gador/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge staging-next into staging

Browse Source
This commit is contained in:
nixpkgs-ci[bot]
2025-09-15 16:09:34 +00:00
committed by GitHub
parent c535ff15bf d59e32fa62
commit 6ec57b45c7
25 changed files with 537 additions and 49 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ci/eval/compare/default.nix
+8 -2
View File
@@ -110,9 +110,15 @@ let
// lib.mapAttrs' (
kernel: rebuilds: lib.nameValuePair "10.rebuild-${kernel}-stdenv" (lib.elem "stdenv" rebuilds)
) rebuildsByKernel
# Set the "11.by: package-maintainer" label to whether all packages directly
# changed are maintained by the PR's author.
// {
"10.rebuild-nixos-tests" =
lib.elem "nixosTests.simple" (extractPackageNames diffAttrs.rebuilds)
&&
# Only set this label when no other label with indication for staging has been set.
# This avoids confusion whether to target staging or batch this with kernel updates.
lib.last (lib.sort lib.lessThan (lib.attrValues rebuildCountByKernel)) <= 500;
# Set the "11.by: package-maintainer" label to whether all packages directly
# changed are maintained by the PR's author.
"11.by: package-maintainer" =
maintainers ? ${githubAuthorId}
&& lib.all (lib.flip lib.elem maintainers.${githubAuthorId}) (
ci/eval/outpaths.nix
+15 -3
View File
@@ -14,7 +14,8 @@
}:
let
lib = import (path + "/lib");
hydraJobs =
nixpkgsJobs =
import (path + "/pkgs/top-level/release.nix")
# Compromise: accuracy vs. resources needed for evaluation.
{
@@ -59,9 +60,15 @@ let
__allowFileset = false;
};
};
nixosJobs = import (path + "/nixos/release.nix") {
inherit attrNamesOnly;
supportedSystems = if systems == null then [ builtins.currentSystem ] else systems;
};
recurseIntoAttrs = attrs: attrs // { recurseForDerivations = true; };
# hydraJobs leaves recurseForDerivations as empty attrmaps;
# release-lib leaves recurseForDerivations as empty attrmaps;
# that would break nix-env and we also need to recurse everywhere.
tweak = lib.mapAttrs (
name: val:
@@ -87,4 +94,9 @@ let
];
in
tweak (builtins.removeAttrs hydraJobs blacklist)
tweak (
(builtins.removeAttrs nixpkgsJobs blacklist)
// {
nixosTests.simple = nixosJobs.tests.simple;
}
)
doc/redirects.json
+15
View File
@@ -225,6 +225,12 @@
"sec-language-cosmic": [
"index.html#sec-language-cosmic"
],
"sec-meta-identifiers": [
"index.html#sec-meta-identifiers"
],
"sec-meta-identifiers-cpe": [
"index.html#sec-meta-identifiers-cpe"
],
"sec-modify-via-packageOverrides": [
"index.html#sec-modify-via-packageOverrides"
],
@@ -628,6 +634,15 @@
"var-go-buildTestBinaries": [
"index.html#var-go-buildTestBinaries"
],
"var-meta-identifiers-cpe": [
"index.html#var-meta-identifiers-cpe"
],
"var-meta-identifiers-cpeParts": [
"index.html#var-meta-identifiers-cpeParts"
],
"var-meta-identifiers-possibleCPEs": [
"index.html#var-meta-identifiers-possibleCPEs"
],
"var-meta-teams": [
"index.html#var-meta-teams"
],
doc/stdenv/meta.chapter.md
+71
View File
@@ -248,3 +248,74 @@ Code to be executed on a peripheral device or embedded controller, built by a th
### `lib.sourceTypes.binaryBytecode` {#lib.sourceTypes.binaryBytecode}
Code to run on a VM interpreter or JIT compiled into bytecode by a third party. This includes packages which download Java `.jar` files from another source.
## Software identifiers {#sec-meta-identifiers}
Package's `meta.identifiers` attribute specifies information about software identifiers associated with this package. Software identifiers are used, for example:
* to generate Software Bill of Materials (SBOM) that lists all components used to build the software, which can later be used to perform vulnerability or license analysis of the resulting software;
* to lookup software in different vulnerability databases or report new vulnerabilities to them.
