From c106c288587b7adb62b303ad5e107e5ee9af4065 Mon Sep 17 00:00:00 2001 From: SchweGELBin Date: Fri, 8 Aug 2025 14:56:20 +0200 Subject: [PATCH 01/19] nixos/matrix-conduit: add secretFile option --- nixos/modules/services/matrix/conduit.nix | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/nixos/modules/services/matrix/conduit.nix b/nixos/modules/services/matrix/conduit.nix index 18b86de86e55..ea699393ede6 100644 --- a/nixos/modules/services/matrix/conduit.nix +++ b/nixos/modules/services/matrix/conduit.nix @@ -26,6 +26,22 @@ in package = lib.mkPackageOption pkgs "matrix-conduit" { }; + secretFile = lib.mkOption { + type = lib.types.nullOr lib.types.path; + default = null; + example = "/run/secrets/matrix-conduit.env"; + description = '' + Path to file containing sensitive environment variables. + Some variables that can be considered secrets are: + + - CONDUIT_JWT_SECRET: + The secret used in the JWT to enable JWT login without it a 400 error will be returned + + - CONDUIT_TURN_SECRET: + The TURN secret + ''; + }; + settings = lib.mkOption { type = lib.types.submodule { freeformType = format.type; @@ -112,6 +128,7 @@ in for details on supported values. Note that database_path can not be edited because the service's reliance on systemd StateDir. + For secrets use secretFile option instead. ''; }; }; @@ -158,6 +175,9 @@ in Restart = "on-failure"; RestartSec = 10; UMask = "077"; + } + // lib.optionalAttrs (cfg.secretFile != null) { + EnvironmentFile = cfg.secretFile; }; unitConfig = { StartLimitBurst = 5; From b07bdd00d2e7dd0a5eb682ae31424200c66fd3d0 Mon Sep 17 00:00:00 2001 From: SchweGELBin Date: Fri, 8 Aug 2025 14:57:20 +0200 Subject: [PATCH 02/19] nixos/matrix-conduit: add SchweGELBin as maintainer --- nixos/modules/services/matrix/conduit.nix | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/nixos/modules/services/matrix/conduit.nix b/nixos/modules/services/matrix/conduit.nix index ea699393ede6..3e8bb1e9d396 100644 --- a/nixos/modules/services/matrix/conduit.nix +++ b/nixos/modules/services/matrix/conduit.nix @@ -11,7 +11,10 @@ let configFile = format.generate "conduit.toml" cfg.settings; in { - meta.maintainers = with lib.maintainers; [ pstn ]; + meta.maintainers = with lib.maintainers; [ + pstn + SchweGELBin + ]; options.services.matrix-conduit = { enable = lib.mkEnableOption "matrix-conduit"; From 72c53ee013dd93f455a9e2a0511ee54d547f3474 Mon Sep 17 00:00:00 2001 From: SchweGELBin Date: Mon, 18 Aug 2025 19:00:49 +0200 Subject: [PATCH 03/19] nixos/matrix-conduit: improve documentation Co-authored-by: Sandro --- nixos/modules/services/matrix/conduit.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/nixos/modules/services/matrix/conduit.nix b/nixos/modules/services/matrix/conduit.nix index 3e8bb1e9d396..8cce1db5c9d0 100644 --- a/nixos/modules/services/matrix/conduit.nix +++ b/nixos/modules/services/matrix/conduit.nix @@ -34,11 +34,11 @@ in default = null; example = "/run/secrets/matrix-conduit.env"; description = '' - Path to file containing sensitive environment variables. + Path to a file containing sensitive environment as described in {manpage}`systemd.exec(5). Some variables that can be considered secrets are: - CONDUIT_JWT_SECRET: - The secret used in the JWT to enable JWT login without it a 400 error will be returned + The secret used to enable JWT login. Without it a 400 error will be returned. - CONDUIT_TURN_SECRET: The TURN secret @@ -131,7 +131,7 @@ in for details on supported values. Note that database_path can not be edited because the service's reliance on systemd StateDir. - For secrets use secretFile option instead. + For secrets use the `secretFile` option instead. ''; }; }; From 50024894dd108d1144ad49acace4f15e1c63f99e Mon Sep 17 00:00:00 2001 From: jopejoe1 Date: Mon, 18 Aug 2025 09:44:31 +0200 Subject: [PATCH 04/19] bchunk: switch from fetchurl to fetchFromGitHub --- pkgs/by-name/bc/bchunk/package.nix | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/pkgs/by-name/bc/bchunk/package.nix b/pkgs/by-name/bc/bchunk/package.nix index 02792a1b2355..9568f62898e7 100644 --- a/pkgs/by-name/bc/bchunk/package.nix +++ b/pkgs/by-name/bc/bchunk/package.nix @@ -1,16 +1,18 @@ { lib, stdenv, - fetchurl, + fetchFromGitHub, }: -stdenv.mkDerivation rec { +stdenv.mkDerivation (finalAttrs: { pname = "bchunk"; version = "1.2.2"; - src = fetchurl { - url = "http://he.fi/bchunk/${pname}-${version}.tar.gz"; - sha256 = "12dxx98kbpc5z4dgni25280088bhlsb677rp832r82zzc1drpng7"; + src = fetchFromGitHub { + owner = "hessu"; + repo = "bchunk"; + tag = "release/${finalAttrs.version}"; + hash = "sha256-wFhBRLRwyC7FrGzadbssqLI9/UwfxBmFfOetaFJgsCo="; }; makeFlags = lib.optionals stdenv.cc.isClang [ @@ -30,4 +32,4 @@ stdenv.mkDerivation rec { license = licenses.gpl2Plus; mainProgram = "bchunk"; }; -} +}) From e3f583c5bf44c1bf8f62ae2e2dae2b65e7ca0500 Mon Sep 17 00:00:00 2001 From: Wolfgang Walther Date: Mon, 1 Sep 2025 18:27:43 +0200 Subject: [PATCH 05/19] ci/eval: eval nixosTests.simple We can't eval all nixos tests, this would be way too expensive. But we can evaluate `nixosTests.simple` as an indication whether the nixos test driver has changed. If that's the case, this means that *all* NixOS tests need to be rebuilt. --- ci/eval/outpaths.nix | 18 +++++++++++++++--- nixos/release.nix | 36 +++++++++++++++++++++++++++++------- 2 files changed, 44 insertions(+), 10 deletions(-) diff --git