From e23f8b775de1b1c91bff3b8bbf227def978aee35 Mon Sep 17 00:00:00 2001 From: 06kellyjac Date: Mon, 22 Sep 2025 13:03:58 +0100 Subject: [PATCH 1/3] shh: 2025.7.13 -> 2025.9.22 Diff: https://github.com/desbma/shh/compare/v2025.7.13...v2025.9.22 Changelog: https://github.com/desbma/shh/blob/v2025.9.22/CHANGELOG.md --- pkgs/by-name/sh/shh/fix_run_checks.patch | 24 +++++++++++++----------- pkgs/by-name/sh/shh/package.nix | 6 +++--- 2 files changed, 16 insertions(+), 14 deletions(-) diff --git a/pkgs/by-name/sh/shh/fix_run_checks.patch b/pkgs/by-name/sh/shh/fix_run_checks.patch index 3b29a4f1b5eb..c555badd5e90 100644 --- a/pkgs/by-name/sh/shh/fix_run_checks.patch +++ b/pkgs/by-name/sh/shh/fix_run_checks.patch @@ -1,14 +1,16 @@ -commit 58bdfa7ef92ba07dc41a07aeef6d790ecd8f888c -Author: kuflierl <41301536+kuflierl@users.noreply.github.com> -Date: Sat May 3 21:02:26 2025 +0200 +commit 3052c2c8be6a44aab2d4c5fa0d560a8109c5ed5e +Author: 06kellyjac +Date: Mon Sep 22 13:17:14 2025 +0100 fix(tests): add support for nix-build-system for tests + Co-authored-by: kuflierl <41301536+kuflierl@users.noreply.github.com> + diff --git a/src/systemd/resolver.rs b/src/systemd/resolver.rs -index e2abbb7..1151592 100644 +index 989f378..0629fb5 100644 --- a/src/systemd/resolver.rs +++ b/src/systemd/resolver.rs -@@ -637,17 +637,14 @@ mod tests { +@@ -650,17 +650,14 @@ mod tests { let OptionValue::List(opt_list) = &candidates[0].value else { panic!(); }; @@ -32,7 +34,7 @@ index e2abbb7..1151592 100644 let actions = vec![ProgramAction::Read("/var/data".into())]; let candidates = resolve(&opts, &actions, &hardening_opts); diff --git a/tests/options.rs b/tests/options.rs -index 835ee14..a9c9973 100644 +index cf20ea0..ab9f389 100644 --- a/tests/options.rs +++ b/tests/options.rs @@ -24,7 +24,7 @@ fn run_true() { @@ -50,7 +52,7 @@ index 835ee14..a9c9973 100644 .stdout(predicate::str::contains("ProtectClock=true\n").count(1)) - .stdout(predicate::str::contains("SystemCallFilter=~@aio:EPERM @chown:EPERM @clock:EPERM @cpu-emulation:EPERM @debug:EPERM @io-event:EPERM @ipc:EPERM @keyring:EPERM @memlock:EPERM @module:EPERM @mount:EPERM @network-io:EPERM @obsolete:EPERM @pkey:EPERM @privileged:EPERM @process:EPERM @raw-io:EPERM @reboot:EPERM @resources:EPERM @sandbox:EPERM @setuid:EPERM @signal:EPERM @swap:EPERM @sync:EPERM @timer:EPERM\n").count(1)) + .stdout(predicate::str::contains("SystemCallFilter=~@aio:EPERM @chown:EPERM @clock:EPERM @cpu-emulation:EPERM @debug:EPERM @io-event:EPERM @ipc:EPERM @keyring:EPERM @memlock:EPERM @module:EPERM @mount:EPERM @network-io:EPERM @obsolete:EPERM @pkey:EPERM @privileged:EPERM @raw-io:EPERM @reboot:EPERM @resources:EPERM @sandbox:EPERM @setuid:EPERM @signal:EPERM @swap:EPERM @sync:EPERM @timer:EPERM\n").count(1)) - .stdout(predicate::str::contains("CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_BPF CAP_CHOWN CAP_MKNOD CAP_NET_RAW CAP_PERFMON CAP_SYS_BOOT CAP_SYS_CHROOT CAP_SYS_MODULE CAP_SYS_NICE