Overriding the default `meta.identifiers` attribute is optional, but it is recommended to fill in pieces to help tools mentioned above get precise data.
For example, we could get automatic notifications about potential vulnerabilities for users in the future.
All identifiers specified in `meta.identifiers` are expected to be unambiguous and valid.
`meta.identifiers` contains `v1` attribute which is an attribute set that guarantees backward compatibility of its constituents. Right now it contains copies of all other attributes in `meta.identifiers`.
### CPE {#sec-meta-identifiers-cpe}
Common Platform Enumeration (CPE) is a specification maintained by NIST as part of the Security Content Automation Protocol (SCAP). It is used to identify software in National Vulnerabilities Database (NVD, https://nvd.nist.gov) and other vulnerability databases.
Current version of CPE 2.3 consists of 13 parts:
```
cpe:2.3:a:<vendor>:<product>:<version>:<update>:<edition>:<language>:<sw_edition>:<target_sw>:<target_hw>:<other>
```
Some of them are as follows:
* *CPE version* - current version of CPE is `2.3`
* *part* - usually in Nixpkgs `a` for "application", can also be `o` for "operating system" or `h` for "hardware"
* *vendor* - can point to the source of the package, or to Nixpkgs itself
* *product* - name of the package
* *version* - version of the package
* *update* - name of the latest update, can be a patch version for semantically versioned packages
* *edition* - any additional specification about the version
You can find information about all of these attributes in the [official specification](https://csrc.nist.gov/projects/security-content-automation-protocol/specifications/cpe/naming) (heading 5.3.3, pages 11-13).
Any fields that don't have a value are set to either `-` if the value is not available or `*` when the field can match any value.
For example, for glibc 2.40.1 CPE would be `cpe:2.3:a:gnu:glibc:2.40:1:*:*:*:*:*:*`.
#### `meta.identifiers.cpeParts` {#var-meta-identifiers-cpeParts}
This attribute contains an attribute set of all parts of the CPE for this package. Most of the parts default to `*` (match any value), with some exceptions:
* `part` defaults to `a` (application), can also be set to `o` for operating systems, for example, Linux kernel, or to `h` for hardware
* `vendor` cannot be deduced from other sources, so it must be specified by the package author
* `product` defaults to provided derivation's `pname` attribute and must be provided explicitly if `pname` is missing
* `version` and `update` have no defaults and should be specified explicitly or using helper functions, when missing, `cpe` attribute will be empty, and all possible guesses using helper functions will be in `possibleCPEs` attribute.
It is up to the package author to make sure all parts are correct and match expected values in [NVD dictionary](https://nvd.nist.gov/products/cpe). Unknown values can be skipped, which would leave them with the default value of `*`.
Following functions help with filling out `version` and `update` fields:
* [`lib.meta.cpeFullVersionWithVendor`](#function-library-lib.meta.cpeFullVersionWithVendor)
* [`lib.meta.cpePatchVersionInUpdateWithVendor`](#function-library-lib.meta.cpePatchVersionInUpdateWithVendor)
For many packages to make CPE available it should be enough to specify only:
```nix
{
# ...
meta.identifiers.cpeParts = lib.meta.cpePatchVersionInUpdateWithVendor vendor version;
}
```
#### `meta.identifiers.cpe` {#var-meta-identifiers-cpe}
A readonly attribute that concatenates all CPE parts in one string.
#### `meta.identifiers.possibleCPEs` {#var-meta-identifiers-possibleCPEs}
A readonly attribute containing the list of guesses for what CPE for this package can look like. It includes all variants of version handling mentioned above. Each item is an attrset with attributes `cpeParts` and `cpe` for each guess.
lib/meta.nix
+188 -1
View File
@@ -15,7 +15,12 @@ let
assertMsg
;
inherit (lib.attrsets) mapAttrs' filterAttrs;
inherit (builtins) isString match typeOf;
inherit (builtins)
isString
match
typeOf
elemAt
;
in
rec {
@@ -491,4 +496,186 @@ rec {
assert assertMsg (match ".*/.*" y == null)
"lib.meta.getExe': The second argument \"${y}\" is a nested path with a \"/\" character, but it should just be the name of the executable instead.";
"${getBin x}/bin/${y}";
/**
Generate [CPE parts](#var-meta-identifiers-cpeParts) from inputs. Copies `vendor` and `version` to the output, and sets `update` to `*`.
