From 760f43a69e47fbbca3a9db56dcf7ac0c1d307ca3 Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Wed, 8 Apr 2026 01:34:05 +0200 Subject: [PATCH 1/7] nixos/firewall: disable refused connections logging On any server on the internet this causes fast rotation of the kernel ringbuffer, which makes more important message disappear from dmesg much too quickly. --- nixos/doc/manual/release-notes/rl-2605.section.md | 6 ++++++ nixos/modules/services/networking/firewall.nix | 2 +- 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/nixos/doc/manual/release-notes/rl-2605.section.md b/nixos/doc/manual/release-notes/rl-2605.section.md index 3090f9ee8891..ce14eba26764 100644 --- a/nixos/doc/manual/release-notes/rl-2605.section.md +++ b/nixos/doc/manual/release-notes/rl-2605.section.md @@ -343,6 +343,12 @@ See . - `services.slurm` now supports slurmrestd usage through the `services.slurm.rest` NixOS options. +- The `networking.firewall.logRefusedConnections` option now defaults to + `false`. Logging of refused or dropped incoming connections can generate a + very high volume of kernel log messages on internet-facing systems, causing + the kernel ring buffer (dmesg) to rotate quickly and potentially discard more + relevant diagnostic information. + - The `services.calibre-web` systemd service has been hardened with additional sandboxing restrictions. - `services.kanidm` options for server, client and unix were moved under dedicated namespaces. diff --git a/nixos/modules/services/networking/firewall.nix b/nixos/modules/services/networking/firewall.nix index 95308c2a9cfc..2e3d1250ef2c 100644 --- a/nixos/modules/services/networking/firewall.nix +++ b/nixos/modules/services/networking/firewall.nix @@ -118,7 +118,7 @@ in logRefusedConnections = lib.mkOption { type = lib.types.bool; - default = true; + default = false; description = '' Whether to log rejected or dropped incoming connections. Note: The logs are found in the kernel logs, i.e. dmesg From 3040774c2f99756cc03c28dd78bbcb2bbd4e73f9 Mon Sep 17 00:00:00 2001 From: Adrian Pistol Date: Fri, 10 Apr 2026 20:27:26 +0200 Subject: [PATCH 2/7] wolfssl: 5.9.0 -> 5.9.1 --- pkgs/by-name/wo/wolfssl/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/wo/wolfssl/package.nix b/pkgs/by-name/wo/wolfssl/package.nix index 6df1a958ebcf..6cde924b81f7 100644 --- a/pkgs/by-name/wo/wolfssl/package.nix +++ b/pkgs/by-name/wo/wolfssl/package.nix @@ -18,13 +18,13 @@ }: stdenv.mkDerivation (finalAttrs: { pname = "wolfssl-${variant}"; - version = "5.9.0"; + version = "5.9.1"; src = fetchFromGitHub { owner = "wolfSSL"; repo = "wolfssl"; tag = "v${finalAttrs.version}-stable"; - hash = "sha256-Ov59Zt0UskADQThdzr9wni2junSpy3jiABWpiGr8xtg="; + hash = "sha256-FyEb94hsO2BaTEi1CJRfCsUiT1xyWCzu7Uys81g2CBE="; }; postPatch = '' From 924e5a22c732c1caebb498c2efcb3c0eecd9feee Mon Sep 17 00:00:00 2001 From: Philip Taron Date: Mon, 30 Mar 2026 07:08:23 -0700 Subject: [PATCH 3/7] nixVersions.stable: nix_2_31 -> nix_2_34 --- nixos/modules/installer/tools/nix-fallback-paths.nix | 12 ++++++------ pkgs/tools/package-management/nix/default.nix | 2 +- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/nixos/modules/installer/tools/nix-fallback-paths.nix b/nixos/modules/installer/tools/nix-fallback-paths.nix index 98bd3cec0de2..7a74c45432ca 100644 --- a/nixos/modules/installer/tools/nix-fallback-paths.nix +++ b/nixos/modules/installer/tools/nix-fallback-paths.nix @@ -1,8 +1,8 @@ { - x86_64-linux = "/nix/store/vals1fs2rl6yn5f8gbqj9mvly4r27shs-nix-2.31.4"; - i686-linux = "/nix/store/fyrlz8cdzvf5csdh5885wifpxc8ywdii-nix-2.31.4"; - aarch64-linux = "/nix/store/19p3nc892m7idfg2ngd1614660xqbhnm-nix-2.31.4"; - riscv64-linux = "/nix/store/x1isvq0xnyrg0l29qk2xlp929cgjsmqy-nix-riscv64-unknown-linux-gnu-2.31.4"; - x86_64-darwin = "/nix/store/4gqxzd5zkxcq271wi5saml4zd92rdkws-nix-2.31.4"; - aarch64-darwin = "/nix/store/r3gz609kdqchxcmil7dhbravbq8kwm93-nix-2.31.4"; + x86_64-linux = "/nix/store/q7f0d4m54yj98fcjmbkscw83j82fypnd-nix-2.34.6"; + i686-linux = "/nix/store/mlv349bmjjx34p50idp54rg0wsm44hws-nix-2.34.6"; + aarch64-linux = "/nix/store/wlcv2ymswfgwv1cj1q29p26rh26xj3nd-nix-2.34.6"; + riscv64-linux = "/nix/store/000b0vjlhw359rl82p8pld00g6363c78-nix-riscv64-unknown-linux-gnu-2.34.6"; + x86_64-darwin = "/nix/store/mqvv503c5l9kgjvc7vyxj3rdx5a71c11-nix-2.34.6"; + aarch64-darwin = "/nix/store/hcgga2smfm8lqirshrbfpk5j1my1wh4j-nix-2.34.6"; } diff --git a/pkgs/tools/package-management/nix/default.nix b/pkgs/tools/package-management/nix/default.nix index 78cbbd8541bf..de0556356e53 100644 --- a/pkgs/tools/package-management/nix/default.nix +++ b/pkgs/tools/package-management/nix/default.nix @@ -230,7 +230,7 @@ lib.makeExtensible ( latest = self.nix_2_34; # Read ./README.md before bumping a major release - stable = addFallbackPathsCheck self.nix_2_31; + stable = addFallbackPathsCheck self.nix_2_34; } // lib.optionalAttrs config.allowAliases ( lib.listToAttrs ( From 0ca69b06507c8a66ba02774b218aa2e8ccd2b59e Mon Sep 17 00:00:00 2001 From: Philip Taron Date: Mon, 30 Mar 2026 08:42:46 -0700 Subject: [PATCH 4/7] nix: fix nix-store-tests-run for static builds The test runner's buildInputs (writableTmpDirAsHomeHook, openssl) need to be nativeBuildInputs. In the static (cross-musl) build, strictDeps is enabled and only nativeBuildInputs are added to PATH. With buildInputs, openssl was not in PATH, causing HttpsBinaryCacheStoreTest.queryPathInfo to crash. --- .../nix/modular/src/libstore-tests/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/tools/package-management/nix/modular/src/libstore-tests/package.nix b/pkgs/tools/package-management/nix/modular/src/libstore-tests/package.nix index e31044270a76..b7eebc6f53ca 100644 --- a/pkgs/tools/package-management/nix/modular/src/libstore-tests/package.nix +++ b/pkgs/tools/package-management/nix/modular/src/libstore-tests/package.nix @@ -62,10 +62,10 @@ mkMesonExecutable (finalAttrs: { runCommand "${finalAttrs.pname}-run" { meta.broken = !stdenv.hostPlatform.emulatorAvailable buildPackages; - buildInputs = [ + nativeBuildInputs = [ writableTmpDirAsHomeHook ] - ++ lib.optional (lib.versionAtLeast version "2.34pre") openssl; + ++ lib.optional (lib.versionAtLeast version "2.34pre") (lib.getBin openssl); } '' export _NIX_TEST_UNIT_DATA=${data + "/src/libstore-tests/data"} From 149201a7e37c197bc090723af5c016f4f596c735 Mon Sep 17 00:00:00 2001 From: Michael Schneider Date: Wed, 18 Feb 2026 13:35:44 +0200 Subject: [PATCH 5/7] nixos/test-driver: use log levels --- .../test-driver/src/test_driver/__init__.py | 13 ++++++ .../lib/test-driver/src/test_driver/logger.py | 45 ++++++++++++++++--- nixos/lib/testing/driver.nix | 12 +++++ 3 files changed, 64 insertions(+), 6 deletions(-) diff --git a/nixos/lib/test-driver/src/test_driver/__init__.py b/nixos/lib/test-driver/src/test_driver/__init__.py index 0f42f2842c77..da527f46b824 100644 --- a/nixos/lib/test-driver/src/test_driver/__init__.py +++ b/nixos/lib/test-driver/src/test_driver/__init__.py @@ -12,6 +12,7 @@ from test_driver.driver import Driver from test_driver.logger import ( CompositeLogger, JunitXMLLogger, + LogLevel, TerminalLogger, XMLLogger, ) @@ -151,6 +152,15 @@ def main() -> None: help="indicates that the interactive SSH backdoor is active and dumps information about it on start", type=int, ) + log_level_map = {level.name.lower(): level for level in LogLevel} + arg_parser.add_argument( + "--log-level", + metavar="LOG_LEVEL", + action=EnvDefault, + envvar="logLevel", + choices=log_level_map, + help="Set the log level", + ) args = arg_parser.parse_args() @@ -169,6 +179,9 @@ def main() -> None: if args.junit_xml: logger.add_logger(JunitXMLLogger(output_directory / args.junit_xml)) + if args.log_level: + logger.set_log_level(log_level_map[args.log_level]) + if not args.keep_machine_state: logger.info( "Machine state will be reset. To keep it, pass --keep-machine-state" diff --git a/nixos/lib/test-driver/src/test_driver/logger.py b/nixos/lib/test-driver/src/test_driver/logger.py index a218d234fe3f..3c2cb41d33b1 100644 --- a/nixos/lib/test-driver/src/test_driver/logger.py +++ b/nixos/lib/test-driver/src/test_driver/logger.py @@ -7,6 +7,7 @@ import unicodedata from abc import ABC, abstractmethod from collections.abc import Iterator from contextlib import ExitStack, contextmanager +from enum import IntEnum from pathlib import Path from queue import Empty, Queue from typing import Any @@ -17,6 +18,12 @@ from colorama import Fore, Style from junit_xml import TestCase, TestSuite +class LogLevel(IntEnum): + INFO = 1 + WARNING = 2 + ERROR = 3 + + class AbstractLogger(ABC): @abstractmethod def log(self, message: str, attributes: dict[str, str] = {}) -> None: @@ -56,6 +63,10 @@ class AbstractLogger(ABC): def print_serial_logs(self, enable: bool) -> None: pass + @abstractmethod + def set_log_level(self, level: LogLevel) -> None: + pass + class JunitXMLLogger(AbstractLogger): class TestCaseState: @@ -71,6 +82,7 @@ class JunitXMLLogger(AbstractLogger): self.currentSubtest = "main" self.outfile: Path = outfile self._print_serial_logs = True + self._log_level = LogLevel.INFO atexit.register(self.close) def log(self, message: str, attributes: dict[str, str] = {}) -> None: @@ -92,10 +104,12 @@ class JunitXMLLogger(AbstractLogger): yield def info(self, *args, **kwargs) -> None: # type: ignore - self.tests[self.currentSubtest].stdout += args[0] + os.linesep + if self._log_level <= LogLevel.INFO: + self.tests[self.currentSubtest].stdout += args[0] + os.linesep def warning(self, *args, **kwargs) -> None: # type: ignore - self.tests[self.currentSubtest].stdout += args[0] + os.linesep + if self._log_level <= LogLevel.WARNING: + self.tests[self.currentSubtest].stdout += args[0] + os.linesep def error(self, *args, **kwargs) -> None: # type: ignore self.tests[self.currentSubtest].stderr += args[0] + os.linesep @@ -113,6 +127,9 @@ class JunitXMLLogger(AbstractLogger): def print_serial_logs(self, enable: bool) -> None: self._print_serial_logs = enable + def set_log_level(self, level: LogLevel) -> None: + self._log_level = level + def close(self) -> None: with open(self.outfile, "w") as f: test_cases = [] @@ -180,10 +197,15 @@ class CompositeLogger(AbstractLogger): for logger in self.logger_list: logger.log_serial(message, machine) + def set_log_level(self, level: LogLevel) -> None: + for logger in self.logger_list: + logger.set_log_level(level) + class TerminalLogger(AbstractLogger): def __init__(self) -> None: self._print_serial_logs = True + self._log_level = LogLevel.INFO def maybe_prefix(self, message: str, attributes: dict[str, str]) -> str: if "machine" in