Merge staging-next into staging

nixos/doc/manual/from_md/release-notes/rl-2305.section.xml

···
   </section>
   <section xml:id="sec-release-23.05-incompatibilities">
     <title>Backward Incompatibilities</title>
-    <itemizedlist spacing="compact">
+    <itemizedlist>
       <listitem>
         <para>
           <literal>carnix</literal> and <literal>cratesIO</literal> has
···
           and
           <link xlink:href="https://github.com/kolloch/crate2nix">crate2nix</link>
           instead.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The EC2 image module no longer fetches instance metadata in
+          stage-1. This results in a significantly smaller initramfs,
+          since network drivers no longer need to be included, and
+          faster boots, since metadata fetching can happen in parallel
+          with startup of other services. This breaks services which
+          rely on metadata being present by the time stage-2 is entered.
+          Anything which reads EC2 metadata from
+          <literal>/etc/ec2-metadata</literal> should now have an
+          <literal>after</literal> dependency on
+          <literal>fetch-ec2-metadata.service</literal>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The EC2 image module previously detected and automatically
+          mounted ext3-formatted instance store devices and partitions
+          in stage-1 (initramfs), storing <literal>/tmp</literal> on the
+          first discovered device. This behaviour, which only catered to
+          very specific use cases and could not be disabled, has been
+          removed. Users relying on this should provide their own
+          implementation, and probably use ext4 and perform the mount in
+          stage-2.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The EC2 image module previously detected and activated
+          swap-formatted instance store devices and partitions in
+          stage-1 (initramfs). This behaviour has been removed. Users
+          relying on this should provide their own implementation.
         </para>
       </listitem>
     </itemizedlist>

nixos/doc/manual/release-notes/rl-2305.section.md

···
 
 - `carnix` and `cratesIO` has been removed due to being unmaintained, use alternatives such as [naersk](https://github.com/nix-community/naersk) and [crate2nix](https://github.com/kolloch/crate2nix) instead.
 
+- The EC2 image module no longer fetches instance metadata in stage-1. This results in a significantly smaller initramfs, since network drivers no longer need to be included, and faster boots, since metadata fetching can happen in parallel with startup of other services.
+  This breaks services which rely on metadata being present by the time stage-2 is entered. Anything which reads EC2 metadata from `/etc/ec2-metadata` should now have an `after` dependency on `fetch-ec2-metadata.service`
+
+- The EC2 image module previously detected and automatically mounted ext3-formatted instance store devices and partitions in stage-1 (initramfs), storing `/tmp` on the first discovered device. This behaviour, which only catered to very specific use cases and could not be disabled, has been removed. Users relying on this should provide their own implementation, and probably use ext4 and perform the mount in stage-2.
+
+- The EC2 image module previously detected and activated swap-formatted instance store devices and partitions in stage-1 (initramfs). This behaviour has been removed. Users relying on this should provide their own implementation.
+
 ## Other Notable Changes {#sec-release-23.05-notable-changes}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->

nixos/maintainers/scripts/ec2/amazon-image.nix

···
 
     sizeMB = mkOption {
       type = with types; either (enum [ "auto" ]) int;
-      default = if config.ec2.hvm then 2048 else 8192;
+      default = 2048;
       example = 8192;
       description = lib.mdDoc "The size in MB of the image";
     };
···
       ''
         { modulesPath, ... }: {
           imports = [ "''${modulesPath}/virtualisation/amazon-image.nix" ];
-          ${optionalString config.ec2.hvm ''
-            ec2.hvm = true;
-          ''}
           ${optionalString config.ec2.efi ''
             ec2.efi = true;
           ''}
···
       pkgs = import ../../../.. { inherit (pkgs) system; }; # ensure we use the regular qemu-kvm package
 
       fsType = "ext4";
-      partitionTableType = if config.ec2.efi then "efi"
-                           else if config.ec2.hvm then "legacy+gpt"
-                           else "none";
+      partitionTableType = if config.ec2.efi then "efi" else "legacy+gpt";
 
       diskSize = cfg.sizeMB;
 

nixos/modules/virtualisation/amazon-image.nix

···
 
 let
   cfg = config.ec2;
-  metadataFetcher = import ./ec2-metadata-fetcher.nix {
-    inherit (pkgs) curl;
-    targetRoot = "$targetRoot/";
-    wgetExtraOptions = "-q";
-  };
 in
 
 {
···
   config = {
 
     assertions = [
-      { assertion = cfg.hvm;
-        message = "Paravirtualized EC2 instances are no longer supported.";
-      }
-      { assertion = cfg.efi -> cfg.hvm;
-        message = "EC2 instances using EFI must be HVM instances.";
-      }
       { assertion = versionOlder config.boot.kernelPackages.kernel.version "5.17";
         message = "ENA driver fails to build with kernel >= 5.17";
       }
     ];
 
-    boot.growPartition = cfg.hvm;
+    boot.growPartition = true;
 
     fileSystems."/" = mkIf (!cfg.zfs.enable) {
       device = "/dev/disk/by-label/nixos";
···
     boot.extraModulePackages = [
       config.boot.kernelPackages.ena
     ];
-    boot.initrd.kernelModules = [ "xen-blkfront" "xen-netfront" ];
-    boot.initrd.availableKernelModules = [ "ixgbevf" "ena" "nvme" ];
-    boot.kernelParams = mkIf cfg.hvm [ "console=ttyS0,115200n8" "random.trust_cpu=on" ];
+    boot.initrd.kernelModules = [ "xen-blkfront" ];
+    boot.initrd.availableKernelModules = [ "nvme" ];
+    boot.kernelParams = [ "console=ttyS0,115200n8" "random.trust_cpu=on" ];
 
