From 2ce1d06baf33806ab9d32ceb38ac0534fe8f3dec Mon Sep 17 00:00:00 2001 From: Linus Heckemann Date: Mon, 2 Jun 2025 22:16:55 +0200 Subject: [PATCH 01/60] nixos/kresd: don't explicitly set group id null is the default, but setting it explicitly rather than relying on the default results in collisions if users want to set their own gid. Requiring mkForce here shouldn't be necessary when the module doesn't specifically rely on the auto-allocation behaviour. Change-Id: Ia541ac4e9c4d85b240386049b9947c607674a2f5 --- nixos/modules/services/networking/kresd.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nixos/modules/services/networking/kresd.nix b/nixos/modules/services/networking/kresd.nix index c93b591701a7..c203aea84df3 100644 --- a/nixos/modules/services/networking/kresd.nix +++ b/nixos/modules/services/networking/kresd.nix @@ -144,7 +144,7 @@ in group = "knot-resolver"; description = "Knot-resolver daemon user"; }; - users.groups.knot-resolver.gid = null; + users.groups.knot-resolver = { }; systemd.packages = [ cfg.package ]; # the units are patched inside the package a bit From aa415e8988fe1246f7efac6defe15af0f0752e67 Mon Sep 17 00:00:00 2001 From: DontEatOreo <57304299+DontEatOreo@users.noreply.github.com> Date: Tue, 1 Jul 2025 04:15:05 +0300 Subject: [PATCH 02/60] yt-dlp: use `fetchFromGitHub` --- pkgs/by-name/yt/yt-dlp/package.nix | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/pkgs/by-name/yt/yt-dlp/package.nix b/pkgs/by-name/yt/yt-dlp/package.nix index 4ed1feb8a6f0..e4aedcfdfb6e 100644 --- a/pkgs/by-name/yt/yt-dlp/package.nix +++ b/pkgs/by-name/yt/yt-dlp/package.nix @@ -1,7 +1,7 @@ { lib, python3Packages, - fetchPypi, + fetchFromGitHub, ffmpeg-headless, rtmpdump, atomicparsley, @@ -17,13 +17,14 @@ python3Packages.buildPythonApplication rec { # The websites yt-dlp deals with are a very moving target. That means that # downloads break constantly. Because of that, updates should always be backported # to the latest stable release. - version = "2025.6.30"; + version = "2025.06.30"; pyproject = true; - src = fetchPypi { - inherit version; - pname = "yt_dlp"; - hash = "sha256-bQroVcClW/zCjf+6gE7IUlublV00pBGRoVYaTOwD2L0="; + src = fetchFromGitHub { + owner = "yt-dlp"; + repo = "yt-dlp"; + tag = version; + hash = "sha256-dwBe6oXh7G67kfiI6BqiC0ZHzleR7QlfMiTVXWYW85I="; }; build-system = with python3Packages; [ @@ -95,7 +96,7 @@ python3Packages.buildPythonApplication rec { youtube-dl is released to the public domain, which means you can modify it, redistribute it or use it however you like. ''; - changelog = "https://github.com/yt-dlp/yt-dlp/blob/HEAD/Changelog.md"; + changelog = "https://github.com/yt-dlp/yt-dlp/blob/${version}/Changelog.md"; license = licenses.unlicense; maintainers = with maintainers; [ SuperSandro2000 From 14f75ec36686a00b12f467eab8a892437c46ff45 Mon Sep 17 00:00:00 2001 From: DontEatOreo <57304299+DontEatOreo@users.noreply.github.com> Date: Tue, 1 Jul 2025 04:18:16 +0300 Subject: [PATCH 03/60] yt-dlp: use `nix-update-script` --- pkgs/by-name/yt/yt-dlp/package.nix | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/pkgs/by-name/yt/yt-dlp/package.nix b/pkgs/by-name/yt/yt-dlp/package.nix index e4aedcfdfb6e..a2d2e211db30 100644 --- a/pkgs/by-name/yt/yt-dlp/package.nix +++ b/pkgs/by-name/yt/yt-dlp/package.nix @@ -9,7 +9,7 @@ ffmpegSupport ? true, rtmpSupport ? true, withAlias ? false, # Provides bin/youtube-dl for backcompat - update-python-libraries, + nix-update-script, }: python3Packages.buildPythonApplication rec { @@ -80,10 +80,7 @@ python3Packages.buildPythonApplication rec { ln -s "$out/bin/yt-dlp" "$out/bin/youtube-dl" ''; - passthru.updateScript = [ - update-python-libraries - (toString ./.) - ]; + passthru.updateScript = nix-update-script { }; meta = with lib; { homepage = "https://github.com/yt-dlp/yt-dlp/"; From 01909f1bdbe696069276aee3ee77426e86bdc470 Mon Sep 17 00:00:00 2001 From: aileot <46470475+aileot@users.noreply.github.com> Date: Thu, 19 Jun 2025 22:22:25 +0900 Subject: [PATCH 04/60] gibo: 1.0.6 -> 3.0.14 --- pkgs/by-name/gi/gibo/package.nix | 46 +++++++++++++++++++------------- 1 file changed, 28 insertions(+), 18 deletions(-) diff --git a/pkgs/by-name/gi/gibo/package.nix b/pkgs/by-name/gi/gibo/package.nix index 9663311e6812..ce9bf295c32f 100644 --- a/pkgs/by-name/gi/gibo/package.nix +++ b/pkgs/by-name/gi/gibo/package.nix @@ -1,33 +1,43 @@ { lib, - stdenv, + buildGoModule, fetchFromGitHub, - coreutils, - findutils, - git, + installShellFiles, }: - -stdenv.mkDerivation rec { +buildGoModule rec { pname = "gibo"; - version = "1.0.6"; + version = "3.0.14"; src = fetchFromGitHub { owner = "simonwhitaker"; repo = "gibo"; - rev = version; - sha256 = "07j3sv9ar9l074krajw8nfmsfmdp836irsbd053dbqk2v880gfm6"; + tag = "v${version}"; + sha256 = "sha256-6w+qhwOHkfKt0hgKO98L6Si0RNJN+CXOOFzGlvxFjcA="; }; - installPhase = '' - mkdir -p $out/bin $out/share/bash-completion/completions - cp gibo $out/bin - cp gibo-completion.bash $out/share/bash-completion/completions + vendorHash = "sha256-pD+7yvBydg1+BQFP0G8rRYTCO//Wg/6pzY19DLs42Gk="; - sed -e 's|\ Date: Wed, 2 Jul 2025 15:21:20 +0300 Subject: [PATCH 05/60] yt-dlp: generate manpages with pandoc --- pkgs/by-name/yt/yt-dlp/package.nix | 45 ++++++++++++++++++++++++------ 1 file changed, 36 insertions(+), 9 deletions(-) diff --git a/pkgs/by-name/yt/yt-dlp/package.nix b/pkgs/by-name/yt/yt-dlp/package.nix index a2d2e211db30..a08ff7c4c6ca 100644 --- a/pkgs/by-name/yt/yt-dlp/package.nix +++ b/pkgs/by-name/yt/yt-dlp/package.nix @@ -5,6 +5,8 @@ ffmpeg-headless, rtmpdump, atomicparsley, + pandoc, + installShellFiles, atomicparsleySupport ? true, ffmpegSupport ? true, rtmpSupport ? true, @@ -27,8 +29,11 @@ python3Packages.buildPythonApplication rec { hash = "sha256-dwBe6oXh7G67kfiI6BqiC0ZHzleR7QlfMiTVXWYW85I="; }; - build-system = with python3Packages; [ - hatchling + build-system = with python3Packages; [ hatchling ]; + + nativeBuildInputs = [ + installShellFiles + pandoc ]; # expose optional-dependencies, but provide all features @@ -53,6 +58,21 @@ python3Packages.buildPythonApplication rec { pythonRelaxDeps = [ "websockets" ]; + preBuild = '' + python devscripts/make_lazy_extractors.py + ''; + + postBuild = '' + python devscripts/prepare_manpage.py yt-dlp.1.temp.md + pandoc -s -f markdown-smart -t man yt-dlp.1.temp.md -o yt-dlp.1 + rm yt-dlp.1.temp.md + + mkdir -p completions/{bash,fish,zsh} + python devscripts/bash-completion.py completions/bash/yt-dlp + python devscripts/zsh-completion.py completions/zsh/_yt-dlp + python devscripts/fish-completion.py completions/fish/yt-dlp.fish + ''; + # Ensure these utilities are available in $PATH: # - ffmpeg: post-processing & transcoding support # - rtmpdump: download files over RTMP @@ -69,16 +89,23 @@ python3Packages.buildPythonApplication rec { ''--prefix PATH : "${lib.makeBinPath packagesToBinPath}"'' ]; - setupPyBuildFlags = [ - "build_lazy_extractors" - ]; - # Requires network doCheck = false; - postInstall = lib.optionalString withAlias '' - ln -s "$out/bin/yt-dlp" "$out/bin/youtube-dl" - ''; + postInstall = + '' + installManPage yt-dlp.1 + + installShellCompletion \ + --bash completions/bash/yt-dlp \ + --fish completions/fish/yt-dlp.fish \ + --zsh completions/zsh/_yt-dlp + + install -Dm644 Changelog.md README.md -t "$out/share/doc/yt_dlp" + '' + + lib.optionalString withAlias '' + ln -s "$out/bin/yt-dlp" "$out/bin/youtube-dl" + ''; passthru.updateScript = nix-update-script { }; From 9f869f7f227ca77a877c52246d0a2904b7924257 Mon Sep 17 00:00:00 2001 From: DontEatOreo <57304299+DontEatOreo@users.noreply.github.com> Date: Tue, 8 Jul 2025 23:23:22 +0300 Subject: [PATCH 06/60] yt-dlp: sort `meta` --- pkgs/by-name/yt/yt-dlp/package.nix | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/pkgs/by-name/yt/yt-dlp/package.nix b/pkgs/by-name/yt/yt-dlp/package.nix index a08ff7c4c6ca..a4ceab04c7b8 100644 --- a/pkgs/by-name/yt/yt-dlp/package.nix +++ b/pkgs/by-name/yt/yt-dlp/package.nix @@ -110,8 +110,10 @@ python3Packages.buildPythonApplication rec { passthru.updateScript = nix-update-script { }; meta = with lib; { - homepage = "https://github.com/yt-dlp/yt-dlp/"; + changelog = "https://github.com/yt-dlp/yt-dlp/blob/${version}/Changelog.md"; description = "Command-line tool to download videos from YouTube.com and other sites (youtube-dl fork)"; + homepage = "https://github.com/yt-dlp/yt-dlp/"; + license = licenses.unlicense; longDescription = '' yt-dlp is a youtube-dl fork based on the now inactive youtube-dlc. @@ -120,12 +122,10 @@ python3Packages.buildPythonApplication rec { youtube-dl is released to the public domain, which means you can modify it, redistribute it or use it however you like. ''; - changelog = "https://github.com/yt-dlp/yt-dlp/blob/${version}/Changelog.md"; - license = licenses.unlicense; + mainProgram = "yt-dlp"; maintainers = with maintainers; [ SuperSandro2000 donteatoreo ]; - mainProgram = "yt-dlp"; }; } From 182bc1e5f931c1ea4d7ce90c5b7111ad02b76a34 Mon Sep 17 00:00:00 2001 From: DontEatOreo <57304299+DontEatOreo@users.noreply.github.com> Date: Tue, 8 Jul 2025 23:24:03 +0300 Subject: [PATCH 07/60] yt-dlp: remove `with lib` --- pkgs/by-name/yt/yt-dlp/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/yt/yt-dlp/package.nix b/pkgs/by-name/yt/yt-dlp/package.nix index a4ceab04c7b8..92aaee8f2633 100644 --- a/pkgs/by-name/yt/yt-dlp/package.nix +++ b/pkgs/by-name/yt/yt-dlp/package.nix @@ -109,11 +109,11 @@ python3Packages.buildPythonApplication rec { passthru.updateScript = nix-update-script { }; - meta = with lib; { + meta = { changelog = "https://github.com/yt-dlp/yt-dlp/blob/${version}/Changelog.md"; description = "Command-line tool to download videos from YouTube.com and other sites (youtube-dl fork)"; homepage = "https://github.com/yt-dlp/yt-dlp/"; - license = licenses.unlicense; + license = lib.licenses.unlicense; longDescription = '' yt-dlp is a youtube-dl fork based on the now inactive youtube-dlc. @@ -123,7 +123,7 @@ python3Packages.buildPythonApplication rec { you can modify it, redistribute it or use it however you like. ''; mainProgram = "yt-dlp"; - maintainers = with maintainers; [ + maintainers = with lib.maintainers; [ SuperSandro2000 donteatoreo ]; From da47ff291bf892cd8c5ee26698227dd8663f9e7b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E2=80=AErekc=C3=A4H=20nitraM=E2=80=AE?= Date: Sat, 15 Mar 2025 15:39:19 +0100 Subject: [PATCH 08/60] poco: add checkPhase This executes at least part of the testsutie. All testsuites that require a service running in the background (Postgress, MongoDB, MariaDB, ...) have been skipped. If one attempts to run them, this likely requires a nixosTest to do so and provide the dependencies. Some tests I had to skip, because they break on darwin. Perhaps fixes for theste test can be developed and upstreamed, but that requires more expertise than I possess. --- .../po/poco/disable-broken-tests.patch | 21 ++++++++++++++ pkgs/by-name/po/poco/package.nix | 29 ++++++++++++++++--- 2 files changed, 46 insertions(+), 4 deletions(-) create mode 100644 pkgs/by-name/po/poco/disable-broken-tests.patch diff --git a/pkgs/by-name/po/poco/disable-broken-tests.patch b/pkgs/by-name/po/poco/disable-broken-tests.patch new file mode 100644 index 000000000000..7c0f27352e15 --- /dev/null +++ b/pkgs/by-name/po/poco/disable-broken-tests.patch @@ -0,0 +1,21 @@ +diff --git a/Data/testsuite/src/DataTest.cpp b/Data/testsuite/src/DataTest.cpp +index a78c4e5..e8d9335 100644 +--- a/Data/testsuite/src/DataTest.cpp ++++ b/Data/testsuite/src/DataTest.cpp +@@ -1652 +1652 @@ CppUnit::Test* DataTest::suite() +- CppUnit_addTest(pSuite, DataTest, testSQLChannel); ++ // CppUnit_addTest(pSuite, DataTest, testSQLChannel); +diff --git a/Net/testsuite/src/HTTPClientSessionTest.cpp b/Net/testsuite/src/HTTPClientSessionTest.cpp +index 31de150..b5c0d13 100644 +--- a/Net/testsuite/src/HTTPClientSessionTest.cpp ++++ b/Net/testsuite/src/HTTPClientSessionTest.cpp +@@ -406 +406 @@ CppUnit::Test* HTTPClientSessionTest::suite() +- CppUnit_addTest(pSuite, HTTPClientSessionTest, testGetSmallUnix); ++ // CppUnit_addTest(pSuite, HTTPClientSessionTest, testGetSmallUnix); +diff --git a/Net/testsuite/src/SocketTest.cpp b/Net/testsuite/src/SocketTest.cpp +index 27c1800..9bd684b 100644 +--- a/Net/testsuite/src/SocketTest.cpp ++++ b/Net/testsuite/src/SocketTest.cpp +@@ -900 +900 @@ CppUnit::Test* SocketTest::suite() +- CppUnit_addTest(pSuite, SocketTest, testEchoUnixLocal); ++ // CppUnit_addTest(pSuite, SocketTest, testEchoUnixLocal); diff --git a/pkgs/by-name/po/poco/package.nix b/pkgs/by-name/po/poco/package.nix index 2117341d5232..6fa0f07d1286 100644 --- a/pkgs/by-name/po/poco/package.nix +++ b/pkgs/by-name/po/poco/package.nix @@ -54,10 +54,23 @@ stdenv.mkDerivation rec { MYSQL_DIR = libmysqlclient; MYSQL_INCLUDE_DIR = "${MYSQL_DIR}/include/mysql"; - cmakeFlags = [ - # use nix provided versions of sqlite, zlib, pcre, expat, ... instead of bundled versions - (lib.cmakeBool "POCO_UNBUNDLED" true) - ]; + cmakeFlags = + let + # These tests require running services, which the checkPhase is ill equipeed to provide + # TODO get them running in a nixosTest + excludeTestsRegex = lib.concatStringsSep "|" [ + "Redis" + "DataODBC" + "MongoDB" + "DataMySQL" + ]; + in + [ + # use nix provided versions of sqlite, zlib, pcre, expat, ... instead of bundled versions + (lib.cmakeBool "POCO_UNBUNDLED" true) + (lib.cmakeBool "ENABLE_TESTS" true) + (lib.cmakeFeature "CMAKE_CTEST_ARGUMENTS" "--exclude-regex;'${excludeTestsRegex}'") + ]; patches = [ # Remove on next release @@ -67,8 +80,16 @@ stdenv.mkDerivation rec { url = "https://patch-diff.githubusercontent.com/raw/pocoproject/poco/pull/4879.patch"; hash = "sha256-VFWuRuf0GPYFp43WKI8utl+agP+7a5biLg7m64EMnVo="; }) + # failing on darwin, could perhaps be patched / a fix upstreamed later + ./disable-broken-tests.patch ]; + doCheck = true; + preCheck = '' + # workaround for some tests trying to write to /homeless-shelter + export HOME=$(mktemp -d) + ''; + postFixup = '' grep -rlF INTERFACE_INCLUDE_DIRECTORIES "$dev/lib/cmake/Poco" | while read -r f; do substituteInPlace "$f" \ From 578bb68e7e552d72911235e5bf8b5e3b97222ad5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E2=80=AErekc=C3=A4H=20nitraM=E2=80=AE?= Date: Sun, 16 Mar 2025 11:28:08 +0100 Subject: [PATCH 09/60] poco: seperately disable broken tests on linux and darwin poco: Better optionals --- ...atch => disable-broken-tests-darwin.patch} | 0 .../po/poco/disable-broken-tests-linux.patch | 28 +++++++++++++++ pkgs/by-name/po/poco/package.nix | 34 ++++++++++++------- 3 files changed, 49 insertions(+), 13 deletions(-) rename pkgs/by-name/po/poco/{disable-broken-tests.patch => disable-broken-tests-darwin.patch} (100%) create mode 100644 pkgs/by-name/po/poco/disable-broken-tests-linux.patch diff --git a/pkgs/by-name/po/poco/disable-broken-tests.patch b/pkgs/by-name/po/poco/disable-broken-tests-darwin.patch similarity index 100% rename from pkgs/by-name/po/poco/disable-broken-tests.patch rename to pkgs/by-name/po/poco/disable-broken-tests-darwin.patch diff --git a/pkgs/by-name/po/poco/disable-broken-tests-linux.patch b/pkgs/by-name/po/poco/disable-broken-tests-linux.patch new file mode 100644 index 000000000000..8f976a30a0b1 --- /dev/null +++ b/pkgs/by-name/po/poco/disable-broken-tests-linux.patch @@ -0,0 +1,28 @@ +diff --git a/Data/testsuite/src/DataTest.cpp b/Data/testsuite/src/DataTest.cpp +index a78c4e5..e8d9335 100644 +--- a/Data/testsuite/src/DataTest.cpp ++++ b/Data/testsuite/src/DataTest.cpp +@@ -1652 +1652 @@ CppUnit::Test* DataTest::suite() +- CppUnit_addTest(pSuite, DataTest, testSQLChannel); ++ // CppUnit_addTest(pSuite, DataTest, testSQLChannel); +diff --git a/Net/testsuite/src/DatagramSocketTest.cpp b/Net/testsuite/src/DatagramSocketTest.cpp +index e765de2..cec4867 100644 +--- a/Net/testsuite/src/DatagramSocketTest.cpp ++++ b/Net/testsuite/src/DatagramSocketTest.cpp +@@ -830 +830 @@ CppUnit::Test* DatagramSocketTest::suite() +- CppUnit_addTest(pSuite, DatagramSocketTest, testBroadcast); ++ // CppUnit_addTest(pSuite, DatagramSocketTest, testBroadcast); +diff --git a/Net/testsuite/src/SocketReactorTest.cpp b/Net/testsuite/src/SocketReactorTest.cpp +index a07576c..b3236c5 100644 +--- a/Net/testsuite/src/SocketReactorTest.cpp ++++ b/Net/testsuite/src/SocketReactorTest.cpp +@@ -706 +706 @@ CppUnit::Test* SocketReactorTest::suite() +- CppUnit_addTest(pSuite, SocketReactorTest, testSocketConnectorFail); ++ // CppUnit_addTest(pSuite, SocketReactorTest, testSocketConnectorFail); +diff --git a/Net/testsuite/src/SocketTest.cpp b/Net/testsuite/src/SocketTest.cpp +index 27c1800..9bd684b 100644 +--- a/Net/testsuite/src/SocketTest.cpp ++++ b/Net/testsuite/src/SocketTest.cpp +@@ -900 +900 @@ CppUnit::Test* SocketTest::suite() +- CppUnit_addTest(pSuite, SocketTest, testEchoUnixLocal); ++ // CppUnit_addTest(pSuite, SocketTest, testEchoUnixLocal); diff --git a/pkgs/by-name/po/poco/package.nix b/pkgs/by-name/po/poco/package.nix index 6fa0f07d1286..76ca801893f0 100644 --- a/pkgs/by-name/po/poco/package.nix +++ b/pkgs/by-name/po/poco/package.nix @@ -56,13 +56,16 @@ stdenv.mkDerivation rec { cmakeFlags = let - # These tests require running services, which the checkPhase is ill equipeed to provide - # TODO get them running in a nixosTest excludeTestsRegex = lib.concatStringsSep "|" [ + # These tests require running services, which the checkPhase is ill equipeed to provide + # TODO get them running in a nixosTest "Redis" "DataODBC" "MongoDB" "DataMySQL" + # network not accessible from nix sandbox + "NetSSL" # around 25 test failures + "Net" # could be made to work when public network access is patched out ]; in [ @@ -72,17 +75,22 @@ stdenv.mkDerivation rec { (lib.cmakeFeature "CMAKE_CTEST_ARGUMENTS" "--exclude-regex;'${excludeTestsRegex}'") ]; - patches = [ - # Remove on next release - (fetchpatch { - name = "disable-included-pcre-if-pcre-is-linked-staticly"; - # this happens when building pkgsStatic.poco - url = "https://patch-diff.githubusercontent.com/raw/pocoproject/poco/pull/4879.patch"; - hash = "sha256-VFWuRuf0GPYFp43WKI8utl+agP+7a5biLg7m64EMnVo="; - }) - # failing on darwin, could perhaps be patched / a fix upstreamed later - ./disable-broken-tests.patch - ]; + patches = + [ + # Remove on next release + (fetchpatch { + name = "disable-included-pcre-if-pcre-is-linked-staticly"; + # this happens when building pkgsStatic.poco + url = "https://patch-diff.githubusercontent.com/raw/pocoproject/poco/pull/4879.patch"; + hash = "sha256-VFWuRuf0GPYFp43WKI8utl+agP+7a5biLg7m64EMnVo="; + }) + ] + ++ lib.optionals stdenv.hostPlatform.isDarwin [ + ./disable-broken-tests-darwin.patch + ] + ++ lib.optionals stdenv.hostPlatform.isLinux [ + ./disable-broken-tests-linux.patch + ]; doCheck = true; preCheck = '' From 7a7ab988d1df2b65feca50c7b8432767e5bff039 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E2=80=AErekc=C3=A4H=20nitraM=E2=80=AE?= Date: Sat, 10 May 2025 22:40:16 +0200 Subject: [PATCH 10/60] poco: switch to writableTmpDirAsHomeHook for a writeable home directory during tests --- pkgs/by-name/po/poco/package.nix | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/po/poco/package.nix b/pkgs/by-name/po/poco/package.nix index 76ca801893f0..2788a418ac49 100644 --- a/pkgs/by-name/po/poco/package.nix +++ b/pkgs/by-name/po/poco/package.nix @@ -13,6 +13,7 @@ openssl, unixODBC, libmysqlclient, + writableTmpDirAsHomeHook, }: stdenv.mkDerivation rec { @@ -93,10 +94,10 @@ stdenv.mkDerivation rec { ]; doCheck = true; - preCheck = '' + nativeCheckInputs = [ # workaround for some tests trying to write to /homeless-shelter - export HOME=$(mktemp -d) - ''; + writableTmpDirAsHomeHook + ]; postFixup = '' grep -rlF INTERFACE_INCLUDE_DIRECTORIES "$dev/lib/cmake/Poco" | while read -r f; do From 79016f0015731e09abf2eca0a3e1555c96e1bb8c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E2=80=AErekc=C3=A4H=20nitraM=E2=80=AE?= Date: Sat, 10 May 2025 22:41:13 +0200 Subject: [PATCH 11/60] poco: prevent warning for --replace without -fail (and other suffixes) --- pkgs/by-name/po/poco/package.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkgs/by-name/po/poco/package.nix b/pkgs/by-name/po/poco/package.nix index 2788a418ac49..170b24375eec 100644 --- a/pkgs/by-name/po/poco/package.nix +++ b/pkgs/by-name/po/poco/package.nix @@ -102,7 +102,7 @@ stdenv.mkDerivation rec { postFixup = '' grep -rlF INTERFACE_INCLUDE_DIRECTORIES "$dev/lib/cmake/Poco" | while read -r f; do substituteInPlace "$f" \ - --replace "$"'{_IMPORT_PREFIX}/include' "" + --replace-quiet "$"'{_IMPORT_PREFIX}/include' "" done ''; From 2a8e772fb192678b22c7afba4eb4851fa9a3d3a2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Martin=20Ha=CC=88cker?= Date: Sat, 12 Jul 2025 22:33:48 +0200 Subject: [PATCH 12/60] poco: disable flaky tests These tests have proven flaky in the nixpkgs ci. Likely because nix build boxes are constantly under very high load, and thus take longer than expected for sleep calls, which is what all of these tests try to do. --- pkgs/by-name/po/poco/disable-flaky-tests.patch | 18 ++++++++++++++++++ pkgs/by-name/po/poco/package.nix | 2 ++ 2 files changed, 20 insertions(+) create mode 100644 pkgs/by-name/po/poco/disable-flaky-tests.patch diff --git a/pkgs/by-name/po/poco/disable-flaky-tests.patch b/pkgs/by-name/po/poco/disable-flaky-tests.patch new file mode 100644 index 000000000000..4f3b6ca5833e --- /dev/null +++ b/pkgs/by-name/po/poco/disable-flaky-tests.patch @@ -0,0 +1,18 @@ +diff --git a/Foundation/testsuite/src/ExpireLRUCacheTest.cpp b/Foundation/testsuite/src/ExpireLRUCacheTest.cpp +--- a/Foundation/testsuite/src/ExpireLRUCacheTest.cpp ++++ b/Foundation/testsuite/src/ExpireLRUCacheTest.cpp +@@ -336 +336 @@ +- CppUnit_addTest(pSuite, ExpireLRUCacheTest, testExpireN); ++ // CppUnit_addTest(pSuite, ExpireLRUCacheTest, testExpireN); +diff --git a/Foundation/testsuite/src/TimestampTest.cpp b/Foundation/testsuite/src/TimestampTest.cpp +--- a/Foundation/testsuite/src/TimestampTest.cpp ++++ b/Foundation/testsuite/src/TimestampTest.cpp +@@ -97 +97 @@ +- CppUnit_addTest(pSuite, TimestampTest, testTimestamp); ++ // CppUnit_addTest(pSuite, TimestampTest, testTimestamp); +diff --git a/Foundation/testsuite/src/UniqueExpireCacheTest.cpp b/Foundation/testsuite/src/UniqueExpireCacheTest.cpp +--- a/Foundation/testsuite/src/UniqueExpireCacheTest.cpp ++++ b/Foundation/testsuite/src/UniqueExpireCacheTest.cpp +@@ -248 +248 @@ +- CppUnit_addTest(pSuite, UniqueExpireCacheTest, testExpireN); ++ // CppUnit_addTest(pSuite, UniqueExpireCacheTest, testExpireN); diff --git a/pkgs/by-name/po/poco/package.nix b/pkgs/by-name/po/poco/package.nix index 170b24375eec..9970457c249b 100644 --- a/pkgs/by-name/po/poco/package.nix +++ b/pkgs/by-name/po/poco/package.nix @@ -85,6 +85,8 @@ stdenv.mkDerivation rec { url = "https://patch-diff.githubusercontent.com/raw/pocoproject/poco/pull/4879.patch"; hash = "sha256-VFWuRuf0GPYFp43WKI8utl+agP+7a5biLg7m64EMnVo="; }) + # https://github.com/pocoproject/poco/issues/4977 + ./disable-flaky-tests.patch ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ ./disable-broken-tests-darwin.patch From 7711b3132961cdc312852bc583f34df5768e9e42 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Mon, 14 Jul 2025 14:18:26 +0000 Subject: [PATCH 13/60] kew: 3.3.3 -> 3.4.0 --- pkgs/by-name/ke/kew/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/ke/kew/package.nix b/pkgs/by-name/ke/kew/package.nix index 1e6cf769bbb3..3e31325173aa 100644 --- a/pkgs/by-name/ke/kew/package.nix +++ b/pkgs/by-name/ke/kew/package.nix @@ -33,13 +33,13 @@ in stdenv.mkDerivation (finalAttrs: { pname = "kew"; - version = "3.3.3"; + version = "3.4.0"; src = fetchFromGitHub { owner = "ravachol"; repo = "kew"; tag = "v${finalAttrs.version}"; - hash = "sha256-1PUvUFlRhGrZLjLwQrNb0kE695m5poSqrAIOBAnm3xk="; + hash = "sha256-dKjAv93NgP0iB5VMWWisvISXQOmx3lyUXG2zKCz2+Bc="; }; postPatch = '' From f45a5eb34d4d2c1f13a712ac84a402d58d5d245e Mon Sep 17 00:00:00 2001 From: aileot <46470475+aileot@users.noreply.github.com> Date: Thu, 19 Jun 2025 23:29:49 +0900 Subject: [PATCH 14/60] gibo: use finalAttrs.version --- pkgs/by-name/gi/gibo/package.nix | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/pkgs/by-name/gi/gibo/package.nix b/pkgs/by-name/gi/gibo/package.nix index ce9bf295c32f..7c94a2561207 100644 --- a/pkgs/by-name/gi/gibo/package.nix +++ b/pkgs/by-name/gi/gibo/package.nix @@ -4,14 +4,14 @@ fetchFromGitHub, installShellFiles, }: -buildGoModule rec { +buildGoModule (finalAttrs: { pname = "gibo"; version = "3.0.14"; src = fetchFromGitHub { owner = "simonwhitaker"; repo = "gibo"; - tag = "v${version}"; + tag = "v${finalAttrs.version}"; sha256 = "sha256-6w+qhwOHkfKt0hgKO98L6Si0RNJN+CXOOFzGlvxFjcA="; }; @@ -20,7 +20,7 @@ buildGoModule rec { ldflags = [ "-s" "-w" - "-X github.com/simonwhitaker/gibo/cmd.version=v${version}" + "-X github.com/simonwhitaker/gibo/cmd.version=${finalAttrs.version}" ]; nativeBuildInputs = [ @@ -36,7 +36,7 @@ buildGoModule rec { installCheckPhase = '' runHook preInstallCheck - $out/bin/gibo version | grep -F "${version}" + $out/bin/gibo version | grep -F "${finalAttrs.version}" runHook postInstallCheck ''; @@ -47,4 +47,4 @@ buildGoModule rec { platforms = lib.platforms.unix; mainProgram = "gibo"; }; -} +}) From 03919fdcc714b5fb16a09cc5cd9b74f9125161a2 Mon Sep 17 00:00:00 2001 From: aileot <46470475+aileot@users.noreply.github.com> Date: Thu, 19 Jun 2025 23:36:52 +0900 Subject: [PATCH 15/60] gibo: update license https://github.com/simonwhitaker/gibo/blob/main/LICENSE https://github.com/simonwhitaker/gibo/blob/v3.0.14/LICENSE https://github.com/simonwhitaker/gibo/blob/3c71aa988d9b1734a2cd98fc2d6c2612afb1fe7a/LICENSE --- pkgs/by-name/gi/gibo/package.