gador/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'origin/master' into staging-next

Browse Source
This commit is contained in:
K900
2025-10-14 11:45:17 +03:00
parent c777510284 0b00566d72
commit ac05cbcaa7
20 changed files with 351 additions and 256 deletions
Download Patch File Download Diff File Expand all files Collapse all files
nixos/modules/services/web-servers/nginx/default.nix
+187 -149
View File
@@ -1491,164 +1491,202 @@ in
};
};
systemd.services.nginx = {
description = "Nginx Web Server";
wantedBy = [ "multi-user.target" ];
wants = concatLists (map (certName: [ "acme-${certName}.service" ]) vhostCertNames);
after = [
"network.target"
]
# Ensure nginx runs with baseline certificates in place.
++ map (certName: "acme-${certName}.service") vhostCertNames;
# Ensure nginx runs (with current config) before the actual ACME jobs run
before = map (certName: "acme-order-renew-${certName}.service") vhostCertNames;
stopIfChanged = false;
preStart = ''
${cfg.preStart}
${execCommand} -t
'';
systemd.services = {
nginx = {
description = "Nginx Web Server";
wantedBy = [ "multi-user.target" ];
wants = lib.optionals (!cfg.enableReload) (
concatLists (map (certName: [ "acme-${certName}.service" ]) vhostCertNames)
);
after = [
"network.target"
]
# Ensure nginx runs with baseline certificates in place.
++ lib.optionals (!cfg.enableReload) (map (certName: "acme-${certName}.service") vhostCertNames);
# Ensure nginx runs (with current config) before the actual ACME jobs run
before = lib.optionals (!cfg.enableReload) (
map (certName: "acme-order-renew-${certName}.service") vhostCertNames
);
stopIfChanged = false;
preStart = ''
${cfg.preStart}
${execCommand} -t
'';
startLimitIntervalSec = 60;
serviceConfig = {
ExecStart = execCommand;
ExecReload = [
"${execCommand} -t"
"${pkgs.coreutils}/bin/kill -HUP $MAINPID"
];
Restart = "always";
RestartSec = "10s";
# User and group
User = cfg.user;
Group = cfg.group;
# Runtime directory and mode
RuntimeDirectory = "nginx";
RuntimeDirectoryMode = "0750";
# Cache directory and mode
CacheDirectory = "nginx";
CacheDirectoryMode = "0750";
# Logs directory and mode
LogsDirectory = "nginx";
LogsDirectoryMode = "0750";
# Proc filesystem
ProcSubset = "pid";
ProtectProc = "invisible";
# New file permissions
UMask = "0027"; # 0640 / 0750
# Capabilities
AmbientCapabilities = [
"CAP_NET_BIND_SERVICE"
"CAP_SYS_RESOURCE"
]
++ optionals cfg.enableQuicBPF [
"CAP_SYS_ADMIN"
"CAP_NET_ADMIN"
];
CapabilityBoundingSet = [
"CAP_NET_BIND_SERVICE"
"CAP_SYS_RESOURCE"
]
++ optionals cfg.enableQuicBPF [
"CAP_SYS_ADMIN"
"CAP_NET_ADMIN"
];
# Security
NoNewPrivileges = true;
# Sandboxing (sorted by occurrence in https://www.freedesktop.org/software/systemd/man/systemd.exec.html)
ProtectSystem = "strict";
ProtectHome = mkDefault true;
PrivateTmp = true;
PrivateDevices = true;
ProtectHostname = true;
ProtectClock = true;
ProtectKernelTunables = true;
ProtectKernelModules = true;
ProtectKernelLogs = true;
ProtectControlGroups = true;
RestrictAddressFamilies = [
"AF_UNIX"
"AF_INET"
"AF_INET6"
];
RestrictNamespaces = true;
LockPersonality = true;
MemoryDenyWriteExecute =
!(
(builtins.any (mod: (mod.allowMemoryWriteExecute or false)) cfg.package.modules)
|| (cfg.package == pkgs.openresty)
