini".source ]; - serviceConfig = { - Type = "simple"; - User = user; - Group = user; - Restart = "always"; - WorkingDirectory = statePath; - } // (if (cfg.statePath == "/var/lib/sourcehut/${serviceDrv.pname}") then { - StateDirectory = [ "sourcehut/${serviceDrv.pname}" ]; - } else {}) - ; + options.services.sourcehut.${srv} = { + enable = mkEnableOption "${srv} service"; - preStart = '' - if ! test -e ${statePath}/db; then - # Setup the initial database - ${setupDB} + user = mkOption { + type = types.str; + default = srvsrht; + description = '' + User for ${srv}.sr.ht. + ''; + }; - # Set the initial state of the database for future database upgrades - if test -e ${cfg.python}/bin/${serviceDrv.pname}-migrate; then - # Run alembic stamp head once to tell alembic the schema is up-to-date - ${cfg.python}/bin/${serviceDrv.pname}-migrate stamp head - fi + group = mkOption { + type = types.str; + default = srvsrht; + description = '' + Group for ${srv}.sr.ht. + Membership grants access to the Git/Mercurial repositories by default, + but not to the config.ini file (where secrets are). + ''; + }; - printf "%s" "${serviceDrv.version}" > ${statePath}/db - fi + port = mkOption { + type = types.port; + default = port; + description = '' + Port on which the "${srv}" backend should listen. + ''; + }; - # Update copy of each users' profile to the latest - # See https://lists.sr.ht/~sircmpwn/sr.ht-admins/<20190302181207.GA13778%40cirno.my.domain> - if ! test -e ${statePath}/webhook; then - # Update ${iniKey}'s users' profile copy to the latest - ${cfg.python}/bin/srht-update-profiles ${iniKey} + redis = { + host = mkOption { + type = types.str; + default = "unix:/run/redis-sourcehut-${srvsrht}/redis.sock?db=0"; + example = "redis://shared.wireguard:6379/0"; + description = '' + The redis host URL. This is used for caching and temporary storage, and must + be shared between nodes (e.g. git1.sr.ht and git2.sr.ht), but need not be + shared between services. It may be shared between services, however, with no + ill effect, if this better suits your infrastructure. + ''; + }; + }; - touch ${statePath}/webhook - fi + postgresql = { + database = mkOption { + type = types.str; + default = "${srv}.sr.ht"; + description = '' + PostgreSQL database name for the ${srv}.sr.ht service, + used if is true. + ''; + }; + }; - ${optionalString (builtins.hasAttr "migrate-on-upgrade" cfgIni && cfgIni.migrate-on-upgrade == "yes") '' - if [ "$(cat ${statePath}/db)" != "${serviceDrv.version}" ]; then - # Manage schema migrations using alembic - ${cfg.python}/bin/${serviceDrv.pname}-migrate -a upgrade head + gunicorn = { + extraArgs = mkOption { + type = with types; listOf str; + default = ["--timeout 120" "--workers 1" "--log-level=info"]; + description = "Extra arguments passed to Gunicorn."; + }; + }; + } // optionalAttrs webhooks { + webhooks = { + extraArgs = mkOption { + type = with types; listOf str; + default = ["--loglevel DEBUG" "--pool eventlet" "--without-heartbeat"]; + description = "Extra arguments passed to the Celery responsible for webhooks."; + }; + celeryConfig = mkOption { + type = types.lines; + default = ""; + description = "Content of the celeryconfig.py used by the Celery responsible for webhooks."; + }; + }; + }; - # Mark down current package version - printf "%s" "${serviceDrv.version}" > ${statePath}/db - fi - ''} + config = lib.mkIf (cfg.enable && srvCfg.enable) (mkMerge [ extraConfig { + users = { + users = { + "${srvCfg.user}" = { + isSystemUser = true; + group = mkDefault srvCfg.group; + description = mkDefault "sourcehut user for ${srv}.sr.ht"; + }; + }; + groups = { + "${srvCfg.group}" = { }; + } // optionalAttrs (cfg.postgresql.enable + && hasSuffix "0" (postgresql.settings.unix_socket_permissions or "")) { + "postgres".members = [ srvCfg.user ]; + } // optionalAttrs (cfg.redis.enable + && hasSuffix "0" (redis.settings.unixsocketperm or "")) { + "redis-sourcehut-${srvsrht}".members = [ srvCfg.user ]; + }; + }; - ${attrs.preStart or ""} - ''; + services.nginx = mkIf cfg.nginx.enable { + virtualHosts."${srv}.${cfg.settings."sr.ht".global-domain}" = mkMerge [ { + forceSSL = mkDefault true; + locations."/".proxyPass = "http://${cfg.listenAddress}:${toString srvCfg.port}"; + locations."/static" = { + root = "${pkgs.sourcehut.${srvsrht}}/${pkgs.sourcehut.python.sitePackages}/${srvsrht}"; + extraConfig = mkDefault '' + expires 30d; + ''; + }; + } cfg.nginx.virtualHost ]; + }; + + services.postgresql = mkIf cfg.postgresql.enable { + authentication = '' + local ${srvCfg.postgresql.database} ${srvCfg.user} trust + ''; + ensureDatabases = [ srvCfg.postgresql.database ]; + ensureUsers = map (name: { + inherit name; + ensurePermissions = { "DATABASE \"${srvCfg.postgresql.database}\"" = "ALL PRIVILEGES"; }; + }) [srvCfg.user]; + }; + + services.sourcehut.services = mkDefault (filter (s: cfg.${s}.enable) + [ "builds" "dispatch" "git" "hg" "hub" "lists" "man" "meta" "pages" "paste" "todo" ]); + + services.sourcehut.settings = mkMerge [ + { + "${srv}.sr.ht".origin = mkDefault "https://${srv}.${cfg.settings."sr.ht".global-domain}"; + } + + (mkIf cfg.postgresql.enable { + "${srv}.sr.ht".connection-string = mkDefault "postgresql:///${srvCfg.postgresql.database}?user=${srvCfg.user}&host=/run/postgresql"; + }) + ]; + + services.redis.servers."sourcehut-${srvsrht}" = mkIf cfg.redis.enable { + enable = true; + databases = 3; + syslog = true; + # TODO: set a more informed value + save = mkDefault [ [1800 10] [300 100] ]; + settings = { + # TODO: set a more informed value + maxmemory = "128MB"; + maxmemory-policy = "volatile-ttl"; + }; + }; + + systemd.services = mkMerge [ + { + "${srvsrht}" = baseService srvsrht { allowStripe = srv == "meta"; } (mkMerge [ + { + description = "sourcehut ${srv}.sr.ht website service"; + before = optional cfg.nginx.enable "nginx.service"; + wants = optional cfg.nginx.enable "nginx.service"; + wantedBy = [ "multi-user.target" ]; + path = optional cfg.postgresql.enable postgresql.package; + # Beware: change in credentials' content will not trigger restart. + restartTriggers = [ configIni ]; + serviceConfig = { + Type = "simple"; + Restart = mkDefault "always"; + #RestartSec = mkDefault "2min"; + StateDirectory = [ "sourcehut/${srvsrht}" ]; + StateDirectoryMode = "2750"; + ExecStart = "${cfg.python}/bin/gunicorn ${srvsrht}.app:app --name ${srvsrht} --bind ${cfg.listenAddress}:${toString srvCfg.port} " + concatStringsSep " " srvCfg.gunicorn.extraArgs; + }; + preStart = let + version = pkgs.sourcehut.${srvsrht}.version; + stateDir = "/var/lib/sourcehut/${srvsrht}"; + in mkBefore '' + set -x + # Use the /run/sourcehut/${srvsrht}/config.ini + # installed by a previous ExecStartPre= in baseService + cd /run/sourcehut/${srvsrht} + + if test ! -e ${stateDir}/db; then + # Setup the initial database. + # Note that it stamps the alembic head afterward + ${cfg.python}/bin/${srvsrht}-initdb + echo ${version} >${stateDir}/db + fi + + ${optionalString cfg.settings.${iniKey}.migrate-on-upgrade '' + if [ "$(cat ${stateDir}/db)" != "${version}" ]; then + # Manage schema migrations using alembic + ${cfg.python}/bin/${srvsrht}-migrate -a upgrade head + echo ${version} >${stateDir}/db + fi + ''} + + # Update copy of each users' profile to the latest + # See https://lists.sr.ht/~sircmpwn/sr.ht-admins/<20190302181207.GA13778%40cirno.my.domain> + if test ! -e ${stateDir}/webhook; then + # Update ${iniKey}'s users' profile copy to the latest + ${cfg.python}/bin/srht-update-profiles ${iniKey} + touch ${stateDir}/webhook + fi + ''; + } mainService ]); + } + + (mkIf webhooks { + "${srvsrht}-webhooks" = baseService "${srvsrht}-webhooks" {} + { + description = "sourcehut ${srv}.sr.ht webhooks service"; + after = [ "${srvsrht}.service" ]; + wantedBy = [ "${srvsrht}.service" ]; + partOf = [ "${srvsrht}.service" ]; + preStart = '' + cp ${pkgs.writeText "${srvsrht}-webhooks-celeryconfig.py" srvCfg.webhooks.celeryConfig} \ + /run/sourcehut/${srvsrht}-webhooks/celeryconfig.py + ''; + serviceConfig = { + Type = "simple"; + Restart = "always"; + ExecStart = "${cfg.python}/bin/celery --app ${srvsrht}.webhooks worker --hostname ${srvsrht}-webhooks@%%h " + concatStringsSep " " srvCfg.webhooks.extraArgs; + # Avoid crashing: os.getloadavg() + ProcSubset = mkForce "all"; + }; + }; + }) + + (mapAttrs (timerName: timer: (baseService timerName {} (mkMerge [ + { + description = "sourcehut ${timerName} service"; + after = [ "network.target" "${srvsrht}.service" ]; + serviceConfig = { + Type = "oneshot"; + ExecStart = "${cfg.python}/bin/${timerName}"; + }; + } + (timer.service or {}) + ]))) extraTimers) + + (mapAttrs (serviceName: extraService: baseService serviceName {} (mkMerge [ + { + description = "sourcehut ${serviceName} service"; + # So that extraServices have the PostgreSQL database initialized. + after = [ "${srvsrht}.service" ]; + wantedBy = [ "${srvsrht}.service" ]; + partOf = [ "${srvsrht}.service" ]; + serviceConfig = { + Type = "simple"; + Restart = mkDefault "always"; + }; + } + extraService + ])) extraServices) + ]; + + systemd.timers = mapAttrs (timerName: timer: + { + description = "sourcehut timer for ${timerName}"; + wantedBy = [ "timers.target" ]; + inherit (timer) timerConfig; + }) extraTimers; + } ]); } - (builtins.removeAttrs attrs [ "path" "preStart" ]) diff --git a/nixos/modules/services/misc/sourcehut/sourcehut.xml b/nixos/modules/services/misc/sourcehut/sourcehut.xml index ab9a8c6cb4be..41094f65a94d 100644 --- a/nixos/modules/services/misc/sourcehut/sourcehut.xml +++ b/nixos/modules/services/misc/sourcehut/sourcehut.xml @@ -14,13 +14,12 @@ Basic usage Sourcehut is a Python and Go based set of applications. - services.sourcehut - by default will use + This NixOS module also provides basic configuration integrating Sourcehut into locally running services.nginx, - services.redis, - services.cron, + services.redis.servers.sourcehut, + services.postfix and - services.postgresql. + services.postgresql services. @@ -42,18 +41,23 @@ in { services.sourcehut = { enable = true; - originBase = fqdn; - services = [ "meta" "man" "git" ]; + git.enable = true; + man.enable = true; + meta.enable = true; + nginx.enable = true; + postfix.enable = true; + postgresql.enable = true; + redis.enable = true; settings = { "sr.ht" = { environment = "production"; global-domain = fqdn; origin = "https://${fqdn}"; # Produce keys with srht-keygen from sourcehut.coresrht. - network-key = "SECRET"; - service-key = "SECRET"; + network-key = "/run/keys/path/to/network-key"; + service-key = "/run/keys/path/to/service-key"; }; - webhooks.private-key= "SECRET"; + webhooks.private-key= "/run/keys/path/to/webhook-key"; }; }; diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix index 96ea8fc92804..09cd26a76692 100644 --- a/nixos/tests/all-tests.nix +++ b/nixos/tests/all-tests.nix @@ -436,6 +436,7 @@ in solanum = handleTest ./solanum.nix {}; solr = handleTest ./solr.nix {}; sonarr = handleTest ./sonarr.nix {}; + sourcehut = handleTest ./sourcehut.nix {}; spacecookie = handleTest ./spacecookie.nix {}; spark = handleTestOn ["x86_64-linux"] ./spark {}; sslh = handleTest ./sslh.nix {}; diff --git a/nixos/tests/sourcehut.nix b/nixos/tests/sourcehut.nix index b56a14ebf85e..d1536c593225 100644 --- a/nixos/tests/sourcehut.nix +++ b/nixos/tests/sourcehut.nix @@ -1,29 +1,197 @@ -import ./make-test-python.nix ({ pkgs, ... }: +import ./make-test-python.nix ({ pkgs, lib, ... }: +let + domain = "sourcehut.localdomain"; + # Note that wildcard certificates just under the TLD (eg. *.com) + # would be rejected by clients like curl. + tls-cert = pkgs.runCommand "selfSignedCerts" { buildInputs = [ pkgs.openssl ]; } '' + openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -nodes -days 36500 \ + -subj '/CN=${domain}' -extensions v3_req \ + -addext 'subjectAltName = DNS:*.