···9 graphene-hardened = {
10 libPath = "${pkgs.graphene-hardened-malloc}/lib/libhardened_malloc.so";
11 description = ''
12- An allocator designed to mitigate memory corruption attacks, such as
13- those caused by use-after-free bugs.
00000000000000014 '';
15 };
16
···9 graphene-hardened = {
10 libPath = "${pkgs.graphene-hardened-malloc}/lib/libhardened_malloc.so";
11 description = ''
12+ Hardened memory allocator coming from GrapheneOS project.
13+ The default configuration template has all normal optional security
14+ features enabled and is quite aggressive in terms of sacrificing
15+ performance and memory usage for security.
16+ '';
17+ };
18+19+ graphene-hardened-light = {
20+ libPath = "${pkgs.graphene-hardened-malloc}/lib/libhardened_malloc-light.so";
21+ description = ''
22+ Hardened memory allocator coming from GrapheneOS project.
23+ The light configuration template disables the slab quarantines,
24+ write after free check, slot randomization and raises the guard
25+ slab interval from 1 to 8 but leaves zero-on-free and slab canaries enabled.
26+ The light configuration has solid performance and memory usage while still
27+ being far more secure than mainstream allocators with much better security
28+ properties.
29 '';
30 };
31
+19-15
nixos/modules/programs/wshowkeys.nix
···1-{ config, lib, pkgs, ... }:
2-3-with lib;
4-005let
6 cfg = config.programs.wshowkeys;
7-in {
8- meta.maintainers = with maintainers; [ primeos ];
9-10 options = {
11 programs.wshowkeys = {
12- enable = mkEnableOption ''
13 wshowkeys (displays keypresses on screen on supported Wayland
14 compositors). It requires root permissions to read input events, but
15 these permissions are dropped after startup'';
016 };
17 };
1819- config = mkIf cfg.enable {
20- security.wrappers.wshowkeys =
21- { setuid = true;
22- owner = "root";
23- group = "root";
24- source = "${pkgs.wshowkeys}/bin/wshowkeys";
25- };
26 };
0027}
···66 "rq"
67 ];
680000069 meta = with lib; {
70 description = "Library for creating background jobs and processing them";
71 homepage = "https://github.com/nvie/rq/";
···66 "rq"
67 ];
6869+ disabledTests = [
70+ # AttributeError
71+ "test_clean_large_registry"
72+ ];
73+74 meta = with lib; {
75 description = "Library for creating background jobs and processing them";
76 homepage = "https://github.com/nvie/rq/";
···1+# etcd
2+3+4+## Upstream release cadence and support
5+6+The etcd project maintains release branches for the current version and previous release.
7+8+For example, when v3.5 is the current version, v3.4 is supported. When v3.6 is released, v3.4 goes out of support.
9+10+Reference: https://etcd.io/docs/v3.5/op-guide/versioning/
11+12+13+## NixOS release and etcd version upkeep
14+15+Every major/minor version bump of `etcd` top-level alias in nixpkgs requires a notification in the next NixOS release notes scheduling the removal of the now unsupported etcd version.
16+17+After every NixOS release, the unsupported etcd versions should be removed by etcd maintainers.
18+19+20+## User guidelines on etcd upgrades
21+22+Before upgrading a NixOS release, certify to upgrade etcd to the latest version in the current used release.
23+24+Manual steps might be required for the upgrade.
25+26+NixOS release notes might have instructions on how to proceed on upgrades.