);
RestrictRealtime = true;
RestrictSUIDSGID = true;
RemoveIPC = true;
PrivateMounts = true;
# System Call Filtering
SystemCallArchitectures = "native";
SystemCallFilter = [
"~@cpu-emulation @debug @keyring @mount @obsolete @privileged @setuid"
]
++ optional cfg.enableQuicBPF [ "bpf" ];
startLimitIntervalSec = 60;
serviceConfig = {
ExecStart = execCommand;
ExecReload = [
"${execCommand} -t"
"${pkgs.coreutils}/bin/kill -HUP $MAINPID"
];
Restart = "always";
RestartSec = "10s";
# User and group
User = cfg.user;
Group = cfg.group;
# Runtime directory and mode
RuntimeDirectory = "nginx";
RuntimeDirectoryMode = "0750";
# Cache directory and mode
CacheDirectory = "nginx";
CacheDirectoryMode = "0750";
# Logs directory and mode
LogsDirectory = "nginx";
LogsDirectoryMode = "0750";
# Proc filesystem
ProcSubset = "pid";
ProtectProc = "invisible";
# New file permissions
UMask = "0027"; # 0640 / 0750
# Capabilities
AmbientCapabilities = [
"CAP_NET_BIND_SERVICE"
"CAP_SYS_RESOURCE"
]
++ optionals cfg.enableQuicBPF [
"CAP_SYS_ADMIN"
"CAP_NET_ADMIN"
];
CapabilityBoundingSet = [
"CAP_NET_BIND_SERVICE"
"CAP_SYS_RESOURCE"
]
++ optionals cfg.enableQuicBPF [
"CAP_SYS_ADMIN"
"CAP_NET_ADMIN"
];
# Security
NoNewPrivileges = true;
# Sandboxing (sorted by occurrence in https://www.freedesktop.org/software/systemd/man/systemd.exec.html)
ProtectSystem = "strict";
ProtectHome = mkDefault true;
PrivateTmp = true;
PrivateDevices = true;
ProtectHostname = true;
ProtectClock = true;
ProtectKernelTunables = true;
ProtectKernelModules = true;
ProtectKernelLogs = true;
ProtectControlGroups = true;
RestrictAddressFamilies = [
"AF_UNIX"
"AF_INET"
"AF_INET6"
];
RestrictNamespaces = true;
LockPersonality = true;
MemoryDenyWriteExecute =
!(
(builtins.any (mod: (mod.allowMemoryWriteExecute or false)) cfg.package.modules)
|| (cfg.package == pkgs.openresty)
);
RestrictRealtime = true;
RestrictSUIDSGID = true;
RemoveIPC = true;
PrivateMounts = true;
# System Call Filtering
SystemCallArchitectures = "native";
SystemCallFilter = [
"~@cpu-emulation @debug @keyring @mount @obsolete @privileged @setuid"
]
++ optional cfg.enableQuicBPF [ "bpf" ];
};
};
};
# This service waits for all certificates to be available
# before reloading nginx configuration.
# sslTargets are added to wantedBy + before
# which allows the acme-order-renew-$cert.service to signify the successful updating
# of certs end-to-end.
nginx-config-reload =
let
sslServices = map (certName: "acme-${certName}.service") vhostCertNames;
sslOrderRenewServices = map (certName: "acme-order-renew-${certName}.service") vhostCertNames;
in
mkIf (cfg.enableReload || vhostCertNames != [ ]) {
wants = optionals cfg.enableReload [ "nginx.service" ];
# Reload config directly after the self-signed certificates have been requested
# This is required for HTTP-01 ACME challenges, as the vHost with `.well-known/acme-challenge`
# must already exist. Another reload with the actual certificate is triggered
# with `security.acme.certs.<...>.reloadServices`
wantedBy = [ "multi-user.target" ] ++ optionals cfg.enableReload sslServices;
after = optionals cfg.enableReload sslServices;
before = optionals cfg.enableReload sslOrderRenewServices;
restartTriggers = optionals cfg.enableReload [ configFile ];
