From 9a8475c634b669680dc1b9e62482c3bf97ff371b Mon Sep 17 00:00:00 2001 From: Andrew Marshall Date: Tue, 9 May 2023 18:34:49 -0400 Subject: [PATCH 1/4] bitwarden: 2023.3.2 -> 2023.4.0 --- pkgs/tools/security/bitwarden/default.nix | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/pkgs/tools/security/bitwarden/default.nix b/pkgs/tools/security/bitwarden/default.nix index f638c4bfca81..95351c1b0e13 100644 --- a/pkgs/tools/security/bitwarden/default.nix +++ b/pkgs/tools/security/bitwarden/default.nix @@ -24,19 +24,19 @@ let buildNpmPackage' = buildNpmPackage.override { nodejs = nodejs_16; }; - version = "2023.3.2"; + version = "2023.4.0"; src = fetchFromGitHub { owner = "bitwarden"; repo = "clients"; rev = "desktop-v${version}"; - sha256 = "sha256-KQDM7XDUA+yRv8y1K//rMCs4J36df42RVsiAXazJeYQ="; + sha256 = "sha256-TTKDl6Py3k+fAy/kcyiMbAAKQdhVnZTyRXV8D/VpKBE="; }; desktop-native = rustPlatform.buildRustPackage { pname = "bitwarden-desktop-native"; inherit src version; sourceRoot = "source/apps/desktop/desktop_native"; - cargoSha256 = "sha256-XsAmVYWPPnY0cgBzpO2aWx/fh85fKr8kMO98cDMzOKk="; + cargoSha256 = "sha256-VW9DmSh9jvqFCZjH1SAYkydSGjXSVEbv4CmtoJBiw5Y="; patchFlags = [ "-p4" ]; @@ -91,7 +91,7 @@ buildNpmPackage' { npmBuildFlags = [ "--workspace apps/desktop" ]; - npmDepsHash = "sha256-RmkTWhakZstCCMLQ3iJ8KD5Yt5ZafXc8NDgncJMLaxs="; + npmDepsHash = "sha256-Y7yGM1poNMALipa0mr/iiTLP1zk3K1BqVBdopy6f6fE="; ELECTRON_SKIP_BINARY_DOWNLOAD = "1"; From baecc1d300981a61242e656118cee33ca141fe24 Mon Sep 17 00:00:00 2001 From: Andrew Marshall Date: Tue, 9 May 2023 18:34:50 -0400 Subject: [PATCH 2/4] bitwarden: make applying patches easier MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Since `sourceRoot` occurs before patching, simply setting `patches` in the native drv to the same as the npm drv doesn’t work, as paths outside the `sourceRoot` referenced in the patches don’t exist and cause applying them to fail. Instead, use `applyPatches` to make `src` have the patches already applied before `sourceRoot` comes into play. It would be possible to not use `sourceRoot` and just `cd`, but then the `Cargo.lock` location needs to be manually specified and it just becomes more mess than it’s worth. `applyPatches` seems the cleanest way to achieve this. --- pkgs/tools/security/bitwarden/default.nix | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-) diff --git a/pkgs/tools/security/bitwarden/default.nix b/pkgs/tools/security/bitwarden/default.nix index 95351c1b0e13..f3a98cc6d55f 100644 --- a/pkgs/tools/security/bitwarden/default.nix +++ b/pkgs/tools/security/bitwarden/default.nix @@ -1,4 +1,5 @@ { lib +, applyPatches , buildNpmPackage , dbus , electron @@ -25,21 +26,23 @@ let buildNpmPackage' = buildNpmPackage.override { nodejs = nodejs_16; }; version = "2023.4.0"; - src = fetchFromGitHub { - owner = "bitwarden"; - repo = "clients"; - rev = "desktop-v${version}"; - sha256 = "sha256-TTKDl6Py3k+fAy/kcyiMbAAKQdhVnZTyRXV8D/VpKBE="; + src = applyPatches { + src = fetchFromGitHub { + owner = "bitwarden"; + repo = "clients"; + rev = "desktop-v${version}"; + sha256 = "sha256-TTKDl6Py3k+fAy/kcyiMbAAKQdhVnZTyRXV8D/VpKBE="; + }; + + patches = [ ]; }; desktop-native = rustPlatform.buildRustPackage { pname = "bitwarden-desktop-native"; inherit src version; - sourceRoot = "source/apps/desktop/desktop_native"; + sourceRoot = "source-patched/apps/desktop/desktop_native"; cargoSha256 = "sha256-VW9DmSh9jvqFCZjH1SAYkydSGjXSVEbv4CmtoJBiw5Y="; - patchFlags = [ "-p4" ]; - nativeBuildInputs = [ pkg-config wrapGAppsHook From b38795a22e1028127a9e2f2be1c8d9b11d31bd26 Mon Sep 17 00:00:00 2001 From: Andrew Marshall Date: Tue, 9 May 2023 