···10431044In certain situations you may want to run the main command (`autoPatchelf`) of the setup hook on a file or a set of directories instead of unconditionally patching all outputs. This can be done by setting the `dontAutoPatchelf` environment variable to a non-empty value.
10451046-By default `autoPatchelf` will fail as soon as any ELF file requires a dependency which cannot be resolved via the given build inputs. In some situations you might prefer to just leave missing dependencies unpatched and continue to patch the rest. This can be achieved by setting the `autoPatchelfIgnoreMissingDeps` environment variable to a non-empty value.
10471048The `autoPatchelf` command also recognizes a `--no-recurse` command line flag, which prevents it from recursing into subdirectories.
1049
···10431044In certain situations you may want to run the main command (`autoPatchelf`) of the setup hook on a file or a set of directories instead of unconditionally patching all outputs. This can be done by setting the `dontAutoPatchelf` environment variable to a non-empty value.
10451046+By default `autoPatchelf` will fail as soon as any ELF file requires a dependency which cannot be resolved via the given build inputs. In some situations you might prefer to just leave missing dependencies unpatched and continue to patch the rest. This can be achieved by setting the `autoPatchelfIgnoreMissingDeps` environment variable to a non-empty value. `autoPatchelfIgnoreMissingDeps` can be set to a list like `autoPatchelfIgnoreMissingDeps = [ "libcuda.so.1" "libcudart.so.1" ];` or to simply `[ "*" ]` to ignore all missing dependencies.
10471048The `autoPatchelf` command also recognizes a `--no-recurse` command line flag, which prevents it from recursing into subdirectories.
1049
···381 cluster resource manager
382 </para>
383 </listitem>
00000000384 </itemizedlist>
385 </section>
386 <section xml:id="sec-release-22.05-incompatibilities">
···520 </listitem>
521 <listitem>
522 <para>
0000000523 The DHCP server (<literal>services.dhcpd4</literal>,
524 <literal>services.dhcpd6</literal>) has been hardened. The
525 service is now using the systemd’s
···549 rely on systemd interpolating <literal>extraFlags</literal> in
550 the service <literal>ExecStart</literal>, this will no longer
551 work.
00000000000552 </para>
553 </listitem>
554 <listitem>
···1691 </listitem>
1692 <listitem>
1693 <para>
00000001694 The <literal>element-desktop</literal> package now has an
1695 <literal>useKeytar</literal> option (defaults to
1696 <literal>true</literal>), which allows disabling
···1789 </listitem>
1790 <listitem>
1791 <para>
0000000001792 The <literal>zrepl</literal> package has been updated from
1793 0.4.0 to 0.5:
1794 </para>
···1882 <para>
1883 <literal>services.xserver.desktopManager.xfce</literal> now
1884 includes Xfce’s screen locker,
1885- <literal>xfce4-screensaver</literal>.
0001886 </para>
1887 </listitem>
1888 <listitem>
···381 cluster resource manager
382 </para>
383 </listitem>
384+ <listitem>
385+ <para>
386+ <link xlink:href="https://nifi.apache.org">nifi</link>, an
387+ easy to use, powerful, and reliable system to process and
388+ distribute data. Available as
389+ <link xlink:href="options.html#opt-services.nifi.enable">services.nifi</link>.
390+ </para>
391+ </listitem>
392 </itemizedlist>
393 </section>
394 <section xml:id="sec-release-22.05-incompatibilities">
···528 </listitem>
529 <listitem>
530 <para>
531+ <literal>services.prometheus.alertManagerTimeout</literal> has
532+ been removed as it has been deprecated upstream and has no
533+ effect.
534+ </para>
535+ </listitem>
536+ <listitem>
537+ <para>
538 The DHCP server (<literal>services.dhcpd4</literal>,
539 <literal>services.dhcpd6</literal>) has been hardened. The
540 service is now using the systemd’s
···564 rely on systemd interpolating <literal>extraFlags</literal> in
565 the service <literal>ExecStart</literal>, this will no longer
566 work.
567+ </para>
568+ </listitem>
569+ <listitem>
570+ <para>
571+ <literal>services.paperless-ng</literal> was renamed to
572+ <literal>services.paperless</literal>. Accordingly, the
573+ <literal>paperless-ng-manage</literal> script (located in
574+ <literal>dataDir</literal>) was renamed to
575+ <literal>paperless-manage</literal>.
576+ <literal>services.paperless</literal> now uses
577+ <literal>paperless-ngx</literal>.
578 </para>
579 </listitem>
580 <listitem>
···1717 </listitem>
1718 <listitem>
1719 <para>
1720+ A module for declarative configuration of openconnect VPN
1721+ profiles was added under
1722+ <literal>networking.openconnect</literal>.
1723+ </para>
1724+ </listitem>
1725+ <listitem>
1726+ <para>
1727 The <literal>element-desktop</literal> package now has an
1728 <literal>useKeytar</literal> option (defaults to
1729 <literal>true</literal>), which allows disabling
···1822 </listitem>
1823 <listitem>
1824 <para>
1825+ <literal>security.pam.ussh</literal> has been added, which
1826+ allows authorizing PAM sessions based on SSH
1827+ <emphasis>certificates</emphasis> held within an SSH agent,
1828+ using
1829+ <link xlink:href="https://github.com/uber/pam-ussh">pam-ussh</link>.
1830+ </para>
1831+ </listitem>
1832+ <listitem>
1833+ <para>
1834 The <literal>zrepl</literal> package has been updated from
1835 0.4.0 to 0.5:
1836 </para>
···1924 <para>
1925 <literal>services.xserver.desktopManager.xfce</literal> now
1926 includes Xfce’s screen locker,
1927+ <literal>xfce4-screensaver</literal> that is enabled by
1928+ default. You can disable it by setting
1929+ <literal>false</literal> to
1930+ <link linkend="opt-services.xserver.desktopManager.xfce.enableScreensaver">services.xserver.desktopManager.xfce.enableScreensaver</link>.
1931 </para>
1932 </listitem>
1933 <listitem>
+11-1
nixos/doc/manual/release-notes/rl-2205.section.md
···109110- [pacemaker](https://clusterlabs.org/pacemaker/) cluster resource manager
11100112<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
113114## Backward Incompatibilities {#sec-release-22.05-incompatibilities}
···173 }
174 ```
17500176- The DHCP server (`services.dhcpd4`, `services.dhcpd6`) has been hardened.
177 The service is now using the systemd's `DynamicUser` mechanism to run as an unprivileged dynamically-allocated user with limited capabilities.
178 The dhcpd state files are now always stored in `/var/lib/dhcpd{4,6}` and the `services.dhcpd4.stateDir` and `service.dhcpd6.stateDir` options have been removed.
···181- The `mailpile` email webclient (`services.mailpile`) has been removed due to its reliance on python2.
182183- `services.ipfs.extraFlags` is now escaped with `utils.escapeSystemdExecArgs`. If you rely on systemd interpolating `extraFlags` in the service `ExecStart`, this will no longer work.
00184185- The `matrix-synapse` service (`services.matrix-synapse`) has been converted to use the `settings` option defined in RFC42.
186 This means that options that are part of your `homeserver.yaml` configuration, and that were specified at the top-level of the
···583 using `fetchgit` or `fetchhg` if the argument `fetchSubmodules`
584 is set to `true`.
58500586- The `element-desktop` package now has an `useKeytar` option (defaults to `true`),
587 which allows disabling `keytar` and in turn `libsecret` usage
588 (which binds to native credential managers / keychain libraries).
···613 and [services.logrotate.extraConfig](#opt-services.logrotate.extraConfig) will work, but issue deprecation
614 warnings and [services.logrotate.settings](#opt-services.logrotate.settings) should now be used instead.
61500616- The `zrepl` package has been updated from 0.4.0 to 0.5:
617618 - The RPC protocol version was bumped; all zrepl daemons in a setup must be updated and restarted before replication can resume.
···642- xfsprogs was update to version 5.15, which enables inobtcount and bigtime by default on filesystem creation. Support for these features was added in kernel 5.10 and deemed stable in kernel 5.15.
643 If you want to be able to mount XFS filesystems created with this release of xfsprogs on kernel releases older than 5.10, you need to format them with `mkfs.xfs -m bigtime=0 -m inobtcount=0`.
644645-- `services.xserver.desktopManager.xfce` now includes Xfce's screen locker, `xfce4-screensaver`.
