diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix index 22a4310eee23..0ee545962645 100644 --- a/maintainers/maintainer-list.nix +++ b/maintainers/maintainer-list.nix @@ -11528,6 +11528,12 @@ githubId = 2770647; name = "Simon Vandel Sillesen"; }; + sir4ur0n = { + email = "sir4ur0n@users.noreply.github.com"; + github = "sir4ur0n"; + githubId = 1204125; + name = "sir4ur0n"; + }; siraben = { email = "bensiraphob@gmail.com"; matrix = "@siraben:matrix.org"; diff --git a/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml b/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml index ceb9ca53716e..f3c6588033fc 100644 --- a/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml +++ b/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml @@ -1785,6 +1785,15 @@ should now be used instead. + + + security.pam.ussh has been added, which + allows authorizing PAM sessions based on SSH + certificates held within an SSH agent, + using + pam-ussh. + + The zrepl package has been updated from diff --git a/nixos/doc/manual/release-notes/rl-2205.section.md b/nixos/doc/manual/release-notes/rl-2205.section.md index ff628d007250..023dcc9f9120 100644 --- a/nixos/doc/manual/release-notes/rl-2205.section.md +++ b/nixos/doc/manual/release-notes/rl-2205.section.md @@ -613,6 +613,8 @@ In addition to numerous new and upgraded packages, this release has the followin and [services.logrotate.extraConfig](#opt-services.logrotate.extraConfig) will work, but issue deprecation warnings and [services.logrotate.settings](#opt-services.logrotate.settings) should now be used instead. +- `security.pam.ussh` has been added, which allows authorizing PAM sessions based on SSH _certificates_ held within an SSH agent, using [pam-ussh](https://github.com/uber/pam-ussh). + - The `zrepl` package has been updated from 0.4.0 to 0.5: - The RPC protocol version was bumped; all zrepl daemons in a setup must be updated and restarted before replication can resume. diff --git a/nixos/modules/security/pam.nix b/nixos/modules/security/pam.nix index 141e1ee9c2c8..530304b497ae 100644 --- a/nixos/modules/security/pam.nix +++ b/nixos/modules/security/pam.nix @@ -61,6 +61,19 @@ let ''; }; + usshAuth = mkOption { + default = false; + type = types.bool; + description = '' + If set, users with an SSH certificate containing an authorized principal + in their SSH agent are able to log in. Specific options are controlled + using the options. + + Note that the must also be + set for this option to take effect. + ''; + }; + yubicoAuth = mkOption { default = config.security.pam.yubico.enable; defaultText = literalExpression "config.security.pam.yubico.enable"; @@ -475,6 +488,9 @@ let optionalString cfg.usbAuth '' auth sufficient ${pkgs.pam_usb}/lib/security/pam_usb.so '' + + (let ussh = config.security.pam.ussh; in optionalString (config.security.pam.ussh.enable && cfg.usshAuth) '' + auth ${ussh.control} ${pkgs.pam_ussh}/lib/security/pam_ussh.so ${optionalString (ussh.caFile != null) "ca_file=${ussh.caFile}"} ${optionalString (ussh.authorizedPrincipals != null) "authorized_principals=${ussh.authorizedPrincipals}"} ${optionalString (ussh.authorizedPrincipalsFile != null) "authorized_principals_file=${ussh.authorizedPrincipalsFile}"} ${optionalString (ussh.group != null) "group=${ussh.group}"} + '') + (let oath = config.security.pam.oath; in optionalString cfg.oathAuth '' auth requisite ${pkgs.oathToolkit}/lib/security/pam_oath.so window=${toString oath.window} usersfile=${toString oath.usersFile} digits=${toString oath.digits} '') + @@ -927,6 +943,96 @@ in }; }; + security.pam.ussh = { + enable = mkOption { + default = false; + type = types.bool; + description = '' + Enables Uber's USSH PAM (pam-ussh) module. + + This is similar to pam-ssh-agent, except that + the presence of a CA-signed SSH key with a valid principal is checked + instead. + + Note that this module must both be enabled using this option and on a + per-PAM-service level as well (using usshAuth). + + More information can be found here. + ''; + }; + + caFile = mkOption { + default = null; + type = with types; nullOr path; + description = '' + By default pam-ussh reads the trusted user CA keys + from /etc/ssh/trusted_user_ca. + + This