gador/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge master into staging-next

Browse Source
This commit is contained in:
github-actions[bot]
2024-08-27 18:04:19 +00:00
committed by GitHub
parent e7712f7a07 f7439a07f6
commit 903fa485a4
62 changed files with 769 additions and 428 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.git-blame-ignore-revs
+3
View File
@@ -168,3 +168,6 @@ fc7a83f8b62e90de5679e993d4d49ca014ea013d
# nrr: format with nixfmt-rfc-style (#334578)
cffc27daf06c77c0d76bc35d24b929cb9d68c3c9
# nixos/kanidm: inherit lib, nixfmt
8f18393d380079904d072007fb19dc64baef0a3a
maintainers/maintainer-list.nix
+8 -1
View File
@@ -2736,7 +2736,7 @@
};
blitz = {
email = "js@alien8.de";
matrix = "@js:ukvly.org";
matrix = "@blitz:chat.x86.lol";
github = "blitz";
githubId = 37907;
name = "Julian Stecklina";
@@ -16685,6 +16685,13 @@
githubId = 74465;
name = "James Fargher";
};
progrm_jarvis = {
email = "mrjarviscraft+nix@gmail.com";
github = "JarvisCraft";
githubId = 7693005;
name = "Petr Portnov";
keys = [ { fingerprint = "884B 08D2 8DFF 6209 1857 C1C7 7E8F C8F7 D1BB 84A3"; } ];
};
progval = {
email = "progval+nix@progval.net";
github = "progval";
maintainers/team-list.nix
+1
View File
@@ -504,6 +504,7 @@ with lib.maintainers;
githubTeams = [ "k3s" ];
members = [
euank
frederictobiasc
marcusramberg
mic92
rorosen
nixos/doc/manual/release-notes/rl-2411.section.md
+2
View File
@@ -384,6 +384,8 @@
- Kanidm can now be provisioned using the new [`services.kanidm.provision`] option, but requires using a patched version available via `pkgs.kanidm.withSecretProvisioning`.
- Kanidm previously had an incorrect systemd service type, causing dependent units with an `after` and `requires` directive to start before `kanidm*` finished startup. The module has now been updated in line with upstream recommendations.
- To facilitate dependency injection, the `imgui` package now builds a static archive using vcpkg' CMake rules.
The derivation now installs "impl" headers selectively instead of by a wildcard.
Use `imgui.src` if you just want to access the unpacked sources.
nixos/modules/services/misc/ollama.nix
+1 -2
View File
@@ -127,8 +127,7 @@ in
example = "10.3.0";
description = ''
Override what rocm will detect your gpu model as.
For example, make rocm treat your RX 5700 XT (or any other model)
as an RX 6900 XT using a value of `"10.3.0"` (gfx 1030).
For example, if you have an RX 5700 XT, try setting this to `"10.1.0"` (gfx 1010).
This sets the value of `HSA_OVERRIDE_GFX_VERSION`. See [ollama's docs](
https://github.com/ollama/ollama/blob/main/docs/gpu.md#amd-radeon
nixos/modules/services/networking/smokeping.nix
+20 -8
View File
@@ -313,11 +313,16 @@ in
group = cfg.user;
description = "smokeping daemon user";
home = smokepingHome;
createHome = true;
# When `cfg.webService` is enabled, `nginx` requires read permissions on the home directory.
homeMode = "711";
};
users.users.${config.services.nginx.user} = mkIf cfg.webService {
extraGroups = [
cfg.user ## user == group in this module
];
};
users.groups.${cfg.user} = { };
systemd.services.smokeping = {
reloadTriggers = [ configPath ];
requiredBy = [ "multi-user.target" ];
@@ -327,15 +332,23 @@ in
ExecStart = "${cfg.package}/bin/smokeping --config=/etc/smokeping.conf --nodaemon";
};
preStart = ''
mkdir -m 0755 -p ${smokepingHome}/cache ${smokepingHome}/data
ln -snf ${cfg.package}/htdocs/css ${smokepingHome}/css
ln -snf ${cfg.package}/htdocs/js ${smokepingHome}/js
ln -snf ${cgiHome} ${smokepingHome}/smokeping.fcgi
${cfg.package}/bin/smokeping --check --config=${configPath}
${cfg.package}/bin/smokeping --static --config=${configPath}
'';
};
systemd.tmpfiles.rules = [
# create cache and data directories
"d ${smokepingHome}/cache 0750 ${cfg.user} ${cfg.user}"
"d ${smokepingHome}/data 0750 ${cfg.user} ${cfg.user}"
# create symlings
"L+ ${smokepingHome}/css - - - - ${cfg.package}/htdocs/css"
"L+ ${smokepingHome}/js - - - - ${cfg.package}/htdocs/js"
"L+ ${smokepingHome}/smokeping.fcgi - - - - ${cgiHome}"
# recursively adjust access mode and ownership (in case config change)
"Z ${smokepingHome} 0750 ${cfg.user} ${cfg.user}"
];
# use nginx to serve the smokeping web service
services.fcgiwrap.instances.smokeping = mkIf cfg.webService {
process.user = cfg.user;
@@ -367,4 +380,3 @@ in
nh2
];
}
nixos/modules/services/security/kanidm.nix
+210 -178
View File
@@ -6,10 +6,42 @@
...
}:
let
inherit (lib)
any
attrNames
attrValues
concatLines
concatLists
converge
filter
filterAttrs
filterAttrsRecursive
flip
foldl'
getExe
hasInfix
hasPrefix
isStorePath
last
mapAttrsToList
mkEnableOption
mkForce
mkIf
mkMerge
mkOption
mkPackageOption
optional
optionalString
splitString
subtractLists
types
unique
;
cfg = config.services.kanidm;
settingsFormat = pkgs.formats.toml { };
# Remove null values, so we can document optional values that don't end up in the generated TOML file.
filterConfig = lib.converge (lib.filterAttrsRecursive (_: v: v != null));
filterConfig = converge (filterAttrsRecursive (_: v: v != null));
serverConfigFile = settingsFormat.generate "server.toml" (filterConfig cfg.serverSettings);
clientConfigFile = settingsFormat.generate "kanidm-config.toml" (filterConfig cfg.clientSettings);
unixConfigFile = settingsFormat.generate "kanidm-unixd.toml" (filterConfig cfg.unixSettings);
@@ -22,24 +54,26 @@ let
# This makes sure that if e.g. the tls_chain is in the nix store and /nix/store is already in the mount
# paths, no new bind mount is added. Adding subpaths caused problems on ofborg.
hasPrefixInList =
list: newPath:
lib.any (path: lib.hasPrefix (builtins.toString path) (builtins.toString newPath)) list;
mergePaths = lib.foldl' (
list: newPath: any (path: hasPrefix (builtins.toString path) (builtins.toString newPath)) list;
mergePaths = foldl' (
merged: newPath:
let
# If the new path is a prefix to some existing path, we need to filter it out
filteredPaths = lib.filter (
p: !lib.hasPrefix (builtins.toString newPath) (builtins.toString p)
) merged;
filteredPaths = filter (p: !hasPrefix (builtins.toString newPath) (builtins.toString p)) merged;
# If a prefix of the new path is already in the list, do not add it
filteredNew = lib.optional (!hasPrefixInList filteredPaths newPath) newPath;
filteredNew = optional (!hasPrefixInList filteredPaths newPath) newPath;
in
filteredPaths ++ filteredNew
) [ ];
defaultServiceConfig = {
# Setting the type to notify enables additional healthchecks, ensuring units
# after and requiring kanidm-* wait for it to complete startup
Type = "notify";
BindReadOnlyPaths = [
"/nix/store"
# For healthcheck notifications
"/run/systemd/notify"
"-/etc/resolv.conf"
"-/etc/nsswitch.conf"
"-/etc/hosts"
@@ -84,13 +118,13 @@ let
mkPresentOption =
what:
lib.mkOption {
mkOption {
description = "Whether to ensure that this ${what} is present or absent.";
type = lib.types.bool;
type = types.bool;
default = true;
};
filterPresent = lib.filterAttrs (_: v: v.present);
filterPresent = filterAttrs (_: v: v.present);
provisionStateJson = pkgs.writeText "provision-state.json" (
builtins.toJSON { inherit (cfg.provision) groups persons systems; }
@@ -98,7 +132,7 @@ let
# Only recover the admin account if a password should explicitly be provisioned
# for the account. Otherwise it is not needed for provisioning.
maybeRecoverAdmin = lib.optionalString (cfg.provision.adminPasswordFile != null) ''
maybeRecoverAdmin = optionalString (cfg.provision.adminPasswordFile != null) ''
KANIDM_ADMIN_PASSWORD=$(< ${cfg.provision.adminPasswordFile})
# We always reset the admin account password if a desired password was specified.
if ! KANIDM_RECOVER_ACCOUNT_PASSWORD=$KANIDM_ADMIN_PASSWORD ${cfg.package}/bin/kanidmd recover-account -c ${serverConfigFile} admin --from-environment >/dev/null; then
@@ -128,7 +162,7 @@ let
echo "kanidm provision: Failed to recover admin account" >&2
exit 1
fi
if ! KANIDM_IDM_ADMIN_PASSWORD=$(grep '{"password' <<< "$recover_out" | ${lib.getExe pkgs.jq} -r .password); then
if ! KANIDM_IDM_ADMIN_PASSWORD=$(grep '{"password' <<< "$recover_out" | ${getExe pkgs.jq} -r .password); then
echo "$recover_out" >&2
echo "kanidm provision: Failed to parse password for idm_admin account" >&2
exit 1
@@ -140,8 +174,8 @@ let
# Wait for the kanidm server to come online
count=0
while ! ${lib.getExe pkgs.curl} -L --silent --max-time 1 --connect-timeout 1 --fail \
${lib.optionalString cfg.provision.acceptInvalidCerts "--insecure"} \
while ! ${getExe pkgs.curl} -L --silent --max-time 1 --connect-timeout 1 --fail \
${optionalString cfg.provision.acceptInvalidCerts "--insecure"} \
${cfg.provision.instanceUrl} >/dev/null
do
sleep 1
@@ -156,58 +190,58 @@ let
${maybeRecoverAdmin}
KANIDM_PROVISION_IDM_ADMIN_TOKEN=$KANIDM_IDM_ADMIN_PASSWORD \
${lib.getExe pkgs.kanidm-provision} \
${lib.optionalString (!cfg.provision.autoRemove) "--no-auto-remove"} \
${lib.optionalString cfg.provision.acceptInvalidCerts "--accept-invalid-certs"} \
${getExe pkgs.kanidm-provision} \
${optionalString (!cfg.provision.autoRemove) "--no-auto-remove"} \
${optionalString cfg.provision.acceptInvalidCerts "--accept-invalid-certs"} \
--url "${cfg.provision.instanceUrl}" \
--state ${provisionStateJson}
'';
serverPort =
# ipv6:
if lib.hasInfix "]:" cfg.serverSettings.bindaddress then
lib.last (lib.splitString "]:" cfg.serverSettings.bindaddress)
if hasInfix "]:" cfg.serverSettings.bindaddress then
last (splitString "]:" cfg.serverSettings.bindaddress)
else
# ipv4:
if lib.hasInfix "." cfg.serverSettings.bindaddress then
lib.last (lib.splitString ":" cfg.serverSettings.bindaddress)
if hasInfix "." cfg.serverSettings.bindaddress then
last (splitString ":" cfg.serverSettings.bindaddress)
# default is 8443
else
"8443";
in
{
options.services.kanidm = {
enableClient = lib.mkEnableOption "the Kanidm client";
enableServer = lib.mkEnableOption "the Kanidm server";
enablePam = lib.mkEnableOption "the Kanidm PAM and NSS integration";
enableClient = mkEnableOption "the Kanidm client";
enableServer = mkEnableOption "the Kanidm server";
enablePam = mkEnableOption "the Kanidm PAM and NSS integration";
package = lib.mkPackageOption pkgs "kanidm" { };
package = mkPackageOption pkgs "kanidm" { };
serverSettings = lib.mkOption {
type = lib.types.submodule {
serverSettings = mkOption {
type = types.submodule {
freeformType = settingsFormat.type;
options = {
bindaddress = lib.mkOption {
bindaddress = mkOption {
description = "Address/port combination the webserver binds to.";
example = "[::1]:8443";
type = lib.types.str;
type = types.str;
};
# Should be optional but toml does not accept null
ldapbindaddress = lib.mkOption {
ldapbindaddress = mkOption {
description = ''
Address and port the LDAP server is bound to. Setting this to `null` disables the LDAP interface.