a/ci/eval/outpaths.nix b/ci/eval/outpaths.nix index 4efe8d1dc061..b4988e844e8e 100644 --- a/ci/eval/outpaths.nix +++ b/ci/eval/outpaths.nix @@ -14,7 +14,8 @@ }: let lib = import (path + "/lib"); - hydraJobs = + + nixpkgsJobs = import (path + "/pkgs/top-level/release.nix") # Compromise: accuracy vs. resources needed for evaluation. { @@ -59,9 +60,15 @@ let __allowFileset = false; }; }; + + nixosJobs = import (path + "/nixos/release.nix") { + inherit attrNamesOnly; + supportedSystems = if systems == null then [ builtins.currentSystem ] else systems; + }; + recurseIntoAttrs = attrs: attrs // { recurseForDerivations = true; }; - # hydraJobs leaves recurseForDerivations as empty attrmaps; + # release-lib leaves recurseForDerivations as empty attrmaps; # that would break nix-env and we also need to recurse everywhere. tweak = lib.mapAttrs ( name: val: @@ -87,4 +94,9 @@ let ]; in -tweak (builtins.removeAttrs hydraJobs blacklist) +tweak ( + (builtins.removeAttrs nixpkgsJobs blacklist) + // { + nixosTests.simple = nixosJobs.tests.simple; + } +) diff --git a/nixos/release.nix b/nixos/release.nix index 207d76704b5e..c4a9be293743 100644 --- a/nixos/release.nix +++ b/nixos/release.nix @@ -12,6 +12,16 @@ with import ../lib; "aarch64-linux" ], configuration ? { }, + + # This flag, if set to true, causes the resulting tree of attributes + # to *not* have a ".${system}" suffixed upon every job name like Hydra + # expects. So far, this is only implemented for `tests`. + # + # This flag exists mainly for use by ci/eval/attrpaths.nix; see + # that file for full details. The exact behavior of this flag + # may change; it should be considered an internal implementation + # detail of ci/eval. + attrNamesOnly ? false, }: with import ../pkgs/top-level/release-lib.nix { inherit supportedSystems; }; @@ -31,9 +41,14 @@ let import ./tests/all-tests.nix { inherit system; pkgs = import ./.. { inherit system; }; - callTest = config: { - ${system} = hydraJob config.test; - }; + callTest = + config: + if attrNamesOnly then + hydraJob config.test + else + { + ${system} = hydraJob config.test; + }; } // { # for typechecking of the scripts and evaluation of @@ -41,13 +56,20 @@ let allDrivers = import ./tests/all-tests.nix { inherit system; pkgs = import ./.. { inherit system; }; - callTest = config: { - ${system} = hydraJob config.driver; - }; + callTest = + config: + if attrNamesOnly then + hydraJob config.test + else + { + ${system} = hydraJob config.driver; + }; }; }; - allTests = foldAttrs recursiveUpdate { } (map allTestsForSystem supportedSystems); + allTests = foldAttrs recursiveUpdate { } ( + map allTestsForSystem (if attrNamesOnly then [ (head supportedSystems) ] else supportedSystems) + ); pkgs = import ./.. { system = "x86_64-linux"; }; From 63e6fc4c4324cb39bd60216cda658e4650add631 Mon Sep 17 00:00:00 2001 From: Wolfgang Walther Date: Mon, 1 Sep 2025 18:35:39 +0200 Subject: [PATCH 06/19] ci/eval/compare: add 10.rebuild-nixos-tests label This indicates that the NixOS test-driver changed and all NixOS tests have to be rebuilt. It can be used to either re-target to staging or to batch this with other similar changes, at least. --- ci/eval/compare/default.nix | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/ci/eval/compare/default.nix b/ci/eval/compare/default.nix index f5c1b1b1dab0..841a3ca8e6d5 100644 --- a/ci/eval/compare/default.nix +++ b/ci/eval/compare/default.nix @@ -103,9 +103,15 @@ let // lib.mapAttrs' ( kernel: rebuilds: lib.nameValuePair "10.rebuild-${kernel}-stdenv" (lib.elem "stdenv" rebuilds) ) rebuildsByKernel - # Set the "11.by: package-maintainer" label to whether all packages directly - # changed are maintained by the PR's author. // { + "10.rebuild-nixos-tests" = + lib.elem "nixosTests.simple" (extractPackageNames diffAttrs.rebuilds) + && + # Only set this label when no other label with indication for staging has been set. + # This avoids confusion whether to target staging or batch this with kernel updates. + lib.last (lib.sort lib.lessThan (lib.attrValues rebuildCountByKernel)) <= 500; + # Set the "11.by: package-maintainer" label to whether all packages directly + # changed are maintained by the PR's author. "11.by: package-maintainer" = maintainers ? ${githubAuthorId} && lib.all (lib.flip lib.elem maintainers.${githubAuthorId}) ( From 6d90bae447d390a76c997407783cc9b249236df6 Mon Sep 17 00:00:00 2001 From: Wolfgang Walther Date: Wed, 3 Sep 2025 18:43:08 +0200 Subject: [PATCH 07/19] nixosTests.simple: drop minimal profile This should be a test that will change whenever most likely *all* NixOS tests change. As such it should use the most "default" configuration possible. This decreases chances of a change that will affect almost other NixOS tests to go unnoticed by this test. With the minimal profile used previously, there could be changes made to the default behavior of NixOS modules which were explicitly disabled in this profile. These would not change the simple test, but would change all other tests. Removing as many moving parts as possible from this test should make it the most default it can be. It now contains only pieces that every other NixOS test has, too: A name, a machine and a testScript. But nothing fancy. --- nixos/tests/simple.nix | 10 +--------- 1 file changed, 1 insertion(+), 9 deletions(-) diff --git a/nixos/tests/simple.nix b/nixos/tests/simple.nix index 3695f3ff9038..f9b9db05302b 