diff --git a/.github/workflows/backport.yml b/.github/workflows/backport.yml index 159175ceb634..1e5a1a229d54 100644 --- a/.github/workflows/backport.yml +++ b/.github/workflows/backport.yml @@ -18,7 +18,7 @@ jobs: steps: # Use a GitHub App to create the PR so that CI gets triggered # The App is scoped to Repository > Contents and Pull Requests: write for Nixpkgs - - uses: actions/create-github-app-token@5d869da34e18e7287c1daad50e0b8ea0f506ce69 # v1.11.0 + - uses: actions/create-github-app-token@c1a285145b9d317df6ced56c09f525b5c2b6f755 # v1.11.1 id: app-token with: app-id: ${{ vars.BACKPORT_APP_ID }} diff --git a/.github/workflows/codeowners-v2.yml b/.github/workflows/codeowners-v2.yml index 5cfeafa8489e..6329e1d9ea11 100644 --- a/.github/workflows/codeowners-v2.yml +++ b/.github/workflows/codeowners-v2.yml @@ -62,7 +62,7 @@ jobs: - name: Build codeowners validator run: nix-build base/ci -A codeownersValidator - - uses: actions/create-github-app-token@5d869da34e18e7287c1daad50e0b8ea0f506ce69 # v1.11.0 + - uses: actions/create-github-app-token@c1a285145b9d317df6ced56c09f525b5c2b6f755 # v1.11.1 id: app-token with: app-id: ${{ vars.OWNER_RO_APP_ID }} @@ -94,7 +94,7 @@ jobs: # This is intentional, because we need to request the review of owners as declared in the base branch. - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - - uses: actions/create-github-app-token@5d869da34e18e7287c1daad50e0b8ea0f506ce69 # v1.11.0 + - uses: actions/create-github-app-token@c1a285145b9d317df6ced56c09f525b5c2b6f755 # v1.11.1 id: app-token with: app-id: ${{ vars.OWNER_APP_ID }} diff --git a/lib/generators.nix b/lib/generators.nix index 4317e49c2538..376aa4081bf4 100644 --- a/lib/generators.nix +++ b/lib/generators.nix @@ -70,6 +70,7 @@ let split toJSON typeOf + escapeXML ; ## -- HELPER FUNCTIONS & DEFAULTS -- @@ -548,13 +549,17 @@ in rec { # Inputs - Options - : Empty set, there may be configuration options in the future + Structured function argument + + : escape (optional, default: `false`) + : If this option is true, XML special characters are escaped in string values and keys Value : The value to be converted to Plist */ - toPlist = {}: v: let + toPlist = { + escape ? false + }: v: let expr = ind: x: if x == null then "" else if isBool x then bool ind x else @@ -568,10 +573,12 @@ in rec { literal = ind: x: ind + x; + maybeEscapeXML = if escape then escapeXML else x: x; + bool = ind: x: literal ind (if x then "" else ""); int = ind: x: literal ind "${toString x}"; - str = ind: x: literal ind "${x}"; - key = ind: x: literal ind "${x}"; + str = ind: x: literal ind "${maybeEscapeXML x}"; + key = ind: x: literal ind "${maybeEscapeXML x}"; float = ind: x: literal ind "${toString x}"; indent = ind: expr "\t${ind}"; @@ -597,7 +604,10 @@ in rec { (expr "\t${ind}" value) ]) x)); - in '' + in + # TODO: As discussed in #356502, deprecated functionality should be removed sometime after 25.11. + lib.warnIf (!escape && lib.oldestSupportedReleaseIsAtLeast 2505) "Using `lib.generators.toPlist` without `escape = true` is deprecated" + '' ${expr "" v} diff --git a/lib/tests/misc.nix b/lib/tests/misc.nix index 62f231cc51fd..f0c4b6f2c5e1 100644 --- a/lib/tests/misc.nix +++ b/lib/tests/misc.nix @@ -1641,7 +1641,7 @@ runTests { expected = "«foo»"; }; - testToPlist = { + testToPlistUnescaped = { expr = mapAttrs (const (generators.toPlist { })) { value = { nested.values = { @@ -1657,10 +1657,34 @@ runTests { emptylist = []; attrs = { foo = null; "foo b/ar" = "baz"; }; emptyattrs = {}; + "keys are not " = "and < neither are string values"; }; }; }; - expected = { value = builtins.readFile ./test-to-plist-expected.plist; }; + expected = { value = builtins.readFile ./test-to-plist-unescaped-expected.plist; }; + }; + + testToPlistEscaped = { + expr = mapAttrs (const (generators.toPlist { escape = true; })) { + value = { + nested.values = { + int = 42; + float = 0.1337; + bool = true; + emptystring = ""; + string = "fn\${o}\"r\\d"; + newlinestring = "\n"; + path = /. + "/foo"; + null_ = null; + list = [ 3 4 "test" ]; + emptylist = []; + attrs = { foo = null; "foo b/ar" = "baz"; }; + emptyattrs = {}; + "keys are " = "and < so are string values"; + }; + }; + }; + expected = { value = builtins.readFile ./test-to-plist-escaped-expected.plist; }; }; testToLuaEmptyAttrSet = { diff --git a/lib/tests/test-to-plist-escaped-expected.plist b/lib/tests/test-to-plist-escaped-expected.plist new file mode 100644 index 000000000000..6ccf05aecc43 --- /dev/null +++ b/lib/tests/test-to-plist-escaped-expected.plist @@ -0,0 +1,48 @@ + + + + + nested + + values + + attrs + + foo b/ar + baz + + bool + + emptyattrs + + + + emptylist + + + + emptystring + + float + 0.133700 + int + 42 + keys are <escaped> + and < so are string values + list + + 3 + 4 + test + + newlinestring + + + path + /foo + string + fn${o}"r\d + + + + \ No newline at end of file diff --git a/lib/tests/test-to-plist-expected.plist b/lib/tests/test-to-plist-unescaped-expected.plist similarity index 90% rename from lib/tests/test-to-plist-expected.plist rename to lib/tests/test-to-plist-unescaped-expected.plist index df0528a60767..ea8d95699f73 100644 --- a/lib/tests/test-to-plist-expected.plist +++ b/lib/tests/test-to-plist-unescaped-expected.plist @@ -27,6 +27,8 @@ 0.133700 int 42 + keys are not + and < neither are string values list 3 diff --git a/nixos/doc/manual/release-notes/rl-2505.section.md b/nixos/doc/manual/release-notes/rl-2505.section.md index 9a0eb89d55db..db753bbdf4ae 100644 --- a/nixos/doc/manual/release-notes/rl-2505.section.md +++ b/nixos/doc/manual/release-notes/rl-2505.section.md @@ -241,6 +241,7 @@ - Cinnamon has been updated to 6.4, please check the [upstream announcement](https://www.linuxmint.com/rel_xia_whatsnew.php) for more details. - Following [changes in Mint 22](https://github.com/linuxmint/mintupgrade/commit/f239cde908288b8c250f938e7311c7ffbc16bd59) we are no longer overriding Qt application styles. You can still restore the previous default with `qt.style = "gtk2"` and `qt.platformTheme = "gtk2"`. + - Following [changes in Mint 20](https://github.com/linuxmint/mintupgrade-legacy/commit/ce15d946ed9a8cb8444abd25088edd824bfb18f6) we are replacing xplayer with celluloid since xplayer is no longer maintained. - Xfce has been updated to 4.20, please check the [upstream feature tour](https://www.xfce.org/about/tour420) for more details. - Wayland session is still [experimental](https://wiki.xfce.org/releng/wayland_roadmap) and requires opt-in using `enableWaylandSession` option. diff --git a/nixos/modules/services/network-filesystems/moosefs.nix b/nixos/modules/services/network-filesystems/moosefs.nix index 1c874e4108f6..bb30448456da 100644 --- a/nixos/modules/services/network-filesystems/moosefs.nix +++ b/nixos/modules/services/network-filesystems/moosefs.nix @@ -1,29 +1,55 @@ -{ config, lib, pkgs, ... }: +{ + config, + lib, + pkgs, + ... +}: let cfg = config.services.moosefs; mfsUser = if cfg.runAsUser then "moosefs" else "root"; - settingsFormat = let - listSep = " "; - allowedTypes = with lib.types; [ bool int float str ]; - valueToString = val: - if lib.isList val then lib.concatStringsSep listSep (map (x: valueToString x) val) - else if lib.isBool val then (if val then "1" else "0") - else toString val; + settingsFormat = + let + listSep = " "; + allowedTypes = with lib.types; [ + bool + int + float + str + ]; + valueToString = + val: + if lib.isList val then + lib.concatStringsSep listSep (map (x: valueToString x) val) + else if lib.isBool val then + (if val then "1" else "0") + else + toString val; - in { - type = with lib.types; let - valueType = oneOf ([ - (listOf valueType) - ] ++ allowedTypes) // { - description = "Flat key-value file"; - }; - in attrsOf valueType; + in + { + type = + with lib.types; + let + valueType = + oneOf ( + [ + (listOf valueType) + ] + ++ allowedTypes + ) + // { + description = "Flat key-value file"; + }; + in + attrsOf valueType; - generate = name: value: - pkgs.writeText name ( lib.concatStringsSep "\n" ( - lib.mapAttrsToList (key: val: "${key} = ${valueToString val}") value )); + generate = + name: value: + pkgs.writeText name ( + lib.concatStringsSep "\n" (lib.mapAttrsToList (key: val: "${key} = ${valueToString val}") value) + ); }; # Manual initialization tool @@ -44,18 +70,22 @@ let systemdService = name: extraConfig: configFile: { wantedBy = [ "multi-user.target" ]; wants = [ "network-online.target" ]; - after = [ "network.target" "network-online.target" ]; + after = [ + "network.target" + "network-online.target" + ]; serviceConfig = { Type = "forking"; - ExecStart = "${pkgs.moosefs}/bin/mfs${name} -c ${configFile} start"; - ExecStop = "${pkgs.moosefs}/bin/mfs${name} -c ${configFile} stop"; + ExecStart = "${pkgs.moosefs}/bin/mfs${name} -c ${configFile} start"; + ExecStop = "${pkgs.moosefs}/bin/mfs${name} -c ${configFile} stop"; ExecReload = "${pkgs.moosefs}/bin/mfs${name} -c ${configFile} reload"; PIDFile = "${cfg."