gador/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge master into staging-next

Browse Source
This commit is contained in:
github-actions[bot]
2023-09-03 00:02:19 +00:00
committed by GitHub
parent 63c9018ce6 3f9e803102
commit 2f3b15cd6f
17 changed files with 736 additions and 276 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkgs/applications/misc/wttrbar/default.nix
+3 -3
View File
@@ -7,18 +7,18 @@
rustPlatform.buildRustPackage rec {
pname = "wttrbar";
version = "0.3.2";
version = "0.4.0";
src = fetchFromGitHub {
owner = "bjesus";
repo = "wttrbar";
rev = version;
hash = "sha256-RQeRDu8x6OQAD7VYT7FwBfj8gxn1nj6hP60oCIiuAgg=";
hash = "sha256-697LoXu6x8ODQa7tG/NqpSqnLJgM765wBFFnKyul7uI=";
};
buildInputs = lib.optionals stdenv.isDarwin [ darwin.apple_sdk_11_0.frameworks.Security ];
cargoHash = "sha256-hJCEA6m/iZuSjWRbbaoJ5ryG0z5U/IWhbEvNAohFyjg=";
cargoHash = "sha256-sxZ4R7QXQSuNFNRuOI/omON6QmQ0DTKQvjHy1BcvXAA=";
meta = {
description = "A simple but detailed weather indicator for Waybar using wttr.in";
pkgs/applications/networking/cloudflared/default.nix
+2 -2
View File
@@ -7,13 +7,13 @@
buildGoModule rec {
pname = "cloudflared";
version = "2023.8.0";
version = "2023.8.2";
src = fetchFromGitHub {
owner = "cloudflare";
repo = "cloudflared";
rev = "refs/tags/${version}";
hash = "sha256-2gBVq7qCOJtSPbE1Yiq7J3roAku1ax+vfZ0SZ8WVHz8=";
hash = "sha256-8khwpGOBSpbAHnKeKFZUrJoE0dgQB3bN6Y/W2gwRfCM=";
};
vendorHash = null;
pkgs/applications/science/math/gretl/default.nix
+33 -13
View File
@@ -1,13 +1,29 @@
{ lib, stdenv, fetchurl, curl, fftw, gmp, gnuplot, gtk3, gtksourceview3, json-glib
, lapack, libxml2, mpfr, openblas, pkg-config, readline }:
{ lib
, stdenv
, fetchurl
, curl
, fftw
, gmp
, gnuplot
, gtk3
, gtksourceview3
, json-glib
, lapack
, libxml2
, mpfr
, openblas
, readline
, Accelerate
, pkg-config
}:
stdenv.mkDerivation rec {
stdenv.mkDerivation (finalAttrs: {
pname = "gretl";
version = "2023a";
version = "2023b";
src = fetchurl {
url = "mirror://sourceforge/gretl/${pname}-${version}.tar.xz";
sha256 = "sha256-T1UwQhw/Tr/juYqVJBkst2LRBCIXPLvVd0N+QCJcVtM=";
url = "mirror://sourceforge/gretl/gretl-${finalAttrs.version}.tar.xz";
hash = "sha256-Hf025JjFxde43TN/1m9PeA1uHqxKTZMI8+1qf3XJLGs=";
};
buildInputs = [
@@ -23,9 +39,13 @@ stdenv.mkDerivation rec {
mpfr
openblas
readline
] ++ lib.optionals stdenv.hostPlatform.isDarwin [
Accelerate
];
nativeBuildInputs = [ pkg-config ];
nativeBuildInputs = [
pkg-config
];
enableParallelBuilding = true;
# Missing install depends:
@@ -33,15 +53,15 @@ stdenv.mkDerivation rec {
# make[1]: *** [Makefile:73: install_datafiles] Error 1
enableParallelInstalling = false;
meta = with lib; {
meta = {
description = "A software package for econometric analysis";
homepage = "https://gretl.sourceforge.net";
license = lib.licenses.gpl3;
longDescription = ''
gretl is a cross-platform software package for econometric analysis,
written in the C programming language.
