From f3f82d83302f0ef41df881d38cf21c25c7507898 Mon Sep 17 00:00:00 2001 From: Maximilian Bosch Date: Tue, 9 Nov 2021 22:46:10 +0100 Subject: [PATCH 01/49] steam: fix `/etc/resolv.conf` reference in FHS env It seems as if it's a problem if `/etc/resolv.conf` is a symlink to `/run/systemd/resolve/stub-resolv.conf` which is the case when using `systemd-resolved.service`: bwrap: Can't bind mount /oldroot/etc/resolv.conf on /newroot/etc/resolv.conf: Unable to mount source on destination: No such file or directory I confirmed that by following the symlink of `/etc/resolv.conf` (pointing to `/run/systemd/resolve/stub-resolv.conf`) with `readlink -f` the issues are all gone. --- pkgs/build-support/build-fhs-userenv-bubblewrap/default.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkgs/build-support/build-fhs-userenv-bubblewrap/default.nix b/pkgs/build-support/build-fhs-userenv-bubblewrap/default.nix index 4773a1e2cf6e..6443cf6fe041 100644 --- a/pkgs/build-support/build-fhs-userenv-bubblewrap/default.nix +++ b/pkgs/build-support/build-fhs-userenv-bubblewrap/default.nix @@ -70,7 +70,7 @@ let "pki" ]; in concatStringsSep "\n " - (map (file: "--ro-bind-try /etc/${file} /etc/${file}") files); + (map (file: "--ro-bind-try $(${coreutils}/bin/readlink -f /etc/${file}) /etc/${file}") files); # Create this on the fly instead of linking from /nix # The container might have to modify it and re-run ldconfig if there are From c1a712267026f3a2c7d1b0bd48db4842b0595409 Mon Sep 17 00:00:00 2001 From: Michael Weiss Date: Thu, 13 Jan 2022 20:24:33 +0100 Subject: [PATCH 02/49] mesa: 21.3.3 -> 21.3.4 --- pkgs/development/libraries/mesa/default.nix | 12 +++-- pkgs/development/libraries/mesa/musl.patch | 59 +++++++++++++++++++++ 2 files changed, 66 insertions(+), 5 deletions(-) create mode 100644 pkgs/development/libraries/mesa/musl.patch diff --git a/pkgs/development/libraries/mesa/default.nix b/pkgs/development/libraries/mesa/default.nix index cb1d99aff2ca..69f43d31da71 100644 --- a/pkgs/development/libraries/mesa/default.nix +++ b/pkgs/development/libraries/mesa/default.nix @@ -33,7 +33,7 @@ with lib; let # Release calendar: https://www.mesa3d.org/release-calendar.html # Release frequency: https://www.mesa3d.org/releasing.html#schedule - version = "21.3.3"; + version = "21.3.4"; branch = versions.major version; self = stdenv.mkDerivation { @@ -47,18 +47,20 @@ self = stdenv.mkDerivation { "ftp://ftp.freedesktop.org/pub/mesa/${version}/mesa-${version}.tar.xz" "ftp://ftp.freedesktop.org/pub/mesa/older-versions/${branch}.x/${version}/mesa-${version}.tar.xz" ]; - sha256 = "08c118j440xpfbjjxmwzm6dfnv4y35q540mmzkchhpbwx89lczxd"; + sha256 = "0zd6skf9qcwlk1k1ljgwijwlyz5si3pgi0h97gd6kkivm7a4y43p"; }; # TODO: # revive ./dricore-gallium.patch when it gets ported (from Ubuntu), as it saved # ~35 MB in $drivers; watch https://launchpad.net/ubuntu/+source/mesa/+changelog patches = [ - # fixes pkgsMusl.mesa build + # To fix flickering on Intel GPUs (iris), see https://github.com/NixOS/nixpkgs/issues/153377: (fetchpatch { - url = "https://raw.githubusercontent.com/void-linux/void-packages/b9f58f303ae23754c95d5d1fe87a98b5a2d8f271/srcpkgs/mesa/patches/musl.patch"; - sha256 = "sha256-Jyl7ILLhn8hBJG7afnEjE8H56Wz/1bxkvlqfrXK5U7I="; + url = "https://gitlab.freedesktop.org/mesa/mesa/-/commit/07dc3d4238e57901ccf98e0b506d9aad2c86b9d9.diff"; + sha256 = "sha256-3fa1qHJes3x1/iXsxfjgy9HnEGlOyFtJatSkU1a3XDI="; }) + # fixes pkgsMusl.mesa build + ./musl.patch (fetchpatch { url = "https://raw.githubusercontent.com/void-linux/void-packages/b9f58f303ae23754c95d5d1fe87a98b5a2d8f271/srcpkgs/mesa/patches/musl-endian.patch"; sha256 = "sha256-eRc91qCaFlVzrxFrNUPpAHd1gsqKsLCCN0IW8pBQcqk="; diff --git a/pkgs/development/libraries/mesa/musl.patch b/pkgs/development/libraries/mesa/musl.patch new file mode 100644 index 000000000000..687a159c1788 --- /dev/null +++ b/pkgs/development/libraries/mesa/musl.patch @@ -0,0 +1,59 @@ +diff --git a/src/amd/vulkan/winsys/amdgpu/radv_amdgpu_winsys.h b/src/amd/vulkan/winsys/amdgpu/radv_amdgpu_winsys.h +index 06ca90564f0..bb244f8f358 100644 +--- a/src/amd/vulkan/winsys/amdgpu/radv_amdgpu_winsys.h ++++ b/src/amd/vulkan/winsys/amdgpu/radv_amdgpu_winsys.h +@@ -30,6 +30,7 @@ + + #include + #include ++#include + #include "util/list.h" + #include "util/rwlock.h" + #include "ac_gpu_info.h" +diff --git a/src/gallium/drivers/freedreno/freedreno_util.h b/src/gallium/drivers/freedreno/freedreno_util.h +index 22f99c41909..2f3195926be 100644 +--- a/src/gallium/drivers/freedreno/freedreno_util.h ++++ b/src/gallium/drivers/freedreno/freedreno_util.h +@@ -108,6 +108,8 @@ extern bool fd_binning_enabled; + #include + #include + ++#define gettid() ((pid_t)syscall(SYS_gettid)) ++ + #define DBG(fmt, ...) \ + do { \ + if (FD_DBG(MSGS)) \ +diff --git a/src/gallium/frontends/nine/nine_debug.c b/src/gallium/frontends/nine/nine_debug.c +index f3a6a945025..f4a6c41a612 100644 +--- a/src/gallium/frontends/nine/nine_debug.c ++++ b/src/gallium/frontends/nine/nine_debug.c +@@ -65,7 +65,7 @@ _nine_debug_printf( unsigned long flag, + { + static boolean first = TRUE; + static unsigned long dbg_flags = DBG_ERROR | DBG_WARN; +- unsigned long tid = 0; ++ pthread_t tid = 0; + + if (first) { + first = FALSE; +@@ -74,7 +74,7 @@ _nine_debug_printf( unsigned long flag, + + #if defined(HAVE_PTHREAD) + if (dbg_flags & DBG_TID) +- tid = (unsigned long)pthread_self(); ++ tid = pthread_self(); + #endif + + if (dbg_flags & flag) { +diff --git a/src/util/rand_xor.c b/src/util/rand_xor.c +index 81b64f1ea71..56ebd2eccdf 100644 +--- a/src/util/rand_xor.c ++++ b/src/util/rand_xor.c +@@ -28,6 +28,7 @@ + #if defined(HAVE_GETRANDOM) + #include + #endif ++#include /* size_t, ssize_t */ + #include + #include + #endif From e60f130e9717591817a5c3867962e799d1a2b6a9 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jos=C3=A9=20Romildo?= Date: Tue, 11 Jan 2022 10:05:43 -0300 Subject: [PATCH 03/49] sierra-gtk-theme: 2019-12-16 -> unstable-2021-05-24 --- pkgs/data/themes/sierra/default.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/data/themes/sierra/default.nix b/pkgs/data/themes/sierra/default.nix index d3fbb5fe7885..638717693229 100644 --- a/pkgs/data/themes/sierra/default.nix +++ b/pkgs/data/themes/sierra/default.nix @@ -2,13 +2,13 @@ stdenv.mkDerivation rec { pname = "sierra-gtk-theme"; - version = "2019-12-16"; + version = "unstable-2021-05-24"; src = fetchFromGitHub { owner = "vinceliuice"; repo = pname; - rev = version; - sha256 = "14hlz8kbrjypyd6wyrwmnj2wm9w3kc8y00ms35ard7x8lmhs56hr"; + rev = "05899001c4fc2fec87c4d222cb3997c414e0affd"; + sha256 = "174l5mryc34ma1r42pk6572c6i9hmzr9vj1a6w06nqz5qcfm1hds"; }; nativeBuildInputs = [ libxml2 ]; From fdf34ebdcbfc58ae69d9898c6df5778b6f0e4d75 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jos=C3=A9=20Romildo?= Date: Tue, 11 Jan 2022 10:07:19 -0300 Subject: [PATCH 04/49] sierra-gtk-theme: reformat --- pkgs/data/themes/sierra/default.nix | 22 ++++++++++++++++++---- 1 file changed, 18 insertions(+), 4 deletions(-) diff --git a/pkgs/data/themes/sierra/default.nix b/pkgs/data/themes/sierra/default.nix index 638717693229..96c756e395b0 100644 --- a/pkgs/data/themes/sierra/default.nix +++ b/pkgs/data/themes/sierra/default.nix @@ -1,4 +1,11 @@ -{ lib, stdenv, fetchFromGitHub, libxml2, gdk-pixbuf, librsvg, gtk-engine-murrine }: +{ lib +, stdenv +, fetchFromGitHub +, gdk-pixbuf +, gtk-engine-murrine +, librsvg +, libxml2 +}: stdenv.mkDerivation rec { pname = "sierra-gtk-theme"; @@ -11,11 +18,18 @@ stdenv.mkDerivation rec { sha256 = "174l5mryc34ma1r42pk6572c6i9hmzr9vj1a6w06nqz5qcfm1hds"; }; - nativeBuildInputs = [ libxml2 ]; + nativeBuildInputs = [ + libxml2 + ]; - buildInputs = [ gdk-pixbuf librsvg ]; + buildInputs = [ + gdk-pixbuf + librsvg + ]; - propagatedUserEnvPkgs = [ gtk-engine-murrine ]; + propagatedUserEnvPkgs = [ + gtk-engine-murrine + ]; installPhase = '' patchShebangs . From a6f06687d4697ae3714da21142895c287c7718f7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jos=C3=A9=20Romildo?= Date: Tue, 11 Jan 2022 10:07:46 -0300 Subject: [PATCH 05/49] sierra-gtk-theme: run hooks in installPhase --- pkgs/data/themes/sierra/default.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/data/themes/sierra/default.nix b/pkgs/data/themes/sierra/default.nix index 96c756e395b0..93983f87f377 100644 --- a/pkgs/data/themes/sierra/default.nix +++ b/pkgs/data/themes/sierra/default.nix @@ -32,9 +32,11 @@ stdenv.mkDerivation rec { ]; installPhase = '' + runHook preInstall patchShebangs . mkdir -p $out/share/themes name= ./install.sh --dest $out/share/themes + runHook postInstall ''; meta = with lib; { From 3739c52a6077e4e8e0d96df2b3cc4b4fa87b71fa Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jos=C3=A9=20Romildo?= Date: Tue, 11 Jan 2022 10:27:04 -0300 Subject: [PATCH 06/49] sierra-gtk-theme: replace duplicate files with hardlinks --- pkgs/data/themes/sierra/default.nix | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/pkgs/data/themes/sierra/default.nix b/pkgs/data/themes/sierra/default.nix index 93983f87f377..fb960d843abd 100644 --- a/pkgs/data/themes/sierra/default.nix +++ b/pkgs/data/themes/sierra/default.nix @@ -3,6 +3,7 @@ , fetchFromGitHub , gdk-pixbuf , gtk-engine-murrine +, jdupes , librsvg , libxml2 }: @@ -19,6 +20,7 @@ stdenv.mkDerivation rec { }; nativeBuildInputs = [ + jdupes libxml2 ]; @@ -33,9 +35,16 @@ stdenv.mkDerivation rec { installPhase = '' runHook preInstall + patchShebangs . + mkdir -p $out/share/themes name= ./install.sh --dest $out/share/themes + + # Replace duplicate files with hardlinks to the first file in each + # set of duplicates, reducing the installed size in about 79% + jdupes -L -r $out/share + runHook postInstall ''; From 405fdb241a62f5698125109a71c09f15b802c372 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jos=C3=A9=20Romildo?= Date: Tue, 11 Jan 2022 11:44:37 -0300 Subject: [PATCH 07/49] sierra-gtk-theme: add optional arguments --- pkgs/data/themes/sierra/default.nix | 20 ++++++++++++++++++-- 1 file changed, 18 insertions(+), 2 deletions(-) diff --git a/pkgs/data/themes/sierra/default.nix b/pkgs/data/themes/sierra/default.nix index fb960d843abd..d7c512cde474 100644 --- a/pkgs/data/themes/sierra/default.nix +++ b/pkgs/data/themes/sierra/default.nix @@ -6,10 +6,22 @@ , jdupes , librsvg , libxml2 +, buttonVariants ? [] # default to all +, colorVariants ? [] # default to all +, opacityVariants ? [] # default to all +, sizeVariants ? [] # default to all }: -stdenv.mkDerivation rec { +let pname = "sierra-gtk-theme"; +in +lib.checkListOfEnum "${pname}: button variants" [ "standard" "alt" ] buttonVariants +lib.checkListOfEnum "${pname}: color variants" [ "light" "dark" ] colorVariants +lib.checkListOfEnum "${pname}: opacity variants" [ "standard" "solid" ] opacityVariants +lib.checkListOfEnum "${pname}: size variants" [ "standard" "compact" ] sizeVariants + +stdenv.mkDerivation { + inherit pname; version = "unstable-2021-05-24"; src = fetchFromGitHub { @@ -39,7 +51,11 @@ stdenv.mkDerivation rec { patchShebangs . mkdir -p $out/share/themes - name= ./install.sh --dest $out/share/themes + name= ./install.sh --dest $out/share/themes \ + ${lib.optionalString (buttonVariants != []) "--alt " + builtins.toString buttonVariants} \ + ${lib.optionalString (colorVariants != []) "--color " + builtins.toString colorVariants} \ + ${lib.optionalString (opacityVariants != []) "--opacity " + builtins.toString opacityVariants} \ + ${lib.optionalString (sizeVariants != []) "--flat " + builtins.toString sizeVariants} # Replace duplicate files with hardlinks to the first file in each # set of duplicates, reducing the installed size in about 79% From ed64cf5062597dd500f0abb7825826ba3e445a61 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jos=C3=A9=20Romildo?= Date: Sun, 16 Jan 2022 15:13:18 -0300 Subject: [PATCH 08/49] sierra-gtk-theme: be more specific with patchShebangs --- pkgs/data/themes/sierra/default.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkgs/data/themes/sierra/default.nix b/pkgs/data/themes/sierra/default.nix index d7c512cde474..e87f64661419 100644 --- a/pkgs/data/themes/sierra/default.nix +++ b/pkgs/data/themes/sierra/default.nix @@ -48,7 +48,7 @@ stdenv.mkDerivation { installPhase = '' runHook preInstall - patchShebangs . + patchShebangs install.sh mkdir -p $out/share/themes name= ./install.sh --dest $out/share/themes \ From 5010f4fff90803f2026a6d5c8a5bb005434091a1 Mon Sep 17 00:00:00 2001 From: talyz Date: Mon, 17 Jan 2022 11:46:51 +0100 Subject: [PATCH 09/49] nixos/keycloak: Use LoadCredential to load secrets MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Use systemd's LoadCredential mechanism to make the secret files available to the service. This gets rid of the privileged part of the ExecPreStart script which only served to copy these files and assign the correct permissions. There's been issues with this approach when used in combination with DynamicUser, where sometimes the user isn't created before the ExecPreStart script runs, causing the error install: invalid user ‘keycloak’ This should fix that issue. Unfortunately, all of the ExecPreStart script had to be moved to ExecStart, since credentials aren't provided to ExecPreStart. See https://github.com/systemd/systemd/issues/19604. --- nixos/modules/services/web-apps/keycloak.nix | 72 +++++++++----------- 1 file changed, 31 insertions(+), 41 deletions(-) diff --git a/nixos/modules/services/web-apps/keycloak.nix b/nixos/modules/services/web-apps/keycloak.nix index aff4ed8dd608..b324bc13dfb3 100644 --- a/nixos/modules/services/web-apps/keycloak.nix +++ b/nixos/modules/services/web-apps/keycloak.nix @@ -735,52 +735,16 @@ in JBOSS_MODULEPATH = "${cfg.package}/modules"; }; serviceConfig = { - ExecStartPre = let - startPreFullPrivileges = '' - set -o errexit -o pipefail -o nounset -o errtrace - shopt -s inherit_errexit - - umask u=rwx,g=,o= - - install -T -m 0400 -o keycloak -g keycloak '${cfg.database.passwordFile}' /run/keycloak/secrets/db_password - '' + lib.optionalString (cfg.sslCertificate != null && cfg.sslCertificateKey != null) '' - install -T -m 0400 -o keycloak -g keycloak '${cfg.sslCertificate}' /run/keycloak/secrets/ssl_cert - install -T -m 0400 -o keycloak -g keycloak '${cfg.sslCertificateKey}' /run/keycloak/secrets/ssl_key - ''; - startPre = '' - set -o errexit -o pipefail -o nounset -o errtrace - shopt -s inherit_errexit - - umask u=rwx,g=,o= - - install -m 0600 ${cfg.package}/standalone/configuration/*.properties /run/keycloak/configuration - install -T -m 0600 ${keycloakConfig} /run/keycloak/configuration/standalone.xml - - replace-secret '@db-password@' '/run/keycloak/secrets/db_password' /run/keycloak/configuration/standalone.xml - - export JAVA_OPTS=-Djboss.server.config.user.dir=/run/keycloak/configuration - add-user-keycloak.sh -u admin -p '${cfg.initialAdminPassword}' - '' + lib.optionalString (cfg.sslCertificate != null && cfg.sslCertificateKey != null) '' - pushd /run/keycloak/ssl/ - cat /run/keycloak/secrets/ssl_cert <(echo) \ - /run/keycloak/secrets/ssl_key <(echo) \ - /etc/ssl/certs/ca-certificates.crt \ - > allcerts.pem - openssl pkcs12 -export -in /run/keycloak/secrets/ssl_cert -inkey /run/keycloak/secrets/ssl_key -chain \ - -name "${cfg.frontendUrl}" -out certificate_private_key_bundle.p12 \ - -CAfile allcerts.pem -passout pass:notsosecretpassword - popd - ''; - in [ - "+${pkgs.writeShellScript "keycloak-start-pre-full-privileges" startPreFullPrivileges}" - "${pkgs.writeShellScript "keycloak-start-pre" startPre}" + LoadCredential = [ + "db_password:${cfg.database.passwordFile}" + ] ++ lib.optionals (cfg.sslCertificate != null && cfg.sslCertificateKey != null) [ + "ssl_cert:${cfg.sslCertificate}" + "ssl_key:${cfg.sslCertificateKey}" ]; - ExecStart = "${cfg.package}/bin/standalone.sh"; User = "keycloak"; Group = "keycloak"; DynamicUser = true; RuntimeDirectory = map (p: "keycloak/" + p) [ - "secrets" "configuration" "deployments" "data" @@ -792,6 +756,32 @@ in LogsDirectory = "keycloak"; AmbientCapabilities = "CAP_NET_BIND_SERVICE"; }; + script = '' + set -o errexit -o pipefail -o nounset -o errtrace + shopt -s inherit_errexit + + umask u=rwx,g=,o= + + install -m 0600 ${cfg.package}/standalone/configuration/*.properties /run/keycloak/configuration + install -T -m 0600 ${keycloakConfig} /run/keycloak/configuration/standalone.xml + + replace-secret '@db-password@' "$CREDENTIALS_DIRECTORY/db_password" /run/keycloak/configuration/standalone.xml + + export JAVA_OPTS=-Djboss.server.config.user.dir=/run/keycloak/configuration + add-user-keycloak.sh -u admin -p '${cfg.initialAdminPassword}' + '' + lib.optionalString (cfg.sslCertificate != null && cfg.sslCertificateKey != null) '' + pushd /run/keycloak/ssl/ + cat "$CREDENTIALS_DIRECTORY/ssl_cert" <(echo) \ + "$CREDENTIALS_DIRECTORY/ssl_key" <(echo) \ + /etc/ssl/certs/ca-certificates.crt \ + > allcerts.pem + openssl pkcs12 -export -in "$CREDENTIALS_DIRECTORY/ssl_cert" -inkey "$CREDENTIALS_DIRECTORY/ssl_key" -chain \ + -name "${cfg.frontendUrl}" -out certificate_private_key_bundle.p12 \ + -CAfile allcerts.pem -passout pass:notsosecretpassword + popd + '' + '' + ${cfg.package}/bin/standalone.sh + ''; }; services.postgresql.enable = lib.mkDefault createLocalPostgreSQL; From 6e157a481a7bd03ac6bbeb86847f4d593ed0a854 Mon Sep 17 00:00:00 2001 From: Yarny0 <41838844+Yarny0@users.noreply.github.com> Date: Wed, 15 Sep 2021 15:31:49 +0200 Subject: [PATCH 10/49] tsm-client: fix lvm2 support lvm2 support was broken when lvm2 got converted to a multiple-output derivation: https://github.com/NixOS/nixpkgs/pull/93024 https://github.com/NixOS/nixpkgs/commit/d3a991d41028c5d2a5af2796c0bb542836457822 The `runtimeDependencies` attribute doesn't specifically look for a `lib` output, so it uses the main `out` output which no longer contains the library object files. Since TSM loads the `libdevmapper.so` library dynamically (likely with `dlfcn.h` functions), the breakage couldn't be detected at build time. The commit at hand simply uses `getLib` to pick the correct output. --- pkgs/tools/backup/tsm-client/default.