From 32679fbfedf611a878c95b66d1ee8664c9615739 Mon Sep 17 00:00:00 2001
From: Adam Stephens <adam@valkor.net>
Date: Wed, 21 Aug 2024 22:21:16 -0400
Subject: [PATCH 1/3] kanidm: pin updatescript to version tags

---
 pkgs/by-name/ka/kanidm/package.nix | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/ka/kanidm/package.nix b/pkgs/by-name/ka/kanidm/package.nix
index dc032583ae07..5562ce8ed558 100644
--- a/pkgs/by-name/ka/kanidm/package.nix
+++ b/pkgs/by-name/ka/kanidm/package.nix
@@ -110,7 +110,14 @@ rustPlatform.buildRustPackage rec {
       inherit (nixosTests) kanidm kanidm-provisioning;
     };
 
-    updateScript = nix-update-script { };
+    updateScript = nix-update-script { 
+      # avoid spurious releases and tags such as "debs"
+      extraArgs = [
+        "-vr"
+        "v(.*)"
+      ];
+    };
+
     inherit enableSecretProvisioning;
     withSecretProvisioning = kanidm.override { enableSecretProvisioning = true; };
   };

From e78f80bc6bd9123a25d4eb2da33a816425d49712 Mon Sep 17 00:00:00 2001
From: Adam Stephens <adam@valkor.net>
Date: Thu, 22 Aug 2024 02:22:21 +0000
Subject: [PATCH 2/3] kanidm: 1.3.2 -> 1.3.3

---
 pkgs/by-name/ka/kanidm/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/ka/kanidm/package.nix b/pkgs/by-name/ka/kanidm/package.nix
index 5562ce8ed558..840b21b04d35 100644
--- a/pkgs/by-name/ka/kanidm/package.nix
+++ b/pkgs/by-name/ka/kanidm/package.nix
@@ -28,16 +28,16 @@ let
 in
 rustPlatform.buildRustPackage rec {
   pname = "kanidm";
-  version = "1.3.2";
+  version = "1.3.3";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-YFmWZlDcsSk+7EGkoK0SkAhNsrIQa55IRIVqisX3zqE=";
+    hash = "sha256-W5G7osV4du6w/BfyY9YrDzorcLNizRsoz70RMfO2AbY=";
   };
 
-  cargoHash = "sha256-8ZENe576gqm+FkQPCgz6mScqdacHilARFWmfe+kDL2A=";
+  cargoHash = "sha256-gJrzOK6vPPBgsQFkKrbMql00XSfKGjgpZhYJLTURxoI=";
 
   KANIDM_BUILD_PROFILE = "release_nixos_${arch}";
 
@@ -110,7 +110,7 @@ rustPlatform.buildRustPackage rec {
       inherit (nixosTests) kanidm kanidm-provisioning;
     };
 
-    updateScript = nix-update-script { 
+    updateScript = nix-update-script {
       # avoid spurious releases and tags such as "debs"
       extraArgs = [
         "-vr"

From b93f6e4acd3a1e3fdc66ebf27c4d47a2e7fa99b6 Mon Sep 17 00:00:00 2001
From: Adam Stephens <adam@valkor.net>
Date: Thu, 22 Aug 2024 10:08:17 -0400
Subject: [PATCH 3/3] nixos/tests/kanidm: bind certs path to fix ofborg tests

provision # [    8.223448] (kanidmd)[819]: kanidm.service: Failed to set up mount namespacing: /ofborg/checkout/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/ofborg-evaluator-1/nixos/tests/common/acme/server:
No such file or directory
---
 nixos/tests/kanidm-provisioning.nix | 11 +++++++++--
 nixos/tests/kanidm.nix              | 11 +++++++++--
 2 files changed, 18 insertions(+), 4 deletions(-)

diff --git a/nixos/tests/kanidm-provisioning.nix b/nixos/tests/kanidm-provisioning.nix
index c96e9647b411..3bfdce6c912c 100644
--- a/nixos/tests/kanidm-provisioning.nix
+++ b/nixos/tests/kanidm-provisioning.nix
@@ -4,6 +4,13 @@ import ./make-test-python.nix (
     certs = import ./common/acme/server/snakeoil-certs.nix;
     serverDomain = certs.domain;
 
+    # copy certs to store to work around mount namespacing
+    certsPath = pkgs.runCommandNoCC "snakeoil-certs" { } ''
+      mkdir $out
+      cp ${certs."${serverDomain}".cert} $out/snakeoil.crt
+      cp ${certs."${serverDomain}".key} $out/snakeoil.key
+    '';
+
     provisionAdminPassword = "very-strong-password-for-admin";
     provisionIdmAdminPassword = "very-strong-password-for-idm-admin";
     provisionIdmAdminPassword2 = "very-strong-alternative-password-for-idm-admin";
@@ -23,8 +30,8 @@ import ./make-test-python.nix (
             domain = serverDomain;
             bindaddress = "[::]:443";
             ldapbindaddress = "[::1]:636";
-            tls_chain = certs."${serverDomain}".cert;
-            tls_key = certs."${serverDomain}".key;
+            tls_chain = "${certsPath}/snakeoil.crt";
+            tls_key = "${certsPath}/snakeoil.key";
           };
           # So we can check whether provisioning did what we wanted
           enableClient = true;
diff --git a/nixos/tests/kanidm.nix b/nixos/tests/kanidm.nix
index a2f4b98a728c..7e2fce20857a 100644
--- a/nixos/tests/kanidm.nix
+++ b/nixos/tests/kanidm.nix
@@ -6,6 +6,13 @@ import ./make-test-python.nix ({ pkgs, ... }:
     testCredentials = {
       password = "Password1_cZPEwpCWvrReripJmAZdmVIZd8HHoHcl";
     };
+
+    # copy certs to store to work around mount namespacing
+    certsPath = pkgs.runCommandNoCC "snakeoil-certs" { } ''
+      mkdir $out
+      cp ${certs."${serverDomain}".cert} $out/snakeoil.crt
+      cp ${certs."${serverDomain}".key} $out/snakeoil.key
+    '';
   in
   {
     name = "kanidm";
@@ -19,8 +26,8 @@ import ./make-test-python.nix ({ pkgs, ... }:
           domain = serverDomain;
           bindaddress = "[::]:443";
           ldapbindaddress = "[::1]:636";
-          tls_chain = certs."${serverDomain}".cert;
-          tls_key = certs."${serverDomain}".key;
+          tls_chain = "${certsPath}/snakeoil.crt";
+          tls_key = "${certsPath}/snakeoil.key";
         };
       };