646647- The `hadoop` package has added support for `aarch64-linux` and `aarch64-darwin` as of 3.3.1 ([#158613](https://github.com/NixOS/nixpkgs/pull/158613)).
648
···109110- [pacemaker](https://clusterlabs.org/pacemaker/) cluster resource manager
111112+- [nifi](https://nifi.apache.org), an easy to use, powerful, and reliable system to process and distribute data. Available as [services.nifi](options.html#opt-services.nifi.enable).
113+114<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
115116## Backward Incompatibilities {#sec-release-22.05-incompatibilities}
···175 }
176 ```
177178+- `services.prometheus.alertManagerTimeout` has been removed as it has been deprecated upstream and has no effect.
179+180- The DHCP server (`services.dhcpd4`, `services.dhcpd6`) has been hardened.
181 The service is now using the systemd's `DynamicUser` mechanism to run as an unprivileged dynamically-allocated user with limited capabilities.
182 The dhcpd state files are now always stored in `/var/lib/dhcpd{4,6}` and the `services.dhcpd4.stateDir` and `service.dhcpd6.stateDir` options have been removed.
···185- The `mailpile` email webclient (`services.mailpile`) has been removed due to its reliance on python2.
186187- `services.ipfs.extraFlags` is now escaped with `utils.escapeSystemdExecArgs`. If you rely on systemd interpolating `extraFlags` in the service `ExecStart`, this will no longer work.
188+189+- `services.paperless-ng` was renamed to `services.paperless`. Accordingly, the `paperless-ng-manage` script (located in `dataDir`) was renamed to `paperless-manage`. `services.paperless` now uses `paperless-ngx`.
190191- The `matrix-synapse` service (`services.matrix-synapse`) has been converted to use the `settings` option defined in RFC42.
192 This means that options that are part of your `homeserver.yaml` configuration, and that were specified at the top-level of the
···589 using `fetchgit` or `fetchhg` if the argument `fetchSubmodules`
590 is set to `true`.
591592+- A module for declarative configuration of openconnect VPN profiles was added under `networking.openconnect`.
593+594- The `element-desktop` package now has an `useKeytar` option (defaults to `true`),
595 which allows disabling `keytar` and in turn `libsecret` usage
596 (which binds to native credential managers / keychain libraries).
···621 and [services.logrotate.extraConfig](#opt-services.logrotate.extraConfig) will work, but issue deprecation
622 warnings and [services.logrotate.settings](#opt-services.logrotate.settings) should now be used instead.
623624+- `security.pam.ussh` has been added, which allows authorizing PAM sessions based on SSH _certificates_ held within an SSH agent, using [pam-ussh](https://github.com/uber/pam-ussh).
625+626- The `zrepl` package has been updated from 0.4.0 to 0.5:
627628 - The RPC protocol version was bumped; all zrepl daemons in a setup must be updated and restarted before replication can resume.
···652- xfsprogs was update to version 5.15, which enables inobtcount and bigtime by default on filesystem creation. Support for these features was added in kernel 5.10 and deemed stable in kernel 5.15.
653 If you want to be able to mount XFS filesystems created with this release of xfsprogs on kernel releases older than 5.10, you need to format them with `mkfs.xfs -m bigtime=0 -m inobtcount=0`.
654655+- `services.xserver.desktopManager.xfce` now includes Xfce's screen locker, `xfce4-screensaver` that is enabled by default. You can disable it by setting `false` to [services.xserver.desktopManager.xfce.enableScreensaver](#opt-services.xserver.desktopManager.xfce.enableScreensaver).
656657- The `hadoop` package has added support for `aarch64-linux` and `aarch64-darwin` as of 3.3.1 ([#158613](https://github.com/NixOS/nixpkgs/pull/158613)).
658
···194 (( ! $inherit_errexit_enabled )) && shopt -u inherit_errexit
195 '';
196197+ /* Remove packages of packagesToRemove from packages, based on their names.
198+ Relies on package names and has quadratic complexity so use with caution!
199+200+ Type:
201+ removePackagesByName :: [package] -> [package] -> [package]
202+203+ Example:
204+ removePackagesByName [ nautilus file-roller ] [ file-roller totem ]
205+ => [ nautilus ]
206+ */
207+ removePackagesByName = packages: packagesToRemove:
208+ let
209+ namesToRemove = map lib.getName packagesToRemove;
210+ in
211+ lib.filter (x: !(builtins.elem (lib.getName x) namesToRemove)) packages;
212+213 systemdUtils = {
214 lib = import ./systemd-lib.nix { inherit lib config pkgs; };
215 unitOptions = import ./systemd-unit-options.nix { inherit lib systemdUtils; };
+25-1
nixos/modules/config/terminfo.nix
···1# This module manages the terminfo database
2# and its integration in the system.
3-{ config, ... }:
0004{
0000000005 config = {
00000000000067 environment.pathsToLink = [
8 "/share/terminfo"
···1# This module manages the terminfo database
2# and its integration in the system.
3+{ config, lib, pkgs, ... }:
4+5+with lib;
6+7{
8+9+ options.environment.enableAllTerminfo = with lib; mkOption {
10+ default = false;
11+ type = types.bool;
12+ description = ''
13+ Whether to install all terminfo outputs
14+ '';
15+ };
16+17 config = {
18+19+ # can be generated with: filter (drv: (builtins.tryEval (drv ? terminfo)).value) (attrValues pkgs)
20+ environment.systemPackages = mkIf config.environment.enableAllTerminfo (map (x: x.terminfo) (with pkgs; [
21+ alacritty
22+ foot
23+ kitty
24+ mtm
25+ rxvt-unicode-unwrapped
26+ rxvt-unicode-unwrapped-emoji
27+ termite
28+ wezterm
29+ ]));
3031 environment.pathsToLink = [
32 "/share/terminfo"
···61 '';
62 };
6364+ usshAuth = mkOption {
65+ default = false;
66+ type = types.bool;
67+ description = ''
68+ If set, users with an SSH certificate containing an authorized principal
69+ in their SSH agent are able to log in. Specific options are controlled
70+ using the <option>security.pam.ussh</option> options.
71+72+ Note that the <option>security.pam.ussh.enable</option> must also be
73+ set for this option to take effect.
74+ '';
75+ };
76+77 yubicoAuth = mkOption {
78 default = config.security.pam.yubico.enable;
79 defaultText = literalExpression "config.security.pam.yubico.enable";
···488 optionalString cfg.usbAuth ''
489 auth sufficient ${pkgs.pam_usb}/lib/security/pam_usb.so
490 '' +
491+ (let ussh = config.security.pam.ussh; in optionalString (config.security.pam.ussh.enable && cfg.usshAuth) ''
492+ auth ${ussh.control} ${pkgs.pam_ussh}/lib/security/pam_ussh.so ${optionalString (ussh.caFile != null) "ca_file=${ussh.caFile}"} ${optionalString (ussh.authorizedPrincipals != null) "authorized_principals=${ussh.authorizedPrincipals}"} ${optionalString (ussh.authorizedPrincipalsFile != null) "authorized_principals_file=${ussh.authorizedPrincipalsFile}"} ${optionalString (ussh.group != null) "group=${ussh.group}"}
493+ '') +
494 (let oath = config.security.pam.oath; in optionalString cfg.oathAuth ''
495 auth requisite ${pkgs.oathToolkit}/lib/security/pam_oath.so window=${toString oath.window} usersfile=${toString oath.usersFile} digits=${toString oath.digits}
496 '') +
···943 };
944 };
945946+ security.pam.ussh = {
947+ enable = mkOption {
948+ default = false;
949+ type = types.bool;
950+ description = ''
951+ Enables Uber's USSH PAM (<literal>pam-ussh</literal>) module.
952+953+ This is similar to <literal>pam-ssh-agent</literal>, except that
954+ the presence of a CA-signed SSH key with a valid principal is checked
955+ instead.
956+957+ Note that this module must both be enabled using this option and on a
958+ per-PAM-service level as well (using <literal>usshAuth</literal>).
959+960+ More information can be found <link
961+ xlink:href="https://github.com/uber/pam-ussh">here</link>.
962+ '';
963+ };
964+965+ caFile = mkOption {
966+ default = null;
967+ type = with types; nullOr path;
968+ description = ''
969+ By default <literal>pam-ussh</literal> reads the trusted user CA keys
970+ from <filename>/etc/ssh/trusted_user_ca</filename>.
971+972+ This should be set the same as your <literal>TrustedUserCAKeys</literal>
973+ option for sshd.
