diff --git a/.github/labeler.yml b/.github/labeler.yml index 9b4ae79ce188..d750cecdbe33 100644 --- a/.github/labeler.yml +++ b/.github/labeler.yml @@ -293,6 +293,7 @@ - any-glob-to-any-file: - nixos/**/* - pkgs/by-name/sw/switch-to-configuration-ng/**/* + - pkgs/by-name/ni/nixos-rebuild-ng/**/* - pkgs/os-specific/linux/nixos-rebuild/**/* "6.topic: nixos-container": diff --git a/ci/OWNERS b/ci/OWNERS index 4bb5e09c7f3a..979442de61be 100644 --- a/ci/OWNERS +++ b/ci/OWNERS @@ -143,6 +143,8 @@ nixos/modules/installer/tools/nix-fallback-paths.nix @NixOS/nix-team @raitobeza /nixos/tests/amazon-ssm-agent.nix @arianvp /nixos/modules/system/boot/grow-partition.nix @arianvp +# nixos-rebuild-ng +/pkgs/by-name/ni/nixos-rebuild-ng @thiagokokada # Updaters diff --git a/nixos/doc/manual/release-notes/rl-2505.section.md b/nixos/doc/manual/release-notes/rl-2505.section.md index 54d157600380..29af283010c9 100644 --- a/nixos/doc/manual/release-notes/rl-2505.section.md +++ b/nixos/doc/manual/release-notes/rl-2505.section.md @@ -1,24 +1,36 @@ -# Release 25.05 ("Warbler”, 2025.05/??) {#sec-release-25.05} - - +# Release 25.05 (“Warbler”, 2025.05/??) {#sec-release-25.05} ## Highlights {#sec-release-25.05-highlights} + + - Create the first release note entry in this section! + + ## New Modules {#sec-release-25.05-new-modules} + + - Create the first release note entry in this section! + + ## Backward Incompatibilities {#sec-release-25.05-incompatibilities} + + - `kanata` was updated to v1.7.0, which introduces several breaking changes. See the release notes of [v1.7.0](https://github.com/jtroo/kanata/releases/tag/v1.7.0) for more information. + + ## Other Notable Changes {#sec-release-25.05-notable-changes} + + - Create the first release note entry in this section! diff --git a/nixos/modules/services/security/aesmd.nix b/nixos/modules/services/security/aesmd.nix index 864d408c0220..4caeab4dea41 100644 --- a/nixos/modules/services/security/aesmd.nix +++ b/nixos/modules/services/security/aesmd.nix @@ -1,10 +1,12 @@ { config, options, pkgs, lib, ... }: -with lib; let + inherit (lib) concatStringsSep literalExpression makeLibraryPath mkEnableOption + mkForce mkIf mkOption mkPackageOption mkRemovedOptionModule optional types; + cfg = config.services.aesmd; opt = options.services.aesmd; - sgx-psw = pkgs.sgx-psw.override { inherit (cfg) debug; }; + sgx-psw = cfg.package; configFile = with cfg.settings; pkgs.writeText "aesmd.conf" ( concatStringsSep "\n" ( @@ -18,13 +20,17 @@ let ); in { + imports = [ + (mkRemovedOptionModule [ "debug" ] '' + Enable debug mode by overriding the aesmd package directly: + + services.aesmd.package = pkgs.sgx-psw.override { debug = true; }; + '') + ]; + options.services.aesmd = { enable = mkEnableOption "Intel's Architectural Enclave Service Manager (AESM) for Intel SGX"; - debug = mkOption { - type = types.bool; - default = false; - description = "Whether to build the PSW package in debug mode."; - }; + package = mkPackageOption pkgs "sgx-psw" { }; environment = mkOption { type = with types; attrsOf str; default = { }; @@ -126,7 +132,7 @@ in "|/dev/sgx_enclave" ]; - serviceConfig = rec { + serviceConfig = { ExecStartPre = pkgs.writeShellScript "copy-aesmd-data-files.sh" '' set -euo pipefail whiteListFile="${aesmDataFolder}/white_list_cert_to_be_verify.bin" diff --git a/nixos/tests/k3s/etcd.nix b/nixos/tests/k3s/etcd.nix index 2616ab02a609..7d9a7ba2b7d8 100644 --- a/nixos/tests/k3s/etcd.nix +++ b/nixos/tests/k3s/etcd.nix @@ -90,6 +90,9 @@ import ../make-test-python.nix ( with subtest("should wait for etcdctl endpoint status to succeed"): etcd.wait_until_succeeds("etcdctl endpoint status") + with subtest("should wait for etcdctl endpoint health to succeed"): + etcd.wait_until_succeeds("etcdctl endpoint health") + with subtest("should start k3s"): k3s.start() k3s.wait_for_unit("k3s") diff --git a/pkgs/applications/networking/cluster/k3s/1_30/chart-versions.nix b/pkgs/applications/networking/cluster/k3s/1_30/chart-versions.nix index aaaa3d4c2970..7f65917312ed 100644 --- a/pkgs/applications/networking/cluster/k3s/1_30/chart-versions.nix +++ b/pkgs/applications/networking/cluster/k3s/1_30/chart-versions.nix @@ -1,10 +1,10 @@ { traefik-crd = { - url = "https://k3s.io/k3s-charts/assets/traefik-crd/traefik-crd-25.0.3+up25.0.0.tgz"; - sha256 = "1z693i4kd3jyf26ccnb0sxjyxadipl6k13n7jyg5v4y93fv1rpdw"; + url = "https://k3s.io/k3s-charts/assets/traefik-crd/traefik-crd-27.0.201+up27.0.2.tgz"; + sha256 = "0vwprcb60y15sc4lmi58gl1zr3yhsq43jlbsfm7gs20ci90frv16"; }; traefik = { - url = "https://k3s.io/k3s-charts/assets/traefik/traefik-25.0.3+up25.0.0.tgz"; - sha256 = "1a24qlp7c6iri72ka1i37l1lzn13xibrd26dy295z2wzr55gg7if"; + url = "https://k3s.io/k3s-charts/assets/traefik/traefik-27.0.201+up27.0.2.tgz"; + sha256 = "12dp1r82qfzqfzs4sfxc54rnw8kv42a3w4gpk5v3qkhqm6fkrnn1"; }; } diff --git a/pkgs/applications/networking/cluster/k3s/1_30/images-versions.json b/pkgs/applications/networking/cluster/k3s/1_30/images-versions.json index 224938362c20..a5606a6ca4e3 100644 --- a/pkgs/applications/networking/cluster/k3s/1_30/images-versions.json +++ b/pkgs/applications/networking/cluster/k3s/1_30/images-versions.json @@ -1,18 +1,18 @@ { "airgap-images-amd64": { - "url": "https://github.com/k3s-io/k3s/releases/download/v1.30.5%2Bk3s1/k3s-airgap-images-amd64.tar.zst", - "sha256": "1fcdhhixxcbqxd8varz3vwz1qrkjpmxmwq74g14z7qafr7nqm757" + "url": "https://github.com/k3s-io/k3s/releases/download/v1.30.6%2Bk3s1/k3s-airgap-images-amd64.tar.zst", + "sha256": "02dpjxncil47ark7pim4gl32646y24a0lmsla153s6v3a89xp0iv" }, "airgap-images-arm": { - "url": "https://github.com/k3s-io/k3s/releases/download/v1.30.5%2Bk3s1/k3s-airgap-images-arm.tar.zst", - "sha256": "04d79m0lp8l53lgrpvhl6drn5jzdgjvaj32mcjq9y175f4knhiaw" + "url": "https://github.com/k3s-io/k3s/releases/download/v1.30.6%2Bk3s1/k3s-airgap-images-arm.tar.zst", + "sha256": "1v8vwgm6xd5iav02j7qk68nhmd6irb0q96c8mxjjxv1s97hcr7il" }, "airgap-images-arm64": { - "url": "https://github.com/k3s-io/k3s/releases/download/v1.30.5%2Bk3s1/k3s-airgap-images-arm64.tar.zst", - "sha256": "1grhh38x3mpj86fn487dfmhgdvbjf61mz8fg8sc9dcqhvpi8rr3w" + "url": "https://github.com/k3s-io/k3s/releases/download/v1.30.6%2Bk3s1/k3s-airgap-images-arm64.tar.zst", + "sha256": "0h4cqg023p184y8glbiddang4kmg4znxl4kgzam6jajdvklvjxsh" }, "images-list": { - "url": "https://github.com/k3s-io/k3s/releases/download/v1.30.5%2Bk3s1/k3s-images.txt", - "sha256": "1l71xhcj2z9fz3mn89iyyxznrgk59qgng549iq3zc8w3l0hl0qry" + "url": "https://github.com/k3s-io/k3s/releases/download/v1.30.6%2Bk3s1/k3s-images.txt", + "sha256": "05229bfg174pvy525dcy7rvmgv9i9v1nnz5ngq80n7zkxj9cp8m8" } } diff --git a/pkgs/applications/networking/cluster/k3s/1_30/versions.nix b/pkgs/applications/networking/cluster/k3s/1_30/versions.nix index 30c6ffe97db0..2002c69e181d 100644 --- a/pkgs/applications/networking/cluster/k3s/1_30/versions.nix +++ b/pkgs/applications/networking/cluster/k3s/1_30/versions.nix @@ -1,15 +1,15 @@ { - k3sVersion = "1.30.5+k3s1"; - k3sCommit = "9b586704a211264ca86b22f2a0b4617b00412235"; - k3sRepoSha256 = "1fzpkfbk2x9xw9js9ns15g84c7q93knwx7fdmdj4af3830kplnnr"; - k3sVendorHash = "sha256-fs9p6ywS5XCeJSF5ovDG40o+H4p4QmEJ0cvU5T9hwuA="; + k3sVersion = "1.30.6+k3s1"; + k3sCommit = "1829eaae5250b78e24816a9088b0244c0332b369"; + k3sRepoSha256 = "1p792g2sf6sfwkz9zj7s9zzb27z11s2g3lp0ww2k0srj4yg5llpk"; + k3sVendorHash = "sha256-YYe1jzmYKCPVEZUKXOVufbOU2nSMrplkVXztZTKlZDI="; chartVersions = import ./chart-versions.nix; imagesVersions = builtins.fromJSON (builtins.readFile ./images-versions.json); k3sRootVersion = "0.14.0"; k3sRootSha256 = "15cs9faw3jishsb5nhgmb5ldjc47hkwf7hz2126fp8ahf80m0fcl"; k3sCNIVersion = "1.5.1-k3s1"; k3sCNISha256 = "1bkz78p77aiw64hdvmlgc5zir9x8zha8qprfaab48jxbcsj3dfi7"; - containerdVersion = "1.7.21-k3s2"; - containerdSha256 = "0kp93fhmw2kiy46hw3ag05z8xwhw7kqp4wcbhsxshsdf0929g539"; + containerdVersion = "1.7.22-k3s1"; + containerdSha256 = "031rapiynpm7zlzn42l8z4m125lww2vyspw02irs4q3qb6mpx3px"; criCtlVersion = "1.29.0-k3s1"; } diff --git a/pkgs/applications/networking/cluster/k3s/1_31/chart-versions.nix b/pkgs/applications/networking/cluster/k3s/1_31/chart-versions.nix index aaaa3d4c2970..7f65917312ed 100644 --- a/pkgs/applications/networking/cluster/k3s/1_31/chart-versions.nix +++ b/pkgs/applications/networking/cluster/k3s/1_31/chart-versions.nix @@ -1,10 +1,10 @@ { traefik-crd = { - url = "https://k3s.io/k3s-charts/assets/traefik-crd/traefik-crd-25.0.3+up25.0.0.tgz"; - sha256 = "1z693i4kd3jyf26ccnb0sxjyxadipl6k13n7jyg5v4y93fv1rpdw"; + url = "https://k3s.io/k3s-charts/assets/traefik-crd/traefik-crd-27.0.201+up27.0.2.tgz"; + sha256 = "0vwprcb60y15sc4lmi58gl1zr3yhsq43jlbsfm7gs20ci90frv16"; }; traefik = { - url = "https://k3s.io/k3s-charts/assets/traefik/traefik-25.0.3+up25.0.0.tgz"; - sha256 = "1a24qlp7c6iri72ka1i37l1lzn13xibrd26dy295z2wzr55gg7if"; + url = "https://k3s.io/k3s-charts/assets/traefik/traefik-27.0.201+up27.0.2.tgz"; + sha256 = "12dp1r82qfzqfzs4sfxc54rnw8kv42a3w4gpk5v3qkhqm6fkrnn1"; }; } diff --git a/pkgs/applications/networking/cluster/k3s/1_31/images-versions.json b/pkgs/applications/networking/cluster/k3s/1_31/images-versions.json index afe4bedff9e4..dadd61aa1af9 100644 --- a/pkgs/applications/networking/cluster/k3s/1_31/images-versions.json +++ b/pkgs/applications/networking/cluster/k3s/1_31/images-versions.json @@ -1,18 +1,18 @@ { "airgap-images-amd64": { - "url": "https://github.com/k3s-io/k3s/releases/download/v1.31.1%2Bk3s1/k3s-airgap-images-amd64.tar.zst", - "sha256": "1hq8bj2hlzbq9rhpx9ifidfkrzy1pknizksq641kazl7kv44wldy" + "url": "https://github.com/k3s-io/k3s/releases/download/v1.31.2%2Bk3s1/k3s-airgap-images-amd64.tar.zst", + "sha256": "0dfixvnra0havzmrnabjhpzvkxfqb3jdd12cbfyd76ann6ijrxn1" }, "airgap-images-arm": { - "url": "https://github.com/k3s-io/k3s/releases/download/v1.31.1%2Bk3s1/k3s-airgap-images-arm.tar.zst", - "sha256": "1mp8k98mzzn7fpyqjyvia13v2jri37nn3fdqdq3gmxrbcqvkh15g" + "url": "https://github.com/k3s-io/k3s/releases/download/v1.31.2%2Bk3s1/k3s-airgap-images-arm.tar.zst", + "sha256": "06r6vifzd2dhx3md0i45cx2ynmzjgrd49iz09x1zissz223ic325" }, "airgap-images-arm64": { - "url": "https://github.com/k3s-io/k3s/releases/download/v1.31.1%2Bk3s1/k3s-airgap-images-arm64.tar.zst", - "sha256": "1gg30iln9grrw3qdwlqwcb0k1zafiwr2lj7vd64mmsm1fj057skw" + "url": "https://github.com/k3s-io/k3s/releases/download/v1.31.2%2Bk3s1/k3s-airgap-images-arm64.tar.zst", + "sha256": "11phgk5snb5ga1krm8nfssniarsd1pd3d4n59jzmjzwhznvq4v7n" }, "images-list": { - "url": "https://github.com/k3s-io/k3s/releases/download/v1.31.1%2Bk3s1/k3s-images.txt", - "sha256": "1l71xhcj2z9fz3mn89iyyxznrgk59qgng549iq3zc8w3l0hl0qry" + "url": "https://github.com/k3s-io/k3s/releases/download/v1.31.2%2Bk3s1/k3s-images.txt", + "sha256": "05229bfg174pvy525dcy7rvmgv9i9v1nnz5ngq80n7zkxj9cp8m8" } } diff --git a/pkgs/applications/networking/cluster/k3s/1_31/versions.nix b/pkgs/applications/networking/cluster/k3s/1_31/versions.nix index 98203d71ab2d..c74ca14810f5 100644 --- a/pkgs/applications/networking/cluster/k3s/1_31/versions.nix +++ b/pkgs/applications/networking/cluster/k3s/1_31/versions.nix @@ -1,15 +1,15 @@ { - k3sVersion = "1.31.1+k3s1"; - k3sCommit = "452dbbc14c747a0070fdf007ef2239a6e5d8d934"; - k3sRepoSha256 = "012j78bxhmjq7d0z0yzxzbvlhgzx9qi254cpk6s6mi3k60ay6bx2"; - k3sVendorHash = "sha256-CnfnyqrBQ9W1G6NORGSA5jB75Dvd1Hgu+KVITYrb6Mc="; + k3sVersion = "1.31.2+k3s1"; + k3sCommit = "6da204241bfd40220cb1af4cde35609e0c58df72"; + k3sRepoSha256 = "0n0sfvxnkz8d9prswmqd6paqisis05l0494znjy2y30418ql580x"; + k3sVendorHash = "sha256-SYIg/lYwIY/e0FQt59Ki4ROzhZ5HfJ03Hd0XE2LIIyc="; chartVersions = import ./chart-versions.nix; imagesVersions = builtins.fromJSON (builtins.readFile ./images-versions.json); k3sRootVersion = "0.14.0"; k3sRootSha256 = "15cs9faw3jishsb5nhgmb5ldjc47hkwf7hz2126fp8ahf80m0fcl"; k3sCNIVersion = "1.5.1-k3s1"; k3sCNISha256 = "1bkz78p77aiw64hdvmlgc5zir9x8zha8qprfaab48jxbcsj3dfi7"; - containerdVersion = "1.7.21-k3s2"; - containerdSha256 = "0kp93fhmw2kiy46hw3ag05z8xwhw7kqp4wcbhsxshsdf0929g539"; + containerdVersion = "1.7.22-k3s1"; + containerdSha256 = "031rapiynpm7zlzn42l8z4m125lww2vyspw02irs4q3qb6mpx3px"; criCtlVersion = "1.31.0-k3s2"; } diff --git a/pkgs/by-name/ez/eza/package.nix b/pkgs/by-name/ez/eza/package.nix index 9925e54a85b2..9a39ca1dc516 100644 --- a/pkgs/by-name/ez/eza/package.nix +++ b/pkgs/by-name/ez/eza/package.nix @@ -17,16 +17,16 @@ rustPlatform.buildRustPackage rec { pname = "eza"; - version = "0.20.7"; + version = "0.20.8"; src = fetchFromGitHub { owner = "eza-community"; repo = "eza"; rev = "v${version}"; - hash = "sha256-1yObVsCUGh2TwZesNNOseFR86oPh+w1q2knQkQ2vjLE="; + hash = "sha256-/YoSBjaKlubOqyOKtaykkh20beDHkwCAWarRlyitoOc="; }; - cargoHash = "sha256-k9zSchHFF2t30ca15eadEhnO0aFH5KIc1i0uuBKZZtc="; + cargoHash = "sha256-5vlVrrgJKObsAd/4Kspu7G3CPfOt6QpbZHgTTKrpuBs="; nativeBuildInputs = [ cmake pkg-config installShellFiles pandoc ]; buildInputs = [ zlib ] diff --git a/pkgs/by-name/gr/grafana-reporter/package.nix b/pkgs/by-name/gr/grafana-reporter/package.nix index c7cb567d5722..04a740d1bddb 100644 --- a/pkgs/by-name/gr/grafana-reporter/package.nix +++ b/pkgs/by-name/gr/grafana-reporter/package.nix @@ -1,8 +1,10 @@ -{ lib -, buildGoModule -, fetchFromGitHub -, tetex -, makeWrapper +{ + lib, + buildGoModule, + fetchFromGitHub, + fetchpatch2, + tetex, + makeWrapper, }: buildGoModule rec { pname = "reporter"; @@ -17,20 +19,21 @@ buildGoModule rec { nativeBuildInputs = [ makeWrapper ]; - vendorHash = null; + vendorHash = "sha256-QlNOx2jm1LVz066t9khppf//T5c9z3YUrSOr6qzbUzI="; - postPatch = '' - go mod init github.com/IzakMarais/reporter - ''; + patches = [ + (fetchpatch2 { + name = "use-go-mod-and-remove-vendor-dirs"; + url = "https://github.com/IzakMarais/reporter/commit/e844b3f624e0da3a960f98cade427fe54f595504.patch"; + hash = "sha256-CdI7/mkYG6t6H6ydGu7atwk18DpagdP7uzfrZVKKlhA="; + }) + ]; postInstall = '' wrapProgram $out/bin/grafana-reporter \ --prefix PATH : ${lib.makeBinPath [ tetex ]} ''; - # Testing library used had a breaking API change and upstream didn't adapt. - doCheck = false; - meta = { description = "PDF report generator from a Grafana dashboard"; mainProgram = "grafana-reporter"; diff --git a/pkgs/by-name/hc/hclfmt/package.nix b/pkgs/by-name/hc/hclfmt/package.nix index 12a1120dbea2..1ed93c4b69d7 100644 --- a/pkgs/by-name/hc/hclfmt/package.nix +++ b/pkgs/by-name/hc/hclfmt/package.nix @@ -2,13 +2,13 @@ buildGoModule rec { pname = "hclfmt"; - version = "2.22.0"; + version = "2.23.0"; src = fetchFromGitHub { owner = "hashicorp"; repo = "hcl"; rev = "v${version}"; - hash = "sha256-jIW2r8RWNbk4maWKeUSe1Kqll5jJYe72UCP2EEGfRYg="; + hash = "sha256-0RRvkOBPVrdbZo9zbVgZletKNXPBsN7pa7fsyfI9hXg="; }; vendorHash = "sha256-F2i7ph9GL9Xo43da6jHPn9P9FdWC6eSgqCyHPBxdFJY="; diff --git a/pkgs/by-name/jo/joincap/package.nix b/pkgs/by-name/jo/joincap/package.nix index c37226a6f327..53bb4c0017d4 100644 --- a/pkgs/by-name/jo/joincap/package.nix +++ b/pkgs/by-name/jo/joincap/package.nix @@ -1,25 +1,24 @@ -{ lib -, buildGoModule -, fetchFromGitHub -, libpcap +{ + lib, + buildGoModule, + fetchFromGitHub, + libpcap, }: buildGoModule rec { pname = "joincap"; - version = "0.10.2"; + version = "0.11.0"; src = fetchFromGitHub { owner = "assafmo"; repo = "joincap"; - rev = "v${version}"; - hash = "sha256-Xli9G/VkDWKkc+7mldmLfvigvPPcdcToc4e15uoadDQ="; + rev = "refs/tags/v${version}"; + hash = "sha256-HvqtAno26ZSggiXbQpkw5ghxCrmmLb5uDdeSQ2QVeq0="; }; - vendorHash = "sha256-YsLIbt3uiA1d08yIEhSRdep1+52AxRvbIzDHlhc5s7Y="; + vendorHash = "sha256-pIu/f7hpSUJG5az7sV9tlXJfIjVT37bTV49kTkR80ek="; - buildInputs = [ - libpcap - ]; + buildInputs = [ libpcap ]; ldflags = [ "-s" @@ -28,10 +27,10 @@ buildGoModule rec { meta = with lib; { description = "Merge multiple pcap files together, gracefully"; - mainProgram = "joincap"; homepage = "https://github.com/assafmo/joincap"; - changelog = "https://github.com/assafmo/joincap/blob/${version}/CHANGELOG.md"; + changelog = "https://github.com/assafmo/joincap/blob/v${version}/CHANGELOG.md"; license = licenses.mit; maintainers = with maintainers; [ fab ]; + mainProgram = "joincap"; }; } diff --git a/pkgs/by-name/ma/matrix-appservice-irc/package.nix b/pkgs/by-name/ma/matrix-appservice-irc/package.nix index c17f0fcec98f..75ef8d6e69d2 100644 --- a/pkgs/by-name/ma/matrix-appservice-irc/package.nix +++ b/pkgs/by-name/ma/matrix-appservice-irc/package.nix @@ -13,13 +13,13 @@ let pname = "matrix-appservice-irc"; - version = "3.0.2"; + version = "3.0.3"; src = fetchFromGitHub { owner = "matrix-org"; repo = pname; rev = "refs/tags/${version}"; - hash = "sha256-ugnFlvu5kkfTHPD44/F8OvGUx55VcHQvTS99T7Wc2fE="; + hash = "sha256-Uq1sd1ZXv1JGjvCXHxBsNKvmdjMf4y4MVlOnCas4u/w="; }; yarnOfflineCache = fetchYarnDeps { diff --git a/pkgs/by-name/ne/neovide/package.nix b/pkgs/by-name/ne/neovide/package.nix index d23f77669caa..f8a33a9a4597 100644 --- a/pkgs/by-name/ne/neovide/package.nix +++ b/pkgs/by-name/ne/neovide/package.nix @@ -1,27 +1,28 @@ -{ lib -, rustPlatform -, clangStdenv -, fetchFromGitHub -, linkFarm -, fetchgit -, runCommand -, gn -, neovim -, ninja -, makeWrapper -, pkg-config -, python3 -, removeReferencesTo -, apple-sdk_11 -, cctools -, SDL2 -, fontconfig -, xorg -, stdenv -, libglvnd -, libxkbcommon -, enableWayland ? stdenv.hostPlatform.isLinux -, wayland +{ + lib, + rustPlatform, + clangStdenv, + fetchFromGitHub, + linkFarm, + fetchgit, + runCommand, + gn, + neovim, + ninja, + makeWrapper, + pkg-config, + python3, + removeReferencesTo, + apple-sdk_11, + cctools, + SDL2, + fontconfig, + xorg, + stdenv, + libglvnd, + libxkbcommon, + enableWayland ? stdenv.hostPlatform.isLinux, + wayland, }: rustPlatform.buildRustPackage.override { stdenv = clangStdenv; } rec { @@ -47,27 +48,32 @@ rustPlatform.buildRustPackage.override { stdenv = clangStdenv; } rec { hash = "sha256-4l6ekAJy+pG27hBGT6A6LLRwbsyKinJf6PP6mMHwaAs="; }; # The externals for skia are taken from skia/DEPS - externals = linkFarm "skia-externals" (lib.mapAttrsToList - (name: value: { inherit name; path = fetchgit value; }) - (lib.importJSON ./skia-externals.json)); + externals = linkFarm "skia-externals" ( + lib.mapAttrsToList (name: value: { + inherit name; + path = fetchgit value; + }) (lib.importJSON ./skia-externals.json) + ); in runCommand "source" { } '' cp -R ${repo} $out chmod -R +w $out ln -s ${externals} $out/third_party/externals - '' - ; + ''; SKIA_GN_COMMAND = "${gn}/bin/gn"; SKIA_NINJA_COMMAND = "${ninja}/bin/ninja"; - nativeBuildInputs = [ - cctools.libtool - makeWrapper - pkg-config - python3 # skia - removeReferencesTo - ]; + nativeBuildInputs = + [ + makeWrapper + pkg-config + python3 # skia + removeReferencesTo + ] + ++ lib.optionals stdenv.hostPlatform.isDarwin [ + cctools.libtool + ]; nativeCheckInputs = [ neovim ]; @@ -77,16 +83,21 @@ rustPlatform.buildRustPackage.override { stdenv = clangStdenv; } rec { rustPlatform.bindgenHook ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ apple-sdk_11 ]; - postFixup = let - libPath = lib.makeLibraryPath ([ - libglvnd - libxkbcommon - xorg.libXcursor - xorg.libXext - xorg.libXrandr - xorg.libXi - ] ++ lib.optionals enableWayland [ wayland ]); - in '' + postFixup = + let + libPath = lib.makeLibraryPath ( + [ + libglvnd + libxkbcommon + xorg.libXcursor + xorg.libXext + xorg.libXrandr + xorg.libXi + ] + ++ lib.optionals enableWayland [ wayland ] + ); + in + '' # library skia embeds the path to its sources remove-references-to -t "$SKIA_SOURCE_DIR" \ $out/bin/neovide @@ -95,18 +106,20 @@ rustPlatform.buildRustPackage.override { stdenv = clangStdenv; } rec { --prefix LD_LIBRARY_PATH : ${libPath} ''; - postInstall = lib.optionalString stdenv.hostPlatform.isDarwin '' - mkdir -p $out/Applications - cp -r extra/osx/Neovide.app $out/Applications - ln -s $out/bin $out/Applications/Neovide.app/Contents/MacOS - '' + lib.optionalString stdenv.hostPlatform.isLinux '' - for n in 16x16 32x32 48x48 256x256; do - install -m444 -D "assets/neovide-$n.png" \ - "$out/share/icons/hicolor/$n/apps/neovide.png" - done - install -m444 -Dt $out/share/icons/hicolor/scalable/apps assets/neovide.svg - install -m444 -Dt $out/share/applications assets/neovide.desktop - ''; + postInstall = + lib.optionalString stdenv.hostPlatform.isDarwin '' + mkdir -p $out/Applications + cp -r extra/osx/Neovide.app $out/Applications + ln -s $out/bin $out/Applications/Neovide.app/Contents/MacOS + '' + + lib.optionalString stdenv.hostPlatform.isLinux '' + for n in 16x16 32x32 48x48 256x256; do + install -m444 -D "assets/neovide-$n.png" \ + "$out/share/icons/hicolor/$n/apps/neovide.png" + done + install -m444 -Dt $out/share/icons/hicolor/scalable/apps assets/neovide.svg + install -m444 -Dt $out/share/applications assets/neovide.desktop + ''; disallowedReferences = [ SKIA_SOURCE_DIR ]; diff --git a/pkgs/by-name/ne/nerd-font-patcher/package.nix b/pkgs/by-name/ne/nerd-font-patcher/package.nix index b4479f10309e..be4321cb37e0 100644 --- a/pkgs/by-name/ne/nerd-font-patcher/package.nix +++ b/pkgs/by-name/ne/nerd-font-patcher/package.nix @@ -2,11 +2,11 @@ python3Packages.buildPythonApplication rec { pname = "nerd-font-patcher"; - version = "3.1.1"; + version = "3.2.1"; src = fetchzip { url = "https://github.com/ryanoasis/nerd-fonts/releases/download/v${version}/FontPatcher.zip"; - sha256 = "sha256-H2dPUs6HVKJcjxy5xtz9nL3SSPXKQF3w30/0l7A0PeY="; + sha256 = "sha256-3s0vcRiNA/pQrViYMwU2nnkLUNUcqXja/jTWO49x3BU="; stripRoot = false; }; diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/README.md b/pkgs/by-name/ni/nixos-rebuild-ng/README.md new file mode 100644 index 000000000000..cc2419844ef8 --- /dev/null +++ b/pkgs/by-name/ni/nixos-rebuild-ng/README.md @@ -0,0 +1,99 @@ +# nixos-rebuild-ng + +Work-in-Progress rewrite of +[`nixos-rebuild`](https://github.com/NixOS/nixpkgs/blob/master/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh). + +## Why the rewrite? + +The current state of `nixos-rebuild` is dare: it is one of the most critical +piece of code we have in NixOS, but it has tons of issues: +- The code is written in Bash, and while this by itself is not necessary bad, + it means that it is difficult to do refactorings due to the lack of tooling + for the language +- The code itself is a hacky mess. Changing even one line of code can cause + issues that affects dozens of people +- Lack of proper testing (we do have some integration tests, but no unit tests + and coverage is probably pitiful) +- The code predates some of the improvements `nix` had over the years, e.g.: it + builds Flakes inside a temporary directory and read the resulting symlink + since the code seems to predate `--print-out-paths` flag + +Given all of those above, improvements in the `nixos-rebuild` are difficult to +do. A full rewrite is probably the easier way to improve the situation since +this can be done in a separate package that will not break anyone. So this is +an attempt of the rewrite. + +## Why Python? + +- It is the language of choice for many critical things inside `nixpkgs`, like + the `NixOSTest` and `systemd-boot-builder.py` activation scripts +- It is a language with great tooling, e.g.: `mypy` for type checking, `ruff` + for linting, `pytest` for unit testing +- It is a scripting language that fits well with the scope of this project +- Python's standard library is great and it means we will need a low number of + external dependencies for this project. For example, `nixos-rebuild` + currently depends in `jq` for JSON parsing, while Python has `json` in + standard library + +## Do's and Don'ts + +- Do: be as much of a drop-in replacement as possible +- Do: fix obvious bugs +- Do: improvements that are non-breaking +- Don't: change logic in breaking ways even if this would be an improvement + +## How to use + +```nix +{ pkgs, ... }: +{ + environment.systemPackages = [ pkgs.nixos-rebuild-ng ]; +} +``` + +And use `nixos-rebuild-ng` instead of `nixos-rebuild`. + +## Current caveats + +- For now we will install it in `nixos-rebuild-ng` path by default, to avoid + conflicting with the current `nixos-rebuild`. This means you can keep both in + your system at the same time, but it also means that a few things like bash + completion are broken right now (since it looks at `nixos-rebuild` binary) +- `_NIXOS_REBUILD_EXEC` is **not** implemented yet, so different from + `nixos-rebuild`, this will use the current version of `nixos-rebuild-ng` in + your `PATH` to build/set profile/switch, while `nixos-rebuild` builds the new + version (the one that will be switched) and re-exec to it instead. This means + that in case of bugs in `nixos-rebuild-ng`, the only way that you will get + them fixed is **after** you switch to a new version +- `nix` bootstrap is also **not** implemented yet, so this means that you will + eval with an old version of Nix instead of a newer one. This is unlikely to + cause issues, because the build will happen in the daemon anyway (that is + only changed after the switch), and unless you are using bleeding edge `nix` + features you will probably have zero problems here. You can basically think + that using `nixos-rebuild-ng` is similar to running `nixos-rebuild --fast` + right now +- Ignore any performance advantages of the rewrite right now, because of the 2 + caveats above +- `--target-host` and `--build-host` are not implemented yet and this is + probably the thing that will be most difficult to implement. Help here is + welcome +- Bugs in the profile