100644 --- a/nixos/tests/simple.nix +++ b/nixos/tests/simple.nix @@ -1,15 +1,7 @@ -{ pkgs, ... }: { name = "simple"; - meta = with pkgs.lib.maintainers; { - maintainers = [ ]; - }; - nodes.machine = - { ... }: - { - imports = [ ../modules/profiles/minimal.nix ]; - }; + nodes.machine = { }; testScript = '' start_all() From e8d5974921c763b81a657783f99e0970203ee2a7 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Sun, 14 Sep 2025 20:36:12 +0000 Subject: [PATCH 08/19] hamrs-pro: 2.43.0 -> 2.44.0 --- pkgs/by-name/ha/hamrs-pro/package.nix | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/pkgs/by-name/ha/hamrs-pro/package.nix b/pkgs/by-name/ha/hamrs-pro/package.nix index fdc251292e59..a4d11dacc0a9 100644 --- a/pkgs/by-name/ha/hamrs-pro/package.nix +++ b/pkgs/by-name/ha/hamrs-pro/package.nix @@ -8,29 +8,29 @@ let pname = "hamrs-pro"; - version = "2.43.0"; + version = "2.44.0"; throwSystem = throw "Unsupported system: ${stdenvNoCC.hostPlatform.system}"; srcs = { x86_64-linux = fetchurl { url = "https://hamrs-dist.s3.amazonaws.com/hamrs-pro-${version}-linux-x86_64.AppImage"; - hash = "sha256-R+yUCqhnFq6ffU0sbearFJ+nsyfrzVnbw/vKV2li8sk="; + hash = "sha256-JDJxiOYgSHEBT0cyTlD/lalI4cQIODK06eaI+iVRDCI="; }; aarch64-linux = fetchurl { url = "https://hamrs-dist.s3.amazonaws.com/hamrs-pro-${version}-linux-arm64.AppImage"; - hash = "sha256-nsZbebiYqAd8By+o3+DgJ51mPAuPzQqRsjxXpWPTgW8="; + hash = "sha256-umm+PEBcY1zVlxG0z585+PxW5gHuGxEtfj8zzIYwgAQ="; }; x86_64-darwin = fetchurl { url = "https://hamrs-dist.s3.amazonaws.com/hamrs-pro-${version}-mac-x64.dmg"; - hash = "sha256-G2vCdgs8wGsZ5EHeO8CI/BtyxvbBAvHTzqbn7InxEAU="; + hash = "sha256-DN2Alc2dMeNyr0VtXzwd4BamtZev+gHBesf5ohM5wm0="; }; aarch64-darwin = fetchurl { url = "https://hamrs-dist.s3.amazonaws.com/hamrs-pro-${version}-mac-arm64.dmg"; - hash = "sha256-CnAbgGsgJCLcKH7HizOncI52G6kn8+FEMhWZR8FPMBc="; + hash = "sha256-JE1F6qHOmGGcfq6lNpiBr6hoK0UPy5S/VzOjhvsjgp4="; }; }; From 1ed8bf3326e0a0d632736dabc1c26e48008d4a44 Mon Sep 17 00:00:00 2001 From: Emily Date: Sun, 14 Sep 2025 23:06:15 +0100 Subject: [PATCH 09/19] =?UTF-8?q?lixPackageSets.lix=5F2=5F93.lix:=20backpo?= =?UTF-8?q?rt=20patches=20for=20toml11=20=E2=89=A5=204?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This unblocks the toml11 update and therefore the CMake 4 update. --- pkgs/tools/package-management/lix/default.nix | 33 +++++++++++++++++++ 1 file changed, 33 insertions(+) diff --git a/pkgs/tools/package-management/lix/default.nix b/pkgs/tools/package-management/lix/default.nix index 4573325396dd..10ddbc22d2fc 100644 --- a/pkgs/tools/package-management/lix/default.nix +++ b/pkgs/tools/package-management/lix/default.nix @@ -11,6 +11,7 @@ fetchFromGitHub, fetchFromGitea, fetchpatch2, + fetchpatch, rustPlatform, editline, ncurses, @@ -167,6 +168,38 @@ lib.makeExtensible ( url = "https://git.lix.systems/lix-project/lix/commit/858de5f47a1bfd33835ec97794ece339a88490f1.patch"; hash = "sha256-FfLO2dFSWV1qwcupIg8dYEhCHir2XX6/Hs89eLwd+SY="; }) + + # Support for toml11 >= 4.0, https://gerrit.lix.systems/c/lix/+/3953 + (fetchpatch { + name = "lix-2.93-toml11-4-1.patch"; + url = "https://git.lix.systems/lix-project/lix/commit/96a39dc464165a3e503a6dc7bd44518a116fe846.patch"; + hash = "sha256-j1DOScY2IFvcouhoap9CQwIZf99MZ92HtY7CjInF/s4="; + }) + (fetchpatch { + name = "lix-2.93-toml11-4-2.patch"; + url = "https://git.lix.systems/lix-project/lix/commit/699d3a63a6351edfdbc8c05f814cc93d6c3637ca.patch"; + hash = "sha256-2iUynAdimxhe5ZSDB7DlzFG3tu1yWhq+lTvjf6+M0pM="; + }) + (fetchpatch { + name = "lix-2.93-toml11-4-3.patch"; + url = "https://git.lix.systems/lix-project/lix/commit/ad52cbde2faa677b711ec950dae74e4aede965a4.patch"; + hash = "sha256-ajQwafL3yZDJMVrR+D9eTGh7L0xbDbqhAUagRur4HDE="; + }) + (fetchpatch { + name = "lix-2.93-toml11-4-4.patch"; + url = "https://git.lix.systems/lix-project/lix/commit/e29a1ccf0af2e2890ec7b7fde82f0e53a1d0aad9.patch"; + hash = "sha256-sXqZxCUtZsO7uEVk2AZx3IkP8b8EPVghYboetcQTp2A="; + }) + (fetchpatch { + name = "lix-2.93-toml11-4-5.patch"; + url = "https://git.lix.systems/lix-project/lix/commit/176b834464b7285b74a72d35df7470a46362ce60.patch"; + hash = "sha256-/KIszfHf2XoB+GeVvXad2AV8pazffYdQRDtIXb9tbj8="; + }) + (fetchpatch { + name = "lix-2.93-toml11-4-6.patch"; + url = "https://git.lix.systems/lix-project/lix/commit/b6d5670bcffebdd43352ea79b36135e35a8148d9.patch"; + hash = "sha256-f4s0TR5MhNMNM5TYLOR7K2/1rtZ389KDjTCKFVK0OcE="; + }) ]; }; }; From 576c521d5307ea820da235f3706b5901dd302bef Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Mon, 15 Sep 2025 08:32:35 +0000 Subject: [PATCH 10/19] prometheus-opnsense-exporter: 0.0.10 -> 0.0.11 --- pkgs/by-name/pr/prometheus-opnsense-exporter/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/pr/prometheus-opnsense-exporter/package.nix b/pkgs/by-name/pr/prometheus-opnsense-exporter/package.nix index ddfa39745843..000b457cddeb 100644 --- a/pkgs/by-name/pr/prometheus-opnsense-exporter/package.nix +++ b/pkgs/by-name/pr/prometheus-opnsense-exporter/package.nix @@ -6,13 +6,13 @@ }: buildGoModule (finalAttrs: { pname = "prometheus-opnsense-exporter"; - version = "0.0.10"; + version = "0.0.11"; src = fetchFromGitHub { owner = "athennamind"; repo = "opnsense-exporter"; tag = "v${finalAttrs.version}"; - hash = "sha256-U/F301HkRfmzB8czwHP9u5UajR9CvxhSZwrJSIwcRd4="; + hash = "sha256-j16ATUeFqPiPElUqCPwylcujN/qiD9GrrBOXelAbgNs="; }; ldflags = [ From 0965be0ffec23a910315d1ff7cea3ec9087a91ec Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Mon, 15 Sep 2025 12:32:12 +0000 Subject: [PATCH 11/19] bootdev-cli: 1.20.2 -> 1.20.3 --- pkgs/by-name/bo/bootdev-cli/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/bo/bootdev-cli/package.nix b/pkgs/by-name/bo/bootdev-cli/package.nix index 783340f7d4d3..9fe878d52ea7 100644 --- a/pkgs/by-name/bo/bootdev-cli/package.nix +++ b/pkgs/by-name/bo/bootdev-cli/package.nix @@ -11,13 +11,13 @@ buildGoModule rec { pname = "bootdev-cli"; - version = "1.20.2"; + version = "1.20.3"; src = fetchFromGitHub { owner = "bootdotdev"; repo = "bootdev"; tag = "v${version}"; - hash = "sha256-TjldTmLX6H0k5mvq0SXoEuoFVxcmg+hMIXpCIVk1m3g="; + hash = "sha256-vjWlD31NCWCtcmhwh+DCjXZHE12VZxj+PdIQx/A6tOY="; }; vendorHash = "sha256-jhRoPXgfntDauInD+F7koCaJlX4XDj+jQSe/uEEYIMM="; From 75a928368d9be14b976ad7c5f6cba01a1320f2c8 Mon Sep 17 00:00:00 2001 From: jthulhu Date: Mon, 15 Sep 2025 15:39:09 +0200 Subject: [PATCH 12/19] lean4: 4.22 -> 4.23.0 Release notes: - https://github.com/leanprover/lean4/releases/tag/v4.23.0-rc1 - https://github.com/leanprover/lean4/releases/tag/v4.23.0-rc2 - https://github.com/leanprover/lean4/releases/tag/v4.23.0 --- pkgs/by-name/le/lean4/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/le/lean4/package.nix b/pkgs/by-name/le/lean4/package.nix index b3253fb00b70..565042ebc3d1 100644 --- a/pkgs/by-name/le/lean4/package.nix +++ b/pkgs/by-name/le/lean4/package.nix @@ -15,7 +15,7 @@ stdenv.mkDerivation (finalAttrs: { pname = "lean4"; - version = "4.22.0"; + version = "4.23.0"; # Using a vendored version rather than nixpkgs' version to match the exact version required by # Lean. Apparently, even a slight version change can impact greatly the final performance. @@ -30,7 +30,7 @@ stdenv.mkDerivation (finalAttrs: { owner = "leanprover"; repo = "lean4"; tag = "v${finalAttrs.version}"; - hash = "sha256-dRS7ZaC/ipIEneheSoTkKkJ5PFeDnLNt8uUknu1lEHA="; + hash = "sha256-wcB3HxSNukIOttjrfvDQB5IkmhYG9w/UMeOfCQ1+lvo="; }; postPatch = From 7e6797761e3549885e338e3b998cdbeeb2d3e79f Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Mon, 15 Sep 2025 14:33:27 +0000 Subject: [PATCH 13/19] mcp-grafana: 0.6.4 -> 0.6.5 --- pkgs/by-name/mc/mcp-grafana/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/mc/mcp-grafana/package.nix b/pkgs/by-name/mc/mcp-grafana/package.nix index d064f5c0e7ef..96228f3b2fbb 100644 --- a/pkgs/by-name/mc/mcp-grafana/package.nix +++ b/pkgs/by-name/mc/mcp-grafana/package.nix @@ -6,13 +6,13 @@ buildGoModule (finalAttrs: { pname = "mcp-grafana"; - version = "0.6.4"; + version = "0.6.5"; src = fetchFromGitHub { owner = "grafana"; repo = "mcp-grafana"; tag = "v${finalAttrs.version}"; - hash = "sha256-bku8vbNjIggaVzhTXZYBgT7TcI9tAUUUrCjl+cSN9OU="; + hash = "sha256-dzAAStlzY5dF2Y86rLJY+wek1BcHqWNmQo0KTiMjxN8="; }; vendorHash = "sha256-42UHI5Z5bgnW40DsRPzoKQdZQ+k785K60gWMp5ehLfU="; From 2c76c4c2198267572f896502bff860e3ae76dd96 Mon Sep 17 00:00:00 2001 From: jopejoe1 Date: Mon, 15 Sep 2025 17:22:19 +0200 Subject: [PATCH 14/19] bchunk: add update script --- pkgs/by-name/bc/bchunk/package.nix | 3 +++ 1 file changed, 3 insertions(+) diff --git a/pkgs/by-name/bc/bchunk/package.nix b/pkgs/by-name/bc/bchunk/package.nix index 9568f62898e7..a0a2451e96a5 100644 --- a/pkgs/by-name/bc/bchunk/package.nix +++ b/pkgs/by-name/bc/bchunk/package.nix @@ -2,6 +2,7 @@ lib, stdenv, fetchFromGitHub, + nix-update-script, }: stdenv.mkDerivation (finalAttrs: { @@ -25,6 +26,8 @@ stdenv.mkDerivation (finalAttrs: { install -Dt $out/share/man/man1 bchunk.1 ''; + passthru.updateScript = nix-update-script { }; + meta = with lib; { homepage = "http://he.fi/bchunk/"; description = "Program that converts CD images in BIN/CUE format into a set of ISO and CDR tracks"; From 4b601cc332c61f5e783e174bdd12e1b1928fbce3 Mon Sep 17 00:00:00 2001 From: Gaetan Lepage Date: Mon, 15 Sep 2025 15:28:18 +0200 Subject: [PATCH 15/19] python3Packages.ncclient: cleanup, make src reproducible --- .../python-modules/ncclient/default.nix | 19 ++++++++++++------- 1 file changed, 12 insertions(+), 7 deletions(-) diff --git a/pkgs/development/python-modules/ncclient/default.nix b/pkgs/development/python-modules/ncclient/default.nix index c73a68a1f5a1..cad5d2ee997a 100644 --- a/pkgs/development/python-modules/ncclient/default.nix +++ b/pkgs/development/python-modules/ncclient/default.nix @@ -6,7 +6,6 @@ paramiko, setuptools, pytestCheckHook, - pythonOlder, }: buildPythonPackage rec { @@ -14,13 +13,19 @@ buildPythonPackage rec { version = "0.7.0"; pyproject = true; - disabled = pythonOlder "3.7"; - src = fetchFromGitHub { owner = "ncclient"; repo = "ncclient"; tag = "v${version}"; - hash = "sha256-GSa7UkBwbwggFqwNFTg2KNqGV5412EE41ma/dzPIEuU="; + # Upstream uses .gitattributes to inject information about the revision + # hash and the refname into `ncclient/_version.py`, see: + # + # - https://git-scm.com/docs/gitattributes#_export_subst and + # - https://github.com/ncclient/ncclient/blob/e056e38af2843de0608da58e2f4662465c96d587/ncclient/_version.py#L25-L28 + postFetch = '' + sed -i 's/git_refnames = "[^"]*"/git_refnames = " (tag: ${src.tag})"/' $out/ncclient/_version.py + ''; + hash = "sha256-vSX+9nTl4r6vnP/vmavdmdChzOC8P2G093/DQNMQwS4="; }; build-system = [ @@ -36,11 +41,11 @@ buildPythonPackage rec { pythonImportsCheck = [ "ncclient" ]; - meta = with lib; { + meta = { description = "Python library for NETCONF clients"; homepage = "https://github.com/ncclient/ncclient"; changelog = "https://github.com/ncclient/ncclient/releases/tag/${src.tag}"; - license = licenses.asl20; - maintainers = with maintainers; [ xnaveira ]; + license = lib.licenses.asl20; + maintainers = with lib.maintainers; [ xnaveira ]; }; } From c11b537fdaefb03960812149ed37c88512081664 Mon Sep 17 00:00:00 2001 From: Gaetan Lepage Date: Mon, 15 Sep 2025 15:45:42 +0200 Subject: [PATCH 16/19] python3Packages.dynaconf: skip failing test --- pkgs/development/python-modules/dynaconf/default.nix | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/pkgs/development/python-modules/dynaconf/default.nix b/pkgs/development/python-modules/dynaconf/default.nix index 8cf0598eda73..e2da505d0ab1 100644 --- a/pkgs/development/python-modules/dynaconf/default.nix +++ b/pkgs/development/python-modules/dynaconf/default.nix @@ -59,6 +59,11 @@ buildPythonPackage rec { versionCheckHook ]; + disabledTests = [ + # AssertionError: assert 42.1 == 'From development env' + "test_envless_load_file" + ]; + disabledTestPaths = [ # import file mismatch # imported module 'app_test' has this __file__ attribute: From dd12290517ff6e57ab2ca384b101e0cdc617570c Mon Sep 17 00:00:00 2001 From: Yuriy Taraday Date: Mon, 1 Sep 2025 07:26:54 +0200 Subject: [PATCH 17/19] Reapply "stdenv: Add CPE fields to meta" This reverts commit de74f9caf0854a9ee8c39774cf4521870fa1f44a. --- doc/redirects.json | 15 ++ doc/stdenv/meta.chapter.md | 71 +++++++ lib/meta.nix | 189 +++++++++++++++++- .../networking/sync/rsync/default.nix | 5 + pkgs/by-name/he/hello/package.nix | 1 + .../development/compilers/gcc/common/meta.nix | 1 + pkgs/development/compilers/gcc/default.nix | 1 + .../compilers/llvm/common/common-let.nix | 2 + .../linux/kernel/manual-config.nix | 7 + pkgs/shells/bash/5.nix | 10 + pkgs/stdenv/generic/check-meta.nix | 63 ++++++ 11 files changed, 364 insertions(+), 1 deletion(-) diff --git a/doc/redirects.json b/doc/redirects.json index 0442248c3e3e..1230b6460b54 100644 --- a/doc/redirects.json +++ b/doc/redirects.json @@ -225,6 +225,12 @@ "sec-language-cosmic": [ "index.html#sec-language-cosmic" ], + "sec-meta-identifiers": [ + "index.html#sec-meta-identifiers" + ], + "sec-meta-identifiers-cpe": [ + "index.html#sec-meta-identifiers-cpe" + ], "sec-modify-via-packageOverrides": [ "index.html#sec-modify-via-packageOverrides" ], @@ -628,6 +634,15 @@ "var-go-buildTestBinaries": [ "index.html#var-go-buildTestBinaries" ], + "var-meta-identifiers-cpe": [ + "index.html#var-meta-identifiers-cpe" + ], + "var-meta-identifiers-cpeParts": [ + "index.html#var-meta-identifiers-cpeParts" + ], + "var-meta-identifiers-possibleCPEs": [ + "index.html#var-meta-identifiers-possibleCPEs" + ], "var-meta-teams": [ "index.html#var-meta-teams" ], diff --git a/doc/stdenv/meta.chapter.md b/doc/stdenv/meta.chapter.md index 6f092d406126..947009869ff1 100644 --- a/doc/stdenv/meta.chapter.md +++ b/doc/stdenv/meta.chapter.md @@ -248,3 +248,74 @@ Code to be executed on a peripheral device or embedded controller, built by a th ### `lib.sourceTypes.binaryBytecode` {#lib.sourceTypes.binaryBytecode} Code to run on a VM interpreter or JIT compiled into bytecode by a third party. This includes packages which download Java `.jar` files from another source. + +## Software identifiers {#sec-meta-identifiers} + +Package's `meta.identifiers` attribute specifies information about software identifiers associated with this package. Software identifiers are used, for example: +* to generate Software Bill of Materials (SBOM) that lists all components used to build the software, which can later be used to perform vulnerability or license analysis of the resulting software; +* to lookup software in different vulnerability databases or report new vulnerabilities to them. + +Overriding the default `meta.identifiers` attribute is optional, but it is recommended to fill in pieces to help tools mentioned above get precise data. +For example, we could get automatic notifications about potential vulnerabilities for users in the future. +All identifiers specified in `meta.identifiers` are expected to be unambiguous and valid. + +`meta.identifiers` contains `v1` attribute which is an attribute set that guarantees backward compatibility of its constituents. Right now it contains copies of all other attributes in `meta.identifiers`. + +### CPE {#sec-meta-identifiers-cpe} + +Common Platform Enumeration (CPE) is a specification maintained by NIST as part of the Security Content Automation Protocol (SCAP). It is used to identify software in National Vulnerabilities Database (NVD, https://nvd.nist.gov) and other vulnerability databases. + +Current version of CPE 2.3 consists of 13 parts: + +``` +cpe:2.3:a:::::::::: +``` + +Some of them are as follows: + +* *CPE version* - current version of CPE is `2.3` +* *part* - usually in Nixpkgs `a` for "application", can also be `o` for "operating system" or `h` for "hardware" +* *vendor* - can point to the source of the package, or to Nixpkgs itself +* *product* - name of the package +* *version* - version of the package +* *update* - name of the latest update, can be a patch version for semantically versioned packages +* *edition* - any additional specification about the version + +You can find information about all of these attributes in