From 77d4f4feee0798084925a9b2affe6fa37dee97e8 Mon Sep 17 00:00:00 2001 From: Maximilian Bosch Date: Mon, 5 Jun 2023 22:39:51 +0200 Subject: [PATCH 01/10] discourse.assets: work around `cannot execute: required file not found` `yarn run patch-package` as `postinstall`-hook doesn't work because it has a shebang using `/usr/bin/env` which isn't available in the sandbox. Removing the postinstall hook and manually running this after `patchShebangs` appears to solve the issue. Relevant error log of the build error (`NIXPKGS_ALLOW_INSECURE=1 nix-build -A discourse.assets`) error /build/source/app/assets/javascripts/node_modules/discourse: Command failed. Exit code: 127 Command: patch-package Arguments: Directory: /build/source/app/assets/javascripts/node_modules/discourse Output: /bin/sh: line 1: /build/source/app/assets/javascripts/node_modules/.bin/patch-package: cannot execute: required file not found info Visit https://yarnpkg.com/en/docs/cli/install for documentation about this command. --- pkgs/servers/web-apps/discourse/default.nix | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/pkgs/servers/web-apps/discourse/default.nix b/pkgs/servers/web-apps/discourse/default.nix index b07425860bf5..394b775f3db2 100644 --- a/pkgs/servers/web-apps/discourse/default.nix +++ b/pkgs/servers/web-apps/discourse/default.nix @@ -39,6 +39,8 @@ , nodePackages , nodejs_16 , dart-sass-embedded +, jq +, moreutils , plugins ? [] }@args: @@ -225,6 +227,8 @@ let nodePackages.patch-package yarn nodejs_16 + jq + moreutils ]; outputs = [ "out" "javascripts" ]; @@ -266,10 +270,19 @@ let export SSL_CERT_FILE=${cacert}/etc/ssl/certs/ca-bundle.crt + find app/assets/javascripts -name package.json -print0 \ + | xargs -0 -I {} bash -c "jq 'del(.scripts.postinstall)' -r <{} | sponge {}" yarn install --offline --cwd app/assets/javascripts/discourse patchShebangs app/assets/javascripts/node_modules/ + # Run `patch-package` AFTER the corresponding shebang inside `.bin/patch-package` + # got patched. Otherwise this will fail with + # /bin/sh: line 1: /build/source/app/assets/javascripts/node_modules/.bin/patch-package: cannot execute: required file not found + pushd app/assets/javascripts &>/dev/null + yarn run patch-package + popd &>/dev/null + redis-server >/dev/null & initdb -A trust $NIX_BUILD_TOP/postgres >/dev/null From 2d677b222c63085d366befea7c55982f686f1ada Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Sat, 15 Jul 2023 10:52:16 +0000 Subject: [PATCH 02/10] minio: 2023-06-09T07-32-12Z -> 2023-07-11T21-29-34Z --- pkgs/servers/minio/default.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/servers/minio/default.nix b/pkgs/servers/minio/default.nix index 75492de079f4..da32029eb5ba 100644 --- a/pkgs/servers/minio/default.nix +++ b/pkgs/servers/minio/default.nix @@ -15,16 +15,16 @@ let in buildGoModule rec { pname = "minio"; - version = "2023-06-09T07-32-12Z"; + version = "2023-07-11T21-29-34Z"; src = fetchFromGitHub { owner = "minio"; repo = "minio"; rev = "RELEASE.