staging-nixos merge for 2026-01-02 (#476256)
This commit is contained in:
K900
@@ -344,7 +344,7 @@ class Driver:
|
||||
return ret
|
||||
|
||||
with driver.logger.nested(f"waiting for {self.condition.description}"):
|
||||
retry(condition, timeout=timeout)
|
||||
retry(condition, timeout_seconds=timeout)
|
||||
|
||||
if fun_ is None:
|
||||
return Poll
|
||||
|
||||
@@ -93,19 +93,24 @@ def make_command(args: list) -> str:
|
||||
return " ".join(map(shlex.quote, (map(str, args))))
|
||||
|
||||
|
||||
def retry(fn: Callable, timeout: int = 900) -> None:
|
||||
"""Call the given function repeatedly, with 1 second intervals,
|
||||
until it returns True or a timeout is reached.
|
||||
"""
|
||||
def retry(fn: Callable, timeout_seconds: int = 900) -> None:
|
||||
"""Call the given function repeatedly, with a one second interval between
|
||||
retries, until it returns True or a timeout is reached.
|
||||
|
||||
for _ in range(timeout):
|
||||
Note that the timeout shown will include the time of the last attempted run.
|
||||
"""
|
||||
start_time = time.monotonic()
|
||||
|
||||
while time.monotonic() - start_time < timeout_seconds:
|
||||
if fn(False):
|
||||
return
|
||||
time.sleep(1)
|
||||
|
||||
elapsed = time.monotonic() - start_time
|
||||
|
||||
if not fn(True):
|
||||
raise RequestedAssertionFailed(
|
||||
f"action timed out after {timeout} tries with one-second pause in-between"
|
||||
f"action timed out after {elapsed:.2f} seconds (timeout={timeout_seconds})"
|
||||
)
|
||||
|
||||
|
||||
|
||||
@@ -205,10 +205,15 @@ sub pciCheck {
|
||||
($device eq "0x4229" || $device eq "0x4230" ||
|
||||
$device eq "0x4222" || $device eq "0x4227");
|
||||
|
||||
push @attrs, "hardware.cpu.intel.npu.enable = true;" if
|
||||
$vendor eq "0x8086" &&
|
||||
($device eq "0x7d1d" || $device eq "0xad1d" ||
|
||||
$device eq "0x643e" || $device eq "0xb03e");
|
||||
# Intel NPU driver
|
||||
# list taken from linux(v6.18): drivers/accel/ivpu/ivpu_drv.h
|
||||
if ($vendor eq "0x8086" &&
|
||||
($device eq "0xfd3e" || $device eq "0x7d1d" || $device eq "0xad1d" ||
|
||||
$device eq "0x643e" || $device eq "0xb03e"))
|
||||
{
|
||||
push @imports, "(modulesPath + \"/hardware/cpu/intel-npu.nix\")";
|
||||
push @attrs, "hardware.cpu.intel.npu.enable = true;";
|
||||
}
|
||||
|
||||
# Assume that all NVIDIA cards are supported by the NVIDIA driver.
|
||||
# There may be exceptions (e.g. old cards).
|
||||
|
||||
@@ -257,6 +257,7 @@
|
||||
./programs/less.nix
|
||||
./programs/liboping.nix
|
||||
./programs/light.nix
|
||||
./programs/lix.nix
|
||||
./programs/localsend.nix
|
||||
./programs/mdevctl.nix
|
||||
./programs/mepo.nix
|
||||
|
||||
@@ -0,0 +1,128 @@
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
...
|
||||
}:
|
||||
let
|
||||
|
||||
cfg = config.nix;
|
||||
|
||||
nixPackage = cfg.package.out;
|
||||
|
||||
commonNixDaemonConfig = {
|
||||
path = [
|
||||
nixPackage
|
||||
config.programs.ssh.package
|
||||
];
|
||||
|
||||
environment =
|
||||
cfg.envVars
|
||||
// {
|
||||
CURL_CA_BUNDLE = config.security.pki.caBundle;
|
||||
}
|
||||
// config.networking.proxy.envVars;
|
||||
|
||||
serviceConfig = {
|
||||
CPUSchedulingPolicy = cfg.daemonCPUSchedPolicy;
|
||||
IOSchedulingClass = cfg.daemonIOSchedClass;
|
||||
IOSchedulingPriority = cfg.daemonIOSchedPriority;
|
||||
};
|
||||
};
|
||||
|
||||
makeNixBuildUser = nr: {
|
||||
name = "nixbld${toString nr}";
|
||||
value = {
|
||||
description = "Lix build user ${toString nr}";
|
||||
uid = builtins.add config.ids.uids.nixbld nr;
|
||||
isSystemUser = true;
|
||||
group = "nixbld";
|
||||
extraGroups = [ "nixbld" ];
|
||||
};
|
||||
};
|
||||
|
||||
nixbldUsers = lib.listToAttrs (map makeNixBuildUser (lib.range 1 cfg.nrBuildUsers));
|
||||
|
||||
in
|
||||
|
||||
{
|
||||
config = lib.mkIf (cfg.enable && nixPackage.pname == "lix") {
|
||||
environment.systemPackages = [
|
||||
nixPackage
|
||||
pkgs.nix-info
|
||||
]
|
||||
++ lib.optional (config.programs.bash.completion.enable) pkgs.nix-bash-completions;
|
||||
|
||||
systemd.packages = [ nixPackage ];
|
||||
|
||||
systemd.tmpfiles.packages = [ nixPackage ];
|
||||
|
||||
systemd.sockets.nix-daemon.wantedBy = [ "sockets.target" ];
|
||||
|
||||
systemd.services."nix-daemon@" = lib.mkMerge [
|
||||
commonNixDaemonConfig
|
||||
{
|
||||
# Do not kill connections serving established connections on upgrade.
|
||||
restartIfChanged = false;
|
||||
}
|
||||
];
|
||||
|
||||
systemd.services.nix-daemon = lib.mkMerge [
|
||||
commonNixDaemonConfig
|
||||
{
|
||||
restartTriggers = [ config.environment.etc."nix/nix.conf".source ];
|
||||
|
||||
# `stopIfChanged = false` changes to switch behavior
|
||||
# from stop -> update units -> start
|
||||
# to update units -> restart
|
||||
#
|
||||
# The `stopIfChanged` setting therefore controls a trade-off between a
|
||||
# more predictable lifecycle, which runs the correct "version" of
|
||||
# the `ExecStop` line, and on the other hand the availability of
|
||||
# sockets during the switch, as the effectiveness of the stop operation
|
||||
# depends on the socket being stopped as well.
|
||||
#
|
||||
# As `nix-daemon.service` does not make use of `ExecStop`, we prefer
|
||||
# to keep the socket up and available. This is important for machines
|
||||
# that run Nix-based services, such as automated build, test, and deploy
|
||||
# services, that expect the daemon socket to be available at all times.
|
||||
#
|
||||
# Notably, the Nix client does not retry on failure to connect to the
|
||||
# daemon socket, and the in-process RemoteStore instance will disable
|
||||
# itself. This makes retries infeasible even for services that are
|
||||
# aware of the issue. Failure to connect can affect not only new client
|
||||
# processes, but also new RemoteStore instances in existing processes,
|
||||
# as well as existing RemoteStore instances that have not saturated
|
||||
# their connection pool.
|
||||
#
|
||||
# Also note that `stopIfChanged = true` does not kill existing
|
||||
# connection handling daemons, as one might wish to happen before a
|
||||
# breaking Nix upgrade (which is rare). The daemon forks that handle
|
||||
# the individual connections split off into their own sessions, causing
|
||||
# them not to be stopped by systemd.
|
||||
# If a Nix upgrade does require all existing daemon processes to stop,
|
||||
# nix-daemon must do so on its own accord, and only when the new version
|
||||
# starts and detects that Nix's persistent state needs an upgrade.
|
||||
stopIfChanged = false;
|
||||
|
||||
}
|
||||
];
|
||||
|
||||
# Set up the environment variables for running Nix.
|
||||
environment.sessionVariables = cfg.envVars;
|
||||
|
||||
nix.nrBuildUsers = lib.mkDefault (
|
||||
if cfg.settings.auto-allocate-uids or false then
|
||||
0
|
||||
else
|
||||
lib.max 32 (if cfg.settings.max-jobs == "auto" then 0 else cfg.settings.max-jobs)
|
||||
);
|
||||
|
||||
users.users = nixbldUsers;
|
||||
|
||||
services.displayManager.hiddenUsers = lib.attrNames nixbldUsers;
|
||||
|
||||
# Legacy configuration conversion.
|
||||
nix.settings.sandbox-fallback = false;
|
||||
};
|
||||
}
|
||||
@@ -117,6 +117,10 @@ in
|
||||
ifaceSet != ""
