···1111 sha256 = "sha256-xZFQQDK+yGAv4IbuNe2dvNa3GDASeJY2mOYw94goAIM=";
1212 };
13131414- # Set vendorSha256 to null because dstask vendors its dependencies (meaning
1414+ # Set vendorHash to null because dstask vendors its dependencies (meaning
1515 # that third party dependencies are stored in the repository).
1616 #
1717 # Ref <https://github.com/NixOS/nixpkgs/pull/87383#issuecomment-633204382>
···38383939 (cd "$root" && update-source-version "sourcehut.python.pkgs.$1" "$version")
40404141- # Update vendorSha256 of Go modules
4141+ # Update vendorHash of Go modules
4242 retry=true
4343 while "$retry"; do
4444 retry=false;
···11+{ lib, fetchFromGitHub, buildGoModule, installShellFiles }:
22+33+buildGoModule rec {
44+ pname = "orchard";
55+ version = "0.12.0";
66+77+ src = fetchFromGitHub {
88+ owner = "cirruslabs";
99+ repo = pname;
1010+ rev = version;
1111+ hash = "sha256-+QNYlZ3/GiDtCySZPOlrDy03lkdGGvbFCWidQhbZJYQ=";
1212+ # populate values that require us to use git. By doing this in postFetch we
1313+ # can delete .git afterwards and maintain better reproducibility of the src.
1414+ leaveDotGit = true;
1515+ postFetch = ''
1616+ cd "$out"
1717+ git rev-parse HEAD > $out/COMMIT
1818+ find "$out" -name .git -print0 | xargs -0 rm -rf
1919+ '';
2020+ };
2121+2222+ vendorHash = "sha256-BrzS+QtpGUHcYNNmSI6FlBtcYwNFri7R6nlVvFihdb4=";
2323+2424+ nativeBuildInputs = [ installShellFiles ];
2525+2626+ ldflags = [
2727+ "-w"
2828+ "-s"
2929+ "-X github.com/cirruslabs/orchard/internal/version.Version=${version}"
3030+ ];
3131+3232+ # ldflags based on metadata from git and source
3333+ preBuild = ''
3434+ ldflags+=" -X github.com/cirruslabs/orchard/internal/version.Commit=$(cat COMMIT)"
3535+ '';
3636+3737+ subPackages = [ "cmd/orchard" ];
3838+3939+ postInstall = ''
4040+ export HOME="$(mktemp -d)"
4141+ installShellCompletion --cmd orchard \
4242+ --bash <($out/bin/orchard completion bash) \
4343+ --zsh <($out/bin/orchard completion zsh) \
4444+ --fish <($out/bin/orchard completion fish)
4545+ '';
4646+4747+ meta = with lib; {
4848+ mainProgram = "orchard";
4949+ description =
5050+ "Orchestrator for running Tart Virtual Machines on a cluster of Apple Silicon devices";
5151+ homepage = "https://github.com/cirruslabs/orchard";
5252+ license = licenses.fairsource09;
5353+ maintainers = with maintainers; [ techknowlogick ];
5454+ };
5555+}
+6-12
pkgs/data/documentation/zeal/default.nix
···17171818let
1919 isQt5 = lib.versions.major qtbase.version == "5";
2020+2021in
2122stdenv.mkDerivation (finalAttrs: {
2223 pname = "zeal";
2323- version = "0.6.1.20230907"; # unstable-date format not suitable for cmake
2424+ version = "0.7.0";
24252526 src = fetchFromGitHub {
2627 owner = "zealdocs";
2728 repo = "zeal";
2828- rev = "20249153077964d01c7c36b9f4042a40e8c8fbf1";
2929- hash = "sha256-AyfpMq0R0ummTGvyUHOh/XBUeVfkFwo1VyyLSGoTN8w=";
2929+ rev = "v${finalAttrs.version}";
3030+ hash = "sha256-s1FaazHVtWE697BO0hIOgZVowdkq68R9x327ZnJRnlo=";
3031 };
31323232- # we only need this if we are using a version that hasn't been released. We
3333- # could also match on the "VERSION x.y.z" bit but then it would have to be
3434- # updated based on whatever is the latest release, so instead just rewrite the
3535- # line.
