···358358<para>
359359 <varname>pkgs.dockerTools</varname> is a set of functions for creating and
360360 manipulating Docker images according to the
361361- <link xlink:href="https://github.com/docker/docker/blob/master/image/spec/v1.md#docker-image-specification-v100">
362362- Docker Image Specification v1.0.0
361361+ <link xlink:href="https://github.com/moby/moby/blob/master/image/spec/v1.2.md#docker-image-specification-v120">
362362+ Docker Image Specification v1.2.0
363363 </link>. Docker itself is not used to perform any of the operations done by these
364364 functions.
365365</para>
···493493 <varname>config</varname> is used to specify the configuration of the
494494 containers that will be started off the built image in Docker.
495495 The available options are listed in the
496496- <link xlink:href="https://github.com/docker/docker/blob/master/image/spec/v1.md#container-runconfig-field-descriptions">
497497- Docker Image Specification v1.0.0
496496+ <link xlink:href="https://github.com/moby/moby/blob/master/image/spec/v1.2.md#image-json-field-descriptions">
497497+ Docker Image Specification v1.2.0
498498 </link>.
499499 </para>
500500 </callout>
···1717<refsynopsisdiv>
1818 <cmdsynopsis>
1919 <command>nixos-option</command>
2020- <arg choice='plain'><replaceable>option.name</replaceable></arg>
2020+ <arg>
2121+ <option>-I</option>
2222+ <replaceable>path</replaceable>
2323+ </arg>
2424+ <arg><option>--verbose</option></arg>
2525+ <arg><option>--xml</option></arg>
2626+ <arg choice="plain"><replaceable>option.name</replaceable></arg>
2127 </cmdsynopsis>
2228</refsynopsisdiv>
2323-24292530<refsection><title>Description</title>
2631···30353136<para>When the option name is not an option, the command prints the list of
3237attributes contained in the attribute set.</para>
3838+3939+</refsection>
4040+4141+<refsection><title>Options</title>
4242+4343+<para>This command accepts the following options:</para>
4444+4545+<variablelist>
4646+4747+ <varlistentry>
4848+ <term><option>-I</option> <replaceable>path</replaceable></term>
4949+ <listitem>
5050+ <para>
5151+ This option is passed to the underlying
5252+ <command>nix-instantiate</command> invocation.
5353+ </para>
5454+ </listitem>
5555+ </varlistentry>
5656+5757+ <varlistentry>
5858+ <term><option>--verbose</option></term>
5959+ <listitem>
6060+ <para>
6161+ This option enables verbose mode, which currently is just
6262+ the Bash <command>set</command> <option>-x</option> debug mode.
6363+ </para>
6464+ </listitem>
6565+ </varlistentry>
6666+6767+ <varlistentry>
6868+ <term><option>--xml</option></term>
6969+ <listitem>
7070+ <para>
7171+ This option causes the output to be rendered as XML.
7272+ </para>
7373+ </listitem>
7474+ </varlistentry>
7575+7676+</variablelist>
33773478</refsection>
3579
+24
nixos/doc/manual/release-notes/rl-1709.xml
···130130 instead. Refer to the description of the options for more details.
131131 </para>
132132 </listitem>
133133+ <listitem>
134134+ <para>
135135+ <literal>tlsdate</literal> package and module were removed. This is due to the project
136136+ being dead and not building with openssl 1.1.
137137+ </para>
138138+ </listitem>
139139+ <listitem>
140140+ <para>
141141+ <literal>wvdial</literal> package and module were removed. This is due to the project
142142+ being dead and not building with openssl 1.1.
143143+ </para>
144144+ </listitem>
145145+ <listitem>
146146+ <para>
147147+ <literal>cc-wrapper</literal>'s setup-hook now exports a number of
148148+ environment variables corresponding to binutils binaries,
149149+ (e.g. <envar>LD</envar>, <envar>STRIP</envar>, <envar>RANLIB</envar>,
150150+ etc). This is done to prevent packages' build systems guessing, which is
151151+ harder to predict, especially when cross-compiling. However, some packages
152152+ have broken due to this—their build systems either not supporting, or
153153+ claiming to support without adequate testing, taking such environment
154154+ variables as parameters.