'';
homepage = "https://gretl.sourceforge.net";
license = licenses.gpl3;
maintainers = with maintainers; [ dmrauh ];
platforms = with platforms; all;
maintainers = with lib.maintainers; [ dmrauh ];
platforms = lib.platforms.all;
};
}
})
pkgs/development/libraries/java/commons/lang/default.nix
+15 -10
View File
@@ -1,26 +1,31 @@
{ lib, stdenv, fetchurl }:
{ lib
, stdenv
, fetchurl
}:
stdenv.mkDerivation rec {
version = "3.12.0";
stdenv.mkDerivation (finalAttrs: {
version = "3.13.0";
pname = "commons-lang";
src = fetchurl {
url = "mirror://apache/commons/lang/binaries/commons-lang3-${version}-bin.tar.gz";
sha256 = "sha256-MwEkZd/Lf3kKyjM+CevxBeKl+5XCxjiz33kNPvqQjig=";
url = "mirror://apache/commons/lang/binaries/commons-lang3-${finalAttrs.version}-bin.tar.gz";
hash = "sha256-yDEbe1wqyfxuJe2DK55YnNLKLh7JcsHAgp2OohWBwWU=";
};
installPhase = ''
tar xf ${src}
runHook preInstall
tar xf ${finalAttrs.src}
mkdir -p $out/share/java
cp *.jar $out/share/java/
runHook postInstall
'';
meta = {
homepage = "https://commons.apache.org/proper/commons-lang";
description = "Provides additional methods to manipulate standard Java library classes";
homepage = "https://commons.apache.org/proper/commons-lang";
license = lib.licenses.asl20;
maintainers = with lib.maintainers; [ copumpkin ];
sourceProvenance = with lib.sourceTypes; [ binaryBytecode ];
license = lib.licenses.asl20;
platforms = with lib.platforms; unix;
sourceProvenance = with lib.sourceTypes; [ binaryBytecode ];
};
}
})
pkgs/development/tools/database/vitess/default.nix
+2 -2
View File
@@ -2,13 +2,13 @@
buildGoModule rec {
pname = "vitess";
version = "17.0.1";
version = "17.0.2";
src = fetchFromGitHub {
owner = "vitessio";
repo = pname;
rev = "v${version}";
hash = "sha256-EvCH1NxsGQzkXv0i5WOZXG9jeile0IHyZAoINgBIwYs=";
hash = "sha256-uST+FtYhGIn/Tieyofbh2r8xonw8qsS6ODrpd/A27r4=";
};
vendorHash = "sha256-0OrPbMG7ElOD+9/kWx1HtvGUBiFpIsNs5Vu7QofzE6Q=";
pkgs/development/tools/flyway/default.nix
+12 -7
View File
@@ -1,10 +1,11 @@
{ lib, stdenv, fetchurl, jre_headless, makeWrapper }:
stdenv.mkDerivation rec{
{ lib, stdenv, fetchurl, jre_headless, makeWrapper, testers }:
stdenv.mkDerivation (finalAttrs: {
pname = "flyway";
version = "9.21.2";
version = "9.22.0";
src = fetchurl {
url = "mirror://maven/org/flywaydb/flyway-commandline/${version}/flyway-commandline-${version}.tar.gz";
sha256 = "sha256-7MIjXF1qgEye2Z/cyeuSFkEmXT8AxkwYfw+/UevsPFg=";
url = "mirror://maven/org/flywaydb/flyway-commandline/${finalAttrs.version}/flyway-commandline-${finalAttrs.version}.tar.gz";
sha256 = "sha256-vdg66ETDfa0WG1TrRWJ9XpMSCE9sd5GlYAJY2TERC5Y=";
};
nativeBuildInputs = [ makeWrapper ];
dontBuild = true;
@@ -12,13 +13,16 @@ stdenv.mkDerivation rec{
installPhase = ''
mkdir -p $out/bin $out/share/flyway
cp -r sql jars drivers conf $out/share/flyway
install -Dt $out/share/flyway/lib lib/community/*.jar lib/*.jar
install -Dt $out/share/flyway/lib lib/community/*.jar lib/*.jar lib/aad/*.jar lib/oracle_wallet/*.jar
