gador/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge branch 'staging' into staging-next

Browse Source 
- the libxml2 issue seemed relatively serious
- changing libxml2 implies rebuilding almost everything
- so we pull also all other `staging` changes with that
  (to waste less machine time)
This commit is contained in:
Vladimír Čunát
2023-12-31 14:58:42 +01:00
parent cc231894b7 36c09a6225
commit 468aed011b
72 changed files with 1075 additions and 532 deletions
Download Patch File Download Diff File Expand all files Collapse all files
nixos/lib/make-options-doc/default.nix
+1 -1
View File
@@ -120,7 +120,7 @@ in rec {
{ meta.description = "List of NixOS options in JSON format";
nativeBuildInputs = [
pkgs.brotli
pkgs.python3Minimal
pkgs.python3
];
options = builtins.toFile "options.json"
(builtins.unsafeDiscardStringContext (builtins.toJSON optionsNix));
nixos/modules/system/boot/timesyncd.nix
+7
View File
@@ -46,6 +46,13 @@ with lib;
wantedBy = [ "sysinit.target" ];
aliases = [ "dbus-org.freedesktop.timesync1.service" ];
restartTriggers = [ config.environment.etc."systemd/timesyncd.conf".source ];
# systemd-timesyncd disables DNSSEC validation in the nss-resolve module by setting SYSTEMD_NSS_RESOLVE_VALIDATE to 0 in the unit file.
# This is required in order to solve the chicken-and-egg problem when DNSSEC validation needs the correct time to work, but to set the
# correct time, we need to connect to an NTP server, which usually requires resolving its hostname.
# In order for nss-resolve to be able to read this environment variable we patch systemd-timesyncd to disable NSCD and use NSS modules directly.
# This means that systemd-timesyncd needs to have NSS modules path in LD_LIBRARY_PATH. When systemd-resolved is disabled we still need to set
# NSS module path so that systemd-timesyncd keeps using other NSS modules that are configured in the system.
environment.LD_LIBRARY_PATH = config.system.nssModules.path;
preStart = (
# Ensure that we have some stored time to prevent
nixos/tests/all-tests.nix
+1
View File
@@ -857,6 +857,7 @@ in {
systemd-shutdown = handleTest ./systemd-shutdown.nix {};
systemd-sysupdate = runTest ./systemd-sysupdate.nix;
systemd-timesyncd = handleTest ./systemd-timesyncd.nix {};
systemd-timesyncd-nscd-dnssec = handleTest ./systemd-timesyncd-nscd-dnssec.nix {};
systemd-user-tmpfiles-rules = handleTest ./systemd-user-tmpfiles-rules.nix {};
systemd-misc = handleTest ./systemd-misc.nix {};
systemd-userdbd = handleTest ./systemd-userdbd.nix {};
nixos/tests/installer.nix
+1 -7
View File
@@ -510,14 +510,8 @@ let
ntp
perlPackages.ListCompare
perlPackages.XMLLibXML
python3Minimal
# make-options-doc/default.nix
(let
self = (pkgs.python3Minimal.override {
inherit self;
includeSiteCustomize = true;
});
in self.withPackages (p: [ p.mistune ]))
python3.withPackages (p: [ p.mistune ])
shared-mime-info
sudo
texinfo
nixos/tests/os-prober.nix
+1 -1
View File
@@ -95,7 +95,7 @@ in {
ntp
perlPackages.ListCompare
perlPackages.XMLLibXML
python3Minimal
python3
shared-mime-info
stdenv
sudo
nixos/tests/systemd-timesyncd-nscd-dnssec.nix
+61
View File
@@ -0,0 +1,61 @@
# This test verifies that systemd-timesyncd can resolve the NTP server hostname when DNSSEC validation
# fails even though it is enforced in the systemd-resolved settings. It is required in order to solve
# the chicken-and-egg problem when DNSSEC validation needs the correct time to work, but to set the
# correct time, we need to connect to an NTP server, which usually requires resolving its hostname.
#
# This test does the following:
# - Sets up a DNS server (tinydns) listening on the eth1 ip addess, serving .ntp and fake.ntp records.
# - Configures that DNS server as a resolver and enables DNSSEC in systemd-resolved settings.
# - Configures systemd-timesyncd to use fake.ntp hostname as an NTP server.
# - Performs a regular DNS lookup, to ensure it fails due to broken DNSSEC.
# - Waits until systemd-timesyncd resolves fake.ntp by checking its debug output.
# Here, we don't expect systemd-timesyncd to connect and synchronize time because there is no NTP
# server running. For this test to succeed, we only need to ensure that systemd-timesyncd
# resolves the IP address of the fake.ntp host.
import ./make-test-python.nix ({ pkgs, ... }:
let
ntpHostname = "fake.ntp";
ntpIP = "192.0.2.1";
in
{
name = "systemd-timesyncd";
nodes.machine = { pkgs, lib, config, ... }:
let
eth1IP = (lib.head config.networking.interfaces.eth1.ipv4.addresses).address;
in
{
# Setup a local DNS server for the NTP domain on the eth1 IP address
services.tinydns = {
enable = true;
ip = eth1IP;
data = ''
.ntp:${eth1IP}
+.${ntpHostname}:${ntpIP}
'';
};
# Enable systemd-resolved with DNSSEC and use the local DNS as a name server
services.resolved.enable = true;
services.resolved.dnssec = "true";
networking.nameservers = [ eth1IP ];
# Configure systemd-timesyncd to use our NTP hostname
services.timesyncd.enable = lib.mkForce true;
services.timesyncd.servers = [ ntpHostname ];
services.timesyncd.extraConfig = ''
FallbackNTP=${ntpHostname}
'';
# The debug output is necessary to determine whether systemd-timesyncd successfully resolves our NTP hostname or not
systemd.services.systemd-timesyncd.environment.SYSTEMD_LOG_LEVEL = "debug";
};
testScript = ''
machine.wait_for_unit("tinydns.service")
machine.wait_for_unit("systemd-timesyncd.service")
machine.fail("resolvectl query ${ntpHostname}")
machine.wait_until_succeeds("journalctl -u systemd-timesyncd.service --grep='Resolved address ${ntpIP}:123 for ${ntpHostname}'")
'';
})
pkgs/applications/misc/audio/sox/default.nix
+2
View File
@@ -79,6 +79,8 @@ stdenv.mkDerivation rec {
++ lib.optional enableLibpulseaudio libpulseaudio
++ lib.optional stdenv.isDarwin CoreAudio;
enableParallelBuilding = true;
meta = with lib; {
description = "Sample Rate Converter for audio";
homepage = "https://sox.sourceforge.net/";
pkgs/build-support/setup-hooks/auto-patchelf.sh
+22 -9
View File
@@ -53,17 +53,30 @@ autoPatchelf() {
esac
done
readarray -td' ' ignoreMissingDepsArray < <(echo -n "$autoPatchelfIgnoreMissingDeps")
if [ "$autoPatchelfIgnoreMissingDeps" == "1" ]; then
echo "autoPatchelf: WARNING: setting 'autoPatchelfIgnoreMissingDeps" \
"= true;' is deprecated and will be removed in a future release." \
"Use 'autoPatchelfIgnoreMissingDeps = [ \"*\" ];' instead." >&2
ignoreMissingDepsArray=( "*" )
if [ -n "$__structuredAttrs" ]; then
local ignoreMissingDepsArray=( "${autoPatchelfIgnoreMissingDeps[@]}" )
local appendRunpathsArray=( "${appendRunpaths[@]}" )
local runtimeDependenciesArray=( "${runtimeDependencies[@]}" )
local patchelfFlagsArray=( "${patchelfFlags[@]}" )
else
readarray -td' ' ignoreMissingDepsArray < <(echo -n "$autoPatchelfIgnoreMissingDeps")
local appendRunpathsArray=($appendRunpaths)
local runtimeDependenciesArray=($runtimeDependencies)
local patchelfFlagsArray=($patchelfFlags)
fi
local appendRunpathsArray=($appendRunpaths)
local runtimeDependenciesArray=($runtimeDependencies)
local patchelfFlagsArray=($patchelfFlags)
# Check if ignoreMissingDepsArray contains "1" and if so, replace it with
# "*", printing a deprecation warning.
for dep in "${ignoreMissingDepsArray[@]}"; do
if [ "$dep" == "1" ]; then
echo "autoPatchelf: WARNING: setting 'autoPatchelfIgnoreMissingDeps" \
"= true;' is deprecated and will be removed in a future release." \
"Use 'autoPatchelfIgnoreMissingDeps = [ \"*\" ];' instead." >&2
ignoreMissingDepsArray=( "*" )
break
fi
done
@pythonInterpreter@ @autoPatchelfScript@ \
${norecurse:+--no-recurse} \
--ignore-missing "${ignoreMissingDepsArray[@]}" \
pkgs/data/misc/tzdata/default.nix
+3 -3
View File
@@ -2,16 +2,16 @@
stdenv.mkDerivation rec {
pname = "tzdata";
version = "2023c";
version = "2023d";
srcs = [
(fetchurl {
url = "https://data.iana.org/time-zones/releases/tzdata${version}.tar.gz";
hash = "sha256-P1ELXRtK6bs45IWqMCp3azF/s2N722QExK33tsrdllw=";
hash = "sha256-28ohlwsKi4wM7O7B17kfqQO+D27KWucytTKWciMqCPM=";
})
(fetchurl {
url = "https://data.iana.org/time-zones/releases/tzcode${version}.tar.gz";
hash = "sha256-RtF/K7Ga1zKQ8DogMAYVLg+g17EeW3FGfEqCOBGyFOc=";
hash = "sha256-6aX54RiIbS3pK2K7BVEKKMxsBY15HJO9a4TTKSw8Fh4=";
})
];
pkgs/development/compilers/ghc/8.10.2-binary.nix
+2
View File
@@ -252,6 +252,8 @@ stdenv.mkDerivation rec {
''
patchShebangs ghc-${version}/utils/
patchShebangs ghc-${version}/configure
test -d ghc-${version}/inplace/bin && \
patchShebangs ghc-${version}/inplace/bin
'' +
# We have to patch the GMP paths for the integer-gmp package.
# Note [musl bindists have no .buildinfo]
pkgs/development/compilers/ghc/8.10.7-binary.nix
+2
View File
@@ -250,6 +250,8 @@ stdenv.mkDerivation rec {
''
patchShebangs ghc-${version}/utils/
patchShebangs ghc-${version}/configure
test -d ghc-${version}/inplace/bin && \
patchShebangs ghc-${version}/inplace/bin
'' +
# We have to patch the GMP paths for the integer-gmp package.
# Note that musl bindists do not contain them,
pkgs/development/compilers/ghc/8.6.5-binary.nix
+2
View File
@@ -102,6 +102,8 @@ stdenv.mkDerivation rec {
''
patchShebangs ghc-${version}/utils/
patchShebangs ghc-${version}/configure
test -d ghc-${version}/inplace/bin && \
patchShebangs ghc-${version}/inplace/bin
'' +
# We have to patch the GMP paths for the integer-gmp package.
pkgs/development/compilers/ghc/9.2.4-binary.nix
+2
View File
@@ -236,6 +236,8 @@ stdenv.mkDerivation rec {
''
patchShebangs ghc-${version}/utils/
patchShebangs ghc-${version}/configure
test -d ghc-${version}/inplace/bin && \
patchShebangs ghc-${version}/inplace/bin
'' +
# We have to patch the GMP paths for the integer-gmp package.
''
pkgs/development/compilers/llvm/11/clang/default.nix
+1 -1
View File
@@ -50,7 +50,7 @@ let
# https://reviews.llvm.org/D51899
./gnu-install-dirs.patch
(substituteAll {
src = ../../clang-11-12-LLVMgold-path.patch;
src = ../../clang-11-15-LLVMgold-path.patch;
libllvmLibdir = "${libllvm.lib}/lib";
})
];
pkgs/development/compilers/llvm/12/clang/default.nix
+1 -1
View File
@@ -47,7 +47,7 @@ let
# https://reviews.llvm.org/D51899
./gnu-install-dirs.patch
(substituteAll {
src = ../../clang-11-12-LLVMgold-path.patch;
src = ../../clang-11-15-LLVMgold-path.patch;
libllvmLibdir = "${libllvm.lib}/lib";
})
];
pkgs/development/compilers/llvm/13/clang/default.nix
+1 -1
View File
@@ -43,7 +43,7 @@ let
./revert-malloc-alignment-assumption.patch
../../common/clang/add-nostdlibinc-flag.patch
(substituteAll {
src = ../../clang-11-12-LLVMgold-path.patch;
src = ../../clang-11-15-LLVMgold-path.patch;
libllvmLibdir = "${libllvm.lib}/lib";
})
];
pkgs/development/compilers/llvm/14/clang/default.nix
+1 -1
View File
@@ -46,7 +46,7 @@ let
./gnu-install-dirs.patch
../../common/clang/add-nostdlibinc-flag.patch
(substituteAll {
src = ../../clang-11-12-LLVMgold-path.patch;
src = ../../clang-11-15-LLVMgold-path.patch;
libllvmLibdir = "${libllvm.lib}/lib";
})
];
pkgs/development/compilers/llvm/15/clang/default.nix
+1 -1
View File
@@ -52,7 +52,7 @@ let
./gnu-install-dirs.patch
../../common/clang/add-nostdlibinc-flag.patch
(substituteAll {
src = ../../clang-11-12-LLVMgold-path.patch;
src = ../../clang-11-15-LLVMgold-path.patch;
libllvmLibdir = "${libllvm.lib}/lib";
})
];
