gador/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge 6a39c6e495 into haskell-updates

Browse Source
This commit is contained in:
nixpkgs-ci[bot]
2025-04-09 00:19:32 +00:00
committed by GitHub
parent fcd01e9240 6a39c6e495
commit d2e4ebc842
476 changed files with 6803 additions and 3376 deletions
Download Patch File Download Diff File Expand all files Collapse all files
doc/release-notes/rl-2505.section.md
+6 -1
View File
@@ -28,6 +28,8 @@
NEWS can been viewed from Emacs by typing `C-h n`, or by clicking `Help->Emacs News` from the menu bar.
It can also be browsed [online](https://git.savannah.gnu.org/cgit/emacs.git/tree/etc/NEWS?h=emacs-30).
- The default openexr version has been updated to 3.2.4.
- The default PHP version has been updated to 8.4.
- The default Erlang OTP version has been updated to 27.
@@ -113,6 +115,8 @@
- `pkgs.nextcloud28` has been removed since it's out of support upstream.
- `centrifugo` was updated to v6, which uses a new config format. See [upstream documentation](https://centrifugal.dev/docs/getting-started/migration_v6) for migration.
- `teleport` has been upgraded from major version 16 to major version 17.
Refer to [upstream upgrade instructions](https://goteleport.com/docs/upgrading/overview/)
and [release notes for v17](https://goteleport.com/docs/changelog/#1701-11152024).
@@ -276,6 +280,7 @@
- `docker_24` has been removed, as it was EOL with vulnerabilities since June 08, 2024.
- Emacs 28 and 29 have been removed.
- Emacs 28 Macport has been removed, while CVEs of Emacs 29 Macport are patched.
- `containerd` has been updated to v2, which contains breaking changes. See the [containerd
2.0](https://github.com/containerd/containerd/blob/main/docs/containerd-2.0.md) documentation for more
@@ -331,7 +336,7 @@
### NexusMods.App upgraded {#sec-nixpkgs-release-25.05-incompatibilities-nexusmods-app-upgraded}
- `nexusmods-app` has been upgraded from version 0.6.3 to 0.8.3.
- `nexusmods-app` has been upgraded from version 0.6.3 to 0.9.2.
- Before upgrading, you **must reset all app state** (mods, games, settings, etc). NexusMods.App will crash if any state from a version older than 0.7.0 is still present.
lib/default.nix
+1
View File
@@ -446,6 +446,7 @@ let
fixupOptionType
mkIf
mkAssert
mkDefinition
mkMerge
mkOverride
mkOptionDefault
lib/modules.nix
+16 -4
View File
@@ -1097,10 +1097,16 @@ let
# Process mkMerge and mkIf properties.
defs' = concatMap (
m:
map (value: {
inherit (m) file;
inherit value;
}) (addErrorContext "while evaluating definitions from `${m.file}':" (dischargeProperties m.value))
map (
value:
if value._type or null == "definition" then
value
else
{
inherit (m) file;
inherit value;
}
) (addErrorContext "while evaluating definitions from `${m.file}':" (dischargeProperties m.value))
) defs;
# Process mkOverride properties.
@@ -1365,6 +1371,11 @@ let
inherit contents;
};
/**
Return a definition with file location information.
*/
mkDefinition = args@{ file, value, ... }: args // { _type = "definition"; };
mkOverride = priority: content: {
_type = "override";
inherit priority content;
@@ -2095,6 +2106,7 @@ private
mkBefore
mkChangedOptionModule
mkDefault
mkDefinition
mkDerivedConfig
mkFixStrictness
mkForce
lib/tests/modules.sh
+8
View File
@@ -673,6 +673,14 @@ checkConfigError 'The option .conflictingPathOptionType. in .*/pathWith.nix. is
# types.pathWith { inStore = true; absolute = false; }
checkConfigError 'In pathWith, inStore means the path must be absolute' config.impossiblePathOptionType ./pathWith.nix
# mkDefinition
# check that mkDefinition 'file' is printed in the error message
checkConfigError 'Cannot merge definitions.*\n\s*- In .file.*\n\s*- In .other.*' config.conflict ./mkDefinition.nix
checkConfigError 'A definition for option .viaOptionDefault. is not of type .boolean.*' config.viaOptionDefault ./mkDefinition.nix
checkConfigOutput '^true$' config.viaConfig ./mkDefinition.nix
checkConfigOutput '^true$' config.mkMerge ./mkDefinition.nix
checkConfigOutput '^true$' config.mkForce ./mkDefinition.nix
cat <<EOF
====== module tests ======
$pass Pass
lib/tests/modules/mkDefinition.nix
+71
View File
@@ -0,0 +1,71 @@
{ lib, ... }:
let
inherit (lib)
mkOption
mkDefinition
mkOptionDefault
;
in
{
imports = [
{
_file = "file";
options.conflict = mkOption {
default = 1;
};
config.conflict = mkDefinition {
file = "other";
value = mkOptionDefault 42;
};
}
{
# Check that mkDefinition works within 'config'
options.viaConfig = mkOption { };
config.viaConfig = mkDefinition {
file = "other";
value = true;
};
}
{
# Check mkMerge can wrap mkDefinitions
# Not the other way around
options.mkMerge = mkOption {
type = lib.types.bool;
};
config.mkMerge = lib.mkMerge [
(mkDefinition {
file = "a.nix";
value = true;
})
(mkDefinition {
file = "b.nix";
value = true;
})
];
}
{
# Check mkDefinition can use mkForce on the value
# Not the other way around
options.mkForce = mkOption {
type = lib.types.bool;
default = false;
};
config.mkForce = mkDefinition {
file = "other";
value = lib.mkForce true;
};
}
{
# Currently expects an error
# mkDefinition doesn't work on option default
# This is a limitation and might be resolved in the future
options.viaOptionDefault = mkOption {
type = lib.types.bool;
default = mkDefinition {
file = "other";
value = true;
};
};
}
];
}
lib/tests/nix-for-tests.nix
+1 -1
View File
@@ -14,7 +14,7 @@
builtins.mapAttrs (
attr: pkg:
if lib.versionAtLeast pkg.version "2.26" then
if lib.versionAtLeast pkg.version "2.29pre" then
pkg.overrideScope (finalScope: prevScope: { aws-sdk-cpp = null; })
else
pkg.override { withAWS = false; }
maintainers/maintainer-list.nix
+37
View File
@@ -3223,6 +3223,12 @@
githubId = 5718007;
name = "Bastian Köcher";
};
blackzeshi = {
name = "blackzeshi";
email = "sergey_zhuzhgov@mail.ru";
github = "zeshi09";
githubId = 105582686;
};
blakesmith = {
name = "Blake Smith";
email = "blakesmith0@gmail.com";
@@ -3748,6 +3754,12 @@
githubId = 382011;
name = "c4605";
};
c4f3z1n = {
name = "João Nogueira";
email = "shires.waking0d@icloud.com";
github = "c4f3z1n";
githubId = 22820003;
};
c4thebomb = {
name = "Ceferino Patino";
email = "c4patino@gmail.com";
@@ -4981,6 +4993,12 @@
name = "Daniel McCarney";
keys = [ { fingerprint = "8026 D24A A966 BF9C D3CD CB3C 08FB 2BFC 470E 75B4"; } ];
};
cr0n = {
name = "cr0n";
github = "n0rc";
githubId = 355000;
email = "cr0n@cypherpunks.cc";
};
Crafter = {
email = "crafter@crafter.rocks";
github = "Craftzman7";
@@ -6444,6 +6462,11 @@
github = "DrakeTDL";
githubId = 22124013;
};
drakon64 = {
name = "Adam Chance";
email = "nixpkgs@drakon.cloud";
githubId = 6444703;
};
dramaturg = {
email = "seb@ds.ag";
github = "dramaturg";
@@ -9896,6 +9919,12 @@
github = "the-furry-hubofeverything";
githubId = 53921912;
};
hucancode = {
email = "hucancode@gmail.com";
github = "hucancode";
githubId = 15852849;
name = "Bang Nguyen Huu";
};
hufman = {
email = "hufman@gmail.com";
github = "hufman";
@@ -19937,6 +19966,14 @@
githubId = 5653911;
name = "Rampoina";
};
rane = {
name = "Rane";
email = "rane+git@junkyard.systems";
matrix = "@rane:junkyard.systems";
github = "digitalrane";
githubId = 1829286;
keys = [ { fingerprint = "EBB6 0EE1 488F D04C D922 C039 AE96 1AF5 9D40 10B5"; } ];
};
ranfdev = {
email = "ranfdev@gmail.com";
name = "Lorenzo Miglietta";
maintainers/team-list.nix
+1
View File
@@ -1183,6 +1183,7 @@ with lib.maintainers;
hehongbo
lach
sigmasquadron
rane
];
scope = "Maintain the Xen Project Hypervisor and the related tooling ecosystem.";
shortName = "Xen Project Hypervisor";
nixos/doc/manual/development/option-def.section.md
+62
View File
@@ -123,3 +123,65 @@ they were declared in separate modules. This can be done using
];
}
```
## Free-floating definitions {#sec-option-definitions-definitions}
:::{.note}
The module system internally transforms module syntax into definitions. This always happens internally.
:::
It is possible to create first class definitions which are not transformed _again_ into definitions by the module system.
Usually the file location of a definition is implicit and equal to the file it came from.
However, when manipulating definitions, it may be useful for them to be completely self-contained (or "free-floating").
A free-floating definition is created with `mkDefinition { file = ...; value = ...; }`.
Preserving the file location creates better error messages, for example when copying definitions from one option to another.
Other properties like `mkOverride` `mkMerge` `mkAfter` can be used in the `value` attribute but not on the entire definition.
This is what would work
```nix
mkDefinition {
value = mkForce 42;
file = "somefile.nix";
}
```
While this would NOT work.
```nix
mkForce (mkDefinition {
value = 42;
file = "somefile.nix";
})
```
The following shows an example configuration that yields an error with the custom position information:
```nix
{
_file = "file.nix";
options.foo = mkOption {
default = 13;
};
config.foo = lib.mkDefinition {
file = "custom place";
# mkOptionDefault creates a conflict with the option foo's `default = 1` on purpose
# So we see the error message below contains the conflicting values and different positions
value = lib.mkOptionDefault 42;
};
}
```
evaluating the module yields the following error:
```
error: Cannot merge definitions of `foo'. Definition values:
- In `file.nix': 13
- In `custom place': 42
```
To set the file location for all definitions in a module, you may add the `_file` module syntax attribute, which has a similar effect to using `mkDefinition` on all definitions in the module, without the hassle.
nixos/doc/manual/redirects.json
+3
View File
@@ -1664,6 +1664,9 @@
"sec-option-definitions-merging": [
"index.html#sec-option-definitions-merging"
],
"sec-option-definitions-definitions": [
"index.html#sec-option-definitions-definitions"
],
"sec-assertions": [
"index.html#sec-assertions"
],
nixos/doc/manual/release-notes/rl-2505.section.md
+3
View File
@@ -22,6 +22,7 @@
- The Mattermost module ({option}`services.mattermost`) and packages (`mattermost` and `mmctl`) have been substantially updated:
- {option}`services.mattermost.preferNixConfig` now defaults to true if you advance {option}`system.stateVersion` to 25.05. This means that if you have {option}`services.mattermost.mutableConfig` set, NixOS will override your settings to those that you define in the module. It is recommended to leave this at the default, even if you used a mutable config before, because it will ensure that your Mattermost data directories are correct. If you moved your data directories, you may want to review the module changes before upgrading.
- Mattermost telemetry reporting is now disabled by default, though security update notifications are enabled. Look at {option}`services.mattermost.telemetry` for options to control this behavior.
- `pkgs.mattermost` has been updated from 9.11 to 10.5 to track the latest extended support release, since 9.11 will become end-of-life during the lifetime of NixOS 25.05.
- `pkgs.mattermostLatest` is now an option to track the latest (non-prerelease) Mattermost release. We test upgrade migrations from ESR releases (`pkgs.mattermost`) to `pkgs.mattermostLatest`.
- The Mattermost frontend is now built from source and can be overridden.
- Note that the Mattermost derivation containing both the webapp and server is now wrapped to allow them to be built independently, so overrides to both webapp and server look like `mattermost.overrideAttrs (prev: { webapp = prev.webapp.override { ... }; server = prev.server.override { ... }; })` now.
@@ -74,6 +75,8 @@
- [MaryTTS](https://github.com/marytts/marytts), an open-source, multilingual text-to-speech synthesis system written in pure Java. Available as [services.marytts](options.html#opt-services.marytts).
- [Reposilite](https://reposilite.com), a lightweight and easy-to-use repository manager for Maven-based artifacts in the JVM ecosystem. Available as [services.reposilite](options.html#opt-services.reposilite).
- [networking.modemmanager](options.html#opt-networking.modemmanager) has been split out of [networking.networkmanager](options.html#opt-networking.networkmanager). NetworkManager still enables ModemManager by default, but options exist now to run NetworkManager without ModemManager.
- [Routinator 3000](https://nlnetlabs.nl/projects/routing/routinator/), a full-featured RPKI Relying Party software package that runs as a service which periodically downloads and verifies RPKI data.
nixos/modules/installer/tools/nix-fallback-paths.nix
+6 -6
View File
@@ -1,8 +1,8 @@
{
x86_64-linux = "/nix/store/00a7rdfwhm6avqkgj68grddbzyz3h6ql-nix-2.24.13";
i686-linux = "/nix/store/s6c620v60hfishzi1lbfpryk65lbvg8g-nix-2.24.13";
aarch64-linux = "/nix/store/7yg9is1shh3383iwi6qynz3vh91l1f9d-nix-2.24.13";
riscv64-linux = "/nix/store/fagjkrx5r6p52xp8qb5581bmnlgp01sn-nix-riscv64-unknown-linux-gnu-2.24.13";
x86_64-darwin = "/nix/store/ifby7rrgkkly5pzjnyac90lzvrak3i9y-nix-2.24.13";
aarch64-darwin = "/nix/store/b0rbdp6ba2fprprpgsw1a8pplzg0j324-nix-2.24.13";
x86_64-linux = "/nix/store/kvqnqgjw3k0xmv3ypzajz3c5wf1pxnbs-nix-2.24.14";
i686-linux = "/nix/store/292xy9z1vjmy0888bzadmj9fmq1ccapv-nix-2.24.14";
aarch64-linux = "/nix/store/qsy62z6rk31s8s937nvkcdhn0ds62yax-nix-2.24.14";
riscv64-linux = "/nix/store/zvrzwzv534zcmhw4ai1hbc4iz229hk3p-nix-riscv64-unknown-linux-gnu-2.24.14";
x86_64-darwin = "/nix/store/jc7x6906wyy6csgf6br1gbwkw56nxm4l-nix-2.24.14";
aarch64-darwin = "/nix/store/sfrmn30fijs6qpfi7ckjkv2vdr4z590h-nix-2.24.14";
}
nixos/modules/module-list.nix
+2
View File
@@ -361,6 +361,7 @@
./programs/zsh/zsh.nix
./rename.nix
./security/acme
./security/agnos.nix
./security/apparmor.nix
./security/audit.nix
./security/auditd.nix
@@ -1609,6 +1610,7 @@
./services/web-apps/pretix.nix
./services/web-apps/privatebin.nix
./services/web-apps/prosody-filer.nix
./services/web-apps/reposilite.nix
./services/web-apps/rimgo.nix
./services/web-apps/rutorrent.nix
./services/web-apps/screego.nix
nixos/modules/programs/amnezia-vpn.nix
+12 -4
View File
@@ -10,16 +10,24 @@ in
{
options.programs.amnezia-vpn = {
enable = lib.mkEnableOption "The AmneziaVPN client";
package = lib.mkPackageOption pkgs "amnezia-vpn" { };
};
config = lib.mkIf cfg.enable {
environment.systemPackages = [ pkgs.amnezia-vpn ];
services.dbus.packages = [ pkgs.amnezia-vpn ];
environment.systemPackages = [ cfg.package ];
services.dbus.packages = [ cfg.package ];
services.resolved.enable = true;
systemd = {
packages = [ pkgs.amnezia-vpn ];
services."AmneziaVPN".wantedBy = [ "multi-user.target" ];
packages = [ cfg.package ];
services."AmneziaVPN" = {
wantedBy = [ "multi-user.target" ];
path = with pkgs; [
procps
iproute2
sudo
];
};
};
};
nixos/modules/security/agnos.nix
+314
View File
@@ -0,0 +1,314 @@
{
config,
lib,
pkgs,
...
}:
let
cfg = config.security.agnos;
format = pkgs.formats.toml { };
name = "agnos";
stateDir = "/var/lib/${name}";
accountType =
let
inherit (lib) types mkOption;
in
types.submodule {
freeformType = format.type;
options = {
email = mkOption {
type = types.str;
description = ''
Email associated with this account.
'';
};
private_key_path = mkOption {
type = types.str;
description = ''
Path of the PEM-encoded private key for this account.
Currently, only RSA keys are supported.
If this path does not exist, then the behavior depends on `generateKeys.enable`.
When this option is `true`,
the key will be automatically generated and saved to this path.
When it is `false`, agnos will fail.
If a relative path is specified,
the key will be looked up (or generated and saved to) under `${stateDir}`.
'';
};
certificates = mkOption {
type = types.listOf certificateType;
description = ''
Certificates for agnos to issue or renew.
'';
};
};
};
certificateType =
let
inherit (lib) types literalExpression mkOption;
in
types.submodule {
freeformType = format.type;
options = {
domains = mkOption {
type = types.listOf types.str;
description = ''
Domains the certificate represents
'';
example = literalExpression ''["a.example.com", "b.example.com", "*b.example.com"]'';
};
fullchain_output_file = mkOption {
type = types.str;
description = ''
Output path for the full chain including the acquired certificate.
If a relative path is specified, the file will be created in `${stateDir}`.
'';
};
key_output_file = mkOption {
type = types.str;
description = ''
Output path for the certificate private key.
If a relative path is specified, the file will be created in `${stateDir}`.
'';
};
};
};
in
{
options.security.agnos =
let
inherit (lib) types mkEnableOption mkOption;
in
{
enable = mkEnableOption name;
settings = mkOption {
description = "Settings";
type = types.submodule {
freeformType = format.type;
options = {
dns_listen_addr = mkOption {
type = types.str;
default = "0.0.0.0:53";
description = ''
Address for agnos to listen on.
Note that this needs to be reachable by the outside world,
and 53 is required in most situations
since `NS` records do not allow specifying the port.
'';
};
accounts = mkOption {
type = types.listOf accountType;
description = ''
A list of ACME accounts.
Each account is associated with an email address
and can be used to obtain an arbitrary amount of certificate
(subject to provider's rate limits,
see e.g. [Let's Encrypt Rate Limits](https://letsencrypt.org/docs/rate-limits/)).
'';
};
};
};
};
generateKeys = {
enable = mkOption {
type = types.bool;
default = false;
description = ''
Enable automatic generation of account keys.
When this is `true`, a key will be generated for each account where
the file referred to by the `private_key` path does not exist yet.
Currently, only RSA keys can be generated.
'';
};
keySize = mkOption {
type = types.int;
default = 4096;
description = ''
Key size in bits to use when generating new keys.
'';
};
};
server = mkOption {
type = types.nullOr types.str;
default = null;
description = ''
ACME Directory Resource URI. Defaults to Let's Encrypt's production endpoint,
`https://acme-v02.api.letsencrypt.org/directory`, if unset.
'';
};
serverCa = mkOption {
type = types.nullOr types.path;
default = null;
description = ''
The root certificate (in PEM format) of the ACME server's HTTPS interface.
'';
};
persistent = mkOption {
type = types.bool;
default = true;
description = ''
When `true`, use a persistent systemd timer.
'';
};
startAt = mkOption {
type = types.either types.str (types.listOf types.str);
default = "daily";
example = "02:00";
description = ''
How often or when to run agnos.
The format is described in
{manpage}`systemd.time(7)`.
'';
};
temporarilyOpenFirewall = mkOption {
type = types.bool;
default = false;
description = ''
When `true`, will open the port specified in `settings.dns_listen_addr`
before running the agnos service, and close it when agnos finishes running.
'';
};
group = mkOption {
type = types.str;
default = name;
description = ''
Group to run Agnos as. The acquired certificates will be owned by this group.
'';
};
user = mkOption {
type = types.str;
default = name;
description = ''
User to run Agnos as. The acquired certificates will be owned by this user.