# Block reloading if not all certs exist yet.
# Happens when config changes add new vhosts/certs.
unitConfig = {
ConditionPathExists = optionals (vhostCertNames != [ ]) (
map (certName: certs.${certName}.directory + "/fullchain.pem") vhostCertNames
);
# Disable rate limiting for this, because it may be triggered quickly a bunch of times
# if a lot of certificates are renewed in quick succession. The reload itself is cheap,
# so even doing a lot of them in a short burst is fine.
# FIXME: there's probably a better way to do this.
StartLimitIntervalSec = 0;
};
serviceConfig = {
Type = "oneshot";
TimeoutSec = 60;
ExecCondition = "/run/current-system/systemd/bin/systemctl -q is-active nginx.service";
ExecStart = "/run/current-system/systemd/bin/systemctl reload nginx.service";
};
};
}
# When reload is enabled, add the systemd dependency to the acme unit to prevent restarts
# of the nginx.service unit.
# This needs to be here, because of how switch-to-configuration works in the case that nginx.service
# is not started at the moment where new certificates are requested.
# Configuring this relationship in nginx.service would lead to s-t-c restarting nginx.service
# when a new certificate is added, as it will restart a unit when their direct unit properties,
# including After and Wants, change.
// lib.optionalAttrs cfg.enableReload (
lib.listToAttrs (
map (
name:
lib.nameValuePair "acme-${name}" {
before = [ "nginx.service" ];
wantedBy = [ "nginx.service" ];
}
) vhostCertNames
)
);
environment.etc."nginx/nginx.conf" = mkIf cfg.enableReload {
source = configFile;
};
# This service waits for all certificates to be available
# before reloading nginx configuration.
# sslTargets are added to wantedBy + before
# which allows the acme-order-renew-$cert.service to signify the successful updating
# of certs end-to-end.
systemd.services.nginx-config-reload =
let
sslOrderRenewServices = map (certName: "acme-order-renew-${certName}.service") vhostCertNames;
in
mkIf (cfg.enableReload || vhostCertNames != [ ]) {
wants = optionals cfg.enableReload [ "nginx.service" ];
wantedBy = sslOrderRenewServices ++ [ "multi-user.target" ];
# XXX Before the finished targets, after the renew services.
# This service might be needed for HTTP-01 challenges, but we only want to confirm
# certs are updated _after_ config has been reloaded.
after = sslOrderRenewServices;
restartTriggers = optionals cfg.enableReload [ configFile ];
# Block reloading if not all certs exist yet.
# Happens when config changes add new vhosts/certs.
unitConfig = {
ConditionPathExists = optionals (vhostCertNames != [ ]) (
map (certName: certs.${certName}.directory + "/fullchain.pem") vhostCertNames
);
