diff --git a/nixos/modules/programs/wayland/uwsm.nix b/nixos/modules/programs/wayland/uwsm.nix index 6216ba2345a1..2ed6a643f39a 100644 --- a/nixos/modules/programs/wayland/uwsm.nix +++ b/nixos/modules/programs/wayland/uwsm.nix @@ -24,6 +24,19 @@ let passthru.providedSessions = [ "${opts.name}-uwsm" ]; }; }); + + desktopEntries = lib.mapAttrsToList ( + name: value: + mk_uwsm_desktop_entry { + inherit name; + inherit (value) + prettyName + comment + binPath + extraArgs + ; + } + ) cfg.waylandCompositors; in { options.programs.uwsm = { @@ -126,18 +139,8 @@ in } (lib.mkIf (cfg.waylandCompositors != { }) { - environment.systemPackages = lib.mapAttrsToList ( - name: value: - mk_uwsm_desktop_entry { - inherit name; - inherit (value) - prettyName - comment - binPath - extraArgs - ; - } - ) cfg.waylandCompositors; + environment.systemPackages = desktopEntries; + services.displayManager.sessionPackages = desktopEntries; }) ] ); diff --git a/pkgs/applications/networking/mailreaders/thunderbird/packages.nix b/pkgs/applications/networking/mailreaders/thunderbird/packages.nix index 93433662a62a..68004fa0dd3d 100644 --- a/pkgs/applications/networking/mailreaders/thunderbird/packages.nix +++ b/pkgs/applications/networking/mailreaders/thunderbird/packages.nix @@ -79,8 +79,8 @@ rec { thunderbird-140 = common { applicationName = "Thunderbird ESR"; - version = "140.7.0esr"; - sha512 = "92746d87ca2d5a59082c25aa3c3a816e5bf24ae3e095f8ec478a60c5cd890faea392ff98b5b510cc9a89b155240dce9d06c7ddd0f17f564722acc65105fb6cd2"; + version = "140.7.1esr"; + sha512 = "2d0f61758b0428eb4eb8294c58d914e03842c9ad7685cd2eec26c723cc1491634f90fc9fcf5ad6d3f13738e141e96c692cd8ff1599869346e3247a0cae2349f4"; updateScript = callPackage ./update.nix { attrPath = "thunderbirdPackages.thunderbird-140"; diff --git a/pkgs/by-name/bi/bitrise/package.nix b/pkgs/by-name/bi/bitrise/package.nix index 016813052478..2e94da8ca781 100644 --- a/pkgs/by-name/bi/bitrise/package.nix +++ b/pkgs/by-name/bi/bitrise/package.nix @@ -6,13 +6,13 @@ }: buildGoModule (finalAttrs: { pname = "bitrise"; - version = "2.37.0"; + version = "2.38.0"; src = fetchFromGitHub { owner = "bitrise-io"; repo = "bitrise"; rev = "v${finalAttrs.version}"; - hash = "sha256-CxWFqrgj/oYsD3yBjR4fdh7FSAaGZnbC6OB9H1VH+m0="; + hash = "sha256-WF6+HgGePOvwdo1nU75ifnH8Fddk1vmSyNOOQER4awo="; }; # many tests rely on writable $HOME/.bitrise and require network access diff --git a/pkgs/by-name/ci/cilium-cli/package.nix b/pkgs/by-name/ci/cilium-cli/package.nix index df4adcea164d..93f58040b446 100644 --- a/pkgs/by-name/ci/cilium-cli/package.nix +++ b/pkgs/by-name/ci/cilium-cli/package.nix @@ -5,6 +5,7 @@ cilium-cli, fetchFromGitHub, installShellFiles, + writableTmpDirAsHomeHook, testers, }: @@ -21,6 +22,10 @@ buildGoModule (finalAttrs: { nativeBuildInputs = [ installShellFiles ]; + # Required to workaround install check error: + # 2022/06/25 10:36:22 Unable to start gops: mkdir /homeless-shelter: permission denied + nativeInstallCheckInputs = [ writableTmpDirAsHomeHook ]; + vendorHash = null; subPackages = [ "cmd/cilium" ]; @@ -31,10 +36,6 @@ buildGoModule (finalAttrs: { "-X=github.com/cilium/cilium/cilium-cli/defaults.CLIVersion=${finalAttrs.version}" ]; - # Required to workaround install check error: - # 2022/06/25 10:36:22 Unable to start gops: mkdir /homeless-shelter: permission denied - HOME = "$TMPDIR"; - postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) '' installShellCompletion --cmd cilium \ --bash <($out/bin/cilium completion bash) \ diff --git a/pkgs/by-name/db/dbus_java/package.nix b/pkgs/by-name/db/dbus_java/package.nix index ef558cba2a29..ac48e9a32479 100644 --- a/pkgs/by-name/db/dbus_java/package.nix +++ b/pkgs/by-name/db/dbus_java/package.nix @@ -15,11 +15,14 @@ stdenv.mkDerivation (finalAttrs: { url = "https://dbus.freedesktop.org/releases/dbus-java/dbus-java-${finalAttrs.version}.tar.gz"; sha256 = "0cyaxd8x6sxmi6pklkkx45j311a6w51fxl4jc5j3inc4cailwh5y"; }; - JAVA_HOME = jdk8; - JAVA = "${jdk8}/bin/java"; - PREFIX = "\${out}"; - JAVAUNIXLIBDIR = "${libmatthew_java}/lib/jni"; - JAVAUNIXJARDIR = "${libmatthew_java}/share/java"; + + env = { + JAVA_HOME = jdk8; + JAVA = "${jdk8}/bin/java"; + PREFIX = "\${out}"; + JAVAUNIXLIBDIR = "${libmatthew_java}/lib/jni"; + JAVAUNIXJARDIR = "${libmatthew_java}/share/java"; + }; buildInputs = [ gettext jdk8 diff --git a/pkgs/by-name/fl/flac/package.nix b/pkgs/by-name/fl/flac/package.nix index d8a654779866..93e57cc8952d 100644 --- a/pkgs/by-name/fl/flac/package.nix +++ b/pkgs/by-name/fl/flac/package.nix @@ -38,11 +38,13 @@ stdenv.mkDerivation (finalAttrs: { "-DBUILD_SHARED_LIBS=ON" ]; - CFLAGS = [ - "-O3" - "-funroll-loops" - ]; - CXXFLAGS = [ "-O3" ]; + env = { + CFLAGS = toString [ + "-O3" + "-funroll-loops" + ]; + CXXFLAGS = toString [ "-O3" ]; + }; patches = [ ./package.patch ]; doCheck = true; diff --git a/pkgs/by-name/fl/fluxcd/package.nix b/pkgs/by-name/fl/fluxcd/package.nix index c0d0a99cda63..dae3433021b1 100644 --- a/pkgs/by-name/fl/fluxcd/package.nix +++ b/pkgs/by-name/fl/fluxcd/package.nix @@ -5,6 +5,7 @@ installShellFiles, lib, stdenv, + writableTmpDirAsHomeHook, }: let @@ -46,11 +47,11 @@ buildGoModule rec { subPackages = [ "cmd/flux" ]; + nativeBuildInputs = [ installShellFiles ]; + # Required to workaround test error: # panic: mkdir /homeless-shelter: permission denied - HOME = "$TMPDIR"; - - nativeBuildInputs = [ installShellFiles ]; + nativeCheckInputs = [ writableTmpDirAsHomeHook ]; doInstallCheck = true; installCheckPhase = '' diff --git a/pkgs/by-name/gd/gdevelop/darwin.nix b/pkgs/by-name/gd/gdevelop/darwin.nix index 4f1a8d8000ff..d45719c855c8 100644 --- a/pkgs/by-name/gd/gdevelop/darwin.nix +++ b/pkgs/by-name/gd/gdevelop/darwin.nix @@ -18,7 +18,7 @@ stdenvNoCC.mkDerivation (finalAttrs: { src = fetchurl { url = "https://github.com/4ian/GDevelop/releases/download/v${version}/GDevelop-5-${version}-universal-mac.zip"; - hash = "sha256-zBUWAFsaa+GenaHDRYNlwMs3BmyOIQ3sr/YYCX1ytEE="; + hash = "sha256-qukv1lD17FW0IOjOcJeh8kt4O9cwK/wzNEH0+vdr6NA="; }; sourceRoot = "."; diff --git a/pkgs/by-name/gd/gdevelop/linux.nix b/pkgs/by-name/gd/gdevelop/linux.nix index d3bc3827566d..d899c0b9b443 100644 --- a/pkgs/by-name/gd/gdevelop/linux.nix +++ b/pkgs/by-name/gd/gdevelop/linux.nix @@ -13,7 +13,7 @@ let if stdenv.hostPlatform.system == "x86_64-linux" then fetchurl { url = "https://github.com/4ian/GDevelop/releases/download/v${version}/GDevelop-5-${version}.AppImage"; - hash = "sha256-1XmKHyUuNcY1efWKLSsEoh+dvSmzUFz3FaoO/iTD7QY="; + hash = "sha256-hElD8VUC17Q/1sMy+ASidhoY9svGNncDf7IUfKkFfZU="; } else throw "${pname}-${version} is not supported on ${stdenv.hostPlatform.system}"; diff --git a/pkgs/by-name/gd/gdevelop/package.nix b/pkgs/by-name/gd/gdevelop/package.nix index 9c5c3c14a568..c56285c63997 100644 --- a/pkgs/by-name/gd/gdevelop/package.nix +++ b/pkgs/by-name/gd/gdevelop/package.nix @@ -4,7 +4,7 @@ callPackage, }: let - version = "5.6.252"; + version = "5.6.257"; pname = "gdevelop"; meta = { description = "Graphical Game Development Studio"; diff --git a/pkgs/by-name/go/go2tv/package.nix b/pkgs/by-name/go/go2tv/package.nix index 9858e2247b94..f1e93e5b88b7 100644 --- a/pkgs/by-name/go/go2tv/package.nix +++ b/pkgs/by-name/go/go2tv/package.nix @@ -16,16 +16,16 @@ buildGoModule rec { pname = "go2tv" + lib.optionalString (!withGui) "-lite"; - version = "1.19.0"; + version = "2.0.2"; src = fetchFromGitHub { owner = "alexballas"; repo = "go2tv"; tag = "v${version}"; - hash = "sha256-aE40mS3wcZHQIPyE9YEv5tRkrz4nClF8Brsbt0M0jK4="; + hash = "sha256-oyd6H3U799el9xcte3mOJo0m2YQTZ/vZjFdM2F7Cha8="; }; - vendorHash = "sha256-jtQSAP/QiSeLn37bg2uapzMBYGo9QvuH4V2YgmPrDN8="; + vendorHash = "sha256-2eEB6yfWFD7X3+qQenRoMiyzHH9i/gDg0IuOo/gUBFw="; nativeBuildInputs = [ pkg-config ]; diff --git a/pkgs/by-name/hd/hdfview/package.nix b/pkgs/by-name/hd/hdfview/package.nix index d1a0a43f2c38..987d3ba3a6ac 100644 --- a/pkgs/by-name/hd/hdfview/package.nix +++ b/pkgs/by-name/hd/hdfview/package.nix @@ -40,8 +40,10 @@ stdenv.mkDerivation (finalAttrs: { stripJavaArchivesHook ]; - HDFLIBS = (hdf4.override { javaSupport = true; }).out; - HDF5LIBS = (hdf5.override { javaSupport = true; }).out; + env = { + HDFLIBS = (hdf4.override { javaSupport = true; }).out; + HDF5LIBS = (hdf5.override { javaSupport = true; }).out; + }; buildPhase = let diff --git a/pkgs/by-name/ho/hottext/package.nix b/pkgs/by-name/ho/hottext/package.nix index 02851dfb4af1..4519aaf47873 100644 --- a/pkgs/by-name/ho/hottext/package.nix +++ b/pkgs/by-name/ho/hottext/package.nix @@ -19,7 +19,7 @@ buildNimPackage (finalAttrs: { lockFile = ./lock.json; - HOTTEXT_FONT_PATH = "${gentium-plus}/share/fonts/truetype/GentiumPlus-Regular.ttf"; + env.HOTTEXT_FONT_PATH = "${gentium-plus}/share/fonts/truetype/GentiumPlus-Regular.ttf"; desktopItem = makeDesktopItem { categories = [ "Utility" ]; diff --git a/pkgs/by-name/ju/juledoc/package.nix b/pkgs/by-name/ju/juledoc/package.nix index 7b31a47ab73e..80582890e3f8 100644 --- a/pkgs/by-name/ju/juledoc/package.nix +++ b/pkgs/by-name/ju/juledoc/package.nix @@ -18,7 +18,7 @@ clangStdenv.mkDerivation (finalAttrs: { nativeBuildInputs = [ julec.hook ]; - JULE_OUT_NAME = "juledoc"; + env.JULE_OUT_NAME = "juledoc"; meta = { description = "Official documentation generator for the Jule programming language"; diff --git a/pkgs/by-name/ju/julefmt/package.nix b/pkgs/by-name/ju/julefmt/package.nix index