Merge master into staging-next

This commit is contained in:
nixpkgs-ci[bot]
2025-07-10 07:19:53 +00:00
committed by GitHub
14 changed files with 453 additions and 377 deletions
+3 -3
View File
@@ -912,7 +912,7 @@ in
mysql-backup = handleTest ./mysql/mysql-backup.nix { };
mysql-replication = handleTest ./mysql/mysql-replication.nix { };
n8n = runTest ./n8n.nix;
nagios = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./nagios.nix { };
nagios = runTestOn [ "x86_64-linux" "aarch64-linux" ] ./nagios.nix;
nar-serve = runTest ./nar-serve.nix;
nat.firewall = handleTest ./nat.nix { withFirewall = true; };
nat.standalone = handleTest ./nat.nix { withFirewall = false; };
@@ -1260,9 +1260,9 @@ in
sane = runTest ./sane.nix;
sanoid = runTest ./sanoid.nix;
saunafs = runTest ./saunafs.nix;
scaphandre = handleTest ./scaphandre.nix { };
scaphandre = runTest ./scaphandre.nix;
schleuder = runTest ./schleuder.nix;
scion-freestanding-deployment = handleTest ./scion/freestanding-deployment { };
scion-freestanding-deployment = runTest ./scion/freestanding-deployment;
scrutiny = runTest ./scrutiny.nix;
scx = runTest ./scx/default.nix;
sddm = import ./sddm.nix { inherit runTest; };
+110 -114
View File
@@ -1,124 +1,120 @@
import ./make-test-python.nix (
{ pkgs, ... }:
{
name = "nagios";
meta = with pkgs.lib.maintainers; {
maintainers = [ symphorien ];
{ lib, ... }:
{
name = "nagios";
meta = with lib.maintainers; {
maintainers = [ symphorien ];
};
nodes.machine =
{ pkgs, ... }:
let
writer = pkgs.writeShellScript "write" ''
set -x
echo "$@" >> /tmp/notifications
'';
in
{
# tested service
services.sshd.enable = true;
# nagios
services.nagios = {
enable = true;
# make state transitions faster
extraConfig.interval_length = "5";
objectDefs =
(map (x: "${pkgs.nagios}/etc/objects/${x}.cfg") [
"templates"
"timeperiods"
"commands"
])
++ [
(pkgs.writeText "objects.cfg" ''
# notifications are written to /tmp/notifications
define command {
command_name notify-host-by-file
command_line ${writer} "$HOSTNAME is $HOSTSTATE$"
}
define command {
command_name notify-service-by-file
command_line ${writer} "$SERVICEDESC$ is $SERVICESTATE$"
