···5858 if m ? config || m ? options then
5959 let badAttrs = removeAttrs m ["imports" "options" "config" "key" "_file"]; in
6060 if badAttrs != {} then
6161- throw "Module `${key}' has an unsupported attribute `${head (attrNames badAttrs)}'."
6161+ throw "Module `${key}' has an unsupported attribute `${head (attrNames badAttrs)}'. This is caused by assignments to the top-level attributes `config' or `options'."
6262 else
6363 { file = m._file or file;
6464 key = toString m.key or key;
+1-3
maintainers/scripts/travis-nox-review-pr.sh
···3232 nix-build pkgs/top-level/release.nix -A tarball
3333 else
3434 echo "=== Checking PR"
3535- # The current HEAD is the PR merged into origin/master, so we compare
3636- # against origin/master
3737- nox-review wip --against origin/master
3535+ nox-review pr ${TRAVIS_PULL_REQUEST}
3836 fi
3937else
4038 echo "$0: Unknown option $1" >&2
+17-17
nixos/modules/config/update-users-groups.pl
···66make_path("/var/lib/nixos", { mode => 0755 });
778899+sub hashPassword {
1010+ my ($password) = @_;
1111+ my $salt = "";
1212+ my @chars = ('.', '/', 0..9, 'A'..'Z', 'a'..'z');
1313+ $salt .= $chars[rand 64] for (1..8);
1414+ return crypt($password, '$6$' . $salt . '$');
1515+}
1616+1717+918# Functions for allocating free GIDs/UIDs. FIXME: respect ID ranges in
1019# /etc/login.defs.
1120sub allocId {
···174183 } else {
175184 warn "warning: password file ‘$u->{passwordFile}’ does not exist\n";
176185 }
186186+ } elsif (defined $u->{password}) {
187187+ $u->{hashedPassword} = hashPassword($u->{password});
177188 }
178189179190 $u->{fakePassword} = $existing->{fakePassword} // "x";
···208219209220foreach my $line (-f "/etc/shadow" ? read_file("/etc/shadow") : ()) {
210221 chomp $line;
211211- my ($name, $password, @rest) = split(':', $line, -9);
222222+ my ($name, $hashedPassword, @rest) = split(':', $line, -9);
212223 my $u = $usersOut{$name};;
213224 next if !defined $u;
214214- $password = $u->{hashedPassword} if defined $u->{hashedPassword} && !$spec->{mutableUsers}; # FIXME
215215- push @shadowNew, join(":", $name, $password, @rest) . "\n";
225225+ $hashedPassword = $u->{hashedPassword} if defined $u->{hashedPassword} && !$spec->{mutableUsers}; # FIXME
226226+ push @shadowNew, join(":", $name, $hashedPassword, @rest) . "\n";
216227 $shadowSeen{$name} = 1;
217228}
218229219230foreach my $u (values %usersOut) {
220231 next if defined $shadowSeen{$u->{name}};
221221- my $password = "!";
222222- $password = $u->{hashedPassword} if defined $u->{hashedPassword};
232232+ my $hashedPassword = "!";
233233+ $hashedPassword = $u->{hashedPassword} if defined $u->{hashedPassword};
223234 # FIXME: set correct value for sp_lstchg.
224224- push @shadowNew, join(":", $u->{name}, $password, "1::::::") . "\n";
235235+ push @shadowNew, join(":", $u->{name}, $hashedPassword, "1::::::") . "\n";
225236}
226237227238write_file("/etc/shadow.tmp", { perms => 0600 }, @shadowNew);
228239rename("/etc/shadow.tmp", "/etc/shadow") or die;
229229-230230-231231-# Call chpasswd to apply password. FIXME: generate the hashes directly
232232-# and merge into the /etc/shadow updating above.
