From 26ca4d15878e89ee428b8908f350256e3210998e Mon Sep 17 00:00:00 2001 From: Andrew Marshall Date: Fri, 4 Mar 2022 09:32:56 -0500 Subject: [PATCH 01/44] nixos/prometheus: Harden systemd service For reference: - ./nixos/modules/services/monitoring/grafana.nix - https://salsa.debian.org/go-team/packages/prometheus/-/blob/80192f1fe3e4b2b3a1816b4d2c4a628809acccbe/debian/service - https://github.com/archlinux/svntogit-packages/blob/5894b9b77a63f8d1aad434e190217ba5f4ba40d4/trunk/prometheus.service I have omitted the Limit* as they do not appear to be commonly used in NixOS, and, per `man systemd.exec`, are less preferred vs. cgroup limits. --- .../monitoring/prometheus/default.nix | 27 +++++++++++++++++++ 1 file changed, 27 insertions(+) diff --git a/nixos/modules/services/monitoring/prometheus/default.nix b/nixos/modules/services/monitoring/prometheus/default.nix index 41848c1c6d3a..c256afedc6b6 100644 --- a/nixos/modules/services/monitoring/prometheus/default.nix +++ b/nixos/modules/services/monitoring/prometheus/default.nix @@ -1800,6 +1800,33 @@ in WorkingDirectory = workingDir; StateDirectory = cfg.stateDir; StateDirectoryMode = "0700"; + # Hardening + AmbientCapabilities = lib.mkIf (cfg.port < 1024) [ "CAP_NET_BIND_SERVICE" ]; + CapabilityBoundingSet = if (cfg.port < 1024) then [ "CAP_NET_BIND_SERVICE" ] else [ "" ]; + DeviceAllow = [ "/dev/null rw" ]; + DevicePolicy = "strict"; + LockPersonality = true; + MemoryDenyWriteExecute = true; + NoNewPrivileges = true; + PrivateDevices = true; + PrivateTmp = true; + PrivateUsers = true; + ProtectClock = true; + ProtectControlGroups = true; + ProtectHome = true; + ProtectHostname = true; + ProtectKernelLogs = true; + ProtectKernelModules = true; + ProtectKernelTunables = true; + ProtectProc = "invisible"; + ProtectSystem = "full"; + RemoveIPC = true; + RestrictAddressFamilies = [ "AF_INET" "AF_INET6" "AF_UNIX" ]; + RestrictNamespaces = true; + RestrictRealtime = true; + RestrictSUIDSGID = true; + SystemCallArchitectures = "native"; + SystemCallFilter = [ "@system-service" "~@privileged" "~@resources" ]; }; }; # prometheus-config-reload will activate after prometheus. However, what we From 58919907a73f2bd0329f8943875d7bab9c5eca8e Mon Sep 17 00:00:00 2001 From: ilkecan Date: Mon, 8 Aug 2022 16:38:05 +0000 Subject: [PATCH 02/44] phpPackages: set meta.mainProgram --- pkgs/development/php-packages/deployer/default.nix | 1 + pkgs/top-level/php-packages.nix | 1 + 2 files changed, 2 insertions(+) diff --git a/pkgs/development/php-packages/deployer/default.nix b/pkgs/development/php-packages/deployer/default.nix index 661a6310958c..bd15bb7db856 100644 --- a/pkgs/development/php-packages/deployer/default.nix +++ b/pkgs/development/php-packages/deployer/default.nix @@ -30,6 +30,7 @@ mkDerivation rec { description = "A deployment tool for PHP"; license = licenses.mit; homepage = "https://deployer.org/"; + mainProgram = "dep"; maintainers = with maintainers; teams.php.members; }; } diff --git a/pkgs/top-level/php-packages.nix b/pkgs/top-level/php-packages.nix index ce3af252abc7..ee330c15b565 100644 --- a/pkgs/top-level/php-packages.nix +++ b/pkgs/top-level/php-packages.nix @@ -56,6 +56,7 @@ lib.makeScope pkgs.newScope (self: with self; { # with how buildPecl does it and make the file easier to overview. mkDerivation = { pname, ... }@args: pkgs.stdenv.mkDerivation (args // { pname = "php-${pname}"; + meta.mainProgram = args.meta.mainProgram or pname; }); # Function to build an extension which is shipped as part of the php From 6eaabd29a3c87c8c0155352faffd81944ed36e6e Mon Sep 17 00:00:00 2001 From: Stephane Schitter Date: Sat, 6 Aug 2022 19:41:56 +0200 Subject: [PATCH 03/44] roundcubePlugins.contextmenu: init at 3.3.1 https://github.com/johndoh/roundcube-contextmenu https://github.com/johndoh/roundcube-contextmenu/releases/tag/3.3.1 --- .../servers/roundcube/plugins/contextmenu/default.nix | 11 +++++++++++ pkgs/servers/roundcube/plugins/plugins.nix | 1 + 2 files changed, 12 insertions(+) create mode 100644 pkgs/servers/roundcube/plugins/contextmenu/default.nix diff --git a/pkgs/servers/roundcube/plugins/contextmenu/default.nix b/pkgs/servers/roundcube/plugins/contextmenu/default.nix new file mode 100644 index 000000000000..90f130a83f94 --- /dev/null +++ b/pkgs/servers/roundcube/plugins/contextmenu/default.nix @@ -0,0 +1,11 @@ +{ roundcubePlugin, fetchzip }: + +roundcubePlugin rec { + pname = "contextmenu"; + version = "3.3.1"; + + src = fetchzip { + url = "https://github.com/johndoh/roundcube-contextmenu/archive/refs/tags/${version}.tar.gz"; + sha256 = "0aya3nv8jwfvd9rlvxfxnyfpdcpw858745xal362l3zzkbkhcrmb"; + }; +} diff --git a/pkgs/servers/roundcube/plugins/plugins.nix b/pkgs/servers/roundcube/plugins/plugins.nix index a9c73874b69e..72738eb4c407 100644 --- a/pkgs/servers/roundcube/plugins/plugins.nix +++ b/pkgs/servers/roundcube/plugins/plugins.nix @@ -6,5 +6,6 @@ roundcubePlugin = callPackage ./roundcube-plugin.nix { }; carddav = callPackage ./carddav { }; + contextmenu = callPackage ./contextmenu { }; persistent_login = callPackage ./persistent_login { }; } From a1e07d8eda7818c8b5b8fd5c1dc59d1f37771960 Mon Sep 17 00:00:00 2001 From: Aaron Jheng Date: Wed, 28 Sep 2022 12:00:19 +0000 Subject: [PATCH 04/44] gllvm: 1.3.0 -> 1.3.1 --- pkgs/development/tools/gllvm/default.nix | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-) diff --git a/pkgs/development/tools/gllvm/default.nix b/pkgs/development/tools/gllvm/default.nix index 460f59dc3d0e..d2d7e523a94f 100644 --- a/pkgs/development/tools/gllvm/default.nix +++ b/pkgs/development/tools/gllvm/default.nix @@ -1,18 +1,23 @@ -{ lib, buildGoPackage, fetchFromGitHub }: +{ lib, buildGoModule, fetchFromGitHub, llvmPackages, getconf }: -buildGoPackage rec { +buildGoModule rec { pname = "gllvm"; - version = "1.3.0"; - - goPackagePath = "github.com/SRI-CSL/gllvm"; + version = "1.3.1"; src = fetchFromGitHub { owner = "SRI-CSL"; repo = "gllvm"; rev = "v${version}"; - sha256 = "sha256-nu6PRFk+GoN1gT1RTbX6mTPZByAGf0bSsj2C5YriGp8="; + sha256 = "sha256-CoreqnMRuPuv+Ci1uyF3HJCJFwK2jwB79okynv6AHTA="; }; + vendorSha256 = "sha256-pQpattmS9VmO3ZIQUFn66az8GSmB4IvYhTTCFn6SUmo="; + + checkInputs = with llvmPackages; [ + clang + llvm + ] ++ lib.optionals stdenv.isDarwin [ getconf ]; + meta = with lib; { homepage = "https://github.com/SRI-CSL/gllvm"; description = "Whole Program LLVM: wllvm ported to go"; From ebb0a9b939409faf3b80c8c680812d69c2791271 Mon Sep 17 00:00:00 2001 From: sternenseemann Date: Tue, 1 Nov 2022 18:29:00 +0100 Subject: [PATCH 05/44] buf: remove reliance of tests on git file transport A recent git security update disabled the file transport by default, see https://github.blog/2022-10-18-git-security-vulnerabilities-announced/#cve-2022-39253 We can pick an upstream patch which needed to be rebased unfortunately, so we can't fetch it directly from GitHub. --- .../buf-tests-dont-use-file-transport.patch | 51 +++++++++++++++++++ pkgs/development/tools/buf/default.nix | 3 ++ 2 files changed, 54 insertions(+) create mode 100644 pkgs/development/tools/buf/buf-tests-dont-use-file-transport.patch diff --git a/pkgs/development/tools/buf/buf-tests-dont-use-file-transport.patch b/pkgs/development/tools/buf/buf-tests-dont-use-file-transport.patch new file mode 100644 index 000000000000..a26f41d71974 --- /dev/null +++ b/pkgs/development/tools/buf/buf-tests-dont-use-file-transport.patch @@ -0,0 +1,51 @@ +commit e9219b88de5ed37af337ee2d2e71e7ec7c0aad1b +Author: Robbert van Ginkel +Date: Thu Oct 20 16:43:28 2022 -0400 + + Fix git unit test by using fake git server rather than file:// (#1518) + + More recent versions of git fix a CVE by disabling some usage of the + `file://` transport, see + https://github.blog/2022-10-18-git-security-vulnerabilities-announced/#cve-2022-39253. + We were using this transport in tests. + + Instead, use https://git-scm.com/docs/git-http-backend to serve up this + repository locally so we don't have to use the file protocol. This + should be a more accurate tests, since we mostly expect submodules to + come from servers. + +diff --git a/private/pkg/git/git_test.go b/private/pkg/git/git_test.go +index 7b77b6cd..7132054e 100644 +--- a/private/pkg/git/git_test.go ++++ b/private/pkg/git/git_test.go +@@ -17,6 +17,8 @@ package git + import ( + "context" + "errors" ++ "net/http/cgi" ++ "net/http/httptest" + "os" + "os/exec" + "path/filepath" +@@ -213,6 +215,21 @@ func createGitDirs( + runCommand(ctx, t, container, runner, "git", "-C", submodulePath, "add", "test.proto") + runCommand(ctx, t, container, runner, "git", "-C", submodulePath, "commit", "-m", "commit 0") + ++ gitExecPath, err := command.RunStdout(ctx, container, runner, "git", "--exec-path") ++ require.NoError(t, err) ++ t.Log(filepath.Join(string(gitExecPath), "git-http-backend")) ++ // https://git-scm.com/docs/git-http-backend#_description ++ f, err := os.Create(filepath.Join(submodulePath, ".git", "git-daemon-export-ok")) ++ require.NoError(t, err) ++ require.NoError(t, f.Close()) ++ server := httptest.NewServer(&cgi.Handler{ ++ Path: filepath.Join(strings.TrimSpace(string(gitExecPath)), "git-http-backend"), ++ Dir: submodulePath, ++ Env: []string{"GIT_PROJECT_ROOT=" + submodulePath}, ++ }) ++ t.Cleanup(server.Close) ++ submodulePath = server.URL ++ + originPath := filepath.Join(tmpDir, "origin") + require.NoError(t, os.MkdirAll(originPath, 0777)) + runCommand(ctx, t, container, runner, "git", "-C", originPath, "init") diff --git a/pkgs/development/tools/buf/default.nix b/pkgs/development/tools/buf/default.nix index 5d5e4084085d..28e568338567 100644 --- a/pkgs/development/tools/buf/default.nix +++ b/pkgs/development/tools/buf/default.nix @@ -26,6 +26,9 @@ buildGoModule rec { ./skip_test_requiring_network.patch # Skip TestWorkspaceGit which requires .git and commits. ./skip_test_requiring_dotgit.patch + # Remove reliance of tests on file protocol which is disabled in git by default now + # Rebased upstream change https://github.com/bufbuild/buf/commit/bcaa77f8bbb8f6c198154c7c8d53596da4506dab + ./buf-tests-dont-use-file-transport.patch ]; nativeBuildInputs = [ installShellFiles ]; From 35dbaabc7885bdfb45723b5e01d9065815717ea6 Mon Sep 17 00:00:00 2001 From: Daniel Baker Date: Sat, 5 Nov 2022 00:07:33 +0100 Subject: [PATCH 06/44] ocamlPackages.ppx_yojson_conv: init at 0.15.1 --- .../ocaml-modules/ppx_yojson_conv/default.nix | 34 +++++++++++++++++++ pkgs/top-level/ocaml-packages.nix | 2 ++ 2 files changed, 36 insertions(+) create mode 100644 pkgs/development/ocaml-modules/ppx_yojson_conv/default.nix diff --git a/pkgs/development/ocaml-modules/ppx_yojson_conv/default.nix b/pkgs/development/ocaml-modules/ppx_yojson_conv/default.nix new file mode 100644 index 000000000000..3feeaa84ab47 --- /dev/null +++ b/pkgs/development/ocaml-modules/ppx_yojson_conv/default.nix @@ -0,0 +1,34 @@ +{ + lib, + buildDunePackage, + fetchFromGitHub, + ppx_js_style, + ppx_yojson_conv_lib, + ppxlib, +}: +buildDunePackage rec { + pname = "ppx_yojson_conv"; + version = "0.15.1"; + duneVersion = "3"; + minimumOCamlVersion = "4.08.0"; + + src = fetchFromGitHub { + owner = "janestreet"; + repo = pname; + rev = "v${version}"; + sha256 = "sha256-lSOUSMVgsRiArEhFTKpAj2yFBPbtaIc/SxdPA+24xXs="; + }; + + propagatedBuildInputs = [ + ppx_js_style + ppx_yojson_conv_lib + ppxlib + ]; + + meta = with lib; { + description = "A PPX syntax extension that generates code for converting OCaml types to and from Yojson"; + homepage = "https://github.com/janestreet/ppx_yojson_conv"; + maintainers = with maintainers; [djacu]; + license = with licenses; [mit]; + }; +} diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix index e929a59cd70f..7276fab86d8a 100644 --- a/pkgs/top-level/ocaml-packages.nix +++ b/pkgs/top-level/ocaml-packages.nix @@ -1314,6 +1314,8 @@ let ppx_tools_versioned = callPackage ../development/ocaml-modules/ppx_tools_versioned { }; + ppx_yojson_conv = callPackage ../development/ocaml-modules/ppx_yojson_conv {}; + ppx_yojson_conv_lib = callPackage ../development/ocaml-modules/ppx_yojson_conv_lib {}; prettym = callPackage ../development/ocaml-modules/prettym { }; From 11bc7ca6dc5f70be0ebeb203d4a3705a185f778e Mon Sep 17 00:00:00 2001 From: kilianar Date: Fri, 4 Nov 2022 11:22:43 +0100 Subject: [PATCH 07/44] vorta: 0.8.7 -> 0.8.9 https://github.com/borgbase/vorta/releases/tag/v0.8.8 https://github.com/borgbase/vorta/releases/tag/v0.8.9 --- pkgs/applications/backup/vorta/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/applications/backup/vorta/default.nix b/pkgs/applications/backup/vorta/default.nix index 32d989e7a253..ad55ef1ab8c8 100644 --- a/pkgs/applications/backup/vorta/default.nix +++ b/pkgs/applications/backup/vorta/default.nix @@ -8,13 +8,13 @@ python3Packages.buildPythonApplication rec { pname = "vorta"; - version = "0.8.7"; + version = "0.8.9"; src = fetchFromGitHub { owner = "borgbase"; repo = "vorta"; rev = "refs/tags/v${version}"; - sha256 = "sha256-9SfHZbNM+lRtwLO/0dE9C4cHb3pSPkxBUITYNEdPMQw="; + sha256 = "sha256-5RZXHMov3CX0zRprs7sgz0+cGEdESLrg4I2glRnTkcU="; }; nativeBuildInputs = [ wrapQtAppsHook ]; From 4d3207ecf7e3fc97d183cd001498a04437745da1 Mon Sep 17 00:00:00 2001 From: Randy Eckenrode Date: Sun, 6 Nov 2022 18:54:18 -0500 Subject: [PATCH 08/44] edk2: fix build on x86_64-darwin ZHF #199919 --- pkgs/development/compilers/edk2/default.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkgs/development/compilers/edk2/default.nix b/pkgs/development/compilers/edk2/default.nix index d51601404868..8ce4322a12e9 100644 --- a/pkgs/development/compilers/edk2/default.nix +++ b/pkgs/development/compilers/edk2/default.nix @@ -61,7 +61,7 @@ edk2 = buildStdenv.mkDerivation { ${"GCC5_${targetArch}_PREFIX"}=stdenv.cc.targetPrefix; makeFlags = [ "-C BaseTools" ] - ++ lib.optionals (stdenv.cc.isClang) [ "BUILD_CC=clang BUILD_CXX=clang++ BUILD_AS=clang" ]; + ++ lib.optionals (stdenv.cc.isClang) [ "CXX=llvm BUILD_AR=ar BUILD_CC=clang BUILD_CXX=clang++ BUILD_AS=clang BUILD_LD=ld" ]; NIX_CFLAGS_COMPILE = "-Wno-return-type" + lib.optionalString (stdenv.cc.isGNU) " -Wno-error=stringop-truncation"; From 9af8b018423289f0422ad8fcfcf8b0bb5855faa6 Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Mon, 7 Nov 2022 01:35:26 +0100 Subject: [PATCH 09/44] openjdk: mark 18 as EOL --- pkgs/development/compilers/openjdk/meta.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkgs/development/compilers/openjdk/meta.nix b/pkgs/development/compilers/openjdk/meta.nix index c66ecc29cf51..0fbd9eff3e4c 100644 --- a/pkgs/development/compilers/openjdk/meta.nix +++ b/pkgs/development/compilers/openjdk/meta.nix @@ -5,7 +5,7 @@ lib: version: with lib; { maintainers = with maintainers; [ edwtjo asbachb ]; platforms = [ "i686-linux" "x86_64-linux" "aarch64-linux" "armv7l-linux" "armv6l-linux" ]; mainProgram = "java"; - knownVulnerabilities = optionals (builtins.elem (versions.major version) [ "12" "13" "14" "15" "16" ]) [ + knownVulnerabilities = optionals (builtins.elem (versions.major version) [ "12" "13" "14" "15" "16" "18" ]) [ "This OpenJDK version has reached its end of life." ]; } From b808a354d215ffa1bb9c5988112ec9adadf7365d Mon Sep 17 00:00:00 2001 From: Randy Eckenrode Date: Sun, 6 Nov 2022 19:36:57 -0500 Subject: [PATCH 10/44] OVMF: fix build on x86_64-darwin ZHF #199919 --- pkgs/applications/virtualization/OVMF/default.nix | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/pkgs/applications/virtualization/OVMF/default.nix b/pkgs/applications/virtualization/OVMF/default.nix index 9a4276997b8e..1e2e8c764a9e 100644 --- a/pkgs/applications/virtualization/OVMF/default.nix +++ b/pkgs/applications/virtualization/OVMF/default.nix @@ -1,4 +1,4 @@ -{ stdenv, nixosTests, lib, edk2, util-linux, nasm, acpica-tools +{ stdenv, nixosTests, lib, edk2, util-linux, nasm, acpica-tools, llvmPackages , csmSupport ? false, seabios ? null , secureBoot ? false , httpSupport ? false @@ -33,7 +33,8 @@ edk2.mkDerivation projectDscPath (finalAttrs: { outputs = [ "out" "fd" ]; - nativeBuildInputs = [ util-linux nasm acpica-tools ]; + nativeBuildInputs = [ util-linux nasm acpica-tools ] + ++ lib.optionals stdenv.cc.isClang [ llvmPackages.bintools llvmPackages.llvm ]; strictDeps = true; hardeningDisable = [ "format" "stackprotector" "pic" "fortify" ]; @@ -44,6 +45,8 @@ edk2.mkDerivation projectDscPath (finalAttrs: { ++ lib.optionals httpSupport [ "-D NETWORK_HTTP_ENABLE=TRUE" "-D NETWORK_HTTP_BOOT_ENABLE=TRUE" ] ++ lib.optionals tpmSupport [ "-D TPM_ENABLE" "-D TPM2_ENABLE" "-D TPM2_CONFIG_ENABLE"]; + NIX_CFLAGS_COMPILE = lib.optional stdenv.cc.isClang "-Qunused-arguments"; + postPatch = lib.optionalString csmSupport '' cp ${seabios}/Csm16.bin OvmfPkg/Csm/Csm16/Csm16.bin ''; From 0aa21a70530618bfdd18c532b4af0c290ad7d070 Mon Sep 17 00:00:00 2001 From: Randy Eckenrode Date: Sun, 6 Nov 2022 19:53:25 -0500 Subject: [PATCH 11/44] edk2-uefi-shell: fix build on x86_64-darwin ZHF #199919 --- pkgs/tools/misc/edk2-uefi-shell/default.nix | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/pkgs/tools/misc/edk2-uefi-shell/default.nix b/pkgs/tools/misc/edk2-uefi-shell/default.nix index 78e0ba28afb0..e3d73775021f 100644 --- a/pkgs/tools/misc/edk2-uefi-shell/default.nix +++ b/pkgs/tools/misc/edk2-uefi-shell/default.nix @@ -1,5 +1,7 @@ { lib +, stdenv , edk2 +, llvmPackages , util-linux , nasm , python3 @@ -8,9 +10,12 @@ edk2.mkDerivation "ShellPkg/ShellPkg.dsc" (finalAttrs: { pname = "edk2-uefi-shell"; inherit (edk2) version; - nativeBuildInputs = [ util-linux nasm python3 ]; + nativeBuildInputs = [ util-linux nasm python3 ] + ++ lib.optionals stdenv.cc.isClang [ llvmPackages.bintools llvmPackages.llvm ]; strictDeps = true; + NIX_CFLAGS_COMPILE = lib.optionals stdenv.cc.isClang [ "-fno-pic" "-Qunused-arguments" ]; + # We only have a .efi file in $out which shouldn't be patched or stripped dontPatchELF = true; dontStrip = true; From 75229f7d189fe1ef924e25ba4c087d27552770d8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Stanis=C5=82aw=20Pitucha?= Date: Mon, 7 Nov 2022 13:57:06 +1100 Subject: [PATCH 12/44] esbuild_netlify: fix darwin build --- pkgs/development/tools/esbuild/netlify.nix | 20 ++++++++++++++++++-- 1 file changed, 18 insertions(+), 2 deletions(-) diff --git a/pkgs/development/tools/esbuild/netlify.nix b/pkgs/development/tools/esbuild/netlify.nix index efd5b917e9cd..939458892f04 100644 --- a/pkgs/development/tools/esbuild/netlify.nix +++ b/pkgs/development/tools/esbuild/netlify.nix @@ -1,4 +1,8 @@ -{ buildGoModule, fetchFromGitHub, lib }: +{ lib +, buildGoModule +, fetchFromGitHub +, fetchpatch +}: buildGoModule rec { pname = "esbuild"; @@ -11,7 +15,19 @@ buildGoModule rec { sha256 = "0asjmqfzdrpfx2hd5hkac1swp52qknyqavsm59j8xr4c1ixhc6n9"; }; - vendorSha256 = "sha256-2ABWPqhK2Cf4ipQH7XvRrd+ZscJhYPc3SV2cGT0apdg="; + vendorSha256 = "sha256-+BfxCyg0KkDQpHt/wycy/8CTG6YBA/VJvJFhhzUnSiQ="; + + patches = [ + # Both upstream patches update the same dependency "x/sys". It's required for darwin compatibility. + (fetchpatch { + url = "https://github.com/evanw/esbuild/commit/2567e099fcc6959e630f100b2c737ca80e88ba82.patch"; + hash = "sha256-KdX/Ru9TBX0mSDaS1ijxgzDI+2AoCvt6Wilhpca3VC0="; + }) + (fetchpatch { + url = "https://github.com/evanw/esbuild/commit/fd13718c6195afb9e63682476a774fa6d4483be0.patch"; + hash = "sha256-va/bXRBQf9qgE9LZXcKKAa0ZpMt/QG7BFClJ8bPWG1Y="; + }) + ]; meta = with lib; { description = "A fork of esbuild maintained by netlify"; From 9d1e84f7125d4477b546a638cb26cc937e687be7 Mon Sep 17 00:00:00 2001 From: Theodore Ni <3806110+tjni@users.noreply.github.com> Date: Sun, 6 Nov 2022 21:48:48 -0800 Subject: [PATCH 13/44] python310Packages.amaranth: make compatible with newer setuptools --- .../python-modules/amaranth/default.nix | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/pkgs/development/python-modules/amaranth/default.nix b/pkgs/development/python-modules/amaranth/default.nix index 938b44202b9b..5a3f7e449e23 100644 --- a/pkgs/development/python-modules/amaranth/default.nix +++ b/pkgs/development/python-modules/amaranth/default.nix @@ -2,6 +2,7 @@ , buildPythonPackage , pythonOlder , fetchFromGitHub +, fetchpatch , setuptools , setuptools-scm , pyvcd @@ -31,6 +32,23 @@ buildPythonPackage rec { sha256 = "P9AG3t30eGeeCN5+t7mjhRoOWIGZVzWQji9eYXphjA0="; }; + patches = [ + (fetchpatch { + name = "fix-for-setuptools-64.0.2-preparation.patch"; + url = "https://github.com/amaranth-lang/amaranth/commit/64771a065a280fa683c1e6692383bec4f59f20fa.patch"; + hash = "sha256-Rsh9vVvUQj9nIcrsRirmR6XwFrfZ2VMaYJ4RCQ8sBE0="; + # This commit removes support for Python 3.6, which is unnecessary to fix + # the build when using new