     # Prevent the nouveau kernel module from being loaded, as it
     # interferes with the nvidia/nvidia-uvm modules needed for CUDA.
···
     # boot.
     boot.blacklistedKernelModules = [ "nouveau" "xen_fbfront" ];
 
-    # Generate a GRUB menu.  Amazon's pv-grub uses this to boot our kernel/initrd.
-    boot.loader.grub.version = if cfg.hvm then 2 else 1;
-    boot.loader.grub.device = if (cfg.hvm && !cfg.efi) then "/dev/xvda" else "nodev";
-    boot.loader.grub.extraPerEntryConfig = mkIf (!cfg.hvm) "root (hd0)";
+    boot.loader.grub.device = if cfg.efi then "nodev" else "/dev/xvda";
     boot.loader.grub.efiSupport = cfg.efi;
     boot.loader.grub.efiInstallAsRemovable = cfg.efi;
     boot.loader.timeout = 1;
···
       terminal_input console serial
     '';
 
-    boot.initrd.network.enable = true;
-
-    # Mount all formatted ephemeral disks and activate all swap devices.
-    # We cannot do this with the ‘fileSystems’ and ‘swapDevices’ options
-    # because the set of devices is dependent on the instance type
-    # (e.g. "m1.small" has one ephemeral filesystem and one swap device,
-    # while "m1.large" has two ephemeral filesystems and no swap
-    # devices).  Also, put /tmp and /var on /disk0, since it has a lot
-    # more space than the root device.  Similarly, "move" /nix to /disk0
-    # by layering a unionfs-fuse mount on top of it so we have a lot more space for
-    # Nix operations.
-    boot.initrd.postMountCommands =
-      ''
-        ${metadataFetcher}
-
-        diskNr=0
-        diskForUnionfs=
-        for device in /dev/xvd[abcde]*; do
-            if [ "$device" = /dev/xvda -o "$device" = /dev/xvda1 ]; then continue; fi
-            fsType=$(blkid -o value -s TYPE "$device" || true)
-            if [ "$fsType" = swap ]; then
-                echo "activating swap device $device..."
-                swapon "$device" || true
-            elif [ "$fsType" = ext3 ]; then
-                mp="/disk$diskNr"
-                diskNr=$((diskNr + 1))
-                if mountFS "$device" "$mp" "" ext3; then
-                    if [ -z "$diskForUnionfs" ]; then diskForUnionfs="$mp"; fi
-                fi
-            else
-                echo "skipping unknown device type $device"
-            fi
-        done
-
-        if [ -n "$diskForUnionfs" ]; then
-            mkdir -m 755 -p $targetRoot/$diskForUnionfs/root
-
-            mkdir -m 1777 -p $targetRoot/$diskForUnionfs/root/tmp $targetRoot/tmp
-            mount --bind $targetRoot/$diskForUnionfs/root/tmp $targetRoot/tmp
-
-            if [ "$(cat "$metaDir/ami-manifest-path")" != "(unknown)" ]; then
-                mkdir -m 755 -p $targetRoot/$diskForUnionfs/root/var $targetRoot/var
-                mount --bind $targetRoot/$diskForUnionfs/root/var $targetRoot/var
-
-                mkdir -p /unionfs-chroot/ro-nix
-                mount --rbind $targetRoot/nix /unionfs-chroot/ro-nix
-
-                mkdir -m 755 -p $targetRoot/$diskForUnionfs/root/nix
-                mkdir -p /unionfs-chroot/rw-nix
-                mount --rbind $targetRoot/$diskForUnionfs/root/nix /unionfs-chroot/rw-nix
-
-                unionfs -o allow_other,cow,nonempty,chroot=/unionfs-chroot,max_files=32768 /rw-nix=RW:/ro-nix=RO $targetRoot/nix
-            fi
-        fi
-      '';
-
-    boot.initrd.extraUtilsCommands =
-      ''
-        # We need swapon in the initrd.
-        copy_bin_and_libs ${pkgs.util-linux}/sbin/swapon
-      '';
+    systemd.services.fetch-ec2-metadata = {
+      wantedBy = [ "multi-user.target" ];
+      after = ["network-online.target"];
+      path = [ pkgs.curl ];
+      script = builtins.readFile ./ec2-metadata-fetcher.sh;
+      serviceConfig.Type = "oneshot";
+      serviceConfig.StandardOutput = "journal+console";
+    };
 
     # Allow root logins only using the SSH key that the user specified
     # at instance creation time.
···
 
     # Always include cryptsetup so that Charon can use it.
     environment.systemPackages = [ pkgs.cryptsetup ];
-
-    boot.initrd.supportedFilesystems = [ "unionfs-fuse" ];
 
     # EC2 has its own NTP server provided by the hypervisor
     networking.timeServers = [ "169.254.169.123" ];

nixos/modules/virtualisation/amazon-options.nix

···
 let
   inherit (lib) literalExpression types;
 in {
+  imports = [
+    (lib.mkRemovedOptionModule [ "ec2" "hvm" ] "Only HVM instances are supported, so specifying it is no longer necessary.")
+  ];
   options = {
     ec2 = {
       zfs = {
···
             };
           });
         };
-      };
-      hvm = lib.mkOption {
-        default = lib.versionAtLeast config.system.stateVersion "17.03";
-        internal = true;
-        description = lib.mdDoc ''
-          Whether the EC2 instance is a HVM instance.
-        '';
       };
       efi = lib.mkOption {
         default = pkgs.stdenv.hostPlatform.isAarch64;