|
||||
) ''iifname { ${ifaceSet} } accept comment "trusted interfaces"''}
|
||||
|
||||
# Multicast ICMPv6 echo replies get marked as invalid by conntrack.
|
||||
# Accept them before conntrack to avoid dropped replies.
|
||||
icmpv6 type echo-reply accept
|
||||
|
||||
# Some ICMPv6 types like NDP is untracked
|
||||
ct state vmap {
|
||||
invalid : drop,
|
||||
|
||||
@@ -174,6 +174,10 @@ in
|
||||
permissions = "u+rx,g+rx,o-rx";
|
||||
};
|
||||
|
||||
system.switch.inhibitors = [
|
||||
cfg.dbusPackage
|
||||
];
|
||||
|
||||
systemd.services.dbus = {
|
||||
aliases = [
|
||||
# hack aiding to prevent dbus from restarting when switching from dbus-broker back to dbus
|
||||
@@ -212,6 +216,10 @@ in
|
||||
cfg.brokerPackage
|
||||
];
|
||||
|
||||
system.switch.inhibitors = [
|
||||
cfg.brokerPackage
|
||||
];
|
||||
|
||||
# Just to be sure we don't restart through the unit alias
|
||||
systemd.services.dbus.reloadIfChanged = true;
|
||||
systemd.user.services.dbus.reloadIfChanged = true;
|
||||
|
||||
@@ -16,10 +16,6 @@ let
|
||||
|
||||
nixPackage = cfg.package.out;
|
||||
|
||||
# nixVersion is an attribute which defines the implementation version.
|
||||
# This is useful for Nix implementations which don't follow Nix's versioning.
|
||||
isNixAtLeast = lib.versionAtLeast (nixPackage.nixVersion or (lib.getVersion nixPackage));
|
||||
|
||||
makeNixBuildUser = nr: {
|
||||
name = "nixbld${toString nr}";
|
||||
value = {
|
||||
@@ -187,7 +183,7 @@ in
|
||||
|
||||
###### implementation
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
config = lib.mkIf (cfg.enable && nixPackage.pname != "lix") {
|
||||
environment.systemPackages = [
|
||||
nixPackage
|
||||
pkgs.nix-info
|
||||
@@ -196,26 +192,15 @@ in
|
||||
|
||||
systemd.packages = [ nixPackage ];
|
||||
|
||||
systemd.tmpfiles = lib.mkMerge [
|
||||
(lib.mkIf (isNixAtLeast "2.8") {
|
||||
packages = [ nixPackage ];
|
||||
})
|
||||
(lib.mkIf (!isNixAtLeast "2.8") {
|
||||
rules = [
|
||||
"d /nix/var/nix/daemon-socket 0755 root root - -"
|
||||
];
|
||||
})
|
||||
];
|
||||
systemd.tmpfiles.packages = [ nixPackage ];
|
||||
|
||||
systemd.sockets.nix-daemon.wantedBy = [ "sockets.target" ];
|
||||
|
||||
systemd.services.nix-daemon = {
|
||||
path = [
|
||||
nixPackage
|
||||
pkgs.util-linux
|
||||
config.programs.ssh.package
|
||||
]
|
||||
++ lib.optionals cfg.distributedBuilds [ pkgs.gzip ];
|
||||
];
|
||||
|
||||
environment =
|
||||
cfg.envVars
|
||||
@@ -224,15 +209,10 @@ in
|
||||
}
|
||||
// config.networking.proxy.envVars;
|
||||
|
||||
unitConfig.RequiresMountsFor = "/nix/store";
|
||||
|
||||
serviceConfig = {
|
||||
CPUSchedulingPolicy = cfg.daemonCPUSchedPolicy;
|
||||
IOSchedulingClass = cfg.daemonIOSchedClass;
|
||||
IOSchedulingPriority = cfg.daemonIOSchedPriority;
|
||||
LimitNOFILE = 1048576;
|
||||
Delegate = "yes";
|
||||
DelegateSubgroup = "supervisor";
|
||||
};
|
||||
|
||||
restartTriggers = [ config.environment.etc."nix/nix.conf".source ];
|
||||
@@ -287,10 +267,7 @@ in
|
||||
services.displayManager.hiddenUsers = lib.attrNames nixbldUsers;
|
||||
|
||||
# Legacy configuration conversion.
|
||||
nix.settings = lib.mkMerge [
|
||||
(lib.mkIf (isNixAtLeast "2.3pre") { sandbox-fallback = false; })
|
||||
];
|
||||
|
||||
nix.settings.sandbox-fallback = false;
|
||||
};
|
||||
|
||||
}
|
||||
|
||||
@@ -11,12 +11,6 @@ let
|
||||
mkOption
|
||||
types
|
||||
;
|
||||
|
||||
systemBuilderArgs = {
|
||||
activationScript = config.system.activationScripts.script;
|
||||
dryActivationScript = config.system.dryActivationScript;
|
||||
};
|
||||
|
||||
in
|
||||
{
|
||||
options = {
|
||||
@@ -52,36 +46,51 @@ in
|
||||
'';
|
||||
};
|
||||
};
|
||||
config = {
|
||||
system.activatableSystemBuilderCommands = ''
|
||||
echo "$activationScript" > $out/activate
|
||||
echo "$dryActivationScript" > $out/dry-activate
|
||||
substituteInPlace $out/activate --subst-var-by out ''${!toplevelVar}
|
||||
substituteInPlace $out/dry-activate --subst-var-by out ''${!toplevelVar}
|
||||
chmod u+x $out/activate $out/dry-activate
|
||||
unset activationScript dryActivationScript
|
||||
'';
|
||||
config =
|
||||
let
|
||||
activationScript = lib.getExe (
|
||||
pkgs.writeShellApplication {
|
||||
name = "activate";
|
||||
text = config.system.activationScripts.script;
|
||||
checkPhase = "";
|
||||
bashOptions = [ ];
|
||||
}
|
||||
);
|
||||
dryActivationScript = lib.getExe (
|
||||
pkgs.writeShellApplication {
|
||||
name = "dry-activate";
|
||||
text = config.system.dryActivationScript;
|
||||
checkPhase = "";
|
||||
bashOptions = [ ];
|
||||
}
|
||||
);
|
||||
in
|
||||
{
|
||||
system.activatableSystemBuilderCommands =
|
||||
# We use sed here instead of substitute(InPlace), because the substitute
|
||||
# functions load the content of the file into a bash variable, which fails
|
||||
# for very large activation scripts.
|
||||
# bash
|
||||
''
|
||||
cp ${activationScript} $out/activate
|
||||
cp ${dryActivationScript} $out/dry-activate
|
||||
${lib.getExe pkgs.gnused} --in-place --expression "s|@out@|''${!toplevelVar}|g" $out/activate $out/dry-activate
|
||||
'';
|
||||
|
||||
system.systemBuilderCommands = lib.mkIf config.system.activatable config.system.activatableSystemBuilderCommands;
|
||||
system.systemBuilderArgs = lib.mkIf config.system.activatable (
|
||||
systemBuilderArgs
|
||||
// {
|
||||
system.systemBuilderCommands = lib.mkIf config.system.activatable config.system.activatableSystemBuilderCommands;
|
||||
system.systemBuilderArgs = lib.mkIf config.system.activatable {
|
||||
toplevelVar = "out";
|
||||
}
|
||||
);
|
||||
};
|
||||
|
||||
system.build.separateActivationScript =
|
||||
pkgs.runCommand "separate-activation-script"
|
||||
(
|
||||
systemBuilderArgs
|
||||
// {
|
||||
system.build.separateActivationScript =
|
||||
pkgs.runCommand "separate-activation-script"
|
||||
{
|
||||
toplevelVar = "toplevel";
|
||||
toplevel = config.system.build.toplevel;
|
||||
}
|
||||
)
|
||||
''
|
||||
mkdir $out
|
||||
${config.system.activatableSystemBuilderCommands}
|
||||
'';
|
||||
};
|
||||
''
|
||||
mkdir $out
|
||||
${config.system.activatableSystemBuilderCommands}
|
||||
'';
|
||||
};
|
||||
}
|
||||
|
||||
@@ -50,8 +50,6 @@ let
|
||||
) withHeadlines;
|
||||
in
|
||||
''
|
||||
#!${pkgs.runtimeShell}
|
||||
|
||||
source ${./lib/lib.sh}
|
||||
|
||||
systemConfig='@out@'
|
||||
|
||||
@@ -16,38 +16,129 @@
|
||||
'')
|
||||
];
|
||||
|
||||
options.system.switch.enable = lib.mkOption {
|
||||
type = lib.types.bool;
|
||||
default = true;
|
||||
description = ''
|
||||
Whether to include the capability to switch configurations.
|
||||
options.system.switch = {
|
||||
enable = lib.mkOption {
|
||||
type = lib.types.bool;
|
||||
default = true;
|
||||
description = ''
|
||||
Whether to include the capability to switch configurations.
|
||||
|
||||
Disabling this makes the system unable to be reconfigured via `nixos-rebuild`.
|
||||
Disabling this makes the system unable to be reconfigured via `nixos-rebuild`.
|
||||
|
||||
This is good for image based appliances where updates are handled
|
||||
outside the image. Reducing features makes the image lighter and
|
||||
slightly more secure.
|
||||
'';
|
||||
This is good for image based appliances where updates are handled
|
||||
outside the image. Reducing features makes the image lighter and
|
||||
slightly more secure.
|
||||
'';
|
||||
};
|
||||
|
||||
inhibitors = lib.mkOption {
|
||||
type = lib.types.listOf lib.types.pathInStore;
|
||||
default = [ ];
|
||||
description = ''
|
||||
List of derivations that will prevent switching into a configuration when
|
||||
they change.
|
||||
This can be manually overridden on the command line if required.