pkgs/development/compilers/llvm/16/clang/default.nix
+5 -6
View File
@@ -1,6 +1,6 @@
{ lib, stdenv, llvm_meta
, monorepoSrc, runCommand
, cmake, ninja, libxml2, libllvm, version, python3
, substituteAll, cmake, ninja, libxml2, libllvm, version, python3
, buildLlvmTools
, fixDarwinDylibNames
, enableManpages ? false
@@ -51,11 +51,10 @@ let
# https://reviews.llvm.org/D51899
./gnu-install-dirs.patch
../../common/clang/add-nostdlibinc-flag.patch
# FIMXE: do we need this patch?
# (substituteAll {
# src = ../../clang-11-12-LLVMgold-path.patch;
# libllvmLibdir = "${libllvm.lib}/lib";
# })
(substituteAll {
src = ../../clang-at-least-16-LLVMgold-path.patch;
libllvmLibdir = "${libllvm.lib}/lib";
})
];
postPatch = ''
pkgs/development/compilers/llvm/16/llvm/default.nix
+2 -1
View File
@@ -325,7 +325,8 @@ in
"-DSPHINX_OUTPUT_MAN=ON"
"-DSPHINX_OUTPUT_HTML=OFF"
"-DSPHINX_WARNINGS_AS_ERRORS=OFF"
] ++ optionals (false) [
] ++ optionals enableGoldPlugin [
# For LLVMgold plugin
"-DLLVM_BINUTILS_INCDIR=${libbfd.dev}/include"
] ++ optionals isDarwin [
"-DLLVM_ENABLE_LIBCXX=ON"
pkgs/development/compilers/llvm/17/clang/default.nix
+5 -6
View File
@@ -1,6 +1,6 @@
{ lib, stdenv, llvm_meta
, monorepoSrc, runCommand
, cmake, ninja, libxml2, libllvm, version, python3
, substituteAll, cmake, ninja, libxml2, libllvm, version, python3
, buildLlvmTools
, fixDarwinDylibNames
, enableManpages ? false
@@ -52,11 +52,10 @@ let
# https://reviews.llvm.org/D51899
./gnu-install-dirs.patch
../../common/clang/add-nostdlibinc-flag.patch
# FIMXE: do we need this patch?
# (substituteAll {
# src = ../../clang-11-12-LLVMgold-path.patch;
# libllvmLibdir = "${libllvm.lib}/lib";
# })
(substituteAll {
src = ../../clang-at-least-16-LLVMgold-path.patch;
libllvmLibdir = "${libllvm.lib}/lib";
})
];
postPatch = ''
pkgs/development/compilers/llvm/17/llvm/default.nix
+5 -5
View File
@@ -8,8 +8,7 @@
, python3
, python3Packages
, libffi
# TODO: Gold plugin on LLVM16 has a severe memory corruption bug: https://github.com/llvm/llvm-project/issues/61350.
, enableGoldPlugin ? false
, enableGoldPlugin ? true
, libbfd
, libpfm
, libxml2
@@ -66,8 +65,8 @@ let
else python3;
in
assert (lib.assertMsg (!enableGoldPlugin) "Gold plugin cannot be enabled on LLVM16 due to a upstream issue: https://github.com/llvm/llvm-project/issues/61350");
stdenv.mkDerivation (rec {
stdenv.mkDerivation (rec {
pname = "llvm";
inherit version;
@@ -325,7 +324,8 @@ in
"-DSPHINX_OUTPUT_MAN=ON"
"-DSPHINX_OUTPUT_HTML=OFF"
"-DSPHINX_WARNINGS_AS_ERRORS=OFF"
] ++ optionals (false) [
] ++ optionals enableGoldPlugin [
# For LLVMgold plugin
"-DLLVM_BINUTILS_INCDIR=${libbfd.dev}/include"
] ++ optionals isDarwin [
"-DLLVM_ENABLE_LIBCXX=ON"
pkgs/development/compilers/llvm/clang-11-12-LLVMgold-path.patch → pkgs/development/compilers/llvm/clang-11-15-LLVMgold-path.patch
View File
pkgs/development/compilers/llvm/clang-at-least-16-LLVMgold-path.patch
+14
View File
@@ -0,0 +1,14 @@
diff --git a/lib/Driver/ToolChains/CommonArgs.cpp b/lib/Driver/ToolChains/CommonArgs.cpp
index 34640b3c450d..93c4a4f4ec5c 100644
--- a/lib/Driver/ToolChains/CommonArgs.cpp
+++ b/lib/Driver/ToolChains/CommonArgs.cpp
@@ -589,8 +589,7 @@ void tools::addLTOOptions(const ToolChain &ToolChain, const ArgList &Args,
#endif
SmallString<1024> Plugin;
- llvm::sys::path::native(Twine(D.Dir) +
- "/../" CLANG_INSTALL_LIBDIR_BASENAME +
+ llvm::sys::path::native(Twine("@libllvmLibdir@") +
PluginName + Suffix,
Plugin);
CmdArgs.push_back(Args.MakeArgString(Twine(PluginPrefix) + Plugin));
pkgs/development/compilers/llvm/git/clang/default.nix
+5 -6
View File
@@ -1,6 +1,6 @@
{ lib, stdenv, llvm_meta
, monorepoSrc, runCommand
, cmake, ninja, libxml2, libllvm, version, python3
, substituteAll, cmake, ninja, libxml2, libllvm, version, python3
, buildLlvmTools
, fixDarwinDylibNames
, enableManpages ? false
@@ -52,11 +52,10 @@ let
# https://reviews.llvm.org/D51899
./gnu-install-dirs.patch
../../common/clang/add-nostdlibinc-flag.patch
# FIMXE: do we need this patch?
# (substituteAll {
# src = ../../clang-11-12-LLVMgold-path.patch;
# libllvmLibdir = "${libllvm.lib}/lib";
# })
(substituteAll {
src = ../../clang-at-least-16-LLVMgold-path.patch;
libllvmLibdir = "${libllvm.lib}/lib";
})
];
postPatch = ''
pkgs/development/compilers/llvm/git/llvm/default.nix
+4 -5
View File
@@ -8,8 +8,7 @@
, python3
, python3Packages
, libffi
# TODO: Gold plugin on LLVM16 has a severe memory corruption bug: https://github.com/llvm/llvm-project/issues/61350.
, enableGoldPlugin ? false
, enableGoldPlugin ? true
, libbfd
, libpfm
, libxml2
@@ -66,8 +65,8 @@ let
else python3;
in
assert (lib.assertMsg (!enableGoldPlugin) "Gold plugin cannot be enabled on LLVM16 due to a upstream issue: https://github.com/llvm/llvm-project/issues/61350");
stdenv.mkDerivation (rec {
stdenv.mkDerivation (rec {
pname = "llvm";
inherit version;
@@ -325,7 +324,7 @@ in
"-DSPHINX_OUTPUT_MAN=ON"
"-DSPHINX_OUTPUT_HTML=OFF"
"-DSPHINX_WARNINGS_AS_ERRORS=OFF"
] ++ optionals (false) [
] ++ optionals enableGoldPlugin [
"-DLLVM_BINUTILS_INCDIR=${libbfd.dev}/include"
] ++ optionals isDarwin [
"-DLLVM_ENABLE_LIBCXX=ON"
pkgs/development/compilers/rust/1_74.nix
-61
View File
@@ -1,61 +0,0 @@
# New rust versions should first go to staging.
# Things to check after updating:
# 1. Rustc should produce rust binaries on x86_64-linux, aarch64-linux and x86_64-darwin:
# i.e. nix-shell -p fd or @GrahamcOfBorg build fd on github
# This testing can be also done by other volunteers as part of the pull
# request review, in case platforms cannot be covered.
# 2. The LLVM version used for building should match with rust upstream.
# Check the version number in the src/llvm-project git submodule in:
# https://github.com/rust-lang/rust/blob/<version-tag>/.gitmodules
# 3. Firefox and Thunderbird should still build on x86_64-linux.
{ stdenv, lib
, buildPackages
, targetPackages
, newScope, callPackage
, CoreFoundation, Security, SystemConfiguration
, pkgsBuildTarget, pkgsBuildBuild, pkgsBuildHost
, makeRustPlatform
, wrapRustcWith
, llvmPackages_16, llvm_16
} @ args:
import ./default.nix {
rustcVersion = "1.74.1";
rustcSha256 = "sha256-Z9s+IvyZIciFuq5ZU7oUT8R0zeKexpq1bUPOdkIGIx0=";
llvmSharedForBuild = pkgsBuildBuild.llvmPackages_16.libllvm.override { enableSharedLibraries = true; };
llvmSharedForHost = pkgsBuildHost.llvmPackages_16.libllvm.override { enableSharedLibraries = true; };
llvmSharedForTarget = pkgsBuildTarget.llvmPackages_16.libllvm.override { enableSharedLibraries = true; };
# For use at runtime
llvmShared = llvm_16.override { enableSharedLibraries = true; };
# Expose llvmPackages used for rustc from rustc via passthru for LTO in Firefox
llvmPackages = llvmPackages_16;
# Note: the version MUST be one version prior to the version we're
# building
bootstrapVersion = "1.73.0";
# fetch hashes by running `print-hashes.sh ${bootstrapVersion}`
bootstrapHashes = {
i686-unknown-linux-gnu = "6a088acbbda734d27e8b431499f1d746de7781673b88fead3aeae072be1d1a5a";
x86_64-unknown-linux-gnu = "aa4cf0b7e66a9f5b7c623d4b340bb1ac2864a5f2c2b981f39f796245dc84f2cb";
x86_64-unknown-linux-musl = "c888457d106ccd40288ca8db1cb966b23d719c9a128daca701ecc574c53773d4";
arm-unknown-linux-gnueabihf = "9c29bb42786aedbb16ea71564eb06068a8b01cca6c6b8857f0c37f91dfba7134";
armv7-unknown-linux-gnueabihf = "092b32b82c602c18279d76d9a96763e85030aa62cda64c1bc73fc1f6355bb99c";
aarch64-unknown-linux-gnu = "e54d7d886ba413ae573151f668e76ea537f9a44406d3d29598269a4a536d12f6";
aarch64-unknown-linux-musl = "f4e9ff895aa55558777585ad4debe2ccf3c0298cb5d65db67814f62428de4a5b";
x86_64-apple-darwin = "ece9646bb153d4bc0f7f1443989de0cbcd8989a7d0bf3b7fb9956e1223954f0c";
aarch64-apple-darwin = "9c96e4c57328fb438ee2d87aa75970ce89b4426b49780ccb3c16af0d7c617cc6";
powerpc64le-unknown-linux-gnu = "8fa215ee3e274fb64364e7084613bc570369488fa22cf5bc8e0fe6dc810fe2b9";
riscv64gc-unknown-linux-gnu = "381379a2381835428b2e7a396b3046581517356b7cc851e39e385aebd5700623";
};
selectRustPackage = pkgs: pkgs.rust_1_74;
rustcPatches = [ ];
}
(builtins.removeAttrs args [ "pkgsBuildTarget" "pkgsBuildHost" "llvmPackages_16" "llvm_16"])