974+ '';
975+ };
976+977+ authorizedPrincipals = mkOption {
978+ default = null;
979+ type = with types; nullOr commas;
980+ description = ''
981+ Comma-separated list of authorized principals to permit; if the user
982+ presents a certificate with one of these principals, then they will be
983+ authorized.
984+985+ Note that <literal>pam-ussh</literal> also requires that the certificate
986+ contain a principal matching the user's username. The principals from
987+ this list are in addition to those principals.
988+989+ Mutually exclusive with <literal>authorizedPrincipalsFile</literal>.
990+ '';
991+ };
992+993+ authorizedPrincipalsFile = mkOption {
994+ default = null;
995+ type = with types; nullOr path;
996+ description = ''
997+ Path to a list of principals; if the user presents a certificate with
998+ one of these principals, then they will be authorized.
999+1000+ Note that <literal>pam-ussh</literal> also requires that the certificate
1001+ contain a principal matching the user's username. The principals from
1002+ this file are in addition to those principals.
1003+1004+ Mutually exclusive with <literal>authorizedPrincipals</literal>.
1005+ '';
1006+ };
1007+1008+ group = mkOption {
1009+ default = null;
1010+ type = with types; nullOr str;
1011+ description = ''
1012+ If set, then the authenticating user must be a member of this group
1013+ to use this module.
1014+ '';
1015+ };
1016+1017+ control = mkOption {
1018+ default = "sufficient";
1019+ type = types.enum [ "required" "requisite" "sufficient" "optional" ];
1020+ description = ''
1021+ This option sets pam "control".
1022+ If you want to have multi factor authentication, use "required".
1023+ If you want to use the SSH certificate instead of the regular password,
1024+ use "sufficient".
1025+1026+ Read
1027+ <citerefentry>
1028+ <refentrytitle>pam.conf</refentrytitle>
1029+ <manvolnum>5</manvolnum>
1030+ </citerefentry>
1031+ for better understanding of this option.
1032+ '';
1033+ };
1034+ };
1035+1036 security.pam.yubico = {
1037 enable = mkOption {
1038 default = false;
···1216 '' +
1217 optionalString (isEnabled (cfg: cfg.usbAuth)) ''
1218 mr ${pkgs.pam_usb}/lib/security/pam_usb.so,
1219+ '' +
1220+ optionalString (isEnabled (cfg: cfg.usshAuth)) ''
1221+ mr ${pkgs.pam_ussh}/lib/security/pam_ussh.so,
1222 '' +
1223 optionalString (isEnabled (cfg: cfg.oathAuth)) ''
1224 "mr ${pkgs.oathToolkit}/lib/security/pam_oath.so,
···1011 check = {
1213+ global = {
14+ sectionNetwork = checkUnitConfig "Network" [
15+ (assertOnlyFields [
16+ "SpeedMeter"
17+ "SpeedMeterIntervalSec"
18+ "ManageForeignRoutingPolicyRules"
19+ "ManageForeignRoutes"
20+ "RouteTable"
21+ ])
22+ (assertValueOneOf "SpeedMeter" boolValues)
23+ (assertInt "SpeedMeterIntervalSec")
24+ (assertValueOneOf "ManageForeignRoutingPolicyRules" boolValues)
25+ (assertValueOneOf "ManageForeignRoutes" boolValues)
26+ ];
27+28+ sectionDHCPv4 = checkUnitConfig "DHCPv4" [
29+ (assertOnlyFields [
30+ "DUIDType"
31+ "DUIDRawData"
32+ ])
33+ ];
34+35+ sectionDHCPv6 = checkUnitConfig "DHCPv6" [
36+ (assertOnlyFields [
37+ "DUIDType"
38+ "DUIDRawData"
39+ ])
40+ ];
41+ };
42+43 link = {
4445 sectionLink = checkUnitConfig "Link" [
···898 default = "";
899 type = types.lines;
900 description = "Extra configuration append to unit";
901+ };
902+ };
903+904+ networkdOptions = {
905+ networkConfig = mkOption {
906+ default = {};
907+ example = { SpeedMeter = true; ManageForeignRoutingPolicyRules = false; };
908+ type = types.addCheck (types.attrsOf unitOption) check.global.sectionNetwork;
909+ description = ''
910+ Each attribute in this set specifies an option in the
911+ <literal>[Network]</literal> section of the networkd config.
912+ See <citerefentry><refentrytitle>networkd.conf</refentrytitle>
913+ <manvolnum>5</manvolnum></citerefentry> for details.
914+ '';
915+ };
916+917+ dhcpV4Config = mkOption {
918+ default = {};
919+ example = { DUIDType = "vendor"; };
920+ type = types.addCheck (types.attrsOf unitOption) check.global.sectionDHCPv4;
921+ description = ''
922+ Each attribute in this set specifies an option in the
923+ <literal>[DHCPv4]</literal> section of the networkd config.
924+ See <citerefentry><refentrytitle>networkd.conf</refentrytitle>
925+ <manvolnum>5</manvolnum></citerefentry> for details.
926+ '';
927+ };
928+929+ dhcpV6Config = mkOption {
930+ default = {};
931+ example = { DUIDType = "vendor"; };
932+ type = types.addCheck (types.attrsOf unitOption) check.global.sectionDHCPv6;
933+ description = ''
934+ Each attribute in this set specifies an option in the
935+ <literal>[DHCPv6]</literal> section of the networkd config.
936+ See <citerefentry><refentrytitle>networkd.conf</refentrytitle>
937+ <manvolnum>5</manvolnum></citerefentry> for details.
938+ '';
939 };
940 };
941···1587 };
1588 };
15891590+ networkdConfig = { config, ... }: {
1591+ options = {
1592+ routeTables = mkOption {
1593+ default = {};
1594+ example = { foo = 27; };
1595+ type = with types; attrsOf int;
1596+ description = ''
1597+ Defines route table names as an attrset of name to number.
1598+ See <citerefentry><refentrytitle>networkd.conf</refentrytitle>
1599+ <manvolnum>5</manvolnum></citerefentry> for details.
1600+ '';
1601+ };
1602+1603+ addRouteTablesToIPRoute2 = mkOption {
1604+ default = true;
1605+ example = false;
1606+ type = types.bool;
1607+ description = ''
1608+ If true and routeTables are set, then the specified route tables
1609+ will also be installed into /etc/iproute2/rt_tables.
1610+ '';
1611+ };
1612+ };
1613+1614+ config = {
1615+ networkConfig = optionalAttrs (config.routeTables != { }) {
1616+ RouteTable = mapAttrsToList
1617+ (name: number: "${name}:${toString number}")
1618+ config.routeTables;
1619+ };
1620+ };
1621+ };
1622+1623 commonMatchText = def: optionalString (def.matchConfig != { }) ''
1624 [Match]
1625 ${attrsToSection def.matchConfig}
···1701 + def.extraConfig;
1702 };
17031704+ renderConfig = def:
1705+ { text = ''
1706+ [Network]
1707+ ${attrsToSection def.networkConfig}
1708+ ''
1709+ + optionalString (def.dhcpV4Config != { }) ''
1710+ [DHCPv4]
1711+ ${attrsToSection def.dhcpV4Config}
1712+ ''
1713+ + optionalString (def.dhcpV6Config != { }) ''
1714+ [DHCPv6]
1715+ ${attrsToSection def.dhcpV6Config}
1716+ ''; };
1717+1718 networkToUnit = name: def:
1719 { inherit (def) enable;
1720 text = commonMatchText def
···1847 description = "Definition of systemd networks.";
1848 };
18491850+ systemd.network.config = mkOption {
1851+ default = {};
1852+ type = with types; submodule [ { options = networkdOptions; } networkdConfig ];
1853+ description = "Definition of global systemd network config.";
1854+ };
1855+1856 systemd.network.units = mkOption {
1857 description = "Definition of networkd units.";
1858 default = {};
···1944 systemd.services.systemd-networkd = {
1945 wantedBy = [ "multi-user.target" ];
1946 aliases = [ "dbus-org.freedesktop.network1.service" ];
1947+ restartTriggers = map (x: x.source) (attrValues unitFiles) ++ [
1948+ config.environment.etc."systemd/networkd.conf".source
1949+ ];
1950 };
19511952 systemd.services.systemd-networkd-wait-online = {
···1967 RemainAfterExit = true;
1968 ExecStart = "${config.systemd.package}/lib/systemd/systemd-networkd-wait-online -i %I ${utils.escapeSystemdExecArgs cfg.wait-online.extraArgs}";
1969 };
1970+ };
1971+1972+ environment.etc."systemd/networkd.conf" = renderConfig cfg.config;
1973+1974+ networking.iproute2 = mkIf (cfg.config.addRouteTablesToIPRoute2 && cfg.config.routeTables != { }) {
1975+ enable = mkDefault true;
1976+ rttablesExtraConfig = ''
1977+1978+ # Extra tables defined in NixOS systemd.networkd.config.routeTables.
