From 5edd90ac3fe4ec47806bcda08d8a1b7a3674a74f Mon Sep 17 00:00:00 2001 From: tomberek Date: Wed, 25 Jun 2014 23:51:50 -0400 Subject: [PATCH 01/21] Haskell: add monadloc-pp --- .../libraries/haskell/monadloc-pp/default.nix | 18 ++++++++++++++++++ pkgs/top-level/haskell-packages.nix | 2 ++ 2 files changed, 20 insertions(+) create mode 100644 pkgs/development/libraries/haskell/monadloc-pp/default.nix diff --git a/pkgs/development/libraries/haskell/monadloc-pp/default.nix b/pkgs/development/libraries/haskell/monadloc-pp/default.nix new file mode 100644 index 000000000000..5ec05316ba0f --- /dev/null +++ b/pkgs/development/libraries/haskell/monadloc-pp/default.nix @@ -0,0 +1,18 @@ +{ cabal, filepath, haskellSrcExts, monadloc, syb }: + +cabal.mkDerivation (self: { + pname = "monadloc-pp"; + version = "0.3"; + sha256 = "0jr9ngcj3l6kd5cscll5kr3a4bp52sdjgrdxd1j5a21jyc3gdyvn"; + isLibrary = false; + isExecutable = true; + buildDepends = [ filepath haskellSrcExts monadloc syb ]; + jailbreak = true; + meta = { + homepage = "http://github.com/pepeiborra/monadloc"; + description = "A preprocessor for generating monadic call traces"; + license = self.stdenv.lib.licenses.publicDomain; + platforms = self.ghc.meta.platforms; + maintainers = [ self.stdenv.lib.maintainers.tomberek ]; + }; +}) diff --git a/pkgs/top-level/haskell-packages.nix b/pkgs/top-level/haskell-packages.nix index 608108a18474..2d83d5a999a4 100644 --- a/pkgs/top-level/haskell-packages.nix +++ b/pkgs/top-level/haskell-packages.nix @@ -1466,6 +1466,8 @@ self : let callPackage = x : y : modifyPrio (newScope self x y); in monadloc = callPackage ../development/libraries/haskell/monadloc {}; + monadlocPp = callPackage ../development/libraries/haskell/monadloc-pp {}; + monadLoops = callPackage ../development/libraries/haskell/monad-loops {}; monadLogger = callPackage ../development/libraries/haskell/monad-logger {}; From a6f11f262e2bd0233d74bc9a88c6f4e8544daf2c Mon Sep 17 00:00:00 2001 From: Jos van den Oever Date: Thu, 26 Jun 2014 11:31:59 +0200 Subject: [PATCH 02/21] Update povray. Current master version has 404 on tar.gz. --- pkgs/tools/graphics/povray/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/tools/graphics/povray/default.nix b/pkgs/tools/graphics/povray/default.nix index 12f307ca9def..6272bdae7803 100644 --- a/pkgs/tools/graphics/povray/default.nix +++ b/pkgs/tools/graphics/povray/default.nix @@ -4,8 +4,8 @@ stdenv.mkDerivation { name = "povray-3.6"; src = fetchurl { - url = http://www.povray.org/redirect/www.povray.org/ftp/pub/povray/Official/Unix/povray-3.6.tar.bz2; - sha256 = "0wvsfgkybx28mj2p76nnsq9rdq50192g5qb7d0xk81s8skn7z2jf"; + url = http://www.povray.org/ftp/pub/povray/Old-Versions/Official-3.62/Unix/povray-3.6.tar.bz2; + sha256 = "4e8a7fecd44807343b6867e1f2440aa0e09613d6d69a7385ac48f4e5e7737a73"; }; # the installPhase wants to put files into $HOME. I let it put the files From e36e853817b4c2da3b202c5e19d5f2111aafac9a Mon Sep 17 00:00:00 2001 From: John Wiegley Date: Thu, 26 Jun 2014 15:53:50 -0700 Subject: [PATCH 03/21] smljnBootstrap: new expression for running smlnj on darwin --- .../development/compilers/smlnj/bootstrap.nix | 43 +++++++++++++++++++ pkgs/top-level/all-packages.nix | 1 + 2 files changed, 44 insertions(+) create mode 100644 pkgs/development/compilers/smlnj/bootstrap.nix diff --git a/pkgs/development/compilers/smlnj/bootstrap.nix