3633 postPatch = ''
3737- sed -i CMakeLists.txt \
3838- -e 's@^project.*@project(Zeal VERSION ${finalAttrs.version})@'
3939- '' + lib.optionalString (!isQt5) ''
4040- substituteInPlace src/app/CMakeLists.txt \
4141- --replace "COMPONENTS Widgets" "COMPONENTS Widgets QmlIntegration"
3434+ substituteInPlace CMakeLists.txt \
3535+ --replace 'ZEAL_VERSION_SUFFIX "-dev"' 'ZEAL_VERSION_SUFFIX ""'
4236 '';
43374438 nativeBuildInputs = [
···11+#!/usr/bin/env nix-shell
22+#!nix-shell -i python3 -p "python3.withPackages (ps: [ ps.beautifulsoup4 ps.lxml ])"
33+from enum import Enum
44+from bs4 import BeautifulSoup, NavigableString, Tag
55+from dataclasses import dataclass
66+import json
77+import pathlib
88+import re
99+import subprocess
1010+import urllib.request
1111+import sys
1212+1313+1414+HERE = pathlib.Path(__file__).parent
1515+ROOT = HERE.parent.parent.parent.parent
1616+VERSIONS_FILE = HERE / "kernels-org.json"
1717+1818+class KernelNature(Enum):
1919+ MAINLINE = 1
2020+ STABLE = 2
2121+ LONGTERM = 3
2222+2323+@dataclass
2424+class KernelRelease:
2525+ nature: KernelNature
2626+ version: str
2727+ date: str
2828+ link: str
2929+ eol: bool = False
3030+3131+def parse_release(release: Tag) -> KernelRelease | None:
3232+ columns: list[Tag] = list(release.find_all('td'))
3333+ try:
3434+ nature = KernelNature[columns[0].get_text().rstrip(':').upper()]
3535+ except KeyError:
3636+ return None
3737+3838+ version = columns[1].get_text().rstrip(' [EOL]')
3939+ date = columns[2].get_text()
4040+ link = columns[3].find('a')
4141+ if link is not None and isinstance(link, Tag):
4242+ link = link.attrs.get('href')
4343+ assert link is not None, f'link for kernel {version} is non-existent'
4444+ eol = bool(release.find(class_='eolkernel'))
4545+4646+ return KernelRelease(nature=nature, version=version, date=date, link=link, eol=eol)
4747+4848+def get_branch(version: str):
4949+ # This is a testing kernel.
5050+ if 'rc' in version:
5151+ return 'testing'
5252+ else:
5353+ major, minor, *_ = version.split(".")
5454+ return f"{major}.{minor}"
5555+5656+5757+def get_hash(url: str):
5858+ return subprocess.check_output(["nix-prefetch-url", url]).decode().strip()
5959+6060+6161+def commit(message):
6262+ return subprocess.check_call(["git", "commit", "-m", message, VERSIONS_FILE])
6363+6464+6565+def main():
6666+ kernel_org = urllib.request.urlopen("https://kernel.org/")
6767+ soup = BeautifulSoup(kernel_org.read().decode(), "lxml")
6868+ release_table = soup.find(id='releases')
6969+ if not release_table or isinstance(release_table, NavigableString):
7070+ print(release_table)
7171+ print('Failed to find the release table on https://kernel.org')
7272+ sys.exit(1)
7373+7474+ releases = release_table.find_all('tr')
7575+ parsed_releases = filter(None, [parse_release(release) for release in releases])
7676+ all_kernels = json.load(VERSIONS_FILE.open())
7777+7878+ for kernel in parsed_releases:
7979+ branch = get_branch(kernel.version)
8080+ nixpkgs_branch = branch.replace('.', '_')
8181+8282+ old_version = all_kernels.get(branch, {}).get("version")
8383+ if old_version == kernel.version:
8484+ print(f"linux_{nixpkgs_branch}: {kernel.version} is latest, skipping...")