# Inputs
`vendor`
: package's vendor
`version`
: package's version
# Type
```
cpeFullVersionWithVendor :: string -> string -> AttrSet
```
# Examples
:::{.example}
## `lib.meta.cpeFullVersionWithVendor` usage example
```nix
lib.meta.cpeFullVersionWithVendor "gnu" "1.2.3"
=> {
vendor = "gnu";
version = "1.2.3";
update = "*";
}
```
:::
:::{.example}
## `lib.meta.cpeFullVersionWithVendor` usage in derivations
```nix
mkDerivation rec {
version = "1.2.3";
# ...
meta = {
# ...
identifiers.cpeParts = lib.meta.cpeFullVersionWithVendor "gnu" version;
};
}
```
:::
*/
cpeFullVersionWithVendor = vendor: version: {
inherit vendor version;
update = "*";
};
/**
Alternate version of [`lib.meta.cpePatchVersionInUpdateWithVendor`](#function-library-lib.meta.cpePatchVersionInUpdateWithVendor).
If `cpePatchVersionInUpdateWithVendor` succeeds, returns an attribute set with `success` set to `true` and `value` set to the result.
Otherwise, `success` is set to `false` and `error` is set to the string representation of the error.
# Inputs
`vendor`
: package's vendor
`version`
: package's version
# Type
```
tryCPEPatchVersionInUpdateWithVendor :: string -> string -> AttrSet
```
# Examples
:::{.example}
## `lib.meta.tryCPEPatchVersionInUpdateWithVendor` usage example
```nix
lib.meta.tryCPEPatchVersionInUpdateWithVendor "gnu" "1.2.3"
=> {
success = true;
value = {
vendor = "gnu";
version = "1.2";
update = "3";
};
}
```
:::
:::{.example}
## `lib.meta.cpePatchVersionInUpdateWithVendor` error example
```nix
lib.meta.tryCPEPatchVersionInUpdateWithVendor "gnu" "5.3p0"
=> {
success = false;
error = "version 5.3p0 doesn't match regex `([0-9]+\\.[0-9]+)\\.([0-9]+)`";
}
```
:::
*/
tryCPEPatchVersionInUpdateWithVendor =
vendor: version:
let
regex = "([0-9]+\\.[0-9]+)\\.([0-9]+)";
# we have to call toString here in case version is an attrset with __toString attribute
versionMatch = builtins.match regex (toString version);
in
if versionMatch == null then
{
success = false;
error = "version ${version} doesn't match regex `${regex}`";
}
else
{
success = true;
value = {
inherit vendor;
version = elemAt versionMatch 0;
update = elemAt versionMatch 1;
};
};
/**
Generate [CPE parts](#var-meta-identifiers-cpeParts) from inputs. Copies `vendor` to the result. When `version` matches `X.Y.Z` where all parts are numerical, sets `version` and `update` fields to `X.Y` and `Z`. Throws an error if the version doesn't match the expected template.
# Inputs
`vendor`
: package's vendor
`version`
: package's version
# Type
```
cpePatchVersionInUpdateWithVendor :: string -> string -> AttrSet
```
# Examples
:::{.example}
## `lib.meta.cpePatchVersionInUpdateWithVendor` usage example
```nix
lib.meta.cpePatchVersionInUpdateWithVendor "gnu" "1.2.3"
=> {
vendor = "gnu";
version = "1.2";
update = "3";
}
```
:::
:::{.example}
## `lib.meta.cpePatchVersionInUpdateWithVendor` usage in derivations
```nix
mkDerivation rec {
version = "1.2.3";