makeWrapper "${jre_headless}/bin/java" $out/bin/flyway \
--add-flags "-Djava.security.egd=file:/dev/../dev/urandom" \
--add-flags "-classpath '$out/share/flyway/lib/*:$out/share/flyway/drivers/*'" \
--add-flags "org.flywaydb.commandline.Main" \
--add-flags "-jarDirs='$out/share/flyway/jars'"
'';
passthru.tests = {
version = testers.testVersion { package = finalAttrs.finalPackage; };
};
meta = with lib; {
description = "Evolve your Database Schema easily and reliably across all your instances";
longDescription = ''
@@ -30,9 +34,10 @@ stdenv.mkDerivation rec{
'';
downloadPage = "https://github.com/flyway/flyway";
homepage = "https://flywaydb.org/";
changelog = "https://documentation.red-gate.com/fd/release-notes-for-flyway-engine-179732572.html";
sourceProvenance = with sourceTypes; [ binaryBytecode ];
license = licenses.asl20;
platforms = platforms.unix;
maintainers = [ maintainers.cmcdragonkai ];
};
}
})
pkgs/games/vintagestory/default.nix
+2 -2
View File
@@ -20,11 +20,11 @@
stdenv.mkDerivation rec {
pname = "vintagestory";
version = "1.18.8";
version = "1.18.10";
src = fetchurl {
url = "https://cdn.vintagestory.at/gamefiles/stable/vs_client_linux-x64_${version}.tar.gz";
hash = "sha256-q7MxmsWCGODOt/hCkCPz964m7az27SddIRBJ1vYg02k=";
hash = "sha256-xkpoVFZWlqhSSDn62MbhBYU6X+l5MmPxtrewg9xKuJc=";
};
pkgs/test/cc-wrapper/fortify1-example.c
+16
View File
@@ -0,0 +1,16 @@
/* an example that should be protected by FORTIFY_SOURCE=1 */
#include <stdio.h>
#include <string.h>
#include <stdlib.h>
int main(int argc, char *argv[]) {
/* allocate on the heap so we're likely to get an
* over-allocation and can be more sure that a
* failure is because of fortify protection rather
* than a genuine segfault */
char* buffer = malloc(sizeof(char) * 7);
strcpy(buffer, argv[1]);
puts(buffer);
return 0;
}
pkgs/test/cc-wrapper/fortify2-example.c
+16
View File
@@ -0,0 +1,16 @@
/* an example that should be protected by FORTIFY_SOURCE=2 but
* not FORTIFY_SOURCE=1 */
#include <stdio.h>
#include <string.h>
struct buffer_with_pad {
char buffer[7];
char pad[25];
};
int main(int argc, char *argv[]) {
struct buffer_with_pad b;
strcpy(b.buffer, argv[1]);
puts(b.buffer);
return 0;
}
pkgs/test/cc-wrapper/fortify3-example.c
+13
View File
@@ -0,0 +1,13 @@
/* an example that should be protected by FORTIFY_SOURCE=3 but
* not FORTIFY_SOURCE=2 */
#include <stdio.h>
#include <string.h>
#include <stdlib.h>
int main(int argc, char *argv[]) {
char* buffer = malloc(atoi(argv[2]));
strcpy(buffer, argv[1]);
puts(buffer);
return 0;
}
pkgs/test/cc-wrapper/hardening.nix
+396
View File
@@ -0,0 +1,396 @@
{ lib
, stdenv
, runCommand
, runCommandWith
, runCommandCC
, debian-devscripts
}:
let
# writeCBin from trivial-builders won't let us choose
# our own stdenv
writeCBinWithStdenv = codePath: stdenv': env: runCommandWith {
name = "test-bin";
stdenv = stdenv';
derivationArgs = {
inherit codePath;
preferLocalBuild = true;
allowSubstitutes = false;
} // env;
} ''
[ -n "$preBuild" ] && eval "$preBuild"
n=$out/bin/test-bin
