gador/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge master into staging-next

Browse Source
This commit is contained in:
nixpkgs-ci[bot]
2025-11-20 18:06:34 +00:00
committed by GitHub
parent 2dc0f2f5cc 34fe0487f8
commit f7ff54e830
72 changed files with 1221 additions and 200 deletions
Download Patch File Download Diff File Expand all files Collapse all files
nixos/doc/manual/release-notes/rl-2511.section.md
+6
View File
@@ -32,6 +32,10 @@
Refer to the [GNOME release notes](https://release.gnome.org/49/) for more details.
- FirewallD support has been added. It can be configured both as a standalone service (through `services.firewalld`), and as a backend to the existing `networking.firewall` options.
- `networking.firewall` now has a `backend` option for choosing which backend to use.
## New Modules {#sec-release-25.11-new-modules}
<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
@@ -53,6 +57,8 @@
- [umami](https://github.com/umami-software/umami), a simple, fast, privacy-focused alternative to Google Analytics. Available with [services.umami](#opt-services.umami.enable).
- [FirewallD](https://firewalld.org/), a firewall daemon with D-Bus interface providing a dynamic firewall. Available as [services.firewalld](#opt-services.firewalld.enable) and a [networking.firewall.backend](#opt-networking.firewall.backend).
- [FileBrowser](https://filebrowser.org/), a web application for managing and sharing files. Available as [services.filebrowser](#opt-services.filebrowser.enable).
- Options under [networking.getaddrinfo](#opt-networking.getaddrinfo.enable) are now allowed to declaratively configure address selection and sorting behavior of `getaddrinfo` in dual-stack networks.
nixos/modules/hardware/facter/default.nix
+1
View File
@@ -7,6 +7,7 @@
imports = [
./disk.nix
./firmware.nix
./graphics
./keyboard.nix
./networking
./system.nix
nixos/modules/hardware/facter/disk.nix
+1 -1
View File
@@ -22,7 +22,7 @@ in
'';
};
config = {
config = lib.mkIf (config.hardware.facter.reportPath != null) {
boot.initrd.availableKernelModules = config.hardware.facter.detected.boot.disk.kernelModules;
};
}
nixos/modules/hardware/facter/firmware.nix
+1 -1
View File
@@ -8,7 +8,7 @@ let
hasIntelCpu = facterLib.hasIntelCpu report;
in
{
config = lib.mkIf isBaremetal {
config = lib.mkIf (config.hardware.facter.reportPath != null && isBaremetal) {
# none (e.g. bare-metal)
# provide firmware for devices that might not have been detected by nixos-facter
hardware.enableRedistributableFirmware = lib.mkDefault true;
nixos/modules/hardware/facter/graphics/amd.nix
+18
View File
@@ -0,0 +1,18 @@
{ lib, config, ... }:
let
facterLib = import ../lib.nix lib;
cfg = config.hardware.facter.detected.graphics.amd;
in
{
options.hardware.facter.detected.graphics = {
amd.enable = lib.mkEnableOption "Enable the AMD Graphics module" // {
default = builtins.elem "amdgpu" (
facterLib.collectDrivers (config.hardware.facter.report.hardware.graphics_card or [ ])
);
defaultText = "hardware dependent";
};
};
config = lib.mkIf (config.hardware.facter.reportPath != null && cfg.enable) {
services.xserver.videoDrivers = [ "modesetting" ];
};
}
nixos/modules/hardware/facter/graphics/default.nix
+42
View File
@@ -0,0 +1,42 @@
{ lib, config, ... }:
let
facterLib = import ../lib.nix lib;
cfg = config.hardware.facter.detected.graphics;
in
{
imports = [
./amd.nix
];
options.hardware.facter.detected = {
graphics.enable = lib.mkEnableOption "Enable the Graphics module" // {
default = builtins.length (config.hardware.facter.report.hardware.monitor or [ ]) > 0;
defaultText = "hardware dependent";
};
boot.graphics.kernelModules = lib.mkOption {
type = lib.types.listOf lib.types.str;
# We currently don't auto import nouveau, in case the user might want to use the proprietary nvidia driver,
# We might want to change this in future, if we have a better idea, how to handle this.
default = lib.remove "nouveau" (
lib.uniqueStrings (
facterLib.collectDrivers (config.hardware.facter.report.hardware.graphics_card or [ ])
)
);
defaultText = "hardware dependent";
description = ''
List of kernel modules to load at boot for the graphics card.
'';
};
};
config = lib.mkIf (config.hardware.facter.reportPath != null && cfg.enable) (
{
boot.initrd.kernelModules = config.hardware.facter.detected.boot.graphics.kernelModules;
}
// (
if lib.versionOlder lib.version "24.11pre" then
{ hardware.opengl.enable = lib.mkDefault true; }
else
{ hardware.graphics.enable = lib.mkDefault true; }
)
);
}
nixos/modules/hardware/facter/keyboard.nix
+1 -1
View File
@@ -15,7 +15,7 @@ in
'';
};
config = {
config = lib.mkIf (config.hardware.facter.reportPath != null) {
boot.initrd.availableKernelModules = config.hardware.facter.detected.boot.keyboard.kernelModules;
};
}
nixos/modules/hardware/facter/networking/default.nix
+7 -5
View File
@@ -60,10 +60,12 @@ in
];
};
};
config = lib.mkIf config.hardware.facter.detected.dhcp.enable {
networking.useDHCP = lib.mkDefault true;
config =
lib.mkIf (config.hardware.facter.reportPath != null && config.hardware.facter.detected.dhcp.enable)
{
networking.useDHCP = lib.mkDefault true;
# Per-interface DHCP configuration
networking.interfaces = perInterfaceConfig;
};
# Per-interface DHCP configuration
networking.interfaces = perInterfaceConfig;
};
}
nixos/modules/hardware/facter/networking/initrd.nix
+1 -1
View File
@@ -14,7 +14,7 @@ in
'';
};
config = lib.mkIf config.boot.initrd.network.enable {
config = lib.mkIf (config.hardware.facter.reportPath != null && config.boot.initrd.network.enable) {
boot.initrd.kernelModules = config.hardware.facter.detected.boot.initrd.networking.kernelModules;
};
}
nixos/modules/hardware/facter/networking/intel.nix
+1 -1
View File
@@ -49,7 +49,7 @@ in
};
};
config = {
config = lib.mkIf (config.hardware.facter.reportPath != null) {
networking.enableIntel2200BGFirmware = lib.mkIf cfg._2200BG.enable (lib.mkDefault true);
hardware.enableRedistributableFirmware = lib.mkIf cfg._3945ABG.enable (lib.mkDefault true);
};
nixos/modules/hardware/facter/system.nix
+5 -2
View File
@@ -6,9 +6,12 @@
}:
{
# Skip setting hostPlatform if it's read-only
nixpkgs =
config.nixpkgs =
lib.optionalAttrs
(config.hardware.facter.report.system or null != null && !options.nixpkgs.hostPlatform.readOnly)
(
config.hardware.facter.report.system or null != null
&& !(options.nixpkgs.hostPlatform.readOnly or false)
)
{
hostPlatform = lib.mkDefault config.hardware.facter.report.system;
};
nixos/modules/hardware/facter/virtualisation.nix
+9 -2
View File
@@ -51,13 +51,20 @@ in
};
};
config = {
config = lib.mkIf (config.hardware.facter.reportPath != null) {
# KVM support
boot.kernelModules =
let
hasCPUFeature =
feature: lib.any ({ features, ... }: lib.elem feature features) (report.hardware.cpu or [ ]);
feature:
lib.any (
{
features ? [ ],
...
}:
lib.elem feature features
) (report.hardware.cpu or [ ]);
in
lib.mkMerge [
(lib.mkIf (hasCPUFeature "vmx") [ "kvm-intel" ])
nixos/modules/module-list.nix
+2
View File
@@ -1162,9 +1162,11 @@
./services/networking/ferm.nix
./services/networking/firefox-syncserver.nix
./services/networking/fireqos.nix
./services/networking/firewall-firewalld.nix
./services/networking/firewall-iptables.nix
./services/networking/firewall-nftables.nix
./services/networking/firewall.nix
./services/networking/firewalld
./services/networking/firezone/gateway.nix
./services/networking/firezone/gui-client.nix
./services/networking/firezone/headless-client.nix
nixos/modules/services/networking/firewall-firewalld.nix
+61
View File
@@ -0,0 +1,61 @@
{ config, lib, ... }:
let
cfg = config.networking.firewall;
in
{
config = lib.mkIf (cfg.enable && cfg.backend == "firewalld") {
assertions = [
{
assertion = cfg.interfaces == { };
message = ''
Per interface configurations is not supported with the firewalld based firewall.
Create zones with `services.firewalld.zones` instead.
