From 91c30a30e9c4811146bf8411f30120acbffa6dba Mon Sep 17 00:00:00 2001 From: Thomas Gerbet Date: Mon, 7 Oct 2024 21:27:25 +0200 Subject: [PATCH 1/5] vim: 9.1.0707 -> 9.1.0765 Fixes CVE-2024-47814 / GHSA-rj48-v4mq-j4vg. Changes: https://github.com/vim/vim/compare/v9.1.0707...v9.1.0765 --- pkgs/applications/editors/vim/common.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/applications/editors/vim/common.nix b/pkgs/applications/editors/vim/common.nix index 5b9cfec4cb32..67cf247fe72a 100644 --- a/pkgs/applications/editors/vim/common.nix +++ b/pkgs/applications/editors/vim/common.nix @@ -1,6 +1,6 @@ { lib, fetchFromGitHub }: rec { - version = "9.1.0707"; + version = "9.1.0765"; outputs = [ "out" "xxd" ]; @@ -8,7 +8,7 @@ rec { owner = "vim"; repo = "vim"; rev = "v${version}"; - hash = "sha256-iHOLABPk5B7Sh7EBYnM7wdxnK2Wv7q4WS3FEp780SV4="; + hash = "sha256-LtEEMpdWXA6qyjAIjgsZoc4hNXXG2ZXxCsbWKC5aEPI="; }; enableParallelBuilding = true; From b7e2eb1e2111ae9ef1be83e1bf34154f30afedbc Mon Sep 17 00:00:00 2001 From: Markus Theil Date: Sat, 5 Oct 2024 11:09:56 +0200 Subject: [PATCH 2/5] openssl_3_2: remove and switch single user to the default openssl Signed-off-by: Markus Theil Picked from PR https://github.com/NixOS/nixpkgs/pull/345998 except that vcunat used `openssl` instead of `openssl_3_3` I do think that we should be well covered with 3.0 and 3.3. https://github.com/openssl/openssl/blob/openssl-3.3.0/NEWS.md --- .../use-etc-ssl-certs-darwin.patch | 0 .../{3.2 => 3.3}/use-etc-ssl-certs.patch | 0 .../development/libraries/openssl/default.nix | 27 ++----------------- .../networking/cloudflare-warp/default.nix | 4 +-- pkgs/top-level/all-packages.nix | 1 - 5 files changed, 4 insertions(+), 28 deletions(-) rename pkgs/development/libraries/openssl/{3.2 => 3.3}/use-etc-ssl-certs-darwin.patch (100%) rename pkgs/development/libraries/openssl/{3.2 => 3.3}/use-etc-ssl-certs.patch (100%) diff --git a/pkgs/development/libraries/openssl/3.2/use-etc-ssl-certs-darwin.patch b/pkgs/development/libraries/openssl/3.3/use-etc-ssl-certs-darwin.patch similarity index 100% rename from pkgs/development/libraries/openssl/3.2/use-etc-ssl-certs-darwin.patch rename to pkgs/development/libraries/openssl/3.3/use-etc-ssl-certs-darwin.patch diff --git a/pkgs/development/libraries/openssl/3.2/use-etc-ssl-certs.patch b/pkgs/development/libraries/openssl/3.3/use-etc-ssl-certs.patch similarity index 100% rename from pkgs/development/libraries/openssl/3.2/use-etc-ssl-certs.patch rename to pkgs/development/libraries/openssl/3.3/use-etc-ssl-certs.patch diff --git a/pkgs/development/libraries/openssl/default.nix b/pkgs/development/libraries/openssl/default.nix index 0c6c8ae98a09..3dee6474adee 100644 --- a/pkgs/development/libraries/openssl/default.nix +++ b/pkgs/development/libraries/openssl/default.nix @@ -312,29 +312,6 @@ in { }; }; - openssl_3_2 = common { - version = "3.2.3"; - hash = "sha256-UrXxxrgCK8WGjDCMVPt3cF5wLWxvRZT5mg3yFqz0Yjk="; - - patches = [ - ./3.0/nix-ssl-cert-file.patch - - # openssl will only compile in KTLS if the current kernel supports it. - # This patch disables build-time detection. - ./3.0/openssl-disable-kernel-detection.patch - - (if stdenv.hostPlatform.isDarwin - then ./3.2/use-etc-ssl-certs-darwin.patch - else ./3.2/use-etc-ssl-certs.patch) - ]; - - withDocs = true; - - extraMeta = { - license = lib.licenses.asl20; - }; - }; - openssl_3_3 = common { version = "3.3.2"; hash = "sha256-LopAsBl5r+i+C7+z3l3BxnCf7bRtbInBDaEUq1/D0oE="; @@ -347,8 +324,8 @@ in { ./3.0/openssl-disable-kernel-detection.patch (if stdenv.hostPlatform.isDarwin - then ./3.2/use-etc-ssl-certs-darwin.patch - else ./3.2/use-etc-ssl-certs.patch) + then ./3.3/use-etc-ssl-certs-darwin.patch + else ./3.3/use-etc-ssl-certs.patch) ]; withDocs = true; diff --git a/pkgs/tools/networking/cloudflare-warp/default.nix b/pkgs/tools/networking/cloudflare-warp/default.nix index c36ec7c947b1..fb03bee688a6 100644 --- a/pkgs/tools/networking/cloudflare-warp/default.nix +++ b/pkgs/tools/networking/cloudflare-warp/default.nix @@ -11,7 +11,7 @@ , makeWrapper , nftables , nss -, openssl_3_2 +, openssl }: stdenv.mkDerivation rec { @@ -42,7 +42,7 @@ stdenv.mkDerivation rec { dbus gtk3 libpcap - openssl_3_2 + openssl nss stdenv.cc.cc.lib ]; diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index ab9a453819d5..1d7359382592 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -22467,7 +22467,6 @@ with pkgs; inherit (callPackages ../development/libraries/openssl { }) openssl_1_1 openssl_3 - openssl_3_2 openssl_3_3; opensubdiv = callPackage ../development/libraries/opensubdiv { }; From 7014f869474850e8e8a43db61aa8566215f9a1a6 Mon Sep 17 00:00:00 2001 From: K900 Date: Fri, 13 Sep 2024 16:11:59 +0300 Subject: [PATCH 3/5] buildFHSEnv: don't set LD_LIBRARY_PATH It's a bad hack that was originally put into place for Steam, which doesn't need it anymore, and it confuses native binaries that run from Steam. --- pkgs/build-support/build-fhsenv-bubblewrap/buildFHSEnv.nix | 1 - 1 file changed, 1 deletion(-) diff --git a/pkgs/build-support/build-fhsenv-bubblewrap/buildFHSEnv.nix b/pkgs/build-support/build-fhsenv-bubblewrap/buildFHSEnv.nix index 3f066f846517..a18885ac5990 100644 --- a/pkgs/build-support/build-fhsenv-bubblewrap/buildFHSEnv.nix +++ b/pkgs/build-support/build-fhsenv-bubblewrap/buildFHSEnv.nix @@ -87,7 +87,6 @@ let etcProfile = writeText "profile" '' export PS1='${name}-fhsenv:\u@\h:\w\$ ' export LOCALE_ARCHIVE='/usr/lib/locale/locale-archive' - export LD_LIBRARY_PATH="/run/opengl-driver/lib:/run/opengl-driver-32/lib''${LD_LIBRARY_PATH:+:}$LD_LIBRARY_PATH" export PATH="/run/wrappers/bin:/usr/bin:/usr/sbin:$PATH" export TZDIR='/etc/zoneinfo' From 70cb669a2f5608583caedde7e691b104f83ad718 Mon Sep 17 00:00:00 2001 From: K900 Date: Fri, 13 Sep 2024 19:53:16 +0300 Subject: [PATCH 4/5] buildFHSEnv: fix nested fhsenvs with LD_PRELOAD I hate this, but I also kinda love this. It's very cursed. Please help. Co-authored-by: Alyssa Ross --- .../build-fhsenv-bubblewrap/container-init.cc | 63 +++++++++++++++++++ .../build-fhsenv-bubblewrap/default.nix | 47 +++++++------- 2 files changed, 88 insertions(+), 22 deletions(-) create mode 100644 pkgs/build-support/build-fhsenv-bubblewrap/container-init.cc diff --git a/pkgs/build-support/build-fhsenv-bubblewrap/container-init.cc b/pkgs/build-support/build-fhsenv-bubblewrap/container-init.cc new file mode 100644 index 000000000000..351e92477a08 --- /dev/null +++ b/pkgs/build-support/build-fhsenv-bubblewrap/container-init.cc @@ -0,0 +1,63 @@ +#include + +#include +#include +#include + +#include + +const char LD_SO_CONF[] = R"(/lib +/lib/x86_64-linux-gnu +/lib64 +/usr/lib +/usr/lib/x86_64-linux-gnu +/usr/lib64 +/lib/i386-linux-gnu +/lib32 +/usr/lib/i386-linux-gnu +/usr/lib32 +/run/opengl-driver/lib +/run/opengl-driver-32/lib +)"; + +int main(int, const char *argv[]) { + std::ofstream ld_so_conf; + ld_so_conf.open("/etc/ld.so.conf"); + ld_so_conf << LD_SO_CONF; + ld_so_conf.close(); + if (!ld_so_conf) { + perror("Failed to generate ld.so.conf"); + return 1; + } + + int e; + pid_t pid; + const char *ldconfig_argv[] = {"/bin/ldconfig", NULL}; + char *ldconfig_envp[] = {NULL}; + if ((e = posix_spawn(&pid, ldconfig_argv[0], NULL, NULL, + (char *const *)ldconfig_argv, ldconfig_envp))) { + fprintf(stderr, "Failed to run ldconfig: %s\n", strerror(e)); + return 1; + } + + int status; + if (waitpid(pid, &status, 