diff --git a/doc/release-notes/rl-2605.section.md b/doc/release-notes/rl-2605.section.md index 9d3bb68f5c06..c59d72f7da45 100644 --- a/doc/release-notes/rl-2605.section.md +++ b/doc/release-notes/rl-2605.section.md @@ -337,6 +337,8 @@ gnuradioMinimal.override { - The `neovim` package and module now disable by default the `python3` and `ruby` providers, unused by most users and reducing closure size from 365MiB to 240MiB. Host provider executables are not exposed anymore along with the neovim wrapper. You can still refer to those using the neovim provider variables (e.g., `python3_host_prog`). +- `canokey-qemu` support for `qemu` was restored (although disabled by default), after being marked as broken since nixpkgs 25.11. Please note that the format of canokey files has changed, and that some data created with older canokey-qemu release cannot be read by the current version. See the [documentation](https://github.com/canokeys/canokey-qemu/tree/v1?tab=readme-ov-file#compatibility-warning) for details. + ### Deprecations {#sec-nixpkgs-release-26.05-lib-deprecations} - `mpv-unwrapped.scripts` and `mpv-unwrapped.wrapper` have been removed. Please use `mpvScripts` and `mpv.override` accordingly. diff --git a/nixos/doc/manual/release-notes/rl-2605.section.md b/nixos/doc/manual/release-notes/rl-2605.section.md index e7c7d13e1c0a..faaee7f9c27f 100644 --- a/nixos/doc/manual/release-notes/rl-2605.section.md +++ b/nixos/doc/manual/release-notes/rl-2605.section.md @@ -361,6 +361,12 @@ See . - `services.slurm` now supports slurmrestd usage through the `services.slurm.rest` NixOS options. +- The `networking.firewall.logRefusedConnections` option now defaults to + `false`. Logging of refused or dropped incoming connections can generate a + very high volume of kernel log messages on internet-facing systems, causing + the kernel ring buffer (dmesg) to rotate quickly and potentially discard more + relevant diagnostic information. + - The `services.calibre-web` systemd service has been hardened with additional sandboxing restrictions. - `services.kanidm` options for server, client and unix were moved under dedicated namespaces. diff --git a/nixos/modules/installer/tools/nix-fallback-paths.nix b/nixos/modules/installer/tools/nix-fallback-paths.nix index 98bd3cec0de2..7a74c45432ca 100644 --- a/nixos/modules/installer/tools/nix-fallback-paths.nix +++ b/nixos/modules/installer/tools/nix-fallback-paths.nix @@ -1,8 +1,8 @@ { - x86_64-linux = "/nix/store/vals1fs2rl6yn5f8gbqj9mvly4r27shs-nix-2.31.4"; - i686-linux = "/nix/store/fyrlz8cdzvf5csdh5885wifpxc8ywdii-nix-2.31.4"; - aarch64-linux = "/nix/store/19p3nc892m7idfg2ngd1614660xqbhnm-nix-2.31.4"; - riscv64-linux = "/nix/store/x1isvq0xnyrg0l29qk2xlp929cgjsmqy-nix-riscv64-unknown-linux-gnu-2.31.4"; - x86_64-darwin = "/nix/store/4gqxzd5zkxcq271wi5saml4zd92rdkws-nix-2.31.4"; - aarch64-darwin = "/nix/store/r3gz609kdqchxcmil7dhbravbq8kwm93-nix-2.31.4"; + x86_64-linux = "/nix/store/q7f0d4m54yj98fcjmbkscw83j82fypnd-nix-2.34.6"; + i686-linux = "/nix/store/mlv349bmjjx34p50idp54rg0wsm44hws-nix-2.34.6"; + aarch64-linux = "/nix/store/wlcv2ymswfgwv1cj1q29p26rh26xj3nd-nix-2.34.6"; + riscv64-linux = "/nix/store/000b0vjlhw359rl82p8pld00g6363c78-nix-riscv64-unknown-linux-gnu-2.34.6"; + x86_64-darwin = "/nix/store/mqvv503c5l9kgjvc7vyxj3rdx5a71c11-nix-2.34.6"; + aarch64-darwin = "/nix/store/hcgga2smfm8lqirshrbfpk5j1my1wh4j-nix-2.34.6"; } diff --git a/nixos/modules/services/networking/firewall.nix b/nixos/modules/services/networking/firewall.nix index 95308c2a9cfc..2e3d1250ef2c 100644 --- a/nixos/modules/services/networking/firewall.nix +++ b/nixos/modules/services/networking/firewall.nix @@ -118,7 +118,7 @@ in logRefusedConnections = lib.mkOption { type = lib.types.bool; - default = true; + default = false; description = '' Whether to log rejected or dropped incoming connections. Note: The logs are found in the kernel logs, i.e. dmesg diff --git a/nixos/tests/systemd-initrd-luks-fido2.nix