nixos/modules/virtualisation/ec2-data.nix

···
 
         wantedBy = [ "multi-user.target" "sshd.service" ];
         before = [ "sshd.service" ];
+        after = ["fetch-ec2-metadata.service"];
 
         path = [ pkgs.iproute2 ];
 

nixos/modules/virtualisation/ec2-metadata-fetcher.nix

···
-{ curl, targetRoot, wgetExtraOptions }:
-# Note: be very cautious about dependencies, each dependency grows
-# the closure of the initrd. Ideally we would not even require curl,
-# but there is no reasonable way to send an HTTP PUT request without
-# it. Note: do not be fooled: the wget referenced in this script
-# is busybox's wget, not the fully featured one with --method support.
-#
-# Make sure that every package you depend on here is already listed as
-# a channel blocker for both the full-sized and small channels.
-# Otherwise, we risk breaking user deploys in released channels.
-#
-# Also note: OpenStack's metadata service for its instances aims to be
-# compatible with the EC2 IMDS. Where possible, try to keep the set of
-# fetched metadata in sync with ./openstack-metadata-fetcher.nix .
-''
-  metaDir=${targetRoot}etc/ec2-metadata
-  mkdir -m 0755 -p "$metaDir"
-  rm -f "$metaDir/*"
-
-  get_imds_token() {
-    # retry-delay of 1 selected to give the system a second to get going,
-    # but not add a lot to the bootup time
-    ${curl}/bin/curl \
-      -v \
-      --retry 3 \
-      --retry-delay 1 \
-      --fail \
-      -X PUT \
-      --connect-timeout 1 \
-      -H "X-aws-ec2-metadata-token-ttl-seconds: 600" \
-      http://169.254.169.254/latest/api/token
-  }
-
-  preflight_imds_token() {
-    # retry-delay of 1 selected to give the system a second to get going,
-    # but not add a lot to the bootup time
-    ${curl}/bin/curl \
-      -v \
-      --retry 3 \
-      --retry-delay 1 \
-      --fail \
-      --connect-timeout 1 \
-      -H "X-aws-ec2-metadata-token: $IMDS_TOKEN" \
-      http://169.254.169.254/1.0/meta-data/instance-id
-  }
-
-  try=1
-  while [ $try -le 3 ]; do
-    echo "(attempt $try/3) getting an EC2 instance metadata service v2 token..."
-    IMDS_TOKEN=$(get_imds_token) && break
-    try=$((try + 1))
-    sleep 1
-  done
-
-  if [ "x$IMDS_TOKEN" == "x" ]; then
-    echo "failed to fetch an IMDS2v token."
-  fi
-
-  try=1
-  while [ $try -le 10 ]; do
-    echo "(attempt $try/10) validating the EC2 instance metadata service v2 token..."
-    preflight_imds_token && break
-    try=$((try + 1))
-    sleep 1
-  done
-
-  echo "getting EC2 instance metadata..."
-
-  wget_imds() {
-    wget ${wgetExtraOptions} --header "X-aws-ec2-metadata-token: $IMDS_TOKEN" "$@";
-  }
-
-  wget_imds -O "$metaDir/ami-manifest-path" http://169.254.169.254/1.0/meta-data/ami-manifest-path
-  (umask 077 && wget_imds -O "$metaDir/user-data" http://169.254.169.254/1.0/user-data)
-  wget_imds -O "$metaDir/hostname" http://169.254.169.254/1.0/meta-data/hostname
-  wget_imds -O "$metaDir/public-keys-0-openssh-key" http://169.254.169.254/1.0/meta-data/public-keys/0/openssh-key
-''

nixos/modules/virtualisation/ec2-metadata-fetcher.sh

···
+metaDir=/etc/ec2-metadata
+mkdir -m 0755 -p "$metaDir"
+rm -f "$metaDir/*"
+
+get_imds_token() {
+  # retry-delay of 1 selected to give the system a second to get going,
+  # but not add a lot to the bootup time
+  curl \
+    --silent \
+    --show-error \
+    --retry 3 \
+    --retry-delay 1 \
+    --fail \
+    -X PUT \
+    --connect-timeout 1 \
+    -H "X-aws-ec2-metadata-token-ttl-seconds: 600" \
+    http://169.254.169.254/latest/api/token
+}
+
+preflight_imds_token() {
+  # retry-delay of 1 selected to give the system a second to get going,
+  # but not add a lot to the bootup time
+  curl \
+    --silent \
+    --show-error \
+    --retry 3 \
+    --retry-delay 1 \
+    --fail \
+    --connect-timeout 1 \
+    -H "X-aws-ec2-metadata-token: $IMDS_TOKEN" \
+    -o /dev/null \
+    http://169.254.169.254/1.0/meta-data/instance-id
+}
+
+try=1
+while [ $try -le 3 ]; do
+  echo "(attempt $try/3) getting an EC2 instance metadata service v2 token..."
+  IMDS_TOKEN=$(get_imds_token) && break
+  try=$((try + 1))
+  sleep 1
+done
+
+if [ "x$IMDS_TOKEN" == "x" ]; then
+  echo "failed to fetch an IMDS2v token."
+fi
+
+try=1
+while [ $try -le 10 ]; do
+  echo "(attempt $try/10) validating the EC2 instance metadata service v2 token..."
+  preflight_imds_token && break
+  try=$((try + 1))
+  sleep 1
+done
+
+echo "getting EC2 instance metadata..."
+
+get_imds() {
+  # Intentionally no --fail here, so that we proceed even if e.g. a
+  # 404 was returned (but we still fail if we can't reach the IMDS
+  # server).
+  curl --silent --show-error --header "X-aws-ec2-metadata-token: $IMDS_TOKEN" "$@"
+}
+
+get_imds -o "$metaDir/ami-manifest-path" http://169.254.169.254/1.0/meta-data/ami-manifest-path
+(umask 077 && get_imds -o "$metaDir/user-data" http://169.254.169.254/1.0/user-data)
+get_imds -o "$metaDir/hostname" http://169.254.169.254/1.0/meta-data/hostname
+get_imds -o "$metaDir/public-keys-0-openssh-key" http://169.254.169.254/1.0/meta-data/public-keys/0/openssh-key