b/pkgs/development/compilers/smlnj/bootstrap.nix new file mode 100644 index 000000000000..27fdf75cc25d --- /dev/null +++ b/pkgs/development/compilers/smlnj/bootstrap.nix @@ -0,0 +1,43 @@ +{ stdenv, fetchurl, cpio, rsync, makeWrapper }: + +stdenv.mkDerivation rec { + name = "smlnj-bootstrap-${version}"; + + version = "110.76"; + + src = fetchurl { + url = "http://smlnj.cs.uchicago.edu/dist/working/${version}/smlnj-x86-${version}.pkg"; + sha256 = "0n3kdlqffqw97piya7i4lddrhjml2dp1q9hfq2jrd2hbzln8vdjf"; + }; + + buildInputs = [ cpio rsync makeWrapper ]; + + unpackPhase = '' + /usr/bin/xar -xf $src + cd smlnj.pkg + ''; + + buildPhase = '' + cat Payload | gunzip -dc | cpio -i + ''; + + installPhase = '' + ensureDir $out/bin + rsync -av bin/ $out/bin/ + + ensureDir $out/lib + rsync -av lib/ $out/lib/ + ''; + + postInstall = '' + wrapProgram "$out/bin/sml" --set "SMLNJ_HOME" "$out" + ''; + + meta = { + description = "Compiler for the Standard ML '97 programming language"; + homepage = http://www.smlnj.org; + license = stdenv.lib.licenses.free; + platforms = stdenv.lib.platforms.darwin; + maintainers = [ stdenv.lib.maintainers.jwiegley ]; + }; +} \ No newline at end of file diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index 4c09e6df6e63..e55f34d45724 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -3303,6 +3303,7 @@ let sdcc = callPackage ../development/compilers/sdcc { }; + smlnjBootstrap = callPackage ../development/compilers/smlnj/bootstrap.nix { }; smlnj = callPackage_i686 ../development/compilers/smlnj { }; stalin = callPackage ../development/compilers/stalin { }; From ad96cc8bf9af05f1b193ecf11e7db66844a8b6b2 Mon Sep 17 00:00:00 2001 From: John Wiegley Date: Thu, 26 Jun 2014 15:54:12 -0700 Subject: [PATCH 04/21] twelf: new expression; prover for PL theory and logic --- .../science/logic/twelf/default.nix | 46 +++++++++++++++++++ pkgs/top-level/all-packages.nix | 6 +++ 2 files changed, 52 insertions(+) create mode 100644 pkgs/applications/science/logic/twelf/default.nix diff --git a/pkgs/applications/science/logic/twelf/default.nix b/pkgs/applications/science/logic/twelf/default.nix new file mode 100644 index 000000000000..f5d2d44df425 --- /dev/null +++ b/pkgs/applications/science/logic/twelf/default.nix @@ -0,0 +1,46 @@ +{ stdenv, fetchurl, pkgconfig, smlnj, rsync }: + +stdenv.mkDerivation rec { + name = "twelf-${version}"; + version = "1.7.1"; + + src = fetchurl { + url = "//twelf.plparty.org/releases/twelf-src-1.7.1.tar.gz"; + sha256 = "0fi1kbs9hrdrm1x4k13angpjasxlyd1gc3ys8ah54i75qbcd9c4i"; + }; + + buildInputs = [ pkgconfig smlnj rsync ]; + + buildPhase = '' + export SMLNJ_HOME=${smlnj} + make smlnj + ''; + + installPhase = '' + ensureDir $out/bin + rsync -av bin/* $out/bin/ + + ensureDir $out/share/emacs/site-lisp/twelf/ + rsync -av emacs/ $out/share/emacs/site-lisp/twelf/ + + ensureDir $out/share/twelf/examples + rsync -av examples/ $out/share/twelf/examples/ + ensureDir $out/share/twelf/vim + rsync -av vim/ $out/share/twelf/vim/ + ''; + + meta = { + description = "Twelf logic proof assistant"; + longDescription = '' + Twelf is a language used to specify, implement, and prove properties of + deductive systems such as programming languages and logics. Large + research projects using Twelf include the TALT typed assembly language, + a foundational