b/nixos/tests/systemd-initrd-luks-fido2.nix index 002281585064..a38c97e8b0dd 100644 --- a/nixos/tests/systemd-initrd-luks-fido2.nix +++ b/nixos/tests/systemd-initrd-luks-fido2.nix @@ -1,11 +1,13 @@ -{ lib, pkgs, ... }: +{ + lib, + pkgs, + hostPkgs, + ... +}: { name = "systemd-initrd-luks-fido2"; - meta = { - # `canokey-qemu` is marked broken. - broken = true; - }; + qemu.package = hostPkgs.qemu_test.override { canokeySupport = true; }; nodes.machine = { pkgs, config, ... }: @@ -22,6 +24,7 @@ "-device canokey,bus=usb-bus.0,file=/tmp/canokey-file" ]; }; + boot.loader.systemd-boot.enable = true; boot.initrd.systemd.enable = true; diff --git a/pkgs/by-name/ca/canokey-qemu/canokey-qemu-memcpy.patch b/pkgs/by-name/ca/canokey-qemu/canokey-qemu-memcpy.patch deleted file mode 100644 index 578c687f54cf..000000000000 --- a/pkgs/by-name/ca/canokey-qemu/canokey-qemu-memcpy.patch +++ /dev/null @@ -1,41 +0,0 @@ -From 9e59480d941c40b868ebafa5138bbc71ca87f08e Mon Sep 17 00:00:00 2001 -From: Alyssa Ross -Date: Sat, 18 May 2024 09:55:17 +0200 -Subject: [PATCH] Fix build where memcpy is a macro - -I got the following compiler error with Clang 16 building for -x86_64-apple-darwin: - - /tmp/nix-build-canokey-qemu-0-unstable-2023-06-06.drv-0/source/canokey-core/applets/oath/oath.c:44:50: error: too many arguments provided to function-like macro invocation - memcpy(RDATA, (uint8_t[]){OATH_TAG_VERSION, 3, 0x05, 0x05, 0x05, OATH_TAG_NAME, HANDLE_LEN}, 7); - ^ - /nix/store/vw8y07yai2pjv02s1piw3r5cyhmjbddf-Libsystem-1238.60.2/include/secure/_string.h:64:9: note: macro 'memcpy' defined here - #define memcpy(dest, src, len) \ - ^ - /tmp/nix-build-canokey-qemu-0-unstable-2023-06-06.drv-0/source/canokey-core/applets/oath/oath.c:44:3: note: parentheses are required around macro argument containing braced initializer list - memcpy(RDATA, (uint8_t[]){OATH_TAG_VERSION, 3, 0x05, 0x05, 0x05, OATH_TAG_NAME, HANDLE_LEN}, 7); - ^ - ( ) - 1 error generated. - -Link: https://github.com/canokeys/canokey-core/pull/85 ---- - canokey-core/applets/oath/oath.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/canokey-core/applets/oath/oath.c b/canokey-core/applets/oath/oath.c -index bd8361a..2d2c0ef 100644 ---- a/canokey-core/applets/oath/oath.c -+++ b/canokey-core/applets/oath/oath.c -@@ -41,7 +41,7 @@ int oath_install(uint8_t reset) { - static int oath_select(const CAPDU *capdu, RAPDU *rapdu) { - if (P2 != 0x00) EXCEPT(SW_WRONG_P1P2); - -- memcpy(RDATA, (uint8_t[]){OATH_TAG_VERSION, 3, 0x05, 0x05, 0x05, OATH_TAG_NAME, HANDLE_LEN}, 7); -+ memcpy(RDATA, ((uint8_t[]){OATH_TAG_VERSION, 3, 0x05, 0x05, 0x05, OATH_TAG_NAME, HANDLE_LEN}), 7); - if (read_attr(OATH_FILE, ATTR_HANDLE, RDATA + 7, HANDLE_LEN) < 0) return -1; - LL = 7 + HANDLE_LEN; - --- -2.44.0 - diff --git a/pkgs/by-name/ca/canokey-qemu/package.nix b/pkgs/by-name/ca/canokey-qemu/package.nix index be8235b8dda4..78030234fc0c 100644 --- a/pkgs/by-name/ca/canokey-qemu/package.nix +++ b/pkgs/by-name/ca/canokey-qemu/package.nix @@ -3,29 +3,30 @@ stdenv, fetchFromGitHub, cmake, + python3Packages, unstableGitUpdater, }: stdenv.mkDerivation rec { pname = "canokey-qemu"; - version = "0-unstable-2023-06-06"; - rev = "151568c34f5e92b086b7a3a62a11c43dd39f628b"; + version = "0-unstable-2026-03-24"; + rev = "41044ec17ddb835b3e5acb385a2e429aa74af627"; src = fetchFromGitHub { owner = "canokeys"; repo = "canokey-qemu"; inherit rev; fetchSubmodules = true; - hash = "sha256-4V/2UOgGWgL+tFJO/k90bCDjWSVyIpxw3nYi9NU/OxA="; + hash = "sha256-eunhMRp3HJ80kCCZbiMGNjA9b0uUMzOsSeNh61d1iJU="; }; - patches = [ - ./canokey-qemu-memcpy.patch - ]; - postPatch = '' substituteInPlace canokey-core/CMakeLists.txt \ - --replace "COMMAND git describe --always --tags --long --abbrev=8 --dirty >>" "COMMAND echo '$rev' >>" - ''; + --replace-fail "git describe --always --tags --long --abbrev=8 --dirty >>" "echo '$rev' >>" + '' + + (lib.optionalString stdenv.hostPlatform.isStatic '' + substituteInPlace