staging-nixos merge for 2026-04-14 (#509851)
This commit is contained in:
Vladimír Čunát
@@ -337,6 +337,8 @@ gnuradioMinimal.override {
|
||||
|
||||
- The `neovim` package and module now disable by default the `python3` and `ruby` providers, unused by most users and reducing closure size from 365MiB to 240MiB. Host provider executables are not exposed anymore along with the neovim wrapper. You can still refer to those using the neovim provider variables (e.g., `python3_host_prog`).
|
||||
|
||||
- `canokey-qemu` support for `qemu` was restored (although disabled by default), after being marked as broken since nixpkgs 25.11. Please note that the format of canokey files has changed, and that some data created with older canokey-qemu release cannot be read by the current version. See the [documentation](https://github.com/canokeys/canokey-qemu/tree/v1?tab=readme-ov-file#compatibility-warning) for details.
|
||||
|
||||
### Deprecations {#sec-nixpkgs-release-26.05-lib-deprecations}
|
||||
|
||||
- `mpv-unwrapped.scripts` and `mpv-unwrapped.wrapper` have been removed. Please use `mpvScripts` and `mpv.override` accordingly.
|
||||
|
||||
@@ -361,6 +361,12 @@ See <https://github.com/NixOS/nixpkgs/issues/481673>.
|
||||
|
||||
- `services.slurm` now supports slurmrestd usage through the `services.slurm.rest` NixOS options.
|
||||
|
||||
- The `networking.firewall.logRefusedConnections` option now defaults to
|
||||
`false`. Logging of refused or dropped incoming connections can generate a
|
||||
very high volume of kernel log messages on internet-facing systems, causing
|
||||
the kernel ring buffer (dmesg) to rotate quickly and potentially discard more
|
||||
relevant diagnostic information.
|
||||
|
||||
- The `services.calibre-web` systemd service has been hardened with additional sandboxing restrictions.
|
||||
|
||||
- `services.kanidm` options for server, client and unix were moved under dedicated namespaces.
|
||||
|
||||
@@ -1,8 +1,8 @@
|
||||
{
|
||||
x86_64-linux = "/nix/store/vals1fs2rl6yn5f8gbqj9mvly4r27shs-nix-2.31.4";
|
||||
i686-linux = "/nix/store/fyrlz8cdzvf5csdh5885wifpxc8ywdii-nix-2.31.4";
|
||||
aarch64-linux = "/nix/store/19p3nc892m7idfg2ngd1614660xqbhnm-nix-2.31.4";
|
||||
riscv64-linux = "/nix/store/x1isvq0xnyrg0l29qk2xlp929cgjsmqy-nix-riscv64-unknown-linux-gnu-2.31.4";
|
||||
x86_64-darwin = "/nix/store/4gqxzd5zkxcq271wi5saml4zd92rdkws-nix-2.31.4";
|
||||
aarch64-darwin = "/nix/store/r3gz609kdqchxcmil7dhbravbq8kwm93-nix-2.31.4";
|
||||
x86_64-linux = "/nix/store/q7f0d4m54yj98fcjmbkscw83j82fypnd-nix-2.34.6";
|
||||
i686-linux = "/nix/store/mlv349bmjjx34p50idp54rg0wsm44hws-nix-2.34.6";
|
||||
aarch64-linux = "/nix/store/wlcv2ymswfgwv1cj1q29p26rh26xj3nd-nix-2.34.6";
|
||||
riscv64-linux = "/nix/store/000b0vjlhw359rl82p8pld00g6363c78-nix-riscv64-unknown-linux-gnu-2.34.6";
|
||||
x86_64-darwin = "/nix/store/mqvv503c5l9kgjvc7vyxj3rdx5a71c11-nix-2.34.6";
|
||||
aarch64-darwin = "/nix/store/hcgga2smfm8lqirshrbfpk5j1my1wh4j-nix-2.34.6";
|
||||
}
|
||||
|
||||
@@ -118,7 +118,7 @@ in
|
||||
|
||||
logRefusedConnections = lib.mkOption {
|
||||
type = lib.types.bool;
|
||||
default = true;
|
||||
default = false;
|
||||
description = ''
|
||||
Whether to log rejected or dropped incoming connections.
|
||||
Note: The logs are found in the kernel logs, i.e. dmesg
|
||||
|
||||
@@ -1,11 +1,13 @@
|
||||
{ lib, pkgs, ... }:
|
||||
{
|
||||
lib,
|
||||
pkgs,
|
||||
hostPkgs,
|
||||
...
