Merge master into staging-next

nixos/doc/manual/release-notes/rl-2311.section.md

@@ -366,6 +366,10 @@
 
 - Package `cloud-sql-proxy` was renamed to `google-cloud-sql-proxy` as it cannot be used with other cloud providers.;
 
+- The Yama LSM is now enabled by default in the kernel, which prevents ptracing non-child processes.
+  This means you will not be able to attach gdb to an existing process, but will need to start that process from gdb (so it is a child).
+  Or you can set `boot.kernel.sysctl."kernel.yama.ptrace_scope"` to 0.
+
 - Package `pash` was removed due to being archived upstream. Use `powershell` as an alternative.
 
 - The option `services.plausible.releaseCookiePath` has been removed: Plausible does not use any distributed Erlang features, and does not plan to (see [discussion](https://github.com/NixOS/nixpkgs/pull/130297#issuecomment-1805851333)), so NixOS now disables them, and the Erlang cookie becomes unnecessary. You may delete the file that `releaseCookiePath` was set to.

nixos/modules/config/sysctl.nix

@@ -69,9 +69,6 @@ in
     # users as these make it easier to exploit kernel vulnerabilities.
     boot.kernel.sysctl."kernel.kptr_restrict" = mkDefault 1;
 
-    # Disable YAMA by default to allow easy debugging.
-    boot.kernel.sysctl."kernel.yama.ptrace_scope" = mkDefault 0;
-
     # Improve compatibility with applications that allocate
     # a lot of memory, like modern games
     boot.kernel.sysctl."vm.max_map_count" = mkDefault 1048576;

nixos/modules/profiles/hardened.nix

@@ -79,10 +79,6 @@ with lib;
     "ufs"
   ];
 
-  # Restrict ptrace() usage to processes with a pre-defined relationship
-  # (e.g., parent/child)
-  boot.kernel.sysctl."kernel.yama.ptrace_scope" = mkOverride 500 1;
-
   # Hide kptrs even for processes with CAP_SYSLOG
   boot.kernel.sysctl."kernel.kptr_restrict" = mkOverride 500 2;
 

nixos/modules/services/networking/tmate-ssh-server.nix

@@ -81,12 +81,12 @@ in
       [
         (pkgs.writeShellApplication {
           name = "tmate-client-config";
-          runtimeInputs = with pkgs;[ openssh coreutils sd ];
+          runtimeInputs = with pkgs;[ openssh coreutils ];
           text = ''
             RSA_SIG="$(ssh-keygen -l -E SHA256 -f "${keysDir}/ssh_host_rsa_key.pub" | cut -d ' ' -f 2)"
             ED25519_SIG="$(ssh-keygen -l -E SHA256 -f "${keysDir}/ssh_host_ed25519_key.pub" | cut -d ' ' -f 2)"
-            sd -sp '@ed25519_fingerprint@' "$ED25519_SIG" ${tmate-config} | \
-              sd -sp '@rsa_fingerprint@' "$RSA_SIG"
+            sed "s|@ed25519_fingerprint@|$ED25519_SIG|g" ${tmate-config} | \
+              sed "s|@rsa_fingerprint@|$RSA_SIG|g"
           '';
         })
       ];

pkgs/applications/misc/clipcat/default.nix

@@ -1,57 +1,50 @@
 { lib
 , fetchFromGitHub
-, installShellFiles
 , rustPlatform
-, rustfmt
-, xorg
-, pkg-config
 , protobuf
-, python3
+, xvfb-run
+, installShellFiles
 }:
 
 rustPlatform.buildRustPackage rec {
   pname = "clipcat";
-  version = "0.5.1";
+  version = "0.6.2";
 
   src = fetchFromGitHub {
     owner = "xrelkd";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-dV17xP6xG6Nyi6m0CdH8Mk4Y0giDtsv/QiM23jF58q0=";
+    sha256 = "sha256-sofP+zyyakB4w1R3wS/FNDTOWwNeDJyB5CBtR3yZsmE=";
   };
 