1979+ ${concatStringsSep "\n" (mapAttrsToList (name: number: "${toString number} ${name}") cfg.config.routeTables)}
1980+ '';
1981 };
19821983 services.resolved.enable = mkDefault true;
+59-41
nixos/modules/system/boot/stage-2-init.sh
···5export HOME=/root PATH="@path@"
678-# Process the kernel command line.
9-for o in $(</proc/cmdline); do
10- case $o in
11- boot.debugtrace)
12- # Show each command.
13- set -x
14- ;;
15- esac
16-done
0171819-# Print a greeting.
20-echo
21-echo -e "\e[1;32m<<< NixOS Stage 2 >>>\e[0m"
22-echo
232425-# Normally, stage 1 mounts the root filesystem read/writable.
26-# However, in some environments, stage 2 is executed directly, and the
27-# root is read-only. So make it writable here.
28-if [ -z "$container" ]; then
29- mount -n -o remount,rw none /
030fi
3132···39 local options="$3"
40 local fsType="$4"
4100000042 install -m 0755 -d "$mountPoint"
43 mount -n -t "$fsType" -o "$options" "$device" "$mountPoint"
44 }
···46fi
474849-echo "booting system configuration $systemConfig" > /dev/kmsg
0000505152# Make /nix/store a read-only bind mount to enforce immutability of
···68fi
697071-# Use /etc/resolv.conf supplied by systemd-nspawn, if applicable.
72-if [ -n "@useHostResolvConf@" ] && [ -e /etc/resolv.conf ]; then
73- resolvconf -m 1000 -a host </etc/resolv.conf
74-fi
0757677-# Log the script output to /dev/kmsg or /run/log/stage-2-init.log.
78-# Only at this point are all the necessary prerequisites ready for these commands.
79-exec {logOutFd}>&1 {logErrFd}>&2
80-if test -w /dev/kmsg; then
81- exec > >(tee -i /proc/self/fd/"$logOutFd" | while read -r line; do
82- if test -n "$line"; then
83- echo "<7>stage-2-init: $line" > /dev/kmsg
84- fi
85- done) 2>&1
86-else
87- mkdir -p /run/log
88- exec > >(tee -i /run/log/stage-2-init.log) 2>&1
089fi
9091···116: >> /etc/machine-id
117118119-# Reset the logging file descriptors.
120-exec 1>&$logOutFd 2>&$logErrFd
121-exec {logOutFd}>&- {logErrFd}>&-
000122123124-# Start systemd in a clean environment.
125-echo "starting systemd..."
126-exec @systemdExecutable@ "$@"
0
···5export HOME=/root PATH="@path@"
678+if [ "${IN_NIXOS_SYSTEMD_STAGE1:-}" != true ]; then
9+ # Process the kernel command line.
10+ for o in $(</proc/cmdline); do
11+ case $o in
12+ boot.debugtrace)
13+ # Show each command.
14+ set -x
15+ ;;
16+ esac
17+ done
181920+ # Print a greeting.
21+ echo
22+ echo -e "\e[1;32m<<< NixOS Stage 2 >>>\e[0m"
23+ echo
242526+ # Normally, stage 1 mounts the root filesystem read/writable.
27+ # However, in some environments, stage 2 is executed directly, and the
28+ # root is read-only. So make it writable here.
29+ if [ -z "$container" ]; then
30+ mount -n -o remount,rw none /
31+ fi
32fi
3334···41 local options="$3"
42 local fsType="$4"
4344+ # We must not overwrite this mount because it's bind-mounted
45+ # from stage 1's /run
46+ if [ "${IN_NIXOS_SYSTEMD_STAGE1:-}" = true ] && [ "${mountPoint}" = /run ]; then
47+ return
48+ fi
49+50 install -m 0755 -d "$mountPoint"
51 mount -n -t "$fsType" -o "$options" "$device" "$mountPoint"
52 }
···54fi
555657+if [ "${IN_NIXOS_SYSTEMD_STAGE1:-}" = true ]; then
58+ echo "booting system configuration ${systemConfig}"
59+else
60+ echo "booting system configuration $systemConfig" > /dev/kmsg
61+fi
626364# Make /nix/store a read-only bind mount to enforce immutability of
···80fi
818283+if [ "${IN_NIXOS_SYSTEMD_STAGE1:-}" != true ]; then
84+ # Use /etc/resolv.conf supplied by systemd-nspawn, if applicable.
85+ if [ -n "@useHostResolvConf@" ] && [ -e /etc/resolv.conf ]; then
86+ resolvconf -m 1000 -a host </etc/resolv.conf
87+ fi
888990+ # Log the script output to /dev/kmsg or /run/log/stage-2-init.log.
91+ # Only at this point are all the necessary prerequisites ready for these commands.
92+ exec {logOutFd}>&1 {logErrFd}>&2
93+ if test -w /dev/kmsg; then
94+ exec > >(tee -i /proc/self/fd/"$logOutFd" | while read -r line; do
95+ if test -n "$line"; then
96+ echo "<7>stage-2-init: $line" > /dev/kmsg
97+ fi
98+ done) 2>&1
99+ else
100+ mkdir -p /run/log
101+ exec > >(tee -i /run/log/stage-2-init.log) 2>&1
102+ fi
103fi
104105···130: >> /etc/machine-id
131132133+# No need to restore the stdout/stderr streams we never redirected and
134+# especially no need to start systemd
135+if [ "${IN_NIXOS_SYSTEMD_STAGE1:-}" != true ]; then
136+ # Reset the logging file descriptors.
137+ exec 1>&$logOutFd 2>&$logErrFd
138+ exec {logOutFd}>&- {logErrFd}>&-
139140141+ # Start systemd in a clean environment.
142+ echo "starting systemd..."
143+ exec @systemdExecutable@ "$@"
144+fi
-8
nixos/modules/system/boot/systemd.nix
···573 })
574 (filterAttrs (name: service: service.enable && service.startAt != []) cfg.services);
575576- # Generate timer units for all services that have a ‘startAt’ value.
577- systemd.user.timers =
578- mapAttrs (name: service:
579- { wantedBy = [ "timers.target" ];
580- timerConfig.OnCalendar = service.startAt;
581- })
582- (filterAttrs (name: service: service.startAt != []) cfg.user.services);
583-584 # Some overrides to upstream units.
585 systemd.services."systemd-backlight@".restartIfChanged = false;
586 systemd.services."systemd-fsck@".restartIfChanged = false;
···46# Those pieces of software we entirely ignore upstream's handling of, and just
47# make sure they're in the path if desired.
48let
49- k3sVersion = "1.23.4+k3s1"; # k3s git tag
50- k3sCommit = "43b1cb48200d8f6af85c16ed944d68fcc96b6506"; # k3s git commit at the above version
51- k3sRepoSha256 = "1sn7rd5hqfqvwj036blk0skmq6r8igbmiqk1dnpaqnkkddpzdgmc";
52- k3sVendorSha256 = "sha256-1/kQvNqFUWwch1JH+twWzBdjNYseoZyVObB1+s9WPM4=";
5354- k3sServerVendorSha256 = "sha256-2KIFff43jfqWdxX61aWofrjmc5mMkr5aEJRFdGpLyU8=";
5556 # taken from ./manifests/traefik.yaml, extracted from '.spec.chart' https://github.com/k3s-io/k3s/blob/v1.23.3%2Bk3s1/scripts/download#L9
57 # The 'patch' and 'minor' versions are currently hardcoded as single digits only, so ignore the trailing two digits. Weird, I know.