'';
example = "[::1]:636";
default = null;
type = lib.types.nullOr lib.types.str;
type = types.nullOr types.str;
};
origin = lib.mkOption {
origin = mkOption {
description = "The origin of your Kanidm instance. Must have https as protocol.";
example = "https://idm.example.org";
type = lib.types.strMatching "^https://.*";
type = types.strMatching "^https://.*";
};
domain = lib.mkOption {
domain = mkOption {
description = ''
The `domain` that Kanidm manages. Must be below or equal to the domain
specified in `serverSettings.origin`.
@@ -218,58 +252,58 @@ in
'';
example = "example.org";
default = null;
type = lib.types.nullOr lib.types.str;
type = types.nullOr types.str;
};
db_path = lib.mkOption {
db_path = mkOption {
description = "Path to Kanidm database.";
default = "/var/lib/kanidm/kanidm.db";
readOnly = true;
type = lib.types.path;
type = types.path;
};
tls_chain = lib.mkOption {
tls_chain = mkOption {
description = "TLS chain in pem format.";
type = lib.types.path;
type = types.path;
};
tls_key = lib.mkOption {
tls_key = mkOption {
description = "TLS key in pem format.";
type = lib.types.path;
type = types.path;
};
log_level = lib.mkOption {
log_level = mkOption {
description = "Log level of the server.";
default = "info";
type = lib.types.enum [
type = types.enum [
"info"
"debug"
"trace"
];
};
role = lib.mkOption {
role = mkOption {
description = "The role of this server. This affects the replication relationship and thereby available features.";
default = "WriteReplica";
type = lib.types.enum [
type = types.enum [
"WriteReplica"
"WriteReplicaNoUI"
"ReadOnlyReplica"
];
};
online_backup = {
path = lib.mkOption {
path = mkOption {
description = "Path to the output directory for backups.";
type = lib.types.path;
type = types.path;
default = "/var/lib/kanidm/backups";
};
schedule = lib.mkOption {
schedule = mkOption {
description = "The schedule for backups in cron format.";
type = lib.types.str;
type = types.str;
default = "00 22 * * *";
};
versions = lib.mkOption {
versions = mkOption {
description = ''
Number of backups to keep.
The default is set to `0`, in order to disable backups by default.
'';
type = lib.types.ints.unsigned;
type = types.ints.unsigned;
default = 0;
example = 7;
};
@@ -285,14 +319,14 @@ in
'';
};
clientSettings = lib.mkOption {
type = lib.types.submodule {
clientSettings = mkOption {
type = types.submodule {
freeformType = settingsFormat.type;
options.uri = lib.mkOption {
options.uri = mkOption {
description = "Address of the Kanidm server.";
example = "http://127.0.0.1:8080";
type = lib.types.str;
type = types.str;
};
};
description = ''
@@ -303,20 +337,20 @@ in
'';
};
unixSettings = lib.mkOption {
type = lib.types.submodule {
unixSettings = mkOption {
type = types.submodule {
freeformType = settingsFormat.type;
options = {
pam_allowed_login_groups = lib.mkOption {
pam_allowed_login_groups = mkOption {
description = "Kanidm groups that are allowed to login using PAM.";
example = "my_pam_group";
type = lib.types.listOf lib.types.str;
type = types.listOf types.str;
};
hsm_pin_path = lib.mkOption {
hsm_pin_path = mkOption {
description = "Path to a HSM pin.";
default = "/var/cache/kanidm-unixd/hsm-pin";
type = lib.types.path;
type = types.path;
};
};
};
@@ -329,73 +363,73 @@ in
};
provision = {
enable = lib.mkEnableOption "provisioning of groups, users and oauth2 resource servers";
enable = mkEnableOption "provisioning of groups, users and oauth2 resource servers";
instanceUrl = lib.mkOption {
instanceUrl = mkOption {
description = "The instance url to which the provisioning tool should connect.";
default = "https://localhost:${serverPort}";
defaultText = ''"https://localhost:<port from serverSettings.bindaddress>"'';
type = lib.types.str;
type = types.str;
};
acceptInvalidCerts = lib.mkOption {
acceptInvalidCerts = mkOption {
description = ''
Whether to allow invalid certificates when provisioning the target instance.
By default this is only allowed when the instanceUrl is localhost. This is
dangerous when used with an external URL.
'';
type = lib.types.bool;
default = lib.hasPrefix "https://localhost:" cfg.provision.instanceUrl;
defaultText = ''lib.hasPrefix "https://localhost:" cfg.provision.instanceUrl'';
type = types.bool;
default = hasPrefix "https://localhost:" cfg.provision.instanceUrl;
defaultText = ''hasPrefix "https://localhost:" cfg.provision.instanceUrl'';
};
adminPasswordFile = lib.mkOption {
adminPasswordFile = mkOption {
description = "Path to a file containing the admin password for kanidm. Do NOT use a file from the nix store here!";
example = "/run/secrets/kanidm-admin-password";
default = null;
type = lib.types.nullOr lib.types.path;
type = types.nullOr types.path;
};
idmAdminPasswordFile = lib.mkOption {
idmAdminPasswordFile = mkOption {
description = ''
Path to a file containing the idm admin password for kanidm. Do NOT use a file from the nix store here!
If this is not given but provisioning is enabled, the idm_admin password will be reset on each restart.
'';
example = "/run/secrets/kanidm-idm-admin-password";
default = null;
type = lib.types.nullOr lib.types.path;
type = types.nullOr types.path;
};
autoRemove = lib.mkOption {
autoRemove = mkOption {
description = ''
Determines whether deleting an entity in this provisioning config should automatically
cause them to be removed from kanidm, too. This works because the provisioning tool tracks
all entities it has ever created. If this is set to false, you need to explicitly specify
`present = false` to delete an entity.
'';
type = lib.types.bool;
type = types.bool;
default = true;
};
groups = lib.mkOption {
groups = mkOption {
description = "Provisioning of kanidm groups";
default = { };
type = lib.types.attrsOf (
lib.types.submodule (groupSubmod: {
type = types.attrsOf (
types.submodule (groupSubmod: {
options = {
present = mkPresentOption "group";
members = lib.mkOption {
members = mkOption {
description = "List of kanidm entities (persons, groups, ...) which are part of this group.";
type = lib.types.listOf lib.types.str;
apply = lib.unique;
type = types.listOf types.str;
apply = unique;
default = [ ];
};
};
config.members = lib.concatLists (
lib.flip lib.mapAttrsToList cfg.provision.persons (
config.members = concatLists (
flip mapAttrsToList cfg.provision.persons (
person: personCfg:
lib.optional (
optional (
personCfg.present && builtins.elem groupSubmod.config._module.args.name personCfg.groups
) person
)
@@ -404,38 +438,38 @@ in
);
};
persons = lib.mkOption {
persons = mkOption {
description = "Provisioning of kanidm persons";
default = { };
type = lib.types.attrsOf (
lib.types.submodule {
type = types.attrsOf (
types.submodule {
options = {
present = mkPresentOption "person";
displayName = lib.mkOption {
displayName = mkOption {
description = "Display name";
type = lib.types.str;
type = types.str;
example = "My User";
};
legalName = lib.mkOption {
legalName = mkOption {
description = "Full legal name";
type = lib.types.nullOr lib.types.str;
type = types.nullOr types.str;
example = "Jane Doe";
default = null;
};
mailAddresses = lib.mkOption {
mailAddresses = mkOption {
description = "Mail addresses. First given address is considered the primary address.";
type = lib.types.listOf lib.types.str;
type = types.listOf types.str;
example = [ "jane.doe@example.com" ];
default = [ ];
};
groups = lib.mkOption {
groups = mkOption {
description = "List of groups this person should belong to.";
type = lib.types.listOf lib.types.str;
apply = lib.unique;
type = types.listOf types.str;
apply = unique;
default = [ ];
};
};
@@ -443,119 +477,119 @@ in
);
};
systems.oauth2 = lib.mkOption {
systems.oauth2 = mkOption {
description = "Provisioning of oauth2 resource servers";
default = { };
type = lib.types.attrsOf (
lib.types.submodule {
type = types.attrsOf (
types.submodule {
options = {
present = mkPresentOption "oauth2 resource server";
public = lib.mkOption {
public = mkOption {
description = "Whether this is a public client (enforces PKCE, doesn't use a basic secret)";
type = lib.types.bool;
type = types.bool;
default = false;
};
displayName = lib.mkOption {
displayName = mkOption {
description = "Display name";
type = lib.types.str;
type = types.str;
example = "Some Service";
};
originUrl = lib.mkOption {
originUrl = mkOption {
description = "The origin URL of the service. OAuth2 redirects will only be allowed to sites under this origin. Must end with a slash.";
type =
let
originStrType = lib.types.strMatching ".*://.*/$";
originStrType = types.strMatching ".*://.*/$";
in
lib.types.either originStrType (lib.types.nonEmptyListOf originStrType);
types.either originStrType (types.nonEmptyListOf originStrType);
example = "https://someservice.example.com/";
};
originLanding = lib.mkOption {
originLanding = mkOption {
description = "When redirecting from the Kanidm Apps Listing page, some linked applications may need to land on a specific page to trigger oauth2/oidc interactions.";
type = lib.types.str;
type = types.str;
example = "https://someservice.example.com/home";
};
basicSecretFile = lib.mkOption {
basicSecretFile = mkOption {
description = ''
The basic secret to use for this service. If null, the random secret generated
by kanidm will not be touched. Do NOT use a path from the nix store here!
'';
type = lib.types.nullOr lib.types.path;
type = types.nullOr types.path;
example = "/run/secrets/some-oauth2-basic-secret";
default = null;
};
enableLocalhostRedirects = lib.mkOption {
enableLocalhostRedirects = mkOption {
description = "Allow localhost redirects. Only for public clients.";
type = lib.types.bool;
type = types.bool;
default = false;
};
enableLegacyCrypto = lib.mkOption {
enableLegacyCrypto = mkOption {
description = "Enable legacy crypto on this client. Allows JWT signing algorthms like RS256.";
type = lib.types.bool;
type = types.bool;
default = false;
};
allowInsecureClientDisablePkce = lib.mkOption {
allowInsecureClientDisablePkce = mkOption {
description = ''
Disable PKCE on this oauth2 resource server to work around insecure clients
that may not support it. You should request the client to enable PKCE!
Only for non-public clients.
'';
type = lib.types.bool;
type = types.bool;
default = false;
};
preferShortUsername = lib.mkOption {
preferShortUsername = mkOption {
description = "Use 'name' instead of 'spn' in the preferred_username claim";
type = lib.types.bool;
type = types.bool;
default = false;
};
scopeMaps = lib.mkOption {
scopeMaps = mkOption {
description = ''
Maps kanidm groups to returned oauth scopes.