c8902c3e3f73..10753f2d3bfa 100644 --- a/pkgs/by-name/ju/julefmt/package.nix +++ b/pkgs/by-name/ju/julefmt/package.nix @@ -18,7 +18,7 @@ clangStdenv.mkDerivation (finalAttrs: { nativeBuildInputs = [ julec.hook ]; - JULE_OUT_NAME = "julefmt"; + env.JULE_OUT_NAME = "julefmt"; meta = { description = "Official formatter tool for the Jule programming language"; diff --git a/pkgs/by-name/ku/kubevela/package.nix b/pkgs/by-name/ku/kubevela/package.nix index e74d1f37bb10..9f50e0c2b21b 100644 --- a/pkgs/by-name/ku/kubevela/package.nix +++ b/pkgs/by-name/ku/kubevela/package.nix @@ -2,13 +2,16 @@ buildGoModule, fetchFromGitHub, installShellFiles, + writableTmpDirAsHomeHook, lib, stdenv, testers, kubevela, nix-update-script, }: - +let + canGenerateShellCompletions = stdenv.buildPlatform.canExecute stdenv.hostPlatform; +in buildGoModule (finalAttrs: { pname = "kubevela"; version = "1.10.6"; @@ -32,17 +35,20 @@ buildGoModule (finalAttrs: { env.CGO_ENABLED = 0; - # Workaround for permission issue in shell completion - HOME = "$TMPDIR"; - installPhase = '' runHook preInstall install -Dm755 "$GOPATH/bin/cli" -T $out/bin/vela runHook postInstall ''; - nativeBuildInputs = [ installShellFiles ]; - postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) '' + nativeBuildInputs = [ + installShellFiles + ] + ++ lib.optionals canGenerateShellCompletions [ + writableTmpDirAsHomeHook # Workaround for permission issue in shell completion + ]; + + postInstall = lib.optionalString canGenerateShellCompletions '' installShellCompletion --cmd vela \ --bash <($out/bin/vela completion bash) \ --zsh <($out/bin/vela completion zsh) diff --git a/pkgs/by-name/lc/lcevcdec/package.nix b/pkgs/by-name/lc/lcevcdec/package.nix index b17ad0758b45..29cc69d434e3 100644 --- a/pkgs/by-name/lc/lcevcdec/package.nix +++ b/pkgs/by-name/lc/lcevcdec/package.nix @@ -14,7 +14,7 @@ stdenv.mkDerivation (finalAttrs: { pname = "lcevcdec"; - version = "4.0.4"; + version = "4.0.5"; outputs = [ "out" @@ -26,7 +26,7 @@ stdenv.mkDerivation (finalAttrs: { owner = "v-novaltd"; repo = "LCEVCdec"; tag = finalAttrs.version; - hash = "sha256-49ZDTYdsgv/RxUZlhIDrqJ3a3QCYA4pGG0QgOpKxzrI="; + hash = "sha256-Ib+2B9o9XUbiEqlP43jKYzvY2pzsFRaS/ZjMn1YgvHE="; }; postPatch = '' diff --git a/pkgs/by-name/le/leiningen/package.nix b/pkgs/by-name/le/leiningen/package.nix index a25997dd8283..01550fdb9768 100644 --- a/pkgs/by-name/le/leiningen/package.nix +++ b/pkgs/by-name/le/leiningen/package.nix @@ -22,7 +22,7 @@ stdenv.mkDerivation (finalAttrs: { hash = "sha256-tyGlc69jF4TyfMtS5xnm0Sh9nTlRrVbTFtOPfs+oGqI="; }; - JARNAME = "leiningen-${finalAttrs.version}-standalone.jar"; + env.JARNAME = "leiningen-${finalAttrs.version}-standalone.jar"; dontUnpack = true; diff --git a/pkgs/by-name/ns/nspr/package.nix b/pkgs/by-name/ns/nspr/package.nix index e23c676c7b0a..570e63c71779 100644 --- a/pkgs/by-name/ns/nspr/package.nix +++ b/pkgs/by-name/ns/nspr/package.nix @@ -33,7 +33,7 @@ stdenv.mkDerivation (finalAttrs: { substituteInPlace configure.in --replace '@executable_path/' "$out/lib/" ''; - HOST_CC = "cc"; + env.HOST_CC = "cc"; depsBuildBuild = [ buildPackages.stdenv.cc ]; configureFlags = [ "--enable-optimize" diff --git a/pkgs/by-name/op/open-scq30/package.nix b/pkgs/by-name/op/open-scq30/package.nix index 662da831b374..09a3392ab09c 100644 --- a/pkgs/by-name/op/open-scq30/package.nix +++ b/pkgs/by-name/op/open-scq30/package.nix @@ -45,7 +45,7 @@ rustPlatform.buildRustPackage (finalAttrs: { cargoHash = "sha256-3K+/CpTGWSjCRa2vOEcDvLIiZMdntugIqnzkXF4wkng="; - INSTALL_PREFIX = placeholder "out"; + env.INSTALL_PREFIX = placeholder "out"; # Requires headphones doCheck = false; diff --git a/pkgs/by-name/pk/pkl/package.nix b/pkgs/by-name/pk/pkl/package.nix index af961ce14aef..60cfea9cc871 100644 --- a/pkgs/by-name/pk/pkl/package.nix +++ b/pkgs/by-name/pk/pkl/package.nix @@ -67,7 +67,7 @@ stdenv.mkDerivation (finalAttrs: { gradleFlagsArray+=(-DcommitId=$(cat .commit-hash)) ''; - JAVA_TOOL_OPTIONS = "-Dfile.encoding=utf-8"; + env.JAVA_TOOL_OPTIONS = "-Dfile.encoding=utf-8"; __darwinAllowLocalNetworking = true; preCheck = '' diff --git a/pkgs/by-name/py/pyprland/package.nix b/pkgs/by-name/py/pyprland/package.nix index ab81f9b86b79..cf81bc3dbb1f 100644 --- a/pkgs/by-name/py/pyprland/package.nix +++ b/pkgs/by-name/py/pyprland/package.nix @@ -33,7 +33,7 @@ python3Packages.buildPythonApplication (finalAttrs: { ''; # NOTE: this is required for the imports check below to work properly - HYPRLAND_INSTANCE_SIGNATURE = "dummy"; + env.HYPRLAND_INSTANCE_SIGNATURE = "dummy"; pythonImportsCheck = [ "pyprland" diff --git a/pkgs/by-name/ra/ramalama/package.nix b/pkgs/by-name/ra/ramalama/package.nix index 563da582a999..7340223194f4 100644 --- a/pkgs/by-name/ra/ramalama/package.nix +++ b/pkgs/by-name/ra/ramalama/package.nix @@ -7,6 +7,7 @@ llama-cpp-vulkan, podman, withPodman ? true, + writableTmpDirAsHomeHook, # passthru ramalama, @@ -14,14 +15,14 @@ python3Packages.buildPythonApplication (finalAttrs: { pname = "ramalama"; - version = "0.15.0"; + version = "0.17.1"; pyproject = true; src = fetchFromGitHub { owner = "containers"; repo = "ramalama"; tag = "v${finalAttrs.version}"; - hash = "sha256-0R7y1PpAxXzSlhfOFHf3cWPzZ544fYVUL0w7jOFSuAU="; + hash = "sha256-BXUWNP3yxuDsL1gY28oWhlu+vTIezYpDbScUsOulyYA="; }; build-system = with python3Packages; [ @@ -31,6 +32,7 @@ python3Packages.buildPythonApplication (finalAttrs: { dependencies = with python3Packages; [ argcomplete + bcrypt pyyaml jsonschema jinja2 @@ -69,8 +71,10 @@ python3Packages.buildPythonApplication (finalAttrs: { ]; nativeCheckInputs = [ - python3Packages.pytestCheckHook podman + python3Packages.pytestCheckHook + python3Packages.requests + writableTmpDirAsHomeHook ]; preCheck = '' diff --git a/pkgs/by-name/ri/ripe-atlas-tools/package.nix b/pkgs/by-name/ri/ripe-atlas-tools/package.nix index ba682025e732..c4757dabb660 100644 --- a/pkgs/by-name/ri/ripe-atlas-tools/package.nix +++ b/pkgs/by-name/ri/ripe-atlas-tools/package.nix @@ -3,6 +3,7 @@ python3, fetchFromGitHub, installShellFiles, + writableTmpDirAsHomeHook, }: python3.pkgs.buildPythonApplication (finalAttrs: { @@ -61,6 +62,7 @@ python3.pkgs.buildPythonApplication (finalAttrs: { nativeCheckInputs = with python3.pkgs; [ pytestCheckHook + writableTmpDirAsHomeHook # for