'';
}
];
boot.kernel.sysctl."net.ipv4.conf.all.rp_filter" =
if cfg.checkReversePath == false then
0
else if cfg.checkReversePath == "loose" then
1
else
2;
services.firewalld = {
settings = {
DefaultZone = lib.mkDefault "nixos-fw-default";
LogDenied =
if cfg.logRefusedConnections then
(if cfg.logRefusedUnicastsOnly then "unicast" else "all")
else
"off";
IPv6_rpfilter =
if cfg.checkReversePath == false then
"no"
else
let
mode = if cfg.checkReversePath == true then "strict" else cfg.checkReversePath;
suffix = if cfg.filterForward then "" else "-forward";
in
"${mode}${suffix}";
};
zones = {
nixos-fw-default = {
target = if cfg.rejectPackets then "%%REJECT%%" else "DROP";
icmpBlockInversion = true;
icmpBlocks = lib.mkIf cfg.allowPing [ "echo-request" ];
ports =
let
f = protocol: port: { inherit protocol port; };
tcpPorts = map (f "tcp") (cfg.allowedTCPPorts ++ cfg.allowedTCPPortRanges);
udpPorts = map (f "udp") (cfg.allowedUDPPorts ++ cfg.allowedUDPPortRanges);
in
tcpPorts ++ udpPorts;
};
trusted.interfaces = cfg.trustedInterfaces;
};
};
};
}
nixos/modules/services/networking/firewall-iptables.nix
+3 -7
View File
@@ -285,9 +285,7 @@ let
in
{
options = {
networking.firewall = {
extraCommands = lib.mkOption {
type = lib.types.lines;
@@ -317,13 +315,11 @@ in
'';
};
};
};
# FIXME: Maybe if `enable' is false, the firewall should still be
# built but not started by default?
config = lib.mkIf (cfg.enable && config.networking.nftables.enable == false) {
config = lib.mkIf (cfg.enable && cfg.backend == "iptables") {
assertions = [
# This is approximately "checkReversePath -> kernelHasRPFilter",
# but the checkReversePath option can include non-boolean
@@ -336,6 +332,8 @@ in
networking.firewall.checkReversePath = lib.mkIf (!kernelHasRPFilter) (lib.mkDefault false);
environment.systemPackages = [ pkgs.nixos-firewall-tool ];
systemd.services.firewall = {
description = "Firewall";
wantedBy = [ "sysinit.target" ];
@@ -365,7 +363,5 @@ in
ExecStop = "@${stopScript} firewall-stop";
};
};
};
}
nixos/modules/services/networking/firewall-nftables.nix
+3 -7
View File
@@ -19,9 +19,7 @@ let
in
{
options = {
networking.firewall = {
extraInputRules = lib.mkOption {
type = lib.types.lines;
@@ -59,11 +57,9 @@ in
'';
};
};
};
config = lib.mkIf (cfg.enable && config.networking.nftables.enable) {
config = lib.mkIf (cfg.enable && cfg.backend == "nftables") {
assertions = [
{
assertion = cfg.extraCommands == "";
@@ -83,6 +79,8 @@ in
}
];
environment.systemPackages = [ pkgs.nixos-firewall-tool ];
networking.nftables.tables."nixos-fw".family = "inet";
networking.nftables.tables."nixos-fw".content = ''
set temp-ports {
@@ -203,7 +201,5 @@ in
}
''}
'';
};
}
nixos/modules/services/networking/firewall.nix
+27 -11
View File
@@ -68,9 +68,7 @@ let
in
{
options = {
networking.firewall = {
enable = lib.mkOption {
type = lib.types.bool;
@@ -82,6 +80,32 @@ in
'';
};
backend = lib.mkOption {
type = lib.types.enum [
"iptables"
"nftables"
"firewalld"
];
default =
if config.services.firewalld.enable then
"firewalld"
else if config.networking.nftables.enable then
"nftables"
else
"iptables";
defaultText = lib.literalExpression ''
if config.services.firewalld.enable then
"firewalld"
else if config.networking.nftables.enable then
"nftables"
else
"iptables"
'';
description = ''
Underlying implementation for the firewall service.
'';
};
package = lib.mkOption {
type = lib.types.package;
default = if config.networking.nftables.enable then pkgs.nftables else pkgs.iptables;
@@ -292,11 +316,9 @@ in
};
}
// commonOptions;
};
config = lib.mkIf cfg.enable {
assertions = [
{
assertion = cfg.filterForward -> config.networking.nftables.enable;
@@ -311,11 +333,7 @@ in
networking.firewall.trustedInterfaces = [ "lo" ];
environment.systemPackages = [
cfg.package
pkgs.nixos-firewall-tool
]
++ cfg.extraPackages;
environment.systemPackages = [ cfg.package ] ++ cfg.extraPackages;
boot.kernelModules =
(lib.optional cfg.autoLoadConntrackHelpers "nf_conntrack")
@@ -323,7 +341,5 @@ in
boot.extraModprobeConfig = lib.optionalString cfg.autoLoadConntrackHelpers ''
options nf_conntrack nf_conntrack_helper=1
'';
};
}
nixos/modules/services/networking/firewalld/default.nix
+66
View File
@@ -0,0 +1,66 @@
{
config,
lib,
pkgs,
...
}:
let
cfg = config.services.firewalld;
paths = pkgs.buildEnv {
name = "firewalld-paths";
paths = cfg.packages;
pathsToLink = [ "/lib/firewalld" ];
};
in
{
imports = [
./service.nix
./settings.nix
./zone.nix
];
options.services.firewalld = {
enable = lib.mkEnableOption "FirewallD";
package = lib.mkPackageOption pkgs "firewalld" { };
packages = lib.mkOption {
type = lib.types.listOf lib.types.package;
default = [ ];
description = ''
Packages providing firewalld zones and other files.
Files found in `/lib/firewalld` will be included.
'';
};
extraArgs = lib.mkOption {
type = lib.types.listOf lib.types.str;
default = [ ];
example = [ "--debug" ];
description = "Extra arguments to pass to FirewallD.";
};
};
config = lib.mkIf cfg.enable {
environment.systemPackages = [ cfg.package ];
services.dbus.packages = [ cfg.package ];
services.firewalld.packages = [ cfg.package ];
services.logrotate.settings."/var/log/firewalld" = {
copytruncate = true;
minsize = "1M";
};
environment.etc."sysconfig/firewalld".text = ''
FIREWALLD_ARGS=${lib.concatStringsSep " " cfg.extraArgs}
'';
systemd.packages = [ cfg.package ];
systemd.services.firewalld = {
aliases = [ "dbus-org.fedoraproject.FirewallD1.service" ];
wantedBy = [ "multi-user.target" ];
serviceConfig.ExecReload = "${lib.getExe' pkgs.coreutils "kill"} -HUP $MAINPID";
environment.NIX_FIREWALLD_CONFIG_PATH = "${paths}/lib/firewalld";
};
};
meta.maintainers = with lib.maintainers; [ prince213 ];
}
nixos/modules/services/networking/firewalld/lib.nix
+55
View File
@@ -0,0 +1,55 @@
{ lib }:
let
inherit (lib) mkOption;
inherit (lib.types)
either
enum
nullOr
port
submodule
;
mkPortOption =
{
optional ? false,
}:
mkOption {
type =
let
type = either port (submodule {
options = {
from = mkOption { type = port; };
to = mkOption { type = port; };
};
});
in
if optional then (nullOr type) else type;
description = "";
apply =
value: if builtins.isAttrs value then "${toString value.from}-${toString value.to}" else value;
};
protocolOption = mkOption {
type = enum [
"tcp"
"udp"
"sctp"
"dccp"
];
description = "";
};
in
{
inherit mkPortOption;
inherit protocolOption;
toXmlAttrs = lib.mapAttrs' (name: lib.nameValuePair ("@" + name));
mkXmlAttr = name: value: { "@${name}" = value; };
filterNullAttrs = lib.filterAttrsRecursive (_: value: value != null);
portProtocolOptions = {
options = {
port = mkPortOption { };
protocol = protocolOption;
};
};
}
nixos/modules/services/networking/firewalld/service.nix
+121
View File
@@ -0,0 +1,121 @@
{
config,
lib,
pkgs,
...
}:
let
cfg = config.services.firewalld;
format = pkgs.formats.xml { };
lib' = import ./lib.nix { inherit lib; };
inherit (lib')
filterNullAttrs
mkXmlAttr
portProtocolOptions
toXmlAttrs
;
inherit (lib) mkOption;
inherit (lib.types)
attrsOf
listOf
nonEmptyStr
nullOr
strMatching
submodule
;
in
{
options.services.firewalld.services = mkOption {
description = ''
firewalld service configuration files. See {manpage}`firewalld.service(5)`.
'';
default = { };
type = attrsOf (submodule {
options = {
version = mkOption {
type = nullOr nonEmptyStr;
description = "Version of the service.";
default = null;
};
short = mkOption {
type = nullOr nonEmptyStr;
description = "Short description for the service.";
default = null;
};
description = mkOption {
type = nullOr nonEmptyStr;
description = "Description for the service.";
default = null;
};
ports = mkOption {
type = listOf (submodule portProtocolOptions);
description = "Ports of the service.";
default = [ ];
};
protocols = mkOption {
type = listOf nonEmptyStr;
description = "Protocols for the service.";
default = [ ];
};
sourcePorts = mkOption {
type = listOf (submodule portProtocolOptions);
description = "Source ports for the service.";
default = [ ];
};
destination = mkOption {
type = submodule {
options = {
ipv4 = mkOption {
type = nullOr (strMatching "([0-9]{1,3}\\.){3}[0-9]{1,3}(/[0-9]{1,2})?");
description = "IPv4 destination.";
default = null;
};
ipv6 = mkOption {
type = nullOr (strMatching "[0-9A-Fa-f:]{3,39}(/[0-9]{1,3})?");
description = "IPv6 destination.";
default = null;
};
};
};
description = "Destinations for the service.";
default = { };
};
includes = mkOption {
type = listOf nonEmptyStr;
description = "Services to include for the service.";
default = [ ];
};
helpers = mkOption {
type = listOf nonEmptyStr;
description = "Helpers for the service.";
default = [ ];
};
};
});
};
config = lib.mkIf cfg.enable {
environment.etc = lib.mapAttrs' (
name: value:
lib.nameValuePair "firewalld/services/${name}.xml" {
source = format.generate "firewalld-service-${name}.xml" {
service = filterNullAttrs (
lib.mergeAttrsList [
(toXmlAttrs { inherit (value) version; })
{
inherit (value) short description;
port = builtins.map toXmlAttrs value.ports;
protocol = builtins.map (mkXmlAttr "value") value.protocols;
source-port = builtins.map toXmlAttrs value.sourcePorts;
destination = toXmlAttrs value.destination;
include = builtins.map (mkXmlAttr "service") value.includes;
helper = builtins.map (mkXmlAttr "name") value.helpers;
}
]
);
};
}
) cfg.services;
};
}
nixos/modules/services/networking/firewalld/settings.nix
+198
View File
@@ -0,0 +1,198 @@
{
config,
lib,
pkgs,
...