18:34:50 -0400 Subject: [PATCH 3/4] bitwarden: update to use Node 18 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Backport patch from Bitwarden master to achieve this as they have done (unreleased) upgrade 16→18, and have several other changes along with it. We want this now because Node 16 is being marked insecure soon for NixOS 23.05; see https://github.com/NixOS/nixpkgs/pull/229910. - These changes should be in the next release in a few weeks - `npm bin` no longer exists, use `npm exec` instead --- pkgs/tools/security/bitwarden/default.nix | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) diff --git a/pkgs/tools/security/bitwarden/default.nix b/pkgs/tools/security/bitwarden/default.nix index f3a98cc6d55f..2785a4d928a5 100644 --- a/pkgs/tools/security/bitwarden/default.nix +++ b/pkgs/tools/security/bitwarden/default.nix @@ -4,6 +4,7 @@ , dbus , electron , fetchFromGitHub +, fetchpatch , glib , gnome , gtk3 @@ -12,7 +13,7 @@ , makeDesktopItem , makeWrapper , moreutils -, nodejs_16 +, nodejs_18 , pkg-config , python3 , rustPlatform @@ -23,7 +24,7 @@ let description = "A secure and free password manager for all of your devices"; icon = "bitwarden"; - buildNpmPackage' = buildNpmPackage.override { nodejs = nodejs_16; }; + buildNpmPackage' = buildNpmPackage.override { nodejs = nodejs_18; }; version = "2023.4.0"; src = applyPatches { @@ -34,7 +35,13 @@ let sha256 = "sha256-TTKDl6Py3k+fAy/kcyiMbAAKQdhVnZTyRXV8D/VpKBE="; }; - patches = [ ]; + patches = [ + # Bump electron to 24 and node to 18 + (fetchpatch { + url = "https://github.com/bitwarden/clients/pull/5205.patch"; + hash = "sha256-sKSrh8RHXtxGczyZScjTeiGZgTZCQ7f45ULj/j9cp6M="; + }) + ]; }; desktop-native = rustPlatform.buildRustPackage { @@ -94,7 +101,7 @@ buildNpmPackage' { npmBuildFlags = [ "--workspace apps/desktop" ]; - npmDepsHash = "sha256-Y7yGM1poNMALipa0mr/iiTLP1zk3K1BqVBdopy6f6fE="; + npmDepsHash = "sha256-UXDn09qyM8GwfUiWLDhhyrGFZeKtTRmQArstw+tm5iE="; ELECTRON_SKIP_BINARY_DOWNLOAD = "1"; @@ -114,7 +121,7 @@ buildNpmPackage' { postBuild = '' pushd apps/desktop - "$(npm bin)"/electron-builder \ + npm exec electron-builder -- \ --dir \ -c.electronDist=${electron}/lib/electron \ -c.electronVersion=${electron.version} From 7e50f350d3099403a3a3c00aa362125e1fad3bc6 Mon Sep 17 00:00:00 2001 From: Andrew Marshall Date: Tue, 9 May 2023 18:34:51 -0400 Subject: [PATCH 4/4] bitwarden: verify Electron version matches expected --- pkgs/tools/security/bitwarden/default.nix | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/pkgs/tools/security/bitwarden/default.nix b/pkgs/tools/security/bitwarden/default.nix index 2785a4d928a5..9a78b698f7af 100644 --- a/pkgs/tools/security/bitwarden/default.nix +++ b/pkgs/tools/security/bitwarden/default.nix @@ -2,7 +2,7 @@ , applyPatches , buildNpmPackage , dbus -, electron +, electron_24 , fetchFromGitHub , fetchpatch , glib @@ -25,6 +25,7 @@ let icon = "bitwarden"; buildNpmPackage' = buildNpmPackage.override { nodejs = nodejs_18; }; + electron = electron_24; version = "2023.4.0"; src = applyPatches { @@ -113,6 +114,11 @@ buildNpmPackage' { ]; preBuild = '' + if [[ $(jq --raw-output '.devDependencies.electron' < package.json | grep -E --only-matching '^[0-9]+') != ${lib.escapeShellArg (lib.versions.major electron.version)} ]]; then + echo 'ERROR: electron version mismatch' + exit 1 + fi + jq 'del(.scripts.postinstall)' apps/desktop/package.json | sponge apps/desktop/package.json jq '.scripts.build = ""' apps/desktop/desktop_native/package.json | sponge apps/desktop/desktop_native/package.json cp ${desktop-native}/lib/libdesktop_native.so apps/desktop/desktop_native/desktop_native.linux-x64-musl.node