# Disable rate limiting for this, because it may be triggered quickly a bunch of times
# if a lot of certificates are renewed in quick succession. The reload itself is cheap,
# so even doing a lot of them in a short burst is fine.
# FIXME: there's probably a better way to do this.
StartLimitIntervalSec = 0;
};
serviceConfig = {
Type = "oneshot";
TimeoutSec = 60;
ExecCondition = "/run/current-system/systemd/bin/systemctl -q is-active nginx.service";
ExecStart = "/run/current-system/systemd/bin/systemctl reload nginx.service";
};
};
security.acme.certs =
let
acmePairs = map (
vhostConfig:
let
hasRoot = vhostConfig.acmeRoot != null;
in
nameValuePair vhostConfig.serverName {
group = mkDefault cfg.group;
# if acmeRoot is null inherit config.security.acme
# Since config.security.acme.certs.<cert>.webroot's own default value
# should take precedence set priority higher than mkOptionDefault
webroot = mkOverride (if hasRoot then 1000 else 2000) vhostConfig.acmeRoot;
# Also nudge dnsProvider to null in case it is inherited
dnsProvider = mkOverride (if hasRoot then 1000 else 2000) null;
extraDomainNames = vhostConfig.serverAliases;
# Filter for enableACME-only vhosts. Don't want to create dud certs
}
) (filter (vhostConfig: vhostConfig.useACMEHost == null) acmeEnabledVhosts);
# Here are two cases:
# - when no `useACMEHost` is set, the `serverName` acme certificate is the primary name and we need to configure it
# - when `useACMEHost` is set, this is also the primary name and we only need to configure the reloadServices property
acmePairs =
map (
vhostConfig:
let
hasRoot = vhostConfig.acmeRoot != null;
in
nameValuePair vhostConfig.serverName {
reloadServices = [ "nginx.service" ];
group = mkDefault cfg.group;
# if acmeRoot is null inherit config.security.acme
# Since config.security.acme.certs.<cert>.webroot's own default value
# should take precedence set priority higher than mkOptionDefault
webroot = mkOverride (if hasRoot then 1000 else 2000) vhostConfig.acmeRoot;
# Also nudge dnsProvider to null in case it is inherited
dnsProvider = mkOverride (if hasRoot then 1000 else 2000) null;
extraDomainNames = vhostConfig.serverAliases;
# Filter for enableACME-only vhosts. Don't want to create dud certs
}
) (filter (vhostConfig: vhostConfig.useACMEHost == null) acmeEnabledVhosts)
++ map (
vhostConfig:
nameValuePair vhostConfig.useACMEHost {
reloadServices = [ "nginx.service" ];
}
) (filter (vhostConfig: vhostConfig.useACMEHost != null) acmeEnabledVhosts);
in
listToAttrs acmePairs;
nixos/tests/acme/default.nix
+33 -21
View File
@@ -1,6 +1,26 @@
{ runTest }:
{ lib, runTest }:
let
domain = "example.test";
nginxBaseModule = {
services.nginx = {
enable = true;
logError = "stderr info";
# This tests a number of things at once:
# - Self-signed certs are in place before the webserver startup
# - Nginx is started before acme renewal is attempted
# - useACMEHost behaves as expected
# - acmeFallbackHost behaves as expected
virtualHosts.default = {
default = true;
addSSL = true;
useACMEHost = "proxied.example.test";
acmeFallbackHost = "localhost:8080";
};
};
specialisation.nullroot.configuration = {
services.nginx.virtualHosts."nullroot.${domain}".acmeFallbackHost = "localhost:8081";
};
};
in
{
http01-builtin = runTest ./http01-builtin.nix;
@@ -11,26 +31,18 @@ in
inherit domain;
serverName = "nginx";
group = "nginx";
baseModule = {
services.nginx = {
enable = true;
enableReload = true;
logError = "stderr info";
# This tests a number of things at once:
# - Self-signed certs are in place before the webserver startup
# - Nginx is started before acme renewal is attempted
# - useACMEHost behaves as expected
# - acmeFallbackHost behaves as expected
virtualHosts.default = {
default = true;
addSSL = true;
useACMEHost = "proxied.example.test";
acmeFallbackHost = "localhost:8080";
};
};
specialisation.nullroot.configuration = {
services.nginx.virtualHosts."nullroot.${domain}".acmeFallbackHost = "localhost:8081";
};
baseModule = lib.recursiveUpdate nginxBaseModule {
services.nginx.enableReload = true;
};
}
);
nginx-without-reload = runTest (
import ./webserver.nix {
inherit domain;
serverName = "nginx";
group = "nginx";
baseModule = lib.recursiveUpdate nginxBaseModule {
services.nginx.enableReload = false;
};
}
);
nixos/tests/acme/webserver.nix
+14 -1
View File
@@ -226,5 +226,18 @@
# Ensure the timer works, due to our shenanigans with
# RemainAfterExit=true
webserver.wait_until_succeeds(f"journalctl --cursor-file=/tmp/cursor | grep 'Starting Order (and renew) ACME certificate for zeroconf3.{domain}...'")