mkdir -p "$(dirname "$n")"
cp "$codePath" code.c
NIX_DEBUG=1 $CC -x c code.c -O1 $TEST_EXTRA_FLAGS -o "$n"
'';
f1exampleWithStdEnv = writeCBinWithStdenv ./fortify1-example.c;
f2exampleWithStdEnv = writeCBinWithStdenv ./fortify2-example.c;
f3exampleWithStdEnv = writeCBinWithStdenv ./fortify3-example.c;
stdenvUnsupport = additionalUnsupported: stdenv.override {
cc = stdenv.cc.override {
cc = (lib.extendDerivation true {
hardeningUnsupportedFlags = (stdenv.cc.cc.hardeningUnsupportedFlags or []) ++ additionalUnsupported;
} stdenv.cc.cc);
};
allowedRequisites = null;
};
checkTestBin = testBin: {
# can only test flags that are detectable by hardening-check
ignoreBindNow ? true,
ignoreFortify ? true,
ignorePie ? true,
ignoreRelRO ? true,
ignoreStackProtector ? true,
expectFailure ? false,
}: let
expectFailureClause = lib.optionalString expectFailure
" && echo 'ERROR: Expected hardening-check to fail, but it passed!' >&2 && exit 1";
in runCommandCC "check-test-bin" {
nativeBuildInputs = [ debian-devscripts ];
buildInputs = [ testBin ];
meta.platforms = lib.platforms.linux; # ELF-reliant
} ''
hardening-check --nocfprotection \
${lib.optionalString ignoreBindNow "--nobindnow"} \
${lib.optionalString ignoreFortify "--nofortify"} \
${lib.optionalString ignorePie "--nopie"} \
${lib.optionalString ignoreRelRO "--norelro"} \
${lib.optionalString ignoreStackProtector "--nostackprotector"} \
$(PATH=$HOST_PATH type -P test-bin) ${expectFailureClause}
touch $out
'';
nameDrvAfterAttrName = builtins.mapAttrs (name: drv:
drv.overrideAttrs (_: { name = "test-${name}"; })
);
# returning a specific exit code when aborting due to a fortify
# check isn't mandated. so it's better to just ensure that a
# nonzero exit code is returned when we go a single byte beyond
# the buffer, with the example programs being designed to be
# unlikely to genuinely segfault for such a small overflow.
fortifyExecTest = testBin: runCommand "exec-test" {
buildInputs = [
testBin
];
meta.broken = !(stdenv.buildPlatform.canExecute stdenv.hostPlatform);
} ''
(
export PATH=$HOST_PATH
echo "Saturated buffer:" # check program isn't completly broken
test-bin 012345 7
echo "One byte too far:" # eighth byte being the null terminator
(! test-bin 0123456 7) || (echo 'Expected failure, but succeeded!' && exit 1)
)
echo "Expected behaviour observed"
touch $out
'';
brokenIf = cond: drv: if cond then drv.overrideAttrs (old: { meta = old.meta or {} // { broken = true; }; }) else drv;
in nameDrvAfterAttrName ({
bindNowExplicitEnabled = brokenIf stdenv.hostPlatform.isStatic (checkTestBin (f2exampleWithStdEnv stdenv {
hardeningEnable = [ "bindnow" ];
}) {
ignoreBindNow = false;
});
# musl implementation undetectable by this means even if present
fortifyExplicitEnabled = brokenIf stdenv.hostPlatform.isMusl (checkTestBin (f2exampleWithStdEnv stdenv {
hardeningEnable = [ "fortify" ];
}) {
ignoreFortify = false;
});
fortify1ExplicitEnabledExecTest = fortifyExecTest (f1exampleWithStdEnv stdenv {
hardeningEnable = [ "fortify" ];
});