}
# nagios boilerplate
define contact {
contact_name alice
alias alice
host_notifications_enabled 1
service_notifications_enabled 1
service_notification_period 24x7
host_notification_period 24x7
service_notification_options w,u,c,r,f,s
host_notification_options d,u,r,f,s
service_notification_commands notify-service-by-file
host_notification_commands notify-host-by-file
email foo@example.com
}
define contactgroup {
contactgroup_name admins
alias Admins
members alice
}
define hostgroup{
hostgroup_name allhosts
alias All hosts
}
# monitored objects
define host {
use generic-host
host_name localhost
alias localhost
address localhost
hostgroups allhosts
contact_groups admins
# make state transitions faster.
max_check_attempts 2
check_interval 1
retry_interval 1
}
define service {
use generic-service
host_name localhost
service_description ssh
check_command check_ssh
# make state transitions faster.
max_check_attempts 2
check_interval 1
retry_interval 1
}
'')
];
};
};
nodes.machine =
{ lib, ... }:
let
writer = pkgs.writeShellScript "write" ''
set -x
echo "$@" >> /tmp/notifications
'';
in
{
# tested service
services.sshd.enable = true;
# nagios
services.nagios = {
enable = true;
# make state transitions faster
extraConfig.interval_length = "5";
objectDefs =
(map (x: "${pkgs.nagios}/etc/objects/${x}.cfg") [
"templates"
"timeperiods"
"commands"
])
++ [
(pkgs.writeText "objects.cfg" ''
# notifications are written to /tmp/notifications
define command {
command_name notify-host-by-file
command_line ${writer} "$HOSTNAME is $HOSTSTATE$"
}
define command {
command_name notify-service-by-file
command_line ${writer} "$SERVICEDESC$ is $SERVICESTATE$"
}
# nagios boilerplate
define contact {
contact_name alice
alias alice
host_notifications_enabled 1
service_notifications_enabled 1
service_notification_period 24x7
host_notification_period 24x7
service_notification_options w,u,c,r,f,s
host_notification_options d,u,r,f,s
service_notification_commands notify-service-by-file
host_notification_commands notify-host-by-file
email foo@example.com
}
define contactgroup {
contactgroup_name admins
alias Admins
members alice
}
define hostgroup{
hostgroup_name allhosts
alias All hosts
}
# monitored objects
define host {
use generic-host
host_name localhost
alias localhost
address localhost
hostgroups allhosts
contact_groups admins
# make state transitions faster.
max_check_attempts 2
check_interval 1
retry_interval 1
}
define service {
use generic-service
host_name localhost
service_description ssh
check_command check_ssh
# make state transitions faster.
max_check_attempts 2
check_interval 1
retry_interval 1
}
'')
];
};
};
testScript =
{ ... }:
''
with subtest("ensure sshd starts"):
machine.wait_for_unit("sshd.service")
testScript = ''
with subtest("ensure sshd starts"):
machine.wait_for_unit("sshd.service")
with subtest("ensure nagios starts"):
machine.wait_for_file("/var/log/nagios/current")
with subtest("ensure nagios starts"):
machine.wait_for_file("/var/log/nagios/current")
def assert_notify(text):
machine.wait_for_file("/tmp/notifications")
real = machine.succeed("cat /tmp/notifications").strip()
print(f"got {real!r}, expected {text!r}")
assert text == real
def assert_notify(text):
machine.wait_for_file("/tmp/notifications")
real = machine.succeed("cat /tmp/notifications").strip()
print(f"got {real!r}, expected {text!r}")
assert text == real
with subtest("ensure we get a notification when sshd is down"):
machine.succeed("systemctl stop sshd")
assert_notify("ssh is CRITICAL")
with subtest("ensure we get a notification when sshd is down"):
machine.succeed("systemctl stop sshd")
assert_notify("ssh is CRITICAL")
with subtest("ensure tests can succeed"):
machine.succeed("systemctl start sshd")
machine.succeed("rm /tmp/notifications")
assert_notify("ssh is OK")
'';
}
)
with subtest("ensure tests can succeed"):
machine.succeed("systemctl start sshd")
machine.succeed("rm /tmp/notifications")
