From cc2738c71ad454dba35cb8c33c4fce2481e344e7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?St=C3=A9phan=20Kochen?= Date: Tue, 14 Mar 2023 22:38:19 +0100 Subject: [PATCH 1/6] swift: reduce closure size of swift-lib --- pkgs/development/compilers/swift/compiler/default.nix | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/pkgs/development/compilers/swift/compiler/default.nix b/pkgs/development/compilers/swift/compiler/default.nix index 5f37c3ec841b..0c0083c334aa 100644 --- a/pkgs/development/compilers/swift/compiler/default.nix +++ b/pkgs/development/compilers/swift/compiler/default.nix @@ -619,7 +619,12 @@ in stdenv.mkDerivation { # Swift has a separate resource root from Clang, but locates the Clang # resource root via subdir or symlink. Provide a default here, but we also # patch Swift to prefer NIX_CC if set. - ln -s ${clang}/resource-root $lib/lib/swift/clang + # + # NOTE: We don't symlink directly here, because that'd add a run-time dep + # on the full Clang compiler to every Swift executable. The copy here is + # just copying the 3 symlinks inside to smaller closures. + mkdir $lib/lib/swift/clang + cp -P ${clang}/resource-root/* $lib/lib/swift/clang/ ${lib.optionalString stdenv.isDarwin '' # Install required library for ObjC interop. From 96100e7675f96c90b4f1124a77f86e87d7a251ee Mon Sep 17 00:00:00 2001 From: Dmitry Bogatov Date: Fri, 17 Mar 2023 21:39:18 -0400 Subject: [PATCH 2/6] passage: add missing dependency on tree(1) Dependency on tree(1) is used to pretty-print list of all stored passwords. Techically, is not needed to fetch or store password by its name, but without it "passage" without arguments would print error. --- pkgs/tools/security/passage/default.nix | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) diff --git a/pkgs/tools/security/passage/default.nix b/pkgs/tools/security/passage/default.nix index 033b5e2028d1..e232a3ac68d6 100644 --- a/pkgs/tools/security/passage/default.nix +++ b/pkgs/tools/security/passage/default.nix @@ -1,5 +1,15 @@ -{ lib, stdenv, fetchFromGitHub, makeBinaryWrapper, bash, age, git ? null -, xclip ? null }: +{ lib +, stdenv +, fetchFromGitHub +, makeBinaryWrapper +, bash +, age +, git ? null +, xclip ? null +# Used to pretty-print list of all stored passwords, but is not needed to fetch +# or store password by its name. Most users would want this dependency. +, tree ? null +}: stdenv.mkDerivation { pname = "passage"; @@ -14,7 +24,7 @@ stdenv.mkDerivation { nativeBuildInputs = [ makeBinaryWrapper ]; - extraPath = lib.makeBinPath [ age git xclip ]; + extraPath = lib.makeBinPath [ age git xclip tree ]; # Using $0 is bad, it causes --help to mention ".passage-wrapped". postInstall = '' From 4413ef0e0cc0ca677f28f1ec99e1e6262cb94d9a Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Sun, 26 Mar 2023 15:05:16 +0200 Subject: [PATCH 3/6] radicale2: Disable weak crypt htpasswd test With our recent libxcrypt changes we don't support a lot of weak algorithms any longer, which made this test fail. --- pkgs/servers/radicale/2.x.nix | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/pkgs/servers/radicale/2.x.nix b/pkgs/servers/radicale/2.x.nix index 737582d76319..7e86322e31c6 100644 --- a/pkgs/servers/radicale/2.x.nix +++ b/pkgs/servers/radicale/2.x.nix @@ -26,8 +26,12 @@ python3.pkgs.buildPythonApplication rec { ]; nativeCheckInputs = with python3.pkgs; [ - pytest-runner - pytest + pytestCheckHook + ]; + + disabledTests = [ + # uses unsupported crypt method + "test_htpasswd_crypt" ]; meta = with lib; { From 8c4c762da229b5f7c83e3946eab8875df9dd88c6 Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Sun, 26 Mar 2023 15:58:08 +0200 Subject: [PATCH 4/6] lighttpd: Disable tests for DES and MD5 These are legacy ciphers, which we don't support any longer. --- pkgs/servers/http/lighttpd/default.nix | 5 +++ .../lighttpd/disable-legacy-crypt-tests.patch | 37 +++++++++++++++++++ 2 files changed, 42 insertions(+) create mode 100644 