See [Scope Relations](https://kanidm.github.io/kanidm/stable/integrations/oauth2.html#scope-relationships) for more information.
'';
type = lib.types.attrsOf (lib.types.listOf lib.types.str);
type = types.attrsOf (types.listOf types.str);
default = { };
};
supplementaryScopeMaps = lib.mkOption {
supplementaryScopeMaps = mkOption {
description = ''
Maps kanidm groups to additionally returned oauth scopes.
See [Scope Relations](https://kanidm.github.io/kanidm/stable/integrations/oauth2.html#scope-relationships) for more information.
'';
type = lib.types.attrsOf (lib.types.listOf lib.types.str);
type = types.attrsOf (types.listOf types.str);
default = { };
};
removeOrphanedClaimMaps = lib.mkOption {
removeOrphanedClaimMaps = mkOption {
description = "Whether claim maps not specified here but present in kanidm should be removed from kanidm.";
type = lib.types.bool;
type = types.bool;
default = true;
};
claimMaps = lib.mkOption {
claimMaps = mkOption {
description = ''
Adds additional claims (and values) based on which kanidm groups an authenticating party belongs to.
See [Claim Maps](https://kanidm.github.io/kanidm/master/integrations/oauth2.html#custom-claim-maps) for more information.
'';
default = { };
type = lib.types.attrsOf (
lib.types.submodule {
type = types.attrsOf (
types.submodule {
options = {
joinType = lib.mkOption {
joinType = mkOption {
description = ''
Determines how multiple values are joined to create the claim value.
See [Claim Maps](https://kanidm.github.io/kanidm/master/integrations/oauth2.html#custom-claim-maps) for more information.
'';
type = lib.types.enum [
type = types.enum [
"array"
"csv"
"ssv"
@@ -563,10 +597,10 @@ in
default = "array";
};
valuesByGroup = lib.mkOption {
valuesByGroup = mkOption {
description = "Maps kanidm groups to values for the claim.";
default = { };
type = lib.types.attrsOf (lib.types.listOf lib.types.str);
type = types.attrsOf (types.listOf types.str);
};
};
}
@@ -579,26 +613,26 @@ in
};
};
config = lib.mkIf (cfg.enableClient || cfg.enableServer || cfg.enablePam) {
config = mkIf (cfg.enableClient || cfg.enableServer || cfg.enablePam) {
assertions =
let
entityList =
type: attrs: lib.flip lib.mapAttrsToList (filterPresent attrs) (name: _: { inherit type name; });
type: attrs: flip mapAttrsToList (filterPresent attrs) (name: _: { inherit type name; });
entities =
entityList "group" cfg.provision.groups
++ entityList "person" cfg.provision.persons
++ entityList "oauth2" cfg.provision.systems.oauth2;
# Accumulate entities by name. Track corresponding entity types for later duplicate check.
entitiesByName = lib.foldl' (
entitiesByName = foldl' (
acc: { type, name }: acc // { ${name} = (acc.${name} or [ ]) ++ [ type ]; }
) { } entities;
assertGroupsKnown =
opt: groups:
let
knownGroups = lib.attrNames (filterPresent cfg.provision.groups);
unknownGroups = lib.subtractLists knownGroups groups;
knownGroups = attrNames (filterPresent cfg.provision.groups);
unknownGroups = subtractLists knownGroups groups;
in
{
assertion = (cfg.enableServer && cfg.provision.enable) -> unknownGroups == [ ];
@@ -608,7 +642,7 @@ in
assertEntitiesKnown =
opt: entities:
let
unknownEntities = lib.subtractLists (lib.attrNames entitiesByName) entities;
unknownEntities = subtractLists (attrNames entitiesByName) entities;
in
{
assertion = (cfg.enableServer && cfg.provision.enable) -> unknownEntities == [ ];
@@ -620,7 +654,7 @@ in
assertion =
!cfg.enableServer
|| ((cfg.serverSettings.tls_chain or null) == null)
|| (!lib.isStorePath cfg.serverSettings.tls_chain);
|| (!isStorePath cfg.serverSettings.tls_chain);
message = ''
<option>services.kanidm.serverSettings.tls_chain</option> points to
a file in the Nix store. You should use a quoted absolute path to
@@ -631,7 +665,7 @@ in
assertion =
!cfg.enableServer
|| ((cfg.serverSettings.tls_key or null) == null)
|| (!lib.isStorePath cfg.serverSettings.tls_key);
|| (!isStorePath cfg.serverSettings.tls_key);
message = ''
<option>services.kanidm.serverSettings.tls_key</option> points to
a file in the Nix store. You should use a quoted absolute path to
@@ -677,9 +711,7 @@ in
&& (
cfg.provision.adminPasswordFile != null
|| cfg.provision.idmAdminPasswordFile != null
|| lib.any (x: x.basicSecretFile != null) (
lib.attrValues (filterPresent cfg.provision.systems.oauth2)
)
|| any (x: x.basicSecretFile != null) (attrValues (filterPresent cfg.provision.systems.oauth2))
)
)
-> cfg.package.enableSecretProvisioning;
@@ -692,48 +724,48 @@ in
(
let
# Filter all names that occurred in more than one entity type.
duplicateNames = lib.filterAttrs (_: v: builtins.length v > 1) entitiesByName;
duplicateNames = filterAttrs (_: v: builtins.length v > 1) entitiesByName;
in
{
assertion = cfg.provision.enable -> duplicateNames == { };
message = ''
services.kanidm.provision requires all entity names (group, person, oauth2, ...) to be unique!
${lib.concatLines (
lib.mapAttrsToList (name: xs: " - '${name}' used as: ${toString xs}") duplicateNames
${concatLines (
mapAttrsToList (name: xs: " - '${name}' used as: ${toString xs}") duplicateNames
)}'';
}
)
]
++ lib.flip lib.mapAttrsToList (filterPresent cfg.provision.persons) (
++ flip mapAttrsToList (filterPresent cfg.provision.persons) (
person: personCfg:
assertGroupsKnown "services.kanidm.provision.persons.${person}.groups" personCfg.groups
)
++ lib.flip lib.mapAttrsToList (filterPresent cfg.provision.groups) (
++ flip mapAttrsToList (filterPresent cfg.provision.groups) (
group: groupCfg:
assertEntitiesKnown "services.kanidm.provision.groups.${group}.members" groupCfg.members
)
++ lib.concatLists (
lib.flip lib.mapAttrsToList (filterPresent cfg.provision.systems.oauth2) (
++ concatLists (
flip mapAttrsToList (filterPresent cfg.provision.systems.oauth2) (
oauth2: oauth2Cfg:
[
(assertGroupsKnown "services.kanidm.provision.systems.oauth2.${oauth2}.scopeMaps" (
lib.attrNames oauth2Cfg.scopeMaps
attrNames oauth2Cfg.scopeMaps
))
(assertGroupsKnown "services.kanidm.provision.systems.oauth2.${oauth2}.supplementaryScopeMaps" (
lib.attrNames oauth2Cfg.supplementaryScopeMaps
attrNames oauth2Cfg.supplementaryScopeMaps
))
]
++ lib.concatLists (
lib.flip lib.mapAttrsToList oauth2Cfg.claimMaps (
++ concatLists (
flip mapAttrsToList oauth2Cfg.claimMaps (
claim: claimCfg: [
(assertGroupsKnown "services.kanidm.provision.systems.oauth2.${oauth2}.claimMaps.${claim}.valuesByGroup" (
lib.attrNames claimCfg.valuesByGroup
attrNames claimCfg.valuesByGroup
))
# At least one group must map to a value in each claim map
{
assertion =
(cfg.provision.enable && cfg.enableServer)
-> lib.any (xs: xs != [ ]) (lib.attrValues claimCfg.valuesByGroup);
-> any (xs: xs != [ ]) (attrValues claimCfg.valuesByGroup);
message = "services.kanidm.provision.systems.oauth2.${oauth2}.claimMaps.${claim} does not specify any values for any group";
}
# Public clients cannot define a basic secret
@@ -762,7 +794,7 @@ in
)
);
environment.systemPackages = lib.mkIf cfg.enableClient [ cfg.package ];
environment.systemPackages = mkIf cfg.enableClient [ cfg.package ];
systemd.tmpfiles.settings."10-kanidm" = {
${cfg.serverSettings.online_backup.path}.d = {
@@ -772,11 +804,11 @@ in
};
};
systemd.services.kanidm = lib.mkIf cfg.enableServer {
systemd.services.kanidm = mkIf cfg.enableServer {
description = "kanidm identity management daemon";
wantedBy = [ "multi-user.target" ];
after = [ "network.target" ];
serviceConfig = lib.mkMerge [
serviceConfig = mkMerge [
# Merge paths and ignore existing prefixes needs to sidestep mkMerge
(
defaultServiceConfig
@@ -789,7 +821,7 @@ in
StateDirectoryMode = "0700";
RuntimeDirectory = "kanidmd";
ExecStart = "${cfg.package}/bin/kanidmd server -c ${serverConfigFile}";
ExecStartPost = lib.mkIf cfg.provision.enable postStartScript;
ExecStartPost = mkIf cfg.provision.enable postStartScript;
User = "kanidm";
Group = "kanidm";
