diff --git a/pkgs/by-name/ch/chromium-hsts-preload-list/package.nix b/pkgs/by-name/ch/chromium-hsts-preload-list/package.nix new file mode 100644 index 000000000000..694535a8d51f --- /dev/null +++ b/pkgs/by-name/ch/chromium-hsts-preload-list/package.nix @@ -0,0 +1,37 @@ +{ + lib, + stdenvNoCC, + fetchurl, +}: + +stdenvNoCC.mkDerivation (finalAttrs: { + pname = "chromium-hsts-preload-list"; + version = "151.0.7891.2"; + + src = fetchurl { + url = "https://raw.github.com/chromium/chromium/${finalAttrs.version}/net/http/transport_security_state_static.json"; + hash = "sha256-YuiotSk0Lf3IHz/UjgCmU/brdB1lszob6DN4DXyjiWU="; + }; + + dontUnpack = true; + strictDeps = true; + __structuredAttrs = true; + + installPhase = '' + runHook preInstall + + install -Dm444 $src $out/share/chromium-hsts-preload-list/transport_security_state_static.json + + runHook postInstall + ''; + + passthru.updateScript = ./update.sh; + + meta = { + description = "Chromium HSTS preload list"; + homepage = "https://www.chromium.org/hsts/"; + license = lib.licenses.bsd3; + maintainers = with lib.maintainers; [ schembriaiden ]; + platforms = lib.platforms.all; + }; +}) diff --git a/pkgs/by-name/ch/chromium-hsts-preload-list/update.sh b/pkgs/by-name/ch/chromium-hsts-preload-list/update.sh new file mode 100755 index 000000000000..4fa1d3459839 --- /dev/null +++ b/pkgs/by-name/ch/chromium-hsts-preload-list/update.sh @@ -0,0 +1,17 @@ +#!/usr/bin/env nix-shell +#!nix-shell -i bash -p common-updater-scripts curl jq nix + +set -euo pipefail + +latest_version=$( + curl -s ${GITHUB_TOKEN:+-u ":$GITHUB_TOKEN"} "https://api.github.com/repos/chromium/chromium/tags" \ + | jq -r 'map(select(.prerelease | not)) | .[1].name' +) + +hash=$( + nix-prefetch-url "https://raw.github.com/chromium/chromium/$latest_version/net/http/transport_security_state_static.json" +) +sri_hash=$(nix hash convert --hash-algo sha256 --to sri "$hash") + +cd "$(dirname "$0")/../../../.." +update-source-version chromium-hsts-preload-list "$latest_version" "$sri_hash" diff --git a/pkgs/by-name/la/ladybird/package.nix b/pkgs/by-name/la/ladybird/package.nix index 47d584108578..5e8f45e08a92 100644 --- a/pkgs/by-name/la/ladybird/package.nix +++ b/pkgs/by-name/la/ladybird/package.nix @@ -7,6 +7,7 @@ unicode-character-database, unicode-idna, publicsuffix-list, + chromium-hsts-preload-list, cmake, ninja, pkg-config, @@ -14,6 +15,7 @@ libavif, angle, # libEGL libjxl, + libedit, libpulseaudio, libwebp, libxcrypt, @@ -34,6 +36,8 @@ skia, nixosTests, unstableGitUpdater, + _experimental-update-script-combinators, + common-updater-scripts, libtommath, sdl3, icu78, @@ -42,18 +46,18 @@ stdenv.mkDerivation (finalAttrs: { pname = "ladybird"; - version = "0-unstable-2026-05-04"; + version = "0-unstable-2026-06-05"; src = fetchFromGitHub { owner = "LadybirdBrowser"; repo = "ladybird"; - rev = "90b790f8702a5d5c5a66ef02f8669da2838ca6e3"; - hash = "sha256-BdJ24YtKMv8B6Vvequf9b5qr0S3FfFuphFo78mCIaN4="; + rev = "02b205361dd239e134f434e484b609d1fa5f1938"; + hash = "sha256-+CVJjrL1kqT2A7r89F+riiHpMa39rcggqG9SByidUY4="; }; cargoDeps = rustPlatform.fetchCargoVendor { inherit (finalAttrs) src; - hash = "sha256-sbNYOdY56+waCVQHbGuvV5jT9EawV2IiGmL1e/O6ZRc="; + hash = "sha256-n0ACVH8NXwe7SIaGFoJ20WIGGR3XjcuLTwPSKGJpT5s="; }; postPatch = '' @@ -85,6 +89,9 @@ stdenv.mkDerivation (finalAttrs: { mkdir build/Caches/PublicSuffix cp ${publicsuffix-list}/share/publicsuffix/public_suffix_list.dat build/Caches/PublicSuffix + + mkdir build/Caches/HSTSPreload + cp ${chromium-hsts-preload-list}/share/chromium-hsts-preload-list/transport_security_state_static.json build/Caches/HSTSPreload ''; nativeBuildInputs = [ @@ -109,6 +116,7 @@ stdenv.mkDerivation (finalAttrs: { libavif angle # libEGL libjxl + libedit libwebp libxcrypt mimalloc @@ -176,7 +184,25 @@ stdenv.mkDerivation (finalAttrs: { nixosTest = nixosTests.ladybird; }; - passthru.updateScript = unstableGitUpdater { }; + passthru.updateScript = + let + updateSource = unstableGitUpdater { + hardcodeZeroVersion = true; + }; + + updateCargoDeps = { + command = [ + (lib.getExe' common-updater-scripts "update-source-version") + "ladybird" + "--ignore-same-version" + "--source-key=cargoDeps.vendorStaging" + ]; + }; + in + _experimental-update-script-combinators.sequence [ + updateSource + updateCargoDeps + ]; meta = { description = "Browser using the SerenityOS LibWeb engine with a Qt or Cocoa GUI"; diff --git a/pkgs/by-name/li/libhsts/package.nix b/pkgs/by-name/li/libhsts/package.nix index b5d9fae0bb2a..621ea039025d 100644 --- a/pkgs/by-name/li/libhsts/package.nix +++ b/pkgs/by-name/li/libhsts/package.nix @@ -2,21 +2,12 @@ lib, stdenv, fetchFromGitLab, - fetchurl, + chromium-hsts-preload-list, autoconf-archive, autoreconfHook, pkg-config, python3, }: -let - chromium_version = "151.0.7891.2"; - - hsts_list = fetchurl { - url = "https://raw.github.com/chromium/chromium/${chromium_version}/net/http/transport_security_state_static.json"; - hash = "sha256-YuiotSk0Lf3IHz/UjgCmU/brdB1lszob6DN4DXyjiWU="; - }; - -in stdenv.mkDerivation rec { pname = "libhsts"; version = "0.1.0"; @@ -39,7 +30,7 @@ stdenv.mkDerivation rec { postPatch = '' pushd tests - cp ${hsts_list} transport_security_state_static.json + cp ${chromium-hsts-preload-list}/share/chromium-hsts-preload-list/transport_security_state_static.json . # strip comments from json sed 's/^ *\/\/.*$//g' transport_security_state_static.json >hsts.json popd @@ -53,8 +44,6 @@ stdenv.mkDerivation rec { python3 ]; - passthru.updateScript = ./update.sh; - meta = { description = "Library to easily check a domain against the Chromium HSTS Preload list"; mainProgram = "hsts"; diff --git a/pkgs/by-name/li/libhsts/update.sh b/pkgs/by-name/li/libhsts/update.sh deleted file mode 100755 index 911f91918332..000000000000 --- a/pkgs/by-name/li/libhsts/update.sh +++ /dev/null @@ -1,14 +0,0 @@ -#!/usr/bin/env nix-shell -#!nix-shell -i bash -p curl jq - -set -euo pipefail -x - -cd "$(dirname "$0")" - -chromium_version=$(curl -s ${GITHUB_TOKEN:+-u ":$GITHUB_TOKEN"} "https://api.github.com/repos/chromium/chromium/tags" | jq -r 'map(select(.prerelease | not)) | .[1].name') -sha256=$(nix-prefetch-url "https://raw.github.com/chromium/chromium/$chromium_version/net/http/transport_security_state_static.json") -hash=$(nix hash convert --to sri "$sha256") - -sed -e "0,/chromium_version/s/chromium_version = \".*\"/chromium_version = \"$chromium_version\"/" \ - -e "0,/hash/s/hash = \".*\"/sha256 = \"$hash\"/" \ - --in-place ./default.nix