proof-carrying-code system, and a type safety proof for + Standard ML. + ''; + homepage = http://twelf.org/wiki/Main_Page; + license = "MIT"; + maintainers = with stdenv.lib.maintainers; [ jwiegley ]; + platforms = stdenv.lib.platforms.unix; + }; +} diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index e55f34d45724..fbbfa940abb2 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -10732,6 +10732,12 @@ let tptp = callPackage ../applications/science/logic/tptp {}; + twelf = callPackage ../applications/science/logic/twelf { + smlnj = if stdenv.isDarwin + then smlnjBootstrap + else smlnj; + }; + verifast = callPackage ../applications/science/logic/verifast {}; why3 = callPackage ../applications/science/logic/why3 {}; From 593e938341f82df93098a5df2ce85af6f7365ace Mon Sep 17 00:00:00 2001 From: Austin Seipp Date: Fri, 27 Jun 2014 00:24:43 -0500 Subject: [PATCH 05/21] php: 5.4.29 -> 5.4.30 CVE-2014-3981, CVE-2014-0207, CVE-2014-3478, CVE-2014-3479, CVE-2014-3480, CVE-2014-3487, CVE-2014-4049, CVE-2014-3515 Signed-off-by: Austin Seipp --- pkgs/development/interpreters/php/5.4.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/interpreters/php/5.4.nix b/pkgs/development/interpreters/php/5.4.nix index b692e4d8a991..c194c3aa8a07 100644 --- a/pkgs/development/interpreters/php/5.4.nix +++ b/pkgs/development/interpreters/php/5.4.nix @@ -9,7 +9,7 @@ in composableDerivation.composableDerivation {} ( fixed : let inherit (fixed.fixed) version; in { - version = "5.4.29"; + version = "5.4.30"; name = "php-${version}"; @@ -243,7 +243,7 @@ composableDerivation.composableDerivation {} ( fixed : let inherit (fixed.fixed) src = fetchurl { url = "http://www.php.net/distributions/php-${version}.tar.bz2"; - sha256 = "19z2n6h1fvj30n6hl2mwhw2f4i1vwhbj3j7abq3gc16gcfh3rkk2"; + sha256 = "1rkc977b4k0y6qg5nf8729g5zpica31h1isyds6khmrdwi23df1j"; }; meta = { From dd56bfbd0082c7a0291cc3cc860363aded31935e Mon Sep 17 00:00:00 2001 From: Austin Seipp Date: Fri, 27 Jun 2014 00:52:12 -0500 Subject: [PATCH 06/21] kernel/grsec: updates Signed-off-by: Austin Seipp --- pkgs/os-specific/linux/kernel/linux-3.10.nix | 4 ++-- pkgs/os-specific/linux/kernel/linux-3.14.nix | 4 ++-- pkgs/os-specific/linux/kernel/linux-3.15.nix | 4 ++-- pkgs/os-specific/linux/kernel/linux-3.4.nix | 4 ++-- pkgs/os-specific/linux/kernel/patches.nix | 12 ++++++------ 5 files changed, 14 insertions(+), 14 deletions(-) diff --git a/pkgs/os-specific/linux/kernel/linux-3.10.nix b/pkgs/os-specific/linux/kernel/linux-3.10.nix index a08ad5ea53d1..6ee5345f498c 100644 --- a/pkgs/os-specific/linux/kernel/linux-3.10.nix +++ b/pkgs/os-specific/linux/kernel/linux-3.10.nix @@ -1,12 +1,12 @@ { stdenv, fetchurl, ... } @ args: import ./generic.nix (args // rec { - version = "3.10.44"; + version = "3.10.45"; extraMeta.branch = "3.10"; src = fetchurl { url = "mirror://kernel/linux/kernel/v3.x/linux-${version}.tar.xz"; - sha256 = "06brvvxkgx4im4jzyl08y8hifgqb8ndxlhdkczwlqx3cgs6769c0"; + sha256 = "0bsmqszc86d33g6qpwgrdckgrd1x37087br3vsc5151s2p22rk1f"; }; features.iwlwifi = true; diff --git a/pkgs/os-specific/linux/kernel/linux-3.14.nix b/pkgs/os-specific/linux/kernel/linux-3.14.nix index 4fbca05501d3..f867309529f1 100644 --- a/pkgs/os-specific/linux/kernel/linux-3.14.nix +++ b/pkgs/os-specific/linux/kernel/linux-3.14.nix @@ -1,12 +1,12 @@ { stdenv, fetchurl, ... } @ args: import ./generic.nix (args // rec { - version = "3.14.8"; + version = "3.14.9"; extraMeta.branch = "3.14"; src = fetchurl { url = "mirror://kernel/linux/kernel/v3.x/linux-${version}.tar.xz"; - sha256 = "0l2k7c8i3vzcs8mwdy3h1yzlqli6vr56wbn6bxp4nyvxkwxlhs5d"; + sha256 = "0rm68hzkxzzh6a1nw6fsxbg43d4b88957ail7b9ga589cagf3p94"; }; features.iwlwifi = true; diff --git a/pkgs/os-specific/linux/kernel/linux-3.15.nix b/pkgs/os-specific/linux/kernel/linux-3.15.nix index 531b85b789aa..68f58f83a2f7 100644 --- a/pkgs/os-specific/linux/kernel/linux-3.15.nix +++ b/pkgs/os-specific/linux/kernel/linux-3.15.nix @@ -1,12 +1,12 @@ { stdenv, fetchurl, ... } @ args: import ./generic.nix (args // rec { - version = "3.15.1"; + version = "3.15.2"; extraMeta.branch = "3.15"; src = fetchurl { url = "mirror://kernel/linux/kernel/v3.x/linux-${version}.tar.xz"; - sha256 = "0bmzag945bb9v20xc2f6i4syx456prai3qj5cxhm8cb76wby4s8b"; + sha256 = "09nq8q84xn6lwzdnn36pzfiqhn1lapi60yxn4hifb7v9ymhc5sv6"; }; features.iwlwifi = true; diff --git a/pkgs/os-specific/linux/kernel/linux-3.4.nix b/pkgs/os-specific/linux/kernel/linux-3.4.nix index 8308340f3f5e..27efaac44889 100644 --- a/pkgs/os-specific/linux/kernel/linux-3.4.nix +++ b/pkgs/os-specific/linux/kernel/linux-3.4.nix @@ -1,12 +1,12 @@ { stdenv, fetchurl, ... } @ args: import ./generic.nix (args // rec { - version = "3.4.94"; + version = "3.4.95"; extraMeta.branch = "3.4"; src = fetchurl { url = "mirror://kernel/linux/kernel/v3.x/linux-${version}.tar.xz"; - sha256 = "0kc1s38zij39z8mrk9x29wizhbn4i7c7gyd796s1ib4826p3k48k"; + sha256 = "1rv2jsfc2m12nk293v12rvvqnicyh73pwp6bcb28jdqdhm95k6l6"; }; kernelPatches = args.kernelPatches ++ diff --git a/pkgs/os-specific/linux/kernel/patches.nix b/pkgs/os-specific/linux/kernel/patches.nix index eb4d7a100be9..5a6a7d15c3c9 100644 --- a/pkgs/os-specific/linux/kernel/patches.nix +++ b/pkgs/os-specific/linux/kernel/patches.nix @@ -60,17 +60,17 @@ rec { }; grsecurity_stable = grsecPatch - { kversion = "3.14.8"; - revision = "201406222110"; + { kversion = "3.14.9"; + revision = "201406262057"; branch = "stable"; - sha256 = "0jar710hqpjkp4g3ldrbcpgc170v9qp8ykajq5fi8mxx4j54gjwa"; + sha256 = "0rrcmlaz69028fwl45xnif1dc9wnl7lnrry1280mdg764wrc6g0n"; }; grsecurity_unstable = grsecPatch - { kversion = "3.15.1"; - revision = "201406222112"; + { kversion = "3.15.2"; + revision = "201406262058"; branch = "test"; - sha256 = "04sbpmzgfgn7hjiln9baynpgr7k67lm0b5wn2z8i2jsjigfmv0r4"; + sha256 = "02r9xasg1hiw3bynwh50r9cqjzwffmhsyg4gmiyzs58izivl1hvd"; }; grsec_fix_path = From f9ebbc80a14d423481cfaca380ae8dc6dd4f14ee Mon Sep 17 00:00:00 2001 From: John Wiegley Date: Thu, 26 Jun 2014 22:53:37 -0700 Subject: [PATCH 07/21] haskell-ghc-mod: patch ghc-process.el to avoid hanging @peti I've determined that the hang which this fixes does not happen all of the time (in fact, I've been using ghc-mod for weeks without seeing it once). But today it happened again, and it made me realize I had undone this patch locally. I'm committing it now because it fixes the problem completely for me, and certainly cannot hurt. --- pkgs/development/libraries/haskell/ghc-mod/default.