-  cargoLock = {
-    lockFile = ./Cargo.lock;
-    outputHashes = {
-      "x11-clipboard-0.6.0" = "sha256-dKx2kda5JC79juksP2qiO9yfeFCWymcYhGPSygQ0mrg=";
-    };
-  };
-
-  # needed for internal protobuf c wrapper library
-  PROTOC = "${protobuf}/bin/protoc";
-  PROTOC_INCLUDE = "${protobuf}/include";
+  cargoHash = "sha256-aOXAjxmk5uqBOw/l1CW/LbeBucr7p4iudbVY6d7yEjg=";
 
   nativeBuildInputs = [
-    pkg-config
-
-    rustPlatform.bindgenHook
-
-    rustfmt
     protobuf
-
-    python3
-
     installShellFiles
   ];
 
-  buildInputs = [ xorg.libxcb ];
+  nativeCheckInputs = [
+    xvfb-run
+  ];
 
-  buildFeatures = [ "all" ];
+  useNextest = true;
+
+  # cargo-nextest help us retry the failed test cases
+  NEXTEST_RETRIES = 5;
+
+  # Some test cases need to interactive with X11, we use xvfb-run here
+  checkPhase = ''
+    xvfb-run --auto-servernum cargo nextest run --release --workspace --no-fail-fast --no-capture
+  '';
 
   postInstall = ''
-    installShellCompletion --bash completions/bash-completion/completions/*
-    installShellCompletion --fish completions/fish/completions/*
-    installShellCompletion --zsh  completions/zsh/site-functions/*
+    for cmd in clipcatd clipcatctl clipcat-menu clipcat-notify; do
+      installShellCompletion --cmd $cmd \
+        --bash <($out/bin/$cmd completions bash) \
+        --fish <($out/bin/$cmd completions fish) \
+        --zsh  <($out/bin/$cmd completions zsh)
+    done
   '';
 
   meta = with lib; {

pkgs/by-name/br/bruno/package.nix

@@ -15,11 +15,11 @@
 
 stdenv.mkDerivation rec {
   pname = "bruno";
-  version = "1.1.1";
+  version = "1.2.0";
 
   src = fetchurl {
     url = "https://github.com/usebruno/bruno/releases/download/v${version}/bruno_${version}_amd64_linux.deb";
-    hash = "sha256-lG5OMxDS7I2jmI6syWzTsHm/NEoGanilW8IPebs+/10=";
+    hash = "sha256-60YwXAukGnMiaYxVOcUgGa/r/If1pJC6pMyyltTfd1c=";
   };
 
   nativeBuildInputs = [ autoPatchelfHook dpkg wrapGAppsHook ];
@@ -55,7 +55,7 @@ stdenv.mkDerivation rec {
     description = "Open-source IDE For exploring and testing APIs.";
     homepage = "https://www.usebruno.com";
     license = licenses.mit;
-    maintainers = with maintainers; [ water-sucks lucasew ];
+    maintainers = with maintainers; [ water-sucks lucasew kashw2 ];
     platforms = [ "x86_64-linux" ];
   };
 }

pkgs/desktops/budgie/budgie-control-center/default.nix

@@ -39,7 +39,6 @@
 , libwacom
 , libxml2
 , libxslt
-, magpie
 , meson
 , modemmanager
 , networkmanager
@@ -109,6 +108,7 @@ stdenv.mkDerivation rec {
     gnome.gnome-remote-desktop
     gnome.gnome-settings-daemon
     gnome.gnome-user-share
+    gnome.mutter
     gsettings-desktop-schemas
     gsound
     gtk3
@@ -126,7 +126,6 @@ stdenv.mkDerivation rec {
     libsecret
     libwacom
     libxml2
-    magpie
     modemmanager
     networkmanager
     polkit
@@ -159,7 +158,7 @@ stdenv.mkDerivation rec {
       --prefix XDG_DATA_DIRS : "${gdk-pixbuf}/share"
       --prefix XDG_DATA_DIRS : "${librsvg}/share"
       # WM keyboard shortcuts
-      --prefix XDG_DATA_DIRS : "${magpie}/share"
+      --prefix XDG_DATA_DIRS : "${gnome.mutter}/share"
     )
   '';
 

pkgs/desktops/budgie/budgie-desktop/default.nix

@@ -71,6 +71,7 @@ stdenv.mkDerivation (finalAttrs: {
     gnome-menus
     gnome.gnome-bluetooth_1_0
     gnome.gnome-settings-daemon
+    gnome.mutter
     gnome.zenity
     graphene
     gtk3

