Merge staging-next into staging

nixos/modules/services/misc/gitlab.nix

···
           port = 3807;
         };
       };
+      registry = lib.optionalAttrs cfg.registry.enable {
+        enabled = true;
+        host = cfg.registry.externalAddress;
+        port = cfg.registry.externalPort;
+        key = cfg.registry.keyFile;
+        api_url = "http://${config.services.dockerRegistry.listenAddress}:${toString config.services.dockerRegistry.port}/";
+        issuer = "gitlab-issuer";
+      };
       extra = {};
       uploads.storage_path = cfg.statePath;
     };
···
     prometheus_multiproc_dir = "/run/gitlab";
     RAILS_ENV = "production";
     MALLOC_ARENA_MAX = "2";
-  };
+  } // cfg.extraEnv;
 
   gitlab-rake = pkgs.stdenv.mkDerivation {
     name = "gitlab-rake";
···
           exist already. Its parent directories must be owned by
           either <literal>root</literal> or the user set in
           <option>services.gitlab.user</option>.
+        '';
+      };
+
+      extraEnv = mkOption {
+        type = types.attrsOf types.str;
+        default = {};
+        description = ''
+          Additional environment variables for the GitLab environment.
         '';
       };
 
···
         '';
       };
 
+      registry = {
+        enable = mkOption {
+          type = types.bool;
+          default = false;
+          description = "Enable GitLab container registry.";
+        };
+        host = mkOption {
+          type = types.str;
+          default = config.services.gitlab.host;
+          description = "GitLab container registry host name.";
+        };
+        port = mkOption {
+          type = types.int;
+          default = 4567;
+          description = "GitLab container registry port.";
+        };
+        certFile = mkOption {
+          type = types.path;
+          default = null;
+          description = "Path to GitLab container registry certificate.";
+        };
+        keyFile = mkOption {
+          type = types.path;
+          default = null;
+          description = "Path to GitLab container registry certificate-key.";
+        };
+        defaultForProjects = mkOption {
+          type = types.bool;
+          default = cfg.registry.enable;
+          description = "If GitLab container registry should be enabled by default for projects.";
+        };
+        issuer = mkOption {
+          type = types.str;
+          default = "gitlab-issuer";
+          description = "GitLab container registry issuer.";
+        };
+        serviceName = mkOption {
+          type = types.str;
+          default = "container_registry";
+          description = "GitLab container registry service name.";
+        };
+        externalAddress = mkOption {
+          type = types.str;
+          default = "";
+          description = "External address used to access registry from the internet";
+        };
+        externalPort = mkOption {
+          type = types.int;
+          description = "External port used to access registry from the internet";
+        };
+      };
+
       smtp = {
         enable = mkOption {
           type = types.bool;
···
         User = pgsql.superUser;
         Type = "oneshot";
         RemainAfterExit = true;
+      };
+    };
+
+    systemd.services.gitlab-registry-cert = optionalAttrs cfg.registry.enable {
+      path = with pkgs; [ openssl ];
+
+      script = ''
+        mkdir -p $(dirname ${cfg.registry.keyFile})
+        mkdir -p $(dirname ${cfg.registry.certFile})
+        openssl req -nodes -newkey rsa:4096 -keyout ${cfg.registry.keyFile} -out /tmp/registry-auth.csr -subj "/CN=${cfg.registry.issuer}"
+        openssl x509 -in /tmp/registry-auth.csr -out ${cfg.registry.certFile} -req -signkey ${cfg.registry.keyFile} -days 3650
+        chown ${cfg.user}:${cfg.group} $(dirname ${cfg.registry.keyFile})
+        chown ${cfg.user}:${cfg.group} $(dirname ${cfg.registry.certFile})
+        chown ${cfg.user}:${cfg.group} ${cfg.registry.keyFile}
+        chown ${cfg.user}:${cfg.group} ${cfg.registry.certFile}
+      '';
+
+      serviceConfig = {
+        ConditionPathExists = "!${cfg.registry.certFile}";
+      };
+    };
+
+    # Ensure Docker Registry launches after the certificate generation job
+    systemd.services.docker-registry = optionalAttrs cfg.registry.enable {
+      wants = [ "gitlab-registry-cert.service" ];
+    };
+
+    # Enable Docker Registry, if GitLab-Container Registry is enabled
+    services.dockerRegistry = optionalAttrs cfg.registry.enable {
+      enable = true;
+      enableDelete = true; # This must be true, otherwise GitLab won't manage it correctly
+      extraConfig = {
+        auth.token = {
+          realm = "http${if cfg.https == true then "s" else ""}://${cfg.host}/jwt/auth";
+          service = cfg.registry.serviceName;
+          issuer = cfg.registry.issuer;
+          rootcertbundle = cfg.registry.certFile;
+        };
       };
     };
 