'';
};
};
config =
let
configFile = format.generate "agnos.toml" cfg.settings;
port = lib.toInt (lib.last (builtins.split ":" cfg.settings.dns_listen_addr));
useNftables = config.networking.nftables.enable;
# nftables implementation for temporarilyOpenFirewall
nftablesSetup = pkgs.writeShellScript "agnos-fw-setup" ''
${lib.getExe pkgs.nftables} add element inet nixos-fw temp-ports "{ tcp . ${toString port} }"
${lib.getExe pkgs.nftables} add element inet nixos-fw temp-ports "{ udp . ${toString port} }"
'';
nftablesTeardown = pkgs.writeShellScript "agnos-fw-teardown" ''
${lib.getExe pkgs.nftables} delete element inet nixos-fw temp-ports "{ tcp . ${toString port} }"
${lib.getExe pkgs.nftables} delete element inet nixos-fw temp-ports "{ udp . ${toString port} }"
'';
# iptables implementation for temporarilyOpenFirewall
helpers = ''
function ip46tables() {
${lib.getExe' pkgs.iptables "iptables"} -w "$@"
${lib.getExe' pkgs.iptables "ip6tables"} -w "$@"
}
'';
fwFilter = ''--dport ${toString port} -j ACCEPT -m comment --comment "agnos"'';
iptablesSetup = pkgs.writeShellScript "agnos-fw-setup" ''
${helpers}
ip46tables -I INPUT 1 -p tcp ${fwFilter}
ip46tables -I INPUT 1 -p udp ${fwFilter}
'';
iptablesTeardown = pkgs.writeShellScript "agnos-fw-setup" ''
${helpers}
ip46tables -D INPUT -p tcp ${fwFilter}
ip46tables -D INPUT -p udp ${fwFilter}
'';
in
lib.mkIf cfg.enable {
assertions = [
{
assertion = !cfg.temporarilyOpenFirewall || config.networking.firewall.enable;
message = "temporarilyOpenFirewall is only useful when firewall is enabled";
}
];
systemd.services.agnos = {
serviceConfig = {
ExecStartPre =
lib.optional cfg.generateKeys.enable ''
${pkgs.agnos}/bin/agnos-generate-accounts-keys \
--no-confirm \
--key-size ${toString cfg.generateKeys.keySize} \
${configFile}
''
++ lib.optional cfg.temporarilyOpenFirewall (
"+" + (if useNftables then nftablesSetup else iptablesSetup)
);
ExecStopPost = lib.optional cfg.temporarilyOpenFirewall (
"+" + (if useNftables then nftablesTeardown else iptablesTeardown)
);
ExecStart = ''
${pkgs.agnos}/bin/agnos \
${if cfg.server != null then "--acme-url=${cfg.server}" else "--no-staging"} \
${lib.optionalString (cfg.serverCa != null) "--acme-serv-ca=${cfg.serverCa}"} \
${configFile}
'';
Type = "oneshot";
User = cfg.user;
Group = cfg.group;
StateDirectory = name;
StateDirectoryMode = "0750";
WorkingDirectory = "${stateDir}";
# Allow binding privileged ports if necessary
CapabilityBoundingSet = lib.mkIf (port < 1024) [ "CAP_NET_BIND_SERVICE" ];
AmbientCapabilities = lib.mkIf (port < 1024) [ "CAP_NET_BIND_SERVICE" ];
};
after = [
"firewall.target"
"network-online.target"
"nftables.service"
];
wants = [ "network-online.target" ];
};
systemd.timers.agnos = {
timerConfig = {
OnCalendar = cfg.startAt;
Persistent = cfg.persistent;
Unit = "agnos.service";
};
wantedBy = [ "timers.target" ];
};
users.groups = lib.mkIf (cfg.group == name) {
${cfg.group} = { };
};
users.users = lib.mkIf (cfg.user == name) {
${cfg.user} = {
isSystemUser = true;
description = "Agnos service user";
group = cfg.group;
};
};
};
}
nixos/modules/services/backup/syncoid.nix
+6 -3
View File
@@ -106,14 +106,17 @@ in
package = lib.mkPackageOption pkgs "sanoid" { };
interval = lib.mkOption {
type = lib.types.str;
type = with lib.types; either str (listOf str);
default = "hourly";
example = "*-*-* *:15:00";
description = ''
Run syncoid at this interval. The default is to run hourly.
The format is described in
{manpage}`systemd.time(7)`.
Must be in the format described in {manpage}`systemd.time(7)`. This is
equivalent to adding a corresponding timer unit with
{option}`OnCalendar` set to the value given here.
Set to an empty list to avoid starting syncoid automatically.
'';
};
nixos/modules/services/databases/mysql.nix
+46 -44
View File
@@ -18,6 +18,22 @@ let
format = pkgs.formats.ini { listsAsDuplicateKeys = true; };
configFile = format.generate "my.cnf" cfg.settings;
generateClusterAddressExpr = ''
if (config.services.mysql.galeraCluster.nodeAddresses == [ ]) then
""
else
"gcomm://''${builtins.concatStringsSep \",\" config.services.mysql.galeraCluster.nodeAddresses}"
+ lib.optionalString (config.services.mysql.galeraCluster.clusterPassword != "")
"?gmcast.seg=1:''${config.services.mysql.galeraCluster.clusterPassword}"
'';
generateClusterAddress =
if (cfg.galeraCluster.nodeAddresses == [ ]) then
""
else
"gcomm://${builtins.concatStringsSep "," cfg.galeraCluster.nodeAddresses}"
+ lib.optionalString (
cfg.galeraCluster.clusterPassword != ""
) "?gmcast.seg=1:${cfg.galeraCluster.clusterPassword}";
in
{
@@ -378,22 +394,8 @@ in
type = lib.types.str;
description = "Full Galera cluster connection string. If nodeAddresses is set, this will be auto-generated, but you can override it with a custom value. Format is typically 'gcomm://node1,node2,node3' with optional parameters.";
example = "gcomm://10.0.0.10,10.0.0.20,10.0.0.30?gmcast.seg=1:SomePassword";
default =
if (cfg.galeraCluster.nodeAddresses == [ ]) then
""
else
"gcomm://${builtins.concatStringsSep "," cfg.galeraCluster.nodeAddresses}"
+ lib.optionalString (
cfg.galeraCluster.clusterPassword != ""
) "?gmcast.seg=1:${cfg.galeraCluster.clusterPassword}";
defaultText = lib.literalExpression ''
if (config.services.mysql.galeraCluster.nodeAddresses == [ ]) then
""
else
"gcomm://''${builtins.concatStringsSep \",\" config.services.mysql.galeraCluster.nodeAddresses}"
+ lib.optionalString (config.services.mysql.galeraCluster.clusterPassword != "")
"?gmcast.seg=1:''${config.services.mysql.galeraCluster.clusterPassword}"
'';
default = ""; # will be evaluate by generateClusterAddress
defaultText = lib.literalExpression generateClusterAddressExpr;
};
};
@@ -404,34 +406,30 @@ in
###### implementation
config = lib.mkIf cfg.enable {
assertions = [
{
assertion = !cfg.galeraCluster.enable || isMariaDB;
message = "'services.mysql.galeraCluster.enable' expect services.mysql.package to be an mariadb variant";
}
{
assertion =
!cfg.galeraCluster.enable
|| (
assertions =
[
{
assertion = !cfg.galeraCluster.enable || isMariaDB;
message = "'services.mysql.galeraCluster.enable' expect services.mysql.package to be an mariadb variant";
}
]
# galeraCluster options checks
++ lib.optionals cfg.galeraCluster.enable [
{
assertion =
cfg.galeraCluster.localAddress != ""
&& (cfg.galeraCluster.nodeAddresses != [ ] || cfg.galeraCluster.clusterAddress != "")
);
message = "mariadb galera cluster is enabled but the localAddress and (nodeAddresses or clusterAddress) are not set";
}
{
assertion = !(cfg.galeraCluster.clusterAddress != "" && cfg.galeraCluster.clusterPassword != "");
message = "mariadb galera clusterPassword is set but overwritten by clusterAddress";
}
{
assertion =
!(
cfg.galeraCluster.enable
&& cfg.galeraCluster.nodeAddresses != [ ]
&& cfg.galeraCluster.clusterAddress != ""
);
message = "When services.mysql.galeraCluster.clusterAddress is set, setting services.mysql.galeraCluster.nodeAddresses is redundant and will be overwritten by clusterAddress. Choose one approach.";
}
];
&& (cfg.galeraCluster.nodeAddresses != [ ] || cfg.galeraCluster.clusterAddress != "");
message = "mariadb galera cluster is enabled but the localAddress and (nodeAddresses or clusterAddress) are not set";
}
{
assertion = cfg.galeraCluster.clusterPassword == "" || cfg.galeraCluster.clusterAddress == "";
message = "mariadb galera clusterPassword is set but overwritten by clusterAddress";
}
{
assertion = cfg.galeraCluster.nodeAddresses != [ ] || cfg.galeraCluster.clusterAddress != "";
message = "When services.mysql.galeraCluster.clusterAddress is set, setting services.mysql.galeraCluster.nodeAddresses is redundant and will be overwritten by clusterAddress. Choose one approach.";
}
];
services.mysql.dataDir = lib.mkDefault (
if lib.versionAtLeast config.system.stateVersion "17.09" then "/var/lib/mysql" else "/var/mysql"
@@ -475,7 +473,11 @@ in
wsrep_provider = "${cfg.galeraCluster.package}/lib/galera/libgalera_smm.so";
wsrep_cluster_name = cfg.galeraCluster.name;
wsrep_cluster_address = cfg.galeraCluster.clusterAddress;
wsrep_cluster_address =
if (cfg.galeraCluster.clusterAddress != "") then
cfg.galeraCluster.clusterAddress
else
generateClusterAddress;
wsrep_node_address = cfg.galeraCluster.localAddress;
wsrep_node_name = "${cfg.galeraCluster.localName}";
nixos/modules/services/mail/cyrus-imap.nix
+14 -18
View File
@@ -72,6 +72,20 @@ let
} cfg.imapdSettings;
in
{
imports = [
(lib.mkRenamedOptionModule
[ "services" "cyrus-imap" "sslServerCert" ]
[ "services" "cyrus-imap" "imapdSettings" "tls_server_cert" ]
)
(lib.mkRenamedOptionModule
[ "services" "cyrus-imap" "sslServerKey" ]
[ "services" "cyrus-imap" "imapdSettings" "tls_server_key" ]
)
(lib.mkRenamedOptionModule
[ "services" "cyrus-imap" "sslCACert" ]
[ "services" "cyrus-imap" "imapdSettings" "tls_client_ca_file" ]
)
];
options.services.cyrus-imap = {
enable = mkEnableOption "Cyrus IMAP, an email, contacts and calendar server";
debug = mkEnableOption "debugging messages for the Cyrus master process";
@@ -294,24 +308,6 @@ in
description = "Path to the configuration file used for Cyrus.";
apply = v: if v != null then v else pkgs.writeText "cyrus.conf" cyrusConfig;
};
sslCACert = mkOption {
type = nullOr str;
default = null;
description = "File path which containing one or more CA certificates to use.";
};
sslServerCert = mkOption {
type = nullOr str;
default = null;
description = "File containing the global certificate used for all services (IMAP, POP3, LMTP, Sieve)";
};
sslServerKey = mkOption {
type = nullOr str;
default = null;
description = "File containing the private key belonging to the global server certificate.";
};
};
config = mkIf cfg.enable {
nixos/modules/services/networking/centrifugo.nix
+8
View File
@@ -65,6 +65,14 @@ in
};
config = lib.mkIf cfg.enable {
assertions = [
{
assertion =
(lib.versionAtLeast cfg.package.version "6") -> (!(cfg.settings ? name) && !(cfg.settings ? port));
message = "`services.centrifugo.settings` is v5 config, must be compatible with centrifugo v6 config format";
}
];
systemd.services.centrifugo = {
description = "Centrifugo messaging server";
wantedBy = [ "multi-user.target" ];
nixos/modules/services/networking/nebula.nix
+45 -7
View File
@@ -84,6 +84,28 @@ in
description = "Whether this node is a relay.";
};
lighthouse.dns.enable = lib.mkOption {
type = lib.types.bool;
default = false;
description = "Whether this lighthouse node should serve DNS.";
};
lighthouse.dns.host = lib.mkOption {
type = lib.types.str;
default = "localhost";
description = ''
IP address on which nebula lighthouse should serve DNS.
'localhost' is a good default to ensure the service does not listen on public interfaces;
use a Nebula address like 10.0.0.5 to make DNS resolution available to nebula hosts only.
'';
};
lighthouse.dns.port = lib.mkOption {
type = lib.types.nullOr lib.types.port;
default = 5353;
description = "UDP port number for lighthouse DNS server.";
};
lighthouses = lib.mkOption {
type = lib.types.listOf lib.types.str;
default = [ ];
@@ -172,10 +194,7 @@ in
'';
example = lib.literalExpression ''
{
lighthouse.dns = {
host = "0.0.0.0";
port = 53;
};
lighthouse.interval = 15;
}
'';
};
@@ -203,6 +222,9 @@ in
lighthouse = {
am_lighthouse = netCfg.isLighthouse;
hosts = netCfg.lighthouses;
serve_dns = netCfg.lighthouse.dns.enable;
dns.host = netCfg.lighthouse.dns.host;
dns.port = netCfg.lighthouse.dns.port;
};
relay = {
am_relay = netCfg.isRelay;
@@ -231,6 +253,19 @@ in
''
settings
);
capabilities =
let
nebulaPort = if !settings.tun.disabled then settings.listen.port else 0;
dnsPort = if settings.lighthouse.serve_dns then settings.lighthouse.dns.port else 0;
in
lib.concatStringsSep " " (
# creation of tunnel interfaces
lib.optional (!settings.tun.disabled) "CAP_NET_ADMIN"
# binding to privileged ports
++ lib.optional (
nebulaPort > 0 && nebulaPort < 1024 || dnsPort > 0 && dnsPort < 1024
) "CAP_NET_BIND_SERVICE"
);
in
{
# Create the systemd service for Nebula.
@@ -248,8 +283,8 @@ in
Restart = "always";
ExecStart = "${netCfg.package}/bin/nebula -config ${configFile}";
UMask = "0027";
CapabilityBoundingSet = "CAP_NET_ADMIN";
AmbientCapabilities = "CAP_NET_ADMIN";
CapabilityBoundingSet = capabilities;
AmbientCapabilities = capabilities;
LockPersonality = true;
NoNewPrivileges = true;
PrivateDevices = false; # needs access to /dev/net/tun (below)
@@ -302,5 +337,8 @@ in
);
};
meta.maintainers = with lib.maintainers; [ numinit ];
meta.maintainers = with lib.maintainers; [
numinit
siriobalmelli
];
}
nixos/modules/services/security/cfssl.nix
+7
View File
@@ -164,6 +164,12 @@ in
];
description = "Log level (0 = DEBUG, 5 = FATAL).";
};
disable = lib.mkOption {
default = null;
type = lib.types.nullOr lib.types.commas;
description = "Endpoints to disable (comma-separated list)";
};
};
config = lib.mkIf cfg.enable {
@@ -218,6 +224,7 @@ in
(opt "tls-remote-ca" tlsRemoteCa)
(opt "db-config" dbConfig)
(opt "loglevel" (toString logLevel))
(opt "disable" disable)
];
}
(lib.mkIf (cfg.dataDir == options.services.cfssl.dataDir.default) {
nixos/modules/services/web-apps/homebox.nix
+39 -8
View File
@@ -35,6 +35,15 @@ in
[documentation](https://homebox.software/en/configure-homebox.html).
'';
};
database = {
createLocally = lib.mkOption {
type = lib.types.bool;
default = false;
description = ''
Configure local PostgreSQL database server for Homebox.
'';
};
};
};
config = mkIf cfg.enable {
@@ -43,16 +52,37 @@ in
group = "homebox";
};
users.groups.homebox = { };
services.homebox.settings = {
HBOX_STORAGE_DATA = mkDefault "/var/lib/homebox/data";
HBOX_DATABASE_DRIVER = mkDefault "sqlite3";
HBOX_DATABASE_SQLITE_PATH = mkDefault "/var/lib/homebox/data/homebox.db?_pragma=busy_timeout=999&_pragma=journal_mode=WAL&_fk=1";
HBOX_OPTIONS_ALLOW_REGISTRATION = mkDefault "false";
HBOX_OPTIONS_CHECK_GITHUB_RELEASE = mkDefault "false";
HBOX_MODE = mkDefault "production";
services.homebox.settings = lib.mkMerge [
(lib.mapAttrs (_: mkDefault) {
HBOX_STORAGE_DATA = "/var/lib/homebox/data";
HBOX_DATABASE_DRIVER = "sqlite3";
HBOX_DATABASE_SQLITE_PATH = "/var/lib/homebox/data/homebox.db?_pragma=busy_timeout=999&_pragma=journal_mode=WAL&_fk=1";
HBOX_OPTIONS_ALLOW_REGISTRATION = "false";
HBOX_OPTIONS_CHECK_GITHUB_RELEASE = "false";
HBOX_MODE = "production";
})
(lib.mkIf cfg.database.createLocally {
HBOX_DATABASE_DRIVER = "postgres";
HBOX_DATABASE_HOST = "/run/postgresql";
HBOX_DATABASE_USERNAME = "homebox";
HBOX_DATABASE_DATABASE = "homebox";
HBOX_DATABASE_PORT = toString config.services.postgresql.settings.port;
})
];
services.postgresql = lib.mkIf cfg.database.createLocally {
enable = true;
ensureDatabases = [ "homebox" ];
ensureUsers = [
{
name = "homebox";
ensureDBOwnership = true;
}
];
};
systemd.services.homebox = {
after = [ "network.target" ];
requires = lib.optional cfg.database.createLocally "postgresql.service";
after = lib.optional cfg.database.createLocally "postgresql.service";
environment = cfg.settings;
serviceConfig = {
User = "homebox";
@@ -82,6 +112,7 @@ in
ProcSubset = "pid";
ProtectSystem = "strict";
RestrictAddressFamilies = [
"AF_UNIX"
"AF_INET"
"AF_INET6"
"AF_NETLINK"
nixos/modules/services/web-apps/mattermost.nix
+57 -43
View File
@@ -147,34 +147,34 @@ let
else
throw "Invalid database driver: ${cfg.database.driver}";
mattermostPluginDerivations =
with pkgs;
map (
plugin:
stdenv.mkDerivation {
name = "mattermost-plugin";
installPhase = ''
mkdir -p $out/share
cp ${plugin} $out/share/plugin.tar.gz
'';
dontUnpack = true;
dontPatch = true;
dontConfigure = true;
dontBuild = true;
preferLocalBuild = true;
}
) cfg.plugins;
mattermostPluginDerivations = map (
plugin:
pkgs.stdenvNoCC.mkDerivation {
name = "${cfg.package.name}-plugin";
installPhase = ''
runHook preInstall
mkdir -p $out/share
ln -sf ${plugin} $out/share/plugin.tar.gz
runHook postInstall
'';
dontUnpack = true;
dontPatch = true;
dontConfigure = true;
dontBuild = true;
preferLocalBuild = true;
}
) cfg.plugins;
mattermostPlugins =
with pkgs;
if mattermostPluginDerivations == [ ] then
null
else
stdenv.mkDerivation {
pkgs.stdenvNoCC.mkDerivation {
name = "${cfg.package.name}-plugins";
nativeBuildInputs = [ autoPatchelfHook ] ++ mattermostPluginDerivations;
nativeBuildInputs = [ pkgs.autoPatchelfHook ] ++ mattermostPluginDerivations;
buildInputs = [ cfg.package ];
installPhase = ''
runHook preInstall
mkdir -p $out
plugins=(${
escapeShellArgs (map (plugin: "${plugin}/share/plugin.tar.gz") mattermostPluginDerivations)
@@ -187,6 +187,7 @@ let
GZIP_OPT=-9 tar -C "$hash" -cvzf "$out/$hash.tar.gz" .
rm -rf "$hash"
done
runHook postInstall
'';
dontUnpack = true;
@@ -254,8 +255,8 @@ let
}
);
mattermostConfJSON = pkgs.writeText "mattermost-config.json" (builtins.toJSON mattermostConf);
format = pkgs.formats.json { };
finalConfig = format.generate "mattermost-config.json" mattermostConf;
in
{
imports = [
@@ -454,9 +455,9 @@ in
the options specified in services.mattermost will be generated
but won't be overwritten on changes or rebuilds.
If this option is disabled, changes in the system console won't
be possible (default). If an config.json is present, it will be
overwritten!
If this option is disabled, persistent changes in the system
console won't be possible (the default). If a config.json is
present, it will be overwritten at service start!
'';
};
@@ -480,7 +481,20 @@ in
description = ''
Plugins to add to the configuration. Overrides any installed if non-null.
This is a list of paths to .tar.gz files or derivations evaluating to
.tar.gz files.
.tar.gz files. You can use `mattermost.buildPlugin` to build plugins;
see the NixOS documentation for more details.
'';
};
pluginsBundle = mkOption {
type = with types; nullOr package;
default = mattermostPlugins;
defaultText = ''
All entries in {config}`services.mattermost.plugins`, repacked
'';
description = ''
Derivation building to a directory of plugin tarballs.
This overrides {option}`services.mattermost.plugins` if provided.
'';
};
@@ -508,7 +522,8 @@ in
type = with types; attrsOf (either int str);
default = { };
description = ''
Extra environment variables to export to the Mattermost process, in the systemd unit.
Extra environment variables to export to the Mattermost process
from the systemd unit configuration.
'';
example = {
MM_SERVICESETTINGS_SITEURL = "http://example.com";
@@ -524,11 +539,11 @@ in
for mattermost (see [the Mattermost documentation](https://docs.mattermost.com/configure/configuration-settings.html#environment-variables)).
Settings defined in the environment file will overwrite settings
set via nix or via the {option}`services.mattermost.extraConfig`
set via Nix or via the {option}`services.mattermost.extraConfig`
option.
Useful for setting config options without their value ending up in the
(world-readable) nix store, e.g. for a database password.
(world-readable) Nix store, e.g. for a database password.
'';
};
@@ -639,13 +654,13 @@ in
if cfg.database.driver == "postgres" then
{
sslmode = "disable";
connect_timeout = 30;
connect_timeout = 60;
}
else if cfg.database.driver == "mysql" then
{
charset = "utf8mb4,utf8";
writeTimeout = "30s";
readTimeout = "30s";
writeTimeout = "60s";
readTimeout = "60s";
}
else
throw "Invalid database driver ${cfg.database.driver}";
@@ -653,13 +668,13 @@ in
if config.mattermost.database.driver == "postgres" then
{
sslmode = "disable";
connect_timeout = 30;
connect_timeout = 60;
}
else if config.mattermost.database.driver == "mysql" then
{
charset = "utf8mb4,utf8";
writeTimeout = "30s";
readTimeout = "30s";
writeTimeout = "60s";
readTimeout = "60s";
}
else
throw "Invalid database driver";
@@ -687,7 +702,7 @@ in
};
settings = mkOption {
type = types.attrs;
inherit (format) type;
default = { };
description = ''
Additional configuration options as Nix attribute set in config.json schema.
