From b76c36dcdc4502bb5837abeeb505f0e60bef5c90 Mon Sep 17 00:00:00 2001 From: Leona Maroni Date: Mon, 22 Sep 2025 15:18:12 +0200 Subject: [PATCH 01/15] nixos/tests/acme: introduce new test nginx without reload --- nixos/tests/acme/default.nix | 54 ++++++++++++++++++----------- pkgs/servers/http/nginx/generic.nix | 1 + 2 files changed, 34 insertions(+), 21 deletions(-) diff --git a/nixos/tests/acme/default.nix b/nixos/tests/acme/default.nix index 2faca3a0b842..6ec14191c2ed 100644 --- a/nixos/tests/acme/default.nix +++ b/nixos/tests/acme/default.nix @@ -1,6 +1,26 @@ -{ runTest }: +{ lib, runTest }: let domain = "example.test"; + nginxBaseModule = { + services.nginx = { + enable = true; + logError = "stderr info"; + # This tests a number of things at once: + # - Self-signed certs are in place before the webserver startup + # - Nginx is started before acme renewal is attempted + # - useACMEHost behaves as expected + # - acmeFallbackHost behaves as expected + virtualHosts.default = { + default = true; + addSSL = true; + useACMEHost = "proxied.example.test"; + acmeFallbackHost = "localhost:8080"; + }; + }; + specialisation.nullroot.configuration = { + services.nginx.virtualHosts."nullroot.${domain}".acmeFallbackHost = "localhost:8081"; + }; + }; in { http01-builtin = runTest ./http01-builtin.nix; @@ -11,26 +31,18 @@ in inherit domain; serverName = "nginx"; group = "nginx"; - baseModule = { - services.nginx = { - enable = true; - enableReload = true; - logError = "stderr info"; - # This tests a number of things at once: - # - Self-signed certs are in place before the webserver startup - # - Nginx is started before acme renewal is attempted - # - useACMEHost behaves as expected - # - acmeFallbackHost behaves as expected - virtualHosts.default = { - default = true; - addSSL = true; - useACMEHost = "proxied.example.test"; - acmeFallbackHost = "localhost:8080"; - }; - }; - specialisation.nullroot.configuration = { - services.nginx.virtualHosts."nullroot.${domain}".acmeFallbackHost = "localhost:8081"; - }; + baseModule = lib.recursiveUpdate nginxBaseModule { + services.nginx.enableReload = true; + }; + } + ); + nginx-without-reload = runTest ( + import ./webserver.nix { + inherit domain; + serverName = "nginx"; + group = "nginx"; + baseModule = lib.recursiveUpdate nginxBaseModule { + services.nginx.enableReload = false; }; } ); diff --git a/pkgs/servers/http/nginx/generic.nix b/pkgs/servers/http/nginx/generic.nix index ac58212aed82..9e3eaa8548cd 100644 --- a/pkgs/servers/http/nginx/generic.nix +++ b/pkgs/servers/http/nginx/generic.nix @@ -298,6 +298,7 @@ stdenv.mkDerivation { ; variants = lib.recurseIntoAttrs nixosTests.nginx-variants; acme-integration = nixosTests.acme.nginx; + acme-integration-without-reload = nixosTests.acme.nginx-without-reload; } // passthru.tests; }; From b3a76d495ec78b1a7b1a098eaac862d19712bdd5 Mon Sep 17 00:00:00 2001 From: Leona Maroni Date: Mon, 22 Sep 2025 15:18:12 +0200 Subject: [PATCH 02/15] nixos/nginx: allow adding new ACME certificates without nginx restart Currently, nginx gets restarted when adding a new ACME certificate, even when `services.nginx.enableReload = true` because of changes in the Wants/After/Before sections of `nginx.service`. This change moves these dependencies to `nginx-config-reload.service` and the respective ACME systemd units. --- .../services/web-servers/nginx/default.nix | 336 ++++++++++-------- nixos/tests/acme/webserver.nix | 15 +- nixos/tests/all-tests.nix | 5 +- 3 files changed, 205 insertions(+), 151 deletions(-) diff --git a/nixos/modules/services/web-servers/nginx/default.nix b/nixos/modules/services/web-servers/nginx/default.nix index a29ad656cad9..87007b00ecca 100644 --- a/nixos/modules/services/web-servers/nginx/default.nix +++ b/nixos/modules/services/web-servers/nginx/default.nix @@ -1491,164 +1491,202 @@ in }; }; - systemd.services.nginx = { - description = "Nginx Web Server"; - wantedBy = [ "multi-user.target" ]; - wants = concatLists (map (certName: [ "acme-${certName}.service" ]) vhostCertNames); - after = [ - "network.target" - ] - # Ensure nginx runs with baseline certificates in place. - ++ map (certName: "acme-${certName}.service") vhostCertNames; - # Ensure nginx runs (with current config) before the actual ACME jobs run - before = map (certName: "acme-order-renew-${certName}.service") vhostCertNames; - stopIfChanged = false; - preStart = '' - ${cfg.preStart} - ${execCommand} -t - ''; + systemd.services = { + nginx = { + description = "Nginx Web Server"; + wantedBy = [ "multi-user.target" ]; + wants = lib.optionals (!cfg.enableReload) ( + concatLists (map (certName: [ "acme-${certName}.service" ]) vhostCertNames) + ); + after = [ + "network.target" + ] + # Ensure nginx runs with baseline certificates in place. + ++ lib.optionals (!cfg.enableReload) (map (certName: "acme-${certName}.service") vhostCertNames); + # Ensure nginx runs (with current config) before the actual ACME jobs run + before = lib.optionals (!cfg.enableReload) ( + map (certName: "acme-order-renew-${certName}.service") vhostCertNames + ); + stopIfChanged = false; + preStart = '' + ${cfg.preStart} + ${execCommand} -t + ''; - startLimitIntervalSec = 60; - serviceConfig = { - ExecStart = execCommand; - ExecReload = [ - "${execCommand} -t" - "${pkgs.coreutils}/bin/kill -HUP $MAINPID" - ]; - Restart = "always"; - RestartSec = "10s"; - # User and group - User = cfg.user; - Group = cfg.group; - # Runtime directory and mode - RuntimeDirectory = "nginx"; - RuntimeDirectoryMode = "0750"; - # Cache directory and mode - CacheDirectory = "nginx"; - CacheDirectoryMode = "0750"; - # Logs directory and mode - LogsDirectory = "nginx"; - LogsDirectoryMode = "0750"; - # Proc filesystem - ProcSubset = "pid"; - ProtectProc = "invisible"; - # New file permissions - UMask = "0027"; # 0640 / 0750 - # Capabilities - AmbientCapabilities = [ - "CAP_NET_BIND_SERVICE" - "CAP_SYS_RESOURCE" - ] - ++ optionals cfg.enableQuicBPF [ - "CAP_SYS_ADMIN" - "CAP_NET_ADMIN" - ]; - CapabilityBoundingSet = [ - "CAP_NET_BIND_SERVICE" - "CAP_SYS_RESOURCE" - ] - ++ optionals cfg.enableQuicBPF [ - "CAP_SYS_ADMIN" - "CAP_NET_ADMIN" - ]; - # Security - NoNewPrivileges = true; - # Sandboxing (sorted by occurrence in https://www.freedesktop.org/software/systemd/man/systemd.exec.html) - ProtectSystem = "strict"; - ProtectHome = mkDefault true; - PrivateTmp = true; - PrivateDevices = true; - ProtectHostname = true; - ProtectClock = true; - ProtectKernelTunables = true; - ProtectKernelModules = true; - ProtectKernelLogs = true; - ProtectControlGroups = true; - RestrictAddressFamilies = [ - "AF_UNIX" - "AF_INET" - "AF_INET6" - ]; - RestrictNamespaces = true; - LockPersonality = true; - MemoryDenyWriteExecute = - !( - (builtins.any (mod: (mod.allowMemoryWriteExecute or false)) cfg.package.modules) - || (cfg.package == pkgs.openresty) - ); - RestrictRealtime = true; - RestrictSUIDSGID = true; - RemoveIPC = true; - PrivateMounts = true; - # System Call Filtering - SystemCallArchitectures = "native"; - SystemCallFilter = [ - "~@cpu-emulation @debug @keyring @mount @obsolete @privileged @setuid" - ] - ++ optional cfg.enableQuicBPF [ "bpf" ]; + startLimitIntervalSec = 60; + serviceConfig = { + ExecStart = execCommand; + ExecReload = [ + "${execCommand} -t" + "${pkgs.coreutils}/bin/kill -HUP $MAINPID" + ]; + Restart = "always"; + RestartSec = "10s"; + # User and group + User = cfg.user; + Group = cfg.group; + # Runtime directory and mode + RuntimeDirectory = "nginx"; + RuntimeDirectoryMode = "0750"; + # Cache directory and mode + CacheDirectory = "nginx"; + CacheDirectoryMode = "0750"; + # Logs directory and mode + LogsDirectory = "nginx"; + LogsDirectoryMode = "0750"; + # Proc filesystem + ProcSubset = "pid"; + ProtectProc = "invisible"; + # New file permissions + UMask = "0027"; # 0640 / 0750 + # Capabilities + AmbientCapabilities = [ + "CAP_NET_BIND_SERVICE" + "CAP_SYS_RESOURCE" + ] + ++ optionals cfg.enableQuicBPF [ + "CAP_SYS_ADMIN" + "CAP_NET_ADMIN" + ]; + CapabilityBoundingSet = [ + "CAP_NET_BIND_SERVICE" + "CAP_SYS_RESOURCE" + ] + ++ optionals cfg.enableQuicBPF [ + "CAP_SYS_ADMIN" + "CAP_NET_ADMIN" + ]; + # Security + NoNewPrivileges = true; + # Sandboxing (sorted by occurrence in https://www.freedesktop.org/software/systemd/man/systemd.exec.html) + ProtectSystem = "strict"; + ProtectHome = mkDefault true; + PrivateTmp = true; + PrivateDevices = true; + ProtectHostname = true; + ProtectClock = true; + ProtectKernelTunables = true; + ProtectKernelModules = true; + ProtectKernelLogs = true; + ProtectControlGroups = true; + RestrictAddressFamilies = [ + "AF_UNIX" + "AF_INET" + "AF_INET6" + ]; + RestrictNamespaces = true; + LockPersonality = true; + MemoryDenyWriteExecute = + !