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkgs/by-name/gi/gibo/package.nix b/pkgs/by-name/gi/gibo/package.nix index 7c94a2561207..ec59708fcd54 100644 --- a/pkgs/by-name/gi/gibo/package.nix +++ b/pkgs/by-name/gi/gibo/package.nix @@ -42,7 +42,7 @@ buildGoModule (finalAttrs: { meta = { homepage = "https://github.com/simonwhitaker/gibo"; - license = lib.licenses.publicDomain; + license = lib.licenses.unlicense; description = "Shell script for easily accessing gitignore boilerplates"; platforms = lib.platforms.unix; mainProgram = "gibo"; From 55d480bc57c7521c5ac288d643c747dfbaf13617 Mon Sep 17 00:00:00 2001 From: aileot <46470475+aileot@users.noreply.github.com> Date: Mon, 14 Jul 2025 23:20:56 +0900 Subject: [PATCH 16/60] gibo: add updateScript --- pkgs/by-name/gi/gibo/package.nix | 3 +++ 1 file changed, 3 insertions(+) diff --git a/pkgs/by-name/gi/gibo/package.nix b/pkgs/by-name/gi/gibo/package.nix index ec59708fcd54..06531674971b 100644 --- a/pkgs/by-name/gi/gibo/package.nix +++ b/pkgs/by-name/gi/gibo/package.nix @@ -2,6 +2,7 @@ lib, buildGoModule, fetchFromGitHub, + nix-update-script, installShellFiles, }: buildGoModule (finalAttrs: { @@ -40,6 +41,8 @@ buildGoModule (finalAttrs: { runHook postInstallCheck ''; + passthru.updateScript = nix-update-script { }; + meta = { homepage = "https://github.com/simonwhitaker/gibo"; license = lib.licenses.unlicense; From 9a036b3b3666302f86b98fed045f447950c80299 Mon Sep 17 00:00:00 2001 From: aileot <46470475+aileot@users.noreply.github.com> Date: Mon, 14 Jul 2025 14:22:36 +0000 Subject: [PATCH 17/60] gibo: use versionCheckHook Note that `writableTmpDirAsHomeHook` with `$HOME` is necessary to pass the version check; `gibo` requires either `$XDG_CACHE_HOME` or `$HOME`, none of which are otherwise defined in running `versionCheckHook`, to store `gibo`'s boilerplate caches. https://github.com/NixOS/nixpkgs/pull/422670#pullrequestreview-3021069843 Co-authored-by: Grimmauld --- pkgs/by-name/gi/gibo/package.nix | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/pkgs/by-name/gi/gibo/package.nix b/pkgs/by-name/gi/gibo/package.nix index 06531674971b..f1b736f95658 100644 --- a/pkgs/by-name/gi/gibo/package.nix +++ b/pkgs/by-name/gi/gibo/package.nix @@ -3,7 +3,9 @@ buildGoModule, fetchFromGitHub, nix-update-script, + versionCheckHook, installShellFiles, + writableTmpDirAsHomeHook, }: buildGoModule (finalAttrs: { pname = "gibo"; @@ -35,11 +37,13 @@ buildGoModule (finalAttrs: { --zsh <($out/bin/gibo completion zsh) ''; - installCheckPhase = '' - runHook preInstallCheck - $out/bin/gibo version | grep -F "${finalAttrs.version}" - runHook postInstallCheck - ''; + doInstallCheck = true; + nativeInstallCheckInputs = [ + versionCheckHook + writableTmpDirAsHomeHook + ]; + versionCheckProgramArg = "version"; + versionCheckKeepEnvironment = [ "HOME" ]; passthru.updateScript = nix-update-script { }; From 020ec9e45c9a71b16b6cc5dffd374db0736947c3 Mon Sep 17 00:00:00 2001 From: aileot <46470475+aileot@users.noreply.github.com> Date: Wed, 16 Jul 2025 23:33:09 +0900 Subject: [PATCH 18/60] gibo: enable shell completions only if emulators are available --- pkgs/by-name/gi/gibo/package.nix | 19 +++++++++++++------ 1 file changed, 13 insertions(+), 6 deletions(-) diff --git a/pkgs/by-name/gi/gibo/package.nix b/pkgs/by-name/gi/gibo/package.nix index f1b736f95658..bddfd825e5d8 100644 --- a/pkgs/by-name/gi/gibo/package.nix +++ b/pkgs/by-name/gi/gibo/package.nix @@ -1,5 +1,7 @@ { lib, + stdenv, + buildPackages, buildGoModule, fetchFromGitHub, nix-update-script, @@ -30,12 +32,17 @@ buildGoModule (finalAttrs: { installShellFiles ]; - postInstall = '' - installShellCompletion --cmd gibo \ - --bash <($out/bin/gibo completion bash) \ - --fish <($out/bin/gibo completion fish) \ - --zsh <($out/bin/gibo completion zsh) - ''; + postInstall = lib.optionalString (stdenv.hostPlatform.emulatorAvailable buildPackages) ( + let + emulator = stdenv.hostPlatform.emulator buildPackages; + in + '' + installShellCompletion --cmd gibo \ + --bash <(${emulator} $out/bin/gibo completion bash) \ + --fish <(${emulator} $out/bin/gibo completion fish) \ + --zsh <(${emulator} $out/bin/gibo completion zsh) + '' + ); doInstallCheck = true; nativeInstallCheckInputs = [ From 6c631ec418f8ba6d7f503ea08874c820a5a1e15d Mon Sep 17 00:00:00 2001 From: Philipp Arras Date: Fri, 18 Jul 2025 11:59:36 +0200 Subject: [PATCH 19/60] python3Packages.nanobind: 2.7.0 -> 2.8.0 --- pkgs/development/python-modules/nanobind/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/python-modules/nanobind/default.nix b/pkgs/development/python-modules/nanobind/default.nix index fb8bd35a91fc..8c6453c6fd77 100644 --- a/pkgs/development/python-modules/nanobind/default.nix +++ b/pkgs/development/python-modules/nanobind/default.nix @@ -26,7 +26,7 @@ }: buildPythonPackage rec { pname = "nanobind"; - version = "2.7.0"; + version = "2.8.0"; pyproject = true; src = fetchFromGitHub { @@ -34,7 +34,7 @@ buildPythonPackage rec { repo = "nanobind"; tag = "v${version}"; fetchSubmodules = true; - hash = "sha256-ex5svqDp9XJtiNCxu0249ORL6LbG679U6PvKQaWANmE="; + hash = "sha256-GGYnyO8eILYNu7va2tMB0QJkBCRDMIfRQO4a9geV49Y="; }; build-system = [ From 2d478a73b70601053af5aafe943100ee29cf5453 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Sat, 19 Jul 2025 05:47:56 +0000 Subject: [PATCH 20/60] python3Packages.llama-cpp-python: 0.3.12 -> 0.3.14 --- pkgs/development/python-modules/llama-cpp-python/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/python-modules/llama-cpp-python/default.nix b/pkgs/development/python-modules/llama-cpp-python/default.nix index 33be1a9dbe4f..045414400682 100644 --- a/pkgs/development/python-modules/llama-cpp-python/default.nix +++ b/pkgs/development/python-modules/llama-cpp-python/default.nix @@ -39,14 +39,14 @@ let in buildPythonPackage rec { pname = "llama-cpp-python"; - version = "0.3.12"; + version = "0.3.14"; pyproject = true; src = fetchFromGitHub { owner = "abetlen"; repo = "llama-cpp-python"; tag = "v${version}"; - hash = "sha256-TTGweGfav1uI2+87iUYc1Esmuor9sEZdZqSU2YVPCdQ="; + hash = "sha256-RJP2QkelqxZuEoxI3CHyenqUJdjw2MsZKUKM+UUxJB8="; fetchSubmodules = true; }; # src = /home/gaetan/llama-cpp-python; From f079f09337bd2bccfb8d4aac2917594f95f591ee Mon Sep 17 00:00:00 2001 From: Benjamin Sparks Date: Fri, 18 Jul 2025 13:11:38 +0200 Subject: [PATCH 21/60] python3Packages.ffmpy: unbreak build with uv-build >=0.8.0 --- .../python-modules/ffmpy/default.nix | 28 +++++++++++-------- 1 file changed, 17 insertions(+), 11 deletions(-) diff --git a/pkgs/development/python-modules/ffmpy/default.nix b/pkgs/development/python-modules/ffmpy/default.nix index 0ce5cdfc5b99..e6960e89473a 100644 --- a/pkgs/development/python-modules/ffmpy/default.nix +++ b/pkgs/development/python-modules/ffmpy/default.nix @@ -24,18 +24,24 @@ buildPythonPackage rec { hash = "sha256-U20mBg+428kkka6NY9qc7X8jH8A5bKa++g2+PTn/MYg="; }; - postPatch = '' - # default to store ffmpeg - substituteInPlace ffmpy/ffmpy.py \ - --replace-fail \ - 'executable: str = "ffmpeg",' \ - 'executable: str = "${ffmpeg-headless}/bin/ffmpeg",' + postPatch = + '' + # default to store ffmpeg + substituteInPlace ffmpy/ffmpy.py \ + --replace-fail \ + 'executable: str = "ffmpeg",' \ + 'executable: str = "${ffmpeg-headless}/bin/ffmpeg",' - # The tests test a mock that does not behave like ffmpeg. If we default to the nix-store ffmpeg they fail. - for fname in tests/*.py; do - echo >>"$fname" 'FFmpeg.__init__.__defaults__ = ("ffmpeg", *FFmpeg.__init__.__defaults__[1:])' - done - ''; + # The tests test a mock that does not behave like ffmpeg. If we default to the nix-store ffmpeg they fail. + for fname in tests/*.py; do + echo >>"$fname" 'FFmpeg.__init__.__defaults__ = ("ffmpeg", *FFmpeg.__init__.__defaults__[1:])' + done + '' + # uv-build in nixpkgs is now at 0.8.0, which otherwise breaks the constraint set by the package. + + '' + substituteInPlace pyproject.toml \ + --replace-fail 'requires = ["uv_build>=0.7.9,<0.8.0"]' 'requires = ["uv_build>=0.7.9,<0.9.0"]' + ''; pythonImportsCheck = [ "ffmpy" ]; From e4036c96603c59b7bb08efed45e5838792bd8b69 Mon Sep 17 00:00:00 2001 From: Benjamin Sparks Date: Fri, 18 Jul 2025 13:12:46 +0200 Subject: [PATCH 22/60] python3Packages.ffmpy: move uv-build to build-system --- pkgs/development/python-modules/ffmpy/default.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkgs/development/python-modules/ffmpy/default.nix b/pkgs/development/python-modules/ffmpy/default.nix index e6960e89473a..c5c0a27be5be 100644 --- a/pkgs/development/python-modules/ffmpy/default.nix +++ b/pkgs/development/python-modules/ffmpy/default.nix @@ -45,7 +45,7 @@ buildPythonPackage rec { pythonImportsCheck = [ "ffmpy" ]; - nativeBuildInputs = [ uv-build ]; + build-system = [ uv-build ]; nativeCheckInputs = [ pytestCheckHook From 2dc577d89ccd5654992582fc412a0ce0d64f817b Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Mon, 21 Jul 2025 13:08:08 +0000 Subject: [PATCH 23/60] protonmail-bridge: 3.21.1 -> 3.21.2 --- pkgs/by-name/pr/protonmail-bridge/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/pr/protonmail-bridge/package.nix b/pkgs/by-name/pr/protonmail-bridge/package.nix index eb293344ee7a..cf3c44994a35 100644 --- a/pkgs/by-name/pr/protonmail-bridge/package.nix +++ b/pkgs/by-name/pr/protonmail-bridge/package.nix @@ -8,13 +8,13 @@ buildGoModule rec { pname = "protonmail-bridge"; - version = "3.21.1"; + version = "3.21.2"; src = fetchFromGitHub { owner = "ProtonMail"; repo = "proton-bridge"; rev = "v${version}"; - hash = "sha256-HGBECDidHFixFOb/ze+3elckpt1JghEtPbWHq7QU1Qg="; + hash = "sha256-IQgP+eWUCyViEBi0WFIOW2rXZLtoyVlrQrtAaqaLOv0="; }; vendorHash = "sha256-aW7N6uacoP99kpvw9E5WrHaQ0fZ4P5WGsNvR/FAZ+cA="; From fdadc0af6effbe40fe16dd20c143304af4ae301a Mon Sep 17 00:00:00 2001 From: Wolfgang Walther Date: Mon, 21 Jul 2025 17:36:45 +0200 Subject: [PATCH 24/60] grub2_efi: turn asserts into meta.broken `meta.broken` can be caught properly by CI, but asserts can not. This has the same intended effect of signaling invalid combinations of arguments. --- pkgs/tools/misc/grub/default.nix | 1149 +++++++++++++++--------------- 1 file changed, 572 insertions(+), 577 deletions(-) diff --git a/pkgs/tools/misc/grub/default.nix b/pkgs/tools/misc/grub/default.nix index 9124dde8caeb..43d06dcc5a5c 100644 --- a/pkgs/tools/misc/grub/default.nix +++ b/pkgs/tools/misc/grub/default.nix @@ -88,588 +88,583 @@ let hash = "sha256-IoRiJHNQ58y0UhCAD0CrpFiI8Mz1upzAtyh5K4Njh/w="; }; in -( +stdenv.mkDerivation rec { + pname = "grub"; + version = "2.12"; + inherit src; - assert efiSupport -> canEfi; - assert zfsSupport -> zfs != null; - assert !(efiSupport && xenSupport); + patches = [ + ./fix-bash-completion.patch + ./add-hidden-menu-entries.patch - stdenv.mkDerivation rec { - pname = "grub"; - version = "2.12"; - inherit src; + # https://lists.gnu.org/archive/html/grub-devel/2025-02/msg00024.html + (fetchpatch { + name = "01_implement_grub_strlcpy.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=ea703528a8581a2ea7e0bad424a70fdf0aec7d8f"; + hash = "sha256-MSMgu1vMG83HRImUUsTyA1YQaIhgEreGGPd+ZDWSI2I="; + }) + (fetchpatch { + name = "02_CVE-2024-45781.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=c1a291b01f4f1dcd6a22b61f1c81a45a966d16ba"; + hash = "sha256-q8ErK+cQzaqwSuhLRFL3AfYBkpgJq1IQmadnlmlz2yw="; + }) + (fetchpatch { + name = "03_CVE-2024-45782_CVE-2024-56737.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=417547c10410b714e43f08f74137c24015f8f4c3"; + hash = "sha256-mRinw27WZ2d1grzyzFGO18yXx72UVBM6Lf5cR8XJfs8="; + }) + (fetchpatch { + name = "04_fs_tar_initialize_name_in_grub_cpio_find_file.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=2c8ac08c99466c0697f704242363fc687f492a0d"; + hash = "sha256-EMGF0B+Fw6tSmllWUJAp1ynzWk+w2C/XM1LmXSReHWg="; + }) + (fetchpatch { + name = "05_CVE-2024-45780.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=0087bc6902182fe5cedce2d034c75a79cf6dd4f3"; + hash = "sha256-IlW5i4EJVoUYPu9/lb0LeytTpzltQuu5fpkFPQNIhls="; + }) + (fetchpatch { + name = "06_fs_f2fs_grub_errno_mount_fails.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=563436258cde64da6b974880abff1bf0959f4da3"; + hash = "sha256-Iu0RPyB+pAnqMT+MTX+TrJbYJsvYPn7jbMgE1jcLh/Q="; + }) + (fetchpatch { + name = "07_CVE-2024-45783.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=f7c070a2e28dfab7137db0739fb8db1dc02d8898"; + hash = "sha256-V1wh2dPeTazmad61jFtOjhq2MdoD+txPWY/AfwwyTZM="; + }) + (fetchpatch { + name = "08_fs_iso9660_grub_errno_mount_fails.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=965db5970811d18069b34f28f5f31ddadde90a97"; + hash = "sha256-6eN1AvZwXkJOQVcjgymy/E7QiAxzL/d0W3KlAZRqUzI="; + }) + (fetchpatch { + name = "09_fs_iso9660_fix_invalid_free.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=1443833a9535a5873f7de3798cf4d8389f366611"; + hash = "sha256-Gt5yMy5Vg9zrDggj3o/TLNt2vT9/6IuHg4Se2p8e8pI="; + }) + (fetchpatch { + name = "10_fs_jfs_fix_oob_read_jfs_getent.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=66175696f3a385b14bdf1ebcda7755834bd2d5fb"; + hash = "sha256-ETbzbc5gvf55sTLjmJOXXC9VH3qcP1Gv5seR/U9NRiY="; + }) + (fetchpatch { + name = "11_fs_jfs_fix_oob_read_caused_by_invalid_dir_slot_index.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=ab09fd0531f3523ac0ef833404526c98c08248f7"; + hash = "sha256-wE6niiIx4BdN800/Eegb6IbBRoMFpXq9kPvatwhWNXY="; + }) + (fetchpatch { + name = "12_fs_jfs_use_full_40_bits_offset_and_address_for_data_extent.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=bd999310fe67f35a66de3bfa2836da91589d04ef"; + hash = "sha256-fbC4oTEIoGWJASzJI5RXfoanrMLTfjFOI51LCUU7Ctg="; + }) + (fetchpatch { + name = "13_fs_jfs_inconsistent_signed_unsigned_types_usage.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=edd995a26ec98654d907a9436a296c2d82bc4b28"; + hash = "sha256-aa1G1vi4bPZejfKEqZokAZTzY9Ea2lyxTrP4drDV9tk="; + }) + (fetchpatch { + name = "14_fs_ext2_fix_out-of-bounds_read_for_inline_extent.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=7e2f750f0a795c4d64ec7dc7591edac8da2e978c"; + hash = "sha256-PtPqZHMU2fy7btRRaaswLyHizplxnygCzDfcg5ievOQ="; + }) + (fetchpatch { + name = "15_fs_ntfs_fix_out-of-bounds_read.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=aff26318783a135562b904ff09e2359893885732"; + hash = "sha256-znN6lkAB9aAhTGKR1038DzOz5nzuTp+7ylHVqRM7HeI="; + }) + (fetchpatch { + name = "16_fs_ntfs_track_the_end_of_the_MFT_attribute_buffer.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=237a71184a32d1ef7732f5f49ed6a89c5fe1c99a"; + hash = "sha256-0I/g0qHkWY6PArPn1UaYRhCrrh9bHknADh34v5eSjjM="; + }) + (fetchpatch { + name = "17_fs_ntfs_use_a_helper_function_to_access_attributes.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=048777bc29043403d077d41a81d0183767b8bc71"; + hash = "sha256-Mm49MSLqCq143r8ruLJm1QoyCoLtOlCBfqoAPwPlv8E="; + }) + # Patch 18 (067b6d225d482280abad03944f04e30abcbdafa1) has been removed because it causes regressions + # https://lists.gnu.org/archive/html/grub-devel/2025-03/msg00067.html + (fetchpatch { + name = "19_fs_xfs_fix_out-of-bounds_read.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=6ccc77b59d16578b10eaf8a4fe85c20b229f0d8a"; + hash = "sha256-FvTzFvfEi3oyxPC/dUHreyzzeVCskaUlYUjpKY/l0DE="; + }) + (fetchpatch { + name = "20_fs_xfs_ensuring_failing_to_mount_sets_a_grub_errno.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=d1d6b7ea58aa5a80a4c4d0666b49460056c8ef0a"; + hash = "sha256-SLdXMmYHq/gRmWrjRrOu5ZYFod84EllUL6hk+gnr3kg="; + }) + (fetchpatch { + name = "21_kern_file_ensure_file_data_is_set.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=a7910687294b29288ac649e71b47493c93294f17"; + hash = "sha256-DabZK9eSToEmSA9dEwtEN+URiVyS9qf6e2Y2UiMuy8Q="; + }) + (fetchpatch { + name = "22_kern_file_implement_filesystem_reference_counting.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=16f196874fbe360a1b3c66064ec15adadf94c57b"; + excludes = [ "grub-core/fs/erofs.c" ]; # Does not exist on 2.12 + hash = "sha256-yGU//1tPaxi+xFKZrsbUAnvgFpwtrIMG+8cPbSud4+U="; + }) + (fetchpatch { + name = "23_prerequisite_1_key_protector_add_key_protectors_framework.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=5d260302da672258444b01239803c8f4d753e3f3"; + hash = "sha256-9WnFN6xMiv+1XMhNHgVEegkhwzp9KpRZI6MIZY/Ih3Q="; + }) + (fetchpatch { + name = "23_prerequisite_2_disk_cryptodisk_allow_user_to_retry_failed_passphrase.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=386b59ddb42fa3f86ddfe557113b25c8fa16f88c"; + hash = "sha256-e1kGQB7wGWvEb2bY3xIpZxE1uzTt9JOKi05jXyUm+bI="; + }) + (fetchpatch { + name = "23_prerequisite_3_cryptodisk_support_key_protectors.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=ad0c52784a375cecaa8715d7deadcf5d65baf173"; + hash = "sha256-+YIvUYA3fLiOFFsXDrQjqjWFluzLa7N1tv0lwq8BqCs="; + }) + (fetchpatch { + name = "23_prerequisite_4_cryptodisk_fallback_to_passphrase.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=6abf8af3c54abc04c4ec71c75d10fcfbc190e181"; + hash = "sha256-eMu9rW4iJucDAsTQMJD1XE6dDIcUmn02cGqIaqBbO3o="; + }) + (fetchpatch { + name = "23_prerequisite_5_cryptodisk_wipe_out_the_cached_keys_from_protectors.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=b35480b48e6f9506d8b7ad8a3b5206d29c24ea95"; + hash = "sha256-5L6Rr+X5Z+Ip91z8cpLcatDW1vyEoZa1icL2oMXPXuI="; + }) + (fetchpatch { + name = "23_prerequisite_6_cli_lock_add_build_option_to_block_command_line_interface.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=bb65d81fe320e4b20d0a9b32232a7546eb275ecc"; + hash = "sha256-HxXgtvEhtaIjXbOcxJHNpD9/NVOv3uXPnue7cagEMu8="; + }) + (fetchpatch { + name = "23_CVE-2024-49504.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=13febd78db3cd85dcba67d8ad03ad4d42815f11e"; + hash = "sha256-U7lNUb4iVAyQ1yEg5ECHCQGE51tKvY13T9Ji09Q1W9Y="; + }) + (fetchpatch { + name = "24_disk_loopback_reference_tracking_for_the_loopback.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=67f70f70a36b6e87a65f928fe1e840a12eafb7ae"; + hash = "sha256-sWBnSF3rAuY1A/IIK1Pc+BqTvyK3j7+lLEhvImtBQMA="; + }) + (fetchpatch { + name = "25_kern_disk_limit_recursion_depth.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=18212f0648b6de7d71d4c8f41eb4d8b78b3a299b"; + hash = "sha256-HiVzXUNs45Fxh4DSqO8wAxSBM7CaYU/bix0PVBcIHGw="; + }) + (fetchpatch { + name = "26_kern_partition_limit_recursion_in_part_iterate.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=8a7103fddfd6664f41081f3bb88eebbf2871da2a"; + hash = "sha256-Nw1VFRVww1VSDSBkRrnTGeaA2PKCitugM12XH6X/2YI="; + }) + (fetchpatch { + name = "27_script_execute_limit_the_recursion_depth.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=d8a937ccae5c6d86dc4375698afca5cefdcd01e1"; + hash = "sha256-YOAdPMZ2iBNMzIwAXFkkyTMKh4ptZUQ0J3v9EjnRlbo="; + }) + (fetchpatch { + name = "28_net_unregister_net_default_ip_and_net_default_mac_variables_hooks_on_unload.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=a1dd8e59da26f1a9608381d3a1a6c0f465282b1d"; + hash = "sha256-7fqdkhFqLECzhz1OLavkHrE9ktDAEmx9ZxZayNr/Eo4="; + }) + (fetchpatch { + name = "29_net_remove_variables_hooks_when_interface_is_unregisted.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=aa8b4d7facef7b75a2703274b1b9d4e0e734c401"; + hash = "sha256-m3VLDbJlwchV5meEpU4LJrDxBtA80qvYcVMJinHLnac="; + }) + (fetchpatch { + name = "30_CVE-2025-0624.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=5eef88152833062a3f7e017535372d64ac8ef7e1"; + hash = "sha256-DvhzHnenAmO9SZpi4kU+0GhyKZB4q4xQYuNJgEhJmn0="; + }) + (fetchpatch { + name = "31_net_tftp_fix_stack_buffer_overflow_in_tftp_open.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=0707accab1b9be5d3645d4700dde3f99209f9367"; + hash = "sha256-16NrpWFSE4jFT2uxmJg16jChw8HiGRTol25XQXNQ5l4="; + }) + (fetchpatch { + name = "32_CVE-2024-45774.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=2c34af908ebf4856051ed29e46d88abd2b20387f"; + hash = "sha256-OWmF+fp2TmetQjV4EWMcESW8u52Okkb5C5IPLfczyv4="; + }) + (fetchpatch { + name = "33_kern_dl_fix_for_an_integer_overflow_in_grub_dl_ref.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=500e5fdd82ca40412b0b73f5e5dda38e4a3af96d"; + hash = "sha256-FNqOWo+oZ4/1sCbTi2uaeKchUxwAKXtbzhScezm0yxk="; + }) + # Patch 34 (https://git.savannah.gnu.org/cgit/grub.git/patch/?id=d72208423dcabf9eb4a3bcb17b6b31888396bd49) + # is skipped, grub_dl_set_mem_attrs() does not exist on 2.12 + (fetchpatch { + name = "35_kern_dl_check_for_the_SHF_INFO_LINK_flag_in_grub_dl_relocate_symbols.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=98ad84328dcabfa603dcf5bd217570aa6b4bdd99"; + hash = "sha256-Zi4Pj2NbodL0VhhO5MWhvErb8xmA7Li0ur0MxpgQjzg="; + }) + (fetchpatch { + name = "36_CVE-2024-45775.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=05be856a8c3aae41f5df90cab7796ab7ee34b872"; + hash = "sha256-T6DO8iuImQTP7hPaCAHMtFnheQoCkZ6w+kfNolLPmrY="; + }) + (fetchpatch { + name = "37_commands_ls_fix_NULL_dereference.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=0bf56bce47489c059e50e61a3db7f682d8c44b56"; + hash = "sha256-h5okwqv4ZFahP3ANUbsk1fiSV4pwEnxUExeBgQ4tiTI="; + }) + (fetchpatch { + name = "38_CVE-2025-0622.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=2123c5bca7e21fbeb0263df4597ddd7054700726"; + hash = "sha256-tFE7VgImGZWDICyvHbrI1hqW6/XohgdTmk21MzljMGw="; + }) + (fetchpatch { + name = "39_CVE-2025-0622.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=9c16197734ada8d0838407eebe081117799bfe67"; + hash = "sha256-tTeuEvadKbXVuY0m0dKtTr11Lpb3yQi4zk0bpwrMOeA="; + }) + (fetchpatch { + name = "40_CVE-2025-0622.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=7580addfc8c94cedb0cdfd7a1fd65b539215e637"; + hash = "sha256-khRLpWqE7hzzoqssVkGFMjAv09T+uHn13Q9pCpogMms="; + }) + (fetchpatch { + name = "41_CVE-2024-45776.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=09bd6eb58b0f71ec273916070fa1e2de16897a91"; + hash = "sha256-yrl/6XUdKQg/MLe8KFuFoRRbQSyOhDmyvnWBV+sr3EY="; + }) + (fetchpatch { + name = "42_CVE-2024-45777.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=b970a5ed967816bbca8225994cd0ee2557bad515"; + hash = "sha256-Vl5Emw3O3Ba2hD1GCWune4PGduDDPO0gM5u+zx/OwKo="; + }) + (fetchpatch { + name = "43_CVE-2025-0690.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=dad8f502974ed9ad0a70ae6820d17b4b142558fc"; + hash = "sha256-DeWOncndX2VM8w1lb5fd5wHAZrI+ChB5Pj9XbUIfDWY="; + }) + (fetchpatch { + name = "44_commands_test_stack_overflow_due_to_unlimited_recursion_depth.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=c68b7d23628a19da67ebe2e06f84165ee04961af"; + hash = "sha256-aputM9KqkB/cK8hBiU9VXbu0LpLNlNCMVIeE9h2pMgY="; + }) + (fetchpatch { + name = "45_CVE-2025-1118.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=34824806ac6302f91e8cabaa41308eaced25725f"; + hash = "sha256-PKQs+fCwj4a9p4hbMqAT3tFNoAOw4xnbKmCwjPUgEOc="; + }) + (fetchpatch { + name = "46_commands_memrw_disable_memory_reading_in_lockdown_mode.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=340e4d058f584534f4b90b7dbea2b64a9f8c418c"; + hash = "sha256-NiMIUnfRreDBw+k4yxUzoRNMFL8pkJhVtkINVgmv5XA="; + }) + (fetchpatch { + name = "47_commands_hexdump_disable_memory_reading_in_lockdown_mode.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=5f31164aed51f498957cdd6ed733ec71a8592c99"; + hash = "sha256-NA7QjxZ9FP+WwiOveqLkbZqsF7hULIyaVS3gNaSUXJE="; + }) + (fetchpatch { + name = "48_CVE-2024-45778_CVE-2024-45779.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=26db6605036bd9e5b16d9068a8cc75be63b8b630"; + hash = "sha256-1+ImwkF/qsejWs2lpyO6xbcqVo2NJGv32gjrP8mEPnI="; + }) + (fetchpatch { + name = "49_CVE-2025-0677_CVE-2025-0684_CVE-2025-0685_CVE-2025-0686_CVE-2025-0689.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=c4bc55da28543d2522a939ba4ee0acde45f2fa74"; + hash = "sha256-qrlErSImMX8eXJHkXjOe5GZ6lWOya5SVpNoiqyEM1lE="; + }) + (fetchpatch { + name = "50_disk_use_safe_math_macros_to_prevent_overflows.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=c407724dad6c3e2fc1571e57adbda71cc03f82aa"; + hash = "sha256-kkAjxXvCdzwqh+oWtEF3qSPiUX9cGWO6eSFVeo7WJzQ="; + }) + (fetchpatch { + name = "51_disk_prevent_overflows_when_allocating_memory_for_arrays.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=d8151f98331ee4d15fcca59edffa59246d8fc15f"; + hash = "sha256-2U+gMLigOCCg3P1GB615xQ0B9PDA6j92tt1ba3Tqg+E="; + }) + (fetchpatch { + name = "52_disk_check_if_returned_pointer_for_allocated_memory_is_NULL.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=33bd6b5ac5c77b346769ab5284262f94e695e464"; + hash = "sha256-+BaJRskWP/YVEdvIxMvEydjQx2LpLlGphRtZjiOUxJ0="; + }) + (fetchpatch { + name = "53_disk_ieee1275_ofdisk_call_grub_ieee1275_close_when_grub_malloc_fails.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=fbaddcca541805c333f0fc792b82772594e73753"; + hash = "sha256-9sGA41HlB/8rtT/fMfkDo4ZJMXBSr+EyN92l/0gDfl4="; + }) + (fetchpatch { + name = "54_fs_use_safe_math_macros_to_prevent_overflows.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=6608163b08a7a8be4b0ab2a5cd4593bba07fe2b7"; + excludes = [ "grub-core/fs/erofs.c" ]; # Does not exist on 2.12 + hash = "sha256-mW4MH5VH5pDxCaFhNh/4mEcYloga56p8vCi7X4kSaek="; + }) + (fetchpatch { + name = "55_CVE-2025-0678_CVE-2025-1125.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=84bc0a9a68835952ae69165c11709811dae7634e"; + hash = "sha256-rCliqM2+k7rTGNpdHFkg3pHvuISjoG0MQr6/8lIvwK4="; + }) + (fetchpatch { + name = "56_fs_prevent_overflows_when_assigning_returned_values_from_read_number.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=cde9f7f338f8f5771777f0e7dfc423ddf952ad31"; + hash = "sha256-dN3HJXNIYtaUZL0LhLabC4VKK6CVC8km9UTw/ln/6ys="; + }) + (fetchpatch { + name = "57_fs_zfs_use_safe_math_macros_to_prevent_overflows.