CMakeLists.txt \ + --replace-fail "add_library(canokey-qemu SHARED" "add_library(canokey-qemu STATIC" + ''); preConfigure = '' cmakeFlagsArray+=( @@ -38,6 +39,24 @@ stdenv.mkDerivation rec { ++ lib.optionals stdenv.cc.isClang [ "-Wno-error=documentation" ] + ++ lib.optionals stdenv.cc.isGNU [ + # canokey-qemu contains a vendored copy of mbedtls, and + # mbedtls widely uses a pattern of starting unions with an + # unsigned int dummy member, and then initializing those unions to + # { 0 }. The problem with this is that it only initializes that + # first union member, so in the common case where the non-dummy + # members are larger than the dummy member, they will only be + # partially initialized since GCC 15[1]. Upstream has added + # ad-hoc memset calls to mitigate this issue, but initializers are + # also still widely used. To avoid the risk of using + # uninitialized memory, force the compiler to zero all bits of + # unions, not just the first element, until upstream has a + # systemic fix in place[2]. + # + # [1]: https://gcc.gnu.org/gcc-15/changes.html + # [2]: https://github.com/Mbed-TLS/mbedtls/issues/9885 + "-fzero-init-padding-bits=unions" + ] ) } ) @@ -48,19 +67,19 @@ stdenv.mkDerivation rec { "dev" ]; - nativeBuildInputs = [ cmake ]; + nativeBuildInputs = [ + cmake + python3Packages.jsonschema + python3Packages.jinja2 + ]; passthru.updateScript = unstableGitUpdater { }; meta = { homepage = "https://github.com/canokeys/canokey-qemu"; - description = "CanoKey QEMU Virt Card"; + description = "CanoKey QEMU Virtual Card"; + longDescription = "A virtual OPENPGP and FIDO2 card. Only for testing purpose. There is no warranty on security."; license = lib.licenses.asl20; - maintainers = with lib.maintainers; [ oxalica ]; - # Uses a four‐year‐old patched vendored version of Mbed TLS for - # cryptography that doesn’t build with CMake 4. Doesn’t build with - # gurrent versions of `canokey-core`, either. No upstream - # development since 2023. - broken = true; + maintainers = with lib.maintainers; [ symphorien ]; }; } diff --git a/pkgs/by-name/wo/wolfssl/package.nix b/pkgs/by-name/wo/wolfssl/package.nix index 6df1a958ebcf..6cde924b81f7 100644 --- a/pkgs/by-name/wo/wolfssl/package.nix +++ b/pkgs/by-name/wo/wolfssl/package.nix @@ -18,13 +18,13 @@ }: stdenv.mkDerivation (finalAttrs: { pname = "wolfssl-${variant}"; - version = "5.9.0"; + version = "5.9.1"; src = fetchFromGitHub { owner = "wolfSSL"; repo = "wolfssl"; tag = "v${finalAttrs.version}-stable"; - hash = "sha256-Ov59Zt0UskADQThdzr9wni2junSpy3jiABWpiGr8xtg="; + hash = "sha256-FyEb94hsO2BaTEi1CJRfCsUiT1xyWCzu7Uys81g2CBE="; }; postPatch = '' diff --git a/pkgs/tools/package-management/nix/default.nix b/pkgs/tools/package-management/nix/default.nix index 78cbbd8541bf..de0556356e53 100644 --- a/pkgs/tools/package-management/nix/default.nix +++ b/pkgs/tools/package-management/nix/default.nix @@ -230,7 +230,7 @@ lib.makeExtensible ( latest = self.nix_2_34; # Read ./README.md before bumping a major release - stable = addFallbackPathsCheck self.nix_2_31; + stable = addFallbackPathsCheck self.nix_2_34; } // lib.optionalAttrs config.allowAliases ( lib.listToAttrs ( diff --git a/pkgs/tools/package-management/nix/modular/src/libstore-tests/package.nix b/pkgs/tools/package-management/nix/modular/src/libstore-tests/package.nix index e31044270a76..b7eebc6f53ca 100644 --- a/pkgs/tools/package-management/nix/modular/src/libstore-tests/package.nix +++ b/pkgs/tools/package-management/nix/modular/src/libstore-tests/package.nix @@ -62,10 +62,10 @@ mkMesonExecutable (finalAttrs: { runCommand "${finalAttrs.pname}-run" { meta.broken = !stdenv.hostPlatform.emulatorAvailable buildPackages; - buildInputs = [ + nativeBuildInputs = [ writableTmpDirAsHomeHook ] - ++ lib.optional (lib.versionAtLeast version "2.34pre") openssl; + ++ lib.optional (lib.versionAtLeast version "2.34pre") (lib.getBin openssl); } '' export _NIX_TEST_UNIT_DATA=${data + "/src/libstore-tests/data"}