From c831bc2a8bd3114adfe9a4f6d3a3641cdfd369e7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jan=20van=20Br=C3=BCgge?= Date: Wed, 2 Oct 2024 14:40:57 +0100 Subject: [PATCH 1/5] python3Packages.scim2-filter-parser: 0.5.0 -> 0.7.0 --- .../python-modules/scim2-filter-parser/default.nix | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/pkgs/development/python-modules/scim2-filter-parser/default.nix b/pkgs/development/python-modules/scim2-filter-parser/default.nix index 2ddf98697185..0929e65510b2 100644 --- a/pkgs/development/python-modules/scim2-filter-parser/default.nix +++ b/pkgs/development/python-modules/scim2-filter-parser/default.nix @@ -12,14 +12,14 @@ buildPythonPackage rec { pname = "scim2-filter-parser"; - version = "0.5.0"; - format = "pyproject"; + version = "0.7.0"; + pyproject = true; src = fetchFromGitHub { owner = "15five"; repo = pname; rev = "refs/tags/${version}"; - hash = "sha256-QEPTYpWlRPWO6Evyt4zoqUST4ousF67GmiOpD7WUqcI="; + hash = "sha256-KmtOtI/5HT0lVwvXQFTlEwMeptoa4cA5hTSgSULxhIc="; }; patches = [ @@ -31,14 +31,14 @@ buildPythonPackage rec { }) ]; - nativeBuildInputs = [ poetry-core ]; + build-system = [ poetry-core ]; postPatch = '' substituteInPlace pyproject.toml \ --replace "poetry.masonry.api" "poetry.core.masonry.api" ''; - propagatedBuildInputs = [ sly ]; + dependencies = [ sly ]; optional-dependencies = { django-query = [ django ]; From 6c5c370f5ea49a31b4bbb1d67a4a3e4a92c428cd Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jan=20van=20Br=C3=BCgge?= Date: Wed, 2 Oct 2024 15:29:39 +0100 Subject: [PATCH 2/5] python3Packages.drf-orjson-renderer: init at 1.7.3 --- .../drf-orjson-renderer/default.nix | 40 +++++++++++++++++++ pkgs/top-level/python-packages.nix | 2 + 2 files changed, 42 insertions(+) create mode 100644 pkgs/development/python-modules/drf-orjson-renderer/default.nix diff --git a/pkgs/development/python-modules/drf-orjson-renderer/default.nix b/pkgs/development/python-modules/drf-orjson-renderer/default.nix new file mode 100644 index 000000000000..a234c66c9929 --- /dev/null +++ b/pkgs/development/python-modules/drf-orjson-renderer/default.nix @@ -0,0 +1,40 @@ +{ + lib, + buildPythonPackage, + fetchFromGitHub, + setuptools, + django, + djangorestframework, + orjson, +}: + +buildPythonPackage { + pname = "drf-orjson-renderer"; + version = "1.7.3"; + pyproject = true; + + src = fetchFromGitHub { + owner = "brianjbuck"; + repo = "drf_orjson_renderer"; + rev = "8885ef748f0152927106ee068375429774a519df"; + hash = "sha256-opC7KcuTg7kdl8xy8H8ZszJb5nn8vJCpRUUIizdnYqU="; + }; + + build-system = [ setuptools ]; + + doCheck = false; # Tests are broken upstream (https://github.com/brianjbuck/drf_orjson_renderer/pull/26) + dependencies = [ + django + djangorestframework + orjson + ]; + + pythonImportsCheck = [ "drf_orjson_renderer" ]; + + meta = { + description = "JSON renderer and parser for Django Rest Framework using the orjson library"; + homepage = "https://github.com/brianjbuck/drf_orjson_renderer"; + license = lib.licenses.mit; + maintainers = with lib.maintainers; [ jvanbruegge ]; + }; +} diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix index 1a026f7d4d41..74c64f2cee49 100644 --- a/pkgs/top-level/python-packages.nix +++ b/pkgs/top-level/python-packages.nix @@ -3873,6 +3873,8 @@ self: super: with self; { drf-nested-routers = callPackage ../development/python-modules/drf-nested-routers { }; + drf-orjson-renderer = callPackage ../development/python-modules/drf-orjson-renderer { }; + drf-spectacular = callPackage ../development/python-modules/drf-spectacular { }; drf-spectacular-sidecar = callPackage ../development/python-modules/drf-spectacular-sidecar { }; From 14f5d0dd5c89159b105889f98e718183d09acc4a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jan=20van=20Br=C3=BCgge?