( + (builtins.any (mod: (mod.allowMemoryWriteExecute or false)) cfg.package.modules) + || (cfg.package == pkgs.openresty) + ); + RestrictRealtime = true; + RestrictSUIDSGID = true; + RemoveIPC = true; + PrivateMounts = true; + # System Call Filtering + SystemCallArchitectures = "native"; + SystemCallFilter = [ + "~@cpu-emulation @debug @keyring @mount @obsolete @privileged @setuid" + ] + ++ optional cfg.enableQuicBPF [ "bpf" ]; + }; }; - }; + + # This service waits for all certificates to be available + # before reloading nginx configuration. + # sslTargets are added to wantedBy + before + # which allows the acme-order-renew-$cert.service to signify the successful updating + # of certs end-to-end. + nginx-config-reload = + let + sslServices = map (certName: "acme-${certName}.service") vhostCertNames; + sslOrderRenewServices = map (certName: "acme-order-renew-${certName}.service") vhostCertNames; + in + mkIf (cfg.enableReload || vhostCertNames != [ ]) { + wants = optionals cfg.enableReload [ "nginx.service" ]; + # Reload config directly after the self-signed certificates have been requested + # This is required for HTTP-01 ACME challenges, as the vHost with `.well-known/acme-challenge` + # must already exist. Another reload with the actual certificate is triggered + # with `security.acme.certs.<...>.reloadServices` + wantedBy = [ "multi-user.target" ] ++ optionals cfg.enableReload sslServices; + after = optionals cfg.enableReload sslServices; + before = optionals cfg.enableReload sslOrderRenewServices; + restartTriggers = optionals cfg.enableReload [ configFile ]; + # Block reloading if not all certs exist yet. + # Happens when config changes add new vhosts/certs. + unitConfig = { + ConditionPathExists = optionals (vhostCertNames != [ ]) ( + map (certName: certs.${certName}.directory + "/fullchain.pem") vhostCertNames + ); + # Disable rate limiting for this, because it may be triggered quickly a bunch of times + # if a lot of certificates are renewed in quick succession. The reload itself is cheap, + # so even doing a lot of them in a short burst is fine. + # FIXME: there's probably a better way to do this. + StartLimitIntervalSec = 0; + }; + serviceConfig = { + Type = "oneshot"; + TimeoutSec = 60; + ExecCondition = "/run/current-system/systemd/bin/systemctl -q is-active nginx.service"; + ExecStart = "/run/current-system/systemd/bin/systemctl reload nginx.service"; + }; + }; + } + # When reload is enabled, add the systemd dependency to the acme unit to prevent restarts + # of the nginx.service unit. + # This needs to be here, because of how switch-to-configuration works in the case that nginx.service + # is not started at the moment where new certificates are requested. + # Configuring this relationship in nginx.service would lead to s-t-c restarting nginx.service + # when a new certificate is added, as it will restart a unit when their direct unit properties, + # including After and Wants, change. + // lib.optionalAttrs cfg.enableReload ( + lib.listToAttrs ( + map ( + name: + lib.nameValuePair "acme-${name}" { + before = [ "nginx.service" ]; + wantedBy = [ "nginx.service" ]; + } + ) vhostCertNames + ) + ); environment.etc."nginx/nginx.conf" = mkIf cfg.enableReload { source = configFile; }; - # This service waits for all certificates to be available - # before reloading nginx configuration. - # sslTargets are added to wantedBy + before - # which allows the acme-order-renew-$cert.service to signify the successful updating - # of certs end-to-end. - systemd.services.nginx-config-reload = - let - sslOrderRenewServices = map (certName: "acme-order-renew-${certName}.service") vhostCertNames; - in - mkIf (cfg.enableReload || vhostCertNames != [ ]) { - wants = optionals cfg.enableReload [ "nginx.service" ]; - wantedBy = sslOrderRenewServices ++ [ "multi-user.target" ]; - # XXX Before the finished targets, after the renew services. - # This service might be needed for HTTP-01 challenges, but we only want to confirm - # certs are updated _after_ config has been reloaded. - after = sslOrderRenewServices; - restartTriggers = optionals cfg.enableReload [ configFile ]; - # Block reloading if not all certs exist yet. - # Happens when config changes add new vhosts/certs. - unitConfig = { - ConditionPathExists = optionals (vhostCertNames != [ ]) ( - map (certName: certs.