From 40fb9e7c5a45af3f63fc821067f044d3d8a4befc Mon Sep 17 00:00:00 2001 From: Samuel Dionne-Riel Date: Tue, 31 Dec 2024 20:06:56 -0500 Subject: [PATCH 01/10] switch-to-configuration-ng: Fix exit status on bootloader install error MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The problem ----------- When rebuilding a system, if `switch-to-configuration-ng` fails to install bootloader files, it will (most likely) `exit(0)`. ``` /etc/nixos $ sudo nixos-rebuild --fast boot && reboot [sudo] password for samuel: building the system configuration... updating GRUB 2 menu... cannot copy /nix/store/.../initrd to /boot/kernels/...-initrd.tmp: No space left on device Failed to install bootloader Broadcast message from samuel@... on pts/1 (Tue 2024-12-31 16:48:26 EST): The system will reboot now! ``` This is a quite awkward breaking change with the expected behaviour. * * * The investigation ----------------- Compare: - https://github.com/NixOS/nixpkgs/blob/85b5f3e959327a3fa46f843848ebb8799069bb95/pkgs/by-name/sw/switch-to-configuration-ng/src/src/main.rs#L171-L179 - https://github.com/NixOS/nixpkgs/blob/85b5f3e959327a3fa46f843848ebb8799069bb95/nixos/modules/system/activation/switch-to-configuration.pl#L115-L117 Let's see what `die()` is all about: - https://github.com/NixOS/nixpkgs/blob/85b5f3e959327a3fa46f843848ebb8799069bb95/pkgs/by-name/sw/switch-to-configuration-ng/src/src/main.rs#L121-L125 ***sus.*** There are multiple issues converging here. **Incorrect port** The original implementation did not use `die`, but `exit 1`. So porting from `perl` following the script's idiosyncrasies was not done appropriately. **Incorrect `die` fac-simile** The `die` method is incomplete with regard to the semantics of perl. - https://perldoc.perl.org/5.40.0/functions/die Of importance to us: > If [die is called], the exit code is determined from the values of > `$!` and `$?` with this pseudocode: > > ``` > exit $! if $!; # errno > exit $? >> 8 if $? >> 8; # child exit status > exit 255; # last resort > ``` The `die()` method in `switch-to-configuration-ng` *only* checks `errno`, using its value directly to `exit()`. It does not handle some form of implicit child process exit status. And, due to incorrect assumptions, it will not fall back to anything. **Incorrect implementation** (Note that from this point on, I'm not a Rust expert, so bear with me if some nuances are lost or incorrectly represented.) The `die()` function implementation, as a port, might not even work correctly. Already, the `spawn` method does not mention it would be setting `errno`, so any `die()` following a `status.success()` is *sus* and should be investigated. Since it's not attempting to do anything "smart" with child processes. - https://doc.rust-lang.org/1.83.0/std/process/struct.Command.html#method.spawn And I'd argue that using *errno* in this manner in Rust is probably a mistake, and should not be done. > This should be called immediately after a call to a platform function, > otherwise the state of the error value is indeterminate. - https://doc.rust-lang.org/1.83.0/std/io/struct.Error.html#method.last_os_error Considering *platform function* is largely left undefined, I would (probably wrongly) intuit that it should be considered undefined behaviour to rely on it. Note that `raw_os_error` might have a surprising interface. > If this `Error` was