${version}"; - sha256 = "sha256-YhABdJ+4KU/UGRukCR4iQ4ClHUz/icbIO/yd8rGIs48="; + sha256 = "sha256-H7JArZa7IivsH/vjEHLNUu8FQ8mDZ2tHqla+KBEQK4Y="; }; - vendorHash = "sha256-c2rB8Or4tt84caEmfbwcHCow3/fllk0mNW0R/MwB5Vg="; + vendorHash = "sha256-NpN6Ypb+9xPWf28AvY8v2QSN/P6VJuHPOGR5EJtN7W4="; doCheck = false; From 87478fdfdff0980ab8d14bc28940463c60abd436 Mon Sep 17 00:00:00 2001 From: Randy Eckenrode Date: Sat, 15 Jul 2023 10:58:26 -0600 Subject: [PATCH 03/10] nodejs: use a response file with llvm-ar nodejs produces a static archive in its `postInstall`. It detects if the `ar` is GNU ar and uses a response file. Otherwise, it adds the files individually. This is apparently very slow with `llvm-ar`, which Darwin now uses by default. Fortunately, `llvm-ar` also supports response files, so detect whether the `ar` is `llvm-ar` and use a response file. I tested the build on aarch64-darwin. `postInstall` took less than a minute to generate a 59 MiB static archive. Comparing to the build on master, the only difference between the two archives is `llvm-ar` zeroes out the dates, uids, and gids by default. Compared disassembly of the archives appeared identical. This fixes the timeouts on staging-next. #241951 https://hydra.nixos.org/build/227170390 --- pkgs/development/web/nodejs/nodejs.nix | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/pkgs/development/web/nodejs/nodejs.nix b/pkgs/development/web/nodejs/nodejs.nix index 75690367ec93..bd90641c16f2 100644 --- a/pkgs/development/web/nodejs/nodejs.nix +++ b/pkgs/development/web/nodejs/nodejs.nix @@ -160,9 +160,14 @@ let ${if stdenv.buildPlatform.isGnu then '' ar -cqs $libv8/lib/libv8.a @files '' else '' - cat files | while read -r file; do - ar -cqS $libv8/lib/libv8.a $file - done + # llvm-ar supports response files, so take advantage of it if it’s available. + if [ "$(basename $(readlink -f $(command -v ar)))" = "llvm-ar" ]; then + ar -cqs $libv8/lib/libv8.a @files + else + cat files | while read -r file; do + ar -cqS $libv8/lib/libv8.a $file + done + fi ''} popd From 999365be77c3fb2b91110c9bc61e1a71a1b59f5f Mon Sep 17 00:00:00 2001 From: Fabian Affolter Date: Sat, 15 Jul 2023 22:20:12 +0200 Subject: [PATCH 04/10] python311Packages.pyrainbird: 2.1.0 -> 3.0.0 Diff: https://github.com/allenporter/pyrainbird/compare/refs/tags/2.1.0...3.0.0 Changelog: https://github.com/allenporter/pyrainbird/releases/tag/3.0.0 --- pkgs/development/python-modules/pyrainbird/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/python-modules/pyrainbird/default.nix b/pkgs/development/python-modules/pyrainbird/default.nix index 79943bca137f..e602812a7678 100644 --- a/pkgs/development/python-modules/pyrainbird/default.nix +++ b/pkgs/development/python-modules/pyrainbird/default.nix @@ -22,7 +22,7 @@ buildPythonPackage rec { pname = "pyrainbird"; - version = "2.1.0"; + version = "3.0.0"; format = "setuptools"; disabled = pythonOlder "3.9"; @@ -31,7 +31,7 @@ buildPythonPackage rec { owner = "allenporter"; repo = pname; rev = "refs/tags/${version}"; - hash = "sha256-JTZtRh7Ecsq0DUpGt5AxAVnN79i/nppsEjoHWcpTOsM="; + hash = "sha256-G/mmM2lEQWJV+7uZHKECj1jnhTYbcOw9yCi4/9nRDuk="; }; postPatch = '' From 26e7964ad124b9ce910bd62e007887e807aafcdd Mon Sep 17 00:00:00 2001 From: toastal Date: Sun, 27 Nov 2022 20:25:49 +0700 Subject: [PATCH 05/10] lunarml: init at unstable-2023-06-25 --- .../development/compilers/lunarml/default.nix | 54 +++++++++++++++++++ pkgs/top-level/all-packages.nix | 2 + 2 files changed, 56 insertions(+) create mode 100644 pkgs/development/compilers/lunarml/default.nix diff --git a/pkgs/development/compilers/lunarml/default.nix b/pkgs/development/compilers/lunarml/default.nix new file mode 100644 index 