manipulation can cause corruption of your profile that + may be difficult to fix, so right now I only recommend using + `nixos-rebuild-ng` if you are testing in a VM or in a filesystem with + snapshots like btrfs or ZFS. Those bugs are unlikely to be unfixable but the + errors can be difficult to understand. If you want to go anyway, + `nix-collect-garbage -d` and `nix store repair` are your friends + +## TODO + +- [ ] Remote host/builders (via SSH) +- [ ] Improve nix arguments handling (e.g.: `nixFlags` vs `copyFlags` in the + old `nixos-rebuild`) +- [ ] `_NIXOS_REBUILD_EXEC` +- [ ] Port `nixos-rebuild.passthru.tests` +- [ ] Change module system to allow easier opt-in, like + `system.switch.enableNg` for `switch-to-configuration-ng` +- [ ] Improve documentation +- [ ] `nixos-rebuild repl` (calling old `nixos-rebuild` for now) +- [ ] `nix` build/bootstrap +- [ ] Reduce build closure diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/package.nix b/pkgs/by-name/ni/nixos-rebuild-ng/package.nix new file mode 100644 index 000000000000..b97387c9cc5f --- /dev/null +++ b/pkgs/by-name/ni/nixos-rebuild-ng/package.nix @@ -0,0 +1,80 @@ +{ + lib, + installShellFiles, + nix, + nixos-rebuild, + python3, + withNgSuffix ? true, +}: +python3.pkgs.buildPythonApplication { + pname = "nixos-rebuild-ng"; + version = "0.0.0"; + src = ./src; + pyproject = true; + + build-system = with python3.pkgs; [ + setuptools + ]; + + dependencies = with python3.pkgs; [ + tabulate + types-tabulate + ]; + + nativeBuildInputs = [ + installShellFiles + ]; + + propagatedBuildInputs = [ + # Make sure that we use the Nix package we depend on, not something + # else from the PATH for nix-{env,instantiate,build}. This is + # important, because NixOS defaults the architecture of the rebuilt + # system to the architecture of the nix-* binaries used. So if on an + # amd64 system the user has an i686 Nix package in her PATH, then we + # would silently downgrade the whole system to be i686 NixOS on the + # next reboot. + # The binary will be included in the wrapper for Python. + nix + ]; + + preBuild = '' + substituteInPlace nixos_rebuild/__init__.py \ + --subst-var-by nixos_rebuild ${lib.getExe nixos-rebuild} + ''; + + postInstall = + '' + installManPage ${nixos-rebuild}/share/man/man8/nixos-rebuild.8 + + installShellCompletion \ + --bash ${nixos-rebuild}/share/bash-completion/completions/_nixos-rebuild + '' + + lib.optionalString withNgSuffix '' + mv $out/bin/nixos-rebuild $out/bin/nixos-rebuild-ng + ''; + + nativeCheckInputs = with python3.pkgs; [ + pytestCheckHook + mypy + ruff + ]; + + pytestFlagsArray = [ "-vv" ]; + + postCheck = '' + echo -e "\x1b[32m## run mypy\x1b[0m" + mypy nixos_rebuild tests + echo -e "\x1b[32m## run ruff\x1b[0m" + ruff check nixos_rebuild tests + echo -e "\x1b[32m## run ruff format\x1b[0m" + ruff format --check nixos_rebuild tests + ''; + + meta = { + description = "Rebuild your NixOS configuration and switch to it, on local hosts and remote"; + homepage = "https://github.com/NixOS/nixpkgs/tree/master/pkgs/by-name/ni/nixos-rebuild-ng"; + license = lib.licenses.mit; + maintainers = [ lib.maintainers.thiagokokada ]; + mainProgram = if withNgSuffix then "nixos-rebuild-ng" else "nixos-rebuild"; + }; +} diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py new file mode 100644 index 000000000000..e3e198292c42 --- /dev/null +++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py @@ -0,0 +1,222 @@ +from __future__ import annotations + +import argparse +import json +import os +import sys +from subprocess import run +from typing import assert_never + +from tabulate import tabulate + +from .models import Action, Flake, NRError, Profile +from .nix import ( + edit, + list_generations, + nixos_build, + nixos_build_flake, + rollback, + rollback_temporary_profile, + set_profile, + switch_to_configuration, + upgrade_channels, +) +from .utils import info + +VERBOSE = False + + +def parse_args(argv: list[str]) -> tuple[argparse.Namespace, list[str]]: + parser = argparse.ArgumentParser( + prog="nixos-rebuild", + description="Reconfigure a NixOS machine", + add_help=False, + allow_abbrev=False, + ) + parser.add_argument("--help", action="store_true") + parser.add_argument("--file", "-f") + parser.add_argument("--attr", "-A") + parser.add_argument("--flake", nargs="?", const=True) + parser.add_argument("--no-flake", dest="flake", action="store_false") + parser.add_argument("--install-bootloader", action="store_true") + # TODO: add deprecated=True in Python >=3.13 + parser.add_argument("--install-grub", action="store_true") + parser.add_argument("--profile-name", "-p", default="system") + parser.add_argument("--specialisation", "-c") + parser.add_argument("--rollback", action="store_true") + parser.add_argument("--upgrade", action="store_true") + parser.add_argument("--upgrade-all", action="store_true") + parser.add_argument("--json", action="store_true") + parser.add_argument("action", choices=Action.values(), nargs="?") + + args, remainder = parser.parse_known_args(argv[1:]) + + global VERBOSE + # Manually parse verbose flag since this is a nix flag that also affect + # the script + VERBOSE = any(v == "--verbose" or v.startswith("-v") for v in remainder) + + # https://github.com/NixOS/nixpkgs/blob/master/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh#L56 + if args.action == Action.DRY_RUN.value: + args.action = Action.DRY_BUILD.value + + if args.install_grub: + info( + f"{parser.prog}: warning: --install-grub deprecated, use --install-bootloader instead" + ) + args.install_bootloader = True + + if args.action == Action.EDIT.value and (args.file or args.attr): + parser.error("--file and --attr are not supported with 'edit'") + + if args.flake and (args.file or args.attr): + parser.error("--flake cannot be used with --file or --attr") + + if args.help or args.action is None: + r = run(["man", "8", "nixos-rebuild"], check=False) + parser.exit(r.returncode) + + return args, remainder + + +def execute(argv: list[str]) -> None: + args, nix_flags = parse_args(argv) + + profile = Profile.from_name(args.profile_name) + flake = Flake.from_arg(args.flake) + + if args.upgrade or args.upgrade_all: + upgrade_channels(bool(args.upgrade_all)) + + match action := Action(args.action): + case Action.SWITCH | Action.BOOT: + info("building the system configuration...") + if args.rollback: + path_to_config = rollback(profile) + elif flake: + path_to_config = nixos_build_flake( + "toplevel", + flake, + nix_flags, + no_link=True, + ) + set_profile(profile, path_to_config) + else: + path_to_config = nixos_build( + "system", + args.attr, + args.file, + nix_flags, + no_out_link=True, + ) + set_profile(profile, path_to_config) + switch_to_configuration( + path_to_config, + action, + specialisation=args.specialisation, + install_bootloader=args.install_bootloader, + ) + case Action.TEST | Action.BUILD | Action.DRY_BUILD | Action.DRY_ACTIVATE: + info("building the system configuration...") + dry_run = action == Action.DRY_BUILD + if args.rollback and action in (Action.TEST, Action.BUILD): + maybe_path_to_config = rollback_temporary_profile(profile) + if maybe_path_to_config: # kinda silly but this makes mypy happy + path_to_config = maybe_path_to_config + else: + raise NRError("could not find previous generation") + elif flake: + path_to_config = nixos_build_flake( + "toplevel", + flake, + nix_flags, + keep_going=True, + dry_run=dry_run, + ) + else: + path_to_config = nixos_build( + "system", + args.attr, + args.file, + nix_flags, + keep_going=True, + dry_run=dry_run, + ) + if action in (Action.TEST, Action.DRY_ACTIVATE): + switch_to_configuration( + path_to_config, + action, + specialisation=args.specialisation, + ) + case Action.BUILD_VM | Action.BUILD_VM_WITH_BOOTLOADER: + info("building the system configuration...") + attr = "vm" if action == Action.BUILD_VM else "vmWithBootLoader" + if flake: + path_to_config = nixos_build_flake( + attr, + flake, + nix_flags, + keep_going=True, + ) + else: + path_to_config = nixos_build( + attr, + args.attr, + args.file, + nix_flags, + keep_going=True, + ) + vm_path = next(path_to_config.glob("bin/run-*-vm"), "./result/bin/run-*-vm") + print(f"Done. The virtual machine can be started by running '{vm_path}'") + case Action.EDIT: + edit(flake, nix_flags) + case Action.DRY_RUN: + assert False, "DRY_RUN should be a DRY_BUILD alias" + case Action.LIST_GENERATIONS: + generations = list_generations(profile) + if args.json: + print(json.dumps(generations, indent=2)) + else: + headers = { + "generation": "Generation", + "date": "Build-date", + "nixosVersion": "NixOS version", + "kernelVersion": "Kernel", + "configurationRevision": "Configuration Revision", + "specialisations": "Specialisation", + "current": "Current", + } + # Not exactly the same format as legacy nixos-rebuild but close + # enough + table = tabulate( + generations, + headers=headers, + tablefmt="plain", + numalign="left", + stralign="left", + disable_numparse=True, + ) + print(table) + case Action.REPL: + # For now just redirect it to `nixos-rebuild` instead of + # duplicating the code + os.execv( + "@nixos_rebuild@", + argv, + ) + case _: + assert_never(action) + + +def main() -> None: + try: + execute(sys.argv) + except (Exception, KeyboardInterrupt) as ex: + if VERBOSE: + raise ex + else: + sys.exit(str(ex)) + + +if __name__ == "__main__": + main() diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/models.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/models.py new file mode 100644 index 000000000000..489c9ba3e796 --- /dev/null +++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/models.py @@ -0,0 +1,121 @@ +from __future__ import annotations + +import platform +import re +from dataclasses import dataclass +from enum import Enum +from pathlib import Path +from typing import Any, ClassVar, TypedDict, override + + +class NRError(Exception): + "nixos-rebuild general error." + + def __init__(self, message: str): + self.message = message + + @override + def __str__(self) -> str: + return f"error: {self.message}" + + +class Action(Enum): + SWITCH = "switch" + BOOT = "boot" + TEST = "test" + BUILD = "build" + EDIT = "edit" + REPL = "repl" + DRY_BUILD = "dry-build" + DRY_RUN = "dry-run" + DRY_ACTIVATE = "dry-activate" + BUILD_VM = "build-vm" + BUILD_VM_WITH_BOOTLOADER = "build-vm-with-bootloader" + LIST_GENERATIONS = "list-generations" + + @override + def __str__(self) -> str: + return self.value + + @staticmethod + def values() -> list[str]: + return [a.value for a in Action] + + +@dataclass(frozen=True) +class Flake: + path: Path + attr: str + _re: ClassVar[re.Pattern[str]] = re.compile( + r"^(?P[^\#]*)\#?(?P[^\#\"]*)$" + ) + + @override + def __str__(self) -> str: + return f"{self.path}#{self.attr}" + + @classmethod + def parse(cls, flake_str: str, hostname: str | None = None) -> Flake: + m = cls._re.match(flake_str) + assert m is not None, f"got no matches for {flake_str}" + attr = m.group("attr") + if not attr: + attr = f"nixosConfigurations.{hostname or "default"}" + else: + attr = f"nixosConfigurations.