assert_notify("ssh is OK")
'';
}
+13 -17
View File
@@ -1,22 +1,18 @@
import ./make-test-python.nix {
{
name = "scaphandre";
nodes = {
scaphandre =
{ pkgs, ... }:
{
boot.kernelModules = [ "intel_rapl_common" ];
nodes.scaphandre =
{ pkgs, ... }:
{
boot.kernelModules = [ "intel_rapl_common" ];
environment.systemPackages = [ pkgs.scaphandre ];
};
};
environment.systemPackages = [ pkgs.scaphandre ];
};
testScript =
{ nodes, ... }:
''
scaphandre.start()
scaphandre.wait_until_succeeds(
"scaphandre stdout -t 4",
)
'';
testScript = ''
scaphandre.start()
scaphandre.wait_until_succeeds(
"scaphandre stdout -t 4",
)
'';
}
@@ -1,211 +1,199 @@
# implements https://github.com/scionproto/scion/blob/27983125bccac6b84d1f96f406853aab0e460405/doc/tutorials/deploy.rst
import ../../make-test-python.nix (
{ pkgs, ... }:
let
trust-root-configuration-keys = pkgs.runCommand "generate-trc-keys.sh" {
buildInputs = [
{ pkgs, ... }:
let
trust-root-configuration-keys = pkgs.runCommand "generate-trc-keys.sh" {
buildInputs = [
pkgs.scion
];
} (builtins.readFile ./bootstrap.sh);
imports = hostId: [
{
services.scion = {
enable = true;
bypassBootstrapWarning = true;
};
networking = {
useNetworkd = true;
useDHCP = false;
};
systemd.network.networks."01-eth1" = {
name = "eth1";
networkConfig.Address = "192.168.1.${toString hostId}/24";
};
environment.etc = {
"scion/topology.json".source = ./topology + "${toString hostId}.json";
"scion/crypto/as".source = trust-root-configuration-keys + "/AS${toString hostId}";
"scion/certs/ISD42-B1-S1.trc".source = trust-root-configuration-keys + "/ISD42-B1-S1.trc";
"scion/keys/master0.key".text = "U${toString hostId}v4k23ZXjGDwDofg/Eevw==";
"scion/keys/master1.key".text = "dBMko${toString hostId}qMS8DfrN/zP2OUdA==";
};
environment.systemPackages = [
pkgs.scion
];
} (builtins.readFile ./bootstrap.sh);
imports = hostId: [
({
services.scion = {
enable = true;
bypassBootstrapWarning = true;
};
networking = {
useNetworkd = true;
useDHCP = false;
};
systemd.network.networks."01-eth1" = {
name = "eth1";
networkConfig.Address = "192.168.1.${toString hostId}/24";
};
environment.etc = {
"scion/topology.json".source = ./topology + "${toString hostId}.json";
"scion/crypto/as".source = trust-root-configuration-keys + "/AS${toString hostId}";
"scion/certs/ISD42-B1-S1.trc".source = trust-root-configuration-keys + "/ISD42-B1-S1.trc";
"scion/keys/master0.key".text = "U${toString hostId}v4k23ZXjGDwDofg/Eevw==";
"scion/keys/master1.key".text = "dBMko${toString hostId}qMS8DfrN/zP2OUdA==";
};
environment.systemPackages = [
pkgs.scion
];
})
];
in
{
name = "scion-test";
nodes = {
scion01 =
{ ... }:
{
imports = (imports 1);
};
scion02 =
{ ... }:
{
imports = (imports 2);
};
scion03 =
{ ... }:
{
imports = (imports 3);
};
scion04 =
{ ... }:
{
imports = (imports 4);
networking.interfaces."lo".ipv4.addresses = [
{
address = "172.16.1.1";
prefixLength = 32;
}
];
services.scion.scion-ip-gateway = {
enable = true;
config = {
tunnel = {
src_ipv4 = "172.16.1.1";
};
};
trafficConfig = {
ASes = {
"42-ffaa:1:5" = {
Nets = [
"172.16.100.0/24"
];
};
};
ConfigVersion = 9001;
};
};
};
scion05 =
{ ... }:
{
imports = (imports 5);
networking.interfaces."lo".ipv4.addresses = [
{
address = "172.16.100.1";
prefixLength = 32;
}
];
services.scion.scion-ip-gateway = {
enable = true;
config = {
tunnel = {
src_ipv4 = "172.16.100.1";
};
};
trafficConfig = {
ASes = {
"42-ffaa:1:4" = {
Nets = [
"172.16.1.0/24"
];
};
};
ConfigVersion = 9001;
};
};
};
}
];
in
{
name = "scion-test";
nodes = {
scion01 = {
imports = (imports 1);
};
testScript =
let
pingAll = pkgs.writeShellScript "ping-all-scion.sh" ''
addresses="42-ffaa:1:1 42-ffaa:1:2 42-ffaa:1:3 42-ffaa:1:4 42-ffaa:1:5"
timeout=100
wait_for_all() {
ret=0
for as in "$@"
do
scion showpaths $as --no-probe > /dev/null
ret=$?
if [ "$ret" -ne "0" ]; then
break
fi
done
return $ret
}
ping_all() {
ret=0
for as in "$@"
do
scion ping "$as,127.0.0.1" -c 3
ret=$?