constructed via `last_os_error` [...], > then this function will return `Some`, otherwise it will return `None`. - https://doc.rust-lang.org/1.83.0/std/io/struct.Error.html#method.raw_os_error Since it's used as `std::io::Error::last_os_error().raw_os_error()`, AFAIUI it will always return `Some`. Since this is exposing `errno`, the libc concept, it will behave the same, and may be set to `0` by default, just like here: ``` $ printf '#include \n#include \nint main() { exit(errno); }' \ | cc -x c - && ./a.out; echo $? 0 ``` Which means that, since no *platform function*[sic] changed its value, it will be zero, the `die()` function will be equivalent to `exit(errno)`, and the program will have failed “successfully” wrongly. * * * The fix ------- I've fixed the `do_pre_switch_check` and `do_install_bootloader` methods, both of which share the same defects (the original script uses `exit 1` for both). They were the only `status.success()` checks using `die()`. * * * Reproducing the issue --------------------- Remember how I said: > Considering *platform function* is largely left undefined, I would > (probably wrongly) intuit that it should be considered undefined > behaviour to rely on it. Here's why it's not some vague FUD. First, make sure a `nixos-rebuild boot` would need to write new files to the boot partition. Removing an older (but still alive) generation's initrd can do that. Fill the `/boot` partition to force an error. ``` $ sudo dd if=/dev/zero of=/boot/BOGUS.FILLINGS ``` Then, and here's the fun part, observe: ``` ~ $ sudo rm -r /run/nixos ~ $ sudo nixos-rebuild --fast boot ; echo $? building the system configuration... updating GRUB 2 menu... cannot copy /nix/store/x91w4p91l7iclkdp38chvdxcw6nr5113-mobile-nixos-initrd-generic/initrd to /boot/kernels/x91w4p91l7iclkdp38chvdxcw6nr5113-mobile-nixos-initrd-generic-initrd.tmp: No space left on device Failed to install bootloader 0 ~ $ sudo nixos-rebuild --fast boot ; echo $? building the system configuration... updating GRUB 2 menu... cannot copy /nix/store/x91w4p91l7iclkdp38chvdxcw6nr5113-mobile-nixos-initrd-generic/initrd to /boot/kernels/x91w4p91l7iclkdp38chvdxcw6nr5113-mobile-nixos-initrd-generic-initrd.tmp: No space left on device Failed to install bootloader warning: error(s) occurred while switching to the new configuration 1 ``` So... What's the deal with /run/nixos? It's where the lock file will reside. (And other transient files.) - https://github.com/NixOS/nixpkgs/blob/85b5f3e959327a3fa46f843848ebb8799069bb95/pkgs/by-name/sw/switch-to-configuration-ng/src/src/main.rs#L1018-L1027 But why does that matter here? ``` ~ $ errno 17 EEXIST 17 File exists ``` This error is produced by some *platform functions*[sic] that create either the directory, or the lockfile. The file already exists. So the script would end-up failing this way *only for the first invocation*. Which is why it's possible any of you all reviewing this ~~novel~~ PR haven't faced that issue. * * * Future work ----------- I believe `die()` *probably* should be switched to check the value, and `exit 255` if it's 0. Though I also believe `die()` shouldn't try to port perl semantics into Rust. I don't think it's working out. Additionally, a NixOS test should be authored to ensure that errors in these phases actually are handled appropriately. Signed-off-by: Samuel Dionne-Riel --- pkgs/by-name/sw/switch-to-configuration-ng/src/src/main.rs | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/sw/switch-to-configuration-ng/src/src/main.rs b/pkgs/by-name/sw/switch-to-configuration-ng/src/src/main.rs index fe86235494ea..017fa24daeae 100644 --- a/pkgs/by-name/sw/switch-to-configuration-ng/src/src/main.rs +++ b/pkgs/by-name/sw/switch-to-configuration-ng/src/src/main.rs @@ -152,7 +152,7 @@ fn do_pre_switch_check(command: &str, toplevel: &Path) -> Result<()> { Ok(Ok(status)) if status.success() => {} _ => { eprintln!("Pre-switch checks failed"); - die() + std::process::exit(1); } } @@ -174,7 +174,7 @@ fn do_install_bootloader(command: &str, toplevel: &Path) -> Result<()> { Ok(Ok(status)) if status.success() => {} _ => { eprintln!("Failed to install bootloader"); - die(); + std::process::exit(1); } } From 0da1960faf21a857b022d90e766162176a2e092a Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Wed, 1 Jan 2025 19:32:18 +0000 Subject: [PATCH 02/10] jackett: 0.22.1109 -> 0.22.1177 --- pkgs/servers/jackett/default.nix | 4 ++-- pkgs/servers/jackett/deps.json | 40 ++++++++++++++++---------------- 2 files changed, 22 insertions(+), 22 deletions(-) diff --git a/pkgs/servers/jackett/default.nix b/pkgs/servers/jackett/default.nix index 087b224cd64a..8d5b2885b867 100644 --- a/pkgs/servers/jackett/default.nix +++ b/pkgs/servers/jackett/default.nix @@ -11,13 +11,13 @@ buildDotnetModule rec { pname = "jackett"; - version = "0.22.1109"; + version = "0.22.1177"; src = fetchFromGitHub { owner = pname; repo = pname; rev = "v${version}"; - hash = "sha512-iuhArQtzOTxHLKP9VruCZp134BIc+haOAnLUtP4phcsjrFerD7SN1OwwG581iEEzNh8jiFSEbCgQzOlltM/GyQ=="; + hash = "sha512-C4fwh47IDsJmmXPY9Rb7LKdXvFlEVQE8ycHu1s26A9ZBP69eVP+ai08ibCJDDk13DCQYk2BCO7cRtWq2PC1P8w=="; }; projectFile = "src/Jackett.Server/Jackett.Server.csproj"; diff --git a/pkgs/servers/jackett/deps.json b/pkgs/servers/jackett/deps.json index efca90b06c93..29fb32438484 100644 --- a/pkgs/servers/jackett/deps.json +++ b/pkgs/servers/jackett/deps.json @@ -106,8 +106,8 @@ }, { "pname": "Microsoft.AspNetCore.Cryptography.Internal", - "version": "8.0.10", - "hash": "sha256-zR9xbcGD4yU/oo/c9dQ4AKTMFT+HSBsfu0oNV6bjPNo=" + "version": "8.0.11", + "hash": "sha256-xEIbxQbMcTvkzNw7KKeYOK9wNMShbTAzhx7DR8QMrvM=" }, { "pname": "Microsoft.AspNetCore.DataProtection", @@ -116,8 +116,8 @@ }, { "pname": "Microsoft.AspNetCore.DataProtection", - "version": "8.0.10", - "hash": "sha256-JYzSF9NxaGA0tXobfaV2ODQdcVCbQBGtcILCRUgcKiY=" + "version": "8.0.11", + "hash": "sha256-hetvscFzzsXkbUfUTXdwoOQFMp5lU4P3klOiOqjWtGc=" }, { "pname": "Microsoft.AspNetCore.DataProtection.Abstractions", @@ -126,8 +126,8 @@ }, { "pname": "Microsoft.AspNetCore.DataProtection.Abstractions", - "version": "8.0.10", - "hash": "sha256-Fa3PLGFHOvIvAkpTRls1iESyg9ZxqY1/I5Q4elmA2SE=" + "version": "8.0.11", + "hash": "sha256-7I7SHhed3s2fGArGUwlc0Jc0MIl4/sgd+E5qZ18Mx2o=" }, { "pname": "Microsoft.AspNetCore.Diagnostics", @@ -226,8 +226,8 @@ }, { "pname": "Microsoft.AspNetCore.JsonPatch", - "version": "8.0.10", - "hash": "sha256-1MUbEqkePx6A4JkUu7bffBuuYmiP8BVTmJ3aDqwa8nk=" + "version": "8.0.11", + "hash": "sha256-7n0O/CWYMjWyicwPZgUUh+YTmdNNZA02rWhBHAzPDPU=" }, { "pname": "Microsoft.AspNetCore.Localization", @@ -281,8 +281,8 @@ }, { "pname": "Microsoft.AspNetCore.Mvc.NewtonsoftJson", - "version": "8.0.10", - "hash": "sha256-PYFjjSZjehd9R3J6wUK+OKfvTzMw6IqC+gJKocfXJbs=" + "version": "8.0.11", + "hash": "sha256-oaSZize0xvrX1qf45gjMmXHipD21tBGTp2pkr7ReS5U=" }, { "pname": "Microsoft.AspNetCore.Mvc.Razor", @@ -906,18 +906,18 @@ }, { "pname": "NLog", - "version": "5.3.2", - "hash": "sha256-b/y/IFUSe7qsSeJ8JVB0VFmJlkviFb8h934ktnn9Fgc=" + "version": "5.3.4", + "hash": "sha256-Cwr1Wu9VbOcRz3GdVKkt7lIpNwC1E4Hdb0g+qEkEr3k=" }, { "pname": "NLog.Extensions.Logging", - "version": "5.3.11", - "hash": "sha256-DP3R51h+9kk06N63U+1C4/JCZTFiADeYTROToAA2R0g=" + "version": "5.3.15", + "hash": "sha256-otzOJncsEmzeGkJ9yxuwQgYFlKIG9ALX+DaKJ/Jhux4=" }, { "pname": "NLog.Web.AspNetCore", - "version": "5.3.11", - "hash": "sha256-6bMYbKyNWtb0tn8k3418mWBuogofIAfwT9NHSopUu58=" + "version": "5.3.15", + "hash": "sha256-JaxCAfsgYM8N7bmAciDowSdOxtMS3eoMszODqWPcqao=" }, { "pname": "NUnit", @@ -936,13 +936,13 @@ }, { "pname": "Polly", - "version": "8.4.2", - "hash": "sha256-cuaH3SdTEdwLA1VddtY6CsmHTiDuYk0dVJ79r/6jSpQ=" + "version": "8.5.0", + "hash": "sha256-oXIqYMkFXoF/9y704LJSX5Non9mry19OSKA7JFviu5Q=" }, { "pname": "Polly.Core", - "version": "8.4.2", - "hash": "sha256-4fn5n6Bu29uqWg8ciii3MDsi9bO2/moPa9B3cJ9Ihe8=" + "version": "8.5.0", + "hash": "sha256-vN/OoQi5F8+oKNO46FwjPcKrgfhGMGjAQ2yCQUlHtOc=" }, { "pname": "SharpZipLib", From fd1d8e7b6fa5fb66230fa911eadb53a8d4bf8536 Mon Sep 17 00:00:00 2001 From: rewine Date: Thu, 2 Jan 2025 19:40:06 +0800 Subject: [PATCH 03/10] neocmakelsp: build with meson --- pkgs/by-name/ne/neocmakelsp/package.nix | 32 +++++++++++++++++++------ 1 file changed, 25 insertions(+), 7 deletions(-) diff --git a/pkgs/by-name/ne/neocmakelsp/package.nix b/pkgs/by-name/ne/neocmakelsp/package.nix index e474831133c1..01a36d4b2f67 100644 --- a/pkgs/by-name/ne/neocmakelsp/package.nix +++ b/pkgs/by-name/ne/neocmakelsp/package.nix @@ -1,10 +1,16 @@ { lib, - rustPlatform, + stdenv, fetchFromGitHub, + meson, + ninja, + python3, + rustPlatform, + rustc, + cargo, }: -rustPlatform.buildRustPackage rec { +stdenv.mkDerivation rec { pname = "neocmakelsp"; version = "0.8.13"; @@ -15,14 +21,26 @@ rustPlatform.buildRustPackage rec { hash = "sha256-MRno86pi389p2lBTu86LCPx5yFN76CbM5AXAs4bsl7c="; }; - cargoHash = "sha256-UVXJF8jvZUcEWbsL+UmrO2VSlvowkXNGRbxCEmB89OU="; + cargoDeps = rustPlatform.fetchCargoTarball { + inherit pname version src; + hash = "sha256-UVXJF8jvZUcEWbsL+UmrO2VSlvowkXNGRbxCEmB89OU="; + }; - meta = with lib; { + nativeBuildInputs = [ + meson + ninja + python3 + rustPlatform.cargoSetupHook + rustc + cargo + ]; + + meta = { description = "CMake lsp based on tower-lsp and treesitter"; homepage = "https://github.com/Decodetalkers/neocmakelsp"; - license = licenses.mit; - platforms = platforms.unix; - maintainers = with maintainers; [ + license = lib.licenses.mit; + platforms = lib.platforms.unix; + maintainers = with lib.maintainers; [ rewine multivac61 ]; From 37e6624667091ad729ad2691773ae053444c5b2b Mon Sep 17 00:00:00 2001 From: Lin Jian Date: Thu, 2 Jan 2025 10:26:06 +0800 Subject: [PATCH 04/10] nixos/kmonad: add new option enableHardening MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Before ```console $ systemd-analyze security kmonad-foo.service | tail -n 1 → Overall exposure level for kmonad-foo.service: 8.2 EXPOSED 🙁 ``` After ```console $ systemd-analyze security kmonad-foo.service | tail -n 1 → Overall exposure level for