319 Commits

Author SHA1 Message Date
Stig Palmquist c6a6976a2a perl: backport security fixes
Perl ships with some CPAN modules vendored as "dual-life", this commit
inject updated versions certain modules directly from CPAN rather than
applying patches from upstream, as they can be tricky to maintain.

It also includes a patch for CVE-2026-8376 which affects 32-bit
platforms.

- perl: CVE-2026-8376
  https://github.com/Perl/perl5/commit/5e7f119eb2bb1181be908701f22bf7068e722f1c

- HTTP-Tiny 0.094: CVE-2026-7010
  https://metacpan.org/release/HAARG/HTTP-Tiny-0.094/changes

- Compress-Raw-Zlib 2.222: CVE-2026-3381, CVE-2026-4176
  https://metacpan.org/release/PMQS/Compress-Raw-Zlib-2.222/changes

- Compress-Raw-Bzip2 2.218
  https://metacpan.org/release/PMQS/Compress-Raw-Bzip2-2.218/changes

- IO-Compress 2.220: CVE-2026-48959, CVE-2026-48961, CVE-2026-48962
  https://metacpan.org/release/PMQS/IO-Compress-2.220/changes

- Archive-Tar 3.12: CVE-2026-42496, CVE-2026-42497, CVE-2026-9538
  https://metacpan.org/release/BINGOS/Archive-Tar-3.12/changes

Assisted-by: Codex (OpenAI)
Signed-off-by: Stig Palmquist <git@stig.io>
(cherry picked from commit d59aeb80e5)
(cherry picked from commit 5613fd0d417095f6e8bf247b23ec19b0ee210a92)
2026-06-22 08:21:28 +02:00
Alexander Bantyev 2839911e81 various: add security-review team as a maintainer
Adds the @NixOS/security-review team as a maintainer to multiple
packages deemed to be important security-wise.

For the motivation of the package list, see:
https://github.com/NixOS/nixpkgs/issues/494349#issuecomment-4005099033
2026-03-05 15:19:44 +01:00
Markus Sütter 196b385317 various: add meta.identifier.cpeParts to a batch of packages 2026-02-02 09:22:55 +01:00
nixpkgs-ci[bot] 06e5fd7d40 Merge staging-next into staging 2026-01-10 11:12:55 +00:00
Alexander Bantyev 6b36e4ea90 perl: add comments for patches
Describes all patches we apply to perl, to help with readability of the
derivation and comply with the style guide.
2026-01-09 16:42:05 +01:00
nixpkgs-ci[bot] 3fa7bb6ca1 Merge staging-next into staging 2026-01-06 00:19:30 +00:00
Marcus Ramberg a026099e26 perl-cross: 1.6.2 -> 1.6.4 2026-01-05 23:28:36 +01:00
Alexander Bantyev 25f0d1212e perl: add tests.withCheck
Adds perl.passthru.tests.withCheck, which runs the test suite provided
with perl.
2025-12-13 00:02:59 +01:00
Audrey Dutcher 4f41c66aa4 perl: Fix build with clang >= 21
When cross compiling for FreeBSD, we see this exact error:
https://github.com/llvm/llvm-project/issues/152241

As described in that issue, -fno-strict-aliasing is a workaround.
2025-12-08 14:54:06 -07:00
Ihar Hrachyshka d35ac1297c perl: remove sw_vers darwin patch
The patch fails to apply on 5.42.

It's no longer needed since:
https://github.com/Perl/perl5/commit/55b5890c26936402c07d7ae9e41b2b9842e36842
2025-11-15 18:28:43 -05:00
Alexander V. Nikolaev f4c5eab672 perl: don't shadow common patches in perl-cross
Signed-off-by: Alexander V. Nikolaev <avn@avnik.info>
2025-11-15 19:34:59 +01:00
Alexander V. Nikolaev 738cc1a199 perl: Fix bootstrap loop in case of cross-compilation
Signed-off-by: Alexander V. Nikolaev <avn@avnik.info>
2025-11-15 19:34:57 +01:00
Alexander V. Nikolaev 2b13410f7a perl: Fix missing B.pm issue in case of crosscompilation
Resurrect and rewrite hunk from cross.patch