155155+ </para>
156156+ </listitem>
133157</itemizedlist>
134158135159<para>Other notable improvements:</para>
···2222 ${optionalString (interfaces!=null) "allow-interfaces=${concatStringsSep "," interfaces}"}
2323 ${optionalString (domainName!=null) "domain-name=${domainName}"}
2424 allow-point-to-point=${yesNo allowPointToPoint}
2525+ ${optionalString (cacheEntriesMax!=null) "cache-entries-max=${toString cacheEntriesMax}"}
25262627 [wide-area]
2728 enable-wide-area=${yesNo wideArea}
···163164 Whether to enable the mDNS NSS (Name Service Switch) plug-in.
164165 Enabling it allows applications to resolve names in the `.local'
165166 domain by transparently querying the Avahi daemon.
167167+ '';
168168+ };
169169+170170+ cacheEntriesMax = mkOption {
171171+ default = null;
172172+ type = types.nullOr types.int;
173173+ description = ''
174174+ Number of resource records to be cached per interface. Use 0 to
175175+ disable caching. Avahi daemon defaults to 4096 if not set.
166176 '';
167177 };
168178
···6677 cfg = config.services.confluence;
8899- pkg = pkgs.atlassian-confluence;
99+ pkg = pkgs.atlassian-confluence.override (optionalAttrs cfg.sso.enable {
1010+ enableSSO = cfg.sso.enable;
1111+ crowdProperties = ''
1212+ application.name ${cfg.sso.applicationName}
1313+ application.password ${cfg.sso.applicationPassword}
1414+ application.login.url ${cfg.sso.crowd}/console/
1515+1616+ crowd.server.url ${cfg.sso.crowd}/services/
1717+ crowd.base.url ${cfg.sso.crowd}/
1818+1919+ session.isauthenticated session.isauthenticated
2020+ session.tokenkey session.tokenkey
2121+ session.validationinterval ${toString cfg.sso.validationInterval}
2222+ session.lastvalidation session.lastvalidation
2323+ '';
2424+ });
10251126in
1227···7590 description = "Protocol used at the proxy.";
7691 };
7792 };
9393+9494+ sso = {
9595+ enable = mkEnableOption "SSO with Atlassian Crowd";
9696+9797+ crowd = mkOption {
9898+ type = types.str;
9999+ example = "http://localhost:8095/crowd";
100100+ description = "Crowd Base URL without trailing slash";
101101+ };
102102+103103+ applicationName = mkOption {
104104+ type = types.str;
105105+ example = "jira";
106106+ description = "Exact name of this Confluence instance in Crowd";
107107+ };
108108+109109+ applicationPassword = mkOption {
110110+ type = types.str;
111111+ description = "Application password of this Confluence instance in Crowd";
112112+ };
113113+114114+ validationInterval = mkOption {
115115+ type = types.int;
116116+ default = 2;
117117+ example = 0;
118118+ description = ''
119119+ Set to 0, if you want authentication checks to occur on each
120120+ request. Otherwise set to the number of minutes between request
121121+ to validate if the user is logged in or out of the Crowd SSO
122122+ server. Setting this value to 1 or higher will increase the
123123+ performance of Crowd's integration.