'';
''
+
lib.optionalString
(config.nodes.webserver.services.nginx.enable && config.nodes.webserver.services.nginx.enableReload)
''
with subtest("Ensure that adding a second vhost does not restart nginx"):
switch_to(webserver, "zeroconf")
webserver.wait_for_unit("renew-triggered.target")
webserver.succeed("journalctl --cursor-file=/tmp/cursor")
switch_to(webserver, "zeroconf3")
webserver.wait_for_unit("renew-triggered.target")
output = webserver.succeed("journalctl --cursor-file=/tmp/cursor")
t.assertNotIn("Stopping Nginx Web Server...", output)
'';
}
nixos/tests/all-tests.nix
+4 -1
View File
@@ -183,7 +183,10 @@ in
# keep-sorted start case=no numeric=no block=yes
_3proxy = runTest ./3proxy.nix;
aaaaxy = runTest ./aaaaxy.nix;
acme = import ./acme/default.nix { inherit runTest; };
acme = import ./acme/default.nix {
inherit runTest;
inherit (pkgs) lib;
};
acme-dns = runTest ./acme-dns.nix;
activation = pkgs.callPackage ../modules/system/activation/test.nix { };
activation-bashless = runTest ./activation/bashless.nix;
pkgs/applications/emulators/libretro/cores/mgba.nix
+3 -3
View File
@@ -5,13 +5,13 @@
}:
mkLibretroCore {
core = "mgba";
version = "0-unstable-2025-07-24";
version = "0-unstable-2025-10-13";
src = fetchFromGitHub {
owner = "libretro";
repo = "mgba";
rev = "affc86e4c07b6e1e8363e0bc1c5ffb813a2e32c9";
hash = "sha256-4nKghnpMI1LuKOKc0vSknTuq+bA0wpBux/a5mGCyev8=";
rev = "c758314a639aa0066e7b65a8341448181b73c804";
hash = "sha256-ev0vzLqZzOr5RW/jf07vXtBmYkcB2m+afADHFBH5zbQ=";
};
meta = {
pkgs/by-name/bi/biome/package.nix
+3 -3
View File
@@ -10,16 +10,16 @@
}:
rustPlatform.buildRustPackage (finalAttrs: {
pname = "biome";
version = "2.2.5";
version = "2.2.6";
src = fetchFromGitHub {
owner = "biomejs";
repo = "biome";
rev = "@biomejs/biome@${finalAttrs.version}";
hash = "sha256-9TOeoog0jpNFyS4vv3dhui7Unil/AmPjmrOaJjcwpfY=";
hash = "sha256-5QxcKVo6niV+K63JRBhs6/RUR6jru20f+DeitfqEuRI=";
};
cargoHash = "sha256-X9I2XmDvpRdXTFGwKpuI2mDSQ1//OseosUy52vykGlY=";
cargoHash = "sha256-/POhRQ2HIaBwk9VeMdkK7dAZ90EmB49oCvQEUScgjpY=";
nativeBuildInputs = [ pkg-config ];
pkgs/by-name/la/lavacli/package.nix
+2 -2
View File
@@ -6,14 +6,14 @@
python3.pkgs.buildPythonApplication rec {
pname = "lavacli";
version = "2.4";
version = "2.5";
pyproject = true;
src = fetchFromGitLab {
owner = "lava";
repo = "lavacli";
tag = "v${version}";
hash = "sha256-KNq+UNOC3N+p0HOed2Mdh9EIXLQccH+aepdfJ59Z2oM=";
hash = "sha256-VEUjqelhqUD6NTiWTtl9gAYzJDQzgP7NpxDyloYEmGU=";
};
build-system = with python3.pkgs; [