setuptools. Include only one file, which has a + # harmless comment change so that the subsequent patch applies cleanly. + includes = ["amaranth/_toolchain/cxx.py"]; + }) + (fetchpatch { + name = "fix-for-setuptools-64.0.2.patch"; + url = "https://github.com/amaranth-lang/amaranth/pull/722/commits/e5a56b07c568e5f4cc2603eefebd14c5cc4e13d8.patch"; + hash = "sha256-C8FyMSKHA7XsEMpO9eYNZx/X5rGaK7p3eXP+jSb6wVg="; + }) + ]; + SETUPTOOLS_SCM_PRETEND_VERSION="${realVersion}"; nativeBuildInputs = [ From d327e40814a4867edcbfd1328d142c541acd9bd6 Mon Sep 17 00:00:00 2001 From: Weijia Wang <9713184+wegank@users.noreply.github.com> Date: Mon, 7 Nov 2022 07:34:00 +0100 Subject: [PATCH 14/44] python3Packages.zeroconf: disable tests on darwin --- pkgs/development/python-modules/zeroconf/default.nix | 3 +++ 1 file changed, 3 insertions(+) diff --git a/pkgs/development/python-modules/zeroconf/default.nix b/pkgs/development/python-modules/zeroconf/default.nix index 7049f5afc965..6bc6b7888d8c 100644 --- a/pkgs/development/python-modules/zeroconf/default.nix +++ b/pkgs/development/python-modules/zeroconf/default.nix @@ -28,6 +28,9 @@ buildPythonPackage rec { ifaddr ]; + # OSError: [Errno 48] Address already in use + doCheck = !stdenv.isDarwin; + checkInputs = [ pytest-asyncio pytestCheckHook From 61f87a8dc31587ea7738c9e14f46f8a3199874e5 Mon Sep 17 00:00:00 2001 From: Mel Bourgeois Date: Mon, 7 Nov 2022 01:32:04 -0600 Subject: [PATCH 15/44] eww: add gdk-pixbuf dependency Without this present, images (particularly SVG) will fail to render in an image widget. It's mentioned as a dependency here: https://github.com/elkowar/eww/issues/302#issuecomment-947627327 --- pkgs/applications/window-managers/eww/default.nix | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/pkgs/applications/window-managers/eww/default.nix b/pkgs/applications/window-managers/eww/default.nix index 6420b79072f0..4e74fcd26e77 100644 --- a/pkgs/applications/window-managers/eww/default.nix +++ b/pkgs/applications/window-managers/eww/default.nix @@ -3,6 +3,7 @@ , fetchFromGitHub , pkg-config , gtk3 +, gdk-pixbuf , withWayland ? false , gtk-layer-shell , stdenv @@ -25,7 +26,7 @@ rustPlatform.buildRustPackage rec { nativeBuildInputs = [ pkg-config ]; - buildInputs = [ gtk3 ] ++ lib.optional withWayland gtk-layer-shell; + buildInputs = [ gtk3 gdk-pixbuf ] ++ lib.optional withWayland gtk-layer-shell; buildNoDefaultFeatures = withWayland; buildFeatures = lib.optional withWayland "wayland"; From 24323d103cd20a6b665eab03c2ec324caccb99b8 Mon Sep 17 00:00:00 2001 From: Pavol Rusnak Date: Mon, 7 Nov 2022 09:34:00 +0100 Subject: [PATCH 16/44] electron: mark versions < 18 as EOL see https://endoflife.date/electron for more info --- pkgs/development/tools/electron/generic.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkgs/development/tools/electron/generic.nix b/pkgs/development/tools/electron/generic.nix index 97e7fb520346..8c64b86b43a1 100644 --- a/pkgs/development/tools/electron/generic.nix +++ b/pkgs/development/tools/electron/generic.nix @@ -31,7 +31,7 @@ let ++ optionals (versionAtLeast version "11.0.0") [ "aarch64-darwin" ] ++ optionals (versionOlder version "19.0.0") [ "i686-linux" ]; sourceProvenance = with sourceTypes; [ binaryNativeCode ]; - knownVulnerabilities = optional (versionOlder version "15.0.0") "Electron version ${version} is EOL"; + knownVulnerabilities = optional (versionOlder version "18.0.0") "Electron version ${version} is EOL"; }; fetcher = vers: tag: hash: fetchurl { From b40b8b92e200373f85854d197bc3d1687c43d38f Mon Sep 17 00:00:00 2001 From: Maximilian Bosch Date: Mon, 7 Nov 2022 10:04:01 +0100 Subject: [PATCH 17/44] nixos/wordpress: ensure that fonts already exists Not a big deal in most of the cases because wordpress ensures that this directory exists on its own, but with our twentig customizations that's actually causing issues. (cherry picked from commit 3285342bfe5f401dda84c13c834e73154928a61c) --- nixos/modules/services/web-apps/wordpress.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/nixos/modules/services/web-apps/wordpress.nix b/nixos/modules/services/web-apps/wordpress.nix index 660f1b2d7f86..43a6d7e75dc6 100644 --- a/nixos/modules/services/web-apps/wordpress.nix +++ b/nixos/modules/services/web-apps/wordpress.nix @@ -409,6 +409,8 @@ in "d '${stateDir hostName}' 0750 ${user} ${webserver.group} - -" "d '${cfg.uploadsDir}' 0750 ${user} ${webserver.group} - -" "Z '${cfg.uploadsDir}' 0750 ${user} ${webserver.group} - -" + "d '${cfg.fontsDir}' 0750 ${user} ${webserver.group} - -" + "Z '${cfg.fontsDir}' 0750 ${user} ${webserver.group} - -" ]) eachSite); systemd.services = mkMerge [ From 0738e1622cad4cf7db86a6ea3ed66cb0b82df864 Mon Sep 17 00:00:00 2001 From: zowoq <59103226+zowoq@users.noreply.github.com> Date: Mon, 7 Nov 2022 19:36:16 +1000 Subject: [PATCH 18/44] nil: 2022-10-03 -> 2022-11-07 https://github.com/oxalica/nil/releases/tag/2022-11-07 --- pkgs/development/tools/nil/default.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/development/tools/nil/default.nix b/pkgs/development/tools/nil/default.nix index 29a4a4c425bd..c943d4715e57 100644 --- a/pkgs/development/tools/nil/default.nix +++ b/pkgs/development/tools/nil/default.nix @@ -2,16 +2,16 @@ rustPlatform.buildRustPackage rec { pname = "nil"; - version = "2022-10-03"; + version = "2022-11-07"; src = fetchFromGitHub { owner = "oxalica"; repo = pname; rev = version; - hash = "sha256-Oo0y/333YyeW9zeYQyiUUay7q7GK/Uu/FdEa6+5c4Pk="; + hash = "sha256-ioY9RvKx9DKnNTeMW8mAIEq23w7Y+lAOFWMkgUQ5fu4="; }; - cargoHash = "sha256-z7wjap7IL2OTd2wEUB6EbSbP71dZiqbKDmJ7oUjVi0U="; + cargoHash = "sha256-sL/bnLK3TifmVHy3LOsduETHh9SGz639vgEKkbHE0HQ="; CFG_DATE = version; CFG_REV = "release"; From 9185b136d3e211a1f2237a8074698eb8e08a5af5 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Mon, 7 Nov 2022 10:03:34 +0000 Subject: [PATCH 19/44] discord-canary: 0.0.142 -> 0.0.143 --- .../networking/instant-messengers/discord/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/applications/networking/instant-messengers/discord/default.nix b/pkgs/applications/networking/instant-messengers/discord/default.nix index 007714644374..185974539a1f 100644 --- a/pkgs/applications/networking/instant-messengers/discord/default.nix +++ b/pkgs/applications/networking/instant-messengers/discord/default.nix @@ -3,7 +3,7 @@ let versions = if stdenv.isLinux then { stable = "0.0.21"; ptb = "0.0.34"; - canary = "0.0.142"; + canary = "0.0.143"; } else { stable = "0.0.264"; ptb = "0.0.59"; @@ -22,7 +22,7 @@ let }; canary = fetchurl { url = "https://dl-canary.discordapp.net/apps/linux/${version}/discord-canary-${version}.tar.gz"; - sha256 = "sha256-/EWJC3hFIBqwHa9z4nMWR7CpoaqYY+pvw+1vcq4F0LU="; + sha256 = "sha256-K+yyg9GTAvggfn4JQCTmq016tMyyzq+nD7aL3+bWFlo="; }; }; x86_64-darwin = { From 29ea368e3c5924d83344e614dd42cf81301097dd Mon Sep 17 00:00:00 2001 From: Pavol Rusnak Date: Mon, 7 Nov 2022 11:26:53 +0100 Subject: [PATCH 20/44] python3Packages.construct-classes: init at 0.1.2 --- .../construct-classes/default.nix | 41 +++++++++++++++++++ pkgs/top-level/python-packages.nix | 2 + 2 files changed, 43 insertions(+) create mode 100644 pkgs/development/python-modules/construct-classes/default.nix diff --git a/pkgs/development/python-modules/construct-classes/default.nix b/pkgs/development/python-modules/construct-classes/default.nix new file mode 100644 index 000000000000..479f0703118f --- /dev/null +++ b/pkgs/development/python-modules/construct-classes/default.nix @@ -0,0 +1,41 @@ +{ lib +, stdenv +, buildPythonPackage +, fetchFromGitHub +, poetry-core +, construct +, pytestCheckHook +}: + +buildPythonPackage rec { + pname = "construct-classes"; + version = "0.1.2"; + format = "pyproject"; + + # no tests in PyPI tarball + src = fetchFromGitHub { + owner = "matejcik"; + repo = "construct-classes"; + rev = "v${version}"; + sha256 = "sha256-l4sVacKTuQbhXCw2lVHCl1OzpCiKmEAm9nSQ8pxFuTo="; + }; + + nativeBuildInputs = [ + poetry-core + ]; + + propagatedBuildInputs = [ + construct + ]; + + checkInputs = [ pytestCheckHook ]; + + pythonImportsCheck = [ "construct_classes" ]; + + meta = with lib; { + description = "Parse your binary data into dataclasses."; + homepage = "https://github.com/matejcik/construct-classes"; + license = licenses.mit; + maintainers = with maintainers; [ prusnak ]; + }; +} diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix index 6e5648173dd1..3810767e7d2a 100644 --- a/pkgs/top-level/python-packages.nix +++ b/pkgs/top-level/python-packages.nix @@ -1928,6 +1928,8 @@ self: super: with self; { construct = callPackage ../development/python-modules/construct { }; + construct-classes = callPackage ../development/python-modules/construct-classes { }; + consul = callPackage ../development/python-modules/consul { }; container-inspector = callPackage ../development/python-modules/container-inspector { }; From 574f38381636b7abc37f96fd69a87cc9d180e75f Mon Sep 17 00:00:00 2001 From: Pavol Rusnak Date: Mon, 7 Nov 2022 11:27:33 +0100 Subject: [PATCH 21/44] python3Packages.trezor: 0.13.3 -> 0.13.4 --- pkgs/development/python-modules/trezor/default.nix | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/pkgs/development/python-modules/trezor/default.nix b/pkgs/development/python-modules/trezor/default.nix index b4a2925a4155..ae9778d91039 100644 --- a/pkgs/development/python-modules/trezor/default.nix +++ b/pkgs/development/python-modules/trezor/default.nix @@ -7,6 +7,7 @@ , attrs , click , construct +, construct-classes , ecdsa , hidapi , libusb1 @@ -24,13 +25,13 @@ buildPythonPackage rec { pname = "trezor"; - version = "0.13.3"; + version = "0.13.4"; disabled = !isPy3k; src = fetchPypi { inherit pname version; - sha256 = "055d32174d4ecf2353f7622ee44b8e82e3bef78fe40ce5cdbeafc785b422a049"; + sha256 = "04a77b44005971819386bbd55242a1004b1f88fbbdb829deb039a1e0028a4af1"; }; nativeBuildInputs = [ installShellFiles ]; @@ -39,6 +40,7 @@ buildPythonPackage rec { attrs click construct + construct-classes ecdsa hidapi libusb1 @@ -58,6 +60,7 @@ buildPythonPackage rec { disabledTestPaths = [ "tests/test_stellar.py" # requires stellar-sdk + "tests/test_firmware.py" # requires network downloads ]; pythonImportsCheck = [ "trezorlib" ]; From 6704831a47c7d57b7d8773a63edb9791973d46c0 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Mon, 