From 18fcf074a288cebc14a8334ea62da0c25b39574b Mon Sep 17 00:00:00 2001 From: Dany Sluijk Date: Sat, 12 Oct 2024 15:26:25 +0200 Subject: [PATCH 01/57] bambu-studio: 01.09.00.70 -> 01.09.07.52 --- maintainers/maintainer-list.nix | 6 ++ .../misc/bambu-studio/default.nix | 64 +++++++++++-------- .../misc/bambu-studio/orca-slicer.nix | 23 +++---- ...-CMakeLists-Link-against-webkit2gtk-.patch | 0 .../0002-fix-build-for-gcc-13.diff | 0 .../dont-link-opencv-world-bambu.patch | 14 ++++ .../dont-link-opencv-world-orca.patch} | 0 .../{ => patches}/meshboolean-const.patch | 0 pkgs/top-level/all-packages.nix | 10 +-- 9 files changed, 67 insertions(+), 50 deletions(-) rename pkgs/applications/misc/bambu-studio/{ => patches}/0001-not-for-upstream-CMakeLists-Link-against-webkit2gtk-.patch (100%) rename pkgs/applications/misc/bambu-studio/{ => patches}/0002-fix-build-for-gcc-13.diff (100%) create mode 100644 pkgs/applications/misc/bambu-studio/patches/dont-link-opencv-world-bambu.patch rename pkgs/applications/misc/bambu-studio/{dont-link-opencv-world.patch => patches/dont-link-opencv-world-orca.patch} (100%) rename pkgs/applications/misc/bambu-studio/{ => patches}/meshboolean-const.patch (100%) diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix index 7b0e36de4a3c..b43f3853919f 100644 --- a/maintainers/maintainer-list.nix +++ b/maintainers/maintainer-list.nix @@ -5781,6 +5781,12 @@ githubId = 1931963; name = "David Sferruzza"; }; + dsluijk = { + name = "Dany Sluijk"; + email = "nix@dany.dev"; + github = "dsluijk"; + githubId = 8537327; + }; dstengele = { name = "Dennis Stengele"; email = "dennis@stengele.me"; diff --git a/pkgs/applications/misc/bambu-studio/default.nix b/pkgs/applications/misc/bambu-studio/default.nix index 4084734aa58e..e753828b78dd 100644 --- a/pkgs/applications/misc/bambu-studio/default.nix +++ b/pkgs/applications/misc/bambu-studio/default.nix @@ -22,10 +22,7 @@ glib, glib-networking, gmp, - gstreamer, - gst-plugins-base, - gst-plugins-bad, - gst-plugins-good, + gst_all_1, gtest, gtk3, hicolor-icon-theme, @@ -36,23 +33,29 @@ nlopt, opencascade-occt_7_6, openvdb, + opencv, pcre, systemd, tbb_2021_11, - webkitgtk_4_0, + webkitgtk, wxGTK31, xorg, withSystemd ? stdenv.hostPlatform.isLinux, }: let - opencascade-occt = opencascade-occt_7_6; - wxGTK31' = wxGTK31.overrideAttrs (old: { - configureFlags = old.configureFlags ++ [ - # Disable noisy debug dialogs - "--enable-debug=no" - ]; - }); - openvdb_tbb_2021_8 = openvdb.overrideAttrs (old: { + wxGTK' = (wxGTK31.override { + withCurl = true; + withPrivateFonts = true; + withWebKit = true; + }) + .overrideAttrs (old: { + configureFlags = old.configureFlags ++ [ + # Disable noisy debug dialogs + "--enable-debug=no" + ]; + }); + + openvdb' = openvdb.overrideAttrs (old: { buildInputs = [ openexr boost179 @@ -65,13 +68,13 @@ let in stdenv.mkDerivation rec { pname = "bambu-studio"; - version = "01.09.00.70"; + version = "01.09.07.52"; src = fetchFromGitHub { owner = "bambulab"; repo = "BambuStudio"; rev = "v${version}"; - hash = "sha256-RBctBhKo7mjxsP7OJhGfoU1eIiGVuMiAqwwSU+gsMds="; + hash = "sha256-fhH4N29P/ysdHHbZt+FnBl3+QtTNhbVE3j4ZnFJyJH0="; }; nativeBuildInputs = [ @@ -95,10 +98,10 @@ stdenv.mkDerivation rec { glib glib-networking gmp - gstreamer - gst-plugins-base - gst-plugins-bad - gst-plugins-good + gst_all_1.gstreamer + gst_all_1.gst-plugins-base + gst_all_1.gst-plugins-bad + gst_all_1.gst-plugins-good gtk3 hicolor-icon-theme ilmbase @@ -106,20 +109,23 @@ stdenv.mkDerivation rec { mesa.osmesa mpfr nlopt - opencascade-occt - openvdb_tbb_2021_8 + opencascade-occt_7_6 + openvdb' pcre tbb_2021_11 - webkitgtk_4_0 - wxGTK31' + webkitgtk + wxGTK' xorg.libX11 + opencv ] ++ lib.optionals withSystemd [ systemd ] ++ checkInputs; patches = [ # Fix for webkitgtk linking - ./0001-not-for-upstream-CMakeLists-Link-against-webkit2gtk-.patch + ./patches/0001-not-for-upstream-CMakeLists-Link-against-webkit2gtk-.patch # Fix build with cgal-5.6.1+ - ./meshboolean-const.patch + ./patches/meshboolean-const.patch + # Fix an issue with + ./patches/dont-link-opencv-world-bambu.patch ]; doCheck = true; @@ -136,7 +142,10 @@ stdenv.mkDerivation rec { # Disable compiler warnings that clutter the build log. # It seems to be a known issue for Eigen: # http://eigen.tuxfamily.org/bz/show_bug.cgi?id=1221 - NIX_CFLAGS_COMPILE = "-Wno-ignored-attributes"; + NIX_CFLAGS_COMPILE = toString [ + "-Wno-ignored-attributes" + "-I${opencv.out}/include/opencv4" + ]; # prusa-slicer uses dlopen on `libudev.so` at runtime NIX_LDFLAGS = lib.optionalString withSystemd "-ludev"; @@ -181,8 +190,9 @@ stdenv.mkDerivation rec { meta = with lib; { description = "PC Software for BambuLab's 3D printers"; homepage = "https://github.com/bambulab/BambuStudio"; + changelog = "https://github.com/bambulab/BambuStudio/releases/tag/v${version}"; license = licenses.agpl3Plus; - maintainers = with maintainers; [ zhaofengli ]; + maintainers = with maintainers; [ zhaofengli dsluijk ]; mainProgram = "bambu-studio"; platforms = platforms.linux; }; diff --git a/pkgs/applications/misc/bambu-studio/orca-slicer.nix b/pkgs/applications/misc/bambu-studio/orca-slicer.nix index 353252dfea17..9f52f7de4260 100644 --- a/pkgs/applications/misc/bambu-studio/orca-slicer.nix +++ b/pkgs/applications/misc/bambu-studio/orca-slicer.nix @@ -16,20 +16,15 @@ bambu-studio.overrideAttrs ( hash = "sha256-7fusdSYpZb4sYl5L/+81PzMd42Nsejj+kCZsq0f7eIk="; }; - patches = - previousAttrs.patches - ++ [ - # FIXME: only required for 2.1.1, can be removed in the next version - ./0002-fix-build-for-gcc-13.diff - - ./dont-link-opencv-world.patch - ]; - - buildInputs = - previousAttrs.buildInputs - ++ [ - opencv - ]; + patches =[ + # FIXME: only required for 2.1.1, can be removed in the next version + ./patches/0002-fix-build-for-gcc-13.diff + # Fix for webkitgtk linking + ./patches/0001-not-for-upstream-CMakeLists-Link-against-webkit2gtk-.patch + # Fix build with cgal-5.6.1+ + ./patches/meshboolean-const.patch + ./patches/dont-link-opencv-world-orca.patch + ]; preFixup = '' gappsWrapperArgs+=( diff --git a/pkgs/applications/misc/bambu-studio/0001-not-for-upstream-CMakeLists-Link-against-webkit2gtk-.patch b/pkgs/applications/misc/bambu-studio/patches/0001-not-for-upstream-CMakeLists-Link-against-webkit2gtk-.patch similarity index 100% rename from pkgs/applications/misc/bambu-studio/0001-not-for-upstream-CMakeLists-Link-against-webkit2gtk-.patch rename to pkgs/applications/misc/bambu-studio/patches/0001-not-for-upstream-CMakeLists-Link-against-webkit2gtk-.patch diff --git a/pkgs/applications/misc/bambu-studio/0002-fix-build-for-gcc-13.diff b/pkgs/applications/misc/bambu-studio/patches/0002-fix-build-for-gcc-13.diff similarity index 100% rename from pkgs/applications/misc/bambu-studio/0002-fix-build-for-gcc-13.diff rename to pkgs/applications/misc/bambu-studio/patches/0002-fix-build-for-gcc-13.diff diff --git a/pkgs/applications/misc/bambu-studio/patches/dont-link-opencv-world-bambu.patch b/pkgs/applications/misc/bambu-studio/patches/dont-link-opencv-world-bambu.patch new file mode 100644 index 000000000000..cb7e212144ac --- /dev/null +++ b/pkgs/applications/misc/bambu-studio/patches/dont-link-opencv-world-bambu.patch @@ -0,0 +1,14 @@ +diff --git a/src/libslic3r/CMakeLists.txt b/src/libslic3r/CMakeLists.txt +index 2cdc525..44e6602 100644 +--- a/src/libslic3r/CMakeLists.txt ++++ b/src/libslic3r/CMakeLists.txt +@@ -533,7 +533,8 @@ target_link_libraries(libslic3r + ${OCCT_LIBS} + Clipper2 + mcut +- opencv_world ++ opencv_core ++ opencv_imgproc + ) + + if(NOT WIN32) \ No newline at end of file diff --git a/pkgs/applications/misc/bambu-studio/dont-link-opencv-world.patch b/pkgs/applications/misc/bambu-studio/patches/dont-link-opencv-world-orca.patch similarity index 100% rename from pkgs/applications/misc/bambu-studio/dont-link-opencv-world.patch rename to pkgs/applications/misc/bambu-studio/patches/dont-link-opencv-world-orca.patch diff --git a/pkgs/applications/misc/bambu-studio/meshboolean-const.patch b/pkgs/applications/misc/bambu-studio/patches/meshboolean-const.patch similarity index 100% rename from pkgs/applications/misc/bambu-studio/meshboolean-const.patch rename to pkgs/applications/misc/bambu-studio/patches/meshboolean-const.patch diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index 3107d86d81c3..0037de0132af 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -32575,15 +32575,7 @@ with pkgs; super-slicer-latest = super-slicer.latest; - bambu-studio = callPackage ../applications/misc/bambu-studio { - inherit (gst_all_1) gstreamer gst-plugins-base gst-plugins-bad gst-plugins-good; - - wxGTK31 = wxGTK31.override { - withCurl = true; - withPrivateFonts = true; - withWebKit = true; - }; - }; + bambu-studio = callPackage ../applications/misc/bambu-studio { }; orca-slicer = callPackage ../applications/misc/bambu-studio/orca-slicer.nix {}; From b7f7cc1dce81a15f12808245a69851aec818e69b Mon Sep 17 00:00:00 2001 From: Dany Sluijk Date: Sat, 12 Oct 2024 15:31:05 +0200 Subject: [PATCH 02/57] bambu-studio: format file --- .../misc/bambu-studio/default.nix | 22 +++++++++++-------- 1 file changed, 13 insertions(+), 9 deletions(-) diff --git a/pkgs/applications/misc/bambu-studio/default.nix b/pkgs/applications/misc/bambu-studio/default.nix index e753828b78dd..47bcc82a20cf 100644 --- a/pkgs/applications/misc/bambu-studio/default.nix +++ b/pkgs/applications/misc/bambu-studio/default.nix @@ -43,17 +43,18 @@ withSystemd ? stdenv.hostPlatform.isLinux, }: let - wxGTK' = (wxGTK31.override { + wxGTK' = + (wxGTK31.override { withCurl = true; withPrivateFonts = true; withWebKit = true; - }) - .overrideAttrs (old: { - configureFlags = old.configureFlags ++ [ - # Disable noisy debug dialogs - "--enable-debug=no" - ]; - }); + }).overrideAttrs + (old: { + configureFlags = old.configureFlags ++ [ + # Disable noisy debug dialogs + "--enable-debug=no" + ]; + }); openvdb' = openvdb.overrideAttrs (old: { buildInputs = [ @@ -192,7 +193,10 @@ stdenv.mkDerivation rec { homepage = "https://github.com/bambulab/BambuStudio"; changelog = "https://github.com/bambulab/BambuStudio/releases/tag/v${version}"; license = licenses.agpl3Plus; - maintainers = with maintainers; [ zhaofengli dsluijk ]; + maintainers = with maintainers; [ + zhaofengli + dsluijk + ]; mainProgram = "bambu-studio"; platforms = platforms.linux; }; From 4117c7f7b143d14de2f9dfbd86ed5e1936634dbb Mon Sep 17 00:00:00 2001 From: Dany Sluijk Date: Mon, 14 Oct 2024 14:32:33 +0200 Subject: [PATCH 03/57] bambu-studio: explicitly define webkitgtk version --- pkgs/applications/misc/bambu-studio/default.nix | 4 ++-- pkgs/applications/misc/bambu-studio/orca-slicer.nix | 1 - 2 files changed, 2 insertions(+), 3 deletions(-) diff --git a/pkgs/applications/misc/bambu-studio/default.nix b/pkgs/applications/misc/bambu-studio/default.nix index 47bcc82a20cf..481f36571706 100644 --- a/pkgs/applications/misc/bambu-studio/default.nix +++ b/pkgs/applications/misc/bambu-studio/default.nix @@ -37,7 +37,7 @@ pcre, systemd, tbb_2021_11, - webkitgtk, + webkitgtk_4_0, wxGTK31, xorg, withSystemd ? stdenv.hostPlatform.isLinux, @@ -114,7 +114,7 @@ stdenv.mkDerivation rec { openvdb' pcre tbb_2021_11 - webkitgtk + webkitgtk_4_0 wxGTK' xorg.libX11 opencv diff --git a/pkgs/applications/misc/bambu-studio/orca-slicer.nix b/pkgs/applications/misc/bambu-studio/orca-slicer.nix index 9f52f7de4260..db86a8c40815 100644 --- a/pkgs/applications/misc/bambu-studio/orca-slicer.nix +++ b/pkgs/applications/misc/bambu-studio/orca-slicer.nix @@ -2,7 +2,6 @@ lib, fetchFromGitHub, bambu-studio, - opencv, }: bambu-studio.overrideAttrs ( finalAttrs: previousAttrs: { From d05c2e3980f6000539f47e822b3811a6f113b95c Mon Sep 17 00:00:00 2001 From: Charlie Root Date: Mon, 21 Oct 2024 22:23:09 +0200 Subject: [PATCH 04/57] imagemagick: Add fftw support --- pkgs/applications/graphics/ImageMagick/default.nix | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/pkgs/applications/graphics/ImageMagick/default.nix b/pkgs/applications/graphics/ImageMagick/default.nix index aa613ef09ae9..8f96fa252fc0 100644 --- a/pkgs/applications/graphics/ImageMagick/default.nix +++ b/pkgs/applications/graphics/ImageMagick/default.nix @@ -24,6 +24,7 @@ , openjpegSupport ? !stdenv.hostPlatform.isMinGW, openjpeg , libwebpSupport ? !stdenv.hostPlatform.isMinGW, libwebp , libheifSupport ? true, libheif +, fftwSupport ? true, fftw , potrace , coreutils , curl @@ -76,6 +77,7 @@ stdenv.mkDerivation (finalAttrs: { (lib.withFeature libjxlSupport "jxl") (lib.withFeatureAs ghostscriptSupport "gs-font-dir" "${ghostscript.fonts}/share/fonts") (lib.withFeature ghostscriptSupport "gslib") + (lib.withFeature fftwSupport "fftw") ] ++ lib.optionals stdenv.hostPlatform.isMinGW [ # due to libxml2 being without DLLs ATM "--enable-static" "--disable-shared" @@ -113,7 +115,8 @@ stdenv.mkDerivation (finalAttrs: { ++ lib.optional lcms2Support lcms2 ++ lib.optional libX11Support libX11 ++ lib.optional libXtSupport libXt - ++ lib.optional libwebpSupport libwebp; + ++ lib.optional libwebpSupport libwebp + ++ lib.optional fftwSupport fftw; postInstall = '' (cd "$dev/include" && ln -s ImageMagick* ImageMagick) From 084f73e7289a6c6293483844248dc7d954e8757c Mon Sep 17 00:00:00 2001 From: Charlie Root Date: Mon, 21 Oct 2024 22:43:37 +0200 Subject: [PATCH 05/57] maintainers: add bloxx12 --- maintainers/maintainer-list.nix | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix index 5ad8fdbbbacb..0de040b23d07 100644 --- a/maintainers/maintainer-list.nix +++ b/maintainers/maintainer-list.nix @@ -2915,6 +2915,12 @@ githubId = 535135; name = "Brennon Loveless"; }; + bloxx12 = { + email = "charlie@charlieroot.dev"; + github = "bloxx12"; + githubId = 75451918; + name = "Charlie Root"; + }; bluescreen303 = { email = "mathijs@bluescreen303.nl"; github = "bluescreen303"; From 26cc7c67b259d281df88321451427f49018f99f8 Mon Sep 17 00:00:00 2001 From: Charlie Root Date: Tue, 22 Oct 2024 15:59:37 +0200 Subject: [PATCH 06/57] imagemagick: add bloxx12 to maintainers --- pkgs/applications/graphics/ImageMagick/default.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkgs/applications/graphics/ImageMagick/default.nix b/pkgs/applications/graphics/ImageMagick/default.nix index 8f96fa252fc0..fd45ff16d257 100644 --- a/pkgs/applications/graphics/ImageMagick/default.nix +++ b/pkgs/applications/graphics/ImageMagick/default.nix @@ -149,7 +149,7 @@ stdenv.mkDerivation (finalAttrs: { description = "Software suite to create, edit, compose, or convert bitmap images"; pkgConfigModules = [ "ImageMagick" "MagickWand" ]; platforms = platforms.linux ++ platforms.darwin; - maintainers = with maintainers; [ dotlambda rhendric ]; + maintainers = with maintainers; [ dotlambda rhendric bloxx12 ]; license = licenses.asl20; mainProgram = "magick"; }; From 8c29c73a6dcf1b89ea8c0c6a8d591217d977f375 Mon Sep 17 00:00:00 2001 From: techknowlogick Date: Fri, 25 Oct 2024 01:09:14 -0400 Subject: [PATCH 07/57] teleport_16: 16.2.0 -> 16.4.6 --- pkgs/servers/teleport/16/default.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/servers/teleport/16/default.nix b/pkgs/servers/teleport/16/default.nix index 75104b03d117..ecd714d77d06 100644 --- a/pkgs/servers/teleport/16/default.nix +++ b/pkgs/servers/teleport/16/default.nix @@ -1,9 +1,9 @@ { wasm-bindgen-cli, ... }@args: import ../generic.nix (args // { - version = "16.2.0"; - hash = "sha256-3LLoO7SNJfEfDEU7JnAhmAOIdRO+TkgiJKjT8sqzelo="; + version = "16.4.6"; + hash = "sha256-TdOCFs6YeqINM8aPryrjYPaXEjc/gIqu7kzVYDnMsjg="; vendorHash = "sha256-iyYfht0aB9Vv2hsaqrieFHXbDhlotKQYfLn4JFqpve8="; - pnpmHash = "sha256-lcev7VwTcuCuced8uZzLoobREWtNRDFRFdfmabJPLtc="; + pnpmHash = "sha256-NF45Wp4itYud01VzxC8bRHZ3xZ1T1du1QmZTDMS5nOk="; cargoLock = { lockFile = ./Cargo.lock; outputHashes = { From 05f80699b95eb8a1db832debc490bfeb65a7bc5d Mon Sep 17 00:00:00 2001 From: Peder Bergebakken Sundt Date: Fri, 25 Oct 2024 22:59:09 +0200 Subject: [PATCH 08/57] gallery-dl: 1.27.6 -> 1.27.7 Changelog: https://github.com/mikf/gallery-dl/blob/v1.27.7/CHANGELOG.md --- pkgs/applications/misc/gallery-dl/default.nix | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/pkgs/applications/misc/gallery-dl/default.nix b/pkgs/applications/misc/gallery-dl/default.nix index ac8e15d38908..590ce86a52e7 100644 --- a/pkgs/applications/misc/gallery-dl/default.nix +++ b/pkgs/applications/misc/gallery-dl/default.nix @@ -10,13 +10,13 @@ buildPythonApplication rec { pname = "gallery-dl"; - version = "1.27.6"; + version = "1.27.7"; format = "setuptools"; src = fetchPypi { inherit version; pname = "gallery_dl"; - hash = "sha256-bxh15aZIupTaHnYM65MAYuYtKx0z2OIQl3WKEU1gO4Q="; + hash = "sha256-9YcxD7AH4U2dOhAiUnknwwGFy9pplFFQ7Rn4cOvDdEc="; }; propagatedBuildInputs = [ @@ -26,6 +26,11 @@ buildPythonApplication rec { nativeCheckInputs = [ pytestCheckHook ]; + disabledTests = [ + # requires network access + "test_init" + ]; + pytestFlagsArray = [ # requires network access "--ignore=test/test_results.py" From 42f519ea739e1a4d0216ca02590ac0233774c8cc Mon Sep 17 00:00:00 2001 From: Nikolay Korotkiy Date: Mon, 21 Oct 2024 23:02:47 +0400 Subject: [PATCH 09/57] =?UTF-8?q?orbiton:=202.65.12=20=E2=86=92=202.67.1?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- pkgs/by-name/or/orbiton/package.nix | 17 ++++++----------- 1 file changed, 6 insertions(+), 11 deletions(-) diff --git a/pkgs/by-name/or/orbiton/package.nix b/pkgs/by-name/or/orbiton/package.nix index 6e9cee2539fe..b1bcb193e322 100644 --- a/pkgs/by-name/or/orbiton/package.nix +++ b/pkgs/by-name/or/orbiton/package.nix @@ -4,32 +4,27 @@ buildGoModule rec { pname = "orbiton"; - version = "2.65.12"; + version = "2.67.1"; src = fetchFromGitHub { owner = "xyproto"; repo = "orbiton"; rev = "v${version}"; - hash = "sha256-1KVw2dj//6vwUUj1jVWe2J/9F6J8BQsvCAEbJZnW26c="; + hash = "sha256-/5USD588kr3uB/Zs1ASKVgxH4kAWZCNBrZL7qqx49gU="; }; vendorHash = null; - postPatch = lib.optionalString stdenv.hostPlatform.isDarwin '' - substituteInPlace Makefile \ - --replace "-Wl,--as-needed" "" - - # Requires impure pbcopy and pbpaste - substituteInPlace v2/pbcopy_test.go \ - --replace TestPBcopy SkipTestPBcopy - ''; - nativeBuildInputs = [ installShellFiles makeWrapper pkg-config ]; buildInputs = lib.optional withGui vte; preBuild = "cd v2"; + checkFlags = [ + "-skip=TestPBcopy" # Requires impure pbcopy and pbpaste + ]; + postInstall = '' cd .. installManPage o.1 From a597d3335aa51dd434c8c1735003c88624162b18 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= Date: Sun, 27 Oct 2024 09:23:42 -0700 Subject: [PATCH 10/57] python312Packages.ftfy: 6.2.3 -> 6.3.1 Diff: https://github.com/rspeer/python-ftfy/compare/refs/tags/v6.2.3...v6.3.1 Changelog: https://github.com/rspeer/python-ftfy/blob/refs/tags/v6.3.1/CHANGELOG.md --- .../python-modules/ftfy/default.nix | 24 +++++++++---------- 1 file changed, 11 insertions(+), 13 deletions(-) diff --git a/pkgs/development/python-modules/ftfy/default.nix b/pkgs/development/python-modules/ftfy/default.nix index d51041828a64..ec5aca9062a6 100644 --- a/pkgs/development/python-modules/ftfy/default.nix +++ b/pkgs/development/python-modules/ftfy/default.nix @@ -1,11 +1,11 @@ { lib, buildPythonPackage, - fetchPypi, + fetchFromGitHub, pythonOlder, # build-system - poetry-core, + hatchling, # dependencies wcwidth, @@ -17,17 +17,19 @@ buildPythonPackage rec { pname = "ftfy"; - version = "6.2.3"; + version = "6.3.1"; pyproject = true; - disabled = pythonOlder "3.7"; + disabled = pythonOlder "3.9"; - src = fetchPypi { - inherit pname version; - hash = "sha256-ebUFmI8p1XelipBpr+dVU6AqRuQt5gkcBmDNxngSutw="; + src = fetchFromGitHub { + owner = "rspeer"; + repo = "python-ftfy"; + rev = "refs/tags/v${version}"; + hash = "sha256-TmwDJeUDcF+uOB2X5tMmnf9liCI9rP6dYJVmJoaqszo="; }; - build-system = [ poetry-core ]; + build-system = [ hatchling ]; dependencies = [ wcwidth ]; @@ -42,12 +44,8 @@ buildPythonPackage rec { export PATH=$out/bin:$PATH ''; - disabledTestPaths = [ - # Calls poetry and fails to match output exactly - "tests/test_cli.py" - ]; - meta = with lib; { + changelog = "https://github.com/rspeer/python-ftfy/blob/${src.rev}/CHANGELOG.md"; description = "Given Unicode text, make its representation consistent and possibly less broken"; mainProgram = "ftfy"; homepage = "https://github.com/LuminosoInsight/python-ftfy"; From 9c95af68e40b3a92ac04526ce5b7160cd6af0d2d Mon Sep 17 00:00:00 2001 From: huantian Date: Mon, 28 Oct 2024 12:08:43 -0700 Subject: [PATCH 11/57] python3Packages.aw-client: 0.5.13 -> 0.5.14 --- pkgs/development/python-modules/aw-client/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/python-modules/aw-client/default.nix b/pkgs/development/python-modules/aw-client/default.nix index 42c51ed2f806..bec43cbf2dbe 100644 --- a/pkgs/development/python-modules/aw-client/default.nix +++ b/pkgs/development/python-modules/aw-client/default.nix @@ -16,7 +16,7 @@ buildPythonPackage rec { pname = "aw-client"; - version = "0.5.13"; + version = "0.5.14"; format = "pyproject"; @@ -25,7 +25,7 @@ buildPythonPackage rec { owner = "ActivityWatch"; repo = "aw-client"; rev = "v${version}"; - sha256 = "sha256-A9f1Wj4F6qRvCVj3iRQvsnILewJK1L5tfI2MnAXZ4nY="; + sha256 = "sha256-HTyhQz/RaNdCtJIV6YHEd6Yhu9VRJ8E9XdN7NcoO8ao="; }; disabled = pythonOlder "3.8"; From d7bf46fed1417df9ce9e1d86deb4e3af35d1ff3d Mon Sep 17 00:00:00 2001 From: Sefa Eyeoglu Date: Mon, 28 Oct 2024 22:13:02 +0100 Subject: [PATCH 12/57] nifi: 1.27.0 -> 1.28.0 Fixes CVE-2024-45477 Relevant commit: https://github.com/apache/nifi/commit/153c87a7daaeebea9b119066285b840ea4056e09 Announcement: https://www.openwall.com/lists/oss-security/2024/10/28/1 Changes: https://github.com/apache/nifi/compare/rel/nifi-1.27.0...rel/nifi-1.28.0 Signed-off-by: Sefa Eyeoglu --- pkgs/servers/web-apps/nifi/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/servers/web-apps/nifi/default.nix b/pkgs/servers/web-apps/nifi/default.nix index 3a65cb0fecfa..480b101098ac 100644 --- a/pkgs/servers/web-apps/nifi/default.nix +++ b/pkgs/servers/web-apps/nifi/default.nix @@ -2,11 +2,11 @@ stdenv.mkDerivation rec { pname = "nifi"; - version = "1.27.0"; + version = "1.28.0"; src = fetchzip { url = "mirror://apache/nifi/${version}/nifi-${version}-bin.zip"; - hash = "sha256-D3o7MLn8vdDqzk6/AJ7Lmq6Yx2swy8CwOyDTlxFSVME="; + hash = "sha256-EQqosdwNdaSUIcP3QlvzJZhDNu1JbHg08FlnZo6ogmQ="; }; nativeBuildInputs = [ makeWrapper ]; From 338e666e6bd835e29c913aa02125daf8bb7153d3 Mon Sep 17 00:00:00 2001 From: Reno Dakota <170618376+paparodeo@users.noreply.github.com> Date: Mon, 28 Oct 2024 06:55:44 +0000 Subject: [PATCH 13/57] bb: fix darwin / clang - autoreconfHook - add missing headers needed for function prototypes. - remove regparm for clang --- pkgs/applications/misc/bb/default.nix | 21 ++- .../misc/bb/included-files-updates.diff | 145 ++++++++++++++++++ 2 files changed, 158 insertions(+), 8 deletions(-) create mode 100644 pkgs/applications/misc/bb/included-files-updates.diff diff --git a/pkgs/applications/misc/bb/default.nix b/pkgs/applications/misc/bb/default.nix index 16f4c0bd2d6f..1c7eedc56570 100644 --- a/pkgs/applications/misc/bb/default.nix +++ b/pkgs/applications/misc/bb/default.nix @@ -1,4 +1,4 @@ -{ stdenv, lib, fetchurl, darwin, aalib, ncurses, xorg, libmikmod }: +{ stdenv, lib, fetchurl, autoreconfHook, aalib, ncurses, xorg, libmikmod }: stdenv.mkDerivation rec { pname = "bb"; @@ -9,19 +9,24 @@ stdenv.mkDerivation rec { sha256 = "1i411glxh7g4pfg4gw826lpwngi89yrbmxac8jmnsfvrfb48hgbr"; }; + patches = [ + # add / update include files to get function prototypes + ./included-files-updates.diff + ]; + + nativeBuildInputs = [ autoreconfHook ]; + buildInputs = [ aalib ncurses libmikmod xorg.libXau xorg.libXdmcp xorg.libX11 - ] ++ lib.optional stdenv.hostPlatform.isDarwin darwin.apple_sdk.frameworks.CoreAudio; + ]; - postPatch = lib.optionalString stdenv.hostPlatform.isDarwin '' - sed -i -e '/^#include $/d' *.c + # regparm attribute is not supported by clang + postPatch = lib.optionalString stdenv.cc.isClang '' + substituteInPlace config.h \ + --replace-fail "__attribute__ ((regparm(n)))" "" ''; - # error: 'regparm' is not valid on this platform - env.NIX_CFLAGS_COMPILE = lib.optionalString (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64) - "-D__STRICT_ANSI__"; - meta = with lib; { homepage = "http://aa-project.sourceforge.net/bb"; description = "AA-lib demo"; diff --git a/pkgs/applications/misc/bb/included-files-updates.diff b/pkgs/applications/misc/bb/included-files-updates.diff new file mode 100644 index 000000000000..07fa331a96c0 --- /dev/null +++ b/pkgs/applications/misc/bb/included-files-updates.diff @@ -0,0 +1,145 @@ +diff --git a/bb.c b/bb.c +index 95850ef..6a7cc78 100644 +--- a/bb.c ++++ b/bb.c +@@ -23,6 +23,7 @@ + + #include + #include ++#include + #include + #include + #include "bb.h" +diff --git a/credits.c b/credits.c +index 8514579..b304d8c 100644 +--- a/credits.c ++++ b/credits.c +@@ -24,7 +24,6 @@ + #include + #include + #include +-#include + #include + #include "bb.h" + #define STAR 1 +diff --git a/credits2.c b/credits2.c +index 65d2431..9dcdf2d 100644 +--- a/credits2.c ++++ b/credits2.c +@@ -25,7 +25,6 @@ + #include + #include + #include +-#include + #include + #include "bb.h" + #define STATE (TIME-starttime) +diff --git a/main.c b/main.c +index ae852a7..c0648b4 100644 +--- a/main.c ++++ b/main.c +@@ -21,6 +21,8 @@ + * 675 Mass Ave, Cambridge, MA 02139, USA. + */ + ++#include ++#include + #include + #include "timers.h" + #include "bb.h" +diff --git a/messager.c b/messager.c +index 95cc410..5164577 100644 +--- a/messager.c ++++ b/messager.c +@@ -22,7 +22,7 @@ + */ + + #include +-#include ++#include + #include "bb.h" + + static int cursor_x, cursor_y; +diff --git a/scene5.c b/scene5.c +index 8d3c798..4a79258 100644 +--- a/scene5.c ++++ b/scene5.c +@@ -22,7 +22,7 @@ + */ + + #include +-#include ++#include + #include + #include "bb.h" + #include "tex.h" +diff --git a/scene8.c b/scene8.c +index 2bcba1e..72ea231 100644 +--- a/scene8.c ++++ b/scene8.c +@@ -22,7 +22,7 @@ + */ + + #include +-#include ++#include + #include "bb.h" + #define STATE1 (TIME-starttime1) + #define STATE (time-starttime) +diff --git a/textform.c b/textform.c +index 859d367..eb9d1cb 100644 +--- a/textform.c ++++ b/textform.c +@@ -1,6 +1,6 @@ + #include + #include +-#include ++#include + #include + #include "bb.h" + #define MAXLINES 10000 +diff --git a/timers.c b/timers.c +index ac822f7..6342c1b 100644 +--- a/timers.c ++++ b/timers.c +@@ -45,12 +45,9 @@ + #include + #endif + /*HAVE_TIME_H*/ +-#include ++#include + #include + #include +-#ifndef _MAC +-#include +-#endif + #ifdef __BEOS__ + #include + #endif +diff --git a/uncompfn.c b/uncompfn.c +index d8eaaea..bc707f8 100644 +--- a/uncompfn.c ++++ b/uncompfn.c +@@ -21,7 +21,7 @@ + * 675 Mass Ave, Cambridge, MA 02139, USA. + */ + +-#include ++#include + #include + #include "bb.h" + +diff --git a/zoom.c b/zoom.c +index 7450095..4b37b2d 100644 +--- a/zoom.c ++++ b/zoom.c +@@ -31,9 +31,6 @@ + #else + #include + #include +-#ifndef _MAC +-#include +-#endif + #ifdef __DJGPP__ + #include "aconfig.dos" + #else From a5a6f3d98480817a3c1d3d35231cd9448c8d3e6e Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Tue, 29 Oct 2024 03:49:18 +0000 Subject: [PATCH 14/57] spotify-player: 0.19.1 -> 0.20.0 --- pkgs/applications/audio/spotify-player/default.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/applications/audio/spotify-player/default.nix b/pkgs/applications/audio/spotify-player/default.nix index a3c51cfaaba2..3f297c3e9bc4 100644 --- a/pkgs/applications/audio/spotify-player/default.nix +++ b/pkgs/applications/audio/spotify-player/default.nix @@ -34,16 +34,16 @@ assert lib.assertOneOf "withAudioBackend" withAudioBackend [ "" "alsa" "pulseaud rustPlatform.buildRustPackage rec { pname = "spotify-player"; - version = "0.19.1"; + version = "0.20.0"; src = fetchFromGitHub { owner = "aome510"; repo = pname; rev = "refs/tags/v${version}"; - hash = "sha256-R8F7s8FPnCe+shNUN/u0qcxFy3IbyfVo2xZ5/E/qwaw="; + hash = "sha256-heycCm2Nwyo+DegMKeXZ+dF+ZqiFT/6P08/28buJc6I="; }; - cargoHash = "sha256-7vximGisIIXBrwHXSWQjO08OraaweG7ZT6v+gVdYGVc="; + cargoHash = "sha256-U3a/6uF7vOV3QnxqPnooBdvjyyIPLnQXiXtTwKeHAxA="; nativeBuildInputs = [ pkg-config From 68030db738e5ac2b815857954cd92de8e1cbd580 Mon Sep 17 00:00:00 2001 From: nartsisss Date: Wed, 30 Oct 2024 01:51:18 +0300 Subject: [PATCH 15/57] hexyl: 0.14.0 -> 0.15.0 --- pkgs/tools/misc/hexyl/default.nix | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/pkgs/tools/misc/hexyl/default.nix b/pkgs/tools/misc/hexyl/default.nix index 5f72c7a702f3..e8be44162b7a 100644 --- a/pkgs/tools/misc/hexyl/default.nix +++ b/pkgs/tools/misc/hexyl/default.nix @@ -2,16 +2,16 @@ rustPlatform.buildRustPackage rec { pname = "hexyl"; - version = "0.14.0"; + version = "0.15.0"; src = fetchFromGitHub { owner = "sharkdp"; - repo = pname; - rev = "v${version}"; - hash = "sha256-di7SBuB4LsnqlP3BdMcsSLj4zpyKA/ninVpRyR9AJaI="; + repo = "hexyl"; + rev = "refs/tags/v${version}"; + hash = "sha256-v/mB0W/AyoJSoK00pqxpfMGZR/4DkkTCnPU6eorl/GI="; }; - cargoHash = "sha256-fXrdOiCmRgMPJxZIS/SkTkZZkag8ZUhNnMlU4k1m/+0="; + cargoHash = "sha256-QaOp7dCXfkIpxAJ+J+Pt9op3uj+LYoYvR78BmHBgnqE="; meta = with lib; { description = "Command-line hex viewer"; From 8e8ae12610acb7f349626e44adb392223df1cc11 Mon Sep 17 00:00:00 2001 From: nartsisss Date: Wed, 30 Oct 2024 01:52:53 +0300 Subject: [PATCH 16/57] hexyl: move to pkgs/by-name --- .../misc/hexyl/default.nix => by-name/he/hexyl/package.nix} | 0 pkgs/top-level/all-packages.nix | 2 -- 2 files changed, 2 deletions(-) rename pkgs/{tools/misc/hexyl/default.nix => by-name/he/hexyl/package.nix} (100%) diff --git a/pkgs/tools/misc/hexyl/default.nix b/pkgs/by-name/he/hexyl/package.nix similarity index 100% rename from pkgs/tools/misc/hexyl/default.nix rename to pkgs/by-name/he/hexyl/package.nix diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index 4a5d3b090784..2b2eb8aa4b4b 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -5161,8 +5161,6 @@ with pkgs; hexio = callPackage ../development/tools/hexio { }; - hexyl = callPackage ../tools/misc/hexyl { }; - hid-listen = callPackage ../tools/misc/hid-listen { }; hid-tools = callPackage ../tools/misc/hid-tools { }; From 2b0a205c955e20b888c38b5db0c156ae04e30723 Mon Sep 17 00:00:00 2001 From: nartsisss Date: Wed, 30 Oct 2024 01:54:34 +0300 Subject: [PATCH 17/57] hexyl: refactor meta, format with nixfmt-rfc-style --- pkgs/by-name/he/hexyl/package.nix | 19 +++++++++++++++---- 1 file changed, 15 insertions(+), 4 deletions(-) diff --git a/pkgs/by-name/he/hexyl/package.nix b/pkgs/by-name/he/hexyl/package.nix index e8be44162b7a..715d8ba6f238 100644 --- a/pkgs/by-name/he/hexyl/package.nix +++ b/pkgs/by-name/he/hexyl/package.nix @@ -1,4 +1,8 @@ -{ lib, rustPlatform, fetchFromGitHub }: +{ + lib, + rustPlatform, + fetchFromGitHub, +}: rustPlatform.buildRustPackage rec { pname = "hexyl"; @@ -13,7 +17,7 @@ rustPlatform.buildRustPackage rec { cargoHash = "sha256-QaOp7dCXfkIpxAJ+J+Pt9op3uj+LYoYvR78BmHBgnqE="; - meta = with lib; { + meta = { description = "Command-line hex viewer"; longDescription = '' `hexyl` is a simple hex viewer for the terminal. It uses a colored @@ -23,8 +27,15 @@ rustPlatform.buildRustPackage rec { ''; homepage = "https://github.com/sharkdp/hexyl"; changelog = "https://github.com/sharkdp/hexyl/blob/v${version}/CHANGELOG.md"; - license = with licenses; [ asl20 /* or */ mit ]; - maintainers = with maintainers; [ dywedir figsoda SuperSandro2000 ]; + license = with lib.licenses; [ + asl20 + mit + ]; + maintainers = with lib.maintainers; [ + dywedir + figsoda + SuperSandro2000 + ]; mainProgram = "hexyl"; }; } From 8c1e22f0d035ae5aa03eaae712cc5f0ec2459586 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Wed, 30 Oct 2024 01:20:46 +0000 Subject: [PATCH 18/57] gremlin-console: 3.7.2 -> 3.7.3 --- pkgs/applications/misc/gremlin-console/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/applications/misc/gremlin-console/default.nix b/pkgs/applications/misc/gremlin-console/default.nix index eccb7df29166..9024589c297a 100644 --- a/pkgs/applications/misc/gremlin-console/default.nix +++ b/pkgs/applications/misc/gremlin-console/default.nix @@ -2,10 +2,10 @@ stdenv.mkDerivation rec { pname = "gremlin-console"; - version = "3.7.2"; + version = "3.7.3"; src = fetchzip { url = "https://downloads.apache.org/tinkerpop/${version}/apache-tinkerpop-gremlin-console-${version}-bin.zip"; - sha256 = "sha256-lIrqMvI/sYGu36X3jNptoIz7mPVomk8YCIR/6y8mpEc="; + sha256 = "sha256-27S1ukq9rHncFuPBZmwIP/bKuPYm3AxdBK3PliYTGEQ="; }; nativeBuildInputs = [ makeWrapper ]; From 093551c82109b99862f7548cd6471682556fcb74 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Wed, 30 Oct 2024 04:30:30 +0000 Subject: [PATCH 19/57] python312Packages.jupyterlab-git: 0.50.1 -> 0.50.2 --- pkgs/development/python-modules/jupyterlab-git/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/python-modules/jupyterlab-git/default.nix b/pkgs/development/python-modules/jupyterlab-git/default.nix index c539c052d4b5..1ab347130ae1 100644 --- a/pkgs/development/python-modules/jupyterlab-git/default.nix +++ b/pkgs/development/python-modules/jupyterlab-git/default.nix @@ -21,7 +21,7 @@ buildPythonPackage rec { pname = "jupyterlab-git"; - version = "0.50.1"; + version = "0.50.2"; pyproject = true; disabled = pythonOlder "3.8"; @@ -29,7 +29,7 @@ buildPythonPackage rec { src = fetchPypi { pname = "jupyterlab_git"; inherit version; - hash = "sha256-v08Go/vCsquE6l1SMmqg4LjM9OmjNX+jGKEZVg4cak0="; + hash = "sha256-zu/chWMsr0maBItDRFnQO15iFmWAHp23GXvUhvXTNDM="; }; nativeBuildInputs = [ From 0944fc3af9e6624c44ceeffa38f426386d9e620b Mon Sep 17 00:00:00 2001 From: Tomo Date: Wed, 30 Oct 2024 05:46:00 +0000 Subject: [PATCH 20/57] armitage: patch for Gradle 8 Only one more Gradle 6 usage left to go! --- pkgs/by-name/ar/armitage/gradle-8.patch | 28 +++++++++++++++++++++++++ pkgs/by-name/ar/armitage/package.nix | 6 +++--- 2 files changed, 31 insertions(+), 3 deletions(-) create mode 100644 pkgs/by-name/ar/armitage/gradle-8.patch diff --git a/pkgs/by-name/ar/armitage/gradle-8.patch b/pkgs/by-name/ar/armitage/gradle-8.patch new file mode 100644 index 000000000000..43dcc358f9a9 --- /dev/null +++ b/pkgs/by-name/ar/armitage/gradle-8.patch @@ -0,0 +1,28 @@ +Upstream PR: https://github.com/r00t0v3rr1d3/armitage/pull/1 +diff --git a/armitage/build.gradle b/armitage/build.gradle +index 43a5d08..50ae084 100644 +--- a/armitage/build.gradle ++++ b/armitage/build.gradle +@@ -19,7 +19,7 @@ jar { + from { + configurations.compileClasspath.filter { it.exists() }.collect { it.isDirectory() ? it : zipTree(it) } + } +- archiveName 'armitage.jar' ++ archiveFileName.set 'armitage.jar' + } + + dependencies { +diff --git a/cortana/build.gradle b/cortana/build.gradle +index c7d08bb..aa54635 100644 +--- a/cortana/build.gradle ++++ b/cortana/build.gradle +@@ -19,7 +19,8 @@ jar { + from { + configurations.compileClasspath.filter { it.exists() }.collect { it.isDirectory() ? it : zipTree(it) } + } +- archiveName 'cortana.jar' ++ duplicatesStrategy DuplicatesStrategy.INCLUDE ++ archiveFileName.set 'cortana.jar' + } + + dependencies { diff --git a/pkgs/by-name/ar/armitage/package.nix b/pkgs/by-name/ar/armitage/package.nix index 7d704633a360..0fc8455b4f87 100644 --- a/pkgs/by-name/ar/armitage/package.nix +++ b/pkgs/by-name/ar/armitage/package.nix @@ -3,7 +3,7 @@ , fetchurl , fetchFromGitHub , jdk11 -, gradle_6 +, gradle , metasploit , makeWrapper , makeDesktopItem @@ -15,8 +15,6 @@ let pname = "armitage"; version = "unstable-2022-12-05"; - gradle = gradle_6; - src = fetchFromGitHub { owner = "r00t0v3rr1d3"; repo = "armitage"; @@ -45,6 +43,8 @@ let url = "https://gitlab.com/kalilinux/packages/armitage/-/raw/042beb7494a10227761ecb3ddabf4019bbb78681/debian/patches/fix-meterpreter.patch"; hash = "sha256-p4fs5xFdC2apW0U8x8u9S4p5gq3Eiv+0E4CGccQZYKY="; }) + # Update for Gradle 8 (https://github.com/r00t0v3rr1d3/armitage/pull/1) + ./gradle-8.patch ]; in From 727b17fed097f332332ebd94075ebd9670dc9654 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= Date: Wed, 23 Oct 2024 19:16:55 +0200 Subject: [PATCH 21/57] nix: fix macOS sandbox escape via builtin builders fixes https://github.com/NixOS/nix/security/advisories/GHSA-wf4c-57rh-9pjg --- pkgs/tools/package-management/nix/common.nix | 4 + pkgs/tools/package-management/nix/default.nix | 51 +++ ...vation-builders-inside-the-sandbox-o.patch | 315 +++++++++++++++++ ...