From 232e7b6df081108480e0a2c0a4df8db8f1e5f944 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= Date: Sun, 23 Feb 2025 17:57:03 +0100 Subject: [PATCH 01/56] nixos/vaultwarden: relax hardening when using sendmail --- .../services/security/vaultwarden/default.nix | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-) diff --git a/nixos/modules/services/security/vaultwarden/default.nix b/nixos/modules/services/security/vaultwarden/default.nix index 285dbc5d7046..613b81b297d2 100644 --- a/nixos/modules/services/security/vaultwarden/default.nix +++ b/nixos/modules/services/security/vaultwarden/default.nix @@ -65,6 +65,7 @@ let vaultwarden = cfg.package.override { inherit (cfg) dbBackend; }; + useSendmail = configEnv.USE_SENDMAIL or null == "true"; in { imports = [ @@ -236,10 +237,10 @@ in DevicePolicy = "closed"; LockPersonality = true; MemoryDenyWriteExecute = true; - NoNewPrivileges = true; - PrivateDevices = true; + NoNewPrivileges = !useSendmail; + PrivateDevices = !useSendmail; PrivateTmp = true; - PrivateUsers = true; + PrivateUsers = !useSendmail; ProcSubset = "pid"; ProtectClock = true; ProtectControlGroups = true; @@ -262,10 +263,13 @@ in inherit StateDirectory; StateDirectoryMode = "0700"; SystemCallArchitectures = "native"; - SystemCallFilter = [ - "@system-service" - "~@privileged" - ]; + SystemCallFilter = + [ + "@system-service" + ] + ++ lib.optionals (!useSendmail) [ + "~@privileged" + ]; Restart = "always"; UMask = "0077"; }; From eaec6a5eaffafa7929531f81a5c9df4995c439a5 Mon Sep 17 00:00:00 2001 From: thiloho <123883702+thiloho@users.noreply.github.com> Date: Mon, 24 Mar 2025 11:41:04 +0100 Subject: [PATCH 02/56] archtika: fix update script by passing src to passthru --- pkgs/by-name/ar/archtika/package.nix | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/ar/archtika/package.nix b/pkgs/by-name/ar/archtika/package.nix index c59c95e9516e..979126012985 100644 --- a/pkgs/by-name/ar/archtika/package.nix +++ b/pkgs/by-name/ar/archtika/package.nix @@ -9,13 +9,13 @@ }: let - version = "1.2.0"; + version = "1.2.1"; src = fetchFromGitHub { owner = "archtika"; repo = "archtika"; tag = "v${version}"; - hash = "sha256-ba9da7LqCE/e2lhRVHD7GOhwOj1fNTBbN/pARPMzIg4="; + hash = "sha256-GffYAtLs12v2Lt1WoKJOG5dZsmzDcySZKFBQwCT9nnY="; }; web = buildNpmPackage { @@ -50,7 +50,10 @@ symlinkJoin { api ]; - passthru.updateScript = nix-update-script { }; + passthru = { + inherit src; + updateScript = nix-update-script { }; + }; meta = { description = "Modern, performant and lightweight CMS"; From 6cc803093ca90f4f8885fb513eae10f4e44f5470 Mon Sep 17 00:00:00 2001 From: thiloho <123883702+thiloho@users.noreply.github.com> Date: Mon, 24 Mar 2025 11:45:34 +0100 Subject: [PATCH 03/56] nixos/archtika: fix mkEnableOption naming --- nixos/modules/services/web-apps/archtika.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nixos/modules/services/web-apps/archtika.nix b/nixos/modules/services/web-apps/archtika.nix index cfd80dfb064f..0367d52451cb 100644 --- a/nixos/modules/services/web-apps/archtika.nix +++ b/nixos/modules/services/web-apps/archtika.nix @@ -17,7 +17,7 @@ let in { options.services.archtika = { - enable = mkEnableOption "Whether to enable the archtika service"; + enable = mkEnableOption "the archtika CMS"; package = mkPackageOption pkgs "archtika" { }; From 2c916c0352c301253c75233232673290f5db76ce Mon Sep 17 00:00:00 2001 From: thiloho <123883702+thiloho@users.noreply.github.com> Date: Mon, 24 Mar 2025 12:12:44 +0100 Subject: [PATCH 04/56] archtika: also pass web to passthru to update npmDepsHash --- pkgs/by-name/ar/archtika/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/ar/archtika/package.nix b/pkgs/by-name/ar/archtika/package.nix index 979126012985..51d948b6c7d3 100644 --- a/pkgs/by-name/ar/archtika/package.nix +++ b/pkgs/by-name/ar/archtika/package.nix @@ -21,7 +21,7 @@ let web = buildNpmPackage { name = "web-app"; src = "${src}/web-app"; - npmDepsHash = "sha256-RTyo7K/Hr1hBGtcBKynrziUInl91JqZl84NkJg16ufA="; + npmDepsHash = "sha256-2udi8vLLvdoZxIyRKLOCfEpEMsooxsIrM1wiua1QPAI="; npmFlags = [ "--legacy-peer-deps" ]; installPhase = '' mkdir -p $out/web-app @@ -51,7 +51,7 @@ symlinkJoin { ]; passthru = { - inherit src; + inherit src web; updateScript = nix-update-script { }; }; From e34de710576078bf6fef73c82f365a62bce7a679 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Simon=20=C5=BDlender?= Date: Sat, 29 Mar 2025 09:48:07 +0100 Subject: [PATCH 05/56] rdkafka: fix cross-compilation --- pkgs/by-name/rd/rdkafka/package.nix | 3 +++ 1 file changed, 3 insertions(+) diff --git a/pkgs/by-name/rd/rdkafka/package.nix b/pkgs/by-name/rd/rdkafka/package.nix index c07800cebd6d..104c967406ab 100644 --- a/pkgs/by-name/rd/rdkafka/package.nix +++ b/pkgs/by-name/rd/rdkafka/package.nix @@ -8,6 +8,7 @@ curl, cmake, ninja, + deterministic-host-uname, }: stdenv.mkDerivation (finalAttrs: { @@ -29,6 +30,8 @@ stdenv.mkDerivation (finalAttrs: { nativeBuildInputs = [ cmake ninja + # cross: build system uses uname to determine host system + deterministic-host-uname ]; buildInputs = [ From d5b45a40334e00d5dee76ff04ff68091ab93b24c Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Mon, 31 Mar 2025 01:47:47 +0000 Subject: [PATCH 06/56] kanata-with-cmd: 1.8.0 -> 1.8.1 --- pkgs/by-name/ka/kanata/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/ka/kanata/package.nix b/pkgs/by-name/ka/kanata/package.nix index e7521b252862..1b949d4efc1d 100644 --- a/pkgs/by-name/ka/kanata/package.nix +++ b/pkgs/by-name/ka/kanata/package.nix @@ -12,17 +12,17 @@ }: rustPlatform.buildRustPackage rec { pname = "kanata"; - version = "1.8.0"; + version = "1.8.1"; src = fetchFromGitHub { owner = "jtroo"; repo = "kanata"; rev = "v${version}"; - sha256 = "sha256-RTFP063NGNfjlOlZ4wghpcUQEmmj73Xlu3KPIxeUI/I="; + sha256 = "sha256-w/PeSqj51gJOWmAV5UPMprntdzinX/IL49D2ZUMfeSM="; }; useFetchCargoVendor = true; - cargoHash = "sha256-/r4u7pM7asCvG3LkbuP1Y63WVls1uZtV/L3cSOzUXr4="; + cargoHash = "sha256-T9fZxv3aujYparzVphfYBJ+5ti/T1VkeCeCqWPyllY8="; buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ apple-sdk_13 From 6a64f899e1a685bbb5e70135bb57452a72eb4f56 Mon Sep 17 00:00:00 2001 From: Paul Meyer Date: Tue, 1 Apr 2025 08:15:34 +0200 Subject: [PATCH 07/56] python3Packages.microsoft-security-utilities-secret-masker: 1.0.0b3 -> 1.0.0b4 Signed-off-by: Paul Meyer --- .../microsoft-security-utilities-secret-masker/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/python-modules/microsoft-security-utilities-secret-masker/default.nix b/pkgs/development/python-modules/microsoft-security-utilities-secret-masker/default.nix index ef2012371dd3..47b82bbac73c 100644 --- a/pkgs/development/python-modules/microsoft-security-utilities-secret-masker/default.nix +++ b/pkgs/development/python-modules/microsoft-security-utilities-secret-masker/default.nix @@ -8,13 +8,13 @@ buildPythonPackage rec { pname = "microsoft-security-utilities-secret-masker"; - version = "1.0.0b3"; + version = "1.0.0b4"; pyproject = true; src = fetchPypi { pname = "microsoft_security_utilities_secret_masker"; inherit version; - hash = "sha256-0EVIIwxno70stGCyjnH+bKwWj0jwbXapadnKR732c0M="; + hash = "sha256-owvTYawYyLUvaEQHa8JkZTNZSeqcegBNlfUZbsb97z4="; }; build-system = [ From 0fdc2760084db2b6159696f39d13beffd591feed Mon Sep 17 00:00:00 2001 From: Paul Meyer Date: Tue, 1 Apr 2025 08:16:25 +0200 Subject: [PATCH 08/56] python3Packages.azure-mgmt-containerservice: 34.1.0 -> 34.2.0 Signed-off-by: Paul Meyer --- .../python-modules/azure-mgmt-containerservice/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/python-modules/azure-mgmt-containerservice/default.nix b/pkgs/development/python-modules/azure-mgmt-containerservice/default.nix index b246540e020d..b43388a22be4 100644 --- a/pkgs/development/python-modules/azure-mgmt-containerservice/default.nix +++ b/pkgs/development/python-modules/azure-mgmt-containerservice/default.nix @@ -11,7 +11,7 @@ buildPythonPackage rec { pname = "azure-mgmt-containerservice"; - version = "34.1.0"; + version = "34.2.0"; pyproject = true; disabled = pythonOlder "3.8"; @@ -19,7 +19,7 @@ buildPythonPackage rec { src = fetchPypi { pname = "azure_mgmt_containerservice"; inherit version; - hash = "sha256-Y3ps+PBmNsAWrRUddvnHunW9BdQzSz3Xg364tRfzDb4="; + hash = "sha256-FB4F8UbyjNRiioMCfVFb0lPzsvhSO+Q7mEFwcRjvWoQ="; }; build-system = [ setuptools ]; From fff8479088ded41cbc59a0051efe4484a2d4ef66 Mon Sep 17 00:00:00 2001 From: Paul Meyer Date: Tue, 1 Apr 2025 08:16:59 +0200 Subject: [PATCH 09/56] python3Packages.azure-mgmt-keyvault: 10.3.1 -> 11.0.0 Signed-off-by: Paul Meyer --- .../python-modules/azure-mgmt-keyvault/default.nix | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/pkgs/development/python-modules/azure-mgmt-keyvault/default.nix b/pkgs/development/python-modules/azure-mgmt-keyvault/default.nix index 4213abd86353..eeaeb6fb85b3 100644 --- a/pkgs/development/python-modules/azure-mgmt-keyvault/default.nix +++ b/pkgs/development/python-modules/azure-mgmt-keyvault/default.nix @@ -11,14 +11,15 @@ buildPythonPackage rec { pname = "azure-mgmt-keyvault"; - version = "10.3.1"; + version = "11.0.0"; pyproject = true; disabled = pythonOlder "3.8"; src = fetchPypi { - inherit pname version; - hash = "sha256-NLkpVq773VccrloD9weOA32Ah7LADPpnSINdxzq7WjA="; + pname = "azure_mgmt_keyvault"; + inherit version; + hash = "sha256-/PsTZoUpJvKjEeG8bmp4brioof1G5gJdTBFO3iy0ZC4="; }; build-system = [ setuptools ]; From 2e0c384c45603051e69f0eba71e5590d6c620f4a Mon Sep 17 00:00:00 2001 From: Paul Meyer Date: Tue, 1 Apr 2025 08:17:25 +0200 Subject: [PATCH 10/56] python3Packages.azure-multiapi-storage: 1.3.0 -> 1.4.0 Signed-off-by: Paul Meyer --- .../python-modules/azure-multiapi-storage/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/python-modules/azure-multiapi-storage/default.nix b/pkgs/development/python-modules/azure-multiapi-storage/default.nix index 600b5e515259..17d1a30156c2 100644 --- a/pkgs/development/python-modules/azure-multiapi-storage/default.nix +++ b/pkgs/development/python-modules/azure-multiapi-storage/default.nix @@ -14,14 +14,14 @@ buildPythonPackage rec { pname = "azure-multiapi-storage"; - version = "1.3.0"; + version = "1.4.0"; pyproject = true; disabled = pythonOlder "3.9"; src = fetchPypi { inherit pname version; - hash = "sha256-tlKogIs39tIoMVl3p/YConfPdPrpX9oc9WqQ+FuhgQk="; + hash = "sha256-RfFd+1xL2ouWJ3NLXMcsRfQ215bi4ha+iCOcYXjND3E="; }; build-system = [ setuptools ]; From 5ea3b8d92e2ab477b455175419d3162fe8592b31 Mon Sep 17 00:00:00 2001 From: Paul Meyer Date: Tue, 1 Apr 2025 08:17:40 +0200 Subject: [PATCH 11/56] azure-cli: 2.70.0 -> 2.71.0 Signed-off-by: Paul Meyer --- pkgs/by-name/az/azure-cli/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/az/azure-cli/package.nix b/pkgs/by-name/az/azure-cli/package.nix index 36adc81b5c16..65f4d5153f02 100644 --- a/pkgs/by-name/az/azure-cli/package.nix +++ b/pkgs/by-name/az/azure-cli/package.nix @@ -26,14 +26,14 @@ }: let - version = "2.70.0"; + version = "2.71.0"; src = fetchFromGitHub { name = "azure-cli-${version}-src"; owner = "Azure"; repo = "azure-cli"; rev = "azure-cli-${version}"; - hash = "sha256-vvX/LkG8qA53AxVlvq7FSTqbVblvE5xbDq4V0SINCAk="; + hash = "sha256-vtuDgj3UJCmKxYg0OgG59ezQh7HlscNywz61BHDzJF8="; }; # put packages that needs to be overridden in the py package scope From e8dd02fe7906f53d57bf238dc178cdb80c8654ed Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Tue, 1 Apr 2025 12:39:53 +0000 Subject: [PATCH 12/56] rssguard: 4.8.1 -> 4.8.2 --- pkgs/applications/networking/feedreaders/rssguard/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/applications/networking/feedreaders/rssguard/default.nix b/pkgs/applications/networking/feedreaders/rssguard/default.nix index 4a4ecd52c73e..70c1f17bcfd1 100644 --- a/pkgs/applications/networking/feedreaders/rssguard/default.nix +++ b/pkgs/applications/networking/feedreaders/rssguard/default.nix @@ -9,13 +9,13 @@ stdenv.mkDerivation rec { pname = "rssguard"; - version = "4.8.1"; + version = "4.8.2"; src = fetchFromGitHub { owner = "martinrotter"; repo = pname; tag = version; - sha256 = "sha256-qWxcjGl4EaLXZ0q6RVy+IKyBcqlx/yYojlGivSXy5Io="; + sha256 = "sha256-C5iA5qK8+FhCUeFtyskY/vd4evaYS3TY1SHAc83/36w="; }; buildInputs = [ From e2fa2553f16654a38c92b7312e32ac6bb7a3f5b9 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Wed, 2 Apr 2025 01:07:06 +0000 Subject: [PATCH 13/56] mill: 0.12.9 -> 0.12.10 --- pkgs/by-name/mi/mill/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/mi/mill/package.nix b/pkgs/by-name/mi/mill/package.nix index 10dfb82e2190..105a0b306a7d 100644 --- a/pkgs/by-name/mi/mill/package.nix +++ b/pkgs/by-name/mi/mill/package.nix @@ -8,11 +8,11 @@ stdenv.mkDerivation (finalAttrs: { pname = "mill"; - version = "0.12.9"; + version = "0.12.10"; src = fetchurl { url = "https://repo1.maven.org/maven2/com/lihaoyi/mill-dist/${finalAttrs.version}/mill-dist-${finalAttrs.version}-assembly.jar"; - hash = "sha256-Ntqzivy8dfsRlBclPNsWOZ4h1Xk7D3UJV7GLVGIEcAU="; + hash = "sha256-TESwISFz4Xf/F4kgnaTQbi/uVrc75bearih8mydPqHM="; }; nativeBuildInputs = [ makeWrapper ]; From 96c25d43d417f2afd6845e6acf91850466b6c374 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Wed, 2 Apr 2025 19:03:32 +0000 Subject: [PATCH 14/56] plemoljp: 2.0.3 -> 2.0.4 --- pkgs/by-name/pl/plemoljp/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/pl/plemoljp/package.nix b/pkgs/by-name/pl/plemoljp/package.nix index ec13bfaaf936..59d92b848bab 100644 --- a/pkgs/by-name/pl/plemoljp/package.nix +++ b/pkgs/by-name/pl/plemoljp/package.nix @@ -6,11 +6,11 @@ stdenvNoCC.mkDerivation rec { pname = "plemoljp"; - version = "2.0.3"; + version = "2.0.4"; src = fetchzip { url = "https://github.com/yuru7/PlemolJP/releases/download/v${version}/PlemolJP_v${version}.zip"; - hash = "sha256-cT2BpD2PoAd38uYCQlq5fv9NYgwInblrYdK/XDEmOWI="; + hash = "sha256-pajE86IK05mm3Z507bvoMGy8JJwuGWZnUiSrXndiBTk="; }; installPhase = '' From d5477d94fc99bfed79faba3088df24f00874bc92 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Wed, 2 Apr 2025 19:03:43 +0000 Subject: [PATCH 15/56] plemoljp-hs: 2.0.3 -> 2.0.4 --- pkgs/by-name/pl/plemoljp-hs/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/pl/plemoljp-hs/package.nix b/pkgs/by-name/pl/plemoljp-hs/package.nix index bc736de3bf7c..20ec33ee1253 100644 --- a/pkgs/by-name/pl/plemoljp-hs/package.nix +++ b/pkgs/by-name/pl/plemoljp-hs/package.nix @@ -6,11 +6,11 @@ stdenvNoCC.mkDerivation rec { pname = "plemoljp-hs"; - version = "2.0.3"; + version = "2.0.4"; src = fetchzip { url = "https://github.com/yuru7/PlemolJP/releases/download/v${version}/PlemolJP_HS_v${version}.zip"; - hash = "sha256-rKWZMIK6TP6IV6KjFGuZE2S6IiMtjtHZeWM44tULduk="; + hash = "sha256-+pRbMgRaIbsXo8e7rQre377F8LhbK9rBjG/vYrdeFQM="; }; installPhase = '' From 837ff226bbd44c29303611703a4085d48f0957c9 Mon Sep 17 00:00:00 2001 From: Cole Helbling Date: Wed, 2 Apr 2025 07:55:32 -0700 Subject: [PATCH 16/56] flake: fix `nix flake check --all-systems --no-build` again This regressed in be4d27febe7776aac010f1ce11e1ff1f60f09bdd, because sphinx-issues depends on pandoc at build-time (which depends on GHC). Previously fixed in https://github.com/NixOS/nixpkgs/pull/349076. --- flake.nix | 31 +++++++++++++++++++++++++------ 1 file changed, 25 insertions(+), 6 deletions(-) diff --git a/flake.nix b/flake.nix index a82bb383c062..3bd0a48a5cce 100644 --- a/flake.nix +++ b/flake.nix @@ -98,15 +98,26 @@ checks = forAllSystems ( system: - { - tarball = jobs.${system}.tarball; - } + { } + // + lib.optionalAttrs + ( + # Exclude x86_64-freebsd because "Failed to evaluate rustc-wrapper-1.85.0: «broken»: is marked as broken" + system != "x86_64-freebsd" + ) + { + tarball = jobs.${system}.tarball; + } // lib.optionalAttrs ( self.legacyPackages.${system}.stdenv.hostPlatform.isLinux # Exclude power64 due to "libressl is not available on the requested hostPlatform" with hostPlatform being power64 && !self.legacyPackages.${system}.targetPlatform.isPower64 + # Exclude armv6l-linux because "cannot bootstrap GHC on this platform ('armv6l-linux' with libc 'defaultLibc')" + && system != "armv6l-linux" + # Exclude riscv64-linux because "cannot bootstrap GHC on this platform ('riscv64-linux' with libc 'defaultLibc')" + && system != "riscv64-linux" ) { # Test that ensures that the nixosSystem function can accept a lib argument @@ -156,8 +167,8 @@ system != "armv6l-linux" # Exclude riscv64-linux because "Package ‘ghc-9.6.6’ in .../pkgs/development/compilers/ghc/common-hadrian.nix:579 is not available on the requested hostPlatform" && system != "riscv64-linux" - # Exclude FreeBSD because "Package ‘ghc-9.6.6’ in .../pkgs/development/compilers/ghc/common-hadrian.nix:579 is not available on the requested hostPlatform" - && !self.legacyPackages.${system}.stdenv.hostPlatform.isFreeBSD + # Exclude x86_64-freebsd because "Package ‘ghc-9.6.6’ in .../pkgs/development/compilers/ghc/common-hadrian.nix:579 is not available on the requested hostPlatform" + && system != "x86_64-freebsd" ) { /** @@ -167,7 +178,15 @@ } ); - formatter = forAllSystems (system: (import ./ci { inherit system; }).fmt.pkg); + formatter = lib.filterAttrs ( + system: _: + # Exclude armv6l-linux because "cannot bootstrap GHC on this platform ('armv6l-linux' with libc 'defaultLibc')" + system != "armv6l-linux" + # Exclude riscv64-linux because "cannot bootstrap GHC on this platform ('riscv64-linux' with libc 'defaultLibc')" + && system != "riscv64-linux" + # Exclude x86_64-freebsd because "Package ‘go-1.22.12-freebsd-amd64-bootstrap’ in /nix/store/0yw40qnrar3lvc5hax5n49abl57apjbn-source/pkgs/development/compilers/go/binary.nix:50 is not available on the requested hostPlatform" + && system != "x86_64-freebsd" + ) (forAllSystems (system: (import ./ci { inherit system; }).fmt.pkg)); /** A nested structure of [packages](https://nix.dev/manual/nix/latest/glossary#package-attribute-set) and other values. From 06b7e29907477081045d9e563c2c3fe61f61e063 Mon Sep 17 00:00:00 2001 From: Cole Helbling Date: Wed, 2 Apr 2025 07:55:32 -0700 Subject: [PATCH 17/56] ci/eval: check that flake outputs on all systems still evaluate --- .github/workflows/eval.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/eval.yml b/.github/workflows/eval.yml index 82781f96c736..01149578af78 100644 --- a/.github/workflows/eval.yml +++ b/.github/workflows/eval.yml @@ -75,6 +75,9 @@ jobs: with: extra_nix_config: sandbox = true + - name: Ensure flake outputs on all systems still evaluate + run: nix --experimental-features 'nix-command flakes' flake check --all-systems --no-build ./nixpkgs + - name: Query nixpkgs with aliases enabled to check for basic syntax errors run: | time nix-env -I ./nixpkgs -f ./nixpkgs -qa '*' --option restrict-eval true --option allow-import-from-derivation false >/dev/null From 8dc9adb7e6b3046d992cbf1ecea88de7d5028114 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Gutyina=20Gerg=C5=91?= Date: Thu, 13 Feb 2025 01:38:05 +0100 Subject: [PATCH 18/56] pocket-id: init at 0.42.1 Co-authored-by: ymstnt <21342713+YMSTNT@users.noreply.github.com> s: 0.42.1 -> 0.44.0 s: 0.44.0 -> 0.45.0 --- pkgs/by-name/po/pocket-id/package.nix | 115 ++++++++++++++++++++++++++ 1 file changed, 115 insertions(+) create mode 100644 pkgs/by-name/po/pocket-id/package.nix diff --git a/pkgs/by-name/po/pocket-id/package.nix b/pkgs/by-name/po/pocket-id/package.nix new file mode 100644 index 000000000000..f29410a8e3c5 --- /dev/null +++ b/pkgs/by-name/po/pocket-id/package.nix @@ -0,0 +1,115 @@ +{ + lib, + fetchFromGitHub, + buildGoModule, + buildNpmPackage, + fetchurl, + makeWrapper, + nodejs, + stdenvNoCC, + nix-update-script, +}: + +let + version = "0.45.0"; + src = fetchFromGitHub { + owner = "pocket-id"; + repo = "pocket-id"; + tag = "v${version}"; + hash = "sha256-x5Y3ArkIPxiE6avk9DNyFdfkc/pY6h3JH3PZCS8U/GM="; + }; + + backend = buildGoModule { + pname = "pocket-id-backend"; + inherit version src; + + sourceRoot = "${src.name}/backend"; + + vendorHash = "sha256-mqpBP+A2X5ome1Ppg/Kki0C+A77jFtWzUjI/RN+ZCzg="; + + preFixup = '' + mv $out/bin/cmd $out/bin/pocket-id-backend + ''; + }; + + frontend = buildNpmPackage (finalAttrs: { + pname = "pocket-id-frontend"; + inherit version src; + + sourceRoot = "${src.name}/frontend"; + + npmDepsHash = "sha256-cpmZzlz+wusfRLN4iIGdk+I4SWrX/gk2fbhg+Gg3paw="; + npmFlags = [ "--legacy-peer-deps" ]; + + nativeBuildInputs = [ + makeWrapper + ]; + + installPhase = '' + runHook preInstall + + # even though vite build creates most of the minified js files, + # it still needs a few packages from node_modules, try to strip that + npm prune --omit=dev --omit=optional $npmFlags + # larger seemingly unused packages + rm -r node_modules/{lucide-svelte,bits-ui,jiti,@swc,.bin} + # unused file types + for pattern in '*.map' '*.map.js' '*.ts'; do + find . -type f -name "$pattern" -exec rm {} + + done + + mkdir -p $out/{bin,lib/pocket-id-frontend} + cp -r build $out/lib/pocket-id-frontend/dist + cp -r node_modules $out/lib/pocket-id-frontend/node_modules + makeWrapper ${lib.getExe nodejs} $out/bin/pocket-id-frontend \ + --add-flags $out/lib/pocket-id-frontend/dist/index.js + + runHook postInstall + ''; + }); + +in +stdenvNoCC.mkDerivation rec { + pname = "pocket-id"; + inherit + version + src + backend + frontend + ; + + dontUnpack = true; + + installPhase = '' + runHook preInstall + + mkdir -p $out/bin + ln -s ${backend}/bin/pocket-id-backend $out/bin/pocket-id-backend + ln -s ${frontend}/bin/pocket-id-frontend $out/bin/pocket-id-frontend + + runHook postInstall + ''; + + passthru = { + updateScript = nix-update-script { + extraArgs = [ + "--subpackage" + "backend" + "--subpackage" + "frontend" + ]; + }; + }; + + meta = { + description = "OIDC provider with passkeys support"; + homepage = "https://pocket-id.org"; + changelog = "https://github.com/pocket-id/pocket-id/releases/tag/v${version}"; + license = lib.licenses.bsd2; + maintainers = with lib.maintainers; [ + gepbird + ymstnt + ]; + platforms = lib.platforms.unix; + }; +} From 01be6580d38ccc3755bbe8408bf7b38bf075d746 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Gutyina=20Gerg=C5=91?