From 4d7f8b50d240ef85b93a64744c21f56ab3c965d7 Mon Sep 17 00:00:00 2001 From: Morgan Helton Date: Tue, 23 Aug 2022 19:47:27 -0500 Subject: [PATCH 1/8] envoy: 1.21.4 -> 1.21.5 --- pkgs/servers/http/envoy/default.nix | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/pkgs/servers/http/envoy/default.nix b/pkgs/servers/http/envoy/default.nix index 1cd6e0c785ef..9bcf573d06c4 100644 --- a/pkgs/servers/http/envoy/default.nix +++ b/pkgs/servers/http/envoy/default.nix @@ -23,8 +23,8 @@ let # However, the version string is more useful for end-users. # These are contained in a attrset of their own to make it obvious that # people should update both. - version = "1.21.4"; - rev = "782ba5e5ab9476770378ec9f1901803e0d38ac41"; + version = "1.21.5"; + rev = "0512f18b764828497febd0f6dcecc1861003d614"; }; in buildBazelPackage rec { @@ -35,7 +35,7 @@ buildBazelPackage rec { owner = "envoyproxy"; repo = "envoy"; inherit (srcVer) rev; - hash = "sha256-SthKDMQs5yNU0iouAPVsDeCPKcsBXmO9ebDwu58UQRs="; + sha256 = "sha256-VWcfdoZ1wGkxaf0PZwfiSFg8D/QDIZs4u/iLUnsbjMo="; postFetch = '' chmod -R +w $out @@ -85,8 +85,8 @@ buildBazelPackage rec { fetchAttrs = { sha256 = { - x86_64-linux = "sha256-/SA+WFHcMjk6iLwuEmuBIzy3pMhw7TThIEx292dv6IE="; - aarch64-linux = "sha256-0XdeirdIP7+nKy8zZbr2uHN2RZ4ZFOJt9i/+Ow1s/W4="; + x86_64-linux = "sha256-bE28PBQjsOLkxjIoDk6HcELPP3XzvqKKVa7yUbXB1Qk="; + aarch64-linux = "sha256-Rf7kEBeH72vsvmzKy/7oKQf8cVNVzIcSuXMhrIhMFKM="; }.${stdenv.system} or (throw "unsupported system ${stdenv.system}"); dontUseCmakeConfigure = true; dontUseGnConfigure = true; From 9677d8a7a5330f10bea4bf5d7866d957adb374b3 Mon Sep 17 00:00:00 2001 From: Morgan Helton Date: Tue, 23 Aug 2022 20:03:27 -0500 Subject: [PATCH 2/8] pomerium: build and include ui --- pkgs/servers/http/pomerium/common.nix | 27 +++++++++ pkgs/servers/http/pomerium/default.nix | 24 +++----- .../http/pomerium/pomerium-ui-package.json | 60 +++++++++++++++++++ pkgs/servers/http/pomerium/ui.nix | 38 ++++++++++++ pkgs/top-level/all-packages.nix | 4 +- 5 files changed, 135 insertions(+), 18 deletions(-) create mode 100644 pkgs/servers/http/pomerium/common.nix create mode 100644 pkgs/servers/http/pomerium/pomerium-ui-package.json create mode 100644 pkgs/servers/http/pomerium/ui.nix diff --git a/pkgs/servers/http/pomerium/common.nix b/pkgs/servers/http/pomerium/common.nix new file mode 100644 index 000000000000..87b9b98a72e8 --- /dev/null +++ b/pkgs/servers/http/pomerium/common.nix @@ -0,0 +1,27 @@ +{ fetchFromGitHub +, lib +}: +let + version = "0.17.1"; + srcHash = "sha256:0b9mdzyfn7c6gwgslqk787yyrrcmdjf3282vx2zvhcr3psz0xqwx"; + vendorSha256 = "sha256:1cq4m5a7z64yg3v1c68d15ilw78il6p53vaqzxgn338zjggr3kig"; + yarnSha256 = "sha256-dLkn9xvQ3gixU63g1xvzbY+YI+9YnaGa3D0uGrrpGvI="; +in +{ + inherit version vendorSha256 yarnSha256; + + src = fetchFromGitHub { + owner = "pomerium"; + repo = "pomerium"; + rev = "v${version}"; + hash = srcHash; + }; + + meta = with lib; { + homepage = "https://pomerium.io"; + description = "Authenticating reverse proxy"; + license = licenses.asl20; + maintainers = with maintainers; [ lukegb ]; + platforms = [ "x86_64-linux" "aarch64-linux" ]; + }; +} diff --git a/pkgs/servers/http/pomerium/default.nix b/pkgs/servers/http/pomerium/default.nix index b6de805a619b..7b115d6d694a 100644 --- a/pkgs/servers/http/pomerium/default.nix +++ b/pkgs/servers/http/pomerium/default.nix @@ -1,26 +1,21 @@ { buildGoModule , fetchFromGitHub +, callPackage , lib , envoy -, zip , nixosTests +, pomerium-ui , pomerium-cli }: let inherit (lib) concatStringsSep concatMap id mapAttrsToList; + common = callPackage ./common.nix { }; in buildGoModule rec { + inherit (common) version src vendorSha256 meta; pname = "pomerium"; - version = "0.17.1"; - src = fetchFromGitHub { - owner = "pomerium"; - repo = "pomerium"; - rev = "v${version}"; - hash = "sha256:0b9mdzyfn7c6gwgslqk787yyrrcmdjf3282vx2zvhcr3psz0xqwx"; - }; - vendorSha256 = "sha256:1cq4m5a7z64yg3v1c68d15ilw78il6p53vaqzxgn338zjggr3kig"; subPackages = [ "cmd/pomerium" ]; @@ -70,6 +65,9 @@ buildGoModule rec { EOF sha256sum '${envoy}/bin/envoy' > internal/envoy/files/envoy.sha256 echo '${envoy.version}' > internal/envoy/files/envoy.version + + # put the built UI files where they will be picked up as part of binary build + cp -r ${pomerium-ui} ui ''; installPhase = '' @@ -80,12 +78,4 @@ buildGoModule rec { inherit (nixosTests) pomerium; inherit pomerium-cli; }; - - meta = with lib; { - homepage = "https://pomerium.io"; - description = "Authenticating reverse proxy"; - license = licenses.asl20; - maintainers = with maintainers; [ lukegb ]; - platforms = [ "x86_64-linux" "aarch64-linux" ]; - }; } diff --git a/pkgs/servers/http/pomerium/pomerium-ui-package.json b/pkgs/servers/http/pomerium/pomerium-ui-package.json new file mode 100644 index 000000000000..12f39ead62a9 --- /dev/null +++ b/pkgs/servers/http/pomerium/pomerium-ui-package.json @@ -0,0 +1,60 @@ +{ + "name": "pomerium", + "version": "1.0.0", + "main": "src/index.tsx", + "license": "Apache-2.0", + "scripts": { + "build": "ts-node ./scripts/esbuild.ts", + "format": "prettier --write .", + "lint": "eslint .", + "watch": "ts-node ./scripts/esbuild.ts --watch" + }, + "browserslist": { + "production": [ + ">0.2%", + "not dead", + "not op_mini all" + ], + "development": [ + "last 1 chrome version", + "last 1 firefox version", + "last 1 safari version" + ] + }, + "dependencies": { + "@babel/core": "^7.0.0", + "@emotion/react": "^11.7.1", + "@emotion/styled": "^11.6.0", + "@fontsource/dm-mono": "^4.5.2", + "@fontsource/dm-sans": "^4.5.1", + "@mui/icons-material": "^5.3.1", + "@mui/material": "^5.4.0", + "luxon": "^2.3.0", + "react": "^17.0.2", + "react-dom": "^17.0.2", + "react-feather": "^2.0.9" + }, + "devDependencies": { + "@trivago/prettier-plugin-sort-imports": "2.0.4", + "@types/luxon": "^2.0.9", + "@types/node": "^17.0.14", + "@types/react": "^17.0.34", + "@types/react-dom": "^17.0.11", + "@typescript-eslint/eslint-plugin": "^5.10.2", + "@typescript-eslint/parser": "^5.10.2", + "esbuild": "^0.13.12", + "eslint": "7.32.0", + "eslint-config-prettier": "^8.3.0", + "eslint-plugin-react": "^7.28.0", + "prettier": "^2.4.1", + "ts-node": "^10.4.0", + "typescript": "^4.4.4" + }, + "prettier": { + "importOrder": [ + "^[./]" + ], + "importOrderSeparation": true, + "importOrderSortSpecifiers": true + } +} diff --git a/pkgs/servers/http/pomerium/ui.nix b/pkgs/servers/http/pomerium/ui.nix new file mode 100644 index 000000000000..f2a94814ca21 --- /dev/null +++ b/pkgs/servers/http/pomerium/ui.nix @@ -0,0 +1,38 @@ +{ lib +, callPackage +, fetchFromGitHub +, fetchYarnDeps +, mkYarnPackage }: +let + common = callPackage ./common.nix { }; +in +mkYarnPackage { + inherit (common) version; + pname = "pomerium-ui"; + src = "${common.src}/ui"; + + # update pomerium-ui-package.json