233233-foreach my $u (@{$spec->{users}}) {
234234- if (defined $u->{password}) {
235235- my $pid = open(PW, "| chpasswd") or die;
236236- print PW "$u->{name}:$u->{password}\n";
237237- close PW or die "unable to change password of user ‘$u->{name}’: $?\n";
238238- }
239239-}
+11-1
nixos/modules/security/sudo.nix
···4646 <filename>sudoers</filename> file.
4747 '';
4848 };
4949+5050+ security.sudo.extraConfig = mkOption {
5151+ type = types.lines;
5252+ default = "";
5353+ description = ''
5454+ Extra configuration text appended to <filename>sudoers</filename>.
5555+ '';
5656+ };
4957 };
50585159···55635664 security.sudo.configFile =
5765 ''
5858- # Don't edit this file. Set the NixOS option ‘security.sudo.configFile’ instead.
6666+ # Don't edit this file. Set the NixOS options ‘security.sudo.configFile’
6767+ # and security.sudo.extraConfig instead.
59686069 # Environment variables to keep for root and %wheel.
6170 Defaults:root,%wheel env_keep+=TERMINFO_DIRS
···69787079 # Users in the "wheel" group can do anything.
7180 %wheel ALL=(ALL) ${if cfg.wheelNeedsPassword then "" else "NOPASSWD: ALL, "}SETENV: ALL
8181+ ${cfg.extraConfig}
7282 '';
73837484 security.setuidPrograms = [ "sudo" "sudoedit" ];
+11-4
nixos/modules/services/misc/gitolite.nix
···1515 default = false;
1616 description = ''
1717 Enable gitolite management under the
1818- <literal>gitolite</literal> user. The Gitolite home
1919- directory is <literal>/var/lib/gitolite</literal>. After
1818+ <literal>gitolite</literal> user. After
2019 switching to a configuration with Gitolite enabled, you can
2120 then run <literal>git clone
2221 gitolite@host:gitolite-admin.git</literal> to manage it further.
2322 '';
2423 };
25242525+ dataDir = mkOption {
2626+ type = types.str;
2727+ default = "/var/lib/gitolite";
2828+ description = ''
2929+ Gitolite home directory (used to store all the repositories).
3030+ '';
3131+ };
3232+2633 adminPubkey = mkOption {
2734 type = types.str;
2835 description = ''
···4552 config = mkIf cfg.enable {
4653 users.extraUsers.gitolite = {
4754 description = "Gitolite user";
4848- home = "/var/lib/gitolite";
5555+ home = cfg.dataDir;
4956 createHome = true;
5057 uid = config.ids.uids.gitolite;
5158 useDefaultShell = true;
···61686269 path = [ pkgs.gitolite pkgs.git pkgs.perl pkgs.bash pkgs.openssh ];
6370 script = ''
6464- cd /var/lib/gitolite
7171+ cd ${cfg.dataDir}
6572 mkdir -p .gitolite/logs
6673 if [ ! -d repositories ]; then
6774 gitolite setup -pk ${pubkeyFile}
+14
nixos/modules/services/misc/nix-daemon.nix
···3636 # /etc/nixos/configuration.nix. Do not edit it!
3737 build-users-group = nixbld
3838 build-max-jobs = ${toString (cfg.maxJobs)}
3939+ build-cores = ${toString (cfg.buildCores)}
3940 build-use-chroot = ${if cfg.useChroot then "true" else "false"}
4041 build-chroot-dirs = ${toString cfg.chrootDirs} /bin/sh=${sh} $(echo $extraPaths)
4142 binary-caches = ${toString cfg.binaryCaches}
···7273 set it to the number of CPUs in your system (e.g., 2 on an Athlon
7374 64 X2).
7475 ";
7676+ };
7777+7878+ buildCores = mkOption {
7979+ type = types.int;
8080+ default = 1;
8181+ example = 64;
8282+ description = ''
8383+ This option defines the maximum number of concurrent tasks during
8484+ one build. It affects, e.g., -j option for make. The default is 1.