= Date: Thu, 3 Apr 2025 06:49:33 +0200 Subject: [PATCH 19/56] nixos/pocket-id: init Co-authored-by: ymstnt <21342713+YMSTNT@users.noreply.github.com> --- .../manual/release-notes/rl-2505.section.md | 2 + nixos/modules/module-list.nix | 1 + nixos/modules/services/security/pocket-id.nix | 278 ++++++++++++++++++ nixos/tests/all-tests.nix | 1 + nixos/tests/pocket-id.nix | 47 +++ pkgs/by-name/po/pocket-id/package.nix | 4 + 6 files changed, 333 insertions(+) create mode 100644 nixos/modules/services/security/pocket-id.nix create mode 100644 nixos/tests/pocket-id.nix diff --git a/nixos/doc/manual/release-notes/rl-2505.section.md b/nixos/doc/manual/release-notes/rl-2505.section.md index f531ff61af86..9d05c32c697d 100644 --- a/nixos/doc/manual/release-notes/rl-2505.section.md +++ b/nixos/doc/manual/release-notes/rl-2505.section.md @@ -166,6 +166,8 @@ - [mqtt-exporter](https://github.com/kpetremann/mqtt-exporter/), a Prometheus exporter for exposing messages from MQTT. Available as [services.prometheus.exporters.mqtt](#opt-services.prometheus.exporters.mqtt.enable). +- [pocket-id](https://pocket-id.org/), an OIDC provider with passkeys support. Available as [services.pocket-id](#opt-services.pocket-id.enable). + - [nvidia-gpu](https://github.com/utkuozdemir/nvidia_gpu_exporter), a Prometheus exporter that scrapes `nvidia-smi` for GPU metrics. Available as [services.prometheus.exporters.nvidia-gpu](#opt-services.prometheus.exporters.nvidia-gpu.enable). - [OpenGamepadUI](https://github.com/ShadowBlip/OpenGamepadUI/), an open source gamepad-native game launcher and overlay for Linux. Available as [programs.opengamepadui](#opt-programs.opengamepadui.enable). diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix index 0a23a0d0d653..5aa0af4c442c 100644 --- a/nixos/modules/module-list.nix +++ b/nixos/modules/module-list.nix @@ -1419,6 +1419,7 @@ ./services/security/paretosecurity.nix ./services/security/pass-secret-service.nix ./services/security/physlock.nix + ./services/security/pocket-id.nix ./services/security/shibboleth-sp.nix ./services/security/sks.nix ./services/security/sshguard.nix diff --git a/nixos/modules/services/security/pocket-id.nix b/nixos/modules/services/security/pocket-id.nix new file mode 100644 index 000000000000..87c13b638dcb --- /dev/null +++ b/nixos/modules/services/security/pocket-id.nix @@ -0,0 +1,278 @@ +{ + lib, + pkgs, + config, + ... +}: + +let + inherit (lib) + mkEnableOption + mkIf + mkOption + optionalAttrs + optional + mkPackageOption + ; + inherit (lib.types) + bool + path + str + submodule + ; + + cfg = config.services.pocket-id; + + format = pkgs.formats.keyValue { }; + settingsFile = format.generate "pocket-id-env-vars" cfg.settings; +in +{ + meta.maintainers = with lib.maintainers; [ + gepbird + ymstnt + ]; + + options.services.pocket-id = { + enable = mkEnableOption "Pocket ID server"; + + package = mkPackageOption pkgs "pocket-id" { }; + + environmentFile = mkOption { + type = path; + description = '' + Path to an environment file loaded for the Pocket ID service. + + This can be used to securely store tokens and secrets outside of the world-readable Nix store. + + Example contents of the file: + MAXMIND_LICENSE_KEY=your-license-key + ''; + default = "/dev/null"; + example = "/var/lib/secrets/pocket-id"; + }; + + settings = mkOption { + type = submodule { + freeformType = format.type; + + options = { + PUBLIC_APP_URL = mkOption { + type = str; + description = '' + The URL where you will access the app. + ''; + default = "http://localhost"; + }; + + TRUST_PROXY = mkOption { + type = bool; + description = '' + Whether the app is behind a reverse proxy. + ''; + default = false; + }; + }; + }; + + default = { }; + + description = '' + Environment variables that will be passed to Pocket ID, see + [configuration options](https://pocket-id.org/docs/configuration/environment-variables) + for supported values. + ''; + }; + + dataDir = mkOption { + type = path; + default = "/var/lib/pocket-id"; + description = '' + The directory where Pocket ID will store its data, such as the database. + ''; + }; + + user = mkOption { + type = str; + default = "pocket-id"; + description = "User account under which Pocket ID runs."; + }; + + group = mkOption { + type = str; + default = "pocket-id"; + description = "Group account under which Pocket ID runs."; + }; + }; + + config = mkIf cfg.enable { + warnings = ( + optional (cfg.settings ? MAXMIND_LICENSE_KEY) + "config.services.pocket-id.settings.MAXMIND_LICENSE_KEY will be stored as plaintext in the Nix store. Use config.services.pocket-id.environmentFile instead." + ); + + systemd.tmpfiles.rules = [ + "d ${cfg.dataDir} 0755 ${cfg.user} ${cfg.group}" + ]; + + systemd.services = { + pocket-id-backend = { + description = "Pocket ID backend"; + after = [ "network.target" ]; + wantedBy = [ "multi-user.target" ]; + restartTriggers = [ + cfg.package + cfg.environmentFile + settingsFile + ]; + + serviceConfig = { + Type = "simple"; + User = cfg.user; + Group = cfg.group; + WorkingDirectory = cfg.dataDir; + ExecStart = "${cfg.package}/bin/pocket-id-backend"; + Restart = "always"; + EnvironmentFile = [ + cfg.environmentFile + settingsFile + ]; + + # Hardening + AmbientCapabilities = ""; + CapabilityBoundingSet = ""; + DeviceAllow = ""; + DevicePolicy = "closed"; + #IPAddressDeny = "any"; # communicates with the frontend + LockPersonality = true; + MemoryDenyWriteExecute = true; + NoNewPrivileges = true; + PrivateDevices = true; + PrivateNetwork = false; # communicates with the frontend + PrivateTmp = true; + PrivateUsers = true; + ProcSubset = "pid"; + ProtectClock = true; + ProtectControlGroups = true; + ProtectHome = true; + ProtectHostname = true; + ProtectKernelLogs = true; + ProtectKernelModules = true; + ProtectKernelTunables = true; + ProtectProc = "invisible"; + ProtectSystem = "full"; # needs to write in cfg.dataDir + RemoveIPC = true; + RestrictAddressFamilies = [ + "AF_INET" + "AF_INET6" + ]; + RestrictNamespaces = true; + RestrictRealtime = true; + RestrictSUIDSGID = true; + SystemCallArchitectures = "native"; + SystemCallFilter = lib.concatStringsSep " " [ + "~" + "@clock" + "@cpu-emulation" + "@debug" + "@module" + "@mount" + "@obsolete" + "@privileged" + "@raw-io" + "@reboot" + #"@resources" # vm test segfaults + "@swap" + ]; + UMask = "0077"; + }; + }; + + pocket-id-frontend = { + description = "Pocket ID frontend"; + after = [ + "network.target" + "pocket-id-backend.service" + ]; + wantedBy = [ "multi-user.target" ]; + restartTriggers = [ + cfg.package + cfg.environmentFile + settingsFile + ]; + + serviceConfig = { + Type = "simple"; + User = cfg.user; + Group = cfg.group; + ExecStart = "${cfg.package}/bin/pocket-id-frontend"; + Restart = "always"; + EnvironmentFile = [ + cfg.environmentFile + settingsFile + ]; + + # Hardening + AmbientCapabilities = ""; + CapabilityBoundingSet = ""; + DeviceAllow = ""; + DevicePolicy = "closed"; + #IPAddressDeny = "any"; # communicates with the backend and client + LockPersonality = true; + MemoryDenyWriteExecute = false; # V8_Fatal segfault + NoNewPrivileges = true; + PrivateDevices = true; + PrivateNetwork = false; # communicates with the backend and client + PrivateTmp = true; + PrivateUsers = true; + ProcSubset = "pid"; + ProtectClock = true; + ProtectControlGroups = true; + ProtectHome = true; + ProtectHostname = true; + ProtectKernelLogs = true; + ProtectKernelModules = true; + ProtectKernelTunables = true; + ProtectProc = "invisible"; + ProtectSystem = "strict"; + RemoveIPC = true; + RestrictAddressFamilies = [ + "AF_INET" + "AF_INET6" + ]; + RestrictNamespaces = true; + RestrictRealtime = true; + RestrictSUIDSGID = true; + SystemCallArchitectures = "native"; + SystemCallFilter = lib.concatStringsSep " " [ + "~" + "@clock" + "@cpu-emulation" + "@debug" + "@module" + "@mount" + "@obsolete" + "@privileged" + "@raw-io" + "@reboot" + "@resources" + "@swap" + ]; + UMask = "0077"; + }; + }; + }; + + users.users = optionalAttrs (cfg.user == "pocket-id") { + pocket-id = { + isSystemUser = true; + group = cfg.group; + description = "Pocket ID backend user"; + home = cfg.dataDir; + }; + }; + + users.groups = optionalAttrs (cfg.group == "pocket-id") { + pocket-id = { }; + }; + }; +} diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix index cc8eecddf778..186e078c8451 100644 --- a/nixos/tests/all-tests.nix +++ b/nixos/tests/all-tests.nix @@ -1039,6 +1039,7 @@ in pleroma = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./pleroma.nix { }; plikd = handleTest ./plikd.nix { }; plotinus = handleTest ./plotinus.nix { }; + pocket-id = handleTest ./pocket-id.nix { }; podgrab = handleTest ./podgrab.nix { }; podman = handleTestOn [ "aarch64-linux" "x86_64-linux" ] ./podman/default.nix { }; podman-tls-ghostunnel = handleTestOn [ diff --git a/nixos/tests/pocket-id.nix b/nixos/tests/pocket-id.nix new file mode 100644 index 000000000000..753fa251473f --- /dev/null +++ b/nixos/tests/pocket-id.nix @@ -0,0 +1,47 @@ +import ./make-test-python.nix ( + { lib, ... }: + + { + name = "pocket-id"; + meta.maintainers = with lib.maintainers; [ + gepbird + ymstnt + ]; + + nodes = { + machine = + { ... }: + { + services.pocket-id = { + enable = true; + settings = { + PORT = 10001; + INTERNAL_BACKEND_URL = "http://localhost:10002"; + BACKEND_PORT = 10002; + }; + }; + }; + }; + + testScript = + { nodes, ... }: + let + inherit (nodes.machine.services.pocket-id) settings; + inherit (builtins) toString; + in + '' + machine.wait_for_unit("pocket-id-backend.service") + machine.wait_for_open_port(${toString settings.BACKEND_PORT}) + machine.wait_for_unit("pocket-id-frontend.service") + machine.wait_for_open_port(${toString settings.PORT}) + + backend_status = machine.succeed("curl -L -o /tmp/backend-output -w '%{http_code}' http://localhost:${toString settings.BACKEND_PORT}/api/users/me") + assert backend_status == "401" + machine.succeed("grep 'You are not signed in' /tmp/backend-output") + + frontend_status = machine.succeed("curl -L -o /tmp/frontend-output -w '%{http_code}' http://localhost:${toString settings.PORT}") + assert frontend_status == "200" + machine.succeed("grep 'Sign in to Pocket ID' /tmp/frontend-output") + ''; + } +) diff --git a/pkgs/by-name/po/pocket-id/package.nix b/pkgs/by-name/po/pocket-id/package.nix index f29410a8e3c5..0fd97ab64c86 100644 --- a/pkgs/by-name/po/pocket-id/package.nix +++ b/pkgs/by-name/po/pocket-id/package.nix @@ -7,6 +7,7 @@ makeWrapper, nodejs, stdenvNoCC, + nixosTests, nix-update-script, }: @@ -91,6 +92,9 @@ stdenvNoCC.mkDerivation rec { ''; passthru = { + tests = { + inherit (nixosTests) pocket-id; + }; updateScript = nix-update-script { extraArgs = [ "--subpackage" From 8a512d5e646722fd19b6bdc6a37ca810ee2faa91 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Thu, 3 Apr 2025 08:25:43 +0000 Subject: [PATCH 20/56] erlang_language_platform: 2025-02-13 -> 2025-04-02 --- pkgs/by-name/er/erlang-language-platform/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/er/erlang-language-platform/package.nix b/pkgs/by-name/er/erlang-language-platform/package.nix index 1450966030a1..da80e66bec07 100644 --- a/pkgs/by-name/er/erlang-language-platform/package.nix +++ b/pkgs/by-name/er/erlang-language-platform/package.nix @@ -14,14 +14,14 @@ let hashes = { linux-aarch64-unknown-linux-gnu = "sha256-i6XsOK8csrJ/9TDzltA7mGjdutLZONFiYGV5tqSCy8o="; - linux-x86_64-unknown-linux-gnu = "sha256-gBIzG0LaP9qxivkr47JpBu1z9km7o/1Wppk/6k2WslE="; + linux-x86_64-unknown-linux-gnu = "sha256-XK3DPWIdPDoIL10EATa8p1bnlpZaOzOdU0LnuKbj++E="; macos-aarch64-apple-darwin = "sha256-8e5duQYDVFyZejMjuZPuWhg1on3CBku9eBuilG5p1BY="; macos-x86_64-apple-darwin = "sha256-dnouUBUUAkMr1h+IJWYamxmk8IC7JdeIUS9/YI0GzOU="; }; in stdenv.mkDerivation rec { pname = "erlang-language-platform"; - version = "2025-02-13"; + version = "2025-04-02"; src = fetchurl { url = "https://github.com/WhatsApp/erlang-language-platform/releases/download/${version}/elp-${release}-otp-26.2.tar.gz"; From ff079b35b5a79d09dfab3cdecf3fead21631f470 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Thu, 3 Apr 2025 12:37:59 +0000 Subject: [PATCH 21/56] cariddi: 1.3.5 -> 1.3.6 --- pkgs/by-name/ca/cariddi/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/ca/cariddi/package.nix b/pkgs/by-name/ca/cariddi/package.nix index 443623316b53..4c2e59842534 100644 --- a/pkgs/by-name/ca/cariddi/package.nix +++ b/pkgs/by-name/ca/cariddi/package.nix @@ -6,16 +6,16 @@ buildGoModule rec { pname = "cariddi"; - version = "1.3.5"; + version = "1.3.6"; src = fetchFromGitHub { owner = "edoardottt"; repo = "cariddi"; tag = "v${version}"; - hash = "sha256-mRrUTRknax3b4hs3frQMzg0GyB3WjMDZJk0RQSAC88U="; + hash = "sha256-ixjHPO0FXKbWOfjMVz1YD+wWpL8wcn2CCO46KF1zb0U="; }; - vendorHash = "sha256-ML1aLbrYhs2IxnN2ywKFOpvAV6yuYb8GI+dtoxwJl4A="; + vendorHash = "sha256-7v92+iDAYG0snJjVCX35rLKV/ZEzaVX2au4HOwa/ILU="; ldflags = [ "-w" From bc519cfdb8c61ddbf8e5fc427fb504e529913291 Mon Sep 17 00:00:00 2001 From: Defelo Date: Tue, 1 Apr 2025 21:33:16 +0200 Subject: [PATCH 22/56] jnv: use finalAttrs pattern --- pkgs/by-name/jn/jnv/package.nix | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/jn/jnv/package.nix b/pkgs/by-name/jn/jnv/package.nix index e42b7fb671f9..908956c6dc9a 100644 --- a/pkgs/by-name/jn/jnv/package.nix +++ b/pkgs/by-name/jn/jnv/package.nix @@ -5,14 +5,15 @@ stdenv, darwin, }: -rustPlatform.buildRustPackage rec { + +rustPlatform.buildRustPackage (finalAttrs: { pname = "jnv"; version = "0.6.0"; src = fetchFromGitHub { owner = "ynqa"; repo = "jnv"; - rev = "v${version}"; + rev = "v${finalAttrs.version}"; hash = "sha256-HKZ+hF5Y7vTA4EODSAd9xYJHaipv5YukTl470ejPLtM="; }; @@ -37,4 +38,4 @@ rustPlatform.buildRustPackage rec { nshalman ]; }; -} +}) From a8300afe2dbfe36d72f9089434b50f648375d327 Mon Sep 17 00:00:00 2001 From: Defelo Date: Tue, 1 Apr 2025 21:33:34 +0200 Subject: [PATCH 23/56] jnv: use tag in fetchFromGitHub --- pkgs/by-name/jn/jnv/package.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkgs/by-name/jn/jnv/package.nix b/pkgs/by-name/jn/jnv/package.nix index 908956c6dc9a..a59702ed9ad7 100644 --- a/pkgs/by-name/jn/jnv/package.nix +++ b/pkgs/by-name/jn/jnv/package.nix @@ -13,7 +13,7 @@ rustPlatform.buildRustPackage (finalAttrs: { src = fetchFromGitHub { owner = "ynqa"; repo = "jnv"; - rev = "v${finalAttrs.version}"; + tag = "v${finalAttrs.version}"; hash = "sha256-HKZ+hF5Y7vTA4EODSAd9xYJHaipv5YukTl470ejPLtM="; }; From c197699159fd1ed3cd3be0cab664a67853c91952 Mon Sep 17 00:00:00 2001 From: Defelo Date: Tue, 1 Apr 2025 21:34:34 +0200 Subject: [PATCH 24/56] jnv: remove `with lib;` --- pkgs/by-name/jn/jnv/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/jn/jnv/package.nix b/pkgs/by-name/jn/jnv/package.nix index a59702ed9ad7..42b0d20bb625 100644 --- a/pkgs/by-name/jn/jnv/package.nix +++ b/pkgs/by-name/jn/jnv/package.nix @@ -28,12 +28,12 @@ rustPlatform.buildRustPackage (finalAttrs: { ] ); - meta = with lib; { + meta = { description = "Interactive JSON filter using jq"; mainProgram = "jnv"; homepage = "https://github.com/ynqa/jnv"; - license = with licenses; [ mit ]; - maintainers = with maintainers; [ + license = with lib.licenses; [ mit ]; + maintainers = with lib.maintainers; [ nealfennimore nshalman ]; From afcb71c4817cddc454fdeb13d5801069b206c1ef Mon Sep 17 00:00:00 2001 From: Defelo Date: Tue, 1 Apr 2025 21:48:43 +0200 Subject: [PATCH 25/56] jnv: remove obsolete buildInputs --- pkgs/by-name/jn/jnv/package.nix | 10 ---------- 1 file changed, 10 deletions(-) diff --git a/pkgs/by-name/jn/jnv/package.nix b/pkgs/by-name/jn/jnv/package.nix index 42b0d20bb625..1b03847a1c83 100644 --- a/pkgs/by-name/jn/jnv/package.nix +++ b/pkgs/by-name/jn/jnv/package.nix @@ -2,8 +2,6 @@ lib, rustPlatform, fetchFromGitHub, - stdenv, - darwin, }: rustPlatform.buildRustPackage (finalAttrs: { @@ -20,14 +18,6 @@ rustPlatform.buildRustPackage (finalAttrs: { useFetchCargoVendor = true; cargoHash = "sha256-VLVoURqmUhhekNZ0a75bwjvSiLfaQ79IlltbmWVyBrI="; - buildInputs = lib.optional stdenv.hostPlatform.isDarwin ( - with darwin.apple_sdk.frameworks; - [ - CoreGraphics - AppKit - ] - ); - meta = { description = "Interactive JSON filter using jq"; mainProgram = "jnv"; From 2843b39e60c86fd9962bc2e208b7e2df12aebc3e Mon Sep 17 00:00:00 2001 From: Defelo Date: Tue, 1 Apr 2025 21:50:44 +0200 Subject: [PATCH 26/56] jnv: add versionCheckHook --- pkgs/by-name/jn/jnv/package.nix | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/pkgs/by-name/jn/jnv/package.nix b/pkgs/by-name/jn/jnv/package.nix index 1b03847a1c83..b5b4140e1b31 100644 --- a/pkgs/by-name/jn/jnv/package.nix +++ b/pkgs/by-name/jn/jnv/package.nix @@ -2,6 +2,7 @@ lib, rustPlatform, fetchFromGitHub, + versionCheckHook, }: rustPlatform.buildRustPackage (finalAttrs: { @@ -18,6 +19,10 @@ rustPlatform.buildRustPackage (finalAttrs: { useFetchCargoVendor = true; cargoHash = "sha256-VLVoURqmUhhekNZ0a75bwjvSiLfaQ79IlltbmWVyBrI="; + nativeInstallCheckInputs = [ versionCheckHook ]; + versionCheckProgramArg = "--version"; + doInstallCheck = true; + meta = { description = "Interactive JSON filter using jq"; mainProgram = "jnv"; From 5b86a3c7cbb0b79577807c7c59a4edc5f4119965 Mon Sep 17 00:00:00 2001 From: Defelo Date: Tue, 1 Apr 2025 21:50:56 +0200 Subject: [PATCH 27/56] jnv: add updateScript --- pkgs/by-name/jn/jnv/package.nix | 3 +++ 1 file changed, 3 insertions(+) diff --git a/pkgs/by-name/jn/jnv/package.nix b/pkgs/by-name/jn/jnv/package.nix index b5b4140e1b31..819bbeb3abd5 100644 --- a/pkgs/by-name/jn/jnv/package.nix +++ b/pkgs/by-name/jn/jnv/package.nix @@ -3,6 +3,7 @@ rustPlatform, fetchFromGitHub, versionCheckHook, + nix-update-script, }: rustPlatform.buildRustPackage (finalAttrs: { @@ -23,6 +24,8 @@ rustPlatform.buildRustPackage (finalAttrs: { versionCheckProgramArg = "--version"; doInstallCheck = true; + passthru.updateScript = nix-update-script { }; + meta = { description = "Interactive JSON filter using jq"; mainProgram = "jnv"; From 36d62f0c85a45c3500b14834549a1485549a5c59 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Fri, 4 Apr 2025 00:35:37 +0000 Subject: [PATCH 28/56] azurehound: 2.3.0 -> 2.3.1 --- pkgs/by-name/az/azurehound/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/az/azurehound/package.nix b/pkgs/by-name/az/azurehound/package.nix index e21a59cc6f69..74ed95caac07 100644 --- a/pkgs/by-name/az/azurehound/package.nix +++ b/pkgs/by-name/az/azurehound/package.nix @@ -7,13 +7,13 @@ buildGoModule rec { pname = "azurehound"; - version = "2.3.0"; + version = "2.3.1"; src = fetchFromGitHub { owner = "SpecterOps"; repo = "AzureHound"; tag = "v${version}"; - hash = "sha256-BbwQ3u1SD4AjNjHzT6QB0x7QJAZ59m1DtvhjZapLIx4="; + hash = "sha256-12ae0y3hjeNPwB33J+XP26h+JfFN5M8+bF8CSon1jp4="; }; vendorHash = "sha256-FG3207OTzkMEoSvQsTH7Ky9T3ur7glG7k0ERfd12SO0="; From 7b3259fbe9ada59d6edd616d891a242bc805fe41 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Fri, 4 Apr 2025 01:26:45 +0000 Subject: [PATCH 29/56] trufflehog: 3.88.20 -> 3.88.21 --- pkgs/tools/security/trufflehog/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/tools/security/trufflehog/default.nix b/pkgs/tools/security/trufflehog/default.nix index b82459d22d84..847e42feaf2f 100644 --- a/pkgs/tools/security/trufflehog/default.nix +++ b/pkgs/tools/security/trufflehog/default.nix @@ -8,13 +8,13 @@ buildGoModule rec { pname = "trufflehog"; - version = "3.88.20"; + version = "3.88.21"; src = fetchFromGitHub { owner = "trufflesecurity"; repo = "trufflehog"; tag = "v${version}"; - hash = "sha256-JLBHg1hCTOOBRTJbjXJitILD/HSmH1WDuzm0t3/OJaA="; + hash = "sha256-hUBUpsfVKifeQ9DpeNKwBGnoLH1OK2T4IOb7yFWxz+Q="; }; vendorHash = "sha256-vJl2gIS14NA9nV9j+81xKv3NnsDce4V7XoeipOZV+wI="; From 3564baaf75199b4c6c35703c492e0056e1741c4d Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Fri, 4 Apr 2025 02:46:47 +0000 Subject: [PATCH 30/56] zwave-js-ui: 9.32.0 -> 10.1.2 --- pkgs/by-name/zw/zwave-js-ui/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/zw/zwave-js-ui/package.nix b/pkgs/by-name/zw/zwave-js-ui/package.nix index d8dd3c074eb1..fc38ef746f90 100644 --- a/pkgs/by-name/zw/zwave-js-ui/package.nix +++ b/pkgs/by-name/zw/zwave-js-ui/package.nix @@ -7,15 +7,15 @@ buildNpmPackage rec { pname = "zwave-js-ui"; - version = "9.32.0"; + version = "10.1.2"; src = fetchFromGitHub { owner = "zwave-js"; repo = "zwave-js-ui"; tag = "v${version}"; - hash = "sha256-DZm3IoLc28YMbwWL6+qHd5BSyRQswRatEvGmwuIzBZM="; + hash = "sha256-j56kDnMw/YX6ONkIjPjopsu6xE2Kt1cZV5u+tX2TqlM="; }; - npmDepsHash = "sha256-FZ/iStpC5DiNthV42/QAzek261ZUAL1DOEIixVlArZ0="; + npmDepsHash = "sha256-hkfDztDtLug9qdxi9NRWnzCN6Parv27stVknZ0cSYpo="; passthru.tests.zwave-js-ui = nixosTests.zwave-js-ui; From a2e886428b4a52bd908a3eccd5c4a6f48993dccf Mon Sep 17 00:00:00 2001 From: Ihar Hrachyshka Date: Thu, 3 Apr 2025 23:18:10 -0400 Subject: [PATCH 31/56] firefox: copy *.dylibs on darwin Without these, some functionality seems broken (e.g. Crypto API). Resolves #394029 Signed-off-by: Ihar Hrachyshka --- pkgs/applications/networking/browsers/firefox/wrapper.nix | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/pkgs/applications/networking/browsers/firefox/wrapper.nix b/pkgs/applications/networking/browsers/firefox/wrapper.nix index c753b04fb700..f6244310858a 100644 --- a/pkgs/applications/networking/browsers/firefox/wrapper.nix +++ b/pkgs/applications/networking/browsers/firefox/wrapper.nix @@ -405,10 +405,12 @@ let + lib.optionalString isDarwin '' cd "${appPath}" - # These files have to be copied and not symlinked, otherwise tabs crash. + # The omni.ja files have to be copied and not symlinked, otherwise tabs crash. # Maybe related to how omni.ja file is mmapped into memory. See: # https://github.com/mozilla/gecko-dev/blob/b1662b447f306e6554647914090d4b73ac8e1664/modules/libjar/nsZipArchive.cpp#L204 - for file in $(find . -type l -name "omni.ja"); do + # + # The *.dylib files are copied, otherwise some basic functionality, e.g. Crypto API, is broken. + for file in $(find . -name "omni.ja" -o -name "*.dylib"); do rm "$file" cp "${browser}/${appPath}/$file" "$file" done From af2ef85a8049794e1a79fda30a0d26e1a4dfafde Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Fri, 4 Apr 2025 05:54:48 +0000 Subject: [PATCH 32/56] python312Packages.xiaomi-ble: 0.35.0 -> 0.36.0 --- pkgs/development/python-modules/xiaomi-ble/default.