${certName}.directory + "/fullchain.pem") vhostCertNames - ); - # Disable rate limiting for this, because it may be triggered quickly a bunch of times - # if a lot of certificates are renewed in quick succession. The reload itself is cheap, - # so even doing a lot of them in a short burst is fine. - # FIXME: there's probably a better way to do this. - StartLimitIntervalSec = 0; - }; - serviceConfig = { - Type = "oneshot"; - TimeoutSec = 60; - ExecCondition = "/run/current-system/systemd/bin/systemctl -q is-active nginx.service"; - ExecStart = "/run/current-system/systemd/bin/systemctl reload nginx.service"; - }; - }; - security.acme.certs = let - acmePairs = map ( - vhostConfig: - let - hasRoot = vhostConfig.acmeRoot != null; - in - nameValuePair vhostConfig.serverName { - group = mkDefault cfg.group; - # if acmeRoot is null inherit config.security.acme - # Since config.security.acme.certs..webroot's own default value - # should take precedence set priority higher than mkOptionDefault - webroot = mkOverride (if hasRoot then 1000 else 2000) vhostConfig.acmeRoot; - # Also nudge dnsProvider to null in case it is inherited - dnsProvider = mkOverride (if hasRoot then 1000 else 2000) null; - extraDomainNames = vhostConfig.serverAliases; - # Filter for enableACME-only vhosts. Don't want to create dud certs - } - ) (filter (vhostConfig: vhostConfig.useACMEHost == null) acmeEnabledVhosts); + # Here are two cases: + # - when no `useACMEHost` is set, the `serverName` acme certificate is the primary name and we need to configure it + # - when `useACMEHost` is set, this is also the primary name and we only need to configure the reloadServices property + acmePairs = + map ( + vhostConfig: + let + hasRoot = vhostConfig.acmeRoot != null; + in + nameValuePair vhostConfig.serverName { + reloadServices = [ "nginx.service" ]; + group = mkDefault cfg.group; + # if acmeRoot is null inherit config.security.acme + # Since config.security.acme.certs..webroot's own default value + # should take precedence set priority higher than mkOptionDefault + webroot = mkOverride (if hasRoot then 1000 else 2000) vhostConfig.acmeRoot; + # Also nudge dnsProvider to null in case it is inherited + dnsProvider = mkOverride (if hasRoot then 1000 else 2000) null; + extraDomainNames = vhostConfig.serverAliases; + # Filter for enableACME-only vhosts. Don't want to create dud certs + } + ) (filter (vhostConfig: vhostConfig.useACMEHost == null) acmeEnabledVhosts) + ++ map ( + vhostConfig: + nameValuePair vhostConfig.useACMEHost { + reloadServices = [ "nginx.service" ]; + } + ) (filter (vhostConfig: vhostConfig.useACMEHost != null) acmeEnabledVhosts); in listToAttrs acmePairs; diff --git a/nixos/tests/acme/webserver.nix b/nixos/tests/acme/webserver.nix index 5dcd8857e8d2..17fe915245d1 100644 --- a/nixos/tests/acme/webserver.nix +++ b/nixos/tests/acme/webserver.nix @@ -226,5 +226,18 @@ # Ensure the timer works, due to our shenanigans with # RemainAfterExit=true webserver.wait_until_succeeds(f"journalctl --cursor-file=/tmp/cursor | grep 'Starting Order (and renew) ACME certificate for zeroconf3.{domain}...'") - ''; + '' + + + lib.optionalString + (config.nodes.webserver.services.nginx.enable && config.nodes.webserver.services.nginx.enableReload) + '' + with subtest("Ensure that adding a second vhost does not restart nginx"): + switch_to(webserver, "zeroconf") + webserver.wait_for_unit("renew-triggered.target") + webserver.succeed("journalctl --cursor-file=/tmp/cursor") + switch_to(webserver, "zeroconf3") + webserver.wait_for_unit("renew-triggered.target") + output = webserver.succeed("journalctl --cursor-file=/tmp/cursor") + t.assertNotIn("Stopping Nginx Web Server...", output) + ''; } diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix index 466fff654e07..ff1571e0d41b 100644 --- a/nixos/tests/all-tests.nix +++ b/nixos/tests/all-tests.nix @@ -183,7 +183,10 @@ in # keep-sorted start case=no numeric=no block=yes _3proxy = runTest ./3proxy.nix; aaaaxy = runTest ./aaaaxy.nix; - acme = import ./acme/default.nix { inherit runTest; }; + acme = import ./acme/default.nix { + inherit runTest; + inherit (pkgs) lib; + }; acme-dns = runTest ./acme-dns.nix; activation = pkgs.callPackage ../modules/system/activation/test.nix { }; activation-etc-overlay-immutable = runTest ./activation/etc-overlay-immutable.nix; From 8a4793fdc0bd8dabaf3fce9c77e812b59a76d12d Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Wed, 8 Oct 2025 17:17:00 +0000 Subject: [PATCH 03/15] python3Packages.pytest-check: 2.5.4 -> 2.6.0 --- pkgs/development/python-modules/pytest-check/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/python-modules/pytest-check/default.nix b/pkgs/development/python-modules/pytest-check/default.nix index ecfa1de70f66..1bfeb0b6fbac 100644 --- a/pkgs/development/python-modules/pytest-check/default.nix +++ b/pkgs/development/python-modules/pytest-check/default.nix @@ -9,13 +9,13 @@ buildPythonPackage rec { pname = "pytest-check"; - version = "2.5.4"; + version = "2.6.0"; pyproject = true; src = fetchPypi { pname = "pytest_check"; inherit version; - hash = "sha256-M9h+KNXkkhf0Eyd+Hg0mfNZskKhaIIlExEMSycjk/3Q="; + hash = "sha256-m+TFmgmCcSkQkUjIXXtZZLV/ClztG2GUWcow5vRjykI="; }; build-system = [ hatchling ]; From 6a848805a6438c6f12d79bace6f57ac050af3418 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Sat, 11 Oct 2025 21:55:19 +0000 Subject: [PATCH 04/15] lavacli: 2.4 -> 2.5 --- pkgs/by-name/la/lavacli/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/la/lavacli/package.nix b/pkgs/by-name/la/lavacli/package.nix index b6b22eaf2700..b505b4ebf8a3 100644 --- a/pkgs/by-name/la/lavacli/package.nix +++ b/pkgs/by-name/la/lavacli/package.nix @@ -6,14 +6,14 @@ python3.pkgs.buildPythonApplication rec { pname = "lavacli"; - version = "2.4"; + version = "2.5"; pyproject = true; src = fetchFromGitLab { owner = "lava"; repo = "lavacli"; tag = "v${version}"; - hash = "sha256-KNq+UNOC3N+p0HOed2Mdh9EIXLQccH+aepdfJ59Z2oM="; + hash = "sha256-VEUjqelhqUD6NTiWTtl9gAYzJDQzgP7NpxDyloYEmGU="; }; build-system = with python3.pkgs; [ From 3fe6486b2ac0b76b392fbdbc8cb8149d6b09728b Mon Sep 17 00:00:00 2001 From: Valentin Chassignol Date: Mon, 13 Oct 2025 11:04:36 +0200 Subject: [PATCH 05/15] python313Packages.timelength: init at 3.0.2 --- .../python-modules/timelength/default.nix | 40 +++++++++++++++++++ pkgs/top-level/python-packages.nix | 2 + 2 files changed, 42 insertions(+) create mode 100644 pkgs/development/python-modules/timelength/default.nix diff --git a/pkgs/development/python-modules/timelength/default.nix b/pkgs/development/python-modules/timelength/default.nix new file mode 100644 index 000000000000..9a27194de7b5 --- /dev/null +++ b/pkgs/development/python-modules/timelength/default.nix @@ -0,0 +1,40 @@ +{ + lib, + fetchFromGitHub, + buildPythonPackage, + pytestCheckHook, + poetry-core, + pytest-mock, +}: + +buildPythonPackage rec { + pname = "timelength"; + version = "3.0.2"; + pyproject = true; + + src = fetchFromGitHub { + owner = "EtorixDev"; + repo = "timelength"; + tag = "v${version}"; + hash = "sha256-iaAtDkx6jPPB7s+sTQsrfNFiwerSDZ+7y7C9oNNYEmg="; + }; + + build-system = [ + poetry-core + ]; + + pythonImportsCheck = [ "timelength" ]; + + nativeCheckInputs = [ + pytestCheckHook + pytest-mock + ]; + + meta = { + description = "Flexible python duration parser designed for human readable lengths of time"; + homepage = "https://github.com/EtorixDev/timelength/"; + changelog = "https://github.com/EtorixDev/timelength/releases/tag/v${version}"; + license = lib.licenses.mit; + maintainers = with lib.maintainers; [ vinetos ]; + }; +} diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix index beb96bbe5f4f..61bfa1930971 100644 --- a/pkgs/top-level/python-packages.nix +++ b/pkgs/top-level/python-packages.nix @@ -18438,6 +18438,8 @@ self: super: with self; { timecop = callPackage ../development/python-modules/timecop { }; + timelength = callPackage ../development/python-modules/timelength { }; + timelib = callPackage ../development/python-modules/timelib { }; timeout-decorator = callPackage ../development/python-modules/timeout-decorator { }; From fb5551e1840b56194fcf73ceccb4a3e77383e814 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= Date: Mon, 13 Oct 2025 18:36:49 +0200 Subject: [PATCH 06/15] searxng: 0-unstable-2025-09-11 -> 0-unstable-2025-10-13 Changelog: https://github.com/searxng/searxng/compare/7c1ebc01489a5b96d4abb0ad9c1180701eb4456c...c34bb612847ce4584f65077b104164993bfa88c5 --- pkgs/by-name/se/searxng/package.nix | 17 +++++------------ 1 file changed, 5 insertions(+), 12 deletions(-) diff --git a/pkgs/by-name/se/searxng/package.nix b/pkgs/by-name/se/searxng/package.nix index 06be3a17c5f3..eac3c1e27d5d 100644 --- a/pkgs/by-name/se/searxng/package.nix +++ b/pkgs/by-name/se/searxng/package.nix @@ -13,27 +13,20 @@ in python.pkgs.toPythonModule ( python.pkgs.buildPythonApplication rec { pname = "searxng"; - version = "0-unstable-2025-09-11"; + version = "0-unstable-2025-10-13"; pyproject = true; src = fetchFromGitHub { owner = "searxng"; repo = "searxng"; - rev = "7c1ebc01489a5b96d4abb0ad9c1180701eb4456c"; - hash = "sha256-nOIt4PyO6DALz7gw5Hh1w1ZDyEAsQAVp4O/eFOLYZ0A="; + rev = "c34bb612847ce4584f65077b104164993bfa88c5"; + hash = "sha256-vs64ue9bI86kCrOUdy8Kddd2GTIYmveyy1XunEqPAtw="; }; nativeBuildInputs = with python.pkgs; [ pythonRelaxDepsHook ]; - pythonRelaxDeps = [ - "certifi" - "flask" - "flask-babel" - "httpx-socks" - "lxml" - "typer-slim" - "whitenoise" - ]; + # upstream pins every dependency + pythonRelaxDeps = true; preBuild = let From c67be443e5c7e35f4906d0dedba2d8a0b634de6d Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Mon, 13 Oct 2025 19:21:41 +0000 Subject: [PATCH 07/15] versatiles: 0.15.7 -> 1.0.1 --- pkgs/by-name/ve/versatiles/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/ve/versatiles/package.nix b/pkgs/by-name/ve/versatiles/package.nix index 471b187e24ac..1fd54eed863b 100644 --- a/pkgs/by-name/ve/versatiles/package.nix +++ b/pkgs/by-name/ve/versatiles/package.nix @@ -6,16 +6,16 @@ rustPlatform.buildRustPackage rec { pname = "versatiles"; - version = "0.15.7"; # When updating: Replace with current version + version = "1.0.1"; # When updating: Replace with current version src = fetchFromGitHub { owner = "versatiles-org"; repo = "versatiles-rs"; tag = "v${version}"; # When updating: Replace with long commit hash of new version - hash = "sha256-E0CWhNaaIfBZsRYcZ2FzWW6HhBRVolY/Lfr1ru+sikQ="; # When updating: Use `lib.fakeHash` for recomputing the hash once. Run: 'nix-build -A versatiles'. Swap with new hash and proceed. + hash = "sha256-Byc8w1NCJbLPInXgva41CO2SnqWRubXeELJLlMFf54k="; # When updating: Use `lib.fakeHash` for recomputing the hash once. Run: 'nix-build -A versatiles'. Swap with new hash and proceed. }; - cargoHash = "sha256-1ZC1MLPfh9E36dxF23Fd0668m3c4cKRD+TJTF1h7ph8="; # When updating: Same as above + cargoHash = "sha256-kWRzxaGDVV3FuVrg+hqpCHPvbCQ0KMO1luCgNiNHYeg="; # When updating: Same as above __darwinAllowLocalNetworking = true; From 24d7d726c41fe82f68a163dac95aa6d67e99fdf3 Mon Sep 17 00:00:00 2001 From: Wolfgang Walther Date: Mon, 13 Oct 2025 21:38:51 +0200 Subject: [PATCH 08/15] ocamlPackages.ocamlnat: drop This package only support OCaml < 4. We only package OCaml >= 4, though. OCaml 4.00.1 is from 2012 already, so this.. has not been supported literally forever? I don't think we need to add an alias for something that only fails an assert all the time anyway. --- .../ocaml-modules/ocamlnat/default.nix | 57 ------------------- pkgs/top-level/ocaml-packages.nix | 2 - 2 files changed, 59 deletions(-) delete mode 100644 pkgs/development/ocaml-modules/ocamlnat/default.nix diff --git a/pkgs/development/ocaml-modules/ocamlnat/default.nix b/pkgs/development/ocaml-modules/ocamlnat/default.nix deleted file mode 100644 index 8729a4cc71fb..000000000000 --- a/pkgs/development/ocaml-modules/ocamlnat/default.nix +++ /dev/null @@ -1,57 +0,0 @@ -{ - stdenv, - lib, - fetchurl, - ocaml, - findlib, - ounit, -}: - -# https://github.com/bmeurer/ocamlnat/issues/3 -assert lib.versionOlder ocaml.version "4"; - -stdenv.mkDerivation rec { - pname = "ocamlnat"; - version = "0.1.1"; - - src = fetchurl { - url = "http://benediktmeurer.de/files/source/${pname}-${version}.tar.bz2"; - sha256 = "0dyvy0j6f47laxhnadvm71z1py9hz9zd49hamf6bij99cggb2ij1"; - }; - - nativeBuildInputs = [ - ocaml - findlib - ]; - checkInputs = [ ounit ]; - - strictDeps = true; - - prefixKey = "--prefix "; - - doCheck = true; - - checkTarget = "test"; - - createFindlibDestdir = true; - - meta = { - description = "OCaml native toplevel"; - homepage = "http://benediktmeurer.de/ocamlnat/"; - license = lib.licenses.qpl; - longDescription = '' - The ocamlnat project provides a new native code OCaml toplevel - ocamlnat, which is mostly compatible to the byte code toplevel ocaml, - but