@@ -803,9 +835,9 @@ in
AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
# This would otherwise override the CAP_NET_BIND_SERVICE capability.
PrivateUsers = lib.mkForce false;
PrivateUsers = mkForce false;
# Port needs to be exposed to the host network
PrivateNetwork = lib.mkForce false;
PrivateNetwork = mkForce false;
RestrictAddressFamilies = [
"AF_INET"
"AF_INET6"
@@ -817,7 +849,7 @@ in
environment.RUST_LOG = "info";
};
systemd.services.kanidm-unixd = lib.mkIf cfg.enablePam {
systemd.services.kanidm-unixd = mkIf cfg.enablePam {
description = "Kanidm PAM daemon";
wantedBy = [ "multi-user.target" ];
after = [ "network.target" ];
@@ -825,7 +857,7 @@ in
unixConfigFile
clientConfigFile
];
serviceConfig = lib.mkMerge [
serviceConfig = mkMerge [
defaultServiceConfig
{
CacheDirectory = "kanidm-unixd";
@@ -848,7 +880,7 @@ in
"/run/kanidm-unixd:/var/run/kanidm-unixd"
];
# Needs to connect to kanidmd
PrivateNetwork = lib.mkForce false;
PrivateNetwork = mkForce false;
RestrictAddressFamilies = [
"AF_INET"
"AF_INET6"
@@ -860,7 +892,7 @@ in
environment.RUST_LOG = "info";
};
systemd.services.kanidm-unixd-tasks = lib.mkIf cfg.enablePam {
systemd.services.kanidm-unixd-tasks = mkIf cfg.enablePam {
description = "Kanidm PAM home management daemon";
wantedBy = [ "multi-user.target" ];
after = [
@@ -910,25 +942,25 @@ in
};
# These paths are hardcoded
environment.etc = lib.mkMerge [
(lib.mkIf cfg.enableServer { "kanidm/server.toml".source = serverConfigFile; })
(lib.mkIf options.services.kanidm.clientSettings.isDefined {
environment.etc = mkMerge [
(mkIf cfg.enableServer { "kanidm/server.toml".source = serverConfigFile; })
(mkIf options.services.kanidm.clientSettings.isDefined {
"kanidm/config".source = clientConfigFile;
})
(lib.mkIf cfg.enablePam { "kanidm/unixd".source = unixConfigFile; })
(mkIf cfg.enablePam { "kanidm/unixd".source = unixConfigFile; })
];
system.nssModules = lib.mkIf cfg.enablePam [ cfg.package ];
system.nssModules = mkIf cfg.enablePam [ cfg.package ];
system.nssDatabases.group = lib.optional cfg.enablePam "kanidm";
system.nssDatabases.passwd = lib.optional cfg.enablePam "kanidm";
system.nssDatabases.group = optional cfg.enablePam "kanidm";
system.nssDatabases.passwd = optional cfg.enablePam "kanidm";
users.groups = lib.mkMerge [
(lib.mkIf cfg.enableServer { kanidm = { }; })
(lib.mkIf cfg.enablePam { kanidm-unixd = { }; })
users.groups = mkMerge [
(mkIf cfg.enableServer { kanidm = { }; })
(mkIf cfg.enablePam { kanidm-unixd = { }; })
];
users.users = lib.mkMerge [
(lib.mkIf cfg.enableServer {
users.users = mkMerge [
(mkIf cfg.enableServer {
kanidm = {
description = "Kanidm server";
isSystemUser = true;
@@ -936,7 +968,7 @@ in
packages = [ cfg.package ];
};
})
(lib.mkIf cfg.enablePam {
(mkIf cfg.enablePam {
kanidm-unixd = {
description = "Kanidm PAM daemon";
isSystemUser = true;
nixos/tests/invidious.nix
+4 -4
View File
@@ -20,7 +20,7 @@ import ./make-test-python.nix ({ pkgs, ... }: {
};
networking.firewall.allowedTCPPorts = [ config.services.postgresql.settings.port ];
};
machine = { config, lib, pkgs, ... }: {
machine = { lib, pkgs, ... }: {
services.invidious = {
enable = true;
};
@@ -81,11 +81,11 @@ import ./make-test-python.nix ({ pkgs, ... }: {
def activate_specialisation(name: str):
machine.succeed(f"${nodes.machine.config.system.build.toplevel}/specialisation/{name}/bin/switch-to-configuration test >&2")
machine.succeed(f"${nodes.machine.system.build.toplevel}/specialisation/{name}/bin/switch-to-configuration test >&2")
url = "http://localhost:${toString nodes.machine.config.services.invidious.port}"
port = ${toString nodes.machine.config.services.invidious.port}
url = "http://localhost:${toString nodes.machine.services.invidious.port}"
port = ${toString nodes.machine.services.invidious.port}
# start postgres vm now
postgres_tcp.start()
pkgs/applications/emulators/box64/default.nix
+2 -2
View File
@@ -21,13 +21,13 @@ assert
stdenv.mkDerivation (finalAttrs: {
pname = "box64";
version = "0.2.8";
version = "0.3.0";
src = fetchFromGitHub {
owner = "ptitSeb";
repo = "box64";
rev = "v${finalAttrs.version}";
hash = "sha256-P+m+JS3THh3LWMZYW6BQ7QyNWlBuL+hMcUtUbpMHzis=";
hash = "sha256-8PpTN7lUjpmSowbaRsfSRWJQRDZICFhVvn05tQYC4PQ=";
};
nativeBuildInputs = [
pkgs/applications/networking/cluster/clusterctl/default.nix
+3 -3
View File
@@ -2,16 +2,16 @@
buildGoModule rec {
pname = "clusterctl";
version = "1.8.0";
version = "1.8.1";
src = fetchFromGitHub {
owner = "kubernetes-sigs";
repo = "cluster-api";
rev = "v${version}";
hash = "sha256-x82ek6KsfmVjG9P9EaGlvbncGaORqMB2lMxannZT4YE=";
hash = "sha256-Z7cFwR8IUThEd4Te3KHPC8K8v56ymAG7nIM/7pxWq4U=";
};
vendorHash = "sha256-z859ZjuvY53HqHXNo8zZkK9XAtMOxh57FeXgGfno3G0=";
vendorHash = "sha256-0VVaD1vGIGezgkVCvIhNHmZqVFxFu4UcUUh0wuX2viw=";
subPackages = [ "cmd/clusterctl" ];
pkgs/applications/networking/cluster/kubectl-evict-pod/default.nix
+2 -2
View File
@@ -2,13 +2,13 @@
buildGoModule rec {
pname = "kubectl-evict-pod";
version = "0.0.13";
version = "0.0.14";
src = fetchFromGitHub {
owner = "rajatjindal";
repo = pname;
rev = "v${version}";
sha256 = "sha256-yA88GDcu1Sg8d5RCC4yiDPYZPxDSnke/4X7nSBSGf88=";
sha256 = "sha256-Z1NIueonjyO2GHulBbXbsQtX7V/Z95GUoZv9AqjLIR0=";
};
vendorHash = null;
pkgs/applications/window-managers/wayfire/wcm.nix
+2 -2
View File
@@ -18,14 +18,14 @@
stdenv.mkDerivation (finalAttrs: {
pname = "wcm";
version = "0.8.0";
version = "0.9.0";
src = fetchFromGitHub {
owner = "WayfireWM";
repo = "wcm";
rev = "v${finalAttrs.version}";
fetchSubmodules = true;
hash = "sha256-UwHJ4Wi83ATnA1CQKNSt8Qga7ooLnAY7QARz2FXvUIo=";
hash = "sha256-oaaEtyu/9XVhFTkmD7WjScMycpKf+M7oPyQatbY23Vo=";
};
nativeBuildInputs = [
pkgs/by-name/ch/chatzone-desktop/package.nix
+74
View File
@@ -0,0 +1,74 @@
{
lib,
appimageTools,
fetchurl,
stdenvNoCC,
makeDesktopItem,
copyDesktopItems,
makeWrapper,
}:
let
pname = "chatzone-desktop";
version = "5.2.1";
src = fetchurl {
url = "https://cdn1.ozone.ru/s3/chatzone-clients/ci/31072024-1/407/chatzone-desktop-linux-5.2.1.AppImage";
hash = "sha256-IXn7mAY3+2q+/PKcNQbRVW+wbAPMWLUh/DGAic6M898=";
};
appimageContents = appimageTools.extract { inherit pname version src; };
in
stdenvNoCC.mkDerivation {
inherit pname version;
src = appimageTools.wrapType2 { inherit pname version src; };
nativeBuildInputs = [
copyDesktopItems
makeWrapper
];
desktopItems = [
(makeDesktopItem {
name = "chatzone";
exec = "chatzone-desktop";
icon = "chatzone-desktop";
terminal = false;
desktopName = "Chatzone";
genericName = "Ozon corporate messenger";
comment = "Mattermost Desktop application for Linux";
categories = [
"Network"
"InstantMessaging"
"Chat"
];
mimeTypes = [ "x-scheme-handler/mattermost" ];
})
];
installPhase = ''
runHook preInstall
mkdir -p $out/
cp -r bin $out/bin
mkdir -p $out/share/chatzone-desktop/
cp ${appimageContents}/app_icon.png $out/share/chatzone-desktop/
cp -r ${appimageContents}/usr/share/icons $out/share
wrapProgram $out/bin/chatzone-desktop \
--add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}"
runHook postInstall
'';
meta = {
description = "Ozon corporate messenger";
mainProgram = "chatzone-desktop";
homepage = "https://apps.o3team.ru/";
downloadPage = "https://apps.o3team.ru/";
sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
license = lib.licenses.unfreeRedistributable;
maintainers = [ lib.maintainers.progrm_jarvis ];
platforms = [ "x86_64-linux" ];
};
}
pkgs/by-name/fl/flatpak/package.nix
+2 -2
View File
@@ -231,9 +231,9 @@ stdenv.mkDerivation (finalAttrs: {
validate-icon = runCommand "test-icon-validation" { } ''
${finalAttrs.finalPackage}/libexec/flatpak-validate-icon \
--sandbox 512 512 \
"${nixos-icons}/share/icons/hicolor/scalable/apps/nix-snowflake-white.svg" > "$out"
"${nixos-icons}/share/icons/hicolor/512x512/apps/nix-snowflake.png" > "$out"
grep format=svg "$out"
grep format=png "$out"
'';
version = testers.testVersion { package = finalAttrs.finalPackage; };
pkgs/by-name/gl/glasskube/package.nix
+4 -4
View File
@@ -7,12 +7,12 @@
}:
let
version = "0.16.0";
version = "0.17.0";
gitSrc = fetchFromGitHub {
owner = "glasskube";
repo = "glasskube";
rev = "refs/tags/v${version}";
hash = "sha256-NZ7FQMJyQlJW5ZS8dNzsURhRcu0IQXyTn/6e91eGhEg=";
hash = "sha256-uo612trSSdbj6XpZHddXELNQideJ/M/qh+LLdzVZL6U=";
};
web-bundle = buildNpmPackage rec {
inherit version;
@@ -20,7 +20,7 @@ let
src = gitSrc;
npmDepsHash = "sha256-0PzjOOdKkKjKUsi+uWYkGAyEXynMNq2OODH/sX2SsWQ=";
npmDepsHash = "sha256-s3ViR6zBUTTu864fiD06N1ouMUYXccj6AMXt5pj+BSc=";
dontNpmInstall = true;
@@ -40,7 +40,7 @@ in buildGoModule rec {
src = gitSrc;