@@ -786,7 +801,7 @@ in
"d= ${tempDir} 0750 ${cfg.user} ${cfg.group} - -"
# Ensure that pluginDir is a directory, as it could be a symlink on prior versions.
"r- ${pluginDir} - - - - -"
# Don't remove or clean it out since it should be persistent, as this is where plugins are unpacked.
"d= ${pluginDir} 0750 ${cfg.user} ${cfg.group} - -"
# Ensure that the plugin directories exist.
@@ -801,15 +816,14 @@ in
"L+ ${cfg.dataDir}/client - - - - ${cfg.package}/client"
]
++ (
if mattermostPlugins == null then
# Create the plugin tarball directory if it's a symlink.
if cfg.pluginsBundle == null then
# Create the plugin tarball directory to allow plugin uploads.
[
"r- ${cfg.dataDir}/plugins - - - - -"
"d= ${cfg.dataDir}/plugins 0750 ${cfg.user} ${cfg.group} - -"
]
else
# Symlink the plugin tarball directory, removing anything existing.
[ "L+ ${cfg.dataDir}/plugins - - - - ${mattermostPlugins}" ]
# Symlink the plugin tarball directory, removing anything existing, since it's managed by Nix.
[ "L+ ${cfg.dataDir}/plugins - - - - ${cfg.pluginsBundle}" ]
);
systemd.services.mattermost = rec {
@@ -836,7 +850,7 @@ in
configDir=${escapeShellArg cfg.configDir}
logDir=${escapeShellArg cfg.logDir}
package=${escapeShellArg cfg.package}
nixConfig=${escapeShellArg mattermostConfJSON}
nixConfig=${escapeShellArg finalConfig}
''
+ optionalString (versionAtLeast config.system.stateVersion "25.05") ''
# Migrate configs in the pre-25.05 directory structure.
nixos/modules/services/web-apps/reposilite.nix
+439
View File
@@ -0,0 +1,439 @@
{
lib,
config,
pkgs,
...
}:
let
cfg = config.services.reposilite;
format = pkgs.formats.cdn { };
configFile = format.generate "reposilite.cdn" cfg.settings;
useEmbeddedDb = cfg.database.type == "sqlite" || cfg.database.type == "h2";
useMySQL = cfg.database.type == "mariadb" || cfg.database.type == "mysql";
usePostgres = cfg.database.type == "postgresql";
# db password is appended at runtime by the service script (if needed)
dbString =
if useEmbeddedDb then
"${cfg.database.type} ${cfg.database.path}"
else
"${cfg.database.type} ${cfg.database.host}:${builtins.toString cfg.database.port} ${cfg.database.dbname} ${cfg.database.user} $(<${cfg.database.passwordFile})";
certDir = config.security.acme.certs.${cfg.useACMEHost}.directory;
databaseModule = {
options = {
type = lib.mkOption {
type = lib.types.enum [
"h2"
"mariadb"
"mysql"
"postgresql"
"sqlite"
];
description = ''
Database engine to use.
'';
default = "sqlite";
};
path = lib.mkOption {
type = lib.types.str;
description = ''
Path to the embedded database file. Set to `--temporary` to use an in-memory database.
'';
default = "reposilite.db";
};
host = lib.mkOption {
type = lib.types.str;
description = ''
Database host address.
'';
default = "127.0.0.1";
};
port = lib.mkOption {
type = lib.types.port;
description = ''
Database TCP port.
'';
defaultText = lib.literalExpression ''
if type == "postgresql" then 5432 else 3306
'';
default = if usePostgres then config.services.postgresql.settings.port else 3306;
};
dbname = lib.mkOption {
type = lib.types.str;
description = ''
Database name.
'';
default = "reposilite";
};
user = lib.mkOption {
type = lib.types.str;
description = ''
Database user.
'';
default = "reposilite";
};
passwordFile = lib.mkOption {
type = lib.types.nullOr lib.types.path;
description = ''
Path to the file containing the password for the database connection.
This file must be readable by {option}`services.reposilite.user`.
'';
default = null;
};
};
};
settingsModule = {
freeformType = format.type;
options = {
hostname = lib.mkOption {
type = lib.types.str;
description = ''
The hostname to bind to. Set to `0.0.0.0` to accept connections from everywhere, or `127.0.0.1` to restrict to localhost."
'';
default = "0.0.0.0";
example = "127.0.0.1";
};
port = lib.mkOption {
type = lib.types.port;
description = ''
The TCP port to bind to.
'';
default = 3000;
};
database = lib.mkOption {
type = lib.types.nullOr lib.types.str;
description = ''
Database connection string. Please use {option}`services.reposilite.database` instead.
See https://reposilite.com/guide/general#local-configuration for valid values.
'';
default = null;
};
sslEnabled = lib.mkOption {
type = lib.types.bool;
description = ''
Whether to listen for encrypted connections on {option}`settings.sslPort`.
'';
default = false;
};
sslPort = lib.mkOption {
type = lib.types.port; # cant be null
description = "SSL port to bind to. SSL needs to be enabled explicitly via {option}`settings.enableSsl`.";
default = 443;
};
keyPath = lib.mkOption {
type = lib.types.nullOr lib.types.str;
description = ''
Path to the .jsk KeyStore or paths to the PKCS#8 certificate and private key, separated by a space (see example).
You can use `''${WORKING_DIRECTORY}` to refer to paths relative to Reposilite's working directory.
If you are using a Java KeyStore, don't forget to specify the password via the {var}`REPOSILITE_LOCAL_KEYPASSWORD` environment variable.
See https://reposilite.com/guide/ssl for more information on how to set SSL up.
'';
default = null;
example = "\${WORKING_DIRECTORY}/cert.pem \${WORKING_DIRECTORY}/key.pem";
};
keyPassword = lib.mkOption {
type = lib.types.nullOr lib.types.str;
description = ''
Plaintext password used to unlock the Java KeyStore set in {option}`services.reposilite.settings.keyPath`.
WARNING: this option is insecure and should not be used to store the password.
Consider using {option}`services.reposilite.keyPasswordFile` instead.
'';
default = null;
};
enforceSsl = lib.mkOption {
type = lib.types.bool;
description = ''
Whether to redirect all traffic to SSL.
'';
default = false;
};
webThreadPool = lib.mkOption {
type = lib.types.ints.between 5 65535;
description = ''
Maximum amount of threads used by the core thread pool. (min: 5)
The web thread pool handles the first few steps of incoming HTTP connections, tasks are redirected as soon as possible to the IO thread pool.
'';
default = 16;
};
ioThreadPool = lib.mkOption {
type = lib.types.ints.between 2 65535;
description = ''
The IO thread pool handles all tasks that may benefit from non-blocking IO. (min: 2)
Because most tasks are redirected to IO thread pool, it might be a good idea to keep it at least equal to web thread pool.
'';
default = 8;
};
databaseThreadPool = lib.mkOption {
type = lib.types.ints.positive;
description = ''
Maximum amount of concurrent connections to the database. (one per thread)
Embedded databases (sqlite, h2) do not support truly concurrent connections, so the value will always be `1` if they are used.
'';
default = 1;
};
compressionStrategy = lib.mkOption {
type = lib.types.enum [
"none"
"gzip"
];
description = ''
Compression algorithm used by this instance of Reposilite.
`none` reduces usage of CPU & memory, but requires transfering more data.
'';
default = "none";
};
idleTimeout = lib.mkOption {
type = lib.types.ints.unsigned;
description = ''
Default idle timeout used by Jetty.
'';
default = 30000;
};
bypassExternalCache = lib.mkOption {
type = lib.types.bool;
description = ''
Add cache bypass headers to responses from /api/* to avoid issues with proxies such as Cloudflare.
'';
default = true;
};
cachedLogSize = lib.mkOption {
type = lib.types.ints.unsigned;
description = ''
Amount of messages stored in the cache logger.
'';
default = 50;
};
defaultFrontend = lib.mkOption {
type = lib.types.bool;
description = ''
Whether to enable the default included frontend with a dashboard.
'';
default = true;
};
basePath = lib.mkOption {
type = lib.types.str;
description = ''
Custom base path for this Reposilite instance.
It is not recommended changing this, you should instead prioritize using a different subdomain.
'';
default = "/";
};
debugEnabled = lib.mkOption {
type = lib.types.bool;
description = ''
Whether to enable debug mode.
'';
default = false;
};
};
};
in
{
options.services.reposilite = {
enable = lib.mkEnableOption "Reposilite";
package = lib.mkPackageOption pkgs "reposilite" { } // {
apply =
pkg:
pkg.override (old: {
plugins = (old.plugins or [ ]) ++ cfg.plugins;
});
};
plugins = lib.mkOption {
type = lib.types.listOf lib.types.package;
description = ''
List of plugins to add to Reposilite.
'';
default = [ ];
example = "with reposilitePlugins; [ checksum groovy ]";
};
database = lib.mkOption {
description = "Database options.";
default = { };
type = lib.types.submodule databaseModule;
};
keyPasswordFile = lib.mkOption {
type = lib.types.nullOr lib.types.path;
description = ''
Path the the file containing the password used to unlock the Java KeyStore file specified in {option}`services.reposilite.settings.keyPath`.
This file must be readable my {option}`services.reposilite.user`.
'';
default = null;
};
useACMEHost = lib.mkOption {
type = lib.types.nullOr lib.types.str;
description = ''
Host of an existing Let's Encrypt certificate to use for SSL.
Make sure that the certificate directory is readable by the `reposilite` user or group, for example via {option}`security.acme.certs.<cert>.group`.
*Note that this option does not create any certificates, nor it does add subdomains to existing ones – you will need to create them manually using {option}`security.acme.certs`*
'';
default = null;
};
settings = lib.mkOption {
description = "Configuration written to the reposilite.cdn file";
default = { };
type = lib.types.submodule settingsModule;
};
workingDirectory = lib.mkOption {
type = lib.types.path;
description = ''
Working directory for Reposilite.
'';
default = "/var/lib/reposilite";
};
extraArgs = lib.mkOption {
type = lib.types.listOf lib.types.str;
description = ''
Extra arguments/parameters passed to the Reposilite. Can be used for first token generation.
'';
default = [ ];
example = lib.literalExpression ''[ "--token" "name:tempsecrettoken" ]'';
};
user = lib.mkOption {
type = lib.types.str;
description = ''
The user to run Reposilite under.
'';
default = "reposilite";
};
group = lib.mkOption {
type = lib.types.str;
description = ''
The group to run Reposilite under.
'';
default = "reposilite";
};
openFirewall = lib.mkOption {
type = lib.types.bool;
description = ''
Whether to open the firewall ports for Reposilite. If SSL is enabled, its port will be opened too.
'';
default = false;
};
};
config = lib.mkIf cfg.enable {
assertions = [
{
assertion = cfg.settings.sslEnabled -> cfg.settings.keyPath != null;
message = ''
Reposilite was configured to enable SSL, but no valid paths to certificate files were provided via `settings.keyPath`.
Read more about SSL certificates here: https://reposilite.com/guide/ssl
'';
}
{
assertion = cfg.settings.enforceSsl -> cfg.settings.sslEnabled;
message = "You cannot enforce SSL if SSL is not enabled.";
}
{
assertion = !useEmbeddedDb -> cfg.database.passwordFile != null;
message = "You need to set `services.reposilite.database.passwordFile` when using MySQL or Postgres.";
}
];
services.reposilite.settings.keyPath = lib.mkIf (
cfg.useACMEHost != null
) "${certDir}/fullchain.pem ${certDir}/key.pem";
environment.systemPackages = [ cfg.package ];
users = {
groups.${cfg.group} = lib.mkIf (cfg.group == "reposilite") { };
users.${cfg.user} = lib.mkIf (cfg.user == "reposilite") {
isSystemUser = true;
group = cfg.group;
};
};
networking.firewall = lib.mkIf cfg.openFirewall (
lib.mkMerge [
{
allowedTCPPorts = [ cfg.settings.port ];
}
(lib.mkIf cfg.settings.sslEnabled {
allowedTCPPorts = [ cfg.settings.sslPort ];
})
]
);
systemd.services.reposilite = {
enable = true;
wantedBy = [ "multi-user.target" ];
after =
[ "network.target" ]
++ (lib.optional useMySQL "mysql.service")
++ (lib.optional usePostgres "postgresql.service");
script =
lib.optionalString (cfg.keyPasswordFile != null && cfg.settings.keyPassword == null) ''
export REPOSILITE_LOCAL_KEYPASSWORD="$(<${cfg.keyPasswordFile})"
''
+ ''
export REPOSILITE_LOCAL_DATABASE="${dbString}"
${lib.getExe cfg.package} --local-configuration ${configFile} --local-configuration-mode none --working-directory ${cfg.workingDirectory} ${lib.escapeShellArgs cfg.extraArgs}
'';
serviceConfig = lib.mkMerge [
(lib.mkIf (builtins.dirOf cfg.workingDirectory == "/var/lib") {
StateDirectory = builtins.baseNameOf cfg.workingDirectory;
StateDirectoryMode = "700";
})
{
Type = "exec";
Restart = "on-failure";
User = cfg.user;
Group = cfg.group;
WorkingDirectory = cfg.workingDirectory;
# TODO better hardening
LimitNOFILE = "1048576";
PrivateTmp = true;
PrivateDevices = true;
ProtectHome = true;
ProtectSystem = "strict";
AmbientCapabilities = "CAP_NET_BIND_SERVICE";
}
];
};
};
meta.maintainers = [ lib.maintainers.uku3lig ];
}
nixos/tests/agnos.nix
+209
View File
@@ -0,0 +1,209 @@
{
system ? builtins.currentSystem,
pkgs ? import ../.. { inherit system; },
lib ? pkgs.lib,
}:
let
inherit (import ../lib/testing-python.nix { inherit system pkgs; }) makeTest;
nodeIP = n: n.networking.primaryIPAddress;
dnsZone =
nodes:
pkgs.writeText "agnos.test.zone" ''
$TTL 604800
@ IN SOA ns1.agnos.test. root.agnos.test. (
3 ; Serial
604800 ; Refresh
86400 ; Retry
2419200 ; Expire
604800 ) ; Negative Cache TTL
;
; name servers - NS records
IN NS ns1.agnos.test.
; name servers - A records
ns1.agnos.test. IN A ${nodeIP nodes.dnsserver}
agnos-ns.agnos.test. IN A ${nodeIP nodes.server}
_acme-challenge.a.agnos.test. IN NS agnos-ns.agnos.test.
_acme-challenge.b.agnos.test. IN NS agnos-ns.agnos.test.
_acme-challenge.c.agnos.test. IN NS agnos-ns.agnos.test.
_acme-challenge.d.agnos.test. IN NS agnos-ns.agnos.test.
'';
mkTest =
{
name,
extraServerConfig ? { },
checkFirewallClosed ? true,
}:
makeTest {
inherit name;
meta = {
maintainers = with lib.maintainers; [ justinas ];
};
nodes = {
# The fake ACME server which will respond to client requests
acme =
{ nodes, pkgs, ... }:
{
imports = [ ./common/acme/server ];
environment.systemPackages = [ pkgs.netcat ];
networking.nameservers = lib.mkForce [ (nodeIP nodes.dnsserver) ];
};
# A fake DNS server which points _acme-challenge subdomains to "server"
dnsserver =
{ nodes, ... }:
{
networking.firewall.allowedTCPPorts = [ 53 ];
networking.firewall.allowedUDPPorts = [ 53 ];
services.bind = {
cacheNetworks = [ "192.168.1.0/24" ];
enable = true;
extraOptions = ''
dnssec-validation no;
'';
zones."agnos.test" = {
file = dnsZone nodes;
master = true;
};
};
};
# The server using agnos to request certificates
server =
{ nodes, ... }:
{
imports = [ extraServerConfig ];
networking.extraHosts = ''
${nodeIP nodes.acme} acme.test
'';
security.agnos = {
enable = true;
generateKeys.enable = true;
persistent = false;
server = "https://acme.test/dir";
serverCa = ./common/acme/server/ca.cert.pem;
temporarilyOpenFirewall = true;
settings.accounts = [
{
email = "webmaster@agnos.test";
# account with an existing private key
private_key_path = "${./common/acme/server/acme.test.key.pem}";
certificates = [
{
domains = [ "a.agnos.test" ];
# Absolute paths
fullchain_output_file = "/tmp/a.agnos.test.crt";
key_output_file = "/tmp/a.agnos.test.key";
}
{
domains = [
"b.agnos.test"
"*.b.agnos.test"
];
# Relative paths
fullchain_output_file = "b.agnos.test.crt";
key_output_file = "b.agnos.test.key";
}
];
}
{
email = "webmaster2@agnos.test";
# account with a missing private key, should get generated
private_key_path = "webmaster2.key";
certificates = [
{
domains = [ "c.agnos.test" ];
# Absolute paths
fullchain_output_file = "/tmp/c.agnos.test.crt";
key_output_file = "/tmp/c.agnos.test.key";
}
{
domains = [
"d.agnos.test"
"*.d.agnos.test"
];
# Relative paths
fullchain_output_file = "d.agnos.test.crt";
key_output_file = "d.agnos.test.key";
}
];
}
];
};
};
};
testScript = ''
def check_firewall_closed(caller):
"""
Check that TCP port 53 is closed again.
Since we do not set `networking.firewall.rejectPackets`,
"timed out" indicates a closed port,
while "connection refused" (after agnos has shut down) indicates an open port.
"""
out = caller.fail("nc -v -z -w 1 server 53 2>&1")
assert "Connection timed out" in out
start_all()
acme.wait_for_unit('pebble.service')
server.wait_for_unit('default.target')
# Test that agnos.timer is scheduled
server.succeed("systemctl status agnos.timer")
server.succeed('systemctl start agnos.service')
expected_perms = "640 agnos agnos"
outputs = [
"/tmp/a.agnos.test.crt",
"/tmp/a.agnos.test.key",
"/var/lib/agnos/b.agnos.test.crt",
"/var/lib/agnos/b.agnos.test.key",
"/var/lib/agnos/webmaster2.key",
"/tmp/c.agnos.test.crt",
"/tmp/c.agnos.test.key",
"/var/lib/agnos/d.agnos.test.crt",
"/var/lib/agnos/d.agnos.test.key",
]
for o in outputs:
out = server.succeed(f"stat -c '%a %U %G' {o}").strip()
assert out == expected_perms, \
f"Expected mode/owner/group to be '{expected_perms}', but it was '{out}'"
${lib.optionalString checkFirewallClosed "check_firewall_closed(acme)"}
'';
};
in
{
iptables = mkTest {
name = "iptables";
};
nftables = mkTest {
name = "nftables";
extraServerConfig = {
networking.nftables.enable = true;
};
};
no-firewall = mkTest {
name = "no-firewall";
extraServerConfig = {
networking.firewall.enable = lib.mkForce false;
security.agnos.temporarilyOpenFirewall = lib.mkForce false;
};
checkFirewallClosed = false;
};
}
nixos/tests/all-tests.nix
+27 -1
View File
@@ -177,6 +177,7 @@ in
agate = runTest ./web-servers/agate.nix;
agda = runTest ./agda.nix;
age-plugin-tpm-decrypt = runTest ./age-plugin-tpm-decrypt.nix;
agnos = discoverTests (import ./agnos.nix);
agorakit = runTest ./web-apps/agorakit.nix;
airsonic = runTest ./airsonic.nix;
akkoma = runTestOn [ "x86_64-linux" "aarch64-linux" ] {
@@ -338,6 +339,30 @@ in
containers-unified-hierarchy = handleTest ./containers-unified-hierarchy.nix { };
convos = handleTest ./convos.nix { };
corerad = handleTest ./corerad.nix { };
cosmic = runTest {
imports = [ ./cosmic.nix ];
_module.args.testName = "cosmic";
_module.args.enableAutologin = false;
_module.args.enableXWayland = true;
};
cosmic-autologin = runTest {
imports = [ ./cosmic.nix ];
_module.args.testName = "cosmic-autologin";
_module.args.enableAutologin = true;
_module.args.enableXWayland = true;
};
cosmic-noxwayland = runTest {
imports = [ ./cosmic.nix ];
_module.args.testName = "cosmic-noxwayland";
_module.args.enableAutologin = false;
_module.args.enableXWayland = false;
};
cosmic-autologin-noxwayland = runTest {
imports = [ ./cosmic.nix ];
_module.args.testName = "cosmic-autologin-noxwayland";
_module.args.enableAutologin = true;
_module.args.enableXWayland = false;
};
coturn = handleTest ./coturn.nix { };
couchdb = handleTest ./couchdb.nix { };
crabfit = handleTest ./crabfit.nix { };
@@ -480,7 +505,7 @@ in
imports = [ ./firefox.nix ];
_module.args.firefoxPackage = pkgs.floorp;
};
fluent-bit = handleTest ./fluent-bit.nix { };
fluent-bit = runTest ./fluent-bit.nix;
fluentd = handleTest ./fluentd.nix { };
fluidd = handleTest ./fluidd.nix { };
fontconfig-default-fonts = handleTest ./fontconfig-default-fonts.nix { };
@@ -1123,6 +1148,7 @@ in
redmine = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./redmine.nix { };
renovate = handleTest ./renovate.nix { };
replace-dependencies = handleTest ./replace-dependencies { };
reposilite = runTest ./reposilite.nix;
restartByActivationScript = handleTest ./restart-by-activation-script.nix { };
restic-rest-server = handleTest ./restic-rest-server.nix { };
restic = handleTest ./restic.nix { };
nixos/tests/centrifugo.nix
+13 -9
View File
@@ -10,7 +10,10 @@ in
{ lib, ... }:
{
name = "centrifugo";
meta.maintainers = [ lib.maintainers.tie ];
meta.maintainers = [
lib.maintainers.tie
lib.maintainers.valodim
];
nodes = lib.listToAttrs (
lib.imap0 (index: name: {
@@ -21,12 +24,15 @@ in
services.centrifugo = {
enable = true;
settings = {
inherit name;
port = centrifugoPort;
# See https://centrifugal.dev/docs/server/engines#redis-sharding
engine = "redis";
# Connect to local Redis shard via Unix socket.
redis_address =
node = {
inherit name;
};
http_server.port = centrifugoPort;
http_api.insecure = true;
usage_stats.disabled = true;
engine.type = "redis";
engine.redis.address =
let
toRedisAddresses = map (name: "${name}:${toString redisPort}");
in
@@ -35,8 +41,6 @@ in
"unix://${config.services.redis.servers.centrifugo.unixSocket}"
]
++ toRedisAddresses (lib.drop (index + 1) nodes);
usage_stats_disable = true;
api_insecure = true;
};
extraGroups = [
config.services.redis.servers.centrifugo.user
nixos/tests/cosmic.nix
+131
View File
@@ -0,0 +1,131 @@
{
config,
lib,
testName,
enableAutologin,
enableXWayland,
...