# musl implementation is effectively FORTIFY_SOURCE=1-only,
# clang-on-glibc also only appears to support FORTIFY_SOURCE=1 (!)
fortifyExplicitEnabledExecTest = brokenIf (
stdenv.hostPlatform.isMusl || (stdenv.cc.isClang && stdenv.hostPlatform.libc == "glibc")
) (fortifyExecTest (f2exampleWithStdEnv stdenv {
hardeningEnable = [ "fortify" ];
}));
fortify3ExplicitEnabled = brokenIf (
stdenv.hostPlatform.isMusl || !stdenv.cc.isGNU || lib.versionOlder stdenv.cc.version "12"
) (checkTestBin (f3exampleWithStdEnv stdenv {
hardeningEnable = [ "fortify3" ];
}) {
ignoreFortify = false;
});
# musl implementation is effectively FORTIFY_SOURCE=1-only
fortify3ExplicitEnabledExecTest = brokenIf (
stdenv.hostPlatform.isMusl || !stdenv.cc.isGNU || lib.versionOlder stdenv.cc.version "12"
) (fortifyExecTest (f3exampleWithStdEnv stdenv {
hardeningEnable = [ "fortify3" ];
}));
pieExplicitEnabled = brokenIf stdenv.hostPlatform.isStatic (checkTestBin (f2exampleWithStdEnv stdenv {
hardeningEnable = [ "pie" ];
}) {
ignorePie = false;
});
relROExplicitEnabled = checkTestBin (f2exampleWithStdEnv stdenv {
hardeningEnable = [ "relro" ];
}) {
ignoreRelRO = false;
};
stackProtectorExplicitEnabled = brokenIf stdenv.hostPlatform.isStatic (checkTestBin (f2exampleWithStdEnv stdenv {
hardeningEnable = [ "stackprotector" ];
}) {
ignoreStackProtector = false;
});
bindNowExplicitDisabled = checkTestBin (f2exampleWithStdEnv stdenv {
hardeningDisable = [ "bindnow" ];
}) {
ignoreBindNow = false;
expectFailure = true;
};
fortifyExplicitDisabled = checkTestBin (f2exampleWithStdEnv stdenv {
hardeningDisable = [ "fortify" ];
}) {
ignoreFortify = false;
expectFailure = true;
};
fortify3ExplicitDisabled = checkTestBin (f3exampleWithStdEnv stdenv {
hardeningDisable = [ "fortify3" ];
}) {
ignoreFortify = false;
expectFailure = true;
};
fortifyExplicitDisabledDisablesFortify3 = checkTestBin (f3exampleWithStdEnv stdenv {
hardeningEnable = [ "fortify3" ];
hardeningDisable = [ "fortify" ];
}) {
ignoreFortify = false;
expectFailure = true;
};
fortify3ExplicitDisabledDoesntDisableFortify = checkTestBin (f2exampleWithStdEnv stdenv {
hardeningEnable = [ "fortify" ];
hardeningDisable = [ "fortify3" ];
}) {
ignoreFortify = false;
};
pieExplicitDisabled = brokenIf (
stdenv.hostPlatform.isMusl && stdenv.cc.isClang
) (checkTestBin (f2exampleWithStdEnv stdenv {
hardeningDisable = [ "pie" ];
}) {
ignorePie = false;
expectFailure = true;
});
# can't force-disable ("partial"?) relro
relROExplicitDisabled = brokenIf true (checkTestBin (f2exampleWithStdEnv stdenv {
hardeningDisable = [ "pie" ];
}) {
ignoreRelRO = false;
expectFailure = true;
});
stackProtectorExplicitDisabled = checkTestBin (f2exampleWithStdEnv stdenv {
hardeningDisable = [ "stackprotector" ];
}) {
ignoreStackProtector = false;
expectFailure = true;
};
