diff --git a/pkgs/by-name/cu/curl-impersonate/chrome/default.nix b/pkgs/by-name/cu/curl-impersonate/chrome/default.nix deleted file mode 100644 index 06807d44aba7..000000000000 --- a/pkgs/by-name/cu/curl-impersonate/chrome/default.nix +++ /dev/null @@ -1,205 +0,0 @@ -{ - lib, - stdenv, - fetchFromGitHub, - callPackage, - buildGoModule, - installShellFiles, - buildPackages, - zlib, - zstd, - sqlite, - cmake, - python3, - ninja, - perl, - pkg-config, - autoconf, - automake, - libtool, - cctools, - cacert, - unzip, - go, - p11-kit, -}: -stdenv.mkDerivation rec { - pname = "curl-impersonate-chrome"; - version = "1.2.0"; - - outputs = [ - "out" - "dev" - ]; - - src = fetchFromGitHub { - owner = "lexiforest"; - repo = "curl-impersonate"; - tag = "v${version}"; - hash = "sha256-tAQdTRGAOD2rpLZvoLQ2YL0wrohXEcmChMZBvYjsMhE="; - }; - - # Disable blanket -Werror to fix build on `gcc-13` related to minor - # warnings on `boringssl`. - env.NIX_CFLAGS_COMPILE = "-Wno-error"; - - strictDeps = true; - - depsBuildBuild = lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [ - buildPackages.stdenv.cc - ]; - - nativeBuildInputs = - lib.optionals stdenv.hostPlatform.isDarwin [ - # Must come first so that it shadows the 'libtool' command but leaves 'libtoolize' - cctools - ] - ++ [ - installShellFiles - cmake - python3 - python3.pythonOnBuildForHost.pkgs.gyp - ninja - perl - pkg-config - autoconf - automake - libtool - unzip - go - ]; - - buildInputs = [ - zlib - zstd - sqlite - ]; - - configureFlags = [ - "--with-ca-bundle=${ - if stdenv.hostPlatform.isDarwin then "/etc/ssl/cert.pem" else "/etc/ssl/certs/ca-certificates.crt" - }" - "--with-ca-path=${cacert}/etc/ssl/certs" - ]; - - buildFlags = [ "build" ]; - checkTarget = "checkbuild"; - installTargets = [ "install" ]; - - doCheck = true; - - dontUseCmakeConfigure = true; - dontUseNinjaBuild = true; - dontUseNinjaInstall = true; - dontUseNinjaCheck = true; - - postUnpack = - lib.concatStringsSep "\n" ( - lib.mapAttrsToList (name: dep: "ln -sT ${dep.outPath} ${src.name}/${name}") ( - lib.filterAttrs (n: v: v ? outPath) passthru.deps - ) - ) - + '' - - curltar=$(realpath -s ${src.name}/curl-*.tar.gz) - - pushd "$(mktemp -d)" - - tar -xf "$curltar" - - pushd curl-curl-*/ - patchShebangs scripts - popd - - rm "$curltar" - tar -czf "$curltar" . - - popd - ''; - - postPatch = '' - substituteInPlace Makefile.in \ - --replace-fail "-lc++" "-lstdc++" - ''; - - preConfigure = '' - export GOCACHE=$TMPDIR/go-cache - export GOPATH=$TMPDIR/go - export GOPROXY=file://${passthru.boringssl-go-modules} - export GOSUMDB=off - - # Need to get value of $out for this flag - configureFlagsArray+=("--with-libnssckbi=$out/lib") - ''; - - postInstall = '' - # Remove vestigial *-config script - rm $out/bin/curl-impersonate-config - - # Patch all shebangs of installed scripts - patchShebangs $out/bin - - # Install headers - make -C curl-*/include install - '' - + lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) '' - # Patch completion names - substituteInPlace curl-*/scripts/Makefile \ - --replace-fail "_curl" "_curl-impersonate" \ - --replace-fail "curl.fish" "curl-impersonate.fish" - - # Install