pkgs/development/compilers/rust/1_75.nix
+61
View File
@@ -0,0 +1,61 @@
# New rust versions should first go to staging.
# Things to check after updating:
# 1. Rustc should produce rust binaries on x86_64-linux, aarch64-linux and x86_64-darwin:
# i.e. nix-shell -p fd or @GrahamcOfBorg build fd on github
# This testing can be also done by other volunteers as part of the pull
# request review, in case platforms cannot be covered.
# 2. The LLVM version used for building should match with rust upstream.
# Check the version number in the src/llvm-project git submodule in:
# https://github.com/rust-lang/rust/blob/<version-tag>/.gitmodules
# 3. Firefox and Thunderbird should still build on x86_64-linux.
{ stdenv, lib
, buildPackages
, targetPackages
, newScope, callPackage
, CoreFoundation, Security, SystemConfiguration
, pkgsBuildTarget, pkgsBuildBuild, pkgsBuildHost
, makeRustPlatform
, wrapRustcWith
, llvmPackages_17, llvm_17
} @ args:
import ./default.nix {
rustcVersion = "1.75.0";
rustcSha256 = "sha256-W3OfRbydNB4tHFcNZdI3VZHiLC0j71uKN3EaA4arwIg=";
llvmSharedForBuild = pkgsBuildBuild.llvmPackages_17.libllvm.override { enableSharedLibraries = true; };
llvmSharedForHost = pkgsBuildHost.llvmPackages_17.libllvm.override { enableSharedLibraries = true; };
llvmSharedForTarget = pkgsBuildTarget.llvmPackages_17.libllvm.override { enableSharedLibraries = true; };
# For use at runtime
llvmShared = llvm_17.override { enableSharedLibraries = true; };
# Expose llvmPackages used for rustc from rustc via passthru for LTO in Firefox
llvmPackages = llvmPackages_17;
# Note: the version MUST be one version prior to the version we're
# building
bootstrapVersion = "1.74.1";
# fetch hashes by running `print-hashes.sh ${bootstrapVersion}`
bootstrapHashes = {
i686-unknown-linux-gnu = "b883b98372c91bc6aa9dc6ebb2b4e02e7dacbbc2ac1ebe55923dc37134df70a4";
x86_64-unknown-linux-gnu = "d206888a2a9d55113940151ba16117ce2456d7de021bab18cfcb06dc48d3157c";
x86_64-unknown-linux-musl = "5af3115a1f16431630f288821bd7f3be8cf7e08a7611b3c3bce3976774aa6cd2";
arm-unknown-linux-gnueabihf = "1dd7d835af4afe9adb7f785046c907090ace66f1c975cfe9e8886847310d8ec9";
armv7-unknown-linux-gnueabihf = "a5038ae004bf86eed64ef67329f7ba047bb4d188663bfd260320d53a2fed33c4";
aarch64-unknown-linux-gnu = "0dbdfce647f3c7d9ff00a7aa5d6dbbd7010486f803a9749cff46189f5ecb438c";
aarch64-unknown-linux-musl = "02674b8e4311780464313c5773d43606fbf6880d5c4512930d59b6d5d369f0de";
x86_64-apple-darwin = "54e1ef01d73f6031fbee36bbecd9af4209eb682dea478696e8282ca64d5792e5";
aarch64-apple-darwin = "af6a982cbed85807fb8e5c4ba85b8a76162b58945f4787e0a7dec32e901e8b3b";
powerpc64le-unknown-linux-gnu = "bb1c9f0ab1016a2817afe8f72c03f8f1787fe44d0f9999669e0c1957a08e6213";
riscv64gc-unknown-linux-gnu = "86561a8d630f634fdd7cb5899d40027103c907d9763a32770b7e2fd57dbd8473";
};
selectRustPackage = pkgs: pkgs.rust_1_75;
rustcPatches = [ ];
}
(builtins.removeAttrs args [ "pkgsBuildTarget" "pkgsBuildHost" "llvmPackages_17" "llvm_17"])
pkgs/development/compilers/spirv-llvm-translator/default.nix
+13 -6
View File
@@ -29,11 +29,11 @@ let
rev = "v${version}";
hash = "sha256-OsDohXRxovtEXaWiRGp8gJ0dXmoALyO+ZimeSO8aPVI=";
} else if llvmMajor == "14" then rec{
version = "14.0.0";
rev = "v${version}";
hash = "sha256-BhNAApgZ/w/92XjpoDY6ZEIhSTwgJ4D3/EfNvPmNM2o=";
version = "14.0.0+unstable-2023-06-22";
rev = "23f398bf369093b1fd67459db8071ffcc6b92658";
hash = "sha256-o7cVj5/ZMER2CvfxL4pRb2qCIxC/HFUPiitf2fKtCyk=";
} else if llvmMajor == "11" then {
version = "unstable-2022-05-04";
version = "11.0.0+unstable-2022-05-04";
rev = "4ef524240833abfeee1c5b9fff6b1bd53f4806b3"; # 267 commits ahead of v11.0.0
hash = "sha256-NoIoa20+2sH41rEnr8lsMhtfesrtdPINiXtUnxYVm8s=";
} else throw "Incompatible LLVM version.";
@@ -48,12 +48,19 @@ disable-warnings-if-gcc13 (stdenv.mkDerivation {
inherit (branch) rev hash;
};
patches = lib.optionals (llvmMajor == "16")[
patches = lib.optionals (llvmMajor == "16") [
# Fixes builds that link against external LLVM dynamic library
(fetchpatch {
url = "https://github.com/KhronosGroup/SPIRV-LLVM-Translator/commit/f3b9b604d7eda18d0d1029d94a6eebd33aa3a3fe.patch";
hash = "sha256-opDjyZcy7O4wcSfm/A51NCIiDyIvbcmbv9ns1njdJbc=";
})
] ++ lib.optionals (llvmMajor == "14") [
(fetchpatch {
# tries to install llvm-spirv into llvm nix store path
url = "https://github.com/KhronosGroup/SPIRV-LLVM-Translator/commit/cce9a2f130070d799000cac42fe24789d2b777ab.patch";
revert = true;
hash = "sha256-GbFacttZRDCgA0jkUoFA4/B3EDn3etweKvM09OwICJ8=";
})
];
nativeBuildInputs = [ pkg-config cmake ]
@@ -71,7 +78,7 @@ disable-warnings-if-gcc13 (stdenv.mkDerivation {
"-DLLVM_SPIRV_BUILD_EXTERNAL=YES"
# RPATH of binary /nix/store/.../bin/llvm-spirv contains a forbidden reference to /build/
"-DCMAKE_SKIP_BUILD_RPATH=ON"
] ++ lib.optionals (llvmMajor != "11") [ "-DLLVM_EXTERNAL_SPIRV_HEADERS_SOURCE_DIR=${spirv-headers.src}" ];
] ++ lib.optional (llvmMajor != "11") "-DLLVM_EXTERNAL_SPIRV_HEADERS_SOURCE_DIR=${spirv-headers.src}";
# FIXME: CMake tries to run "/llvm-lit" which of course doesn't exist
doCheck = false;
pkgs/development/interpreters/ruby/default.nix
-1
View File
@@ -148,7 +148,6 @@ let
postUnpack = opString rubygemsSupport ''
rm -rf $sourceRoot/{lib,test}/rubygems*
cp -r ${rubygems}/lib/rubygems* $sourceRoot/lib
cp -r ${rubygems}/test/rubygems $sourceRoot/test
'';
postPatch = ''
pkgs/development/interpreters/ruby/rubygems/0002-binaries-with-env-shebang.patch
+6 -6
View File
@@ -14,15 +14,15 @@ diff --git a/lib/rubygems/dependency_installer.rb b/lib/rubygems/dependency_inst
index 34620860..00ab31d9 100644
--- a/lib/rubygems/dependency_installer.rb
+++ b/lib/rubygems/dependency_installer.rb
@@ -18,7 +18,7 @@ class Gem::DependencyInstaller
@@ -17,7 +17,7 @@ class Gem::DependencyInstaller
extend Gem::Deprecate
DEFAULT_OPTIONS = { # :nodoc:
- :env_shebang => false,
+ :env_shebang => true,
:document => %w[ri],
:domain => :both, # HACK dup
:force => false,
- env_shebang: false,
+ env_shebang: true,
document: %w[ri],
domain: :both, # HACK: dup
force: false,
--
2.21.0
pkgs/development/interpreters/ruby/rubygems/0003-gem-install-default-to-user.patch
+5 -5
View File
@@ -12,15 +12,15 @@ diff --git a/lib/rubygems/path_support.rb b/lib/rubygems/path_support.rb
index ed680d65..749b9ea6 100644
--- a/lib/rubygems/path_support.rb
+++ b/lib/rubygems/path_support.rb
@@ -23,7 +23,7 @@ class Gem::PathSupport
@@ -24,7 +24,7 @@ class Gem::PathSupport
# hashtable, or defaults to ENV, the system environment.
#
def initialize(env)
- @home = env["GEM_HOME"] || Gem.default_dir
+ @home = env["GEM_HOME"] || Gem.user_dir
- @home = normalize_home_dir(env["GEM_HOME"] || Gem.default_dir)
+ @home = normalize_home_dir(env["GEM_HOME"] || Gem.user_dir || Gem.default_dir)
@path = split_gem_path env["GEM_PATH"], @home
if File::ALT_SEPARATOR
@home = @home.gsub(File::ALT_SEPARATOR, File::SEPARATOR)
@spec_cache_dir = env["GEM_SPEC_CACHE"] || Gem.default_spec_cache_dir
--
2.21.0
pkgs/development/interpreters/ruby/rubygems/default.nix
+2 -2
View File
@@ -2,11 +2,11 @@
stdenv.mkDerivation rec {
pname = "rubygems";
version = "3.4.22";
version = "3.5.3";
src = fetchurl {
url = "https://rubygems.org/rubygems/rubygems-${version}.tgz";
hash = "sha256-gD+nd3bRHT0btWOCZhbIERJEJeAzGtH9mDxBRARqYVY=";
hash = "sha256-8xFe6AgJkvJXwBYbgR4HsBLyAXXtiTSfsayYl33cXJw=";
};
patches = [
pkgs/development/libraries/aspell/default.nix
+4 -11
View File
@@ -1,4 +1,4 @@
{ lib, stdenv, fetchurl, fetchpatch, fetchzip, perl, ncurses
{ lib, stdenv, fetchurl, fetchzip, perl, ncurses
# for tests
, aspell, glibc, runCommand
@@ -20,21 +20,14 @@ in
stdenv.mkDerivation rec {
pname = "aspell";
version = "0.60.8";
version = "0.60.8.1";
src = fetchurl {
url = "mirror://gnu/aspell/aspell-${version}.tar.gz";
sha256 = "1wi60ankalmh8ds7nplz434jd7j94gdvbahdwsr539rlad8pxdzr";
hash = "sha256-1toSs01C1Ff6YE5DWtSEp0su/80SD/QKzWuz+yiH0hs=";
};
patches = [
(fetchpatch {
# objstack: assert that the alloc size will fit within a chunk
name = "CVE-2019-25051.patch";
url = "https://github.com/gnuaspell/aspell/commit/0718b375425aad8e54e1150313b862e4c6fd324a.patch";
sha256 = "03z259xrk41x3j190gaprf3mqysyfgh3a04rjmch3h625vj95x39";
})
] ++ lib.optional searchNixProfiles ./data-dirs-from-nix-profiles.patch;
patches = lib.optional searchNixProfiles ./data-dirs-from-nix-profiles.patch;
postPatch = ''
patch interfaces/cc/aspell.h < ${./clang.patch}
pkgs/development/libraries/audio/lilv/default.nix
+5 -1
View File
@@ -31,7 +31,11 @@ stdenv.mkDerivation rec {
buildInputs = [ libsndfile serd sord sratom ];
propagatedBuildInputs = [ lv2 ];
mesonFlags = [ "-Ddocs=disabled" ];
mesonFlags = [
"-Ddocs=disabled"
# Tests require building a shared library.
(lib.mesonEnable "tests" (!stdenv.hostPlatform.isStatic))
];
passthru = {
tests = {
pkgs/development/libraries/gtk/3.x.nix
+2 -2
View File
@@ -64,7 +64,7 @@ in
stdenv.mkDerivation (finalAttrs: {
pname = "gtk+3";
version = "3.24.38";
version = "3.24.39";
outputs = [ "out" "dev" ] ++ lib.optional withIntrospection "devdoc";
outputBin = "dev";
@@ -78,7 +78,7 @@ stdenv.mkDerivation (finalAttrs: {
inherit (finalAttrs) version;
in fetchurl {
url = "mirror://gnome/sources/gtk+/${lib.versions.majorMinor version}/gtk+-${version}.tar.xz";
sha256 = "sha256-zhHezwGLJb3YUFVEpPhyQoVOyIvgVNmt5fOiBETdjuc=";
sha256 = "sha256-HKw+VmubLzZTpFjAjC3N/cqfkIA3rAPJ2FZLQpV3jXk=";
};
patches = [
pkgs/development/libraries/jbig2dec/default.nix
-4
View File
@@ -13,10 +13,6 @@ stdenv.mkDerivation rec {
patchShebangs test_jbig2dec.py
'';
preConfigure = ''
./autogen.sh
'';
nativeBuildInputs = [ autoconf automake libtool ];
# `autogen.sh` runs `configure`, and expects that any flags needed
pkgs/development/libraries/json-c/default.nix
+13 -16
View File
@@ -1,24 +1,20 @@
{ lib, stdenv, fetchFromGitHub, fetchpatch, cmake }:
{ lib
, stdenv
, fetchFromGitHub
, cmake
}:
stdenv.mkDerivation rec {
stdenv.mkDerivation (finalAttrs: {
pname = "json-c";
version = "0.16";
version = "0.17";
src = fetchFromGitHub {
owner = "json-c";
repo = "json-c";
rev = "json-c-0.16-20220414";
sha256 = "sha256-KbnUWLgpg6/1wvXhUoYswyqDcgiwEcvgaWCPjNcX20o=";
rev = "json-c-0.17-20230812";
hash = "sha256-R5KIJ0xVgGqffjzJaZvvvhAneJ+ZBuanyF6KYTTxb58=";
};
patches = [
# needed for emscripten, which uses LLVM 15+
(fetchpatch {
url = "https://github.com/json-c/json-c/commit/6eca65617aacd19f4928acd5766b8dd20eda0b34.patch";
sha256 = "sha256-fyugX+HgYlt/4AVtfNDaKS+blyUt8JYTNqkmhURb9dk=";
})
];
outputs = [ "out" "dev" ];
nativeBuildInputs = [ cmake ];
@@ -31,9 +27,10 @@ stdenv.mkDerivation rec {
and parse JSON formatted strings back into the C representation of JSON
objects.
