diff --git a/nixos/doc/manual/redirects.json b/nixos/doc/manual/redirects.json index 4385b88e7cea..654debde8da7 100644 --- a/nixos/doc/manual/redirects.json +++ b/nixos/doc/manual/redirects.json @@ -1185,6 +1185,12 @@ "module-services-gitlab-maintenance-rake": [ "index.html#module-services-gitlab-maintenance-rake" ], + "module-services-gitlab-runner": [ + "index.html#module-services-gitlab-runner" + ], + "ex-gitlab-runner-podman": [ + "index.html#ex-gitlab-runner-podman" + ], "module-forgejo": [ "index.html#module-forgejo" ], diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix index 4ae56e40ead8..33787453a48c 100644 --- a/nixos/modules/module-list.nix +++ b/nixos/modules/module-list.nix @@ -502,7 +502,7 @@ ./services/continuous-integration/buildkite-agents.nix ./services/continuous-integration/gitea-actions-runner.nix ./services/continuous-integration/github-runners.nix - ./services/continuous-integration/gitlab-runner.nix + ./services/continuous-integration/gitlab-runner/runner.nix ./services/continuous-integration/gocd-agent/default.nix ./services/continuous-integration/gocd-server/default.nix ./services/continuous-integration/hercules-ci-agent/default.nix diff --git a/nixos/modules/services/continuous-integration/gitlab-runner.nix b/nixos/modules/services/continuous-integration/gitlab-runner/runner.nix similarity index 100% rename from nixos/modules/services/continuous-integration/gitlab-runner.nix rename to nixos/modules/services/continuous-integration/gitlab-runner/runner.nix diff --git a/nixos/modules/services/misc/gitlab.md b/nixos/modules/services/misc/gitlab.md index 60c0e9310acd..b583836e2ff7 100644 --- a/nixos/modules/services/misc/gitlab.md +++ b/nixos/modules/services/misc/gitlab.md @@ -10,6 +10,7 @@ configure a webserver to proxy HTTP requests to the socket. For instance, the following configuration could be used to use nginx as frontend proxy: + ```nix { services.nginx = { @@ -40,6 +41,7 @@ The default state dir is `/var/gitlab/state`. This is where all data like the repositories and uploads will be stored. A basic configuration with some custom settings could look like this: + ```nix { services.gitlab = { @@ -104,6 +106,7 @@ the [services.gitlab.backup.startAt](#opt-services.gitlab.backup.startAt) option to configure regular backups. To run a manual backup, start the `gitlab-backup` service: + ```ShellSession $ systemctl start gitlab-backup.service ``` @@ -116,6 +119,116 @@ will have to run the command as the user that you configured to run GitLab with. A list of all available rake tasks can be obtained by running: + ```ShellSession $ sudo -u git -H gitlab-rake -T ``` + +## Runner {#module-services-gitlab-runner} + +GitLab Runner is a CI runner which is an executable which you can host yourself. +A Gitlab pipeline runs operations over a Gitlab Runner. These can include +building an executable, running a test suite, pushing a docker image, etc. The +Gitlab Runner receives jobs from Gitlab which it then dispatches to the +configured executors +([`docker` (`podman`), or `shell` or `kubernetes`](https://docs.gitlab.com/runner/executors)). + +The +[services.gitlab-runner.services](https://search.nixos.org/options?query=services.gitlab-runner.services) +documents a number of typical setups to configure multiple runners with +different executors. + +The [below example](#ex-gitlab-runner-podman) gives a **more elaborate** example how to +configure a Gitlab Runner with caching and reasonably good security practices. + +::: {#ex-gitlab-runner-podman .example} + +## Example: Gitlab Runner with `podman` and Nix Store Caching + +The [VM tested `podman-runner`](https://github.com/NixOS/nixpkgs/blob/master/nixos/tests/gitlab/runner/podman-runner/default.nix) +(a NixOS module for reuse) configures an advanced Gitlab runner with the following features: + +- The executor is `podman` which gives you better additional safety than + `docker`. That means every job is run in a `podman` container. + +- The following container **images** are built with Nix: + + **Container Images for Gitlab Jobs**: + - `local/alpine`: An image based on Alpine with a Nix installation + (attribute `jobImages.alpine`). + - `local/ubuntu`: An image based on Ubuntu with a Nix installation + (attribute `jobImages.ubuntu`). + - `local/nix`: An image based on Nix which only comes with `nix` + installed (attribute `jobImages.nix`). + + **Images for VM Setup**: + - `local/nix-daemon-image`: An image with a Nix daemon which is + used to share the `/nix/store` across jobs (variable `nixDaemonImage`) setup with some essentials derivations `bootstrapPkgs`. + - `local/podman-daemon-image`: An image with `podman` running as a daemon which is + used to run `podman` inside the above job containers images + (variable `podmanDaemonImage`). + +- Every job container runs in a `podman` container instance based by default on + `jobImage.ubuntu`. A pipeline job can override this with `image: local/alpine`. + - Each job container will have the `/nix/store` mounted from the container + `nix-daemon-container` (see registration flags + `--docker-volumes-from "nix-daemon-container:ro"`). + + The `nix-daemon-container` is a single container instance of a + `nixDaemonImage`. This enables caching of `/nix/store` paths across all jobs + in **all** runners. This makes **the host VM's `/nix/store` independent of the + Nix store used in the jobs**, which is good. + + ::: {.note} + **Security:** If you don't want this you need multiple `nixDaemonImage` + containers for each registered runner (`gitlab-runner.services.`). + ::: + + - Each job container will have the `/run/podman/podman.sock` socket mounted from the + `podman-daemon-container`. + + The `podman-daemon-container` is a single container of a `podmanDaemonImage` which runs + `podman` as a daemon. Job containers can use this daemon to spawn nested containers as well (podman-in-podman). + **Keep in mind that `bind` mounts are local to the `podman-daemon-container`** + and can be be worked around with a `podman volume create ` and manual copy-to/copy-from this volume ``. + + If you only need to build containers you don't need this feature (`podman-daemon-container`), see below point. + + Container configuration files (`auxRootFiles`) are copied to all containers to + ensure `podman` works consistently inside the job containers. + + - The job containers do **not** mount the `podman` socket from the host (NixOS + VM) mounted for security reasons. + + ::: {.note} + Building container images with `buildah` (stripped + `podman` for building images) inside a job which runs `jobImage.alpine` + is still possible. + ::: + + - **Cleanup Disk Space**: + + With this setup its really easy to clean the `nix-daemon-container` + (e.g. if you run out of disk space), then reboot and have the runner in a clean state. + You can do the following to effectively clean everything and start with fresh volumes safely: + + ```bash + # Stop the Gitlab runner. + systemctl stop gitlab-runner.service + # Stop `systemd`-managed containers, such that they get not recreated + # when deleting below. + systemctl stop podman-podman-daemon-container.service \ + podman-nix-daemon-container.service \ + podman-nix-container.service \ + podman-alpine-container.service \ + podman-ubuntu-container.service || true + + podman container rm -f --all + podman image rm -f --all + podman volumes rm -f --all + + reboot + # Systemd will restart all containers and create volumes etc. + ``` + +::: diff --git a/nixos/modules/virtualisation/xen-dom0.nix b/nixos/modules/virtualisation/xen-dom0.nix index 014fb864da80..ba4b92779197 100644 --- a/nixos/modules/virtualisation/xen-dom0.nix +++ b/nixos/modules/virtualisation/xen-dom0.nix @@ -907,13 +907,17 @@ in wantedBy = [ "multi-user.target" ]; serviceConfig = { PIDFile = cfg.qemu.pidFile; - ExecStart = '' - ${cfg.qemu.package}/${cfg.qemu.package.qemu-system-i386} \ - -xen-domid 0 -xen-attach -name dom0 -nographic -M xenpv \ - -daemonize -monitor /dev/null -serial /dev/null -parallel \ - /dev/null -nodefaults -no-user-config -pidfile \ - ${cfg.qemu.pidFile} - ''; + overrideStrategy = "asDropin"; + ExecStart = [ + "" + '' + ${cfg.qemu.package}/${cfg.qemu.package.qemu-system-i386} \ + -xen-domid 0 -xen-attach -name dom0 -nographic -M xenpv \ + -daemonize -monitor /dev/null -serial /dev/null -parallel \ + /dev/null -nodefaults -no-user-config -pidfile \ + ${cfg.qemu.pidFile} + '' + ]; }; }; diff --git a/nixos/release-combined.nix b/nixos/release-combined.nix index da66d7c323f3..6730a9faa4d8 100644 --- a/nixos/release-combined.nix +++ b/nixos/release-combined.nix @@ -98,7 +98,8 @@ rec { (onFullSupported "nixos.tests.firewall") (onFullSupported "nixos.tests.fontconfig-default-fonts") - (onFullSupported "nixos.tests.gitlab") + (onFullSupported "nixos.tests.gitlab.gitlab") + (onFullSupported "nixos.tests.gitlab.runner") (onFullSupported "nixos.tests.gnome") (onSystems [ "x86_64-linux" ] "nixos.tests.hibernate") (onFullSupported "nixos.tests.i3wm") diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix index 5a0946c3b135..b63cdd007f82 100644 --- a/nixos/tests/all-tests.nix +++ b/nixos/tests/all-tests.nix @@ -642,7 +642,9 @@ in gitdaemon = runTest ./gitdaemon.nix; gitea = handleTest ./gitea.nix { giteaPackage = pkgs.gitea; }; github-runner = runTest ./github-runner.nix; - gitlab = runTest ./gitlab.nix; + gitlab = import ./gitlab { + inherit runTest; + }; gitolite = runTest ./gitolite.nix; gitolite-fcgiwrap = runTest ./gitolite-fcgiwrap.nix; glance = runTest ./glance.nix; diff --git a/nixos/tests/gitlab/default.nix b/nixos/tests/gitlab/default.nix new file mode 100644 index 000000000000..0e8841e95187 --- /dev/null +++ b/nixos/tests/gitlab/default.nix @@ -0,0 +1,5 @@ +{ runTest }: +{ + gitlab = runTest ./gitlab.nix; + runner = runTest ./runner.nix; +} diff --git a/nixos/tests/gitlab.nix b/nixos/tests/gitlab/gitlab.nix similarity index 99% rename from nixos/tests/gitlab.nix rename to nixos/tests/gitlab/gitlab.nix index 1a9c1605ec43..762d0a572854 100644 --- a/nixos/tests/gitlab.nix +++ b/nixos/tests/gitlab/gitlab.nix @@ -7,12 +7,12 @@ # - Opening and closing issues. # - Downloading repository archives as tar.gz and tar.bz2 # Run with -# [nixpkgs]$ nix-build -A nixosTests.gitlab +# [nixpkgs]$ nix-build -A nixosTests.gitlab.gitlab { pkgs, lib, ... }: let - inherit (import ./ssh-keys.nix pkgs) snakeOilPrivateKey snakeOilPublicKey; + inherit (import ../ssh-keys.nix pkgs) snakeOilPrivateKey snakeOilPublicKey; initialRootPassword = "notproduction"; rootProjectId = "2"; @@ -37,7 +37,7 @@ in gitlab = { ... }: { - imports = [ common/user-account.nix ]; + imports = [ ../common/user-account.nix ]; environment.systemPackages = with pkgs; [ git ]; diff --git a/nixos/tests/gitlab/runner.nix b/nixos/tests/gitlab/runner.nix new file mode 100644 index 000000000000..8a97bea4b596 --- /dev/null +++ b/nixos/tests/gitlab/runner.nix @@ -0,0 +1,178 @@ +# This test runs a gitlab-runner and performs the following tests in +# two machines `gitlab` and `gitlab-runner`: +# - Create runners in the `gitlab` machine for all runners in `./runner`. +# - Inject the runner tokens into the `gitlab-runner.service` (machine `gitlab-runner`) +# which runs all runners: +# - Shell runner in `./runner/shell-runner`. +# - Start the `gitlab-runner.service`. +# - Check that all runners in `gitlab` are `active`. +# +# Run with +# [nixpkgs]$ nix-build -A nixosTests.gitlab.runner + +{ + pkgs, + lib, + ... +}: + +let + initialRootPassword = "notproduction"; + + runnerTokenDir = "/run/secrets/gitlab-runner"; + + runnerConfigs = { + # The Gitlab runner where each job runs + # on the host (not containerized and very insecure). + shell = { + desc = "Shell runner (host NixOS shell, host Nix store)"; + name = "shell"; + tokenFile = "${runnerTokenDir}/token-shell.env"; + }; + + # The Gitlab runner which uses the Docker runner (we use podman). + # Features: + # - Daemonizes the Nix store into a container. + # - All jobs run in an unprivileged container, e.g. with image + # (`local/nix`, `local/alpine`, `local/ubuntu`) + podman = { + desc = "Podman runner (containers, shared containerized Nix store)"; + name = "podman"; + tokenFile = "${runnerTokenDir}/token-podman.env"; + }; + }; +in +{ + name = "gitlab-runner"; + meta.maintainers = with lib.maintainers; [ + gabyx + ]; + + nodes = { + gitlab-runner = + { ... }: + { + imports = [ + ../common/user-account.nix + (import ./runner/shell-runner.nix { + runnerConfig = runnerConfigs.shell; + }) + ] + # Only enable the podman runner on x86_64 + # cause of built images. + ++ (lib.optional pkgs.stdenv.buildPlatform.isx86_64 ( + import ./runner/podman-runner { + runnerConfig = runnerConfigs.podman; + } + )); + + virtualisation = { + diskSize = 10000; + }; + + # Define the Gitlab Runner. + services.gitlab-runner = { + enable = true; + + settings = { + log_level = "info"; + }; + + gracefulTermination = false; + }; + }; + gitlab = + { config, ... }: + { + imports = [ ../common/user-account.nix ]; + + networking.firewall.allowedTCPPorts = [ + config.services.nginx.defaultHTTPListenPort + ]; + + environment.systemPackages = with pkgs; [ git ]; + + virtualisation.memorySize = 6144; + virtualisation.cores = 4; + + systemd.services.gitlab.serviceConfig.Restart = lib.mkForce "no"; + systemd.services.gitlab-workhorse.serviceConfig.Restart = lib.mkForce "no"; + systemd.services.gitaly.serviceConfig.Restart = lib.mkForce "no"; + systemd.services.gitlab-sidekiq.serviceConfig.Restart = lib.mkForce "no"; + + services.nginx = { + enable = true; + recommendedProxySettings = true; + virtualHosts = { + localhost = { + locations."/".proxyPass = "http://unix:/run/gitlab/gitlab-workhorse.socket"; + }; + }; + }; + + services.gitlab = { + enable = true; + databasePasswordFile = pkgs.writeText "dbPassword" "xo0daiF4"; + initialRootPasswordFile = pkgs.writeText "rootPassword" initialRootPassword; + secrets = { + secretFile = pkgs.writeText "secret" "Aig5zaic"; + otpFile = pkgs.writeText "otpsecret" "Riew9mue"; + dbFile = pkgs.writeText "dbsecret" "we2quaeZ"; + jwsFile = pkgs.runCommand "oidcKeyBase" { } "${pkgs.openssl}/bin/openssl genrsa 2048 > $out"; + activeRecordPrimaryKeyFile = pkgs.writeText "arprimary" "vsaYPZjTRxcbG7W6gNr95AwBmzFUd4Eu"; + activeRecordDeterministicKeyFile = pkgs.writeText "ardeterministic" "kQarv9wb2JVP7XzLTh5f6DFcMHms4nEC"; + activeRecordSaltFile = pkgs.writeText "arsalt" "QkgR9CfFU3MXEWGqa7LbP24AntK5ZeYw"; + }; + + # reduce memory usage + sidekiq.concurrency = 1; + puma.workers = 2; + }; + }; + }; + + testScript = + { nodes, ... }: + let + authPayload = pkgs.writeText "auth.json" ( + builtins.toJSON { + grant_type = "password"; + username = "root"; + password = initialRootPassword; + } + ); + + runnerTokenEnv = pkgs.writeText "runner-token.env" '' + CI_SERVER_URL=http://gitlab + CI_SERVER_TOKEN=$token + ''; + + createRunnerPayload = pkgs.writeText "create-runner.json" ( + builtins.toJSON { + runner_type = "instance_type"; + } + ); + in + # python + '' + # Define some globals for the python script below. + JQ_BINARY="${pkgs.jq}/bin/jq" + GITLAB_STATE_PATH="${nodes.gitlab.services.gitlab.statePath}" + RUNNER_TOKEN_ENV_FILE="${runnerTokenEnv}" + AUTH_PAYLOAD_FILE="${authPayload}" + CREATE_RUNNER_PAYLOAD_FILE="${createRunnerPayload}" + + ${lib.readFile ./runner_test.py} + + start_all() + wait_for_services() + + # Run all tests. + test_connection() + test_register_runner(name="shell", tokenFile="${runnerConfigs.shell.tokenFile}") + test_register_runner(name="podman", tokenFile="${runnerConfigs.podman.tokenFile}") + restart_gitlab_runner_service(runnerConfigs) + test_runner_registered(runnerConfigs["shell"]) + test_runner_registered(runnerConfigs["podman"]) + ''; +} diff --git a/nixos/tests/gitlab/runner/podman-runner/default.nix b/nixos/tests/gitlab/runner/podman-runner/default.nix new file mode 100644 index 000000000000..0bdccfaeed3a --- /dev/null +++ b/nixos/tests/gitlab/runner/podman-runner/default.nix @@ -0,0 +1,425 @@ +{ runnerConfig }: +# Gitlab Runner Module +# +# This module will add a Gitlab-Runner +# with a nix-daemon running in a podman container `nix-daemon-container`. +# Check the documentation in the NixOS Manual. +# +# Debugging on the VM: +# +# - You can use `journalctl -u gitlab-runner.service`. +# +# - To run a job container inside the VM use: +# ```bash +# podman run --rm -it +# --volumes-from 'nix-daemon-container' +# -v "podman-daemon-socket:/run/podman" +# "local/alpine" \ +# bash -c "export CI_PIPELINE_ID=123456 && gitlab-runner-pre-build-script; echo hello" +# ``` +{ + lib, + pkgs, + ... +}: +let + # Switch to not use IFD in nixpkgs test. + # NOTE: When reusing this runner, you can set this to `true`. + useIFD = false; + + # Either we use a Nix as the base image or Alpine. + imageNames = { + default = imageNames.alpine; + + alpine = "local/alpine"; + nix = "local/nix"; + ubuntu = "local/ubuntu"; + + all = with imageNames; [ + alpine + nix + ubuntu + ]; + }; + + noPruneLabels = { + no-prune = "true"; + }; + + # This derivation will contain a folder `/etc` + files = pkgs.callPackage ./files { }; + preBuildScript = pkgs.callPackage ./scripts/prebuild.nix { }; + + # These derivations are Linked into the job images root dir. + bootstrapPkgs = [ + pkgs.nix + # Runtime dependencies of nix. + pkgs.gnutar + pkgs.gzip + pkgs.openssh + pkgs.xz + pkgs.cacert + + # Other stuff. + (lib.hiPrio pkgs.coreutils) + (lib.hiPrio pkgs.findutils) + pkgs.openssh + pkgs.bashInteractive + (lib.hiPrio pkgs.git) + pkgs.cachix + + pkgs.just + pkgs.podman # For nested containers. + + preBuildScript + + files.containers + files.nixConfig + ]; + + # All these packages are added to the Nix daemon. + nixStorePkgs = bootstrapPkgs ++ [ + # These files + files.basicRoot + files.fakeNixpkgs + ]; + + toEnvList = envs: lib.mapAttrsToList (k: v: "${k}=${v}") envs; + + # This is the Nix base image used for the Nix Daemon. + # The build script for the nixos/nix image is vendored due to Hydra limitations. + # cause it is IFD (Import from Derivation) which is not allowed. + # NOTE: When reusing this runner you can set `useIFD` to true: + nixImageBaseFn = + if !useIFD then + import ./nix-image.nix + else + import ( + (pkgs.fetchFromGitHub { + owner = "NixOS"; + repo = "nix"; + rev = "2.32.4"; + hash = "sha256-8QYnRyGOTm3h/Dp8I6HCmQzlO7C009Odqyp28pTWgcY="; + }) + + "/docker.nix" + ); + + nixImageBase = pkgs.callPackage nixImageBaseFn { + name = "local/nix-base"; + tag = "latest"; + + bundleNixpkgs = false; + maxLayers = 2; + + # You can add here a user with uid,gid,uname,gname etc. + # We are using root. + + extraPkgs = nixStorePkgs; + + nixConf = { + cores = "0"; + experimental-features = [ + "nix-command" + "flakes" + ]; + }; + }; + + # This is the daemon image which provides the store + # as volumes. + nixDaemonImage = pkgs.dockerTools.buildLayeredImage { + fromImage = nixImageBase; + name = "local/nix-daemon"; + tag = "latest"; + + config = { + Volumes = { + "/nix/store" = { }; + "/nix/var/nix/db" = { }; + "/nix/var/nix/daemon-socket" = { }; + }; + Labels = noPruneLabels; + }; + maxLayers = 4; + }; + + # This is the podman daemon image which enables + # a job image to use `podman` internally. + podmanDaemonImage = + let + # Update with: + # ```shell + # nix run "github:nixos/nixpkgs/nixos-unstable#nix-prefetch-docker" -- \ + # --image-name quay.io/podman/stable --image-tag v5.6.0 + # ``` + base = pkgs.dockerTools.pullImage { + imageName = "quay.io/podman/stable"; + imageDigest = "sha256:7c9381b9af167cf2218831c3af3135856c99f488b543b78435c8f18e19ad739a"; + hash = "sha256-pXXCu13fB/RN9qx8iLhE5Kko6glTrFrRhR7fo2OS7V0="; + finalImageName = "quay.io/podman/stable"; + finalImageTag = "v5.6.0"; + }; + in + pkgs.dockerTools.buildLayeredImage { + fromImage = base; + name = "local/podman-daemon"; + tag = "latest"; + + config = { + Labels = noPruneLabels; + }; + }; + + jobImages = + let + extraCommands = '' + set -eu + # Set missing Nix directories. + mkdir -p -m 0755 nix/var/log/nix/drvs + mkdir -p -m 0755 nix/var/nix/{gcroots,profiles,temproots,userpool} + mkdir -p -m 1777 nix/var/nix/{gcroots,profiles}/per-user + mkdir -p -m 0755 nix/var/nix/profiles/per-user/root + + # Need a HOME. + mkdir -vp root + mkdir -p -m 0700 root/.nix-defexpr + ''; + in + { + # The Nix image. + # Similar to https://github.com/nix-community/docker-nixpkgs/blob/main/images/nix/default.nix. + nix = pkgs.dockerTools.buildLayeredImage { + name = imageNames.nix; + tag = "latest"; + + extraCommands = extraCommands + '' + set -eu + # For `/usr/bin/env`. + mkdir -p usr && ln -s ../bin usr/bin + ''; + + contents = bootstrapPkgs ++ [ files.basicRoot ]; + # No store paths are copied into. We provide them by mounting the + # /nix/store. + includeStorePaths = false; + + config = { + Labels = noPruneLabels; + Env = toEnvList envs.nix; + }; + maxLayers = 2; + }; + + # This is the analog image to `local/nix` but Alpine based. + alpine = + let + # Update with: + # ```shell + # nix run "github:nixos/nixpkgs/nixos-unstable#nix-prefetch-docker" -- --image-name alpine --image-tag latest + # ``` + alpineBase = pkgs.dockerTools.pullImage { + imageName = "alpine"; + imageDigest = "sha256:beefdbd8a1da6d2915566fde36db9db0b524eb737fc57cd1367effd16dc0d06d"; + sha256 = "0gf7wbjp37zbni3pz8vdgq1mss6mz69wynms0gqhq7lsxfmg9xj9"; + finalImageName = "alpine"; + finalImageTag = "latest"; + }; + in + (pkgs.dockerTools.buildLayeredImage { + fromImage = alpineBase; + name = imageNames.alpine; + tag = "latest"; + + inherit extraCommands; + + contents = bootstrapPkgs; + # No store paths are copied into. We provide them by mounting the + # /nix/store. + includeStorePaths = false; + + config = { + Labels = noPruneLabels; + Env = toEnvList envs.nix; + }; + + # Only if `build buildLayeredImage`. + maxLayers = 3; + }); + + # This is the analog image to `local/nix` but Ubuntu based. + ubuntu = + let + # Update with: + # ```shell + # nix run "github:nixos/nixpkgs/nixos-unstable#nix-prefetch-docker" -- \ + # --image-name ubuntu --image-tag latest + # ``` + ubuntuBase = pkgs.dockerTools.pullImage { + imageName = "ubuntu"; + imageDigest = "sha256:1e622c5f073b4f6bfad6632f2616c7f59ef256e96fe78bf6a595d1dc4376ac02"; + hash = "sha256-aC8SgxdcMSaaU89YMr/uwE022Yqey2frmeZqr+L1xEU="; + finalImageName = "ubuntu"; + finalImageTag = "latest"; + }; + in + (pkgs.dockerTools.buildLayeredImage { + fromImage = ubuntuBase; + name = imageNames.ubuntu; + tag = "latest"; + + inherit extraCommands; + + contents = bootstrapPkgs; + # No store paths are copied into. We provide them by mounting the + # /nix/store. + includeStorePaths = false; + + config = { + Labels = noPruneLabels; + Env = toEnvList envs.ubuntu; + }; + + # Only if `build buildLayeredImage`. + maxLayers = 3; + }); + }; + + nixDaemonContainer = { + imageFile = nixDaemonImage; + image = "local/nix-daemon:latest"; + + volumes = [ + "nix-daemon-store:/nix/store" + "nix-daemon-db:/nix/var/nix/db" + "nix-daemon-socket:/nix/var/nix/daemon-socket" + ]; + cmd = [ + "nix" + "daemon" + ]; + }; + + podmanDaemonContainer = { + imageFile = podmanDaemonImage; + image = "local/podman-daemon:latest"; + volumes = [ + "podman-daemon-socket:/run/podman" + "podman-cache:/var/lib/container" + # Shared images, currently not needed. + "podman-shared:/var/lib/shared:ro" + ]; + privileged = true; + cmd = [ + "podman" + "system" + "service" + "--time=0" + "unix:///run/podman/podman.sock" + "--log-level" + "info" + ]; + }; + + # Environment variables for all job containers. + envs = rec { + common = { + # Access to the nix daemon. + NIX_REMOTE = "daemon"; + # Access to podman. + CONTAINER_HOST = "unix:///run/podman/podman.sock"; + + USER = "root"; + PATH = "/nix/var/nix/profiles/default/bin:/nix/var/nix/profiles/default/sbin:/bin:/sbin:/usr/bin:/usr/sbin"; + + SSL_CERT_FILE = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"; + NIX_SSL_CERT_FILE = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"; + + # For shells, source this file. + ENV = "${pkgs.nix}/etc/profile.d/nix-daemon.sh"; + BASH_ENV = "${pkgs.nix}/etc/profile.d/nix-daemon.sh"; + + # Make a fake nixpkgs which throws when using + # `nix repl -f ` for example. + NIX_PATH = "nixpkgs=${files.fakeNixpkgs}"; + }; + + nix = common // { + IMAGE_OS_DIST = "nix"; + }; + + alpine = common // { + IMAGE_OS_DIST = "alpine"; + }; + + ubuntu = common // { + IMAGE_OS_DIST = "ubuntu"; + }; + }; + + registrationFlags = [ + "--docker-volumes" + "gitlab-runner-scratch:/scratch" + + "--docker-volumes" + "podman-daemon-socket:/run/podman" + + "--docker-volumes-from" + "nix-daemon-container:ro" + + "--docker-pull-policy" + "if-not-present" + + "--docker-allowed-pull-policies" + "if-not-present" + + "--docker-host" + "unix:///var/run/podman/podman.sock" + + "--docker-network-mode" + "host" + ]; + +in +{ + imports = [ ./virtualization.nix ]; + + virtualisation.oci-containers = { + backend = "podman"; + + containers = { + nix-daemon-container = nixDaemonContainer; + podman-daemon-container = podmanDaemonContainer; + } + // + # Workaround to add the job images to the registry. + (lib.concatMapAttrs (name: image: { + "${name}-container" = { + imageFile = jobImages.${name}; + image = "${imageNames.${name}}:latest"; + extraOptions = [ + "--volumes-from" + "nix-daemon-container:ro" + ]; + dependsOn = [ "nix-daemon-container" ]; + cmd = [ "true" ]; + }; + }) jobImages); + }; + + # Define the Gitlab Runner. + services.gitlab-runner.services.podman-runner = { + description = runnerConfig.desc; + + inherit registrationFlags; + + authenticationTokenConfigFile = runnerConfig.tokenFile; + + executor = "docker"; + dockerImage = imageNames.default; + dockerAllowedImages = [ ]; + dockerPrivileged = false; + requestConcurrency = 4; + + preBuildScript = "${preBuildScript}/bin/gitlab-runner-pre-build-script"; + }; +} diff --git a/nixos/tests/gitlab/runner/podman-runner/files/basicRoot/etc/group b/nixos/tests/gitlab/runner/podman-runner/files/basicRoot/etc/group new file mode 100644 index 000000000000..162f79fd7086 --- /dev/null +++ b/nixos/tests/gitlab/runner/podman-runner/files/basicRoot/etc/group @@ -0,0 +1,21 @@ +root:x:0: +wheel:x:1: +kmem:x:2: +tty:x:3: +messagebus:x:4: +disk:x:6: +audio:x:17: +floppy:x:18: +uucp:x:19: +lp:x:20: +cdrom:x:24: +tape:x:25: +video:x:26: +dialout:x:27: +utmp:x:29: +adm:x:55: +keys:x:96: +users:x:100: +input:x:174: +nixbld:x:30000:nixbld1,nixbld10,nixbld11,nixbld12,nixbld13,nixbld14,nixbld15,nixbld16,nixbld17,nixbld18,nixbld19,nixbld2,nixbld20,nixbld21,nixbld22,nixbld23,nixbld24,nixbld25,nixbld26,nixbld27,nixbld28,nixbld29,nixbld3,nixbld30,nixbld31,nixbld32,nixbld4,nixbld5,nixbld6,nixbld7,nixbld8,nixbld9 +nogroup:x:65534: diff --git a/nixos/tests/gitlab/runner/podman-runner/files/basicRoot/etc/nsswitch.conf b/nixos/tests/gitlab/runner/podman-runner/files/basicRoot/etc/nsswitch.conf new file mode 100644 index 000000000000..59a21416fd8f --- /dev/null +++ b/nixos/tests/gitlab/runner/podman-runner/files/basicRoot/etc/nsswitch.conf @@ -0,0 +1,11 @@ +passwd: files mymachines systemd +group: files mymachines systemd +shadow: files + +hosts: files mymachines dns myhostname +networks: files + +ethers: files +services: files +protocols: files +rpc: files diff --git a/nixos/tests/gitlab/runner/podman-runner/files/basicRoot/etc/passwd b/nixos/tests/gitlab/runner/podman-runner/files/basicRoot/etc/passwd new file mode 100644 index 000000000000..006b53f7bf82 --- /dev/null +++ b/nixos/tests/gitlab/runner/podman-runner/files/basicRoot/etc/passwd @@ -0,0 +1,34 @@ +root:x:0:0:System administrator:/root:/bin/bash +nixbld1:x:30001:30000:Nix build user 1:/var/empty:/run/current-system/sw/bin/nologin +nixbld2:x:30002:30000:Nix build user 2:/var/empty:/run/current-system/sw/bin/nologin +nixbld3:x:30003:30000:Nix build user 3:/var/empty:/run/current-system/sw/bin/nologin +nixbld4:x:30004:30000:Nix build user 4:/var/empty:/run/current-system/sw/bin/nologin +nixbld5:x:30005:30000:Nix build user 5:/var/empty:/run/current-system/sw/bin/nologin +nixbld6:x:30006:30000:Nix build user 6:/var/empty:/run/current-system/sw/bin/nologin +nixbld7:x:30007:30000:Nix build user 7:/var/empty:/run/current-system/sw/bin/nologin +nixbld8:x:30008:30000:Nix build user 8:/var/empty:/run/current-system/sw/bin/nologin +nixbld9:x:30009:30000:Nix build user 9:/var/empty:/run/current-system/sw/bin/nologin +nixbld10:x:30010:30000:Nix build user 10:/var/empty:/run/current-system/sw/bin/nologin +nixbld11:x:30011:30000:Nix build user 11:/var/empty:/run/current-system/sw/bin/nologin +nixbld12:x:30012:30000:Nix build user 12:/var/empty:/run/current-system/sw/bin/nologin +nixbld13:x:30013:30000:Nix build user 13:/var/empty:/run/current-system/sw/bin/nologin +nixbld14:x:30014:30000:Nix build user 14:/var/empty:/run/current-system/sw/bin/nologin +nixbld15:x:30015:30000:Nix build user 15:/var/empty:/run/current-system/sw/bin/nologin +nixbld16:x:30016:30000:Nix build user 16:/var/empty:/run/current-system/sw/bin/nologin +nixbld17:x:30017:30000:Nix build user 17:/var/empty:/run/current-system/sw/bin/nologin +nixbld18:x:30018:30000:Nix build user 18:/var/empty:/run/current-system/sw/bin/nologin +nixbld19:x:30019:30000:Nix build user 19:/var/empty:/run/current-system/sw/bin/nologin +nixbld20:x:30020:30000:Nix build user 20:/var/empty:/run/current-system/sw/bin/nologin +nixbld21:x:30021:30000:Nix build user 21:/var/empty:/run/current-system/sw/bin/nologin +nixbld22:x:30022:30000:Nix build user 22:/var/empty:/run/current-system/sw/bin/nologin +nixbld23:x:30023:30000:Nix build user 23:/var/empty:/run/current-system/sw/bin/nologin +nixbld24:x:30024:30000:Nix build user 24:/var/empty:/run/current-system/sw/bin/nologin +nixbld25:x:30025:30000:Nix build user 25:/var/empty:/run/current-system/sw/bin/nologin +nixbld26:x:30026:30000:Nix build user 26:/var/empty:/run/current-system/sw/bin/nologin +nixbld27:x:30027:30000:Nix build user 27:/var/empty:/run/current-system/sw/bin/nologin +nixbld28:x:30028:30000:Nix build user 28:/var/empty:/run/current-system/sw/bin/nologin +nixbld29:x:30029:30000:Nix build user 29:/var/empty:/run/current-system/sw/bin/nologin +nixbld30:x:30030:30000:Nix build user 30:/var/empty:/run/current-system/sw/bin/nologin +nixbld31:x:30031:30000:Nix build user 31:/var/empty:/run/current-system/sw/bin/nologin +nixbld32:x:30032:30000:Nix build user 32:/var/empty:/run/current-system/sw/bin/nologin +nobody:x:65534:65534:Unprivileged account (don't use!):/var/empty:/run/current-system/sw/bin/nologin diff --git a/nixos/tests/gitlab/runner/podman-runner/files/containers/etc/containers/containers.conf b/nixos/tests/gitlab/runner/podman-runner/files/containers/etc/containers/containers.conf new file mode 100644 index 000000000000..0bf45cd2a1a1 --- /dev/null +++ b/nixos/tests/gitlab/runner/podman-runner/files/containers/etc/containers/containers.conf @@ -0,0 +1,2 @@ +[engine] +cgroup_manager = "cgroupfs" diff --git a/nixos/tests/gitlab/runner/podman-runner/files/containers/etc/containers/mounts.conf b/nixos/tests/gitlab/runner/podman-runner/files/containers/etc/containers/mounts.conf new file mode 100644 index 000000000000..b54e7222210b --- /dev/null +++ b/nixos/tests/gitlab/runner/podman-runner/files/containers/etc/containers/mounts.conf @@ -0,0 +1,2 @@ +/run/secrets/etc-pki-entitlement:/run/secrets/etc-pki-entitlement +/run/secrets/rhsm:/run/secrets/rhsm diff --git a/nixos/tests/gitlab/runner/podman-runner/files/containers/etc/containers/policy.json b/nixos/tests/gitlab/runner/podman-runner/files/containers/etc/containers/policy.json new file mode 100644 index 000000000000..4724dd816814 --- /dev/null +++ b/nixos/tests/gitlab/runner/podman-runner/files/containers/etc/containers/policy.json @@ -0,0 +1,12 @@ +{ + "default": [ + { + "type": "insecureAcceptAnything" + } + ], + "transports": { + "docker-daemon": { + "": [{ "type": "insecureAcceptAnything" }] + } + } +} diff --git a/nixos/tests/gitlab/runner/podman-runner/files/containers/etc/containers/registries.conf b/nixos/tests/gitlab/runner/podman-runner/files/containers/etc/containers/registries.conf new file mode 100644 index 000000000000..c3a575800d86 --- /dev/null +++ b/nixos/tests/gitlab/runner/podman-runner/files/containers/etc/containers/registries.conf @@ -0,0 +1,2 @@ +unqualified-search-registries = ["registry.fedoraproject.org", "registry.access.redhat.com", "docker.io"] +short-name-mode = "enforcing" diff --git a/nixos/tests/gitlab/runner/podman-runner/files/containers/etc/containers/registries.conf.d/000-shortnames.conf b/nixos/tests/gitlab/runner/podman-runner/files/containers/etc/containers/registries.conf.d/000-shortnames.conf new file mode 100644 index 000000000000..142e6158235c --- /dev/null +++ b/nixos/tests/gitlab/runner/podman-runner/files/containers/etc/containers/registries.conf.d/000-shortnames.conf @@ -0,0 +1,5 @@ +[aliases] + "buildah" = "quay.io/buildah/stable" + "podman" = "quay.io/podman/stable" + "alpine" = "docker.io/library/alpine" + "ubuntu" = "docker.io/library/ubuntu" diff --git a/nixos/tests/gitlab/runner/podman-runner/files/containers/etc/containers/registries.d/default.yaml b/nixos/tests/gitlab/runner/podman-runner/files/containers/etc/containers/registries.d/default.yaml new file mode 100644 index 000000000000..9e892d760b21 --- /dev/null +++ b/nixos/tests/gitlab/runner/podman-runner/files/containers/etc/containers/registries.d/default.yaml @@ -0,0 +1,27 @@ +# This is a default registries.d configuration file. You may +# add to this file or create additional files in registries.d/. +# +# lookaside: for reading/writing simple signing