completions - make -C curl-*/scripts install - ''; - - preFixup = - let - libext = stdenv.hostPlatform.extensions.sharedLibrary; - in - '' - # If libnssckbi.so is needed, link libnssckbi.so without needing nss in closure - if grep -F nssckbi $out/lib/libcurl-impersonate${libext} &>/dev/null; then - ln -s ${p11-kit}/lib/pkcs11/p11-kit-trust${libext} $out/lib/libnssckbi${libext} - ${lib.optionalString stdenv.hostPlatform.isElf '' - patchelf --add-needed libnssckbi${libext} $out/lib/libcurl-impersonate${libext} - ''} - fi - ''; - - disallowedReferences = [ go ]; - - passthru = { - deps = callPackage ./deps.nix { }; - - updateScript = ./update.sh; - - # Find the correct boringssl source file - boringssl-source = builtins.head ( - lib.attrValues (lib.filterAttrs (name: _: lib.strings.hasPrefix "boringssl-" name) passthru.deps) - ); - boringssl-go-modules = - (buildGoModule { - inherit (passthru.boringssl-source) name; - - src = passthru.boringssl-source; - vendorHash = "sha256-HepiJhj7OsV7iQHlM2yi5BITyAM04QqWRX28Rj7sRKk="; - - nativeBuildInputs = [ unzip ]; - - proxyVendor = true; - }).goModules; - }; - - meta = { - changelog = "https://github.com/lexiforest/curl-impersonate/releases/tag/${src.tag}"; - description = "Special build of curl that can impersonate Chrome & Firefox"; - homepage = "https://github.com/lexiforest/curl-impersonate"; - license = with lib.licenses; [ - curl - mit - ]; - maintainers = with lib.maintainers; [ ggg ]; - platforms = lib.platforms.unix; - mainProgram = "curl-impersonate"; - }; -} diff --git a/pkgs/by-name/cu/curl-impersonate/chrome/deps.nix b/pkgs/by-name/cu/curl-impersonate/deps.nix similarity index 100% rename from pkgs/by-name/cu/curl-impersonate/chrome/deps.nix rename to pkgs/by-name/cu/curl-impersonate/deps.nix diff --git a/pkgs/by-name/cu/curl-impersonate/firefox/curl-impersonate-0.6.1-fix-command-paths.patch b/pkgs/by-name/cu/curl-impersonate/firefox/curl-impersonate-0.6.1-fix-command-paths.patch deleted file mode 100644 index 04ae8e93595f..000000000000 --- a/pkgs/by-name/cu/curl-impersonate/firefox/curl-impersonate-0.6.1-fix-command-paths.patch +++ /dev/null @@ -1,13 +0,0 @@ -diff --git a/Makefile.in b/Makefile.in -index 877c54f..3e39ed1 100644 ---- a/Makefile.in -+++ b/Makefile.in -@@ -209,6 +209,8 @@ $(NSS_VERSION).tar.gz: - - $(nss_static_libs): $(NSS_VERSION).tar.gz - tar xf $(NSS_VERSION).tar.gz -+ sed -i -e "1s@#!/usr/bin/env bash@#!$$(type -p bash)@" $(NSS_VERSION)/nss/build.sh -+ sed -i -e "s@/usr/bin/\(env \)\?grep@$$(type -p grep)@" $(NSS_VERSION)/nss/coreconf/config.gypi - - ifeq ($(host),$(build)) - # Native build, use NSS' build script. diff --git a/pkgs/by-name/cu/curl-impersonate/firefox/default.nix b/pkgs/by-name/cu/curl-impersonate/firefox/default.nix deleted file mode 100644 index afce85222f53..000000000000 --- a/pkgs/by-name/cu/curl-impersonate/firefox/default.nix +++ /dev/null @@ -1,197 +0,0 @@ -{ - lib, - stdenv, - fetchFromGitHub, - fetchpatch, - callPackage, - buildGoModule, - installShellFiles, - buildPackages, - zlib, - sqlite, - cmake, - python3, - ninja, - perl, - autoconf, - automake, - libtool, - cctools, - cacert, - unzip, - go, - p11-kit, -}: -stdenv.mkDerivation rec { - pname = "curl-impersonate-ff"; - version = "0.6.1"; - - outputs = [ - "out" - "dev" - ]; - - src = fetchFromGitHub { - owner = "lwthiker"; - repo = "curl-impersonate"; - rev = "v${version}"; - hash = "sha256-ExmEhjJC8FPzx08RuKOhRxKgJ4Dh+ElEl+OUHzRCzZc="; - }; - - patches = [ - # Fix shebangs and commands in the NSS build scripts - # (can't just patchShebangs or substituteInPlace since makefile unpacks it) - ./curl-impersonate-0.6.1-fix-command-paths.patch - - # SOCKS5 heap buffer overflow - https://curl.se/docs/CVE-2023-38545.html - (fetchpatch { - name = "curl-impersonate-patch-cve-2023-38545.patch"; - url = "https://github.com/lwthiker/curl-impersonate/commit/e7b90a0d9c61b6954aca27d346750240e8b6644e.diff"; - hash = "sha256-jFrz4Q+MJGfNmwwzHhThado4c9hTd/+b/bfRsr3FW5k="; - }) - ]; - - # Disable blanket -Werror to fix build on `gcc-13` related to minor - # warnings on `boringssl`. - env.NIX_CFLAGS_COMPILE = "-Wno-error"; - - strictDeps = true; - - depsBuildBuild = lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [ - buildPackages.stdenv.cc - ]; - - nativeBuildInputs = - lib.optionals stdenv.hostPlatform.isDarwin [ - # Must come first so that it shadows the 'libtool' command but leaves 'libtoolize' - cctools - ] - ++ [ - installShellFiles - cmake - python3 - python3.pythonOnBuildForHost.pkgs.gyp - ninja - perl - autoconf - automake - libtool - unzip - go - ]; - - buildInputs = [ - zlib - sqlite - ]; - - configureFlags = [ - "--with-ca-bundle=${ - if stdenv.hostPlatform.isDarwin then "/etc/ssl/cert.pem" else "/etc/ssl/certs/ca-certificates.crt" - }" - "--with-ca-path=${cacert}/etc/ssl/certs" - ]; - - buildFlags = [ "firefox-build" ]; - checkTarget = "firefox-checkbuild"; - installTargets = [ "firefox-install" ]; - - doCheck = true; - - dontUseCmakeConfigure = true; - dontUseNinjaBuild = true; - dontUseNinjaInstall = true; - dontUseNinjaCheck = true; - - postUnpack = lib.concatStringsSep "\n" ( - lib.mapAttrsToList (name: dep: "ln -sT ${dep.outPath} ${src.name}/${name}") ( - lib.filterAttrs (n: v: v ? outPath) passthru.deps - ) - ); - - preConfigure = '' - export GOCACHE=$TMPDIR/go-cache - export GOPATH=$TMPDIR/go - export GOPROXY=file://${passthru.boringssl-go-modules} - export GOSUMDB=off - - # Need to get value of $out for this flag - configureFlagsArray+=("--with-libnssckbi=$out/lib") - ''; - - postInstall = '' - # Remove vestigial *-config script - rm $out/bin/curl-impersonate-ff-config - - # Patch all shebangs of installed scripts - patchShebangs $out/bin - - # Install headers - make -C curl-*/include install - '' - + lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) '' - # Build and install completions for each curl binary - - # Patch in correct binary name and alias it to all scripts - perl curl-*/scripts/completion.pl --curl $out/bin/curl-impersonate-ff --shell zsh >$TMPDIR/curl-impersonate-ff.zsh - substituteInPlace $TMPDIR/curl-impersonate-ff.zsh \ - --replace-fail \ - '#compdef curl' \ - "#compdef curl-impersonate-ff$(find $out/bin -name 'curl_*' -printf ' %f=curl-impersonate-ff')" - - perl curl-*/scripts/completion.pl --curl $out/bin/curl-impersonate-ff --shell fish >$TMPDIR/curl-impersonate-ff.fish - substituteInPlace $TMPDIR/curl-impersonate-ff.fish \ - --replace-fail \ - '--command curl' \ - "--command curl-impersonate-ff$(find $out/bin -name 'curl_*' -printf ' --command %f')" - - # Install zsh and fish completions - installShellCompletion $TMPDIR/curl-impersonate-ff.