8585+ Some builds may become non-deterministic with this option; use with
8686+ care! Packages will only be affected if enableParallelBuilding is
8787+ set for them.
8888+ '';
7589 };
76907791 useChroot = mkOption {
···11{ stdenv, fetchurl, python }:
2233stdenv.mkDerivation {
44- name = "git-repo-1.20";
44+ name = "git-repo-1.21";
55 src = fetchurl {
66- # I could not find a versioned url for the 1.20 version. In case
66+ # I could not find a versioned url for the 1.21 version. In case
77 # the sha mismatches, check the homepage for new version and sha.
88 url = "http://commondatastorage.googleapis.com/git-repo-downloads/repo";
99- sha1 = "e197cb48ff4ddda4d11f23940d316e323b29671c";
99+ sha1 = "b8bd1804f432ecf1bab730949c82b93b0fc5fede";
1010 };
11111212 unpackPhase = "true";
+157-120
pkgs/build-support/fetchgit/nix-prefetch-git
···1010builder=
11111212if test -n "$deepClone"; then
1313- deepClone=true
1313+ deepClone=true
1414else
1515- deepClone=false
1515+ deepClone=false
1616fi
17171818if test "$leaveDotGit" != 1; then
1919- leaveDotGit=
1919+ leaveDotGit=
2020else
2121- leaveDotGit=true
2121+ leaveDotGit=true
2222fi
232324242525argi=0
2626argfun=""
2727for arg; do
2828- if test -z "$argfun"; then
2929- case $arg in
3030- --out) argfun=set_out;;
3131- --url) argfun=set_url;;
3232- --rev) argfun=set_rev;;
3333- --hash) argfun=set_hashType;;
3434- --deepClone) deepClone=true;;
3535- --no-deepClone) deepClone=false;;
3636- --leave-dotGit) leaveDotGit=true;;
3737- --fetch-submodules) fetchSubmodules=true;;
3838- --builder) builder=true;;
3939- *)
4040- argi=$(($argi + 1))
4141- case $argi in
4242- 1) url=$arg;;
4343- 2) rev=$arg;;
4444- 3) expHash=$arg;;
4545- *) exit 1;;
4646- esac
4747- ;;
4848- esac
4949- else
5050- case $argfun in
5151- set_*)
5252- var=$(echo $argfun | sed 's,^set_,,')
5353- eval $var=$arg
5454- ;;
5555- esac
5656- argfun=""
5757- fi
2828+ if test -z "$argfun"; then
2929+ case $arg in
3030+ --out) argfun=set_out;;
3131+ --url) argfun=set_url;;
3232+ --rev) argfun=set_rev;;
3333+ --hash) argfun=set_hashType;;
3434+ --deepClone) deepClone=true;;
3535+ --no-deepClone) deepClone=false;;
3636+ --leave-dotGit) leaveDotGit=true;;
3737+ --fetch-submodules) fetchSubmodules=true;;
3838+ --builder) builder=true;;
3939+ *)
4040+ argi=$(($argi + 1))
4141+ case $argi in
4242+ 1) url=$arg;;
4343+ 2) rev=$arg;;
4444+ 3) expHash=$arg;;
4545+ *) exit 1;;
4646+ esac
4747+ ;;
4848+ esac
4949+ else
5050+ case $argfun in
5151+ set_*)
5252+ var=$(echo $argfun | sed 's,^set_,,')
5353+ eval $var=$arg
5454+ ;;
5555+ esac
5656+ argfun=""
5757+ fi
5858done
59596060usage(){
···7575}
76767777if test -z "$url"; then
7878- usage
7878+ usage
7979fi
808081818282init_remote(){
8383- local url=$1;
8484- git init;
8585- git remote add origin $url;
8383+ local url=$1
8484+ git init
8585+ git remote add origin $url
8686}
87878888# Return the reference of an hash if it exists on the remote repository.