should be set the same as your TrustedUserCAKeys + option for sshd. + ''; + }; + + authorizedPrincipals = mkOption { + default = null; + type = with types; nullOr commas; + description = '' + Comma-separated list of authorized principals to permit; if the user + presents a certificate with one of these principals, then they will be + authorized. + + Note that pam-ussh also requires that the certificate + contain a principal matching the user's username. The principals from + this list are in addition to those principals. + + Mutually exclusive with authorizedPrincipalsFile. + ''; + }; + + authorizedPrincipalsFile = mkOption { + default = null; + type = with types; nullOr path; + description = '' + Path to a list of principals; if the user presents a certificate with + one of these principals, then they will be authorized. + + Note that pam-ussh also requires that the certificate + contain a principal matching the user's username. The principals from + this file are in addition to those principals. + + Mutually exclusive with authorizedPrincipals. + ''; + }; + + group = mkOption { + default = null; + type = with types; nullOr str; + description = '' + If set, then the authenticating user must be a member of this group + to use this module. + ''; + }; + + control = mkOption { + default = "sufficient"; + type = types.enum [ "required" "requisite" "sufficient" "optional" ]; + description = '' + This option sets pam "control". + If you want to have multi factor authentication, use "required". + If you want to use the SSH certificate instead of the regular password, + use "sufficient". + + Read + + pam.conf + 5 + + for better understanding of this option. + ''; + }; + }; + security.pam.yubico = { enable = mkOption { default = false; @@ -1111,6 +1217,9 @@ in optionalString (isEnabled (cfg: cfg.usbAuth)) '' mr ${pkgs.pam_usb}/lib/security/pam_usb.so, '' + + optionalString (isEnabled (cfg: cfg.usshAuth)) '' + mr ${pkgs.pam_ussh}/lib/security/pam_ussh.so, + '' + optionalString (isEnabled (cfg: cfg.oathAuth)) '' "mr ${pkgs.oathToolkit}/lib/security/pam_oath.so, '' + diff --git a/nixos/modules/security/sudo.nix b/nixos/modules/security/sudo.nix index 99e578f8adae..4bf239fca8f9 100644 --- a/nixos/modules/security/sudo.nix +++ b/nixos/modules/security/sudo.nix @@ -245,7 +245,7 @@ in environment.systemPackages = [ sudo ]; - security.pam.services.sudo = { sshAgentAuth = true; }; + security.pam.services.sudo = { sshAgentAuth = true; usshAuth = true; }; environment.etc.sudoers = { source = diff --git a/nixos/modules/system/boot/networkd.nix b/nixos/modules/system/boot/networkd.nix index 1e9f870b32fb..d1a6f46bfc40 100644 --- a/nixos/modules/system/boot/networkd.nix +++ b/nixos/modules/system/boot/networkd.nix @@ -10,6 +10,36 @@ let check = { + global = { + sectionNetwork = checkUnitConfig "Network" [ + (assertOnlyFields [ + "SpeedMeter" + "SpeedMeterIntervalSec" + "ManageForeignRoutingPolicyRules" + "ManageForeignRoutes" + "RouteTable" + ]) + (assertValueOneOf "SpeedMeter" boolValues) + (assertInt "SpeedMeterIntervalSec") + (assertValueOneOf "ManageForeignRoutingPolicyRules" boolValues) + (assertValueOneOf "ManageForeignRoutes" boolValues) + ]; + + sectionDHCPv4 = checkUnitConfig "DHCPv4" [ + (assertOnlyFields [ + "DUIDType" + "DUIDRawData" + ]) + ]; + + sectionDHCPv6 = checkUnitConfig "DHCPv6" [ + (assertOnlyFields [ + "DUIDType" + "DUIDRawData" + ]) + ]; + }; + link = { sectionLink = checkUnitConfig "Link" [ @@ -871,6 +901,44 @@ let }; }; + networkdOptions = { + networkConfig = mkOption { + default = {}; + example = { SpeedMeter = true; ManageForeignRoutingPolicyRules = false; }; + type = types.addCheck (types.attrsOf unitOption) check.global.sectionNetwork; + description = '' + Each attribute in this set specifies an option in the + [Network] section of the networkd config. + See networkd.conf + 5 for details. + ''; + }; + + dhcpV4Config = mkOption { + default = {}; + example = { DUIDType = "vendor"; }; + type = types.addCheck (types.attrsOf unitOption) check.global.sectionDHCPv4; + description = '' + Each attribute in this set specifies an option in the + [DHCPv4] section of the networkd config. + See networkd.conf + 5 