pkgs/servers/http/lighttpd/disable-legacy-crypt-tests.patch diff --git a/pkgs/servers/http/lighttpd/default.nix b/pkgs/servers/http/lighttpd/default.nix index ec727c464954..b942589b791c 100644 --- a/pkgs/servers/http/lighttpd/default.nix +++ b/pkgs/servers/http/lighttpd/default.nix @@ -22,6 +22,11 @@ stdenv.mkDerivation rec { sha256 = "sha256-FqyNuV5xlim6YZSbmfiib+upRqgdGFIVsoN5u0EWsLQ="; }; + patches = [ + # disable tests for des/md5, which we don't support any more + ./disable-legacy-crypt-tests.patch + ]; + postPatch = '' patchShebangs tests # Linux sandbox has an empty hostname and not /etc/hosts, which fails some tests diff --git a/pkgs/servers/http/lighttpd/disable-legacy-crypt-tests.patch b/pkgs/servers/http/lighttpd/disable-legacy-crypt-tests.patch new file mode 100644 index 000000000000..3bf50551652e --- /dev/null +++ b/pkgs/servers/http/lighttpd/disable-legacy-crypt-tests.patch @@ -0,0 +1,37 @@ +diff --git a/tests/mod-fastcgi.t b/tests/mod-fastcgi.t +index 25016e60..e0427046 100755 +--- a/tests/mod-fastcgi.t ++++ b/tests/mod-fastcgi.t +@@ -79,7 +79,7 @@ EOF + ok($tf->handle_http($t) == 0, 'FastCGI + bin-copy-environment'); + + SKIP: { +- skip "no crypt-des under openbsd", 2 if $^O eq 'openbsd'; ++ skip "no crypt-des", 2; + + $t->{REQUEST} = ( <{RESPONSE} = [ { 'HTTP-Protocol' => 'HTTP/1.0', 'HTTP-Status' => 200 } ]; + ok($tf->handle_http($t) == 0, 'Basic-Auth: Valid Auth-token - plain'); + + SKIP: { +- skip "no crypt-des under openbsd", 2 if $^O eq 'openbsd'; ++ skip "no crypt-des", 2; + $t->{REQUEST} = ( <{RESPONSE} = [ { 'HTTP-Protocol' => 'HTTP/1.0', 'HTTP-Status' => 401 } ]; + ok($tf->handle_http($t) == 0, 'Basic-Auth: Valid Auth-token - htpasswd (apr-md5, wrong password)'); + + SKIP: { +- skip "no crypt-md5 under cygwin", 1 if $^O eq 'cygwin'; +- skip "no crypt-md5 under darwin", 1 if $^O eq 'darwin'; +- skip "no crypt-md5 under openbsd",1 if $^O eq 'openbsd'; ++ skip "no crypt-md5", 1; + $t->{REQUEST} = ( < Date: Sun, 26 Mar 2023 18:37:15 +0200 Subject: [PATCH 5/6] xdp-tools: fix hash of the patch I'm sorry. --- pkgs/tools/networking/xdp-tools/default.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkgs/tools/networking/xdp-tools/default.nix b/pkgs/tools/networking/xdp-tools/default.nix index 0e5a27ddd17a..b14dd819e434 100644 --- a/pkgs/tools/networking/xdp-tools/default.nix +++ b/pkgs/tools/networking/xdp-tools/default.nix @@ -29,7 +29,7 @@ stdenv.mkDerivation rec { # Fix function detection for btf__type_cnt() (fetchpatch { url = "https://github.com/xdp-project/xdp-tools/commit/a7df567634af77381832a2212c5f5099b07734f3.patch"; - sha256 = "1i4s4y0z9pf3dnjzxy8k0jkjshhz3b0v49qw4cspjrjlmcmy0x00"; + sha256 = "n6qG/bojSGUowrAaJWxecYpWdv9OceHkoaGlhbl81hA="; }) ]; From b0fd7a3179772d1a640dfc9f00b3df8cc50873ec Mon Sep 17 00:00:00 2001 From: Jian Lin <75130626+jian-lin@users.noreply.github.com> Date: Mon, 27 Mar 2023 01:51:14 +0800 Subject: [PATCH 6/6] nixos/nftables: add release notes for checkRuleset option (#223283) --- nixos/doc/manual/release-notes/rl-2305.section.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/nixos/doc/manual/release-notes/rl-2305.section.md b/nixos/doc/manual/release-notes/rl-2305.section.md index f2ba00ef74dd..76e439373114 100644 --- a/nixos/doc/manual/release-notes/rl-2305.section.md +++ b/nixos/doc/manual/release-notes/rl-2305.section.md @@ -259,6 +259,8 @@ In addition to numerous new and upgraded packages, this release has the followin If undesired, the old behavior can be restored by overriding the builders with `{ installDocumentation = false; }`. +- The new option `networking.nftables.checkRuleset` controls whether the ruleset is checked for syntax or not during build. It is `true` by default. The check might fail because it is in a sandbox environment. To circumvent this, the ruleset file can be edited using the `networking.nftables.preCheckRuleset` option. + - `mastodon` now supports connection to a remote `PostgreSQL` database. - `nextcloud` has an option to enable SSE-C in S3.