7 Nov 2022 11:05:40 +0000 Subject: [PATCH 22/44] fuzzel: 1.7.0 -> 1.8.2 --- pkgs/applications/misc/fuzzel/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/applications/misc/fuzzel/default.nix b/pkgs/applications/misc/fuzzel/default.nix index 421f98b1fb62..162b6362fd7d 100644 --- a/pkgs/applications/misc/fuzzel/default.nix +++ b/pkgs/applications/misc/fuzzel/default.nix @@ -25,14 +25,14 @@ assert svgSupport -> enableCairo; stdenv.mkDerivation rec { pname = "fuzzel"; - version = "1.7.0"; + version = "1.8.2"; src = fetchFromGitea { domain = "codeberg.org"; owner = "dnkl"; repo = "fuzzel"; rev = version; - sha256 = "1261gwxiky37pvzmmbrpml1psa22kkglb141ybj1fbnwg6j7jvlf"; + sha256 = "sha256-5uXf5HfQ8bDQSMNCHHaC9sCX5P/D89T2ZOUiXTDx3bQ="; }; nativeBuildInputs = [ From a8ed4be9a67c98770dceb00b52f7caa2d0c73eca Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Mon, 7 Nov 2022 11:31:21 +0000 Subject: [PATCH 23/44] gmsh: 4.10.5 -> 4.11.0 --- pkgs/applications/science/math/gmsh/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/applications/science/math/gmsh/default.nix b/pkgs/applications/science/math/gmsh/default.nix index 03a427e06cc2..22eee8b305a5 100644 --- a/pkgs/applications/science/math/gmsh/default.nix +++ b/pkgs/applications/science/math/gmsh/default.nix @@ -5,11 +5,11 @@ assert (!blas.isILP64) && (!lapack.isILP64); stdenv.mkDerivation rec { pname = "gmsh"; - version = "4.10.5"; + version = "4.11.0"; src = fetchurl { url = "https://gmsh.info/src/gmsh-${version}-source.tgz"; - sha256 = "sha256-zAMMWu5l59WPhQuLb1WmiUXIm8hx+U4SOSefWiEPxOo="; + sha256 = "sha256-PPLyRFXuCSUsmeZNTmRilW5o8P8fN7rKC3jICdbMVXo="; }; buildInputs = [ From 286e7fbbe9ef8c5ea930f7f6ad535dc8e26f5d81 Mon Sep 17 00:00:00 2001 From: teutat3s <10206665+teutat3s@users.noreply.github.com> Date: Mon, 7 Nov 2022 12:34:40 +0100 Subject: [PATCH 24/44] lispPackages_new.sbclPackages.pgloader: add missing freetds dependency to mssql nativeLibs --- pkgs/development/lisp-modules-new/ql.nix | 3 +++ 1 file changed, 3 insertions(+) diff --git a/pkgs/development/lisp-modules-new/ql.nix b/pkgs/development/lisp-modules-new/ql.nix index 8e06ef75a1f6..4ffce7a8d769 100644 --- a/pkgs/development/lisp-modules-new/ql.nix +++ b/pkgs/development/lisp-modules-new/ql.nix @@ -60,6 +60,9 @@ let trivial-ssh-libssh2 = pkg: { nativeLibs = [ libssh2 ]; }; + mssql = pkg: { + nativeLibs = [ freetds ]; + }; sqlite = pkg: { nativeLibs = [ sqlite ]; }; From dd947cf33a9fd2ebbd056690e1783c4869690c38 Mon Sep 17 00:00:00 2001 From: 06kellyjac Date: Mon, 7 Nov 2022 11:38:32 +0000 Subject: [PATCH 25/44] grype: fix for darwin --- pkgs/tools/security/grype/default.nix | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/pkgs/tools/security/grype/default.nix b/pkgs/tools/security/grype/default.nix index f4624b87e80a..c690c0f62941 100644 --- a/pkgs/tools/security/grype/default.nix +++ b/pkgs/tools/security/grype/default.nix @@ -26,7 +26,8 @@ buildGoModule rec { find "$out" -name .git -print0 | xargs -0 rm -rf ''; }; - vendorSha256 = "sha256-K6MJp07JEit/6AHqLtnzXIaVCi7W6jfX41M96VwnS5A="; + proxyVendor = true; + vendorSha256 = "sha256-tRux9M9vFPj3TqhsF1zSV4V1YKnLVViuQjum9YFr5FU="; nativeBuildInputs = [ installShellFiles From b234d4f06d75dc2ac2caafb6e3be83d940715a96 Mon Sep 17 00:00:00 2001 From: Robert Hensing Date: Mon, 7 Nov 2022 13:05:07 +0100 Subject: [PATCH 26/44] esbuild_netlify: Add netlify-cli to tests --- pkgs/development/tools/esbuild/netlify.nix | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/pkgs/development/tools/esbuild/netlify.nix b/pkgs/development/tools/esbuild/netlify.nix index 939458892f04..6520c53dd1f4 100644 --- a/pkgs/development/tools/esbuild/netlify.nix +++ b/pkgs/development/tools/esbuild/netlify.nix @@ -2,6 +2,7 @@ , buildGoModule , fetchFromGitHub , fetchpatch +, netlify-cli }: buildGoModule rec { @@ -29,6 +30,12 @@ buildGoModule rec { }) ]; + passthru = { + tests = { + inherit netlify-cli; + }; + }; + meta = with lib; { description = "A fork of esbuild maintained by netlify"; homepage = "https://github.com/netlify/esbuild"; From ac4ed49fa5ff12e6eb6aac72b17f5df01088d4b4 Mon Sep 17 00:00:00 2001 From: Sascha Grunert Date: Mon, 7 Nov 2022 13:05:25 +0100 Subject: [PATCH 27/44] crun: 1.6 -> 1.7 Signed-off-by: Sascha Grunert --- pkgs/applications/virtualization/crun/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/applications/virtualization/crun/default.nix b/pkgs/applications/virtualization/crun/default.nix index 3bd766e7ae94..810fefa2863f 100644 --- a/pkgs/applications/virtualization/crun/default.nix +++ b/pkgs/applications/virtualization/crun/default.nix @@ -38,13 +38,13 @@ let in stdenv.mkDerivation rec { pname = "crun"; - version = "1.6"; + version = "1.7"; src = fetchFromGitHub { owner = "containers"; repo = pname; rev = version; - sha256 = "sha256-JO07bF2Xucz8lSvj7om17a/NT0I7Vru1vayZhPDFLIw="; + sha256 = "sha256-Ly6GBR7nF7J5Dwe1jrQxR4XYsao7KxBAxGn8fsJwmMs="; fetchSubmodules = true; }; From acc4e8eb237f83d0e85463722c9411ee0de44f8a Mon Sep 17 00:00:00 2001 From: 0xb10c Date: Mon, 7 Nov 2022 11:47:24 +0100 Subject: [PATCH 28/44] btcd: init at 0.23.3 --- maintainers/maintainer-list.nix | 6 ++++ .../applications/blockchains/btcd/default.nix | 31 +++++++++++++++++++ pkgs/top-level/all-packages.nix | 2 ++ 3 files changed, 39 insertions(+) create mode 100644 pkgs/applications/blockchains/btcd/default.nix diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix index 860ac22872e4..99907a6877f8 100644 --- a/maintainers/maintainer-list.nix +++ b/maintainers/maintainer-list.nix @@ -69,6 +69,12 @@ fingerprint = "F466 A548 AD3F C1F1 8C88 4576 8702 7528 B006 D66D"; }]; }; + _0xB10C = { + email = "nixpkgs@b10c.me"; + name = "0xB10C"; + github = "0xb10c"; + githubId = 19157360; + }; _0xbe7a = { email = "nix@be7a.de"; name = "Bela Stoyan"; diff --git a/pkgs/applications/blockchains/btcd/default.nix b/pkgs/applications/blockchains/btcd/default.nix new file mode 100644 index 000000000000..34a6aa1dad83 --- /dev/null +++ b/pkgs/applications/blockchains/btcd/default.nix @@ -0,0 +1,31 @@ +{ lib, buildGoModule, fetchFromGitHub }: + +buildGoModule rec { + pname = "btcd"; + version = "0.23.3"; + + src = fetchFromGitHub { + owner = "btcsuite"; + repo = pname; + rev = "v${version}"; + sha256 = "sha256-LdK68Ianiyrs+HVMwrkiX2ruCWKkdpuY8ylxhNbm9qI="; + }; + + vendorSha256 = "sha256-3w8rb0sfAIFCXqPXOKb4QwoLd7WsbFv3phu/rJCEjeY="; + + subPackages = [ "." "cmd/*" ]; + + preCheck = '' + DIR="github.com/btcsuite/btcd/" + # TestCreateDefaultConfigFile requires the sample-btcd.conf in $DIR + mkdir -p $DIR + cp sample-btcd.conf $DIR + ''; + + meta = with lib; { + description = "An alternative full node bitcoin implementation written in Go (golang)"; + homepage = "https://github.com/btcsuite/btcd"; + license = licenses.isc; + maintainers = with maintainers; [ _0xB10C ]; + }; +} diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index d05df3751808..a043b0a32d15 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -33395,6 +33395,8 @@ with pkgs; inherit (darwin) autoSignDarwinBinariesHook; }; + btcd = callPackage ../applications/blockchains/btcd { }; + cgminer = callPackage ../applications/blockchains/cgminer { }; chia = callPackage ../applications/blockchains/chia { }; From 1528a7ca86b19830e87590113e9db15955fbffe9 Mon Sep 17 00:00:00 2001 From: Bobby Rong Date: Mon, 7 Nov 2022 14:25:27 +0800 Subject: [PATCH 29/44] cinnamon.cinnamon-gsettings-overrides: Override gnome-terminal settings with Fedora's default This fixes issues caused by vanilla gnome-terminal and mint-artwork: - Grey text and black background, this makes text almost unreadable. - Only one 'New Terminal' button in menu which means you cannot open tab and open window in the same menu. --- .../cinnamon-gsettings-overrides/default.nix | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/pkgs/desktops/cinnamon/cinnamon-gsettings-overrides/default.nix b/pkgs/desktops/cinnamon/cinnamon-gsettings-overrides/default.nix index a8d46d578996..30caaaf6e3df 100644 --- a/pkgs/desktops/cinnamon/cinnamon-gsettings-overrides/default.nix +++ b/pkgs/desktops/cinnamon/cinnamon-gsettings-overrides/default.nix @@ -2,6 +2,7 @@ , runCommand , nixos-artwork , glib +, gnome , gtk3 , gsettings-desktop-schemas , extraGSettingsOverrides ? "" @@ -35,9 +36,20 @@ let cinnamon-session cinnamon-settings-daemon cinnamon-common + gnome.gnome-terminal gtk3 ] ++ extraGSettingsOverridePackages; + gsettingsOverrides = '' + # Use Fedora's default to make text readable and + # restore ununified menu. + # https://github.com/NixOS/nixpkgs/issues/200017 + [org.gnome.Terminal.Legacy.Settings] + theme-variant='dark' + unified-menu=false + + ${extraGSettingsOverrides} + ''; in # TODO: Having https://github.com/NixOS/nixpkgs/issues/54150 would supersede this @@ -53,7 +65,7 @@ runCommand "cinnamon-gsettings-overrides" { preferLocalBuild = true; } chmod -R a+w "$data_dir" cat - > "$schema_dir/nixos-defaults.gschema.override" <<- EOF - ${extraGSettingsOverrides} + ${gsettingsOverrides} EOF ${glib.dev}/bin/glib-compile-schemas --strict "$schema_dir" From f9c04d85570252777530fe2495b96352cbac7f3c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Christian=20K=C3=B6gler?= Date: Sun, 6 Nov 2022 23:18:32 +0100 Subject: [PATCH 30/44] neovide: 0.10.1 -> 0.10.3 --- pkgs/applications/editors/neovim/neovide/default.