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkgs/tools/backup/tsm-client/default.nix b/pkgs/tools/backup/tsm-client/default.nix index e298751facab..9e0e5e3a606c 100644 --- a/pkgs/tools/backup/tsm-client/default.nix +++ b/pkgs/tools/backup/tsm-client/default.nix @@ -91,7 +91,7 @@ let zlib ]; runtimeDependencies = [ - lvm2 + (lib.attrsets.getLib lvm2) ]; sourceRoot = "."; From ce6eea6002704b5a2285fb7800e247e3e0946f6c Mon Sep 17 00:00:00 2001 From: Yarny0 <41838844+Yarny0@users.noreply.github.com> Date: Sat, 18 Sep 2021 10:08:29 +0200 Subject: [PATCH 11/49] tsm-client: add gnugrep to PATH While testing the new version, I observed that `dsmc` prints an error "sh: grep: command not found" when executed with empty PATH. Apparently, `dsmc` needs `grep` in its PATH. --- pkgs/tools/backup/tsm-client/default.nix | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/pkgs/tools/backup/tsm-client/default.nix b/pkgs/tools/backup/tsm-client/default.nix index 9e0e5e3a606c..e1f5055b2218 100644 --- a/pkgs/tools/backup/tsm-client/default.nix +++ b/pkgs/tools/backup/tsm-client/default.nix @@ -3,6 +3,7 @@ , autoPatchelfHook , buildEnv , fetchurl +, gnugrep , makeWrapper , procps , zlib @@ -158,7 +159,7 @@ buildEnv { target=$(readlink "$bin") rm "$bin" makeWrapper "$target" "$bin" \ - --prefix PATH : "$out/dsm_dir:${lib.strings.makeBinPath [ procps acl jdk8 ]}" \ + --prefix PATH : "$out/dsm_dir:${lib.makeBinPath [ procps gnugrep acl jdk8 ]}" \ --set DSM_DIR $out/dsm_dir done ''; From 6d134acc4a18897eb248e7ce7daeecc06e68d517 Mon Sep 17 00:00:00 2001 From: Yarny0 <41838844+Yarny0@users.noreply.github.com> Date: Sun, 28 Nov 2021 21:52:04 +0100 Subject: [PATCH 12/49] tsm-client: use explicit package option for Java GUI The tsm-client package comes in two flavours: command line only (`tsm-client`) and with a Java-backed GUI (`tsm-client-withGui`). To control which package is built, the build recipe simply used to check if the `jdk8` package was provided as package input. This commit changes this mechanism: The build recipe now accepts the explicit option `enableGui`, which is set to `false` by default. As the commit at hand touches the build recipe arguments, it also changes argument sorting following https://nixos.org/manual/nixpkgs/stable/#sec-syntax --- pkgs/tools/backup/tsm-client/default.nix | 27 +++++++++++++----------- pkgs/top-level/all-packages.nix | 4 ++-- 2 files changed, 17 insertions(+), 14 deletions(-) diff --git a/pkgs/tools/backup/tsm-client/default.nix b/pkgs/tools/backup/tsm-client/default.nix index e1f5055b2218..bd7b21be7645 100644 --- a/pkgs/tools/backup/tsm-client/default.nix +++ b/pkgs/tools/backup/tsm-client/default.nix @@ -1,16 +1,16 @@ { lib , stdenv -, autoPatchelfHook -, buildEnv , fetchurl -, gnugrep -, makeWrapper -, procps +, autoPatchelfHook , zlib -# optional packages that enable certain features -, acl ? null # EXT2/EXT3/XFS ACL support -, jdk8 ? null # Java GUI -, lvm2 ? null # LVM image backup and restore functions +, lvm2 # LVM image backup and restore functions (optional) +, acl # EXT2/EXT3/XFS ACL support (optional) +, gnugrep +, procps +, jdk8 # Java GUI (needed for `enableGui`) +, buildEnv +, makeWrapper +, enableGui ? false # enables Java GUI `dsmj` # path to `dsm.sys` configuration files , dsmSysCli ? "/etc/tsm-client/cli.dsm.sys" , dsmSysApi ? "/etc/tsm-client/api.dsm.sys" @@ -127,6 +127,9 @@ let ''; }; + binPath = lib.makeBinPath ([ acl gnugrep procps ] + ++ lib.optional enableGui jdk8); + in buildEnv { @@ -145,7 +148,7 @@ buildEnv { # to the so-called "installation directories" # * Add symlinks to the "installation directories" # that point to the `dsm.sys` configuration files - # * Drop the Java GUI executable unless `jdk` is present + # * Drop the Java GUI executable unless `enableGui` is set # * Create wrappers for the command-line interface to # prepare `PATH` and `DSM_DIR` environment variables postBuild = '' @@ -153,13 +156,13 @@ buildEnv { ln --symbolic --no-target-directory opt/tivoli/tsm/client/api/bin64 $out/dsmi_dir ln --symbolic --no-target-directory "${dsmSysCli}" $out/dsm_dir/dsm.sys ln --symbolic --no-target-directory "${dsmSysApi}" $out/dsmi_dir/dsm.sys - ${lib.optionalString (jdk8==null) "rm $out/bin/dsmj"} + ${lib.optionalString (!enableGui) "rm $out/bin/dsmj"} for bin in $out/bin/* do target=$(readlink "$bin") rm "$bin" makeWrapper "$target" "$bin" \ - --prefix PATH : "$out/dsm_dir:${lib.makeBinPath [ procps gnugrep acl jdk8 ]}" \ + --prefix PATH : "$out/dsm_dir:${binPath}" \ --set DSM_DIR $out/dsm_dir done ''; diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index ff2ae2087025..b5e787375e2e 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -4923,8 +4923,8 @@ with pkgs; timeline = callPackage ../applications/office/timeline { }; - tsm-client = callPackage ../tools/backup/tsm-client { jdk8 = null; }; - tsm-client-withGui = callPackage ../tools/backup/tsm-client { }; + tsm-client = callPackage ../tools/backup/tsm-client { }; + tsm-client-withGui = callPackage ../tools/backup/tsm-client { enableGui = true; }; tracker = callPackage ../development/libraries/tracker { }; From 517ae2a288d11366de4f6867f74e04215e916b85 Mon Sep 17 00:00:00 2001 From: Yarny0 <41838844+Yarny0@users.noreply.github.com> Date: Tue, 30 Nov 2021 21:59:57 +0100 Subject: [PATCH 13/49] tsm-client: update URL structure IBM has changed the URL structures of their support web pages. The commit at hand updates most URLs and in particular the package update instructions so they follow the new structure. It also calculates the source download URL from the version number, so package updates no longer have to update the URL in addition to the version string. --- pkgs/tools/backup/tsm-client/default.nix | 32 ++++++++++++++++-------- 1 file changed, 22 insertions(+), 10 deletions(-) diff --git a/pkgs/tools/backup/tsm-client/default.nix b/pkgs/tools/backup/tsm-client/default.nix index bd7b21be7645..0e2c99c485e1 100644 --- a/pkgs/tools/backup/tsm-client/default.nix +++ b/pkgs/tools/backup/tsm-client/default.nix @@ -19,7 +19,7 @@ # For an explanation of optional packages # (features provided by them, version limits), see -# https://www-01.ibm.com/support/docview.wss?uid=swg21052223#Version%208.1 +# https://www.ibm.com/support/pages/node/660813#Version%208.1 # IBM Tivoli Storage Manager Client uses a system-wide @@ -41,21 +41,25 @@ # point to this derivations `/dsmi_dir` directory symlink. # Other environment variables might be necessary, # depending on local configuration or usage; see: -# https://www.ibm.com/support/knowledgecenter/en/SSEQVQ_8.1.8/client/c_cfg_sapiunix.html +# https://www.ibm.com/docs/en/spectrum-protect/8.1.8?topic=solaris-set-api-environment-variables -# The newest version of TSM client should be discoverable -# by going the the `downloadPage` (see `meta` below), -# there to "Client Latest Downloads", -# "IBM Spectrum Protect Client Downloads and READMEs", -# then to "Linux x86_64 Ubuntu client" (as of 2019-07-15). +# The newest version of TSM client should be discoverable by +# going to the `downloadPage` (see `meta` below), then +# * find section "Client Service Release", +# * pick the latest version and follow the link +# "IBM Spectrum Protect Client .. Downloads and READMEs" +# * in the table at the page's bottom, follow the +# "HTTPS" link of the "Linux x86_64 Ubuntu client" +# * in the directory listing, pick the big `.tar` file +# (as of 2021-12-13) let meta = { - homepage = "https://www.ibm.com/us-en/marketplace/data-protection-and-recovery"; - downloadPage = "https://www-01.ibm.com/support/docview.wss?uid=swg21239415"; + homepage = "https://www.ibm.com/products/data-protection-and-recovery"; + downloadPage = "https://www.ibm.com/support/pages/ibm-spectrum-protect-downloads-latest-fix-packs-and-interim-fixes"; platforms = [ "x86_64-linux" ]; license = lib.licenses.unfree; maintainers = [ lib.maintainers.yarny ]; @@ -75,11 +79,19 @@ let ''; }; + mkSrcUrl = version: + let + major = lib.versions.major version; + minor = lib.versions.minor version; + patch = lib.versions.patch version; + in + "https://public.dhe.ibm.com/storage/tivoli-storage-management/maintenance/client/v${major}r${minor}/Linux/LinuxX86_DEB/BA/v${major}${minor}${patch}/${version}-TIV-TSMBAC-LinuxX86_DEB.tar"; + unwrapped = stdenv.mkDerivation rec { name = "tsm-client-${version}-unwrapped"; version = "8.1.8.0"; src = fetchurl { - url = "ftp://public.dhe.ibm.com/storage/tivoli-storage-management/maintenance/client/v8r1/Linux/LinuxX86_DEB/BA/v818/${version}-TIV-TSMBAC-LinuxX86_DEB.tar"; + url = mkSrcUrl version; sha256 = "0c1d0jm0i7qjd314nhj2vj8fs7sncm1x2n4d6dg4049jniyvjhpk"; }; inherit meta; From 5ad0ecb9019e964d2abfe034e184f8b846e42dfa Mon Sep 17 00:00:00 2001 From: Yarny0 <41838844+Yarny0@users.noreply.github.com> Date: Tue, 30 Nov 2021 22:07:04 +0100 Subject: [PATCH 14/49] tsm-client: 8.1.8.0 -> 8.1.13.0 tsm-client now links against openssl; patchelf complains without it. Links to IBM's "Authorized Program Analysis Report"s (something like release notes), to READMEs, and to Security Bulletins, for all updates between 8.1.8.0 and 8.1.13.0: * 8.1.9.x * APARs: https://www.ibm.com/support/pages/node/1077159 * READMEs: https://www.ibm.com/support/pages/node/1108473 * https://www.ibm.com/support/pages/node/1107261 (CVE-2018-2025) * https://www.ibm.com/support/pages/node/1107777 (CVE-2019-4406) * 8.1.10.x * APARs: https://www.ibm.com/support/pages/node/6223098 * READMEs: https://www.ibm.com/support/pages/node/6223388 * https://www.ibm.com/support/pages/node/6221448 (CVE-2020-4494, CVE-2020-4406) * https://www.ibm.com/support/pages/node/6245356 (CVE-2020-2654) * https://www.ibm.com/support/pages/node/6245366 (CVE-2015-4000) * 8.1.11.x * APARs: https://www.ibm.com/support/pages/node/6367203 * READMEs: https://www.ibm.com/support/pages/node/6367205 * https://www.ibm.com/support/pages/node/6371646 * https://www.ibm.com/support/pages/node/6371650 * https://www.ibm.com/support/pages/node/6371652 * 8.1.12.x * APARs: https://www.ibm.com/support/pages/node/6429561 * READMEs: https://www.ibm.com/support/pages/node/6443671 * https://www.ibm.com/support/pages/node/6445503 (CVE-2021-20532) * https://www.ibm.com/support/pages/node/6445497 (CVE-2021-29672, CVE-2021-20546) * https://www.ibm.com/support/pages/node/6445489 (CVE-2020-1971, CVE-2021-23840, CVE-2021-23841) * https://www.ibm.com/support/pages/node/6445483 (CVE-2020-27221, CVE-2020-14782) * 8.1.13.x * APARs: https://www.ibm.com/support/pages/node/6524936 * READMEs: https://www.ibm.com/support/pages/node/6524938 * https://www.ibm.com/support/pages/node/6524706 (CVE-2021-39048) * https://www.ibm.com/support/pages/node/6524712 (CVE-2021-3712, CVE-2021-3711) --- pkgs/tools/backup/tsm-client/default.nix | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/pkgs/tools/backup/tsm-client/default.nix b/pkgs/tools/backup/tsm-client/default.nix index 0e2c99c485e1..e29efa3c0019 100644 --- a/pkgs/tools/backup/tsm-client/default.nix +++ b/pkgs/tools/backup/tsm-client/default.nix @@ -2,6 +2,7 @@ , stdenv , fetchurl , autoPatchelfHook +, openssl , zlib , lvm2 # LVM image backup and restore functions (optional) , acl # EXT2/EXT3/XFS ACL support (optional) @@ -41,7 +42,7 @@ # point to this derivations `/dsmi_dir` directory symlink. # Other environment variables might be necessary, # depending on local configuration or usage; see: -# https://www.ibm.com/docs/en/spectrum-protect/8.1.8?topic=solaris-set-api-environment-variables +# https://www.ibm.com/docs/en/spectrum-protect/8.1.13?topic=solaris-set-api-environment-variables # The newest version of TSM client should be discoverable by @@ -89,10 +90,10 @@ let unwrapped = stdenv.mkDerivation rec { name = "tsm-client-${version}-unwrapped"; - version = "8.1.8.0"; + version = "8.1.13.0"; src = fetchurl { url = mkSrcUrl version; - sha256 = "0c1d0jm0i7qjd314nhj2vj8fs7sncm1x2n4d6dg4049jniyvjhpk"; + sha256 = "0fy9c224g6rkrgd6ls01vs30bk9j9mlhf2x6akd11r7h8bib19zn"; }; inherit meta; @@ -100,6 +101,7 @@ let autoPatchelfHook ]; buildInputs = [ + openssl stdenv.cc.cc zlib ]; From 7934926b2e9761fe38ef567efaa0791d7d96388d Mon Sep 17 00:00:00 2001 From: Yarny0 <41838844+Yarny0@users.noreply.github.com> Date: Sun, 24 Oct 2021 08:59:16 +0200 Subject: [PATCH 15/49] tsm-client: makeWrapper buildInputs to nativeBuildInputs Although I'm not sure if `tsm-client` will ever be subject to cross-compiling, referencing makeWrapper from native BuildInputs is The Right Thing. This is a kind of follow-up of https://github.com/NixOS/nixpkgs/pull/112276 --- pkgs/tools/backup/tsm-client/default.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkgs/tools/backup/tsm-client/default.nix b/pkgs/tools/backup/tsm-client/default.nix index e29efa3c0019..cb7ec933e8e4 100644 --- a/pkgs/tools/backup/tsm-client/default.nix +++ b/pkgs/tools/backup/tsm-client/default.nix @@ -151,7 +151,7 @@ buildEnv { inherit meta; passthru = { inherit unwrapped; }; paths = [ unwrapped ]; - buildInputs = [ makeWrapper ]; + nativeBuildInputs = [ makeWrapper ]; pathsToLink = [ "/" "/bin" From 8fa6f90ad6d03a8eb9b7a069f78f7f10a1fa2b51 Mon Sep 17 00:00:00 2001 From: Yarny0 <41838844+Yarny0@users.noreply.github.com> Date: Sat, 4 Dec 2021 09:00:58 +0100 Subject: [PATCH 16/49] tsm-client: set mainProgram The TSM command line client `dsmc` should be the program that is usually invoked from this package. However, if a user explicitely asks for the package with GUI support (with `enableGui`, available in the package `tsm-client-withGui`), we set the mainProgram to the graphical application `dsmj` as that's likely what the user is looking for. --- pkgs/tools/backup/tsm-client/default.nix | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/pkgs/tools/backup/tsm-client/default.nix b/pkgs/tools/backup/tsm-client/default.nix index cb7ec933e8e4..ad9b8315aedc 100644 --- a/pkgs/tools/backup/tsm-client/default.nix +++ b/pkgs/tools/backup/tsm-client/default.nix @@ -62,6 +62,7 @@ let homepage = "https://www.ibm.com/products/data-protection-and-recovery"; downloadPage = "https://www.ibm.com/support/pages/ibm-spectrum-protect-downloads-latest-fix-packs-and-interim-fixes"; platforms = [ "x86_64-linux" ]; + mainProgram = "dsmc"; license = lib.licenses.unfree; maintainers = [ lib.maintainers.yarny ]; description = "IBM Spectrum Protect (Tivoli Storage Manager) CLI and API"; @@ -148,7 +149,9 @@ in buildEnv { name = "tsm-client-${unwrapped.version}"; - inherit meta; + meta = meta // lib.attrsets.optionalAttrs enableGui { + mainProgram = "dsmj"; + }; passthru = { inherit unwrapped; }; paths = [ unwrapped ]; nativeBuildInputs = [ makeWrapper ]; From 3f6d1f5f60461dc60992bf200e8c13535e2727a7 Mon Sep 17 00:00:00 2001 From: Yarny0 <41838844+Yarny0@users.noreply.github.com> Date: Sun, 24 Oct 2021 10:17:59 +0200 Subject: [PATCH 17/49] nixos/tsm-{client,backup}: update links in module comments IBM has changed the URL structures of their support web pages. The commit at hand updates URLs in two comments so they follow the new structure. --- nixos/modules/programs/tsm-client.nix | 2 +- nixos/modules/services/backup/tsm.nix | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/nixos/modules/programs/tsm-client.nix b/nixos/modules/programs/tsm-client.nix index 65d4db7834ff..421beec86e50 100644 --- a/nixos/modules/programs/tsm-client.nix +++ b/nixos/modules/programs/tsm-client.nix @@ -144,7 +144,7 @@ let }; config.name = mkDefault name; # Client system-options file directives are explained here: - # https://www.ibm.com/support/knowledgecenter/SSEQVQ_8.1.8/client/c_opt_usingopts.html + # https://www.ibm.com/docs/en/spectrum-protect/8.1.13?topic=commands-processing-options config.extraConfig = mapAttrs (lib.trivial.const mkDefault) ( { diff --git a/nixos/modules/services/backup/tsm.nix b/nixos/modules/services/backup/tsm.nix index 6c238745797e..d138e163e34f 100644 --- a/nixos/modules/services/backup/tsm.nix +++ b/nixos/modules/services/backup/tsm.nix @@ -88,7 +88,7 @@ in # TSM needs a HOME dir to store