vendorHash = "sha256-bh1ZQhd3xYoz4AEe/EZ4baBryQx4WfdacTQDP1Roi2Y=";
vendorHash = "sha256-KzoFPhySX2w7ndU6nndx/KqoUfE8o6OT/9a2DEz5YuI=";
CGO_ENABLED = 0;
pkgs/by-name/im/immich-go/package.nix
+2 -2
View File
@@ -1,13 +1,13 @@
{ lib, buildGoModule, fetchFromGitHub, nix-update-script, testers, immich-go }:
buildGoModule rec {
pname = "immich-go";
version = "1.21.3";
version = "0.22.0";
src = fetchFromGitHub {
owner = "simulot";
repo = "immich-go";
rev = "${version}";
hash = "sha256-DgTEkiT9D+8wa6mzWWnsh98f7hEEK5r3QiH2e1yarCU=";
hash = "sha256-dSyVn7CQqZ/tCxF/Yl12eubWkZrV5FM8uRexCjZILbw=";
# Inspired by: https://github.com/NixOS/nixpkgs/blob/f2d7a289c5a5ece8521dd082b81ac7e4a57c2c5c/pkgs/applications/graphics/pdfcpu/default.nix#L20-L32
# The intention here is to write the information into files in the `src`'s
pkgs/by-name/le/legba/package.nix
+5 -1
View File
@@ -5,6 +5,8 @@
, pkg-config
, openssl
, samba
, stdenv
, darwin
}:
rustPlatform.buildRustPackage rec {
@@ -21,7 +23,9 @@ rustPlatform.buildRustPackage rec {
cargoHash = "sha256-viDfJ214Zf5segjrLSTbHav5T5e219NAF+MvuPow+JQ=";
nativeBuildInputs = [ cmake pkg-config ];
buildInputs = [ openssl.dev samba ];
buildInputs = [ openssl.dev samba ] ++ lib.optionals stdenv.isDarwin [
darwin.apple_sdk.frameworks.SystemConfiguration
];
# Paho C test fails due to permission issue
doCheck = false;
pkgs/by-name/lo/loopwm/package.nix
+4
View File
@@ -29,6 +29,10 @@ stdenvNoCC.mkDerivation (finalAttrs: {
runHook postInstall
'';
passthru = {
updateScript = ./update.sh;
};
meta = {
description = "macOS Window management made elegant";
homepage = "https://github.com/MrKai77/Loop";
pkgs/by-name/lo/loopwm/update.sh
Executable
+20
View File
@@ -0,0 +1,20 @@
#!/usr/bin/env nix-shell
#!nix-shell -i bash -p curl jq gnused
set -euo pipefail
cd "$(dirname "$0")" || exit 1
# Grab latest release version
LOOPWM_LATEST_VER="$(curl --fail -s ${GITHUB_TOKEN:+-u ":$GITHUB_TOKEN"} "https://api.github.com/repos/MrKai77/Loop/releases/latest" | jq -r '.tag_name' | sed 's/^v//')"
LOOPWM_CURRENT_VER="$(grep -oP 'version = "\K[^"]+' package.nix)"
if [[ "$LOOPWM_LATEST_VER" == "$LOOPWM_CURRENT_VER" ]]; then
echo "loopwm is up-to-date"
exit 0
fi
LOOPWM_DARWIN_HASH="$(nix-hash --to-sri --type sha256 "$(nix-prefetch-url --type sha256 "https://github.com/MrKai77/Loop/releases/download/${LOOPWM_LATEST_VER}/Loop.zip")")"
sed -i "s#hash = \".*\"#hash = \"$LOOPWM_DARWIN_HASH\"#g" package.nix
sed -i "s#version = \".*\";#version = \"$LOOPWM_LATEST_VER\";#g" package.nix
pkgs/by-name/md/mdbook-alerts/package.nix
+3 -3
View File
@@ -7,7 +7,7 @@
CoreServices ? darwin.apple_sdk.frameworks.CoreServices,
}:
let
version = "0.6.3";
version = "0.6.4";
in
rustPlatform.buildRustPackage {
pname = "mdbook-alerts";
@@ -17,10 +17,10 @@ rustPlatform.buildRustPackage {
owner = "lambdalisue";
repo = "rs-mdbook-alerts";
rev = "v${version}";
hash = "sha256-MoaV/JRhWKYEzUkzxRTgYjqBw+gb2h+Bjb4mEvWEkp8=";
hash = "sha256-bg3X7M2H553tGxH8cEkkT0XK20fWwkp2nTVEgtZ819s=";
};
cargoHash = "sha256-tHRbeDSK4aULz69jy5MeU4rANVuO2q3GUhDvBA4iQCM=";
cargoHash = "sha256-MMhpH3WIAXnjw6xOl2HNfrIFEwjHfVDPquWnFhhZCMU=";
buildInputs = lib.optionals stdenv.isDarwin [ CoreServices ];
pkgs/by-name/mi/minijinja/package.nix
+3 -3
View File
@@ -2,16 +2,16 @@
rustPlatform.buildRustPackage rec {
pname = "minijinja";
version = "2.1.2";
version = "2.2.0";
src = fetchFromGitHub {
owner = "mitsuhiko";
repo = "minijinja";
rev = version;
hash = "sha256-BB8uM0yU8M5Crh5hLucJkhvjLC1Vlk5bGKmeO1rCy+Y=";
hash = "sha256-ctFer7KPvES/tSV2e3G3rRIe7z2U4wgViB2qxBZuTUM=";
};
cargoHash = "sha256-bn7qJZE68UJPNaARQRXy6GPkplv0KAkKByy85ooi5kg=";
cargoHash = "sha256-kDWmUg86aZP99ebkv/1aKT2YJv7DdTT5oxnegxpD9gQ=";
# The tests relies on the presence of network connection
doCheck = false;
pkgs/by-name/nb/nbfc-linux/package.nix
+2 -2
View File
@@ -6,13 +6,13 @@
}:
stdenv.mkDerivation (finalAttrs: {
pname = "nbfc-linux";
version = "0.1.15";
version = "0.2.7";
src = fetchFromGitHub {
owner = "nbfc-linux";
repo = "nbfc-linux";
rev = "${finalAttrs.version}";
hash = "sha256-+xYr2uIxfMaMAaHGvvA+0WPZjwj3wVAc34e1DWsJLqE=";
hash = "sha256-1tLW/xEh01y8BjVbgIa95DkYWf7CDVSo/lI/1U28Xs8=";
};
nativeBuildInputs = [
pkgs/tools/misc/nbqa/default.nix → pkgs/by-name/nb/nbqa/package.nix
+23 -9
View File
@@ -1,20 +1,27 @@
{ black
, blacken-docs
, fetchFromGitHub
, lib
, python3
, ruff
{
lib,
python3,
fetchFromGitHub,
# optional-dependencies
black,
blacken-docs,
ruff,
# passthru
testers,
nbqa,
}:
python3.pkgs.buildPythonApplication rec {
pname = "nbqa";
version = "1.8.7";
version = "1.9.0";
pyproject = true;
src = fetchFromGitHub {
owner = "nbQA-dev";
repo = "nbQA";
rev = "refs/tags/${version}";
hash = "sha256-zn+e/svaxeJU9P1sIaRrVuKW0+FM0GLKZTUx3PfuThk=";
hash = "sha256-9s+q2unh+jezU0Er7ZH0tvgntmPFts9OmsgAMeQXRrY=";
};
build-system = with python3.pkgs; [
@@ -33,7 +40,8 @@ python3.pkgs.buildPythonApplication rec {
ruff = [ ruff ];
};
dependencies = with python3.pkgs;
dependencies =
with python3.pkgs;
[
autopep8
ipython
@@ -90,6 +98,12 @@ python3.pkgs.buildPythonApplication rec {
"tests/test_include_exclude.py"
];
passthru = {
tests.version = testers.testVersion {
package = nbqa;
};
};
meta = {
homepage = "https://github.com/nbQA-dev/nbQA";
changelog = "https://nbqa.readthedocs.io/en/latest/history.html";
pkgs/by-name/op/opshin/package.nix
+3 -3
View File
@@ -6,15 +6,15 @@
python3.pkgs.buildPythonApplication rec {
pname = "opshin";
version = "0.22.0";
version = "0.23.0";
format = "pyproject";
src = fetchFromGitHub {
owner = "OpShin";
repo = "opshin";
rev = version;
hash = "sha256-ixA5D7Bm/tjYEFhqaJ4sKkCkqQZpDyrwfD/LgN6Y4Uo=";
rev = "refs/tags/${version}";
hash = "sha256-H6tuSJYV9bAwXu/5Y8g6aFbbQFCpq2aqcmRaDq2cAEg=";
};
propagatedBuildInputs = with python3.pkgs; [
pkgs/by-name/pr/protoc-gen-prost-crate/package.nix
+3 -3
View File
@@ -7,14 +7,14 @@
rustPlatform.buildRustPackage rec {
pname = "protoc-gen-prost-crate";
version = "0.4.0";
version = "0.4.1";
src = fetchCrate {
inherit pname version;
hash = "sha256-+TSZ2QstAF8DXsHunV/nQyqF++0bFud1ZWJQEI3JEwc=";
hash = "sha256-9rIFDZbI6XGDsNzFMnMYY4loJxojdz6vnQKAz9eDAyQ=";
};
cargoHash = "sha256-KbErgnXG11ngzLVSktuyUAupYs1ZD64z3plKVtzLx1A=";
cargoHash = "sha256-uAygKDdm+0SEDFBQcaoYTRMRgnodiO/kL1sGbRmdJKE=";
passthru.updateScript = nix-update-script { };
pkgs/by-name/pr/protoc-gen-prost-serde/package.nix
+3 -3
View File
@@ -7,14 +7,14 @@
rustPlatform.buildRustPackage rec {
pname = "protoc-gen-prost-serde";
version = "0.3.0";
version = "0.3.1";
src = fetchCrate {
inherit pname version;
hash = "sha256-O2Mpft31ZQncqETWzwD73I1nX1Wt5XVHcTJUk5qhRLY=";
hash = "sha256-RQlNVGa6BRIqIGodqNN3eGl//hkUWrq7GpTGpRBCDgE=";
};
cargoHash = "sha256-aUWmNS3jF1I0NLApBn3GMMv6ID9mM/j7r7sPFCsFIuw=";
cargoHash = "sha256-ZQOlDqDUd1nZi+2iFKCUq4Gnc9HGcLblIGY2cdQyGM0=";
passthru.updateScript = nix-update-script { };
pkgs/by-name/pr/protoc-gen-prost/package.nix
+3 -3
View File
@@ -7,14 +7,14 @@
rustPlatform.buildRustPackage rec {
pname = "protoc-gen-prost";
version = "0.3.1";
version = "0.4.0";
src = fetchCrate {
inherit pname version;
hash = "sha256-ma9sdt3/uq06BMELwsNadMkiEfstQhA4DAQEPdizZJM=";
hash = "sha256-Bz5/LyKludw0Tz3r+xr4DMRdMSz/nRzjs7Q66z1PrTU=";
};
cargoHash = "sha256-pJDrwX5uDIrycxtmbds8l4wadZE0RdgmNpMwVkUGJDs=";
cargoHash = "sha256-X6yEJBgW9XzCNSxEQYj6LdPjbCPyh4SnKwdA/+sNNeg=";
passthru.updateScript = nix-update-script { };
pkgs/by-name/pr/protoc-gen-tonic/package.nix
+3 -3
View File
@@ -7,14 +7,14 @@
rustPlatform.buildRustPackage rec {
pname = "protoc-gen-tonic";
version = "0.4.0";
version = "0.4.1";
src = fetchCrate {
inherit pname version;
hash = "sha256-3qz1ea9lEsZjhWNA0lcwqsPkNmjj2ZBljqNRr5/2lKM=";
hash = "sha256-H7YQ8y6YA8kjR9bhHfBOYu0OEFc8ezqXkqC6jGScs3s=";
};
cargoHash = "sha256-nUsRoDaP+omZdOTnaxvHbJT1uNGtyfgXyEFZbp/CeYA=";
cargoHash = "sha256-eYX3w/rSi/kuH6gyWCWT4on7pKedPKnl9pht1jXNwpg=";
passthru.updateScript = nix-update-script { };
pkgs/by-name/ra/rathole/package.nix
+47
View File
@@ -0,0 +1,47 @@
{
lib,
stdenv,
fetchFromGitHub,
rustPlatform,
pkg-config,
openssl,
nixosTests,
darwin,
}:
rustPlatform.buildRustPackage {
pname = "rathole";
version = "0.5.0-unstable-2024-06-06";
src = fetchFromGitHub {
owner = "rapiz1";
repo = "rathole";
rev = "be14d124a22e298d12d92e56ef4fec0e51517998";
hash = "sha256-C0/G4JOZ4pTAvcKZhRHsGvlLlwAyWBQ0rMScLvaLSuA=";
};
cargoHash = "sha256-zlwIgzqpoEgYqZe4Gv8owJQ3m7UFgPA5joRMiyq+T/M=";
nativeBuildInputs = [ pkg-config ];
buildInputs = [
openssl
] ++ lib.optionals stdenv.isDarwin (with darwin.apple_sdk.frameworks; [ CoreServices ]);