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/pkgs/development/libraries/haskell/ghc-mod/default.nix b/pkgs/development/libraries/haskell/ghc-mod/default.nix index f05bfedafcff..ee2cbdbd2032 100644 --- a/pkgs/development/libraries/haskell/ghc-mod/default.nix +++ b/pkgs/development/libraries/haskell/ghc-mod/default.nix @@ -21,6 +21,7 @@ cabal.mkDerivation (self: { configureFlags = "--datasubdir=${self.pname}-${self.version}"; postInstall = '' cd $out/share/$pname-$version + sed -i -e 's/"-b" "\\n" "-l"/"-l" "-b" "\\"\\\\n\\""/' ghc-process.el make rm Makefile cd .. From 48f2ca07f481e70204f760bff16f5699a309bdfa Mon Sep 17 00:00:00 2001 From: Austin Seipp Date: Fri, 27 Jun 2014 01:12:43 -0500 Subject: [PATCH 08/21] arcanist: 20140617 -> 20140627 Signed-off-by: Austin Seipp --- pkgs/development/tools/misc/arcanist/default.nix | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/pkgs/development/tools/misc/arcanist/default.nix b/pkgs/development/tools/misc/arcanist/default.nix index 7e3a3a6d15c9..4236cffadfc9 100644 --- a/pkgs/development/tools/misc/arcanist/default.nix +++ b/pkgs/development/tools/misc/arcanist/default.nix @@ -3,18 +3,18 @@ let libphutil = fetchgit { url = "git://github.com/facebook/libphutil.git"; - rev = "0027e97cd6cbafcbdc626b4ac6cf315b9508a14f"; - sha256 = "4781a4e3e1cb72da24e97f89a9b879803be8e1cf6baa2a4517801dfb893eec26"; + rev = "8d1b522333caf4984180ac830be8635437bacedb"; + sha256 = "e83da381cd8845b64a1cd3244d17736fb736aeabce37efd19754447f47cd4fe1"; }; arcanist = fetchgit { url = "git://github.com/facebook/arcanist.git"; - rev = "680ec3670cd9d9195debf3e9b674b1b232156e61"; - sha256 = "a70cde586960676c0d69f4d98e6936633e0d79c37c6f6cc5b0213146a6b18c83"; + rev = "0971c728fea89ac45a67e06cdb89349ad8040c60"; + sha256 = "33e595b81dcbef181d3c71072ecf1c22db3f86f49dbb5276c671caefe83c8594"; }; in stdenv.mkDerivation rec { name = "arcanist-${version}"; - version = "20140617"; + version = "20140627"; src = [ arcanist libphutil ]; buildInputs = [ php makeWrapper flex ]; From 865787ef3273566fe5b979638e3a0bbf08836595 Mon Sep 17 00:00:00 2001 From: aszlig Date: Fri, 27 Jun 2014 08:34:59 +0200 Subject: [PATCH 09/21] nixos/tests/openssh: Test configured auth keys. So far the test only uses an authorized key that is copied over to the target machine instead of being set by the target's configuration. Now, we cover both cases. Signed-off-by: aszlig --- nixos/tests/openssh.nix | 48 +++++++++++++++++++++++++++++++++-------- 1 file changed, 39 insertions(+), 9 deletions(-) diff --git a/nixos/tests/openssh.nix b/nixos/tests/openssh.nix index 0b9714c275da..d4ce95e49f70 100644 --- a/nixos/tests/openssh.nix +++ b/nixos/tests/openssh.nix @@ -1,4 +1,21 @@ -import ./make-test.nix ({ pkgs, ... }: { +import ./make-test.nix ({ pkgs, ... }: + +let + snakeOilPrivateKey = pkgs.writeText "privkey.snakeoil" '' + -----BEGIN EC PRIVATE KEY----- + MHcCAQEEIHQf/khLvYrQ8IOika5yqtWvI0oquHlpRLTZiJy5dRJmoAoGCCqGSM49 + AwEHoUQDQgAEKF0DYGbBwbj06tA3fd/+yP44cvmwmHBWXZCKbS+RQlAKvLXMWkpN + r1lwMyJZoSGgBHoUahoYjTh9/sJL7XLJtA== + -----END EC PRIVATE KEY----- + ''; + + snakeOilPublicKey = pkgs.lib.concatStrings [ + "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHA" + "yNTYAAABBBChdA2BmwcG49OrQN33f/sj+OHL5sJhwVl2Qim0vkUJQCry1zFpKTa" + "9ZcDMiWaEhoAR6FGoaGI04ff7CS+1yybQ= sakeoil" + ]; + +in { nodes = { @@ -9,6 +26,9 @@ import ./make-test.nix ({ pkgs, ... }: { services.openssh.enable = true; security.pam.services.sshd.limits = [ { domain = "*"; item = "memlock"; type = "-"; value = 1024; } ]; + users.extraUsers.root.openssh.authorizedKeys.keys = [ + snakeOilPublicKey + ]; }; client = @@ -23,15 +43,25 @@ import ./make-test.nix ({ pkgs, ... }: { $server->waitForUnit("sshd"); - $server->succeed("mkdir -m 700 /root/.ssh"); - $server->copyFileFromHost("key.pub", "/root/.ssh/authorized_keys"); + subtest "manual-authkey", sub { + $server->succeed("mkdir -m 700 /root/.ssh"); + $server->copyFileFromHost("key.pub", "/root/.ssh/authorized_keys"); - $client->succeed("mkdir -m 700 /root/.ssh"); - $client->copyFileFromHost("key", "/root/.ssh/id_dsa"); - $client->succeed("chmod 600 /root/.ssh/id_dsa"); + $client->succeed("mkdir -m 700 /root/.ssh"); + $client->copyFileFromHost("key", "/root/.ssh/id_dsa"); + $client->succeed("chmod 600 /root/.ssh/id_dsa"); - $client->waitForUnit("network.target"); - $client->succeed("ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no server 'echo hello world' >&2"); - $client->succeed("ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no server 'ulimit -l' | grep 1024"); + $client->waitForUnit("network.target"); + $client->succeed("ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no server 'echo hello world' >&2"); + $client->succeed("ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no server 'ulimit -l' | grep 1024"); + }; + + subtest "configured-authkey", sub { + $client->succeed("cat ${snakeOilPrivateKey} > privkey.snakeoil"); + $client->succeed("chmod 600 privkey.snakeoil"); + $client->succeed("ssh -o UserKnownHostsFile=/dev/null" . + " -o StrictHostKeyChecking=no -i privkey.snakeoil" . + " server true"); + }; ''; }) From da32f052b1390a77c58c8c1c3fae62db1abd050e Mon Sep 17 00:00:00 2001 From: aszlig Date: Fri, 27 Jun 2014 09:19:30 +0200 Subject: [PATCH 10/21] Revert "nixos/sshd: drop mode from auth keys file". This reverts commit a3331eb87b25d954766af9652e1415a783dae76c. See https://github.com/NixOS/nixpkgs/issues/2559#issuecomment-47313334 for a description why this is not a good idea. I guess it's better to implement a sane way to remove all files in authorized_keys.d, especially because it is also backwards-compatible. Reopens #2559. Signed-off-by: aszlig --- nixos/modules/services/networking/ssh/sshd.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/nixos/modules/services/networking/ssh/sshd.nix b/nixos/modules/services/networking/ssh/sshd.nix index b563a781f1d4..e4b29a0b9090 100644 --- a/nixos/modules/services/networking/ssh/sshd.nix +++ b/nixos/modules/services/networking/ssh/sshd.nix @@ -56,6 +56,7 @@ let authKeysFiles = let mkAuthKeyFile = u: { target = "ssh/authorized_keys.d/${u.name}"; + mode = "0444"; source = pkgs.writeText "${u.name}-authorized_keys" '' ${concatStringsSep "\n" u.openssh.authorizedKeys.keys} ${concatMapStrings (f: readFile f + "\n") u.openssh.authorizedKeys.keyFiles} From 622673495b6b00843c2bbacc932b377e2389cc8b Mon Sep 17 00:00:00 2001 From: aszlig Date: Fri, 27 Jun 2014 09:39:12 +0200 Subject: [PATCH 11/21] nixos/log2html: Remove schema from jQuery URLs. This allows viewing test logs for example when using a Hydra running with HTTPS. Signed-off-by: aszlig --- nixos/lib/test-driver/log2html.xsl | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/nixos/lib/test-driver/log2html.xsl b/nixos/lib/test-driver/log2html.xsl index 8e907d85ffac..ce8a9c6de2b2 100644 --- a/nixos/lib/test-driver/log2html.xsl +++ b/nixos/lib/test-driver/log2html.xsl @@ -9,8 +9,8 @@ - - + +