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf config.system.switch.enable {
|
||||
# Use a subshell so we can source makeWrapper's setup hook without
|
||||
# affecting the rest of activatableSystemBuilderCommands.
|
||||
system.activatableSystemBuilderCommands = ''
|
||||
(
|
||||
source ${pkgs.buildPackages.makeWrapper}/nix-support/setup-hook
|
||||
system = {
|
||||
activatableSystemBuilderCommands = ''
|
||||
(
|
||||
source ${pkgs.buildPackages.makeWrapper}/nix-support/setup-hook
|
||||
|
||||
mkdir $out/bin
|
||||
ln -sf ${lib.getExe pkgs.switch-to-configuration-ng} $out/bin/switch-to-configuration
|
||||
wrapProgram $out/bin/switch-to-configuration \
|
||||
--set OUT $out \
|
||||
--set TOPLEVEL ''${!toplevelVar} \
|
||||
--set DISTRO_ID ${lib.escapeShellArg config.system.nixos.distroId} \
|
||||
--set INSTALL_BOOTLOADER ${lib.escapeShellArg config.system.build.installBootLoader} \
|
||||
--set PRE_SWITCH_CHECK ${lib.escapeShellArg config.system.preSwitchChecksScript} \
|
||||
--set LOCALE_ARCHIVE ${config.i18n.glibcLocales}/lib/locale/locale-archive \
|
||||
--set SYSTEMD ${config.systemd.package}
|
||||
)
|
||||
'';
|
||||
mkdir $out/bin
|
||||
ln -sf ${lib.getExe pkgs.switch-to-configuration-ng} $out/bin/switch-to-configuration
|
||||
wrapProgram $out/bin/switch-to-configuration \
|
||||
--set OUT $out \
|
||||
--set TOPLEVEL ''${!toplevelVar} \
|
||||
--set DISTRO_ID ${lib.escapeShellArg config.system.nixos.distroId} \
|
||||
--set INSTALL_BOOTLOADER ${lib.escapeShellArg config.system.build.installBootLoader} \
|
||||
--set PRE_SWITCH_CHECK ${lib.escapeShellArg config.system.preSwitchChecksScript} \
|
||||
--set LOCALE_ARCHIVE ${config.i18n.glibcLocales}/lib/locale/locale-archive \
|
||||
--set SYSTEMD ${config.systemd.package}
|
||||
)
|
||||
'';
|
||||
|
||||
systemBuilderCommands = ''
|
||||
ln -s ${config.system.build.inhibitSwitch} $out/switch-inhibitors
|
||||
'';
|
||||
|
||||
build.inhibitSwitch = pkgs.writeTextFile {
|
||||
name = "switch-inhibitors";
|
||||
text = lib.concatMapStringsSep "\n" (drv: drv.outPath) config.system.switch.inhibitors;
|
||||
};
|
||||
|
||||
preSwitchChecks.switchInhibitors =
|
||||
let
|
||||
realpath = lib.getExe' pkgs.coreutils "realpath";
|
||||
sha256sum = lib.getExe' pkgs.coreutils "sha256sum";
|
||||
diff = lib.getExe' pkgs.diffutils "diff";
|
||||
in
|
||||
# bash
|
||||
''
|
||||
incoming="''${1-}"
|
||||
action="''${2-}"
|
||||
|
||||
if [ "$action" == "boot" ]; then
|
||||
echo "Not checking switch inhibitors (action = $action)"
|
||||
exit
|
||||
fi
|
||||
|
||||
echo -n "Checking switch inhibitors..."
|
||||
|
||||
booted_inhibitors="$(${realpath} /run/booted-system)/switch-inhibitors"
|
||||
booted_inhibitors_sha="$(
|
||||
if [ -f "$booted_inhibitors" ]; then
|
||||
${sha256sum} - < "$booted_inhibitors"
|
||||
else
|
||||
echo 'none'
|
||||
fi
|
||||
)"
|
||||
|
||||
if [ "$booted_inhibitors_sha" == "none" ]; then
|
||||
echo
|
||||
echo "The previous configuration did not specify switch inhibitors, nothing to check."
|
||||
exit
|
||||
fi
|
||||
|
||||
new_inhibitors="$(${realpath} "$incoming")/switch-inhibitors"
|
||||
new_inhibitors_sha="$(
|
||||
if [ -f "$new_inhibitors" ]; then
|
||||
${sha256sum} - < "$new_inhibitors"
|
||||
else
|
||||
echo 'none'
|
||||
fi
|
||||
)"
|
||||
|
||||
if [ "$new_inhibitors_sha" == "none" ]; then
|
||||
echo
|
||||
echo "The new configuration does not specify switch inhibitors, nothing to check."
|
||||
exit
|
||||
fi
|
||||
|
||||
if [ "$new_inhibitors_sha" != "$booted_inhibitors_sha" ]; then
|
||||
echo
|
||||
echo "Found diff in switch inhibitors:"
|
||||
echo
|
||||
${diff} --color "$booted_inhibitors" "$new_inhibitors"
|
||||
echo
|
||||
echo "The new configuration contains changes to packages that were"
|
||||
echo "listed as switch inhibitors."
|
||||
echo
|
||||
echo "If you really want to switch into this configuration directly, then"
|
||||
echo "you can set NIXOS_NO_CHECK=1 to ignore these pre-switch checks."
|
||||
echo
|
||||
echo "WARNING: doing so might cause the switch to fail or your system to become unstable."
|
||||
echo
|
||||
exit 1
|
||||
else
|
||||
echo " done"
|
||||
fi
|
||||
'';
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
@@ -73,7 +73,7 @@ trap 'fail' 0
|
||||
|
||||
# Print a greeting.
|
||||
info
|
||||
info "[1;32m<<< @distroName@ Stage 1 >>>[0m"
|
||||
info "[1;32m@stage1Greeting@[0m"
|
||||
info
|
||||
|
||||
# Make several required directories.
|
||||
|
||||
@@ -323,6 +323,7 @@ let
|
||||
postMountCommands
|
||||
preFailCommands
|
||||
kernelModules
|
||||
stage1Greeting
|
||||
;
|
||||
|
||||
resumeDevices = map (sd: if sd ? device then sd.device else "/dev/disk/by-label/${sd.label}") (
|
||||
@@ -686,6 +687,15 @@ in
|
||||
'';
|
||||
};
|
||||
|
||||
boot.initrd.stage1Greeting = mkOption {
|
||||
type = types.str;
|
||||
default = "<<< ${config.system.nixos.distroName} Stage 1 >>>";
|
||||
defaultText = literalExpression ''"<<< ''${config.system.nixos.distroName} Stage 1 >>>"'';
|
||||
description = ''
|
||||
The greeting message displayed during NixOS stage 1 boot.
|
||||
'';
|
||||
};
|
||||
|
||||
boot.loader.supportsInitrdSecrets = mkOption {
|
||||
internal = true;
|
||||
default = false;
|
||||
|
||||
@@ -19,7 +19,7 @@ if [ "${IN_NIXOS_SYSTEMD_STAGE1:-}" != true ]; then
|
||||
|
||||
# Print a greeting.
|
||||
echo
|
||||
echo -e "\e[1;32m<<< @distroName@ Stage 2 >>>\e[0m"
|
||||
echo -e "\e[1;32m@stage2Greeting@\e[0m"
|
||||
echo
|
||||
|
||||
|
||||
|
||||
@@ -17,9 +17,8 @@ let
|
||||
replacements = {
|
||||
shell = "${pkgs.bash}/bin/bash";
|
||||
systemConfig = null; # replaced in ../activation/top-level.nix
|
||||
inherit (config.boot) systemdExecutable;
|
||||
inherit (config.boot) systemdExecutable stage2Greeting;
|
||||
nixStoreMountOpts = lib.concatStringsSep " " (map lib.escapeShellArg config.boot.nixStoreMountOpts);
|
||||
inherit (config.system.nixos) distroName;
|
||||
inherit useHostResolvConf;
|
||||
inherit (config.system.build) earlyMountScript;
|
||||
path = lib.makeBinPath (
|
||||
@@ -87,6 +86,15 @@ in
|
||||
'';
|
||||
};
|
||||
|
||||
stage2Greeting = mkOption {
|
||||
type = types.str;
|
||||
default = "<<< ${config.system.nixos.distroName} Stage 2 >>>";
|
||||
defaultText = literalExpression ''"<<< ''${config.system.nixos.distroName} Stage 2 >>>"'';
|
||||
description = ''
|
||||
The greeting message displayed during NixOS stage 2 boot.
|
||||
'';
|
||||
};
|
||||
|
||||
extraSystemdUnitPaths = mkOption {
|
||||
default = [ ];
|
||||
type = types.listOf types.str;
|
||||
|
||||
@@ -567,6 +567,10 @@ in
|
||||
);
|
||||
};
|
||||
|
||||
system.switch.inhibitors = [
|
||||
cfg.package
|
||||
];
|
||||
|
||||
environment.systemPackages = [ cfg.package ];
|
||||
|
||||
environment.etc =
|
||||
|
||||
@@ -114,6 +114,27 @@ in
|
||||
'';
|
||||
};
|
||||
|
||||
rebootTriggers = lib.mkOption {
|
||||
type = lib.types.listOf lib.types.pathInStore;
|
||||
default = [ ];
|
||||
description = ''
|
||||
List of derivations that will cause an auto-reboot when changed when
|
||||
{option}`system.autoUpgrade.allowReboot` is set to true.