nixos/tests/all-tests.nix

···
   pam-u2f = handleTest ./pam/pam-u2f.nix {};
   pam-ussh = handleTest ./pam/pam-ussh.nix {};
   pass-secret-service = handleTest ./pass-secret-service.nix {};
-  patroni = handleTest ./patroni.nix {};
+  patroni = handleTestOn ["x86_64-linux"] ./patroni.nix {};
   pantalaimon = handleTest ./matrix/pantalaimon.nix {};
   pantheon = handleTest ./pantheon.nix {};
   paperless = handleTest ./paperless.nix {};

nixos/tests/ec2.nix

···
       ../modules/testing/test-instrumentation.nix
       ../modules/profiles/qemu-guest.nix
       {
-        ec2.hvm = true;
-
         # Hack to make the partition resizing work in QEMU.
         boot.initrd.postDeviceCommands = mkBefore ''
           ln -s vda /dev/xvda

nixos/tests/patroni.nix

···
 
       start_all()
 
+      etcd.wait_for_unit("etcd.service")
+
       with subtest("should bootstrap a new patroni cluster"):
           wait_for_all_nodes_ready()
 

pkgs/applications/editors/emacs/generic.nix

···
     ++ lib.optionals stdenv.isLinux [ dbus libselinux alsa-lib acl gpm ]
     ++ lib.optionals withSystemd [ systemd ]
     ++ lib.optionals withX
-      [ xlibsWrapper libXaw Xaw3d libXpm libpng libjpeg giflib libtiff libXft
-        gconf cairo ]
-    ++ lib.optionals (withX || withNS) [ librsvg ]
+      [ xlibsWrapper libXaw Xaw3d gconf cairo ]
+    ++ lib.optionals (withX || withPgtk)
+      [ libXpm libpng libjpeg giflib libtiff ]
+    ++ lib.optionals (withX || withNS || withPgtk ) [ librsvg ]
     ++ lib.optionals withImageMagick [ imagemagick ]
     ++ lib.optionals (stdenv.isLinux && withX) [ m17n_lib libotf ]
     ++ lib.optional (withX && withGTK2) gtk2-x11
···
       then [ "--disable-ns-self-contained" ]
     else if withX
       then [ "--with-x-toolkit=${toolkit}" "--with-xft" "--with-cairo" ]
-      else [ "--with-x=no" "--with-xpm=no" "--with-jpeg=no" "--with-png=no"
-             "--with-gif=no" "--with-tiff=no" ])
+    else if withPgtk
+      then [ "--with-pgtk" ]
+    else [ "--with-x=no" "--with-xpm=no" "--with-jpeg=no" "--with-png=no"
+           "--with-gif=no" "--with-tiff=no" ])
     ++ lib.optionals withMacport [
       "--with-mac"
       "--enable-mac-app=$$out/Applications"
···
     ++ lib.optional withXwidgets "--with-xwidgets"
     ++ lib.optional nativeComp "--with-native-compilation"
     ++ lib.optional withImageMagick "--with-imagemagick"
-    ++ lib.optional withPgtk "--with-pgtk"
     ++ lib.optional withXinput2 "--with-xinput2"
     ++ lib.optional (!withToolkitScrollBars) "--without-toolkit-scroll-bars"
   ;

pkgs/applications/networking/browsers/chromium/upstream-info.json

···
     }
   },
   "dev": {
-    "version": "109.0.5410.0",
-    "sha256": "00g8q0qzl8kyc9j60nsvvjkr2x9js2xvbkmwp77p8b6gg0pyymjn",
-    "sha256bin64": "0ljhc5lqdy01apzyj96xzl931d904i37x62257s1h35w0j78mps0",
+    "version": "109.0.5414.10",
+    "sha256": "05yhfb5gznllh9rm6jhzaakj5kvdlxa8c4zqml10h297dbyr44bf",
+    "sha256bin64": "01fzjxrgzhccj75gvqj5w2xhqrphwzycdfqbsd6nc5p08jizpvy0",
     "deps": {
       "gn": {
-        "version": "2022-10-28",
+        "version": "2022-11-10",
         "url": "https://gn.googlesource.com/gn",
-        "rev": "a4d67be044b42963de801001e7146f9657c7fad4",
-        "sha256": "0wikkkx503ip5xr72bz6d6sh2k50h5wlz9y8vmasvnrz9kjmlv5b"
+        "rev": "1c4151ff5c1d6fbf7fa800b8d4bb34d3abc03a41",
+        "sha256": "02621c9nqpr4pwcapy31x36l5kbyd0vdgd0wdaxj5p8hrxk67d6b"
       }
     }
   },

pkgs/applications/radio/csdr/default.nix

···
     libsamplerate
   ];
 