${name}".settings.DATA_PATH}/.mfs${name}.lock"; } // extraConfig; }; -in { +in +{ ###### interface options = { services.moosefs = { @@ -150,7 +180,10 @@ in { type = with lib.types; listOf str; default = null; description = "Mount points used by chunkserver for data storage (see mfshdd.cfg)."; - example = [ "/mnt/hdd1" "/mnt/hdd2" ]; + example = [ + "/mnt/hdd1" + "/mnt/hdd2" + ]; }; settings = lib.mkOption { @@ -197,7 +230,7 @@ in { }; }; }; - default = {}; + default = { }; description = "CGI server configuration options."; }; }; @@ -205,115 +238,139 @@ in { }; ###### implementation - config = lib.mkIf (cfg.client.enable || cfg.master.enable || cfg.metalogger.enable || cfg.chunkserver.enable || cfg.cgiserver.enable) { - warnings = [ ( lib.mkIf (!cfg.runAsUser) "Running MooseFS services as root is not recommended.") ]; + config = + lib.mkIf + ( + cfg.client.enable + || cfg.master.enable + || cfg.metalogger.enable + || cfg.chunkserver.enable + || cfg.cgiserver.enable + ) + { + warnings = [ (lib.mkIf (!cfg.runAsUser) "Running MooseFS services as root is not recommended.") ]; - services.moosefs = { - master.settings = lib.mkIf cfg.master.enable (lib.mkMerge [ - { - WORKING_USER = mfsUser; - EXPORTS_FILENAME = toString ( pkgs.writeText "mfsexports.cfg" - (lib.concatStringsSep "\n" cfg.master.exports)); - } - (lib.mkIf cfg.cgiserver.enable { - MFSCGISERV = toString cfg.cgiserver.settings.PORT; - }) - ]); + services.moosefs = { + master.settings = lib.mkIf cfg.master.enable ( + lib.mkMerge [ + { + WORKING_USER = mfsUser; + EXPORTS_FILENAME = toString ( + pkgs.writeText "mfsexports.cfg" (lib.concatStringsSep "\n" cfg.master.exports) + ); + } + (lib.mkIf cfg.cgiserver.enable { + MFSCGISERV = toString cfg.cgiserver.settings.PORT; + }) + ] + ); - metalogger.settings = lib.mkIf cfg.metalogger.enable { - WORKING_USER = mfsUser; - MASTER_HOST = cfg.masterHost; - }; + metalogger.settings = lib.mkIf cfg.metalogger.enable { + WORKING_USER = mfsUser; + MASTER_HOST = cfg.masterHost; + }; - chunkserver.settings = lib.mkIf cfg.chunkserver.enable { - WORKING_USER = mfsUser; - MASTER_HOST = cfg.masterHost; - HDD_CONF_FILENAME = toString ( pkgs.writeText "mfshdd.cfg" - (lib.concatStringsSep "\n" cfg.chunkserver.hdds)); - }; - }; - - users = lib.mkIf ( cfg.runAsUser && ( cfg.master.enable || cfg.metalogger.enable || cfg.chunkserver.enable || cfg.cgiserver.enable ) ) { - users.moosefs = { - isSystemUser = true; - description = "MooseFS daemon user"; - group = "moosefs"; - }; - groups.moosefs = {}; - }; - - environment.systemPackages = - (lib.optional cfg.client.enable pkgs.moosefs) ++ - (lib.optional cfg.master.enable initTool); - - networking.firewall.allowedTCPPorts = lib.mkMerge [ - (lib.optionals cfg.master.openFirewall [ 9419 9420 9421 ]) - (lib.optional cfg.chunkserver.openFirewall 9422) - (lib.optional (cfg.cgiserver.enable && cfg.cgiserver.openFirewall) cfg.cgiserver.settings.PORT) - ]; - - systemd.tmpfiles.rules = [ - # Master directories - (lib.optionalString cfg.master.enable - "d ${cfg.master.settings.DATA_PATH} 0700 ${mfsUser} ${mfsUser} -") - - # Metalogger directories - (lib.optionalString cfg.metalogger.enable - "d ${cfg.metalogger.settings.DATA_PATH} 0700 ${mfsUser} ${mfsUser} -") - - # Chunkserver directories - (lib.optionalString cfg.chunkserver.enable - "d ${cfg.chunkserver.settings.DATA_PATH} 0700 ${mfsUser} ${mfsUser} -") - ] ++ lib.optionals (cfg.chunkserver.enable && cfg.chunkserver.hdds != null) - (map (dir: "d ${dir} 0755 ${mfsUser} ${mfsUser} -") cfg.chunkserver.hdds); - - systemd.services = lib.mkMerge [ - (lib.mkIf cfg.master.enable { - mfs-master = (lib.mkMerge [ - (systemdService "master" { - TimeoutStartSec = 1800; - TimeoutStopSec = 1800; - Restart = "on-failure"; - User = mfsUser; - } masterCfg) - { - preStart = lib.mkIf cfg.master.autoInit "${initTool}/bin/mfsmaster-init"; - } - ]); - }) - - (lib.mkIf cfg.metalogger.enable { - mfs-metalogger = systemdService "metalogger" { - Restart = "on-abnormal"; - User = mfsUser; - } metaloggerCfg; - }) - - (lib.mkIf cfg.chunkserver.enable { - mfs-chunkserver = systemdService "chunkserver" { - Restart = "on-abnormal"; - User = mfsUser; - } chunkserverCfg; - }) - - (lib.mkIf cfg.cgiserver.enable { - mfs-cgiserv = { - description = "MooseFS CGI Server"; - wantedBy = [ "multi-user.target" ]; - after = [ "mfs-master.service" ]; - - serviceConfig = { - Type = "simple"; - ExecStart = "${pkgs.moosefs}/bin/mfscgiserv -D /var/lib/mfs -f start"; - ExecStop = "${pkgs.moosefs}/bin/mfscgiserv -D /var/lib/mfs stop"; - Restart = "on-failure"; - RestartSec = "30s"; - User = mfsUser; - Group = mfsUser; - WorkingDirectory = "/var/lib/mfs"; + chunkserver.settings = lib.mkIf cfg.chunkserver.enable { + WORKING_USER = mfsUser; + MASTER_HOST = cfg.masterHost; + HDD_CONF_FILENAME = toString ( + pkgs.writeText "mfshdd.cfg" (lib.concatStringsSep "\n" cfg.chunkserver.hdds) + ); }; }; - }) - ]; - }; + + users = + lib.mkIf + ( + cfg.runAsUser + && (cfg.master.enable || cfg.metalogger.enable || cfg.chunkserver.enable || cfg.cgiserver.enable) + ) + { + users.moosefs = { + isSystemUser = true; + description = "MooseFS daemon user"; + group = "moosefs"; + }; + groups.moosefs = { }; + }; + + environment.systemPackages = + (lib.optional cfg.client.enable pkgs.moosefs) ++ (lib.optional cfg.master.enable initTool); + + networking.firewall.allowedTCPPorts = lib.mkMerge [ + (lib.optionals cfg.master.openFirewall [ + 9419 + 9420 + 9421 + ]) + (lib.optional cfg.chunkserver.openFirewall 9422) + (lib.optional (cfg.cgiserver.enable && cfg.cgiserver.openFirewall) cfg.cgiserver.settings.PORT) + ]; + + systemd.tmpfiles.rules = + [ + # Master directories + (lib.optionalString cfg.master.enable "d ${cfg.master.settings.DATA_PATH} 0700 ${mfsUser} ${mfsUser} -") + + # Metalogger directories + (lib.optionalString cfg.metalogger.enable "d ${cfg.metalogger.settings.DATA_PATH} 0700 ${mfsUser} ${mfsUser} -") + + # Chunkserver directories + (lib.optionalString cfg.chunkserver.enable "d ${cfg.chunkserver.settings.DATA_PATH} 0700 ${mfsUser} ${mfsUser} -") + ] + ++ lib.optionals (cfg.chunkserver.enable && cfg.chunkserver.hdds != null) ( + map (dir: "d ${dir} 0755 ${mfsUser} ${mfsUser} -") cfg.chunkserver.hdds + ); + + systemd.services = lib.mkMerge [ + (lib.mkIf cfg.master.enable { + mfs-master = ( + lib.mkMerge [ + (systemdService "master" { + TimeoutStartSec = 1800; + TimeoutStopSec = 1800; + Restart = "on-failure"; + User = mfsUser; + } masterCfg) + { + preStart = lib.mkIf cfg.master.autoInit "${initTool}/bin/mfsmaster-init"; + } + ] + ); + }) + + (lib.mkIf cfg.metalogger.enable { + mfs-metalogger = systemdService "metalogger" { + Restart = "on-abnormal"; + User = mfsUser; + } metaloggerCfg; + }) + + (lib.mkIf cfg.chunkserver.enable { + mfs-chunkserver = systemdService "chunkserver" { + Restart = "on-abnormal"; + User = mfsUser; + } chunkserverCfg; + }) + + (lib.mkIf cfg.cgiserver.enable { + mfs-cgiserv = { + description = "MooseFS CGI Server"; + wantedBy = [ "multi-user.target" ]; + after = [ "mfs-master.service" ]; + + serviceConfig = { + Type = "simple"; + ExecStart = "${pkgs.moosefs}/bin/mfscgiserv -D /var/lib/mfs -f start"; + ExecStop = "${pkgs.moosefs}/bin/mfscgiserv -D /var/lib/mfs stop"; + Restart = "on-failure"; + RestartSec = "30s"; + User = mfsUser; + Group = mfsUser; + WorkingDirectory = "/var/lib/mfs"; + }; + }; + }) + ]; + }; } diff --git a/nixos/modules/services/x11/desktop-managers/cinnamon.nix b/nixos/modules/services/x11/desktop-managers/cinnamon.nix index 2abcd5033cd5..c64c2293a439 100644 --- a/nixos/modules/services/x11/desktop-managers/cinnamon.nix +++ b/nixos/modules/services/x11/desktop-managers/cinnamon.nix @@ -241,10 +241,10 @@ in xviewer xreader xed-editor - xplayer pix # external apps shipped with linux-mint + celluloid gnome-calculator gnome-calendar gnome-screenshot diff --git a/nixos/tests/xfce-wayland.nix b/nixos/tests/xfce-wayland.nix index 5f835528c851..f81ec563e7a6 100644 --- a/nixos/tests/xfce-wayland.nix +++ b/nixos/tests/xfce-wayland.nix @@ -23,8 +23,6 @@ import ./make-test-python.nix ( services.xserver.desktopManager.xfce.enable = true; services.xserver.desktopManager.xfce.enableWaylandSession = true; - # https://gitlab.xfce.org/apps/xfce4-screensaver/-/merge_requests/28 - services.xserver.desktopManager.xfce.enableScreensaver = false; environment.systemPackages = [ pkgs.wlrctl ]; }; diff --git a/pkgs/applications/backup/timeshift/unwrapped.nix b/pkgs/applications/backup/timeshift/unwrapped.nix index 3fbaed4b21be..ebc37cfe55ff 100644 --- a/pkgs/applications/backup/timeshift/unwrapped.nix +++ b/pkgs/applications/backup/timeshift/unwrapped.nix @@ -57,6 +57,10 @@ stdenv.mkDerivation rec { xapp ]; + env = lib.optionalAttrs stdenv.cc.isGNU { + NIX_CFLAGS_COMPILE = "-Wno-error=implicit-function-declaration"; + }; + meta = with lib; { description = "System restore tool for Linux"; longDescription = '' diff --git a/pkgs/applications/editors/vim/plugins/overrides.nix b/pkgs/applications/editors/vim/plugins/overrides.nix index a397815beff5..a2024e3be6c7 100644 --- a/pkgs/applications/editors/vim/plugins/overrides.nix +++ b/pkgs/applications/editors/vim/plugins/overrides.nix @@ -246,6 +246,10 @@ in