|
||||
'';
|
||||
defaultText = lib.literalExpression ''
|
||||
[
|
||||
config.system.build.initialRamdisk
|
||||
config.system.build.kernel
|
||||
config.hardware.firmware
|
||||
(pkgs.writeTextFile {
|
||||
name = "kernel-params";
|
||||
text = lib.concatStringsSep " " config.boot.kernelParams;
|
||||
})
|
||||
]
|
||||
++ config.system.switch.inhibitors
|
||||
'';
|
||||
};
|
||||
|
||||
randomizedDelaySec = lib.mkOption {
|
||||
default = "0";
|
||||
type = lib.types.str;
|
||||
@@ -197,133 +218,205 @@ in
|
||||
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
config = lib.mkMerge [
|
||||
|
||||
assertions = [
|
||||
{
|
||||
assertion = !((cfg.channel != null) && (cfg.flake != null));
|
||||
message = ''
|
||||
The options 'system.autoUpgrade.channel' and 'system.autoUpgrade.flake' cannot both be set.
|
||||
'';
|
||||
}
|
||||
{
|
||||
assertion = (cfg.runGarbageCollection -> config.nix.enable);
|
||||
message = ''
|
||||
The option 'system.autoUpgrade.runGarbageCollection = true' requires 'nix.enable = true'.
|
||||
'';
|
||||
}
|
||||
];
|
||||
|
||||
system.autoUpgrade.flags = (
|
||||
if cfg.flake == null then
|
||||
[ "--no-build-output" ]
|
||||
++ lib.optionals (cfg.channel != null) [
|
||||
"-I"
|
||||
"nixpkgs=${cfg.channel}/nixexprs.tar.xz"
|
||||
{
|
||||
system = {
|
||||
autoUpgrade.rebootTriggers = [
|
||||
config.system.build.initialRamdisk
|
||||
config.system.build.kernel
|
||||
config.hardware.firmware
|
||||
(pkgs.writeTextFile {
|
||||
name = "kernel-params";
|
||||
text = lib.concatStringsSep " " config.boot.kernelParams;
|
||||
})
|
||||
]
|
||||
else
|
||||
[
|
||||
"--refresh"
|
||||
"--flake ${cfg.flake}"
|
||||
]
|
||||
);
|
||||
++ config.system.switch.inhibitors;
|
||||
|
||||
systemd.services.nixos-upgrade = {
|
||||
description = "NixOS Upgrade";
|
||||
systemBuilderCommands = ''
|
||||
ln -s ${config.system.build.rebootTriggers} $out/reboot-triggers
|
||||
'';
|
||||
|
||||
restartIfChanged = false;
|
||||
unitConfig.X-StopOnRemoval = false;
|
||||
unitConfig.OnSuccess = lib.optional (
|
||||
cfg.runGarbageCollection && config.nix.enable
|
||||
) "nix-gc.service";
|
||||
build.rebootTriggers = pkgs.writeTextFile {
|
||||
name = "reboot-triggers";
|
||||
text = lib.concatMapStringsSep "\n" (drv: drv.outPath) config.system.autoUpgrade.rebootTriggers;
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
serviceConfig.Type = "oneshot";
|
||||
|
||||
environment =
|
||||
config.nix.envVars
|
||||
// {
|
||||
inherit (config.environment.sessionVariables) NIX_PATH;
|
||||
HOME = "/root";
|
||||
(lib.mkIf cfg.enable {
|
||||
assertions = [
|
||||
{
|
||||
assertion = !((cfg.channel != null) && (cfg.flake != null));
|
||||
message = ''
|
||||
The options 'system.autoUpgrade.channel' and 'system.autoUpgrade.flake' cannot both be set.
|
||||
'';
|
||||
}
|
||||
{
|
||||
assertion = (cfg.runGarbageCollection -> config.nix.enable);
|
||||
message = ''
|
||||
The option 'system.autoUpgrade.runGarbageCollection = true' requires 'nix.enable = true'.
|
||||
'';
|
||||
}
|
||||
// config.networking.proxy.envVars;
|
||||
|
||||
path = with pkgs; [
|
||||
coreutils
|
||||
gnutar
|
||||
xz.bin
|
||||
gzip
|
||||
gitMinimal
|
||||
config.nix.package.out
|
||||
config.programs.ssh.package
|
||||
];
|
||||
|
||||
script =
|
||||
let
|
||||
nixos-rebuild = "${config.system.build.nixos-rebuild}/bin/nixos-rebuild";
|
||||
date = "${pkgs.coreutils}/bin/date";
|
||||
readlink = "${pkgs.coreutils}/bin/readlink";
|
||||
shutdown = "${config.systemd.package}/bin/shutdown";
|
||||
upgradeFlag = lib.optional (cfg.channel == null && cfg.upgrade) "--upgrade";
|
||||
in
|
||||
if cfg.allowReboot then
|
||||
''
|
||||
${nixos-rebuild} boot ${toString (cfg.flags ++ upgradeFlag)}
|
||||
booted="$(${readlink} /run/booted-system/{initrd,kernel,kernel-modules})"
|
||||
built="$(${readlink} /nix/var/nix/profiles/system/{initrd,kernel,kernel-modules})"
|
||||
|
||||
${lib.optionalString (cfg.rebootWindow != null) ''
|
||||
current_time="$(${date} +%H:%M)"
|
||||
|
||||
lower="${cfg.rebootWindow.lower}"
|
||||
upper="${cfg.rebootWindow.upper}"
|
||||
|
||||
if [[ "''${lower}" < "''${upper}" ]]; then
|
||||
if [[ "''${current_time}" > "''${lower}" ]] && \
|
||||
[[ "''${current_time}" < "''${upper}" ]]; then
|
||||
do_reboot="true"
|
||||
else
|
||||
do_reboot="false"
|
||||
fi
|
||||
else
|
||||
# lower > upper, so we are crossing midnight (e.g. lower=23h, upper=6h)
|
||||
# we want to reboot if cur > 23h or cur < 6h
|
||||
if [[ "''${current_time}" < "''${upper}" ]] || \
|
||||
[[ "''${current_time}" > "''${lower}" ]]; then
|
||||
do_reboot="true"
|
||||
else
|
||||
do_reboot="false"
|
||||
fi
|
||||
fi
|
||||
''}
|
||||
|
||||
if [ "''${booted}" = "''${built}" ]; then
|
||||
${nixos-rebuild} ${cfg.operation} ${toString cfg.flags}
|
||||
${lib.optionalString (cfg.rebootWindow != null) ''
|
||||
elif [ "''${do_reboot}" != true ]; then
|
||||
echo "Outside of configured reboot window, skipping."
|
||||
''}
|
||||
else
|
||||
${shutdown} -r +1
|
||||
fi
|
||||
''
|
||||
system.autoUpgrade.flags = (
|
||||
if cfg.flake == null then
|
||||
[ "--no-build-output" ]
|
||||
++ lib.optionals (cfg.channel != null) [
|
||||
"-I"
|
||||
"nixpkgs=${cfg.channel}/nixexprs.tar.xz"
|
||||
]
|
||||
else
|
||||
''
|
||||
${nixos-rebuild} ${cfg.operation} ${toString (cfg.flags ++ upgradeFlag)}
|
||||
'';
|
||||
[
|
||||
"--refresh"
|
||||
"--flake ${cfg.flake}"
|
||||
]
|
||||
);
|
||||
|
||||
startAt = cfg.dates;
|
||||
systemd.services.nixos-upgrade = {
|
||||
description = "NixOS Upgrade";
|
||||
|
||||
after = [ "network-online.target" ];
|
||||
wants = [ "network-online.target" ];
|
||||
};
|
||||
restartIfChanged = false;
|
||||
unitConfig.X-StopOnRemoval = false;
|
||||
unitConfig.OnSuccess = lib.optional (
|
||||
cfg.runGarbageCollection && config.nix.enable
|
||||
) "nix-gc.service";
|
||||
|
||||
systemd.timers.nixos-upgrade = {
|
||||
timerConfig = {
|
||||
RandomizedDelaySec = cfg.randomizedDelaySec;
|
||||
FixedRandomDelay = cfg.fixedRandomDelay;
|
||||
Persistent = cfg.persistent;
|
||||
serviceConfig.Type = "oneshot";
|
||||
|
||||
environment =
|
||||
config.nix.envVars
|
||||
// {
|
||||
inherit (config.environment.sessionVariables) NIX_PATH;
|
||||
HOME = "/root";
|
||||
}
|
||||
// config.networking.proxy.envVars;
|
||||
|
||||
path = with pkgs; [
|
||||
coreutils
|
||||
gnutar
|
||||
xz.bin
|
||||
gzip
|
||||
gitMinimal
|
||||
config.nix.package.out
|
||||
config.programs.ssh.package
|
||||
config.system.build.nixos-rebuild
|
||||
config.systemd.package
|
||||
];
|
||||
|
||||
script =
|
||||
let
|
||||
upgradeFlag = lib.optional (cfg.channel == null && cfg.flake == null) "--upgrade";
|
||||
in
|
||||
if cfg.allowReboot then
|
||||
# bash
|
||||
''
|
||||
echo "Running nixos-rebuild boot..."
