simplesamlphp: remove
See https://github.com/NixOS/nixpkgs/pull/312251#issuecomment-3416076466 I think it's frankly careless to merge something into nixpkgs that's two patch-releases behind the current patch-level of the _legacy branch_ of a software. Especially for security-sensitive things. On top, this got never updated even though there are two high-rated CVEs in this, i.e. CVE-2025-27773[1] and CVE-2024-52596[2]. [1] https://github.com/advisories/GHSA-46r4-f8gj-xg56 [2] https://github.com/advisories/GHSA-2x65-fpch-2fcm
This commit is contained in:
Maximilian Bosch
@@ -178,7 +178,7 @@ The pre-existing `services.ankisyncd` has been marked deprecated and will be dro
|
||||
|
||||
- [Scrutiny](https://github.com/AnalogJ/scrutiny), a S.M.A.R.T monitoring tool for hard disks with a web frontend. Available as [services.scrutiny](#opt-services.scrutiny.enable).
|
||||
|
||||
- [SimpleSAMLphp](https://simplesamlphp.org/), an application written in native PHP that deals with authentication (SQL, .htpasswd, YubiKey, LDAP, PAPI, Radius). Available as [services.simplesamlphp](#opt-services.simplesamlphp).
|
||||
- [SimpleSAMLphp](https://simplesamlphp.org/), an application written in native PHP that deals with authentication (SQL, .htpasswd, YubiKey, LDAP, PAPI, Radius). Available as `services.simplesamlphp`.
|
||||
|
||||
- `systemd`'s `gateway`, `upload`, and `remote` services, which provide ways of sending journals across the network. Enable using [services.journald.gateway](#opt-services.journald.gateway.enable), [services.journald.upload](#opt-services.journald.upload.enable), and [services.journald.remote](#opt-services.journald.remote.enable).
|
||||
|
||||
|
||||
@@ -350,6 +350,8 @@
|
||||
|
||||
- `services.gitea` supports sending notifications with sendmail again. To do this, activate the parameter `services.gitea.mailerUseSendmail` and configure SMTP server.
|
||||
|
||||
- `simplesamlphp` has been removed since the package was severely outdated, unmaintained in nixpkgs and having known vulnerabilities.
|
||||
|
||||
- `networking.wireless.networks.<name>` now has an option to specify SSID, hence allowing duplicated SSID setup. The BSSID option is added along side with this.
|
||||
|
||||
- Revamp of the ACME certificate acquisication and renewal process to help scale systems with lots (100+) of certificates.
|
||||
|
||||
@@ -1704,7 +1704,6 @@
|
||||
./services/web-apps/shiori.nix
|
||||
./services/web-apps/sillytavern.nix
|
||||
./services/web-apps/silverbullet.nix
|
||||
./services/web-apps/simplesamlphp.nix
|
||||
./services/web-apps/slskd.nix
|
||||
./services/web-apps/snipe-it.nix
|
||||
./services/web-apps/snips-sh.nix
|
||||
|
||||
@@ -408,6 +408,9 @@ in
|
||||
services.postfixadmin has been removed since it was unmaintained in nixpkgs and the version
|
||||
available only supported PHP 8.1 which is EOL.
|
||||
'')
|
||||
(mkRemovedOptionModule [ "services" "simplesamlphp" ] ''
|
||||
services.simplesamlphp has been vulnerable and unmaintained in nixpkgs.
|
||||
'')
|
||||
# Do NOT add any option renames here, see top of the file
|
||||
];
|
||||
}
|
||||
|
||||
@@ -1,128 +0,0 @@
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
...
|
||||
}:
|
||||
let
|
||||
cfg = config.services.simplesamlphp;
|
||||
|
||||
format = pkgs.formats.php { finalVariable = "config"; };
|
||||
|
||||
generateConfig =
|
||||
opts:
|
||||
pkgs.runCommand "simplesamlphp-config" { } ''
|
||||
mkdir $out
|
||||
cp ${format.generate "config.php" opts.settings} $out/config.php
|
||||
cp ${format.generate "authsources.php" opts.authSources} $out/authsources.php
|
||||
'';
|
||||
in
|
||||
{
|
||||
meta = {
|
||||
maintainers = with lib.maintainers; [ nhnn ];
|
||||
};
|
||||
|
||||
options.services.simplesamlphp =
|
||||
with lib;
|
||||
mkOption {
|
||||
type = types.attrsOf (
|
||||
types.submodule (
|
||||
{ config, ... }:
|
||||
{
|
||||
options = {
|
||||
package = mkPackageOption pkgs "simplesamlphp" { };
|
||||
configureNginx = mkOption {
|
||||
type = types.bool;
|
||||
default = true;
|
||||
description = "Configure nginx as a reverse proxy for SimpleSAMLphp.";
|
||||
};
|
||||
phpfpmPool = mkOption {
|
||||
type = types.str;
|
||||
description = "The PHP-FPM pool that serves SimpleSAMLphp instance.";
|
||||
};
|
||||
localDomain = mkOption {
|
||||
type = types.str;
|
||||
description = "The domain serving your SimpleSAMLphp instance. This option modifies only /saml route.";
|
||||
};
|
||||
settings = mkOption {
|
||||
type = types.submodule {
|
||||
freeformType = format.type;
|
||||
options = {
|
||||
baseurlpath = mkOption {
|
||||
type = types.str;
|
||||
example = "https://filesender.example.com/saml/";
|
||||
description = "URL where SimpleSAMLphp can be reached.";
|
||||
};
|
||||
};
|
||||
};
|
||||
default = { };
|
||||
description = ''
|
||||
Configuration options used by SimpleSAMLphp.