# ...
meta = {
# ...
identifiers.cpeParts = lib.meta.cpePatchVersionInUpdateWithVendor "gnu" version;
};
}
```
:::
*/
cpePatchVersionInUpdateWithVendor =
vendor: version:
let
result = tryCPEPatchVersionInUpdateWithVendor vendor version;
in
if result.success then result.value else throw result.error;
}
nixos/modules/services/matrix/conduit.nix
+24 -1
View File
@@ -11,7 +11,10 @@ let
configFile = format.generate "conduit.toml" cfg.settings;
in
{
meta.maintainers = with lib.maintainers; [ pstn ];
meta.maintainers = with lib.maintainers; [
pstn
SchweGELBin
];
options.services.matrix-conduit = {
enable = lib.mkEnableOption "matrix-conduit";
@@ -26,6 +29,22 @@ in
package = lib.mkPackageOption pkgs "matrix-conduit" { };
secretFile = lib.mkOption {
type = lib.types.nullOr lib.types.path;
default = null;
example = "/run/secrets/matrix-conduit.env";
description = ''
Path to a file containing sensitive environment as described in {manpage}`systemd.exec(5).
Some variables that can be considered secrets are:
- CONDUIT_JWT_SECRET:
The secret used to enable JWT login. Without it a 400 error will be returned.
- CONDUIT_TURN_SECRET:
The TURN secret
'';
};
settings = lib.mkOption {
type = lib.types.submodule {
freeformType = format.type;
@@ -112,6 +131,7 @@ in
<https://docs.conduit.rs/configuration.html>
for details on supported values.
Note that database_path can not be edited because the service's reliance on systemd StateDir.
For secrets use the `secretFile` option instead.
'';
};
};
@@ -158,6 +178,9 @@ in
Restart = "on-failure";
RestartSec = 10;
UMask = "077";
}
// lib.optionalAttrs (cfg.secretFile != null) {
EnvironmentFile = cfg.secretFile;
};
unitConfig = {
StartLimitBurst = 5;
nixos/release.nix
+29 -7
View File
@@ -12,6 +12,16 @@ with import ../lib;
"aarch64-linux"
],
configuration ? { },
# This flag, if set to true, causes the resulting tree of attributes
# to *not* have a ".${system}" suffixed upon every job name like Hydra
# expects. So far, this is only implemented for `tests`.
#
# This flag exists mainly for use by ci/eval/attrpaths.nix; see
# that file for full details. The exact behavior of this flag
# may change; it should be considered an internal implementation
# detail of ci/eval.
attrNamesOnly ? false,
}:
with import ../pkgs/top-level/release-lib.nix { inherit supportedSystems; };
@@ -31,9 +41,14 @@ let
import ./tests/all-tests.nix {
inherit system;
pkgs = import ./.. { inherit system; };
callTest = config: {
${system} = hydraJob config.test;
};
callTest =
config:
if attrNamesOnly then
hydraJob config.test
else
{
${system} = hydraJob config.test;
};
}
// {
# for typechecking of the scripts and evaluation of
@@ -41,13 +56,20 @@ let
allDrivers = import ./tests/all-tests.nix {
inherit system;
pkgs = import ./.. { inherit system; };
callTest = config: {
${system} = hydraJob config.driver;
};
callTest =
config:
if attrNamesOnly then
hydraJob config.test
else
{
${system} = hydraJob config.driver;
};
};
};
allTests = foldAttrs recursiveUpdate { } (map allTestsForSystem supportedSystems);
allTests = foldAttrs recursiveUpdate { } (
map allTestsForSystem (if attrNamesOnly then [ (head supportedSystems) ] else supportedSystems)
);
pkgs = import ./.. { system = "x86_64-linux"; };
nixos/tests/simple.nix
+1 -9
View File
@@ -1,15 +1,7 @@
{ pkgs, ... }:
{
name = "simple";
meta = with pkgs.lib.maintainers; {