pkgs/desktops/budgie/budgie-gsettings-overrides/default.nix

@@ -4,7 +4,7 @@
 , budgie-desktop-view
 , glib
 , gsettings-desktop-schemas
-, magpie
+, gnome
 , mate
 , nixos-artwork
 , nixos-background-light ? nixos-artwork.wallpapers.nineish
@@ -63,7 +63,7 @@ let
       budgie-desktop
       budgie-desktop-view
       gsettings-desktop-schemas
-      magpie
+      gnome.mutter
   ] ++ extraGSettingsOverridePackages;
 
 in

pkgs/desktops/budgie/magpie/default.nix

@@ -70,7 +70,6 @@ stdenv.mkDerivation (finalAttrs: {
     "-Degl_device=true"
     "-Dprofiler=true"
     "-Ddocs=true"
-    "-Dwith_shared_components=true"
   ];
 
   propagatedBuildInputs = [

pkgs/desktops/gnome/extensions/pop-shell/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-shell-extension-pop-shell";
-  version = "unstable-2023-04-27";
+  version = "unstable-2023-11-10";
 
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "shell";
-    rev = "b5acccefcaa653791d25f70a22c0e04f1858d96e";
-    hash = "sha256-w6EBHKWJ4L3ZRVmFqZhCqHGumbElQXk9udYSnwjIl6c=";
+    rev = "aafc9458a47a68c396933c637de00421f5198a2a";
+    hash = "sha256-74lZbEYHj7fufRSbuI2SN9rqbB3gpRa0V96qjAFc01s=";
   };
 
   nativeBuildInputs = [ glib gjs typescript ];

pkgs/desktops/gnome/extensions/pop-shell/fix-gjs.patch

@@ -1,29 +1,26 @@
 diff --git a/src/extension.ts b/src/extension.ts
-index c3833e9..611e84c 100644
+index f34e865..f12d4db 100644
 --- a/src/extension.ts
 +++ b/src/extension.ts
-@@ -544,7 +544,7 @@ export class Ext extends Ecs.System<ExtEvent> {
-             return true
-         }
+@@ -556,7 +556,7 @@ export class Ext extends Ecs.System<ExtEvent> {
+             return true;
+         };
  
--        const ipc = utils.async_process_ipc(["gjs", path])
-+        const ipc = utils.async_process_ipc([path])
+-        const ipc = utils.async_process_ipc(['gjs', '--module', path]);
++        const ipc = utils.async_process_ipc([path]);
  
          if (ipc) {
              const generator = (stdout: any, res: any) => {
 diff --git a/src/panel_settings.ts b/src/panel_settings.ts
-index 5d02d33..1cd70d0 100644
+index fbcafbf..ef409ee 100644
 --- a/src/panel_settings.ts
 +++ b/src/panel_settings.ts
-@@ -348,7 +348,7 @@ function color_selector(ext: Ext, menu: any) {
+@@ -352,7 +352,7 @@ function color_selector(ext: Ext, menu: any) {
      color_selector_item.add_child(color_button);
      color_button.connect('button-press-event', () => {
-         let path = Me.dir.get_path() + "/color_dialog/main.js";
--        let resp = GLib.spawn_command_line_async(`gjs ${path}`);
+         let path = get_current_path() + '/color_dialog/main.js';
+-        let resp = GLib.spawn_command_line_async(`gjs --module ${path}`);
 +        let resp = GLib.spawn_command_line_async(`${path}`);
          if (!resp) {
- 
              return null;
--- 
-2.37.3
-
+         }

pkgs/development/python-modules/asysocks/default.nix

@@ -7,14 +7,14 @@
 
 buildPythonPackage rec {
   pname = "asysocks";
-  version = "0.2.9";
+  version = "0.2.11";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-zg3xEveyEOisk8s4R/36Ly9JH5xDvVsjS4FZIxHOlZ8=";
+    hash = "sha256-Fwm898mU7wvH5OkYVUrw3rL4VT5yyvoHxVtfcuL+4bQ=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/cytoolz/default.nix

@@ -32,10 +32,10 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [ pytestCheckHook ];
 