'';
homepage = "https://github.com/json-c/json-c/wiki";
homepage = "https://github.com/json-c/json-c/wiki";
changelog = "https://github.com/json-c/json-c/blob/${finalAttrs.src.rev}/ChangeLog";
maintainers = with maintainers; [ lovek323 ];
platforms = platforms.unix;
platforms = platforms.unix;
license = licenses.mit;
};
}
})
pkgs/development/libraries/lcms2/default.nix
+2 -2
View File
@@ -2,11 +2,11 @@
stdenv.mkDerivation rec {
pname = "lcms2";
version = "2.15";
version = "2.16";
src = fetchurl {
url = "mirror://sourceforge/lcms/${pname}-${version}.tar.gz";
sha256 = "sha256-sgy8vQ9QNDO+Kk6BRiEG+mEFCjUHTcJKTjVnktlxqzk=";
hash = "sha256-2HPTSti5tM6gEGMfGmIo0gh0deTcXnY+uBrMI9nUWlE=";
};
outputs = [ "bin" "dev" "out" ];
pkgs/development/libraries/libao/default.nix
+11 -1
View File
@@ -1,4 +1,5 @@
{ stdenv, lib, fetchFromGitHub, autoreconfHook, pkg-config, libpulseaudio, alsa-lib, libcap
{ stdenv, lib, fetchFromGitHub, fetchpatch
, autoreconfHook, pkg-config, libpulseaudio, alsa-lib, libcap
, CoreAudio, CoreServices, AudioUnit
, usePulseAudio }:
@@ -14,6 +15,15 @@ stdenv.mkDerivation rec {
sha256 = "0svgk4sc9kdhcsfyvbvgm5vpbg3sfr6z5rliflrw49v3x2i4vxq5";
};
patches = [
# add header time.h for nanosecond
(fetchpatch {
name = "nanosecond-header.patch";
url = "https://github.com/xiph/libao/commit/1f998f5d6d77674dad01b181811638578ad68242.patch";
hash = "sha256-cvlyhQq1YS4pVya44LfsKD1R6iSOONsHJGRbP5LlanQ=";
})
];
configureFlags = [
"--disable-broken-oss"
"--enable-alsa-mmap"
pkgs/development/libraries/libde265/default.nix
+2 -2
View File
@@ -14,14 +14,14 @@
}:
stdenv.mkDerivation (finalAttrs: rec {
version = "1.0.14";
version = "1.0.15";
pname = "libde265";
src = fetchFromGitHub {
owner = "strukturag";
repo = "libde265";
rev = "refs/tags/v${version}";
hash = "sha256-aZRtF4wYWxi/6ORNu7yVxFFdkvJTvBwPinL5lC0Mlqg=";
hash = "sha256-guiLM4RNe5O0qpeCoQUbs1Z7j0wp8iK9za2+6NIB8yY=";
};
nativeBuildInputs = [ cmake pkg-config ];
pkgs/development/libraries/libdrm/default.nix
+2 -2
View File
@@ -6,11 +6,11 @@
stdenv.mkDerivation rec {
pname = "libdrm";
version = "2.4.118";
version = "2.4.119";
src = fetchurl {
url = "https://dri.freedesktop.org/${pname}/${pname}-${version}.tar.xz";
hash = "sha256-p3e9hfK1/JxX+IbIIFgwBXgxfK/bx30Kdp1+mpVnq4g=";
hash = "sha256-CknxLwm1tuaOqq/z8Cynz/mqkmk5shLTQxYdPorFYpE=";
};
outputs = [ "out" "dev" "bin" ];
pkgs/development/libraries/libimobiledevice/default.nix
+11
View File
@@ -1,6 +1,7 @@
{ lib
, stdenv
, fetchFromGitHub
, fetchpatch
, autoreconfHook
, pkg-config
, openssl
@@ -26,6 +27,16 @@ stdenv.mkDerivation rec {
hash = "sha256-mIsB+EaGJlGMOpz3OLrs0nAmhOY1BwMs83saFBaejwc=";
};
patches = [
# Pull upstream fix for clang-16 and upcoming gcc-14 support:
# https://github.com/libimobiledevice/libimobiledevice/pull/1444
(fetchpatch {
name = "usleep-decl.patch";
url = "https://github.com/libimobiledevice/libimobiledevice/commit/db623184c0aa09c27697f5a2e81025db223075d5.patch";
hash = "sha256-TgdgBkEDXzQDSgJxcZc+pZncfmBVXarhHOByGFs6p0Q=";
})
];
nativeBuildInputs = [
autoreconfHook
pkg-config
pkgs/development/libraries/libseccomp/default.nix
+2 -2
View File
@@ -2,11 +2,11 @@
stdenv.mkDerivation rec {
pname = "libseccomp";
version = "2.5.4";
version = "2.5.5";
src = fetchurl {
url = "https://github.com/seccomp/libseccomp/releases/download/v${version}/libseccomp-${version}.tar.gz";
sha256 = "sha256-2CkCQAQFzwBoV07z3B/l9ZJiB1Q7oa5vjnoVdjUdy9s=";
hash = "sha256-JIosik2bmFiqa69ScSw0r+/PnJ6Ut23OAsHJqiX7M3U=";
};
outputs = [ "out" "lib" "dev" "man" "pythonsrc" ];
pkgs/development/libraries/libssh2/CVE-2023-48795.patch
+459
View File
@@ -0,0 +1,459 @@
From d34d9258b8420b19ec3f97b4cc5bf7aa7d98e35a Mon Sep 17 00:00:00 2001
From: Michael Buckley <michael@buckleyisms.com>
Date: Thu, 30 Nov 2023 15:08:02 -0800
Subject: [PATCH] src: add 'strict KEX' to fix CVE-2023-48795 "Terrapin Attack"
Refs:
https://terrapin-attack.com/
https://seclists.org/oss-sec/2023/q4/292
https://osv.dev/list?ecosystem=&q=CVE-2023-48795
https://github.com/advisories/GHSA-45x7-px36-x8w8
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-48795
Fixes #1290
Closes #1291
---
src/kex.c | 63 +++++++++++++++++++++++------------
src/libssh2_priv.h | 18 +++++++---
src/packet.c | 83 +++++++++++++++++++++++++++++++++++++++++++---
src/packet.h | 2 +-
src/session.c | 3 ++
src/transport.c | 12 ++++++-
6 files changed, 149 insertions(+), 32 deletions(-)
diff --git a/src/kex.c b/src/kex.c
index 8e7b7f0af3..a7b301e157 100644
--- a/src/kex.c
+++ b/src/kex.c
@@ -3032,6 +3032,13 @@ kex_method_extension_negotiation = {
0,
};
+static const LIBSSH2_KEX_METHOD
+kex_method_strict_client_extension = {
+ "kex-strict-c-v00@openssh.com",
+ NULL,
+ 0,
+};
+
static const LIBSSH2_KEX_METHOD *libssh2_kex_methods[] = {
#if LIBSSH2_ED25519
&kex_method_ssh_curve25519_sha256,
@@ -3050,6 +3057,7 @@ static const LIBSSH2_KEX_METHOD *libssh2_kex_methods[] = {
&kex_method_diffie_helman_group1_sha1,
&kex_method_diffie_helman_group_exchange_sha1,
&kex_method_extension_negotiation,
+ &kex_method_strict_client_extension,
NULL
};
@@ -3302,13 +3310,13 @@ static int kexinit(LIBSSH2_SESSION * session)
return 0;
}
-/* kex_agree_instr
+/* _libssh2_kex_agree_instr
* Kex specific variant of strstr()
* Needle must be preceded by BOL or ',', and followed by ',' or EOL
*/
-static unsigned char *
-kex_agree_instr(unsigned char *haystack, size_t haystack_len,
- const unsigned char *needle, size_t needle_len)
+unsigned char *
+_libssh2_kex_agree_instr(unsigned char *haystack, size_t haystack_len,
+ const unsigned char *needle, size_t needle_len)
{
unsigned char *s;
unsigned char *end_haystack;
@@ -3393,7 +3401,7 @@ static int kex_agree_hostkey(LIBSSH2_SESSION * session,
while(s && *s) {
unsigned char *p = (unsigned char *) strchr((char *) s, ',');
size_t method_len = (p ? (size_t)(p - s) : strlen((char *) s));
- if(kex_agree_instr(hostkey, hostkey_len, s, method_len)) {
+ if(_libssh2_kex_agree_instr(hostkey, hostkey_len, s, method_len)) {
const LIBSSH2_HOSTKEY_METHOD *method =
(const LIBSSH2_HOSTKEY_METHOD *)
kex_get_method_by_name((char *) s, method_len,
@@ -3427,9 +3435,9 @@ static int kex_agree_hostkey(LIBSSH2_SESSION * session,
}
while(hostkeyp && (*hostkeyp) && (*hostkeyp)->name) {
- s = kex_agree_instr(hostkey, hostkey_len,
- (unsigned char *) (*hostkeyp)->name,
- strlen((*hostkeyp)->name));
+ s = _libssh2_kex_agree_instr(hostkey, hostkey_len,
+ (unsigned char *) (*hostkeyp)->name,
+ strlen((*hostkeyp)->name));
if(s) {
/* So far so good, but does it suit our purposes? (Encrypting vs
Signing) */
@@ -3463,6 +3471,12 @@ static int kex_agree_kex_hostkey(LIBSSH2_SESSION * session, unsigned char *kex,
{
const LIBSSH2_KEX_METHOD **kexp = libssh2_kex_methods;
unsigned char *s;
+ const unsigned char *strict =
+ (unsigned char *)"kex-strict-s-v00@openssh.com";
+
+ if(_libssh2_kex_agree_instr(kex, kex_len, strict, 28)) {
+ session->kex_strict = 1;
+ }
if(session->kex_prefs) {
s = (unsigned char *) session->kex_prefs;
@@ -3470,7 +3484,7 @@ static int kex_agree_kex_hostkey(LIBSSH2_SESSION * session, unsigned char *kex,
while(s && *s) {
unsigned char *q, *p = (unsigned char *) strchr((char *) s, ',');
size_t method_len = (p ? (size_t)(p - s) : strlen((char *) s));
- q = kex_agree_instr(kex, kex_len, s, method_len);
+ q = _libssh2_kex_agree_instr(kex, kex_len, s, method_len);
if(q) {
const LIBSSH2_KEX_METHOD *method = (const LIBSSH2_KEX_METHOD *)
kex_get_method_by_name((char *) s, method_len,
@@ -3504,9 +3518,9 @@ static int kex_agree_kex_hostkey(LIBSSH2_SESSION * session, unsigned char *kex,
}
while(*kexp && (*kexp)->name) {
- s = kex_agree_instr(kex, kex_len,
- (unsigned char *) (*kexp)->name,
- strlen((*kexp)->name));
+ s = _libssh2_kex_agree_instr(kex, kex_len,
+ (unsigned char *) (*kexp)->name,
+ strlen((*kexp)->name));
if(s) {
/* We've agreed on a key exchange method,
* Can we agree on a hostkey that works with this kex?