···6869 # taken from go.mod, the 'github.com/containerd/containerd' line
70 # run `grep github.com/containerd/containerd go.mod | head -n1 | awk '{print $4}'`
71- containerdVersion = "1.5.9-k3s1";
72- containerdSha256 = "09wfy20z3c9fnla353pibpsb10xzl0f4xwp8qdjh3fwa1q2626gg";
7374 # run `grep github.com/kubernetes-sigs/cri-tools go.mod | head -n1 | awk '{print $4}'` in the k3s repo at the tag
75 criCtlVersion = "1.22.0-k3s1";
···228229 patches = [
230 ./patches/0001-scrips-download-strip-downloading-just-package-CRD.patch
231- ./patches/0002-Don-t-build-a-static-binary-in-package-cli.patch
232 ];
0000000000000000233234 # Important utilities used by the kubelet, see
235 # https://github.com/kubernetes/kubernetes/issues/26093#issuecomment-237202494
···46# Those pieces of software we entirely ignore upstream's handling of, and just
47# make sure they're in the path if desired.
48let
49+ k3sVersion = "1.23.5+k3s1"; # k3s git tag
50+ k3sCommit = "313aaca547f030752788dce696fdf8c9568bc035"; # k3s git commit at the above version
51+ k3sRepoSha256 = "0vk72609cyyh64irp14jp2zspnxw34jm710cbwgklx0ch6kiz88d";
52+ k3sVendorSha256 = "sha256-d7kQsJi/eQbaTUDglp3gFpc5Im6CyD9coKeM3kMrbjI=";
5354+ k3sServerVendorSha256 = "sha256-E3USXNuXY0lzZH+t3O7BOQ8rKNNQ6avOMItgOEi1cEg=";
5556 # taken from ./manifests/traefik.yaml, extracted from '.spec.chart' https://github.com/k3s-io/k3s/blob/v1.23.3%2Bk3s1/scripts/download#L9
57 # The 'patch' and 'minor' versions are currently hardcoded as single digits only, so ignore the trailing two digits. Weird, I know.
···6869 # taken from go.mod, the 'github.com/containerd/containerd' line
70 # run `grep github.com/containerd/containerd go.mod | head -n1 | awk '{print $4}'`
71+ containerdVersion = "1.5.10-k3s1";
72+ containerdSha256 = "1ff2sfaqpjimq7w0lprci6ibyi6v65ap6b9sr6b0j12gqr2sqwa5";
7374 # run `grep github.com/kubernetes-sigs/cri-tools go.mod | head -n1 | awk '{print $4}'` in the k3s repo at the tag
75 criCtlVersion = "1.22.0-k3s1";
···228229 patches = [
230 ./patches/0001-scrips-download-strip-downloading-just-package-CRD.patch
0231 ];
232+233+ postPatch = ''
234+ # Nix prefers dynamically linked binaries over static binary.
235+236+ substituteInPlace scripts/package-cli \
237+ --replace '"$LDFLAGS $STATIC" -o' \
238+ '"$LDFLAGS" -o' \
239+ --replace "STATIC=\"-extldflags \'-static\'\"" \
240+ ""
241+242+ # Upstream codegen fails with trimpath set. Removes "trimpath" for 'go generate':
243+244+ substituteInPlace scripts/package-cli \
245+ --replace '"''${GO}" generate' \
246+ 'GOFLAGS="" "''${GO}" generate'
247+ '';
248249 # Important utilities used by the kubelet, see
250 # https://github.com/kubernetes/kubernetes/issues/26093#issuecomment-237202494
···23buildGoModule rec {
4 pname = "ipfs";
5- version = "0.12.1"; # When updating, also check if the repo version changed and adjust repoVersion below
6 rev = "v${version}";
78 repoVersion = "12"; # Also update ipfs-migrator when changing the repo version
···10 # go-ipfs makes changes to it's source tarball that don't match the git source.
11 src = fetchurl {
12 url = "https://github.com/ipfs/go-ipfs/releases/download/${rev}/go-ipfs-source.tar.gz";
13- sha256 = "sha256-fUExCvE6x5VFBl66y52DGvr8ZNSXZ6MYpVQP/D7X328=";
14 };
1516 # tarball contains multiple files/directories
···23buildGoModule rec {
4 pname = "ipfs";
5+ version = "0.12.2"; # When updating, also check if the repo version changed and adjust repoVersion below
6 rev = "v${version}";
78 repoVersion = "12"; # Also update ipfs-migrator when changing the repo version
···10 # go-ipfs makes changes to it's source tarball that don't match the git source.
11 src = fetchurl {
12 url = "https://github.com/ipfs/go-ipfs/releases/download/${rev}/go-ipfs-source.tar.gz";
13+ sha256 = "sha256-66NNLMSfeBHQh/QlnETB/ssra9CKbD+jtaJuX+14x00=";
14 };
1516 # tarball contains multiple files/directories
···1{ lib
2, fetchFromGitHub
03, armadillo
4, cmake
5, gmp
···34 # cpu_features which is bundled in the source. NOTE: Perhaps this patch
35 # should be sent upstream.
36 ./fix_libcpu_features_install_path.patch
0000037 ];
3839 nativeBuildInputs = [
···1{ lib
2, fetchFromGitHub
3+, fetchpatch
4, armadillo
5, cmake
6, gmp
···35 # cpu_features which is bundled in the source. NOTE: Perhaps this patch
36 # should be sent upstream.
37 ./fix_libcpu_features_install_path.patch
38+ # Fixes a compilation issue, should be removed on next release.
39+ (fetchpatch {
40+ url = "https://github.com/gnss-sdr/gnss-sdr/commit/8a42967c854e575f2dd9ee7ca81a2522eebb864b.patch";
41+ sha256 = "sha256-W8BwC08QVtW0LUj5Q+j28aYG+713s+vQIzsWyrNUs1Q=";
42+ })
43 ];
4445 nativeBuildInputs = [
···178 chmod -R 755 share
179 cp -rLTf ${staticUsrProfileTarget}/share share
180 else
181- cp -rLf ${staticUsrProfileTarget}/share share
182 fi
183 fi
184 for i in bin sbin include; do
···178 chmod -R 755 share
179 cp -rLTf ${staticUsrProfileTarget}/share share
180 else
181+ cp -rsHf ${staticUsrProfileTarget}/share share
182 fi
183 fi
184 for i in bin sbin include; do
+23-17
pkgs/build-support/setup-hooks/auto-patchelf.py
···1#!/usr/bin/env python3
23-from collections import defaultdict
4-from contextlib import contextmanager
5-from dataclasses import dataclass
6-from elftools.common.exceptions import ELFError # type: ignore
7-from elftools.elf.dynamic import DynamicSection # type: ignore
8-from elftools.elf.elffile import ELFFile # type: ignore
9-from elftools.elf.enums import ENUM_E_TYPE, ENUM_EI_OSABI # type: ignore
10-from itertools import chain
11-from pathlib import Path, PurePath
12-13-from typing import Tuple, Optional, Iterator, List, DefaultDict, Set
14-15import argparse
16import os
17import pprint
18import subprocess
19import sys
000000200000212223@contextmanager
···246 lib_dirs: List[Path],
247 runtime_deps: List[Path],
248 recursive: bool =True,
249- ignore_missing: bool =False) -> None:
250251 if not paths_to_patch:
252 sys.exit("No paths to patch, stopping.")
···264 missing = [dep for dep in dependencies if not dep.found]
265266 # Print a summary of the missing dependencies at the end
00267 for dep in missing:
268- print(f"auto-patchelf could not satisfy dependency {dep.name} wanted by {dep.file}")
0000269270- if missing and not ignore_missing:
271 sys.exit('auto-patchelf failed to find all the required dependencies.\n'
272- 'Add the missing dependencies to --libs or use --ignore-missing.')
0273274275def main() -> None:
···280 'libraries in the provided paths.')
281 parser.add_argument(
282 "--ignore-missing",
283- action="store_true",
0284 help="Do not fail when some dependencies are not found.")
285 parser.add_argument(
286 "--no-recurse",
···1#!/usr/bin/env python3
20000000000003import argparse
4import os
5import pprint
6import subprocess
7import sys
8+from collections import defaultdict
9+from contextlib import contextmanager
10+from dataclasses import dataclass
11+from itertools import chain
12+from pathlib import Path, PurePath
13+from typing import DefaultDict, Iterator, List, Optional, Set, Tuple
1415+from elftools.common.exceptions import ELFError # type: ignore
16+from elftools.elf.dynamic import DynamicSection # type: ignore
17+from elftools.elf.elffile import ELFFile # type: ignore
18+from elftools.elf.enums import ENUM_E_TYPE, ENUM_EI_OSABI # type: ignore
192021@contextmanager
···244 lib_dirs: List[Path],
245 runtime_deps: List[Path],
246 recursive: bool =True,
247+ ignore_missing: List[str] = []) -> None:
248249 if not paths_to_patch:
250 sys.exit("No paths to patch, stopping.")