when updating package, sourced from ui/package.json + packageJSON = ./pomerium-ui-package.json; + offlineCache = fetchYarnDeps { + yarnLock = "${common.src}/ui/yarn.lock"; + sha256 = common.yarnSha256; + }; + + buildPhase = '' + runHook preBuild + yarn --offline build + runHook postbuild + ''; + + installPhase = '' + runHook preInstall + cp -R deps/pomerium/dist $out + runHook postInstall + ''; + + doDist = false; + + meta = common.meta // { + description = "Pomerium authenticating reverse proxy UI"; + }; +} diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index 6f8786a40cf4..e18c5dc1e98e 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -22892,7 +22892,9 @@ with pkgs; }; pflogsumm = callPackage ../servers/mail/postfix/pflogsumm.nix { }; - pomerium = callPackage ../servers/http/pomerium { }; + pomerium = callPackage ../servers/http/pomerium { + pomerium-ui = callPackage ../servers/http/pomerium/ui.nix { }; + }; pomerium-cli = callPackage ../tools/security/pomerium-cli { }; postgrey = callPackage ../servers/mail/postgrey { }; From 4dfa0d23241afc02fe30caef4d6bd26075b48c61 Mon Sep 17 00:00:00 2001 From: Morgan Helton Date: Tue, 23 Aug 2022 20:08:34 -0500 Subject: [PATCH 3/8] pomerium: 0.17.1 -> 0.18.0 --- pkgs/servers/http/pomerium/common.nix | 10 ++-- pkgs/servers/http/pomerium/default.nix | 13 +++-- .../servers/http/pomerium/external-envoy.diff | 48 +++++++++++++++++++ 3 files changed, 61 insertions(+), 10 deletions(-) create mode 100644 pkgs/servers/http/pomerium/external-envoy.diff diff --git a/pkgs/servers/http/pomerium/common.nix b/pkgs/servers/http/pomerium/common.nix index 87b9b98a72e8..d7a0814f1315 100644 --- a/pkgs/servers/http/pomerium/common.nix +++ b/pkgs/servers/http/pomerium/common.nix @@ -2,10 +2,10 @@ , lib }: let - version = "0.17.1"; - srcHash = "sha256:0b9mdzyfn7c6gwgslqk787yyrrcmdjf3282vx2zvhcr3psz0xqwx"; - vendorSha256 = "sha256:1cq4m5a7z64yg3v1c68d15ilw78il6p53vaqzxgn338zjggr3kig"; - yarnSha256 = "sha256-dLkn9xvQ3gixU63g1xvzbY+YI+9YnaGa3D0uGrrpGvI="; + version = "0.18.0"; + srcSha256 = "sha256-sM4kM8CqbZjl+RIsezWYVCmjoDKfGl+EQcdEaPKvVHs="; + vendorSha256 = "sha256-1EWcjfrO3FEypUUKwNwDisogERCuKOvtC7z0mC2JZn4="; + yarnSha256 = "sha256-Uh0y2Zmy6bSoyL5WMTce01hoH7EvSIniHyIBMxfMvhg="; in { inherit version vendorSha256 yarnSha256; @@ -14,7 +14,7 @@ in owner = "pomerium"; repo = "pomerium"; rev = "v${version}"; - hash = srcHash; + sha256 = srcSha256; }; meta = with lib; { diff --git a/pkgs/servers/http/pomerium/default.nix b/pkgs/servers/http/pomerium/default.nix index 7b115d6d694a..31f9a7e59e0c 100644 --- a/pkgs/servers/http/pomerium/default.nix +++ b/pkgs/servers/http/pomerium/default.nix @@ -20,6 +20,9 @@ buildGoModule rec { "cmd/pomerium" ]; + # patch pomerium to allow use of external envoy + patches = [ ./external-envoy.diff ]; + ldflags = let # Set a variety of useful meta variables for stamping the build with. setVars = { @@ -29,7 +32,7 @@ buildGoModule rec { ProjectName = "pomerium"; ProjectURL = "github.com/pomerium/pomerium"; }; - "github.com/pomerium/pomerium/internal/envoy" = { + "github.com/pomerium/pomerium/pkg/envoy" = { OverrideEnvoyPath = "${envoy}/bin/envoy"; }; }; @@ -49,8 +52,8 @@ buildGoModule rec { # Replace embedded envoy with nothing. # We set OverrideEnvoyPath above, so rawBinary should never get looked at # but we still need to set a checksum/version. - rm internal/envoy/files/files_{darwin,linux}*.go - cat <internal/envoy/files/files_generic.go + rm pkg/envoy/files/files_{darwin,linux}*.go + cat <pkg/envoy/files/files_external.go package files import _ "embed" // embed @@ -63,8 +66,8 @@ buildGoModule rec { //go:embed envoy.version var rawVersion string EOF - sha256sum '${envoy}/bin/envoy' > internal/envoy/files/envoy.sha256 - echo '${envoy.version}' > internal/envoy/files/envoy.version + sha256sum '${envoy}/bin/envoy' > pkg/envoy/files/envoy.sha256 + echo '${envoy.version}' > pkg/envoy/files/envoy.version # put the built UI files where they will be picked up as part of binary build cp -r ${pomerium-ui} ui diff --git a/pkgs/servers/http/pomerium/external-envoy.diff b/pkgs/servers/http/pomerium/external-envoy.diff new file mode 100644 index 000000000000..49f4985ad77c --- /dev/null +++ b/pkgs/servers/http/pomerium/external-envoy.diff @@ -0,0 +1,48 @@ +diff --git a/pkg/envoy/envoy.go b/pkg/envoy/envoy.go +index e32cfc29..9d32c057 100644 +--- a/pkg/envoy/envoy.go ++++ b/pkg/envoy/envoy.go +@@ -8,9 +8,9 @@ import ( + "errors" + "fmt" + "io" ++ "io/fs" + "os" + "os/exec" +- "path" + "path/filepath" + "regexp" + "strconv" +@@ -36,8 +36,12 @@ import ( + + const ( + configFileName = "envoy-config.yaml" ++ workingDirectoryName = ".pomerium-envoy" ++ embeddedEnvoyPermissions fs.FileMode = 0o700 + ) + ++var OverrideEnvoyPath = "" ++ + type serverOptions struct { + services string + logLevel string +@@ -60,13 +64,16 @@ type Server struct { + + // NewServer creates a new server with traffic routed by envoy. + func NewServer(ctx context.Context, src config.Source, builder *envoyconfig.Builder) (*Server, error) { +- envoyPath, err := Extract() ++ envoyPath := OverrideEnvoyPath ++ wd := filepath.Join(os.TempDir(), workingDirectoryName) ++ ++ err := os.MkdirAll(wd, embeddedEnvoyPermissions) + if err != nil { +- return nil, fmt.Errorf("extracting envoy: %w", err) ++ return nil, fmt.Errorf("error creating temporary working directory for envoy: %w", err) + } + + srv := &Server{ +- wd: path.Dir(envoyPath), ++ wd: wd, + builder: builder, + grpcPort: src.GetConfig().GRPCPort, + httpPort: src.GetConfig().HTTPPort, From b900ad154bed259755cfac10aa182937c12c6c2a Mon Sep 17 00:00:00 2001 From: Morgan Helton Date: Tue, 23 Aug 2022 20:08:41 -0500 Subject: [PATCH 4/8] pomerium-cli: 0.17.1 -> 0.18.0 --- pkgs/tools/security/pomerium-cli/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/tools/security/pomerium-cli/default.nix b/pkgs/tools/security/pomerium-cli/default.nix index 9463e0851898..3731aed4e663 100644 --- a/pkgs/tools/security/pomerium-cli/default.nix +++ b/pkgs/tools/security/pomerium-cli/default.nix @@ -15,10 +15,10 @@ buildGoModule rec { owner = "pomerium"; repo = "cli"; rev = "v${version}"; - hash = "sha256-AZeBtHy2MEPE8uZVJv4wLdOt6f9QNbaQnP5a2YVYYAg="; + sha256 = "sha256-P1aEAr+Q2wnKLq3JHQbss6SPdrYnzE8J2yp/Lu5Cg/0="; }; - vendorSha256 = "sha256-K0Vdsl6wD0eJeJRsUjiNPuGx1KPkZrlCCzdyAysVonc="; + vendorSha256 = "sha256-AAdhFpFCbUU3kjVQ84sYWYrGBWD5u6f219MvVS0j9Oo="; subPackages = [ "cmd/pomerium-cli" From 7f6ab2ddbc08de30f1e5a3b7644a5523daf51554 Mon Sep 17 00:00:00 2001 From: Luke Granger-Brown Date: Sun, 4 Sep 2022 22:10:23 +0100 Subject: [PATCH 5/8] pomerium-cli: detach from pomerium versioning --- pkgs/tools/security/pomerium-cli/default.nix | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/pkgs/tools/security/pomerium-cli/default.nix