__darwinAllowLocalNetworking = true;
passthru.tests = {
inherit (nixosTests) rathole;
};
meta = {
description = "Reverse proxy for NAT traversal";
homepage = "https://github.com/rapiz1/rathole";
license = lib.licenses.asl20;
mainProgram = "rathole";
maintainers = with lib.maintainers; [
dit7ya
xokdvium
];
};
}
pkgs/by-name/rk/rkboot/package.nix
+2 -2
View File
@@ -1,7 +1,7 @@
{ stdenv
, lib
, rkbin
, box64
, qemu
}:
stdenv.mkDerivation {
@@ -19,7 +19,7 @@ stdenv.mkDerivation {
do
# The proprietary, statically linked binaries to perform boot_merge are
# x86_64 only. Though we use box64 to emulate if building on aarch64-linux
${lib.optionalString stdenv.isAarch64 "${lib.getExe box64}"} ./tools/boot_merger "$i" || true
${lib.optionalString stdenv.isAarch64 "${qemu}/bin/qemu-x86_64"} ./tools/boot_merger "$i" || true
done
'';
pkgs/applications/networking/instant-messengers/viber/default.nix → pkgs/by-name/vi/viber/package.nix
+5 -3
View File
@@ -43,15 +43,17 @@
stdenv.mkDerivation {
pname = "viber";
version = "21.8.0.11";
version = "23.2.0.3";
src = fetchurl {
# Official link: https://download.cdn.viber.com/cdn/desktop/Linux/viber.deb
url = "https://download.cdn.viber.com/cdn/desktop/Linux/viber.deb";
# Taking Internet Archive snapshot of a specific version to avoid breakage
# on new versions
url = "https://web.archive.org/web/20240824071651/https://download.cdn.viber.com/cdn/desktop/Linux/viber.deb";
hash = "sha256-9WHiI2WlsgEhCPkrQoAunmF6lSb2n5RgQJ2+sdnSShM=";
};
nativeBuildInputs = [ makeWrapper ];
buildInputs = [ dpkg ];
dontUnpack = true;
pkgs/applications/video/video-trimmer/default.nix → pkgs/by-name/vi/video-trimmer/package.nix
+27 -23
View File
@@ -1,37 +1,38 @@
{ stdenv
, lib
, fetchFromGitLab
, rustPlatform
, cargo
, pkg-config
, meson
, rustc
, wrapGAppsHook4
, desktop-file-utils
, blueprint-compiler
, ninja
, gtk4
, libadwaita
, gst_all_1
, ffmpeg-headless
{
stdenv,
lib,
fetchFromGitLab,
rustPlatform,
cargo,
pkg-config,
meson,
rustc,
wrapGAppsHook4,
desktop-file-utils,
blueprint-compiler,
ninja,
gtk4,
libadwaita,
gst_all_1,
ffmpeg-headless,
}:
stdenv.mkDerivation (finalAttrs: {
pname = "video-trimmer";
version = "0.8.1";
version = "0.8.2";
src = fetchFromGitLab {
domain = "gitlab.gnome.org";
owner = "YaLTeR";
repo = "video-trimmer";
rev = "v${finalAttrs.version}";
hash = "sha256-nr0PAvp4wlswQBNN2LLyYQMpk3IIleHf3+978XhUGGQ=";
hash = "sha256-GXFbfebwiESplOeYDWxBH8Q0SCgV0vePYV7rv0qgrHM=";
};
cargoDeps = rustPlatform.fetchCargoTarball {
inherit (finalAttrs) src;
name = "${finalAttrs.pname}-${finalAttrs.version}";
hash = "sha256-YFbLMpQbHUtxRrBVarcoIeDsvc26NWc1YhMeCaLgJAc=";
hash = "sha256-szxJzBFtyFZ1T5TZb2MDPFJzn+EYETa/JbPdlg6UrTk=";
};
nativeBuildInputs = [
@@ -67,12 +68,15 @@ stdenv.mkDerivation (finalAttrs: {
)
'';
meta = with lib; {
meta = {
homepage = "https://gitlab.gnome.org/YaLTeR/video-trimmer";
description = "Trim videos quickly";
maintainers = with maintainers; [ doronbehar ];
license = licenses.gpl3Plus;
platforms = platforms.linux;
maintainers = with lib.maintainers; [
doronbehar
aleksana
];
license = lib.licenses.gpl3Plus;
platforms = lib.platforms.linux;
mainProgram = "video-trimmer";
};
})
pkgs/by-name/wa/warp-terminal/versions.json
+4 -4
View File
@@ -1,10 +1,10 @@
{
"darwin": {
"hash": "sha256-imHJKbE+M4jFzeymhBaFkzUqG1jiY6Bi17Ll+JSsj7w=",
"version": "0.2024.08.13.08.02.stable_03"
"hash": "sha256-EDhj4Gb0ykFX8W2G8osusjggemcuHO7hkUKb151cQ6g=",
"version": "0.2024.08.20.08.02.stable_00"
},
"linux": {
"hash": "sha256-MkNt6LzZdn/FjLcISm49ELPjIa8KAs/fd3k0/EhAyZQ=",
"version": "0.2024.08.13.08.02.stable_04"
"hash": "sha256-Uk5pSoAvEppjLnskLc5/ftcCaiJnXATJfCPDP2QpBo8=",
"version": "0.2024.08.20.08.02.stable_00"
}
}
pkgs/by-name/ya/yandex-music/info.json
+7
View File
@@ -0,0 +1,7 @@
{
"branch": "master",
"commit_hash": "4ac238a00ca0b36e9755e55e54a22d3107ba443c",
"commit_message": "Update packages",
"date": "2024-08-27",
"tag": "v5.13.2"
}
pkgs/by-name/ya/yandex-music/package.nix
+88
View File
@@ -0,0 +1,88 @@
{
fetchurl,
stdenvNoCC,
lib,
makeWrapper,
p7zip,
asar,
jq,
python3,
electron,
fetchFromGitHub,
electronArguments ? "",
trayEnabled ? true,
}:
stdenvNoCC.mkDerivation rec {
pname = "yandex-music";
version = "5.13.2";
src = fetchFromGitHub {
owner = "cucumber-sp";
repo = "yandex-music-linux";
rev = "v${version}";
hash = "sha256-yQX2GEulAQ02BndpwAAwGdTYtUlNXCgsCUdmXxPwtKU=";
};
nativeBuildInputs = [
p7zip
asar
jq
python3
makeWrapper
];
passthru.updateScript = ./update.sh;
ymExe =
let
ym_info = builtins.fromJSON (builtins.readFile ./ym_info.json);
in
fetchurl {
url = ym_info.ym.exe_link;
sha256 = ym_info.ym.exe_sha256;
};
buildPhase = ''
runHook preBuild
bash "./repack.sh" -o "./app" "$ymExe"
runHook postBuild
'';
installPhase = ''
runHook preInstall
mkdir -p "$out/share/nodejs"
mv app/yandex-music.asar "$out/share/nodejs"
CONFIG_FILE="$out/share/yandex-music.conf"
echo "TRAY_ENABLED=${if trayEnabled then "1" else "0"}" >> "$CONFIG_FILE"
echo "ELECTRON_ARGS=\"${electronArguments}\"" >> "$CONFIG_FILE"
install -Dm755 "$src/templates/yandex-music.sh" "$out/bin/yandex-music"
substituteInPlace "$out/bin/yandex-music" \
--replace-fail "%electron_path%" "${electron}/bin/electron" \
--replace-fail "%asar_path%" "$out/share/nodejs/yandex-music.asar"
wrapProgram "$out/bin/yandex-music" \
--set-default YANDEX_MUSIC_CONFIG "$CONFIG_FILE"
install -Dm644 "./app/favicon.png" "$out/share/pixmaps/yandex-music.png"
install -Dm644 "./app/favicon.png" "$out/share/icons/hicolor/48x48/apps/yandex-music.png"
install -Dm644 "./app/favicon.svg" "$out/share/icons/hicolor/scalable/apps/yandex-music.svg"
install -Dm644 "$src/templates/desktop" "$out/share/applications/yandex-music.desktop"
runHook postInstall
'';
meta = {
description = "Yandex Music - Personal recommendations, selections for any occasion and new music";
homepage = "https://music.yandex.ru/";
downloadPage = "https://music.yandex.ru/download/";
changelog = "https://github.com/cucumber-sp/yandex-music-linux/releases/tag/v5.13.2";
license = lib.licenses.unfree;
platforms = lib.platforms.linux;
maintainers = with lib.maintainers; [ shved ];
};
}
pkgs/by-name/ya/yandex-music/update.sh
Executable
+43
View File
@@ -0,0 +1,43 @@
#!/usr/bin/env nix-shell
#! nix-shell -i bash -p common-updater-scripts fd jq
set -eou pipefail
OWNER="cucumber-sp"
REPO="yandex-music-linux"
URL="https://api.github.com/repos/$OWNER/$REPO"
RAW="https://raw.githubusercontent.com/$OWNER/$REPO"
latest_release="$(curl --silent "$URL/releases/latest")"
latest_tag="$(curl --silent "$URL/tags?per_page=1")"
commit_hash="$(jq -r '.[0].commit.sha' <<<"$latest_tag")"
latest_commit="$(curl --silent "$URL/commits/$commit_hash"'')"
commit_message="$(jq -r '.commit.message' <<<"$latest_commit")"
tag=$(jq -r '.tag_name' <<<"$latest_release")
# drop 'v' prefix
version="${tag#v}"
branch=$(jq -r '.target_commitish' <<<"$latest_release")
date=$(jq -r '.created_at' <<<"$latest_release")
# truncate time
date=${date%T*}
# update version; otherwise fail
update-source-version yandex-music "$version" --ignore-same-hash
# set yandex-music dir
dir="pkgs/by-name/ya/yandex-music"
echo -e '{
"branch": "'"$branch"'",
"commit_hash": "'"$commit_hash"'",
"commit_message": "'"$commit_message"'",
"date": "'"$date"'",
"tag": "'"$tag"'"
}' >"$dir/info.json" || echo "Please run the script in the root of the Nixpkgs repo"
curl --silent "$RAW/$commit_hash/utility/version_info.json" |\
jq . > "$dir/ym_info.json" ||\
echo "Please run the script in the root of the Nixpkgs repo"
pkgs/by-name/ya/yandex-music/ym_info.json
+14
View File
@@ -0,0 +1,14 @@
{
"ym": {
"version": "5.13.2",
"exe_name": "Yandex_Music_x64_5.13.2.exe",
"exe_link": "https://music-desktop-application.s3.yandex.net/stable/Yandex_Music_x64_5.13.2.exe",
"exe_sha256": "ac7a489a59e074358559f544a26143ca81a6bdfa41481242f3419b76eaffdb0b"
},
"electron": {
"version": "29.4.6",
"x64": "https://github.com/electron/electron/releases/download/v29.4.6/electron-v29.4.6-linux-x64.zip",
"armv7l": "https://github.com/electron/electron/releases/download/v29.4.6/electron-v29.4.6-linux-armv7l.zip",
"arm64": "https://github.com/electron/electron/releases/download/v29.4.6/electron-v29.4.6-linux-arm64.zip"
}
}
pkgs/by-name/ze/zed-editor/Cargo.lock
Generated
+1 -1
View File
@@ -13839,7 +13839,7 @@ dependencies = [
[[package]]
name = "zed"
version = "0.149.5"
version = "0.149.6"
dependencies = [
"activity_indicator",
"anyhow",
pkgs/by-name/ze/zed-editor/package.nix
+2 -2
View File
@@ -35,13 +35,13 @@ assert withGLES -> stdenv.isLinux;
rustPlatform.buildRustPackage rec {
pname = "zed";