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/development/python-modules/xiaomi-ble/default.nix b/pkgs/development/python-modules/xiaomi-ble/default.nix index b0c8020c06e4..b24845d9b3d1 100644 --- a/pkgs/development/python-modules/xiaomi-ble/default.nix +++ b/pkgs/development/python-modules/xiaomi-ble/default.nix @@ -19,7 +19,7 @@ buildPythonPackage rec { pname = "xiaomi-ble"; - version = "0.35.0"; + version = "0.36.0"; pyproject = true; disabled = pythonOlder "3.9"; @@ -28,7 +28,7 @@ buildPythonPackage rec { owner = "Bluetooth-Devices"; repo = "xiaomi-ble"; tag = "v${version}"; - hash = "sha256-+mXn5R9zRjTPKqzB0vFHSO2+Jx+61K7/Ksp+jmMUDo4="; + hash = "sha256-qk8eoPuyU8deEuQkRRtTt1AxIpjaXaS/byDxMfZnLgI="; }; build-system = [ poetry-core ]; @@ -57,7 +57,7 @@ buildPythonPackage rec { meta = with lib; { description = "Library for Xiaomi BLE devices"; homepage = "https://github.com/Bluetooth-Devices/xiaomi-ble"; - changelog = "https://github.com/Bluetooth-Devices/xiaomi-ble/releases/tag/v${version}"; + changelog = "https://github.com/Bluetooth-Devices/xiaomi-ble/releases/tag/${src.tag}"; license = licenses.mit; maintainers = with maintainers; [ fab ]; }; From ed26b7b0c374e946dbd774e00d7f0aa1b8fde87f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= Date: Fri, 4 Apr 2025 11:37:33 +0200 Subject: [PATCH 33/56] nixos/onlyoffice: misc cleanup --- nixos/modules/services/web-apps/onlyoffice.nix | 16 ++++++---------- 1 file changed, 6 insertions(+), 10 deletions(-) diff --git a/nixos/modules/services/web-apps/onlyoffice.nix b/nixos/modules/services/web-apps/onlyoffice.nix index 5d2e03147a68..48e51b13bb39 100644 --- a/nixos/modules/services/web-apps/onlyoffice.nix +++ b/nixos/modules/services/web-apps/onlyoffice.nix @@ -114,7 +114,7 @@ in proxy_pass http://onlyoffice-docservice/$2$3; ''; # /etc/nginx/includes/ds-docservice.conf - #disable caching for api.js + # disable caching for api.js "~ ^(\\/[\\d]+\\.[\\d]+\\.[\\d]+[\\.|-][\\w]+)?\\/(web-apps\\/apps\\/api\\/documents\\/api\\.js)$".extraConfig = '' expires -1; @@ -124,26 +124,23 @@ in "~ ^(\\/[\\d]+\\.[\\d]+\\.[\\d]+[\\.|-][\\w]+)?\\/(document_editor_service_worker\\.js)$".extraConfig = '' expires 365d; - # gzip_static on; - alias ${cfg.package}/var/www/onlyoffice/documentserver/sdkjs/common/serviceworker/$2; + alias ${cfg.package}/var/www/onlyoffice/documentserver/sdkjs/common/serviceworker/$2; ''; - #suppress logging the unsupported locale error in web-apps + # suppress logging the unsupported locale error in web-apps "~ ^(\\/[\\d]+\\.[\\d]+\\.[\\d]+[\\.|-][\\w]+)?\\/(web-apps)(\\/.*\\.json)$".extraConfig = '' expires 365d; error_log /dev/null crit; alias ${cfg.package}/var/www/onlyoffice/documentserver/$2$3; ''; - #suppress logging the unsupported locale error in plugins + # suppress logging the unsupported locale error in plugins "~ ^(\\/[\\d]+\\.[\\d]+\\.[\\d]+[\\.|-][\\w]+)?\\/(sdkjs-plugins)(\\/.*\\.json)$".extraConfig = '' expires 365d; error_log /dev/null crit; - # gzip_static on; alias ${cfg.package}/var/www/onlyoffice/documentserver/$2$3; ''; "~ ^(\\/[\\d]+\\.[\\d]+\\.[\\d]+[\\.|-][\\w]+)?\\/(web-apps|sdkjs|sdkjs-plugins|fonts|dictionaries)(\\/.*)$".extraConfig = '' expires 365d; - # gzip_static on; alias ${cfg.package}/var/www/onlyoffice/documentserver/$2$3; ''; "~* ^(\\/cache\\/files.*)(\\/.*)".extraConfig = '' @@ -302,9 +299,8 @@ in ' /run/onlyoffice/config/default.json | sponge /run/onlyoffice/config/default.json chmod u+w /run/onlyoffice/config/production-linux.json - jq ' - .FileConverter.converter.x2tPath = "${cfg.x2t}/bin/x2t" - ' /run/onlyoffice/config/production-linux.json | sponge /run/onlyoffice/config/production-linux.json + jq '.FileConverter.converter.x2tPath = "${cfg.x2t}/bin/x2t"' \ + /run/onlyoffice/config/production-linux.json | sponge /run/onlyoffice/config/production-linux.json if psql -d onlyoffice -c "SELECT 'task_result'::regclass;" >/dev/null; then psql -f ${cfg.package}/var/www/onlyoffice/documentserver/server/schema/postgresql/removetbl.sql From dbb3bdb4d4d981692cefe88436eb36f3a59f9d96 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= Date: Fri, 4 Apr 2025 11:37:49 +0200 Subject: [PATCH 34/56] onlyoffice-documentserver: fail loudly when HASH_POSTFIX would change --- pkgs/by-name/on/onlyoffice-documentserver/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/on/onlyoffice-documentserver/package.nix b/pkgs/by-name/on/onlyoffice-documentserver/package.nix index a86bf31a641f..0d828b87580c 100644 --- a/pkgs/by-name/on/onlyoffice-documentserver/package.nix +++ b/pkgs/by-name/on/onlyoffice-documentserver/package.nix @@ -61,9 +61,9 @@ let mkdir -p var/lib/onlyoffice/ var/www/onlyoffice/documentserver/fonts/ # see usr/bin/documentserver-flush-cache.sh - cp var/www/onlyoffice/documentserver/web-apps/apps/api/documents/api.js.tpl var/www/onlyoffice/documentserver/web-apps/apps/api/documents/api.js - HASH=$(basename $out | cut -d '-' -f 1) - sed -i "s/{{HASH_POSTFIX}}/$HASH/g" var/www/onlyoffice/documentserver/web-apps/apps/api/documents/api.js + cp var/www/onlyoffice/documentserver/web-apps/apps/api/documents/api.js{.tpl,} + substituteInPlace var/www/onlyoffice/documentserver/web-apps/apps/api/documents/api.js \ + --replace-fail '{{HASH_POSTFIX}}' "$(basename $out | cut -d '-' -f 1)" mv * $out/ ''; From 915d70217de01d00d365369abf64c5be6fa2139d Mon Sep 17 00:00:00 2001 From: Zexin Yuan Date: Fri, 4 Apr 2025 17:54:55 +0800 Subject: [PATCH 35/56] aider-chat: 0.80.0 -> 0.81.0, enable update script --- pkgs/development/python-modules/aider-chat/default.nix | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/pkgs/development/python-modules/aider-chat/default.nix b/pkgs/development/python-modules/aider-chat/default.nix index 5cd871b868d3..519738bfad42 100644 --- a/pkgs/development/python-modules/aider-chat/default.nix +++ b/pkgs/development/python-modules/aider-chat/default.nix @@ -112,6 +112,7 @@ torch, nltk, boto3, + nix-update-script, }: let @@ -123,7 +124,7 @@ let ]; }; - version = "0.80.0"; + version = "0.81.0"; aider-chat = buildPythonPackage { pname = "aider-chat"; inherit version; @@ -136,7 +137,7 @@ let owner = "Aider-AI"; repo = "aider"; tag = "v${version}"; - hash = "sha256-W3GO5+0rprQHmn1upL3pcXuv2e9Wir6TW0tUnvZj48E="; + hash = "sha256-xWOXsffLAVBZvJM8PuAJ12IrmNLfXuqHrbIMtPM1leE="; }; pythonRelaxDeps = true; @@ -365,6 +366,8 @@ let makeWrapperArgs = makeWrapperArgs ++ playwrightArgs ++ helpArgs; } ); + + updateScript = nix-update-script { }; }; meta = { From edef4448e8c89b8a8acfc0b91cb5304b77363006 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Fri, 4 Apr 2025 10:03:54 +0000 Subject: [PATCH 36/56] tippecanoe: 2.75.1 -> 2.77.0 --- pkgs/by-name/ti/tippecanoe/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/ti/tippecanoe/package.nix b/pkgs/by-name/ti/tippecanoe/package.nix index e298a641dc70..e7d7ab976153 100644 --- a/pkgs/by-name/ti/tippecanoe/package.nix +++ b/pkgs/by-name/ti/tippecanoe/package.nix @@ -10,13 +10,13 @@ stdenv.mkDerivation (finalAttrs: { pname = "tippecanoe"; - version = "2.75.1"; + version = "2.77.0"; src = fetchFromGitHub { owner = "felt"; repo = "tippecanoe"; tag = finalAttrs.version; - hash = "sha256-rBuk34lOrp9aW7yK0LOTRqFJg3J8IogR01kcFhgK12Y="; + hash = "sha256-7yRrUn1U0iERlix/8/oaMaizlpzqdiSIHj298ykaJjE="; }; buildInputs = [ From ed7eae38b4598bd4787aaf198e7c5b89773fdd7e Mon Sep 17 00:00:00 2001 From: Mitsuo HEIJO Date: Fri, 4 Apr 2025 20:11:45 +0900 Subject: [PATCH 37/56] gojq: install zsh completion --- pkgs/by-name/go/gojq/package.nix | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/pkgs/by-name/go/gojq/package.nix b/pkgs/by-name/go/gojq/package.nix index bc2f9dea992c..365b7bc336c0 100644 --- a/pkgs/by-name/go/gojq/package.nix +++ b/pkgs/by-name/go/gojq/package.nix @@ -4,6 +4,7 @@ fetchFromGitHub, testers, gojq, + installShellFiles, }: buildGoModule rec { @@ -24,6 +25,12 @@ buildGoModule rec { "-w" ]; + nativeBuildInputs = [ installShellFiles ]; + + postInstall = '' + installShellCompletion --cmd gojq --zsh _gojq + ''; + passthru.tests.version = testers.testVersion { package = gojq; }; From 8807f45da070cec9c6b5bb10da865a128cfde570 Mon Sep 17 00:00:00 2001 From: Piotr Kwiecinski <2151333+piotrkwiecinski@users.noreply.github.com> Date: Fri, 4 Apr 2025 13:44:11 +0200 Subject: [PATCH 38/56] nixosTests.librenms: migrate to runTest Part of #386873 --- nixos/tests/all-tests.nix | 2 +- nixos/tests/librenms.nix | 178 +++++++++++++++++++------------------- 2 files changed, 89 insertions(+), 91 deletions(-) diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix index 5ffcaccf17f9..8176aeaccbc3 100644 --- a/nixos/tests/all-tests.nix +++ b/nixos/tests/all-tests.nix @@ -691,7 +691,7 @@ in leaps = handleTest ./leaps.nix { }; lemmy = handleTest ./lemmy.nix { }; libinput = handleTest ./libinput.nix { }; - librenms = handleTest ./librenms.nix { }; + librenms = runTest ./librenms.nix; libresprite = handleTest ./libresprite.nix { }; libreswan = runTest ./libreswan.nix; libreswan-nat = runTest ./libreswan-nat.nix; diff --git a/nixos/tests/librenms.nix b/nixos/tests/librenms.nix index 05821dfa1000..d8d3e5eb92fa 100644 --- a/nixos/tests/librenms.nix +++ b/nixos/tests/librenms.nix @@ -1,106 +1,104 @@ -import ./make-test-python.nix ( - { pkgs, lib, ... }: +{ pkgs, lib, ... }: - let - api_token = "f87f42114e44b63ad1b9e3c3d33d6fbe"; # random md5 hash - wrong_api_token = "e68ba041fcf1eab923a7a6de3af5f726"; # another random md5 hash - in - { - name = "librenms"; - meta.maintainers = lib.teams.wdz.members; +let + api_token = "f87f42114e44b63ad1b9e3c3d33d6fbe"; # random md5 hash + wrong_api_token = "e68ba041fcf1eab923a7a6de3af5f726"; # another random md5 hash +in +{ + name = "librenms"; + meta.maintainers = lib.teams.wdz.members; - nodes.librenms = { - time.timeZone = "Europe/Berlin"; + nodes.librenms = { + time.timeZone = "Europe/Berlin"; - environment.systemPackages = with pkgs; [ - curl - jq - ]; + environment.systemPackages = with pkgs; [ + curl + jq + ]; - services.librenms = { - enable = true; - hostname = "librenms"; - database = { - createLocally = true; - host = "localhost"; - database = "librenms"; - username = "librenms"; - passwordFile = pkgs.writeText "librenms-db-pass" "librenmsdbpass"; - }; - nginx = { - default = true; - }; - enableOneMinutePolling = true; - settings = { - enable_billing = true; - }; + services.librenms = { + enable = true; + hostname = "librenms"; + database = { + createLocally = true; + host = "localhost"; + database = "librenms"; + username = "librenms"; + passwordFile = pkgs.writeText "librenms-db-pass" "librenmsdbpass"; }; - - # systemd oneshot to create a dummy admin user and a API token for testing - systemd.services.lnms-api-init = { - description = "LibreNMS API init"; - after = [ "librenms-setup.service" ]; - wantedBy = [ "multi-user.target" ]; - serviceConfig = { - Type = "oneshot"; - RemainAfterExit = true; - User = "root"; - Group = "root"; - }; - script = '' - API_USER_NAME=api - API_TOKEN=${api_token} # random md5 hash - - # seeding database to get the admin roles - ${pkgs.librenms}/artisan db:seed --force --no-interaction - - # we don't need to know the password, it just has to exist - API_USER_PASS=$(${pkgs.pwgen}/bin/pwgen -s 64 1) - ${pkgs.librenms}/artisan user:add $API_USER_NAME -r admin -p $API_USER_PASS - API_USER_ID=$(${pkgs.mariadb}/bin/mysql -D librenms -N -B -e "SELECT user_id FROM users WHERE username = '$API_USER_NAME';") - - ${pkgs.mariadb}/bin/mysql -D librenms -e "INSERT INTO api_tokens (user_id, token_hash, description) VALUES ($API_USER_ID, '$API_TOKEN', 'API User')" - ''; + nginx = { + default = true; + }; + enableOneMinutePolling = true; + settings = { + enable_billing = true; }; }; - nodes.snmphost = { - - services.snmpd = { - enable = true; - openFirewall = true; - - configText = '' - com2sec readonly default public - - group MyROGroup v2c readonly - view all included .1 80 - access MyROGroup "" any noauth exact all none none - - syslocation Testcity, Testcountry - syscontact Testi mc Test - ''; - + # systemd oneshot to create a dummy admin user and a API token for testing + systemd.services.lnms-api-init = { + description = "LibreNMS API init"; + after = [ "librenms-setup.service" ]; + wantedBy = [ "multi-user.target" ]; + serviceConfig = { + Type = "oneshot"; + RemainAfterExit = true; + User = "root"; + Group = "root"; }; + script = '' + API_USER_NAME=api + API_TOKEN=${api_token} # random md5 hash + + # seeding database to get the admin roles + ${pkgs.librenms}/artisan db:seed --force --no-interaction + + # we don't need to know the password, it just has to exist + API_USER_PASS=$(${pkgs.pwgen}/bin/pwgen -s 64 1) + ${pkgs.librenms}/artisan user:add $API_USER_NAME -r admin -p $API_USER_PASS + API_USER_ID=$(${pkgs.mariadb}/bin/mysql -D librenms -N -B -e "SELECT user_id FROM users WHERE username = '$API_USER_NAME';") + + ${pkgs.mariadb}/bin/mysql -D librenms -e "INSERT INTO api_tokens (user_id, token_hash, description) VALUES ($API_USER_ID, '$API_TOKEN', 'API User')" + ''; }; + }; - testScript = '' - start_all() + nodes.snmphost = { - snmphost.wait_for_unit("snmpd.service") + services.snmpd = { + enable = true; + openFirewall = true; - librenms.wait_for_unit("lnms-api-init.service") - librenms.wait_for_open_port(80) + configText = '' + com2sec readonly default public - # Test that we can authenticate against the API - librenms.succeed("curl --fail -H 'X-Auth-Token: ${api_token}' http://localhost/api/v0") - librenms.fail("curl --fail -H 'X-Auth-Token: ${wrong_api_token}' http://localhost/api/v0") + group MyROGroup v2c readonly + view all included .1 80 + access MyROGroup "" any noauth exact all none none - # add snmphost as a device - librenms.succeed("curl --fail -X POST -d '{\"hostname\":\"snmphost\",\"version\":\"v2c\",\"community\":\"public\"}' -H 'X-Auth-Token: ${api_token}' http://localhost/api/v0/devices") + syslocation Testcity, Testcountry + syscontact Testi mc Test + ''; - # wait until snmphost gets polled - librenms.wait_until_succeeds("test $(curl -H 'X-Auth-Token: ${api_token}' http://localhost/api/v0/devices/snmphost | jq -Mr .devices[0].last_polled) != 'null'") - ''; - } -) + }; + }; + + testScript = '' + start_all() + + snmphost.wait_for_unit("snmpd.service") + + librenms.wait_for_unit("lnms-api-init.service") + librenms.wait_for_open_port(80) + + # Test that we can authenticate against the API + librenms.succeed("curl --fail -H 'X-Auth-Token: ${api_token}' http://localhost/api/v0") + librenms.fail("curl --fail -H 'X-Auth-Token: ${wrong_api_token}' http://localhost/api/v0") + + # add snmphost as a device + librenms.succeed("curl --fail -X POST -d '{\"hostname\":\"snmphost\",\"version\":\"v2c\",\"community\":\"public\"}' -H 'X-Auth-Token: ${api_token}' http://localhost/api/v0/devices") + + # wait until snmphost gets polled + librenms.wait_until_succeeds("test $(curl -H 'X-Auth-Token: ${api_token}' http://localhost/api/v0/devices/snmphost | jq -Mr .devices[0].last_polled) != 'null'") + ''; +} From 470a936f46fed1e6dd699fd286757592b3b5f95d Mon Sep 17 00:00:00 2001 From: Piotr Kwiecinski <2151333+piotrkwiecinski@users.noreply.github.com> Date: Fri, 4 Apr 2025 13:55:33 +0200 Subject: [PATCH 39/56] nixosTests.tuxguitar: migrate to runTest Part of #386873 --- nixos/tests/all-tests.nix | 2 +- nixos/tests/tuxguitar.nix | 50 ++++++++++++++++++--------------------- 2 files changed, 24 insertions(+), 28 deletions(-) diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix index 9ee7f01fef1b..0de678f814b1 100644 --- a/nixos/tests/all-tests.nix +++ b/nixos/tests/all-tests.nix @@ -1350,7 +1350,7 @@ in tuptime = handleTest ./tuptime.nix { }; turbovnc-headless-server = handleTest ./turbovnc-headless-server.nix { }; turn-rs = handleTest ./turn-rs.nix { }; - tuxguitar = handleTest ./tuxguitar.nix { }; + tuxguitar = runTest ./tuxguitar.nix; twingate = runTest ./twingate.nix; typesense = handleTest ./typesense.nix { }; ucarp = handleTest ./ucarp.nix { }; diff --git a/nixos/tests/tuxguitar.nix b/nixos/tests/tuxguitar.nix index e491f96a89ce..d0df7d5c5bb5 100644 --- a/nixos/tests/tuxguitar.nix +++ b/nixos/tests/tuxguitar.nix @@ -1,29 +1,25 @@ -import ./make-test-python.nix ( - { pkgs, ... }: - { - name = "tuxguitar"; - meta = with pkgs.lib.maintainers; { - maintainers = [ ]; +{ ... }: +{ + name = "tuxguitar"; + meta.maintainers = [ ]; + + nodes.machine = + { config, pkgs, ... }: + { + imports = [ + ./common/x11.nix + ]; + + services.xserver.enable = true; + + environment.systemPackages = [ pkgs.tuxguitar ]; }; - nodes.machine = - { config, pkgs, ... }: - { - imports = [ - ./common/x11.nix - ]; - - services.xserver.enable = true; - - environment.systemPackages = [ pkgs.tuxguitar ]; - }; - - testScript = '' - machine.wait_for_x() - machine.succeed("tuxguitar >&2 &") - machine.wait_for_window("TuxGuitar - Untitled.tg") - machine.sleep(1) - machine.screenshot("tuxguitar") - ''; - } -) + testScript = '' + machine.wait_for_x() + machine.succeed("tuxguitar >&2 &") + machine.wait_for_window("TuxGuitar - Untitled.tg") + machine.sleep(1) + machine.screenshot("tuxguitar") + ''; +} From e6067eeed96dd759fa6e49701e9b4dd77b96e549 Mon Sep 17 00:00:00 2001 From: Silvan Mosberger Date: Fri, 4 Apr 2025 14:06:16 +0200 Subject: [PATCH 40/56] nixfmt-rfc-style: 2025-03-03 -> 2025-04-04 Probably the last unstable update before stabilising nixfmt. Includes: - Crucial fixes for the merge tool: https://github.com/NixOS/nixfmt/pull/291 - Recursive mode deprecation warning informing of nixfmt-tree: https://github.com/NixOS/nixfmt/pull/287 --- pkgs/by-name/ni/nixfmt-rfc-style/date.txt | 2 +- pkgs/by-name/ni/nixfmt-rfc-style/generated-package.nix | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/ni/nixfmt-rfc-style/date.txt b/pkgs/by-name/ni/nixfmt-rfc-style/date.txt index 323e1df227fb..24a34eca600b 100644 --- a/pkgs/by-name/ni/nixfmt-rfc-style/date.txt +++ b/pkgs/by-name/ni/nixfmt-rfc-style/date.txt @@ -1 +1 @@ -2025-03-03 +2025-04-04 diff --git a/pkgs/by-name/ni/nixfmt-rfc-style/generated-package.nix b/pkgs/by-name/ni/nixfmt-rfc-style/generated-package.nix index 95e0871add42..1da633e8999d 100644 --- a/pkgs/by-name/ni/nixfmt-rfc-style/generated-package.nix +++ b/pkgs/by-name/ni/nixfmt-rfc-style/generated-package.nix @@ -25,8 +25,8 @@ mkDerivation { pname = "nixfmt"; version = "0.6.0"; src = fetchzip { - url = "https://github.com/nixos/nixfmt/archive/3261d1016ecc753c59ff92767a257f91b587e705.tar.gz"; - sha256 = "0jk6mgp710iwxyc7wa5kzz0p0rpcwbbs21smnv14cyii0jniz42s"; + url = "https://github.com/nixos/nixfmt/archive/65af4b69133d19f534d97746c97c2d5b464f43b4.tar.gz"; + sha256 = "0l0w3janvss1n1j7qkcml97zndm2jm2gbrzzs9d8l0ixnrw0cd5r"; }; isLibrary = true; isExecutable = true; From 8f0d4225d4aca60386844933164e92b6660d00b3 Mon Sep 17 00:00:00 2001 From: Piotr Kwiecinski <2151333+piotrkwiecinski@users.noreply.github.com> Date: Fri, 4 Apr 2025 14:14:45 +0200 Subject: [PATCH 41/56] nixosTests.lighttpd: migrate to runTest Part of #386873 --- nixos/tests/all-tests.nix | 2 +- nixos/tests/lighttpd.nix | 42 +++++++++++++++++++-------------------- 2 files changed, 21 insertions(+), 23 deletions(-) diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix index 9ee7f01fef1b..2c6fa25761a4 100644 --- a/nixos/tests/all-tests.nix +++ b/nixos/tests/all-tests.nix @@ -703,7 +703,7 @@ in libvirtd = handleTest ./libvirtd.nix { }; lidarr = handleTest ./lidarr.nix { }; lightdm = handleTest ./lightdm.nix { }; - lighttpd = handleTest ./lighttpd.nix { }; + lighttpd = runTest ./lighttpd.nix; limesurvey = handleTest ./limesurvey.nix { }; limine = import ./limine { inherit runTest; }; listmonk = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./listmonk.nix { }; diff --git a/nixos/tests/lighttpd.nix b/nixos/tests/lighttpd.nix index 271dc19ef68c..db08fdf3de22 100644 --- a/nixos/tests/lighttpd.nix +++ b/nixos/tests/lighttpd.nix @@ -1,25 +1,23 @@ -import ./make-test-python.nix ( - { lib, pkgs, ... }: - { - name = "lighttpd"; - meta.maintainers = with lib.maintainers; [ bjornfor ]; +{ lib, pkgs, ... }: +{ + name = "lighttpd"; + meta.maintainers = with lib.maintainers; [ bjornfor ]; - nodes = { - server = { - services.lighttpd.enable = true; - services.lighttpd.document-root = pkgs.runCommand "document-root" { } '' - mkdir -p "$out" - echo "hello nixos test" > "$out/file.txt" - ''; - }; + nodes = { + server = { + services.lighttpd.enable = true; + services.lighttpd.document-root = pkgs.runCommand "document-root" { } '' + mkdir -p "$out" + echo "hello nixos test" > "$out/file.txt" + ''; }; + }; - testScript = '' - start_all() - server.wait_for_unit("lighttpd.service") - res = server.succeed("curl --fail http://localhost/file.txt") - assert "hello nixos test" in res, f"bad server response: '{res}'" - server.succeed("systemctl reload lighttpd") - ''; - } -) + testScript = '' + start_all() + server.wait_for_unit("lighttpd.service") + res = server.succeed("curl --fail http://localhost/file.txt") + assert "hello nixos test" in res, f"bad server response: '{res}'" + server.succeed("systemctl reload lighttpd") + ''; +} From d86c274b99b9c40ac54e0423cc99e9ab44105497 Mon Sep 17 00:00:00 2001 From: Piotr Kwiecinski <2151333+piotrkwiecinski@users.noreply.github.com> Date: Fri, 4 Apr 2025 14:23:09 +0200 Subject: [PATCH 42/56] nixosTests.starship: migrate to runTest Part of #386873 --- nixos/tests/all-tests.nix | 2 +- nixos/tests/starship.nix | 92 +++++++++++++++++++-------------------- 2 files changed, 46 insertions(+), 48 deletions(-) diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix index 9ee7f01fef1b..c4928d9e52e5 100644 --- a/nixos/tests/all-tests.nix +++ b/nixos/tests/all-tests.nix @@ -1202,7 +1202,7 @@ in sssd-ldap = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./sssd-ldap.nix { }; stalwart-mail = handleTest ./stalwart-mail.nix { }; stargazer = runTest ./web-servers/stargazer.nix; - starship = handleTest ./starship.nix { }; + starship = runTest ./starship.nix; stash = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./stash.nix { }; static-web-server = handleTest ./web-servers/static-web-server.nix { }; step-ca = handleTestOn [ "x86_64-linux" ] ./step-ca.nix { }; diff --git a/nixos/tests/starship.nix b/nixos/tests/starship.nix index 23e103fc000e..382666d8f176 100644 --- a/nixos/tests/starship.nix +++ b/nixos/tests/starship.nix @@ -1,53 +1,51 @@ -import ./make-test-python.nix ( - { pkgs, ... }: - { - name = "starship"; - meta.maintainers = pkgs.starship.meta.maintainers; +{ pkgs, ... }: +{ + name = "starship"; + meta.maintainers = pkgs.starship.meta.maintainers; - nodes.machine = { - programs = { - fish.enable = true; - zsh.enable = true; + nodes.machine = { + programs = { + fish.enable = true; + zsh.enable = true; - starship = { - enable = true; - settings.format = ""; - }; + starship = { + enable = true; + settings.format = ""; }; - - environment.systemPackages = - map - ( - shell: - pkgs.writeScriptBin "expect-${shell}" '' - #!