From 042d01678115aebf5258362f84e106710d6ef15b Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Thu, 1 Aug 2024 02:02:13 +0200 Subject: [PATCH 1/8] python312Packages.sentry-sdk_2: 2.11.0 -> 2.12.0 https://github.com/getsentry/sentry-python/blob/2.12.0/CHANGELOG.md --- pkgs/development/python-modules/sentry-sdk/default.nix | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/pkgs/development/python-modules/sentry-sdk/default.nix b/pkgs/development/python-modules/sentry-sdk/default.nix index 38200db6976f..cd522d2b06e6 100644 --- a/pkgs/development/python-modules/sentry-sdk/default.nix +++ b/pkgs/development/python-modules/sentry-sdk/default.nix @@ -63,14 +63,14 @@ buildPythonPackage rec { pname = "sentry-sdk"; - version = "2.11.0"; + version = "2.12.0"; pyproject = true; src = fetchFromGitHub { owner = "getsentry"; repo = "sentry-python"; rev = version; - hash = "sha256-ajinOND8MC9Z69WPxF65wjOmJfU5CZUzTRWJwLLh/OQ="; + hash = "sha256-34/QDus1KKCD2fe0ZTmgB1hTqMC7M6/fuuqKYRRsJ2E="; }; postPatch = '' @@ -189,6 +189,7 @@ buildPythonPackage rec { "test_auto_session_tracking_with_aggregates" # timing sensitive "test_profile_captured" + "test_continuous_profiler_manual_start_and_stop" ]; pythonImportsCheck = [ "sentry_sdk" ]; From de2963ddfeba4055e3fc637c701c397cbcdbebd3 Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Thu, 1 Aug 2024 02:19:33 +0200 Subject: [PATCH 2/8] python312Packages.python-bidi: 0.4.2 -> 0.6.0 https://github.com/MeirKriheli/python-bidi/releases/tag/v0.5.0 https://github.com/MeirKriheli/python-bidi/releases/tag/v0.5.1 https://github.com/MeirKriheli/python-bidi/releases/tag/v0.5.2 https://github.com/MeirKriheli/python-bidi/releases/tag/v0.6.0 --- .../python-modules/python-bidi/default.nix | 34 ++++++++++++++----- 1 file changed, 26 insertions(+), 8 deletions(-) diff --git a/pkgs/development/python-modules/python-bidi/default.nix b/pkgs/development/python-modules/python-bidi/default.nix index c18f52714c3c..0c35e6579696 100644 --- a/pkgs/development/python-modules/python-bidi/default.nix +++ b/pkgs/development/python-modules/python-bidi/default.nix @@ -1,21 +1,39 @@ { lib, buildPythonPackage, - fetchPypi, - six, + fetchFromGitHub, + rustPlatform, + pytestCheckHook, }: buildPythonPackage rec { pname = "python-bidi"; - version = "0.4.2"; - format = "setuptools"; + version = "0.6.0"; + pyproject = true; - src = fetchPypi { - inherit pname version; - sha256 = "U0f3HoKz6Zdtxlfwne0r/jm6jWd3yoGlssVsMBIcSW4="; + src = fetchFromGitHub { + owner = "MeirKriheli"; + repo = "python-bidi"; + rev = "refs/tags/v${version}"; + hash = "sha256-LrXt9qaXfy8Rn9HjU4YSTFT4WsqzwCgh0flcxXOTF6E="; }; - propagatedBuildInputs = [ six ]; + cargoDeps = rustPlatform.fetchCargoTarball { + inherit src; + name = "${pname}-${version}"; + hash = "sha256-34R8T8cXiX1iRx/Zb51Eb/nf0wLpN38hz0VnsmzPzws="; + }; + + build-system = [ + rustPlatform.cargoSetupHook + rustPlatform.maturinBuildHook + ]; + + preCheck = '' + rm -rf bidi + ''; + + nativeCheckInputs = [ pytestCheckHook ]; meta = with lib; { homepage = "https://github.com/MeirKriheli/python-bidi"; From 5c7f63cf1c54b9f20739cb319d756ff18890167e Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Thu, 1 Aug 