signatures +# lookaside-staging: for writing simple signing signatures, preferred over lookaside +# +# lookaside and lookaside-staging take a value of the following: +# lookaside: {schema}://location +# +# For reading signatures, schema may be http, https, or file. +# For writing signatures, schema may only be file. + +# The default locations are built-in, for both reading and writing: +# /var/lib/containers/sigstore for root, or +# ~/.local/share/containers/sigstore for non-root users. +default-docker: +# lookaside: https://… +# lookaside-staging: file:///… + +# The 'docker' indicator here is the start of the configuration +# for docker registries. +# +# docker: +# +# privateregistry.com: +# lookaside: https://privateregistry.com/sigstore/ +# lookaside-staging: /mnt/nfs/privateregistry/sigstore diff --git a/nixos/tests/gitlab/runner/podman-runner/files/containers/etc/containers/registries.d/registry.access.redhat.com.yaml b/nixos/tests/gitlab/runner/podman-runner/files/containers/etc/containers/registries.d/registry.access.redhat.com.yaml new file mode 100644 index 000000000000..45018d5830a7 --- /dev/null +++ b/nixos/tests/gitlab/runner/podman-runner/files/containers/etc/containers/registries.d/registry.access.redhat.com.yaml @@ -0,0 +1,3 @@ +docker: + registry.access.redhat.com: + lookaside: https://access.redhat.com/webassets/docker/content/sigstore diff --git a/nixos/tests/gitlab/runner/podman-runner/files/containers/etc/containers/registries.d/registry.redhat.io.yaml b/nixos/tests/gitlab/runner/podman-runner/files/containers/etc/containers/registries.d/registry.redhat.io.yaml new file mode 100644 index 000000000000..ba1769320ce7 --- /dev/null +++ b/nixos/tests/gitlab/runner/podman-runner/files/containers/etc/containers/registries.d/registry.redhat.io.yaml @@ -0,0 +1,3 @@ +docker: + registry.redhat.io: + lookaside: https://registry.redhat.io/containers/sigstore diff --git a/nixos/tests/gitlab/runner/podman-runner/files/containers/etc/containers/storage.conf b/nixos/tests/gitlab/runner/podman-runner/files/containers/etc/containers/storage.conf new file mode 100644 index 000000000000..9db50278d80b --- /dev/null +++ b/nixos/tests/gitlab/runner/podman-runner/files/containers/etc/containers/storage.conf @@ -0,0 +1,15 @@ +[storage] +driver = "overlay" +runroot = "/run/containers/storage" +graphroot = "/var/lib/containers/storage" + +[storage.options] +additionalimagestores = [ +"/var/lib/shared", +"/usr/lib/containers/storage", +] +pull_options = {enable_partial_images = "true", use_hard_links = "false", ostree_repos=""} + +[storage.options.overlay] +mount_program = "/usr/bin/fuse-overlayfs" +mountopt = "nodev,fsync=0" diff --git a/nixos/tests/gitlab/runner/podman-runner/files/default.nix b/nixos/tests/gitlab/runner/podman-runner/files/default.nix new file mode 100644 index 000000000000..e791ae42367f --- /dev/null +++ b/nixos/tests/gitlab/runner/podman-runner/files/default.nix @@ -0,0 +1,46 @@ +# Specific files for the job images. +# +# - `basicRoot`: Some basic root files for the `jobImages.nix`. +# - `fakeNixpkgs`: A fake Nixpkg directory which is set as `NIX_PATH=nixpkgs:` +# which throws on load. +# - `nixConfig`: The Nix config with some options. +# - `containers`: +# These are some files which are copied to the job images needed for +# `buildah` (`podman`): +# +# ```bash +# podman create --name temp-buildah quay.io/buildah/stable:latest +# podman cp temp-buildah:/etc/containers ./etc/ +# find ./etc -type d -empty -delete +# podman container rm temp-buildah +#``` +# +{ pkgs, ... }: +let + + # We need proper derivations to add it to the nixImageBase. + mkDrv = + name: src: + pkgs.stdenv.mkDerivation { + inherit name src; + installPhase = '' + mkdir -p $out + cp -r $src/* $out/ + ''; + }; +in +{ + basicRoot = mkDrv "basic-root-files" ./basicRoot; + containers = mkDrv "containers-files" ./containers; + fakeNixpkgs = mkDrv "fake-nixpkgs" ./fake-nixpkgs; + + nixConfig = pkgs.writeTextFile { + name = "nix.conf"; + destination = "/etc/nix/nix.conf"; + text = '' + accept-flake-config = true + experimental-features = nix-command flakes + max-jobs = auto + ''; + }; +} diff --git a/nixos/tests/gitlab/runner/podman-runner/files/fake-nixpkgs/default.nix b/nixos/tests/gitlab/runner/podman-runner/files/fake-nixpkgs/default.nix new file mode 100644 index 000000000000..eee7aacaf920 --- /dev/null +++ b/nixos/tests/gitlab/runner/podman-runner/files/fake-nixpkgs/default.nix @@ -0,0 +1,10 @@ +_: +throw '' + This container doesn't include nixpkgs. + + The best way to work around that is to pin your dependencies. See + https://nix.dev/tutorials/first-steps/towards-reproducibility-pinning-nixpkgs.html + + Or if you must, override the NIX_PATH environment variable with eg: + "NIX_PATH=nixpkgs=channel:nixos-unstable" +'' diff --git a/nixos/tests/gitlab/runner/podman-runner/nix-image.nix b/nixos/tests/gitlab/runner/podman-runner/nix-image.nix new file mode 100644 index 000000000000..43c11ae25175 --- /dev/null +++ b/nixos/tests/gitlab/runner/podman-runner/nix-image.nix @@ -0,0 +1,400 @@ +# This is the vendored build script from +# https://raw.githubusercontent.com/NixOS/nix/refs/heads/master/docker.nix +# which builds the Nix image. +# This is only here to please Hydra which is not beeing able to build IFDs. +# `import (nixRepo + "./docker.nix")`. +{ + # Core dependencies + pkgs ? import { }, + lib ? pkgs.lib, + dockerTools ? pkgs.dockerTools, + runCommand ? pkgs.runCommand, + buildPackages ? pkgs.buildPackages, + # Image configuration + name ? "nix", + tag ? "latest", + bundleNixpkgs ? true, + channelName ? "nixpkgs", + channelURL ? "https://channels.nixos.org/nixpkgs-unstable", + extraPkgs ? [ ], + maxLayers ? 70, + nixConf ? { }, + flake-registry ? null, + uid ? 0, + gid ? 0, + uname ? "root", + gname ? "root", + Labels ? { + "org.opencontainers.image.title" = "Nix"; + "org.opencontainers.image.source" = "https://github.com/NixOS/nix"; + "org.opencontainers.image.vendor" = "Nix project"; + "org.opencontainers.image.version" = nix.version; + "org.opencontainers.image.description" = "Nix container image"; + }, + Cmd ? [ (lib.getExe bashInteractive) ], + # Default Packages + nix ? pkgs.nix, + bashInteractive ? pkgs.bashInteractive, + coreutils-full ? pkgs.coreutils-full, + gnutar ? pkgs.gnutar, + gzip ? pkgs.gzip, + gnugrep ? pkgs.gnugrep, + which ? pkgs.which, + curl ? pkgs.curl, + less ? pkgs.less, + wget ? pkgs.wget, + man ? pkgs.man, + cacert ? pkgs.cacert, + findutils ? pkgs.findutils, + iana-etc ? pkgs.iana-etc, + gitMinimal ? pkgs.gitMinimal, + openssh ? pkgs.openssh, + # Other dependencies + shadow ? pkgs.shadow, +}: +let + defaultPkgs = [ + nix + bashInteractive + coreutils-full + gnutar + gzip + gnugrep + which + curl + less + wget + man + cacert.out + findutils + iana-etc + gitMinimal + openssh + ] + ++ extraPkgs; + + users = { + + root = { + uid = 0; + shell = lib.getExe bashInteractive; + home = "/root"; + gid = 0; + groups = [ "root" ]; + description = "System administrator"; + }; + + nobody = { + uid = 65534; + shell = lib.getExe' shadow "nologin"; + home = "/var/empty"; + gid = 65534; + groups = [ "nobody" ]; + description = "Unprivileged account (don't use!)"; + }; + + } + // lib.optionalAttrs (uid != 0) { + "${uname}" = { + uid = uid; + shell = lib.getExe bashInteractive; + home = "/home/${uname}"; + gid = gid; + groups = [ "${gname}" ]; + description = "Nix user"; + }; + } + // lib.listToAttrs ( + map (n: { + name = "nixbld${toString n}"; + value = { + uid = 30000 + n; + gid = 30000; + groups = [ "nixbld" ]; + description = "Nix build user ${toString n}"; + }; + }) (lib.lists.range 1 32) + ); + + groups = { + root.gid = 0; + nixbld.gid = 30000; + nobody.gid = 65534; + } + // lib.optionalAttrs (gid != 0) { + "${gname}".gid = gid; + }; + + userToPasswd = ( + k: + { + uid, + gid ? 65534, + home ? "/var/empty", + description ? "", + shell ? "/bin/false", + groups ? [ ], + }: + "${k}:x:${toString uid}:${toString gid}:${description}:${home}:${shell}" + ); + passwdContents = (lib.concatStringsSep "\n" (lib.attrValues (lib.mapAttrs userToPasswd users))); + + userToShadow = k: { ... }: "${k}:!:1::::::"; + shadowContents = (lib.concatStringsSep "\n" (lib.attrValues (lib.mapAttrs userToShadow users))); + + # Map groups to members + # { + # group = [ "user1" "user2" ]; + # } + groupMemberMap = ( + let + # Create a flat list of user/group mappings + mappings = ( + builtins.foldl' ( + acc: user: + let + groups = users.${user}.groups or [ ]; + in + acc + ++ map (group: { + inherit user group; + }) groups + ) [ ] (lib.attrNames users) + ); + in + (builtins.foldl' ( + acc: v: + acc + // { + ${v.group} = acc.${v.group} or [ ] ++ [ v.user ]; + } + ) { } mappings) + ); + + groupToGroup = + k: + { gid }: + let + members = groupMemberMap.${k} or [ ]; + in + "${k}:x:${toString gid}:${lib.concatStringsSep "," members}"; + groupContents = (lib.concatStringsSep "\n" (lib.attrValues (lib.mapAttrs groupToGroup groups))); + + toConf = + with pkgs.lib.generators; + toKeyValue { + mkKeyValue = mkKeyValueDefault { + mkValueString = v: if lib.isList v then lib.concatStringsSep " " v else mkValueStringDefault { } v; + } " = "; + }; + + nixConfContents = toConf ( + { + sandbox = false; + build-users-group = "nixbld"; + trusted-public-keys = [ "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=" ]; + } + // nixConf + ); + + userHome = if uid == 0 then "/root" else "/home/${uname}"; + + baseSystem = + let + nixpkgs = pkgs.path; + channel = runCommand "channel-nixos" { inherit bundleNixpkgs; } '' + mkdir $out + if [ "$bundleNixpkgs" ]; then + ln -s ${ + builtins.path { + path = nixpkgs; + name = "source"; + } + } $out/nixpkgs + echo "[]" > $out/manifest.nix + fi + ''; + # doc/manual/source/command-ref/files/manifest.nix.md + manifest = buildPackages.runCommand "manifest.nix" { } '' + cat > $out < $out/etc/passwd + echo "" >> $out/etc/passwd + + cat $groupContentsPath > $out/etc/group + echo "" >> $out/etc/group + + cat $shadowContentsPath > $out/etc/shadow + echo "" >> $out/etc/shadow + + mkdir -p $out/usr + ln -s /nix/var/nix/profiles/share $out/usr/ + + mkdir -p $out/nix/var/nix/gcroots + + mkdir $out/tmp + + mkdir -p $out/var/tmp + + mkdir -p $out/etc/nix + cat $nixConfContentsPath > $out/etc/nix/nix.conf + + mkdir -p $out${userHome} + mkdir -p $out/nix/var/nix/profiles/per-user/${uname} + + # see doc/manual/source/command-ref/files/profiles.md + ln -s ${profile} $out/nix/var/nix/profiles/default-1-link + ln -s /nix/var/nix/profiles/default-1-link $out/nix/var/nix/profiles/default + ln -s /nix/var/nix/profiles/default $out${userHome}/.nix-profile + + # see doc/manual/source/command-ref/files/channels.md + ln -s ${channel} $out/nix/var/nix/profiles/per-user/${uname}/channels-1-link + ln -s /nix/var/nix/profiles/per-user/${uname}/channels-1-link $out/nix/var/nix/profiles/per-user/${uname}/channels + + # see doc/manual/source/command-ref/files/default-nix-expression.md + mkdir -p $out${userHome}/.nix-defexpr + ln -s /nix/var/nix/profiles/per-user/${uname}/channels $out${userHome}/.nix-defexpr/channels + echo "${channelURL} ${channelName}" > $out${userHome}/.nix-channels + + # may get replaced by pkgs.dockerTools.binSh & pkgs.dockerTools.usrBinEnv + mkdir -p $out/bin $out/usr/bin + ln -s ${lib.getExe' coreutils-full "env"} $out/usr/bin/env + ln -s ${lib.getExe bashInteractive} $out/bin/sh + + '' + + (lib.optionalString (flake-registry-path != null) '' + nixCacheDir="${userHome}/.cache/nix" + mkdir -p $out$nixCacheDir + globalFlakeRegistryPath="$nixCacheDir/flake-registry.json" + ln -s ${flake-registry-path} $out$globalFlakeRegistryPath + mkdir -p $out/nix/var/nix/gcroots/auto + rootName=$(${lib.getExe' nix "nix"} --extra-experimental-features nix-command hash file --type sha1 --base32 <(echo -n $globalFlakeRegistryPath)) + ln -s $globalFlakeRegistryPath $out/nix/var/nix/gcroots/auto/$rootName + '') + ); + +in +dockerTools.buildLayeredImageWithNixDb { + + inherit + name + tag + maxLayers + uid + gid + uname + gname + ; + + contents = [ baseSystem ]; + + extraCommands = '' + rm -rf nix-support + ln -s /nix/var/nix/profiles nix/var/nix/gcroots/profiles + ''; + fakeRootCommands = '' + chmod 1777 tmp + chmod 1777 var/tmp + chown -R ${toString uid}:${toString gid} .