|
||||
new_configuration="$(
|
||||
# For some reason we still get a newline here in the journal between the
|
||||
# nixos-rebuild stderr output and us echoing the store path that was
|
||||
# printed on stdout.
|
||||
# This might have to do with the particular way in which systemd handles
|
||||
# stdout/stderr, they are unix sockets and not normal streams.
|
||||
store_path="$(nixos-rebuild boot ${toString (cfg.flags ++ upgradeFlag)})"
|
||||
echo "$store_path" >&2
|
||||
echo "$store_path"
|
||||
)"
|
||||
if [ -z "$new_configuration" ]; then
|
||||
echo "Looks like nixos-rebuild failed... Aborting"
|
||||
exit 1
|
||||
fi
|
||||
echo "New configuration is $new_configuration"
|
||||
switch_to_new_configuration="$new_configuration"/bin/switch-to-configuration
|
||||
|
||||
${lib.optionalString (cfg.rebootWindow != null) # bash
|
||||
''
|
||||
current_time="$(date +%H:%M)"
|
||||
|
||||
lower="${cfg.rebootWindow.lower}"
|
||||
upper="${cfg.rebootWindow.upper}"
|
||||
|
||||
if [[ "''${lower}" < "''${upper}" ]]; then
|
||||
if [[ "''${current_time}" > "''${lower}" ]] && [[ "''${current_time}" < "''${upper}" ]]; then
|
||||
do_reboot="true"
|
||||
else
|
||||
do_reboot="false"
|
||||
fi
|
||||
else
|
||||
# lower > upper, so we are crossing midnight (e.g. lower=23h, upper=6h)
|
||||
# we want to reboot if cur > 23h or cur < 6h
|
||||
if [[ "''${current_time}" < "''${upper}" ]] || [[ "''${current_time}" > "''${lower}" ]]; then
|
||||
do_reboot="true"
|
||||
else
|
||||
do_reboot="false"
|
||||
fi
|
||||
fi
|
||||
''
|
||||
}
|
||||
|
||||
booted_triggers="$(realpath /run/booted-system)/reboot-triggers"
|
||||
booted_triggers_sha="$(
|
||||
if [ -f "$booted_triggers" ]; then
|
||||
sha256sum - < "$booted_triggers"
|
||||
else
|
||||
echo 'none'
|
||||
fi
|
||||
)"
|
||||
|
||||
new_triggers="$(realpath "$new_configuration")/reboot-triggers"
|
||||
new_triggers_sha="$(
|
||||
if [ -f "$new_triggers" ]; then
|
||||
sha256sum - < "$new_triggers"
|
||||
else
|
||||
echo 'none'
|
||||
fi
|
||||
)"
|
||||
|
||||
${lib.optionalString (cfg.operation == "switch") # bash
|
||||
''
|
||||
echo "Running switch-to-configuration check..."
|
||||
if "$switch_to_new_configuration" check; then
|
||||
echo "Checking reboot triggers..."
|
||||
if [ "$new_triggers_sha" == "$booted_triggers_sha" ]; then
|
||||
echo "Switching into the new generation..."
|
||||
"$switch_to_new_configuration" ${cfg.operation}
|
||||
exit 0
|
||||
fi
|
||||
fi
|
||||
''
|
||||
}
|
||||
${lib.optionalString (cfg.rebootWindow != null) # bash
|
||||
''
|
||||
if [ "''${do_reboot}" != true ]; then
|
||||
echo "Outside of configured reboot window, skipping."
|
||||
exit 0
|
||||
fi
|
||||
''
|
||||
}
|
||||
echo "Scheduling a reboot to activate the new generation"
|
||||
systemctl reboot --when="+2min"
|
||||
''
|
||||
else
|
||||
# bash
|
||||
''
|
||||
nixos-rebuild ${cfg.operation} ${toString (cfg.flags ++ upgradeFlag)}
|
||||
'';
|
||||
|
||||
startAt = cfg.dates;
|
||||
|
||||
after = [ "network-online.target" ];
|
||||
wants = [ "network-online.target" ];
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
systemd.timers.nixos-upgrade = {
|
||||
timerConfig = {
|
||||
RandomizedDelaySec = cfg.randomizedDelaySec;
|
||||
FixedRandomDelay = cfg.fixedRandomDelay;
|
||||
Persistent = cfg.persistent;
|
||||
};
|
||||
};
|
||||
})
|
||||
|
||||
];
|
||||
}
|
||||
|
||||
+12
-12
@@ -290,23 +290,23 @@ in
|
||||
testScript = ''
|
||||
start_all()
|
||||
|
||||
server.wait_for_unit("sshd", timeout=30)
|
||||
server_allowed_users.wait_for_unit("sshd", timeout=30)
|
||||
server_localhost_only.wait_for_unit("sshd", timeout=30)
|
||||
server_match_rule.wait_for_unit("sshd", timeout=30)
|
||||
server_no_openssl.wait_for_unit("sshd", timeout=30)
|
||||
server_no_pam.wait_for_unit("sshd", timeout=30)
|
||||
server_null_pam.wait_for_unit("sshd", timeout=30)
|
||||
server.wait_for_unit("sshd", timeout=60)
|
||||
server_allowed_users.wait_for_unit("sshd", timeout=60)
|
||||
server_localhost_only.wait_for_unit("sshd", timeout=60)
|
||||
server_match_rule.wait_for_unit("sshd", timeout=60)
|
||||
server_no_openssl.wait_for_unit("sshd", timeout=60)
|
||||
server_no_pam.wait_for_unit("sshd", timeout=60)
|
||||
server_null_pam.wait_for_unit("sshd", timeout=60)
|
||||
server_null_pam.fail("journalctl -u sshd.service | grep 'Unsupported option UsePAM'")
|
||||
server_sftp.wait_for_unit("sshd", timeout=30)
|
||||
server_sftp.wait_for_unit("sshd", timeout=60)
|
||||
|
||||
server_lazy.wait_for_unit("sshd.socket", timeout=30)
|
||||
server_localhost_only_lazy.wait_for_unit("sshd.socket", timeout=30)
|
||||
server_lazy_socket.wait_for_unit("sshd.socket", timeout=30)
|
||||
server_lazy.wait_for_unit("sshd.socket", timeout=60)
|
||||
server_localhost_only_lazy.wait_for_unit("sshd.socket", timeout=60)
|
||||
server_lazy_socket.wait_for_unit("sshd.socket", timeout=60)
|
||||
|
||||
# sshd-keygen is a oneshot unit, so just wait for multi-user.target, which
|
||||
# pulls it in.
|
||||
server_no_sshd_with_key.wait_for_unit("multi-user.target", timeout=30)
|
||||
server_no_sshd_with_key.wait_for_unit("multi-user.target", timeout=60)
|
||||
|
||||
with subtest("manual-authkey"):
|
||||
client.succeed(
|
||||
|
||||
@@ -6,7 +6,7 @@
|
||||
};
|
||||
|
||||
nodes.machine =
|
||||
{ pkgs, ... }:
|
||||
{ pkgs, lib, ... }:
|
||||
{
|
||||
imports = [ ../modules/profiles/minimal.nix ];
|
||||
|
||||
@@ -46,6 +46,14 @@
|
||||
fi
|
||||
'';
|
||||
};
|
||||
|
||||
# Make sure we don't crash on long activation scripts
|
||||
specialisation.longscript.configuration = {
|
||||
system.activationScripts.long = {
|
||||
supportsDryActivation = true;
|
||||
text = lib.concatStringsSep "\n" (lib.genList (i: ''# line number ${toString i}'') 1000000);
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
testScript = # python
|
||||
|
||||
@@ -29,11 +29,11 @@
|
||||
|
||||
stdenv.mkDerivation (finalAttrs: {
|
||||
pname = "bind";
|
||||
version = "9.20.16";
|
||||
version = "9.20.17";
|
||||
|
||||
src = fetchurl {
|
||||
url = "https://downloads.isc.org/isc/bind9/${finalAttrs.version}/bind-${finalAttrs.version}.tar.xz";
|
||||
hash = "sha256-A//Mek/LfDm4KzS+G6K1n2wZG8eVxZNVMNXr5jCjUtY=";
|
||||
hash = "sha256-XMiaCdoJF+sd32QMwHwXL/RPqbvzo0raS2ovfucP8cg=";
|
||||
};
|
||||
|
||||
outputs = [
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
{
|
||||
lib,
|
||||
fetchFromGitHub,
|
||||
fetchpatch2,
|
||||
gitMinimal,
|
||||
makeBinaryWrapper,
|
||||
installShellFiles,
|
||||
@@ -20,16 +21,27 @@ let
|
||||
devenvNixVersion = "2.30.4";
|
||||
|
||||
devenv_nix =
|
||||
let
|
||||
components =
|
||||
(nixVersions.nixComponents_git.override { version = devenvNixVersion; }).overrideSource
|
||||
(fetchFromGitHub {
|
||||
owner = "cachix";
|
||||
repo = "nix";
|
||||
rev = "devenv-${devenvNixVersion}";
|
||||
hash = "sha256-3+GHIYGg4U9XKUN4rg473frIVNn8YD06bjwxKS1IPrU=";
|
||||
});
|
||||
in
|
||||
(
|
||||
(nixVersions.nixComponents_git.override { version = devenvNixVersion; })