8585+ continue
8686+8787+ if old_version is None:
8888+ message = f"linux_{nixpkgs_branch}: init at {kernel.version}"
8989+ else:
9090+ message = f"linux_{nixpkgs_branch}: {old_version} -> {kernel.version}"
9191+9292+ print(message)
9393+9494+ all_kernels[branch] = {"version": kernel.version, "hash": get_hash(kernel.link)}
9595+9696+ with VERSIONS_FILE.open("w") as fd:
9797+ json.dump(all_kernels, fd, indent=4)
9898+ fd.write("\n") # makes editorconfig happy
9999+100100+ commit(message)
101101+102102+103103+if __name__ == "__main__":
104104+ main()
+9-67
pkgs/os-specific/linux/kernel/update.sh
···11#!/usr/bin/env bash
22-set -e
33-44-# Get the latest versions from kernel.org
55-LINUXSED='s/.*linux-\([0-9]\+\(.[0-9]\+\)*\).*/\1/p'
66-KDATA="$(curl -s https://www.kernel.org | sed -n -e '/Download complete/p')"
77-VERSIONS=($(sed -n -e $LINUXSED <<< "$KDATA" | sort -Vr))
88-99-# Remove mainline version if there is a stable update
1010-# Note due to sorting these two will always exist at the bottom
1111-if grep -q "^${VERSIONS[1]}" <<< "${VERSIONS[0]}"; then
1212- VERSIONS=(${VERSIONS[@]:0:1} ${VERSIONS[@]:2})
1313-fi
1414-1515-# Inspect each file and see if it has the latest version
1616-NIXPKGS="$(git rev-parse --show-toplevel)"
1717-ls $NIXPKGS/pkgs/os-specific/linux/kernel | while read FILE; do
1818- KERNEL="$(sed -n -e $LINUXSED <<< "$FILE")"
1919- [ -z "$KERNEL" ] && continue
2020-2121- # Find the matching new kernel version
2222- MATCHING=""
2323- for V in "${VERSIONS[@]}"; do
2424- if grep -q "^$KERNEL" <<< "$V"; then
2525- MATCHING="$V"
2626- break
2727- fi
2828- done
2929- if [ -z "$MATCHING" ]; then
3030- echo "Out-of-support $KERNEL"
3131- continue
3232- fi
3333-3434- # Inspect the nix expression to check for changes
3535- DATA="$(<$NIXPKGS/pkgs/os-specific/linux/kernel/$FILE)"
3636- URL="$(sed -n -e 's/.*url = "\(.*\)";.*/\1/p' <<< "$DATA" | sed -e "s/\${version}/$MATCHING/g")"
3737- OLDVER=$(sed -n -e 's/.*version = "\(.*\)".*/\1/p' <<< "$DATA")
3838- if [ "$OLDVER" = "$V" ]; then
3939- echo "No updates for $KERNEL"
4040- continue
4141- fi
4242-4343- # Download the new file for the hash
4444- if ! HASH="$(nix-prefetch-url $URL 2>/dev/null)"; then
4545- echo "Failed to get hash of $URL"
4646- continue
4747- fi
4848- sed -i -e "s/sha256 = \".*\"/sha256 = \"$HASH\"/g" $NIXPKGS/pkgs/os-specific/linux/kernel/$FILE
4949-5050- # Rewrite the expression
5151- sed -i -e '/version = /d' $NIXPKGS/pkgs/os-specific/linux/kernel/$FILE
5252- sed -i -e "\#buildLinux (args // rec {#a \ version = \"$V\";" $NIXPKGS/pkgs/os-specific/linux/kernel/$FILE
5353-5454- # Commit the changes
5555- git add -u $NIXPKGS/pkgs/os-specific/linux/kernel/$FILE
5656- git commit -m "linux: $OLDVER -> $V" >/dev/null 2>&1
5757-5858- echo "Updated $OLDVER -> $V"
5959-done
22+cd "$(dirname "$(readlink -f "$0")")" || exit
6036161-# Allowing errors again: one broken update script shouldn't inhibit the
6262-# update of other kernel variants.