${userHome} + chown -R ${toString uid}:${toString gid} nix + ''; + + config = { + inherit Cmd Labels; + User = "${toString uid}:${toString gid}"; + Env = [ + "USER=${uname}" + "PATH=${ + lib.concatStringsSep ":" [ + "${userHome}/.nix-profile/bin" + "/nix/var/nix/profiles/default/bin" + "/nix/var/nix/profiles/default/sbin" + ] + }" + "MANPATH=${ + lib.concatStringsSep ":" [ + "${userHome}/.nix-profile/share/man" + "/nix/var/nix/profiles/default/share/man" + ] + }" + "SSL_CERT_FILE=/nix/var/nix/profiles/default/etc/ssl/certs/ca-bundle.crt" + "GIT_SSL_CAINFO=/nix/var/nix/profiles/default/etc/ssl/certs/ca-bundle.crt" + "NIX_SSL_CERT_FILE=/nix/var/nix/profiles/default/etc/ssl/certs/ca-bundle.crt" + "NIX_PATH=/nix/var/nix/profiles/per-user/${uname}/channels:${userHome}/.nix-defexpr/channels" + ]; + }; + +} diff --git a/nixos/tests/gitlab/runner/podman-runner/scripts/prebuild.nix b/nixos/tests/gitlab/runner/podman-runner/scripts/prebuild.nix new file mode 100644 index 000000000000..4e78638f09a5 --- /dev/null +++ b/nixos/tests/gitlab/runner/podman-runner/scripts/prebuild.nix @@ -0,0 +1,55 @@ +{ writeShellScriptBin, nix }: +writeShellScriptBin "gitlab-runner-pre-build-script" + # bash + '' + set -e + set -u + + function section_start() { + local name="$1" + shift + echo -e "\e[0Ksection_start:$(date +%s):$name[collapsed=true]\r\e[0K$*" + } + + function section_end() { + local name="$1" + echo -e "\e[0Ksection_end:$(date +%s):$name\r\e[0K" + } + + function setup() { + # We need to allow modification of nix config for cachix as + # otherwise it is link to the read only file in the store. + cp --remove-destination \ + "$(readlink -f /etc/nix/nix.conf)" /etc/nix/nix.conf + + # shellcheck disable=SC1091 + . "${nix}/etc/profile.d/nix-daemon.sh" + } + + function setup_pipeline_scratch_dir() { + scratch_dir="/scratch/$CI_PIPELINE_ID" + + echo "Create scratch directory for pipeline: $scratch_dir" + mkdir -p "$scratch_dir" || { + echo "Could not create scratch dir '$scratch_dir'." >&2 + exit 1 + } + + export CI_CUSTOM_SCRATCH_DIR="$scratch_dir" + } + + function print_info() { + echo "Nix version:" + nix --version + } + + function main() { + print_info + setup + setup_pipeline_scratch_dir + } + + section_start gitlab-runner-prebuild "Gitlab-Runner PreBuild Script" + main "$@" + section_end gitlab-runner-prebuild + '' diff --git a/nixos/tests/gitlab/runner/podman-runner/virtualization.nix b/nixos/tests/gitlab/runner/podman-runner/virtualization.nix new file mode 100644 index 000000000000..89a06023400d --- /dev/null +++ b/nixos/tests/gitlab/runner/podman-runner/virtualization.nix @@ -0,0 +1,43 @@ +{ lib, ... }: +{ + virtualisation.docker = { + enable = lib.mkForce false; + }; + + virtualisation.podman = { + enable = true; + + # Create a `docker` alias for podman, to use it as a drop-in replacement + # dockerCompat = true; + dockerSocket = { + enable = true; + }; + + # Required for containers under podman-compose to be able to talk to each other. + defaultNetwork.settings.dns_enabled = true; + + autoPrune = { + dates = "weekly"; + flags = [ + "--filter" + "label!=no-prune" + "--volumes" + "--log-level" + "debug" + ]; + }; + }; + + virtualisation.containers.storage.settings = { + storage = { + driver = "overlay"; + graphroot = "/var/lib/containers/storage"; + runroot = "/run/containers/storage"; + + # Does not work currently. + options.overlay = { + mountopt = "nodev,metacopy=on"; + }; + }; + }; +} diff --git a/nixos/tests/gitlab/runner/shell-runner.nix b/nixos/tests/gitlab/runner/shell-runner.nix new file mode 100644 index 000000000000..da2eaa1b94ea --- /dev/null +++ b/nixos/tests/gitlab/runner/shell-runner.nix @@ -0,0 +1,12 @@ +{ + runnerConfig, +}: +# This is the runner config for the `nixosConfiguration.services.gitlab-runner.services.X` +{ + services.gitlab-runner.services.shell-runner = { + description = runnerConfig.desc; + authenticationTokenConfigFile = runnerConfig.tokenFile; + + executor = "shell"; + }; +} diff --git a/nixos/tests/gitlab/runner_test.py b/nixos/tests/gitlab/runner_test.py new file mode 100644 index 000000000000..adc98e363915 --- /dev/null +++ b/nixos/tests/gitlab/runner_test.py @@ -0,0 +1,146 @@ +import json +import os +from dataclasses import dataclass +from pathlib import Path +from string import Template +from typing import Any + + +@dataclass +class Runner: + name: str + tokenFile: str + + id: str + token: str + + +@dataclass +class Machines: + gitlab: Any + gitlab_runner: Any + + +@dataclass +class Nix: + jq: str + gitlab_state_path: str + create_runner_payload_file: str + auth_payload_file: str + runner_token_env_file: str + + +# Some global variables to work in the tests. +out_dir = os.environ.get("out", os.getcwd()) +nix = Nix( + jq=JQ_BINARY, + gitlab_state_path=GITLAB_STATE_PATH, + auth_payload_file=AUTH_PAYLOAD_FILE, + create_runner_payload_file=CREATE_RUNNER_PAYLOAD_FILE, + runner_token_env_file=RUNNER_TOKEN_ENV_FILE, +) +vms = Machines(gitlab, gitlab_runner) +runnerConfigs: dict[str, Runner] = {} + + +def wait_for_services(): + vms.gitlab.wait_for_unit("gitaly.service") + vms.gitlab.wait_for_unit("gitlab-workhorse.service") + vms.gitlab.wait_for_unit("gitlab.service") + vms.gitlab.wait_for_unit("gitlab-sidekiq.service") + vms.gitlab.wait_for_file(f"{nix.gitlab_state_path}/tmp/sockets/gitlab.socket") + vms.gitlab.wait_until_succeeds("curl -sSf http://gitlab/users/sign_in") + + +def test_connection(): + """ + Test the connection to Gitlab and check if it is reachable from the runner VM. + """ + + print("==> Getting secrets and headers.") + vms.gitlab.succeed( + "cp /var/gitlab/state/config/secrets.yml /root/gitlab-secrets.yml" + ) + + vms.gitlab.succeed( + f"echo \"Authorization: Bearer $(curl -X POST -H 'Content-Type: application/json' -d @{nix.auth_payload_file} http://gitlab/oauth/token | {nix.jq} -r '.access_token')\" >/tmp/headers" + ) + + vms.gitlab.copy_from_vm("/tmp/headers") + out_dir = os.environ.get("out", os.getcwd()) + vms.gitlab_runner.copy_from_host(str(Path(out_dir, "headers")), "/tmp/headers") + + print("==> Testing connection.") + vms.gitlab_runner.succeed("curl -v -H @/tmp/headers http://gitlab/api/v4/version") + + +def test_register_runner(name: str, tokenFile: str): + """ + Register the runner in Gitlab and write the token file to be picked up by + the gitlab-runner service on the other VM. + """ + + r = Runner( + name=name, + tokenFile=tokenFile, + token="", + id="", + ) + runnerConfigs[r.name] = r + + print(f"==> Create Runner '{r.name}'") + resp = vms.gitlab.execute( + f""" + curl -s -X POST \ + -H 'Content-Type: application/json' \ + -H @/tmp/headers \ + -d @{nix.create_runner_payload_file} \ + http://gitlab/api/v4/user/runners + """ + )[1] + obj = json.loads(resp) + r.id = obj["id"] + r.token = obj["token"] + print(f"==> Registered runner '{r.id}' with token '{r.token}'.") + + # Push the token to the runner machine. + print("==> Push runner token to machine.") + tokenF = Path(out_dir, f"token-{r.name}.env") + with open(nix.runner_token_env_file, "r") as f: + tokenData = Template(f.read()).substitute({"token": r.token}) + with open(tokenF, "w") as w: + w.write(tokenData) + vms.gitlab_runner.copy_from_host(str(tokenF), r.tokenFile) + + +def restart_gitlab_runner_service(runnerConfigs): + print("==> Restart Gitlab Runner") + + if any([n == "podman" for n in runnerConfigs.keys()]): + vms.gitlab_runner.wait_for_unit("podman-nix-daemon-container.service") + vms.gitlab_runner.wait_for_unit("podman-podman-daemon-container.service") + + vms.gitlab_runner.systemctl("restart gitlab-runner.service") + vms.gitlab_runner.wait_for_unit("gitlab-runner.service") + + +def test_runner_registered(r: Runner): + """ + Test that the runner `r` is registered in Gitlab and its status is active. + """ + + print(f"==> Check that runner '{r.name}' is registered.") + + resp = vms.gitlab.execute( + f""" + curl -s -X GET \ + -H 'Content-Type: application/json' \ + -H @/tmp/headers \ + http://gitlab/api/v4/runners/{r.id}""" + )[1] + runnerStatus = json.loads(resp) + + if not runnerStatus["active"]: + raise Exception( + f"Runner '{r.name}' [id: '{r.id}'] status is not active: {resp}" + ) diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix index 30ff7d823f17..538e62aed995 100644 --- a/pkgs/applications/editors/vscode/extensions/default.nix +++ b/pkgs/applications/editors/vscode/extensions/default.nix @@ -1005,8 +1005,8 @@ let mktplcRef = { name = "coder-remote"; publisher = "coder"; - version = "1.11.5"; - hash = "sha256-p2mAm6bY2lNocQLQ/8ZW+JcDFlwhMytoQtXNMeJq+CE="; + version = "1.11.6"; + hash = "sha256-yMhbOnG7jVO0oPzLa+El5i7KlD1GCYTOcfF0cOUf5hQ="; }; meta = { description = "Extension for Visual Studio Code to open any Coder workspace in VS Code with a single click"; @@ -1953,8 +1953,8 @@ let mktplcRef = { publisher = "github"; name = "vscode-pull-request-github"; - version = "0.122.0"; - hash = "sha256-U7BpKnkk7l4+dmgam6OP3Dl6ySX9e+wHmUELGpAjOss="; + version = "0.124.1"; + hash = "sha256-+ooxmm3OiNuQigApqkQV9hzw18yUGPEjKFEgn7MjpJA="; }; meta = { license = lib.licenses.mit; @@ -1965,8 +1965,8 @@ let mktplcRef = { name = "gitlab-workflow"; publisher = "gitlab"; - version = "6.60.2"; - hash = "sha256-X3ZOrEkcFDlB4pYqEvO3gACAOET1kjF56FkHLmNKRrI="; + version = "6.61.2"; + hash = "sha256-NLWu/4QgG/vbhTVjV57bt6J7AX2kC59/2xNkj8PMdtc="; }; meta = { description = "GitLab extension for Visual Studio Code"; @@ -3828,8 +3828,8 @@ let mktplcRef = { name = "ansible"; publisher = "redhat"; - version = "25.12.2"; - hash = "sha256-mglzlRBGD09RDwzfJvWaTt3btgEF/G818prJcQC8/Is="; + version = "25.12.3"; + hash = "sha256-6G/CpzSSrRzwtay4+t46gz8aBF7qgu79NUhBypTJMrc="; }; meta = { description = "Ansible language support"; diff --git a/pkgs/by-name/_8/_86Box/package.nix b/pkgs/by-name/_8/_86Box/package.nix index 00d56eba252d..45ad748ab214 100644 --- a/pkgs/by-name/_8/_86Box/package.nix +++ b/pkgs/by-name/_8/_86Box/package.nix @@ -40,13 +40,13 @@ stdenv.mkDerivation (finalAttrs: { pname = "86Box"; - version = "5.2"; + version = "5.3"; src = fetchFromGitHub { owner = "86Box"; repo = "86Box"; tag = "v${finalAttrs.version}"; - hash = "sha256-JcKLtREGSNA0IOGM5kqFjAya155KeYV/nqynG4dVv4w="; + hash = "sha256-n68Ghhsv15TzpOMH4dBTNxa6AYwqN5s2C5pyO9VVaco="; }; patches = [ ./darwin.patch ]; @@ -119,7 +119,7 @@ stdenv.mkDerivation (finalAttrs: { owner = "86Box"; repo = "roms"; tag = "v${finalAttrs.version}"; - hash = "sha256-DmOxQ+E7bHF5St70YqPbIzMoADS8dtp2nDXvrhcAVw4="; + hash = "sha256-7/xhhT29ijGNVlW7oJXdyJuhUwVs0b4dIUjc3lVtNEY="; }; updateScript = ./update.sh; }; diff --git a/pkgs/by-name/an/ansel/package.nix b/pkgs/by-name/an/ansel/package.nix index 6117a91ea3b2..cc07d323806e 100644 --- a/pkgs/by-name/an/ansel/package.nix +++ b/pkgs/by-name/an/ansel/package.nix @@ -82,13 +82,13 @@ let in stdenv.mkDerivation { pname = "ansel"; - version = "0-unstable-2025-12-08"; + version = "0-unstable-2025-12-15"; src = fetchFromGitHub { owner = "aurelienpierreeng"; repo = "ansel"; - rev = "06961da4b03abff051c4abff32eeb6356894809e"; - hash = "sha256-UJC1TBGga52/d1uRkZzCJtNcivql7zjGEUP7mav56wk="; + rev = "c2c49aee68ca256bffbd01da7a67ff57791948a0"; + hash = "sha256-wHzUJE2QxcGt+IuOgJNXonJ97BctNmmZyyCoahjZb90="; fetchSubmodules = true; }; diff --git a/pkgs/by-name/ar/argo-workflows/package.nix b/pkgs/by-name/ar/argo-workflows/package.nix index ccec9fd24637..3bb18cd36d0e 100644 --- a/pkgs/by-name/ar/argo-workflows/package.nix +++ b/pkgs/by-name/ar/argo-workflows/package.nix @@ -41,7 +41,7 @@ buildGoModule rec { ]; postInstall = '' - for shell in bash zsh; do + for shell in bash zsh fish; do ${ if (stdenv.buildPlatform == stdenv.hostPlatform) then "$out/bin/argo" diff --git a/pkgs/by-name/bi/bikeshed/package.nix b/pkgs/by-name/bi/bikeshed/package.nix index 28b54441cd74..34db60658156 100644 --- a/pkgs/by-name/bi/bikeshed/package.nix +++ b/pkgs/by-name/bi/bikeshed/package.nix @@ -6,12 +6,12 @@ python3Packages.buildPythonApplication rec { pname = "bikeshed"; - version = "7.0.0"; + version = "7.0.5"; pyproject = true; src = fetchPypi { inherit pname version; - hash = "sha256-KDa751bPpyu++7N5rTN1XvOXZ2qOFSaajw7dIe7CAWw="; + hash = "sha256-D0PP+NnLREJr0F6M/KG8O9HTz3FOaN0GkWLo96PaU/E="; }; patches = [ ./remove-install-check.patch ]; diff --git a/pkgs/by-name/bl/blender/fix-hip-path.patch b/pkgs/by-name/bl/blender/fix-hip-path.patch deleted file mode 100644 index 8d28dc3441fa..000000000000 --- a/pkgs/by-name/bl/blender/fix-hip-path.patch +++ /dev/null @@ -1,25 +0,0 @@ -commit 0c7159ed66e28b4da4275cd79e01b2d0669808a3 (HEAD -> fix-hip-path-syntax-error, amarshall/fix-hip-path-syntax-error) -Author: Andrew Marshall -Date: Thu Nov 20 20:24:20 2025 -0500 - - Fix: Incorrect HIP load path on Linux - - Missing comma meant the following line was concatenated with this one, - causing the path to be - "/opt/rocm/hip/lib/libamdhip64.so.6libamdhip64.so.7". - - Broken in 14bd7a531feddb81a0e522b7db76288639f1ad05. - -diff --git a/extern/hipew/src/hipew.c b/extern/hipew/src/hipew.c -index 3ce13ef7c32..e72ccde69ef 100644 ---- a/extern/hipew/src/hipew.c -+++ b/extern/hipew/src/hipew.c -@@ -244,7 +244,7 @@ static int hipewHipInit(void) { - const char* hip_paths[] = { "libamdhip64.so", - "libamdhip64.so.6", - "/opt/rocm/lib/libamdhip64.so.6", -- "/opt/rocm/hip/lib/libamdhip64.so.6" -+ "/opt/rocm/hip/lib/libamdhip64.so.6", - "libamdhip64.so.7", - "/opt/rocm/lib/libamdhip64.so.7", - "/opt/rocm/hip/lib/libamdhip64.so.7", diff --git a/pkgs/by-name/bl/blender/package.nix b/pkgs/by-name/bl/blender/package.nix index f9453a6d40e2..c27f27613067 100644 --- a/pkgs/by-name/bl/blender/package.nix +++ b/pkgs/by-name/bl/blender/package.nix @@ -117,18 +117,14 @@ in stdenv'.mkDerivation (finalAttrs: { pname = "blender"; - version = "5.0.0"; + version = "5.0.1"; src = fetchzip { name = "source"; url = "https://download.blender.org/source/blender-${finalAttrs.version}.tar.xz"; - hash = "sha256-UUHsylDmMWRcr1gGiXuYnno7D6uMjLqTYd9ak4FnZis="; + hash = "sha256-fNnQRfGfNc7rbk8npkcYtoAqRjJc6MaV4mqtSJxd0EM="; }; - patches = [ - ./fix-hip-path.patch # https://projects.blender.org/blender/blender/pulls/150321 - ]; - postPatch = (lib.optionalString stdenv.hostPlatform.isDarwin '' : > build_files/cmake/platform/platform_apple_xcode.cmake diff --git a/pkgs/by-name/ca/cantus/package.nix b/pkgs/by-name/ca/cantus/package.nix new file mode 100644 index 000000000000..2fc13a7ec16d --- /dev/null +++ b/pkgs/by-name/ca/cantus/package.nix @@ -0,0 +1,51 @@ +{ + fetchFromGitHub, + lib, + rustPlatform, + pkg-config, + autoPatchelfHook, + stdenv, + wayland, + vulkan-loader, + libxkbcommon, + nix-update-script, +}: +rustPlatform.buildRustPackage rec { + pname = "cantus"; + version = "0.4.0"; + + src = fetchFromGitHub { + owner = "CodedNil"; + repo = "cantus"; + tag = version; + hash = "sha256-Mox8OGJFbQd3dy/I1O6OjqDa4FAFcZWiS+zOuTwV6js="; + }; + + cargoHash = "sha256-9+2+PkUA+s6v/Mrpo8M1lLemxClVONbbeHtric2z/Jw="; + + nativeBuildInputs = [ + pkg-config + autoPatchelfHook + ]; + + runtimeDependencies = [ + libxkbcommon + vulkan-loader + ]; + + buildInputs = [ + stdenv.cc.cc.lib + wayland + ]; + + passthru.updateScript = nix-update-script { }; + + meta = { + description = "Beautiful interactive music widget for Wayland"; + homepage = "https://github.com/CodedNil/cantus"; + license = lib.licenses.mit; + mainProgram = "cantus"; + maintainers = with lib.maintainers; [ CodedNil ]; + platforms = lib.platforms.linux; + }; +} diff --git a/pkgs/by-name/ga/gamescope/package.nix b/pkgs/by-name/ga/gamescope/package.nix index d9584ad0d204..682b71e2b338 100644 --- a/pkgs/by-name/ga/gamescope/package.nix +++ b/pkgs/by-name/ga/gamescope/package.nix @@ -49,14 +49,14 @@ let in stdenv.mkDerivation (finalAttrs: { pname = "gamescope"; - version = "3.16.18"; + version = "3.16.19"; src = fetchFromGitHub { owner = "ValveSoftware"; repo = "gamescope"; tag = finalAttrs.version; fetchSubmodules = true; - hash = "sha256-/5n1ZpZYg2KzlON7cgde96sTCO/jvvmr0AkWYF8IBGU="; + hash = "sha256-Bwj781MVeQexjYnHfDArgjVjl7eQW+CzbdKrLdcAKkg="; }; patches = [ diff --git a/pkgs/by-name/ho/home-manager/package.nix b/pkgs/by-name/ho/home-manager/package.nix index d2a0f2524d43..603f25507c6b 100644 --- a/pkgs/by-name/ho/home-manager/package.nix +++ b/pkgs/by-name/ho/home-manager/package.nix @@ -19,14 +19,14 @@ stdenvNoCC.mkDerivation (finalAttrs: { pname = "home-manager"; - version = "0-unstable-2025-12-13"; + version = "0-unstable-2025-12-19"; src = fetchFromGitHub { name = "home-manager-source"; owner = "nix-community"; repo = "home-manager"; - rev = "d787ec69c3216ea33be1c0424fe65cb23aa8fb31"; - hash = "sha256-KOP4QnkiRwiD5KEOr6ceF67rfTP1OqPmCCft6xDC3k4="; + rev = "bb35f07cc95a73aacbaf1f7f46bb8a3f40f265b5"; + hash = "sha256-47Ee0bTidhF/3/sHuYnWRuxcCrrm0mBNDxBkOTd3wWQ="; }; nativeBuildInputs = [ diff --git a/pkgs/by-name/if/ifm/package.nix b/pkgs/by-name/if/ifm/package.nix index 571c630f4519..29ece74a0bd3 100644 --- a/pkgs/by-name/if/ifm/package.nix +++ b/pkgs/by-name/if/ifm/package.nix @@ -1,22 +1,25 @@ { lib, stdenv, - fetchzip, + fetchFromSourcehut, autoreconfHook, bison, flex, help2man, perl, tk, + python3, }: -stdenv.mkDerivation { +stdenv.mkDerivation (finalAttrs: { pname = "ifm"; - version = "2015-11-08"; + version = "5.5"; - src = fetchzip { - url = "https://bitbucket.org/zondo/ifm/get/dca0774e4d3a.zip"; - sha256 = "14af21qjd5jvsscm6vxpsdrnipdr33g6niagzmykrhyfhwcbjahi"; + src = fetchFromSourcehut { + owner = "~zondo"; + repo = "ifm"; + tag = finalAttrs.version; + hash = "sha256-RA0F8hccVJTq/F4l27CwhxynTqVuLJaYBiUfd/UfvPc="; }; nativeBuildInputs = [ @@ -24,6 +27,7 @@ stdenv.mkDerivation { bison flex help2man + python3 ]; buildInputs = [ @@ -45,4 +49,4 @@ stdenv.mkDerivation { platforms = lib.platforms.linux; maintainers = [ ]; }; -} +}) diff --git a/pkgs/by-name/ju/just/package.nix b/pkgs/by-name/ju/just/package.nix index 16655bfe8757..1182233cdd95 100644 --- a/pkgs/by-name/ju/just/package.nix +++ b/pkgs/by-name/ju/just/package.nix @@ -17,7 +17,7 @@ withDocumentation ? stdenv.buildPlatform.canExecute stdenv.hostPlatform, }: let - version = "1.43.1"; + version = "1.45.0"; in rustPlatform.buildRustPackage { inherit version; @@ -34,10 +34,10 @@ rustPlatform.buildRustPackage { owner = "casey"; repo = "just"; tag = version; - hash = "sha256-ma1P8mcSnU/G/B/pN2tDEVokP+fGShGFodS2TG4wyQY="; + hash = "sha256-D+xMPpn8JLX88eIO9zY051K81KPGBhcFvhBIwuTDymk="; }; - cargoHash = "sha256-nT5GTAvj2+ytbOpRNNVardchK1aXPCiJGSUp5ZoBCVA="; + cargoHash = "sha256-zokI+mWyI/HmzP7GuO59usEsscl3tpeyhNT2tXmLny8="; nativeBuildInputs = lib.optionals (installShellCompletions || installManPages) [ installShellFiles ] @@ -91,8 +91,8 @@ rustPlatform.buildRustPackage { # No linkcheck in sandbox echo 'optional = true' >> book/en/book.toml mdbook build book/en - mkdir -p $doc/share/doc/$name - mv ./book/en/build/html $doc/share/doc/$name + mkdir -p $doc/share/doc/$name/html + mv ./book/en/build/* $doc/share/doc/$name/html '' + lib.optionalString installManPages '' $out/bin/just --man > ./just.1 diff --git a/pkgs/by-name/kw/kwm/org.nixos.kwm.plist b/pkgs/by-name/kw/kwm/org.nixos.kwm.plist deleted file mode 100644 index eafce2ab4a46..000000000000 --- a/pkgs/by-name/kw/kwm/org.nixos.kwm.plist +++ /dev/null @@ -1,26 +0,0 @@ - - - - - Label - org.nixos.kwm - ProgramArguments - - @out@/kwm - - KeepAlive - - Sockets - - Listeners - - SockServiceName - 3020 - SockType - dgram - SockFamily - IPv4 - - - - diff --git a/pkgs/by-name/kw/kwm/package.nix b/pkgs/by-name/kw/kwm/package.nix deleted file mode 100644 index 0f1c13640cc7..000000000000 --- a/pkgs/by-name/kw/kwm/package.nix +++ /dev/null @@ -1,39 +0,0 @@ -{ - lib, - stdenv, - fetchzip, -}: - -stdenv.mkDerivation rec { - pname = "kwm"; - version = "4.0.5"; - - src = fetchzip { - stripRoot = false; - url = "https://github.com/koekeishiya/kwm/releases/download/v${version}/Kwm-${version}.zip"; - sha256 = "1ld1vblg3hmc6lpb8p2ljvisbkijjkijf4y87z5y1ia4k8pk7mxb"; - }; - - # TODO: Build this properly once we have swiftc. - dontBuild = true; - - installPhase = '' - mkdir -p $out/bin - cp kwmc $out/bin/kwmc - cp kwm overlaylib.dylib $out - - mkdir -p $out/Library/LaunchDaemons - cp ${./org.nixos.kwm.plist} $out/Library/LaunchDaemons/org.nixos.kwm.plist - substituteInPlace $out/Library/LaunchDaemons/org.nixos.kwm.plist --subst-var out - ''; - - meta = { - description = "Tiling window manager with focus follows mouse for OSX"; - homepage = "https://github.com/koekeishiya/kwm"; - downloadPage = "https://github.com/koekeishiya/kwm/releases"; - platforms = lib.platforms.darwin; - maintainers = with lib.maintainers; [ lnl7 ]; - mainProgram = "kwmc"; - license = lib.licenses.mit; - }; -} diff --git a/pkgs/by-name/li/litmusctl/package.nix b/pkgs/by-name/li/litmusctl/package.nix index 1aefd755a269..2b1aef569c27 100644 --- a/pkgs/by-name/li/litmusctl/package.nix +++ b/pkgs/by-name/li/litmusctl/package.nix @@ -9,7 +9,7 @@ buildGoModule rec { pname = "litmusctl"; - version = "1.20.0"; + version = "1.21.0"; nativeBuildInputs = [ installShellFiles @@ -23,7 +23,7 @@ buildGoModule rec { owner = "litmuschaos"; repo = "litmusctl"; rev = "${version}"; - hash = "sha256-AXfBUwDBekNmsAXaDKMmgTTu0sCIHaVDfrFrRyx7Bl8="; + hash = "sha256-Re9NBGKJK7FKCVtOg3BTuH4PXSmkvEtf+yYD75u5Lgg="; }; vendorHash = "sha256-7FYOQ89aUFPX+5NCPYKg+YGCXstQ6j9DK4V2mCgklu0="; diff --git a/pkgs/by-name/me/meilisearch/package.nix b/pkgs/by-name/me/meilisearch/package.nix index e192dc9ecfa3..f793352b14fa 100644 --- a/pkgs/by-name/me/meilisearch/package.nix +++ b/pkgs/by-name/me/meilisearch/package.nix @@ -8,18 +8,18 @@ rustPlatform.buildRustPackage (finalAttrs: { pname = "meilisearch"; - version = "1.30.1"; + version = "1.31.0"; src = fetchFromGitHub { owner = "meilisearch"; repo = "meilisearch"; tag = "v${finalAttrs.version}"; - hash = "sha256-Q2K4ojWrPI0XGVKnzS4DUz0y0G+DQdIGSGlbEEm/iEA="; + hash = "sha256-xwQxvyOaldcSyJBjQKLXTayvr3r9EwnXovkqs13XrUY="; }; cargoBuildFlags = [ "--package=meilisearch" ]; - cargoHash = "sha256-GoGarEEXAGgpTRMyRr+E6szIekf5AU+BAwtt+g/WZas="; + cargoHash = "sha256-gvXViWVgu3mAE29Qmk7U2wMV96JYCm3CDcEKLoLwNqg="; # Default features include mini dashboard which downloads something from the internet. buildNoDefaultFeatures = true; diff --git a/pkgs/by-name/mu/muvm/package.nix b/pkgs/by-name/mu/muvm/package.nix index 09e92b4bdee4..2c85e4a7eff3 100644 --- a/pkgs/by-name/mu/muvm/package.nix +++ b/pkgs/by-name/mu/muvm/package.nix @@ -6,6 +6,7 @@ libkrun, passt, dhcpcd, + socat, systemd, udev, pkg-config, @@ -40,6 +41,7 @@ let [ dhcpcd passt + socat (placeholder "out") ] ++ lib.optionals stdenv.hostPlatform.isAarch64 [ fex ] diff --git a/pkgs/by-name/ni/nixpkgs-review/package.nix b/pkgs/by-name/ni/nixpkgs-review/package.nix index 3e8a5a3bb53c..74e03c8124a0 100644 --- a/pkgs/by-name/ni/nixpkgs-review/package.nix +++ b/pkgs/by-name/ni/nixpkgs-review/package.nix @@ -22,14 +22,14 @@ python3Packages.buildPythonApplication rec { pname = "nixpkgs-review"; - version = "3.5.1"; + version = "3.6.0"; pyproject = true; src = fetchFromGitHub { owner = "Mic92"; repo = "nixpkgs-review"; tag = version; - hash = "sha256-43+H68OPABAqg9GQZJ+XehyWmUWk+EWiHzSxyc55luY="; + hash = "sha256-SGykze7xkurdrqwMvXZU4E7VAuEcHCKqtlXAdaQrr1M="; }; build-system = [ diff --git a/pkgs/by-name/ni/nixpkgs-reviewFull/package.nix b/pkgs/by-name/ni/nixpkgs-reviewFull/package.nix index cb0bcff21ddb..1d153dc12a65 100644 --- a/pkgs/by-name/ni/nixpkgs-reviewFull/package.nix +++ b/pkgs/by-name/ni/nixpkgs-reviewFull/package.nix @@ -1,5 +1,6 @@ { stdenv, nixpkgs-review }: +# nixpkgs-update: no auto update nixpkgs-review.override { withSandboxSupport = stdenv.hostPlatform.isLinux; withNom = true; diff --git a/pkgs/by-name/pr/process-compose/package.nix b/pkgs/by-name/pr/process-compose/package.nix index 071e4a41d743..e0957d62b074 100644 --- a/pkgs/by-name/pr/process-compose/package.nix +++ b/pkgs/by-name/pr/process-compose/package.nix @@ -10,13 +10,13 @@ let in buildGoModule (finalAttrs: { pname = "process-compose"; - version = "1.78.0"; + version = "1.85.0"; src = fetchFromGitHub { owner = "F1bonacc1"; repo = "process-compose"; tag = "v${finalAttrs.version}"; - hash = "sha256-phWrEqDdyXYvxWhToV8j01nDeX9ZV12DichiYDOPaLw="; + hash = "sha256-8nNvlTl4qUtlNV2ebsObssYRPepPL//fe26y/wY93l4="; # populate values that require us to use git. By doing this in postFetch we # can delete .git afterwards and maintain better reproducibility of the src. @@ -46,13 +46,11 @@ buildGoModule (finalAttrs: { installShellFiles ]; - vendorHash = "sha256-TsfZtq8L/FD0DsOW4T2i8BSYNq4jvqLJyOSPdrWGPq8="; + vendorHash = "sha256-uZFwiYTkx9TE6T0UJ+EUF8zqP4/8vWYoN+frD6KvQC0="; doCheck = false; postInstall = '' - mv $out/bin/{src,process-compose} - installShellCompletion --cmd process-compose \ --bash <($out/bin/process-compose completion bash) \ --zsh <($out/bin/process-compose completion zsh) \ diff --git a/pkgs/by-name/qm/qmmp/package.nix b/pkgs/by-name/qm/qmmp/package.nix index e8484a125b40..2afa9c6258c8 100644 --- a/pkgs/by-name/qm/qmmp/package.nix +++ b/pkgs/by-name/qm/qmmp/package.nix @@ -54,11 +54,11 @@ stdenv.mkDerivation (finalAttrs: { pname = "qmmp"; - version = "2.3.0"; + version = "2.3.1"; src = fetchurl { url = "https://qmmp.ylsoftware.com/files/qmmp/2.3/qmmp-${finalAttrs.version}.tar.bz2"; - hash = "sha256-AcPjA2fIhReM0RVZTSD2lKR6NS/X5l/PVyLhKsgzMGM="; + hash = "sha256-ph0cH6qcQRx1KSpXEJmRgrkYgxuPDyAMhxSeP/NTvqk="; }; nativeBuildInputs = [ diff --git a/pkgs/by-name/qu/quarkus/package.nix b/pkgs/by-name/qu/quarkus/package.nix index 1668d507bd60..2075e4b1430e 100644 --- a/pkgs/by-name/qu/quarkus/package.nix +++ b/pkgs/by-name/qu/quarkus/package.nix @@ -8,11 +8,11 @@ stdenv.mkDerivation (finalAttrs: { pname = "quarkus-cli"; - version = "3.30.2"; + version = "3.30.4"; src = fetchurl { url = "https://github.com/quarkusio/quarkus/releases/download/${finalAttrs.version}/quarkus-cli-${finalAttrs.version}.tar.gz"; - hash = "sha256-1iHzvgw4xSJPldeRI50rLO/b1YVk8NuSdnU9atG0VRA="; + hash = "sha256-0EDFWcv3IujCxmBbqPTgFOGdv977pWgx8ujO2NZ5EJQ="; }; nativeBuildInputs = [ makeWrapper ]; diff --git a/pkgs/by-name/sl/slobdict/package.nix b/pkgs/by-name/sl/slobdict/package.nix new file mode 100644 index 000000000000..29a9d5a6b3c1 --- /dev/null +++ b/pkgs/by-name/sl/slobdict/package.nix @@ -0,0 +1,88 @@ +{ + lib, + blueprint-compiler, + meson, + ninja, + fetchFromGitHub, + python3Packages, + wrapGAppsHook4, + gobject-introspection, + pkg-config, + gtk4, + webkitgtk_6_0, + glib, + libadwaita, + libzim, +}: + +python3Packages.buildPythonApplication rec { + pname = "slobdict"; + version = "1.0.0"; + + pyproject = false; # built with meson + + src = fetchFromGitHub { + owner = "MuntashirAkon"; + repo = "SlobDict"; + tag = version; + hash = "sha256-V6EmEpxUMZUN9lHSNs4nZBZI2QNxUUWWODukm01lYxY="; + }; + + nativeBuildInputs = [ + blueprint-compiler + gobject-introspection + meson + ninja + pkg-config + wrapGAppsHook4 + ]; + + buildInputs = [ + gtk4 + glib + libadwaita + libzim + webkitgtk_6_0 + ]; + + dependencies = with python3Packages; [ + pygobject3 + pyglossary + + # Optional deps of pyglossary + pyyaml + beautifulsoup4 + biplist + # colorize-pinyin not packaged + html5lib + marisa-trie + mistune + polib + prompt-toolkit + pymorphy3 + # python-romkan-ng not packaged + xxhash + ]; + + # Prevent double wrapping, let the Python wrapper use the args in preFixup. + dontWrapGApps = true; + + postInstall = '' + chmod +x $out/bin/slobdict + ''; + + preFixup = '' + makeWrapperArgs+=("''${gappsWrapperArgs[@]}") + ''; + + strictDeps = true; + + meta = { + homepage = "https://github.com/MuntashirAkon/SlobDict"; + description = "Modern, lightweight GTK 4 dictionary app"; + mainProgram = "slobdict"; + maintainers = with lib.maintainers; [ linsui ]; + license = lib.licenses.agpl3Plus; + platforms = lib.platforms.linux; + }; +} diff --git a/pkgs/by-name/st/streamripper/package.nix b/pkgs/by-name/st/streamripper/package.nix index 92ae81268f2f..69241c08bfe0 100644 --- a/pkgs/by-name/st/streamripper/package.nix +++ b/pkgs/by-name/st/streamripper/package.nix @@ -2,6 +2,7 @@ lib, stdenv, fetchurl, + fetchpatch, fetchDebianPatch, glib, pkg-config, @@ -34,6 +35,13 @@ stdenv.mkDerivation rec { patch = "873964-http"; hash = "sha256-D6koUCbnJHtRuq2zZy9VrxymuGXN1COacbQhphgB8qo="; }) + # fix SR_ERROR_INVALID_METADATA caused by HTTP chunking + # (https://sourceforge.net/p/streamripper/bugs/193/#6a82) + (fetchpatch { + name = "streamripper-http-1.0.patch"; + url = "https://sourceforge.net/p/streamripper/bugs/_discuss/thread/df13e77a/6a82/attachment/streamripper-http-1.0.patch"; + hash = "sha256-EhkxAqMcRJ4IJ6BLrpSQu6FomfEbxvgAu12vaDdNqEU="; + }) ]; nativeBuildInputs = [ pkg-config ]; diff --git a/pkgs/by-name/tc/tclint/package.nix b/pkgs/by-name/tc/tclint/package.nix index abd467be283d..7e1735efcb6b 100644 --- a/pkgs/by-name/tc/tclint/package.nix +++ b/pkgs/by-name/tc/tclint/package.nix @@ -8,14 +8,14 @@ python3Packages.buildPythonApplication rec { pname = "tclint"; - version = "0.6.2"; + version = "0.7.0"; pyproject = true; src = fetchFromGitHub { owner = "nmoroze"; repo = "tclint"; tag = "v${version}"; - hash = "sha256-z0ytMK3xxqXZJTMuY2wiBFo8LXAUZZBb13kr/kXtyjI="; + hash = "sha256-GkWQlOmPh/IpkdcNKkaHJoVDD2r5wCSFeMZA96dxiXM="; }; build-system = with python3Packages; [ diff --git a/pkgs/by-name/te/technitium-dns-server-library/package.nix b/pkgs/by-name/te/technitium-dns-server-library/package.nix index 8971d7dfc795..185f1f4519c4 100644 --- a/pkgs/by-name/te/technitium-dns-server-library/package.nix +++ b/pkgs/by-name/te/technitium-dns-server-library/package.nix @@ -7,13 +7,13 @@ }: buildDotnetModule rec { pname = "technitium-dns-server-library"; - version = "dns-server-v14.2.0"; + version = "14.3.0"; src = fetchFromGitHub { owner = "TechnitiumSoftware"; repo = "TechnitiumLibrary"; - tag = version; - hash = "sha256-a5gCwOxBlp+MzcxrYWY56ihb2ayC/l9G3SQ31ZVpBZc="; + tag = "dns-server-v${version}"; + hash = "sha256-Z8qGp9zMsmPNroO2cS7t7A4lwQ7pnGdzCAcCCEYoXrE="; name = "${pname}-${version}"; }; diff --git a/pkgs/by-name/te/technitium-dns-server/package.nix b/pkgs/by-name/te/technitium-dns-server/package.nix index 49533367f839..4fabd1c7f8f3 100644 --- a/pkgs/by-name/te/technitium-dns-server/package.nix +++ b/pkgs/by-name/te/technitium-dns-server/package.nix @@ -10,13 +10,13 @@ }: buildDotnetModule rec { pname = "technitium-dns-server"; - version = "14.2.0"; + version = "14.3.0"; src = fetchFromGitHub { owner = "TechnitiumSoftware"; repo = "DnsServer"; tag = "v${version}"; - hash = "sha256-zLm6uEC8BoaDfyzmLErJTOzzSKxrmb0j3VhEcsyizI4="; + hash = "sha256-NUH1gn8kdtMBKC5+XEqqTGySNMCDFGF5yy6NbGeRvvY="; name = "${pname}-${version}"; }; diff --git a/pkgs/by-name/un/unison-ucm/package.nix b/pkgs/by-name/un/unison-ucm/package.nix index 632b63287077..67a50d21f5ae 100644 --- a/pkgs/by-name/un/unison-ucm/package.nix +++ b/pkgs/by-name/un/unison-ucm/package.nix @@ -69,18 +69,20 @@ stdenv.mkDerivation (finalAttrs: { --set UCM_WEB_UI "$out/ui" ''; + passthru.updateScript = ./update.sh; + meta = { description = "Modern, statically-typed purely functional language"; homepage = "https://unisonweb.org/"; - license = with lib.licenses; [ - mit - bsd3 + license = [ + lib.licenses.mit + lib.licenses.bsd3 ]; mainProgram = "ucm"; - maintainers = with lib.maintainers; [ - ceedubs - sellout - virusdave + maintainers = [ + lib.maintainers.ceedubs + lib.maintainers.sellout + lib.maintainers.virusdave ]; platforms = [ "x86_64-darwin" @@ -88,6 +90,6 @@ stdenv.mkDerivation (finalAttrs: { "aarch64-darwin" "aarch64-linux" ]; - sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ]; + sourceProvenance = [ lib.sourceTypes.binaryNativeCode ]; }; }) diff --git a/pkgs/by-name/un/unison-ucm/update.sh b/pkgs/by-name/un/unison-ucm/update.sh new file mode 100755 index 000000000000..e840fbf9d779 --- /dev/null +++ b/pkgs/by-name/un/unison-ucm/update.sh @@ -0,0 +1,49 @@ +#!/usr/bin/env nix-shell +#!nix-shell -i bash -p curl jq gnused nix + +set -euo pipefail + +cd "$(dirname "${BASH_SOURCE[0]}")" + +owner="unisonweb" +repo="unison" +pname="unison-ucm" + +# Fetch latest version +latest_tag=$(curl -s "https://api.github.com/repos/$owner/$repo/releases/latest" | jq -r .tag_name) +version=${latest_tag#release/} + +current_version=$(sed -nE 's/\s*version = "(.