kmonad-foo.service: 0.4 SAFE 😀 ``` --- .../manual/release-notes/rl-2505.section.md | 3 + nixos/modules/services/hardware/kmonad.nix | 87 ++++++++++++++----- 2 files changed, 70 insertions(+), 20 deletions(-) diff --git a/nixos/doc/manual/release-notes/rl-2505.section.md b/nixos/doc/manual/release-notes/rl-2505.section.md index 0295deffc3d0..65e1e0421fc1 100644 --- a/nixos/doc/manual/release-notes/rl-2505.section.md +++ b/nixos/doc/manual/release-notes/rl-2505.section.md @@ -126,6 +126,9 @@ to review the new defaults and description of [](#opt-services.nextcloud.poolSettings). +- `kmonad` is now hardened by default using common `systemd` settings. + If KMonad is used to execute shell commands, hardening may make some of them fail. In that case, you can disable hardening using {option}`services.kmonad.keyboards..enableHardening` option. + - `asusd` has been upgraded to version 6 which supports multiple aura devices. To account for this, the single `auraConfig` configuration option has been replaced with `auraConfigs` which is an attribute set of config options per each device. The config files may also be now specified as either source files or text strings; to account for this you will need to specify that `text` is used for your existing configs, e.g.: ```diff -services.asusd.asusdConfig = '''file contents''' diff --git a/nixos/modules/services/hardware/kmonad.nix b/nixos/modules/services/hardware/kmonad.nix index fa9b8fbb610f..72d5d7d71503 100644 --- a/nixos/modules/services/hardware/kmonad.nix +++ b/nixos/modules/services/hardware/kmonad.nix @@ -41,6 +41,19 @@ let ''; }; + enableHardening = lib.mkOption { + type = lib.types.bool; + default = true; + example = false; + description = '' + Whether to enable systemd hardening. + + ::: {.note} + If KMonad is used to execute shell commands, hardening may make some of them fail. + ::: + ''; + }; + defcfg = { enable = lib.mkEnableOption '' automatic generation of the defcfg block. @@ -128,26 +141,60 @@ let StartLimitIntervalSec = 2; StartLimitBurst = 5; }; - serviceConfig = { - ExecStart = '' - ${lib.getExe cfg.package} ${mkCfg keyboard} \ - ${utils.escapeSystemdExecArgs cfg.extraArgs} - ''; - Restart = "always"; - # Restart at increasing intervals from 2s to 1m - RestartSec = 2; - RestartSteps = 30; - RestartMaxDelaySec = "1min"; - Nice = -20; - DynamicUser = true; - User = "kmonad"; - Group = "kmonad"; - SupplementaryGroups = [ - # These ensure that our dynamic user has access to the device node - config.users.groups.input.name - config.users.groups.uinput.name - ] ++ keyboard.extraGroups; - }; + serviceConfig = + { + ExecStart = '' + ${lib.getExe cfg.package} ${mkCfg keyboard} \ + ${utils.escapeSystemdExecArgs cfg.extraArgs} + ''; + Restart = "always"; + # Restart at increasing intervals from 2s to 1m + RestartSec = 2; + RestartSteps = 30; + RestartMaxDelaySec = "1min"; + Nice = -20; + DynamicUser = true; + User = "kmonad"; + Group = "kmonad"; + SupplementaryGroups = [ + # These ensure that our dynamic user has access to the device node + config.users.groups.input.name + config.users.groups.uinput.name + ] ++ keyboard.extraGroups; + } + // lib.optionalAttrs keyboard.enableHardening { + DeviceAllow = [ + "/dev/uinput w" + "char-input r" + ]; + CapabilityBoundingSet = [ "" ]; + DevicePolicy = "closed"; + IPAddressDeny = [ "any" ]; + LockPersonality = true; + MemoryDenyWriteExecute = true; + PrivateNetwork = true; + PrivateUsers = true; + ProcSubset = "pid"; + ProtectClock = true; + ProtectControlGroups = true; + ProtectHome = true; + ProtectHostname = true; + ProtectKernelLogs = true; + ProtectKernelModules = true; + ProtectKernelTunables = true; + ProtectProc = "invisible"; + RestrictAddressFamilies = [ "none" ]; + RestrictNamespaces = true; + RestrictRealtime = true; + SystemCallArchitectures = [ "native" ]; + SystemCallErrorNumber = "EPERM"; + SystemCallFilter = [ + "@system-service" + "~@privileged" + "~@resources" + ]; + UMask = "0077"; + }; # make sure the new config is used after nixos-rebuild switch # stopIfChanged controls[0] how a service is "restarted" during # nixos-rebuild switch. By default, stopIfChanged is true, which stops From 1f52848733066d20f65e6737ee0ea1374e65b743 Mon Sep 17 00:00:00 2001 From: Dimitar Nestorov <8790386+dimitarnestorov@users.noreply.github.com> Date: Sat, 4 Jan 2025 16:22:19 +0200 Subject: [PATCH 05/10] tuist: init at 4.38.2 --- pkgs/by-name/tu/tuist/package.nix | 52 +++++++++++++++++++++++++++++++ 1 file changed, 52 insertions(+) create mode 100644 pkgs/by-name/tu/tuist/package.nix diff --git a/pkgs/by-name/tu/tuist/package.nix b/pkgs/by-name/tu/tuist/package.nix new file mode 100644 index 000000000000..eb113828ccc4 --- /dev/null +++ b/pkgs/by-name/tu/tuist/package.nix @@ -0,0 +1,52 @@ +{ + lib, + stdenvNoCC, + fetchurl, + unzip, + nix-update-script, +}: + +stdenvNoCC.mkDerivation (finalAttrs: { + pname = "tuist"; + version = "4.38.2"; + + src = fetchurl { + url = "https://github.com/tuist/tuist/releases/download/${finalAttrs.version}/tuist.zip"; + hash = "sha256-FK9F0Y3p04NOoy1Mnlcvimm/LGA5Y+lQ9P679SNNOzA="; + }; + + dontUnpack = true; + dontPatch = true; + dontConfigure = true; + dontBuild = true; + dontFixup = true; + + nativeBuildInputs = [ unzip ]; + + installPhase = '' + runHook preInstall + + mkdir -p $out/opt/tuist/ + unzip $src -d $out/opt/tuist/ + + mkdir -p $out/bin/ + ln -s $out/opt/tuist/tuist $out/bin/tuist + + runHook postInstall + ''; + + passthru = { + updateScript = nix-update-script { }; + }; + + meta = { + description = "Command line tool that helps you generate, maintain and interact with Xcode projects"; + homepage = "https://tuist.dev"; + changelog = "https://github.com/tuist/tuist/blob/${finalAttrs.version}/CHANGELOG.md"; + license = lib.licenses.mit; + sourceProvenance = [ lib.sourceTypes.binaryNativeCode ]; + maintainers = [ lib.maintainers.DimitarNestorov ]; + platforms = lib.platforms.darwin; + mainProgram = "tuist"; + }; +}) From 520ff1bc3ab0a2da16ba74a92d5fbeb876ba7cbc Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Sun, 5 Jan 2025 00:49:25 +0000 Subject: [PATCH 06/10] evil-helix: 20240716 -> 20250104 --- pkgs/by-name/ev/evil-helix/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/ev/evil-helix/package.nix b/pkgs/by-name/ev/evil-helix/package.nix index 151aa1a278f8..c34b1167462d 100644 --- a/pkgs/by-name/ev/evil-helix/package.nix +++ b/pkgs/by-name/ev/evil-helix/package.nix @@ -8,16 +8,16 @@ rustPlatform.buildRustPackage rec { pname = "evil-helix"; - version = "20240716"; + version = "20250104"; src = fetchFromGitHub { owner = "usagi-flow"; repo = "evil-helix"; rev = "release-${version}"; - hash = "sha256-nvLo8bWjiLJjM+pZArMKu4gjEFPrlqDI/Kf+W8fs9L8="; + hash = "sha256-Otp68+SbW51/MqVejPrbYzeRu4wAiYsNkDQQTZScW1Q="; }; - cargoHash = "sha256-2qrfw/QVfZZ3GTBalNne4QYQsI+JZBf5FdLJD84gnS4="; + cargoHash = "sha256-84OfCXdwoo8SUwXrgm98DIcmmBIxHxZGOJ/ZPxJuyjY="; nativeBuildInputs = [ installShellFiles ]; From 68b896973f0f097cd60ad3a6df8fb0e18fd0731d Mon Sep 17 00:00:00 2001 From: Mostafa Khaled <112074172+mostafa-khaled775@users.noreply.github.com> Date: Sun, 5 Jan 2025 06:55:01 +0000 Subject: [PATCH 07/10] ltex-ls: set meta.mainProgram to "ltex-ls" --- pkgs/by-name/lt/ltex-ls/package.