@@ -3550,7 +3564,7 @@ static int kex_agree_crypt(LIBSSH2_SESSION * session,
unsigned char *p = (unsigned char *) strchr((char *) s, ',');
size_t method_len = (p ? (size_t)(p - s) : strlen((char *) s));
- if(kex_agree_instr(crypt, crypt_len, s, method_len)) {
+ if(_libssh2_kex_agree_instr(crypt, crypt_len, s, method_len)) {
const LIBSSH2_CRYPT_METHOD *method =
(const LIBSSH2_CRYPT_METHOD *)
kex_get_method_by_name((char *) s, method_len,
@@ -3572,9 +3586,9 @@ static int kex_agree_crypt(LIBSSH2_SESSION * session,
}
while(*cryptp && (*cryptp)->name) {
- s = kex_agree_instr(crypt, crypt_len,
- (unsigned char *) (*cryptp)->name,
- strlen((*cryptp)->name));
+ s = _libssh2_kex_agree_instr(crypt, crypt_len,
+ (unsigned char *) (*cryptp)->name,
+ strlen((*cryptp)->name));
if(s) {
endpoint->crypt = *cryptp;
return 0;
@@ -3614,7 +3628,7 @@ static int kex_agree_mac(LIBSSH2_SESSION * session,
unsigned char *p = (unsigned char *) strchr((char *) s, ',');
size_t method_len = (p ? (size_t)(p - s) : strlen((char *) s));
- if(kex_agree_instr(mac, mac_len, s, method_len)) {
+ if(_libssh2_kex_agree_instr(mac, mac_len, s, method_len)) {
const LIBSSH2_MAC_METHOD *method = (const LIBSSH2_MAC_METHOD *)
kex_get_method_by_name((char *) s, method_len,
(const LIBSSH2_COMMON_METHOD **)
@@ -3635,8 +3649,9 @@ static int kex_agree_mac(LIBSSH2_SESSION * session,
}
while(*macp && (*macp)->name) {
- s = kex_agree_instr(mac, mac_len, (unsigned char *) (*macp)->name,
- strlen((*macp)->name));
+ s = _libssh2_kex_agree_instr(mac, mac_len,
+ (unsigned char *) (*macp)->name,
+ strlen((*macp)->name));
if(s) {
endpoint->mac = *macp;
return 0;
@@ -3667,7 +3682,7 @@ static int kex_agree_comp(LIBSSH2_SESSION *session,
unsigned char *p = (unsigned char *) strchr((char *) s, ',');
size_t method_len = (p ? (size_t)(p - s) : strlen((char *) s));
- if(kex_agree_instr(comp, comp_len, s, method_len)) {
+ if(_libssh2_kex_agree_instr(comp, comp_len, s, method_len)) {
const LIBSSH2_COMP_METHOD *method =
(const LIBSSH2_COMP_METHOD *)
kex_get_method_by_name((char *) s, method_len,
@@ -3689,8 +3704,9 @@ static int kex_agree_comp(LIBSSH2_SESSION *session,
}
while(*compp && (*compp)->name) {
- s = kex_agree_instr(comp, comp_len, (unsigned char *) (*compp)->name,
- strlen((*compp)->name));
+ s = _libssh2_kex_agree_instr(comp, comp_len,
+ (unsigned char *) (*compp)->name,
+ strlen((*compp)->name));
if(s) {
endpoint->comp = *compp;
return 0;
@@ -3871,6 +3887,7 @@ _libssh2_kex_exchange(LIBSSH2_SESSION * session, int reexchange,
session->local.kexinit = key_state->oldlocal;
session->local.kexinit_len = key_state->oldlocal_len;
key_state->state = libssh2_NB_state_idle;
+ session->state &= ~LIBSSH2_STATE_INITIAL_KEX;
session->state &= ~LIBSSH2_STATE_KEX_ACTIVE;
session->state &= ~LIBSSH2_STATE_EXCHANGING_KEYS;
return -1;
@@ -3896,6 +3913,7 @@ _libssh2_kex_exchange(LIBSSH2_SESSION * session, int reexchange,
session->local.kexinit = key_state->oldlocal;
session->local.kexinit_len = key_state->oldlocal_len;
key_state->state = libssh2_NB_state_idle;
+ session->state &= ~LIBSSH2_STATE_INITIAL_KEX;
session->state &= ~LIBSSH2_STATE_KEX_ACTIVE;
session->state &= ~LIBSSH2_STATE_EXCHANGING_KEYS;
return -1;
@@ -3944,6 +3962,7 @@ _libssh2_kex_exchange(LIBSSH2_SESSION * session, int reexchange,
session->remote.kexinit = NULL;
}
+ session->state &= ~LIBSSH2_STATE_INITIAL_KEX;
session->state &= ~LIBSSH2_STATE_KEX_ACTIVE;
session->state &= ~LIBSSH2_STATE_EXCHANGING_KEYS;
diff --git a/src/libssh2_priv.h b/src/libssh2_priv.h
index 7660366954..18d9ab2130 100644
--- a/src/libssh2_priv.h
+++ b/src/libssh2_priv.h
@@ -736,6 +736,9 @@ struct _LIBSSH2_SESSION
/* key signing algorithm preferences -- NULL yields server order */
char *sign_algo_prefs;
+ /* Whether to use the OpenSSH Strict KEX extension */
+ int kex_strict;
+
/* (remote as source of data -- packet_read ) */
libssh2_endpoint_data remote;
@@ -908,6 +911,7 @@ struct _LIBSSH2_SESSION
int fullpacket_macstate;
size_t fullpacket_payload_len;
int fullpacket_packet_type;
+ uint32_t fullpacket_required_type;
/* State variables used in libssh2_sftp_init() */
libssh2_nonblocking_states sftpInit_state;
@@ -948,10 +952,11 @@ struct _LIBSSH2_SESSION
};
/* session.state bits */
-#define LIBSSH2_STATE_EXCHANGING_KEYS 0x00000001
-#define LIBSSH2_STATE_NEWKEYS 0x00000002
-#define LIBSSH2_STATE_AUTHENTICATED 0x00000004
-#define LIBSSH2_STATE_KEX_ACTIVE 0x00000008
+#define LIBSSH2_STATE_INITIAL_KEX 0x00000001
+#define LIBSSH2_STATE_EXCHANGING_KEYS 0x00000002
+#define LIBSSH2_STATE_NEWKEYS 0x00000004
+#define LIBSSH2_STATE_AUTHENTICATED 0x00000008
+#define LIBSSH2_STATE_KEX_ACTIVE 0x00000010
/* session.flag helpers */
#ifdef MSG_NOSIGNAL
@@ -1182,6 +1187,11 @@ ssize_t _libssh2_send(libssh2_socket_t socket, const void *buffer,
int _libssh2_kex_exchange(LIBSSH2_SESSION * session, int reexchange,
key_exchange_state_t * state);
+unsigned char *_libssh2_kex_agree_instr(unsigned char *haystack,
+ size_t haystack_len,
+ const unsigned char *needle,
+ size_t needle_len);
+
/* Let crypt.c/hostkey.c expose their method structs */
const LIBSSH2_CRYPT_METHOD **libssh2_crypt_methods(void);
const LIBSSH2_HOSTKEY_METHOD **libssh2_hostkey_methods(void);
diff --git a/src/packet.c b/src/packet.c
index eccb8c56a8..6da14e9fa1 100644
--- a/src/packet.c
+++ b/src/packet.c
@@ -624,14 +624,13 @@ packet_authagent_open(LIBSSH2_SESSION * session,
* layer when it has received a packet.
*
* The input pointer 'data' is pointing to allocated data that this function
- * is asked to deal with so on failure OR success, it must be freed fine.
- * The only exception is when the return code is LIBSSH2_ERROR_EAGAIN.
+ * will be freed unless return the code is LIBSSH2_ERROR_EAGAIN.
*
* This function will always be called with 'datalen' greater than zero.
*/
int
_libssh2_packet_add(LIBSSH2_SESSION * session, unsigned char *data,
- size_t datalen, int macstate)
+ size_t datalen, int macstate, uint32_t seq)
{
int rc = 0;
unsigned char *message = NULL;
@@ -676,6 +675,70 @@ _libssh2_packet_add(LIBSSH2_SESSION * session, unsigned char *data,
break;
}
+ if(session->state & LIBSSH2_STATE_INITIAL_KEX) {
+ if(msg == SSH_MSG_KEXINIT) {
+ if(!session->kex_strict) {
+ if(datalen < 17) {
+ LIBSSH2_FREE(session, data);
+ session->packAdd_state = libssh2_NB_state_idle;
+ return _libssh2_error(session,
+ LIBSSH2_ERROR_BUFFER_TOO_SMALL,
+ "Data too short extracting kex");
+ }
+ else {
+ const unsigned char *strict =
+ (unsigned char *)"kex-strict-s-v00@openssh.com";
+ struct string_buf buf;
+ unsigned char *algs = NULL;
+ size_t algs_len = 0;
+
+ buf.data = (unsigned char *)data;
+ buf.dataptr = buf.data;
+ buf.len = datalen;
+ buf.dataptr += 17; /* advance past type and cookie */
+
+ if(_libssh2_get_string(&buf, &algs, &algs_len)) {
+ LIBSSH2_FREE(session, data);
+ session->packAdd_state = libssh2_NB_state_idle;
+ return _libssh2_error(session,
+ LIBSSH2_ERROR_BUFFER_TOO_SMALL,
+ "Algs too short");
+ }
+
+ if(algs_len == 0 ||
+ _libssh2_kex_agree_instr(algs, algs_len, strict, 28)) {
+ session->kex_strict = 1;
+ }
+ }
+ }
+
+ if(session->kex_strict && seq) {
+ LIBSSH2_FREE(session, data);
+ session->socket_state = LIBSSH2_SOCKET_DISCONNECTED;
+ session->packAdd_state = libssh2_NB_state_idle;
+ libssh2_session_disconnect(session, "strict KEX violation: "
+ "KEXINIT was not the first packet");
+
+ return _libssh2_error(session, LIBSSH2_ERROR_SOCKET_DISCONNECT,
+ "strict KEX violation: "
+ "KEXINIT was not the first packet");
+ }
+ }
+
+ if(session->kex_strict && session->fullpacket_required_type &&
+ session->fullpacket_required_type != msg) {
+ LIBSSH2_FREE(session, data);
+ session->socket_state = LIBSSH2_SOCKET_DISCONNECTED;
+ session->packAdd_state = libssh2_NB_state_idle;
+ libssh2_session_disconnect(session, "strict KEX violation: "
+ "unexpected packet type");
+
+ return _libssh2_error(session, LIBSSH2_ERROR_SOCKET_DISCONNECT,
+ "strict KEX violation: "
+ "unexpected packet type");
+ }
+ }
+
if(session->packAdd_state == libssh2_NB_state_allocated) {
/* A couple exceptions to the packet adding rule: */
switch(msg) {
@@ -1364,6 +1427,15 @@ _libssh2_packet_ask(LIBSSH2_SESSION * session, unsigned char packet_type,
return 0;
}
+ else if(session->kex_strict &&
+ (session->state & LIBSSH2_STATE_INITIAL_KEX)) {
+ libssh2_session_disconnect(session, "strict KEX violation: "
+ "unexpected packet type");
+
+ return _libssh2_error(session, LIBSSH2_ERROR_SOCKET_DISCONNECT,
+ "strict KEX violation: "
+ "unexpected packet type");
+ }
packet = _libssh2_list_next(&packet->node);
}
return -1;
@@ -1425,7 +1497,10 @@ _libssh2_packet_require(LIBSSH2_SESSION * session, unsigned char packet_type,
}
while(session->socket_state == LIBSSH2_SOCKET_CONNECTED) {
- int ret = _libssh2_transport_read(session);
+ int ret;
+ session->fullpacket_required_type = packet_type;
+ ret = _libssh2_transport_read(session);
+ session->fullpacket_required_type = 0;
if(ret == LIBSSH2_ERROR_EAGAIN)
return ret;
else if(ret < 0) {
diff --git a/src/packet.h b/src/packet.h
index 1d90b8af12..955351e5f6 100644
--- a/src/packet.h
+++ b/src/packet.h
@@ -72,6 +72,6 @@ int _libssh2_packet_burn(LIBSSH2_SESSION * session,
int _libssh2_packet_write(LIBSSH2_SESSION * session, unsigned char *data,
unsigned long data_len);
int _libssh2_packet_add(LIBSSH2_SESSION * session, unsigned char *data,
- size_t datalen, int macstate);
+ size_t datalen, int macstate, uint32_t seq);
#endif /* LIBSSH2_PACKET_H */
diff --git a/src/session.c b/src/session.c
index 35e7929fe7..9d89ade8ec 100644
--- a/src/session.c
+++ b/src/session.c
@@ -469,6 +469,8 @@ libssh2_session_init_ex(LIBSSH2_ALLOC_FUNC((*my_alloc)),
session->abstract = abstract;
session->api_timeout = 0; /* timeout-free API by default */
session->api_block_mode = 1; /* blocking API by default */
+ session->state = LIBSSH2_STATE_INITIAL_KEX;
+ session->fullpacket_required_type = 0;
session->packet_read_timeout = LIBSSH2_DEFAULT_READ_TIMEOUT;
session->flag.quote_paths = 1; /* default behavior is to quote paths
for the scp subsystem */
@@ -1223,6 +1225,7 @@ libssh2_session_disconnect_ex(LIBSSH2_SESSION *session, int reason,
const char *desc, const char *lang)
{
int rc;
+ session->state &= ~LIBSSH2_STATE_INITIAL_KEX;
session->state &= ~LIBSSH2_STATE_EXCHANGING_KEYS;
BLOCK_ADJUST(rc, session,
session_disconnect(session, reason, desc, lang));
diff --git a/src/transport.c b/src/transport.c
index 21be9d2b80..a8bb588a4b 100644
--- a/src/transport.c
+++ b/src/transport.c
@@ -186,6 +186,7 @@ fullpacket(LIBSSH2_SESSION * session, int encrypted /* 1 or 0 */ )
struct transportpacket *p = &session->packet;
int rc;
int compressed;
+ uint32_t seq = session->remote.seqno;
if(session->fullpacket_state == libssh2_NB_state_idle) {
session->fullpacket_macstate = LIBSSH2_MAC_CONFIRMED;
@@ -317,7 +318,7 @@ fullpacket(LIBSSH2_SESSION * session, int encrypted /* 1 or 0 */ )
if(session->fullpacket_state == libssh2_NB_state_created) {
rc = _libssh2_packet_add(session, p->payload,
session->fullpacket_payload_len,
- session->fullpacket_macstate);
+ session->fullpacket_macstate, seq);
if(rc == LIBSSH2_ERROR_EAGAIN)
return rc;
if(rc) {
@@ -328,6 +329,11 @@ fullpacket(LIBSSH2_SESSION * session, int encrypted /* 1 or 0 */ )
session->fullpacket_state = libssh2_NB_state_idle;
+ if(session->kex_strict &&
+ session->fullpacket_packet_type == SSH_MSG_NEWKEYS) {
+ session->remote.seqno = 0;
+ }
+
return session->fullpacket_packet_type;
}
@@ -1093,6 +1099,10 @@ int _libssh2_transport_send(LIBSSH2_SESSION *session,
session->local.seqno++;
+ if(session->kex_strict && data[0] == SSH_MSG_NEWKEYS) {
+ session->local.seqno = 0;
+ }
+
ret = LIBSSH2_SEND(session, p->outbuf, total_length,
LIBSSH2_SOCKET_SEND_FLAGS(session));
if(ret < 0)
pkgs/development/libraries/libssh2/default.nix
+6
View File
@@ -9,6 +9,12 @@ stdenv.mkDerivation rec {
sha256 = "sha256-NzYWHkHiaTMk3rOMJs/cPv5iCdY0ukJY2xzs/2pa1GE=";
};
patches = [
# fetchpatch cannot be used due to infinite recursion
# https://github.com/libssh2/libssh2/commit/d34d9258b8420b19ec3f97b4cc5bf7aa7d98e35a
./CVE-2023-48795.patch
];
outputs = [ "out" "dev" "devdoc" ];
propagatedBuildInputs = [ openssl ]; # see Libs: in libssh2.pc
pkgs/development/libraries/libwacom/default.nix
+16 -8
View File
@@ -6,14 +6,16 @@
, glib
, pkg-config
, udev
, libevdev
, libgudev
, libxml2
, python3
, valgrind
}:
stdenv.mkDerivation rec {
pname = "libwacom";
version = "2.8.0";
version = "2.9.0";
outputs = [ "out" "dev" ];
@@ -21,7 +23,7 @@ stdenv.mkDerivation rec {
owner = "linuxwacom";
repo = "libwacom";
rev = "libwacom-${version}";
hash = "sha256-VjFZBlOIG1L4dXPJ8DWxrbfVqdQC+X7zVXFryo43FFc=";
hash = "sha256-oM3dd22hQaAXdNoO2Q2JvO2lJCkmfw8f0NWxYcVT3lA=";
};
postPatch = ''
@@ -38,6 +40,7 @@ stdenv.mkDerivation rec {
buildInputs = [
glib
udev
libevdev
libgudev
];
@@ -50,13 +53,18 @@ stdenv.mkDerivation rec {
"-Dtests=${if doCheck then "enabled" else "disabled"}"
];
checkInputs = [
libxml2
];
nativeCheckInputs = [
valgrind
] ++ (with python3.pkgs; [
libevdev
pytest
pyudev
]);
(python3.withPackages (ps: with ps; [
ps.libevdev
pytest
pyudev
]))
];
meta = with lib; {
platforms = platforms.linux;
@@ -64,6 +72,6 @@ stdenv.mkDerivation rec {
changelog = "https://github.com/linuxwacom/libwacom/blob/${src.rev}/NEWS";
description = "Libraries, configuration, and diagnostic tools for Wacom tablets running under Linux";
maintainers = teams.freedesktop.members;
license = licenses.mit;
license = licenses.hpnd;
};
}
pkgs/development/libraries/libxml2/default.nix
+8 -4
View File
@@ -1,6 +1,7 @@
{ stdenv
, lib
, fetchurl
, fetchFromGitLab
, zlib
, pkg-config
, autoreconfHook
@@ -34,16 +35,19 @@ in
let
libxml = stdenv.mkDerivation rec {
pname = "libxml2";
version = "2.12.3";
version = "2.12.3-unstable-2023-12-14";
outputs = [ "bin" "dev" "out" "doc" ]
++ lib.optional pythonSupport "py"
++ lib.optional (enableStatic && enableShared) "static";
outputMan = "bin";
src = fetchurl {
url = "mirror://gnome/sources/libxml2/${lib.versions.majorMinor version}/libxml2-${version}.tar.xz";
hash = "sha256-jI8QkjQKif8yvEStXJaTr/m8ino+FhuyOWZuXRWsmqo=";
src = fetchFromGitLab {
domain = "gitlab.gnome.org";
owner = "GNOME";
repo = "libxml2";
rev = "f006355eda722cae204606b9f95ba51f5ce9189b";
hash = "sha256-3WE90KDZq4Uaawuulc3t2+R8duCqgjEGUDN4HSXxohY=";
};
strictDeps = true;