124124+ '';
125125+ };
126126+ };
127127+128128+7812979130 jrePackage = let
80131 jreSwitch = unfree: free: if config.nixpkgs.config.allowUnfree or false then unfree else free;
···6677 cfg = config.services.jira;
8899- pkg = pkgs.atlassian-jira;
99+ pkg = pkgs.atlassian-jira.override {
1010+ enableSSO = cfg.sso.enable;
1111+ crowdProperties = ''
1212+ application.name ${cfg.sso.applicationName}
1313+ application.password ${cfg.sso.applicationPassword}
1414+ application.login.url ${cfg.sso.crowd}/console/
1515+1616+ crowd.server.url ${cfg.sso.crowd}/services/
1717+ crowd.base.url ${cfg.sso.crowd}/
1818+1919+ session.isauthenticated session.isauthenticated
2020+ session.tokenkey session.tokenkey
2121+ session.validationinterval ${toString cfg.sso.validationInterval}
2222+ session.lastvalidation session.lastvalidation
2323+ '';
2424+ };
10251126in
1227···7994 type = types.bool;
8095 default = true;
8196 description = "Whether the connections to the proxy should be considered secure.";
9797+ };
9898+ };
9999+100100+ sso = {
101101+ enable = mkEnableOption "SSO with Atlassian Crowd";
102102+103103+ crowd = mkOption {
104104+ type = types.str;
105105+ example = "http://localhost:8095/crowd";
106106+ description = "Crowd Base URL without trailing slash";
107107+ };
108108+109109+ applicationName = mkOption {
110110+ type = types.str;
111111+ example = "jira";
112112+ description = "Exact name of this JIRA instance in Crowd";
113113+ };
114114+115115+ applicationPassword = mkOption {
116116+ type = types.str;
117117+ description = "Application password of this JIRA instance in Crowd";
118118+ };
119119+120120+ validationInterval = mkOption {
121121+ type = types.int;
122122+ default = 2;
123123+ example = 0;
124124+ description = ''
125125+ Set to 0, if you want authentication checks to occur on each
126126+ request. Otherwise set to the number of minutes between request
127127+ to validate if the user is logged in or out of the Crowd SSO
128128+ server. Setting this value to 1 or higher will increase the
129129+ performance of Crowd's integration.
130130+ '';
82131 };
83132 };
84133
···141141 system.build = mkOption {
142142 internal = true;
143143 default = {};
144144+ type = types.attrs;
144145 description = ''
145146 Attribute set of derivations used to setup the system.
146147 '';
+1-1
nixos/modules/system/boot/systemd.nix
···593593 services.logind.extraConfig = mkOption {
594594 default = "";
595595 type = types.lines;
596596- example = "HandleLidSwitch=ignore";
596596+ example = "IdleAction=lock";
597597 description = ''
598598 Extra config options for systemd-logind. See man logind.conf for
599599 available options.
+1
nixos/modules/virtualisation/xen-dom0.nix
···1616 virtualisation.xen.enable =
1717 mkOption {
1818 default = false;
1919+ type = types.bool;
1920 description =
2021 ''
2122 Setting this option enables the Xen hypervisor, a
···69697070 meta = with stdenv.lib; {
7171 description = "3D Creation/Animation/Publishing System";
7272- homepage = http://www.blender.org;
7272+ homepage = https://www.blender.org;
7373 # They comment two licenses: GPLv2 and Blender License, but they
7474 # say: "We've decided to cancel the BL offering for an indefinite period."
7575 license = licenses.gpl2Plus;
···11-diff --git a/gale-install.in b/gale-install.in
22-index 50e8ad8..eec0ed2 100644
33---- a/gale-install.in
44-+++ b/gale-install.in
55-@@ -29,22 +29,78 @@ testkey_stdin() {
66- gkinfo -x 2>/dev/null | qgrep "^Public key: <$1>"
77- }
88-99--if [ -n "$GALE_SYS_DIR" ]; then
1010-- SYS_DIR="$GALE_SYS_DIR"
1111--elif [ -n "$sysconfdir" ]; then
1212-- SYS_DIR="$sysconfdir/gale"
1313-+INST_SYS_DIR="$sysconfdir/gale"
1414-+
1515-+if [ `id -u` -eq 0 ]; then
1616-+ is_root=yes
1717-+ SYS_DIR=/etc/gale
1818-+else
1919-+ is_root=no
2020-+ SYS_DIR="$HOME/.gale"
2121-+fi
2222-+
2323-+if [ -f /etc/NIXOS ]; then
2424-+ is_nixos=yes
2525-+else
2626-+ is_nixos=no
2727-+fi
2828-+
2929-+if [ -u /run/wrappers/bin/gksign ]; then
3030-+ cat <<EOM
3131-+
3232-+Gale appears to have already been set up via the NixOS module system (check
3333-+/etc/nixos/configuration.nix).
3434-+
3535-+EOM
3636-+
3737-+ exit 0
3838-+fi
3939-+
4040-+if [ $is_root = yes ]; then
4141-+ cat <<EOM
4242-+
4343-+You are running gale-install as root, so I'm going to assume you want to set up
4444-+Gale for system-wide use. Unfortunately, Gale expects to be able to run the
4545-+"gksign" program via setuid, and we can't change gksign's permissions once it's
4646-+already been installed because the Nix store is immutable by design.
