···2020 ips = [ "9.9.9.9" "149.112.112.112" ];
2121 url = "https://dns.quad9.net/dns-query";
2222 };
2323+ opendns = {
2424+ ips = [ "208.67.222.222" "208.67.220.220" ];
2525+ url = "https://doh.opendns.com/dns-query";
2626+ };
2727+ custom = {
2828+ inherit (cfg.provider) ips url;
2929+ };
2330 };
24312532 defaultProvider = "quad9";
26332734 providerCfg =
2828- let
2929- isCustom = cfg.provider.kind == "custom";
3030- in
3131- lib.concatStringsSep " " [
3535+ concatStringsSep " " [
3236 "-b"
3333- (concatStringsSep "," (if isCustom then cfg.provider.ips else providers."${cfg.provider.kind}".ips))
3737+ (concatStringsSep "," providers."${cfg.provider.kind}".ips)
3438 "-r"
3535- (if isCustom then cfg.provider.url else providers."${cfg.provider.kind}".url)
3939+ providers."${cfg.provider.kind}".url
3640 ];
37413842in
···6266 The upstream provider to use or custom in case you do not trust any of
6367 the predefined providers or just want to use your own.
64686565- The default is ${defaultProvider} and there are privacy and security trade-offs
6666- when using any upstream provider. Please consider that before using any
6767- of them.
6969+ The default is ${defaultProvider} and there are privacy and security
7070+ trade-offs when using any upstream provider. Please consider that
7171+ before using any of them.
68726969- If you pick a custom provider, you will need to provide the bootstrap
7070- IP addresses as well as the resolver https URL.
7373+ Supported providers: ${concatStringsSep ", " (builtins.attrNames providers)}
7474+7575+ If you pick the custom provider, you will need to provide the
7676+ bootstrap IP addresses as well as the resolver https URL.
7177 '';
7272- type = types.enum ((builtins.attrNames providers) ++ [ "custom" ]);
7878+ type = types.enum (builtins.attrNames providers);
7379 default = defaultProvider;
7480 };
7581···105111 config = lib.mkIf cfg.enable {
106112 systemd.services.https-dns-proxy = {
107113 description = "DNS to DNS over HTTPS (DoH) proxy";
114114+ requires = [ "network.target" ];
108115 after = [ "network.target" ];
116116+ wants = [ "nss-lookup.target" ];
117117+ before = [ "nss-lookup.target" ];
109118 wantedBy = [ "multi-user.target" ];
110119 serviceConfig = rec {
111120 Type = "exec";
112121 DynamicUser = true;
122122+ ProtectHome = "tmpfs";
113123 ExecStart = lib.concatStringsSep " " (
114124 [
115115- "${pkgs.https-dns-proxy}/bin/https_dns_proxy"
125125+ (lib.getExe pkgs.https-dns-proxy)
116126 "-a ${toString cfg.address}"
117127 "-p ${toString cfg.port}"
118128 "-l -"
···11+## How to upgrade llvm_git
22+33+- Run `update-git.py`.
44+ This will set the github revision and sha256 for `llvmPackages_git.llvm` to whatever the latest chromium build is using.
55+ For a more recent, commit run `nix-prefetch-github` and change the rev and sha256 accordingly.
66+77+- That was the easy part.
88+ The hard part is updating the patch files.
99+1010+ The general process is:
1111+1212+ 1. Try to build `llvmPackages_git.llvm` and associated packages such as
1313+ `clang` and `compiler-rt`. You can use the `-L` and `--keep-failed` flags to make
1414+ debugging patch errors easy, e.g., `nix build .#llvmPackages_git.clang -L --keep-failed`
1515+1616+ 2. The build will error out with something similar to this:
1717+ ```sh
1818+ ...
1919+ clang-unstable> patching sources
2020+ clang-unstable> applying patch /nix/store/nndv6gq6w608n197fndvv5my4a5zg2qi-purity.patch
2121+ clang-unstable> patching file lib/Driver/ToolChains/Gnu.cpp
2222+ clang-unstable> Hunk #1 FAILED at 487.