if [ "$ret" -ne "0" ]; then
break
fi
done
return $ret
}
for i in $(seq 0 $timeout); do
sleep 1
wait_for_all $addresses || continue
ping_all $addresses && exit 0
scion02 = {
imports = (imports 2);
};
scion03 = {
imports = (imports 3);
};
scion04 = {
imports = (imports 4);
networking.interfaces."lo".ipv4.addresses = [
{
address = "172.16.1.1";
prefixLength = 32;
}
];
services.scion.scion-ip-gateway = {
enable = true;
config = {
tunnel = {
src_ipv4 = "172.16.1.1";
};
};
trafficConfig = {
ASes = {
"42-ffaa:1:5" = {
Nets = [
"172.16.100.0/24"
];
};
};
ConfigVersion = 9001;
};
};
};
scion05 = {
imports = (imports 5);
networking.interfaces."lo".ipv4.addresses = [
{
address = "172.16.100.1";
prefixLength = 32;
}
];
services.scion.scion-ip-gateway = {
enable = true;
config = {
tunnel = {
src_ipv4 = "172.16.100.1";
};
};
trafficConfig = {
ASes = {
"42-ffaa:1:4" = {
Nets = [
"172.16.1.0/24"
];
};
};
ConfigVersion = 9001;
};
};
};
};
testScript =
let
pingAll = pkgs.writeShellScript "ping-all-scion.sh" ''
addresses="42-ffaa:1:1 42-ffaa:1:2 42-ffaa:1:3 42-ffaa:1:4 42-ffaa:1:5"
timeout=100
wait_for_all() {
ret=0
for as in "$@"
do
scion showpaths $as --no-probe > /dev/null
ret=$?
if [ "$ret" -ne "0" ]; then
break
fi
done
exit 1
'';
in
''
# List of AS instances
machines = [scion01, scion02, scion03, scion04, scion05]
# Functions to avoid many for loops
def start(allow_reboot=False):
for i in machines:
i.start(allow_reboot=allow_reboot)
def wait_for_unit(service_name):
for i in machines:
i.wait_for_unit(service_name)
def succeed(command):
for i in machines:
i.succeed(command)
def reboot():
for i in machines:
i.reboot()
def crash():
for i in machines:
i.crash()
# Start all machines, allowing reboot for later
start(allow_reboot=True)
# Wait for scion-control.service on all instances
wait_for_unit("scion-control.service")
# Ensure cert is valid against TRC
succeed("scion-pki certificate verify --trc /etc/scion/certs/*.trc /etc/scion/crypto/as/*.pem >&2")
# Execute pingAll command on all instances
succeed("${pingAll} >&2")
# Execute ICMP pings across scion-ip-gateway
scion04.succeed("ping -c 3 172.16.100.1 >&2")
scion05.succeed("ping -c 3 172.16.1.1 >&2")
# Restart all scion services and ping again to test robustness
succeed("systemctl restart scion-* >&2")
succeed("${pingAll} >&2")
# Reboot machines, wait for service, and ping again
reboot()
wait_for_unit("scion-control.service")
succeed("${pingAll} >&2")
# Crash, start, wait for service, and ping again
crash()
start()
wait_for_unit("scion-control.service")
succeed("pkill -9 scion-* >&2")
wait_for_unit("scion-control.service")
succeed("${pingAll} >&2")
return $ret
}
ping_all() {
ret=0
for as in "$@"
do
scion ping "$as,127.0.0.1" -c 3
ret=$?
if [ "$ret" -ne "0" ]; then
break
fi
done
return $ret
}
for i in $(seq 0 $timeout); do
sleep 1
wait_for_all $addresses || continue
ping_all $addresses && exit 0
done
exit 1
'';
}
)
in
''
# List of AS instances
machines = [scion01, scion02, scion03, scion04, scion05]
# Functions to avoid many for loops
def start(allow_reboot=False):
for i in machines:
i.start(allow_reboot=allow_reboot)
def wait_for_unit(service_name):
for i in machines:
i.wait_for_unit(service_name)
def succeed(command):
for i in machines:
i.succeed(command)
def reboot():
for i in machines:
i.reboot()
def crash():
for i in machines:
i.crash()
# Start all machines, allowing reboot for later
start(allow_reboot=True)
# Wait for scion-control.service on all instances
wait_for_unit("scion-control.service")