|
||||
See [](https://simplesamlphp.org/docs/stable/simplesamlphp-install)
|
||||
for available options.
|
||||
'';
|
||||
};
|
||||
|
||||
authSources = mkOption {
|
||||
type = format.type;
|
||||
default = { };
|
||||
description = ''
|
||||
Auth sources options used by SimpleSAMLphp.
|
||||
'';
|
||||
};
|
||||
|
||||
libDir = mkOption {
|
||||
type = types.str;
|
||||
readOnly = true;
|
||||
description = ''
|
||||
Path to the SimpleSAMLphp library directory.
|
||||
'';
|
||||
};
|
||||
configDir = mkOption {
|
||||
type = types.str;
|
||||
readOnly = true;
|
||||
description = ''
|
||||
Path to the SimpleSAMLphp config directory.
|
||||
'';
|
||||
};
|
||||
};
|
||||
config = {
|
||||
libDir = "${config.package}/share/php/simplesamlphp/";
|
||||
configDir = "${generateConfig config}";
|
||||
};
|
||||
}
|
||||
)
|
||||
);
|
||||
default = { };
|
||||
description = "Instances of SimpleSAMLphp. This module is designed to work with already existing PHP-FPM pool and NGINX virtualHost.";
|
||||
};
|
||||
|
||||
config = lib.mkIf (cfg != { }) {
|
||||
services.phpfpm.pools = lib.mapAttrs' (
|
||||
phpfpmName: opts:
|
||||
lib.nameValuePair opts.phpfpmPool { phpEnv.SIMPLESAMLPHP_CONFIG_DIR = "${generateConfig opts}"; }
|
||||
) cfg;
|
||||
|
||||
services.nginx.virtualHosts = lib.mapAttrs' (
|
||||
phpfpmName: opts:
|
||||
lib.nameValuePair opts.localDomain (
|
||||
lib.mkIf opts.configureNginx {
|
||||
locations."^~ /saml/" = {
|
||||
alias = "${opts.package}/share/php/simplesamlphp/www/";
|
||||
extraConfig = ''
|
||||
location ~ ^(?<prefix>/saml)(?<phpfile>.+?\.php)(?<pathinfo>/.*)?$ {
|
||||
include ${pkgs.nginx}/conf/fastcgi.conf;
|
||||
fastcgi_split_path_info ^(.+\.php)(/.+)$;
|
||||
fastcgi_pass unix:${config.services.phpfpm.pools.${phpfpmName}.socket};
|
||||
fastcgi_intercept_errors on;
|
||||
fastcgi_param SCRIPT_FILENAME $document_root$phpfile;
|
||||
fastcgi_param SCRIPT_NAME /saml$phpfile;
|
||||
fastcgi_param PATH_INFO $pathinfo if_not_empty;
|
||||
}
|
||||
'';
|
||||
};
|
||||
}
|
||||
)
|
||||
) cfg;
|
||||
};
|
||||
}
|
||||
@@ -1,25 +0,0 @@
|
||||
{
|
||||
php,
|
||||
fetchFromGitHub,
|
||||
lib,
|
||||
}:
|
||||
php.buildComposerProject2 (finalAttrs: {
|
||||
pname = "simplesamlphp";
|
||||
version = "1.19.7";
|
||||
|
||||
src = fetchFromGitHub {
|
||||
owner = "simplesamlphp";
|
||||
repo = "simplesamlphp";
|
||||
tag = "v${finalAttrs.version}";
|
||||
hash = "sha256-Qmy9fuZq8MBqvYV6/u3Dg92pHHicuUhdNeB22u4hwwA=";
|
||||
};
|
||||
|
||||
vendorHash = "sha256-kFRvOxSfqlM+xzFFlEm9YrbQDOvC4AA0BtztFQ1xxDU=";
|
||||
|
||||
meta = {
|
||||
description = "Application written in native PHP that deals with authentication (SQL, .htpasswd, YubiKey, LDAP, PAPI, Radius)";
|
||||
homepage = "https://simplesamlphp.org";
|
||||
license = lib.licenses.lgpl21;
|
||||
maintainers = with lib.maintainers; [ nhnn ];
|
||||
};
|
||||
})
|
||||
@@ -2399,6 +2399,7 @@ mapAliases {
|
||||
signal-desktop-source = lib.warnOnInstantiate "'signal-desktop-source' is now exposed at 'signal-desktop'." signal-desktop; # Added 2025-04-16
|
||||
silc_server = throw "'silc_server' has been removed because it is unmaintained"; # Added 2025-05-12
|
||||
silc_client = throw "'silc_client' has been removed because it is unmaintained"; # Added 2025-05-12
|
||||
simplesamlphp = throw "'simplesamlphp' was removed because it was unmaintained in nixpkgs"; # Added 2025-10-17
|
||||
siproxd = throw "'siproxd' has been removed as it was unmaintained and incompatible with newer libosip versions"; # Added 2025-05-18
|
||||
sisco.lv2 = throw "'sisco.lv2' has been removed as it was unmaintained and broken"; # Added 2025-08-26
|
||||
sipwitch = throw "'sipwitch' has been removed because it has been marked as broken since at least November 2024."; # Added 2025-10-01
|
||||
|
||||
Reference in New Issue
Block a user