From 6015511bd9d0eb09498457eb04e8778a71554499 Mon Sep 17 00:00:00 2001 From: Moraxyc Date: Sat, 1 Nov 2025 10:44:24 +0800 Subject: [PATCH 1/9] vboot_reference: rename to vboot-utils --- pkgs/by-name/vb/{vboot_reference => vboot-utils}/package.nix | 0 pkgs/top-level/aliases.nix | 1 + 2 files changed, 1 insertion(+) rename pkgs/by-name/vb/{vboot_reference => vboot-utils}/package.nix (100%) diff --git a/pkgs/by-name/vb/vboot_reference/package.nix b/pkgs/by-name/vb/vboot-utils/package.nix similarity index 100% rename from pkgs/by-name/vb/vboot_reference/package.nix rename to pkgs/by-name/vb/vboot-utils/package.nix diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix index b4a6e14d7d4e..b3ee95ce368a 100644 --- a/pkgs/top-level/aliases.nix +++ b/pkgs/top-level/aliases.nix @@ -1533,6 +1533,7 @@ mapAliases { vamp.vampSDK = throw "'vamp.vampSDK' has been renamed to/replaced by 'vamp-plugin-sdk'"; # Converted to throw 2025-10-27 vaultwarden-vault = throw "'vaultwarden-vault' has been renamed to/replaced by 'vaultwarden.webvault'"; # Converted to throw 2025-10-27 vbetool = throw "'vbetool' has been removed as it is broken and not maintained upstream."; # Added 2025-06-11 + vboot_reference = vboot-utils; # Added 2025-11-01 vc_0_7 = throw "'vc_0_7' has been removed as it was broken, unused in nixpkgs and unmaintained"; # Added 2025-10-20 vdirsyncerStable = throw "'vdirsyncerStable' has been renamed to/replaced by 'vdirsyncer'"; # Converted to throw 2025-10-27 ventoy-bin = throw "'ventoy-bin' has been renamed to/replaced by 'ventoy'"; # Converted to throw 2025-10-27 From e4aabc0530bc80210ae35cc570f93134d62aefde Mon Sep 17 00:00:00 2001 From: Moraxyc Date: Sat, 1 Nov 2025 10:46:53 +0800 Subject: [PATCH 2/9] vboot-utils: migrate to finalAttrs --- pkgs/by-name/vb/vboot-utils/package.nix | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/vb/vboot-utils/package.nix b/pkgs/by-name/vb/vboot-utils/package.nix index 3c9ffbf9a881..40d3246e4c37 100644 --- a/pkgs/by-name/vb/vboot-utils/package.nix +++ b/pkgs/by-name/vb/vboot-utils/package.nix @@ -9,13 +9,13 @@ xz, }: -stdenv.mkDerivation { +stdenv.mkDerivation (finalAttrs: { pname = "vboot_reference"; version = "135.16209"; src = fetchFromGitiles { url = "https://chromium.googlesource.com/chromiumos/platform/vboot_reference"; - rev = "bf4b21294a1c2c6b94f400819d3fce4a905b3afe"; # refs/heads/release-R135-16209.B + rev = "refs/heads/release-R${finalAttrs.passthru.versionFormatted}.B"; hash = "sha256-frg7NkK173wAHJRedtbJI5jI8Kee/VkByh5DCUzD9OA="; }; @@ -56,10 +56,14 @@ stdenv.mkDerivation { cp -r tests/devkeys* $out/share/vboot/ ''; + passthru = { + versionFormatted = lib.concatStringsSep "-" (lib.versions.splitVersion finalAttrs.version); + }; + meta = { description = "Chrome OS partitioning and kernel signing tools"; license = lib.licenses.bsd3; platforms = lib.platforms.linux; maintainers = [ lib.maintainers.jmbaur ]; }; -} +}) From 2ccdc74273e5903dec078a8d7ed4285b5d30cf0b Mon Sep 17 00:00:00 2001 From: Moraxyc Date: Sat, 1 Nov 2025 10:53:53 +0800 Subject: [PATCH 3/9] vboot-utils: 135.16209 -> 143.16463 --- pkgs/by-name/vb/vboot-utils/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/vb/vboot-utils/package.nix b/pkgs/by-name/vb/vboot-utils/package.nix index 40d3246e4c37..baa9892df342 100644 --- a/pkgs/by-name/vb/vboot-utils/package.nix +++ b/pkgs/by-name/vb/vboot-utils/package.nix @@ -11,12 +11,12 @@ stdenv.mkDerivation (finalAttrs: { pname = "vboot_reference"; - version = "135.16209"; + version = "143.16463"; src = fetchFromGitiles { url = "https://chromium.googlesource.com/chromiumos/platform/vboot_reference"; rev = "refs/heads/release-R${finalAttrs.passthru.versionFormatted}.B"; - hash = "sha256-frg7NkK173wAHJRedtbJI5jI8Kee/VkByh5DCUzD9OA="; + hash = "sha256-8a49xD+EYXDouFuBmLyAtPxThYET6DtKImBPzXVhpxE="; }; nativeBuildInputs = [ pkg-config ]; From 9d748b82bb7fe80147ae8662ed9dc771a5a6490d Mon Sep 17 00:00:00 2001 From: Moraxyc Date: Sat, 1 Nov 2025 10:56:36 +0800 Subject: [PATCH 4/9] vboot-utils: add flashrom support --- pkgs/by-name/vb/vboot-utils/package.nix | 21 +++++++++++++++++++-- 1 file changed, 19 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/vb/vboot-utils/package.nix b/pkgs/by-name/vb/vboot-utils/package.nix index baa9892df342..051bb0ac0382 100644 --- a/pkgs/by-name/vb/vboot-utils/package.nix +++ b/pkgs/by-name/vb/vboot-utils/package.nix @@ -7,6 +7,9 @@ openssl, libyaml, xz, + flashrom, + + withFlashrom ? true, }: stdenv.mkDerivation (finalAttrs: { @@ -25,7 +28,8 @@ stdenv.mkDerivation (finalAttrs: { libyaml openssl xz - ]; + ] + ++ lib.optional withFlashrom finalAttrs.passthru.flashromChromeos; enableParallelBuilding = true; @@ -42,7 +46,7 @@ stdenv.mkDerivation (finalAttrs: { makeFlags = [ "DESTDIR=$(out)" "HOST_ARCH=${stdenv.hostPlatform.parsed.cpu.name}" - "USE_FLASHROM=0" + "USE_FLASHROM=${if withFlashrom then "1" else "0"}" # Upstream has weird opinions about DESTDIR # https://chromium.googlesource.com/chromiumos/platform/vboot_reference/+/refs/heads/release-R135-16209.B/Makefile#51 "UB_DIR=${placeholder "out"}/bin" @@ -58,6 +62,19 @@ stdenv.mkDerivation (finalAttrs: { passthru = { versionFormatted = lib.concatStringsSep "-" (lib.versions.splitVersion finalAttrs.version); + flashromChromeos = flashrom.overrideAttrs (_prev: { + src = fetchFromGitiles { + url = "https://chromium.googlesource.com/chromiumos/third_party/flashrom"; + rev = "refs/heads/release-R${finalAttrs.passthru.versionFormatted}.B-master"; + hash = "sha256-zOoWpuS/vDLvnRPdA9FNGhNbcwh3PMQwbdfqsyqj858="; + }; + + # requires git + mesonFlags = _prev.mesonFlags ++ [ (lib.mesonEnable "documentation" false) ]; + + # requires specific hardware + doCheck = false; + }); }; meta = { From feb8b3e2e1a790ed4d373cd4fe3b4d8ada8ab6f5 Mon Sep 17 00:00:00 2001 From: Moraxyc Date: Sat, 1 Nov 2025 10:59:12 +0800 Subject: [PATCH 5/9] vboot-utils: fix flashrom not found --- pkgs/by-name/vb/vboot-utils/package.nix | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/pkgs/by-name/vb/vboot-utils/package.nix b/pkgs/by-name/vb/vboot-utils/package.nix index 051bb0ac0382..030354e9326c 100644 --- a/pkgs/by-name/vb/vboot-utils/package.nix +++ b/pkgs/by-name/vb/vboot-utils/package.nix @@ -3,6 +3,7 @@ stdenv, fetchFromGitiles, pkg-config, + makeBinaryWrapper, libuuid, openssl, libyaml, @@ -22,7 +23,11 @@ stdenv.mkDerivation (finalAttrs: { hash = "sha256-8a49xD+EYXDouFuBmLyAtPxThYET6DtKImBPzXVhpxE="; }; - nativeBuildInputs = [ pkg-config ]; + nativeBuildInputs = [ + pkg-config + makeBinaryWrapper + ]; + buildInputs = [ libuuid libyaml @@ -58,6 +63,10 @@ stdenv.mkDerivation (finalAttrs: { postInstall = '' mkdir -p $out/share/vboot cp -r tests/devkeys* $out/share/vboot/ + '' + + lib.optionalString withFlashrom '' + wrapProgram $out/bin/crossystem \ + --prefix PATH : ${lib.makeBinPath [ finalAttrs.passthru.flashromChromeos ]} ''; passthru = { From e3115a58eefa26c8d05ecfbeacd46ae7b3260bd7 Mon Sep 17 00:00:00 2001 From: Moraxyc Date: Sat, 1 Nov 2025 11:07:36 +0800 Subject: [PATCH 6/9] vboot-utils: fix pname --- pkgs/by-name/vb/vboot-utils/package.