|
||||
.nix-everything.overrideSource
|
||||
(fetchFromGitHub {
|
||||
owner = "cachix";
|
||||
repo = "nix";
|
||||
rev = "devenv-${devenvNixVersion}";
|
||||
hash = "sha256-3+GHIYGg4U9XKUN4rg473frIVNn8YD06bjwxKS1IPrU=";
|
||||
})
|
||||
).overrideAttrs
|
||||
# Support for mdbook >= 0.5, https://github.com/NixOS/nix/issues/14628
|
||||
components.appendPatches [
|
||||
(fetchpatch2 {
|
||||
name = "nix-2.30-14695-mdbook-0.5-support.patch";
|
||||
url = "https://github.com/NixOS/nix/commit/5cbd7856de0a9c13351f98e32a1e26d0854d87fd.patch";
|
||||
excludes = [ "doc/manual/package.nix" ];
|
||||
hash = "sha256-GYaTOG9wZT9UI4G6za535PkLyjHKSxwBjJsXbjmI26g=";
|
||||
})
|
||||
]
|
||||
).nix-everything.overrideAttrs
|
||||
(old: {
|
||||
pname = "devenv-nix";
|
||||
version = devenvNixVersion;
|
||||
|
||||
@@ -0,0 +1,16 @@
|
||||
--- a/book.toml
|
||||
+++ b/book.toml
|
||||
@@ -1,6 +1,5 @@
|
||||
[book]
|
||||
language = "en"
|
||||
-multilingual = false
|
||||
src = "book"
|
||||
title = "Engage"
|
||||
|
||||
@@ -8,5 +7,5 @@ build-dir = "public"
|
||||
|
||||
[output.html]
|
||||
-git-repository-icon = "fa-git-square"
|
||||
+git-repository-icon = "fab-square-git"
|
||||
git-repository-url = "https://gitlab.computer.surgery/charles/engage"
|
||||
|
||||
@@ -28,6 +28,11 @@ rustPlatform.buildRustPackage (finalAttrs: {
|
||||
hash = "sha256-n7ypFJBYT712Uzh1NnWWSOIpEDKR0e6sQxbiIN6pZgo=";
|
||||
};
|
||||
|
||||
patches = [
|
||||
# Support mdbook 0.5.x - remove deprecated multilingual field
|
||||
./mdbook-0.5-support.patch
|
||||
];
|
||||
|
||||
cargoHash = "sha256-UTIxxPBtxzsZilxriAT8ksl2ovoDzIhB+8f+b2cGN3k=";
|
||||
|
||||
nativeBuildInputs = [
|
||||
|
||||
@@ -0,0 +1,14 @@
|
||||
--- a/helix-term/src/commands.rs
|
||||
+++ b/helix-term/src/commands.rs
|
||||
@@ -424,9 +424,9 @@ impl MappableCommand {
|
||||
add_newline_below, "Add newline below",
|
||||
goto_type_definition, "Goto type definition",
|
||||
goto_implementation, "Goto implementation",
|
||||
- goto_file_start, "Goto line number <n> else file start",
|
||||
+ goto_file_start, "Goto line number <n> else file start",
|
||||
goto_file_end, "Goto file end",
|
||||
- extend_to_file_start, "Extend to line number<n> else file start",
|
||||
+ extend_to_file_start, "Extend to line number <n> else file start",
|
||||
extend_to_file_end, "Extend to file end",
|
||||
goto_file, "Goto files/URLs in selections",
|
||||
goto_file_hsplit, "Goto files in selections (hsplit)",
|
||||
@@ -1,5 +1,6 @@
|
||||
{
|
||||
fetchzip,
|
||||
fetchpatch,
|
||||
lib,
|
||||
rustPlatform,
|
||||
mdbook,
|
||||
@@ -25,6 +26,17 @@ rustPlatform.buildRustPackage (final: {
|
||||
stripRoot = false;
|
||||
};
|
||||
|
||||
patches = [
|
||||
# Support mdbook 0.5.x: escape HTML tags in command descriptions
|
||||
./mdbook-0.5-support.patch
|
||||
];
|
||||
|
||||
postPatch = ''
|
||||
# mdbook 0.5 uses asset hashing for CSS/JS files
|
||||
# Remove custom theme to use default mdbook theme with correct asset references
|
||||
rm -f book/theme/index.hbs
|
||||
'';
|
||||
|
||||
cargoHash = "sha256-Mf0nrgMk1MlZkSyUN6mlM5lmTcrOHn3xBNzmVGtApEU=";
|
||||
|
||||
nativeBuildInputs = [
|
||||
@@ -49,7 +61,7 @@ rustPlatform.buildRustPackage (final: {
|
||||
mkdir -p $out/share/{applications,icons/hicolor/256x256/apps}
|
||||
cp contrib/Helix.desktop $out/share/applications
|
||||
cp contrib/helix.png $out/share/icons/hicolor/256x256/apps
|
||||
cp -r book-html $doc/share/doc/$name
|
||||
cp -r ../book-html $doc/share/doc/$name
|
||||
'';
|
||||
|
||||
nativeInstallCheckInputs = [
|
||||
|
||||
@@ -10,13 +10,14 @@
|
||||
|
||||
rustPlatform.buildRustPackage {
|
||||
pname = "mdbook-cmdrun";
|
||||
version = "0.6.0-unstable-2024-04-15";
|
||||
version = "0.7.3-unstable-2025-12-22";
|
||||
|
||||
# mdbook 0.5 upgrade: https://github.com/FauconFan/mdbook-cmdrun/pull/23
|
||||
src = fetchFromGitHub {
|
||||
owner = "FauconFan";
|
||||
owner = "roberth";
|
||||
repo = "mdbook-cmdrun";
|
||||
rev = "d1fef67f100563c2a433b1f5dd5a71810db6b90d";
|
||||
hash = "sha256-Q2h64XCyDxLmmCNC3wTw81pBotaMEUjY5y0Oq6q20cQ=";
|
||||
rev = "3947c797d063352e0f983311c078430215cc1cca";
|
||||
hash = "sha256-0RkyMJ8tsnGcSD0ksGTGAyliH6AihVl0HEesljEmTH8=";
|
||||
};
|
||||
|
||||
nativeCheckInputs = [
|
||||
@@ -26,7 +27,7 @@ rustPlatform.buildRustPackage {
|
||||
util-linux # used by tests/regression/shell/input.md
|
||||
];
|
||||
|
||||
cargoHash = "sha256-C3Rg+WXHBA7KyUDFdhBz4mOm8CFH/f7UVA8KOLs9ClE=";
|
||||
cargoHash = "sha256-oUlH+z50a1FtzDADXfGKSYjauZGTok0bVMq718HLglY=";
|
||||
|
||||
meta = {
|
||||
description = "mdbook preprocessor to run arbitrary commands";
|
||||
|
||||
@@ -8,7 +8,7 @@
|
||||
installShellFiles,
|
||||
}:
|
||||
let
|
||||
version = "0.4.52";
|
||||
version = "0.5.1";
|
||||
in
|
||||
rustPlatform.buildRustPackage rec {
|
||||
inherit version;
|
||||
@@ -18,18 +18,10 @@ rustPlatform.buildRustPackage rec {
|
||||
owner = "rust-lang";
|
||||
repo = "mdBook";
|
||||
tag = "v${version}";
|
||||
hash = "sha256-a3GSMz1+8Ve5cp4x1NjBlsCU/wMC4Jl3/H9qx7+1XlI=";
|
||||
hash = "sha256-t7Qou3H6dlO97puWQGkPlyb0jjpGoYCrz041iZWWL/s=";
|
||||
};
|
||||
|
||||
cargoHash = "sha256-wvTixSVHXglJM+nBMulZNZKF8pZfNd2G8Z+1PlAWmpk=";
|
||||
|
||||
patches = [
|
||||
(fetchpatch2 {
|
||||
name = "fix-rust-1.91-tests.patch";
|
||||
url = "https://github.com/rust-lang/mdBook/commit/841c68d05e763b031524a2b4d679f033cd15e64c.patch?full_index=1";
|
||||
hash = "sha256-KDQhmFX2TWamtdyssFL69MP3vg9LABb+bF8/7vaFsew=";
|
||||
})
|
||||
];
|
||||
cargoHash = "sha256-bJr0u025syrP/LGgIbXD0mRvQrvnnOntiaAfr/9tQ90=";
|
||||
|
||||
nativeBuildInputs = [ installShellFiles ];
|
||||
|
||||
|
||||
@@ -16,18 +16,18 @@
|
||||
|
||||
rustPlatform.buildRustPackage (finalAttrs: {
|
||||
pname = "ruff";
|
||||
version = "0.14.9";
|
||||
version = "0.14.10";
|
||||
|
||||
src = fetchFromGitHub {
|
||||
owner = "astral-sh";
|
||||
repo = "ruff";
|
||||
tag = finalAttrs.version;
|
||||
hash = "sha256-2EuI11mdwxKry7d56Ua7ZEU7K0XMgIVHm1zSVoWLkzM=";
|
||||
hash = "sha256-YwgW3sjI3l3H9Tq2BO7yDOhiiaIy///xxj4UQYq39gI=";
|
||||
};
|
||||
|
||||
cargoBuildFlags = [ "--package=ruff" ];
|
||||
|
||||
cargoHash = "sha256-db45h6I5tCcPMbPGa/dV3eJ9CxCwnGShmHdg92AUhv0=";
|
||||
cargoHash = "sha256-NyNXR1PGds+GXAha9u4DglUyy7T+yqLjNpGnchYn6oc=";
|
||||
|
||||
nativeBuildInputs = [ installShellFiles ];
|
||||
|
||||
|
||||
@@ -17,13 +17,13 @@
|
||||
}:
|
||||
stdenv.mkDerivation (finalAttrs: {
|
||||
pname = "wolfssl-${variant}";
|
||||
version = "5.8.2";
|
||||
version = "5.8.4";
|
||||
|
||||
src = fetchFromGitHub {
|
||||
owner = "wolfSSL";
|
||||
repo = "wolfssl";
|
||||
tag = "v${finalAttrs.version}-stable";
|
||||
hash = "sha256-rWBfpI6tdpKvQA/XdazBvU5hzyai5PtKRBpM4iplZDU=";
|
||||
hash = "sha256-vfJKmDdM0r591t5GnuSS7NyiUYXCQOTKbWLVydB3N9s=";
|
||||
};
|
||||
|
||||
postPatch = ''
|
||||
|
||||
@@ -57,14 +57,14 @@ in
|
||||
|
||||
stdenv.mkDerivation rec {
|
||||
pname = "busybox";
|
||||
version = "1.36.1";
|
||||
version = "1.37.0";