${domain}' + install -D -t $out key.pem cert.pem + ''; + + images = { + nixos.unstable.x86_64 = + let + systemConfig = { pkgs, ... }: { + # passwordless ssh server + services.openssh = { + enable = true; + permitRootLogin = "yes"; + extraConfig = "PermitEmptyPasswords yes"; + }; + + users = { + mutableUsers = false; + # build user + extraUsers."build" = { + isNormalUser = true; + uid = 1000; + extraGroups = [ "wheel" ]; + password = ""; + }; + users.root.password = ""; + }; + + security.sudo.wheelNeedsPassword = false; + nix.trustedUsers = [ "root" "build" ]; + documentation.nixos.enable = false; + + # builds.sr.ht-image-specific network settings + networking = { + hostName = "build"; + dhcpcd.enable = false; + defaultGateway.address = "10.0.2.2"; + usePredictableInterfaceNames = false; + interfaces."eth0".ipv4.addresses = [{ + address = "10.0.2.15"; + prefixLength = 25; + }]; + enableIPv6 = false; + nameservers = [ + # OpenNIC anycast + "185.121.177.177" + "169.239.202.202" + # Google + "8.8.8.8" + ]; + firewall.allowedTCPPorts = [ 22 ]; + }; + + environment.systemPackages = [ + pkgs.gitMinimal + #pkgs.mercurial + pkgs.curl + pkgs.gnupg + ]; + }; + qemuConfig = { pkgs, ... }: { + imports = [ systemConfig ]; + fileSystems."/".device = "/dev/disk/by-label/nixos"; + boot.initrd.availableKernelModules = [ + "ahci" + "ehci_pci" + "sd_mod" + "usb_storage" + "usbhid" + "virtio_balloon" + "virtio_blk" + "virtio_pci" + "virtio_ring" + "xhci_pci" + ]; + boot.loader = { + grub = { + version = 2; + device = "/dev/vda"; + }; + timeout = 0; + }; + }; + config = (import (pkgs.path + "/nixos/lib/eval-config.nix") { + inherit pkgs; modules = [ qemuConfig ]; + system = "x86_64-linux"; + }).config; + in + import (pkgs.path + "/nixos/lib/make-disk-image.nix") { + inherit pkgs lib config; + diskSize = 16000; + format = "qcow2-compressed"; + contents = [ + { source = pkgs.writeText "gitconfig" '' + [user] + name = builds.sr.ht + email = build@sr.ht + ''; + target = "/home/build/.gitconfig"; + user = "build"; + group = "users"; + mode = "644"; + } + ]; + }; + }; + +in { name = "sourcehut"; meta.maintainers = [ pkgs.lib.maintainers.tomberek ]; - machine = { config, pkgs, ... }: { - virtualisation.memorySize = 2048; - networking.firewall.allowedTCPPorts = [ 80 ]; + machine = { config, pkgs, nodes, ... }: { + # buildsrht needs space + virtualisation.diskSize = 4 * 1024; + virtualisation.memorySize = 2 * 1024; + networking.domain = domain; + networking.extraHosts = '' + ${config.networking.primaryIPAddress} meta.${domain} + ${config.networking.primaryIPAddress} builds.${domain} + ''; services.sourcehut = { enable = true; - services = [ "meta" ]; - originBase = "sourcehut"; - settings."sr.ht".service-key = "8888888888888888888888888888888888888888888888888888888888888888"; - settings."sr.ht".network-key = "0000000000000000000000000000000000000000000="; - settings.webhooks.private-key = "0000000000000000000000000000000000000000000="; + services = [ "meta" "builds" ]; + nginx.enable = true; + nginx.virtualHost = { + forceSSL = true; + sslCertificate = "${tls-cert}/cert.pem"; + sslCertificateKey = "${tls-cert}/key.pem"; + }; + postgresql.enable = true; + redis.enable = true; + + meta.enable = true; + builds = { + enable = true; + # FIXME: see why it does not seem to activate fully. + #enableWorker = true; + inherit images; + }; + settings."sr.ht" = { + global-domain = config.networking.domain; + service-key = pkgs.writeText "service-key" "8b327279b77e32a3620e2fc9aabce491cc46e7d821fd6713b2a2e650ce114d01"; + network-key = pkgs.writeText "network-key" "cEEmc30BRBGkgQZcHFksiG7hjc6_dK1XR2Oo5Jb9_nQ="; + }; + settings."builds.sr.ht" = { + oauth-client-secret = pkgs.writeText "buildsrht-oauth-client-secret" "2260e9c4d9b8dcedcef642860e0504bc"; + oauth-client-id = "299db9f9c2013170"; + }; + settings.webhooks.private-key = pkgs.writeText "webhook-key" "Ra3IjxgFiwG9jxgp4WALQIZw/BMYt30xWiOsqD0J7EA="; + }; + + networking.firewall.allowedTCPPorts = [ 443 ]; + security.pki.certificateFiles = [ "${tls-cert}/cert.pem" ]; + services.nginx = { + enable = true; + recommendedGzipSettings = true; + recommendedOptimisation = true; + recommendedTlsSettings = true; + recommendedProxySettings = true; + }; + + services.postgresql = { + enable = true; + enableTCPIP = false; + settings.unix_socket_permissions = "0770"; }; }; testScript = '' start_all() machine.wait_for_unit("multi-user.target") + + # Testing metasrht + machine.wait_for_unit("metasrht-api.service") machine.wait_for_unit("metasrht.service") machine.wait_for_open_port(5000) - machine.succeed("curl -sL http://localhost:5000 | grep meta.sourcehut") + machine.succeed("curl -sL http://localhost:5000 | grep meta.${domain}") + machine.succeed("curl -sL http://meta.${domain} | grep meta.${domain}") + + # Testing buildsrht + machine.wait_for_unit("buildsrht.service") + machine.wait_for_open_port(5002) + machine.succeed("curl -sL http://localhost:5002 | grep builds.${domain}") + #machine.wait_for_unit("buildsrht-worker.service") ''; }) diff --git a/pkgs/applications/audio/sfizz/default.nix b/pkgs/applications/audio/sfizz/default.nix index 702f5c3982a2..d579e78b35e7 100644 --- a/pkgs/applications/audio/sfizz/default.nix +++ b/pkgs/applications/audio/sfizz/default.nix @@ -1,18 +1,16 @@ -{ lib, stdenv, fetchFromGitHub -, libjack2, libsndfile, xorg, freetype, libxkbcommon -, cairo, glib, gnome, flac, libogg, libvorbis, libopus -, cmake, pkg-config -}: +{ lib, stdenv, fetchFromGitHub, libjack2, libsndfile, xorg, freetype +, libxkbcommon, cairo, glib, gnome, flac, libogg, libvorbis, libopus, cmake +, pango, pkg-config }: stdenv.mkDerivation rec { pname = "sfizz"; - version = "0.5.1"; + version = "1.1.1"; src = fetchFromGitHub { owner = "sfztools"; repo = pname; rev = version; - sha256 = "sha256-3RdY5+BPsdk6vctDy24w5aJsVOV9qzSgXs62Pm5UEKs="; + sha256 = "1gzpbns89j6ggzfjjvyhgigynsv20synrs7lmc32hwp4g73l0j7n"; fetchSubmodules = true; }; @@ -37,18 +35,18 @@ stdenv.mkDerivation rec { glib gnome.zenity freetype + pango ]; nativeBuildInputs = [ cmake pkg-config ]; postPatch = '' - substituteInPlace editor/external/vstgui4/vstgui/lib/platform/linux/x11fileselector.cpp \ - --replace '"/usr/bin/zenity' '"${gnome.zenity}/bin/zenity' + substituteInPlace plugins/editor/external/vstgui4/vstgui/lib/platform/linux/x11fileselector.cpp \ + --replace 'zenitypath = "zenity"' 'zenitypath = "${gnome.zenity}/bin/zenity"' + substituteInPlace plugins/editor/src/editor/NativeHelpers.cpp \ + --replace '/usr/bin/zenity' '${gnome.zenity}/bin/zenity' ''; - cmakeFlags = [ - "-DCMAKE_BUILD_TYPE=Release" - "-DSFIZZ_TESTS=ON" - ]; + cmakeFlags = [ "-DCMAKE_BUILD_TYPE=Release" "-DSFIZZ_TESTS=ON" ]; meta = with lib; { homepage = "https://github.com/sfztools/sfizz"; diff --git a/pkgs/applications/kde/kalzium.nix b/pkgs/applications/kde/kalzium.nix index 3f51f068815b..02ab1bd52c20 100644 --- a/pkgs/applications/kde/kalzium.nix +++ b/pkgs/applications/kde/kalzium.nix @@ -3,7 +3,7 @@ mkDerivation { pname = "kalzium"; meta = with lib; { - homepage = "https://kde.org/applications/en/utilities/org.kde.kalzium"; + homepage = "https://edu.kde.org/kalzium/"; description = "Program that shows you the Periodic Table of Elements"; maintainers = with maintainers; [ freezeboy ]; license = licenses.gpl2Plus; diff --git a/pkgs/applications/kde/kipi-plugins.nix b/pkgs/applications/kde/kipi-plugins.nix index d79980a3a6f1..8dde231b7cec 100644 --- a/pkgs/applications/kde/kipi-plugins.nix +++ b/pkgs/applications/kde/kipi-plugins.nix @@ -17,7 +17,7 @@ mkDerivation { meta = { description = "Plugins for KDE-based image applications"; license = lib.licenses.gpl2; - homepage = "https://cgit.kde.org/kipi-plugins.git"; + homepage = "https://github.com/KDE/kipi-plugins"; maintainers = with lib.maintainers; [ ttuegel ]; }; } diff --git a/pkgs/applications/misc/inherd-quake/default.nix b/pkgs/applications/misc/inherd-quake/default.nix index 2a8d04daa0c3..1b0de8a65811 100644 --- a/pkgs/applications/misc/inherd-quake/default.nix +++ b/pkgs/applications/misc/inherd-quake/default.nix @@ -9,17 +9,17 @@ }: rustPlatform.buildRustPackage rec { - pname = "quake"; + pname = "inherd-quake"; version = "0.3.0"; src = fetchFromGitHub { owner = "phodal"; - repo = pname; + repo = "quake"; rev = "v${version}"; sha256 = "1f7k68g18g3dpnrsmhgmz753bly1i3f4lmsljiyp9ap0c6w8ahgg"; }; - cargoSha256 = "1yqj9rq770j116138bqn4ycggy13vvym1cz50myfddb9rjjzafrl"; + cargoSha256 = "17q9sjypa331gdfvmx1kbcbvnj34rnsf37b9rnji4jrqfysgrs5w"; nativeBuildInputs = [ pkg-config ]; @@ -35,5 +35,6 @@ rustPlatform.buildRustPackage rec { homepage = "https://github.com/phodal/quake"; license = licenses.mit; maintainers = [ maintainers.elliot ]; + mainProgram = "quake"; }; } diff --git a/pkgs/applications/misc/marktext/default.nix b/pkgs/applications/misc/marktext/default.nix index 1e71493e5fec..0688c189e45e 100644 --- a/pkgs/applications/misc/marktext/default.nix +++ b/pkgs/applications/misc/marktext/default.nix @@ -50,5 +50,6 @@ appimageTools.wrapType2 rec { license = licenses.mit; maintainers = with maintainers; [ nh2 ]; platforms = [ "x86_64-linux" ]; + mainProgram = "marktext"; }; } diff --git a/pkgs/applications/misc/metadata-cleaner/default.nix b/pkgs/applications/misc/metadata-cleaner/default.nix index d869164f6609..f113eed155fc 100644 --- a/pkgs/applications/misc/metadata-cleaner/default.nix +++ b/pkgs/applications/misc/metadata-cleaner/default.nix @@ -9,7 +9,7 @@ , itstool , libadwaita , librsvg -, meson +, meson_0_60 , ninja , pkg-config , poppler_gi @@ -18,7 +18,7 @@ python3.pkgs.buildPythonApplication rec { pname = "metadata-cleaner"; - version = "2.0.1"; + version = "2.1.3"; format = "other"; @@ -26,7 +26,7 @@ python3.pkgs.buildPythonApplication rec { owner = "rmnvgr"; repo = "metadata-cleaner"; rev = "v${version}"; - sha256 = "sha256-iTKs3DEZSzqRARXJKPPygvCS5JNUMbQBkfjacwd168Y="; + hash = "sha256-9sLjgqqQBXcudlBRmqAwWcWMUXoIUyAK272zaNKbJNY="; }; nativeBuildInputs = [ @@ -35,7 +35,7 @@ python3.pkgs.buildPythonApplication rec { glib gtk4 itstool - meson + meson_0_60 ninja pkg-config wrapGAppsHook diff --git a/pkgs/applications/networking/cluster/spark/default.nix b/pkgs/applications/networking/cluster/spark/default.nix index af194afafa9a..3de0f9441138 100644 --- a/pkgs/applications/networking/cluster/spark/default.nix +++ b/pkgs/applications/networking/cluster/spark/default.nix @@ -46,7 +46,7 @@ let meta = { description = "Apache Spark is a fast and general engine for large-scale data processing"; - homepage = "http://spark.apache.org"; + homepage = "https://spark.apache.org"; license = lib.licenses.asl20; platforms = lib.platforms.all; maintainers = with maintainers; [ thoughtpolice offline kamilchm illustris ]; diff --git a/pkgs/applications/radio/flex-ncat/default.nix b/pkgs/applications/radio/flex-ncat/default.nix index 360769a44dda..dee9f29da73f 100644 --- a/pkgs/applications/radio/flex-ncat/default.nix +++ b/pkgs/applications/radio/flex-ncat/default.nix @@ -2,16 +2,16 @@ buildGoModule rec { pname = "flex-ncat"; - version = "0.0-20210420.0"; + version = "0.1-20211223.0"; src = fetchFromGitHub { owner = "kc2g-flex-tools"; repo = "nCAT"; rev = "v${version}"; - sha256 = "0wrdmlp9rrr4n0g9pj0j20ddskllyr59dr3p5fm9z0avkncn3a0m"; + hash = "sha256-l5IH6EtWqxMLqUfIYpaKgZE9Jq8q4+WgZIazQ2scyxg="; }; - vendorSha256 = "0npzhvpyaxvfaivycnscvh45lp0ycdg9xrlfm8vhfr835yj2adiv"; + vendorSha256 = "sha256-OzYlpC8DZQc3qo7mnl5jHlxaCNxMW+Z3VG535e+G/1o="; meta = with lib; { homepage = "https://github.com/kc2g-flex-tools/nCAT"; diff --git a/pkgs/applications/version-management/gitlab/data.json b/pkgs/applications/version-management/gitlab/data.json index 7c23d18a6a94..4a1e7f46ea38 100644 --- a/pkgs/applications/version-management/gitlab/data.json +++ b/pkgs/applications/version-management/gitlab/data.json @@ -1,14 +1,14 @@ { - "version": "14.5.2", - "repo_hash": "sha256-sXRVnxb7b3grosg0YXwd+GBXHF7mDxIRXhWHcswZjdA=", - "yarn_hash": "134x774vz1w9qhxs6xfk7vnajxzqwfyb9f55qhpwqprg6ldwivkr", + "version": "14.6.0", + "repo_hash": "0b77nh7xq5qalzhvfmsymmkrb78lmaffk464b074wi5c8gy3f5dn", + "yarn_hash": "1kcjbf8xn3bwac2s9i2i7dpgbkwcjh09wvgbgysm5yffpdswg6nl", "owner": "gitlab-org", "repo": "gitlab", - "rev": "v14.5.2-ee", + "rev": "v14.6.0-ee", "passthru": { - "GITALY_SERVER_VERSION": "14.5.2", - "GITLAB_PAGES_VERSION": "1.48.0", + "GITALY_SERVER_VERSION": "14.6.0", + "GITLAB_PAGES_VERSION": "1.49.0", "GITLAB_SHELL_VERSION": "13.22.1", - "GITLAB_WORKHORSE_VERSION": "14.5.2" + "GITLAB_WORKHORSE_VERSION": "14.6.0" } } diff --git