}:
{
name = testName;
meta = {
platforms = lib.platforms.linux;
maintainers = with lib.maintainers; [
thefossguy
];
};
nodes.machine = {
imports = [ ./common/user-account.nix ];
services = {
# For `cosmic-store` to be added to `environment.systemPackages`
# and for it to work correctly because Flatpak is a runtime
# dependency of `cosmic-store`.
flatpak.enable = true;
displayManager.cosmic-greeter.enable = true;
desktopManager.cosmic = {
enable = true;
xwayland.enable = enableXWayland;
};
};
services.displayManager.autoLogin = lib.mkIf enableAutologin {
enable = true;
user = "alice";
};
environment.systemPackages = with config.node.pkgs; [
# These two packages are used to check if a window was opened
# under the COSMIC session or not. Kinda important.
# TODO: Move the check from the test module to
# `nixos/lib/test-driver/src/test_driver/machine.py` so more
# Wayland-only testing can be done using the existing testing
# infrastructure.
jq
lswt
];
# So far, all COSMIC tests launch a few GUI applications. In doing
# so, the default allocated memory to the guest of 1024M quickly
# poses a very high risk of an OOM-shutdown which is worse than an
# OOM-kill. Because now, the test failed, but not for a genuine
# reason, but an OOM-shutdown. That's an inconclusive failure
# which might possibly mask an actual failure. Not enabling
# systemd-oomd because we need said applications running for a
# few seconds. So instead, bump the allocated memory to the guest
# from 1024M to 4x; 4096M.
virtualisation.memorySize = 4096;
};
testScript =
{ nodes, ... }:
let
cfg = nodes.machine;
user = cfg.users.users.alice;
DISPLAY = lib.strings.optionalString enableXWayland (
if enableAutologin then "DISPLAY=:0" else "DISPLAY=:1"
);
in
''
#testName: ${testName}
''
+ (
if (enableAutologin) then
''
with subtest("cosmic-greeter initialisation"):
machine.wait_for_unit("graphical.target")
''
else
''
from time import sleep
machine.wait_for_unit("graphical.target")
machine.wait_until_succeeds("pgrep --uid ${toString cfg.users.users.cosmic-greeter.name} --full cosmic-greeter")
# Sleep for 10 seconds for ensuring that `greetd` loads the
# password prompt for the login screen properly.
sleep(10)
with subtest("cosmic-session login"):
machine.send_chars("${user.password}\n", delay=0.2)
''
)
+ ''
# _One_ of the final processes to start as part of the
# `cosmic-session` target is the Workspaces applet. So, wait
# for it to start. The process existing means that COSMIC
# now handles any opened windows from now on.
machine.wait_until_succeeds("pgrep --uid ${toString user.uid} --full 'cosmic-panel-button com.system76.CosmicWorkspaces'")
# The best way to test for Wayland and XWayland is to launch
# the GUI applications and see the results yourself.
with subtest("Launch applications"):
# key: binary_name
# value: "app-id" as reported by `lswt`
gui_apps_to_launch = {}
# We want to ensure that the first-party applications
# start/launch properly.
gui_apps_to_launch['cosmic-edit'] = 'com.system76.CosmicEdit'
gui_apps_to_launch['cosmic-files'] = 'com.system76.CosmicFiles'
gui_apps_to_launch['cosmic-player'] = 'com.system76.CosmicPlayer'
gui_apps_to_launch['cosmic-settings'] = 'com.system76.CosmicSettings'
gui_apps_to_launch['cosmic-store'] = 'com.system76.CosmicStore'
gui_apps_to_launch['cosmic-term'] = 'com.system76.CosmicTerm'
for gui_app, app_id in gui_apps_to_launch.items():
machine.succeed(f"su - ${user.name} -c 'WAYLAND_DISPLAY=wayland-1 XDG_RUNTIME_DIR=/run/user/${toString user.uid} ${DISPLAY} {gui_app} >&2 &'", timeout=5)
# Nix builds the following non-commented expression to the following:
# `su - alice -c 'WAYLAND_DISPLAY=wayland-1 XDG_RUNTIME_DIR=/run/user/1000 lswt --json | jq ".toplevels" | grep "^ \\"app-id\\": \\"{app_id}\\"$"' `
machine.wait_until_succeeds(f''''su - ${user.name} -c 'WAYLAND_DISPLAY=wayland-1 XDG_RUNTIME_DIR=/run/user/${toString user.uid} lswt --json | jq ".toplevels" | grep "^ \\"app-id\\": \\"{app_id}\\"$"' '''', timeout=30)
machine.succeed(f"pkill {gui_app}", timeout=5)
machine.succeed("echo 'test completed succeessfully' > /${testName}")
machine.copy_from_vm('/${testName}')
machine.shutdown()
'';
}
nixos/tests/envfs.nix
-2
View File
@@ -25,8 +25,6 @@ import ./make-test-python.nix (
"PATH= /usr/bin/env --version",
"PATH= test -e /usr/bin/sh",
"PATH= test -e /usr/bin/env",
# no stat
"! test -e /usr/bin/cp",
# also picks up PATH that was set after execve
"! /usr/bin/hello",
"PATH=${pkgs.hello}/bin /usr/bin/hello",
nixos/tests/fluent-bit.nix
+52 -36
View File
@@ -1,40 +1,56 @@
import ./make-test-python.nix (
{ lib, pkgs, ... }:
{
name = "fluent-bit";
nodes.machine =
{ config, pkgs, ... }:
{
services.fluent-bit = {
enable = true;
settings = {
pipeline = {
inputs = [
{
name = "systemd";
systemd_filter = "_SYSTEMD_UNIT=fluent-bit.service";
}
];
outputs = [
{
name = "file";
path = "/var/log/fluent-bit";
file = "fluent-bit.out";
}
];
};
};
# Regression test for https://github.com/NixOS/nixpkgs/pull/395128
{
name = "fluent-bit";
nodes.machine = {
services.fluent-bit = {
enable = true;
settings = {
pipeline = {
inputs = [
{
name = "systemd";
systemd_filter = "_SYSTEMD_UNIT=fluent-bit-regression-395128.service";
}
];
outputs = [
{
name = "file";
path = "/var/log/fluent-bit";
file = "fluent-bit.out";
}
];
};
systemd.services.fluent-bit.serviceConfig.LogsDirectory = "fluent-bit";
};
};
systemd.services.fluent-bit.serviceConfig.LogsDirectory = "fluent-bit";
testScript = ''
start_all()
# Logs get compressed when larger than 1024 bytes
# Lets generate some logs that trigger that
# This causes libzstd to be dlopen'd by systemd which breaks fluent-bit 3.2.7+
# https://www.freedesktop.org/software/systemd/man/latest/journald.conf.html#Compress=
systemd.services.fluent-bit-regression-395128 = {
serviceConfig = {
Type = "oneshot";
RemainAfterExit = true;
};
script = ''
for i in {1..20}; do
(head -c 1200 < /dev/zero | tr '\0' 'A') && echo
sleep 1
done
'';
};
};
machine.wait_for_unit("fluent-bit.service")
machine.wait_for_file("/var/log/fluent-bit/fluent-bit.out")
'';
}
)
testScript = ''
start_all()
machine.wait_for_unit("fluent-bit.service")
with subtest("fluent-bit handles zstd-compressed journal logs"):
machine.succeed("systemctl start fluent-bit-regression-395128.service")
machine.succeed("systemctl show -p NRestarts fluent-bit.service | grep -q 'NRestarts=0'")
machine.wait_for_file("/var/log/fluent-bit/fluent-bit.out")
'';
}
nixos/tests/homebox.nix
+29 -12
View File
@@ -8,19 +8,36 @@ import ./make-test-python.nix (
meta = with pkgs.lib.maintainers; {
maintainers = [ patrickdag ];
};
nodes.machine = {
services.homebox = {
enable = true;
settings.HBOX_WEB_PORT = port;
};
};
testScript = ''
machine.wait_for_unit("homebox.service")
machine.wait_for_open_port(${port})
nodes =
let
self = {
simple = {
services.homebox = {
enable = true;
settings.HBOX_WEB_PORT = port;
};
};
machine.succeed("curl --fail -X GET 'http://localhost:${port}/'")
out = machine.succeed("curl --fail 'http://localhost:${port}/api/v1/status'")
assert '"health":true' in out
postgres = {
imports = [ self.simple ];
services.homebox.database.createLocally = true;
};
};
in
self;
testScript = ''
def test_homebox(node):
node.wait_for_unit("homebox.service")
node.wait_for_open_port(${port})
node.succeed("curl --fail -X GET 'http://localhost:${port}/'")
out = node.succeed("curl --fail 'http://localhost:${port}/api/v1/status'")
assert '"health":true' in out
test_homebox(simple)
simple.send_monitor_command("quit")
simple.wait_for_shutdown()
test_homebox(postgres)
'';
}
)
nixos/tests/mattermost/default.nix
+133 -78
View File
@@ -33,7 +33,7 @@ import ../make-test-python.nix (
);
};
system.stateVersion = lib.mkDefault "25.05";
system.stateVersion = lib.mkDefault (lib.versions.majorMinor lib.version);
services.mattermost = lib.recursiveUpdate {
enable = true;
@@ -63,7 +63,7 @@ import ../make-test-python.nix (
# Upgrade to the latest Mattermost.
specialisation.latest.configuration = {
services.mattermost.package = lib.mkForce pkgs.mattermostLatest;
system.stateVersion = lib.mkVMOverride "25.05";
system.stateVersion = lib.mkVMOverride (lib.versions.majorMinor lib.version);
};
}
)
@@ -90,57 +90,60 @@ import ../make-test-python.nix (
name = "mattermost";
nodes = rec {
postgresMutable =
postgresMutable = makeMattermost {
mutableConfig = true;
preferNixConfig = false;
settings.SupportSettings.HelpLink = "https://search.nixos.org";
} { };
postgresMostlyMutable =
makeMattermost
{
mutableConfig = true;
preferNixConfig = false;
settings.SupportSettings.HelpLink = "https://search.nixos.org";
preferNixConfig = true;
plugins = with pkgs; [
# Build the demo plugin.
(mattermost.buildPlugin {
pname = "mattermost-plugin-starter-template";
version = "0.1.0";
src = fetchFromGitHub {
owner = "mattermost";
repo = "mattermost-plugin-starter-template";
# Newer versions have issues with their dependency lockfile.
rev = "7c98e89ac1a268ce8614bc665571b7bbc9a70df2";
hash = "sha256-uyfxB0GZ45qL9ssWUord0eKQC6S0TlCTtjTOXWtK4H0=";
};
vendorHash = "sha256-Jl4F9YkHNqiFP9/yeyi4vTntqxMk/J1zhEP6QLSvJQA=";
npmDepsHash = "sha256-z08nc4XwT+uQjQlZiUydJyh8mqeJoYdPFWuZpw9k99s=";
})
# Build the todos plugin.
(mattermost.buildPlugin {
pname = "mattermost-plugin-todo";
version = "0.8-pre";
src = fetchFromGitHub {
owner = "mattermost-community";
repo = "mattermost-plugin-todo";
# 0.7.1 didn't work, seems to use an older set of node dependencies.
rev = "f25dc91ea401c9f0dcd4abcebaff10eb8b9836e5";
hash = "sha256-OM+m4rTqVtolvL5tUE8RKfclqzoe0Y38jLU60Pz7+HI=";
};
vendorHash = "sha256-5KpechSp3z/Nq713PXYruyNxveo6CwrCSKf2JaErbgg=";
npmDepsHash = "sha256-o2UOEkwb8Vx2lDWayNYgng0GXvmS6lp/ExfOq3peyMY=";
extraGoModuleAttrs = {
npmFlags = [ "--legacy-peer-deps" ];
};
})
];
}
{
# Last version to support the "old" config layout.
system.stateVersion = lib.mkForce "24.11";
# First version to support the "new" config layout.
specialisation.upgrade.configuration.system.stateVersion = lib.mkVMOverride "25.05";
# Supports the "new" config layout.
specialisation.upgrade.configuration.system.stateVersion = lib.mkVMOverride (
lib.versions.majorMinor lib.version
);
};
postgresMostlyMutable = makeMattermost {
mutableConfig = true;
plugins = with pkgs; [
# Build the demo plugin.
(mattermost.buildPlugin {
pname = "mattermost-plugin-starter-template";
version = "0.1.0";
src = fetchFromGitHub {
owner = "mattermost";
repo = "mattermost-plugin-starter-template";
# Newer versions have issues with their dependency lockfile.
rev = "7c98e89ac1a268ce8614bc665571b7bbc9a70df2";
hash = "sha256-uyfxB0GZ45qL9ssWUord0eKQC6S0TlCTtjTOXWtK4H0=";
};
vendorHash = "sha256-Jl4F9YkHNqiFP9/yeyi4vTntqxMk/J1zhEP6QLSvJQA=";
npmDepsHash = "sha256-z08nc4XwT+uQjQlZiUydJyh8mqeJoYdPFWuZpw9k99s=";
})
# Build the todos plugin.
(mattermost.buildPlugin {
pname = "mattermost-plugin-todo";
version = "0.8-pre";
src = fetchFromGitHub {
owner = "mattermost-community";
repo = "mattermost-plugin-todo";
# 0.7.1 didn't work, seems to use an older set of node dependencies.
rev = "f25dc91ea401c9f0dcd4abcebaff10eb8b9836e5";
hash = "sha256-OM+m4rTqVtolvL5tUE8RKfclqzoe0Y38jLU60Pz7+HI=";
};
vendorHash = "sha256-5KpechSp3z/Nq713PXYruyNxveo6CwrCSKf2JaErbgg=";
npmDepsHash = "sha256-o2UOEkwb8Vx2lDWayNYgng0GXvmS6lp/ExfOq3peyMY=";
extraGoModuleAttrs = {
npmFlags = [ "--legacy-peer-deps" ];
};
})
];
} { };
postgresImmutable = makeMattermost {
package = pkgs.mattermost.overrideAttrs (prev: {
webapp = prev.webapp.overrideAttrs (prevWebapp: {
@@ -343,9 +346,14 @@ import ../make-test-python.nix (
'';
in
''
import sys
import shlex
import threading
import queue
def wait_mattermost_up(node, site_name="${siteName}"):
print(f"wait_mattermost_up({node.name!r}, site_name={site_name!r})", file=sys.stderr)
node.wait_for_unit("multi-user.target")
node.systemctl("start mattermost.service")
node.wait_for_unit("mattermost.service")
node.wait_for_open_port(8065)
@@ -353,20 +361,25 @@ import ../make-test-python.nix (
node.succeed(f"curl {shlex.quote('${url}')}/index.html | grep {shlex.quote(site_name)}")
def restart_mattermost(node, site_name="${siteName}"):
print(f"restart_mattermost({node.name!r}, site_name={site_name!r})", file=sys.stderr)
node.systemctl("restart mattermost.service")
wait_mattermost_up(node, site_name)
def expect_config(node, mattermost_version, *configs):
print(f"expect_config({node.name!r}, {mattermost_version!r}, *{configs!r})", file=sys.stderr)
for config in configs:
node.succeed(f"${expectConfig} {shlex.quote(config)} {shlex.quote(mattermost_version)}")
def expect_plugins(node, jq_or_code):
print(f"expect_plugins({node.name!r}, {jq_or_code!r})", file=sys.stderr)
node.succeed(f"${expectPlugins} {shlex.quote(str(jq_or_code))}")
def ensure_post(node, fail_if_not_found=False):
print(f"ensure_post({node.name!r}, fail_if_not_found={fail_if_not_found!r})", file=sys.stderr)
node.succeed(f"${ensurePost} {shlex.quote('${url}')} {1 if fail_if_not_found else 0}")
def set_config(node, *configs, nixos_version='25.05'):
def set_config(node, *configs, nixos_version='${lib.versions.majorMinor lib.version}'):
print(f"set_config({node.name!r}, *{configs!r}, nixos_version={nixos_version!r})", file=sys.stderr)
for config in configs:
args = [shlex.quote("${setConfig}")]
args.append(shlex.quote(config))
@@ -374,8 +387,13 @@ import ../make-test-python.nix (
args.append(shlex.quote(str(nixos_version)))
node.succeed(' '.join(args))
def run_mattermost_tests(mutableToplevel: str, mutable,
mostlyMutableToplevel: str, mostlyMutable,
def switch_to_specialisation(node, toplevel: str, specialisation: str):
print(f"switch_to_specialisation({node.name!r}, {toplevel!r}, {specialisation!r})", file=sys.stderr)
node.succeed(f"{toplevel}/specialisation/{specialisation}/bin/switch-to-configuration switch || true")
def run_mattermost_tests(shutdown_queue: queue.Queue,
mutableToplevel: str, mutable,
mostlyMutableToplevel: str, mostlyMutablePlugins: str, mostlyMutable,
immutableToplevel: str, immutable,
environmentFileToplevel: str, environmentFile):
esr, latest = '${pkgs.mattermost.version}', '${pkgs.mattermostLatest.version}'
@@ -391,8 +409,7 @@ import ../make-test-python.nix (
set_config(
mutable,
'.SupportSettings.AboutLink = "https://mattermost.com"',
'.SupportSettings.HelpLink = "https://nixos.org/nixos/manual"',
nixos_version='24.11' # Default 'mutable' config is an old version
'.SupportSettings.HelpLink = "https://nixos.org/nixos/manual"'
)
ensure_post(mutable)
restart_mattermost(mutable)
@@ -401,23 +418,14 @@ import ../make-test-python.nix (
expect_config(mutable, esr, '.AboutLink == "https://mattermost.com" and .HelpLink == "https://nixos.org/nixos/manual"')
ensure_post(mutable, fail_if_not_found=True)
# Switch to the newer config
mutable.succeed(f"{mutableToplevel}/specialisation/upgrade/bin/switch-to-configuration switch")
wait_mattermost_up(mutable)
# AboutLink and HelpLink should be changed, still, and the post should still exist
expect_config(mutable, esr, '.AboutLink == "https://mattermost.com" and .HelpLink == "https://nixos.org/nixos/manual"')
ensure_post(mutable, fail_if_not_found=True)
# Switch to the latest Mattermost version
mutable.succeed(f"{mutableToplevel}/specialisation/latest/bin/switch-to-configuration switch")
switch_to_specialisation(mutable, mutableToplevel, "latest")
wait_mattermost_up(mutable)
# AboutLink and HelpLink should be changed, still, and the post should still exist
expect_config(mutable, latest, '.AboutLink == "https://mattermost.com" and .HelpLink == "https://nixos.org/nixos/manual"')
ensure_post(mutable, fail_if_not_found=True)
mutable.shutdown()
shutdown_queue.put(mutable)
## Mostly mutable node tests ##
mostlyMutable.start()
@@ -434,13 +442,40 @@ import ../make-test-python.nix (
mostlyMutable,
'.SupportSettings.AboutLink = "https://mattermost.com"',
'.SupportSettings.HelpLink = "https://nixos.org/nixos/manual"',
nixos_version='24.11' # Default 'mostlyMutable' config is an old version
)
ensure_post(mostlyMutable)
restart_mattermost(mostlyMutable)
# HelpLink should be changed but AboutLink should not, and the post should exist
expect_config(mostlyMutable, esr, '.AboutLink == "https://nixos.org" and .HelpLink == "https://nixos.org/nixos/manual"')
ensure_post(mostlyMutable, fail_if_not_found=True)