···262 missing = [dep for dep in dependencies if not dep.found]
263264 # Print a summary of the missing dependencies at the end
265+ print(f"auto-patchelf: {len(missing)} dependencies could not be satisfied")
266+ failure = False
267 for dep in missing:
268+ if dep.name.name in ignore_missing or "*" in ignore_missing:
269+ print(f"warn: auto-patchelf ignoring missing {dep.name} wanted by {dep.file}")
270+ else:
271+ print(f"error: auto-patchelf could not satisfy dependency {dep.name} wanted by {dep.file}")
272+ failure = True
273274+ if failure:
275 sys.exit('auto-patchelf failed to find all the required dependencies.\n'
276+ 'Add the missing dependencies to --libs or use '
277+ '`--ignore-missing="foo.so.1 bar.so etc.so"`.')
278279280def main() -> None:
···285 'libraries in the provided paths.')
286 parser.add_argument(
287 "--ignore-missing",
288+ nargs="*",
289+ type=str,
290 help="Do not fail when some dependencies are not found.")
291 parser.add_argument(
292 "--no-recurse",
···77 - Filter out versions that only support old GNOME versions
78 - Download the extension and hash it
79 """
80- extension_versions: Dict[ShellVersion, Dict[str, str]] = {}
0081 for shell_version, version_prefix in supported_versions.items():
82 # Newest compatible extension version
83 extension_version: Optional[int] = max(
···91 # Extension is not compatible with this GNOME version
92 if not extension_version:
93 continue
00000094 logging.debug(
95- f"[{shell_version}] Downloading '{uuid}' v{extension_version}"
96 )
97- sha256, metadata = fetch_extension_data(uuid, str(extension_version))
98- extension_versions[shell_version] = {
000000099 "version": str(extension_version),
100 "sha256": sha256,
101 # The downloads are impure, their metadata.json may change at any time.
···103 # Upstream issue: https://gitlab.gnome.org/Infrastructure/extensions-web/-/issues/137
104 "metadata": metadata,
105 }
106- return extension_versions
107108109def pname_from_url(url: str) -> Tuple[str, str]:
···77 - Filter out versions that only support old GNOME versions
78 - Download the extension and hash it
79 """
80+81+ # Determine extension version per shell version
82+ extension_versions: Dict[ShellVersion, ExtensionVersion] = {}
83 for shell_version, version_prefix in supported_versions.items():
84 # Newest compatible extension version
85 extension_version: Optional[int] = max(
···93 # Extension is not compatible with this GNOME version
94 if not extension_version:
95 continue
96+97+ extension_versions[shell_version] = extension_version
98+99+ # Download information once for all extension versions chosen above
100+ extension_info_cache: Dict[ExtensionVersion, Tuple[str, str]] = {}
101+ for extension_version in sorted(set(extension_versions.values())):
102 logging.debug(
103+ f"[{uuid}] Downloading v{extension_version}"
104 )
105+ extension_info_cache[extension_version] = \
106+ fetch_extension_data(uuid, str(extension_version))
107+108+ # Fill map
109+ extension_versions_full: Dict[ShellVersion, Dict[str, str]] = {}
110+ for shell_version, extension_version in extension_versions.items():
111+ sha256, metadata = extension_info_cache[extension_version]
112+113+ extension_versions_full[shell_version] = {
114 "version": str(extension_version),
115 "sha256": sha256,
116 # The downloads are impure, their metadata.json may change at any time.
···118 # Upstream issue: https://gitlab.gnome.org/Infrastructure/extensions-web/-/issues/137
119 "metadata": metadata,
120 }
121+ return extension_versions_full
122123124def pname_from_url(url: str) -> Tuple[str, str]:
···1-{ lib, stdenv, fetchFromGitHub, cmake, python3, validatePkgConfig, fetchpatch }:
00000000023stdenv.mkDerivation rec {
4 pname = "jsoncpp";
···28 cp -a ${src} ${src.name}
29 chmod -R +w ${src.name}
30 export sourceRoot=${src.name}
000031 '';
3233 # Hack to be able to run the test, broken because we use
···4243 cmakeFlags = [
44 "-DBUILD_SHARED_LIBS=ON"
45- "-DBUILD_STATIC_LIBS=OFF"
46 "-DBUILD_OBJECT_LIBS=OFF"
47 "-DJSONCPP_WITH_CMAKE_PACKAGE=ON"
48- ] ++ lib.optional (stdenv.buildPlatform != stdenv.hostPlatform) "-DJSONCPP_WITH_TESTS=OFF";
0000000000004950 meta = with lib; {
51 homepage = "https://github.com/open-source-parsers/jsoncpp";
···1+{ lib
2+, stdenv
3+, fetchFromGitHub
4+, cmake
5+, python3
6+, validatePkgConfig
7+, fetchpatch
8+, secureMemory ? false
9+, enableStatic ? stdenv.hostPlatform.isStatic
10+}:
1112stdenv.mkDerivation rec {
13 pname = "jsoncpp";
···37 cp -a ${src} ${src.name}
38 chmod -R +w ${src.name}
39 export sourceRoot=${src.name}
40+ '';
41+42+ postPatch = lib.optionalString secureMemory ''
43+ sed -i 's/#define JSONCPP_USING_SECURE_MEMORY 0/#define JSONCPP_USING_SECURE_MEMORY 1/' include/json/version.h
44 '';
4546 # Hack to be able to run the test, broken because we use
···5556 cmakeFlags = [
57 "-DBUILD_SHARED_LIBS=ON"
058 "-DBUILD_OBJECT_LIBS=OFF"
59 "-DJSONCPP_WITH_CMAKE_PACKAGE=ON"
60+ ]
61+ # the test's won't compile if secureMemory is used because there is no
62+ # comparison operators and conversion functions between
63+ # std::basic_string<..., Json::SecureAllocator<char>> vs.
64+ # std::basic_string<..., [default allocator]>
65+ ++ lib.optional ((stdenv.buildPlatform != stdenv.hostPlatform) || secureMemory) "-DJSONCPP_WITH_TESTS=OFF"
66+ ++ lib.optional (!enableStatic) "-DBUILD_STATIC_LIBS=OFF";
67+68+ # this is fixed and no longer necessary in 1.9.5 but there they use
69+ # memset_s without switching to a different c++ standard in the cmake files
70+ postInstall = lib.optionalString enableStatic ''
71+ (cd $out/lib && ln -sf libjsoncpp_static.a libjsoncpp.a)
72+ '';
7374 meta = with lib; {
75 homepage = "https://github.com/open-source-parsers/jsoncpp";
···1-{ callPackage, fetchurl, ... } @ args:
2-3-callPackage ./generic.nix (args // rec {
4- version = "2.5.0";
5- # make sure you test also -A pythonPackages.protobuf
6- src = fetchurl {
7- url = "http://protobuf.googlecode.com/files/${version}.tar.bz2";
8- sha256 = "0xxn9gxhvsgzz2sgmihzf6pf75clr05mqj6218camwrwajpcbgqk";
9- };
10-})
···0000000000
-61
pkgs/development/libraries/protobuf/generic.nix
···1-{ lib, stdenv, version, src
2-, autoreconfHook, zlib, gtest
3-, ...
4-}:
5-6-stdenv.mkDerivation {
7- pname = "protobuf";
8- inherit version;
9-10- inherit src;
11-12- postPatch = ''
13- rm -rf gtest
14- cp -r ${gtest.src}/googletest gtest
15- chmod -R a+w gtest
16- '' + lib.optionalString stdenv.isDarwin ''
17- substituteInPlace src/google/protobuf/testing/googletest.cc \
18- --replace 'tmpnam(b)' '"'$TMPDIR'/foo"'
19- '';
20-21- outputs = [ "out" "lib" ];
22-23- nativeBuildInputs = [ autoreconfHook ];
24- buildInputs = [ zlib ];
25-26- # The generated C++ code uses static initializers which mutate a global data
27- # structure. This causes problems for an executable when:
28- #
29- # 1) it dynamically links to two libs, both of which contain generated C++ for
30- # the same proto file, and
31- # 2) the two aforementioned libs both dynamically link to libprotobuf.
32- #
33- # One solution is to statically link libprotobuf, that way the global
34- # variables are not shared; in fact, this is necessary for the python Mesos
35- # binding to not crash, as the python lib contains two C extensions which
36- # both refer to the same proto schema.
