From be2175dc949a34334f1ad9a81d95279ead470bb1 Mon Sep 17 00:00:00 2001 From: Dan Callaghan Date: Tue, 19 Jul 2022 22:31:11 +1000 Subject: [PATCH 1/5] openldap: load client config from /etc, not the nix store We want Openldap clients to load /etc/ldap.conf at runtime, not ${pkgs.openldap}/etc/ldap.conf which is always a sample config. Pass sysconfdir=/etc at compile time, so that /etc/krb5.conf is embedded in the library as the path of its config file. Pass sysconfdir=${out}/etc at install time, so that the sample configs and schema files are correctly included in the build output. This hack works because the Makefiles are not smart enough to notice that the sysconfdir variable has changed across invocations -- because nobody ever writes their Makefiles to be that smart. :-) Fixes #181937. --- nixos/tests/openldap.nix | 12 +++++++++++- pkgs/development/libraries/openldap/default.nix | 3 ++- 2 files changed, 13 insertions(+), 2 deletions(-) diff --git a/nixos/tests/openldap.nix b/nixos/tests/openldap.nix index 3c388119d5d2..96459d21a5ef 100644 --- a/nixos/tests/openldap.nix +++ b/nixos/tests/openldap.nix @@ -13,10 +13,17 @@ let objectClass: organizationalUnit ou: users ''; + ldapClientConfig = { + enable = true; + loginPam = false; + nsswitch = false; + server = "ldap://"; + base = "dc=example"; + }; testScript = '' machine.wait_for_unit("openldap.service") machine.succeed( - 'ldapsearch -LLL -D "cn=root,dc=example" -w notapassword -b "dc=example"', + 'ldapsearch -LLL -D "cn=root,dc=example" -w notapassword', ) ''; in { @@ -57,6 +64,7 @@ in { }; declarativeContents."dc=example" = dbContents; }; + users.ldap = ldapClientConfig; }; }) { inherit pkgs system; }; @@ -76,6 +84,7 @@ in { rootpw = "notapassword"; declarativeContents."dc=example" = dbContents; }; + users.ldap = ldapClientConfig; }; }) { inherit system pkgs; }; @@ -88,6 +97,7 @@ in { enable = true; configDir = "/var/db/slapd.d"; }; + users.ldap = ldapClientConfig; }; testScript = let diff --git a/pkgs/development/libraries/openldap/default.nix b/pkgs/development/libraries/openldap/default.nix index 551a0827eee2..e6f2c218a5bf 100644 --- a/pkgs/development/libraries/openldap/default.nix +++ b/pkgs/development/libraries/openldap/default.nix @@ -97,7 +97,7 @@ stdenv.mkDerivation rec { "CC=${stdenv.cc.targetPrefix}cc" "STRIP=" # Disable install stripping as it breaks cross-compiling. We strip binaries anyway in fixupPhase. "prefix=${placeholder "out"}" - "sysconfdir=${placeholder "out"}/etc" + "sysconfdir=/etc" "systemdsystemunitdir=${placeholder "out"}/lib/systemd/system" # contrib modules require these "moduledir=${placeholder "out"}/lib/modules" @@ -134,6 +134,7 @@ stdenv.mkDerivation rec { installFlags = [ "prefix=${placeholder "out"}" + "sysconfdir=${placeholder "out"}/etc" "moduledir=${placeholder "out"}/lib/modules" "INSTALL=install" ]; From 4bf0af2efdba7a8d9e524a86af99d1a457ffe09e Mon Sep 17 00:00:00 2001 From: kilianar Date: Thu, 21 Jul 2022 06:36:18 +0200 Subject: [PATCH 2/5] minio: 2022-05-08T23-50-31Z -> 2022-07-17T15-43-14Z https://github.com/minio/minio/releases/tag/RELEASE.2022-07-17T15-43-14Z fixes CVE-2022-31028 --- pkgs/servers/minio/default.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/servers/minio/default.nix b/pkgs/servers/minio/default.nix index 3349f0cf3a02..b4f876b30578 100644 --- a/pkgs/servers/minio/default.nix +++ b/pkgs/servers/minio/default.nix @@ -15,16 +15,16 @@ let in buildGoModule rec { pname = "minio"; - version = "2022-05-08T23-50-31Z"; + version = "2022-07-17T15-43-14Z"; src = fetchFromGitHub { owner = "minio"; repo = "minio"; rev = "RELEASE.${version}"; - sha256 = "sha256-Ssuqk/ax6MWdXtbJqWeTTtsIiTK4FmYSR5rOqxh+IaU="; + sha256 = "sha256-hQ52fL4Z3RHthHaJXCkKpbebWpq8MxHo4BziokTuJA4="; }; - vendorSha256 = "sha256-JoI3B3rDzlY0lDHF3rjrzv8/Rq+XCFRs35bWVZqfAKA="; + vendorSha256 = "sha256-u36oHqIxMD3HRio9A3tUt6FO1DtAcQDiC/O54ByeNyg="; doCheck = false; From 20ada9a6c75ab9a904a0629d3900d43af06722f5 Mon Sep 17 00:00:00 2001 From: ajs124 Date: Thu, 21 Jul 2022 16:03:03 +0200 Subject: [PATCH 3/5] nss_latest: 3.80 -> 3.81 https://github.com/nss-dev/nss/blob/master/doc/rst/releases/nss_3_81.rst --- pkgs/development/libraries/nss/latest.