${pkgs.expect}/bin/expect -f - - spawn env TERM=xterm ${shell} -i - - expect "" { - send "exit\n" - } timeout { - send_user "\n${shell} failed to display Starship\n" - exit 1 - } - - expect eof - '' - ) - [ - "bash" - "fish" - "zsh" - ]; }; - testScript = '' - start_all() - machine.wait_for_unit("default.target") + environment.systemPackages = + map + ( + shell: + pkgs.writeScriptBin "expect-${shell}" '' + #!${pkgs.expect}/bin/expect -f - machine.succeed("expect-bash") - machine.succeed("expect-fish") - machine.succeed("expect-zsh") - ''; - } -) + spawn env TERM=xterm ${shell} -i + + expect "" { + send "exit\n" + } timeout { + send_user "\n${shell} failed to display Starship\n" + exit 1 + } + + expect eof + '' + ) + [ + "bash" + "fish" + "zsh" + ]; + }; + + testScript = '' + start_all() + machine.wait_for_unit("default.target") + + machine.succeed("expect-bash") + machine.succeed("expect-fish") + machine.succeed("expect-zsh") + ''; +} From 3c6b1cf6f60dd2e786c6ed11a22eab790863d41b Mon Sep 17 00:00:00 2001 From: Neyts Zupan Date: Thu, 3 Apr 2025 20:25:28 +0100 Subject: [PATCH 43/56] paretosecurity: 0.0.96 -> 0.1.3 Also: * Fix PATH for systemd services * Make UI tests faster and more robust by setting low resolution --- nixos/modules/services/security/paretosecurity.nix | 14 ++++++++++++++ nixos/tests/paretosecurity.nix | 11 +++++++++-- pkgs/by-name/pa/paretosecurity/package.nix | 6 +++--- 3 files changed, 26 insertions(+), 5 deletions(-) diff --git a/nixos/modules/services/security/paretosecurity.nix b/nixos/modules/services/security/paretosecurity.nix index 9ec196eee6a0..a1080ede8431 100644 --- a/nixos/modules/services/security/paretosecurity.nix +++ b/nixos/modules/services/security/paretosecurity.nix @@ -24,6 +24,17 @@ # dependencies here. This creates the necessary symlinks in the proper locations. systemd.sockets.paretosecurity.wantedBy = [ "sockets.target" ]; + # In NixOS, systemd services are configured with minimal PATH. However, + # paretosecurity helper looks for installed software to do its job, so + # it needs the full system PATH. For example, it runs `iptables` to see if + # firewall is configured. And it looks for various password managers to see + # if one is installed. + # The `paretosecurity-user` timer service that is configured lower has + # the same need. + systemd.services.paretosecurity.serviceConfig.Environment = [ + "PATH=${config.system.path}/bin:${config.system.path}/sbin" + ]; + # Enable the tray icon and timer services if the trayIcon option is enabled systemd.user = lib.mkIf config.services.paretosecurity.trayIcon { services.paretosecurity-trayicon = { @@ -31,6 +42,9 @@ }; services.paretosecurity-user = { wantedBy = [ "graphical-session.target" ]; + serviceConfig.Environment = [ + "PATH=${config.system.path}/bin:${config.system.path}/sbin" + ]; }; timers.paretosecurity-user = { wantedBy = [ "timers.target" ]; diff --git a/nixos/tests/paretosecurity.nix b/nixos/tests/paretosecurity.nix index a2b9317c678f..bf9af17e2f5e 100644 --- a/nixos/tests/paretosecurity.nix +++ b/nixos/tests/paretosecurity.nix @@ -29,6 +29,8 @@ package = patchedPareto; }; + networking.firewall.enable = true; + }; nodes.dashboard = @@ -64,6 +66,12 @@ services.displayManager.autoLogin = { enable = true; user = "alice"; + + }; + + virtualisation.resolution = { + x = 640; + y = 480; }; environment.systemPackages = [ pkgs.xdotool ]; @@ -94,7 +102,6 @@ + " --skip 21830a4e-84f1-48fe-9c5b-beab436b2cdb" # Disk encryption + " --skip 44e4754a-0b42-4964-9cc2-b88b2023cb1e" # Pareto Security is up to date + " --skip f962c423-fdf5-428a-a57a-827abc9b253e" # Password manager installed - + " --skip 2e46c89a-5461-4865-a92e-3b799c12034a" # Firewall is enabled + "'" ) @@ -117,7 +124,7 @@ ]: status, out = xfce.systemctl("is-enabled " + unit, "alice") assert status == 0, f"Unit {unit} is not enabled (status: {status}): {out}" - xfce.succeed("xdotool mousemove 850 10") + xfce.succeed("xdotool mousemove 460 10") xfce.wait_for_text("Pareto Security") xfce.succeed("xdotool click 1") xfce.wait_for_text("Run Checks") diff --git a/pkgs/by-name/pa/paretosecurity/package.nix b/pkgs/by-name/pa/paretosecurity/package.nix index e6b5232d75cb..25728d4e32a3 100644 --- a/pkgs/by-name/pa/paretosecurity/package.nix +++ b/pkgs/by-name/pa/paretosecurity/package.nix @@ -9,16 +9,16 @@ buildGoModule rec { pname = "paretosecurity"; - version = "0.0.96"; + version = "0.1.3"; src = fetchFromGitHub { owner = "ParetoSecurity"; repo = "agent"; rev = version; - hash = "sha256-SyeIGSDvrnOvyOJ0zC8CulpaMa+iZeRaMTJUSydz2tw="; + hash = "sha256-ovyfHqLCf5U3UR1HfoA+UQhqLZ6IaILcpqptPRQsb60="; }; - vendorHash = "sha256-O/OF3Y6HiiikMxf657k9eIM7UfkicIImAUxVVf/TgR8="; + vendorHash = "sha256-7mKAFkKGpBOjXc3J/sfF3k3pJF53tFybXZgbfJInuSY="; proxyVendor = true; ldflags = [ From 0f8342b5f490334c96e2f2984c089a6d21b01032 Mon Sep 17 00:00:00 2001 From: Moritz Sanft <58110325+msanft@users.noreply.github.com> Date: Fri, 4 Apr 2025 15:15:34 +0200 Subject: [PATCH 44/56] mkosi: rename python3 -> python --- pkgs/tools/virtualization/mkosi/default.nix | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/pkgs/tools/virtualization/mkosi/default.nix b/pkgs/tools/virtualization/mkosi/default.nix index 6f2fdc6eefe4..1163a909fec3 100644 --- a/pkgs/tools/virtualization/mkosi/default.nix +++ b/pkgs/tools/virtualization/mkosi/default.nix @@ -2,6 +2,7 @@ lib, fetchFromGitHub, stdenv, + python, systemd, pandoc, kmod, @@ -15,13 +16,11 @@ replaceVars, # Python packages - python, setuptools, setuptools-scm, wheel, buildPythonApplication, pytestCheckHook, - pefile, # Optional dependencies withQemu ? false, @@ -46,7 +45,7 @@ let withKernelInstall = true; }; - python3pefile = python.withPackages (_: [ pefile ]); + pythonWithPefile = python.withPackages (ps: [ ps.pefile ]); deps = [ @@ -85,7 +84,7 @@ buildPythonApplication rec { [ (replaceVars ./0001-Use-wrapped-binaries-instead-of-Python-interpreter.patch { UKIFY = "${systemdForMkosi}/lib/systemd/ukify"; - PYTHON_PEFILE = "${python3pefile}/bin/python3.12"; + PYTHON_PEFILE = lib.getExe pythonWithPefile; NIX_PATH = toString (lib.makeBinPath deps); MKOSI_SANDBOX = null; # will be replaced in postPatch }) From 2789c83e9c0d696bc44516c80c599c87c8279316 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Fri, 4 Apr 2025 13:54:00 +0000 Subject: [PATCH 45/56] gosec: 2.22.2 -> 2.22.3 --- pkgs/by-name/go/gosec/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/go/gosec/package.nix b/pkgs/by-name/go/gosec/package.nix index c066b645df68..79b2d9bfd682 100644 --- a/pkgs/by-name/go/gosec/package.nix +++ b/pkgs/by-name/go/gosec/package.nix @@ -6,16 +6,16 @@ buildGoModule rec { pname = "gosec"; - version = "2.22.2"; + version = "2.22.3"; src = fetchFromGitHub { owner = "securego"; repo = pname; rev = "v${version}"; - hash = "sha256-j9MRMtINGPn4Hn9Z3+19/Q+Weu277WVONXKtJf9x5Cc="; + hash = "sha256-MQ/dDK2t9H7bSsr5MMtlKySLAJIDimRbpATHyOYxrBo="; }; - vendorHash = "sha256-lZFTmf4/J3NDdawfp2WpPoaVxepbyazIyC8ahOwPcZo="; + vendorHash = "sha256-R1w+dHx3Aond6DmwCHRVZXmUABWfpsbLgcDW67Ukz0E="; subPackages = [ "cmd/gosec" From 9fbc4bf2d3c2f8c8339e536c1abd69c7c89617fe Mon Sep 17 00:00:00 2001 From: Yohann Boniface Date: Fri, 4 Apr 2025 15:56:11 +0200 Subject: [PATCH 46/56] linux-doc: fix build (#395281) --- pkgs/os-specific/linux/kernel/htmldocs.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkgs/os-specific/linux/kernel/htmldocs.nix b/pkgs/os-specific/linux/kernel/htmldocs.nix index f6c02fc5ea7e..bfd7de475e17 100644 --- a/pkgs/os-specific/linux/kernel/htmldocs.nix +++ b/pkgs/os-specific/linux/kernel/htmldocs.nix @@ -19,7 +19,7 @@ stdenv.mkDerivation { patchShebangs \ Documentation/sphinx/parse-headers.pl \ scripts/{get_abi.pl,get_feat.pl,kernel-doc,sphinx-pre-install} \ - tools/net/ynl/ynl-gen-rst.py + tools/net/ynl/pyynl/ynl_gen_rst.py ''; FONTCONFIG_FILE = makeFontsConf { From 57ddd56634b85ea00171bc58b2c59d1c9b3c47cd Mon Sep 17 00:00:00 2001 From: "Adam C. Stephens" Date: Fri, 4 Apr 2025 13:56:45 +0000 Subject: [PATCH 47/56] grafana-loki: 3.4.2 -> 3.4.3 https://github.com/grafana/loki/releases/tag/v3.4.3 --- pkgs/by-name/gr/grafana-loki/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/gr/grafana-loki/package.nix b/pkgs/by-name/gr/grafana-loki/package.nix index 8aeda3eb7495..69f76cdf2946 100644 --- a/pkgs/by-name/gr/grafana-loki/package.nix +++ b/pkgs/by-name/gr/grafana-loki/package.nix @@ -12,14 +12,14 @@ }: buildGoModule rec { - version = "3.4.2"; + version = "3.4.3"; pname = "grafana-loki"; src = fetchFromGitHub { owner = "grafana"; repo = "loki"; rev = "v${version}"; - hash = "sha256-GE92NlFCOk6qFtrgeBvLDI0OkmWaJ1j07Q14+jgi9+w="; + hash = "sha256-1tI9X2eIKuWEWJBbN4UAw8yeRrjgfqcenJyTNMk5rqU="; }; vendorHash = null; From 428cee5acf1970b3aa0f5710de38d3ef5af492b8 Mon Sep 17 00:00:00 2001 From: "Adam C. Stephens" Date: Fri, 4 Apr 2025 14:00:02 +0000 Subject: [PATCH 48/56] erlang_27: 27.3.1 -> 27.3.2 https://github.com/erlang/otp/releases/tag/OTP-27.3.2 --- pkgs/development/interpreters/erlang/27.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/interpreters/erlang/27.nix b/pkgs/development/interpreters/erlang/27.nix index 8a2955813656..8acd7815772c 100644 --- a/pkgs/development/interpreters/erlang/27.nix +++ b/pkgs/development/interpreters/erlang/27.nix @@ -1,6 +1,6 @@ { mkDerivation }: mkDerivation { - version = "27.3.1"; - sha256 = "sha256-VuVRwcS2TgDYT7buLMHOe8r0AWM+R9DxydcHErAy8xw="; + version = "27.3.2"; + sha256 = "sha256-Pybkcm3pLt0wV+S9ia/BAmM1AKp/nVSAckEzNn4KjSg="; } From b494878375c609b59ec0d09855e775f5ced90a01 Mon Sep 17 00:00:00 2001 From: Gaetan Lepage Date: Fri, 4 Apr 2025 16:06:36 +0200 Subject: [PATCH 49/56] nix-update: 1.10.0 -> 1.11.0 Diff: https://github.com/Mic92/nix-update/compare/refs/tags/1.10.0...1.11.0 Changelog: https://github.com/Mic92/nix-update/releases/tag/1.11.0 --- pkgs/by-name/ni/nix-update/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/ni/nix-update/package.nix b/pkgs/by-name/ni/nix-update/package.nix index 6e32a46cbe6c..fd0194e180f6 100644 --- a/pkgs/by-name/ni/nix-update/package.nix +++ b/pkgs/by-name/ni/nix-update/package.nix @@ -11,14 +11,14 @@ let self = python3Packages.buildPythonApplication { pname = "nix-update"; - version = "1.10.0"; + version = "1.11.0"; pyproject = true; src = fetchFromGitHub { owner = "Mic92"; repo = "nix-update"; tag = self.version; - hash = "sha256-fGs/EdCEoDA9N5gPtHU6CaDZo9e/aqW6pm6atsjK7PI="; + hash = "sha256-G5YehePEMhTgxCnLp8Dg+bDHvOe+QltlCkQHVwMtYx0="; }; build-system = [ python3Packages.setuptools ]; From 991ddfebd8539981f77c2567ac99b394935a2f4a Mon Sep 17 00:00:00 2001 From: Gaetan Lepage Date: Fri, 4 Apr 2025 16:11:25 +0200 Subject: [PATCH 50/56] nix-update: simplify expression --- pkgs/by-name/ni/nix-update/package.nix | 98 +++++++++++++------------- 1 file changed, 48 insertions(+), 50 