37- #
38- # See: https://github.com/NixOS/nixpkgs/pull/19064#issuecomment-255082684
39- # https://github.com/google/protobuf/issues/1489
40- dontDisableStatic = true;
41- configureFlags = [
42- "CFLAGS=-fPIC"
43- "CXXFLAGS=-fPIC"
44- ];
45-46- doCheck = true;
47-48- meta = {
49- description = "Protocol Buffers - Google's data interchange format";
50- longDescription =
51- '' Protocol Buffers are a way of encoding structured data in an
52- efficient yet extensible format. Google uses Protocol Buffers for
53- almost all of its internal RPC protocols and file formats.
54- '';
55- license = "mBSD";
56- homepage = "https://developers.google.com/protocol-buffers/";
57- platforms = lib.platforms.unix;
58- };
59-60- passthru.version = version;
61-}
···1-diff --git a/setup.py b/setup.py
2-index 9429459622..2727b3becb 100644
3---- a/setup.py
4-+++ b/setup.py
5-@@ -136,12 +136,12 @@ REQUIRED_PACKAGES = [
6- # version of dill. It is best to use the same version of dill on client and
7- # server, therefore list of allowed versions is very narrow.
8- # See: https://github.com/uqfoundation/dill/issues/341.
9-- 'dill>=0.3.1.1,<0.3.2',
10-+ 'dill>=0.3.1.1',
11- 'fastavro>=0.21.4,<2',
12- 'grpcio>=1.29.0,<2',
13- 'hdfs>=2.1.0,<3.0.0',
14-- 'httplib2>=0.8,<0.20.0',
15-- 'numpy>=1.14.3,<1.21.0',
16-+ 'httplib2>=0.8',
17-+ 'numpy>=1.14.3',
18- 'pymongo>=3.8.0,<4.0.0',
19- 'oauth2client>=2.0.1,<5',
20- 'protobuf>=3.12.2,<4',
···1+{ lib
2+, stdenv
3+, fetchFromGitHub
4+, fetchpatch
5+}:
67stdenv.mkDerivation rec {
8 pname = "samurai";
···12 owner = "michaelforney";
13 repo = pname;
14 rev = version;
15+ hash = "sha256-RPY3MFlnSDBZ5LOkdWnMiR/CZIBdqIFo9uLU+SAKPBI=";
16 };
1718 makeFlags = [ "DESTDIR=" "PREFIX=${placeholder "out"}" ];
1920 patches = [
21+ # NULL pointer dereference in writefile() in util.c; remove this at the next
22+ # release
23 (fetchpatch {
24 name = "CVE-2021-30218.patch";
25 url = "https://github.com/michaelforney/samurai/commit/e84b6d99c85043fa1ba54851ee500540ec206918.patch";
26 sha256 = "sha256-hyndwj6st4rwOJ35Iu0qL12dR5E6CBvsulvR27PYKMw=";
27 })
28+ # NULL pointer dereference in printstatus() in build.c; remove this at the
29+ # next release
30 (fetchpatch {
31 name = "CVE-2021-30219.patch";
32 url = "https://github.com/michaelforney/samurai/commit/d2af3bc375e2a77139c3a28d6128c60cd8d08655.patch";
···35 ];
3637 meta = with lib; {
38+ homepage = "https://github.com/michaelforney/samurai";
39 description = "ninja-compatible build tool written in C";
40+ longDescription = ''
41+ samurai is a ninja-compatible build tool with a focus on simplicity,
42+ speed, and portability.
43+44+ It is written in C99, requires various POSIX.1-2008 interfaces, and
45+ nowadays implements ninja build language through version 1.9.0 except for
46+ Microsoft (R) Visual C++ (TM) dependency handling (deps = msvc).
47+48+ It is feature-complete (but not bug-compatible) and supports most of the
49+ same options as ninja, using the same format for .ninja_log and
50+ .ninja_deps as the original ninja tool, currently version 5 and 4
51+ respectively.
52+ '';
53 license = with licenses; [ mit asl20 ]; # see LICENSE
54+ maintainers = with maintainers; [ dtzWill AndersonTorres ];
55+ platforms = platforms.all;
56 };
57}
58
···1-{ lib, stdenv, fetchurl, removeReferencesTo }:
000023stdenv.mkDerivation rec {
4 pname = "pkgconf";
5 version = "1.8.0";
67- nativeBuildInputs = [ removeReferencesTo ];
00089 outputs = [ "out" "lib" "dev" "man" "doc" ];
100011 enableParallelBuilding = true;
1213- src = fetchurl {
14- url = "https://distfiles.dereferenced.org/${pname}/${pname}-${version}.tar.xz";
15- sha256 = "sha256-75x+YYIrfLg1bm6eHcpY2VVvMgDXisqzXkNH6dTCu68=";
16- };
17-18- # Debian has outputs like these too:
19- # https://packages.debian.org/source/buster/pkgconf, so take it this
20- # reference removing is safe.
21 postFixup = ''
00022 remove-references-to \
23 -t "${placeholder "dev"}" \
24 "${placeholder "lib"}"/lib/* \
25 "${placeholder "out"}"/bin/*
26- remove-references-to \
27- -t "${placeholder "out"}" \
28- "${placeholder "lib"}"/lib/*
29 ''
30 # Move back share/aclocal. Yes, this normally goes in the dev output for good
31 # reason, but in this case the dev output is for the `libpkgconf` library,
···37 '';
3839 meta = with lib; {
040 description = "Package compiler and linker metadata toolkit";
41- homepage = "https://git.dereferenced.org/pkgconf/pkgconf";
42- platforms = platforms.all;
000000043 license = licenses.isc;
44- maintainers = with maintainers; [ zaninime ];
045 };
46}
···1+{ lib
2+, stdenv
3+, fetchurl
4+, removeReferencesTo
5+}:
67stdenv.mkDerivation rec {
8 pname = "pkgconf";
9 version = "1.8.0";
1011+ src = fetchurl {
12+ url = "https://distfiles.dereferenced.org/${pname}/${pname}-${version}.tar.xz";
13+ hash = "sha256-75x+YYIrfLg1bm6eHcpY2VVvMgDXisqzXkNH6dTCu68=";
14+ };
1516 outputs = [ "out" "lib" "dev" "man" "doc" ];
1718+ nativeBuildInputs = [ removeReferencesTo ];
19+20 enableParallelBuilding = true;
2122+ # Debian has outputs like these too
23+ # (https://packages.debian.org/source/bullseye/pkgconf), so it is safe to
24+ # remove those references
0000025 postFixup = ''
26+ remove-references-to \
27+ -t "${placeholder "out"}" \
28+ "${placeholder "lib"}"/lib/*
29 remove-references-to \
30 -t "${placeholder "dev"}" \
31 "${placeholder "lib"}"/lib/* \
32 "${placeholder "out"}"/bin/*
00033 ''
34 # Move back share/aclocal. Yes, this normally goes in the dev output for good
35 # reason, but in this case the dev output is for the `libpkgconf` library,
···41 '';
4243 meta = with lib; {
44+ homepage = "https://github.com/pkgconf/pkgconf";
45 description = "Package compiler and linker metadata toolkit";
46+ longDescription = ''
47+ pkgconf is a program which helps to configure compiler and linker flags
48+ for development libraries. It is similar to pkg-config from
49+ freedesktop.org.
50+51+ libpkgconf is a library which provides access to most of pkgconf's
52+ functionality, to allow other tooling such as compilers and IDEs to
53+ discover and use libraries configured by pkgconf.
54+ '';
55 license = licenses.isc;
56+ maintainers = with maintainers; [ zaninime AndersonTorres ];
57+ platforms = platforms.all;
58 };
59}
···23let
4 # having the full version string here makes it easier to update
5- modDirVersion = "5.17.0-zen1";
6 parts = lib.splitString "-" modDirVersion;
7 version = lib.elemAt parts 0;
8 suffix = lib.elemAt parts 1;
···20 owner = "zen-kernel";
21 repo = "zen-kernel";
22 inherit rev;
23- sha256 = "sha256-8DCcO2oPnwXjjm3PW7vNZKbB3S7XsEB/svAMhbPRJIo=";
24 };
2526 structuredExtraConfig = with lib.kernel; {
···23let
4 # having the full version string here makes it easier to update
5+ modDirVersion = "5.17.2-zen3";
6 parts = lib.splitString "-" modDirVersion;
7 version = lib.elemAt parts 0;
8 suffix = lib.elemAt parts 1;
···20 owner = "zen-kernel";
21 repo = "zen-kernel";
22 inherit rev;
23+ sha256 = "sha256-q6Cc3wQHDXzyt2hx3+CS8N74myC6ra/Y+8IHQxTkoLo=";
24 };
2526 structuredExtraConfig = with lib.kernel; {
···23 # NB: This is needed for the postBuild step
24 nativeBuildInputs = [ (python2.withPackages ( p: with p; [ cffi ] )) ];
2526- buildInputs = [ (python2.withPackages (p: with p; [ cffi pyserial greenlet jinja2 ])) ];
2728 # we need to run this to prebuild the chelper.