000000000000..ff3122ce2198 --- /dev/null +++ b/pkgs/development/compilers/lunarml/default.nix @@ -0,0 +1,54 @@ +{ lib +, fetchFromGitHub +, stdenvNoCC +, mlton +, lua5_3 +}: + +let + pname = "lunarml"; +in +stdenvNoCC.mkDerivation { + inherit pname; + + version = "unstable-2023-06-25"; + + src = fetchFromGitHub { + owner = "minoki"; + repo = "LunarML"; + rev = "f58f90cf7a2f26340403245907ed183f6a12ab52"; + sha256 = "djHJfUAPplsejFW9L3fbwTeeWgvR+gKkI8TmwIh8n7E="; + }; + + outputs = [ "out" "doc" ]; + + nativeBuildInputs = [ + mlton + ]; + + nativeCheckInputs = [ + lua5_3 + ]; + + postBuild = '' + make -C thirdparty install + ''; + + doCheck = true; + + installPhase = '' + mkdir -p $doc/${pname} $out/{bin,lib} + cp -r bin $out + cp -r lib $out + cp -r doc/* README.* LICENSE* $doc/${pname} + cp -r example $doc/${pname} + ''; + + meta = { + description = "Standard ML compiler that produces Lua/JavaScript"; + homepage = "https://github.com/minoki/LunarML"; + license = lib.licenses.mit; + maintainers = with lib.maintainers; [ toastal ]; + platforms = mlton.meta.platforms; + }; +} diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index 4bc30d8e8e76..7428dffddf1d 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -16313,6 +16313,8 @@ with pkgs; inherit (darwin.apple_sdk.frameworks) CoreServices Security; }; + lunarml = callPackage ../development/compilers/lunarml { }; + manticore = callPackage ../development/compilers/manticore { }; marst = callPackage ../development/compilers/marst { }; From aa804347c4a6e2e13e44037dd5a733dd9348f0cd Mon Sep 17 00:00:00 2001 From: Fabian Affolter Date: Sun, 16 Jul 2023 08:32:05 +0200 Subject: [PATCH 06/10] python311Packages.pyrainbird: update disabled --- pkgs/development/python-modules/pyrainbird/default.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkgs/development/python-modules/pyrainbird/default.nix b/pkgs/development/python-modules/pyrainbird/default.nix index e602812a7678..a913923b2ce8 100644 --- a/pkgs/development/python-modules/pyrainbird/default.nix +++ b/pkgs/development/python-modules/pyrainbird/default.nix @@ -25,7 +25,7 @@ buildPythonPackage rec { version = "3.0.0"; format = "setuptools"; - disabled = pythonOlder "3.9"; + disabled = pythonOlder "3.10"; src = fetchFromGitHub { owner = "allenporter"; From e7059632c66003bc12d81559e471519a24481585 Mon Sep 17 00:00:00 2001 From: Colin Date: Thu, 13 Jul 2023 09:27:37 +0000 Subject: [PATCH 07/10] nixos/trust-dns: init Co-authored-by: Yt --- .../manual/release-notes/rl-2311.section.md | 2 + nixos/modules/module-list.nix | 1 + .../modules/services/networking/trust-dns.nix | 177 ++++++++++++++++++ 3 files changed, 180 insertions(+) create mode 100644 nixos/modules/services/networking/trust-dns.nix diff --git a/nixos/doc/manual/release-notes/rl-2311.section.md b/nixos/doc/manual/release-notes/rl-2311.section.md index abcfe1efee8d..5ccaa92914e1 100644 --- a/nixos/doc/manual/release-notes/rl-2311.section.md +++ b/nixos/doc/manual/release-notes/rl-2311.section.md @@ -24,6 +24,8 @@ - [Apache Guacamole](https://guacamole.apache.org/), a cross-platform, clientless remote desktop gateway. Available as [services.guacamole-server](#opt-services.guacamole-server.enable) and [services.guacamole-client](#opt-services.guacamole-client.enable) services. +- [trust-dns](https://trust-dns.org/), a Rust based DNS server built