4747-+
4848-+EOM
4949-+
5050-+ if [ $is_nixos = no ]; then
5151-+ cat <<EOM
5252-+
5353-+This isn't a NixOS system. Gale can only be installed for a single user on
5454-+non-NixOS systems. If you want a system-wide installation, you'll have to
5555-+install Gale the old-fashioned way. Sorry.
5656-+
5757-+EOM
5858-+
5959-+ exit 1
6060-+ fi
6161-+ cat <<EOM
6262-+
6363-+This script will generate a domain key for you, and after you get it signed, you
6464-+can finish the setup process by configuring Gale via the NixOS module system
6565-+(i.e. /etc/nixos/configuration.nix).
6666-+
6767-+EOM
6868-+
6969- else
7070-- echo "Error: cannot locate Gale system configuration directory."
7171-- exit 1
7272-+ cat <<EOM
7373-+
7474-+Hi. You are running gale-install as a normal user, so I'm going to assume you
7575-+want to set up Gale for your own (i.e. non-system-wide) use.
7676-+
7777-+EOM
7878-+
7979- fi
8080-8181--CONF="$SYS_DIR/conf"
8282- umask 022
8383--PATH="$bindir:$sbindir:$PATH:/usr/ucb"
8484-+PATH="$bindir:$sbindir:$PATH"
8585- export PATH
8686-8787--if [ -f "$CONF" ]; then
8888-- exec 3<"$CONF"
8989-+if [ -n "$SYS_DIR" ] && [ -f "$SYS_DIR/conf" ]; then
9090-+ exec 3<"$SYS_DIR/conf"
9191-9292- while read var value <&3 ; do
9393- case "$var" in
9494-@@ -58,52 +114,14 @@ if [ -f "$CONF" ]; then
9595- exec 3<&-
9696- fi
9797-9898--USER="`whoami`"
9999--if [ -z "$USER" ]; then
100100-- echo "Error: cannot determine your username."
101101-- exit 1
102102--fi
103103--
104104--# -----------------------------------------------------------------------------
105105--# check directory structure
106106--
107107--if [ ! -d "$SYS_DIR" ]; then
108108-- echo "Error: Invalid SYS_DIR: \"$SYS_DIR\"."
109109-- exit 1
110110--fi
111111--
112112- # -----------------------------------------------------------------------------
113113--# get settings for important variables: user, domain, server
114114-+# get settings for important variables: domain, server
115115-116116--[ -n "$CONF_GALE_USER" ] && GALE_USER="$CONF_GALE_USER"
117117- [ -n "$CONF_GALE_DOMAIN" ] && GALE_DOMAIN="$CONF_GALE_DOMAIN"
118118- [ -n "$CONF_GALE_SERVER" ] && GALE_SERVER="$CONF_GALE_SERVER"
119119-120120--if [ -z "$GALE_USER" ]; then
121121--cat << EOM
122122--
123123--Hi. You need to denote a user to own the Gale domain secret key. You must
124124--trust this user with Gale authentication for your domain; the "gksign" program
125125--will run as this user. I recommend using a special "gale" user; if you don't
126126--have administrative privileges here, you'll probably have to use your own
127127--account. I do not recommend the use of "root".
128128--
129129--No harm done if you stop this script now to set up such a user.
130130--
131131--EOM
132132--
133133-- printf "Enter the Gale username: "
134134-- read GALE_USER
135135-- if [ -z "$GALE_USER" ]; then
136136-- echo "Error: Invalid username or no home dir: \"$GALE_USER\"."
137137-- exit 1
138138-- fi
139139--else
140140-- echo "Using \"$GALE_USER\" as the Gale owner."
141141--fi
142142--
143143- if [ -z "$GALE_DOMAIN" ] ; then
144144--cat << EOM
145145-+ cat << EOM
146146-147147- You need to identify the name of your Gale domain for two purposes:
148148-149149-@@ -140,97 +158,56 @@ else
150150- fi
151151-152152- # -----------------------------------------------------------------------------
153153--# create configuration file
154154--
155155--if [ ! -f "$CONF" ]; then
156156--cat > "$CONF" <<EOM
157157--# $CONF -- created by Gale installer; edit to suit.