pkgs/applications/misc/electron-cash/default.nix

···
-{ lib, fetchFromGitHub, python3Packages, qtbase, fetchpatch, wrapQtAppsHook
+{ lib, stdenv, fetchFromGitHub, python3Packages, qtbase, fetchpatch, wrapQtAppsHook
 , secp256k1 }:
 
 python3Packages.buildPythonApplication rec {
···
     pytest electroncash/tests
   '';
 
-  postInstall = ''
+  postInstall = lib.optionalString stdenv.isLinux ''
     substituteInPlace $out/share/applications/electron-cash.desktop \
       --replace "Exec=electron-cash" "Exec=$out/bin/electron-cash"
   '';
···
       of the blockchain.
     '';
     homepage = "https://www.electroncash.org/";
-    platforms = platforms.linux;
+    platforms = platforms.unix;
     maintainers = with maintainers; [ lassulus nyanloutre oxalica ];
     license = licenses.mit;
   };

pkgs/applications/misc/makeself/default.nix

···
     sha256 = "07cq7q71bv3fwddkp2863ylry2ivds00f8sjy8npjpdbkailxm21";
   };
 
-  patches = [ ./tests-use-better-shell.patch ];
   postPatch = "patchShebangs test";
 
-  doCheck = true;
+  # Issue #110149: our default /bin/sh apparently has 32-bit math only
+  # (attribute busybox-sandbox-shell), and that causes problems
+  # when running these tests inside build, based on free disk space.
+  doCheck = false;
   checkTarget = "test";
   checkInputs = [ which zstd pbzip2 ];
 

pkgs/applications/misc/makeself/tests-use-better-shell.patch

···
-Use full bash's sh in tests instead of /bin/sh, as that would be
-too minimalist in the build sandbox.  See issue:
-https://github.com/NixOS/nixpkgs/issues/110149#issuecomment-874258128
-diff --git a/test/extracttest b/test/extracttest
---- a/test/extracttest
-+++ b/test/extracttest
-@@ -9,2 +9,3 @@ setupTests() {
-   $SUT $* archive makeself-test.run "Test $*" echo Testing
-+  sed "1s|/bin|$(dirname "$SHELL")|" -i ./makeself-test.run
- }

pkgs/applications/networking/irc/weechat/scripts/default.nix

···
   weechat-go = callPackage ./weechat-go { };
 
   buffer_autoset = callPackage ./buffer_autoset { };
+
+  highmon = callPackage ./highmon { };
 }

pkgs/applications/networking/irc/weechat/scripts/highmon/default.nix

···
+{ lib, stdenv, fetchurl, weechat }:
+
+stdenv.mkDerivation {
+  pname = "highmon";
+  version = "2.7";
+
+  src = fetchurl {
+    url = "https://raw.githubusercontent.com/KenjiE20/highmon/182e67d070c75efc81999e68c2ac7fdfe44d2872/highmon.pl";
+    sha256 = "1vvgzscb12l3cp2nq954fx6j3awvpjsb0nqylal51ps9cq9a3wir";
+  };
+
+  dontUnpack = true;
+
+  passthru.scripts = [ "highmon.pl" ];
+
+  installPhase = ''
+    runHook preInstall
+
+    install -D $src $out/share/highmon.pl
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    inherit (weechat.meta) platforms;
+    homepage = "https://github.com/KenjiE20/highmon/";
+    description = "highmon.pl is a weechat script that adds 'Highlight Monitor'.";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ govanify ];
+  };
+}