2323+ clang-unstable> 1 out of 1 hunk FAILED -- saving rejects to file lib/Driver/ToolChains/Gnu.cpp.rej
2424+ note: keeping build directory '/tmp/nix-build-clang-unstable-2022-25-07.drv-17'
2525+ error: builder for '/nix/store/zwi123kpkyz52fy7p6v23azixd807r8c-clang-unstable-2022-25-07.drv' failed with exit code 1;
2626+ last 8 log lines:
2727+ > unpacking sources
2828+ > unpacking source archive /nix/store/mrxadx11wv1ckjr2208qgxp472pmmg6g-clang-src-unstable-2022-25-07
2929+ > source root is clang-src-unstable-2022-25-07/clang
3030+ > patching sources
3131+ > applying patch /nix/store/nndv6gq6w608n197fndvv5my4a5zg2qi-purity.patch
3232+ > patching file lib/Driver/ToolChains/Gnu.cpp
3333+ > Hunk #1 FAILED at 487.
3434+ > 1 out of 1 hunk FAILED -- saving rejects to file lib/Driver/ToolChains/Gnu.cpp.rej
3535+ For full logs, run 'nix log /nix/store/zwi123kpkyz52fy7p6v23azixd807r8c-clang-unstable-2022-25-07.drv'.
3636+ note: keeping build directory '/tmp/nix-build-compiler-rt-libc-unstable-2022-25-07.drv-20'
3737+ error: 1 dependencies of derivation '/nix/store/ndbbh3wrl0l39b22azf46f1n7zlqwmag-clang-wrapper-unstable-2022-25-07.drv' failed to build
3838+ ```
3939+4040+ Notice the `Hunk #1 Failed at 487` line.
4141+ The lines above show us that the `purity.patch` failed on `lib/Driver/ToolChains/Gnu.cpp` when compiling `clang`.
4242+4343+ 3. The task now is to cross reference the hunks in the purity patch with
4444+ `lib/Driver/ToolCahins/Gnu.cpp.orig` to see why the patch failed.
4545+ The `.orig` file will be in the build directory referenced in the line `note: keeping build directory ...`;
4646+ this message results from the `--keep-failed` flag.
4747+4848+ 4. Now you should be able to open whichever patch failed, and the `foo.orig` file that it failed on.
4949+ Correct the patch by adapting it to the new code and be mindful of whitespace;
5050+ which can be an easily missed reason for failures.
5151+ For cases where the hunk is no longer needed you can simply remove it from the patch.
5252+5353+ This is fine for small corrections, but when more serious changes are needed its better to use git.
5454+5555+ 1. Clone the LLVM monorepo at https://github.com/llvm/llvm-project/
5656+5757+ 2. Check out the revision we were using before.
5858+5959+ 3. Use `patch -p1 < path/to-path` in the project subdirectories to apply the patches and commit.
6060+6161+ 4. Use `git rebase HEAD^ --onto <dest>` to rebase the patches onto the new revision we are trying to build, and fix all conflicts.
6262+6363+ 5. Use `git diff HEAD^:<project> HEAD:<project>` to get subdir diff to write back to Nixpkgs.
6464+6565+## Information on our current patch sets
6666+6767+### "GNU Install Dirs" patches
6868+6969+Use CMake's [`GNUInstallDirs`](https://cmake.org/cmake/help/latest/module/GNUInstallDirs.html) to support multiple outputs.
7070+7171+Previously, LLVM Just hard-coded `bin`, `include`, and `lib${LLVM_TARGET_PREFIX}`.
7272+We are making it use these variables.
7373+7474+For the older LLVM versions, these patches live in https://github.com/Ericson2314/llvm-project branches `split-prefix`.
7575+Instead of applying the patches to the worktree per the above instructions, one can checkout those directly and rebase those instead.
7676+7777+For newer LLVM versions, enough has has been upstreamed,
7878+(see https://reviews.llvm.org/differential/query/5UAfpj_9zHwY/ for my progress upstreaming),
7979+that I have just assembled new gnu-install-dirs patches from the remaining unmerged patches instead of rebasing from the prior LLVM's gnu install dirs patch.