# most flags can't be "unsupported" by compiler alone and
# binutils doesn't have an accessible hardeningUnsupportedFlags
# mechanism, so can only test a couple of flags through altered
# stdenv trickery
fortifyStdenvUnsupp = checkTestBin (f2exampleWithStdEnv (stdenvUnsupport ["fortify"]) {
hardeningEnable = [ "fortify" ];
}) {
ignoreFortify = false;
expectFailure = true;
};
fortify3StdenvUnsupp = checkTestBin (f3exampleWithStdEnv (stdenvUnsupport ["fortify3"]) {
hardeningEnable = [ "fortify3" ];
}) {
ignoreFortify = false;
expectFailure = true;
};
fortifyStdenvUnsuppUnsupportsFortify3 = checkTestBin (f3exampleWithStdEnv (stdenvUnsupport ["fortify"]) {
hardeningEnable = [ "fortify3" ];
}) {
ignoreFortify = false;
expectFailure = true;
};
fortify3StdenvUnsuppDoesntUnsuppFortify = brokenIf stdenv.hostPlatform.isMusl (checkTestBin (f2exampleWithStdEnv (stdenvUnsupport ["fortify3"]) {
hardeningEnable = [ "fortify" ];
}) {
ignoreFortify = false;
});
fortify3StdenvUnsuppDoesntUnsuppFortifyExecTest = fortifyExecTest (f2exampleWithStdEnv (stdenvUnsupport ["fortify3"]) {
hardeningEnable = [ "fortify" ];
});
stackProtectorStdenvUnsupp = checkTestBin (f2exampleWithStdEnv (stdenvUnsupport ["stackprotector"]) {
hardeningEnable = [ "stackprotector" ];
}) {
ignoreStackProtector = false;
expectFailure = true;
};
# NIX_HARDENING_ENABLE set in the shell overrides hardeningDisable
# and hardeningEnable
stackProtectorReenabledEnv = checkTestBin (f2exampleWithStdEnv stdenv {
hardeningDisable = [ "stackprotector" ];
preBuild = ''
export NIX_HARDENING_ENABLE="stackprotector"
'';
}) {
ignoreStackProtector = false;
};
stackProtectorReenabledFromAllEnv = checkTestBin (f2exampleWithStdEnv stdenv {
hardeningDisable = [ "all" ];
preBuild = ''
export NIX_HARDENING_ENABLE="stackprotector"
'';
}) {
ignoreStackProtector = false;
};
stackProtectorRedisabledEnv = checkTestBin (f2exampleWithStdEnv stdenv {
hardeningEnable = [ "stackprotector" ];
preBuild = ''
export NIX_HARDENING_ENABLE=""
'';
}) {
ignoreStackProtector = false;
expectFailure = true;
};
fortify3EnabledEnvEnablesFortify = brokenIf stdenv.hostPlatform.isMusl (checkTestBin (f2exampleWithStdEnv stdenv {
hardeningDisable = [ "fortify" "fortify3" ];
preBuild = ''
export NIX_HARDENING_ENABLE="fortify3"
'';
}) {
ignoreFortify = false;
});
fortify3EnabledEnvEnablesFortifyExecTest = fortifyExecTest (f2exampleWithStdEnv stdenv {
hardeningDisable = [ "fortify" "fortify3" ];
preBuild = ''
export NIX_HARDENING_ENABLE="fortify3"
'';
});
fortifyEnabledEnvDoesntEnableFortify3 = checkTestBin (f3exampleWithStdEnv stdenv {
hardeningDisable = [ "fortify" "fortify3" ];
preBuild = ''
export NIX_HARDENING_ENABLE="fortify"
'';
}) {
ignoreFortify = false;
expectFailure = true;
};
# NIX_HARDENING_ENABLE can't enable an unsupported feature
stackProtectorUnsupportedEnabledEnv = checkTestBin (f2exampleWithStdEnv (stdenvUnsupport ["stackprotector"]) {