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/applications/editors/neovim/neovide/default.nix b/pkgs/applications/editors/neovim/neovide/default.nix index 3d1aa9cdc57c..3a32516b7d3c 100644 --- a/pkgs/applications/editors/neovim/neovide/default.nix +++ b/pkgs/applications/editors/neovim/neovide/default.nix @@ -31,16 +31,16 @@ }: rustPlatform.buildRustPackage rec { pname = "neovide"; - version = "0.10.1"; + version = "0.10.3"; src = fetchFromGitHub { owner = "Kethku"; repo = "neovide"; rev = version; - sha256 = "sha256-PViSiK6+H79MLIOFe26cNqUZ6gZdqDC/S+ksTrbOm54="; + sha256 = "sha256-CcBiCcfOJzuq0DnokTUHpMdo7Ry29ugQ+N7Hk0R+cQE="; }; - cargoSha256 = "sha256-GvueDUY4Hzfih/MyEfhdz/QNVd9atTC8SCF+PyuJJic="; + cargoSha256 = "sha256-bS7yBnxAWPoTTabxI6W5Knl1DFiDztYSkEPJMa8bqlY="; SKIA_SOURCE_DIR = let From f4ff9c26499a600fcc2459cfc6d8bbc5c1dfc5ea Mon Sep 17 00:00:00 2001 From: happysalada Date: Mon, 7 Nov 2022 07:36:28 -0500 Subject: [PATCH 31/44] lighthouse: init module --- nixos/modules/module-list.nix | 1 + .../services/blockchain/ethereum/erigon.nix | 26 +- .../blockchain/ethereum/lighthouse.nix | 333 ++++++++++++++++++ 3 files changed, 358 insertions(+), 2 deletions(-) create mode 100644 nixos/modules/services/blockchain/ethereum/lighthouse.nix diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix index 90825aa3401f..cadcb2e99dc9 100644 --- a/nixos/modules/module-list.nix +++ b/nixos/modules/module-list.nix @@ -321,6 +321,7 @@ ./services/backup/znapzend.nix ./services/blockchain/ethereum/geth.nix ./services/blockchain/ethereum/erigon.nix + ./services/blockchain/ethereum/lighthouse.nix ./services/backup/zrepl.nix ./services/cluster/corosync/default.nix ./services/cluster/hadoop/default.nix diff --git a/nixos/modules/services/blockchain/ethereum/erigon.nix b/nixos/modules/services/blockchain/ethereum/erigon.nix index 162774730976..892262d246b7 100644 --- a/nixos/modules/services/blockchain/ethereum/erigon.nix +++ b/nixos/modules/services/blockchain/ethereum/erigon.nix @@ -13,6 +13,15 @@ in { services.erigon = { enable = mkEnableOption (lib.mdDoc "Ethereum implementation on the efficiency frontier"); + group = mkOption { + type = types.str; + default = "ethereum"; + description = lib.mdDoc '' + Group of the user running the lighthouse process. This is used to share the jwt + secret with the execution layer. + ''; + }; + settings = mkOption { description = lib.mdDoc '' Configuration for Erigon @@ -55,6 +64,19 @@ in { }; config = mkIf cfg.enable { + users = { + users.erigon = { + name = "erigon"; + group = cfg.group; + description = "Erigon user"; + home = "/var/lib/erigon"; + isSystemUser = true; + }; + groups = mkIf (cfg.group == "ethereum") { + ethereum = {}; + }; + }; + # Default values are the same as in the binary, they are just written here for convenience. services.erigon.settings = { datadir = mkDefault "/var/lib/erigon"; @@ -77,10 +99,11 @@ in { serviceConfig = { ExecStart = "${pkgs.erigon}/bin/erigon --config ${configFile}"; + User = "erigon"; + Group = cfg.group; Restart = "on-failure"; StateDirectory = "erigon"; CapabilityBoundingSet = ""; - DynamicUser = true; NoNewPrivileges = true; PrivateTmp = true; ProtectHome = true; @@ -97,7 +120,6 @@ in { RestrictNamespaces = true; LockPersonality = true; RemoveIPC = true; - RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ]; SystemCallFilter = [ "@system-service" "~@privileged" ]; }; }; diff --git a/nixos/modules/services/blockchain/ethereum/lighthouse.nix b/nixos/modules/services/blockchain/ethereum/lighthouse.nix new file mode 100644 index 000000000000..57e32132f1d1 --- /dev/null +++ b/nixos/modules/services/blockchain/ethereum/lighthouse.nix @@ -0,0 +1,333 @@ +{ config, lib, pkgs, ... }: + +with lib; +let + + cfg = config.services.lighthouse; +in { + + options = { + services.lighthouse = { + beacon = mkOption { + description = lib.mdDoc "Beacon node"; + type = types.submodule { + options = { + enable = lib.mkEnableOption (lib.mdDoc "Lightouse Beacon node"); + + dataDir = mkOption { + type = types.str; + default = "/var/lib/lighthouse-beacon"; + description = lib.mdDoc '' + Directory where data will be stored. Each chain will be stored under it's own specific subdirectory. + ''; + }; + + address = mkOption { + type = types.str; + default = "0.0.0.0"; + description = lib.mdDoc '' + Listen address of Beacon node. + ''; + }; + + port = mkOption { + type = types.port; + default = 9000; + description = lib.mdDoc '' + Port number the Beacon node will be listening on. + ''; + }; + + openFirewall = mkOption { + type = types.bool; + default = false; + description = lib.mdDoc '' + Open the port in the firewall + ''; + }; + + disableDepositContractSync = mkOption { + type = types.bool; + default = false; + description = lib.mdDoc '' + Explictly disables syncing of deposit logs from the execution node. + This overrides any previous option that depends on it. + Useful if you intend to run a non-validating beacon node. + ''; + }; + + group = mkOption { + type = types.str; + default = "ethereum"; + description = lib.mdDoc '' + Group of the user running the lighthouse process. This is used to share the jwt + secret with the execution layer. + ''; + }; + + execution = { + address = mkOption { + type = types.str; + default = "127.0.0.1"; + description = lib.mdDoc '' + Listen address for the execution layer. + ''; + }; + + port = mkOption { + type = types.port; + default = 8551; + description = lib.mdDoc '' + Port number the Beacon node will be listening on for the execution layer. + ''; + }; + + jwtPath = mkOption { + type = types.str; + default = ""; + description = lib.mdDoc '' + Path for the jwt secret required to connect to the execution layer. + ''; + }; + }; + + http = { + enable = lib.mkEnableOption (lib.mdDoc "Beacon node http api"); + port = mkOption { + type = types.port; + default = 5052; + description = lib.mdDoc '' + Port number of Beacon node RPC service. + ''; + }; + + address = mkOption { + type = types.str; + default = "127.0.0.1"; + description = lib.mdDoc '' + Listen address of Beacon node RPC service. + ''; + }; + }; + + metrics = { + enable = lib.mkEnableOption (lib.mdDoc "Beacon node prometheus metrics"); + address = mkOption { + type = types.str; + default = "127.0.0.1"; + description = lib.mdDoc '' + Listen address of Beacon node metrics service. + ''; + }; + + port = mkOption { + type = types.port; + default = 5054; + description = lib.mdDoc '' + Port number of Beacon node metrics service. + ''; + }; + }; + + extraArgs = mkOption { + type = types.str; + description = lib.mdDoc '' + Additional arguments passed to the lighthouse beacon command. + ''; + default = ""; + example = ""; + }; + }; + }; + }; + + validator = mkOption { + description = lib.mdDoc "Validator node"; + type = types.submodule { + options = { + enable = mkOption { + type = types.bool; + default = false; + description = lib.mdDoc "Enable Lightouse Validator node."; + }; + + dataDir = mkOption { + type = types.str; + default = "/var/lib/lighthouse-validator"; + description = lib.mdDoc '' + Directory where data will be stored. Each chain will be stored under it's own specific subdirectory. + ''; + }; + + beaconNodes = mkOption { + type = types.listOf types.str; + default = ["http://localhost:5052"]; + description = lib.mdDoc '' + Beacon nodes to connect to. + ''; + }; + + metrics = { + enable = lib.mkEnableOption (lib.mdDoc "Validator node prometheus metrics"); + address = mkOption { + type = types.str; + default = "127.0.0.1"; + description = lib.mdDoc '' + Listen address of Validator node metrics service. + ''; + }; + + port = mkOption { + type = types.port; + default = 5056; + description = lib.mdDoc '' + Port number of Validator node metrics service. + ''; + }; + }; + + extraArgs = mkOption { + type = types.str; + description = lib.mdDoc '' + Additional arguments passed to the lighthouse validator command. + ''; + default = ""; + example = ""; + }; + }; + }; + }; + + network = mkOption { + type = types.enum [ "mainnet" "prater" "goerli" "gnosis" "kiln" "ropsten" "sepolia" ]; + default = "mainnet"; + description = lib.mdDoc '' + The network to connect to. Mainnet is the default ethereum network. + ''; + }; + + extraArgs = mkOption { + type = types.str; + description = lib.mdDoc '' + Additional arguments passed to every lighthouse command. + ''; + default = ""; + example = ""; + }; + }; + }; + + config = mkIf (cfg.beacon.enable || cfg.validator.enable) { + + users = { + users.lighthouse-beacon = { + name = "lighthouse-beacon"; + group = cfg.beacon.group; + description = "Lighthouse beacon node user"; + home = "${cfg.beacon.dataDir}"; + isSystemUser = true; + }; + groups = mkIf (cfg.beacon.group == "ethereum") { + ethereum = {}; + }; + }; + + environment.systemPackages = [ pkgs.lighthouse ] ; + + networking.firewall = mkIf cfg.beacon.enable { + allowedTCPPorts = mkIf cfg.beacon.openFirewall [ cfg.beacon.port ]; + allowedUDPPorts = mkIf cfg.beacon.openFirewall [ cfg.beacon.port ]; + }; + + + systemd.services.lighthouse-beacon = mkIf cfg.beacon.enable { + description = "Lighthouse beacon node (connect to P2P nodes and verify blocks)"; + wantedBy = [ "multi-user.target" ]; + after = [ "network.target" ]; + + script = '' + # make sure the chain data directory is created on first run + mkdir -p ${cfg.beacon.dataDir}/${cfg.network} + + ${pkgs.lighthouse}/bin/lighthouse beacon_node \ + --disable-upnp \ + ${lib.optionalString cfg.beacon.disableDepositContractSync "--disable-deposit-contract-sync"} \ + --port ${toString cfg.beacon.port} \ + --listen-address ${cfg.beacon.address} \ + --network ${cfg.network} \ + --datadir ${cfg.beacon.dataDir}/${cfg.network} \ + --execution-endpoint http://${cfg.beacon.execution.address}:${toString cfg.beacon.execution.port} \ + --execution-jwt ${cfg.beacon.execution.jwtPath} \ + ${lib.optionalString cfg.beacon.http.enable '' --http --http-address ${cfg.beacon.http.address} --http-port ${toString cfg.beacon.http.port}''} \ + ${lib.optionalString cfg.beacon.metrics.enable '' --metrics --metrics-address ${cfg.beacon.metrics.address} --metrics-port ${toString cfg.beacon.metrics.port}''} \ + ${cfg.extraArgs} ${cfg.beacon.extraArgs} + ''; + serviceConfig = { + User = "lighthouse-beacon"; + Group = cfg.beacon.group; + Restart = "on-failure"; + StateDirectory = "lighthouse-beacon"; + NoNewPrivileges = true; + PrivateTmp = true; + ProtectHome = true; + ProtectClock = true; + ProtectProc = "noaccess"; + ProcSubset = "pid"; + ProtectKernelLogs = true; + ProtectKernelModules = true; + ProtectKernelTunables = true; + ProtectControlGroups = true; + ProtectHostname = true; + RestrictSUIDSGID = true; + RestrictRealtime = true; + RestrictNamespaces = true; + LockPersonality = true; + RemoveIPC = true; + SystemCallFilter = [ "@system-service" "~@privileged" ]; + }; + }; + + systemd.services.lighthouse-validator = mkIf cfg.validator.enable { + description = "Lighthouse validtor node (manages validators, using data obtained from the beacon node via a HTTP API)"; + wantedBy = [ "multi-user.target" ]; + after = [ "network.target" ]; + + script = '' + # make sure the chain data directory is created on first run + mkdir -p ${cfg.validator.dataDir}/${cfg.network} + + ${pkgs.lighthouse}/bin/lighthouse