-goal-Print-sandbox-error-detail-on-.patch | 34 ++ .../0003-local-derivation-goal-Refactor.patch | 41 +++ ...-goal-Move-builder-preparation-to-no.patch | 75 ++++ ...vation-builders-inside-the-sandbox-o.patch | 312 +++++++++++++++++ ...-goal-Print-sandbox-error-detail-on-.patch | 34 ++ .../0003-local-derivation-goal-Refactor.patch | 41 +++ ...-goal-Move-builder-preparation-to-no.patch | 75 ++++ ...vation-builders-inside-the-sandbox-o.patch | 320 +++++++++++++++++ ...-goal-Print-sandbox-error-detail-on-.patch | 34 ++ .../0003-local-derivation-goal-Refactor.patch | 41 +++ ...-goal-Move-builder-preparation-to-no.patch | 75 ++++ ...vation-builders-inside-the-sandbox-o.patch | 320 +++++++++++++++++ ...-goal-Print-sandbox-error-detail-on-.patch | 34 ++ .../0003-local-derivation-goal-Refactor.patch | 41 +++ ...-goal-Move-builder-preparation-to-no.patch | 75 ++++ ...vation-builders-inside-the-sandbox-o.patch | 327 ++++++++++++++++++ ...-goal-Print-sandbox-error-detail-on-.patch | 34 ++ .../0003-local-derivation-goal-Refactor.patch | 41 +++ ...-goal-Move-builder-preparation-to-no.patch | 75 ++++ ...vation-builders-inside-the-sandbox-o.patch | 323 +++++++++++++++++ ...-goal-Print-sandbox-error-detail-on-.patch | 34 ++ .../0003-local-derivation-goal-Refactor.patch | 41 +++ ...-goal-Move-builder-preparation-to-no.patch | 75 ++++ ...vation-builders-inside-the-sandbox-o.patch | 323 +++++++++++++++++ ...ckaging-Add-darwin-lsandbox-in-meson.patch | 53 +++ ...-goal-Print-sandbox-error-detail-on-.patch | 34 ++ .../0004-local-derivation-goal-Refactor.patch | 41 +++ ...-goal-Move-builder-preparation-to-no.patch | 75 ++++ .../git/0001-Fix-meson-build-on-darwin.patch | 28 ++ ...vation-builders-inside-the-sandbox-o.patch | 323 +++++++++++++++++ ...ckaging-Add-darwin-lsandbox-in-meson.patch | 53 +++ ...-goal-Print-sandbox-error-detail-on-.patch | 34 ++ .../0005-local-derivation-goal-Refactor.patch | 41 +++ ...-goal-Move-builder-preparation-to-no.patch | 75 ++++ 37 files changed, 3952 insertions(+) create mode 100644 pkgs/tools/package-management/nix/patches/2_18/0001-fix-Run-all-derivation-builders-inside-the-sandbox-o.patch create mode 100644 pkgs/tools/package-management/nix/patches/2_18/0002-local-derivation-goal-Print-sandbox-error-detail-on-.patch create mode 100644 pkgs/tools/package-management/nix/patches/2_18/0003-local-derivation-goal-Refactor.patch create mode 100644 pkgs/tools/package-management/nix/patches/2_18/0004-local-derivation-goal-Move-builder-preparation-to-no.patch create mode 100644 pkgs/tools/package-management/nix/patches/2_19/0001-fix-Run-all-derivation-builders-inside-the-sandbox-o.patch create mode 100644 pkgs/tools/package-management/nix/patches/2_19/0002-local-derivation-goal-Print-sandbox-error-detail-on-.patch create mode 100644 pkgs/tools/package-management/nix/patches/2_19/0003-local-derivation-goal-Refactor.patch create mode 100644 pkgs/tools/package-management/nix/patches/2_19/0004-local-derivation-goal-Move-builder-preparation-to-no.patch create mode 100644 pkgs/tools/package-management/nix/patches/2_20/0001-fix-Run-all-derivation-builders-inside-the-sandbox-o.patch create mode 100644 pkgs/tools/package-management/nix/patches/2_20/0002-local-derivation-goal-Print-sandbox-error-detail-on-.patch create mode 100644 pkgs/tools/package-management/nix/patches/2_20/0003-local-derivation-goal-Refactor.patch create mode 100644 pkgs/tools/package-management/nix/patches/2_20/0004-local-derivation-goal-Move-builder-preparation-to-no.patch create mode 100644 pkgs/tools/package-management/nix/patches/2_21/0001-fix-Run-all-derivation-builders-inside-the-sandbox-o.patch create mode 100644 pkgs/tools/package-management/nix/patches/2_21/0002-local-derivation-goal-Print-sandbox-error-detail-on-.patch create mode 100644 pkgs/tools/package-management/nix/patches/2_21/0003-local-derivation-goal-Refactor.patch create mode 100644 pkgs/tools/package-management/nix/patches/2_21/0004-local-derivation-goal-Move-builder-preparation-to-no.patch create mode 100644 pkgs/tools/package-management/nix/patches/2_22/0001-fix-Run-all-derivation-builders-inside-the-sandbox-o.patch create mode 100644 pkgs/tools/package-management/nix/patches/2_22/0002-local-derivation-goal-Print-sandbox-error-detail-on-.patch create mode 100644 pkgs/tools/package-management/nix/patches/2_22/0003-local-derivation-goal-Refactor.patch create mode 100644 pkgs/tools/package-management/nix/patches/2_22/0004-local-derivation-goal-Move-builder-preparation-to-no.patch create mode 100644 pkgs/tools/package-management/nix/patches/2_23/0001-fix-Run-all-derivation-builders-inside-the-sandbox-o.patch create mode 100644 pkgs/tools/package-management/nix/patches/2_23/0002-local-derivation-goal-Print-sandbox-error-detail-on-.patch create mode 100644 pkgs/tools/package-management/nix/patches/2_23/0003-local-derivation-goal-Refactor.patch create mode 100644 pkgs/tools/package-management/nix/patches/2_23/0004-local-derivation-goal-Move-builder-preparation-to-no.patch create mode 100644 pkgs/tools/package-management/nix/patches/2_24/0001-fix-Run-all-derivation-builders-inside-the-sandbox-o.patch create mode 100644 pkgs/tools/package-management/nix/patches/2_24/0002-packaging-Add-darwin-lsandbox-in-meson.patch create mode 100644 pkgs/tools/package-management/nix/patches/2_24/0003-local-derivation-goal-Print-sandbox-error-detail-on-.patch create mode 100644 pkgs/tools/package-management/nix/patches/2_24/0004-local-derivation-goal-Refactor.patch create mode 100644 pkgs/tools/package-management/nix/patches/2_24/0005-local-derivation-goal-Move-builder-preparation-to-no.patch create mode 100644 pkgs/tools/package-management/nix/patches/git/0001-Fix-meson-build-on-darwin.patch create mode 100644 pkgs/tools/package-management/nix/patches/git/0002-fix-Run-all-derivation-builders-inside-the-sandbox-o.patch create mode 100644 pkgs/tools/package-management/nix/patches/git/0003-packaging-Add-darwin-lsandbox-in-meson.patch create mode 100644 pkgs/tools/package-management/nix/patches/git/0004-local-derivation-goal-Print-sandbox-error-detail-on-.patch create mode 100644 pkgs/tools/package-management/nix/patches/git/0005-local-derivation-goal-Refactor.patch create mode 100644 pkgs/tools/package-management/nix/patches/git/0006-local-derivation-goal-Move-builder-preparation-to-no.patch diff --git a/pkgs/tools/package-management/nix/common.nix b/pkgs/tools/package-management/nix/common.nix index 4d04cbb6274d..07e58a41e400 100644 --- a/pkgs/tools/package-management/nix/common.nix +++ b/pkgs/tools/package-management/nix/common.nix @@ -16,6 +16,7 @@ let atLeast210 = lib.versionAtLeast version "2.10pre"; atLeast213 = lib.versionAtLeast version "2.13pre"; atLeast214 = lib.versionAtLeast version "2.14pre"; + atLeast218 = lib.versionAtLeast version "2.18pre"; atLeast219 = lib.versionAtLeast version "2.19pre"; atLeast220 = lib.versionAtLeast version "2.20pre"; atLeast221 = lib.versionAtLeast version "2.21pre"; @@ -42,6 +43,7 @@ in , callPackage , coreutils , curl +, darwin , docbook_xsl_ns , docbook5 , editline @@ -158,6 +160,8 @@ self = stdenv.mkDerivation { libseccomp ] ++ lib.optionals withAWS [ aws-sdk-cpp + ] ++ lib.optional (atLeast218 && stdenv.hostPlatform.isDarwin) [ + darwin.apple_sdk.libs.sandbox ]; diff --git a/pkgs/tools/package-management/nix/default.nix b/pkgs/tools/package-management/nix/default.nix index adfa793f1d35..377dbc43a288 100644 --- a/pkgs/tools/package-management/nix/default.nix +++ b/pkgs/tools/package-management/nix/default.nix @@ -178,42 +178,85 @@ in lib.makeExtensible (self: ({ version = "2.18.8"; hash = "sha256-0rHRifdjzzxMh/im8pRx6XoY62irDTDUes+Pn0CR65I="; self_attribute_name = "nix_2_18"; + patches = [ + ./patches/2_18/0001-fix-Run-all-derivation-builders-inside-the-sandbox-o.patch + ./patches/2_18/0002-local-derivation-goal-Print-sandbox-error-detail-on-.patch + ./patches/2_18/0003-local-derivation-goal-Refactor.patch + ./patches/2_18/0004-local-derivation-goal-Move-builder-preparation-to-no.patch + ]; }; nix_2_19 = common { version = "2.19.6"; hash = "sha256-XT5xiwOLgXf+TdyOjbJVOl992wu9mBO25WXHoyli/Tk="; self_attribute_name = "nix_2_19"; + patches = [ + ./patches/2_19/0001-fix-Run-all-derivation-builders-inside-the-sandbox-o.patch + ./patches/2_19/0002-local-derivation-goal-Print-sandbox-error-detail-on-.patch + ./patches/2_19/0003-local-derivation-goal-Refactor.patch + ./patches/2_19/0004-local-derivation-goal-Move-builder-preparation-to-no.patch + ]; }; nix_2_20 = common { version = "2.20.8"; hash = "sha256-M2tkMtjKi8LDdNLsKi3IvD8oY/i3rtarjMpvhybS3WY="; self_attribute_name = "nix_2_20"; + patches = [ + ./patches/2_20/0001-fix-Run-all-derivation-builders-inside-the-sandbox-o.patch + ./patches/2_20/0002-local-derivation-goal-Print-sandbox-error-detail-on-.patch + ./patches/2_20/0003-local-derivation-goal-Refactor.patch + ./patches/2_20/0004-local-derivation-goal-Move-builder-preparation-to-no.patch + ]; }; nix_2_21 = common { version = "2.21.4"; hash = "sha256-c6nVZ0pSrfhFX3eVKqayS+ioqyAGp3zG9ZPO5rkXFRQ="; self_attribute_name = "nix_2_21"; + patches = [ + ./patches/2_21/0001-fix-Run-all-derivation-builders-inside-the-sandbox-o.patch + ./patches/2_21/0002-local-derivation-goal-Print-sandbox-error-detail-on-.patch + ./patches/2_21/0003-local-derivation-goal-Refactor.patch + ./patches/2_21/0004-local-derivation-goal-Move-builder-preparation-to-no.patch + ]; }; nix_2_22 = common { version = "2.22.3"; hash = "sha256-l04csH5rTWsK7eXPWVxJBUVRPMZXllFoSkYFTq/i8WU="; self_attribute_name = "nix_2_22"; + patches = [ + ./patches/2_22/0001-fix-Run-all-derivation-builders-inside-the-sandbox-o.patch + ./patches/2_22/0002-local-derivation-goal-Print-sandbox-error-detail-on-.patch + ./patches/2_22/0003-local-derivation-goal-Refactor.patch + ./patches/2_22/0004-local-derivation-goal-Move-builder-preparation-to-no.patch + ]; }; nix_2_23 = common { version = "2.23.3"; hash = "sha256-lAoLGVIhRFrfgv7wcyduEkyc83QKrtsfsq4of+WrBeg="; self_attribute_name = "nix_2_23"; + patches = [ + ./patches/2_23/0001-fix-Run-all-derivation-builders-inside-the-sandbox-o.patch + ./patches/2_23/0002-local-derivation-goal-Print-sandbox-error-detail-on-.patch + ./patches/2_23/0003-local-derivation-goal-Refactor.patch + ./patches/2_23/0004-local-derivation-goal-Move-builder-preparation-to-no.patch + ]; }; nix_2_24 = (common { version = "2.24.9"; hash = "sha256-OwJByTdCz1t91ysBqynK+ifszkoIGEXUn6HE2t82+c8="; self_attribute_name = "nix_2_24"; + patches = [ + ./patches/2_24/0001-fix-Run-all-derivation-builders-inside-the-sandbox-o.patch + ./patches/2_24/0002-packaging-Add-darwin-lsandbox-in-meson.patch + ./patches/2_24/0003-local-derivation-goal-Print-sandbox-error-detail-on-.patch + ./patches/2_24/0004-local-derivation-goal-Refactor.patch + ./patches/2_24/0005-local-derivation-goal-Move-builder-preparation-to-no.patch + ]; }).override (lib.optionalAttrs (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86_64) { # Fix the following error with the default x86_64-darwin SDK: # @@ -234,6 +277,14 @@ in lib.makeExtensible (self: ({ rev = "ca3fc1693b309ab6b8b0c09408a08d0055bf0363"; hash = "sha256-Hp7dkx7zfB9a4l5QusXUob0b1T2qdZ23LFo5dcp3xrU="; }; + patches = [ + ./patches/git/0001-Fix-meson-build-on-darwin.patch + ./patches/git/0002-fix-Run-all-derivation-builders-inside-the-sandbox-o.patch + ./patches/git/0003-packaging-Add-darwin-lsandbox-in-meson.patch + ./patches/git/0004-local-derivation-goal-Print-sandbox-error-detail-on-.patch + ./patches/git/0005-local-derivation-goal-Refactor.patch + ./patches/git/0006-local-derivation-goal-Move-builder-preparation-to-no.patch + ]; self_attribute_name = "git"; }).override (lib.optionalAttrs (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86_64) { # Fix the following error with the default x86_64-darwin SDK: diff --git a/pkgs/tools/package-management/nix/patches/2_18/0001-fix-Run-all-derivation-builders-inside-the-sandbox-o.patch b/pkgs/tools/package-management/nix/patches/2_18/0001-fix-Run-all-derivation-builders-inside-the-sandbox-o.patch new file mode 100644 index 000000000000..c13844f8bdd7 --- /dev/null +++ b/pkgs/tools/package-management/nix/patches/2_18/0001-fix-Run-all-derivation-builders-inside-the-sandbox-o.patch @@ -0,0 +1,315 @@ +From 3c4bc6929eb13cf648c54931a28797bb1c289052 Mon Sep 17 00:00:00 2001 +From: Puck Meerburg +Date: Fri, 1 Mar 2024 11:42:24 -0500 +Subject: [PATCH 1/4] fix: Run all derivation builders inside the sandbox on + macOS +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Signed-off-by: Jörg Thalheim +--- + configure.ac | 6 +- + flake.nix | 1 + + src/libstore/build/local-derivation-goal.cc | 221 ++++++++++---------- + 3 files changed, 114 insertions(+), 114 deletions(-) + +diff --git a/configure.ac b/configure.ac +index 4e50d0913..44852ad79 100644 +--- a/configure.ac ++++ b/configure.ac +@@ -58,13 +58,17 @@ AC_CHECK_TOOL([AR], [ar]) + AC_SYS_LARGEFILE + + +-# Solaris-specific stuff. ++# OS-specific stuff. + AC_STRUCT_DIRENT_D_TYPE + case "$host_os" in + solaris*) + # Solaris requires -lsocket -lnsl for network functions + LDFLAGS="-lsocket -lnsl $LDFLAGS" + ;; ++ darwin*) ++ # Need to link to libsandbox. ++ LDFLAGS="-lsandbox $LDFLAGS" ++ ;; + esac + + +diff --git a/flake.nix b/flake.nix +index 6c9bef4d8..66ac1bfd8 100644 +--- a/flake.nix ++++ b/flake.nix +@@ -173,6 +173,7 @@ + boost + lowdown-nix + ] ++ ++ lib.optionals stdenv.isDarwin [darwin.apple_sdk.libs.sandbox] + ++ lib.optionals stdenv.isLinux [(libseccomp.overrideAttrs (_: rec { + version = "2.5.5"; + src = fetchurl { +diff --git a/src/libstore/build/local-derivation-goal.cc b/src/libstore/build/local-derivation-goal.cc +index 4d690beaf..fb83cfdc7 100644 +--- a/src/libstore/build/local-derivation-goal.cc ++++ b/src/libstore/build/local-derivation-goal.cc +@@ -53,6 +53,10 @@ + #if __APPLE__ + #include + #include ++#include ++ ++/* This definition is undocumented but depended upon by all major browsers. */ ++extern "C" int sandbox_init_with_parameters(const char *profile, uint64_t flags, const char *const parameters[], char **errorbuf); + #endif + + #include +@@ -2034,141 +2038,132 @@ void LocalDerivationGoal::runChild() + + std::string builder = "invalid"; + +- if (drv->isBuiltin()) { +- ; +- } + #if __APPLE__ +- else { +- /* This has to appear before import statements. */ +- std::string sandboxProfile = "(version 1)\n"; +- +- if (useChroot) { +- +- /* Lots and lots and lots of file functions freak out if they can't stat their full ancestry */ +- PathSet ancestry; +- +- /* We build the ancestry before adding all inputPaths to the store because we know they'll +- all have the same parents (the store), and there might be lots of inputs. This isn't +- particularly efficient... I doubt it'll be a bottleneck in practice */ +- for (auto & i : dirsInChroot) { +- Path cur = i.first; +- while (cur.compare("/") != 0) { +- cur = dirOf(cur); +- ancestry.insert(cur); +- } +- } ++ /* This has to appear before import statements. */ ++ std::string sandboxProfile = "(version 1)\n"; + +- /* And we want the store in there regardless of how empty dirsInChroot. We include the innermost +- path component this time, since it's typically /nix/store and we care about that. */ +- Path cur = worker.store.storeDir; ++ if (useChroot) { ++ ++ /* Lots and lots and lots of file functions freak out if they can't stat their full ancestry */ ++ PathSet ancestry; ++ ++ /* We build the ancestry before adding all inputPaths to the store because we know they'll ++ all have the same parents (the store), and there might be lots of inputs. This isn't ++ particularly efficient... I doubt it'll be a bottleneck in practice */ ++ for (auto & i : dirsInChroot) { ++ Path cur = i.first; + while (cur.compare("/") != 0) { +- ancestry.insert(cur); + cur = dirOf(cur); ++ ancestry.insert(cur); + } ++ } + +- /* Add all our input paths to the chroot */ +- for (auto & i : inputPaths) { +- auto p = worker.store.printStorePath(i); +- dirsInChroot[p] = p; +- } +- +- /* Violations will go to the syslog if you set this. Unfortunately the destination does not appear to be configurable */ +- if (settings.darwinLogSandboxViolations) { +- sandboxProfile += "(deny default)\n"; +- } else { +- sandboxProfile += "(deny default (with no-log))\n"; +- } ++ /* And we want the store in there regardless of how empty dirsInChroot. We include the innermost ++ path component this time, since it's typically /nix/store and we care about that. */ ++ Path cur = worker.store.storeDir; ++ while (cur.compare("/") != 0) { ++ ancestry.insert(cur); ++ cur = dirOf(cur); ++ } + +- sandboxProfile += +- #include "sandbox-defaults.sb" +- ; ++ /* Add all our input paths to the chroot */ ++ for (auto & i : inputPaths) { ++ auto p = worker.store.printStorePath(i); ++ dirsInChroot[p] = p; ++ } + +- if (!derivationType->isSandboxed()) +- sandboxProfile += +- #include "sandbox-network.sb" +- ; +- +- /* Add the output paths we'll use at build-time to the chroot */ +- sandboxProfile += "(allow file-read* file-write* process-exec\n"; +- for (auto & [_, path] : scratchOutputs) +- sandboxProfile += fmt("\t(subpath \"%s\")\n", worker.store.printStorePath(path)); +- +- sandboxProfile += ")\n"; +- +- /* Our inputs (transitive dependencies and any impurities computed above) +- +- without file-write* allowed, access() incorrectly returns EPERM +- */ +- sandboxProfile += "(allow file-read* file-write* process-exec\n"; +- for (auto & i : dirsInChroot) { +- if (i.first != i.second.source) +- throw Error( +- "can't map '%1%' to '%2%': mismatched impure paths not supported on Darwin", +- i.first, i.second.source); +- +- std::string path = i.first; +- struct stat st; +- if (lstat(path.c_str(), &st)) { +- if (i.second.optional && errno == ENOENT) +- continue; +- throw SysError("getting attributes of path '%s", path); +- } +- if (S_ISDIR(st.st_mode)) +- sandboxProfile += fmt("\t(subpath \"%s\")\n", path); +- else +- sandboxProfile += fmt("\t(literal \"%s\")\n", path); +- } +- sandboxProfile += ")\n"; ++ /* Violations will go to the syslog if you set this. Unfortunately the destination does not appear to be configurable */ ++ if (settings.darwinLogSandboxViolations) { ++ sandboxProfile += "(deny default)\n"; ++ } else { ++ sandboxProfile += "(deny default (with no-log))\n"; ++ } + +- /* Allow file-read* on full directory hierarchy to self. Allows realpath() */ +- sandboxProfile += "(allow file-read*\n"; +- for (auto & i : ancestry) { +- sandboxProfile += fmt("\t(literal \"%s\")\n", i); +- } +- sandboxProfile += ")\n"; ++ sandboxProfile += ++ #include "sandbox-defaults.sb" ++ ; + +- sandboxProfile += additionalSandboxProfile; +- } else ++ if (!derivationType->isSandboxed()) + sandboxProfile += +- #include "sandbox-minimal.sb" ++ #include "sandbox-network.sb" + ; + +- debug("Generated sandbox profile:"); +- debug(sandboxProfile); ++ /* Add the output paths we'll use at build-time to the chroot */ ++ sandboxProfile += "(allow file-read* file-write* process-exec\n"; ++ for (auto & [_, path] : scratchOutputs) ++ sandboxProfile += fmt("\t(subpath \"%s\")\n", worker.store.printStorePath(path)); + +- Path sandboxFile = tmpDir + "/.sandbox.sb"; ++ sandboxProfile += ")\n"; + +- writeFile(sandboxFile, sandboxProfile); ++ /* Our inputs (transitive dependencies and any impurities computed above) + +- bool allowLocalNetworking = parsedDrv->getBoolAttr("__darwinAllowLocalNetworking"); ++ without file-write* allowed, access() incorrectly returns EPERM ++ */ ++ sandboxProfile += "(allow file-read* file-write* process-exec\n"; ++ for (auto & i : dirsInChroot) { ++ if (i.first != i.second.source) ++ throw Error( ++ "can't map '%1%' to '%2%': mismatched impure paths not supported on Darwin", ++ i.first, i.second.source); + +- /* The tmpDir in scope points at the temporary build directory for our derivation. Some packages try different mechanisms +- to find temporary directories, so we want to open up a broader place for them to dump their files, if needed. */ +- Path globalTmpDir = canonPath(defaultTempDir(), true); ++ std::string path = i.first; ++ struct stat st; ++ if (lstat(path.c_str(), &st)) { ++ if (i.second.optional && errno == ENOENT) ++ continue; ++ throw SysError("getting attributes of path '%s", path); ++ } ++ if (S_ISDIR(st.st_mode)) ++ sandboxProfile += fmt("\t(subpath \"%s\")\n", path); ++ else ++ sandboxProfile += fmt("\t(literal \"%s\")\n", path); ++ } ++ sandboxProfile += ")\n"; + +- /* They don't like trailing slashes on subpath directives */ +- while (!globalTmpDir.empty() && globalTmpDir.back() == '/') +- globalTmpDir.pop_back(); ++ /* Allow file-read* on full directory hierarchy to self. Allows realpath() */ ++ sandboxProfile += "(allow file-read*\n"; ++ for (auto & i : ancestry) { ++ sandboxProfile += fmt("\t(literal \"%s\")\n", i); ++ } ++ sandboxProfile += ")\n"; + +- if (getEnv("_NIX_TEST_NO_SANDBOX") != "1") { +- builder = "/usr/bin/sandbox-exec"; +- args.push_back("sandbox-exec"); +- args.push_back("-f"); +- args.push_back(sandboxFile); +- args.push_back("-D"); +- args.push_back("_GLOBAL_TMP_DIR=" + globalTmpDir); +- if (allowLocalNetworking) { +- args.push_back("-D"); +- args.push_back(std::string("_ALLOW_LOCAL_NETWORKING=1")); +- } +- args.push_back(drv->builder); +- } else { +- builder = drv->builder; +- args.push_back(std::string(baseNameOf(drv->builder))); ++ sandboxProfile += additionalSandboxProfile; ++ } else ++ sandboxProfile += ++ #include "sandbox-minimal.sb" ++ ; ++ ++ debug("Generated sandbox profile:"); ++ debug(sandboxProfile); ++ ++ bool allowLocalNetworking = parsedDrv->getBoolAttr("__darwinAllowLocalNetworking"); ++ ++ /* The tmpDir in scope points at the temporary build directory for our derivation. Some packages try different mechanisms ++ to find temporary directories, so we want to open up a broader place for them to dump their files, if needed. */ ++ Path globalTmpDir = canonPath(defaultTempDir(), true); ++ ++ /* They don't like trailing slashes on subpath directives */ ++ while (!globalTmpDir.empty() && globalTmpDir.back() == '/') ++ globalTmpDir.pop_back(); ++ ++ if (getEnv("_NIX_TEST_NO_SANDBOX") != "1") { ++ Strings sandboxArgs; ++ sandboxArgs.push_back("_GLOBAL_TMP_DIR"); ++ sandboxArgs.push_back(globalTmpDir); ++ if (allowLocalNetworking) { ++ sandboxArgs.push_back("_ALLOW_LOCAL_NETWORKING"); ++ sandboxArgs.push_back("1"); ++ } ++ if (sandbox_init_with_parameters(sandboxProfile.c_str(), 0, stringsToCharPtrs(sandboxArgs).data(), NULL)) { ++ writeFull(STDERR_FILENO, "failed to configure sandbox\n"); ++ _exit(1); + } + } ++ ++ builder = drv->builder; ++ args.push_back(std::string(baseNameOf(drv->builder))); + #else +- else { ++ if (!drv->isBuiltin()) { + builder = drv->builder; + args.push_back(std::string(baseNameOf(drv->builder))); + } +-- +2.46.1 + diff --git a/pkgs/tools/package-management/nix/patches/2_18/0002-local-derivation-goal-Print-sandbox-error-detail-on-.patch b/pkgs/tools/package-management/nix/patches/2_18/0002-local-derivation-goal-Print-sandbox-error-detail-on-.patch new file mode 100644 index 000000000000..a3bc4f05cdaf --- /dev/null +++ b/pkgs/tools/package-management/nix/patches/2_18/0002-local-derivation-goal-Print-sandbox-error-detail-on-.patch @@ -0,0 +1,34 @@ +From 4ac099d6ab4b6851aeb8b7a1e37f5794716d5138 Mon Sep 17 00:00:00 2001 +From: Robert Hensing +Date: Thu, 3 Oct 2024 12:44:12 +0200 +Subject: [PATCH 2/4] local-derivation-goal: Print sandbox error detail on + darwin +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Co-Authored-By: Théophane Hufschmitt +Signed-off-by: Jörg Thalheim +--- + src/libstore/build/local-derivation-goal.cc | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/src/libstore/build/local-derivation-goal.cc b/src/libstore/build/local-derivation-goal.cc +index fb83cfdc7..d41d1c1e5 100644 +--- a/src/libstore/build/local-derivation-goal.cc ++++ b/src/libstore/build/local-derivation-goal.cc +@@ -2154,8 +2154,9 @@ void LocalDerivationGoal::runChild() + sandboxArgs.push_back("_ALLOW_LOCAL_NETWORKING"); + sandboxArgs.push_back("1"); + } +- if (sandbox_init_with_parameters(sandboxProfile.c_str(), 0, stringsToCharPtrs(sandboxArgs).data(), NULL)) { +- writeFull(STDERR_FILENO, "failed to configure sandbox\n"); ++ char * sandbox_errbuf = nullptr; ++ if (sandbox_init_with_parameters(sandboxProfile.c_str(), 0, stringsToCharPtrs(sandboxArgs).data(), &sandbox_errbuf)) { ++ writeFull(STDERR_FILENO, fmt("failed to configure sandbox: %s\n", sandbox_errbuf ? sandbox_errbuf : "(null)")); + _exit(1); + } + } +-- +2.46.1 + diff --git a/pkgs/tools/package-management/nix/patches/2_18/0003-local-derivation-goal-Refactor.patch b/pkgs/tools/package-management/nix/patches/2_18/0003-local-derivation-goal-Refactor.patch new file mode 100644 index 000000000000..81997405a5f7 --- /dev/null +++ b/pkgs/tools/package-management/nix/patches/2_18/0003-local-derivation-goal-Refactor.patch @@ -0,0 +1,41 @@ +From 6fe3a5e26def808b99856099d74aa3017ecf6d9d Mon Sep 17 00:00:00 2001 +From: Robert Hensing +Date: Thu, 3 Oct 2024 12:50:27 +0200 +Subject: [PATCH 3/4] local-derivation-goal: Refactor +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +This works because the `builder` and `args` variables are only used +in the non-builtin code path. + +Co-Authored-By: Théophane Hufschmitt +Signed-off-by: Jörg Thalheim +--- + src/libstore/build/local-derivation-goal.cc | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +diff --git a/src/libstore/build/local-derivation-goal.cc b/src/libstore/build/local-derivation-goal.cc +index d41d1c1e5..faecc403b 100644 +--- a/src/libstore/build/local-derivation-goal.cc ++++ b/src/libstore/build/local-derivation-goal.cc +@@ -2160,15 +2160,12 @@ void LocalDerivationGoal::runChild() + _exit(1); + } + } ++#endif + +- builder = drv->builder; +- args.push_back(std::string(baseNameOf(drv->builder))); +-#else + if (!drv->isBuiltin()) { + builder = drv->builder; + args.push_back(std::string(baseNameOf(drv->builder))); + } +-#endif + + for (auto & i : drv->args) + args.push_back(rewriteStrings(i, inputRewrites)); +-- +2.46.1 + diff --git a/pkgs/tools/package-management/nix/patches/2_18/0004-local-derivation-goal-Move-builder-preparation-to-no.patch b/pkgs/tools/package-management/nix/patches/2_18/0004-local-derivation-goal-Move-builder-preparation-to-no.patch new file mode 100644 index 000000000000..4a17ccedbdbd --- /dev/null +++ b/pkgs/tools/package-management/nix/patches/2_18/0004-local-derivation-goal-Move-builder-preparation-to-no.patch @@ -0,0 +1,75 @@ +From d219faa93badcfc8134c81ba0d2b821775eb947c Mon Sep 17 00:00:00 2001 +From: Robert Hensing +Date: Thu, 3 Oct 2024 12:57:00 +0200 +Subject: [PATCH 4/4] local-derivation-goal: Move builder preparation to + non-builtin code path +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Signed-off-by: Jörg Thalheim +--- + src/libstore/build/local-derivation-goal.cc | 25 +++++++++------------ + 1 file changed, 10 insertions(+), 15 deletions(-) + +diff --git a/src/libstore/build/local-derivation-goal.cc b/src/libstore/build/local-derivation-goal.cc +index faecc403b..23d5d5e3f 100644 +--- a/src/libstore/build/local-derivation-goal.cc ++++ b/src/libstore/build/local-derivation-goal.cc +@@ -2033,11 +2033,6 @@ void LocalDerivationGoal::runChild() + throw SysError("setuid failed"); + } + +- /* Fill in the arguments. */ +- Strings args; +- +- std::string builder = "invalid"; +- + #if __APPLE__ + /* This has to appear before import statements. */ + std::string sandboxProfile = "(version 1)\n"; +@@ -2162,14 +2157,6 @@ void LocalDerivationGoal::runChild() + } + #endif + +- if (!drv->isBuiltin()) { +- builder = drv->builder; +- args.push_back(std::string(baseNameOf(drv->builder))); +- } +- +- for (auto & i : drv->args) +- args.push_back(rewriteStrings(i, inputRewrites)); +- + /* Indicate that we managed to set up the build environment. */ + writeFull(STDERR_FILENO, std::string("\2\n")); + +@@ -2199,6 +2186,14 @@ void LocalDerivationGoal::runChild() + } + } + ++ // Now builder is not builtin ++ ++ Strings args; ++ args.push_back(std::string(baseNameOf(drv->builder))); ++ ++ for (auto & i : drv->args) ++ args.push_back(rewriteStrings(i, inputRewrites)); ++ + #if __APPLE__ + posix_spawnattr_t attrp; + +@@ -2220,9 +2215,9 @@ void LocalDerivationGoal::runChild() + posix_spawnattr_setbinpref_np(&attrp, 1, &cpu, NULL); + } + +- posix_spawn(NULL, builder.c_str(), NULL, &attrp, stringsToCharPtrs(args).data(), stringsToCharPtrs(envStrs).data()); ++ posix_spawn(NULL, drv->builder.c_str(), NULL, &attrp, stringsToCharPtrs(args).data(), stringsToCharPtrs(envStrs).data()); + #else +- execve(builder.c_str(), stringsToCharPtrs(args).data(), stringsToCharPtrs(envStrs).data()); ++ execve(drv->builder.c_str(), stringsToCharPtrs(args).data(), stringsToCharPtrs(envStrs).data()); + #endif + + throw SysError("executing '%1%'", drv->builder); +-- +2.46.1 + diff --git a/pkgs/tools/package-management/nix/patches/2_19/0001-fix-Run-all-derivation-builders-inside-the-sandbox-o.patch b/pkgs/tools/package-management/nix/patches/2_19/0001-fix-Run-all-derivation-builders-inside-the-sandbox-o.patch new file mode 100644 index 000000000000..dfe091b48c7d --- /dev/null +++ b/pkgs/tools/package-management/nix/patches/2_19/0001-fix-Run-all-derivation-builders-inside-the-sandbox-o.patch @@ -0,0 +1,312 @@ +From 172734f47a8062285cec0055133efcc45df03e54 Mon Sep 17 00:00:00 2001 +From: Puck Meerburg +Date: Fri, 1 Mar 2024 11:42:24 -0500 +Subject: [PATCH 1/4] fix: Run all derivation builders inside the sandbox on + macOS +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Signed-off-by: Jörg Thalheim +--- + configure.ac | 6 +- + flake.nix | 1 + + src/libstore/build/local-derivation-goal.cc | 217 ++++++++++---------- + 3 files changed, 112 insertions(+), 112 deletions(-) + +diff --git a/configure.ac b/configure.ac +index 281ba2c32..6d73804e2 100644 +--- a/configure.ac ++++ b/configure.ac +@@ -58,13 +58,17 @@ AC_CHECK_TOOL([AR], [ar]) + AC_SYS_LARGEFILE + + +-# Solaris-specific stuff. ++# OS-specific stuff. + AC_STRUCT_DIRENT_D_TYPE + case "$host_os" in + solaris*) + # Solaris requires -lsocket -lnsl for network functions + LDFLAGS="-lsocket -lnsl $LDFLAGS" + ;; ++ darwin*) ++ # Need to link to libsandbox. ++ LDFLAGS="-lsandbox $LDFLAGS" ++ ;; + esac + + +diff --git a/flake.nix b/flake.nix +index 6deb09f22..98f9cc25f 100644 +--- a/flake.nix ++++ b/flake.nix +@@ -202,6 +202,7 @@ + libsodium + ] + ++ lib.optionals stdenv.isLinux [libseccomp] ++ ++ lib.optionals stdenv.isDarwin [darwin.apple_sdk.libs.sandbox] + ++ lib.optional stdenv.hostPlatform.isx86_64 libcpuid; + + checkDeps = [ +diff --git a/src/libstore/build/local-derivation-goal.cc b/src/libstore/build/local-derivation-goal.cc +index b6c7666e5..effd9c613 100644 +--- a/src/libstore/build/local-derivation-goal.cc ++++ b/src/libstore/build/local-derivation-goal.cc +@@ -55,6 +55,10 @@ + #if __APPLE__ + #include + #include ++#include ++ ++/* This definition is undocumented but depended upon by all major browsers. */ ++extern "C" int sandbox_init_with_parameters(const char *profile, uint64_t flags, const char *const parameters[], char **errorbuf); + #endif + + #include +@@ -2031,140 +2035,131 @@ void LocalDerivationGoal::runChild() + + std::string builder = "invalid"; + +- if (drv->isBuiltin()) { +- ; +- } + #if __APPLE__ +- else { +- /* This has to appear before import statements. */ +- std::string sandboxProfile = "(version 1)\n"; +- +- if (useChroot) { +- +- /* Lots and lots and lots of file functions freak out if they can't stat their full ancestry */ +- PathSet ancestry; +- +- /* We build the ancestry before adding all inputPaths to the store because we know they'll +- all have the same parents (the store), and there might be lots of inputs. This isn't +- particularly efficient... I doubt it'll be a bottleneck in practice */ +- for (auto & i : pathsInChroot) { +- Path cur = i.first; +- while (cur.compare("/") != 0) { +- cur = dirOf(cur); +- ancestry.insert(cur); +- } +- } ++ /* This has to appear before import statements. */ ++ std::string sandboxProfile = "(version 1)\n"; + +- /* And we want the store in there regardless of how empty pathsInChroot. We include the innermost +- path component this time, since it's typically /nix/store and we care about that. */ +- Path cur = worker.store.storeDir; ++ if (useChroot) { ++ ++ /* Lots and lots and lots of file functions freak out if they can't stat their full ancestry */ ++ PathSet ancestry; ++ ++ /* We build the ancestry before adding all inputPaths to the store because we know they'll ++ all have the same parents (the store), and there might be lots of inputs. This isn't ++ particularly efficient... I doubt it'll be a bottleneck in practice */ ++ for (auto & i : pathsInChroot) { ++ Path cur = i.first; + while (cur.compare("/") != 0) { +- ancestry.insert(cur); + cur = dirOf(cur); ++ ancestry.insert(cur); + } ++ } + +- /* Add all our input paths to the chroot */ +- for (auto & i : inputPaths) { +- auto p = worker.store.printStorePath(i); +- pathsInChroot[p] = p; +- } ++ /* And we want the store in there regardless of how empty pathsInChroot. We include the innermost ++ path component this time, since it's typically /nix/store and we care about that. */ ++ Path cur = worker.store.storeDir; ++ while (cur.compare("/") != 0) { ++ ancestry.insert(cur); ++ cur = dirOf(cur); ++ } + +- /* Violations will go to the syslog if you set this. Unfortunately the destination does not appear to be configurable */ +- if (settings.darwinLogSandboxViolations) { +- sandboxProfile += "(deny default)\n"; +- } else { +- sandboxProfile += "(deny default (with no-log))\n"; +- } ++ /* Add all our input paths to the chroot */ ++ for (auto & i : inputPaths) { ++ auto p = worker.store.printStorePath(i); ++ pathsInChroot[p] = p; ++ } ++ ++ /* Violations will go to the syslog if you set this. Unfortunately the destination does not appear to be configurable */ ++ if (settings.darwinLogSandboxViolations) { ++ sandboxProfile += "(deny default)\n"; ++ } else { ++ sandboxProfile += "(deny default (with no-log))\n"; ++ } + ++ sandboxProfile += ++ #include "sandbox-defaults.sb" ++ ; ++ ++ if (!derivationType->isSandboxed()) + sandboxProfile += +- #include "sandbox-defaults.sb" ++ #include "sandbox-network.sb" + ; + +- if (!derivationType->isSandboxed()) +- sandboxProfile += +- #include "sandbox-network.sb" +- ; +- +- /* Add the output paths we'll use at build-time to the chroot */ +- sandboxProfile += "(allow file-read* file-write* process-exec\n"; +- for (auto & [_, path] : scratchOutputs) +- sandboxProfile += fmt("\t(subpath \"%s\")\n", worker.store.printStorePath(path)); +- +- sandboxProfile += ")\n"; +- +- /* Our inputs (transitive dependencies and any impurities computed above) +- +- without file-write* allowed, access() incorrectly returns EPERM +- */ +- sandboxProfile += "(allow file-read* file-write* process-exec\n"; +- for (auto & i : pathsInChroot) { +- if (i.first != i.second.source) +- throw Error( +- "can't map '%1%' to '%2%': mismatched impure paths not supported on Darwin", +- i.first, i.second.source); +- +- std::string path = i.first; +- struct stat st; +- if (lstat(path.c_str(), &st)) { +- if (i.second.optional && errno == ENOENT) +- continue; +- throw SysError("getting attributes of path '%s", path); +- } +- if (S_ISDIR(st.st_mode)) +- sandboxProfile += fmt("\t(subpath \"%s\")\n", path); +- else +- sandboxProfile += fmt("\t(literal \"%s\")\n", path); +- } +- sandboxProfile += ")\n"; ++ /* Add the output paths we'll use at build-time to the chroot */ ++ sandboxProfile += "(allow file-read* file-write* process-exec\n"; ++ for (auto & [_, path] : scratchOutputs) ++ sandboxProfile += fmt("\t(subpath \"%s\")\n", worker.store.printStorePath(path)); + +- /* Allow file-read* on full directory hierarchy to self. Allows realpath() */ +- sandboxProfile += "(allow file-read*\n"; +- for (auto & i : ancestry) { +- sandboxProfile += fmt("\t(literal \"%s\")\n", i); +- } +- sandboxProfile += ")\n"; ++ sandboxProfile += ")\n"; + +- sandboxProfile += additionalSandboxProfile; +- } else +- sandboxProfile += +- #include "sandbox-minimal.sb" +- ; ++ /* Our inputs (transitive dependencies and any impurities computed above) ++ ++ without file-write* allowed, access() incorrectly returns EPERM ++ */ ++ sandboxProfile += "(allow file-read* file-write* process-exec\n"; ++ for (auto & i : pathsInChroot) { ++ if (i.first != i.second.source) ++ throw Error( ++ "can't map '%1%' to '%2%': mismatched impure paths not supported on Darwin", ++ i.first, i.second.source); ++ ++ std::string path = i.first; ++ struct stat st; ++ if (lstat(path.c_str(), &st)) { ++ if (i.second.optional && errno == ENOENT) ++ continue; ++ throw SysError("getting attributes of path '%s", path); ++ } ++ if (S_ISDIR(st.st_mode)) ++ sandboxProfile += fmt("\t(subpath \"%s\")\n", path); ++ else ++ sandboxProfile += fmt("\t(literal \"%s\")\n", path); ++ } ++ sandboxProfile += ")\n"; + +- debug("Generated sandbox profile:"); +- debug(sandboxProfile); ++ /* Allow file-read* on full directory hierarchy to self. Allows realpath() */ ++ sandboxProfile += "(allow file-read*\n"; ++ for (auto & i : ancestry) { ++ sandboxProfile += fmt("\t(literal \"%s\")\n", i); ++ } ++ sandboxProfile += ")\n"; + +- Path sandboxFile = tmpDir + "/.sandbox.sb"; ++ sandboxProfile += additionalSandboxProfile; ++ } else ++ sandboxProfile += ++ #include "sandbox-minimal.sb" ++ ; + +- writeFile(sandboxFile, sandboxProfile); ++ debug("Generated sandbox profile:"); ++ debug(sandboxProfile); + +- bool allowLocalNetworking = parsedDrv->getBoolAttr("__darwinAllowLocalNetworking"); ++ bool allowLocalNetworking = parsedDrv->getBoolAttr("__darwinAllowLocalNetworking"); + +- /* The tmpDir in scope points at the temporary build directory for our derivation. Some packages try different mechanisms +- to find temporary directories, so we want to open up a broader place for them to dump their files, if needed. */ +- Path globalTmpDir = canonPath(getEnvNonEmpty("TMPDIR").value_or("/tmp"), true); ++ /* The tmpDir in scope points at the temporary build directory for our derivation. Some packages try different mechanisms ++ to find temporary directories, so we want to open up a broader place for them to dump their files, if needed. */ ++ Path globalTmpDir = canonPath(getEnvNonEmpty("TMPDIR").value_or("/tmp"), true); + +- /* They don't like trailing slashes on subpath directives */ +- if (globalTmpDir.back() == '/') globalTmpDir.pop_back(); ++ /* They don't like trailing slashes on subpath directives */ ++ if (globalTmpDir.back() == '/') globalTmpDir.pop_back(); + +- if (getEnv("_NIX_TEST_NO_SANDBOX") != "1") { +- builder = "/usr/bin/sandbox-exec"; +- args.push_back("sandbox-exec"); +- args.push_back("-f"); +- args.push_back(sandboxFile); +- args.push_back("-D"); +- args.push_back("_GLOBAL_TMP_DIR=" + globalTmpDir); +- if (allowLocalNetworking) { +- args.push_back("-D"); +- args.push_back(std::string("_ALLOW_LOCAL_NETWORKING=1")); +- } +- args.push_back(drv->builder); +- } else { +- builder = drv->builder; +- args.push_back(std::string(baseNameOf(drv->builder))); ++ if (getEnv("_NIX_TEST_NO_SANDBOX") != "1") { ++ Strings sandboxArgs; ++ sandboxArgs.push_back("_GLOBAL_TMP_DIR"); ++ sandboxArgs.push_back(globalTmpDir); ++ if (allowLocalNetworking) { ++ sandboxArgs.push_back("_ALLOW_LOCAL_NETWORKING"); ++ sandboxArgs.push_back("1"); ++ } ++ if (sandbox_init_with_parameters(sandboxProfile.c_str(), 0, stringsToCharPtrs(sandboxArgs).data(), NULL)) { ++ writeFull(STDERR_FILENO, "failed to configure sandbox\n"); ++ _exit(1); + } + } ++ ++ builder = drv->builder; ++ args.push_back(std::string(baseNameOf(drv->builder))); + #else +- else { ++ if (!drv->isBuiltin()) { + builder = drv->builder; + args.push_back(std::string(baseNameOf(drv->builder))); + } +-- +2.46.1 + diff --git a/pkgs/tools/package-management/nix/patches/2_19/0002-local-derivation-goal-Print-sandbox-error-detail-on-.patch b/pkgs/tools/package-management/nix/patches/2_19/0002-local-derivation-goal-Print-sandbox-error-detail-on-.patch new file mode 100644 index 000000000000..8378f739dd7e --- /dev/null +++ b/pkgs/tools/package-management/nix/patches/2_19/0002-local-derivation-goal-Print-sandbox-error-detail-on-.patch @@ -0,0 +1,34 @@ +From 4a5018019e969537fdba36314fe5c19fe91828af Mon Sep 17 00:00:00 2001 +From: Robert Hensing +Date: Thu, 3 Oct 2024 12:44:12 +0200 +Subject: [PATCH 2/4] local-derivation-goal: Print sandbox error detail on + darwin +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Co-Authored-By: Théophane Hufschmitt +Signed-off-by: Jörg Thalheim +--- + src/libstore/build/local-derivation-goal.cc | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/src/libstore/build/local-derivation-goal.cc b/src/libstore/build/local-derivation-goal.cc +index effd9c613..a67347b59 100644 +--- a/src/libstore/build/local-derivation-goal.cc ++++ b/src/libstore/build/local-derivation-goal.cc +@@ -2150,8 +2150,9 @@ void LocalDerivationGoal::runChild() + sandboxArgs.push_back("_ALLOW_LOCAL_NETWORKING"); + sandboxArgs.push_back("1"); + } +- if (sandbox_init_with_parameters(sandboxProfile.c_str(), 0, stringsToCharPtrs(sandboxArgs).data(), NULL)) { +- writeFull(STDERR_FILENO, "failed to configure sandbox\n"); ++ char * sandbox_errbuf = nullptr; ++ if (sandbox_init_with_parameters(sandboxProfile.c_str(), 0, stringsToCharPtrs(sandboxArgs).data(), &sandbox_errbuf)) { ++ writeFull(STDERR_FILENO, fmt("failed to configure sandbox: %s\n", sandbox_errbuf ? sandbox_errbuf : "(null)")); + _exit(1); + } + } +-- +2.46.1 + diff --git a/pkgs/tools/package-management/nix/patches/2_19/0003-local-derivation-goal-Refactor.patch b/pkgs/tools/package-management/nix/patches/2_19/0003-local-derivation-goal-Refactor.patch new file mode 100644 index 000000000000..f98d7069b554 --- /dev/null +++ b/pkgs/tools/package-management/nix/patches/2_19/0003-local-derivation-goal-Refactor.patch @@ -0,0 +1,41 @@ +From f9e5b3b52323fdcac4e21bfec4d03bd66ea6a503 Mon Sep 17 00:00:00 2001 +From: Robert Hensing +Date: Thu, 3 Oct 2024 12:50:27 +0200 +Subject: [PATCH 3/4] local-derivation-goal: Refactor +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +This works because the `builder` and `args` variables are only used +in the non-builtin code path. + +Co-Authored-By: Théophane Hufschmitt +Signed-off-by: Jörg Thalheim +--- + src/libstore/build/local-derivation-goal.cc | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +diff --git a/src/libstore/build/local-derivation-goal.cc b/src/libstore/build/local-derivation-goal.cc +index a67347b59..eeb2635ee 100644 +--- a/src/libstore/build/local-derivation-goal.cc ++++ b/src/libstore/build/local-derivation-goal.cc +@@ -2156,15 +2156,12 @@ void LocalDerivationGoal::runChild() + _exit(1); + } + } ++#endif + +- builder = drv->builder; +- args.push_back(std::string(baseNameOf(drv->builder))); +-#else + if (!drv->isBuiltin()) { + builder = drv->builder; + args.push_back(std::string(baseNameOf(drv->builder))); + } +-#endif + + for (auto & i : drv->args) + args.push_back(rewriteStrings(i, inputRewrites)); +-- +2.46.1 + diff --git a/pkgs/tools/package-management/nix/patches/2_19/0004-local-derivation-goal-Move-builder-preparation-to-no.patch b/pkgs/tools/package-management/nix/patches/2_19/0004-local-derivation-goal-Move-builder-preparation-to-no.patch new file mode 100644 index 000000000000..523e0edea3d9 --- /dev/null +++ b/pkgs/tools/package-management/nix/patches/2_19/0004-local-derivation-goal-Move-builder-preparation-to-no.patch @@ -0,0 +1,75 @@ +From 126a1fd3385175ac94ae4000a9798e0cafb3c168 Mon Sep 17 00:00:00 2001 +From: Robert Hensing +Date: Thu, 3 Oct 2024 12:57:00 +0200 +Subject: [PATCH 4/4] local-derivation-goal: Move builder preparation to + non-builtin code path +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Signed-off-by: Jörg Thalheim +--- + src/libstore/build/local-derivation-goal.cc | 25 +++++++++------------ + 1 file changed, 10 insertions(+), 15 deletions(-) + +diff --git a/src/libstore/build/local-derivation-goal.cc b/src/libstore/build/local-derivation-goal.cc +index eeb2635ee..e29330f0e 100644 +--- a/src/libstore/build/local-derivation-goal.cc ++++ b/src/libstore/build/local-derivation-goal.cc +@@ -2030,11 +2030,6 @@ void LocalDerivationGoal::runChild() + throw SysError("setuid failed"); + } + +- /* Fill in the arguments. */ +- Strings args; +- +- std::string builder = "invalid"; +- + #if __APPLE__ + /* This has to appear before import statements. */ + std::string sandboxProfile = "(version 1)\n"; +@@ -2158,14 +2153,6 @@ void LocalDerivationGoal::runChild() + } + #endif + +- if (!drv->isBuiltin()) { +- builder = drv->builder; +- args.push_back(std::string(baseNameOf(drv->builder))); +- } +- +- for (auto & i : drv->args) +- args.push_back(rewriteStrings(i, inputRewrites)); +- + /* Indicate that we managed to set up the build environment. */ + writeFull(STDERR_FILENO, std::string("\2\n")); + +@@ -2195,6 +2182,14 @@ void LocalDerivationGoal::runChild() + } + } + ++ // Now builder is not builtin ++ ++ Strings args; ++ args.push_back(std::string(baseNameOf(drv->builder))); ++ ++ for (auto & i : drv->args) ++ args.push_back(rewriteStrings(i, inputRewrites)); ++ + #if __APPLE__ + posix_spawnattr_t attrp; + +@@ -2216,9 +2211,9 @@ void LocalDerivationGoal::runChild() + posix_spawnattr_setbinpref_np(&attrp, 1, &cpu, NULL); + } + +- posix_spawn(NULL, builder.c_str(), NULL, &attrp, stringsToCharPtrs(args).data(), stringsToCharPtrs(envStrs).data()); ++ posix_spawn(NULL, drv->builder.c_str(), NULL, &attrp, stringsToCharPtrs(args).data(), stringsToCharPtrs(envStrs).data()); + #else +- execve(builder.c_str(), stringsToCharPtrs(args).data(), stringsToCharPtrs(envStrs).data()); ++ execve(drv->builder.c_str(), stringsToCharPtrs(args).data(), stringsToCharPtrs(envStrs).data()); + #endif + + throw SysError("executing '%1%'", drv->builder); +-- +2.46.1 + diff --git a/pkgs/tools/package-management/nix/patches/2_20/0001-fix-Run-all-derivation-builders-inside-the-sandbox-o.patch b/pkgs/tools/package-management/nix/patches/2_20/0001-fix-Run-all-derivation-builders-inside-the-sandbox-o.patch new file mode 100644 index 000000000000..6c5d8b785990 --- /dev/null +++ b/pkgs/tools/package-management/nix/patches/2_20/0001-fix-Run-all-derivation-builders-inside-the-sandbox-o.patch @@ -0,0 +1,320 @@ +From aa54b01af503644a393e4e4055c4ce2a23ce9139 Mon Sep 17 00:00:00 2001 +From: Puck Meerburg +Date: Fri, 1 Mar 2024 11:42:24 -0500 +Subject: [PATCH 1/4] fix: Run all derivation builders inside the sandbox on + macOS +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Signed-off-by: Jörg Thalheim +--- + configure.ac | 6 +- + package.nix | 2 + + src/libstore/build/local-derivation-goal.cc | 217 ++++++++++---------- + 3 files changed, 113 insertions(+), 112 deletions(-) + +diff --git a/configure.ac b/configure.ac +index 8c29c1e62..8c524fd93 100644 +--- a/configure.ac ++++ b/configure.ac +@@ -58,13 +58,17 @@ AC_CHECK_TOOL([AR], [ar]) + AC_SYS_LARGEFILE + + +-# Solaris-specific stuff. ++# OS-specific stuff. + AC_STRUCT_DIRENT_D_TYPE + case "$host_os" in + solaris*) + # Solaris requires -lsocket -lnsl for network functions + LDFLAGS="-lsocket -lnsl $LDFLAGS" + ;; ++ darwin*) ++ # Need to link to libsandbox. ++ LDFLAGS="-lsandbox $LDFLAGS" ++ ;; + esac + + +diff --git a/package.nix b/package.nix +index d1d14d10e..40283ffcf 100644 +--- a/package.nix ++++ b/package.nix +@@ -24,6 +24,7 @@ + , libgit2 + , libseccomp + , libsodium ++, darwin + , lowdown + , mdbook + , mdbook-linkcheck +@@ -233,6 +234,7 @@ in { + gtest + rapidcheck + ] ++ lib.optional stdenv.isLinux libseccomp ++ ++ lib.optional stdenv.hostPlatform.isDarwin darwin.apple_sdk.libs.sandbox + ++ lib.optional stdenv.hostPlatform.isx86_64 libcpuid + # There have been issues building these dependencies + ++ lib.optional (stdenv.hostPlatform == stdenv.buildPlatform && (stdenv.isLinux || stdenv.isDarwin)) +diff --git a/src/libstore/build/local-derivation-goal.cc b/src/libstore/build/local-derivation-goal.cc +index b8228bc11..9ab676429 100644 +--- a/src/libstore/build/local-derivation-goal.cc ++++ b/src/libstore/build/local-derivation-goal.cc +@@ -57,6 +57,10 @@ + #if __APPLE__ + #include + #include ++#include ++ ++/* This definition is undocumented but depended upon by all major browsers. */ ++extern "C" int sandbox_init_with_parameters(const char *profile, uint64_t flags, const char *const parameters[], char **errorbuf); + #endif + + #include +@@ -2023,140 +2027,131 @@ void LocalDerivationGoal::runChild() + + std::string builder = "invalid"; + +- if (drv->isBuiltin()) { +- ; +- } + #if __APPLE__ +- else { +- /* This has to appear before import statements. */ +- std::string sandboxProfile = "(version 1)\n"; +- +- if (useChroot) { +- +- /* Lots and lots and lots of file functions freak out if they can't stat their full ancestry */ +- PathSet ancestry; +- +- /* We build the ancestry before adding all inputPaths to the store because we know they'll +- all have the same parents (the store), and there might be lots of inputs. This isn't +- particularly efficient... I doubt it'll be a bottleneck in practice */ +- for (auto & i : pathsInChroot) { +- Path cur = i.first; +- while (cur.compare("/") != 0) { +- cur = dirOf(cur); +- ancestry.insert(cur); +- } +- } ++ /* This has to appear before import statements. */ ++ std::string sandboxProfile = "(version 1)\n"; + +- /* And we want the store in there regardless of how empty pathsInChroot. We include the innermost +- path component this time, since it's typically /nix/store and we care about that. */ +- Path cur = worker.store.storeDir; ++ if (useChroot) { ++ ++ /* Lots and lots and lots of file functions freak out if they can't stat their full ancestry */ ++ PathSet ancestry; ++ ++ /* We build the ancestry before adding all inputPaths to the store because we know they'll ++ all have the same parents (the store), and there might be lots of inputs. This isn't ++ particularly efficient... I doubt it'll be a bottleneck in practice */ ++ for (auto & i : pathsInChroot) { ++ Path cur = i.first; + while (cur.compare("/") != 0) { +- ancestry.insert(cur); + cur = dirOf(cur); ++ ancestry.insert(cur); + } ++ } + +- /* Add all our input paths to the chroot */ +- for (auto & i : inputPaths) { +- auto p = worker.store.printStorePath(i); +- pathsInChroot[p] = p; +- } ++ /* And we want the store in there regardless of how empty pathsInChroot. We include the innermost ++ path component this time, since it's typically /nix/store and we care about that. */ ++ Path cur = worker.store.storeDir; ++ while (cur.compare("/") != 0) { ++ ancestry.insert(cur); ++ cur = dirOf(cur); ++ } + +- /* Violations will go to the syslog if you set this. Unfortunately the destination does not appear to be configurable */ +- if (settings.darwinLogSandboxViolations) { +- sandboxProfile += "(deny default)\n"; +- } else { +- sandboxProfile += "(deny default (with no-log))\n"; +- } ++ /* Add all our input paths to the chroot */ ++ for (auto & i : inputPaths) { ++ auto p = worker.store.printStorePath(i); ++ pathsInChroot[p] = p; ++ } ++ ++ /* Violations will go to the syslog if you set this. Unfortunately the destination does not appear to be configurable */ ++ if (settings.darwinLogSandboxViolations) { ++ sandboxProfile += "(deny default)\n"; ++ } else { ++ sandboxProfile += "(deny default (with no-log))\n"; ++ } + ++ sandboxProfile += ++ #include "sandbox-defaults.sb" ++ ; ++ ++ if (!derivationType->isSandboxed()) + sandboxProfile += +- #include "sandbox-defaults.sb" ++ #include "sandbox-network.sb" + ; + +- if (!derivationType->isSandboxed()) +- sandboxProfile += +- #include "sandbox-network.sb" +- ; +- +- /* Add the output paths we'll use at build-time to the chroot */ +- sandboxProfile += "(allow file-read* file-write* process-exec\n"; +- for (auto & [_, path] : scratchOutputs) +- sandboxProfile += fmt("\t(subpath \"%s\")\n", worker.store.printStorePath(path)); +- +- sandboxProfile += ")\n"; +- +- /* Our inputs (transitive dependencies and any impurities computed above) +- +- without file-write* allowed, access() incorrectly returns EPERM +- */ +- sandboxProfile += "(allow file-read* file-write* process-exec\n"; +- for (auto & i : pathsInChroot) { +- if (i.first != i.second.source) +- throw Error( +- "can't map '%1%' to '%2%': mismatched impure paths not supported on Darwin", +- i.first, i.second.source); +- +- std::string path = i.first; +- struct stat st; +- if (lstat(path.c_str(), &st)) { +- if (i.second.optional && errno == ENOENT) +- continue; +- throw SysError("getting attributes of path '%s", path); +- } +- if (S_ISDIR(st.st_mode)) +- sandboxProfile += fmt("\t(subpath \"%s\")\n", path); +- else +- sandboxProfile += fmt("\t(literal \"%s\")\n", path); +- } +- sandboxProfile += ")\n"; ++ /* Add the output paths we'll use at build-time to the chroot */ ++ sandboxProfile += "(allow file-read* file-write* process-exec\n"; ++ for (auto & [_, path] : scratchOutputs) ++ sandboxProfile += fmt("\t(subpath \"%s\")\n", worker.store.printStorePath(path)); + +- /* Allow file-read* on full directory hierarchy to self. Allows realpath() */ +- sandboxProfile += "(allow file-read*\n"; +- for (auto & i : ancestry) { +- sandboxProfile += fmt("\t(literal \"%s\")\n", i); +- } +- sandboxProfile += ")\n"; ++ sandboxProfile += ")\n"; + +- sandboxProfile += additionalSandboxProfile; +- } else +- sandboxProfile += +- #include "sandbox-minimal.sb" +- ; ++ /* Our inputs (transitive dependencies and any impurities computed above) ++ ++ without file-write* allowed, access() incorrectly returns EPERM ++ */ ++ sandboxProfile += "(allow file-read* file-write* process-exec\n"; ++ for (auto & i : pathsInChroot) { ++ if (i.first != i.second.source) ++ throw Error( ++ "can't map '%1%' to '%2%': mismatched impure paths not supported on Darwin", ++ i.first, i.second.source); ++ ++ std::string path = i.first; ++ struct stat st; ++ if (lstat(path.c_str(), &st)) { ++ if (i.second.optional && errno == ENOENT) ++ continue; ++ throw SysError("getting attributes of path '%s", path); ++ } ++ if (S_ISDIR(st.st_mode)) ++ sandboxProfile += fmt("\t(subpath \"%s\")\n", path); ++ else ++ sandboxProfile += fmt("\t(literal \"%s\")\n", path); ++ } ++ sandboxProfile += ")\n"; + +- debug("Generated sandbox profile:"); +- debug(sandboxProfile); ++ /* Allow file-read* on full directory hierarchy to self. Allows realpath() */ ++ sandboxProfile += "(allow file-read*\n"; ++ for (auto & i : ancestry) { ++ sandboxProfile += fmt("\t(literal \"%s\")\n", i); ++ } ++ sandboxProfile += ")\n"; + +- Path sandboxFile = tmpDir + "/.sandbox.sb"; ++ sandboxProfile += additionalSandboxProfile; ++ } else ++ sandboxProfile += ++ #include "sandbox-minimal.sb" ++ ; + +- writeFile(sandboxFile, sandboxProfile); ++ debug("Generated sandbox profile:"); ++ debug(sandboxProfile); + +- bool allowLocalNetworking = parsedDrv->getBoolAttr("__darwinAllowLocalNetworking"); ++ bool allowLocalNetworking = parsedDrv->getBoolAttr("__darwinAllowLocalNetworking"); + +- /* The tmpDir in scope points at the temporary build directory for our derivation. Some packages try different mechanisms +- to find temporary directories, so we want to open up a broader place for them to dump their files, if needed. */ +- Path globalTmpDir = canonPath(getEnvNonEmpty("TMPDIR").value_or("/tmp"), true); ++ /* The tmpDir in scope points at the temporary build directory for our derivation. Some packages try different mechanisms ++ to find temporary directories, so we want to open up a broader place for them to dump their files, if needed. */ ++ Path globalTmpDir = canonPath(getEnvNonEmpty("TMPDIR").value_or("/tmp"), true); + +- /* They don't like trailing slashes on subpath directives */ +- if (globalTmpDir.back() == '/') globalTmpDir.pop_back(); ++ /* They don't like trailing slashes on subpath directives */ ++ if (globalTmpDir.back() == '/') globalTmpDir.pop_back(); + +- if (getEnv("_NIX_TEST_NO_SANDBOX") != "1") { +- builder = "/usr/bin/sandbox-exec"; +- args.push_back("sandbox-exec"); +- args.push_back("-f"); +- args.push_back(sandboxFile); +- args.push_back("-D"); +- args.push_back("_GLOBAL_TMP_DIR=" + globalTmpDir); +- if (allowLocalNetworking) { +- args.push_back("-D"); +- args.push_back(std::string("_ALLOW_LOCAL_NETWORKING=1")); +- } +- args.push_back(drv->builder); +- } else { +- builder = drv->builder; +- args.push_back(std::string(baseNameOf(drv->builder))); ++ if (getEnv("_NIX_TEST_NO_SANDBOX") != "1") { ++ Strings sandboxArgs; ++ sandboxArgs.push_back("_GLOBAL_TMP_DIR"); ++ sandboxArgs.push_back(globalTmpDir); ++ if (allowLocalNetworking) { ++ sandboxArgs.push_back("_ALLOW_LOCAL_NETWORKING"); ++ sandboxArgs.push_back("1"); ++ } ++ if (sandbox_init_with_parameters(sandboxProfile.c_str(), 0, stringsToCharPtrs(sandboxArgs).data(), NULL)) { ++ writeFull(STDERR_FILENO, "failed to configure sandbox\n"); ++ _exit(1); + } + } ++ ++ builder = drv->builder; ++ args.push_back(std::string(baseNameOf(drv->builder))); + #else +- else { ++ if (!drv->isBuiltin()) { + builder = drv->builder; + args.push_back(std::string(baseNameOf(drv->builder))); + } +-- +2.46.1 + diff --git a/pkgs/tools/package-management/nix/patches/2_20/0002-local-derivation-goal-Print-sandbox-error-detail-on-.patch b/pkgs/tools/package-management/nix/patches/2_20/0002-local-derivation-goal-Print-sandbox-error-detail-on-.patch new file mode 100644 index 000000000000..d644be6703e7 --- /dev/null +++ b/pkgs/tools/package-management/nix/patches/2_20/0002-local-derivation-goal-Print-sandbox-error-detail-on-.patch @@ -0,0 +1,34 @@ +From b78e489f79165457b59faa2270fd89769d0fc17d Mon Sep 17 00:00:00 2001 +From: Robert Hensing +Date: Thu, 3 Oct 2024 12:44:12 +0200 +Subject: [PATCH 2/4] local-derivation-goal: Print sandbox error detail on + darwin +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Co-Authored-By: Théophane Hufschmitt +Signed-off-by: Jörg Thalheim +--- + src/libstore/build/local-derivation-goal.cc | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/src/libstore/build/local-derivation-goal.cc b/src/libstore/build/local-derivation-goal.cc +index 9ab676429..8476e038e 100644 +--- a/src/libstore/build/local-derivation-goal.cc ++++ b/src/libstore/build/local-derivation-goal.cc +@@ -2142,8 +2142,9 @@ void LocalDerivationGoal::runChild() + sandboxArgs.push_back("_ALLOW_LOCAL_NETWORKING"); + sandboxArgs.push_back("1"); + } +- if (sandbox_init_with_parameters(sandboxProfile.c_str(), 0, stringsToCharPtrs(sandboxArgs).data(), NULL)) { +- writeFull(STDERR_FILENO, "failed to configure sandbox\n"); ++ char * sandbox_errbuf = nullptr; ++ if (sandbox_init_with_parameters(sandboxProfile.c_str(), 0, stringsToCharPtrs(sandboxArgs).data(), &sandbox_errbuf)) { ++ writeFull(STDERR_FILENO, fmt("failed to configure sandbox: %s\n", sandbox_errbuf ? sandbox_errbuf : "(null)")); + _exit(1); + } + } +-- +2.46.1 + diff --git a/pkgs/tools/package-management/nix/patches/2_20/0003-local-derivation-goal-Refactor.patch b/pkgs/tools/package-management/nix/patches/2_20/0003-local-derivation-goal-Refactor.patch new file mode 100644 index 000000000000..05e8c5843ace --- /dev/null +++ b/pkgs/tools/package-management/nix/patches/2_20/0003-local-derivation-goal-Refactor.patch @@ -0,0 +1,41 @@ +From db6bcf3f7714929d5a21b655c5f8ccd2ddbdf7f2 Mon Sep 17 00:00:00 2001 +From: Robert Hensing +Date: Thu, 3 Oct 2024 12:50:27 +0200 +Subject: [PATCH 3/4] local-derivation-goal: Refactor +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +This works because the `builder` and `args` variables are only used +in the non-builtin code path. + +Co-Authored-By: Théophane Hufschmitt +Signed-off-by: Jörg Thalheim +--- + src/libstore/build/local-derivation-goal.cc | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +diff --git a/src/libstore/build/local-derivation-goal.cc b/src/libstore/build/local-derivation-goal.cc +index 8476e038e..12b67df69 100644 +--- a/src/libstore/build/local-derivation-goal.cc ++++ b/src/libstore/build/local-derivation-goal.cc +@@ -2148,15 +2148,12 @@ void LocalDerivationGoal::runChild() + _exit(1); + } + } ++#endif + +- builder = drv->builder; +- args.push_back(std::string(baseNameOf(drv->builder))); +-#else + if (!drv->isBuiltin()) { + builder = drv->builder; + args.push_back(std::string(baseNameOf(drv->builder))); + } +-#endif + + for (auto & i : drv->args) + args.push_back(rewriteStrings(i, inputRewrites)); +-- +2.46.1 + diff --git a/pkgs/tools/package-management/nix/patches/2_20/0004-local-derivation-goal-Move-builder-preparation-to-no.patch b/pkgs/tools/package-management/nix/patches/2_20/0004-local-derivation-goal-Move-builder-preparation-to-no.patch new file mode 100644 index 000000000000..852940d3b711 --- /dev/null +++ b/pkgs/tools/package-management/nix/patches/2_20/0004-local-derivation-goal-Move-builder-preparation-to-no.patch @@ -0,0 +1,75 @@ +From 55be7deee1471e77e3ad408c5e23842df0d5bc28 Mon Sep 17 00:00:00 2001 +From: Robert Hensing +Date: Thu, 3 Oct 2024 12:57:00 +0200 +Subject: [PATCH 4/4] local-derivation-goal: Move builder preparation to + non-builtin code path +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Signed-off-by: Jörg Thalheim +--- + src/libstore/build/local-derivation-goal.cc | 25 +++++++++------------ + 1 file changed, 10 insertions(+), 15 deletions(-) + +diff --git a/src/libstore/build/local-derivation-goal.cc b/src/libstore/build/local-derivation-goal.cc +index 12b67df69..ada86dbb8 100644 +--- a/src/libstore/build/local-derivation-goal.cc ++++ b/src/libstore/build/local-derivation-goal.cc +@@ -2022,11 +2022,6 @@ void LocalDerivationGoal::runChild() + throw SysError("setuid failed"); + } + +- /* Fill in the arguments. */ +- Strings args; +- +- std::string builder = "invalid"; +- + #if __APPLE__ + /* This has to appear before import statements. */ + std::string sandboxProfile = "(version 1)\n"; +@@ -2150,14 +2145,6 @@ void LocalDerivationGoal::runChild() + } + #endif + +- if (!drv->isBuiltin()) { +- builder = drv->builder; +- args.push_back(std::string(baseNameOf(drv->builder))); +- } +- +- for (auto & i : drv->args) +- args.push_back(rewriteStrings(i, inputRewrites)); +- + /* Indicate that we managed to set up the build environment. */ + writeFull(STDERR_FILENO, std::string("\2\n")); + +@@ -2187,6 +2174,14 @@ void LocalDerivationGoal::runChild() + } + } + ++ // Now builder is not builtin ++ ++ Strings args; ++ args.push_back(std::string(baseNameOf(drv->builder))); ++ ++ for (auto & i : drv->args) ++ args.push_back(rewriteStrings(i, inputRewrites)); ++ + #if __APPLE__ + posix_spawnattr_t attrp; + +@@ -2208,9 +2203,9 @@ void LocalDerivationGoal::runChild() + posix_spawnattr_setbinpref_np(&attrp, 1, &cpu, NULL); + } + +- posix_spawn(NULL, builder.c_str(), NULL, &attrp, stringsToCharPtrs(args).data(), stringsToCharPtrs(envStrs).data()); ++ posix_spawn(NULL, drv->builder.c_str(), NULL, &attrp, stringsToCharPtrs(args).data(), stringsToCharPtrs(envStrs).data()); + #else +- execve(builder.c_str(), stringsToCharPtrs(args).data(), stringsToCharPtrs(envStrs).data()); ++ execve(drv->builder.c_str(), stringsToCharPtrs(args).data(), stringsToCharPtrs(envStrs).data()); + #endif + + throw SysError("executing '%1%'", drv->builder); +-- +2.46.1 + diff --git a/pkgs/tools/package-management/nix/patches/2_21/0001-fix-Run-all-derivation-builders-inside-the-sandbox-o.patch b/pkgs/tools/package-management/nix/patches/2_21/0001-fix-Run-all-derivation-builders-inside-the-sandbox-o.patch new file mode 100644 index 000000000000..d35d20896e6b --- /dev/null +++ b/pkgs/tools/package-management/nix/patches/2_21/0001-fix-Run-all-derivation-builders-inside-the-sandbox-o.patch @@ -0,0 +1,320 @@ +From ae8a38d29cc0fbd6394acd72fdaaa62b3798f698 Mon Sep 17 00:00:00 2001 +From: Puck Meerburg +Date: Fri, 1 Mar 2024 11:42:24 -0500 +Subject: [PATCH 1/4] fix: Run all derivation builders inside the sandbox on + macOS +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Signed-off-by: Jörg Thalheim +--- + configure.ac | 6 +- + package.nix | 2 + + src/libstore/build/local-derivation-goal.cc | 217 ++++++++++---------- + 3 files changed, 113 insertions(+), 112 deletions(-) + +diff --git a/configure.ac b/configure.ac +index 676b145a5..f6fa35c81 100644 +--- a/configure.ac ++++ b/configure.ac +@@ -62,13 +62,17 @@ AC_CHECK_TOOL([AR], [ar]) + AC_SYS_LARGEFILE + + +-# Solaris-specific stuff. ++# OS-specific stuff. + AC_STRUCT_DIRENT_D_TYPE + case "$host_os" in + solaris*) + # Solaris requires -lsocket -lnsl for network functions + LDFLAGS="-lsocket -lnsl $LDFLAGS" + ;; ++ darwin*) ++ # Need to link to libsandbox. ++ LDFLAGS="-lsandbox $LDFLAGS" ++ ;; + esac + + +diff --git a/package.nix b/package.nix +index 7d9a39771..de2e1aff1 100644 +--- a/package.nix ++++ b/package.nix +@@ -25,6 +25,7 @@ + , libseccomp + , libsodium + , man ++, darwin + , lowdown + , mdbook + , mdbook-linkcheck +@@ -239,6 +240,7 @@ in { + gtest + rapidcheck + ] ++ lib.optional stdenv.isLinux libseccomp ++ ++ lib.optional stdenv.hostPlatform.isDarwin darwin.apple_sdk.libs.sandbox + ++ lib.optional stdenv.hostPlatform.isx86_64 libcpuid + # There have been issues building these dependencies + ++ lib.optional (stdenv.hostPlatform == stdenv.buildPlatform && (stdenv.isLinux || stdenv.isDarwin)) +diff --git a/src/libstore/build/local-derivation-goal.cc b/src/libstore/build/local-derivation-goal.cc +index 710304b67..c73b30b80 100644 +--- a/src/libstore/build/local-derivation-goal.cc ++++ b/src/libstore/build/local-derivation-goal.cc +@@ -58,6 +58,10 @@ + #if __APPLE__ + #include + #include ++#include ++ ++/* This definition is undocumented but depended upon by all major browsers. */ ++extern "C" int sandbox_init_with_parameters(const char *profile, uint64_t flags, const char *const parameters[], char **errorbuf); + #endif + + #include +@@ -2018,140 +2022,131 @@ void LocalDerivationGoal::runChild() + + std::string builder = "invalid"; + +- if (drv->isBuiltin()) { +- ; +- } + #if __APPLE__ +- else { +- /* This has to appear before import statements. */ +- std::string sandboxProfile = "(version 1)\n"; +- +- if (useChroot) { +- +- /* Lots and lots and lots of file functions freak out if they can't stat their full ancestry */ +- PathSet ancestry; +- +- /* We build the ancestry before adding all inputPaths to the store because we know they'll +- all have the same parents (the store), and there might be lots of inputs. This isn't +- particularly efficient... I doubt it'll be a bottleneck in practice */ +- for (auto & i : pathsInChroot) { +- Path cur = i.first; +- while (cur.compare("/") != 0) { +- cur = dirOf(cur); +- ancestry.insert(cur); +- } +- } ++ /* This has to appear before import statements. */ ++ std::string sandboxProfile = "(version 1)\n"; + +- /* And we want the store in there regardless of how empty pathsInChroot. We include the innermost +- path component this time, since it's typically /nix/store and we care about that. */ +- Path cur = worker.store.storeDir; ++ if (useChroot) { ++ ++ /* Lots and lots and lots of file functions freak out if they can't stat their full ancestry */ ++ PathSet ancestry; ++ ++ /* We build the ancestry before adding all inputPaths to the store because we know they'll ++ all have the same parents (the store), and there might be lots of inputs. This isn't ++ particularly efficient... I doubt it'll be a bottleneck in practice */ ++ for (auto & i : pathsInChroot) { ++ Path cur = i.first; + while (cur.compare("/") != 0) { +- ancestry.insert(cur); + cur = dirOf(cur); ++ ancestry.insert(cur); + } ++ } + +- /* Add all our input paths to the chroot */ +- for (auto & i : inputPaths) { +- auto p = worker.store.printStorePath(i); +- pathsInChroot[p] = p; +- } ++ /* And we want the store in there regardless of how empty pathsInChroot. We include the innermost ++ path component this time, since it's typically /nix/store and we care about that. */ ++ Path cur = worker.store.storeDir; ++ while (cur.compare("/") != 0) { ++ ancestry.insert(cur); ++ cur = dirOf(cur); ++ } + +- /* Violations will go to the syslog if you set this. Unfortunately the destination does not appear to be configurable */ +- if (settings.darwinLogSandboxViolations) { +- sandboxProfile += "(deny default)\n"; +- } else { +- sandboxProfile += "(deny default (with no-log))\n"; +- } ++ /* Add all our input paths to the chroot */ ++ for (auto & i : inputPaths) { ++ auto p = worker.store.printStorePath(i); ++ pathsInChroot[p] = p; ++ } ++ ++ /* Violations will go to the syslog if you set this. Unfortunately the destination does not appear to be configurable */ ++ if (settings.darwinLogSandboxViolations) { ++ sandboxProfile += "(deny default)\n"; ++ } else { ++ sandboxProfile += "(deny default (with no-log))\n"; ++ } + ++ sandboxProfile += ++ #include "sandbox-defaults.sb" ++ ; ++ ++ if (!derivationType->isSandboxed()) + sandboxProfile += +- #include "sandbox-defaults.sb" ++ #include "sandbox-network.sb" + ; + +- if (!derivationType->isSandboxed()) +- sandboxProfile += +- #include "sandbox-network.sb" +- ; +- +- /* Add the output paths we'll use at build-time to the chroot */ +- sandboxProfile += "(allow file-read* file-write* process-exec\n"; +- for (auto & [_, path] : scratchOutputs) +- sandboxProfile += fmt("\t(subpath \"%s\")\n", worker.store.printStorePath(path)); +- +- sandboxProfile += ")\n"; +- +- /* Our inputs (transitive dependencies and any impurities computed above) +- +- without file-write* allowed, access() incorrectly returns EPERM +- */ +- sandboxProfile += "(allow file-read* file-write* process-exec\n"; +- for (auto & i : pathsInChroot) { +- if (i.first != i.second.source) +- throw Error( +- "can't map '%1%' to '%2%': mismatched impure paths not supported on Darwin", +- i.first, i.second.source); +- +- std::string path = i.first; +- struct stat st; +- if (lstat(path.c_str(), &st)) { +- if (i.second.optional && errno == ENOENT) +- continue; +- throw SysError("getting attributes of path '%s", path); +- } +- if (S_ISDIR(st.st_mode)) +- sandboxProfile += fmt("\t(subpath \"%s\")\n", path); +- else +- sandboxProfile += fmt("\t(literal \"%s\")\n", path); +- } +- sandboxProfile += ")\n"; ++ /* Add the output paths we'll use at build-time to the chroot */ ++ sandboxProfile += "(allow file-read* file-write* process-exec\n"; ++ for (auto & [_, path] : scratchOutputs) ++ sandboxProfile += fmt("\t(subpath \"%s\")\n", worker.store.printStorePath(path)); + +- /* Allow file-read* on full directory hierarchy to self. Allows realpath() */ +- sandboxProfile += "(allow file-read*\n"; +- for (auto & i : ancestry) { +- sandboxProfile += fmt("\t(literal \"%s\")\n", i); +- } +- sandboxProfile += ")\n"; ++ sandboxProfile += ")\n"; + +- sandboxProfile += additionalSandboxProfile; +- } else +- sandboxProfile += +- #include "sandbox-minimal.sb" +- ; ++ /* Our inputs (transitive dependencies and any impurities computed above) ++ ++ without file-write* allowed, access() incorrectly returns EPERM ++ */ ++ sandboxProfile += "(allow file-read* file-write* process-exec\n"; ++ for (auto & i : pathsInChroot) { ++ if (i.first != i.second.source) ++ throw Error( ++ "can't map '%1%' to '%2%': mismatched impure paths not supported on Darwin", ++ i.first, i.second.source); ++ ++ std::string path = i.first; ++ struct stat st; ++ if (lstat(path.c_str(), &st)) { ++ if (i.second.optional && errno == ENOENT) ++ continue; ++ throw SysError("getting attributes of path '%s", path); ++ } ++ if (S_ISDIR(st.st_mode)) ++ sandboxProfile += fmt("\t(subpath \"%s\")\n", path); ++ else ++ sandboxProfile += fmt("\t(literal \"%s\")\n", path); ++ } ++ sandboxProfile += ")\n"; + +- debug("Generated sandbox profile:"); +- debug(sandboxProfile); ++ /* Allow file-read* on full directory hierarchy to self. Allows realpath() */ ++ sandboxProfile += "(allow file-read*\n"; ++ for (auto & i : ancestry) { ++ sandboxProfile += fmt("\t(literal \"%s\")\n", i); ++ } ++ sandboxProfile += ")\n"; + +- Path sandboxFile = tmpDir + "/.sandbox.sb"; ++ sandboxProfile += additionalSandboxProfile; ++ } else ++ sandboxProfile += ++ #include "sandbox-minimal.sb" ++ ; + +- writeFile(sandboxFile, sandboxProfile); ++ debug("Generated sandbox profile:"); ++ debug(sandboxProfile); + +- bool allowLocalNetworking = parsedDrv->getBoolAttr("__darwinAllowLocalNetworking"); ++ bool allowLocalNetworking = parsedDrv->getBoolAttr("__darwinAllowLocalNetworking"); + +- /* The tmpDir in scope points at the temporary build directory for our derivation. Some packages try different mechanisms +- to find temporary directories, so we want to open up a broader place for them to dump their files, if needed. */ +- Path globalTmpDir = canonPath(getEnvNonEmpty("TMPDIR").value_or("/tmp"), true); ++ /* The tmpDir in scope points at the temporary build directory for our derivation. Some packages try different mechanisms ++ to find temporary directories, so we want to open up a broader place for them to dump their files, if needed. */ ++ Path globalTmpDir = canonPath(getEnvNonEmpty("TMPDIR").value_or("/tmp"), true); + +- /* They don't like trailing slashes on subpath directives */ +- if (globalTmpDir.back() == '/') globalTmpDir.pop_back(); ++ /* They don't like trailing slashes on subpath directives */ ++ if (globalTmpDir.back() == '/') globalTmpDir.pop_back(); + +- if (getEnv("_NIX_TEST_NO_SANDBOX") != "1") { +- builder = "/usr/bin/sandbox-exec"; +- args.push_back("sandbox-exec"); +- args.push_back("-f"); +- args.push_back(sandboxFile); +- args.push_back("-D"); +- args.push_back("_GLOBAL_TMP_DIR=" + globalTmpDir); +- if (allowLocalNetworking) { +- args.push_back("-D"); +- args.push_back(std::string("_ALLOW_LOCAL_NETWORKING=1")); +- } +- args.push_back(drv->builder); +- } else { +- builder = drv->builder; +- args.push_back(std::string(baseNameOf(drv->builder))); ++ if (getEnv("_NIX_TEST_NO_SANDBOX") != "1") { ++ Strings sandboxArgs; ++ sandboxArgs.push_back("_GLOBAL_TMP_DIR"); ++ sandboxArgs.push_back(globalTmpDir); ++ if (allowLocalNetworking) { ++ sandboxArgs.push_back("_ALLOW_LOCAL_NETWORKING"); ++ sandboxArgs.push_back("1"); ++ } ++ if (sandbox_init_with_parameters(sandboxProfile.c_str(), 0, stringsToCharPtrs(sandboxArgs).data(), NULL)) { ++ writeFull(STDERR_FILENO, "failed to configure sandbox\n"); ++ _exit(1); + } + } ++ ++ builder = drv->builder; ++ args.push_back(std::string(baseNameOf(drv->builder))); + #else +- else { ++ if (!drv->isBuiltin()) { + builder = drv->builder; + args.push_back(std::string(baseNameOf(drv->builder))); + } +-- +2.46.1 + diff --git a/pkgs/tools/package-management/nix/patches/2_21/0002-local-derivation-goal-Print-sandbox-error-detail-on-.patch b/pkgs/tools/package-management/nix/patches/2_21/0002-local-derivation-goal-Print-sandbox-error-detail-on-.patch new file mode 100644 index 000000000000..053d3eb672d9 --- /dev/null +++ b/pkgs/tools/package-management/nix/patches/2_21/0002-local-derivation-goal-Print-sandbox-error-detail-on-.patch @@ -0,0 +1,34 @@ +From b429e96583e2d005c77df8c82261022397f20648 Mon Sep 17 00:00:00 2001 +From: Robert Hensing +Date: Thu, 3 Oct 2024 12:44:12 +0200 +Subject: [PATCH 2/4] local-derivation-goal: Print sandbox error detail on + darwin +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Co-Authored-By: Théophane Hufschmitt +Signed-off-by: Jörg Thalheim +--- + src/libstore/build/local-derivation-goal.cc | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/src/libstore/build/local-derivation-goal.cc b/src/libstore/build/local-derivation-goal.cc +index c73b30b80..e6f4c397d 100644 +--- a/src/libstore/build/local-derivation-goal.cc ++++ b/src/libstore/build/local-derivation-goal.cc +@@ -2137,8 +2137,9 @@ void LocalDerivationGoal::runChild() + sandboxArgs.push_back("_ALLOW_LOCAL_NETWORKING"); + sandboxArgs.push_back("1"); + } +- if (sandbox_init_with_parameters(sandboxProfile.c_str(), 0, stringsToCharPtrs(sandboxArgs).data(), NULL)) { +- writeFull(STDERR_FILENO, "failed to configure sandbox\n"); ++ char * sandbox_errbuf = nullptr; ++ if (sandbox_init_with_parameters(sandboxProfile.c_str(), 0, stringsToCharPtrs(sandboxArgs).data(), &sandbox_errbuf)) { ++ writeFull(STDERR_FILENO, fmt("failed to configure sandbox: %s\n", sandbox_errbuf ? sandbox_errbuf : "(null)")); + _exit(1); + } + } +-- +2.46.1 + diff --git a/pkgs/tools/package-management/nix/patches/2_21/0003-local-derivation-goal-Refactor.patch b/pkgs/tools/package-management/nix/patches/2_21/0003-local-derivation-goal-Refactor.patch new file mode 100644 index 000000000000..97809a556b57 --- /dev/null +++ b/pkgs/tools/package-management/nix/patches/2_21/0003-local-derivation-goal-Refactor.patch @@ -0,0 +1,41 @@ +From 74b93c1edba00c2601e20b8acdcc78e29bd3f092 Mon Sep 17 00:00:00 2001 +From: Robert Hensing +Date: Thu, 3 Oct 2024 12:50:27 +0200 +Subject: [PATCH 3/4] local-derivation-goal: Refactor +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +This works because the `builder` and `args` variables are only used +in the non-builtin code path. + +Co-Authored-By: Théophane Hufschmitt +Signed-off-by: Jörg Thalheim +--- + src/libstore/build/local-derivation-goal.cc | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +diff --git a/src/libstore/build/local-derivation-goal.cc b/src/libstore/build/local-derivation-goal.cc +index e6f4c397d..e81818fa8 100644 +--- a/src/libstore/build/local-derivation-goal.cc ++++ b/src/libstore/build/local-derivation-goal.cc +@@ -2143,15 +2143,12 @@ void LocalDerivationGoal::runChild() + _exit(1); + } + } ++#endif + +- builder = drv->builder; +- args.push_back(std::string(baseNameOf(drv->builder))); +-#else + if (!drv->isBuiltin()) { + builder = drv->builder; + args.push_back(std::string(baseNameOf(drv->builder))); + } +-#endif + + for (auto & i : drv->args) + args.push_back(rewriteStrings(i, inputRewrites)); +-- +2.46.1 + diff --git a/pkgs/tools/package-management/nix/patches/2_21/0004-local-derivation-goal-Move-builder-preparation-to-no.patch b/pkgs/tools/package-management/nix/patches/2_21/0004-local-derivation-goal-Move-builder-preparation-to-no.patch new file mode 100644 index 000000000000..b2f3b2b7815c --- /dev/null +++ b/pkgs/tools/package-management/nix/patches/2_21/0004-local-derivation-goal-Move-builder-preparation-to-no.patch @@ -0,0 +1,75 @@ +From c8de35f74cbce58651c3b64ba66061040f546b9f Mon Sep 17 00:00:00 2001 +From: Robert Hensing +Date: Thu, 3 Oct 2024 12:57:00 +0200 +Subject: [PATCH 4/4] local-derivation-goal: Move builder preparation to + non-builtin code path +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Signed-off-by: Jörg Thalheim +--- + src/libstore/build/local-derivation-goal.cc | 25 +++++++++------------ + 1 file changed, 10 insertions(+), 15 deletions(-) + +diff --git a/src/libstore/build/local-derivation-goal.cc b/src/libstore/build/local-derivation-goal.cc +index e81818fa8..078f1a5be 100644 +--- a/src/libstore/build/local-derivation-goal.cc ++++ b/src/libstore/build/local-derivation-goal.cc +@@ -2017,11 +2017,6 @@ void LocalDerivationGoal::runChild() + throw SysError("setuid failed"); + } + +- /* Fill in the arguments. */ +- Strings args; +- +- std::string builder = "invalid"; +- + #if __APPLE__ + /* This has to appear before import statements. */ + std::string sandboxProfile = "(version 1)\n"; +@@ -2145,14 +2140,6 @@ void LocalDerivationGoal::runChild() + } + #endif + +- if (!drv->isBuiltin()) { +- builder = drv->builder; +- args.push_back(std::string(baseNameOf(drv->builder))); +- } +- +- for (auto & i : drv->args) +- args.push_back(rewriteStrings(i, inputRewrites)); +- + /* Indicate that we managed to set up the build environment. */ + writeFull(STDERR_FILENO, std::string("\2\n")); + +@@ -2183,6 +2170,14 @@ void LocalDerivationGoal::runChild() + } + } + ++ // Now builder is not builtin ++ ++ Strings args; ++ args.push_back(std::string(baseNameOf(drv->builder))); ++ ++ for (auto & i : drv->args) ++ args.push_back(rewriteStrings(i, inputRewrites)); ++ + #if __APPLE__ + posix_spawnattr_t attrp; + +@@ -2204,9 +2199,9 @@ void LocalDerivationGoal::runChild() + posix_spawnattr_setbinpref_np(&attrp, 1, &cpu, NULL); + } + +- posix_spawn(NULL, builder.c_str(), NULL, &attrp, stringsToCharPtrs(args).data(), stringsToCharPtrs(envStrs).data()); ++ posix_spawn(NULL, drv->builder.c_str(), NULL, &attrp, stringsToCharPtrs(args).data(), stringsToCharPtrs(envStrs).data()); + #else +- execve(builder.c_str(), stringsToCharPtrs(args).data(), stringsToCharPtrs(envStrs).data()); ++ execve(drv->builder.c_str(), stringsToCharPtrs(args).data(), stringsToCharPtrs(envStrs).data()); + #endif + + throw SysError("executing '%1%'", drv->builder); +-- +2.46.1 + diff --git a/pkgs/tools/package-management/nix/patches/2_22/0001-fix-Run-all-derivation-builders-inside-the-sandbox-o.patch b/pkgs/tools/package-management/nix/patches/2_22/0001-fix-Run-all-derivation-builders-inside-the-sandbox-o.patch new file mode 100644 index 000000000000..72470dec5fd2 --- /dev/null +++ b/pkgs/tools/package-management/nix/patches/2_22/0001-fix-Run-all-derivation-builders-inside-the-sandbox-o.patch @@ -0,0 +1,327 @@ +From 8217054e3554ffd376f42fb0a65087a7af2ddfab Mon Sep 17 00:00:00 2001 +From: Puck Meerburg +Date: Fri, 1 Mar 2024 11:42:24 -0500 +Subject: [PATCH 1/4] fix: Run all derivation builders inside the sandbox on + macOS +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Signed-off-by: Jörg Thalheim +--- + configure.ac | 6 +- + package.nix | 5 +- + .../unix/build/local-derivation-goal.cc | 223 +++++++++--------- + 3 files changed, 118 insertions(+), 116 deletions(-) + +diff --git a/configure.ac b/configure.ac +index 8f60bf4be..5e67e04be 100644 +--- a/configure.ac ++++ b/configure.ac +@@ -62,13 +62,17 @@ AC_CHECK_TOOL([AR], [ar]) + AC_SYS_LARGEFILE + + +-# Solaris-specific stuff. ++# OS-specific stuff. + AC_STRUCT_DIRENT_D_TYPE + case "$host_os" in + solaris*) + # Solaris requires -lsocket -lnsl for network functions + LDFLAGS="-lsocket -lnsl $LDFLAGS" + ;; ++ darwin*) ++ # Need to link to libsandbox. ++ LDFLAGS="-lsandbox $LDFLAGS" ++ ;; + esac + + +diff --git a/package.nix b/package.nix +index 59265f522..28be97400 100644 +--- a/package.nix ++++ b/package.nix +@@ -27,6 +27,7 @@ + , libseccomp + , libsodium + , man ++, darwin + , lowdown + , mdbook + , mdbook-linkcheck +@@ -249,7 +250,9 @@ in { + ] ++ lib.optionals buildUnitTests [ + gtest + rapidcheck +- ] ++ lib.optional stdenv.isLinux (libseccomp.overrideAttrs (_: rec { ++ ] ++ ++ lib.optional stdenv.hostPlatform.isDarwin darwin.apple_sdk.libs.sandbox ++ ++ lib.optional stdenv.isLinux (libseccomp.overrideAttrs (_: rec { + version = "2.5.5"; + src = fetchurl { + url = "https://github.com/seccomp/libseccomp/releases/download/v${version}/libseccomp-${version}.tar.gz"; +diff --git a/src/libstore/unix/build/local-derivation-goal.cc b/src/libstore/unix/build/local-derivation-goal.cc +index b8ccdf834..449d4b07c 100644 +--- a/src/libstore/unix/build/local-derivation-goal.cc ++++ b/src/libstore/unix/build/local-derivation-goal.cc +@@ -58,6 +58,10 @@ + #if __APPLE__ + #include + #include ++#include ++ ++/* This definition is undocumented but depended upon by all major browsers. */ ++extern "C" int sandbox_init_with_parameters(const char *profile, uint64_t flags, const char *const parameters[], char **errorbuf); + #endif + + #include +@@ -2026,141 +2030,132 @@ void LocalDerivationGoal::runChild() + + std::string builder = "invalid"; + +- if (drv->isBuiltin()) { +- ; +- } + #if __APPLE__ +- else { +- /* This has to appear before import statements. */ +- std::string sandboxProfile = "(version 1)\n"; +- +- if (useChroot) { +- +- /* Lots and lots and lots of file functions freak out if they can't stat their full ancestry */ +- PathSet ancestry; +- +- /* We build the ancestry before adding all inputPaths to the store because we know they'll +- all have the same parents (the store), and there might be lots of inputs. This isn't +- particularly efficient... I doubt it'll be a bottleneck in practice */ +- for (auto & i : pathsInChroot) { +- Path cur = i.first; +- while (cur.compare("/") != 0) { +- cur = dirOf(cur); +- ancestry.insert(cur); +- } +- } ++ /* This has to appear before import statements. */ ++ std::string sandboxProfile = "(version 1)\n"; ++ ++ if (useChroot) { + +- /* And we want the store in there regardless of how empty pathsInChroot. We include the innermost +- path component this time, since it's typically /nix/store and we care about that. */ +- Path cur = worker.store.storeDir; ++ /* Lots and lots and lots of file functions freak out if they can't stat their full ancestry */ ++ PathSet ancestry; ++ ++ /* We build the ancestry before adding all inputPaths to the store because we know they'll ++ all have the same parents (the store), and there might be lots of inputs. This isn't ++ particularly efficient... I doubt it'll be a bottleneck in practice */ ++ for (auto & i : pathsInChroot) { ++ Path cur = i.first; + while (cur.compare("/") != 0) { +- ancestry.insert(cur); + cur = dirOf(cur); ++ ancestry.insert(cur); + } ++ } + +- /* Add all our input paths to the chroot */ +- for (auto & i : inputPaths) { +- auto p = worker.store.printStorePath(i); +- pathsInChroot[p] = p; +- } +- +- /* Violations will go to the syslog if you set this. Unfortunately the destination does not appear to be configurable */ +- if (settings.darwinLogSandboxViolations) { +- sandboxProfile += "(deny default)\n"; +- } else { +- sandboxProfile += "(deny default (with no-log))\n"; +- } ++ /* And we want the store in there regardless of how empty pathsInChroot. We include the innermost ++ path component this time, since it's typically /nix/store and we care about that. */ ++ Path cur = worker.store.storeDir; ++ while (cur.compare("/") != 0) { ++ ancestry.insert(cur); ++ cur = dirOf(cur); ++ } + +- sandboxProfile += +- #include "sandbox-defaults.sb" +- ; ++ /* Add all our input paths to the chroot */ ++ for (auto & i : inputPaths) { ++ auto p = worker.store.printStorePath(i); ++ pathsInChroot[p] = p; ++ } + +- if (!derivationType->isSandboxed()) +- sandboxProfile += +- #include "sandbox-network.sb" +- ; +- +- /* Add the output paths we'll use at build-time to the chroot */ +- sandboxProfile += "(allow file-read* file-write* process-exec\n"; +- for (auto & [_, path] : scratchOutputs) +- sandboxProfile += fmt("\t(subpath \"%s\")\n", worker.store.printStorePath(path)); +- +- sandboxProfile += ")\n"; +- +- /* Our inputs (transitive dependencies and any impurities computed above) +- +- without file-write* allowed, access() incorrectly returns EPERM +- */ +- sandboxProfile += "(allow file-read* file-write* process-exec\n"; +- for (auto & i : pathsInChroot) { +- if (i.first != i.second.source) +- throw Error( +- "can't map '%1%' to '%2%': mismatched impure paths not supported on Darwin", +- i.first, i.second.source); +- +- std::string path = i.first; +- auto optSt = maybeLstat(path.c_str()); +- if (!optSt) { +- if (i.second.optional) +- continue; +- throw SysError("getting attributes of required path '%s", path); +- } +- if (S_ISDIR(optSt->st_mode)) +- sandboxProfile += fmt("\t(subpath \"%s\")\n", path); +- else +- sandboxProfile += fmt("\t(literal \"%s\")\n", path); +- } +- sandboxProfile += ")\n"; ++ /* Violations will go to the syslog if you set this. Unfortunately the destination does not appear to be configurable */ ++ if (settings.darwinLogSandboxViolations) { ++ sandboxProfile += "(deny default)\n"; ++ } else { ++ sandboxProfile += "(deny default (with no-log))\n"; ++ } + +- /* Allow file-read* on full directory hierarchy to self. Allows realpath() */ +- sandboxProfile += "(allow file-read*\n"; +- for (auto & i : ancestry) { +- sandboxProfile += fmt("\t(literal \"%s\")\n", i); +- } +- sandboxProfile += ")\n"; ++ sandboxProfile += ++ #include "sandbox-defaults.sb" ++ ; + +- sandboxProfile += additionalSandboxProfile; +- } else ++ if (!derivationType->isSandboxed()) + sandboxProfile += +- #include "sandbox-minimal.sb" ++ #include "sandbox-network.sb" + ; + +- debug("Generated sandbox profile:"); +- debug(sandboxProfile); +- +- Path sandboxFile = tmpDir + "/.sandbox.sb"; ++ /* Add the output paths we'll use at build-time to the chroot */ ++ sandboxProfile += "(allow file-read* file-write* process-exec\n"; ++ for (auto & [_, path] : scratchOutputs) ++ sandboxProfile += fmt("\t(subpath \"%s\")\n", worker.store.printStorePath(path)); + +- writeFile(sandboxFile, sandboxProfile); ++ sandboxProfile += ")\n"; + +- bool allowLocalNetworking = parsedDrv->getBoolAttr("__darwinAllowLocalNetworking"); ++ /* Our inputs (transitive dependencies and any impurities computed above) + +- /* The tmpDir in scope points at the temporary build directory for our derivation. Some packages try different mechanisms +- to find temporary directories, so we want to open up a broader place for them to put their files, if needed. */ +- Path globalTmpDir = canonPath(defaultTempDir(), true); ++ without file-write* allowed, access() incorrectly returns EPERM ++ */ ++ sandboxProfile += "(allow file-read* file-write* process-exec\n"; ++ for (auto & i : pathsInChroot) { ++ if (i.first != i.second.source) ++ throw Error( ++ "can't map '%1%' to '%2%': mismatched impure paths not supported on Darwin", ++ i.first, i.second.source); ++ ++ std::string path = i.first; ++ auto optSt = maybeLstat(path.c_str()); ++ if (!optSt) { ++ if (i.second.optional) ++ continue; ++ throw SysError("getting attributes of required path '%s", path); ++ } ++ if (S_ISDIR(optSt->st_mode)) ++ sandboxProfile += fmt("\t(subpath \"%s\")\n", path); ++ else ++ sandboxProfile += fmt("\t(literal \"%s\")\n", path); ++ } ++ sandboxProfile += ")\n"; + +- /* They don't like trailing slashes on subpath directives */ +- while (!globalTmpDir.empty() && globalTmpDir.back() == '/') +- globalTmpDir.pop_back(); ++ /* Allow file-read* on full directory hierarchy to self. Allows realpath() */ ++ sandboxProfile += "(allow file-read*\n"; ++ for (auto & i : ancestry) { ++ sandboxProfile += fmt("\t(literal \"%s\")\n", i); ++ } ++ sandboxProfile += ")\n"; + +- if (getEnv("_NIX_TEST_NO_SANDBOX") != "1") { +- builder = "/usr/bin/sandbox-exec"; +- args.push_back("sandbox-exec"); +- args.push_back("-f"); +- args.push_back(sandboxFile); +- args.push_back("-D"); +- args.push_back("_GLOBAL_TMP_DIR=" + globalTmpDir); +- if (allowLocalNetworking) { +- args.push_back("-D"); +- args.push_back(std::string("_ALLOW_LOCAL_NETWORKING=1")); +- } +- args.push_back(drv->builder); +- } else { +- builder = drv->builder; +- args.push_back(std::string(baseNameOf(drv->builder))); ++ sandboxProfile += additionalSandboxProfile; ++ } else ++ sandboxProfile += ++ #include "sandbox-minimal.sb" ++ ; ++ ++ debug("Generated sandbox profile:"); ++ debug(sandboxProfile); ++ ++ bool allowLocalNetworking = parsedDrv->getBoolAttr("__darwinAllowLocalNetworking"); ++ ++ /* The tmpDir in scope points at the temporary build directory for our derivation. Some packages try different mechanisms ++ to find temporary directories, so we want to open up a broader place for them to put their files, if needed. */ ++ Path globalTmpDir = canonPath(defaultTempDir(), true); ++ ++ /* They don't like trailing slashes on subpath directives */ ++ while (!globalTmpDir.empty() && globalTmpDir.back() == '/') ++ globalTmpDir.pop_back(); ++ ++ if (getEnv("_NIX_TEST_NO_SANDBOX") != "1") { ++ Strings sandboxArgs; ++ sandboxArgs.push_back("_GLOBAL_TMP_DIR"); ++ sandboxArgs.push_back(globalTmpDir); ++ if (allowLocalNetworking) { ++ sandboxArgs.push_back("_ALLOW_LOCAL_NETWORKING"); ++ sandboxArgs.push_back("1"); ++ } ++ if (sandbox_init_with_parameters(sandboxProfile.c_str(), 0, stringsToCharPtrs(sandboxArgs).data(), NULL)) { ++ writeFull(STDERR_FILENO, "failed to configure sandbox\n"); ++ _exit(1); + } + } ++ ++ builder = drv->builder; ++ args.push_back(std::string(baseNameOf(drv->builder))); + #else +- else { ++ if (!drv->isBuiltin()) { + builder = drv->builder; + args.push_back(std::string(baseNameOf(drv->builder))); + } +-- +2.46.1 + diff --git a/pkgs/tools/package-management/nix/patches/2_22/0002-local-derivation-goal-Print-sandbox-error-detail-on-.patch b/pkgs/tools/package-management/nix/patches/2_22/0002-local-derivation-goal-Print-sandbox-error-detail-on-.patch new file mode 100644 index 000000000000..6ac281e6316c --- /dev/null +++ b/pkgs/tools/package-management/nix/patches/2_22/0002-local-derivation-goal-Print-sandbox-error-detail-on-.patch @@ -0,0 +1,34 @@ +From f0677f190d0bd042c3a864508a5307b19a2c2d26 Mon Sep 17 00:00:00 2001 +From: Robert Hensing +Date: Thu, 3 Oct 2024 12:44:12 +0200 +Subject: [PATCH 2/4] local-derivation-goal: Print sandbox error detail on + darwin +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Co-Authored-By: Théophane Hufschmitt +Signed-off-by: Jörg Thalheim +--- + src/libstore/unix/build/local-derivation-goal.cc | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/src/libstore/unix/build/local-derivation-goal.cc b/src/libstore/unix/build/local-derivation-goal.cc +index 449d4b07c..b74bd2e64 100644 +--- a/src/libstore/unix/build/local-derivation-goal.cc ++++ b/src/libstore/unix/build/local-derivation-goal.cc +@@ -2146,8 +2146,9 @@ void LocalDerivationGoal::runChild() + sandboxArgs.push_back("_ALLOW_LOCAL_NETWORKING"); + sandboxArgs.push_back("1"); + } +- if (sandbox_init_with_parameters(sandboxProfile.c_str(), 0, stringsToCharPtrs(sandboxArgs).data(), NULL)) { +- writeFull(STDERR_FILENO, "failed to configure sandbox\n"); ++ char * sandbox_errbuf = nullptr; ++ if (sandbox_init_with_parameters(sandboxProfile.c_str(), 0, stringsToCharPtrs(sandboxArgs).data(), &sandbox_errbuf)) { ++ writeFull(STDERR_FILENO, fmt("failed to configure sandbox: %s\n", sandbox_errbuf ? sandbox_errbuf : "(null)")); + _exit(1); + } + } +-- +2.46.1 + diff --git a/pkgs/tools/package-management/nix/patches/2_22/0003-local-derivation-goal-Refactor.patch b/pkgs/tools/package-management/nix/patches/2_22/0003-local-derivation-goal-Refactor.patch new file mode 100644 index 000000000000..dfb5add1978d --- /dev/null +++ b/pkgs/tools/package-management/nix/patches/2_22/0003-local-derivation-goal-Refactor.patch @@ -0,0 +1,41 @@ +From 1b39753f4d63465c709d18482945ce680b6f3f1e Mon Sep 17 00:00:00 2001 +From: Robert Hensing +Date: Thu, 3 Oct 2024 12:50:27 +0200 +Subject: [PATCH 3/4] local-derivation-goal: Refactor +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +This works because the `builder` and `args` variables are only used +in the non-builtin code path. + +Co-Authored-By: Théophane Hufschmitt +Signed-off-by: Jörg Thalheim +--- + src/libstore/unix/build/local-derivation-goal.cc | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +diff --git a/src/libstore/unix/build/local-derivation-goal.cc b/src/libstore/unix/build/local-derivation-goal.cc +index b74bd2e64..9b8b3c51b 100644 +--- a/src/libstore/unix/build/local-derivation-goal.cc ++++ b/src/libstore/unix/build/local-derivation-goal.cc +@@ -2152,15 +2152,12 @@ void LocalDerivationGoal::runChild() + _exit(1); + } + } ++#endif + +- builder = drv->builder; +- args.push_back(std::string(baseNameOf(drv->builder))); +-#else + if (!drv->isBuiltin()) { + builder = drv->builder; + args.push_back(std::string(baseNameOf(drv->builder))); + } +-#endif + + for (auto & i : drv->args) + args.push_back(rewriteStrings(i, inputRewrites)); +-- +2.46.1 + diff --git a/pkgs/tools/package-management/nix/patches/2_22/0004-local-derivation-goal-Move-builder-preparation-to-no.patch b/pkgs/tools/package-management/nix/patches/2_22/0004-local-derivation-goal-Move-builder-preparation-to-no.patch new file mode 100644 index 000000000000..8e200685dc73 --- /dev/null +++ b/pkgs/tools/package-management/nix/patches/2_22/0004-local-derivation-goal-Move-builder-preparation-to-no.patch @@ -0,0 +1,75 @@ +From 9e198a75f76ac08f835975d4b2743e156616a219 Mon Sep 17 00:00:00 2001 +From: Robert Hensing +Date: Thu, 3 Oct 2024 12:57:00 +0200 +Subject: [PATCH 4/4] local-derivation-goal: Move builder preparation to + non-builtin code path +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Signed-off-by: Jörg Thalheim +--- + .../unix/build/local-derivation-goal.cc | 25 ++++++++----------- + 1 file changed, 10 insertions(+), 15 deletions(-) + +diff --git a/src/libstore/unix/build/local-derivation-goal.cc b/src/libstore/unix/build/local-derivation-goal.cc +index 9b8b3c51b..08366712c 100644 +--- a/src/libstore/unix/build/local-derivation-goal.cc ++++ b/src/libstore/unix/build/local-derivation-goal.cc +@@ -2025,11 +2025,6 @@ void LocalDerivationGoal::runChild() + throw SysError("setuid failed"); + } + +- /* Fill in the arguments. */ +- Strings args; +- +- std::string builder = "invalid"; +- + #if __APPLE__ + /* This has to appear before import statements. */ + std::string sandboxProfile = "(version 1)\n"; +@@ -2154,14 +2149,6 @@ void LocalDerivationGoal::runChild() + } + #endif + +- if (!drv->isBuiltin()) { +- builder = drv->builder; +- args.push_back(std::string(baseNameOf(drv->builder))); +- } +- +- for (auto & i : drv->args) +- args.push_back(rewriteStrings(i, inputRewrites)); +- + /* Indicate that we managed to set up the build environment. */ + writeFull(STDERR_FILENO, std::string("\2\n")); + +@@ -2192,6 +2179,14 @@ void LocalDerivationGoal::runChild() + } + } + ++ // Now builder is not builtin ++ ++ Strings args; ++ args.push_back(std::string(baseNameOf(drv->builder))); ++ ++ for (auto & i : drv->args) ++ args.push_back(rewriteStrings(i, inputRewrites)); ++ + #if __APPLE__ + posix_spawnattr_t attrp; + +@@ -2213,9 +2208,9 @@ void LocalDerivationGoal::runChild() + posix_spawnattr_setbinpref_np(&attrp, 1, &cpu, NULL); + } + +- posix_spawn(NULL, builder.c_str(), NULL, &attrp, stringsToCharPtrs(args).data(), stringsToCharPtrs(envStrs).data()); ++ posix_spawn(NULL, drv->builder.c_str(), NULL, &attrp, stringsToCharPtrs(args).data(), stringsToCharPtrs(envStrs).data()); + #else +- execve(builder.c_str(), stringsToCharPtrs(args).data(), stringsToCharPtrs(envStrs).data()); ++ execve(drv->builder.c_str(), stringsToCharPtrs(args).data(), stringsToCharPtrs(envStrs).data()); + #endif + + throw SysError("executing '%1%'", drv->builder); +-- +2.46.1 + diff --git a/pkgs/tools/package-management/nix/patches/2_23/0001-fix-Run-all-derivation-builders-inside-the-sandbox-o.patch b/pkgs/tools/package-management/nix/patches/2_23/0001-fix-Run-all-derivation-builders-inside-the-sandbox-o.patch new file mode 100644 index 000000000000..f309ff6818d4 --- /dev/null +++ b/pkgs/tools/package-management/nix/patches/2_23/0001-fix-Run-all-derivation-builders-inside-the-sandbox-o.patch @@ -0,0 +1,323 @@ +From 05994033d58e358ddafe51d1d04626eb76b8a192 Mon Sep 17 00:00:00 2001 +From: Puck Meerburg +Date: Fri, 1 Mar 2024 11:42:24 -0500 +Subject: [PATCH 1/4] fix: Run all derivation builders inside the sandbox on + macOS +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Signed-off-by: Jörg Thalheim +--- + configure.ac | 6 +- + package.nix | 2 + + .../unix/build/local-derivation-goal.cc | 223 +++++++++--------- + 3 files changed, 116 insertions(+), 115 deletions(-) + +diff --git a/configure.ac b/configure.ac +index 90a6d45d5..f98a0a5ea 100644 +--- a/configure.ac ++++ b/configure.ac +@@ -62,12 +62,16 @@ AC_CHECK_TOOL([AR], [ar]) + AC_SYS_LARGEFILE + + +-# Solaris-specific stuff. ++# OS-specific stuff. + case "$host_os" in + solaris*) + # Solaris requires -lsocket -lnsl for network functions + LDFLAGS="-lsocket -lnsl $LDFLAGS" + ;; ++ darwin*) ++ # Need to link to libsandbox. ++ LDFLAGS="-lsandbox $LDFLAGS" ++ ;; + esac + + +diff --git a/package.nix b/package.nix +index cf1654c6a..1dfe7ab31 100644 +--- a/package.nix ++++ b/package.nix +@@ -27,6 +27,7 @@ + , libseccomp + , libsodium + , man ++, darwin + , lowdown + , mdbook + , mdbook-linkcheck +@@ -250,6 +251,7 @@ in { + gtest + rapidcheck + ] ++ lib.optional stdenv.isLinux libseccomp ++ ++ lib.optional stdenv.hostPlatform.isDarwin darwin.apple_sdk.libs.sandbox + ++ lib.optional stdenv.hostPlatform.isx86_64 libcpuid + # There have been issues building these dependencies + ++ lib.optional (stdenv.hostPlatform == stdenv.buildPlatform && (stdenv.isLinux || stdenv.isDarwin)) +diff --git a/src/libstore/unix/build/local-derivation-goal.cc b/src/libstore/unix/build/local-derivation-goal.cc +index ae9c715d6..878644fa5 100644 +--- a/src/libstore/unix/build/local-derivation-goal.cc ++++ b/src/libstore/unix/build/local-derivation-goal.cc +@@ -58,6 +58,10 @@ + #if __APPLE__ + #include + #include ++#include ++ ++/* This definition is undocumented but depended upon by all major browsers. */ ++extern "C" int sandbox_init_with_parameters(const char *profile, uint64_t flags, const char *const parameters[], char **errorbuf); + #endif + + #include +@@ -2017,141 +2021,132 @@ void LocalDerivationGoal::runChild() + + std::string builder = "invalid"; + +- if (drv->isBuiltin()) { +- ; +- } + #if __APPLE__ +- else { +- /* This has to appear before import statements. */ +- std::string sandboxProfile = "(version 1)\n"; +- +- if (useChroot) { +- +- /* Lots and lots and lots of file functions freak out if they can't stat their full ancestry */ +- PathSet ancestry; +- +- /* We build the ancestry before adding all inputPaths to the store because we know they'll +- all have the same parents (the store), and there might be lots of inputs. This isn't +- particularly efficient... I doubt it'll be a bottleneck in practice */ +- for (auto & i : pathsInChroot) { +- Path cur = i.first; +- while (cur.compare("/") != 0) { +- cur = dirOf(cur); +- ancestry.insert(cur); +- } +- } ++ /* This has to appear before import statements. */ ++ std::string sandboxProfile = "(version 1)\n"; ++ ++ if (useChroot) { + +- /* And we want the store in there regardless of how empty pathsInChroot. We include the innermost +- path component this time, since it's typically /nix/store and we care about that. */ +- Path cur = worker.store.storeDir; ++ /* Lots and lots and lots of file functions freak out if they can't stat their full ancestry */ ++ PathSet ancestry; ++ ++ /* We build the ancestry before adding all inputPaths to the store because we know they'll ++ all have the same parents (the store), and there might be lots of inputs. This isn't ++ particularly efficient... I doubt it'll be a bottleneck in practice */ ++ for (auto & i : pathsInChroot) { ++ Path cur = i.first; + while (cur.compare("/") != 0) { +- ancestry.insert(cur); + cur = dirOf(cur); ++ ancestry.insert(cur); + } ++ } + +- /* Add all our input paths to the chroot */ +- for (auto & i : inputPaths) { +- auto p = worker.store.printStorePath(i); +- pathsInChroot[p] = p; +- } +- +- /* Violations will go to the syslog if you set this. Unfortunately the destination does not appear to be configurable */ +- if (settings.darwinLogSandboxViolations) { +- sandboxProfile += "(deny default)\n"; +- } else { +- sandboxProfile += "(deny default (with no-log))\n"; +- } ++ /* And we want the store in there regardless of how empty pathsInChroot. We include the innermost ++ path component this time, since it's typically /nix/store and we care about that. */ ++ Path cur = worker.store.storeDir; ++ while (cur.compare("/") != 0) { ++ ancestry.insert(cur); ++ cur = dirOf(cur); ++ } + +- sandboxProfile += +- #include "sandbox-defaults.sb" +- ; ++ /* Add all our input paths to the chroot */ ++ for (auto & i : inputPaths) { ++ auto p = worker.store.printStorePath(i); ++ pathsInChroot[p] = p; ++ } + +- if (!derivationType->isSandboxed()) +- sandboxProfile += +- #include "sandbox-network.sb" +- ; +- +- /* Add the output paths we'll use at build-time to the chroot */ +- sandboxProfile += "(allow file-read* file-write* process-exec\n"; +- for (auto & [_, path] : scratchOutputs) +- sandboxProfile += fmt("\t(subpath \"%s\")\n", worker.store.printStorePath(path)); +- +- sandboxProfile += ")\n"; +- +- /* Our inputs (transitive dependencies and any impurities computed above) +- +- without file-write* allowed, access() incorrectly returns EPERM +- */ +- sandboxProfile += "(allow file-read* file-write* process-exec\n"; +- for (auto & i : pathsInChroot) { +- if (i.first != i.second.source) +- throw Error( +- "can't map '%1%' to '%2%': mismatched impure paths not supported on Darwin", +- i.first, i.second.source); +- +- std::string path = i.first; +- auto optSt = maybeLstat(path.c_str()); +- if (!optSt) { +- if (i.second.optional) +- continue; +- throw SysError("getting attributes of required path '%s", path); +- } +- if (S_ISDIR(optSt->st_mode)) +- sandboxProfile += fmt("\t(subpath \"%s\")\n", path); +- else +- sandboxProfile += fmt("\t(literal \"%s\")\n", path); +- } +- sandboxProfile += ")\n"; ++ /* Violations will go to the syslog if you set this. Unfortunately the destination does not appear to be configurable */ ++ if (settings.darwinLogSandboxViolations) { ++ sandboxProfile += "(deny default)\n"; ++ } else { ++ sandboxProfile += "(deny default (with no-log))\n"; ++ } + +- /* Allow file-read* on full directory hierarchy to self. Allows realpath() */ +- sandboxProfile += "(allow file-read*\n"; +- for (auto & i : ancestry) { +- sandboxProfile += fmt("\t(literal \"%s\")\n", i); +- } +- sandboxProfile += ")\n"; ++ sandboxProfile += ++ #include "sandbox-defaults.sb" ++ ; + +- sandboxProfile += additionalSandboxProfile; +- } else ++ if (!derivationType->isSandboxed()) + sandboxProfile += +- #include "sandbox-minimal.sb" ++ #include "sandbox-network.sb" + ; + +- debug("Generated sandbox profile:"); +- debug(sandboxProfile); +- +- Path sandboxFile = tmpDir + "/.sandbox.sb"; ++ /* Add the output paths we'll use at build-time to the chroot */ ++ sandboxProfile += "(allow file-read* file-write* process-exec\n"; ++ for (auto & [_, path] : scratchOutputs) ++ sandboxProfile += fmt("\t(subpath \"%s\")\n", worker.store.printStorePath(path)); + +- writeFile(sandboxFile, sandboxProfile); ++ sandboxProfile += ")\n"; + +- bool allowLocalNetworking = parsedDrv->getBoolAttr("__darwinAllowLocalNetworking"); ++ /* Our inputs (transitive dependencies and any impurities computed above) + +- /* The tmpDir in scope points at the temporary build directory for our derivation. Some packages try different mechanisms +- to find temporary directories, so we want to open up a broader place for them to put their files, if needed. */ +- Path globalTmpDir = canonPath(defaultTempDir(), true); ++ without file-write* allowed, access() incorrectly returns EPERM ++ */ ++ sandboxProfile += "(allow file-read* file-write* process-exec\n"; ++ for (auto & i : pathsInChroot) { ++ if (i.first != i.second.source) ++ throw Error( ++ "can't map '%1%' to '%2%': mismatched impure paths not supported on Darwin", ++ i.first, i.second.source); ++ ++ std::string path = i.first; ++ auto optSt = maybeLstat(path.c_str()); ++ if (!optSt) { ++ if (i.second.optional) ++ continue; ++ throw SysError("getting attributes of required path '%s", path); ++ } ++ if (S_ISDIR(optSt->st_mode)) ++ sandboxProfile += fmt("\t(subpath \"%s\")\n", path); ++ else ++ sandboxProfile += fmt("\t(literal \"%s\")\n", path); ++ } ++ sandboxProfile += ")\n"; + +- /* They don't like trailing slashes on subpath directives */ +- while (!globalTmpDir.empty() && globalTmpDir.back() == '/') +- globalTmpDir.pop_back(); ++ /* Allow file-read* on full directory hierarchy to self. Allows realpath() */ ++ sandboxProfile += "(allow file-read*\n"; ++ for (auto & i : ancestry) { ++ sandboxProfile += fmt("\t(literal \"%s\")\n", i); ++ } ++ sandboxProfile += ")\n"; + +- if (getEnv("_NIX_TEST_NO_SANDBOX") != "1") { +- builder = "/usr/bin/sandbox-exec"; +- args.push_back("sandbox-exec"); +- args.push_back("-f"); +- args.push_back(sandboxFile); +- args.push_back("-D"); +- args.push_back("_GLOBAL_TMP_DIR=" + globalTmpDir); +- if (allowLocalNetworking) { +- args.push_back("-D"); +- args.push_back(std::string("_ALLOW_LOCAL_NETWORKING=1")); +- } +- args.push_back(drv->builder); +- } else { +- builder = drv->builder; +- args.push_back(std::string(baseNameOf(drv->builder))); ++ sandboxProfile += additionalSandboxProfile; ++ } else ++ sandboxProfile += ++ #include "sandbox-minimal.sb" ++ ; ++ ++ debug("Generated sandbox profile:"); ++ debug(sandboxProfile); ++ ++ bool allowLocalNetworking = parsedDrv->getBoolAttr("__darwinAllowLocalNetworking"); ++ ++ /* The tmpDir in scope points at the temporary build directory for our derivation. Some packages try different mechanisms ++ to find temporary directories, so we want to open up a broader place for them to put their files, if needed. */ ++ Path globalTmpDir = canonPath(defaultTempDir(), true); ++ ++ /* They don't like trailing slashes on subpath directives */ ++ while (!globalTmpDir.empty() && globalTmpDir.back() == '/') ++ globalTmpDir.pop_back(); ++ ++ if (getEnv("_NIX_TEST_NO_SANDBOX") != "1") { ++ Strings sandboxArgs; ++ sandboxArgs.push_back("_GLOBAL_TMP_DIR"); ++ sandboxArgs.push_back(globalTmpDir); ++ if (allowLocalNetworking) { ++ sandboxArgs.push_back("_ALLOW_LOCAL_NETWORKING"); ++ sandboxArgs.push_back("1"); ++ } ++ if (sandbox_init_with_parameters(sandboxProfile.c_str(), 0, stringsToCharPtrs(sandboxArgs).data(), NULL)) { ++ writeFull(STDERR_FILENO, "failed to configure sandbox\n"); ++ _exit(1); + } + } ++ ++ builder = drv->builder; ++ args.push_back(std::string(baseNameOf(drv->builder))); + #else +- else { ++ if (!drv->isBuiltin()) { + builder = drv->builder; + args.push_back(std::string(baseNameOf(drv->builder))); + } +-- +2.46.1 + diff --git a/pkgs/tools/package-management/nix/patches/2_23/0002-local-derivation-goal-Print-sandbox-error-detail-on-.patch b/pkgs/tools/package-management/nix/patches/2_23/0002-local-derivation-goal-Print-sandbox-error-detail-on-.patch new file mode 100644 index 000000000000..e264b4f1b4dc --- /dev/null +++ b/pkgs/tools/package-management/nix/patches/2_23/0002-local-derivation-goal-Print-sandbox-error-detail-on-.patch @@ -0,0 +1,34 @@ +From c43954ffac356b4168cbcfe2a67b4bad3f0dff5d Mon Sep 17 00:00:00 2001 +From: Robert Hensing +Date: Thu, 3 Oct 2024 12:44:12 +0200 +Subject: [PATCH 2/4] local-derivation-goal: Print sandbox error detail on + darwin +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Co-Authored-By: Théophane Hufschmitt +Signed-off-by: Jörg Thalheim +--- + src/libstore/unix/build/local-derivation-goal.cc | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/src/libstore/unix/build/local-derivation-goal.cc b/src/libstore/unix/build/local-derivation-goal.cc +index 878644fa5..0df1f0683 100644 +--- a/src/libstore/unix/build/local-derivation-goal.cc ++++ b/src/libstore/unix/build/local-derivation-goal.cc +@@ -2137,8 +2137,9 @@ void LocalDerivationGoal::runChild() + sandboxArgs.push_back("_ALLOW_LOCAL_NETWORKING"); + sandboxArgs.push_back("1"); + } +- if (sandbox_init_with_parameters(sandboxProfile.c_str(), 0, stringsToCharPtrs(sandboxArgs).data(), NULL)) { +- writeFull(STDERR_FILENO, "failed to configure sandbox\n"); ++ char * sandbox_errbuf = nullptr; ++ if (sandbox_init_with_parameters(sandboxProfile.c_str(), 0, stringsToCharPtrs(sandboxArgs).data(), &sandbox_errbuf)) { ++ writeFull(STDERR_FILENO, fmt("failed to configure sandbox: %s\n", sandbox_errbuf ? sandbox_errbuf : "(null)")); + _exit(1); + } + } +-- +2.46.1 + diff --git a/pkgs/tools/package-management/nix/patches/2_23/0003-local-derivation-goal-Refactor.patch b/pkgs/tools/package-management/nix/patches/2_23/0003-local-derivation-goal-Refactor.patch new file mode 100644 index 000000000000..27c632b041dd --- /dev/null +++ b/pkgs/tools/package-management/nix/patches/2_23/0003-local-derivation-goal-Refactor.patch @@ -0,0 +1,41 @@ +From 53b4bdcb8b0f114bea978cffbea325fd73f779b5 Mon Sep 17 00:00:00 2001 +From: Robert Hensing +Date: Thu, 3 Oct 2024 12:50:27 +0200 +Subject: [PATCH 3/4] local-derivation-goal: Refactor +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +This works because the `builder` and `args` variables are only used +in the non-builtin code path. + +Co-Authored-By: Théophane Hufschmitt +Signed-off-by: Jörg Thalheim +--- + src/libstore/unix/build/local-derivation-goal.cc | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +diff --git a/src/libstore/unix/build/local-derivation-goal.cc b/src/libstore/unix/build/local-derivation-goal.cc +index 0df1f0683..9e67283c9 100644 +--- a/src/libstore/unix/build/local-derivation-goal.cc ++++ b/src/libstore/unix/build/local-derivation-goal.cc +@@ -2143,15 +2143,12 @@ void LocalDerivationGoal::runChild() + _exit(1); + } + } ++#endif + +- builder = drv->builder; +- args.push_back(std::string(baseNameOf(drv->builder))); +-#else + if (!drv->isBuiltin()) { + builder = drv->builder; + args.push_back(std::string(baseNameOf(drv->builder))); + } +-#endif + + for (auto & i : drv->args) + args.push_back(rewriteStrings(i, inputRewrites)); +-- +2.46.1 + diff --git a/pkgs/tools/package-management/nix/patches/2_23/0004-local-derivation-goal-Move-builder-preparation-to-no.patch b/pkgs/tools/package-management/nix/patches/2_23/0004-local-derivation-goal-Move-builder-preparation-to-no.patch new file mode 100644 index 000000000000..6ef5c8e48c4c --- /dev/null +++ b/pkgs/tools/package-management/nix/patches/2_23/0004-local-derivation-goal-Move-builder-preparation-to-no.patch @@ -0,0 +1,75 @@ +From 67b5c7004302cbd344f63ccd306673a9adec4520 Mon Sep 17 00:00:00 2001 +From: Robert Hensing +Date: Thu, 3 Oct 2024 12:57:00 +0200 +Subject: [PATCH 4/4] local-derivation-goal: Move builder preparation to + non-builtin code path +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Signed-off-by: Jörg Thalheim +--- + .../unix/build/local-derivation-goal.cc | 25 ++++++++----------- + 1 file changed, 10 insertions(+), 15 deletions(-) + +diff --git a/src/libstore/unix/build/local-derivation-goal.cc b/src/libstore/unix/build/local-derivation-goal.cc +index 9e67283c9..1f4bafb56 100644 +--- a/src/libstore/unix/build/local-derivation-goal.cc ++++ b/src/libstore/unix/build/local-derivation-goal.cc +@@ -2016,11 +2016,6 @@ void LocalDerivationGoal::runChild() + throw SysError("setuid failed"); + } + +- /* Fill in the arguments. */ +- Strings args; +- +- std::string builder = "invalid"; +- + #if __APPLE__ + /* This has to appear before import statements. */ + std::string sandboxProfile = "(version 1)\n"; +@@ -2145,14 +2140,6 @@ void LocalDerivationGoal::runChild() + } + #endif + +- if (!drv->isBuiltin()) { +- builder = drv->builder; +- args.push_back(std::string(baseNameOf(drv->builder))); +- } +- +- for (auto & i : drv->args) +- args.push_back(rewriteStrings(i, inputRewrites)); +- + /* Indicate that we managed to set up the build environment. */ + writeFull(STDERR_FILENO, std::string("\2\n")); + +@@ -2183,6 +2170,14 @@ void LocalDerivationGoal::runChild() + } + } + ++ // Now builder is not builtin ++ ++ Strings args; ++ args.push_back(std::string(baseNameOf(drv->builder))); ++ ++ for (auto & i : drv->args) ++ args.push_back(rewriteStrings(i, inputRewrites)); ++ + #if __APPLE__ + posix_spawnattr_t attrp; + +@@ -2204,9 +2199,9 @@ void LocalDerivationGoal::runChild() + posix_spawnattr_setbinpref_np(&attrp, 1, &cpu, NULL); + } + +- posix_spawn(NULL, builder.c_str(), NULL, &attrp, stringsToCharPtrs(args).data(), stringsToCharPtrs(envStrs).data()); ++ posix_spawn(NULL, drv->builder.c_str(), NULL, &attrp, stringsToCharPtrs(args).data(), stringsToCharPtrs(envStrs).data()); + #else +- execve(builder.c_str(), stringsToCharPtrs(args).data(), stringsToCharPtrs(envStrs).data()); ++ execve(drv->builder.c_str(), stringsToCharPtrs(args).data(), stringsToCharPtrs(envStrs).data()); + #endif + + throw SysError("executing '%1%'", drv->builder); +-- +2.46.1 + diff --git a/pkgs/tools/package-management/nix/patches/2_24/0001-fix-Run-all-derivation-builders-inside-the-sandbox-o.patch b/pkgs/tools/package-management/nix/patches/2_24/0001-fix-Run-all-derivation-builders-inside-the-sandbox-o.patch new file mode 100644 index 000000000000..9c3d5f987da2 --- /dev/null +++ b/pkgs/tools/package-management/nix/patches/2_24/0001-fix-Run-all-derivation-builders-inside-the-sandbox-o.patch @@ -0,0 +1,323 @@ +From 170242cf0ca3e9fadbad2004126793634d56623e Mon Sep 17 00:00:00 2001 +From: Puck Meerburg +Date: Fri, 1 Mar 2024 11:42:24 -0500 +Subject: [PATCH 1/5] fix: Run all derivation builders inside the sandbox on + macOS +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Signed-off-by: Jörg Thalheim +--- + configure.ac | 6 +- + package.nix | 2 + + .../unix/build/local-derivation-goal.cc | 223 +++++++++--------- + 3 files changed, 116 insertions(+), 115 deletions(-) + +diff --git a/configure.ac b/configure.ac +index 5c22ed176..dff35981b 100644 +--- a/configure.ac ++++ b/configure.ac +@@ -62,12 +62,16 @@ AC_CHECK_TOOL([AR], [ar]) + AC_SYS_LARGEFILE + + +-# Solaris-specific stuff. ++# OS-specific stuff. + case "$host_os" in + solaris*) + # Solaris requires -lsocket -lnsl for network functions + LDFLAGS="-lsocket -lnsl $LDFLAGS" + ;; ++ darwin*) ++ # Need to link to libsandbox. ++ LDFLAGS="-lsandbox $LDFLAGS" ++ ;; + esac + + +diff --git a/package.nix b/package.nix +index a7c8923e8..fcd1e1898 100644 +--- a/package.nix ++++ b/package.nix +@@ -23,6 +23,7 @@ + , libseccomp + , libsodium + , man ++, darwin + , lowdown + , mdbook + , mdbook-linkcheck +@@ -235,6 +236,7 @@ in { + gtest + rapidcheck + ] ++ lib.optional stdenv.isLinux libseccomp ++ ++ lib.optional stdenv.hostPlatform.isDarwin darwin.apple_sdk.libs.sandbox + ++ lib.optional stdenv.hostPlatform.isx86_64 libcpuid + # There have been issues building these dependencies + ++ lib.optional (stdenv.hostPlatform == stdenv.buildPlatform && (stdenv.isLinux || stdenv.isDarwin)) +diff --git a/src/libstore/unix/build/local-derivation-goal.cc b/src/libstore/unix/build/local-derivation-goal.cc +index 54ca69580..7ce266122 100644 +--- a/src/libstore/unix/build/local-derivation-goal.cc ++++ b/src/libstore/unix/build/local-derivation-goal.cc +@@ -58,6 +58,10 @@ + #if __APPLE__ + #include + #include ++#include ++ ++/* This definition is undocumented but depended upon by all major browsers. */ ++extern "C" int sandbox_init_with_parameters(const char *profile, uint64_t flags, const char *const parameters[], char **errorbuf); + #endif + + #include +@@ -2039,141 +2043,132 @@ void LocalDerivationGoal::runChild() + + std::string builder = "invalid"; + +- if (drv->isBuiltin()) { +- ; +- } + #if __APPLE__ +- else { +- /* This has to appear before import statements. */ +- std::string sandboxProfile = "(version 1)\n"; +- +- if (useChroot) { +- +- /* Lots and lots and lots of file functions freak out if they can't stat their full ancestry */ +- PathSet ancestry; +- +- /* We build the ancestry before adding all inputPaths to the store because we know they'll +- all have the same parents (the store), and there might be lots of inputs. This isn't +- particularly efficient... I doubt it'll be a bottleneck in practice */ +- for (auto & i : pathsInChroot) { +- Path cur = i.first; +- while (cur.compare("/") != 0) { +- cur = dirOf(cur); +- ancestry.insert(cur); +- } +- } ++ /* This has to appear before import statements. */ ++ std::string sandboxProfile = "(version 1)\n"; ++ ++ if (useChroot) { + +- /* And we want the store in there regardless of how empty pathsInChroot. We include the innermost +- path component this time, since it's typically /nix/store and we care about that. */ +- Path cur = worker.store.storeDir; ++ /* Lots and lots and lots of file functions freak out if they can't stat their full ancestry */ ++ PathSet ancestry; ++ ++ /* We build the ancestry before adding all inputPaths to the store because we know they'll ++ all have the same parents (the store), and there might be lots of inputs. This isn't ++ particularly efficient... I doubt it'll be a bottleneck in practice */ ++ for (auto & i : pathsInChroot) { ++ Path cur = i.first; + while (cur.compare("/") != 0) { +- ancestry.insert(cur); + cur = dirOf(cur); ++ ancestry.insert(cur); + } ++ } + +- /* Add all our input paths to the chroot */ +- for (auto & i : inputPaths) { +- auto p = worker.store.printStorePath(i); +- pathsInChroot[p] = p; +- } +- +- /* Violations will go to the syslog if you set this. Unfortunately the destination does not appear to be configurable */ +- if (settings.darwinLogSandboxViolations) { +- sandboxProfile += "(deny default)\n"; +- } else { +- sandboxProfile += "(deny default (with no-log))\n"; +- } ++ /* And we want the store in there regardless of how empty pathsInChroot. We include the innermost ++ path component this time, since it's typically /nix/store and we care about that. */ ++ Path cur = worker.store.storeDir; ++ while (cur.compare("/") != 0) { ++ ancestry.insert(cur); ++ cur = dirOf(cur); ++ } + +- sandboxProfile += +- #include "sandbox-defaults.sb" +- ; ++ /* Add all our input paths to the chroot */ ++ for (auto & i : inputPaths) { ++ auto p = worker.store.printStorePath(i); ++ pathsInChroot[p] = p; ++ } + +- if (!derivationType->isSandboxed()) +- sandboxProfile += +- #include "sandbox-network.sb" +- ; +- +- /* Add the output paths we'll use at build-time to the chroot */ +- sandboxProfile += "(allow file-read* file-write* process-exec\n"; +- for (auto & [_, path] : scratchOutputs) +- sandboxProfile += fmt("\t(subpath \"%s\")\n", worker.store.printStorePath(path)); +- +- sandboxProfile += ")\n"; +- +- /* Our inputs (transitive dependencies and any impurities computed above) +- +- without file-write* allowed, access() incorrectly returns EPERM +- */ +- sandboxProfile += "(allow file-read* file-write* process-exec\n"; +- for (auto & i : pathsInChroot) { +- if (i.first != i.second.source) +- throw Error( +- "can't map '%1%' to '%2%': mismatched impure paths not supported on Darwin", +- i.first, i.second.source); +- +- std::string path = i.first; +- auto optSt = maybeLstat(path.c_str()); +- if (!optSt) { +- if (i.second.optional) +- continue; +- throw SysError("getting attributes of required path '%s", path); +- } +- if (S_ISDIR(optSt->st_mode)) +- sandboxProfile += fmt("\t(subpath \"%s\")\n", path); +- else +- sandboxProfile += fmt("\t(literal \"%s\")\n", path); +- } +- sandboxProfile += ")\n"; ++ /* Violations will go to the syslog if you set this. Unfortunately the destination does not appear to be configurable */ ++ if (settings.darwinLogSandboxViolations) { ++ sandboxProfile += "(deny default)\n"; ++ } else { ++ sandboxProfile += "(deny default (with no-log))\n"; ++ } + +- /* Allow file-read* on full directory hierarchy to self. Allows realpath() */ +- sandboxProfile += "(allow file-read*\n"; +- for (auto & i : ancestry) { +- sandboxProfile += fmt("\t(literal \"%s\")\n", i); +- } +- sandboxProfile += ")\n"; ++ sandboxProfile += ++ #include "sandbox-defaults.sb" ++ ; + +- sandboxProfile += additionalSandboxProfile; +- } else ++ if (!derivationType->isSandboxed()) + sandboxProfile += +- #include "sandbox-minimal.sb" ++ #include "sandbox-network.sb" + ; + +- debug("Generated sandbox profile:"); +- debug(sandboxProfile); +- +- Path sandboxFile = tmpDir + "/.sandbox.sb"; ++ /* Add the output paths we'll use at build-time to the chroot */ ++ sandboxProfile += "(allow file-read* file-write* process-exec\n"; ++ for (auto & [_, path] : scratchOutputs) ++ sandboxProfile += fmt("\t(subpath \"%s\")\n", worker.store.printStorePath(path)); + +- writeFile(sandboxFile, sandboxProfile); ++ sandboxProfile += ")\n"; + +- bool allowLocalNetworking = parsedDrv->getBoolAttr("__darwinAllowLocalNetworking"); ++ /* Our inputs (transitive dependencies and any impurities computed above) + +- /* The tmpDir in scope points at the temporary build directory for our derivation. Some packages try different mechanisms +- to find temporary directories, so we want to open up a broader place for them to put their files, if needed. */ +- Path globalTmpDir = canonPath(defaultTempDir(), true); ++ without file-write* allowed, access() incorrectly returns EPERM ++ */ ++ sandboxProfile += "(allow file-read* file-write* process-exec\n"; ++ for (auto & i : pathsInChroot) { ++ if (i.first != i.second.source) ++ throw Error( ++ "can't map '%1%' to '%2%': mismatched impure paths not supported on Darwin", ++ i.first, i.second.source); ++ ++ std::string path = i.first; ++ auto optSt = maybeLstat(path.c_str()); ++ if (!optSt) { ++ if (i.second.optional) ++ continue; ++ throw SysError("getting attributes of required path '%s", path); ++ } ++ if (S_ISDIR(optSt->st_mode)) ++ sandboxProfile += fmt("\t(subpath \"%s\")\n", path); ++ else ++ sandboxProfile += fmt("\t(literal \"%s\")\n", path); ++ } ++ sandboxProfile += ")\n"; + +- /* They don't like trailing slashes on subpath directives */ +- while (!globalTmpDir.empty() && globalTmpDir.back() == '/') +- globalTmpDir.pop_back(); ++ /* Allow file-read* on full directory hierarchy to self. Allows realpath() */ ++ sandboxProfile += "(allow file-read*\n"; ++ for (auto & i : ancestry) { ++ sandboxProfile += fmt("\t(literal \"%s\")\n", i); ++ } ++ sandboxProfile += ")\n"; + +- if (getEnv("_NIX_TEST_NO_SANDBOX") != "1") { +- builder = "/usr/bin/sandbox-exec"; +- args.push_back("sandbox-exec"); +- args.push_back("-f"); +- args.push_back(sandboxFile); +- args.push_back("-D"); +- args.push_back("_GLOBAL_TMP_DIR=" + globalTmpDir); +- if (allowLocalNetworking) { +- args.push_back("-D"); +- args.push_back(std::string("_ALLOW_LOCAL_NETWORKING=1")); +- } +- args.push_back(drv->builder); +- } else { +- builder = drv->builder; +- args.push_back(std::string(baseNameOf(drv->builder))); ++ sandboxProfile += additionalSandboxProfile; ++ } else ++ sandboxProfile += ++ #include "sandbox-minimal.sb" ++ ; ++ ++ debug("Generated sandbox profile:"); ++ debug(sandboxProfile); ++ ++ bool allowLocalNetworking = parsedDrv->getBoolAttr("__darwinAllowLocalNetworking"); ++ ++ /* The tmpDir in scope points at the temporary build directory for our derivation. Some packages try different mechanisms ++ to find temporary directories, so we want to open up a broader place for them to put their files, if needed. */ ++ Path globalTmpDir = canonPath(defaultTempDir(), true); ++ ++ /* They don't like trailing slashes on subpath directives */ ++ while (!globalTmpDir.empty() && globalTmpDir.back() == '/') ++ globalTmpDir.pop_back(); ++ ++ if (getEnv("_NIX_TEST_NO_SANDBOX") != "1") { ++ Strings sandboxArgs; ++ sandboxArgs.push_back("_GLOBAL_TMP_DIR"); ++ sandboxArgs.push_back(globalTmpDir); ++ if (allowLocalNetworking) { ++ sandboxArgs.push_back("_ALLOW_LOCAL_NETWORKING"); ++ sandboxArgs.push_back("1"); ++ } ++ if (sandbox_init_with_parameters(sandboxProfile.c_str(), 0, stringsToCharPtrs(sandboxArgs).data(), NULL)) { ++ writeFull(STDERR_FILENO, "failed to configure sandbox\n"); ++ _exit(1); + } + } ++ ++ builder = drv->builder; ++ args.push_back(std::string(baseNameOf(drv->builder))); + #else +- else { ++ if (!drv->isBuiltin()) { + builder = drv->builder; + args.push_back(std::string(baseNameOf(drv->builder))); + } +-- +2.46.1 + diff --git a/pkgs/tools/package-management/nix/patches/2_24/0002-packaging-Add-darwin-lsandbox-in-meson.patch b/pkgs/tools/package-management/nix/patches/2_24/0002-packaging-Add-darwin-lsandbox-in-meson.patch new file mode 100644 index 000000000000..c709ea62354d --- /dev/null +++ b/pkgs/tools/package-management/nix/patches/2_24/0002-packaging-Add-darwin-lsandbox-in-meson.patch @@ -0,0 +1,53 @@ +From f8a1a149c73113e01c44b73ce9e1005575d52a9a Mon Sep 17 00:00:00 2001 +From: Robert Hensing +Date: Thu, 3 Oct 2024 12:23:17 +0200 +Subject: [PATCH 2/5] packaging: Add darwin -lsandbox in meson +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Signed-off-by: Jörg Thalheim +--- + src/libstore/meson.build | 5 +++++ + src/libstore/package.nix | 2 ++ + 2 files changed, 7 insertions(+) + +diff --git a/src/libstore/meson.build b/src/libstore/meson.build +index 50b15e15d..b23c85061 100644 +--- a/src/libstore/meson.build ++++ b/src/libstore/meson.build +@@ -68,6 +68,11 @@ has_acl_support = cxx.has_header('sys/xattr.h') \ + and cxx.has_function('lremovexattr') + configdata.set('HAVE_ACL_SUPPORT', has_acl_support.to_int()) + ++if host_machine.system() == 'darwin' ++ sandbox = cxx.find_library('sandbox') ++ deps_other += [sandbox] ++endif ++ + subdir('build-utils-meson/threads') + + boost = dependency( +diff --git a/src/libstore/package.nix b/src/libstore/package.nix +index 4582ba0d2..d98bac16d 100644 +--- a/src/libstore/package.nix ++++ b/src/libstore/package.nix +@@ -7,6 +7,7 @@ + , ninja + , pkg-config + , unixtools ++, darwin + + , nix-util + , boost +@@ -65,6 +66,7 @@ mkMesonDerivation (finalAttrs: { + sqlite + ] ++ lib.optional stdenv.hostPlatform.isLinux libseccomp + # There have been issues building these dependencies ++ ++ lib.optional stdenv.hostPlatform.isDarwin darwin.apple_sdk.libs.sandbox + ++ lib.optional (stdenv.hostPlatform == stdenv.buildPlatform && (stdenv.isLinux || stdenv.isDarwin)) + aws-sdk-cpp + ; +-- +2.46.1 + diff --git a/pkgs/tools/package-management/nix/patches/2_24/0003-local-derivation-goal-Print-sandbox-error-detail-on-.patch b/pkgs/tools/package-management/nix/patches/2_24/0003-local-derivation-goal-Print-sandbox-error-detail-on-.patch new file mode 100644 index 000000000000..2c984b6343db --- /dev/null +++ b/pkgs/tools/package-management/nix/patches/2_24/0003-local-derivation-goal-Print-sandbox-error-detail-on-.patch @@ -0,0 +1,34 @@ +From ae7a2ea74136363c2f6ac6e624ea95da7abfafcc Mon Sep 17 00:00:00 2001 +From: Robert Hensing +Date: Thu, 3 Oct 2024 12:44:12 +0200 +Subject: [PATCH 3/5] local-derivation-goal: Print sandbox error detail on + darwin +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Co-Authored-By: Théophane Hufschmitt +Signed-off-by: Jörg Thalheim +--- + src/libstore/unix/build/local-derivation-goal.cc | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/src/libstore/unix/build/local-derivation-goal.cc b/src/libstore/unix/build/local-derivation-goal.cc +index 7ce266122..706771e8e 100644 +--- a/src/libstore/unix/build/local-derivation-goal.cc ++++ b/src/libstore/unix/build/local-derivation-goal.cc +@@ -2159,8 +2159,9 @@ void LocalDerivationGoal::runChild() + sandboxArgs.push_back("_ALLOW_LOCAL_NETWORKING"); + sandboxArgs.push_back("1"); + } +- if (sandbox_init_with_parameters(sandboxProfile.c_str(), 0, stringsToCharPtrs(sandboxArgs).data(), NULL)) { +- writeFull(STDERR_FILENO, "failed to configure sandbox\n"); ++ char * sandbox_errbuf = nullptr; ++ if (sandbox_init_with_parameters(sandboxProfile.c_str(), 0, stringsToCharPtrs(sandboxArgs).data(), &sandbox_errbuf)) { ++ writeFull(STDERR_FILENO, fmt("failed to configure sandbox: %s\n", sandbox_errbuf ? sandbox_errbuf : "(null)")); + _exit(1); + } + } +-- +2.46.1 + diff --git a/pkgs/tools/package-management/nix/patches/2_24/0004-local-derivation-goal-Refactor.patch b/pkgs/tools/package-management/nix/patches/2_24/0004-local-derivation-goal-Refactor.patch new file mode 100644 index 000000000000..dbf54c5020c9 --- /dev/null +++ b/pkgs/tools/package-management/nix/patches/2_24/0004-local-derivation-goal-Refactor.patch @@ -0,0 +1,41 @@ +From 047ee50db2f660eb3f50fab8f7543ce95e814b7c Mon Sep 17 00:00:00 2001 +From: Robert Hensing +Date: Thu, 3 Oct 2024 12:50:27 +0200 +Subject: [PATCH 4/5] local-derivation-goal: Refactor +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +This works because the `builder` and `args` variables are only used +in the non-builtin code path. + +Co-Authored-By: Théophane Hufschmitt +Signed-off-by: Jörg Thalheim +--- + src/libstore/unix/build/local-derivation-goal.cc | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +diff --git a/src/libstore/unix/build/local-derivation-goal.cc b/src/libstore/unix/build/local-derivation-goal.cc +index 706771e8e..d9738a1ea 100644 +--- a/src/libstore/unix/build/local-derivation-goal.cc ++++ b/src/libstore/unix/build/local-derivation-goal.cc +@@ -2165,15 +2165,12 @@ void LocalDerivationGoal::runChild() + _exit(1); + } + } ++#endif + +- builder = drv->builder; +- args.push_back(std::string(baseNameOf(drv->builder))); +-#else + if (!drv->isBuiltin()) { + builder = drv->builder; + args.push_back(std::string(baseNameOf(drv->builder))); + } +-#endif + + for (auto & i : drv->args) + args.push_back(rewriteStrings(i, inputRewrites)); +-- +2.46.1 + diff --git a/pkgs/tools/package-management/nix/patches/2_24/0005-local-derivation-goal-Move-builder-preparation-to-no.patch b/pkgs/tools/package-management/nix/patches/2_24/0005-local-derivation-goal-Move-builder-preparation-to-no.patch new file mode 100644 index 000000000000..c4fc9b2c2117 --- /dev/null +++ b/pkgs/tools/package-management/nix/patches/2_24/0005-local-derivation-goal-Move-builder-preparation-to-no.patch @@ -0,0 +1,75 @@ +From 50f83e4bbd9107576399f94449ac9cb4e80d575e Mon Sep 17 00:00:00 2001 +From: Robert Hensing +Date: Thu, 3 Oct 2024 12:57:00 +0200 +Subject: [PATCH 5/5] local-derivation-goal: Move builder preparation to + non-builtin code path +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Signed-off-by: Jörg Thalheim +--- + .../unix/build/local-derivation-goal.cc | 25 ++++++++----------- + 1 file changed, 10 insertions(+), 15 deletions(-) + +diff --git a/src/libstore/unix/build/local-derivation-goal.cc b/src/libstore/unix/build/local-derivation-goal.cc +index d9738a1ea..2a09e3dd4 100644 +--- a/src/libstore/unix/build/local-derivation-goal.cc ++++ b/src/libstore/unix/build/local-derivation-goal.cc +@@ -2038,11 +2038,6 @@ void LocalDerivationGoal::runChild() + throw SysError("setuid failed"); + } + +- /* Fill in the arguments. */ +- Strings args; +- +- std::string builder = "invalid"; +- + #if __APPLE__ + /* This has to appear before import statements. */ + std::string sandboxProfile = "(version 1)\n"; +@@ -2167,14 +2162,6 @@ void LocalDerivationGoal::runChild() + } + #endif + +- if (!drv->isBuiltin()) { +- builder = drv->builder; +- args.push_back(std::string(baseNameOf(drv->builder))); +- } +- +- for (auto & i : drv->args) +- args.push_back(rewriteStrings(i, inputRewrites)); +- + /* Indicate that we managed to set up the build environment. */ + writeFull(STDERR_FILENO, std::string("\2\n")); + +@@ -2205,6 +2192,14 @@ void LocalDerivationGoal::runChild() + } + } + ++ // Now builder is not builtin ++ ++ Strings args; ++ args.push_back(std::string(baseNameOf(drv->builder))); ++ ++ for (auto & i : drv->args) ++ args.push_back(rewriteStrings(i, inputRewrites)); ++ + #if __APPLE__ + posix_spawnattr_t attrp; + +@@ -2226,9 +2221,9 @@ void LocalDerivationGoal::runChild() + posix_spawnattr_setbinpref_np(&attrp, 1, &cpu, NULL); + } + +- posix_spawn(NULL, builder.c_str(), NULL, &attrp, stringsToCharPtrs(args).data(), stringsToCharPtrs(envStrs).data()); ++ posix_spawn(NULL, drv->builder.c_str(), NULL, &attrp, stringsToCharPtrs(args).data(), stringsToCharPtrs(envStrs).data()); + #else +- execve(builder.c_str(), stringsToCharPtrs(args).data(), stringsToCharPtrs(envStrs).data()); ++ execve(drv->builder.c_str(), stringsToCharPtrs(args).data(), stringsToCharPtrs(envStrs).data()); + #endif + + throw SysError("executing '%1%'", drv->builder); +-- +2.46.1 + diff --git a/pkgs/tools/package-management/nix/patches/git/0001-Fix-meson-build-on-darwin.patch b/pkgs/tools/package-management/nix/patches/git/0001-Fix-meson-build-on-darwin.patch new file mode 100644 index 000000000000..e03bed014561 --- /dev/null +++ b/pkgs/tools/package-management/nix/patches/git/0001-Fix-meson-build-on-darwin.patch @@ -0,0 +1,28 @@ +From 766263d53ae69d70c5915426e6e8f58abd988226 Mon Sep 17 00:00:00 2001 +From: Robert Hensing +Date: Tue, 22 Oct 2024 15:28:04 +0200 +Subject: [PATCH 1/6] Fix meson build on darwin +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +std::stringbuf is defined in +Signed-off-by: Jörg Thalheim +--- + src/libutil/strings.cc | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/src/libutil/strings.cc b/src/libutil/strings.cc +index d1c9f700c..c221a43c6 100644 +--- a/src/libutil/strings.cc ++++ b/src/libutil/strings.cc +@@ -1,5 +1,6 @@ + #include + #include ++#include + + #include "strings-inline.hh" + #include "os-string.hh" +-- +2.46.1 + diff --git a/pkgs/tools/package-management/nix/patches/git/0002-fix-Run-all-derivation-builders-inside-the-sandbox-o.patch b/pkgs/tools/package-management/nix/patches/git/0002-fix-Run-all-derivation-builders-inside-the-sandbox-o.patch new file mode 100644 index 000000000000..36218646f3b6 --- /dev/null +++ b/pkgs/tools/package-management/nix/patches/git/0002-fix-Run-all-derivation-builders-inside-the-sandbox-o.patch @@ -0,0 +1,323 @@ +From d2c880b03f58eb4fdd6d19eb3ffa4345a0477419 Mon Sep 17 00:00:00 2001 +From: Puck Meerburg +Date: Fri, 1 Mar 2024 11:42:24 -0500 +Subject: [PATCH 2/6] fix: Run all derivation builders inside the sandbox on + macOS +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Signed-off-by: Jörg Thalheim +--- + configure.ac | 6 +- + package.nix | 2 + + .../unix/build/local-derivation-goal.cc | 223 +++++++++--------- + 3 files changed, 116 insertions(+), 115 deletions(-) + +diff --git a/configure.ac b/configure.ac +index 198198dea..c7c9b3f4b 100644 +--- a/configure.ac ++++ b/configure.ac +@@ -62,12 +62,16 @@ AC_CHECK_TOOL([AR], [ar]) + AC_SYS_LARGEFILE + + +-# Solaris-specific stuff. ++# OS-specific stuff. + case "$host_os" in + solaris*) + # Solaris requires -lsocket -lnsl for network functions + LDFLAGS="-lsocket -lnsl $LDFLAGS" + ;; ++ darwin*) ++ # Need to link to libsandbox. ++ LDFLAGS="-lsandbox $LDFLAGS" ++ ;; + esac + + +diff --git a/package.nix b/package.nix +index 00621d475..77f1de58c 100644 +--- a/package.nix ++++ b/package.nix +@@ -23,6 +23,7 @@ + , libseccomp + , libsodium + , man ++, darwin + , lowdown + , mdbook + , mdbook-linkcheck +@@ -232,6 +233,7 @@ in { + gtest + rapidcheck + ] ++ lib.optional stdenv.isLinux libseccomp ++ ++ lib.optional stdenv.hostPlatform.isDarwin darwin.apple_sdk.libs.sandbox + ++ lib.optional stdenv.hostPlatform.isx86_64 libcpuid + # There have been issues building these dependencies + ++ lib.optional (stdenv.hostPlatform == stdenv.buildPlatform && (stdenv.isLinux || stdenv.isDarwin)) +diff --git a/src/libstore/unix/build/local-derivation-goal.cc b/src/libstore/unix/build/local-derivation-goal.cc +index b4685b3a7..067755c0d 100644 +--- a/src/libstore/unix/build/local-derivation-goal.cc ++++ b/src/libstore/unix/build/local-derivation-goal.cc +@@ -58,6 +58,10 @@ + #if __APPLE__ + #include + #include ++#include ++ ++/* This definition is undocumented but depended upon by all major browsers. */ ++extern "C" int sandbox_init_with_parameters(const char *profile, uint64_t flags, const char *const parameters[], char **errorbuf); + #endif + + #include +@@ -2088,141 +2092,132 @@ void LocalDerivationGoal::runChild() + + std::string builder = "invalid"; + +- if (drv->isBuiltin()) { +- ; +- } + #if __APPLE__ +- else { +- /* This has to appear before import statements. */ +- std::string sandboxProfile = "(version 1)\n"; +- +- if (useChroot) { +- +- /* Lots and lots and lots of file functions freak out if they can't stat their full ancestry */ +- PathSet ancestry; +- +- /* We build the ancestry before adding all inputPaths to the store because we know they'll +- all have the same parents (the store), and there might be lots of inputs. This isn't +- particularly efficient... I doubt it'll be a bottleneck in practice */ +- for (auto & i : pathsInChroot) { +- Path cur = i.first; +- while (cur.compare("/") != 0) { +- cur = dirOf(cur); +- ancestry.insert(cur); +- } +- } ++ /* This has to appear before import statements. */ ++ std::string sandboxProfile = "(version 1)\n"; ++ ++ if (useChroot) { + +- /* And we want the store in there regardless of how empty pathsInChroot. We include the innermost +- path component this time, since it's typically /nix/store and we care about that. */ +- Path cur = worker.store.storeDir; ++ /* Lots and lots and lots of file functions freak out if they can't stat their full ancestry */ ++ PathSet ancestry; ++ ++ /* We build the ancestry before adding all inputPaths to the store because we know they'll ++ all have the same parents (the store), and there might be lots of inputs. This isn't ++ particularly efficient... I doubt it'll be a bottleneck in practice */ ++ for (auto & i : pathsInChroot) { ++ Path cur = i.first; + while (cur.compare("/") != 0) { +- ancestry.insert(cur); + cur = dirOf(cur); ++ ancestry.insert(cur); + } ++ } + +- /* Add all our input paths to the chroot */ +- for (auto & i : inputPaths) { +- auto p = worker.store.printStorePath(i); +- pathsInChroot[p] = p; +- } +- +- /* Violations will go to the syslog if you set this. Unfortunately the destination does not appear to be configurable */ +- if (settings.darwinLogSandboxViolations) { +- sandboxProfile += "(deny default)\n"; +- } else { +- sandboxProfile += "(deny default (with no-log))\n"; +- } ++ /* And we want the store in there regardless of how empty pathsInChroot. We include the innermost ++ path component this time, since it's typically /nix/store and we care about that. */ ++ Path cur = worker.store.storeDir; ++ while (cur.compare("/") != 0) { ++ ancestry.insert(cur); ++ cur = dirOf(cur); ++ } + +- sandboxProfile += +- #include "sandbox-defaults.sb" +- ; ++ /* Add all our input paths to the chroot */ ++ for (auto & i : inputPaths) { ++ auto p = worker.store.printStorePath(i); ++ pathsInChroot[p] = p; ++ } + +- if (!derivationType->isSandboxed()) +- sandboxProfile += +- #include "sandbox-network.sb" +- ; +- +- /* Add the output paths we'll use at build-time to the chroot */ +- sandboxProfile += "(allow file-read* file-write* process-exec\n"; +- for (auto & [_, path] : scratchOutputs) +- sandboxProfile += fmt("\t(subpath \"%s\")\n", worker.store.printStorePath(path)); +- +- sandboxProfile += ")\n"; +- +- /* Our inputs (transitive dependencies and any impurities computed above) +- +- without file-write* allowed, access() incorrectly returns EPERM +- */ +- sandboxProfile += "(allow file-read* file-write* process-exec\n"; +- for (auto & i : pathsInChroot) { +- if (i.first != i.second.source) +- throw Error( +- "can't map '%1%' to '%2%': mismatched impure paths not supported on Darwin", +- i.first, i.second.source); +- +- std::string path = i.first; +- auto optSt = maybeLstat(path.c_str()); +- if (!optSt) { +- if (i.second.optional) +- continue; +- throw SysError("getting attributes of required path '%s", path); +- } +- if (S_ISDIR(optSt->st_mode)) +- sandboxProfile += fmt("\t(subpath \"%s\")\n", path); +- else +- sandboxProfile += fmt("\t(literal \"%s\")\n", path); +- } +- sandboxProfile += ")\n"; ++ /* Violations will go to the syslog if you set this. Unfortunately the destination does not appear to be configurable */ ++ if (settings.darwinLogSandboxViolations) { ++ sandboxProfile += "(deny default)\n"; ++ } else { ++ sandboxProfile += "(deny default (with no-log))\n"; ++ } + +- /* Allow file-read* on full directory hierarchy to self. Allows realpath() */ +- sandboxProfile += "(allow file-read*\n"; +- for (auto & i : ancestry) { +- sandboxProfile += fmt("\t(literal \"%s\")\n", i); +- } +- sandboxProfile += ")\n"; ++ sandboxProfile += ++ #include "sandbox-defaults.sb" ++ ; + +- sandboxProfile += additionalSandboxProfile; +- } else ++ if (!derivationType->isSandboxed()) + sandboxProfile += +- #include "sandbox-minimal.sb" ++ #include "sandbox-network.sb" + ; + +- debug("Generated sandbox profile:"); +- debug(sandboxProfile); +- +- Path sandboxFile = tmpDir + "/.sandbox.sb"; ++ /* Add the output paths we'll use at build-time to the chroot */ ++ sandboxProfile += "(allow file-read* file-write* process-exec\n"; ++ for (auto & [_, path] : scratchOutputs) ++ sandboxProfile += fmt("\t(subpath \"%s\")\n", worker.store.printStorePath(path)); + +- writeFile(sandboxFile, sandboxProfile); ++ sandboxProfile += ")\n"; + +- bool allowLocalNetworking = parsedDrv->getBoolAttr("__darwinAllowLocalNetworking"); ++ /* Our inputs (transitive dependencies and any impurities computed above) + +- /* The tmpDir in scope points at the temporary build directory for our derivation. Some packages try different mechanisms +- to find temporary directories, so we want to open up a broader place for them to put their files, if needed. */ +- Path globalTmpDir = canonPath(defaultTempDir(), true); ++ without file-write* allowed, access() incorrectly returns EPERM ++ */ ++ sandboxProfile += "(allow file-read* file-write* process-exec\n"; ++ for (auto & i : pathsInChroot) { ++ if (i.first != i.second.source) ++ throw Error( ++ "can't map '%1%' to '%2%': mismatched impure paths not supported on Darwin", ++ i.first, i.second.source); ++ ++ std::string path = i.first; ++ auto optSt = maybeLstat(path.c_str()); ++ if (!optSt) { ++ if (i.second.optional) ++ continue; ++ throw SysError("getting attributes of required path '%s", path); ++ } ++ if (S_ISDIR(optSt->st_mode)) ++ sandboxProfile += fmt("\t(subpath \"%s\")\n", path); ++ else ++ sandboxProfile += fmt("\t(literal \"%s\")\n", path); ++ } ++ sandboxProfile += ")\n"; + +- /* They don't like trailing slashes on subpath directives */ +- while (!globalTmpDir.empty() && globalTmpDir.back() == '/') +- globalTmpDir.pop_back(); ++ /* Allow file-read* on full directory hierarchy to self. Allows realpath() */ ++ sandboxProfile += "(allow file-read*\n"; ++ for (auto & i : ancestry) { ++ sandboxProfile += fmt("\t(literal \"%s\")\n", i); ++ } ++ sandboxProfile += ")\n"; + +- if (getEnv("_NIX_TEST_NO_SANDBOX") != "1") { +- builder = "/usr/bin/sandbox-exec"; +- args.push_back("sandbox-exec"); +- args.push_back("-f"); +- args.push_back(sandboxFile); +- args.push_back("-D"); +- args.push_back("_GLOBAL_TMP_DIR=" + globalTmpDir); +- if (allowLocalNetworking) { +- args.push_back("-D"); +- args.push_back(std::string("_ALLOW_LOCAL_NETWORKING=1")); +- } +- args.push_back(drv->builder); +- } else { +- builder = drv->builder; +- args.push_back(std::string(baseNameOf(drv->builder))); ++ sandboxProfile += additionalSandboxProfile; ++ } else ++ sandboxProfile += ++ #include "sandbox-minimal.sb" ++ ; ++ ++ debug("Generated sandbox profile:"); ++ debug(sandboxProfile); ++ ++ bool allowLocalNetworking = parsedDrv->getBoolAttr("__darwinAllowLocalNetworking"); ++ ++ /* The tmpDir in scope points at the temporary build directory for our derivation. Some packages try different mechanisms ++ to find temporary directories, so we want to open up a broader place for them to put their files, if needed. */ ++ Path globalTmpDir = canonPath(defaultTempDir(), true); ++ ++ /* They don't like trailing slashes on subpath directives */ ++ while (!globalTmpDir.empty() && globalTmpDir.back() == '/') ++ globalTmpDir.pop_back(); ++ ++ if (getEnv("_NIX_TEST_NO_SANDBOX") != "1") { ++ Strings sandboxArgs; ++ sandboxArgs.push_back("_GLOBAL_TMP_DIR"); ++ sandboxArgs.push_back(globalTmpDir); ++ if (allowLocalNetworking) { ++ sandboxArgs.push_back("_ALLOW_LOCAL_NETWORKING"); ++ sandboxArgs.push_back("1"); ++ } ++ if (sandbox_init_with_parameters(sandboxProfile.c_str(), 0, stringsToCharPtrs(sandboxArgs).data(), NULL)) { ++ writeFull(STDERR_FILENO, "failed to configure sandbox\n"); ++ _exit(1); + } + } ++ ++ builder = drv->builder; ++ args.push_back(std::string(baseNameOf(drv->builder))); + #else +- else { ++ if (!drv->isBuiltin()) { + builder = drv->builder; + args.push_back(std::string(baseNameOf(drv->builder))); + } +-- +2.46.1 + diff --git a/pkgs/tools/package-management/nix/patches/git/0003-packaging-Add-darwin-lsandbox-in-meson.patch b/pkgs/tools/package-management/nix/patches/git/0003-packaging-Add-darwin-lsandbox-in-meson.patch new file mode 100644 index 000000000000..0dfbd10ab1e8 --- /dev/null +++ b/pkgs/tools/package-management/nix/patches/git/0003-packaging-Add-darwin-lsandbox-in-meson.patch @@ -0,0 +1,53 @@ +From f7335530619f9b18d6cc249a297e4dca369101a5 Mon Sep 17 00:00:00 2001 +From: Robert Hensing +Date: Thu, 3 Oct 2024 12:23:17 +0200 +Subject: [PATCH 3/6] packaging: Add darwin -lsandbox in meson +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Signed-off-by: Jörg Thalheim +--- + src/libstore/meson.build | 5 +++++ + src/libstore/package.nix | 2 ++ + 2 files changed, 7 insertions(+) + +diff --git a/src/libstore/meson.build b/src/libstore/meson.build +index 6a6aabf97..c2aa5bff3 100644 +--- a/src/libstore/meson.build ++++ b/src/libstore/meson.build +@@ -69,6 +69,11 @@ has_acl_support = cxx.has_header('sys/xattr.h') \ + and cxx.has_function('lremovexattr') + configdata.set('HAVE_ACL_SUPPORT', has_acl_support.to_int()) + ++if host_machine.system() == 'darwin' ++ sandbox = cxx.find_library('sandbox') ++ deps_other += [sandbox] ++endif ++ + subdir('build-utils-meson/threads') + + boost = dependency( +diff --git a/src/libstore/package.nix b/src/libstore/package.nix +index 9568462b5..f04e3b95f 100644 +--- a/src/libstore/package.nix ++++ b/src/libstore/package.nix +@@ -3,6 +3,7 @@ + , mkMesonLibrary + + , unixtools ++, darwin + + , nix-util + , boost +@@ -56,6 +57,7 @@ mkMesonLibrary (finalAttrs: { + sqlite + ] ++ lib.optional stdenv.hostPlatform.isLinux libseccomp + # There have been issues building these dependencies ++ ++ lib.optional stdenv.hostPlatform.isDarwin darwin.apple_sdk.libs.sandbox + ++ lib.optional (stdenv.hostPlatform == stdenv.buildPlatform && (stdenv.isLinux || stdenv.isDarwin)) + aws-sdk-cpp + ; +-- +2.46.1 + diff --git a/pkgs/tools/package-management/nix/patches/git/0004-local-derivation-goal-Print-sandbox-error-detail-on-.patch b/pkgs/tools/package-management/nix/patches/git/0004-local-derivation-goal-Print-sandbox-error-detail-on-.patch new file mode 100644 index 000000000000..4bff61efdf7f --- /dev/null +++ b/pkgs/tools/package-management/nix/patches/git/0004-local-derivation-goal-Print-sandbox-error-detail-on-.patch @@ -0,0 +1,34 @@ +From 14d09e0b55898ac22d4cdeade3bf6c4174052ffd Mon Sep 17 00:00:00 2001 +From: Robert Hensing +Date: Thu, 3 Oct 2024 12:44:12 +0200 +Subject: [PATCH 4/6] local-derivation-goal: Print sandbox error detail on + darwin +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Co-Authored-By: Théophane Hufschmitt +Signed-off-by: Jörg Thalheim +--- + src/libstore/unix/build/local-derivation-goal.cc | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/src/libstore/unix/build/local-derivation-goal.cc b/src/libstore/unix/build/local-derivation-goal.cc +index 067755c0d..f34d68403 100644 +--- a/src/libstore/unix/build/local-derivation-goal.cc ++++ b/src/libstore/unix/build/local-derivation-goal.cc +@@ -2208,8 +2208,9 @@ void LocalDerivationGoal::runChild() + sandboxArgs.push_back("_ALLOW_LOCAL_NETWORKING"); + sandboxArgs.push_back("1"); + } +- if (sandbox_init_with_parameters(sandboxProfile.c_str(), 0, stringsToCharPtrs(sandboxArgs).data(), NULL)) { +- writeFull(STDERR_FILENO, "failed to configure sandbox\n"); ++ char * sandbox_errbuf = nullptr; ++ if (sandbox_init_with_parameters(sandboxProfile.c_str(), 0, stringsToCharPtrs(sandboxArgs).data(), &sandbox_errbuf)) { ++ writeFull(STDERR_FILENO, fmt("failed to configure sandbox: %s\n", sandbox_errbuf ? sandbox_errbuf : "(null)")); + _exit(1); + } + } +-- +2.46.1 + diff --git a/pkgs/tools/package-management/nix/patches/git/0005-local-derivation-goal-Refactor.patch b/pkgs/tools/package-management/nix/patches/git/0005-local-derivation-goal-Refactor.patch new file mode 100644 index 000000000000..cec9d67513ed --- /dev/null +++ b/pkgs/tools/package-management/nix/patches/git/0005-local-derivation-goal-Refactor.patch @@ -0,0 +1,41 @@ +From 06e27042e176b79561f50decb0fdf836b7bec3f5 Mon Sep 17 00:00:00 2001 +From: Robert Hensing +Date: Thu, 3 Oct 2024 12:50:27 +0200 +Subject: [PATCH 5/6] local-derivation-goal: Refactor +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +This works because the `builder` and `args` variables are only used +in the non-builtin code path. + +Co-Authored-By: Théophane Hufschmitt +Signed-off-by: Jörg Thalheim +--- + src/libstore/unix/build/local-derivation-goal.cc | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +diff --git a/src/libstore/unix/build/local-derivation-goal.cc b/src/libstore/unix/build/local-derivation-goal.cc +index f34d68403..f781a84c6 100644 +--- a/src/libstore/unix/build/local-derivation-goal.cc ++++ b/src/libstore/unix/build/local-derivation-goal.cc +@@ -2214,15 +2214,12 @@ void LocalDerivationGoal::runChild() + _exit(1); + } + } ++#endif + +- builder = drv->builder; +- args.push_back(std::string(baseNameOf(drv->builder))); +-#else + if (!drv->isBuiltin()) { + builder = drv->builder; + args.push_back(std::string(baseNameOf(drv->builder))); + } +-#endif + + for (auto & i : drv->args) + args.push_back(rewriteStrings(i, inputRewrites)); +-- +2.46.1 + diff --git a/pkgs/tools/package-management/nix/patches/git/0006-local-derivation-goal-Move-builder-preparation-to-no.patch b/pkgs/tools/package-management/nix/patches/git/0006-local-derivation-goal-Move-builder-preparation-to-no.patch new file mode 100644 index 000000000000..4e63db1f183e --- /dev/null +++ b/pkgs/tools/package-management/nix/patches/git/0006-local-derivation-goal-Move-builder-preparation-to-no.patch @@ -0,0 +1,75 @@ +From d1e0bae55afb3c3ef0bcad5d644b0e04da6279b3 Mon Sep 17 00:00:00 2001 +From: Robert Hensing +Date: Thu, 3 Oct 2024 12:57:00 +0200 +Subject: [PATCH 6/6] local-derivation-goal: Move builder preparation to + non-builtin code path +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Signed-off-by: Jörg Thalheim +--- + .../unix/build/local-derivation-goal.cc | 25 ++++++++----------- + 1 file changed, 10 insertions(+), 15 deletions(-) + +diff --git a/src/libstore/unix/build/local-derivation-goal.cc b/src/libstore/unix/build/local-derivation-goal.cc +index f781a84c6..dcfaadeef 100644 +--- a/src/libstore/unix/build/local-derivation-goal.cc ++++ b/src/libstore/unix/build/local-derivation-goal.cc +@@ -2087,11 +2087,6 @@ void LocalDerivationGoal::runChild() + throw SysError("setuid failed"); + } + +- /* Fill in the arguments. */ +- Strings args; +- +- std::string builder = "invalid"; +- + #if __APPLE__ + /* This has to appear before import statements. */ + std::string sandboxProfile = "(version 1)\n"; +@@ -2216,14 +2211,6 @@ void LocalDerivationGoal::runChild() + } + #endif + +- if (!drv->isBuiltin()) { +- builder = drv->builder; +- args.push_back(std::string(baseNameOf(drv->builder))); +- } +- +- for (auto & i : drv->args) +- args.push_back(rewriteStrings(i, inputRewrites)); +- + /* Indicate that we managed to set up the build environment. */ + writeFull(STDERR_FILENO, std::string("\2\n")); + +@@ -2254,6 +2241,14 @@ void LocalDerivationGoal::runChild() + } + } + ++ // Now builder is not builtin ++ ++ Strings args; ++ args.push_back(std::string(baseNameOf(drv->builder))); ++ ++ for (auto & i : drv->args) ++ args.push_back(rewriteStrings(i, inputRewrites)); ++ + #if __APPLE__ + posix_spawnattr_t attrp; + +@@ -2275,9 +2270,9 @@ void LocalDerivationGoal::runChild() + posix_spawnattr_setbinpref_np(&attrp, 1, &cpu, NULL); + } + +- posix_spawn(NULL, builder.c_str(), NULL, &attrp, stringsToCharPtrs(args).data(), stringsToCharPtrs(envStrs).data()); ++ posix_spawn(NULL, drv->builder.c_str(), NULL, &attrp, stringsToCharPtrs(args).data(), stringsToCharPtrs(envStrs).data()); + #else +- execve(builder.c_str(), stringsToCharPtrs(args).data(), stringsToCharPtrs(envStrs).data()); ++ execve(drv->builder.c_str(), stringsToCharPtrs(args).data(), stringsToCharPtrs(envStrs).data()); + #endif + + throw SysError("executing '%1%'", drv->builder); +-- +2.46.1 + From 626d52a01a6aeea28a698d5ef38dcecf02ac0470 Mon Sep 17 00:00:00 2001 From: Fabian Affolter Date: Wed, 30 Oct 2024 09:18:40 +0100 Subject: [PATCH 22/57] python312Packages.thinqconnect: 0.9.7-unstable-2024-09-09 -> 0.9.9 Diff: thinq-connect/pythinqconnect@39d535a...0.9.9 --- pkgs/development/python-modules/thinqconnect/default.nix | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/pkgs/development/python-modules/thinqconnect/default.nix b/pkgs/development/python-modules/thinqconnect/default.nix index 0b269d0ff3d7..ec85761f7d05 100644 --- a/pkgs/development/python-modules/thinqconnect/default.nix +++ b/pkgs/development/python-modules/thinqconnect/default.nix @@ -10,8 +10,8 @@ }: buildPythonPackage rec { - pname = "pythinqconnect"; - version = "0.9.7-unstable-2024-09-09"; + pname = "thinqconnect"; + version = "0.9.9"; pyproject = true; disabled = pythonOlder "3.10"; @@ -19,9 +19,8 @@ buildPythonPackage rec { src = fetchFromGitHub { owner = "thinq-connect"; repo = "pythinqconnect"; - # https://github.com/thinq-connect/pythinqconnect/issues/1 - rev = "39d535a2a5d1067a110eea37ae92002d0793b7e9"; - hash = "sha256-+nQAUqg5rB2eJgPBJJR8NsQ1O2Wb4UsbBQVPir1jyAU="; + rev = "refs/tags/${version}"; + hash = "sha256-G6fg+mXrUnSkfpeJAvDXEu57UgkYEObErEnds2PK13Y="; }; build-system = [ setuptools ]; From 4314d91ff8c64dac9d2bb1ff62f454515e931840 Mon Sep 17 00:00:00 2001 From: Fabian Affolter Date: Wed, 30 Oct 2024 09:21:38 +0100 Subject: [PATCH 23/57] python312Packages.pyexploitdb: 0.2.41 -> 0.2.53 Changelog: https://github.com/GoVanguard/pyExploitDb/blob/master/ChangeLog.md --- pkgs/development/python-modules/pyexploitdb/default.nix | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/pkgs/development/python-modules/pyexploitdb/default.nix b/pkgs/development/python-modules/pyexploitdb/default.nix index fa555cff881b..3456c6262dab 100644 --- a/pkgs/development/python-modules/pyexploitdb/default.nix +++ b/pkgs/development/python-modules/pyexploitdb/default.nix @@ -10,7 +10,7 @@ buildPythonPackage rec { pname = "pyexploitdb"; - version = "0.2.41"; + version = "0.2.53"; pyproject = true; disabled = pythonOlder "3.7"; @@ -18,7 +18,7 @@ buildPythonPackage rec { src = fetchPypi { pname = "pyExploitDb"; inherit version; - hash = "sha256-QwMD7V1BSmFBZ7mazo7TnuZijm8MC/M/oKMV4nh1v5A="; + hash = "sha256-NebM8nhIo4Hgf7iwSV2utcrqR1kLh+cpmqV1Gc9r8cw="; }; build-system = [ setuptools ]; @@ -35,8 +35,8 @@ buildPythonPackage rec { meta = with lib; { description = "Library to fetch the most recent exploit-database"; - homepage = "https://github.com/GoVanguard/pyExploitDb"; - changelog = "https://github.com/GoVanguard/pyExploitDb/blob/master/ChangeLog.md"; + homepage = "https://github.com/Hackman238/pyExploitDb/pyExploitDb"; + changelog = "https://github.com/Hackman238/pyExploitDb/pyExploitDb/blob/master/ChangeLog.md"; license = licenses.gpl3Plus; maintainers = with maintainers; [ fab ]; }; From e90dd85230c9532c66e676239f66637b59d65349 Mon Sep 17 00:00:00 2001 From: Fabian Affolter Date: Wed, 30 Oct 2024 10:29:42 +0100 Subject: [PATCH 24/57] python312Packages.webrtc-models: init at 0.1.0 WebRTC models as Python dataclasses with mashumaro https://github.com/home-assistant-libs/python-webrtc-models --- .../python-modules/webrtc-models/default.nix | 59 +++++++++++++++++++ pkgs/top-level/python-packages.nix | 2 + 2 files changed, 61 insertions(+) create mode 100644 pkgs/development/python-modules/webrtc-models/default.nix diff --git a/pkgs/development/python-modules/webrtc-models/default.nix b/pkgs/development/python-modules/webrtc-models/default.nix new file mode 100644 index 000000000000..d03d77ca4924 --- /dev/null +++ b/pkgs/development/python-modules/webrtc-models/default.nix @@ -0,0 +1,59 @@ +{ + lib, + buildPythonPackage, + fetchFromGitHub, + hatchling, + mashumaro, + orjson, + pytest-asyncio, + pytest-cov-stub, + pytestCheckHook, + pythonOlder, + syrupy, +}: + +buildPythonPackage rec { + pname = "webrtc-models"; + version = "0.1.0"; + pyproject = true; + + disabled = pythonOlder "3.12"; + + src = fetchFromGitHub { + owner = "home-assistant-libs"; + repo = "python-webrtc-models"; + rev = "refs/tags/${version}"; + hash = "sha256-Wmz+P4FFJJZujWF0SR6HVERNNO7xSM1iCayg6tmVyso="; + }; + + postPatch = '' + substituteInPlace pyproject.toml \ + --replace-fail 'version = "0.0.0"' 'version = "${version}"' + ''; + + pythonRelaxDeps = [ "orjson" ]; + + build-system = [ hatchling ]; + + dependencies = [ + mashumaro + orjson + ]; + + nativeCheckInputs = [ + pytest-asyncio + pytest-cov-stub + pytestCheckHook + syrupy + ]; + + pythonImportsCheck = [ "webrtc_models" ]; + + meta = { + description = "WebRTC models as Python dataclasses with mashumaro"; + homepage = "https://github.com/home-assistant-libs/python-webrtc-models"; + changelog = "https://github.com/home-assistant-libs/python-webrtc-models/releases/tag/${version}"; + license = lib.licenses.asl20; + maintainers = with lib.maintainers; [ fab ]; + }; +} diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix index f201fad95c5f..0a0b98e0f6a1 100644 --- a/pkgs/top-level/python-packages.nix +++ b/pkgs/top-level/python-packages.nix @@ -17514,6 +17514,8 @@ self: super: with self; { webob = callPackage ../development/python-modules/webob { }; + webrtc-models = callPackage ../development/python-modules/webrtc-models { }; + webrtc-noise-gain = callPackage ../development/python-modules/webrtc-noise-gain { }; webrtcvad = callPackage ../development/python-modules/webrtcvad { }; From b3dbc9eb0ff9a3c8264bdfd78172572b8c46bc9f Mon Sep 17 00:00:00 2001 From: Fabian Affolter Date: Wed, 30 Oct 2024 10:34:07 +0100 Subject: [PATCH 25/57] python312Packages.go2rtc-client: init at 0.0.1b2 Module for interacting with go2rtc https://github.com/home-assistant-libs/python-go2rtc-client --- .../python-modules/go2rtc-client/default.nix | 67 +++++++++++++++++++ pkgs/top-level/python-packages.nix | 2 + 2 files changed, 69 insertions(+) create mode 100644 pkgs/development/python-modules/go2rtc-client/default.nix diff --git a/pkgs/development/python-modules/go2rtc-client/default.nix b/pkgs/development/python-modules/go2rtc-client/default.nix new file mode 100644 index 000000000000..e370d262b090 --- /dev/null +++ b/pkgs/development/python-modules/go2rtc-client/default.nix @@ -0,0 +1,67 @@ +{ + lib, + aiohttp, + aioresponses, + awesomeversion, + buildPythonPackage, + fetchFromGitHub, + hatchling, + mashumaro, + orjson, + pytest-asyncio, + pytest-cov-stub, + pytestCheckHook, + pythonOlder, + syrupy, + webrtc-models, +}: + +buildPythonPackage rec { + pname = "go2rtc-client"; + version = "0.0.1b2"; + pyproject = true; + + disabled = pythonOlder "3.12"; + + src = fetchFromGitHub { + owner = "home-assistant-libs"; + repo = "python-go2rtc-client"; + rev = "refs/tags/${version}"; + hash = "sha256-q1NDHauYy8C3tlIpt6J0iMj0TNtBv2j9aU/IE5CgBjg="; + }; + + postPatch = '' + substituteInPlace pyproject.toml \ + --replace-fail 'version = "0.0.0"' 'version = "${version}"' + ''; + + pythonRelaxDeps = [ "orjson" ]; + + build-system = [ hatchling ]; + + dependencies = [ + aiohttp + awesomeversion + mashumaro + orjson + webrtc-models + ]; + + nativeCheckInputs = [ + aioresponses + pytest-asyncio + pytest-cov-stub + pytestCheckHook + syrupy + ]; + + pythonImportsCheck = [ "go2rtc_client" ]; + + meta = { + description = "Module for interacting with go2rtc"; + homepage = "https://github.com/home-assistant-libs/python-go2rtc-client"; + changelog = "https://github.com/home-assistant-libs/python-go2rtc-client/releases/tag/${version}"; + license = lib.licenses.asl20; + maintainers = with lib.maintainers; [ ]; + }; +} diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix index 0a0b98e0f6a1..d51d39017472 100644 --- a/pkgs/top-level/python-packages.nix +++ b/pkgs/top-level/python-packages.nix @@ -5160,6 +5160,8 @@ self: super: with self; { gnureadline = callPackage ../development/python-modules/gnureadline { }; + go2rtc-client = callPackage ../development/python-modules/go2rtc-client { }; + goalzero = callPackage ../development/python-modules/goalzero { }; gocardless-pro = callPackage ../development/python-modules/gocardless-pro { }; From b47e6c8bf0807992612f34f455dc806588006f72 Mon Sep 17 00:00:00 2001 From: Fabian Affolter Date: Wed, 30 Oct 2024 10:46:57 +0100 Subject: [PATCH 26/57] python312Packages.automower-ble: init at 0.2.0 Module to connect to Husqvarna Automower Connect https://github.com/alistair23/AutoMower-BLE --- .../python-modules/automower-ble/default.nix | 39 +++++++++++++++++++ pkgs/top-level/python-packages.nix | 2 + 2 files changed, 41 insertions(+) create mode 100644 pkgs/development/python-modules/automower-ble/default.nix diff --git a/pkgs/development/python-modules/automower-ble/default.nix b/pkgs/development/python-modules/automower-ble/default.nix new file mode 100644 index 000000000000..5a2dbd5d8c30 --- /dev/null +++ b/pkgs/development/python-modules/automower-ble/default.nix @@ -0,0 +1,39 @@ +{ + lib, + bleak, + buildPythonPackage, + fetchFromGitHub, + setuptools, + pytestCheckHook, + pythonOlder, +}: + +buildPythonPackage rec { + pname = "automower-ble"; + version = "0.2.0"; + pyproject = true; + + disabled = pythonOlder "3.10"; + + src = fetchFromGitHub { + owner = "alistair23"; + repo = "AutoMower-BLE"; + rev = "refs/tags/${version}"; + hash = "sha256-BWfRXz78e1Xq0fNOGJ2IFnjNqfH3oD5VIGMxyCPtEUw="; + }; + + build-system = [ setuptools ]; + + dependencies = [ bleak ]; + + nativeCheckInputs = [ pytestCheckHook ]; + + pythonImportsCheck = [ "automower_ble" ]; + + meta = { + description = "Module to connect to Husqvarna Automower Connect"; + homepage = "https://github.com/alistair23/AutoMower-BLE"; + license = lib.licenses.gpl3Only; + maintainers = with lib.maintainers; [ fab ]; + }; +} diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix index f201fad95c5f..62eb43a0d046 100644 --- a/pkgs/top-level/python-packages.nix +++ b/pkgs/top-level/python-packages.nix @@ -1036,6 +1036,8 @@ self: super: with self; { automate-home = callPackage ../development/python-modules/automate-home { }; + automower-ble = callPackage ../development/python-modules/automower-ble { }; + automx2 = callPackage ../development/python-modules/automx2 { }; autopage = callPackage ../development/python-modules/autopage { }; From 13d68e0407a007d969504281c6842535dd7f7c96 Mon Sep 17 00:00:00 2001 From: Markus Kowalewski Date: Wed, 30 Oct 2024 11:27:54 +0100 Subject: [PATCH 27/57] panoply: 5.5.3 -> 5.5.4 --- pkgs/tools/misc/panoply/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/tools/misc/panoply/default.nix b/pkgs/tools/misc/panoply/default.nix index 78bd166a5f6f..4905c0cbb4fd 100644 --- a/pkgs/tools/misc/panoply/default.nix +++ b/pkgs/tools/misc/panoply/default.nix @@ -8,11 +8,11 @@ stdenvNoCC.mkDerivation rec { pname = "panoply"; - version = "5.5.3"; + version = "5.5.4"; src = fetchurl { url = "https://www.giss.nasa.gov/tools/panoply/download/PanoplyJ-${version}.tgz"; - hash = "sha256-TCuCLWMVp7t0JpHA6TbwUdURj/aBggzLa9I7llRY0TU="; + hash = "sha256-rC2vQcaanK2nNSDtiXNhyBiV0SN3QqtwU8WNBc7D/Nw="; }; nativeBuildInputs = [ makeWrapper ]; From debb301a2118b88c5ddb2355661886daa5c75038 Mon Sep 17 00:00:00 2001 From: Adriaan van der Bergh Date: Wed, 30 Oct 2024 11:34:54 +0100 Subject: [PATCH 28/57] =?UTF-8?q?vscode:=201.94.2=20=E2=86=92=201.95.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- pkgs/applications/editors/vscode/vscode.nix | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/pkgs/applications/editors/vscode/vscode.nix b/pkgs/applications/editors/vscode/vscode.nix index 1c12abb14780..d4be19eefe3f 100644 --- a/pkgs/applications/editors/vscode/vscode.nix +++ b/pkgs/applications/editors/vscode/vscode.nix @@ -30,21 +30,21 @@ let archive_fmt = if stdenv.hostPlatform.isDarwin then "zip" else "tar.gz"; sha256 = { - x86_64-linux = "0w452wnzyb4wmr2qqq55dhfb1jd0zqmwf65fbmxdz7jn1jimjjrn"; - x86_64-darwin = "1b333snvrw8khryhi5scfhhkg43m3b6ds3nvs24nbvx8k7h69hmm"; - aarch64-linux = "12p5cdva14s9sfgyrzg3nylpmgdnmfavwx3xxxmblzq1gcal2g6i"; - aarch64-darwin = "1l59fcdvynkl5kyz9bn31mld6pi89nynk1zw645rczjm940pac7p"; - armv7l-linux = "07ylija6chg6jc2zcavdr9yw1laniigw57f2gilyjynv1cgjm76r"; + x86_64-linux = "12cfks56pz1fljv4zrh4q2k6vai2rpdyw5lbap9y8wa9f5pz0m55"; + x86_64-darwin = "0zxmlpilh83grcv6jk2avlxiy2w0a1vbwmv0fjzy6nvdma91j7lj"; + aarch64-linux = "1gx5xg54mmkiglwmv8fjppqb8bj0fqn9yg0r5q9kzdhh9702dxsg"; + aarch64-darwin = "13wnraa13msz7rxzwk232rwrnbmwx0dpq13aq68zjz80clsf4jgp"; + armv7l-linux = "06kngg0scrk8sz3j874iffyci70ng8j8l1v83k572vw847956850"; }.${system} or throwSystem; in callPackage ./generic.nix rec { # Please backport all compatible updates to the stable release. # This is important for the extension ecosystem. - version = "1.94.2"; + version = "1.95.0"; pname = "vscode" + lib.optionalString isInsiders "-insiders"; # This is used for VS Code - Remote SSH test - rev = "384ff7382de624fb94dbaf6da11977bba1ecd427"; + rev = "912bb683695358a54ae0c670461738984cbb5b95"; executableName = "code" + lib.optionalString isInsiders "-insiders"; longName = "Visual Studio Code" + lib.optionalString isInsiders " - Insiders"; @@ -68,7 +68,7 @@ in src = fetchurl { name = "vscode-server-${rev}.tar.gz"; url = "https://update.code.visualstudio.com/commit:${rev}/server-linux-x64/stable"; - sha256 = "1mj9fg76b9x9r6ql21hbckpni179vfa9j8fiah9rd6ih7sb72048"; + sha256 = "1chk0xwsiw6pm6ihjlp9695n0l1wfipwv4h04v5dmm9dcwlarp1m"; }; }; From 2b295f648dfd091ac3f35b7ca11f8b272f335346 Mon Sep 17 00:00:00 2001 From: detroyejr Date: Sat, 28 Sep 2024 12:50:21 -0400 Subject: [PATCH 29/57] positron-bin: init at 2024.11.0-116 --- pkgs/by-name/po/positron-bin/package.nix | 137 +++++++++++++++++++++++ pkgs/by-name/po/positron-bin/update.sh | 54 +++++++++ 2 files changed, 191 insertions(+) create mode 100644 pkgs/by-name/po/positron-bin/package.nix create mode 100755 pkgs/by-name/po/positron-bin/update.sh diff --git a/pkgs/by-name/po/positron-bin/package.nix b/pkgs/by-name/po/positron-bin/package.nix new file mode 100644 index 000000000000..c399ba32f752 --- /dev/null +++ b/pkgs/by-name/po/positron-bin/package.nix @@ -0,0 +1,137 @@ +{ + lib, + _7zz, + alsa-lib, + systemd, + autoPatchelfHook, + blas, + dpkg, + fetchurl, + gtk3, + libglvnd, + libxkbcommon, + makeShellWrapper, + mesa, + musl, + nss, + patchelf, + stdenv, + xorg, +}: +let + pname = "positron-bin"; + version = "2024.11.0-116"; +in +stdenv.mkDerivation { + inherit version pname; + + src = + if stdenv.isDarwin then + fetchurl { + url = "https://github.com/posit-dev/positron/releases/download/${version}/Positron-${version}.dmg"; + hash = "sha256-5Ym42InDgFLGdZk0LYV1H0eC5WzmsYToG1KLdiGgTto="; + } + else + fetchurl { + url = "https://github.com/posit-dev/positron/releases/download/${version}/Positron-${version}.deb"; + hash = "sha256-pE25XVYFW8WwyQ7zmox2mmXy6ZCSaXk2gSnPimg7xtU="; + }; + + buildInputs = + [ makeShellWrapper ] + ++ lib.optionals stdenv.hostPlatform.isLinux [ + alsa-lib + dpkg + gtk3 + libglvnd + libxkbcommon + mesa + musl + nss + stdenv.cc.cc + xorg.libX11 + xorg.libXcomposite + xorg.libXdamage + xorg.libxkbfile + ] + ++ lib.optionals stdenv.hostPlatform.isDarwin [ + blas + patchelf + ]; + + nativeBuildInputs = + lib.optionals stdenv.hostPlatform.isLinux [ + autoPatchelfHook + ] + ++ lib.optionals stdenv.hostPlatform.isDarwin [ + _7zz + ]; + + runtimeDependencies = lib.optionals stdenv.hostPlatform.isLinux [ + # Needed to fix the "Zygote could not fork" error. + (lib.getLib systemd) + ]; + + unpackPhase = '' + runHook preUnpack + ${lib.optionalString stdenv.hostPlatform.isLinux ''dpkg-deb --fsys-tarfile "$src" | tar -x --no-same-owner''} + runHook postUnpack + ''; + + installPhase = + if stdenv.hostPlatform.isDarwin then + '' + runHook preInstall + mkdir -p "$out/Applications" "$out/bin" + cp -r . "$out/Applications/Positron.app" + + # Positron will use the system version of BLAS if we don't provide the nix version. + wrapProgram "$out/Applications/Positron.app/Contents/Resources/app/bin/code" \ + --prefix DYLD_INSERT_LIBRARIES : "${lib.makeLibraryPath [ blas ]}/libblas.dylib" + + ln -s "$out/Applications/Positron.app/Contents/Resources/app/bin/code" "$out/bin/positron" + runHook postInstall + '' + else + '' + runHook preInstall + mkdir -p "$out/share" + cp -r usr/share/pixmaps "$out/share/pixmaps" + cp -r usr/share/positron "$out/share/positron" + + mkdir -p "$out/share/applications" + install -m 444 -D usr/share/applications/positron.desktop "$out/share/applications/positron.desktop" + substituteInPlace "$out/share/applications/positron.desktop" \ + --replace-fail \ + "Icon=com.visualstudio.code.oss" \ + "Icon=$out/share/pixmaps/com.visualstudio.code.oss.png" \ + --replace-fail \ + "Exec=/usr/share/positron/positron %F" \ + "Exec=$out/share/positron/.positron-wrapped %F" \ + --replace-fail \ + "/usr/share/positron/positron --new-window %F" \ + "$out/share/positron/.positron-wrapped --new-window %F" + + # Fix libGL.so not found errors. + wrapProgram "$out/share/positron/positron" \ + --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ libglvnd ]}" + + mkdir -p "$out/bin" + ln -s "$out/share/positron/positron" "$out/bin/positron" + runHook postInstall + ''; + + passthru.updateScript = ./update.sh; + + meta = with lib; { + description = "Positron, a next-generation data science IDE"; + homepage = "https://github.com/posit-dev/positron"; + license = licenses.elastic20; + maintainers = with maintainers; [ + b-rodrigues + detroyejr + ]; + mainProgram = "positron"; + platforms = [ "x86_64-linux" ] ++ platforms.darwin; + }; +} diff --git a/pkgs/by-name/po/positron-bin/update.sh b/pkgs/by-name/po/positron-bin/update.sh new file mode 100755 index 000000000000..28081f589ec9 --- /dev/null +++ b/pkgs/by-name/po/positron-bin/update.sh @@ -0,0 +1,54 @@ +#!/usr/bin/env nix-shell +#! nix-shell -i bash -p curl jq git + +nixpkgs="$(git rev-parse --show-toplevel)" +positron_nix="$nixpkgs/pkgs/by-name/po/positron-bin/package.nix" + +current_version=$(grep -oP "version = \"\K.*\d" $positron_nix) +new_version=$(curl -sSfL \ + -H "Accept: application/vnd.github+json" \ + -H "X-GitHub-Api-Version: 2022-11-28" \ + "https://api.github.com/repos/posit-dev/positron/releases?per_page=1" \ + | jq -r '.