the [official specification](https://csrc.nist.gov/projects/security-content-automation-protocol/specifications/cpe/naming) (heading 5.3.3, pages 11-13). + +Any fields that don't have a value are set to either `-` if the value is not available or `*` when the field can match any value. + +For example, for glibc 2.40.1 CPE would be `cpe:2.3:a:gnu:glibc:2.40:1:*:*:*:*:*:*`. + +#### `meta.identifiers.cpeParts` {#var-meta-identifiers-cpeParts} + +This attribute contains an attribute set of all parts of the CPE for this package. Most of the parts default to `*` (match any value), with some exceptions: + +* `part` defaults to `a` (application), can also be set to `o` for operating systems, for example, Linux kernel, or to `h` for hardware +* `vendor` cannot be deduced from other sources, so it must be specified by the package author +* `product` defaults to provided derivation's `pname` attribute and must be provided explicitly if `pname` is missing +* `version` and `update` have no defaults and should be specified explicitly or using helper functions, when missing, `cpe` attribute will be empty, and all possible guesses using helper functions will be in `possibleCPEs` attribute. + +It is up to the package author to make sure all parts are correct and match expected values in [NVD dictionary](https://nvd.nist.gov/products/cpe). Unknown values can be skipped, which would leave them with the default value of `*`. + +Following functions help with filling out `version` and `update` fields: + +* [`lib.meta.cpeFullVersionWithVendor`](#function-library-lib.meta.cpeFullVersionWithVendor) +* [`lib.meta.cpePatchVersionInUpdateWithVendor`](#function-library-lib.meta.cpePatchVersionInUpdateWithVendor) + +For many packages to make CPE available it should be enough to specify only: + +```nix +{ + # ... + meta.identifiers.cpeParts = lib.meta.cpePatchVersionInUpdateWithVendor vendor version; +} +``` + +#### `meta.identifiers.cpe` {#var-meta-identifiers-cpe} + +A readonly attribute that concatenates all CPE parts in one string. + +#### `meta.identifiers.possibleCPEs` {#var-meta-identifiers-possibleCPEs} + +A readonly attribute containing the list of guesses for what CPE for this package can look like. It includes all variants of version handling mentioned above. Each item is an attrset with attributes `cpeParts` and `cpe` for each guess. diff --git a/lib/meta.nix b/lib/meta.nix index 810b2d9a5e3e..85e800a7d8f6 100644 --- a/lib/meta.nix +++ b/lib/meta.nix @@ -15,7 +15,12 @@ let assertMsg ; inherit (lib.attrsets) mapAttrs' filterAttrs; - inherit (builtins) isString match typeOf; + inherit (builtins) + isString + match + typeOf + elemAt + ; in rec { @@ -491,4 +496,186 @@ rec { assert assertMsg (match ".*/.*" y == null) "lib.meta.getExe': The second argument \"${y}\" is a nested path with a \"/\" character, but it should just be the name of the executable instead."; "${getBin x}/bin/${y}"; + + /** + Generate [CPE parts](#var-meta-identifiers-cpeParts) from inputs. Copies `vendor` and `version` to the output, and sets `update` to `*`. + + # Inputs + + `vendor` + + : package's vendor + + `version` + + : package's version + + # Type + + ``` + cpeFullVersionWithVendor :: string -> string -> AttrSet + ``` + + # Examples + :::{.example} + ## `lib.meta.cpeFullVersionWithVendor` usage example + + ```nix + lib.meta.cpeFullVersionWithVendor "gnu" "1.2.3" + => { + vendor = "gnu"; + version = "1.2.3"; + update = "*"; + } + ``` + + ::: + :::{.example} + ## `lib.meta.cpeFullVersionWithVendor` usage in derivations + + ```nix + mkDerivation rec { + version = "1.2.3"; + # ... + meta = { + # ... + identifiers.cpeParts = lib.meta.cpeFullVersionWithVendor "gnu" version; + }; + } + ``` + ::: + */ + cpeFullVersionWithVendor = vendor: version: { + inherit vendor version; + update = "*"; + }; + + /** + Alternate version of [`lib.meta.cpePatchVersionInUpdateWithVendor`](#function-library-lib.meta.cpePatchVersionInUpdateWithVendor). + If `cpePatchVersionInUpdateWithVendor` succeeds, returns an attribute set with `success` set to `true` and `value` set to the result. + Otherwise, `success` is set to `false` and `error` is set to the string representation of the error. + + # Inputs + + `vendor` + + : package's vendor + + `version` + + : package's version + + # Type + + ``` + tryCPEPatchVersionInUpdateWithVendor :: string -> string -> AttrSet + ``` + + # Examples + :::{.example} + ## `lib.meta.tryCPEPatchVersionInUpdateWithVendor` usage example + + ```nix + lib.meta.tryCPEPatchVersionInUpdateWithVendor "gnu" "1.2.3" + => { + success = true; + value = { + vendor = "gnu"; + version = "1.2"; + update = "3"; + }; + } + ``` + + ::: + :::{.example} + ## `lib.meta.cpePatchVersionInUpdateWithVendor` error example + + ```nix + lib.meta.tryCPEPatchVersionInUpdateWithVendor "gnu" "5.3p0" + => { + success = false; + error = "version 5.3p0 doesn't match regex `([0-9]+\\.[0-9]+)\\.([0-9]+)`"; + } + ``` + + ::: + */ + tryCPEPatchVersionInUpdateWithVendor = + vendor: version: + let + regex = "([0-9]+\\.[0-9]+)\\.