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkgs/by-name/vb/vboot-utils/package.nix b/pkgs/by-name/vb/vboot-utils/package.nix index 030354e9326c..981202ea1fa0 100644 --- a/pkgs/by-name/vb/vboot-utils/package.nix +++ b/pkgs/by-name/vb/vboot-utils/package.nix @@ -14,7 +14,7 @@ }: stdenv.mkDerivation (finalAttrs: { - pname = "vboot_reference"; + pname = "vboot-utils"; version = "143.16463"; src = fetchFromGitiles { From 7655529213230cc1b794c9e2911a305dc2ac11cc Mon Sep 17 00:00:00 2001 From: Moraxyc Date: Sat, 1 Nov 2025 11:10:52 +0800 Subject: [PATCH 7/9] ubootPythonTools.binman: use vboot-utils --- pkgs/misc/uboot/python.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/misc/uboot/python.nix b/pkgs/misc/uboot/python.nix index 0e1bb72b657f..dc81ec04f37f 100644 --- a/pkgs/misc/uboot/python.nix +++ b/pkgs/misc/uboot/python.nix @@ -12,7 +12,7 @@ lzop, openssl, ubootTools, - vboot_reference, + vboot-utils, xilinx-bootgen, xz, zstd, @@ -85,7 +85,7 @@ rec { lzop openssl ubootTools - vboot_reference + vboot-utils xilinx-bootgen xz zstd From 9718f2952f51307a2800c2869a49162f5c121dce Mon Sep 17 00:00:00 2001 From: Wolfgang Walther Date: Sat, 1 Nov 2025 12:51:27 +0100 Subject: [PATCH 8/9] workflows/check: run codeowners validator from trusted checkout In f7d6d11e8e8e046faaa6fbc55c2c1312e967cf04 I wrongly assumed that running from the untrusted checkout should be fine for the codeowners validator, because we removed all the logic for privileged tokens. However, this job also contains access to the cachix secret, which could be used to push malicious code to cachix, which would then be pulled by a more privileged workflow like reviewers.yml later. --- .github/workflows/check.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml index f55ff86dfdcf..d6b136204d9b 100644 --- a/.github/workflows/check.yml +++ b/.github/workflows/check.yml @@ -80,6 +80,7 @@ jobs: uses: ./.github/actions/checkout with: merged-as-untrusted-at: ${{ inputs.mergedSha }} + target-as-trusted-at: ${{ inputs.targetSha }} - uses: cachix/install-nix-action@fd24c48048070c1be9acd18c9d369a83f0fe94d7 # v31 @@ -92,7 +93,7 @@ jobs: pushFilter: -source$ - name: Build codeowners validator - run: nix-build nixpkgs/untrusted/ci --arg nixpkgs ./nixpkgs/untrusted-pinned -A codeownersValidator + run: nix-build nixpkgs/trusted/ci --arg nixpkgs ./nixpkgs/trusted-pinned -A codeownersValidator - name: Validate codeowners env: From f66a380ea3ddb2b8899255b81467a9a01327cc1f Mon Sep 17 00:00:00 2001 From: Wolfgang Walther Date: Sat, 1 Nov 2025 12:53:03 +0100 Subject: [PATCH 9/9] workflows/pr: rename to pull-request-target To be able to disable the pr.yml workflow on GitHub, we need to rename it to a different name. Let's use the long name for consistency with merge-group.yml. This only affects the GitHub-internal name, not the visible name in the PR checklist, which is still "PR". This visible name is also used by nixpkgs-review, so that won't break. --- .github/workflows/README.md | 2 +- .../workflows/{pr.yml => pull-request-target.yml} | 0 .github/workflows/reviewers.yml | 2 +- .github/workflows/test.yml | 4 ++-- ci/github-script/labels.js | 14 +++++++++++++- 5 files