a/pkgs/applications/version-management/gitlab/gitaly/Gemfile b/pkgs/applications/version-management/gitlab/gitaly/Gemfile index 6568c0c3cbf4..bec450d04760 100644 --- a/pkgs/applications/version-management/gitlab/gitaly/Gemfile +++ b/pkgs/applications/version-management/gitlab/gitaly/Gemfile @@ -31,3 +31,11 @@ group :development, :test do gem 'grpc-tools', '= 1.30.2' end + +# Gems required in omnibus-gitlab pipeline +group :development, :test, :omnibus do + # Using a fork until https://github.com/pivotal/LicenseFinder/pull/816 is + # resolved. For details, check discussion in + # https://gitlab.com/gitlab-org/gitlab/-/merge_requests/74881 + gem 'gitlab-license_finder', require: false +end diff --git a/pkgs/applications/version-management/gitlab/gitaly/Gemfile.lock b/pkgs/applications/version-management/gitlab/gitaly/Gemfile.lock index b5c5ec672b37..415ca4b16752 100644 --- a/pkgs/applications/version-management/gitlab/gitaly/Gemfile.lock +++ b/pkgs/applications/version-management/gitlab/gitaly/Gemfile.lock @@ -26,7 +26,7 @@ GEM memoizable (~> 0.4.0) addressable (2.7.0) public_suffix (>= 2.0.2, < 5.0) - ast (2.4.1) + ast (2.4.2) binding_ninja (0.2.3) builder (3.2.4) charlock_holmes (0.7.7) @@ -73,6 +73,13 @@ GEM opentracing (~> 0.4) pg_query (~> 2.1) redis (> 3.0.0, < 5.0.0) + gitlab-license_finder (6.14.2.1) + bundler + rubyzip (>= 1, < 3) + thor (~> 1.0) + tomlrb (>= 1.3, < 2.1) + with_env (= 1.1.0) + xml-simple (~> 1.1.5) gitlab-markup (1.7.1) google-protobuf (3.17.3) googleapis-common-protos-types (1.1.0) @@ -119,7 +126,7 @@ GEM opentracing (0.5.0) optimist (3.0.1) parallel (1.19.2) - parser (2.7.2.0) + parser (3.0.3.2) ast (~> 2.4.1) pg_query (2.1.1) google-protobuf (>= 3.17.1) @@ -184,6 +191,7 @@ GEM rubocop-ast (0.2.0) parser (>= 2.7.0.1) ruby-progressbar (1.10.1) + rubyzip (2.3.2) rugged (1.2.0) sanitize (4.6.6) crass (~> 1.0.2) @@ -199,6 +207,7 @@ GEM thread_safe (0.3.6) thrift (0.15.0) timecop (0.9.1) + tomlrb (2.0.1) tzinfo (2.0.4) concurrent-ruby (~> 1.0) unicode-display_width (1.7.0) @@ -210,6 +219,9 @@ GEM equalizer (~> 0.0.9) parser (>= 2.6.5) procto (~> 0.0.2) + with_env (1.1.0) + xml-simple (1.1.9) + rexml zeitwerk (2.4.2) PLATFORMS @@ -223,6 +235,7 @@ DEPENDENCIES gitlab-gollum-lib (~> 4.2.7.10.gitlab.1) gitlab-gollum-rugged_adapter (~> 0.4.4.4.gitlab.1) gitlab-labkit (~> 0.21.1) + gitlab-license_finder gitlab-markup (~> 1.7.1) google-protobuf (~> 3.17.0) grpc (~> 1.30.2) diff --git a/pkgs/applications/version-management/gitlab/gitaly/default.nix b/pkgs/applications/version-management/gitlab/gitaly/default.nix index b4eceb190446..7cfcdf7dd746 100644 --- a/pkgs/applications/version-management/gitlab/gitaly/default.nix +++ b/pkgs/applications/version-management/gitlab/gitaly/default.nix @@ -33,7 +33,7 @@ let }; }; - version = "14.5.2"; + version = "14.6.0"; gitaly_package = "gitlab.com/gitlab-org/gitaly/v${lib.versions.major version}"; in @@ -45,7 +45,7 @@ buildGoModule { owner = "gitlab-org"; repo = "gitaly"; rev = "v${version}"; - sha256 = "sha256-x8LRBd0bw1JipBu3MbV0d8WFIFPD7joZDBGOr1gstMg="; + sha256 = "sha256-YiDZtWRb1PnCAv+UCPRQFoCA12vf3xoHoJ1i/hW+vMg="; }; vendorSha256 = "sha256-ZLd4E3+e25Hqmd6ZyF3X6BveMEg7OF0FX9IvNBWn3v0="; diff --git a/pkgs/applications/version-management/gitlab/gitaly/gemset.nix b/pkgs/applications/version-management/gitlab/gitaly/gemset.nix index 0fa91679adb2..5e9efe0a8245 100644 --- a/pkgs/applications/version-management/gitlab/gitaly/gemset.nix +++ b/pkgs/applications/version-management/gitlab/gitaly/gemset.nix @@ -65,10 +65,10 @@ platforms = []; source = { remotes = ["https://rubygems.org"]; - sha256 = "1l3468czzjmxl93ap40hp7z94yxp4nbag0bxqs789bm30md90m2a"; + sha256 = "04nc8x27hlzlrr5c2gn7mar4vdr0apw5xg22wp6m8dx3wqr04a0y"; type = "gem"; }; - version = "2.4.1"; + version = "2.4.2"; }; binding_ninja = { groups = ["default" "development" "test"]; @@ -274,6 +274,17 @@ }; version = "0.21.2"; }; + gitlab-license_finder = { + dependencies = ["rubyzip" "thor" "tomlrb" "with_env" "xml-simple"]; + groups = ["development" "omnibus" "test"]; + platforms = []; + source = { + remotes = ["https://rubygems.org"]; + sha256 = "0fzrv96kbzyqnsdj762x7n0y006rsgsi8k23nad4xsa43d065i71"; + type = "gem"; + }; + version = "6.14.2.1"; + }; gitlab-markup = { groups = ["default"]; platforms = []; @@ -543,10 +554,10 @@ platforms = []; source = { remotes = ["https://rubygems.org"]; - sha256 = "1f7gmm60yla325wlnd3qkxs59qm2y0aan8ljpg6k18rwzrrfil6z"; + sha256 = "0sszdl9mpzqzn9kxrp28sqmg47mjxcwypr4d60vbajqba4v885di"; type = "gem"; }; - version = "2.7.2.0"; + version = "3.0.3.2"; }; pg_query = { dependencies = ["google-protobuf"]; @@ -825,6 +836,16 @@ }; version = "1.10.1"; }; + rubyzip = { + groups = ["default" "development" "omnibus" "test"]; + platforms = []; + source = { + remotes = ["https://rubygems.org"]; + sha256 = "0grps9197qyxakbpw02pda59v45lfgbgiyw48i0mq9f2bn9y6mrz"; + type = "gem"; + }; + version = "2.3.2"; + }; rugged = { groups = ["default"]; platforms = []; @@ -912,6 +933,16 @@ }; version = "0.9.1"; }; + tomlrb = { + groups = ["default" "development" "omnibus" "test"]; + platforms = []; + source = { + remotes = ["https://rubygems.org"]; + sha256 = "0a83cb5xpyzlr651d46rk5xgq37s46hs9nfqy9baawzs31hm9k2g"; + type = "gem"; + }; + version = "2.0.1"; + }; tzinfo = { dependencies = ["concurrent-ruby"]; groups = ["default" "development" "test"]; @@ -944,6 +975,27 @@ }; version = "0.4.7"; }; + with_env = { + groups = ["default" "development" "omnibus" "test"]; + platforms = []; + source = { + remotes = ["https://rubygems.org"]; + sha256 = "1r5ns064mbb99hf1dyxsk9183hznc5i7mn3bi86zka6dlvqf9csh"; + type = "gem"; + }; + version = "1.1.0"; + }; + xml-simple = { + dependencies = ["rexml"]; + groups = ["default" "development" "omnibus" "test"]; + platforms = []; + source = { + remotes = ["https://rubygems.org"]; + sha256 = "0pb9plyl71mdbjr4kllfy53qx6g68ryxblmnq9dilvy837jk24fj"; + type = "gem"; + }; + version = "1.1.9"; + }; zeitwerk = { groups = ["default" "development" "test"]; platforms = []; diff --git a/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix b/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix index b592fc6faa22..fd8bdd2aef17 100644 --- a/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix +++ b/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix @@ -5,7 +5,7 @@ in buildGoModule rec { pname = "gitlab-workhorse"; - version = "14.5.2"; + version = "14.6.0"; src = fetchFromGitLab { owner = data.owner; @@ -16,7 +16,7 @@ buildGoModule rec { sourceRoot = "source/workhorse"; - vendorSha256 = "sha256-yLZY9FFUS4nJl4TkE6MwICCEwtPTXFc5zuj4FgiIy74="; + vendorSha256 = "sha256-ps/MjNY2woHrfcsNZTurnO2TbasWdS3LiuPUfVD2Ypc="; buildInputs = [ git ]; ldflags = [ "-X main.Version=${version}" ]; doCheck = false; diff --git a/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile b/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile index 69a8528d6897..a28a05536ffc 100644 --- a/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile +++ b/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile @@ -153,7 +153,7 @@ gem 'faraday_middleware-aws-sigv4', '~>0.3.0' # Markdown and HTML processing gem 'html-pipeline', '~> 2.13.2' gem 'deckar01-task_list', '2.3.1' -gem 'gitlab-markup', '~> 1.7.1' +gem 'gitlab-markup', '~> 1.8.0' gem 'github-markup', '~> 1.7.0', require: 'github/markup' gem 'commonmarker', '~> 0.23.2' gem 'kramdown', '~> 2.3.1' @@ -185,7 +185,7 @@ gem 'rack', '~> 2.2.3' gem 'rack-timeout', '~> 0.5.1', require: 'rack/timeout/base' group :puma do - gem 'puma', '~> 5.3.1', require: false + gem 'puma', '~> 5.5.2', require: false gem 'puma_worker_killer', '~> 0.3.1', require: false gem 'sd_notify', '~> 0.1.0', require: false end @@ -194,10 +194,10 @@ end gem 'state_machines-activerecord', '~> 0.8.0' # Issue tags -gem 'acts-as-taggable-on', '~> 7.0' +gem 'acts-as-taggable-on', '~> 8.1' # Background jobs -gem 'sidekiq', '~> 6.2.2' +gem 'sidekiq', '~> 6.3' gem 'sidekiq-cron', '~> 1.0' gem 'redis-namespace', '~> 1.8.1' gem 'gitlab-sidekiq-fetcher', '0.8.0', require: 'sidekiq-reliable-fetch' @@ -376,7 +376,7 @@ group :development, :test do gem 'spring', '~> 2.1.0' gem 'spring-commands-rspec', '~> 1.0.4' - gem 'gitlab-styles', '~> 6.4.0', require: false + gem 'gitlab-styles', '~> 6.6.0', require: false gem 'haml_lint', '~> 0.36.0', require: false gem 'bundler-audit', '~> 0.7.0.1', require: false @@ -400,17 +400,22 @@ group :development, :test do end group :development, :test, :danger do - gem 'gitlab-dangerfiles', '~> 2.5.0', require: false + gem 'gitlab-dangerfiles', '~> 2.6.1', require: false end group :development, :test, :coverage do gem 'simplecov', '~> 0.18.5', require: false + gem 'simplecov-lcov', '~> 0.8.0', require: false gem 'simplecov-cobertura', '~> 1.3.1', require: false + gem 'undercover', '~> 0.4.4', require: false end # Gems required in omnibus-gitlab pipeline group :development, :test, :omnibus do - gem 'license_finder', '~> 6.0', require: false + # Using a fork until https://github.com/pivotal/LicenseFinder/pull/816 is + # resolved. For details, check discussion in + # https://gitlab.com/gitlab-org/gitlab/-/merge_requests/74881 + gem 'gitlab-license_finder', '~> 6.0', require: false end group :test do @@ -459,7 +464,7 @@ gem 'health_check', '~> 3.0' # System information gem 'vmstat', '~> 2.3.0' -gem 'sys-filesystem', '~> 1.1.6' +gem 'sys-filesystem', '~> 1.4.3' # NTP client gem 'net-ntp' @@ -471,7 +476,7 @@ gem 'sshkey', '~> 2.0' # Required for ED25519 SSH host key support group :ed25519 do gem 'ed25519', '~> 1.2' - gem 'bcrypt_pbkdf', '~> 1.0' + gem 'bcrypt_pbkdf', '~> 1.1' end # Spamcheck GRPC protocol definitions @@ -494,7 +499,7 @@ gem 'flipper', '~> 0.21.0' gem 'flipper-active_record', '~> 0.21.0' gem 'flipper-active_support_cache_store', '~> 0.21.0' gem 'unleash', '~> 3.2.2' -gem 'gitlab-experiment', '~> 0.6.4' +gem 'gitlab-experiment', '~> 0.6.5' # Structured logging gem 'lograge', '~> 0.5' @@ -539,4 +544,4 @@ gem 'ipaddress', '~> 0.8.3' gem 'parslet', '~> 1.8' -gem 'ipynbdiff', '0.3.7' +gem 'ipynbdiff', '0.3.8' diff --git a/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile.lock b/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile.lock index 4da4cce018bf..3bfd392abaf9 100644 --- a/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile.lock +++ b/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile.lock @@ -66,7 +66,7 @@ GEM minitest (>= 5.1) tzinfo (~> 2.0) zeitwerk (~> 2.3) - acts-as-taggable-on (7.0.0) + acts-as-taggable-on (8.1.0) activerecord (>= 5.0, < 6.2) addressable (2.8.0) public_suffix (>= 2.0.2, < 5.0) @@ -130,7 +130,7 @@ GEM base32 (0.3.2) batch-loader (2.0.1) bcrypt (3.1.16) - bcrypt_pbkdf (1.0.0) + bcrypt_pbkdf (1.1.0) benchmark (0.1.1) benchmark-ips (2.3.0) benchmark-memory (0.1.2) @@ -215,7 +215,7 @@ GEM css_parser (1.7.0) addressable daemons (1.3.1) - danger (8.4.1) + danger (8.4.2) claide (~> 1.0) claide-plugins (>= 0.9.2) colored2 (~> 3.1) @@ -451,10 +451,10 @@ GEM terminal-table (~> 1.5, >= 1.5.1) gitlab-chronic (0.10.5) numerizer (~> 0.2) - gitlab-dangerfiles (2.5.0) + gitlab-dangerfiles (2.6.1) danger (>= 8.3.1) danger-gitlab (>= 8.0.0) - gitlab-experiment (0.6.4) + gitlab-experiment (0.6.5) activesupport (>= 3.0) request_store (>= 1.0) scientist (~> 1.6, >= 1.6.0) @@ -474,8 +474,15 @@ GEM pg_query (~> 2.1) redis (> 3.0.0, < 5.0.0) gitlab-license (2.0.0) + gitlab-license_finder (6.14.2.1) + bundler + rubyzip (>= 1, < 3) + thor (~> 1.0) + tomlrb (>= 1.3, < 2.1) + with_env (= 1.1.0) + xml-simple (~> 1.1.5) gitlab-mail_room (0.0.9) - gitlab-markup (1.7.1) + gitlab-markup (1.8.0) gitlab-net-dns (0.9.1) gitlab-omniauth-openid-connect (0.8.0) addressable (~> 2.7) @@ -483,9 +490,10 @@ GEM openid_connect (~> 1.2) gitlab-sidekiq-fetcher (0.8.0) sidekiq (~> 6.1) - gitlab-styles (6.4.0) + gitlab-styles (6.6.0) rubocop (~> 0.91, >= 0.91.1) rubocop-gitlab-security (~> 0.1.1) + rubocop-graphql (~> 0.10) rubocop-performance (~> 1.9.2) rubocop-rails (~> 2.9) rubocop-rspec (~> 1.44) @@ -626,14 +634,16 @@ GEM mime-types (~> 3.0) multi_xml (>= 0.5.2) httpclient (2.8.3) - i18n (1.8.10) + i18n (1.8.11) concurrent-ruby (~> 1.0) i18n_data (0.8.0) icalendar (2.4.1) + imagen (0.1.8) + parser (>= 