b/pkgs/tools/security/pomerium-cli/default.nix index 3731aed4e663..cded5b83643a 100644 --- a/pkgs/tools/security/pomerium-cli/default.nix +++ b/pkgs/tools/security/pomerium-cli/default.nix @@ -1,7 +1,6 @@ { buildGoModule , fetchFromGitHub , lib -, pomerium }: let @@ -9,7 +8,7 @@ let in buildGoModule rec { pname = "pomerium-cli"; - inherit (pomerium) version; + version = "0.18.0"; src = fetchFromGitHub { owner = "pomerium"; From 16215285cd14ee42f1764d93a22bde764b216e7d Mon Sep 17 00:00:00 2001 From: Luke Granger-Brown Date: Sun, 4 Sep 2022 22:20:47 +0100 Subject: [PATCH 6/8] envoy: 1.21.5 -> 1.23.1 --- pkgs/servers/http/envoy/default.nix | 46 +++++++++------ .../http/envoy/use-system-python.patch | 58 +++++++++++++++++++ 2 files changed, 85 insertions(+), 19 deletions(-) create mode 100644 pkgs/servers/http/envoy/use-system-python.patch diff --git a/pkgs/servers/http/envoy/default.nix b/pkgs/servers/http/envoy/default.nix index 9bcf573d06c4..b9342ccd4fac 100644 --- a/pkgs/servers/http/envoy/default.nix +++ b/pkgs/servers/http/envoy/default.nix @@ -1,14 +1,14 @@ { lib -, bazel_4 +, bazel_5 , buildBazelPackage , fetchFromGitHub -, fetchpatch , stdenv , cmake , gn , go , jdk , ninja +, patchelf , python3 , linuxHeaders , nixosTests @@ -23,19 +23,19 @@ let # However, the version string is more useful for end-users. # These are contained in a attrset of their own to make it obvious that # people should update both. - version = "1.21.5"; - rev = "0512f18b764828497febd0f6dcecc1861003d614"; + version = "1.23.1"; + rev = "edd69583372955fdfa0b8ca3820dd7312c094e46"; }; in buildBazelPackage rec { pname = "envoy"; inherit (srcVer) version; - bazel = bazel_4; + bazel = bazel_5; src = fetchFromGitHub { owner = "envoyproxy"; repo = "envoy"; inherit (srcVer) rev; - sha256 = "sha256-VWcfdoZ1wGkxaf0PZwfiSFg8D/QDIZs4u/iLUnsbjMo="; + sha256 = "sha256:157dbmp479xv5507n48yibvlgi2ac0l3sl9rzm28cm9lhzwva3k0"; postFetch = '' chmod -R +w $out @@ -48,26 +48,21 @@ buildBazelPackage rec { postPatch = '' sed -i 's,#!/usr/bin/env python3,#!${python3}/bin/python,' bazel/foreign_cc/luajit.patch sed -i '/javabase=/d' .bazelrc - # Patch paths to build tools, and disable gold because it just segfaults. - substituteInPlace bazel/external/wee8.genrule_cmd \ - --replace '"''$$gn"' '"''$$(command -v gn)"' \ - --replace '"''$$ninja"' '"''$$(command -v ninja)"' \ - --replace '"''$$WEE8_BUILD_ARGS"' '"''$$WEE8_BUILD_ARGS use_gold=false"' + + # Use system Python. + sed -i -e '/python_interpreter_target =/d' -e '/@python3_10/d' bazel/python_dependencies.bzl ''; patches = [ - # make linux/tcp.h relative. drop when upgrading to >1.21 - (fetchpatch { - url = "https://github.com/envoyproxy/envoy/commit/68448aae7a78a3123097b6ea96016b270457e7b8.patch"; - sha256 = "123kv3x37p8fgfp29jhw5xg5js5q5ipibs8hsm7gzfd5bcllnpfh"; - }) - # fix issues with brotli and GCC 11.2.0+ (-Werror=vla-parameter) ./bump-brotli.patch # fix linux-aarch64 WAMR builds # (upstream WAMR only detects aarch64 on Darwin, not Linux) ./fix-aarch64-wamr.patch + + # use system Python, not bazel-fetched binary Python + ./use-system-python.patch ]; nativeBuildInputs = [ @@ -77,6 +72,7 @@ buildBazelPackage rec { go jdk ninja + patchelf ]; buildInputs = [ @@ -85,8 +81,8 @@ buildBazelPackage rec { fetchAttrs = { sha256 = { - x86_64-linux = "sha256-bE28PBQjsOLkxjIoDk6HcELPP3XzvqKKVa7yUbXB1Qk="; - aarch64-linux = "sha256-Rf7kEBeH72vsvmzKy/7oKQf8cVNVzIcSuXMhrIhMFKM="; + x86_64-linux = "0y3gpvx148bnn6kljdvkg99m681vw39l0avrhvncbf62hvpifqkw"; + aarch64-linux = "0lln5mdlskahz5hb4w268ys2ksy3051drrwlhracmk4i7rpm7fq3"; }.