blink-cmp = callPackage ./non-generated/blink-cmp { }; + blink-cmp-copilot = super.blink-cmp-copilot.overrideAttrs { + dependencies = [ self.copilot-lua ]; + }; + bluloco-nvim = super.bluloco-nvim.overrideAttrs { dependencies = [ self.lush-nvim ]; }; @@ -1299,6 +1303,7 @@ in "lazyvim.plugins.extras.lang.svelte" "lazyvim.plugins.extras.lang.typescript" "lazyvim.plugins.init" + "lazyvim.plugins.ui" "lazyvim.plugins.xtras" ]; }; @@ -2203,6 +2208,14 @@ in vimCommandCheck = "TealBuild"; }; + nvim-tree-lua = super.nvim-tree-lua.overrideAttrs { + nvimSkipModule = [ + # Meta can't be required + "nvim-tree._meta.api" + "nvim-tree._meta.api_decorator" + ]; + }; + nvim-treesitter = super.nvim-treesitter.overrideAttrs ( callPackage ./nvim-treesitter/overrides.nix { } self super ); @@ -2597,14 +2610,19 @@ in nvimSkipModule = [ # Requires setup call first "snacks.dashboard" + "snacks.debug" + "snacks.dim" "snacks.git" + "snacks.indent" + "snacks.input" "snacks.lazygit" "snacks.notifier" + "snacks.scratch" + "snacks.scroll" "snacks.terminal" "snacks.win" "snacks.words" - "snacks.debug" - "snacks.scratch" + "snacks.zen" # Optional trouble integration "trouble.sources.profiler" ]; diff --git a/pkgs/applications/networking/cluster/k3s/1_29/images-versions.json b/pkgs/applications/networking/cluster/k3s/1_29/images-versions.json index bac6f9bd273f..2a2b97c4345c 100644 --- a/pkgs/applications/networking/cluster/k3s/1_29/images-versions.json +++ b/pkgs/applications/networking/cluster/k3s/1_29/images-versions.json @@ -1,18 +1,18 @@ { "airgap-images-amd64": { - "url": "https://github.com/k3s-io/k3s/releases/download/v1.29.11%2Bk3s1/k3s-airgap-images-amd64.tar.zst", - "sha256": "0i62dg60090wmiqi2wzqa4jx45dag71y0936hhy00402wdcylmj7" + "url": "https://github.com/k3s-io/k3s/releases/download/v1.29.12%2Bk3s1/k3s-airgap-images-amd64.tar.zst", + "sha256": "0p3d0k4ckzrbd3xd4v9vb8rhw9jcl4ilx9ch94yhf8kxnnblgzyb" }, "airgap-images-arm": { - "url": "https://github.com/k3s-io/k3s/releases/download/v1.29.11%2Bk3s1/k3s-airgap-images-arm.tar.zst", - "sha256": "0v9wazqiypzpxpc31vi0x3w1jwsny8xcnv67bcjwj5xlwpjlsjz9" + "url": "https://github.com/k3s-io/k3s/releases/download/v1.29.12%2Bk3s1/k3s-airgap-images-arm.tar.zst", + "sha256": "0j9ajjz201w319gfryx2q7jnmyi8gg805v7jsdmy4xkyl8ki80jw" }, "airgap-images-arm64": { - "url": "https://github.com/k3s-io/k3s/releases/download/v1.29.11%2Bk3s1/k3s-airgap-images-arm64.tar.zst", - "sha256": "07145gdpgqy49pvinnx0pal9mzsljysgd5zfq565fx5smfxzvbyn" + "url": "https://github.com/k3s-io/k3s/releases/download/v1.29.12%2Bk3s1/k3s-airgap-images-arm64.tar.zst", + "sha256": "1yc1yafr16mli1jk9xc4vgp6q36zk9z5p4rjmdng42dp0j6kvj0w" }, "images-list": { - "url": "https://github.com/k3s-io/k3s/releases/download/v1.29.11%2Bk3s1/k3s-images.txt", - "sha256": "05229bfg174pvy525dcy7rvmgv9i9v1nnz5ngq80n7zkxj9cp8m8" + "url": "https://github.com/k3s-io/k3s/releases/download/v1.29.12%2Bk3s1/k3s-images.txt", + "sha256": "1gqiaszfw49hsbn7xkkadykaf028vys13ykqvpkqar0f7hwwbja6" } } diff --git a/pkgs/applications/networking/cluster/k3s/1_29/versions.nix b/pkgs/applications/networking/cluster/k3s/1_29/versions.nix index a194a72812d5..4d72e3c1e725 100644 --- a/pkgs/applications/networking/cluster/k3s/1_29/versions.nix +++ b/pkgs/applications/networking/cluster/k3s/1_29/versions.nix @@ -1,8 +1,8 @@ { - k3sVersion = "1.29.11+k3s1"; - k3sCommit = "666b590a7512c0baab01c93bf81222fa22565c45"; - k3sRepoSha256 = "0w9lldvzkd3rrq0gypqnyjmjr73bxay44q2vfcj4my0ryc3bajf4"; - k3sVendorHash = "sha256-FaOBeUONkeG2CfGUN4VRUzpQl0C6b06kKCnb6ICYHzo="; + k3sVersion = "1.29.12+k3s1"; + k3sCommit = "ab3818c6169fb022c1fb74b8646d8d724a0f6030"; + k3sRepoSha256 = "10lmva3wwpzymm5lf65gg7ixbz5vdbpagb1ghbc4r8v50ack0cvf"; + k3sVendorHash = "sha256-s49GPwMPkF38NTj/aZ1aMliT/Msa1BMS9fmfqcp0//s="; chartVersions = import ./chart-versions.nix; imagesVersions = builtins.fromJSON (builtins.readFile ./images-versions.json); k3sRootVersion = "0.14.1"; diff --git a/pkgs/applications/networking/cluster/k3s/1_30/images-versions.json b/pkgs/applications/networking/cluster/k3s/1_30/images-versions.json index 836e9c559d69..20f45a47ad9f 100644 --- a/pkgs/applications/networking/cluster/k3s/1_30/images-versions.json +++ b/pkgs/applications/networking/cluster/k3s/1_30/images-versions.json @@ -1,18 +1,18 @@ { "airgap-images-amd64": { - "url": "https://github.com/k3s-io/k3s/releases/download/v1.30.7%2Bk3s1/k3s-airgap-images-amd64.tar.zst", - "sha256": "09czfci3c37phn89zzqnsxgxwclmzf03mxlh88v0d7fk4qjlqa4i" + "url": "https://github.com/k3s-io/k3s/releases/download/v1.30.8%2Bk3s1/k3s-airgap-images-amd64.tar.zst", + "sha256": "12vvc79jy1nyvcpsr2bi6w1zf28rqx99vh7anjm13snzsk7kzqc2" }, "airgap-images-arm": { - "url": "https://github.com/k3s-io/k3s/releases/download/v1.30.7%2Bk3s1/k3s-airgap-images-arm.tar.zst", - "sha256": "1wdnfc0f17rjz5gd1gfngax9ghjxv4gpzq73gyd745j53f64wv7n" + "url": "https://github.com/k3s-io/k3s/releases/download/v1.30.8%2Bk3s1/k3s-airgap-images-arm.tar.zst", + "sha256": "0mhn1ilh830m403yg1y3nqzjcakhs3i6hgdq2s8w2spyz2kdrgv1" }, "airgap-images-arm64": { - "url": "https://github.com/k3s-io/k3s/releases/download/v1.30.7%2Bk3s1/k3s-airgap-images-arm64.tar.zst", - "sha256": "04i8j4x26bia3sqc5ra23p0nyy1ncd57mifwakm8nrk8dayigm8d" + "url": "https://github.com/k3s-io/k3s/releases/download/v1.30.8%2Bk3s1/k3s-airgap-images-arm64.tar.zst", + "sha256": "0jdxf36dksypjvgil23wn8ins5rp0achmlavmv12vhijfllkqnn5" }, "images-list": { - "url": "https://github.com/k3s-io/k3s/releases/download/v1.30.7%2Bk3s1/k3s-images.txt", - "sha256": "05229bfg174pvy525dcy7rvmgv9i9v1nnz5ngq80n7zkxj9cp8m8" + "url": "https://github.com/k3s-io/k3s/releases/download/v1.30.8%2Bk3s1/k3s-images.txt", + "sha256": "1gqiaszfw49hsbn7xkkadykaf028vys13ykqvpkqar0f7hwwbja6" } } diff --git a/pkgs/applications/networking/cluster/k3s/1_30/versions.nix b/pkgs/applications/networking/cluster/k3s/1_30/versions.nix index ce7592f78dd0..922a97814e08 100644 --- a/pkgs/applications/networking/cluster/k3s/1_30/versions.nix +++ b/pkgs/applications/networking/cluster/k3s/1_30/versions.nix @@ -1,8 +1,8 @@ { - k3sVersion = "1.30.7+k3s1"; - k3sCommit = "00f901803ada2af4adb0439804f98b6fb6379992"; - k3sRepoSha256 = "0jvbd4g1kisyjs2hrz4aqwrg08b13pvdf10dyyavvw1bmzki26ih"; - k3sVendorHash = "sha256-3kLD2oyeo1cC0qRD48sFbsARuD034wilcNQpGRa65aQ="; + k3sVersion = "1.30.8+k3s1"; + k3sCommit = "b43a365f27d8372336fea7b0984a571109d742ca"; + k3sRepoSha256 = "1fkpvx25aw59vvyfq9pbnph3kgyr4ykxg2dkkjdmqjdgwza04c47"; + k3sVendorHash = "sha256-q/cRKuqXuzPcLEYD+BH82ZAc+ZgGIqKWLsM1E4uQsok="; chartVersions = import ./chart-versions.nix; imagesVersions = builtins.fromJSON (builtins.readFile ./images-versions.json); k3sRootVersion = "0.14.1"; diff --git a/pkgs/applications/networking/cluster/k3s/builder.nix b/pkgs/applications/networking/cluster/k3s/builder.nix index 2e0a4f5fec3d..285b6c4e4c17 100644 --- a/pkgs/applications/networking/cluster/k3s/builder.nix +++ b/pkgs/applications/networking/cluster/k3s/builder.nix @@ -56,12 +56,15 @@ lib: libseccomp, makeWrapper, nixosTests, + overrideBundleAttrs ? { }, # An attrSet/function to override the `k3sBundle` derivation. + overrideCniPluginsAttrs ? { }, # An attrSet/function to override the `k3sCNIPlugins` derivation. + overrideContainerdAttrs ? { }, # An attrSet/function to override the `k3sContainerd` derivation. pkg-config, pkgsBuildBuild, procps, rsync, - runc, runCommand, + runc, socat, sqlite, stdenv, @@ -174,28 +177,30 @@ let sha256 = k3sRootSha256; stripRoot = false; }; - k3sCNIPlugins = buildGoModule rec { - pname = "k3s-cni-plugins"; - version = k3sCNIVersion; - vendorHash = null; + k3sCNIPlugins = + (buildGoModule rec { + pname = "k3s-cni-plugins"; + version = k3sCNIVersion; + vendorHash = null; - subPackages = [ "." ]; + subPackages = [ "." ]; - src = fetchFromGitHub { - owner = "rancher"; - repo = "plugins"; - rev = "v${version}"; - sha256 = k3sCNISha256; - }; + src = fetchFromGitHub { + owner = "rancher"; + repo = "plugins"; + rev = "v${version}"; + sha256 = k3sCNISha256; + }; - postInstall = '' - mv $out/bin/plugins $out/bin/cni - ''; + postInstall = '' + mv $out/bin/plugins $out/bin/cni + ''; - meta = baseMeta // { - description = "CNI plugins, as patched by rancher for k3s"; - }; - }; + meta = baseMeta // { + description = "CNI plugins, as patched by rancher for k3s"; + }; + }).overrideAttrs + overrideCniPluginsAttrs; # Grab this separately from a build because it's used by both stages of the # k3s build. k3sRepo = fetchgit { @@ -261,67 +266,71 @@ let # derivation when we've built all the binaries, but haven't bundled them in # with generated bindata yet. - k3sServer = buildGoModule { - pname = "k3s-server"; - version = k3sVersion; + k3sBundle = + (buildGoModule { + pname = "k3s-bin"; + version = k3sVersion; - src = k3sRepo; - vendorHash = k3sVendorHash; + src = k3sRepo; + vendorHash = k3sVendorHash; - nativeBuildInputs = [ pkg-config ]; - buildInputs = [ - libseccomp - sqlite.dev - ]; + nativeBuildInputs = [ pkg-config ]; + buildInputs = [ + libseccomp + sqlite.dev + ]; - subPackages = [ "cmd/server" ]; - ldflags = versionldflags; + subPackages = [ "cmd/server" ]; + ldflags = versionldflags; - tags = [ - "ctrd" - "libsqlite3" - "linux" - ]; + tags = [ + "ctrd" + "libsqlite3" + "linux" + ]; - # create the multicall symlinks for k3s - postInstall = '' - mv $out/bin/server $out/bin/k3s - pushd $out - # taken verbatim from https://github.com/k3s-io/k3s/blob/v1.23.3%2Bk3s1/scripts/build#L105-L113 - ln -s k3s ./bin/containerd - ln -s k3s ./bin/crictl - ln -s k3s ./bin/ctr - ln -s k3s ./bin/k3s-agent - ln -s k3s ./bin/k3s-certificate - ln -s k3s ./bin/k3s-completion - ln -s k3s ./bin/k3s-etcd-snapshot - ln -s k3s ./bin/k3s-secrets-encrypt - ln -s k3s ./bin/k3s-server - ln -s k3s ./bin/k3s-token - ln -s k3s ./bin/kubectl - popd - ''; + # create the multicall symlinks for k3s + postInstall = '' + mv $out/bin/server $out/bin/k3s + pushd $out + # taken verbatim from https://github.com/k3s-io/k3s/blob/v1.23.3%2Bk3s1/scripts/build#L105-L113 + ln -s k3s ./bin/containerd + ln -s k3s ./bin/crictl + ln -s k3s ./bin/ctr + ln -s k3s ./bin/k3s-agent + ln -s k3s ./bin/k3s-certificate + ln -s k3s ./bin/k3s-completion + ln -s k3s ./bin/k3s-etcd-snapshot + ln -s k3s ./bin/k3s-secrets-encrypt + ln -s k3s ./bin/k3s-server + ln -s k3s ./bin/k3s-token + ln -s k3s ./bin/kubectl + popd + ''; - meta = baseMeta // { - description = "Various binaries that get packaged into the final k3s binary"; - }; - }; + meta = baseMeta // { + description = "Various binaries that get packaged into the final k3s binary"; + }; + }).overrideAttrs + overrideBundleAttrs; # Only used for the shim since # https://github.com/k3s-io/k3s/blob/v1.27.2%2Bk3s1/scripts/build#L153 - k3sContainerd = buildGoModule { - pname = "k3s-containerd"; - version = containerdVersion; - src = fetchFromGitHub { - owner = "k3s-io"; - repo = "containerd"; - rev = "v${containerdVersion}"; - sha256 = containerdSha256; - }; - vendorHash = null; - buildInputs = [ btrfs-progs ]; - subPackages = [ "cmd/containerd-shim-runc-v2" ]; - ldflags = versionldflags; - }; + k3sContainerd = + (buildGoModule { + pname = "k3s-containerd"; + version = containerdVersion; + src = fetchFromGitHub { + owner = "k3s-io"; + repo = "containerd"; + rev = "v${containerdVersion}"; + sha256 = containerdSha256; + }; + vendorHash = null; + buildInputs = [ btrfs-progs ]; + subPackages = [ "cmd/containerd-shim-runc-v2" ]; + ldflags = versionldflags; + }).overrideAttrs + overrideContainerdAttrs; in buildGoModule rec { pname = "k3s"; @@ -397,7 +406,7 @@ buildGoModule rec { propagatedBuildInputs = [ k3sCNIPlugins k3sContainerd - k3sServer + k3sBundle ]; # We override most of buildPhase due to peculiarities in k3s's build. @@ -411,7 +420,7 @@ buildGoModule rec { # copy needed 'go generate' inputs into place mkdir -p ./bin/aux - rsync -a --no-perms ${k3sServer}/bin/ ./bin/ + rsync -a --no-perms ${k3sBundle}/bin/ ./bin/ ln -vsf ${k3sCNIPlugins}/bin/cni ./bin/cni ln -vsf ${k3sContainerd}/bin/containerd-shim-runc-v2 ./bin rsync -a --no-perms --chmod u=rwX ${k3sRoot}/etc/ ./etc/ @@ -463,7 +472,7 @@ buildGoModule rec { k3sContainerd = k3sContainerd; k3sRepo = k3sRepo; k3sRoot = k3sRoot; - k3sServer = k3sServer; + k3sBundle = k3sBundle; mkTests = version: let diff --git a/pkgs/by-name/ca/caribou/package.nix b/pkgs/by-name/ca/caribou/package.nix index 463fe2f7e281..5383cb72e973 100644 --- a/pkgs/by-name/ca/caribou/package.nix +++ b/pkgs/by-name/ca/caribou/package.nix @@ -91,6 +91,13 @@ stdenv.mkDerivation rec { substituteInPlace libcaribou/Makefile.am --replace "--shared-library=libcaribou.so.0" "--shared-library=$out/lib/libcaribou.so.0" ''; + env = lib.optionalAttrs stdenv.cc.isGNU { + # This really should be done by latest Vala, but we are using + # release tarball here, which dists generated C code. + # https://gitlab.gnome.org/GNOME/vala/-/merge_requests/369 + NIX_CFLAGS_COMPILE = "-Wno-error=incompatible-pointer-types"; + }; + passthru = { updateScript = gnome.updateScript { packageName = "caribou"; }; }; diff --git a/pkgs/by-name/ci/cinnamon-common/package.nix b/pkgs/by-name/ci/cinnamon-common/package.nix index 6bba5b87514d..7114b3433b14 100644 --- a/pkgs/by-name/ci/cinnamon-common/package.nix +++ b/pkgs/by-name/ci/cinnamon-common/package.nix @@ -76,13 +76,13 @@ in # TODO (after 25.05 branch-off): Rename to pkgs.cinnamon stdenv.mkDerivation rec { pname = "cinnamon-common"; - version = "6.4.2"; + version = "6.4.3"; src = fetchFromGitHub { owner = "linuxmint"; repo = "cinnamon"; rev = version; - hash = "sha256-r5cSm/a+xtHwwAHQmdgviDAN3nnMAnXGY/p+ER1/gbk="; + hash = "sha256-Nq4CFLmvgyPFg+mALE1UYauWAR7ZjtJGJOSChbIjm4g="; }; patches = [ diff --git a/pkgs/by-name/dp/dpdk/package.nix b/pkgs/by-name/dp/dpdk/package.nix index a0cea804b54e..ddff5c4bcb45 100644 --- a/pkgs/by-name/dp/dpdk/package.nix +++ b/pkgs/by-name/dp/dpdk/package.nix @@ -3,6 +3,7 @@ , pkg-config, meson, ninja, makeWrapper , libbsd, numactl, libbpf, zlib, elfutils, jansson, openssl, libpcap, rdma-core , doxygen, python3, pciutils +, fetchpatch , withExamples ? [] , shared ? false , machine ? ( @@ -50,6 +51,14 @@ stdenv.mkDerivation rec { libbsd ]; + patches = [ + (fetchpatch { + name = "CVE-2024-11614.patch"; + url = "https://git.dpdk.org/dpdk-stable/patch/?id=fdf13ea6fede07538fbe5e2a46fa6d4b2368fa81"; + hash = "sha256-lD2mhPm5r1tWZb4IpzHa2SeK1DyQ3rwjzArRTpAgZAY="; + }) + ]; + postPatch = '' patchShebangs config/arm buildtools ''; diff --git a/pkgs/by-name/ei/eigenmath/package.nix b/pkgs/by-name/ei/eigenmath/package.nix index c5a197c66199..d649a87dc080 100644 --- a/pkgs/by-name/ei/eigenmath/package.nix +++ b/pkgs/by-name/ei/eigenmath/package.nix @@ -8,13 +8,13 @@ stdenv.mkDerivation rec { pname = "eigenmath"; - version = "3.35-unstable-2024-12-11"; + version = "337-unstable-2024-12-20"; src = fetchFromGitHub { owner = "georgeweigt"; repo = pname; - rev = "8aeb901425aae6dc27b00040dee38cf51fd81a5e"; - hash = "sha256-fhQHxdbecDAcMylMU50FHPGWf6XgwBgPBaP4v3ntOmc="; + rev = "571412786696680e1e04909e90e77d9d39b10b2a"; + hash = "sha256-7/5UsU5TSW++MROWuUTsAptkv7gcqhvcqaRHYzXswB8="; }; checkPhase = diff --git a/pkgs/by-name/fa/fanbox-dl/package.nix b/pkgs/by-name/fa/fanbox-dl/package.nix index f2c942757e4b..4f1b0eb3e822 100644 --- a/pkgs/by-name/fa/fanbox-dl/package.nix +++ b/pkgs/by-name/fa/fanbox-dl/package.nix @@ -6,13 +6,13 @@ buildGoModule rec { pname = "fanbox-dl"; - version = "0.27.1"; + version = "0.27.2"; src = fetchFromGitHub { owner = "hareku"; repo = "fanbox-dl"; rev = "v${version}"; - hash = "sha256-2fxptsETjWyQxQv/VDx2A5UMZ3oLgC298YY/To3qaqk="; + hash = "sha256-qsuYsAXlMuNvGxtrisqqr2E9OgiXsYneBx+CnVOyU2g="; }; vendorHash = "sha256-l/mgjCqRzidJ1QxH8bKGa7ZnRZVOqkuNifgEyFVU7fA="; diff --git a/pkgs/by-name/gl/glaze/package.nix b/pkgs/by-name/gl/glaze/package.nix index 3e494e7461fa..98ff2f100368 100644 --- a/pkgs/by-name/gl/glaze/package.nix +++ b/pkgs/by-name/gl/glaze/package.nix @@ -8,13 +8,13 @@ stdenv.mkDerivation (final: { pname = "glaze"; - version = "4.0.2"; + version = "4.2.2"; src = fetchFromGitHub { owner = "stephenberry"; repo = "glaze"; rev = "v${final.version}"; - hash = "sha256-fNarN2VFgfZDmY62EoLsiMdW60XPbi71wbiSe/ftaFc="; + hash = "sha256-P6hrwSpeQXHhag7HV28EVXsEwd2ZJEad3GRclCiOz8w="; }; nativeBuildInputs = [ cmake ]; diff --git a/pkgs/by-name/ka/kanidm/1_3.nix b/pkgs/by-name/ka/kanidm/1_3.nix index e9d7b1cd8211..8d4d310ac713 100644 --- a/pkgs/by-name/ka/kanidm/1_3.nix +++ b/pkgs/by-name/ka/kanidm/1_3.nix @@ -1,7 +1,8 @@ import ./generic.nix { version = "1.3.3"; hash = "sha256-W5G7osV4du6w/BfyY9YrDzorcLNizRsoz70RMfO2AbY="; - cargoHash = "sha256-gJrzOK6vPPBgsQFkKrbMql00XSfKGjgpZhYJLTURxoI="; + cargoHash = "sha256-iziTHr0gvv319Rzgkze9J1H4UzPR7WxMmCkiGVsb33k="; + patchDir = ./patches/1_3; extraMeta = { knownVulnerabilities = [ '' diff --git a/pkgs/by-name/ka/kanidm/1_4.nix b/pkgs/by-name/ka/kanidm/1_4.nix index 73d7a7a2f7f9..7c4ada64db24 100644 --- a/pkgs/by-name/ka/kanidm/1_4.nix +++ b/pkgs/by-name/ka/kanidm/1_4.nix @@ -1,5 +1,6 @@ import ./generic.nix { version = "1.4.5"; hash = "sha256-0nn/ZyjkLXWXBZasNhbeEynEN52cmZQAcgg3hLmRpdo="; - cargoHash = "sha256-sLz1EdczSj0/ACLUpWex3i8ZUhNeyU/RVwuAqccLIz8="; + cargoHash = "sha256-9ZB9PwVnqoCRMFXOY7ejh76hmOg7cjVpnjgJfh8aXGI="; + patchDir = ./patches/1_4; } diff --git a/pkgs/by-name/ka/kanidm/generic.nix b/pkgs/by-name/ka/kanidm/generic.nix index 607062bafdda..5c0a04bcbc2b 100644 --- a/pkgs/by-name/ka/kanidm/generic.nix +++ b/pkgs/by-name/ka/kanidm/generic.nix @@ -2,6 +2,7 @@ version, hash, cargoHash, + patchDir, extraMeta ? { }, }: @@ -35,8 +36,9 @@ let arch = if stdenv.hostPlatform.isx86_64 then "x86_64" else "generic"; in rustPlatform.buildRustPackage rec { - pname = "kanidm"; + pname = "kanidm" + (lib.optionalString enableSecretProvisioning "-with-secret-provisioning"); inherit version cargoHash; + cargoDepsName = "kanidm"; src = fetchFromGitHub { owner = pname; @@ -48,8 +50,8 @@ rustPlatform.buildRustPackage rec { KANIDM_BUILD_PROFILE = "release_nixos_${arch}"; patches = lib.optionals enableSecretProvisioning [ - ./patches/oauth2-basic-secret-modify.patch - ./patches/recover-account.patch + "${patchDir}/oauth2-basic-secret-modify.patch" + "${patchDir}/recover-account.patch" ]; postPatch = diff --git a/pkgs/by-name/ka/kanidm/patches/1_3/oauth2-basic-secret-modify.patch b/pkgs/by-name/ka/kanidm/patches/1_3/oauth2-basic-secret-modify.patch new file mode 100644 index 000000000000..afff94ca51e9 --- /dev/null +++ b/pkgs/by-name/ka/kanidm/patches/1_3/oauth2-basic-secret-modify.patch @@ -0,0 +1,303 @@ +From 44dfbc2b9dccce86c7d7e7b54db4c989344b8c56 Mon Sep 17 00:00:00 2001 +From: oddlama +Date: Mon, 12 Aug 2024 23:17:25 +0200 +Subject: [PATCH 1/2] oauth2 basic secret modify + +--- + server/core/src/actors/v1_write.rs | 42 ++++++++++++++++++++++++++++++ + server/core/src/https/v1.rs | 6 ++++- + server/core/src/https/v1_oauth2.rs | 29 +++++++++++++++++++++ + server/lib/src/constants/acp.rs | 6 +++++ + 4 files changed, 82 insertions(+), 1 deletion(-) + +diff --git a/server/core/src/actors/v1_write.rs b/server/core/src/actors/v1_write.rs +index e00a969fb..1cacc67b8 100644 +--- a/server/core/src/actors/v1_write.rs ++++ b/server/core/src/actors/v1_write.rs +@@ -315,20 +315,62 @@ impl QueryServerWriteV1 { + }; + + trace!