}:
let
cfg = config.services.firewalld;
format = pkgs.formats.keyValue { };
inherit (lib) mkOption;
inherit (lib.types)
bool
commas
either
enum
nonEmptyStr
separatedString
submodule
;
in
{
options.services.firewalld.settings = mkOption {
description = ''
FirewallD config file.
See {manpage}`firewalld.conf(5)`.
'';
default = { };
type = submodule {
freeformType = format.type;
options = {
DefaultZone = mkOption {
type = nonEmptyStr;
description = "Default zone for connections.";
default = "public";
};
CleanupOnExit = mkOption {
type = bool;
description = "Whether to clean up firewall rules when firewalld stops.";
default = true;
};
CleanupModulesOnExit = mkOption {
type = bool;
description = "Whether to unload all firewall-related kernel modules when firewalld stops.";
default = false;
};
IPv6_rpfilter = mkOption {
type = enum [
"strict"
"loose"
"strict-forward"
"loose-forward"
"no"
];
description = ''
Performs reverse path filtering (RPF) on IPv6 packets as per RFC 3704.
Possible values:
`"strict"`
: Performs "strict" filtering as per RFC 3704.
This check verifies that the in ingress interface is the same interface that would be used to send a packet reply to the source.
That is, `ingress == egress`.
`"loose"`
: Performs "loose" filtering as per RFC 3704.
This check only verifies that there is a route back to the source through any interface; even if it's not the same one on which the packet arrived.
`"strict-forward"`
: This is almost identical to "strict", but does not perform RPF for packets targeted to the host (INPUT).
`"loose-forward"`
: This is almost identical to "loose", but does not perform RPF for packets targeted to the host (INPUT).
`"no"`
: RPF is completely disabled.
The rp_filter for IPv4 is controlled using sysctl.
'';
default = "strict";
};
IndividualCalls = mkOption {
type = bool;
description = ''
Whether to use individual -restore calls to apply changes to the firewall.
The use of individual calls increases the time that is needed to apply changes and to start the daemon, but is good for debugging as error messages are more specific.
'';
default = false;
};
LogDenied = mkOption {
type = enum [
"all"
"unicast"
"broadcast"
"multicast"
"off"
];
description = ''
Add logging rules right before reject and drop rules in the INPUT, FORWARD and OUTPUT chains for the default rules and also final reject and drop rules in zones for the configured link-layer packet type.
'';
default = "off";
};
FirewallBackend = mkOption {
type = enum [
"nftables"
"iptables"
];
description = ''
The firewall backend implementation.
This applies to all firewalld primitives.
The only exception is direct and passthrough rules which always use the traditional iptables, ip6tables, and ebtables backends.
::: {.caution}
The iptables backend is deprecated.
It will be removed in a future release.
:::
'';
default = "nftables";
};
FlushAllOnReload = mkOption {
type = bool;
description = "Whether to flush all runtime rules on a reload.";
default = true;
};
ReloadPolicy = mkOption {
type =
let
policy = enum [
"DROP"
"REJECT"
"ACCEPT"
];
in
either policy commas;
description = "The policy during reload.";
default = "INPUT:DROP,FORWARD:DROP,OUTPUT:DROP";
};
RFC3964_IPv4 = mkOption {
type = bool;
description = ''
Whether to filter IPv6 traffic with 6to4 destination addresses that correspond to IPv4 addresses that should not be routed over the public internet.
'';
default = true;
};
StrictForwardPorts = mkOption {
type = bool;
description = ''
If enabled, the generated destination NAT (DNAT) rules will NOT accept traffic that was DNAT'd by other entities, e.g. docker.
Firewalld will be strict and not allow published container ports until they're explicitly allowed via firewalld.
If set to `false`, then docker (and podman) integrates seamlessly with firewalld.
Published container ports are implicitly allowed.
'';
default = false;
};
NftablesFlowtable = mkOption {
type = separatedString " ";
description = ''
This may improve forwarded traffic throughput by enabling nftables flowtable.
It is a software fastpath and avoids calling nftables rule evaluation for data packets.
Its value is a space separate list of interfaces.
'';
default = "off";
};
NftablesCounters = mkOption {
type = bool;
description = "Whether to add a counter to every nftables rule.";
default = false;
};
NftablesTableOwner = mkOption {
type = bool;
description = ''
If enabled, the generated nftables rule set will be owned exclusively by firewalld.
This prevents other entities from mistakenly (or maliciously) modifying firewalld's rule set.
If you intend to modify firewalld's rules, set this to `false`.
'';
default = true;
};
};
};
};
config = lib.mkIf cfg.enable {
assertions = [
{
assertion = cfg.settings.FirewallBackend == "nftables" -> config.networking.nftables.enable;
message = ''
FirewallD uses nftables as the firewall backend (by default), but nftables support isn't enabled.
Please read the description of networking.nftables.enable for possible problems.
If using nftables is not desired, set services.firewalld.settings.FirewallBackend to "iptables", but be aware that FirewallD has deprecated support for it, and will override firewall rule set by other services, if any.
'';
}
];
environment.etc."firewalld/firewalld.conf" = {
source = format.generate "firewalld.conf" cfg.settings;
};
};
}
nixos/modules/services/networking/firewalld/zone.nix
+281
View File
@@ -0,0 +1,281 @@
{
config,
lib,
pkgs,
...
}:
let
cfg = config.services.firewalld;
format = pkgs.formats.xml { };
lib' = import ./lib.nix { inherit lib; };
inherit (lib')
filterNullAttrs
mkPortOption
mkXmlAttr
portProtocolOptions
protocolOption
toXmlAttrs
;
inherit (lib) mkOption;
inherit (lib.types)
attrTag
attrsOf
bool
enum
ints
listOf
nonEmptyStr
nullOr
strMatching
submodule
;
in
{
options.services.firewalld.zones = mkOption {
description = ''
firewalld zone configuration files.
See {manpage}`firewalld.zone(5)`.
'';
default = { };
example = {
public = {
forward = true;
services = [
"ssh"
"dhcpv6-client"
];
};
external = {
forward = true;
services = [
"ssh"
];
masquerade = true;
};
dmz = {
forward = true;
services = [
"ssh"
];
};
work = {
forward = true;
services = [
"ssh"
"dhcpv6-client"
];
};
home = {
forward = true;
services = [
"ssh"
"mdns"
"samba-client"
"dhcpv6-client"
];
};
internal = {
forward = true;
services = [
"ssh"
"mdns"
"samba-client"
"dhcpv6-client"
];
};
};
type = attrsOf (submodule {
options = {
version = mkOption {
type = nullOr nonEmptyStr;
description = "Version of the zone.";
default = null;
};
target = mkOption {
type = enum [
"ACCEPT"
"%%REJECT%%"
"DROP"
];
description = "Action for packets that doesn't match any rules.";
default = "%%REJECT%%";
};
ingressPriority = mkOption {
type = nullOr ints.s16;
description = ''
Priority for inbound traffic.
Lower values have higher priority.
'';
default = null;
};
egressPriority = mkOption {
type = nullOr ints.s16;
description = ''
Priority for outbound traffic.
Lower values have higher priority.
'';
default = null;
};
interfaces = mkOption {
type = listOf nonEmptyStr;
description = "Interfaces to bind.";
default = [ ];
};
sources = mkOption {
type = listOf (attrTag {
address = mkOption {
type = nonEmptyStr;
description = ''
An IP address or a network IP address with a mask for IPv4 or IPv6.
For IPv4, the mask can be a network mask or a plain number.
For IPv6 the mask is a plain number.
The use of host names is not supported.
'';
};
mac = mkOption {
type = strMatching "([[:xdigit:]]{2}:){5}[[:xdigit:]]{2}";
description = "A MAC address.";
};
ipset = mkOption {
type = nonEmptyStr;
description = "An ipset.";
};
});
description = "Source addresses, address ranges, MAC addresses or ipsets to bind.";
default = [ ];
};
icmpBlockInversion = mkOption {
type = bool;
description = ''
Whether to invert the icmp block handling.
Only enabled ICMP types are accepted and all others are rejected in the zone.
'';
default = false;
};
forward = mkOption {
type = bool;
description = ''
Whether to enable intra-zone forwarding.
When enabled, packets will be forwarded between interfaces or sources within a zone, even if the zone's target is not set to ACCEPT.