maintainers = [ ];
};
nodes.machine =
{ ... }:
{
imports = [ ../modules/profiles/minimal.nix ];
};
nodes.machine = { };
testScript = ''
start_all()
pkgs/applications/networking/sync/rsync/default.nix
+5
View File
@@ -98,5 +98,10 @@ stdenv.mkDerivation rec {
ivan
];
platforms = platforms.unix;
identifiers.cpeParts = {
vendor = "samba";
inherit version;
update = "-";
};
};
}
pkgs/by-name/bc/bchunk/package.nix
+11 -6
View File
@@ -1,16 +1,19 @@
{
lib,
stdenv,
fetchurl,
fetchFromGitHub,
nix-update-script,
}:
stdenv.mkDerivation rec {
stdenv.mkDerivation (finalAttrs: {
pname = "bchunk";
version = "1.2.2";
src = fetchurl {
url = "http://he.fi/bchunk/${pname}-${version}.tar.gz";
sha256 = "12dxx98kbpc5z4dgni25280088bhlsb677rp832r82zzc1drpng7";
src = fetchFromGitHub {
owner = "hessu";
repo = "bchunk";
tag = "release/${finalAttrs.version}";
hash = "sha256-wFhBRLRwyC7FrGzadbssqLI9/UwfxBmFfOetaFJgsCo=";
};
makeFlags = lib.optionals stdenv.cc.isClang [
@@ -23,6 +26,8 @@ stdenv.mkDerivation rec {
install -Dt $out/share/man/man1 bchunk.1
'';
passthru.updateScript = nix-update-script { };
meta = with lib; {
homepage = "http://he.fi/bchunk/";
description = "Program that converts CD images in BIN/CUE format into a set of ISO and CDR tracks";
@@ -30,4 +35,4 @@ stdenv.mkDerivation rec {
license = licenses.gpl2Plus;
mainProgram = "bchunk";
};
}
})
pkgs/by-name/bo/bootdev-cli/package.nix
+2 -2
View File
@@ -11,13 +11,13 @@
buildGoModule rec {
pname = "bootdev-cli";
version = "1.20.2";
version = "1.20.3";
src = fetchFromGitHub {
owner = "bootdotdev";
repo = "bootdev";
tag = "v${version}";
hash = "sha256-TjldTmLX6H0k5mvq0SXoEuoFVxcmg+hMIXpCIVk1m3g=";
hash = "sha256-vjWlD31NCWCtcmhwh+DCjXZHE12VZxj+PdIQx/A6tOY=";
};
vendorHash = "sha256-jhRoPXgfntDauInD+F7koCaJlX4XDj+jQSe/uEEYIMM=";
pkgs/by-name/ha/hamrs-pro/package.nix
+5 -5
View File
@@ -8,29 +8,29 @@
let
pname = "hamrs-pro";
version = "2.43.0";
version = "2.44.0";
throwSystem = throw "Unsupported system: ${stdenvNoCC.hostPlatform.system}";
srcs = {
x86_64-linux = fetchurl {
url = "https://hamrs-dist.s3.amazonaws.com/hamrs-pro-${version}-linux-x86_64.AppImage";
hash = "sha256-R+yUCqhnFq6ffU0sbearFJ+nsyfrzVnbw/vKV2li8sk=";
hash = "sha256-JDJxiOYgSHEBT0cyTlD/lalI4cQIODK06eaI+iVRDCI=";
};
aarch64-linux = fetchurl {
url = "https://hamrs-dist.s3.amazonaws.com/hamrs-pro-${version}-linux-arm64.AppImage";
hash = "sha256-nsZbebiYqAd8By+o3+DgJ51mPAuPzQqRsjxXpWPTgW8=";
hash = "sha256-umm+PEBcY1zVlxG0z585+PxW5gHuGxEtfj8zzIYwgAQ=";
};
x86_64-darwin = fetchurl {
url = "https://hamrs-dist.s3.amazonaws.com/hamrs-pro-${version}-mac-x64.dmg";
hash = "sha256-G2vCdgs8wGsZ5EHeO8CI/BtyxvbBAvHTzqbn7InxEAU=";
hash = "sha256-DN2Alc2dMeNyr0VtXzwd4BamtZev+gHBesf5ohM5wm0=";
};
aarch64-darwin = fetchurl {
url = "https://hamrs-dist.s3.amazonaws.com/hamrs-pro-${version}-mac-arm64.dmg";
hash = "sha256-CnAbgGsgJCLcKH7HizOncI52G6kn8+FEMhWZR8FPMBc=";
hash = "sha256-JE1F6qHOmGGcfq6lNpiBr6hoK0UPy5S/VzOjhvsjgp4=";
};
};
pkgs/by-name/he/hello/package.nix
+1
View File
@@ -55,5 +55,6 @@ stdenv.mkDerivation (finalAttrs: {
maintainers = with lib.maintainers; [ stv0g ];
mainProgram = "hello";
platforms = lib.platforms.all;
identifiers.cpeParts.vendor = "gnu";
};
})
pkgs/by-name/le/lean4/package.nix
+2 -2
View File
@@ -15,7 +15,7 @@
stdenv.mkDerivation (finalAttrs: {
pname = "lean4";
version = "4.22.0";
version = "4.23.0";