(?del, "Begin delete event"); + + idms_prox_write + .qs_write + .delete(&del) + .and_then(|_| idms_prox_write.commit().map(|_| ())) + } + ++ #[instrument( ++ level = "info", ++ skip_all, ++ fields(uuid = ?eventid) ++ )] ++ pub async fn handle_oauth2_basic_secret_write( ++ &self, ++ client_auth_info: ClientAuthInfo, ++ filter: Filter, ++ new_secret: String, ++ eventid: Uuid, ++ ) -> Result<(), OperationError> { ++ // Given a protoEntry, turn this into a modification set. ++ let ct = duration_from_epoch_now(); ++ let mut idms_prox_write = self.idms.proxy_write(ct).await; ++ let ident = idms_prox_write ++ .validate_client_auth_info_to_ident(client_auth_info, ct) ++ .map_err(|e| { ++ admin_error!(err = ?e, "Invalid identity"); ++ e ++ })?; ++ ++ let modlist = ModifyList::new_purge_and_set( ++ Attribute::OAuth2RsBasicSecret, ++ Value::SecretValue(new_secret), ++ ); ++ ++ let mdf = ++ ModifyEvent::from_internal_parts(ident, &modlist, &filter, &idms_prox_write.qs_write) ++ .map_err(|e| { ++ admin_error!(err = ?e, "Failed to begin modify during handle_oauth2_basic_secret_write"); ++ e ++ })?; ++ ++ trace!(?mdf, "Begin modify event"); ++ ++ idms_prox_write ++ .qs_write ++ .modify(&mdf) ++ .and_then(|_| idms_prox_write.commit()) ++ } ++ + #[instrument( + level = "info", + skip_all, + fields(uuid = ?eventid) + )] + pub async fn handle_reviverecycled( + &self, + client_auth_info: ClientAuthInfo, + filter: Filter, + eventid: Uuid, +diff --git a/server/core/src/https/v1.rs b/server/core/src/https/v1.rs +index 8aba83bb2..f1f815026 100644 +--- a/server/core/src/https/v1.rs ++++ b/server/core/src/https/v1.rs +@@ -1,17 +1,17 @@ + //! The V1 API things! + + use axum::extract::{Path, State}; + use axum::http::{HeaderMap, HeaderValue}; + use axum::middleware::from_fn; + use axum::response::{IntoResponse, Response}; +-use axum::routing::{delete, get, post, put}; ++use axum::routing::{delete, get, post, put, patch}; + use axum::{Extension, Json, Router}; + use axum_extra::extract::cookie::{Cookie, CookieJar, SameSite}; + use compact_jwt::{Jwk, Jws, JwsSigner}; + use kanidm_proto::constants::uri::V1_AUTH_VALID; + use std::net::IpAddr; + use uuid::Uuid; + + use kanidm_proto::internal::{ + ApiToken, AppLink, CUIntentToken, CURequest, CUSessionToken, CUStatus, CreateRequest, + CredentialStatus, DeleteRequest, IdentifyUserRequest, IdentifyUserResponse, ModifyRequest, +@@ -3119,20 +3119,24 @@ pub(crate) fn route_setup(state: ServerState) -> Router { + ) + .route( + "/v1/oauth2/:rs_name/_image", + post(super::v1_oauth2::oauth2_id_image_post) + .delete(super::v1_oauth2::oauth2_id_image_delete), + ) + .route( + "/v1/oauth2/:rs_name/_basic_secret", + get(super::v1_oauth2::oauth2_id_get_basic_secret), + ) ++ .route( ++ "/v1/oauth2/:rs_name/_basic_secret", ++ patch(super::v1_oauth2::oauth2_id_patch_basic_secret), ++ ) + .route( + "/v1/oauth2/:rs_name/_scopemap/:group", + post(super::v1_oauth2::oauth2_id_scopemap_post) + .delete(super::v1_oauth2::oauth2_id_scopemap_delete), + ) + .route( + "/v1/oauth2/:rs_name/_sup_scopemap/:group", + post(super::v1_oauth2::oauth2_id_sup_scopemap_post) + .delete(super::v1_oauth2::oauth2_id_sup_scopemap_delete), + ) +diff --git a/server/core/src/https/v1_oauth2.rs b/server/core/src/https/v1_oauth2.rs +index 5e481afab..a771aed04 100644 +--- a/server/core/src/https/v1_oauth2.rs ++++ b/server/core/src/https/v1_oauth2.rs +@@ -144,20 +144,49 @@ pub(crate) async fn oauth2_id_get_basic_secret( + ) -> Result>, WebError> { + let filter = oauth2_id(&rs_name); + state + .qe_r_ref + .handle_oauth2_basic_secret_read(client_auth_info, filter, kopid.eventid) + .await + .map(Json::from) + .map_err(WebError::from) + } + ++#[utoipa::path( ++ patch, ++ path = "/v1/oauth2/{rs_name}/_basic_secret", ++ request_body=ProtoEntry, ++ responses( ++ DefaultApiResponse, ++ ), ++ security(("token_jwt" = [])), ++ tag = "v1/oauth2", ++ operation_id = "oauth2_id_patch_basic_secret" ++)] ++/// Overwrite the basic secret for a given OAuth2 Resource Server. ++#[instrument(level = "info", skip(state, new_secret))] ++pub(crate) async fn oauth2_id_patch_basic_secret( ++ State(state): State, ++ Extension(kopid): Extension, ++ VerifiedClientInformation(client_auth_info): VerifiedClientInformation, ++ Path(rs_name): Path, ++ Json(new_secret): Json, ++) -> Result, WebError> { ++ let filter = oauth2_id(&rs_name); ++ state ++ .qe_w_ref ++ .handle_oauth2_basic_secret_write(client_auth_info, filter, new_secret, kopid.eventid) ++ .await ++ .map(Json::from) ++ .map_err(WebError::from) ++} ++ + #[utoipa::path( + patch, + path = "/v1/oauth2/{rs_name}", + request_body=ProtoEntry, + responses( + DefaultApiResponse, + ), + security(("token_jwt" = [])), + tag = "v1/oauth2", + operation_id = "oauth2_id_patch" +diff --git a/server/lib/src/constants/acp.rs b/server/lib/src/constants/acp.rs +index f3409649d..42e407b7d 100644 +--- a/server/lib/src/constants/acp.rs ++++ b/server/lib/src/constants/acp.rs +@@ -645,34 +645,36 @@ lazy_static! { + Attribute::Image, + ], + modify_present_attrs: vec![ + Attribute::Description, + Attribute::DisplayName, + Attribute::OAuth2RsName, + Attribute::OAuth2RsOrigin, + Attribute::OAuth2RsOriginLanding, + Attribute::OAuth2RsSupScopeMap, + Attribute::OAuth2RsScopeMap, ++ Attribute::OAuth2RsBasicSecret, + Attribute::OAuth2AllowInsecureClientDisablePkce, + Attribute::OAuth2JwtLegacyCryptoEnable, + Attribute::OAuth2PreferShortUsername, + Attribute::Image, + ], + create_attrs: vec![ + Attribute::Class, + Attribute::Description, + Attribute::DisplayName, + Attribute::OAuth2RsName, + Attribute::OAuth2RsOrigin, + Attribute::OAuth2RsOriginLanding, + Attribute::OAuth2RsSupScopeMap, + Attribute::OAuth2RsScopeMap, ++ Attribute::OAuth2RsBasicSecret, + Attribute::OAuth2AllowInsecureClientDisablePkce, + Attribute::OAuth2JwtLegacyCryptoEnable, + Attribute::OAuth2PreferShortUsername, + Attribute::Image, + ], + create_classes: vec![ + EntryClass::Object, + EntryClass::OAuth2ResourceServer, + EntryClass::OAuth2ResourceServerBasic, + EntryClass::OAuth2ResourceServerPublic, +@@ -739,36 +741,38 @@ lazy_static! { + Attribute::Image, + ], + modify_present_attrs: vec![ + Attribute::Description, + Attribute::DisplayName, + Attribute::OAuth2RsName, + Attribute::OAuth2RsOrigin, + Attribute::OAuth2RsOriginLanding, + Attribute::OAuth2RsSupScopeMap, + Attribute::OAuth2RsScopeMap, ++ Attribute::OAuth2RsBasicSecret, + Attribute::OAuth2AllowInsecureClientDisablePkce, + Attribute::OAuth2JwtLegacyCryptoEnable, + Attribute::OAuth2PreferShortUsername, + Attribute::OAuth2AllowLocalhostRedirect, + Attribute::OAuth2RsClaimMap, + Attribute::Image, + ], + create_attrs: vec![ + Attribute::Class, + Attribute::Description, + Attribute::DisplayName, + Attribute::OAuth2RsName, + Attribute::OAuth2RsOrigin, + Attribute::OAuth2RsOriginLanding, + Attribute::OAuth2RsSupScopeMap, + Attribute::OAuth2RsScopeMap, ++ Attribute::OAuth2RsBasicSecret, + Attribute::OAuth2AllowInsecureClientDisablePkce, + Attribute::OAuth2JwtLegacyCryptoEnable, + Attribute::OAuth2PreferShortUsername, + Attribute::OAuth2AllowLocalhostRedirect, + Attribute::OAuth2RsClaimMap, + Attribute::Image, + ], + create_classes: vec![ + EntryClass::Object, + EntryClass::OAuth2ResourceServer, +@@ -840,36 +844,38 @@ lazy_static! { + Attribute::Image, + ], + modify_present_attrs: vec![ + Attribute::Description, + Attribute::DisplayName, + Attribute::Name, + Attribute::OAuth2RsOrigin, + Attribute::OAuth2RsOriginLanding, + Attribute::OAuth2RsSupScopeMap, + Attribute::OAuth2RsScopeMap, ++ Attribute::OAuth2RsBasicSecret, + Attribute::OAuth2AllowInsecureClientDisablePkce, + Attribute::OAuth2JwtLegacyCryptoEnable, + Attribute::OAuth2PreferShortUsername, + Attribute::OAuth2AllowLocalhostRedirect, + Attribute::OAuth2RsClaimMap, + Attribute::Image, + ], + create_attrs: vec![ + Attribute::Class, + Attribute::Description, + Attribute::Name, + Attribute::OAuth2RsName, + Attribute::OAuth2RsOrigin, + Attribute::OAuth2RsOriginLanding, + Attribute::OAuth2RsSupScopeMap, + Attribute::OAuth2RsScopeMap, ++ Attribute::OAuth2RsBasicSecret, + Attribute::OAuth2AllowInsecureClientDisablePkce, + Attribute::OAuth2JwtLegacyCryptoEnable, + Attribute::OAuth2PreferShortUsername, + Attribute::OAuth2AllowLocalhostRedirect, + Attribute::OAuth2RsClaimMap, + Attribute::Image, + ], + create_classes: vec![ + EntryClass::Object, + EntryClass::Account, +-- +2.45.2 + diff --git a/pkgs/by-name/ka/kanidm/patches/1_3/recover-account.patch b/pkgs/by-name/ka/kanidm/patches/1_3/recover-account.patch new file mode 100644 index 000000000000..a344f5a2086f --- /dev/null +++ b/pkgs/by-name/ka/kanidm/patches/1_3/recover-account.patch @@ -0,0 +1,173 @@ +From cc8269489b56755714f07eee4671f8aa2659c014 Mon Sep 17 00:00:00 2001 +From: oddlama +Date: Mon, 12 Aug 2024 23:17:42 +0200 +Subject: [PATCH 2/2] recover account + +--- + server/core/src/actors/internal.rs | 3 ++- + server/core/src/admin.rs | 6 +++--- + server/daemon/src/main.rs | 14 +++++++++++++- + server/daemon/src/opt.rs | 4 ++++ + 4 files changed, 22 insertions(+), 5 deletions(-) + +diff --git a/server/core/src/actors/internal.rs b/server/core/src/actors/internal.rs +index 40c18777f..40d553b40 100644 +--- a/server/core/src/actors/internal.rs ++++ b/server/core/src/actors/internal.rs +@@ -153,25 +153,26 @@ impl QueryServerWriteV1 { + } + + #[instrument( + level = "info", + skip(self, eventid), + fields(uuid = ?eventid) + )] + pub(crate) async fn handle_admin_recover_account( + &self, + name: String, ++ password: Option, + eventid: Uuid, + ) -> Result { + let ct = duration_from_epoch_now(); + let mut idms_prox_write = self.idms.proxy_write(ct).await; +- let pw = idms_prox_write.recover_account(name.as_str(), None)?; ++ let pw = idms_prox_write.recover_account(name.as_str(), password.as_deref())?; + + idms_prox_write.commit().map(|()| pw) + } + + #[instrument( + level = "info", + skip_all, + fields(uuid = ?eventid) + )] + pub(crate) async fn handle_domain_raise(&self, eventid: Uuid) -> Result { +diff --git a/server/core/src/admin.rs b/server/core/src/admin.rs +index 90ccb1927..85e31ddef 100644 +--- a/server/core/src/admin.rs ++++ b/server/core/src/admin.rs +@@ -17,21 +17,21 @@ use tokio_util::codec::{Decoder, Encoder, Framed}; + use tracing::{span, Instrument, Level}; + use uuid::Uuid; + + pub use kanidm_proto::internal::{ + DomainInfo as ProtoDomainInfo, DomainUpgradeCheckReport as ProtoDomainUpgradeCheckReport, + DomainUpgradeCheckStatus as ProtoDomainUpgradeCheckStatus, + }; + + #[derive(Serialize, Deserialize, Debug)] + pub enum AdminTaskRequest { +- RecoverAccount { name: String }, ++ RecoverAccount { name: String, password: Option }, + ShowReplicationCertificate, + RenewReplicationCertificate, + RefreshReplicationConsumer, + DomainShow, + DomainUpgradeCheck, + DomainRaise, + DomainRemigrate { level: Option }, + } + + #[derive(Serialize, Deserialize, Debug)] +@@ -302,22 +302,22 @@ async fn handle_client( + let mut reqs = Framed::new(sock, ServerCodec); + + trace!("Waiting for requests ..."); + while let Some(Ok(req)) = reqs.next().await { + // Setup the logging span + let eventid = Uuid::new_v4(); + let nspan = span!(Level::INFO, "handle_admin_client_request", uuid = ?eventid); + + let resp = async { + match req { +- AdminTaskRequest::RecoverAccount { name } => { +- match server_rw.handle_admin_recover_account(name, eventid).await { ++ AdminTaskRequest::RecoverAccount { name, password } => { ++ match server_rw.handle_admin_recover_account(name, password, eventid).await { + Ok(password) => AdminTaskResponse::RecoverAccount { password }, + Err(e) => { + error!(err = ?e, "error during recover-account"); + AdminTaskResponse::Error + } + } + } + AdminTaskRequest::ShowReplicationCertificate => match repl_ctrl_tx.as_mut() { + Some(ctrl_tx) => show_replication_certificate(ctrl_tx).await, + None => { +diff --git a/server/daemon/src/main.rs b/server/daemon/src/main.rs +index 577995615..a967928c9 100644 +--- a/server/daemon/src/main.rs ++++ b/server/daemon/src/main.rs +@@ -894,27 +894,39 @@ async fn kanidm_main( + } else { + let output_mode: ConsoleOutputMode = commonopts.output_mode.to_owned().into(); + submit_admin_req( + config.adminbindpath.as_str(), + AdminTaskRequest::RefreshReplicationConsumer, + output_mode, + ) + .await; + } + } +- KanidmdOpt::RecoverAccount { name, commonopts } => { ++ KanidmdOpt::RecoverAccount { name, from_environment, commonopts } => { + info!("Running account recovery ..."); + let output_mode: ConsoleOutputMode = commonopts.output_mode.to_owned().into(); ++ let password = if *from_environment { ++ match std::env::var("KANIDM_RECOVER_ACCOUNT_PASSWORD") { ++ Ok(val) => Some(val), ++ _ => { ++ error!("Environment variable KANIDM_RECOVER_ACCOUNT_PASSWORD not set"); ++ return ExitCode::FAILURE; ++ } ++ } ++ } else { ++ None ++ }; + submit_admin_req( + config.adminbindpath.as_str(), + AdminTaskRequest::RecoverAccount { + name: name.to_owned(), ++ password, + }, + output_mode, + ) + .await; + } + KanidmdOpt::Database { + commands: DbCommands::Reindex(_copt), + } => { + info!("Running in reindex mode ..."); + reindex_server_core(&config).await; +diff --git a/server/daemon/src/opt.rs b/server/daemon/src/opt.rs +index f1b45a5b3..9c013e32e 100644 +--- a/server/daemon/src/opt.rs ++++ b/server/daemon/src/opt.rs +@@ -229,20 +229,24 @@ enum KanidmdOpt { + /// Create a self-signed ca and tls certificate in the locations listed from the + /// configuration. These certificates should *not* be used in production, they + /// are for testing and evaluation only! + CertGenerate(CommonOpt), + #[clap(name = "recover-account")] + /// Recover an account's password + RecoverAccount { + #[clap(value_parser)] + /// The account name to recover credentials for. + name: String, ++ /// Use the password given in the environment variable ++ /// `KANIDM_RECOVER_ACCOUNT_PASSWORD` instead of generating one. ++ #[clap(long = "from-environment")] ++ from_environment: bool, + #[clap(flatten)] + commonopts: CommonOpt, + }, + /// Display this server's replication certificate + ShowReplicationCertificate { + #[clap(flatten)] + commonopts: CommonOpt, + }, + /// Renew this server's replication certificate + RenewReplicationCertificate { +-- +2.45.2 + diff --git a/pkgs/by-name/ka/kanidm/patches/oauth2-basic-secret-modify.patch b/pkgs/by-name/ka/kanidm/patches/1_4/oauth2-basic-secret-modify.patch similarity index 100% rename from pkgs/by-name/ka/kanidm/patches/oauth2-basic-secret-modify.patch rename to pkgs/by-name/ka/kanidm/patches/1_4/oauth2-basic-secret-modify.patch diff --git a/pkgs/by-name/ka/kanidm/patches/recover-account.patch b/pkgs/by-name/ka/kanidm/patches/1_4/recover-account.patch similarity index 100% rename from pkgs/by-name/ka/kanidm/patches/recover-account.patch rename to pkgs/by-name/ka/kanidm/patches/1_4/recover-account.patch diff --git a/pkgs/by-name/li/libmpd/package.nix b/pkgs/by-name/li/libmpd/package.nix index a509134318d4..c186379cde4e 100644 --- a/pkgs/by-name/li/libmpd/package.nix +++ b/pkgs/by-name/li/libmpd/package.nix @@ -35,6 +35,10 @@ stdenv.mkDerivation (finalAttrs: { cp -r doc/html $devdoc/share/devhelp/libmpd/doxygen ''; + # Fix GCC 14 build + # https://hydra.nixos.org/build/281958201/nixlog/3 + env.NIX_CFLAGS_COMPILE = "-Wno-error=int-conversion"; + meta = with lib; { description = "Higher level access to MPD functions"; homepage = "https://www.musicpd.org/download/libmpd/"; diff --git a/pkgs/by-name/lv/lv/package.nix b/pkgs/by-name/lv/lv/package.nix index bb901a29b84f..18d25c1ab89e 100644 --- a/pkgs/by-name/lv/lv/package.nix +++ b/pkgs/by-name/lv/lv/package.nix @@ -1,23 +1,31 @@ { lib, stdenv, - fetchurl, + fetchFromGitHub, ncurses, + unstableGitUpdater, + autoreconfHook, }: stdenv.mkDerivation rec { pname = "lv"; - version = "4.51"; + version = "4.51-unstable-2020-08-03"; - src = fetchurl { - url = "mirror://debian/pool/main/l/${pname}/${pname}_${version}.orig.tar.gz"; - sha256 = "0yf3idz1qspyff1if41xjpqqcaqa8q8icslqlnz0p9dj36gmm5l3"; + src = fetchFromGitHub { + owner = "ttdoda"; + repo = "lv"; + rev = "1fb214d4136334a1f6cd932b99f85c74609e1f23"; + hash = "sha256-mUFiWzTTM6nAKQgXA0sYIUm1MwN7HBHD8LWBgzu3ZUk="; }; makeFlags = [ "prefix=${placeholder "out"}" ]; + nativeBuildInputs = [ autoreconfHook ]; buildInputs = [ ncurses ]; + preAutoreconf = "cd src"; + postAutoreconf = "cd .."; + configurePhase = '' mkdir -p build cd build @@ -28,9 +36,13 @@ stdenv.mkDerivation rec { mkdir -p $out/bin ''; + passthru.updateScript = unstableGitUpdater { + tagPrefix = "v"; + }; + meta = with lib; { description = "Powerful multi-lingual file viewer / grep"; - homepage = "https://web.archive.org/web/20160310122517/www.ff.iij4u.or.jp/~nrt/lv/"; + homepage = "https://github.com/ttdoda/lv"; license = licenses.gpl2Plus; platforms = with platforms; linux ++ darwin; maintainers = with maintainers; [ kayhide ]; diff --git a/pkgs/by-name/me/mesa-demos/package.nix b/pkgs/by-name/me/mesa-demos/package.nix index d26fbe799dd5..362d98b0bffa 100644 --- a/pkgs/by-name/me/mesa-demos/package.nix +++ b/pkgs/by-name/me/mesa-demos/package.nix @@ -7,6 +7,7 @@ libGLU, libX11, libXext, + libgbm, mesa, meson, ninja, @@ -47,7 +48,7 @@ stdenv.mkDerivation rec { libXext libGL libGLU - mesa + libgbm wayland wayland-protocols vulkan-loader diff --git a/pkgs/by-name/mi/mint-l-icons/package.nix b/pkgs/by-name/mi/mint-l-icons/package.nix index 3a53d89ade14..63692168c262 100644 --- a/pkgs/by-name/mi/mint-l-icons/package.nix +++ b/pkgs/by-name/mi/mint-l-icons/package.nix @@ -10,14 +10,14 @@ stdenvNoCC.mkDerivation rec { pname = "mint-l-icons"; - version = "1.7.3"; + version = "1.7.4"; src = fetchFromGitHub { owner = "linuxmint"; repo = pname; # They don't really do tags, this is just a named commit. - rev = "f1900facf915715623ef0ca2874ae4dd04039e81"; - hash = "sha256-UpVuhzZdw0Ri6X20N/yGFMmwEymMvLr78DwYaHD+CNY="; + rev = "b442277c822c92f7bb68282cb82c7d1a98e3fd37"; + hash = "sha256-vPDEribE/CZwoAK1C9fjbWQEO/NWMWCKCUO/Xw/SxZ0="; }; propagatedBuildInputs = [ diff --git a/pkgs/by-name/mi/mint-themes/package.nix b/pkgs/by-name/mi/mint-themes/package.nix index 2145c964e468..88049d075176 100644 --- a/pkgs/by-name/mi/mint-themes/package.nix +++ b/pkgs/by-name/mi/mint-themes/package.nix @@ -8,13 +8,13 @@ stdenvNoCC.mkDerivation rec { pname = "mint-themes"; - version = "2.2.1"; + version = "2.2.2"; src = fetchFromGitHub { owner = "linuxmint"; repo = pname; rev = version; - hash = "sha256-vKIAIaMW1iY85/IeoYeXT1Po+3o+Q6D6RcoA0kpjJoI="; + hash = "sha256-97H2gVSZh0azl2ui4iWsNqgKzkBXRo6Daza2XtRdqII="; }; nativeBuildInputs = [ diff --git a/pkgs/by-name/mu/muffin/package.nix b/pkgs/by-name/mu/muffin/package.nix index 44e2f83f7887..69654afc27e3 100644 --- a/pkgs/by-name/mu/muffin/package.nix +++ b/pkgs/by-name/mu/muffin/package.nix @@ -24,7 +24,7 @@ libXdamage, libxkbcommon, libXtst, - libgbm, + mesa, meson, ninja, pipewire, @@ -66,7 +66,6 @@ stdenv.mkDerivation rec { nativeBuildInputs = [ desktop-file-utils - libgbm meson ninja pkg-config @@ -106,6 +105,7 @@ stdenv.mkDerivation rec { json-glib libXtst graphene + mesa # actually uses eglmesaext ]; mesonFlags = [ diff --git a/pkgs/by-name/op/openmpi/package.nix b/pkgs/by-name/op/openmpi/package.nix index 7fcca51c739e..719247b58a43 100644 --- a/pkgs/by-name/op/openmpi/package.nix +++ b/pkgs/by-name/op/openmpi/package.nix @@ -85,6 +85,7 @@ stdenv.mkDerivation (finalAttrs: { zlib libevent hwloc + prrte ] ++ lib.optionals stdenv.hostPlatform.isLinux [ libnl @@ -92,7 +93,6 @@ stdenv.mkDerivation (finalAttrs: { pmix ucx ucc - prrte ] ++ lib.optionals cudaSupport [ cudaPackages.cuda_cudart ] ++ lib.optionals (stdenv.hostPlatform.isLinux || stdenv.hostPlatform.isFreeBSD) [ rdma-core ] @@ -119,7 +119,7 @@ stdenv.mkDerivation (finalAttrs: { "--with-pmix=${lib.getDev pmix}" "--with-pmix-libdir=${lib.getLib pmix}/lib" # Puts a "default OMPI_PRTERUN" value to mpirun / mpiexec executables - (lib.withFeatureAs stdenv.hostPlatform.isLinux "prrte" (lib.getBin prrte)) + (lib.withFeatureAs true "prrte" (lib.getBin prrte)) (lib.withFeature enableSGE "sge") (lib.enableFeature enablePrefix "mpirun-prefix-by-default") # TODO: add UCX support, which is recommended to use with cuda for the most robust OpenMPI build diff --git a/pkgs/by-name/pr/prrte/package.nix b/pkgs/by-name/pr/prrte/package.nix index 980b4d889d43..1deb96f3a6c7 100644 --- a/pkgs/by-name/pr/prrte/package.nix +++ b/pkgs/by-name/pr/prrte/package.nix @@ -75,6 +75,6 @@ stdenv.mkDerivation rec { homepage = "https://docs.prrte.org/"; license = lib.licenses.bsd3; maintainers = with lib.maintainers; [ markuskowa ]; - platforms = lib.platforms.linux; + platforms = lib.platforms.unix; }; } diff --git a/pkgs/by-name/ro/rocksdb/package.nix b/pkgs/by-name/ro/rocksdb/package.nix index 8327560a56c4..70de68530e82 100644 --- a/pkgs/by-name/ro/rocksdb/package.nix +++ b/pkgs/by-name/ro/rocksdb/package.nix @@ -20,13 +20,13 @@ stdenv.mkDerivation (finalAttrs: { pname = "rocksdb"; - version = "9.7.4"; + version = "9.8.4"; src = fetchFromGitHub { owner = "facebook"; repo = "rocksdb"; rev = "v${finalAttrs.version}"; - hash = "sha256-u5uuShM2SxHc9/zL4UU56IhCcR/ZQbzde0LgOYS44bM="; + hash = "sha256-A6Gx4FqoGlxITUUz9k6tkDjUcLtMUBK9JS8vuAS96H0="; }; patches = lib.optional ( diff --git a/pkgs/by-name/si/signal-desktop/signal-desktop-aarch64.nix b/pkgs/by-name/si/signal-desktop/signal-desktop-aarch64.nix index 52ccb08fb503..b12cb4b80540 100644 --- a/pkgs/by-name/si/signal-desktop/signal-desktop-aarch64.nix +++ b/pkgs/by-name/si/signal-desktop/signal-desktop-aarch64.nix @@ -2,7 +2,7 @@ callPackage ./generic.nix { } rec { pname = "signal-desktop"; dir = "Signal"; - version = "7.34.0"; + version = "7.36.0"; url = "https://github.com/0mniteck/Signal-Desktop-Mobian/raw/${version}/builds/release/signal-desktop_${version}_arm64.deb"; - hash = "sha256-feNjNhKGIJsV6LH2mKAXd7TEnmvcKXheXmqJZEBqXvE="; + hash = "sha256-nmAqFDw35pdZg5tiq9MUlqXnbRLRkSOX9SWhccnE2Xw="; } diff --git a/pkgs/by-name/si/signal-desktop/signal-desktop-darwin.nix b/pkgs/by-name/si/signal-desktop/signal-desktop-darwin.nix index 9552f9e258fa..b34d728a931d 100644 --- a/pkgs/by-name/si/signal-desktop/signal-desktop-darwin.nix +++ b/pkgs/by-name/si/signal-desktop/signal-desktop-darwin.nix @@ -6,11 +6,11 @@ }: stdenv.mkDerivation (finalAttrs: { pname = "signal-desktop"; - version = "7.35.0"; + version = "7.36.0"; src = fetchurl { url = "https://updates.signal.org/desktop/signal-desktop-mac-universal-${finalAttrs.version}.dmg"; - hash = "sha256-+ZzZp3/koitwtHyUmcgltcYo91KfDfQzOjnOzTJJu6c="; + hash = "sha256-hHgobx4q+nWtsq6uplVWY5ie0qu5ZoeFxYZNflza/CM="; }; sourceRoot = "."; diff --git a/pkgs/by-name/si/signal-desktop/signal-desktop.nix b/pkgs/by-name/si/signal-desktop/signal-desktop.nix index 2b91d4166037..37d925e75a6a 100644 --- a/pkgs/by-name/si/signal-desktop/signal-desktop.nix +++ b/pkgs/by-name/si/signal-desktop/signal-desktop.nix @@ -2,7 +2,7 @@ callPackage ./generic.nix { } rec { pname = "signal-desktop"; dir = "Signal"; - version = "7.35.0"; + version = "7.36.0"; url = "https://updates.signal.org/desktop/apt/pool/s/signal-desktop/signal-desktop_${version}_amd64.deb"; - hash = "sha256-cQ7bwgRjlI2idnHtl7EZyBfjcPz52s8+E7UpLxn4FEg="; + hash = "sha256-5p9Vnxj53jOZbEirWamwv4Fkm/fMLeLfV93GDrV8XuA="; } diff --git a/pkgs/by-name/si/simple-live-app/package.nix b/pkgs/by-name/si/simple-live-app/package.nix index 8d8a0c33dc61..9186f1f6a5d6 100644 --- a/pkgs/by-name/si/simple-live-app/package.nix +++ b/pkgs/by-name/si/simple-live-app/package.nix @@ -26,7 +26,7 @@ libpulseaudio, libcaca, libdrm, - mesa, + libgbm, libXScrnSaver, nv-codec-headers-11, libXpresent, @@ -96,7 +96,7 @@ flutter324.buildFlutterApplication rec { libpulseaudio libcaca libdrm - mesa + libgbm libXScrnSaver libXpresent nv-codec-headers-11 diff --git a/pkgs/by-name/sy/syft/package.nix b/pkgs/by-name/sy/syft/package.nix index 8e94fef9001f..e1ee3a24f9e4 100644 --- a/pkgs/by-name/sy/syft/package.nix +++ b/pkgs/by-name/sy/syft/package.nix @@ -7,13 +7,13 @@ buildGoModule rec { pname = "syft"; - version = "1.18.0"; + version = "1.18.1"; src = fetchFromGitHub { owner = "anchore"; repo = "syft"; rev = "refs/tags/v${version}"; - hash = "sha256-cxBZs4H557Sc1k3jftbxjv1DcPM9GZb/2QGtuuA/D2I="; + hash = "sha256-ot4qdCxF9Kg657IFzUIxGsmRCDag1a4Ipq1qj2RPW0E="; # populate values that require us to use git. By doing this in postFetch we # can delete .git afterwards and maintain better reproducibility of the src. leaveDotGit = true; @@ -28,7 +28,7 @@ buildGoModule rec { # hash mismatch with darwin proxyVendor = true; - vendorHash = "sha256-hilxZidIIwrqd6motWDlicCPepU4gyZvqk/Fzry98UE="; + vendorHash = "sha256-3GvOWu+h1d5qUxUd7yxE/YReeuXteVV/4ZrnMgGRZi0="; nativeBuildInputs = [ installShellFiles ]; diff --git a/pkgs/by-name/ti/tiledb/package.nix b/pkgs/by-name/ti/tiledb/package.nix index 89cd19166e22..ca15cf16221e 100644 --- a/pkgs/by-name/ti/tiledb/package.nix +++ b/pkgs/by-name/ti/tiledb/package.nix @@ -48,16 +48,24 @@ stdenv.mkDerivation rec { ./FindMagic_EP.cmake.patch ]; - postPatch = '' - # copy pre-fetched external project to directory where it is expected to be - mkdir -p build/externals/src - cp -a ${ep-file-windows} build/externals/src/ep_magic - chmod -R u+w build/externals/src/ep_magic + postPatch = + '' + # copy pre-fetched external project to directory where it is expected to be + mkdir -p build/externals/src + cp -a ${ep-file-windows} build/externals/src/ep_magic + chmod -R u+w build/externals/src/ep_magic - # add openssl on path - sed -i '49i list(APPEND OPENSSL_PATHS "${openssl.dev}" "${openssl.out}")' \ - cmake/Modules/FindOpenSSL_EP.cmake - ''; + # add openssl on path + sed -i '49i list(APPEND OPENSSL_PATHS "${openssl.dev}" "${openssl.out}")' \ + cmake/Modules/FindOpenSSL_EP.cmake + '' + # libcxx (as of llvm-19) does not yet support `stop_token` and `jthread` + # without the -fexperimental-library flag. Tiledb adds its own + # implementations in the std namespace which conflict with libcxx. This + # test can be re-enabled once libcxx supports stop_token and jthread. + + lib.optionalString (stdenv.cc.libcxx != null) '' + truncate -s0 tiledb/stdx/test/CMakeLists.txt + ''; # upstream will hopefully