|
||||
}:
|
||||
{
|
||||
name = "systemd-initrd-luks-fido2";
|
||||
|
||||
meta = {
|
||||
# `canokey-qemu` is marked broken.
|
||||
broken = true;
|
||||
};
|
||||
qemu.package = hostPkgs.qemu_test.override { canokeySupport = true; };
|
||||
|
||||
nodes.machine =
|
||||
{ pkgs, config, ... }:
|
||||
@@ -22,6 +24,7 @@
|
||||
"-device canokey,bus=usb-bus.0,file=/tmp/canokey-file"
|
||||
];
|
||||
};
|
||||
|
||||
boot.loader.systemd-boot.enable = true;
|
||||
|
||||
boot.initrd.systemd.enable = true;
|
||||
|
||||
@@ -1,41 +0,0 @@
|
||||
From 9e59480d941c40b868ebafa5138bbc71ca87f08e Mon Sep 17 00:00:00 2001
|
||||
From: Alyssa Ross <hi@alyssa.is>
|
||||
Date: Sat, 18 May 2024 09:55:17 +0200
|
||||
Subject: [PATCH] Fix build where memcpy is a macro
|
||||
|
||||
I got the following compiler error with Clang 16 building for
|
||||
x86_64-apple-darwin:
|
||||
|
||||
/tmp/nix-build-canokey-qemu-0-unstable-2023-06-06.drv-0/source/canokey-core/applets/oath/oath.c:44:50: error: too many arguments provided to function-like macro invocation
|
||||
memcpy(RDATA, (uint8_t[]){OATH_TAG_VERSION, 3, 0x05, 0x05, 0x05, OATH_TAG_NAME, HANDLE_LEN}, 7);
|
||||
^
|
||||
/nix/store/vw8y07yai2pjv02s1piw3r5cyhmjbddf-Libsystem-1238.60.2/include/secure/_string.h:64:9: note: macro 'memcpy' defined here
|
||||
#define memcpy(dest, src, len) \
|
||||
^
|
||||
/tmp/nix-build-canokey-qemu-0-unstable-2023-06-06.drv-0/source/canokey-core/applets/oath/oath.c:44:3: note: parentheses are required around macro argument containing braced initializer list
|
||||
memcpy(RDATA, (uint8_t[]){OATH_TAG_VERSION, 3, 0x05, 0x05, 0x05, OATH_TAG_NAME, HANDLE_LEN}, 7);
|
||||
^
|
||||
( )
|
||||
1 error generated.
|
||||
|
||||
Link: https://github.com/canokeys/canokey-core/pull/85
|
||||
---
|
||||
canokey-core/applets/oath/oath.c | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/canokey-core/applets/oath/oath.c b/canokey-core/applets/oath/oath.c
|
||||
index bd8361a..2d2c0ef 100644
|
||||
--- a/canokey-core/applets/oath/oath.c
|
||||
+++ b/canokey-core/applets/oath/oath.c
|
||||
@@ -41,7 +41,7 @@ int oath_install(uint8_t reset) {
|
||||
static int oath_select(const CAPDU *capdu, RAPDU *rapdu) {
|
||||
if (P2 != 0x00) EXCEPT(SW_WRONG_P1P2);
|
||||
|
||||
- memcpy(RDATA, (uint8_t[]){OATH_TAG_VERSION, 3, 0x05, 0x05, 0x05, OATH_TAG_NAME, HANDLE_LEN}, 7);
|
||||
+ memcpy(RDATA, ((uint8_t[]){OATH_TAG_VERSION, 3, 0x05, 0x05, 0x05, OATH_TAG_NAME, HANDLE_LEN}), 7);
|
||||
if (read_attr(OATH_FILE, ATTR_HANDLE, RDATA + 7, HANDLE_LEN) < 0) return -1;
|
||||
LL = 7 + HANDLE_LEN;
|
||||
|
||||
--
|
||||
2.44.0
|
||||
|
||||
@@ -3,29 +3,30 @@
|
||||
stdenv,
|
||||
fetchFromGitHub,
|
||||
cmake,
|
||||
python3Packages,
|
||||
unstableGitUpdater,
|
||||
}:
|
||||
stdenv.mkDerivation rec {
|
||||
pname = "canokey-qemu";
|
||||
version = "0-unstable-2023-06-06";
|
||||
rev = "151568c34f5e92b086b7a3a62a11c43dd39f628b";
|
||||
version = "0-unstable-2026-03-24";
|
||||
rev = "41044ec17ddb835b3e5acb385a2e429aa74af627";
|
||||
|
||||
src = fetchFromGitHub {
|
||||
owner = "canokeys";
|
||||
repo = "canokey-qemu";
|
||||
inherit rev;
|
||||
fetchSubmodules = true;
|
||||
hash = "sha256-4V/2UOgGWgL+tFJO/k90bCDjWSVyIpxw3nYi9NU/OxA=";
|
||||
hash = "sha256-eunhMRp3HJ80kCCZbiMGNjA9b0uUMzOsSeNh61d1iJU=";
|
||||
};
|
||||
|
||||
patches = [
|
||||
./canokey-qemu-memcpy.patch
|
||||
];
|
||||
|
||||
postPatch = ''
|
||||
substituteInPlace canokey-core/CMakeLists.txt \
|
||||
--replace "COMMAND git describe --always --tags --long --abbrev=8 --dirty >>" "COMMAND echo '$rev' >>"
|
||||
'';
|
||||
--replace-fail "git describe --always --tags --long --abbrev=8 --dirty >>" "echo '$rev' >>"
|
||||
''
|
||||
+ (lib.optionalString stdenv.hostPlatform.isStatic ''
|
||||
substituteInPlace CMakeLists.txt \
|
||||
--replace-fail "add_library(canokey-qemu SHARED" "add_library(canokey-qemu STATIC"
|
||||
'');
|
||||
|
||||
preConfigure = ''
|
||||
cmakeFlagsArray+=(
|
||||
@@ -38,6 +39,24 @@ stdenv.mkDerivation rec {
|
||||
++ lib.optionals stdenv.cc.isClang [
|
||||
"-Wno-error=documentation"
|
||||
]
