diff --git a/maintainers/team-list.nix b/maintainers/team-list.nix index 33c7131798c3..8e1dac52dfd2 100644 --- a/maintainers/team-list.nix +++ b/maintainers/team-list.nix @@ -593,10 +593,7 @@ with lib.maintainers; }; infisical = { - members = [ - akhilmhdh - mahyarmirrashed - ]; + members = [ akhilmhdh ]; scope = "Maintain Infisical"; shortName = "Infisical"; }; diff --git a/nixos/doc/manual/release-notes/rl-2511.section.md b/nixos/doc/manual/release-notes/rl-2511.section.md index 588eff3b51b5..eb17c8f20d9a 100644 --- a/nixos/doc/manual/release-notes/rl-2511.section.md +++ b/nixos/doc/manual/release-notes/rl-2511.section.md @@ -27,6 +27,8 @@ - Options under [networking.getaddrinfo](#opt-networking.getaddrinfo.enable) are now allowed to declaratively configure address selection and sorting behavior of `getaddrinfo` in dual-stack networks. +- [Homebridge](https://github.com/homebridge/homebridge), a lightweight Node.js server you can run on your home network that emulates the iOS HomeKit API. Available as [services.homebridge](#opt-services.homebridge.enable). + - [LACT](https://github.com/ilya-zlobintsev/LACT), a GPU monitoring and configuration tool, can now be enabled through [services.lact.enable](#opt-services.lact.enable). Note that for LACT to work properly on AMD GPU systems, you need to enable [hardware.amdgpu.overdrive.enable](#opt-hardware.amdgpu.overdrive.enable). @@ -50,6 +52,8 @@ - [Newt](https://github.com/fosrl/newt), a fully user space WireGuard tunnel client and TCP/UDP proxy, designed to securely expose private resources controlled by Pangolin. Available as [services.newt](options.html#opt-services.newt.enable). +- [qBittorrent](https://www.qbittorrent.org/), is a bittorrent client programmed in C++ / Qt that uses libtorrent by Arvid Norberg. Available as [services.qbittorrent](#opt-services.qbittorrent.enable). + - [Szurubooru](https://github.com/rr-/szurubooru), an image board engine inspired by services such as Danbooru, dedicated for small and medium communities. Available as [services.szurubooru](#opt-services.szurubooru.enable). - The [Neat IP Address Planner](https://spritelink.github.io/NIPAP/) (NIPAP) can now be enabled through [services.nipap.enable](#opt-services.nipap.enable). diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix index 373a2df52894..9c9d49c09ad4 100644 --- a/nixos/modules/module-list.nix +++ b/nixos/modules/module-list.nix @@ -696,6 +696,7 @@ ./services/home-automation/evcc.nix ./services/home-automation/govee2mqtt.nix ./services/home-automation/home-assistant.nix + ./services/home-automation/homebridge.nix ./services/home-automation/matter-server.nix ./services/home-automation/wyoming/faster-whisper.nix ./services/home-automation/wyoming/openwakeword.nix @@ -1501,6 +1502,7 @@ ./services/torrent/magnetico.nix ./services/torrent/opentracker.nix ./services/torrent/peerflix.nix + ./services/torrent/qbittorrent.nix ./services/torrent/rtorrent.nix ./services/torrent/torrentstream.nix ./services/torrent/transmission.nix diff --git a/nixos/modules/services/home-automation/homebridge.nix b/nixos/modules/services/home-automation/homebridge.nix new file mode 100644 index 000000000000..9f0d379c6514 --- /dev/null +++ b/nixos/modules/services/home-automation/homebridge.nix @@ -0,0 +1,433 @@ +{ + config, + lib, + pkgs, + ... +}: + +let + cfg = config.services.homebridge; + + restartCommand = "sudo -n systemctl restart homebridge"; + + defaultConfigUIPlatform = { + inherit (cfg.uiSettings) + platform + name + port + restart + log + ; + }; + + defaultConfig = { + description = "Homebridge"; + bridge = { + inherit (cfg.settings.bridge) name port; + # These have to be set at least once, otherwise the homebridge will not work + username = "CC:22:3D:E3:CE:30"; + pin = "031-45-154"; + }; + platforms = [ + defaultConfigUIPlatform + ]; + }; + + defaultConfigFile = settingsFormat.generate "config.json" defaultConfig; + + nixOverrideConfig = cfg.settings // { + platforms = [ cfg.uiSettings ] ++ cfg.settings.platforms; + }; + + nixOverrideConfigFile = settingsFormat.generate "nixOverrideConfig.json" nixOverrideConfig; + + # Create a single jq filter that updates all fields at once + # Platforms need to be unique by "platform" + # Accessories need to be unique by "name" + jqMergeFilter = '' + reduce .[] as $item ( + {}; + . * $item + { + "platforms": ( + ((.platforms // []) + ($item.platforms // [])) | + group_by(.platform) | + map(reduce .[] as $platform ({}; . * $platform)) + ), + "accessories": ( + ((.accessories // []) + ($item.accessories // [])) | + group_by(.name) | + map(reduce .[] as $accessory ({}; . * $accessory)) + ) + } + ) + ''; + + jqMergeFilterFile = pkgs.writeTextFile { + name = "jqMergeFilter.jq"; + text = jqMergeFilter; + }; + + # Validation function to ensure no platform has the platform "config". + # We want to make sure settings for the "config" platform are set in uiSettings. + validatePlatforms = + platforms: + let + conflictingPlatforms = builtins.filter (p: p.platform == "config") platforms; + in + if builtins.length conflictingPlatforms > 0 then + throw "The platforms list must not contain any platform with platform type 'config'. Use the uiSettings attribute instead." + else + platforms; + + settingsFormat = pkgs.formats.json { }; +in +{ + options.services.homebridge = with lib.types; { + + # Basic Example + # { + # services.homebridge = { + # enable = true; + # # Necessary for service to be reachable + # openFirewall = true; + # }; + # } + + enable = lib.mkEnableOption "Homebridge: Homekit home automation"; + + user = lib.mkOption { + type = str; + default = "homebridge"; + description = "User to run homebridge as."; + }; + + group = lib.mkOption { + type = str; + default = "homebridge"; + description = "Group to run homebridge as."; + }; + + openFirewall = lib.mkEnableOption "" // { + description = '' + Open ports in the firewall for the Homebridge web interface and service. + ''; + }; + + userStoragePath = lib.mkOption { + type = str; + default = "/var/lib/homebridge"; + description = '' + Path to store homebridge user files (needs to be writeable). + ''; + }; + + pluginPath = lib.mkOption { + type = str; + default = "/var/lib/homebridge/node_modules"; + description = '' + Path to the plugin download directory (needs to be writeable). + Seems this needs to end with node_modules, as Homebridge will run npm + on the parent directory. + ''; + }; + + environmentFile = lib.mkOption { + type = types.nullOr types.str; + default = null; + description = '' + Path to an environment-file which may contain secrets. + ''; + }; + + settings = lib.mkOption { + default = { }; + description = '' + Configuration options for homebridge. + + For more details, see [the homebridge documentation](https://github.com/homebridge/homebridge/wiki/Homebridge-Config-JSON-Explained). + ''; + type = submodule { + freeformType = settingsFormat.type; + options = { + description = lib.mkOption { + type = str; + default = "Homebridge"; + description = "Description of the homebridge instance."; + readOnly = true; + }; + + bridge.name = lib.mkOption { + type = str; + default = "Homebridge"; + description = "Name of the homebridge"; + }; + + bridge.port = lib.mkOption { + type = port; + default = 51826; + description = "The port homebridge listens on"; + }; + + platforms = lib.mkOption { + description = "Homebridge Platforms"; + default = [ ]; + apply = validatePlatforms; + type = listOf (submodule { + freeformType = settingsFormat.type; + options = { + name = lib.mkOption { + type = str; + description = "Name of the platform"; + }; + platform = lib.mkOption { + type = str; + description = "Platform type"; + }; + }; + }); + }; + + accessories = lib.mkOption { + description = "Homebridge Accessories"; + default = [ ]; + type = listOf (submodule { + freeformType = settingsFormat.type; + options = { + name = lib.mkOption { + type = str; + description = "Name of the accessory"; + }; + accessory = lib.mkOption { + type = str; + description = "Accessory type"; + }; + }; + }); + }; + }; + }; + }; + + # Defines the parameters for the Homebridge UI Plugin. + # This submodule will get merged into the "platforms" array + # inside settings. + uiSettings = lib.mkOption { + # Full list of UI settings can be found here: https://github.com/homebridge/homebridge-config-ui-x/wiki/Config-Options + default = { }; + description = '' + Configuration options for homebridge config UI plugin. + + For more details, see [the homebridge-config-ui-x documentation](https://github.com/homebridge/homebridge-config-ui-x/wiki/Config-Options). + ''; + type = submodule { + freeformType = settingsFormat.type; + options = { + ## Following parameters must be set, and can't be changed. + + # Must be "config" for UI service to see its config + platform = lib.mkOption { + type = str; + default = "config"; + description = "Type of the homebridge UI platform"; + readOnly = true; + }; + + name = lib.mkOption { + type = str; + default = "Config"; + description = "Name of the homebridge UI platform"; + readOnly = true; + }; + + # Homebridge can be installed many ways, but we're forcing a double service systemd setup + # This command will restart both services + restart = lib.mkOption { + type = str; + default = restartCommand; + description = "Command to restart the homebridge UI service"; + readOnly = true; + }; + + # We're using systemd, so make sure logs is setup to pull from systemd + log.method = lib.mkOption { + type = str; + default = "systemd"; + description = "Method to use for logging"; + readOnly = true; + }; + + log.service = lib.mkOption { + type = str; + default = "homebridge"; + description = "Name of the systemd service to log to"; + readOnly = true; + }; + + # The following options are allowed to be changed. + port = lib.mkOption { + type = port; + default = 8581; + description = "The port the UI web service should listen on"; + }; + }; + }; + }; + }; + + config = lib.mkIf cfg.enable { + systemd.services.homebridge = { + description = "Homebridge"; + wants = [ "network-online.target" ]; + after = [ + "syslog.target" + "network-online.target" + ]; + wantedBy = [ "multi-user.target" ]; + + # On start, if the config file is missing, create a default one + # Otherwise, ensure that the config file is using the + # properties as specified by nix. + # Not sure if there is a better way to do this than to use jq + # to replace sections of json. + preStart = '' + # If the user storage path does not exist, create it + if [ ! -d "${cfg.userStoragePath}" ]; then + install -d -m 700 -o ${cfg.user} -g ${cfg.group} "${cfg.userStoragePath}" + fi + # If there is no config file, create a placeholder default + if [ ! -e "${cfg.userStoragePath}/config.json" ]; then + install -D -m 600 -o ${cfg.user} -g ${cfg.group} "${defaultConfigFile}" "${cfg.userStoragePath}/config.json" + fi + + # Apply all nix override settings to config.json in a single jq operation + ${pkgs.jq}/bin/jq -s -f "${jqMergeFilterFile}" "${cfg.userStoragePath}/config.json" "${nixOverrideConfigFile}" | ${pkgs.jq}/bin/jq . > "${cfg.userStoragePath}/config.json.tmp" + install -D -m 600 -o ${cfg.user} -g ${cfg.group} "${cfg.userStoragePath}/config.json.tmp" "${cfg.userStoragePath}/config.json" + + # Remove temporary files + rm "${cfg.userStoragePath}/config.json.tmp" + + # Make sure plugin directory exists + install -d -m 755 -o ${cfg.user} -g ${cfg.group} "${cfg.pluginPath}" + + # In order for hb-service to detect the homebridge installation, we need to create a folder structure + # where homebridge and homebrdige-config-ui-x node modules are side by side, and then point + # UIX_BASE_PATH_OVERRIDE at the homebridge-config-ui-x node module in the service environment. + # So, first create a directory to symlink these packages to + install -d -m 755 -o ${cfg.user} -g ${cfg.group} "${cfg.userStoragePath}/homebridge-packages" + + # Then, symlink in the homebridge and homebridge-config-ui-x packages + rm -rf "${cfg.userStoragePath}/homebridge-packages/homebridge" + ln -s "${pkgs.homebridge}/lib/node_modules/homebridge" "${cfg.userStoragePath}/homebridge-packages/homebridge" + rm -rf "${cfg.userStoragePath}/homebridge-packages/homebridge-config-ui-x" + ln -s "${pkgs.homebridge-config-ui-x}/lib/node_modules/homebridge-config-ui-x" "${cfg.userStoragePath}/homebridge-packages/homebridge-config-ui-x" + ''; + + # hb-service environment variables based on source code analysis + environment = { + HOMEBRIDGE_CONFIG_UI_TERMINAL = "1"; + DISABLE_OPENCOLLECTIVE = "true"; + # Required or homebridge will search the global npm namespace + UIX_STRICT_PLUGIN_RESOLUTION = "1"; + # Workaround to ensure homebridge does not run in sudo mode + HOMEBRIDGE_APT_PACKAGE = "1"; + # Required to get the service to detect the homebridge install correctly + UIX_BASE_PATH_OVERRIDE = "${cfg.userStoragePath}/homebridge-packages/homebridge-config-ui-x"; + }; + + path = with pkgs; [ + # Tools listed in homebridge's installation documentations: + # https://github.com/homebridge/homebridge/wiki/Install-Homebridge-on-Arch-Linux + nodejs + nettools + gcc + gnumake + # Required for access to systemctl and journalctl + systemd + # Required for access to sudo + "/run/wrappers" + # Some plugins need bash to download tools + bash + ]; + + # Settings from https://github.com/homebridge/homebridge-config-ui-x/blob/latest/src/bin/platforms/linux.ts + serviceConfig = { + Type = "simple"; + User = cfg.user; + PermissionsStartOnly = true; + StateDirectory = "homebridge"; + EnvironmentFile = lib.mkIf (cfg.environmentFile != null) [ cfg.environmentFile ]; + ExecStart = "${pkgs.homebridge-config-ui-x}/bin/hb-service run -U ${cfg.userStoragePath} -P ${cfg.pluginPath}"; + Restart = "always"; + RestartSec = 3; + KillMode = "process"; + CapabilityBoundingSet = [ + "CAP_IPC_LOCK" + "CAP_NET_ADMIN" + "CAP_NET_BIND_SERVICE" + "CAP_NET_RAW" + "CAP_SETGID" + "CAP_SETUID" + "CAP_SYS_CHROOT" + "CAP_CHOWN" + "CAP_FOWNER" + "CAP_DAC_OVERRIDE" + "CAP_AUDIT_WRITE" + "CAP_SYS_ADMIN" + ]; + AmbientCapabilities = [ + "CAP_NET_RAW" + "CAP_NET_BIND_SERVICE" + ]; + }; + }; + + # Create a user whose home folder is the user storage path + users.users = lib.mkIf (cfg.user == "homebridge") { + homebridge = { + inherit (cfg) group; + # Necessary so that this user can run journalctl + extraGroups = [ "systemd-journal" ]; + description = "homebridge user"; + isSystemUser = true; + home = cfg.userStoragePath; + }; + }; + + users.groups = lib.mkIf (cfg.group == "homebridge") { + homebridge = { }; + }; + + # Need passwordless sudo for a few commands + # homebridge-config-ui-x needs for some features + security.sudo.extraRules = [ + { + users = [ cfg.user ]; + commands = [ + { + # Ability to restart homebridge service + command = "${pkgs.systemd}/bin/systemctl restart homebridge"; + options = [ "NOPASSWD" ]; + } + { + # Ability to shutdown server + command = "${pkgs.systemd}/bin/shutdown -h now"; + options = [ "NOPASSWD" ]; + } + { + # Ability to restart server + command = "${pkgs.systemd}/bin/shutdown -r now"; + options = [ "NOPASSWD" ]; + } + ]; + } + ]; + + networking.firewall = { + allowedTCPPorts = lib.mkIf cfg.openFirewall [ + cfg.settings.bridge.port + cfg.uiSettings.port + ]; + allowedUDPPorts = lib.mkIf cfg.openFirewall [ 5353 ]; + }; + }; +} diff --git a/nixos/modules/services/networking/kresd.nix b/nixos/modules/services/networking/kresd.nix index 40440fbd16cc..5373dbf76ca9 100644 --- a/nixos/modules/services/networking/kresd.nix +++ b/nixos/modules/services/networking/kresd.nix @@ -161,7 +161,7 @@ in group = "knot-resolver"; description = "Knot-resolver daemon user"; }; - users.groups.knot-resolver.gid = null; + users.groups.knot-resolver = { }; systemd.packages = [ cfg.package ]; # the units are patched inside the package a bit diff --git a/nixos/modules/services/torrent/qbittorrent.nix b/nixos/modules/services/torrent/qbittorrent.nix new file mode 100644 index 000000000000..f62750a02361 --- /dev/null +++ b/nixos/modules/services/torrent/qbittorrent.nix @@ -0,0 +1,238 @@ +{ + config, + pkgs, + lib, + utils, + ... +}: +let + cfg = config.services.qbittorrent; + inherit (builtins) concatStringsSep isAttrs isString; + inherit (lib) + literalExpression + getExe + mkEnableOption + mkOption + mkPackageOption + mkIf + maintainers + escape + collect + mapAttrsRecursive + optionals + ; + inherit (lib.types) + str + port + path + nullOr + listOf + attrsOf + anything + submodule + ; + inherit (lib.generators) toINI mkKeyValueDefault mkValueStringDefault; + gendeepINI = toINI { + mkKeyValue = + let + sep = "="; + in + k: v: + if isAttrs v then + concatStringsSep "\n" ( + collect isString ( + mapAttrsRecursive ( + path: value: + "${escape [ sep ] (concatStringsSep "\\" ([ k ] ++ path))}${sep}${mkValueStringDefault { } value}" + ) v + ) + ) + else + mkKeyValueDefault { } sep k v; + }; + configFile = pkgs.writeText "qBittorrent.conf" (gendeepINI cfg.serverConfig); +in +{ + options.services.qbittorrent = { + enable = mkEnableOption "qbittorrent, BitTorrent client"; + + package = mkPackageOption pkgs "qbittorrent-nox" { }; + + user = mkOption { + type = str; + default = "qbittorrent"; + description = "User account under which qbittorrent runs."; + }; + + group = mkOption { + type = str; + default = "qbittorrent"; + description = "Group under which qbittorrent runs."; + }; + + profileDir = mkOption { + type = path; + default = "/var/lib/qBittorrent/"; + description = "the path passed to qbittorrent via --profile."; + }; + + openFirewall = mkEnableOption "opening both the webuiPort and torrentPort over TCP in the firewall"; + + webuiPort = mkOption { + default = 8080; + type = nullOr port; + description = "the port passed to qbittorrent via `--webui-port`"; + }; + + torrentingPort = mkOption { + default = null; + type = nullOr port; + description = "the port passed to qbittorrent via `--torrenting-port`"; + }; + + serverConfig = mkOption { + default = { }; + type = submodule { + freeformType = attrsOf (attrsOf anything); + }; + description = '' + Free-form settings mapped to the `qBittorrent.conf` file in the profile. + Refer to [Explanation-of-Options-in-qBittorrent](https://github.com/qbittorrent/qBittorrent/wiki/Explanation-of-Options-in-qBittorrent). + The Password_PBKDF2 format is oddly unique, you will likely want to use [this tool](https://codeberg.org/feathecutie/qbittorrent_password) to generate the format. + Alternatively you can run qBittorrent independently first and use its webUI to generate the format. + + Optionally an alternative webUI can be easily set. VueTorrent for example: + ```nix + { + Preferences = { + WebUI = { + AlternativeUIEnabled = true; + RootFolder = "''${pkgs.vuetorrent}/share/vuetorrent"; + }; + }; + } + ]; + ``` + ''; + example = literalExpression '' + { + LegalNotice.Accepted = true; + Preferences = { + WebUI = { + Username = "user"; + Password_PBKDF2 = "generated ByteArray."; + }; + General.Locale = "en"; + }; + } + ''; + }; + + extraArgs = mkOption { + type = listOf str; + default = [ ]; + description = '' + Extra arguments passed to qbittorrent. See `qbittorrent -h`, or the [source code](https://github.com/qbittorrent/qBittorrent/blob/master/src/app/cmdoptions.cpp), for the available arguments. + ''; + example = [ + "--confirm-legal-notice" + ]; + }; + }; + config = mkIf cfg.enable { + systemd = { + tmpfiles.settings = { + qbittorrent = { + "${cfg.profileDir}/qBittorrent/"."d" = { + mode = "755"; + inherit (cfg) user group; + }; + "${cfg.profileDir}/qBittorrent/config/"."d" = { + mode = "755"; + inherit (cfg) user group; + }; + "${cfg.profileDir}/qBittorrent/config/qBittorrent.conf"."L+" = mkIf (cfg.serverConfig != { }) { + mode = "1400"; + inherit (cfg) user group; + argument = "${configFile}"; + }; + }; + }; + services.qbittorrent = { + description = "qbittorrent BitTorrent client"; + wants = [ "network-online.target" ]; + after = [ + "local-fs.target" + "network-online.target" + "nss-lookup.target" + ]; + wantedBy = [ "multi-user.target" ]; + restartTriggers = optionals (cfg.serverConfig != { }) [ configFile ]; + + serviceConfig = { + Type = "simple"; + User = cfg.user; + Group = cfg.group; + ExecStart = utils.escapeSystemdExecArgs ( + [ + (getExe cfg.package) + "--profile=${cfg.profileDir}" + ] + ++ optionals (cfg.webuiPort != null) [ "--webui-port=${toString cfg.webuiPort}" ] + ++ optionals (cfg.torrentingPort != null) [ "--torrenting-port=${toString cfg.torrentingPort}" ] + ++ cfg.extraArgs + ); + TimeoutStopSec = 1800; + + # https://github.com/qbittorrent/qBittorrent/pull/6806#discussion_r121478661 + PrivateTmp = false; + + PrivateNetwork = false; + RemoveIPC = true; + NoNewPrivileges = true; + PrivateDevices = true; + PrivateUsers = true; + ProtectHome = "yes"; + ProtectProc = "invisible"; + ProcSubset = "pid"; + ProtectSystem = "full"; + ProtectClock = true; + ProtectHostname = true; + ProtectKernelLogs = true; + ProtectKernelModules = true; + ProtectKernelTunables = true; + ProtectControlGroups = true; + RestrictAddressFamilies = [ + "AF_INET" + "AF_INET6" + "AF_NETLINK" + ]; + RestrictNamespaces = true; + RestrictRealtime = true; + RestrictSUIDSGID = true; + LockPersonality = true; + MemoryDenyWriteExecute = true; + SystemCallArchitectures = "native"; + CapabilityBoundingSet = ""; + SystemCallFilter = [ "@system-service" ]; + }; + }; + }; + + users = { + users = mkIf (cfg.user == "qbittorrent") { + qbittorrent = { + inherit (cfg) group; + isSystemUser = true; + }; + }; + groups = mkIf (cfg.group == "qbittorrent") { qbittorrent = { }; }; + }; + + networking.firewall.allowedTCPPorts = mkIf cfg.openFirewall ( + optionals (cfg.webuiPort != null) [ cfg.webuiPort ] + ++ optionals (cfg.torrentingPort != null) [ cfg.torrentingPort ] + ); + }; + meta.maintainers = with maintainers; [ fsnkty ]; +} diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix index fd7caf0bacf6..a6aa600415dd 100644 --- a/nixos/tests/all-tests.nix +++ b/nixos/tests/all-tests.nix @@ -700,6 +700,7 @@ in hledger-web = runTest ./hledger-web.nix; hockeypuck = runTest ./hockeypuck.nix; home-assistant = runTest ./home-assistant.nix; + homebridge = runTest ./homebridge.nix; hostname = handleTest ./hostname.nix { }; hound = runTest ./hound.nix; hub = runTest ./git/hub.nix; @@ -1221,6 +1222,7 @@ in public-inbox = runTest ./public-inbox.nix; pufferpanel = runTest ./pufferpanel.nix; pulseaudio = discoverTests (import ./pulseaudio.nix); + qbittorrent = runTest ./qbittorrent.nix; qboot = handleTestOn [ "x86_64-linux" "i686-linux" ] ./qboot.nix { }; qemu-vm-restrictnetwork = handleTest ./qemu-vm-restrictnetwork.nix { }; qemu-vm-volatile-root = runTest ./qemu-vm-volatile-root.nix; diff --git a/nixos/tests/homebridge.nix b/nixos/tests/homebridge.nix new file mode 100644 index 000000000000..ce0f85caa413 --- /dev/null +++ b/nixos/tests/homebridge.nix @@ -0,0 +1,88 @@ +{ + lib, + ... +}: + +let + userStoragePath = "/var/lib/foobar"; + pluginPath = "${userStoragePath}/node_modules"; +in +{ + name = "homebridge"; + meta.maintainers = with lib.maintainers; [ fmoda3 ]; + + nodes.homebridge = + { pkgs, ... }: + { + services.homebridge = { + enable = true; + inherit userStoragePath pluginPath; + + settings = { + bridge = { + name = "Homebridge"; + port = 51826; + }; + }; + + uiSettings = { + port = 8581; + }; + }; + + # Cause a configuration change inside `config.json` and verify that the process is being reloaded. + specialisation.differentName = { + inheritParentConfig = true; + configuration.services.homebridge.settings.bridge.name = lib.mkForce "Test Home"; + }; + }; + + testScript = + { nodes, ... }: + let + system = nodes.homebridge.system.build.toplevel; + in + '' + import json + + start_all() + + + def get_homebridge_journal_cursor() -> str: + exit, out = homebridge.execute("journalctl -u homebridge.service -n1 -o json-pretty --output-fields=__CURSOR") + assert exit == 0 + return json.loads(out)["__CURSOR"] + + + def wait_for_homebridge(cursor): + homebridge.wait_until_succeeds(f"journalctl --after-cursor='{cursor}' -u homebridge.service | grep -q 'Logging to'") + + + homebridge.wait_for_unit("homebridge.service") + homebridge_cursor = get_homebridge_journal_cursor() + + with subtest("Check that JSON configuration file is in place"): + homebridge.succeed("test -f ${userStoragePath}/config.json") + + with subtest("Check that Homebridge's web interface and API can be reached"): + wait_for_homebridge(homebridge_cursor) + homebridge.wait_for_open_port(51826) + homebridge.wait_for_open_port(8581) + homebridge.succeed("curl --fail http://localhost:8581/") + + with subtest("Check service restart from SIGHUP"): + homebridge_pid = homebridge.succeed("systemctl show --property=MainPID homebridge.service") + homebridge_cursor = get_homebridge_journal_cursor() + homebridge.succeed("${system}/specialisation/differentName/bin/switch-to-configuration test") + wait_for_homebridge(homebridge_cursor) + new_homebridge_pid = homebridge.succeed("systemctl show --property=MainPID homebridge.service") + assert homebridge_pid != new_homebridge_pid, "The PID of the homebridge process must change after sending SIGHUP" + + with subtest("Check that no errors were logged"): + homebridge.fail("journalctl -u homebridge -o cat | grep -q ERROR") + + with subtest("Check systemd unit hardening"): + homebridge.log(homebridge.succeed("systemctl cat homebridge.service")) + homebridge.log(homebridge.succeed("systemd-analyze security homebridge.service")) + ''; +} diff --git a/nixos/tests/qbittorrent.nix b/nixos/tests/qbittorrent.nix new file mode 100644 index 000000000000..e7bafbef0631 --- /dev/null +++ b/nixos/tests/qbittorrent.nix @@ -0,0 +1,190 @@ +{ pkgs, lib, ... }: +{ + name = "qbittorrent"; + + meta = with pkgs.lib.maintainers; { + maintainers = [ fsnkty ]; + }; + + nodes = { + simple = { + services.qbittorrent.enable = true; + + specialisation.portChange.configuration = { + services.qbittorrent = { + enable = true; + webuiPort = 5555; + torrentingPort = 44444; + }; + }; + + specialisation.openPorts.configuration = { + services.qbittorrent = { + enable = true; + openFirewall = true; + webuiPort = 8080; + torrentingPort = 55555; + }; + }; + + specialisation.serverConfig.configuration = { + services.qbittorrent = { + enable = true; + webuiPort = null; + serverConfig.Preferences.WebUI.Port = "8181"; + }; + }; + }; + # Seperate vm because it's not possible to reboot into a specialisation with + # switch-to-configuration: https://github.com/NixOS/nixpkgs/issues/82851 + # For one of the test we check if manual changes are overridden during + # reboot, therefore it's necessary to reboot into a declarative setup. + declarative = { + services.qbittorrent = { + enable = true; + webuiPort = null; + serverConfig = { + Preferences = { + WebUI = { + Username = "user"; + # Default password: adminadmin + Password_PBKDF2 = "@ByteArray(6DIf26VOpTCYbgNiO6DAFQ==:e6241eaAWGzRotQZvVA5/up9fj5wwSAThLgXI2lVMsYTu1StUgX9MgmElU3Sa/M8fs+zqwZv9URiUOObjqJGNw==)"; + Port = lib.mkDefault "8181"; + }; + }; + }; + }; + + specialisation.serverConfigChange.configuration = { + services.qbittorrent = { + enable = true; + webuiPort = null; + serverConfig.Preferences.WebUI.Port = "7171"; + }; + }; + }; + }; + + testScript = + { nodes, ... }: + let + simpleSpecPath = "${nodes.simple.system.build.toplevel}/specialisation"; + declarativeSpecPath = "${nodes.declarative.system.build.toplevel}/specialisation"; + portChange = "${simpleSpecPath}/portChange"; + openPorts = "${simpleSpecPath}/openPorts"; + serverConfig = "${simpleSpecPath}/serverConfig"; + serverConfigChange = "${declarativeSpecPath}/serverConfigChange"; + in + '' + simple.start(allow_reboot=True) + declarative.start(allow_reboot=True) + + + def test_webui(machine, port): + machine.wait_for_unit("qbittorrent.service") + machine.wait_for_open_port(port) + machine.wait_until_succeeds(f"curl --fail http://localhost:{port}") + + + # To simulate an interactive change in the settings + def setPreferences_api(machine, port, post_creds, post_data): + qb_url = f"http://localhost:{port}" + api_url = f"{qb_url}/api/v2" + cookie_path = "/tmp/qbittorrent.cookie" + + machine.succeed( + f'curl --header "Referer: {qb_url}" \ + --data "{post_creds}" {api_url}/auth/login \ + -c {cookie_path}' + ) + machine.succeed( + f'curl --header "Referer: {qb_url}" \ + --data "{post_data}" {api_url}/app/setPreferences \ + -b {cookie_path}' + ) + + + # A randomly generated password is printed in the service log when no + # password it set + def get_temp_pass(machine): + _, password = machine.execute( + "journalctl -u qbittorrent.service |\ + grep 'The WebUI administrator password was not set.' |\ + awk '{ print $NF }' | tr -d '\n'" + ) + return password + + + # Non declarative tests + + with subtest("webui works with all default settings"): + test_webui(simple, 8080) + + with subtest("check if manual changes in settings are saved correctly"): + temp_pass = get_temp_pass(simple) + + ## Change some settings + api_post = [r"json={\"listen_port\": 33333}", r"json={\"web_ui_port\": 9090}"] + for x in api_post: + setPreferences_api( + machine=simple, + port=8080, + post_creds=f"username=admin&password={temp_pass}", + post_data=x, + ) + + simple.wait_for_open_port(33333) + test_webui(simple, 9090) + + ## Test which settings are reset + ## As webuiPort is passed as an cli it should reset after reboot + ## As torrentingPort is not passed as an cli it should not reset after + ## reboot + simple.reboot() + test_webui(simple, 8080) + simple.wait_for_open_port(33333) + + with subtest("ports are changed on config change"): + simple.succeed("${portChange}/bin/switch-to-configuration test") + test_webui(simple, 5555) + simple.wait_for_open_port(44444) + + with subtest("firewall is opened correctly"): + simple.succeed("${openPorts}/bin/switch-to-configuration test") + test_webui(simple, 8080) + declarative.wait_until_succeeds("curl --fail http://simple:8080") + declarative.wait_for_open_port(55555, "simple") + + with subtest("switching from simple to declarative works"): + simple.succeed("${serverConfig}/bin/switch-to-configuration test") + test_webui(simple, 8181) + + + # Declarative tests + + with subtest("serverConfig is applied correctly"): + test_webui(declarative, 8181) + + with subtest("manual changes are overridden during reboot"): + ## Change some settings + setPreferences_api( + machine=declarative, + port=8181, # as set through serverConfig + post_creds="username=user&password=adminadmin", + post_data=r"json={\"web_ui_port\": 9191}", + ) + + test_webui(declarative, 9191) + + ## Test which settings are reset + ## The generated qBittorrent.conf is, apparently, reapplied after reboot. + ## Because the port is set in `serverConfig` this overrides the manually + ## set port. + declarative.reboot() + test_webui(declarative, 8181) + + with subtest("changes in serverConfig are applied correctly"): + declarative.succeed("${serverConfigChange}/bin/switch-to-configuration test") + test_webui(declarative, 7171) + ''; +} diff --git a/pkgs/applications/editors/vim/plugins/generated.nix b/pkgs/applications/editors/vim/plugins/generated.nix index d1233299fe31..955c598468bc 100644 --- a/pkgs/applications/editors/vim/plugins/generated.nix +++ b/pkgs/applications/editors/vim/plugins/generated.nix @@ -5243,6 +5243,19 @@ final: prev: { meta.hydraPlatforms = [ ]; }; + fyler-nvim = buildVimPlugin { + pname = "fyler.nvim"; + version = "2025-07-21"; + src = fetchFromGitHub { + owner = "A7Lavinraj"; + repo = "fyler.nvim"; + rev = "6595c9ef272797aeb92aacdc392cf670c994e467"; + sha256 = "14fbmhxw7xyg618g3pv7hq64ppcas997qvkbdnl2z0lqrk2nn3zy"; + }; + meta.homepage = "https://github.com/A7Lavinraj/fyler.nvim/"; + meta.hydraPlatforms = [ ]; + }; + fzf-checkout-vim = buildVimPlugin { pname = "fzf-checkout.vim"; version = "2023-10-05"; diff --git a/pkgs/applications/editors/vim/plugins/overrides.nix b/pkgs/applications/editors/vim/plugins/overrides.nix index 9c35b2dd1eb6..49d81e85cab6 100644 --- a/pkgs/applications/editors/vim/plugins/overrides.nix +++ b/pkgs/applications/editors/vim/plugins/overrides.nix @@ -1245,6 +1245,15 @@ in ]; }; + fyler-nvim = super.fyler-nvim.overrideAttrs { + nvimSkipModules = [ + # Requires setup call + "fyler.views.explorer.init" + "fyler.views.explorer.actions" + "fyler.views.explorer.ui" + ]; + }; + fzf-checkout-vim = super.fzf-checkout-vim.overrideAttrs { # The plugin has a makefile which tries to run tests in a docker container. # This prevents it. diff --git a/pkgs/applications/editors/vim/plugins/vim-plugin-names b/pkgs/applications/editors/vim/plugins/vim-plugin-names index af8b68f2611f..330dba5b5178 100644 --- a/pkgs/applications/editors/vim/plugins/vim-plugin-names +++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names @@ -401,6 +401,7 @@ https://github.com/shumphrey/fugitive-gitlab.vim/,, https://github.com/BeneCollyridam/futhark-vim/,, https://github.com/tzachar/fuzzy.nvim/,HEAD, https://github.com/rktjmp/fwatch.nvim/,, +https://github.com/A7Lavinraj/fyler.nvim/,stable, https://github.com/stsewd/fzf-checkout.vim/,, https://github.com/monkoose/fzf-hoogle.vim/,HEAD, https://github.com/gfanto/fzf-lsp.nvim/,, diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix index c8b07ef0427b..79135426c494 100644 --- a/pkgs/applications/editors/vscode/extensions/default.nix +++ b/pkgs/applications/editors/vscode/extensions/default.nix @@ -1343,96 +1343,6 @@ let detachhead.basedpyright = callPackage ./detachhead.basedpyright { }; - devsense.composer-php-vscode = buildVscodeMarketplaceExtension { - mktplcRef = { - name = "composer-php-vscode"; - publisher = "devsense"; - version = "1.59.17515"; - hash = "sha256-unqWaEtShJHqol0tV4ocb0nI81rWFQuv/W1i+2zMeZM="; - }; - meta = { - changelog = "https://marketplace.visualstudio.com/items/DEVSENSE.composer-php-vscode/changelog"; - description = "Visual studio code extension for full development integration for Composer, the PHP package manager"; - downloadPage = "https://marketplace.visualstudio.com/items?itemName=DEVSENSE.composer-php-vscode"; - homepage = "https://github.com/DEVSENSE/phptools-docs"; - license = lib.licenses.unfree; - maintainers = [ ]; - }; - }; - - devsense.phptools-vscode = buildVscodeMarketplaceExtension { - mktplcRef = - let - sources = { - "x86_64-linux" = { - arch = "linux-x64"; - hash = "sha256-8i5nRlzd+LnpEh9trWECxfiC1W4S0ekBab5vo18OlsA="; - }; - "x86_64-darwin" = { - arch = "darwin-x64"; - sha256 = "14crw56277rdwhigabb3nsndkfcs3yzzf7gw85jvryxviq32chgy"; - }; - "aarch64-linux" = { - arch = "linux-arm64"; - sha256 = "1j1xlvbg3nrfmdd9zm6kywwicdwdkrq0si86lcndaii8m7sj5pfp"; - }; - "aarch64-darwin" = { - arch = "darwin-arm64"; - sha256 = "0nlks6iqxkx1xlicsa8lrb1319rgznlxkv2gg7wkwgzph97ik8bi"; - }; - }; - in - { - name = "phptools-vscode"; - publisher = "devsense"; - version = "1.41.14332"; - } - // sources.${stdenv.system} or (throw "Unsupported system: ${stdenv.system}"); - - nativeBuildInputs = [ autoPatchelfHook ]; - - buildInputs = [ - zlib - (lib.getLib stdenv.cc.cc) - ]; - - postInstall = '' - chmod +x $out/share/vscode/extensions/devsense.phptools-vscode/out/server/devsense.php.ls - ''; - - meta = { - changelog = "https://marketplace.visualstudio.com/items/DEVSENSE.phptools-vscode/changelog"; - description = "Visual studio code extension for full development integration for the PHP language"; - downloadPage = "https://marketplace.visualstudio.com/items?itemName=DEVSENSE.phptools-vscode"; - homepage = "https://github.com/DEVSENSE/phptools-docs"; - license = lib.licenses.unfree; - maintainers = [ ]; - platforms = [ - "x86_64-linux" - "x86_64-darwin" - "aarch64-darwin" - "aarch64-linux" - ]; - }; - }; - - devsense.profiler-php-vscode = buildVscodeMarketplaceExtension { - mktplcRef = { - name = "profiler-php-vscode"; - publisher = "devsense"; - version = "1.59.17515"; - hash = "sha256-Y2y1vpqKEOjg4eniG0myhaAkJLdEIAT1UdEdbr04MrA="; - }; - meta = { - changelog = "https://marketplace.visualstudio.com/items/DEVSENSE.profiler-php-vscode/changelog"; - description = "Visual studio code extension for PHP and XDebug profiling and inspecting"; - downloadPage = "https://marketplace.visualstudio.com/items?itemName=DEVSENSE.profiler-php-vscode"; - homepage = "https://github.com/DEVSENSE/phptools-docs"; - license = lib.licenses.unfree; - maintainers = [ ]; - }; - }; - dhall.dhall-lang = buildVscodeMarketplaceExtension { mktplcRef = { name = "dhall-lang"; diff --git a/pkgs/applications/editors/vscode/extensions/ms-python.python/default.nix b/pkgs/applications/editors/vscode/extensions/ms-python.python/default.nix index 6507f0587c65..e5e1edbcf035 100644 --- a/pkgs/applications/editors/vscode/extensions/ms-python.python/default.nix +++ b/pkgs/applications/editors/vscode/extensions/ms-python.python/default.nix @@ -15,8 +15,8 @@ vscode-utils.buildVscodeMarketplaceExtension rec { mktplcRef = { name = "python"; publisher = "ms-python"; - version = "2025.10.0"; - hash = "sha256-uD6NWGD5GyYwd7SeoGsgYEH26NI+hDxCx3f2EhqoOXk="; + version = "2025.10.1"; + hash = "sha256-3hd940mfxnvqoblIrx/S0A8KwHtYLFuonu52/HGGfak="; }; buildInputs = [ icu ]; diff --git a/pkgs/by-name/bu/burpsuite/package.nix b/pkgs/by-name/bu/burpsuite/package.nix index 8258329233fd..daa5acffae30 100644 --- a/pkgs/by-name/bu/burpsuite/package.nix +++ b/pkgs/by-name/bu/burpsuite/package.nix @@ -9,20 +9,20 @@ }: let - version = "2025.7"; + version = "2025.7.1"; product = if proEdition then { productName = "pro"; productDesktop = "Burp Suite Professional Edition"; - hash = "sha256-JnsaMo6QixmC1SzW6I/iX7YOZLxWaU7AlvqsZ66cPeg="; + hash = "sha256-qyTvvEEiZFtiRvPM8IcuRlzBKOO40Fe9g8l9wrsIY84="; } else { productName = "community"; productDesktop = "Burp Suite Community Edition"; - hash = "sha256-M8/Fy8yZH+WuF34IautU2fnFKOWI4/tPCzRKRIkxagY="; + hash = "sha256-y34WlQtGZNBn1StoWhQh02EHbCVxYMoOQMH4cGbviXg="; }; src = fetchurl { diff --git a/pkgs/by-name/ch/cherry-studio/package.nix b/pkgs/by-name/ch/cherry-studio/package.nix index 432aade4a5c5..c380e4bc42f3 100644 --- a/pkgs/by-name/ch/cherry-studio/package.nix +++ b/pkgs/by-name/ch/cherry-studio/package.nix @@ -5,7 +5,7 @@ yarn-berry_4, nodejs, python3, - electron, + electron_35, makeWrapper, writableTmpDirAsHomeHook, makeDesktopItem, @@ -14,6 +14,7 @@ }: let + electron = electron_35; yarn-berry = yarn-berry_4; in stdenv.mkDerivation (finalAttrs: { diff --git a/pkgs/by-name/gf/gfn-electron/package.nix b/pkgs/by-name/gf/gfn-electron/package.nix index 576a87024575..ccddb1b12b05 100644 --- a/pkgs/by-name/gf/gfn-electron/package.nix +++ b/pkgs/by-name/gf/gfn-electron/package.nix @@ -2,12 +2,13 @@ lib, buildNpmPackage, fetchFromGitHub, - electron, + electron_35, nix-update-script, makeBinaryWrapper, python3, }: let + electron = electron_35; version = "2.2.0"; in buildNpmPackage { diff --git a/pkgs/by-name/gi/gibo/package.nix b/pkgs/by-name/gi/gibo/package.nix index 9663311e6812..bddfd825e5d8 100644 --- a/pkgs/by-name/gi/gibo/package.nix +++ b/pkgs/by-name/gi/gibo/package.nix @@ -1,40 +1,64 @@ { lib, stdenv, + buildPackages, + buildGoModule, fetchFromGitHub, - coreutils, - findutils, - git, + nix-update-script, + versionCheckHook, + installShellFiles, + writableTmpDirAsHomeHook, }: - -stdenv.mkDerivation rec { +buildGoModule (finalAttrs: { pname = "gibo"; - version = "1.0.6"; + version = "3.0.14"; src = fetchFromGitHub { owner = "simonwhitaker"; repo = "gibo"; - rev = version; - sha256 = "07j3sv9ar9l074krajw8nfmsfmdp836irsbd053dbqk2v880gfm6"; + tag = "v${finalAttrs.version}"; + sha256 = "sha256-6w+qhwOHkfKt0hgKO98L6Si0RNJN+CXOOFzGlvxFjcA="; }; - installPhase = '' - mkdir -p $out/bin $out/share/bash-completion/completions - cp gibo $out/bin - cp gibo-completion.bash $out/share/bash-completion/completions + vendorHash = "sha256-pD+7yvBydg1+BQFP0G8rRYTCO//Wg/6pzY19DLs42Gk="; - sed -e 's|\ 0.1.0', path: 'vendor/gems/bundler-checksum', require: false, feature_category: :shared +gem 'bundler-checksum', '~> 0.1.0', path: 'gems/bundler-checksum', require: false, feature_category: :shared # See https://docs.gitlab.com/ee/development/gemfile.html#upgrade-rails for guidelines when upgrading Rails @@ -37,7 +37,7 @@ gem 'mutex_m', '~> 0.3', feature_category: :shared # Need by Rails gem 'drb', '~> 2.2', feature_category: :shared -gem 'bootsnap', '~> 1.18.3', require: false, feature_category: :shared +gem 'bootsnap', '~> 1.18.6', require: false, feature_category: :shared # Avoid the precompiled native gems because Omnibus needs to build this to ensure # LD_LIBRARY_PATH is correct: https://gitlab.com/gitlab-org/omnibus-gitlab/-/merge_requests/7730 @@ -344,9 +344,6 @@ gem 'atlassian-jwt', '~> 0.2.1', feature_category: :integrations # Slack integration gem 'slack-messenger', '~> 2.3.5', feature_category: :integrations -# FogBugz integration -gem 'ruby-fogbugz', '~> 0.3.0', feature_category: :importers - # Kubernetes integration gem 'kubeclient', '~> 4.11.0', feature_category: :shared @@ -404,7 +401,7 @@ gem 'gitlab-schema-validation', path: 'gems/gitlab-schema-validation', feature_c gem 'gitlab-http', path: 'gems/gitlab-http', feature_category: :shared gem 'premailer-rails', '~> 1.12.0', feature_category: :notifications -gem 'gitlab-labkit', '~> 0.37.0', feature_category: :shared +gem 'gitlab-labkit', '~> 0.39.0', feature_category: :shared gem 'thrift', '>= 0.16.0', feature_category: :shared # I18n @@ -422,10 +419,6 @@ gem 'tty-prompt', '~> 0.23', require: false, feature_category: :shared # Perf bar gem 'peek', '~> 1.1', feature_category: :shared -# Google Cloud Profiler support -gem 'cloud_profiler_agent', '~> 0.0.0', path: 'vendor/gems/cloud_profiler_agent', require: false, - feature_category: :shared - # Snowplow events trackin gem 'snowplow-tracker', '~> 0.8.0', feature_category: :product_analytics @@ -438,7 +431,7 @@ gem 'prometheus-client-mmap', '~> 1.2.9', require: 'prometheus/client', feature_ gem 'async', '~> 2.24.0', require: false, feature_category: :shared # Security report schemas used to validate CI job artifacts of security jobs -gem 'gitlab-security_report_schemas', '0.1.2.min15.0.0.max15.2.1', feature_category: :vulnerability_management +gem 'gitlab-security_report_schemas', '0.1.3.min15.0.0.max15.2.2', feature_category: :vulnerability_management # OpenTelemetry group :opentelemetry do @@ -515,7 +508,7 @@ group :development, :test do gem 'database_cleaner-active_record', '~> 2.2.0', feature_category: :database gem 'rspec-rails', '~> 7.1.0', feature_category: :shared - gem 'factory_bot_rails', '~> 6.4.3', feature_category: :tooling + gem 'factory_bot_rails', '~> 6.5.0', feature_category: :tooling # Prevent occasions where minitest is not bundled in packaged versions of ruby (see #3826) gem 'minitest', '~> 5.11.0', feature_category: :shared @@ -565,7 +558,7 @@ group :development, :test, :coverage do gem 'simplecov', '~> 0.22', require: false, feature_category: :tooling gem 'simplecov-lcov', '~> 0.8.0', require: false, feature_category: :tooling gem 'simplecov-cobertura', '~> 2.1.0', require: false, feature_category: :tooling - gem 'undercover', '~> 0.6.0', require: false, feature_category: :tooling + gem 'undercover', '~> 0.7.0', require: false, feature_category: :tooling end # Gems required in omnibus-gitlab pipeline @@ -646,7 +639,7 @@ gem 'spamcheck', '~> 1.3.0', feature_category: :insider_threat gem 'gitaly', '~> 18.1.0.pre.rc1', feature_category: :gitaly # KAS GRPC protocol definitions -gem 'gitlab-kas-grpc', '~> 17.11.0', feature_category: :deployment_management +gem 'gitlab-kas-grpc', '~> 18.1.0', feature_category: :deployment_management # Lock until 1.74.0 is available # https://gitlab.com/gitlab-com/gl-infra/production/-/issues/20067 @@ -728,6 +721,7 @@ gem 'arr-pm', '~> 0.0.12', feature_category: :package_registry # Remote Development gem 'devfile', '~> 0.4.4', feature_category: :workspaces +gem 'hashdiff', '~> 1.2.0', feature_category: :workspaces # Apple plist parsing gem 'CFPropertyList', '~> 3.0.0', feature_category: :mobile_devops @@ -758,4 +752,4 @@ gem 'paper_trail', '~> 16.0', feature_category: :shared gem "i18n_data", "~> 0.13.1", feature_category: :system_access -gem "gitlab-cloud-connector", "~> 1.14", require: 'gitlab/cloud_connector', feature_category: :cloud_connector +gem "gitlab-cloud-connector", "~> 1.21", require: 'gitlab/cloud_connector', feature_category: :plan_provisioning diff --git a/pkgs/by-name/gi/gitlab/rubyEnv/Gemfile.lock b/pkgs/by-name/gi/gitlab/rubyEnv/Gemfile.lock index e5a452a4d519..7b7363c6267c 100644 --- a/pkgs/by-name/gi/gitlab/rubyEnv/Gemfile.lock +++ b/pkgs/by-name/gi/gitlab/rubyEnv/Gemfile.lock @@ -4,6 +4,12 @@ PATH activerecord-gitlab (0.2.0) activerecord (>= 7) +PATH + remote: gems/bundler-checksum + specs: + bundler-checksum (0.1.0) + bundler + PATH remote: gems/click_house-client specs: @@ -126,21 +132,6 @@ PATH diffy (~> 3.4) oj (~> 3.16, >= 3.16.10) -PATH - remote: vendor/gems/bundler-checksum - specs: - bundler-checksum (0.1.0) - bundler - -PATH - remote: vendor/gems/cloud_profiler_agent - specs: - cloud_profiler_agent (0.0.1.pre) - google-cloud-profiler-v2 (~> 0.3) - google-protobuf (~> 3.25) - googleauth (>= 0.14) - stackprof (~> 0.2) - PATH remote: vendor/gems/devise-pbkdf2-encryptable specs: @@ -217,8 +208,8 @@ GEM nkf rexml RedCloth (4.3.4) - acme-client (2.0.21) - base64 (~> 0.2.0) + acme-client (2.0.22) + base64 (~> 0.2) faraday (>= 1.0, < 3.0.0) faraday-retry (>= 1.0, < 3.0.0) actioncable (7.1.5.1) @@ -343,8 +334,8 @@ GEM awrence (1.2.1) aws-eventstream (1.3.0) aws-partitions (1.1001.0) - aws-sdk-cloudformation (1.131.0) - aws-sdk-core (~> 3, >= 3.216.0) + aws-sdk-cloudformation (1.133.0) + aws-sdk-core (~> 3, >= 3.225.0) aws-sigv4 (~> 1.5) aws-sdk-core (3.225.0) aws-eventstream (~> 1, >= 1.3.0) @@ -446,7 +437,7 @@ GEM descendants_tracker (~> 0.0.1) colored2 (3.1.2) commonmarker (0.23.11) - concurrent-ruby (1.2.3) + concurrent-ruby (1.3.5) connection_pool (2.5.3) console (1.29.2) fiber-annotation @@ -489,7 +480,7 @@ GEM danger-gitlab (8.0.0) danger gitlab (~> 4.2, >= 4.2.0) - database_cleaner-active_record (2.2.0) + database_cleaner-active_record (2.2.1) activerecord (>= 5.a) database_cleaner-core (~> 2.0.0) database_cleaner-core (2.0.1) @@ -552,7 +543,7 @@ GEM jwt (>= 2.5) ostruct (>= 0.5) dotenv (2.7.6) - drb (2.2.1) + drb (2.2.3) dry-cli (1.0.0) dry-core (1.0.1) concurrent-ruby (~> 1.0) @@ -608,9 +599,9 @@ GEM html-pipeline (~> 2.9) factory_bot (6.5.0) activesupport (>= 5.0.0) - factory_bot_rails (6.4.4) + factory_bot_rails (6.5.0) factory_bot (~> 6.5) - railties (>= 5.0.0) + railties (>= 6.1.0) faraday (2.13.1) faraday-net_http (>= 2.0, < 3.5) json @@ -619,7 +610,7 @@ GEM faraday (>= 1, < 3) faraday-http-cache (2.5.0) faraday (>= 0.8) - faraday-multipart (1.1.0) + faraday-multipart (1.1.1) multipart-post (~> 2.0) faraday-net_http (3.1.0) net-http @@ -734,10 +725,10 @@ GEM terminal-table (>= 1.5.1) gitlab-chronic (0.10.6) numerizer (~> 0.2) - gitlab-cloud-connector (1.17.0) + gitlab-cloud-connector (1.21.0) activesupport (~> 7.0) jwt (~> 2.9.3) - gitlab-crystalball (1.1.0) + gitlab-crystalball (1.1.1) git (< 4) ostruct (< 1) gitlab-dangerfiles (4.9.2) @@ -758,15 +749,17 @@ GEM nokogiri (~> 1, >= 1.10.8) gitlab-glfm-markdown (0.0.31) rb_sys (~> 0.9.109) - gitlab-kas-grpc (17.11.3) + gitlab-kas-grpc (18.1.0) grpc (~> 1.0) - gitlab-labkit (0.37.0) + gitlab-labkit (0.39.0) actionpack (>= 5.0.0, < 8.1.0) activesupport (>= 5.0.0, < 8.1.0) + google-protobuf (~> 3) grpc (>= 1.62) jaeger-client (~> 1.1.0) opentracing (~> 0.4) - pg_query (>= 5.1.0, < 7.0) + pg_query (>= 6.1.0, < 7.0) + prometheus-client-mmap (~> 1.2.9) redis (> 3.0.0, < 6.0.0) gitlab-license (2.6.0) gitlab-mail_room (0.0.27) @@ -782,7 +775,7 @@ GEM activesupport (>= 5.2.0) rake (~> 13.0) snowplow-tracker (~> 0.8.0) - gitlab-secret_detection (0.29.1) + gitlab-secret_detection (0.33.0) grpc (>= 1.63.0, < 2) grpc_reflection (~> 0.1) parallel (~> 1) @@ -790,9 +783,10 @@ GEM sentry-ruby (~> 5.22) stackprof (~> 0.2.27) toml-rb (~> 2.2) - gitlab-security_report_schemas (0.1.2.min15.0.0.max15.2.1) + gitlab-security_report_schemas (0.1.3.min15.0.0.max15.2.2) activesupport (>= 6, < 8) json_schemer (~> 2.3.0) + mutex_m (~> 0.3.0) gitlab-styles (13.1.0) rubocop (= 1.71.1) rubocop-capybara (~> 2.21.0) @@ -887,9 +881,6 @@ GEM google-cloud-location (0.6.0) gapic-common (>= 0.20.0, < 2.a) google-cloud-errors (~> 1.0) - google-cloud-profiler-v2 (0.4.0) - gapic-common (>= 0.18.0, < 2.a) - google-cloud-errors (~> 1.0) google-cloud-storage (1.45.0) addressable (~> 2.8) digest-crc (~> 0.4) @@ -995,7 +986,7 @@ GEM thor tilt hana (1.3.7) - hashdiff (1.1.0) + hashdiff (1.2.0) hashie (5.0.0) health_check (3.1.0) railties (>= 5.0) @@ -1104,7 +1095,7 @@ GEM language_server-protocol (3.17.0.3) launchy (2.5.2) addressable (~> 2.8) - lefthook (1.11.13) + lefthook (1.11.16) letter_opener (1.10.0) launchy (>= 2.2, < 4) letter_opener_web (3.0.0) @@ -1259,7 +1250,7 @@ GEM ostruct (>= 0.2) oj-introspect (0.8.0) oj (>= 3.16.10) - omniauth (2.1.2) + omniauth (2.1.3) hashie (>= 3.4.6) rack (>= 2.2.3) rack-protection @@ -1312,7 +1303,7 @@ GEM opensearch-ruby (3.4.0) faraday (>= 1.0, < 3) multi_json (>= 1.0) - openssl (3.2.0) + openssl (3.3.0) openssl-signature_algorithm (1.3.0) openssl (> 2.0) opentelemetry-api (1.2.5) @@ -1516,7 +1507,7 @@ GEM pyu-ruby-sasl (0.0.3.3) raabro (1.4.0) racc (1.8.1) - rack (2.2.13) + rack (2.2.17) rack-accept (0.4.5) rack (>= 0.4) rack-attack (6.7.0) @@ -1588,7 +1579,7 @@ GEM rake-compiler-dock (= 1.9.1) rbs (3.6.1) logger - rbtrace (0.5.1) + rbtrace (0.5.2) ffi (>= 1.0.6) msgpack (>= 0.4.3) optimist (>= 3.0.0) @@ -1726,9 +1717,6 @@ GEM rubocop-rspec_rails (2.30.0) rubocop (~> 1.61) rubocop-rspec (~> 3, >= 3.0.1) - ruby-fogbugz (0.3.0) - crack (~> 0.4) - multipart-post (~> 2.0) ruby-lsp (0.23.20) language_server-protocol (~> 3.17.0) prism (>= 1.2, < 2.0) @@ -1736,7 +1724,7 @@ GEM sorbet-runtime (>= 0.5.10782) ruby-lsp-rails (0.3.31) ruby-lsp (>= 0.23.0, < 0.24.0) - ruby-lsp-rspec (0.1.23) + ruby-lsp-rspec (0.1.24) ruby-lsp (~> 0.23.19) ruby-magic (0.6.0) mini_portile2 (~> 2.8) @@ -1845,7 +1833,7 @@ GEM tilt (~> 2.0) yard (~> 0.9, >= 0.9.24) yard-solargraph (~> 0.1) - solargraph-rspec (0.5.1) + solargraph-rspec (0.5.2) solargraph (~> 0.52, >= 0.52.0) sorbet-runtime (0.5.11647) spamcheck (1.3.3) @@ -1854,7 +1842,8 @@ GEM spring-commands-rspec (1.0.4) spring (>= 0.9.1) sprite-factory (1.7.1) - sprockets (3.7.2) + sprockets (3.7.5) + base64 concurrent-ruby (~> 1.0) rack (> 1, < 3) sprockets-rails (3.5.2) @@ -1961,12 +1950,14 @@ GEM tzinfo (2.0.6) concurrent-ruby (~> 1.0) uber (0.1.0) - undercover (0.6.4) + undercover (0.7.0) base64 bigdecimal imagen (>= 0.2.0) rainbow (>= 2.1, < 4.0) rugged (>= 0.27, < 1.10) + simplecov + simplecov_json_formatter unf (0.1.4) unf_ext unf_ext (0.0.8.2) @@ -2084,7 +2075,7 @@ DEPENDENCIES benchmark-ips (~> 2.14.0) benchmark-memory (~> 0.1) better_errors (~> 2.10.1) - bootsnap (~> 1.18.3) + bootsnap (~> 1.18.6) browser (~> 5.3.1) bullet (~> 8.0.0) bundler-checksum (~> 0.1.0)! @@ -2094,7 +2085,6 @@ DEPENDENCIES charlock_holmes (~> 0.7.9) circuitbox (= 2.0.0) click_house-client! - cloud_profiler_agent (~> 0.0.0)! commonmarker (~> 0.23.10) concurrent-ruby (~> 1.1) connection_pool (~> 2.5.3) @@ -2128,7 +2118,7 @@ DEPENDENCIES email_reply_trimmer (~> 0.1) email_spec (~> 2.3.0) error_tracking_open_api! - factory_bot_rails (~> 6.4.3) + factory_bot_rails (~> 6.5.0) faraday (~> 2) faraday-multipart (~> 1.0) faraday-retry (~> 2) @@ -2154,7 +2144,7 @@ DEPENDENCIES gitlab-active-context! gitlab-backup-cli! gitlab-chronic (~> 0.10.5) - gitlab-cloud-connector (~> 1.14) + gitlab-cloud-connector (~> 1.21) gitlab-crystalball (~> 1.1.0) gitlab-dangerfiles (~> 4.9.0) gitlab-duo-workflow-service-client (~> 0.2)! @@ -2163,8 +2153,8 @@ DEPENDENCIES gitlab-glfm-markdown (~> 0.0.31) gitlab-housekeeper! gitlab-http! - gitlab-kas-grpc (~> 17.11.0) - gitlab-labkit (~> 0.37.0) + gitlab-kas-grpc (~> 18.1.0) + gitlab-labkit (~> 0.39.0) gitlab-license (~> 2.6) gitlab-mail_room (~> 0.0.24) gitlab-markup (~> 2.0.0) @@ -2175,7 +2165,7 @@ DEPENDENCIES gitlab-schema-validation! gitlab-sdk (~> 0.3.0) gitlab-secret_detection (< 1.0) - gitlab-security_report_schemas (= 0.1.2.min15.0.0.max15.2.1) + gitlab-security_report_schemas (= 0.1.3.min15.0.0.max15.2.2) gitlab-sidekiq-fetcher! gitlab-styles (~> 13.1.0) gitlab-topology-service-client (~> 0.1)! @@ -2215,6 +2205,7 @@ DEPENDENCIES guard-rspec haml_lint (~> 0.58) hamlit (~> 2.15.0) + hashdiff (~> 1.2.0) hashie (~> 5.0.0) health_check (~> 3.0) html-pipeline (~> 2.14.3) @@ -2354,7 +2345,6 @@ DEPENDENCIES rspec_junit_formatter rspec_profiling (~> 0.0.9) rubocop - ruby-fogbugz (~> 0.3.0) ruby-lsp (~> 0.23.0) ruby-lsp-rails (~> 0.3.6) ruby-lsp-rspec (~> 0.1.10) @@ -2405,7 +2395,7 @@ DEPENDENCIES truncato (~> 0.7.13) tty-prompt (~> 0.23) typhoeus (~> 1.4.0) - undercover (~> 0.6.0) + undercover (~> 0.7.0) unicode-emoji (~> 4.0) unleash (~> 3.2.2) uri (= 0.13.2) diff --git a/pkgs/by-name/gi/gitlab/rubyEnv/gemset.nix b/pkgs/by-name/gi/gitlab/rubyEnv/gemset.nix index 4edeca120f33..9042ca7c22c3 100644 --- a/pkgs/by-name/gi/gitlab/rubyEnv/gemset.nix +++ b/pkgs/by-name/gi/gitlab/rubyEnv/gemset.nix @@ -9,10 +9,10 @@ src: { platforms = [ ]; source = { remotes = [ "https://rubygems.org" ]; - sha256 = "0hbn563v0rc85md0fcx3z968dvq7n2ra64wbgyxg09ndjgwl9870"; + sha256 = "1xvnj58nln2xa8vlxc1v4zgyda4n387npbcd94z3pjg28fvk8xc1"; type = "gem"; }; - version = "2.0.21"; + version = "2.0.22"; }; actioncable = { dependencies = [ @@ -557,10 +557,10 @@ src: { platforms = [ ]; source = { remotes = [ "https://rubygems.org" ]; - sha256 = "1bkkx0sz1lkqhzkrpklnalpv2dshvrdi12yq47xmv0nflhgzysmp"; + sha256 = "08d3khg5bpi73vmghphr5w4acds2vr8gcdpm93fsaj38wvb960s9"; type = "gem"; }; - version = "1.131.0"; + version = "1.133.0"; }; aws-sdk-core = { dependencies = [ @@ -925,7 +925,7 @@ src: { groups = [ "default" ]; platforms = [ ]; source = { - path = "${src}/vendor/gems/bundler-checksum"; + path = "${src}/gems/bundler-checksum"; type = "path"; }; version = "0.1.0"; @@ -1145,21 +1145,6 @@ src: { }; version = "0.1.0"; }; - cloud_profiler_agent = { - dependencies = [ - "google-cloud-profiler-v2" - "google-protobuf" - "googleauth" - "stackprof" - ]; - groups = [ "default" ]; - platforms = [ ]; - source = { - path = "${src}/vendor/gems/cloud_profiler_agent"; - type = "path"; - }; - version = "0.0.1.pre"; - }; coderay = { groups = [ "default" @@ -1232,10 +1217,10 @@ src: { platforms = [ ]; source = { remotes = [ "https://rubygems.org" ]; - sha256 = "1qh1b14jwbbj242klkyz5fc7npd4j0mvndz62gajhvl1l3wd7zc2"; + sha256 = "1ipbrgvf0pp6zxdk5ascp6i29aybz2bx9wdrlchjmpx6mhvkwfw1"; type = "gem"; }; - version = "1.2.3"; + version = "1.3.5"; }; connection_pool = { groups = [ @@ -1478,10 +1463,10 @@ src: { platforms = [ ]; source = { remotes = [ "https://rubygems.org" ]; - sha256 = "1iz1hv2b1z7509dxvxdwzay1hhs24glxls5ldbyh688zxkcdca1j"; + sha256 = "1jxzgg3yccp3gjncl5ih0y13dcappmy0y8pq85wgjj0yx5fh0ixy"; type = "gem"; }; - version = "2.2.0"; + version = "2.2.1"; }; database_cleaner-core = { groups = [ @@ -1809,15 +1794,17 @@ src: { drb = { groups = [ "default" + "development" + "monorepo" "test" ]; platforms = [ ]; source = { remotes = [ "https://rubygems.org" ]; - sha256 = "0h5kbj9hvg5hb3c7l425zpds0vb42phvln2knab8nmazg2zp5m79"; + sha256 = "0wrkl7yiix268s2md1h6wh91311w95ikd8fy8m5gx589npyxc00b"; type = "gem"; }; - version = "2.2.1"; + version = "2.2.3"; }; dry-cli = { groups = [ "default" ]; @@ -2192,10 +2179,10 @@ src: { platforms = [ ]; source = { remotes = [ "https://rubygems.org" ]; - sha256 = "122wkrc3d2q1dlca27794hh3arw0kvrf3rgmvn7hj3y5lb51g7hk"; + sha256 = "18n06y5ww7d08w296b6fpzx05yywp5r8p88j0k37r994aiin2ysa"; type = "gem"; }; - version = "6.4.4"; + version = "6.5.0"; }; faraday = { dependencies = [ @@ -2250,10 +2237,10 @@ src: { platforms = [ ]; source = { remotes = [ "https://rubygems.org" ]; - sha256 = "0l87r9jg06nsh24gwwd1jdnxb1zq89ffybnxab0dd90nfcf0ysw5"; + sha256 = "00w9imp55hi81q0wsgwak90ldkk7gbyb8nzmmv8hy0s907s8z8bp"; type = "gem"; }; - version = "1.1.0"; + version = "1.1.1"; }; faraday-net_http = { dependencies = [ "net-http" ]; @@ -2857,10 +2844,10 @@ src: { platforms = [ ]; source = { remotes = [ "https://rubygems.org" ]; - sha256 = "0d5zrz5vgb8zrnri42awqfvcq9kfzlrc032nprknddpb9iagbsmr"; + sha256 = "02bpl0jz8m7kfa5alkc90cbajkxy5fggva10zh7cgii3y912msqn"; type = "gem"; }; - version = "1.17.0"; + version = "1.21.0"; }; gitlab-crystalball = { dependencies = [ @@ -2874,10 +2861,10 @@ src: { platforms = [ ]; source = { remotes = [ "https://rubygems.org" ]; - sha256 = "1a42qg2m7w0qn7as3zrc4v7lrxig532izi7yb2w8rbcwm114fcdx"; + sha256 = "1vdqa11dchcmlkph9almmxjq9qsgcfv0n460lyghx7l0n09s2r04"; type = "gem"; }; - version = "1.1.0"; + version = "1.1.1"; }; gitlab-dangerfiles = { dependencies = [ @@ -2994,29 +2981,31 @@ src: { platforms = [ ]; source = { remotes = [ "https://rubygems.org" ]; - sha256 = "0lsz61cr7i3d72i6rxvbfqbq6f5anzbbmhmrmr7mprna4dy93d7q"; + sha256 = "07d5jav33nvl83s83yd9fg6vv636n65ybni6m6k3yvlfxygpb3wn"; type = "gem"; }; - version = "17.11.3"; + version = "18.1.0"; }; gitlab-labkit = { dependencies = [ "actionpack" "activesupport" + "google-protobuf" "grpc" "jaeger-client" "opentracing" "pg_query" + "prometheus-client-mmap" "redis" ]; groups = [ "default" ]; platforms = [ ]; source = { remotes = [ "https://rubygems.org" ]; - sha256 = "0w7szxnvh9hvxcragnqvn37c6jpm4gf7aadzxslajj91vdh0mpfj"; + sha256 = "07jpj78nnjmgz9brxxzqbx7l9fajyfq74l4vjavqmnff18vgr0gf"; type = "gem"; }; - version = "0.37.0"; + version = "0.39.0"; }; gitlab-license = { groups = [ "default" ]; @@ -3156,24 +3145,25 @@ src: { platforms = [ ]; source = { remotes = [ "https://rubygems.org" ]; - sha256 = "0b4908vic675qq1mh1i45vh5z9vdg1ynanxdbdzaazxvjkakdwzd"; + sha256 = "14ds4l7802ypxx56pid7xlhnlbk5ir9zc8adfm96yy9k2sgfmdnf"; type = "gem"; }; - version = "0.29.1"; + version = "0.33.0"; }; gitlab-security_report_schemas = { dependencies = [ "activesupport" "json_schemer" + "mutex_m" ]; groups = [ "default" ]; platforms = [ ]; source = { remotes = [ "https://rubygems.org" ]; - sha256 = "1bl0qrmb6xci719zxnaizja2pf0wabzi91b49y0immf9gr43f01h"; + sha256 = "0v4sfh2497g5w5hhf89wjgvjbasa13hfgm0r05myzd5hbv7v2h3f"; type = "gem"; }; - version = "0.1.2.min15.0.0.max15.2.1"; + version = "0.1.3.min15.0.0.max15.2.2"; }; gitlab-sidekiq-fetcher = { dependencies = [ @@ -3589,20 +3579,6 @@ src: { }; version = "0.6.0"; }; - google-cloud-profiler-v2 = { - dependencies = [ - "gapic-common" - "google-cloud-errors" - ]; - groups = [ "default" ]; - platforms = [ ]; - source = { - remotes = [ "https://rubygems.org" ]; - sha256 = "1qyknlvwji7vqhani490cacsrzlqfza10hv47him93yhfnqjmz2k"; - type = "gem"; - }; - version = "0.4.0"; - }; google-cloud-storage = { dependencies = [ "addressable" @@ -4050,10 +4026,10 @@ src: { platforms = [ ]; source = { remotes = [ "https://rubygems.org" ]; - sha256 = "1jf9dxgjz6z7fvymyz2acyvn9iyvwkn6d9sk7y4fxwbmfc75yimm"; + sha256 = "1da0w5v7ppxrgvh58bafjklzv73nknyq73if6d9rkz2v24zg3169"; type = "gem"; }; - version = "1.1.0"; + version = "1.2.0"; }; hashie = { groups = [ "default" ]; @@ -4697,10 +4673,10 @@ src: { platforms = [ ]; source = { remotes = [ "https://rubygems.org" ]; - sha256 = "18msiw0b3krm9krxrahiladblh6pjpj395wcjjw2fvsimwyy7vk4"; + sha256 = "11g6iqlsck4ypjfg1b7pkcisy5qbm774rwbwdz2rka5lcccky9qs"; type = "gem"; }; - version = "1.11.13"; + version = "1.11.16"; }; letter_opener = { dependencies = [ "launchy" ]; @@ -5672,10 +5648,10 @@ src: { platforms = [ ]; source = { remotes = [ "https://rubygems.org" ]; - sha256 = "1km0wqx9pj609jidvrqfsvzbzfgdnlpdnv7i7xfqm3wb55vk5w6y"; + sha256 = "1hjnb5b5m549irs0h1455ipzsv82pikdagx9wjb6r4j1bkjy494d"; type = "gem"; }; - version = "2.1.2"; + version = "2.1.3"; }; omniauth-alicloud = { dependencies = [ "omniauth-oauth2" ]; @@ -5920,10 +5896,10 @@ src: { platforms = [ ]; source = { remotes = [ "https://rubygems.org" ]; - sha256 = "054d6ybgjdzxw567m7rbnd46yp6gkdbc5ihr536vxd3p15vbhjrw"; + sha256 = "0ygfbbs3c61d32ymja2k6sznj5pr540cip9z91lhzcvsr4zmffpz"; type = "gem"; }; - version = "3.2.0"; + version = "3.3.0"; }; openssl-signature_algorithm = { dependencies = [ "openssl" ]; @@ -6960,10 +6936,10 @@ src: { platforms = [ ]; source = { remotes = [ "https://rubygems.org" ]; - sha256 = "1yzhcwvfkrlb8l79w24yjclv636jn6rnznp95shmssk934bi1vnc"; + sha256 = "1pcr8sn02lwzv3z6vx5n41b6ybcnw9g9h05s3lkv4vqdm0f2mq2z"; type = "gem"; }; - version = "2.2.13"; + version = "2.2.17"; }; rack-accept = { dependencies = [ "rack" ]; @@ -7314,10 +7290,10 @@ src: { platforms = [ ]; source = { remotes = [ "https://rubygems.org" ]; - sha256 = "1p65p6f917al0f07sn5ca9yj92f7mk52xgnp0ahqpyrb8r6sdjz8"; + sha256 = "158qydqnrn1r0gm806j0bn439y0dyzdpscwi1sm3ldl1mcid5mx2"; type = "gem"; }; - version = "0.5.1"; + version = "0.5.2"; }; rchardet = { groups = [ @@ -8063,20 +8039,6 @@ src: { }; version = "2.30.0"; }; - ruby-fogbugz = { - dependencies = [ - "crack" - "multipart-post" - ]; - groups = [ "default" ]; - platforms = [ ]; - source = { - remotes = [ "https://rubygems.org" ]; - sha256 = "0mznsnhsgh1yg57j5gighr9vjricnix1l7ngf654k3v4fkjcs12y"; - type = "gem"; - }; - version = "0.3.0"; - }; ruby-lsp = { dependencies = [ "language_server-protocol" @@ -8110,10 +8072,10 @@ src: { platforms = [ ]; source = { remotes = [ "https://rubygems.org" ]; - sha256 = "1lv886262vzmjpgcd0759zn86yaidjn1wznnscn75saj4d81bafj"; + sha256 = "08m2fw4f784lkbyz5rbzdhj57p0x2pfygk66ls0qsn5avnv7izs1"; type = "gem"; }; - version = "0.1.23"; + version = "0.1.24"; }; ruby-magic = { dependencies = [ "mini_portile2" ]; @@ -8704,10 +8666,10 @@ src: { platforms = [ ]; source = { remotes = [ "https://rubygems.org" ]; - sha256 = "1kpsdfkj6yvd5ndhj5vbll4591lwg4gjrf5c61ffj8vvy4j93z0d"; + sha256 = "1wxzz7580h6k2sghj9p1ss33i6nlmpmwqawi6ilr87si233rwgxc"; type = "gem"; }; - version = "0.5.1"; + version = "0.5.2"; }; sorbet-runtime = { groups = [ @@ -8772,21 +8734,18 @@ src: { }; sprockets = { dependencies = [ + "base64" "concurrent-ruby" "rack" ]; - groups = [ - "default" - "development" - "test" - ]; + groups = [ "default" ]; platforms = [ ]; source = { remotes = [ "https://rubygems.org" ]; - sha256 = "182jw5a0fbqah5w9jancvfmjbk88h8bxdbwnl4d3q809rpxdg8ay"; + sha256 = "10ykzsa76cf8kvbfkszlvbyn4ckcx1mxjhfvwxzs7y28cljhzhkj"; type = "gem"; }; - version = "3.7.2"; + version = "3.7.5"; }; sprockets-rails = { dependencies = [ @@ -9475,6 +9434,8 @@ src: { "imagen" "rainbow" "rugged" + "simplecov" + "simplecov_json_formatter" ]; groups = [ "coverage" @@ -9484,10 +9445,10 @@ src: { platforms = [ ]; source = { remotes = [ "https://rubygems.org" ]; - sha256 = "06pc56qly4c8ygwg9hyay1vmxq75clm62ljw0s9ljamm57qzqd1w"; + sha256 = "0kd7rk9qf9gx53i8jrkc1fjl2bjjxyw9cd1i784ipnfl3dc0da8s"; type = "gem"; }; - version = "0.6.4"; + version = "0.7.0"; }; unf = { dependencies = [ "unf_ext" ]; diff --git a/pkgs/by-name/go/google-chrome/package.nix b/pkgs/by-name/go/google-chrome/package.nix index 27dd1eab9d8c..70cf21c06170 100644 --- a/pkgs/by-name/go/google-chrome/package.nix +++ b/pkgs/by-name/go/google-chrome/package.nix @@ -171,11 +171,11 @@ let linux = stdenvNoCC.mkDerivation (finalAttrs: { inherit pname meta passthru; - version = "138.0.7204.100"; + version = "138.0.7204.157"; src = fetchurl { url = "https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-stable/google-chrome-stable_${finalAttrs.version}-1_amd64.deb"; - hash = "sha256-H22aDTMvbUsbBWasGjCP1dUKmYzD9/6TIzfBpahAnA8="; + hash = "sha256-QmWevU4cYmUc6lUbFG4bQ1aKFuUyIUorJjMMF14bzZ4="; }; # With strictDeps on, some shebangs were not being patched correctly @@ -276,11 +276,11 @@ let darwin = stdenvNoCC.mkDerivation (finalAttrs: { inherit pname meta passthru; - version = "138.0.7204.101"; + version = "138.0.7204.158"; src = fetchurl { - url = "http://dl.google.com/release2/chrome/h7v73czgelyzwk2xfcs2gkpkwm_138.0.7204.101/GoogleChrome-138.0.7204.101.dmg"; - hash = "sha256-gG20H5QsVmnfRi+Zo+OiLTLlPP2cLp6W+JaJoRE0QtI="; + url = "http://dl.google.com/release2/chrome/adskeulizkrq3h2yvus65pybna6a_138.0.7204.158/GoogleChrome-138.0.7204.158.dmg"; + hash = "sha256-D7Iik+R9PIfvL1QEASfip5M2pE+nco90dKet4Fehq/8="; }; dontPatch = true; diff --git a/pkgs/by-name/ha/haxor-news/package.nix b/pkgs/by-name/ha/haxor-news/package.nix index c0923839d41b..d57a43d20c95 100644 --- a/pkgs/by-name/ha/haxor-news/package.nix +++ b/pkgs/by-name/ha/haxor-news/package.nix @@ -2,51 +2,23 @@ lib, fetchFromGitHub, fetchPypi, - python3, + python3Packages, }: -let - py = python3.override { - self = py; - packageOverrides = self: super: { - # not compatible with prompt_toolkit >=2.0 - prompt-toolkit = super.prompt-toolkit.overridePythonAttrs (oldAttrs: rec { - name = "${oldAttrs.pname}-${version}"; - version = "1.0.18"; - src = oldAttrs.src.override { - inherit version; - hash = "sha256-3U/KAsgGlJetkxotCZFMaw0bUBUc6Ha8Fb3kx0cJASY="; - }; - }); - # Use click 7 - click = super.click.overridePythonAttrs (old: rec { - version = "7.1.2"; - src = fetchPypi { - pname = "click"; - inherit version; - hash = "sha256-0rUlXHxjSbwb0eWeCM0SrLvWPOZJ8liHVXg6qU37axo="; - }; - disabledTests = [ "test_bytes_args" ]; - }); - }; - }; -in -with py.pkgs; - -buildPythonApplication rec { +python3Packages.buildPythonApplication rec { pname = "haxor-news"; - version = "unstable-2020-10-20"; + version = "unstable-2022-04-22"; format = "setuptools"; # haven't done a stable release in 3+ years, but actively developed src = fetchFromGitHub { owner = "donnemartin"; repo = "haxor-news"; - rev = "811a5804c09406465b2b02eab638c08bf5c4fa7f"; - hash = "sha256-5v61b49ttwqPOvtoykJBBzwVSi7S8ARlakccMr12bbw="; + rev = "8294e4498858f036a344b06e82f08b834c2a8270"; + hash = "sha256-0eVk5zj7F3QDFvV0Kv9aeV1oeKxr/Kza6M3pK6hyYuY="; }; - propagatedBuildInputs = [ + propagatedBuildInputs = with python3Packages; [ click colorama requests @@ -58,7 +30,7 @@ buildPythonApplication rec { # will fail without pre-seeded config files doCheck = false; - nativeCheckInputs = [ + nativeCheckInputs = with python3Packages; [ unittestCheckHook mock ]; diff --git a/pkgs/by-name/ho/homebridge-config-ui-x/package.nix b/pkgs/by-name/ho/homebridge-config-ui-x/package.nix new file mode 100644 index 000000000000..e63069768dda --- /dev/null +++ b/pkgs/by-name/ho/homebridge-config-ui-x/package.nix @@ -0,0 +1,69 @@ +{ + lib, + stdenv, + buildNpmPackage, + fetchFromGitHub, + fetchNpmDeps, + npmHooks, + python3, + cacert, +}: + +buildNpmPackage (finalAttrs: { + pname = "homebridge-config-ui-x"; + version = "5.1.0"; + + src = fetchFromGitHub { + owner = "homebridge"; + repo = "homebridge-config-ui-x"; + tag = "v${finalAttrs.version}"; + hash = "sha256-asyNIiNv0bGD6fT4VTSp1W6f3dudkdZsVOc3KKOi4OY="; + }; + + # Deps hash for the root package + npmDepsHash = "sha256-XkdpR8yDNuP+681JIsKwHnY/Us83JGaAXJNBnGIU2UI="; + + # Deps src and hash for ui subdirectory + npmDeps_ui = fetchNpmDeps { + name = "npm-deps-ui"; + src = "${finalAttrs.src}/ui"; + hash = "sha256-vwJcls72nzbbtC4YXasgGWtgIVV4AMuNwIkEJuubP2Q="; + }; + + # Need to also run npm ci in the ui subdirectory + preBuild = '' + # Tricky way to run npmConfigHook multiple times + ( + source ${npmHooks.npmConfigHook}/nix-support/setup-hook + npmRoot=ui npmDeps=${finalAttrs.npmDeps_ui} makeCacheWritable= npmConfigHook + ) + # Required to prevent "ng build" from failing due to + # prompting user for autocompletion + export CI=true + ''; + + # On darwin, the build failed because openpty() is not declared + # Uses the prebuild version of @homebridge/node-pty-prebuilt-multiarch instead + # Remove this (and the makeCacheWritable in preBuild), once we fix + # compiling node-pty on darwin + makeCacheWritable = stdenv.hostPlatform.isDarwin; + + nativeBuildInputs = [ + python3 + ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ cacert ]; + + meta = { + description = "Configure Homebridge, monitor and backup from a browser"; + homepage = "https://github.com/homebridge/homebridge-config-ui-x"; + license = lib.licenses.mit; + mainProgram = "homebridge-config-ui-x"; + platforms = lib.platforms.linux ++ lib.platforms.darwin; + maintainers = with lib.maintainers; [ fmoda3 ]; + # Works on darwin when not in sandbox because it downloads a prebuilt binary + # for node-pty at build time, which does not work in sandbox. + # Need to figure out why this error occurs: + # ../src/unix/pty.cc:478:13: error: use of undeclared identifier 'openpty' + # int ret = openpty(&master, &slave, nullptr, NULL, static_cast(&winp)); + broken = stdenv.hostPlatform.isDarwin; + }; +}) diff --git a/pkgs/by-name/ho/homebridge/package.nix b/pkgs/by-name/ho/homebridge/package.nix new file mode 100644 index 000000000000..950cc87a715c --- /dev/null +++ b/pkgs/by-name/ho/homebridge/package.nix @@ -0,0 +1,37 @@ +{ + lib, + buildNpmPackage, + fetchFromGitHub, + jq, +}: + +buildNpmPackage (finalAttrs: { + pname = "homebridge"; + version = "1.11.0"; + + src = fetchFromGitHub { + owner = "homebridge"; + repo = "homebridge"; + tag = "v${finalAttrs.version}"; + hash = "sha256-95wd3pVumz/KGZNjOHrSOUtI4vipeHRWK7D8e9Nzpyo="; + }; + + npmDepsHash = "sha256-fcahrKJXvEMosLbcZY6x/hklmAy4Dyf65xNfFPa4OpU="; + + # Homebridge's clean phase attempts to install rimraf directly, which fails in nix builds + # rimraf is already in the declared dependencies, so we just don't need to do it. + # This will replace "npm install rimraf && rimraf lib/" with "rimraf lib/". + preBuild = '' + cat package.json | ${jq}/bin/jq '.scripts.clean = "rimraf lib/"' > package.json.tmp + mv package.json.tmp package.json + ''; + + meta = { + description = "Lightweight emulator of iOS HomeKit API"; + homepage = "https://github.com/homebridge/homebridge"; + license = lib.licenses.asl20; + mainProgram = "homebridge"; + platforms = lib.platforms.linux ++ lib.platforms.darwin; + maintainers = with lib.maintainers; [ fmoda3 ]; + }; +}) diff --git a/pkgs/by-name/ht/httptoolkit/package.nix b/pkgs/by-name/ht/httptoolkit/package.nix index 2ee5de0eefad..71bb4d1dc716 100644 --- a/pkgs/by-name/ht/httptoolkit/package.nix +++ b/pkgs/by-name/ht/httptoolkit/package.nix @@ -6,10 +6,12 @@ makeWrapper, makeDesktopItem, copyDesktopItems, - electron, + electron_35, httptoolkit-server, }: - +let + electron = electron_35; +in buildNpmPackage rec { pname = "httptoolkit"; version = "1.20.1"; diff --git a/pkgs/by-name/ic/icloudpd/package.nix b/pkgs/by-name/ic/icloudpd/package.nix index 758b4f6c476d..1ad08d2ca142 100644 --- a/pkgs/by-name/ic/icloudpd/package.nix +++ b/pkgs/by-name/ic/icloudpd/package.nix @@ -9,14 +9,14 @@ python3Packages.buildPythonApplication rec { pname = "icloudpd"; - version = "1.28.2"; + version = "1.29.2"; pyproject = true; src = fetchFromGitHub { owner = "icloud-photos-downloader"; repo = "icloud_photos_downloader"; tag = "v${version}"; - hash = "sha256-5zuV32AOorkRqt3wiUt2ndo+4j1FQ9JBSc8wY+v01OA="; + hash = "sha256-V6y/JRRfvxfQE5+ZuM8N/jciWxRr9HI6PGjnzyJ2aP8="; }; pythonRelaxDeps = true; diff --git a/pkgs/by-name/jj/jjui/package.nix b/pkgs/by-name/jj/jjui/package.nix index 0bc4a7b2e3aa..40541c059da1 100644 --- a/pkgs/by-name/jj/jjui/package.nix +++ b/pkgs/by-name/jj/jjui/package.nix @@ -7,16 +7,16 @@ }: buildGoModule (finalAttrs: { pname = "jjui"; - version = "0.8.12"; + version = "0.9.0"; src = fetchFromGitHub { owner = "idursun"; repo = "jjui"; tag = "v${finalAttrs.version}"; - hash = "sha256-KqW5XwQxKF11qWXpqhcREVZHSVqPNnJCceaW0uvgpFg="; + hash = "sha256-FTFryzlU7PsrU2SkOdxYLunVrRKUauAwmzIkJe3xKlk="; }; - vendorHash = "sha256-2nUU5rrVWBk+9ljC+OiAVLcRnWghPPfpvq5yoNSRdVk="; + vendorHash = "sha256-oswFlMuoaTHfgpr2+o8EX80hl82H9JewPFk3khm8Il4="; ldflags = [ "-X main.Version=${finalAttrs.version}" ]; diff --git a/pkgs/by-name/ke/kew/package.nix b/pkgs/by-name/ke/kew/package.nix index 1e6cf769bbb3..3e31325173aa 100644 --- a/pkgs/by-name/ke/kew/package.nix +++ b/pkgs/by-name/ke/kew/package.nix @@ -33,13 +33,13 @@ in stdenv.mkDerivation (finalAttrs: { pname = "kew"; - version = "3.3.3"; + version = "3.4.0"; src = fetchFromGitHub { owner = "ravachol"; repo = "kew"; tag = "v${finalAttrs.version}"; - hash = "sha256-1PUvUFlRhGrZLjLwQrNb0kE695m5poSqrAIOBAnm3xk="; + hash = "sha256-dKjAv93NgP0iB5VMWWisvISXQOmx3lyUXG2zKCz2+Bc="; }; postPatch = '' diff --git a/pkgs/by-name/ke/keycloak/package.nix b/pkgs/by-name/ke/keycloak/package.nix index ed999f096682..14861246630a 100644 --- a/pkgs/by-name/ke/keycloak/package.nix +++ b/pkgs/by-name/ke/keycloak/package.nix @@ -1,8 +1,8 @@ { - stdenv, lib, + stdenv, fetchzip, - makeWrapper, + makeBinaryWrapper, jre_headless, nixosTests, callPackage, @@ -22,17 +22,17 @@ let ) "--features-disabled=${lib.concatStringsSep "," disabledFeatures}"} ''; in -stdenv.mkDerivation rec { +stdenv.mkDerivation (finalAttrs: { pname = "keycloak"; version = "26.3.1"; src = fetchzip { - url = "https://github.com/keycloak/keycloak/releases/download/${version}/keycloak-${version}.zip"; + url = "https://github.com/keycloak/keycloak/releases/download/${finalAttrs.version}/keycloak-${finalAttrs.version}.zip"; hash = "sha256-M3YbS/aK9y4N2kZrm1wNT1ZaWAaUwaRn9QQ8fMdOV5g="; }; nativeBuildInputs = [ - makeWrapper + makeBinaryWrapper jre_headless ]; @@ -104,5 +104,4 @@ stdenv.mkDerivation rec { leona ]; }; - -} +}) diff --git a/pkgs/by-name/la/lash/package.nix b/pkgs/by-name/la/lash/package.nix index c3ec6476b2a4..b5a69b2208f0 100644 --- a/pkgs/by-name/la/lash/package.nix +++ b/pkgs/by-name/la/lash/package.nix @@ -12,8 +12,6 @@ readline, }: -assert libuuid != null; - stdenv.mkDerivation rec { pname = "lash"; version = "0.5.4"; @@ -40,7 +38,9 @@ stdenv.mkDerivation rec { libxml2 readline ]; - propagatedBuildInputs = [ libuuid ]; + propagatedBuildInputs = + assert libuuid != null; + [ libuuid ]; NIX_LDFLAGS = "-lm -lpthread -luuid"; postInstall = '' diff --git a/pkgs/by-name/li/libpff/package.nix b/pkgs/by-name/li/libpff/package.nix index 31071f5ac9fb..dbc9b5d40f3d 100644 --- a/pkgs/by-name/li/libpff/package.nix +++ b/pkgs/by-name/li/libpff/package.nix @@ -6,13 +6,13 @@ autoreconfHook, }: -stdenv.mkDerivation rec { +stdenv.mkDerivation (finalAttrs: { pname = "libpff"; - version = "20211114"; + version = "20231205"; src = fetchzip { - url = "https://github.com/libyal/libpff/releases/download/${version}/libpff-alpha-${version}.tar.gz"; - sha256 = "sha256-UmGRBgi78nDSuuOXi/WmODojWU5AbQGKNQwLseoh714="; + url = "https://github.com/libyal/libpff/releases/download/${finalAttrs.version}/libpff-alpha-${finalAttrs.version}.tar.gz"; + hash = "sha256-VrdfZRC2iwTfv3YrObQvIH9QZPTi9pUQoAyUcBVJyes="; }; nativeBuildInputs = [ @@ -29,8 +29,8 @@ stdenv.mkDerivation rec { description = "Library and tools to access the Personal Folder File (PFF) and the Offline Folder File (OFF) format"; homepage = "https://github.com/libyal/libpff"; downloadPage = "https://github.com/libyal/libpff/releases"; - changelog = "https://github.com/libyal/libpff/blob/${version}/ChangeLog"; + changelog = "https://github.com/libyal/libpff/blob/${finalAttrs.version}/ChangeLog"; license = lib.licenses.lgpl3Only; maintainers = with lib.maintainers; [ hacker1024 ]; }; -} +}) diff --git a/pkgs/by-name/mi/misskey/package.nix b/pkgs/by-name/mi/misskey/package.nix index e840b4491f51..8f96f1353067 100644 --- a/pkgs/by-name/mi/misskey/package.nix +++ b/pkgs/by-name/mi/misskey/package.nix @@ -17,16 +17,20 @@ stdenv.mkDerivation (finalAttrs: { pname = "misskey"; - version = "2025.6.3"; + version = "2025.7.0"; src = fetchFromGitHub { owner = "misskey-dev"; repo = "misskey"; tag = finalAttrs.version; - hash = "sha256-6UZcIZlfcYcQgjR/jrNhsoLNQGml2tjK3LYLI0fdgMU="; + hash = "sha256-LtBggq60buNPnGPSbh+TcFODxCoqX+rFdX0P7dYMYI0="; fetchSubmodules = true; }; + patches = [ + ./pnpm-lock.yaml.patch + ]; + nativeBuildInputs = [ nodejs pnpm_9.configHook @@ -36,9 +40,14 @@ stdenv.mkDerivation (finalAttrs: { # https://nixos.org/manual/nixpkgs/unstable/#javascript-pnpm pnpmDeps = pnpm_9.fetchDeps { - inherit (finalAttrs) pname version src; - fetcherVersion = 1; - hash = "sha256-T8LwpEjeWNmkIo3Dn1BCFHBsTzA/Dt6/pk/NMtvT0N4="; + inherit (finalAttrs) + pname + version + src + patches + ; + fetcherVersion = 2; + hash = "sha256-5yuM56sLDSo4M5PDl3gUZOdSexW1YjfYBR3BJMqNHzU="; }; buildPhase = '' diff --git a/pkgs/by-name/mi/misskey/pnpm-lock.yaml.patch b/pkgs/by-name/mi/misskey/pnpm-lock.yaml.patch new file mode 100644 index 000000000000..a3db65c7e052 --- /dev/null +++ b/pkgs/by-name/mi/misskey/pnpm-lock.yaml.patch @@ -0,0 +1,270 @@ +--- a/pnpm-lock.yaml ++++ b/pnpm-lock.yaml +@@ -11,7 +11,7 @@ + + patchedDependencies: + typeorm: +- hash: 2677b97a423e157945c154e64183d3ae2eb44dfa9cb0e5ce731a7612f507bb56 ++ hash: i7ls76affxbomopkwkccq5jvsu + path: patches/typeorm.patch + + importers: +@@ -51,6 +51,10 @@ + typescript: + specifier: 5.8.3 + version: 5.8.3 ++ optionalDependencies: ++ '@tensorflow/tfjs-core': ++ specifier: 4.22.0 ++ version: 4.22.0(encoding@0.1.13) + devDependencies: + '@misskey-dev/eslint-plugin': + specifier: 2.1.0 +@@ -85,10 +89,6 @@ + start-server-and-test: + specifier: 2.0.12 + version: 2.0.12 +- optionalDependencies: +- '@tensorflow/tfjs-core': +- specifier: 4.22.0 +- version: 4.22.0(encoding@0.1.13) + + packages/backend: + dependencies: +@@ -427,7 +427,7 @@ + version: 4.2.0 + typeorm: + specifier: 0.3.24 +- version: 0.3.24(patch_hash=2677b97a423e157945c154e64183d3ae2eb44dfa9cb0e5ce731a7612f507bb56)(ioredis@5.6.1)(pg@8.16.0)(reflect-metadata@0.2.2) ++ version: 0.3.24(patch_hash=i7ls76affxbomopkwkccq5jvsu)(ioredis@5.6.1)(pg@8.16.0)(reflect-metadata@0.2.2) + typescript: + specifier: 5.8.3 + version: 5.8.3 +@@ -446,6 +446,94 @@ + xev: + specifier: 3.0.2 + version: 3.0.2 ++ optionalDependencies: ++ '@swc/core-android-arm64': ++ specifier: 1.3.11 ++ version: 1.3.11 ++ '@swc/core-darwin-arm64': ++ specifier: 1.12.0 ++ version: 1.12.0 ++ '@swc/core-darwin-x64': ++ specifier: 1.12.0 ++ version: 1.12.0 ++ '@swc/core-freebsd-x64': ++ specifier: 1.3.11 ++ version: 1.3.11 ++ '@swc/core-linux-arm-gnueabihf': ++ specifier: 1.12.0 ++ version: 1.12.0 ++ '@swc/core-linux-arm64-gnu': ++ specifier: 1.12.0 ++ version: 1.12.0 ++ '@swc/core-linux-arm64-musl': ++ specifier: 1.12.0 ++ version: 1.12.0 ++ '@swc/core-linux-x64-gnu': ++ specifier: 1.12.0 ++ version: 1.12.0 ++ '@swc/core-linux-x64-musl': ++ specifier: 1.12.0 ++ version: 1.12.0 ++ '@swc/core-win32-arm64-msvc': ++ specifier: 1.12.0 ++ version: 1.12.0 ++ '@swc/core-win32-ia32-msvc': ++ specifier: 1.12.0 ++ version: 1.12.0 ++ '@swc/core-win32-x64-msvc': ++ specifier: 1.12.0 ++ version: 1.12.0 ++ '@tensorflow/tfjs': ++ specifier: 4.22.0 ++ version: 4.22.0(encoding@0.1.13)(seedrandom@3.0.5) ++ '@tensorflow/tfjs-node': ++ specifier: 4.22.0 ++ version: 4.22.0(encoding@0.1.13)(seedrandom@3.0.5) ++ bufferutil: ++ specifier: 4.0.9 ++ version: 4.0.9 ++ slacc-android-arm-eabi: ++ specifier: 0.0.10 ++ version: 0.0.10 ++ slacc-android-arm64: ++ specifier: 0.0.10 ++ version: 0.0.10 ++ slacc-darwin-arm64: ++ specifier: 0.0.10 ++ version: 0.0.10 ++ slacc-darwin-universal: ++ specifier: 0.0.10 ++ version: 0.0.10 ++ slacc-darwin-x64: ++ specifier: 0.0.10 ++ version: 0.0.10 ++ slacc-freebsd-x64: ++ specifier: 0.0.10 ++ version: 0.0.10 ++ slacc-linux-arm-gnueabihf: ++ specifier: 0.0.10 ++ version: 0.0.10 ++ slacc-linux-arm64-gnu: ++ specifier: 0.0.10 ++ version: 0.0.10 ++ slacc-linux-arm64-musl: ++ specifier: 0.0.10 ++ version: 0.0.10 ++ slacc-linux-x64-gnu: ++ specifier: 0.0.10 ++ version: 0.0.10 ++ slacc-linux-x64-musl: ++ specifier: 0.0.10 ++ version: 0.0.10 ++ slacc-win32-arm64-msvc: ++ specifier: 0.0.10 ++ version: 0.0.10 ++ slacc-win32-x64-msvc: ++ specifier: 0.0.10 ++ version: 0.0.10 ++ utf-8-validate: ++ specifier: 6.0.5 ++ version: 6.0.5 + devDependencies: + '@jest/globals': + specifier: 29.7.0 +@@ -612,94 +700,6 @@ + supertest: + specifier: 7.1.1 + version: 7.1.1 +- optionalDependencies: +- '@swc/core-android-arm64': +- specifier: 1.3.11 +- version: 1.3.11 +- '@swc/core-darwin-arm64': +- specifier: 1.12.0 +- version: 1.12.0 +- '@swc/core-darwin-x64': +- specifier: 1.12.0 +- version: 1.12.0 +- '@swc/core-freebsd-x64': +- specifier: 1.3.11 +- version: 1.3.11 +- '@swc/core-linux-arm-gnueabihf': +- specifier: 1.12.0 +- version: 1.12.0 +- '@swc/core-linux-arm64-gnu': +- specifier: 1.12.0 +- version: 1.12.0 +- '@swc/core-linux-arm64-musl': +- specifier: 1.12.0 +- version: 1.12.0 +- '@swc/core-linux-x64-gnu': +- specifier: 1.12.0 +- version: 1.12.0 +- '@swc/core-linux-x64-musl': +- specifier: 1.12.0 +- version: 1.12.0 +- '@swc/core-win32-arm64-msvc': +- specifier: 1.12.0 +- version: 1.12.0 +- '@swc/core-win32-ia32-msvc': +- specifier: 1.12.0 +- version: 1.12.0 +- '@swc/core-win32-x64-msvc': +- specifier: 1.12.0 +- version: 1.12.0 +- '@tensorflow/tfjs': +- specifier: 4.22.0 +- version: 4.22.0(encoding@0.1.13)(seedrandom@3.0.5) +- '@tensorflow/tfjs-node': +- specifier: 4.22.0 +- version: 4.22.0(encoding@0.1.13)(seedrandom@3.0.5) +- bufferutil: +- specifier: 4.0.9 +- version: 4.0.9 +- slacc-android-arm-eabi: +- specifier: 0.0.10 +- version: 0.0.10 +- slacc-android-arm64: +- specifier: 0.0.10 +- version: 0.0.10 +- slacc-darwin-arm64: +- specifier: 0.0.10 +- version: 0.0.10 +- slacc-darwin-universal: +- specifier: 0.0.10 +- version: 0.0.10 +- slacc-darwin-x64: +- specifier: 0.0.10 +- version: 0.0.10 +- slacc-freebsd-x64: +- specifier: 0.0.10 +- version: 0.0.10 +- slacc-linux-arm-gnueabihf: +- specifier: 0.0.10 +- version: 0.0.10 +- slacc-linux-arm64-gnu: +- specifier: 0.0.10 +- version: 0.0.10 +- slacc-linux-arm64-musl: +- specifier: 0.0.10 +- version: 0.0.10 +- slacc-linux-x64-gnu: +- specifier: 0.0.10 +- version: 0.0.10 +- slacc-linux-x64-musl: +- specifier: 0.0.10 +- version: 0.0.10 +- slacc-win32-arm64-msvc: +- specifier: 0.0.10 +- version: 0.0.10 +- slacc-win32-x64-msvc: +- specifier: 0.0.10 +- version: 0.0.10 +- utf-8-validate: +- specifier: 6.0.5 +- version: 6.0.5 + + packages/frontend: + dependencies: +@@ -11221,8 +11221,8 @@ + vue-component-type-helpers@2.2.12: + resolution: {integrity: sha512-YbGqHZ5/eW4SnkPNR44mKVc6ZKQoRs/Rux1sxC6rdwXb4qpbOSYfDr9DsTHolOTGmIKgM9j141mZbBeg05R1pw==} + +- vue-component-type-helpers@3.0.1: +- resolution: {integrity: sha512-j23mCB5iEbGsyIhnVdXdWUOg+UdwmVxpKnYYf2j+4ppCt5VSFXKjwu9YFt0QYxUaf5G99PuHsVfRScjHCRSsGQ==} ++ vue-component-type-helpers@3.0.3: ++ resolution: {integrity: sha512-koiBu7lO8e6w/UlbZAAIW11qcFQocYIl7Nh/SVwGZ804ej5KrncU32bRxi2zfU2Kyf6HWuk1CeeVP2rhIL+vyQ==} + + vue-demi@0.14.7: + resolution: {integrity: sha512-EOG8KXDQNwkJILkx/gPcoL/7vH+hORoBaKgGe+6W7VFMvCYJfmF2dGbvgDroVnI8LU7/kTu8mbjRZGBU1z9NTA==} +@@ -14955,7 +14955,7 @@ + ts-dedent: 2.2.0 + type-fest: 2.19.0 + vue: 3.5.17(typescript@5.8.3) +- vue-component-type-helpers: 3.0.1 ++ vue-component-type-helpers: 3.0.3 + + '@stylistic/eslint-plugin@2.13.0(eslint@9.31.0)(typescript@5.8.3)': + dependencies: +@@ -23034,7 +23034,7 @@ + + typedarray@0.0.6: {} + +- typeorm@0.3.24(patch_hash=2677b97a423e157945c154e64183d3ae2eb44dfa9cb0e5ce731a7612f507bb56)(ioredis@5.6.1)(pg@8.16.0)(reflect-metadata@0.2.2): ++ typeorm@0.3.24(patch_hash=i7ls76affxbomopkwkccq5jvsu)(ioredis@5.6.1)(pg@8.16.0)(reflect-metadata@0.2.2): + dependencies: + '@sqltools/formatter': 1.2.5 + ansis: 3.17.0 +@@ -23371,7 +23371,7 @@ + + vue-component-type-helpers@2.2.12: {} + +- vue-component-type-helpers@3.0.1: {} ++ vue-component-type-helpers@3.0.3: {} + + vue-demi@0.14.7(vue@3.5.17(typescript@5.8.3)): + dependencies: diff --git a/pkgs/by-name/ot/otio/package.nix b/pkgs/by-name/ot/otio/package.nix new file mode 100644 index 000000000000..8b5f3edffd1d --- /dev/null +++ b/pkgs/by-name/ot/otio/package.nix @@ -0,0 +1,48 @@ +{ + lib, + stdenv, + cmake, + fetchFromGitHub, + imath, + python3, + rapidjson, +}: + +stdenv.mkDerivation (finalAttrs: { + pname = "otio"; + version = "0.17.0"; + + src = fetchFromGitHub { + owner = "AcademySoftwareFoundation"; + repo = "OpenTimelineIO"; + tag = "v${finalAttrs.version}"; + sha256 = "sha256-53KXjbhHxuEtu6iRGWrirvFamuZ/WbOTcKCfs1iqKmM="; + }; + + nativeBuildInputs = [ + cmake + python3 + ]; + + buildInputs = [ + imath + rapidjson + ]; + + cmakeFlags = [ + (lib.cmakeBool "OTIO_PYTHON_INSTALL" false) + (lib.cmakeBool "OTIO_DEPENDENCIES_INSTALL" false) + (lib.cmakeBool "OTIO_FIND_IMATH" true) + (lib.cmakeBool "OTIO_SHARED_LIBS" true) + (lib.cmakeBool "OTIO_AUTOMATIC_SUBMODULES" false) + ]; + + meta = { + description = "Interchange format and API for editorial cut information"; + homepage = "http://opentimeline.io/"; + changelog = "https://github.com/AcademySoftwareFoundation/OpenTimelineIO/releases/tag/v${finalAttrs.version}"; + license = lib.licenses.asl20; + maintainers = with lib.maintainers; [ liberodark ]; + platforms = lib.platforms.linux; + }; +}) diff --git a/pkgs/by-name/pi/pike/package.nix b/pkgs/by-name/pi/pike/package.nix index 421d5f95a840..ea06e6a0d499 100644 --- a/pkgs/by-name/pi/pike/package.nix +++ b/pkgs/by-name/pi/pike/package.nix @@ -120,12 +120,12 @@ let in stdenv.mkDerivation (finalAttrs: { pname = "pike"; - version = "v8.0.2020"; + version = "8.0.2020"; src = fetchFromGitHub { owner = "pikelang"; repo = "Pike"; - rev = finalAttrs.version; + tag = "v${finalAttrs.version}"; hash = "sha256-VHfMfICtvCHdFTIjiYw9tR5g9KycR7jqdg3wT+T37mA="; }; diff --git a/pkgs/by-name/po/poco/disable-broken-tests-darwin.patch b/pkgs/by-name/po/poco/disable-broken-tests-darwin.patch new file mode 100644 index 000000000000..7c0f27352e15 --- /dev/null +++ b/pkgs/by-name/po/poco/disable-broken-tests-darwin.patch @@ -0,0 +1,21 @@ +diff --git a/Data/testsuite/src/DataTest.cpp b/Data/testsuite/src/DataTest.cpp +index a78c4e5..e8d9335 100644 +--- a/Data/testsuite/src/DataTest.cpp ++++ b/Data/testsuite/src/DataTest.cpp +@@ -1652 +1652 @@ CppUnit::Test* DataTest::suite() +- CppUnit_addTest(pSuite, DataTest, testSQLChannel); ++ // CppUnit_addTest(pSuite, DataTest, testSQLChannel); +diff --git a/Net/testsuite/src/HTTPClientSessionTest.cpp b/Net/testsuite/src/HTTPClientSessionTest.cpp +index 31de150..b5c0d13 100644 +--- a/Net/testsuite/src/HTTPClientSessionTest.cpp ++++ b/Net/testsuite/src/HTTPClientSessionTest.cpp +@@ -406 +406 @@ CppUnit::Test* HTTPClientSessionTest::suite() +- CppUnit_addTest(pSuite, HTTPClientSessionTest, testGetSmallUnix); ++ // CppUnit_addTest(pSuite, HTTPClientSessionTest, testGetSmallUnix); +diff --git a/Net/testsuite/src/SocketTest.cpp b/Net/testsuite/src/SocketTest.cpp +index 27c1800..9bd684b 100644 +--- a/Net/testsuite/src/SocketTest.cpp ++++ b/Net/testsuite/src/SocketTest.cpp +@@ -900 +900 @@ CppUnit::Test* SocketTest::suite() +- CppUnit_addTest(pSuite, SocketTest, testEchoUnixLocal); ++ // CppUnit_addTest(pSuite, SocketTest, testEchoUnixLocal); diff --git a/pkgs/by-name/po/poco/disable-broken-tests-linux.patch b/pkgs/by-name/po/poco/disable-broken-tests-linux.patch new file mode 100644 index 000000000000..8f976a30a0b1 --- /dev/null +++ b/pkgs/by-name/po/poco/disable-broken-tests-linux.patch @@ -0,0 +1,28 @@ +diff --git a/Data/testsuite/src/DataTest.cpp b/Data/testsuite/src/DataTest.cpp +index a78c4e5..e8d9335 100644 +--- a/Data/testsuite/src/DataTest.cpp ++++ b/Data/testsuite/src/DataTest.cpp +@@ -1652 +1652 @@ CppUnit::Test* DataTest::suite() +- CppUnit_addTest(pSuite, DataTest, testSQLChannel); ++ // CppUnit_addTest(pSuite, DataTest, testSQLChannel); +diff --git a/Net/testsuite/src/DatagramSocketTest.cpp b/Net/testsuite/src/DatagramSocketTest.cpp +index e765de2..cec4867 100644 +--- a/Net/testsuite/src/DatagramSocketTest.cpp ++++ b/Net/testsuite/src/DatagramSocketTest.cpp +@@ -830 +830 @@ CppUnit::Test* DatagramSocketTest::suite() +- CppUnit_addTest(pSuite, DatagramSocketTest, testBroadcast); ++ // CppUnit_addTest(pSuite, DatagramSocketTest, testBroadcast); +diff --git a/Net/testsuite/src/SocketReactorTest.cpp b/Net/testsuite/src/SocketReactorTest.cpp +index a07576c..b3236c5 100644 +--- a/Net/testsuite/src/SocketReactorTest.cpp ++++ b/Net/testsuite/src/SocketReactorTest.cpp +@@ -706 +706 @@ CppUnit::Test* SocketReactorTest::suite() +- CppUnit_addTest(pSuite, SocketReactorTest, testSocketConnectorFail); ++ // CppUnit_addTest(pSuite, SocketReactorTest, testSocketConnectorFail); +diff --git a/Net/testsuite/src/SocketTest.cpp b/Net/testsuite/src/SocketTest.cpp +index 27c1800..9bd684b 100644 +--- a/Net/testsuite/src/SocketTest.cpp ++++ b/Net/testsuite/src/SocketTest.cpp +@@ -900 +900 @@ CppUnit::Test* SocketTest::suite() +- CppUnit_addTest(pSuite, SocketTest, testEchoUnixLocal); ++ // CppUnit_addTest(pSuite, SocketTest, testEchoUnixLocal); diff --git a/pkgs/by-name/po/poco/disable-flaky-tests.patch b/pkgs/by-name/po/poco/disable-flaky-tests.patch new file mode 100644 index 000000000000..4f3b6ca5833e --- /dev/null +++ b/pkgs/by-name/po/poco/disable-flaky-tests.patch @@ -0,0 +1,18 @@ +diff --git a/Foundation/testsuite/src/ExpireLRUCacheTest.cpp b/Foundation/testsuite/src/ExpireLRUCacheTest.cpp +--- a/Foundation/testsuite/src/ExpireLRUCacheTest.cpp ++++ b/Foundation/testsuite/src/ExpireLRUCacheTest.cpp +@@ -336 +336 @@ +- CppUnit_addTest(pSuite, ExpireLRUCacheTest, testExpireN); ++ // CppUnit_addTest(pSuite, ExpireLRUCacheTest, testExpireN); +diff --git a/Foundation/testsuite/src/TimestampTest.cpp b/Foundation/testsuite/src/TimestampTest.cpp +--- a/Foundation/testsuite/src/TimestampTest.cpp ++++ b/Foundation/testsuite/src/TimestampTest.cpp +@@ -97 +97 @@ +- CppUnit_addTest(pSuite, TimestampTest, testTimestamp); ++ // CppUnit_addTest(pSuite, TimestampTest, testTimestamp); +diff --git a/Foundation/testsuite/src/UniqueExpireCacheTest.cpp b/Foundation/testsuite/src/UniqueExpireCacheTest.cpp +--- a/Foundation/testsuite/src/UniqueExpireCacheTest.cpp ++++ b/Foundation/testsuite/src/UniqueExpireCacheTest.cpp +@@ -248 +248 @@ +- CppUnit_addTest(pSuite, UniqueExpireCacheTest, testExpireN); ++ // CppUnit_addTest(pSuite, UniqueExpireCacheTest, testExpireN); diff --git a/pkgs/by-name/po/poco/package.nix b/pkgs/by-name/po/poco/package.nix index 2117341d5232..9970457c249b 100644 --- a/pkgs/by-name/po/poco/package.nix +++ b/pkgs/by-name/po/poco/package.nix @@ -13,6 +13,7 @@ openssl, unixODBC, libmysqlclient, + writableTmpDirAsHomeHook, }: stdenv.mkDerivation rec { @@ -54,25 +55,56 @@ stdenv.mkDerivation rec { MYSQL_DIR = libmysqlclient; MYSQL_INCLUDE_DIR = "${MYSQL_DIR}/include/mysql"; - cmakeFlags = [ - # use nix provided versions of sqlite, zlib, pcre, expat, ... instead of bundled versions - (lib.cmakeBool "POCO_UNBUNDLED" true) - ]; + cmakeFlags = + let + excludeTestsRegex = lib.concatStringsSep "|" [ + # These tests require running services, which the checkPhase is ill equipeed to provide + # TODO get them running in a nixosTest + "Redis" + "DataODBC" + "MongoDB" + "DataMySQL" + # network not accessible from nix sandbox + "NetSSL" # around 25 test failures + "Net" # could be made to work when public network access is patched out + ]; + in + [ + # use nix provided versions of sqlite, zlib, pcre, expat, ... instead of bundled versions + (lib.cmakeBool "POCO_UNBUNDLED" true) + (lib.cmakeBool "ENABLE_TESTS" true) + (lib.cmakeFeature "CMAKE_CTEST_ARGUMENTS" "--exclude-regex;'${excludeTestsRegex}'") + ]; - patches = [ - # Remove on next release - (fetchpatch { - name = "disable-included-pcre-if-pcre-is-linked-staticly"; - # this happens when building pkgsStatic.poco - url = "https://patch-diff.githubusercontent.com/raw/pocoproject/poco/pull/4879.patch"; - hash = "sha256-VFWuRuf0GPYFp43WKI8utl+agP+7a5biLg7m64EMnVo="; - }) + patches = + [ + # Remove on next release + (fetchpatch { + name = "disable-included-pcre-if-pcre-is-linked-staticly"; + # this happens when building pkgsStatic.poco + url = "https://patch-diff.githubusercontent.com/raw/pocoproject/poco/pull/4879.patch"; + hash = "sha256-VFWuRuf0GPYFp43WKI8utl+agP+7a5biLg7m64EMnVo="; + }) + # https://github.com/pocoproject/poco/issues/4977 + ./disable-flaky-tests.patch + ] + ++ lib.optionals stdenv.hostPlatform.isDarwin [ + ./disable-broken-tests-darwin.patch + ] + ++ lib.optionals stdenv.hostPlatform.isLinux [ + ./disable-broken-tests-linux.patch + ]; + + doCheck = true; + nativeCheckInputs = [ + # workaround for some tests trying to write to /homeless-shelter + writableTmpDirAsHomeHook ]; postFixup = '' grep -rlF INTERFACE_INCLUDE_DIRECTORIES "$dev/lib/cmake/Poco" | while read -r f; do substituteInPlace "$f" \ - --replace "$"'{_IMPORT_PREFIX}/include' "" + --replace-quiet "$"'{_IMPORT_PREFIX}/include' "" done ''; diff --git a/pkgs/by-name/pr/protonmail-bridge/package.nix b/pkgs/by-name/pr/protonmail-bridge/package.nix index eb293344ee7a..cf3c44994a35 100644 --- a/pkgs/by-name/pr/protonmail-bridge/package.nix +++ b/pkgs/by-name/pr/protonmail-bridge/package.nix @@ -8,13 +8,13 @@ buildGoModule rec { pname = "protonmail-bridge"; - version = "3.21.1"; + version = "3.21.2"; src = fetchFromGitHub { owner = "ProtonMail"; repo = "proton-bridge"; rev = "v${version}"; - hash = "sha256-HGBECDidHFixFOb/ze+3elckpt1JghEtPbWHq7QU1Qg="; + hash = "sha256-IQgP+eWUCyViEBi0WFIOW2rXZLtoyVlrQrtAaqaLOv0="; }; vendorHash = "sha256-aW7N6uacoP99kpvw9E5WrHaQ0fZ4P5WGsNvR/FAZ+cA="; diff --git a/pkgs/by-name/qb/qbittorrent/package.nix b/pkgs/by-name/qb/qbittorrent/package.nix index 79a3d68990a3..ecd6148a7388 100644 --- a/pkgs/by-name/qb/qbittorrent/package.nix +++ b/pkgs/by-name/qb/qbittorrent/package.nix @@ -16,6 +16,7 @@ webuiSupport ? true, wrapGAppsHook3, zlib, + nixosTests, }: stdenv.mkDerivation (finalAttrs: { @@ -74,7 +75,10 @@ stdenv.mkDerivation (finalAttrs: { qtWrapperArgs+=("''${gappsWrapperArgs[@]}") ''; - passthru.updateScript = nix-update-script { extraArgs = [ "--version-regex=release-(.*)" ]; }; + passthru = { + updateScript = nix-update-script { extraArgs = [ "--version-regex=release-(.*)" ]; }; + tests.testService = nixosTests.qbittorrent; + }; meta = { description = "Featureful free software BitTorrent client"; diff --git a/pkgs/by-name/tr/trilium-next-desktop/package.nix b/pkgs/by-name/tr/trilium-next-desktop/package.nix index d51666362caf..292383aae9c7 100644 --- a/pkgs/by-name/tr/trilium-next-desktop/package.nix +++ b/pkgs/by-name/tr/trilium-next-desktop/package.nix @@ -5,7 +5,7 @@ fetchurl, makeBinaryWrapper, # use specific electron since it has to load a compiled module - electron_36, + electron_37, autoPatchelfHook, makeDesktopItem, copyDesktopItems, @@ -15,10 +15,10 @@ let pname = "trilium-next-desktop"; - version = "0.95.0"; + version = "0.97.1"; triliumSource = os: arch: sha256: { - url = "https://github.com/TriliumNext/Notes/releases/download/v${version}/TriliumNextNotes-v${version}-${os}-${arch}.zip"; + url = "https://github.com/TriliumNext/Trilium/releases/download/v${version}/TriliumNotes-v${version}-${os}-${arch}.zip"; inherit sha256; }; @@ -26,10 +26,10 @@ let darwinSource = triliumSource "macos"; # exposed like this for update.sh - x86_64-linux.sha256 = "1lykzd1spvl6x6xm2qhw5bzcs9pbcars686gwbirscr53fb7q841"; - aarch64-linux.sha256 = "0bxrsj1g8dgg9rd6s0aj9jm2w6nk9yn6b1xgiab8kn298p3iqz64"; - x86_64-darwin.sha256 = "16cv52c6jn5ah5ccdfxffwrmf6vz8d4q4rj0v5ny4m0g0al78isg"; - aarch64-darwin.sha256 = "0v388frd4skpilxn8i5isd9xgn0qs9zszfs3h75q3qpx4xz355ps"; + x86_64-linux.sha256 = "1lb1mp031pa4wg6wrp8l84vw1glmqc27l4gf85a47bi4b63das2l"; + aarch64-linux.sha256 = "1yrxk8q2aafgcvipwhkwmjidymwia0dgqnhchhngmris6zrbb3wj"; + x86_64-darwin.sha256 = "0d8li5h2rn3iyzxsbs4g7a98zzdn58x4iwhzvxcjxy7b6h4hldvg"; + aarch64-darwin.sha256 = "07r1rw84mlszr2bzjwz62lsy14j9xm22li2ksdc4ra93q58kmip1"; sources = { x86_64-linux = linuxSource "x64" x86_64-linux.sha256; @@ -111,7 +111,7 @@ let asar pack $tmp/ $out/share/trilium/resources/app.asar rm -rf $tmp - makeWrapper ${lib.getExe electron_36} $out/bin/trilium \ + makeWrapper ${lib.getExe electron_37} $out/bin/trilium \ "''${gappsWrapperArgs[@]}" \ --set-default ELECTRON_IS_DEV 0 \ --add-flags $out/share/trilium/resources/app.asar diff --git a/pkgs/by-name/tr/trilium-next-desktop/update.sh b/pkgs/by-name/tr/trilium-next-desktop/update.sh index e2820a90dc7e..2b3802e9abd2 100755 --- a/pkgs/by-name/tr/trilium-next-desktop/update.sh +++ b/pkgs/by-name/tr/trilium-next-desktop/update.sh @@ -8,22 +8,22 @@ setKV () { sed -i "s|$2 = \".*\"|$2 = \"${3:-}\"|" $1 } -version=$(curl -s --show-error "https://api.github.com/repos/TriliumNext/Notes/releases/latest" | jq -r '.tag_name' | tail -c +2) +version=$(curl -s --show-error "https://api.github.com/repos/TriliumNext/Trilium/releases/latest" | jq -r '.tag_name' | tail -c +2) setKV ./package.nix version $version # Update desktop application -sha256_linux64=$(nix-prefetch-url --quiet https://github.com/TriliumNext/Notes/releases/download/v${version}/TriliumNextNotes-v${version}-linux-x64.zip) -sha256_linux64_arm=$(nix-prefetch-url --quiet https://github.com/TriliumNext/Notes/releases/download/v${version}/TriliumNextNotes-v${version}-linux-arm64.zip) -sha256_darwin64=$(nix-prefetch-url --quiet https://github.com/TriliumNext/Notes/releases/download/v${version}/TriliumNextNotes-v${version}-macos-x64.zip) -sha256_darwin64_arm=$(nix-prefetch-url --quiet https://github.com/TriliumNext/Notes/releases/download/v${version}/TriliumNextNotes-v${version}-macos-arm64.zip) +sha256_linux64=$(nix-prefetch-url --quiet https://github.com/TriliumNext/Trilium/releases/download/v${version}/TriliumNotes-v${version}-linux-x64.zip) +sha256_linux64_arm=$(nix-prefetch-url --quiet https://github.com/TriliumNext/Trilium/releases/download/v${version}/TriliumNotes-v${version}-linux-arm64.zip) +sha256_darwin64=$(nix-prefetch-url --quiet https://github.com/TriliumNext/Trilium/releases/download/v${version}/TriliumNotes-v${version}-macos-x64.zip) +sha256_darwin64_arm=$(nix-prefetch-url --quiet https://github.com/TriliumNext/Trilium/releases/download/v${version}/TriliumNotes-v${version}-macos-arm64.zip) setKV ./package.nix x86_64-linux.sha256 $sha256_linux64 setKV ./package.nix aarch64-linux.sha256 $sha256_linux64_arm setKV ./package.nix x86_64-darwin.sha256 $sha256_darwin64 setKV ./package.nix aarch64-darwin.sha256 $sha256_darwin64_arm # Update server -sha256_linux64_server=$(nix-prefetch-url --quiet https://github.com/TriliumNext/Notes/releases/download/v${version}/TriliumNextNotes-Server-v${version}-linux-x64.tar.xz) -sha256_linux64_server_arm=$(nix-prefetch-url --quiet https://github.com/TriliumNext/Notes/releases/download/v${version}/TriliumNextNotes-Server-v${version}-linux-arm64.tar.xz) +sha256_linux64_server=$(nix-prefetch-url --quiet https://github.com/TriliumNext/Trilium/releases/download/v${version}/TriliumNotes-Server-v${version}-linux-x64.tar.xz) +sha256_linux64_server_arm=$(nix-prefetch-url --quiet https://github.com/TriliumNext/Trilium/releases/download/v${version}/TriliumNotes-Server-v${version}-linux-arm64.tar.xz) setKV ../trilium-next-server/package.nix version $version setKV ../trilium-next-server/package.nix serverSource_x64.sha256 $sha256_linux64_server setKV ../trilium-next-server/package.nix serverSource_arm64.sha256 $sha256_linux64_server_arm diff --git a/pkgs/by-name/tr/trilium-next-server/package.nix b/pkgs/by-name/tr/trilium-next-server/package.nix index 327f462c9287..6ea019bf45f3 100644 --- a/pkgs/by-name/tr/trilium-next-server/package.nix +++ b/pkgs/by-name/tr/trilium-next-server/package.nix @@ -7,12 +7,12 @@ }: let - version = "0.95.0"; + version = "0.97.1"; - serverSource_x64.url = "https://github.com/TriliumNext/Notes/releases/download/v${version}/TriliumNextNotes-Server-v${version}-linux-x64.tar.xz"; - serverSource_x64.sha256 = "1rjl38i6l894kwpmc925amf9zbwyjlc4sqh3skm1f13vhv9pj9dx"; - serverSource_arm64.url = "https://github.com/TriliumNext/Notes/releases/download/v${version}/TriliumNextNotes-Server-v${version}-linux-arm64.tar.xz"; - serverSource_arm64.sha256 = "1rpzc13vdp5b3iwwc1l6h78nb5iairlxbflwvjwhy1149lpqnn8m"; + serverSource_x64.url = "https://github.com/TriliumNext/Trilium/releases/download/v${version}/TriliumNotes-Server-v${version}-linux-x64.tar.xz"; + serverSource_x64.sha256 = "1y0ass5b3c8qx28b31x2h7i1rlvdyjimsklgjpv8d47micsg6m7z"; + serverSource_arm64.url = "https://github.com/TriliumNext/Trilium/releases/download/v${version}/TriliumNotes-Server-v${version}-linux-arm64.tar.xz"; + serverSource_arm64.sha256 = "12bnmbm1p98633xsyxq6rr05jl79bn820915a0gmq14np7vskhmp"; serverSource = if stdenv.hostPlatform.isx86_64 then diff --git a/pkgs/by-name/yt/yt-dlp/package.nix b/pkgs/by-name/yt/yt-dlp/package.nix index 4ed1feb8a6f0..92aaee8f2633 100644 --- a/pkgs/by-name/yt/yt-dlp/package.nix +++ b/pkgs/by-name/yt/yt-dlp/package.nix @@ -1,15 +1,17 @@ { lib, python3Packages, - fetchPypi, + fetchFromGitHub, ffmpeg-headless, rtmpdump, atomicparsley, + pandoc, + installShellFiles, atomicparsleySupport ? true, ffmpegSupport ? true, rtmpSupport ? true, withAlias ? false, # Provides bin/youtube-dl for backcompat - update-python-libraries, + nix-update-script, }: python3Packages.buildPythonApplication rec { @@ -17,17 +19,21 @@ python3Packages.buildPythonApplication rec { # The websites yt-dlp deals with are a very moving target. That means that # downloads break constantly. Because of that, updates should always be backported # to the latest stable release. - version = "2025.6.30"; + version = "2025.06.30"; pyproject = true; - src = fetchPypi { - inherit version; - pname = "yt_dlp"; - hash = "sha256-bQroVcClW/zCjf+6gE7IUlublV00pBGRoVYaTOwD2L0="; + src = fetchFromGitHub { + owner = "yt-dlp"; + repo = "yt-dlp"; + tag = version; + hash = "sha256-dwBe6oXh7G67kfiI6BqiC0ZHzleR7QlfMiTVXWYW85I="; }; - build-system = with python3Packages; [ - hatchling + build-system = with python3Packages; [ hatchling ]; + + nativeBuildInputs = [ + installShellFiles + pandoc ]; # expose optional-dependencies, but provide all features @@ -52,6 +58,21 @@ python3Packages.buildPythonApplication rec { pythonRelaxDeps = [ "websockets" ]; + preBuild = '' + python devscripts/make_lazy_extractors.py + ''; + + postBuild = '' + python devscripts/prepare_manpage.py yt-dlp.1.temp.md + pandoc -s -f markdown-smart -t man yt-dlp.1.temp.md -o yt-dlp.1 + rm yt-dlp.1.temp.md + + mkdir -p completions/{bash,fish,zsh} + python devscripts/bash-completion.py completions/bash/yt-dlp + python devscripts/zsh-completion.py completions/zsh/_yt-dlp + python devscripts/fish-completion.py completions/fish/yt-dlp.fish + ''; + # Ensure these utilities are available in $PATH: # - ffmpeg: post-processing & transcoding support # - rtmpdump: download files over RTMP @@ -68,25 +89,31 @@ python3Packages.buildPythonApplication rec { ''--prefix PATH : "${lib.makeBinPath packagesToBinPath}"'' ]; - setupPyBuildFlags = [ - "build_lazy_extractors" - ]; - # Requires network doCheck = false; - postInstall = lib.optionalString withAlias '' - ln -s "$out/bin/yt-dlp" "$out/bin/youtube-dl" - ''; + postInstall = + '' + installManPage yt-dlp.1 - passthru.updateScript = [ - update-python-libraries - (toString ./.) - ]; + installShellCompletion \ + --bash completions/bash/yt-dlp \ + --fish completions/fish/yt-dlp.fish \ + --zsh completions/zsh/_yt-dlp - meta = with lib; { - homepage = "https://github.com/yt-dlp/yt-dlp/"; + install -Dm644 Changelog.md README.md -t "$out/share/doc/yt_dlp" + '' + + lib.optionalString withAlias '' + ln -s "$out/bin/yt-dlp" "$out/bin/youtube-dl" + ''; + + passthru.updateScript = nix-update-script { }; + + meta = { + changelog = "https://github.com/yt-dlp/yt-dlp/blob/${version}/Changelog.md"; description = "Command-line tool to download videos from YouTube.com and other sites (youtube-dl fork)"; + homepage = "https://github.com/yt-dlp/yt-dlp/"; + license = lib.licenses.unlicense; longDescription = '' yt-dlp is a youtube-dl fork based on the now inactive youtube-dlc. @@ -95,12 +122,10 @@ python3Packages.buildPythonApplication rec { youtube-dl is released to the public domain, which means you can modify it, redistribute it or use it however you like. ''; - changelog = "https://github.com/yt-dlp/yt-dlp/blob/HEAD/Changelog.md"; - license = licenses.unlicense; - maintainers = with maintainers; [ + mainProgram = "yt-dlp"; + maintainers = with lib.maintainers; [ SuperSandro2000 donteatoreo ]; - mainProgram = "yt-dlp"; }; } diff --git a/pkgs/development/python-modules/ffmpy/default.nix b/pkgs/development/python-modules/ffmpy/default.nix index 0ce5cdfc5b99..884899fc994e 100644 --- a/pkgs/development/python-modules/ffmpy/default.nix +++ b/pkgs/development/python-modules/ffmpy/default.nix @@ -24,22 +24,29 @@ buildPythonPackage rec { hash = "sha256-U20mBg+428kkka6NY9qc7X8jH8A5bKa++g2+PTn/MYg="; }; - postPatch = '' - # default to store ffmpeg - substituteInPlace ffmpy/ffmpy.py \ - --replace-fail \ - 'executable: str = "ffmpeg",' \ - 'executable: str = "${ffmpeg-headless}/bin/ffmpeg",' - - # The tests test a mock that does not behave like ffmpeg. If we default to the nix-store ffmpeg they fail. - for fname in tests/*.py; do - echo >>"$fname" 'FFmpeg.__init__.__defaults__ = ("ffmpeg", *FFmpeg.__init__.__defaults__[1:])' - done - ''; + postPatch = + # Default to store ffmpeg. + '' + substituteInPlace ffmpy/ffmpy.py \ + --replace-fail \ + 'executable: str = "ffmpeg",' \ + 'executable: str = "${lib.getExe ffmpeg-headless}",' + '' + # The tests test a mock that does not behave like ffmpeg. If we default to the nix-store ffmpeg they fail. + + '' + for fname in tests/*.py; do + echo >>"$fname" 'FFmpeg.__init__.__defaults__ = ("ffmpeg", *FFmpeg.__init__.__defaults__[1:])' + done + '' + # uv-build in nixpkgs is now at 0.8.0, which otherwise breaks the constraint set by the package. + + '' + substituteInPlace pyproject.toml \ + --replace-fail 'requires = ["uv_build>=0.7.9,<0.8.0"]' 'requires = ["uv_build>=0.7.9,<0.9.0"]' + ''; pythonImportsCheck = [ "ffmpy" ]; - nativeBuildInputs = [ uv-build ]; + build-system = [ uv-build ]; nativeCheckInputs = [ pytestCheckHook diff --git a/pkgs/development/python-modules/llama-cpp-python/default.nix b/pkgs/development/python-modules/llama-cpp-python/default.nix index 33be1a9dbe4f..045414400682 100644 --- a/pkgs/development/python-modules/llama-cpp-python/default.nix +++ b/pkgs/development/python-modules/llama-cpp-python/default.nix @@ -39,14 +39,14 @@ let in buildPythonPackage rec { pname = "llama-cpp-python"; - version = "0.3.12"; + version = "0.3.14"; pyproject = true; src = fetchFromGitHub { owner = "abetlen"; repo = "llama-cpp-python"; tag = "v${version}"; - hash = "sha256-TTGweGfav1uI2+87iUYc1Esmuor9sEZdZqSU2YVPCdQ="; + hash = "sha256-RJP2QkelqxZuEoxI3CHyenqUJdjw2MsZKUKM+UUxJB8="; fetchSubmodules = true; }; # src = /home/gaetan/llama-cpp-python; diff --git a/pkgs/development/python-modules/nanobind/default.nix b/pkgs/development/python-modules/nanobind/default.nix index fb8bd35a91fc..8c6453c6fd77 100644 --- a/pkgs/development/python-modules/nanobind/default.nix +++ b/pkgs/development/python-modules/nanobind/default.nix @@ -26,7 +26,7 @@ }: buildPythonPackage rec { pname = "nanobind"; - version = "2.7.0"; + version = "2.8.0"; pyproject = true; src = fetchFromGitHub { @@ -34,7 +34,7 @@ buildPythonPackage rec { repo = "nanobind"; tag = "v${version}"; fetchSubmodules = true; - hash = "sha256-ex5svqDp9XJtiNCxu0249ORL6LbG679U6PvKQaWANmE="; + hash = "sha256-GGYnyO8eILYNu7va2tMB0QJkBCRDMIfRQO4a9geV49Y="; }; build-system = [ diff --git a/pkgs/development/python-modules/pysilero-vad/default.nix b/pkgs/development/python-modules/pysilero-vad/default.nix index 98e2fa1b8a37..63cbc36ca3d0 100644 --- a/pkgs/development/python-modules/pysilero-vad/default.nix +++ b/pkgs/development/python-modules/pysilero-vad/default.nix @@ -17,20 +17,18 @@ buildPythonPackage rec { pname = "pysilero-vad"; - version = "2.1.0"; + version = "2.1.1"; pyproject = true; src = fetchFromGitHub { owner = "rhasspy"; repo = "pysilero-vad"; tag = "v${version}"; - hash = "sha256-h49AD3ICh0NYyh2EDogynQ0qgkKCAQTVKS9rbXbrqPE="; + hash = "sha256-zxvYvPnL99yIVHrzbRbKmTazzlefOS+s2TAWLweRSYE="; }; build-system = [ setuptools ]; - pythonRelaxDeps = [ "numpy" ]; - dependencies = [ numpy onnxruntime diff --git a/pkgs/development/python-modules/sagemaker-core/default.nix b/pkgs/development/python-modules/sagemaker-core/default.nix index af289bac323c..0ee3b625525d 100644 --- a/pkgs/development/python-modules/sagemaker-core/default.nix +++ b/pkgs/development/python-modules/sagemaker-core/default.nix @@ -28,14 +28,14 @@ buildPythonPackage rec { pname = "sagemaker-core"; - version = "1.0.42"; + version = "1.0.45"; pyproject = true; src = fetchFromGitHub { owner = "aws"; repo = "sagemaker-core"; tag = "v${version}"; - hash = "sha256-To4VjTuE9fkVQSXR1k6NMAjrByzFhAidvui8w+etOQc="; + hash = "sha256-/NXSuDQAhRQ5RuYV1Eaat0TjMzqj1IYp3LECmTISoK8="; }; build-system = [ diff --git a/pkgs/development/python-modules/scim2-client/default.nix b/pkgs/development/python-modules/scim2-client/default.nix index 47a056103ca8..27dd921289f1 100644 --- a/pkgs/development/python-modules/scim2-client/default.nix +++ b/pkgs/development/python-modules/scim2-client/default.nix @@ -17,7 +17,7 @@ buildPythonPackage rec { pname = "scim2-client"; - version = "0.5.1"; + version = "0.5.2"; pyproject = true; @@ -26,7 +26,7 @@ buildPythonPackage rec { src = fetchPypi { inherit version; pname = "scim2_client"; - hash = "sha256-g2RR+Ruvjw88cGHcwEPoktTmB8VcWAPnea3BErS8JyI="; + hash = "sha256-viIriAFyfJVrJRr04GBD3dhaQ+iUVujigsx1ucSSeqA="; }; build-system = [ hatchling ]; diff --git a/pkgs/os-specific/linux/kernel/generic.nix b/pkgs/os-specific/linux/kernel/generic.nix index 50c5d9683760..71673921d238 100644 --- a/pkgs/os-specific/linux/kernel/generic.nix +++ b/pkgs/os-specific/linux/kernel/generic.nix @@ -94,8 +94,6 @@ let # cgit) that are needed here should be included directly in Nixpkgs as # files. - assert stdenv.hostPlatform.isLinux; - let # Dirty hack to make sure that `version` & `src` have # `` as position diff --git a/pkgs/os-specific/linux/kernel/zen-kernels.nix b/pkgs/os-specific/linux/kernel/zen-kernels.nix index 49522576d3d3..3bafacbb61bc 100644 --- a/pkgs/os-specific/linux/kernel/zen-kernels.nix +++ b/pkgs/os-specific/linux/kernel/zen-kernels.nix @@ -23,9 +23,9 @@ let }; # ./update-zen.py lqx lqx = { - version = "6.15.6"; # lqx + version = "6.15.7"; # lqx suffix = "lqx1"; # lqx - sha256 = "092yz6r6wzkafr0rafb1qdapghjwr33dlx3id5jn03jkq4g8jgmd"; # lqx + sha256 = "05pr17hqrlf4jfw3fxja9n0lfs4piy03fh4wqjhbd601sjif6akh"; # lqx isLqx = true; }; }; diff --git a/pkgs/os-specific/linux/ply/default.nix b/pkgs/os-specific/linux/ply/default.nix index 3e1dfa296706..53d3553afc0a 100644 --- a/pkgs/os-specific/linux/ply/default.nix +++ b/pkgs/os-specific/linux/ply/default.nix @@ -55,5 +55,6 @@ stdenv.mkDerivation rec { mic92 mbbx6spp ]; + platforms = lib.platforms.linux; }; } diff --git a/pkgs/servers/home-assistant/custom-components/roborock_custom_map/package.nix b/pkgs/servers/home-assistant/custom-components/roborock_custom_map/package.nix new file mode 100644 index 000000000000..82da77373fa5 --- /dev/null +++ b/pkgs/servers/home-assistant/custom-components/roborock_custom_map/package.nix @@ -0,0 +1,25 @@ +{ + lib, + buildHomeAssistantComponent, + fetchFromGitHub, +}: + +buildHomeAssistantComponent rec { + owner = "Lash-L"; + domain = "roborock_custom_map"; + version = "0.1.1"; + + src = fetchFromGitHub { + owner = "Lash-L"; + repo = "RoborockCustomMap"; + tag = version; + hash = "sha256-ZKaUTUTN0tTW8bks0TYixfmbEa7A7ERdJ+xZ365HEbU="; + }; + + meta = { + description = "This allows you to use the core Roborock integration with the Xiaomi Map Card"; + homepage = "https://github.com/Lash-L/RoborockCustomMap"; + license = lib.licenses.mit; + maintainers = with lib.maintainers; [ kranzes ]; + }; +} diff --git a/pkgs/servers/home-assistant/custom-lovelace-modules/advanced-camera-card/package.nix b/pkgs/servers/home-assistant/custom-lovelace-modules/advanced-camera-card/package.nix index 4f834e41bbdb..e305b5da1298 100644 --- a/pkgs/servers/home-assistant/custom-lovelace-modules/advanced-camera-card/package.nix +++ b/pkgs/servers/home-assistant/custom-lovelace-modules/advanced-camera-card/package.nix @@ -6,11 +6,11 @@ stdenv.mkDerivation rec { pname = "advanced-camera-card"; - version = "7.14.2"; + version = "7.14.3"; src = fetchzip { url = "https://github.com/dermotduffy/advanced-camera-card/releases/download/v${version}/advanced-camera-card.zip"; - hash = "sha256-I4ZrkhrwP+b7IHNWbGpGPmlH9CP7o2mFTfN5J1fOY/E="; + hash = "sha256-pbca+z0abg2aeffBZ3yqfz7nbR+sqQgvRUML2DH0tIY="; }; # TODO: build from source once yarn berry support lands in nixpkgs diff --git a/pkgs/test/nixos-functions/default.nix b/pkgs/test/nixos-functions/default.nix index dc8e0b3ead31..4cc738cfaebe 100644 --- a/pkgs/test/nixos-functions/default.nix +++ b/pkgs/test/nixos-functions/default.nix @@ -21,14 +21,14 @@ let label = "test"; }; in -pkgs.recurseIntoAttrs { - - nixos-test = - (pkgs.nixos { - system.nixos = dummyVersioning; - boot.loader.grub.enable = false; - fileSystems."/".device = "/dev/null"; - system.stateVersion = lib.trivial.release; - }).toplevel; - -} +lib.optionalAttrs (stdenv.hostPlatform.isLinux) ( + pkgs.recurseIntoAttrs { + nixos-test = + (pkgs.nixos { + system.nixos = dummyVersioning; + boot.loader.grub.enable = false; + fileSystems."/".device = "/dev/null"; + system.stateVersion = lib.trivial.release; + }).toplevel; + } +) diff --git a/pkgs/tools/misc/grub/default.nix b/pkgs/tools/misc/grub/default.nix index 9124dde8caeb..43d06dcc5a5c 100644 --- a/pkgs/tools/misc/grub/default.nix +++ b/pkgs/tools/misc/grub/default.nix @@ -88,588 +88,583 @@ let hash = "sha256-IoRiJHNQ58y0UhCAD0CrpFiI8Mz1upzAtyh5K4Njh/w="; }; in -( +stdenv.mkDerivation rec { + pname = "grub"; + version = "2.12"; + inherit src; - assert efiSupport -> canEfi; - assert zfsSupport -> zfs != null; - assert !(efiSupport && xenSupport); + patches = [ + ./fix-bash-completion.patch + ./add-hidden-menu-entries.patch - stdenv.mkDerivation rec { - pname = "grub"; - version = "2.12"; - inherit src; + # https://lists.gnu.org/archive/html/grub-devel/2025-02/msg00024.html + (fetchpatch { + name = "01_implement_grub_strlcpy.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=ea703528a8581a2ea7e0bad424a70fdf0aec7d8f"; + hash = "sha256-MSMgu1vMG83HRImUUsTyA1YQaIhgEreGGPd+ZDWSI2I="; + }) + (fetchpatch { + name = "02_CVE-2024-45781.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=c1a291b01f4f1dcd6a22b61f1c81a45a966d16ba"; + hash = "sha256-q8ErK+cQzaqwSuhLRFL3AfYBkpgJq1IQmadnlmlz2yw="; + }) + (fetchpatch { + name = "03_CVE-2024-45782_CVE-2024-56737.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=417547c10410b714e43f08f74137c24015f8f4c3"; + hash = "sha256-mRinw27WZ2d1grzyzFGO18yXx72UVBM6Lf5cR8XJfs8="; + }) + (fetchpatch { + name = "04_fs_tar_initialize_name_in_grub_cpio_find_file.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=2c8ac08c99466c0697f704242363fc687f492a0d"; + hash = "sha256-EMGF0B+Fw6tSmllWUJAp1ynzWk+w2C/XM1LmXSReHWg="; + }) + (fetchpatch { + name = "05_CVE-2024-45780.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=0087bc6902182fe5cedce2d034c75a79cf6dd4f3"; + hash = "sha256-IlW5i4EJVoUYPu9/lb0LeytTpzltQuu5fpkFPQNIhls="; + }) + (fetchpatch { + name = "06_fs_f2fs_grub_errno_mount_fails.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=563436258cde64da6b974880abff1bf0959f4da3"; + hash = "sha256-Iu0RPyB+pAnqMT+MTX+TrJbYJsvYPn7jbMgE1jcLh/Q="; + }) + (fetchpatch { + name = "07_CVE-2024-45783.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=f7c070a2e28dfab7137db0739fb8db1dc02d8898"; + hash = "sha256-V1wh2dPeTazmad61jFtOjhq2MdoD+txPWY/AfwwyTZM="; + }) + (fetchpatch { + name = "08_fs_iso9660_grub_errno_mount_fails.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=965db5970811d18069b34f28f5f31ddadde90a97"; + hash = "sha256-6eN1AvZwXkJOQVcjgymy/E7QiAxzL/d0W3KlAZRqUzI="; + }) + (fetchpatch { + name = "09_fs_iso9660_fix_invalid_free.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=1443833a9535a5873f7de3798cf4d8389f366611"; + hash = "sha256-Gt5yMy5Vg9zrDggj3o/TLNt2vT9/6IuHg4Se2p8e8pI="; + }) + (fetchpatch { + name = "10_fs_jfs_fix_oob_read_jfs_getent.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=66175696f3a385b14bdf1ebcda7755834bd2d5fb"; + hash = "sha256-ETbzbc5gvf55sTLjmJOXXC9VH3qcP1Gv5seR/U9NRiY="; + }) + (fetchpatch { + name = "11_fs_jfs_fix_oob_read_caused_by_invalid_dir_slot_index.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=ab09fd0531f3523ac0ef833404526c98c08248f7"; + hash = "sha256-wE6niiIx4BdN800/Eegb6IbBRoMFpXq9kPvatwhWNXY="; + }) + (fetchpatch { + name = "12_fs_jfs_use_full_40_bits_offset_and_address_for_data_extent.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=bd999310fe67f35a66de3bfa2836da91589d04ef"; + hash = "sha256-fbC4oTEIoGWJASzJI5RXfoanrMLTfjFOI51LCUU7Ctg="; + }) + (fetchpatch { + name = "13_fs_jfs_inconsistent_signed_unsigned_types_usage.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=edd995a26ec98654d907a9436a296c2d82bc4b28"; + hash = "sha256-aa1G1vi4bPZejfKEqZokAZTzY9Ea2lyxTrP4drDV9tk="; + }) + (fetchpatch { + name = "14_fs_ext2_fix_out-of-bounds_read_for_inline_extent.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=7e2f750f0a795c4d64ec7dc7591edac8da2e978c"; + hash = "sha256-PtPqZHMU2fy7btRRaaswLyHizplxnygCzDfcg5ievOQ="; + }) + (fetchpatch { + name = "15_fs_ntfs_fix_out-of-bounds_read.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=aff26318783a135562b904ff09e2359893885732"; + hash = "sha256-znN6lkAB9aAhTGKR1038DzOz5nzuTp+7ylHVqRM7HeI="; + }) + (fetchpatch { + name = "16_fs_ntfs_track_the_end_of_the_MFT_attribute_buffer.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=237a71184a32d1ef7732f5f49ed6a89c5fe1c99a"; + hash = "sha256-0I/g0qHkWY6PArPn1UaYRhCrrh9bHknADh34v5eSjjM="; + }) + (fetchpatch { + name = "17_fs_ntfs_use_a_helper_function_to_access_attributes.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=048777bc29043403d077d41a81d0183767b8bc71"; + hash = "sha256-Mm49MSLqCq143r8ruLJm1QoyCoLtOlCBfqoAPwPlv8E="; + }) + # Patch 18 (067b6d225d482280abad03944f04e30abcbdafa1) has been removed because it causes regressions + # https://lists.gnu.org/archive/html/grub-devel/2025-03/msg00067.html + (fetchpatch { + name = "19_fs_xfs_fix_out-of-bounds_read.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=6ccc77b59d16578b10eaf8a4fe85c20b229f0d8a"; + hash = "sha256-FvTzFvfEi3oyxPC/dUHreyzzeVCskaUlYUjpKY/l0DE="; + }) + (fetchpatch { + name = "20_fs_xfs_ensuring_failing_to_mount_sets_a_grub_errno.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=d1d6b7ea58aa5a80a4c4d0666b49460056c8ef0a"; + hash = "sha256-SLdXMmYHq/gRmWrjRrOu5ZYFod84EllUL6hk+gnr3kg="; + }) + (fetchpatch { + name = "21_kern_file_ensure_file_data_is_set.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=a7910687294b29288ac649e71b47493c93294f17"; + hash = "sha256-DabZK9eSToEmSA9dEwtEN+URiVyS9qf6e2Y2UiMuy8Q="; + }) + (fetchpatch { + name = "22_kern_file_implement_filesystem_reference_counting.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=16f196874fbe360a1b3c66064ec15adadf94c57b"; + excludes = [ "grub-core/fs/erofs.c" ]; # Does not exist on 2.12 + hash = "sha256-yGU//1tPaxi+xFKZrsbUAnvgFpwtrIMG+8cPbSud4+U="; + }) + (fetchpatch { + name = "23_prerequisite_1_key_protector_add_key_protectors_framework.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=5d260302da672258444b01239803c8f4d753e3f3"; + hash = "sha256-9WnFN6xMiv+1XMhNHgVEegkhwzp9KpRZI6MIZY/Ih3Q="; + }) + (fetchpatch { + name = "23_prerequisite_2_disk_cryptodisk_allow_user_to_retry_failed_passphrase.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=386b59ddb42fa3f86ddfe557113b25c8fa16f88c"; + hash = "sha256-e1kGQB7wGWvEb2bY3xIpZxE1uzTt9JOKi05jXyUm+bI="; + }) + (fetchpatch { + name = "23_prerequisite_3_cryptodisk_support_key_protectors.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=ad0c52784a375cecaa8715d7deadcf5d65baf173"; + hash = "sha256-+YIvUYA3fLiOFFsXDrQjqjWFluzLa7N1tv0lwq8BqCs="; + }) + (fetchpatch { + name = "23_prerequisite_4_cryptodisk_fallback_to_passphrase.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=6abf8af3c54abc04c4ec71c75d10fcfbc190e181"; + hash = "sha256-eMu9rW4iJucDAsTQMJD1XE6dDIcUmn02cGqIaqBbO3o="; + }) + (fetchpatch { + name = "23_prerequisite_5_cryptodisk_wipe_out_the_cached_keys_from_protectors.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=b35480b48e6f9506d8b7ad8a3b5206d29c24ea95"; + hash = "sha256-5L6Rr+X5Z+Ip91z8cpLcatDW1vyEoZa1icL2oMXPXuI="; + }) + (fetchpatch { + name = "23_prerequisite_6_cli_lock_add_build_option_to_block_command_line_interface.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=bb65d81fe320e4b20d0a9b32232a7546eb275ecc"; + hash = "sha256-HxXgtvEhtaIjXbOcxJHNpD9/NVOv3uXPnue7cagEMu8="; + }) + (fetchpatch { + name = "23_CVE-2024-49504.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=13febd78db3cd85dcba67d8ad03ad4d42815f11e"; + hash = "sha256-U7lNUb4iVAyQ1yEg5ECHCQGE51tKvY13T9Ji09Q1W9Y="; + }) + (fetchpatch { + name = "24_disk_loopback_reference_tracking_for_the_loopback.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=67f70f70a36b6e87a65f928fe1e840a12eafb7ae"; + hash = "sha256-sWBnSF3rAuY1A/IIK1Pc+BqTvyK3j7+lLEhvImtBQMA="; + }) + (fetchpatch { + name = "25_kern_disk_limit_recursion_depth.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=18212f0648b6de7d71d4c8f41eb4d8b78b3a299b"; + hash = "sha256-HiVzXUNs45Fxh4DSqO8wAxSBM7CaYU/bix0PVBcIHGw="; + }) + (fetchpatch { + name = "26_kern_partition_limit_recursion_in_part_iterate.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=8a7103fddfd6664f41081f3bb88eebbf2871da2a"; + hash = "sha256-Nw1VFRVww1VSDSBkRrnTGeaA2PKCitugM12XH6X/2YI="; + }) + (fetchpatch { + name = "27_script_execute_limit_the_recursion_depth.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=d8a937ccae5c6d86dc4375698afca5cefdcd01e1"; + hash = "sha256-YOAdPMZ2iBNMzIwAXFkkyTMKh4ptZUQ0J3v9EjnRlbo="; + }) + (fetchpatch { + name = "28_net_unregister_net_default_ip_and_net_default_mac_variables_hooks_on_unload.