changed, 17 insertions(+), 5 deletions(-) rename .github/workflows/{pr.yml => pull-request-target.yml} (100%) diff --git a/.github/workflows/README.md b/.github/workflows/README.md index 2c739bd56129..4aed9617cae4 100644 --- a/.github/workflows/README.md +++ b/.github/workflows/README.md @@ -64,7 +64,7 @@ This results in a key with the following semantics: ## Required Status Checks -The "Required Status Checks" branch ruleset is implemented in two top-level workflows: `pr.yml` and `merge-group.yml`. +The "Required Status Checks" branch ruleset is implemented in two top-level workflows: `pull-request-target.yml` and `merge-group.yml`. The PR workflow defines all checks that need to succeed to add a Pull Request to the Merge Queue. If no Merge Queue is set up for a branch, the PR workflow defines the checks required to merge into the target branch. diff --git a/.github/workflows/pr.yml b/.github/workflows/pull-request-target.yml similarity index 100% rename from .github/workflows/pr.yml rename to .github/workflows/pull-request-target.yml diff --git a/.github/workflows/reviewers.yml b/.github/workflows/reviewers.yml index b5d0ada43b9d..f22e44d7cbff 100644 --- a/.github/workflows/reviewers.yml +++ b/.github/workflows/reviewers.yml @@ -102,7 +102,7 @@ jobs: const run_id = (await github.rest.actions.listWorkflowRuns({ owner: context.repo.owner, repo: context.repo.repo, - workflow_id: context.eventName === 'pull_request' ? 'test.yml' : 'pr.yml', + workflow_id: context.eventName === 'pull_request' ? 'test.yml' : 'pull-request-target.yml', event: context.eventName, head_sha: context.payload.pull_request.head.sha })).data.workflow_runs[0].id diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 4cac4b3f0bb6..b26f7ee98998 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -63,7 +63,7 @@ jobs: '.github/workflows/eval.yml', '.github/workflows/labels.yml', '.github/workflows/lint.yml', - '.github/workflows/pr.yml', + '.github/workflows/pull-request-target.yml', '.github/workflows/reviewers.yml', '.github/workflows/test.yml', ].includes(file))) core.setOutput('pr', true) @@ -87,7 +87,7 @@ jobs: if: needs.prepare.outputs.pr name: PR needs: [prepare] - uses: ./.github/workflows/pr.yml + uses: ./.github/workflows/pull-request-target.yml # Those are actually only used on the pull_request_target event, but will throw an error if not set. permissions: issues: write diff --git a/ci/github-script/labels.js b/ci/github-script/labels.js index adb730aa257d..bd6c81bd9d99 100644 --- a/ci/github-script/labels.js +++ b/ci/github-script/labels.js @@ -199,12 +199,24 @@ module.exports = async ({ github, context, core, dry }) => { ( await github.rest.actions.listWorkflowRuns({ ...context.repo, + workflow_id: 'pull-request-target.yml', + event: 'pull_request_target', + exclude_pull_requests: true, + head_sha: pull_request.head.sha, + }) + ).data.workflow_runs[0] ?? + // TODO: Remove this after 2026-02-01, at which point all pr.yml artifacts will have expired. + ( + await github.rest.actions.listWorkflowRuns({ + ...context.repo, + // In older PRs, we need pr.yml instead of pull-request-target.yml. workflow_id: 'pr.yml', event: 'pull_request_target', exclude_pull_requests: true, head_sha: pull_request.head.sha, }) - ).data.workflow_runs[0] ?? {} + ).data.workflow_runs[0] ?? + {} // Newer PRs might not have run Eval to completion, yet. // Older PRs might not have an eval.yml workflow, yet.