0) == -1) { + perror("Failed to wait for ldconfig"); + return 1; + } + if (WIFEXITED(status)) { + if (WEXITSTATUS(status)) { + fprintf(stderr, "ldconfig exited %d\n", WEXITSTATUS(status)); + return 1; + } + } else { + fprintf(stderr, "ldconfig killed by signal %d\n", WTERMSIG(status)); + return 1; + } + + argv[0] = "/init"; + execv(argv[0], (char *const *)argv); + + perror("Failed to exec stage 2 init"); + return 1; +} diff --git a/pkgs/build-support/build-fhsenv-bubblewrap/default.nix b/pkgs/build-support/build-fhsenv-bubblewrap/default.nix index 5be1172352b5..8bf5aebeb516 100644 --- a/pkgs/build-support/build-fhsenv-bubblewrap/default.nix +++ b/pkgs/build-support/build-fhsenv-bubblewrap/default.nix @@ -5,6 +5,7 @@ , writeShellScript , glibc , pkgsi686Linux +, runCommandCC , coreutils , bubblewrap }: @@ -98,29 +99,30 @@ let ]; in map (path: "/etc/${path}") files; - # Create this on the fly instead of linking from /nix - # The container might have to modify it and re-run ldconfig if there are - # issues running some binary with LD_LIBRARY_PATH - createLdConfCache = '' - cat > /etc/ld.so.conf < /dev/null + # Here's the problem case: + # - we need to run bash to run the init script + # - LD_PRELOAD may be set to another dynamic library, requiring us to discover its dependencies + # - oops! ldconfig is part of the init script, and it hasn't run yet + # - everything explodes + # + # In particular, this happens with fhsenvs in fhsenvs, e.g. when running + # a wrapped game from Steam. + # + # So, instead of doing that, we build a tiny static (important!) shim + # that executes ldconfig in a completely clean environment to generate + # the initial cache, and then execs into the "real" init, which is the + # first time we see anything dynamically linked at all. + # + # Also, the real init is placed strategically at /init, so we don't + # have to recompile this every time. + containerInit = runCommandCC "container-init" { + buildInputs = [ stdenv.cc.libc.static or null ]; + } '' + $CXX -static -s -o $out ${./container-init.cc} ''; - init = run: writeShellScript "${name}-init" '' + + realInit = run: writeShellScript "${name}-init" '' source /etc/profile - ${createLdConfCache} exec ${run} "$@" ''; @@ -253,6 +255,7 @@ let --symlink /etc/ld.so.cache ${glibc}/etc/ld.so.cache \ --ro-bind ${glibc}/etc/rpc ${glibc}/etc/rpc \ --remount-ro ${glibc}/etc \ + --symlink ${realInit runScript} /init \ '' + optionalString fhsenv.isMultiBuild (indentLines '' --tmpfs ${pkgsi686Linux.glibc}/etc \ --symlink /etc/ld.so.conf ${pkgsi686Linux.glibc}/etc/ld.so.conf \ @@ -265,7 +268,7 @@ let "''${auto_mounts[@]}" "''${x11_args[@]}" ${concatStringsSep "\n " extraBwrapArgs} - ${init runScript} ${initArgs} + ${containerInit} ${initArgs} ) exec "''${cmd[@]}" ''; From a3ccb7f562a93826ad0112adf20dc7f697b7713e Mon Sep 17 00:00:00 2001 From: K900 Date: Thu, 19 Sep 2024 18:21:35 +0300 Subject: [PATCH 5/5] steam: decimate --- nixos/modules/programs/steam.nix | 2 +- .../build-fhsenv-bubblewrap/buildFHSEnv.nix | 3 + pkgs/games/steam/default.nix | 17 +- pkgs/games/steam/fhsenv.nix | 423 +++++------------- pkgs/games/steam/runtime-wrapped.nix | 45 -- pkgs/games/steam/runtime.nix | 37 -- pkgs/top-level/aliases.nix | 1 + pkgs/top-level/all-packages.nix | 1 - 8 files changed, 114 insertions(+), 415 deletions(-) delete mode 100644 pkgs/games/steam/runtime-wrapped.nix delete mode 100644 pkgs/games/steam/runtime.nix diff --git a/nixos/modules/programs/steam.nix b/nixos/modules/programs/steam.nix index 92e6f4ccaeb1..dab8425721c5 100644 --- a/nixos/modules/programs/steam.nix +++ b/nixos/modules/programs/steam.nix @@ -31,7 +31,7 @@ in { default = pkgs.steam; defaultText = lib.literalExpression "pkgs.steam"; example = lib.literalExpression '' - pkgs.steam-small.override { + pkgs.steam.override { extraEnv = { MANGOHUD = true; OBS_VKCAPTURE = true; diff --git a/pkgs/build-support/build-fhsenv-bubblewrap/buildFHSEnv.nix b/pkgs/build-support/build-fhsenv-bubblewrap/buildFHSEnv.nix index a18885ac5990..25f8b8a39b6b 100644 --- a/pkgs/build-support/build-fhsenv-bubblewrap/buildFHSEnv.nix +++ b/pkgs/build-support/build-fhsenv-bubblewrap/buildFHSEnv.nix @@ -12,6 +12,7 @@ , targetPkgs ? pkgs: [] , multiPkgs ? pkgs: [] , multiArch ? false # Whether to include 32bit packages +, includeClosures ? false # Whether to include closures of all packages , nativeBuildInputs ? [] , extraBuildCommands ? "" , extraBuildCommandsMulti ? "" @@ -171,6 +172,7 @@ let ${pkgs.glib.dev}/bin/glib-compile-schemas $out/share/glib-2.0/schemas fi ''; + inherit includeClosures; }; staticUsrProfileMulti = buildEnv { @@ -178,6 +180,7 @@ let paths = baseMultiPaths ++ multiPaths; extraOutputsToInstall = [ "out" "lib" ] ++ extraOutputsToInstall; ignoreCollisions = true; + inherit includeClosures; }; # setup library paths only for the targeted architecture diff --git a/pkgs/games/steam/default.nix b/pkgs/games/steam/default.nix index 4d3f2ba7140c..ee2b72be5400 100644 --- a/pkgs/games/steam/default.nix +++ b/pkgs/games/steam/default.nix @@ -1,5 +1,5 @@ { makeScopeWithSplicing', generateSplicesForMkScope -, stdenv, buildFHSEnv, pkgsi686Linux, mesa-demos +, stdenv }: let @@ -10,21 +10,8 @@ let else if stdenv.hostPlatform.system == "i686-linux" then "i386" else throw "Unsupported platform: ${stdenv.hostPlatform.system}"; - steam-runtime = callPackage ./runtime.nix { }; - steam-runtime-wrapped = callPackage ./runtime-wrapped.nix { }; steam = callPackage ./steam.nix { }; - steam-fhsenv = callPackage ./fhsenv.nix { - mesa-demos-i686 = - if self.steamArch == "amd64" - then pkgsi686Linux.mesa-demos - else mesa-demos; - steam-runtime-wrapped-i686 = - if self.steamArch == "amd64" - then pkgsi686Linux.steamPackages.steam-runtime-wrapped - else null; - inherit buildFHSEnv; - }; - steam-fhsenv-small = steam-fhsenv.override { withGameSpecificLibraries = false; }; + steam-fhsenv = callPackage ./fhsenv.nix {}; # This has to exist so Hydra tries to build all of Steam's dependencies. # FIXME: Maybe we should expose it as something more generic? diff --git a/pkgs/games/steam/fhsenv.nix b/pkgs/games/steam/fhsenv.nix index 6a4a1e002058..1eb6dffd3a39 100644 --- a/pkgs/games/steam/fhsenv.nix +++ b/pkgs/games/steam/fhsenv.nix @@ -1,340 +1,127 @@ -{ lib, stdenv, writeShellScript, buildFHSEnv, steam, mesa-demos-i686 -, steam-runtime-wrapped, steam-runtime-wrapped-i686 ? null -, extraPkgs ? pkgs: [ ] # extra packages to add to targetPkgs -, extraLibraries ? pkgs: [ ] # extra packages to add to multiPkgs -, extraProfile ? "" # string to append to profile -, extraPreBwrapCmds ? "" # extra commands to run before calling bubblewrap (real default is at usage site) -, extraBwrapArgs ? [ ] # extra arguments to pass to bubblewrap (real default is at usage site) -, extraArgs ? "" # arguments to always pass to steam -, extraEnv ? { } # Environment variables to pass to Steam - -# steamwebhelper deletes unrelated electron programs' singleton cookies from /tmp on startup: -# https://github.com/ValveSoftware/steam-for-linux/issues/9121 -, privateTmp ? true # Whether to separate steam's /tmp from the host system - -, withGameSpecificLibraries ? true # include game specific libraries -}@args: - +{ + lib, + steam, + buildFHSEnv, + writeShellScript, + extraPkgs ? pkgs: [ ], # extra packages to add to targetPkgs + extraLibraries ? pkgs: [ ], # extra packages to add to multiPkgs + extraProfile ? "", # string to append to profile + extraPreBwrapCmds ? "", # extra commands to run before calling bubblewrap + extraBwrapArgs ? [ ], # extra arguments to pass to bubblewrap (real default is at usage site) + extraArgs ? "", # arguments to always pass to steam + extraEnv ? { }, # Environment variables to pass to Steam +}: let - commonTargetPkgs = pkgs: with pkgs; [ - # Needed for operating system detection until - # https://github.com/ValveSoftware/steam-for-linux/issues/5909 is resolved - lsb-release - # Errors in output without those - pciutils - # run.sh wants ldconfig - glibc_multi.bin - # Games' dependencies - xorg.xrandr - which - # Needed by gdialog, including in the steam-runtime - perl - # Open URLs - xdg-utils - iana-etc - # Steam Play / Proton - python3 - # Steam VR - procps - usbutils + steamEnv = { name, runScript, passthru ? {}, meta ? {} }: + buildFHSEnv { + inherit name runScript passthru meta; - # It tries to execute xdg-user-dir and spams the log with command not founds - xdg-user-dirs + multiArch = true; + includeClosures = true; - # electron based launchers need newer versions of these libraries than what runtime provides - mesa - sqlite - ] ++ extraPkgs pkgs; + # https://gitlab.steamos.cloud/steamrt/steam-runtime-tools/-/blob/main/docs/distro-assumptions.md#command-line-tools + targetPkgs = pkgs: with pkgs; [ + steam - ldPath = lib.optionals stdenv.hostPlatform.is64bit [ "/lib64" ] - ++ [ "/lib32" ] - ++ map (x: "/steamrt/${steam-runtime-wrapped.arch}/" + x) steam-runtime-wrapped.libs - ++ lib.optionals (steam-runtime-wrapped-i686 != null) (map (x: "/steamrt/${steam-runtime-wrapped-i686.arch}/" + x) steam-runtime-wrapped-i686.libs); + bash + coreutils + file + lsb-release # not documented, called from Big Picture + pciutils # not documented, complains about lspci on startup + glibc_multi.bin + xz + zenity - # Zachtronics and a few other studios expect STEAM_LD_LIBRARY_PATH to be present - exportLDPath = '' - export LD_LIBRARY_PATH=${lib.concatStringsSep ":" ldPath}''${LD_LIBRARY_PATH:+:}$LD_LIBRARY_PATH - export STEAM_LD_LIBRARY_PATH="$STEAM_LD_LIBRARY_PATH''${STEAM_LD_LIBRARY_PATH:+:}$LD_LIBRARY_PATH" - ''; + # Steam expects it to be /sbin specifically + (pkgs.runCommand "sbin-ldconfig" {} '' + mkdir -p $out/sbin + ln -s /bin/ldconfig $out/sbin/ldconfig + '') - # bootstrap.tar.xz has 444 permissions, which means that simple deletes fail - # and steam will not be able to start - fixBootstrap = '' - if [ -r $HOME/.steam/steam/bootstrap.tar.xz ]; then - chmod +w $HOME/.steam/steam/bootstrap.tar.xz - fi - ''; + # crashes on startup if it can't find libX11 locale files + (pkgs.runCommand "xorg-locale" {} '' + mkdir -p $out + ln -s ${xorg.libX11}/share $out/share + '') + ] ++ extraPkgs pkgs; - envScript = '' - # prevents various error messages - unset GIO_EXTRA_MODULES + # https://gitlab.steamos.cloud/steamrt/steam-runtime-tools/-/blob/main/docs/distro-assumptions.md#shared-libraries + multiPkgs = pkgs: with pkgs; [ + glibc + libxcrypt + libGL - # This is needed for IME (e.g. iBus, fcitx5) to function correctly on non-CJK locales - # https://github.com/ValveSoftware/steam-for-linux/issues/781#issuecomment-2004757379 - GTK_IM_MODULE='xim' - '' + lib.toShellVars extraEnv; + libdrm + mesa # for libgbm + udev + libudev0-shim + libva + vulkan-loader -in buildFHSEnv rec { + networkmanager # not documented, used for network status things in Big Picture + # FIXME: figure out how to only build libnm? + libcap # not documented, required by srt-bwrap + ] ++ extraLibraries pkgs; + + extraInstallCommands = lib.optionalString (steam != null) '' + ln -s ${steam}/share $out/share + ''; + + profile = '' + # prevents log spam