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/pkgs/by-name/lt/ltex-ls/package.nix b/pkgs/by-name/lt/ltex-ls/package.nix index 7de384b4776d..4204579818ec 100644 --- a/pkgs/by-name/lt/ltex-ls/package.nix +++ b/pkgs/by-name/lt/ltex-ls/package.nix @@ -34,6 +34,7 @@ stdenvNoCC.mkDerivation rec { homepage = "https://valentjn.github.io/ltex/"; description = "LSP language server for LanguageTool"; license = licenses.mpl20; + mainProgram = "ltex-ls"; maintainers = with maintainers; [ vinnymeller ]; platforms = jre_headless.meta.platforms; }; From 4a1f68268333483845dc02bf2ed64b6b4e0d71a9 Mon Sep 17 00:00:00 2001 From: Francesco Gazzetta Date: Tue, 24 Dec 2024 11:30:48 +0100 Subject: [PATCH 08/10] tcl-9_0,tk-9_0: 9.0.0 -> 9.0.1 Fixes darwin for tk-9_0 --- pkgs/development/interpreters/tcl/9.0.nix | 4 ++-- pkgs/development/libraries/tk/9.0.nix | 2 +- pkgs/development/libraries/tk/generic.nix | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/pkgs/development/interpreters/tcl/9.0.nix b/pkgs/development/interpreters/tcl/9.0.nix index 48a9570675a1..30108004c318 100644 --- a/pkgs/development/interpreters/tcl/9.0.nix +++ b/pkgs/development/interpreters/tcl/9.0.nix @@ -4,13 +4,13 @@ callPackage ./generic.nix ( args // rec { release = "9.0"; - version = "${release}.0"; + version = "${release}.1"; # Note: when updating, the hash in pkgs/development/libraries/tk/9.0.nix must also be updated! src = fetchzip { url = "mirror://sourceforge/tcl/tcl${version}-src.tar.gz"; - sha256 = "sha256-QaPSY6kfxyc3x+2ptzEmN2puZ0gSFSeeNjPuxsVKXYE="; + hash = "sha256-NWwCQGyaUzfTgHqpib4lLeflULWKuLE4qYxP+0EizHs="; }; } ) diff --git a/pkgs/development/libraries/tk/9.0.nix b/pkgs/development/libraries/tk/9.0.nix index ff99ca8b4f63..671fa80ed8bc 100644 --- a/pkgs/development/libraries/tk/9.0.nix +++ b/pkgs/development/libraries/tk/9.0.nix @@ -11,7 +11,7 @@ callPackage ./generic.nix ( src = fetchzip { url = "mirror://sourceforge/tcl/tk${tcl.version}-src.tar.gz"; - sha256 = "sha256-jQ9kZuFx6ikQ+SpY7kSbvXJ5hjw4WB9VgRaNlQLtG0s="; + hash = "sha256-eX9HSPnNHeWkCaH0TBhmxQ3keTb4he3KY5rS1w4ubTo="; }; patches = [ diff --git a/pkgs/development/libraries/tk/generic.nix b/pkgs/development/libraries/tk/generic.nix index dfe14f22ec45..73d37d55db93 100644 --- a/pkgs/development/libraries/tk/generic.nix +++ b/pkgs/development/libraries/tk/generic.nix @@ -87,6 +87,6 @@ tcl.mkTclDerivation { platforms = platforms.all; maintainers = [ ]; broken = stdenv.hostPlatform.isDarwin - && lib.elem (lib.versions.majorMinor tcl.version) ["8.5" "9.0"]; + && lib.elem (lib.versions.majorMinor tcl.version) ["8.5"]; }; } From 81874bfc8c1a0f2724a075a9fc0983415f9791b4 Mon Sep 17 00:00:00 2001 From: Francesco Gazzetta Date: Wed, 20 Nov 2024 22:20:38 +0100 Subject: [PATCH 09/10] dayon: 14.0.2 -> 15.0.0 https://github.com/RetGal/Dayon/releases/tag/v15.0.0 --- pkgs/by-name/da/dayon/package.nix | 27 +++++++++++---------------- 1 file changed, 11 insertions(+), 16 deletions(-) diff --git a/pkgs/by-name/da/dayon/package.nix b/pkgs/by-name/da/dayon/package.nix index d183a9256730..722bc175d3df 100644 --- a/pkgs/by-name/da/dayon/package.nix +++ b/pkgs/by-name/da/dayon/package.nix @@ -11,13 +11,13 @@ stdenv.mkDerivation (finalAttrs: { pname = "dayon"; - version = "14.0.2"; + version = "15.0.0"; src = fetchFromGitHub { owner = "RetGal"; repo = "dayon"; rev = "v${finalAttrs.version}"; - hash = "sha256-nRNqubR44ydZwwuQG3q6TRm+MHTRgRbeLI9dsk83wq4="; + hash = "sha256-Tnw1Tr+iRxvHFzSICwOcf4mErNx+imD7/WxVspiR7yo="; }; nativeBuildInputs = [ @@ -39,13 +39,13 @@ stdenv.mkDerivation (finalAttrs: { install -Dm644 build/dayon.jar $out/share/dayon/dayon.jar # jre is in PATH because dayon needs keytool to generate certificates - makeWrapper ${jre}/bin/java $out/bin/dayon \ + makeWrapper ${lib.getExe jre} $out/bin/dayon \ --prefix PATH : "${lib.makeBinPath [ jre ]}" \ --add-flags "-jar $out/share/dayon/dayon.jar" - makeWrapper ${jre}/bin/java $out/bin/dayon_assisted \ + makeWrapper ${lib.getExe jre} $out/bin/dayon_assisted \ --prefix PATH : "${lib.makeBinPath [ jre ]}" \ --add-flags "-cp $out/share/dayon/dayon.jar mpo.dayon.assisted.AssistedRunner" - makeWrapper ${jre}/bin/java $out/bin/dayon_assistant \ + makeWrapper ${lib.getExe jre} $out/bin/dayon_assistant \ --prefix PATH : "${lib.makeBinPath [ jre ]}" \ --add-flags "-cp $out/share/dayon/dayon.jar mpo.dayon.assistant.AssistantRunner" install -Dm644 resources/dayon.png $out/share/icons/hicolor/128x128/apps/dayon.png @@ -54,21 +54,16 @@ stdenv.mkDerivation (finalAttrs: { ''; desktopItems = [ - "resources/deb/dayon_assisted.desktop" - "resources/deb/dayon_assistant.desktop" + "debian/dayon_assisted.desktop" + "debian/dayon_assistant.desktop" ]; - postFixup = '' - substituteInPlace $out/share/applications/*.desktop \ - --replace "/usr/bin/dayon/dayon.png" "dayon" - ''; - - meta = with lib; { + meta = { description = "Easy to use, cross-platform remote desktop assistance solution"; homepage = "https://retgal.github.io/Dayon/index.html"; - license = licenses.gpl3Plus; # https://github.com/RetGal/Dayon/issues/59 + license = lib.licenses.gpl3Plus; # https://github.com/RetGal/Dayon/issues/59 mainProgram = "dayon"; - maintainers = with maintainers; [ fgaz ]; - platforms = platforms.all; + maintainers = with lib.maintainers; [ fgaz ]; + platforms = lib.platforms.all; }; }) From 605edc825b76f097ed3c37798fa84815423683ed Mon Sep 17 00:00:00 2001 From: K900 Date: Sun, 5 Jan 2025 14:43:26 +0300 Subject: [PATCH 10/10] Revert "unbound: pull changes to master" --- pkgs/by-name/un/unbound/package.nix | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/un/unbound/package.nix b/pkgs/by-name/un/unbound/package.nix index 40a6adf37a04..f96caa1428da 100644 --- a/pkgs/by-name/un/unbound/package.nix +++ b/pkgs/by-name/un/unbound/package.nix @@ -64,9 +64,10 @@ stdenv.mkDerivation (finalAttrs: { outputs = [ "out" "lib" "man" ]; # "dev" would only split ~20 kB - nativeBuildInputs = [ bison flex pkg-config ] - ++ lib.optionals withMakeWrapper [ makeWrapper ] + nativeBuildInputs = + lib.optionals withMakeWrapper [ makeWrapper ] ++ lib.optionals withDNSTAP [ protobufc ] + ++ [ pkg-config flex bison ] ++ lib.optionals withPythonModule [ swig ]; buildInputs = [ openssl nettle expat libevent ]