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=a1dd8e59da26f1a9608381d3a1a6c0f465282b1d"; + hash = "sha256-7fqdkhFqLECzhz1OLavkHrE9ktDAEmx9ZxZayNr/Eo4="; + }) + (fetchpatch { + name = "29_net_remove_variables_hooks_when_interface_is_unregisted.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=aa8b4d7facef7b75a2703274b1b9d4e0e734c401"; + hash = "sha256-m3VLDbJlwchV5meEpU4LJrDxBtA80qvYcVMJinHLnac="; + }) + (fetchpatch { + name = "30_CVE-2025-0624.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=5eef88152833062a3f7e017535372d64ac8ef7e1"; + hash = "sha256-DvhzHnenAmO9SZpi4kU+0GhyKZB4q4xQYuNJgEhJmn0="; + }) + (fetchpatch { + name = "31_net_tftp_fix_stack_buffer_overflow_in_tftp_open.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=0707accab1b9be5d3645d4700dde3f99209f9367"; + hash = "sha256-16NrpWFSE4jFT2uxmJg16jChw8HiGRTol25XQXNQ5l4="; + }) + (fetchpatch { + name = "32_CVE-2024-45774.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=2c34af908ebf4856051ed29e46d88abd2b20387f"; + hash = "sha256-OWmF+fp2TmetQjV4EWMcESW8u52Okkb5C5IPLfczyv4="; + }) + (fetchpatch { + name = "33_kern_dl_fix_for_an_integer_overflow_in_grub_dl_ref.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=500e5fdd82ca40412b0b73f5e5dda38e4a3af96d"; + hash = "sha256-FNqOWo+oZ4/1sCbTi2uaeKchUxwAKXtbzhScezm0yxk="; + }) + # Patch 34 (https://git.savannah.gnu.org/cgit/grub.git/patch/?id=d72208423dcabf9eb4a3bcb17b6b31888396bd49) + # is skipped, grub_dl_set_mem_attrs() does not exist on 2.12 + (fetchpatch { + name = "35_kern_dl_check_for_the_SHF_INFO_LINK_flag_in_grub_dl_relocate_symbols.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=98ad84328dcabfa603dcf5bd217570aa6b4bdd99"; + hash = "sha256-Zi4Pj2NbodL0VhhO5MWhvErb8xmA7Li0ur0MxpgQjzg="; + }) + (fetchpatch { + name = "36_CVE-2024-45775.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=05be856a8c3aae41f5df90cab7796ab7ee34b872"; + hash = "sha256-T6DO8iuImQTP7hPaCAHMtFnheQoCkZ6w+kfNolLPmrY="; + }) + (fetchpatch { + name = "37_commands_ls_fix_NULL_dereference.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=0bf56bce47489c059e50e61a3db7f682d8c44b56"; + hash = "sha256-h5okwqv4ZFahP3ANUbsk1fiSV4pwEnxUExeBgQ4tiTI="; + }) + (fetchpatch { + name = "38_CVE-2025-0622.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=2123c5bca7e21fbeb0263df4597ddd7054700726"; + hash = "sha256-tFE7VgImGZWDICyvHbrI1hqW6/XohgdTmk21MzljMGw="; + }) + (fetchpatch { + name = "39_CVE-2025-0622.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=9c16197734ada8d0838407eebe081117799bfe67"; + hash = "sha256-tTeuEvadKbXVuY0m0dKtTr11Lpb3yQi4zk0bpwrMOeA="; + }) + (fetchpatch { + name = "40_CVE-2025-0622.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=7580addfc8c94cedb0cdfd7a1fd65b539215e637"; + hash = "sha256-khRLpWqE7hzzoqssVkGFMjAv09T+uHn13Q9pCpogMms="; + }) + (fetchpatch { + name = "41_CVE-2024-45776.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=09bd6eb58b0f71ec273916070fa1e2de16897a91"; + hash = "sha256-yrl/6XUdKQg/MLe8KFuFoRRbQSyOhDmyvnWBV+sr3EY="; + }) + (fetchpatch { + name = "42_CVE-2024-45777.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=b970a5ed967816bbca8225994cd0ee2557bad515"; + hash = "sha256-Vl5Emw3O3Ba2hD1GCWune4PGduDDPO0gM5u+zx/OwKo="; + }) + (fetchpatch { + name = "43_CVE-2025-0690.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=dad8f502974ed9ad0a70ae6820d17b4b142558fc"; + hash = "sha256-DeWOncndX2VM8w1lb5fd5wHAZrI+ChB5Pj9XbUIfDWY="; + }) + (fetchpatch { + name = "44_commands_test_stack_overflow_due_to_unlimited_recursion_depth.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=c68b7d23628a19da67ebe2e06f84165ee04961af"; + hash = "sha256-aputM9KqkB/cK8hBiU9VXbu0LpLNlNCMVIeE9h2pMgY="; + }) + (fetchpatch { + name = "45_CVE-2025-1118.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=34824806ac6302f91e8cabaa41308eaced25725f"; + hash = "sha256-PKQs+fCwj4a9p4hbMqAT3tFNoAOw4xnbKmCwjPUgEOc="; + }) + (fetchpatch { + name = "46_commands_memrw_disable_memory_reading_in_lockdown_mode.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=340e4d058f584534f4b90b7dbea2b64a9f8c418c"; + hash = "sha256-NiMIUnfRreDBw+k4yxUzoRNMFL8pkJhVtkINVgmv5XA="; + }) + (fetchpatch { + name = "47_commands_hexdump_disable_memory_reading_in_lockdown_mode.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=5f31164aed51f498957cdd6ed733ec71a8592c99"; + hash = "sha256-NA7QjxZ9FP+WwiOveqLkbZqsF7hULIyaVS3gNaSUXJE="; + }) + (fetchpatch { + name = "48_CVE-2024-45778_CVE-2024-45779.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=26db6605036bd9e5b16d9068a8cc75be63b8b630"; + hash = "sha256-1+ImwkF/qsejWs2lpyO6xbcqVo2NJGv32gjrP8mEPnI="; + }) + (fetchpatch { + name = "49_CVE-2025-0677_CVE-2025-0684_CVE-2025-0685_CVE-2025-0686_CVE-2025-0689.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=c4bc55da28543d2522a939ba4ee0acde45f2fa74"; + hash = "sha256-qrlErSImMX8eXJHkXjOe5GZ6lWOya5SVpNoiqyEM1lE="; + }) + (fetchpatch { + name = "50_disk_use_safe_math_macros_to_prevent_overflows.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=c407724dad6c3e2fc1571e57adbda71cc03f82aa"; + hash = "sha256-kkAjxXvCdzwqh+oWtEF3qSPiUX9cGWO6eSFVeo7WJzQ="; + }) + (fetchpatch { + name = "51_disk_prevent_overflows_when_allocating_memory_for_arrays.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=d8151f98331ee4d15fcca59edffa59246d8fc15f"; + hash = "sha256-2U+gMLigOCCg3P1GB615xQ0B9PDA6j92tt1ba3Tqg+E="; + }) + (fetchpatch { + name = "52_disk_check_if_returned_pointer_for_allocated_memory_is_NULL.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=33bd6b5ac5c77b346769ab5284262f94e695e464"; + hash = "sha256-+BaJRskWP/YVEdvIxMvEydjQx2LpLlGphRtZjiOUxJ0="; + }) + (fetchpatch { + name = "53_disk_ieee1275_ofdisk_call_grub_ieee1275_close_when_grub_malloc_fails.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=fbaddcca541805c333f0fc792b82772594e73753"; + hash = "sha256-9sGA41HlB/8rtT/fMfkDo4ZJMXBSr+EyN92l/0gDfl4="; + }) + (fetchpatch { + name = "54_fs_use_safe_math_macros_to_prevent_overflows.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=6608163b08a7a8be4b0ab2a5cd4593bba07fe2b7"; + excludes = [ "grub-core/fs/erofs.c" ]; # Does not exist on 2.12 + hash = "sha256-mW4MH5VH5pDxCaFhNh/4mEcYloga56p8vCi7X4kSaek="; + }) + (fetchpatch { + name = "55_CVE-2025-0678_CVE-2025-1125.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=84bc0a9a68835952ae69165c11709811dae7634e"; + hash = "sha256-rCliqM2+k7rTGNpdHFkg3pHvuISjoG0MQr6/8lIvwK4="; + }) + (fetchpatch { + name = "56_fs_prevent_overflows_when_assigning_returned_values_from_read_number.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=cde9f7f338f8f5771777f0e7dfc423ddf952ad31"; + hash = "sha256-dN3HJXNIYtaUZL0LhLabC4VKK6CVC8km9UTw/ln/6ys="; + }) + (fetchpatch { + name = "57_fs_zfs_use_safe_math_macros_to_prevent_overflows.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=88e491a0f744c6b19b6d4caa300a576ba56db7c9"; + hash = "sha256-taSuKyCf9+TiQZcF26yMWpDDQqCfTdRuZTqB9aEz3aA="; + }) + (fetchpatch { + name = "58_fs_zfs_prevent_overflows_when_allocating_memory_for_arrays.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=7f38e32c7ebeaebb79e2c71e3c7d5ea367d3a39c"; + hash = "sha256-E5VmP7I4TAEXxTz3j7mi/uIr9kOSzMoPHAYAbyu56Xk="; + }) + (fetchpatch { + name = "59_fs_zfs_check_if_returned_pointer_for_allocated_memory_is_NULL.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=13065f69dae0eeb60813809026de5bd021051892"; + hash = "sha256-1W//rHUspDS+utdNc069J8lX1ONfoBKiJYnUt46C/D0="; + }) + (fetchpatch { + name = "60_fs_zfs_add_missing_NULL_check_after_grub_strdup_call.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=dd6a4c8d10e02ca5056681e75795041a343636e4"; + hash = "sha256-iFLEkz5G6aQ8FXGuY7/wgN4d4o0+sUxWMKYIFcQ/H+o="; + }) + (fetchpatch { + name = "61_net_use_safe_math_macros_to_prevent_overflows.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=4beeff8a31c4fb4071d2225533cfa316b5a58391"; + hash = "sha256-/gs5ZhplQ1h7PWw0p+b5+0OxmRcvDRKWHj39ezhivcg="; + }) + (fetchpatch { + name = "62_net_prevent_overflows_when_allocating_memory_for_arrays.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=dee2c14fd66bc497cdc74c69fde8c9b84637c8eb"; + hash = "sha256-cO02tCGEeQhQF0TmgtNOgUwRLnNgmxhEefo1gtSlFOk="; + }) + (fetchpatch { + name = "63_net_check_if_returned_pointer_for_allocated_memory_is_NULL.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=1c06ec900591d1fab6fbacf80dc010541d0a5ec8"; + hash = "sha256-oSRhWWVraitoVDqGlFOVzdCkaNqFGOHLjJu75CSc388="; + }) + (fetchpatch { + name = "64_fs_sfs_check_if_allocated_memory_is_NULL.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=e3c578a56f9294e286b6028ca7c1def997a17b15"; + hash = "sha256-7tvFbmjWmWmmRykQjMvZV6IYlhSS8oNR7YfaO5XXAfU="; + }) + (fetchpatch { + name = "65_script_execute_fix_potential_underflow_and_NULL.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=d13b6e8ebd10b4eb16698a002aa40258cf6e6f0e"; + hash = "sha256-paMWaAIImzxtufUrVF5v4T4KnlDAJIPhdaHznu5CyZ8="; + }) + (fetchpatch { + name = "66_osdep_unix_getroot_fix_potential_underflow.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=66733f7c7dae889861ea3ef3ec0710811486019e"; + hash = "sha256-/14HC1kcW7Sy9WfJQFfC+YnvS/GNTMP+Uy6Dxd3zkwc="; + }) + (fetchpatch { + name = "67_misc_ensure_consistent_overflow_error_messages.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=f8795cde217e21539c2f236bcbb1a4bf521086b3"; + hash = "sha256-4X7wr1Tg16xDE9FO6NTlgkfLV5zFKmajeaOspIqcCuI="; + }) + (fetchpatch { + name = "68_bus_usb_ehci_define_GRUB_EHCI_TOGGLE_as_grub_uint32_t.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=9907d9c2723304b42cf6da74f1cc6c4601391956"; + hash = "sha256-D8xaI8g7ffGGmZqqeS8wxWIFLUWUBfmHwMVOHkYTc2I="; + }) + (fetchpatch { + name = "69_normal_menu_use_safe_math_to_avoid_an_integer_overflow.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=5b36a5210e21bee2624f8acc36aefd8f10266adb"; + hash = "sha256-UourmM0Zlaj4o+SnYi5AtjfNujDOt+2ez2XH/uWyiaM="; + }) + (fetchpatch { + name = "70_kern_partition_add_sanity_check_after_grub_strtoul_call.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=8e6e87e7923ca2ae880021cb42a35cc9bb4c8fe2"; + hash = "sha256-4keMUu6ZDKmuSQlFnldV15dDGUibsnSvoEWhLsqWieI="; + }) + (fetchpatch { + name = "71_kern_misc_add_sanity_check_after_grub_strtoul_call.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=a8d6b06331a75d75b46f3dd6cc6fcd40dcf604b7"; + hash = "sha256-2Mpe1sqyuoUPyMAKGZTNzG/ig3G3K8w0gia7lc508Rg="; + }) + (fetchpatch { + name = "72_loader_i386_linux_cast_left_shift_to_grub_uint32_t.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=490a6ab71cebd96fae7a1ceb9067484f5ccbec2a"; + hash = "sha256-e49OC1EBaX0/nWTTXT5xE5apTJPQV0myP5Ohxn9Wwa8="; + }) + (fetchpatch { + name = "73_loader_i386_bsd_use_safe_math_to_avoid_underflow.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=4dc6166571645780c459dde2cdc1b001a5ec844c"; + hash = "sha256-e8X+oBvejcFNOY1Tp/f6QqCDwrgK7f9u1F8SdO/dhy4="; + }) + (fetchpatch { + # Fixes 7e2f750f0a (security patch 14/73) + name = "fs_ext2_rework_out-of-bounds_read_for_inline_and_external_extents.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=348cd416a3574348f4255bf2b04ec95938990997"; + hash = "sha256-WBLYQxv8si2tvdPAvbm0/4NNqYWBMJpFV4GC0HhN/kE="; + }) + ]; - patches = [ - ./fix-bash-completion.patch - ./add-hidden-menu-entries.patch - - # https://lists.gnu.org/archive/html/grub-devel/2025-02/msg00024.html - (fetchpatch { - name = "01_implement_grub_strlcpy.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=ea703528a8581a2ea7e0bad424a70fdf0aec7d8f"; - hash = "sha256-MSMgu1vMG83HRImUUsTyA1YQaIhgEreGGPd+ZDWSI2I="; - }) - (fetchpatch { - name = "02_CVE-2024-45781.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=c1a291b01f4f1dcd6a22b61f1c81a45a966d16ba"; - hash = "sha256-q8ErK+cQzaqwSuhLRFL3AfYBkpgJq1IQmadnlmlz2yw="; - }) - (fetchpatch { - name = "03_CVE-2024-45782_CVE-2024-56737.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=417547c10410b714e43f08f74137c24015f8f4c3"; - hash = "sha256-mRinw27WZ2d1grzyzFGO18yXx72UVBM6Lf5cR8XJfs8="; - }) - (fetchpatch { - name = "04_fs_tar_initialize_name_in_grub_cpio_find_file.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=2c8ac08c99466c0697f704242363fc687f492a0d"; - hash = "sha256-EMGF0B+Fw6tSmllWUJAp1ynzWk+w2C/XM1LmXSReHWg="; - }) - (fetchpatch { - name = "05_CVE-2024-45780.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=0087bc6902182fe5cedce2d034c75a79cf6dd4f3"; - hash = "sha256-IlW5i4EJVoUYPu9/lb0LeytTpzltQuu5fpkFPQNIhls="; - }) - (fetchpatch { - name = "06_fs_f2fs_grub_errno_mount_fails.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=563436258cde64da6b974880abff1bf0959f4da3"; - hash = "sha256-Iu0RPyB+pAnqMT+MTX+TrJbYJsvYPn7jbMgE1jcLh/Q="; - }) - (fetchpatch { - name = "07_CVE-2024-45783.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=f7c070a2e28dfab7137db0739fb8db1dc02d8898"; - hash = "sha256-V1wh2dPeTazmad61jFtOjhq2MdoD+txPWY/AfwwyTZM="; - }) - (fetchpatch { - name = "08_fs_iso9660_grub_errno_mount_fails.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=965db5970811d18069b34f28f5f31ddadde90a97"; - hash = "sha256-6eN1AvZwXkJOQVcjgymy/E7QiAxzL/d0W3KlAZRqUzI="; - }) - (fetchpatch { - name = "09_fs_iso9660_fix_invalid_free.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=1443833a9535a5873f7de3798cf4d8389f366611"; - hash = "sha256-Gt5yMy5Vg9zrDggj3o/TLNt2vT9/6IuHg4Se2p8e8pI="; - }) - (fetchpatch { - name = "10_fs_jfs_fix_oob_read_jfs_getent.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=66175696f3a385b14bdf1ebcda7755834bd2d5fb"; - hash = "sha256-ETbzbc5gvf55sTLjmJOXXC9VH3qcP1Gv5seR/U9NRiY="; - }) - (fetchpatch { - name = "11_fs_jfs_fix_oob_read_caused_by_invalid_dir_slot_index.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=ab09fd0531f3523ac0ef833404526c98c08248f7"; - hash = "sha256-wE6niiIx4BdN800/Eegb6IbBRoMFpXq9kPvatwhWNXY="; - }) - (fetchpatch { - name = "12_fs_jfs_use_full_40_bits_offset_and_address_for_data_extent.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=bd999310fe67f35a66de3bfa2836da91589d04ef"; - hash = "sha256-fbC4oTEIoGWJASzJI5RXfoanrMLTfjFOI51LCUU7Ctg="; - }) - (fetchpatch { - name = "13_fs_jfs_inconsistent_signed_unsigned_types_usage.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=edd995a26ec98654d907a9436a296c2d82bc4b28"; - hash = "sha256-aa1G1vi4bPZejfKEqZokAZTzY9Ea2lyxTrP4drDV9tk="; - }) - (fetchpatch { - name = "14_fs_ext2_fix_out-of-bounds_read_for_inline_extent.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=7e2f750f0a795c4d64ec7dc7591edac8da2e978c"; - hash = "sha256-PtPqZHMU2fy7btRRaaswLyHizplxnygCzDfcg5ievOQ="; - }) - (fetchpatch { - name = "15_fs_ntfs_fix_out-of-bounds_read.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=aff26318783a135562b904ff09e2359893885732"; - hash = "sha256-znN6lkAB9aAhTGKR1038DzOz5nzuTp+7ylHVqRM7HeI="; - }) - (fetchpatch { - name = "16_fs_ntfs_track_the_end_of_the_MFT_attribute_buffer.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=237a71184a32d1ef7732f5f49ed6a89c5fe1c99a"; - hash = "sha256-0I/g0qHkWY6PArPn1UaYRhCrrh9bHknADh34v5eSjjM="; - }) - (fetchpatch { - name = "17_fs_ntfs_use_a_helper_function_to_access_attributes.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=048777bc29043403d077d41a81d0183767b8bc71"; - hash = "sha256-Mm49MSLqCq143r8ruLJm1QoyCoLtOlCBfqoAPwPlv8E="; - }) - # Patch 18 (067b6d225d482280abad03944f04e30abcbdafa1) has been removed because it causes regressions - # https://lists.gnu.org/archive/html/grub-devel/2025-03/msg00067.html - (fetchpatch { - name = "19_fs_xfs_fix_out-of-bounds_read.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=6ccc77b59d16578b10eaf8a4fe85c20b229f0d8a"; - hash = "sha256-FvTzFvfEi3oyxPC/dUHreyzzeVCskaUlYUjpKY/l0DE="; - }) - (fetchpatch { - name = "20_fs_xfs_ensuring_failing_to_mount_sets_a_grub_errno.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=d1d6b7ea58aa5a80a4c4d0666b49460056c8ef0a"; - hash = "sha256-SLdXMmYHq/gRmWrjRrOu5ZYFod84EllUL6hk+gnr3kg="; - }) - (fetchpatch { - name = "21_kern_file_ensure_file_data_is_set.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=a7910687294b29288ac649e71b47493c93294f17"; - hash = "sha256-DabZK9eSToEmSA9dEwtEN+URiVyS9qf6e2Y2UiMuy8Q="; - }) - (fetchpatch { - name = "22_kern_file_implement_filesystem_reference_counting.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=16f196874fbe360a1b3c66064ec15adadf94c57b"; - excludes = [ "grub-core/fs/erofs.c" ]; # Does not exist on 2.12 - hash = "sha256-yGU//1tPaxi+xFKZrsbUAnvgFpwtrIMG+8cPbSud4+U="; - }) - (fetchpatch { - name = "23_prerequisite_1_key_protector_add_key_protectors_framework.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=5d260302da672258444b01239803c8f4d753e3f3"; - hash = "sha256-9WnFN6xMiv+1XMhNHgVEegkhwzp9KpRZI6MIZY/Ih3Q="; - }) - (fetchpatch { - name = "23_prerequisite_2_disk_cryptodisk_allow_user_to_retry_failed_passphrase.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=386b59ddb42fa3f86ddfe557113b25c8fa16f88c"; - hash = "sha256-e1kGQB7wGWvEb2bY3xIpZxE1uzTt9JOKi05jXyUm+bI="; - }) - (fetchpatch { - name = "23_prerequisite_3_cryptodisk_support_key_protectors.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=ad0c52784a375cecaa8715d7deadcf5d65baf173"; - hash = "sha256-+YIvUYA3fLiOFFsXDrQjqjWFluzLa7N1tv0lwq8BqCs="; - }) - (fetchpatch { - name = "23_prerequisite_4_cryptodisk_fallback_to_passphrase.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=6abf8af3c54abc04c4ec71c75d10fcfbc190e181"; - hash = "sha256-eMu9rW4iJucDAsTQMJD1XE6dDIcUmn02cGqIaqBbO3o="; - }) - (fetchpatch { - name = "23_prerequisite_5_cryptodisk_wipe_out_the_cached_keys_from_protectors.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=b35480b48e6f9506d8b7ad8a3b5206d29c24ea95"; - hash = "sha256-5L6Rr+X5Z+Ip91z8cpLcatDW1vyEoZa1icL2oMXPXuI="; - }) - (fetchpatch { - name = "23_prerequisite_6_cli_lock_add_build_option_to_block_command_line_interface.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=bb65d81fe320e4b20d0a9b32232a7546eb275ecc"; - hash = "sha256-HxXgtvEhtaIjXbOcxJHNpD9/NVOv3uXPnue7cagEMu8="; - }) - (fetchpatch { - name = "23_CVE-2024-49504.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=13febd78db3cd85dcba67d8ad03ad4d42815f11e"; - hash = "sha256-U7lNUb4iVAyQ1yEg5ECHCQGE51tKvY13T9Ji09Q1W9Y="; - }) - (fetchpatch { - name = "24_disk_loopback_reference_tracking_for_the_loopback.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=67f70f70a36b6e87a65f928fe1e840a12eafb7ae"; - hash = "sha256-sWBnSF3rAuY1A/IIK1Pc+BqTvyK3j7+lLEhvImtBQMA="; - }) - (fetchpatch { - name = "25_kern_disk_limit_recursion_depth.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=18212f0648b6de7d71d4c8f41eb4d8b78b3a299b"; - hash = "sha256-HiVzXUNs45Fxh4DSqO8wAxSBM7CaYU/bix0PVBcIHGw="; - }) - (fetchpatch { - name = "26_kern_partition_limit_recursion_in_part_iterate.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=8a7103fddfd6664f41081f3bb88eebbf2871da2a"; - hash = "sha256-Nw1VFRVww1VSDSBkRrnTGeaA2PKCitugM12XH6X/2YI="; - }) - (fetchpatch { - name = "27_script_execute_limit_the_recursion_depth.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=d8a937ccae5c6d86dc4375698afca5cefdcd01e1"; - hash = "sha256-YOAdPMZ2iBNMzIwAXFkkyTMKh4ptZUQ0J3v9EjnRlbo="; - }) - (fetchpatch { - name = "28_net_unregister_net_default_ip_and_net_default_mac_variables_hooks_on_unload.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=a1dd8e59da26f1a9608381d3a1a6c0f465282b1d"; - hash = "sha256-7fqdkhFqLECzhz1OLavkHrE9ktDAEmx9ZxZayNr/Eo4="; - }) - (fetchpatch { - name = "29_net_remove_variables_hooks_when_interface_is_unregisted.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=aa8b4d7facef7b75a2703274b1b9d4e0e734c401"; - hash = "sha256-m3VLDbJlwchV5meEpU4LJrDxBtA80qvYcVMJinHLnac="; - }) - (fetchpatch { - name = "30_CVE-2025-0624.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=5eef88152833062a3f7e017535372d64ac8ef7e1"; - hash = "sha256-DvhzHnenAmO9SZpi4kU+0GhyKZB4q4xQYuNJgEhJmn0="; - }) - (fetchpatch { - name = "31_net_tftp_fix_stack_buffer_overflow_in_tftp_open.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=0707accab1b9be5d3645d4700dde3f99209f9367"; - hash = "sha256-16NrpWFSE4jFT2uxmJg16jChw8HiGRTol25XQXNQ5l4="; - }) - (fetchpatch { - name = "32_CVE-2024-45774.