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=88e491a0f744c6b19b6d4caa300a576ba56db7c9"; + hash = "sha256-taSuKyCf9+TiQZcF26yMWpDDQqCfTdRuZTqB9aEz3aA="; + }) + (fetchpatch { + name = "58_fs_zfs_prevent_overflows_when_allocating_memory_for_arrays.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=7f38e32c7ebeaebb79e2c71e3c7d5ea367d3a39c"; + hash = "sha256-E5VmP7I4TAEXxTz3j7mi/uIr9kOSzMoPHAYAbyu56Xk="; + }) + (fetchpatch { + name = "59_fs_zfs_check_if_returned_pointer_for_allocated_memory_is_NULL.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=13065f69dae0eeb60813809026de5bd021051892"; + hash = "sha256-1W//rHUspDS+utdNc069J8lX1ONfoBKiJYnUt46C/D0="; + }) + (fetchpatch { + name = "60_fs_zfs_add_missing_NULL_check_after_grub_strdup_call.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=dd6a4c8d10e02ca5056681e75795041a343636e4"; + hash = "sha256-iFLEkz5G6aQ8FXGuY7/wgN4d4o0+sUxWMKYIFcQ/H+o="; + }) + (fetchpatch { + name = "61_net_use_safe_math_macros_to_prevent_overflows.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=4beeff8a31c4fb4071d2225533cfa316b5a58391"; + hash = "sha256-/gs5ZhplQ1h7PWw0p+b5+0OxmRcvDRKWHj39ezhivcg="; + }) + (fetchpatch { + name = "62_net_prevent_overflows_when_allocating_memory_for_arrays.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=dee2c14fd66bc497cdc74c69fde8c9b84637c8eb"; + hash = "sha256-cO02tCGEeQhQF0TmgtNOgUwRLnNgmxhEefo1gtSlFOk="; + }) + (fetchpatch { + name = "63_net_check_if_returned_pointer_for_allocated_memory_is_NULL.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=1c06ec900591d1fab6fbacf80dc010541d0a5ec8"; + hash = "sha256-oSRhWWVraitoVDqGlFOVzdCkaNqFGOHLjJu75CSc388="; + }) + (fetchpatch { + name = "64_fs_sfs_check_if_allocated_memory_is_NULL.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=e3c578a56f9294e286b6028ca7c1def997a17b15"; + hash = "sha256-7tvFbmjWmWmmRykQjMvZV6IYlhSS8oNR7YfaO5XXAfU="; + }) + (fetchpatch { + name = "65_script_execute_fix_potential_underflow_and_NULL.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=d13b6e8ebd10b4eb16698a002aa40258cf6e6f0e"; + hash = "sha256-paMWaAIImzxtufUrVF5v4T4KnlDAJIPhdaHznu5CyZ8="; + }) + (fetchpatch { + name = "66_osdep_unix_getroot_fix_potential_underflow.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=66733f7c7dae889861ea3ef3ec0710811486019e"; + hash = "sha256-/14HC1kcW7Sy9WfJQFfC+YnvS/GNTMP+Uy6Dxd3zkwc="; + }) + (fetchpatch { + name = "67_misc_ensure_consistent_overflow_error_messages.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=f8795cde217e21539c2f236bcbb1a4bf521086b3"; + hash = "sha256-4X7wr1Tg16xDE9FO6NTlgkfLV5zFKmajeaOspIqcCuI="; + }) + (fetchpatch { + name = "68_bus_usb_ehci_define_GRUB_EHCI_TOGGLE_as_grub_uint32_t.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=9907d9c2723304b42cf6da74f1cc6c4601391956"; + hash = "sha256-D8xaI8g7ffGGmZqqeS8wxWIFLUWUBfmHwMVOHkYTc2I="; + }) + (fetchpatch { + name = "69_normal_menu_use_safe_math_to_avoid_an_integer_overflow.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=5b36a5210e21bee2624f8acc36aefd8f10266adb"; + hash = "sha256-UourmM0Zlaj4o+SnYi5AtjfNujDOt+2ez2XH/uWyiaM="; + }) + (fetchpatch { + name = "70_kern_partition_add_sanity_check_after_grub_strtoul_call.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=8e6e87e7923ca2ae880021cb42a35cc9bb4c8fe2"; + hash = "sha256-4keMUu6ZDKmuSQlFnldV15dDGUibsnSvoEWhLsqWieI="; + }) + (fetchpatch { + name = "71_kern_misc_add_sanity_check_after_grub_strtoul_call.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=a8d6b06331a75d75b46f3dd6cc6fcd40dcf604b7"; + hash = "sha256-2Mpe1sqyuoUPyMAKGZTNzG/ig3G3K8w0gia7lc508Rg="; + }) + (fetchpatch { + name = "72_loader_i386_linux_cast_left_shift_to_grub_uint32_t.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=490a6ab71cebd96fae7a1ceb9067484f5ccbec2a"; + hash = "sha256-e49OC1EBaX0/nWTTXT5xE5apTJPQV0myP5Ohxn9Wwa8="; + }) + (fetchpatch { + name = "73_loader_i386_bsd_use_safe_math_to_avoid_underflow.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=4dc6166571645780c459dde2cdc1b001a5ec844c"; + hash = "sha256-e8X+oBvejcFNOY1Tp/f6QqCDwrgK7f9u1F8SdO/dhy4="; + }) + (fetchpatch { + # Fixes 7e2f750f0a (security patch 14/73) + name = "fs_ext2_rework_out-of-bounds_read_for_inline_and_external_extents.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=348cd416a3574348f4255bf2b04ec95938990997"; + hash = "sha256-WBLYQxv8si2tvdPAvbm0/4NNqYWBMJpFV4GC0HhN/kE="; + }) + ]; - patches = [ - ./fix-bash-completion.patch - ./add-hidden-menu-entries.patch - - # https://lists.gnu.org/archive/html/grub-devel/2025-02/msg00024.html - (fetchpatch { - name = "01_implement_grub_strlcpy.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=ea703528a8581a2ea7e0bad424a70fdf0aec7d8f"; - hash = "sha256-MSMgu1vMG83HRImUUsTyA1YQaIhgEreGGPd+ZDWSI2I="; - }) - (fetchpatch { - name = "02_CVE-2024-45781.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=c1a291b01f4f1dcd6a22b61f1c81a45a966d16ba"; - hash = "sha256-q8ErK+cQzaqwSuhLRFL3AfYBkpgJq1IQmadnlmlz2yw="; - }) - (fetchpatch { - name = "03_CVE-2024-45782_CVE-2024-56737.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=417547c10410b714e43f08f74137c24015f8f4c3"; - hash = "sha256-mRinw27WZ2d1grzyzFGO18yXx72UVBM6Lf5cR8XJfs8="; - }) - (fetchpatch { - name = "04_fs_tar_initialize_name_in_grub_cpio_find_file.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=2c8ac08c99466c0697f704242363fc687f492a0d"; - hash = "sha256-EMGF0B+Fw6tSmllWUJAp1ynzWk+w2C/XM1LmXSReHWg="; - }) - (fetchpatch { - name = "05_CVE-2024-45780.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=0087bc6902182fe5cedce2d034c75a79cf6dd4f3"; - hash = "sha256-IlW5i4EJVoUYPu9/lb0LeytTpzltQuu5fpkFPQNIhls="; - }) - (fetchpatch { - name = "06_fs_f2fs_grub_errno_mount_fails.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=563436258cde64da6b974880abff1bf0959f4da3"; - hash = "sha256-Iu0RPyB+pAnqMT+MTX+TrJbYJsvYPn7jbMgE1jcLh/Q="; - }) - (fetchpatch { - name = "07_CVE-2024-45783.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=f7c070a2e28dfab7137db0739fb8db1dc02d8898"; - hash = "sha256-V1wh2dPeTazmad61jFtOjhq2MdoD+txPWY/AfwwyTZM="; - }) - (fetchpatch { - name = "08_fs_iso9660_grub_errno_mount_fails.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=965db5970811d18069b34f28f5f31ddadde90a97"; - hash = "sha256-6eN1AvZwXkJOQVcjgymy/E7QiAxzL/d0W3KlAZRqUzI="; - }) - (fetchpatch { - name = "09_fs_iso9660_fix_invalid_free.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=1443833a9535a5873f7de3798cf4d8389f366611"; - hash = "sha256-Gt5yMy5Vg9zrDggj3o/TLNt2vT9/6IuHg4Se2p8e8pI="; - }) - (fetchpatch { - name = "10_fs_jfs_fix_oob_read_jfs_getent.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=66175696f3a385b14bdf1ebcda7755834bd2d5fb"; - hash = "sha256-ETbzbc5gvf55sTLjmJOXXC9VH3qcP1Gv5seR/U9NRiY="; - }) - (fetchpatch { - name = "11_fs_jfs_fix_oob_read_caused_by_invalid_dir_slot_index.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=ab09fd0531f3523ac0ef833404526c98c08248f7"; - hash = "sha256-wE6niiIx4BdN800/Eegb6IbBRoMFpXq9kPvatwhWNXY="; - }) - (fetchpatch { - name = "12_fs_jfs_use_full_40_bits_offset_and_address_for_data_extent.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=bd999310fe67f35a66de3bfa2836da91589d04ef"; - hash = "sha256-fbC4oTEIoGWJASzJI5RXfoanrMLTfjFOI51LCUU7Ctg="; - }) - (fetchpatch { - name = "13_fs_jfs_inconsistent_signed_unsigned_types_usage.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=edd995a26ec98654d907a9436a296c2d82bc4b28"; - hash = "sha256-aa1G1vi4bPZejfKEqZokAZTzY9Ea2lyxTrP4drDV9tk="; - }) - (fetchpatch { - name = "14_fs_ext2_fix_out-of-bounds_read_for_inline_extent.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=7e2f750f0a795c4d64ec7dc7591edac8da2e978c"; - hash = "sha256-PtPqZHMU2fy7btRRaaswLyHizplxnygCzDfcg5ievOQ="; - }) - (fetchpatch { - name = "15_fs_ntfs_fix_out-of-bounds_read.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=aff26318783a135562b904ff09e2359893885732"; - hash = "sha256-znN6lkAB9aAhTGKR1038DzOz5nzuTp+7ylHVqRM7HeI="; - }) - (fetchpatch { - name = "16_fs_ntfs_track_the_end_of_the_MFT_attribute_buffer.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=237a71184a32d1ef7732f5f49ed6a89c5fe1c99a"; - hash = "sha256-0I/g0qHkWY6PArPn1UaYRhCrrh9bHknADh34v5eSjjM="; - }) - (fetchpatch { - name = "17_fs_ntfs_use_a_helper_function_to_access_attributes.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=048777bc29043403d077d41a81d0183767b8bc71"; - hash = "sha256-Mm49MSLqCq143r8ruLJm1QoyCoLtOlCBfqoAPwPlv8E="; - }) - # Patch 18 (067b6d225d482280abad03944f04e30abcbdafa1) has been removed because it causes regressions - # https://lists.gnu.org/archive/html/grub-devel/2025-03/msg00067.html - (fetchpatch { - name = "19_fs_xfs_fix_out-of-bounds_read.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=6ccc77b59d16578b10eaf8a4fe85c20b229f0d8a"; - hash = "sha256-FvTzFvfEi3oyxPC/dUHreyzzeVCskaUlYUjpKY/l0DE="; - }) - (fetchpatch { - name = "20_fs_xfs_ensuring_failing_to_mount_sets_a_grub_errno.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=d1d6b7ea58aa5a80a4c4d0666b49460056c8ef0a"; - hash = "sha256-SLdXMmYHq/gRmWrjRrOu5ZYFod84EllUL6hk+gnr3kg="; - }) - (fetchpatch { - name = "21_kern_file_ensure_file_data_is_set.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=a7910687294b29288ac649e71b47493c93294f17"; - hash = "sha256-DabZK9eSToEmSA9dEwtEN+URiVyS9qf6e2Y2UiMuy8Q="; - }) - (fetchpatch { - name = "22_kern_file_implement_filesystem_reference_counting.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=16f196874fbe360a1b3c66064ec15adadf94c57b"; - excludes = [ "grub-core/fs/erofs.c" ]; # Does not exist on 2.12 - hash = "sha256-yGU//1tPaxi+xFKZrsbUAnvgFpwtrIMG+8cPbSud4+U="; - }) - (fetchpatch { - name = "23_prerequisite_1_key_protector_add_key_protectors_framework.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=5d260302da672258444b01239803c8f4d753e3f3"; - hash = "sha256-9WnFN6xMiv+1XMhNHgVEegkhwzp9KpRZI6MIZY/Ih3Q="; - }) - (fetchpatch { - name = "23_prerequisite_2_disk_cryptodisk_allow_user_to_retry_failed_passphrase.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=386b59ddb42fa3f86ddfe557113b25c8fa16f88c"; - hash = "sha256-e1kGQB7wGWvEb2bY3xIpZxE1uzTt9JOKi05jXyUm+bI="; - }) - (fetchpatch { - name = "23_prerequisite_3_cryptodisk_support_key_protectors.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=ad0c52784a375cecaa8715d7deadcf5d65baf173"; - hash = "sha256-+YIvUYA3fLiOFFsXDrQjqjWFluzLa7N1tv0lwq8BqCs="; - }) - (fetchpatch { - name = "23_prerequisite_4_cryptodisk_fallback_to_passphrase.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=6abf8af3c54abc04c4ec71c75d10fcfbc190e181"; - hash = "sha256-eMu9rW4iJucDAsTQMJD1XE6dDIcUmn02cGqIaqBbO3o="; - }) - (fetchpatch { - name = "23_prerequisite_5_cryptodisk_wipe_out_the_cached_keys_from_protectors.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=b35480b48e6f9506d8b7ad8a3b5206d29c24ea95"; - hash = "sha256-5L6Rr+X5Z+Ip91z8cpLcatDW1vyEoZa1icL2oMXPXuI="; - }) - (fetchpatch { - name = "23_prerequisite_6_cli_lock_add_build_option_to_block_command_line_interface.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=bb65d81fe320e4b20d0a9b32232a7546eb275ecc"; - hash = "sha256-HxXgtvEhtaIjXbOcxJHNpD9/NVOv3uXPnue7cagEMu8="; - }) - (fetchpatch { - name = "23_CVE-2024-49504.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=13febd78db3cd85dcba67d8ad03ad4d42815f11e"; - hash = "sha256-U7lNUb4iVAyQ1yEg5ECHCQGE51tKvY13T9Ji09Q1W9Y="; - }) - (fetchpatch { - name = "24_disk_loopback_reference_tracking_for_the_loopback.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=67f70f70a36b6e87a65f928fe1e840a12eafb7ae"; - hash = "sha256-sWBnSF3rAuY1A/IIK1Pc+BqTvyK3j7+lLEhvImtBQMA="; - }) - (fetchpatch { - name = "25_kern_disk_limit_recursion_depth.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=18212f0648b6de7d71d4c8f41eb4d8b78b3a299b"; - hash = "sha256-HiVzXUNs45Fxh4DSqO8wAxSBM7CaYU/bix0PVBcIHGw="; - }) - (fetchpatch { - name = "26_kern_partition_limit_recursion_in_part_iterate.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=8a7103fddfd6664f41081f3bb88eebbf2871da2a"; - hash = "sha256-Nw1VFRVww1VSDSBkRrnTGeaA2PKCitugM12XH6X/2YI="; - }) - (fetchpatch { - name = "27_script_execute_limit_the_recursion_depth.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=d8a937ccae5c6d86dc4375698afca5cefdcd01e1"; - hash = "sha256-YOAdPMZ2iBNMzIwAXFkkyTMKh4ptZUQ0J3v9EjnRlbo="; - }) - (fetchpatch { - name = "28_net_unregister_net_default_ip_and_net_default_mac_variables_hooks_on_unload.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=a1dd8e59da26f1a9608381d3a1a6c0f465282b1d"; - hash = "sha256-7fqdkhFqLECzhz1OLavkHrE9ktDAEmx9ZxZayNr/Eo4="; - }) - (fetchpatch { - name = "29_net_remove_variables_hooks_when_interface_is_unregisted.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=aa8b4d7facef7b75a2703274b1b9d4e0e734c401"; - hash = "sha256-m3VLDbJlwchV5meEpU4LJrDxBtA80qvYcVMJinHLnac="; - }) - (fetchpatch { - name = "30_CVE-2025-0624.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=5eef88152833062a3f7e017535372d64ac8ef7e1"; - hash = "sha256-DvhzHnenAmO9SZpi4kU+0GhyKZB4q4xQYuNJgEhJmn0="; - }) - (fetchpatch { - name = "31_net_tftp_fix_stack_buffer_overflow_in_tftp_open.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=0707accab1b9be5d3645d4700dde3f99209f9367"; - hash = "sha256-16NrpWFSE4jFT2uxmJg16jChw8HiGRTol25XQXNQ5l4="; - }) - (fetchpatch { - name = "32_CVE-2024-45774.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=2c34af908ebf4856051ed29e46d88abd2b20387f"; - hash = "sha256-OWmF+fp2TmetQjV4EWMcESW8u52Okkb5C5IPLfczyv4="; - }) - (fetchpatch { - name = "33_kern_dl_fix_for_an_integer_overflow_in_grub_dl_ref.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=500e5fdd82ca40412b0b73f5e5dda38e4a3af96d"; - hash = "sha256-FNqOWo+oZ4/1sCbTi2uaeKchUxwAKXtbzhScezm0yxk="; - }) - # Patch 34 (https://git.savannah.gnu.org/cgit/grub.git/patch/?id=d72208423dcabf9eb4a3bcb17b6b31888396bd49) - # is skipped, grub_dl_set_mem_attrs() does not exist on 2.12 - (fetchpatch { - name = "35_kern_dl_check_for_the_SHF_INFO_LINK_flag_in_grub_dl_relocate_symbols.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=98ad84328dcabfa603dcf5bd217570aa6b4bdd99"; - hash = "sha256-Zi4Pj2NbodL0VhhO5MWhvErb8xmA7Li0ur0MxpgQjzg="; - }) - (fetchpatch { - name = "36_CVE-2024-45775.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=05be856a8c3aae41f5df90cab7796ab7ee34b872"; - hash = "sha256-T6DO8iuImQTP7hPaCAHMtFnheQoCkZ6w+kfNolLPmrY="; - }) - (fetchpatch { - name = "37_commands_ls_fix_NULL_dereference.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=0bf56bce47489c059e50e61a3db7f682d8c44b56"; - hash = "sha256-h5okwqv4ZFahP3ANUbsk1fiSV4pwEnxUExeBgQ4tiTI="; - }) - (fetchpatch { - name = "38_CVE-2025-0622.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=2123c5bca7e21fbeb0263df4597ddd7054700726"; - hash = "sha256-tFE7VgImGZWDICyvHbrI1hqW6/XohgdTmk21MzljMGw="; - }) - (fetchpatch { - name = "39_CVE-2025-0622.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=9c16197734ada8d0838407eebe081117799bfe67"; - hash = "sha256-tTeuEvadKbXVuY0m0dKtTr11Lpb3yQi4zk0bpwrMOeA="; - }) - (fetchpatch { - name = "40_CVE-2025-0622.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=7580addfc8c94cedb0cdfd7a1fd65b539215e637"; - hash = "sha256-khRLpWqE7hzzoqssVkGFMjAv09T+uHn13Q9pCpogMms="; - }) - (fetchpatch { - name = "41_CVE-2024-45776.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=09bd6eb58b0f71ec273916070fa1e2de16897a91"; - hash = "sha256-yrl/6XUdKQg/MLe8KFuFoRRbQSyOhDmyvnWBV+sr3EY="; - }) - (fetchpatch { - name = "42_CVE-2024-45777.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=b970a5ed967816bbca8225994cd0ee2557bad515"; - hash = "sha256-Vl5Emw3O3Ba2hD1GCWune4PGduDDPO0gM5u+zx/OwKo="; - }) - (fetchpatch { - name = "43_CVE-2025-0690.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=dad8f502974ed9ad0a70ae6820d17b4b142558fc"; - hash = "sha256-DeWOncndX2VM8w1lb5fd5wHAZrI+ChB5Pj9XbUIfDWY="; - }) - (fetchpatch { - name = "44_commands_test_stack_overflow_due_to_unlimited_recursion_depth.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=c68b7d23628a19da67ebe2e06f84165ee04961af"; - hash = "sha256-aputM9KqkB/cK8hBiU9VXbu0LpLNlNCMVIeE9h2pMgY="; - }) - (fetchpatch { - name = "45_CVE-2025-1118.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=34824806ac6302f91e8cabaa41308eaced25725f"; - hash = "sha256-PKQs+fCwj4a9p4hbMqAT3tFNoAOw4xnbKmCwjPUgEOc="; - }) - (fetchpatch { - name = "46_commands_memrw_disable_memory_reading_in_lockdown_mode.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=340e4d058f584534f4b90b7dbea2b64a9f8c418c"; - hash = "sha256-NiMIUnfRreDBw+k4yxUzoRNMFL8pkJhVtkINVgmv5XA="; - }) - (fetchpatch { - name = "47_commands_hexdump_disable_memory_reading_in_lockdown_mode.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=5f31164aed51f498957cdd6ed733ec71a8592c99"; - hash = "sha256-NA7QjxZ9FP+WwiOveqLkbZqsF7hULIyaVS3gNaSUXJE="; - }) - (fetchpatch { - name = "48_CVE-2024-45778_CVE-2024-45779.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=26db6605036bd9e5b16d9068a8cc75be63b8b630"; - hash = "sha256-1+ImwkF/qsejWs2lpyO6xbcqVo2NJGv32gjrP8mEPnI="; - }) - (fetchpatch { - name = "49_CVE-2025-0677_CVE-2025-0684_CVE-2025-0685_CVE-2025-0686_CVE-2025-0689.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=c4bc55da28543d2522a939ba4ee0acde45f2fa74"; - hash = "sha256-qrlErSImMX8eXJHkXjOe5GZ6lWOya5SVpNoiqyEM1lE="; - }) - (fetchpatch { - name = "50_disk_use_safe_math_macros_to_prevent_overflows.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=c407724dad6c3e2fc1571e57adbda71cc03f82aa"; - hash = "sha256-kkAjxXvCdzwqh+oWtEF3qSPiUX9cGWO6eSFVeo7WJzQ="; - }) - (fetchpatch { - name = "51_disk_prevent_overflows_when_allocating_memory_for_arrays.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=d8151f98331ee4d15fcca59edffa59246d8fc15f"; - hash = "sha256-2U+gMLigOCCg3P1GB615xQ0B9PDA6j92tt1ba3Tqg+E="; - }) - (fetchpatch { - name = "52_disk_check_if_returned_pointer_for_allocated_memory_is_NULL.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=33bd6b5ac5c77b346769ab5284262f94e695e464"; - hash = "sha256-+BaJRskWP/YVEdvIxMvEydjQx2LpLlGphRtZjiOUxJ0="; - }) - (fetchpatch { - name = "53_disk_ieee1275_ofdisk_call_grub_ieee1275_close_when_grub_malloc_fails.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=fbaddcca541805c333f0fc792b82772594e73753"; - hash = "sha256-9sGA41HlB/8rtT/fMfkDo4ZJMXBSr+EyN92l/0gDfl4="; - }) - (fetchpatch { - name = "54_fs_use_safe_math_macros_to_prevent_overflows.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=6608163b08a7a8be4b0ab2a5cd4593bba07fe2b7"; - excludes = [ "grub-core/fs/erofs.c" ]; # Does not exist on 2.12 - hash = "sha256-mW4MH5VH5pDxCaFhNh/4mEcYloga56p8vCi7X4kSaek="; - }) - (fetchpatch { - name = "55_CVE-2025-0678_CVE-2025-1125.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=84bc0a9a68835952ae69165c11709811dae7634e"; - hash = "sha256-rCliqM2+k7rTGNpdHFkg3pHvuISjoG0MQr6/8lIvwK4="; - }) - (fetchpatch { - name = "56_fs_prevent_overflows_when_assigning_returned_values_from_read_number.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=cde9f7f338f8f5771777f0e7dfc423ddf952ad31"; - hash = "sha256-dN3HJXNIYtaUZL0LhLabC4VKK6CVC8km9UTw/ln/6ys="; - }) - (fetchpatch { - name = "57_fs_zfs_use_safe_math_macros_to_prevent_overflows.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=88e491a0f744c6b19b6d4caa300a576ba56db7c9"; - hash = "sha256-taSuKyCf9+TiQZcF26yMWpDDQqCfTdRuZTqB9aEz3aA="; - }) - (fetchpatch { - name = "58_fs_zfs_prevent_overflows_when_allocating_memory_for_arrays.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=7f38e32c7ebeaebb79e2c71e3c7d5ea367d3a39c"; - hash = "sha256-E5VmP7I4TAEXxTz3j7mi/uIr9kOSzMoPHAYAbyu56Xk="; - }) - (fetchpatch { - name = "59_fs_zfs_check_if_returned_pointer_for_allocated_memory_is_NULL.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=13065f69dae0eeb60813809026de5bd021051892"; - hash = "sha256-1W//rHUspDS+utdNc069J8lX1ONfoBKiJYnUt46C/D0="; - }) - (fetchpatch { - name = "60_fs_zfs_add_missing_NULL_check_after_grub_strdup_call.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=dd6a4c8d10e02ca5056681e75795041a343636e4"; - hash = "sha256-iFLEkz5G6aQ8FXGuY7/wgN4d4o0+sUxWMKYIFcQ/H+o="; - }) - (fetchpatch { - name = "61_net_use_safe_math_macros_to_prevent_overflows.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=4beeff8a31c4fb4071d2225533cfa316b5a58391"; - hash = "sha256-/gs5ZhplQ1h7PWw0p+b5+0OxmRcvDRKWHj39ezhivcg="; - }) - (fetchpatch { - name = "62_net_prevent_overflows_when_allocating_memory_for_arrays.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=dee2c14fd66bc497cdc74c69fde8c9b84637c8eb"; - hash = "sha256-cO02tCGEeQhQF0TmgtNOgUwRLnNgmxhEefo1gtSlFOk="; - }) - (fetchpatch { - name = "63_net_check_if_returned_pointer_for_allocated_memory_is_NULL.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=1c06ec900591d1fab6fbacf80dc010541d0a5ec8"; - hash = "sha256-oSRhWWVraitoVDqGlFOVzdCkaNqFGOHLjJu75CSc388="; - }) - (fetchpatch { - name = "64_fs_sfs_check_if_allocated_memory_is_NULL.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=e3c578a56f9294e286b6028ca7c1def997a17b15"; - hash = "sha256-7tvFbmjWmWmmRykQjMvZV6IYlhSS8oNR7YfaO5XXAfU="; - }) - (fetchpatch { - name = "65_script_execute_fix_potential_underflow_and_NULL.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=d13b6e8ebd10b4eb16698a002aa40258cf6e6f0e"; - hash = "sha256-paMWaAIImzxtufUrVF5v4T4KnlDAJIPhdaHznu5CyZ8="; - }) - (fetchpatch { - name = "66_osdep_unix_getroot_fix_potential_underflow.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=66733f7c7dae889861ea3ef3ec0710811486019e"; - hash = "sha256-/14HC1kcW7Sy9WfJQFfC+YnvS/GNTMP+Uy6Dxd3zkwc="; - }) - (fetchpatch { - name = "67_misc_ensure_consistent_overflow_error_messages.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=f8795cde217e21539c2f236bcbb1a4bf521086b3"; - hash = "sha256-4X7wr1Tg16xDE9FO6NTlgkfLV5zFKmajeaOspIqcCuI="; - }) - (fetchpatch { - name = "68_bus_usb_ehci_define_GRUB_EHCI_TOGGLE_as_grub_uint32_t.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=9907d9c2723304b42cf6da74f1cc6c4601391956"; - hash = "sha256-D8xaI8g7ffGGmZqqeS8wxWIFLUWUBfmHwMVOHkYTc2I="; - }) - (fetchpatch { - name = "69_normal_menu_use_safe_math_to_avoid_an_integer_overflow.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=5b36a5210e21bee2624f8acc36aefd8f10266adb"; - hash = "sha256-UourmM0Zlaj4o+SnYi5AtjfNujDOt+2ez2XH/uWyiaM="; - }) - (fetchpatch { - name = "70_kern_partition_add_sanity_check_after_grub_strtoul_call.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=8e6e87e7923ca2ae880021cb42a35cc9bb4c8fe2"; - hash = "sha256-4keMUu6ZDKmuSQlFnldV15dDGUibsnSvoEWhLsqWieI="; - }) - (fetchpatch { - name = "71_kern_misc_add_sanity_check_after_grub_strtoul_call.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=a8d6b06331a75d75b46f3dd6cc6fcd40dcf604b7"; - hash = "sha256-2Mpe1sqyuoUPyMAKGZTNzG/ig3G3K8w0gia7lc508Rg="; - }) - (fetchpatch { - name = "72_loader_i386_linux_cast_left_shift_to_grub_uint32_t.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=490a6ab71cebd96fae7a1ceb9067484f5ccbec2a"; - hash = "sha256-e49OC1EBaX0/nWTTXT5xE5apTJPQV0myP5Ohxn9Wwa8="; - }) - (fetchpatch { - name = "73_loader_i386_bsd_use_safe_math_to_avoid_underflow.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=4dc6166571645780c459dde2cdc1b001a5ec844c"; - hash = "sha256-e8X+oBvejcFNOY1Tp/f6QqCDwrgK7f9u1F8SdO/dhy4="; - }) - (fetchpatch { - # Fixes 7e2f750f0a (security patch 14/73) - name = "fs_ext2_rework_out-of-bounds_read_for_inline_and_external_extents.patch"; - url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=348cd416a3574348f4255bf2b04ec95938990997"; - hash = "sha256-WBLYQxv8si2tvdPAvbm0/4NNqYWBMJpFV4GC0HhN/kE="; - }) - ]; - - postPatch = - if kbdcompSupport then - '' - sed -i util/grub-kbdcomp.in -e 's@\bckbcomp\b@${ckbcomp}/bin/ckbcomp@' - '' - else - '' - echo '#! ${runtimeShell}' > util/grub-kbdcomp.in - echo 'echo "Compile grub2 with { kbdcompSupport = true; } to enable support for this command."' >> util/grub-kbdcomp.in - ''; - - depsBuildBuild = [ buildPackages.stdenv.cc ]; - nativeBuildInputs = [ - bison - flex - python3 - pkg-config - gettext - freetype - autoconf - automake - help2man - ]; - buildInputs = - [ - ncurses - libusb-compat-0_1 - freetype - lvm2 - fuse - libtool - bash - ] - ++ lib.optional doCheck qemu - ++ lib.optional zfsSupport zfs; - - strictDeps = true; - - hardeningDisable = [ "all" ]; - - separateDebugInfo = !xenSupport; - - preConfigure = '' - for i in "tests/util/"*.in - do - sed -i "$i" -e's|/bin/bash|${stdenv.shell}|g' - done - - # Apparently, the QEMU executable is no longer called - # `qemu-system-i386', even on i386. - # - # In addition, use `-nodefaults' to avoid errors like: - # - # chardev: opening backend "stdio" failed - # qemu: could not open serial device 'stdio': Invalid argument - # - # See . - sed -i "tests/util/grub-shell.in" \ - -e's/qemu-system-i386/qemu-system-x86_64 -nodefaults/g' - - unset CPP # setting CPP intereferes with dependency calculation - - patchShebangs . - - GNULIB_REVISION=$(. bootstrap.conf; echo $GNULIB_REVISION) - if [ "$GNULIB_REVISION" != ${gnulib.rev} ]; then - echo "This version of GRUB requires a different gnulib revision!" - echo "We have: ${gnulib.rev}" - echo "GRUB needs: $GNULIB_REVISION" - exit 1 - fi - - cp -f --no-preserve=mode ${locales}/po/LINGUAS ${locales}/po/*.po po - - ./bootstrap --no-git --gnulib-srcdir=${gnulib} - - substituteInPlace ./configure --replace '/usr/share/fonts/unifont' '${unifont}/share/fonts' - ''; - - postConfigure = '' - # make sure .po files are up to date to workaround - # parallel `msgmerge --update` on autogenerated .po files: - # https://github.com/NixOS/nixpkgs/pull/248747#issuecomment-1676301670 - make dist - ''; - - configureFlags = - [ - "--enable-grub-mount" # dep of os-prober - ] - ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [ - # grub doesn't do cross-compilation as usual and tries to use unprefixed - # tools to target the host. Provide toolchain information explicitly for - # cross builds. - # - # Ref: # https://github.com/buildroot/buildroot/blob/master/boot/grub2/grub2.mk#L108 - "TARGET_CC=${stdenv.cc.targetPrefix}cc" - "TARGET_NM=${stdenv.cc.targetPrefix}nm" - "TARGET_OBJCOPY=${stdenv.cc.targetPrefix}objcopy" - "TARGET_RANLIB=${stdenv.cc.targetPrefix}ranlib" - "TARGET_STRIP=${stdenv.cc.targetPrefix}strip" - ] - ++ lib.optional zfsSupport "--enable-libzfs" - ++ lib.optionals efiSupport [ - "--with-platform=efi" - "--target=${efiSystemsBuild.