From b08d6a664f548c86446439a1e24e484b0ee140ea Mon Sep 17 00:00:00 2001 From: Rahul Rameshbabu Date: Sat, 1 Jun 2024 10:49:32 -0700 Subject: [PATCH 1/4] globalprotect-openconnect: remove deprecated 1.x package The 1.x iteration of globalprotect-openconnect is no longer being developed. Remove related components from nixpkgs. Signed-off-by: Rahul Rameshbabu --- .../manual/release-notes/rl-2411.section.md | 3 + nixos/modules/module-list.nix | 1 - .../services/networking/globalprotect-vpn.nix | 57 ------------------- .../globalprotect-openconnect/default.nix | 32 ----------- pkgs/top-level/all-packages.nix | 2 - 5 files changed, 3 insertions(+), 92 deletions(-) delete mode 100644 nixos/modules/services/networking/globalprotect-vpn.nix delete mode 100644 pkgs/tools/networking/globalprotect-openconnect/default.nix diff --git a/nixos/doc/manual/release-notes/rl-2411.section.md b/nixos/doc/manual/release-notes/rl-2411.section.md index 6600679ad168..607fc44eb690 100644 --- a/nixos/doc/manual/release-notes/rl-2411.section.md +++ b/nixos/doc/manual/release-notes/rl-2411.section.md @@ -472,6 +472,9 @@ - The `isync` package has been updated to version `1.5.0`, which introduces some breaking changes. See the [compatibility concerns](https://sourceforge.net/projects/isync/files/isync/1.5.0/) for more details. +- Legacy package `globalprotect-openconnect` 1.x and related module + `globalprotect-vpn` were dropped. + ## Other Notable Changes {#sec-release-24.11-notable-changes} diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix index 97ea85cfb89a..a70bee9f6083 100644 --- a/nixos/modules/module-list.nix +++ b/nixos/modules/module-list.nix @@ -1045,7 +1045,6 @@ ./services/networking/gdomap.nix ./services/networking/ghostunnel.nix ./services/networking/git-daemon.nix - ./services/networking/globalprotect-vpn.nix ./services/networking/gns3-server.nix ./services/networking/gnunet.nix ./services/networking/go-autoconfig.nix diff --git a/nixos/modules/services/networking/globalprotect-vpn.nix b/nixos/modules/services/networking/globalprotect-vpn.nix deleted file mode 100644 index 87ce8a5e142f..000000000000 --- a/nixos/modules/services/networking/globalprotect-vpn.nix +++ /dev/null @@ -1,57 +0,0 @@ -{ config, lib, pkgs, ... }: -let - cfg = config.services.globalprotect; - - execStart = - if cfg.csdWrapper == null then - "${pkgs.globalprotect-openconnect}/bin/gpservice" - else - "${pkgs.globalprotect-openconnect}/bin/gpservice --csd-wrapper=${cfg.csdWrapper}"; -in - -{ - options.services.globalprotect = { - enable = lib.mkEnableOption "globalprotect"; - - settings = lib.mkOption { - description = '' - GlobalProtect-openconnect configuration. For more information, visit - . - ''; - default = { }; - example = { - "vpn1.company.com" = { - openconnect-args = "--script=/path/to/vpnc-script"; - }; - }; - type = lib.types.attrs; - }; - - csdWrapper = lib.mkOption { - description = '' - A script that will produce a Host Integrity Protection (HIP) report, - as described at - ''; - default = null; - example = lib.literalExpression ''"''${pkgs.openconnect}/libexec/openconnect/hipreport.sh"''; - type = lib.types.nullOr lib.types.path; - }; - }; - - config = lib.mkIf cfg.enable { - services.dbus.packages = [ pkgs.globalprotect-openconnect ]; - - environment.etc."gpservice/gp.conf".text = lib.generators.toINI { } cfg.settings; - - systemd.services.gpservice = { - description = "GlobalProtect openconnect DBus service"; - serviceConfig = { - Type = "dbus"; - BusName = "com.yuezk.qt.GPService"; - ExecStart = execStart; - }; - wantedBy = [ "multi-user.target" ]; - after = [ "network.target" ]; - }; - }; -} diff --git a/pkgs/tools/networking/globalprotect-openconnect/default.nix b/pkgs/tools/networking/globalprotect-openconnect/default.nix deleted file mode 100644 index 5b00de2fda85..000000000000 --- a/pkgs/tools/networking/globalprotect-openconnect/default.nix +++ /dev/null @@ -1,32 +0,0 @@ -{ stdenv, lib, fetchurl -, cmake, qtwebsockets, qtwebengine, qtkeychain, wrapQtAppsHook, openconnect -}: - -stdenv.mkDerivation rec { - pname = "globalprotect-openconnect"; - version = "1.4.9"; - - src = fetchurl { - url = "https://github.com/yuezk/GlobalProtect-openconnect/releases/download/v${version}/globalprotect-openconnect-${version}.tar.gz"; - hash = "sha256-vhvVKESLbqHx3XumxbIWOXIreDkW3yONDMXMHxhjsvk="; - }; - - nativeBuildInputs = [ cmake wrapQtAppsHook ]; - - buildInputs = [ openconnect qtwebsockets qtwebengine qtkeychain ]; - - patchPhase = '' - substituteInPlace GPService/gpservice.h \ - --replace /usr/local/bin/openconnect ${openconnect}/bin/openconnect; - substituteInPlace GPService/CMakeLists.txt \ - --replace /etc/gpservice $out/etc/gpservice; - ''; - - meta = with lib; { - description = "GlobalProtect VPN client (GUI) for Linux based on OpenConnect that supports SAML auth mode"; - homepage = "https://github.com/yuezk/GlobalProtect-openconnect"; - license = licenses.gpl3Only; - maintainers = [ maintainers.jerith666 ]; - platforms = platforms.linux; - }; -} diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index 587c69d8ed05..a891da9a6b6c 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -13547,8 +13547,6 @@ with pkgs; inherit (openconnectPackages) openconnect openconnect_openssl; - globalprotect-openconnect = libsForQt5.callPackage ../tools/networking/globalprotect-openconnect { }; - ding-libs = callPackage ../tools/misc/ding-libs { }; sssd = callPackage ../os-specific/linux/sssd { From b6a158f7e4385185c0f145db5f9ab0ccdc26f8c2 Mon Sep 17 00:00:00 2001 From: Rahul Rameshbabu Date: Sat, 1 Jun 2024 14:27:40 -0700 Subject: [PATCH 2/4] maintainers: add binary-eater Add maintainer information for Rahul Rameshbabu. Signed-off-by: Rahul Rameshbabu --- maintainers/maintainer-list.nix | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix index 40ab1b6aabd1..990cfbe825cd 100644 --- a/maintainers/maintainer-list.nix +++ b/maintainers/maintainer-list.nix @@ -2733,6 +2733,13 @@ githubId = 19915050; name = "binarycat"; }; + binary-eater = { + email = "sergeantsagara@protonmail.com"; + github = "Binary-Eater"; + githubId = 10691440; + name = "Rahul Rameshbabu"; + keys = [ { fingerprint = "678A 8DF1 D9F2 B51B 7110 BE53 FF24 7B3E 5411 387B"; } ]; + }; binsky = { email = "timo@binsky.org"; github = "binsky08"; From 156fe9a8981b45dc5af47b7bef8ac501f6c6f599 Mon Sep 17 00:00:00 2001 From: Rahul Rameshbabu Date: Sat, 1 Jun 2024 14:31:11 -0700 Subject: [PATCH 3/4] globalprotect-openconnect: add core logic and packages for 2.x releases The GUI of GlobalProtect-openconnect is unfree software, while the CLI is licensed as GPLv3-only. This packaging work focuses on the CLI, and components required for the CLI. Link: https://github.com/yuezk/GlobalProtect-openconnect Signed-off-by: Rahul Rameshbabu --- .../manual/release-notes/rl-2411.section.md | 5 +- pkgs/by-name/gp/gpauth/package.nix | 50 +++++++++++++++++++ pkgs/by-name/gp/gpclient/package.nix | 41 +++++++++++++++ 3 files changed, 95 insertions(+), 1 deletion(-) create mode 100644 pkgs/by-name/gp/gpauth/package.nix create mode 100644 pkgs/by-name/gp/gpclient/package.nix diff --git a/nixos/doc/manual/release-notes/rl-2411.section.md b/nixos/doc/manual/release-notes/rl-2411.section.md index 607fc44eb690..12372c0a3a58 100644 --- a/nixos/doc/manual/release-notes/rl-2411.section.md +++ b/nixos/doc/manual/release-notes/rl-2411.section.md @@ -473,7 +473,10 @@ - The `isync` package has been updated to version `1.5.0`, which introduces some breaking changes. See the [compatibility concerns](https://sourceforge.net/projects/isync/files/isync/1.5.0/) for more details. - Legacy package `globalprotect-openconnect` 1.x and related module - `globalprotect-vpn` were dropped. + `globalprotect-vpn` were dropped. Two new packages `gpauth` and `gpclient` + from the 2.x version of the GlobalProtect-openconnect project are added in its + place. The GUI components related to the project are non-free and not + packaged. ## Other Notable Changes {#sec-release-24.11-notable-changes} diff --git a/pkgs/by-name/gp/gpauth/package.nix b/pkgs/by-name/gp/gpauth/package.nix new file mode 100644 index 000000000000..e1199c9ed372 --- /dev/null +++ b/pkgs/by-name/gp/gpauth/package.nix @@ -0,0 +1,50 @@ +{ + rustPlatform, + lib, + fetchFromGitHub, + libsoup, + openssl, + pkg-config, + perl, + webkitgtk, +}: + +rustPlatform.buildRustPackage rec { + pname = "gpauth"; + version = "2.3.7"; + + src = fetchFromGitHub { + owner = "yuezk"; + repo = "GlobalProtect-openconnect"; + rev = "v${version}"; + hash = "sha256-Zr888II65bUjrbStZfD0AYCXKY6VdKVJHQhbKwaY3is="; + }; + + buildAndTestSubdir = "apps/gpauth"; + cargoHash = "sha256-AuYw8CC0bMJzIJJQXhcQajQ4SACz4aKv6rG4HMq7U18="; + + nativeBuildInputs = [ + perl + pkg-config + ]; + buildInputs = [ + libsoup + openssl + webkitgtk + ]; + + meta = with lib; { + changelog = "https://github.com/${src.owner}/${src.repo}/blob/${src.rev}/changelog.md"; + description = "A CLI for GlobalProtect VPN, based on OpenConnect, supports the SSO authentication method"; + longDescription = '' + A CLI for GlobalProtect VPN, based on OpenConnect, supports the SSO + authentication method. Inspired by gp-saml-gui. + + The CLI version is always free and open source in this repo. It has almost + the same features as the GUI version. + ''; + homepage = "https://github.com/${src.owner}/${src.repo}"; + license = with licenses; [ gpl3Only ]; + maintainers = with maintainers; [ binary-eater ]; + }; +} diff --git a/pkgs/by-name/gp/gpclient/package.nix b/pkgs/by-name/gp/gpclient/package.nix new file mode 100644 index 000000000000..786123e74d44 --- /dev/null +++ b/pkgs/by-name/gp/gpclient/package.nix @@ -0,0 +1,41 @@ +{ + rustPlatform, + gpauth, + openconnect, + openssl, + perl, + vpnc-scripts, +}: + +rustPlatform.buildRustPackage rec { + pname = "gpclient"; + + inherit (gpauth) version src meta; + + buildAndTestSubdir = "apps/gpclient"; + cargoHash = "sha256-aJYFBvVrj1n2+9WLLBH5WTRRzTle19LsdJ2DielJYik="; + + nativeBuildInputs = [ perl ]; + buildInputs = [ + gpauth + openconnect + openssl + ]; + + preConfigure = '' + substituteInPlace crates/gpapi/src/lib.rs \ + --replace-fail /usr/bin/gpauth ${gpauth}/bin/gpauth + substituteInPlace crates/common/src/vpn_utils.rs \ + --replace-fail /usr/sbin/vpnc-script ${vpnc-scripts}/bin/vpnc-script + ''; + + postInstall = '' + mkdir -p $out/share/applications + cp packaging/files/usr/share/applications/gpgui.desktop $out/share/applications/gpgui.desktop + ''; + + postFixup = '' + substituteInPlace $out/share/applications/gpgui.desktop \ + --replace-fail /usr/bin/gpclient $out/bin/gpclient + ''; +} From 2b0ff836a9e36fa16b192fcbad250fb699708d19 Mon Sep 17 00:00:00 2001 From: Weijia Wang <9713184+wegank@users.noreply.github.com> Date: Sat, 21 Sep 2024 23:36:06 +0200 Subject: [PATCH 4/4] nixos/globalprotect: mention removal --- nixos/modules/rename.nix | 1 + pkgs/top-level/aliases.nix | 1 + 2 files changed, 2 insertions(+) diff --git a/nixos/modules/rename.nix b/nixos/modules/rename.nix index 7e3711498383..122ef63913a5 100644 --- a/nixos/modules/rename.nix +++ b/nixos/modules/rename.nix @@ -74,6 +74,7 @@ in (mkRemovedOptionModule [ "services" "fourStoreEndpoint" ] "The fourStoreEndpoint module has been removed") (mkRemovedOptionModule [ "services" "fprot" ] "The corresponding package was removed from nixpkgs.") (mkRemovedOptionModule [ "services" "frab" ] "The frab module has been removed") + (mkRemovedOptionModule [ "services" "globalprotect"] "The corresponding package was removed from nixpkgs.") (mkRemovedOptionModule [ "services" "homeassistant-satellite"] "The `services.homeassistant-satellite` module has been replaced by `services.wyoming-satellite`.") (mkRemovedOptionModule [ "services" "hydron" ] "The `services.hydron` module has been removed as the project has been archived upstream since 2022 and is affected by a severe remote code execution vulnerability.") (mkRemovedOptionModule [ "services" "ihatemoney" ] "The ihatemoney module has been removed for lack of downstream maintainer") diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix index 8a883f079d7a..c1b0a4635a88 100644 --- a/pkgs/top-level/aliases.nix +++ b/pkgs/top-level/aliases.nix @@ -555,6 +555,7 @@ mapAliases ({ glide = throw "'glide' has been removed as it is unmaintained, please use Go modules instead"; # Added 2023-12-26 glfw-wayland = glfw; # Added 2024-04-19 glfw-wayland-minecraft = glfw3-minecraft; # Added 2024-05-08 + globalprotect-openconnect = throw "'globalprotect-openconnect' has been renamed to/replaced by 'gpauth' and 'gpclient'"; # Added 2024-09-21 glxinfo = mesa-demos; # Added 2024-07-04 gmailieer = lieer; # Added 2020-04-19 gmic-qt-krita = throw "gmic-qt-krita was removed as it's no longer supported upstream."; # Converted to throw 2023-02-02