# Using a vendored version rather than nixpkgs' version to match the exact version required by
# Lean. Apparently, even a slight version change can impact greatly the final performance.
@@ -30,7 +30,7 @@ stdenv.mkDerivation (finalAttrs: {
owner = "leanprover";
repo = "lean4";
tag = "v${finalAttrs.version}";
hash = "sha256-dRS7ZaC/ipIEneheSoTkKkJ5PFeDnLNt8uUknu1lEHA=";
hash = "sha256-wcB3HxSNukIOttjrfvDQB5IkmhYG9w/UMeOfCQ1+lvo=";
};
postPatch =
pkgs/by-name/mc/mcp-grafana/package.nix
+2 -2
View File
@@ -6,13 +6,13 @@
buildGoModule (finalAttrs: {
pname = "mcp-grafana";
version = "0.6.4";
version = "0.6.5";
src = fetchFromGitHub {
owner = "grafana";
repo = "mcp-grafana";
tag = "v${finalAttrs.version}";
hash = "sha256-bku8vbNjIggaVzhTXZYBgT7TcI9tAUUUrCjl+cSN9OU=";
hash = "sha256-dzAAStlzY5dF2Y86rLJY+wek1BcHqWNmQo0KTiMjxN8=";
};
vendorHash = "sha256-42UHI5Z5bgnW40DsRPzoKQdZQ+k785K60gWMp5ehLfU=";
pkgs/by-name/pr/prometheus-opnsense-exporter/package.nix
+2 -2
View File
@@ -6,13 +6,13 @@
}:
buildGoModule (finalAttrs: {
pname = "prometheus-opnsense-exporter";
version = "0.0.10";
version = "0.0.11";
src = fetchFromGitHub {
owner = "athennamind";
repo = "opnsense-exporter";
tag = "v${finalAttrs.version}";
hash = "sha256-U/F301HkRfmzB8czwHP9u5UajR9CvxhSZwrJSIwcRd4=";
hash = "sha256-j16ATUeFqPiPElUqCPwylcujN/qiD9GrrBOXelAbgNs=";
};
ldflags = [
pkgs/development/compilers/gcc/common/meta.nix
+1
View File
@@ -30,4 +30,5 @@ in
teams = [ teams.gcc ];
mainProgram = "${targetPrefix}gcc";
identifiers.cpeParts.vendor = "gnu";
}
pkgs/development/compilers/gcc/default.nix
+1
View File
@@ -421,6 +421,7 @@ pipe
platforms
teams
mainProgram
identifiers
;
};
}
pkgs/development/compilers/llvm/common/common-let.nix
+2
View File
@@ -34,6 +34,8 @@ rec {
++ lib.platforms.riscv
++ lib.platforms.m68k
++ lib.platforms.loongarch64;
identifiers.cpeParts.vendor = "llvm";
};
releaseInfo =
pkgs/development/python-modules/dynaconf/default.nix
+5
View File
@@ -59,6 +59,11 @@ buildPythonPackage rec {
versionCheckHook
];
disabledTests = [
# AssertionError: assert 42.1 == 'From development env'
"test_envless_load_file"
];
disabledTestPaths = [
# import file mismatch
# imported module 'app_test' has this __file__ attribute:
pkgs/development/python-modules/ncclient/default.nix
+12 -7
View File
@@ -6,7 +6,6 @@
paramiko,
setuptools,
pytestCheckHook,
pythonOlder,
}:
buildPythonPackage rec {
@@ -14,13 +13,19 @@ buildPythonPackage rec {
version = "0.7.0";
pyproject = true;
disabled = pythonOlder "3.7";
src = fetchFromGitHub {
owner = "ncclient";
repo = "ncclient";
tag = "v${version}";
hash = "sha256-GSa7UkBwbwggFqwNFTg2KNqGV5412EE41ma/dzPIEuU=";
# Upstream uses .gitattributes to inject information about the revision
# hash and the refname into `ncclient/_version.py`, see:
#
# - https://git-scm.com/docs/gitattributes#_export_subst and
# - https://github.com/ncclient/ncclient/blob/e056e38af2843de0608da58e2f4662465c96d587/ncclient/_version.py#L25-L28
postFetch = ''
sed -i 's/git_refnames = "[^"]*"/git_refnames = " (tag: ${src.tag})"/' $out/ncclient/_version.py
'';
hash = "sha256-vSX+9nTl4r6vnP/vmavdmdChzOC8P2G093/DQNMQwS4=";
};
build-system = [
@@ -36,11 +41,11 @@ buildPythonPackage rec {
pythonImportsCheck = [ "ncclient" ];
meta = with lib; {
meta = {
description = "Python library for NETCONF clients";