Signed-off-by: Alexander V. Nikolaev <avn@avnik.info>
2025-11-15 19:34:57 +01:00
Alexander V. Nikolaev 4ce528e3a9 perl: Workaround Scalar::Util missing for miniperl
Signed-off-by: Alexander V. Nikolaev <avn@avnik.info>
2025-11-15 19:34:56 +01:00
Alyssa Ross b5fa38a5e5 perl: unconditionally set _GNU_SOURCE
Perl uses GNU extensions if they are available.  Its build system
tries to detect whether the libc is one that recognizes _GNU_SOURCE
with bad heuristics, that don't work for e.g. riscv64 musl.  Upstream
is not willing to unconditionally set _GNU_SOURCE like programs
usually do, because of an IMO misguided fear of somebody one day
writing a libc that interprets _GNU_SOURCE to mean something
different, so the only thing we can really do is set it ourselves.
On libcs that don't gate GNU extensions behind _GNU_SOURCE, like BSDs,
this should be a no-op.  This should also improve things for cross
where musl builds are currently broken due to perl-cross setting
_GNU_SOURCE for the configure step but not the build step, although I
haven't tested that.

Link: https://github.com/Perl/perl5/issues/16807#issuecomment-544099623
Link: https://github.com/arsv/perl-cross/issues/158
2025-11-15 19:34:53 +01:00
Marcus Ramberg ea55a49b7f perl: add cross patchset for 5.42.0 2025-11-15 19:33:36 +01:00
Marcus Ramberg de6e69cd4a perl: 5.40.0 -> 5.42.0
Drop 0.38 and 5.40
2025-11-15 19:32:26 +01:00
Artturin 1f74d7a2bd treewide: remove = __splicedPackages
Now that `pkgs` is `__splicedPackages` on cross we can remove these
variables I set.

Assignments like `patchutils = pkgs.patchutils_0_3_3;` in
`all-packages.nix` cannot be removed because the `pkgs`
in `patchutils = pkgs.patchutils_0_3_3;` in `all-packages.nix` is coming from
this `pkgs:` https://www.github.com/NixOS/nixpkgs/blob/b6e486730fc875ec79a3dea0f1f46eaf9f6ffa9d/pkgs/top-level/all-packages.nix#L9
instead of the `pkgs` in `with pkgs;`
2025-10-28 21:54:15 +01:00
Marcus Ramberg 3f63011df4 perl: fix build when cross-compiling to the musl libc (#430413) 2025-09-05 13:31:23 +02:00
Artturin 24ecea845f perl: Fix applying all the patches on cross
Applying the patches was broken in a2e1f82167
because a `patches` attr was added after `//` which overrode the `patches` before the `//`
2025-08-17 22:39:46 +03:00
someplaceguy 82aba98fa1 perl: fix build when cross-compiling to the musl libc
Fixes #428187
2025-08-02 13:37:53 -03:00
Wolfgang Walther 5a0711127c treewide: run nixfmt 1.0.0 2025-07-24 13:55:40 +02:00
Colin a2e1f82167 perl540: fix cross compilation 2025-06-22 11:59:03 +02:00
nixpkgs-ci[bot] 386c13fe1a Merge master into staging-next 2025-06-13 12:07:07 +00:00
aleksana 3bb2d75764 perl: add perl team to teams 2025-06-13 01:23:50 +08:00
Stig Palmquist 88c1caa7d0 perl: apply patch for CVE-2025-40909 2025-05-30 05:28:24 +02:00
Yannik Sander 41d3086567 perl: filter out reference to apple-sdk package
The perl package started depending on `apple-sdk` via references in
`lib/perl5/5.40.0/darwin-thread-multi-2level/Config_heavy.pl`:

```
fd --type=file . /nix/store/cwlch1mxd40ayx8qy7hl8q2scrwgqhg6-perl-5.40.0/lib/ -X rg "/nix/store/lsjl29pwp5if71jfgxlv8fifsrpax805-apple-sdk-11.3" {}
/nix/store/cwlch1mxd40ayx8qy7hl8q2scrwgqhg6-perl-5.40.0/lib/perl5/5.40.0/darwin-thread-multi-2level/Config_heavy.pl
1039:incpth='/nix/store/j3dhkx4m14m38drh3f40bccrwrgzlsg5-libcxx-19.1.7-dev/include /nix/store/hklang3njvw0f5mgra9vsvn3c2zi2v45-compiler-rt-libc-19.1.7-dev/include /nix/store/g4qcalcnvm5n393xq8p9swxd8rc0xxzj-libxcrypt-4.4.38/include /nix/store/f4z2y0zn2bmrwywp67y3h21cmb6ky547-libiconv-109-dev/include /nix/store/17a9rq4bw8drbhlr3dijrmxzfqlz8z85-libresolv-83-dev/include /nix/store/34bb5prqghfl0hpindhk8xlc5s2q2xjg-libsbuf-14.1.0-dev/include /nix/store/vzi6s9yh1i12bkj9abyfp43y6x1fdzpl-cups-headers-2.4.11/include /no-such-path/resource-root/include /nix/store/lsjl29pwp5if71jfgxlv8fifsrpax805-apple-sdk-11.3/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk/usr/include /no-such-path/include'
1087:libpth='/nix/store/g4qcalcnvm5n393xq8p9swxd8rc0xxzj-libxcrypt-4.4.38/lib /no-such-path/resource-root/lib /nix/store/lsjl29pwp5if71jfgxlv8fifsrpax805-apple-sdk-11.3/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk/usr/lib /no-such-path/lib'
1092:libspath=' /nix/store/g4qcalcnvm5n393xq8p9swxd8rc0xxzj-libxcrypt-4.4.38/lib /no-such-path/resource-root/lib /nix/store/lsjl29pwp5if71jfgxlv8fifsrpax805-apple-sdk-11.3/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk/usr/lib /no-such-path/lib'
1331:timeincl='/nix/store/lsjl29pwp5if71jfgxlv8fifsrpax805-apple-sdk-11.3/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk/usr/include/sys/time.h '
```