-  meta = {
+  meta = with lib; {
     homepage = "https://github.com/pytoolz/cytoolz/";
     description = "Cython implementation of Toolz: High performance functional utilities";
-    license = "licenses.bsd3";
+    license = licenses.bsd3;
     maintainers = with lib.maintainers; [ fridh ];
   };
 }

pkgs/development/python-modules/dbus-fast/default.nix

@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "dbus-fast";
-  version = "2.14.0";
+  version = "2.15.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "Bluetooth-Devices";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-IT18r7LKOVuiCuE/QzW6X/jkr5EK8sSR038i4LR1bcs=";
+    hash = "sha256-TgkOE6gOFbrbHsllpAZuNNQm3EqCrWW5WSMKqW8bOuI=";
   };
 
   # The project can build both an optimized cython version and an unoptimized

pkgs/development/python-modules/minikerberos/default.nix

@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "minikerberos";
-  version = "0.4.2";
+  version = "0.4.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-BECKWG5nxICOSfQJgXJqCki2gcv/ZRrDFo57nXHvhos=";
+    hash = "sha256-9VPK15GIPcG+UcyUinevKyEoom6mNA99NKL0XWd9G/M=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/paypalrestsdk/default.nix

@@ -1,20 +0,0 @@
-{ buildPythonPackage, fetchPypi
-, requests, six, pyopenssl }:
-
-buildPythonPackage rec {
-  pname = "paypalrestsdk";
-  version = "1.13.2";
-
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "sha256-kZUfNtsw1oW5ceFASYSRo1bPHfjv9xZWYDrKTtcs81o=";
-  };
-
-  propagatedBuildInputs = [ requests six pyopenssl ];
-
-  meta = {
-    homepage = "https://developer.paypal.com/";
-    description = "Python APIs to create, process and manage payment";
-    license = "PayPal SDK License";
-  };
-}

pkgs/development/python-modules/pillow-simd/default.nix

@@ -31,7 +31,7 @@ import ../pillow/generic.nix (rec {
 
       Currently, Pillow-SIMD can be compiled with SSE4 (default) or AVX2 support.
     '';
-    license = "http://www.pythonware.com/products/pil/license.htm";
+    license = licenses.hpnd;
     maintainers = with maintainers; [ ];
   };
 } // args )

pkgs/development/python-modules/pycollada/default.nix

@@ -18,7 +18,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python library for reading and writing collada documents";
     homepage = "http://pycollada.github.io/";
-    license = "BSD"; # they don't specify which BSD variant
+    license = licenses.bsd3;
     platforms = with platforms; linux ++ darwin;
     maintainers = with maintainers; [ bjornfor ];
   };

pkgs/development/python-modules/pyopengl/default.nix

@@ -69,7 +69,7 @@ buildPythonPackage rec {
       Python 2.5) ctypes library, and is provided under an extremely
       liberal BSD-style Open-Source license.
     '';
-    license = "BSD-style";
+    license = licenses.bsd3;
     platforms = platforms.mesaPlatforms;
   };
 

pkgs/development/python-modules/wasmer/default.nix

@@ -8,6 +8,7 @@
 , libiconv
 , libffi
 , libxml2
+, llvm_14
 , ncurses
 , zlib
 }:
@@ -93,7 +94,7 @@ in
     pname = "wasmer-compiler-llvm";
     buildAndTestSubdir = "packages/compiler-llvm";
     cargoHash = "sha256-xawbf5gXXV+7I2F2fDSaMvjtFvGDBtqX7wL3c28TSbA=";
-    extraNativeBuildInputs = [ rustc.llvm ];
+    extraNativeBuildInputs = [ llvm_14 ];
     extraBuildInputs = [ libffi libxml2.out ncurses zlib ];
   };
 

pkgs/development/web/bun/default.nix

@@ -12,7 +12,7 @@
 }:
 
 stdenvNoCC.mkDerivation rec {
-  version = "1.0.13";
+  version = "1.0.14";
   pname = "bun";
 