homepage = "https://github.com/ncclient/ncclient";
changelog = "https://github.com/ncclient/ncclient/releases/tag/${src.tag}";
license = licenses.asl20;
maintainers = with maintainers; [ xnaveira ];
license = lib.licenses.asl20;
maintainers = with lib.maintainers; [ xnaveira ];
};
}
pkgs/os-specific/linux/kernel/manual-config.nix
+7
View File
@@ -546,6 +546,13 @@ lib.makeOverridable (
]
++ lib.optional (lib.versionOlder version "5.19") "loongarch64-linux";
timeout = 14400; # 4 hours
identifiers.cpeParts = {
part = "o";
vendor = "linux";
product = "linux_kernel";
inherit version;
update = "*";
};
}
// extraMeta;
};
pkgs/shells/bash/5.nix
+10
View File
@@ -183,5 +183,15 @@ lib.warnIf (withDocs != null)
badPlatforms = [ lib.systems.inspect.patterns.isMinGW ];
maintainers = [ ];
mainProgram = "bash";
identifiers.cpeParts =
let
versionSplit = lib.split "p" version;
in
{
vendor = "gnu";
product = "bash";
version = lib.elemAt versionSplit 0;
update = lib.elemAt versionSplit 2;
};
};
}
pkgs/stdenv/generic/check-meta.nix
+85
View File
@@ -11,6 +11,7 @@ let
inherit (lib)
all
attrNames
attrValues
concatMapStrings
concatMapStringsSep
concatStrings
@@ -37,6 +38,8 @@ let
inherit (lib.meta)
availableOn
cpeFullVersionWithVendor
tryCPEPatchVersionInUpdateWithVendor
;
inherit (lib.generators)
@@ -438,6 +441,8 @@ let
# Used for the original location of the maintainer and team attributes to assist with pings.
maintainersPosition = any;
teamsPosition = any;
identifiers = attrs;
};
checkMetaAttr =
@@ -571,6 +576,36 @@ let
else
validYes;
# Helper functions and declarations to handle identifiers, extracted to reduce allocations
hasAllCPEParts =
cpeParts:
let
values = attrValues cpeParts;
in
(length values == 11) && !any isNull values;
makeCPE =
{
part,
vendor,
product,
version,
update,
edition,
sw_edition,
target_sw,
target_hw,
language,
other,
}:
"cpe:2.3:${part}:${vendor}:${product}:${version}:${update}:${edition}:${sw_edition}:${target_sw}:${target_hw}:${language}:${other}";
possibleCPEPartsFuns = [
(vendor: version: {
success = true;
value = cpeFullVersionWithVendor vendor version;
})
tryCPEPatchVersionInUpdateWithVendor
];
# The meta attribute is passed in the resulting attribute set,
# but it's not part of the actual derivation, i.e., it's not
# passed to the builder and is not a dependency. But since we
@@ -635,6 +670,56 @@ let
maintainers =
attrs.meta.maintainers or [ ] ++ concatMap (team: team.members or [ ]) attrs.meta.teams or [ ];
identifiers =
let
# nix-env writes a warning for each derivation that has null in its meta values, so
# fields without known values are removed from the result
defaultCPEParts = {
part = "a";
#vendor = null;
${if attrs ? pname then "product" else null} = attrs.pname;
#version = null;
#update = null;
edition = "*";
sw_edition = "*";
target_sw = "*";
target_hw = "*";
language = "*";
other = "*";
};
cpeParts = defaultCPEParts // attrs.meta.identifiers.cpeParts or { };
cpe = if hasAllCPEParts cpeParts then makeCPE cpeParts else null;
possibleCPEs =
if cpe != null then
[ { inherit cpeParts cpe; } ]
else if attrs.meta.identifiers.cpeParts.vendor or null == null || attrs.version or null == null then
[ ]
else
concatMap (
f:
let
result = f attrs.meta.identifiers.cpeParts.vendor attrs.version;