${stdenv.hostPlatform.system}.target}" - "--program-prefix=" - ] - ++ lib.optionals xenSupport [ - "--with-platform=xen" - "--target=${efiSystemsBuild.${stdenv.hostPlatform.system}.target}" - ]; - - # save target that grub is compiled for - grubTarget = - if efiSupport then - "${efiSystemsInstall.${stdenv.hostPlatform.system}.target}-efi" - else - lib.optionalString inPCSystems "${pcSystems.${stdenv.hostPlatform.system}.target}-pc"; - - doCheck = false; - enableParallelBuilding = true; - - postInstall = '' - # Avoid a runtime reference to gcc - sed -i $out/lib/grub/*/modinfo.sh -e "/grub_target_cppflags=/ s|'.*'|' '|" - # just adding bash to buildInputs wasn't enough to fix the shebang - substituteInPlace $out/lib/grub/*/modinfo.sh \ - --replace ${buildPackages.bash} "/usr/bin/bash" - ''; - - passthru.tests = { - nixos-grub = nixosTests.grub; - nixos-install-simple = nixosTests.installer.simple; - nixos-install-grub-uefi = nixosTests.installer.simpleUefiGrub; - nixos-install-grub-uefi-spec = nixosTests.installer.simpleUefiGrubSpecialisation; - }; - - meta = with lib; { - description = "GNU GRUB, the Grand Unified Boot Loader"; - - longDescription = '' - GNU GRUB is a Multiboot boot loader. It was derived from GRUB, GRand - Unified Bootloader, which was originally designed and implemented by - Erich Stefan Boleyn. - - Briefly, the boot loader is the first software program that runs when a - computer starts. It is responsible for loading and transferring - control to the operating system kernel software (such as the Hurd or - the Linux). The kernel, in turn, initializes the rest of the - operating system (e.g., GNU). + postPatch = + if kbdcompSupport then + '' + sed -i util/grub-kbdcomp.in -e 's@\bckbcomp\b@${ckbcomp}/bin/ckbcomp@' + '' + else + '' + echo '#! ${runtimeShell}' > util/grub-kbdcomp.in + echo 'echo "Compile grub2 with { kbdcompSupport = true; } to enable support for this command."' >> util/grub-kbdcomp.in ''; - homepage = "https://www.gnu.org/software/grub/"; + depsBuildBuild = [ buildPackages.stdenv.cc ]; + nativeBuildInputs = [ + bison + flex + python3 + pkg-config + gettext + freetype + autoconf + automake + help2man + ]; + buildInputs = + [ + ncurses + libusb-compat-0_1 + freetype + lvm2 + fuse + libtool + bash + ] + ++ lib.optional doCheck qemu + ++ lib.optional zfsSupport zfs; - license = licenses.gpl3Plus; + strictDeps = true; - platforms = - if xenSupport then - [ - "x86_64-linux" - "i686-linux" - ] - else - platforms.gnu ++ platforms.linux; + hardeningDisable = [ "all" ]; - maintainers = [ ]; - }; - } -) + separateDebugInfo = !xenSupport; + + preConfigure = '' + for i in "tests/util/"*.in + do + sed -i "$i" -e's|/bin/bash|${stdenv.shell}|g' + done + + # Apparently, the QEMU executable is no longer called + # `qemu-system-i386', even on i386. + # + # In addition, use `-nodefaults' to avoid errors like: + # + # chardev: opening backend "stdio" failed + # qemu: could not open serial device 'stdio': Invalid argument + # + # See . + sed -i "tests/util/grub-shell.in" \ + -e's/qemu-system-i386/qemu-system-x86_64 -nodefaults/g' + + unset CPP # setting CPP intereferes with dependency calculation + + patchShebangs . + + GNULIB_REVISION=$(. bootstrap.conf; echo $GNULIB_REVISION) + if [ "$GNULIB_REVISION" != ${gnulib.rev} ]; then + echo "This version of GRUB requires a different gnulib revision!" + echo "We have: ${gnulib.rev}" + echo "GRUB needs: $GNULIB_REVISION" + exit 1 + fi + + cp -f --no-preserve=mode ${locales}/po/LINGUAS ${locales}/po/*.po po + + ./bootstrap --no-git --gnulib-srcdir=${gnulib} + + substituteInPlace ./configure --replace '/usr/share/fonts/unifont' '${unifont}/share/fonts' + ''; + + postConfigure = '' + # make sure .po files are up to date to workaround + # parallel `msgmerge --update` on autogenerated .po files: + # https://github.com/NixOS/nixpkgs/pull/248747#issuecomment-1676301670 + make dist + ''; + + configureFlags = + [ + "--enable-grub-mount" # dep of os-prober + ] + ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [ + # grub doesn't do cross-compilation as usual and tries to use unprefixed + # tools to target the host. Provide toolchain information explicitly for + # cross builds. + # + # Ref: # https://github.com/buildroot/buildroot/blob/master/boot/grub2/grub2.mk#L108 + "TARGET_CC=${stdenv.cc.targetPrefix}cc" + "TARGET_NM=${stdenv.cc.targetPrefix}nm" + "TARGET_OBJCOPY=${stdenv.cc.targetPrefix}objcopy" + "TARGET_RANLIB=${stdenv.cc.targetPrefix}ranlib" + "TARGET_STRIP=${stdenv.cc.targetPrefix}strip" + ] + ++ lib.optional zfsSupport "--enable-libzfs" + ++ lib.optionals efiSupport [ + "--with-platform=efi" + "--target=${efiSystemsBuild.${stdenv.hostPlatform.system}.target}" + "--program-prefix=" + ] + ++ lib.optionals xenSupport [ + "--with-platform=xen" + "--target=${efiSystemsBuild.${stdenv.hostPlatform.system}.target}" + ]; + + # save target that grub is compiled for + grubTarget = + if efiSupport then + "${efiSystemsInstall.${stdenv.hostPlatform.system}.target}-efi" + else + lib.optionalString inPCSystems "${pcSystems.${stdenv.hostPlatform.system}.target}-pc"; + + doCheck = false; + enableParallelBuilding = true; + + postInstall = '' + # Avoid a runtime reference to gcc + sed -i $out/lib/grub/*/modinfo.sh -e "/grub_target_cppflags=/ s|'.*'|' '|" + # just adding bash to buildInputs wasn't enough to fix the shebang + substituteInPlace $out/lib/grub/*/modinfo.sh \ + --replace ${buildPackages.bash} "/usr/bin/bash" + ''; + + passthru.tests = { + nixos-grub = nixosTests.grub; + nixos-install-simple = nixosTests.installer.simple; + nixos-install-grub-uefi = nixosTests.installer.simpleUefiGrub; + nixos-install-grub-uefi-spec = nixosTests.installer.simpleUefiGrubSpecialisation; + }; + + meta = with lib; { + description = "GNU GRUB, the Grand Unified Boot Loader"; + + longDescription = '' + GNU GRUB is a Multiboot boot loader. It was derived from GRUB, GRand + Unified Bootloader, which was originally designed and implemented by + Erich Stefan Boleyn. + + Briefly, the boot loader is the first software program that runs when a + computer starts. It is responsible for loading and transferring + control to the operating system kernel software (such as the Hurd or + the Linux). The kernel, in turn, initializes the rest of the + operating system (e.g., GNU). + ''; + + homepage = "https://www.gnu.org/software/grub/"; + + license = licenses.gpl3Plus; + + platforms = + if xenSupport then + [ + "x86_64-linux" + "i686-linux" + ] + else + platforms.gnu ++ platforms.linux; + + maintainers = [ ]; + + broken = !(efiSupport -> canEfi) || !(zfsSupport -> zfs != null) || (efiSupport && xenSupport); + }; +} From 9347e5fc83bd236a3357b30f55da3f7148d53f1f Mon Sep 17 00:00:00 2001 From: Pol Dellaiera Date: Mon, 21 Jul 2025 18:18:44 +0200 Subject: [PATCH 25/60] vscode-extensions.devsense.composer-php-vscode: drop --- .../editors/vscode/extensions/default.nix | 17 ----------------- 1 file changed, 17 deletions(-) diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix index c0bd3fb5c3a6..ef16d9971c34 100644 --- a/pkgs/applications/editors/vscode/extensions/default.nix +++ b/pkgs/applications/editors/vscode/extensions/default.nix @@ -1343,23 +1343,6 @@ let detachhead.basedpyright = callPackage ./detachhead.basedpyright { }; - devsense.composer-php-vscode = buildVscodeMarketplaceExtension { - mktplcRef = { - name = "composer-php-vscode"; - publisher = "devsense"; - version = "1.59.17515"; - hash = "sha256-unqWaEtShJHqol0tV4ocb0nI81rWFQuv/W1i+2zMeZM="; - }; - meta = { - changelog = "https://marketplace.visualstudio.com/items/DEVSENSE.composer-php-vscode/changelog"; - description = "Visual studio code extension for full development integration for Composer, the PHP package manager"; - downloadPage = "https://marketplace.visualstudio.com/items?itemName=DEVSENSE.composer-php-vscode"; - homepage = "https://github.com/DEVSENSE/phptools-docs"; - license = lib.licenses.unfree; - maintainers = [ ]; - }; - }; - devsense.phptools-vscode = buildVscodeMarketplaceExtension { mktplcRef = let From 1b6570f5029fafcf67133f4462d5347c7ec4b39f Mon Sep 17 00:00:00 2001 From: Pol Dellaiera Date: Mon, 21 Jul 2025 18:19:12 +0200 Subject: [PATCH 26/60] vscode-extensions.devsense.phptools-vscode: drop --- .../editors/vscode/extensions/default.nix | 56 ------------------- 1 file changed, 56 deletions(-) diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix index ef16d9971c34..bc3120a9f738 100644 --- a/pkgs/applications/editors/vscode/extensions/default.nix +++ b/pkgs/applications/editors/vscode/extensions/default.nix @@ -1343,62 +1343,6 @@ let detachhead.basedpyright = callPackage ./detachhead.basedpyright { }; - devsense.phptools-vscode = buildVscodeMarketplaceExtension { - mktplcRef = - let - sources = { - "x86_64-linux" = { - arch = "linux-x64"; - hash = "sha256-8i5nRlzd+LnpEh9trWECxfiC1W4S0ekBab5vo18OlsA="; - }; - "x86_64-darwin" = { - arch = "darwin-x64"; - sha256 = "14crw56277rdwhigabb3nsndkfcs3yzzf7gw85jvryxviq32chgy"; - }; - "aarch64-linux" = { - arch = "linux-arm64"; - sha256 = "1j1xlvbg3nrfmdd9zm6kywwicdwdkrq0si86lcndaii8m7sj5pfp"; - }; - "aarch64-darwin" = { - arch = "darwin-arm64"; - sha256 = "0nlks6iqxkx1xlicsa8lrb1319rgznlxkv2gg7wkwgzph97ik8bi"; - }; - }; - in - { - name = "phptools-vscode"; - publisher = "devsense"; - version = "1.41.14332"; - } - // sources.${stdenv.system} or (throw "Unsupported system: ${stdenv.system}"); - - nativeBuildInputs = [ autoPatchelfHook ]; - - buildInputs = [ - zlib - (lib.getLib stdenv.cc.cc) - ]; - - postInstall = '' - chmod +x $out/share/vscode/extensions/devsense.phptools-vscode/out/server/devsense.php.ls - ''; - - meta = { - changelog = "https://marketplace.visualstudio.com/items/DEVSENSE.phptools-vscode/changelog"; - description = "Visual studio code extension for full development integration for the PHP language"; - downloadPage = "https://marketplace.visualstudio.com/items?itemName=DEVSENSE.phptools-vscode"; - homepage = "https://github.com/DEVSENSE/phptools-docs"; - license = lib.licenses.unfree; - maintainers = [ ]; - platforms = [ - "x86_64-linux" - "x86_64-darwin" - "aarch64-darwin" - "aarch64-linux" - ]; - }; - }; - devsense.profiler-php-vscode = buildVscodeMarketplaceExtension { mktplcRef = { name = "profiler-php-vscode"; From 178bf08bb233b19f4509faef63a0c372b6a66ece Mon Sep 17 00:00:00 2001 From: Pol Dellaiera Date: Mon, 21 Jul 2025 18:21:21 +0200 Subject: [PATCH 27/60] vscode-extensions.devsense.profiler-php-vscode: drop --- .../editors/vscode/extensions/default.nix | 17 ----------------- 1 file changed, 17 deletions(-) diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix index bc3120a9f738..b67d40fe3f7b 100644 --- a/pkgs/applications/editors/vscode/extensions/default.nix +++ b/pkgs/applications/editors/vscode/extensions/default.nix @@ -1343,23 +1343,6 @@ let detachhead.basedpyright = callPackage ./detachhead.basedpyright { }; - devsense.profiler-php-vscode = buildVscodeMarketplaceExtension { - mktplcRef = { - name = "profiler-php-vscode"; - publisher = "devsense"; - version = "1.59.17515"; - hash = "sha256-Y2y1vpqKEOjg4eniG0myhaAkJLdEIAT1UdEdbr04MrA="; - }; - meta = { - changelog = "https://marketplace.visualstudio.com/items/DEVSENSE.profiler-php-vscode/changelog"; - description = "Visual studio code extension for PHP and XDebug profiling and inspecting"; - downloadPage = "https://marketplace.visualstudio.com/items?itemName=DEVSENSE.profiler-php-vscode"; - homepage = "https://github.com/DEVSENSE/phptools-docs"; - license = lib.licenses.unfree; - maintainers = [ ]; - }; - }; - dhall.dhall-lang = buildVscodeMarketplaceExtension { mktplcRef = { name = "dhall-lang"; From 07c441b8fee23fde28347554c71df4cb6c3e7342 Mon Sep 17 00:00:00 2001 From: Wolfgang Walther Date: Mon, 21 Jul 2025 18:36:07 +0200 Subject: [PATCH 28/60] lash: delay assert behind eval of `meta` This allows CI to evaluate `meta.platforms` to see that this package is not supported on darwin. Working around the assert before that requires much more hackery. I'm not 100% sure whether the assert is needed, but it doesn't hurt to keep it in this place. --- pkgs/by-name/la/lash/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/la/lash/package.nix b/pkgs/by-name/la/lash/package.nix index c3ec6476b2a4..b5a69b2208f0 100644 --- a/pkgs/by-name/la/lash/package.nix +++ b/pkgs/by-name/la/lash/package.nix @@ -12,8 +12,6 @@ readline, }: -assert libuuid != null; - stdenv.mkDerivation rec { pname = "lash"; version = "0.5.4"; @@ -40,7 +38,9 @@ stdenv.mkDerivation rec { libxml2 readline ]; - propagatedBuildInputs = [ libuuid ]; + propagatedBuildInputs = + assert libuuid != null; + [ libuuid ]; NIX_LDFLAGS = "-lm -lpthread -luuid"; postInstall = '' From ae9c80a004ab7a6df82c56995ff06839ab6951df Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Mon, 21 Jul 2025 19:26:45 +0200 Subject: [PATCH 29/60] python3Packages.pysilero-vad: 2.1.0 -> 2.1.1 https://github.com/rhasspy/pysilero-vad/blob/v2.1.1/CHANGELOG.md --- pkgs/development/python-modules/pysilero-vad/default.nix | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/pkgs/development/python-modules/pysilero-vad/default.nix b/pkgs/development/python-modules/pysilero-vad/default.nix index 98e2fa1b8a37..63cbc36ca3d0 100644 --- a/pkgs/development/python-modules/pysilero-vad/default.nix +++ b/pkgs/development/python-modules/pysilero-vad/default.nix @@ -17,20 +17,18 @@ buildPythonPackage rec { pname = "pysilero-vad"; - version = "2.1.0"; + version = "2.1.1"; pyproject = true; src = fetchFromGitHub { owner = "rhasspy"; repo = "pysilero-vad"; tag = "v${version}"; - hash = "sha256-h49AD3ICh0NYyh2EDogynQ0qgkKCAQTVKS9rbXbrqPE="; + hash = "sha256-zxvYvPnL99yIVHrzbRbKmTazzlefOS+s2TAWLweRSYE="; }; build-system = [ setuptools ]; - pythonRelaxDeps = [ "numpy" ]; - dependencies = [ numpy onnxruntime From 7baba2131c7667d3a0ca9a4d3f4641f8148638b5 Mon Sep 17 00:00:00 2001 From: bitbloxhub <45184892+bitbloxhub@users.noreply.github.com> Date: Mon, 21 Jul 2025 17:57:35 +0000 Subject: [PATCH 30/60] vimPlugins.fyler-nvim: init at 2025-07-21 --- pkgs/applications/editors/vim/plugins/generated.nix | 13 +++++++++++++ pkgs/applications/editors/vim/plugins/overrides.nix | 9 +++++++++ .../editors/vim/plugins/vim-plugin-names | 1 + 3 files changed, 23 insertions(+) diff --git a/pkgs/applications/editors/vim/plugins/generated.nix b/pkgs/applications/editors/vim/plugins/generated.nix index d1233299fe31..955c598468bc 100644 --- a/pkgs/applications/editors/vim/plugins/generated.nix +++ b/pkgs/applications/editors/vim/plugins/generated.nix @@ -5243,6 +5243,19 @@ final: prev: { meta.hydraPlatforms = [ ]; }; + fyler-nvim = buildVimPlugin { + pname = "fyler.nvim"; + version = "2025-07-21"; + src = fetchFromGitHub { + owner = "A7Lavinraj"; + repo = "fyler.nvim"; + rev = "6595c9ef272797aeb92aacdc392cf670c994e467"; + sha256 = "14fbmhxw7xyg618g3pv7hq64ppcas997qvkbdnl2z0lqrk2nn3zy"; + }; + meta.homepage = "https://github.com/A7Lavinraj/fyler.nvim/"; + meta.hydraPlatforms = [ ]; + }; + fzf-checkout-vim = buildVimPlugin { pname = "fzf-checkout.vim"; version = "2023-10-05"; diff --git a/pkgs/applications/editors/vim/plugins/overrides.nix b/pkgs/applications/editors/vim/plugins/overrides.nix index 9c35b2dd1eb6..49d81e85cab6 100644 --- a/pkgs/applications/editors/vim/plugins/overrides.nix +++ b/pkgs/applications/editors/vim/plugins/overrides.nix @@ -1245,6 +1245,15 @@ in ]; }; + fyler-nvim = super.fyler-nvim.overrideAttrs { + nvimSkipModules = [ + # Requires setup call + "fyler.views.explorer.init" + "fyler.views.explorer.actions" + "fyler.views.explorer.ui" + ]; + }; + fzf-checkout-vim = super.fzf-checkout-vim.overrideAttrs { # The plugin has a makefile which tries to run tests in a docker container. # This prevents it. diff --git a/pkgs/applications/editors/vim/plugins/vim-plugin-names b/pkgs/applications/editors/vim/plugins/vim-plugin-names index af8b68f2611f..330dba5b5178 100644 --- a/pkgs/applications/editors/vim/plugins/vim-plugin-names +++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names @@ -401,6 +401,7 @@ https://github.com/shumphrey/fugitive-gitlab.vim/,, https://github.com/BeneCollyridam/futhark-vim/,, https://github.com/tzachar/fuzzy.nvim/,HEAD, https://github.com/rktjmp/fwatch.nvim/,, +https://github.com/A7Lavinraj/fyler.nvim/,stable, https://github.com/stsewd/fzf-checkout.vim/,, https://github.com/monkoose/fzf-hoogle.vim/,HEAD, https://github.com/gfanto/fzf-lsp.nvim/,, From b3af68890fa08fc64b4f357a1f7938b9e8e4f5d6 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Mon, 21 Jul 2025 18:44:59 +0000 Subject: [PATCH 31/60] burpsuite: 2025.7 -> 2025.7.1 --- pkgs/by-name/bu/burpsuite/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/bu/burpsuite/package.nix b/pkgs/by-name/bu/burpsuite/package.nix index 8258329233fd..daa5acffae30 100644 --- a/pkgs/by-name/bu/burpsuite/package.nix +++ b/pkgs/by-name/bu/burpsuite/package.nix @@ -9,20 +9,20 @@ }: let - version = "2025.7"; + version = "2025.7.1"; product = if proEdition then { productName = "pro"; productDesktop = "Burp Suite Professional Edition"; - hash = "sha256-JnsaMo6QixmC1SzW6I/iX7YOZLxWaU7AlvqsZ66cPeg="; + hash = "sha256-qyTvvEEiZFtiRvPM8IcuRlzBKOO40Fe9g8l9wrsIY84="; } else { productName = "community"; productDesktop = "Burp Suite Community Edition"; - hash = "sha256-M8/Fy8yZH+WuF34IautU2fnFKOWI4/tPCzRKRIkxagY="; + hash = "sha256-y34WlQtGZNBn1StoWhQh02EHbCVxYMoOQMH4cGbviXg="; }; src = fetchurl { From 956c9fd0bf619867ad2f39f1698229ca81890a06 Mon Sep 17 00:00:00 2001 From: Gaetan Lepage Date: Mon, 21 Jul 2025 20:51:51 +0200 Subject: [PATCH 32/60] keycloak: switch to finalAttrs pattern --- pkgs/by-name/ke/keycloak/package.nix | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/pkgs/by-name/ke/keycloak/package.nix b/pkgs/by-name/ke/keycloak/package.nix index ed999f096682..03efe7f933fa 100644 --- a/pkgs/by-name/ke/keycloak/package.nix +++ b/pkgs/by-name/ke/keycloak/package.nix @@ -1,6 +1,6 @@ { - stdenv, lib, + stdenv, fetchzip, makeWrapper, jre_headless, @@ -22,12 +22,12 @@ let ) "--features-disabled=${lib.concatStringsSep "," disabledFeatures}"} ''; in -stdenv.mkDerivation rec { +stdenv.mkDerivation (finalAttrs: { pname = "keycloak"; version = "26.3.1"; src = fetchzip { - url = "https://github.com/keycloak/keycloak/releases/download/${version}/keycloak-${version}.zip"; + url = "https://github.com/keycloak/keycloak/releases/download/${finalAttrs.version}/keycloak-${finalAttrs.version}.zip"; hash = "sha256-M3YbS/aK9y4N2kZrm1wNT1ZaWAaUwaRn9QQ8fMdOV5g="; }; @@ -104,5 +104,4 @@ stdenv.mkDerivation rec { leona ]; }; - -} +}) From 0febbb4ff90f2bf7637567214b0bbf1de43ba461 Mon Sep 17 00:00:00 2001 From: Wolfgang Walther Date: Mon, 21 Jul 2025 20:11:42 +0200 Subject: [PATCH 33/60] linux: remove assert on linux Asserting the hostplatform for `linux` is bad, because it can't be caught by CI. For the `linux` package itself, it doesn't make a difference, because it also has `meta.platforms = linux` set, so this will fail evaluation - and in a way that can nicely be caught by CI. --- pkgs/os-specific/linux/kernel/generic.nix | 2 -- pkgs/os-specific/linux/ply/default.nix | 1 + pkgs/test/nixos-functions/default.nix | 22 +++++++++++----------- 3 files changed, 12 insertions(+), 13 deletions(-) diff --git a/pkgs/os-specific/linux/kernel/generic.nix b/pkgs/os-specific/linux/kernel/generic.nix index 50c5d9683760..71673921d238 100644 --- a/pkgs/os-specific/linux/kernel/generic.nix +++ b/pkgs/os-specific/linux/kernel/generic.nix @@ -94,8 +94,6 @@ let # cgit) that are needed here should be included directly in Nixpkgs as # files. - assert stdenv.hostPlatform.isLinux; - let # Dirty hack to make sure that `version` & `src` have # `` as position diff --git a/pkgs/os-specific/linux/ply/default.nix b/pkgs/os-specific/linux/ply/default.nix index 3e1dfa296706..53d3553afc0a 100644 --- a/pkgs/os-specific/linux/ply/default.nix +++ b/pkgs/os-specific/linux/ply/default.nix @@ -55,5 +55,6 @@ stdenv.mkDerivation rec { mic92 mbbx6spp ]; + platforms = lib.platforms.linux; }; } diff --git a/pkgs/test/nixos-functions/default.nix b/pkgs/test/nixos-functions/default.nix index dc8e0b3ead31..4cc738cfaebe 100644 --- a/pkgs/test/nixos-functions/default.nix +++ b/pkgs/test/nixos-functions/default.nix @@ -21,14 +21,14 @@ let label = "test"; }; in -pkgs.recurseIntoAttrs { - - nixos-test = - (pkgs.nixos { - system.nixos = dummyVersioning; - boot.loader.grub.enable = false; - fileSystems."/".device = "/dev/null"; - system.stateVersion = lib.trivial.release; - }).toplevel; - -} +lib.optionalAttrs (stdenv.hostPlatform.isLinux) ( + pkgs.recurseIntoAttrs { + nixos-test = + (pkgs.nixos { + system.nixos = dummyVersioning; + boot.loader.grub.enable = false; + fileSystems."/".device = "/dev/null"; + system.stateVersion = lib.trivial.release; + }).toplevel; + } +) From 54f2140b6afc6b5bf950b9fca24370a6ebb0ea2c Mon Sep 17 00:00:00 2001 From: Mahyar Mirrashed Date: Sun, 20 Jul 2025 16:24:56 -0500 Subject: [PATCH 34/60] teams/infisical: remove mahyarmirrashed --- maintainers/team-list.nix | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/maintainers/team-list.nix b/maintainers/team-list.nix index 33c7131798c3..8e1dac52dfd2 100644 --- a/maintainers/team-list.nix +++ b/maintainers/team-list.nix @@ -593,10 +593,7 @@ with lib.maintainers; }; infisical = { - members = [ - akhilmhdh - mahyarmirrashed - ]; + members = [ akhilmhdh ]; scope = "Maintain Infisical"; shortName = "Infisical"; }; From cc3be1a4e92425f303ac55a61a2f78e6972cb891 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Mon, 21 Jul 2025 23:25:36 +0000 Subject: [PATCH 35/60] linuxKernel.kernels.linux_lqx: 6.15.6 -> 6.15.7 --- pkgs/os-specific/linux/kernel/zen-kernels.