From 8116f9653cc82c62aa5ca98fe2b232c40cf6ca58 Mon Sep 17 00:00:00 2001 From: Maximilian Bosch Date: Thu, 29 Dec 2022 22:26:35 +0100 Subject: [PATCH 1/4] privacyidea: 3.7.4 -> 3.8 ChangeLog: https://github.com/privacyidea/privacyidea/blob/v3.8/Changelog --- .../applications/misc/privacyidea/default.nix | 24 ++++++++----------- 1 file changed, 10 insertions(+), 14 deletions(-) diff --git a/pkgs/applications/misc/privacyidea/default.nix b/pkgs/applications/misc/privacyidea/default.nix index b45854a6d180..ce8decde217b 100644 --- a/pkgs/applications/misc/privacyidea/default.nix +++ b/pkgs/applications/misc/privacyidea/default.nix @@ -1,5 +1,5 @@ { lib, fetchFromGitHub, cacert, openssl, nixosTests -, python39, fetchpatch +, python39 }: let @@ -84,18 +84,23 @@ let nativeCheckInputs = []; doCheck = false; }); + # Requires pytest-httpserver as checkInput now which requires Werkzeug>=2 which is not + # supported by current privacyIDEA. + responses = super.responses.overridePythonAttrs (lib.const { + doCheck = false; + }); }; }; in python3'.pkgs.buildPythonPackage rec { pname = "privacyIDEA"; - version = "3.7.4"; + version = "3.8"; src = fetchFromGitHub { owner = pname; repo = pname; rev = "v${version}"; - sha256 = "sha256-QoVL6WJjX6+sN5S/iqV3kcfQ5fWTXkTnf6NpZcw3bGo="; + sha256 = "sha256-A3Dk1oX0yf5uoH3z7JkH6Uoi+l/jf1BwUurN1U8UnL0="; fetchSubmodules = true; }; @@ -104,17 +109,7 @@ python3'.pkgs.buildPythonPackage rec { defusedxml croniter flask_migrate pyjwt configobj sqlsoup pillow python-gnupg passlib pyopenssl beautifulsoup4 smpplib flask-babel ldap3 huey pyyaml qrcode oauth2client requests lxml cbor2 psycopg2 - pydash ecdsa google-auth importlib-metadata argon2-cffi bcrypt - ]; - - patches = [ - # Apply https://github.com/privacyidea/privacyidea/pull/3304, fixes - # `Exceeds the limit (4300) for integer string conversion` in the tests, - # see https://hydra.nixos.org/build/192932057 - (fetchpatch { - url = "https://github.com/privacyidea/privacyidea/commit/0e28f36c0b3291a361669f4a3a77c294f4564475.patch"; - sha256 = "sha256-QqcO8bkt+I2JKce/xk2ZhzEaLZ3E4uZ4x5W9Kk0pMQQ="; - }) + pydash ecdsa google-auth importlib-metadata argon2-cffi bcrypt segno ]; passthru.tests = { inherit (nixosTests) privacyidea; }; @@ -128,6 +123,7 @@ python3'.pkgs.buildPythonPackage rec { # Tries to connect to `fcm.googleapis.com`. "test_02_api_push_poll" + "test_04_decline_auth_request" # Timezone info not available in build sandbox "test_14_convert_timestamp_to_utc" From f6c8d04d11fe58b52844a626c87575e0c2e09c34 Mon Sep 17 00:00:00 2001 From: Maximilian Bosch Date: Sun, 5 Feb 2023 15:06:31 +0100 Subject: [PATCH 2/4] nixos/privacyidea: fix db uri Fixes db migration on 3.8. See also https://github.com/privacyidea/privacyidea/issues/3447 --- nixos/modules/services/security/privacyidea.