|
||||
++ lib.optionals stdenv.cc.isGNU [
|
||||
# canokey-qemu contains a vendored copy of mbedtls, and
|
||||
# mbedtls widely uses a pattern of starting unions with an
|
||||
# unsigned int dummy member, and then initializing those unions to
|
||||
# { 0 }. The problem with this is that it only initializes that
|
||||
# first union member, so in the common case where the non-dummy
|
||||
# members are larger than the dummy member, they will only be
|
||||
# partially initialized since GCC 15[1]. Upstream has added
|
||||
# ad-hoc memset calls to mitigate this issue, but initializers are
|
||||
# also still widely used. To avoid the risk of using
|
||||
# uninitialized memory, force the compiler to zero all bits of
|
||||
# unions, not just the first element, until upstream has a
|
||||
# systemic fix in place[2].
|
||||
#
|
||||
# [1]: https://gcc.gnu.org/gcc-15/changes.html
|
||||
# [2]: https://github.com/Mbed-TLS/mbedtls/issues/9885
|
||||
"-fzero-init-padding-bits=unions"
|
||||
]
|
||||
)
|
||||
}
|
||||
)
|
||||
@@ -48,19 +67,19 @@ stdenv.mkDerivation rec {
|
||||
"dev"
|
||||
];
|
||||
|
||||
nativeBuildInputs = [ cmake ];
|
||||
nativeBuildInputs = [
|
||||
cmake
|
||||
python3Packages.jsonschema
|
||||
python3Packages.jinja2
|
||||
];
|
||||
|
||||
passthru.updateScript = unstableGitUpdater { };
|
||||
|
||||
meta = {
|
||||
homepage = "https://github.com/canokeys/canokey-qemu";
|
||||
description = "CanoKey QEMU Virt Card";
|
||||
description = "CanoKey QEMU Virtual Card";
|
||||
longDescription = "A virtual OPENPGP and FIDO2 card. Only for testing purpose. There is no warranty on security.";
|
||||
license = lib.licenses.asl20;
|
||||
maintainers = with lib.maintainers; [ oxalica ];
|
||||
# Uses a four‐year‐old patched vendored version of Mbed TLS for
|
||||
# cryptography that doesn’t build with CMake 4. Doesn’t build with
|
||||
# gurrent versions of `canokey-core`, either. No upstream
|
||||
# development since 2023.
|
||||
broken = true;
|
||||
maintainers = with lib.maintainers; [ symphorien ];
|
||||
};
|
||||
}
|
||||
|
||||
@@ -18,13 +18,13 @@
|
||||
}:
|
||||
stdenv.mkDerivation (finalAttrs: {
|
||||
pname = "wolfssl-${variant}";
|
||||
version = "5.9.0";
|
||||
version = "5.9.1";
|
||||
|
||||
src = fetchFromGitHub {
|
||||
owner = "wolfSSL";
|
||||
repo = "wolfssl";
|
||||
tag = "v${finalAttrs.version}-stable";
|
||||
hash = "sha256-Ov59Zt0UskADQThdzr9wni2junSpy3jiABWpiGr8xtg=";
|
||||
hash = "sha256-FyEb94hsO2BaTEi1CJRfCsUiT1xyWCzu7Uys81g2CBE=";
|
||||
};
|
||||
|
||||
postPatch = ''
|
||||
|
||||
@@ -230,7 +230,7 @@ lib.makeExtensible (
|
||||
latest = self.nix_2_34;
|
||||
|
||||
# Read ./README.md before bumping a major release
|
||||
stable = addFallbackPathsCheck self.nix_2_31;
|
||||
stable = addFallbackPathsCheck self.nix_2_34;
|
||||
}
|
||||
// lib.optionalAttrs config.allowAliases (
|
||||
lib.listToAttrs (
|
||||
|
||||
@@ -62,10 +62,10 @@ mkMesonExecutable (finalAttrs: {
|
||||
runCommand "${finalAttrs.pname}-run"
|
||||
{
|
||||
meta.broken = !stdenv.hostPlatform.emulatorAvailable buildPackages;
|
||||
buildInputs = [
|
||||
nativeBuildInputs = [
|
||||
writableTmpDirAsHomeHook
|
||||
]
|
||||
++ lib.optional (lib.versionAtLeast version "2.34pre") openssl;
|
||||
++ lib.optional (lib.versionAtLeast version "2.34pre") (lib.getBin openssl);
|
||||
}
|
||||
''
|
||||
export _NIX_TEST_UNIT_DATA=${data + "/src/libstore-tests/data"}
|
||||
|
||||
Reference in New Issue
Block a user