for details. + ''; + }; + + dhcpV6Config = mkOption { + default = {}; + example = { DUIDType = "vendor"; }; + type = types.addCheck (types.attrsOf unitOption) check.global.sectionDHCPv6; + description = '' + Each attribute in this set specifies an option in the + [DHCPv6] section of the networkd config. + See networkd.conf + 5 for details. + ''; + }; + }; + linkOptions = commonNetworkOptions // { # overwrite enable option from above enable = mkOption { @@ -1519,6 +1587,39 @@ let }; }; + networkdConfig = { config, ... }: { + options = { + routeTables = mkOption { + default = {}; + example = { foo = 27; }; + type = with types; attrsOf int; + description = '' + Defines route table names as an attrset of name to number. + See networkd.conf + 5 for details. + ''; + }; + + addRouteTablesToIPRoute2 = mkOption { + default = true; + example = false; + type = types.bool; + description = '' + If true and routeTables are set, then the specified route tables + will also be installed into /etc/iproute2/rt_tables. + ''; + }; + }; + + config = { + networkConfig = optionalAttrs (config.routeTables != { }) { + RouteTable = mapAttrsToList + (name: number: "${name}:${toString number}") + config.routeTables; + }; + }; + }; + commonMatchText = def: optionalString (def.matchConfig != { }) '' [Match] ${attrsToSection def.matchConfig} @@ -1600,6 +1701,20 @@ let + def.extraConfig; }; + renderConfig = def: + { text = '' + [Network] + ${attrsToSection def.networkConfig} + '' + + optionalString (def.dhcpV4Config != { }) '' + [DHCPv4] + ${attrsToSection def.dhcpV4Config} + '' + + optionalString (def.dhcpV6Config != { }) '' + [DHCPv6] + ${attrsToSection def.dhcpV6Config} + ''; }; + networkToUnit = name: def: { inherit (def) enable; text = commonMatchText def @@ -1732,6 +1847,12 @@ in description = "Definition of systemd networks."; }; + systemd.network.config = mkOption { + default = {}; + type = with types; submodule [ { options = networkdOptions; } networkdConfig ]; + description = "Definition of global systemd network config."; + }; + systemd.network.units = mkOption { description = "Definition of networkd units."; default = {}; @@ -1823,7 +1944,9 @@ in systemd.services.systemd-networkd = { wantedBy = [ "multi-user.target" ]; aliases = [ "dbus-org.freedesktop.network1.service" ]; - restartTriggers = map (x: x.source) (attrValues unitFiles); + restartTriggers = map (x: x.source) (attrValues unitFiles) ++ [ + config.environment.etc."systemd/networkd.conf".source + ]; }; systemd.services.systemd-networkd-wait-online = { @@ -1846,6 +1969,17 @@ in }; }; + environment.etc."systemd/networkd.conf" = renderConfig cfg.config; + + networking.iproute2 = mkIf (cfg.config.addRouteTablesToIPRoute2 && cfg.config.routeTables != { }) { + enable = mkDefault true; + rttablesExtraConfig = '' + + # Extra tables defined in NixOS systemd.networkd.config.routeTables. + ${concatStringsSep "\n" (mapAttrsToList (name: number: "${toString number} ${name}") cfg.config.routeTables)} + ''; + }; + services.resolved.enable = mkDefault true; }) ]; diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix index d9429920f13b..b427933cb20a 100644 --- a/nixos/tests/all-tests.nix +++ b/nixos/tests/all-tests.nix @@ -398,6 +398,7 @@ in pam-file-contents = handleTest ./pam/pam-file-contents.nix {}; pam-oath-login = handleTest ./pam/pam-oath-login.nix {}; pam-u2f = handleTest ./pam/pam-u2f.nix {}; + pam-ussh = handleTest ./pam/pam-ussh.nix {}; pantalaimon = handleTest ./matrix/pantalaimon.nix {}; pantheon = handleTest ./pantheon.nix {}; paperless-ng = handleTest ./paperless-ng.nix {}; diff --git a/nixos/tests/pam/pam-ussh.nix b/nixos/tests/pam/pam-ussh.nix new file mode 100644 index 000000000000..ba0570dbf97d --- /dev/null +++ b/nixos/tests/pam/pam-ussh.nix @@ -0,0 +1,70 @@ +import ../make-test-python.nix ({ pkgs, lib, ... }: + +let + testOnlySSHCredentials = pkgs.runCommand "pam-ussh-test-ca" { + nativeBuildInputs = [ pkgs.openssh ]; + } '' + mkdir $out + ssh-keygen -t ed25519 -N "" -f $out/ca + + ssh-keygen -t ed25519 -N "" -f $out/alice + ssh-keygen -s $out/ca -I "alice user key" -n "alice,root" -V 19700101:forever $out/alice.pub + + ssh-keygen -t ed25519 -N "" -f $out/bob + ssh-keygen -s $out/ca -I "bob user key" -n "bob" -V 19700101:forever $out/bob.pub + ''; + makeTestScript = user: pkgs.writeShellScript "pam-ussh-${user}-test-script" '' + set -euo pipefail + + eval $(${pkgs.openssh}/bin/ssh-agent) + + mkdir -p $HOME/.ssh + chmod 700 $HOME/.ssh + cp ${testOnlySSHCredentials}/${user}{,.pub,-cert.pub} $HOME/.ssh + chmod 600 $HOME/.ssh/${user} + chmod 644 $HOME/.ssh/${user}{,-cert}.pub + + set -x + + ${pkgs.openssh}/bin/ssh-add $HOME/.ssh/${user} + ${pkgs.openssh}/bin/ssh-add -l &>2 + + exec sudo id -u -n + ''; +in { + name = "pam-ussh"; + meta.maintainers = with lib.maintainers; [ lukegb ]; + + machine = + { ... }: + { + users.users.alice = { isNormalUser = true; extraGroups = [ "wheel" ]; }; + users.users.bob = { isNormalUser = true; extraGroups = [ "wheel" ]; }; + + security.pam.ussh = { + enable = true; + authorizedPrincipals = "root"; + caFile = "${testOnlySSHCredentials}/ca.pub"; + }; + + security.sudo = { + enable = true; + extraConfig = '' + Defaults lecture="never" + ''; + }; + }; + + testScript = + '' + with subtest("alice should be allowed to escalate to root"): + machine.succeed( + 'su -c "${makeTestScript "alice"}" -l alice | grep root' + ) + + with subtest("bob should not be allowed to escalate to root"): + machine.fail( + 'su -c "${makeTestScript "bob"}" -l bob | grep root' + ) + ''; +}) diff --git a/nixos/tests/systemd-networkd.nix b/nixos/tests/systemd-networkd.nix index 7faeae3704ec..6c423f4140b1 100644 --- a/nixos/tests/systemd-networkd.nix +++ b/nixos/tests/systemd-networkd.nix @@ -8,6 +8,9 @@ let generateNodeConf = { lib, pkgs, config, privk, pubk, peerId, nodeId, ...}: { environment.systemPackages = with pkgs; [ wireguard-tools ]; systemd.network = { enable = true; + config = { + routeTables.custom = 23; + }; netdevs = { "90-wg0" = { netdevConfig = { Kind = "wireguard"; Name = "wg0"; }; @@ -39,6 +42,7 @@ let generateNodeConf = { lib, pkgs, config, privk, pubk, peerId, nodeId, ...}: { address = [ "10.0.0.${nodeId}/32" ]; routes = [ { routeConfig = { Gateway = "10.0.0.${nodeId}"; Destination = "10.0.0.0/24"; }; } + { routeConfig = { Gateway = "10.0.0.${nodeId}"; Destination = "10.0.0.0/24"; Table = "custom"; }; } ]; }; "30-eth1" = { @@ -87,6 +91,12 @@ testScript = '' node1.wait_for_unit("systemd-networkd-wait-online.service") node2.wait_for_unit("systemd-networkd-wait-online.service") + # ================================ + # Networkd Config + # ================================ + node1.succeed("grep RouteTable=custom:23 /etc/systemd/networkd.conf") + node1.succeed("sudo ip route show table custom | grep '10.0.0.0/24 via 10.0.0.1 dev wg0 proto static'") + # ================================ # Wireguard # ================================ diff --git a/pkgs/applications/networking/cluster/argocd-autopilot/default.nix b/pkgs/applications/networking/cluster/argocd-autopilot/default.nix index 58f5dfed8518..4bc1d2d1c20c 100644 --- a/pkgs/applications/networking/cluster/argocd-autopilot/default.nix +++ b/pkgs/applications/networking/cluster/argocd-autopilot/default.nix @@ -2,16 +2,16 @@ buildGoModule rec { pname = "argocd-autopilot"; - version = "0.3.1"; + version = "0.3.2"; src = fetchFromGitHub { owner = "argoproj-labs"; repo = "argocd-autopilot"; rev = "v${version}"; - sha256 = "sha256-L8+sb0lGPuc6smOFwijRGFS+oSCxEqB5c1tG55MPlgE="; + sha256 = "sha256-9si2zqYhmAqzhdUWMkfQ/yLeyNcZSAWypvZTbDDrPvA="; }; - vendorSha256 = "sha256-sxPTOao3scTmiVKFyGeWPMzXQz/d0HSVmUYocNGm1vA="; + vendorSha256 = "sha256-UfZCGG24JjPoc5nbX9vPeFCP8YGMNF5oUrdwTC6RpKI="; proxyVendor = true; diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json index 0df988b9f98a..f78fd4fc20b9 100644 --- a/pkgs/applications/networking/cluster/terraform-providers/providers.json +++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json @@ -40,10 +40,10 @@ "owner": "aliyun", "provider-source-address": "registry.terraform.io/aliyun/alicloud", "repo": "terraform-provider-alicloud", - "rev": "v1.162.0", - "sha256": "sha256-xqZv15Tst+7o9HhNu6/bW+a4z7FTkra+MfS8jKrfeNs=", - "vendorSha256": "sha256-RbOf/S0rkbhW0s+/YOqu+BQuE0V4aS2x36Xf+hgBkqY=", - "version": "1.162.0" + "rev": "v1.163.0", + "sha256": "sha256-lSg8jAzQfRc++U6zAhkfbVf/+hIW/1Nov35o6M8mRrw=", + "vendorSha256": "sha256-8dAk23ISxYuYKj5s0W6g93RBW1++NuZEPva5MaNBSyw=", + "version": "1.163.0" }, "ansible": { "owner": "nbering", @@ -76,10 +76,10 @@ "owner": "vmware", "provider-source-address": "registry.terraform.io/vmware/avi", "repo": "terraform-provider-avi", - "rev": "v21.1.3", - "sha256": "160l9864p73283hc27qaabd3lrh7lm8fyh6k9xlal5isfd9vrm5p", - "vendorSha256": "1hw1xp20nhs4p1q9l887m82456fg5977pm66165gdkczwrq2zr6v", - "version": "21.1.3" + "rev": "v21.1.4", + "sha256": "sha256-6H56TRA3I0CQ9/d8JdP5JNL0u3lpS8YhCvdSM5bxYp8=", + "vendorSha256": "sha256-b0MwGmgugZdmVk7ZVBSCivDQ4n+tLABymH/igo/S1Wc=", + "version": "21.1.4" }, "aviatrix": { "owner": "AviatrixSystems", @@ -148,10 +148,10 @@ "owner": "DrFaust92", "provider-source-address": "registry.terraform.io/DrFaust92/bitbucket", "repo": "terraform-provider-bitbucket", - "rev": "v2.13.1", - "sha256": "sha256-P/6scAuRMRrACHmEdWjn+W37ptVmVgtj+iTXQDrG+WM=", - "vendorSha256": "sha256-o1CZ4VuGCPALqSIz8KSm1zCwd3r9bR13CRvP7XpVBAM=", - "version": "2.13.1" + "rev": "v2.14.0", + "sha256": "sha256-tF1Q55mxwPU6dziiNzdacNtHvemd9ciQHE2E6een1WY=", + "vendorSha256": "sha256-L8QYz1xgw8ZQjrU33uP18XxNUjImPYATZ02h46G4aXs=", + "version": "2.14.0" }, "brightbox": { "owner": "brightbox", @@ -194,10 +194,10 @@ "owner": "cloudflare", "provider-source-address": "registry.terraform.io/cloudflare/cloudflare", "repo": "terraform-provider-cloudflare", - "rev": "v3.12.0", - "sha256": "sha256-y2qq0asEnhnOjthLBFxyQjf1N5KNlXXK0eXjT1/vCXg=", + "rev": "v3.12.1", + "sha256": "sha256-8l6+hyjW+N3N5OGj/cviH97EFqouSrnJULk/SXrYCTk=", "vendorSha256": "sha256-v6fUzYwrYt4rk5LT0LyNd8e9X79r3dwtd3s1QIV/w/s=", - "version": "3.12.0" + "version": "3.12.1" }, "cloudfoundry": { "owner": "cloudfoundry-community", @@ -754,10 +754,10 @@ "owner": "vmware", "provider-source-address": "registry.terraform.io/vmware/nsxt", "repo": "terraform-provider-nsxt", - "rev": "v3.2.5", - "sha256": "0j5kspfmqxdnvk3sfb476rckkn9fdgpw5haf495901a114wynr2l", + "rev": "v3.2.6", + "sha256": "sha256-1uQMjzqMJ1NQVVCXy5aHrrZ4vDK5s1JqUnLyYf1qLVw=", "vendorSha256": null, - "version": "3.2.5" + "version": "3.2.6" }, "null": { "owner": "hashicorp", @@ -791,10 +791,10 @@ "owner": "okta", "provider-source-address": "registry.terraform.io/okta/okta", "repo": "terraform-provider-okta", - "rev": "v3.22.1", - "sha256": "sha256-G1KJJSxJmzFlIUWOs+7htcgp61oWCu+ryCKaIHzxhzw=", - "vendorSha256": "sha256-n7ih8QtapA+xno1twlM2b2XGEesdJdJIPD+QWpmJDVA=", - "version": "3.22.1" + "rev": "v3.23.0", + "sha256": "sha256-azqWTQA4FW79U+GrdCBO4BWA5c+Cce3ELANS2Os5bSs=", + "vendorSha256": "sha256-S4HVfl/PbgpgWFedkWM+EGyYAL5P0cdkLMYL+y+aX8w=", + "version": "3.23.0" }, "oktaasa": { "owner": "oktadeveloper", diff --git a/pkgs/development/compilers/gcc/10/default.nix b/pkgs/development/compilers/gcc/10/default.nix index d00d428a6950..1e8917ef6cf1 100644 --- a/pkgs/development/compilers/gcc/10/default.nix +++ b/pkgs/development/compilers/gcc/10/default.nix @@ -71,7 +71,12 @@ let majorVersion = "10"; # Obtain latest patch with ../update-mcfgthread-patches.sh ++ optional (!crossStageStatic && targetPlatform.isMinGW) ./Added-mcf-thread-model-support-from-mcfgthread.patch - ++ [ ../libsanitizer-no-cyclades.patch ]; + ++ [ ../libsanitizer-no-cyclades.patch ] + + ++ optional (buildPlatform.system == "aarch64-darwin" && targetPlatform != buildPlatform) (fetchpatch { + url = "https://raw.githubusercontent.com/richard-vd/musl-cross-make/5e9e87f06fc3220e102c29d3413fbbffa456fcd6/patches/gcc-${version}/0008-darwin-aarch64-self-host-driver.patch"; + sha256 = "sha256-XtykrPd5h/tsnjY1wGjzSOJ+AyyNLsfnjuOZ5Ryq9vA="; + }); /* Cross-gcc settings (build == host != target) */ crossMingw = targetPlatform != hostPlatform && targetPlatform.libc == "msvcrt"; diff --git a/pkgs/development/libraries/boost/generic.nix b/pkgs/development/libraries/boost/generic.nix index c0fce3ae5760..17698216b8d9 100644 --- a/pkgs/development/libraries/boost/generic.nix +++ b/pkgs/development/libraries/boost/generic.nix @@ -68,7 +68,7 @@ let else "$NIX_BUILD_CORES"; - needUserConfig = stdenv.hostPlatform != stdenv.buildPlatform || useMpi || stdenv.isDarwin; + needUserConfig = stdenv.hostPlatform != stdenv.buildPlatform || useMpi || (stdenv.isDarwin && enableShared); b2Args = concatStringsSep " " ([ "--includedir=$dev/include" diff --git a/pkgs/development/libraries/bullet/default.nix b/pkgs/development/libraries/bullet/default.nix index 6a33d2ce2043..e37da386cd6d 100644 --- a/pkgs/development/libraries/bullet/default.nix +++ b/pkgs/development/libraries/bullet/default.nix @@ -11,13 +11,13 @@ stdenv.mkDerivation rec { pname = "bullet"; - version = "3.22a"; + version = "3.22b"; src = fetchFromGitHub { owner = "bulletphysics"; repo = "bullet3"; rev = version; - sha256 = "sha256-Ng+kg720y69aE0FgTnD60F05zwUX/LzLlImnrODzOuo="; + sha256 = "sha256-hf2b7enh9mziPKFcdU8NwLdhcxhV7Ididf9Bwwa+5/M="; }; nativeBuildInputs = [ cmake ]; diff --git a/pkgs/development/python-modules/apache-beam/default.nix b/pkgs/development/python-modules/apache-beam/default.nix index b8d1a94eeff0..8d774410ca35 100644 --- a/pkgs/development/python-modules/apache-beam/default.nix +++ b/pkgs/development/python-modules/apache-beam/default.nix @@ -25,8 +25,6 @@ , pydot , pyhamcrest , pymongo -, pytest-timeout -, pytest-xdist , pytestCheckHook , python , pythonAtLeast @@ -43,26 +41,21 @@ buildPythonPackage rec { pname = "apache-beam"; - version = "2.36.0"; + version = "2.37.0"; disabled = pythonAtLeast "3.10"; src = fetchFromGitHub { owner = "apache"; repo = "beam"; rev = "v${version}"; - sha256 = "sha256-f+ICbKSwNjkhrTCCZwxbmqZlQ1+dQSTRag1IflWsqYg="; + sha256 = "sha256-FmfTxRLqXUHhhAZIxCRx2+phX0bmU5rIHaftBU4yBJY="; }; - patches = [ - ./relax-deps.patch - # Fixes https://issues.apache.org/jira/browse/BEAM-9324 - ./fix-cython.patch - ]; - # See https://github.com/NixOS/nixpkgs/issues/156957. postPatch = '' substituteInPlace setup.py \ - --replace "typing-extensions>=3.7.0,<4" "typing-extensions" \ + --replace "dill>=0.3.1.1,<0.3.2" "dill" \ + --replace "httplib2>=0.8,<0.20.0" "httplib2" \ --replace "pyarrow>=0.15.1,<7.0.0" "pyarrow" ''; @@ -109,8 +102,6 @@ buildPythonPackage rec { parameterized psycopg2 pyhamcrest - pytest-timeout - pytest-xdist pytestCheckHook pyyaml requests-mock @@ -123,6 +114,18 @@ buildPythonPackage rec { preCheck = "cd $out/lib/${python.libPrefix}/site-packages"; disabledTestPaths = [ + # Fails with + # _______ ERROR collecting apache_beam/io/external/xlang_jdbcio_it_test.py _______ + # apache_beam/io/external/xlang_jdbcio_it_test.py:80: in + # class CrossLanguageJdbcIOTest(unittest.TestCase): + # apache_beam/io/external/xlang_jdbcio_it_test.py:99: in CrossLanguageJdbcIOTest + # container_init: Callable[[], Union[PostgresContainer, MySqlContainer]], + # E NameError: name 'MySqlContainer' is not defined + # + # Test relies on the testcontainers package, which is not currently (as of + # 2022-04-08) available in nixpkgs. + "apache_beam/io/external/xlang_jdbcio_it_test.py" + # These tests depend on the availability of specific servers backends. "apache_beam/runners/portability/flink_runner_test.py" "apache_beam/runners/portability/samza_runner_test.py" @@ -136,12 +139,6 @@ buildPythonPackage rec { # quite elaborate testing infra with containers and multiple # different runners - I don't expect them to help debugging these # when running via our (= custom from their PoV) testing infra. - "testBuildListUnpack" - "testBuildTupleUnpack" - "testBuildTupleUnpackWithCall" - "test_convert_bare_types" - "test_incomparable_default" - "test_pardo_type_inference" "test_with_main_session" ]; diff --git a/pkgs/development/python-modules/apache-beam/fix-cython.patch b/pkgs/development/python-modules/apache-beam/fix-cython.patch deleted file mode 100644 index f73d75b4b84a..000000000000 --- a/pkgs/development/python-modules/apache-beam/fix-cython.patch +++ /dev/null @@ -1,41 +0,0 @@ -diff --git a/apache_beam/runners/worker/operations.py b/apache_beam/runners/worker/operations.py -index 3464c5750c..5921c72b90 100644 ---- a/apache_beam/runners/worker/operations.py -+++ b/apache_beam/runners/worker/operations.py -@@ -69,18 +69,6 @@ if TYPE_CHECKING: - from apache_beam.runners.worker.statesampler import StateSampler - from apache_beam.transforms.userstate import TimerSpec - --# Allow some "pure mode" declarations. --try: -- import cython --except ImportError: -- -- class