certificates. environment.HOME = "/var/lib/tsm-backup"; # for exit status description see - # https://www.ibm.com/support/knowledgecenter/en/SSEQVQ_8.1.8/client/c_sched_rtncode.html + # https://www.ibm.com/docs/en/spectrum-protect/8.1.13?topic=clients-client-return-codes serviceConfig.SuccessExitStatus = "4 8"; # The `-se` option must come after the command. # The `-optfile` option suppresses a `dsm.opt`-not-found warning. From c5effcaaeac42e3d54dd04985645ab2600641ad8 Mon Sep 17 00:00:00 2001 From: Yarny0 <41838844+Yarny0@users.noreply.github.com> Date: Sun, 24 Oct 2021 10:56:40 +0200 Subject: [PATCH 18/49] nixos/tsm-backup: enable most systemd sandboxing options This enables some systemd sandboxing options for the `tsm-backup.service`. Those settings have been determined by expermentation. This commit tries hard to protect the filesystem from write access, but not to hide anything from read access, so users can backup all files they choose to backup. An exception are API filesystems (`/dev`, `/proc`, `/sys`): As their "files" are not stored on persistent storage, they are sandboxed away as much as possible. Note that the service still has to run with root privileges to reach files with limited access permissions. The obvious alternative to use a dedicated user account and the `CAP_DAC_READ_SEARCH` capability to permit system-wide read access while blocking write access does not work. Experiments have shown that `dsmc` verifies access permissions for each file before attempting to open it for reading. Hence `dsmc` refuses to copy files where the file permission mode blocks read access -- even if process capabilities would allow it to proceed irrespective of permissions. --- nixos/modules/services/backup/tsm.nix | 39 ++++++++++++++++++++------- 1 file changed, 29 insertions(+), 10 deletions(-) diff --git a/nixos/modules/services/backup/tsm.nix b/nixos/modules/services/backup/tsm.nix index d138e163e34f..0017a6f69c16 100644 --- a/nixos/modules/services/backup/tsm.nix +++ b/nixos/modules/services/backup/tsm.nix @@ -87,16 +87,35 @@ in environment.DSM_LOG = "/var/log/tsm-backup/"; # TSM needs a HOME dir to store certificates. environment.HOME = "/var/lib/tsm-backup"; - # for exit status description see - # https://www.ibm.com/docs/en/spectrum-protect/8.1.13?topic=clients-client-return-codes - serviceConfig.SuccessExitStatus = "4 8"; - # The `-se` option must come after the command. - # The `-optfile` option suppresses a `dsm.opt`-not-found warning. - serviceConfig.ExecStart = - "${cfgPrg.wrappedPackage}/bin/dsmc ${cfg.command} -se='${cfg.servername}' -optfile=/dev/null"; - serviceConfig.LogsDirectory = "tsm-backup"; - serviceConfig.StateDirectory = "tsm-backup"; - serviceConfig.StateDirectoryMode = "0750"; + serviceConfig = { + # for exit status description see + # https://www.ibm.com/docs/en/spectrum-protect/8.1.13?topic=clients-client-return-codes + SuccessExitStatus = "4 8"; + # The `-se` option must come after the command. + # The `-optfile` option suppresses a `dsm.opt`-not-found warning. + ExecStart = + "${cfgPrg.wrappedPackage}/bin/dsmc ${cfg.command} -se='${cfg.servername}' -optfile=/dev/null"; + LogsDirectory = "tsm-backup"; + StateDirectory = "tsm-backup"; + StateDirectoryMode = "0750"; + # systemd sandboxing + LockPersonality = true; + NoNewPrivileges = true; + PrivateDevices = true; + #PrivateTmp = true; # would break backup of {/var,}/tmp + #PrivateUsers = true; # would block backup of /home/* + ProtectClock = true; + ProtectControlGroups = true; + ProtectHome = "read-only"; + ProtectHostname = true; + ProtectKernelLogs = true; + ProtectKernelModules = true; + ProtectKernelTunables = true; + ProtectProc = "noaccess"; + ProtectSystem = "strict"; + RestrictNamespaces = true; + RestrictSUIDSGID = true; + }; startAt = mkIf (cfg.autoTime!=null) cfg.autoTime; }; }; From c2192ed77ae517094a235dfb0ef33d7b88d81212 Mon Sep 17 00:00:00 2001 From: Yarny0 <41838844+Yarny0@users.noreply.github.com> Date: Sun, 5 Dec 2021 13:52:06 +0100 Subject: [PATCH 19/49] nixos/tsm-{client,backup}: use new type `nonEmptyStr` The module option type `nonEmptyStr` was introduced in commit https://github.com/NixOS/nixpkgs/commit/a3c5f0cba8fa9c4d9782ef83757be6e4028f54b7 The tsm modules previously simply used `strMatching ".+"` to prevent empty option strings, but the new type is more thorough as it also catches space-only strings. --- nixos/modules/programs/tsm-client.nix | 6 +++--- nixos/modules/services/backup/tsm.nix | 8 ++++---- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/nixos/modules/programs/tsm-client.nix b/nixos/modules/programs/tsm-client.nix index 421beec86e50..28db96253875 100644 --- a/nixos/modules/programs/tsm-client.nix +++ b/nixos/modules/programs/tsm-client.nix @@ -7,7 +7,7 @@ let inherit (lib.modules) mkDefault mkIf; inherit (lib.options) literalExpression mkEnableOption mkOption; inherit (lib.strings) concatStringsSep optionalString toLower; - inherit (lib.types) addCheck attrsOf lines nullOr package path port str strMatching submodule; + inherit (lib.types) addCheck attrsOf lines nonEmptyStr nullOr package path port str strMatching submodule; # Checks if given list of strings contains unique # elements when compared without considering case. @@ -35,7 +35,7 @@ let ''; }; options.server = mkOption { - type = strMatching ".+"; + type = nonEmptyStr; example = "tsmserver.company.com"; description = '' Host/domain name or IP address of the IBM TSM server. @@ -56,7 +56,7 @@ let ''; }; options.node = mkOption { - type = strMatching ".+"; + type = nonEmptyStr; example = "MY-TSM-NODE"; description = '' Target node name on the IBM TSM server. diff --git a/nixos/modules/services/backup/tsm.nix b/nixos/modules/services/backup/tsm.nix index 0017a6f69c16..4e690ac6ecda 100644 --- a/nixos/modules/services/backup/tsm.nix +++ b/nixos/modules/services/backup/tsm.nix @@ -5,7 +5,7 @@ let inherit (lib.attrsets) hasAttr; inherit (lib.modules) mkDefault mkIf; inherit (lib.options) mkEnableOption mkOption; - inherit (lib.types) nullOr strMatching; + inherit (lib.types) nonEmptyStr nullOr; options.services.tsmBackup = { enable = mkEnableOption '' @@ -15,7 +15,7 @@ let ''; command = mkOption { - type = strMatching ".+"; + type = nonEmptyStr; default = "backup"; example = "incr"; description = '' @@ -24,7 +24,7 @@ let ''; }; servername = mkOption { - type = strMatching ".+"; + type = nonEmptyStr; example = "mainTsmServer"; description = '' Create a systemd system service @@ -41,7 +41,7 @@ let ''; }; autoTime = mkOption { - type = nullOr (strMatching ".+"); + type = nullOr nonEmptyStr; default = null; example = "12:00"; description = '' From f6dca95c5dc8ab63322e439ae33a148877838ba9 Mon Sep 17 00:00:00 2001 From: Yarny0 <41838844+Yarny0@users.noreply.github.com> Date: Sat, 18 Dec 2021 09:21:57 +0100 Subject: [PATCH 20/49] tsm-client: add test derivation and a module test The tsm-client needs a tsm-server to do anything useful. Without a server, automated tests can just check diagnostic outputs for plausibility. The commit at hand adds two tests: 1. The command line interface `dsmc` is called, then it is verified that the program does * report the correct client version, * find its configuration file, * report a connection error. 2. To check the GUI (and the tsm-client nixos module), we add a vm test which uses the module to install `tsm-client-withGui`. To verify that the GUI's basic functionality is present, we skip over all connection failure related error messages and open the "Connection Information" dialog from the main application window. This dialog presents the node name and the client version; both are verified by the test. Note: Our `tsm-client` build recipe consists of two packages: The "unwrapped" package and the final package. This commit puts the unwrapped one into the final package's `passthru` so that tests can access the original version string that is needed to check the client version reported by the application. --- nixos/tests/all-tests.nix | 1 + nixos/tests/tsm-client-gui.nix | 57 ++++++++++++++++++++++ pkgs/tools/backup/tsm-client/default.nix | 11 ++++- pkgs/tools/backup/tsm-client/test-cli.nix | 58 +++++++++++++++++++++++ 4 files changed, 125 insertions(+), 2 deletions(-) create mode 100644 nixos/tests/tsm-client-gui.nix create mode 100644 pkgs/tools/backup/tsm-client/test-cli.nix diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix index 95ce2cc5ccf2..ef98567a006f 100644 --- a/nixos/tests/all-tests.nix +++ b/nixos/tests/all-tests.nix @@ -487,6 +487,7 @@ in trezord = handleTest ./trezord.nix {}; trickster = handleTest ./trickster.nix {}; trilium-server = handleTestOn ["x86_64-linux"] ./trilium-server.nix {}; + tsm-client-gui = handleTest ./tsm-client-gui.nix {}; txredisapi = handleTest ./txredisapi.nix {}; tuptime = handleTest ./tuptime.nix {}; turbovnc-headless-server = handleTest ./turbovnc-headless-server.nix {}; diff --git a/nixos/tests/tsm-client-gui.nix b/nixos/tests/tsm-client-gui.nix new file mode 100644 index 000000000000..e4bcd344a895 --- /dev/null +++ b/nixos/tests/tsm-client-gui.nix @@ -0,0 +1,57 @@ +# The tsm-client GUI first tries to connect to a server. +# We can't simulate a server, so we just check if +# it reports the correct connection failure error. +# After that the test persuades the GUI +# to show its main application window +# and verifies some configuration information. + +import ./make-test-python.nix ({ lib, pkgs, ... }: { + name = "tsm-client"; + + enableOCR = true; + + machine = { pkgs, ... }: { + imports = [ ./common/x11.nix ]; + programs.tsmClient = { + enable = true; + package = pkgs.tsm-client-withGui; + defaultServername = "testserver"; + servers.testserver = { + # 192.0.0.8 is a "dummy address" according to RFC 7600 + server = "192.0.0.8"; + node = "SOME-NODE"; + passwdDir = "/tmp"; + }; + }; + }; + + testScript = '' + machine.succeed("which dsmj") # fail early if this is missing + machine.wait_for_x() + machine.execute("DSM_LOG=/tmp dsmj -optfile=/dev/null >&2 &") + + # does it report the "TCP/IP connection failure" error code? + machine.wait_for_window("IBM Spectrum Protect") + machine.wait_for_text("ANS2610S") + machine.send_key("esc") + + # it asks to continue to restore a local backupset now; + # "yes" (return) leads to the main application window + machine.wait_for_text("backupset") + machine.send_key("ret") + + # main window: navigate to "Connection Information" + machine.wait_for_text("Welcome") + machine.send_key("alt-f") # "File" menu + machine.send_key("c") # "Connection Information" + + # "Connection Information" dialog box + machine.wait_for_window("Connection Information") + machine.wait_for_text("SOME-NODE") + machine.wait_for_text("${pkgs.tsm-client.passthru.unwrapped.version}") + + machine.shutdown() + ''; + + meta.maintainers = [ lib.maintainers.yarny ]; +}) diff --git a/pkgs/tools/backup/tsm-client/default.nix b/pkgs/tools/backup/tsm-client/default.nix index ad9b8315aedc..6303d76a1dad 100644 --- a/pkgs/tools/backup/tsm-client/default.nix +++ b/pkgs/tools/backup/tsm-client/default.nix @@ -1,4 +1,6 @@ { lib +, callPackage +, nixosTests , stdenv , fetchurl , autoPatchelfHook @@ -81,6 +83,11 @@ let ''; }; + passthru.tests = { + test-cli = callPackage ./test-cli.nix {}; + test-gui = nixosTests.tsm-client-gui; + }; + mkSrcUrl = version: let major = lib.versions.major version; @@ -96,7 +103,7 @@ let url = mkSrcUrl version; sha256 = "0fy9c224g6rkrgd6ls01vs30bk9j9mlhf2x6akd11r7h8bib19zn"; }; - inherit meta; + inherit meta passthru; nativeBuildInputs = [ autoPatchelfHook @@ -152,7 +159,7 @@ buildEnv { meta = meta // lib.attrsets.optionalAttrs enableGui { mainProgram = "dsmj"; }; - passthru = { inherit unwrapped; }; + passthru = passthru // { inherit unwrapped; }; paths = [ unwrapped ]; nativeBuildInputs = [ makeWrapper ]; pathsToLink = [ diff --git a/pkgs/tools/backup/tsm-client/test-cli.nix b/pkgs/tools/backup/tsm-client/test-cli.nix new file mode 100644 index 000000000000..0858083c9f90 --- /dev/null +++ b/pkgs/tools/backup/tsm-client/test-cli.nix @@ -0,0 +1,58 @@ +{ lib +, writeText +, runCommand +, tsm-client +}: + +# Let the client try to connect to a server. +# We can't simulate a server, so there's no more to test. + +let + + # 192.0.0.8 is a "dummy address" according to RFC 7600 + dsmSysCli = writeText "cli.dsm.sys" '' + defaultserver testserver + server testserver + commmethod v6tcpip + tcpserveraddress 192.0.0.8 + nodename ARBITRARYNODENAME + ''; + + tsm-client_ = tsm-client.override { inherit dsmSysCli; }; + + env.nativeBuildInputs = [ tsm-client_ ]; + + versionString = + let + inherit (tsm-client_.passthru.unwrapped) version; + major = lib.versions.major version; + minor = lib.versions.minor version; + patch = lib.versions.patch version; + fixup = lib.lists.elemAt (lib.versions.splitVersion version) 3; + in + "Client Version ${major}, Release ${minor}, Level ${patch}.${fixup}"; + +in + +runCommand "${tsm-client.name}-test-cli" env '' + set -o nounset + set -o pipefail + + export DSM_LOG=$(mktemp -d ./dsm_log.XXXXXXXXXXX) + + { dsmc -optfile=/dev/null || true; } | tee dsmc-stdout + + # does it report the correct version? + grep --fixed-strings '${versionString}' dsmc-stdout + + # does it use the provided dsm.sys config file? + # if it does, it states the node's name + grep ARBITRARYNODENAME dsmc-stdout + + # does it try (and fail) to connect to the server? + # if it does, it reports the "TCP/IP connection failure" error code + grep ANS1017E dsmc-stdout + grep ANS1017E $DSM_LOG/dsmerror.log + + touch $out +'' From 66d068bf66f8e5f55c589ff4c6114c0773c4ee70 Mon Sep 17 00:00:00 2001 From: Yarny0 <41838844+Yarny0@users.noreply.github.com> Date: Sat, 18 Dec 2021 13:49:54 +0100 Subject: [PATCH 21/49] tsm-client: use rpm source instead of deb/Ubuntu IBM publishes their IBM Spectrum Protect client for Linux in two flavors: * "Linux x86_64 client" * "Linux x86_64 Ubuntu client" Up to this commit, nixpkgs used the Ubuntu flavor to build its `tsm-client` derivation. However, the history of published archive files in * https://public.dhe.ibm.com/storage/tivoli-storage-management/maintenance/client/v8r1/Linux/ * https://public.dhe.ibm.com/storage/tivoli-storage-management/patches/client/v8r1/Linux/ suggests that updates in the fourth level of the version numbers (e.g. 8.1.13.0 -> 8.1.13.1) do not get published as Ubuntu flavor. It order to be able to always use the latest release, this commit switches to the non-Ubuntu flavor. The non-Ubuntu archive contains rpm files, so this commit switches from `ar` to `rpmextract`. Instead of unpacking all deb files, the build recipe now unpacks all _but one_ rpm file: The file `TIVsm-WEBGUI.x86_64.rpm` apparently contains a plugin that is not included in the Ubuntu version (see note below). Comparing the old and the new derivation's output indicates that this choice minimizes the difference between the results: The output of the old (Ubuntu flavor) derivation contains: * `commons-codec-1.6.jar` * `share/` with changelog and copyright information for the packages `gskssl64` and `gskcrypt64` The output of the new (non-Ubuntu flavor) derivation contains: * `lib64`, symlink to `lib` * `commons-codec-1.14.jar` * `opt/tivoli/tsm/license/{api,baclient}/sm/` with license agreement files in many languages Besides these differences, the outputs' file names are equal. Note: I don't know what functionality `TIVsm-WEBGUI.x86_64.rpm` actually provides. Unpacking it with the other rpm files makes patchelf complain about missing X11 libraries, so in order to include it here, one would likely need to add those to `buildInputs`. However, as the old (Ubuntu flavor) `tsm-client` package did not contain this functionality and as I cannot test or use it in any way, I opted to not include it now. If we want to include this with a later commit, we should add another package build option (like `enableGui`) so that the default `tsm-client` package does not pull in X11 libraries and its closure size therefore stays small. --- pkgs/tools/backup/tsm-client/default.nix | 46 +++++++++++++++--------- 1 file changed, 29 insertions(+), 17 deletions(-) diff --git a/pkgs/tools/backup/tsm-client/default.nix b/pkgs/tools/backup/tsm-client/default.nix index 6303d76a1dad..2cb29106c989 100644 --- a/pkgs/tools/backup/tsm-client/default.nix +++ b/pkgs/tools/backup/tsm-client/default.nix @@ -4,6 +4,7 @@ , stdenv , fetchurl , autoPatchelfHook +, rpmextract , openssl , zlib , lvm2 # LVM image backup and restore functions (optional) @@ -48,14 +49,20 @@ # The newest version of TSM client should be discoverable by -# going to the `downloadPage` (see `meta` below), then -# * find section "Client Service Release", -# * pick the latest version and follow the link -# "IBM Spectrum Protect Client .. Downloads and READMEs" -# * in the table at the page's bottom, follow the -# "HTTPS" link of the "Linux x86_64 Ubuntu client" -# * in the directory listing, pick the big `.tar` file -# (as of 2021-12-13) +# going to the `downloadPage` (see `meta` below). +# Find the "Backup-archive