pkgs/development/libraries/polkit/default.nix
+8 -14
View File
@@ -9,7 +9,6 @@
, mesonEmulatorHook
, ninja
, perl
, rsync
, python3
, fetchpatch
, gettext
@@ -72,7 +71,6 @@ stdenv.mkDerivation rec {
meson
ninja
perl
rsync
# man pages
libxslt
@@ -131,7 +129,7 @@ stdenv.mkDerivation rec {
# at install time but Meson does not support this
# so we need to convince it to install all files to a temporary
# location using DESTDIR and then move it to proper one in postInstall.
DESTDIR = "${placeholder "out"}/dest";
env.DESTDIR = "dest";
inherit doCheck;
@@ -165,19 +163,15 @@ stdenv.mkDerivation rec {
postInstall = ''
# Move stuff from DESTDIR to proper location.
# We use rsync to merge the directories.
rsync --archive "${DESTDIR}/etc" "$out"
rm --recursive "${DESTDIR}/etc"
rsync --archive "${DESTDIR}${system}"/* "$out"
rm --recursive "${DESTDIR}${system}"/*
rmdir --parents --ignore-fail-on-non-empty "${DESTDIR}${system}"
# We need to be careful with the ordering to merge without conflicts.
for o in $(getAllOutputNames); do
rsync --archive "${DESTDIR}/''${!o}" "$(dirname "''${!o}")"
rm --recursive "${DESTDIR}/''${!o}"
mv "$DESTDIR/''${!o}" "''${!o}"
done
# Ensure the DESTDIR is removed.
destdirContainer="$(dirname "${DESTDIR}")"
pushd "$destdirContainer"; rmdir --parents "''${DESTDIR##$destdirContainer/}${builtins.storeDir}"; popd
mv "$DESTDIR/etc" "$out"
mv "$DESTDIR${system}/share"/* "$out/share"
# Ensure we did not forget to install anything.
rmdir --parents --ignore-fail-on-non-empty "$DESTDIR${builtins.storeDir}" "$DESTDIR${system}/share"
! test -e "$DESTDIR"
'';
meta = with lib; {
pkgs/development/libraries/srt/default.nix
+1
View File
@@ -34,6 +34,7 @@ stdenv.mkDerivation rec {
# (setting it to an absolute path causes include files to go to $out/$out/include,
# because the absolute path is interpreted with root at $out).
"-DCMAKE_INSTALL_INCLUDEDIR=include"
"-DENABLE_SHARED=${if stdenv.hostPlatform.isStatic then "OFF" else "ON"}"
# TODO Remove this when https://github.com/Haivision/srt/issues/538 is fixed and available to nixpkgs
# Workaround for the fact that srt incorrectly disables GNUInstallDirs when LIBDIR is specified,
# see https://github.com/NixOS/nixpkgs/pull/54463#discussion_r249878330
pkgs/development/libraries/unittest-cpp/default.nix
+4
View File
@@ -24,6 +24,10 @@ stdenv.mkDerivation rec {
})
];
# Fix 'Version:' setting in .pc file. TODO: remove once upstreamed:
# https://github.com/unittest-cpp/unittest-cpp/pull/188
cmakeFlags = [ "-DPACKAGE_VERSION=${version}" ];
nativeBuildInputs = [ cmake ];
doCheck = false;
pkgs/development/libraries/xsimd/default.nix
+2 -2
View File
@@ -7,12 +7,12 @@
stdenv.mkDerivation (finalAttrs: {
pname = "xsimd";
version = "11.2.0";
version = "12.1.1";
src = fetchFromGitHub {
owner = "xtensor-stack";
repo = "xsimd";
rev = finalAttrs.version;
sha256 = "sha256-CzgfxXGZXoJ56dX+mDPsHZC31YudrZXpX2tovh/Vjr0=";
hash = "sha256-ofUFieeRtpnzNv3Ad5oYwKWb2XcqQHoj601TIhydJyI=";
};
patches = [
# Ideally, Accelerate/Accelerate.h should be used for this implementation,
pkgs/development/python-modules/buildcatrust/default.nix
+12 -2
View File
@@ -1,27 +1,37 @@
{ lib
, buildPythonPackage
, fetchPypi
, flit-core
, pytestCheckHook
}:
buildPythonPackage rec {
pname = "buildcatrust";
version = "0.1.3";
pyproject = true;
src = fetchPypi {
inherit pname version;
sha256 = "sha256:0s0m0fy943dakw9cbd40h46qmrhhgrcp292kppyb34m6y27sbagy";
hash = "sha256:0s0m0fy943dakw9cbd40h46qmrhhgrcp292kppyb34m6y27sbagy";
};
nativeBuildInputs = [
flit-core
];
nativeCheckInputs = [
pytestCheckHook
];
disabledTestPaths = [
# Non-hermetic, needs internet access (e.g. attempts to retrieve NSS store).
"buildcatrust/tests/test_nonhermetic.py"
];
pythonImportsCheck = [ "buildcatrust" "buildcatrust.cli" ];
pythonImportsCheck = [
"buildcatrust"
"buildcatrust.cli"
];
meta = with lib; {
description = "Build SSL/TLS trust stores";
pkgs/development/ruby-modules/bundler/default.nix
+2 -2
View File
@@ -4,8 +4,8 @@ buildRubyGem rec {
inherit ruby;
name = "${gemName}-${version}";
gemName = "bundler";
version = "2.4.22";
source.sha256 = "sha256-dHulCw5n3yXL07SPlYMad6TVOlgdVfBjly/LFG0ULF8=";
version = "2.5.3";
source.sha256 = "sha256-JJzQdaxPM1rnD3iMm+D0wYgJOk2n0FvVO+K67z8l58s=";
dontPatchShebangs = true;
postFixup = ''
pkgs/development/tools/build-managers/scons/3.1.2.nix
+14 -4
View File
@@ -1,16 +1,25 @@
{ lib, fetchurl, python3 }:
{ lib, fetchFromGitHub, python3 }:
let
pname = "scons";
version = "3.1.2";
src = fetchurl {
url = "mirror://sourceforge/scons/scons-${version}.tar.gz";
hash = "sha256-eAHz9i9lRSjict94C+EMDpM36JdlC2Ldzunzn94T+Ps=";
src = fetchFromGitHub {
owner = "Scons";
repo = "scons";
rev = version;
hash = "sha256-C3U4N7+9vplzoJoevQe5Zeuz0TDmB6/miMwBJLzA3WA=";
};
in
python3.pkgs.buildPythonApplication {
inherit pname version src;
outputs = [ "out" "man" ];
preConfigure = ''
python bootstrap.py
cd build/scons
'';
setupHook = ./setup-hook.sh;
doCheck = true;
@@ -36,3 +45,4 @@ python3.pkgs.buildPythonApplication {
maintainers = with lib.maintainers; [ AndersonTorres ];
};
}
# TODO: patch to get rid of distutils and other deprecations
pkgs/development/tools/build-managers/scons/4.1.0.nix
+15 -8
View File
@@ -1,25 +1,32 @@
{ lib, fetchurl, python3 }:
{ lib, fetchFromGitHub, python3 }:
let
pname = "scons";
version = "4.1.0";
src = fetchurl {
url = "mirror://sourceforge/scons/scons-${version}.tar.gz";
hash = "sha256-ctKNdi4hJnh/Fz49WeCJI5+LL06e8xFNV/ELEgaYXYU=";
src = fetchFromGitHub {
owner = "Scons";
repo = "scons";
rev = version;
hash = "sha256-ldus/9ghqAMB7A+NrHiCQm7saCdIpqzufGCLxWRhYKU=";
};
in
python3.pkgs.buildPythonApplication {
inherit pname version src;
outputs = [ "out" "man" ];
postPatch = ''
substituteInPlace setup.cfg \
--replace "build/dist" "dist" \
--replace "build/doc/man/" ""
--replace "build/dist" "dist"
'';
preConfigure = ''
python scripts/scons.py
'';
postInstall = ''
mkdir -p "$out/share/man/man1"
mv "$out/"*.1 "$out/share/man/man1/"
mkdir -pv "$man/share/man/man1"
mv -v "$out/"*.1 "$man/share/man/man1/"
'';
setupHook = ./setup-hook.sh;
pkgs/development/tools/build-managers/scons/4.5.2.nix
+14 -6
View File
@@ -1,16 +1,20 @@
{ lib, fetchurl, python3 }:
{ lib, fetchFromGitHub, python3 }:
let
pname = "scons";
version = "4.5.2";
src = fetchurl {
url = "mirror://sourceforge/project/scons/scons/${version}/SCons-${version}.tar.gz";
hash = "sha256-ziaqyV01CnmkGSGWsL6sPLJPTMq84BI+so0zcPV28HI=";
src = fetchFromGitHub {
owner = "Scons";
repo = "scons";
rev = version;
hash = "sha256-vxJsz24jDsPcttwPXq9+ztc/N7W4Gkydgykk/FLgZLo=";
};
in
python3.pkgs.buildPythonApplication {
inherit pname version src;
outputs = [ "out" "man" ];
patches = [
./env.patch
];
@@ -21,9 +25,13 @@ python3.pkgs.buildPythonApplication {
--replace "build/doc/man/" ""
'';
preConfigure = ''
python scripts/scons.py
'';
postInstall = ''
mkdir -p "$out/share/man/man1"
mv "$out/"*.1 "$out/share/man/man1/"
mkdir -p "$man/share/man/man1"
mv "$out/"*.1 "$man/share/man/man1/"
'';
setupHook = ./setup-hook.sh;
pkgs/development/tools/misc/gdb/default.nix
+4 -4
View File
@@ -4,7 +4,7 @@
, fetchurl, fetchpatch, pkg-config, perl, texinfo, setupDebugInfoDirs, buildPackages
# Run time
, ncurses, readline, gmp, mpfr, expat, libipt, zlib, zstd, dejagnu, sourceHighlight, libiconv
, ncurses, readline, gmp, mpfr, expat, libipt, zlib, zstd, xz, dejagnu, sourceHighlight, libiconv
, pythonSupport ? stdenv.hostPlatform == stdenv.buildPlatform && !stdenv.hostPlatform.isCygwin, python3 ? null
, enableDebuginfod ? lib.meta.availableOn stdenv.hostPlatform elfutils, elfutils
@@ -30,11 +30,11 @@ assert pythonSupport -> python3 != null;
stdenv.mkDerivation rec {
pname = targetPrefix + basename + lib.optionalString hostCpuOnly "-host-cpu-only";
version = "13.2";
version = "14.1";
src = fetchurl {
url = "mirror://gnu/gdb/${basename}-${version}.tar.xz";
hash = "sha256-/Vvrt74YM6vbbgI8L0mKNUSYKB350FUj2JFbq+uJPwo=";
hash = "sha256-1m31EnYUNFH8v/RkzIcj1o8enfRaai1WNaVOcWQ+24A=";
};
postPatch = lib.optionalString stdenv.isDarwin ''
@@ -55,7 +55,7 @@ stdenv.mkDerivation rec {
nativeBuildInputs = [ pkg-config texinfo perl setupDebugInfoDirs ];
buildInputs = [ ncurses readline gmp mpfr expat libipt zlib zstd guile sourceHighlight ]
buildInputs = [ ncurses readline gmp mpfr expat libipt zlib zstd xz guile sourceHighlight ]
++ lib.optional pythonSupport python3
++ lib.optional doCheck dejagnu
++ lib.optional enableDebuginfod (elfutils.override { enableDebuginfod = true; })
pkgs/os-specific/linux/iproute/default.nix
+2 -2
View File
@@ -6,11 +6,11 @@
stdenv.mkDerivation rec {
pname = "iproute2";
version = "6.5.0";
version = "6.6.0";
src = fetchurl {
url = "mirror://kernel/linux/utils/net/${pname}/${pname}-${version}.tar.xz";
hash = "sha256-pwF5CF+huW08M7BAyAm3XitXVjrcUFpK0F4mCd83NGM=";
hash = "sha256-hzjIBK/Qnwv3VpN/DD3iMReDKpjYy79QOGz1AFzWE84=";
};
postPatch = ''
pkgs/os-specific/linux/iputils/default.nix
+2 -2
View File
@@ -15,13 +15,13 @@
stdenv.mkDerivation rec {
pname = "iputils";
version = "20221126";
version = "20231222";
src = fetchFromGitHub {
owner = pname;
repo = pname;
rev = version;
hash = "sha256-XVoQhdjBmEK8TbCpaKLjebPw7ZT8iEvyLJDTCkzezeE=";
hash = "sha256-/blxT6k79fgbxX8qCQuJMf7zDPwMjJUt7FCscaMXx6U=";
};
outputs = [ "out" "apparmor" ];
pkgs/os-specific/linux/procps-ng/default.nix
+2 -2
View File
@@ -48,8 +48,8 @@ stdenv.mkDerivation rec {
enableParallelBuilding = true;
# Too red
configureFlags = [ "--disable-modern-top" ]
# Too red; 8bit support for fixing https://github.com/NixOS/nixpkgs/issues/275220
configureFlags = [ "--disable-modern-top" "--enable-watch8bit" ]
++ lib.optional withSystemd "--with-systemd"
++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
"ac_cv_func_malloc_0_nonnull=yes"
pkgs/os-specific/linux/systemd/0020-timesyncd-disable-NSCD-when-DNSSEC-validation-is-dis.patch
+46
View File
@@ -0,0 +1,46 @@
From 7a27556920fe1feefd17096841c8f3ca1294a1b3 Mon Sep 17 00:00:00 2001
From: Yuri Nesterov <yuriy.nesterov@unikie.com>
Date: Wed, 21 Jun 2023 17:17:38 +0300
Subject: [PATCH] timesyncd: disable NSCD when DNSSEC validation is disabled
Systemd-timesyncd sets SYSTEMD_NSS_RESOLVE_VALIDATE=0 in the unit file
to disable DNSSEC validation but it doesn't work when NSCD is used in
the system. This patch disabes NSCD in systemd-timesyncd when
SYSTEMD_NSS_RESOLVE_VALIDATE is set to 0 so that it uses NSS libraries
directly.