158158--EOM
159159-+# create configuration file (if this is a single-user setup)
160160-+
161161-+if [ $is_root = no ]; then
162162-+ CONF="$SYS_DIR/conf"
163163-+
164164-+ if [ ! -d "$SYS_DIR" ]; then
165165-+ run mkdir -m 0700 -p "$SYS_DIR"
166166-+ run mkdir -m 0700 -p "$SYS_DIR/auth"
167167-+ run mkdir -m 0755 -p "$SYS_DIR/auth/trusted"
168168-+ run cp -f "$INST_SYS_DIR/auth/trusted/ROOT" "$SYS_DIR/auth/trusted"
169169-+ run mkdir -m 0700 -p "$SYS_DIR/auth/private"
170170-+ run mkdir -p "$SYS_DIR/auth/local" "$SYS_DIR/auth/cache"
171171-+ fi
172172-173173--cat <<EOM
174174-+ if [ ! -f "$CONF" ]; then
175175-+ cat <<EOM
176176-177177- *** Creating "$CONF".
178178- Examine and edit this file to your taste and local needs.
179179- If you want to recreate it from scratch, remove it and re-run this.
180180--EOM
181181--fi
182182--
183183--[ -n "$CONF_GALE_USER" ] || cat >> "$CONF" <<EOM
184184-185185--# The user who owns the domain secret key. (Used in installation and upgrade)
186186--GALE_USER $GALE_USER
187187- EOM
188188-189189--[ -n "$CONF_GALE_DOMAIN" ] || cat >> "$CONF" << EOM
190190-+ cat > "$CONF" <<EOF
191191-+# $CONF -- created by Gale installer; edit to suit.
192192-193193- # The authentication domain to use. (Mandatory)
194194- GALE_DOMAIN $GALE_DOMAIN
195195--EOM
196196--
197197--# -----------------------------------------------------------------------------
198198--# make gksign setuid
199199-+EOF
200200-201201--gksign="$sbindir/gksign"
202202--readlink="`which readlink 2>/dev/null`"
203203--[ -x "$readlink" ] && gksignlink="`"$readlink" "$gksign" 2>/dev/null`"
204204--[ -f "$gksignlink" ] && gksign="$gksignlink"
205205--
206206--echo ""
207207--if copy chown "$GALE_USER" "$gksign" ; then
208208-- :
209209--else
210210-- echo "*** We need to chown $GALE_USER '$gksign'."
211211-- echo " Please run this script as a user that can do so,"
212212-- echo " or do so yourself and re-run this script."
213213-- exit 1
214214-+ fi
215215- fi
216216--run chmod 4755 "$gksign"
217217-218218--# -----------------------------------------------------------------------------
219219--# create a domain, if necessary
220220-+if [ $is_root = no ]; then
221221-+ GALE_SYS_DIR="$SYS_DIR"
222222-+ export GALE_SYS_DIR
223223-224224--echo ""
225225--if test -u "$gksign" || copy chmod u+s "$gksign" ; then
226226-- :
227227-+ testkey "$GALE_DOMAIN" && exit 0
228228-+ echo "*** You lack a signed key for your domain, \"$GALE_DOMAIN\"."
229229-+ GALE="$SYS_DIR"
230230- else
231231-- echo "*** We need to chmod u+s '$gksign'."
232232-- echo " Please run this script as a user that can do so,"
233233-- echo " or do so yourself and re-run this script."
234234-- exit 1
235235--fi
236236--
237237--testkey "$GALE_DOMAIN" && exit 0
238238--echo "*** You lack a signed key for your domain, \"$GALE_DOMAIN\"."
239239--
240240--if [ "x$GALE_USER" != "x$USER" ]; then
241241--cat <<EOM
242242--Become user "$GALE_USER" (you are now "$USER") and run this script again
243243--to create a new domain; contact your domain administrator if you wish to
244244--become part of an existing domain.
245245--EOM
246246-- exit 1
247247--fi
248248--
249249--if [ -z "$HOME" ]; then
250250-- cd
251251-- HOME="`pwd`"
252252-- echo "Warning: \$HOME not set, assuming \"$HOME\"."