preBuild = ''
export NIX_HARDENING_ENABLE="stackprotector"
'';
}) {
ignoreStackProtector = false;
expectFailure = true;
};
# undetectable by this means on static even if present
fortify1ExplicitEnabledCmdlineDisabled = brokenIf stdenv.hostPlatform.isStatic (checkTestBin (f1exampleWithStdEnv stdenv {
hardeningEnable = [ "fortify" ];
preBuild = ''
export TEST_EXTRA_FLAGS='-D_FORTIFY_SOURCE=0'
'';
}) {
ignoreFortify = false;
expectFailure = true;
});
# musl implementation undetectable by this means even if present
fortify1ExplicitDisabledCmdlineEnabled = brokenIf (
stdenv.hostPlatform.isMusl || stdenv.hostPlatform.isStatic
) (checkTestBin (f1exampleWithStdEnv stdenv {
hardeningDisable = [ "fortify" ];
preBuild = ''
export TEST_EXTRA_FLAGS='-D_FORTIFY_SOURCE=1'
'';
}) {
ignoreFortify = false;
});
fortify1ExplicitDisabledCmdlineEnabledExecTest = fortifyExecTest (f1exampleWithStdEnv stdenv {
hardeningDisable = [ "fortify" ];
preBuild = ''
export TEST_EXTRA_FLAGS='-D_FORTIFY_SOURCE=1'
'';
});
fortify1ExplicitEnabledCmdlineDisabledNoWarn = f1exampleWithStdEnv stdenv {
hardeningEnable = [ "fortify" ];
preBuild = ''
export TEST_EXTRA_FLAGS='-D_FORTIFY_SOURCE=0 -Werror'
'';
};
} // (let
tb = f2exampleWithStdEnv stdenv {
hardeningDisable = [ "all" ];
hardeningEnable = [ "fortify" "pie" ];
};
in {
allExplicitDisabledBindNow = checkTestBin tb {
ignoreBindNow = false;
expectFailure = true;
};
allExplicitDisabledFortify = checkTestBin tb {
ignoreFortify = false;
expectFailure = true;
};
allExplicitDisabledPie = brokenIf (
stdenv.hostPlatform.isMusl && stdenv.cc.isClang
) (checkTestBin tb {
ignorePie = false;
expectFailure = true;
});
# can't force-disable ("partial"?) relro
allExplicitDisabledRelRO = brokenIf true (checkTestBin tb {
ignoreRelRO = false;
expectFailure = true;
});
allExplicitDisabledStackProtector = checkTestBin tb {
ignoreStackProtector = false;
expectFailure = true;
};
}))
pkgs/test/default.nix
+8
View File
@@ -23,6 +23,14 @@ with pkgs;
stdenv-inputs = callPackage ./stdenv-inputs { };
stdenv = callPackage ./stdenv { };
hardeningFlags = recurseIntoAttrs (callPackage ./cc-wrapper/hardening.nix {});
hardeningFlags-gcc = recurseIntoAttrs (callPackage ./cc-wrapper/hardening.nix {
stdenv = gccStdenv;
});
hardeningFlags-clang = recurseIntoAttrs (callPackage ./cc-wrapper/hardening.nix {
stdenv = llvmPackages.stdenv;
});
config = callPackage ./config.nix { };
haskell = callPackage ./haskell { };
pkgs/tools/filesystems/bindfs/default.nix
+21 -10
View File
@@ -1,25 +1,36 @@
{ lib, stdenv, fetchurl, fuse, fuse3, pkg-config }:
{ lib
, stdenv
, fetchurl
, pkg-config
, fuse
, fuse3
}:
stdenv.mkDerivation rec {
version = "1.17.3";
stdenv.mkDerivation (finalAttrs: {
version = "1.17.4";
pname = "bindfs";
src = fetchurl {
url = "https://bindfs.org/downloads/${pname}-${version}.tar.gz";