6363-set +e
44+echo "Update linux (mainline)"
55+COMMIT=1 ./update-mainline.py || echo "update-mainline failed with exit code $?"
6466565-echo Update linux-rt
6666-COMMIT=1 $NIXPKGS/pkgs/os-specific/linux/kernel/update-rt.sh || echo "update-rt failed with exit code $?"
77+echo "Update linux-rt"
88+COMMIT=1 ./update-rt.sh || echo "update-rt failed with exit code $?"
6796868-echo Update linux-libre
6969-COMMIT=1 $NIXPKGS/pkgs/os-specific/linux/kernel/update-libre.sh || echo "update-libre failed with exit code $?"
1010+echo "Update linux-libre"
1111+COMMIT=1 ./update-libre.sh || echo "update-libre failed with exit code $?"
70127171-echo Update linux-hardened
7272-COMMIT=1 $NIXPKGS/pkgs/os-specific/linux/kernel/hardened/update.py || echo "update-hardened failed with exit code $?"
1313+echo "Update linux-hardened"
1414+COMMIT=1 ./hardened/update.py || echo "update-hardened failed with exit code $?"
+2-2
pkgs/servers/apache-airflow/python-package.nix
···8787, enabledProviders ? []
8888}:
8989let
9090- version = "2.7.0";
9090+ version = "2.7.1";
91919292 airflow-src = fetchFromGitHub rec {
9393 owner = "apache";
···9696 # Download using the git protocol rather than using tarballs, because the
9797 # GitHub archive tarballs don't appear to include tests
9898 forceFetchGit = true;
9999- hash = "sha256-zB4PWcPkm+lat4tNfVld051RHlC1dW2EbgyoxDao52o=";
9999+ hash = "sha256-TxlOdazdaEKt9U+t/zjRChUABLhVTqXvH8nUbYrRrQs=";
100100 };
101101102102 # airflow bundles a web interface, which is built using webpack by an undocumented shell script in airflow's source tree.
+2
pkgs/servers/dns/nsd/default.nix
···29293030 buildInputs = [ libevent openssl ];
31313232+ enableParallelBuilding = true;
3333+3234 configureFlags =
3335 let edf = c: o: if c then ["--enable-${o}"] else ["--disable-${o}"];
3436 in edf bind8Stats "bind8-stats"
+9
pkgs/servers/mail/spamassassin/default.nix
···33perlPackages.buildPerlPackage rec {
44 pname = "SpamAssassin";
55 version = "4.0.0";
66+ rulesRev = "r1905950";
6778 src = fetchurl {
89 url = "mirror://apache/spamassassin/source/Mail-${pname}-${version}.tar.bz2";
910 hash = "sha256-5aoXBQowvHK6qGr9xgSMrepNHsLsxh14dxegWbgxnog=";
1111+ };
1212+ defaultRulesSrc = fetchurl {
1313+ url = "mirror://apache/spamassassin/source/Mail-${pname}-rules-${version}.${rulesRev}.tgz";
1414+ hash = "sha256-rk/7uRfrx/76ckD8W7UVHdpmP45AWRYa18m0Lu0brG0=";
1015 };
11161217 patches = [
···5257 postInstall = ''
5358 mkdir -p $out/share/spamassassin
5459 mv "rules/"* $out/share/spamassassin/
6060+6161+ tar -xzf ${defaultRulesSrc} -C $out/share/spamassassin/
6262+ local moduleversion="$(${perlPackages.perl}/bin/perl -I lib -e 'use Mail::SpamAssassin; print $Mail::SpamAssassin::VERSION')"
6363+ sed -i -e "s/@@VERSION@@/$moduleversion/" $out/share/spamassassin/*.cf
55645665 for n in "$out/bin/"*; do
5766 # Skip if this isn't a perl script