···1616 ###### implementation
1717 config = lib.mkIf config.hardware.cpu.amd.updateMicrocode {
1818 # Microcode updates must be the first item prepended in the initrd
1919- boot.initrd.prepend = lib.mkOrder 1 [ "${pkgs.microcodeAmd}/amd-ucode.img" ];
1919+ boot.initrd.prepend = lib.mkOrder 1 [ "${pkgs.microcode-amd}/amd-ucode.img" ];
2020 };
21212222}
+1-1
nixos/modules/hardware/cpu/intel-microcode.nix
···1616 ###### implementation
1717 config = lib.mkIf config.hardware.cpu.intel.updateMicrocode {
1818 # Microcode updates must be the first item prepended in the initrd
1919- boot.initrd.prepend = lib.mkOrder 1 [ "${pkgs.microcodeIntel}/intel-ucode.img" ];
1919+ boot.initrd.prepend = lib.mkOrder 1 [ "${pkgs.microcode-intel}/intel-ucode.img" ];
2020 };
21212222}
+7-7
nixos/modules/security/acme/default.nix
···166166 # ensure all required lock files exist, but none more
167167 script = ''
168168 GLOBIGNORE="${lib.concatStringsSep ":" concurrencyLockfiles}"
169169- rm -f *
169169+ rm -f -- *
170170 unset GLOBIGNORE
171171172172 xargs touch <<< "${toString concurrencyLockfiles}"
···323323 cat key.pem fullchain.pem > full.pem
324324325325 # Group might change between runs, re-apply it
326326- chown '${user}:${data.group}' *
326326+ chown '${user}:${data.group}' -- *
327327328328 # Default permissions make the files unreadable by group + anon
329329 # Need to be readable by group
330330- chmod 640 *
330330+ chmod 640 -- *
331331 '';
332332 };
333333···410410411411 expiration_line="$(
412412 set -euxo pipefail
413413- openssl x509 -noout -enddate <$pem \
413413+ openssl x509 -noout -enddate <"$pem" \
414414 | grep notAfter \
415415 | sed -e 's/^notAfter=//'
416416 )"
···418418419419 expiration_date="$(date -d "$expiration_line" +%s)"
420420 now="$(date +%s)"
421421- expiration_s=$[expiration_date - now]
422422- expiration_days=$[expiration_s / (3600 * 24)] # rounds down
421421+ expiration_s=$((expiration_date - now))
422422+ expiration_days=$((expiration_s / (3600 * 24))) # rounds down
423423424424 [[ $expiration_days -gt ${toString data.validMinDays} ]]
425425 }
···441441 # Check if we can renew.
442442 # We can only renew if the list of domains has not changed.
443443 # We also need an account key. Avoids #190493
444444- if cmp -s domainhash.txt certificates/domainhash.txt && [ -e 'certificates/${keyName}.key' -a -e 'certificates/${keyName}.crt' -a -n "$(find accounts -name '${data.email}.key')" ]; then
444444+ if cmp -s domainhash.txt certificates/domainhash.txt && [ -e 'certificates/${keyName}.key' ] && [ -e 'certificates/${keyName}.crt' ] && [ -n "$(find accounts -name '${data.email}.key')" ]; then
445445446446 # Even if a cert is not expired, it may be revoked by the CA.
447447 # Try to renew, and silently fail if the cert is not expired.