8989ref_from_hash(){
9090- local hash=$1;
9090+ local hash=$1
9191 git ls-remote origin | sed -n "\,$hash\t, { s,\(.*\)\t\(.*\),\2,; p; q}"
9292}
9393···9999100100# Fetch everything and checkout the right sha1
101101checkout_hash(){
102102- local hash="$1";
103103- local ref="$2";
102102+ local hash="$1"
103103+ local ref="$2"
104104105105 if test -z "$hash"; then
106106- hash=$(hash_from_ref $ref);
107107- fi;
106106+ hash=$(hash_from_ref $ref)
107107+ fi
108108109109 git fetch ${builder:+--progress} origin || return 1
110110 git checkout -b fetchgit $hash || return 1
···112112113113# Fetch only a branch/tag and checkout it.
114114checkout_ref(){
115115- local hash="$1";
116116- local ref="$2";
115115+ local hash="$1"
116116+ local ref="$2"
117117118118 if "$deepClone"; then
119119- # The caller explicitly asked for a deep clone. Deep clones
120120- # allow "git describe" and similar tools to work. See
121121- # http://thread.gmane.org/gmane.linux.distributions.nixos/3569
122122- # for a discussion.
123123- return 1
119119+ # The caller explicitly asked for a deep clone. Deep clones
120120+ # allow "git describe" and similar tools to work. See
121121+ # http://thread.gmane.org/gmane.linux.distributions.nixos/3569
122122+ # for a discussion.
123123+ return 1
124124 fi
125125126126 if test -z "$ref"; then
127127- ref=$(ref_from_hash $hash);
128128- fi;
127127+ ref=$(ref_from_hash $hash)
128128+ fi
129129130130 if test -n "$ref"; then
131131 # --depth option is ignored on http repository.
132132 git fetch ${builder:+--progress} --depth 1 origin +"$ref" || return 1
133133 git checkout -b fetchgit FETCH_HEAD || return 1
134134 else
135135- return 1;
136136- fi;
135135+ return 1
136136+ fi
137137}
138138139139# Update submodules
···145145 git submodule status |
146146 while read l; do
147147 # checkout each submodule
148148- local hash=$(echo $l | awk '{print substr($1,2)}');
149149- local dir=$(echo $l | awk '{print $2}');
148148+ local hash=$(echo $l | awk '{print substr($1,2)}')
149149+ local dir=$(echo $l | awk '{print $2}')
150150 local name=$(
151151 git config -f .gitmodules --get-regexp submodule\.[^.]*\.path |
152152 sed -n "s,^\(.*\)\.path $dir\$,\\1,p")
153153- local url=$(git config -f .gitmodules --get ${name}.url);
153153+ local url=$(git config -f .gitmodules --get ${name}.url)
154154155155 # Get Absolute URL if we have a relative URL
156156 if ! echo "$url" | grep '^[a-zA-Z]\+://' >/dev/null 2>&1; then
157157- url="$(git config --get remote.origin.url)/$url"
157157+ url="$(git config --get remote.origin.url)/$url"
158158 fi
159159160160- clone "$dir" "$url" "$hash" "";
161161- done;
160160+ clone "$dir" "$url" "$hash" ""
161161+ done
162162}
163163164164clone(){
···168168 local hash="$3"
169169 local ref="$4"
170170171171- cd $dir;
171171+ cd $dir
172172173173 # Initialize the repository.
174174- init_remote "$url";
174174+ init_remote "$url"
175175176176 # Download data from the repository.
177177 checkout_ref "$hash" "$ref" ||
178178 checkout_hash "$hash" "$ref" || (
179179- echo 1>&2 "Unable to checkout $hash$ref from $url.";
180180- exit 1;
179179+ echo 1>&2 "Unable to checkout $hash$ref from $url."
180180+ exit 1
181181 )
182182183183 # Checkout linked sources.