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=2c34af908ebf4856051ed29e46d88abd2b20387f"; - hash = "sha256-OWmF+fp2TmetQjV4EWMcESW8u52Okkb5C5IPLfczyv4="; - }) - (fetchpatch { - name = "33_kern_dl_fix_for_an_integer_overflow_in_grub_dl_ref.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=500e5fdd82ca40412b0b73f5e5dda38e4a3af96d"; - hash = "sha256-FNqOWo+oZ4/1sCbTi2uaeKchUxwAKXtbzhScezm0yxk="; - }) - # Patch 34 (https://git.savannah.gnu.org/cgit/grub.git/patch/?id=d72208423dcabf9eb4a3bcb17b6b31888396bd49) - # is skipped, grub_dl_set_mem_attrs() does not exist on 2.12 - (fetchpatch { - name = "35_kern_dl_check_for_the_SHF_INFO_LINK_flag_in_grub_dl_relocate_symbols.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=98ad84328dcabfa603dcf5bd217570aa6b4bdd99"; - hash = "sha256-Zi4Pj2NbodL0VhhO5MWhvErb8xmA7Li0ur0MxpgQjzg="; - }) - (fetchpatch { - name = "36_CVE-2024-45775.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=05be856a8c3aae41f5df90cab7796ab7ee34b872"; - hash = "sha256-T6DO8iuImQTP7hPaCAHMtFnheQoCkZ6w+kfNolLPmrY="; - }) - (fetchpatch { - name = "37_commands_ls_fix_NULL_dereference.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=0bf56bce47489c059e50e61a3db7f682d8c44b56"; - hash = "sha256-h5okwqv4ZFahP3ANUbsk1fiSV4pwEnxUExeBgQ4tiTI="; - }) - (fetchpatch { - name = "38_CVE-2025-0622.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=2123c5bca7e21fbeb0263df4597ddd7054700726"; - hash = "sha256-tFE7VgImGZWDICyvHbrI1hqW6/XohgdTmk21MzljMGw="; - }) - (fetchpatch { - name = "39_CVE-2025-0622.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=9c16197734ada8d0838407eebe081117799bfe67"; - hash = "sha256-tTeuEvadKbXVuY0m0dKtTr11Lpb3yQi4zk0bpwrMOeA="; - }) - (fetchpatch { - name = "40_CVE-2025-0622.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=7580addfc8c94cedb0cdfd7a1fd65b539215e637"; - hash = "sha256-khRLpWqE7hzzoqssVkGFMjAv09T+uHn13Q9pCpogMms="; - }) - (fetchpatch { - name = "41_CVE-2024-45776.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=09bd6eb58b0f71ec273916070fa1e2de16897a91"; - hash = "sha256-yrl/6XUdKQg/MLe8KFuFoRRbQSyOhDmyvnWBV+sr3EY="; - }) - (fetchpatch { - name = "42_CVE-2024-45777.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=b970a5ed967816bbca8225994cd0ee2557bad515"; - hash = "sha256-Vl5Emw3O3Ba2hD1GCWune4PGduDDPO0gM5u+zx/OwKo="; - }) - (fetchpatch { - name = "43_CVE-2025-0690.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=dad8f502974ed9ad0a70ae6820d17b4b142558fc"; - hash = "sha256-DeWOncndX2VM8w1lb5fd5wHAZrI+ChB5Pj9XbUIfDWY="; - }) - (fetchpatch { - name = "44_commands_test_stack_overflow_due_to_unlimited_recursion_depth.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=c68b7d23628a19da67ebe2e06f84165ee04961af"; - hash = "sha256-aputM9KqkB/cK8hBiU9VXbu0LpLNlNCMVIeE9h2pMgY="; - }) - (fetchpatch { - name = "45_CVE-2025-1118.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=34824806ac6302f91e8cabaa41308eaced25725f"; - hash = "sha256-PKQs+fCwj4a9p4hbMqAT3tFNoAOw4xnbKmCwjPUgEOc="; - }) - (fetchpatch { - name = "46_commands_memrw_disable_memory_reading_in_lockdown_mode.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=340e4d058f584534f4b90b7dbea2b64a9f8c418c"; - hash = "sha256-NiMIUnfRreDBw+k4yxUzoRNMFL8pkJhVtkINVgmv5XA="; - }) - (fetchpatch { - name = "47_commands_hexdump_disable_memory_reading_in_lockdown_mode.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=5f31164aed51f498957cdd6ed733ec71a8592c99"; - hash = "sha256-NA7QjxZ9FP+WwiOveqLkbZqsF7hULIyaVS3gNaSUXJE="; - }) - (fetchpatch { - name = "48_CVE-2024-45778_CVE-2024-45779.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=26db6605036bd9e5b16d9068a8cc75be63b8b630"; - hash = "sha256-1+ImwkF/qsejWs2lpyO6xbcqVo2NJGv32gjrP8mEPnI="; - }) - (fetchpatch { - name = "49_CVE-2025-0677_CVE-2025-0684_CVE-2025-0685_CVE-2025-0686_CVE-2025-0689.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=c4bc55da28543d2522a939ba4ee0acde45f2fa74"; - hash = "sha256-qrlErSImMX8eXJHkXjOe5GZ6lWOya5SVpNoiqyEM1lE="; - }) - (fetchpatch { - name = "50_disk_use_safe_math_macros_to_prevent_overflows.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=c407724dad6c3e2fc1571e57adbda71cc03f82aa"; - hash = "sha256-kkAjxXvCdzwqh+oWtEF3qSPiUX9cGWO6eSFVeo7WJzQ="; - }) - (fetchpatch { - name = "51_disk_prevent_overflows_when_allocating_memory_for_arrays.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=d8151f98331ee4d15fcca59edffa59246d8fc15f"; - hash = "sha256-2U+gMLigOCCg3P1GB615xQ0B9PDA6j92tt1ba3Tqg+E="; - }) - (fetchpatch { - name = "52_disk_check_if_returned_pointer_for_allocated_memory_is_NULL.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=33bd6b5ac5c77b346769ab5284262f94e695e464"; - hash = "sha256-+BaJRskWP/YVEdvIxMvEydjQx2LpLlGphRtZjiOUxJ0="; - }) - (fetchpatch { - name = "53_disk_ieee1275_ofdisk_call_grub_ieee1275_close_when_grub_malloc_fails.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=fbaddcca541805c333f0fc792b82772594e73753"; - hash = "sha256-9sGA41HlB/8rtT/fMfkDo4ZJMXBSr+EyN92l/0gDfl4="; - }) - (fetchpatch { - name = "54_fs_use_safe_math_macros_to_prevent_overflows.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=6608163b08a7a8be4b0ab2a5cd4593bba07fe2b7"; - excludes = [ "grub-core/fs/erofs.c" ]; # Does not exist on 2.12 - hash = "sha256-mW4MH5VH5pDxCaFhNh/4mEcYloga56p8vCi7X4kSaek="; - }) - (fetchpatch { - name = "55_CVE-2025-0678_CVE-2025-1125.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=84bc0a9a68835952ae69165c11709811dae7634e"; - hash = "sha256-rCliqM2+k7rTGNpdHFkg3pHvuISjoG0MQr6/8lIvwK4="; - }) - (fetchpatch { - name = "56_fs_prevent_overflows_when_assigning_returned_values_from_read_number.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=cde9f7f338f8f5771777f0e7dfc423ddf952ad31"; - hash = "sha256-dN3HJXNIYtaUZL0LhLabC4VKK6CVC8km9UTw/ln/6ys="; - }) - (fetchpatch { - name = "57_fs_zfs_use_safe_math_macros_to_prevent_overflows.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=88e491a0f744c6b19b6d4caa300a576ba56db7c9"; - hash = "sha256-taSuKyCf9+TiQZcF26yMWpDDQqCfTdRuZTqB9aEz3aA="; - }) - (fetchpatch { - name = "58_fs_zfs_prevent_overflows_when_allocating_memory_for_arrays.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=7f38e32c7ebeaebb79e2c71e3c7d5ea367d3a39c"; - hash = "sha256-E5VmP7I4TAEXxTz3j7mi/uIr9kOSzMoPHAYAbyu56Xk="; - }) - (fetchpatch { - name = "59_fs_zfs_check_if_returned_pointer_for_allocated_memory_is_NULL.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=13065f69dae0eeb60813809026de5bd021051892"; - hash = "sha256-1W//rHUspDS+utdNc069J8lX1ONfoBKiJYnUt46C/D0="; - }) - (fetchpatch { - name = "60_fs_zfs_add_missing_NULL_check_after_grub_strdup_call.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=dd6a4c8d10e02ca5056681e75795041a343636e4"; - hash = "sha256-iFLEkz5G6aQ8FXGuY7/wgN4d4o0+sUxWMKYIFcQ/H+o="; - }) - (fetchpatch { - name = "61_net_use_safe_math_macros_to_prevent_overflows.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=4beeff8a31c4fb4071d2225533cfa316b5a58391"; - hash = "sha256-/gs5ZhplQ1h7PWw0p+b5+0OxmRcvDRKWHj39ezhivcg="; - }) - (fetchpatch { - name = "62_net_prevent_overflows_when_allocating_memory_for_arrays.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=dee2c14fd66bc497cdc74c69fde8c9b84637c8eb"; - hash = "sha256-cO02tCGEeQhQF0TmgtNOgUwRLnNgmxhEefo1gtSlFOk="; - }) - (fetchpatch { - name = "63_net_check_if_returned_pointer_for_allocated_memory_is_NULL.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=1c06ec900591d1fab6fbacf80dc010541d0a5ec8"; - hash = "sha256-oSRhWWVraitoVDqGlFOVzdCkaNqFGOHLjJu75CSc388="; - }) - (fetchpatch { - name = "64_fs_sfs_check_if_allocated_memory_is_NULL.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=e3c578a56f9294e286b6028ca7c1def997a17b15"; - hash = "sha256-7tvFbmjWmWmmRykQjMvZV6IYlhSS8oNR7YfaO5XXAfU="; - }) - (fetchpatch { - name = "65_script_execute_fix_potential_underflow_and_NULL.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=d13b6e8ebd10b4eb16698a002aa40258cf6e6f0e"; - hash = "sha256-paMWaAIImzxtufUrVF5v4T4KnlDAJIPhdaHznu5CyZ8="; - }) - (fetchpatch { - name = "66_osdep_unix_getroot_fix_potential_underflow.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=66733f7c7dae889861ea3ef3ec0710811486019e"; - hash = "sha256-/14HC1kcW7Sy9WfJQFfC+YnvS/GNTMP+Uy6Dxd3zkwc="; - }) - (fetchpatch { - name = "67_misc_ensure_consistent_overflow_error_messages.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=f8795cde217e21539c2f236bcbb1a4bf521086b3"; - hash = "sha256-4X7wr1Tg16xDE9FO6NTlgkfLV5zFKmajeaOspIqcCuI="; - }) - (fetchpatch { - name = "68_bus_usb_ehci_define_GRUB_EHCI_TOGGLE_as_grub_uint32_t.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=9907d9c2723304b42cf6da74f1cc6c4601391956"; - hash = "sha256-D8xaI8g7ffGGmZqqeS8wxWIFLUWUBfmHwMVOHkYTc2I="; - }) - (fetchpatch { - name = "69_normal_menu_use_safe_math_to_avoid_an_integer_overflow.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=5b36a5210e21bee2624f8acc36aefd8f10266adb"; - hash = "sha256-UourmM0Zlaj4o+SnYi5AtjfNujDOt+2ez2XH/uWyiaM="; - }) - (fetchpatch { - name = "70_kern_partition_add_sanity_check_after_grub_strtoul_call.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=8e6e87e7923ca2ae880021cb42a35cc9bb4c8fe2"; - hash = "sha256-4keMUu6ZDKmuSQlFnldV15dDGUibsnSvoEWhLsqWieI="; - }) - (fetchpatch { - name = "71_kern_misc_add_sanity_check_after_grub_strtoul_call.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=a8d6b06331a75d75b46f3dd6cc6fcd40dcf604b7"; - hash = "sha256-2Mpe1sqyuoUPyMAKGZTNzG/ig3G3K8w0gia7lc508Rg="; - }) - (fetchpatch { - name = "72_loader_i386_linux_cast_left_shift_to_grub_uint32_t.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=490a6ab71cebd96fae7a1ceb9067484f5ccbec2a"; - hash = "sha256-e49OC1EBaX0/nWTTXT5xE5apTJPQV0myP5Ohxn9Wwa8="; - }) - (fetchpatch { - name = "73_loader_i386_bsd_use_safe_math_to_avoid_underflow.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=4dc6166571645780c459dde2cdc1b001a5ec844c"; - hash = "sha256-e8X+oBvejcFNOY1Tp/f6QqCDwrgK7f9u1F8SdO/dhy4="; - }) - (fetchpatch { - # Fixes 7e2f750f0a (security patch 14/73) - name = "fs_ext2_rework_out-of-bounds_read_for_inline_and_external_extents.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=348cd416a3574348f4255bf2b04ec95938990997"; - hash = "sha256-WBLYQxv8si2tvdPAvbm0/4NNqYWBMJpFV4GC0HhN/kE="; - }) - ]; - - postPatch = - if kbdcompSupport then - '' - sed -i util/grub-kbdcomp.in -e 's@\bckbcomp\b@${ckbcomp}/bin/ckbcomp@' - '' - else - '' - echo '#! ${runtimeShell}' > util/grub-kbdcomp.in - echo 'echo "Compile grub2 with { kbdcompSupport = true; } to enable support for this command."' >> util/grub-kbdcomp.in - ''; - - depsBuildBuild = [ buildPackages.stdenv.cc ]; - nativeBuildInputs = [ - bison - flex - python3 - pkg-config - gettext - freetype - autoconf - automake - help2man - ]; - buildInputs = - [ - ncurses - libusb-compat-0_1 - freetype - lvm2 - fuse - libtool - bash - ] - ++ lib.optional doCheck qemu - ++ lib.optional zfsSupport zfs; - - strictDeps = true; - - hardeningDisable = [ "all" ]; - - separateDebugInfo = !xenSupport; - - preConfigure = '' - for i in "tests/util/"*.in - do - sed -i "$i" -e's|/bin/bash|${stdenv.shell}|g' - done - - # Apparently, the QEMU executable is no longer called - # `qemu-system-i386', even on i386. - # - # In addition, use `-nodefaults' to avoid errors like: - # - # chardev: opening backend "stdio" failed - # qemu: could not open serial device 'stdio': Invalid argument - # - # See . - sed -i "tests/util/grub-shell.in" \ - -e's/qemu-system-i386/qemu-system-x86_64 -nodefaults/g' - - unset CPP # setting CPP intereferes with dependency calculation - - patchShebangs . - - GNULIB_REVISION=$(. bootstrap.conf; echo $GNULIB_REVISION) - if [ "$GNULIB_REVISION" != ${gnulib.rev} ]; then - echo "This version of GRUB requires a different gnulib revision!" - echo "We have: ${gnulib.rev}" - echo "GRUB needs: $GNULIB_REVISION" - exit 1 - fi - - cp -f --no-preserve=mode ${locales}/po/LINGUAS ${locales}/po/*.po po - - ./bootstrap --no-git --gnulib-srcdir=${gnulib} - - substituteInPlace ./configure --replace '/usr/share/fonts/unifont' '${unifont}/share/fonts' - ''; - - postConfigure = '' - # make sure .po files are up to date to workaround - # parallel `msgmerge --update` on autogenerated .po files: - # https://github.com/NixOS/nixpkgs/pull/248747#issuecomment-1676301670 - make dist - ''; - - configureFlags = - [ - "--enable-grub-mount" # dep of os-prober - ] - ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [ - # grub doesn't do cross-compilation as usual and tries to use unprefixed - # tools to target the host. Provide toolchain information explicitly for - # cross builds. - # - # Ref: # https://github.com/buildroot/buildroot/blob/master/boot/grub2/grub2.mk#L108 - "TARGET_CC=${stdenv.cc.targetPrefix}cc" - "TARGET_NM=${stdenv.cc.targetPrefix}nm" - "TARGET_OBJCOPY=${stdenv.cc.targetPrefix}objcopy" - "TARGET_RANLIB=${stdenv.cc.targetPrefix}ranlib" - "TARGET_STRIP=${stdenv.cc.targetPrefix}strip" - ] - ++ lib.optional zfsSupport "--enable-libzfs" - ++ lib.optionals efiSupport [ - "--with-platform=efi" - "--target=${efiSystemsBuild.${stdenv.hostPlatform.system}.target}" - "--program-prefix=" - ] - ++ lib.optionals xenSupport [ - "--with-platform=xen" - "--target=${efiSystemsBuild.${stdenv.hostPlatform.system}.target}" - ]; - - # save target that grub is compiled for - grubTarget = - if efiSupport then - "${efiSystemsInstall.${stdenv.hostPlatform.system}.target}-efi" - else - lib.optionalString inPCSystems "${pcSystems.${stdenv.hostPlatform.system}.target}-pc"; - - doCheck = false; - enableParallelBuilding = true; - - postInstall = '' - # Avoid a runtime reference to gcc - sed -i $out/lib/grub/*/modinfo.sh -e "/grub_target_cppflags=/ s|'.*'|' '|" - # just adding bash to buildInputs wasn't enough to fix the shebang - substituteInPlace $out/lib/grub/*/modinfo.sh \ - --replace ${buildPackages.bash} "/usr/bin/bash" - ''; - - passthru.tests = { - nixos-grub = nixosTests.grub; - nixos-install-simple = nixosTests.installer.simple; - nixos-install-grub-uefi = nixosTests.installer.simpleUefiGrub; - nixos-install-grub-uefi-spec = nixosTests.installer.simpleUefiGrubSpecialisation; - }; - - meta = with lib; { - description = "GNU GRUB, the Grand Unified Boot Loader"; - - longDescription = '' - GNU GRUB is a Multiboot boot loader. It was derived from GRUB, GRand - Unified Bootloader, which was originally designed and implemented by - Erich Stefan Boleyn. - - Briefly, the boot loader is the first software program that runs when a - computer starts. It is responsible for loading and transferring - control to the operating system kernel software (such as the Hurd or - the Linux). The kernel, in turn, initializes the rest of the - operating system (e.g., GNU). + postPatch = + if kbdcompSupport then + '' + sed -i util/grub-kbdcomp.in -e 's@\bckbcomp\b@${ckbcomp}/bin/ckbcomp@' + '' + else + '' + echo '#! ${runtimeShell}' > util/grub-kbdcomp.in + echo 'echo "Compile grub2 with { kbdcompSupport = true; } to enable support for this command."' >> util/grub-kbdcomp.in ''; - homepage = "https://www.gnu.org/software/grub/"; + depsBuildBuild = [ buildPackages.stdenv.cc ]; + nativeBuildInputs = [ + bison + flex + python3 + pkg-config + gettext + freetype + autoconf + automake + help2man + ]; + buildInputs = + [ + ncurses + libusb-compat-0_1 + freetype + lvm2 + fuse + libtool + bash + ] + ++ lib.optional doCheck qemu + ++ lib.optional zfsSupport zfs; - license = licenses.gpl3Plus; + strictDeps = true; - platforms = - if xenSupport then - [ - "x86_64-linux" - "i686-linux" - ] - else - platforms.gnu ++ platforms.linux; + hardeningDisable = [ "all" ]; - maintainers = [ ]; - }; - } -) + separateDebugInfo = !xenSupport; + + preConfigure = '' + for i in "tests/util/"*.in + do + sed -i "$i" -e's|/bin/bash|${stdenv.shell}|g' + done + + # Apparently, the QEMU executable is no longer called + # `qemu-system-i386', even on i386. + # + # In addition, use `-nodefaults' to avoid errors like: + # + # chardev: opening backend "stdio" failed + # qemu: could not open serial device 'stdio': Invalid argument + # + # See . + sed -i "tests/util/grub-shell.in" \ + -e's/qemu-system-i386/qemu-system-x86_64 -nodefaults/g' + + unset CPP # setting CPP intereferes with dependency calculation + + patchShebangs . + + GNULIB_REVISION=$(. bootstrap.conf; echo $GNULIB_REVISION) + if [ "$GNULIB_REVISION" != ${gnulib.rev} ]; then + echo "This version of GRUB requires a different gnulib revision!" + echo "We have: ${gnulib.rev}" + echo "GRUB needs: $GNULIB_REVISION" + exit 1 + fi + + cp -f --no-preserve=mode ${locales}/po/LINGUAS ${locales}/po/*.po po + + ./bootstrap --no-git --gnulib-srcdir=${gnulib} + + substituteInPlace ./configure --replace '/usr/share/fonts/unifont' '${unifont}/share/fonts' + ''; + + postConfigure = '' + # make sure .po files are up to date to workaround + # parallel `msgmerge --update` on autogenerated .po files: + # https://github.com/NixOS/nixpkgs/pull/248747#issuecomment-1676301670 + make dist + ''; + + configureFlags = + [ + "--enable-grub-mount" # dep of os-prober + ] + ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [ + # grub doesn't do cross-compilation as usual and tries to use unprefixed + # tools to target the host. Provide toolchain information explicitly for + # cross builds. + # + # Ref: # https://github.com/buildroot/buildroot/blob/master/boot/grub2/grub2.mk#L108 + "TARGET_CC=${stdenv.cc.targetPrefix}cc" + "TARGET_NM=${stdenv.cc.targetPrefix}nm" + "TARGET_OBJCOPY=${stdenv.cc.targetPrefix}objcopy" + "TARGET_RANLIB=${stdenv.cc.targetPrefix}ranlib" + "TARGET_STRIP=${stdenv.cc.targetPrefix}strip" + ] + ++ lib.optional zfsSupport "--enable-libzfs" + ++ lib.optionals efiSupport [ + "--with-platform=efi" + "--target=${efiSystemsBuild.${stdenv.hostPlatform.system}.target}" + "--program-prefix=" + ] + ++ lib.optionals xenSupport [ + "--with-platform=xen" + "--target=${efiSystemsBuild.${stdenv.hostPlatform.system}.target}" + ]; + + # save target that grub is compiled for + grubTarget = + if efiSupport then + "${efiSystemsInstall.${stdenv.hostPlatform.system}.target}-efi" + else + lib.optionalString inPCSystems "${pcSystems.${stdenv.hostPlatform.system}.target}-pc"; + + doCheck = false; + enableParallelBuilding = true; + + postInstall = '' + # Avoid a runtime reference to gcc + sed -i $out/lib/grub/*/modinfo.sh -e "/grub_target_cppflags=/ s|'.*'|' '|" + # just adding bash to buildInputs wasn't enough to fix the shebang + substituteInPlace $out/lib/grub/*/modinfo.sh \ + --replace ${buildPackages.bash} "/usr/bin/bash" + ''; + + passthru.tests = { + nixos-grub = nixosTests.grub; + nixos-install-simple = nixosTests.installer.simple; + nixos-install-grub-uefi = nixosTests.installer.simpleUefiGrub; + nixos-install-grub-uefi-spec = nixosTests.installer.simpleUefiGrubSpecialisation; + }; + + meta = with lib; { + description = "GNU GRUB, the Grand Unified Boot Loader"; + + longDescription = '' + GNU GRUB is a Multiboot boot loader. It was derived from GRUB, GRand + Unified Bootloader, which was originally designed and implemented by + Erich Stefan Boleyn. + + Briefly, the boot loader is the first software program that runs when a + computer starts. It is responsible for loading and transferring + control to the operating system kernel software (such as the Hurd or + the Linux). The kernel, in turn, initializes the rest of the + operating system (e.g., GNU). + ''; + + homepage = "https://www.gnu.org/software/grub/"; + + license = licenses.gpl3Plus; + + platforms = + if xenSupport then + [ + "x86_64-linux" + "i686-linux" + ] + else + platforms.gnu ++ platforms.linux; + + maintainers = [ ]; + + broken = !(efiSupport -> canEfi) || !(zfsSupport -> zfs != null) || (efiSupport && xenSupport); + }; +} diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index b27aab0a7ab7..a06d2418ea0c 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -6855,9 +6855,9 @@ with pkgs; electron-source.electron_37 else electron_37-bin; - electron = electron_35; - electron-bin = electron_35-bin; - electron-chromedriver = electron-chromedriver_35; + electron = electron_37; + electron-bin = electron_37-bin; + electron-chromedriver = electron-chromedriver_37; autoconf = callPackage ../development/tools/misc/autoconf { }; autoconf213 = callPackage ../development/tools/misc/autoconf/2.13.nix { };