This change increases the closure size of `perl` from ~115MiB to ~1.11GiB
on darwin systems.

`apple-sdk` seems to be referenced via `stdenv.cc.fallback_sdk`.
Following the exisitng pattern in
`pkgs/development/interpreters/perl/interpreter.nix`,
that removes removes references to `stdenv.cc` and `stdenv.cc.cc`,
this commit also removes the reference to
`apple-sdk` / `stdenv.cc.fallback_sdk`.
2025-04-18 17:26:59 +02:00
Stig Palmquist 821d2fe81d perl: apply patch for CVE-2024-56406 2025-04-11 11:49:51 +02:00
Silvan Mosberger 374e6bcc40 treewide: Format all Nix files
Format all Nix files using the officially approved formatter,
making the CI check introduced in the previous commit succeed:

  nix-build ci -A fmt.check

This is the next step of the of the [implementation](https://github.com/NixOS/nixfmt/issues/153)
of the accepted [RFC 166](https://github.com/NixOS/rfcs/pull/166).

This commit will lead to merge conflicts for a number of PRs,
up to an estimated ~1100 (~33%) among the PRs with activity in the past 2
months, but that should be lower than what it would be without the previous
[partial treewide format](https://github.com/NixOS/nixpkgs/pull/322537).

Merge conflicts caused by this commit can now automatically be resolved while rebasing using the
[auto-rebase script](https://github.com/NixOS/nixpkgs/tree/8616af08d915377bd930395f3b700a0e93d08728/maintainers/scripts/auto-rebase).

If you run into any problems regarding any of this, please reach out to the
[formatting team](https://nixos.org/community/teams/formatting/) by
pinging @NixOS/nix-formatting.
2025-04-01 20:10:43 +02:00
Silvan Mosberger 4f0dadbf38 treewide: format all inactive Nix files
After final improvements to the official formatter implementation,
this commit now performs the first treewide reformat of Nix files using it.
This is part of the implementation of RFC 166.

Only "inactive" files are reformatted, meaning only files that
aren't being touched by any PR with activity in the past 2 months.
This is to avoid conflicts for PRs that might soon be merged.
Later we can do a full treewide reformat to get the rest,
which should not cause as many conflicts.

A CI check has already been running for some time to ensure that new and
already-formatted files are formatted, so the files being reformatted here
should also stay formatted.