2.5, != 2.5.1.1) invisible_captcha (1.1.0) rails (>= 4.2) ipaddress (0.8.3) - ipynbdiff (0.3.7) + ipynbdiff (0.3.8) diffy (= 3.3.0) json (= 2.5.1) jaeger-client (1.1.0) @@ -699,13 +709,6 @@ GEM railties (>= 5.2) rexml libyajl2 (1.2.0) - license_finder (6.0.0) - bundler - rubyzip (>= 1, < 3) - thor - toml (= 0.2.0) - with_env (= 1.1.0) - xml-simple licensee (9.14.1) dotenv (~> 2.0) octokit (~> 4.17) @@ -896,7 +899,7 @@ GEM orm_adapter (0.5.0) os (1.1.1) parallel (1.20.1) - parser (3.0.2.0) + parser (3.0.3.2) ast (~> 2.4.1) parslet (1.8.2) pastel (0.8.0) @@ -935,7 +938,7 @@ GEM tty-markdown tty-prompt public_suffix (4.0.6) - puma (5.3.2) + puma (5.5.2) nio4r (~> 2.0) puma_worker_killer (0.3.1) get_process_mem (~> 0.2) @@ -1100,6 +1103,8 @@ GEM parser (>= 2.7.1.5) rubocop-gitlab-security (0.1.1) rubocop (>= 0.51) + rubocop-graphql (0.10.3) + rubocop (>= 0.87, < 2) rubocop-performance (1.9.2) rubocop (>= 0.90.0, < 2.0) rubocop-ast (>= 0.4.0) @@ -1151,7 +1156,7 @@ GEM sawyer (0.8.2) addressable (>= 2.3.5) faraday (> 0.8, < 2.0) - scientist (1.6.0) + scientist (1.6.2) sd_notify (0.1.0) securecompare (1.0.0) seed-fu (2.3.7) @@ -1168,7 +1173,7 @@ GEM shellany (0.0.1) shoulda-matchers (4.0.1) activesupport (>= 4.2.0) - sidekiq (6.2.2) + sidekiq (6.3.1) connection_pool (>= 2.2.2) rack (~> 2.0) redis (>= 4.2.0) @@ -1187,6 +1192,7 @@ GEM simplecov-cobertura (1.3.1) simplecov (~> 0.8) simplecov-html (0.12.3) + simplecov-lcov (0.8.0) sixarm_ruby_unaccent (1.2.0) slack-messenger (2.3.4) snowplow-tracker (0.6.1) @@ -1242,8 +1248,8 @@ GEM activesupport (>= 3) attr_required (>= 0.0.5) httpclient (>= 2.4) - sys-filesystem (1.1.9) - ffi + sys-filesystem (1.4.3) + ffi (~> 1.1) sysexits (1.2.0) tanuki_emoji (0.5.0) temple (0.8.2) @@ -1265,8 +1271,6 @@ GEM timecop (0.9.1) timeliness (0.3.10) timfel-krb5-auth (0.8.3) - toml (0.2.0) - parslet (~> 1.8.0) toml-rb (2.0.1) citrus (~> 3.0, > 3.0) tomlrb (1.3.0) @@ -1304,6 +1308,10 @@ GEM concurrent-ruby (~> 1.0) u2f (0.2.1) uber (0.1.0) + undercover (0.4.4) + imagen (>= 0.1.8) + rainbow (>= 2.1, < 4.0) + rugged (>= 0.27, < 1.3) unf (0.1.4) unf_ext unf_ext (0.0.7.7) @@ -1366,7 +1374,7 @@ GEM nokogiri (~> 1.8) yajl-ruby (1.4.1) yard (0.9.26) - zeitwerk (2.4.2) + zeitwerk (2.5.1) PLATFORMS ruby @@ -1375,7 +1383,7 @@ DEPENDENCIES RedCloth (~> 4.3.2) acme-client (~> 2.0, >= 2.0.6) activerecord-explain-analyze (~> 0.1) - acts-as-taggable-on (~> 7.0) + acts-as-taggable-on (~> 8.1) addressable (~> 2.8) akismet (~> 3.0) apollo_upload_server (~> 2.1.0) @@ -1395,7 +1403,7 @@ DEPENDENCIES base32 (~> 0.3.0) batch-loader (~> 2.0.1) bcrypt (~> 3.1, >= 3.1.14) - bcrypt_pbkdf (~> 1.0) + bcrypt_pbkdf (~> 1.1) benchmark-ips (~> 2.3.0) benchmark-memory (~> 0.1) better_errors (~> 2.9.0) @@ -1460,17 +1468,18 @@ DEPENDENCIES gitaly (~> 14.4.0.pre.rc43) github-markup (~> 1.7.0) gitlab-chronic (~> 0.10.5) - gitlab-dangerfiles (~> 2.5.0) - gitlab-experiment (~> 0.6.4) + gitlab-dangerfiles (~> 2.6.1) + gitlab-experiment (~> 0.6.5) gitlab-fog-azure-rm (~> 1.2.0) gitlab-labkit (~> 0.21.1) gitlab-license (~> 2.0) + gitlab-license_finder (~> 6.0) gitlab-mail_room (~> 0.0.9) - gitlab-markup (~> 1.7.1) + gitlab-markup (~> 1.8.0) gitlab-net-dns (~> 0.9.1) gitlab-omniauth-openid-connect (~> 0.8.0) gitlab-sidekiq-fetcher (= 0.8.0) - gitlab-styles (~> 6.4.0) + gitlab-styles (~> 6.6.0) gitlab_chronic_duration (~> 0.10.6.2) gitlab_omniauth-ldap (~> 2.1.1) gon (~> 6.4.0) @@ -1500,7 +1509,7 @@ DEPENDENCIES icalendar invisible_captcha (~> 1.1.0) ipaddress (~> 0.8.3) - ipynbdiff (= 0.3.7) + ipynbdiff (= 0.3.8) jira-ruby (~> 2.1.4) js_regex (~> 3.7) json (~> 2.5.1) @@ -1513,7 +1522,6 @@ DEPENDENCIES kubeclient (~> 4.9.2) lefthook (~> 0.7.0) letter_opener_web (~> 2.0.0) - license_finder (~> 6.0) licensee (~> 9.14.1) lockbox (~> 0.6.2) lograge (~> 0.5) @@ -1565,7 +1573,7 @@ DEPENDENCIES pry-byebug pry-rails (~> 0.3.9) pry-shell (~> 0.5.0) - puma (~> 5.3.1) + puma (~> 5.5.2) puma_worker_killer (~> 0.3.1) rack (~> 2.2.3) rack-attack (~> 6.3.0) @@ -1612,11 +1620,12 @@ DEPENDENCIES sentry-raven (~> 3.1) settingslogic (~> 2.0.9) shoulda-matchers (~> 4.0.1) - sidekiq (~> 6.2.2) + sidekiq (~> 6.3) sidekiq-cron (~> 1.0) simple_po_parser (~> 1.1.2) simplecov (~> 0.18.5) simplecov-cobertura (~> 1.3.1) + simplecov-lcov (~> 0.8.0) slack-messenger (~> 2.3.4) snowplow-tracker (~> 0.6.1) solargraph (~> 0.43) @@ -1628,7 +1637,7 @@ DEPENDENCIES sshkey (~> 2.0) stackprof (~> 0.2.15) state_machines-activerecord (~> 0.8.0) - sys-filesystem (~> 1.1.6) + sys-filesystem (~> 1.4.3) tanuki_emoji (~> 0.5) terser (= 1.0.2) test-prof (~> 1.0.7) @@ -1639,6 +1648,7 @@ DEPENDENCIES toml-rb (~> 2.0) truncato (~> 0.7.11) u2f (~> 0.2.1) + undercover (~> 0.4.4) unf (~> 0.1.4) unleash (~> 3.2.2) valid_email (~> 0.1) diff --git a/pkgs/applications/version-management/gitlab/rubyEnv/gemset.nix b/pkgs/applications/version-management/gitlab/rubyEnv/gemset.nix index 5154254b165a..3ee8ea0512bd 100644 --- a/pkgs/applications/version-management/gitlab/rubyEnv/gemset.nix +++ b/pkgs/applications/version-management/gitlab/rubyEnv/gemset.nix @@ -148,10 +148,10 @@ platforms = []; source = { remotes = ["https://rubygems.org"]; - sha256 = "09m7lvm6id8mm8y9qycjr54l9gyqfb43x6yjz23cggisjg0px1fv"; + sha256 = "0kfnyix173bazjswab21bx7hmqmik71awj2kz090fsa2nv58c4mw"; type = "gem"; }; - version = "7.0.0"; + version = "8.1.0"; }; addressable = { dependencies = ["public_suffix"]; @@ -484,10 +484,10 @@ platforms = []; source = { remotes = ["https://rubygems.org"]; - sha256 = "0cj4k13c7qvvck7y25i3xarvyqq8d27vl61jddifkc7llnnap1hv"; + sha256 = "0ndamfaivnkhc6hy0yqyk2gkwr6f3bz6216lh74hsiiyk3axz445"; type = "gem"; }; - version = "1.0.0"; + version = "1.1.0"; }; benchmark = { groups = ["default" "development"]; @@ -931,10 +931,10 @@ platforms = []; source = { remotes = ["https://rubygems.org"]; - sha256 = "1f9p7sdj542cbn352qz58m4n26kamv6vbnxzpc06j0pxi50z3i0v"; + sha256 = "07mxkgksgilfipd97rgfhx7c421j1fx7rk6lf0k18bkccyg1r8vn"; type = "gem"; }; - version = "8.4.1"; + version = "8.4.2"; }; danger-gitlab = { dependencies = ["danger" "gitlab"]; @@ -1942,10 +1942,10 @@ platforms = []; source = { remotes = ["https://rubygems.org"]; - sha256 = "1488s24c9fm55z2a2pbry2fjx72fzgzv0y48krgldvf0qy43l0kz"; + sha256 = "0pgb0v41qn2cnzzn4fizffds07vhz9sf09bpmm0lw86x8lz6vfdq"; type = "gem"; }; - version = "2.5.0"; + version = "2.6.1"; }; gitlab-experiment = { dependencies = ["activesupport" "request_store" "scientist"]; @@ -1953,10 +1953,10 @@ platforms = []; source = { remotes = ["https://rubygems.org"]; - sha256 = "07b7fb8vkpwjf668mircz6lavr8yp5xc7f7yp1v1h7izhzhn7m8g"; + sha256 = "064iy0pgjfvfcxynclmk70cdi10hwx7xzq1c14p68cilg569vma2"; type = "gem"; }; - version = "0.6.4"; + version = "0.6.5"; }; gitlab-fog-azure-rm = { dependencies = ["azure-storage-blob" "azure-storage-common" "fog-core" "fog-json" "mime-types" "ms_rest_azure"]; @@ -1990,6 +1990,17 @@ }; version = "2.0.0"; }; + gitlab-license_finder = { + dependencies = ["rubyzip" "thor" "tomlrb" "with_env" "xml-simple"]; + groups = ["development" "omnibus" "test"]; + platforms = []; + source = { + remotes = ["https://rubygems.org"]; + sha256 = "0fzrv96kbzyqnsdj762x7n0y006rsgsi8k23nad4xsa43d065i71"; + type = "gem"; + }; + version = "6.14.2.1"; + }; gitlab-mail_room = { groups = ["default"]; platforms = []; @@ -2005,10 +2016,10 @@ platforms = []; source = { remotes = ["https://rubygems.org"]; - sha256 = "0xnlra517pfj3hx07kasbqlcw51ix4xajr6bsd3mwg8bc92dlwy7"; + sha256 = "11kc33j6m0nayppkb7645w0ldh8g18pgmxgb8wz39pd5vilr6qpv"; type = "gem"; }; - version = "1.7.1"; + version = "1.8.0"; }; gitlab-net-dns = { groups = ["default"]; @@ -2043,15 +2054,15 @@ version = "0.8.0"; }; gitlab-styles = { - dependencies = ["rubocop" "rubocop-gitlab-security" "rubocop-performance" "rubocop-rails" "rubocop-rspec"]; + dependencies = ["rubocop" "rubocop-gitlab-security" "rubocop-graphql" "rubocop-performance" "rubocop-rails" "rubocop-rspec"]; groups = ["development" "test"]; platforms = []; source = { remotes = ["https://rubygems.org"]; - sha256 = "16d90sd0x6qfkhgfjysswwrzk82zs82xs9azn9w287irpzdkvj7f"; + sha256 = "1xs7v0sj3j4d5yflfn8n5azh5qwxsrc432q7v4nckg9irwqj99js"; type = "gem"; }; - version = "6.4.0"; + version = "6.6.0"; }; gitlab_chronic_duration = { dependencies = ["numerizer"]; @@ -2532,10 +2543,10 @@ platforms = []; source = { remotes = ["https://rubygems.org"]; - sha256 = "0g2fnag935zn2ggm5cn6k4s4xvv53v2givj1j90szmvavlpya96a"; + sha256 = "0vdd1kii40qhbr9n8qx71k2gskq6rkl8ygy8hw5hfj8bb5a364xf"; type = "gem"; }; - version = "1.8.10"; + version = "1.8.11"; }; i18n_data = { groups = ["default"]; @@ -2557,6 +2568,17 @@ }; version = "2.4.1"; }; + imagen = { + dependencies = ["parser"]; + groups = ["coverage" "default" "development" "test"]; + platforms = []; + source = { + remotes = ["https://rubygems.org"]; + sha256 = "0qm1jcprs0xys8m72kgm9pasd1xzhiqiyv64baxwcygyshkvgrzx"; + type = "gem"; + }; + version = "0.1.8"; + }; invisible_captcha = { dependencies = ["rails"]; groups = ["default"]; @@ -2584,10 +2606,10 @@ platforms = []; source = { remotes = ["https://rubygems.org"]; - sha256 = "18337bzcwssmnyg2wf3za50z0zh2b1sh17wgaapavd1ffr24svkx"; + sha256 = "0raj4xwp2dz1xrzcpqqdp5ygfpjdy7jx28ziqg9f73hf850j90d1"; type = "gem"; }; - version = "0.3.7"; + version = "0.3.8"; }; jaeger-client = { dependencies = ["opentracing" "thrift"]; @@ -2846,17 +2868,6 @@ }; version = "1.2.0"; }; - license_finder = { - dependencies = ["rubyzip" "thor" "toml" "with_env" "xml-simple"]; - groups = ["development" "omnibus" "test"]; - platforms = []; - source = { - remotes = ["https://rubygems.org"]; - sha256 = "0kc4bkaxy6mm6kpbpg8hdjsqpzybh7cy5b45qydc7bfa9c35vr93"; - type = "gem"; - }; - version = "6.0.0"; - }; licensee = { dependencies = ["dotenv" "octokit" "reverse_markdown" "rugged" "thor"]; groups = ["default"]; @@ -3758,14 +3769,14 @@ }; parser = { dependencies = ["ast"]; - groups = ["default" "development" "test"]; + groups = ["coverage" "default" "development" "test"]; platforms = []; source = { remotes = ["https://rubygems.org"]; - sha256 = "06ma6w87ph8lnc9z4hi40ynmcdnjv0p8x53x0s3fjkz4q2p6sxh5"; + sha256 = "0sszdl9mpzqzn9kxrp28sqmg47mjxcwypr4d60vbajqba4v885di"; type = "gem"; }; - version = "3.0.2.0"; + version = "3.0.3.2"; }; parslet = { groups = ["default" "development" "test"]; @@ -3958,10 +3969,10 @@ platforms = []; source = { remotes = ["https://rubygems.org"]; - sha256 = "0lmaq05a257m9588a81wql3a5p039f221f0dmq57bm2qjwxydjmj"; + sha256 = "1xblxnrs0c5m326v7kgr32k4m00cl2ipcf5m0qvyisrw62vd5dbn"; type = "gem"; }; - version = "5.3.2"; + version = "5.5.2"; }; puma_worker_killer = { dependencies = ["get_process_mem" "puma"]; @@ -4637,6 +4648,17 @@ }; version = "0.1.1"; }; + rubocop-graphql = { + dependencies = ["rubocop"]; + groups = ["default" "development" "test"]; + platforms = []; + source = { + remotes = ["https://rubygems.org"]; + sha256 = "0hvm17hm7xjqcfn70c7h3rrz2y2mrazqmkp5ains08j0zd39x7rh"; + type = "gem"; + }; + version = "0.10.3"; + }; rubocop-performance = { dependencies = ["rubocop" "rubocop-ast"]; groups = ["default" "development" "test"]; @@ -4886,10 +4908,10 @@ platforms = []; source = { remotes = ["https://rubygems.org"]; - sha256 = "0jklwk9aldvlmdv17m77g2f82j383alqd4jjnwn4c564q9wvz3fp"; + sha256 = "05xiv6kznhawbkjrz97s6lp2ld0w95x1l2s80gm8m49f273399s2"; type = "gem"; }; - version = "1.6.0"; + version = "1.6.2"; }; sd_notify = { groups = ["puma"]; @@ -5001,10 +5023,10 @@ platforms = []; source = { remotes = ["https://rubygems.org"]; - sha256 = "104a97cl94aclg71ngrr097zjbdf6cibnz4q3rqjb88izmd7cfk6"; + sha256 = "0k38cbwhcj9ncfzlgfmvq2zqfdvldln58w8s8v89m0jqlhnhsqhj"; type = "gem"; }; - version = "6.2.2"; + version = "6.3.1"; }; sidekiq-cron = { dependencies = ["fugit" "sidekiq"]; @@ -5070,6 +5092,16 @@ }; version = "0.12.3"; }; + simplecov-lcov = { + groups = ["coverage" "development" "test"]; + platforms = []; + source = { + remotes = ["https://rubygems.org"]; + sha256 = "1h8kswnshgb9zidvc88f4zjy4gflgz3854sx9wrw8ppgnwfg6581"; + type = "gem"; + }; + version = "0.8.0"; + }; sixarm_ruby_unaccent = { groups = ["default"]; platforms = []; @@ -5297,10 +5329,10 @@ platforms = []; source = { remotes = ["https://rubygems.org"]; - sha256 = "03y0mnn5mp9ydi5jc4d3y0gnk5fxwljzzfzj9rg7q94kslwi1kx4"; + sha256 = "08bln6c3qmylakgpmpswv4zdis8bf96nkbrxpb9xcal2i7g1j29r"; type = "gem"; }; - version = "1.1.9"; + version = "1.4.3"; }; sysexits = { groups = ["default" "development" "test"]; @@ -5456,17 +5488,6 @@ }; version = "0.8.3"; }; - toml = { - dependencies = ["parslet"]; - groups = ["default" "development" "test"]; - platforms = []; - source = { - remotes = ["https://rubygems.org"]; - sha256 = "0xj460rkyqvg74xc8kivmbvgc46c6mm7r8mbjs5m2gq8khf8sbki"; - type = "gem"; - }; - version = "0.2.0"; - }; toml-rb = { dependencies = ["citrus"]; groups = ["default"]; @@ -5615,6 +5636,17 @@ }; version = "0.1.0"; }; + undercover = { + dependencies = ["imagen" "rainbow" "rugged"]; + groups = ["coverage" "development" "test"]; + platforms = []; + source = { + remotes = ["https://rubygems.org"]; + sha256 = "19gnc5sr41z3rqbw03k8v3sdpn7rccmgivnc0x5pdq4x7bhcpi31"; + type = "gem"; + }; + version = "0.4.4"; + }; unf = { dependencies = ["unf_ext"]; groups = ["default"]; @@ -5934,9 +5966,9 @@ platforms = []; source = { remotes = ["https://rubygems.org"]; - sha256 = "1746czsjarixq0x05f7p3hpzi38ldg6wxnxxw74kbjzh1sdjgmpl"; + sha256 = "18l4r6layck0d80ydc692mv1lxak5xbf6w2paj1x7m2ggbggzxgj"; type = "gem"; }; - version = "2.4.2"; + version = "2.5.1"; }; } diff --git a/pkgs/applications/version-management/sourcehut/builds.nix b/pkgs/applications/version-management/sourcehut/builds.nix index c8163caf8eae..2e771de73a54 100644 --- a/pkgs/applications/version-management/sourcehut/builds.nix +++ b/pkgs/applications/version-management/sourcehut/builds.nix @@ -11,26 +11,31 @@ , python }: let - version = "0.66.7"; - - buildWorker = src: buildGoModule { - inherit src version; - pname = "builds-sr-ht-worker"; - - vendorSha256 = "sha256-giOaldV46aBqXyFH/cQVsbUr6Rb4VMhbBO86o48tRZY="; - }; -in -buildPythonPackage rec { - inherit version; - pname = "buildsrht"; + version = "0.74.17"; src = fetchFromSourcehut { owner = "~sircmpwn"; repo = "builds.sr.ht"; rev = version; - sha256 = "sha256-2MLs/DOXHjEYarXDVUcPZe3o0fmZbzVxn528SE72lhM="; + sha256 = "sha256-6Yc33lkhozpnx8e6yukUfo+/Qw5mwpJQQKuYbC7uqcU="; }; + buildWorker = src: buildGoModule { + inherit src version; + pname = "builds-sr-ht-worker"; + + vendorSha256 = "sha256-Pf1M9a43eK4jr6QMi6kRHA8DodXQU0pqq9ua5VC3ER0="; + }; +in +buildPythonPackage rec { + inherit src version; + pname = "buildsrht"; + + patches = [ + # Revert change breaking Unix socket support for Redis + patches/redis-socket/build/0001-Revert-Add-build-submission-and-queue-monitoring.patch + ]; + nativeBuildInputs = srht.nativeBuildInputs; propagatedBuildInputs = [ @@ -56,10 +61,12 @@ buildPythonPackage rec { cp ${buildWorker "${src}/worker"}/bin/worker $out/bin/builds.sr.ht-worker ''; + pythonImportsCheck = [ "buildsrht" ]; + meta = with lib; { homepage = "https://git.sr.ht/~sircmpwn/builds.sr.ht"; description = "Continuous integration service for the sr.ht network"; - license = licenses.agpl3; + license = licenses.agpl3Only; maintainers = with maintainers; [ eadwu ]; }; } diff --git a/pkgs/applications/version-management/sourcehut/core.nix b/pkgs/applications/version-management/sourcehut/core.nix index 7c3a516ed9dc..3242b85e3787 100644 --- a/pkgs/applications/version-management/sourcehut/core.nix +++ b/pkgs/applications/version-management/sourcehut/core.nix @@ -25,17 +25,16 @@ , sassc , nodejs , redis -, writeText }: buildPythonPackage rec { pname = "srht"; - version = "0.67.4"; + version = "0.68.13"; src = fetchgit { url = "https://git.sr.ht/~sircmpwn/core.sr.ht"; rev = version; - sha256 = "sha256-XvzFfcBK5Mq8p7xEBAF/eupUE1kkUBh5k+ByM/WA9bc="; + sha256 = "sha256-LPyEfpNlmod18Fj16xpihKOrsU/hQUfAeOmWMmUeVPQ="; fetchSubmodules = true; }; @@ -46,6 +45,7 @@ buildPythonPackage rec { }; patches = [ + # Disable check for npm ./disable-npm-install.patch ]; @@ -87,6 +87,7 @@ buildPythonPackage rec { ''; dontUseSetuptoolsCheck = true; + pythonImportsCheck = [ "srht" ]; meta = with lib; { homepage = "https://git.sr.ht/~sircmpwn/srht"; diff --git a/pkgs/applications/version-management/sourcehut/default.nix b/pkgs/applications/version-management/sourcehut/default.nix index 401a1437b7d9..00810f208cc5 100644 --- a/pkgs/applications/version-management/sourcehut/default.nix +++ b/pkgs/applications/version-management/sourcehut/default.nix @@ -22,6 +22,7 @@ let listssrht = self.callPackage ./lists.nix { }; mansrht = self.callPackage ./man.nix { }; metasrht = self.callPackage ./meta.nix { }; + pagessrht = self.callPackage ./pages.nix { }; pastesrht = self.callPackage ./paste.nix { }; todosrht = self.callPackage ./todo.nix { }; @@ -40,6 +41,7 @@ with python.pkgs; recurseIntoAttrs { listssrht = toPythonApplication listssrht; mansrht = toPythonApplication mansrht; metasrht = toPythonApplication metasrht; + pagessrht = pagessrht; pastesrht = toPythonApplication pastesrht; todosrht = toPythonApplication todosrht; } diff --git a/pkgs/applications/version-management/sourcehut/dispatch.nix b/pkgs/applications/version-management/sourcehut/dispatch.nix index 637c6f9c1df4..18e105aea4bf 100644 --- a/pkgs/applications/version-management/sourcehut/dispatch.nix +++ b/pkgs/applications/version-management/sourcehut/dispatch.nix @@ -9,13 +9,13 @@ buildPythonPackage rec { pname = "dispatchsrht"; - version = "0.15.8"; + version = "0.15.34"; src = fetchFromSourcehut { owner = "~sircmpwn"; repo = "dispatch.sr.ht"; rev = version; - sha256 = "sha256-zWCGPjIgMKHXHJUs9aciV7IFgo0rpahon6KXHDwcfss="; + sha256 = "sha256-bZ4ZKohMozZIyP0TUgxETOECib4XGUv29+Mg8ZsoMf8="; }; nativeBuildInputs = srht.nativeBuildInputs; @@ -31,10 +31,12 @@ buildPythonPackage rec { export SRHT_PATH=${srht}/${python.sitePackages}/srht ''; + pythonImportsCheck = [ "dispatchsrht" ]; + meta = with lib; { homepage = "https://dispatch.sr.ht/~sircmpwn/dispatch.sr.ht"; description = "Task dispatcher and service integration tool for the sr.ht network"; - license = licenses.agpl3; + license = licenses.agpl3Only; maintainers = with maintainers; [ eadwu ]; }; } diff --git a/pkgs/applications/version-management/sourcehut/git.nix b/pkgs/applications/version-management/sourcehut/git.nix index e44fb9cd6c6c..e33bb6595012 100644 --- a/pkgs/applications/version-management/sourcehut/git.nix +++ b/pkgs/applications/version-management/sourcehut/git.nix @@ -8,13 +8,13 @@ , scmsrht }: let - version = "0.72.8"; + version = "0.76.4"; src = fetchFromSourcehut { owner = "~sircmpwn"; repo = "git.sr.ht"; rev = version; - sha256 = "sha256-AB2uzajO5PtcpJfbOOTfuDFM6is5K39v3AZJ1hShRNc="; + sha256 = "sha256-diUkQpB/ivg8JTaoTcSyKr9Q9LZiMo6qVInBDPceklc="; }; buildShell = src: buildGoModule { @@ -32,13 +32,13 @@ let buildKeys = src: buildGoModule { inherit src version; pname = "gitsrht-keys"; - vendorSha256 = "1d94cqy7x0q0agwg515xxsbl70b3qrzxbzsyjhn1pbyj532brn7f"; + vendorSha256 = "sha256-9pojS69HCKVHUceyOpGtv9ewcxFD4WsOVsEzkmWJkF4="; }; buildUpdateHook = src: buildGoModule { inherit src version; pname = "gitsrht-update-hook"; - vendorSha256 = "0fwzqpjv8x5y3w3bfjd0x0cvqjjak23m0zj88hf32jpw49xmjkih"; + vendorSha256 = "sha256-sBlG7EFqdDm7CkAHVX50Mf4N3sl1rPNmWExG/bfbfGA="; }; updateHook = buildUpdateHook "${src}/gitsrht-update-hook"; @@ -72,10 +72,12 @@ buildPythonPackage rec { inherit updateHook; }; + pythonImportsCheck = [ "gitsrht" ]; + meta = with lib; { homepage = "https://git.sr.ht/~sircmpwn/git.sr.ht"; description = "Git repository hosting service for the sr.ht network"; - license = licenses.agpl3; + license = licenses.agpl3Only; maintainers = with maintainers; [ eadwu ]; }; } diff --git a/pkgs/applications/version-management/sourcehut/hg.nix b/pkgs/applications/version-management/sourcehut/hg.nix index cddb76cabf25..6716f643a7e1 100644 --- a/pkgs/applications/version-management/sourcehut/hg.nix +++ b/pkgs/applications/version-management/sourcehut/hg.nix @@ -10,12 +10,12 @@ buildPythonPackage rec { pname = "hgsrht"; - version = "0.27.4"; + version = "0.29.3"; src = fetchhg { url = "https://hg.sr.ht/~sircmpwn/hg.sr.ht"; rev = version; - sha256 = "1c0qfi0gmbfngvds6917fy9ii2iglawn429757rh7b4bvzn7n6mr"; + sha256 = "y8gKaamwD5lsYqO1SkxMcn3E2TWidHAo2slvEU+8ovg="; }; nativeBuildInputs = srht.nativeBuildInputs; @@ -32,10 +32,12 @@ buildPythonPackage rec { export SRHT_PATH=${srht}/${python.sitePackages}/srht ''; + pythonImportsCheck = [ "hgsrht" ]; + meta = with lib; { homepage = "https://git.sr.ht/~sircmpwn/hg.sr.ht"; description = "Mercurial repository hosting service for the sr.ht network"; - license = licenses.agpl3; + license = licenses.agpl3Only; maintainers = with maintainers; [ eadwu ]; }; } diff --git a/pkgs/applications/version-management/sourcehut/hub.nix b/pkgs/applications/version-management/sourcehut/hub.nix index 17cb3fe4b614..511ec359fc4b 100644 --- a/pkgs/applications/version-management/sourcehut/hub.nix +++ b/pkgs/applications/version-management/sourcehut/hub.nix @@ -6,13 +6,13 @@ buildPythonPackage rec { pname = "hubsrht"; - version = "0.13.1"; + version = "0.14.4"; src = fetchFromSourcehut { owner = "~sircmpwn"; repo = "hub.sr.ht"; rev = version; - sha256 = "sha256-Kqzy4mh5Nn1emzHBco/LVuXro/tW3NX+OYqdEwBSQ/U="; + sha256 = "sha256-7HF+jykWGqzPWA0YtJZQZU7pnID1yexcqLkEf2HpnSs="; }; nativeBuildInputs = srht.nativeBuildInputs; @@ -26,11 +26,12 @@ buildPythonPackage rec { ''; dontUseSetuptoolsCheck = true; + pythonImportsCheck = [ "hubsrht" ]; meta = with lib; { homepage = "https://git.sr.ht/~sircmpwn/hub.sr.ht"; description = "Project hub service for the sr.ht network"; - license = licenses.agpl3; + license = licenses.agpl3Only; maintainers = with maintainers; [ eadwu ]; }; } diff --git a/pkgs/applications/version-management/sourcehut/lists.nix b/pkgs/applications/version-management/sourcehut/lists.nix index b419b49f7b5d..3490796dda01 100644 --- a/pkgs/applications/version-management/sourcehut/lists.nix +++ b/pkgs/applications/version-management/sourcehut/lists.nix @@ -12,13 +12,13 @@ buildPythonPackage rec { pname = "listssrht"; - version = "0.48.19"; + version = "0.51.0"; src = fetchFromSourcehut { owner = "~sircmpwn"; repo = "lists.sr.ht"; rev = version; - sha256 = "sha256-bsakEMyvWaxiE4/SGcAP4mlGG9jkdHfFxpt9H+TJn/8="; + sha256 = "sha256-iywZ6G5E4AJevg/Q1LoB7JMJxBcsAnbhiND++mFy/bw="; }; nativeBuildInputs = srht.nativeBuildInputs; @@ -37,10 +37,12 @@ buildPythonPackage rec { export SRHT_PATH=${srht}/${python.sitePackages}/srht ''; + pythonImportsCheck = [ "listssrht" ]; + meta = with lib; { homepage = "https://git.sr.ht/~sircmpwn/lists.sr.ht"; description = "Mailing list service for the sr.ht network"; - license = licenses.agpl3; + license = licenses.agpl3Only; maintainers = with maintainers; [ eadwu ]; }; } diff --git a/pkgs/applications/version-management/sourcehut/man.nix b/pkgs/applications/version-management/sourcehut/man.nix index bd331f000a72..2d4d152e3aae 100644 --- a/pkgs/applications/version-management/sourcehut/man.nix +++ b/pkgs/applications/version-management/sourcehut/man.nix @@ -8,13 +8,13 @@ buildPythonPackage rec { pname = "mansrht"; - version = "0.15.12"; + version = "0.15.22"; src = fetchFromSourcehut { owner = "~sircmpwn"; repo = "man.sr.ht"; rev = version; - sha256 = "sha256-MqH/8K9XRvEg6P7GHE6XXtWnhDP3wT8iGoNaFtYQbio="; + sha256 = "sha256-curouf+eNCKprDI23blGs4AzJMry6zlCLDt/+0j5c8A="; }; nativeBuildInputs = srht.nativeBuildInputs; @@ -29,10 +29,12 @@ buildPythonPackage rec { export SRHT_PATH=${srht}/${python.sitePackages}/srht ''; + pythonImportsCheck = [ "mansrht" ]; + meta = with lib; { homepage = "https://git.sr.ht/~sircmpwn/man.sr.ht"; description = "Wiki service for the sr.ht network"; - license = licenses.agpl3; + license = licenses.agpl3Only; maintainers = with maintainers; [ eadwu ]; }; } diff --git a/pkgs/applications/version-management/sourcehut/meta.nix b/pkgs/applications/version-management/sourcehut/meta.nix index 86d293973d7f..74a00692b6c7 100644 --- a/pkgs/applications/version-management/sourcehut/meta.nix +++ b/pkgs/applications/version-management/sourcehut/meta.nix @@ -18,19 +18,19 @@ , python }: let - version = "0.53.14"; + version = "0.57.2"; src = fetchFromSourcehut { owner = "~sircmpwn"; repo = "meta.sr.ht"; rev = version; - sha256 = "sha256-/+r/XLDkcSTW647xPMh5bcJmR2xZNNH74AJ5jemna2k="; + sha256 = "sha256-+ksfAOuch/fLkFLYU52Ug0Hf0EoERy+oCwa9g+GKuAA="; }; buildApi = src: buildGoModule { inherit src version; pname = "metasrht-api"; - vendorSha256 = "sha256-eZyDrr2VcNMxI++18qUy7LA1Q1YDlWCoRtl00L8lfR4="; + vendorSha256 = "sha256-vo+YbMyo/Eal7hbFxP9hwIW2cePJcGFszoDRCCzFYdM="; }; in @@ -38,6 +38,11 @@ buildPythonPackage rec { pname = "metasrht"; inherit version src; + patches = [ + # Revert change breaking Unix socket support for Redis + patches/redis-socket/meta/0001-Revert-Add-webhook-queue-monitoring.patch + ]; + nativeBuildInputs = srht.nativeBuildInputs; propagatedBuildInputs = [ @@ -66,10 +71,12 @@ buildPythonPackage rec { cp ${buildApi "${src}/api/"}/bin/api $out/bin/metasrht-api ''; + pythonImportsCheck = [ "metasrht" ]; + meta = with lib; { homepage = "https://git.sr.ht/~sircmpwn/meta.sr.ht"; description = "Account management service for the sr.ht network"; - license = licenses.agpl3; + license = licenses.agpl3Only; maintainers = with maintainers; [ eadwu ]; }; } diff --git a/pkgs/applications/version-management/sourcehut/pages.nix b/pkgs/applications/version-management/sourcehut/pages.nix new file mode 100644 index 000000000000..9b6011d99900 --- /dev/null +++ b/pkgs/applications/version-management/sourcehut/pages.nix @@ -0,0 +1,30 @@ +{ lib +, fetchFromSourcehut +, buildGoModule +}: + +buildGoModule rec { + pname = "pagessrht"; + version = "0.5.2"; + + src = fetchFromSourcehut { + owner = "~sircmpwn"; + repo = "pages.sr.ht"; + rev = version; + sha256 = "sha256-yEM122uhF0MNkMlNXyvBSfkLogRQETeuBl2K66kivac="; + }; + + vendorSha256 = "sha256-udr+1y5ApQCSPhs3yQTTi9QfzRbz0A9COYuFMjQGa74="; + + postInstall = '' + mkdir -p $out/share/sql/ + cp -r -t $out/share/sql/ schema.sql migrations + ''; + + meta = with lib; { + homepage = "https://git.sr.ht/~sircmpwn/pages.sr.ht"; + description = "Web hosting service for the sr.ht network"; + license = licenses.agpl3Only; + maintainers = with maintainers; [ eadwu ]; + }; +} diff --git a/pkgs/applications/version-management/sourcehut/paste.nix b/pkgs/applications/version-management/sourcehut/paste.nix index 0d8c91354937..c411f8e8c954 100644 --- a/pkgs/applications/version-management/sourcehut/paste.nix +++ b/pkgs/applications/version-management/sourcehut/paste.nix @@ -8,13 +8,13 @@ buildPythonPackage rec { pname = "pastesrht"; - version = "0.12.1"; + version = "0.13.6"; src = fetchFromSourcehut { owner = "~sircmpwn"; repo = "paste.sr.ht"; rev = version; - sha256 = "sha256-QQhd2LeH9BLmlHilhsv+9fZ+RPNmEMSmOpFA3dsMBFc="; + sha256 = "sha256-Khcqk86iD9nxiKXN3+8mSLNoDau2qXNFOrLdkVu+rH8="; }; nativeBuildInputs = srht.nativeBuildInputs; @@ -29,10 +29,12 @@ buildPythonPackage rec { export SRHT_PATH=${srht}/${python.sitePackages}/srht ''; + pythonImportsCheck = [ "pastesrht" ]; + meta = with lib; { homepage = "https://git.sr.ht/~sircmpwn/paste.sr.ht"; description = "Ad-hoc text file hosting service for the sr.ht network"; - license = licenses.agpl3; + license = licenses.agpl3Only; maintainers = with maintainers; [ eadwu ]; }; } diff --git a/pkgs/applications/version-management/sourcehut/patches/redis-socket/build/0001-Revert-Add-build-submission-and-queue-monitoring.patch b/pkgs/applications/version-management/sourcehut/patches/redis-socket/build/0001-Revert-Add-build-submission-and-queue-monitoring.patch new file mode 100644 index 000000000000..ae8e95ddc0c2 --- /dev/null +++ b/pkgs/applications/version-management/sourcehut/patches/redis-socket/build/0001-Revert-Add-build-submission-and-queue-monitoring.patch @@ -0,0 +1,69 @@ +From 069b03f85847ed4a9223183b62ee53f420838911 Mon Sep 17 00:00:00 2001 +From: Julien Moutinho +Date: Thu, 16 Dec 2021 04:54:24 +0100 +Subject: [PATCH builds.sr.ht] Revert "Add build submission and queue + monitoring" + +This reverts commit 690f1aa16c77e418dc40109cd5e8fdf4a7ed947a. + +This has broken Unix socket support for Redis +See https://lists.sr.ht/~sircmpwn/sr.ht-dev/%3C20211208082636.65665-1-me%40ignaskiela.eu%3E#%3C20211216033723.wefibfulfjhqnhem@sourcephile.fr%3E +--- + buildsrht/app.py | 3 --- + buildsrht/runner.py | 9 +-------- + 2 files changed, 1 insertion(+), 11 deletions(-) + +diff --git a/buildsrht/app.py b/buildsrht/app.py +index e5321a2..7c9977c 100644 +--- a/buildsrht/app.py ++++ b/buildsrht/app.py +@@ -36,9 +36,6 @@ class BuildApp(SrhtFlask): + self.register_blueprint(secrets) + self.register_blueprint(gql_blueprint) + +- from buildsrht.runner import builds_queue_metrics_collector +- self.metrics_registry.register(builds_queue_metrics_collector) +- + @self.context_processor + def inject(): + return { +diff --git a/buildsrht/runner.py b/buildsrht/runner.py +index 7773452..0389c8e 100644 +--- a/buildsrht/runner.py ++++ b/buildsrht/runner.py +@@ -5,13 +5,10 @@ from srht.config import cfg + from srht.database import db + from srht.email import send_email + from srht.oauth import UserType +-from srht.metrics import RedisQueueCollector +-from prometheus_client import Counter + + allow_free = cfg("builds.sr.ht", "allow-free", default="no") == "yes" + +-builds_broker = cfg("builds.sr.ht", "redis") +-runner = Celery('builds', broker=builds_broker, config_source={ ++runner = Celery('builds', broker=cfg("builds.sr.ht", "redis"), config_source={ + "CELERY_TASK_SERIALIZER": "json", + "CELERY_ACCEPT_CONTENT": ["json"], + "CELERY_RESULT_SERIALIZER": "json", +@@ -19,9 +16,6 @@ runner = Celery('builds', broker=builds_broker, config_source={ + "CELERY_TASK_PROTOCOL": 1 + }) + +-builds_queue_metrics_collector = RedisQueueCollector(builds_broker, "buildsrht_builds", "Number of builds currently in queue") +-builds_submitted = Counter("buildsrht_builds_submited", "Number of builds submitted") +- + def queue_build(job, manifest): + from buildsrht.types import JobStatus + job.status = JobStatus.queued +@@ -34,7 +28,6 @@ def queue_build(job, manifest): + cfg("sr.ht", "owner-email"), + "Cryptocurrency mining attempt on builds.sr.ht") + else: +- builds_submitted.inc() + run_build.delay(job.id, manifest.to_dict()) + + def requires_payment(user): +-- +2.34.0 + diff --git a/pkgs/applications/version-management/sourcehut/patches/redis-socket/meta/0001-Revert-Add-webhook-queue-monitoring.patch b/pkgs/applications/version-management/sourcehut/patches/redis-socket/meta/0001-Revert-Add-webhook-queue-monitoring.patch new file mode 100644 index 000000000000..9ec37670b060 --- /dev/null +++ b/pkgs/applications/version-management/sourcehut/patches/redis-socket/meta/0001-Revert-Add-webhook-queue-monitoring.patch @@ -0,0 +1,48 @@ +From d88bee195797c6c294320617ff14798da94cd0f3 Mon Sep 17 00:00:00 2001 +From: Julien Moutinho +Date: Thu, 16 Dec 2021 04:52:08 +0100 +Subject: [PATCH meta.sr.ht] Revert "Add webhook queue monitoring" + +This reverts commit 9931df3c23094af5179df9ef019ca732b8125dac. + +This has broken Unix socket support for Redis. +See https://lists.sr.ht/~sircmpwn/sr.ht-dev/%3C20211208082636.65665-1-me%40ignaskiela.eu%3E#%3C20211216033723.wefibfulfjhqnhem@sourcephile.fr%3E +--- + metasrht/app.py | 3 --- + metasrht/webhooks.py | 5 +---- + 2 files changed, 1 insertion(+), 7 deletions(-) + +diff --git a/metasrht/app.py b/metasrht/app.py +index b190875..89c59bc 100644 +--- a/metasrht/app.py ++++ b/metasrht/app.py +@@ -49,9 +49,6 @@ class MetaApp(SrhtFlask): + from metasrht.blueprints.billing import billing + self.register_blueprint(billing) + +- from metasrht.webhooks import webhook_metrics_collector +- self.metrics_registry.register(webhook_metrics_collector) +- + @self.context_processor + def inject(): + return { +diff --git a/metasrht/webhooks.py b/metasrht/webhooks.py +index 3e1149e..3f0ba01 100644 +--- a/metasrht/webhooks.py ++++ b/metasrht/webhooks.py +@@ -7,11 +7,8 @@ if not hasattr(db, "session"): + db.init() + from srht.webhook import Event + from srht.webhook.celery import CeleryWebhook, make_worker +-from srht.metrics import RedisQueueCollector + +-webhook_broker = cfg("meta.sr.ht", "webhooks", "redis://") +-worker = make_worker(broker=webhook_broker) +-webhook_metrics_collector = RedisQueueCollector(webhook_broker, "srht_webhooks", "Webhook queue length") ++worker = make_worker(broker=cfg("meta.sr.ht", "webhooks", "redis://")) + + class UserWebhook(CeleryWebhook): + events = [ +-- +2.34.0 + diff --git a/pkgs/applications/version-management/sourcehut/scm.nix b/pkgs/applications/version-management/sourcehut/scm.nix index 1f3852653601..9fbaa8c92454 100644 --- a/pkgs/applications/version-management/sourcehut/scm.nix +++ b/pkgs/applications/version-management/sourcehut/scm.nix @@ -5,18 +5,17 @@ , redis , pyyaml , buildsrht -, writeText }: buildPythonPackage rec { pname = "scmsrht"; - version = "0.22.9"; + version = "0.22.16"; # Untagged version src = fetchFromSourcehut { owner = "~sircmpwn"; repo = "scm.sr.ht"; rev = version; - sha256 = "sha256-327G6C8FW+iZx+167D7TQsFtV6FGc8MpMVo9L/cUUqU="; + sha256 = "sha256-A4Q7wUc4ag7KRWOkdYXCsbzuFHyJJsM15OjrCoVt9UQ="; }; nativeBuildInputs = srht.nativeBuildInputs; @@ -33,11 +32,12 @@ buildPythonPackage rec { ''; dontUseSetuptoolsCheck = true; + pythonImportsCheck = [ "scmsrht" ]; meta = with lib; { - homepage = "https://git.sr.ht/~sircmpwn/git.sr.ht"; + homepage = "https://git.sr.ht/~sircmpwn/scm.sr.ht"; description = "Shared support code for sr.ht source control services."; - license = licenses.agpl3; + license = licenses.agpl3Only; maintainers = with maintainers; [ eadwu ]; }; } diff --git a/pkgs/applications/version-management/sourcehut/todo.nix b/pkgs/applications/version-management/sourcehut/todo.nix index 85e1f5637b62..da31ba240730 100644 --- a/pkgs/applications/version-management/sourcehut/todo.nix +++ b/pkgs/applications/version-management/sourcehut/todo.nix @@ -12,13 +12,13 @@ buildPythonPackage rec { pname = "todosrht"; - version = "0.64.14"; + version = "0.66.1"; src = fetchFromSourcehut { owner = "~sircmpwn"; repo = "todo.sr.ht"; rev = version; - sha256 = "sha256-huIAhn6h1F5w5ST4/yBwr82kAzyYwhLu+gpRuOQgnsE="; + sha256 = "sha256-P0xaQpK7O9zipGSIa5jL1O0L/fKt51EMNGt7XndYQ+g="; }; nativeBuildInputs = srht.nativeBuildInputs; @@ -42,11 +42,12 @@ buildPythonPackage rec { ]; dontUseSetuptoolsCheck = true; + pythonImportsCheck = [ "todosrht" ]; meta = with lib; { homepage = "https://todo.sr.ht/~sircmpwn/todo.sr.ht"; description = "Ticket tracking service for the sr.ht network"; - license = licenses.agpl3; + license = licenses.agpl3Only; maintainers = with maintainers; [ eadwu ]; }; } diff --git a/pkgs/applications/version-management/sourcehut/update.sh b/pkgs/applications/version-management/sourcehut/update.sh index 156d4cc35e44..97509397aef5 100755 --- a/pkgs/applications/version-management/sourcehut/update.sh +++ b/pkgs/applications/version-management/sourcehut/update.sh @@ -1,8 +1,11 @@ #! /usr/bin/env nix-shell #! nix-shell -i bash -p git mercurial common-updater-scripts +set -eux -o pipefail -cd "$(dirname "${BASH_SOURCE[0]}")" +cd "$(dirname "${BASH_SOURCE[0]}")" || exit 1 root=../../../.. +tmp=$(mktemp -d) +trap 'rm -rf "$tmp"' EXIT default() { (cd "$root" && nix-instantiate --eval --strict -A "sourcehut.python.pkgs.$1.meta.position" | sed -re 's/^"(.*):[0-9]+"$/\1/') @@ -13,42 +16,61 @@ version() { } src_url() { - (cd "$root" && nix-instantiate --eval --strict -A "sourcehut.python.pkgs.$1.src.drvAttrs.url" | tr -d '"') + nix-instantiate --eval --strict --expr " with import $root {}; let src = sourcehut.python.pkgs.$1.drvAttrs.src; in src.url or src.meta.homepage" | tr -d '"' } get_latest_version() { src="$(src_url "$1")" - tmp=$(mktemp -d) - + rm -rf "$tmp" if [ "$1" = "hgsrht" ]; then - hg clone "$src" "$tmp" &> /dev/null + hg clone "$src" "$tmp" >/dev/null printf "%s" "$(cd "$tmp" && hg log --limit 1 --template '{latesttag}')" else - git clone "$src" "$tmp" - printf "%s" "$(cd "$tmp" && git describe $(git rev-list --tags --max-count=1))" + git clone "$src" "$tmp" >/dev/null + printf "%s" "$(cd "$tmp" && git describe "$(git rev-list --tags --max-count=1)")" fi } update_version() { default_nix="$(default "$1")" - version_old="$(version "$1")" + oldVersion="$(version "$1")" version="$(get_latest_version "$1")" (cd "$root" && update-source-version "sourcehut.python.pkgs.