[0].name') + +if [[ "$new_version" == "$current_version" ]]; then + echo 'Positron is already up to date' + exit 0; +fi + +# Update Darwin hash. +current_hash=$(nix store prefetch-file --json --hash-type sha256 \ + "https://github.com/posit-dev/positron/releases/download/${current_version}/Positron-${current_version}.dmg" \ + | jq -r .hash) + +new_hash=$(nix store prefetch-file --json --hash-type sha256 \ + "https://github.com/posit-dev/positron/releases/download/${new_version}/Positron-${new_version}.dmg" \ + | jq -r .hash) + +sed -i "s|$current_hash|$new_hash|g" $positron_nix + +# Update Linux hash. +current_hash=$(nix store prefetch-file --json --hash-type sha256 \ + "https://github.com/posit-dev/positron/releases/download/${current_version}/Positron-${current_version}.deb" \ + | jq -r .hash) + +new_hash=$(nix store prefetch-file --json --hash-type sha256 \ + "https://github.com/posit-dev/positron/releases/download/${new_version}/Positron-${new_version}.deb" \ + | jq -r .hash) + +sed -i "s|$current_hash|$new_hash|g" $positron_nix + +# Update version +sed -i "s|$current_version|$new_version|g" $positron_nix + +# Attempt to build. +export NIXPKGS_ALLOW_UNFREE=1 + +if ! nix-build -A positron-bin "$nixpkgs"; then + echo "The updated positron-bin failed to build." + exit 1 +fi + +# Commit changes +git add "$positron_nix" +git commit -m "positron-bin: ${current_version} -> ${new_version}" From 0114bdb771fb438841448a988a3f0ec385616781 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Wed, 30 Oct 2024 12:39:53 +0000 Subject: [PATCH 30/57] bitbake-language-server: 0.0.14 -> 0.0.15 --- pkgs/by-name/bi/bitbake-language-server/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/bi/bitbake-language-server/package.nix b/pkgs/by-name/bi/bitbake-language-server/package.nix index 3789d3bd9ba2..fe19310ab29d 100644 --- a/pkgs/by-name/bi/bitbake-language-server/package.nix +++ b/pkgs/by-name/bi/bitbake-language-server/package.nix @@ -7,14 +7,14 @@ python3.pkgs.buildPythonApplication rec { pname = "bitbake-language-server"; - version = "0.0.14"; + version = "0.0.15"; format = "pyproject"; src = fetchFromGitHub { owner = "Freed-Wu"; repo = pname; rev = version; - hash = "sha256-aGj9lW420A+iTQWSCdIITAJj3p89VUkPvdhQ/0M6uXo="; + hash = "sha256-NLDQ2P5peweugkoNYskpCyCEgBwVFA7RTs8+NvH8fj8="; }; nativeBuildInputs = with python3.pkgs; [ From 0af55cfcbe41750f7c821d5bfd7f54e1f20d94df Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Rafael=20Fern=C3=A1ndez=20L=C3=B3pez?= Date: Wed, 30 Oct 2024 13:43:30 +0100 Subject: [PATCH 31/57] docs: update docker and podman anchor on CUDA section --- doc/languages-frameworks/cuda.section.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/doc/languages-frameworks/cuda.section.md b/doc/languages-frameworks/cuda.section.md index af52a3d31d05..bb394a243b79 100644 --- a/doc/languages-frameworks/cuda.section.md +++ b/doc/languages-frameworks/cuda.section.md @@ -150,7 +150,7 @@ All new projects should use the CUDA redistributables available in [`cudaPackage In the scenario you are unable to run the resulting binary: this is arguably the most complicated as it could be any combination of the previous reasons. This type of failure typically occurs when a library attempts to load or open a library it depends on that it does not declare in its `DT_NEEDED` section. As a first step, ensure that dependencies are patched with [`autoAddDriverRunpath`](https://search.nixos.org/packages?channel=unstable&type=packages&query=autoAddDriverRunpath). Failing that, try running the application with [`nixGL`](https://github.com/guibou/nixGL) or a similar wrapper tool. If that works, it likely means that the application is attempting to load a library that is not in the `RPATH` or `RUNPATH` of the binary. -## Running Docker or Podman containers with CUDA support {#running-docker-or-podman-containers-with-cuda-support} +## Running Docker or Podman containers with CUDA support {#cuda-docker-podman} It is possible to run Docker or Podman containers with CUDA support. The recommended mechanism to perform this task is to use the [NVIDIA Container Toolkit](https://docs.nvidia.com/datacenter/cloud-native/container-toolkit/latest/index.html). From b0f5d7c1f54b6959e7f5a8a443f71a4463ccf553 Mon Sep 17 00:00:00 2001 From: a-kenji Date: Wed, 30 Oct 2024 14:47:13 +0100 Subject: [PATCH 32/57] hebbot: move from `matrix-hebbot` This attribute move was sadly overlooked by the migration to `pkgs/by-name`, it has not been in a stable release so far. --- pkgs/by-name/{ma/matrix-hebbot => he/hebbot}/package.nix | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename pkgs/by-name/{ma/matrix-hebbot => he/hebbot}/package.nix (100%) diff --git a/pkgs/by-name/ma/matrix-hebbot/package.nix b/pkgs/by-name/he/hebbot/package.nix similarity index 100% rename from pkgs/by-name/ma/matrix-hebbot/package.nix rename to pkgs/by-name/he/hebbot/package.nix From b907d793ebc4e8b8b38aeb4ea8ec5bb9ebc6eb1c Mon Sep 17 00:00:00 2001 From: 06kellyjac Date: Wed, 30 Oct 2024 13:42:17 +0000 Subject: [PATCH 33/57] fulcio: 1.6.4 -> 1.6.5 Moved to pkgs/by-name Diff: https://github.com/sigstore/fulcio/compare/v1.6.4...v1.6.5 Changelog: https://github.com/sigstore/fulcio/releases/tag/v1.6.5 --- .../fu/fulcio/package.nix} | 66 ++++++++++++------- pkgs/top-level/all-packages.nix | 2 - 2 files changed, 44 insertions(+), 24 deletions(-) rename pkgs/{tools/security/fulcio/default.nix => by-name/fu/fulcio/package.nix} (66%) diff --git a/pkgs/tools/security/fulcio/default.nix b/pkgs/by-name/fu/fulcio/package.nix similarity index 66% rename from pkgs/tools/security/fulcio/default.nix rename to pkgs/by-name/fu/fulcio/package.nix index 9f3207dbc6ce..91479e062755 100644 --- a/pkgs/tools/security/fulcio/default.nix +++ b/pkgs/by-name/fu/fulcio/package.nix @@ -1,14 +1,27 @@ -{ lib, buildGoModule, fetchFromGitHub, installShellFiles }: +{ + lib, + buildGoModule, + fetchFromGitHub, + + # required for completion and cross-complilation + installShellFiles, + buildPackages, + stdenv, + + # required for testing + testers, + fulcio, +}: buildGoModule rec { pname = "fulcio"; - version = "1.6.4"; + version = "1.6.5"; src = fetchFromGitHub { owner = "sigstore"; repo = pname; rev = "v${version}"; - hash = "sha256-eRf504i9kYQua/p0SNlDGNeXa9ztoyz6M8nukhRyzIY="; + hash = "sha256-TCWZrTqNXTcTsLqTnwnJPXN+kMYVVwLm2J3Y6gd2CV8="; # populate values that require us to use git. By doing this in postFetch we # can delete .git afterwards and maintain better reproducibility of the src. leaveDotGit = true; @@ -20,7 +33,7 @@ buildGoModule rec { find "$out" -name .git -print0 | xargs -0 rm -rf ''; }; - vendorHash = "sha256-VTJhQrsqwGHq8211N3pUf4fmU4H90gRWYJTdEufNGg4="; + vendorHash = "sha256-3E2Y0UlJMjTiM4ILEiaNqVmt4fWMvCRAqzm//CvRIl4="; nativeBuildInputs = [ installShellFiles ]; @@ -42,26 +55,32 @@ buildGoModule rec { preCheck = '' # test all paths unset subPackages - - # skip test that requires networking - substituteInPlace pkg/config/config_network_test.go \ - --replace "TestLoad" "SkipLoad" ''; - postInstall = '' - installShellCompletion --cmd fulcio \ - --bash <($out/bin/fulcio completion bash) \ - --fish <($out/bin/fulcio completion fish) \ - --zsh <($out/bin/fulcio completion zsh) - ''; + checkFlags = [ + "-skip=TestLoad" + ]; - doInstallCheck = true; - installCheckPhase = '' - runHook preInstallCheck - $out/bin/fulcio --help - $out/bin/fulcio version 2>&1 | grep "v${version}" - runHook postInstallCheck - ''; + postInstall = + let + fulcio = + if stdenv.buildPlatform.canExecute stdenv.hostPlatform then + placeholder "out" + else + buildPackages.fulcio; + in + '' + installShellCompletion --cmd fulcio \ + --bash <(${fulcio}/bin/fulcio completion bash) \ + --fish <(${fulcio}/bin/fulcio completion fish) \ + --zsh <(${fulcio}/bin/fulcio completion zsh) + ''; + + passthru.tests.version = testers.testVersion { + package = fulcio; + command = "fulcio version"; + version = "v${version}"; + }; meta = with lib; { homepage = "https://github.com/sigstore/fulcio"; @@ -79,6 +98,9 @@ buildGoModule rec { disconnected instance. ''; license = licenses.asl20; - maintainers = with maintainers; [ lesuisse jk ]; + maintainers = with maintainers; [ + lesuisse + jk + ]; }; } diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index 92bc0ac82acb..ae46cedd1e08 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -7665,8 +7665,6 @@ with pkgs; fswebcam = callPackage ../os-specific/linux/fswebcam { }; - fulcio = callPackage ../tools/security/fulcio { }; - fuseiso = callPackage ../tools/filesystems/fuseiso { }; fdbPackages = dontRecurseIntoAttrs (callPackage ../servers/foundationdb { }); From cbf90379d11f7f535fda6c7a8f6c442cf3dd1418 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Wed, 30 Oct 2024 13:59:29 +0000 Subject: [PATCH 34/57] atproto-goat: 0-unstable-2024-10-08 -> 0-unstable-2024-10-29 --- pkgs/by-name/at/atproto-goat/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/at/atproto-goat/package.nix b/pkgs/by-name/at/atproto-goat/package.nix index 0874fe7f103a..b2ba3474d212 100644 --- a/pkgs/by-name/at/atproto-goat/package.nix +++ b/pkgs/by-name/at/atproto-goat/package.nix @@ -7,13 +7,13 @@ buildGoModule rec { pname = "atproto-goat"; - version = "0-unstable-2024-10-08"; + version = "0-unstable-2024-10-29"; src = fetchFromGitHub { owner = "bluesky-social"; repo = "indigo"; - rev = "06bacb465af714feb77609566aba15ab1ed41e24"; - hash = "sha256-wWsE3sAGZQmOBVqTgy4RjoU8zmtuvyQIj9DjwSbtmKw="; + rev = "983ce4a481a32a3eb2944c4c76e885d0f6006f83"; + hash = "sha256-Jo3pI4uRyKh3yV03ijOcg+Uyu75Spmy/VS116MVgleU="; }; postPatch = '' From 34fe58c3a1345719727eb0443b3265d6bb615324 Mon Sep 17 00:00:00 2001 From: Samuel Tardieu Date: Fri, 25 Oct 2024 16:29:23 +0200 Subject: [PATCH 35/57] python312Packages.sphinx-lv2-theme: init at 1.4.2 --- .../sphinx-lv2-theme/default.nix | 33 +++++++++++++++++++ pkgs/top-level/python-packages.nix | 2 ++ 2 files changed, 35 insertions(+) create mode 100644 pkgs/development/python-modules/sphinx-lv2-theme/default.nix diff --git a/pkgs/development/python-modules/sphinx-lv2-theme/default.nix b/pkgs/development/python-modules/sphinx-lv2-theme/default.nix new file mode 100644 index 000000000000..47689da31158 --- /dev/null +++ b/pkgs/development/python-modules/sphinx-lv2-theme/default.nix @@ -0,0 +1,33 @@ +{ + buildPythonPackage, + lib, + fetchFromGitLab, + setuptools, + sphinx, +}: + +buildPythonPackage rec { + pname = "sphinx-lv2-theme"; + version = "1.4.2"; + pyproject = true; + + src = fetchFromGitLab { + owner = "LV2"; + repo = "sphinx_lv2_theme"; + rev = "v${version}"; + hash = "sha256-x3h2hOQIyzOmnh58WMHjuOARdML1sDiVAf7m0YghhJ4="; + }; + + build-system = [ setuptools ]; + + dependencies = [ sphinx ]; + + pythonImportsCheck = [ "sphinx_lv2_theme" ]; + + meta = { + description = "Sphinx theme in the style of the LV2 plugin"; + homepage = "https://gitlab.com/lv2/sphinx_lv2_theme"; + license = lib.licenses.isc; + maintainers = with lib.maintainers; [ samueltardieu ]; + }; +} diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix index 2479af7f7fa0..cae561048c50 100644 --- a/pkgs/top-level/python-packages.nix +++ b/pkgs/top-level/python-packages.nix @@ -14773,6 +14773,8 @@ self: super: with self; { sphinx-jupyterbook-latex = callPackage ../development/python-modules/sphinx-jupyterbook-latex { }; + sphinx-lv2-theme = callPackage ../development/python-modules/sphinx-lv2-theme { }; + sphinx-multitoc-numbering = callPackage ../development/python-modules/sphinx-multitoc-numbering { }; sphinx-notfound-page = callPackage ../development/python-modules/sphinx-notfound-page { }; From 7278ad3935bbcd129dd6fdf4280ef1efe1a55607 Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Wed, 30 Oct 2024 16:21:49 +0100 Subject: [PATCH 36/57] home-assistant-custom-lovelace-modules.mushroom: 4.0.7 -> 4.0.8 https://github.com/piitaya/lovelace-mushroom/releases/tag/v4.0.8 --- .../custom-lovelace-modules/mushroom/default.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/servers/home-assistant/custom-lovelace-modules/mushroom/default.nix b/pkgs/servers/home-assistant/custom-lovelace-modules/mushroom/default.nix index 9a03f71e8041..5c05354c3752 100644 --- a/pkgs/servers/home-assistant/custom-lovelace-modules/mushroom/default.nix +++ b/pkgs/servers/home-assistant/custom-lovelace-modules/mushroom/default.nix @@ -5,16 +5,16 @@ buildNpmPackage rec { pname = "mushroom"; - version = "4.0.7"; + version = "4.0.8"; src = fetchFromGitHub { owner = "piitaya"; repo = "lovelace-mushroom"; rev = "v${version}"; - hash = "sha256-97FW4kNPaoP501xD0W/PjmykwhLbLz7yHVNZiwl/clE="; + hash = "sha256-jwL/LrnQsjwv9Wt+jmJKE7jJ3YO8K7eBkxkvAvCbg7g="; }; - npmDepsHash = "sha256-Gpt17teEbBMHU8teiH66fjZmgq+6v/XovTVxNfHFTg4="; + npmDepsHash = "sha256-fzmVRmX1lBy+t7gRCUfw2ONYyKDUs6IkSnAstiYJ7qg="; installPhase = '' runHook preInstall From ece1914240e2d2625e1dc45ed2d4a2485ee8d86a Mon Sep 17 00:00:00 2001 From: aktaboot Date: Sat, 19 Oct 2024 22:30:20 +0200 Subject: [PATCH 37/57] syncstorage-rs: 0.17.9 -> 0.17.12 https://github.com/mozilla-services/syncstorage-rs/releases --- pkgs/by-name/sy/syncstorage-rs/Cargo.lock | 47 +++++++++------------- pkgs/by-name/sy/syncstorage-rs/package.nix | 5 ++- 2 files changed, 23 insertions(+), 29 deletions(-) diff --git a/pkgs/by-name/sy/syncstorage-rs/Cargo.lock b/pkgs/by-name/sy/syncstorage-rs/Cargo.lock index 4333f1d26fbb..4f364aacbdd5 100644 --- a/pkgs/by-name/sy/syncstorage-rs/Cargo.lock +++ b/pkgs/by-name/sy/syncstorage-rs/Cargo.lock @@ -2458,8 +2458,7 @@ checksum = "61697e0a1c7e512e84a621326239844a24d8207b4669b41bc18b32ea5cbf988b" [[package]] name = "sentry" version = "0.34.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5484316556650182f03b43d4c746ce0e3e48074a21e2f51244b648b6542e1066" +source = "git+https://github.com/getsentry/sentry-rust?rev=1b65b5c#1b65b5c99af975496880e7325218479e0037d097" dependencies = [ "curl", "httpdate", @@ -2473,8 +2472,7 @@ dependencies = [ [[package]] name = "sentry-backtrace" version = "0.34.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "40aa225bb41e2ec9d7c90886834367f560efc1af028f1c5478a6cce6a59c463a" +source = "git+https://github.com/getsentry/sentry-rust?rev=1b65b5c#1b65b5c99af975496880e7325218479e0037d097" dependencies = [ "backtrace", "once_cell", @@ -2485,8 +2483,7 @@ dependencies = [ [[package]] name = "sentry-contexts" version = "0.34.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1a8dd746da3d16cb8c39751619cefd4fcdbd6df9610f3310fd646b55f6e39910" +source = "git+https://github.com/getsentry/sentry-rust?rev=1b65b5c#1b65b5c99af975496880e7325218479e0037d097" dependencies = [ "hostname", "libc", @@ -2499,8 +2496,7 @@ dependencies = [ [[package]] name = "sentry-core" version = "0.34.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "161283cfe8e99c8f6f236a402b9ccf726b201f365988b5bb637ebca0abbd4a30" +source = "git+https://github.com/getsentry/sentry-rust?rev=1b65b5c#1b65b5c99af975496880e7325218479e0037d097" dependencies = [ "once_cell", "rand", @@ -2512,8 +2508,7 @@ dependencies = [ [[package]] name = "sentry-debug-images" version = "0.34.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8fc6b25e945fcaa5e97c43faee0267eebda9f18d4b09a251775d8fef1086238a" +source = "git+https://github.com/getsentry/sentry-rust?rev=1b65b5c#1b65b5c99af975496880e7325218479e0037d097" dependencies = [ "findshlibs", "once_cell", @@ -2523,8 +2518,7 @@ dependencies = [ [[package]] name = "sentry-tracing" version = "0.34.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "cd3c5faf2103cd01eeda779ea439b68c4ee15adcdb16600836e97feafab362ec" +source = "git+https://github.com/getsentry/sentry-rust?rev=1b65b5c#1b65b5c99af975496880e7325218479e0037d097" dependencies = [ "sentry-backtrace", "sentry-core", @@ -2535,8 +2529,7 @@ dependencies = [ [[package]] name = "sentry-types" version = "0.34.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5d68cdf6bc41b8ff3ae2a9c4671e97426dcdd154cc1d4b6b72813f285d6b163f" +source = "git+https://github.com/getsentry/sentry-rust?rev=1b65b5c#1b65b5c99af975496880e7325218479e0037d097" dependencies = [ "debugid", "hex", @@ -2827,7 +2820,7 @@ checksum = "a7065abeca94b6a8a577f9bd45aa0867a2238b74e8eb67cf10d492bc39351394" [[package]] name = "syncserver" -version = "0.17.9" +version = "0.17.12" dependencies = [ "actix-cors", "actix-http", @@ -2882,7 +2875,7 @@ dependencies = [ [[package]] name = "syncserver-common" -version = "0.17.9" +version = "0.17.12" dependencies = [ "actix-web", "backtrace", @@ -2902,7 +2895,7 @@ dependencies = [ [[package]] name = "syncserver-db-common" -version = "0.17.9" +version = "0.17.12" dependencies = [ "backtrace", "deadpool", @@ -2916,7 +2909,7 @@ dependencies = [ [[package]] name = "syncserver-settings" -version = "0.17.9" +version = "0.17.12" dependencies = [ "config 0.11.0", "num_cpus", @@ -2930,7 +2923,7 @@ dependencies = [ [[package]] name = "syncstorage-db" -version = "0.17.9" +version = "0.17.12" dependencies = [ "async-trait", "cadence", @@ -2953,7 +2946,7 @@ dependencies = [ [[package]] name = "syncstorage-db-common" -version = "0.17.9" +version = "0.17.12" dependencies = [ "async-trait", "backtrace", @@ -2972,7 +2965,7 @@ dependencies = [ [[package]] name = "syncstorage-mysql" -version = "0.17.9" +version = "0.17.12" dependencies = [ "async-trait", "backtrace", @@ -2995,7 +2988,7 @@ dependencies = [ [[package]] name = "syncstorage-settings" -version = "0.17.9" +version = "0.17.12" dependencies = [ "rand", "serde 1.0.203", @@ -3005,7 +2998,7 @@ dependencies = [ [[package]] name = "syncstorage-spanner" -version = "0.17.9" +version = "0.17.12" dependencies = [ "async-trait", "backtrace", @@ -3149,7 +3142,7 @@ checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20" [[package]] name = "tokenserver-auth" -version = "0.17.9" +version = "0.17.12" dependencies = [ "async-trait", "base64 0.22.1", @@ -3176,7 +3169,7 @@ dependencies = [ [[package]] name = "tokenserver-common" -version = "0.17.9" +version = "0.17.12" dependencies = [ "actix-web", "backtrace", @@ -3191,7 +3184,7 @@ dependencies = [ [[package]] name = "tokenserver-db" -version = "0.17.9" +version = "0.17.12" dependencies = [ "async-trait", "backtrace", @@ -3216,7 +3209,7 @@ dependencies = [ [[package]] name = "tokenserver-settings" -version = "0.17.9" +version = "0.17.12" dependencies = [ "jsonwebtoken", "serde 1.0.203", diff --git a/pkgs/by-name/sy/syncstorage-rs/package.nix b/pkgs/by-name/sy/syncstorage-rs/package.nix index 4c24a889afd0..be1765ce034a 100644 --- a/pkgs/by-name/sy/syncstorage-rs/package.nix +++ b/pkgs/by-name/sy/syncstorage-rs/package.nix @@ -20,13 +20,13 @@ in rustPlatform.buildRustPackage rec { pname = "syncstorage-rs"; - version = "0.17.9"; + version = "0.17.12"; src = fetchFromGitHub { owner = "mozilla-services"; repo = pname; rev = "refs/tags/${version}"; - hash = "sha256-ezTwAAtt0/jKfA6FtvzuQVFYOODMcD4RFiU3x0Umifk="; + hash = "sha256-hvKbKbRa5zk+80xmKWeMRjshaS6uybFzb5KdBY19Sl8="; }; nativeBuildInputs = [ @@ -49,6 +49,7 @@ rustPlatform.buildRustPackage rec { lockFile = ./Cargo.lock; outputHashes = { "deadpool-0.7.0" = "sha256-yQwn45EuzmPBwuT+iLJ/LLWAkBkW2vF+GLswdbpFVAY="; + "sentry-0.34.0" = "sha256-BdWz6EIEm2YU3DG3ODkuXCVCMV6srdyx2gXkOxINjHc="; }; }; From d2c9de5e7c2f48328a5817a1cb8e6dab4adfbf94 Mon Sep 17 00:00:00 2001 From: aktaboot Date: Mon, 21 Oct 2024 14:04:26 +0200 Subject: [PATCH 38/57] syncstorage-rs: add passthru.updateScript --- pkgs/by-name/sy/syncstorage-rs/package.nix | 3 +++ 1 file changed, 3 insertions(+) diff --git a/pkgs/by-name/sy/syncstorage-rs/package.nix b/pkgs/by-name/sy/syncstorage-rs/package.nix index be1765ce034a..51dc44b14e34 100644 --- a/pkgs/by-name/sy/syncstorage-rs/package.nix +++ b/pkgs/by-name/sy/syncstorage-rs/package.nix @@ -6,6 +6,7 @@ , libmysqlclient , makeBinaryWrapper , lib +, nix-update-script }: let @@ -56,6 +57,8 @@ rustPlatform.buildRustPackage rec { # almost all tests need a DB to test against doCheck = false; + passthru.updateScript = nix-update-script {}; + meta = { description = "Mozilla Sync Storage built with Rust"; homepage = "https://github.com/mozilla-services/syncstorage-rs"; From 98c9f5fd29c91d00ed9f3f30a61e709298e2fbd8 Mon Sep 17 00:00:00 2001 From: techknowlogick Date: Fri, 25 Oct 2024 11:47:44 -0400 Subject: [PATCH 39/57] teleport_15: 15.4.11 -> 15.4.21 --- pkgs/servers/teleport/15/default.nix | 8 ++++---- pkgs/servers/teleport/generic.nix | 2 +- pkgs/servers/teleport/tsh.patch | 2 +- pkgs/servers/teleport/tsh_16.patch | 17 ----------------- 4 files changed, 6 insertions(+), 23 deletions(-) delete mode 100644 pkgs/servers/teleport/tsh_16.patch diff --git a/pkgs/servers/teleport/15/default.nix b/pkgs/servers/teleport/15/default.nix index 23ac2d2024d7..12cedd539696 100644 --- a/pkgs/servers/teleport/15/default.nix +++ b/pkgs/servers/teleport/15/default.nix @@ -1,9 +1,9 @@ { wasm-bindgen-cli, ... }@args: import ../generic.nix (args // { - version = "15.4.11"; - hash = "sha256-vmJ76aRAsbSGXZ2HcuryOlUYrUOPMP6MaI8OjxxyiZ4="; - vendorHash = "sha256-oJo8Ga6TAUz1xSYiRckzq8zZvgIZFCeEwZbiyyVOdkI="; - yarnHash = "sha256-5ppgBa5CyQ49FSFhdWDbTcCTdt0vsXAzNTeyG4r7crg="; + version = "15.4.21"; + hash = "sha256-n5dAJ5ilq5nHo3neQzCUFnDRwLhArwleMSho4/g0MT4="; + vendorHash = "sha256-bW8ztNeSzxUNtbuBtxIya9TeGfktC+/fz9iXB0GL0Mg="; + yarnHash = "sha256-ZaLLrcwAeq6TQ1SaA2few4s0HqktOZEpxCTcNGloGfk="; cargoLock = { lockFile = ./Cargo.lock; outputHashes = { diff --git a/pkgs/servers/teleport/generic.nix b/pkgs/servers/teleport/generic.nix index abeed3b24435..ed2ce5d8a7d1 100644 --- a/pkgs/servers/teleport/generic.nix +++ b/pkgs/servers/teleport/generic.nix @@ -150,7 +150,7 @@ buildGoModule rec { patches = extPatches ++ [ ./0001-fix-add-nix-path-to-exec-env.patch ./rdpclient.patch - (if lib.versionAtLeast version "16" then ./tsh_16.patch else ./tsh.patch) + ./tsh.patch ]; # Reduce closure size for client machines diff --git a/pkgs/servers/teleport/tsh.patch b/pkgs/servers/teleport/tsh.patch index 6344a3915717..f510b21d5dec 100644 --- a/pkgs/servers/teleport/tsh.patch +++ b/pkgs/servers/teleport/tsh.patch @@ -11,7 +11,7 @@ index 5de21c69d0..3995c19e3c 100644 if err != nil { return trace.Wrap(err) } -+ cf.executablePath = path.Dir(tempBinaryPath) + "/tsh" ++ cf.executablePath = filepath.Dir(tempBinaryPath) + "/tsh" // configs setEnvFlags(&cf) diff --git a/pkgs/servers/teleport/tsh_16.patch b/pkgs/servers/teleport/tsh_16.patch deleted file mode 100644 index f510b21d5dec..000000000000 --- a/pkgs/servers/teleport/tsh_16.patch +++ /dev/null @@ -1,17 +0,0 @@ -diff --git a/tool/tsh/common/tsh.go b/tool/tsh/common/tsh.go -index 5de21c69d0..3995c19e3c 100644 ---- a/tool/tsh/common/tsh.go -+++ b/tool/tsh/common/tsh.go -@@ -1084,10 +1084,11 @@ func Run(ctx context.Context, args []string, opts ...CliOption) error { - - var err error - -- cf.executablePath, err = os.Executable() -+ tempBinaryPath, err := os.Executable() - if err != nil { - return trace.Wrap(err) - } -+ cf.executablePath = filepath.Dir(tempBinaryPath) + "/tsh" - - // configs - setEnvFlags(&cf) From 47ce90d1e9600fec977fccf6af5ef451c09f94c9 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Wed, 30 Oct 2024 15:48:04 +0000 Subject: [PATCH 40/57] python312Packages.sagemaker-core: 1.0.10 -> 1.0.11 --- pkgs/development/python-modules/sagemaker-core/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/python-modules/sagemaker-core/default.nix b/pkgs/development/python-modules/sagemaker-core/default.nix index 2ae837fa6e40..262f1ff3673f 100644 --- a/pkgs/development/python-modules/sagemaker-core/default.nix +++ b/pkgs/development/python-modules/sagemaker-core/default.nix @@ -25,14 +25,14 @@ buildPythonPackage rec { pname = "sagemaker-core"; - version = "1.0.10"; + version = "1.0.11"; pyproject = true; src = fetchFromGitHub { owner = "aws"; repo = "sagemaker-core"; rev = "refs/tags/v${version}"; - hash = "sha256-UloQJ5B10XXPbwsktVZzjcW7BLW8wCAw3wGmAkSl6wc="; + hash = "sha256-6r8roHMJ4s/+mGiPeMVZ9wagdXNJQ3+tUFZ/7T+NQBc="; }; build-system = [ From d78e3fa321d24e60480b2c7ae7244ee12a0be37a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Felix=20Schr=C3=B6ter?= Date: Wed, 30 Oct 2024 17:10:33 +0100 Subject: [PATCH 41/57] mullvad-browser: 13.5.7 -> 13.5.9 https://github.com/mullvad/mullvad-browser/releases/tag/13.5.9 --- pkgs/by-name/mu/mullvad-browser/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/mu/mullvad-browser/package.nix b/pkgs/by-name/mu/mullvad-browser/package.nix index 2dd6f0463833..84b63cc542ce 100644 --- a/pkgs/by-name/mu/mullvad-browser/package.nix +++ b/pkgs/by-name/mu/mullvad-browser/package.nix @@ -90,7 +90,7 @@ let ++ lib.optionals mediaSupport [ ffmpeg ] ); - version = "13.5.7"; + version = "13.5.9"; sources = { x86_64-linux = fetchurl { @@ -102,7 +102,7 @@ let "https://tor.eff.org/dist/mullvadbrowser/${version}/mullvad-browser-linux-x86_64-${version}.tar.xz" "https://tor.calyxinstitute.org/dist/mullvadbrowser/${version}/mullvad-browser-linux-x86_64-${version}.tar.xz" ]; - hash = "sha256-Te6Cw3fUs4XGz07lL54bKUU9HYC5soaKFlbWGujd/oU="; + hash = "sha256-hyFYI42IfFY0vqkqInkLQAWSY8flsmWGN8CaXBwXbGA="; }; }; From 1c5d6411a65d3378e416fb542da496a34bbcd900 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Wed, 30 Oct 2024 16:24:12 +0000 Subject: [PATCH 42/57] simple64-netplay-server: 2024.06.1 -> 2024.10.1 --- pkgs/by-name/si/simple64-netplay-server/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/si/simple64-netplay-server/package.nix b/pkgs/by-name/si/simple64-netplay-server/package.nix index 9f39a3b782d3..079997fca19b 100644 --- a/pkgs/by-name/si/simple64-netplay-server/package.nix +++ b/pkgs/by-name/si/simple64-netplay-server/package.nix @@ -6,16 +6,16 @@ buildGoModule rec { pname = "simple64-netplay-server"; - version = "2024.06.1"; + version = "2024.10.1"; src = fetchFromGitHub { owner = "simple64"; repo = "simple64-netplay-server"; rev = "refs/tags/v${version}"; - hash = "sha256-WTEtTzRkXuIusfK6Nbj1aLwXcXyaXQi+j3SsDrvtLKo="; + hash = "sha256-p9hHVf1LD95w280ScUkxHKmBJLJ9eiH3WEYV+kaALgQ="; }; - vendorHash = "sha256-zfLSti368rBHj17HKDZKtOQQrhVGVa2CaieaDGHcZOk="; + vendorHash = "sha256-HeYA/nR0NuP/fPMJXGGuN2eP6vB4yj1yWFfFDyp34QE="; meta = { description = "Dedicated server for simple64 netplay"; From 79de2381eca79067508ebf1bf52a7300945f5e88 Mon Sep 17 00:00:00 2001 From: Fabian Affolter Date: Wed, 30 Oct 2024 17:26:11 +0100 Subject: [PATCH 43/57] python312Packages.walrus: 0.9.3 -> 0.9.4 Diff: https://github.com/coleifer/walrus/compare/refs/tags/0.9.3...0.9.4 Changelog: https://github.com/coleifer/walrus/blob/0.9.4/CHANGELOG.md --- .../python-modules/walrus/default.nix | 22 ++++++------------- 1 file changed, 7 insertions(+), 15 deletions(-) diff --git a/pkgs/development/python-modules/walrus/default.nix b/pkgs/development/python-modules/walrus/default.nix index 976037f92889..e5513ff4ac9a 100644 --- a/pkgs/development/python-modules/walrus/default.nix +++ b/pkgs/development/python-modules/walrus/default.nix @@ -1,18 +1,18 @@ { lib, - pkgs, buildPythonPackage, fetchFromGitHub, + pkgs, pythonOlder, redis, + setuptools, unittestCheckHook, - fetchpatch, }: buildPythonPackage rec { pname = "walrus"; - version = "0.9.3"; - format = "setuptools"; + version = "0.9.4"; + pyproject = true; disabled = pythonOlder "3.7"; @@ -20,20 +20,12 @@ buildPythonPackage rec { owner = "coleifer"; repo = "walrus"; rev = "refs/tags/${version}"; - hash = "sha256-jinYMGSBAY8HTg92qU/iU5vGIrrDr5SeQG0XjsBVfcc="; + hash = "sha256-cvoRiaGGTpZWfSE6DDT6GwDmc/TC/Z/E76Qy9Zzkpsw="; }; - patches = [ - # distutils has been deprecated, this wraps its import inside a try-catch - # and fallsback to a fallback import. - # Should not be necessary in future versions. - (fetchpatch { - url = "https://github.com/coleifer/walrus/commit/79e20c89aa4015017ef8a3e0b5c27ca2731dc9b2.patch"; - hash = "sha256-hCpvki6SV3KYhicjjUMP4VrKMEerMjq2n1BgozXKDO8="; - }) - ]; + build-system = [ setuptools ]; - propagatedBuildInputs = [ redis ]; + dependencies = [ redis ]; nativeCheckInputs = [ unittestCheckHook ]; From 93cce0becc5e1eb0be4b870681c86cc4e024ef16 Mon Sep 17 00:00:00 2001 From: Wim de With Date: Wed, 30 Oct 2024 19:20:01 +0100 Subject: [PATCH 44/57] nixos/prometheus: remove tor exporter --- .../manual/release-notes/rl-2411.section.md | 2 + .../monitoring/prometheus/exporters.nix | 4 +- .../monitoring/prometheus/exporters/tor.nix | 43 ------------------- nixos/tests/prometheus-exporters.nix | 19 -------- .../monitoring/prometheus/tor-exporter.nix | 2 - 5 files changed, 5 insertions(+), 65 deletions(-) delete mode 100644 nixos/modules/services/monitoring/prometheus/exporters/tor.nix diff --git a/nixos/doc/manual/release-notes/rl-2411.section.md b/nixos/doc/manual/release-notes/rl-2411.section.md index 8123f2ca52e9..27839938a98d 100644 --- a/nixos/doc/manual/release-notes/rl-2411.section.md +++ b/nixos/doc/manual/release-notes/rl-2411.section.md @@ -564,6 +564,8 @@ - The `services.prometheus.exporters.minio` option has been removed, as it's upstream implementation was broken and unmaintained. Minio now has built-in [Prometheus metrics exposure](https://min.io/docs/minio/linux/operations/monitoring/collect-minio-metrics-using-prometheus.html), which can be used instead. +- The `services.prometheus.exporters.tor` option has been removed, as its upstream implementation was broken and unmaintained. + - The `services.patroni.raft` option has been removed, as Raft has been [deprecated by upstream since 3.0.0](https://github.com/patroni/patroni/blob/master/docs/releases.rst#version-300) - `services.roundcube.maxAttachmentSize` will multiply the value set with `1.37` to offset overhead introduced by the base64 encoding applied to attachments. diff --git a/nixos/modules/services/monitoring/prometheus/exporters.nix b/nixos/modules/services/monitoring/prometheus/exporters.nix index cf840a2d4514..c388a7aa5558 100644 --- a/nixos/modules/services/monitoring/prometheus/exporters.nix +++ b/nixos/modules/services/monitoring/prometheus/exporters.nix @@ -88,7 +88,6 @@ let "statsd" "surfboard" "systemd" - "tor" "unbound" "unifi" "unpoller" @@ -299,6 +298,9 @@ in The Minio exporter has been removed, as it was broken and unmaintained. See the 24.11 release notes for more information. '') + (lib.mkRemovedOptionModule [ "tor" ] '' + The Tor exporter has been removed, as it was broken and unmaintained. + '') ]; }; description = "Prometheus exporter configuration"; diff --git a/nixos/modules/services/monitoring/prometheus/exporters/tor.nix b/nixos/modules/services/monitoring/prometheus/exporters/tor.nix deleted file mode 100644 index d39112d0c283..000000000000 --- a/nixos/modules/services/monitoring/prometheus/exporters/tor.nix +++ /dev/null @@ -1,43 +0,0 @@ -{ config, lib, pkgs, options, ... }: - -let - cfg = config.services.prometheus.exporters.tor; - inherit (lib) mkOption types concatStringsSep; -in -{ - port = 9130; - extraOpts = { - torControlAddress = mkOption { - type = types.str; - default = "127.0.0.1"; - description = '' - Tor control IP address or hostname. - ''; - }; - - torControlPort = mkOption { - type = types.port; - default = 9051; - description = '' - Tor control port. - ''; - }; - }; - serviceOpts = { - serviceConfig = { - ExecStart = '' - ${pkgs.prometheus-tor-exporter}/bin/prometheus-tor-exporter \ - -b ${cfg.listenAddress} \ - -p ${toString cfg.port} \ - -a ${cfg.torControlAddress} \ - -c ${toString cfg.torControlPort} \ - ${concatStringsSep " \\\n " cfg.extraFlags} - ''; - }; - - # CPython requires a process to either have $HOME defined or run as a UID - # defined in /etc/passwd. The latter is false with DynamicUser, so define a - # dummy $HOME. https://bugs.python.org/issue10496 - environment = { HOME = "/var/empty"; }; - }; -} diff --git a/nixos/tests/prometheus-exporters.nix b/nixos/tests/prometheus-exporters.nix index 71eef72df6f3..6ad1bc654084 100644 --- a/nixos/tests/prometheus-exporters.nix +++ b/nixos/tests/prometheus-exporters.nix @@ -1511,25 +1511,6 @@ let ''; }; - tor = { - exporterConfig = { - enable = true; - }; - metricProvider = { - # Note: this does not connect the test environment to the Tor network. - # Client, relay, bridge or exit connectivity are disabled by default. - services.tor.enable = true; - services.tor.settings.ControlPort = 9051; - }; - exporterTest = '' - wait_for_unit("tor.service") - wait_for_open_port(9051) - wait_for_unit("prometheus-tor-exporter.service") - wait_for_open_port(9130) - succeed("curl -sSf localhost:9130/metrics | grep 'tor_version{.