fix this in some newer release env.CXXFLAGS = "-include random"; diff --git a/pkgs/by-name/xp/xplayer/package.nix b/pkgs/by-name/xp/xplayer/package.nix index 42088cf6fd76..d17b1f05b197 100644 --- a/pkgs/by-name/xp/xplayer/package.nix +++ b/pkgs/by-name/xp/xplayer/package.nix @@ -86,6 +86,13 @@ stdenv.mkDerivation rec { patchPythonScript $out/lib/xplayer/plugins/dbus/dbusservice.py ''; + env = lib.optionalAttrs stdenv.cc.isGNU { + NIX_CFLAGS_COMPILE = toString [ + "-Wno-error=incompatible-pointer-types" + "-Wno-error=return-mismatch" + ]; + }; + meta = with lib; { description = "Generic media player from Linux Mint"; license = with licenses; [ diff --git a/pkgs/by-name/ze/zenoh/package.nix b/pkgs/by-name/ze/zenoh/package.nix index be0fe0d26297..823025666682 100644 --- a/pkgs/by-name/ze/zenoh/package.nix +++ b/pkgs/by-name/ze/zenoh/package.nix @@ -31,57 +31,7 @@ rustPlatform.buildRustPackage rec { "zenoh-ext-examples" ]; - checkFlags = [ - # thread 'test_liveliness_query_clique' panicked at zenoh/tests/liveliness.rs:103:43: - # called `Result::unwrap()` on an `Err` value: Can not create a new TCP listener bound to tcp/localhost:47448... - "--skip test_liveliness_query_clique" - # thread 'test_liveliness_subscriber_double_client_history_middle' panicked at zenoh/tests/liveliness.rs:845:43: - # called `Result::unwrap()` on an `Err` value: Can not create a new TCP listener bound to tcp/localhost:47456... - "--skip test_liveliness_subscriber_double_client_history_middle" - # thread 'zenoh_matching_status_remote' panicked at zenoh/tests/matching.rs:155:5: - # assertion failed: received_status.ok().flatten().map(|s| - # s.matching_subscribers()).eq(&Some(true)) - "--skip zenoh_matching_status_remote" - # thread 'qos_pubsub' panicked at zenoh/tests/qos.rs:50:18: - # called `Result::unwrap()` on an `Err` value: Elapsed(()) - "--skip qos_pubsub" - # never ending tests - "--skip router_linkstate" - "--skip three_node_combination" - "--skip three_node_combination_multicast" - # Error: Timeout at zenoh/tests/routing.rs:453. - "--skip gossip" - # thread 'zenoh_session_multicast' panicked at zenoh/tests/session.rs:85:49: - # called `Result::unwrap()` on an `Err` value: Can not create a new UDP link bound to udp/224.0.0.1:17448... - "--skip zenoh_session_multicast" - # thread 'tests::transport_multicast_compression_udp_only' panicked at io/zenoh-transport/tests/multicast_compression.rs:170:86: - # called `Result::unwrap()` on an `Err` value: Can not create a new UDP link bound to udp/224.24.220.245:21000... - "--skip tests::transport_multicast_compression_udp_only" - # thread 'tests::transport_multicast_udp_only' panicked at io/zenoh-transport/tests/multicast_transport.rs:167:86: - # called `Result::unwrap()` on an `Err` value: Can not create a new UDP link bound to udp/224.52.216.110:20000... - "--skip tests::transport_multicast_udp_only" - # thread 'openclose_tcp_only_connect_with_interface_restriction' panicked at io/zenoh-transport/tests/unicast_openclose.rs:764:63: - # index out of bounds: the len is 0 but the index is 0 - "--skip openclose_tcp_only_connect_with_interface_restriction" - # thread 'openclose_udp_only_listen_with_interface_restriction' panicked at io/zenoh-transport/tests/unicast_openclose.rs:820:72: - # index out of bounds: the len is 0 but the index is 0 - "--skip openclose_tcp_only_listen_with_interface_restriction" - # thread 'openclose_tcp_only_listen_with_interface_restriction' panicked at io/zenoh-transport/tests/unicast_openclose.rs:783:72: - # index out of bounds: the len is 0 but the index is 0 - "--skip openclose_udp_only_connect_with_interface_restriction" - # thread 'openclose_udp_only_connect_with_interface_restriction' panicked at io/zenoh-transport/tests/unicast_openclose.rs:802:63: - # index out of bounds: the len is 0 but the index is 0 - "--skip openclose_udp_only_listen_with_interface_restriction" - - # These tests require a network interface and fail in the sandbox - "--skip openclose_quic_only_listen_with_interface_restriction" - "--skip openclose_quic_only_connect_with_interface_restriction" - "--skip openclose_tls_only_connect_with_interface_restriction" - "--skip openclose_tls_only_listen_with_interface_restriction" - - # This test fails on Hydra - "--skip authenticator_quic" - ]; + doCheck = false; passthru.tests.version = testers.testVersion { package = zenoh; diff --git a/pkgs/desktops/xfce/applications/xfce4-screensaver/default.nix b/pkgs/desktops/xfce/applications/xfce4-screensaver/default.nix index 6d956e14b29a..a69f97b6e45f 100644 --- a/pkgs/desktops/xfce/applications/xfce4-screensaver/default.nix +++ b/pkgs/desktops/xfce/applications/xfce4-screensaver/default.nix @@ -16,6 +16,7 @@ python3, systemd, xfconf, + xfdesktop, lib, }: @@ -26,9 +27,9 @@ in mkXfceDerivation { category = "apps"; pname = "xfce4-screensaver"; - version = "4.18.3"; + version = "4.18.4"; - sha256 = "sha256-hOhWJoiKoeRgkhXaR8rnDpcJpStMD4BBdll4nwSA+EQ="; + sha256 = "sha256-vkxkryi7JQg1L/JdWnO9qmW6Zx6xP5Urq4kXMe7Iiyc="; nativeBuildInputs = [ gobject-introspection @@ -56,6 +57,11 @@ mkXfceDerivation { makeFlags = [ "DBUS_SESSION_SERVICE_DIR=$(out)/etc" ]; + preFixup = '' + # For default wallpaper. + gappsWrapperArgs+=(--prefix XDG_DATA_DIRS : "${xfdesktop}/share") + ''; + meta = with lib; { description = "Screensaver for Xfce"; maintainers = with maintainers; [ symphorien ] ++ teams.xfce.members; diff --git a/pkgs/development/libraries/clutter-gst/default.nix b/pkgs/development/libraries/clutter-gst/default.nix index 11cdf0b4f7fd..3f67e0ab6fb6 100644 --- a/pkgs/development/libraries/clutter-gst/default.nix +++ b/pkgs/development/libraries/clutter-gst/default.nix @@ -11,6 +11,7 @@ gnome, gdk-pixbuf, gobject-introspection, + gst_all_1, }: stdenv.mkDerivation rec { @@ -49,6 +50,8 @@ stdenv.mkDerivation rec { glib cogl gdk-pixbuf + gst_all_1.gstreamer + gst_all_1.gst-plugins-base ]; postBuild = "rm -rf $out/share/gtk-doc"; diff --git a/pkgs/development/python-modules/mlx/default.nix b/pkgs/development/python-modules/mlx/default.nix index ac90ebb89808..aa765f0537a5 100644 --- a/pkgs/development/python-modules/mlx/default.nix +++ b/pkgs/development/python-modules/mlx/default.nix @@ -28,13 +28,13 @@ let in buildPythonPackage rec { pname = "mlx"; - version = "0.18.0"; + version = "0.21.1"; src = fetchFromGitHub { owner = "ml-explore"; repo = "mlx"; rev = "refs/tags/v${version}"; - hash = "sha256-eFKjCrutqrmhZKzRrLq5nYl0ieqLvoXpbnTxA1NEhWo="; + hash = "sha256-wxv9bA9e8VyFv/FMh63sUTTNgkXHGQJNQhLuVynczZA="; }; pyproject = true; @@ -83,6 +83,9 @@ buildPythonPackage rec { changelog = "https://github.com/ml-explore/mlx/releases/tag/v${version}"; license = licenses.mit; platforms = [ "aarch64-darwin" ]; - maintainers = with maintainers; [ viraptor ]; + maintainers = with maintainers; [ + viraptor + Gabriella439 + ]; }; } diff --git a/pkgs/development/python-modules/nanobind/default.nix b/pkgs/development/python-modules/nanobind/default.nix index 3d2005a1c6aa..a01f9a175006 100644 --- a/pkgs/development/python-modules/nanobind/default.nix +++ b/pkgs/development/python-modules/nanobind/default.nix @@ -27,14 +27,14 @@ }: buildPythonPackage rec { pname = "nanobind"; - version = "2.2.0"; + version = "2.4.0"; pyproject = true; src = fetchFromGitHub { owner = "wjakob"; repo = "nanobind"; - rev = "refs/tags/v${version}"; - hash = "sha256-HtZfpMVz/7VMVrFg48IkitK6P3tA+swOeaLLiKguXXk="; + tag = "v${version}"; + hash = "sha256-9OpDsjFEeJGtbti4Q9HHl78XaGf8M3lG4ukvHCMzyMU="; fetchSubmodules = true; }; @@ -85,7 +85,7 @@ buildPythonPackage rec { meta = { homepage = "https://github.com/wjakob/nanobind"; - changelog = "https://github.com/wjakob/nanobind/blob/${src.rev}/docs/changelog.rst"; + changelog = "https://github.com/wjakob/nanobind/blob/${src.tag}/docs/changelog.rst"; description = "Tiny and efficient C++/Python bindings"; longDescription = '' nanobind is a small binding library that exposes C++ types in Python and diff --git a/pkgs/servers/web-apps/freshrss/default.nix b/pkgs/servers/web-apps/freshrss/default.nix index c018b0c505a9..e963b22fa302 100644 --- a/pkgs/servers/web-apps/freshrss/default.nix +++ b/pkgs/servers/web-apps/freshrss/default.nix @@ -8,13 +8,13 @@ stdenvNoCC.mkDerivation rec { pname = "FreshRSS"; - version = "1.24.3"; + version = "1.25.0"; src = fetchFromGitHub { owner = "FreshRSS"; repo = "FreshRSS"; rev = version; - hash = "sha256-JgniYjw+Fk5EaXrXVjelBYBP1JOZarAF07iToiwnkdY="; + hash = "sha256-jBIU8xxXsl/67sebo8MS59Q0dWBTe0tO+xpVf1/uo0c="; }; postPatch = '' diff --git a/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl b/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl index d0f88c4dfdbc..9fa149ffe1e3 100755 --- a/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl +++ b/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl @@ -34,7 +34,7 @@ $pcMap{"uuid"} = "libuuid"; $pcMap{"libudev"} = "udev"; $pcMap{"gl"} = "libGL"; $pcMap{"GL"} = "libGL"; -$pcMap{"gbm"} = "mesa"; +$pcMap{"gbm"} = "libgbm"; $pcMap{"hwdata"} = "hwdata"; $pcMap{"\$PIXMAN"} = "pixman"; $pcMap{"\$RENDERPROTO"} = "xorgproto";