'';
default = false;
};
short = mkOption {
type = nullOr nonEmptyStr;
description = "Short description for the zone.";
default = null;
};
description = mkOption {
type = nullOr nonEmptyStr;
description = "Description for the zone.";
default = null;
};
services = mkOption {
type = listOf nonEmptyStr;
description = "Services to allow in the zone.";
default = [ ];
};
ports = mkOption {
type = listOf (submodule portProtocolOptions);
description = "Ports to allow in the zone.";
default = [ ];
};
protocols = mkOption {
type = listOf nonEmptyStr;
description = "Protocols to allow in the zone.";
default = [ ];
};
icmpBlocks = mkOption {
type = listOf nonEmptyStr;
description = "ICMP types to block in the zone.";
default = [ ];
};
masquerade = mkOption {
type = bool;
description = "Whether to enable masquerading in the zone.";
default = false;
};
forwardPorts = mkOption {
type = listOf (submodule {
options = {
port = mkPortOption { };
protocol = protocolOption;
to-port = (mkPortOption { optional = true; }) // {
default = null;
};
to-addr = mkOption {
type = nullOr nonEmptyStr;
description = "Destination IP address.";
default = null;
};
};
});
description = "Ports to forward in the zone.";
default = [ ];
};
sourcePorts = mkOption {
type = listOf (submodule portProtocolOptions);
description = "Source ports to allow in the zone.";
default = [ ];
};
rules = mkOption {
type = listOf (format.type);
description = "Rich rules for the zone.";
default = [ ];
};
};
});
};
config = lib.mkIf cfg.enable {
services.firewalld.zones = {
drop = {
target = "DROP";
forward = true;
};
block = {
forward = true;
};
trusted = {
target = "ACCEPT";
forward = true;
};
};
environment.etc = lib.mapAttrs' (
name: value:
lib.nameValuePair "firewalld/zones/${name}.xml" {
source = format.generate "firewalld-zone-${name}.xml" {
zone =
let
mkXmlAttrList = name: builtins.map (mkXmlAttr name);
mkXmlTag = value: if value then "" else null;
in
filterNullAttrs (
lib.mergeAttrsList [
(toXmlAttrs { inherit (value) version target; })
(mkXmlAttr "ingress-priority" value.ingressPriority)
(mkXmlAttr "egress-priority" value.egressPriority)
{
interface = mkXmlAttrList "name" value.interfaces;
source = builtins.map toXmlAttrs value.sources;
icmp-block-inversion = mkXmlTag value.icmpBlockInversion;
forward = mkXmlTag value.forward;
inherit (value) short description;
service = mkXmlAttrList "name" value.services;
port = builtins.map toXmlAttrs value.ports;
protocol = mkXmlAttrList "value" value.protocols;
icmp-block = mkXmlAttrList "name" value.icmpBlocks;
masquerade = mkXmlTag value.masquerade;
forward-port = builtins.map toXmlAttrs (builtins.map filterNullAttrs value.forwardPorts);
source-port = builtins.map toXmlAttrs value.sourcePorts;
rule = value.rules;
}
]
);
};
}
) cfg.zones;
};
}
nixos/modules/services/networking/netbird.nix
+26 -10
View File
@@ -507,19 +507,35 @@ in
) "loose";
# Ports opened on a specific
interfaces = listToAttrs (
toClientList (client: {
name = client.interface;
value.allowedUDPPorts = optionals client.openInternalFirewall [
# note: those should be opened up by NetBird itself, but it needs additional
# NixOS -specific debugging and tweaking before it works
5353 # <0.59.0 DNS forwarder port, kept for compatibility with those clients
22054 # >=0.59.0 DNS forwarder port
];
})
interfaces = lib.mkIf (config.networking.firewall.backend != "firewalld") (
listToAttrs (
toClientList (client: {
name = client.interface;
value.allowedUDPPorts = optionals client.openInternalFirewall [
# note: those should be opened up by NetBird itself, but it needs additional
# NixOS -specific debugging and tweaking before it works
5353 # <0.59.0 DNS forwarder port, kept for compatibility with those clients
22054 # >=0.59.0 DNS forwarder port
];
})
)
);
};
services.firewalld.zones.netbird = {
interfaces = lib.pipe cfg.clients [
(lib.filterAttrs (_: client: client.openFirewall))
lib.attrValues
(map (client: client.interface))
];
ports = [
{
protocol = "udp";
port = 5353;
}
];
};
systemd.network.networks = mkIf config.networking.useNetworkd (
toClientAttrs (
client:
nixos/modules/services/video/wivrn.nix
+2
View File
@@ -231,6 +231,8 @@ in
allowedUDPPorts = [ 9757 ];
};
services.firewalld.packages = [ cfg.package ];
environment = {
systemPackages = [
cfg.package
nixos/modules/services/x11/desktop-managers/kodi.nix
+2
View File
@@ -38,5 +38,7 @@ in
];
environment.systemPackages = [ cfg.package ];
services.firewalld.packages = [ cfg.package ];
};
}
nixos/modules/virtualisation/libvirtd.nix
+8 -3
View File
@@ -447,6 +447,8 @@ in
Include ${cfg.package}/etc/ssh/ssh_config.d/30-libvirt-ssh-proxy.conf
'';
services.firewalld.packages = [ cfg.package ];
systemd.packages = [ cfg.package ];
systemd.services.libvirtd-config = {
@@ -480,11 +482,12 @@ in
ln -s --force ${cfg.qemu.package}/bin/qemu-pr-helper /run/${dirName}/nix-helpers/
# Symlink to OVMF firmware code and variable template images distributed with QEMU
cp -sfv $(
readarray -t firmware_files < <(
${pkgs.jq}/bin/jq -rs \
'[.[] | .mapping.executable.filename, .mapping."nvram-template".filename] | unique | .[]' \
${cfg.qemu.package}/share/qemu/firmware/* \
) /run/${dirName}/nix-ovmf
${cfg.qemu.package}/share/qemu/firmware/*
)
cp -sfv "''${firmware_files[@]}" /run/${dirName}/nix-ovmf
# Symlink hooks to /var/lib/libvirt
${concatStringsSep "\n" (
@@ -542,6 +545,8 @@ in
OOMScoreAdjust = "-999";
};
restartIfChanged = false;
enableStrictShellChecks = true;
};
systemd.services.virtchd = {
nixos/modules/virtualisation/podman/default.nix
+3 -1
View File
@@ -249,7 +249,9 @@ in
};
# containers cannot reach aardvark-dns otherwise
networking.firewall.interfaces.${network_interface}.allowedUDPPorts = lib.mkIf dns_enabled [ 53 ];
networking.firewall = lib.mkIf (config.networking.firewall.backend != "firewalld") {
interfaces.${network_interface}.allowedUDPPorts = lib.mkIf dns_enabled [ 53 ];
};
virtualisation.containers = {
enable = true; # Enable common /etc/containers configuration
nixos/tests/all-tests.nix
+7 -2
View File
@@ -569,12 +569,17 @@ in
firejail = runTest ./firejail.nix;
firewall = runTest {
imports = [ ./firewall.nix ];
_module.args.nftables = false;
_module.args.backend = "iptables";
};
firewall-firewalld = runTest {
imports = [ ./firewall.nix ];
_module.args.backend = "firewalld";
};
firewall-nftables = runTest {
imports = [ ./firewall.nix ];
_module.args.nftables = true;
_module.args.backend = "nftables";
};
firewalld = runTest ./firewalld.nix;
firezone = runTest ./firezone/firezone.nix;
fish = runTest ./fish.nix;
flannel = runTestOn [ "x86_64-linux" ] ./flannel.nix;
nixos/tests/firewall.nix
+35 -24
View File
@@ -1,10 +1,11 @@
# Test the firewall module.
{ lib, nftables, ... }:
{ lib, backend, ... }:
{
name = "firewall" + lib.optionalString nftables "-nftables";
name = "firewall-${backend}";
meta = with lib.maintainers; {
maintainers = [
prince213
rvfg
garyguo
];
@@ -12,10 +13,11 @@
nodes = {
walled =
{ ... }:
{ lib, ... }:
{
networking.firewall = {
enable = true;
inherit backend;
logRefusedPackets = true;
# Syntax smoke test, not actually verified otherwise
allowedTCPPorts = [
@@ -37,26 +39,29 @@
to = 8010;
}
];
interfaces.eth0 = {
allowedTCPPorts = [ 10003 ];
allowedTCPPortRanges = [
{
from = 10000;
to = 10005;
}
];
};
interfaces.eth3 = {
allowedUDPPorts = [ 10003 ];
allowedUDPPortRanges = [
{
from = 10000;
to = 10005;
}
];
interfaces = lib.mkIf (backend != "firewalld") {
eth0 = {
allowedTCPPorts = [ 10003 ];
allowedTCPPortRanges = [
{
from = 10000;
to = 10005;
}
];
};
eth3 = {
allowedUDPPorts = [ 10003 ];
allowedUDPPortRanges = [
{
from = 10000;
to = 10005;
}
];
};
};
};
networking.nftables.enable = nftables;
services.firewalld.enable = backend == "firewalld";
networking.nftables.enable = backend != "iptables";
services.httpd.enable = true;
services.httpd.adminAddr = "foo@example.org";
@@ -77,7 +82,13 @@
testScript =
{ nodes, ... }:
let
unit = if nftables then "nftables" else "firewall";
unit = if backend == "iptables" then "firewall" else backend;
openPort =
if backend == "firewalld" then
"firewall-cmd --add-port=80/tcp"
else
"nixos-firewall-tool open tcp 80";
reset = if backend == "firewalld" then "firewall-cmd --reload" else "nixos-firewall-tool reset";
in
''
start_all()
@@ -98,11 +109,11 @@
walled.succeed("ping -c 1 attacker >&2")
# Open tcp port 80 at runtime
walled.succeed("nixos-firewall-tool open tcp 80")
walled.succeed("${openPort}")
attacker.succeed("curl -v http://walled/ >&2")
# Reset the firewall
walled.succeed("nixos-firewall-tool reset")
walled.succeed("${reset}")
attacker.fail("curl --fail --connect-timeout 2 http://walled/ >&2")