from SteamRT GTK trying to load host GIO modules + unset GIO_EXTRA_MODULES + + # udev event notifications don't work reliably inside containers. + # SDL2 already tries to automatically detect flatpak and pressure-vessel + # and falls back to inotify-based discovery [1]. We make SDL2 do the + # same by telling it explicitly. + # + # [1] + export SDL_JOYSTICK_DISABLE_UDEV=1 + + # This is needed for IME (e.g. iBus, fcitx5) to function correctly on non-CJK locales + # https://github.com/ValveSoftware/steam-for-linux/issues/781#issuecomment-2004757379 + export GTK_IM_MODULE='xim' + + # See https://gitlab.steamos.cloud/steamrt/steam-runtime-tools/-/blob/main/docs/distro-assumptions.md#graphics-driver + export LIBGL_DRIVERS_PATH=/run/opengl-driver/lib/dri:/run/opengl-driver-32/lib/dri + export __EGL_VENDOR_LIBRARY_DIRS=/run/opengl-driver/share/glvnd/egl_vendor.d:/run/opengl-driver-32/share/glvnd/egl_vendor.d + export LIBVA_DRIVERS_PATH=/run/opengl-driver/lib/dri:/run/opengl-driver-32/lib/dri + export VDPAU_DRIVER_PATH=/run/opengl-driver/lib/vdpau:/run/opengl-driver-32/lib/vdpau + + set -a + ${lib.toShellVars extraEnv} + set +a + + ${extraProfile} + ''; + + privateTmp = true; + + inherit extraPreBwrapCmds; + + extraBwrapArgs = [ + # Steam will dump crash reports here, make those more accessible + "--bind-try /tmp/dumps /tmp/dumps" + ] ++ extraBwrapArgs; + }; +in steamEnv { name = "steam"; - # Steam still needs 32bit and various native games do too - multiArch = true; - - targetPkgs = pkgs: with pkgs; [ - steam - # License agreement - zenity - ] ++ commonTargetPkgs pkgs; - - multiPkgs = pkgs: with pkgs; [ - # These are required by steam with proper errors - xorg.libXcomposite - xorg.libXtst - xorg.libXrandr - xorg.libXext - xorg.libX11 - xorg.libXfixes - libGL - libva - pipewire - - # steamwebhelper - harfbuzz - libthai - pango - - lsof # friends options won't display "Launch Game" without it - file # called by steam's setup.sh - - # dependencies for mesa drivers, needed inside pressure-vessel - mesa.llvmPackages.llvm.lib - vulkan-loader - expat - wayland - xorg.libxcb - xorg.libXdamage - xorg.libxshmfence - xorg.libXxf86vm - elfutils - - # Without these it silently fails - xorg.libXinerama - xorg.libXcursor - xorg.libXrender - xorg.libXScrnSaver - xorg.libXi - xorg.libSM - xorg.libICE - curl - nspr - nss - cups - libcap - SDL2 - libusb1 - dbus-glib - gsettings-desktop-schemas - ffmpeg - libudev0-shim - - # Verified games requirements - fontconfig - freetype - xorg.libXt - xorg.libXmu - libogg - libvorbis - SDL - SDL2_image - glew110 - libdrm - libidn - tbb - zlib - - # SteamVR - udev - dbus - - # Other things from runtime - glib - gtk2 - bzip2 - flac - libglut - libjpeg - libpng - libpng12 - libsamplerate - libmikmod - libtheora - libtiff - pixman - speex - SDL_image - SDL_ttf - SDL_mixer - SDL2_ttf - SDL2_mixer - libappindicator-gtk2 - libdbusmenu-gtk2 - libindicator-gtk2 - libcaca - libcanberra - libgcrypt - libunwind - libvpx - librsvg - xorg.libXft - libvdpau - - # required by coreutils stuff to run correctly - # Steam ends up with LD_LIBRARY_PATH=/usr/lib:: - # which overrides DT_RUNPATH in our binaries, so it tries to dynload the - # very old versions of stuff from the runtime. - # FIXME: how do we even fix this correctly - attr - # same thing, but for Xwayland (usually via gamescope), already in the closure - libkrb5 - keyutils - ] ++ lib.optionals withGameSpecificLibraries [ - # Not formally in runtime but needed by some games - at-spi2-atk - at-spi2-core # CrossCode - gst_all_1.gstreamer - gst_all_1.gst-plugins-ugly - gst_all_1.gst-plugins-base - json-glib # paradox launcher (Stellaris) - libxkbcommon # paradox launcher - libvorbis # Dead Cells - libxcrypt # Alien Isolation, XCOM 2, Company of Heroes 2 - mono - ncurses # Crusader Kings III - openssl - xorg.xkeyboardconfig - xorg.libpciaccess - xorg.libXScrnSaver # Dead Cells - icu # dotnet runtime, e.g. Stardew Valley - - # screeps dependencies - gtk3 - zlib - atk - cairo - gdk-pixbuf - - # Prison Architect - libGLU - libuuid - libbsd - alsa-lib - - # Loop Hero - # FIXME: Also requires openssl_1_1, which is EOL. Either find an alternative solution, or remove these dependencies (if not needed by other games) - libidn2 - libpsl - nghttp2.lib - rtmpdump - ] - # This needs to come from pkgs as the passed-in steam-runtime-wrapped may not be the same architecture - ++ pkgs.steamPackages.steam-runtime-wrapped.overridePkgs - ++ extraLibraries pkgs; - - extraInstallCommands = lib.optionalString (steam != null) '' - mkdir -p $out/share/applications - ln -s ${steam}/share/icons $out/share - ln -s ${steam}/share/pixmaps $out/share - ln -s ${steam}/share/applications/steam.desktop $out/share/applications/steam.desktop - ''; - - profile = '' - # Workaround for issue #44254 (Steam cannot connect to friends network) - # https://github.com/NixOS/nixpkgs/issues/44254 - if [ -z ''${TZ+x} ]; then - new_TZ="$(readlink -f /etc/localtime | grep -P -o '(?<=/zoneinfo/).*$')" - if [ $? -eq 0 ]; then - export TZ="$new_TZ" - fi - fi - - # udev event notifications don't work reliably inside containers. - # SDL2 already tries to automatically detect flatpak and pressure-vessel - # and falls back to inotify-based discovery [1]. We make SDL2 do the - # same by telling it explicitly. - # - # [1] - export SDL_JOYSTICK_DISABLE_UDEV=1 - '' + extraProfile; - - runScript = writeShellScript "steam-wrapper.sh" '' - if [ -f /etc/NIXOS ]; then # Check only useful on NixOS - ${mesa-demos-i686}/bin/glxinfo 2>&1 | grep -q Error - # If there was an error running glxinfo, we know something is wrong with the configuration - if [ $? -eq 0 ]; then - cat < /dev/stderr - ** - WARNING: Steam is not set up. Add the following options to /etc/nixos/configuration.nix - and then run \`sudo nixos-rebuild switch\`: - { - hardware.graphics.enable32Bit = true; - hardware.pulseaudio.support32Bit = true; - } - ** - EOF - fi - fi - - ${exportLDPath} - ${fixBootstrap} - - set -o allexport # Export the following env vars - ${envScript} + runScript = writeShellScript "steam-wrapped" '' exec steam ${extraArgs} "$@" ''; - inherit privateTmp; - - extraPreBwrapCmds = '' - install -m 1777 -d /tmp/dumps - '' + args.extraPreBwrapCmds or ""; - - extraBwrapArgs = [ - "--bind-try /etc/NIXOS /etc/NIXOS" # required 32bit driver check in runScript - "--bind-try /tmp/dumps /tmp/dumps" - ] ++ args.extraBwrapArgs or []; - - meta = - if steam != null - then - steam.meta // lib.optionalAttrs (!withGameSpecificLibraries) { - description = steam.meta.description + " (without game specific libraries)"; - mainProgram = "steam"; - } - else { - description = "Steam dependencies (dummy package, do not use)"; - }; - - passthru.steamargs = args; - passthru.run = buildFHSEnv { + passthru.run = steamEnv { name = "steam-run"; - targetPkgs = commonTargetPkgs; - inherit multiArch multiPkgs profile extraInstallCommands extraBwrapArgs; - runScript = writeShellScript "steam-run" '' - run="$1" - if [ "$run" = "" ]; then + if [ $# -eq 0 ]; then echo "Usage: steam-run command-to-run args..." >&2 exit 1 fi - shift - ${exportLDPath} - ${fixBootstrap} - - set -o allexport # Export the following env vars - ${envScript} - exec -- "$run" "$@" + exec "$@" ''; meta = (steam.meta or {}) // { @@ -347,4 +134,8 @@ in buildFHSEnv rec { license = lib.licenses.mit; }; }; + + meta = (steam.meta or {}) // { + description = "Steam dependencies (dummy package, do not use)"; + }; } diff --git a/pkgs/games/steam/runtime-wrapped.nix b/pkgs/games/steam/runtime-wrapped.nix deleted file mode 100644 index 648e012d3fe5..000000000000 --- a/pkgs/games/steam/runtime-wrapped.nix +++ /dev/null @@ -1,45 +0,0 @@ -{ stdenv, steamArch, lib, perl, pkgs, steam-runtime -, runtimeOnly ? false -}: - -let - overridePkgs = lib.optionals (!runtimeOnly) (with pkgs; [ - libgpg-error - libpulseaudio - alsa-lib - openalSoft - libva1 - libvdpau - vulkan-loader - gcc.cc.lib - nss - nspr - xorg.libxcb - ]); - - allPkgs = overridePkgs ++ [ steam-runtime ]; - - gnuArch = if steamArch == "amd64" then "x86_64-linux-gnu" - else if steamArch == "i386" then "i386-linux-gnu" - else throw "Unsupported architecture"; - - libs = [ "lib/${gnuArch}" "lib" "usr/lib/${gnuArch}" "usr/lib" ]; - bins = [ "bin" "usr/bin" ]; - -in stdenv.mkDerivation { - name = "steam-runtime-wrapped"; - - nativeBuildInputs = [ perl ]; - - builder = ./build-wrapped.sh; - - passthru = { - inherit gnuArch libs bins overridePkgs; - arch = steamArch; - }; - - installPhase = '' - buildDir "${toString libs}" "${toString (map lib.getLib allPkgs)}" - buildDir "${toString bins}" "${toString (map lib.getBin allPkgs)}" - ''; -} diff --git a/pkgs/games/steam/runtime.nix b/pkgs/games/steam/runtime.nix deleted file mode 100644 index f736ac8daa47..000000000000 --- a/pkgs/games/steam/runtime.nix +++ /dev/null @@ -1,37 +0,0 @@ -{ lib, stdenv, fetchurl - -# for update script -, writeShellScript, curl, nix-update -}: - -stdenv.mkDerivation (finalAttrs: { - - pname = "steam-runtime"; - # from https://repo.steampowered.com/steamrt-images-scout/snapshots/latest-steam-client-general-availability/VERSION.txt - version = "0.20240415.84615"; - - src = fetchurl { - url = "https://repo.steampowered.com/steamrt-images-scout/snapshots/${finalAttrs.version}/steam-runtime.tar.xz"; - hash = "sha256-C8foNnIVA+O4YwuCrIf9N6Lr/GlApPVgZsYgi+3OZUE="; - name = "scout-runtime-${finalAttrs.version}.tar.gz"; - }; - - buildCommand = '' - mkdir -p $out - tar -C $out --strip=1 -x -f $src - ''; - - passthru = { - updateScript = writeShellScript "update.sh" '' - version=$(${curl}/bin/curl https://repo.steampowered.com/steamrt-images-scout/snapshots/latest-steam-client-general-availability/VERSION.txt) - ${lib.getExe nix-update} --version "$version" steamPackages.steam-runtime - ''; - }; - - meta = { - description = "Official runtime used by Steam"; - homepage = "https://github.com/ValveSoftware/steam-runtime"; - license = lib.licenses.unfreeRedistributable; # Includes NVIDIA CG toolkit - maintainers = with lib.maintainers; [ hrdinka abbradar ]; - }; -}) diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix index 88b828c32cbe..659b60117a31 100644 --- a/pkgs/top-level/aliases.nix +++ b/pkgs/top-level/aliases.nix @@ -1520,6 +1520,7 @@ mapAliases { ssm-agent = amazon-ssm-agent; # Added 2023-10-17 starboard-octant-plugin = throw "starboard-octant-plugin has been dropped due to needing octant which is archived"; # Added 2023-09-29 starspace = throw "starspace has been removed from nixpkgs, as it was broken"; # Added 2024-07-15 + steam-small = steam; # Added 2024-09-12 steam-run-native = steam-run; # added 2022-02-21 StormLib = stormlib; # Added 2024-01-21 sumneko-lua-language-server = lua-language-server; # Added 2023-02-07 diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index 1d7359382592..2ac9e6be40c3 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -35332,7 +35332,6 @@ with pkgs; steamPackages = recurseIntoAttrs (callPackage ../games/steam { }); steam = steamPackages.steam-fhsenv; - steam-small = steamPackages.steam-fhsenv-small; steam-run = steam.run;