validator_client \ + --network ${cfg.network} \ + --beacon-nodes ${lib.concatStringsSep "," cfg.validator.beaconNodes} \ + --datadir ${cfg.validator.dataDir}/${cfg.network} + ${optionalString cfg.validator.metrics.enable ''--metrics --metrics-address ${cfg.validator.metrics.address} --metrics-port ${toString cfg.validator.metrics.port}''} \ + ${cfg.extraArgs} ${cfg.validator.extraArgs} + ''; + + serviceConfig = { + Restart = "on-failure"; + StateDirectory = "lighthouse-validator"; + CapabilityBoundingSet = ""; + DynamicUser = true; + NoNewPrivileges = true; + PrivateTmp = true; + ProtectHome = true; + ProtectClock = true; + ProtectProc = "noaccess"; + ProcSubset = "pid"; + ProtectKernelLogs = true; + ProtectKernelModules = true; + ProtectKernelTunables = true; + ProtectControlGroups = true; + ProtectHostname = true; + RestrictSUIDSGID = true; + RestrictRealtime = true; + RestrictNamespaces = true; + LockPersonality = true; + RemoveIPC = true; + RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ]; + SystemCallFilter = [ "@system-service" "~@privileged" ]; + }; + }; + }; +} From 0778d6e0c447a7f8ee3e579af97a0cab04954a88 Mon Sep 17 00:00:00 2001 From: Fabian Affolter Date: Mon, 7 Nov 2022 14:17:55 +0100 Subject: [PATCH 32/44] metasploit: 6.2.24 -> 6.2.25 --- pkgs/tools/security/metasploit/Gemfile | 2 +- pkgs/tools/security/metasploit/Gemfile.lock | 30 +++++++------- pkgs/tools/security/metasploit/default.nix | 4 +- pkgs/tools/security/metasploit/gemset.nix | 46 ++++++++++----------- 4 files changed, 41 insertions(+), 41 deletions(-) diff --git a/pkgs/tools/security/metasploit/Gemfile b/pkgs/tools/security/metasploit/Gemfile index f1cd325ad15a..4a6dd4336fab 100644 --- a/pkgs/tools/security/metasploit/Gemfile +++ b/pkgs/tools/security/metasploit/Gemfile @@ -1,4 +1,4 @@ # frozen_string_literal: true source "https://rubygems.org" -gem "metasploit-framework", git: "https://github.com/rapid7/metasploit-framework", ref: "refs/tags/6.2.24" +gem "metasploit-framework", git: "https://github.com/rapid7/metasploit-framework", ref: "refs/tags/6.2.25" diff --git a/pkgs/tools/security/metasploit/Gemfile.lock b/pkgs/tools/security/metasploit/Gemfile.lock index 301c3acbb90d..1817df3c473a 100644 --- a/pkgs/tools/security/metasploit/Gemfile.lock +++ b/pkgs/tools/security/metasploit/Gemfile.lock @@ -1,9 +1,9 @@ GIT remote: https://github.com/rapid7/metasploit-framework - revision: 1c805324f10bafa3a99fcd0315cc99ef83430b23 - ref: refs/tags/6.2.24 + revision: 2ab12336a4a6197c88ca4777c016311fa4fb7a3d + ref: refs/tags/6.2.25 specs: - metasploit-framework (6.2.24) + metasploit-framework (6.2.25) actionpack (~> 6.0) activerecord (~> 6.0) activesupport (~> 6.0) @@ -129,13 +129,13 @@ GEM arel-helpers (2.14.0) activerecord (>= 3.1.0, < 8) aws-eventstream (1.2.0) - aws-partitions (1.652.0) + aws-partitions (1.656.0) aws-sdk-core (3.166.0) aws-eventstream (~> 1, >= 1.0.2) aws-partitions (~> 1, >= 1.651.0) aws-sigv4 (~> 1.5) jmespath (~> 1, >= 1.6.1) - aws-sdk-ec2 (1.343.0) + aws-sdk-ec2 (1.345.0) aws-sdk-core (~> 3, >= 3.165.0) aws-sigv4 (~> 1.1) aws-sdk-iam (1.73.0) @@ -152,7 +152,7 @@ GEM aws-eventstream (~> 1, >= 1.0.2) bcrypt (3.1.18) bcrypt_pbkdf (1.1.0) - bindata (2.4.13) + bindata (2.4.14) bson (4.15.0) builder (3.2.4) concurrent-ruby (1.0.5) @@ -174,7 +174,7 @@ GEM eventmachine (>= 1.0.0.beta.4) erubi (1.11.0) eventmachine (1.2.7) - faker (2.23.0) + faker (3.0.0) i18n (>= 1.8.11, < 2) faraday (2.6.0) faraday-net_http (>= 2.0, < 3.1) @@ -237,7 +237,7 @@ GEM activesupport (~> 6.0) railties (~> 6.0) metasploit-payloads (2.0.97) - metasploit_data_models (5.0.5) + metasploit_data_models (5.0.6) activerecord (~> 6.0) activesupport (~> 6.0) arel-helpers @@ -245,7 +245,7 @@ GEM metasploit-model (>= 3.1) pg railties (~> 6.0) - recog (~> 2.0) + recog webrick metasploit_payloads-mettle (1.0.20) method_source (1.0.0) @@ -260,7 +260,7 @@ GEM net-ldap (0.17.1) net-protocol (0.1.3) timeout - net-smtp (0.3.2) + net-smtp (0.3.3) net-protocol net-ssh (7.0.1) network_interface (0.0.2) @@ -309,7 +309,7 @@ GEM thor (~> 1.0) rake (13.0.6) rb-readline (0.5.5) - recog (2.3.23) + recog (3.0.3) nokogiri redcarpet (3.5.1) reline (0.3.1) @@ -359,7 +359,7 @@ GEM rex-socket rex-text rex-struct2 (0.1.3) - rex-text (0.2.45) + rex-text (0.2.46) rex-zip (0.1.4) rex-text rexml (3.2.5) @@ -399,7 +399,7 @@ GEM ttfunk (1.7.0) tzinfo (2.0.5) concurrent-ruby (~> 1.0) - tzinfo-data (1.2022.5) + tzinfo-data (1.2022.6) tzinfo (>= 1.0.0) unf (0.1.4) unf_ext @@ -427,7 +427,7 @@ GEM activesupport (>= 4.2, < 8.0) xmlrpc (0.3.2) webrick - zeitwerk (2.6.1) + zeitwerk (2.6.5) PLATFORMS ruby @@ -436,4 +436,4 @@ DEPENDENCIES metasploit-framework! BUNDLED WITH - 2.3.23 + 2.3.24 diff --git a/pkgs/tools/security/metasploit/default.nix b/pkgs/tools/security/metasploit/default.nix index 2ff0eb70831d..6b3578105cf7 100644 --- a/pkgs/tools/security/metasploit/default.nix +++ b/pkgs/tools/security/metasploit/default.nix @@ -15,13 +15,13 @@ let }; in stdenv.mkDerivation rec { pname = "metasploit-framework"; - version = "6.2.24"; + version = "6.2.25"; src = fetchFromGitHub { owner = "rapid7"; repo = "metasploit-framework"; rev = version; - sha256 = "sha256-BU6R4/wCgXjxLcWrIGo5MSRD71SV3kEHWil8HIeHK0k="; + sha256 = "sha256-lrooEMmSu7pgG3Nm35G385ipdc4WdlM696Dd5KdwVJ0="; }; nativeBuildInputs = [ makeWrapper ]; diff --git a/pkgs/tools/security/metasploit/gemset.nix b/pkgs/tools/security/metasploit/gemset.nix index 78630b3a15b3..0e3186c100be 100644 --- a/pkgs/tools/security/metasploit/gemset.nix +++ b/pkgs/tools/security/metasploit/gemset.nix @@ -104,10 +104,10 @@ platforms = []; source = { remotes = ["https://rubygems.org"]; - sha256 = "0jxv2az9l3q1nk4bif07yr7kc0wi9znihgdph6cf8z74lbbpl7kv"; + sha256 = "1l4n8wrjhm4n9hn8c1dm92vwqlcf5wryw4dqmmp5whm6k2k9slkh"; type = "gem"; }; - version = "1.652.0"; + version = "1.656.0"; }; aws-sdk-core = { groups = ["default"]; @@ -124,10 +124,10 @@ platforms = []; source = { remotes = ["https://rubygems.org"]; - sha256 = "0crzfd4g0ym8gnn989cbv6xdwzkkp8fdqn4y7aqahyh4vixq0zki"; + sha256 = "1lqx1iadp1vdm3rgb79a219a7xkss409fadqnd5k7vl0cncxkg2s"; type = "gem"; }; - version = "1.343.0"; + version = "1.345.0"; }; aws-sdk-iam = { groups = ["default"]; @@ -194,10 +194,10 @@ platforms = []; source = { remotes = ["https://rubygems.org"]; - sha256 = "0gbwv05hlpqrz483zd8kbsgf4i62n1gzh7rnk6nl4ik4swkdmxwa"; + sha256 = "0mz9hz5clknznw8i5f3l2zb9103mlgh96djdhlvlfpf2chkr0s1z"; type = "gem"; }; - version = "2.4.13"; + version = "2.4.14"; }; bson = { groups = ["default"]; @@ -334,10 +334,10 @@ platforms = []; source = { remotes = ["https://rubygems.org"]; - sha256 = "1wslw5gh335zcahxmdd497xaa7h0d8l60c0jfv942mn47fxy8m47"; + sha256 = "0fcrgzjvqc9fxhnn7mzvzxd41m63cil7n19mjxnisx836p0k93hl"; type = "gem"; }; - version = "2.23.0"; + version = "3.0.0"; }; faraday = { groups = ["default"]; @@ -604,12 +604,12 @@ platforms = []; source = { fetchSubmodules = false; - rev = "1c805324f10bafa3a99fcd0315cc99ef83430b23"; - sha256 = "0j9bhy3iqz19b83l3plmakpl691i75m21ay55pqpi082zkir2kh5"; + rev = "2ab12336a4a6197c88ca4777c016311fa4fb7a3d"; + sha256 = "17alf2ky9pd0ywx56xhnrrssk67kny8xyrkk3dhbmfwjr482ifln"; type = "git"; url = "https://github.com/rapid7/metasploit-framework"; }; - version = "6.2.24"; + version = "6.2.25"; }; metasploit-model = { groups = ["default"]; @@ -636,10 +636,10 @@ platforms = []; source = { remotes = ["https://rubygems.org"]; - sha256 = "1h7w6kavbylbs55rkv12hg28wcchwqvzmagw9yrkqmncwdavl0dl"; + sha256 = "1dli79r6rh77mwh6xqjzvz5kld70j93myg0gd5q0jxjhimwcrgya"; type = "gem"; }; - version = "5.0.5"; + version = "5.0.6"; }; metasploit_payloads-mettle = { groups = ["default"]; @@ -756,10 +756,10 @@ platforms = []; source = { remotes = ["https://rubygems.org"]; - sha256 = "0d1y3nkgwypfsivip8vzphs3a01a40ds4ng8i314fpr9fdk48dad"; + sha256 = "1c6md06hm5bf6rv53sk54dl2vg038pg8kglwv3rayx0vk2mdql9x"; type = "gem"; }; - version = "0.3.2"; + version = "0.3.3"; }; net-ssh = { groups = ["default"]; @@ -1027,10 +1027,10 @@ platforms = []; source = { remotes = ["https://rubygems.org"]; - sha256 = "0axq8hw515b8hbv1jm4lbrqnjm5bvjjnj7xbx9pvp17zlklvsfzb"; + sha256 = "1apkzqm07bccnfqf0fgpkcyshkqxb43fj7mkd78za4niimm3lk6w"; type = "gem"; }; - version = "2.3.23"; + version = "3.0.3"; }; redcarpet = { groups = ["default"]; @@ -1217,10 +1217,10 @@ platforms = []; source = { remotes = ["https://rubygems.org"]; - sha256 = "0x7ppwzvwz8fag1n2j231wxvb0vl4qbbsqw7v8y0hx8vrfs3k5km"; + sha256 = "0arm3yakxs541qbm52rxjjd9b3p70sqim7syd83m3vqh366gr67d"; type = "gem"; }; - version = "0.2.45"; + version = "0.2.46"; }; rex-zip = { groups = ["default"]; @@ -1438,10 +1438,10 @@ platforms = []; source = { remotes = ["https://rubygems.org"]; - sha256 = "1w2qlazh0r23bz9qf2d4smvlv4a1yin8kprkqqxwkiwfs5v1n55s"; + sha256 = "0dpwi70x9jrpvc7p103ci0kppam79wqqrskq9n39r3jrp4b4j27w"; type = "gem"; }; - version = "1.2022.5"; + version = "1.2022.6"; }; unf = { groups = ["default"]; @@ -1568,9 +1568,9 @@ platforms = []; source = { remotes = ["https://rubygems.org"]; - sha256 = "18hihq3hxs2ywxh3ixm366cawwy4k733mh680ldaa1vxjiraxj58"; + sha256 = "10ipi1b3rh2vgwskfzcrgagc6hw5ppsz7jamsimglvww8bvya3zy"; type = "gem"; }; - version = "2.6.1"; + version = "2.6.5"; }; } From 370c1a9ad0388df4c3677fa82899353ae19dee40 Mon Sep 17 00:00:00 2001 From: Weijia Wang <9713184+wegank@users.noreply.github.com> Date: Mon, 7 Nov 2022 13:23:19 +0000 Subject: [PATCH 33/44] python3Packages.sh: disable flaky tests --- .../development/python-modules/sh/default.nix | 24 +++++++--- .../sh/disable-broken-tests-darwin.patch | 48 ------------------- 2 files changed, 17 insertions(+), 55 deletions(-) delete mode 100644 pkgs/development/python-modules/sh/disable-broken-tests-darwin.patch diff --git a/pkgs/development/python-modules/sh/default.nix b/pkgs/development/python-modules/sh/default.nix index d6334251bff4..17dcc5acbee0 100644 --- a/pkgs/development/python-modules/sh/default.nix +++ b/pkgs/development/python-modules/sh/default.nix @@ -1,4 +1,4 @@ -{ lib, buildPythonPackage, fetchPypi, python, coverage, lsof, glibcLocales, coreutils }: +{ lib, stdenv, buildPythonPackage, fetchPypi, python, coverage, lsof, glibcLocales, coreutils, pytestCheckHook }: buildPythonPackage rec { pname = "sh"; @@ -9,17 +9,12 @@ buildPythonPackage rec { sha256 = "sha256-5ARbbHMtnOddVxx59awiNO3Zrk9fqdWbCXBQgr3KGMc="; }; - patches = [ - # Disable tests that fail on Darwin sandbox - ./disable-broken-tests-darwin.patch - ]; - postPatch = '' sed -i 's#/usr/bin/env python#${python.interpreter}#' test.py sed -i 's#/bin/sleep#${coreutils.outPath}/bin/sleep#' test.py ''; - checkInputs = [ coverage lsof glibcLocales ]; + checkInputs = [ coverage lsof glibcLocales pytestCheckHook ]; # A test needs the HOME directory to be different from $TMPDIR. preCheck = '' @@ -27,6 +22,21 @@ buildPythonPackage rec { HOME=$(mktemp -d) ''; + pytestFlagsArray = [ "test.py" ]; + + disabledTests = [ + # Disable tests that fail on Hydra + "test_no_fd_leak" + "test_piped_exception1" + "test_piped_exception2" + "test_unicode_path" + ] ++ lib.optionals stdenv.isDarwin [ + # Disable tests that fail on Darwin sandbox + "test_background_exception" + "test_cwd" + "test_ok_code" + ]; + meta = with lib; { description = "Python subprocess interface"; homepage = "https://pypi.python.org/pypi/sh/"; diff --git a/pkgs/development/python-modules/sh/disable-broken-tests-darwin.patch b/pkgs/development/python-modules/sh/disable-broken-tests-darwin.patch deleted file mode 100644 index dfeb50db8d0e..000000000000 --- a/pkgs/development/python-modules/sh/disable-broken-tests-darwin.patch +++ /dev/null @@ -1,48 +0,0 @@ -From c596ad546fe7460b57a62799837757eb641309c1 Mon Sep 17 00:00:00 2001 -From: Sirio Balmelli -Date: Mon, 20 Jul 2020 19:51:20 +0200 -Subject: [PATCH] Disable tests that fail on Darwin (macOS) or with sandboxing - -Signed-off-by: Sirio Balmelli ---- a/test.py -+++ b/test.py -@@ -377,6 +377,7 @@ exit(3) - self.assertEqual(sed(_in="one test three", e="s/test/two/").strip(), - "one two three") - -+ @not_macos - def test_ok_code(self): - from sh import ls, ErrorReturnCode_1, ErrorReturnCode_2 - -@@ -982,6 +983,7 @@ print(sys.argv[1]) - now = time.time() - self.assertGreater(now - start, sleep_time) - -+ @not_macos - def test_background_exception(self): - from sh import ls, ErrorReturnCode_1, ErrorReturnCode_2 - p = ls("/ofawjeofj", _bg=True, _bg_exc=False) # should not raise -@@ -1779,6 +1781,7 @@ exit(49) - p = python(py.name, _ok_code=49, _bg=True) - self.assertEqual(49, p.exit_code) - -+ @not_macos - def test_cwd(self): - from sh import pwd - from os.path import realpath -@@ -2777,6 +2780,7 @@ print("cool") - # on osx. so skip it for now if osx - @not_macos - @requires_progs("lsof") -+ @skipUnless(False, "Flaky on Hydra") - def test_no_fd_leak(self): - import sh - import os -@@ -2879,6 +2883,7 @@ print("hi") - python(py.name, _in=stdin) - - @requires_utf8 -+ @skipUnless(False, "Does not work in sandbox") - def test_unicode_path(self): - from sh import Command - From 32b67fe06229fb39023fd8ca4b6d8ed3342e2df4 Mon Sep 17 00:00:00 2001 From: colin Date: Tue, 1 Nov 2022 05:31:48 -0700 Subject: [PATCH 34/44] lightdm-mobile-greeter: init at 2022-10-30 this is a greeter designed for mobile hardware. although most mobile DEs are capable of running without an external greeter by using their own lock screens, those tend to have different limitations. for example, the lock screen in Phosh doesn't do PAM session management -- but by using this lightdm-mobile-greeter which integrates with PAM, one can do things like decrypt a home directory or unlock keys on login. the upstream project lacks many images/videos, so here's what the software looks like: --- .../lightdm-mobile-greeter/default.nix | 53 +++++++++++++++++++ pkgs/top-level/all-packages.nix | 2 + 2 files changed, 55 insertions(+) create mode 100644 pkgs/applications/display-managers/lightdm-mobile-greeter/default.nix diff --git a/pkgs/applications/display-managers/lightdm-mobile-greeter/default.nix b/pkgs/applications/display-managers/lightdm-mobile-greeter/default.nix new file mode 100644 index 000000000000..a4ea16aa4a78 --- /dev/null +++ b/pkgs/applications/display-managers/lightdm-mobile-greeter/default.nix @@ -0,0 +1,53 @@ +{ lib +, fetchFromGitea +, gtk3 +, libhandy_0 +, lightdm +, lightdm-mobile-greeter +, linkFarm +, pkg-config +, rustPlatform +}: + +rustPlatform.buildRustPackage rec { + pname = "lightdm-mobile-greeter"; + version = "2022-10-30"; + + src = fetchFromGitea { + domain = "git.raatty.club"; + owner = "raatty"; + repo = "lightdm-mobile-greeter"; + rev = "8c8d6dfce62799307320c8c5a1f0dd5c8c18e4d3"; + hash = "sha256-SrAR2+An3BN/doFl/s8PcYZMUHLfVPXKZOo6ndO60nY="; + }; + cargoHash = "sha256-NZ0jOkEBNa5oOydfyKm0XQB/vkAvBv9wHBbnM9egQFQ="; + + buildInputs = [ + gtk3 + libhandy_0 + lightdm + ]; + nativeBuildInputs = [ + pkg-config + ]; + + postInstall = '' + mkdir -p $out/share/xgreeters + substitute lightdm-mobile-greeter.desktop \ + $out/share/xgreeters/lightdm-mobile-greeter.desktop \ + --replace lightdm-mobile-greeter $out/bin/lightdm-mobile-greeter + ''; + + passthru.xgreeters = linkFarm "lightdm-mobile-greeter-xgreeters" [{ + path = "${lightdm-mobile-greeter}/share/xgreeters/lightdm-mobile-greeter.desktop"; + name = "lightdm-mobile-greeter.desktop"; + }]; + + meta = with lib; { + description = "A simple log in screen for use on touch screens"; + homepage = "https://git.raatty.club/raatty/lightdm-mobile-greeter"; + maintainers = with maintainers; [ colinsane ]; + platforms = platforms.linux; + license = licenses.mit; + }; +} diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index 1965a7216afa..cd838fe4f843 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -31888,6 +31888,8 @@ with pkgs; lightdm-mini-greeter = callPackage ../applications/display-managers/lightdm-mini-greeter { }; + lightdm-mobile-greeter = callPackage ../applications/display-managers/lightdm-mobile-greeter { }; + lightdm-tiny-greeter = callPackage ../applications/display-managers/lightdm-tiny-greeter { conf = config.lightdm-tiny-greeter.conf or ""; }; From ed9998cf2a5ebb181ee604d2f0a2b0c64718c082 Mon Sep 17 00:00:00 2001 From: colin Date: Wed, 2 Nov 2022 03:31:52 -0700 Subject: [PATCH 35/44] nixos/lightdm: add `greeters.mobile` config option i based this on the neighboring lightdm-greeters/mini.nix module. lightdm-mobile-greeter doesn't have a lot of configuration options. it grabs the default user to login as from lightdm, along with which DE it should launch. so no further configuration should be needed aside from enabling `services.xserver.displayManager.lightdm.enable` and either setting `services.xserver.displayManager.defaultSession` to the appropriate session or explicitly defining a seat like: ```nix services.xserver.displayManager.lightdm.extraSeatDefaults = '' user-session = phosh ''; ``` --- .../lightdm-greeters/mobile.nix | 26 +++++++++++++++++++ .../services/x11/display-managers/lightdm.nix | 1 + 2 files changed, 27 insertions(+) create mode 100644 nixos/modules/services/x11/display-managers/lightdm-greeters/mobile.nix diff --git a/nixos/modules/services/x11/display-managers/lightdm-greeters/mobile.nix b/nixos/modules/services/x11/display-managers/lightdm-greeters/mobile.nix new file mode 100644 index 000000000000..31cc9b3deaa1 --- /dev/null +++ b/nixos/modules/services/x11/display-managers/lightdm-greeters/mobile.nix @@ -0,0 +1,26 @@ +{ config, lib, pkgs, ... }: + +with lib; +let + dmcfg = config.services.xserver.displayManager; + ldmcfg = dmcfg.lightdm; + cfg = ldmcfg.greeters.mobile; +in +{ + options = { + services.xserver.displayManager.lightdm.greeters.mobile = { + enable = mkEnableOption (lib.mdDoc + "lightdm-mobile-greeter as the lightdm greeter" + ); + }; + }; + + config = mkIf (ldmcfg.enable && cfg.enable) { + services.xserver.displayManager.lightdm.greeters.gtk.enable = false; + + services.xserver.displayManager.lightdm.greeter = mkDefault { + package = pkgs.lightdm-mobile-greeter.xgreeters; + name = "lightdm-mobile-greeter"; + }; + }; +} diff --git a/nixos/modules/services/x11/display-managers/lightdm.nix b/nixos/modules/services/x11/display-managers/lightdm.nix index b0508c3b4f79..f74e8efb8f64 100644 --- a/nixos/modules/services/x11/display-managers/lightdm.nix +++ b/nixos/modules/services/x11/display-managers/lightdm.nix @@ -83,6 +83,7 @@ in ./lightdm-greeters/pantheon.nix ./lightdm-greeters/tiny.nix ./lightdm-greeters/slick.nix + ./lightdm-greeters/mobile.nix (mkRenamedOptionModule [ "services" "xserver" "displayManager" "lightdm" "autoLogin" "enable" ] [ "services" "xserver" From 2d1dc67fe1d2abbd86051c59eaa597ef85c09129 Mon Sep 17 00:00:00 2001 From: Weijia Wang <9713184+wegank@users.noreply.github.com> Date: Fri, 4 Nov 2022 01:11:32 +0100 Subject: [PATCH 36/44] aspellDicts.is, aspellDicts.nb: fix build on darwin --- .../libraries/aspell/dictionaries.nix | 20 +++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/pkgs/development/libraries/aspell/dictionaries.nix b/pkgs/development/libraries/aspell/dictionaries.nix index c0d9d87aa422..74caec57c2d8 100644 --- a/pkgs/development/libraries/aspell/dictionaries.nix +++ b/pkgs/development/libraries/aspell/dictionaries.nix @@ -105,6 +105,26 @@ let homepage = "http://ftp.gnu.org/gnu/aspell/dict/0index.html"; } // (args.meta or {}); + } // lib.optionalAttrs (stdenv.isDarwin && elem language [ "is" "nb" ]) { + # tar: Cannot open: Illegal byte sequence + unpackPhase = '' + runHook preUnpack + + tar -xf $src --strip-components=1 || true + + runHook postUnpack + ''; + + postPatch = getAttr language { + is = '' + cp icelandic.alias íslenska.alias + sed -i 's/ .slenska\.alias/ íslenska.alias/g' Makefile.pre + ''; + nb = '' + cp bokmal.alias bokmål.alias + sed -i 's/ bokm.l\.alias/ bokmål.alias/g' Makefile.pre + ''; + }; } // removeAttrs args [ "language" "filename" "sha256" "meta" ]; in buildDict buildArgs; From 1ef74a785480396ba179200196cac8256a67cfce Mon Sep 17 00:00:00 2001 From: happysalada Date: Mon, 7 Nov 2022 09:01:51 -0500 Subject: [PATCH 37/44] lighthouse: module add defaults --- nixos/modules/services/blockchain/ethereum/lighthouse.