+  hardeningDisable = lib.optional stdenv.isAarch64 "format";
+
   postFixup = ''
     substituteInPlace "$out"/lib/pkgconfig/csdr.pc \
       --replace '=''${prefix}//' '=/' \
···
   '';
 
   meta = with lib; {
-    broken = stdenv.isDarwin;
     homepage = "https://github.com/jketterl/csdr";
     description = "A simple DSP library and command-line tool for Software Defined Radio";
     license = licenses.gpl3Only;
     platforms = platforms.unix;
+    broken = stdenv.isDarwin;
     maintainers = teams.c3d2.members;
   };
 }

pkgs/development/compilers/mit-scheme/default.nix

···
-{ fetchurl, lib, stdenv, makeWrapper, gnum4, texinfo, texLive, automake,
-  autoconf, libtool, ghostscript, ncurses,
-  enableX11 ? false, xlibsWrapper }:
+{ fetchurl
+, lib
+, stdenv
+, makeWrapper
+, gnum4
+, texinfo
+, texLive
+, automake
+, autoconf
+, libtool
+, ghostscript
+, ncurses
+, enableX11 ? false, libX11
+}:
 
 let
   version = "11.2";
···
       sha256 = "17822hs9y07vcviv2af17p3va7qh79dird49nj50bwi9rz64ia3w";
     };
 
-  buildInputs = [ ncurses ] ++ lib.optional enableX11 xlibsWrapper;
+  buildInputs = [ ncurses ] ++ lib.optionals enableX11 [ libX11 ];
 
   configurePhase = ''
     runHook preConfigure

pkgs/development/libraries/science/astronomy/cfitsio/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "cfitsio";
-  version = "4.1.0";
+  version = "4.2.0";
 
   src = fetchurl {
     url = "https://heasarc.gsfc.nasa.gov/FTP/software/fitsio/c/cfitsio-${version}.tar.gz";
-    sha256 = "sha256-s2fGldKDGVjnFmkhw7NW1d+lGx7O5QW5dBa6OdG2wXo=";
+    sha256 = "sha256-66U9Gz9uNFYyuwmnt1LsfO09Y+xRU6hIOA84gMXWGIk=";
   };
 
   buildInputs = [ bzip2 zlib ];

pkgs/development/python-modules/aiocoap/default.nix

···
 
 buildPythonPackage rec {
   pname = "aiocoap";
-  version = "0.4.4";
+  version = "0.4.5";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
···
   src = fetchFromGitHub {
     owner = "chrysn";
     repo = pname;
-    rev = version;
-    sha256 = "sha256-m/tU1qf+CB9/2eoXktpBSgwjj8lMuMQ/WGYL6HhMNxA=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-t2yfWWfkJmOr14XdLsIV48HMgVRaEnUO4IG2jQHbKWA=";
   };
 
   propagatedBuildInputs = [
···
   meta = with lib; {
     description = "Python CoAP library";
     homepage = "https://aiocoap.readthedocs.io/";
+    changelog = "https://github.com/chrysn/aiocoap/blob/${version}/NEWS";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
   };

pkgs/development/python-modules/aiohomekit/default.nix

···
 
 buildPythonPackage rec {
   pname = "aiohomekit";
-  version = "2.3.0";
+  version = "2.3.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
···
     owner = "Jc2k";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-dX3yz7b3fejLFtlk5CKBQzk+o9FpLtxyZYt5SaybBJM=";
+    hash = "sha256-jkLbCx9F7bDg2wIiEVGkaFPOYg5CROp5lfR8ZGvkKhY=";
   };
 
   nativeBuildInputs = [
···
       Homekit accessories.
     '';
     homepage = "https://github.com/Jc2k/aiohomekit";
+    changelog = "https://github.com/Jc2k/aiohomekit/releases/tag/${version}";
     license = with licenses; [ asl20 ];
     maintainers = with maintainers; [ fab ];
   };

pkgs/development/python-modules/griffe/default.nix

···
 
 buildPythonPackage rec {
   pname = "griffe";
-  version = "0.24.0";
+  version = "0.24.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
···
   src = fetchFromGitHub {
     owner = "mkdocstrings";
     repo = pname;
-    rev = version;
-    hash = "sha256-Gcht9pmh15dvSHRsG9y82l4HoJ7l/gxbmrRh7Jow2Bs=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-HOjwm/IktllmD7Gg9bu8NZqe2RazFC5MNMgH3cld6/8=";
   };
 
   postPatch = ''
···
   meta = with lib; {
     description = "Signatures for entire Python programs";
     homepage = "https://github.com/mkdocstrings/griffe";
+    changelog = "https://github.com/mkdocstrings/griffe/blob/${version}/CHANGELOG.md";
     license = licenses.isc;
     maintainers = with maintainers; [ fab ];
   };

pkgs/development/python-modules/masky/default.nix

···
+{ lib
+, asn1crypto
+, buildPythonPackage
+, colorama
+, cryptography
+, fetchFromGitHub
+, impacket
+, pyasn1
+, pythonOlder
+}:
+
+buildPythonPackage rec {
+  pname = "masky";
+  version = "0.1.1";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "Z4kSec";
+    repo = "Masky";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-uxq4SBudxFbBiV3Cu+oBRKezIWf5p+8VJlIIqQjtSXA=";
+  };
+
+  propagatedBuildInputs = [
+    asn1crypto
+    colorama
+    cryptography
+    impacket
+    pyasn1
+  ];
+
+  # Module has no tests
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "masky"
+  ];
+
+  meta = with lib; {
+    description = "Library to remotely dump domain credentials";
+    homepage = "https://github.com/Z4kSec/Masky";
+    changelog = "https://github.com/Z4kSec/Masky/releases/tag/v${version}";
+    license = licenses.mit;
+    maintainers = with maintainers; [ elasticdog ];
+  };
+}