253253--fi
254254--
255255--GALE="$HOME/.gale"
256256--mkdir -p "$GALE"
257257--if [ ! -w "$GALE" ]; then
258258-- echo "Error: Cannot create \"$GALE\"."
259259-- exit 1
260260-+ GALE="`pwd`"
261261- fi
262262-263263- unsigned="$GALE/$GALE_DOMAIN.unsigned"
264264- signer="`echo "$GALE_DOMAIN" | sed 's%^[^.@:/]*[.@:/]%%'`"
265265- [ -z "$signer" ] && signer="ROOT"
266266-267267--if [ -f "$unsigned" ]; then
268268--
269269--cat << EOM
270270-+if [ $is_root = no ] && [ -f "$unsigned" ]; then
271271-+ cat << EOM
272272-273273- Okay, so we've already been here. Last time, I created the file
274274- "$unsigned" for you to have signed.
275275-@@ -275,16 +252,12 @@ EOM
276276- exit 1
277277- fi
278278-279279--cat << EOM
280280--
281281--The domain should be properly configured now. Assuming users can access a
282282--version of "gksign" setuid to "$GALE_USER" (this user), they should be
283283--able to start running clients and generating IDs for themselves.
284284-+ cat << EOM
285285-286286--The installation process is complete!
287287-+The domain should be properly configured now. The installation process is
288288-+complete!
289289-290290- EOM
291291--
292292- exit 0
293293- fi
294294-295295-@@ -300,7 +273,10 @@ printf "Enter the description: "
296296- read descr
297297-298298- echo "We will generate the key now. Have patience."
299299--gkgen -r "$GALE/auth/private/$GALE_DOMAIN.gpri" \
300300-+if [ $is_root = no ]; then
301301-+ install_gpri=auth/private/
302302-+fi
303303-+gkgen -r "$GALE/${install_gpri}$GALE_DOMAIN.gpri" \
304304- -u "$unsigned" "$GALE_DOMAIN" /"$descr" || exit 1
305305-306306- cat << EOM
307307-@@ -311,8 +284,29 @@ the owner of the "$signer" domain through appropriate means.
308308- Take care to preseve the file's binary data; you may need to uuencode it.
309309-310310- Assuming they trust you with your subdomain, they should pass the key through
311311--"gksign" as a filter, returning the signed output to you. When you have this
312312--signed key file available, re-run this script, and we will move on to the
313313--next step.
314314-+"gksign" as a filter, returning the signed output to you.
315315-+
316316-+EOM
317317-+
318318-+if [ $is_nixos = yes ]; then
319319-+ cat <<EOM
320320-+
321321-+When you have this signed key file available, you can finish the setup process
322322-+by placing the private key and signed public key in a directory (they will be
323323-+copied) and setting "services.gale.keyPath" in /etc/nixos/configuration.nix.
324324-325325- EOM
326326-+else
327327-+ cat <<EOM
328328-+
329329-+When you have this signed key file available, re-run this script, and we will
330330-+move on to the next step.
331331-+
332332-+*** IMPORTANT ***
333333-+You must set GALE_SYS_DIR="$GALE_SYS_DIR" in your environment before re-running
334334-+this script and before running any Gale programs once setup is finished! Make
335335-+sure to set it now, and consider setting it via your shell initialization files
336336-+so that you don't forget to do it next login.
337337-+
338338-+EOM
339339-+fi
···11+#! @shell@
22+33+set -eu -o pipefail
44+55+path_backup="$PATH"
66+if [ -n "@coreutils_bin@" ]; then
77+ PATH="@coreutils_bin@/bin"
88+fi
99+1010+declare -r recurThreshold=300
1111+1212+declare overflowCount=0
1313+for ((n=0; n < $#; ++n)); do
1414+ case "${!n}" in
1515+ -l*) let overflowCount+=1 ;;
1616+ -reexport-l*) let overflowCount+=1 ;;
1717+ *) ;;
1818+ esac
1919+done
2020+2121+declare -a allArgs=()
2222+2323+if (( "$overflowCount" <= "$recurThreshold" )); then
2424+ allArgs=("$@")
2525+else
2626+ declare -a childrenLookup=() childrenLink=()
2727+2828+ while (( $# )); do
2929+ case "$1" in
3030+ -L/*)
3131+ childrenLookup+=("$1")
3232+ allArgs+=("$1")
3333+ ;;
3434+ -L)
3535+ echo "cctools LD does not support '-L foo' or '-l foo'" >&2
3636+ exit 1
3737+ ;;
3838+ -l)
3939+ echo "cctools LD does not support '-L foo' or '-l foo'" >&2
4040+ exit 1
4141+ ;;
4242+ -lazy_library | -lazy_framework | -lto_library)
4343+ # We aren't linking any "azy_library", "to_library", etc.