# Ensure cert is valid against TRC
succeed("scion-pki certificate verify --trc /etc/scion/certs/*.trc /etc/scion/crypto/as/*.pem >&2")
# Execute pingAll command on all instances
succeed("${pingAll} >&2")
# Execute ICMP pings across scion-ip-gateway
scion04.succeed("ping -c 3 172.16.100.1 >&2")
scion05.succeed("ping -c 3 172.16.1.1 >&2")
# Restart all scion services and ping again to test robustness
succeed("systemctl restart scion-* >&2")
succeed("${pingAll} >&2")
# Reboot machines, wait for service, and ping again
reboot()
wait_for_unit("scion-control.service")
succeed("${pingAll} >&2")
# Crash, start, wait for service, and ping again
crash()
start()
wait_for_unit("scion-control.service")
succeed("pkill -9 scion-* >&2")
wait_for_unit("scion-control.service")
succeed("${pingAll} >&2")
'';
}
-2
View File
@@ -19,8 +19,6 @@ buildGoModule rec {
excludedPackages = [ "website" ];
doCheck = false;
meta = with lib; {
description = "Collection of tools and libraries for working with Go code, including linters and static analysis";
homepage = "https://staticcheck.io";
+1
View File
@@ -45,6 +45,7 @@ let
lsb-release # not documented, called from Big Picture
pciutils # not documented, complains about lspci on startup
glibc_multi.bin
xdg-utils # calls xdg-open occasionally
xz
zenity
@@ -0,0 +1,29 @@
{
buildDunePackage,
async,
uri,
amqp-client,
ezxmlm,
}:
buildDunePackage {
pname = "amqp-client-async";
inherit (amqp-client) version src;
doCheck = true;
buildInputs = [
ezxmlm
];
propagatedBuildInputs = [
amqp-client
async
uri
];
meta = amqp-client.meta // {
description = "Amqp client library, async version";
};
}
@@ -0,0 +1,39 @@
{
lib,
buildDunePackage,
fetchFromGitHub,
version ? "2.3.0",
}:
buildDunePackage {
pname = "amqp-client";
inherit version;
minimalOCamlVersion = "4.14.0";
src = fetchFromGitHub {
owner = "andersfugmann";
repo = "amqp-client";
tag = version;
hash = "sha256-zWhkjVoKyNCIBXD5746FywCg3DKn1mXb1tn1VlF9Tyg=";
};
doCheck = true;
meta = {
description = "Amqp client base library";
homepage = "https://github.com/andersfugmann/amqp-client";
license = lib.licenses.bsd3;
changelog = "https://raw.githubusercontent.com/andersfugmann/amqp-client/refs/tags/${version}/Changelog";
maintainers = with lib.maintainers; [ momeemt ];
longDescription = ''
This library provides high level client bindings for amqp. The library
is tested with rabbitmq, but should work with other amqp
servers. The library is written in pure OCaml.
This is the base library required by lwt/async versions.
You should install either amqp-client-async or amqp-client-lwt
for actual client functionality.
'';
};
}
@@ -0,0 +1,28 @@
{
buildDunePackage,
lwt,
lwt_log,
amqp-client,
uri,
ezxmlm,
}:
buildDunePackage {
pname = "amqp-client-lwt";
inherit (amqp-client) version src;
buildInputs = [ ezxmlm ];
propagatedBuildInputs = [
lwt
lwt_log
amqp-client
uri
];
doCheck = true;
meta = amqp-client.meta // {
description = "Amqp client library, lwt version";
};
}
+6 -3
View File
@@ -39,13 +39,13 @@ let
rec {
pname = "arm-trusted-firmware${lib.optionalString (platform != null) "-${platform}"}";
version = "2.12.1";
version = "2.13.0";
src = fetchFromGitHub {
owner = "ARM-software";
repo = "arm-trusted-firmware";
tag = "lts-v${version}";
hash = "sha256-yPWygW1swSwL3DrHPNIlTeTeV7XG4C9ALFA/+OTiz+4=";
tag = "v${version}";
hash = "sha256-rxm5RCjT/MyMCTxiEC8jQeFMrCggrb2DRbs/qDPXb20=";
};
patches = lib.optionals deleteHDCPBlobBeforeBuild [