client" table on that page. +# Look for "Download Documents" of the latest release. +# Here, two links must be checked: +# * "IBM Spectrum Protect Client ... Downloads and READMEs": +# In the table at the page's bottom, +# check the date of the "Linux x86_64 client" +# * "IBM Spectrum Protect BA client ... interim fix downloads" +# Look for the "Linux x86_64 client" rows +# in the table # at the bottom of each page. +# Follow the "HTTPS" link of the row with the latest date stamp. +# In the directory listing to show up, pick the big `.tar` file. +# +# (as of 2021-12-18) let @@ -93,20 +100,22 @@ let major = lib.versions.major version; minor = lib.versions.minor version; patch = lib.versions.patch version; + fixup = lib.lists.elemAt (lib.versions.splitVersion version) 3; in - "https://public.dhe.ibm.com/storage/tivoli-storage-management/maintenance/client/v${major}r${minor}/Linux/LinuxX86_DEB/BA/v${major}${minor}${patch}/${version}-TIV-TSMBAC-LinuxX86_DEB.tar"; + "https://public.dhe.ibm.com/storage/tivoli-storage-management/${if fixup=="0" then "maintenance" else "patches"}/client/v${major}r${minor}/Linux/LinuxX86/BA/v${major}${minor}${patch}/${version}-TIV-TSMBAC-LinuxX86.tar"; unwrapped = stdenv.mkDerivation rec { name = "tsm-client-${version}-unwrapped"; version = "8.1.13.0"; src = fetchurl { url = mkSrcUrl version; - sha256 = "0fy9c224g6rkrgd6ls01vs30bk9j9mlhf2x6akd11r7h8bib19zn"; + sha256 = "1p6bw1szsb6kl7nfalsnz0kxcs8dvggh8ad8irj677ljhhryqbm4"; }; inherit meta passthru; nativeBuildInputs = [ autoPatchelfHook + rpmextract ]; buildInputs = [ openssl @@ -119,12 +128,15 @@ let sourceRoot = "."; postUnpack = '' - for debfile in *.deb - do - ar -x "$debfile" - tar --xz --extract --file=data.tar.xz - rm data.tar.xz - done + rpmextract TIVsm-API64.x86_64.rpm + rpmextract TIVsm-APIcit.x86_64.rpm + rpmextract TIVsm-BA.x86_64.rpm + rpmextract TIVsm-BAcit.x86_64.rpm + rpmextract TIVsm-BAhdw.x86_64.rpm + rpmextract TIVsm-JBB.x86_64.rpm + # use globbing so that version updates don't break the build: + rpmextract gskcrypt64-*.linux.x86_64.rpm + rpmextract gskssl64-*.linux.x86_64.rpm ''; installPhase = '' @@ -136,7 +148,7 @@ let # Fix relative symlinks after `/usr` was moved up one level preFixup = '' - for link in $out/lib/* $out/bin/* + for link in $out/lib{,64}/* $out/bin/* do target=$(readlink "$link") if [ "$(cut -b -6 <<< "$target")" != "../../" ] From 4a42ca06c10fc049a63cc12201ab1b93125230fe Mon Sep 17 00:00:00 2001 From: Yarny0 <41838844+Yarny0@users.noreply.github.com> Date: Sat, 18 Dec 2021 16:25:03 +0100 Subject: [PATCH 22/49] tsm-client: 8.1.13.0 -> 8.1.13.1 Link to Security Bulletin: https://www.ibm.com/support/pages/node/6527080 (CVE-2021-44228) --- pkgs/tools/backup/tsm-client/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/tools/backup/tsm-client/default.nix b/pkgs/tools/backup/tsm-client/default.nix index 2cb29106c989..2f5c50e2b294 100644 --- a/pkgs/tools/backup/tsm-client/default.nix +++ b/pkgs/tools/backup/tsm-client/default.nix @@ -106,10 +106,10 @@ let unwrapped = stdenv.mkDerivation rec { name = "tsm-client-${version}-unwrapped"; - version = "8.1.13.0"; + version = "8.1.13.1"; src = fetchurl { url = mkSrcUrl version; - sha256 = "1p6bw1szsb6kl7nfalsnz0kxcs8dvggh8ad8irj677ljhhryqbm4"; + sha256 = "00kgfn00b4gmmpxgw7n5kyfh94a9fkmi8bm9pqy9gz8qrp1v9d2r"; }; inherit meta passthru; From be904af99c0a9a26f2beb4cab2da45ff0c139bc7 Mon Sep 17 00:00:00 2001 From: Yarny0 <41838844+Yarny0@users.noreply.github.com> Date: Thu, 6 Jan 2022 10:02:11 +0100 Subject: [PATCH 23/49] tsm-client: 8.1.13.1 -> 8.1.13.2 Link to Security Bulletin: https://www.ibm.com/support/pages/node/6537640 (CVE-2021-45105, CVE-2021-45046) --- pkgs/tools/backup/tsm-client/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/tools/backup/tsm-client/default.nix b/pkgs/tools/backup/tsm-client/default.nix index 2f5c50e2b294..7c29d34d2046 100644 --- a/pkgs/tools/backup/tsm-client/default.nix +++ b/pkgs/tools/backup/tsm-client/default.nix @@ -106,10 +106,10 @@ let unwrapped = stdenv.mkDerivation rec { name = "tsm-client-${version}-unwrapped"; - version = "8.1.13.1"; + version = "8.1.13.2"; src = fetchurl { url = mkSrcUrl version; - sha256 = "00kgfn00b4gmmpxgw7n5kyfh94a9fkmi8bm9pqy9gz8qrp1v9d2r"; + sha256 = "0cspxr96g93kb8vy6m86ks16sfw1zghkd2fmxk95mwphs762d5xm"; }; inherit meta passthru; From 756f45306b69ac4fe0a4cd4e2d42bb3d29162f43 Mon Sep 17 00:00:00 2001 From: Yarny0 <41838844+Yarny0@users.noreply.github.com> Date: Sat, 15 Jan 2022 10:53:06 +0100 Subject: [PATCH 24/49] tsm-client: 8.1.13.2 -> 8.1.13.3 Link to Security Bulletin: https://www.ibm.com/support/pages/node/6540692 (CVE-2021-44832) --- pkgs/tools/backup/tsm-client/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/tools/backup/tsm-client/default.nix b/pkgs/tools/backup/tsm-client/default.nix index 7c29d34d2046..c684b34ec4e5 100644 --- a/pkgs/tools/backup/tsm-client/default.nix +++ b/pkgs/tools/backup/tsm-client/default.nix @@ -106,10 +106,10 @@ let unwrapped = stdenv.mkDerivation rec { name = "tsm-client-${version}-unwrapped"; - version = "8.1.13.2"; + version = "8.1.13.3"; src = fetchurl { url = mkSrcUrl version; - sha256 = "0cspxr96g93kb8vy6m86ks16sfw1zghkd2fmxk95mwphs762d5xm"; + sha256 = "1dwczf236drdaf4jcfzz5154vdwvxf5zraxhrhiddl6n80hnvbcd"; }; inherit meta passthru; From 21b1de2bcd06ca1eb98ef46d3cb4aaf9461067c4 Mon Sep 17 00:00:00 2001 From: talyz Date: Mon, 17 Jan 2022 12:42:30 +0100 Subject: [PATCH 25/49] nixos/keycloak: Inherit library functions and builtins Instead of referencing all library functions through `lib.` and builtins through `builtins.` at every invocation, inherit them into the appropriate scope. --- nixos/modules/services/web-apps/keycloak.nix | 629 ++++++++++--------- 1 file changed, 321 insertions(+), 308 deletions(-) diff --git a/nixos/modules/services/web-apps/keycloak.nix b/nixos/modules/services/web-apps/keycloak.nix index b324bc13dfb3..436dad383754 100644 --- a/nixos/modules/services/web-apps/keycloak.nix +++ b/nixos/modules/services/web-apps/keycloak.nix @@ -3,299 +3,312 @@ let cfg = config.services.keycloak; opt = options.services.keycloak; + + inherit (lib) types mkOption concatStringsSep mapAttrsToList + escapeShellArg recursiveUpdate optionalAttrs boolToString mkOrder + sort filterAttrs concatMapStringsSep concatStrings mkIf + optionalString optionals mkDefault literalExpression hasSuffix + foldl' isAttrs filter attrNames elem literalDocBook + maintainers; + + inherit (builtins) match typeOf; in { - options.services.keycloak = { - - enable = lib.mkOption { - type = lib.types.bool; - default = false; - example = true; - description = '' - Whether to enable the Keycloak identity and access management - server. - ''; - }; - - bindAddress = lib.mkOption { - type = lib.types.str; - default = "\${jboss.bind.address:0.0.0.0}"; - example = "127.0.0.1"; - description = '' - On which address Keycloak should accept new connections. - - A special syntax can be used to allow command line Java system - properties to override the value: ''${property.name:value} - ''; - }; - - httpPort = lib.mkOption { - type = lib.types.str; - default = "\${jboss.http.port:80}"; - example = "8080"; - description = '' - On which port Keycloak should listen for new HTTP connections. - - A special syntax can be used to allow command line Java system - properties to override the value: ''${property.name:value} - ''; - }; - - httpsPort = lib.mkOption { - type = lib.types.str; - default = "\${jboss.https.port:443}"; - example = "8443"; - description = '' - On which port Keycloak should listen for new HTTPS connections. - - A special syntax can be used to allow command line Java system - properties to override the value: ''${property.name:value} - ''; - }; - - frontendUrl = lib.mkOption { - type = lib.types.str; - apply = x: - if x == "" || lib.hasSuffix "/" x then - x - else - x + "/"; - example = "keycloak.example.com/auth"; - description = '' - The public URL used as base for all frontend requests. Should - normally include a trailing /auth. - - See the - Hostname section of the Keycloak server installation - manual for more information. - ''; - }; - - forceBackendUrlToFrontendUrl = lib.mkOption { - type = lib.types.bool; - default = false; - example = true; - description = '' - Whether Keycloak should force all requests to go through the - frontend URL configured in . By default, - Keycloak allows backend requests to instead use its local - hostname or IP address and may also advertise it to clients - through its OpenID Connect Discovery endpoint. - - See the - Hostname section of the Keycloak server installation - manual for more information. - ''; - }; - - sslCertificate = lib.mkOption { - type = lib.types.nullOr lib.types.path; - default = null; - example = "/run/keys/ssl_cert"; - description = '' - The path to a PEM formatted certificate to use for TLS/SSL - connections. - - This should be a string, not a Nix path, since Nix paths are - copied into the world-readable Nix store. - ''; - }; - - sslCertificateKey = lib.mkOption { - type = lib.types.nullOr lib.types.path; - default = null; - example = "/run/keys/ssl_key"; - description = '' - The path to a PEM formatted private key to use for TLS/SSL - connections. - - This should be a string, not a Nix path, since Nix paths are - copied into the world-readable Nix store. - ''; - }; - - database = { - type = lib.mkOption { - type = lib.types.enum [ "mysql" "postgresql" ]; - default = "postgresql"; - example = "mysql"; + options.services.keycloak = + let + inherit (types) bool str nullOr attrsOf path enum anything + package port; + in + { + enable = mkOption { + type = bool; + default = false; + example = true; description = '' - The type of database Keycloak should connect to. + Whether to enable the Keycloak identity and access management + server. ''; }; - host = lib.mkOption { - type = lib.types.str; - default = "localhost"; + bindAddress = mkOption { + type = str; + default = "\${jboss.bind.address:0.0.0.0}"; + example = "127.0.0.1"; description = '' - Hostname of the database to connect to. + On which address Keycloak should accept new connections. + + A special syntax can be used to allow command line Java system + properties to override the value: ''${property.name:value} ''; }; - port = - let - dbPorts = { - postgresql = 5432; - mysql = 3306; - }; - in - lib.mkOption { - type = lib.types.port; - default = dbPorts.${cfg.database.type}; - defaultText = lib.literalDocBook "default port of selected database"; - description = '' - Port of the database to connect to. - ''; - }; - - useSSL = lib.mkOption { - type = lib.types.bool; - default = cfg.database.host != "localhost"; - defaultText = lib.literalExpression ''config.${opt.database.host} != "localhost"''; + httpPort = mkOption { + type = str; + default = "\${jboss.http.port:80}"; + example = "8080"; description = '' - Whether the database connection should be secured by SSL / - TLS. + On which port Keycloak should listen for new HTTP connections. + + A special syntax can be used to allow command line Java system + properties to override the value: ''${property.name:value} ''; }; - caCert = lib.mkOption { - type = lib.types.nullOr lib.types.path; + httpsPort = mkOption { + type = str; + default = "\${jboss.https.port:443}"; + example = "8443"; + description = '' + On which port Keycloak should listen for new HTTPS connections. + + A special syntax can be used to allow command line Java system + properties to override the value: ''${property.name:value} + ''; + }; + + frontendUrl = mkOption { + type = str; + apply = x: + if x == "" || hasSuffix "/" x then + x + else + x + "/"; + example = "keycloak.example.com/auth"; + description = '' + The public URL used as base for all frontend requests. Should + normally include a trailing /auth. + + See the + Hostname section of the Keycloak server installation + manual for more information. + ''; + }; + + forceBackendUrlToFrontendUrl = mkOption { + type = bool; + default = false; + example = true; + description = '' + Whether Keycloak should force all requests to go through the + frontend URL configured in . By default, + Keycloak allows backend requests to instead use its local + hostname or IP address and may also advertise it to clients + through its OpenID Connect Discovery endpoint. + + See the + Hostname section of the Keycloak server installation + manual for more information. + ''; + }; + + sslCertificate = mkOption { + type = nullOr path; default = null; + example = "/run/keys/ssl_cert"; description = '' - The SSL / TLS CA certificate that verifies the identity of the - database server. - - Required when PostgreSQL is used and SSL is turned on. - - For MySQL, if left at null, the default - Java keystore is used, which should suffice if the server - certificate is issued by an official CA. - ''; - }; - - createLocally = lib.mkOption { - type = lib.types.bool; - default = true; - description = '' - Whether a database should be automatically created on the - local host. Set this to false if you plan on provisioning a - local database yourself. This has no effect if - services.keycloak.database.host is customized. - ''; - }; - - username = lib.mkOption { - type = lib.types.str; - default = "keycloak"; - description = '' - Username to use when connecting to an external or manually - provisioned database; has no effect when a local database is - automatically provisioned. - - To use this with a local database, set to - false and create the database and user - manually. The database should be called - keycloak. - ''; - }; - - passwordFile = lib.mkOption { - type = lib.types.path; - example = "/run/keys/db_password"; - description = '' - File containing the database password. + The path to a PEM formatted certificate to use for TLS/SSL + connections. This should be a string, not a Nix path, since Nix paths are copied into the world-readable Nix store. ''; }; - }; - package = lib.mkOption { - type = lib.types.package; - default = pkgs.keycloak; - defaultText = lib.literalExpression "pkgs.keycloak"; - description = '' - Keycloak package to use. - ''; - }; + sslCertificateKey = mkOption { + type = nullOr path; + default = null; + example = "/run/keys/ssl_key"; + description = '' + The path to a PEM formatted private key to use for TLS/SSL + connections. - initialAdminPassword = lib.mkOption { - type = lib.types.str; - default = "changeme"; - description = '' - Initial password set for the admin - user. The password is not stored safely and should be changed - immediately in the admin panel. - ''; - }; + This should be a string, not a Nix path, since Nix paths are + copied into the world-readable Nix store. + ''; + }; - themes = lib.mkOption { - type = lib.types.attrsOf lib.types.package; - default = {}; - description = '' - Additional theme packages for Keycloak. Each theme is linked into - subdirectory with a corresponding attribute name. + database = { + type = mkOption { + type = enum [ "mysql" "postgresql" ]; + default = "postgresql"; + example = "mysql"; + description = '' + The type of database Keycloak should connect to. + ''; + }; - Theme packages consist of several subdirectories which provide - different theme types: for example, account, - login etc. After adding a theme to this option you - can select it by its name in Keycloak administration console. - ''; - }; + host = mkOption { + type = str; + default = "localhost"; + description = '' + Hostname of the database to connect to. + ''; + }; - extraConfig = lib.mkOption { - type = lib.types.attrsOf lib.types.anything; - default = { }; - example = lib.literalExpression '' - { - "subsystem=keycloak-server" = { - "spi=hostname" = { - "provider=default" = null; - "provider=fixed" = { - enabled = true; - properties.hostname = "keycloak.example.com"; - }; - default-provider = "fixed"; + port = + let + dbPorts = { + postgresql = 5432; + mysql = 3306; }; + in + mkOption { + type = port; + default = dbPorts.${cfg.database.type}; + defaultText = literalDocBook "default port of selected database"; + description = '' + Port of the database to connect to. + ''; }; - } - ''; - description = '' - Additional Keycloak configuration options to set in - standalone.xml. - Options are expressed as a Nix attribute set which matches the - structure of the jboss-cli configuration. The configuration is - effectively overlayed on top of the default configuration - shipped with Keycloak. To remove existing nodes and undefine - attributes from the default configuration, set them to - null. + useSSL = mkOption { + type = bool; + default = cfg.database.host != "localhost"; + defaultText = literalExpression ''config.