---
src/timesync/timesyncd.c | 11 +++++++++++
1 file changed, 11 insertions(+)
diff --git a/src/timesync/timesyncd.c b/src/timesync/timesyncd.c
index 1d8ebecc91..2b0ae361ff 100644
--- a/src/timesync/timesyncd.c
+++ b/src/timesync/timesyncd.c
@@ -21,6 +21,11 @@
#include "timesyncd-conf.h"
#include "timesyncd-manager.h"
#include "user-util.h"
+#include "env-util.h"
+
+struct traced_file;
+extern void __nss_disable_nscd(void (*)(size_t, struct traced_file *));
+static void register_traced_file(size_t dbidx, struct traced_file *finfo) {}
static int advance_tstamp(int fd, const struct stat *st) {
assert_se(fd >= 0);
@@ -198,6 +203,12 @@ static int run(int argc, char *argv[]) {
if (r < 0)
return log_error_errno(r, "Failed to parse fallback server strings: %m");
+ r = getenv_bool_secure("SYSTEMD_NSS_RESOLVE_VALIDATE");
+ if (r == 0) {
+ log_info("Disabling NSCD because DNSSEC validation is turned off");
+ __nss_disable_nscd(register_traced_file);
+ }
+
log_debug("systemd-timesyncd running as pid " PID_FMT, getpid_cached());
notify_message = notify_start("READY=1\n"
--
2.34.1
pkgs/os-specific/linux/systemd/default.nix
+1
View File
@@ -208,6 +208,7 @@ stdenv.mkDerivation (finalAttrs: {
./0017-core-don-t-taint-on-unmerged-usr.patch
./0018-tpm2_context_init-fix-driver-name-checking.patch
./0019-systemctl-edit-suggest-systemdctl-edit-runtime-on-sy.patch
./0020-timesyncd-disable-NSCD-when-DNSSEC-validation-is-dis.patch
] ++ lib.optional stdenv.hostPlatform.isMusl (
let
oe-core = fetchzip {
pkgs/os-specific/linux/util-linux/bcachefs-patch-set.patch
-277
View File
@@ -1,277 +0,0 @@
commit 68564ebb50f8afab5a9527c534417e247cca0b27
Author: Filipe Manana <fdmanana@kernel.org>
Date: Thu Aug 17 10:20:13 2023 +0100
libmount: Fix regression when mounting with atime
A regression was introduced in v2.39 that causes mounting with the atime
option to fail:
$ mkfs.ext4 -F /dev/sdi
$ mount -o atime /dev/sdi /mnt/sdi
mount: /mnt/sdi: not mount point or bad option.
dmesg(1) may have more information after failed mount system call.
The failure comes from the mount_setattr(2) call returning -EINVAL. This
is because we pass an invalid value for the attr_clr argument. From a
strace capture we have:
mount_setattr(4, "", AT_EMPTY_PATH, {attr_set=0, attr_clr=MOUNT_ATTR_NOATIME, propagation=0 /* MS_??? */, userns_fd=0}, 32) = -1 EINVAL (Invalid argument)
We can't pass MOUNT_ATTR_NOATIME to mount_setattr(2) through the attr_clr
argument because all atime options are exclusive, so in order to set atime
one has to pass MOUNT_ATTR__ATIME to attr_clr and leave attr_set as
MOUNT_ATTR_RELATIME (which is defined as a value of 0).
This can be read from the man page for mount_setattr(2) and also from the
kernel source:
$ cat fs/namespace.c
static int build_mount_kattr(const struct mount_attr *attr, size_t usize,
struct mount_kattr *kattr, unsigned int flags)
{
(...)
/*
* Since the MOUNT_ATTR_<atime> values are an enum, not a bitmap,
* users wanting to transition to a different atime setting cannot
* simply specify the atime setting in @attr_set, but must also
* specify MOUNT_ATTR__ATIME in the @attr_clr field.
* So ensure that MOUNT_ATTR__ATIME can't be partially set in
* @attr_clr and that @attr_set can't have any atime bits set if
* MOUNT_ATTR__ATIME isn't set in @attr_clr.
*/
if (attr->attr_clr & MOUNT_ATTR__ATIME) {
if ((attr->attr_clr & MOUNT_ATTR__ATIME) != MOUNT_ATTR__ATIME)
return -EINVAL;
/*
* Clear all previous time settings as they are mutually
* exclusive.
*/
kattr->attr_clr |= MNT_RELATIME | MNT_NOATIME;
switch (attr->attr_set & MOUNT_ATTR__ATIME) {
case MOUNT_ATTR_RELATIME:
kattr->attr_set |= MNT_RELATIME;
break;
case MOUNT_ATTR_NOATIME:
kattr->attr_set |= MNT_NOATIME;
break;
case MOUNT_ATTR_STRICTATIME:
break;
default:
return -EINVAL;
}
(...)
So fix this by setting attr_clr MOUNT_ATTR__ATIME if we want to clear any
atime related option.
Signed-off-by: Filipe Manana <fdmanana@kernel.org>
diff --git a/libmount/src/optlist.c b/libmount/src/optlist.c
index 1e962ec6d..0702adae7 100644
--- a/libmount/src/optlist.c
+++ b/libmount/src/optlist.c
@@ -875,7 +875,18 @@ int mnt_optlist_get_attrs(struct libmnt_optlist *ls, uint64_t *set, uint64_t *cl
if (opt->ent->mask & MNT_INVERT) {
DBG(OPTLIST, ul_debugobj(ls, " clr: %s", opt->ent->name));
- *clr |= x;
+ /*
+ * All atime settings are mutually exclusive so *clr must
+ * have MOUNT_ATTR__ATIME set.
+ *
+ * See the function fs/namespace.c:build_mount_kattr()
+ * in the linux kernel source.
+ */
+ if (x == MOUNT_ATTR_RELATIME || x == MOUNT_ATTR_NOATIME ||
+ x == MOUNT_ATTR_STRICTATIME)
+ *clr |= MOUNT_ATTR__ATIME;
+ else
+ *clr |= x;
} else {
DBG(OPTLIST, ul_debugobj(ls, " set: %s", opt->ent->name));
*set |= x;
diff --git a/tests/expected/libmount/context-mount-flags b/tests/expected/libmount/context-mount-flags
index 960641863..eb71323dd 100644
--- a/tests/expected/libmount/context-mount-flags
+++ b/tests/expected/libmount/context-mount-flags
@@ -3,3 +3,6 @@ ro,nosuid,noexec
successfully mounted
rw,nosuid,noexec
successfully umounted
+successfully mounted
+rw,relatime
+successfully umounted
diff --git a/tests/ts/libmount/context b/tests/ts/libmount/context
index f5b47185e..a5d2e81a3 100755
--- a/tests/ts/libmount/context
+++ b/tests/ts/libmount/context
@@ -116,8 +116,15 @@ $TS_CMD_FINDMNT --kernel --mountpoint $MOUNTPOINT -o VFS-OPTIONS -n >> $TS_OUTPU
ts_run $TESTPROG --umount $MOUNTPOINT >> $TS_OUTPUT 2>> $TS_ERRLOG
is_mounted $DEVICE && echo "$DEVICE still mounted" >> $TS_OUTPUT 2>> $TS_ERRLOG
-ts_finalize_subtest
+# Test that the atime option works after the migration to use the new kernel mount APIs.
+ts_run $TESTPROG --mount -o atime $DEVICE $MOUNTPOINT >> $TS_OUTPUT 2>> $TS_ERRLOG
+$TS_CMD_FINDMNT --kernel --mountpoint $MOUNTPOINT -o VFS-OPTIONS -n >> $TS_OUTPUT 2>> $TS_ERRLOG
+is_mounted $DEVICE || echo "$DEVICE not mounted" >> $TS_OUTPUT 2>> $TS_ERRLOG
+ts_run $TESTPROG --umount $MOUNTPOINT >> $TS_OUTPUT 2>> $TS_ERRLOG
+is_mounted $DEVICE && echo "$DEVICE still mounted" >> $TS_OUTPUT 2>> $TS_ERRLOG
+
+ts_finalize_subtest
ts_init_subtest "mount-loopdev"
mkdir -p $MOUNTPOINT &> /dev/null
commit 1ec71634aa4ef5ddca23d65c8a296f3614231e8a
Author: Colin Gillespie <colin@cgillespie.xyz>
Date: Wed Aug 9 18:28:07 2023 +1000
libblkid: (bcachefs) fix not detecting large superblocks
Probing does not detect bcachefs filesystems with a superblock larger
than 4KiB. Bcachefs superblocks grow in size and can become much larger
than this.
Increase the superblock maximum size limit to 1MiB.
Validate the superblock isn't larger than the maximum size defined in
the superblocks layout section.