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/os-specific/linux/kernel/zen-kernels.nix b/pkgs/os-specific/linux/kernel/zen-kernels.nix index 49522576d3d3..3bafacbb61bc 100644 --- a/pkgs/os-specific/linux/kernel/zen-kernels.nix +++ b/pkgs/os-specific/linux/kernel/zen-kernels.nix @@ -23,9 +23,9 @@ let }; # ./update-zen.py lqx lqx = { - version = "6.15.6"; # lqx + version = "6.15.7"; # lqx suffix = "lqx1"; # lqx - sha256 = "092yz6r6wzkafr0rafb1qdapghjwr33dlx3id5jn03jkq4g8jgmd"; # lqx + sha256 = "05pr17hqrlf4jfw3fxja9n0lfs4piy03fh4wqjhbd601sjif6akh"; # lqx isLqx = true; }; }; From 0f9fec43ab1ae92bb7776fe8b369768f1a18ca43 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Tue, 22 Jul 2025 01:53:55 +0000 Subject: [PATCH 36/60] python3Packages.sagemaker-core: 1.0.42 -> 1.0.45 --- pkgs/development/python-modules/sagemaker-core/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/python-modules/sagemaker-core/default.nix b/pkgs/development/python-modules/sagemaker-core/default.nix index af289bac323c..0ee3b625525d 100644 --- a/pkgs/development/python-modules/sagemaker-core/default.nix +++ b/pkgs/development/python-modules/sagemaker-core/default.nix @@ -28,14 +28,14 @@ buildPythonPackage rec { pname = "sagemaker-core"; - version = "1.0.42"; + version = "1.0.45"; pyproject = true; src = fetchFromGitHub { owner = "aws"; repo = "sagemaker-core"; tag = "v${version}"; - hash = "sha256-To4VjTuE9fkVQSXR1k6NMAjrByzFhAidvui8w+etOQc="; + hash = "sha256-/NXSuDQAhRQ5RuYV1Eaat0TjMzqj1IYp3LECmTISoK8="; }; build-system = [ From 82ae5ca2e0f42aec44a11985da3746b394c08d92 Mon Sep 17 00:00:00 2001 From: Ilan Joselevich Date: Tue, 22 Jul 2025 05:12:39 +0300 Subject: [PATCH 37/60] home-assistant-custom-components.roborock_custom_map: init at 0.1.1 --- .../roborock_custom_map/package.nix | 25 +++++++++++++++++++ 1 file changed, 25 insertions(+) create mode 100644 pkgs/servers/home-assistant/custom-components/roborock_custom_map/package.nix diff --git a/pkgs/servers/home-assistant/custom-components/roborock_custom_map/package.nix b/pkgs/servers/home-assistant/custom-components/roborock_custom_map/package.nix new file mode 100644 index 000000000000..82da77373fa5 --- /dev/null +++ b/pkgs/servers/home-assistant/custom-components/roborock_custom_map/package.nix @@ -0,0 +1,25 @@ +{ + lib, + buildHomeAssistantComponent, + fetchFromGitHub, +}: + +buildHomeAssistantComponent rec { + owner = "Lash-L"; + domain = "roborock_custom_map"; + version = "0.1.1"; + + src = fetchFromGitHub { + owner = "Lash-L"; + repo = "RoborockCustomMap"; + tag = version; + hash = "sha256-ZKaUTUTN0tTW8bks0TYixfmbEa7A7ERdJ+xZ365HEbU="; + }; + + meta = { + description = "This allows you to use the core Roborock integration with the Xiaomi Map Card"; + homepage = "https://github.com/Lash-L/RoborockCustomMap"; + license = lib.licenses.mit; + maintainers = with lib.maintainers; [ kranzes ]; + }; +} From c9e7ea0cee7f278a27c6deece8d3e11cfc13c488 Mon Sep 17 00:00:00 2001 From: Sizhe Zhao Date: Tue, 22 Jul 2025 11:02:49 +0800 Subject: [PATCH 38/60] misskey: 2025.6.3 -> 2025.7.0 --- pkgs/by-name/mi/misskey/package.nix | 19 +- pkgs/by-name/mi/misskey/pnpm-lock.yaml.patch | 270 +++++++++++++++++++ 2 files changed, 284 insertions(+), 5 deletions(-) create mode 100644 pkgs/by-name/mi/misskey/pnpm-lock.yaml.patch diff --git a/pkgs/by-name/mi/misskey/package.nix b/pkgs/by-name/mi/misskey/package.nix index e840b4491f51..8f96f1353067 100644 --- a/pkgs/by-name/mi/misskey/package.nix +++ b/pkgs/by-name/mi/misskey/package.nix @@ -17,16 +17,20 @@ stdenv.mkDerivation (finalAttrs: { pname = "misskey"; - version = "2025.6.3"; + version = "2025.7.0"; src = fetchFromGitHub { owner = "misskey-dev"; repo = "misskey"; tag = finalAttrs.version; - hash = "sha256-6UZcIZlfcYcQgjR/jrNhsoLNQGml2tjK3LYLI0fdgMU="; + hash = "sha256-LtBggq60buNPnGPSbh+TcFODxCoqX+rFdX0P7dYMYI0="; fetchSubmodules = true; }; + patches = [ + ./pnpm-lock.yaml.patch + ]; + nativeBuildInputs = [ nodejs pnpm_9.configHook @@ -36,9 +40,14 @@ stdenv.mkDerivation (finalAttrs: { # https://nixos.org/manual/nixpkgs/unstable/#javascript-pnpm pnpmDeps = pnpm_9.fetchDeps { - inherit (finalAttrs) pname version src; - fetcherVersion = 1; - hash = "sha256-T8LwpEjeWNmkIo3Dn1BCFHBsTzA/Dt6/pk/NMtvT0N4="; + inherit (finalAttrs) + pname + version + src + patches + ; + fetcherVersion = 2; + hash = "sha256-5yuM56sLDSo4M5PDl3gUZOdSexW1YjfYBR3BJMqNHzU="; }; buildPhase = '' diff --git a/pkgs/by-name/mi/misskey/pnpm-lock.yaml.patch b/pkgs/by-name/mi/misskey/pnpm-lock.yaml.patch new file mode 100644 index 000000000000..a3db65c7e052 --- /dev/null +++ b/pkgs/by-name/mi/misskey/pnpm-lock.yaml.patch @@ -0,0 +1,270 @@ +--- a/pnpm-lock.yaml ++++ b/pnpm-lock.yaml +@@ -11,7 +11,7 @@ + + patchedDependencies: + typeorm: +- hash: 2677b97a423e157945c154e64183d3ae2eb44dfa9cb0e5ce731a7612f507bb56 ++ hash: i7ls76affxbomopkwkccq5jvsu + path: patches/typeorm.patch + + importers: +@@ -51,6 +51,10 @@ + typescript: + specifier: 5.8.3 + version: 5.8.3 ++ optionalDependencies: ++ '@tensorflow/tfjs-core': ++ specifier: 4.22.0 ++ version: 4.22.0(encoding@0.1.13) + devDependencies: + '@misskey-dev/eslint-plugin': + specifier: 2.1.0 +@@ -85,10 +89,6 @@ + start-server-and-test: + specifier: 2.0.12 + version: 2.0.12 +- optionalDependencies: +- '@tensorflow/tfjs-core': +- specifier: 4.22.0 +- version: 4.22.0(encoding@0.1.13) + + packages/backend: + dependencies: +@@ -427,7 +427,7 @@ + version: 4.2.0 + typeorm: + specifier: 0.3.24 +- version: 0.3.24(patch_hash=2677b97a423e157945c154e64183d3ae2eb44dfa9cb0e5ce731a7612f507bb56)(ioredis@5.6.1)(pg@8.16.0)(reflect-metadata@0.2.2) ++ version: 0.3.24(patch_hash=i7ls76affxbomopkwkccq5jvsu)(ioredis@5.6.1)(pg@8.16.0)(reflect-metadata@0.2.2) + typescript: + specifier: 5.8.3 + version: 5.8.3 +@@ -446,6 +446,94 @@ + xev: + specifier: 3.0.2 + version: 3.0.2 ++ optionalDependencies: ++ '@swc/core-android-arm64': ++ specifier: 1.3.11 ++ version: 1.3.11 ++ '@swc/core-darwin-arm64': ++ specifier: 1.12.0 ++ version: 1.12.0 ++ '@swc/core-darwin-x64': ++ specifier: 1.12.0 ++ version: 1.12.0 ++ '@swc/core-freebsd-x64': ++ specifier: 1.3.11 ++ version: 1.3.11 ++ '@swc/core-linux-arm-gnueabihf': ++ specifier: 1.12.0 ++ version: 1.12.0 ++ '@swc/core-linux-arm64-gnu': ++ specifier: 1.12.0 ++ version: 1.12.0 ++ '@swc/core-linux-arm64-musl': ++ specifier: 1.12.0 ++ version: 1.12.0 ++ '@swc/core-linux-x64-gnu': ++ specifier: 1.12.0 ++ version: 1.12.0 ++ '@swc/core-linux-x64-musl': ++ specifier: 1.12.0 ++ version: 1.12.0 ++ '@swc/core-win32-arm64-msvc': ++ specifier: 1.12.0 ++ version: 1.12.0 ++ '@swc/core-win32-ia32-msvc': ++ specifier: 1.12.0 ++ version: 1.12.0 ++ '@swc/core-win32-x64-msvc': ++ specifier: 1.12.0 ++ version: 1.12.0 ++ '@tensorflow/tfjs': ++ specifier: 4.22.0 ++ version: 4.22.0(encoding@0.1.13)(seedrandom@3.0.5) ++ '@tensorflow/tfjs-node': ++ specifier: 4.22.0 ++ version: 4.22.0(encoding@0.1.13)(seedrandom@3.0.5) ++ bufferutil: ++ specifier: 4.0.9 ++ version: 4.0.9 ++ slacc-android-arm-eabi: ++ specifier: 0.0.10 ++ version: 0.0.10 ++ slacc-android-arm64: ++ specifier: 0.0.10 ++ version: 0.0.10 ++ slacc-darwin-arm64: ++ specifier: 0.0.10 ++ version: 0.0.10 ++ slacc-darwin-universal: ++ specifier: 0.0.10 ++ version: 0.0.10 ++ slacc-darwin-x64: ++ specifier: 0.0.10 ++ version: 0.0.10 ++ slacc-freebsd-x64: ++ specifier: 0.0.10 ++ version: 0.0.10 ++ slacc-linux-arm-gnueabihf: ++ specifier: 0.0.10 ++ version: 0.0.10 ++ slacc-linux-arm64-gnu: ++ specifier: 0.0.10 ++ version: 0.0.10 ++ slacc-linux-arm64-musl: ++ specifier: 0.0.10 ++ version: 0.0.10 ++ slacc-linux-x64-gnu: ++ specifier: 0.0.10 ++ version: 0.0.10 ++ slacc-linux-x64-musl: ++ specifier: 0.0.10 ++ version: 0.0.10 ++ slacc-win32-arm64-msvc: ++ specifier: 0.0.10 ++ version: 0.0.10 ++ slacc-win32-x64-msvc: ++ specifier: 0.0.10 ++ version: 0.0.10 ++ utf-8-validate: ++ specifier: 6.0.5 ++ version: 6.0.5 + devDependencies: + '@jest/globals': + specifier: 29.7.0 +@@ -612,94 +700,6 @@ + supertest: + specifier: 7.1.1 + version: 7.1.1 +- optionalDependencies: +- '@swc/core-android-arm64': +- specifier: 1.3.11 +- version: 1.3.11 +- '@swc/core-darwin-arm64': +- specifier: 1.12.0 +- version: 1.12.0 +- '@swc/core-darwin-x64': +- specifier: 1.12.0 +- version: 1.12.0 +- '@swc/core-freebsd-x64': +- specifier: 1.3.11 +- version: 1.3.11 +- '@swc/core-linux-arm-gnueabihf': +- specifier: 1.12.0 +- version: 1.12.0 +- '@swc/core-linux-arm64-gnu': +- specifier: 1.12.0 +- version: 1.12.0 +- '@swc/core-linux-arm64-musl': +- specifier: 1.12.0 +- version: 1.12.0 +- '@swc/core-linux-x64-gnu': +- specifier: 1.12.0 +- version: 1.12.0 +- '@swc/core-linux-x64-musl': +- specifier: 1.12.0 +- version: 1.12.0 +- '@swc/core-win32-arm64-msvc': +- specifier: 1.12.0 +- version: 1.12.0 +- '@swc/core-win32-ia32-msvc': +- specifier: 1.12.0 +- version: 1.12.0 +- '@swc/core-win32-x64-msvc': +- specifier: 1.12.0 +- version: 1.12.0 +- '@tensorflow/tfjs': +- specifier: 4.22.0 +- version: 4.22.0(encoding@0.1.13)(seedrandom@3.0.5) +- '@tensorflow/tfjs-node': +- specifier: 4.22.0 +- version: 4.22.0(encoding@0.1.13)(seedrandom@3.0.5) +- bufferutil: +- specifier: 4.0.9 +- version: 4.0.9 +- slacc-android-arm-eabi: +- specifier: 0.0.10 +- version: 0.0.10 +- slacc-android-arm64: +- specifier: 0.0.10 +- version: 0.0.10 +- slacc-darwin-arm64: +- specifier: 0.0.10 +- version: 0.0.10 +- slacc-darwin-universal: +- specifier: 0.0.10 +- version: 0.0.10 +- slacc-darwin-x64: +- specifier: 0.0.10 +- version: 0.0.10 +- slacc-freebsd-x64: +- specifier: 0.0.10 +- version: 0.0.10 +- slacc-linux-arm-gnueabihf: +- specifier: 0.0.10 +- version: 0.0.10 +- slacc-linux-arm64-gnu: +- specifier: 0.0.10 +- version: 0.0.10 +- slacc-linux-arm64-musl: +- specifier: 0.0.10 +- version: 0.0.10 +- slacc-linux-x64-gnu: +- specifier: 0.0.10 +- version: 0.0.10 +- slacc-linux-x64-musl: +- specifier: 0.0.10 +- version: 0.0.10 +- slacc-win32-arm64-msvc: +- specifier: 0.0.10 +- version: 0.0.10 +- slacc-win32-x64-msvc: +- specifier: 0.0.10 +- version: 0.0.10 +- utf-8-validate: +- specifier: 6.0.5 +- version: 6.0.5 + + packages/frontend: + dependencies: +@@ -11221,8 +11221,8 @@ + vue-component-type-helpers@2.2.12: + resolution: {integrity: sha512-YbGqHZ5/eW4SnkPNR44mKVc6ZKQoRs/Rux1sxC6rdwXb4qpbOSYfDr9DsTHolOTGmIKgM9j141mZbBeg05R1pw==} + +- vue-component-type-helpers@3.0.1: +- resolution: {integrity: sha512-j23mCB5iEbGsyIhnVdXdWUOg+UdwmVxpKnYYf2j+4ppCt5VSFXKjwu9YFt0QYxUaf5G99PuHsVfRScjHCRSsGQ==} ++ vue-component-type-helpers@3.0.3: ++ resolution: {integrity: sha512-koiBu7lO8e6w/UlbZAAIW11qcFQocYIl7Nh/SVwGZ804ej5KrncU32bRxi2zfU2Kyf6HWuk1CeeVP2rhIL+vyQ==} + + vue-demi@0.14.7: + resolution: {integrity: sha512-EOG8KXDQNwkJILkx/gPcoL/7vH+hORoBaKgGe+6W7VFMvCYJfmF2dGbvgDroVnI8LU7/kTu8mbjRZGBU1z9NTA==} +@@ -14955,7 +14955,7 @@ + ts-dedent: 2.2.0 + type-fest: 2.19.0 + vue: 3.5.17(typescript@5.8.3) +- vue-component-type-helpers: 3.0.1 ++ vue-component-type-helpers: 3.0.3 + + '@stylistic/eslint-plugin@2.13.0(eslint@9.31.0)(typescript@5.8.3)': + dependencies: +@@ -23034,7 +23034,7 @@ + + typedarray@0.0.6: {} + +- typeorm@0.3.24(patch_hash=2677b97a423e157945c154e64183d3ae2eb44dfa9cb0e5ce731a7612f507bb56)(ioredis@5.6.1)(pg@8.16.0)(reflect-metadata@0.2.2): ++ typeorm@0.3.24(patch_hash=i7ls76affxbomopkwkccq5jvsu)(ioredis@5.6.1)(pg@8.16.0)(reflect-metadata@0.2.2): + dependencies: + '@sqltools/formatter': 1.2.5 + ansis: 3.17.0 +@@ -23371,7 +23371,7 @@ + + vue-component-type-helpers@2.2.12: {} + +- vue-component-type-helpers@3.0.1: {} ++ vue-component-type-helpers@3.0.3: {} + + vue-demi@0.14.7(vue@3.5.17(typescript@5.8.3)): + dependencies: From 84d174e312870ccefb9ba0dd11532bb2a58773db Mon Sep 17 00:00:00 2001 From: nuko Date: Sun, 26 May 2024 17:17:55 +1200 Subject: [PATCH 39/60] nixos/qbittorrent: init service module nixos/qbittorrent: add default serverConfig & fix test Migrate to runTest Replace lib.optional with lib.optionals nixos/qbittorrent: update release notes to 2511 --- .../manual/release-notes/rl-2511.section.md | 2 + nixos/modules/module-list.nix | 1 + .../modules/services/torrent/qbittorrent.nix | 238 ++++++++++++++++++ nixos/tests/all-tests.nix | 1 + nixos/tests/qbittorrent.nix | 190 ++++++++++++++ pkgs/by-name/qb/qbittorrent/package.nix | 6 +- 6 files changed, 437 insertions(+), 1 deletion(-) create mode 100644 nixos/modules/services/torrent/qbittorrent.nix create mode 100644 nixos/tests/qbittorrent.nix diff --git a/nixos/doc/manual/release-notes/rl-2511.section.md b/nixos/doc/manual/release-notes/rl-2511.section.md index 1d63a51ce567..bde1d5e7f3bb 100644 --- a/nixos/doc/manual/release-notes/rl-2511.section.md +++ b/nixos/doc/manual/release-notes/rl-2511.section.md @@ -48,6 +48,8 @@ - [Newt](https://github.com/fosrl/newt), a fully user space WireGuard tunnel client and TCP/UDP proxy, designed to securely expose private resources controlled by Pangolin. Available as [services.newt](options.html#opt-services.newt.enable). +- [qBittorrent](https://www.qbittorrent.org/), is a bittorrent client programmed in C++ / Qt that uses libtorrent by Arvid Norberg. Available as [services.qbittorrent](#opt-services.qbittorrent.enable). + - [Szurubooru](https://github.com/rr-/szurubooru), an image board engine inspired by services such as Danbooru, dedicated for small and medium communities. Available as [services.szurubooru](#opt-services.szurubooru.enable). - The [Neat IP Address Planner](https://spritelink.github.io/NIPAP/) (NIPAP) can now be enabled through [services.nipap.enable](#opt-services.nipap.enable). diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix index e2e04222383f..341d99e006fc 100644 --- a/nixos/modules/module-list.nix +++ b/nixos/modules/module-list.nix @@ -1498,6 +1498,7 @@ ./services/torrent/magnetico.nix ./services/torrent/opentracker.nix ./services/torrent/peerflix.nix + ./services/torrent/qbittorrent.nix ./services/torrent/rtorrent.nix ./services/torrent/torrentstream.nix ./services/torrent/transmission.nix diff --git a/nixos/modules/services/torrent/qbittorrent.nix b/nixos/modules/services/torrent/qbittorrent.nix new file mode 100644 index 000000000000..f62750a02361 --- /dev/null +++ b/nixos/modules/services/torrent/qbittorrent.nix @@ -0,0 +1,238 @@ +{ + config, + pkgs, + lib, + utils, + ... +}: +let + cfg = config.services.qbittorrent; + inherit (builtins) concatStringsSep isAttrs isString; + inherit (lib) + literalExpression + getExe + mkEnableOption + mkOption + mkPackageOption + mkIf + maintainers + escape + collect + mapAttrsRecursive + optionals + ; + inherit (lib.types) + str + port + path + nullOr + listOf + attrsOf + anything + submodule + ; + inherit (lib.generators) toINI mkKeyValueDefault mkValueStringDefault; + gendeepINI = toINI { + mkKeyValue = + let + sep = "="; + in + k: v: + if isAttrs v then + concatStringsSep "\n" ( + collect isString ( + mapAttrsRecursive ( + path: value: + "${escape [ sep ] (concatStringsSep "\\" ([ k ] ++ path))}${sep}${mkValueStringDefault { } value}" + ) v + ) + ) + else + mkKeyValueDefault { } sep k v; + }; + configFile = pkgs.writeText "qBittorrent.conf" (gendeepINI cfg.serverConfig); +in +{ + options.services.qbittorrent = { + enable = mkEnableOption "qbittorrent, BitTorrent client"; + + package = mkPackageOption pkgs "qbittorrent-nox" { }; + + user = mkOption { + type = str; + default = "qbittorrent"; + description = "User account under which qbittorrent runs."; + }; + + group = mkOption { + type = str; + default = "qbittorrent"; + description = "Group under which qbittorrent runs."; + }; + + profileDir = mkOption { + type = path; + default = "/var/lib/qBittorrent/"; + description = "the path passed to qbittorrent via --profile."; + }; + + openFirewall = mkEnableOption "opening both the webuiPort and torrentPort over TCP in the firewall"; + + webuiPort = mkOption { + default = 8080; + type = nullOr port; + description = "the port passed to qbittorrent via `--webui-port`"; + }; + + torrentingPort = mkOption { + default = null; + type = nullOr port; + description = "the port passed to qbittorrent via `--torrenting-port`"; + }; + + serverConfig = mkOption { + default = { }; + type = submodule { + freeformType = attrsOf (attrsOf anything); + }; + description = '' + Free-form settings mapped to the `qBittorrent.conf` file in the profile. + Refer to [Explanation-of-Options-in-qBittorrent](https://github.com/qbittorrent/qBittorrent/wiki/Explanation-of-Options-in-qBittorrent). + The Password_PBKDF2 format is oddly unique, you will likely want to use [this tool](https://codeberg.org/feathecutie/qbittorrent_password) to generate the format. + Alternatively you can run qBittorrent independently first and use its webUI to generate the format. + + Optionally an alternative webUI can be easily set. VueTorrent for example: + ```nix + { + Preferences = { + WebUI = { + AlternativeUIEnabled = true; + RootFolder = "''${pkgs.vuetorrent}/share/vuetorrent"; + }; + }; + } + ]; + ``` + ''; + example = literalExpression '' + { + LegalNotice.Accepted = true; + Preferences = { + WebUI = { + Username = "user"; + Password_PBKDF2 = "generated ByteArray."; + }; + General.Locale = "en"; + }; + } + ''; + }; + + extraArgs = mkOption { + type = listOf str; + default = [ ]; + description = '' + Extra arguments passed to qbittorrent. See `qbittorrent -h`, or the [source code](https://github.com/qbittorrent/qBittorrent/blob/master/src/app/cmdoptions.cpp), for the available arguments. + ''; + example = [ + "--confirm-legal-notice" + ]; + }; + }; + config = mkIf cfg.enable { + systemd = { + tmpfiles.settings = { + qbittorrent = { + "${cfg.profileDir}/qBittorrent/"."d" = { + mode = "755"; + inherit (cfg) user group; + }; + "${cfg.profileDir}/qBittorrent/config/"."d" = { + mode = "755"; + inherit (cfg) user group; + }; + "${cfg.profileDir}/qBittorrent/config/qBittorrent.conf"."L+" = mkIf (cfg.serverConfig != { }) { + mode = "1400"; + inherit (cfg) user group; + argument = "${configFile}"; + }; + }; + }; + services.qbittorrent = { + description = "qbittorrent BitTorrent client"; + wants = [ "network-online.target" ]; + after = [ + "local-fs.target" + "network-online.target" + "nss-lookup.target" + ]; + wantedBy = [ "multi-user.target" ]; + restartTriggers = optionals (cfg.serverConfig != { }) [ configFile ]; + + serviceConfig = { + Type = "simple"; + User = cfg.user; + Group = cfg.group; + ExecStart = utils.escapeSystemdExecArgs ( + [ + (getExe cfg.package) + "--profile=${cfg.profileDir}" + ] + ++ optionals (cfg.webuiPort != null) [ "--webui-port=${toString cfg.webuiPort}" ] + ++ optionals (cfg.torrentingPort != null) [ "--torrenting-port=${toString cfg.torrentingPort}" ] + ++ cfg.extraArgs + ); + TimeoutStopSec = 1800; + + # https://github.com/qbittorrent/qBittorrent/pull/6806#discussion_r121478661 + PrivateTmp = false; + + PrivateNetwork = false; + RemoveIPC = true; + NoNewPrivileges = true; + PrivateDevices = true; + PrivateUsers = true; + ProtectHome = "yes"; + ProtectProc = "invisible"; + ProcSubset = "pid"; + ProtectSystem = "full"; + ProtectClock = true; + ProtectHostname = true; + ProtectKernelLogs = true; + ProtectKernelModules = true; + ProtectKernelTunables = true; + ProtectControlGroups = true; + RestrictAddressFamilies = [ + "AF_INET" + "AF_INET6" + "AF_NETLINK" + ]; + RestrictNamespaces = true; + RestrictRealtime = true; + RestrictSUIDSGID = true; + LockPersonality = true; + MemoryDenyWriteExecute = true; + SystemCallArchitectures = "native"; + CapabilityBoundingSet = ""; + SystemCallFilter = [ "@system-service" ]; + }; + }; + }; + + users = { + users = mkIf (cfg.user == "qbittorrent") { + qbittorrent = { + inherit (cfg) group; + isSystemUser = true; + }; + }; + groups = mkIf (cfg.group == "qbittorrent") { qbittorrent = { }; }; + }; + + networking.firewall.allowedTCPPorts = mkIf cfg.openFirewall ( + optionals (cfg.webuiPort != null) [ cfg.webuiPort ] + ++ optionals (cfg.torrentingPort != null) [ cfg.torrentingPort ] + ); + }; + meta.maintainers = with maintainers; [ fsnkty ]; +} diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix index 07ddbf27b7d8..a08434d3f454 100644 --- a/nixos/tests/all-tests.nix +++ b/nixos/tests/all-tests.nix @@ -1220,6 +1220,7 @@ in public-inbox = runTest ./public-inbox.nix; pufferpanel = runTest ./pufferpanel.nix; pulseaudio = discoverTests (import ./pulseaudio.nix); + qbittorrent = runTest ./qbittorrent.nix; qboot = handleTestOn [ "x86_64-linux" "i686-linux" ] ./qboot.nix { }; qemu-vm-restrictnetwork = handleTest ./qemu-vm-restrictnetwork.nix { }; qemu-vm-volatile-root = runTest ./qemu-vm-volatile-root.nix; diff --git a/nixos/tests/qbittorrent.nix b/nixos/tests/qbittorrent.nix new file mode 100644 index 000000000000..e7bafbef0631 --- /dev/null +++ b/nixos/tests/qbittorrent.nix @@ -0,0 +1,190 @@ +{ pkgs, lib, ... }: +{ + name = "qbittorrent"; + + meta = with pkgs.lib.maintainers; { + maintainers = [ fsnkty ]; + }; + + nodes = { + simple = { + services.qbittorrent.enable = true; + + specialisation.portChange.configuration = { + services.qbittorrent = { + enable = true; + webuiPort = 5555; + torrentingPort = 44444; + }; + }; + + specialisation.openPorts.configuration = { + services.qbittorrent = { + enable = true; + openFirewall = true; + webuiPort = 8080; + torrentingPort = 55555; + }; + }; + + specialisation.serverConfig.configuration = { + services.qbittorrent = { + enable = true; + webuiPort = null; + serverConfig.Preferences.WebUI.Port = "8181"; + }; + }; + }; + # Seperate vm because it's not possible to reboot into a specialisation with + # switch-to-configuration: https://github.com/NixOS/nixpkgs/issues/82851 + # For one of the test we check if manual changes are overridden during + # reboot, therefore it's necessary to reboot into a declarative setup. + declarative = { + services.qbittorrent = { + enable = true; + webuiPort = null; + serverConfig = { + Preferences = { + WebUI = { + Username = "user"; + # Default password: adminadmin + Password_PBKDF2 = "@ByteArray(6DIf26VOpTCYbgNiO6DAFQ==:e6241eaAWGzRotQZvVA5/up9fj5wwSAThLgXI2lVMsYTu1StUgX9MgmElU3Sa/M8fs+zqwZv9URiUOObjqJGNw==)"; + Port = lib.mkDefault "8181"; + }; + }; + }; + }; + + specialisation.serverConfigChange.configuration = { + services.qbittorrent = { + enable = true; + webuiPort = null; + serverConfig.Preferences.WebUI.Port = "7171"; + }; + }; + }; + }; + + testScript = + { nodes, ... }: + let + simpleSpecPath = "${nodes.simple.system.build.toplevel}/specialisation"; + declarativeSpecPath = "${nodes.declarative.system.build.toplevel}/specialisation"; + portChange = "${simpleSpecPath}/portChange"; + openPorts = "${simpleSpecPath}/openPorts"; + serverConfig = "${simpleSpecPath}/serverConfig"; + serverConfigChange = "${declarativeSpecPath}/serverConfigChange"; + in + '' + simple.start(allow_reboot=True) + declarative.start(allow_reboot=True) + + + def test_webui(machine, port): + machine.wait_for_unit("qbittorrent.service") + machine.wait_for_open_port(port) + machine.wait_until_succeeds(f"curl --fail http://localhost:{port}") + + + # To simulate an interactive change in the settings + def setPreferences_api(machine, port, post_creds, post_data): + qb_url = f"http://localhost:{port}" + api_url = f"{qb_url}/api/v2" + cookie_path = "/tmp/qbittorrent.cookie" + + machine.succeed( + f'curl --header "Referer: {qb_url}" \ + --data "{post_creds}" {api_url}/auth/login \ + -c {cookie_path}' + ) + machine.succeed( + f'curl --header "Referer: {qb_url}" \ + --data "{post_data}" {api_url}/app/setPreferences \ + -b {cookie_path}' + ) + + + # A randomly generated password is printed in the service log when no + # password it set + def get_temp_pass(machine): + _, password = machine.execute( + "journalctl -u qbittorrent.service |\ + grep 'The WebUI administrator password was not set.' |\ + awk '{ print $NF }' | tr -d '\n'" + ) + return password + + + # Non declarative tests + + with subtest("webui works with all default settings"): + test_webui(simple, 8080) + + with subtest("check if manual changes in settings are saved correctly"): + temp_pass = get_temp_pass(simple) + + ## Change some settings + api_post = [r"json={\"listen_port\": 33333}", r"json={\"web_ui_port\": 9090}"] + for x in api_post: + setPreferences_api( + machine=simple, + port=8080, + post_creds=f"username=admin&password={temp_pass}", + post_data=x, + ) + + simple.wait_for_open_port(33333) + test_webui(simple, 9090) + + ## Test which settings are reset + ## As webuiPort is passed as an cli it should reset after reboot + ## As torrentingPort is not passed as an cli it should not reset after + ## reboot + simple.reboot() + test_webui(simple, 8080) + simple.wait_for_open_port(33333) + + with subtest("ports are changed on config change"): + simple.succeed("${portChange}/bin/switch-to-configuration test") + test_webui(simple, 5555) + simple.wait_for_open_port(44444) + + with subtest("firewall is opened correctly"): + simple.succeed("${openPorts}/bin/switch-to-configuration test") + test_webui(simple, 8080) + declarative.wait_until_succeeds("curl --fail http://simple:8080") + declarative.wait_for_open_port(55555, "simple") + + with subtest("switching from simple to declarative works"): + simple.succeed("${serverConfig}/bin/switch-to-configuration test") + test_webui(simple, 8181) + + + # Declarative tests + + with subtest("serverConfig is applied correctly"): + test_webui(declarative, 8181) + + with subtest("manual changes are overridden during reboot"): + ## Change some settings + setPreferences_api( + machine=declarative, + port=8181, # as set through serverConfig + post_creds="username=user&password=adminadmin", + post_data=r"json={\"web_ui_port\": 9191}", + ) + + test_webui(declarative, 9191) + + ## Test which settings are reset + ## The generated qBittorrent.conf is, apparently, reapplied after reboot. + ## Because the port is set in `serverConfig` this overrides the manually + ## set port. + declarative.reboot() + test_webui(declarative, 8181) + + with subtest("changes in serverConfig are applied correctly"): + declarative.succeed("${serverConfigChange}/bin/switch-to-configuration test") + test_webui(declarative, 7171) + ''; +} diff --git a/pkgs/by-name/qb/qbittorrent/package.nix b/pkgs/by-name/qb/qbittorrent/package.nix index 79a3d68990a3..ecd6148a7388 100644 --- a/pkgs/by-name/qb/qbittorrent/package.nix +++ b/pkgs/by-name/qb/qbittorrent/package.nix @@ -16,6 +16,7 @@ webuiSupport ? true, wrapGAppsHook3, zlib, + nixosTests, }: stdenv.mkDerivation (finalAttrs: { @@ -74,7 +75,10 @@ stdenv.mkDerivation (finalAttrs: { qtWrapperArgs+=("''${gappsWrapperArgs[@]}") ''; - passthru.updateScript = nix-update-script { extraArgs = [ "--version-regex=release-(.*)" ]; }; + passthru = { + updateScript = nix-update-script { extraArgs = [ "--version-regex=release-(.