attributes: @@ -216,10 +238,12 @@ class TerminalLogger(AbstractLogger): self.log(f"(finished: {message}, in {toc - tic:.2f} seconds)", attributes) def info(self, *args, **kwargs) -> None: # type: ignore - self.log(*args, **kwargs) + if self._log_level <= LogLevel.INFO: + self.log(*args, **kwargs) def warning(self, *args, **kwargs) -> None: # type: ignore - self.log(*args, **kwargs) + if self._log_level <= LogLevel.WARNING: + self.log(*args, **kwargs) def error(self, *args, **kwargs) -> None: # type: ignore self.log(*args, **kwargs) @@ -227,6 +251,9 @@ class TerminalLogger(AbstractLogger): def print_serial_logs(self, enable: bool) -> None: self._print_serial_logs = enable + def set_log_level(self, level: LogLevel) -> None: + self._log_level = level + def log_serial(self, message: str, machine: str) -> None: if not self._print_serial_logs: return @@ -246,6 +273,7 @@ class XMLLogger(AbstractLogger): self.queue: Queue[dict[str, str]] = Queue() self._print_serial_logs = True + self._log_level = LogLevel.INFO self.xml.startDocument() self.xml.startElement("logfile", attrs=AttributesImpl({})) @@ -269,10 +297,12 @@ class XMLLogger(AbstractLogger): self.xml.endElement("line") def info(self, *args, **kwargs) -> None: # type: ignore - self.log(*args, **kwargs) + if self._log_level <= LogLevel.INFO: + self.log(*args, **kwargs) def warning(self, *args, **kwargs) -> None: # type: ignore - self.log(*args, **kwargs) + if self._log_level <= LogLevel.WARNING: + self.log(*args, **kwargs) def error(self, *args, **kwargs) -> None: # type: ignore self.log(*args, **kwargs) @@ -287,6 +317,9 @@ class XMLLogger(AbstractLogger): def print_serial_logs(self, enable: bool) -> None: self._print_serial_logs = enable + def set_log_level(self, level: LogLevel) -> None: + self._log_level = level + def log_serial(self, message: str, machine: str) -> None: if not self._print_serial_logs: return diff --git a/nixos/lib/testing/driver.nix b/nixos/lib/testing/driver.nix index 5cd7c2ebb806..d5638718dda7 100644 --- a/nixos/lib/testing/driver.nix +++ b/nixos/lib/testing/driver.nix @@ -119,6 +119,7 @@ let --set testScript "$out/test-script" \ --set globalTimeout "${toString config.globalTimeout}" \ --set vlans '${toString vlans}' \ + --set logLevel "${config.logLevel}" \ ${lib.escapeShellArgs ( lib.concatMap (arg: [ "--add-flags" @@ -219,6 +220,17 @@ in This may speed up your iteration cycle, unless you're working on the [{option}`testScript`](#test-opt-testScript). ''; }; + + logLevel = mkOption { + description = "Log level for the test driver."; + type = types.enum [ + "info" + "warning" + "error" + ]; + default = "info"; + example = "warning"; + }; }; config = { From 7272b6ad4d631566ae1cfba328e881e6e092441e Mon Sep 17 00:00:00 2001 From: Guillaume Girol Date: Sat, 21 Mar 2026 12:00:00 +0000 Subject: [PATCH 6/7] canokey-qemu: 0-unstable-2023-06-06 -> 0-unstable-2026-03-24 --- doc/release-notes/rl-2605.section.md | 2 + nixos/tests/systemd-initrd-luks-fido2.nix | 13 +++-- .../ca/canokey-qemu/canokey-qemu-memcpy.patch | 41 -------------- pkgs/by-name/ca/canokey-qemu/package.nix | 53 +++++++++++++------ 4 files changed, 46 insertions(+), 63 deletions(-) delete mode 100644 pkgs/by-name/ca/canokey-qemu/canokey-qemu-memcpy.patch diff --git a/doc/release-notes/rl-2605.section.md b/doc/release-notes/rl-2605.section.md index 9d3bb68f5c06..c59d72f7da45 100644 --- a/doc/release-notes/rl-2605.section.md +++ b/doc/release-notes/rl-2605.section.md @@ -337,6 +337,8 @@ gnuradioMinimal.override { - The `neovim` package and