cache generation. ]; disabledTests = [ @@ -85,8 +87,6 @@ python3.pkgs.buildPythonApplication (finalAttrs: { "tests/test_docs.py" ]; - HOME = "$TMPDIR"; # for cache generation. - # Necessary because it confuse the tests when it does "from ripe.atlas.sagan import X" # version.py is used by Sphinx tests. preCheck = '' diff --git a/pkgs/by-name/sa/sailsd/package.nix b/pkgs/by-name/sa/sailsd/package.nix index f8245fb6e6aa..8b677c624364 100644 --- a/pkgs/by-name/sa/sailsd/package.nix +++ b/pkgs/by-name/sa/sailsd/package.nix @@ -30,7 +30,7 @@ stdenv.mkDerivation (finalAttrs: { libsailing ]; - INSTALL_PATH = "$(out)"; + env.INSTALL_PATH = "$(out)"; postUnpack = '' rmdir $sourceRoot/libsailing diff --git a/pkgs/by-name/ti/timelimit/package.nix b/pkgs/by-name/ti/timelimit/package.nix index 5fd1978e41ed..b80ff791acc0 100644 --- a/pkgs/by-name/ti/timelimit/package.nix +++ b/pkgs/by-name/ti/timelimit/package.nix @@ -20,8 +20,11 @@ stdenv.mkDerivation (finalAttrs: { doCheck = true; installFlags = [ "PREFIX=$(out)" ]; - INSTALL_PROGRAM = "install -m755"; - INSTALL_DATA = "install -m644"; + + env = { + INSTALL_PROGRAM = "install -m755"; + INSTALL_DATA = "install -m644"; + }; meta = { description = "Execute a command and terminates the spawned process after a given time with a given signal"; diff --git a/pkgs/by-name/tu/tunefish/package.nix b/pkgs/by-name/tu/tunefish/package.nix index f3144615ac35..06a460507de2 100644 --- a/pkgs/by-name/tu/tunefish/package.nix +++ b/pkgs/by-name/tu/tunefish/package.nix @@ -13,6 +13,7 @@ libxext, libxinerama, libxrandr, + writableTmpDirAsHomeHook, }: stdenv.mkDerivation (finalAttrs: { @@ -32,6 +33,7 @@ stdenv.mkDerivation (finalAttrs: { nativeBuildInputs = [ pkg-config python3 + writableTmpDirAsHomeHook # silences build warnings ]; buildInputs = [ @@ -52,9 +54,6 @@ stdenv.mkDerivation (finalAttrs: { "CONFIG=Release" ]; - # silences build warnings - HOME = "/build"; - postPatch = '' patchShebangs src/tunefish4/generate-lv2-ttl.py ''; diff --git a/pkgs/by-name/wi/wiimms-iso-tools/package.nix b/pkgs/by-name/wi/wiimms-iso-tools/package.nix index 5c6d35117502..703cbbf37f56 100644 --- a/pkgs/by-name/wi/wiimms-iso-tools/package.nix +++ b/pkgs/by-name/wi/wiimms-iso-tools/package.nix @@ -42,7 +42,7 @@ stdenv.mkDerivation (finalAttrs: { substituteInPlace Makefile --replace gcc "$CC" ''; - INSTALL_PATH = "$out"; + env.INSTALL_PATH = "$out"; installPhase = '' mkdir "$out" diff --git a/pkgs/by-name/xp/xpra/package.nix b/pkgs/by-name/xp/xpra/package.nix index ce558c18f38f..07094de10ae1 100644 --- a/pkgs/by-name/xp/xpra/package.nix +++ b/pkgs/by-name/xp/xpra/package.nix @@ -126,7 +126,12 @@ effectiveBuildPythonApplication rec { patchShebangs --build fs/bin/build_cuda_kernels.py ''; - INCLUDE_DIRS = "${pam}/include"; + env = { + # error: 'import_cairo' defined but not used + NIX_CFLAGS_COMPILE = "-Wno-error=unused-function"; + + INCLUDE_DIRS = "${pam}/include"; + }; nativeBuildInputs = [ clang @@ -224,9 +229,6 @@ effectiveBuildPythonApplication rec { ] ); - # error: 'import_cairo' defined but not used - env.NIX_CFLAGS_COMPILE = "-Wno-error=unused-function"; - setupPyBuildFlags = [ "--with-Xdummy" "--without-Xdummy_wrapper" diff --git a/pkgs/development/python-modules/django-cte/default.nix b/pkgs/development/python-modules/django-cte/default.nix index 7617efdf83a3..a12dc7f8b32a 100644 --- a/pkgs/development/python-modules/django-cte/default.nix +++ b/pkgs/development/python-modules/django-cte/default.nix @@ -10,14 +10,14 @@ buildPythonPackage rec { pname = "django-cte"; - version = "2.0.0"; + version = "3.0.0"; pyproject = true; src = fetchFromGitHub { owner = "dimagi"; repo = "django-cte"; tag = "v${version}"; - hash = "sha256-DPbvmxTh24gTGvqzBg1VVN1LHxhGc+r81RITCuyccfw="; + hash = "sha256-pXTnk3Z+6jiqq7Q2JTpHxZSNHaTRT3lAAeuHTQIuzBM="; }; build-system = [ diff --git a/pkgs/development/python-modules/hy/default.nix b/pkgs/development/python-modules/hy/default.nix index fc66a397da43..505f2800d634 100644 --- a/pkgs/development/python-modules/hy/default.nix +++ b/pkgs/development/python-modules/hy/default.nix @@ -24,7 +24,7 @@ buildPythonPackage rec { }; # https://github.com/hylang/hy/blob/1.0a4/get_version.py#L9-L10 - HY_VERSION = version; + env.HY_VERSION = version; build-system = [ setuptools ]; diff --git a/pkgs/development/python-modules/sphinx-favicon/default.nix b/pkgs/development/python-modules/sphinx-favicon/default.nix index c006ec3ca9d8..7ab23d9c8e36 100644 --- a/pkgs/development/python-modules/sphinx-favicon/default.nix +++ b/pkgs/development/python-modules/sphinx-favicon/default.nix @@ -10,14 +10,14 @@ buildPythonPackage rec { pname = "sphinx-favicon"; - version = "1.0.1"; + version = "1.1.0"; pyproject = true; src = fetchFromGitHub { owner = "tcmetzger"; repo = "sphinx-favicon"; tag = "v${version}"; - hash = "sha256-Arcjj+6WWuSfufh8oqrDyAtjp07j1JEuw2YlmFcfL3U="; + hash = "sha256-8zKG145BttlE8HYJ0H8O762TYC9KeIO8L9UfgNDs+i8="; }; build-system = [ diff --git a/pkgs/os-specific/linux/busybox/default.nix b/pkgs/os-specific/linux/busybox/default.nix index 745ac5770ff0..507fa59f3aee 100644 --- a/pkgs/os-specific/linux/busybox/default.nix +++ b/pkgs/os-specific/linux/busybox/default.nix @@ -3,6 +3,7 @@ lib, buildPackages, fetchurl, + fetchpatch, fetchFromGitLab, enableStatic ? stdenv.hostPlatform.isStatic, enableMinimal ? false, @@ -76,6 +77,19 @@ stdenv.mkDerivation rec { # Fix aarch64 build failure: sha1_process_block64_shaNI is x86-specific # https://lists.busybox.net/pipermail/busybox/2024-September/090943.html ./fix-aarch64-sha1.patch + # archival: disallow path traversals (CVE-2023-39810) + (fetchpatch { + name = "CVE-2023-39810.patch"; + url = "https://git.busybox.net/busybox/patch/?id=9a8796436b9b0641e13480811902ea2ac57881d3"; + hash = "sha256-pOARbCwiucrkNITBoOMpLF3GniYvJiyBeBi2/Aw2JY8="; + }) + # tar: strip unsafe hardlink components - GNU tar does the same + (fetchpatch { + name = "CVE-2026-26157_CVE-2026-26158.patch"; + url = "https://git.busybox.net/busybox/patch/?id=3fb6b31c716669e12f75a2accd31bb7685b1a1cb"; + excludes = [ "networking/httpd_ratelimit_cgi.c" ]; # New since release. + hash = "sha256-Msm9sDZrVx7ofunnvnTS73SPKUUpR3Tv5xZ/wBd+rts="; + }) ] ++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform) ./clang-cross.patch;