{zsh,fish} - ''; - - preFixup = - let - libext = stdenv.hostPlatform.extensions.sharedLibrary; - in - '' - # If libnssckbi.so is needed, link libnssckbi.so without needing nss in closure - if grep -F nssckbi $out/lib/libcurl-impersonate-*${libext} &>/dev/null; then - ln -s ${p11-kit}/lib/pkcs11/p11-kit-trust${libext} $out/lib/libnssckbi${libext} - ${lib.optionalString stdenv.hostPlatform.isElf '' - patchelf --add-needed libnssckbi${libext} $out/lib/libcurl-impersonate-*${libext} - ''} - fi - ''; - - disallowedReferences = [ go ]; - - passthru = { - deps = callPackage ./deps.nix { }; - - updateScript = ./update.sh; - - boringssl-go-modules = - (buildGoModule { - inherit (passthru.deps."boringssl.zip") name; - - src = passthru.deps."boringssl.zip"; - vendorHash = "sha256-SNUsBiKOGWmkRdTVABVrlbLAVMfu0Q9IgDe+kFC5vXs="; - - nativeBuildInputs = [ unzip ]; - - proxyVendor = true; - }).goModules; - }; - - meta = { - description = "Special build of curl that can impersonate Chrome & Firefox"; - homepage = "https://github.com/lwthiker/curl-impersonate"; - license = with lib.licenses; [ - curl - mit - ]; - maintainers = with lib.maintainers; [ deliciouslytyped ]; - platforms = lib.platforms.unix; - mainProgram = "curl-impersonate-ff"; - }; -} diff --git a/pkgs/by-name/cu/curl-impersonate/firefox/deps.nix b/pkgs/by-name/cu/curl-impersonate/firefox/deps.nix deleted file mode 100644 index b8a70b935302..000000000000 --- a/pkgs/by-name/cu/curl-impersonate/firefox/deps.nix +++ /dev/null @@ -1,28 +0,0 @@ -# Generated by update.sh -{ fetchurl }: -{ - "curl-8.1.1.tar.xz" = fetchurl { - url = "https://curl.se/download/curl-8.1.1.tar.xz"; - hash = "sha256-CKlI4GGSlkVZfB73GU4HswiyIIT/A/p0ALRl5sBRSeU="; - }; - - "brotli-1.0.9.tar.gz" = fetchurl { - url = "https://github.com/google/brotli/archive/refs/tags/v1.0.9.tar.gz"; - hash = "sha256-+ejYHQQFumbRgVKa9CozVPg4yTkJX/mZMNpqqc32/kY="; - }; - - "nss-3.92.tar.gz" = fetchurl { - url = "https://ftp.mozilla.org/pub/security/nss/releases/NSS_3_92_RTM/src/nss-3.92-with-nspr-4.35.tar.gz"; - hash = "sha256-IcF2v/+27IQLX5hcf48BRoL0ovtVsGkkc0Fy1cBIbcU="; - }; - - "boringssl.zip" = fetchurl { - url = "https://github.com/google/boringssl/archive/1b7fdbd9101dedc3e0aa3fcf4ff74eacddb34ecc.zip"; - hash = "sha256-daVVQvpxkuEL/8/+QtLOJkdO+ECYZE3P4qJmDjV1GM0="; - }; - - "nghttp2-1.56.0.tar.bz2" = fetchurl { - url = "https://github.com/nghttp2/nghttp2/releases/download/v1.56.0/nghttp2-1.56.0.tar.bz2"; - hash = "sha256-L13Nv1d6LfUTokZGRUhMw10uTQczZT1jGTrlHbQd70E="; - }; -} diff --git a/pkgs/by-name/cu/curl-impersonate/firefox/update.sh b/pkgs/by-name/cu/curl-impersonate/firefox/update.sh deleted file mode 100644 index 3202ed1c9057..000000000000 --- a/pkgs/by-name/cu/curl-impersonate/firefox/update.sh +++ /dev/null @@ -1,92 +0,0 @@ -#!