{attr}" + return Flake(Path(m.group("path")), attr) + + @classmethod + def from_arg(cls, flake_arg: Any) -> Flake | None: + hostname = platform.node() + match flake_arg: + case str(s): + return cls.parse(s, hostname) + case True: + return cls.parse(".", hostname) + case False: + return None + case _: + # Use /etc/nixos/flake.nix if it exists. + default_path = Path("/etc/nixos/flake.nix") + if default_path.exists(): + # It can be a symlink to the actual flake. + if default_path.is_symlink(): + default_path = default_path.readlink() + return cls.parse(str(default_path.parent), hostname) + else: + return None + + +@dataclass(frozen=True) +class Generation: + id: int + timestamp: str # we may want to have a proper timestamp type in future + current: bool + + +# camelCase since this will be used as output for `--json` flag +class GenerationJson(TypedDict): + generation: int + date: str + nixosVersion: str + kernelVersion: str + configurationRevision: str + specialisations: list[str] + current: bool + + +@dataclass(frozen=True) +class Profile: + name: str + path: Path + + @staticmethod + def from_name(name: str = "system") -> Profile: + match name: + case "system": + return Profile(name, Path("/nix/var/nix/profiles/system")) + case _: + path = Path("/nix/var/nix/profiles/system-profiles") / name + path.parent.mkdir(mode=0o755, parents=True, exist_ok=True) + return Profile(name, path) diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py new file mode 100644 index 000000000000..1197fb5abbf6 --- /dev/null +++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py @@ -0,0 +1,282 @@ +from __future__ import annotations + +import os +from datetime import datetime +from pathlib import Path +from subprocess import PIPE, CalledProcessError, run +from typing import Final + +from .models import ( + Action, + Flake, + Generation, + GenerationJson, + NRError, + Profile, +) +from .utils import dict_to_flags + +FLAKE_FLAGS: Final = ["--extra-experimental-features", "nix-command flakes"] + + +def edit(flake: Flake | None, nix_flags: list[str] | None = None) -> None: + "Try to find and open NixOS configuration file in editor." + if flake: + run( + ["nix", *FLAKE_FLAGS, "edit", *(nix_flags or []), "--", str(flake)], + check=False, + ) + else: + if nix_flags: + raise NRError("'edit' does not support extra Nix flags") + nixos_config = Path( + os.getenv("NIXOS_CONFIG") + or run( + ["nix-instantiate", "--find-file", "nixos-config"], + text=True, + stdout=PIPE, + check=False, + ).stdout.strip() + or "/etc/nixos/default.nix" + ) + if nixos_config.is_dir(): + nixos_config /= "default.nix" + + if nixos_config.exists(): + run([os.getenv("EDITOR", "nano"), nixos_config], check=False) + else: + raise NRError("cannot find NixOS config file") + + +def _parse_generation_from_nix_store(path: Path, profile: Profile) -> Generation: + entry_id = path.name.split("-")[1] + current = path.name == profile.path.readlink().name + timestamp = datetime.fromtimestamp(path.stat().st_ctime).strftime( + "%Y-%m-%d %H:%M:%S" + ) + + return Generation( + id=int(entry_id), + timestamp=timestamp, + current=current, + ) + + +def _parse_generation_from_nix_env(line: str) -> Generation: + parts = line.split() + + entry_id = parts[0] + timestamp = f"{parts[1]} {parts[2]}" + current = "(current)" in parts + + return Generation( + id=int(entry_id), + timestamp=timestamp, + current=current, + ) + + +def get_generations(profile: Profile, lock_profile: bool = False) -> list[Generation]: + """Get all NixOS generations from profile. + + Includes generation ID (e.g.: 1, 2), timestamp (e.g.: when it was created) + and if this is the current active profile or not. + + If `lock_profile = True` this command will need root to run successfully. + """ + if not profile.path.exists(): + raise NRError(f"no profile '{profile.name}' found") + + result = [] + if lock_profile: + # Using `nix-env --list-generations` needs root to lock the profile + # TODO: do we actually need to lock profile for e.g.: rollback? + # https://github.com/NixOS/nix/issues/5144 + r = run( + ["nix-env", "-p", profile.path, "--list-generations"], + text=True, + stdout=True, + check=True, + ) + for line in r.stdout.splitlines(): + result.append(_parse_generation_from_nix_env(line)) + else: + for p in profile.path.parent.glob("system-*-link"): + result.append(_parse_generation_from_nix_store(p, profile)) + return sorted(result, key=lambda d: d.id) + + +def list_generations(profile: Profile) -> list[GenerationJson]: + """Get all NixOS generations from profile, including extra information. + + Includes OS information like the commit, kernel version, configuration + revision and specialisations. + + Will be formatted in a way that is expected by the output of + `nixos-rebuild list-generations --json`. + """ + generations = get_generations(profile) + result = [] + for generation in reversed(generations): + generation_path = ( + profile.path.parent / f"{profile.path.name}-{generation.id}-link" + ) + try: + nixos_version = (generation_path / "nixos-version").read_text().strip() + except IOError: + nixos_version = "Unknown" + try: + kernel_version = next( + (generation_path / "kernel-modules/lib/modules").iterdir() + ).name + except IOError: + kernel_version = "Unknown" + specialisations = [ + s.name for s in (generation_path / "specialisation").glob("*") if s.is_dir() + ] + try: + configuration_revision = run( + [generation_path / "sw/bin/nixos-version", "--configuration-revision"], + capture_output=True, + check=True, + text=True, + ).stdout.strip() + except (CalledProcessError, IOError): + configuration_revision = "Unknown" + + result.append( + GenerationJson( + generation=generation.id, + date=generation.timestamp, + nixosVersion=nixos_version, + kernelVersion=kernel_version, + configurationRevision=configuration_revision, + specialisations=specialisations, + current=generation.current, + ) + ) + + return result + + +def nixos_build( + attr: str, + pre_attr: str | None, + file: str | None, + nix_flags: list[str] | None = None, + **kwargs: bool | str, +) -> Path: + """Build NixOS attribute using classic Nix. + + It will by default build `` with `attr`, however it + optionally supports building from an external file and custom attributes + paths. + + Returns the built attribute as path. + """ + if pre_attr or file: + run_args = [ + "nix-build", + file or "default.nix", + "--attr", + f"{'.'.join(x for x in [pre_attr, attr] if x)}", + ] + else: + run_args = ["nix-build", "", "--attr", attr] + run_args += dict_to_flags(kwargs) + (nix_flags or []) + r = run(run_args, check=True, text=True, stdout=PIPE) + return Path(r.stdout.strip()) + + +def nixos_build_flake( + attr: str, + flake: Flake, + nix_flags: list[str] | None = None, + **kwargs: bool | str, +) -> Path: + """Build NixOS attribute using Flakes. + + Returns the built attribute as path. + """ + run_args = [ + "nix", + *FLAKE_FLAGS, + "build", + "--print-out-paths", + f"{flake}.config.system.build.{attr}", + ] + run_args += dict_to_flags(kwargs) + (nix_flags or []) + r = run(run_args, check=True, text=True, stdout=PIPE) + return Path(r.stdout.strip()) + + +def rollback(profile: Profile) -> Path: + "Rollback Nix profile, like one created by `nixos-rebuild switch`." + run(["nix-env", "--rollback", "-p", profile.path], check=True) + # Rollback config PATH is the own profile + return profile.path + + +def rollback_temporary_profile(profile: Profile) -> Path | None: + "Rollback a temporary Nix profile, like one created by `nixos-rebuild test`." + generations = get_generations(profile, lock_profile=True) + previous_gen_id = None + for generation in generations: + if not generation.current: + previous_gen_id = generation.id + + if previous_gen_id: + return profile.path.parent / f"{profile.name}-{previous_gen_id}-link" + else: + return None + + +def set_profile(profile: Profile, path_to_config: Path) -> None: + "Set a path as the current active Nix profile." + run(["nix-env", "-p", profile.path, "--set", path_to_config], check=True) + + +def switch_to_configuration( + path_to_config: Path, + action: Action, + install_bootloader: bool = False, + specialisation: str | None = None, +) -> None: + """Call `/bin/switch-to-configuration `. + + Expects a built path to run, like one generated with `nixos_build` or + `nixos_build_flake` functions. + """ + if specialisation: + if action not in (Action.SWITCH, Action.TEST): + raise NRError( + "'--specialisation' can only be used with 'switch' and 'test'" + ) + path_to_config = path_to_config / f"specialisation/{specialisation}" + + if not path_to_config.exists(): + raise NRError(f"specialisation not found: {specialisation}") + + run( + [path_to_config / "bin/switch-to-configuration", str(action)], + env={ + "NIXOS_INSTALL_BOOTLOADER": "1" if install_bootloader else "0", + "LOCALE_ARCHIVE": os.getenv("LOCALE_ARCHIVE", ""), + }, + check=True, + ) + + +def upgrade_channels(all: bool = False) -> None: + """Upgrade channels for classic Nix. + + It will either upgrade just the `nixos` channel (including any channel + that has a `.update-on-nixos-rebuild` file) or all. + """ + for channel_path in Path("/nix/var/nix/profiles/per-user/root/channels/").glob("*"): + if ( + all + or channel_path.name == "nixos" + or (channel_path / ".update-on-nixos-rebuild").exists() + ): + run(["nix-channel", "--update", channel_path.name], check=False) diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/utils.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/utils.py new file mode 100644 index 000000000000..1cc210c3005a --- /dev/null +++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/utils.py @@ -0,0 +1,28 @@ +from __future__ import annotations + +import sys +from functools import partial +from typing import Any + +info = partial(print, file=sys.stderr) + + +def dict_to_flags(d: dict[str, Any]) -> list[str]: + flags = [] + for key, value in d.items(): + flag = f"--{'-'.join(key.split('_'))}" + match value: + case None | False: + pass + case True: + flags.append(flag) + case int(): + flags.append(f"-{key[0] * value}") + case str(): + flags.append(flag) + flags.append(value) + case list(): + flags.append(flag) + for v in value: + flags.append(v) + return flags diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/pyproject.toml b/pkgs/by-name/ni/nixos-rebuild-ng/src/pyproject.toml new file mode 100644 index 000000000000..457bcfe011b6 --- /dev/null +++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/pyproject.toml @@ -0,0 +1,51 @@ +[build-system] +requires = ["setuptools"] +build-backend = "setuptools.build_meta" + +[project] +name = "nixos-rebuild-ng" +version = "0.0.0" + +[project.scripts] +nixos-rebuild = "nixos_rebuild:main" + +[tool.mypy] +# `--strict` config, but explicit options to avoid breaking build when mypy is +# updated +warn_unused_configs = true +disallow_any_generics = true +disallow_subclassing_any = true +disallow_untyped_calls = true +disallow_untyped_defs = true +disallow_incomplete_defs = true +check_untyped_defs = true +disallow_untyped_decorators = true +warn_redundant_casts = true +warn_unused_ignores = true +warn_return_any = true +# no_implicit_reexport = true +strict_equality = true +extra_checks = true + +# extra options not included in `--strict` +enable_error_code = ["explicit-override", "mutable-override"] + +[[tool.mypy.overrides]] +module = "pytest.*" +ignore_missing_imports = true + +[tool.ruff.lint] +extend-select = [ + # ensure imports are sorted + "I", + # require 'from __future__ import annotations' + "FA102", + # require `check` argument for `subprocess.run` + "PLW1510", +] + +[tool.ruff.lint.per-file-ignores] +"tests/" = ["FA102"] + +[tool.pytest.ini_options] +addopts = ["--import-mode=importlib"] diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/__init__.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/__init__.py new file mode 100644 index 000000000000..e69de29bb2d1 diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/helpers.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/helpers.py new file mode 100644 index 000000000000..0474c6671edd --- /dev/null +++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/helpers.py @@ -0,0 +1,13 @@ +from __future__ import annotations + +from types import ModuleType +from typing import Any, Callable + + +def get_qualified_name( + method: Callable[..., Any], + module: ModuleType | None = None, +) -> str: + module_name = getattr(module, "__name__", method.__module__) + method_name = getattr(method, "__qualname__", method.__name__) + return f"{module_name}.{method_name}" diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_main.