FakeCython(object): -- @staticmethod -- def cast(type, value): -- return value -- -- globals()['cython'] = FakeCython() -- - _globally_windowed_value = GlobalWindows.windowed_value(None) - _global_window_type = type(_globally_windowed_value.windows[0]) - -@@ -149,7 +137,7 @@ class ConsumerSet(Receiver): - # type: (WindowedValue) -> None - self.update_counters_start(windowed_value) - for consumer in self.consumers: -- cython.cast(Operation, consumer).process(windowed_value) -+ consumer.process(windowed_value) - self.update_counters_finish() - - def try_split(self, fraction_of_remainder): -@@ -345,7 +333,7 @@ class Operation(object): - - def output(self, windowed_value, output_index=0): - # type: (WindowedValue, int) -> None -- cython.cast(Receiver, self.receivers[output_index]).receive(windowed_value) -+ self.receivers[output_index].receive(windowed_value) - - def add_receiver(self, operation, output_index=0): - # type: (Operation, int) -> None diff --git a/pkgs/development/python-modules/apache-beam/relax-deps.patch b/pkgs/development/python-modules/apache-beam/relax-deps.patch deleted file mode 100644 index 67bd38f5e7cc..000000000000 --- a/pkgs/development/python-modules/apache-beam/relax-deps.patch +++ /dev/null @@ -1,20 +0,0 @@ -diff --git a/setup.py b/setup.py -index 9429459622..2727b3becb 100644 ---- a/setup.py -+++ b/setup.py -@@ -136,12 +136,12 @@ REQUIRED_PACKAGES = [ - # version of dill. It is best to use the same version of dill on client and - # server, therefore list of allowed versions is very narrow. - # See: https://github.com/uqfoundation/dill/issues/341. -- 'dill>=0.3.1.1,<0.3.2', -+ 'dill>=0.3.1.1', - 'fastavro>=0.21.4,<2', - 'grpcio>=1.29.0,<2', - 'hdfs>=2.1.0,<3.0.0', -- 'httplib2>=0.8,<0.20.0', -- 'numpy>=1.14.3,<1.21.0', -+ 'httplib2>=0.8', -+ 'numpy>=1.14.3', - 'pymongo>=3.8.0,<4.0.0', - 'oauth2client>=2.0.1,<5', - 'protobuf>=3.12.2,<4', diff --git a/pkgs/os-specific/linux/pam_ussh/default.nix b/pkgs/os-specific/linux/pam_ussh/default.nix new file mode 100644 index 000000000000..889c8bc6f57c --- /dev/null +++ b/pkgs/os-specific/linux/pam_ussh/default.nix @@ -0,0 +1,67 @@ +{ buildGoModule +, fetchFromGitHub +, pam +, lib +, nixosTests +}: + +buildGoModule rec { + pname = "pam_ussh"; + version = "unstable-20210615"; + + src = fetchFromGitHub { + owner = "uber"; + repo = "pam-ussh"; + rev = "e9524bda90ba19d3b9eb24f49cb63a6a56a19193"; # HEAD as of 2022-03-13 + sha256 = "0nb9hpqbghgi3zvq41kabydzyc6ffaaw9b4jkc5jrwn1klpw1xk8"; + }; + + prePatch = '' + cp ${./go.mod} go.mod + ''; + overrideModAttrs = (_: { + inherit prePatch; + }); + + vendorSha256 = "0hjifc3kbwmx7kjn858vi05cwwra6q19cqjfd94k726pwhk37qkw"; + + buildInputs = [ + pam + ]; + + buildPhase = '' + runHook preBuild + + if [ -z "$enableParallelBuilding" ]; then + export NIX_BUILD_CORES=1 + fi + go build -buildmode=c-shared -o pam_ussh.so -v -p $NIX_BUILD_CORES . + + runHook postBuild + ''; + checkPhase = '' + runHook preCheck + + go test -v -p $NIX_BUILD_CORES . + + runHook postCheck + ''; + installPhase = '' + runHook preInstall + + mkdir -p $out/lib/security + cp pam_ussh.so $out/lib/security + + runHook postInstall + ''; + + passthru.tests = { inherit (nixosTests) pam-ussh; }; + + meta = with lib; { + homepage = "https://github.com/uber/pam-ussh"; + description = "PAM module to authenticate using SSH certificates"; + license = licenses.mit; + platforms = platforms.linux; + maintainers = with maintainers; [ lukegb ]; + }; +} diff --git a/pkgs/os-specific/linux/pam_ussh/go.mod b/pkgs/os-specific/linux/pam_ussh/go.mod new file mode 100644 index 000000000000..9adc453560a4 --- /dev/null +++ b/pkgs/os-specific/linux/pam_ussh/go.mod @@ -0,0 +1,15 @@ +module github.com/uber/pam-ussh + +go 1.17 + +require ( + github.com/stretchr/testify v1.7.0 + golang.org/x/crypto v0.0.0-20220313003712-b769efc7c000 +) + +require ( + github.com/davecgh/go-spew v1.1.0 // indirect + github.com/pmezard/go-difflib v1.0.0 // indirect + golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1 // indirect + gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c // indirect +) diff --git a/pkgs/servers/misc/oven-media-engine/default.nix b/pkgs/servers/misc/oven-media-engine/default.nix