*)" ]; }; + tests.testService = nixosTests.qbittorrent; + }; meta = { description = "Featureful free software BitTorrent client"; From d6966c3ef22eb2bfbb4c72600fc85ad74deb7a9a Mon Sep 17 00:00:00 2001 From: Markus Hauck Date: Tue, 22 Jul 2025 08:10:25 +0200 Subject: [PATCH 40/60] haxor-news: unstable-2020-10-20 -> unstable-2022-04-22 Package was not building with error, I removed the manual package overrides and it built fine. Also updated to the most recent unstable commit afterwards. From what I tested it seems to work fine. ``` error: builder for '/nix/store/15l75w52cxc77zwdqv2w41cz0sylky0q-python3.13-prompt-toolkit-1.0.18.drv' failed with exit code 1; last 21 log lines: > Sourcing python-remove-tests-dir-hook > Sourcing python-catch-conflicts-hook.sh > Sourcing python-remove-bin-bytecode-hook.sh > Sourcing pypa-build-hook > Using pypaBuildPhase > Sourcing python-runtime-deps-check-hook > Using pythonRuntimeDepsCheckHook > Sourcing pypa-install-hook > Using pypaInstallPhase > Sourcing python-imports-check-hook.sh > Using pythonImportsCheckPhase > Sourcing python-namespaces-hook > Sourcing python-catch-conflicts-hook.sh > Sourcing pytest-check-hook > Using pytestCheckPhase > Running phase: unpackPhase > unpacking source archive /nix/store/hxiafm537za17sivpcljvqr6qlsclc8n-prompt_toolkit-1.0.18.tar.gz > source root is prompt_toolkit-1.0.18 > setting SOURCE_DATE_EPOCH to timestamp 1570133629 of file "prompt_toolkit-1.0.18/setup.cfg" > Running phase: patchPhase > substitute(): ERROR: file 'src/prompt_toolkit/__init__.py' does not exist For full logs, run: nix log /nix/store/15l75w52cxc77zwdqv2w41cz0sylky0q-python3.13-prompt-toolkit-1.0.18.drv ``` --- pkgs/by-name/ha/haxor-news/package.nix | 42 +++++--------------------- 1 file changed, 7 insertions(+), 35 deletions(-) diff --git a/pkgs/by-name/ha/haxor-news/package.nix b/pkgs/by-name/ha/haxor-news/package.nix index c0923839d41b..d57a43d20c95 100644 --- a/pkgs/by-name/ha/haxor-news/package.nix +++ b/pkgs/by-name/ha/haxor-news/package.nix @@ -2,51 +2,23 @@ lib, fetchFromGitHub, fetchPypi, - python3, + python3Packages, }: -let - py = python3.override { - self = py; - packageOverrides = self: super: { - # not compatible with prompt_toolkit >=2.0 - prompt-toolkit = super.prompt-toolkit.overridePythonAttrs (oldAttrs: rec { - name = "${oldAttrs.pname}-${version}"; - version = "1.0.18"; - src = oldAttrs.src.override { - inherit version; - hash = "sha256-3U/KAsgGlJetkxotCZFMaw0bUBUc6Ha8Fb3kx0cJASY="; - }; - }); - # Use click 7 - click = super.click.overridePythonAttrs (old: rec { - version = "7.1.2"; - src = fetchPypi { - pname = "click"; - inherit version; - hash = "sha256-0rUlXHxjSbwb0eWeCM0SrLvWPOZJ8liHVXg6qU37axo="; - }; - disabledTests = [ "test_bytes_args" ]; - }); - }; - }; -in -with py.pkgs; - -buildPythonApplication rec { +python3Packages.buildPythonApplication rec { pname = "haxor-news"; - version = "unstable-2020-10-20"; + version = "unstable-2022-04-22"; format = "setuptools"; # haven't done a stable release in 3+ years, but actively developed src = fetchFromGitHub { owner = "donnemartin"; repo = "haxor-news"; - rev = "811a5804c09406465b2b02eab638c08bf5c4fa7f"; - hash = "sha256-5v61b49ttwqPOvtoykJBBzwVSi7S8ARlakccMr12bbw="; + rev = "8294e4498858f036a344b06e82f08b834c2a8270"; + hash = "sha256-0eVk5zj7F3QDFvV0Kv9aeV1oeKxr/Kza6M3pK6hyYuY="; }; - propagatedBuildInputs = [ + propagatedBuildInputs = with python3Packages; [ click colorama requests @@ -58,7 +30,7 @@ buildPythonApplication rec { # will fail without pre-seeded config files doCheck = false; - nativeCheckInputs = [ + nativeCheckInputs = with python3Packages; [ unittestCheckHook mock ]; From 22bfcc9570a70877cfbafc38c6cba2e20356c3ca Mon Sep 17 00:00:00 2001 From: Ben Siraphob Date: Mon, 21 Jul 2025 23:22:16 -0700 Subject: [PATCH 41/60] pike: use tag --- pkgs/by-name/pi/pike/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/pi/pike/package.nix b/pkgs/by-name/pi/pike/package.nix index 421d5f95a840..ea06e6a0d499 100644 --- a/pkgs/by-name/pi/pike/package.nix +++ b/pkgs/by-name/pi/pike/package.nix @@ -120,12 +120,12 @@ let in stdenv.mkDerivation (finalAttrs: { pname = "pike"; - version = "v8.0.2020"; + version = "8.0.2020"; src = fetchFromGitHub { owner = "pikelang"; repo = "Pike"; - rev = finalAttrs.version; + tag = "v${finalAttrs.version}"; hash = "sha256-VHfMfICtvCHdFTIjiYw9tR5g9KycR7jqdg3wT+T37mA="; }; From eaf3ba463f718cca04cd996c58fcdb34f0b0231e Mon Sep 17 00:00:00 2001 From: Jost Alemann Date: Tue, 22 Jul 2025 08:22:55 +0200 Subject: [PATCH 42/60] jjui: 0.8.12 -> 0.9.0 Changelog: https://github.com/idursun/jjui/releases/tag/v0.9.0 Diff: https://github.com/idursun/jjui/compare/v0.8.12...v0.9.0 --- pkgs/by-name/jj/jjui/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/jj/jjui/package.nix b/pkgs/by-name/jj/jjui/package.nix index 0bc4a7b2e3aa..40541c059da1 100644 --- a/pkgs/by-name/jj/jjui/package.nix +++ b/pkgs/by-name/jj/jjui/package.nix @@ -7,16 +7,16 @@ }: buildGoModule (finalAttrs: { pname = "jjui"; - version = "0.8.12"; + version = "0.9.0"; src = fetchFromGitHub { owner = "idursun"; repo = "jjui"; tag = "v${finalAttrs.version}"; - hash = "sha256-KqW5XwQxKF11qWXpqhcREVZHSVqPNnJCceaW0uvgpFg="; + hash = "sha256-FTFryzlU7PsrU2SkOdxYLunVrRKUauAwmzIkJe3xKlk="; }; - vendorHash = "sha256-2nUU5rrVWBk+9ljC+OiAVLcRnWghPPfpvq5yoNSRdVk="; + vendorHash = "sha256-oswFlMuoaTHfgpr2+o8EX80hl82H9JewPFk3khm8Il4="; ldflags = [ "-X main.Version=${finalAttrs.version}" ]; From 6df8c1946dd6ded181a78e406de4e49170508a3a Mon Sep 17 00:00:00 2001 From: liberodark Date: Mon, 21 Jul 2025 13:42:18 +0200 Subject: [PATCH 43/60] trilium-next-{desktop, server}: 0.95.0 -> 0.97.1 --- pkgs/by-name/tr/trilium-next-desktop/package.nix | 16 ++++++++-------- pkgs/by-name/tr/trilium-next-desktop/update.sh | 14 +++++++------- pkgs/by-name/tr/trilium-next-server/package.nix | 10 +++++----- 3 files changed, 20 insertions(+), 20 deletions(-) diff --git a/pkgs/by-name/tr/trilium-next-desktop/package.nix b/pkgs/by-name/tr/trilium-next-desktop/package.nix index d51666362caf..292383aae9c7 100644 --- a/pkgs/by-name/tr/trilium-next-desktop/package.nix +++ b/pkgs/by-name/tr/trilium-next-desktop/package.nix @@ -5,7 +5,7 @@ fetchurl, makeBinaryWrapper, # use specific electron since it has to load a compiled module - electron_36, + electron_37, autoPatchelfHook, makeDesktopItem, copyDesktopItems, @@ -15,10 +15,10 @@ let pname = "trilium-next-desktop"; - version = "0.95.0"; + version = "0.97.1"; triliumSource = os: arch: sha256: { - url = "https://github.com/TriliumNext/Notes/releases/download/v${version}/TriliumNextNotes-v${version}-${os}-${arch}.zip"; + url = "https://github.com/TriliumNext/Trilium/releases/download/v${version}/TriliumNotes-v${version}-${os}-${arch}.zip"; inherit sha256; }; @@ -26,10 +26,10 @@ let darwinSource = triliumSource "macos"; # exposed like this for update.sh - x86_64-linux.sha256 = "1lykzd1spvl6x6xm2qhw5bzcs9pbcars686gwbirscr53fb7q841"; - aarch64-linux.sha256 = "0bxrsj1g8dgg9rd6s0aj9jm2w6nk9yn6b1xgiab8kn298p3iqz64"; - x86_64-darwin.sha256 = "16cv52c6jn5ah5ccdfxffwrmf6vz8d4q4rj0v5ny4m0g0al78isg"; - aarch64-darwin.sha256 = "0v388frd4skpilxn8i5isd9xgn0qs9zszfs3h75q3qpx4xz355ps"; + x86_64-linux.sha256 = "1lb1mp031pa4wg6wrp8l84vw1glmqc27l4gf85a47bi4b63das2l"; + aarch64-linux.sha256 = "1yrxk8q2aafgcvipwhkwmjidymwia0dgqnhchhngmris6zrbb3wj"; + x86_64-darwin.sha256 = "0d8li5h2rn3iyzxsbs4g7a98zzdn58x4iwhzvxcjxy7b6h4hldvg"; + aarch64-darwin.sha256 = "07r1rw84mlszr2bzjwz62lsy14j9xm22li2ksdc4ra93q58kmip1"; sources = { x86_64-linux = linuxSource "x64" x86_64-linux.sha256; @@ -111,7 +111,7 @@ let asar pack $tmp/ $out/share/trilium/resources/app.asar rm -rf $tmp - makeWrapper ${lib.getExe electron_36} $out/bin/trilium \ + makeWrapper ${lib.getExe electron_37} $out/bin/trilium \ "''${gappsWrapperArgs[@]}" \ --set-default ELECTRON_IS_DEV 0 \ --add-flags $out/share/trilium/resources/app.asar diff --git a/pkgs/by-name/tr/trilium-next-desktop/update.sh b/pkgs/by-name/tr/trilium-next-desktop/update.sh index e2820a90dc7e..2b3802e9abd2 100755 --- a/pkgs/by-name/tr/trilium-next-desktop/update.sh +++ b/pkgs/by-name/tr/trilium-next-desktop/update.sh @@ -8,22 +8,22 @@ setKV () { sed -i "s|$2 = \".*\"|$2 = \"${3:-}\"|" $1 } -version=$(curl -s --show-error "https://api.github.com/repos/TriliumNext/Notes/releases/latest" | jq -r '.tag_name' | tail -c +2) +version=$(curl -s --show-error "https://api.github.com/repos/TriliumNext/Trilium/releases/latest" | jq -r '.tag_name' | tail -c +2) setKV ./package.nix version $version # Update desktop application -sha256_linux64=$(nix-prefetch-url --quiet https://github.com/TriliumNext/Notes/releases/download/v${version}/TriliumNextNotes-v${version}-linux-x64.zip) -sha256_linux64_arm=$(nix-prefetch-url --quiet https://github.com/TriliumNext/Notes/releases/download/v${version}/TriliumNextNotes-v${version}-linux-arm64.zip) -sha256_darwin64=$(nix-prefetch-url --quiet https://github.com/TriliumNext/Notes/releases/download/v${version}/TriliumNextNotes-v${version}-macos-x64.zip) -sha256_darwin64_arm=$(nix-prefetch-url --quiet https://github.com/TriliumNext/Notes/releases/download/v${version}/TriliumNextNotes-v${version}-macos-arm64.zip) +sha256_linux64=$(nix-prefetch-url --quiet https://github.com/TriliumNext/Trilium/releases/download/v${version}/TriliumNotes-v${version}-linux-x64.zip) +sha256_linux64_arm=$(nix-prefetch-url --quiet https://github.com/TriliumNext/Trilium/releases/download/v${version}/TriliumNotes-v${version}-linux-arm64.zip) +sha256_darwin64=$(nix-prefetch-url --quiet https://github.com/TriliumNext/Trilium/releases/download/v${version}/TriliumNotes-v${version}-macos-x64.zip) +sha256_darwin64_arm=$(nix-prefetch-url --quiet https://github.com/TriliumNext/Trilium/releases/download/v${version}/TriliumNotes-v${version}-macos-arm64.zip) setKV ./package.nix x86_64-linux.sha256 $sha256_linux64 setKV ./package.nix aarch64-linux.sha256 $sha256_linux64_arm setKV ./package.nix x86_64-darwin.sha256 $sha256_darwin64 setKV ./package.nix aarch64-darwin.sha256 $sha256_darwin64_arm # Update server -sha256_linux64_server=$(nix-prefetch-url --quiet https://github.com/TriliumNext/Notes/releases/download/v${version}/TriliumNextNotes-Server-v${version}-linux-x64.tar.xz) -sha256_linux64_server_arm=$(nix-prefetch-url --quiet https://github.com/TriliumNext/Notes/releases/download/v${version}/TriliumNextNotes-Server-v${version}-linux-arm64.tar.xz) +sha256_linux64_server=$(nix-prefetch-url --quiet https://github.com/TriliumNext/Trilium/releases/download/v${version}/TriliumNotes-Server-v${version}-linux-x64.tar.xz) +sha256_linux64_server_arm=$(nix-prefetch-url --quiet https://github.com/TriliumNext/Trilium/releases/download/v${version}/TriliumNotes-Server-v${version}-linux-arm64.tar.xz) setKV ../trilium-next-server/package.nix version $version setKV ../trilium-next-server/package.nix serverSource_x64.sha256 $sha256_linux64_server setKV ../trilium-next-server/package.nix serverSource_arm64.sha256 $sha256_linux64_server_arm diff --git a/pkgs/by-name/tr/trilium-next-server/package.nix b/pkgs/by-name/tr/trilium-next-server/package.nix index 327f462c9287..6ea019bf45f3 100644 --- a/pkgs/by-name/tr/trilium-next-server/package.nix +++ b/pkgs/by-name/tr/trilium-next-server/package.nix @@ -7,12 +7,12 @@ }: let - version = "0.95.0"; + version = "0.97.1"; - serverSource_x64.url = "https://github.com/TriliumNext/Notes/releases/download/v${version}/TriliumNextNotes-Server-v${version}-linux-x64.tar.xz"; - serverSource_x64.sha256 = "1rjl38i6l894kwpmc925amf9zbwyjlc4sqh3skm1f13vhv9pj9dx"; - serverSource_arm64.url = "https://github.com/TriliumNext/Notes/releases/download/v${version}/TriliumNextNotes-Server-v${version}-linux-arm64.tar.xz"; - serverSource_arm64.sha256 = "1rpzc13vdp5b3iwwc1l6h78nb5iairlxbflwvjwhy1149lpqnn8m"; + serverSource_x64.url = "https://github.com/TriliumNext/Trilium/releases/download/v${version}/TriliumNotes-Server-v${version}-linux-x64.tar.xz"; + serverSource_x64.sha256 = "1y0ass5b3c8qx28b31x2h7i1rlvdyjimsklgjpv8d47micsg6m7z"; + serverSource_arm64.url = "https://github.com/TriliumNext/Trilium/releases/download/v${version}/TriliumNotes-Server-v${version}-linux-arm64.tar.xz"; + serverSource_arm64.sha256 = "12bnmbm1p98633xsyxq6rr05jl79bn820915a0gmq14np7vskhmp"; serverSource = if stdenv.hostPlatform.isx86_64 then From 74fa03ff39451bb407b928921e505d42ed168c83 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Tue, 22 Jul 2025 07:27:49 +0000 Subject: [PATCH 44/60] vscode-extensions.ms-python.python: 2025.10.0 -> 2025.10.1 --- .../editors/vscode/extensions/ms-python.python/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/applications/editors/vscode/extensions/ms-python.python/default.nix b/pkgs/applications/editors/vscode/extensions/ms-python.python/default.nix index 6507f0587c65..e5e1edbcf035 100644 --- a/pkgs/applications/editors/vscode/extensions/ms-python.python/default.nix +++ b/pkgs/applications/editors/vscode/extensions/ms-python.python/default.nix @@ -15,8 +15,8 @@ vscode-utils.buildVscodeMarketplaceExtension rec { mktplcRef = { name = "python"; publisher = "ms-python"; - version = "2025.10.0"; - hash = "sha256-uD6NWGD5GyYwd7SeoGsgYEH26NI+hDxCx3f2EhqoOXk="; + version = "2025.10.1"; + hash = "sha256-3hd940mfxnvqoblIrx/S0A8KwHtYLFuonu52/HGGfak="; }; buildInputs = [ icu ]; From 5fd5a18fdefb282fc7dd075226383ab262325154 Mon Sep 17 00:00:00 2001 From: Gaetan Lepage Date: Tue, 22 Jul 2025 10:12:33 +0200 Subject: [PATCH 45/60] keycloak: makeWrapper -> makeBinaryWrapper --- pkgs/by-name/ke/keycloak/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/ke/keycloak/package.nix b/pkgs/by-name/ke/keycloak/package.nix index 03efe7f933fa..14861246630a 100644 --- a/pkgs/by-name/ke/keycloak/package.nix +++ b/pkgs/by-name/ke/keycloak/package.nix @@ -2,7 +2,7 @@ lib, stdenv, fetchzip, - makeWrapper, + makeBinaryWrapper, jre_headless, nixosTests, callPackage, @@ -32,7 +32,7 @@ stdenv.mkDerivation (finalAttrs: { }; nativeBuildInputs = [ - makeWrapper + makeBinaryWrapper jre_headless ]; From 45b3ed076f453503b1264b18e12074fef4f10eee Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Mon, 21 Jul 2025 23:05:43 +0000 Subject: [PATCH 46/60] python3Packages.scim2-client: 0.5.1 -> 0.5.2 --- pkgs/development/python-modules/scim2-client/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/python-modules/scim2-client/default.nix b/pkgs/development/python-modules/scim2-client/default.nix index 47a056103ca8..27dd921289f1 100644 --- a/pkgs/development/python-modules/scim2-client/default.nix +++ b/pkgs/development/python-modules/scim2-client/default.nix @@ -17,7 +17,7 @@ buildPythonPackage rec { pname = "scim2-client"; - version = "0.5.1"; + version = "0.5.2"; pyproject = true; @@ -26,7 +26,7 @@ buildPythonPackage rec { src = fetchPypi { inherit version; pname = "scim2_client"; - hash = "sha256-g2RR+Ruvjw88cGHcwEPoktTmB8VcWAPnea3BErS8JyI="; + hash = "sha256-viIriAFyfJVrJRr04GBD3dhaQ+iUVujigsx1ucSSeqA="; }; build-system = [ hatchling ]; From cd6364be9e474997c5aad6e44041e4180ed94d8f Mon Sep 17 00:00:00 2001 From: Antonio Date: Tue, 22 Jul 2025 10:13:12 +0200 Subject: [PATCH 47/60] libpff: 20111114 -> 20231205 --- pkgs/by-name/li/libpff/package.nix | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/pkgs/by-name/li/libpff/package.nix b/pkgs/by-name/li/libpff/package.nix index 31071f5ac9fb..dbc9b5d40f3d 100644 --- a/pkgs/by-name/li/libpff/package.nix +++ b/pkgs/by-name/li/libpff/package.nix @@ -6,13 +6,13 @@ autoreconfHook, }: -stdenv.mkDerivation rec { +stdenv.mkDerivation (finalAttrs: { pname = "libpff"; - version = "20211114"; + version = "20231205"; src = fetchzip { - url = "https://github.com/libyal/libpff/releases/download/${version}/libpff-alpha-${version}.tar.gz"; - sha256 = "sha256-UmGRBgi78nDSuuOXi/WmODojWU5AbQGKNQwLseoh714="; + url = "https://github.com/libyal/libpff/releases/download/${finalAttrs.version}/libpff-alpha-${finalAttrs.version}.tar.gz"; + hash = "sha256-VrdfZRC2iwTfv3YrObQvIH9QZPTi9pUQoAyUcBVJyes="; }; nativeBuildInputs = [ @@ -29,8 +29,8 @@ stdenv.mkDerivation rec { description = "Library and tools to access the Personal Folder File (PFF) and the Offline Folder File (OFF) format"; homepage = "https://github.com/libyal/libpff"; downloadPage = "https://github.com/libyal/libpff/releases"; - changelog = "https://github.com/libyal/libpff/blob/${version}/ChangeLog"; + changelog = "https://github.com/libyal/libpff/blob/${finalAttrs.version}/ChangeLog"; license = lib.licenses.lgpl3Only; maintainers = with lib.maintainers; [ hacker1024 ]; }; -} +}) From c66d63bdb303e6e6344d0cfac4e625f42979ae45 Mon Sep 17 00:00:00 2001 From: Jon Seager Date: Tue, 22 Jul 2025 11:46:54 +0200 Subject: [PATCH 48/60] icloudpd: 1.28.2 -> 1.29.2 --- pkgs/by-name/ic/icloudpd/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/ic/icloudpd/package.nix b/pkgs/by-name/ic/icloudpd/package.nix index 758b4f6c476d..1ad08d2ca142 100644 --- a/pkgs/by-name/ic/icloudpd/package.nix +++ b/pkgs/by-name/ic/icloudpd/package.nix @@ -9,14 +9,14 @@ python3Packages.buildPythonApplication rec { pname = "icloudpd"; - version = "1.28.2"; + version = "1.29.2"; pyproject = true; src = fetchFromGitHub { owner = "icloud-photos-downloader"; repo = "icloud_photos_downloader"; tag = "v${version}"; - hash = "sha256-5zuV32AOorkRqt3wiUt2ndo+4j1FQ9JBSc8wY+v01OA="; + hash = "sha256-V6y/JRRfvxfQE5+ZuM8N/jciWxRr9HI6PGjnzyJ2aP8="; }; pythonRelaxDeps = true; From 0f1a603304469cc457b5f9ccabdd7d943e3129c3 Mon Sep 17 00:00:00 2001 From: Frank Moda Date: Wed, 24 Jan 2024 19:50:25 -0500 Subject: [PATCH 49/60] homebridge: init at 1.11.0 --- pkgs/by-name/ho/homebridge/package.nix | 37 ++++++++++++++++++++++++++ 1 file changed, 37 insertions(+) create mode 100644 pkgs/by-name/ho/homebridge/package.nix diff --git a/pkgs/by-name/ho/homebridge/package.nix b/pkgs/by-name/ho/homebridge/package.nix new file mode 100644 index 000000000000..950cc87a715c --- /dev/null +++ b/pkgs/by-name/ho/homebridge/package.nix @@ -0,0 +1,37 @@ +{ + lib, + buildNpmPackage, + fetchFromGitHub, + jq, +}: + +buildNpmPackage (finalAttrs: { + pname = "homebridge"; + version = "1.11.0"; + + src = fetchFromGitHub { + owner = "homebridge"; + repo = "homebridge"; + tag = "v${finalAttrs.version}"; + hash = "sha256-95wd3pVumz/KGZNjOHrSOUtI4vipeHRWK7D8e9Nzpyo="; + }; + + npmDepsHash = "sha256-fcahrKJXvEMosLbcZY6x/hklmAy4Dyf65xNfFPa4OpU="; + + # Homebridge's clean phase attempts to install rimraf directly, which fails in nix builds + # rimraf is already in the declared dependencies, so we just don't need to do it. + # This will replace "npm install rimraf && rimraf lib/" with "rimraf lib/". + preBuild = '' + cat package.json | ${jq}/bin/jq '.scripts.clean = "rimraf lib/"' > package.json.tmp + mv package.json.tmp package.json + ''; + + meta = { + description = "Lightweight emulator of iOS HomeKit API"; + homepage = "https://github.com/homebridge/homebridge"; + license = lib.licenses.asl20; + mainProgram = "homebridge"; + platforms = lib.platforms.linux ++ lib.platforms.darwin; + maintainers = with lib.maintainers; [ fmoda3 ]; + }; +}) From b26ab810846076fe984e82379872f3d4f87686d5 Mon Sep 17 00:00:00 2001 From: Frank Moda Date: Wed, 24 Jan 2024 19:50:50 -0500 Subject: [PATCH 50/60] homebridge-config-ui-x: init at 5.1.0 --- .../ho/homebridge-config-ui-x/package.nix | 69 +++++++++++++++++++ 1 file changed, 69 insertions(+) create mode 100644 pkgs/by-name/ho/homebridge-config-ui-x/package.nix diff --git a/pkgs/by-name/ho/homebridge-config-ui-x/package.nix b/pkgs/by-name/ho/homebridge-config-ui-x/package.nix new file mode 100644 index 000000000000..e63069768dda --- /dev/null +++ b/pkgs/by-name/ho/homebridge-config-ui-x/package.nix @@ -0,0 +1,69 @@ +{ + lib, + stdenv, + buildNpmPackage, + fetchFromGitHub, + fetchNpmDeps, + npmHooks, + python3, + cacert, +}: + +buildNpmPackage (finalAttrs: { + pname = "homebridge-config-ui-x"; + version = "5.1.0"; + + src = fetchFromGitHub { + owner = "homebridge"; + repo = "homebridge-config-ui-x"; + tag = "v${finalAttrs.version}"; + hash = "sha256-asyNIiNv0bGD6fT4VTSp1W6f3dudkdZsVOc3KKOi4OY="; + }; + + # Deps hash for the root package + npmDepsHash = "sha256-XkdpR8yDNuP+681JIsKwHnY/Us83JGaAXJNBnGIU2UI="; + + # Deps src and hash for ui subdirectory + npmDeps_ui = fetchNpmDeps { + name = "npm-deps-ui"; + src = "${finalAttrs.src}/ui"; + hash = "sha256-vwJcls72nzbbtC4YXasgGWtgIVV4AMuNwIkEJuubP2Q="; + }; + + # Need to also run npm ci in the ui subdirectory + preBuild = '' + # Tricky way to run npmConfigHook multiple times + ( + source ${npmHooks.npmConfigHook}/nix-support/setup-hook + npmRoot=ui npmDeps=${finalAttrs.npmDeps_ui} makeCacheWritable= npmConfigHook + ) + # Required to prevent "ng build" from failing due to + # prompting user for autocompletion + export CI=true + ''; + + # On darwin, the build failed because openpty() is not declared + # Uses the prebuild version of @homebridge/node-pty-prebuilt-multiarch instead + # Remove this (and the makeCacheWritable in preBuild), once we fix + # compiling node-pty on darwin + makeCacheWritable = stdenv.hostPlatform.isDarwin; + + nativeBuildInputs = [ + python3 + ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ cacert ]; + + meta = { + description = "Configure Homebridge, monitor and backup from a browser"; + homepage = "https://github.com/homebridge/homebridge-config-ui-x"; + license = lib.licenses.mit; + mainProgram = "homebridge-config-ui-x"; + platforms = lib.platforms.linux ++ lib.platforms.darwin; + maintainers = with lib.maintainers; [ fmoda3 ]; + # Works on darwin when not in sandbox because it downloads a prebuilt binary + # for node-pty at build time, which does not work in sandbox. + # Need to figure out why this error occurs: + # ../src/unix/pty.cc:478:13: error: use of undeclared identifier 'openpty' + # int ret = openpty(&master, &slave, nullptr, NULL, static_cast(&winp)); + broken = stdenv.hostPlatform.isDarwin; + }; +}) From 12ed2954d4bef2867a56c78c96e3906fee25ec46 Mon Sep 17 00:00:00 2001 From: Frank Moda Date: Wed, 24 Jan 2024 19:51:12 -0500 Subject: [PATCH 51/60] nixos/homebridge: init --- .../manual/release-notes/rl-2511.section.md | 2 + nixos/modules/module-list.nix | 1 + .../services/home-automation/homebridge.nix | 433 ++++++++++++++++++ nixos/tests/all-tests.nix | 1 + nixos/tests/homebridge.nix | 88 ++++ 5 files changed, 525 insertions(+) create mode 100644 nixos/modules/services/home-automation/homebridge.nix create mode 100644 nixos/tests/homebridge.nix diff --git a/nixos/doc/manual/release-notes/rl-2511.section.md b/nixos/doc/manual/release-notes/rl-2511.section.md index 588eff3b51b5..90ff52647228 100644 --- a/nixos/doc/manual/release-notes/rl-2511.section.md +++ b/nixos/doc/manual/release-notes/rl-2511.section.md @@ -27,6 +27,8 @@ - Options under [networking.getaddrinfo](#opt-networking.getaddrinfo.enable) are now allowed to declaratively configure address selection and sorting behavior of `getaddrinfo` in dual-stack networks. +- [Homebridge](https://github.com/homebridge/homebridge), a lightweight Node.js server you can run on your home network that emulates the iOS HomeKit API. Available as [services.homebridge](#opt-services.homebridge.enable). + - [LACT](https://github.com/ilya-zlobintsev/LACT), a GPU monitoring and configuration tool, can now be enabled through [services.lact.enable](#opt-services.lact.enable). Note that for LACT to work properly on AMD GPU systems, you need to enable [hardware.amdgpu.overdrive.enable](#opt-hardware.amdgpu.overdrive.enable). diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix index 373a2df52894..44e94b934fb7 100644 --- a/nixos/modules/module-list.nix +++ b/nixos/modules/module-list.nix @@ -696,6 +696,7 @@ ./services/home-automation/evcc.nix ./services/home-automation/govee2mqtt.nix ./services/home-automation/home-assistant.nix + ./services/home-automation/homebridge.nix ./services/home-automation/matter-server.nix ./services/home-automation/wyoming/faster-whisper.nix ./services/home-automation/wyoming/openwakeword.nix diff --git a/nixos/modules/services/home-automation/homebridge.nix b/nixos/modules/services/home-automation/homebridge.nix new file mode 100644 index 000000000000..9f0d379c6514 --- /dev/null +++ b/nixos/modules/services/home-automation/homebridge.nix @@ -0,0 +1,433 @@ +{ + config, + lib, + pkgs, + ... +}: + +let + cfg = config.services.homebridge; + + restartCommand = "sudo -n systemctl restart homebridge"; + + defaultConfigUIPlatform = { + inherit (cfg.uiSettings) + platform + name + port + restart + log + ; + }; + + defaultConfig = { + description = "Homebridge"; + bridge = { + inherit (cfg.settings.bridge) name port; + # These have to be set at least once, otherwise the homebridge will not work + username = "CC:22:3D:E3:CE:30"; + pin = "031-45-154"; + }; + platforms = [ + defaultConfigUIPlatform + ]; + }; + + defaultConfigFile = settingsFormat.generate "config.json" defaultConfig; + + nixOverrideConfig = cfg.settings // { + platforms = [ cfg.uiSettings ] ++ cfg.settings.platforms; + }; + + nixOverrideConfigFile = settingsFormat.generate "nixOverrideConfig.json" nixOverrideConfig; + + # Create a single jq filter that updates all fields at once + # Platforms need to be unique by "platform" + # Accessories need to be unique by "name" + jqMergeFilter = '' + reduce .[] as $item ( + {}; + . * $item + { + "platforms": ( + ((.platforms // []) + ($item.platforms // [])) | + group_by(.platform) | + map(reduce .[] as $platform ({}; . * $platform)) + ), + "accessories": ( + ((.accessories // []) + ($item.accessories // [])) | + group_by(.name) | + map(reduce .