${opt.database.host} != "localhost"''; + description = '' + Whether the database connection should be secured by SSL / + TLS. + ''; + }; - The example configuration does the equivalent of the following - script, which removes the hostname provider - default, adds the deprecated hostname - provider fixed and defines it the default: + caCert = mkOption { + type = nullOr path; + default = null; + description = '' + The SSL / TLS CA certificate that verifies the identity of the + database server. - - /subsystem=keycloak-server/spi=hostname/provider=default:remove() - /subsystem=keycloak-server/spi=hostname/provider=fixed:add(enabled = true, properties = { hostname = "keycloak.example.com" }) - /subsystem=keycloak-server/spi=hostname:write-attribute(name=default-provider, value="fixed") - + Required when PostgreSQL is used and SSL is turned on. + + For MySQL, if left at null, the default + Java keystore is used, which should suffice if the server + certificate is issued by an official CA. + ''; + }; + + createLocally = mkOption { + type = bool; + default = true; + description = '' + Whether a database should be automatically created on the + local host. Set this to false if you plan on provisioning a + local database yourself. This has no effect if + services.keycloak.database.host is customized. + ''; + }; + + username = mkOption { + type = str; + default = "keycloak"; + description = '' + Username to use when connecting to an external or manually + provisioned database; has no effect when a local database is + automatically provisioned. + + To use this with a local database, set to + false and create the database and user + manually. The database should be called + keycloak. + ''; + }; + + passwordFile = mkOption { + type = path; + example = "/run/keys/db_password"; + description = '' + File containing the database password. + + This should be a string, not a Nix path, since Nix paths are + copied into the world-readable Nix store. + ''; + }; + }; + + package = mkOption { + type = package; + default = pkgs.keycloak; + defaultText = literalExpression "pkgs.keycloak"; + description = '' + Keycloak package to use. + ''; + }; + + initialAdminPassword = mkOption { + type = str; + default = "changeme"; + description = '' + Initial password set for the admin + user. The password is not stored safely and should be changed + immediately in the admin panel. + ''; + }; + + themes = mkOption { + type = attrsOf package; + default = { }; + description = '' + Additional theme packages for Keycloak. Each theme is linked into + subdirectory with a corresponding attribute name. + + Theme packages consist of several subdirectories which provide + different theme types: for example, account, + login etc. After adding a theme to this option you + can select it by its name in Keycloak administration console. + ''; + }; + + extraConfig = mkOption { + type = attrsOf anything; + default = { }; + example = literalExpression '' + { + "subsystem=keycloak-server" = { + "spi=hostname" = { + "provider=default" = null; + "provider=fixed" = { + enabled = true; + properties.hostname = "keycloak.example.com"; + }; + default-provider = "fixed"; + }; + }; + } + ''; + description = '' + Additional Keycloak configuration options to set in + standalone.xml. + + Options are expressed as a Nix attribute set which matches the + structure of the jboss-cli configuration. The configuration is + effectively overlayed on top of the default configuration + shipped with Keycloak. To remove existing nodes and undefine + attributes from the default configuration, set them to + null. + + The example configuration does the equivalent of the following + script, which removes the hostname provider + default, adds the deprecated hostname + provider fixed and defines it the default: + + + /subsystem=keycloak-server/spi=hostname/provider=default:remove() + /subsystem=keycloak-server/spi=hostname/provider=fixed:add(enabled = true, properties = { hostname = "keycloak.example.com" }) + /subsystem=keycloak-server/spi=hostname:write-attribute(name=default-provider, value="fixed") + + + You can discover available options by using the jboss-cli.sh + program and by referring to the Keycloak + Server Installation and Configuration Guide. + ''; + }; - You can discover available options by using the jboss-cli.sh - program and by referring to the Keycloak - Server Installation and Configuration Guide. - ''; }; - }; - config = let # We only want to create a database if we're actually going to connect to it. @@ -332,10 +345,10 @@ in fi done - ${lib.concatStringsSep "\n" (lib.mapAttrsToList (name: theme: "linkTheme ${theme} ${lib.escapeShellArg name}") cfg.themes)} + ${concatStringsSep "\n" (mapAttrsToList (name: theme: "linkTheme ${theme} ${escapeShellArg name}") cfg.themes)} ''; - keycloakConfig' = builtins.foldl' lib.recursiveUpdate { + keycloakConfig' = foldl' recursiveUpdate { "interface=public".inet-address = cfg.bindAddress; "socket-binding-group=standard-sockets"."socket-binding=http".port = cfg.httpPort; "subsystem=keycloak-server" = { @@ -353,7 +366,7 @@ in password = "@db-password@"; }; } [ - (lib.optionalAttrs (cfg.database.type == "postgresql") { + (optionalAttrs (cfg.database.type == "postgresql") { "subsystem=datasources" = { "jdbc-driver=postgresql" = { driver-module-name = "org.postgresql"; @@ -361,16 +374,16 @@ in driver-xa-datasource-class-name = "org.postgresql.xa.PGXADataSource"; }; "data-source=KeycloakDS" = { - connection-url = "jdbc:postgresql://${cfg.database.host}:${builtins.toString cfg.database.port}/keycloak"; + connection-url = "jdbc:postgresql://${cfg.database.host}:${toString cfg.database.port}/keycloak"; driver-name = "postgresql"; - "connection-properties=ssl".value = lib.boolToString cfg.database.useSSL; - } // (lib.optionalAttrs (cfg.database.caCert != null) { + "connection-properties=ssl".value = boolToString cfg.database.useSSL; + } // (optionalAttrs (cfg.database.caCert != null) { "connection-properties=sslrootcert".value = cfg.database.caCert; "connection-properties=sslmode".value = "verify-ca"; }); }; }) - (lib.optionalAttrs (cfg.database.type == "mysql") { + (optionalAttrs (cfg.database.type == "mysql") { "subsystem=datasources" = { "jdbc-driver=mysql" = { driver-module-name = "com.mysql"; @@ -378,38 +391,38 @@ in driver-class-name = "com.mysql.jdbc.Driver"; }; "data-source=KeycloakDS" = { - connection-url = "jdbc:mysql://${cfg.database.host}:${builtins.toString cfg.database.port}/keycloak"; + connection-url = "jdbc:mysql://${cfg.database.host}:${toString cfg.database.port}/keycloak"; driver-name = "mysql"; - "connection-properties=useSSL".value = lib.boolToString cfg.database.useSSL; - "connection-properties=requireSSL".value = lib.boolToString cfg.database.useSSL; - "connection-properties=verifyServerCertificate".value = lib.boolToString cfg.database.useSSL; + "connection-properties=useSSL".value = boolToString cfg.database.useSSL; + "connection-properties=requireSSL".value = boolToString cfg.database.useSSL; + "connection-properties=verifyServerCertificate".value = boolToString cfg.database.useSSL; "connection-properties=characterEncoding".value = "UTF-8"; valid-connection-checker-class-name = "org.jboss.jca.adapters.jdbc.extensions.mysql.MySQLValidConnectionChecker"; validate-on-match = true; exception-sorter-class-name = "org.jboss.jca.adapters.jdbc.extensions.mysql.MySQLExceptionSorter"; - } // (lib.optionalAttrs (cfg.database.caCert != null) { + } // (optionalAttrs (cfg.database.caCert != null) { "connection-properties=trustCertificateKeyStoreUrl".value = "file:${mySqlCaKeystore}"; "connection-properties=trustCertificateKeyStorePassword".value = "notsosecretpassword"; }); }; }) - (lib.optionalAttrs (cfg.sslCertificate != null && cfg.sslCertificateKey != null) { + (optionalAttrs (cfg.sslCertificate != null && cfg.sslCertificateKey != null) { "socket-binding-group=standard-sockets"."socket-binding=https".port = cfg.httpsPort; - "subsystem=elytron" = lib.mkOrder 900 { - "key-store=httpsKS" = lib.mkOrder 900 { + "subsystem=elytron" = mkOrder 900 { + "key-store=httpsKS" = mkOrder 900 { path = "/run/keycloak/ssl/certificate_private_key_bundle.p12"; credential-reference.clear-text = "notsosecretpassword"; type = "JKS"; }; - "key-manager=httpsKM" = lib.mkOrder 901 { + "key-manager=httpsKM" = mkOrder 901 { key-store = "httpsKS"; credential-reference.clear-text = "notsosecretpassword"; }; - "server-ssl-context=httpsSSC" = lib.mkOrder 902 { + "server-ssl-context=httpsSSC" = mkOrder 902 { key-manager = "httpsKM"; }; }; - "subsystem=undertow" = lib.mkOrder 901 { + "subsystem=undertow" = mkOrder 901 { "server=default-server"."https-listener=https".ssl-context = "httpsSSC"; }; }) @@ -500,7 +513,7 @@ in # with `expression` to evaluate. prefixExpression = string: let - matchResult = builtins.match ''"\$\{.*}"'' string; + matchResult = match ''"\$\{.*}"'' string; in if matchResult != null then "expression " + string @@ -509,21 +522,21 @@ in writeAttribute = attribute: value: let - type = builtins.typeOf value; + type = typeOf value; in if type == "set" then let - names = builtins.attrNames value; + names = attrNames value; in - builtins.foldl' (text: name: text + (writeAttribute "${attribute}.${name}" value.${name})) "" names + foldl' (text: name: text + (writeAttribute "${attribute}.${name}" value.${name})) "" names else if value == null then '' if (outcome == success) of ${path}:read-attribute(name="${attribute}") ${path}:undefine-attribute(name="${attribute}") end-if '' - else if builtins.elem type [ "string" "path" "bool" ] then + else if elem type [ "string" "path" "bool" ] then let - value' = if type == "bool" then lib.boolToString value else ''"${value}"''; + value' = if type == "bool" then boolToString value else ''"${value}"''; in '' if (result != ${prefixExpression value'}) of ${path}:read-attribute(name="${attribute}") ${path}:write-attribute(name=${attribute}, value=${value'}) @@ -531,8 +544,8 @@ in '' else throw "Unsupported type '${type}' for path '${path}'!"; in - lib.concatStrings - (lib.mapAttrsToList + concatStrings + (mapAttrsToList (attribute: value: (writeAttribute attribute value)) set); @@ -557,19 +570,19 @@ in let makeArg = attribute: value: let - type = builtins.typeOf value; + type = typeOf value; in if type == "set" then "${attribute} = { " + (makeArgList value) + " }" - else if builtins.elem type [ "string" "path" "bool" ] then - "${attribute} = ${if type == "bool" then lib.boolToString value else ''"${value}"''}" + else if elem type [ "string" "path" "bool" ] then + "${attribute} = ${if type == "bool" then boolToString value else ''"${value}"''}" else if value == null then "" else throw "Unsupported type '${type}' for attribute '${attribute}'!"; in - lib.concatStringsSep ", " (lib.mapAttrsToList makeArg set); + concatStringsSep ", " (mapAttrsToList makeArg set); /* Recurses into the `nodeValue` attrset. Only subattrsets that @@ -579,7 +592,7 @@ in recurse = nodePath: nodeValue: let nodeContent = - if builtins.isAttrs nodeValue && nodeValue._type or "" == "order" then + if isAttrs nodeValue && nodeValue._type or "" == "order" then nodeValue.content else nodeValue; @@ -587,21 +600,21 @@ in let value = nodeContent.${name}; in - if (builtins.match ".*([=]).*" name) == [ "=" ] then - if builtins.isAttrs value || value == null then + if (match ".*([=]).*" name) == [ "=" ] then + if isAttrs value || value == null then true else - throw "Parsing path '${lib.concatStringsSep "." (nodePath ++ [ name ])}' failed: JBoss attributes cannot contain '='!" + throw "Parsing path '${concatStringsSep "." (nodePath ++ [ name ])}' failed: JBoss attributes cannot contain '='!" else false; - jbossPath = "/" + lib.concatStringsSep "/" nodePath; - children = if !builtins.isAttrs nodeContent then {} else nodeContent; - subPaths = builtins.filter isPath (builtins.attrNames children); + jbossPath = "/" + concatStringsSep "/" nodePath; + children = if !isAttrs nodeContent then {} else nodeContent; + subPaths = filter isPath (attrNames children); getPriority = name: let value = children.${name}; in if value._type or "" == "order" then value.priority else 1000; - orderedSubPaths = lib.sort (a: b: getPriority a < getPriority b) subPaths; - jbossAttrs = lib.filterAttrs (name: _: !(isPath name)) children; + orderedSubPaths = sort (a: b: getPriority a < getPriority b) subPaths; + jbossAttrs = filterAttrs (name: _: !(isPath name)) children; text = if nodeContent != null then '' @@ -615,7 +628,7 @@ in ${jbossPath}:remove() end-if ''; - in text + lib.concatMapStringsSep "\n" (name: recurse (nodePath ++ [name]) children.${name}) orderedSubPaths; + in text + concatMapStringsSep "\n" (name: recurse (nodePath ++ [name]) children.${name}) orderedSubPaths; in recurse [] attrs; @@ -652,7 +665,7 @@ in cp configuration/standalone.xml $out ''; in - lib.mkIf cfg.enable { + mkIf cfg.enable { assertions = [ { @@ -663,7 +676,7 @@ in environment.systemPackages = [ cfg.package ]; - systemd.services.keycloakPostgreSQLInit = lib.mkIf createLocalPostgreSQL { + systemd.services.keycloakPostgreSQLInit = mkIf createLocalPostgreSQL { after = [ "postgresql.service" ]; before = [ "keycloak.service" ]; bindsTo = [ "postgresql.service" ]; @@ -687,7 +700,7 @@ in ''; }; - systemd.services.keycloakMySQLInit = lib.mkIf createLocalMySQL { + systemd.services.keycloakMySQLInit = mkIf createLocalMySQL { after = [ "mysql.service" ]; before = [ "keycloak.service" ]; bindsTo = [ "mysql.service" ]; @@ -737,7 +750,7 @@ in serviceConfig = { LoadCredential = [ "db_password:${cfg.database.passwordFile}" - ] ++ lib.optionals (cfg.sslCertificate != null && cfg.sslCertificateKey != null) [ + ] ++ optionals (cfg.sslCertificate != null && cfg.sslCertificateKey != null) [ "ssl_cert:${cfg.sslCertificate}" "ssl_key:${cfg.sslCertificateKey}" ]; @@ -769,7 +782,7 @@ in export JAVA_OPTS=-Djboss.server.config.user.dir=/run/keycloak/configuration add-user-keycloak.sh -u admin -p '${cfg.initialAdminPassword}' - '' + lib.optionalString (cfg.sslCertificate != null && cfg.sslCertificateKey != null) '' + '' + optionalString (cfg.sslCertificate != null && cfg.sslCertificateKey != null) '' pushd /run/keycloak/ssl/ cat "$CREDENTIALS_DIRECTORY/ssl_cert" <(echo) \ "$CREDENTIALS_DIRECTORY/ssl_key" <(echo) \ @@ -784,11 +797,11 @@ in ''; }; - services.postgresql.enable = lib.mkDefault createLocalPostgreSQL; - services.mysql.enable = lib.mkDefault createLocalMySQL; - services.mysql.package = lib.mkIf createLocalMySQL pkgs.mariadb; + services.postgresql.enable = mkDefault createLocalPostgreSQL; + services.mysql.enable = mkDefault createLocalMySQL; + services.mysql.package = mkIf createLocalMySQL pkgs.mariadb; }; meta.doc = ./keycloak.xml; - meta.maintainers = [ lib.maintainers.talyz ]; + meta.maintainers = [ maintainers.talyz ]; } From 95430e31f5af1e68540d2f1076a51bdcb9cd54bd Mon Sep 17 00:00:00 2001 From: talyz Date: Mon, 17 Jan 2022 12:46:02 +0100 Subject: [PATCH 26/49] nixos/keycloak: Reformat the code with nixpkgs-fmt --- nixos/modules/services/web-apps/keycloak.nix | 194 ++++++++++--------- 1 file changed, 102 insertions(+), 92 deletions(-) diff --git a/nixos/modules/services/web-apps/keycloak.nix b/nixos/modules/services/web-apps/keycloak.nix index 436dad383754..a01f0049b2c7 100644 --- a/nixos/modules/services/web-apps/keycloak.nix +++ b/nixos/modules/services/web-apps/keycloak.nix @@ -316,12 +316,12 @@ in createLocalPostgreSQL = databaseActuallyCreateLocally && cfg.database.type == "postgresql"; createLocalMySQL = databaseActuallyCreateLocally && cfg.database.type == "mysql"; - mySqlCaKeystore = pkgs.runCommand "mysql-ca-keystore" {} '' + mySqlCaKeystore = pkgs.runCommand "mysql-ca-keystore" { } '' ${pkgs.jre}/bin/keytool -importcert -trustcacerts -alias MySQLCACert -file ${cfg.database.caCert} -keystore $out -storepass notsosecretpassword -noprompt ''; # Both theme and theme type directories need to be actual directories in one hierarchy to pass Keycloak checks. - themesBundle = pkgs.runCommand "keycloak-themes" {} '' + themesBundle = pkgs.runCommand "keycloak-themes" { } '' linkTheme() { theme="$1" name="$2" @@ -348,24 +348,25 @@ in ${concatStringsSep "\n" (mapAttrsToList (name: theme: "linkTheme ${theme} ${escapeShellArg name}") cfg.themes)} ''; - keycloakConfig' = foldl' recursiveUpdate { - "interface=public".inet-address = cfg.bindAddress; - "socket-binding-group=standard-sockets"."socket-binding=http".port = cfg.httpPort; - "subsystem=keycloak-server" = { - "spi=hostname"."provider=default" = { - enabled = true; - properties = { - inherit (cfg) frontendUrl forceBackendUrlToFrontendUrl; + keycloakConfig' = foldl' recursiveUpdate + { + "interface=public".inet-address = cfg.bindAddress; + "socket-binding-group=standard-sockets"."socket-binding=http".port = cfg.httpPort; + "subsystem=keycloak-server" = { + "spi=hostname"."provider=default" = { + enabled = true; + properties = { + inherit (cfg) frontendUrl forceBackendUrlToFrontendUrl; + }; }; + "theme=defaults".dir = toString themesBundle; }; - "theme=defaults".dir = toString themesBundle; - }; - "subsystem=datasources"."data-source=KeycloakDS" = { - max-pool-size = "20"; - user-name = if databaseActuallyCreateLocally then "keycloak" else cfg.database.username; - password = "@db-password@"; - }; - } [ + "subsystem=datasources"."data-source=KeycloakDS" = { + max-pool-size = "20"; + user-name = if databaseActuallyCreateLocally then "keycloak" else cfg.database.username; + password = "@db-password@"; + }; + } [ (optionalAttrs (cfg.database.type == "postgresql") { "subsystem=datasources" = { "jdbc-driver=postgresql" = { @@ -515,39 +516,40 @@ in let matchResult = match ''"\$\{.