pkgs/development/python-modules/meshtastic/default.nix

···
 
 buildPythonPackage rec {
   pname = "meshtastic";
-  version = "2.0.3";
+  version = "2.0.4";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
···
     owner = "meshtastic";
     repo = "Meshtastic-python";
     rev = "refs/tags/${version}";
-    hash = "sha256-h8OuDmm9I8lElhAGSpPx8sPUTY+EnFp2VXOYrYjiYNk=";
+    hash = "sha256-WPmoK/5pTVv9ueRnR6Gxtj86LM8ChB0dMfEvo+lLmy0=";
   };
 
   propagatedBuildInputs = [
···
     "test_watchGPIOs"
     "test_writeConfig_with_no_radioConfig"
     "test_writeGPIOs"
+    "test_reboot"
+    "test_shutdown"
   ];
 
   meta = with lib; {
     description = "Python API for talking to Meshtastic devices";
     homepage = "https://github.com/meshtastic/Meshtastic-python";
+    changelog = "https://github.com/meshtastic/python/releases/tag/${version}";
     license = with licenses; [ asl20 ];
     maintainers = with maintainers; [ fab ];
   };

pkgs/development/python-modules/ntlm-auth/default.nix

···
 , fetchFromGitHub
 , mock
 , pytestCheckHook
+, pythonOlder
 , requests
-, six
 }:
 
 buildPythonPackage rec {
   pname = "ntlm-auth";
   version = "1.5.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "jborean93";
     repo = "ntlm-auth";
     rev = "v${version}";
-    sha256 = "00dpf5bfsy07frsjihv1k10zmwcyq4bvkilbxha7h6nlwpcm2409";
+    hash = "sha256-CRBR2eXUGngU7IvGuRfBnvH6QZhhwyh1dgd47VZxtwE=";
   };
 
   propagatedBuildInputs = [
     cryptography
-    six
   ];
 
   checkInputs = [
···
     requests
   ];
 
-  pythonImportsCheck = [ "ntlm_auth" ];
+  pythonImportsCheck = [
+    "ntlm_auth"
+  ];
+
+  disabledTests = [
+    # Tests are outdated as module will be replaced by pyspnego
+    "test_authenticate_message"
+    "test_authenticate_without_domain_workstation"
+    "test_create_authenticate_message"
+    "test_get_"
+    "test_lm_v"
+    "test_nt_"
+    "test_ntlm_context"
+    "test_ntowfv"
+  ];
 
   meta = with lib; {
     description = "Calculates NTLM Authentication codes";
     homepage = "https://github.com/jborean93/ntlm-auth";
+    changelog = "https://github.com/jborean93/ntlm-auth/releases/tag/v${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ elasticdog ];
-    platforms = platforms.all;
   };
 }

pkgs/development/python-modules/pytenable/default.nix

···
 
 buildPythonPackage rec {
   pname = "pytenable";
-  version = "1.4.9";
+  version = "1.4.10";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
···
     owner = "tenable";
     repo = "pyTenable";
     rev = "refs/tags/${version}";
-    hash = "sha256-Cj1/f/e+j5CJMl+afF+HStd419Uh053jKk/vmObaBl8=";
+    hash = "sha256-BNPfoKXDLUckj/yg1Gz806CS5CyjWvc/Hy/NwnuWfo0=";
   };
 
   propagatedBuildInputs = [
···
   meta = with lib; {
     description = "Python library for the Tenable.io and TenableSC API";
     homepage = "https://github.com/tenable/pyTenable";
+    changelog = "https://github.com/tenable/pyTenable/releases/tag/${version}";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
   };

pkgs/development/python-modules/sensor-state-data/default.nix

···
 
 buildPythonPackage rec {
   pname = "sensor-state-data";
-  version = "2.12.0";
+  version = "2.12.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
···
     owner = "Bluetooth-Devices";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-u17vtw3yu8ibi/omTriy6s33/243WjxM03Nss3pFAYk=";
+    hash = "sha256-Ycn62qQ+IMqtuuE/wJPUDlyTiklu2WYrGD+wVXssRFg=";
   };
 
   nativeBuildInputs = [
···
   meta = with lib; {
     description = "Models for storing and converting Sensor Data state";
     homepage = "https://github.com/bluetooth-devices/sensor-state-data";
+    changelog = "https://github.com/Bluetooth-Devices/sensor-state-data/releases/tag/v${version}";
     license = with licenses; [ asl20 ];
     maintainers = with maintainers; [ fab ];
   };

pkgs/servers/etcd/3.5.nix

···
 { lib, buildGoModule, fetchFromGitHub, symlinkJoin }:
 
 let
-  version = "3.5.5";
+  version = "3.5.6";
 
   src = fetchFromGitHub {
     owner = "etcd-io";
     repo = "etcd";
     rev = "v${version}";
-    sha256 = "sha256-V10aeYwr1ZS990lYZELJjq8NX7cBs0bzlYYzoYWS3zQ=";
+    sha256 = "sha256-KQ3N6HBgdLnS/8UprT99gH9ttsy2cgfaWSL/ILX6t1A=";
   };
 
   CGO_ENABLED = 0;
···
 
     inherit CGO_ENABLED meta src version;
 
-    vendorSha256 = "sha256-BTIrLgUXnV+0d0DTKE3TvvW2JH4oSE+SnJs+yfH26Ms=";
+    vendorSha256 = "sha256-u4N8YXmnVk5flPimdE4olr/1hVZoEDEgUwXRRTlX51o=";
 
     modRoot = "./server";
 
···
 
     inherit CGO_ENABLED meta src version;
 
-    vendorSha256 = "sha256-yUgrKIjCtYTLmdZe1p9Rx9MUZzqOAmNF4tUckJgF8Ks=";
+    vendorSha256 = "sha256-J4qW2Dzpwk85XW3oWvT1F5ec/jzkcLbTC+1CMBztWRw=";
 
     modRoot = "./etcdutl";
   };
···
 
     inherit CGO_ENABLED meta src version;
 