# If we stop the firewall, then connections should succeed.
nixos/tests/firewalld.nix
+52
View File
@@ -0,0 +1,52 @@
{ lib, pkgs, ... }:
{
name = "firewalld";
meta.maintainers = with pkgs.lib.maintainers; [
prince213
];
nodes = {
walled = {
networking.nftables.enable = true;
services.firewalld.enable = true;
services.httpd.enable = true;
services.httpd.adminAddr = "foo@example.org";
};
open = {
networking.nftables.enable = true;
services.firewalld = {
enable = true;
settings.DefaultZone = "trusted";
};
services.httpd.enable = true;
services.httpd.adminAddr = "foo@example.org";
};
};
testScript = ''
start_all()
walled.wait_for_unit("firewalld")
walled.wait_for_unit("httpd")
open.wait_for_unit("network.target")
with subtest("walled local httpd works"):
walled.succeed("curl -v http://localhost/ >&2")
with subtest("incoming connections are blocked"):
open.fail("curl --fail --connect-timeout 2 http://walled/ >&2")
with subtest("outgoing connections are allowed"):
walled.succeed("curl -v http://open/ >&2")
with subtest("runtime configuration can be changed"):
walled.succeed("firewall-cmd --add-service=http")
open.succeed("curl -v http://walled/ >&2")
with subtest("runtime configuration are not permanent"):
walled.succeed("firewall-cmd --complete-reload")
open.fail("curl --fail --connect-timeout 2 http://walled/ >&2")
'';
}
pkgs/applications/editors/vscode/extensions/default.nix
+2 -2
View File
@@ -4831,8 +4831,8 @@ let
mktplcRef = {
name = "uiua-vscode";
publisher = "uiua-lang";
version = "0.0.66";
hash = "sha256-eFdRzkoYJeQdpebKcSFhhnZZXFcA3oKURvqjBx5hReQ=";
version = "0.0.67";
hash = "sha256-Q/wJZ+ObCU+hRpZZKQGQtdt99/I6QHkSuHlNy7oe5Pk=";
};
meta = {
description = "VSCode language extension for Uiua";
pkgs/applications/networking/cluster/terraform-providers/providers.json
+2 -2
View File
@@ -1228,11 +1228,11 @@
"vendorHash": "sha256-skswuFKhN4FFpIunbom9rM/FVRJVOFb1WwHeAIaEjn8="
},
"spacelift-io_spacelift": {
"hash": "sha256-d26HPdufp8HgZSMA/wkEMtwXUOXSRgFd7+wqRc3V0OI=",
"hash": "sha256-aOpS9KJm31Rz3LnSLAAxV9A5XLuJxGzIWkv9JuEG3H8=",
"homepage": "https://registry.terraform.io/providers/spacelift-io/spacelift",
"owner": "spacelift-io",
"repo": "terraform-provider-spacelift",
"rev": "v1.37.0",
"rev": "v1.38.0",
"spdx": "MIT",
"vendorHash": "sha256-cX5K221Jnq701Nb+2bC1LmXVL7YvkZ8dkc2wYjDNOSw="
},
pkgs/by-name/bo/bookstack/package.nix
+3 -3
View File
@@ -8,16 +8,16 @@
php83.buildComposerProject2 (finalAttrs: {
pname = "bookstack";
version = "25.11.1";
version = "25.11.2";
src = fetchFromGitHub {
owner = "bookstackapp";
repo = "bookstack";
tag = "v${finalAttrs.version}";
hash = "sha256-qRJBBas54x/IoLs97/SBQW1FvhI/HYXQ9etQ+2LUse8=";
hash = "sha256-HHNiGnMVUtFWn2rexmbtbbKWtLs+og70sWYVtgw9Mas=";
};
vendorHash = "sha256-cIkfYc078NMP7QAGuoC4f77SaVPEnQ3H4zqIU4P3wd8=";
vendorHash = "sha256-sqoUGv4+WMblJAW2iJ80v89+dkvAlaNiDaTSCWcavy8=";
passthru = {
phpPackage = php83;
pkgs/by-name/bo/bottom/package.nix
+3 -3
View File
@@ -11,16 +11,16 @@
rustPlatform.buildRustPackage (finalAttrs: {
pname = "bottom";
version = "0.11.3";
version = "0.11.4";
src = fetchFromGitHub {
owner = "ClementTsang";
repo = "bottom";
tag = finalAttrs.version;
hash = "sha256-7rVvKAqK8hqICnSr/Ax9ndsIZAdTaUyOAoVZ13W5BJs=";
hash = "sha256-hyEYSkoV86BWVMjolU9IjU0rTABxE4ag26el0UydsFQ=";
};
cargoHash = "sha256-OXprj84ixm5KFayWsHuxCB3p5Ob/oZgsk3u3lqkOiuk=";
cargoHash = "sha256-VnpSgaBxSHJj+brMtNwmbrXUN9H3y0oinF8ya+vsl88=";
nativeBuildInputs = [
autoAddDriverRunpath
pkgs/by-name/br/brutespray/package.nix
+6 -5
View File
@@ -8,16 +8,16 @@
buildGoModule (finalAttrs: {
pname = "brutespray";
version = "2.4.0";
version = "2.4.1";
src = fetchFromGitHub {
owner = "x90skysn3k";
repo = "brutespray";
tag = "v${finalAttrs.version}";
hash = "sha256-tws3BvVQSlGcBgiJ8Ho7V/KJjzoq3TEOiChqTzrMbiU=";
hash = "sha256-szW4Cvby93aWbdH4I/RbGVvPBuM11sJGLuZA4nP2Cb4=";
};
vendorHash = "sha256-Fe3W5rlKygw4z5bF+6xy5mv86wKcBuCf3nhtdtFWJPM=";
vendorHash = "sha256-NJV5lCjr9wNZAZYtO1jWpLW2otWutUSQKdvnKUiFtBo=";
nativeBuildInputs = [ makeBinaryWrapper ];
@@ -29,14 +29,15 @@ buildGoModule (finalAttrs: {
'';
meta = {
homepage = "https://github.com/x90skysn3k/brutespray";
description = "Tool to do brute-forcing from Nmap output";
mainProgram = "brutespray";
homepage = "https://github.com/x90skysn3k/brutespray";
longDescription = ''
This tool automatically attempts default credentials on found services
directly from Nmap output.
'';
changelog = "https://github.com/x90skysn3k/brutespray/releases/tag/v${finalAttrs.version}";
license = lib.licenses.mit;
maintainers = [ ];
mainProgram = "brutespray";
};
})
pkgs/by-name/bu/bulky/package.nix
+13 -6
View File
@@ -10,17 +10,18 @@
gtk3,
glib,
common-licenses,
xapp-symbolic-icons,
}:
stdenv.mkDerivation rec {
pname = "bulky";
version = "3.9";
version = "4.0";
src = fetchFromGitHub {
owner = "linuxmint";
repo = "bulky";
tag = version;
hash = "sha256-LrArLx0AOEaeAvLBVhV9ho5H+qeiaBfjs8+iV5W9u+w=";
hash = "sha256-BHMCtvnz3Ua4pa3Pnh2PbxZ9a0vJOJ+Se2/DaPbUqQA=";
};
nativeBuildInputs = [
@@ -45,10 +46,10 @@ stdenv.mkDerivation rec {
postPatch = ''
substituteInPlace usr/lib/bulky/bulky.py \
--replace "/usr/share/locale" "$out/share/locale" \
--replace /usr/share/bulky "$out/share/bulky" \
--replace /usr/share/common-licenses "${common-licenses}/share/common-licenses" \
--replace __DEB_VERSION__ "${version}"
--replace-fail "/usr/share/locale" "$out/share/locale" \
--replace-fail /usr/share/bulky "$out/share/bulky" \
--replace-fail /usr/share/common-licenses "${common-licenses}/share/common-licenses" \
--replace-fail __DEB_VERSION__ "${version}"
'';
installPhase = ''
@@ -63,6 +64,12 @@ stdenv.mkDerivation rec {
glib-compile-schemas $out/share/glib-2.0/schemas
'';
preFixup = ''
gappsWrapperArgs+=(
--prefix XDG_DATA_DIRS : ${lib.makeSearchPath "share" [ xapp-symbolic-icons ]}
)
'';
meta = with lib; {
description = "Bulk rename app";
mainProgram = "bulky";
pkgs/by-name/ca/cargo-all-features/package.nix
+5
View File
@@ -13,6 +13,11 @@ rustPlatform.buildRustPackage rec {
hash = "sha256-pHwQq6/KGCIYm3Q63YbUit6yUjwEFnpBJCE6lpGBcZc=";
};
postPatch = ''
substituteInPlace tests/settings.rs \
--replace-fail 'cmd.env("RUSTFLAGS", "-Cinstrument-coverage");' '''
'';
cargoHash = "sha256-tAwU7vJLp4KLzYAEbtSpNKbZBz+hBdAiIkUD/A5CpwI=";
meta = with lib; {
pkgs/by-name/ca/cargo-shear/package.nix
+3 -3
View File
@@ -8,15 +8,15 @@
rustPlatform.buildRustPackage (finalAttrs: {
pname = "cargo-shear";
version = "1.6.2";
version = "1.6.3";
src = fetchCrate {
pname = "cargo-shear";
version = finalAttrs.version;
hash = "sha256-5N8sAKStdQnrgzXECxu/oRuGVLwLx/KfW2vcPClVZGM=";
hash = "sha256-8aRIDzMaVbu0oKU1Ufig3rBj/X8P/DPzUdrTfA77z0w=";
};
cargoHash = "sha256-WdB4oJtQAh90Fe+Km+SddpmyvHdyemo3KsuRyBtZ5FY=";
cargoHash = "sha256-A29u5ZI6zKUuBtpEEVkM4dVbTqETZlK8f33MG8V1SwE=";
env = {
# https://github.com/Boshen/cargo-shear/blob/v1.6.2/src/lib.rs#L51-L54
pkgs/by-name/cd/cdncheck/package.nix
+2 -2
View File
@@ -6,13 +6,13 @@
buildGoModule rec {
pname = "cdncheck";
version = "1.2.9";
version = "1.2.10";
src = fetchFromGitHub {
owner = "projectdiscovery";
repo = "cdncheck";
tag = "v${version}";
hash = "sha256-d1j/1DYeKolBBJ2DdPBduAymL68DRV0eUFoEuJSL0qU=";
hash = "sha256-KX+LEVRRPGtMEmYgrrSWBsvXyd7nvC5CHoRNI3kuVqI=";
};
vendorHash = "sha256-XLfbuqyu+U11v8TZifPyltLQtx+zAFxlTh0rgpXOpYU=";
pkgs/by-name/cr/croc/package.nix
+3 -3
View File
@@ -8,16 +8,16 @@
buildGoModule rec {
pname = "croc";
version = "10.2.7";
version = "10.3.0";
src = fetchFromGitHub {
owner = "schollz";
repo = "croc";