···11-diff --git a/CMakeLists.txt b/CMakeLists.txt
22-index c5003b5efa1d..4fffb9721284 100644
33---- a/CMakeLists.txt
44-+++ b/CMakeLists.txt
55-@@ -5,6 +5,8 @@
66-77- cmake_minimum_required(VERSION 3.13.4)
88-99-+include(GNUInstallDirs)
1010-+
1111- # Check if compiler-rt is built as a standalone project.
1212- if (CMAKE_SOURCE_DIR STREQUAL CMAKE_CURRENT_SOURCE_DIR OR COMPILER_RT_STANDALONE_BUILD)
1313- project(CompilerRT C CXX ASM)
141diff --git a/cmake/base-config-ix.cmake b/cmake/base-config-ix.cmake
1515-index 1ada0ab30ba0..b4be6c4a3c73 100644
22+index 8a6219568b3f..30ee68a47ccf 100644
163--- a/cmake/base-config-ix.cmake
174+++ b/cmake/base-config-ix.cmake
1818-@@ -66,7 +66,7 @@ if (LLVM_TREE_AVAILABLE)
1919- else()
2020- # Take output dir and install path from the user.
2121- set(COMPILER_RT_OUTPUT_DIR ${CMAKE_CURRENT_BINARY_DIR} CACHE PATH
2222-- "Path where built compiler-rt libraries should be stored.")
2323-+ "Path where built compiler-rt build artifacts should be stored.")
2424- set(COMPILER_RT_EXEC_OUTPUT_DIR ${CMAKE_CURRENT_BINARY_DIR}/bin CACHE PATH
2525- "Path where built compiler-rt executables should be stored.")
2626- set(COMPILER_RT_INSTALL_PATH "" CACHE PATH
2727-@@ -98,23 +98,23 @@ endif()
55+@@ -100,13 +100,13 @@ endif()
286 if(LLVM_ENABLE_PER_TARGET_RUNTIME_DIR AND NOT APPLE)
297 set(COMPILER_RT_OUTPUT_LIBRARY_DIR
308 ${COMPILER_RT_OUTPUT_DIR}/lib)
···4018 set(COMPILER_RT_INSTALL_LIBRARY_DIR "${default_install_path}" CACHE PATH
4119 "Path where built compiler-rt libraries should be installed.")
4220 endif()
4343--extend_path(default_install_path "${COMPILER_RT_INSTALL_PATH}" bin)
4444-+extend_path(default_install_path "${COMPILER_RT_INSTALL_PATH}" "${CMAKE_INSTALL_BINDIR}")
4545- set(COMPILER_RT_INSTALL_BINARY_DIR "${default_install_path}" CACHE PATH
4646- "Path where built compiler-rt executables should be installed.")
4747--extend_path(default_install_path "${COMPILER_RT_INSTALL_PATH}" include)
4848-+extend_path(default_install_path "${COMPILER_RT_INSTALL_PATH}" "${CMAKE_INSTALL_INCLUDEDIR}")
4949- set(COMPILER_RT_INSTALL_INCLUDE_DIR "${default_install_path}" CACHE PATH
5050- "Path where compiler-rt headers should be installed.")
5151--extend_path(default_install_path "${COMPILER_RT_INSTALL_PATH}" share)
5252-+extend_path(default_install_path "${COMPILER_RT_INSTALL_PATH}" "${CMAKE_INSTALL_DATADIR}")
5353- set(COMPILER_RT_INSTALL_DATA_DIR "${default_install_path}" CACHE PATH
5454- "Path where compiler-rt data files should be installed.")
5555-
···11+--- a/CMakeLists.txt
22++++ b/CMakeLists.txt
33+@@ -131,10 +131,21 @@ if (NOT LIBCXXABI_ENABLE_SHARED AND NOT LIBCXXABI_ENABLE_STATIC)
44+ message(FATAL_ERROR "libc++abi must be built as either a shared or static library.")
55+ endif()
66+77+-# TODO: Remove this, which shouldn't be necessary since we know we're being built
88+-# side-by-side with libc++.
99+ set(LIBCXXABI_LIBCXX_INCLUDES "" CACHE PATH
1010+ "Specify path to libc++ includes.")
