···16 ###### implementation
17 config = lib.mkIf config.hardware.cpu.amd.updateMicrocode {
18 # Microcode updates must be the first item prepended in the initrd
19- boot.initrd.prepend = lib.mkOrder 1 [ "${pkgs.microcodeAmd}/amd-ucode.img" ];
20 };
2122}
···16 ###### implementation
17 config = lib.mkIf config.hardware.cpu.amd.updateMicrocode {
18 # Microcode updates must be the first item prepended in the initrd
19+ boot.initrd.prepend = lib.mkOrder 1 [ "${pkgs.microcode-amd}/amd-ucode.img" ];
20 };
2122}
+1-1
nixos/modules/hardware/cpu/intel-microcode.nix
···16 ###### implementation
17 config = lib.mkIf config.hardware.cpu.intel.updateMicrocode {
18 # Microcode updates must be the first item prepended in the initrd
19- boot.initrd.prepend = lib.mkOrder 1 [ "${pkgs.microcodeIntel}/intel-ucode.img" ];
20 };
2122}
···16 ###### implementation
17 config = lib.mkIf config.hardware.cpu.intel.updateMicrocode {
18 # Microcode updates must be the first item prepended in the initrd
19+ boot.initrd.prepend = lib.mkOrder 1 [ "${pkgs.microcode-intel}/intel-ucode.img" ];
20 };
2122}
+7-7
nixos/modules/security/acme/default.nix
···166 # ensure all required lock files exist, but none more
167 script = ''
168 GLOBIGNORE="${lib.concatStringsSep ":" concurrencyLockfiles}"
169- rm -f *
170 unset GLOBIGNORE
171172 xargs touch <<< "${toString concurrencyLockfiles}"
···323 cat key.pem fullchain.pem > full.pem
324325 # Group might change between runs, re-apply it
326- chown '${user}:${data.group}' *
327328 # Default permissions make the files unreadable by group + anon
329 # Need to be readable by group
330- chmod 640 *
331 '';
332 };
333···410411 expiration_line="$(
412 set -euxo pipefail
413- openssl x509 -noout -enddate <$pem \
414 | grep notAfter \
415 | sed -e 's/^notAfter=//'
416 )"
···418419 expiration_date="$(date -d "$expiration_line" +%s)"
420 now="$(date +%s)"
421- expiration_s=$[expiration_date - now]
422- expiration_days=$[expiration_s / (3600 * 24)] # rounds down
423424 [[ $expiration_days -gt ${toString data.validMinDays} ]]
425 }
···441 # Check if we can renew.
442 # We can only renew if the list of domains has not changed.
443 # We also need an account key. Avoids #190493
444- if cmp -s domainhash.txt certificates/domainhash.txt && [ -e 'certificates/${keyName}.key' -a -e 'certificates/${keyName}.crt' -a -n "$(find accounts -name '${data.email}.key')" ]; then
445446 # Even if a cert is not expired, it may be revoked by the CA.
447 # Try to renew, and silently fail if the cert is not expired.
···166 # ensure all required lock files exist, but none more
167 script = ''
168 GLOBIGNORE="${lib.concatStringsSep ":" concurrencyLockfiles}"
169+ rm -f -- *
170 unset GLOBIGNORE
171172 xargs touch <<< "${toString concurrencyLockfiles}"
···323 cat key.pem fullchain.pem > full.pem
324325 # Group might change between runs, re-apply it
326+ chown '${user}:${data.group}' -- *
327328 # Default permissions make the files unreadable by group + anon
329 # Need to be readable by group
330+ chmod 640 -- *
331 '';
332 };
333···410411 expiration_line="$(
412 set -euxo pipefail
413+ openssl x509 -noout -enddate <"$pem" \
414 | grep notAfter \
415 | sed -e 's/^notAfter=//'
416 )"
···418419 expiration_date="$(date -d "$expiration_line" +%s)"
420 now="$(date +%s)"
421+ expiration_s=$((expiration_date - now))
422+ expiration_days=$((expiration_s / (3600 * 24))) # rounds down
423424 [[ $expiration_days -gt ${toString data.validMinDays} ]]
425 }
···441 # Check if we can renew.
442 # We can only renew if the list of domains has not changed.
443 # We also need an account key. Avoids #190493
444+ if cmp -s domainhash.txt certificates/domainhash.txt && [ -e 'certificates/${keyName}.key' ] && [ -e 'certificates/${keyName}.crt' ] && [ -n "$(find accounts -name '${data.email}.key')" ]; then
445446 # Even if a cert is not expired, it may be revoked by the CA.
447 # Try to renew, and silently fail if the cert is not expired.