rev = "v${version}";
hash = "sha256-eIWLTWFnF7lMU2b43Txoi8yxAEmPIKl5xmK2Q5wgXeg=";
hash = "sha256-5mxrfYAR4kTy9hdbsC7wFdroHf68dknPH3mq4KXG36Y=";
};
vendorHash = "sha256-kuJrh9cK+ezxbScks0slj7f/nGHQTQpxg5I5bJ16ORk=";
vendorHash = "sha256-xEF1vjYQaeDYxcC3FTgR0zCFqvziNIrJVpJJT4o1cVU=";
subPackages = [ "." ];
pkgs/by-name/da/dart-sass/package.nix
+2 -2
View File
@@ -23,13 +23,13 @@ let
in
buildDartApplication rec {
pname = "dart-sass";
version = "1.94.0";
version = "1.94.2";
src = fetchFromGitHub {
owner = "sass";
repo = "dart-sass";
tag = version;
hash = "sha256-upE3IVMvwLABzq3rlgKN6LOnAH1TE8kdsTAh3Hr5QE0=";
hash = "sha256-/ygA4Ymo7n3JWCv/qxkQs6JWoIhMIwHjKCqk4KyKOMw=";
};
pubspecLock = lib.importJSON ./pubspec.lock.json;
pkgs/by-name/da/dart-sass/pubspec.lock.json
+2 -2
View File
@@ -184,11 +184,11 @@
"dependency": "transitive",
"description": {
"name": "dart_style",
"sha256": "c87dfe3d56f183ffe9106a18aebc6db431fc7c98c31a54b952a77f3d54a85697",
"sha256": "a9c30492da18ff84efe2422ba2d319a89942d93e58eb0b73d32abe822ef54b7b",
"url": "https://pub.dev"
},
"source": "hosted",
"version": "3.1.2"
"version": "3.1.3"
},
"dartdoc": {
"dependency": "direct dev",
pkgs/by-name/de/dediprog-sf100/package.nix
+4 -1
View File
@@ -47,6 +47,9 @@ stdenv.mkDerivation (finalAttrs: {
description = "Linux software for DediProg SF100/SF600 programmers";
license = lib.licenses.gpl2;
platforms = lib.platforms.linux;
maintainers = with lib.maintainers; [ thillux ];
maintainers = with lib.maintainers; [
thillux
felixsinger
];
};
})
pkgs/by-name/di/di-tui/package.nix
+2 -2
View File
@@ -6,13 +6,13 @@
}:
buildGoModule rec {
pname = "di-tui";
version = "1.11.3";
version = "1.11.4";
src = fetchFromGitHub {
owner = "acaloiaro";
repo = "di-tui";
rev = "v${version}";
hash = "sha256-Qd+Rwyw0aC5RGucvl3v3mHbV6dB9VHvk9/nh/glWU90=";
hash = "sha256-CTZ98EbOdM/uCFZHtCGnU4OHmFw4iPwqseb0RuJvDnk=";
};
vendorHash = "sha256-b7dG0nSjPQpjWUbOlIxWudPZWKqtq96sQaJxKvsQT9I=";
pkgs/by-name/fa/fabric-ai/package.nix
+2 -2
View File
@@ -7,13 +7,13 @@
buildGoModule rec {
pname = "fabric-ai";
version = "1.4.323";
version = "1.4.328";
src = fetchFromGitHub {
owner = "danielmiessler";
repo = "fabric";
tag = "v${version}";
hash = "sha256-1l0O6o6bFqfFjEAwgU8KM5K1Bx0BC654lSY+SmGUNu4=";
hash = "sha256-s7XZDYD8y36zUw5StJnYMNxCkDiub3ubg7/I7AY91mE=";
};
vendorHash = "sha256-bOA4vKwiRNRCyDWKCmzwLZlhsZwjSVe194Th6MNlwvM=";
pkgs/by-name/fi/firewalld/package.nix
+6
View File
@@ -26,6 +26,7 @@
sysctl,
wrapGAppsNoGuiHook,
withGui ? false,
nixosTests,
}:
let
@@ -153,6 +154,11 @@ stdenv.mkDerivation rec {
wrapPythonProgramsIn "$out/bin" "$out ${pythonPath}"
'';
passthru.tests = {
firewalld = nixosTests.firewalld;
firewall-firewalld = nixosTests.firewall-firewalld;
};
meta = {
description = "Firewall daemon with D-Bus interface";
homepage = "https://firewalld.org";
pkgs/by-name/ge/gemini-cli-bin/package.nix
+3 -2
View File
@@ -8,11 +8,11 @@
}:
stdenvNoCC.mkDerivation (finalAttrs: {
pname = "gemini-cli-bin";
version = "0.15.4";
version = "0.16.0";
src = fetchurl {
url = "https://github.com/google-gemini/gemini-cli/releases/download/v${finalAttrs.version}/gemini.js";
hash = "sha256-X4QXDZYtTY0LO9OiE9F99DBvit79Tsz/4zhfVHPQxSE=";
hash = "sha256-BL+qIQgqqVuOQzCVjS9lnExijM0XDj5v3+RPkbspw9Q=";
};
dontUnpack = true;
@@ -25,6 +25,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
runHook preInstall
install -D "$src" "$out/bin/gemini"
sed -i '/disableAutoUpdate: {/,/}/ s/default: false/default: true/' "$out/bin/gemini"
runHook postInstall
'';
pkgs/by-name/gn/gnome-online-accounts-gtk/package.nix
+9 -2
View File
@@ -11,17 +11,18 @@
gnome-online-accounts,
gtk4,
libadwaita,
xapp-symbolic-icons,
}:
stdenv.mkDerivation (finalAttrs: {
pname = "gnome-online-accounts-gtk";
version = "3.50.7";
version = "3.50.8";
src = fetchFromGitHub {
owner = "xapp-project";
repo = "gnome-online-accounts-gtk";
rev = finalAttrs.version;
hash = "sha256-CFPaCx3tfOIoovm9AXofBdZzl/Rxiz5RVOrVKCuxZbI=";
hash = "sha256-DcW88Zx8uoxOL+2mV7uBIsnmQEuy02tbAO1ljf0ZigQ=";
};
nativeBuildInputs = [
@@ -39,6 +40,12 @@ stdenv.mkDerivation (finalAttrs: {
libadwaita # for goa-backend
];
preFixup = ''
gappsWrapperArgs+=(
--prefix XDG_DATA_DIRS : ${lib.makeSearchPath "share" [ xapp-symbolic-icons ]}
)
'';
meta = with lib; {
description = "Online accounts configuration utility";
homepage = "https://github.com/xapp-project/gnome-online-accounts-gtk";
pkgs/by-name/gv/gvm-libs/package.nix
+7 -5
View File
@@ -1,11 +1,12 @@
{
lib,
stdenv,
cjson,
cmake,
curl,
doxygen,
fetchFromGitHub,
glib,
glib-networking,
gnutls,
gpgme,
hiredis,
@@ -25,13 +26,13 @@
stdenv.mkDerivation rec {
pname = "gvm-libs";
version = "22.11.0";
version = "22.31.1";
src = fetchFromGitHub {
owner = "greenbone";
repo = "gvm-libs";
tag = "v${version}";
hash = "sha256-VYFAy6VVASNOBLs39qukePYr5pV0IR1qjztv+veNCVc=";
hash = "sha256-/2r5jPWqOb9KQyCW1ja9xV/RBQnsZCeJJHL2a6oH3bk=";
};
postPatch = ''
@@ -45,8 +46,9 @@ stdenv.mkDerivation rec {
];
buildInputs = [
cjson
curl
glib
glib-networking
gnutls
gpgme
hiredis
@@ -71,7 +73,7 @@ stdenv.mkDerivation rec {
meta = {
description = "Libraries module for the Greenbone Vulnerability Management Solution";
homepage = "https://github.com/greenbone/gvm-libs";
changelog = "https://github.com/greenbone/gvm-libs/releases/tag/v${version}";
changelog = "https://github.com/greenbone/gvm-libs/releases/tag/${src.tag}";
license = with lib.licenses; [ gpl2Plus ];
maintainers = with lib.maintainers; [ fab ];
platforms = lib.platforms.linux;
pkgs/by-name/ki/kimai/package.nix
+3 -3
View File
@@ -7,13 +7,13 @@
php.buildComposerProject2 (finalAttrs: {
pname = "kimai";
version = "2.42.0";
version = "2.43.0";
src = fetchFromGitHub {
owner = "kimai";
repo = "kimai";
tag = finalAttrs.version;
hash = "sha256-5CPNUneOHbKxI/7/ARRt2hDKGmpvtmJwBAWdblCNmCQ=";
hash = "sha256-gleeUCV9Id0GINFfpdYrS8A0yFv8VNCbApv9lsqb6SA=";
};
php = php.buildEnv {
@@ -38,7 +38,7 @@ php.buildComposerProject2 (finalAttrs: {
'';
};
vendorHash = "sha256-z0bSqSCSPF61x+zCbIVxRJ4SsxWaqL5yrK6+E8cxgiI=";
vendorHash = "sha256-vXkR8UV7CHUfKtfC/onmde0VIqu6HxxoTOKgLrP3Cik=";
composerNoPlugins = false;
pkgs/by-name/li/libgedit-gfls/package.nix
+2 -2
View File
@@ -16,7 +16,7 @@
stdenv.mkDerivation (finalAttrs: {
pname = "libgedit-gfls";
version = "0.3.0";
version = "0.3.1";
outputs = [
"out"
@@ -30,7 +30,7 @@ stdenv.mkDerivation (finalAttrs: {
owner = "gedit";
repo = "libgedit-gfls";
tag = finalAttrs.version;
hash = "sha256-X56QPcmNB0Ey+kzSqDnb6/j6/w7IU7MFSAxW8mX8I3w=";
hash = "sha256-HBXOphDvFwXea0mlfPqPtaXgNpAZyHYwuHBn5f7hPso=";
};
nativeBuildInputs = [
pkgs/by-name/lu/luau-lsp/package.nix
+2 -2
View File
@@ -9,13 +9,13 @@
stdenv.mkDerivation (finalAttrs: {
pname = "luau-lsp";
version = "1.56.1";
version = "1.56.2";
src = fetchFromGitHub {
owner = "JohnnyMorganz";
repo = "luau-lsp";
tag = finalAttrs.version;
hash = "sha256-IRBVLLWycc4zkjR82jAEcTlmDgXSLbaAA7ejSIYm41U=";
hash = "sha256-lEv4ZysuYrK86JRoH8M2PesGEo7LI9ybGLIOExPtTZQ=";
fetchSubmodules = true;
};
pkgs/by-name/mo/mocha/package.nix
+3 -3
View File
@@ -6,16 +6,16 @@
buildNpmPackage (finalAttrs: {
pname = "mocha";
version = "11.7.4";
version = "11.7.5";
src = fetchFromGitHub {
owner = "mochajs";
repo = "mocha";
tag = "v${finalAttrs.version}";
hash = "sha256-mRXdAPKDNnQzr8oz6NrTeUFgT7aBbsTl4TxFvjcVqCs=";
hash = "sha256-Bk/yF3z/DZ4h9mj1a/EG5ofC6/CIpLd81iQ1w7XkZ0A=";
};
npmDepsHash = "sha256-NTJ27KucQcrnpPVtEX3zr6qQZjaLzNHPhgJefntE8hg=";
npmDepsHash = "sha256-dcq6P4BB6w7GGMzW2GfF8AzDnqPV/BS5nz+dxVjnc3o=";
postInstall = ''
