From ce6168bd6d81d156bd6f86080cd7d7a0ee06f15a Mon Sep 17 00:00:00 2001 From: emilylange Date: Thu, 7 Aug 2025 23:48:28 +0200 Subject: [PATCH] kanidm: use `finalAttrs` everywhere This makes the resulting derivation when using `overrideAttrs` more accurate and also fixes a discrepancy in `kanidmWithSecretProvisioning`. One would expect this change to be a no-op, but it isn't. Not because there is some unwanted change, but rather because unlike `kanidm_1_x.withSecretProvisioning`, `kanidmWithSecretProvisioning_1_x` used `kanidm` as a basis when it should have used `kanidm_1_x`. ~~~ # before nix-repl> kanidmWithSecretProvisioning_1_5.patches [ ./pkgs/by-name/ka/kanidm/provision-patches/1_6/oauth2-basic-secret-modify.patch ./pkgs/by-name/ka/kanidm/provision-patches/1_6/recover-account.patch ] # after nix-repl> kanidmWithSecretProvisioning_1_5.patches [ ./pkgs/by-name/ka/kanidm/provision-patches/1_5/oauth2-basic-secret-modify.patch ./pkgs/by-name/ka/kanidm/provision-patches/1_5/recover-account.patch ] ~~~ The change itself is written in a way that minimizes formatting changes enforced by `nixfmt`. For example, it would have been nice to access `finalAttrs.version` in `versionUnderscored` without having to make it a function, but that would have required to move the `let in` into `finalAttrs: {`, causing the entire attrset to reformat. Similarly, offloading this into `passthru` would have caused other bits to reformat because of the variable name length differences. --- pkgs/by-name/ka/kanidm/generic.nix | 39 +++++++++++++++--------------- pkgs/top-level/all-packages.nix | 27 +++++++++------------ 2 files changed, 31 insertions(+), 35 deletions(-) diff --git a/pkgs/by-name/ka/kanidm/generic.nix b/pkgs/by-name/ka/kanidm/generic.nix index 0810710fc854..be610935f5bd 100644 --- a/pkgs/by-name/ka/kanidm/generic.nix +++ b/pkgs/by-name/ka/kanidm/generic.nix @@ -22,7 +22,7 @@ pam, bashInteractive, rust-jemalloc-sys, - kanidm, + kanidmWithSecretProvisioning, # If this is enabled, kanidm will be built with two patches allowing both # oauth2 basic secrets and admin credentials to be provisioned. # This is NOT officially supported (and will likely never be), @@ -35,14 +35,8 @@ let arch = if stdenv.hostPlatform.isx86_64 then "x86_64" else "generic"; - versionUnderscored = builtins.replaceStrings [ "." ] [ "_" ] ( - lib.versions.majorMinor kanidm.version - ); - - provisionPatches = [ - (./. + "/provision-patches/${versionUnderscored}/oauth2-basic-secret-modify.patch") - (./. + "/provision-patches/${versionUnderscored}/recover-account.patch") - ]; + versionUnderscored = + finalAttrs: lib.replaceStrings [ "." ] [ "_" ] (lib.versions.majorMinor finalAttrs.version); upgradeNote = '' Please upgrade by verifying `kanidmd domain upgrade-check` and choosing the @@ -60,13 +54,16 @@ rustPlatform.buildRustPackage (finalAttrs: { src = fetchFromGitHub { owner = "kanidm"; repo = "kanidm"; - rev = "refs/tags/v${version}"; + tag = "v${finalAttrs.version}"; inherit hash; }; env.KANIDM_BUILD_PROFILE = "release_nixpkgs_${arch}"; - patches = lib.optionals enableSecretProvisioning provisionPatches; + patches = lib.optionals enableSecretProvisioning [ + (./. + "/provision-patches/${versionUnderscored finalAttrs}/oauth2-basic-secret-modify.patch") + (./. + "/provision-patches/${versionUnderscored finalAttrs}/recover-account.patch") + ]; postPatch = let @@ -75,7 +72,7 @@ rustPlatform.buildRustPackage (finalAttrs: { profile = { cpu_flags = if stdenv.hostPlatform.isx86_64 then "x86_64_legacy" else "none"; } - // lib.optionalAttrs (lib.versionAtLeast version "1.5") { + // lib.optionalAttrs (lib.versionAtLeast finalAttrs.version "1.5") { client_config_path = "/etc/kanidm/config"; resolver_config_path = "/etc/kanidm/unixd"; resolver_unix_shell_path = "${lib.getBin bashInteractive}/bin/bash"; @@ -136,24 +133,26 @@ rustPlatform.buildRustPackage (finalAttrs: { passthru = { tests = { - kanidm = nixosTests.kanidm versionUnderscored; - kanidm-provisioning = nixosTests.kanidm-provisioning versionUnderscored; + kanidm = nixosTests.kanidm (versionUnderscored finalAttrs); + kanidm-provisioning = nixosTests.kanidm-provisioning (versionUnderscored finalAttrs); }; updateScript = lib.optionals (!enableSecretProvisioning) (nix-update-script { extraArgs = [ "-vr" - "v(${lib.versions.major kanidm.version}\\.