gador/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

kanidm: use finalAttrs everywhere

Browse Source 
This makes the resulting derivation when using `overrideAttrs` more
accurate and also fixes a discrepancy in `kanidmWithSecretProvisioning`.

One would expect this change to be a no-op, but it isn't. Not because
there is some unwanted change, but rather because unlike
`kanidm_1_x.withSecretProvisioning`, `kanidmWithSecretProvisioning_1_x`
used `kanidm` as a basis when it should have used `kanidm_1_x`.

~~~
# before
nix-repl> kanidmWithSecretProvisioning_1_5.patches
[
  ./pkgs/by-name/ka/kanidm/provision-patches/1_6/oauth2-basic-secret-modify.patch
  ./pkgs/by-name/ka/kanidm/provision-patches/1_6/recover-account.patch
]

# after
nix-repl> kanidmWithSecretProvisioning_1_5.patches
[
  ./pkgs/by-name/ka/kanidm/provision-patches/1_5/oauth2-basic-secret-modify.patch
  ./pkgs/by-name/ka/kanidm/provision-patches/1_5/recover-account.patch
]
~~~

The change itself is written in a way that minimizes formatting changes
enforced by `nixfmt`. For example, it would have been nice to access
`finalAttrs.version` in `versionUnderscored` without having to make it a
function, but that would have required to move the `let in` into
`finalAttrs: {`, causing the entire attrset to reformat. Similarly,
offloading this into `passthru` would have caused other bits to reformat
because of the variable name length differences.
This commit is contained in:
emilylange
2025-08-08 14:42:07 +02:00
parent 0283151f7f
commit ce6168bd6d
2 changed files with 31 additions and 35 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkgs/by-name/ka/kanidm/generic.nix
+19 -20
View File
@@ -22,7 +22,7 @@
pam,
bashInteractive,
rust-jemalloc-sys,
kanidm,
kanidmWithSecretProvisioning,
# If this is enabled, kanidm will be built with two patches allowing both
# oauth2 basic secrets and admin credentials to be provisioned.
# This is NOT officially supported (and will likely never be),
@@ -35,14 +35,8 @@
let
arch = if stdenv.hostPlatform.isx86_64 then "x86_64" else "generic";
versionUnderscored = builtins.replaceStrings [ "." ] [ "_" ] (
lib.versions.majorMinor kanidm.version
);
provisionPatches = [
(./. + "/provision-patches/${versionUnderscored}/oauth2-basic-secret-modify.patch")
(./. + "/provision-patches/${versionUnderscored}/recover-account.patch")
];
versionUnderscored =
finalAttrs: lib.replaceStrings [ "." ] [ "_" ] (lib.versions.majorMinor finalAttrs.version);
upgradeNote = ''
Please upgrade by verifying `kanidmd domain upgrade-check` and choosing the
@@ -60,13 +54,16 @@ rustPlatform.buildRustPackage (finalAttrs: {
src = fetchFromGitHub {
owner = "kanidm";
repo = "kanidm";
rev = "refs/tags/v${version}";
tag = "v${finalAttrs.version}";
inherit hash;
};
env.KANIDM_BUILD_PROFILE = "release_nixpkgs_${arch}";
patches = lib.optionals enableSecretProvisioning provisionPatches;
patches = lib.optionals enableSecretProvisioning [
(./. + "/provision-patches/${versionUnderscored finalAttrs}/oauth2-basic-secret-modify.patch")
(./. + "/provision-patches/${versionUnderscored finalAttrs}/recover-account.patch")
];
postPatch =
let
@@ -75,7 +72,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
profile = {
cpu_flags = if stdenv.hostPlatform.isx86_64 then "x86_64_legacy" else "none";
}
// lib.optionalAttrs (lib.versionAtLeast version "1.5") {
// lib.optionalAttrs (lib.versionAtLeast finalAttrs.version "1.5") {
client_config_path = "/etc/kanidm/config";
resolver_config_path = "/etc/kanidm/unixd";
resolver_unix_shell_path = "${lib.getBin bashInteractive}/bin/bash";
@@ -136,24 +133,26 @@ rustPlatform.buildRustPackage (finalAttrs: {