2024 02:22:30 +0200 Subject: [PATCH 3/8] python312Packages.webauthn: 2.1.0 -> 2.2.0 https://github.com/duo-labs/py_webauthn/blob/v2.2.0/CHANGELOG.md --- .../development/python-modules/webauthn/default.nix | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/pkgs/development/python-modules/webauthn/default.nix b/pkgs/development/python-modules/webauthn/default.nix index f74727188166..476445e0d462 100644 --- a/pkgs/development/python-modules/webauthn/default.nix +++ b/pkgs/development/python-modules/webauthn/default.nix @@ -2,8 +2,10 @@ lib, buildPythonPackage, fetchFromGitHub, + setuptools, asn1crypto, cbor2, + cryptography, pythonOlder, pyopenssl, pytestCheckHook, @@ -11,8 +13,8 @@ buildPythonPackage rec { pname = "webauthn"; - version = "2.1.0"; - format = "setuptools"; + version = "2.2.0"; + pyproject = true; disabled = pythonOlder "3.8"; @@ -20,12 +22,15 @@ buildPythonPackage rec { owner = "duo-labs"; repo = "py_webauthn"; rev = "refs/tags/v${version}"; - hash = "sha256-AfQ3lt0WvoThU5kCE7MzhAXwbqmNaCrUqOMWI937hO4="; + hash = "sha256-NBCR5GwmXA6COP9NOYnoD3l1vuOpym/kyNawd8FstLc="; }; + build-system = [ setuptools ]; + propagatedBuildInputs = [ asn1crypto cbor2 + cryptography pyopenssl ]; @@ -35,7 +40,7 @@ buildPythonPackage rec { disabledTests = [ # TypeError: X509StoreContextError.__init__() missing 1 required... - "test_throws_on_bad_root_cert" + #"test_throws_on_bad_root_cert" ]; meta = with lib; { From aba20f38cb46572d4f821bd5ff212d95e6aaff5c Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Thu, 1 Aug 2024 02:26:22 +0200 Subject: [PATCH 4/8] python312Packages.django-hijack: 3.5.4 -> 3.6.0 https://github.com/django-hijack/django-hijack/releases/tag/3.6.0 --- pkgs/development/python-modules/django-hijack/default.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/development/python-modules/django-hijack/default.nix b/pkgs/development/python-modules/django-hijack/default.nix index 6d29cacb8c54..5900e4a42ff5 100644 --- a/pkgs/development/python-modules/django-hijack/default.nix +++ b/pkgs/development/python-modules/django-hijack/default.nix @@ -21,14 +21,14 @@ buildPythonPackage rec { pname = "django-hijack"; - version = "3.5.4"; + version = "3.6.0"; pyproject = true; src = fetchFromGitHub { owner = "django-hijack"; repo = "django-hijack"; rev = "refs/tags/${version}"; - hash = "sha256-d8rKn4Hab7y/e/VLhVfr3A3TUhoDtjP7RhCj+o6IbyE="; + hash = "sha256-uece+tR3Nd32nfKn1gtcWqckN4z5iUP+C0dJxyDPXBA="; }; postPatch = '' @@ -58,7 +58,7 @@ buildPythonPackage rec { ]; preCheck = '' - export DJANGO_SETTINGS_MODULE=hijack.tests.test_app.settings + export DJANGO_SETTINGS_MODULE=tests.test_app.settings ''; # needed for npmDeps update From 63f15b89de6ae4039253791bd392fa858808343a Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Thu, 1 Aug 2024 03:04:48 +0200 Subject: [PATCH 5/8] pretix: 2024.6.0 -> 2024.7.0 https://pretix.eu/about/en/blog/20240726-release-2024-7/ --- pkgs/by-name/pr/pretix/package.nix | 44 ++++++++++++++----------- pkgs/by-name/pr/pretix/pr4362.patch | 50 +++++++++++++++++++++++++++++ 2 files changed, 75 insertions(+), 19 deletions(-) create mode 100644 pkgs/by-name/pr/pretix/pr4362.patch diff --git a/pkgs/by-name/pr/pretix/package.nix