citrix_workspace has a hard dependency on libsoup 2.4 (autoPatchelf
fails if it is not present), which is being removed as it is insecure.
Thus, this package is broken for now.
HdxRtcEngine loads libpulse.so.0 dynamically, so autoPatchelf cannot discover the dependency from ELF metadata. Add libpulseaudio to the wrapper library path so Teams HDX optimization can initialize endpoint audio.
Add the GStreamer plugin stack that Citrix documents for Linux webcam redirection and propagate GST_PLUGIN_SYSTEM_PATH_1_0 through the wrapped entrypoints so the client can discover those plugins at runtime.
Unpack the vendor-bundled WebKit 4.0 runtime, skip optional EPA, device
trust, and FIDO installer steps, and make 26.01 the default Citrix
Workspace package.
Rewrite the generated desktop entries to call the wrapped commands from $out/bin instead of the upstream install paths. Keep selfservice as the launcher target for menu and citrixapp URI handling, and keep adapter as the ICA file handler entrypoint.
When printing the error message with instructions to manually obtain a
fixed-output derivation using requireFile, print the string as escaped
using `escapeShellArg`, rather than using a here-doc where Bash
expansion will be performed.
This permits passing instructions that contain characters that Bash
would normally expand without needing to escape them (or even know that
they need escaping from Bash), for example instructions referencing
`$PWD`.
Document this in the current release notes, and update existing
requireFile calls that perform this now-unnecessary escaping. In
passing, fix up a couple of minor message errors.
this creates some eval errors that will be fixed in the next commit
done with the following script:
```fish
\#!/usr/bin/env fish
set packagesjson (nix eval --impure --json --expr '
let
lib = import ./lib;
in
import pkgs/servers/x11/xorg/default.nix (lib.mapAttrs (
name: _:
if name == "lib" then
lib
else if name == "config" then
{ allowAliases = false; }
else
name
) (__functionArgs (import pkgs/servers/x11/xorg/default.nix))) { }
' | jq)
set one (grep '^ [A-Za-z0-9_-]*$' pkgs/servers/x11/xorg/default.nix | string trim | string replace -r '$' Z | sort | string sub -e -1)
set two (grep '^ [A-Za-z0-9_-]* = [A-Za-z0-9_-]*;$' pkgs/servers/x11/xorg/default.nix | cut -d= -f1 | string trim | string replace -r '$' Z | sort | string sub -e -1)
for arg in $one $two
set oname $arg
set nname (echo $packagesjson | jq -r .$oname)
if test $nname = null
echo (set_color red)warn:(set_color normal) unknown package xorg.$oname >&2
continue
end
echo $oname "->" $nname
# replace basic xorg.$name references
for file in (rg -F "xorg.$oname" --files-with-matches pkgs)
# special cases
sd -F "$oname = xorg.$oname;" "$nname = $nname;" $file
# replace
sd -F "xorg.$oname" "$nname" $file
# fixup function arguments
# prevent duplicate function args
if grep -E " ($oname|$nname),\$" $file >/dev/null
continue
end
if grep 'xorg\..' $file >/dev/null # case1: there is more so we can't just remove the function arg
if grep ' xorg,$' $file >/dev/null
sd ' xorg,$' " xorg,
$nname," $file
else if grep ' xorg ? .*,$' $file >/dev/null
sd 'xorg( ? .*),$' "xorg\$1,
$nname," $file
else
sd -F 'xorg,' "$nname,
xorg," $file
end
else # case there is no more xorg..* so we can just replace the function arg
sd 'xorg(| ? .*),.*$' "$nname," $file
end
end
end
nix fmt
```
This commit was created by a combination of scripts and tools:
- an ast-grep script to prefix things in meta with `lib.`,
- a modified nixf-diagnose / nixf combination to remove unused `with
lib;`, and
- regular nixfmt.
Co-authored-by: Wolfgang Walther <walther@technowledgy.de>
`webkitgtk_4_0` was already transitively insecure because of `libsoup_2_4` and it will be removed soon.
Ideally, we would just replace it with `libsoup_3`-based `webkitgtk_4_1`
but it is unclear if they would work with the 4.1 ABI. At best, the programs
would only be looking for 4.0, failing to build or start, at worst there
might be conflicts with libsoup 2 symbols if that is pulled in by anything
or crashes that will only happen after certain action.
Let’s mark the packages as broken to ensure human intervention.
Austin Horstman