= Date: Tue, 10 Dec 2024 13:23:23 +0000 Subject: [PATCH 3/5] python3Packages.python-kadmin-rs: init at 0.5.2 --- .../python-kadmin-rs/default.nix | 67 +++++++++++++++++++ pkgs/top-level/python-packages.nix | 2 + 2 files changed, 69 insertions(+) create mode 100644 pkgs/development/python-modules/python-kadmin-rs/default.nix diff --git a/pkgs/development/python-modules/python-kadmin-rs/default.nix b/pkgs/development/python-modules/python-kadmin-rs/default.nix new file mode 100644 index 000000000000..25acb0f5eea7 --- /dev/null +++ b/pkgs/development/python-modules/python-kadmin-rs/default.nix @@ -0,0 +1,67 @@ +{ + lib, + pkgs, + fetchFromGitHub, + rustPlatform, + pythonImportsCheckHook, + buildPythonPackage, + + cargo, + rustc, + pkg-config, + sccache, + setuptools, + setuptools-rust, + setuptools-scm, +}: + +buildPythonPackage rec { + pname = "python-kadmin-rs"; + version = "0.5.2"; + pyproject = true; + + src = fetchFromGitHub { + owner = "authentik-community"; + repo = "kadmin-rs"; + rev = "kadmin/version/${version}"; + hash = "sha256-5sbYnEoT0/3BTJBipEy+DpIDbX6mRIpAE6CuAoJ5bw4="; + }; + + cargoDeps = rustPlatform.fetchCargoTarball { + inherit src; + hash = "sha256-QLj7RDoyn8QzExUSnofT8XqHZmh72j87HlzOksBvk7Q="; + }; + + buildInputs = [ + pkgs.krb5 + ]; + + nativeBuildInputs = [ + sccache + pkg-config + pythonImportsCheckHook + rustPlatform.bindgenHook + rustPlatform.cargoSetupHook + cargo + rustc + ]; + + build-system = [ + setuptools + setuptools-rust + setuptools-scm + ]; + + pythonImportsCheck = [ + "kadmin" + "kadmin_local" + ]; + + meta = { + description = "Rust and Python interfaces to the Kerberos administration interface (kadm5)"; + homepage = "https://github.com/authentik-community/kadmin-rs"; + changelog = "https://github.com/authentik-community/kadmin-rs/releases/tag/kadmin%2Fversion%2F${version}"; + license = lib.licenses.mit; + maintainers = with lib.maintainers; [ jvanbruegge ]; + }; +} diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix index 74c64f2cee49..3f9780d093da 100644 --- a/pkgs/top-level/python-packages.nix +++ b/pkgs/top-level/python-packages.nix @@ -10725,6 +10725,8 @@ self: super: with self; { python-juicenet = callPackage ../development/python-modules/python-juicenet { }; + python-kadmin-rs = callPackage ../development/python-modules/python-kadmin-rs { }; + python-kasa = callPackage ../development/python-modules/python-kasa { }; python-keycloak = callPackage ../development/python-modules/python-keycloak { }; From 3702cc6c6be87f3cab03f0b21d2cc032aa421cac Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jan=20van=20Br=C3=BCgge?= Date: Tue, 10 Dec 2024 13:50:27 +0000 Subject: [PATCH 4/5] authentik,authentik.outposts.