# Note that attrs.meta.identifiers.cpeParts at this point can include defaults with user overrides.
# Since we can't split them apart, user overrides don't apply to possibleCPEs.
guessedParts = cpeParts // result.value;
in
optional (result.success && hasAllCPEParts guessedParts) {
cpeParts = guessedParts;
cpe = makeCPE guessedParts;
}
) possibleCPEPartsFuns;
v1 = {
inherit cpeParts possibleCPEs;
${if cpe != null then "cpe" else null} = cpe;
};
in
v1
// {
inherit v1;
};
# Expose the result of the checks for everyone to see.
unfree = hasUnfreeLicense attrs;
broken = isMarkedBroken attrs;
pkgs/tools/package-management/lix/default.nix
+33
View File
@@ -11,6 +11,7 @@
fetchFromGitHub,
fetchFromGitea,
fetchpatch2,
fetchpatch,
rustPlatform,
editline,
ncurses,
@@ -167,6 +168,38 @@ lib.makeExtensible (
url = "https://git.lix.systems/lix-project/lix/commit/858de5f47a1bfd33835ec97794ece339a88490f1.patch";
hash = "sha256-FfLO2dFSWV1qwcupIg8dYEhCHir2XX6/Hs89eLwd+SY=";
})
# Support for toml11 >= 4.0, https://gerrit.lix.systems/c/lix/+/3953
(fetchpatch {
name = "lix-2.93-toml11-4-1.patch";
url = "https://git.lix.systems/lix-project/lix/commit/96a39dc464165a3e503a6dc7bd44518a116fe846.patch";
hash = "sha256-j1DOScY2IFvcouhoap9CQwIZf99MZ92HtY7CjInF/s4=";
})
(fetchpatch {
name = "lix-2.93-toml11-4-2.patch";
url = "https://git.lix.systems/lix-project/lix/commit/699d3a63a6351edfdbc8c05f814cc93d6c3637ca.patch";
hash = "sha256-2iUynAdimxhe5ZSDB7DlzFG3tu1yWhq+lTvjf6+M0pM=";
})
(fetchpatch {
name = "lix-2.93-toml11-4-3.patch";
url = "https://git.lix.systems/lix-project/lix/commit/ad52cbde2faa677b711ec950dae74e4aede965a4.patch";
hash = "sha256-ajQwafL3yZDJMVrR+D9eTGh7L0xbDbqhAUagRur4HDE=";
})
(fetchpatch {
name = "lix-2.93-toml11-4-4.patch";
url = "https://git.lix.systems/lix-project/lix/commit/e29a1ccf0af2e2890ec7b7fde82f0e53a1d0aad9.patch";
hash = "sha256-sXqZxCUtZsO7uEVk2AZx3IkP8b8EPVghYboetcQTp2A=";
})
(fetchpatch {
name = "lix-2.93-toml11-4-5.patch";
url = "https://git.lix.systems/lix-project/lix/commit/176b834464b7285b74a72d35df7470a46362ce60.patch";
hash = "sha256-/KIszfHf2XoB+GeVvXad2AV8pazffYdQRDtIXb9tbj8=";
})
(fetchpatch {
name = "lix-2.93-toml11-4-6.patch";
url = "https://git.lix.systems/lix-project/lix/commit/b6d5670bcffebdd43352ea79b36135e35a8148d9.patch";
hash = "sha256-f4s0TR5MhNMNM5TYLOR7K2/1rtZ389KDjTCKFVK0OcE=";
})
];
};
};