b/pkgs/by-name/pr/pretix/package.nix index c561e9c61c41..40a51c1458d1 100644 --- a/pkgs/by-name/pr/pretix/package.nix +++ b/pkgs/by-name/pr/pretix/package.nix @@ -40,13 +40,13 @@ let }; pname = "pretix"; - version = "2024.6.0"; + version = "2024.7.0"; src = fetchFromGitHub { owner = "pretix"; repo = "pretix"; rev = "refs/tags/v${version}"; - hash = "sha256-erI3Ai6zwNSvMiF3YKfnU9ePb9R92rfi5rsxfAOh6EQ="; + hash = "sha256-08ykuFPcG3WvinJd9zadirXFqsMt9GbdOGU2CGbW7ls="; }; npmDeps = buildNpmPackage { @@ -54,7 +54,7 @@ let inherit version src; sourceRoot = "${src.name}/src/pretix/static/npm_dir"; - npmDepsHash = "sha256-//CLPnx5eUxIHIUGc7x2UF8qsfAYRtvHbHXSDNtI/eI="; + npmDepsHash = "sha256-BfvKuwB5VLX09Lxji+EpMBvZeKTIQvptVtrHSRYY+14="; dontBuild = true; @@ -76,6 +76,26 @@ python.pkgs.buildPythonApplication rec { # Discover pretix.plugin entrypoints during build and add them into # INSTALLED_APPS, so that their static files are collected. ./plugin-build.patch + + # https://github.com/pretix/pretix/pull/4362 + # Fix TOCTOU race in directory creation + ./pr4362.patch + ]; + + pythonRelaxDeps = [ + "bleach" + "importlib-metadata" + "pillow" + "protobuf" + "python-bidi" + "requests" + "sentry-sdk" + ]; + + pythonRemoveDeps = [ + "phonenumberslite" # we provide phonenumbers instead + "psycopg2-binary" # we provide psycopg2 instead + "vat-moss-forked" # we provide a patched vat-moss package ]; postPatch = '' @@ -88,22 +108,8 @@ python.pkgs.buildPythonApplication rec { sed -i "/setuptools-rust/d" pyproject.toml substituteInPlace pyproject.toml \ - --replace-fail phonenumberslite phonenumbers \ - --replace-fail psycopg2-binary psycopg2 \ - --replace-fail vat_moss_forked==2020.3.20.0.11.0 vat-moss \ - --replace-fail "bleach==5.0.*" bleach \ - --replace-fail "djangorestframework==3.15.*" djangorestframework \ - --replace-fail "django-compressor==4.5" django-compressor \ - --replace-fail "dnspython==2.6.*" dnspython \ - --replace-fail "importlib_metadata==7.*" importlib_metadata \ - --replace-fail "markdown==3.6" markdown \ - --replace-fail "protobuf==5.27.*" protobuf \ - --replace-fail "pycryptodome==3.20.*" pycryptodome \ - --replace-fail "pypdf==4.2.*" pypdf \ - --replace-fail "python-dateutil==2.9.*" python-dateutil \ - --replace-fail "requests==2.31.*" "requests" \ - --replace-fail "sentry-sdk==2.5.*" "sentry-sdk>=2" \ - --replace-fail "stripe==7.9.*" stripe + --replace-fail '"backend"' '"setuptools.build_meta"' \ + --replace-fail 'backend-path = ["_build"]' "" ''; build-system = with python.pkgs; [ diff --git a/pkgs/by-name/pr/pretix/pr4362.patch b/pkgs/by-name/pr/pretix/pr4362.patch new file mode 100644 index 000000000000..97d4a20c2239 --- /dev/null +++ b/pkgs/by-name/pr/pretix/pr4362.patch @@ -0,0 +1,50 @@ +From 5688f3624005d02803f2a434db025f367b4963d3 Mon Sep 17 00:00:00 2001 +From: Martin Weinelt +Date: Thu, 1 Aug 2024 02:39:59 +0200 +Subject: [PATCH] Prevent race condition in directory creation + +Checking whether a path does not exist before trying to create it does +not follow the Python paradigm of asking for forgiveness, rather than +permission, and opens up a time-of-check to time-of-use race. +--- + src/pretix/settings.py | 17 +++++++++-------- + 1 file changed, 9 insertions(+), 8 deletions(-) + +diff --git a/src/pretix/settings.py b/src/pretix/settings.py +index 81ff644be..854187f05 100644 +--- a/src/pretix/settings.py ++++ b/src/pretix/settings.py +@@ -37,6 +37,7 @@ import configparser + import logging + import os + import sys ++from contextlib import suppress + from json import loads + from urllib.parse import urlparse + +@@ -70,14 +71,14 @@ MEDIA_ROOT = os.path.join(DATA_DIR, 'media') + PROFILE_DIR = os.path.join(DATA_DIR, 'profiles') + CACHE_DIR = config.get('pretix', 'cachedir', fallback=os.path.join(DATA_DIR, 'cache')) + +-if not os.path.exists(DATA_DIR): +- os.mkdir(DATA_DIR) +-if not os.path.exists(LOG_DIR): +- os.mkdir(LOG_DIR) +-if not os.path.exists(MEDIA_ROOT): +- os.mkdir(MEDIA_ROOT) +-if not os.path.exists(CACHE_DIR): +- os.mkdir(CACHE_DIR) ++def mkdir(path): ++ with suppress(FileExistsError): ++ os.mkdir(path) ++ ++mkdir(DATA_DIR) ++mkdir(LOG_DIR) ++mkdir(MEDIA_ROOT) ++mkdir(CACHE_DIR) + + if config.has_option('django', 'secret'): + SECRET_KEY = config.get('django', 'secret') +-- +2.45.2 + From 4ba537131f69b1ee4b2aae210c40b5618d72acae Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Thu, 1 Aug 2024 03:05:50 +0200 Subject: [PATCH 6/8] nixos/pretix: increases startup timeout Migrations on a busy machine can exceed 5 minutes, which I can reproduce on a busy builder. --- nixos/modules/services/web-apps/pretix.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/nixos/modules/services/web-apps/pretix.nix b/nixos/modules/services/web-apps/pretix.nix index 0fb635964fe6..853611c41ef7 100644 --- a/nixos/modules/services/web-apps/pretix.nix +++ b/nixos/modules/services/web-apps/pretix.nix @@ -249,7 +249,7 @@ in }; host = mkOption { - type = with types; nullOr types.path; + type = with types; nullOr path; default = if cfg.settings.database.backend == "postgresql" then "/run/postgresql" else null; defaultText = literalExpression '' if config.services.pretix.settings..database.backend == "postgresql" then "/run/postgresql" @@ -535,7 +535,7 @@ in fi ''; serviceConfig = { - TimeoutStartSec = "5min"; + TimeoutStartSec = "15min"; ExecStart = "${getExe' pythonEnv "gunicorn"} --bind unix:/run/pretix/pretix.sock ${cfg.gunicorn.extraArgs} pretix.wsgi"; RuntimeDirectory = "pretix"; }; From 53e5eaef01a65d80938fed04ae4c9216b2964159 Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Thu, 1 Aug 2024 05:05:14 +0200 Subject: [PATCH 7/8] python312Packages.drafthorse: init at 2.4.0 Pure-python ZUGFeRD implementation --- .../python-modules/drafthorse/default.nix | 40 +++++++++++++++++++ pkgs/top-level/python-packages.nix | 2 + 2 files changed, 42 insertions(+) create mode 100644 pkgs/development/python-modules/drafthorse/default.nix diff --git a/pkgs/development/python-modules/drafthorse/default.nix b/pkgs/development/python-modules/drafthorse/default.nix new file mode 100644 index 000000000000..4efde1b74bb8 --- /dev/null +++ b/pkgs/development/python-modules/drafthorse/default.nix @@ -0,0 +1,40 @@ +{ + lib, + buildPythonPackage, + fetchFromGitHub, + setuptools, + lxml, + pypdf, + pytestCheckHook, +}: + +buildPythonPackage rec { + pname = "drafthorse"; + version = "2.4.0"; + pyproject = true; + + src = fetchFromGitHub { + owner = "pretix"; + repo = "python-drafthorse"; + rev = version; + hash = "sha256-3W5rQ0YhyhIoZ+KsaOjlEJOrcoejPoTIJaylK7DOwKc="; + }; + + build-system = [ setuptools ]; + + dependencies = [ + lxml + pypdf + ]; + + nativeCheckInputs = [ pytestCheckHook ]; + + pythonImportsCheck = [ "drafthorse" ]; + + meta = with lib; { + description = "Pure-python ZUGFeRD implementation"; + homepage = "https://github.com/pretix/python-drafthorse"; + license = licenses.asl20; + maintainers = with maintainers; [ hexa ]; + }; +} diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix index 69b4d2db6f37..b7cce422d313 100644 --- a/pkgs/top-level/python-packages.nix +++ b/pkgs/top-level/python-packages.nix @@ -3617,6 +3617,8 @@ self: super: with self; { dploot = callPackage ../development/python-modules/dploot { }; + drafthorse = callPackage ../development/python-modules/drafthorse { }; + draftjs-exporter = callPackage ../development/python-modules/draftjs-exporter { }; dragonfly = callPackage ../development/python-modules/dragonfly { }; From 83d3dd1c4a62dec5d46349faec863b319e127eec Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Thu, 1 Aug 2024 05:08:06 +0200 Subject: [PATCH 8/8] pretix.plugins.zugferd: init at 2.2.0 Annotate pretix' invoices with ZUGFeRD data --- pkgs/by-name/pr/pretix/plugins/default.nix | 2 + pkgs/by-name/pr/pretix/plugins/zugferd.nix | 47 ++++++++++++++++++++++ 2 files changed, 49 insertions(+) create mode 100644 pkgs/by-name/pr/pretix/plugins/zugferd.nix diff --git a/pkgs/by-name/pr/pretix/plugins/default.nix b/pkgs/by-name/pr/pretix/plugins/default.nix index 70e643705c00..a60316e521e4 100644 --- a/pkgs/by-name/pr/pretix/plugins/default.nix +++ b/pkgs/by-name/pr/pretix/plugins/default.nix @@ -10,4 +10,6 @@ reluctant-stripe = callPackage ./reluctant-stripe.nix { }; stretchgoals = callPackage ./stretchgoals.nix { }; + + zugferd = callPackage ./zugferd.nix { }; } diff --git a/pkgs/by-name/pr/pretix/plugins/zugferd.nix b/pkgs/by-name/pr/pretix/plugins/zugferd.nix new file mode 100644 index 000000000000..3255eeb78bd3 --- /dev/null +++ b/pkgs/by-name/pr/pretix/plugins/zugferd.nix @@ -0,0 +1,47 @@ +{ + lib, + buildPythonPackage, + fetchFromGitHub, + pretix-plugin-build, + setuptools, + drafthorse, + ghostscript_headless, +}: + +buildPythonPackage rec { + pname = "pretix-zugferd"; + version = "2.2.0"; + pyproject = true; + + src = fetchFromGitHub { + owner = "pretix"; + repo = "pretix-zugferd"; + rev = "v${version}"; + hash = "sha256-ozFDNIA+0feHrHHvxcf+6Jh4L83svmPEE/rerd4Yim8="; + }; + + postPatch = '' + substituteInPlace pretix_zugferd/invoice.py \ + --replace-fail 'fallback="gs"' 'fallback="${lib.getExe ghostscript_headless}"' + ''; + + pythonRelaxDeps = [ "drafthorse" ]; + + build-system = [ + pretix-plugin-build + setuptools + ]; + + dependencies = [ drafthorse ]; + + doCheck = false; # no tests + + pythonImportsCheck = [ "pretix_zugferd" ]; + + meta = with lib; { + description = "Annotate pretix' invoices with ZUGFeRD data"; + homepage = "https://github.com/pretix/pretix-zugferd"; + license = licenses.asl20; + maintainers = with maintainers; [ hexa ]; + }; +}