{ldap,radius}: 2024.6.4 -> 2024.12.1 --- pkgs/by-name/au/authentik/ldap.nix | 7 +- pkgs/by-name/au/authentik/outposts.nix | 3 +- pkgs/by-name/au/authentik/package.nix | 280 ++++++++++++++----------- pkgs/by-name/au/authentik/radius.nix | 7 +- 4 files changed, 172 insertions(+), 125 deletions(-) diff --git a/pkgs/by-name/au/authentik/ldap.nix b/pkgs/by-name/au/authentik/ldap.nix index 3d65ccdd8413..844cdfb6b70b 100644 --- a/pkgs/by-name/au/authentik/ldap.nix +++ b/pkgs/by-name/au/authentik/ldap.nix @@ -1,10 +1,13 @@ -{ buildGoModule, authentik }: +{ + buildGoModule, + authentik, +}: buildGoModule { pname = "authentik-ldap-outpost"; inherit (authentik) version src; - vendorHash = "sha256-BcL9QAc2jJqoPaQImJIFtCiu176nxmVcCLPjXjNBwqI="; + vendorHash = "sha256-FyRTPs2xfostV2x03IjrxEYBSrsZwnuPn+oHyQq1Kq0="; env.CGO_ENABLED = 0; diff --git a/pkgs/by-name/au/authentik/outposts.nix b/pkgs/by-name/au/authentik/outposts.nix index c10ace799611..f1d5181609ad 100644 --- a/pkgs/by-name/au/authentik/outposts.nix +++ b/pkgs/by-name/au/authentik/outposts.nix @@ -1,4 +1,5 @@ -{ callPackage }: { +{ callPackage }: +{ ldap = callPackage ./ldap.nix { }; radius = callPackage ./radius.nix { }; } diff --git a/pkgs/by-name/au/authentik/package.nix b/pkgs/by-name/au/authentik/package.nix index 9dc47773f341..51ebcdbe2e1f 100644 --- a/pkgs/by-name/au/authentik/package.nix +++ b/pkgs/by-name/au/authentik/package.nix @@ -1,26 +1,27 @@ -{ lib -, stdenvNoCC -, callPackages -, fetchFromGitHub -, fetchpatch -, fetchzip -, buildNpmPackage -, buildGoModule -, runCommand -, openapi-generator-cli -, nodejs -, python312 -, codespell -, makeWrapper }: +{ + lib, + stdenvNoCC, + callPackages, + cacert, + fetchFromGitHub, + buildNpmPackage, + buildGoModule, + runCommand, + chromedriver, + openapi-generator-cli, + nodejs, + python312, + makeWrapper, +}: let - version = "2024.6.4"; + version = "2024.12.1"; src = fetchFromGitHub { owner = "goauthentik"; repo = "authentik"; rev = "version/${version}"; - hash = "sha256-QwK/auMLCJEHHtyexFnO+adCq/u0fezHQ90fXW9J4c4="; + hash = "sha256-CkUmsVKzAQ/VWIhtxWxlcGtrWVa8hxqsMqvfcsG5ktA="; }; meta = with lib; { @@ -29,34 +30,69 @@ let homepage = "https://goauthentik.io/"; license = licenses.mit; platforms = platforms.linux; - maintainers = with maintainers; [ jvanbruegge risson ]; - knownVulnerabilities = [ - "CVE-2024-52307" - "CVE-2024-52287" - "CVE-2024-52289" - "Authentik 2024.6.x is end-of-life, consider using https://github.com/nix-community/authentik-nix for an up-to-date alternative" + maintainers = with maintainers; [ + jvanbruegge + risson ]; }; - website = buildNpmPackage { - pname = "authentik-website"; - inherit version src meta; - npmDepsHash = "sha256-JM+ae+zDsMdvovd2p4IJIH89KlMeDU7HOZjFbDCyehw="; + # prefetch-npm-deps does not save all dependencies even though the lockfile is fine + website-deps = stdenvNoCC.mkDerivation { + pname = "authentik-website-deps"; + inherit src version meta; - NODE_ENV = "production"; - NODE_OPTIONS = "--openssl-legacy-provider"; + sourceRoot = "source/website"; + + outputHash = "sha256-SONw9v67uuVk8meRIuS1KaBGbej6Gbz6nZxPDnHfCwQ="; + outputHashMode = "recursive"; + + nativeBuildInputs = [ + nodejs + cacert + ]; + + buildPhase = '' + npm ci --cache ./cache + rm -r ./cache + ''; + + installPhase = '' + mv node_modules $out + ''; + + dontPatchShebangs = true; + }; + + website = stdenvNoCC.mkDerivation { + pname = "authentik-website"; + inherit src version meta; + + nativeBuildInputs = [ nodejs ]; postPatch = '' - cd website + substituteInPlace package.json --replace-fail 'cross-env ' "" + ''; + + sourceRoot = "source/website"; + + buildPhase = '' + runHook preBuild + + cp -r ${website-deps} node_modules + chmod -R +w node_modules + pushd node_modules/.bin + patchShebangs $(readlink docusaurus) + popd + cat node_modules/.bin/docusaurus + npm run build-bundled + + runHook postBuild ''; installPhase = '' mkdir $out cp -r build $out/help ''; - - npmBuildScript = "build-bundled"; - npmFlags = [ "--ignore-scripts" ]; }; clientapi = stdenvNoCC.mkDerivation { @@ -86,19 +122,21 @@ let pname = "authentik-webui"; inherit version meta; - src = runCommand "authentik-webui-source" {} '' + src = runCommand "authentik-webui-source" { } '' mkdir -p $out/web/node_modules/@goauthentik/ cp -r ${src}/web $out/ ln -s ${src}/package.json $out/ ln -s ${src}/website $out/ ln -s ${clientapi} $out/web/node_modules/@goauthentik/api ''; - npmDepsHash = "sha256-8TzB3ylZzVLePD86of8E/lGgIQCciWMQF9m1Iqv9ZTY="; + npmDepsHash = "sha256-aRfpJWTp2WQB3E9aqzJn3BiPLwpCkdvMoyHexaKvz0U="; postPatch = '' cd web ''; + CHROMEDRIVER_FILEPATH = lib.getExe chromedriver; + installPhase = '' runHook preInstall mkdir $out @@ -110,7 +148,10 @@ let NODE_ENV = "production"; NODE_OPTIONS = "--openssl-legacy-provider"; - npmInstallFlags = [ "--include=dev" ]; + npmInstallFlags = [ + "--include=dev" + "--ignore-scripts" + ]; }; python = python312.override { @@ -164,14 +205,6 @@ let inherit version src meta; pyproject = true; - patches = [ - (fetchpatch { - name = "scim-schema-load.patch"; - url = "https://github.com/goauthentik/authentik/commit/f3640bd3c0ee2f43efcfd506bb71d2b7b6761017.patch"; - hash = "sha256-4AC7Dc4TM7ok964ztc+XdHvoU/DKyi9yJoz5u1dljEM="; - }) - ]; - postPatch = '' rm lifecycle/system_migrations/tenant_files.py substituteInPlace authentik/root/settings.py \ @@ -186,76 +219,82 @@ let --replace-fail 'web/' '${webui}/' ''; - nativeBuildInputs = [ prev.poetry-core ]; + nativeBuildInputs = [ + prev.poetry-core + ]; - propagatedBuildInputs = with final; [ - argon2-cffi - celery - channels - channels-redis - codespell - colorama - dacite - deepmerge - defusedxml - django - django-cte - django-filter - django-guardian - django-model-utils - django-pglock - django-prometheus - django-redis - django-storages - django-tenants - djangorestframework - djangorestframework-guardian2 - docker - drf-spectacular - duo-client - facebook-sdk - fido2 - flower - geoip2 - google-api-python-client - gunicorn - jsonpatch - kubernetes - ldap3 - lxml - msgraph-sdk - opencontainers - packaging - paramiko - psycopg - pydantic - pydantic-scim - pyjwt - pyyaml - requests-oauthlib - scim2-filter-parser - sentry-sdk - service-identity - setproctitle - structlog - swagger-spec-validator - tenant-schemas-celery - twilio - twisted - ua-parser - urllib3 - uvicorn - watchdog - webauthn - wsproto - xmlsec - zxcvbn - ] - ++ channels.optional-dependencies.daphne - ++ django-storages.optional-dependencies.s3 - ++ opencontainers.optional-dependencies.reggie - ++ psycopg.optional-dependencies.c - ++ uvicorn.optional-dependencies.standard; + propagatedBuildInputs = + with final; + [ + argon2-cffi + celery + channels + channels-redis + cryptography + dacite + deepmerge + defusedxml + django + django-countries + django-cte + django-filter + django-guardian + django-model-utils + django-pglock + django-prometheus + django-redis + django-storages + django-tenants + djangorestframework + djangorestframework-guardian2 + docker + drf-orjson-renderer + drf-spectacular + duo-client + fido2 + flower + geoip2 + google-api-python-client + gunicorn + gssapi + jsonpatch + jwcrypto + kubernetes + ldap3 + lxml + msgraph-sdk + opencontainers + packaging + paramiko + psycopg + pydantic + pydantic-scim + pyjwt + pyrad + python-kadmin-rs + pyyaml + requests-oauthlib + scim2-filter-parser + sentry-sdk + service-identity + setproctitle + structlog + swagger-spec-validator + tenant-schemas-celery + twilio + ua-parser + urllib3 + uvicorn + watchdog + webauthn + wsproto + xmlsec + zxcvbn + ] + ++ django-storages.optional-dependencies.s3 + ++ opencontainers.optional-dependencies.reggie + ++ psycopg.optional-dependencies.c + ++ uvicorn.optional-dependencies.standard; postInstall = '' mkdir -p $out/web $out/website @@ -287,7 +326,7 @@ let env.CGO_ENABLED = 0; - vendorHash = "sha256-BcL9QAc2jJqoPaQImJIFtCiu176nxmVcCLPjXjNBwqI="; + vendorHash = "sha256-FyRTPs2xfostV2x03IjrxEYBSrsZwnuPn+oHyQq1Kq0="; postInstall = '' mv $out/bin/server $out/bin/authentik @@ -296,18 +335,14 @@ let subPackages = [ "cmd/server" ]; }; -in stdenvNoCC.mkDerivation { +in +stdenvNoCC.mkDerivation { pname = "authentik"; inherit src version; postPatch = '' rm Makefile patchShebangs lifecycle/ak - - # This causes issues in systemd services - substituteInPlace lifecycle/ak \ - --replace-fail 'printf' '>&2 printf' \ - --replace-fail '> /dev/stderr' "" ''; installPhase = '' @@ -316,7 +351,12 @@ in stdenvNoCC.mkDerivation { cp -r lifecycle/ak $out/bin/ wrapProgram $out/bin/ak \ - --prefix PATH : ${lib.makeBinPath [ (python.withPackages (ps: [ps.authentik-django])) proxy ]} \ + --prefix PATH : ${ + lib.makeBinPath [ + (python.withPackages (ps: [ ps.authentik-django ])) + proxy + ] + } \ --set TMPDIR /dev/shm \ --set PYTHONDONTWRITEBYTECODE 1 \ --set PYTHONUNBUFFERED 1 diff --git a/pkgs/by-name/au/authentik/radius.nix b/pkgs/by-name/au/authentik/radius.nix index fa2c40eba997..6418a264a326 100644 --- a/pkgs/by-name/au/authentik/radius.nix +++ b/pkgs/by-name/au/authentik/radius.nix @@ -1,10 +1,13 @@ -{ buildGoModule, authentik }: +{ + buildGoModule, + authentik, +}: buildGoModule { pname = "authentik-radius-outpost"; inherit (authentik) version src; - vendorHash = "sha256-BcL9QAc2jJqoPaQImJIFtCiu176nxmVcCLPjXjNBwqI="; + vendorHash = "sha256-FyRTPs2xfostV2x03IjrxEYBSrsZwnuPn+oHyQq1Kq0="; env.CGO_ENABLED = 0; From 813e4811fdcce384123956a505bb310dbe2854ee Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jan=20van=20Br=C3=BCgge?= Date: Thu, 3 Oct 2024 15:15:50 +0100 Subject: [PATCH 5/5] authentik.outposts.proxy: init at 2024.12.1 --- pkgs/by-name/au/authentik/outposts.nix | 1 + pkgs/by-name/au/authentik/proxy.nix | 21 +++++++++++++++++++++ 2 files changed, 22 insertions(+) create mode 100644 pkgs/by-name/au/authentik/proxy.nix diff --git a/pkgs/by-name/au/authentik/outposts.nix b/pkgs/by-name/au/authentik/outposts.nix index f1d5181609ad..b251368a2869 100644 --- a/pkgs/by-name/au/authentik/outposts.nix +++ b/pkgs/by-name/au/authentik/outposts.nix @@ -1,5 +1,6 @@ { callPackage }: { ldap = callPackage ./ldap.nix { }; + proxy = callPackage ./proxy.nix { }; radius = callPackage ./radius.nix { }; } diff --git a/pkgs/by-name/au/authentik/proxy.nix b/pkgs/by-name/au/authentik/proxy.nix new file mode 100644 index 000000000000..a11adf539aa0 --- /dev/null +++ b/pkgs/by-name/au/authentik/proxy.nix @@ -0,0 +1,21 @@ +{ + buildGoModule, + authentik, +}: + +buildGoModule { + pname = "authentik-proxy-outpost"; + inherit (authentik) version src; + + vendorHash = "sha256-FyRTPs2xfostV2x03IjrxEYBSrsZwnuPn+oHyQq1Kq0="; + + env.CGO_ENABLED = 0; + + subPackages = [ "cmd/proxy" ]; + + meta = authentik.meta // { + description = "Authentik proxy outpost which is used for HTTP reverse proxy authentication"; + homepage = "https://goauthentik.io/docs/providers/proxy/"; + mainProgram = "proxy"; + }; +}