# Switch to the newer config and make sure the plugins directory is replaced with a directory,
# since it could have been a symlink on previous versions.
mostlyMutable.systemctl("stop mattermost.service")
mostlyMutable.succeed(f"[ ! -L /var/lib/mattermost/data/plugins ] && rm -rf /var/lib/mattermost/data/plugins && ln -s {mostlyMutablePlugins} /var/lib/mattermost/data/plugins || true")
mostlyMutable.succeed('[ -L /var/lib/mattermost/data/plugins ] && [ -d /var/lib/mattermost/data/plugins ]')
switch_to_specialisation(mostlyMutable, mostlyMutableToplevel, "upgrade")
wait_mattermost_up(mostlyMutable)
mostlyMutable.succeed('[ ! -L /var/lib/mattermost/data/plugins ] && [ -d /var/lib/mattermost/data/plugins ]')
# HelpLink should be changed, still, and the post should still exist
expect_config(mostlyMutable, esr, '.AboutLink == "https://nixos.org" and .HelpLink == "https://nixos.org/nixos/manual"')
ensure_post(mostlyMutable, fail_if_not_found=True)
# Edit the config and make a post
set_config(
mostlyMutable,
'.SupportSettings.AboutLink = "https://mattermost.com/foo"',
'.SupportSettings.HelpLink = "https://nixos.org/nixos/manual/bar"',
'.PluginSettings.PluginStates."com.mattermost.plugin-todo".Enable = true'
)
ensure_post(mostlyMutable)
restart_mattermost(mostlyMutable)
# AboutLink should be overridden by NixOS configuration; HelpLink should be what we set above
expect_config(mostlyMutable, esr, '.AboutLink == "https://nixos.org" and .HelpLink == "https://nixos.org/nixos/manual"')
expect_config(mostlyMutable, esr, '.AboutLink == "https://nixos.org" and .HelpLink == "https://nixos.org/nixos/manual/bar"')
# Single plugin that's now enabled.
expect_plugins(mostlyMutable, 'length == 1')
@@ -449,14 +484,14 @@ import ../make-test-python.nix (
ensure_post(mostlyMutable, fail_if_not_found=True)
# Switch to the latest Mattermost version
mostlyMutable.succeed(f"{mostlyMutableToplevel}/specialisation/latest/bin/switch-to-configuration switch")
switch_to_specialisation(mostlyMutable, mostlyMutableToplevel, "latest")
wait_mattermost_up(mostlyMutable)
# AboutLink should be overridden and the post should still exist
expect_config(mostlyMutable, latest, '.AboutLink == "https://nixos.org" and .HelpLink == "https://nixos.org/nixos/manual"')
expect_config(mostlyMutable, latest, '.AboutLink == "https://nixos.org" and .HelpLink == "https://nixos.org/nixos/manual/bar"')
ensure_post(mostlyMutable, fail_if_not_found=True)
mostlyMutable.shutdown()
shutdown_queue.put(mostlyMutable)
## Immutable node tests ##
immutable.start()
@@ -484,14 +519,14 @@ import ../make-test-python.nix (
ensure_post(immutable, fail_if_not_found=True)
# Switch to the latest Mattermost version
immutable.succeed(f"{immutableToplevel}/specialisation/latest/bin/switch-to-configuration switch")
switch_to_specialisation(immutable, immutableToplevel, "latest")
wait_mattermost_up(immutable)
# AboutLink and HelpLink should be changed, still, and the post should still exist
expect_config(immutable, latest, '.AboutLink == "https://nixos.org" and .HelpLink == "https://search.nixos.org"')
ensure_post(immutable, fail_if_not_found=True)
immutable.shutdown()
shutdown_queue.put(immutable)
## Environment File node tests ##
environmentFile.start()
@@ -503,36 +538,56 @@ import ../make-test-python.nix (
ensure_post(environmentFile, fail_if_not_found=True)
# Switch to the latest Mattermost version
environmentFile.succeed(f"{environmentFileToplevel}/specialisation/latest/bin/switch-to-configuration switch")
switch_to_specialisation(environmentFile, environmentFileToplevel, "latest")
wait_mattermost_up(environmentFile)
# AboutLink should be changed still, and the post should still exist
expect_config(environmentFile, latest, '.AboutLink == "https://nixos.org"')
ensure_post(environmentFile, fail_if_not_found=True)
environmentFile.shutdown()
shutdown_queue.put(environmentFile)
run_mattermost_tests(
"${nodes.mysqlMutable.system.build.toplevel}",
mysqlMutable,
"${nodes.mysqlMostlyMutable.system.build.toplevel}",
mysqlMostlyMutable,
"${nodes.mysqlImmutable.system.build.toplevel}",
mysqlImmutable,
"${nodes.mysqlEnvironmentFile.system.build.toplevel}",
mysqlEnvironmentFile
)
# Run shutdowns asynchronously so we can pipeline them.
shutdown_queue: queue.Queue = queue.Queue()
def shutdown_worker():
while True:
node = shutdown_queue.get()
print(f"Shutting down node {node.name!r} asynchronously", file=sys.stderr)
node.shutdown()
shutdown_queue.task_done()
threading.Thread(target=shutdown_worker, daemon=True).start()
${pkgs.lib.optionalString pkgs.stdenv.isx86_64 ''
# Only run the MySQL tests on x86_64 so we don't have to debug MySQL ARM issues.
run_mattermost_tests(
shutdown_queue,
"${nodes.mysqlMutable.system.build.toplevel}",
mysqlMutable,
"${nodes.mysqlMostlyMutable.system.build.toplevel}",
"${nodes.mysqlMostlyMutable.services.mattermost.pluginsBundle}",
mysqlMostlyMutable,
"${nodes.mysqlImmutable.system.build.toplevel}",
mysqlImmutable,
"${nodes.mysqlEnvironmentFile.system.build.toplevel}",
mysqlEnvironmentFile
)
''}
run_mattermost_tests(
shutdown_queue,
"${nodes.postgresMutable.system.build.toplevel}",
postgresMutable,
"${nodes.postgresMostlyMutable.system.build.toplevel}",
"${nodes.postgresMostlyMutable.services.mattermost.pluginsBundle}",
postgresMostlyMutable,
"${nodes.postgresImmutable.system.build.toplevel}",
postgresImmutable,
"${nodes.postgresEnvironmentFile.system.build.toplevel}",
postgresEnvironmentFile
)
# Drain the queue
shutdown_queue.join()
'';
}
)
nixos/tests/nebula.nix
+14 -1
View File
@@ -14,7 +14,10 @@ import ./make-test-python.nix (
lib.mkMerge [
{
# Expose nebula for doing cert signing.
environment.systemPackages = [ pkgs.nebula ];
environment.systemPackages = [
pkgs.dig
pkgs.nebula
];
users.users.root.openssh.authorizedKeys.keys = [ snakeOilPublicKey ];
services.openssh.enable = true;
networking.firewall.enable = true; # Implicitly true, but let's make sure.
@@ -51,6 +54,7 @@ import ./make-test-python.nix (
lighthouse =
{ ... }@args:
makeNebulaNode args "lighthouse" {
networking.firewall.allowedUDPPorts = [ 53 ];
networking.interfaces.eth1.ipv4.addresses = lib.mkForce [
{
address = "192.168.1.1";
@@ -77,6 +81,13 @@ import ./make-test-python.nix (
}
];
};
lighthouse = {
dns = {
enable = true;
host = "10.0.100.1"; # bind to lighthouse interface
port = 53; # answer on standard DNS port
};
};
};
};
@@ -338,6 +349,8 @@ import ./make-test-python.nix (
# allowAny can ping the lighthouse, but not allowFromLighthouse because of its inbound firewall
allowAny.succeed("ping -c3 10.0.100.1")
allowAny.fail("ping -c3 10.0.100.3")
# allowAny can also resolve DNS on lighthouse
allowAny.succeed("dig @10.0.100.1 allowToLighthouse | grep -E 'allowToLighthouse\.\s+[0-9]+\s+IN\s+A\s+10\.0\.100\.4'")
# allowFromLighthouse can ping the lighthouse and allowAny
allowFromLighthouse.succeed("ping -c3 10.0.100.1")
nixos/tests/reposilite.nix
+53
View File
@@ -0,0 +1,53 @@
{ lib, ... }:
{
name = "reposilite";
nodes = {
machine =
{ pkgs, ... }:
{
services = {
mysql = {
enable = true;
package = pkgs.mariadb;
ensureDatabases = [ "reposilite" ];
initialScript = pkgs.writeText "reposilite-test-db-init" ''
CREATE USER 'reposilite'@'localhost' IDENTIFIED BY 'ReposiliteDBPass';
GRANT ALL PRIVILEGES ON reposilite.* TO 'reposilite'@'localhost';
FLUSH PRIVILEGES;
'';
};
reposilite = {
enable = true;
plugins = with pkgs.reposilitePlugins; [
checksum
groovy
];
extraArgs = [
"--token"
"test:SuperSecretTestToken"
];
database = {
type = "mariadb";
passwordFile = "/run/reposiliteDbPass";
};
settings.port = 8080;
};
};
};
};
testScript = ''
machine.start()
machine.execute("echo \"ReposiliteDBPass\" > /run/reposiliteDbPass && chmod 600 /run/reposiliteDbPass && chown reposilite:reposilite /run/reposiliteDbPass")
machine.wait_for_unit("reposilite.service")
machine.wait_for_open_port(8080)
machine.fail("curl -Sf localhost:8080/api/auth/me")
machine.succeed("curl -Sfu test:SuperSecretTestToken localhost:8080/api/auth/me")
'';
meta.maintainers = [ lib.maintainers.uku3lig ];
}
pkgs/applications/audio/calf/default.nix
+2 -2
View File
@@ -17,13 +17,13 @@
}:
stdenv.mkDerivation rec {
pname = "calf";
version = "0.90.4";
version = "0.90.6";
src = fetchFromGitHub {
owner = "calf-studio-gear";
repo = "calf";
tag = version;
hash = "sha256-E9H2YG1HAhIN+zJxDKIJTkJapbNz8h9dfd5YfZp9Zp0=";
hash = "sha256-rcMuQFig6BrnyGFyvYaAHmOvabEHGl+1lMNfffLHn1w=";
};
outputs = [
pkgs/applications/editors/emacs/default.nix
-2
View File
@@ -46,8 +46,6 @@ lib.makeScope pkgs.newScope (
withPgtk = true;
};
emacs28-macport = callPackage (self.sources.emacs28-macport) inheritedArgs;
emacs29-macport = callPackage (self.sources.emacs29-macport) inheritedArgs;
}
)
pkgs/applications/editors/emacs/make-emacs.nix
+2 -2
View File
@@ -535,10 +535,10 @@ mkDerivation (finalAttrs: {
};
};
meta = meta // {
meta = {
broken = withNativeCompilation && !(stdenv.buildPlatform.canExecute stdenv.hostPlatform);
knownVulnerabilities = lib.optionals (lib.versionOlder version "30") [
"CVE-2024-53920 CVE-2025-1244, please use newer versions such as emacs30"
];
};
} // meta;
})
pkgs/applications/editors/emacs/sources.nix
+20 -33
View File
@@ -13,6 +13,7 @@ let
patches ? _: [ ],
rev,
hash,
meta ? { },
}:
{
inherit
@@ -98,7 +99,7 @@ let
}
.${variant};
mainProgram = "emacs";
};
} // meta;
};
in
{
@@ -121,40 +122,26 @@ in
];
});
emacs28-macport = import ./make-emacs.nix (mkArgs {
pname = "emacs-mac";
version = "28.2";
variant = "macport";
rev = "emacs-28.2-mac-9.1";
hash = "sha256-Ne2jQ2nVLNiQmnkkOXVc5AkLVkTpm8pFC7VNY2gQjPE=";
patches = fetchpatch: [
# CVE-2022-45939
(fetchpatch {
url = "https://git.savannah.gnu.org/cgit/emacs.git/patch/?id=d48bb4874bc6cd3e69c7a15fc3c91cc141025c51";
hash = "sha256-TiBQkexn/eb6+IqJNDqR/Rn7S7LVdHmL/21A5tGsyJs=";
})
# https://lists.gnu.org/archive/html/emacs-devel/2024-03/msg00611.html
(fetchpatch {
url = "https://gitweb.gentoo.org/proj/emacs-patches.git/plain/emacs/28.2/10_all_org-macro-eval.patch?id=af40e12cb742510e5d40a06ffc6dfca97e340dd6";
hash = "sha256-OdGt4e9JGjWJPkfJhbYsmQQc6jart4BH5aIKPIbWKFs=";
})
(fetchpatch {
url = "https://gitweb.gentoo.org/proj/emacs-patches.git/plain/emacs/28.2/11_all_untrusted-content.patch?id=af40e12cb742510e5d40a06ffc6dfca97e340dd6";
hash = "sha256-wa2bsnCt5yFx0+RAFZGBPI+OoKkbrfkkMer/KBEc/wA=";
})
(fetchpatch {
url = "https://gitweb.gentoo.org/proj/emacs-patches.git/plain/emacs/28.2/12_all_org-remote-unsafe.patch?id=af40e12cb742510e5d40a06ffc6dfca97e340dd6";
hash = "sha256-b6WU1o3PfDV/6BTPfPNUFny6oERJCNsDrvflxX3Yvek=";
})
];
});
emacs29-macport = import ./make-emacs.nix (mkArgs {
pname = "emacs-mac";
version = "29.1";
version = "29.4";
variant = "macport";
rev = "emacs-29.1-mac-10.0";
hash = "sha256-TE829qJdPjeOQ+kD0SfyO8d5YpJjBge/g+nScwj+XVU=";
rev = "emacs-29.4-mac-10.1";
hash = "sha256-8OQ+fon9tclbh/eUJ09uqKfMaz9M77QnLIp2R8QB6Ic=";
patches = fetchpatch: [
# CVE-2024-53920
(fetchpatch {
url = "https://gitweb.gentoo.org/proj/emacs-patches.git/plain/emacs/29.4/07_all_trusted-content.patch?id=f24370de4de0a37304958ec1569d5c50c1745b7f";
hash = "sha256-zUWM2HDO5MHEB5fC5TCUxzmSafMvXO5usRzCyp9Q7P4=";
})
# CVE-2025-1244
(fetchpatch {
url = "https://gitweb.gentoo.org/proj/emacs-patches.git/plain/emacs/29.4/06_all_man.patch?id=f24370de4de0a37304958ec1569d5c50c1745b7f";
hash = "sha256-Vdf6GF5YmGoHTkxiD9mdYH0hgvfovZwrqYN1NQ++U1w=";
})
];
meta.knownVulnerabilities = [ ];
});
}
pkgs/applications/editors/jetbrains/default.nix
+1 -3
View File
@@ -82,9 +82,9 @@ let
pname
jdk
extraWrapperArgs
extraLdPath
extraBuildInputs
;
extraLdPath = extraLdPath ++ lib.optionals (stdenv.hostPlatform.isLinux) [ libGL ];
src =
if fromSource then
communitySources."${pname}"
@@ -336,7 +336,6 @@ rec {
libICE
libSM
libX11
libGL
];
}).overrideAttrs
(attrs: {
@@ -378,7 +377,6 @@ rec {
libxcrypt-legacy
fontconfig
xorg.libX11
libGL
]
++ lib.optionals (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isAarch64) [
expat
pkgs/applications/editors/vscode/extensions/almenon.arepl/default.nix
+20
View File
@@ -0,0 +1,20 @@
{
lib,
vscode-utils,
}:
vscode-utils.buildVscodeMarketplaceExtension {
mktplcRef = {
name = "arepl";
publisher = "almenon";
version = "3.0.0";
hash = "sha256-NadsB/6kUQ7/d9o3rUc7889jO+4MdvBhtyI4UUGpzqk=";
};
meta = {
description = "Preferred dark/light themes by John Papa";
downloadPage = "https://marketplace.visualstudio.com/items?itemName=almenon.arepl";
homepage = "https://github.com/Almenon/AREPL-vscode";
license = lib.licenses.mit;
maintainers = [ lib.maintainers.therobot2105 ];
};
}
pkgs/applications/editors/vscode/extensions/betterthantomorrow.calva/default.nix
+2 -2
View File
@@ -10,8 +10,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
mktplcRef = {
name = "calva";
publisher = "betterthantomorrow";
version = "2.0.374";
hash = "sha256-VwdHOkduSSIrcOvrcVf7K8DSp3N1u9fvbaCVDCxp+bk=";
version = "2.0.496";
hash = "sha256-vf6JwsMMAcAZMXTRrczgEpvmmN34eSgsO8QXNL4+DHM=";
};
nativeBuildInputs = [
jq
pkgs/applications/editors/vscode/extensions/castwide.solargraph/default.nix
+2 -2
View File
@@ -4,8 +4,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
mktplcRef = {
name = "solargraph";
publisher = "castwide";
version = "0.24.1";
hash = "sha256-M96kGuCKo232rIwLovDU+C/rhEgZWT4s/zsR7CUYPnk=";
version = "0.25.0";
hash = "sha256-5SmCkHGCS8dYfdSm3NRk091jH44m+7kkj+VL84YKM4g=";
};
meta = {
description = "Ruby language server featuring code completion, intellisense, and inline documentation";
pkgs/applications/editors/vscode/extensions/default.nix
+75 -73
View File
@@ -241,6 +241,8 @@ let
};
};
almenon.arepl = callPackage ./almenon.arepl { };
alygin.vscode-tlaplus = buildVscodeMarketplaceExtension {
mktplcRef = {
name = "vscode-tlaplus";
@@ -257,8 +259,8 @@ let
mktplcRef = {
name = "ng-template";
publisher = "Angular";
version = "19.2.2";
hash = "sha256-WoNrKcK9Gr9gVWH/pwKyEUHuzcVNKh6zQwwpG4BuVCg=";
version = "19.2.3";
hash = "sha256-fW7JtaFXBR+PL17CUCtIAXndO/fBctisHd/uZg5Dez4=";
};
meta = {
changelog = "https://marketplace.visualstudio.com/items/Angular.ng-template/changelog";
@@ -490,8 +492,8 @@ let
mktplcRef = {
publisher = "banacorn";
name = "agda-mode";
version = "0.5.4";
hash = "sha256-U+J1FxFMK0tfi+YueXohnommHXagoadVYsZLp5lAC3Q=";
version = "0.5.5";
hash = "sha256-xz+KO743jGziLzO7pINTcOX9JV68MJ0juDl+rpr9hk8=";
};
meta = {
changelog = "https://marketplace.visualstudio.com/items/banacorn.agda-mode/changelog";
@@ -781,8 +783,8 @@ let
mktplcRef = {
name = "vscode-tailwindcss";
publisher = "bradlc";
version = "0.14.12";
hash = "sha256-Dn+Z5uZYoWSriNnkYK1rRoHv8sjr7ui70UeTA3e0wIs=";
version = "0.14.14";
hash = "sha256-LUjVrtL1HmxzzW8OqbadN/p3DdZDwSj2iFeXudV2ULo=";
};
meta = {
changelog = "https://marketplace.visualstudio.com/items/bradlc.vscode-tailwindcss/changelog";
@@ -1011,8 +1013,8 @@ let
mktplcRef = {
name = "coder-remote";
publisher = "coder";
version = "1.5.0";
hash = "sha256-l4F3HZKkqANw9ErCE75IpI3GIWJIkePOW9+4QsKWaVQ=";
version = "1.7.0";
hash = "sha256-uUm5kS8vjCKGpJOdyJcE/ig3DUZSsQ7LbvYodNyWF5w=";
};
meta = {
description = "Extension for Visual Studio Code to open any Coder workspace in VS Code with a single click";
@@ -1158,8 +1160,8 @@ let
mktplcRef = {
name = "dbclient-jdbc";
publisher = "cweijan";
version = "1.4.2";
hash = "sha256-ru4c7/6X3HfKyn5wz7I5PRh+A4bntB+FAWEGUzjMlY8=";
version = "1.4.3";
hash = "sha256-XaV7N3IFe6+gc/qrHkSUikAQghJb6k6+XE5fMYWdyDY=";
};
meta = {
description = "JDBC Adapter For Database Client";
@@ -1174,8 +1176,8 @@ let
mktplcRef = {
name = "vscode-database-client2";
publisher = "cweijan";
version = "8.2.3";
hash = "sha256-QOYTJSO0kGXSjvLnkbmbXSaKZcvWqO07yvZ/PNe8Fmc=";
version = "8.2.4";
hash = "sha256-tfUEUFyijRfzH805Eb26fgrIPLPv2GuOsCOqHuQQmQM=";
};
meta = {
description = "Database Client For Visual Studio Code";
@@ -1203,8 +1205,8 @@ let
mktplcRef = {
publisher = "DanielSanMedium";
name = "dscodegpt";
version = "3.9.49";
hash = "sha256-YKeUgQpnH5XrYOiUdU5R2a9PJLj2iLYPXxhGdXAqW8U=";
version = "3.10.68";
hash = "sha256-CB6XraQoMoFRhSKZzTVwsXs5ip5PfYraGR6GyULxrl0=";
};
meta = {
changelog = "https://marketplace.visualstudio.com/items/DanielSanMedium.dscodegpt/changelog";
@@ -1220,8 +1222,8 @@ let
mktplcRef = {
publisher = "daohong-emilio";
name = "yash";
version = "0.3.0";
hash = "sha256-vQ0r1/DEfA6ebB4NmUciO5d4zRWS4pZeTXspWVRfe4g=";
version = "0.3.1";
hash = "sha256-DentLM/XT7b7O4vptVcja9E8pQjiDPOLilo8wjTH0IE=";
};
meta = {
license = lib.licenses.mit;
@@ -1233,8 +1235,8 @@ let
mktplcRef = {
name = "dart-code";
publisher = "dart-code";
version = "3.107.20250311";
hash = "sha256-A66/oodVLCFT2+UAP+DW+Un8T5l396UDACzHYHbe7Hk=";
version = "3.108.2";
hash = "sha256-tBJSx0m/RWWkZaBdoM7awaBt7ZrfWic0AIYUAGyNz+E=";
};
meta.license = lib.licenses.mit;
@@ -1244,8 +1246,8 @@ let
mktplcRef = {
name = "flutter";
publisher = "dart-code";
version = "3.107.20250303";
hash = "sha256-xhhZIZK7ywNxoXHeih/fpR0QoatIkbzcfX+eXOogzJs=";
version = "3.108.0";
hash = "sha256-+wqnHTQhVuSn46CsIVa3PCCrJ73kRr9oOLePm3uPshA=";
};
meta.license = lib.licenses.mit;
@@ -1482,8 +1484,8 @@ let
mktplcRef = {
publisher = "discloud";
name = "discloud";
version = "2.22.36";
hash = "sha256-SZ9cT5fowDS8NcWpZWU05+VEiDENs/vCikc8K6loRms=";
version = "2.22.40";
hash = "sha256-YxWla1bayzIX70PxdFSZuJum6ddazzgQKjRH7DpceTY=";
};
meta = {
changelog = "https://marketplace.visualstudio.com/items/discloud.discloud/changelog";
@@ -1511,8 +1513,8 @@ let
mktplcRef = {
name = "competitive-programming-helper";
publisher = "DivyanshuAgrawal";
version = "2025.3.1742989763";
hash = "sha256-e7pRhZOe+6UW7VE63yX+Il2YZToR4cwYqEar+aAPlkc=";
version = "2025.4.1743875007";
hash = "sha256-WtzJ9rcssUAk2zACjqWYpwh6aHtzh9eGMGANeeFqCnU=";
};
meta = {
changelog = "https://marketplace.visualstudio.com/items/DivyanshuAgrawal.competitive-programming-helper/changelog";