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_main.py new file mode 100644 index 000000000000..03dcf684e734 --- /dev/null +++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_main.py @@ -0,0 +1,270 @@ +import textwrap +from pathlib import Path +from subprocess import PIPE, CompletedProcess +from typing import Any +from unittest.mock import call, patch + +import pytest + +import nixos_rebuild as nr + +from .helpers import get_qualified_name + + +@pytest.fixture(autouse=True) +def setup(monkeypatch: Any) -> None: + monkeypatch.setenv("LOCALE_ARCHIVE", "/locale") + + +def test_parse_args() -> None: + with pytest.raises(SystemExit) as e: + nr.parse_args(["nixos-rebuild", "unknown-action"]) + assert e.value.code == 2 + + with pytest.raises(SystemExit) as e: + nr.parse_args(["nixos-rebuild", "test", "--flake", "--file", "abc"]) + assert e.value.code == 2 + + with pytest.raises(SystemExit) as e: + nr.parse_args(["nixos-rebuild", "edit", "--attr", "attr"]) + assert e.value.code == 2 + + r1, remainder = nr.parse_args( + [ + "nixos-rebuild", + "switch", + "--install-grub", + "--flake", + "/etc/nixos", + "--extra", + "flag", + ] + ) + assert remainder == ["--extra", "flag"] + assert r1.flake == "/etc/nixos" + assert r1.install_bootloader is True + assert r1.install_grub is True + assert r1.profile_name == "system" + assert r1.action == "switch" + + r2, remainder = nr.parse_args( + [ + "nixos-rebuild", + "dry-run", + "--flake", + "--no-flake", + "-f", + "foo", + "--attr", + "bar", + ] + ) + assert remainder == [] + assert r2.flake is False + assert r2.action == "dry-build" + assert r2.file == "foo" + assert r2.attr == "bar" + + +@patch(get_qualified_name(nr.nix.run, nr.nix), autospec=True) +def test_execute_nix_boot(mock_run: Any, tmp_path: Path) -> None: + config_path = tmp_path / "test" + config_path.touch() + mock_run.side_effect = [ + # nixos_build + CompletedProcess([], 0, str(config_path)), + # set_profile + CompletedProcess([], 0), + # switch_to_configuration + CompletedProcess([], 0), + ] + + nr.execute(["nixos-rebuild", "boot", "--no-flake", "-vvv"]) + + assert nr.VERBOSE is True + assert mock_run.call_count == 3 + mock_run.assert_has_calls( + [ + call( + [ + "nix-build", + "", + "--attr", + "system", + "--no-out-link", + "-vvv", + ], + check=True, + text=True, + stdout=PIPE, + ), + call( + [ + "nix-env", + "-p", + Path("/nix/var/nix/profiles/system"), + "--set", + config_path, + ], + check=True, + ), + call( + [config_path / "bin/switch-to-configuration", "boot"], + env={"NIXOS_INSTALL_BOOTLOADER": "0", "LOCALE_ARCHIVE": "/locale"}, + check=True, + ), + ] + ) + + +@patch(get_qualified_name(nr.nix.run, nr.nix), autospec=True) +def test_execute_nix_switch_flake(mock_run: Any, tmp_path: Path) -> None: + config_path = tmp_path / "test" + config_path.touch() + mock_run.side_effect = [ + # nixos_build_flake + CompletedProcess([], 0, str(config_path)), + # set_profile + CompletedProcess([], 0), + # switch_to_configuration + CompletedProcess([], 0), + ] + + nr.execute( + [ + "nixos-rebuild", + "switch", + "--flake", + "/path/to/config#hostname", + "--install-bootloader", + "--verbose", + ] + ) + + assert nr.VERBOSE is True + assert mock_run.call_count == 3 + mock_run.assert_has_calls( + [ + call( + [ + "nix", + "--extra-experimental-features", + "nix-command flakes", + "build", + "--print-out-paths", + "/path/to/config#nixosConfigurations.hostname.config.system.build.toplevel", + "--no-link", + "--verbose", + ], + check=True, + text=True, + stdout=PIPE, + ), + call( + [ + "nix-env", + "-p", + Path("/nix/var/nix/profiles/system"), + "--set", + config_path, + ], + check=True, + ), + call( + [config_path / "bin/switch-to-configuration", "switch"], + env={"NIXOS_INSTALL_BOOTLOADER": "1", "LOCALE_ARCHIVE": "/locale"}, + check=True, + ), + ] + ) + + +@patch(get_qualified_name(nr.nix.run, nr.nix), autospec=True) +def test_execute_switch_rollback(mock_run: Any) -> None: + nr.execute(["nixos-rebuild", "switch", "--rollback", "--install-bootloader"]) + + assert nr.VERBOSE is False + assert mock_run.call_count == 2 + mock_run.assert_has_calls( + [ + call( + [ + "nix-env", + "--rollback", + "-p", + Path("/nix/var/nix/profiles/system"), + ], + check=True, + ), + call( + [ + Path("/nix/var/nix/profiles/system/bin/switch-to-configuration"), + "switch", + ], + env={"NIXOS_INSTALL_BOOTLOADER": "1", "LOCALE_ARCHIVE": "/locale"}, + check=True, + ), + ] + ) + + +@patch(get_qualified_name(nr.nix.run, nr.nix), autospec=True) +@patch(get_qualified_name(nr.nix.Path.exists, nr.nix), autospec=True, return_value=True) +@patch(get_qualified_name(nr.nix.Path.mkdir, nr.nix), autospec=True) +def test_execute_test_rollback( + mock_path_mkdir: Any, + mock_path_exists: Any, + mock_run: Any, +) -> None: + mock_run.side_effect = [ + # rollback_temporary_profile + CompletedProcess( + [], + 0, + stdout=textwrap.dedent("""\ + 2082 2024-11-07 22:58:56 + 2083 2024-11-07 22:59:41 + 2084 2024-11-07 23:54:17 (current) + """), + ), + # switch_to_configuration + CompletedProcess([], 0), + ] + + nr.execute( + [ + "nixos-rebuild", + "test", + "--rollback", + "--profile-name", + "foo", + ] + ) + + assert nr.VERBOSE is False + assert mock_run.call_count == 2 + mock_run.assert_has_calls( + [ + call( + [ + "nix-env", + "-p", + Path("/nix/var/nix/profiles/system-profiles/foo"), + "--list-generations", + ], + text=True, + stdout=True, + check=True, + ), + call( + [ + Path( + "/nix/var/nix/profiles/system-profiles/foo-2083-link/bin/switch-to-configuration" + ), + "test", + ], + env={"NIXOS_INSTALL_BOOTLOADER": "0", "LOCALE_ARCHIVE": "/locale"}, + check=True, + ), + ] + ) diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_models.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_models.py new file mode 100644 index 000000000000..cd3a19beb789 --- /dev/null +++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_models.py @@ -0,0 +1,100 @@ +import platform +from pathlib import Path +from typing import Any +from unittest.mock import patch + +from nixos_rebuild import models as m + +from .helpers import get_qualified_name + + +def test_flake_parse() -> None: + assert m.Flake.parse("/path/to/flake#attr") == m.Flake( + Path("/path/to/flake"), "nixosConfigurations.attr" + ) + assert m.Flake.parse("/path/ to /flake", "hostname") == m.Flake( + Path("/path/ to /flake"), "nixosConfigurations.hostname" + ) + assert m.Flake.parse("/path/to/flake", "hostname") == m.Flake( + Path("/path/to/flake"), "nixosConfigurations.hostname" + ) + assert m.Flake.parse(".#attr") == m.Flake(Path("."), "nixosConfigurations.attr") + assert m.Flake.parse("#attr") == m.Flake(Path("."), "nixosConfigurations.attr") + assert m.Flake.parse(".", None) == m.Flake(Path("."), "nixosConfigurations.default") + assert m.Flake.parse("", "") == m.Flake(Path("."), "nixosConfigurations.default") + + +@patch(get_qualified_name(platform.node), autospec=True) +def test_flake_from_arg(mock_node: Any) -> None: + mock_node.return_value = "hostname" + + # Flake string + assert m.Flake.from_arg("/path/to/flake#attr") == m.Flake( + Path("/path/to/flake"), "nixosConfigurations.attr" + ) + + # False + assert m.Flake.from_arg(False) is None + + # True + assert m.Flake.from_arg(True) == m.Flake(Path("."), "nixosConfigurations.hostname") + + # None when we do not have /etc/nixos/flake.nix + with patch( + get_qualified_name(m.Path.exists, m), + autospec=True, + return_value=False, + ): + assert m.Flake.from_arg(None) is None + + # None when we have a file in /etc/nixos/flake.nix + with ( + patch( + get_qualified_name(m.Path.exists, m), + autospec=True, + return_value=True, + ), + patch( + get_qualified_name(m.Path.is_symlink, m), + autospec=True, + return_value=False, + ), + ): + assert m.Flake.from_arg(None) == m.Flake( + Path("/etc/nixos"), "nixosConfigurations.hostname" + ) + + with ( + patch( + get_qualified_name(m.Path.exists, m), + autospec=True, + return_value=True, + ), + patch( + get_qualified_name(m.Path.is_symlink, m), + autospec=True, + return_value=True, + ), + patch( + get_qualified_name(m.Path.readlink, m), + autospec=True, + return_value=Path("/path/to/flake.nix"), + ), + ): + assert m.Flake.from_arg(None) == m.Flake( + Path("/path/to"), "nixosConfigurations.hostname" + ) + + +@patch(get_qualified_name(m.Path.mkdir, m), autospec=True) +def test_profile_from_name(mock_mkdir: Any) -> None: + assert m.Profile.from_name("system") == m.Profile( + "system", + Path("/nix/var/nix/profiles/system"), + ) + + assert m.Profile.from_name("something") == m.Profile( + "something", + Path("/nix/var/nix/profiles/system-profiles/something"), + ) + mock_mkdir.assert_called_once() diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py new file mode 100644 index 000000000000..8b145bfc8305 --- /dev/null +++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py @@ -0,0 +1,327 @@ +import textwrap +from pathlib import Path +from subprocess import PIPE, CompletedProcess +from typing import Any +from unittest.mock import ANY, call, patch + +import pytest + +import nixos_rebuild.nix as n +from nixos_rebuild import models as m + +from .helpers import get_qualified_name + + +@patch(get_qualified_name(n.run, n), autospec=True) +def test_edit(mock_run: Any, monkeypatch: Any, tmpdir: Any) -> None: + # Flake + flake = m.Flake.parse(".#attr") + n.edit(flake, ["--commit-lock-file"]) + mock_run.assert_called_with( + [ + "nix", + "--extra-experimental-features", + "nix-command flakes", + "edit", + "--commit-lock-file", + "--", + ".#nixosConfigurations.attr", + ], + check=False, + ) + + # Classic + with monkeypatch.context() as mp: + default_nix = tmpdir.join("default.nix") + default_nix.write("{}") + + mp.setenv("NIXOS_CONFIG", str(tmpdir)) + mp.setenv("EDITOR", "editor") + + n.edit(None) + mock_run.assert_called_with(["editor", default_nix], check=False) + + +def test_get_generations_from_nix_store(tmp_path: Path) -> None: + nixos_path = tmp_path / "nixos-system" + nixos_path.mkdir() + + (tmp_path / "system").symlink_to(tmp_path / "system-2-link") + # In the "wrong" order on purpose to make sure we are sorting the results + (tmp_path / "system-1-link").symlink_to(nixos_path) + (tmp_path / "system-3-link").symlink_to(nixos_path) + (tmp_path / "system-2-link").symlink_to(nixos_path) + + assert n.get_generations( + m.Profile("system", tmp_path / "system"), + lock_profile=False, + ) == [ + m.Generation(id=1, current=False, timestamp=ANY), + m.Generation(id=2, current=True, timestamp=ANY), + m.Generation(id=3, current=False, timestamp=ANY), + ] + + +@patch( + get_qualified_name(n.run, n), + autospec=True, + return_value=CompletedProcess( + [], + 0, + stdout=textwrap.dedent("""\ + 2082 2024-11-07 22:58:56 + 2083 2024-11-07 22:59:41 + 2084 2024-11-07 23:54:17 (current) + """), + ), +) +def test_get_generations_from_nix_env(mock_run: Any, tmp_path: Path) -> None: + path = tmp_path / "test" + path.touch() + + assert n.get_generations(m.Profile("system", path), lock_profile=True) == [ + m.Generation(id=2082, current=False, timestamp="2024-11-07 22:58:56"), + m.Generation(id=2083, current=False, timestamp="2024-11-07 22:59:41"), + m.Generation(id=2084, current=True, timestamp="2024-11-07 23:54:17"), + ] + + +@patch( + get_qualified_name(n.get_generations), + autospec=True, + return_value=[ + m.Generation( + id=1, + timestamp="2024-11-07 23:54:17", + current=False, + ), + m.Generation( + id=2, + timestamp="2024-11-07 23:54:17", + current=True, + ), + ], +) +def test_list_generations(mock_get_generations: Any, tmp_path: Path) -> None: + # Probably better to test this function in a real system, this test is + # mostly to make sure it doesn't break horribly + assert n.list_generations(m.Profile("system", tmp_path)) == [ + { + "configurationRevision": "Unknown", + "current": True, + "date": "2024-11-07 23:54:17", + "generation": 2, + "kernelVersion": "Unknown", + "nixosVersion": "Unknown", + "specialisations": [], + }, + { + "configurationRevision": "Unknown", + "current": False, + "date": "2024-11-07 23:54:17", + "generation": 1, + "kernelVersion": "Unknown", + "nixosVersion": "Unknown", + "specialisations": [], + }, + ] + + +@patch( + get_qualified_name(n.run, n), + autospec=True, + return_value=CompletedProcess([], 0, stdout=" \n/path/to/file\n "), +) +def test_nixos_build_flake(mock_run: Any) -> None: + flake = m.Flake.parse(".#hostname") + + assert n.nixos_build_flake( + "toplevel", + flake, + ["--nix-flag", "foo"], + no_link=True, + ) == Path("/path/to/file") + mock_run.assert_called_with( + [ + "nix", + "--extra-experimental-features", + "nix-command flakes", + "build", + "--print-out-paths", + ".#nixosConfigurations.hostname.config.system.build.toplevel", + "--no-link", + "--nix-flag", + "foo", + ], + check=True, + text=True, + stdout=PIPE, + ) + + +@patch( + get_qualified_name(n.run, n), + autospec=True, + return_value=CompletedProcess([], 0, stdout=" \n/path/to/file\n "), +) +def test_nixos_build(mock_run: Any, monkeypatch: Any) -> None: + assert n.nixos_build("attr", None, None, ["--nix-flag", "foo"]) == Path( + "/path/to/file" + ) + mock_run.assert_called_with( + ["nix-build", "", "--attr", "attr", "--nix-flag", "foo"], + check=True, + text=True, + stdout=PIPE, + ) + + n.nixos_build("attr", "preAttr", "file") + mock_run.assert_called_with( + ["nix-build", "file", "--attr", "preAttr.attr"], + check=True, + text=True, + stdout=PIPE, + ) + + n.nixos_build("attr", None, "file", no_out_link=True) + mock_run.assert_called_with( + ["nix-build", "file", "--attr", "attr", "--no-out-link"], + check=True, + text=True, + stdout=PIPE, + ) + + n.nixos_build("attr", "preAttr", None, no_out_link=False, keep_going=True) + mock_run.assert_called_with( + ["nix-build", "default.nix", "--attr", "preAttr.attr", "--keep-going"], + check=True, + text=True, + stdout=PIPE, + ) + + +@patch(get_qualified_name(n.run, n), autospec=True) +def test_rollback(mock_run: Any, tmp_path: Path) -> None: + path = tmp_path / "test" + path.touch() + + profile = m.Profile("system", path) + + assert n.rollback(profile) == profile.path + mock_run.assert_called_with(["nix-env", "--rollback", "-p", path], check=True) + + +def test_rollback_temporary_profile(tmp_path: Path) -> None: + path = tmp_path / "test" + path.touch() + profile = m.Profile("system", path) + + with patch(get_qualified_name(n.run, n), autospec=True) as mock_run: + mock_run.return_value = CompletedProcess( + [], + 0, + stdout=textwrap.dedent("""\ + 2082 2024-11-07 22:58:56 + 2083 2024-11-07 22:59:41 + 2084 2024-11-07 23:54:17 (current) + """), + ) + assert ( + n.rollback_temporary_profile(m.Profile("system", path)) + == path.parent / "system-2083-link" + ) + assert ( + n.rollback_temporary_profile(m.Profile("foo", path)) + == path.parent / "foo-2083-link" + ) + + with patch(get_qualified_name(n.run, n), autospec=True) as mock_run: + mock_run.return_value = CompletedProcess([], 0, stdout="") + assert n.rollback_temporary_profile(profile) is None + + +@patch(get_qualified_name(n.run, n), autospec=True) +def test_set_profile(mock_run: Any) -> None: + profile_path = Path("/path/to/profile") + config_path = Path("/path/to/config") + n.set_profile(m.Profile("system", profile_path), config_path) + + mock_run.assert_called_with( + ["nix-env", "-p", profile_path, "--set", config_path], check=True + ) + + +@patch(get_qualified_name(n.run, n), autospec=True) +def test_switch_to_configuration(mock_run: Any, monkeypatch: Any) -> None: + profile_path = Path("/path/to/profile") + config_path = Path("/path/to/config") + + with monkeypatch.context() as mp: + mp.setenv("LOCALE_ARCHIVE", "") + + n.switch_to_configuration( + profile_path, + m.Action.SWITCH, + specialisation=None, + install_bootloader=False, + ) + mock_run.assert_called_with( + [profile_path / "bin/switch-to-configuration", "switch"], + env={"NIXOS_INSTALL_BOOTLOADER": "0", "LOCALE_ARCHIVE": ""}, + check=True, + ) + + with pytest.raises(m.NRError) as e: + n.switch_to_configuration( + config_path, + m.Action.BOOT, + specialisation="special", + ) + assert ( + str(e.value) + == "error: '--specialisation' can only be used with 'switch' and 'test'" + ) + + with monkeypatch.context() as mp: + mp.setenv("LOCALE_ARCHIVE", "/path/to/locale") + mp.setattr(Path, Path.exists.