This commit was automatically created and can be verified using

    nix-build https://github.com/infinisil/treewide-nixpkgs-reformat-script/archive/a08b3a4d199c6124ac5b36a889d9099b4383463f.tar.gz \
      --argstr baseRev b32a094368
    result/bin/apply-formatting $NIXPKGS_PATH
2024-12-10 20:26:33 +01:00
Artturin 9d9f4b50b4 Revert "splice.nix: make pkgs splicedPackages" 2024-12-06 18:58:53 +02:00
Artturin a27e48e1b2 treewide: remove = __splicedPackages
Now that `pkgs` is `__splicedPackages` on cross we can remove these
variables I set.

Assignments like `patchutils = pkgs.patchutils_0_3_3;` in
`all-packages.nix` cannot be removed because the `pkgs`
in `patchutils = pkgs.patchutils_0_3_3;` in `all-packages.nix` is coming from
this `pkgs:` https://www.github.com/NixOS/nixpkgs/blob/b6e486730fc875ec79a3dea0f1f46eaf9f6ffa9d/pkgs/top-level/all-packages.nix#L9
instead of the `pkgs` in `with pkgs;`
2024-11-11 00:25:02 +02:00
github-actions[bot] 60a1d9cc7b Merge staging-next into staging 2024-10-15 06:05:12 +00:00
Tristan Ross 13c8edc10a perl: fix cross compiling 2024-10-14 20:46:35 -07:00
Stig Palmquist c49774ff46 perl540: fix build in stage1, add C locale patch
- Add patch from Perl upstream fixing build if only C locale is
  available

- Change back from `perl538` to `perl` (perl540) in bootstrap-stage-1
2024-09-25 18:38:27 +02:00
Artturin f0e657f3b1 Merge branch 'master' into staging-next 2024-09-25 06:05:01 +03:00
Artturin e0464e4788 treewide: replace stdenv.is with stdenv.hostPlatform.is
In preparation for the deprecation of `stdenv.isX`.

These shorthands are not conducive to cross-compilation because they
hide the platforms.

Darwin might get cross-compilation for which the continued usage of `stdenv.isDarwin` will get in the way

One example of why this is bad and especially affects compiler packages
https://www.github.com/NixOS/nixpkgs/pull/343059

There are too many files to go through manually but a treewide should
get users thinking when they see a `hostPlatform.isX` in a place where it
doesn't make sense.

```
fd --type f "\.nix" | xargs sd --fixed-strings "stdenv.is" "stdenv.hostPlatform.is"
fd --type f "\.nix" | xargs sd --fixed-strings "stdenv'.is" "stdenv'.hostPlatform.is"
fd --type f "\.nix" | xargs sd --fixed-strings "clangStdenv.is" "clangStdenv.hostPlatform.is"
fd --type f "\.nix" | xargs sd --fixed-strings "gccStdenv.is" "gccStdenv.hostPlatform.is"
fd --type f "\.nix" | xargs sd --fixed-strings "stdenvNoCC.is" "stdenvNoCC.hostPlatform.is"
fd --type f "\.nix" | xargs sd --fixed-strings "inherit (stdenv) is" "inherit (stdenv.hostPlatform) is"
fd --type f "\.nix" | xargs sd --fixed-strings "buildStdenv.is" "buildStdenv.hostPlatform.is"
fd --type f "\.nix" | xargs sd --fixed-strings "effectiveStdenv.is" "effectiveStdenv.hostPlatform.is"
fd --type f "\.nix" | xargs sd --fixed-strings "originalStdenv.is" "originalStdenv.hostPlatform.is"
```
2024-09-25 00:04:37 +03:00
Sergei Trofimovich a41bb2c31e perlInterpreters.perl536: drop the attribute
Without the change `nixpkgs` exposes unevaluatable attribute as:

    $ nix build --no-link -f. perlInterpreters.perl536.perlOnBuild
    error: attribute 'perl536' missing
       at pkgs/development/interpreters/perl/interpreter.nix:207:37:
          206|       perlOnBuildForBuild = override pkgsBuildBuild.${perlAttr};
          207|       perlOnBuildForHost = override pkgsBuildHost.${perlAttr};
             |                                     ^
          208|       perlOnBuildForTarget = override pkgsBuildTarget.${perlAttr};
       Did you mean one of perl538 or perl540?