@@ -96,6 +96,9 @@ let
hardeningDisable = [ "all" ];
dontStrip = true;
# breaks secondary CPU bringup on at least RK3588, maybe others
env.NIX_CFLAGS_COMPILE = "-fomit-frame-pointer";
meta =
with lib;
{
@@ -1,19 +0,0 @@
diff --git a/board/raspberrypi/rpi/rpi.env b/board/raspberrypi/rpi/rpi.env
index 30228285ed..0327ef74fa 100644
--- a/board/raspberrypi/rpi/rpi.env
+++ b/board/raspberrypi/rpi/rpi.env
@@ -69,9 +69,9 @@ fdt_high=ffffffff
initrd_high=ffffffff
#endif
kernel_addr_r=0x00080000
-scriptaddr=0x02400000
-pxefile_addr_r=0x02500000
-fdt_addr_r=0x02600000
-ramdisk_addr_r=0x02700000
+scriptaddr=0x05500000
+pxefile_addr_r=0x05600000
+fdt_addr_r=0x05700000
+ramdisk_addr_r=0x05800000
boot_targets=mmc usb pxe dhcp
+24 -14
View File
@@ -32,10 +32,10 @@
}@pkgs:
let
defaultVersion = "2025.01";
defaultVersion = "2025.07";
defaultSrc = fetchurl {
url = "https://ftp.denx.de/pub/u-boot/u-boot-${defaultVersion}.tar.bz2";
hash = "sha256-ze99UHyT8bvZ8BXqm8IfoHQmhIFAVQGUWrxvhU1baG8=";
hash = "sha256-D5M/bFpCaJW/MG6T5qxTxghw5LVM2lbZUhG+yZ5jvsc=";
};
# Dependencies for the tools need to be included as either native or cross,
@@ -71,9 +71,7 @@ let
src = if src == null then defaultSrc else src;
patches = [
./0001-configs-rpi-allow-for-bigger-kernels.patch
] ++ extraPatches;
patches = extraPatches;
postPatch = ''
${lib.concatMapStrings (script: ''
@@ -222,7 +220,10 @@ in
ubootAmx335xEVM = buildUBoot {
defconfig = "am335x_evm_defconfig";
extraMeta.platforms = [ "armv7l-linux" ];
extraMeta = {
platforms = [ "armv7l-linux" ];
broken = true; # too big, exceeds memory size
};
filesToInstall = [
"MLO"
"u-boot.img"
@@ -473,6 +474,19 @@ in
];
};
ubootOrangePi5Max = buildUBoot {
defconfig = "orangepi-5-max-rk3588_defconfig";
extraMeta.platforms = [ "aarch64-linux" ];
BL31 = "${armTrustedFirmwareRK3588}/bl31.elf";
ROCKCHIP_TPL = rkbin.TPL_RK3588;
filesToInstall = [
"u-boot.itb"
"idbloader.img"
"u-boot-rockchip.bin"
"u-boot-rockchip-spi.bin"
];
};
ubootOrangePi5Plus = buildUBoot {
defconfig = "orangepi-5-plus-rk3588_defconfig";
extraMeta.platforms = [ "aarch64-linux" ];
@@ -752,13 +766,6 @@ in
};
ubootRockPro64 = buildUBoot {
extraPatches = [
# https://patchwork.ozlabs.org/project/uboot/list/?series=237654&archive=both&state=*
(fetchpatch {
url = "https://patchwork.ozlabs.org/series/237654/mbox/";
sha256 = "0aiw9zk8w4msd3v8nndhkspjify0yq6a5f0zdy6mhzs0ilq896c3";
})
];
defconfig = "rockpro64-rk3399_defconfig";
extraMeta.platforms = [ "aarch64-linux" ];
BL31 = "${armTrustedFirmwareRK3399}/bl31.elf";
@@ -781,7 +788,10 @@ in
ubootSheevaplug = buildUBoot {
defconfig = "sheevaplug_defconfig";
extraMeta.platforms = [ "armv5tel-linux" ];
extraMeta = {
platforms = [ "armv5tel-linux" ];
broken = true; # too big, exceeds partition size
};
filesToInstall = [ "u-boot.kwb" ];
};
+1
View File
@@ -11342,6 +11342,7 @@ with pkgs;
ubootOrangePi3
ubootOrangePi3B
ubootOrangePi5
ubootOrangePi5Max
ubootOrangePi5Plus
ubootOrangePiPc
ubootOrangePiZeroPlus2H5
+6
View File
@@ -32,6 +32,12 @@ let
ancient = callPackage ../development/ocaml-modules/ancient { };
amqp-client = callPackage ../development/ocaml-modules/amqp-client { };
amqp-client-async = callPackage ../development/ocaml-modules/amqp-client/async.nix { };
amqp-client-lwt = callPackage ../development/ocaml-modules/amqp-client/lwt.nix { };
angstrom = callPackage ../development/ocaml-modules/angstrom { };
angstrom-async = callPackage ../development/ocaml-modules/angstrom-async { };