- Updates gnupg 2.4.8 to 2.4.9
- Update freepg patches to source-2.4.9-freepg
- Use `substituteInPlace` with `--replace-fail` to make keyserver change
more robust.
- Update `static.patch` to generated `configure` (Thanks alyssais)
This commit was created by a combination of scripts and tools:
- an ast-grep script to prefix things in meta with `lib.`,
- a modified nixf-diagnose / nixf combination to remove unused `with
lib;`, and
- regular nixfmt.
Co-authored-by: Wolfgang Walther <walther@technowledgy.de>
Correct typo on `postInstall` attribute of `gnupg` derivation.
Commit 6f635e3 introduced a code snippet in `postInstall` to add libexec
tools from gnupg (such as gpg-preset-passphrase) to `$out/bin/`,
which would eventually appear on `PATH`. However with a minor typo,
missing the necessary asterisk.
This was added because the static patch modified configure.ac,
requiring configure to be regenerated. For reasons we don't totally
understand, regenerating configure has all sorts of other undesirable
side effects. So to unbreak things, instead of regenerating
configure, we can include just the configure changes relevant to the
static patch in the patch file.
Fixes: 35c9771eee ("gnupg: fix static")
Patch has been submitted upstream, but past experience trying to send
patches to GnuPG does not make me optimistic that this will be dealt
with any time soon. If it doesn't work out upstream I'll submit it to
freepg, whose patchset we're already using.
The last upstream release was 6 years ago and there is no remaining
usage within nixpkgs. Given it is a security sensitive package, it would
be nice to remove it before running into issues.
Add patches to GnuPG 2.4 from FreePG, a common resource for GnuPG
downstream packagers to track, maintain, and apply commonly-used patches
for GnuPG that have been refused by upstream.
The purpose of adding these patches to nixpkgs is to ensure
compatibility with other OpenPGP tools.
https://gitlab.com/freepg/gnupg/
After final improvements to the official formatter implementation,
this commit now performs the first treewide reformat of Nix files using it.
This is part of the implementation of RFC 166.
Only "inactive" files are reformatted, meaning only files that
aren't being touched by any PR with activity in the past 2 months.
This is to avoid conflicts for PRs that might soon be merged.
Later we can do a full treewide reformat to get the rest,
which should not cause as many conflicts.
A CI check has already been running for some time to ensure that new and
already-formatted files are formatted, so the files being reformatted here
should also stay formatted.
This commit was automatically created and can be verified using
nix-build https://github.com/infinisil/treewide-nixpkgs-reformat-script/archive/a08b3a4d199c6124ac5b36a889d9099b4383463f.tar.gz \
--argstr baseRev 57b193d8dd
result/bin/apply-formatting $NIXPKGS_PATH
After final improvements to the official formatter implementation,
this commit now performs the first treewide reformat of Nix files using it.
This is part of the implementation of RFC 166.
Only "inactive" files are reformatted, meaning only files that
aren't being touched by any PR with activity in the past 2 months.
This is to avoid conflicts for PRs that might soon be merged.
Later we can do a full treewide reformat to get the rest,
which should not cause as many conflicts.
A CI check has already been running for some time to ensure that new and
already-formatted files are formatted, so the files being reformatted here
should also stay formatted.
This commit was automatically created and can be verified using
nix-build https://github.com/infinisil/treewide-nixpkgs-reformat-script/archive/a08b3a4d199c6124ac5b36a889d9099b4383463f.tar.gz \
--argstr baseRev b32a094368
result/bin/apply-formatting $NIXPKGS_PATH
In preparation for the deprecation of `stdenv.isX`.
These shorthands are not conducive to cross-compilation because they
hide the platforms.
Darwin might get cross-compilation for which the continued usage of `stdenv.isDarwin` will get in the way
One example of why this is bad and especially affects compiler packages
https://www.github.com/NixOS/nixpkgs/pull/343059
There are too many files to go through manually but a treewide should
get users thinking when they see a `hostPlatform.isX` in a place where it
doesn't make sense.
```
fd --type f "\.nix" | xargs sd --fixed-strings "stdenv.is" "stdenv.hostPlatform.is"
fd --type f "\.nix" | xargs sd --fixed-strings "stdenv'.is" "stdenv'.hostPlatform.is"
fd --type f "\.nix" | xargs sd --fixed-strings "clangStdenv.is" "clangStdenv.hostPlatform.is"
fd --type f "\.nix" | xargs sd --fixed-strings "gccStdenv.is" "gccStdenv.hostPlatform.is"
fd --type f "\.nix" | xargs sd --fixed-strings "stdenvNoCC.is" "stdenvNoCC.hostPlatform.is"
fd --type f "\.nix" | xargs sd --fixed-strings "inherit (stdenv) is" "inherit (stdenv.hostPlatform) is"
fd --type f "\.nix" | xargs sd --fixed-strings "buildStdenv.is" "buildStdenv.hostPlatform.is"
fd --type f "\.nix" | xargs sd --fixed-strings "effectiveStdenv.is" "effectiveStdenv.hostPlatform.is"
fd --type f "\.nix" | xargs sd --fixed-strings "originalStdenv.is" "originalStdenv.hostPlatform.is"
```
GnuPG upstream changed some of its behavior on the 2.4 branch to use its
own, non-standardized format for keys and encrypted data by default.
This affects in particular the way that keys are generated, and
algorithm capability flags within now signal the ability to use GnuPG's
own AEAD encryption format.
Notably, these formats are not compatible with other implementations of
OpenPGP. It is based on a draft spec that is specific to GnuPG
(draft-koch-openpgp-2015-rfc4880bis), and not compatible with the format
that is on track to be standardized as upcoming OpenPGP version 6.
The political circumstances that led to this issue are complex (and a
bit dumb), but in the end GnuPG emitting incompatible packets is
certainly in noone's interest. This patch is a revert of a GnuPG
upstream commit as it is applied by Fedora, I suggest we follow suit
until the situation becomes more clear.
See also: https://src.fedoraproject.org/rpms/gnupg2/pull-request/15
nixpkgs-ci[bot]