# Installed only for backwards compat, but should just be removed.
pkgs/by-name/mo/models-dev/package.nix
+15 -7
View File
@@ -6,19 +6,19 @@
nix-update-script,
writableTmpDirAsHomeHook,
}:
stdenvNoCC.mkDerivation (finalAttrs: {
let
pname = "models-dev";
version = "0-unstable-2025-11-17";
version = "0-unstable-2025-11-20";
src = fetchFromGitHub {
owner = "sst";
repo = "models.dev";
rev = "0cb3e3498ba712bd31528926d2efdd26e925267b";
hash = "sha256-ICMR59DaqriZZmO7260iuyMjuIRJ9AYtWlzVZY0KFXw=";
rev = "5389818cb714afeeca30ceef3c012498bba7f709";
hash = "sha256-ld/bWHJPGoDO7lyXnmGCzSt1f3A/JA8azJcj0C5HT8E=";
};
node_modules = stdenvNoCC.mkDerivation {
pname = "models-dev-node_modules";
inherit (finalAttrs) version src;
pname = "${pname}-node_modules";
inherit version src;
impureEnvVars = lib.fetchers.proxyImpureEnvVars ++ [
"GIT_PROXY_COMMAND"
@@ -69,13 +69,21 @@ stdenvNoCC.mkDerivation (finalAttrs: {
outputHashAlgo = "sha256";
outputHashMode = "recursive";
};
in
stdenvNoCC.mkDerivation (finalAttrs: {
inherit
pname
version
src
node_modules
;
nativeBuildInputs = [ bun ];
configurePhase = ''
runHook preConfigure
cp -R ${finalAttrs.node_modules}/. .
cp -R ${node_modules}/. .
runHook postConfigure
'';
pkgs/by-name/ob/obfs4/package.nix
+24 -10
View File
@@ -3,11 +3,13 @@
buildGoModule,
fetchFromGitLab,
installShellFiles,
versionCheckHook,
nix-update-script,
}:
buildGoModule rec {
buildGoModule (finalAttrs: {
pname = "obfs4";
version = "0.4.0";
version = "0.6.2";
src = fetchFromGitLab {
domain = "gitlab.torproject.org";
@@ -16,15 +18,16 @@ buildGoModule rec {
# We don't use pname = lyrebird and we use the old obfs4 name as the first
# will collide with lyrebird Gtk3 program.
repo = "lyrebird";
rev = "lyrebird-${version}";
hash = "sha256-aPALWvngC/BVQO73yUAykHvEb6T0DZcGMowXINDqhpQ=";
tag = "lyrebird-${finalAttrs.version}";
hash = "sha256-0Nny97bapiyolmCHcty+HtZTziA50bqoCD+3gyFZIQE=";
};
vendorHash = "sha256-iR3+ZMEF0SB3EoLTf2gtqTe3CQcjtDRhfwwbwGj3pXo=";
vendorHash = "sha256-ifJyOhbaB7BDBayvbh1otF1hxCuxzSG9NLb7Xtvaupg=";
ldflags = [
"-s"
"-w"
"-X main.lyrebirdVersion=${finalAttrs.version}"
];
subPackages = [ "cmd/lyrebird" ];
@@ -36,7 +39,15 @@ buildGoModule rec {
ln -s $out/share/man/man1/{lyrebird,obfs4proxy}.1
'';
meta = with lib; {
nativeInstallCheckInputs = [ versionCheckHook ];
versionCheckProgramArg = "--version";
doInstallCheck = true;
passthru.updateScript = nix-update-script {
extraArgs = [ "--version-regex=^lyrebird-(\\d+\\.\\d+\\.\\d+)$" ];
};
meta = {
description = "Circumvents censorship by transforming Tor traffic between clients and bridges";
longDescription = ''
Obfs4proxy is a tool that attempts to circumvent censorship by
@@ -50,13 +61,16 @@ buildGoModule rec {
multiple pluggable transports.
'';
homepage = "https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/lyrebird";
maintainers = with maintainers; [ thoughtpolice ];
mainProgram = "lyrebird";
changelog = "https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/lyrebird/-/raw/${src.rev}/ChangeLog";
changelog = "https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/lyrebird/-/blob/lyrebird-${finalAttrs.version}/ChangeLog";
license = with lib.licenses; [
bsd2
bsd3
gpl3
];
maintainers = with lib.maintainers; [
thoughtpolice
defelo
];
mainProgram = "lyrebird";
};
}
})
pkgs/by-name/pl/plasma-panel-colorizer/package.nix
+2 -2
View File
@@ -9,13 +9,13 @@
stdenv.mkDerivation (finalAttrs: {
pname = "plasma-panel-colorizer";
version = "5.3.0";
version = "5.4.0";
src = fetchFromGitHub {
owner = "luisbocanegra";
repo = "plasma-panel-colorizer";
tag = "v${finalAttrs.version}";
hash = "sha256-hv0XBBeXjpwtjFuQ5RRFf/v3ygZbTfsKjWBsd7vs7ps=";
hash = "sha256-8cjOyQzX3MOcXLux0raiAlx6kNreLa5jGdGQDlFNGiw=";
};
nativeBuildInputs = [
pkgs/by-name/re/renderdoc/package.nix
+2 -2
View File
@@ -33,13 +33,13 @@ let
in
stdenv.mkDerivation (finalAttrs: {
pname = "renderdoc";
version = "1.40";
version = "1.41";
src = fetchFromGitHub {
owner = "baldurk";
repo = "renderdoc";
rev = "v${finalAttrs.version}";
hash = "sha256-420UV9I+jJ8sLOQVhfGfkGPqAnN+kgPy8k0rZLt5X+Y=";
hash = "sha256-1Us+hwvsHX2Zn0BCv8YkOCN1226gAXeZYsg4btyJi8w=";
};
outputs = [
pkgs/by-name/to/tor/package.nix
+2 -2
View File
@@ -46,11 +46,11 @@ in
stdenv.mkDerivation (finalAttrs: {
pname = "tor";
version = "0.4.8.20";
version = "0.4.8.21";
src = fetchurl {
url = "https://dist.torproject.org/tor-${finalAttrs.version}.tar.gz";
hash = "sha256-G7IjKM3R7pSGR7/O1XHvp4wS/FBkGHtB1SVAhbUoL6c=";
hash = "sha256-6vb1tzCRuVV2lF6t6YgW3f980AW+/k2UcYpvdmuECQM=";
};
outputs = [
pkgs/by-name/we/wechat/package.nix
+2 -2
View File
@@ -30,14 +30,14 @@ let
# https://dldir1.qq.com/weixin/mac/mac-release.xml
any-darwin =
let
version = "4.1.5.11-31899";
version = "4.1.5.17-31953";
version' = lib.replaceString "-" "_" version;
in
{
inherit version;
src = fetchurl {
url = "https://dldir1v6.qq.com/weixin/Universal/Mac/xWeChatMac_universal_${version'}.dmg";
hash = "sha256-uBOjBrUH2kTxSMJjycHynCN/FZqxphzp3zkgouiJp+o=";
hash = "sha256-eItxPcvlzxwqXG7IxN001aoR+9SqyVOA7y71Sh83jYI=";
};
};
in
pkgs/development/libraries/openssl/default.nix
+9 -6
View File
@@ -90,7 +90,15 @@ let
substituteInPlace Configurations/unix-Makefile.tmpl \
--replace 'ENGINESDIR=$(libdir)/engines-{- $sover_dirname -}' \
'ENGINESDIR=$(OPENSSLDIR)/engines-{- $sover_dirname -}'
'';
''
# This test will fail if the error strings between the build libc and host
# libc mismatch, e.g. when cross-compiling from glibc to musl
+
lib.optionalString
(finalAttrs.finalPackage.doCheck && stdenv.hostPlatform.libc != stdenv.buildPlatform.libc)
''
rm test/recipes/02-test_errstr.t
'';
outputs = [
"bin"
@@ -186,11 +194,6 @@ let
"--openssldir=/.$(etc)/etc/ssl"
)
]