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/nixos/modules/services/blockchain/ethereum/lighthouse.nix b/nixos/modules/services/blockchain/ethereum/lighthouse.nix index 57e32132f1d1..6002b16785a7 100644 --- a/nixos/modules/services/blockchain/ethereum/lighthouse.nix +++ b/nixos/modules/services/blockchain/ethereum/lighthouse.nix @@ -10,6 +10,7 @@ in { services.lighthouse = { beacon = mkOption { description = lib.mdDoc "Beacon node"; + default = {}; type = types.submodule { options = { enable = lib.mkEnableOption (lib.mdDoc "Lightouse Beacon node"); @@ -143,6 +144,7 @@ in { validator = mkOption { description = lib.mdDoc "Validator node"; + default = {}; type = types.submodule { options = { enable = mkOption { From 89c92a92062746bc12cb066614ca4c59f13ea3bc Mon Sep 17 00:00:00 2001 From: Jan Solanti Date: Thu, 20 Oct 2022 04:39:10 +0300 Subject: [PATCH 38/44] SDL2: 2.24.0 -> 2.24.1 --- pkgs/development/libraries/SDL2/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/libraries/SDL2/default.nix b/pkgs/development/libraries/SDL2/default.nix index 9900d8874b25..97899f316d76 100644 --- a/pkgs/development/libraries/SDL2/default.nix +++ b/pkgs/development/libraries/SDL2/default.nix @@ -59,11 +59,11 @@ with lib; stdenv.mkDerivation rec { pname = "SDL2"; - version = "2.24.0"; + version = "2.24.1"; src = fetchurl { url = "https://www.libsdl.org/release/${pname}-${version}.tar.gz"; - sha256 = "sha256-keTDSxdo+S05mweOFxRIxq8Yyv2nQ5h+0gZKKJVNbZc="; + sha256 = "sha256-vBIViLEQUGVZjOOAeAJqQUwo6pXmbtKtq0xE2Aswnhs="; }; dontDisableStatic = if withStatic then 1 else 0; outputs = [ "out" "dev" ]; From 6d7127b1765578183ad428b5d99e4d113f13fe4c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Stanis=C5=82aw=20Pitucha?= Date: Mon, 7 Nov 2022 11:54:52 +1100 Subject: [PATCH 39/44] lzlib: fix darwin build --- pkgs/development/libraries/lzlib/default.nix | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/pkgs/development/libraries/lzlib/default.nix b/pkgs/development/libraries/lzlib/default.nix index 7ddf4fa5f178..4e28fc3a5b0d 100644 --- a/pkgs/development/libraries/lzlib/default.nix +++ b/pkgs/development/libraries/lzlib/default.nix @@ -12,6 +12,10 @@ stdenv.mkDerivation rec { sha256 = "sha256-3ea9WzJTXxeyjJrCS2ZgfgJQUGrBQypBEso8c/XWYsM="; }; + postPatch = lib.optionalString stdenv.isDarwin '' + substituteInPlace Makefile.in --replace '-Wl,--soname=' '-Wl,-install_name,$(out)/lib/' + ''; + makeFlags = [ "CC:=$(CC)" ]; doCheck = true; From 4db7dc72d27f94483d759beeb7d4c1914b4da1e2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= Date: Mon, 7 Nov 2022 15:55:47 +0100 Subject: [PATCH 40/44] SDL2: 2.24.1 -> 2.24.2 --- pkgs/development/libraries/SDL2/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/libraries/SDL2/default.nix b/pkgs/development/libraries/SDL2/default.nix index 97899f316d76..a38761ed7c50 100644 --- a/pkgs/development/libraries/SDL2/default.nix +++ b/pkgs/development/libraries/SDL2/default.nix @@ -59,11 +59,11 @@ with lib; stdenv.mkDerivation rec { pname = "SDL2"; - version = "2.24.1"; + version = "2.24.2"; src = fetchurl { url = "https://www.libsdl.org/release/${pname}-${version}.tar.gz"; - sha256 = "sha256-vBIViLEQUGVZjOOAeAJqQUwo6pXmbtKtq0xE2Aswnhs="; + sha256 = "sha256-s17wqAKwnZDtOt0NysDpWCCAQgKRT1u3sP63EPGhMp8="; }; dontDisableStatic = if withStatic then 1 else 0; outputs = [ "out" "dev" ]; From 37171a5d906a609ca593b3a47965b4cae941e3c4 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Sun, 6 Nov 2022 15:40:25 +0000 Subject: [PATCH 41/44] yamlpath: 3.6.8 -> 3.6.9 --- pkgs/development/tools/yamlpath/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/tools/yamlpath/default.nix b/pkgs/development/tools/yamlpath/default.nix index 60cb97511bbf..55e86e42da4a 100644 --- a/pkgs/development/tools/yamlpath/default.nix +++ b/pkgs/development/tools/yamlpath/default.nix @@ -6,14 +6,14 @@ python3.pkgs.buildPythonApplication rec { pname = "yamlpath"; - version = "3.6.8"; + version = "3.6.9"; format = "setuptools"; src = fetchFromGitHub { owner = "wwkimball"; repo = pname; rev = "refs/tags/v${version}"; - sha256 = "sha256-g4Pw0IWLY/9nG2eqbiknWCZjJNGbmV42KEviIENXYYA="; + sha256 = "sha256-0r1jlDWlYPIjUEudHbwt324rt0H8K3PUb7RILoxNNnw="; }; propagatedBuildInputs = with python3.pkgs; [ From 427e49595b477a911b97253e6c17be70070a77f9 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Sun, 6 Nov 2022 02:12:19 +0000 Subject: [PATCH 42/44] mangal: 4.0.1 -> 4.0.2 --- pkgs/applications/misc/mangal/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/applications/misc/mangal/default.nix b/pkgs/applications/misc/mangal/default.nix index f4c7869f152c..1c7840be855a 100644 --- a/pkgs/applications/misc/mangal/default.nix +++ b/pkgs/applications/misc/mangal/default.nix @@ -2,13 +2,13 @@ buildGoModule rec { pname = "mangal"; - version = "4.0.1"; + version = "4.0.2"; src = fetchFromGitHub { owner = "metafates"; repo = pname; rev = "v${version}"; - hash = "sha256-pMiZgO/+koyIDm7ONZn0qEq+d6HeFfQFaU1Qjovqmc4="; + hash = "sha256-ssvd8gdF5h6EKLY/W+1zbZWcVQqy+UirIS0p0DBQj0E="; }; proxyVendor = true; From caed6c004d52649e5c4a80d247c62289b67e0d6a Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Mon, 7 Nov 2022 16:13:40 +0000 Subject: [PATCH 43/44] oh-my-zsh: 2022-11-06 -> 2022-11-07 --- pkgs/shells/zsh/oh-my-zsh/default.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/shells/zsh/oh-my-zsh/default.nix b/pkgs/shells/zsh/oh-my-zsh/default.nix index cd9054208a6c..d8e01c339ce7 100644 --- a/pkgs/shells/zsh/oh-my-zsh/default.nix +++ b/pkgs/shells/zsh/oh-my-zsh/default.nix @@ -5,15 +5,15 @@ , git, nix, nixfmt, jq, coreutils, gnused, curl, cacert, bash }: stdenv.mkDerivation rec { - version = "2022-11-06"; + version = "2022-11-07"; pname = "oh-my-zsh"; - rev = "4806f755694d160f20e3fb8ae0a1d009d56d966b"; + rev = "0145d744a9c4c11f00992f7f3ad9555bc8ac6177"; src = fetchFromGitHub { inherit rev; owner = "ohmyzsh"; repo = "ohmyzsh"; - sha256 = "zaaTcTka4L3Ec2bWgT0Yd8vSVG/n21G0PC/VxK2DfT8="; + sha256 = "F1h+yTYCVS3rz/ADahOQWyee3TKjkNfUc8O7Ug+2z48="; }; strictDeps = true; From 891dfb1b636737be2f4d8d235233b08e4d2ffb67 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Manuel=20B=C3=A4renz?= Date: Tue, 1 Nov 2022 21:30:20 +0100 Subject: [PATCH 44/44] nixos/mastodon: add option mediaAutoRemove --- .../from_md/release-notes/rl-2211.section.xml | 7 +++ .../manual/release-notes/rl-2211.section.md | 4 +- nixos/modules/services/web-apps/mastodon.nix | 49 +++++++++++++++++++ 3 files changed, 59 insertions(+), 1 deletion(-) diff --git a/nixos/doc/manual/from_md/release-notes/rl-2211.section.xml b/nixos/doc/manual/from_md/release-notes/rl-2211.section.xml index 02cb2dd9ccd1..a2f67d2707ee 100644 --- a/nixos/doc/manual/from_md/release-notes/rl-2211.section.xml +++ b/nixos/doc/manual/from_md/release-notes/rl-2211.section.xml @@ -961,6 +961,13 @@ configure this behaviour. + + + mastodon now automatically removes remote + media attachments older than 30 days. This is configurable + through services.mastodon.mediaAutoRemove. + + The Redis module now disables RDB persistence when diff --git a/nixos/doc/manual/release-notes/rl-2211.section.md b/nixos/doc/manual/release-notes/rl-2211.section.md index 43abb40b8a04..3540881c4622 100644 --- a/nixos/doc/manual/release-notes/rl-2211.section.md +++ b/nixos/doc/manual/release-notes/rl-2211.section.md @@ -296,6 +296,8 @@ Available as [services.patroni](options.html#opt-services.patroni.enable). - ZFS module will not allow hibernation by default, this is a safety measure to prevent data loss cases like the ones described at [OpenZFS/260](https://github.com/openzfs/zfs/issues/260) and [OpenZFS/12842](https://github.com/openzfs/zfs/issues/12842). Use the `boot.zfs.allowHibernation` option to configure this behaviour. +- `mastodon` now automatically removes remote media attachments older than 30 days. This is configurable through `services.mastodon.mediaAutoRemove`. + - The Redis module now disables RDB persistence when `services.redis.servers..save = []` instead of using the Redis default. - Neo4j was updated from version 3 to version 4. See this [migration guide](https://neo4j.com/docs/upgrade-migration-guide/current/) on how to migrate your Neo4j instance. @@ -364,7 +366,7 @@ Available as [services.patroni](options.html#opt-services.patroni.enable). [systemd.oomd.enableRootSlice](options.html#opt-systemd.oomd.enableRootSlice), [systemd.oomd.enableSystemSlice](options.html#opt-systemd.oomd.enableSystemSlice), and [systemd.oomd.enableUserServices](options.html#opt-systemd.oomd.enableUserServices). - + - The `tt-rss` service performs two database migrations when you first use its web UI after upgrade. Consider backing up its database before updating. - The `pass-secret-service` package now includes systemd units from upstream, so adding it to the NixOS `services.dbus.packages` option will make it start automatically as a systemd user service when an application tries to talk to the libsecret D-Bus API. diff --git a/nixos/modules/services/web-apps/mastodon.nix b/nixos/modules/services/web-apps/mastodon.nix index dad8c3d3e38b..83890e969909 100644 --- a/nixos/modules/services/web-apps/mastodon.nix +++ b/nixos/modules/services/web-apps/mastodon.nix @@ -425,6 +425,39 @@ in { Do automatic database migrations. ''; }; + + mediaAutoRemove = { + enable = lib.mkOption { + type = lib.types.bool; + default = true; + example = false; + description = lib.mdDoc '' + Automatically remove remote media attachments and preview cards older than the configured amount of days. + + Recommended in https://docs.joinmastodon.org/admin/setup/. + ''; + }; + + startAt = lib.mkOption { + type = lib.types.str; + default = "daily"; + example = "hourly"; + description = lib.mdDoc '' + How often to remove remote media. + + The format is described in {manpage}`systemd.time(7)`. + ''; + }; + + olderThanDays = lib.mkOption { + type = lib.types.int; + default = 30; + example = 14; + description = lib.mdDoc '' + How old remote media needs to be in order to be removed. + ''; + }; + }; }; }; @@ -585,6 +618,22 @@ in { path = with pkgs; [ file imagemagick ffmpeg ]; }; + systemd.services.mastodon-media-auto-remove = lib.mkIf cfg.mediaAutoRemove.enable { + description = "Mastodon media auto remove"; + environment = env; + serviceConfig = { + Type = "oneshot"; + script = let + olderThanDays = toString cfg.mediaAutoRemove.olderThanDays; + in '' + ${cfg.package}/bin/tootctl media remove --days=${olderThanDays} + ${cfg.package}/bin/tootctl preview_cards remove --days=${olderThanDays} + ''; + EnvironmentFile = "/var/lib/mastodon/.secrets_env"; + startAt = cfg.mediaAutoRemove.startAt; + } // cfgService; + }; + services.nginx = lib.mkIf cfg.configureNginx { enable = true; recommendedProxySettings = true; # required for redirections to work