__name__, lambda self: True) + + n.switch_to_configuration( + Path("/path/to/config"), + m.Action.TEST, + install_bootloader=True, + specialisation="special", + ) + mock_run.assert_called_with( + [ + config_path / "specialisation/special/bin/switch-to-configuration", + "test", + ], + env={"NIXOS_INSTALL_BOOTLOADER": "1", "LOCALE_ARCHIVE": "/path/to/locale"}, + check=True, + ) + + +@patch( + get_qualified_name(n.Path.glob, n), + autospec=True, + return_value=[ + Path("/nix/var/nix/profiles/per-user/root/channels/nixos"), + Path("/nix/var/nix/profiles/per-user/root/channels/nixos-hardware"), + Path("/nix/var/nix/profiles/per-user/root/channels/home-manager"), + ], +) +def test_upgrade_channels(mock_glob: Any) -> None: + with patch(get_qualified_name(n.run, n), autospec=True) as mock_run: + n.upgrade_channels(False) + mock_run.assert_called_with(["nix-channel", "--update", "nixos"], check=False) + + with patch(get_qualified_name(n.run, n), autospec=True) as mock_run: + n.upgrade_channels(True) + mock_run.assert_has_calls( + [ + call(["nix-channel", "--update", "nixos"], check=False), + call(["nix-channel", "--update", "nixos-hardware"], check=False), + call(["nix-channel", "--update", "home-manager"], check=False), + ] + ) diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_utils.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_utils.py new file mode 100644 index 000000000000..98c0b798742c --- /dev/null +++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_utils.py @@ -0,0 +1,23 @@ +from nixos_rebuild import utils as u + + +def test_dict_to_flags() -> None: + r = u.dict_to_flags( + { + "test_flag_1": True, + "test_flag_2": False, + "test_flag_3": "value", + "test_flag_4": ["v1", "v2"], + "test_flag_5": None, + "verbose": 5, + } + ) + assert r == [ + "--test-flag-1", + "--test-flag-3", + "value", + "--test-flag-4", + "v1", + "v2", + "-vvvvv", + ] diff --git a/pkgs/by-name/rb/rbenv/package.nix b/pkgs/by-name/rb/rbenv/package.nix index 6c080f4f2181..1e69e874f573 100644 --- a/pkgs/by-name/rb/rbenv/package.nix +++ b/pkgs/by-name/rb/rbenv/package.nix @@ -1,21 +1,26 @@ -{ lib, stdenv, fetchFromGitHub, installShellFiles }: +{ + lib, + stdenv, + fetchFromGitHub, + installShellFiles, +}: -stdenv.mkDerivation rec { +stdenv.mkDerivation (finalAttrs: { pname = "rbenv"; - version = "1.2.0"; + version = "1.3.0"; nativeBuildInputs = [ installShellFiles ]; src = fetchFromGitHub { owner = "rbenv"; repo = "rbenv"; - rev = "v${version}"; - sha256 = "sha256-m/Yy5EK8pLTBFcsgKCrNvQrPFFIlYklXXZbjN4Nmm9c="; + rev = "v${finalAttrs.version}"; + sha256 = "sha256-AO0z9QtCGHwUr2ji28sbvQmCBDIfjAqbiac+HTH3N7Q="; }; postPatch = '' - patchShebangs src/configure - pushd src + patchShebangs src/configure + pushd src ''; installPhase = '' @@ -24,19 +29,20 @@ stdenv.mkDerivation rec { mv libexec $out ln -s $out/libexec/rbenv $out/bin/rbenv - installShellCompletion completions/rbenv.{bash,zsh} + installShellCompletion --zsh completions/_rbenv + installShellCompletion --bash completions/rbenv.bash ''; - meta = with lib; { - description = "Groom your app’s Ruby environment"; - mainProgram = "rbenv"; + meta = { + description = "Version manager tool for the Ruby programming language on Unix-like systems"; longDescription = '' Use rbenv to pick a Ruby version for your application and guarantee that your development environment matches production. Put rbenv to work with Bundler for painless Ruby upgrades and bulletproof deployments. ''; homepage = "https://github.com/rbenv/rbenv"; - license = licenses.mit; - maintainers = with maintainers; [ fzakaria ]; - platforms = platforms.all; + license = lib.licenses.mit; + maintainers = with lib.maintainers; [ fzakaria ]; + mainProgram = "rbenv"; + platforms = lib.platforms.all; }; -} +}) diff --git a/pkgs/by-name/re/remarshal_0_17/package.nix b/pkgs/by-name/re/remarshal_0_17/package.nix index 1a178a236e0e..6dfeddad0fbd 100644 --- a/pkgs/by-name/re/remarshal_0_17/package.nix +++ b/pkgs/by-name/re/remarshal_0_17/package.nix @@ -50,7 +50,7 @@ pythonPackages.buildPythonApplication rec { nativeCheckInputs = [ pythonPackages.pytestCheckHook ]; - passthru.updateScript = throw "This package is pinned to 0.17.1 for YAML 1.1 support"; + # nixpkgs-update: no auto update meta = with lib; { changelog = "https://github.com/remarshal-project/remarshal/releases/tag/v${version}"; diff --git a/pkgs/by-name/sp/spread/package.nix b/pkgs/by-name/sp/spread/package.nix index 4fb6a143e051..51fbc76bc708 100644 --- a/pkgs/by-name/sp/spread/package.nix +++ b/pkgs/by-name/sp/spread/package.nix @@ -61,6 +61,6 @@ buildGoModule { description = "Convenient full-system test (task) distribution"; homepage = "https://github.com/snapcore/spread"; maintainers = with lib.maintainers; [ jnsgruk ]; - platforms = lib.platforms.linux; + platforms = lib.platforms.unix; }; } diff --git a/pkgs/by-name/vo/volatility3/package.nix b/pkgs/by-name/vo/volatility3/package.nix index ffc0a0c93280..1a65ba132af5 100644 --- a/pkgs/by-name/vo/volatility3/package.nix +++ b/pkgs/by-name/vo/volatility3/package.nix @@ -5,14 +5,14 @@ python3.pkgs.buildPythonApplication rec { pname = "volatility3"; - version = "2.7.0"; + version = "2.8.0"; pyproject = true; src = fetchFromGitHub { owner = "volatilityfoundation"; repo = "volatility3"; rev = "refs/tags/v${version}"; - hash = "sha256-elTUAvSe91TqpsTXg08SPKaVr6iM7FKcBaVNunv+HfU="; + hash = "sha256-XMoVfT1Wd8r684y4crTOjW9GklSTkivOGv1Ii10KzII="; }; build-system = with python3.pkgs; [ diff --git a/pkgs/development/compilers/kind2/default.nix b/pkgs/development/compilers/kind2/default.nix index a5a8585d020e..4af6762da2a7 100644 --- a/pkgs/development/compilers/kind2/default.nix +++ b/pkgs/development/compilers/kind2/default.nix @@ -1,8 +1,9 @@ -{ lib -, rustPlatform -, fetchCrate -, stdenv -, darwin +{ + lib, + rustPlatform, + fetchCrate, + stdenv, + darwin, }: rustPlatform.buildRustPackage rec { @@ -16,6 +17,13 @@ rustPlatform.buildRustPackage rec { cargoHash = "sha256-KzoEh/kMKsHx9K3t1/uQZ7fdsZEM+v8UOft8JjEB1Zw="; + postPatch = '' + substituteInPlace src/main.rs \ + --replace-fail "#![feature(panic_info_message)]" "" + substituteInPlace src/main.rs \ + --replace-fail "e.message().unwrap()" "e.payload()" + ''; + buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ darwin.apple_sdk_11_0.frameworks.Security ]; diff --git a/pkgs/development/libraries/wolfssl/default.nix b/pkgs/development/libraries/wolfssl/default.nix index aeef5a8c4705..0a8202839c36 100644 --- a/pkgs/development/libraries/wolfssl/default.nix +++ b/pkgs/development/libraries/wolfssl/default.nix @@ -10,23 +10,22 @@ # requiring to build a special variant for that software. Example: 'haproxy' , variant ? "all" , extraConfigureFlags ? [] +, enableARMCryptoExtensions ? stdenv.hostPlatform.isAarch64 && ((builtins.match "^.*\\+crypto.*$" stdenv.hostPlatform.gcc.arch) != null) , enableLto ? !(stdenv.hostPlatform.isStatic || stdenv.cc.isClang) }: stdenv.mkDerivation (finalAttrs: { pname = "wolfssl-${variant}"; - version = "5.7.2"; + version = "5.7.4"; src = fetchFromGitHub { owner = "wolfSSL"; repo = "wolfssl"; rev = "refs/tags/v${finalAttrs.version}-stable"; - hash = "sha256-VTMVgBSDL6pw1eEKnxGzTdyQYWVbMd3mAnOnpAOKVhk="; + hash = "sha256-/dtW1E1wYfQEuotclUEOK5+Vg4S7vt1xWhr1lEtu60w="; }; postPatch = '' patchShebangs ./scripts - # ocsp stapling tests require network access, so skip them - sed -i -e'2s/.*/exit 77/' scripts/ocsp-stapling.test # ensure test detects musl-based systems too substituteInPlace scripts/ocsp-stapling2.test \ --replace '"linux-gnu"' '"linux-"' @@ -54,10 +53,11 @@ stdenv.mkDerivation (finalAttrs: { # Enable AVX/AVX2/AES-NI instructions, gated by runtime detection via CPUID. "--enable-intelasm" "--enable-aesni" - ] ++ lib.optionals (stdenv.hostPlatform.isAarch64 && stdenv.hostPlatform.isDarwin) [ + ] ++ lib.optionals (stdenv.hostPlatform.isAarch64) [ # No runtime detection under ARM and no platform function checks like for X86. - # However, all ARM macOS systems have the supported extensions autodetected in the configure script. - "--enable-armasm=inline" + (if enableARMCryptoExtensions + then "--enable-armasm=inline" + else "--disable-armasm") ] ++ extraConfigureFlags; # Breaks tls13 tests on aarch64-darwin. @@ -67,6 +67,9 @@ stdenv.mkDerivation (finalAttrs: { env.NIX_CFLAGS_COMPILE = lib.optionalString enableLto "-flto"; env.NIX_LDFLAGS_COMPILE = lib.optionalString enableLto "-flto"; + # Don't attempt connections to external services in the test suite. + env.WOLFSSL_EXTERNAL_TEST = "0"; + outputs = [ "dev" "doc" diff --git a/pkgs/development/python-modules/aioopenexchangerates/default.nix b/pkgs/development/python-modules/aioopenexchangerates/default.nix index 963ddc56eaad..eaf034f090b2 100644 --- a/pkgs/development/python-modules/aioopenexchangerates/default.nix +++ b/pkgs/development/python-modules/aioopenexchangerates/default.nix @@ -14,7 +14,7 @@ buildPythonPackage rec { pname = "aioopenexchangerates"; - version = "0.6.8"; + version = "0.6.10"; pyproject = true; disabled = pythonOlder "3.11"; @@ -23,7 +23,7 @@ buildPythonPackage rec { owner = "MartinHjelmare"; repo = "aioopenexchangerates"; rev = "refs/tags/v${version}"; - hash = "sha256-O7Hq+dtonh527eJI4/YSIF58P3TWsdFlUYDd0vzA2yo="; + hash = "sha256-GDAeBk4h0YLFbLSGEjomvzR94y0JGsRzd15J4sv6i6o="; }; pythonRelaxDeps = [ "pydantic" ]; diff --git a/pkgs/development/python-modules/appthreat-vulnerability-db/default.nix b/pkgs/development/python-modules/appthreat-vulnerability-db/default.nix index aa9fd60a8a4c..acb87d74c275 100644 --- a/pkgs/development/python-modules/appthreat-vulnerability-db/default.nix +++ b/pkgs/development/python-modules/appthreat-vulnerability-db/default.nix @@ -21,7 +21,7 @@ buildPythonPackage rec { pname = "appthreat-vulnerability-db"; - version = "6.1.1"; + version = "6.2.1"; pyproject = true; disabled = pythonOlder "3.10"; @@ -30,7 +30,7 @@ buildPythonPackage rec { owner = "AppThreat"; repo = "vulnerability-db"; rev = "refs/tags/v${version}"; - hash = "sha256-FISV+wEpoRVfHNjN/fZw7aqFp5XDvB21ZhQhRQvCnHY="; + hash = "sha256-Jk6sxmnV3lfrPlnQFM0DVxHvtJTtOyQTnyw2o3UZL3U="; }; pythonRelaxDeps = [ diff --git a/pkgs/development/python-modules/fabric/default.nix b/pkgs/development/python-modules/fabric/default.nix index 001abb7883a8..173a596f0c89 100644 --- a/pkgs/development/python-modules/fabric/default.nix +++ b/pkgs/development/python-modules/fabric/default.nix @@ -1,58 +1,71 @@ { lib, buildPythonPackage, - fetchPypi, - cryptography, decorator, + deprecated, + fetchPypi, + icecream, invoke, mock, paramiko, - pytestCheckHook, pytest-relaxed, + pytestCheckHook, + pythonOlder, + setuptools, }: buildPythonPackage rec { pname = "fabric"; version = "3.2.2"; - format = "setuptools"; + pyproject = true; + + disabled = pythonOlder "3.10"; src = fetchPypi { inherit pname version; hash = "sha256-h4PKQuOwB28IsmkBqsa52bHxnEEAdOesz6uQLBhP9KM="; }; - # only relevant to python < 3.4 - postPatch = '' - substituteInPlace setup.py \ - --replace ', "pathlib2"' ' ' - ''; + build-system = [ setuptools ]; - propagatedBuildInputs = [ + dependencies = [ invoke paramiko - cryptography + deprecated decorator ]; nativeCheckInputs = [ - pytestCheckHook - pytest-relaxed + icecream mock + pytest-relaxed + pytestCheckHook ]; - # ==================================== ERRORS ==================================== - # ________________________ ERROR collecting test session _________________________ - # Direct construction of SpecModule has been deprecated, please use SpecModule.from_parent - # See https://docs.pytest.org/en/stable/deprecations.html#node-construction-changed-to-node-from-parent for more details. - doCheck = false; + pytestFlagsArray = [ "tests/*.py" ]; pythonImportsCheck = [ "fabric" ]; - meta = with lib; { + disabledTests = [ + # Tests are out-dated + "calls_RemoteShell_run_with_all_kwargs_and_returns_its_result" + "executes_arguments_on_contents_run_via_threading" + "expect" + "from_v1" + "honors_config_system_for_allowed_kwargs" + "llows_disabling_remote_mode_preservation" + "load" + "preserves_remote_mode_by_default" + "proxy_jump" + "raises_TypeError_for_disallowed_kwargs" + ]; + + meta = { description = "Pythonic remote execution"; - mainProgram = "fab"; homepage = "https://www.fabfile.org/"; - license = licenses.bsd2; + changelog = "https://www.fabfile.org/changelog.html"; + license = lib.licenses.bsd2; maintainers = [ ]; + mainProgram = "fab"; }; } diff --git a/pkgs/development/python-modules/llama-index-core/default.nix b/pkgs/development/python-modules/llama-index-core/default.nix index be4eef72fa7e..ca094727e083 100644 --- a/pkgs/development/python-modules/llama-index-core/default.nix +++ b/pkgs/development/python-modules/llama-index-core/default.nix @@ -6,6 +6,7 @@ deprecated, dirtyjson, fetchFromGitHub, + filetype, fsspec, jsonpath-ng, llamaindex-py-client, @@ -35,7 +36,7 @@ buildPythonPackage rec { pname = "llama-index-core"; - version = "0.11.20"; + version = "0.11.23"; pyproject = true; disabled = pythonOlder "3.8"; @@ -44,7 +45,7 @@ buildPythonPackage rec { owner = "run-llama"; repo = "llama_index"; rev = "refs/tags/v${version}"; - hash = "sha256-r4xedtxoYv6CcxtDrgwau9LY3kOBg3jXlQm1g59L7x4="; + hash = "sha256-DMdU8LT1IGTHM8EsCX44MvGv+luOsKnPSI7yRR5ULPo="; }; sourceRoot = "${src.name}/${pname}"; @@ -72,6 +73,7 @@ buildPythonPackage rec { dataclasses-json deprecated dirtyjson + filetype fsspec jsonpath-ng llamaindex-py-client diff --git a/pkgs/development/python-modules/llama-index-embeddings-gemini/default.nix b/pkgs/development/python-modules/llama-index-embeddings-gemini/default.nix index 7bd5e2d40021..e16484b78d7e 100644 --- a/pkgs/development/python-modules/llama-index-embeddings-gemini/default.nix +++ b/pkgs/development/python-modules/llama-index-embeddings-gemini/default.nix @@ -10,7 +10,7 @@ buildPythonPackage rec { pname = "llama-index-embeddings-gemini"; - version = "0.2.1"; + version = "0.2.2"; pyproject = true; disabled = pythonOlder "3.9"; @@ -18,7 +18,7 @@ buildPythonPackage rec { src = fetchPypi { pname = "llama_index_embeddings_gemini"; inherit version; - hash = "sha256-TA3dm1+NZ0Km9Li9cswzm5fusVYXTRqA9W3U4OgT92I="; + hash = "sha256-lVW12tWDqNQW+mijxcF98aOuNw006xTdv0Cm+yZ4H0o="; }; pythonRelaxDeps = [ "google-generativeai" ]; diff --git a/pkgs/development/python-modules/llama-index-legacy/default.nix b/pkgs/development/python-modules/llama-index-legacy/default.nix index 5ab6bd06bba3..43e13c7cedeb 100644 --- a/pkgs/development/python-modules/llama-index-legacy/default.nix +++ b/pkgs/development/python-modules/llama-index-legacy/default.nix @@ -9,7 +9,7 @@ buildPythonPackage rec { pname = "llama-index-legacy"; - version = "0.9.48.post3"; + version = "0.9.48.post4"; pyproject = true; disabled = pythonOlder "3.8"; @@ -17,7 +17,7 @@ buildPythonPackage rec { src = fetchPypi { pname = "llama_index_legacy"; inherit version; - hash = "sha256-9pafEIXvsKvr1jZ+RvNRICDz9rnAhvRYpRmDDdYeggY="; + hash = "sha256-+Kl2Tn4TSlK/715T0tYlYb/AH8CYdMUcwAHfb1MCrjA="; }; pythonRelaxDeps = [ "tenacity" ]; diff --git a/pkgs/development/python-modules/llama-index-llms-ollama/default.nix b/pkgs/development/python-modules/llama-index-llms-ollama/default.nix index 04bb0ddd0caa..106005841f1e 100644 --- a/pkgs/development/python-modules/llama-index-llms-ollama/default.nix +++ b/pkgs/development/python-modules/llama-index-llms-ollama/default.nix @@ -10,7 +10,7 @@ buildPythonPackage rec { pname = "llama-index-llms-ollama"; - version = "0.3.4"; + version = "0.3.6"; pyproject = true; disabled = pythonOlder "3.8"; @@ -18,7 +18,7 @@ buildPythonPackage rec { src = fetchPypi { pname = "llama_index_llms_ollama"; inherit version; - hash = "sha256-Vt9uGIcIGvRSL57DK+LUYy2NTyYZ9yqnHqYJZiMeVKA="; + hash = "sha256-EoTvA98XH+/ulJ+NdenRzjo4Fy+ZAmmjjzkyj1qT6kc="; }; build-system = [ poetry-core ]; diff --git a/pkgs/development/python-modules/llama-index-readers-file/default.nix b/pkgs/development/python-modules/llama-index-readers-file/default.nix index 7a12cf4bf4ab..1c040bd03e7b 100644 --- a/pkgs/development/python-modules/llama-index-readers-file/default.nix +++ b/pkgs/development/python-modules/llama-index-readers-file/default.nix @@ -13,7 +13,7 @@ buildPythonPackage rec { pname = "llama-index-readers-file"; - version = "0.2.2"; + version = "0.3.0"; pyproject = true; disabled = pythonOlder "3.8"; @@ -21,7 +21,7 @@ buildPythonPackage rec { src = fetchPypi { pname = "llama_index_readers_file"; inherit version; - hash = "sha256-SEWfkJYLhjc3FHtm7YOv7JzomE+O2iVhttJQAhQ2XbI="; + hash = "sha256-bGdfzS8FmaEx+J4cXtNSHd4xM4qbckp3IfXf1yQ+qNg="; }; pythonRelaxDeps = [ diff --git a/pkgs/development/python-modules/llama-index-readers-s3/default.nix b/pkgs/development/python-modules/llama-index-readers-s3/default.nix index 3b0f5cb2c0ce..1aab269de7c5 100644 --- a/pkgs/development/python-modules/llama-index-readers-s3/default.nix +++ b/pkgs/development/python-modules/llama-index-readers-s3/default.nix @@ -11,7 +11,7 @@ buildPythonPackage rec { pname = "llama-index-readers-s3"; - version = "0.2.0"; + version = "0.3.0"; pyproject = true; disabled = pythonOlder "3.8"; @@ -19,7 +19,7 @@ buildPythonPackage rec { src = fetchPypi { pname = "llama_index_readers_s3"; inherit version; - hash = "sha256-BXld0+j4UpwUFtkjkmfn3CwxMQoCZFj84D4R3Rr2jso="; + hash = "sha256-gTseRAdHZW2jzewN3rRC6B8yCgMu8H7Y3N6ZdH1D1nI="; }; build-system = [ poetry-core ]; diff --git a/pkgs/development/python-modules/llama-index-vector-stores-chroma/default.nix b/pkgs/development/python-modules/llama-index-vector-stores-chroma/default.nix index 629d27c8e554..ab6183c410d9 100644 --- a/pkgs/development/python-modules/llama-index-vector-stores-chroma/default.nix +++ b/pkgs/development/python-modules/llama-index-vector-stores-chroma/default.nix @@ -10,7 +10,7 @@ buildPythonPackage rec { pname = "llama-index-vector-stores-chroma"; - version = "0.2.1"; + version = "0.3.0"; pyproject = true; disabled = pythonOlder "3.8"; @@ -18,7 +18,7 @@ buildPythonPackage rec { src = fetchPypi { pname = "llama_index_vector_stores_chroma"; inherit version; - hash = "sha256-3vFadjVLtGWLFrrbklN6cudmJz1eVmsFdUYQBdpThH8="; + hash = "sha256-VAWSFqI71r0dw69MWYbbOLKTNYawQujuEmOF16XeziM="; }; build-system = [ poetry-core ]; diff --git a/pkgs/development/python-modules/llama-parse/default.nix b/pkgs/development/python-modules/llama-parse/default.nix index bc8719d4de36..457b75d40ff3 100644 --- a/pkgs/development/python-modules/llama-parse/default.nix +++ b/pkgs/development/python-modules/llama-parse/default.nix @@ -9,7 +9,7 @@ buildPythonPackage rec { pname = "llama-parse"; - version = "0.5.12"; + version = "0.5.14"; pyproject = true; disabled = pythonOlder "3.8"; @@ -17,7 +17,7 @@ buildPythonPackage rec { src = fetchPypi { pname = "llama_parse"; inherit version; - hash = "sha256-4kFgbPNXRCXfdsD10BoxqVx5LG+++AqvcvjtZEi9FxU="; + hash = "sha256-uQUQ9Yd01u5ztidf5PGqD/OjBgJt8plZYG5WBzOEJIw="; }; build-system = [ poetry-core ]; diff --git a/pkgs/development/python-modules/pyside6/default.nix b/pkgs/development/python-modules/pyside6/default.nix index 840af05e4bab..f55d5dee6fef 100644 --- a/pkgs/development/python-modules/pyside6/default.nix +++ b/pkgs/development/python-modules/pyside6/default.nix @@ -94,19 +94,18 @@ stdenv.mkDerivation (finalAttrs: { pythonImportsCheckHook ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ moveBuildTree ]; - buildInputs = - python.pkgs.qt6.darwinVersionInputs - ++ ( - if stdenv.hostPlatform.isLinux then - # qtwebengine fails under darwin - # see https://github.com/NixOS/nixpkgs/pull/312987 - packages ++ [ python.pkgs.qt6.qtwebengine ] - else - [ - qt_linked - cups - ] - ); + buildInputs = ( + if stdenv.hostPlatform.isLinux then + # qtwebengine fails under darwin + # see https://github.com/NixOS/nixpkgs/pull/312987 + packages ++ [ python.pkgs.qt6.qtwebengine ] + else + python.pkgs.qt6.darwinVersionInputs + ++ [ + qt_linked + cups + ] + ); propagatedBuildInputs = [ shiboken6 ]; diff --git a/pkgs/development/python-modules/shiboken6/default.nix b/pkgs/development/python-modules/shiboken6/default.nix index e5889977ed13..a5c3b63f8ec7 100644 --- a/pkgs/development/python-modules/shiboken6/default.nix +++ b/pkgs/development/python-modules/shiboken6/default.nix @@ -31,15 +31,18 @@ stdenv'.mkDerivation (finalAttrs: { (python.pythonOnBuildForHost.withPackages (ps: [ ps.setuptools ])) ] ++ lib.optionals stdenv.hostPlatform.isLinux [ autoPatchelfHook ]; - buildInputs = [ - llvmPackages.llvm - llvmPackages.libclang - python.pkgs.qt6.qtbase - python.pkgs.qt6.darwinVersionInputs - python.pkgs.ninja - python.pkgs.packaging - python.pkgs.setuptools - ]; + buildInputs = + [ + llvmPackages.llvm + llvmPackages.libclang + python.pkgs.qt6.qtbase + python.pkgs.ninja + python.pkgs.packaging + python.pkgs.setuptools + ] + ++ lib.optionals stdenv.hostPlatform.isDarwin [ + python.pkgs.qt6.darwinVersionInputs + ]; cmakeFlags = [ "-DBUILD_TESTS=OFF" ]; diff --git a/pkgs/development/python-modules/twilio/default.nix b/pkgs/development/python-modules/twilio/default.nix index dce798f73b2a..c8b6bdbd3dc4 100644 --- a/pkgs/development/python-modules/twilio/default.nix +++ b/pkgs/development/python-modules/twilio/default.nix @@ -21,7 +21,7 @@ buildPythonPackage rec { pname = "twilio"; - version = "9.3.6"; + version = "9.3.7"; pyproject = true; disabled = pythonOlder "3.7"; @@ -30,7 +30,7 @@ buildPythonPackage rec { owner = "twilio"; repo = "twilio-python"; rev = "refs/tags/${version}"; - hash = "sha256-H/MBRiGU2EnrhspX2ilVvnxdr7A50q+snCM2inobrcs="; + hash = "sha256-ncLefK29GVhjiXi0zSXjUbL23oxoUH7Pu4cFttK4WrY="; }; build-system = [ setuptools ]; diff --git a/pkgs/development/python-modules/zfec/default.nix b/pkgs/development/python-modules/zfec/default.nix index dd12475d893d..07616470b31e 100644 --- a/pkgs/development/python-modules/zfec/default.nix +++ b/pkgs/development/python-modules/zfec/default.nix @@ -10,12 +10,12 @@ buildPythonPackage rec { pname = "zfec"; - version = "1.5.7.4"; + version = "1.6.0.0"; pyproject = true; src = fetchPypi { inherit pname version; - hash = "sha256-EGmFchj4ur5AhEOXEnIIA6Ef6RsU8gvHepak5vThER8="; + hash = "sha256-xaGGHCU7USaYwuczrk2D9eLW6myIG32+ETNLaU51WgA="; }; nativeBuildInputs = [ setuptools ]; diff --git a/pkgs/os-specific/linux/sgx/psw/cppmicroservices-no-mtime.patch b/pkgs/os-specific/linux/sgx/psw/cppmicroservices-no-mtime.patch new file mode 100644 index 000000000000..019f58927152 --- /dev/null +++ b/pkgs/os-specific/linux/sgx/psw/cppmicroservices-no-mtime.patch @@ -0,0 +1,26 @@ +diff --git a/external/CppMicroServices/framework/src/bundle/BundleResourceContainer.cpp b/external/CppMicroServices/framework/src/bundle/BundleResourceContainer.cpp +index aee499e9..13fa89d4 100644 +--- a/external/CppMicroServices/framework/src/bundle/BundleResourceContainer.cpp ++++ b/external/CppMicroServices/framework/src/bundle/BundleResourceContainer.cpp +@@ -105,7 +105,7 @@ bool BundleResourceContainer::GetStat(int index, + const_cast(&m_ZipArchive), index) + ? true + : false; +- stat.modifiedTime = zipStat.m_time; ++ stat.modifiedTime = 0; + stat.crc32 = zipStat.m_crc32; + // This will limit the size info from uint64 to uint32 on 32-bit + // architectures. We don't care because we assume resources > 2GB +diff --git a/external/CppMicroServices/third_party/miniz.c b/external/CppMicroServices/third_party/miniz.c +index 6b0ebd7a..fa2aebca 100644 +--- a/external/CppMicroServices/third_party/miniz.c ++++ b/external/CppMicroServices/third_party/miniz.c +@@ -170,7 +170,7 @@ + // If MINIZ_NO_TIME is specified then the ZIP archive functions will not be able to get the current time, or + // get/set file times, and the C run-time funcs that get/set times won't be called. + // The current downside is the times written to your archives will be from 1979. +-//#define