up to 100 times faster. It is based on the optimizing native code - compiler, the native runtime and an earlier prototype by Alain - Frisch. It is build upon Just-In-Time techniques and currently - supports Unix-like systems (i.e. Linux, BSD or macOS) running on - x86 or x86-64 processors. Support for additional architectures and - operating systems is planned, but not yet available. - ''; - inherit (ocaml.meta) platforms; - maintainers = [ - lib.maintainers.maggesi - ]; - }; -} diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix index 92da02d990d1..c7b21022812c 100644 --- a/pkgs/top-level/ocaml-packages.nix +++ b/pkgs/top-level/ocaml-packages.nix @@ -2227,8 +2227,6 @@ let hol_light = callPackage ../applications/science/logic/hol_light { }; - ocamlnat = callPackage ../development/ocaml-modules/ocamlnat { }; - ### End ### } From 9b77121ae3180a5402bbb1876809aec0b0094f0b Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Mon, 13 Oct 2025 20:34:58 +0000 Subject: [PATCH 09/15] ltex-ls-plus: 18.5.1 -> 18.6.0 --- pkgs/by-name/lt/ltex-ls-plus/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/lt/ltex-ls-plus/package.nix b/pkgs/by-name/lt/ltex-ls-plus/package.nix index b187cd1a16c5..a1053ade1595 100644 --- a/pkgs/by-name/lt/ltex-ls-plus/package.nix +++ b/pkgs/by-name/lt/ltex-ls-plus/package.nix @@ -9,11 +9,11 @@ stdenvNoCC.mkDerivation rec { pname = "ltex-ls-plus"; - version = "18.5.1"; + version = "18.6.0"; src = fetchurl { url = "https://github.com/ltex-plus/ltex-ls-plus/releases/download/${version}/ltex-ls-plus-${version}.tar.gz"; - sha256 = "sha256-kSs/0Hi9G5l632+dqxGhlvMJCizzKFY/dq7UyAr3uss="; + sha256 = "sha256-T5ZUQHOjP3V0Xebi6elcjYEuiDtFg5fd+kwrubjWFoU="; }; nativeBuildInputs = [ makeBinaryWrapper ]; From ef91ac861d6a919417b6061ad849cbd1375c7fb1 Mon Sep 17 00:00:00 2001 From: zowoq <59103226+zowoq@users.noreply.github.com> Date: Tue, 14 Oct 2025 09:15:52 +1000 Subject: [PATCH 10/15] go_1_24: 1.24.8 -> 1.24.9 Changelog: https://go.dev/doc/devel/release#go1.24 --- pkgs/development/compilers/go/1.24.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/compilers/go/1.24.nix b/pkgs/development/compilers/go/1.24.nix index 69a54435932e..39d61674a21b 100644 --- a/pkgs/development/compilers/go/1.24.nix +++ b/pkgs/development/compilers/go/1.24.nix @@ -27,11 +27,11 @@ let in stdenv.mkDerivation (finalAttrs: { pname = "go"; - version = "1.24.8"; + version = "1.24.9"; src = fetchurl { url = "https://go.dev/dl/go${finalAttrs.version}.src.tar.gz"; - hash = "sha256-sf8yxcSlDd+hoct4tg3Vo2KushhLt48Ai0JbYglXVfs="; + hash = "sha256-xy+BulT+AO/n8+dJnUAJeSRogbE7d16am7hVQcEb5pU="; }; strictDeps = true; From 997953b16a8fb9d3ec16b3891d55c44fc1291c02 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Tue, 14 Oct 2025 00:25:01 +0000 Subject: [PATCH 11/15] kdePackages.kio-fuse: 5.1.0 -> 5.1.1 --- pkgs/kde/misc/kio-fuse/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/kde/misc/kio-fuse/default.nix b/pkgs/kde/misc/kio-fuse/default.nix index cf28083b0813..ec1fb884f853 100644 --- a/pkgs/kde/misc/kio-fuse/default.nix +++ b/pkgs/kde/misc/kio-fuse/default.nix @@ -7,11 +7,11 @@ }: mkKdeDerivation rec { pname = "kio-fuse"; - version = "5.1.0"; + version = "5.1.1"; src = fetchurl { url = "mirror://kde/stable/kio-fuse/kio-fuse-${version}.tar.xz"; - hash = "sha256-fRBFgSJ9Whm0JLM/QWjRgVVrEBXW3yIY4BqI1kRJ6Us="; + hash = "sha256-rfaqfOBVwJh+cWqTrAHzwKl8EoBCFEPNayHg5x12PRQ="; }; extraNativeBuildInputs = [ pkg-config ]; From 7600f3cf5ff2bb25ef806c9956c74692b8b394fa Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Tue, 14 Oct 2025 00:37:13 +0000 Subject: [PATCH 12/15] mdfried: 0.12.6 -> 0.12.9 --- pkgs/by-name/md/mdfried/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/md/mdfried/package.nix b/pkgs/by-name/md/mdfried/package.nix index a55094e4eeb1..25e62257ecc7 100644 --- a/pkgs/by-name/md/mdfried/package.nix +++ b/pkgs/by-name/md/mdfried/package.nix @@ -6,16 +6,16 @@ rustPlatform.buildRustPackage (finalAttrs: { pname = "mdfried"; - version = "0.12.6"; + version = "0.12.9"; src = fetchFromGitHub { owner = "benjajaja"; repo = "mdfried"; tag = "v${finalAttrs.version}"; - hash = "sha256-0xfdVZLqjlBvlpQYAYVTR2tAn6IjD0rgEBScYe5L4g4="; + hash = "sha256-0vAPUmG11Qvds3g2iaH7umZpo4b2/Dtvcm6I8WfM8jw="; }; - cargoHash = "sha256-jDv6H846Po4Q4ungaC7e/311dgQ8M1L/bQayR5NgZv4="; + cargoHash = "sha256-3jx4sIXETEsgTBcTTbedEv0BXoSejLe4oEaudhQIN6s="; doCheck = true; From af70ad706db919d644586e8f95c1d8d3d0a1ac56 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Tue, 14 Oct 2025 01:33:35 +0000 Subject: [PATCH 13/15] biome: 2.2.5 -> 2.2.6 --- pkgs/by-name/bi/biome/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/bi/biome/package.nix b/pkgs/by-name/bi/biome/package.nix index 36c610c25f4b..967588c95784 100644 --- a/pkgs/by-name/bi/biome/package.nix +++ b/pkgs/by-name/bi/biome/package.nix @@ -10,16 +10,16 @@ }: rustPlatform.buildRustPackage (finalAttrs: { pname = "biome"; - version = "2.2.5"; + version = "2.2.6"; src = fetchFromGitHub { owner = "biomejs"; repo = "biome"; rev = "@biomejs/biome@${finalAttrs.version}"; - hash = "sha256-9TOeoog0jpNFyS4vv3dhui7Unil/AmPjmrOaJjcwpfY="; + hash = "sha256-5QxcKVo6niV+K63JRBhs6/RUR6jru20f+DeitfqEuRI="; }; - cargoHash = "sha256-X9I2XmDvpRdXTFGwKpuI2mDSQ1//OseosUy52vykGlY="; + cargoHash = "sha256-/POhRQ2HIaBwk9VeMdkK7dAZ90EmB49oCvQEUScgjpY="; nativeBuildInputs = [ pkg-config ]; From dfc68ed8607fac82bd6a855eff2e7dcdd5ef1048 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Tue, 14 Oct 2025 01:56:14 +0000 Subject: [PATCH 14/15] libretro.mgba: 0-unstable-2025-07-24 -> 0-unstable-2025-10-13 --- pkgs/applications/emulators/libretro/cores/mgba.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/applications/emulators/libretro/cores/mgba.nix b/pkgs/applications/emulators/libretro/cores/mgba.nix index 7717c5dcdb6c..35d0335d940d 100644 --- a/pkgs/applications/emulators/libretro/cores/mgba.nix +++ b/pkgs/applications/emulators/libretro/cores/mgba.nix @@ -5,13 +5,13 @@ }: mkLibretroCore { core = "mgba"; - version = "0-unstable-2025-07-24"; + version = "0-unstable-2025-10-13"; src = fetchFromGitHub { owner = "libretro"; repo = "mgba"; - rev = "affc86e4c07b6e1e8363e0bc1c5ffb813a2e32c9"; - hash = "sha256-4nKghnpMI1LuKOKc0vSknTuq+bA0wpBux/a5mGCyev8="; + rev = "c758314a639aa0066e7b65a8341448181b73c804"; + hash = "sha256-ev0vzLqZzOr5RW/jf07vXtBmYkcB2m+afADHFBH5zbQ="; }; meta = { From b692ac3877104534238eca8b5c6ddd561ad1a807 Mon Sep 17 00:00:00 2001 From: Ethan Carter Edwards Date: Tue, 14 Oct 2025 01:35:06 -0400 Subject: [PATCH 15/15] ocamlPackages.dockerfile: init at 8.3.2 Homepage: https://www.ocurrent.org/ocaml-dockerfile/dockerfile/Dockerfile/index.html Source: https://github.com/ocurrent/ocaml-dockerfile Ocaml library for creating a Dockerfile Signed-off-by: Ethan Carter Edwards --- .../ocaml-modules/dockerfile/default.nix | 42 +++++++++++++++++++ pkgs/top-level/ocaml-packages.nix | 2 + 2 files changed, 44 insertions(+) create mode 100644 pkgs/development/ocaml-modules/dockerfile/default.nix diff --git a/pkgs/development/ocaml-modules/dockerfile/default.nix b/pkgs/development/ocaml-modules/dockerfile/default.nix new file mode 100644 index 000000000000..f052e9be0e40 --- /dev/null +++ b/pkgs/development/ocaml-modules/dockerfile/default.nix @@ -0,0 +1,42 @@ +{ + lib, + buildDunePackage, + fetchFromGitHub, + fmt, + ppx_sexp_conv, + sexplib, + alcotest, +}: + +buildDunePackage rec { + pname = "dockerfile"; + version = "8.3.2"; + + src = fetchFromGitHub { + owner = "ocurrent"; + repo = "ocaml-dockerfile"; + tag = version; + hash = "sha256-L4TjCf8SaNMxqkrr+AoL/Lx2oWgf2owJFs26lu68ejs="; + }; + + propagatedBuildInputs = [ + fmt + ppx_sexp_conv + sexplib + ]; + + checkInputs = [ + alcotest + ]; + + doCheck = true; + + meta = { + description = "Interface for creating Dockerfiles"; + homepage = "https://www.ocurrent.org/ocaml-dockerfile/dockerfile/Dockerfile/index.html"; + downloadPage = "https://github.com/ocurrent/ocaml-dockerfile"; + changelog = "https://github.com/ocurrent/ocaml-dockerfile/blob/v${version}/CHANGES.md"; + license = lib.licenses.isc; + maintainers = [ lib.maintainers.ethancedwards8 ]; + }; +} diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix index b67b7bd0b607..bf72069a33ee 100644 --- a/pkgs/top-level/ocaml-packages.nix +++ b/pkgs/top-level/ocaml-packages.nix @@ -418,6 +418,8 @@ let dnssec = callPackage ../development/ocaml-modules/dns/dnssec.nix { }; + dockerfile = callPackage ../development/ocaml-modules/dockerfile { }; + dolmen = callPackage ../development/ocaml-modules/dolmen { }; dolmen_loop = callPackage ../development/ocaml-modules/dolmen/loop.nix { };