From 5fc400b8e98b377031525b937d3642264a56e3de Mon Sep 17 00:00:00 2001 From: 06kellyjac Date: Thu, 13 Nov 2025 14:34:16 +0000 Subject: [PATCH 1/7] notation: add jk to maintainers --- pkgs/by-name/no/notation/package.nix | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/pkgs/by-name/no/notation/package.nix b/pkgs/by-name/no/notation/package.nix index e800d429736e..cd1895f03aed 100644 --- a/pkgs/by-name/no/notation/package.nix +++ b/pkgs/by-name/no/notation/package.nix @@ -50,7 +50,9 @@ buildGoModule (finalAttrs: { description = "CLI tool to sign and verify OCI artifacts and container images"; homepage = "https://notaryproject.dev/"; license = lib.licenses.asl20; - maintainers = [ ]; + maintainers = with lib.maintainers; [ + jk + ]; mainProgram = "notation"; }; }) From 7cd32151f5cc1ee7964793fe1cff0f34dee42952 Mon Sep 17 00:00:00 2001 From: 06kellyjac Date: Thu, 13 Nov 2025 15:44:09 +0000 Subject: [PATCH 2/7] notation: add vdemeester as maintainer https://github.com/NixOS/nixpkgs/pull/461273#issuecomment-3528411732 Co-authored-by: vdemeester --- pkgs/by-name/no/notation/package.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/pkgs/by-name/no/notation/package.nix b/pkgs/by-name/no/notation/package.nix index cd1895f03aed..6874459774c7 100644 --- a/pkgs/by-name/no/notation/package.nix +++ b/pkgs/by-name/no/notation/package.nix @@ -52,6 +52,7 @@ buildGoModule (finalAttrs: { license = lib.licenses.asl20; maintainers = with lib.maintainers; [ jk + vdemeester ]; mainProgram = "notation"; }; From c79de89efa11d8546798f1edba6b8c5ce06fa557 Mon Sep 17 00:00:00 2001 From: 06kellyjac Date: Thu, 13 Nov 2025 14:34:40 +0000 Subject: [PATCH 3/7] notation: more granular excludedPackages --- pkgs/by-name/no/notation/package.nix | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/pkgs/by-name/no/notation/package.nix b/pkgs/by-name/no/notation/package.nix index 6874459774c7..c765e172377b 100644 --- a/pkgs/by-name/no/notation/package.nix +++ b/pkgs/by-name/no/notation/package.nix @@ -25,7 +25,9 @@ buildGoModule (finalAttrs: { ]; # This is a Go sub-module and cannot be built directly (e2e tests). - excludedPackages = [ "./test" ]; + excludedPackages = [ + "./test/e2e" + ]; ldflags = [ "-s" From 6d2c02483fe13fd567fdf5b5ff4408de72675d31 Mon Sep 17 00:00:00 2001 From: 06kellyjac Date: Thu, 13 Nov 2025 14:39:26 +0000 Subject: [PATCH 4/7] notation: provide completions when cross-compiling --- pkgs/by-name/no/notation/package.nix | 24 +++++++++++++++++------- 1 file changed, 17 insertions(+), 7 deletions(-) diff --git a/pkgs/by-name/no/notation/package.nix b/pkgs/by-name/no/notation/package.nix index c765e172377b..21cef5758c2b 100644 --- a/pkgs/by-name/no/notation/package.nix +++ b/pkgs/by-name/no/notation/package.nix @@ -1,10 +1,12 @@ { lib, - stdenv, buildGoModule, fetchFromGitHub, installShellFiles, testers, + + stdenv, + buildPackages, }: buildGoModule (finalAttrs: { @@ -36,12 +38,20 @@ buildGoModule (finalAttrs: { "-X github.com/notaryproject/notation/internal/version.BuildMetadata=" ]; - postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) '' - installShellCompletion --cmd notation \ - --bash <($out/bin/notation completion bash) \ - --fish <($out/bin/notation completion fish) \ - --zsh <($out/bin/notation completion zsh) - ''; + postInstall = + let + exe = + if stdenv.buildPlatform.canExecute stdenv.hostPlatform then + "${placeholder "out"}/bin/${finalAttrs.meta.mainProgram}" + else + lib.getExe buildPackages.notation; + in + '' + installShellCompletion --cmd ${finalAttrs.meta.mainProgram} \ + --bash <(${exe} completion bash) \ + --fish <(${exe} completion fish) \ + --zsh <(${exe} completion zsh) + ''; passthru.tests.version = testers.testVersion { package = finalAttrs.finalPackage; From 4e550ce0eb9fe84901413569685b9e15dbda04ea Mon Sep 17 00:00:00 2001 From: 06kellyjac Date: Thu, 13 Nov 2025 14:40:33 +0000 Subject: [PATCH 5/7] notation: switch to versionCheckHook --- pkgs/by-name/no/notation/package.nix | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/pkgs/by-name/no/notation/package.nix b/pkgs/by-name/no/notation/package.nix index 21cef5758c2b..74b6b09ca5e9 100644 --- a/pkgs/by-name/no/notation/package.nix +++ b/pkgs/by-name/no/notation/package.nix @@ -3,10 +3,11 @@ buildGoModule, fetchFromGitHub, installShellFiles, - testers, stdenv, buildPackages, + + versionCheckHook, }: buildGoModule (finalAttrs: { @@ -53,10 +54,11 @@ buildGoModule (finalAttrs: { --zsh <(${exe} completion zsh) ''; - passthru.tests.version = testers.testVersion { - package = finalAttrs.finalPackage; - command = "notation version"; - }; + nativeInstallCheckInputs = [ + versionCheckHook + ]; + doInstallCheck = true; + versionCheckProgramArg = "version"; meta = { description = "CLI tool to sign and verify OCI artifacts and container images"; From 5ad9e1b2fe31395b4e2a2741432ac50a8719e411 Mon Sep 17 00:00:00 2001 From: 06kellyjac Date: Thu, 