${stdenv.system} or (throw "unsupported system ${stdenv.system}"); dontUseCmakeConfigure = true; dontUseGnConfigure = true; @@ -95,6 +91,12 @@ buildBazelPackage rec { find $bazelOut/external -name requirements.bzl | while read requirements; do sed -i '/# Generated from /d' "$requirements" done + find $bazelOut/external -type f -executable | while read execbin; do + file "$execbin" | grep -q ': ELF .*, dynamically linked,' || continue + patchelf \ + --set-interpreter $(cat ${stdenv.cc}/nix-support/dynamic-linker) \ + "$execbin" + done # Remove references to paths in the Nix store. sed -i \ @@ -138,6 +140,12 @@ buildBazelPackage rec { "--cxxopt=-Wno-maybe-uninitialized" "--cxxopt=-Wno-uninitialized" "--cxxopt=-Wno-error=type-limits" + "--cxxopt=-Wno-error=range-loop-construct" + + # Force use of system Java. + "--extra_toolchains=@local_jdk//:all" + "--java_runtime_version=local_jdk" + "--tool_java_runtime_version=local_jdk" "--define=wasm=${wasmRuntime}" ]; diff --git a/pkgs/servers/http/envoy/use-system-python.patch b/pkgs/servers/http/envoy/use-system-python.patch new file mode 100644 index 000000000000..a2030cc75fd0 --- /dev/null +++ b/pkgs/servers/http/envoy/use-system-python.patch @@ -0,0 +1,58 @@ +diff --git a/bazel/python_dependencies.bzl b/bazel/python_dependencies.bzl +index d9dfb14a9b..b8e92452a7 100644 +--- a/bazel/python_dependencies.bzl ++++ b/bazel/python_dependencies.bzl +@@ -1,10 +1,8 @@ + load("@rules_python//python:pip.bzl", "pip_install", "pip_parse") +-load("@python3_10//:defs.bzl", "interpreter") + + def envoy_python_dependencies(): + pip_parse( + name = "base_pip3", +- python_interpreter_target = interpreter, + requirements_lock = "@envoy//tools/base:requirements.txt", + extra_pip_args = ["--require-hashes"], + ) +@@ -12,14 +10,12 @@ def envoy_python_dependencies(): + # These need to use `pip_install` + pip_install( + # Note: dev requirements do *not* check hashes +- python_interpreter_target = interpreter, + name = "dev_pip3", + requirements = "@envoy//tools/dev:requirements.txt", + ) + + pip_install( + name = "fuzzing_pip3", +- python_interpreter_target = interpreter, + requirements = "@rules_fuzzing//fuzzing:requirements.txt", + extra_pip_args = ["--require-hashes"], + ) +diff --git a/bazel/repositories_extra.bzl b/bazel/repositories_extra.bzl +index 885b41dec6..ac5605eb30 100644 +--- a/bazel/repositories_extra.bzl ++++ b/bazel/repositories_extra.bzl +@@ -1,22 +1,12 @@ + load("@emsdk//:deps.bzl", emsdk_deps = "deps") +-load("@rules_python//python:repositories.bzl", "python_register_toolchains") + load("@proxy_wasm_cpp_host//bazel/cargo/wasmtime:crates.bzl", "wasmtime_fetch_remote_crates") + load("//bazel/external/cargo:crates.bzl", "raze_fetch_remote_crates") + load("@aspect_bazel_lib//lib:repositories.bzl", "aspect_bazel_lib_dependencies") + +-# Python version for `rules_python` +-PYTHON_VERSION = "3.10.2" +- + # Envoy deps that rely on a first stage of dependency loading in envoy_dependencies(). +-def envoy_dependencies_extra(python_version = PYTHON_VERSION): ++def envoy_dependencies_extra(): + emsdk_deps() + raze_fetch_remote_crates() + wasmtime_fetch_remote_crates() + +- # Registers underscored Python minor version - eg `python3_10` +- python_register_toolchains( +- name = "python%s" % ("_".join(python_version.split(".")