-    vendorSha256 = "sha256-qT8OJg4aTzz0p0s6yhmDYcfJ0p9KNbnlRbOCfOao0vk=";
+    vendorSha256 = "sha256-+5zWXVErkFAvtkpNQtKn/jLOGUdHkXgeZWI7/RIMgMQ=";
 
     modRoot = "./etcdctl";
   };

pkgs/tools/networking/chaos/default.nix

···
 
 buildGoModule rec {
   pname = "chaos";
-  version = "0.3.0";
+  version = "0.4.0";
 
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = "chaos-client";
-    rev = "v${version}";
-    sha256 = "sha256-1bmKIBbsZHNzwFZ0iPshXclCTcQMzU7zRs5MjMhTFYU=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-NA78zMge9AsfqO1px1FWCDKmWy1a0h8dtTotpgLazh4=";
   };
 
-  vendorSha256 = "sha256-2QOdqX4JX9A/i1+qqemVq47PQfqDnxkj0EQMzK8k8/E=";
+  vendorHash = "sha256-KkT/mgU1BOwJcjxOBMCMq0hyxZAyoh25bi+s3ka6TOg=";
 
   subPackages = [
     "cmd/chaos/"
···
   meta = with lib; {
     description = "Tool to communicate with Chaos DNS API";
     homepage = "https://github.com/projectdiscovery/chaos-client";
+    changelog = "https://github.com/projectdiscovery/chaos-client/releases/tag/v${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ fab ];
   };

pkgs/tools/networking/minio-client/default.nix

···
 
 buildGoModule rec {
   pname = "minio-client";
-  version = "2022-11-07T23-47-39Z";
+  version = "2022-11-17T21-20-39Z";
 
   src = fetchFromGitHub {
     owner = "minio";
     repo = "mc";
     rev = "RELEASE.${version}";
-    sha256 = "sha256-g7q2VONGySMlw+aWZfWnZ2TVvV4lOGMNXl/4IRQrEOs=";
+    sha256 = "sha256-z9XP2oTnyTJMAgyjC21uHL8vipyyuKKSGkXU8ASdXuI=";
   };
 
-  vendorSha256 = "sha256-KD3mhl5d3LhqH37AeNmfuk5+KktWdUTNGi5YNuhyMDk=";
+  vendorSha256 = "sha256-Nm3bKOGtMtvSI9XQU684emIupJ+y/AUbTUnqndOUPSo=";
 
   subPackages = [ "." ];
 

pkgs/tools/security/crackmapexec/default.nix

···
 
 python3.pkgs.buildPythonApplication rec {
   pname = "crackmapexec";
-  version = "5.3.0";
+  version = "5.4.0";
   format = "pyproject";
 
   src = fetchFromGitHub {
-    owner = "byt3bl33d3r";
+    owner = "Porchetta-Industries";
     repo = "CrackMapExec";
-    rev = "v${version}";
-    hash = "sha256-wPS1PCvR9Ffp0r9lZZkFATt+i+eR5ap16HzLWDZbJKI=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-V2n840QyLofTfQE4vtFYGfQwl65sklp+KfNS9RCLvI8=";
   };
 
   nativeBuildInputs = with python3.pkgs; [
···
     dsinternals
     impacket
     lsassy
+    masky
     msgpack
     neo4j
     paramiko
···
 
   meta = with lib; {
     description = "Tool for pentesting networks";
-    homepage = "https://github.com/byt3bl33d3r/CrackMapExec";
+    homepage = "https://github.com/Porchetta-Industries/CrackMapExec";
+    changelog = "https://github.com/Porchetta-Industries/CrackMapExec/releases/tag/v${version}";
     license = with licenses; [ bsd2 ];
     maintainers = with maintainers; [ fab ];
     mainProgram = "cme";

pkgs/tools/security/echidna/default.nix

···
 { lib
 , fetchFromGitHub
 # Haskell deps
-, mkDerivation, aeson, ansi-terminal, base, base16-bytestring, binary, brick
-, bytestring, cborg, containers, data-dword, data-has, deepseq, directory
-, exceptions, filepath, hashable, hevm, hpack, lens, lens-aeson, megaparsec
-, MonadRandom, mtl, optparse-applicative, process, random, stm, tasty
-, tasty-hunit, tasty-quickcheck, temporary, text, transformers , unix, unliftio
-, unliftio-core, unordered-containers, vector, vector-instances, vty
-, wl-pprint-annotated, word8, yaml, extra, ListLike, semver
+, mkDerivation, aeson, base, base16-bytestring, binary, brick, bytestring
+, containers, data-dword, data-has, directory, exceptions, extra, filepath
+, hashable, hevm, hpack, html-entities, lens, ListLike, MonadRandom, mtl
+, optparse-applicative, process, random, semver, tasty, tasty-hunit
+, tasty-quickcheck, text, transformers, unix, unliftio, unordered-containers
+, vector, vector-instances, vty, yaml
 }:
 mkDerivation rec {
   pname = "echidna";
-  version = "2.0.3";
+  version = "2.0.4";
 
   src = fetchFromGitHub {
     owner = "crytic";
     repo = "echidna";
     rev = "v${version}";
-    sha256 = "sha256-ZLk3K00O6aERf+G5SagDVUk1/ba9U+9n9dqCImkczJs=";
+    sha256 = "sha256-DiEZGbd08QLP8zgrIssGYL6h18AprcWZSYp1mMu9TRw=";
   };
 