pkgs/by-name/lt/ltex-ls-plus/package.nix
+2 -2
View File
@@ -9,11 +9,11 @@
stdenvNoCC.mkDerivation rec {
pname = "ltex-ls-plus";
version = "18.5.1";
version = "18.6.0";
src = fetchurl {
url = "https://github.com/ltex-plus/ltex-ls-plus/releases/download/${version}/ltex-ls-plus-${version}.tar.gz";
sha256 = "sha256-kSs/0Hi9G5l632+dqxGhlvMJCizzKFY/dq7UyAr3uss=";
sha256 = "sha256-T5ZUQHOjP3V0Xebi6elcjYEuiDtFg5fd+kwrubjWFoU=";
};
nativeBuildInputs = [ makeBinaryWrapper ];
pkgs/by-name/md/mdfried/package.nix
+3 -3
View File
@@ -6,16 +6,16 @@
rustPlatform.buildRustPackage (finalAttrs: {
pname = "mdfried";
version = "0.12.6";
version = "0.12.9";
src = fetchFromGitHub {
owner = "benjajaja";
repo = "mdfried";
tag = "v${finalAttrs.version}";
hash = "sha256-0xfdVZLqjlBvlpQYAYVTR2tAn6IjD0rgEBScYe5L4g4=";
hash = "sha256-0vAPUmG11Qvds3g2iaH7umZpo4b2/Dtvcm6I8WfM8jw=";
};
cargoHash = "sha256-jDv6H846Po4Q4ungaC7e/311dgQ8M1L/bQayR5NgZv4=";
cargoHash = "sha256-3jx4sIXETEsgTBcTTbedEv0BXoSejLe4oEaudhQIN6s=";
doCheck = true;
pkgs/by-name/se/searxng/package.nix
+4 -3
View File
@@ -13,14 +13,14 @@ in
python.pkgs.toPythonModule (
python.pkgs.buildPythonApplication rec {
pname = "searxng";
version = "0-unstable-2025-09-11";
version = "0-unstable-2025-10-13";
pyproject = true;
src = fetchFromGitHub {
owner = "searxng";
repo = "searxng";
rev = "7c1ebc01489a5b96d4abb0ad9c1180701eb4456c";
hash = "sha256-nOIt4PyO6DALz7gw5Hh1w1ZDyEAsQAVp4O/eFOLYZ0A=";
rev = "c34bb612847ce4584f65077b104164993bfa88c5";
hash = "sha256-vs64ue9bI86kCrOUdy8Kddd2GTIYmveyy1XunEqPAtw=";
};
nativeBuildInputs = with python.pkgs; [ pythonRelaxDepsHook ];
@@ -33,6 +33,7 @@ python.pkgs.toPythonModule (
"lxml"
"setproctitle"
"typer-slim"
"typing-extensions"
"whitenoise"
];
pkgs/by-name/ve/versatiles/package.nix
+3 -3
View File
@@ -6,16 +6,16 @@
rustPlatform.buildRustPackage rec {
pname = "versatiles";
version = "0.15.7"; # When updating: Replace with current version
version = "1.0.1"; # When updating: Replace with current version
src = fetchFromGitHub {
owner = "versatiles-org";
repo = "versatiles-rs";
tag = "v${version}"; # When updating: Replace with long commit hash of new version
hash = "sha256-E0CWhNaaIfBZsRYcZ2FzWW6HhBRVolY/Lfr1ru+sikQ="; # When updating: Use `lib.fakeHash` for recomputing the hash once. Run: 'nix-build -A versatiles'. Swap with new hash and proceed.
hash = "sha256-Byc8w1NCJbLPInXgva41CO2SnqWRubXeELJLlMFf54k="; # When updating: Use `lib.fakeHash` for recomputing the hash once. Run: 'nix-build -A versatiles'. Swap with new hash and proceed.