# Tell build system it's cross environment. This allows to skip tests
# that would fail when libc is different. Otherwise, run the tests.
++ lib.optional (
!lib.systems.equals stdenv.buildPlatform stdenv.hostPlatform
) "--cross-compile-prefix=${lib.getBin stdenv.cc}/bin/"
++ lib.optionals withCryptodev [
"-DHAVE_CRYPTODEV"
"-DUSE_CRYPTODEV_DIGESTS"
pkgs/development/python-modules/beautysh/default.nix
+2 -2
View File
@@ -13,14 +13,14 @@
buildPythonPackage rec {
pname = "beautysh";
version = "6.4.1";
version = "6.4.2";
pyproject = true;
src = fetchFromGitHub {
owner = "lovesegfault";
repo = "beautysh";
tag = "v${version}";
hash = "sha256-B+1qwivb9MZ+W0u7hccDt3aTjDOcbEQ89Alc8mWd2Sg=";
hash = "sha256-wLqysNhkagZ+sphqMC78cLoKvsMJpJCJr16lgvU37JI=";
};
build-system = [ hatchling ];
pkgs/development/python-modules/cantools/default.nix
+2 -2
View File
@@ -18,12 +18,12 @@
buildPythonPackage rec {
pname = "cantools";
version = "41.0.0";
version = "41.0.1";
pyproject = true;
src = fetchPypi {
inherit pname version;
hash = "sha256-gdfvoy1moUmTSyG2kaQPtA254LdPoCwk9PJX9YfRaa4=";
hash = "sha256-WycDUgKJuRFR5fPFT8wBxoijgrqDqjf6RnQxV4Pl8uk=";
};
build-system = [
pkgs/development/python-modules/frozendict/default.nix
+2 -2
View File
@@ -9,7 +9,7 @@
buildPythonPackage rec {
pname = "frozendict";
version = "2.4.6";
version = "2.4.7";
pyproject = true;
disabled = pythonOlder "3.6";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
owner = "Marco-Sulla";
repo = "python-frozendict";
tag = "v${version}";
hash = "sha256-cdKI0wIr0w6seV12cigqyJL6PSkLVzwVxASUB8n7lFY=";
hash = "sha256-ehx8X3jbKls/DVgCzWJ+nTX+m/Cdknnu/sjrAMxnJFo=";
};
# build C version if it exists
pkgs/development/python-modules/lacuscore/default.nix
+2 -2
View File
@@ -18,14 +18,14 @@
buildPythonPackage rec {
pname = "lacuscore";
version = "1.19.3";
version = "1.20.1";
pyproject = true;
src = fetchFromGitHub {
owner = "ail-project";
repo = "LacusCore";
tag = "v${version}";
hash = "sha256-mm9oInWx7xZ+39kNOt77TLjCCf60Tmisefh71+2ZIMw=";
hash = "sha256-L7hmqNymXkZD/NQk1OQ9H34aJcCa6W23gkQSjomv7Iw=";
};
pythonRelaxDeps = [
pkgs/development/python-modules/llama-index-vector-stores-milvus/default.nix
+2 -2
View File
@@ -9,13 +9,13 @@
buildPythonPackage rec {
pname = "llama-index-vector-stores-milvus";
version = "0.9.3";
version = "0.9.4";
pyproject = true;
src = fetchPypi {
pname = "llama_index_vector_stores_milvus";
inherit version;
hash = "sha256-JiGsSKKlwV3efEkT5p3lXcEY7hCbVWRdCAX9X539Ke0=";
hash = "sha256-Zf+/xk3bqN/ARvwzDiN4/g7Neo6l9x5wTcTSvzto//A=";
};
build-system = [ hatchling ];
pkgs/development/python-modules/lxmf/default.nix
+2 -5
View File
@@ -2,23 +2,20 @@
lib,
buildPythonPackage,
fetchFromGitHub,
pythonOlder,
rns,
setuptools,
}:
buildPythonPackage rec {
pname = "lxmf";
version = "0.9.2";
version = "0.9.3";
pyproject = true;
disabled = pythonOlder "3.7";
src = fetchFromGitHub {
owner = "markqvist";
repo = "lxmf";
tag = version;
hash = "sha256-9xmg0ofp/0Cy8+et80qWNFIRyiF3vTmdzACLIO+t27U=";
hash = "sha256-bPRoKJGMy+JAyhKcRXKR3Jra5K1UAjRMg0lMt2lOvzA=";
};
build-system = [ setuptools ];
pkgs/development/python-modules/pytenable/default.nix
+3 -6
View File
@@ -15,7 +15,6 @@
pytestCheckHook,
python-box,
python-dateutil,
pythonOlder,
requests-pkcs12,
requests-toolbelt,
requests,
@@ -28,16 +27,14 @@
buildPythonPackage rec {
pname = "pytenable";
version = "1.8.4";
version = "1.9.0";
pyproject = true;
disabled = pythonOlder "3.10";
src = fetchFromGitHub {
owner = "tenable";
repo = "pyTenable";
tag = version;
hash = "sha256-Dt6jN+0Ktv3CO88RmbgKCU8v3Oa10MnKjyJaePxXsaI=";
hash = "sha256-ml5364D3qvd6VNhF2JyGoCzxbdO0DBkaBMoD38O5x8o=";
};
pythonRelaxDeps = [
@@ -102,7 +99,7 @@ buildPythonPackage rec {
description = "Python library for the Tenable.io and TenableSC API";
homepage = "https://github.com/tenable/pyTenable";
changelog = "https://github.com/tenable/pyTenable/releases/tag/${src.tag}";
license = with licenses; [ mit ];
license = licenses.mit;
maintainers = with maintainers; [ fab ];
};
}
pkgs/development/python-modules/rns/default.nix
+2 -2
View File
@@ -14,14 +14,14 @@
buildPythonPackage rec {
pname = "rns";
version = "1.0.2";
version = "1.0.3";
pyproject = true;
src = fetchFromGitHub {
owner = "markqvist";
repo = "Reticulum";
tag = version;
hash = "sha256-c2k+jEiDwtauM+2x8HNqLZIUv4d53hVngS6LbIIs+k4=";
hash = "sha256-Tvn51iODNES35VRDR7/Ev/8El5XDe1nObujrjhcvrM8=";
};
patches = [
pkgs/development/python-modules/svgdigitizer/default.nix
+7 -3
View File
@@ -2,7 +2,6 @@
lib,
buildPythonPackage,
fetchFromGitHub,
stdenv,
# build-system
setuptools,
@@ -29,14 +28,14 @@
buildPythonPackage rec {
pname = "svgdigitizer";
version = "0.13.0";
version = "0.14.1";
pyproject = true;
src = fetchFromGitHub {
owner = "echemdb";
repo = "svgdigitizer";
tag = version;
hash = "sha256-UlcvCfNoEijIKoqSbufEZ6988rqwT2xDEy4P/9fdgVM=";
hash = "sha256-ZOR9CviQhPyJQjbLpR53ZVwaarrICg87vtzCL1nq+jE=";
};
build-system = [
@@ -70,6 +69,11 @@ buildPythonPackage rec {
"svgdigitizer"
];
disabledTests = [
# test tries to connect to doi.org
"svgdigitizer.pdf.Pdf.bibliographic_entry"
];
pythonImportsCheck = [
"svgdigitizer"
];
pkgs/development/python-modules/yara-x/default.nix
+3 -3
View File
@@ -9,21 +9,21 @@
buildPythonPackage rec {
pname = "yara-x";
version = "1.9.0";
version = "1.10.0";
pyproject = true;
src = fetchFromGitHub {
owner = "VirusTotal";
repo = "yara-x";
tag = "v${version}";
hash = "sha256-yoQoAtgXBgniNebU9HMxF1m0UHFD6iU095he9tCNNIo=";
hash = "sha256-aRFDutYFD476xq2TTVWB5CxF1pi3C24NJpfc5kD+aNA=";
};
buildAndTestSubdir = "py";
cargoDeps = rustPlatform.fetchCargoVendor {
inherit pname src version;
hash = "sha256-/HMyNofKpeYaFfRcZ1LAb3vfW/TQy+DsILXRCpJFlCQ=";
hash = "sha256-CT+walpFIFTaO480ATHO1E38K9Tw14QqLRYzztWQmeA=";
};
nativeBuildInputs = [
pkgs/os-specific/linux/kernel/zen-kernels.nix
+2 -2
View File
@@ -16,9 +16,9 @@ let
variants = {
# ./update-zen.py zen
zen = {
version = "6.17.7"; # zen
version = "6.17.8"; # zen
suffix = "zen1"; # zen
sha256 = "01dh7cdqa4rx0fmr22yyn8d6qb8ns7v0x53k2ij3vrp9pz6p5cs4"; # zen
sha256 = "0khz49xgqvbxsq0gk127xspic3ks1x61v3ggnjzwhzsgpqyvjv04"; # zen
isLqx = false;
};
# ./update-zen.py lqx
pkgs/servers/sql/postgresql/ext/postgis.nix
+2 -2
View File
@@ -35,7 +35,7 @@ let
in
postgresqlBuildExtension (finalAttrs: {
pname = "postgis";
version = "3.6.0";
version = "3.6.1";
outputs = [
"out"
@@ -46,7 +46,7 @@ postgresqlBuildExtension (finalAttrs: {
owner = "postgis";
repo = "postgis";
tag = finalAttrs.version;
hash = "sha256-L8k3yk1Dn4Dk7UyHse+8RJsjYsYMebdsiZp6fS7cC0Y=";
hash = "sha256-WVS2TWKishTnCWJ87Vvdcb0i3VR+g/qSjcTDO1cx1s0=";
};
buildInputs = [