|
||||
|
||||
# Note to whoever is updating busybox: please verify that:
|
||||
# nix-build pkgs/stdenv/linux/make-bootstrap-tools.nix -A test
|
||||
# still builds after the update.
|
||||
src = fetchurl {
|
||||
url = "https://busybox.net/downloads/${pname}-${version}.tar.bz2";
|
||||
sha256 = "sha256-uMwkyVdNgJ5yecO+NJeVxdXOtv3xnKcJ+AzeUOR94xQ=";
|
||||
sha256 = "sha256-MxHf8y50ZJn03w1d8E1+s5Y4LX4Qi7klDntRm4NwQ6Q=";
|
||||
};
|
||||
|
||||
hardeningDisable = [
|
||||
@@ -77,53 +77,9 @@ stdenv.mkDerivation rec {
|
||||
# necessary when it's run from the Nix store as <hash>-busybox during
|
||||
# stdenv bootstrap.
|
||||
./busybox-in-store.patch
|
||||
# libbb: sockaddr2str: ensure only printable characters are returned for the hostname part
|
||||
(fetchurl {
|
||||
name = "CVE-2022-28391.patch";
|
||||
url = "https://git.alpinelinux.org/aports/plain/main/busybox/0001-libbb-sockaddr2str-ensure-only-printable-characters-.patch?id=ed92963eb55bbc8d938097b9ccb3e221a94653f4";
|
||||
sha256 = "sha256-yviw1GV+t9tbHbY7YNxEqPi7xEreiXVqbeRyf8c6Awo=";
|
||||
})
|
||||
# nslookup: sanitize all printed strings with printable_string
|
||||
(fetchurl {
|
||||
name = "CVE-2022-28391.patch";
|
||||
url = "https://git.alpinelinux.org/aports/plain/main/busybox/0002-nslookup-sanitize-all-printed-strings-with-printable.patch?id=ed92963eb55bbc8d938097b9ccb3e221a94653f4";
|
||||
sha256 = "sha256-vl1wPbsHtXY9naajjnTicQ7Uj3N+EQ8pRNnrdsiow+w=";
|
||||
})
|
||||
# shell: avoid segfault on ${0::0/0~09J}
|
||||
# See also: https://bugs.busybox.net/show_bug.cgi?id=15216
|
||||
(fetchpatch {
|
||||
name = "CVE-2022-48174.patch";
|
||||
url = "https://git.busybox.net/busybox/patch/?id=d417193cf37ca1005830d7e16f5fa7e1d8a44209";
|
||||
hash = "sha256-mpDEwYncpU6X6tmtj9xM2KCrB/v2ys5bYxmPPrhm6es=";
|
||||
})
|
||||
# Make sure we don't read past the end of the string in next_token()
|
||||
# when backslash is the last character in an (invalid) regexp.
|
||||
# See also: https://bugs.busybox.net/show_bug.cgi?id=15874
|
||||
# This patch is also used by Alpine, see https://git.alpinelinux.org/aports/tree/main/busybox/0037-awk.c-fix-CVE-2023-42366-bug-15874.patch
|
||||
(fetchpatch {
|
||||
name = "CVE-2023-42366.patch";
|
||||
url = "https://bugs.busybox.net/attachment.cgi?id=9697";
|
||||
hash = "sha256-2eYfLZLjStea9apKXogff6sCAdG9yHx0ZsgUBaGfQIA=";
|
||||
})
|
||||
# awk: fix use after free (CVE-2023-42363)
|
||||
# See also: https://bugs.busybox.net/show_bug.cgi?id=15865
|
||||
(fetchpatch {
|
||||
name = "CVE-2023-42363.patch";
|
||||
url = "https://git.launchpad.net/ubuntu/+source/busybox/plain/debian/patches/CVE-2023-42363.patch?id=c9d8a323b337d58e302717d41796aa0242963d5a";
|
||||
hash = "sha256-1W9Q8+yFkYQKzNTrvndie8QuaEbyAFL1ZASG2fPF+Z4=";
|
||||
})
|
||||
# awk: fix ternary operator and precedence of =
|
||||
# See also: https://bugs.busybox.net/show_bug.cgi?id=15871 https://bugs.busybox.net/show_bug.cgi?id=15868
|
||||
(fetchpatch {
|
||||
name = "CVE-2023-42364_CVE-2023-42365.patch";
|
||||
url = "https://git.alpinelinux.org/aports/plain/main/busybox/CVE-2023-42364-CVE-2023-42365.patch?id=8a4bf5971168bf48201c05afda7bee0fbb188e13";
|
||||
hash = "sha256-nQPgT9eA1asCo38Z9X7LR9My0+Vz5YBPba3ARV3fWcc=";
|
||||
})
|
||||
# tar: fix TOCTOU symlink race condition
|
||||
(fetchurl {
|
||||
url = "https://git.alpinelinux.org/aports/plain/main/busybox/0001-tar-fix-TOCTOU-symlink-race-condition.patch?id=9e42dea5fba84a8afad1f1910b7d3884128a567e";
|
||||
hash = "sha256-GmXQhwB1/IPVjXXpGi5RjRvuGJgIMIb7lQKB63m306g=";
|
||||
})
|
||||
# Fix aarch64 build failure: sha1_process_block64_shaNI is x86-specific
|
||||
# https://lists.busybox.net/pipermail/busybox/2024-September/090943.html
|
||||
./fix-aarch64-sha1.patch
|
||||
]
|
||||
++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform) ./clang-cross.patch;
|
||||
|
||||
|
||||
@@ -0,0 +1,24 @@
|
||||
From upstream commit fixing aarch64 build failure
|
||||
|
||||
The sha1_process_block64_shaNI function is x86-specific and needs
|
||||
architecture guards to prevent undeclared function errors on ARM64
|
||||
and other non-x86 platforms.