CAP_SYS_PACCT CAP_SYS_PTRACE CAP_SYS_TIME CAP_SYS_TTY_CONFIG CAP_SYSLOG CAP_WAKE_ALARM\n").count(1)); + .stdout(predicate::str::contains("CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_BPF CAP_CHOWN CAP_IPC_LOCK CAP_KILL CAP_MKNOD CAP_NET_RAW CAP_PERFMON CAP_SYS_BOOT CAP_SYS_CHROOT CAP_SYS_MODULE CAP_SYS_NICE CAP_SYS_PACCT CAP_SYS_PTRACE CAP_SYS_TIME CAP_SYS_TTY_CONFIG CAP_SYSLOG CAP_WAKE_ALARM\n").count(1)); } @@ -97,7 +97,7 @@ fn run_ls_dev() { @@ -92,7 +94,7 @@ index 835ee14..a9c9973 100644 .stdout(predicate::str::contains("ProtectClock=true\n").count(1)) - .stdout(predicate::str::contains("SystemCallFilter=~@aio:EPERM @chown:EPERM @clock:EPERM @cpu-emulation:EPERM @debug:EPERM @io-event:EPERM @ipc:EPERM @keyring:EPERM @memlock:EPERM @module:EPERM @mount:EPERM @network-io:EPERM @obsolete:EPERM @pkey:EPERM @privileged:EPERM @process:EPERM @raw-io:EPERM @reboot:EPERM @resources:EPERM @sandbox:EPERM @setuid:EPERM @signal:EPERM @swap:EPERM @sync:EPERM @timer:EPERM\n").count(1)) + .stdout(predicate::str::contains("SystemCallFilter=~@aio:EPERM @chown:EPERM @clock:EPERM @cpu-emulation:EPERM @debug:EPERM @io-event:EPERM @ipc:EPERM @keyring:EPERM @memlock:EPERM @module:EPERM @mount:EPERM @network-io:EPERM @obsolete:EPERM @pkey:EPERM @privileged:EPERM @raw-io:EPERM @reboot:EPERM @resources:EPERM @sandbox:EPERM @setuid:EPERM @signal:EPERM @swap:EPERM @sync:EPERM @timer:EPERM\n").count(1)) - .stdout(predicate::str::contains("CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_BPF CAP_CHOWN CAP_MKNOD CAP_NET_RAW CAP_PERFMON CAP_SYS_BOOT CAP_SYS_CHROOT CAP_SYS_MODULE CAP_SYS_NICE CAP_SYS_PACCT CAP_SYS_PTRACE CAP_SYS_TIME CAP_SYS_TTY_CONFIG CAP_SYSLOG CAP_WAKE_ALARM\n").count(1)); + .stdout(predicate::str::contains("CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_BPF CAP_CHOWN CAP_IPC_LOCK CAP_KILL CAP_MKNOD CAP_NET_RAW CAP_PERFMON CAP_SYS_BOOT CAP_SYS_CHROOT CAP_SYS_MODULE CAP_SYS_NICE CAP_SYS_PACCT CAP_SYS_PTRACE CAP_SYS_TIME CAP_SYS_TTY_CONFIG CAP_SYSLOG CAP_WAKE_ALARM\n").count(1)); } @@ -201,7 +201,7 @@ fn run_read_kallsyms() { @@ -110,11 +112,11 @@ index 835ee14..a9c9973 100644 .stdout(predicate::str::contains("ProtectClock=true\n").count(1)) - .stdout(predicate::str::contains("SystemCallFilter=~@aio:EPERM @chown:EPERM @clock:EPERM @cpu-emulation:EPERM @debug:EPERM @io-event:EPERM @ipc:EPERM @keyring:EPERM @memlock:EPERM @module:EPERM @mount:EPERM @network-io:EPERM @obsolete:EPERM @pkey:EPERM @privileged:EPERM @process:EPERM @raw-io:EPERM @reboot:EPERM @resources:EPERM @sandbox:EPERM @setuid:EPERM @signal:EPERM @swap:EPERM @sync:EPERM @timer:EPERM\n").count(1)) + .stdout(predicate::str::contains("SystemCallFilter=~@aio:EPERM @chown:EPERM @clock:EPERM @cpu-emulation:EPERM @debug:EPERM @io-event:EPERM @ipc:EPERM @keyring:EPERM @memlock:EPERM @module:EPERM @mount:EPERM @network-io:EPERM @obsolete:EPERM @pkey:EPERM @privileged:EPERM @raw-io:EPERM @reboot:EPERM @resources:EPERM @sandbox:EPERM @setuid:EPERM @signal:EPERM @swap:EPERM @sync:EPERM @timer:EPERM\n").count(1)) - .stdout(predicate::str::contains("CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_BPF CAP_CHOWN CAP_MKNOD CAP_NET_RAW CAP_PERFMON CAP_SYS_BOOT CAP_SYS_CHROOT CAP_SYS_MODULE CAP_SYS_NICE CAP_SYS_PACCT CAP_SYS_PTRACE CAP_SYS_TIME CAP_SYS_TTY_CONFIG CAP_SYSLOG CAP_WAKE_ALARM\n").count(1)); + .stdout(predicate::str::contains("CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_BPF CAP_CHOWN CAP_IPC_LOCK CAP_KILL CAP_MKNOD CAP_NET_RAW CAP_PERFMON CAP_SYS_BOOT CAP_SYS_CHROOT CAP_SYS_MODULE CAP_SYS_NICE CAP_SYS_PACCT CAP_SYS_PTRACE CAP_SYS_TIME CAP_SYS_TTY_CONFIG CAP_SYSLOG CAP_WAKE_ALARM\n").count(1)); } @@ -344,6 +344,7 @@ fn run_systemctl() { - .stdout(predicate::str::contains("CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_BPF CAP_CHOWN CAP_MKNOD CAP_NET_RAW CAP_PERFMON CAP_SYS_BOOT CAP_SYS_CHROOT CAP_SYS_MODULE CAP_SYS_NICE CAP_SYS_PACCT CAP_SYS_PTRACE CAP_SYS_TIME CAP_SYS_TTY_CONFIG CAP_SYSLOG CAP_WAKE_ALARM\n").count(1)); + .stdout(predicate::str::contains("CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_BPF CAP_CHOWN CAP_IPC_LOCK CAP_KILL CAP_MKNOD CAP_NET_RAW CAP_PERFMON CAP_SYS_BOOT CAP_SYS_CHROOT CAP_SYS_MODULE CAP_SYS_NICE CAP_SYS_PACCT CAP_SYS_PTRACE CAP_SYS_TIME CAP_SYS_TTY_CONFIG CAP_SYSLOG CAP_WAKE_ALARM\n").count(1)); } +// patched due to nix build isolation @@ -145,6 +147,6 @@ index 835ee14..a9c9973 100644 .stdout(predicate::str::contains("ProtectClock=true\n").count(1)) - .stdout(predicate::str::contains("SystemCallFilter=~@aio:EPERM @chown:EPERM @clock:EPERM @cpu-emulation:EPERM @debug:EPERM @io-event:EPERM @ipc:EPERM @keyring:EPERM @memlock:EPERM @module:EPERM @mount:EPERM @obsolete:EPERM @pkey:EPERM @privileged:EPERM @raw-io:EPERM @reboot:EPERM @resources:EPERM @sandbox:EPERM @setuid:EPERM @signal:EPERM @swap:EPERM @sync:EPERM @timer:EPERM\n").count(1)) + .stdout(predicate::str::contains("SystemCallFilter=~@aio:EPERM @chown:EPERM @clock:EPERM @cpu-emulation:EPERM @debug:EPERM @io-event:EPERM @ipc:EPERM @keyring:EPERM @memlock:EPERM @module:EPERM @mount:EPERM @obsolete:EPERM @pkey:EPERM @privileged:EPERM @process:EPERM @raw-io:EPERM @reboot:EPERM @resources:EPERM @sandbox:EPERM @setuid:EPERM @signal:EPERM @swap:EPERM @sync:EPERM @timer:EPERM\n").count(1)) - .stdout(predicate::str::contains("CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_BPF CAP_CHOWN CAP_MKNOD CAP_NET_RAW CAP_PERFMON CAP_SYS_BOOT CAP_SYS_CHROOT CAP_SYS_MODULE CAP_SYS_NICE CAP_SYS_PACCT CAP_SYS_PTRACE CAP_SYS_TIME CAP_SYS_TTY_CONFIG CAP_SYSLOG CAP_WAKE_ALARM\n").count(1)); + .stdout(predicate::str::contains("CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_BPF CAP_CHOWN CAP_IPC_LOCK CAP_KILL CAP_MKNOD CAP_NET_RAW CAP_PERFMON CAP_SYS_BOOT CAP_SYS_CHROOT CAP_SYS_MODULE CAP_SYS_NICE CAP_SYS_PACCT CAP_SYS_PTRACE CAP_SYS_TIME CAP_SYS_TTY_CONFIG CAP_SYSLOG CAP_WAKE_ALARM\n").count(1)); } diff --git