(cherry picked from commit 48d573797797650d96456979797c0155d58f61cb)
diff --git a/libblkid/src/superblocks/bcache.c b/libblkid/src/superblocks/bcache.c
index 40e702d75..236877042 100644
--- a/libblkid/src/superblocks/bcache.c
+++ b/libblkid/src/superblocks/bcache.c
@@ -102,6 +102,15 @@ union bcachefs_sb_csum {
uint8_t raw[16];
} __attribute__((packed));
+struct bcachefs_sb_layout {
+ uint8_t magic[16];
+ uint8_t layout_type;
+ uint8_t sb_max_size_bits;
+ uint8_t nr_superblocks;
+ uint8_t pad[5];
+ uint64_t sb_offset[61];
+} __attribute__((packed));
+
struct bcachefs_super_block {
union bcachefs_sb_csum csum;
uint16_t version;
@@ -123,7 +132,7 @@ struct bcachefs_super_block {
uint64_t flags[8];
uint64_t features[2];
uint64_t compat[2];
- uint8_t layout[512];
+ struct bcachefs_sb_layout layout;
struct bcachefs_sb_field _start[];
} __attribute__((packed));
@@ -143,7 +152,7 @@ struct bcachefs_super_block {
/* granularity of offset and length fields within superblock */
#define BCACHEFS_SECTOR_SIZE 512
/* maximum superblock size */
-#define BCACHEFS_SB_MAX_SIZE 4096
+#define BCACHEFS_SB_MAX_SIZE 0x100000
/* fields offset within super block */
#define BCACHEFS_SB_FIELDS_OFF offsetof(struct bcachefs_super_block, _start)
/* tag value for members field */
@@ -302,6 +311,9 @@ static int probe_bcachefs(blkid_probe pr, const struct blkid_idmag *mag)
return BLKID_PROBE_NONE;
sb_size = BCACHEFS_SB_FIELDS_OFF + BYTES(bcs);
+ if (sb_size > BCACHEFS_SECTOR_SIZE << bcs->layout.sb_max_size_bits)
+ return BLKID_PROBE_NONE;
+
if (sb_size > BCACHEFS_SB_MAX_SIZE)
return BLKID_PROBE_NONE;
commit acbf17ae8f8ee0f941fe98ed12f115f2b349bba8
Author: Karel Zak <kzak@redhat.com>
Date: Wed Aug 23 11:53:45 2023 +0200
libblkid: (bcachefs) fix compiler warning [-Werror=sign-compare]
Addresses: https://github.com/util-linux/util-linux/pull/2427
Signed-off-by: Karel Zak <kzak@redhat.com>
(cherry picked from commit 17873d38fc97913c0a31d4bd08cfbfe45c4de5be)
diff --git a/libblkid/src/superblocks/bcache.c b/libblkid/src/superblocks/bcache.c
index 236877042..6ab3fe9d4 100644
--- a/libblkid/src/superblocks/bcache.c
+++ b/libblkid/src/superblocks/bcache.c
@@ -311,7 +311,7 @@ static int probe_bcachefs(blkid_probe pr, const struct blkid_idmag *mag)
return BLKID_PROBE_NONE;
sb_size = BCACHEFS_SB_FIELDS_OFF + BYTES(bcs);
- if (sb_size > BCACHEFS_SECTOR_SIZE << bcs->layout.sb_max_size_bits)
+ if (sb_size > ((uint64_t) BCACHEFS_SECTOR_SIZE << bcs->layout.sb_max_size_bits))
return BLKID_PROBE_NONE;
if (sb_size > BCACHEFS_SB_MAX_SIZE)
commit 6b9fda87c4e5d0c6f945d7565197f157b9fa3d5f
Author: Thomas Weißschuh <thomas@t-8ch.de>
Date: Wed Aug 23 11:58:33 2023 +0200
libblkid: (bcachefs) fix size validation
Avoid signed shift out-of-bounds.
Also mark the constants explitly as unsigned instead of casting.
Signed-off-by: Thomas Weißschuh <thomas@t-8ch.de>
(cherry picked from commit befe455f59de8c7bc66b85ed52aae8cbc95325fa)
diff --git a/libblkid/src/superblocks/bcache.c b/libblkid/src/superblocks/bcache.c
index 6ab3fe9d4..28ac4b52b 100644
--- a/libblkid/src/superblocks/bcache.c
+++ b/libblkid/src/superblocks/bcache.c
@@ -142,17 +142,19 @@ struct bcachefs_super_block {
/* magic string len */
#define BCACHE_SB_MAGIC_LEN (sizeof(BCACHE_SB_MAGIC) - 1)
/* super block offset */
-#define BCACHE_SB_OFF 0x1000
+#define BCACHE_SB_OFF 0x1000U
/* supper block offset in kB */
#define BCACHE_SB_KBOFF (BCACHE_SB_OFF >> 10)
/* magic string offset within super block */
#define BCACHE_SB_MAGIC_OFF offsetof(struct bcache_super_block, magic)
/* start of checksummed data within superblock */
-#define BCACHE_SB_CSUMMED_START 8
+#define BCACHE_SB_CSUMMED_START 8U
/* granularity of offset and length fields within superblock */
-#define BCACHEFS_SECTOR_SIZE 512
+#define BCACHEFS_SECTOR_SIZE 512U
+/* maximum superblock size shift */
+#define BCACHEFS_SB_MAX_SIZE_SHIFT 0x10U
/* maximum superblock size */
-#define BCACHEFS_SB_MAX_SIZE 0x100000
+#define BCACHEFS_SB_MAX_SIZE (1U << BCACHEFS_SB_MAX_SIZE_SHIFT)
/* fields offset within super block */
#define BCACHEFS_SB_FIELDS_OFF offsetof(struct bcachefs_super_block, _start)
/* tag value for members field */
@@ -311,12 +313,16 @@ static int probe_bcachefs(blkid_probe pr, const struct blkid_idmag *mag)
return BLKID_PROBE_NONE;
sb_size = BCACHEFS_SB_FIELDS_OFF + BYTES(bcs);
- if (sb_size > ((uint64_t) BCACHEFS_SECTOR_SIZE << bcs->layout.sb_max_size_bits))
- return BLKID_PROBE_NONE;
if (sb_size > BCACHEFS_SB_MAX_SIZE)
return BLKID_PROBE_NONE;
+ if (bcs->layout.sb_max_size_bits > BCACHEFS_SB_MAX_SIZE_SHIFT)
+ return BLKID_PROBE_NONE;
+
+ if (sb_size > (BCACHEFS_SECTOR_SIZE << bcs->layout.sb_max_size_bits))
+ return BLKID_PROBE_NONE;
+
sb = blkid_probe_get_sb_buffer(pr, mag, sb_size);
if (!sb)
return BLKID_PROBE_NONE;
pkgs/os-specific/linux/util-linux/default.nix
+2 -3
View File
@@ -20,16 +20,15 @@
stdenv.mkDerivation rec {
pname = "util-linux" + lib.optionalString (!nlsSupport && !ncursesSupport && !systemdSupport) "-minimal";
version = "2.39.2";
version = "2.39.3";
src = fetchurl {
url = "mirror://kernel/linux/utils/util-linux/v${lib.versions.majorMinor version}/util-linux-${version}.tar.xz";
hash = "sha256-h6vfqo5JD4vm3el298gLm1/58wHhtn44meHwWlmhUx8=";
hash = "sha256-e2YF5I0aSfQ8xLTPxZ8xPQ3VQC+kC5aBC9Vy4Wff7Q8=";
};
patches = [
./rtcwake-search-PATH-for-shutdown.patch
./bcachefs-patch-set.patch
];
# We separate some of the utilities into their own outputs. This
pkgs/test/auto-patchelf-hook/default.nix
+6
View File
@@ -0,0 +1,6 @@
{ lib, callPackage }:
lib.recurseIntoAttrs {
withStructuredAttrs = callPackage ./package.nix { __structuredAttrs = true; };
withoutStructuredAttrs = callPackage ./package.nix { __structuredAttrs = false; };
}
pkgs/test/auto-patchelf-hook/package.nix
+96
View File
@@ -0,0 +1,96 @@
# This is a test for autoPatchelfHook. To test it, we just need a simple binary
# which uses the hook. We took the derivation from tonelib-jam, which sounds
# like a good candidate with a small closure, and trimmed it down.
{ stdenv
, lib
, fetchurl
, autoPatchelfHook
, dpkg
, freetype
, curl
# This test checks that the behavior of autoPatchelfHook is correct whether
# __structuredAttrs
# (https://nixos.org/manual/nix/stable/language/advanced-attributes#adv-attr-structuredAttrs)
# is set or not. Hence __structuredAttrs is provided as a parameter.
, __structuredAttrs
}:
let runtimeDependencies = [
(lib.getLib curl)
"/some/dep"
"/some/other/dep"
]
# A dependency with space only works with __structuredAttrs set to true.
++ lib.lists.optional __structuredAttrs "/some/dep with space";
in
stdenv.mkDerivation {
name = "auto-patchelf-test";
src = fetchurl {
url = "https://tonelib.net/download/221222/ToneLib-Jam-amd64.deb";
sha256 = "sha256-c6At2lRPngQPpE7O+VY/Hsfw+QfIb3COIuHfbqqIEuM=";
};
unpackCmd = ''
dpkg -x $curSrc source
'';
nativeBuildInputs = [
dpkg
autoPatchelfHook
];
installPhase = ''
mv usr $out
'';
buildInputs = [
freetype
];
autoPatchelfIgnoreMissingDeps = [
"libGL.so.1"
"libasound.so.2"
];
inherit runtimeDependencies;
# Additional phase performing the actual test.
installCheckPhase =
let allDeps = runtimeDependencies ++ [ (lib.getLib freetype) ];
in
''
local binary="$out/bin/ToneLib-Jam"
local interpreter=$(patchelf --print-interpreter $binary)
local runpath=$(patchelf --print-rpath $binary)
local glibcStorePath="${stdenv.cc.libc}"
# Check that the glibc path is a prefix of the interpreter. If
# autoPatchelfHook ran correctly, the binary should have set the interpreter
# to point to the store.
echo "[auto-patchelf-hook-test]: Check that the interpreter is in the store"
test "''${interpreter#$glibcStorePath}" != "$interpreter"
readarray -td':' runpathArray < <(echo -n "$runpath")
echo "[auto-patchelf-hook-test]: Check that the runpath has the right number of entries"
test "''${#runpathArray[@]}" -eq ${builtins.toString (builtins.length allDeps)}
echo "[auto-patchelf-hook-test]: Check that the runpath contains the expected runtime deps"
''
+ lib.strings.concatStringsSep "\n"
(lib.lists.imap0
(i: path:
let iAsStr = builtins.toString i; in
''
echo "[auto-patchelf-hook-test]: Check that entry ${iAsStr} is ${path}"
test "''${paths[${iAsStr}]}" = "$path"
'')
allDeps
);
doInstallCheck = true;
inherit __structuredAttrs;
}
pkgs/test/default.nix
+2
View File
@@ -169,4 +169,6 @@ with pkgs;
pkgs-lib = recurseIntoAttrs (import ../pkgs-lib/tests { inherit pkgs; });
nixpkgs-check-by-name = callPackage ./nixpkgs-check-by-name { };
auto-patchelf-hook = callPackage ./auto-patchelf-hook { };
}
pkgs/tools/networking/curl/configure-ipv6-autodetect.diff
+46
View File
@@ -0,0 +1,46 @@
diff --git a/configure b/configure
index 04d1de1..5de1b41 100755
--- a/configure
+++ b/configure
@@ -24949,15 +24949,12 @@ else $as_nop
# include <netinet/in6.h>
#endif
#endif
-#include <stdlib.h> /* for exit() */
-main()
+
+int main(void)
{
struct sockaddr_in6 s;
(void)s;
- if (socket(AF_INET6, SOCK_STREAM, 0) < 0)
- exit(1);
- else
- exit(0);
+ return socket(AF_INET6, SOCK_STREAM, 0) < 0;
}
diff --git a/configure.ac b/configure.ac
index 2d71c83..bd38dd9 100644
--- a/configure.ac
+++ b/configure.ac
@@ -1679,15 +1679,12 @@ AS_HELP_STRING([--disable-ipv6],[Disable IPv6 support]),
# include <netinet/in6.h>
#endif
#endif
-#include <stdlib.h> /* for exit() */
-main()
+
+int main(void)
{
struct sockaddr_in6 s;
(void)s;
- if (socket(AF_INET6, SOCK_STREAM, 0) < 0)
- exit(1);
- else
- exit(0);
+ return socket(AF_INET6, SOCK_STREAM, 0) < 0;
}
]])
],
pkgs/tools/networking/curl/default.nix
+6
View File
@@ -57,6 +57,12 @@ stdenv.mkDerivation (finalAttrs: {
hash = "sha256-FsYqnErw9wPSi9pte783ukcFWtNBTXDexj4uYzbyqC0=";
};
patches = [
# fix ipv6 autodetect compile error in configure script
# remove once https://github.com/curl/curl/pull/12607 released (8.6.0)
./configure-ipv6-autodetect.diff
];
outputs = [ "bin" "dev" "out" "man" "devdoc" ];
separateDebugInfo = stdenv.isLinux;
pkgs/tools/nix/nixos-render-docs/default.nix
+1 -8
View File
@@ -1,18 +1,11 @@
{ lib
, stdenv
, python3
, python3Minimal
, runCommand
}:
let
# python3Minimal can't be overridden with packages on Darwin, due to a missing framework.
# Instead of modifying stdenv, we take the easy way out, since most people on Darwin will
# just be hacking on the Nixpkgs manual (which also uses make-options-doc).
python = ((if stdenv.isDarwin then python3 else python3Minimal).override {
self = python;
includeSiteCustomize = true;
}).override {
python = python3.override {
packageOverrides = final: prev: {
markdown-it-py = prev.markdown-it-py.overridePythonAttrs (_: {
doCheck = false;
pkgs/top-level/all-packages.nix
+5 -5
View File
@@ -16959,11 +16959,11 @@ with pkgs;
wrapRustcWith = { rustc-unwrapped, ... } @ args: callPackage ../build-support/rust/rustc-wrapper args;
wrapRustc = rustc-unwrapped: wrapRustcWith { inherit rustc-unwrapped; };
rust_1_74 = callPackage ../development/compilers/rust/1_74.nix {
rust_1_75 = callPackage ../development/compilers/rust/1_75.nix {
inherit (darwin.apple_sdk.frameworks) CoreFoundation Security SystemConfiguration;
llvm_16 = llvmPackages_16.libllvm;
llvm_17 = llvmPackages_17.libllvm;
};
rust = rust_1_74;
rust = rust_1_75;
mrustc = callPackage ../development/compilers/mrustc { };
mrustc-minicargo = callPackage ../development/compilers/mrustc/minicargo.nix { };
@@ -16971,8 +16971,8 @@ with pkgs;
openssl = openssl_1_1;
};
rustPackages_1_74 = rust_1_74.packages.stable;
rustPackages = rustPackages_1_74;
rustPackages_1_75 = rust_1_75.packages.stable;
rustPackages = rustPackages_1_75;
inherit (rustPackages) cargo cargo-auditable cargo-auditable-cargo-wrapper clippy rustc rustPlatform;