*}"'' string; in - if matchResult != null then - "expression " + string - else - string; + if matchResult != null then + "expression " + string + else + string; writeAttribute = attribute: value: let type = typeOf value; in - if type == "set" then - let - names = attrNames value; - in - foldl' (text: name: text + (writeAttribute "${attribute}.${name}" value.${name})) "" names - else if value == null then '' - if (outcome == success) of ${path}:read-attribute(name="${attribute}") - ${path}:undefine-attribute(name="${attribute}") + if type == "set" then + let + names = attrNames value; + in + foldl' (text: name: text + (writeAttribute "${attribute}.${name}" value.${name})) "" names + else if value == null then '' + if (outcome == success) of ${path}:read-attribute(name="${attribute}") + ${path}:undefine-attribute(name="${attribute}") + end-if + '' + else if elem type [ "string" "path" "bool" ] then + let + value' = if type == "bool" then boolToString value else ''"${value}"''; + in + '' + if (result != ${prefixExpression value'}) of ${path}:read-attribute(name="${attribute}") + ${path}:write-attribute(name=${attribute}, value=${value'}) end-if '' - else if elem type [ "string" "path" "bool" ] then - let - value' = if type == "bool" then boolToString value else ''"${value}"''; - in '' - if (result != ${prefixExpression value'}) of ${path}:read-attribute(name="${attribute}") - ${path}:write-attribute(name=${attribute}, value=${value'}) - end-if - '' - else throw "Unsupported type '${type}' for path '${path}'!"; + else throw "Unsupported type '${type}' for path '${path}'!"; in - concatStrings - (mapAttrsToList - (attribute: value: (writeAttribute attribute value)) - set); + concatStrings + (mapAttrsToList + (attribute: value: (writeAttribute attribute value)) + set); /* Produces an argument list for the JBoss `add()` function, @@ -572,17 +574,17 @@ in let type = typeOf value; in - if type == "set" then - "${attribute} = { " + (makeArgList value) + " }" - else if elem type [ "string" "path" "bool" ] then - "${attribute} = ${if type == "bool" then boolToString value else ''"${value}"''}" - else if value == null then - "" - else - throw "Unsupported type '${type}' for attribute '${attribute}'!"; + if type == "set" then + "${attribute} = { " + (makeArgList value) + " }" + else if elem type [ "string" "path" "bool" ] then + "${attribute} = ${if type == "bool" then boolToString value else ''"${value}"''}" + else if value == null then + "" + else + throw "Unsupported type '${type}' for attribute '${attribute}'!"; in - concatStringsSep ", " (mapAttrsToList makeArg set); + concatStringsSep ", " (mapAttrsToList makeArg set); /* Recurses into the `nodeValue` attrset. Only subattrsets that @@ -600,19 +602,21 @@ in let value = nodeContent.${name}; in - if (match ".*([=]).*" name) == [ "=" ] then - if isAttrs value || value == null then - true - else - throw "Parsing path '${concatStringsSep "." (nodePath ++ [ name ])}' failed: JBoss attributes cannot contain '='!" + if (match ".*([=]).*" name) == [ "=" ] then + if isAttrs value || value == null then + true else - false; + throw "Parsing path '${concatStringsSep "." (nodePath ++ [ name ])}' failed: JBoss attributes cannot contain '='!" + else + false; jbossPath = "/" + concatStringsSep "/" nodePath; - children = if !isAttrs nodeContent then {} else nodeContent; + children = if !isAttrs nodeContent then { } else nodeContent; subPaths = filter isPath (attrNames children); getPriority = name: - let value = children.${name}; - in if value._type or "" == "order" then value.priority else 1000; + let + value = children.${name}; + in + if value._type or "" == "order" then value.priority else 1000; orderedSubPaths = sort (a: b: getPriority a < getPriority b) subPaths; jbossAttrs = filterAttrs (name: _: !(isPath name)) children; text = @@ -628,45 +632,48 @@ in ${jbossPath}:remove() end-if ''; - in text + concatMapStringsSep "\n" (name: recurse (nodePath ++ [name]) children.${name}) orderedSubPaths; + in + text + concatMapStringsSep "\n" (name: recurse (nodePath ++ [ name ]) children.${name}) orderedSubPaths; in - recurse [] attrs; + recurse [ ] attrs; jbossCliScript = pkgs.writeText "jboss-cli-script" (mkJbossScript keycloakConfig'); - keycloakConfig = pkgs.runCommand "keycloak-config" { - nativeBuildInputs = [ cfg.package ]; - } '' - export JBOSS_BASE_DIR="$(pwd -P)"; - export JBOSS_MODULEPATH="${cfg.package}/modules"; - export JBOSS_LOG_DIR="$JBOSS_BASE_DIR/log"; + keycloakConfig = pkgs.runCommand "keycloak-config" + { + nativeBuildInputs = [ cfg.package ]; + } + '' + export JBOSS_BASE_DIR="$(pwd -P)"; + export JBOSS_MODULEPATH="${cfg.package}/modules"; + export JBOSS_LOG_DIR="$JBOSS_BASE_DIR/log"; - cp -r ${cfg.package}/standalone/configuration . - chmod -R u+rwX ./configuration + cp -r ${cfg.package}/standalone/configuration . + chmod -R u+rwX ./configuration - mkdir -p {deployments,ssl} + mkdir -p {deployments,ssl} - standalone.sh& + standalone.sh& - attempt=1 - max_attempts=30 - while ! jboss-cli.sh --connect ':read-attribute(name=server-state)'; do - if [[ "$attempt" == "$max_attempts" ]]; then - echo "ERROR: Could not connect to Keycloak after $attempt attempts! Failing.." >&2 - exit 1 - fi - echo "Keycloak not fully started yet, retrying.. ($attempt/$max_attempts)" - sleep 1 - (( attempt++ )) - done + attempt=1 + max_attempts=30 + while ! jboss-cli.sh --connect ':read-attribute(name=server-state)'; do + if [[ "$attempt" == "$max_attempts" ]]; then + echo "ERROR: Could not connect to Keycloak after $attempt attempts! Failing.." >&2 + exit 1 + fi + echo "Keycloak not fully started yet, retrying.. ($attempt/$max_attempts)" + sleep 1 + (( attempt++ )) + done - jboss-cli.sh --connect --file=${jbossCliScript} --echo-command + jboss-cli.sh --connect --file=${jbossCliScript} --echo-command - cp configuration/standalone.xml $out - ''; + cp configuration/standalone.xml $out + ''; in - mkIf cfg.enable { - + mkIf cfg.enable + { assertions = [ { assertion = (cfg.database.useSSL && cfg.database.type == "postgresql") -> (cfg.database.caCert != null); @@ -727,13 +734,16 @@ in let databaseServices = if createLocalPostgreSQL then [ - "keycloakPostgreSQLInit.service" "postgresql.service" + "keycloakPostgreSQLInit.service" + "postgresql.service" ] else if createLocalMySQL then [ - "keycloakMySQLInit.service" "mysql.service" + "keycloakMySQLInit.service" + "mysql.service" ] else [ ]; - in { + in + { after = databaseServices; bindsTo = databaseServices; wantedBy = [ "multi-user.target" ]; From e2d1f6aabfef4c8009d01ad39b7e6235a364c37f Mon Sep 17 00:00:00 2001 From: bezmuth Date: Mon, 17 Jan 2022 20:50:58 +0000 Subject: [PATCH 27/49] rizin: 0.3.2 -> 0.3.4 --- pkgs/development/tools/analysis/rizin/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/tools/analysis/rizin/default.nix b/pkgs/development/tools/analysis/rizin/default.nix index c316ef970f88..c4cdf85a7d8a 100644 --- a/pkgs/development/tools/analysis/rizin/default.nix +++ b/pkgs/development/tools/analysis/rizin/default.nix @@ -23,11 +23,11 @@ stdenv.mkDerivation rec { pname = "rizin"; - version = "0.3.2"; + version = "0.3.4"; src = fetchurl { url = "https://github.com/rizinorg/rizin/releases/download/v${version}/rizin-src-v${version}.tar.xz"; - sha256 = "sha256-T65gm1tfRD7dZSL8qZKMTAbQ65Lx/ecidFc9T1b7cig="; + sha256 = "sha256-7qSbOWOHwJ0ZcFqrAqYXzbFWgvymfxAf8rJ+75SnEOk="; }; mesonFlags = [ From ba989d87fe1fb98500722a32a2c6af20ef2e4983 Mon Sep 17 00:00:00 2001 From: bezmuth Date: Mon, 17 Jan 2022 20:52:39 +0000 Subject: [PATCH 28/49] cutter: 2.0.4 -> 2.0.5 --- pkgs/development/tools/analysis/rizin/cutter.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/tools/analysis/rizin/cutter.nix b/pkgs/development/tools/analysis/rizin/cutter.nix index 698f9e8231d0..a6ac4fbce12f 100644 --- a/pkgs/development/tools/analysis/rizin/cutter.nix +++ b/pkgs/development/tools/analysis/rizin/cutter.nix @@ -11,13 +11,13 @@ mkDerivation rec { pname = "cutter"; - version = "2.0.4"; + version = "2.0.5"; src = fetchFromGitHub { owner = "rizinorg"; repo = "cutter"; rev = "v${version}"; - sha256 = "sha256-Z5mqLkeA7AZnvKdpdRzaYfNMsGUI7i7wPTXVyIRYwxI="; + sha256 = "sha256-ljws9S7ZxZK/Ou8jgGSoR++vtzFTEBywHMhCC/UOLEs="; fetchSubmodules = true; }; From 0a85191a3ba37c8c8be5dbd447dca186bc464e28 Mon Sep 17 00:00:00 2001 From: "florian on nixos (Florian Brandes)" Date: Mon, 17 Jan 2022 21:59:14 +0100 Subject: [PATCH 29/49] python3Packages.sentinels: init at 1.0.0 --- .../python-modules/sentinels/default.nix | 36 +++++++++++++++++++ pkgs/top-level/python-packages.nix | 2 ++ 2 files changed, 38 insertions(+) create mode 100644 pkgs/development/python-modules/sentinels/default.nix diff --git a/pkgs/development/python-modules/sentinels/default.nix b/pkgs/development/python-modules/sentinels/default.nix new file mode 100644 index 000000000000..17c2c94a30ff --- /dev/null +++ b/pkgs/development/python-modules/sentinels/default.nix @@ -0,0 +1,36 @@ +{ lib +, buildPythonPackage +, pythonOlder +, fetchPypi +, setuptools +, pytestCheckHook +}: + +buildPythonPackage rec { + pname = "sentinels"; + version = "1.0.0"; + + disabled = pythonOlder "3.5"; + + src = fetchPypi { + inherit pname version; + sha256 = "1cglkxph47pki4db4kjx5g4ikxp2milqdlcjgqwmx4p1gx6p1q3v"; + }; + + propagatedBuildInputs = [ + setuptools + ]; + + checkInputs = [ + pytestCheckHook + ]; + + pythonImportsCheck = [ "sentinels" ]; + + meta = with lib; { + homepage = "https://github.com/vmalloc/sentinels/"; + description = "Various objects to denote special meanings in python"; + license = licenses.bsd3; + maintainers = with maintainers; [ gador ]; + }; +} diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix index 7bfe838ab082..08479a0cdd99 100644 --- a/pkgs/top-level/python-packages.nix +++ b/pkgs/top-level/python-packages.nix @@ -8819,6 +8819,8 @@ in { sentinel = callPackage ../development/python-modules/sentinel { }; + sentinels = callPackage ../development/python-modules/sentinels { }; + sentry-sdk = callPackage ../development/python-modules/sentry-sdk { }; sepaxml = callPackage ../development/python-modules/sepaxml { }; From ff788f18b64ed0bbcac0c89fc5b31374d1b8ed22 Mon Sep 17 00:00:00 2001 From: Fabian Affolter Date: Tue, 18 Jan 2022 09:57:08 +0100 Subject: [PATCH 30/49] checkov: 2.0.712 -> 2.0.727 --- pkgs/development/tools/analysis/checkov/default.nix | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/pkgs/development/tools/analysis/checkov/default.nix b/pkgs/development/tools/analysis/checkov/default.nix index 3ddde0c282f9..1a4b29671875 100644 --- a/pkgs/development/tools/analysis/checkov/default.nix +++ b/pkgs/development/tools/analysis/checkov/default.nix @@ -22,13 +22,13 @@ with py.pkgs; buildPythonApplication rec { pname = "checkov"; - version = "2.0.712"; + version = "2.0.727"; src = fetchFromGitHub { owner = "bridgecrewio"; repo = pname; rev = version; - hash = "sha256-iUplSd4/OcJtfby2bn7b6GwCbXnBMqUSuLjkkh+7W9Y="; + hash = "sha256-hegbkmM8ZN6zO2iANGRr2QRW3ErdtwYaTo618uELev0="; }; nativeBuildInputs = with py.pkgs; [ @@ -81,6 +81,7 @@ buildPythonApplication rec { postPatch = '' substituteInPlace setup.py \ + --replace "cyclonedx-python-lib>=0.11.0,<1.0.0" "cyclonedx-python-lib>=0.11.0" \ --replace "jsonschema==3.0.2" "jsonschema>=3.0.2" ''; From 4396e4f65889ed0a85b24183240f06cd53f3801c Mon Sep 17 00:00:00 2001 From: "florian on nixos (Florian Brandes)" Date: Sun, 16 Jan 2022 11:44:49 +0100 Subject: [PATCH 31/49] python3Packages.flask-paranoid: init at 0.2 needed for pgadmin4 init https://github.com/NixOS/nixpkgs/pull/154764 --- .../python-modules/flask-paranoid/default.nix | 40 +++++++++++++++++++ pkgs/top-level/python-packages.nix | 2 + 2 files changed, 42 insertions(+) create mode 100644 pkgs/development/python-modules/flask-paranoid/default.nix diff --git a/pkgs/development/python-modules/flask-paranoid/default.nix b/pkgs/development/python-modules/flask-paranoid/default.nix new file mode 100644 index 000000000000..787b34a93b37 --- /dev/null +++ b/pkgs/development/python-modules/flask-paranoid/default.nix @@ -0,0 +1,40 @@ +{ lib +, buildPythonPackage +, fetchFromGitHub +, flask +, pytestCheckHook +}: + +buildPythonPackage rec { + pname = "flask-paranoid"; + version = "0.2"; + + src = fetchFromGitHub { + owner = "miguelgrinberg"; + repo = pname; + rev = "v${version}"; + sha256 = "0WWc/ktAOuTk4A75xI1jCj/aef2+1TjLKBA9+PRfJO0="; + }; + + postPatch = '' + # tests have a typo in one of the assertions + substituteInPlace tests/test_paranoid.py --replace "01-Jan-1970" "01 Jan 1970" + ''; + + propagatedBuildInputs = [ + flask + ]; + + checkInputs = [ + pytestCheckHook + ]; + + pythonImportsCheck = [ "flask_paranoid" ]; + + meta = with lib; { + homepage = "https://github.com/miguelgrinberg/flask-paranoid/"; + description = "Simple user session protection"; + license = licenses.mit; + maintainers = with maintainers; [ gador ]; + }; +} diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix index e02cdeee1b4f..2c89637c7146 100644 --- a/pkgs/top-level/python-packages.nix +++ b/pkgs/top-level/python-packages.nix @@ -2908,6 +2908,8 @@ in { flask-paginate = callPackage ../development/python-modules/flask-paginate { }; + flask-paranoid = callPackage ../development/python-modules/flask-paranoid { }; + flask_principal = callPackage ../development/python-modules/flask-principal { }; flask-pymongo = callPackage ../development/python-modules/Flask-PyMongo { }; From 24df24be7306e75162adce0a70e8dc70cef44f94 Mon Sep 17 00:00:00 2001 From: "florian on nixos (Florian Brandes)" Date: Sun, 16 Jan 2022 11:57:16 +0100 Subject: [PATCH 32/49] python3Packages.speaklater3: init at 1.4 needed for pgadmin4 init https://github.com/NixOS/nixpkgs/pull/154764 --- .../python-modules/speaklater3/default.nix | 23 +++++++++++++++++++ pkgs/top-level/python-packages.nix | 2 ++ 2 files changed, 25 insertions(+) create mode 100644 pkgs/development/python-modules/speaklater3/default.nix diff --git a/pkgs/development/python-modules/speaklater3/default.nix b/pkgs/development/python-modules/speaklater3/default.nix new file mode 100644 index 000000000000..60c4c99fd3a2 --- /dev/null +++ b/pkgs/development/python-modules/speaklater3/default.nix @@ -0,0 +1,23 @@ +{ lib +, buildPythonPackage +, fetchPypi +}: + +buildPythonPackage rec { + pname = "speaklater3"; + version = "1.4"; + + src = fetchPypi { + inherit pname version; + sha256 = "ySYdS2taMEZyMS0esImb4Cj6yRdgGQqA/szTHTo7UEI="; + }; + + pythonImportsCheck = [ "speaklater" ]; + + meta = with lib; { + description = "Implements a lazy string for python useful for use with gettext"; + homepage = "https://github.com/mitsuhiko/speaklater"; + license = licenses.bsd0; + maintainers = with maintainers; [ gador ]; + }; +} diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix index e02cdeee1b4f..e89e872fef7c 100644 --- a/pkgs/top-level/python-packages.nix +++ b/pkgs/top-level/python-packages.nix @@ -9156,6 +9156,8 @@ in { speaklater = callPackage ../development/python-modules/speaklater { }; + speaklater3 = callPackage ../development/python-modules/speaklater3 { }; + spectral-cube = callPackage ../development/python-modules/spectral-cube { }; speedtest-cli = callPackage ../development/python-modules/speedtest-cli { }; From bc53afc5744166078f76875a2e162e3395bff040 Mon Sep 17 00:00:00 2001 From: "florian on nixos (Florian Brandes)" Date: Sun, 16 Jan 2022 14:45:52 +0100 Subject: [PATCH 33/49] python3Packages.httpagentparser: init at 1.9.1 --- .../httpagentparser/default.nix | 26 +++++++++++++++++++ pkgs/top-level/python-packages.nix | 2 ++ 2 files changed, 28 insertions(+) create mode 100644 pkgs/development/python-modules/httpagentparser/default.nix diff --git a/pkgs/development/python-modules/httpagentparser/default.nix b/pkgs/development/python-modules/httpagentparser/default.nix new file mode 100644 index 000000000000..e0c9dd09bcba --- /dev/null +++ b/pkgs/development/python-modules/httpagentparser/default.nix @@ -0,0 +1,26 @@ +{ lib +, buildPythonPackage +, fetchPypi +}: + +buildPythonPackage rec { + pname = "httpagentparser"; + version = "1.9.1"; + + src = fetchPypi { + inherit pname version; + sha256 = "73Y9MZk912GCWs7myLNL4yuVzxZ10cc8PNNfnlKDGyY="; + }; + + # PyPi version does not include test directory + doCheck = false; + + pythonImportsCheck = [ "httpagentparser" ]; + + meta = with lib; { + homepage = "https://github.com/shon/httpagentparser"; + description = "Extracts OS Browser etc information from http user agent string"; + license = licenses.mit; + maintainers = with maintainers; [ gador ]; + }; +} diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix index e02cdeee1b4f..1c9bbefc94bc 100644 --- a/pkgs/top-level/python-packages.nix +++ b/pkgs/top-level/python-packages.nix @@ -3731,6 +3731,8 @@ in { httmock = callPackage ../development/python-modules/httmock { }; + httpagentparser = callPackage ../development/python-modules/httpagentparser { }; + httpauth = callPackage ../development/python-modules/httpauth { }; httpbin = callPackage ../development/python-modules/httpbin { }; From c6a18b488ca0a5805fd67aebdcf526cb82fffdf3 Mon Sep 17 00:00:00 2001 From: "florian on nixos (Florian Brandes)" Date: Sun, 16 Jan 2022 11:39:11 +0100 Subject: [PATCH 34/49] python3Packages.flask-gravatar: init at 0.5.0 needed for pgadmin4 init https://github.com/NixOS/nixpkgs/pull/154764 --- .../python-modules/flask-gravatar/default.nix | 48 +++++++++++++++++++ pkgs/top-level/python-packages.nix | 2 + 2 files changed, 50 insertions(+) create mode 100644 pkgs/development/python-modules/flask-gravatar/default.nix diff --git a/pkgs/development/python-modules/flask-gravatar/default.nix b/pkgs/development/python-modules/flask-gravatar/default.nix new file mode 100644 index 000000000000..8d56c1238acf --- /dev/null +++ b/pkgs/development/python-modules/flask-gravatar/default.nix @@ -0,0 +1,48 @@ +{ lib +, buildPythonPackage +, fetchPypi +, flask +, pytestCheckHook +, pygments +}: + +buildPythonPackage rec { + pname = "flask-gravatar"; + version = "0.5.0"; + + src = fetchPypi { + pname = "Flask-Gravatar"; + inherit version; + sha256 = "YGZfMcLGEokdto/4Aek+06CIHGyOw0arxk0qmSP1YuE="; + }; + + + postPatch = '' + sed -i setup.py \ + -e "s|tests_require=tests_require,||g" \ + -e "s|extras_require=extras_require,||g" \ + -e "s|setup_requires=setup_requires,||g" + # pep8 is deprecated and cov not needed + substituteInPlace pytest.ini \ + --replace "--pep8" "" \ + --replace "--cov=flask_gravatar --cov-report=term-missing" "" + ''; + + propagatedBuildInputs = [ + flask + ]; + + checkInputs = [ + pytestCheckHook + pygments + ]; + + pythonImportsCheck = [ "flask_gravatar" ]; + + meta = with lib; { + homepage = "https://github.com/zzzsochi/Flask-Gravatar"; + description = "Small and simple integration of gravatar into flask"; + license = licenses.bsd3; + maintainers = with maintainers; [ gador ]; + }; +} diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix index e02cdeee1b4f..a8aa13dceb8d 100644 --- a/pkgs/top-level/python-packages.nix +++ b/pkgs/top-level/python-packages.nix @@ -2888,6 +2888,8 @@ in { flask_elastic = callPackage ../development/python-modules/flask-elastic { }; + flask-gravatar = callPackage ../development/python-modules/flask-gravatar { }; + flask-httpauth = callPackage ../development/python-modules/flask-httpauth { }; flask-jwt-extended = callPackage ../development/python-modules/flask-jwt-extended { }; From d6a6139d650784f602a5a0c1c5b2a9547ee72de7 Mon Sep 17 00:00:00 2001 From: be7a Date: Tue, 18 Jan 2022 14:39:40 +0100 Subject: [PATCH 35/49] pferd: 3.2.0 -> 3.3.1 --- pkgs/tools/misc/pferd/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/tools/misc/pferd/default.nix b/pkgs/tools/misc/pferd/default.nix index 5c88ea2349f7..76df2a688273 100644 --- a/pkgs/tools/misc/pferd/default.nix +++ b/pkgs/tools/misc/pferd/default.nix @@ -5,14 +5,14 @@ python3Packages.buildPythonApplication rec { pname = "pferd"; - version = "3.2.0"; + version = "3.3.1"; format = "pyproject"; src = fetchFromGitHub { owner = "Garmelon"; repo = "PFERD"; rev = "v${version}"; - sha256 = "0r75a128r8ghrccc1flmpxblfrab5kg6fypzrlfmv2aqhkqg1brb"; + sha256 = "162s966kmpngmp0h55x185qxsy96q2kxz2dd8w0zyh0n2hbap3lh"; }; propagatedBuildInputs = with python3Packages; [ From af080751af5752982a6adb43161a6e392d2da9eb Mon Sep 17 00:00:00 2001 From: Sumner Evans Date: Tue, 18 Jan 2022 07:42:20 -0700 Subject: [PATCH 36/49] matrix_common: init at 1.0.0 New required dependency for matrix-synapse --- .../python-modules/matrix-common/default.nix | 27 +++++++++++++++++++ pkgs/top-level/python-packages.nix | 2 ++ 2 files changed, 29 insertions(+) create mode 100644 pkgs/development/python-modules/matrix-common/default.nix diff --git a/pkgs/development/python-modules/matrix-common/default.nix b/pkgs/development/python-modules/matrix-common/default.nix new file mode 100644 index 000000000000..44d37b988a7d --- /dev/null +++ b/pkgs/development/python-modules/matrix-common/default.nix @@ -0,0 +1,27 @@ +{ stdenv +, lib +, buildPythonPackage +, fetchPypi +, attrs +}: + +buildPythonPackage rec { + pname = "matrix_common"; + version = "1.0.0"; + format = "pyproject"; + + src = fetchPypi { + inherit pname version; + sha256 = "sha256-ZmiKRoJ8hv1USuJBDzV2U1uIFt2lRxmT+iAOqOShJK4="; + }; + + propagatedBuildInputs = [ attrs ]; + pythonImportsCheck = [ "matrix_common" ]; + + meta = with lib; { + description = "Common utilities for Synapse, Sydent and Sygnal"; + homepage = "https://github.com/matrix-org/matrix-python-common"; + license = licenses.asl20; + maintainers = with maintainers; [ sumnerevans ]; + }; +} diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix index 8af4c25e4dff..01e5d608e64f 100644 --- a/pkgs/top-level/python-packages.nix +++ b/pkgs/top-level/python-packages.nix @@ -4873,6 +4873,8 @@ in { matrix-client = callPackage ../development/python-modules/matrix-client { }; + matrix-common = callPackage ../development/python-modules/matrix-common { }; + matrix-nio = callPackage ../development/python-modules/matrix-nio { }; mattermostdriver = callPackage ../development/python-modules/mattermostdriver { }; From ae7e8b427e6b807d32fade6034f3122e86d49ed3 Mon Sep 17 00:00:00 2001 From: Sumner Evans Date: Tue, 18 Jan 2022 07:42:33 -0700 Subject: [PATCH 37/49] matrix-synapse: 1.49.2 -> 1.50.1 --- pkgs/servers/matrix-synapse/default.nix | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/pkgs/servers/matrix-synapse/default.nix b/pkgs/servers/matrix-synapse/default.nix index dbb6fbc84f50..e8a887fa93c1 100644 --- a/pkgs/servers/matrix-synapse/default.nix +++ b/pkgs/servers/matrix-synapse/default.nix @@ -11,11 +11,11 @@ in with python3.pkgs; buildPythonApplication rec { pname = "matrix-synapse"; - version = "1.49.2"; + version = "1.50.1"; src = fetchPypi { inherit pname version; - sha256 = "7b795ecfc36e3f57eb7cffbc5ef9da1745b777536416c31509b3e6220c39ca4d"; + sha256 = "sha256-fdO+HJ1+fk+s65jLkPDiG+Ei89x5Fbkh9BUUFQ3NJ3M="; }; buildInputs = [ openssl ]; @@ -31,6 +31,7 @@ buildPythonApplication rec { jinja2 jsonschema lxml + matrix-common msgpack netaddr phonenumbers From 88a4c4c46618c280dd0c9d0da4b2b3f199af70e8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= Date: Tue, 18 Jan 2022 19:02:23 +0100 Subject: [PATCH 38/49] mdcat: 0.25.0 -> 0.25.1 --- pkgs/tools/text/mdcat/default.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/tools/text/mdcat/default.nix b/pkgs/tools/text/mdcat/default.nix index 6cdd90f2be3d..fdf05fe20011 100644 --- a/pkgs/tools/text/mdcat/default.nix +++ b/pkgs/tools/text/mdcat/default.nix @@ -12,20 +12,20 @@ rustPlatform.buildRustPackage rec { pname = "mdcat"; - version = "0.25.0"; + version = "0.25.1"; src = fetchFromGitHub { owner = "lunaryorn"; repo = pname; rev = "mdcat-${version}"; - sha256 = "sha256-wrtvVFOSqpNBWLRGPL+08WBS4ltQyZwRE3/dqqT6IXg="; + sha256 = "sha256-deG2VjyjFs0LFeTXfPYy3zzjj0rpVjxE0DhkpD5PzSQ="; }; nativeBuildInputs = [ pkg-config asciidoctor installShellFiles ]; buildInputs = [ openssl ] ++ lib.optional stdenv.isDarwin Security; - cargoSha256 = "sha256-9I6/lt5VXfZp2/W6EoXtagcNj2kfxB5ZT2GkWgsUyM8="; + cargoSha256 = "sha256-bPGSdXooBZMye3yj00f3rWIiW4wfg2B4meH44hpkXTY="; checkInputs = [ ansi2html ]; # Skip tests that use the network and that include files. From ba7c4fa91dbfb59f5c65e8ed0186fea4e6471ac2 Mon Sep 17 00:00:00 2001 From: evils <30512529+evils@users.noreply.github.com> Date: Tue, 18 Jan 2022 19:06:30 +0100 Subject: [PATCH 39/49] kicad: enable i18n by default (#155065) without i18n /nix/store/xgs0n52djlqqmw6qlvg6j2jxpzdpsi92-kicad-6.0.1 7269408096 /nix/store/k7ra3zkx6mp0b3ivsf0ba14mbinwws0w-kicad-unstable-33a4c9b08e 7277796352 with i18n /nix/store/2xh82r2znqipky0sny49h9cs5fbhmh4v-kicad-6.0.1 7286672288 /nix/store/532r1f3j8xjki8g87400n0gnd594pcbm-kicad-unstable-33a4c9b08e 7294795424 --- pkgs/applications/science/electronics/kicad/default.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkgs/applications/science/electronics/kicad/default.nix b/pkgs/applications/science/electronics/kicad/default.nix index 44a538370dae..95e88ff14071 100644 --- a/pkgs/applications/science/electronics/kicad/default.nix +++ b/pkgs/applications/science/electronics/kicad/default.nix @@ -22,7 +22,7 @@ , sanitizeAddress ? false , sanitizeThreads ? false , with3d ? true -, withI18n ? false +, withI18n ? true , withPCM ? true # Plugin and Content Manager , srcs ? { } }: From aad4d13f529e01942dbe9891c3b10d2d2e6e7615 Mon Sep 17 00:00:00 2001 From: Sandro Date: Tue, 18 Jan 2022 19:21:47 +0100 Subject: [PATCH 40/49] Update pkgs/development/python-modules/flask-gravatar/default.nix --- pkgs/development/python-modules/flask-gravatar/default.nix | 1 - 1 file changed, 1 deletion(-) diff --git a/pkgs/development/python-modules/flask-gravatar/default.nix b/pkgs/development/python-modules/flask-gravatar/default.nix index 8d56c1238acf..c0bbf7d01467 100644 --- a/pkgs/development/python-modules/flask-gravatar/default.nix +++ b/pkgs/development/python-modules/flask-gravatar/default.nix @@ -16,7 +16,6 @@ buildPythonPackage rec { sha256 = "YGZfMcLGEokdto/4Aek+06CIHGyOw0arxk0qmSP1YuE="; }; - postPatch = '' sed -i setup.py \ -e "s|tests_require=tests_require,||g" \ From e1fb4063999293bd953331999160e906dac285c3 Mon Sep 17 00:00:00 2001 From: "florian on nixos (Florian Brandes)" Date: Mon, 17 Jan 2022 22:05:15 +0100 Subject: [PATCH 41/49] python3Packages.mongomock: init at 3.23.0 --- .../python-modules/mongomock/default.nix | 40 +++++++++++++++++++ pkgs/top-level/python-packages.nix | 2 + 2 files changed, 42 insertions(+) create mode 100644 pkgs/development/python-modules/mongomock/default.nix diff --git a/pkgs/development/python-modules/mongomock/default.nix b/pkgs/development/python-modules/mongomock/default.nix new file mode 100644 index 000000000000..0f2f305c97c3 --- /dev/null +++ b/pkgs/development/python-modules/mongomock/default.nix @@ -0,0 +1,40 @@ +{ lib +, buildPythonPackage +, fetchPypi +, pbr +, sentinels +, six +, pytestCheckHook +}: + +buildPythonPackage rec { + pname = "mongomock"; + version = "3.23.0"; + + src = fetchPypi { + inherit pname version; + sha256 = "1pdh4pj5n6dsaqy98q40wig5y6imfs1p043cgkaaw8f2hxy5x56r"; + }; + + nativeBuildInputs = [ + pbr + ]; + + propagatedBuildInputs = [ + sentinels + six + ]; + + checkInputs = [ + pytestCheckHook + ]; + + pythonImportsCheck = [ "mongomock" ]; + + meta = with lib; { + homepage = "https://github.com/mongomock/mongomock"; + description = "Fake pymongo stub for testing simple MongoDB-dependent code"; + license = licenses.bsd3; + maintainers = with maintainers; [ gador ]; + }; +} diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix index e02cdeee1b4f..feaa9c53aef5 100644 --- a/pkgs/top-level/python-packages.nix +++ b/pkgs/top-level/python-packages.nix @@ -5062,6 +5062,8 @@ in { mohawk = callPackage ../development/python-modules/mohawk { }; + mongomock = callPackage ../development/python-modules/mongomock { }; + mongodict = callPackage ../development/python-modules/mongodict { }; mongoengine = callPackage ../development/python-modules/mongoengine { }; From 6f7bf7bc46de41bce75b1c4c6b684907943d4bb8 Mon Sep 17 00:00:00 2001 From: bb2020 Date: Wed, 2 Jun 2021 16:02:12 +0300 Subject: [PATCH 42/49] nixos/mbpfan: set aggressive default values --- nixos/modules/services/misc/mbpfan.nix | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/nixos/modules/services/misc/mbpfan.nix b/nixos/modules/services/misc/mbpfan.nix index d80b6fafc2cf..8af531b73d78 100644 --- a/nixos/modules/services/misc/mbpfan.nix +++ b/nixos/modules/services/misc/mbpfan.nix @@ -29,7 +29,7 @@ in { maxFanSpeed = mkOption { type = types.int; - default = 6200; + default = 6199; description = '' The maximum fan speed. ''; @@ -37,7 +37,7 @@ in { lowTemp = mkOption { type = types.int; - default = 63; + default = 55; description = '' The low temperature. ''; @@ -45,7 +45,7 @@ in { highTemp = mkOption { type = types.int; - default = 66; + default = 58; description = '' The high temperature. ''; @@ -61,7 +61,7 @@ in { pollingInterval = mkOption { type = types.int; - default = 7; + default = 1; description = '' The polling interval. ''; @@ -82,8 +82,8 @@ in { environment = { etc."mbpfan.conf".text = '' [general] - min_fan_speed = ${toString cfg.minFanSpeed} - max_fan_speed = ${toString cfg.maxFanSpeed} + min_fan1_speed = ${toString cfg.minFanSpeed} + max_fan1_speed = ${toString cfg.maxFanSpeed} low_temp = ${toString cfg.lowTemp} high_temp = ${toString cfg.highTemp} max_temp = ${toString cfg.maxTemp} From d3a146c2ec9c1dae66d11d1cd45052e5a9fde9c5 Mon Sep 17 00:00:00 2001 From: Tobias Bora Date: Tue, 18 Jan 2022 19:30:50 +0100 Subject: [PATCH 43/49] bespokesynth: 1.0 -> 1.1.0. Fixing issues with file loading (#144708) Co-authored-by: OPNA2608 --- .../audio/bespokesynth/default.nix | 190 ++++++++++-------- pkgs/top-level/all-packages.nix | 8 +- 2 files changed, 116 insertions(+), 82 deletions(-) diff --git a/pkgs/applications/audio/bespokesynth/default.nix b/pkgs/applications/audio/bespokesynth/default.nix index e8d2ada38783..a5ef585969e6 100644 --- a/pkgs/applications/audio/bespokesynth/default.nix +++ b/pkgs/applications/audio/bespokesynth/default.nix @@ -1,40 +1,46 @@ -{ lib, stdenv, fetchFromGitHub, pkg-config, fetchzip -, libjack2, alsa-lib, freetype, libX11, libXrandr, libXinerama, libXext, libXcursor -, libGL, python3, ncurses, libusb1 -, gtk3, webkitgtk, curl, xvfb-run, makeWrapper - # "Debug", or "Release" -, buildType ? "Release" +{ lib +, stdenv +, fetchFromGitHub +, fetchzip +, cmake +, pkg-config +, ninja +, makeWrapper +, libjack2 +, alsa-lib +, alsa-tools +, freetype +, libusb1 +, libX11 +, libXrandr +, libXinerama +, libXext +, libXcursor +, libXScrnSaver +, libGL +, libxcb +, xcbutil +, libxkbcommon +, xcbutilkeysyms +, xcb-util-cursor +, gtk3 +, webkitgtk +, python3 +, curl +, pcre +, mount +, gnome +, Cocoa +, WebKit +, CoreServices +, CoreAudioKit + # It is not allowed to distribute binaries with the VST2 SDK plugin without a license + # (the author of Bespoke has such a licence but not Nix). VST3 should work out of the box. + # Read more in https://github.com/NixOS/nixpkgs/issues/145607 +, enableVST2 ? false }: let - projucer = stdenv.mkDerivation rec { - pname = "projucer"; - version = "5.4.7"; - - src = fetchFromGitHub { - owner = "juce-framework"; - repo = "JUCE"; - rev = version; - sha256= "0qpiqfwwpcghk7ij6w4vy9ywr3ryg7ppg77bmd7783kxg6zbhj8h"; - }; - - nativeBuildInputs = [ pkg-config ]; - buildInputs = [ - freetype libX11 libXrandr libXinerama libXext gtk3 webkitgtk - libjack2 curl - ]; - preBuild = '' - cd extras/Projucer/Builds/LinuxMakefile - ''; - makeFlags = [ "CONFIG=${buildType}" ]; - enableParallelBuilding = true; - - installPhase = '' - mkdir -p $out/bin - cp -a build/Projucer $out/bin/Projucer - ''; - }; - # equal to vst-sdk in ../oxefmsynth/default.nix vst-sdk = stdenv.mkDerivation rec { name = "vstsdk3610_11_06_2018_build_37"; @@ -50,70 +56,92 @@ let in stdenv.mkDerivation rec { pname = "bespokesynth"; - version = "1.0.0"; + version = "1.1.0"; src = fetchFromGitHub { - owner = "awwbees"; + owner = "BespokeSynth"; repo = pname; rev = "v${version}"; - sha256 = "04b2m40jszphslkd4850jcb8qwls392lwy3lc6vlj01h4izvapqk"; + sha256 = "sha256-PN0Q6/gI1PeMaF/8EZFGJdLR8JVHQZfWunAhOIQxkHw="; + fetchSubmodules = true; }; - configurePhase = '' - runHook preConfigure + cmakeBuildType = "Release"; - export HOME=$(mktemp -d) - xvfb-run sh -e < Date: Tue, 4 Jan 2022 16:59:34 +0300 Subject: [PATCH 44/49] nixos/mbpfan: convert to structural settings --- .../from_md/release-notes/rl-2205.section.xml | 8 ++ .../manual/release-notes/rl-2205.section.md | 2 + nixos/modules/services/misc/mbpfan.nix | 112 ++++++++---------- 3 files changed, 62 insertions(+), 60 deletions(-) diff --git a/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml b/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml index 59740dff3ff1..34e31b6e505e 100644 --- a/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml +++ b/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml @@ -551,6 +551,14 @@ renamed to linux-firmware. + + + The services.mbpfan module was converted to + a + RFC + 0042 configuration. + + A new module was added for the diff --git a/nixos/doc/manual/release-notes/rl-2205.section.md b/nixos/doc/manual/release-notes/rl-2205.section.md index 85cd8082007b..068984d0e151 100644 --- a/nixos/doc/manual/release-notes/rl-2205.section.md +++ b/nixos/doc/manual/release-notes/rl-2205.section.md @@ -192,6 +192,8 @@ In addition to numerous new and upgraded packages, this release has the followin - The `firmwareLinuxNonfree` package has been renamed to `linux-firmware`. +- The `services.mbpfan` module was converted to a [RFC 0042](https://github.com/NixOS/rfcs/blob/master/rfcs/0042-config-option.md) configuration. + - A new module was added for the [Starship](https://starship.rs/) shell prompt, providing the