version = "0.149.5";
version = "0.149.6";
src = fetchFromGitHub {
owner = "zed-industries";
repo = "zed";
rev = "refs/tags/v${version}";
hash = "sha256-RQGYcJJf65arew9iwtPh/jFYMbXiY9Wg7xEjAsUSvEA=";
hash = "sha256-YWXK5heCCw6eXhc1Fh7eIC0tzszC86FP3ovzkCYkdtc=";
fetchSubmodules = true;
};
pkgs/desktops/lomiri/development/libusermetrics/default.nix
+44 -45
View File
@@ -1,37 +1,40 @@
{ stdenv
, lib
, fetchFromGitLab
, gitUpdater
, testers
, cmake
, cmake-extras
, dbus
, doxygen
, gsettings-qt
, gtest
, intltool
, json-glib
, libapparmor
, libqtdbustest
, pkg-config
, qdjango
, qtbase
, qtdeclarative
, qtxmlpatterns
, ubports-click
, validatePkgConfig
, wrapQtAppsHook
{
stdenv,
lib,
fetchFromGitLab,
fetchpatch,
gitUpdater,
testers,
cmake,
cmake-extras,
dbus,
doxygen,
glibcLocales,
gsettings-qt,
gtest,
intltool,
json-glib,
libapparmor,
libqtdbustest,
pkg-config,
qdjango,
qtbase,
qtdeclarative,
qtxmlpatterns,
ubports-click,
validatePkgConfig,
wrapQtAppsHook,
}:
stdenv.mkDerivation (finalAttrs: {
pname = "libusermetrics";
version = "1.3.2";
version = "1.3.3";
src = fetchFromGitLab {
owner = "ubports";
repo = "development/core/libusermetrics";
rev = finalAttrs.version;
hash = "sha256-jmJH5vByBnBqgQfyb7HNVe+eS/jHcU64R2dnvuLbqss=";
hash = "sha256-V4vxNyHMs2YYBILkpco79FN9xnooULgB+z2Kf3V0790=";
};
outputs = [
@@ -41,21 +44,21 @@ stdenv.mkDerivation (finalAttrs: {
];
patches = [
# Not submitted yet, waiting for decision on how CMake testing should be handled
./2001-Remove-custom-check-target.patch
# Due to https://gitlab.com/ubports/development/core/libusermetrics/-/issues/8, we require knowledge about AppArmor availability at launch time
# Custom patch to launch a module-defined service that can handle this
./2002-Launch-module-created-systemd-service.patch
# Remove when https://gitlab.com/ubports/development/core/libusermetrics/-/merge_requests/17 merged & in release
(fetchpatch {
name = "0001-libusermetrics-BUILD_TESTING.patch";
url = "https://gitlab.com/ubports/development/core/libusermetrics/-/commit/c1e4847601cc4522034a766755ce491d48132d77.patch";
hash = "sha256-UWc9/ngpuiSm0Rd6eBK/R3N/NwDRtMxie78seN3+y/8=";
})
];
postPatch = ''
# Tries to query QMake for QT_INSTALL_QML variable, would return broken paths into /build/qtbase-<commit> even if qmake was available
substituteInPlace src/modules/UserMetrics/CMakeLists.txt \
--replace 'query_qmake(QT_INSTALL_QML QT_IMPORTS_DIR)' 'set(QT_IMPORTS_DIR "''${CMAKE_INSTALL_PREFIX}/${qtbase.qtQmlPrefix}")'
--replace-fail 'query_qmake(QT_INSTALL_QML QT_IMPORTS_DIR)' 'set(QT_IMPORTS_DIR "''${CMAKE_INSTALL_PREFIX}/${qtbase.qtQmlPrefix}")'
substituteInPlace doc/CMakeLists.txt \
--replace "\''${CMAKE_INSTALL_DATAROOTDIR}/doc/libusermetrics-doc" "\''${CMAKE_INSTALL_DOCDIR}"
--replace-fail "\''${CMAKE_INSTALL_FULL_DATAROOTDIR}/doc/libusermetrics-doc" "\''${CMAKE_INSTALL_DOCDIR}"
'';
strictDeps = true;
@@ -82,8 +85,12 @@ stdenv.mkDerivation (finalAttrs: {
qtbase
];
# Tests need to be able to check locale
LC_ALL = lib.optionalString finalAttrs.finalPackage.doCheck "en_US.UTF-8";
nativeCheckInputs = [
dbus
glibcLocales
];
checkInputs = [
@@ -96,14 +103,6 @@ stdenv.mkDerivation (finalAttrs: {
(lib.cmakeBool "GSETTINGS_LOCALINSTALL" true)
(lib.cmakeBool "GSETTINGS_COMPILE" true)
(lib.cmakeBool "ENABLE_CLICK" true)
(lib.cmakeBool "ENABLE_TESTS" finalAttrs.finalPackage.doCheck)
(lib.cmakeFeature "CMAKE_CTEST_ARGUMENTS" (lib.concatStringsSep ";" [
# Exclude tests
"-E" (lib.strings.escapeShellArg "(${lib.concatStringsSep "|" [
# Flaky, randomly failing in UserMetricsImplTest.AddTranslatedData (data not ready when signal is emitted?)
"^usermetricsoutput-unit-tests"
]})")
]))
];
doCheck = stdenv.buildPlatform.canExecute stdenv.hostPlatform;
@@ -118,13 +117,13 @@ stdenv.mkDerivation (finalAttrs: {
updateScript = gitUpdater { };
};
meta = with lib; {
meta = {
description = "Enables apps to locally store interesting numerical data for later presentation";
homepage = "https://gitlab.com/ubports/development/core/libusermetrics";
changelog = "https://gitlab.com/ubports/development/core/libusermetrics/-/blob/${finalAttrs.version}/ChangeLog";
license = licenses.lgpl3Only;
maintainers = teams.lomiri.members;
platforms = platforms.linux;
license = lib.licenses.lgpl3Only;
maintainers = lib.teams.lomiri.members;
platforms = lib.platforms.linux;
mainProgram = "usermetricsinput";
pkgConfigModules = [
"libusermetricsinput-1"
pkgs/development/coq-modules/waterproof/default.nix
+24
View File
@@ -0,0 +1,24 @@
{ lib, mkCoqDerivation, coq, version ? null }:
mkCoqDerivation {
pname = "waterproof";
owner = "impermeable";
repo = "coq-waterproof";
inherit version;
defaultVersion = let inherit (lib.versions) range; in
lib.switch coq.coq-version [
{ case = range "8.18" "8.18"; out = "2.1.1+8.18"; }
] null;
release = {
"2.1.1+8.18".sha256 = "sha256-jYuQ9SPFRefNCUfn6+jEaJ4399EnU0gXPPkEDCpJYOI=";
};
mlPlugin = true;
useDune = true;
meta = {
description = "Coq proofs in a style that resembles non-mechanized mathematical proofs";
license = lib.licenses.lgpl3Plus;
};
}
pkgs/development/embedded/avrdude/default.nix
+5 -10
View File
@@ -1,4 +1,4 @@
{ lib, callPackage, stdenv, fetchFromGitHub, cmake, bison, flex, libusb1, elfutils
{ lib, callPackage, stdenv, fetchFromGitHub, cmake, bison, flex, pkg-config, libusb1, elfutils
, libftdi1, readline, hidapi, libserialport, libusb-compat-0_1
# Documentation building doesn't work on Darwin. It fails with:
# Undefined subroutine &Locale::Messages::dgettext called in ... texi2html
@@ -12,16 +12,16 @@ in
stdenv.mkDerivation (finalAttrs: {
pname = "avrdude";
version = "7.3";
version = "8.0";
src = fetchFromGitHub {
owner = "avrdudes";
repo = "avdude";
repo = "avrdude";
rev = "v${finalAttrs.version}";
sha256 = "sha256-JqW3AOMmAfcy+PQRcqviWlxA6GoMSEfzIFt1pRYY7Dw=";
sha256 = "w58HVCvKuWpGJwllupbj7ndeq4iE9LPs/IjFSUN0DOU=";
};
nativeBuildInputs = [ cmake bison flex ] ++ lib.optionals docSupport [
nativeBuildInputs = [ cmake bison flex pkg-config ] ++ lib.optionals docSupport [
unixtools.more
texliveMedium
texinfo
@@ -48,11 +48,6 @@ stdenv.mkDerivation (finalAttrs: {
cmakeFlags = lib.optionals docSupport [ "-DBUILD_DOC=ON" ]
++ lib.optionals stdenv.hostPlatform.isLinux [ "-DHAVE_LINUXSPI=ON" "-DHAVE_PARPORT=ON" ];
# dvips output references texlive in comments, resulting in a huge closure
postInstall = lib.optionalString docSupport ''
rm $out/share/doc/avrdude/*.ps
'';
passthru = {
# Vendored and mutated copy of libelf for avrdudes use.
# Produces a static library only.
pkgs/development/libraries/rapidyaml/default.nix
+2 -2
View File
@@ -7,14 +7,14 @@
stdenv.mkDerivation rec {
pname = "rapidyaml";
version = "0.7.1";
version = "0.7.2";
src = fetchFromGitHub {
owner = "biojppm";
repo = pname;
fetchSubmodules = true;
rev = "v${version}";
hash = "sha256-NUPx/1DkhSeCTt3Y5WpsN3wX7pMNOeku7eHdmFv/OWw=";
hash = "sha256-vAYafhWo9xavM2j+mT3OGcX7ZSS25mieR/3b79BO+jA=";
};
nativeBuildInputs = [ cmake git ];
pkgs/development/python-modules/aioesphomeapi/default.nix
+2 -2
View File
@@ -26,7 +26,7 @@
buildPythonPackage rec {
pname = "aioesphomeapi";
version = "25.1.0";
version = "25.2.1";
pyproject = true;
disabled = pythonOlder "3.9";
@@ -35,7 +35,7 @@ buildPythonPackage rec {
owner = "esphome";
repo = "aioesphomeapi";
rev = "refs/tags/v${version}";
hash = "sha256-YRUX7WHiizAIHjGkCZwefqqMXykokXgwrHZ3OwLIVCs=";
hash = "sha256-pQ8RR8e9NVQNBKaQMI60WYANI0rSK5L/H+5e2Tu7zUU=";
};
build-system = [
pkgs/development/python-modules/libknot/default.nix
+2 -2
View File
@@ -12,12 +12,12 @@
buildPythonPackage rec {
pname = "libknot";
version = "3.3.8";
version = "3.3.9";
pyproject = true;
src = fetchPypi {
inherit pname version;
hash = "sha256-RG2NOFQC6rxeutawn3ArZy9uNLn+gPmEqrv1E0YYJx4=";
hash = "sha256-AAjH5+IQdkzTIp1+q638d9dzAfo7nXUudOLQm81P7lU=";
};
postPatch = ''
pkgs/development/python-modules/pytouchlinesl/default.nix
+2 -2
View File
@@ -12,7 +12,7 @@
buildPythonPackage rec {
pname = "pytouchlinesl";
version = "0.1.3";
version = "0.1.5";
pyproject = true;
disabled = pythonOlder "3.10";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
owner = "jnsgruk";
repo = "pytouchlinesl";
rev = "refs/tags/${version}";
hash = "sha256-TLKZ3mPNS7jRpbx3nllLlv5jPVQDLcTs44oJr6rNGeQ=";
hash = "sha256-kdLMuxA1Ig85mH7s9rlmVjEsItXxRlDA1JTFasnJogg=";
};
build-system = [ setuptools ];
pkgs/development/python-modules/tesserocr/default.nix
+2 -2
View File
@@ -21,12 +21,12 @@
buildPythonPackage rec {
pname = "tesserocr";
version = "2.7.0";
version = "2.7.1";
format = "setuptools";
src = fetchPypi {
inherit pname version;