to be safe and secure from the ground up. Available as [services.trust-dns](#opt-services.trust-dns.enable). + ## Backward Incompatibilities {#sec-release-23.11-incompatibilities} - The `boot.loader.raspberryPi` options have been marked deprecated, with intent for removal for NixOS 24.11. They had a limited use-case, and do not work like people expect. They required either very old installs ([before mid-2019](https://github.com/NixOS/nixpkgs/pull/62462)) or customized builds out of scope of the standard and generic AArch64 support. That option set never supported the Raspberry Pi 4 family of devices. diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix index a20fbd69a2cb..97abbe219116 100644 --- a/nixos/modules/module-list.nix +++ b/nixos/modules/module-list.nix @@ -1059,6 +1059,7 @@ ./services/networking/tox-node.nix ./services/networking/toxvpn.nix ./services/networking/trickster.nix + ./services/networking/trust-dns.nix ./services/networking/tvheadend.nix ./services/networking/twingate.nix ./services/networking/ucarp.nix diff --git a/nixos/modules/services/networking/trust-dns.nix b/nixos/modules/services/networking/trust-dns.nix new file mode 100644 index 000000000000..a3b4d12479b4 --- /dev/null +++ b/nixos/modules/services/networking/trust-dns.nix @@ -0,0 +1,177 @@ +{ config, lib, pkgs, ... }: + +let + cfg = config.services.trust-dns; + toml = pkgs.formats.toml { }; + + configFile = toml.generate "trust-dns.toml" ( + lib.filterAttrsRecursive (_: v: v != null) cfg.settings + ); + + zoneType = lib.types.submodule ({ config, ... }: { + options = with lib; { + zone = mkOption { + type = types.str; + description = mdDoc '' + Zone name, like "example.com", "localhost", or "0.0.127.in-addr.arpa". + ''; + }; + zone_type = mkOption { + type = types.enum [ "Primary" "Secondary" "Hint" "Forward" ]; + default = "Primary"; + description = mdDoc '' + One of: + - "Primary" (the master, authority for the zone). + - "Secondary" (the slave, replicated from the primary). + - "Hint" (a cached zone with recursive resolver abilities). + - "Forward" (a cached zone where all requests are forwarded to another resolver). + + For more details about these zone types, consult the documentation for BIND, + though note that trust-dns supports only a subset of BIND's zone types: + + ''; + }; + file = mkOption { + type = types.either types.path types.str; + default = "${config.zone}.zone"; + defaultText = literalExpression ''"''${config.zone}.zone"''; + description = mdDoc '' + Path to the .zone file. + If not fully-qualified, this path will be interpreted relative to the `directory` option. + If omitted, defaults to the value of the `zone` option suffixed with ".zone". + ''; + }; + }; + }); +in +{ + meta.maintainers = with lib.maintainers; [ colinsane ]; + options = { + services.trust-dns = with lib; { + enable = mkEnableOption (lib.mdDoc "trust-dns"); + package = mkOption { + type = types.package; + default = pkgs.trust-dns; + defaultText = "pkgs.trust-dns"; + description = mdDoc '' + Trust-dns package to use. + Only `bin/named` need be provided: the other trust-dns utilities (client and resolver) are not needed. + ''; + }; + quiet = mkOption { + type = types.bool; + default = false; + description = mdDoc '' + Log ERROR level messages only. + This option is mutually exclusive with the `debug` option. + If neither `quiet` nor `debug` are enabled, logging defaults to the INFO level. + ''; + }; + debug = mkOption { + type = types.bool; + default = false; + description = mdDoc '' + Log DEBUG, INFO, WARN and ERROR messages. + This option is mutually exclusive with the `debug` option. + If neither `quiet` nor `debug` are enabled, logging defaults to the INFO level. + ''; + }; + settings = mkOption { + description = lib.mdDoc '' + Settings for trust-dns. The options enumerated here are not exhaustive. + Refer to upstream documentation for all available options: + - [Example settings](https://github.com/bluejekyll/trust-dns/blob/main/tests/test-data/test_configs/example.toml) + ''; + type = types.submodule { + freeformType = toml.type; + options = { + listen_addrs_ipv4 = mkOption { + type = types.listOf types.str; + default = [ "0.0.0.0" ]; + description = mdDoc '' + List of ipv4 addresses on which to listen for DNS queries. + ''; + }; + listen_addrs_ipv6 = mkOption { + type = types.listOf types.str; + default = lib.optional config.networking.enableIPv6 "::0"; + defaultText = literalExpression ''lib.optional config.networking.enableIPv6 "::0"''; + description = mdDoc '' + List of ipv6 addresses on which to listen for DNS queries. + ''; + }; + listen_port = mkOption { + type = types.port; + default = 53; + description = mdDoc '' + Port to listen on (applies to all listen addresses). + ''; + }; + directory = mkOption { + type = types.str; + default = "/var/lib/trust-dns"; + description = mdDoc '' + The directory in which trust-dns should look for .zone files, + whenever zones aren't specified by absolute path. + ''; + }; + zones = mkOption { + description = mdDoc "List of zones to serve."; + default = {}; + type = types.listOf (types.coercedTo types.str (zone: { inherit zone; }) zoneType); + }; + }; + }; + }; + }; + }; + + config = lib.mkIf cfg.enable { + systemd.services.trust-dns = { + description = "trust-dns Domain Name Server"; + unitConfig.Documentation = "https://trust-dns.org/"; + serviceConfig = { + ExecStart = + let + flags = (lib.optional cfg.debug "--debug") ++ (lib.optional cfg.quiet "--quiet"); + flagsStr = builtins.concatStringsSep " " flags; + in '' + ${cfg.package}/bin/named --config ${configFile} ${flagsStr} + ''; + Type = "simple"; + Restart = "on-failure"; + RestartSec = "10s"; + DynamicUser = true; + + StateDirectory = "trust-dns"; + ReadWritePaths = [ cfg.settings.directory ]; + + AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ]; + CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ]; + LockPersonality = true; + MemoryDenyWriteExecute = true; + NoNewPrivileges = true; + PrivateDevices = true; + PrivateMounts = true; + PrivateTmp = true; + ProtectClock = true; + ProtectControlGroups = true; + ProtectHome = true; + ProtectHostname = true; + ProtectKernelLogs = true; + ProtectKernelModules = true; + ProtectKernelTunables = true; + ProtectProc = "invisible"; + ProtectSystem = "full"; + RemoveIPC = true; + RestrictAddressFamilies = [ "AF_INET AF_INET6" ]; + RestrictNamespaces = true; + RestrictSUIDSGID = true; + SystemCallArchitectures = "native"; + SystemCallFilter = [ "@system-service" "~@privileged" "~@resources" ]; + }; + after = [ "network.target" ]; + wantedBy = [ "multi-user.target" ]; + }; + }; +} From 21c9f7de2240cdb2391591ae929f64501be33fa9 Mon Sep 17 00:00:00 2001 From: Daniel Quernheim Date: Thu, 13 Jul 2023 14:47:57 +0200 Subject: [PATCH 08/10] ocamlPackages.eio_main: depend on `eio_linux` instead of `uring` Otherwise, Eio falls back to using the POSIX backend or fails with "The io_uring backend was disabled at compile-time" --- pkgs/development/ocaml-modules/eio/main.