|
||||
|
||||
This fixes the compile error: 'sha1_process_block64_shaNI' undeclared
|
||||
(first use in this function)
|
||||
|
||||
Reference: https://lists.busybox.net/pipermail/busybox/2024-September/090943.html
|
||||
Upstream patch: https://www.mail-archive.com/busybox@busybox.net/msg29511.html
|
||||
|
||||
--- a/libbb/hash_md5_sha.c
|
||||
+++ b/libbb/hash_md5_sha.c
|
||||
@@ -1313,7 +1313,9 @@ unsigned FAST_FUNC sha1_end(sha1_ctx_t *ctx, void *resbuf)
|
||||
hash_size = 8;
|
||||
if (ctx->process_block == sha1_process_block64
|
||||
#if ENABLE_SHA1_HWACCEL
|
||||
+# if defined(__GNUC__) && (defined(__i386__) || defined(__x86_64__))
|
||||
|| ctx->process_block == sha1_process_block64_shaNI
|
||||
+# endif
|
||||
#endif
|
||||
) {
|
||||
hash_size = 5;
|
||||
@@ -1328,6 +1328,14 @@ let
|
||||
HOTPLUG_PCI_ACPI = yes; # PCI hotplug using ACPI
|
||||
HOTPLUG_PCI_PCIE = yes; # PCI-Expresscard hotplug support
|
||||
|
||||
# Enable all available thermal governors
|
||||
THERMAL_GOV_BANG_BANG = yes;
|
||||
THERMAL_GOV_FAIR_SHARE = yes;
|
||||
THERMAL_GOV_POWER_ALLOCATOR = yes;
|
||||
THERMAL_GOV_STEP_WISE = yes;
|
||||
THERMAL_GOV_USER_SPACE = yes;
|
||||
DEVFREQ_THERMAL = yes;
|
||||
|
||||
# Enable AMD's ROCm GPU compute stack
|
||||
HSA_AMD = lib.mkIf stdenv.hostPlatform.is64bit yes;
|
||||
ZONE_DEVICE = lib.mkIf (
|
||||
@@ -1355,6 +1363,8 @@ let
|
||||
X86_PLATFORM_DRIVERS_DELL = lib.mkIf stdenv.hostPlatform.isx86 (whenAtLeast "5.12" yes);
|
||||
X86_PLATFORM_DRIVERS_HP = lib.mkIf stdenv.hostPlatform.isx86 (whenAtLeast "6.1" yes);
|
||||
|
||||
ARM64_PMEM = lib.mkIf stdenv.hostPlatform.isAarch64 yes;
|
||||
|
||||
LIRC = yes;
|
||||
|
||||
SCHED_CORE = whenAtLeast "5.14" yes;
|
||||
|
||||
@@ -31,6 +31,14 @@
|
||||
confDir ? "/etc",
|
||||
}:
|
||||
let
|
||||
# Support for mdbook >= 0.5, https://git.lix.systems/lix-project/lix/issues/1051
|
||||
lixMdbookPatch = fetchpatch2 {
|
||||
name = "lix-mdbook-0.5-support.patch";
|
||||
url = "https://git.lix.systems/lix-project/lix/commit/54df89f601b3b4502a5c99173c9563495265d7e7.patch";
|
||||
excludes = [ "package.nix" ];
|
||||
hash = "sha256-uu/SIG8fgVVWhsGxmszTPHwe4SQtLgbxdShOMKbeg2w=";
|
||||
};
|
||||
|
||||
makeLixScope =
|
||||
{
|
||||
attrName,
|
||||
@@ -223,6 +231,8 @@ lib.makeExtensible (
|
||||
url = "https://git.lix.systems/lix-project/lix/commit/b6d5670bcffebdd43352ea79b36135e35a8148d9.patch";
|
||||
hash = "sha256-f4s0TR5MhNMNM5TYLOR7K2/1rtZ389KDjTCKFVK0OcE=";
|
||||
})
|
||||
|
||||
lixMdbookPatch
|
||||
];
|
||||
};
|
||||
};
|
||||
@@ -246,6 +256,8 @@ lib.makeExtensible (
|
||||
inherit src;
|
||||
hash = "sha256-APm8m6SVEAO17BBCka13u85/87Bj+LePP7Y3zHA3Mpg=";
|
||||
};
|
||||
|
||||
patches = [ lixMdbookPatch ];
|
||||
};
|
||||
};
|
||||
|
||||
@@ -268,6 +280,8 @@ lib.makeExtensible (
|
||||
inherit src;
|
||||
hash = "sha256-APm8m6SVEAO17BBCka13u85/87Bj+LePP7Y3zHA3Mpg=";
|
||||
};
|
||||
|
||||
patches = [ lixMdbookPatch ];
|
||||
};
|
||||
};
|
||||
|
||||
|
||||
@@ -136,19 +136,34 @@ lib.makeExtensible (
|
||||
version = "2.28.5";
|
||||
hash = "sha256-oIfAHxO+BCtHXJXLHBnsKkGl1Pw+Uuq1PwNxl+lZ+Oc=";
|
||||
self_attribute_name = "nix_2_28";
|
||||
patches = [
|
||||
(fetchpatch2 {
|
||||
name = "nix-2.28-14764-mdbook-0.5-support.patch";
|
||||
url = "https://github.com/NixOS/nix/commit/5a64138e862fe364e751c5c286e8db8c466aaee7.patch";
|
||||
hash = "sha256-K5TNroqSRH9j7vSzWw/6/b19mu7q+J5XPTDvJ3xVWlE=";
|
||||
})
|
||||
];
|
||||
};
|
||||
|
||||
nixComponents_2_30 = nixDependencies.callPackage ./modular/packages.nix rec {
|
||||
version = "2.30.3";
|
||||
inherit maintainers teams;
|
||||
otherSplices = generateSplicesForNixComponents "nixComponents_2_30";
|
||||
src = fetchFromGitHub {
|
||||
owner = "NixOS";
|
||||
repo = "nix";
|
||||
tag = version;
|
||||
hash = "sha256-kBuwzMgIE9Tmve0Rpp+q+YCsE2mw9d62M/950ViWeJ0=";
|
||||
};
|
||||
};
|
||||
nixComponents_2_30 =
|
||||
(nixDependencies.callPackage ./modular/packages.nix rec {
|
||||
version = "2.30.3";
|
||||
inherit maintainers teams;
|
||||
otherSplices = generateSplicesForNixComponents "nixComponents_2_30";
|
||||
src = fetchFromGitHub {
|
||||
owner = "NixOS";
|
||||
repo = "nix";
|
||||
tag = version;
|
||||
hash = "sha256-kBuwzMgIE9Tmve0Rpp+q+YCsE2mw9d62M/950ViWeJ0=";
|
||||
};
|
||||
}).appendPatches
|
||||
[
|
||||
(fetchpatch2 {
|
||||
name = "nix-2.30-14695-mdbook-0.5-support.patch";
|
||||
url = "https://github.com/NixOS/nix/commit/5cbd7856de0a9c13351f98e32a1e26d0854d87fd.patch";
|
||||
hash = "sha256-w8WQfWxMtprDLoZUhrCm4zr6xZXKhoIirq3la0Y7/wU=";
|
||||
})
|
||||
];
|
||||
|
||||
nix_2_30 = addTests "nix_2_30" self.nixComponents_2_30.nix-everything;
|
||||
|
||||
@@ -165,39 +180,55 @@ lib.makeExtensible (
|
||||
};
|
||||
}).appendPatches
|
||||
(
|
||||
# issues on darwin: https://github.com/NixOS/nixpkgs/pull/468208#issuecomment-3626314109
|
||||
lib.optional stdenv.isLinux (fetchpatch2 {
|
||||
name = "nix-2.31-14240-sri-error-message.patch";
|
||||
url = "https://github.com/NixOS/nix/commit/56751b1cd2c4700c71c545f2246adf602c97fdf5.patch";
|
||||
hash = "sha256-CerSBAI+H2RqPp9jsCP0QIM2rZYx3yBZHVVUAztgc18=";
|
||||
})
|
||||
[
|
||||
(fetchpatch2 {
|
||||
name = "nix-2.31-14692-mdbook-0.5-support.patch";
|
||||
url = "https://github.com/NixOS/nix/commit/a4f5f365090980a6eeb2ef483e49c04bdefd71a8.patch";
|
||||
hash = "sha256-GOWZtHSzHovnD8iUknr61bo7y85i0BKdw3kVBGDfBX0=";
|
||||
})
|
||||
]
|
||||
++
|
||||
# issues on darwin: https://github.com/NixOS/nixpkgs/pull/468208#issuecomment-3626314109
|
||||
lib.optional stdenv.isLinux (fetchpatch2 {
|
||||
name = "nix-2.31-14240-sri-error-message.patch";
|
||||
url = "https://github.com/NixOS/nix/commit/56751b1cd2c4700c71c545f2246adf602c97fdf5.patch";
|
||||
hash = "sha256-CerSBAI+H2RqPp9jsCP0QIM2rZYx3yBZHVVUAztgc18=";
|
||||
})
|
||||
);
|
||||
|
||||
nix_2_31 = addTests "nix_2_31" self.nixComponents_2_31.nix-everything;
|
||||
|
||||
nixComponents_2_32 = nixDependencies.callPackage ./modular/packages.nix rec {
|
||||
version = "2.32.4";
|
||||
inherit (self.nix_2_31.meta) maintainers teams;
|
||||
otherSplices = generateSplicesForNixComponents "nixComponents_2_32";
|
||||
src = fetchFromGitHub {
|
||||
owner = "NixOS";
|
||||
repo = "nix";
|
||||
tag = version;
|
||||
hash = "sha256-8QYnRyGOTm3h/Dp8I6HCmQzlO7C009Odqyp28pTWgcY=";
|
||||
};
|
||||
};
|
||||
nixComponents_2_32 =
|
||||
(nixDependencies.callPackage ./modular/packages.nix rec {
|
||||
version = "2.32.4";
|
||||
inherit (self.nix_2_31.meta) maintainers teams;
|
||||
otherSplices = generateSplicesForNixComponents "nixComponents_2_32";
|
||||
src = fetchFromGitHub {
|
||||
owner = "NixOS";
|
||||
repo = "nix";
|
||||
tag = version;
|
||||
hash = "sha256-8QYnRyGOTm3h/Dp8I6HCmQzlO7C009Odqyp28pTWgcY=";
|
||||
};
|
||||
}).appendPatches
|
||||
[
|
||||
(fetchpatch2 {
|
||||
name = "nix-2.32-14693-mdbook-0.5-support.patch";
|
||||
url = "https://github.com/NixOS/nix/commit/ba5bede9f51f126b29aaa01a3170da281cef0231.patch";
|
||||
hash = "sha256-jY5fWnJSBfHRmB0RnBKeu3aYQ8wmDKYVqTj85cWVZRA=";
|
||||
})
|
||||
];
|
||||
|
||||
nix_2_32 = addTests "nix_2_32" self.nixComponents_2_32.nix-everything;
|
||||
|
||||
nixComponents_git = nixDependencies.callPackage ./modular/packages.nix rec {
|
||||
version = "2.33pre20251107_${lib.substring 0 8 src.rev}";
|
||||
version = "2.34pre20251217_${lib.substring 0 8 src.rev}";
|
||||
inherit maintainers teams;
|
||||
otherSplices = generateSplicesForNixComponents "nixComponents_git";
|
||||
src = fetchFromGitHub {
|
||||
owner = "NixOS";
|
||||
repo = "nix";
|
||||
rev = "479b6b73a9576452c14ca66b7f3cd4873969077e";
|
||||
hash = "sha256-eBjgsauQXFz2yeiNoPEzgkf7uyV+S8HYCQgZhPVx/9I=";
|
||||
rev = "b6add8dcc6f4f6feb1ce83aaffe4d7e660e6f616";
|
||||
hash = "sha256-2au7PdQ4HXSuktTPCtOJoD/LNjqMwbHIJmuzEYW1b7I=";
|
||||
};
|
||||
};
|
||||
|
||||
|
||||
Reference in New Issue
Block a user