MINIZ_NO_TIME ++#define MINIZ_NO_TIME + + // Define MINIZ_NO_ARCHIVE_APIS to disable all ZIP archive API's. + //#define MINIZ_NO_ARCHIVE_APIS diff --git a/pkgs/os-specific/linux/sgx/psw/default.nix b/pkgs/os-specific/linux/sgx/psw/default.nix index 829b0c6525ec..6a73775dbf83 100644 --- a/pkgs/os-specific/linux/sgx/psw/default.nix +++ b/pkgs/os-specific/linux/sgx/psw/default.nix @@ -1,22 +1,37 @@ { stdenv , lib , fetchurl +, fetchFromGitHub , cmake , coreutils , curl , file +, git , makeWrapper , nixosTests , protobuf , python3 -, sgx-sdk +, ocaml +, ocamlPackages , which , debug ? false }: stdenv.mkDerivation rec { - inherit (sgx-sdk) patches src version versionTag; pname = "sgx-psw"; + # Version as given in se_version.h + version = "2.25.100.3"; + # Version as used in the Git tag + versionTag = "2.25"; + src = fetchFromGitHub { + owner = "intel"; + repo = "linux-sgx"; + rev = "sgx_${versionTag}"; + hash = "sha256-RR+vFTd9ZM6XUn3KgQeUM+xoj1Ava4zQzFYA/nfXyaw="; + fetchSubmodules = true; + }; + + # Extract Intel-provided, pre-built enclaves and libs. postUnpack = let # Fetch the pre-built, Intel-signed Architectural Enclaves (AE). They help @@ -24,34 +39,104 @@ stdenv.mkDerivation rec { # attestation quotes, and do platform certification. ae.prebuilt = fetchurl { url = "https://download.01.org/intel-sgx/sgx-linux/${versionTag}/prebuilt_ae_${versionTag}.tar.gz"; - hash = "sha256-IGV9VEwY/cQBV4Vz2sps4JgRweWRl/l08ocb9P4SH8Q="; + hash = "sha256-Hlh96rYOyml2y50d8ASKz6U97Fl0hbGYECeZiG9nMSQ="; }; - # Also include the Data Center Attestation Primitives (DCAP) platform - # enclaves. + + # Pre-built ipp-crypto with mitigations. + optlib.prebuilt = fetchurl { + url = "https://download.01.org/intel-sgx/sgx-linux/${versionTag}/optimized_libs_${versionTag}.tar.gz"; + hash = "sha256-7mDTaLtpOQLHQ6Fv+FWJ2k/veJZPXIcuj7kOdRtRqhg="; + }; + + # Fetch the Data Center Attestation Primitives (DCAP) platform enclaves + # and pre-built sgxssl. dcap = rec { - version = "1.21"; + version = "1.22"; filename = "prebuilt_dcap_${version}.tar.gz"; prebuilt = fetchurl { url = "https://download.01.org/intel-sgx/sgx-dcap/${version}/linux/${filename}"; - hash = "sha256-/PPD2MyNxoCwzNljIFcpkFvItXbyvymsJ7+Uf4IyZuk="; + hash = "sha256-RTpJQ6epoAN8YQXSJUjJQ5mPaQIiQpStTWFsnspjjDQ="; }; }; in - sgx-sdk.postUnpack + '' + '' + # Make sure this is the right version of linux-sgx + grep -q '"${version}"' "$src/common/inc/internal/se_version.h" \ + || (echo "Could not find expected version ${version} in linux-sgx source" >&2 && exit 1) + + tar -xzvf ${ae.prebuilt} -C $sourceRoot/ + tar -xzvf ${optlib.prebuilt} -C $sourceRoot/ + # Make sure we use the correct version of prebuilt DCAP grep -q 'ae_file_name=${dcap.filename}' "$src/external/dcap_source/QuoteGeneration/download_prebuilt.sh" \ || (echo "Could not find expected prebuilt DCAP ${dcap.filename} in linux-sgx source" >&2 && exit 1) - tar -zxf ${ae.prebuilt} -C $sourceRoot/ - tar -zxf ${dcap.prebuilt} -C $sourceRoot/external/dcap_source/QuoteGeneration/ + tar -xzvf ${dcap.prebuilt} -C $sourceRoot/external/dcap_source ./prebuilt/ + tar -xzvf ${dcap.prebuilt} -C $sourceRoot/external/dcap_source/QuoteGeneration ./psw/ + ''; + + patches = [ + # There's a `make preparation` step that downloads some prebuilt binaries + # and applies some patches to the in-repo git submodules. This patch removes + # the parts that download things, since we can't do that inside the sandbox. + ./disable-downloads.patch + + # This patch disables mtime in bundled zip file for reproducible builds. + # + # Context: The `aesm_service` binary depends on a vendored library called + # `CppMicroServices`. At build time, this lib creates and then bundles + # service resources into a zip file and then embeds this zip into the + # binary. Without changes, the `aesm_service` will be different after every + # build because the embedded zip file contents have different modified times. + ./cppmicroservices-no-mtime.patch + ]; + + postPatch = + let + # The base directories we want to copy headers from. The exact headers are + # parsed from + bomDirsToCopyFrom = builtins.concatStringsSep "|" [ + "common/" + "external/dcap_source/" + "external/ippcp_internal/" + "external/sgx-emm/" + "psw/" + "sdk/tlibcxx/" + ]; + in + '' + patchShebangs \ + external/sgx-emm/create_symlink.sh \ + linux/installer/bin/build-installpkg.sh \ + linux/installer/common/psw/createTarball.sh \ + linux/installer/common/psw/install.sh + + # Run sgx-sdk preparation step + make preparation + + # Build a fake SGX_SDK directory. Normally sgx-psw depends on first building + # all of sgx-sdk, however we can actually build them independently by just + # copying a few header files and building `sgx_edger8r` separately. + mkdir .sgxsdk + export SGX_SDK="$(readlink -f .sgxsdk)" + + # Parse the BOM for the headers we need, then copy them into SGX_SDK + # Each line in the BOM.txt looks like: + # /...\t/package/...\t.... + # TODO(phlip9): hardlink? + sed -n -r 's:^/(${bomDirsToCopyFrom})(\S+)\s/package/(\S+)\s.*$:\1\2\n.sgxsdk/\3:p' \ + < linux/installer/common/sdk/BOMs/sdk_base.txt \ + | xargs --max-args=2 install -v -D ''; nativeBuildInputs = [ cmake file + git makeWrapper + ocaml + ocamlPackages.ocamlbuild python3 - sgx-sdk which ]; @@ -60,27 +145,24 @@ stdenv.mkDerivation rec { protobuf ]; - hardeningDisable = [ - # causes redefinition of _FORTIFY_SOURCE - "fortify3" - ] ++ lib.optionals debug [ - "fortify" - ]; - - postPatch = '' - patchShebangs \ - linux/installer/bin/build-installpkg.sh \ - linux/installer/common/psw/createTarball.sh \ - linux/installer/common/psw/install.sh - ''; - dontUseCmakeConfigure = true; - buildFlags = [ - "psw_install_pkg" - ] ++ lib.optionals debug [ - "DEBUG=1" - ]; + preBuild = '' + # Build `sgx_edger8r`, the enclave .edl -> .h file codegen tool. + # Then place it in `$SGX_SDK/bin` and `$SGX_SDK/bin/x64`. + make -C sdk/edger8r/linux + mkdir -p $SGX_SDK/bin/x64 + sgx_edger8r_bin="$(readlink -f build/linux/sgx_edger8r)" + ln -s $sgx_edger8r_bin $SGX_SDK/bin/ + ln -s $sgx_edger8r_bin $SGX_SDK/bin/x64/ + + # Add this so we can link against libsgx_urts. + build_dir="$(readlink -f build/linux)" + ln -s $build_dir $SGX_SDK/lib + ln -s $build_dir $SGX_SDK/lib64 + ''; + + buildFlags = [ "psw_install_pkg" ] ++ lib.optionals debug [ "DEBUG=1" ]; installFlags = [ "-C linux/installer/common/psw/output" diff --git a/pkgs/os-specific/linux/sgx/psw/disable-downloads.patch b/pkgs/os-specific/linux/sgx/psw/disable-downloads.patch new file mode 100644 index 000000000000..fff31cb67ebe --- /dev/null +++ b/pkgs/os-specific/linux/sgx/psw/disable-downloads.patch @@ -0,0 +1,32 @@ +diff --git a/Makefile b/Makefile +index 19bc05a..6b1acd4 100644 +--- a/Makefile ++++ b/Makefile +@@ -50,13 +50,13 @@ tips: + preparation: + # As SDK build needs to clone and patch openmp, we cannot support the mode that download the source from github as zip. + # Only enable the download from git +- git submodule update --init --recursive ++ # git submodule update --init --recursive + cd external/dcap_source/external/jwt-cpp && git apply ../0001-Add-a-macro-to-disable-time-support-in-jwt-for-SGX.patch >/dev/null 2>&1 || \ + git apply ../0001-Add-a-macro-to-disable-time-support-in-jwt-for-SGX.patch -R --check +- ./external/dcap_source/QuoteVerification/prepare_sgxssl.sh nobuild ++ # ./external/dcap_source/QuoteVerification/prepare_sgxssl.sh nobuild + cd external/openmp/openmp_code && git apply ../0001-Enable-OpenMP-in-SGX.patch >/dev/null 2>&1 || git apply ../0001-Enable-OpenMP-in-SGX.patch --check -R + cd external/protobuf/protobuf_code && git apply ../sgx_protobuf.patch >/dev/null 2>&1 || git apply ../sgx_protobuf.patch --check -R +- cd external/protobuf/protobuf_code && git submodule update --init --recursive && cd third_party/abseil-cpp && git apply ../../../sgx_abseil.patch>/dev/null 2>&1 || git apply ../../../sgx_abseil.patch --check -R ++ cd external/protobuf/protobuf_code && cd third_party/abseil-cpp && git apply ../../../sgx_abseil.patch>/dev/null 2>&1 || git apply ../../../sgx_abseil.patch --check -R + ./external/sgx-emm/create_symlink.sh + cd external/mbedtls/mbedtls_code && git apply ../sgx_mbedtls.patch >/dev/null 2>&1 || git apply ../sgx_mbedtls.patch --check -R + cd external/cbor && cp -r libcbor sgx_libcbor +@@ -64,8 +64,8 @@ preparation: + cd external/cbor/sgx_libcbor && git apply ../sgx_cbor.patch >/dev/null 2>&1 || git apply ../sgx_cbor.patch --check -R + cd external/ippcp_internal/ipp-crypto && git apply ../0001-IPP-crypto-for-SGX.patch > /dev/null 2>&1 || git apply ../0001-IPP-crypto-for-SGX.patch --check -R + cd external/ippcp_internal/ipp-crypto && mkdir -p build +- ./download_prebuilt.sh +- ./external/dcap_source/QuoteGeneration/download_prebuilt.sh ++ # ./download_prebuilt.sh ++ # ./external/dcap_source/QuoteGeneration/download_prebuilt.sh + + psw: + $(MAKE) -C psw/ USE_OPT_LIBS=$(USE_OPT_LIBS) diff --git a/pkgs/tools/backup/monolith/default.nix b/pkgs/tools/backup/monolith/default.nix index 307ca6251ca4..454fed104ec1 100644 --- a/pkgs/tools/backup/monolith/default.nix +++ b/pkgs/tools/backup/monolith/default.nix @@ -6,20 +6,23 @@ , libiconv , Security , SystemConfiguration +, nix-update-script }: rustPlatform.buildRustPackage rec { pname = "monolith"; - version = "2.8.1"; + version = "2.8.3"; src = fetchFromGitHub { owner = "Y2Z"; repo = pname; rev = "v${version}"; - sha256 = "sha256-qMB4Tok0tYAqj8r9LEkjhBV5ko+hwagFS7MsL8AYJnc="; + hash = "sha256-t4FdTFXbKs7Xfw8dKoME7WDn+Fpe/uHPXyr5Wj+AXSA="; }; - cargoHash = "sha256-FeD0+s79orFDUVsb205W0pdXgDI+p1UrH3GIfKwUqDQ="; + cargoHash = "sha256-lBGcS1+CBYeVIG546aHSBVJ9y96rB3IDDVJPqCFUDZQ="; + + OPENSSL_NO_VENDOR = true; nativeBuildInputs = lib.optionals stdenv.hostPlatform.isLinux [ pkg-config ]; buildInputs = lib.optionals stdenv.hostPlatform.isLinux [ openssl ] @@ -27,11 +30,15 @@ rustPlatform.buildRustPackage rec { checkFlags = [ "--skip=tests::cli" ]; + passthru.updateScript = nix-update-script { }; + meta = with lib; { description = "Bundle any web page into a single HTML file"; mainProgram = "monolith"; homepage = "https://github.com/Y2Z/monolith"; - license = licenses.unlicense; + license = licenses.cc0; + platforms = lib.platforms.unix; + broken = stdenv.isDarwin; maintainers = with maintainers; [ Br1ght0ne ]; }; } diff --git a/pkgs/tools/security/metasploit/Gemfile b/pkgs/tools/security/metasploit/Gemfile index 1d1d18028d73..16e8d88deb07 100644 --- a/pkgs/tools/security/metasploit/Gemfile +++ b/pkgs/tools/security/metasploit/Gemfile @@ -1,4 +1,4 @@ # frozen_string_literal: true source "https://rubygems.org" -gem "metasploit-framework", git: "https://github.com/rapid7/metasploit-framework", ref: "refs/tags/6.4.35" +gem "metasploit-framework", git: "https://github.com/rapid7/metasploit-framework", ref: "refs/tags/6.4.36" diff --git a/pkgs/tools/security/metasploit/Gemfile.lock b/pkgs/tools/security/metasploit/Gemfile.lock index dd31cae7f785..1dbd6efe4073 100644 --- a/pkgs/tools/security/metasploit/Gemfile.lock +++ b/pkgs/tools/security/metasploit/Gemfile.lock @@ -1,9 +1,9 @@ GIT remote: https://github.com/rapid7/metasploit-framework - revision: 5c56ef7e53090ba4a2a019269e2a632edbbe1692 - ref: refs/tags/6.4.35 + revision: 65c9364cfbe9540e24a7c5312666e77e2de52389 + ref: refs/tags/6.4.36 specs: - metasploit-framework (6.4.35) + metasploit-framework (6.4.36) aarch64 abbrev actionpack (~> 7.0.0) diff --git a/pkgs/tools/security/metasploit/default.nix b/pkgs/tools/security/metasploit/default.nix index 782312de8a66..a49be1d4338d 100644 --- a/pkgs/tools/security/metasploit/default.nix +++ b/pkgs/tools/security/metasploit/default.nix @@ -15,13 +15,13 @@ let }; in stdenv.mkDerivation rec { pname = "metasploit-framework"; - version = "6.4.35"; + version = "6.4.36"; src = fetchFromGitHub { owner = "rapid7"; repo = "metasploit-framework"; rev = "refs/tags/${version}"; - hash = "sha256-oAz/74dt/Wcm4FX/kvJ0v3vz5ugp0Muu0Tx+w10cVz4="; + hash = "sha256-di7/LBqXrcIhy4UG5krAFSJ1ZhrJuGxEWJ25aVLuiGg="; }; nativeBuildInputs = [ diff --git a/pkgs/tools/security/metasploit/gemset.nix b/pkgs/tools/security/metasploit/gemset.nix index aeb9e5acc88c..a5820adc5097 100644 --- a/pkgs/tools/security/metasploit/gemset.nix +++ b/pkgs/tools/security/metasploit/gemset.nix @@ -734,12 +734,12 @@ platforms = []; source = { fetchSubmodules = false; - rev = "5c56ef7e53090ba4a2a019269e2a632edbbe1692"; - sha256 = "0gjp3ifw6ziws6pcpl19x3kg6yxzfkr95zsmw0k6gzbdhzpzy350"; + rev = "65c9364cfbe9540e24a7c5312666e77e2de52389"; + sha256 = "0s48xr96kfcxb126rf6939k7a8hmq15fc1l5rchw5bcp38ngybkn"; type = "git"; url = "https://github.com/rapid7/metasploit-framework"; }; - version = "6.4.35"; + version = "6.4.36"; }; metasploit-model = { groups = ["default"];