a/pkgs/by-name/sh/shh/package.nix b/pkgs/by-name/sh/shh/package.nix index df19b76f8fe6..1cb931aad653 100644 --- a/pkgs/by-name/sh/shh/package.nix +++ b/pkgs/by-name/sh/shh/package.nix @@ -18,16 +18,16 @@ let in rustPlatform.buildRustPackage rec { pname = "shh"; - version = "2025.7.13"; + version = "2025.9.22"; src = fetchFromGitHub { owner = "desbma"; repo = "shh"; tag = "v${version}"; - hash = "sha256-mTBA+NPkeGF1sSnXpOz9xBsKDAihRe+TVcBAlvbBQPc="; + hash = "sha256-Esb6IR49YtGWvLmGLtviAyMLjoWZLQka2igC6yKJ3A0="; }; - cargoHash = "sha256-JrtXDercjkPA5WVaq+LyhFmGqMAxQ/sVZQlmtJUTrms="; + cargoHash = "sha256-CB0jhVDR40lZaYqNq43V/af1v3Ph+6Z9swSrrsNgA8k="; patches = [ ./fix_run_checks.patch From 27d705e47a2a243a7b06becb40f8cbf1668fd19b Mon Sep 17 00:00:00 2001 From: 06kellyjac Date: Mon, 22 Sep 2025 13:38:18 +0100 Subject: [PATCH 2/3] shh: move to finalAttrs pattern --- pkgs/by-name/sh/shh/package.nix | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/pkgs/by-name/sh/shh/package.nix b/pkgs/by-name/sh/shh/package.nix index 1cb931aad653..0b76ce44c34f 100644 --- a/pkgs/by-name/sh/shh/package.nix +++ b/pkgs/by-name/sh/shh/package.nix @@ -16,14 +16,14 @@ let isNativeDocgen = (stdenv.buildPlatform.canExecute stdenv.hostPlatform) && enableDocumentationFeature; in -rustPlatform.buildRustPackage rec { +rustPlatform.buildRustPackage (finalAttrs: { pname = "shh"; version = "2025.9.22"; src = fetchFromGitHub { owner = "desbma"; repo = "shh"; - tag = "v${version}"; + tag = "v${finalAttrs.version}"; hash = "sha256-Esb6IR49YtGWvLmGLtviAyMLjoWZLQka2igC6yKJ3A0="; }; @@ -85,9 +85,9 @@ rustPlatform.buildRustPackage rec { installManPage target/mangen/* - installShellCompletion --cmd ${pname} \ - target/shellcomplete/${pname}.{bash,fish} \ - --zsh target/shellcomplete/_${pname} + installShellCompletion --cmd ${finalAttrs.pname} \ + target/shellcomplete/${finalAttrs.pname}.{bash,fish} \ + --zsh target/shellcomplete/_${finalAttrs.pname} ''; # RUST_BACKTRACE = 1; @@ -99,11 +99,11 @@ rustPlatform.buildRustPackage rec { homepage = "https://github.com/desbma/shh"; license = lib.licenses.gpl3Only; platforms = lib.platforms.linux; - changelog = "https://github.com/desbma/shh/blob/v${version}/CHANGELOG.md"; + changelog = "https://github.com/desbma/shh/blob/v${finalAttrs.version}/CHANGELOG.md"; mainProgram = "shh"; maintainers = with lib.maintainers; [ erdnaxe kuflierl ]; }; -} +}) From 844d63e83084081cbf9bf6e07329bd490932a6e1 Mon Sep 17 00:00:00 2001 From: 06kellyjac Date: Mon, 22 Sep 2025 13:38:47 +0100 Subject: [PATCH 3/3] shh: add jk as maintainer --- pkgs/by-name/sh/shh/package.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/pkgs/by-name/sh/shh/package.nix b/pkgs/by-name/sh/shh/package.nix index 0b76ce44c34f..b8940661b542 100644 --- a/pkgs/by-name/sh/shh/package.nix +++ b/pkgs/by-name/sh/shh/package.nix @@ -104,6 +104,7 @@ rustPlatform.buildRustPackage (finalAttrs: { maintainers = with lib.maintainers; [ erdnaxe kuflierl + jk ]; }; })