};
cargoHash = "sha256-1ZC1MLPfh9E36dxF23Fd0668m3c4cKRD+TJTF1h7ph8="; # When updating: Same as above
cargoHash = "sha256-kWRzxaGDVV3FuVrg+hqpCHPvbCQ0KMO1luCgNiNHYeg="; # When updating: Same as above
__darwinAllowLocalNetworking = true;
pkgs/development/compilers/go/1.24.nix
+2 -2
View File
@@ -27,11 +27,11 @@ let
in
stdenv.mkDerivation (finalAttrs: {
pname = "go";
version = "1.24.8";
version = "1.24.9";
src = fetchurl {
url = "https://go.dev/dl/go${finalAttrs.version}.src.tar.gz";
hash = "sha256-sf8yxcSlDd+hoct4tg3Vo2KushhLt48Ai0JbYglXVfs=";
hash = "sha256-xy+BulT+AO/n8+dJnUAJeSRogbE7d16am7hVQcEb5pU=";
};
strictDeps = true;
pkgs/development/ocaml-modules/dockerfile/default.nix
+42
View File
@@ -0,0 +1,42 @@
{
lib,
buildDunePackage,
fetchFromGitHub,
fmt,
ppx_sexp_conv,
sexplib,
alcotest,
}:
buildDunePackage rec {
pname = "dockerfile";
version = "8.3.2";
src = fetchFromGitHub {
owner = "ocurrent";
repo = "ocaml-dockerfile";
tag = version;
hash = "sha256-L4TjCf8SaNMxqkrr+AoL/Lx2oWgf2owJFs26lu68ejs=";
};
propagatedBuildInputs = [
fmt
ppx_sexp_conv
sexplib
];
checkInputs = [
alcotest
];
doCheck = true;
meta = {
description = "Interface for creating Dockerfiles";
homepage = "https://www.ocurrent.org/ocaml-dockerfile/dockerfile/Dockerfile/index.html";
downloadPage = "https://github.com/ocurrent/ocaml-dockerfile";
changelog = "https://github.com/ocurrent/ocaml-dockerfile/blob/v${version}/CHANGES.md";
license = lib.licenses.isc;
maintainers = [ lib.maintainers.ethancedwards8 ];
};
}
pkgs/development/ocaml-modules/ocamlnat/default.nix
-57
View File
@@ -1,57 +0,0 @@
{
stdenv,
lib,
fetchurl,
ocaml,
findlib,
ounit,
}:
# https://github.com/bmeurer/ocamlnat/issues/3
assert lib.versionOlder ocaml.version "4";
stdenv.mkDerivation rec {
pname = "ocamlnat";
version = "0.1.1";
src = fetchurl {
url = "http://benediktmeurer.de/files/source/${pname}-${version}.tar.bz2";
sha256 = "0dyvy0j6f47laxhnadvm71z1py9hz9zd49hamf6bij99cggb2ij1";
};
nativeBuildInputs = [
ocaml
findlib
];
checkInputs = [ ounit ];
strictDeps = true;
prefixKey = "--prefix ";
doCheck = true;
checkTarget = "test";
createFindlibDestdir = true;
meta = {
description = "OCaml native toplevel";
homepage = "http://benediktmeurer.de/ocamlnat/";
license = lib.licenses.qpl;
longDescription = ''
The ocamlnat project provides a new native code OCaml toplevel
ocamlnat, which is mostly compatible to the byte code toplevel ocaml,
but up to 100 times faster. It is based on the optimizing native code
compiler, the native runtime and an earlier prototype by Alain
Frisch. It is build upon Just-In-Time techniques and currently
supports Unix-like systems (i.e. Linux, BSD or macOS) running on
x86 or x86-64 processors. Support for additional architectures and
operating systems is planned, but not yet available.