184184 if test -n "$fetchSubmodules"; then
185185- init_submodules;
185185+ init_submodules
186186 fi
187187188188 if [ -z "$builder" -a -f .topdeps ]; then
189189- if tg help 2>&1 > /dev/null
190190- then
191191- echo "populating TopGit branches..."
192192- tg remote --populate origin
193193- else
194194- echo "WARNING: would populate TopGit branches but TopGit is not available" >&2
195195- echo "WARNING: install TopGit to fix the problem" >&2
196196- fi
189189+ if tg help 2>&1 > /dev/null
190190+ then
191191+ echo "populating TopGit branches..."
192192+ tg remote --populate origin
193193+ else
194194+ echo "WARNING: would populate TopGit branches but TopGit is not available" >&2
195195+ echo "WARNING: install TopGit to fix the problem" >&2
196196+ fi
197197 fi
198198199199- cd $top;
199199+ cd $top
200200+}
201201+202202+# Remove all remote branches, remove tags not reachable from HEAD, do a full
203203+# repack and then garbage collect unreferenced objects.
204204+make_deterministic_repo(){
205205+ local repo="$1"
206206+207207+ # run in sub-shell to not touch current working directory
208208+ (
209209+ cd "$repo"
210210+ # Remove files that contain timestamps or otherwise have non-deterministic
211211+ # properties.
212212+ rm -rf .git/logs/ .git/hooks/ .git/index .git/FETCH_HEAD .git/ORIG_HEAD \
213213+ .git/refs/remotes/origin/HEAD .git/config
214214+215215+ # Remove all remote branches.
216216+ git branch -r | while read branch; do
217217+ git branch -rD "$branch" >&2
218218+ done
219219+220220+ # Remove tags not reachable from HEAD. If we're exactly on a tag, don't
221221+ # delete it.
222222+ maybe_tag=$(git tag --points-at HEAD)
223223+ git tag --contains HEAD | while read tag; do
224224+ if [ "$tag" != "$maybe_tag" ]; then
225225+ git tag -d "$tag" >&2
226226+ fi
227227+ done
228228+229229+ # Do a full repack, for determinism.
230230+ # Repack does not add unreferenced objects to a pack file.
231231+ git repack -A -d -f
232232+233233+ # Garbage collect unreferenced objects.
234234+ git gc --prune=all
235235+ )
200236}
237237+201238202239clone_user_rev() {
203240 local dir="$1"
···210247 clone "$dir" "$url" "" "$rev" 1>&2;;
211248 *)
212249 if test -z "$(echo $rev | tr -d 0123456789abcdef)"; then
213213- clone "$dir" "$url" "$rev" "" 1>&2;
250250+ clone "$dir" "$url" "$rev" "" 1>&2
214251 else
215215- echo 1>&2 "Bad commit hash or bad reference.";
216216- exit 1;
252252+ echo 1>&2 "Bad commit hash or bad reference."
253253+ exit 1
217254 fi;;
218255 esac
219256···224261 # Allow doing additional processing before .git removal
225262 eval "$NIX_PREFETCH_GIT_CHECKOUT_HOOK"
226263 if test -z "$leaveDotGit"; then
227227- echo "removing \`.git'..." >&2
264264+ echo "removing \`.git'..." >&2
228265 find $dir -name .git\* | xargs rm -rf
229266 else
230230- # The logs and index contain timestamps, and the hooks contain
231231- # the nix path of git's bash
232232- find $dir -name .git | xargs -I {} rm -rf {}/logs {}/index {}/hooks
267267+ find $dir -name .git | while read gitdir; do
268268+ make_deterministic_repo "$(readlink -f "$gitdir/..")"