deletions(-) diff --git a/pkgs/by-name/ni/nix-update/package.nix b/pkgs/by-name/ni/nix-update/package.nix index fd0194e180f6..ce343a85db56 100644 --- a/pkgs/by-name/ni/nix-update/package.nix +++ b/pkgs/by-name/ni/nix-update/package.nix @@ -6,57 +6,55 @@ nix-prefetch-git, nixpkgs-review, python3Packages, + nix-update, }: -let - self = python3Packages.buildPythonApplication { - pname = "nix-update"; - version = "1.11.0"; - pyproject = true; +python3Packages.buildPythonApplication rec { + pname = "nix-update"; + version = "1.11.0"; + pyproject = true; - src = fetchFromGitHub { - owner = "Mic92"; - repo = "nix-update"; - tag = self.version; - hash = "sha256-G5YehePEMhTgxCnLp8Dg+bDHvOe+QltlCkQHVwMtYx0="; - }; - - build-system = [ python3Packages.setuptools ]; - - makeWrapperArgs = [ - "--prefix" - "PATH" - ":" - (lib.makeBinPath [ - nix - nix-prefetch-git - nixpkgs-review - ]) - ]; - - checkPhase = '' - runHook preCheck - - $out/bin/nix-update --help >/dev/null - - runHook postCheck - ''; - - passthru = { - nix-update-script = callPackage ./nix-update-script.nix { nix-update = self; }; - }; - - meta = { - description = "Swiss-knife for updating nix packages"; - homepage = "https://github.com/Mic92/nix-update/"; - changelog = "https://github.com/Mic92/nix-update/releases/tag/${self.version}"; - license = lib.licenses.mit; - maintainers = with lib.maintainers; [ - figsoda - mic92 - ]; - mainProgram = "nix-update"; - }; + src = fetchFromGitHub { + owner = "Mic92"; + repo = "nix-update"; + tag = version; + hash = "sha256-G5YehePEMhTgxCnLp8Dg+bDHvOe+QltlCkQHVwMtYx0="; }; -in -self + + build-system = [ python3Packages.setuptools ]; + + makeWrapperArgs = [ + "--prefix" + "PATH" + ":" + (lib.makeBinPath [ + nix + nix-prefetch-git + nixpkgs-review + ]) + ]; + + checkPhase = '' + runHook preCheck + + $out/bin/nix-update --help >/dev/null + + runHook postCheck + ''; + + passthru = { + nix-update-script = callPackage ./nix-update-script.nix { inherit nix-update; }; + }; + + meta = { + description = "Swiss-knife for updating nix packages"; + homepage = "https://github.com/Mic92/nix-update/"; + changelog = "https://github.com/Mic92/nix-update/releases/tag/${version}"; + license = lib.licenses.mit; + maintainers = with lib.maintainers; [ + figsoda + mic92 + ]; + mainProgram = "nix-update"; + }; +} From c4500a94e4676ae4520af302430da88a84ad2169 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Fri, 4 Apr 2025 14:34:55 +0000 Subject: [PATCH 51/56] python312Packages.posthog: 3.18.1 -> 3.23.0 --- pkgs/development/python-modules/posthog/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/python-modules/posthog/default.nix b/pkgs/development/python-modules/posthog/default.nix index 98496c26958f..d3ffd2b75a3c 100644 --- a/pkgs/development/python-modules/posthog/default.nix +++ b/pkgs/development/python-modules/posthog/default.nix @@ -19,14 +19,14 @@ buildPythonPackage rec { pname = "posthog"; - version = "3.18.1"; + version = "3.23.0"; pyproject = true; src = fetchFromGitHub { owner = "PostHog"; repo = "posthog-python"; tag = "v${version}"; - hash = "sha256-1jJACzDf8J4Vsrvtj0PgeK1Ck2Bzy5ThHm0Ohd+LyYs="; + hash = "sha256-+nmCmO1vPnNgZJdZSWwapeFfckNXEcdc/129yaLygf8="; }; build-system = [ setuptools ]; From 4bbc09a1d0a044f2e894a4b42e5d5c485aefa36b Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Fri, 4 Apr 2025 14:41:15 +0000 Subject: [PATCH 52/56] beam26Packages.erlfmt: 1.6.0 -> 1.6.1 --- pkgs/development/beam-modules/erlfmt/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/beam-modules/erlfmt/default.nix b/pkgs/development/beam-modules/erlfmt/default.nix index 8a51cd792009..405aec021fc3 100644 --- a/pkgs/development/beam-modules/erlfmt/default.nix +++ b/pkgs/development/beam-modules/erlfmt/default.nix @@ -6,12 +6,12 @@ rebar3Relx rec { pname = "erlfmt"; - version = "1.6.0"; + version = "1.6.1"; releaseType = "escript"; src = fetchFromGitHub { owner = "WhatsApp"; repo = "erlfmt"; - sha256 = "sha256-p4cdnKDY02XqdFOkijhOo527eZenfMF8J2dbuvH/hcY="; + sha256 = "sha256-O7+7dMgmnNd9hHuRcJqMAI0gmONz5EO3qSlUC3tufh0="; rev = "v${version}"; }; meta = with lib; { From 7afa349ea8b05e500c37e72e5e70f15e35a242eb Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= Date: Mon, 23 Dec 2024 04:43:33 +0100 Subject: [PATCH 53/56] nixos/paperless: mirror upstream admin user creation more closely Closes #249767 Before we only created the admin user when passwordFile was set. Now it is possible to set PAPERLESS_ADMIN_USER and PAPERLESS_ADMIN_PASSWORD directly to create the admin user, like in the upstream Docker image. --- nixos/modules/services/misc/paperless.nix | 20 +++++++++++--------- 1 file changed, 11 insertions(+), 9 deletions(-) diff --git a/nixos/modules/services/misc/paperless.nix b/nixos/modules/services/misc/paperless.nix index db703ce77883..c1f35526bd9b 100644 --- a/nixos/modules/services/misc/paperless.nix +++ b/nixos/modules/services/misc/paperless.nix @@ -421,8 +421,7 @@ in }; environment = env; - preStart = - '' + preStart = '' # remove old papaerless-manage symlink # TODO: drop with NixOS 25.11 [[ -L '${cfg.dataDir}/paperless-manage' ]] && rm '${cfg.dataDir}/paperless-manage' @@ -448,13 +447,15 @@ in ${cfg.package}/bin/paperless-ngx document_index reindex fi - echo ${cfg.package.version} > "$versionFile" - fi - '' - + lib.optionalString (cfg.passwordFile != null) '' + echo ${cfg.package.version} > "$versionFile" + fi + + if ${lib.boolToString (cfg.passwordFile != null)} || [[ -n $PAPERLESS_ADMIN_PASSWORD ]]; then export PAPERLESS_ADMIN_USER="''${PAPERLESS_ADMIN_USER:-admin}" - PAPERLESS_ADMIN_PASSWORD=$(cat "$CREDENTIALS_DIRECTORY/PAPERLESS_ADMIN_PASSWORD") - export PAPERLESS_ADMIN_PASSWORD + if [[ -e $CREDENTIALS_DIRECTORY/PAPERLESS_ADMIN_PASSWORD ]]; then + PAPERLESS_ADMIN_PASSWORD=$(cat "$CREDENTIALS_DIRECTORY/PAPERLESS_ADMIN_PASSWORD") + export PAPERLESS_ADMIN_PASSWORD + fi superuserState="$PAPERLESS_ADMIN_USER:$PAPERLESS_ADMIN_PASSWORD" superuserStateFile="${cfg.dataDir}/superuser-state" @@ -462,7 +463,8 @@ in ${cfg.package}/bin/paperless-ngx manage_superuser echo "$superuserState" > "$superuserStateFile" fi - ''; + fi + ''; requires = lib.optional cfg.database.createLocally "postgresql.service"; after = lib.optional enableRedis "redis-paperless.service" From 40bd63a475c362475ef10d4ff3a3dcce4d166fe8 Mon Sep 17 00:00:00 2001 From: Qiming Chu Date: Fri, 4 Apr 2025 23:39:58 +0800 Subject: [PATCH 54/56] home-assistant: pin jellyfin-apiclient-python to version 1.10.0 Signed-off-by: Qiming Chu --- pkgs/servers/home-assistant/default.nix | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/pkgs/servers/home-assistant/default.nix b/pkgs/servers/home-assistant/default.nix index 78eff4e2231f..1a25a9bf1007 100644 --- a/pkgs/servers/home-assistant/default.nix +++ b/pkgs/servers/home-assistant/default.nix @@ -151,6 +151,18 @@ let ]; }); + # Pinned due to home-assistant still needing 1.10.0 verison + # Remove this when home-assistant upates the jellyfin-apiclient-python version + jellyfin-apiclient-python = super.jellyfin-apiclient-python.overridePythonAttrs (oldAttrs: rec { + version = "1.10.0"; + src = fetchFromGitHub { + owner = "jellyfin"; + repo = "jellyfin-apiclient-python"; + tag = "v${version}"; + hash = "sha256-H1FqypNuVIZ17cFdNDEmmKICswxJkUGq2LhlingbCVk="; + }; + }); + # acme and thus hass-nabucasa doesn't support josepy v2 # https://github.com/certbot/certbot/issues/10185 josepy = super.josepy.overridePythonAttrs (old: rec { From fdcba6e9d5358959436f4ced8c362d5f96533a5c Mon Sep 17 00:00:00 2001 From: Victor Rodriguez Date: Fri, 4 Apr 2025 10:57:33 -0600 Subject: [PATCH 55/56] ytui-music: replace youtube-dl with yt-dlp --- pkgs/by-name/yt/ytui-music/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/yt/ytui-music/package.nix b/pkgs/by-name/yt/ytui-music/package.nix index 8bc1d7e5334f..53ca6814919d 100644 --- a/pkgs/by-name/yt/ytui-music/package.nix +++ b/pkgs/by-name/yt/ytui-music/package.nix @@ -8,7 +8,7 @@ stdenv, darwin, mpv, - youtube-dl, + yt-dlp, makeBinaryWrapper, }: @@ -49,7 +49,7 @@ rustPlatform.buildRustPackage rec { postInstall = '' wrapProgram $out/bin/ytui_music \ - --prefix PATH : ${lib.makeBinPath [ youtube-dl ]} + --prefix PATH : ${lib.makeBinPath [ yt-dlp ]} ''; doInstallCheck = true; From 249b8edca06f58cd5ac3a16950bb6d6c724f35ca Mon Sep 17 00:00:00 2001 From: Mirza Arnaut Date: Fri, 4 Apr 2025 18:58:21 +0200 Subject: [PATCH 56/56] copilot-language-server: add fhs version (#393260) --- .../co/copilot-language-server/package.nix | 29 +++++++++++++++---- pkgs/top-level/all-packages.nix | 2 ++ 2 files changed, 26 insertions(+), 5 deletions(-) diff --git a/pkgs/by-name/co/copilot-language-server/package.nix b/pkgs/by-name/co/copilot-language-server/package.nix index c0d97ed5723a..f03224ab18f4 100644 --- a/pkgs/by-name/co/copilot-language-server/package.nix +++ b/pkgs/by-name/co/copilot-language-server/package.nix @@ -1,6 +1,7 @@ { lib, stdenvNoCC, + buildFHSEnv, fetchzip, nix-update-script, }: @@ -24,8 +25,24 @@ let } ."${stdenvNoCC.hostPlatform.system}" or (throw "Unsupported system: ${stdenvNoCC.hostPlatform.system}"); -in + executableName = "copilot-language-server"; + fhs = + { package }: + buildFHSEnv { + name = package.meta.mainProgram; + version = package.version; + targetPkgs = pkgs: [ pkgs.stdenv.cc.cc.lib ]; + runScript = lib.getExe package; + + meta = package.meta // { + description = + package.meta.description + + " (FHS-wrapped, expand package details for further information when to use it)"; + longDescription = "Use this version if you encounter an error like `Could not start dynamically linked executable` or `SyntaxError: Invalid or unexpected token` (see nixpkgs issue [391730](https://github.com/NixOS/nixpkgs/issues/391730))."; + }; + }; +in stdenvNoCC.mkDerivation (finalAttrs: { pname = "copilot-language-server"; version = "1.294.0"; @@ -36,18 +53,20 @@ stdenvNoCC.mkDerivation (finalAttrs: { stripRoot = false; }; - npmDepsHash = "sha256-PLX/mN7xu8gMh2BkkyTncP3+rJ3nBmX+pHxl0ONXbe4="; installPhase = '' runHook preInstall - install -Dt "$out"/bin "${os}-${arch}"/copilot-language-server + install "${os}-${arch}/${executableName}" -Dm755 -t "$out"/bin runHook postInstall ''; dontStrip = true; - passthru.updateScript = nix-update-script { }; + passthru = { + updateScript = nix-update-script { }; + fhs = fhs { package = finalAttrs.finalPackage; }; + }; meta = { description = "Use GitHub Copilot with any editor or IDE via the Language Server Protocol"; @@ -60,7 +79,7 @@ stdenvNoCC.mkDerivation (finalAttrs: { shortName = "GitHub Copilot License"; url = "https://github.com/customer-terms/github-copilot-product-specific-terms"; }; - mainProgram = "copilot-language-server"; + mainProgram = executableName; platforms = [ "x86_64-linux" "aarch64-linux" diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index 11a44028da68..e7687e393439 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -359,6 +359,8 @@ with pkgs; coolercontrol = recurseIntoAttrs (callPackage ../applications/system/coolercontrol { }); + copilot-language-server-fhs = copilot-language-server.fhs; + curv = callPackage ../by-name/cu/curv/package.nix { openexr = openexr_3; };