1111++if (NOT libcxx IN_LIST LLVM_ENABLE_RUNTIMES)
1212++ if (NOT IS_DIRECTORY ${LIBCXXABI_LIBCXX_INCLUDES})
1313++ message(FATAL_ERROR
1414++ "LIBCXXABI_LIBCXX_INCLUDES=${LIBCXXABI_LIBCXX_INCLUDES} is not a valid directory. "
1515++ "Please provide the path to where the libc++ headers have been installed.")
1616++ endif()
1717++ add_library(cxx-headers INTERFACE)
1818++ if("${CMAKE_CXX_COMPILER_ID}" STREQUAL "MSVC" OR "${CMAKE_CXX_SIMULATE_ID}" STREQUAL "MSVC")
1919++ target_compile_options(cxx-headers INTERFACE /I "${LIBCXXABI_LIBCXX_INCLUDES}")
2020++ else()
2121++ target_compile_options(cxx-headers INTERFACE -I "${LIBCXXABI_LIBCXX_INCLUDES}")
2222++ endif()
2323++endif()
2424+2525+ set(LIBCXXABI_HERMETIC_STATIC_LIBRARY_DEFAULT OFF)
2626+ if (WIN32)
2727+--- a/test/CMakeLists.txt
2828++++ b/test/CMakeLists.txt
2929+@@ -61,9 +61,13 @@ if (LIBCXXABI_BUILD_EXTERNAL_THREAD_LIBRARY)
3030+ list(APPEND LIBCXXABI_TEST_DEPS cxx_external_threads)
3131+ endif()
3232+3333+-list(APPEND LIBCXXABI_TEST_DEPS cxx)
3434+-if (LIBCXXABI_USE_LLVM_UNWINDER AND TARGET unwind)
3535+- list(APPEND LIBCXXABI_TEST_DEPS unwind)
3636++if(libcxx IN_LIST LLVM_ENABLE_RUNTIMES)
3737++ list(APPEND LIBCXXABI_TEST_DEPS cxx)
3838++endif()
3939++if(libunwind IN_LIST LLVM_ENABLE_RUNTIMES)
4040++ if (LIBCXXABI_USE_LLVM_UNWINDER AND TARGET unwind)
4141++ list(APPEND LIBCXXABI_TEST_DEPS unwind)
4242++ endif()
4343+ endif()
4444+4545+ set(AUTO_GEN_COMMENT "## Autogenerated by libcxxabi configuration.\n# Do not edit!")
···25252626 patches = [
2727 ./gnu-install-dirs.patch
2828- # On Darwin the llvm-config is perhaps not working fine as the
2929- # LLVM_MAIN_SRC_DIR is not getting set correctly, and the build fails as
3030- # the include path is not correct.
3131- ./fix-root-src-dir.patch
3228 ];
33293430 nativeBuildInputs = [ cmake ];
3531 buildInputs = [ libllvm libxml2 ];
36323737- cmakeFlags = lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
3333+ cmakeFlags = [
3434+ "-DLLD_INSTALL_PACKAGE_DIR=${placeholder "dev"}/lib/cmake/lld"
3535+ ] ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
3836 "-DLLVM_TABLEGEN_EXE=${buildLlvmTools.llvm}/bin/llvm-tblgen"
3937 ];
4038
···11-diff --git a/CMakeLists.txt b/CMakeLists.txt
22-index 79d451965ed4..78188978d6de 100644
33---- a/CMakeLists.txt
44-+++ b/CMakeLists.txt
55-@@ -12,6 +12,8 @@ set(CMAKE_MODULE_PATH
66- # If we are not building as part of LLVM, build LLDB as a standalone project,
77- # using LLVM as an external library.
88- if (CMAKE_SOURCE_DIR STREQUAL CMAKE_CURRENT_SOURCE_DIR)
99-+ include(GNUInstallDirs)
1010-+
1111- project(lldb)
1212- include(LLDBStandalone)
1313-141diff --git a/cmake/modules/AddLLDB.cmake b/cmake/modules/AddLLDB.cmake
152index 3291a7c808e1..b27d27ce6a87 100644
163--- a/cmake/modules/AddLLDB.cmake
···5959 ++ optional (lib.versionAtLeast version "4.14") libelf
6060 ++ optional (lib.versionAtLeast version "5.13") zstd;
61616262-6363- installkernel = buildPackages.writeShellScript "installkernel" ''
6464- set -e
6565- mkdir -p $4
6666- cp -av $2 $4
6767- cp -av $3 $4
6868- '';
6969-7062 drvAttrs = config_: kernelConf: kernelPatches: configfile:
7163 let
7264 config = let attrName = attr: "CONFIG_" + attr; in {
···114106 ++ optional (lib.versionAtLeast version "5.2" && lib.versionOlder version "5.4") ./gen-kheaders-metadata.patch;
115107116108 prePatch = ''
117117- for mf in $(find -name Makefile -o -name Makefile.include -o -name install.sh); do
118118- echo "stripping FHS paths in \`$mf'..."