13 Nov 2025 16:00:06 +0000 Subject: [PATCH 6/7] notation: fix tests with darwin sandbox on --- pkgs/by-name/no/notation/package.nix | 3 +++ 1 file changed, 3 insertions(+) diff --git a/pkgs/by-name/no/notation/package.nix b/pkgs/by-name/no/notation/package.nix index 74b6b09ca5e9..c3afde4cb20d 100644 --- a/pkgs/by-name/no/notation/package.nix +++ b/pkgs/by-name/no/notation/package.nix @@ -32,6 +32,9 @@ buildGoModule (finalAttrs: { "./test/e2e" ]; + # tests bind to localhost + __darwinAllowLocalNetworking = true; + ldflags = [ "-s" "-w" From 756e773154012b7f0aff7e5da798f78787782a07 Mon Sep 17 00:00:00 2001 From: 06kellyjac Date: Thu, 13 Nov 2025 14:59:45 +0000 Subject: [PATCH 7/7] notary: drop --- doc/release-notes/rl-2511.section.md | 2 + pkgs/by-name/no/notary/package.nix | 58 ---------------------------- pkgs/top-level/aliases.nix | 1 + 3 files changed, 3 insertions(+), 58 deletions(-) delete mode 100644 pkgs/by-name/no/notary/package.nix diff --git a/doc/release-notes/rl-2511.section.md b/doc/release-notes/rl-2511.section.md index 2a9912f269fc..13650c9ec1c9 100644 --- a/doc/release-notes/rl-2511.section.md +++ b/doc/release-notes/rl-2511.section.md @@ -104,6 +104,8 @@ - `mx-puppet-discord` was removed from Nixpkgs along with its NixOS module as it was unmaintained and was the only user of sha1 hashes in tree. +- `notary` has been removed because it was [archived upstream](https://github.com/notaryproject/.github/issues/70). Upstream recommends [`notation`](https://github.com/notaryproject/notation/) instead. + - `gradience` has been removed because it was archived upstream. - `kbd` package's `outputs` now include a `man` and `scripts` outputs. The `unicode_start` and `unicode_stop` Bash scripts are now part of the `scripts` output, allowing most usages of the `kbd` package to not pull in `bash`. diff --git a/pkgs/by-name/no/notary/package.nix b/pkgs/by-name/no/notary/package.nix deleted file mode 100644 index d25575ca8567..000000000000 --- a/pkgs/by-name/no/notary/package.nix +++ /dev/null @@ -1,58 +0,0 @@ -{ - lib, - fetchFromGitHub, - buildGoModule, -}: -buildGoModule rec { - pname = "notary"; - version = "0.6.1-unstable-2024-04-16"; - - src = fetchFromGitHub { - owner = "notaryproject"; - repo = "notary"; - rev = "9d2b3b35929392c9945d976b8bdecbe2f53a299e"; - hash = "sha256-u19BfTJwRWholK0b3BcgSmcMM9AR7OeXo64AOi87r0A="; - }; - - vendorHash = null; - - tags = [ - "pkcs11" - ]; - - ldflags = [ - "-X github.com/theupdateframework/notary/version.NotaryVersion=${version}" - ]; - - # Tests try to use network. - doCheck = false; - - meta = { - description = "Project that allows anyone to have trust over arbitrary collections of data"; - mainProgram = "notary"; - longDescription = '' - The Notary project comprises a server and a client for running and - interacting with trusted collections. See the service architecture - documentation for more information. - - Notary aims to make the internet more secure by making it easy for people - to publish and verify content. We often rely on TLS to secure our - communications with a web server which is inherently flawed, as any - compromise of the server enables malicious content to be substituted for - the legitimate content. - - With Notary, publishers can sign their content offline using keys kept - highly secure. Once the publisher is ready to make the content available, - they can push their signed trusted collection to a Notary Server. - - Consumers, having acquired the publisher's public key through a secure - channel, can then communicate with any notary server or (insecure) mirror, - relying only on the publisher's key to determine the validity and - integrity of the received content. - ''; - license = lib.licenses.asl20; - homepage = "https://github.com/theupdateframework/notary"; - maintainers = [ lib.maintainers.vdemeester ]; - platforms = lib.platforms.unix; - }; -} diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix index 71e7b8bda41b..907be80b061c 100644 --- a/pkgs/top-level/aliases.nix +++ b/pkgs/top-level/aliases.nix @@ -1142,6 +1142,7 @@ mapAliases { nm-tray = throw "'nm-tray' has been removed, as it only works with Plasma 5"; # Added 2025-08-30 nomacs-qt6 = nomacs; # Added 2025-08-30 norouter = throw "norouter has been removed because it has been marked as broken since at least November 2024."; # Added 2025-09-29 + notary = throw "'notary' has been removed due to being archived upstream. Consider using 'notation' instead."; # Added 2025-11-13 notes-up = throw "'notes-up' has been removed as it was unmaintained and depends on deprecated webkitgtk_4_0"; # Added 2025-10-09 notify-sharp = throw "'notify-sharp' has been removed as it was unmaintained and depends on deprecated dbus-sharp versions"; # Added 2025-08-25 noto-fonts-emoji = throw "'noto-fonts-emoji' has been renamed to/replaced by 'noto-fonts-color-emoji'"; # Converted to throw 2025-10-27