[:-1])), +- python_version = python_version, +- ) +- + aspect_bazel_lib_dependencies() From 2ded6702dcccfdf9c42d0cefa1fb2e15fd0e0676 Mon Sep 17 00:00:00 2001 From: Luke Granger-Brown Date: Sun, 4 Sep 2022 22:20:58 +0100 Subject: [PATCH 7/8] pomerium: 0.18.0 -> 0.19.0 --- pkgs/servers/http/pomerium/common.nix | 12 +++++------- pkgs/servers/http/pomerium/pomerium-ui-package.json | 1 + 2 files changed, 6 insertions(+), 7 deletions(-) diff --git a/pkgs/servers/http/pomerium/common.nix b/pkgs/servers/http/pomerium/common.nix index d7a0814f1315..24071eb5044d 100644 --- a/pkgs/servers/http/pomerium/common.nix +++ b/pkgs/servers/http/pomerium/common.nix @@ -1,14 +1,12 @@ { fetchFromGitHub , lib }: -let - version = "0.18.0"; - srcSha256 = "sha256-sM4kM8CqbZjl+RIsezWYVCmjoDKfGl+EQcdEaPKvVHs="; - vendorSha256 = "sha256-1EWcjfrO3FEypUUKwNwDisogERCuKOvtC7z0mC2JZn4="; - yarnSha256 = "sha256-Uh0y2Zmy6bSoyL5WMTce01hoH7EvSIniHyIBMxfMvhg="; -in + { - inherit version vendorSha256 yarnSha256; + version = "0.19.0"; + srcSha256 = "sha256:0s5ji1iywymzxlv89y3ivl5vngkifhbpidpwxdrh969l3c5r4klf"; + vendorSha256 = "sha256:1p78nb7bryvs7p5iq6ihylflyjia60x4hd9c62ffwz37dwqlbi33"; + yarnSha256 = "sha256:1n6swanrds9hbd4yyfjzpnfhsb8fzj1pwvvcg3w7b1cgnihclrmv"; src = fetchFromGitHub { owner = "pomerium"; diff --git a/pkgs/servers/http/pomerium/pomerium-ui-package.json b/pkgs/servers/http/pomerium/pomerium-ui-package.json index 12f39ead62a9..6b9dcf4a3e8d 100644 --- a/pkgs/servers/http/pomerium/pomerium-ui-package.json +++ b/pkgs/servers/http/pomerium/pomerium-ui-package.json @@ -30,6 +30,7 @@ "@mui/icons-material": "^5.3.1", "@mui/material": "^5.4.0", "luxon": "^2.3.0", + "markdown-to-jsx": "^7.1.7", "react": "^17.0.2", "react-dom": "^17.0.2", "react-feather": "^2.0.9" From 0b16c98205c02df91ab72d687a66927f34e3a7aa Mon Sep 17 00:00:00 2001 From: Morgan Helton Date: Mon, 5 Sep 2022 14:28:23 -0500 Subject: [PATCH 8/8] pomerium: consolidate ui and base package --- pkgs/servers/http/pomerium/common.nix | 25 ------------- pkgs/servers/http/pomerium/default.nix | 50 +++++++++++++++++++++++--- pkgs/servers/http/pomerium/ui.nix | 38 -------------------- pkgs/top-level/all-packages.nix | 4 +-- 4 files changed, 47 insertions(+), 70 deletions(-) delete mode 100644 pkgs/servers/http/pomerium/common.nix delete mode 100644 pkgs/servers/http/pomerium/ui.nix diff --git a/pkgs/servers/http/pomerium/common.nix b/pkgs/servers/http/pomerium/common.nix deleted file mode 100644 index 24071eb5044d..000000000000 --- a/pkgs/servers/http/pomerium/common.nix +++ /dev/null @@ -1,25 +0,0 @@ -{ fetchFromGitHub -, lib -}: - -{ - version = "0.19.0"; - srcSha256 = "sha256:0s5ji1iywymzxlv89y3ivl5vngkifhbpidpwxdrh969l3c5r4klf"; - vendorSha256 = "sha256:1p78nb7bryvs7p5iq6ihylflyjia60x4hd9c62ffwz37dwqlbi33"; - yarnSha256 = "sha256:1n6swanrds9hbd4yyfjzpnfhsb8fzj1pwvvcg3w7b1cgnihclrmv"; - - src = fetchFromGitHub { - owner = "pomerium"; - repo = "pomerium"; - rev = "v${version}"; - sha256 = srcSha256; - }; - - meta = with lib; { - homepage = "https://pomerium.io"; - description = "Authenticating reverse proxy"; - license = licenses.asl20; - maintainers = with maintainers; [ lukegb ]; - platforms = [ "x86_64-linux" "aarch64-linux" ]; - }; -} diff --git a/pkgs/servers/http/pomerium/default.nix b/pkgs/servers/http/pomerium/default.nix index 31f9a7e59e0c..42af2054caf2 