119119- sed -i "$mf" -e 's|/usr/bin/||g ; s|/bin/||g ; s|/sbin/||g'
120120- done
121109 sed -i Makefile -e 's|= depmod|= ${buildPackages.kmod}/bin/depmod|'
122110123111 # Don't include a (random) NT_GNU_BUILD_ID, to make the build more deterministic.
···146134 fi
147135148136 patchShebangs scripts
137137+138138+ # also patch arch-specific install scripts
139139+ for i in $(find arch -name install.sh); do
140140+ patchShebangs "$i"
141141+ done
149142 '';
150143151144 configurePhase = ''
···185178 kernelConf.target
186179 "vmlinux" # for "perf" and things like that
187180 ] ++ optional isModular "modules"
188188- ++ optional buildDTBs "dtbs"
181181+ ++ optionals buildDTBs ["dtbs" "DTC_FLAGS=-@"]
189182 ++ extraMakeFlags;
190183191184 installFlags = [
192192- "INSTALLKERNEL=${installkernel}"
193185 "INSTALL_PATH=$(out)"
194186 ] ++ (optional isModular "INSTALL_MOD_PATH=$(out)")
195187 ++ optional installsFirmware "INSTALL_FW_PATH=$(out)/lib/firmware"
196188 ++ optionals buildDTBs ["dtbs_install" "INSTALL_DTBS_PATH=$(out)/dtbs"];
197189198198- preInstall = ''
190190+ preInstall = let
191191+ # All we really need to do here is copy the final image and System.map to $out,
192192+ # and use the kernel's modules_install, firmware_install, dtbs_install, etc. targets
193193+ # for the rest. Easy, right?
194194+ #
195195+ # Unfortunately for us, the obvious way of getting the built image path,
196196+ # make -s image_name, does not work correctly, because some architectures
197197+ # (*cough* aarch64 *cough*) change KBUILD_IMAGE on the fly in their install targets,
198198+ # so we end up attempting to install the thing we didn't actually build.
199199+ #
200200+ # Thankfully, there's a way out that doesn't involve just hardcoding everything.
201201+ #
202202+ # The kernel has an install target, which runs a pretty simple shell script
203203+ # (located at scripts/install.sh or arch/$arch/boot/install.sh, depending on
204204+ # which kernel version you're looking at) that tries to do something sensible.
205205+ #
206206+ # (it would be great to hijack this script immediately, as it has all the
207207+ # information we need passed to it and we don't need it to try and be smart,
208208+ # but unfortunately, the exact location of the scripts differs between kernel
209209+ # versions, and they're seemingly not considered to be public API at all)
210210+ #
211211+ # One of the ways it tries to discover what "something sensible" actually is
212212+ # is by delegating to what's supposed to be a user-provided install script
213213+ # located at ~/bin/installkernel.
214214+ #
215215+ # (the other options are:
216216+ # - a distribution-specific script at /sbin/installkernel,
217217+ # which we can't really create in the sandbox easily
218218+ # - an architecture-specific script at arch/$arch/boot/install.sh,
219219+ # which attempts to guess _something_ and usually guesses very wrong)
220220+ #
221221+ # More specifically, the install script exec's into ~/bin/installkernel, if one
222222+ # exists, with the following arguments:
223223+ #
224224+ # $1: $KERNELRELEASE - full kernel version string
225225+ # $2: $KBUILD_IMAGE - the final image path
226226+ # $3: System.map - path to System.map file, seemingly hardcoded everywhere
227227+ # $4: $INSTALL_PATH - path to the destination directory as specified in installFlags
228228+ #
229229+ # $2 is exactly what we want, so hijack the script and use the knowledge given to it
230230+ # by the makefile overlords for our own nefarious ends.