@@ -1595,8 +1597,8 @@ let
# semver scheme, contrary to preview versions which are listed on
# the VSCode Marketplace and use a calver scheme. We should avoid
# using preview versions, because they expire after two weeks.
version = "16.3.3";
hash = "sha256-nc/EaMhZSdpd3ZaRQLZkSh1p4Ai3CFN4GunI2+o/+ZI=";
version = "17.0.1";
hash = "sha256-0wRhdVR9q7oFjQQM090oXRxICUMCu7BjgOGkKTxeQmg=";
};
meta = {
changelog = "https://marketplace.visualstudio.com/items/eamodio.gitlens/changelog";
@@ -1898,8 +1900,8 @@ let
mktplcRef = {
name = "vscode-jest-runner";
publisher = "firsttris";
version = "0.4.79";
hash = "sha256-gcykn/mOvNzFKjKyY4fVhmIWR2kBKCo1ILpp1am0dIw=";
version = "0.4.80";
hash = "sha256-Qe0EOKohvk/ALYT0QbOiYKOkBvfF63hv3T4VwiIls6A=";
};
meta = {
description = "Simple way to run or debug a single (or multiple) tests from context-menu";
@@ -2105,8 +2107,8 @@ let
publisher = "github";
name = "copilot";
# Verify which version is available with nix run nixpkgs#vsce -- show github.copilot --json
version = "1.293.0";
hash = "sha256-LwgINocPHA9jL6pMw40BgaZ3lOUwWPoOJWTDr+27h5Q=";
version = "1.297.0";
hash = "sha256-UVL0Yf8MSY7ETOxmEK+dljrOQL9ctUWVhbYdr0v00b0=";
};
meta = {
@@ -2171,8 +2173,8 @@ let
mktplcRef = {
publisher = "github";
name = "vscode-pull-request-github";
version = "0.107.2025031304";
hash = "sha256-BWmcAocEWBE7eeiyMBUcTBmozPWgLkdiDOskhf7drD8=";
version = "0.108.0";
hash = "sha256-GNNPc8nzNIrPOn+4ujKvhKodeHt9r1QlV8+EgqIz54I=";
};
meta = {
license = lib.licenses.mit;
@@ -2183,8 +2185,8 @@ let
mktplcRef = {
name = "gitlab-workflow";
publisher = "gitlab";
version = "6.6.0";
hash = "sha256-Tf1rsKK1KMBonwBR/2fZv2F6VLkPYXzX7sI3EipZvrQ=";
version = "6.7.1";
hash = "sha256-qNOjbDdGrab53YYO4TCqxk8v2pmvjElgeXYU525/6Eg=";
};
meta = {
description = "GitLab extension for Visual Studio Code";
@@ -2550,8 +2552,8 @@ let
mktplcRef = {
name = "ionic";
publisher = "ionic";
version = "1.103.0";
hash = "sha256-TjtMkFCKu30LUvYv7nKav9EZlnmm3iXb9LlRYPPfKB0=";
version = "1.104.0";
hash = "sha256-E3Hfs7YgZ4+eF0Pg7CI7fPFt6DEtFw0DdLq4BSY7vBQ=";
};
meta = {
description = "Official VSCode extension for Ionic and Capacitor development";
@@ -2566,8 +2568,8 @@ let
mktplcRef = {
name = "Ionide-fsharp";
publisher = "Ionide";
version = "7.25.5";
hash = "sha256-Aak4uML3NqMaq4IJzcGHTYbcXlq1y/ZJ6m/f1pQWoQs=";
version = "7.25.7";
hash = "sha256-6AN6LrFGWmLsCwRrtLqW1Mf+txReGeg7fvZ8W2Jv8Uo=";
};
meta = {
changelog = "https://marketplace.visualstudio.com/items/Ionide.Ionide-fsharp/changelog";
@@ -2827,8 +2829,8 @@ let
mktplcRef = {
name = "lean";
publisher = "jroesch";
version = "0.16.59";
hash = "sha256-tXiAM2MBF+Axd0zB7Rlgx8b8FgwlLaZex0++H2DpBls=";
version = "0.16.60";
hash = "sha256-z0mOnbqpKMH5d78jAMgDIgO+5sk4xHOWAfa4kzXYISs=";
};
meta = {
changelog = "https://github.com/leanprover/vscode-lean/blob/v${mktplcRef.version}/README.md#release-notes";
@@ -3074,8 +3076,8 @@ let
mktplcRef = {
name = "vscode-ltex-plus";
publisher = "ltex-plus";
version = "15.4.0";
hash = "sha256-ET7ZnXKiT4IAoySMaZn0O2awsKtWMGgnTT7xOEcSim4=";
version = "15.5.0";
hash = "sha256-tAqtWX7NHR8ftrtDRY2BGk3VwLa0Wx9OxQo8uGF/JlA=";
};
meta = {
description = "VS Code extension for grammar/spell checking using LanguageTool with support for LaTeX, Markdown, and others";
@@ -3119,8 +3121,8 @@ let
mktplcRef = {
name = "marp-vscode";
publisher = "marp-team";
version = "3.1.1";
hash = "sha256-WRhLd5uTy3F2rBf/9emjm9JB5hvRv+dB66vhuqnedwc=";
version = "3.2.0";
hash = "sha256-SSkmvm9NJnLw38luZWF6K7g5caaivtP+v+39qPR/oyo=";
};
meta = {
license = lib.licenses.mit;
@@ -3209,8 +3211,8 @@ let
mktplcRef = {
name = "rainbow-csv";
publisher = "mechatroner";
version = "3.18.0";
hash = "sha256-zmIaGvenFU8jiGHGIk3d6dmXO12t+WMwq76OEUbclgg=";
version = "3.19.0";
hash = "sha256-el3vcF90RZiXrqlBxAko9mLdeoThnwGb/JzmR1woutc=";
};
meta = {
changelog = "https://marketplace.visualstudio.com/items/mechatroner.rainbow-csv/changelog";
@@ -3349,8 +3351,8 @@ let
mktplcRef = {
name = "vscode-dotnet-runtime";
publisher = "ms-dotnettools";
version = "2.3.0";
hash = "sha256-KfWQpg+qSxrmL4z05pk239i8bY6EMJpu6F48mJbnK08=";
version = "2.3.1";
hash = "sha256-0bn2B17kJd5uXe/MJCzYin2iWGdKD4H4nUIXdzb5NxM=";
};
meta = {
changelog = "https://marketplace.visualstudio.com/items/ms-dotnettools.vscode-dotnet-runtime/changelog";
@@ -3368,26 +3370,26 @@ let
sources = {
"x86_64-linux" = {
arch = "linux-x64";
hash = "sha256-oQMwzQuW5vjxtDboRCeiEO5aytsAY6rb14JDTmK3JPg=";
hash = "sha256-pmA7BNwyHiaU93j61/MyrBV5kH0DlW+7BA6HNlKGnso=";
};
"x86_64-darwin" = {
arch = "darwin-x64";
hash = "sha256-/9+qtLDNYUFvdoehit3BihA38p6RqJ7na5Q27xxpZk0=";
hash = "sha256-E2KRzjIxLFmwArzEKittjejacrCOFFNNzphWw8v5CpE=";
};
"aarch64-linux" = {
arch = "linux-arm64";
hash = "sha256-JqLlYMKyTXaEzuTPPxVaO8WJiuCUN+9xBzyA6+aYdSc=";
hash = "sha256-pnQP1OKr3NJgUuXzO1InYqGA49OuMFn2iEf8wpl4PqM=";
};
"aarch64-darwin" = {
arch = "darwin-arm64";
hash = "sha256-dhiUePePkO3MxRQ5UP+lOxRax503JlERe/GWJ8pPUIg=";
hash = "sha256-8XIeK5AIFKQaK5YMNSRqxr5p72zXb7ZLPq6PbeWO864=";
};
};
in
{
name = "vscodeintellicode-csharp";
publisher = "ms-dotnettools";
version = "2.1.11";
version = "2.2.3";
}
// sources.${stdenv.system};
nativeBuildInputs = lib.optionals stdenv.hostPlatform.isLinux [ autoPatchelfHook ];
@@ -3415,8 +3417,8 @@ let
mktplcRef = {
name = "vscode-kubernetes-tools";
publisher = "ms-kubernetes-tools";
version = "1.3.20";
hash = "sha256-83KcESin+w3Y6jiSrSq6iWF99jformxr7NTnYSkKtKQ=";
version = "1.3.21";
hash = "sha256-/Y7sRpJzwmo3fgwdrYqNNu8XA+j3zohJBv9vOcm3bRk=";
};
meta = {
license = lib.licenses.mit;
@@ -3638,8 +3640,8 @@ let
mktplcRef = {
name = "remote-containers";
publisher = "ms-vscode-remote";
version = "0.404.0";
hash = "sha256-7rPJruFk3XbDvipIYqYwwsbhofuViXsdtnKihiwRKok=";
version = "0.409.0";
hash = "sha256-K+pJeon1EWux3pnfzvwCODo55vWpA2Lvps4GFJW/ALU=";
};
meta = {
description = "Open any folder or repository inside a Docker container";
@@ -3952,8 +3954,8 @@ let
mktplcRef = {
name = "material-icon-theme";
publisher = "PKief";
version = "5.20.0";
sha256 = "sha256-Z83FXPf8mXcxmzOdk8IG9ZcP/1OYL8pEHEKPc3pZFdo=";
version = "5.21.2";
sha256 = "sha256-HEcFa+SCosf5UonqxFQZI+G5ogxCaScmHt54xn4H4QI=";
};
meta = {
license = lib.licenses.mit;
@@ -4550,8 +4552,8 @@ let
mktplcRef = {
publisher = "sonarsource";
name = "sonarlint-vscode";
version = "4.18.0";
hash = "sha256-+2aeJhIwH6oiRQcPK714u8IiU3QKwhQOB0xgmsf4DXw=";
version = "4.19.0";
hash = "sha256-IjukIQIs4RoCZyzJiRDgFIPBvIK5Wn8o7NdvbfqlMBI=";
};
meta.license = lib.licenses.lgpl3Only;
};
@@ -4641,8 +4643,8 @@ let
mktplcRef = {
publisher = "streetsidesoftware";
name = "code-spell-checker";
version = "4.0.41";
hash = "sha256-M/uqzU64nqSdRtxxQ1H+pg0YdkqYXEHlxmXrVcn/UqA=";
version = "4.0.45";
hash = "sha256-2goKjykQMLTRPP9Y0aBXLu3qDlhEKO00x82C18nKlIY=";
};
meta = {
changelog = "https://marketplace.visualstudio.com/items/streetsidesoftware.code-spell-checker/changelog";
@@ -4751,8 +4753,8 @@ let
mktplcRef = {
name = "tabnine-vscode";
publisher = "tabnine";
version = "3.249.0";
hash = "sha256-Pp1LlVAkozh2kIEvmPxg4LuuT08MeGbMN77M5Mx81qI=";
version = "3.253.0";
hash = "sha256-4FDYIDLqb66XylX1WRGqbwqBUc0XgNG6XENEVXC/7Sk=";
};
meta = {
license = lib.licenses.mit;
@@ -5038,8 +5040,8 @@ let
mktplcRef = {
name = "uiua-vscode";
publisher = "uiua-lang";
version = "0.0.62";
hash = "sha256-Fq3NmCL17QVAmOmFWSkxc0qRwCRDsRbkeRzwyP02Nq4=";
version = "0.0.63";
hash = "sha256-qlBcnQyH5VbgmBlTvVi59OpYtyuVrJLoSuRIbrBGFVE=";
};
meta = {
description = "VSCode language extension for Uiua";
@@ -5092,8 +5094,8 @@ let
mktplcRef = {
name = "errorlens";
publisher = "usernamehw";
version = "3.24.0";
hash = "sha256-r5xXR4rDbP+2bk66yqPoLod8IZXFrntcKHuWbAiFWwE=";
version = "3.25.0";
hash = "sha256-Gszz6sGJt6DBgVCH7tgTGTX73TbKBwityJn7cY39WmU=";
};
meta = {
changelog = "https://marketplace.visualstudio.com/items/usernamehw.errorlens/changelog";
@@ -5292,8 +5294,8 @@ let
mktplcRef = {
publisher = "vscjava";
name = "vscode-java-test";
version = "0.43.0";
hash = "sha256-EM0S1Y4cRMBCRbAZgl9m6fIhANPrvdGVZXOLlDLnVWo=";
version = "0.43.1";
hash = "sha256-yiKBG1A5ahvB6iTqh2yzFzcKJlU1lu4dqd+4cygWVQ4=";
};
meta = {
license = lib.licenses.mit;
@@ -5681,8 +5683,8 @@ let
mktplcRef = {
name = "vscode-zig";
publisher = "ziglang";
version = "0.6.7";
hash = "sha256-l8pu348v2JUg/7+Qy5B41eyraPUj9WQ1WuW1aumgM9w=";
version = "0.6.8";
hash = "sha256-u4Vd2YP47ccpz4ZMOGDN1eFS8qiC7nGIbo6YtvxNHFM=";
};
meta = {
changelog = "https://marketplace.visualstudio.com/items/ziglang.vscode-zig/changelog";
pkgs/applications/editors/vscode/extensions/ms-python.debugpy/default.nix
+2 -2
View File
@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
mktplcRef = {
name = "debugpy";
publisher = "ms-python";
version = "2025.4.1";
hash = "sha256-PzO5CA/JaLlyMMQ0wOIIvoL116boSOpqtX9plw9IUgQ=";
version = "2025.6.0";
hash = "sha256-sdePoi+GdWi0AMWLOvVtCYkCbdxZMx2pMJAZF7aYluc=";
};
meta = {
pkgs/applications/editors/vscode/extensions/ms-toolsai.jupyter/default.nix
+2 -2
View File
@@ -9,8 +9,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
mktplcRef = {
name = "jupyter";
publisher = "ms-toolsai";
version = "2025.2.0";
hash = "sha256-YMvu8aEumV3VTdNZKiLK+5jmTL9y5tcMxrEBwEMcTI4=";
version = "2025.3.0";
hash = "sha256-dH74EX5PDq4t/CukjsswtKLVwbE+q0J+fpZ1MA8CDZI=";
};
nativeBuildInputs = [
pkgs/applications/editors/vscode/extensions/ms-vscode-remote.remote-ssh/default.nix
+2 -2
View File
@@ -84,8 +84,8 @@ buildVscodeMarketplaceExtension {
mktplcRef = {
name = "remote-ssh";
publisher = "ms-vscode-remote";
version = "0.118.0";
hash = "sha256-LHsOjl5fIm4/ixlFs/yL/U2VRwRMigRk0Q3MtNdyzVE=";
version = "0.119.0";
hash = "sha256-S6quMPlDNSLIqyMmTZsDts5bLh2LBdAPuQibT3AEHH8=";
};
postPatch = ''
pkgs/applications/editors/vscode/extensions/ms-vscode.cpptools/default.nix
+3 -3
View File
@@ -41,11 +41,11 @@ let
isx86Linux = stdenv.hostPlatform.system == "x86_64-linux";
supported = {
x86_64-linux = {
hash = "sha256-ek4WBr9ZJ87TXlKQowA68YNt3WNOXymLcVfz1g+Be2o=";
hash = "sha256-KWr+nfODCRoZq67qwswzbcPW5WMmf9kvRwNFKpjyt4k=";
arch = "linux-x64";
};
aarch64-linux = {
hash = "sha256-2+JqosgyoMRFnl8fnCrKljkdF3eU72mXy30ZUnaIerA=";
hash = "sha256-a6PwlSo3q1hLVx0JDSTwPGfjfk7CtdYCuFccSpPg7U8=";
arch = "linux-arm64";
};
};
@@ -58,7 +58,7 @@ vscode-utils.buildVscodeMarketplaceExtension {
mktplcRef = base // {
name = "cpptools";
publisher = "ms-vscode";
version = "1.22.2";
version = "1.24.5";
};
nativeBuildInputs = [
pkgs/applications/editors/vscode/extensions/ms-windows-ai-studio.windows-ai-studio/default.nix
+2 -2
View File
@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
mktplcRef = {
name = "windows-ai-studio";
publisher = "ms-windows-ai-studio";
version = "0.6.1";
hash = "sha256-BAA7wSfyJ4y8how+NnaGdCf/BCU6aOmI8ew8qpcQCnY=";
version = "0.10.9";
hash = "sha256-JhpPOnzFQmTtzyl5p/dqFH/tjJ4qsfJhdco6uLUpVN4=";
};
meta = {
pkgs/applications/editors/vscode/extensions/rooveterinaryinc.roo-cline/default.nix
+2 -2
View File
@@ -8,8 +8,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
mktplcRef = {
publisher = "RooVeterinaryInc";
name = "roo-cline";
version = "3.10.5";
hash = "sha256-7A8BQHUu7CYA28fHv68Zvf6zhlJwwXZaNVLb+/cBAIg=";
version = "3.11.9";
hash = "sha256-+Bi9nHRXXZGKGvTS8o0CbtS6KBJmQz+Wiiinqs16vZA=";
};
passthru.updateScript = vscode-extensions-update-script { };
pkgs/applications/editors/vscode/extensions/saoudrizwan.claude-dev/default.nix
+2 -2
View File
@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
mktplcRef = {
name = "claude-dev";
publisher = "saoudrizwan";
version = "3.8.6";
hash = "sha256-JqrzMZoAlBcBfQPWJn+c0PW5ScWclstg5BDPyntN3co=";
version = "3.9.2";
hash = "sha256-InlftUHtOHEszgtjPl7H6V0PkyHUEZ6MqyZTbFtjA+k=";
};
meta = {
pkgs/applications/editors/vscode/extensions/visualjj.visualjj/default.nix
+5 -5
View File
@@ -11,26 +11,26 @@ vscode-utils.buildVscodeMarketplaceExtension {
sources = {
"x86_64-linux" = {
arch = "linux-x64";
hash = "sha256-s3peDZApzSfemXRqRjf5fYQGHVf1DAP7XG4NuOqiGcY=";
hash = "sha256-Sno0UnWnuOogT9DMEF+8dMZLqxAoHSsKORkHpre40dE=";
};
"x86_64-darwin" = {
arch = "darwin-x64";
hash = "sha256-WutwGOcXoREk6oUdFjhsKcrf64CG4GSn9JgGWiQe9l8=";
hash = "sha256-GaqBiAs0G9h1p2itDITPFBkFD1uOmM0fEp4tKmYFCXY=";
};
"aarch64-linux" = {
arch = "linux-arm64";
hash = "sha256-377T8cfY4jHX+iJjdDScMP+wX6UZCYLasl16ngwfq6U=";
hash = "sha256-uDRhsAGw7mEI2ztC8QWDtrHAeMwk9IzU5Sln7HQl+1Y=";
};
"aarch64-darwin" = {
arch = "darwin-arm64";
hash = "sha256-fufJ9NV73skhwBFe2vCLjh5ykQagXfO0VAdHGPhfOQ4=";
hash = "sha256-/5VEFXlGORo9t5ehDmLcqb0cYvJ6Gb1yIootyqpMZM8=";
};
};
in
{
name = "visualjj";
publisher = "visualjj";
version = "0.14.2";
version = "0.14.4";
}
// sources.${stdenvNoCC.hostPlatform.system}
or (throw "Unsupported system ${stdenvNoCC.hostPlatform.system}");
pkgs/applications/emulators/libretro/cores/beetle-pce-fast.nix
+3 -3
View File
@@ -5,13 +5,13 @@
}:
mkLibretroCore {
core = "mednafen-pce-fast";
version = "0-unstable-2025-03-07";
version = "0-unstable-2025-03-28";
src = fetchFromGitHub {
owner = "libretro";
repo = "beetle-pce-fast-libretro";
rev = "9f2b7943db1fb784daf0948b0b493bc7f76919f8";
hash = "sha256-fwrfZ0Z/DAtDRuBqxCS11/qNoomAtUgEOf4eOLk9vO0=";
rev = "4ee33ff536f14295c178a037f9b5d5a960ce3c6f";
hash = "sha256-ZL+aV469RHp5SSBFmK0q+1h2MdcM1q+TZu5Rrv/N0DU=";
};
makefile = "Makefile";
pkgs/applications/emulators/libretro/cores/beetle-psx.nix
+3 -3
View File
@@ -8,13 +8,13 @@
}:
mkLibretroCore {
core = "mednafen-psx" + lib.optionalString withHw "-hw";
version = "0-unstable-2025-03-28";
version = "0-unstable-2025-04-04";
src = fetchFromGitHub {
owner = "libretro";
repo = "beetle-psx-libretro";
rev = "e2522914f72291ad7232d996e7eabdf167b1b414";
hash = "sha256-uxnRNP5BRpabHLjuI4IiLzqCfRobETEMnwJ9mw+ZdaE=";
rev = "90c09d4b8e6923a22538c35f68ace2d9fead134d";
hash = "sha256-eVoKmGE3N8uePcNpxWjAjgUjTIfEHZR3K2FLtQtLp+M=";
};
extraBuildInputs = lib.optionals withHw [
pkgs/applications/emulators/libretro/cores/bsnes.nix
+3 -3
View File
@@ -5,13 +5,13 @@
}:
mkLibretroCore {
core = "bsnes";
version = "0-unstable-2025-03-07";
version = "0-unstable-2025-04-04";
src = fetchFromGitHub {
owner = "libretro";
repo = "bsnes-libretro";
rev = "ec353ea2502be9b71f3d9830b7a7b66ee69e254c";