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/libraries/nss/latest.nix b/pkgs/development/libraries/nss/latest.nix index 40f88afed29f..4a793bd7cecc 100644 --- a/pkgs/development/libraries/nss/latest.nix +++ b/pkgs/development/libraries/nss/latest.nix @@ -5,6 +5,6 @@ # Example: nix-shell ./maintainers/scripts/update.nix --argstr package cacert import ./generic.nix { - version = "3.80"; - hash = "sha256-wL8f0sfimmsCswliK6r8RD7skMiTS7FV2ku5iYh4S2o="; + version = "3.81"; + hash = "sha256-qL9fO7YXBo1X57FfPZ1SjxCa8NV98uqrBRm2Qj7czKY="; } From fa8de76521f2de93b6b4bf6e79b0c4a3d90e6d60 Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Fri, 22 Jul 2022 00:29:21 +0200 Subject: [PATCH 4/5] Revert "openldap: load client config from /etc, not the nix store" --- nixos/tests/openldap.nix | 12 +----------- pkgs/development/libraries/openldap/default.nix | 3 +-- 2 files changed, 2 insertions(+), 13 deletions(-) diff --git a/nixos/tests/openldap.nix b/nixos/tests/openldap.nix index 96459d21a5ef..3c388119d5d2 100644 --- a/nixos/tests/openldap.nix +++ b/nixos/tests/openldap.nix @@ -13,17 +13,10 @@ let objectClass: organizationalUnit ou: users ''; - ldapClientConfig = { - enable = true; - loginPam = false; - nsswitch = false; - server = "ldap://"; - base = "dc=example"; - }; testScript = '' machine.wait_for_unit("openldap.service") machine.succeed( - 'ldapsearch -LLL -D "cn=root,dc=example" -w notapassword', + 'ldapsearch -LLL -D "cn=root,dc=example" -w notapassword -b "dc=example"', ) ''; in { @@ -64,7 +57,6 @@ in { }; declarativeContents."dc=example" = dbContents; }; - users.ldap = ldapClientConfig; }; }) { inherit pkgs system; }; @@ -84,7 +76,6 @@ in { rootpw = "notapassword"; declarativeContents."dc=example" = dbContents; }; - users.ldap = ldapClientConfig; }; }) { inherit system pkgs; }; @@ -97,7 +88,6 @@ in { enable = true; configDir = "/var/db/slapd.d"; }; - users.ldap = ldapClientConfig; }; testScript = let diff --git a/pkgs/development/libraries/openldap/default.nix b/pkgs/development/libraries/openldap/default.nix index e6f2c218a5bf..551a0827eee2 100644 --- a/pkgs/development/libraries/openldap/default.nix +++ b/pkgs/development/libraries/openldap/default.nix @@ -97,7 +97,7 @@ stdenv.mkDerivation rec { "CC=${stdenv.cc.targetPrefix}cc" "STRIP=" # Disable install stripping as it breaks cross-compiling. We strip binaries anyway in fixupPhase. "prefix=${placeholder "out"}" - "sysconfdir=/etc" + "sysconfdir=${placeholder "out"}/etc" "systemdsystemunitdir=${placeholder "out"}/lib/systemd/system" # contrib modules require these "moduledir=${placeholder "out"}/lib/modules" @@ -134,7 +134,6 @@ stdenv.mkDerivation rec { installFlags = [ "prefix=${placeholder "out"}" - "sysconfdir=${placeholder "out"}/etc" "moduledir=${placeholder "out"}/lib/modules" "INSTALL=install" ]; From d99563cd78b5dee34bbe42f25817bfa974c7bd94 Mon Sep 17 00:00:00 2001 From: Bill Ewanick Date: Thu, 21 Jul 2022 15:58:14 -0400 Subject: [PATCH 5/5] Add oil to packages before invoking shell, this allows the oil shell to actually run --- pkgs/servers/web-apps/lemmy/update.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/servers/web-apps/lemmy/update.sh b/pkgs/servers/web-apps/lemmy/update.sh index ebe46e97a294..2df3f9e88d06 100755 --- a/pkgs/servers/web-apps/lemmy/update.sh +++ b/pkgs/servers/web-apps/lemmy/update.sh @@ -1,5 +1,5 @@ -#!/usr/bin/env nix-shell -#! nix-shell -i oil -p jq sd nix-prefetch-github ripgrep moreutils +#! /usr/bin/env nix-shell +#! nix-shell -i oil -p oil jq sd nix-prefetch-github ripgrep moreutils # TODO set to `verbose` or `extdebug` once implemented in oil shopt --set xtrace