231231+ #
232232+ # Note that the makefiles specifically look in ~/bin/installkernel, and
233233+ # writeShellScriptBin writes the script to <store path>/bin/installkernel,
234234+ # so HOME needs to be set to just the store path.
235235+ #
236236+ # FIXME: figure out a less roundabout way of doing this.
237237+ installkernel = buildPackages.writeShellScriptBin "installkernel" ''
238238+ cp -av $2 $4
239239+ cp -av $3 $4
240240+ '';
241241+ in ''
199242 installFlagsArray+=("-j$NIX_BUILD_CORES")
243243+ export HOME=${installkernel}
200244 '';
201245202246 # Some image types need special install targets (e.g. uImage is installed with make uinstall)
+24-7
pkgs/servers/dns/https-dns-proxy/default.nix
···11{ lib, stdenv, fetchFromGitHub, cmake, gtest, c-ares, curl, libev }:
2233+let
44+ # https-dns-proxy supports HTTP3 if curl has support, but as of 2022-08 curl doesn't work with that enabled
55+ # curl' = (curl.override { http3Support = true; });
66+ curl' = curl;
77+88+in
39stdenv.mkDerivation rec {
410 pname = "https-dns-proxy";
511 # there are no stable releases (yet?)
66- version = "unstable-2021-03-29";
1212+ version = "unstable-2022-05-05";
713814 src = fetchFromGitHub {
915 owner = "aarond10";
1016 repo = "https_dns_proxy";
1111- rev = "bbd9ef272dcda3ead515871f594768af13192af7";
1212- sha256 = "sha256-r+IpDklI3vITK8ZlZvIFm3JdDe2r8DK2ND3n1a/ThrM=";
1717+ rev = "d310a378795790350703673388821558163944de";
1818+ hash = "sha256-On4SKUeltPhzM/x+K9aKciKBw5lmVySxnmLi2tnKr3Y=";
1319 };
14202121+ postPatch = ''
2222+ substituteInPlace https_dns_proxy.service.in \
2323+ --replace "\''${CMAKE_INSTALL_PREFIX}/" ""
2424+ substituteInPlace munin/https_dns_proxy.plugin \
2525+ --replace '--unit https_dns_proxy.service' '--unit https-dns-proxy.service'
2626+ '';
2727+1528 nativeBuildInputs = [ cmake gtest ];
16291717- buildInputs = [ c-ares curl libev ];
3030+ buildInputs = [ c-ares curl' libev ];
18311919- installPhase = ''
2020- install -Dm555 -t $out/bin https_dns_proxy
2121- install -Dm444 -t $out/share/doc/${pname} ../{LICENSE,README}.*
3232+ postInstall = ''
3333+ install -Dm444 -t $out/share/doc/${pname} ../{LICENSE,*.md}
3434+ install -Dm444 -t $out/share/${pname}/munin ../munin/*
3535+ # the systemd service definition is garbage, and we use our own with NixOS
3636+ mv $out/lib/systemd $out/share/${pname}
3737+ rmdir $out/lib
2238 '';
23392440 # upstream wants to add tests and the gtest framework is in place, so be ready
···3046 license = licenses.mit;
3147 maintainers = with maintainers; [ peterhoeg ];
3248 platforms = platforms.linux;
4949+ mainProgram = "https_dns_proxy";
3350 };
3451}
+2-2
pkgs/servers/jellyfin/default.nix
···2929in
3030buildDotnetModule rec {
3131 pname = "jellyfin";
3232- version = "10.8.3"; # ensure that jellyfin-web has matching version
3232+ version = "10.8.4"; # ensure that jellyfin-web has matching version
33333434 src = fetchFromGitHub {
3535 owner = "jellyfin";
3636 repo = "jellyfin";
3737 rev = "v${version}";
3838- sha256 = "QVpmHhVR4+UbVz5m92g5VcpcxVz1/9MNll2YN7ZnNHw=";
3838+ sha256 = "dzaySywQ43Vdj0GUGjpKaSgsu5Zu0SKyoOCYHAfp/v8=";
3939 };
40404141 patches = [