options `programs.starship.enable` and `programs.starship.settings`. diff --git a/nixos/modules/services/misc/mbpfan.nix b/nixos/modules/services/misc/mbpfan.nix index 8af531b73d78..d2b0f0da2ad9 100644 --- a/nixos/modules/services/misc/mbpfan.nix +++ b/nixos/modules/services/misc/mbpfan.nix @@ -5,6 +5,8 @@ with lib; let cfg = config.services.mbpfan; verbose = if cfg.verbose then "v" else ""; + settingsFormat = pkgs.formats.ini {}; + settingsFile = settingsFormat.generate "config.conf" cfg.settings; in { options.services.mbpfan = { @@ -19,54 +21,6 @@ in { ''; }; - minFanSpeed = mkOption { - type = types.int; - default = 2000; - description = '' - The minimum fan speed. - ''; - }; - - maxFanSpeed = mkOption { - type = types.int; - default = 6199; - description = '' - The maximum fan speed. - ''; - }; - - lowTemp = mkOption { - type = types.int; - default = 55; - description = '' - The low temperature. - ''; - }; - - highTemp = mkOption { - type = types.int; - default = 58; - description = '' - The high temperature. - ''; - }; - - maxTemp = mkOption { - type = types.int; - default = 86; - description = '' - The maximum temperature. - ''; - }; - - pollingInterval = mkOption { - type = types.int; - default = 1; - description = '' - The polling interval. - ''; - }; - verbose = mkOption { type = types.bool; default = false; @@ -74,23 +28,61 @@ in { If true, sets the log level to verbose. ''; }; + + settings = mkOption { + default = {}; + description = "The INI configuration for Mbpfan."; + type = types.submodule { + freeformType = settingsFormat.type; + + options.general.min_fan1_speed = mkOption { + type = types.int; + default = 2000; + description = "The minimum fan speed."; + }; + options.general.max_fan1_speed = mkOption { + type = types.int; + default = 6199; + description = "The maximum fan speed."; + }; + options.general.low_temp = mkOption { + type = types.int; + default = 55; + description = "The low temperature."; + }; + options.general.high_temp = mkOption { + type = types.int; + default = 58; + description = "The high temperature."; + }; + options.general.max_temp = mkOption { + type = types.int; + default = 86; + description = "The maximum temperature."; + }; + options.general.polling_interval = mkOption { + type = types.int; + default = 1; + description = "The polling interval."; + }; + }; + }; }; + imports = [ + (mkRenamedOptionModule [ "services" "mbpfan" "pollingInterval" ] [ "services" "mbpfan" "settings" "general" "polling_interval" ]) + (mkRenamedOptionModule [ "services" "mbpfan" "maxTemp" ] [ "services" "mbpfan" "settings" "general" "max_temp" ]) + (mkRenamedOptionModule [ "services" "mbpfan" "lowTemp" ] [ "services" "mbpfan" "settings" "general" "low_temp" ]) + (mkRenamedOptionModule [ "services" "mbpfan" "highTemp" ] [ "services" "mbpfan" "settings" "general" "high_temp" ]) + (mkRenamedOptionModule [ "services" "mbpfan" "minFanSpeed" ] [ "services" "mbpfan" "settings" "general" "min_fan1_speed" ]) + (mkRenamedOptionModule [ "services" "mbpfan" "maxFanSpeed" ] [ "services" "mbpfan" "settings" "general" "max_fan1_speed" ]) + ]; + config = mkIf cfg.enable { boot.kernelModules = [ "coretemp" "applesmc" ]; - environment = { - etc."mbpfan.conf".text = '' - [general] - min_fan1_speed = ${toString cfg.minFanSpeed} - max_fan1_speed = ${toString cfg.maxFanSpeed} - low_temp = ${toString cfg.lowTemp} - high_temp = ${toString cfg.highTemp} - max_temp = ${toString cfg.maxTemp} - polling_interval = ${toString cfg.pollingInterval} - ''; - systemPackages = [ cfg.package ]; - }; + environment.etc."mbpfan.conf".source = settingsFile; + environment.systemPackages = [ cfg.package ]; systemd.services.mbpfan = { description = "A fan manager daemon for MacBook Pro"; From 95dfbf360c09df1556a312297a7b3605252a2227 Mon Sep 17 00:00:00 2001 From: Emery Hemingway Date: Mon, 17 Jan 2022 14:35:35 +0100 Subject: [PATCH 45/49] nncp: 8.0.2 -> 8.1.0 --- pkgs/tools/misc/nncp/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/tools/misc/nncp/default.nix b/pkgs/tools/misc/nncp/default.nix index 8470837278b0..9024ddb64390 100644 --- a/pkgs/tools/misc/nncp/default.nix +++ b/pkgs/tools/misc/nncp/default.nix @@ -3,12 +3,12 @@ stdenv.mkDerivation rec { pname = "nncp"; - version = "8.0.2"; + version = "8.1.0"; outputs = [ "out" "doc" "info" ]; src = fetchurl { url = "http://www.nncpgo.org/download/${pname}-${version}.tar.xz"; - sha256 = "sha256-hMb7bAdk3xFcUe5CTu9LnIR3VSJDUKbMSE86s8d5udM="; + sha256 = "sha256-d3U233dedtZrBWRdb0QElNOd/L1+Ut4CWvkZo5TPU+w="; }; nativeBuildInputs = [ go redo-apenwarr ]; From 1d1dc7798ded248dfa67f950e7a97c24a8a76964 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= Date: Tue, 18 Jan 2022 19:03:11 +0100 Subject: [PATCH 46/49] tlauncher: remove tlauncher has a shady past (https://github.com/NixOS/nixpkgs/pull/152744#issuecomment-1014125073) offers torrents on their website with cracked games and the discussion in their reddit is primarly around cracked Mincraft versions. This reverts commit ed4ece3f4437749aacdae7e5c7d109dc52489826. --- pkgs/games/tlauncher/default.nix | 100 ------------------------------- pkgs/top-level/aliases.nix | 1 + pkgs/top-level/all-packages.nix | 2 - 3 files changed, 1 insertion(+), 102 deletions(-) delete mode 100644 pkgs/games/tlauncher/default.nix diff --git a/pkgs/games/tlauncher/default.nix b/pkgs/games/tlauncher/default.nix deleted file mode 100644 index 48cfac1f582c..000000000000 --- a/pkgs/games/tlauncher/default.nix +++ /dev/null @@ -1,100 +0,0 @@ -{ lib -, stdenv -, openjdk8 -, buildFHSUserEnv -, fetchzip -, fetchurl -, copyDesktopItems -, makeDesktopItem -}: -let - version = "2.839"; - src = stdenv.mkDerivation { - pname = "tlauncher"; - inherit version; - src = fetchzip { - name = "tlauncher.zip"; - url = "https://dl2.tlauncher.org/f.php?f=files%2FTLauncher-${version}.zip"; - sha256 = "sha256-KphpNuTucpuJhXspKxqDyYQN6vbpY0XCB3GAd5YCGbc="; - stripRoot = false; - }; - installPhase = '' - cp $src/*.jar $out - ''; - }; - fhs = buildFHSUserEnv { - name = "tlauncher"; - runScript = '' - ${openjdk8}/bin/java -jar "${src}" "$@" - ''; - targetPkgs = pkgs: with pkgs; [ - alsa-lib - cpio - cups - file - fontconfig - freetype - giflib - glib - gnome2.GConf - gnome2.gnome_vfs - gtk2 - libjpeg - libGL - openjdk8-bootstrap - perl - which - xorg.libICE - xorg.libX11 - xorg.libXcursor - xorg.libXext - xorg.libXi - xorg.libXinerama - xorg.libXrandr - xorg.xrandr - xorg.libXrender - xorg.libXt - xorg.libXtst - xorg.libXtst - xorg.libXxf86vm - zip - zlib - ]; - }; - desktopItem = makeDesktopItem { - name = "tlauncher"; - exec = "tlauncher"; - icon = fetchurl { - url = "https://styles.redditmedia.com/t5_2o8oax/styles/communityIcon_gu5r5v8eaiq51.png"; - sha256 = "sha256-ma8zxaUxdAw5VYfOK8i8s1kjwMgs80Eomq43Cb0HZWw="; - }; - comment = "Minecraft launcher"; - desktopName = "TLauncher"; - categories = "Game;"; - }; -in stdenv.mkDerivation { - pname = "tlauncher-wrapper"; - inherit version; - - dontUnpack = true; - - installPhase = '' - runHook preInstall - - mkdir $out/{bin,share/applications} -p - install ${fhs}/bin/tlauncher $out/bin - - runHook postInstall - ''; - - nativeBuildInputs = [ copyDesktopItems ]; - desktopItems = [ desktopItem ]; - - meta = with lib; { - description = "Minecraft launcher that already deal with forge, optifine and mods"; - homepage = "https://tlauncher.org/"; - maintainers = with maintainers; [ lucasew ]; - license = licenses.unfree; - platforms = openjdk8.meta.platforms; - }; -} diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix index 0118bd5473bf..e003e62f8ba2 100644 --- a/pkgs/top-level/aliases.nix +++ b/pkgs/top-level/aliases.nix @@ -782,6 +782,7 @@ mapAliases ({ pgtap = postgresqlPackages.pgtap; plv8 = postgresqlPackages.plv8; timescaledb = postgresqlPackages.timescaledb; + tlauncher = throw "tlauncher has been removed because there questionable practices and legality concerns"; tsearch_extras = postgresqlPackages.tsearch_extras; cstore_fdw = postgresqlPackages.cstore_fdw; pg_hll = postgresqlPackages.pg_hll; diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index 1e39d0e6977b..a682ce6a3673 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -30931,8 +30931,6 @@ with pkgs; portmod = callPackage ../games/portmod { }; - tlauncher = callPackage ../games/tlauncher { }; - tr-patcher = callPackage ../games/tr-patcher { }; tes3cmd = callPackage ../games/tes3cmd { }; From 5a82b24bd5ab60a5f69d152880614ac9a1e8a479 Mon Sep 17 00:00:00 2001 From: "florian on nixos (Florian Brandes)" Date: Sun, 16 Jan 2022 11:30:01 +0100 Subject: [PATCH 47/49] python3Packages.flask-security-too: init at 4.1.2 needed for pgadmin4 init https://github.com/NixOS/nixpkgs/pull/154764 --- .../flask-security-too/default.nix | 76 +++++++++++++++++++ pkgs/top-level/python-packages.nix | 2 + 2 files changed, 78 insertions(+) create mode 100644 pkgs/development/python-modules/flask-security-too/default.nix diff --git a/pkgs/development/python-modules/flask-security-too/default.nix b/pkgs/development/python-modules/flask-security-too/default.nix new file mode 100644 index 000000000000..ddf5aa05c493 --- /dev/null +++ b/pkgs/development/python-modules/flask-security-too/default.nix @@ -0,0 +1,76 @@ +{ lib +, buildPythonPackage +, fetchPypi +, flask +, blinker +, setuptools +, itsdangerous +, flask_principal +, passlib +, email_validator +, flask_wtf +, flask_login +, pytestCheckHook +, flask_mail +, sqlalchemy +, flask_sqlalchemy +, flask-mongoengine +, peewee +, pony +, zxcvbn +, mongoengine +, cryptography +, pyqrcode +, phonenumbers +, bleach +, mongomock +}: + +buildPythonPackage rec { + pname = "flask-security-too"; + version = "4.1.2"; + + src = fetchPypi { + pname = "Flask-Security-Too"; + inherit version; + sha256 = "16ws5n08vm7wsa2f7lrkxvc7jl3ah1xfylhhyzb4vvqmlk7x9hw8"; + }; + + propagatedBuildInputs = [ + flask + flask_login + flask_principal + flask_wtf + email_validator + itsdangerous + passlib + blinker + setuptools + ]; + + checkInputs = [ + pytestCheckHook + flask_mail + sqlalchemy + flask_sqlalchemy + flask-mongoengine + peewee + pony + zxcvbn + mongoengine + cryptography + pyqrcode + phonenumbers + bleach + mongomock + ]; + + pythonImportsCheck = [ "flask_security" ]; + + meta = with lib; { + homepage = "https://pypi.org/project/Flask-Security-Too/"; + description = "Simple security for Flask apps (fork)"; + license = licenses.mit; + maintainers = with maintainers; [ gador ]; + }; +} diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix index beff0cddc89e..57f79f1f13c1 100644 --- a/pkgs/top-level/python-packages.nix +++ b/pkgs/top-level/python-packages.nix @@ -2930,6 +2930,8 @@ in { flask-session = callPackage ../development/python-modules/flask-session { }; + flask-security-too = callPackage ../development/python-modules/flask-security-too { }; + flask-silk = callPackage ../development/python-modules/flask-silk { }; flask-socketio = callPackage ../development/python-modules/flask-socketio { }; From ef6f8783ea42565020efaf8d37638849817e09a9 Mon Sep 17 00:00:00 2001 From: Robert Hensing Date: Tue, 18 Jan 2022 15:55:47 +0100 Subject: [PATCH 48/49] nixos/doc/rl-2205.section.md: Hint to avoid merge conflicts --- nixos/doc/manual/release-notes/rl-2205.section.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/nixos/doc/manual/release-notes/rl-2205.section.md b/nixos/doc/manual/release-notes/rl-2205.section.md index 068984d0e151..feac58f05e8b 100644 --- a/nixos/doc/manual/release-notes/rl-2205.section.md +++ b/nixos/doc/manual/release-notes/rl-2205.section.md @@ -53,6 +53,8 @@ In addition to numerous new and upgraded packages, this release has the followin - [rstudio-server](https://www.rstudio.com/products/rstudio/#rstudio-server), a browser-based version of the RStudio IDE for the R programming language. Available as [services.rstudio-server](options.html#opt-services.rstudio-server.enable). + + ## Backward Incompatibilities {#sec-release-22.05-incompatibilities} - `pkgs.ghc` now refers to `pkgs.targetPackages.haskellPackages.ghc`. @@ -130,6 +132,8 @@ In addition to numerous new and upgraded packages, this release has the followin [settings-style](https://github.com/NixOS/rfcs/blob/master/rfcs/0042-config-option.md) configuration. + + ## Other Notable Changes {#sec-release-22.05-notable-changes} - The option [services.redis.servers](#opt-services.redis.servers) was added @@ -207,3 +211,5 @@ In addition to numerous new and upgraded packages, this release has the followin - Renamed option `services.openssh.challengeResponseAuthentication` to `services.openssh.kbdInteractiveAuthentication`. Reason is that the old name has been deprecated upstream. Using the old option name will still work, but produce a warning. + + From 48965506a1ac5b0a08a0224551e8604c323691d1 Mon Sep 17 00:00:00 2001 From: sternenseemann Date: Mon, 17 Jan 2022 19:12:54 +0100 Subject: [PATCH 49/49] lib/asserts: use throw to display message for assertMsg `assert` has the annoying property that it dumps a lot of code at the user without the built in capability to display a nicer message. We have worked around this using `assertMsg` which would *additionally* display a nice message. We can do even better: By using `throw` we can make evaluation fail before assert draws its conclusions and prevent it from displaying the code making up the assert condition, so we get the nicer message of `throw` and the syntactical convenience of `assert`. Before: nix-repl> python.override { reproducibleBuild = true; stripBytecode = false; } trace: Deterministic builds require stripping bytecode. error: assertion (((lib).assertMsg (reproducibleBuild -> stripBytecode)) "Deterministic builds require stripping bytecode.") failed at /home/lukas/src/nix/nixpkgs/pkgs/development/interpreters/python/cpython/2.7/default.nix:45:1 After: nix-repl> python.override { reproducibleBuild = true; stripBytecode = false; } error: Deterministic builds require stripping bytecode. --- lib/asserts.nix | 22 +++++++++---------- .../from_md/release-notes/rl-2205.section.xml | 12 ++++++++++ .../manual/release-notes/rl-2205.section.md | 2 ++ 3 files changed, 24 insertions(+), 12 deletions(-) diff --git a/lib/asserts.nix b/lib/asserts.nix index 8a5f1fb3feb7..9ae357cbc935 100644 --- a/lib/asserts.nix +++ b/lib/asserts.nix @@ -2,35 +2,33 @@ rec { - /* Print a trace message if pred is false. + /* Throw if pred is false, else return pred. Intended to be used to augment asserts with helpful error messages. Example: assertMsg false "nope" - => false - stderr> trace: nope + stderr> error: nope - assert (assertMsg ("foo" == "bar") "foo is not bar, silly"); "" - stderr> trace: foo is not bar, silly - stderr> assert failed at … + assert assertMsg ("foo" == "bar") "foo is not bar, silly"; "" + stderr> error: foo is not bar, silly Type: assertMsg :: Bool -> String -> Bool */ # TODO(Profpatsch): add tests that check stderr assertMsg = pred: msg: - if pred - then true - else builtins.trace msg false; + pred || builtins.throw msg; /* Specialized `assertMsg` for checking if val is one of the elements of a list. Useful for checking enums. Example: - let sslLibrary = "libressl" + let sslLibrary = "libressl"; in assertOneOf "sslLibrary" sslLibrary [ "openssl" "bearssl" ] - => false - stderr> trace: sslLibrary must be one of "openssl", "bearssl", but is: "libressl" + stderr> error: sslLibrary must be one of [ + stderr> "openssl" + stderr> "bearssl" + stderr> ], but is: "libressl" Type: assertOneOf :: String -> ComparableVal -> List ComparableVal -> Bool diff --git a/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml b/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml index 34e31b6e505e..ce45b0d79775 100644 --- a/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml +++ b/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml @@ -408,6 +408,18 @@ configuration. + + + lib.assertMsg and + lib.assertOneOf no longer return + false if the passed condition is + false, throwing the + given error message instead (which makes the resulting error + message less cluttered). This will not impact the behaviour of + code using these functions as intended, namely as top-level + wrapper for assert conditions. + +
diff --git a/nixos/doc/manual/release-notes/rl-2205.section.md b/nixos/doc/manual/release-notes/rl-2205.section.md index feac58f05e8b..25b3ada2c563 100644 --- a/nixos/doc/manual/release-notes/rl-2205.section.md +++ b/nixos/doc/manual/release-notes/rl-2205.section.md @@ -132,6 +132,8 @@ In addition to numerous new and upgraded packages, this release has the followin [settings-style](https://github.com/NixOS/rfcs/blob/master/rfcs/0042-config-option.md) configuration. +- `lib.assertMsg` and `lib.assertOneOf` no longer return `false` if the passed condition is `false`, `throw`ing the given error message instead (which makes the resulting error message less cluttered). This will not impact the behaviour of code using these functions as intended, namely as top-level wrapper for `assert` conditions. + ## Other Notable Changes {#sec-release-22.05-notable-changes}