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/ocaml-modules/eio/main.nix b/pkgs/development/ocaml-modules/eio/main.nix index 32a6affef0e0..def30f2a0597 100644 --- a/pkgs/development/ocaml-modules/eio/main.nix +++ b/pkgs/development/ocaml-modules/eio/main.nix @@ -3,7 +3,7 @@ , buildDunePackage , eio , eio_posix -, uring +, eio_linux }: buildDunePackage { @@ -18,6 +18,6 @@ buildDunePackage { propagatedBuildInputs = [ eio_posix ] ++ lib.optionals stdenv.isLinux [ - uring + eio_linux ]; } From e79b9009e62e5db5cbfa9c9db522a8548207c8a4 Mon Sep 17 00:00:00 2001 From: Maximilian Bosch Date: Sun, 16 Jul 2023 09:54:51 +0200 Subject: [PATCH 09/10] perlPackages.PLS: 0.897 -> 0.905 ChangeLog: https://github.com/FractalBoy/perl-language-server/releases/tag/server-0.905%2Fclient-v0.0.17 ChangeLog: https://github.com/FractalBoy/perl-language-server/releases/tag/0.902 ChangeLog: https://github.com/FractalBoy/perl-language-server/releases/tag/0.901 ChangeLog: https://github.com/FractalBoy/perl-language-server/releases/tag/server-0.900%2Fclient-v0.0.15 ChangeLog: https://github.com/FractalBoy/perl-language-server/releases/tag/server-0.899%2Fclient-v0.0.14 ChangeLog: https://github.com/FractalBoy/perl-language-server/releases/tag/server-0.898%2Fclient-v0.0.13 --- pkgs/top-level/perl-packages.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix index 3311de6b9de9..9df669ba3724 100644 --- a/pkgs/top-level/perl-packages.nix +++ b/pkgs/top-level/perl-packages.nix @@ -20006,10 +20006,10 @@ with self; { PLS = buildPerlPackage { pname = "PLS"; - version = "0.897"; + version = "0.905"; src = fetchurl { - url = "mirror://cpan/authors/id/M/MR/MREISNER/PLS-0.897.tar.gz"; - hash = "sha256-3dzDrSbSgjQJ9l2NPKfCc4o4FwPiiSG1Vm8d2aJV6Ag="; + url = "mirror://cpan/authors/id/M/MR/MREISNER/PLS-0.905.tar.gz"; + hash = "sha256-RVW1J5nBZBXDy/5eMB6gLKDrvDQhTH/lLx19ykUwLik="; }; propagatedBuildInputs = [ Future IOAsync PPI PPR PathTiny PerlCritic PerlTidy PodMarkdown URI ]; nativeBuildInputs = lib.optional stdenv.isDarwin shortenPerlShebang; From 9f57f0f31df8e35a40c2cbb3346f41c33cef8914 Mon Sep 17 00:00:00 2001 From: toastal Date: Thu, 13 Jul 2023 20:19:32 +0700 Subject: [PATCH 10/10] =?UTF-8?q?ocamlPackages.eio:=200.10=20=E2=86=92=200?= =?UTF-8?q?.11?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- pkgs/development/ocaml-modules/eio/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/ocaml-modules/eio/default.nix b/pkgs/development/ocaml-modules/eio/default.nix index c925928433a0..d474d365a113 100644 --- a/pkgs/development/ocaml-modules/eio/default.nix +++ b/pkgs/development/ocaml-modules/eio/default.nix @@ -18,14 +18,14 @@ buildDunePackage rec { pname = "eio"; - version = "0.10"; + version = "0.11"; minimalOCamlVersion = "5.0"; duneVersion = "3"; src = fetchurl { url = "https://github.com/ocaml-multicore/${pname}/releases/download/v${version}/${pname}-${version}.tbz"; - sha256 = "OQ94FFB7gTPWwl46Z6dC1zHHymYlKyh7H7DjrU0Q7sw="; + sha256 = "DDN0IHRWJjFneIb0/koC+Wcs7JQpf/hcLthU21uqcao="; }; propagatedBuildInputs = [