index 4760b2b7ccb5..655da606ef06 100644 --- a/pkgs/servers/misc/oven-media-engine/default.nix +++ b/pkgs/servers/misc/oven-media-engine/default.nix @@ -18,13 +18,13 @@ stdenv.mkDerivation rec { pname = "oven-media-engine"; - version = "0.13.1"; + version = "0.13.2"; src = fetchFromGitHub { owner = "AirenSoft"; repo = "OvenMediaEngine"; rev = "v${version}"; - sha256 = "sha256-oWZ+o19bNR7/QuYTquRa3l7GfRLMEdyPtBUOwb2p3jA="; + sha256 = "0lkpidx4r890mcdk9m69j4iahm7qr7w34h11w1nmi132v0rqm0h8"; }; sourceRoot = "source/src"; diff --git a/pkgs/tools/audio/abcmidi/default.nix b/pkgs/tools/audio/abcmidi/default.nix index 17f4d8848481..88fc66602459 100644 --- a/pkgs/tools/audio/abcmidi/default.nix +++ b/pkgs/tools/audio/abcmidi/default.nix @@ -2,11 +2,11 @@ stdenv.mkDerivation rec { pname = "abcMIDI"; - version = "2022.02.21"; + version = "2022.03.20"; src = fetchzip { url = "https://ifdo.ca/~seymour/runabc/${pname}-${version}.zip"; - hash = "sha256-oGGtJhVugqTvXD34Q2f8L5qoYoyyT5JjuBhqh4VYAAo="; + hash = "sha256-4PN4XL9Jx+vcT2QCA6GwomIqP7lRXkyBkRz641tephw="; }; meta = with lib; { diff --git a/pkgs/tools/misc/chezmoi/default.nix b/pkgs/tools/misc/chezmoi/default.nix index 35e3032f6131..00d0ef3361f8 100644 --- a/pkgs/tools/misc/chezmoi/default.nix +++ b/pkgs/tools/misc/chezmoi/default.nix @@ -2,13 +2,13 @@ buildGoModule rec { pname = "chezmoi"; - version = "2.15.0"; + version = "2.15.1"; src = fetchFromGitHub { owner = "twpayne"; repo = "chezmoi"; rev = "v${version}"; - sha256 = "sha256-P4ELrDcN6kIpIsKgZJppJv+y+ofnEz7McmGvCijnfQA="; + sha256 = "sha256-spIdY28ZC/+6bwWWwKW7Iu2E2eKD7MeRuxEAMN2e3H8="; }; vendorSha256 = "sha256-D27a107gjHK4NYkJhZDd0SvhUmmRSl3DX519nglAoPo="; diff --git a/pkgs/tools/nix/alejandra/default.nix b/pkgs/tools/nix/alejandra/default.nix index 15d232dbfbba..43b6200972dd 100644 --- a/pkgs/tools/nix/alejandra/default.nix +++ b/pkgs/tools/nix/alejandra/default.nix @@ -7,16 +7,16 @@ rustPlatform.buildRustPackage rec { pname = "alejandra"; - version = "1.1.0"; + version = "1.2.0"; src = fetchFromGitHub { owner = "kamadorueda"; repo = "alejandra"; rev = version; - sha256 = "sha256-vkFKYnSmhPPXtc3AH7iRtqRRqxhj0o5WySqPT+klDWU="; + sha256 = "sha256-35hEJuMvRswOPKb9lbB9ZuHVe0eJN6WJc4T8Frn0hYQ="; }; - cargoSha256 = "sha256-MsXaanznE4UtZMj54EDq86aJ2t4xT8O5ziTpa/KCwBw="; + cargoSha256 = "sha256-SsIpggbRQPjpCYgCG4sSJ022MmMV4bJJ8UAHcJR74O8="; passthru.tests = { version = testVersion { package = alejandra; }; diff --git a/pkgs/tools/security/exploitdb/default.nix b/pkgs/tools/security/exploitdb/default.nix index cfb1490e3c7f..2a39c61121a0 100644 --- a/pkgs/tools/security/exploitdb/default.nix +++ b/pkgs/tools/security/exploitdb/default.nix @@ -2,13 +2,13 @@ stdenv.mkDerivation rec { pname = "exploitdb"; - version = "2022-03-31"; + version = "2022-04-08"; src = fetchFromGitHub { owner = "offensive-security"; repo = pname; rev = version; - sha256 = "sha256-T7vPDbB330Uv276+oGnEYK1xGpJCMzzZiQXx4uW1kc4="; + sha256 = "sha256-yZ/4ULiNekedF0wUwowq5wcen52NbIsbSzINhKuStzo="; }; nativeBuildInputs = [ makeWrapper ]; diff --git a/pkgs/tools/text/difftastic/default.nix b/pkgs/tools/text/difftastic/default.nix index 17c1a33d8c89..1bc18749c652 100644 --- a/pkgs/tools/text/difftastic/default.nix +++ b/pkgs/tools/text/difftastic/default.nix @@ -2,16 +2,16 @@ rustPlatform.buildRustPackage rec { pname = "difftastic"; - version = "0.25.0"; + version = "0.26.0"; src = fetchFromGitHub { owner = "wilfred"; repo = pname; rev = version; - sha256 = "sha256-TJMMy1fMwqUMVhztMOlN4yQhW5IF36yahOhDTJ9kadA="; + sha256 = "sha256-bluiRWueb9+UG+8jCwm+Xc483dSvoxwu+HP02I0DZBs="; }; - cargoSha256 = "sha256-crH2SodT+Wy3auk3uli253rIrHyKsibQcYGtpxwbJJQ="; + cargoSha256 = "sha256-nVYPvYt3Sr1VxoXiaFhpiAh+vngklsr6vn1jfBUg4C4="; meta = with lib; { description = "A syntax-aware diff"; diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index 7f596c047184..4b1c304c5d11 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -23106,6 +23106,8 @@ with pkgs; pam_usb = callPackage ../os-specific/linux/pam_usb { }; + pam_ussh = callPackage ../os-specific/linux/pam_ussh { }; + paxctl = callPackage ../os-specific/linux/paxctl { }; paxtest = callPackage ../os-specific/linux/paxtest { };