hash = "sha256-9QRKEIi1JHd503KN9+DKxLMJMJWyNu9vomPAmlbb/zw=";
rev = "8d89089d35bedc257dc13bebd3790f70417311a5";
hash = "sha256-0n2N2Ks8MIy7dcuj2SESjDNxma7RRhAgOxQ5sC3XJTM=";
};
makefile = "Makefile";
pkgs/applications/emulators/libretro/cores/fceumm.nix
+3 -3
View File
@@ -5,13 +5,13 @@
}:
mkLibretroCore {
core = "fceumm";
version = "0-unstable-2025-02-12";
version = "0-unstable-2025-04-06";
src = fetchFromGitHub {
owner = "libretro";
repo = "libretro-fceumm";
rev = "26f92531a95a9a74f45a8bf13fc9f3f48cde2976";
hash = "sha256-XtSuZEfu03dFMQUX4VvpeFLzoWG3TeIBQG4cQkap+t8=";
rev = "b349f7f3e211bb7725f133d3818ab98da5059760";
hash = "sha256-MNYpuipjnDl9GUl5qWGi5W5cFhUCd/weCKuTRdttKJ4=";
};
meta = {
pkgs/applications/emulators/libretro/cores/gambatte.nix
+3 -3
View File
@@ -5,13 +5,13 @@
}:
mkLibretroCore {
core = "gambatte";
version = "0-unstable-2025-03-07";
version = "0-unstable-2025-04-04";
src = fetchFromGitHub {
owner = "libretro";
repo = "gambatte-libretro";
rev = "4b3edb41d33e52b6d70c4e18bf0819a070991b66";
hash = "sha256-8RmNDvUd64FqEgduNMHgbunu92SqMi+Pn//Ou2EQUFs=";
rev = "2910240a4100ccad68f935082b8bbce194673cb5";
hash = "sha256-segz2SocZaNNgToNQOIEVIOD3CidyZIS81dStcdAsTs=";
};
meta = {
pkgs/applications/emulators/libretro/cores/genesis-plus-gx.nix
+3 -3
View File
@@ -5,13 +5,13 @@
}:
mkLibretroCore {
core = "genesis-plus-gx";
version = "0-unstable-2025-03-08";
version = "0-unstable-2025-04-04";
src = fetchFromGitHub {
owner = "libretro";
repo = "Genesis-Plus-GX";
rev = "1024afbcd77a7bf7c87972c7c86d3a7759877fc7";
hash = "sha256-9Y3uzWpiYIRGTFApVGdLIONpBpPaO1sRgaGj1EVI3M4=";
rev = "32a4853c5fd352cc3054e83ed375476cf023aa5f";
hash = "sha256-3r562/3WWWkibEKzPrA+lASY5Wpz8kuX5EQKqFKJdAA=";
};
meta = {
pkgs/applications/emulators/libretro/cores/mame.nix
+3 -3
View File
@@ -9,13 +9,13 @@
}:
mkLibretroCore {
core = "mame";
version = "0-unstable-2025-03-06";
version = "0-unstable-2025-04-01";
src = fetchFromGitHub {
owner = "libretro";
repo = "mame";
rev = "40edadab2e445bfda9d206def9508b43b11fb96a";
hash = "sha256-TrDx77VCdtLuihwhlz+sYkUvegTxsG8eAn3h6KYO3z0=";
rev = "a638be8510d061f435e2abd46e514bb6c7e41262";
hash = "sha256-adMLJ3mm+02X07UwG3ojhdt1x5+FvCartxNc/EHz4CQ=";
fetchSubmodules = true;
};
pkgs/applications/emulators/libretro/cores/mame2003-plus.nix
+3 -3
View File
@@ -5,13 +5,13 @@
}:
mkLibretroCore {
core = "mame2003-plus";
version = "0-unstable-2025-03-27";
version = "0-unstable-2025-04-07";
src = fetchFromGitHub {
owner = "libretro";
repo = "mame2003-plus-libretro";
rev = "4df08f409666e46a0a2d94c3cebcfbba72975ca9";
hash = "sha256-Dp4f3j9Zm3BLMftEJSDSYrqPy1zJ8miStiUTI9mFdLw=";
rev = "2b5fc26ee64d963021bc266aa45f19d90b282f92";
hash = "sha256-ZbebYUOUdaLVTh+VD8AQvAv/zQzr6tugJRl3iYSrUeo=";
};
makefile = "Makefile";
pkgs/applications/emulators/libretro/cores/mame2003.nix
+3 -3
View File
@@ -5,13 +5,13 @@
}:
mkLibretroCore {
core = "mame2003";
version = "0-unstable-2025-03-18";
version = "0-unstable-2025-04-02";
src = fetchFromGitHub {
owner = "libretro";
repo = "mame2003-libretro";
rev = "8565eec2e963b78f07a5a1f4b74df1271f3ece13";
hash = "sha256-pChPUwKIOtP4nl9ReqlrgxOJ/qcO6m2SnHhx3Y+hktM=";
rev = "a0547e84a8f58856551ca2d252f05f56212810a4";
hash = "sha256-POpKNpPOyOp/EkrUTa2esOJAaWoJvuijDToF6/V41uU=";
};
# Fix build with GCC 14
pkgs/applications/emulators/libretro/cores/pcsx-rearmed.nix
+3 -3
View File
@@ -5,13 +5,13 @@
}:
mkLibretroCore {
core = "pcsx-rearmed";
version = "0-unstable-2025-03-26";
version = "0-unstable-2025-03-30";
src = fetchFromGitHub {
owner = "libretro";
repo = "pcsx_rearmed";
rev = "4b0894f55fb7244b522fb720f41363e86f2085fe";
hash = "sha256-748TR87fO1BLBWwDAJxkEBr327g64RUTdBvvMu6lSEI=";
rev = "6091efb4d64ed745495455ba82352ec82f55cb4f";
hash = "sha256-9FyD3a6FE7xtt/UGvRNfopvQPgAg/0QGrJ1NNMEIsyg=";
};
dontConfigure = true;
pkgs/applications/emulators/libretro/cores/picodrive.nix
+3 -3
View File
@@ -5,13 +5,13 @@
}:
mkLibretroCore {
core = "picodrive";
version = "0-unstable-2025-03-25";
version = "0-unstable-2025-04-03";
src = fetchFromGitHub {
owner = "libretro";
repo = "picodrive";
rev = "752c266491ae8775dab9a98dbd94472f42b9b16f";
hash = "sha256-l9qYOUyQzyleWeQv74rEOEwOk6iyH43WVIUHcC6Aw2Y=";
rev = "1a08d73159820bb31941d8c5ed6242a74bd4b332";
hash = "sha256-849XeceXoPHpOMlxVtHgL2TYQTHibUbGs0oHBEiCzvw=";
fetchSubmodules = true;
};
pkgs/applications/emulators/libretro/cores/play.nix
+3 -3
View File
@@ -14,13 +14,13 @@
}:
mkLibretroCore {
core = "play";
version = "0-unstable-2025-03-25";
version = "0-unstable-2025-04-04";
src = fetchFromGitHub {
owner = "jpd002";
repo = "Play-";
rev = "01d094c0c3ed723b0747079afddfd319001f01d4";
hash = "sha256-o8tfYg88spRZBDokc/dkRsVvvfGejYVnDQfvQ1BBRps=";
rev = "225e37d0dc7b8a7bb6dc3534b992373477f9923d";
hash = "sha256-bY4RwJyS4R/vjae2UCi4SnIW04IzoQyMOYsW4f+UQg8=";
fetchSubmodules = true;
};
pkgs/applications/emulators/libretro/cores/scummvm.nix
+3 -3
View File
@@ -25,13 +25,13 @@ let
in
mkLibretroCore {
core = "scummvm";
version = "0-unstable-2025-03-09";
version = "0-unstable-2025-04-05";
src = fetchFromGitHub {
owner = "libretro";
repo = "scummvm";
rev = "8e9d265d81661dcffe0bc326e07e50af5d1d224a";
hash = "sha256-BdBQoj358uL7VNPZozRA4oEG5KS09rkucd80vQgkaDo=";
rev = "9d31b31c179fd4a43f7cfc383a3435a9070c6aa8";
hash = "sha256-E5e30Iowwr8pnryncnzlPjBhpIEuKqAHxHk+HwagEnE=";
};
extraBuildInputs = [
pkgs/applications/emulators/wine/sources.nix
+3 -3
View File
@@ -115,9 +115,9 @@ rec {
unstable = fetchurl rec {
# NOTE: Don't forget to change the hash for staging as well.
version = "10.4";
version = "10.5";
url = "https://dl.winehq.org/wine/source/10.x/wine-${version}.tar.xz";
hash = "sha256-oJAZzlxCuga6kexCPUnY8qmo6sTBqSMMc+HRGWOdXpI=";
hash = "sha256-wDbsHvR2dHdKX5lFgwIuni62j+j8GLOox55oWzvsibw=";
inherit (stable) patches;
## see http://wiki.winehq.org/Gecko
@@ -163,7 +163,7 @@ rec {
staging = fetchFromGitLab rec {
# https://gitlab.winehq.org/wine/wine-staging
inherit (unstable) version;
hash = "sha256-LteUANxr+w1N9r6LNztjRfr3yXtJnUMi0uayTRtFoSU=";
hash = "sha256-rXA/55rwQSJR247E4H7cQdTtXRmjomRbls7THV3jfcE=";
domain = "gitlab.winehq.org";
owner = "wine";
repo = "wine-staging";
pkgs/applications/gis/qgis/unwrapped.nix
+2 -2
View File
@@ -82,14 +82,14 @@ let
];
in
mkDerivation rec {
version = "3.42.0";
version = "3.42.1";
pname = "qgis-unwrapped";
src = fetchFromGitHub {
owner = "qgis";
repo = "QGIS";
rev = "final-${lib.replaceStrings [ "." ] [ "_" ] version}";
hash = "sha256-vqT6ffqY1M6/2eW08VghysC+v7ZI9Yz0Zhk9UY/izZc=";
hash = "sha256-0VW/5X8C35uwIZu018Vtp7qosS0v1b+1SFUE8NSTQYE=";
};
passthru = {
pkgs/applications/graphics/gimp/default.nix
+2 -2
View File
@@ -45,7 +45,7 @@
libheif,
libxslt,
libgudev,
openexr_3,
openexr,
desktopToDarwinBundle,
AppKit,
Cocoa,
@@ -126,7 +126,7 @@ stdenv.mkDerivation (finalAttrs: {
poppler
poppler_data
libtiff
openexr_3
openexr
libmng
librsvg
libwmf
pkgs/applications/graphics/krita/generic.nix
+2 -2
View File
@@ -30,7 +30,7 @@
libkdcraw,
lcms2,
gsl,
openexr_3,
openexr,
giflib,
libjxl,
mlt,
@@ -105,7 +105,7 @@ mkDerivation rec {
fribidi
lcms2
gsl
openexr_3
openexr
lager
libaom
libheif
pkgs/applications/graphics/qvge/default.nix
+5 -4
View File
@@ -12,13 +12,14 @@
stdenv.mkDerivation rec {
pname = "qvge";
version = "0.6.3";
version = "0.6.3-unstable-2024-04-08";
src = fetchFromGitHub {
owner = "ArsMasiuk";
repo = pname;
rev = "v${version}";
sha256 = "sha256-rtbUAp3l0VZsu+D9HCHM3q0UkDLflw50rYRq/LP4Wu4=";
repo = "qvge";
#tag = "v${version}";
rev = "5751948358d407673cfda10f52892683be143d42";
hash = "sha256-Rh8ahS/9x2aWu4THjLKoog58+yJoCQ6GETaAQTW4Hq8=";
};
sourceRoot = "${src.name}/src";
pkgs/applications/graphics/qvge/set-graphviz-path.patch
+2 -2
View File
@@ -1,7 +1,7 @@
diff --git i/commonui/CNodeEditorUIController.cpp w/commonui/CNodeEditorUIController.cpp
index 7dacd48..64983e4 100644
--- i/commonui/CNodeEditorUIController.cpp
+++ w/commonui/CNodeEditorUIController.cpp
--- i/qvgeui/CNodeEditorUIController.cpp
+++ w/qvgeui/CNodeEditorUIController.cpp
@@ -123,7 +123,7 @@ CNodeEditorUIController::CNodeEditorUIController(CMainWindow *parent) :
QString pathToGraphviz = QCoreApplication::applicationDirPath() + "/../tools/graphviz";
m_optionsData.graphvizPath = QFileInfo(pathToGraphviz).absoluteFilePath();
pkgs/applications/kde/kio-extras.nix
+2 -2
View File
@@ -24,7 +24,7 @@
syntax-highlighting,
libmtp,
libssh,
openexr_3,
openexr,
libtirpc,
phonon,
qtsvg,
@@ -71,7 +71,7 @@ mkDerivation {
syntax-highlighting
libmtp
libssh
openexr_3
openexr
libtirpc
phonon
qtsvg
pkgs/applications/misc/plover/default.nix
+4 -2
View File
@@ -1,5 +1,6 @@
{
lib,
config,
fetchFromGitHub,
python3Packages,
wmctrl,
@@ -8,8 +9,6 @@
}:
{
stable = throw "plover.stable was removed because it used Python 2. Use plover.dev instead."; # added 2022-06-05
dev =
with python3Packages;
mkDerivationWith buildPythonPackage rec {
@@ -58,3 +57,6 @@
'';
};
}
// lib.optionalAttrs config.allowAliases {
stable = throw "plover.stable was removed because it used Python 2. Use plover.dev instead."; # added 2022-06-05
}
pkgs/applications/networking/browsers/chromium/info.json
+14 -14
View File
@@ -1,10 +1,10 @@
{
"chromium": {
"version": "135.0.7049.52",
"version": "135.0.7049.84",
"chromedriver": {
"version": "135.0.7049.42",
"hash_darwin": "sha256-CixR0TvndAgxvXYbetIqKg6NRu/z3pJe+USCZ0pyQd4=",
"hash_darwin_aarch64": "sha256-WKDi97j1F9+I6RYOsdiXVrgVibZ3ZoVPljo1XAtw0o8="
"version": "135.0.7049.85",
"hash_darwin": "sha256-L4x/MSCbVt2UIQwbHREDV8br6DmdfuqTJ3//7opK2IU=",
"hash_darwin_aarch64": "sha256-vixXGqbc2UYpydg1RILhrtmr5DdbJ5I1sD8aNikejQU="
},
"deps": {
"depot_tools": {
@@ -20,8 +20,8 @@
"DEPS": {
"src": {
"url": "https://chromium.googlesource.com/chromium/src.git",
"rev": "9ba7e609d28c509a8ce9265c2247065d8d251173",
"hash": "sha256-PjvfckdlaMq9HWefGxFppgBumlqh7xoCoxYFwk/r630=",
"rev": "6c019e56001911b3fd467e03bf68c435924d62f4",
"hash": "sha256-BFw1o2cIHBeBudeigH6YTOuLGsp/+pTOeE1lXBO3aio=",
"recompress": true
},
"src/third_party/clang-format/script": {
@@ -126,8 +126,8 @@
},
"src/third_party/dawn": {
"url": "https://dawn.googlesource.com/dawn.git",
"rev": "bdc68b25b620d7302a955e2c38c548ebfe74ef31",
"hash": "sha256-R9SQiKUjLkLmPJwuWpw7fcibrWxSlXWkDsCra7Ci0UQ="
"rev": "53dfda5e9d07d58b43cea66b8153c55dd751ff88",
"hash": "sha256-zXxJZz2C4eDJ8beHDXJe0UCNesDw5R0ogFcsdiF8VIc="
},
"src/third_party/dawn/third_party/glfw": {
"url": "https://chromium.googlesource.com/external/github.com/glfw/glfw",
@@ -616,8 +616,8 @@
},
"src/third_party/skia": {
"url": "https://skia.googlesource.com/skia.git",
"rev": "b99f146a03d3c98049768fd91c2bbe6594b02b2c",
"hash": "sha256-tl1GDmcStkuKMmzzsYuRG6Nrk4xDqgYYBoa1VsQNOwY="
"rev": "6e445bdea696eb6b6a46681dfc1a63edaa517edb",
"hash": "sha256-mSup6nKsEPjJ/HBV7PwjBI4PP7/RdwFm/dnavKeRqzI="
},
"src/third_party/smhasher/src": {
"url": "https://chromium.googlesource.com/external/smhasher.git",
@@ -706,8 +706,8 @@
},
"src/third_party/wasm_tts_engine/src": {
"url": "https://chromium.googlesource.com/chromium/wasm-tts-engine",
"rev": "6ab3e63276a2d66ba3e7db4f87c5b7cb00e22130",
"hash": "sha256-ZcnKKnHsN1UyztAXClc2EUwfeX3yuLtMM2Zjwpnh62U="
"rev": "53d2aba6f0cf7db57e17edfc3ff6471871b0c125",
"hash": "sha256-t5eeehwspRLaowEMPLa8/lV5AHamXQBfH/un0DHLVAM="
},
"src/third_party/wayland/src": {
"url": "https://chromium.googlesource.com/external/anongit.freedesktop.org/git/wayland/wayland.git",
@@ -751,8 +751,8 @@
},
"src/third_party/webrtc": {
"url": "https://webrtc.googlesource.com/src.git",
"rev": "04413d62f754a7b1a3a2d8c3df23bcde040112b2",
"hash": "sha256-sFoBgpPeMJQNSjNp8dDEUlB/7lJUpIXTpu0eRq94cGk="
"rev": "9e5db68b15087eccd8d2493b4e8539c1657e0f75",
"hash": "sha256-gXdBDo+fzp6hJB8qyhscV7ajwSfCUeYvSxhL10g56rU="
},
"src/third_party/wuffs/src": {
"url": "https://skia.googlesource.com/external/github.com/google/wuffs-mirror-release-c.git",
pkgs/applications/networking/cluster/helm/plugins/helm-diff.nix
+3 -3
View File
@@ -6,16 +6,16 @@
buildGoModule rec {
pname = "helm-diff";
version = "3.10.0";
version = "3.11.0";
src = fetchFromGitHub {
owner = "databus23";
repo = pname;
rev = "v${version}";
hash = "sha256-vRngZigXOyxdx9bG2uWpeQ0ASTW+4tKuQWZ1Vm47Y+k=";
hash = "sha256-wnroUILQKVW+aMPhI8MHyzRMox3MhpRMtvYWm6siJqQ=";
};
vendorHash = "sha256-kotV3GC2ilq258cLVGOzBTHb0koWfn92Acl0L8rRi5I=";
vendorHash = "sha256-B4o67yVp7u9N/HNEkF7pbHC33a8fZJvayoPL+qovDeY=";
ldflags = [
"-s"
pkgs/applications/networking/cluster/terraform-providers/providers.json
+4 -4
View File
@@ -135,11 +135,11 @@
"vendorHash": null
},
"azurerm": {
"hash": "sha256-wM/oWLOAB6EhtUVTP+gHn+hpqhrISAsd31ili2hmLyQ=",
"hash": "sha256-pbXkGKym7amioTZlguwBpoFvfvYnCGOxZ7PIT8I3dxY=",
"homepage": "https://registry.terraform.io/providers/hashicorp/azurerm",
"owner": "hashicorp",
"repo": "terraform-provider-azurerm",
"rev": "v4.24.0",
"rev": "v4.26.0",
"spdx": "MPL-2.0",
"vendorHash": null
},
@@ -913,11 +913,11 @@
"vendorHash": "sha256-LRIfxQGwG988HE5fftGl6JmBG7tTknvmgpm4Fu1NbWI="
},
"oci": {
"hash": "sha256-/tgZFUzJqBNTxJzmhcs9YyB55DNwC3oFr9nVyHsFGW4=",
"hash": "sha256-UG2dXoHHH7sWma4+Zlvtj2aHwcvJPKgTxJFZDxqzKyc=",
"homepage": "https://registry.terraform.io/providers/oracle/oci",
"owner": "oracle",
"repo": "terraform-provider-oci",
"rev": "v6.31.0",
"rev": "v6.32.0",
"spdx": "MPL-2.0",
"vendorHash": null
},
pkgs/applications/networking/datovka/default.nix
+2 -2
View File
@@ -13,11 +13,11 @@
mkDerivation rec {
pname = "datovka";
version = "4.25.0";
version = "4.26.0";
src = fetchurl {
url = "https://gitlab.nic.cz/datovka/datovka/-/archive/v${version}/datovka-v${version}.tar.gz";
sha256 = "sha256-Snm9dDtHZQsx4T82tML77auBTb1lvITUOfL+kmhY4es=";
sha256 = "sha256-pEdjh/c4vhirj2R9bYDdi2FL7N9x67kTOyfXiJDzMKE=";
};
buildInputs = [
pkgs/applications/networking/mailreaders/thunderbird/packages.nix
+2 -2
View File
@@ -99,8 +99,8 @@ rec {
thunderbird-128 = common {
applicationName = "Thunderbird ESR";
version = "128.8.1esr";
sha512 = "f1ef0a665f2cef49b427cbfb4a3548df0cccf4470c03367cdb3d2729d4f6bbf25056c378ffa9e1184b6687332998d12ff9ba251b97b7ca859d9d43be9d7414ba";
version = "128.9.1esr";
sha512 = "bc53ad210c6942fd4a5d31e693d6f376c009873397ea4e3c36d9de33d9dc1af5a3ff9e6ca9039dd8849ea8b56daa220f08b7bef4e2ea1b86e98dfe3b9b58dc0d";
updateScript = callPackage ./update.nix {