The interpreter depends on presence of `perl536` attribute which wa
removed recently.
2024-09-15 07:05:28 +01:00
Tobias Mayer 8df266da79 pkgsStatic.perl: fix build 2024-09-07 19:09:49 +02:00
Marcus Ramberg 384f9f8336 perl: 5.38.2 -> 5.40.0
- perl: perl538 -> perl540
- perl: disable parallel building as it fails for 5.40
- perlPackages: perl538Packages -> perl540Packages
- perlCross:  84db4c7 -> 1.6
2024-09-07 19:09:39 +02:00
github-actions[bot] 0629545b27 Merge master into staging-next 2024-08-27 00:13:08 +00:00
Jade Lovelace 5dfdb09561 tree-wide: remove eelco as maintainer from things he no longer maintains
While preparing this change, I read the git blame on all of the files I
touched. I saw a working lifetime of building this system which we use
every day and love dearly and keep maintained ourselves. I saw commits
from a 14 year range between 2003 to 2017!! I could not be more thankful
for Eelco's work on building large parts of the foundation of nixpkgs
that all of us rely on now.

However, the end date of that range of the files I looked at the blame
on was 2017. I did not see surviving code from any newer date than that.
Looking at the Git logs, Eelco has been working on other things, and
that's totally fine.

However, it means that our maintenance metadata is out of date on a lot
of packages, and *that*'s the reason I am submitting this change. There
are a lot of packages that don't have anyone with their name on them to
be pinged if they need attention, even if they have had recent activity
(although it is never clear if recent activity was just someone fixing
it because ZHF or because the package actually matters to them).
There are a lot of packages with storied history that maybe don't need
to be in the set anymore at all since they have not been touched in
years; or maybe they are simply finished.

Empty maintainer lists should be a sign that we need to figure out who
maintains it or potentially remove it if it has rotted, and allowing the
maintainer list to be empty if it is already not maintained is part of a
healthy repository ecology.

Either way, I would like to have the maintenance metadata not mislead
anyone into sending Eelco emails about packages he doesn't, in practice,
work on anymore. I have not removed his name from everything; there are
some things that he is the upstream for or has worked on more recently,
for instance, like Nix, which I have left alone.
2024-08-21 01:17:45 -07:00
John Ericson c4a733d8e4 Merge pull request #320466 from rhelmot/freebsd-perl-env
perl: add cc in addition to makeBinaryWrapper
2024-08-15 14:15:57 -05:00
Audrey Dutcher f293272682 perl: add cc in addition to makeBinaryWrapper. see NixOS#311794
The "correct" solution to this problem (makeBinaryWrapper fails to be
able to compile the binary wrapper when building a freebsd cross env) is
that makeBinaryWrapper should propagate or embed a reference to the
compiler. However, this causes build failures on musl, so this will have
to do for now.
2024-07-24 12:40:30 -07:00
John Ericson 6389a88c08 Merge pull request #318166 from rhelmot/freebsd-perl-cross
perl: explicitly tell FreeBSD cross that crypt is available
2024-06-17 17:34:23 -04:00
Audrey Dutcher f6e67788cb perl: explicitly tell FreeBSD cross that crypt is available 2024-06-16 22:19:11 -07:00
Alexis Hildebrandt f8c4a98e8e treewide: Remove the definite article from meta.description
nix run nixpkgs#silver-searcher -- -G '\.nix$' -0l 'description.*"([Tt]he)? ' pkgs \
  | xargs -0 nix run nixpkgs#gnused -- -i '' -Ee 's/(description.*")[Tt]he (.)/\1\U\2/'
2024-06-09 23:08:46 +02:00
Wolfgang Walther b5a8fcb949 perl: fix spelling of filename 2024-04-01 15:19:58 +02:00
Stig Palmquist b04b0d0ee0 perl: enableParallelBuilding when not crossCompiling
enableParallelBuilding=false was inadvertently set in f4162143, this
commit reverts to the previous behavior of disabling parallel builds
only during during cross compilation.

The change was made due to problems with local builds during the
upgrade to perl 5.38.0, and should not have been included in the commit.
2024-03-04 05:35:11 +01:00
Stig Palmquist 9625705020 perl.perl-cross: 1.5 -> 84db4c71 2023-11-30 12:08:46 +01:00