${lib.versions.minor kanidm.version}\\.[0-9]*)" + "v(${lib.versions.major finalAttrs.version}\\.${lib.versions.minor finalAttrs.version}\\.[0-9]*)" "--override-filename" - "pkgs/by-name/ka/kanidm/${versionUnderscored}.nix" + "pkgs/by-name/ka/kanidm/${versionUnderscored finalAttrs}.nix" ]; }); inherit enableSecretProvisioning; - withSecretProvisioning = kanidm.override { enableSecretProvisioning = true; }; + # Unfortunately there is no such thing as finalAttrs.finalPackage.override, + # so we have to resort to this. + withSecretProvisioning = kanidmWithSecretProvisioning; eolMessage = lib.optionalString (eolDate != null) '' - kanidm ${lib.versions.majorMinor version} is deprecated and will reach end-of-life on ${eolDate} + kanidm ${lib.versions.majorMinor finalAttrs.version} is deprecated and will reach end-of-life on ${eolDate} ${upgradeNote} ''; @@ -163,7 +162,7 @@ rustPlatform.buildRustPackage (finalAttrs: { requiredSystemFeatures = [ "big-parallel" ]; meta = { - changelog = "https://github.com/kanidm/kanidm/releases/tag/v${version}"; + changelog = "https://github.com/kanidm/kanidm/releases/tag/v${finalAttrs.version}"; description = "Simple, secure and fast identity management platform"; homepage = "https://github.com/kanidm/kanidm"; license = lib.licenses.mpl20; @@ -174,7 +173,7 @@ rustPlatform.buildRustPackage (finalAttrs: { ]; knownVulnerabilities = lib.optionals unsupported [ '' - kanidm ${lib.versions.majorMinor version} has reached end-of-life. + kanidm ${lib.versions.majorMinor finalAttrs.version} has reached end-of-life. ${upgradeNote} '' diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index 2187a7fa3929..90bc379bd4d2 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -10128,23 +10128,20 @@ with pkgs; jetty = jetty_12; - kanidm_1_5 = callPackage ../by-name/ka/kanidm/1_5.nix { kanidm = kanidm_1_5; }; - kanidm_1_6 = callPackage ../by-name/ka/kanidm/1_6.nix { kanidm = kanidm_1_6; }; - kanidm_1_7 = callPackage ../by-name/ka/kanidm/1_7.nix { kanidm = kanidm_1_7; }; - - kanidmWithSecretProvisioning = kanidmWithSecretProvisioning_1_6; - - kanidmWithSecretProvisioning_1_5 = callPackage ../by-name/ka/kanidm/1_5.nix { - enableSecretProvisioning = true; + kanidm_1_5 = callPackage ../by-name/ka/kanidm/1_5.nix { + kanidmWithSecretProvisioning = kanidmWithSecretProvisioning_1_5; + }; + kanidm_1_6 = callPackage ../by-name/ka/kanidm/1_6.nix { + kanidmWithSecretProvisioning = kanidmWithSecretProvisioning_1_6; + }; + kanidm_1_7 = callPackage ../by-name/ka/kanidm/1_7.nix { + kanidmWithSecretProvisioning = kanidmWithSecretProvisioning_1_7; }; - kanidmWithSecretProvisioning_1_6 = callPackage ../by-name/ka/kanidm/1_6.nix { - enableSecretProvisioning = true; - }; - - kanidmWithSecretProvisioning_1_7 = callPackage ../by-name/ka/kanidm/1_7.nix { - enableSecretProvisioning = true; - }; + kanidmWithSecretProvisioning = kanidm.override { enableSecretProvisioning = true; }; + kanidmWithSecretProvisioning_1_5 = kanidm_1_5.override { enableSecretProvisioning = true; }; + kanidmWithSecretProvisioning_1_6 = kanidm_1_6.override { enableSecretProvisioning = true; }; + kanidmWithSecretProvisioning_1_7 = kanidm_1_7.override { enableSecretProvisioning = true; }; knot-resolver = callPackage ../servers/dns/knot-resolver { systemd = systemdMinimal; # in closure already anyway