29 postBuild = "python2 ./chelper/__init__.py";
···23 # NB: This is needed for the postBuild step
24 nativeBuildInputs = [ (python2.withPackages ( p: with p; [ cffi ] )) ];
2526+ buildInputs = [ (python2.withPackages (p: with p; [ cffi pyserial greenlet jinja2 numpy ])) ];
2728 # we need to run this to prebuild the chelper.
29 postBuild = "python2 ./chelper/__init__.py";
···18 # this allows us to include the bits of rails we use without pieces we do not.
19 #
20 # To issue a rails update bump the version number here
21- rails_version = '6.1.4.1'
22 gem 'actionmailer', rails_version
23 gem 'actionpack', rails_version
24 gem 'actionview', rails_version
···105106gem 'omniauth-google-oauth2'
107108-# Pinning oj until https://github.com/ohler55/oj/issues/699 is resolved.
109-# Segfaults and stuck processes after upgrading.
110-gem 'oj', '3.13.2'
111112gem 'pg'
113gem 'mini_sql'
···135gem 'addressable'
136gem 'json_schemer'
13700000000138# Gems used only for assets and not required in production environments by default.
139# Allow everywhere for now cause we are allowing asset debugging in production
140group :assets do
···152153group :test, :development do
154 gem 'rspec'
155- gem 'mock_redis'
156 gem 'listen', require: false
157 gem 'certified', require: false
158 gem 'fabrication', require: false
···18 # this allows us to include the bits of rails we use without pieces we do not.
19 #
20 # To issue a rails update bump the version number here
21+ rails_version = '6.1.4.7'
22 gem 'actionmailer', rails_version
23 gem 'actionpack', rails_version
24 gem 'actionview', rails_version
···105106gem 'omniauth-google-oauth2'
107108+gem 'oj'
00109110gem 'pg'
111gem 'mini_sql'
···133gem 'addressable'
134gem 'json_schemer'
135136+if Gem::Version.new(RUBY_VERSION) >= Gem::Version.new("3.1")
137+ # net-smtp, net-imap and net-pop were removed from default gems in Ruby 3.1
138+ gem "net-smtp", "~> 0.2.1", require: false
139+ gem "net-imap", "~> 0.2.1", require: false
140+ gem "net-pop", "~> 0.1.1", require: false
141+ gem "digest", "3.0.0", require: false
142+end
143+144# Gems used only for assets and not required in production environments by default.
145# Allow everywhere for now cause we are allowing asset debugging in production
146group :assets do
···158159group :test, :development do
160 gem 'rspec'
0161 gem 'listen', require: false
162 gem 'certified', require: false
163 gem 'fabrication', require: false
···23buildGoModule rec {
4 pname = "syft";
5- version = "0.43.2";
67 src = fetchFromGitHub {
8 owner = "anchore";
9 repo = pname;
10 rev = "v${version}";
11- sha256 = "sha256-vGzS5Tpg+3f+ydsNbYza4FnCLBv6hMT3RGdlHrKjtfE=";
12 # populate values that require us to use git. By doing this in postFetch we
13 # can delete .git afterwards and maintain better reproducibility of the src.
14 leaveDotGit = true;
···23buildGoModule rec {
4 pname = "syft";
5+ version = "0.44.0";
67 src = fetchFromGitHub {
8 owner = "anchore";
9 repo = pname;
10 rev = "v${version}";
11+ sha256 = "sha256-w5/lTGkwH6cLzbj6/ZUJyFtwx9EyA5Q7hs/CwtsdsJA=";
12 # populate values that require us to use git. By doing this in postFetch we
13 # can delete .git afterwards and maintain better reproducibility of the src.
14 leaveDotGit = true;
···52 xinput
53 ];
5455- autoPatchelfIgnoreMissingDeps = true; # Attempts to patchelf unneeded SOs
5657 meta = with lib; {
58 description = "A tracking application for A Link to the Past Randomizer";
···52 xinput
53 ];
5455+ autoPatchelfIgnoreMissingDeps = [ "libc.musl-x86_64.so.1" ]; # Attempts to patchelf unneeded SOs
5657 meta = with lib; {
58 description = "A tracking application for A Link to the Past Randomizer";
···7}:
8stdenv.mkDerivation rec {
9 pname = "nix-direnv";
10- version = "1.6.1";
1112 src = fetchFromGitHub {
13 owner = "nix-community";
14 repo = "nix-direnv";
15 rev = version;
16- sha256 = "sha256-WgNfo9GRqIrXsIgNRhoNPU2/uwyPd8xG8xEEImEy4KY=";
17 };
1819 # Substitute instead of wrapping because the resulting file is
···7}:
8stdenv.mkDerivation rec {
9 pname = "nix-direnv";
10+ version = "2.0.0";
1112 src = fetchFromGitHub {
13 owner = "nix-community";
14 repo = "nix-direnv";
15 rev = version;
16+ sha256 = "sha256-0gBb/U7tNNSjazJE/Z2qAxHPX53wRSPMJ8rHc7HtCNg=";
17 };
1819 # Substitute instead of wrapping because the resulting file is
-2
pkgs/tools/misc/powerline-go/default.nix
···1617 vendorSha256 = "sha256-HYF6aKz+P241EKmupEoretadlrh9FBRx6nIER66jofg=";
1819- doCheck = false;
20-21 meta = with lib; {
22 description = "A Powerline like prompt for Bash, ZSH and Fish";
23 homepage = "https://github.com/justjanne/powerline-go";
···1617 vendorSha256 = "sha256-HYF6aKz+P241EKmupEoretadlrh9FBRx6nIER66jofg=";
180019 meta = with lib; {
20 description = "A Powerline like prompt for Bash, ZSH and Fish";
21 homepage = "https://github.com/justjanne/powerline-go";
···67buildGoModule rec {
8 pname = "kubescape";
9+ version = "2.0.152";
1011 src = fetchFromGitHub {
12 owner = "armosec";
13 repo = pname;
14 rev = "v${version}";
15+ hash = "sha256-hibXmA2JerfnkGiSnBUCMHGPm4Tefnsl/x2VAS5z0Fo=";
16 };
17+ vendorSha256 = "sha256-HfsQfoz1n3FEd2eVBBz3Za2jYCSrozXpL34Z8CgQsTA=";
1819 nativeBuildInputs = [
20 installShellFiles
21 ];
2200023 ldflags = [
24 "-s"
25 "-w"
26+ "-X github.com/armosec/kubescape/v2/core/cautils.BuildNumber=v${version}"
27 ];
2829+ subPackages = [ "." ];
30+31+ preCheck = ''
32+ # Feed in all but the integration tests for testing
33+ # This is because subPackages above limits what is built to just what we
34+ # want but also limits the tests
35+ # Skip httphandler tests - the checkPhase doesn't care about excludedPackages
36+ getGoDirs() {
37+ go list ./... | grep -v httphandler
38+ }
39+40+ rm core/pkg/resourcehandler/{repositoryscanner,urlloader}_test.go
41 '';
4243 postInstall = ''
···51 installCheckPhase = ''
52 runHook preInstallCheck
53 $out/bin/kubescape --help
54+ # `--version` vs `version` shows the version without checking for latest
55+ # if the flag is missing the BuildNumber may have moved
56 $out/bin/kubescape --version | grep "v${version}"
57 runHook postInstallCheck
58 '';
···1-{ buildGoModule, fetchFromGitHub, lib }:
02buildGoModule rec {
3 pname = "goawk";
4 version = "1.16.0";
···1213 vendorSha256 = "sha256-pQpattmS9VmO3ZIQUFn66az8GSmB4IvYhTTCFn6SUmo=";
1415- # checks do not pass at the moment
16- doCheck = false;
00000000001718 meta = with lib; {
19 description = "A POSIX-compliant AWK interpreter written in Go";