'';
inherit (ocaml.meta) platforms;
maintainers = [
lib.maintainers.maggesi
];
};
}
pkgs/development/python-modules/pytest-check/default.nix
+2 -2
View File
@@ -9,13 +9,13 @@
buildPythonPackage rec {
pname = "pytest-check";
version = "2.5.4";
version = "2.6.0";
pyproject = true;
src = fetchPypi {
pname = "pytest_check";
inherit version;
hash = "sha256-M9h+KNXkkhf0Eyd+Hg0mfNZskKhaIIlExEMSycjk/3Q=";
hash = "sha256-m+TFmgmCcSkQkUjIXXtZZLV/ClztG2GUWcow5vRjykI=";
};
build-system = [ hatchling ];
pkgs/development/python-modules/timelength/default.nix
+40
View File
@@ -0,0 +1,40 @@
{
lib,
fetchFromGitHub,
buildPythonPackage,
pytestCheckHook,
poetry-core,
pytest-mock,
}:
buildPythonPackage rec {
pname = "timelength";
version = "3.0.2";
pyproject = true;
src = fetchFromGitHub {
owner = "EtorixDev";
repo = "timelength";
tag = "v${version}";
hash = "sha256-iaAtDkx6jPPB7s+sTQsrfNFiwerSDZ+7y7C9oNNYEmg=";
};
build-system = [
poetry-core
];
pythonImportsCheck = [ "timelength" ];
nativeCheckInputs = [
pytestCheckHook
pytest-mock
];
meta = {
description = "Flexible python duration parser designed for human readable lengths of time";
homepage = "https://github.com/EtorixDev/timelength/";
changelog = "https://github.com/EtorixDev/timelength/releases/tag/v${version}";
license = lib.licenses.mit;
maintainers = with lib.maintainers; [ vinetos ];
};
}
pkgs/kde/misc/kio-fuse/default.nix
+2 -2
View File
@@ -7,11 +7,11 @@
}:
mkKdeDerivation rec {
pname = "kio-fuse";
version = "5.1.0";
version = "5.1.1";
src = fetchurl {
url = "mirror://kde/stable/kio-fuse/kio-fuse-${version}.tar.xz";
hash = "sha256-fRBFgSJ9Whm0JLM/QWjRgVVrEBXW3yIY4BqI1kRJ6Us=";
hash = "sha256-rfaqfOBVwJh+cWqTrAHzwKl8EoBCFEPNayHg5x12PRQ=";
};
extraNativeBuildInputs = [ pkg-config ];
pkgs/servers/http/nginx/generic.nix
+1
View File
@@ -298,6 +298,7 @@ stdenv.mkDerivation {
;
variants = lib.recurseIntoAttrs nixosTests.nginx-variants;
acme-integration = nixosTests.acme.nginx;
acme-integration-without-reload = nixosTests.acme.nginx-without-reload;
}
// passthru.tests;
};
pkgs/top-level/ocaml-packages.nix
+2 -2
View File
@@ -418,6 +418,8 @@ let
dnssec = callPackage ../development/ocaml-modules/dns/dnssec.nix { };
dockerfile = callPackage ../development/ocaml-modules/dockerfile { };
dolmen = callPackage ../development/ocaml-modules/dolmen { };
dolmen_loop = callPackage ../development/ocaml-modules/dolmen/loop.nix { };
@@ -2227,8 +2229,6 @@ let
hol_light = callPackage ../applications/science/logic/hol_light { };
ocamlnat = callPackage ../development/ocaml-modules/ocamlnat { };
### End ###
}
pkgs/top-level/python-packages.nix
+2
View File
@@ -18442,6 +18442,8 @@ self: super: with self; {
timecop = callPackage ../development/python-modules/timecop { };
timelength = callPackage ../development/python-modules/timelength { };
timelib = callPackage ../development/python-modules/timelib { };
timeout-decorator = callPackage ../development/python-modules/timeout-decorator { };