269269+ done
233270 fi
234271}
235272236273if test -n "$builder"; then
237237- test -n "$out" -a -n "$url" -a -n "$rev" || usage
238238- mkdir $out
239239- clone_user_rev "$out" "$url" "$rev"
274274+ test -n "$out" -a -n "$url" -a -n "$rev" || usage
275275+ mkdir $out
276276+ clone_user_rev "$out" "$url" "$rev"
240277else
241241- if test -z "$hashType"; then
242242- hashType=sha256
243243- fi
278278+ if test -z "$hashType"; then
279279+ hashType=sha256
280280+ fi
244281245245- # If the hash was given, a file with that hash may already be in the
246246- # store.
247247- if test -n "$expHash"; then
248248- finalPath=$(nix-store --print-fixed-path --recursive "$hashType" "$expHash" git-export)
249249- if ! nix-store --check-validity "$finalPath" 2> /dev/null; then
250250- finalPath=
251251- fi
252252- hash=$expHash
253253- fi
282282+ # If the hash was given, a file with that hash may already be in the
283283+ # store.
284284+ if test -n "$expHash"; then
285285+ finalPath=$(nix-store --print-fixed-path --recursive "$hashType" "$expHash" git-export)
286286+ if ! nix-store --check-validity "$finalPath" 2> /dev/null; then
287287+ finalPath=
288288+ fi
289289+ hash=$expHash
290290+ fi
254291255255- # If we don't know the hash or a path with that hash doesn't exist,
256256- # download the file and add it to the store.
257257- if test -z "$finalPath"; then
292292+ # If we don't know the hash or a path with that hash doesn't exist,
293293+ # download the file and add it to the store.
294294+ if test -z "$finalPath"; then
258295259259- tmpPath="$(mktemp -d "${TMPDIR:-/tmp}/git-checkout-tmp-XXXXXXXX")"
260260- trap "rm -rf \"$tmpPath\"" EXIT
296296+ tmpPath="$(mktemp -d "${TMPDIR:-/tmp}/git-checkout-tmp-XXXXXXXX")"
297297+ trap "rm -rf \"$tmpPath\"" EXIT
261298262262- tmpFile="$tmpPath/git-export"
263263- mkdir "$tmpFile"
299299+ tmpFile="$tmpPath/git-export"
300300+ mkdir "$tmpFile"
264301265265- # Perform the checkout.
266266- clone_user_rev "$tmpFile" "$url" "$rev"
302302+ # Perform the checkout.
303303+ clone_user_rev "$tmpFile" "$url" "$rev"
267304268268- # Compute the hash.
269269- hash=$(nix-hash --type $hashType $hashFormat $tmpFile)
270270- if ! test -n "$QUIET"; then echo "hash is $hash" >&2; fi
305305+ # Compute the hash.
306306+ hash=$(nix-hash --type $hashType $hashFormat $tmpFile)
307307+ if ! test -n "$QUIET"; then echo "hash is $hash" >&2; fi
271308272272- # Add the downloaded file to the Nix store.
273273- finalPath=$(nix-store --add-fixed --recursive "$hashType" $tmpFile)
309309+ # Add the downloaded file to the Nix store.
310310+ finalPath=$(nix-store --add-fixed --recursive "$hashType" $tmpFile)
274311275275- if test -n "$expHash" -a "$expHash" != "$hash"; then
276276- echo "hash mismatch for URL \`$url'"
277277- exit 1
278278- fi
279279- fi
312312+ if test -n "$expHash" -a "$expHash" != "$hash"; then
313313+ echo "hash mismatch for URL \`$url'"
314314+ exit 1
315315+ fi
316316+ fi
280317281281- if ! test -n "$QUIET"; then echo "path is $finalPath" >&2; fi
318318+ if ! test -n "$QUIET"; then echo "path is $finalPath" >&2; fi
282319283283- echo $hash
320320+ echo $hash
284321285285- if test -n "$PRINT_PATH"; then
286286- echo $finalPath
287287- fi
322322+ if test -n "$PRINT_PATH"; then
323323+ echo $finalPath
324324+ fi
288325fi