([0-9]+)"; + # we have to call toString here in case version is an attrset with __toString attribute + versionMatch = builtins.match regex (toString version); + in + if versionMatch == null then + { + success = false; + error = "version ${version} doesn't match regex `${regex}`"; + } + else + { + success = true; + value = { + inherit vendor; + version = elemAt versionMatch 0; + update = elemAt versionMatch 1; + }; + }; + + /** + Generate [CPE parts](#var-meta-identifiers-cpeParts) from inputs. Copies `vendor` to the result. When `version` matches `X.Y.Z` where all parts are numerical, sets `version` and `update` fields to `X.Y` and `Z`. Throws an error if the version doesn't match the expected template. + + # Inputs + + `vendor` + + : package's vendor + + `version` + + : package's version + + # Type + + ``` + cpePatchVersionInUpdateWithVendor :: string -> string -> AttrSet + ``` + + # Examples + :::{.example} + ## `lib.meta.cpePatchVersionInUpdateWithVendor` usage example + + ```nix + lib.meta.cpePatchVersionInUpdateWithVendor "gnu" "1.2.3" + => { + vendor = "gnu"; + version = "1.2"; + update = "3"; + } + ``` + + ::: + :::{.example} + ## `lib.meta.cpePatchVersionInUpdateWithVendor` usage in derivations + + ```nix + mkDerivation rec { + version = "1.2.3"; + # ... + meta = { + # ... + identifiers.cpeParts = lib.meta.cpePatchVersionInUpdateWithVendor "gnu" version; + }; + } + ``` + + ::: + */ + cpePatchVersionInUpdateWithVendor = + vendor: version: + let + result = tryCPEPatchVersionInUpdateWithVendor vendor version; + in + if result.success then result.value else throw result.error; } diff --git a/pkgs/applications/networking/sync/rsync/default.nix b/pkgs/applications/networking/sync/rsync/default.nix index c87d1015ef4f..feb66f6fdf25 100644 --- a/pkgs/applications/networking/sync/rsync/default.nix +++ b/pkgs/applications/networking/sync/rsync/default.nix @@ -92,5 +92,10 @@ stdenv.mkDerivation rec { ivan ]; platforms = platforms.unix; + identifiers.cpeParts = { + vendor = "samba"; + inherit version; + update = "-"; + }; }; } diff --git a/pkgs/by-name/he/hello/package.nix b/pkgs/by-name/he/hello/package.nix index 4e12ff39093e..bbcce772a3aa 100644 --- a/pkgs/by-name/he/hello/package.nix +++ b/pkgs/by-name/he/hello/package.nix @@ -55,5 +55,6 @@ stdenv.mkDerivation (finalAttrs: { maintainers = with lib.maintainers; [ stv0g ]; mainProgram = "hello"; platforms = lib.platforms.all; + identifiers.cpeParts.vendor = "gnu"; }; }) diff --git a/pkgs/development/compilers/gcc/common/meta.nix b/pkgs/development/compilers/gcc/common/meta.nix index c69f9956ddfc..e0325feafbe8 100644 --- a/pkgs/development/compilers/gcc/common/meta.nix +++ b/pkgs/development/compilers/gcc/common/meta.nix @@ -30,4 +30,5 @@ in teams = [ teams.gcc ]; mainProgram = "${targetPrefix}gcc"; + identifiers.cpeParts.vendor = "gnu"; } diff --git a/pkgs/development/compilers/gcc/default.nix b/pkgs/development/compilers/gcc/default.nix index 3e78d7946b5d..a79cfed28598 100644 --- a/pkgs/development/compilers/gcc/default.nix +++ b/pkgs/development/compilers/gcc/default.nix @@ -419,6 +419,7 @@ pipe platforms teams mainProgram + identifiers ; }; } diff --git a/pkgs/development/compilers/llvm/common/common-let.nix b/pkgs/development/compilers/llvm/common/common-let.nix index c310a8ab96fc..b6b570d628ae 100644 --- a/pkgs/development/compilers/llvm/common/common-let.nix +++ b/pkgs/development/compilers/llvm/common/common-let.nix @@ -34,6 +34,8 @@ rec { ++ lib.platforms.riscv ++ lib.platforms.m68k ++ lib.platforms.loongarch64; + + identifiers.cpeParts.vendor = "llvm"; }; releaseInfo = diff --git a/pkgs/os-specific/linux/kernel/manual-config.nix b/pkgs/os-specific/linux/kernel/manual-config.nix index a4090cb4ef20..41d23aa13240 100644 --- a/pkgs/os-specific/linux/kernel/manual-config.nix +++ b/pkgs/os-specific/linux/kernel/manual-config.nix @@ -546,6 +546,13 @@ lib.makeOverridable ( ] ++ lib.optional (lib.versionOlder version "5.19") "loongarch64-linux"; timeout = 14400; # 4 hours + identifiers.cpeParts = { + part = "o"; + vendor = "linux"; + product = "linux_kernel"; + inherit version; + update = "*"; + }; } // extraMeta; }; diff --git a/pkgs/shells/bash/5.nix b/pkgs/shells/bash/5.nix index 424769a4a5c1..bb26bcd77336 100644 --- a/pkgs/shells/bash/5.nix +++ b/pkgs/shells/bash/5.nix @@ -183,5 +183,15 @@ lib.warnIf (withDocs != null) badPlatforms = [ lib.systems.inspect.patterns.isMinGW ]; maintainers = [ ]; mainProgram = "bash"; + identifiers.cpeParts = + let + versionSplit = lib.split "p" version; + in + { + vendor = "gnu"; + product = "bash"; + version = lib.elemAt versionSplit 0; + update = lib.elemAt versionSplit 2; + }; }; } diff --git a/pkgs/stdenv/generic/check-meta.nix b/pkgs/stdenv/generic/check-meta.nix index f96b8a6aaceb..78f06e4e8126 100644 --- a/pkgs/stdenv/generic/check-meta.nix +++ b/pkgs/stdenv/generic/check-meta.nix @@ -11,6 +11,7 @@ let inherit (lib) all attrNames + attrValues concatMapStrings concatMapStringsSep concatStrings @@ -37,6 +38,8 @@ let inherit (lib.meta) availableOn + cpeFullVersionWithVendor + tryCPEPatchVersionInUpdateWithVendor ; inherit (lib.generators) @@ -438,6 +441,8 @@ let # Used for the original location of the maintainer and team attributes to assist with pings. maintainersPosition = any; teamsPosition = any; + + identifiers = attrs; }; checkMetaAttr = @@ -571,6 +576,19 @@ let else validYes; + # Helper functions and declarations to handle identifiers, extracted to reduce allocations + hasAllCPEParts = cpeParts: !any isNull (attrValues cpeParts); + makeCPE = + cpeParts: + "cpe:2.3:${cpeParts.part}:${cpeParts.vendor}:${cpeParts.product}:${cpeParts.version}:${cpeParts.update}:${cpeParts.edition}:${cpeParts.sw_edition}:${cpeParts.target_sw}:${cpeParts.target_hw}:${cpeParts.language}:${cpeParts.other}"; + possibleCPEPartsFuns = [ + (vendor: version: { + success = true; + value = cpeFullVersionWithVendor vendor version; + }) + tryCPEPatchVersionInUpdateWithVendor + ]; + # The meta attribute is passed in the resulting attribute set, # but it's not part of the actual derivation, i.e., it's not # passed to the builder and is not a dependency. But since we @@ -635,6 +653,51 @@ let maintainers = attrs.meta.maintainers or [ ] ++ concatMap (team: team.members or [ ]) attrs.meta.teams or [ ]; + identifiers = + let + defaultCPEParts = { + part = "a"; + vendor = null; + product = attrs.pname or null; + version = null; + update = null; + edition = "*"; + sw_edition = "*"; + target_sw = "*"; + target_hw = "*"; + language = "*"; + other = "*"; + }; + + cpeParts = defaultCPEParts // attrs.meta.identifiers.cpeParts or { }; + cpe = if hasAllCPEParts cpeParts then makeCPE cpeParts else null; + + possibleCPEs = + if cpe != null then + [ { inherit cpeParts cpe; } ] + else if attrs.meta.identifiers.cpeParts.vendor or null == null || attrs.version or null == null then + [ ] + else + concatMap ( + f: + let + result = f attrs.meta.identifiers.cpeParts.vendor attrs.version; + # Note that attrs.meta.identifiers.cpeParts at this point can include defaults with user overrides. + # Since we can't split them apart, user overrides don't apply to possibleCPEs. + guessedParts = cpeParts // result.value; + in + optional (result.success && (hasAllCPEParts guessedParts)) { + cpeParts = guessedParts; + cpe = (makeCPE guessedParts); + } + ) possibleCPEPartsFuns; + v1 = { inherit cpeParts cpe possibleCPEs; }; + in + v1 + // { + inherit v1; + }; + # Expose the result of the checks for everyone to see. unfree = hasUnfreeLicense attrs; broken = isMarkedBroken attrs; From a178fd8c436915d233a1de37a2b211489aad5340 Mon Sep 17 00:00:00 2001 From: Yuriy Taraday Date: Mon, 1 Sep 2025 07:55:53 +0200 Subject: [PATCH 18/19] stdenv: Remove all null values from meta.identifiers nix-env writes a warning for each derivation that has null in its meta values, so fields without known values are removed from the result. Fixes issue raised by @K900 in https://github.com/NixOS/nixpkgs/pull/409797#issuecomment-3238995897 --- pkgs/stdenv/generic/check-meta.nix | 22 ++++++++++++++++------ 1 file changed, 16 insertions(+), 6 deletions(-) diff --git a/pkgs/stdenv/generic/check-meta.nix b/pkgs/stdenv/generic/check-meta.nix index 78f06e4e8126..b3c04f85fdf8 100644 --- a/pkgs/stdenv/generic/check-meta.nix +++ b/pkgs/stdenv/generic/check-meta.nix @@ -577,7 +577,12 @@ let validYes; # Helper functions and declarations to handle identifiers, extracted to reduce allocations - hasAllCPEParts = cpeParts: !any isNull (attrValues cpeParts); + hasAllCPEParts = + cpeParts: + let + values = attrValues cpeParts; + in + (length values == 11) && !any isNull values; makeCPE = cpeParts: "cpe:2.3:${cpeParts.part}:${cpeParts.vendor}:${cpeParts.product}:${cpeParts.version}:${cpeParts.update}:${cpeParts.edition}:${cpeParts.sw_edition}:${cpeParts.target_sw}:${cpeParts.target_hw}:${cpeParts.language}:${cpeParts.other}"; @@ -655,12 +660,14 @@ let identifiers = let + # nix-env writes a warning for each derivation that has null in its meta values, so + # fields without known values are removed from the result defaultCPEParts = { part = "a"; - vendor = null; - product = attrs.pname or null; - version = null; - update = null; + #vendor = null; + ${if attrs ? pname then "product" else null} = attrs.pname; + #version = null; + #update = null; edition = "*"; sw_edition = "*"; target_sw = "*"; @@ -691,7 +698,10 @@ let cpe = (makeCPE guessedParts); } ) possibleCPEPartsFuns; - v1 = { inherit cpeParts cpe possibleCPEs; }; + v1 = { + inherit cpeParts possibleCPEs; + ${if cpe != null then "cpe" else null} = cpe; + }; in v1 // { From 5e1eee582748866a51ca8f780829c3b2cf523fc3 Mon Sep 17 00:00:00 2001 From: Yuriy Taraday Date: Fri, 12 Sep 2025 17:43:00 +0200 Subject: [PATCH 19/19] stdenv: Address comments by @ConnorBaker --- pkgs/stdenv/generic/check-meta.nix | 20 ++++++++++++++++---- 1 file changed, 16 insertions(+), 4 deletions(-) diff --git a/pkgs/stdenv/generic/check-meta.nix b/pkgs/stdenv/generic/check-meta.nix index b3c04f85fdf8..d8f519b0f185 100644 --- a/pkgs/stdenv/generic/check-meta.nix +++ b/pkgs/stdenv/generic/check-meta.nix @@ -584,8 +584,20 @@ let in (length values == 11) && !any isNull values; makeCPE = - cpeParts: - "cpe:2.3:${cpeParts.part}:${cpeParts.vendor}:${cpeParts.product}:${cpeParts.version}:${cpeParts.update}:${cpeParts.edition}:${cpeParts.sw_edition}:${cpeParts.target_sw}:${cpeParts.target_hw}:${cpeParts.language}:${cpeParts.other}"; + { + part, + vendor, + product, + version, + update, + edition, + sw_edition, + target_sw, + target_hw, + language, + other, + }: + "cpe:2.3:${part}:${vendor}:${product}:${version}:${update}:${edition}:${sw_edition}:${target_sw}:${target_hw}:${language}:${other}"; possibleCPEPartsFuns = [ (vendor: version: { success = true; @@ -693,9 +705,9 @@ let # Since we can't split them apart, user overrides don't apply to possibleCPEs. guessedParts = cpeParts // result.value; in - optional (result.success && (hasAllCPEParts guessedParts)) { + optional (result.success && hasAllCPEParts guessedParts) { cpeParts = guessedParts; - cpe = (makeCPE guessedParts); + cpe = makeCPE guessedParts; } ) possibleCPEPartsFuns; v1 = {