module now disable by default the `python3` and `ruby` providers, unused by most users and reducing closure size from 365MiB to 240MiB. Host provider executables are not exposed anymore along with the neovim wrapper. You can still refer to those using the neovim provider variables (e.g., `python3_host_prog`). +- `canokey-qemu` support for `qemu` was restored (although disabled by default), after being marked as broken since nixpkgs 25.11. Please note that the format of canokey files has changed, and that some data created with older canokey-qemu release cannot be read by the current version. See the [documentation](https://github.com/canokeys/canokey-qemu/tree/v1?tab=readme-ov-file#compatibility-warning) for details. + ### Deprecations {#sec-nixpkgs-release-26.05-lib-deprecations} - `mpv-unwrapped.scripts` and `mpv-unwrapped.wrapper` have been removed. Please use `mpvScripts` and `mpv.override` accordingly. diff --git a/nixos/tests/systemd-initrd-luks-fido2.nix b/nixos/tests/systemd-initrd-luks-fido2.nix index 002281585064..a38c97e8b0dd 100644 --- a/nixos/tests/systemd-initrd-luks-fido2.nix +++ b/nixos/tests/systemd-initrd-luks-fido2.nix @@ -1,11 +1,13 @@ -{ lib, pkgs, ... }: +{ + lib, + pkgs, + hostPkgs, + ... +}: { name = "systemd-initrd-luks-fido2"; - meta = { - # `canokey-qemu` is marked broken. - broken = true; - }; + qemu.package = hostPkgs.qemu_test.override { canokeySupport = true; }; nodes.machine = { pkgs, config, ... }: @@ -22,6 +24,7 @@ "-device canokey,bus=usb-bus.0,file=/tmp/canokey-file" ]; }; + boot.loader.systemd-boot.enable = true; boot.initrd.systemd.enable = true; diff --git a/pkgs/by-name/ca/canokey-qemu/canokey-qemu-memcpy.patch b/pkgs/by-name/ca/canokey-qemu/canokey-qemu-memcpy.patch deleted file mode 100644 index 578c687f54cf..000000000000 --- a/pkgs/by-name/ca/canokey-qemu/canokey-qemu-memcpy.patch +++ /dev/null @@ -1,41 +0,0 @@ -From 9e59480d941c40b868ebafa5138bbc71ca87f08e Mon Sep 17 00:00:00 2001 -From: Alyssa Ross -Date: Sat, 18 May 2024 09:55:17 +0200 -Subject: [PATCH] Fix build where memcpy is a macro - -I got the following compiler error with Clang 16 building for -x86_64-apple-darwin: - - /tmp/nix-build-canokey-qemu-0-unstable-2023-06-06.drv-0/source/canokey-core/applets/oath/oath.c:44:50: error: too many arguments provided to function-like macro invocation - memcpy(RDATA, (uint8_t[]){OATH_TAG_VERSION, 3, 0x05, 0x05, 0x05, OATH_TAG_NAME, HANDLE_LEN}, 7); - ^ - /nix/store/vw8y07yai2pjv02s1piw3r5cyhmjbddf-Libsystem-1238.60.2/include/secure/_string.h:64:9: note: macro 'memcpy' defined here - #define memcpy(dest, src, len) \ - ^ - /tmp/nix-build-canokey-qemu-0-unstable-2023-06-06.drv-0/source/canokey-core/applets/oath/oath.c:44:3: note: parentheses are required around macro argument containing braced initializer list - memcpy(RDATA, (uint8_t[]){OATH_TAG_VERSION, 3, 0x05, 0x05, 0x05, OATH_TAG_NAME, HANDLE_LEN}, 7); - ^ - ( ) - 1 error generated. - -Link: https://github.com/canokeys/canokey-core/pull/85 ---- - canokey-core/applets/oath/oath.