$1" "$version") - git add "$default_nix" - git commit -m "$1: $version_old -> $version" + # Update vendorSha256 of Go modules + retry=true + while "$retry"; do + retry=false; + exec < <(exec nix -L build -f "$root" sourcehut.python.pkgs."$1" 2>&1) + while IFS=' :' read -r origin hash; do + case "$origin" in + (expected|specified) oldHash="$hash";; + (got) sed -i "s|$oldHash|$hash|" "$default_nix"; retry=true; break;; + (*) printf >&2 "%s\n" "$origin${hash:+:$hash}" + esac + done + done + + if [ "$oldVersion" != "$version" ]; then + git add "$default_nix" + git commit -m "sourcehut.$1: $oldVersion -> $version" + fi } -services=( "srht" "buildsrht" "dispatchsrht" "gitsrht" "hgsrht" "hubsrht" "listssrht" "mansrht" - "metasrht" "pastesrht" "todosrht" "scmsrht" ) - -# Whether or not a specific service is requested -if [ -n "$1" ]; then - version="$(get_latest_version "$1")" - (cd "$root" && update-source-version "sourcehut.python.pkgs.$1" "$version") +if [ $# -gt 0 ]; then + services=("$@") else - for service in "${services[@]}"; do - update_version "$service" - done + # Beware that some packages must be updated before others, + # eg. buildsrht must be updated before gitsrht, + # otherwise this script would enter an infinite loop + # because the reported $oldHash to be changed + # may not actually be in $default_nix + # but in the file of one of its dependencies. + services=( "srht" "scmsrht" "buildsrht" "dispatchsrht" "gitsrht" "hgsrht" "hubsrht" "listssrht" "mansrht" + "metasrht" "pagessrht" "pastesrht" "todosrht" ) fi + +for service in "${services[@]}"; do + update_version "$service" +done diff --git a/pkgs/desktops/gnome/apps/gnome-power-manager/default.nix b/pkgs/desktops/gnome/apps/gnome-power-manager/default.nix index 0337f70a20e5..a883067e7804 100644 --- a/pkgs/desktops/gnome/apps/gnome-power-manager/default.nix +++ b/pkgs/desktops/gnome/apps/gnome-power-manager/default.nix @@ -51,7 +51,7 @@ in stdenv.mkDerivation rec { ]; meta = with lib; { - homepage = "https://projects-old.gnome.org/gnome-power-manager/"; + homepage = "https://gitlab.gnome.org/GNOME/gnome-power-manager"; description = "View battery and power statistics provided by UPower"; maintainers = teams.gnome.members; license = licenses.gpl2Plus; diff --git a/pkgs/development/go-modules/generic/default.nix b/pkgs/development/go-modules/generic/default.nix index 3b645f9ce8b9..f00ca1984ec8 100644 --- a/pkgs/development/go-modules/generic/default.nix +++ b/pkgs/development/go-modules/generic/default.nix @@ -71,6 +71,7 @@ let inherit (go) GOOS GOARCH; patches = args.patches or []; + patchFlags = args.patchFlags or []; preBuild = args.preBuild or ""; sourceRoot = args.sourceRoot or ""; diff --git a/pkgs/development/interpreters/lfe/generic-builder.nix b/pkgs/development/interpreters/lfe/generic-builder.nix index 620568967452..2431199beaaf 100644 --- a/pkgs/development/interpreters/lfe/generic-builder.nix +++ b/pkgs/development/interpreters/lfe/generic-builder.nix @@ -83,7 +83,7 @@ buildRebar3 { code. An LFE evaluator and shell is also included. ''; - homepage = "http://lfe.io"; + homepage = "https://lfe.io"; downloadPage = "https://github.com/rvirding/lfe/releases"; license = licenses.asl20; diff --git a/pkgs/development/libraries/gf2x/default.nix b/pkgs/development/libraries/gf2x/default.nix index 3440697989ee..c37dcf4242d2 100644 --- a/pkgs/development/libraries/gf2x/default.nix +++ b/pkgs/development/libraries/gf2x/default.nix @@ -30,7 +30,7 @@ stdenv.mkDerivation rec { meta = with lib; { description = "Routines for fast arithmetic in GF(2)[x]"; - homepage = "http://gf2x.gforge.inria.fr"; + homepage = "https://gitlab.inria.fr/gf2x/gf2x/"; license = licenses.gpl2Plus; maintainers = teams.sage.members; platforms = platforms.unix; diff --git a/pkgs/development/libraries/grantlee/5/default.nix b/pkgs/development/libraries/grantlee/5/default.nix index 4eef2d407d8e..6c8bf6eb7223 100644 --- a/pkgs/development/libraries/grantlee/5/default.nix +++ b/pkgs/development/libraries/grantlee/5/default.nix @@ -46,7 +46,7 @@ mkDerivation rec { The syntax is intended to follow the syntax of the Django template system, and the design of Django is reused in Grantlee.''; - homepage = "http://gitorious.org/grantlee"; + homepage = "https://github.com/steveire/grantlee"; maintainers = [ maintainers.ttuegel ]; license = licenses.lgpl21; inherit (qtbase.meta) platforms; diff --git a/pkgs/development/libraries/grantlee/default.nix b/pkgs/development/libraries/grantlee/default.nix index 53ae099b1bb6..3301d6c47cff 100644 --- a/pkgs/development/libraries/grantlee/default.nix +++ b/pkgs/development/libraries/grantlee/default.nix @@ -27,7 +27,7 @@ stdenv.mkDerivation rec { The syntax is intended to follow the syntax of the Django template system, and the design of Django is reused in Grantlee.''; - homepage = "http://gitorious.org/grantlee"; + homepage = "https://github.com/steveire/grantlee"; license = lib.licenses.lgpl21; inherit (qt4.meta) platforms; }; diff --git a/pkgs/development/libraries/gtksourceviewmm/4.x.nix b/pkgs/development/libraries/gtksourceviewmm/4.x.nix index 5bdcc029c5c8..d6e7dfd3db56 100644 --- a/pkgs/development/libraries/gtksourceviewmm/4.x.nix +++ b/pkgs/development/libraries/gtksourceviewmm/4.x.nix @@ -22,7 +22,7 @@ stdenv.mkDerivation rec { meta = with lib; { platforms = platforms.linux; - homepage = "https://developer.gnome.org/gtksourceviewmm/"; + homepage = "https://gitlab.gnome.org/GNOME/gtksourceviewmm"; description = "C++ wrapper for gtksourceview"; license = licenses.lgpl2; maintainers = teams.gnome.members; diff --git a/pkgs/development/libraries/gtksourceviewmm/default.nix b/pkgs/development/libraries/gtksourceviewmm/default.nix index cdc96f3f1a04..ec1396512929 100644 --- a/pkgs/development/libraries/gtksourceviewmm/default.nix +++ b/pkgs/development/libraries/gtksourceviewmm/default.nix @@ -22,7 +22,7 @@ stdenv.mkDerivation rec { meta = with lib; { platforms = platforms.unix; - homepage = "https://developer.gnome.org/gtksourceviewmm/"; + homepage = "https://gitlab.gnome.org/GNOME/gtksourceviewmm"; description = "C++ wrapper for gtksourceview"; license = licenses.lgpl2; maintainers = [ maintainers.juliendehos ]; diff --git a/pkgs/development/libraries/libnotify/default.nix b/pkgs/development/libraries/libnotify/default.nix index 40089e3d7e9e..d3b857d76739 100644 --- a/pkgs/development/libraries/libnotify/default.nix +++ b/pkgs/development/libraries/libnotify/default.nix @@ -61,7 +61,7 @@ stdenv.mkDerivation rec { }; meta = with lib; { - homepage = "https://developer.gnome.org/notification-spec/"; + homepage = "https://gitlab.gnome.org/GNOME/libnotify"; description = "A library that sends desktop notifications to a notification daemon"; platforms = platforms.unix; maintainers = teams.gnome.members; diff --git a/pkgs/development/lua-modules/generated-packages.nix b/pkgs/development/lua-modules/generated-packages.nix index 45a4801a73b9..c4442f1fd795 100644 --- a/pkgs/development/lua-modules/generated-packages.nix +++ b/pkgs/development/lua-modules/generated-packages.nix @@ -605,7 +605,7 @@ buildLuarocksPackage { propagatedBuildInputs = [ lua ]; meta = { - homepage = "http://github.com/pavouk/lgi"; + homepage = "https://github.com/pavouk/lgi"; description = "Lua bindings to GObject libraries"; license.fullName = "MIT/X11"; }; diff --git a/pkgs/development/python-modules/angrcli/default.nix b/pkgs/development/python-modules/angrcli/default.nix index 30c90cfa5833..bad2bb01bf8a 100644 --- a/pkgs/development/python-modules/angrcli/default.nix +++ b/pkgs/development/python-modules/angrcli/default.nix @@ -11,7 +11,7 @@ buildPythonPackage rec { pname = "angrcli"; - version = "1.1.1"; + version = "1.2.0"; format = "setuptools"; disabled = pythonOlder "3.6"; @@ -20,7 +20,7 @@ buildPythonPackage rec { owner = "fmagin"; repo = "angr-cli"; rev = "v${version}"; - sha256 = "0mz3yzsw08xwpj6188rxmr7darilh4ismcnh8nhp9945wjyzl4kr"; + sha256 = "sha256-a5ajUBQwt3xUNkeSOeGOAFf47wd4UVk+LcuAHGqbq4s="; }; propagatedBuildInputs = [ @@ -35,9 +35,6 @@ buildPythonPackage rec { ]; postPatch = '' - # Version mismatch, https://github.com/fmagin/angr-cli/pull/11 - substituteInPlace setup.py \ - --replace "version='1.1.0'," "version='${version}'," substituteInPlace tests/test_derefs.py \ --replace "/bin/ls" "${coreutils}/bin/ls" ''; diff --git a/pkgs/development/python-modules/apache-airflow/default.nix b/pkgs/development/python-modules/apache-airflow/default.nix index 22a1772bf162..c666d89b2bfa 100644 --- a/pkgs/development/python-modules/apache-airflow/default.nix +++ b/pkgs/development/python-modules/apache-airflow/default.nix @@ -234,7 +234,7 @@ buildPythonPackage rec { meta = with lib; { description = "Programmatically author, schedule and monitor data pipelines"; - homepage = "http://airflow.apache.org/"; + homepage = "https://airflow.apache.org/"; license = licenses.asl20; maintainers = with maintainers; [ bhipple costrouc ingenieroariel ]; }; diff --git a/pkgs/development/python-modules/certifi/default.nix b/pkgs/development/python-modules/certifi/default.nix index 53fe66f01532..68a0ca42986e 100644 --- a/pkgs/development/python-modules/certifi/default.nix +++ b/pkgs/development/python-modules/certifi/default.nix @@ -25,7 +25,7 @@ buildPythonPackage rec { pythonImportsCheck = [ "certifi" ]; meta = with lib; { - homepage = "https://certifi.io/"; + homepage = "https://github.com/certifi/python-certifi"; description = "Python package for providing Mozilla's CA Bundle"; license = licenses.isc; maintainers = with maintainers; [ koral ]; diff --git a/pkgs/development/python-modules/certifi/python2.nix b/pkgs/development/python-modules/certifi/python2.nix index adc9594d69d0..529d5b1fb996 100644 --- a/pkgs/development/python-modules/certifi/python2.nix +++ b/pkgs/development/python-modules/certifi/python2.nix @@ -26,7 +26,7 @@ in buildPythonPackage rec { doCheck = false; meta = with lib; { - homepage = "https://certifi.io/"; + homepage = "https://github.com/certifi/python-certifi"; description = "Python package for providing Mozilla's CA Bundle"; license = licenses.isc; maintainers = with maintainers; [ ]; # NixOps team diff --git a/pkgs/development/python-modules/iso4217/default.nix b/pkgs/development/python-modules/iso4217/default.nix index 58d9ef5ffbd5..b1438f29a017 100644 --- a/pkgs/development/python-modules/iso4217/default.nix +++ b/pkgs/development/python-modules/iso4217/default.nix @@ -2,27 +2,34 @@ , buildPythonPackage , fetchFromGitHub , fetchurl +, importlib-resources , pytestCheckHook , python +, pythonOlder }: let table = fetchurl { - # See https://github.com/dahlia/iso4217/blob/main/setup.py#L18 + # See https://github.com/dahlia/iso4217/blob/main/setup.py#L19 url = "http://www.currency-iso.org/dam/downloads/lists/list_one.xml"; - sha256 = "0frhicc7s8gqglr41hzx61fic3ckvr4sg773ahp1s28n5by3y7ac"; + hash = "sha256-bp8uTMR1YRaI2cJLo0kdt9xD4nNaWK+LdlheWQ26qy0="; }; in buildPythonPackage rec { pname = "iso4217"; - version = "1.6"; + version = "1.7"; + format = "setuptools"; src = fetchFromGitHub { owner = "dahlia"; repo = pname; rev = version; - sha256 = "0mdpf5a0xr5lrcfgvqi1sdn7ln2w6pkc3lg0laqkbx5mhxky0fla"; + hash = "sha256-Ih2l6bGM7i5TUkzJPkgx8EOOL4a3/qE28SUZS6M4sQc="; }; + propagatedBuildInputs = lib.optionals (pythonOlder "3.9") [ + importlib-resources + ]; + checkInputs = [ pytestCheckHook ]; @@ -39,9 +46,13 @@ buildPythonPackage rec { cp -r ${table} $out/${python.sitePackages}/$pname/table.xml ''; - pytestFlagsArray = [ "$pname/test.py" ]; + pytestFlagsArray = [ + "$pname/test.py" + ]; - pythonImportsCheck = [ "iso4217" ]; + pythonImportsCheck = [ + "iso4217" + ]; meta = with lib; { description = "ISO 4217 currency data package for Python"; diff --git a/pkgs/development/python-modules/pipx/default.nix b/pkgs/development/python-modules/pipx/default.nix index 86091820a1dc..2f80806c431a 100644 --- a/pkgs/development/python-modules/pipx/default.nix +++ b/pkgs/development/python-modules/pipx/default.nix @@ -11,7 +11,7 @@ buildPythonPackage rec { pname = "pipx"; - version = "0.16.5"; + version = "0.17.0"; disabled = pythonOlder "3.6"; @@ -20,7 +20,7 @@ buildPythonPackage rec { owner = "pipxproject"; repo = pname; rev = version; - sha256 = "sha256-gBeaHEig47XWKoPx3jzvgk/jJPJXtr5R5qUL0LgvbDg="; + sha256 = "sha256-vR/tKV+ZB0nZaxEcB83dwoSI7kBC1rA+6fo30rizroM="; }; propagatedBuildInputs = [ diff --git a/pkgs/development/python-modules/pyupgrade/default.nix b/pkgs/development/python-modules/pyupgrade/default.nix index 324f0a934a5a..46764be02762 100644 --- a/pkgs/development/python-modules/pyupgrade/default.nix +++ b/pkgs/development/python-modules/pyupgrade/default.nix @@ -8,7 +8,7 @@ buildPythonPackage rec { pname = "pyupgrade"; - version = "2.29.1"; + version = "2.30.0"; format = "setuptools"; disabled = pythonOlder "3.6"; @@ -17,7 +17,7 @@ buildPythonPackage rec { owner = "asottile"; repo = pname; rev = "v${version}"; - sha256 = "sha256-fN0+4/EeoMD2c16OgepjDWuUhowMxzM7nB3mkL3iDjc="; + sha256 = "sha256-Fku95ar5i+QV21GhomO6/ivlJcnOhPyximyPsh2/dc0="; }; checkInputs = [ diff --git a/pkgs/development/python-modules/types-pytz/default.nix b/pkgs/development/python-modules/types-pytz/default.nix index b4c07bbaedbc..b9d0abc25b11 100644 --- a/pkgs/development/python-modules/types-pytz/default.nix +++ b/pkgs/development/python-modules/types-pytz/default.nix @@ -5,17 +5,20 @@ buildPythonPackage rec { pname = "types-pytz"; - version = "2021.3.2"; + version = "2021.3.3"; + format = "setuptools"; src = fetchPypi { inherit pname version; - sha256 = "sha256-xO42Rm+u2a8zTRUJPQXOpBYyPS0EMVi7WCu5TAQav1E="; + sha256 = "sha256-9tIdZoeTWhYV20ZLHh34ANGVAsNrwEhvQ759/SxASUc="; }; # Modules doesn't have tests doCheck = false; - pythonImportsCheck = [ "pytz-stubs" ]; + pythonImportsCheck = [ + "pytz-stubs" + ]; meta = with lib; { description = "Typing stubs for pytz"; diff --git a/pkgs/development/tools/build-managers/apache-ant/default.nix b/pkgs/development/tools/build-managers/apache-ant/default.nix index 7c05fcf60a37..e75260472140 100644 --- a/pkgs/development/tools/build-managers/apache-ant/default.nix +++ b/pkgs/development/tools/build-managers/apache-ant/default.nix @@ -79,7 +79,7 @@ stdenv.mkDerivation rec { ''; # */ meta = { - homepage = "http://ant.apache.org/"; + homepage = "https://ant.apache.org/"; description = "A Java-based build tool"; longDescription = '' diff --git a/pkgs/development/tools/rust/rust-analyzer/default.nix b/pkgs/development/tools/rust/rust-analyzer/default.nix index d08f2acb9dec..164e57e77490 100644 --- a/pkgs/development/tools/rust/rust-analyzer/default.nix +++ b/pkgs/development/tools/rust/rust-analyzer/default.nix @@ -11,23 +11,20 @@ rustPlatform.buildRustPackage rec { pname = "rust-analyzer-unwrapped"; - version = "2021-12-13"; - cargoSha256 = "sha256-VF4pwSl3Wei7KxyQFOPj7hVX/NG2zImRLv4iN+ijAs8="; + version = "2021-12-27"; + cargoSha256 = "sha256-yok7kLcvKvDwrdgJR0540QLJi5/zXi0NyZxhtoQ8Xno="; src = fetchFromGitHub { owner = "rust-analyzer"; repo = "rust-analyzer"; rev = version; - sha256 = "sha256-xt7iDfIoaBhStgqsgttyOFF4NYPQ8jeVwDoYUwrvtrA="; + sha256 = "sha256-/195+NsV6Mku2roi8zVy4dw8QGL6rQcnPcQ29Os8oqs="; }; patches = [ # Code format and git history check require more dependencies but don't really matter for packaging. # So just ignore them. ./ignore-git-and-rustfmt-tests.patch - - # Remove when we have rustc >= 1.57.0. - ./no-1-57-map-while.patch ]; buildAndTestSubdir = "crates/rust-analyzer"; diff --git a/pkgs/development/tools/rust/rust-analyzer/no-1-57-map-while.patch b/pkgs/development/tools/rust/rust-analyzer/no-1-57-map-while.patch deleted file mode 100644 index 6114f51831be..000000000000 --- a/pkgs/development/tools/rust/rust-analyzer/no-1-57-map-while.patch +++ /dev/null @@ -1,20 +0,0 @@ ---- a/crates/ide_db/src/helpers.rs -+++ b/crates/ide_db/src/helpers.rs -@@ -309,7 +309,7 @@ pub fn lint_eq_or_in_group(lint: &str, lint_is: &str) -> bool { - pub fn parse_tt_as_comma_sep_paths(input: ast::TokenTree) -> Option> { - let r_paren = input.r_paren_token(); - let tokens = -- input.syntax().children_with_tokens().skip(1).map_while(|it| match it.into_token() { -+ input.syntax().children_with_tokens().skip(1).map(|it| match it.into_token() { - // seeing a keyword means the attribute is unclosed so stop parsing here - Some(tok) if tok.kind().is_keyword() => None, - // don't include the right token tree parenthesis if it exists -@@ -317,7 +317,7 @@ pub fn parse_tt_as_comma_sep_paths(input: ast::TokenTree) -> Option None, - Some(tok) => Some(tok), -- }); -+ }).take_while(|tok| tok.is_some()).map(|tok| tok.unwrap()); - let input_expressions = tokens.into_iter().group_by(|tok| tok.kind() == T![,]); - let paths = input_expressions - .into_iter() diff --git a/pkgs/os-specific/linux/phc-intel/default.nix b/pkgs/os-specific/linux/phc-intel/default.nix index 34693564e0aa..a0d43b2e0e36 100644 --- a/pkgs/os-specific/linux/phc-intel/default.nix +++ b/pkgs/os-specific/linux/phc-intel/default.nix @@ -44,8 +44,7 @@ in stdenv.mkDerivation rec { while noticably reducing fan noise. This driver works only on supported Intel architectures. ''; - homepage = "http://www.linux-phc.org/"; - downloadPage = "http://www.linux-phc.org/forum/viewtopic.php?f=7&t=267"; + homepage = "https://github.com/danielw86dev/phc-intel-dkms"; license = licenses.gpl2; platforms = [ "x86_64-linux" "i686-linux" ]; broken = lib.versionAtLeast kernel.version "4.18"; diff --git a/pkgs/servers/apache-kafka/default.nix b/pkgs/servers/apache-kafka/default.nix index e2db02f0def2..d086c2b922c3 100644 --- a/pkgs/servers/apache-kafka/default.nix +++ b/pkgs/servers/apache-kafka/default.nix @@ -59,7 +59,7 @@ stdenv.mkDerivation rec { ''; meta = with lib; { - homepage = "http://kafka.apache.org"; + homepage = "https://kafka.apache.org"; description = "A high-throughput distributed messaging system"; license = licenses.asl20; maintainers = [ maintainers.ragge ]; diff --git a/pkgs/servers/heisenbridge/default.nix b/pkgs/servers/heisenbridge/default.nix index 3d3439b05d2d..c7afb03afc09 100644 --- a/pkgs/servers/heisenbridge/default.nix +++ b/pkgs/servers/heisenbridge/default.nix @@ -2,23 +2,15 @@ python3Packages.buildPythonApplication rec { pname = "heisenbridge"; - version = "1.7.1"; + version = "1.8.2"; src = fetchFromGitHub { owner = "hifi"; repo = pname; rev = "v${version}"; - sha256 = "sha256-q1Rj8BehvYnV/Kah5YKAxBUz4j9WziSqn1fVeaKpy7g="; + sha256 = "173prcd56rwlxjxlw67arnm12k1l317xi5s6m7jhmp8zbbrj5vwr"; }; - patches = [ - # Compatibility with aiohttp 3.8.0 - (fetchpatch { - url = "https://github.com/hifi/heisenbridge/commit/cff5d33e0b617e6cf3a44dc00c72b98743175c9e.patch"; - sha256 = "sha256-y5X4mWvX1bq0XNZNTYUc0iK3SzvaHpS7px53I7xC9c8="; - }) - ]; - postPatch = '' echo "${version}" > heisenbridge/version.txt ''; diff --git a/pkgs/servers/home-assistant/default.nix b/pkgs/servers/home-assistant/default.nix index 0bffbaf45e7a..c9e06f151383 100644 --- a/pkgs/servers/home-assistant/default.nix +++ b/pkgs/servers/home-assistant/default.nix @@ -320,6 +320,7 @@ in with py.pkgs; buildPythonApplication rec { ciso8601 cryptography httpx + ifaddr jinja2 pip pyjwt diff --git a/pkgs/servers/mail/dovecot/plugins/fts_xapian/default.nix b/pkgs/servers/mail/dovecot/plugins/fts_xapian/default.nix index 113a3679d1e2..9af34371490d 100644 --- a/pkgs/servers/mail/dovecot/plugins/fts_xapian/default.nix +++ b/pkgs/servers/mail/dovecot/plugins/fts_xapian/default.nix @@ -31,5 +31,6 @@ stdenv.mkDerivation rec { license = licenses.lgpl21Only; maintainers = with maintainers; [ julm symphorien ]; platforms = platforms.unix; + broken = stdenv.isDarwin; # never built on Hydra https://hydra.nixos.org/job/nixpkgs/trunk/dovecot_fts_xapian.x86_64-darwin }; } diff --git a/pkgs/tools/filesystems/ceph/default.nix b/pkgs/tools/filesystems/ceph/default.nix index 5975b30ac143..2c6175bec13e 100644 --- a/pkgs/tools/filesystems/ceph/default.nix +++ b/pkgs/tools/filesystems/ceph/default.nix @@ -85,7 +85,7 @@ let }; getMeta = description: with lib; { - homepage = "https://ceph.com/"; + homepage = "https://ceph.io/"; inherit description; license = with licenses; [ lgpl21 gpl2 bsd3 mit publicDomain ]; maintainers = with maintainers; [ adev ak johanot krav ]; diff --git a/pkgs/tools/graphics/ibniz/default.nix b/pkgs/tools/graphics/ibniz/default.nix index 227ab5d082dc..a74267846c1d 100644 --- a/pkgs/tools/graphics/ibniz/default.nix +++ b/pkgs/tools/graphics/ibniz/default.nix @@ -18,7 +18,7 @@ stdenv.mkDerivation rec { meta = with lib; { description = "Virtual machine designed for extremely compact low-level audiovisual programs"; - homepage = "http://www.pelulamu.net/ibniz/"; + homepage = "https://github.com/viznut/IBNIZ"; license = licenses.zlib; platforms = platforms.linux; maintainers = [ maintainers.dezgeg ]; diff --git a/pkgs/tools/misc/libbitcoin/libbitcoin-network.nix b/pkgs/tools/misc/libbitcoin/libbitcoin-network.nix index 48dab31e9a80..5d330ee3cacc 100644 --- a/pkgs/tools/misc/libbitcoin/libbitcoin-network.nix +++ b/pkgs/tools/misc/libbitcoin/libbitcoin-network.nix @@ -28,7 +28,7 @@ in stdenv.mkDerivation { meta = with lib; { description = "Bitcoin P2P Network Library"; - homepage = "https://libbitcoin.org/"; + homepage = "https://libbitcoin.info/"; platforms = platforms.linux ++ platforms.darwin; maintainers = with maintainers; [ asymmetric ]; diff --git a/pkgs/tools/misc/libbitcoin/libbitcoin-protocol.nix b/pkgs/tools/misc/libbitcoin/libbitcoin-protocol.nix index 1d8af4a336b3..06f6546e964d 100644 --- a/pkgs/tools/misc/libbitcoin/libbitcoin-protocol.nix +++ b/pkgs/tools/misc/libbitcoin/libbitcoin-protocol.nix @@ -29,7 +29,7 @@ in stdenv.mkDerivation { meta = with lib; { description = "Bitcoin Blockchain Query Protocol"; - homepage = "https://libbitcoin.org/"; + homepage = "https://libbitcoin.info/"; platforms = platforms.linux ++ platforms.darwin; maintainers = with maintainers; [ asymmetric ]; diff --git a/pkgs/tools/misc/libbitcoin/libbitcoin.nix b/pkgs/tools/misc/libbitcoin/libbitcoin.nix index b4f91bc936d2..65bd52a03029 100644 --- a/pkgs/tools/misc/libbitcoin/libbitcoin.nix +++ b/pkgs/tools/misc/libbitcoin/libbitcoin.nix @@ -29,7 +29,7 @@ in stdenv.mkDerivation { meta = with lib; { description = "C++ library for building bitcoin applications"; - homepage = "https://libbitcoin.org/"; + homepage = "https://libbitcoin.info/"; platforms = platforms.linux ++ platforms.darwin; maintainers = with maintainers; [ ]; diff --git a/pkgs/tools/security/rekor/default.nix b/pkgs/tools/security/rekor/default.nix index 4ff36910bb1b..55ab6333a7fe 100644 --- a/pkgs/tools/security/rekor/default.nix +++ b/pkgs/tools/security/rekor/default.nix @@ -4,20 +4,20 @@ let generic = { pname, packageToBuild, description }: buildGoModule rec { inherit pname; - version = "0.3.0"; + version = "0.4.0"; src = fetchFromGitHub { owner = "sigstore"; repo = "rekor"; rev = "v${version}"; - sha256 = "sha256-FaVZm9C1pewJCZlYgNyD/ZYr/UIRvhqVTUhFTmysxeg="; + sha256 = "sha256-15p4hm4Cvs/yLaQIcxctVdMKRWPjIIFwBcbru6QcjXo="; }; - vendorSha256 = "sha256-EBKj/+ruE88qvlbOme4GBfAqt3/1jHcqhY0IHxh6Y5U="; + vendorSha256 = "sha256-XCCO4Vamzj5pJFmu1A8mpTLlVAtocrn20myYJVWtBrY="; subPackages = [ packageToBuild ]; - ldflags = [ "-s" "-w" "-X github.com/sigstore/rekor/${packageToBuild}/app.gitVersion=v${version}" ]; + ldflags = [ "-s" "-w" "-X github.com/sigstore/rekor/${packageToBuild}/app.GitVersion=v${version}" ]; meta = with lib; { inherit description; diff --git a/pkgs/tools/security/scorecard/default.nix b/pkgs/tools/security/scorecard/default.nix index 0cc94c63c9f0..e08ff55bc18b 100644 --- a/pkgs/tools/security/scorecard/default.nix +++ b/pkgs/tools/security/scorecard/default.nix @@ -2,13 +2,13 @@ buildGoModule rec { pname = "scorecard"; - version = "3.0.1"; + version = "3.2.1"; src = fetchFromGitHub { owner = "ossf"; repo = pname; rev = "v${version}"; - sha256 = "sha256-19XDAgv9ARCZ7eNlWUPcsbGNyKA9vYFry8m6D3+vQP8="; + sha256 = "sha256-MVFhw/r1sws82oofV4LHmiSlKxyYd8abYq8oFiB0HH8="; # populate values otherwise taken care of by goreleaser, # unfortunately these require us to use git. By doing # this in postFetch we can delete .git afterwards and @@ -27,7 +27,7 @@ buildGoModule rec { find "$out" -name .git -print0 | xargs -0 rm -rf ''; }; - vendorSha256 = "sha256-ucF26pTEvG8tkzsyC9WNbvl8QCeetKBvBIcQL2NTfjo="; + vendorSha256 = "sha256-WrM2aE0z6SnfoPEBqgn1TO6sSGPMrQvL6+ddvOS2w1k="; # Install completions post-install nativeBuildInputs = [ installShellFiles ];