pkgs/development/python-modules/pytest-rerunfailures/default.nix

···
 
 buildPythonPackage rec {
   pname = "pytest-rerunfailures";
-  version = "9.1.1";
+  version = "10.1";
 
   disabled = pythonOlder "3.5";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1cb11a17fc121b3918414eb5eaf314ee325f2e693ac7cb3f6abf7560790827f2";
+    sha256 = "7617c06de13ee6dd2df9add7e275bfb2bcebbaaf3e450f5937cd0200df824273";
   };
 
   buildInputs = [ pytest ];

pkgs/os-specific/linux/busybox/sandbox-shell.nix

···
     CONFIG_FEATURE_FANCY_ECHO y
     CONFIG_FEATURE_SH_MATH y
     CONFIG_FEATURE_SH_MATH_64 y
+    CONFIG_FEATURE_TEST_64 y
 
     CONFIG_ASH y
     CONFIG_ASH_OPTIMIZE_FOR_SIZE y

pkgs/tools/misc/trash-cli/default.nix

···
 
 python3Packages.buildPythonApplication rec {
   pname = "trash-cli";
-  version = "0.21.6.10.1";
+  version = "0.21.6.30";
 
   src = fetchFromGitHub {
     owner = "andreafrancia";
     repo = "trash-cli";
     rev = version;
-    sha256 = "0mhpzf3vmd876aldl5gazmk4si0zvrh0v1rwsz2hbrn0571zmzy9";
+    sha256 = "09vwg4jpx7pl7rd5ybq5ldgwky8zzf59msmzvmim9vipnmjgkxv7";
   };
 
   propagatedBuildInputs = [ python3Packages.psutil ];

pkgs/tools/networking/bore/default.nix

···
+{ lib, stdenv, rustPlatform, fetchFromBitbucket, llvmPackages, Libsystem, SystemConfiguration, installShellFiles }:
+
+rustPlatform.buildRustPackage rec {
+  pname = "bore";
+  version = "0.3.3";
+
+  src = fetchFromBitbucket {
+    owner = "delan";
+    repo = "nonymous";
+    rev = version;
+    sha256 = "0gws1f625izrb3armh6bay1k8l9p9csl37jx03yss1r720k4vn2x";
+  };
+
+  cargoSha256 = "1n09gcp1y885lz6g2f73zw3fd0fmv7nwlvaqba2yl0kylzk7naa6";
+  cargoBuildFlags = "-p ${pname}";
+
+  # FIXME can’t test --all-targets and --doc in a single invocation
+  cargoTestFlags = "--features std --all-targets --workspace";
+
+  nativeBuildInputs = [ installShellFiles ]
+    ++ lib.optional stdenv.isDarwin llvmPackages.libclang;
+
+  buildInputs = lib.optionals stdenv.isDarwin [
+    Libsystem
+    SystemConfiguration
+  ];
+
+  LIBCLANG_PATH="${llvmPackages.libclang.lib}/lib";
+
+  postInstall = ''
+    installManPage $src/bore/doc/bore.1
+  '';
+
+  doInstallCheck = true;
+  installCheckPhase = ''
+    printf '\0\0\0\0\0\0\0\0\0\0\0\0' \
+    | $out/bin/bore --decode \
+    | grep -q ';; NoError #0 Query 0 0 0 0 flags'
+  '';
+
+  meta = with lib; {
+    description = "DNS query tool";
+    homepage = "https://crates.io/crates/bore";
+    license = licenses.isc;
+    maintainers = [ maintainers.delan ];
+  };
+}

pkgs/top-level/all-packages.nix

···
 
   agebox = callPackage ../tools/security/agebox { };
 
+  bore = callPackage ../tools/networking/bore {
+    inherit (darwin) Libsystem;
+    inherit (darwin.apple_sdk.frameworks) SystemConfiguration;
+  };
+
   brotli = callPackage ../tools/compression/brotli { };
 
   biosdevname = callPackage ../tools/networking/biosdevname { };