100644 --- a/pkgs/servers/http/pomerium/default.nix +++ b/pkgs/servers/http/pomerium/default.nix @@ -3,18 +3,52 @@ , callPackage , lib , envoy +, mkYarnPackage +, fetchYarnDeps , nixosTests -, pomerium-ui , pomerium-cli }: let inherit (lib) concatStringsSep concatMap id mapAttrsToList; - common = callPackage ./common.nix { }; in buildGoModule rec { - inherit (common) version src vendorSha256 meta; pname = "pomerium"; + version = "0.19.0"; + src = fetchFromGitHub { + owner = "pomerium"; + repo = "pomerium"; + rev = "v${version}"; + sha256 = "sha256:0s5ji1iywymzxlv89y3ivl5vngkifhbpidpwxdrh969l3c5r4klf"; + }; + + vendorSha256 = "sha256:1p78nb7bryvs7p5iq6ihylflyjia60x4hd9c62ffwz37dwqlbi33"; + + ui = mkYarnPackage { + inherit version; + src = "${src}/ui"; + + # update pomerium-ui-package.json when updating package, sourced from ui/package.json + packageJSON = ./pomerium-ui-package.json; + offlineCache = fetchYarnDeps { + yarnLock = "${src}/ui/yarn.lock"; + sha256 = "sha256:1n6swanrds9hbd4yyfjzpnfhsb8fzj1pwvvcg3w7b1cgnihclrmv"; + }; + + buildPhase = '' + runHook preBuild + yarn --offline build + runHook postbuild + ''; + + installPhase = '' + runHook preInstall + cp -R deps/pomerium/dist $out + runHook postInstall + ''; + + doDist = false; + }; subPackages = [ "cmd/pomerium" @@ -70,7 +104,7 @@ buildGoModule rec { echo '${envoy.version}' > pkg/envoy/files/envoy.version # put the built UI files where they will be picked up as part of binary build - cp -r ${pomerium-ui} ui + cp -r ${ui}/* ui/dist ''; installPhase = '' @@ -81,4 +115,12 @@ buildGoModule rec { inherit (nixosTests) pomerium; inherit pomerium-cli; }; + + meta = with lib; { + homepage = "https://pomerium.io"; + description = "Authenticating reverse proxy"; + license = licenses.asl20; + maintainers = with maintainers; [ lukegb ]; + platforms = [ "x86_64-linux" "aarch64-linux" ]; + }; } diff --git a/pkgs/servers/http/pomerium/ui.nix b/pkgs/servers/http/pomerium/ui.nix deleted file mode 100644 index f2a94814ca21..000000000000 --- a/pkgs/servers/http/pomerium/ui.nix +++ /dev/null @@ -1,38 +0,0 @@ -{ lib -, callPackage -, fetchFromGitHub -, fetchYarnDeps -, mkYarnPackage }: -let - common = callPackage ./common.nix { }; -in -mkYarnPackage { - inherit (common) version; - pname = "pomerium-ui"; - src = "${common.src}/ui"; - - # update pomerium-ui-package.json when updating package, sourced from ui/package.json - packageJSON = ./pomerium-ui-package.json; - offlineCache = fetchYarnDeps { - yarnLock = "${common.src}/ui/yarn.lock"; - sha256 = common.yarnSha256; - }; - - buildPhase = '' - runHook preBuild - yarn --offline build - runHook postbuild - ''; - - installPhase = '' - runHook preInstall - cp -R deps/pomerium/dist $out - runHook postInstall - ''; - - doDist = false; - - meta = common.meta // { - description = "Pomerium authenticating reverse proxy UI"; - }; -} diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index e18c5dc1e98e..6f8786a40cf4 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -22892,9 +22892,7 @@ with pkgs; }; pflogsumm = callPackage ../servers/mail/postfix/pflogsumm.nix { }; - pomerium = callPackage ../servers/http/pomerium { - pomerium-ui = callPackage ../servers/http/pomerium/ui.nix { }; - }; + pomerium = callPackage ../servers/http/pomerium { }; pomerium-cli = callPackage ../tools/security/pomerium-cli { }; postgrey = callPackage ../servers/mail/postgrey { };