attrPath = "thunderbirdPackages.thunderbird-128";
pkgs/applications/office/mendeley/default.nix
+2 -2
View File
@@ -8,13 +8,13 @@
let
pname = "mendeley";
version = "2.131.0";
version = "2.132.0";
executableName = "${pname}-reference-manager";
src = fetchurl {
url = "https://static.mendeley.com/bin/desktop/mendeley-reference-manager-${version}-x86_64.AppImage";
hash = "sha256-pVykRTs0yI9UArgxuE3RUKI8onv27hjyG1Dy4PXztuQ=";
hash = "sha256-d4B+rVwWHKLVgY/aK3E6i6CyQKD4TsxZ/XyKbbCrQE0=";
};
appimageContents = appimageTools.extractType2 {
pkgs/applications/science/chemistry/jmol/default.nix
+2 -2
View File
@@ -31,7 +31,7 @@ let
};
in
stdenv.mkDerivation rec {
version = "16.3.11";
version = "16.3.13";
pname = "jmol";
src =
@@ -40,7 +40,7 @@ stdenv.mkDerivation rec {
in
fetchurl {
url = "mirror://sourceforge/jmol/Jmol/Version%20${baseVersion}/Jmol%20${version}/Jmol-${version}-binary.tar.gz";
hash = "sha256-sa2wYzLtk3rSghNxk/kJfaOIDPEJLfwKRRIXMRNBEuI=";
hash = "sha256-ehJZSMhUsE0iO3sDD5Q0UMfcjNmTgPzMNgWG5nIeBFo=";
};
patchPhase = ''
pkgs/applications/science/electronics/hal-hardware-analyzer/default.nix
+1
View File
@@ -47,6 +47,7 @@ stdenv.mkDerivation rec {
hash = "sha256-bjbW4pr04pP0TCuSdzPcV8h6LbLWMvdGSf61RL9Ju6E=";
})
./4.4.1-newer-spdlog-fmt-compat.patch
./resynthesis-fix-narrowing-conversion.patch
];
# make sure bundled dependencies don't get in the way - install also otherwise
pkgs/applications/science/electronics/hal-hardware-analyzer/resynthesis-fix-narrowing-conversion.patch
+13
View File
@@ -0,0 +1,13 @@
diff --git a/plugins/resynthesis/src/resynthesis.cpp b/plugins/resynthesis/src/resynthesis.cpp
index 7a7e404114f..f2889667af8 100644
--- a/plugins/resynthesis/src/resynthesis.cpp
+++ b/plugins/resynthesis/src/resynthesis.cpp
@@ -1058,7 +1058,7 @@ namespace hal
// delete the created directory and the contained files
std::filesystem::remove_all(base_path);
- return OK(subgraph.size());
+ return OK(static_cast<unsigned int>(subgraph.size()));
}
Result<u32> resynthesize_subgraph_of_type(Netlist* nl, const std::vector<const GateType*>& gate_types, GateLibrary* target_gl)
pkgs/applications/science/electronics/qucs-s/default.nix
+2 -2
View File
@@ -24,13 +24,13 @@
stdenv.mkDerivation rec {
pname = "qucs-s";
version = "25.1.1";
version = "25.1.2";
src = fetchFromGitHub {
owner = "ra3xdh";
repo = "qucs_s";
rev = version;
hash = "sha256-H/iLCCX1fMozs/G8erX7cia7wRLjvLxofuiu6pGVJ58=";
hash = "sha256-+xPhHmuogNuolmMFcUAP2hMfJh1D+O4DrPkcuR6+mR8=";
};
postPatch = ''
pkgs/applications/video/mpv/scripts/twitch-chat.nix
+3 -3
View File
@@ -7,13 +7,13 @@
}:
buildLua {
pname = "twitch-chat";
version = "0-unstable-2024-06-23";
version = "0-unstable-2025-03-30";
src = fetchFromGitHub {
owner = "CrendKing";
repo = "mpv-twitch-chat";
rev = "bb0c2e84675f4f1e0c221c8e1d3516b60242b985";
hash = "sha256-lnWYcr49koI60Su85OWbcxrARWTfXW2zIvfCZ6c3GtI=";
rev = "97c94ae58b4a898067b9c63c477716280327d8e1";
hash = "sha256-KjlzVuj47zos2RQHbveijsyJoN2f7VGBboWolISom7M=";
postFetch = "rm $out/screenshot.webp";
};
pkgs/applications/video/obs-studio/plugins/obs-color-monitor.nix
+2 -2
View File
@@ -9,13 +9,13 @@
stdenv.mkDerivation (finalAttrs: {
pname = "obs-color-monitor";
version = "0.9.0";
version = "0.9.1";
src = fetchFromGitHub {
owner = "norihiro";
repo = "obs-color-monitor";
tag = finalAttrs.version;
hash = "sha256-EIp1GQ5dKN43D7xodX/ucYcJm994eKsnidFlbLKWHuI=";
hash = "sha256-4Dagga9BgW1Fiaxqs9QlyTax+SgFyTiNiU3yP2GjIDs=";
};
nativeBuildInputs = [ cmake ];
pkgs/applications/video/olive-editor/default.nix
+2 -2
View File
@@ -12,7 +12,7 @@
cmake,
wrapQtAppsHook,
openimageio,
openexr_3,
openexr,
portaudio,
imath,
qtwayland,
@@ -78,7 +78,7 @@ stdenv.mkDerivation {
opencolorio
openimageio'
imath
openexr_3
openexr
portaudio
qtwayland
qtmultimedia
pkgs/by-name/ad/adminer/package.nix
+2 -2
View File
@@ -8,13 +8,13 @@
}:
stdenv.mkDerivation (finalAttrs: {
version = "5.1.0";
version = "5.1.1";
pname = "adminer";
# not using fetchFromGitHub as the git repo relies on submodules that are included in the tar file
src = fetchurl {
url = "https://github.com/vrana/adminer/releases/download/v${finalAttrs.version}/adminer-${finalAttrs.version}.zip";
hash = "sha256-SLu7NJoCkfEL9WhYQSHEx5QZmD6cjkBXpwEnp7d6Elo=";
hash = "sha256-L1akLFljp4UW/YEVLi317ijY62WN9L4g+OQ127vUP/4=";
};
nativeBuildInputs = [
pkgs/by-name/ag/agnos/package.nix
+33
View File
@@ -0,0 +1,33 @@
{
fetchFromGitHub,
lib,
nixosTests,
rustPlatform,
openssl,
pkg-config,
}:
rustPlatform.buildRustPackage rec {
pname = "agnos";
version = "0.1.0";
src = fetchFromGitHub {
owner = "krtab";
repo = "agnos";
rev = "v${version}";
hash = "sha256-hSiJvpTQIbhz/0AFBTvgfRDTqOi9YcDOvln15SksMJs=";
};
cargoHash = "sha256-wmnfAvtTjioslSdD6z0mMl3Hz46wpPYMk494r9xXj44=";
buildInputs = [ openssl ];
nativeBuildInputs = [ pkg-config ];
meta = with lib; {
description = "Obtains certificates from Let's Encrypt using DNS-01 without the need for API access to the DNS provider";
homepage = "https://github.com/krtab/agnos";
license = licenses.mit;
maintainers = with maintainers; [ justinas ];
};
passthru.tests = nixosTests.agnos;
}
pkgs/by-name/ai/airwindows/package.nix
+3 -3
View File
@@ -8,13 +8,13 @@
}:
stdenv.mkDerivation {
pname = "airwindows";
version = "0-unstable-2025-03-23";
version = "0-unstable-2025-04-06";
src = fetchFromGitHub {
owner = "airwindows";
repo = "airwindows";
rev = "9de336a436cb5ea1e47a319947acb1ea44cede6e";
hash = "sha256-gI5dmI5ysoCmUBTL6CgUw+F/K8D4RbXlXNTpIJMbotk=";
rev = "d109d6b9948449a883a9694d3f5aa8702a57f56b";
hash = "sha256-4yXcPedz5wYqAiLyF5Cgc/DH4jjfJGSLv4qDyIJW4x0=";
};
# we patch helpers because honestly im spooked out by where those variables
pkgs/by-name/al/alioth/package.nix
+3 -3
View File
@@ -6,20 +6,20 @@
rustPlatform.buildRustPackage rec {
pname = "alioth";
version = "0.6.0";
version = "0.7.0";
src = fetchFromGitHub {
owner = "google";
repo = "alioth";
tag = "v${version}";
hash = "sha256-CQYh/F7eGk94dsXP7j3udhhBReYBvV6D8nzK/3VicwU=";
hash = "sha256-xFNX2cxmaw2H8D21qs6mnTMuSidmJ0xJ/b4pxdLTvow=";
};
# Checks use `debug_assert_eq!`
checkType = "debug";
useFetchCargoVendor = true;
cargoHash = "sha256-kW76EBlpzeSmIhW5UsYjPYp5KeH2mPuf3aAiTSM06g4=";
cargoHash = "sha256-x2Abw/RVKpPx0EWyF3w0kywtd23A+NSNaHRVZ4oB1jI=";
separateDebugInfo = true;
pkgs/by-name/al/alive2/package.nix
+4 -2
View File
@@ -24,17 +24,19 @@ clangStdenv.mkDerivation (finalAttrs: {
nativeBuildInputs = [
cmake
ninja
re2c
];
buildInputs = [
re2c
z3
hiredis
llvm_18
ninja
];
strictDeps = true;
postPatch = ''
substituteInPlace CMakeLists.txt \
--replace-fail '-Werror' "" \
--replace-fail 'find_package(Git REQUIRED)' ""
'';
pkgs/by-name/am/amnezia-vpn/package.nix
+21 -23
View File
@@ -12,14 +12,12 @@
shadowsocks-rust,
cloak-pt,
wireguard-tools,
procps,
iproute2,
sudo,
libssh,
zlib,
tun2socks,
xray,
nix-update-script,
bash,
}:
let
amnezia-tun2socks = tun2socks.overrideAttrs (
@@ -83,7 +81,7 @@ stdenv.mkDerivation (finalAttrs: {
substituteInPlace client/configurators/openvpn_configurator.cpp \
--replace-fail ".arg(qApp->applicationDirPath());" ".arg(\"$out/libexec\");"
substituteInPlace client/ui/qautostart.cpp \
--replace-fail "/usr/share/pixmaps/AmneziaVPN.png" "$out/share/pixmaps/AmneziaVPN.png"
--replace-fail "/usr/share/pixmaps/AmneziaVPN.png" "AmneziaVPN"
substituteInPlace deploy/installer/config/AmneziaVPN.desktop.in \
--replace-fail "/usr/share/pixmaps/AmneziaVPN.png" "$out/share/pixmaps/AmneziaVPN.png"
substituteInPlace deploy/data/linux/AmneziaVPN.service \
@@ -107,31 +105,31 @@ stdenv.mkDerivation (finalAttrs: {
];
buildInputs = [
bash
kdePackages.qt5compat
kdePackages.qtremoteobjects
kdePackages.qtsvg
libsecret
qt6.qtbase
qt6.qttools
kdePackages.qtremoteobjects
kdePackages.qtsvg
kdePackages.qt5compat
];
qtWrapperArgs = [
''--prefix PATH : ${
lib.makeBinPath [
procps
iproute2
sudo
]
}''
];
installPhase = ''
runHook preInstall
postInstall = ''
mkdir -p $out/bin $out/libexec $out/share/applications $out/share/pixmaps $out/lib/systemd/system
cp client/AmneziaVPN service/server/AmneziaVPN-service $out/bin/
cp ../deploy/data/linux/client/bin/update-resolv-conf.sh $out/libexec/
cp ../AppDir/AmneziaVPN.desktop $out/share/applications/
cp ../deploy/data/linux/AmneziaVPN.png $out/share/pixmaps/
cp ../deploy/data/linux/AmneziaVPN.service $out/lib/systemd/system/
install -m555 client/AmneziaVPN service/server/AmneziaVPN-service $out/bin/
install -m555 ../deploy/data/linux/client/bin/update-resolv-conf.sh $out/libexec/
install -m444 ../AppDir/AmneziaVPN.desktop $out/share/applications/
install -m444 ../deploy/data/linux/AmneziaVPN.png $out/share/pixmaps/
install -m444 ../deploy/data/linux/AmneziaVPN.service $out/lib/systemd/system/
runHook postInstall
'';
postFixup = ''
# Temporary unwrap non-binary executable until qt6.wrapQtAppsHook is fixed
mv $out/libexec/.update-resolv-conf.sh-wrapped $out/libexec/update-resolv-conf.sh
'';
passthru = {
@@ -149,7 +147,7 @@ stdenv.mkDerivation (finalAttrs: {
meta = with lib; {
description = "Amnezia VPN Client";
downloadPage = "https://amnezia.org/en/downloads";
homepage = "https://amnezia.org/en";
homepage = "https://github.com/amnezia-vpn/amnezia-client";
license = licenses.gpl3;
mainProgram = "AmneziaVPN";
maintainers = with maintainers; [ sund3RRR ];
pkgs/by-name/an/ansel/package.nix
+2 -2
View File
@@ -15,7 +15,7 @@
libxml2,
cmake,
exiftool,
openexr_3,
openexr,
glib,
python3Packages,
perlPackages,
@@ -147,7 +147,7 @@ stdenv.mkDerivation {
libxkbcommon
libxslt
libXtst
openexr_3
openexr
openjpeg
osm-gps-map
pcre
pkgs/by-name/an/anyrun/package.nix
+3 -3
View File
@@ -17,13 +17,13 @@
rustPlatform.buildRustPackage {
pname = "anyrun";
version = "0-unstable-2024-12-27";
version = "0-unstable-2025-04-04";
src = fetchFromGitHub {
owner = "kirottu";
repo = "anyrun";
rev = "06017e753c8886d5296768dca80745ee09402a2d";
hash = "sha256-jU88Q9tP4vuvWYGQcmOdFwI9e2uMPVYJHbXdiklIH9o=";
rev = "786f539d69d5abcefa68978dbaa964ac14536a00";
hash = "sha256-f+oXT9b3xuBDmm4v4nDqJvlHabxxZRB6+pay4Ub/NvA=";
};
useFetchCargoVendor = true;
pkgs/by-name/ap/appflowy/package.nix
+3 -3
View File
@@ -17,11 +17,11 @@ let
rec {
x86_64-linux = {
urlSuffix = "linux-x86_64.tar.gz";
hash = "sha256-e0G7J2BRRC+2MMqpvu5BNnimS7RRTjRBgo/j1T9iYWU=";
hash = "sha256-WUAyGx7RcLlQsYpfcbV69k1ESaif5VraxUFAslMi5lo=";
};
x86_64-darwin = {
urlSuffix = "macos-universal.zip";
hash = "sha256-A9BCdYxeWPjCOZ/L0wYTVuqybLHfc1vsWWxAY7IJohw=";
hash = "sha256-fB6DCp2+7T9ozHuMdsv6IwwIyD6+t7LxVWMj9lDJ5Fw=";
};
aarch64-darwin = x86_64-darwin;
}
@@ -30,7 +30,7 @@ let
in
stdenvNoCC.mkDerivation (finalAttrs: {
pname = "appflowy";
version = "0.8.7";
version = "0.8.8";
src = fetchzip {
url = "https://github.com/AppFlowy-IO/appflowy/releases/download/${finalAttrs.version}/AppFlowy-${finalAttrs.version}-${dist.urlSuffix}";
pkgs/by-name/ar/art/package.nix
+2 -2
View File
@@ -32,7 +32,7 @@
exiv2,
exiftool,
mimalloc,
openexr_3,
openexr,
ilmbase,
opencolorio,
color-transformation-language,
@@ -83,7 +83,7 @@ stdenv.mkDerivation rec {
exiftool
libcanberra-gtk3
mimalloc
openexr_3
openexr
ilmbase
opencolorio
color-transformation-language
pkgs/by-name/at/attic-client/package.nix
+3 -3
View File
@@ -2,7 +2,7 @@
lib,
rustPlatform,
fetchFromGitHub,
nixForLinking,
nixVersions,
nixosTests,
boost,
pkg-config,
@@ -29,7 +29,7 @@ rustPlatform.buildRustPackage {
buildInputs =
[
nixForLinking
nixVersions.nix_2_24
boost
]
++ lib.optionals stdenv.hostPlatform.isDarwin (
@@ -44,7 +44,7 @@ rustPlatform.buildRustPackage {
useFetchCargoVendor = true;
ATTIC_DISTRIBUTOR = "nixpkgs";
NIX_INCLUDE_PATH = "${lib.getDev nixForLinking}/include";
NIX_INCLUDE_PATH = "${lib.getDev nixVersions.nix_2_24}/include";
# Attic interacts with Nix directly and its tests require trusted-user access
# to nix-daemon to import NARs, which is not possible in the build sandbox.
pkgs/by-name/ba/backgroundremover/package.nix
+2 -2
View File
@@ -11,7 +11,7 @@ let
p = python3.pkgs;
self = p.buildPythonApplication rec {
pname = "backgroundremover";
version = "0.2.9";
version = "0.3.0";
pyproject = true;
build-system = [
@@ -22,7 +22,7 @@ let
owner = "nadermx";
repo = "backgroundremover";
rev = "v${version}";
hash = "sha256-tQ8J3xamOzPPSbFMxIDYKv1TzK1AVwF/DWXdZlrlYvM=";
hash = "sha256-fWazMDjc+EoXvO7Iq+zwtJaMEU64ajpO6JtlvU5T0nc=";
};
models = runCommand "background-remover-models" { } ''
pkgs/by-name/ba/backrest/package.nix
+7 -3
View File
@@ -11,13 +11,13 @@
}:
let
pname = "backrest";
version = "1.7.3";
version = "1.8.0";
src = fetchFromGitHub {
owner = "garethgeorge";
repo = "backrest";
tag = "v${version}";
hash = "sha256-X3FiNor2q/JgyV05CIAls7MjMvongH5dGeutPz+CW9I=";
hash = "sha256-p2CKXQeA0rHhS6uP0x2tNsFzHBCOi6sRDlr+o4HeBjk=";
};
frontend = stdenv.mkDerivation (finalAttrs: {
@@ -69,7 +69,11 @@ buildGoModule {
checkFlags =
let
skippedTests =
[ "TestRunCommand" ]
[
"TestMultihostIndexSnapshots"
"TestRunCommand"
"TestSnapshot"
]
++ lib.optionals stdenv.hostPlatform.isDarwin [
"TestBackup" # relies on ionice
"TestCancelBackup"
pkgs/by-name/ba/badger/package.nix
+3 -3
View File
@@ -6,16 +6,16 @@
buildGoModule rec {
pname = "badger";
version = "4.6.0";
version = "4.7.0";
src = fetchFromGitHub {
owner = "dgraph-io";
repo = "badger";
rev = "v${version}";
hash = "sha256-W3vPTLGI7YT7dFklJnOcpfYqQ9aBCsel9L6q4WNincY=";
hash = "sha256-R4nahpUuCjPas1NBnWmQ/KBTY+/yPSyo8AmTvgwhYVI=";
};
vendorHash = "sha256-UVdOiaj1FN0etB9F0kt+THfO0Aa1kgdGYVeSVv4GpxY=";
vendorHash = "sha256-x4+CHLmQhu7Y6n1qx2CBY6KzRIRLD7Gn+pzXQy3/5rA=";
subPackages = [ "badger" ];
pkgs/by-name/ba/bao/package.nix
+3 -3
View File
@@ -6,16 +6,16 @@
rustPlatform.buildRustPackage rec {
pname = "bao";
version = "0.13.0";
version = "0.13.1";
src = fetchCrate {
inherit version;
pname = "${pname}_bin";
hash = "sha256-MpMNhL1n8dNJJcJJiDXv/qWUgCNqQIvvcR8veH+abuI=";
hash = "sha256-8h5otpu3z2Hgy0jMCITJNr8Q4iVdlR5Lea2X+WuenWs=";
};
useFetchCargoVendor = true;
cargoHash = "sha256-Vw8T/pgGMjI8QklkQNuZSYmKcKhaR320q8ZBAT4HPZ8=";
cargoHash = "sha256-B0wvJTcIRJxBU0G1DONnKeQYrmsmMIorhTLc73o4/kE=";
meta = {
description = "Implementation of BLAKE3 verified streaming";

Some files were not shown because too many files have changed in this diff Show More