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/canokey-core/applets/oath/oath.c b/canokey-core/applets/oath/oath.c -index bd8361a..2d2c0ef 100644 ---- a/canokey-core/applets/oath/oath.c -+++ b/canokey-core/applets/oath/oath.c -@@ -41,7 +41,7 @@ int oath_install(uint8_t reset) { - static int oath_select(const CAPDU *capdu, RAPDU *rapdu) { - if (P2 != 0x00) EXCEPT(SW_WRONG_P1P2); - -- memcpy(RDATA, (uint8_t[]){OATH_TAG_VERSION, 3, 0x05, 0x05, 0x05, OATH_TAG_NAME, HANDLE_LEN}, 7); -+ memcpy(RDATA, ((uint8_t[]){OATH_TAG_VERSION, 3, 0x05, 0x05, 0x05, OATH_TAG_NAME, HANDLE_LEN}), 7); - if (read_attr(OATH_FILE, ATTR_HANDLE, RDATA + 7, HANDLE_LEN) < 0) return -1; - LL = 7 + HANDLE_LEN; - --- -2.44.0 - diff --git a/pkgs/by-name/ca/canokey-qemu/package.nix b/pkgs/by-name/ca/canokey-qemu/package.nix index be8235b8dda4..78030234fc0c 100644 --- a/pkgs/by-name/ca/canokey-qemu/package.nix +++ b/pkgs/by-name/ca/canokey-qemu/package.nix @@ -3,29 +3,30 @@ stdenv, fetchFromGitHub, cmake, + python3Packages, unstableGitUpdater, }: stdenv.mkDerivation rec { pname = "canokey-qemu"; - version = "0-unstable-2023-06-06"; - rev = "151568c34f5e92b086b7a3a62a11c43dd39f628b"; + version = "0-unstable-2026-03-24"; + rev = "41044ec17ddb835b3e5acb385a2e429aa74af627"; src = fetchFromGitHub { owner = "canokeys"; repo = "canokey-qemu"; inherit rev; fetchSubmodules = true; - hash = "sha256-4V/2UOgGWgL+tFJO/k90bCDjWSVyIpxw3nYi9NU/OxA="; + hash = "sha256-eunhMRp3HJ80kCCZbiMGNjA9b0uUMzOsSeNh61d1iJU="; }; - patches = [ - ./canokey-qemu-memcpy.patch - ]; - postPatch = '' substituteInPlace canokey-core/CMakeLists.txt \ - --replace "COMMAND git describe --always --tags --long --abbrev=8 --dirty >>" "COMMAND echo '$rev' >>" - ''; + --replace-fail "git describe --always --tags --long --abbrev=8 --dirty >>" "echo '$rev' >>" + '' + + (lib.optionalString stdenv.hostPlatform.isStatic '' + substituteInPlace CMakeLists.txt \ + --replace-fail "add_library(canokey-qemu SHARED" "add_library(canokey-qemu STATIC" + ''); preConfigure = '' cmakeFlagsArray+=( @@ -38,6 +39,24 @@ stdenv.mkDerivation rec { ++ lib.optionals stdenv.cc.isClang [ "-Wno-error=documentation" ] + ++ lib.optionals stdenv.cc.isGNU [ + # canokey-qemu contains a vendored copy of mbedtls, and + # mbedtls widely uses a pattern of starting unions with an + # unsigned int dummy member, and then initializing those unions to + # { 0 }. The problem with this is that it only initializes that + # first union member, so in the common case where the non-dummy + # members are larger than the dummy member, they will only be + # partially initialized since GCC 15[1]. Upstream has added + # ad-hoc memset calls to mitigate this issue, but initializers are + # also still widely used. To avoid the risk of using + # uninitialized memory, force the compiler to zero all bits of + # unions, not just the first element, until upstream has a + # systemic fix in place[2]. + # + # [1]: https://gcc.gnu.org/gcc-15/changes.html + # [2]: https://github.com/Mbed-TLS/mbedtls/issues/9885 + "-fzero-init-padding-bits=unions" + ] ) } ) @@ -48,19 +67,19 @@ stdenv.mkDerivation rec { "dev" ]; - nativeBuildInputs = [ cmake ]; + nativeBuildInputs = [ + cmake + python3Packages.jsonschema + python3Packages.jinja2 + ]; passthru.updateScript = unstableGitUpdater { }; meta = { homepage = "https://github.com/canokeys/canokey-qemu"; - description = "CanoKey QEMU Virt Card"; + description = "CanoKey QEMU Virtual Card"; + longDescription = "A virtual OPENPGP and FIDO2 card. Only for testing purpose. There is no warranty on security."; license = lib.licenses.asl20; - maintainers = with lib.maintainers; [ oxalica ]; - # Uses a four‐year‐old patched vendored version of Mbed TLS for - # cryptography that doesn’t build with CMake 4. Doesn’t build with - # gurrent versions of `canokey-core`, either. No upstream - # development since 2023. - broken = true; + maintainers = with lib.maintainers; [ symphorien ]; }; } From 1d16486166a9eb27aefc7739b9c3c615bfa1345d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= Date: Tue, 14 Apr 2026 10:30:14 +0200 Subject: [PATCH 7/7] Revert "nixos/test-driver: use log levels" This reverts commit 149201a7e37c197bc090723af5c016f4f596c735. I don't get what needs to done to fix redirects in the NixOS manual, so let's unblock by reverting for now. --- .../test-driver/src/test_driver/__init__.py | 13 ------ .../lib/test-driver/src/test_driver/logger.py | 45 +++---------------- nixos/lib/testing/driver.nix | 12 ----- 3 files changed, 6 insertions(+), 64 deletions(-) diff --git a/nixos/lib/test-driver/src/test_driver/__init__.py b/nixos/lib/test-driver/src/test_driver/__init__.py index da527f46b824..0f42f2842c77 100644 --- a/nixos/lib/test-driver/src/test_driver/__init__.py +++ b/nixos/lib/test-driver/src/test_driver/__init__.py @@ -12,7 +12,6 @@ from test_driver.driver import Driver from test_driver.logger import ( CompositeLogger, JunitXMLLogger, - LogLevel, TerminalLogger, XMLLogger, ) @@ -152,15 +151,6 @@ def main() -> None: help="indicates that the interactive SSH backdoor is active and dumps information about it on start", type=int, ) - log_level_map = {level.name.lower(): level for level in LogLevel} - arg_parser.add_argument( - "--log-level", - metavar="LOG_LEVEL", - action=EnvDefault, - envvar="logLevel", - choices=log_level_map, - help="Set the log level", - ) args = arg_parser.parse_args() @@ -179,9 +169,6 @@ def main() -> None: if args.junit_xml: logger.add_logger(JunitXMLLogger(output_directory / args.junit_xml)) - if args.log_level: - logger.set_log_level(log_level_map[args.log_level]) - if not args.keep_machine_state: logger.info( "Machine state will be reset. To keep it, pass --keep-machine-state" diff --git a/nixos/lib/test-driver/src/test_driver/logger.py b/nixos/lib/test-driver/src/test_driver/logger.py index 3c2cb41d33b1..a218d234fe3f 100644 --- a/nixos/lib/test-driver/src/test_driver/logger.py +++ b/nixos/lib/test-driver/src/test_driver/logger.py @@ -7,7 +7,6 @@ import unicodedata from abc import ABC, abstractmethod from collections.abc import Iterator from contextlib import ExitStack, contextmanager -from enum import IntEnum from pathlib import Path from queue import Empty, Queue from typing import Any @@ -18,12 +17,6 @@ from colorama import Fore, Style from junit_xml import TestCase, TestSuite -class LogLevel(IntEnum): - INFO = 1 - WARNING = 2 - ERROR = 3 - - class AbstractLogger(ABC): @abstractmethod def log(self, message: str, attributes: dict[str, str] = {}) -> None: @@ -63,10 +56,6 @@ class AbstractLogger(ABC): def print_serial_logs(self, enable: bool) -> None: pass - @abstractmethod - def set_log_level(self, level: LogLevel) -> None: - pass - class JunitXMLLogger(AbstractLogger): class TestCaseState: @@ -82,7 +71,6 @@ class JunitXMLLogger(AbstractLogger): self.currentSubtest = "main" self.outfile: Path = outfile self._print_serial_logs = True - self._log_level = LogLevel.INFO atexit.register(self.close) def log(self, message: str, attributes: dict[str, str] = {}) -> None: @@ -104,12 +92,10 @@ class JunitXMLLogger(AbstractLogger): yield def info(self, *args, **kwargs) -> None: # type: ignore - if self._log_level <= LogLevel.INFO: - self.tests[self.currentSubtest].stdout += args[0] + os.linesep + self.tests[self.currentSubtest].stdout += args[0] + os.linesep def warning(self, *args, **kwargs) -> None: # type: ignore - if self._log_level <= LogLevel.WARNING: - self.tests[self.currentSubtest].stdout += args[0] + os.linesep + self.tests[self.currentSubtest].stdout += args[0] + os.linesep def error(self, *args, **kwargs) -> None: # type: ignore self.tests[self.currentSubtest].stderr += args[0] + os.linesep @@ -127,9 +113,6 @@ class JunitXMLLogger(AbstractLogger): def print_serial_logs(self, enable: bool) -> None: self._print_serial_logs = enable - def set_log_level(self, level: LogLevel) -> None: - self._log_level = level - def close(self) -> None: with open(self.outfile, "w") as f: test_cases = [] @@ -197,15 +180,10 @@ class CompositeLogger(AbstractLogger): for logger in self.logger_list: logger.log_serial(message, machine) - def set_log_level(self, level: LogLevel) -> None: - for logger in self.logger_list: - logger.set_log_level(level) - class TerminalLogger(AbstractLogger): def __init__(self) -> None: self._print_serial_logs = True - self._log_level = LogLevel.INFO def maybe_prefix(self, message: str, attributes: dict[str, str]) -> str: if "machine" in attributes: @@ -238,12 +216,10 @@ class TerminalLogger(AbstractLogger): self.log(f"(finished: {message}, in {toc - tic:.2f} seconds)", attributes) def info(self, *args, **kwargs) -> None: # type: ignore - if self._log_level <= LogLevel.INFO: - self.log(*args, **kwargs) + self.log(*args, **kwargs) def warning(self, *args, **kwargs) -> None: # type: ignore - if self._log_level <= LogLevel.WARNING: - self.log(*args, **kwargs) + self.log(*args, **kwargs) def error(self, *args, **kwargs) -> None: # type: ignore self.log(*args, **kwargs) @@ -251,9 +227,6 @@ class TerminalLogger(AbstractLogger): def print_serial_logs(self, enable: bool) -> None: self._print_serial_logs = enable - def set_log_level(self, level: LogLevel) -> None: - self._log_level = level - def log_serial(self, message: str, machine: str) -> None: if not self._print_serial_logs: return @@ -273,7 +246,6 @@ class XMLLogger(AbstractLogger): self.queue: Queue[dict[str, str]] = Queue() self._print_serial_logs = True - self._log_level = LogLevel.INFO self.xml.startDocument() self.xml.startElement("logfile", attrs=AttributesImpl({})) @@ -297,12 +269,10 @@ class XMLLogger(AbstractLogger): self.xml.endElement("line") def info(self, *args, **kwargs) -> None: # type: ignore - if self._log_level <= LogLevel.INFO: - self.log(*args, **kwargs) + self.log(*args, **kwargs) def warning(self, *args, **kwargs) -> None: # type: ignore - if self._log_level <= LogLevel.WARNING: - self.log(*args, **kwargs) + self.log(*args, **kwargs) def error(self, *args, **kwargs) -> None: # type: ignore self.log(*args, **kwargs) @@ -317,9 +287,6 @@ class XMLLogger(AbstractLogger): def print_serial_logs(self, enable: bool) -> None: self._print_serial_logs = enable - def set_log_level(self, level: LogLevel) -> None: - self._log_level = level - def log_serial(self, message: str, machine: str) -> None: if not self._print_serial_logs: return diff --git a/nixos/lib/testing/driver.nix b/nixos/lib/testing/driver.nix index d5638718dda7..5cd7c2ebb806 100644 --- a/nixos/lib/testing/driver.nix +++ b/nixos/lib/testing/driver.nix @@ -119,7 +119,6 @@ let --set testScript "$out/test-script" \ --set globalTimeout "${toString config.globalTimeout}" \ --set vlans '${toString vlans}' \ - --set logLevel "${config.logLevel}" \ ${lib.escapeShellArgs ( lib.concatMap (arg: [ "--add-flags" @@ -220,17 +219,6 @@ in This may speed up your iteration cycle, unless you're working on the [{option}`testScript`](#test-opt-testScript). ''; }; - - logLevel = mkOption { - description = "Log level for the test driver."; - type = types.enum [ - "info" - "warning" - "error" - ]; - default = "info"; - example = "warning"; - }; }; config = {