   src = passthru.sources.${stdenvNoCC.hostPlatform.system} or (throw "Unsupported system: ${stdenvNoCC.hostPlatform.system}");
@@ -51,19 +51,19 @@ stdenvNoCC.mkDerivation rec {
     sources = {
       "aarch64-darwin" = fetchurl {
         url = "https://github.com/oven-sh/bun/releases/download/bun-v${version}/bun-darwin-aarch64.zip";
-        hash = "sha256-HAcPrC/xFu9UHdpyF13OW3cXQEmpcyvtswaGAdHtnUE=";
+        hash = "sha256-15YHmf3hJtkRXV8JO2P6XEx3ySOmaXIXU++pt6xl7fM=";
       };
       "aarch64-linux" = fetchurl {
         url = "https://github.com/oven-sh/bun/releases/download/bun-v${version}/bun-linux-aarch64.zip";
-        hash = "sha256-dadj5YKpWOxWzn7z+ve3naHmfVsX4fAtNARruXyY/pM=";
+        hash = "sha256-DEsYsn6zuUVFt6LerkMIb8bIPvCL6bW2qtX3fg6QLvw=";
       };
       "x86_64-darwin" = fetchurl {
         url = "https://github.com/oven-sh/bun/releases/download/bun-v${version}/bun-darwin-x64.zip";
-        hash = "sha256-QbiEZ1YRozE/af41c7/jI+DXAGAhjplTsMaZoCGKYTo=";
+        hash = "sha256-kZTp/L/C+8zs7mY9wogM5zRYjXXvLEEW8a1GzyhuQyA=";
       };
       "x86_64-linux" = fetchurl {
         url = "https://github.com/oven-sh/bun/releases/download/bun-v${version}/bun-linux-x64.zip";
-        hash = "sha256-rOWXBvYJfhi+3fSv6ZDU5tZ51Nfy4nBIRaFOimRHHTs=";
+        hash = "sha256-8ixHAN2VpeEdixoq8Aw4KwG+B7bw5u35XVT5TFZzeRE=";
       };
     };
     updateScript = writeShellScript "update-bun" ''

pkgs/servers/jellyfin/default.nix

@@ -14,13 +14,13 @@
 
 buildDotnetModule rec {
   pname = "jellyfin";
-  version = "10.8.11"; # ensure that jellyfin-web has matching version
+  version = "10.8.12"; # ensure that jellyfin-web has matching version
 
   src = fetchFromGitHub {
     owner = "jellyfin";
     repo = "jellyfin";
     rev = "v${version}";
-    sha256 = "deJv2lWo0kXGixCBJzfdIBZcNjg45y2ITGQfWcM2smU=";
+    sha256 = "aou73pgusNIEyRxzNalfow/PThgK6Gn6XiylBoRwR1w=";
   };
 
   patches = [

pkgs/tools/networking/ngrep/default.nix

@@ -44,10 +44,12 @@ stdenv.mkDerivation rec {
       more common packet sniffing tools, such as tcpdump and snoop.
     '';
     homepage = "https://github.com/jpr5/ngrep/";
-    # <ngrep>/doc/README.txt says that ngrep itself is licensed under a
-    # 'BSD-like' license but that the 'regex' library (in the ngrep tarball) is
-    # GPLv2.
-    license = "ngrep";  # Some custom BSD-style, see LICENSE.txt
+    license = {
+      shortName = "ngrep";  # BSD-style, see README.md and LICENSE
+      url = "https://github.com/jpr5/ngrep/blob/master/LICENSE";
+      free = true;
+      redistributable = true;
+    };
     platforms = with platforms; linux ++ darwin;
     maintainers = [ maintainers.bjornfor ];
   };

pkgs/top-level/python-aliases.nix

@@ -264,6 +264,7 @@ mapAliases ({
   pam = python-pam; # added 2020-09-07.
   PasteDeploy = pastedeploy; # added 2021-10-07
   pathpy = path; # added 2022-04-12
+  paypalrestsdk = throw "paypalrestsdk was removed, the upstream repo was archived back in 2020"; # Added 2023-11-25
   pdfposter = throw "pdfposter was promoted to a top-level attribute"; # Added 2023-06-29
   pdfminer = pdfminer-six; # added 2022-05-25
   pep257 = pydocstyle; # added 2022-04-12

pkgs/top-level/python-packages.nix

@@ -8859,8 +8859,6 @@ self: super: with self; {
 
   paypalhttp = callPackage ../development/python-modules/paypalhttp { };
 
-  paypalrestsdk = callPackage ../development/python-modules/paypalrestsdk { };
-
   pbkdf2 = callPackage ../development/python-modules/pbkdf2 { };
 
   pbr = callPackage ../development/python-modules/pbr { };