sha256 = "sha256-wWh2CRVywjJCwW6Hxb5+NRL0Q6rmNzKNjAEcBx6TAus=";
url = "https://bindfs.org/downloads/bindfs-${finalAttrs.version}.tar.gz";
hash = "sha256-b9Svm6LsK9tgPvjuoqnRLbLl/py+UrhkC0FXNKWfPcw=";
};
nativeBuildInputs = [ pkg-config ];
nativeBuildInputs = [
pkg-config
];
buildInputs = if stdenv.isDarwin then [ fuse ] else [ fuse3 ];
postFixup = ''
ln -s $out/bin/bindfs $out/bin/mount.fuse.bindfs
'';
meta = {
changelog = "https://github.com/mpartel/bindfs/raw/${finalAttrs.version}/ChangeLog";
description = "A FUSE filesystem for mounting a directory to another location";
homepage = "https://bindfs.org";
license = lib.licenses.gpl2Only;
homepage = "https://bindfs.org";
license = lib.licenses.gpl2Only;
maintainers = with lib.maintainers; [ lovek323 lovesegfault ];
platforms = lib.platforms.unix;
platforms = lib.platforms.unix;
};
}
})
pkgs/tools/misc/debian-devscripts/default.nix
+9 -1
View File
@@ -1,4 +1,4 @@
{lib, stdenv, fetchurl, xz, dpkg
{lib, stdenv, fetchurl, fetchpatch, xz, dpkg
, libxslt, docbook_xsl, makeWrapper, writeShellScript
, python3Packages
, perlPackages, curl, gnupg, diffutils, nano, pkg-config, bash-completion, help2man
@@ -19,6 +19,14 @@ in stdenv.mkDerivation rec {
hash = "sha256-j0fUVTS/lPKFdgeMhksiJz2+E5koB07IK2uEj55EWG0=";
};
patches = [
(fetchpatch {
name = "hardening-check-obey-binutils-env-vars.patch";
url = "https://github.com/Debian/devscripts/pull/2/commits/c6a018e0ef50a1b0cb4962a2f96dae7c6f21f1d4.patch";
hash = "sha256-UpS239JiAM1IYxNuJLdILq2h0xlR5t0Tzhj47xiMHww=";
})
];
postPatch = ''
substituteInPlace scripts/Makefile --replace /usr/share/dpkg ${dpkg}/share/dpkg
substituteInPlace scripts/debrebuild.pl --replace /usr/bin/perl ${perlPackages.perl}/bin/perl
pkgs/tools/networking/veilid/Cargo.lock
Generated
+182 -223
View File
File diff suppressed because it is too large Load Diff
pkgs/tools/networking/veilid/default.nix
+3 -2
View File
@@ -10,20 +10,21 @@
rustPlatform.buildRustPackage rec {
pname = "veilid";
version = "0.1.10";
version = "0.2.0";
src = fetchFromGitLab {
owner = "veilid";
repo = pname;
rev = "v${version}";
fetchSubmodules = true;
sha256 = "sha256-43VCv0MqRIqKioM5Uj3sap9SvGnjgrZFxGPG98hk1v0=";
sha256 = "sha256-OgV6Rp5Az5iPUekeO8L28bxlXj/wZ5mOGmlXz14wcoQ=";
};
cargoLock = {
lockFile = ./Cargo.lock;
outputHashes = {
"bugsalot-0.2.2" = "sha256-9zLzK22dOB7w+ejk1SfkA98z4rEzrB6mAVUpPFuDUnY=";
"keychain-services-0.1.2" = "sha256-gkiE9PoSIgHngXc/BLMTL97/6dSnqAj42+q01CLbu+E=";
};
};
pkgs/top-level/all-packages.nix
+3 -1
View File
@@ -845,7 +845,9 @@ with pkgs;
autoreconfHook = buildPackages.autoreconfHook269;
};
gretl = callPackage ../applications/science/math/gretl { };
gretl = callPackage ../applications/science/math/gretl {
inherit (darwin.apple_sdk.frameworks) Accelerate;
};
grsync = callPackage ../applications/misc/grsync { };