passthru = {
tests = {
kanidm = nixosTests.kanidm versionUnderscored;
kanidm-provisioning = nixosTests.kanidm-provisioning versionUnderscored;
kanidm = nixosTests.kanidm (versionUnderscored finalAttrs);
kanidm-provisioning = nixosTests.kanidm-provisioning (versionUnderscored finalAttrs);
};
updateScript = lib.optionals (!enableSecretProvisioning) (nix-update-script {
extraArgs = [
"-vr"
"v(${lib.versions.major kanidm.version}\\.${lib.versions.minor kanidm.version}\\.[0-9]*)"
"v(${lib.versions.major finalAttrs.version}\\.${lib.versions.minor finalAttrs.version}\\.[0-9]*)"
"--override-filename"
"pkgs/by-name/ka/kanidm/${versionUnderscored}.nix"
"pkgs/by-name/ka/kanidm/${versionUnderscored finalAttrs}.nix"
];
});
inherit enableSecretProvisioning;
withSecretProvisioning = kanidm.override { enableSecretProvisioning = true; };
# Unfortunately there is no such thing as finalAttrs.finalPackage.override,
# so we have to resort to this.
withSecretProvisioning = kanidmWithSecretProvisioning;
eolMessage = lib.optionalString (eolDate != null) ''
kanidm ${lib.versions.majorMinor version} is deprecated and will reach end-of-life on ${eolDate}
kanidm ${lib.versions.majorMinor finalAttrs.version} is deprecated and will reach end-of-life on ${eolDate}
${upgradeNote}
'';
@@ -163,7 +162,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
requiredSystemFeatures = [ "big-parallel" ];
meta = {
changelog = "https://github.com/kanidm/kanidm/releases/tag/v${version}";
changelog = "https://github.com/kanidm/kanidm/releases/tag/v${finalAttrs.version}";
description = "Simple, secure and fast identity management platform";
homepage = "https://github.com/kanidm/kanidm";
license = lib.licenses.mpl20;
@@ -174,7 +173,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
];
knownVulnerabilities = lib.optionals unsupported [
''
kanidm ${lib.versions.majorMinor version} has reached end-of-life.
kanidm ${lib.versions.majorMinor finalAttrs.version} has reached end-of-life.
${upgradeNote}
''
pkgs/top-level/all-packages.nix
+12 -15
View File
@@ -10128,23 +10128,20 @@ with pkgs;
jetty = jetty_12;
kanidm_1_5 = callPackage ../by-name/ka/kanidm/1_5.nix { kanidm = kanidm_1_5; };
kanidm_1_6 = callPackage ../by-name/ka/kanidm/1_6.nix { kanidm = kanidm_1_6; };
kanidm_1_7 = callPackage ../by-name/ka/kanidm/1_7.nix { kanidm = kanidm_1_7; };
kanidmWithSecretProvisioning = kanidmWithSecretProvisioning_1_6;
kanidmWithSecretProvisioning_1_5 = callPackage ../by-name/ka/kanidm/1_5.nix {
enableSecretProvisioning = true;
kanidm_1_5 = callPackage ../by-name/ka/kanidm/1_5.nix {
kanidmWithSecretProvisioning = kanidmWithSecretProvisioning_1_5;
};
kanidm_1_6 = callPackage ../by-name/ka/kanidm/1_6.nix {
kanidmWithSecretProvisioning = kanidmWithSecretProvisioning_1_6;
};
kanidm_1_7 = callPackage ../by-name/ka/kanidm/1_7.nix {
kanidmWithSecretProvisioning = kanidmWithSecretProvisioning_1_7;
};
kanidmWithSecretProvisioning_1_6 = callPackage ../by-name/ka/kanidm/1_6.nix {
enableSecretProvisioning = true;
};
kanidmWithSecretProvisioning_1_7 = callPackage ../by-name/ka/kanidm/1_7.nix {
enableSecretProvisioning = true;
};
kanidmWithSecretProvisioning = kanidm.override { enableSecretProvisioning = true; };
kanidmWithSecretProvisioning_1_5 = kanidm_1_5.override { enableSecretProvisioning = true; };
kanidmWithSecretProvisioning_1_6 = kanidm_1_6.override { enableSecretProvisioning = true; };
kanidmWithSecretProvisioning_1_7 = kanidm_1_7.override { enableSecretProvisioning = true; };
knot-resolver = callPackage ../servers/dns/knot-resolver {
systemd = systemdMinimal; # in closure already anyway