-  # NOTE: echidna is behind with aeson because of hevm, this patch updates
-  # the code to work with the major aeson update that broke the build
-  # it's temporary until hevm version 0.50.0 is released - https://github.com/ethereum/hevm/milestone/1
-  patches = [ ./echidna-update-aeson.patch ];
-
   isLibrary = true;
   isExecutable = true;
   libraryHaskellDepends = [
-    aeson ansi-terminal base base16-bytestring binary brick bytestring cborg
-    containers data-dword data-has deepseq directory exceptions filepath
-    hashable hevm lens lens-aeson megaparsec MonadRandom mtl
-    optparse-applicative process random stm temporary text transformers unix
-    unliftio unliftio-core unordered-containers vector vector-instances vty
-    wl-pprint-annotated word8 yaml extra ListLike semver
+    aeson base base16-bytestring binary brick bytestring containers data-dword
+    data-has directory exceptions extra filepath hashable hevm html-entities
+    lens ListLike MonadRandom mtl optparse-applicative process random semver
+    text transformers unix unliftio unordered-containers vector vector-instances
+    vty yaml
   ];
   libraryToolDepends = [ hpack ];
   executableHaskellDepends = libraryHaskellDepends;

pkgs/tools/security/echidna/echidna-update-aeson.patch

···
-diff --git a/lib/Echidna/Config.hs b/lib/Echidna/Config.hs
-index f8d5777..3d761fe 100644
---- a/lib/Echidna/Config.hs
-+++ b/lib/Echidna/Config.hs
-@@ -13,8 +13,8 @@ import Control.Monad.State (StateT(..), runStateT)
- import Control.Monad.Trans (lift)
- import Data.Bool (bool)
- import Data.Aeson
-+import Data.Aeson.KeyMap (keys)
- import Data.Has (Has(..))
--import Data.HashMap.Strict (keys)
- import Data.HashSet (fromList, insert, difference)
- import Data.Maybe (fromMaybe)
- import Data.Text (isPrefixOf)
-@@ -23,11 +23,13 @@ import EVM.Types (w256)
- 
- import qualified Control.Monad.Fail as M (MonadFail(..))
- import qualified Data.ByteString as BS
-+import qualified Data.Aeson.Key as Key
-+import qualified Data.HashSet as HS
- import qualified Data.List.NonEmpty as NE
- import qualified Data.Yaml as Y
- 
- import Echidna.Test
--import Echidna.Types.Campaign 
-+import Echidna.Types.Campaign
- import Echidna.Mutator.Corpus (defaultMutationConsts)
- import Echidna.Types.Config (EConfigWithUsage(..), EConfig(..))
- import Echidna.Types.Solidity
-@@ -52,7 +54,7 @@ instance FromJSON EConfigWithUsage where
-                   _        -> mempty
-     (c, ks) <- runStateT (parser v') $ fromList []
-     let found = fromList (keys v')
--    return $ EConfigWithUsage c (found `difference` ks) (ks `difference` found)
-+    return $ EConfigWithUsage c (HS.map Key.toText $ found `difference` ks) (HS.map Key.toText $ ks `difference` found)
-     -- this parser runs in StateT and comes equipped with the following
-     -- equivalent unary operators:
-     -- x .:? k (Parser) <==> x ..:? k (StateT)

pkgs/tools/security/zlint/default.nix

···
+{ lib
+, buildGoModule
+, fetchFromGitHub
+, testers
+, zlint
+}:
+
+buildGoModule rec {
+  pname = "zlint";
+  version = "3.4.0";
+
+  src = fetchFromGitHub {
+    owner = "zmap";
+    repo = "zlint";
+    rev = "v${version}";
+    hash = "sha256-l39GdfEKUAw5DQNjx6ZBgfGtengRlUUasm0G07kAA2A=";
+  };
+
+  modRoot = "v3";
+
+  vendorHash = "sha256-OiHEyMHuSiWDB/1YRvAhErb1h/rFfXXVcagcP386doc=";
+
+  postPatch = ''
+    # Remove a package which is not declared in go.mod.
+    rm -rf v3/cmd/genTestCerts
+  '';
+
+  subPackages = [
+    "cmd/zlint"
+    "cmd/zlint-gtld-update"
+  ];
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X main.version=${version}"
+  ];
+
+  # Checks rely on .git directory, leaveDotGit makes the source derivation flaky.
+  doCheck = false;
+
+  passthru.tests.version = testers.testVersion {
+    package = zlint;
+    command = "zlint -version";
+  };
+
+  meta = with lib; {
+    description = "X.509 Certificate Linter focused on Web PKI standards and requirements";
+    longDescription = ''
+      ZLint is a X.509 certificate linter written in Go that checks for
+      consistency with standards (e.g. RFC 5280) and other relevant PKI
+      requirements (e.g. CA/Browser Forum Baseline Requirements).
+    '';
+    homepage = "https://github.com/zmap/zlint";
+    changelog = "https://github.com/zmap/zlint/releases/tag/${src.rev}";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ baloo ];
+  };
+}

pkgs/top-level/all-packages.nix

···
 
   zkar = callPackage ../tools/security/zkar { };
 
+  zlint = callPackage ../tools/security/zlint { };
+
   zmap = callPackage ../tools/security/zmap { };
 
   zpool-iostat-viz = callPackage ../tools/filesystems/zpool-iostat-viz { };

pkgs/top-level/python-packages.nix

···
 
   mask-rcnn = callPackage ../development/python-modules/mask-rcnn { };
 
+  masky = callPackage ../development/python-modules/masky { };
+
   mastodon-py = callPackage ../development/python-modules/mastodon-py { };
 
   mat2 = callPackage ../development/python-modules/mat2 { };