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nixos/modules/services/security/privacyidea.nix b/nixos/modules/services/security/privacyidea.nix index e446e606cad8..8f3af467c237 100644 --- a/nixos/modules/services/security/privacyidea.nix +++ b/nixos/modules/services/security/privacyidea.nix @@ -41,7 +41,7 @@ let piCfgFile = pkgs.writeText "privacyidea.cfg" '' SUPERUSER_REALM = [ '${concatStringsSep "', '" cfg.superuserRealm}' ] - SQLALCHEMY_DATABASE_URI = 'postgresql:///privacyidea' + SQLALCHEMY_DATABASE_URI = 'postgresql+psycopg2:///privacyidea' SECRET_KEY = '${cfg.secretKey}' PI_PEPPER = '${cfg.pepper}' PI_ENCFILE = '${cfg.encFile}' From ffd4bf730f81d0d56e8549a3fb0790148963416b Mon Sep 17 00:00:00 2001 From: Maximilian Bosch Date: Mon, 6 Feb 2023 16:36:40 +0100 Subject: [PATCH 3/4] privacyidea: fix hash Apparently the tag was force-pushed :( According to diffoscope the only thing changed is `.readthedocs.yaml`, so no big deal. --- pkgs/applications/misc/privacyidea/default.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkgs/applications/misc/privacyidea/default.nix b/pkgs/applications/misc/privacyidea/default.nix index ce8decde217b..1fed43d623dd 100644 --- a/pkgs/applications/misc/privacyidea/default.nix +++ b/pkgs/applications/misc/privacyidea/default.nix @@ -100,7 +100,7 @@ python3'.pkgs.buildPythonPackage rec { owner = pname; repo = pname; rev = "v${version}"; - sha256 = "sha256-A3Dk1oX0yf5uoH3z7JkH6Uoi+l/jf1BwUurN1U8UnL0="; + sha256 = "sha256-FCvuWXon8c9LnX1FnCxcSTfBR5/6zijD6ld0iAEVFkU="; fetchSubmodules = true; }; From 918c22bd5f2a754542a115c2d1178adf830abd12 Mon Sep 17 00:00:00 2001 From: Maximilian Bosch Date: Mon, 6 Feb 2023 20:28:26 +0100 Subject: [PATCH 4/4] privacyidea: fix build The previous changes for the 3.8 update are ready, but staging got merged into master, so there are a few more challenges to tackle: * Use python 3.10 now since it's actually supported and less effort to build (3.9 isn't recursed into anymore). * sphinx doesn't build with these overrides, so patch it out entirely (i.e. drop `sphinxHook` where it's causing problems). * backport a few jinja2 fixes for python 3.10 that were fixed in later versions, but break because this env is stuck to 2.11. --- .../modules/services/security/privacyidea.nix | 2 +- .../applications/misc/privacyidea/default.nix | 69 ++++++++++++++++++- 2 files changed, 68 insertions(+), 3 deletions(-) diff --git a/nixos/modules/services/security/privacyidea.nix b/nixos/modules/services/security/privacyidea.nix index 8f3af467c237..664335cb58e8 100644 --- a/nixos/modules/services/security/privacyidea.nix +++ b/nixos/modules/services/security/privacyidea.nix @@ -6,7 +6,7 @@ let cfg = config.services.privacyidea; opt = options.services.privacyidea; - uwsgi = pkgs.uwsgi.override { plugins = [ "python3" ]; python3 = pkgs.python39; }; + uwsgi = pkgs.uwsgi.override { plugins = [ "python3" ]; python3 = pkgs.python310; }; python = uwsgi.python3; penv = python.withPackages (const [ pkgs.privacyidea ]); logCfg = pkgs.writeText "privacyidea-log.cfg" '' diff --git a/pkgs/applications/misc/privacyidea/default.nix b/pkgs/applications/misc/privacyidea/default.nix index 1fed43d623dd..b83fd511b5d8 100644 --- a/pkgs/applications/misc/privacyidea/default.nix +++ b/pkgs/applications/misc/privacyidea/default.nix @@ -1,9 +1,13 @@ { lib, fetchFromGitHub, cacert, openssl, nixosTests -, python39 +, python310, fetchpatch }: let - python3' = python39.override { + dropDevOutput = { outputs, ... }: { + outputs = lib.filter (x: x != "doc") outputs; + }; + + python3' = python310.override { packageOverrides = self: super: { sqlalchemy = super.sqlalchemy.overridePythonAttrs (oldAttrs: rec { version = "1.3.24"; @@ -25,6 +29,15 @@ let sha256 = "ae2f05671588762dd83a21d8b18c51fe355e86783e24594995ff8d7380dffe38"; }; }); + flask-sqlalchemy = super.flask-sqlalchemy.overridePythonAttrs (old: rec { + version = "2.5.1"; + format = "setuptools"; + src = self.fetchPypi { + pname = "Flask-SQLAlchemy"; + inherit version; + hash = "sha256:2bda44b43e7cacb15d4e05ff3cc1f8bc97936cc464623424102bfc2c35e95912"; + }; + }); # Taken from by https://github.com/NixOS/nixpkgs/pull/173090/commits/d2c0c7eb4cc91beb0a1adbaf13abc0a526a21708 werkzeug = super.werkzeug.overridePythonAttrs (old: rec { version = "1.0.1"; @@ -44,6 +57,19 @@ let inherit version; sha256 = "sha256-ptWEM94K6AA0fKsfowQ867q+i6qdKeZo8cdoy4ejM8Y="; }; + patches = [ + # python 3.10 compat fixes. In later upstream releases, but these + # are not compatible with flask 1 which we need here :( + (fetchpatch { + url = "https://github.com/thmo/jinja/commit/1efb4cc918b4f3d097c376596da101de9f76585a.patch"; + sha256 = "sha256-GFaSvYxgzOEFmnnDIfcf0ImScNTh1lR4lxt2Uz1DYdU="; + }) + (fetchpatch { + url = "https://github.com/mkrizek/jinja/commit/bd8bad37d1c0e2d8995a44fd88e234f5340afec5.patch"; + sha256 = "sha256-Uow+gaO+/dH6zavC0X/SsuMAfhTLRWpamVlL87DXDRA="; + excludes = [ "CHANGES.rst" ]; + }) + ]; }); # Required by jinja2-2.11.3 markupsafe = super.markupsafe.overridePythonAttrs (old: rec { @@ -89,6 +115,45 @@ let responses = super.responses.overridePythonAttrs (lib.const { doCheck = false; }); + flask-babel = (super.flask-babel.override { + sphinxHook = null; + furo = null; + }).overridePythonAttrs (old: (dropDevOutput old) // rec { + pname = "Flask-Babel"; + version = "2.0.0"; + format = "setuptools"; + src = self.fetchPypi { + inherit pname; + inherit version; + hash = "sha256:f9faf45cdb2e1a32ea2ec14403587d4295108f35017a7821a2b1acb8cfd9257d"; + }; + }); + psycopg2 = (super.psycopg2.override { + sphinxHook = null; + sphinx-better-theme = null; + }).overridePythonAttrs dropDevOutput; + hypothesis = super.hypothesis.override { + enableDocumentation = false; + }; + pyjwt = (super.pyjwt.override { + sphinxHook = null; + sphinx-rtd-theme = null; + }).overridePythonAttrs (old: (dropDevOutput old) // { format = "setuptools"; }); + beautifulsoup4 = (super.beautifulsoup4.override { + sphinxHook = null; + }).overridePythonAttrs dropDevOutput; + pydash = (super.pydash.override { + sphinx-rtd-theme = null; + }).overridePythonAttrs (old: rec { + version = "5.1.0"; + src = self.fetchPypi { + inherit (old) pname; + inherit version; + hash = "sha256-GysFCsG64EnNB/WSCxT6u+UmOPSF2a2h6xFanuv/aDU="; + }; + format = "setuptools"; + doCheck = false; + }); }; }; in