*)";/\1/p' package.nix) + +if [[ "$version" == "$current_version" ]]; then + echo "$pname is already up-to-date" + exit 0 +fi + +echo "Updating $pname from $current_version to $version" + +# Update version in the file +sed -i "s/version = \"$current_version\";/version = \"$version\";/" package.nix + +# Define platforms and their corresponding URL suffixes +declare -A platforms=( + ["aarch64-darwin"]="ucm-macos-arm64.tar.gz" + ["x86_64-darwin"]="ucm-macos-x64.tar.gz" + ["aarch64-linux"]="ucm-linux-arm64.tar.gz" + ["x86_64-linux"]="ucm-linux-x64.tar.gz" +) + +for platform in "${!platforms[@]}"; do + filename="${platforms[$platform]}" + url="https://github.com/$owner/$repo/releases/download/release/$version/$filename" + + echo "Prefetching $url for $platform..." + hash=$(nix-prefetch-url "$url" --type sha256) + sri_hash=$(nix hash convert --hash-algo sha256 --to sri "$hash") + + # Replace the hash for the specific platform + # We look for the platform key, then the next hash line + sed -i "/$platform = fetchurl/,/hash =/ s|hash = \".*\";|hash = \"$sri_hash\";|" package.nix +done + +echo "Update complete." diff --git a/pkgs/by-name/wh/whatsapp-chat-exporter/package.nix b/pkgs/by-name/wh/whatsapp-chat-exporter/package.nix index e21a419b5206..33164edb834e 100644 --- a/pkgs/by-name/wh/whatsapp-chat-exporter/package.nix +++ b/pkgs/by-name/wh/whatsapp-chat-exporter/package.nix @@ -5,7 +5,7 @@ }: let - version = "0.12.0"; + version = "0.12.1"; in python3Packages.buildPythonApplication { pname = "whatsapp-chat-exporter"; @@ -16,7 +16,7 @@ python3Packages.buildPythonApplication { owner = "KnugiHK"; repo = "Whatsapp-Chat-Exporter"; tag = version; - hash = "sha256-0FJZqqmuSA+te5lzi1okkmuT3s2JNX7uHoYl9ayNt/Q="; + hash = "sha256-AyxRIjcAGjxCe0m2cSESQWd75v5tzpsCmb+3wChbH7c="; }; propagatedBuildInputs = with python3Packages; [ diff --git a/pkgs/by-name/za/zapret/package.nix b/pkgs/by-name/za/zapret/package.nix index 7a04d605c32d..e97a4bb8b532 100644 --- a/pkgs/by-name/za/zapret/package.nix +++ b/pkgs/by-name/za/zapret/package.nix @@ -67,9 +67,10 @@ stdenv.mkDerivation (finalAttrs: { cp -r $src/docs/* $out/usr/share/docs - mkdir -p $out/usr/share/zapret/{common,ipset} + mkdir -p $out/usr/share/zapret/{common,files/fake,ipset} cp $src/common/* $out/usr/share/zapret/common + cp $src/files/fake/* $out/usr/share/zapret/files/fake cp $src/ipset/* $out/usr/share/zapret/ipset rm -f $out/usr/share/zapret/ipset/zapret-hosts-user-exclude.txt.default diff --git a/pkgs/development/php-packages/luasandbox/default.nix b/pkgs/development/php-packages/luasandbox/default.nix index c6b436c8cf8a..1f6e937e5459 100644 --- a/pkgs/development/php-packages/luasandbox/default.nix +++ b/pkgs/development/php-packages/luasandbox/default.nix @@ -8,13 +8,13 @@ buildPecl rec { pname = "luasandbox"; - version = "4.1.2"; + version = "4.1.3"; src = fetchFromGitHub { owner = "wikimedia"; repo = "mediawiki-php-luasandbox"; tag = version; - hash = "sha256-HWObytoHBvxF9+QC62yJfi6MuHOOXFbSNkhuz5zWPCY="; + hash = "sha256-YQ7mxrAjtpYCThy0UPHlB0bkf86qpKqXxH4XV0hB+YU="; }; nativeBuildInputs = [ pkg-config ]; diff --git a/pkgs/development/python-modules/iamdata/default.nix b/pkgs/development/python-modules/iamdata/default.nix index 71c2bb933542..4958b9730c56 100644 --- a/pkgs/development/python-modules/iamdata/default.nix +++ b/pkgs/development/python-modules/iamdata/default.nix @@ -8,14 +8,14 @@ buildPythonPackage rec { pname = "iamdata"; - version = "0.1.202512211"; + version = "0.1.202512221"; pyproject = true; src = fetchFromGitHub { owner = "cloud-copilot"; repo = "iam-data-python"; tag = "v${version}"; - hash = "sha256-1gJoVSRbSjUOcRBKlW59S79aNYvuP6dy6377XT/wlFA="; + hash = "sha256-IEFEynR5gLS9kdIMlytK1XKOawsnxsT+vWvLGZ6yd5g="; }; __darwinAllowLocalNetworking = true; diff --git a/pkgs/development/python-modules/jupyter-collaboration/default.nix b/pkgs/development/python-modules/jupyter-collaboration/default.nix index 80f40ec97074..7535561c19c9 100644 --- a/pkgs/development/python-modules/jupyter-collaboration/default.nix +++ b/pkgs/development/python-modules/jupyter-collaboration/default.nix @@ -23,14 +23,14 @@ buildPythonPackage rec { pname = "jupyter-collaboration"; - version = "4.1.2"; + version = "4.2.0"; pyproject = true; src = fetchFromGitHub { owner = "jupyterlab"; repo = "jupyter-collaboration"; tag = "v${version}"; - hash = "sha256-/NFx76jqByPhzFKYFIcVctJv9+WQeuoUQaqNt+tUs8o="; + hash = "sha256-KXD5RRRh8cwZWZUpJrkS7RAfaeTjAHajKLl8c5MuhrA="; }; sourceRoot = "${src.name}/projects/jupyter-collaboration"; diff --git a/pkgs/development/python-modules/oelint-data/default.nix b/pkgs/development/python-modules/oelint-data/default.nix index d8173ba3e7ff..1ec87b3943bd 100644 --- a/pkgs/development/python-modules/oelint-data/default.nix +++ b/pkgs/development/python-modules/oelint-data/default.nix @@ -8,14 +8,14 @@ buildPythonPackage rec { pname = "oelint-data"; - version = "1.2.9"; + version = "1.2.10"; pyproject = true; src = fetchFromGitHub { owner = "priv-kweihmann"; repo = "oelint-data"; tag = version; - hash = "sha256-1BIW76qK4w1B5yAhmi3OJxLr+ctOAmjqBKuh6UKyCXM="; + hash = "sha256-9SxIslA/gfIe1lboWuK5/Ya7trMhVJokf7X3P0XyELE="; }; build-system = [ diff --git a/pkgs/development/python-modules/pypdf/default.nix b/pkgs/development/python-modules/pypdf/default.nix index e95e1b7f8170..8ef95974bdad 100644 --- a/pkgs/development/python-modules/pypdf/default.nix +++ b/pkgs/development/python-modules/pypdf/default.nix @@ -27,7 +27,7 @@ buildPythonPackage rec { pname = "pypdf"; - version = "6.4.0"; + version = "6.4.2"; pyproject = true; disabled = pythonOlder "3.8"; @@ -38,7 +38,7 @@ buildPythonPackage rec { tag = version; # fetch sample files used in tests fetchSubmodules = true; - hash = "sha256-QCMOB0qnxVPo8fGcf+TsEcBYYINXVbDCowrLUqNjojw="; + hash = "sha256-GkCNw7XvDPvLIiIUAgXsTLQ2OBbqhpf3xHQZpB/f2ys="; }; outputs = [ diff --git a/pkgs/development/python-modules/renault-api/default.nix b/pkgs/development/python-modules/renault-api/default.nix index c11eba5dd65e..6995d57601d2 100644 --- a/pkgs/development/python-modules/renault-api/default.nix +++ b/pkgs/development/python-modules/renault-api/default.nix @@ -19,14 +19,14 @@ buildPythonPackage rec { pname = "renault-api"; - version = "0.5.1"; + version = "0.5.2"; pyproject = true; src = fetchFromGitHub { owner = "hacf-fr"; repo = "renault-api"; tag = "v${version}"; - hash = "sha256-FH6x+hknNGgrSHaOt7RTYeuVLqb/DNy7X3065VvcFwA="; + hash = "sha256-7ZvUg2Dgu9hSG1VXDT+YC6PBbylsR4d12ZR66UrPlyE="; }; build-system = [ poetry-core ]; diff --git a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix index 65daebe28503..36c84ccc7fae 100644 --- a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix +++ b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix @@ -9,14 +9,14 @@ buildPythonPackage rec { pname = "tencentcloud-sdk-python"; - version = "3.1.15"; + version = "3.1.16"; pyproject = true; src = fetchFromGitHub { owner = "TencentCloud"; repo = "tencentcloud-sdk-python"; tag = version; - hash = "sha256-Q8AwLuS9+5j0EDQCHNpBJBaM3leHynwFGkBPOkzAh/g="; + hash = "sha256-DtYEBRKd3qH+ZJMWTALcVlRPBMs6mhr5fgxyTvdOofo="; }; build-system = [ setuptools ]; diff --git a/pkgs/development/python-modules/velbus-aio/default.nix b/pkgs/development/python-modules/velbus-aio/default.nix index cc67dbbb92bb..c269c46175be 100644 --- a/pkgs/development/python-modules/velbus-aio/default.nix +++ b/pkgs/development/python-modules/velbus-aio/default.nix @@ -16,14 +16,14 @@ buildPythonPackage rec { pname = "velbus-aio"; - version = "2025.11.0"; + version = "2025.12.0"; pyproject = true; src = fetchFromGitHub { owner = "Cereal2nd"; repo = "velbus-aio"; tag = version; - hash = "sha256-/sceaihRNMebcdQzNuZdH9uPibaG7UjvSP50kJ85L+Q="; + hash = "sha256-DmS5XvYUXGYLQWoXNlqsQ4tFsdWMqiJhHYokbuZT67c="; fetchSubmodules = true; }; diff --git a/pkgs/development/python-modules/whodap/default.nix b/pkgs/development/python-modules/whodap/default.nix index 1aa53ff63e27..51488677a3cb 100644 --- a/pkgs/development/python-modules/whodap/default.nix +++ b/pkgs/development/python-modules/whodap/default.nix @@ -4,25 +4,25 @@ fetchFromGitHub, pytest-asyncio, pytestCheckHook, - pythonOlder, httpx, + setuptools, }: buildPythonPackage rec { pname = "whodap"; - version = "0.1.13"; - format = "setuptools"; - - disabled = pythonOlder "3.8"; + version = "0.1.14"; + pyproject = true; src = fetchFromGitHub { owner = "pogzyb"; repo = "whodap"; - tag = version; + tag = "v${version}"; hash = "sha256-VSFtHjdG9pJAryGUgwI0NxxaW0JiXEHU7aVvXYxymtc="; }; - propagatedBuildInputs = [ httpx ]; + build-system = [ setuptools ]; + + dependencies = [ httpx ]; nativeCheckInputs = [ pytest-asyncio @@ -40,7 +40,7 @@ buildPythonPackage rec { description = "Python RDAP utility for querying and parsing information about domain names"; homepage = "https://github.com/pogzyb/whodap"; changelog = "https://github.com/pogzyb/whodap/releases/tag/${src.tag}"; - license = with lib.licenses; [ mit ]; + license = lib.licenses.mit; maintainers = with lib.maintainers; [ fab ]; }; } diff --git a/pkgs/os-specific/linux/evdi/default.nix b/pkgs/os-specific/linux/evdi/default.nix index 0782834818e4..cedb47da24e0 100644 --- a/pkgs/os-specific/linux/evdi/default.nix +++ b/pkgs/os-specific/linux/evdi/default.nix @@ -17,13 +17,13 @@ let in stdenv.mkDerivation (finalAttrs: { pname = "evdi"; - version = "1.14.11"; + version = "1.14.12"; src = fetchFromGitHub { owner = "DisplayLink"; repo = "evdi"; tag = "v${finalAttrs.version}"; - hash = "sha256-SxYUhu76vwgCQgjOYVpvdWsFpNcyzuSjZe3x/v566VU="; + hash = "sha256-J5unC9KTnbwTlBMi/sCAyxD3R18vb9bHK1NPU/0NHwM="; }; prePatch = '' diff --git a/pkgs/servers/home-assistant/custom-lovelace-modules/universal-remote-card/package.nix b/pkgs/servers/home-assistant/custom-lovelace-modules/universal-remote-card/package.nix index 4c8b456cabf8..77fdc9e6891e 100644 --- a/pkgs/servers/home-assistant/custom-lovelace-modules/universal-remote-card/package.nix +++ b/pkgs/servers/home-assistant/custom-lovelace-modules/universal-remote-card/package.nix @@ -6,18 +6,18 @@ buildNpmPackage rec { pname = "universal-remote-card"; - version = "4.9.2"; + version = "4.9.3"; src = fetchFromGitHub { owner = "Nerwyn"; repo = "android-tv-card"; rev = version; - hash = "sha256-ifFs+C42i8Iq1CLJIgJ1MRyNzVczDSAur2NJNWMjQSc="; + hash = "sha256-Xy2qtck1ZrB5y4SPkWC/JrSsoZciBdI7rm2HdakHu3I="; }; patches = [ ./dont-call-git.patch ]; - npmDepsHash = "sha256-4RpBYUBlKqogaiibbiUGK1pS3ZN5h9teKjqFJPMJiIY="; + npmDepsHash = "sha256-Js9HlQOQUFDU2wIe9JdXqkcKlsAgoE8/d74Zw+9iyN4="; installPhase = '' runHook preInstall diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix index 2fcda0b528da..e2faf7d790ef 100644 --- a/pkgs/top-level/aliases.nix +++ b/pkgs/top-level/aliases.nix @@ -814,6 +814,7 @@ mapAliases { kube3d = throw "'kube3d' has been renamed to/replaced by 'k3d'"; # Converted to throw 2025-10-27 kubei = throw "'kubei' has been renamed to/replaced by 'kubeclarity'"; # Converted to throw 2025-10-27 kubo-migrator-all-fs-repo-migrations = throw "'kubo-migrator-all-fs-repo-migrations' has been renamed to/replaced by 'kubo-fs-repo-migrations'"; # Converted to throw 2025-10-27 + kwm = throw "'kwm' has been removed since upstream is a 404"; # Added 2025-12-21 languageMachines.frog = frog; # Added 2025-10-7 languageMachines.frogdata = frogdata; # Added 2025-10-7 languageMachines.libfolia = libfolia; # Added 2025-10-7