[] as $accessory ({}; . * $accessory)) + ) + } + ) + ''; + + jqMergeFilterFile = pkgs.writeTextFile { + name = "jqMergeFilter.jq"; + text = jqMergeFilter; + }; + + # Validation function to ensure no platform has the platform "config". + # We want to make sure settings for the "config" platform are set in uiSettings. + validatePlatforms = + platforms: + let + conflictingPlatforms = builtins.filter (p: p.platform == "config") platforms; + in + if builtins.length conflictingPlatforms > 0 then + throw "The platforms list must not contain any platform with platform type 'config'. Use the uiSettings attribute instead." + else + platforms; + + settingsFormat = pkgs.formats.json { }; +in +{ + options.services.homebridge = with lib.types; { + + # Basic Example + # { + # services.homebridge = { + # enable = true; + # # Necessary for service to be reachable + # openFirewall = true; + # }; + # } + + enable = lib.mkEnableOption "Homebridge: Homekit home automation"; + + user = lib.mkOption { + type = str; + default = "homebridge"; + description = "User to run homebridge as."; + }; + + group = lib.mkOption { + type = str; + default = "homebridge"; + description = "Group to run homebridge as."; + }; + + openFirewall = lib.mkEnableOption "" // { + description = '' + Open ports in the firewall for the Homebridge web interface and service. + ''; + }; + + userStoragePath = lib.mkOption { + type = str; + default = "/var/lib/homebridge"; + description = '' + Path to store homebridge user files (needs to be writeable). + ''; + }; + + pluginPath = lib.mkOption { + type = str; + default = "/var/lib/homebridge/node_modules"; + description = '' + Path to the plugin download directory (needs to be writeable). + Seems this needs to end with node_modules, as Homebridge will run npm + on the parent directory. + ''; + }; + + environmentFile = lib.mkOption { + type = types.nullOr types.str; + default = null; + description = '' + Path to an environment-file which may contain secrets. + ''; + }; + + settings = lib.mkOption { + default = { }; + description = '' + Configuration options for homebridge. + + For more details, see [the homebridge documentation](https://github.com/homebridge/homebridge/wiki/Homebridge-Config-JSON-Explained). + ''; + type = submodule { + freeformType = settingsFormat.type; + options = { + description = lib.mkOption { + type = str; + default = "Homebridge"; + description = "Description of the homebridge instance."; + readOnly = true; + }; + + bridge.name = lib.mkOption { + type = str; + default = "Homebridge"; + description = "Name of the homebridge"; + }; + + bridge.port = lib.mkOption { + type = port; + default = 51826; + description = "The port homebridge listens on"; + }; + + platforms = lib.mkOption { + description = "Homebridge Platforms"; + default = [ ]; + apply = validatePlatforms; + type = listOf (submodule { + freeformType = settingsFormat.type; + options = { + name = lib.mkOption { + type = str; + description = "Name of the platform"; + }; + platform = lib.mkOption { + type = str; + description = "Platform type"; + }; + }; + }); + }; + + accessories = lib.mkOption { + description = "Homebridge Accessories"; + default = [ ]; + type = listOf (submodule { + freeformType = settingsFormat.type; + options = { + name = lib.mkOption { + type = str; + description = "Name of the accessory"; + }; + accessory = lib.mkOption { + type = str; + description = "Accessory type"; + }; + }; + }); + }; + }; + }; + }; + + # Defines the parameters for the Homebridge UI Plugin. + # This submodule will get merged into the "platforms" array + # inside settings. + uiSettings = lib.mkOption { + # Full list of UI settings can be found here: https://github.com/homebridge/homebridge-config-ui-x/wiki/Config-Options + default = { }; + description = '' + Configuration options for homebridge config UI plugin. + + For more details, see [the homebridge-config-ui-x documentation](https://github.com/homebridge/homebridge-config-ui-x/wiki/Config-Options). + ''; + type = submodule { + freeformType = settingsFormat.type; + options = { + ## Following parameters must be set, and can't be changed. + + # Must be "config" for UI service to see its config + platform = lib.mkOption { + type = str; + default = "config"; + description = "Type of the homebridge UI platform"; + readOnly = true; + }; + + name = lib.mkOption { + type = str; + default = "Config"; + description = "Name of the homebridge UI platform"; + readOnly = true; + }; + + # Homebridge can be installed many ways, but we're forcing a double service systemd setup + # This command will restart both services + restart = lib.mkOption { + type = str; + default = restartCommand; + description = "Command to restart the homebridge UI service"; + readOnly = true; + }; + + # We're using systemd, so make sure logs is setup to pull from systemd + log.method = lib.mkOption { + type = str; + default = "systemd"; + description = "Method to use for logging"; + readOnly = true; + }; + + log.service = lib.mkOption { + type = str; + default = "homebridge"; + description = "Name of the systemd service to log to"; + readOnly = true; + }; + + # The following options are allowed to be changed. + port = lib.mkOption { + type = port; + default = 8581; + description = "The port the UI web service should listen on"; + }; + }; + }; + }; + }; + + config = lib.mkIf cfg.enable { + systemd.services.homebridge = { + description = "Homebridge"; + wants = [ "network-online.target" ]; + after = [ + "syslog.target" + "network-online.target" + ]; + wantedBy = [ "multi-user.target" ]; + + # On start, if the config file is missing, create a default one + # Otherwise, ensure that the config file is using the + # properties as specified by nix. + # Not sure if there is a better way to do this than to use jq + # to replace sections of json. + preStart = '' + # If the user storage path does not exist, create it + if [ ! -d "${cfg.userStoragePath}" ]; then + install -d -m 700 -o ${cfg.user} -g ${cfg.group} "${cfg.userStoragePath}" + fi + # If there is no config file, create a placeholder default + if [ ! -e "${cfg.userStoragePath}/config.json" ]; then + install -D -m 600 -o ${cfg.user} -g ${cfg.group} "${defaultConfigFile}" "${cfg.userStoragePath}/config.json" + fi + + # Apply all nix override settings to config.json in a single jq operation + ${pkgs.jq}/bin/jq -s -f "${jqMergeFilterFile}" "${cfg.userStoragePath}/config.json" "${nixOverrideConfigFile}" | ${pkgs.jq}/bin/jq . > "${cfg.userStoragePath}/config.json.tmp" + install -D -m 600 -o ${cfg.user} -g ${cfg.group} "${cfg.userStoragePath}/config.json.tmp" "${cfg.userStoragePath}/config.json" + + # Remove temporary files + rm "${cfg.userStoragePath}/config.json.tmp" + + # Make sure plugin directory exists + install -d -m 755 -o ${cfg.user} -g ${cfg.group} "${cfg.pluginPath}" + + # In order for hb-service to detect the homebridge installation, we need to create a folder structure + # where homebridge and homebrdige-config-ui-x node modules are side by side, and then point + # UIX_BASE_PATH_OVERRIDE at the homebridge-config-ui-x node module in the service environment. + # So, first create a directory to symlink these packages to + install -d -m 755 -o ${cfg.user} -g ${cfg.group} "${cfg.userStoragePath}/homebridge-packages" + + # Then, symlink in the homebridge and homebridge-config-ui-x packages + rm -rf "${cfg.userStoragePath}/homebridge-packages/homebridge" + ln -s "${pkgs.homebridge}/lib/node_modules/homebridge" "${cfg.userStoragePath}/homebridge-packages/homebridge" + rm -rf "${cfg.userStoragePath}/homebridge-packages/homebridge-config-ui-x" + ln -s "${pkgs.homebridge-config-ui-x}/lib/node_modules/homebridge-config-ui-x" "${cfg.userStoragePath}/homebridge-packages/homebridge-config-ui-x" + ''; + + # hb-service environment variables based on source code analysis + environment = { + HOMEBRIDGE_CONFIG_UI_TERMINAL = "1"; + DISABLE_OPENCOLLECTIVE = "true"; + # Required or homebridge will search the global npm namespace + UIX_STRICT_PLUGIN_RESOLUTION = "1"; + # Workaround to ensure homebridge does not run in sudo mode + HOMEBRIDGE_APT_PACKAGE = "1"; + # Required to get the service to detect the homebridge install correctly + UIX_BASE_PATH_OVERRIDE = "${cfg.userStoragePath}/homebridge-packages/homebridge-config-ui-x"; + }; + + path = with pkgs; [ + # Tools listed in homebridge's installation documentations: + # https://github.com/homebridge/homebridge/wiki/Install-Homebridge-on-Arch-Linux + nodejs + nettools + gcc + gnumake + # Required for access to systemctl and journalctl + systemd + # Required for access to sudo + "/run/wrappers" + # Some plugins need bash to download tools + bash + ]; + + # Settings from https://github.com/homebridge/homebridge-config-ui-x/blob/latest/src/bin/platforms/linux.ts + serviceConfig = { + Type = "simple"; + User = cfg.user; + PermissionsStartOnly = true; + StateDirectory = "homebridge"; + EnvironmentFile = lib.mkIf (cfg.environmentFile != null) [ cfg.environmentFile ]; + ExecStart = "${pkgs.homebridge-config-ui-x}/bin/hb-service run -U ${cfg.userStoragePath} -P ${cfg.pluginPath}"; + Restart = "always"; + RestartSec = 3; + KillMode = "process"; + CapabilityBoundingSet = [ + "CAP_IPC_LOCK" + "CAP_NET_ADMIN" + "CAP_NET_BIND_SERVICE" + "CAP_NET_RAW" + "CAP_SETGID" + "CAP_SETUID" + "CAP_SYS_CHROOT" + "CAP_CHOWN" + "CAP_FOWNER" + "CAP_DAC_OVERRIDE" + "CAP_AUDIT_WRITE" + "CAP_SYS_ADMIN" + ]; + AmbientCapabilities = [ + "CAP_NET_RAW" + "CAP_NET_BIND_SERVICE" + ]; + }; + }; + + # Create a user whose home folder is the user storage path + users.users = lib.mkIf (cfg.user == "homebridge") { + homebridge = { + inherit (cfg) group; + # Necessary so that this user can run journalctl + extraGroups = [ "systemd-journal" ]; + description = "homebridge user"; + isSystemUser = true; + home = cfg.userStoragePath; + }; + }; + + users.groups = lib.mkIf (cfg.group == "homebridge") { + homebridge = { }; + }; + + # Need passwordless sudo for a few commands + # homebridge-config-ui-x needs for some features + security.sudo.extraRules = [ + { + users = [ cfg.user ]; + commands = [ + { + # Ability to restart homebridge service + command = "${pkgs.systemd}/bin/systemctl restart homebridge"; + options = [ "NOPASSWD" ]; + } + { + # Ability to shutdown server + command = "${pkgs.systemd}/bin/shutdown -h now"; + options = [ "NOPASSWD" ]; + } + { + # Ability to restart server + command = "${pkgs.systemd}/bin/shutdown -r now"; + options = [ "NOPASSWD" ]; + } + ]; + } + ]; + + networking.firewall = { + allowedTCPPorts = lib.mkIf cfg.openFirewall [ + cfg.settings.bridge.port + cfg.uiSettings.port + ]; + allowedUDPPorts = lib.mkIf cfg.openFirewall [ 5353 ]; + }; + }; +} diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix index fd7caf0bacf6..1eed4b3d7187 100644 --- a/nixos/tests/all-tests.nix +++ b/nixos/tests/all-tests.nix @@ -700,6 +700,7 @@ in hledger-web = runTest ./hledger-web.nix; hockeypuck = runTest ./hockeypuck.nix; home-assistant = runTest ./home-assistant.nix; + homebridge = runTest ./homebridge.nix; hostname = handleTest ./hostname.nix { }; hound = runTest ./hound.nix; hub = runTest ./git/hub.nix; diff --git a/nixos/tests/homebridge.nix b/nixos/tests/homebridge.nix new file mode 100644 index 000000000000..ce0f85caa413 --- /dev/null +++ b/nixos/tests/homebridge.nix @@ -0,0 +1,88 @@ +{ + lib, + ... +}: + +let + userStoragePath = "/var/lib/foobar"; + pluginPath = "${userStoragePath}/node_modules"; +in +{ + name = "homebridge"; + meta.maintainers = with lib.maintainers; [ fmoda3 ]; + + nodes.homebridge = + { pkgs, ... }: + { + services.homebridge = { + enable = true; + inherit userStoragePath pluginPath; + + settings = { + bridge = { + name = "Homebridge"; + port = 51826; + }; + }; + + uiSettings = { + port = 8581; + }; + }; + + # Cause a configuration change inside `config.json` and verify that the process is being reloaded. + specialisation.differentName = { + inheritParentConfig = true; + configuration.services.homebridge.settings.bridge.name = lib.mkForce "Test Home"; + }; + }; + + testScript = + { nodes, ... }: + let + system = nodes.homebridge.system.build.toplevel; + in + '' + import json + + start_all() + + + def get_homebridge_journal_cursor() -> str: + exit, out = homebridge.execute("journalctl -u homebridge.service -n1 -o json-pretty --output-fields=__CURSOR") + assert exit == 0 + return json.loads(out)["__CURSOR"] + + + def wait_for_homebridge(cursor): + homebridge.wait_until_succeeds(f"journalctl --after-cursor='{cursor}' -u homebridge.service | grep -q 'Logging to'") + + + homebridge.wait_for_unit("homebridge.service") + homebridge_cursor = get_homebridge_journal_cursor() + + with subtest("Check that JSON configuration file is in place"): + homebridge.succeed("test -f ${userStoragePath}/config.json") + + with subtest("Check that Homebridge's web interface and API can be reached"): + wait_for_homebridge(homebridge_cursor) + homebridge.wait_for_open_port(51826) + homebridge.wait_for_open_port(8581) + homebridge.succeed("curl --fail http://localhost:8581/") + + with subtest("Check service restart from SIGHUP"): + homebridge_pid = homebridge.succeed("systemctl show --property=MainPID homebridge.service") + homebridge_cursor = get_homebridge_journal_cursor() + homebridge.succeed("${system}/specialisation/differentName/bin/switch-to-configuration test") + wait_for_homebridge(homebridge_cursor) + new_homebridge_pid = homebridge.succeed("systemctl show --property=MainPID homebridge.service") + assert homebridge_pid != new_homebridge_pid, "The PID of the homebridge process must change after sending SIGHUP" + + with subtest("Check that no errors were logged"): + homebridge.fail("journalctl -u homebridge -o cat | grep -q ERROR") + + with subtest("Check systemd unit hardening"): + homebridge.log(homebridge.succeed("systemctl cat homebridge.service")) + homebridge.log(homebridge.succeed("systemd-analyze security homebridge.service")) + ''; +} From 78f194b3ae2a85dabb6789ba0929fc260687fd97 Mon Sep 17 00:00:00 2001 From: Jon Seager Date: Tue, 22 Jul 2025 11:44:36 +0200 Subject: [PATCH 52/60] google-chrome: 138.0.7204.100 -> 138.0.7204.157 --- pkgs/by-name/go/google-chrome/package.nix | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/pkgs/by-name/go/google-chrome/package.nix b/pkgs/by-name/go/google-chrome/package.nix index 27dd1eab9d8c..70cf21c06170 100644 --- a/pkgs/by-name/go/google-chrome/package.nix +++ b/pkgs/by-name/go/google-chrome/package.nix @@ -171,11 +171,11 @@ let linux = stdenvNoCC.mkDerivation (finalAttrs: { inherit pname meta passthru; - version = "138.0.7204.100"; + version = "138.0.7204.157"; src = fetchurl { url = "https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-stable/google-chrome-stable_${finalAttrs.version}-1_amd64.deb"; - hash = "sha256-H22aDTMvbUsbBWasGjCP1dUKmYzD9/6TIzfBpahAnA8="; + hash = "sha256-QmWevU4cYmUc6lUbFG4bQ1aKFuUyIUorJjMMF14bzZ4="; }; # With strictDeps on, some shebangs were not being patched correctly @@ -276,11 +276,11 @@ let darwin = stdenvNoCC.mkDerivation (finalAttrs: { inherit pname meta passthru; - version = "138.0.7204.101"; + version = "138.0.7204.158"; src = fetchurl { - url = "http://dl.google.com/release2/chrome/h7v73czgelyzwk2xfcs2gkpkwm_138.0.7204.101/GoogleChrome-138.0.7204.101.dmg"; - hash = "sha256-gG20H5QsVmnfRi+Zo+OiLTLlPP2cLp6W+JaJoRE0QtI="; + url = "http://dl.google.com/release2/chrome/adskeulizkrq3h2yvus65pybna6a_138.0.7204.158/GoogleChrome-138.0.7204.158.dmg"; + hash = "sha256-D7Iik+R9PIfvL1QEASfip5M2pE+nco90dKet4Fehq/8="; }; dontPatch = true; From f4187309deafbdfaf59b9bd7997c2c42dd7756e8 Mon Sep 17 00:00:00 2001 From: Leona Maroni Date: Fri, 18 Jul 2025 12:58:33 +0200 Subject: [PATCH 53/60] gitlab: 18.1.2 -> 18.2.0 https://about.gitlab.com/releases/2025/07/17/gitlab-18-2-released/ --- pkgs/by-name/gi/gitaly/package.nix | 6 +- .../gi/gitlab-container-registry/package.nix | 6 +- .../gitlab-elasticsearch-indexer/package.nix | 6 +- pkgs/by-name/gi/gitlab-pages/package.nix | 6 +- pkgs/by-name/gi/gitlab-shell/package.nix | 6 +- pkgs/by-name/gi/gitlab/data.json | 18 +-- .../gi/gitlab/gitlab-workhorse/default.nix | 4 +- pkgs/by-name/gi/gitlab/rubyEnv/Gemfile | 26 ++- pkgs/by-name/gi/gitlab/rubyEnv/Gemfile.lock | 104 ++++++------ pkgs/by-name/gi/gitlab/rubyEnv/gemset.nix | 151 +++++++----------- 10 files changed, 139 insertions(+), 194 deletions(-) diff --git a/pkgs/by-name/gi/gitaly/package.nix b/pkgs/by-name/gi/gitaly/package.nix index f27132f57d2a..4d844474cb7d 100644 --- a/pkgs/by-name/gi/gitaly/package.nix +++ b/pkgs/by-name/gi/gitaly/package.nix @@ -7,7 +7,7 @@ }: let - version = "18.1.2"; + version = "18.2.0"; package_version = "v${lib.versions.major version}"; gitaly_package = "gitlab.com/gitlab-org/gitaly/${package_version}"; @@ -21,10 +21,10 @@ let owner = "gitlab-org"; repo = "gitaly"; rev = "v${version}"; - hash = "sha256-ErA04W6rWsjSay02bst0ur1mztrdo8SW/mpGtln4unI="; + hash = "sha256-e78kokFzVqFGgurlqThxHhfrGiRuZ+XG2g5hRrCuF3Y="; }; - vendorHash = "sha256-BTpcnaHNyLgdAA9KqqA+mBo18fmQ0+OwLGNOPHRJ/IE="; + vendorHash = "sha256-RjDV4NGmmdT9STQBHiYf3UUYwPmuSg6970/W/ekxin0="; ldflags = [ "-X ${gitaly_package}/internal/version.version=${version}" diff --git a/pkgs/by-name/gi/gitlab-container-registry/package.nix b/pkgs/by-name/gi/gitlab-container-registry/package.nix index d5013e8d13d6..217966c4b1eb 100644 --- a/pkgs/by-name/gi/gitlab-container-registry/package.nix +++ b/pkgs/by-name/gi/gitlab-container-registry/package.nix @@ -6,7 +6,7 @@ buildGoModule rec { pname = "gitlab-container-registry"; - version = "4.24.0"; + version = "4.25.0"; rev = "v${version}-gitlab"; # nixpkgs-update: no auto update @@ -14,10 +14,10 @@ buildGoModule rec { owner = "gitlab-org"; repo = "container-registry"; inherit rev; - hash = "sha256-GNL7L6DKIKEgDEZQkeHNOn4R5SnWnHvNoUIs2YLjoR8="; + hash = "sha256-7jzKFC29NAHi5iag6aA/5LzH6IyqMa3yAxtzV9OsBnQ="; }; - vendorHash = "sha256-zisadCxyfItD/n7VGbtbvhl8MRHiqdw0Kkrg6ebgS/8="; + vendorHash = "sha256-z9IlfyJ48FQzhbY38GbZaeQjg3cMDU8tLCXKhazP64A="; checkFlags = let diff --git a/pkgs/by-name/gi/gitlab-elasticsearch-indexer/package.nix b/pkgs/by-name/gi/gitlab-elasticsearch-indexer/package.nix index 3befb216c4c2..ea5fad14c940 100644 --- a/pkgs/by-name/gi/gitlab-elasticsearch-indexer/package.nix +++ b/pkgs/by-name/gi/gitlab-elasticsearch-indexer/package.nix @@ -8,17 +8,17 @@ buildGoModule rec { pname = "gitlab-elasticsearch-indexer"; - version = "5.6.0"; + version = "5.7.0"; # nixpkgs-update: no auto update src = fetchFromGitLab { owner = "gitlab-org"; repo = "gitlab-elasticsearch-indexer"; rev = "v${version}"; - hash = "sha256-XerIPK+s0OWYAqKVqE3HSSI+D4cXixYqRHmf9/4C2eg="; + hash = "sha256-Qlz8YT6lGUtnMXCrfZZjzmSz0AivzcCVEd/tEKzfoYg="; }; - vendorHash = "sha256-qNGACM5DKufyNVKhJyakmMRbaMXi+JJUfojhWdk0ptU="; + vendorHash = "sha256-C0B9fe/S5TODgVTMGBBD5oGH/DsxAvCB6tBLaRdswCA="; buildInputs = [ icu ]; nativeBuildInputs = [ pkg-config ]; diff --git a/pkgs/by-name/gi/gitlab-pages/package.nix b/pkgs/by-name/gi/gitlab-pages/package.nix index d21dba50c838..b0e6e6dad31e 100644 --- a/pkgs/by-name/gi/gitlab-pages/package.nix +++ b/pkgs/by-name/gi/gitlab-pages/package.nix @@ -6,17 +6,17 @@ buildGoModule rec { pname = "gitlab-pages"; - version = "18.1.2"; + version = "18.2.0"; # nixpkgs-update: no auto update src = fetchFromGitLab { owner = "gitlab-org"; repo = "gitlab-pages"; rev = "v${version}"; - hash = "sha256-XY/WK19nujQPdsicGDHS5gEZf3uJZdW41R4xK9hDML0="; + hash = "sha256-TcDk816n4483SzTuz5bc8e2efrd2eJdM8jWXpM3DMvY="; }; - vendorHash = "sha256-6ZHKwPhC3N813kiw1NnPOMVc2CBSIClwc4MunDi0gCk="; + vendorHash = "sha256-OubXCpvGtGqegQmdb6R1zw/0DfQ4FdbJGt7qYYRnWnA="; subPackages = [ "." ]; meta = { diff --git a/pkgs/by-name/gi/gitlab-shell/package.nix b/pkgs/by-name/gi/gitlab-shell/package.nix index 2bc9ba46c36a..c12daca4cdc3 100644 --- a/pkgs/by-name/gi/gitlab-shell/package.nix +++ b/pkgs/by-name/gi/gitlab-shell/package.nix @@ -8,14 +8,14 @@ buildGoModule rec { pname = "gitlab-shell"; - version = "14.42.0"; + version = "14.43.0"; # nixpkgs-update: no auto update src = fetchFromGitLab { owner = "gitlab-org"; repo = "gitlab-shell"; rev = "v${version}"; - hash = "sha256-U42xSb9kZpxBIE+tua5m3iNMBfcLRlujSI3K5eWiuME="; + hash = "sha256-JBcfsOLutxHUk5z+vXP8CnVSmJazhqJk4fZ0vONIswo="; }; buildInputs = [ @@ -27,7 +27,7 @@ buildGoModule rec { ./remove-hardcoded-locations.patch ]; - vendorHash = "sha256-aBANgvo9kWiHoytaB10J3hf9vOWVsz/vJApVHet93xg="; + vendorHash = "sha256-zuxgWBrrftkNjMhAXs8cAcQmb8RLQqvnFhU0HnUUcTA="; subPackages = [ "cmd/gitlab-shell" diff --git a/pkgs/by-name/gi/gitlab/data.json b/pkgs/by-name/gi/gitlab/data.json index 7e6ef7cd5e0f..aa76ef74a44a 100644 --- a/pkgs/by-name/gi/gitlab/data.json +++ b/pkgs/by-name/gi/gitlab/data.json @@ -1,15 +1,15 @@ { - "version": "18.1.2", - "repo_hash": "072ib6rc7mw9pdzql8514k4z76i1ahssyj5kypgyvf9qj4naym0b", - "yarn_hash": "0c5pp3dpvw0q0nfl6w1lpdmk7dvkfinwb7z7a3vq22wgzca23x2m", + "version": "18.2.0", + "repo_hash": "0wkxnhrxq3x2ahbb1hffd2c321mz3y1wi7qh89drg8rn4qgz09cd", + "yarn_hash": "04mqinnbhr6zgab2p1bq6y6b20bf4c4cynkgfc67mzm9xhybr3fk", "owner": "gitlab-org", "repo": "gitlab", - "rev": "v18.1.2-ee", + "rev": "v18.2.0-ee", "passthru": { - "GITALY_SERVER_VERSION": "18.1.2", - "GITLAB_PAGES_VERSION": "18.1.2", - "GITLAB_SHELL_VERSION": "14.42.0", - "GITLAB_ELASTICSEARCH_INDEXER_VERSION": "5.6.0", - "GITLAB_WORKHORSE_VERSION": "18.1.2" + "GITALY_SERVER_VERSION": "18.2.0", + "GITLAB_PAGES_VERSION": "18.2.0", + "GITLAB_SHELL_VERSION": "14.43.0", + "GITLAB_ELASTICSEARCH_INDEXER_VERSION": "5.7.0", + "GITLAB_WORKHORSE_VERSION": "18.2.0" } } diff --git a/pkgs/by-name/gi/gitlab/gitlab-workhorse/default.nix b/pkgs/by-name/gi/gitlab/gitlab-workhorse/default.nix index d32d1530b2ce..c8f129daff95 100644 --- a/pkgs/by-name/gi/gitlab/gitlab-workhorse/default.nix +++ b/pkgs/by-name/gi/gitlab/gitlab-workhorse/default.nix @@ -10,7 +10,7 @@ in buildGoModule rec { pname = "gitlab-workhorse"; - version = "18.1.2"; + version = "18.2.0"; # nixpkgs-update: no auto update src = fetchFromGitLab { @@ -22,7 +22,7 @@ buildGoModule rec { sourceRoot = "${src.name}/workhorse"; - vendorHash = "sha256-jsp68duGIW1p8ltfSlK0jPd22iscjiIOyrxfsr+2QY0="; + vendorHash = "sha256-fJ1QqVn2t591ZQv9ilwgk+sPwNZNy6bHvpdCPs7S0+s="; buildInputs = [ git ]; ldflags = [ "-X main.Version=${version}" ]; doCheck = false; diff --git a/pkgs/by-name/gi/gitlab/rubyEnv/Gemfile b/pkgs/by-name/gi/gitlab/rubyEnv/Gemfile index b8cd3db40e42..40f61b9e6d0b 100644 --- a/pkgs/by-name/gi/gitlab/rubyEnv/Gemfile +++ b/pkgs/by-name/gi/gitlab/rubyEnv/Gemfile @@ -7,7 +7,7 @@ end source 'https://rubygems.org' if ENV.fetch('BUNDLER_CHECKSUM_VERIFICATION_OPT_IN', 'false') != 'false' # this verification is still experimental - $LOAD_PATH.unshift(File.expand_path("vendor/gems/bundler-checksum/lib", __dir__)) + $LOAD_PATH.unshift(File.expand_path("gems/bundler-checksum/lib", __dir__)) require 'bundler-checksum' BundlerChecksum.patch! end @@ -21,7 +21,7 @@ end extend ignore_feature_category -gem 'bundler-checksum', '~> 0.1.0', path: 'vendor/gems/bundler-checksum', require: false, feature_category: :shared +gem 'bundler-checksum', '~> 0.1.0', path: 'gems/bundler-checksum', require: false, feature_category: :shared # See https://docs.gitlab.com/ee/development/gemfile.html#upgrade-rails for guidelines when upgrading Rails @@ -37,7 +37,7 @@ gem 'mutex_m', '~> 0.3', feature_category: :shared # Need by Rails gem 'drb', '~> 2.2', feature_category: :shared -gem 'bootsnap', '~> 1.18.3', require: false, feature_category: :shared +gem 'bootsnap', '~> 1.18.6', require: false, feature_category: :shared # Avoid the precompiled native gems because Omnibus needs to build this to ensure # LD_LIBRARY_PATH is correct: https://gitlab.com/gitlab-org/omnibus-gitlab/-/merge_requests/7730 @@ -344,9 +344,6 @@ gem 'atlassian-jwt', '~> 0.2.1', feature_category: :integrations # Slack integration gem 'slack-messenger', '~> 2.3.5', feature_category: :integrations -# FogBugz integration -gem 'ruby-fogbugz', '~> 0.3.0', feature_category: :importers - # Kubernetes integration gem 'kubeclient', '~> 4.11.0', feature_category: :shared @@ -404,7 +401,7 @@ gem 'gitlab-schema-validation', path: 'gems/gitlab-schema-validation', feature_c gem 'gitlab-http', path: 'gems/gitlab-http', feature_category: :shared gem 'premailer-rails', '~> 1.12.0', feature_category: :notifications -gem 'gitlab-labkit', '~> 0.37.0', feature_category: :shared +gem 'gitlab-labkit', '~> 0.39.0', feature_category: :shared gem 'thrift', '>= 0.16.0', feature_category: :shared # I18n @@ -422,10 +419,6 @@ gem 'tty-prompt', '~> 0.23', require: false, feature_category: :shared # Perf bar gem 'peek', '~> 1.1', feature_category: :shared -# Google Cloud Profiler support -gem 'cloud_profiler_agent', '~> 0.0.0', path: 'vendor/gems/cloud_profiler_agent', require: false, - feature_category: :shared - # Snowplow events trackin gem 'snowplow-tracker', '~> 0.8.0', feature_category: :product_analytics @@ -438,7 +431,7 @@ gem 'prometheus-client-mmap', '~> 1.2.9', require: 'prometheus/client', feature_ gem 'async', '~> 2.24.0', require: false, feature_category: :shared # Security report schemas used to validate CI job artifacts of security jobs -gem 'gitlab-security_report_schemas', '0.1.2.min15.0.0.max15.2.1', feature_category: :vulnerability_management +gem 'gitlab-security_report_schemas', '0.1.3.min15.0.0.max15.2.2', feature_category: :vulnerability_management # OpenTelemetry group :opentelemetry do @@ -515,7 +508,7 @@ group :development, :test do gem 'database_cleaner-active_record', '~> 2.2.0', feature_category: :database gem 'rspec-rails', '~> 7.1.0', feature_category: :shared - gem 'factory_bot_rails', '~> 6.4.3', feature_category: :tooling + gem 'factory_bot_rails', '~> 6.5.0', feature_category: :tooling # Prevent occasions where minitest is not bundled in packaged versions of ruby (see #3826) gem 'minitest', '~> 5.11.0', feature_category: :shared @@ -565,7 +558,7 @@ group :development, :test, :coverage do gem 'simplecov', '~> 0.22', require: false, feature_category: :tooling gem 'simplecov-lcov', '~> 0.8.0', require: false, feature_category: :tooling gem 'simplecov-cobertura', '~> 2.1.0', require: false, feature_category: :tooling - gem 'undercover', '~> 0.6.0', require: false, feature_category: :tooling + gem 'undercover', '~> 0.7.0', require: false, feature_category: :tooling end # Gems required in omnibus-gitlab pipeline @@ -646,7 +639,7 @@ gem 'spamcheck', '~> 1.3.0', feature_category: :insider_threat gem 'gitaly', '~> 18.1.0.pre.rc1', feature_category: :gitaly # KAS GRPC protocol definitions -gem 'gitlab-kas-grpc', '~> 17.11.0', feature_category: :deployment_management +gem 'gitlab-kas-grpc', '~> 18.1.0', feature_category: :deployment_management # Lock until 1.74.0 is available # https://gitlab.com/gitlab-com/gl-infra/production/-/issues/20067 @@ -728,6 +721,7 @@ gem 'arr-pm', '~> 0.0.12', feature_category: :package_registry # Remote Development gem 'devfile', '~> 0.4.4', feature_category: :workspaces +gem 'hashdiff', '~> 1.2.0', feature_category: :workspaces # Apple plist parsing gem 'CFPropertyList', '~> 3.0.0', feature_category: :mobile_devops @@ -758,4 +752,4 @@ gem 'paper_trail', '~> 16.0', feature_category: :shared gem "i18n_data", "~> 0.13.1", feature_category: :system_access -gem "gitlab-cloud-connector", "~> 1.14", require: 'gitlab/cloud_connector', feature_category: :cloud_connector +gem "gitlab-cloud-connector", "~> 1.21", require: 'gitlab/cloud_connector', feature_category: :plan_provisioning diff --git a/pkgs/by-name/gi/gitlab/rubyEnv/Gemfile.lock b/pkgs/by-name/gi/gitlab/rubyEnv/Gemfile.lock index e5a452a4d519..7b7363c6267c 100644 --- a/pkgs/by-name/gi/gitlab/rubyEnv/Gemfile.lock +++ b/pkgs/by-name/gi/gitlab/rubyEnv/Gemfile.lock @@ -4,6 +4,12 @@ PATH activerecord-gitlab (0.2.0) activerecord (>= 7) +PATH + remote: gems/bundler-checksum + specs: + bundler-checksum (0.1.0) + bundler + PATH remote: gems/click_house-client specs: @@ -126,21 +132,6 @@ PATH diffy (~> 3.4) oj (~> 3.16, >= 3.16.10) -PATH - remote: vendor/gems/bundler-checksum - specs: - bundler-checksum (0.1.0) - bundler - -PATH - remote: vendor/gems/cloud_profiler_agent - specs: - cloud_profiler_agent (0.0.1.pre) - google-cloud-profiler-v2 (~> 0.3) - google-protobuf (~> 3.25) - googleauth (>= 0.14) - stackprof (~> 0.2) - PATH remote: vendor/gems/devise-pbkdf2-encryptable specs: @@ -217,8 +208,8 @@ GEM nkf rexml RedCloth (4.3.4) - acme-client (2.0.21) - base64 (~> 0.2.0) + acme-client (2.0.22) + base64 (~> 0.2) faraday (>= 1.0, < 3.0.0) faraday-retry (>= 1.0, < 3.0.0) actioncable (7.1.5.1) @@ -343,8 +334,8 @@ GEM awrence (1.2.1) aws-eventstream (1.3.0) aws-partitions (1.1001.0) - aws-sdk-cloudformation (1.131.0) - aws-sdk-core (~> 3, >= 3.216.0) + aws-sdk-cloudformation (1.133.0) + aws-sdk-core (~> 3, >= 3.225.0) aws-sigv4 (~> 1.5) aws-sdk-core (3.225.0) aws-eventstream (~> 1, >= 1.3.0) @@ -446,7 +437,7 @@ GEM descendants_tracker (~> 0.0.1) colored2 (3.1.2) commonmarker (0.23.11) - concurrent-ruby (1.2.3) + concurrent-ruby (1.3.5) connection_pool (2.5.3) console (1.29.2) fiber-annotation @@ -489,7 +480,7 @@ GEM danger-gitlab (8.0.0) danger gitlab (~> 4.2, >= 4.2.0) - database_cleaner-active_record (2.2.0) + database_cleaner-active_record (2.2.1) activerecord (>= 5.a) database_cleaner-core (~> 2.0.0) database_cleaner-core (2.0.1) @@ -552,7 +543,7 @@ GEM jwt (>= 2.5) ostruct (>= 0.5) dotenv (2.7.6) - drb (2.2.1) + drb (2.2.3) dry-cli (1.0.0) dry-core (1.0.1) concurrent-ruby (~> 1.0) @@ -608,9 +599,9 @@ GEM html-pipeline (~> 2.9) factory_bot (6.5.0) activesupport (>= 5.0.0) - factory_bot_rails (6.4.4) + factory_bot_rails (6.5.0) factory_bot (~> 6.5) - railties (>= 5.0.0) + railties (>= 6.1.0) faraday (2.13.1) faraday-net_http (>= 2.0, < 3.5) json @@ -619,7 +610,7 @@ GEM faraday (>= 1, < 3) faraday-http-cache (2.5.0) faraday (>= 0.8) - faraday-multipart (1.1.0) + faraday-multipart (1.1.1) multipart-post (~> 2.0) faraday-net_http (3.1.0) net-http @@ -734,10 +725,10 @@ GEM terminal-table (>= 1.5.1) gitlab-chronic (0.10.6) numerizer (~> 0.2) - gitlab-cloud-connector (1.17.0) + gitlab-cloud-connector (1.21.0) activesupport (~> 7.0) jwt (~> 2.9.3) - gitlab-crystalball (1.1.0) + gitlab-crystalball (1.1.1) git (< 4) ostruct (< 1) gitlab-dangerfiles (4.9.2) @@ -758,15 +749,17 @@ GEM nokogiri (~> 1, >= 1.10.8) gitlab-glfm-markdown (0.0.31) rb_sys (~> 0.9.109) - gitlab-kas-grpc (17.11.3) + gitlab-kas-grpc (18.1.0) grpc (~> 1.0) - gitlab-labkit (0.37.0) + gitlab-labkit (0.39.0) actionpack (>= 5.0.0, < 8.1.0) activesupport (>= 5.0.0, < 8.1.0) + google-protobuf (~> 3) grpc (>= 1.62) jaeger-client (~> 1.1.0) opentracing (~> 0.4) - pg_query (>= 5.1.0, < 7.0) + pg_query (>= 6.1.0, < 7.0) + prometheus-client-mmap (~> 1.2.9) redis (> 3.0.0, < 6.0.0) gitlab-license (2.6.0) gitlab-mail_room (0.0.27) @@ -782,7 +775,7 @@ GEM activesupport (>= 5.2.0) rake (~> 13.0) snowplow-tracker (~> 0.8.0) - gitlab-secret_detection (0.29.1) + gitlab-secret_detection (0.33.0) grpc (>= 1.63.0, < 2) grpc_reflection (~> 0.1) parallel (~> 1) @@ -790,9 +783,10 @@ GEM sentry-ruby (~> 5.22) stackprof (~> 0.2.27) toml-rb (~> 2.2) - gitlab-security_report_schemas (0.1.2.min15.0.0.max15.2.1) + gitlab-security_report_schemas (0.1.3.min15.0.0.max15.2.2) activesupport (>= 6, < 8) json_schemer (~> 2.3.0) + mutex_m (~> 0.3.0) gitlab-styles (13.1.0) rubocop (= 1.71.1) rubocop-capybara (~> 2.21.0) @@ -887,9 +881,6 @@ GEM google-cloud-location (0.6.0) gapic-common (>= 0.20.0, < 2.a) google-cloud-errors (~> 1.0) - google-cloud-profiler-v2 (0.4.0) - gapic-common (>= 0.18.0, < 2.a) - google-cloud-errors (~> 1.0) google-cloud-storage (1.45.0) addressable (~> 2.8) digest-crc (~> 0.4) @@ -995,7 +986,7 @@ GEM thor tilt hana (1.3.7) - hashdiff (1.1.0) + hashdiff (1.2.0) hashie (5.0.0) health_check (3.1.0) railties (>= 5.0) @@ -1104,7 +1095,7 @@ GEM language_server-protocol (3.17.0.3) launchy (2.5.2) addressable (~> 2.8) - lefthook (1.11.13) + lefthook (1.11.16) letter_opener (1.10.0) launchy (>= 2.2, < 4) letter_opener_web (3.0.0) @@ -1259,7 +1250,7 @@ GEM ostruct (>= 0.2) oj-introspect (0.8.0) oj (>= 3.16.10) - omniauth (2.1.2) + omniauth (2.1.3) hashie (>= 3.4.6) rack (>= 2.2.3) rack-protection @@ -1312,7 +1303,7 @@ GEM opensearch-ruby (3.4.0) faraday (>= 1.0, < 3) multi_json (>= 1.0) - openssl (3.2.0) + openssl (3.3.0) openssl-signature_algorithm (1.3.0) openssl (> 2.0) opentelemetry-api (1.2.5) @@ -1516,7 +1507,7 @@ GEM pyu-ruby-sasl (0.0.3.3) raabro (1.4.0) racc (1.8.1) - rack (2.2.13) + rack (2.2.17) rack-accept (0.4.5) rack (>= 0.4) rack-attack (6.7.0) @@ -1588,7 +1579,7 @@ GEM rake-compiler-dock (= 1.9.1) rbs (3.6.1) logger - rbtrace (0.5.1) + rbtrace (0.5.2) ffi (>= 1.0.6) msgpack (>= 0.4.3) optimist (>= 3.0.0) @@ -1726,9 +1717,6 @@ GEM rubocop-rspec_rails (2.30.0) rubocop (~> 1.61) rubocop-rspec (~> 3, >= 3.0.1) - ruby-fogbugz (0.3.0) - crack (~> 0.4) - multipart-post (~> 2.0) ruby-lsp (0.23.20) language_server-protocol (~> 3.17.0) prism (>= 1.2, < 2.0) @@ -1736,7 +1724,7 @@ GEM sorbet-runtime (>= 0.5.10782) ruby-lsp-rails (0.3.31) ruby-lsp (>= 0.23.0, < 0.24.0) - ruby-lsp-rspec (0.1.23) + ruby-lsp-rspec (0.1.24) ruby-lsp (~> 0.23.19) ruby-magic (0.6.0) mini_portile2 (~> 2.8) @@ -1845,7 +1833,7 @@ GEM tilt (~> 2.0) yard (~> 0.9, >= 0.9.24) yard-solargraph (~> 0.1) - solargraph-rspec (0.5.1) + solargraph-rspec (0.5.2) solargraph (~> 0.52, >= 0.52.0) sorbet-runtime (0.5.11647) spamcheck (1.3.3) @@ -1854,7 +1842,8 @@ GEM spring-commands-rspec (1.0.4) spring (>= 0.9.1) sprite-factory (1.7.1) - sprockets (3.7.2) + sprockets (3.7.5) + base64 concurrent-ruby (~> 1.0) rack (> 1, < 3) sprockets-rails (3.5.2) @@ -1961,12 +1950,14 @@ GEM tzinfo (2.0.6) concurrent-ruby (~> 1.0) uber (0.1.0) - undercover (0.6.4) + undercover (0.7.0) base64 bigdecimal imagen (>= 0.2.0) rainbow (>= 2.1, < 4.0) rugged (>= 0.27, < 1.10) + simplecov + simplecov_json_formatter unf (0.1.4) unf_ext unf_ext (0.0.8.2) @@ -2084,7 +2075,7 @@ DEPENDENCIES benchmark-ips (~> 2.14.0) benchmark-memory (~> 0.1) better_errors (~> 2.10.1) - bootsnap (~> 1.18.3) + bootsnap (~> 1.18.6) browser (~> 5.3.1) bullet (~> 8.0.0) bundler-checksum (~> 0.1.0)! @@ -2094,7 +2085,6 @@ DEPENDENCIES charlock_holmes (~> 0.7.9) circuitbox (= 2.0.0) click_house-client! - cloud_profiler_agent (~> 0.0.0)! commonmarker (~> 0.23.10) concurrent-ruby (~> 1.1) connection_pool (~> 2.5.3) @@ -2128,7 +2118,7 @@ DEPENDENCIES email_reply_trimmer (~> 0.1) email_spec (~> 2.3.0) error_tracking_open_api! - factory_bot_rails (~> 6.4.3) + factory_bot_rails (~> 6.5.0) faraday (~> 2) faraday-multipart (~> 1.0) faraday-retry (~> 2) @@ -2154,7 +2144,7 @@ DEPENDENCIES gitlab-active-context! gitlab-backup-cli! gitlab-chronic (~> 0.10.5) - gitlab-cloud-connector (~> 1.14) + gitlab-cloud-connector (~> 1.21) gitlab-crystalball (~> 1.1.0) gitlab-dangerfiles (~> 4.9.0) gitlab-duo-workflow-service-client (~> 0.2)! @@ -2163,8 +2153,8 @@ DEPENDENCIES gitlab-glfm-markdown (~> 0.0.31) gitlab-housekeeper! gitlab-http! - gitlab-kas-grpc (~> 17.11.0) - gitlab-labkit (~> 0.37.0) + gitlab-kas-grpc (~> 18.1.0) + gitlab-labkit (~> 0.39.0) gitlab-license (~> 2.6) gitlab-mail_room (~> 0.0.24) gitlab-markup (~> 2.0.0) @@ -2175,7 +2165,7 @@ DEPENDENCIES gitlab-schema-validation! gitlab-sdk (~> 0.3.0) gitlab-secret_detection (< 1.0) - gitlab-security_report_schemas (= 0.1.2.min15.0.0.max15.2.1) + gitlab-security_report_schemas (= 0.1.3.min15.0.0.max15.2.2) gitlab-sidekiq-fetcher! gitlab-styles (~> 13.1.0) gitlab-topology-service-client (~> 0.1)! @@ -2215,6 +2205,7 @@ DEPENDENCIES guard-rspec haml_lint (~> 0.58) hamlit (~> 2.15.0) + hashdiff (~> 1.2.0) hashie (~> 5.0.0) health_check (~> 3.0) html-pipeline (~> 2.14.3) @@ -2354,7 +2345,6 @@ DEPENDENCIES rspec_junit_formatter rspec_profiling (~> 0.0.9) rubocop - ruby-fogbugz (~> 0.3.0) ruby-lsp (~> 0.23.0) ruby-lsp-rails (~> 0.3.6) ruby-lsp-rspec (~> 0.1.10) @@ -2405,7 +2395,7 @@ DEPENDENCIES truncato (~> 0.7.13) tty-prompt (~> 0.23) typhoeus (~> 1.4.0) - undercover (~> 0.6.0) + undercover (~> 0.7.0) unicode-emoji (~> 4.0) unleash (~> 3.2.2) uri (= 0.13.2) diff --git a/pkgs/by-name/gi/gitlab/rubyEnv/gemset.nix b/pkgs/by-name/gi/gitlab/rubyEnv/gemset.nix index 4edeca120f33..9042ca7c22c3 100644 --- a/pkgs/by-name/gi/gitlab/rubyEnv/gemset.nix +++ b/pkgs/by-name/gi/gitlab/rubyEnv/gemset.nix @@ -9,10 +9,10 @@ src: { platforms = [ ]; source = { remotes = [ "https://rubygems.org" ]; - sha256 = "0hbn563v0rc85md0fcx3z968dvq7n2ra64wbgyxg09ndjgwl9870"; + sha256 = "1xvnj58nln2xa8vlxc1v4zgyda4n387npbcd94z3pjg28fvk8xc1"; type = "gem"; }; - version = "2.0.21"; + version = "2.0.22"; }; actioncable = { dependencies = [ @@ -557,10 +557,10 @@ src: { platforms = [ ]; source = { remotes = [ "https://rubygems.org" ]; - sha256 = "1bkkx0sz1lkqhzkrpklnalpv2dshvrdi12yq47xmv0nflhgzysmp"; + sha256 = "08d3khg5bpi73vmghphr5w4acds2vr8gcdpm93fsaj38wvb960s9"; type = "gem"; }; - version = "1.131.0"; + version = "1.133.0"; }; aws-sdk-core = { dependencies = [ @@ -925,7 +925,7 @@ src: { groups = [ "default" ]; platforms = [ ]; source = { - path = "${src}/vendor/gems/bundler-checksum"; + path = "${src}/gems/bundler-checksum"; type = "path"; }; version = "0.1.0"; @@ -1145,21 +1145,6 @@ src: { }; version = "0.1.0"; }; - cloud_profiler_agent = { - dependencies = [ - "google-cloud-profiler-v2" - "google-protobuf" - "googleauth" - "stackprof" - ]; - groups = [ "default" ]; - platforms = [ ]; - source = { - path = "${src}/vendor/gems/cloud_profiler_agent"; - type = "path"; - }; - version = "0.0.1.pre"; - }; coderay = { groups = [ "default" @@ -1232,10 +1217,10 @@ src: { platforms = [ ]; source = { remotes = [ "https://rubygems.org" ]; - sha256 = "1qh1b14jwbbj242klkyz5fc7npd4j0mvndz62gajhvl1l3wd7zc2"; + sha256 = "1ipbrgvf0pp6zxdk5ascp6i29aybz2bx9wdrlchjmpx6mhvkwfw1"; type = "gem"; }; - version = "1.2.3"; + version = "1.3.5"; }; connection_pool = { groups = [ @@ -1478,10 +1463,10 @@ src: { platforms = [ ]; source = { remotes = [ "https://rubygems.org" ]; - sha256 = "1iz1hv2b1z7509dxvxdwzay1hhs24glxls5ldbyh688zxkcdca1j"; + sha256 = "1jxzgg3yccp3gjncl5ih0y13dcappmy0y8pq85wgjj0yx5fh0ixy"; type = "gem"; }; - version = "2.2.0"; + version = "2.2.1"; }; database_cleaner-core = { groups = [ @@ -1809,15 +1794,17 @@ src: { drb = { groups = [ "default" + "development" + "monorepo" "test" ]; platforms = [ ]; source = { remotes = [ "https://rubygems.org" ]; - sha256 = "0h5kbj9hvg5hb3c7l425zpds0vb42phvln2knab8nmazg2zp5m79"; + sha256 = "0wrkl7yiix268s2md1h6wh91311w95ikd8fy8m5gx589npyxc00b"; type = "gem"; }; - version = "2.2.1"; + version = "2.2.3"; }; dry-cli = { groups = [ "default" ]; @@ -2192,10 +2179,10 @@ src: { platforms = [ ]; source = { remotes = [ "https://rubygems.org" ]; - sha256 = "122wkrc3d2q1dlca27794hh3arw0kvrf3rgmvn7hj3y5lb51g7hk"; + sha256 = "18n06y5ww7d08w296b6fpzx05yywp5r8p88j0k37r994aiin2ysa"; type = "gem"; }; - version = "6.4.4"; + version = "6.5.0"; }; faraday = { dependencies = [ @@ -2250,10 +2237,10 @@ src: { platforms = [ ]; source = { remotes = [ "https://rubygems.org" ]; - sha256 = "0l87r9jg06nsh24gwwd1jdnxb1zq89ffybnxab0dd90nfcf0ysw5"; + sha256 = "00w9imp55hi81q0wsgwak90ldkk7gbyb8nzmmv8hy0s907s8z8bp"; type = "gem"; }; - version = "1.1.0"; + version = "1.1.1"; }; faraday-net_http = { dependencies = [ "net-http" ]; @@ -2857,10 +2844,10 @@ src: { platforms = [ ]; source = { remotes = [ "https://rubygems.org" ]; - sha256 = "0d5zrz5vgb8zrnri42awqfvcq9kfzlrc032nprknddpb9iagbsmr"; + sha256 = "02bpl0jz8m7kfa5alkc90cbajkxy5fggva10zh7cgii3y912msqn"; type = "gem"; }; - version = "1.17.0"; + version = "1.21.0"; }; gitlab-crystalball = { dependencies = [ @@ -2874,10 +2861,10 @@ src: { platforms = [ ]; source = { remotes = [ "https://rubygems.org" ]; - sha256 = "1a42qg2m7w0qn7as3zrc4v7lrxig532izi7yb2w8rbcwm114fcdx"; + sha256 = "1vdqa11dchcmlkph9almmxjq9qsgcfv0n460lyghx7l0n09s2r04"; type = "gem"; }; - version = "1.1.0"; + version = "1.1.1"; }; gitlab-dangerfiles = { dependencies = [ @@ -2994,29 +2981,31 @@ src: { platforms = [ ]; source = { remotes = [ "https://rubygems.org" ]; - sha256 = "0lsz61cr7i3d72i6rxvbfqbq6f5anzbbmhmrmr7mprna4dy93d7q"; + sha256 = "07d5jav33nvl83s83yd9fg6vv636n65ybni6m6k3yvlfxygpb3wn"; type = "gem"; }; - version = "17.11.3"; + version = "18.1.0"; }; gitlab-labkit = { dependencies = [ "actionpack" "activesupport" + "google-protobuf" "grpc" "jaeger-client" "opentracing" "pg_query" + "prometheus-client-mmap" "redis" ]; groups = [ "default" ]; platforms = [ ]; source = { remotes = [ "https://rubygems.org" ]; - sha256 = "0w7szxnvh9hvxcragnqvn37c6jpm4gf7aadzxslajj91vdh0mpfj"; + sha256 = "07jpj78nnjmgz9brxxzqbx7l9fajyfq74l4vjavqmnff18vgr0gf"; type = "gem"; }; - version = "0.37.0"; + version = "0.39.0"; }; gitlab-license = { groups = [ "default" ]; @@ -3156,24 +3145,25 @@ src: { platforms = [ ]; source = { remotes = [ "https://rubygems.org" ]; - sha256 = "0b4908vic675qq1mh1i45vh5z9vdg1ynanxdbdzaazxvjkakdwzd"; + sha256 = "14ds4l7802ypxx56pid7xlhnlbk5ir9zc8adfm96yy9k2sgfmdnf"; type = "gem"; }; - version = "0.29.1"; + version = "0.33.0"; }; gitlab-security_report_schemas = { dependencies = [ "activesupport" "json_schemer" + "mutex_m" ]; groups = [ "default" ]; platforms = [ ]; source = { remotes = [ "https://rubygems.org" ]; - sha256 = "1bl0qrmb6xci719zxnaizja2pf0wabzi91b49y0immf9gr43f01h"; + sha256 = "0v4sfh2497g5w5hhf89wjgvjbasa13hfgm0r05myzd5hbv7v2h3f"; type = "gem"; }; - version = "0.1.2.min15.0.0.max15.2.1"; + version = "0.1.3.min15.0.0.max15.2.2"; }; gitlab-sidekiq-fetcher = { dependencies = [ @@ -3589,20 +3579,6 @@ src: { }; version = "0.6.0"; }; - google-cloud-profiler-v2 = { - dependencies = [ - "gapic-common" - "google-cloud-errors" - ]; - groups = [ "default" ]; - platforms = [ ]; - source = { - remotes = [ "https://rubygems.org" ]; - sha256 = "1qyknlvwji7vqhani490cacsrzlqfza10hv47him93yhfnqjmz2k"; - type = "gem"; - }; - version = "0.4.0"; - }; google-cloud-storage = { dependencies = [ "addressable" @@ -4050,10 +4026,10 @@ src: { platforms = [ ]; source = { remotes = [ "https://rubygems.org" ]; - sha256 = "1jf9dxgjz6z7fvymyz2acyvn9iyvwkn6d9sk7y4fxwbmfc75yimm"; + sha256 = "1da0w5v7ppxrgvh58bafjklzv73nknyq73if6d9rkz2v24zg3169"; type = "gem"; }; - version = "1.1.0"; + version = "1.2.0"; }; hashie = { groups = [ "default" ]; @@ -4697,10 +4673,10 @@ src: { platforms = [ ]; source = { remotes = [ "https://rubygems.org" ]; - sha256 = "18msiw0b3krm9krxrahiladblh6pjpj395wcjjw2fvsimwyy7vk4"; + sha256 = "11g6iqlsck4ypjfg1b7pkcisy5qbm774rwbwdz2rka5lcccky9qs"; type = "gem"; }; - version = "1.11.13"; + version = "1.11.16"; }; letter_opener = { dependencies = [ "launchy" ]; @@ -5672,10 +5648,10 @@ src: { platforms = [ ]; source = { remotes = [ "https://rubygems.org" ]; - sha256 = "1km0wqx9pj609jidvrqfsvzbzfgdnlpdnv7i7xfqm3wb55vk5w6y"; + sha256 = "1hjnb5b5m549irs0h1455ipzsv82pikdagx9wjb6r4j1bkjy494d"; type = "gem"; }; - version = "2.1.2"; + version = "2.1.3"; }; omniauth-alicloud = { dependencies = [ "omniauth-oauth2" ]; @@ -5920,10 +5896,10 @@ src: { platforms = [ ]; source = { remotes = [ "https://rubygems.org" ]; - sha256 = "054d6ybgjdzxw567m7rbnd46yp6gkdbc5ihr536vxd3p15vbhjrw"; + sha256 = "0ygfbbs3c61d32ymja2k6sznj5pr540cip9z91lhzcvsr4zmffpz"; type = "gem"; }; - version = "3.2.0"; + version = "3.3.0"; }; openssl-signature_algorithm = { dependencies = [ "openssl" ]; @@ -6960,10 +6936,10 @@ src: { platforms = [ ]; source = { remotes = [ "https://rubygems.org" ]; - sha256 = "1yzhcwvfkrlb8l79w24yjclv636jn6rnznp95shmssk934bi1vnc"; + sha256 = "1pcr8sn02lwzv3z6vx5n41b6ybcnw9g9h05s3lkv4vqdm0f2mq2z"; type = "gem"; }; - version = "2.2.13"; + version = "2.2.17"; }; rack-accept = { dependencies = [ "rack" ]; @@ -7314,10 +7290,10 @@ src: { platforms = [ ]; source = { remotes = [ "https://rubygems.org" ]; - sha256 = "1p65p6f917al0f07sn5ca9yj92f7mk52xgnp0ahqpyrb8r6sdjz8"; + sha256 = "158qydqnrn1r0gm806j0bn439y0dyzdpscwi1sm3ldl1mcid5mx2"; type = "gem"; }; - version = "0.5.1"; + version = "0.5.2"; }; rchardet = { groups = [ @@ -8063,20 +8039,6 @@ src: { }; version = "2.30.0"; }; - ruby-fogbugz = { - dependencies = [ - "crack" - "multipart-post" - ]; - groups = [ "default" ]; - platforms = [ ]; - source = { - remotes = [ "https://rubygems.org" ]; - sha256 = "0mznsnhsgh1yg57j5gighr9vjricnix1l7ngf654k3v4fkjcs12y"; - type = "gem"; - }; - version = "0.3.0"; - }; ruby-lsp = { dependencies = [ "language_server-protocol" @@ -8110,10 +8072,10 @@ src: { platforms = [ ]; source = { remotes = [ "https://rubygems.org" ]; - sha256 = "1lv886262vzmjpgcd0759zn86yaidjn1wznnscn75saj4d81bafj"; + sha256 = "08m2fw4f784lkbyz5rbzdhj57p0x2pfygk66ls0qsn5avnv7izs1"; type = "gem"; }; - version = "0.1.23"; + version = "0.1.24"; }; ruby-magic = { dependencies = [ "mini_portile2" ]; @@ -8704,10 +8666,10 @@ src: { platforms = [ ]; source = { remotes = [ "https://rubygems.org" ]; - sha256 = "1kpsdfkj6yvd5ndhj5vbll4591lwg4gjrf5c61ffj8vvy4j93z0d"; + sha256 = "1wxzz7580h6k2sghj9p1ss33i6nlmpmwqawi6ilr87si233rwgxc"; type = "gem"; }; - version = "0.5.1"; + version = "0.5.2"; }; sorbet-runtime = { groups = [ @@ -8772,21 +8734,18 @@ src: { }; sprockets = { dependencies = [ + "base64" "concurrent-ruby" "rack" ]; - groups = [ - "default" - "development" - "test" - ]; + groups = [ "default" ]; platforms = [ ]; source = { remotes = [ "https://rubygems.org" ]; - sha256 = "182jw5a0fbqah5w9jancvfmjbk88h8bxdbwnl4d3q809rpxdg8ay"; + sha256 = "10ykzsa76cf8kvbfkszlvbyn4ckcx1mxjhfvwxzs7y28cljhzhkj"; type = "gem"; }; - version = "3.7.2"; + version = "3.7.5"; }; sprockets-rails = { dependencies = [ @@ -9475,6 +9434,8 @@ src: { "imagen" "rainbow" "rugged" + "simplecov" + "simplecov_json_formatter" ]; groups = [ "coverage" @@ -9484,10 +9445,10 @@ src: { platforms = [ ]; source = { remotes = [ "https://rubygems.org" ]; - sha256 = "06pc56qly4c8ygwg9hyay1vmxq75clm62ljw0s9ljamm57qzqd1w"; + sha256 = "0kd7rk9qf9gx53i8jrkc1fjl2bjjxyw9cd1i784ipnfl3dc0da8s"; type = "gem"; }; - version = "0.6.4"; + version = "0.7.0"; }; unf = { dependencies = [ "unf_ext" ]; From b72bcc3aa55a2945028fbf0b8108e931cc6ac328 Mon Sep 17 00:00:00 2001 From: Benjamin Sparks Date: Tue, 22 Jul 2025 12:10:59 +0200 Subject: [PATCH 54/60] python3Packages.ffmpy: refactor Prefer lib.getExe over hardcoding the ffmpeg binary path, Move comments out of patches --- pkgs/development/python-modules/ffmpy/default.nix | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/pkgs/development/python-modules/ffmpy/default.nix b/pkgs/development/python-modules/ffmpy/default.nix index c5c0a27be5be..884899fc994e 100644 --- a/pkgs/development/python-modules/ffmpy/default.nix +++ b/pkgs/development/python-modules/ffmpy/default.nix @@ -25,14 +25,15 @@ buildPythonPackage rec { }; postPatch = + # Default to store ffmpeg. '' - # default to store ffmpeg substituteInPlace ffmpy/ffmpy.py \ --replace-fail \ 'executable: str = "ffmpeg",' \ - 'executable: str = "${ffmpeg-headless}/bin/ffmpeg",' - - # The tests test a mock that does not behave like ffmpeg. If we default to the nix-store ffmpeg they fail. + 'executable: str = "${lib.getExe ffmpeg-headless}",' + '' + # The tests test a mock that does not behave like ffmpeg. If we default to the nix-store ffmpeg they fail. + + '' for fname in tests/*.py; do echo >>"$fname" 'FFmpeg.__init__.__defaults__ = ("ffmpeg", *FFmpeg.__init__.__defaults__[1:])' done From 06e427292c06e875f251c6397173baf79c41a439 Mon Sep 17 00:00:00 2001 From: "R. RyanTM" Date: Tue, 22 Jul 2025 20:25:53 +1000 Subject: [PATCH 55/60] home-assistant-custom-lovelace-modules.advanced-camera-card: 7.14.2 -> 7.14.3 (#427370 ) https://github.com/dermotduffy/advanced-camera-card/releases/tag/v7.14.3 --- .../custom-lovelace-modules/advanced-camera-card/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/servers/home-assistant/custom-lovelace-modules/advanced-camera-card/package.nix b/pkgs/servers/home-assistant/custom-lovelace-modules/advanced-camera-card/package.nix index 4f834e41bbdb..e305b5da1298 100644 --- a/pkgs/servers/home-assistant/custom-lovelace-modules/advanced-camera-card/package.nix +++ b/pkgs/servers/home-assistant/custom-lovelace-modules/advanced-camera-card/package.nix @@ -6,11 +6,11 @@ stdenv.mkDerivation rec { pname = "advanced-camera-card"; - version = "7.14.2"; + version = "7.14.3"; src = fetchzip { url = "https://github.com/dermotduffy/advanced-camera-card/releases/download/v${version}/advanced-camera-card.zip"; - hash = "sha256-I4ZrkhrwP+b7IHNWbGpGPmlH9CP7o2mFTfN5J1fOY/E="; + hash = "sha256-pbca+z0abg2aeffBZ3yqfz7nbR+sqQgvRUML2DH0tIY="; }; # TODO: build from source once yarn berry support lands in nixpkgs From 24e9218ae92faaf24fee57f2290d61abe3d8afc4 Mon Sep 17 00:00:00 2001 From: liberodark Date: Tue, 22 Jul 2025 12:13:44 +0200 Subject: [PATCH 56/60] otio: init at 0.17.0 --- pkgs/by-name/ot/otio/package.nix | 48 ++++++++++++++++++++++++++++++++ 1 file changed, 48 insertions(+) create mode 100644 pkgs/by-name/ot/otio/package.nix diff --git a/pkgs/by-name/ot/otio/package.nix b/pkgs/by-name/ot/otio/package.nix new file mode 100644 index 000000000000..8b5f3edffd1d --- /dev/null +++ b/pkgs/by-name/ot/otio/package.nix @@ -0,0 +1,48 @@ +{ + lib, + stdenv, + cmake, + fetchFromGitHub, + imath, + python3, + rapidjson, +}: + +stdenv.mkDerivation (finalAttrs: { + pname = "otio"; + version = "0.17.0"; + + src = fetchFromGitHub { + owner = "AcademySoftwareFoundation"; + repo = "OpenTimelineIO"; + tag = "v${finalAttrs.version}"; + sha256 = "sha256-53KXjbhHxuEtu6iRGWrirvFamuZ/WbOTcKCfs1iqKmM="; + }; + + nativeBuildInputs = [ + cmake + python3 + ]; + + buildInputs = [ + imath + rapidjson + ]; + + cmakeFlags = [ + (lib.cmakeBool "OTIO_PYTHON_INSTALL" false) + (lib.cmakeBool "OTIO_DEPENDENCIES_INSTALL" false) + (lib.cmakeBool "OTIO_FIND_IMATH" true) + (lib.cmakeBool "OTIO_SHARED_LIBS" true) + (lib.cmakeBool "OTIO_AUTOMATIC_SUBMODULES" false) + ]; + + meta = { + description = "Interchange format and API for editorial cut information"; + homepage = "http://opentimeline.io/"; + changelog = "https://github.com/AcademySoftwareFoundation/OpenTimelineIO/releases/tag/v${finalAttrs.version}"; + license = lib.licenses.asl20; + maintainers = with lib.maintainers; [ liberodark ]; + platforms = lib.platforms.linux; + }; +}) From 35a30439d4f8066321e668f3e4ba5a6a6092b458 Mon Sep 17 00:00:00 2001 From: teutat3s <10206665+teutat3s@users.noreply.github.com> Date: Fri, 4 Jul 2025 15:50:59 +0200 Subject: [PATCH 57/60] electron{,-bin,-chromedriver}: 35 -> 37 --- pkgs/top-level/all-packages.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index 63e939840e1b..bdbc642c239a 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -6855,9 +6855,9 @@ with pkgs; electron-source.electron_37 else electron_37-bin; - electron = electron_35; - electron-bin = electron_35-bin; - electron-chromedriver = electron-chromedriver_35; + electron = electron_37; + electron-bin = electron_37-bin; + electron-chromedriver = electron-chromedriver_37; autoconf = callPackage ../development/tools/misc/autoconf { }; autoconf213 = callPackage ../development/tools/misc/autoconf/2.13.nix { }; From 0a243bd7a3495f5b605eb299597eda7f84648abd Mon Sep 17 00:00:00 2001 From: Yaya Date: Sun, 13 Jul 2025 12:26:57 +0200 Subject: [PATCH 58/60] cherry-studio: pin electron_35 Upstream `package.json` pins the electron release to v35 and it does not build successfully with newer releases. --- pkgs/by-name/ch/cherry-studio/package.nix | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/pkgs/by-name/ch/cherry-studio/package.nix b/pkgs/by-name/ch/cherry-studio/package.nix index 432aade4a5c5..c380e4bc42f3 100644 --- a/pkgs/by-name/ch/cherry-studio/package.nix +++ b/pkgs/by-name/ch/cherry-studio/package.nix @@ -5,7 +5,7 @@ yarn-berry_4, nodejs, python3, - electron, + electron_35, makeWrapper, writableTmpDirAsHomeHook, makeDesktopItem, @@ -14,6 +14,7 @@ }: let + electron = electron_35; yarn-berry = yarn-berry_4; in stdenv.mkDerivation (finalAttrs: { From 2a7784da9782c91aab0049d0f38130d448df0df3 Mon Sep 17 00:00:00 2001 From: Yaya Date: Sun, 13 Jul 2025 12:32:45 +0200 Subject: [PATCH 59/60] gfn-electron: pin electron_35 It does not build with newer releases of electron yet. --- pkgs/by-name/gf/gfn-electron/package.nix | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/pkgs/by-name/gf/gfn-electron/package.nix b/pkgs/by-name/gf/gfn-electron/package.nix index 576a87024575..ccddb1b12b05 100644 --- a/pkgs/by-name/gf/gfn-electron/package.nix +++ b/pkgs/by-name/gf/gfn-electron/package.nix @@ -2,12 +2,13 @@ lib, buildNpmPackage, fetchFromGitHub, - electron, + electron_35, nix-update-script, makeBinaryWrapper, python3, }: let + electron = electron_35; version = "2.2.0"; in buildNpmPackage { From 39bb74e8e19ac19f16fbcf99d91418ca886cde90 Mon Sep 17 00:00:00 2001 From: teutat3s <10206665+teutat3s@users.noreply.github.com> Date: Tue, 22 Jul 2025 12:19:04 +0200 Subject: [PATCH 60/60] httptoolkit: pin electron_35 It does not build with newer releases of electron yet. --- pkgs/by-name/ht/httptoolkit/package.nix | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/ht/httptoolkit/package.nix b/pkgs/by-name/ht/httptoolkit/package.nix index 2ee5de0eefad..71bb4d1dc716 100644 --- a/pkgs/by-name/ht/httptoolkit/package.nix +++ b/pkgs/by-name/ht/httptoolkit/package.nix @@ -6,10 +6,12 @@ makeWrapper, makeDesktopItem, copyDesktopItems, - electron, + electron_35, httptoolkit-server, }: - +let + electron = electron_35; +in buildNpmPackage rec { pname = "httptoolkit"; version = "1.20.1";