\\+} 1'") - ''; - }; - unpoller = { nodeName = "unpoller"; exporterConfig.enable = true; diff --git a/pkgs/servers/monitoring/prometheus/tor-exporter.nix b/pkgs/servers/monitoring/prometheus/tor-exporter.nix index c12e92c5ee56..82983c1e0598 100644 --- a/pkgs/servers/monitoring/prometheus/tor-exporter.nix +++ b/pkgs/servers/monitoring/prometheus/tor-exporter.nix @@ -27,8 +27,6 @@ python3Packages.buildPythonApplication rec { --add-flags "$out/share/prometheus-tor-exporter.py" ''; - passthru.tests = { inherit (nixosTests.prometheus-exporters) tor; }; - meta = with lib; { description = "Prometheus exporter that exposes metrics from a Tor daemon"; mainProgram = "prometheus-tor-exporter"; From bc4b30e0c3cdbaaded2e1f5150ae822d45d2cd97 Mon Sep 17 00:00:00 2001 From: Wim de With Date: Wed, 30 Oct 2024 19:44:28 +0100 Subject: [PATCH 45/57] prometheus-tor-exporter: remove This package was broken by an update to its stem dependency and is no longer maintained. --- .../monitoring/prometheus/tor-exporter.nix | 38 ------------------- pkgs/top-level/aliases.nix | 1 + pkgs/top-level/all-packages.nix | 1 - 3 files changed, 1 insertion(+), 39 deletions(-) delete mode 100644 pkgs/servers/monitoring/prometheus/tor-exporter.nix diff --git a/pkgs/servers/monitoring/prometheus/tor-exporter.nix b/pkgs/servers/monitoring/prometheus/tor-exporter.nix deleted file mode 100644 index 82983c1e0598..000000000000 --- a/pkgs/servers/monitoring/prometheus/tor-exporter.nix +++ /dev/null @@ -1,38 +0,0 @@ -{ lib, fetchFromGitHub, python3Packages, nixosTests }: - -python3Packages.buildPythonApplication rec { - pname = "tor-exporter"; - version = "0.4"; - - # Just a single .py file to use as the application's main entry point. - format = "other"; - - src = fetchFromGitHub { - rev = "v${version}"; - owner = "atx"; - repo = "prometheus-tor_exporter"; - sha256 = "1gzf42z0cgdqijbi9cwpjkqzkvnabaxkkfa5ac5h27r3pxx3q4n0"; - }; - - propagatedBuildInputs = with python3Packages; [ prometheus-client stem retrying ]; - - installPhase = '' - mkdir -p $out/share/ - cp prometheus-tor-exporter.py $out/share/ - ''; - - fixupPhase = '' - makeWrapper "${python3Packages.python.interpreter}" "$out/bin/prometheus-tor-exporter" \ - --set PYTHONPATH "$PYTHONPATH" \ - --add-flags "$out/share/prometheus-tor-exporter.py" - ''; - - meta = with lib; { - description = "Prometheus exporter that exposes metrics from a Tor daemon"; - mainProgram = "prometheus-tor-exporter"; - homepage = "https://github.com/atx/prometheus-tor_exporter"; - license = licenses.mit; - maintainers = with maintainers; [ Scrumplex ]; - platforms = platforms.unix; - }; -} diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix index ac1e02b3ce72..64aeb521b9be 100644 --- a/pkgs/top-level/aliases.nix +++ b/pkgs/top-level/aliases.nix @@ -962,6 +962,7 @@ mapAliases { prometheus-dovecot-exporter = dovecot_exporter; # Added 2024-06-10 prometheus-openldap-exporter = throw "'prometheus-openldap-exporter' has been removed from nixpkgs, as it was unmaintained"; # Added 2024-09-01 prometheus-minio-exporter = throw "'prometheus-minio-exporter' has been removed from nixpkgs, use Minio's built-in Prometheus integration instead"; # Added 2024-06-10 + prometheus-tor-exporter = throw "'prometheus-tor-exporter' has been removed from nixpkgs, as it was broken and unmaintained"; # Added 2024-10-30 protobuf3_24 = protobuf_24; protobuf3_23 = protobuf_23; protobuf3_21 = protobuf_21; diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index 92bc0ac82acb..efe8f7a1be31 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -24877,7 +24877,6 @@ with pkgs; prometheus-surfboard-exporter = callPackage ../servers/monitoring/prometheus/surfboard-exporter.nix { }; prometheus-sql-exporter = callPackage ../servers/monitoring/prometheus/sql-exporter.nix { }; prometheus-systemd-exporter = callPackage ../servers/monitoring/prometheus/systemd-exporter.nix { }; - prometheus-tor-exporter = callPackage ../servers/monitoring/prometheus/tor-exporter.nix { }; prometheus-unbound-exporter = callPackage ../servers/monitoring/prometheus/unbound-exporter.nix { }; prometheus-v2ray-exporter = callPackage ../servers/monitoring/prometheus/v2ray-exporter.nix { }; prometheus-varnish-exporter = callPackage ../servers/monitoring/prometheus/varnish-exporter.nix { }; From b16ae23afd789e01760983bbda32d774b74e3c01 Mon Sep 17 00:00:00 2001 From: FliegendeWurst <2012gdwu+github@posteo.de> Date: Wed, 30 Oct 2024 19:49:52 +0100 Subject: [PATCH 46/57] qctools: revert ffmpeg version to 6 Regression caused by #337855 --- pkgs/applications/video/qctools/default.nix | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/pkgs/applications/video/qctools/default.nix b/pkgs/applications/video/qctools/default.nix index cbe565fe73c8..4f19af793880 100644 --- a/pkgs/applications/video/qctools/default.nix +++ b/pkgs/applications/video/qctools/default.nix @@ -1,4 +1,4 @@ -{ lib, stdenv, fetchurl, qmake, wrapQtAppsHook, ffmpeg, qtmultimedia, qwt }: +{ lib, stdenv, fetchurl, qmake, wrapQtAppsHook, ffmpeg_6, qtmultimedia, qwt }: stdenv.mkDerivation rec { pname = "qctools"; @@ -13,7 +13,7 @@ stdenv.mkDerivation rec { nativeBuildInputs = [ qmake wrapQtAppsHook ]; - buildInputs = [ ffmpeg qtmultimedia qwt ]; + buildInputs = [ ffmpeg_6 qtmultimedia qwt ]; installPhase = '' runHook preInstall @@ -30,11 +30,11 @@ stdenv.mkDerivation rec { runHook postInstall ''; - meta = with lib; { + meta = { description = "Audiovisual analytics and filtering of video files"; homepage = "https://mediaarea.net/QCTools"; - license = licenses.gpl3Only; - maintainers = with maintainers; [ orivej ]; - platforms = platforms.linux; + license = lib.licenses.gpl3Only; + maintainers = with lib.maintainers; [ orivej ]; + platforms = lib.platforms.linux; }; } From efe481b1874787b7c49842d518c0ea961c8b7954 Mon Sep 17 00:00:00 2001 From: Jordan Williams Date: Wed, 30 Oct 2024 14:11:45 -0500 Subject: [PATCH 47/57] nagiosPlugins.openbsd_snmp3_check: init at 0.55 #349598 --- .../openbsd_snmp3_check/default.nix | 41 +++++++++++++++++++ .../monitoring/nagios-plugins/plugins.nix | 1 + 2 files changed, 42 insertions(+) create mode 100644 pkgs/servers/monitoring/nagios-plugins/openbsd_snmp3_check/default.nix diff --git a/pkgs/servers/monitoring/nagios-plugins/openbsd_snmp3_check/default.nix b/pkgs/servers/monitoring/nagios-plugins/openbsd_snmp3_check/default.nix new file mode 100644 index 000000000000..62b435a890c9 --- /dev/null +++ b/pkgs/servers/monitoring/nagios-plugins/openbsd_snmp3_check/default.nix @@ -0,0 +1,41 @@ +{ + fetchFromGitHub, + lib, + nix-update-script, + openbsd_snmp3_check, + python3Packages, + testers, +}: +python3Packages.buildPythonApplication rec { + pname = "openbsd_snmp3_check"; + version = "0.55"; + pyproject = false; + + src = fetchFromGitHub { + owner = "alexander-naumov"; + repo = "openbsd_snmp3_check"; + rev = "v${version}"; + hash = "sha256-qDYANMvQU72f9wz8os7S1PfBH08AAqhtWLHVuSmkub4="; + }; + + postInstall = '' + install -Dm755 openbsd_snmp3.py $out/bin/openbsd_snmp3.py + ''; + + passthru = { + updateScript = nix-update-script { }; + tests.version = testers.testVersion { + package = openbsd_snmp3_check; + }; + }; + + meta = with lib; { + changelog = "https://github.com/alexander-naumov/openbsd_snmp3_check/releases/tag/v${version}"; + description = "SNMP v3 check for OpenBSD systems state monitoring"; + homepage = "https://github.com/alexander-naumov/openbsd_snmp3_check"; + license = with licenses; [ bsd3 ]; + platforms = platforms.unix; + maintainers = with maintainers; [ jwillikers ]; + mainProgram = "openbsd_snmp3.py"; + }; +} diff --git a/pkgs/servers/monitoring/nagios-plugins/plugins.nix b/pkgs/servers/monitoring/nagios-plugins/plugins.nix index c61457de9bd0..d49c914d2a41 100644 --- a/pkgs/servers/monitoring/nagios-plugins/plugins.nix +++ b/pkgs/servers/monitoring/nagios-plugins/plugins.nix @@ -13,4 +13,5 @@ inherit (callPackage ./labs_consol_de { }) check_mssql_health check_nwc_health check_ups_health; manubulon-snmp-plugins = callPackage ./manubulon-snmp-plugins { }; + openbsd_snmp3_check = callPackage ./openbsd_snmp3_check { }; } From 19b39206a70897259119c8dd17ddaaa8f8d30ca1 Mon Sep 17 00:00:00 2001 From: Anthony ROUSSEL Date: Sat, 26 Oct 2024 19:59:39 +0200 Subject: [PATCH 48/57] awscli2: 2.17.64 -> 2.18.15 https://github.com/aws/aws-cli/compare/2.17.64...2.18.15 --- pkgs/by-name/aw/awscli2/package.nix | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/pkgs/by-name/aw/awscli2/package.nix b/pkgs/by-name/aw/awscli2/package.nix index 0a9958e92d2f..a42799386ce5 100644 --- a/pkgs/by-name/aw/awscli2/package.nix +++ b/pkgs/by-name/aw/awscli2/package.nix @@ -62,22 +62,20 @@ let in py.pkgs.buildPythonApplication rec { pname = "awscli2"; - version = "2.17.64"; # N.B: if you change this, check if overrides are still up-to-date + version = "2.18.15"; # N.B: if you change this, check if overrides are still up-to-date pyproject = true; src = fetchFromGitHub { owner = "aws"; repo = "aws-cli"; rev = "refs/tags/${version}"; - hash = "sha256-Hq86KhAIATSz3dF1zO6aSdZQAfLs4EcRqWglAOJUVGk="; + hash = "sha256-dm4Z3WsFq5GQN6gvi5OS9J96PqhGx8Qz2OsHwUBrsAs="; }; - patches = [ ]; - postPatch = '' substituteInPlace pyproject.toml \ - --replace-fail 'awscrt>=0.19.18,<=0.21.2' 'awscrt>=0.19.18' \ - --replace-fail 'cryptography>=40.0.0,<40.0.2' 'cryptography>=43.0.0' \ + --replace-fail 'awscrt>=0.19.18,<=0.22.0' 'awscrt>=0.22.0' \ + --replace-fail 'cryptography>=40.0.0,<43.0.2' 'cryptography>=43.0.0' \ --replace-fail 'distro>=1.5.0,<1.9.0' 'distro>=1.5.0' \ --replace-fail 'docutils>=0.10,<0.20' 'docutils>=0.10' \ --replace-fail 'prompt-toolkit>=3.0.24,<3.0.39' 'prompt-toolkit>=3.0.24' From a6fe6f6d0cbf731f4e338101da945394a5e0766b Mon Sep 17 00:00:00 2001 From: Anthony ROUSSEL Date: Wed, 23 Oct 2024 22:13:08 +0200 Subject: [PATCH 49/57] facter: 4.8.0 -> 4.10.0 https://github.com/puppetlabs/facter/compare/4.8.0...4.10.0 --- pkgs/by-name/fa/facter/Gemfile.lock | 2 +- pkgs/by-name/fa/facter/gemset.nix | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/fa/facter/Gemfile.lock b/pkgs/by-name/fa/facter/Gemfile.lock index 2e80bd9192b4..1af6d837a747 100644 --- a/pkgs/by-name/fa/facter/Gemfile.lock +++ b/pkgs/by-name/fa/facter/Gemfile.lock @@ -1,7 +1,7 @@ GEM remote: https://rubygems.org/ specs: - facter (4.8.0) + facter (4.10.0) hocon (~> 1.3) thor (>= 1.0.1, < 1.3) hocon (1.4.0) diff --git a/pkgs/by-name/fa/facter/gemset.nix b/pkgs/by-name/fa/facter/gemset.nix index 2f70d6047e01..92a024a62211 100644 --- a/pkgs/by-name/fa/facter/gemset.nix +++ b/pkgs/by-name/fa/facter/gemset.nix @@ -5,10 +5,10 @@ platforms = []; source = { remotes = ["https://rubygems.org"]; - sha256 = "1130mzk90pi0y9fnraqqak7gcfg61dhx92axwnhchbpw09akfl09"; + sha256 = "17d561xf4s5016fm9jkfkkafn6660g04fz1yp5xfvkb0j4xj32mp"; type = "gem"; }; - version = "4.8.0"; + version = "4.10.0"; }; hocon = { groups = ["default"]; From ada4f701363825e31c3a4c16c494ceac1908470f Mon Sep 17 00:00:00 2001 From: Anthony ROUSSEL Date: Wed, 23 Oct 2024 22:14:27 +0200 Subject: [PATCH 50/57] pdk: 3.2.0 -> 3.3.0 https://github.com/puppetlabs/pdk/compare/v3.2.0...v3.3.0 --- pkgs/by-name/pd/pdk/Gemfile | 2 +- pkgs/by-name/pd/pdk/Gemfile.lock | 28 ++++++++++------- pkgs/by-name/pd/pdk/gemset.nix | 52 +++++++++++++++++++++++--------- 3 files changed, 55 insertions(+), 27 deletions(-) diff --git a/pkgs/by-name/pd/pdk/Gemfile b/pkgs/by-name/pd/pdk/Gemfile index 1e165ac0c6c1..7a7c9e0ec7f4 100644 --- a/pkgs/by-name/pd/pdk/Gemfile +++ b/pkgs/by-name/pd/pdk/Gemfile @@ -1,2 +1,2 @@ source 'https://rubygems.org' -gem 'pdk', '3.2.0' +gem 'pdk', '3.3.0' diff --git a/pkgs/by-name/pd/pdk/Gemfile.lock b/pkgs/by-name/pd/pdk/Gemfile.lock index cd5c071a641b..c34293761fb2 100644 --- a/pkgs/by-name/pd/pdk/Gemfile.lock +++ b/pkgs/by-name/pd/pdk/Gemfile.lock @@ -1,24 +1,26 @@ GEM remote: https://rubygems.org/ specs: - addressable (2.8.6) - public_suffix (>= 2.0.2, < 6.0) - childprocess (4.1.0) - cri (2.15.11) + addressable (2.8.7) + public_suffix (>= 2.0.2, < 7.0) + childprocess (5.1.0) + logger (~> 1.5) + cri (2.15.12) deep_merge (1.2.2) diff-lcs (1.5.1) ffi (1.17.0) hitimes (2.0.0) - json-schema (4.3.0) + json-schema (4.3.1) addressable (>= 2.8) json_pure (2.6.3) - minitar (0.9) + logger (1.6.1) + minitar (0.12.1) pastel (0.8.0) tty-color (~> 0.5) pathspec (1.1.3) - pdk (3.2.0) + pdk (3.3.0) bundler (>= 2.1.0, < 3.0.0) - childprocess (~> 4.1.0) + childprocess (~> 5.0) cri (~> 2.15.11) deep_merge (~> 1.2.2) diff-lcs (>= 1.5.0) @@ -28,10 +30,14 @@ GEM json_pure (~> 2.6.3) minitar (~> 0.8) pathspec (~> 1.1) + puppet-modulebuilder (~> 1.0) tty-prompt (~> 0.23) tty-spinner (~> 0.9) tty-which (~> 0.5) - public_suffix (5.0.5) + public_suffix (6.0.1) + puppet-modulebuilder (1.1.0) + minitar (~> 0.9) + pathspec (>= 0.2.1, < 3.0.0) tty-color (0.6.0) tty-cursor (0.7.1) tty-prompt (0.23.1) @@ -51,7 +57,7 @@ PLATFORMS ruby DEPENDENCIES - pdk (= 3.2.0) + pdk (= 3.3.0) BUNDLED WITH - 2.5.9 + 2.5.16 diff --git a/pkgs/by-name/pd/pdk/gemset.nix b/pkgs/by-name/pd/pdk/gemset.nix index 28f276022d0e..77f06054e403 100644 --- a/pkgs/by-name/pd/pdk/gemset.nix +++ b/pkgs/by-name/pd/pdk/gemset.nix @@ -5,30 +5,31 @@ platforms = []; source = { remotes = ["https://rubygems.org"]; - sha256 = "0irbdwkkjwzajq1ip6ba46q49sxnrl2cw7ddkdhsfhb6aprnm3vr"; + sha256 = "0cl2qpvwiffym62z991ynks7imsm87qmgxf0yfsmlwzkgi9qcaa6"; type = "gem"; }; - version = "2.8.6"; + version = "2.8.7"; }; childprocess = { + dependencies = ["logger"]; groups = ["default"]; platforms = []; source = { remotes = ["https://rubygems.org"]; - sha256 = "1lvcp8bsd35g57f7wz4jigcw2sryzzwrpcgjwwf3chmjrjcww5in"; + sha256 = "1v5nalaarxnfdm6rxb7q6fmc6nx097jd630ax6h9ch7xw95li3cs"; type = "gem"; }; - version = "4.1.0"; + version = "5.1.0"; }; cri = { groups = ["default"]; platforms = []; source = { remotes = ["https://rubygems.org"]; - sha256 = "1bhsgnjav94mz5vf3305gxz1g34gm9kxvnrn1dkz530r8bpj0hr5"; + sha256 = "1rank6i9p2drwdcmhan6ifkzrz1v3mwpx47fwjl75rskxwjfkgwa"; type = "gem"; }; - version = "2.15.11"; + version = "2.15.12"; }; deep_merge = { groups = ["default"]; @@ -76,10 +77,10 @@ platforms = []; source = { remotes = ["https://rubygems.org"]; - sha256 = "1ljqbpjc5aa8a2cgq8f64iwbx7rr9dqvpk7v8n5jpslyz6mvyddc"; + sha256 = "09bq393nrxa7hmphc3li8idgxdnb5hwgj15d0q5qsh4l5g1qvrnm"; type = "gem"; }; - version = "4.3.0"; + version = "4.3.1"; }; json_pure = { groups = ["default"]; @@ -91,15 +92,25 @@ }; version = "2.6.3"; }; + logger = { + groups = ["default"]; + platforms = []; + source = { + remotes = ["https://rubygems.org"]; + sha256 = "0lwncq2rf8gm79g2rcnnyzs26ma1f4wnfjm6gs4zf2wlsdz5in9s"; + type = "gem"; + }; + version = "1.6.1"; + }; minitar = { groups = ["default"]; platforms = []; source = { remotes = ["https://rubygems.org"]; - sha256 = "126mq86x67d1p63acrfka4zx0cx2r0vc93884jggxnrmmnzbxh13"; + sha256 = "0f307mpj4j0gp7iq77xj4p149f4krcvbll9rismng3jcijpbn79s"; type = "gem"; }; - version = "0.9"; + version = "0.12.1"; }; pastel = { dependencies = ["tty-color"]; @@ -123,25 +134,36 @@ version = "1.1.3"; }; pdk = { - dependencies = ["childprocess" "cri" "deep_merge" "diff-lcs" "ffi" "hitimes" "json-schema" "json_pure" "minitar" "pathspec" "tty-prompt" "tty-spinner" "tty-which"]; + dependencies = ["childprocess" "cri" "deep_merge" "diff-lcs" "ffi" "hitimes" "json-schema" "json_pure" "minitar" "pathspec" "puppet-modulebuilder" "tty-prompt" "tty-spinner" "tty-which"]; groups = ["default"]; platforms = []; source = { remotes = ["https://rubygems.org"]; - sha256 = "1avc2dgcdi9l6xam9crka790jhpx04536387f1vq2p9yqpr5lw7h"; + sha256 = "1gildcnii3ayw585as8d8bqhnfb9diqg7n3vmgaz8c5b9wb8c106"; type = "gem"; }; - version = "3.2.0"; + version = "3.3.0"; }; public_suffix = { groups = ["default"]; platforms = []; source = { remotes = ["https://rubygems.org"]; - sha256 = "14y4vzjwf5gp0mqgs880kis0k7n2biq8i6ci6q2n315kichl1hvj"; + sha256 = "0vqcw3iwby3yc6avs1vb3gfd0vcp2v7q310665dvxfswmcf4xm31"; type = "gem"; }; - version = "5.0.5"; + version = "6.0.1"; + }; + puppet-modulebuilder = { + dependencies = ["minitar" "pathspec"]; + groups = ["default"]; + platforms = []; + source = { + remotes = ["https://rubygems.org"]; + sha256 = "0rh31hq24nkddd83cx7n9ln5bsib3a052hrmn120sq0937337173"; + type = "gem"; + }; + version = "1.1.0"; }; tty-color = { groups = ["default"]; From dbd67057425c6f4518b03129d270999d01ce9ebe Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Th=C3=A9o=20Bori?= Date: Sun, 6 Oct 2024 19:09:36 +0200 Subject: [PATCH 51/57] ctune: init at 1.3.2 --- .../ct/ctune/cmake_disable_git_clone.patch | 59 +++++++++++++++++ pkgs/by-name/ct/ctune/package.nix | 66 +++++++++++++++++++ 2 files changed, 125 insertions(+) create mode 100644 pkgs/by-name/ct/ctune/cmake_disable_git_clone.patch create mode 100644 pkgs/by-name/ct/ctune/package.nix diff --git a/pkgs/by-name/ct/ctune/cmake_disable_git_clone.patch b/pkgs/by-name/ct/ctune/cmake_disable_git_clone.patch new file mode 100644 index 000000000000..2aafd621c278 --- /dev/null +++ b/pkgs/by-name/ct/ctune/cmake_disable_git_clone.patch @@ -0,0 +1,59 @@ +diff --git a/CMakeLists.txt b/CMakeLists.txt +index 1a30d61..bea8d7c 100644 +--- a/CMakeLists.txt ++++ b/CMakeLists.txt +@@ -50,13 +50,6 @@ include(FetchContent) + + set(CMAKE_VERBOSE_MAKEFILE ON) + +-#========================================== PRE-CHECKS ============================================# +-include(FindGit) +-find_package(Git) +- +-if (NOT Git_FOUND) +- message(FATAL_ERROR "Required package 'Git' not found on system.") +-endif () + + #======================================== LIB IMPORTS =============================================# + # ======= # +@@ -68,28 +61,9 @@ include_directories(${OPENSSL_INCLUDE_DIR}) + # ============== # + # JSON-C library # + # ============== # +-set(JSONC_DOWNLOAD_PATH "${TEMP_DIR_PATH}/libjsonc") +-set(JSONC_INSTALL_PATH "${CMAKE_EXTERNAL_OUTPUT_DIRECTORY}") +- +-add_custom_target(make-jsonc-install-dir ALL +- COMMAND ${CMAKE_COMMAND} -E make_directory ${JSONC_INSTALL_PATH} +-) +- +-ExternalProject_Add(libjsonc +- PREFIX "${JSONC_DOWNLOAD_PATH}" +- SOURCE_DIR "${JSONC_DOWNLOAD_PATH}/src/libjsonc-build" +- GIT_REPOSITORY "https://github.com/json-c/json-c.git" +- CMAKE_ARGS "-DBUILD_STATIC_LIBS=ON" +- "-DBUILD_SHARED_LIBS=OFF" +- "-DCMAKE_INSTALL_PREFIX:PATH=${JSONC_INSTALL_PATH}" +- "-DHAVE_ARC4RANDOM=OFF" +- "-DCMAKE_BUILD_TYPE=release" +-) +- +-set(JSONC_LIBRARIES +- ${CMAKE_EXTERNAL_OUTPUT_DIRECTORY}/lib/libjson-c.a +- bsd +-) ++find_package(PkgConfig REQUIRED) ++pkg_check_modules(JSONC REQUIRED json-c) ++include_directories(${JSONC_INCLUDE_DIRS}) + + # ============ # + # Curl library # +@@ -408,7 +382,7 @@ add_subdirectory(docs) + #endforeach() + + add_executable(ctune ${SOURCE_FILES}) +-add_dependencies(ctune ctune_logger libjsonc) ++add_dependencies(ctune ctune_logger) + include_directories(${CMAKE_EXTERNAL_OUTPUT_DIRECTORY}/include) + + add_dependencies(ctune ${CTUNE_PLUGIN_LIST_AUDIO_PLAYER}) diff --git a/pkgs/by-name/ct/ctune/package.nix b/pkgs/by-name/ct/ctune/package.nix new file mode 100644 index 000000000000..c9e38fba90ab --- /dev/null +++ b/pkgs/by-name/ct/ctune/package.nix @@ -0,0 +1,66 @@ +{ + stdenv, + lib, + fetchFromGitHub, + openssl, + curl, + ffmpeg, + vlc, + SDL2, + lame, + json_c, + cmake, + pkg-config, + ncurses, + libuuid, + pandoc, +}: +stdenv.mkDerivation (finalAttrs: { + pname = "ctune"; + version = "1.3.2"; + + src = fetchFromGitHub { + owner = "An7ar35"; + repo = "ctune"; + rev = "refs/tags/v${finalAttrs.version}"; + hash = "sha256-fy7Wb4R6HDa+cLxI5YWq67gxw1XS/iDDN4M3Rn7GYeI="; + }; + + nativeBuildInputs = [ + cmake + pkg-config + pandoc + ]; + + buildInputs = [ + openssl + curl + ffmpeg + vlc + SDL2 + lame + json_c + ncurses + libuuid + ]; + + strictDeps = true; + + cmakeFlags = [ + # Avoid a wrong nested install path location + # Set to "$out" instead of "$out/$out" + "-DCMAKE_INSTALL_PREFIX=''" + ]; + + patches = [ ./cmake_disable_git_clone.patch ]; + + meta = { + description = "A nice terminal nCurses (tui) internet radio player for Linux, browse and search from api.radio-browser.info"; + homepage = " https://github.com/An7ar35/ctune"; + changelog = "https://github.com/An7ar35/ctune/blob/master/CHANGELOG.md"; + license = lib.licenses.agpl3Plus; + maintainers = with lib.maintainers; [ theobori ]; + mainProgram = "ctune"; + platforms = lib.platforms.linux; + }; +}) From c2d71c11d04502f4be8eaaf14c57ad2ceead0d7b Mon Sep 17 00:00:00 2001 From: Tomo Date: Wed, 30 Oct 2024 17:12:50 +0000 Subject: [PATCH 52/57] jd-gui: drop Upstream has no commits since 2019: https://github.com/java-decompiler/jd-gui jd-gui uses Gradle 6, which has been EOL since 10 Feb 2023: https://endoflife.date/gradle (The JDK team is working on dropping Gradle 6). Attempting to build with a newer Gradle fails with a nontrivial error. Potential replacements: cfr, bytecode-viewer, procyon --- .../manual/release-notes/rl-2411.section.md | 3 + pkgs/tools/security/jd-gui/default.nix | 96 -------- pkgs/tools/security/jd-gui/deps.json | 210 ------------------ pkgs/top-level/aliases.nix | 1 + pkgs/top-level/all-packages.nix | 2 - 5 files changed, 4 insertions(+), 308 deletions(-) delete mode 100644 pkgs/tools/security/jd-gui/default.nix delete mode 100644 pkgs/tools/security/jd-gui/deps.json diff --git a/nixos/doc/manual/release-notes/rl-2411.section.md b/nixos/doc/manual/release-notes/rl-2411.section.md index 8123f2ca52e9..490aa3d5f569 100644 --- a/nixos/doc/manual/release-notes/rl-2411.section.md +++ b/nixos/doc/manual/release-notes/rl-2411.section.md @@ -566,6 +566,9 @@ - The `services.patroni.raft` option has been removed, as Raft has been [deprecated by upstream since 3.0.0](https://github.com/patroni/patroni/blob/master/docs/releases.rst#version-300) +- The `jd-gui` package was removed due to an inactive upstream and a dependency on the end-of-life Gradle 6. + Java decompilers already packaged in Nixpkgs include `bytecode-viewer` (GUI), `cfr` (CLI), and `procyon` (CLI). + - `services.roundcube.maxAttachmentSize` will multiply the value set with `1.37` to offset overhead introduced by the base64 encoding applied to attachments. - The `services.mxisd` module has been removed as both [mxisd](https://github.com/kamax-matrix/mxisd) and [ma1sd](https://github.com/ma1uta/ma1sd) are not maintained any longer. diff --git a/pkgs/tools/security/jd-gui/default.nix b/pkgs/tools/security/jd-gui/default.nix deleted file mode 100644 index a9ef78f3f5e4..000000000000 --- a/pkgs/tools/security/jd-gui/default.nix +++ /dev/null @@ -1,96 +0,0 @@ -{ lib -, stdenv -, fetchFromGitHub -, fetchpatch -, jre -, jdk -, gradle_6 -, makeDesktopItem -, copyDesktopItems -, runtimeShell -}: - -let - pname = "jd-gui"; - version = "1.6.6"; - - name = "${pname}-${version}"; - - src = fetchFromGitHub { - owner = "java-decompiler"; - repo = pname; - rev = "v${version}"; - hash = "sha256-QHiZPYFwDQzbXVSuhwzQqBRXlkG9QVU+Jl6SKvBoCwQ="; - }; - - gradle = gradle_6; - - desktopItem = makeDesktopItem { - name = "jd-gui"; - exec = "jd-gui %F"; - icon = "jd-gui"; - comment = "Java Decompiler JD-GUI"; - desktopName = "JD-GUI"; - genericName = "Java Decompiler"; - mimeTypes = [ "application/java" "application/java-vm" "application/java-archive" ]; - categories = [ "Development" "Debugger" ]; - startupWMClass = "org-jd-gui-App"; - }; - -in stdenv.mkDerivation rec { - inherit pname version src; - - patches = [ - # https://github.com/java-decompiler/jd-gui/pull/362 - (fetchpatch { - name = "nebula-plugin-gradle-6-compatibility.patch"; - url = "https://github.com/java-decompiler/jd-gui/commit/91f805f9dc8ce0097460e63c8095ccea870687e6.patch"; - hash = "sha256-9eaM9Mx2FaKIhGSOHjATKN/CrtvJeXyrH8Mdx8LNtpE="; - }) - ]; - - nativeBuildInputs = [ jdk gradle copyDesktopItems ]; - - mitmCache = gradle.fetchDeps { - inherit pname; - data = ./deps.json; - }; - - __darwinAllowLocalNetworking = true; - - gradleBuildTask = "jar"; - - installPhase = let - jar = "$out/share/jd-gui/${name}.jar"; - in '' - runHook preInstall - - mkdir -p $out/bin $out/share/{jd-gui,icons/hicolor/128x128/apps} - cp build/libs/${name}.jar ${jar} - cp src/linux/resources/jd_icon_128.png $out/share/icons/hicolor/128x128/apps/jd-gui.png - - cat > $out/bin/jd-gui < Date: Wed, 30 Oct 2024 19:14:14 +0000 Subject: [PATCH 53/57] jd-cli: drop JCenter Bintray is dead. This package depends on jd-core, which was only hosted through JCenter Bintray. --- .../manual/release-notes/rl-2411.section.md | 4 +++ pkgs/tools/security/jd-cli/default.nix | 34 ------------------- pkgs/top-level/aliases.nix | 3 +- pkgs/top-level/all-packages.nix | 2 -- 4 files changed, 6 insertions(+), 37 deletions(-) delete mode 100644 pkgs/tools/security/jd-cli/default.nix diff --git a/nixos/doc/manual/release-notes/rl-2411.section.md b/nixos/doc/manual/release-notes/rl-2411.section.md index 490aa3d5f569..fc17ae8523eb 100644 --- a/nixos/doc/manual/release-notes/rl-2411.section.md +++ b/nixos/doc/manual/release-notes/rl-2411.section.md @@ -566,6 +566,10 @@ - The `services.patroni.raft` option has been removed, as Raft has been [deprecated by upstream since 3.0.0](https://github.com/patroni/patroni/blob/master/docs/releases.rst#version-300) +- The `jd-cli` package was removed due to an inactive upstream and a dependency on the shut down + JCenter JAR repository. + Java decompilers already packaged in Nixpkgs include `bytecode-viewer` (GUI), `cfr` (CLI), and `procyon` (CLI). + - The `jd-gui` package was removed due to an inactive upstream and a dependency on the end-of-life Gradle 6. Java decompilers already packaged in Nixpkgs include `bytecode-viewer` (GUI), `cfr` (CLI), and `procyon` (CLI). diff --git a/pkgs/tools/security/jd-cli/default.nix b/pkgs/tools/security/jd-cli/default.nix deleted file mode 100644 index d99c1e687ac3..000000000000 --- a/pkgs/tools/security/jd-cli/default.nix +++ /dev/null @@ -1,34 +0,0 @@ -{ lib, fetchFromGitHub, jre, makeWrapper, maven }: - -maven.buildMavenPackage rec { - pname = "jd-cli"; - version = "1.2.1"; - - src = fetchFromGitHub { - owner = "intoolswetrust"; - repo = pname; - rev = "${pname}-${version}"; - hash = "sha256-rRttA5H0A0c44loBzbKH7Waoted3IsOgxGCD2VM0U/Q="; - }; - - mvnHash = "sha256-lEcAq0H8Uacv02ItjVGfxvtRip5206HtpREBrQDzBDo="; - - mvnParameters = "-DskipTests"; - - nativeBuildInputs = [ makeWrapper ]; - - installPhase = '' - mkdir -p $out/bin $out/share/jd-cli - install -Dm644 jd-cli/target/jd-cli.jar $out/share/jd-cli - - makeWrapper ${jre}/bin/java $out/bin/jd-cli \ - --add-flags "-jar $out/share/jd-cli/jd-cli.jar" - ''; - - meta = with lib; { - description = "Simple command line wrapper around JD Core Java Decompiler project"; - homepage = "https://github.com/intoolswetrust/jd-cli"; - license = licenses.gpl3; - maintainers = with maintainers; [ majiir ]; - }; -} diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix index a1b1e68f38e6..43a6c818c44e 100644 --- a/pkgs/top-level/aliases.nix +++ b/pkgs/top-level/aliases.nix @@ -533,7 +533,8 @@ mapAliases { jami-client-qt = jami-client; # Added 2022-11-06 jami-client = jami; # Added 2023-02-10 jami-daemon = jami.daemon; # Added 2023-02-10 - jd-gui = throw "jd-gui has been removed due to upstream being unmaintained since 2019. Other Java decompilers in Nixpkgs include bytecode-viewer (GUI), cfr (CLI), and procyon (CLI)."; # Added 2024-10-30 + jd-cli = throw "jd-cli has been removed due to upstream being unmaintained since 2019. Other Java decompilers in Nixpkgs include bytecode-viewer (GUI), cfr (CLI), and procyon (CLI)."; # Added 2024-10-30 + jd-gui = throw "jd-gui has been removed due to a dependency on the dead JCenter Bintray. Other Java decompilers in Nixpkgs include bytecode-viewer (GUI), cfr (CLI), and procyon (CLI)."; # Added 2024-10-30 jsawk = throw "'jsawk' has been removed because it is unmaintained upstream"; # Added 2028-08-07 # Julia diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index 760bbc942a98..f10f72f9256f 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -8743,8 +8743,6 @@ with pkgs; jc = with python3Packages; toPythonApplication jc; - jd-cli = callPackage ../tools/security/jd-cli { }; - jd-diff-patch = callPackage ../development/tools/jd-diff-patch { }; jdiskreport = callPackage ../tools/misc/jdiskreport { }; From b0dc30316d5266a7b7ae573b52f639e461f9489e Mon Sep 17 00:00:00 2001 From: Reno Dakota <170618376+paparodeo@users.noreply.github.com> Date: Wed, 30 Oct 2024 20:52:02 +0000 Subject: [PATCH 54/57] xorg.libAppleWM: 1.4.1 -> 1.4.1-unstable-2021-01-04 fixes build on darwin https://gitlab.freedesktop.org/xorg/lib/libapplewm/-/compare/libAppleWM-1.4.1...d8926ba5805ac8feed0b0cf8ebf54d8ab7af2314 --- pkgs/servers/x11/xorg/default.nix | 6 +++--- pkgs/servers/x11/xorg/overrides.nix | 6 ++---- pkgs/servers/x11/xorg/tarballs.list | 2 +- 3 files changed, 6 insertions(+), 8 deletions(-) diff --git a/pkgs/servers/x11/xorg/default.nix b/pkgs/servers/x11/xorg/default.nix index e25f09c5f077..10a09ce036b5 100644 --- a/pkgs/servers/x11/xorg/default.nix +++ b/pkgs/servers/x11/xorg/default.nix @@ -1018,11 +1018,11 @@ self: with self; { # THIS IS A GENERATED FILE. DO NOT EDIT! libAppleWM = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, libX11, libXext, testers }: stdenv.mkDerivation (finalAttrs: { pname = "libAppleWM"; - version = "1.4.1"; + version = "be972ebc3a97292e7d2b2350eff55ae12df99a42"; builder = ./builder.sh; src = fetchurl { - url = "mirror://xorg/individual/lib/libAppleWM-1.4.1.tar.bz2"; - sha256 = "0r8x28n45q89x91mz8mv0zkkcxi8wazkac886fyvflhiv2y8ap2y"; + url = "https://gitlab.freedesktop.org/xorg/lib/libAppleWM/-/archive/be972ebc3a97292e7d2b2350eff55ae12df99a42/libAppleWM-be972ebc3a97292e7d2b2350eff55ae12df99a42.tar.bz2"; + sha256 = "1hrq03pahmrbb05r6a7j7m1nxl65wlfi6d2lwm1kvra63q91f9ph"; }; hardeningDisable = [ "bindnow" "relro" ]; strictDeps = true; diff --git a/pkgs/servers/x11/xorg/overrides.nix b/pkgs/servers/x11/xorg/overrides.nix index 128bd2d76ba3..7ed53ee22212 100644 --- a/pkgs/servers/x11/xorg/overrides.nix +++ b/pkgs/servers/x11/xorg/overrides.nix @@ -169,10 +169,8 @@ self: super: }); libAppleWM = super.libAppleWM.overrideAttrs (attrs: { - buildInputs = attrs.buildInputs ++ [ ApplicationServices ]; - preConfigure = '' - substituteInPlace src/Makefile.in --replace -F/System -F${ApplicationServices} - ''; + nativeBuildInputs = attrs.nativeBuildInputs ++ [ autoreconfHook ]; + buildInputs = attrs.buildInputs ++ [ xorg.utilmacros ]; }); libXau = super.libXau.overrideAttrs (attrs: { diff --git a/pkgs/servers/x11/xorg/tarballs.list b/pkgs/servers/x11/xorg/tarballs.list index 3e77aa833ec9..d06a7cfe2b63 100644 --- a/pkgs/servers/x11/xorg/tarballs.list +++ b/pkgs/servers/x11/xorg/tarballs.list @@ -165,7 +165,7 @@ mirror://xorg/individual/font/font-sun-misc-1.0.4.tar.xz mirror://xorg/individual/font/font-util-1.4.1.tar.xz mirror://xorg/individual/font/font-winitzki-cyrillic-1.0.4.tar.xz mirror://xorg/individual/font/font-xfree86-type1-1.0.5.tar.xz -mirror://xorg/individual/lib/libAppleWM-1.4.1.tar.bz2 +https://gitlab.freedesktop.org/xorg/lib/libAppleWM/-/archive/be972ebc3a97292e7d2b2350eff55ae12df99a42/libAppleWM-be972ebc3a97292e7d2b2350eff55ae12df99a42.tar.bz2 mirror://xorg/individual/lib/libdmx-1.1.5.tar.xz mirror://xorg/individual/lib/libfontenc-1.1.8.tar.xz mirror://xorg/individual/lib/libFS-1.0.10.tar.xz From 7402e574c9403a9e8a85716670b0fef47e67d8a8 Mon Sep 17 00:00:00 2001 From: Emily Date: Wed, 30 Oct 2024 23:11:24 +0000 Subject: [PATCH 55/57] auto-patchelf: avoid filesets The use of filesets triggers the same Nix evaluation bug as in e4b8a0a243d917d78935e6c479a5005e7c52063f, which broke the installer tests again. --- pkgs/by-name/au/auto-patchelf/package.nix | 7 +------ pkgs/by-name/au/auto-patchelf/{ => src}/auto-patchelf.py | 0 2 files changed, 1 insertion(+), 6 deletions(-) rename pkgs/by-name/au/auto-patchelf/{ => src}/auto-patchelf.py (100%) diff --git a/pkgs/by-name/au/auto-patchelf/package.nix b/pkgs/by-name/au/auto-patchelf/package.nix index 1e1880560adf..ade96b2a9fbf 100644 --- a/pkgs/by-name/au/auto-patchelf/package.nix +++ b/pkgs/by-name/au/auto-patchelf/package.nix @@ -8,12 +8,7 @@ python3Packages.buildPythonApplication { version = "0-unstable-2024-08-14"; pyproject = false; - src = lib.fileset.toSource { - root = ./.; - fileset = lib.fileset.unions [ - ./auto-patchelf.py - ]; - }; + src = ./src; dependencies = with python3Packages; [ pyelftools diff --git a/pkgs/by-name/au/auto-patchelf/auto-patchelf.py b/pkgs/by-name/au/auto-patchelf/src/auto-patchelf.py similarity index 100% rename from pkgs/by-name/au/auto-patchelf/auto-patchelf.py rename to pkgs/by-name/au/auto-patchelf/src/auto-patchelf.py From ea61f604da7f72d7c5261af16f0e592b53bacef9 Mon Sep 17 00:00:00 2001 From: AwesomeQubic <77882752+AwesomeQubic@users.noreply.github.com> Date: Thu, 31 Oct 2024 00:30:40 +0100 Subject: [PATCH 56/57] lua: set mainProgram (#352347) --- pkgs/development/interpreters/lua-5/interpreter.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/pkgs/development/interpreters/lua-5/interpreter.nix b/pkgs/development/interpreters/lua-5/interpreter.nix index 0f7b65df95ef..082fa879e2f7 100644 --- a/pkgs/development/interpreters/lua-5/interpreter.nix +++ b/pkgs/development/interpreters/lua-5/interpreter.nix @@ -169,6 +169,7 @@ stdenv.mkDerivation (finalAttrs: management with incremental garbage collection, making it ideal for configuration, scripting, and rapid prototyping. ''; + mainProgram = "lua"; license = lib.licenses.mit; platforms = lib.platforms.unix; }; From e45e0e2b9520e13cfeb109d1a618d7bb1583bf51 Mon Sep 17 00:00:00 2001 From: Tomo Date: Wed, 30 Oct 2024 23:02:41 +0000 Subject: [PATCH 57/57] gradle_6: drop Unmaintained since 10 Feb 2023: https://endoflife.date/gradle Numerous security vulnerabilities: #352236 --- nixos/doc/manual/release-notes/rl-2411.section.md | 5 +++++ .../tools/build-managers/gradle/default.nix | 12 ------------ pkgs/top-level/aliases.nix | 2 ++ pkgs/top-level/all-packages.nix | 2 -- 4 files changed, 7 insertions(+), 14 deletions(-) diff --git a/nixos/doc/manual/release-notes/rl-2411.section.md b/nixos/doc/manual/release-notes/rl-2411.section.md index 9f390a666244..ae2fbab9446c 100644 --- a/nixos/doc/manual/release-notes/rl-2411.section.md +++ b/nixos/doc/manual/release-notes/rl-2411.section.md @@ -334,6 +334,11 @@ This change requires granting access to the repositories to this user or setting the appropriate one through `services.cgit.some-instance.user`. +- `gradle_6` was removed due to being [unsupported upstream as of 10 Feb 2023](https://endoflife.date/gradle). + Additionally, it had numerous security vulnerabilities that were only patched + in later versions, such as [CVE-2021-29429](https://nvd.nist.gov/vuln/detail/CVE-2021-32751), + [CVE-2021-29427](https://nvd.nist.gov/vuln/detail/CVE-2021-29427), [CVE-2021-29428](https://nvd.nist.gov/vuln/detail/CVE-2021-29428), and [CVE-2021-32751](https://nvd.nist.gov/vuln/detail/CVE-2021-32751). + - `nvimpager` was updated to version 0.13.0, which changes the order of user and nvimpager settings: user commands in `-c` and `--cmd` now override the respective default settings because they are executed later. diff --git a/pkgs/development/tools/build-managers/gradle/default.nix b/pkgs/development/tools/build-managers/gradle/default.nix index 970dcf2d638f..a2a1c1115a53 100644 --- a/pkgs/development/tools/build-managers/gradle/default.nix +++ b/pkgs/development/tools/build-managers/gradle/default.nix @@ -195,18 +195,6 @@ rec { defaultJava = jdk17; }; - gradle_6 = gen { - version = "6.9.4"; - hash = "sha256-PiQCKFON6fGHcqV06ZoLqVnoPW7zUQFDgazZYxeBOJo="; - defaultJava = jdk11; - meta.knownVulnerabilities = [ - "CVE-2021-29429: '[...]files created with open permissions in the system temporary directory can allow an attacker to access information downloaded by Gradle[...]'" - "CVE-2021-29427: '[...]there is a vulnerability which can lead to information disclosure and/or dependency poisoning[...] In some cases, Gradle may ignore content filters and search all repositories for dependencies. This only occurs when repository content filtering is used from within a `pluginManagement` block in a settings file.'" - "CVE-2021-29428: '[...]the system temporary directory can be created with open permissions that allow multiple users to create and delete files within it. Gradle builds could be vulnerable to a local privilege escalation from an attacker quickly deleting and recreating files in the system temporary directory.'" - "CVE-2021-32751: '[...]start scripts generated by the `application` plugin and the `gradlew` script are both vulnerable to arbitrary code execution when an attacker is able to change environment variables for the user running the script[...]'" - ]; - }; - wrapGradle = { lib, callPackage, mitm-cache, substituteAll, symlinkJoin, concatTextFile, makeSetupHook, nix-update-script }: diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix index c08ecc0f2f8e..8adba09d6cd8 100644 --- a/pkgs/top-level/aliases.nix +++ b/pkgs/top-level/aliases.nix @@ -466,6 +466,8 @@ mapAliases { gnuradio3_9Minimal = throw "gnuradio3_9Minimal has been removed because it is not compatible with the latest volk and it had no dependent packages which justified it's distribution"; # Added 2024-07-28 gnuradio3_9Packages = throw "gnuradio3_9Minimal has been removed because it is not compatible with the latest volk and it had no dependent packages which justified it's distribution"; # Added 2024-07-28 gobby5 = throw "'gobby5' has been renamed to/replaced by 'gobby'"; # Converted to throw 2024-10-17 + gradle_6 = throw "Gradle 6 has been removed, as it is end-of-life (https://endoflife.date/gradle) and has many vulnerabilities that are not resolved until Gradle 7."; # Added 2024-10-30 + gradle_6-unwrapped = throw "Gradle 6 has been removed, as it is end-of-life (https://endoflife.date/gradle) and has many vulnerabilities that are not resolved until Gradle 7."; # Added 2024-10-30 #godot diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index 6c0b5ec0d532..7e71e4f8fedb 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -17609,12 +17609,10 @@ with pkgs; gradleGen = gradle-packages.gen; wrapGradle = callPackage gradle-packages.wrapGradle { }; - gradle_6-unwrapped = callPackage gradle-packages.gradle_6 { }; gradle_7-unwrapped = callPackage gradle-packages.gradle_7 { }; gradle_8-unwrapped = callPackage gradle-packages.gradle_8 { }; gradle-unwrapped = gradle_8-unwrapped; - gradle_6 = wrapGradle gradle_6-unwrapped null; gradle_7 = wrapGradle gradle_7-unwrapped null; gradle_8 = wrapGradle gradle_8-unwrapped null; gradle = wrapGradle gradle-unwrapped "gradle-unwrapped";