hash = "sha256-RcCTYwM30Bpqj5d6JGrW1zLrEfLgcrsibVmtPSR4HJk=";
hash = "sha256-N0TFyLur8YFyhJx3Mb4A3C5eRPjFVtN8hQ54h5SuCvQ=";
};
# https://github.com/sirfz/tesserocr/issues/314
pkgs/development/tools/continuous-integration/cirrus-cli/default.nix
+2 -2
View File
@@ -6,13 +6,13 @@
buildGoModule rec {
pname = "cirrus-cli";
version = "0.122.2";
version = "0.122.4";
src = fetchFromGitHub {
owner = "cirruslabs";
repo = pname;
rev = "v${version}";
hash = "sha256-+P4FpGH09hgY+PCrFNKAZgh9/hO8C0aFAnv545bA0gw=";
hash = "sha256-YpdzwGThmc9r4I+Rx8nxTZToi+J3UbqwZD+F2hYEG8M=";
};
vendorHash = "sha256-WAYjYIHsBkQiTUmMDRXnx3Q1UAFVfXmZDFxzw7Kh0ds=";
pkgs/development/tools/firebase-tools/default.nix
+3 -3
View File
@@ -8,16 +8,16 @@
buildNpmPackage rec {
pname = "firebase-tools";
version = "13.15.2";
version = "13.15.4";
src = fetchFromGitHub {
owner = "firebase";
repo = "firebase-tools";
rev = "v${version}";
hash = "sha256-8W602Rs5kPAYhhwhUaSmA7oV0DROA0Ut2+QHBubNqJM=";
hash = "sha256-sVLzEswyewffGoHhc/eJvOoHzMbMmoq1M23noJmvWxE=";
};
npmDepsHash = "sha256-HWTCpBfMvpa9pUOaYOSDCc/JdZzBhZfEO/ejSNxwnXA=";
npmDepsHash = "sha256-hBXcA/rmbictMuBihu1kDgkriunwC+gP/lWEhaPklLM=";
postPatch = ''
ln -s npm-shrinkwrap.json package-lock.json
pkgs/development/tools/language-servers/helm-ls/default.nix
+2 -2
View File
@@ -8,13 +8,13 @@
buildGoModule rec {
pname = "helm-ls";
version = "0.0.21";
version = "0.0.22";
src = fetchFromGitHub {
owner = "mrjosh";
repo = "helm-ls";
rev = "v${version}";
hash = "sha256-O30gdcQdNjKADraPCltTjNglztz37CVx+fUeoVI3/O8=";
hash = "sha256-h3ppVj+Y1jtvsZLWzZxmFmmxr0My9Nd4zQBqeDSX0ZI=";
};
vendorHash = "sha256-AWKCE2BZGVYcr6Pe8URQo11Xnr3sfgWWkm9v7vvILOo=";
pkgs/development/tools/misc/circleci-cli/default.nix
+2 -2
View File
@@ -2,13 +2,13 @@
buildGoModule rec {
pname = "circleci-cli";
version = "0.1.30888";
version = "0.1.30995";
src = fetchFromGitHub {
owner = "CircleCI-Public";
repo = pname;
rev = "v${version}";
sha256 = "sha256-ZnU48pj1xv2GuiDW/lsKzOcdLbwKyVupV0PBw7CJvm0=";
sha256 = "sha256-DSgpyQ9luC7RSFq/TbJplQzEKJEDdGIPHsFX3LuzqaQ=";
};
vendorHash = "sha256-60edYYhbSPiJWmuQXXEt+xCnSxsHf8Q38RgyWwdP6vQ=";
pkgs/servers/invidious/default.nix
+2 -3
View File
@@ -1,7 +1,7 @@
{ lib
, callPackage
, crystal
, fetchFromGitea
, fetchFromGitHub
, librsvg
, pkg-config
, libxml2
@@ -29,8 +29,7 @@ crystal.buildCrystalPackage rec {
pname = "invidious";
inherit (versions.invidious) version;
src = fetchFromGitea {
domain = "gitea.invidious.io";
src = fetchFromGitHub {
owner = "iv-org";
repo = "invidious";
fetchSubmodules = true;
pkgs/servers/invidious/shards.nix
+2 -2
View File
@@ -1,8 +1,8 @@
{
ameba = {
url = "https://github.com/crystal-ameba/ameba.git";
rev = "v1.5.0";
sha256 = "1idivsbpmi40aqvs82fsv37nrgikirprxrj3ls9chsb876fq9p2d";
rev = "v1.6.1";
sha256 = "1qlgqpgycfxvvrfzih7b9ayb6fvkffz5aw0msbj70z2q7wvsq29p";
};
athena-negotiation = {
url = "https://github.com/athena-framework/negotiation.git";
pkgs/servers/invidious/update.sh
+3 -2
View File
@@ -36,7 +36,7 @@ if [ ! -d "$git_dir" ]; then
fi
git -C "$git_dir" fetch origin --tags "$git_branch"
new_tag="$(git -C "$git_dir" ls-remote --tags --sort=committerdate origin | head -n1 | grep -Po '(?<=refs/tags/).*')"
new_tag="$(git -C "$git_dir" ls-remote --tags --sort=-committerdate origin | tail -n1 | grep -Po '(?<=refs/tags/).*')"
new_version="${new_tag#v}"
if [ "$new_version" = "$old_version" ]; then
@@ -44,8 +44,9 @@ if [ "$new_version" = "$old_version" ]; then
exit
fi
info "updating to $new_tag"
commit="$(git -C "$git_dir" rev-list "$new_tag" --max-count=1 --abbrev-commit)"
date="$(git -C "$git_dir" log -1 --format=%cd --date=format:%Y.%m.%d)"
date="$(git -C "$git_dir" log -1 --format=%cd --date=format:%Y.%m.%d "$commit")"
json_set '.invidious.date' "$date"
json_set '.invidious.commit' "$commit"
json_set '.invidious.version' "$new_version"
pkgs/servers/invidious/versions.json
+4 -4
View File
@@ -1,9 +1,9 @@
{
"invidious": {
"hash": "sha256-YZ+uhn1ESuRTZxAMoxKCpxEaUfeCUqOrSr3LkdbrTkU=",
"version": "2.20240427",
"date": "2024.04.27",
"commit": "eda7444c"
"hash": "sha256-oNkEFATRVgPC8Bhp0v04an3LvqgsSEjLZdeblb7n8TI=",
"version": "2.20240825.2",
"date": "2024.08.26",
"commit": "4782a670"
},
"videojs": {
"hash": "sha256-jED3zsDkPN8i6GhBBJwnsHujbuwlHdsVpVqa1/pzSH4="
pkgs/servers/monitoring/prometheus/knot-exporter.nix
+2 -2
View File
@@ -6,13 +6,13 @@
python3.pkgs.buildPythonApplication rec {
pname = "knot-exporter";
version = "3.3.8";
version = "3.3.9";
pyproject = true;
src = fetchPypi {
pname = "knot_exporter";
inherit version;
hash = "sha256-c6J2c9UpuLOW9rUif+k76PUb7Mh2WIH5Nn3alKaVNyw=";
hash = "sha256-8OeMWEXnAaLYpZD/bKAm8vtf0mkGCavmJOV4ThWGDDo=";
};
nativeBuildInputs = [
pkgs/tools/admin/chamber/default.nix
+3 -3
View File
@@ -2,18 +2,18 @@
buildGoModule rec {
pname = "chamber";
version = "3.0.1";
version = "3.1.0";
src = fetchFromGitHub {
owner = "segmentio";
repo = pname;
rev = "v${version}";
sha256 = "sha256-zjVch0NzCmimydk7/Uz4FZhcgQD+9xV6H6sAtPnFhDE=";
sha256 = "sha256-BD4gtdlIh5IRgTtrCdEN+o5d00wZsczsH0JbdoFdg4o=";
};
CGO_ENABLED = 0;
vendorHash = "sha256-1glSjsuHN7urlktxJ/vR/jfDgbVBWsui0bZWMhmJ50c=";
vendorHash = "sha256-Rk6doJqLD8ucU+mGDtteCyM/QvnzbIVnFmFW9b09560=";
ldflags = [ "-s" "-w" "-X main.Version=v${version}" ];
pkgs/tools/networking/picosnitch/default.nix
+3
View File
@@ -39,5 +39,8 @@ python3.pkgs.buildPythonApplication rec {
license = licenses.gpl3Plus;
maintainers = [ maintainers.elesiuta ];
platforms = platforms.linux;
knownVulnerabilities = [
"Allows an unprivileged user to write to arbitrary files as root; see https://github.com/elesiuta/picosnitch/issues/40"
];
};
}
pkgs/tools/networking/rathole/default.nix
-48
View File
@@ -1,48 +0,0 @@
{ lib
, stdenv
, fetchFromGitHub
, rustPlatform
, pkg-config
, openssl
, nixosTests
, CoreServices
}:
rustPlatform.buildRustPackage rec {
pname = "rathole";
version = "0.5.0";
src = fetchFromGitHub {
owner = "rapiz1";
repo = pname;
rev = "refs/tags/v${version}";
hash = "sha256-YfLzR1lHk+0N3YU1XTNxz+KE1S3xaiKJk0zASm6cr1s=";
};
cargoHash = "sha256-UyQXAUPnp32THZJAs/p3bIXZjcXTvjy207QBVLCfkr8=";
nativeBuildInputs = [
pkg-config
];
buildInputs = [
openssl
] ++ lib.optionals stdenv.isDarwin [
CoreServices
];
__darwinAllowLocalNetworking = true;
doCheck = false; # https://github.com/rapiz1/rathole/issues/222
passthru.tests = { inherit (nixosTests) rathole; };
meta = with lib; {
description = "Reverse proxy for NAT traversal";
homepage = "https://github.com/rapiz1/rathole";
changelog = "https://github.com/rapiz1/rathole/releases/tag/v${version}";
license = licenses.asl20;
maintainers = with maintainers; [ dit7ya ];
mainProgram = "rathole";
};
}
pkgs/tools/virtualization/govc/default.nix
+2 -2
View File
@@ -2,7 +2,7 @@
buildGoModule rec {
pname = "govc";
version = "0.40.0";
version = "0.42.0";
subPackages = [ "govc" ];
@@ -10,7 +10,7 @@ buildGoModule rec {
rev = "v${version}";
owner = "vmware";
repo = "govmomi";
sha256 = "sha256-Lyuz1m6JUbh2+pdWCQLoiOz72ZCigZIjUu+y0GYTPlM=";
sha256 = "sha256-Sr3cJHnNeEPpYcAl+DmVL6lG0FKFhNHOVejRWBE3yUM=";
};
vendorHash = "sha256-W4Q4jCbW5lruXEhgKg7ZiPCHGxuYwYqi8Qm2JMyJaFE=";
pkgs/top-level/all-packages.nix
-10
View File
@@ -10658,8 +10658,6 @@ with pkgs;
nb = callPackage ../tools/misc/nb { };
nbqa = callPackage ../tools/misc/nbqa { };
kb = callPackage ../tools/misc/kb { };
notable = callPackage ../applications/misc/notable { };
@@ -13685,8 +13683,6 @@ with pkgs;
pythonPackages = python3Packages;
};
video-trimmer = callPackage ../applications/video/video-trimmer { };
via = callPackage ../tools/misc/via { };
vial = callPackage ../tools/misc/vial { };
@@ -18721,10 +18717,6 @@ with pkgs;
ran = callPackage ../servers/http/ran { };
rathole = callPackage ../tools/networking/rathole {
inherit (darwin.apple_sdk.frameworks) CoreServices;
};
retry = callPackage ../tools/system/retry { };
rizin = pkgs.callPackage ../development/tools/analysis/rizin { };
@@ -33335,8 +33327,6 @@ with pkgs;
tart = callPackage ../applications/virtualization/tart { };
viber = callPackage ../applications/networking/instant-messengers/viber { };
wavebox = callPackage ../applications/networking/instant-messengers/wavebox { };
sonic-pi = libsForQt5.callPackage ../applications/audio/sonic-pi { };
pkgs/top-level/coq-packages.nix
+1
View File
@@ -159,6 +159,7 @@ let
paco = self.paco.override { version = "4.1.2"; };
};
}));
waterproof = callPackage ../development/coq-modules/waterproof {};
zorns-lemma = callPackage ../development/coq-modules/zorns-lemma {};
filterPackages = doesFilter: if doesFilter then filterCoqPackages self else self;
};