/usr/bin/env nix-shell -#!nix-shell -i bash -p git nix jq coreutils gnugrep gnused curl common-updater-scripts -# shellcheck shell=bash -set -euo pipefail - -nixpkgs="$(git rev-parse --show-toplevel || (printf 'Could not find root of nixpkgs repo\nAre we running from within the nixpkgs git repo?\n' >&2; exit 1))" - -stripwhitespace() { - sed -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//' -} - -narhash() { - nix --extra-experimental-features nix-command store prefetch-file --json "$1" | jq -r .hash -} - -nixeval() { - nix --extra-experimental-features nix-command eval --json --impure -f "$nixpkgs" "$1" | jq -r . -} - -vendorhash() { - (nix --extra-experimental-features nix-command build --no-link -f "$nixpkgs" --no-link "$1" 2>&1 >/dev/null | tail -n3 | grep -F got: | cut -d: -f2- | stripwhitespace) 2>/dev/null || true -} - -findpath() { - path="$(nix --extra-experimental-features nix-command eval --json --impure -f "$nixpkgs" "$1.meta.position" | jq -r . | cut -d: -f1)" - outpath="$(nix --extra-experimental-features nix-command eval --json --impure --expr "fetchGit \"$nixpkgs\"")" - - if [ -n "$outpath" ]; then - path="${path/$(echo "$outpath" | jq -r .)/$nixpkgs}" - fi - - echo "$path" -} - -getvar() { - echo "$2" | grep -F "$1" | sed -e 's/:=/:/g' | cut -d: -f2- | stripwhitespace -} - -attr="${UPDATE_NIX_ATTR_PATH:-curl-impersonate}" -version="$(curl -sSL "https://api.github.com/repos/lwthiker/curl-impersonate/releases/latest" | jq -r .tag_name | sed -e 's/^v//')" - -pkgpath="$(findpath "$attr")" - -updated="$(cd "$nixpkgs" && update-source-version "$attr" "$version" --file="$pkgpath" --print-changes | jq -r length)" - -if [ "$updated" -eq 0 ]; then - echo 'update.sh: Package version not updated, nothing to do.' - exit 0 -fi - -vars="$(curl -sSL "https://github.com/lwthiker/curl-impersonate/raw/v$version/Makefile.in" | grep '^ *[^ ]*_\(VERSION\|URL\|COMMIT\) *:=')" - -cat >"$(dirname "$pkgpath")"/deps.nix </dev/null; then + ln -s ${p11-kit}/lib/pkcs11/p11-kit-trust${libext} $out/lib/libnssckbi${libext} + ${lib.optionalString stdenv.hostPlatform.isElf '' + patchelf --add-needed libnssckbi${libext} $out/lib/libcurl-impersonate${libext} + ''} + fi + ''; + + disallowedReferences = [ go ]; + + passthru = { + deps = callPackage ./deps.nix { }; + + updateScript = ./update.sh; + + # Find the correct boringssl source file + boringssl-source = builtins.head ( + lib.attrValues (lib.filterAttrs (name: _: lib.strings.hasPrefix "boringssl-" name) passthru.deps) + ); + boringssl-go-modules = + (buildGoModule { + inherit (passthru.boringssl-source) name; + + src = passthru.boringssl-source; + vendorHash = "sha256-HepiJhj7OsV7iQHlM2yi5BITyAM04QqWRX28Rj7sRKk="; + + nativeBuildInputs = [ unzip ]; + + proxyVendor = true; + }).goModules; + + inherit src; tests = { inherit (nixosTests) curl-impersonate; }; }; + + meta = { + changelog = "https://github.com/lexiforest/curl-impersonate/releases/tag/${src.tag}"; + description = "Special build of curl that can impersonate Chrome & Firefox"; + homepage = "https://github.com/lexiforest/curl-impersonate"; + license = with lib.licenses; [ + curl + mit + ]; + maintainers = with lib.maintainers; [ ggg ]; + platforms = lib.platforms.unix; + mainProgram = "curl-impersonate"; + }; } diff --git a/pkgs/by-name/cu/curl-impersonate/chrome/update.sh b/pkgs/by-name/cu/curl-impersonate/update.sh similarity index 98% rename from pkgs/by-name/cu/curl-impersonate/chrome/update.sh rename to pkgs/by-name/cu/curl-impersonate/update.sh index 429bc3700e11..0c0b9b2021b1 100755 --- a/pkgs/by-name/cu/curl-impersonate/chrome/update.sh +++ b/pkgs/by-name/cu/curl-impersonate/update.sh @@ -50,7 +50,7 @@ evalvar() { echo $out } -attr="${UPDATE_NIX_ATTR_PATH:-curl-impersonate-chrome}" +attr="${UPDATE_NIX_ATTR_PATH:-curl-impersonate}" version="$(curl -sSL "https://api.github.com/repos/lexiforest/curl-impersonate/releases/latest" | jq -r .tag_name | sed -e 's/^v//')" pkgpath="$(findpath "$attr")" diff --git a/pkgs/development/python-modules/curl-cffi/default.nix b/pkgs/development/python-modules/curl-cffi/default.nix index 05ee0ca89e60..223cfb0c1918 100644 --- a/pkgs/development/python-modules/curl-cffi/default.nix +++ b/pkgs/development/python-modules/curl-cffi/default.nix @@ -4,7 +4,7 @@ fetchFromGitHub, setuptools, addBinToPathHook, - curl-impersonate-chrome, + curl-impersonate, cffi, certifi, charset-normalizer, @@ -35,7 +35,7 @@ buildPythonPackage rec { patches = [ ./use-system-libs.patch ]; - buildInputs = [ curl-impersonate-chrome ]; + buildInputs = [ curl-impersonate ]; build-system = [ cffi diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix index 3e7e11b93aa3..227b397fb8de 100644 --- a/pkgs/top-level/aliases.nix +++ b/pkgs/top-level/aliases.nix @@ -497,6 +497,8 @@ mapAliases { cudaPackages_12_4 = throw "CUDA 12.4 has been removed from Nixpkgs, as it is unmaintained upstream and depends on unsupported compilers"; # Added 2025-08-08 cudaPackages_12_5 = throw "CUDA 12.5 has been removed from Nixpkgs, as it is unmaintained upstream and depends on unsupported compilers"; # Added 2025-08-08 cups-kyodialog3 = throw "'cups-kyodialog3' has been renamed to/replaced by 'cups-kyodialog'"; # Converted to throw 2025-10-27 + curl-impersonate-chrome = warnAlias "curl-impersonate-chrome has been renamed to curl-impersonate" curl-impersonate; # Added 2025-11-02 + curl-impersonate-ff = throw "curl-impersonate-ff has been removed because it is unmaintained upstream and has vulnerable dependencies. Use curl-impersonate instead."; # Added 2025-11-02 curlHTTP3 = warnAlias "'curlHTTP3' has been removed, as 'curl' now has HTTP/3 support enabled by default" curl; # Added 2025-08-22 cyber = throw "cyber has been removed, as it does not build with supported Zig versions"; # Added 2025-08-09 dale = throw "dale has been removed, as it does not build with supported LLVM versions"; # Added 2025-08-10 diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index 96e58242bdb8..a81eb492ecac 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -2431,9 +2431,6 @@ with pkgs; ngtcp2 = ngtcp2-gnutls; }; - curl-impersonate-ff = curl-impersonate.curl-impersonate-ff; - curl-impersonate-chrome = curl-impersonate.curl-impersonate-chrome; - cve-bin-tool = python3Packages.callPackage ../tools/security/cve-bin-tool { }; dconf2nix = callPackage ../development/tools/haskell/dconf2nix { };