4444+ allArgs+=("$1")
4545+ ;;
4646+ -lazy-l | -weak-l) allArgs+=("$1") ;;
4747+ # We can't so easily prevent header issues from these.
4848+ -lSystem) allArgs+=("$1") ;;
4949+ # Special case as indirection seems like a bad idea for something
5050+ # so fundamental. Can be removed for simplicity.
5151+ -l?* | -reexport-l?*) childrenLink+=("$1") ;;
5252+ *) allArgs+=("$1") ;;
5353+ esac
5454+5555+ shift
5656+ done
5757+5858+ declare n=0
5959+ while (( $n < "${#childrenLink[@]}" )); do
6060+ if [[ "${childrenLink[n]}" = -l* ]]; then
6161+ childrenLink[n]="-reexport${childrenLink[n]}"
6262+ fi
6363+ let ++n
6464+ done
6565+ unset n
6666+6767+ declare -r outputNameLibless=$(basename $( \
6868+ if [[ -z "${outputName:+isUndefined}" ]]; then
6969+ echo unnamed
7070+ elif [[ "${outputName:0:3}" = lib ]]; then
7171+ echo "${outputName:3}"
7272+ else
7373+ echo "${outputName}"
7474+ fi))
7575+ declare -ra children=("$outputNameLibless-reexport-delegate-0" \
7676+ "$outputNameLibless-reexport-delegate-1")
7777+7878+ mkdir -p "$out/lib"
7979+8080+ PATH="$PATH:@out@/bin"
8181+8282+ symbolBloatObject=$outputNameLibless-symbol-hack.o
8383+ if [[ ! -e $symbolBloatObject ]]; then
8484+ printf '.private_extern _______child_hack_foo\nchild_hack_foo:\n' \
8585+ | @binPrefix@as -- -o $symbolBloatObject
8686+ fi
8787+8888+ # first half of libs
8989+ @binPrefix@ld -macosx_version_min $MACOSX_DEPLOYMENT_TARGET -arch x86_64 -dylib \
9090+ -o "$out/lib/lib${children[0]}.dylib" \
9191+ -install_name "$out/lib/lib${children[0]}.dylib" \
9292+ "${childrenLookup[@]}" "$symbolBloatObject" \
9393+ "${childrenLink[@]:0:$((${#childrenLink[@]} / 2 ))}"
9494+9595+ # second half of libs
9696+ @binPrefix@ld -macosx_version_min $MACOSX_DEPLOYMENT_TARGET -arch x86_64 -dylib \
9797+ -o "$out/lib/lib${children[1]}.dylib" \
9898+ -install_name "$out/lib/lib${children[1]}.dylib" \
9999+ "${childrenLookup[@]}" "$symbolBloatObject" \
100100+ "${childrenLink[@]:$((${#childrenLink[@]} / 2 ))}"
101101+102102+ allArgs+=("-L$out/lib" "-l${children[0]}" "-l${children[1]}")
103103+fi
104104+105105+PATH="$path_backup"
106106+exec @prog@ "${allArgs[@]}"
+16-9
pkgs/build-support/docker/default.nix
···497497 # Use the temp folder we've been working on to create a new image.
498498 mv temp image/$layerID
499499500500- # Create image configuration file (used by registry v2) by using
501501- # the configuration of the last layer
502502- SHA_ARRAY=$(find ./ -name layer.tar | xargs sha256sum | cut -d" " -f1 | xargs -I{} echo -n '"sha256:{}" ' | sed 's/" "/","/g' | awk '{ print "["$1"]" }')
503503- jq ". + {\"rootfs\": {\"diff_ids\": $SHA_ARRAY, \"type\": \"layers\"}}" image/$layerID/json > config.json
504504- CONFIG_SHA=$(sha256sum config.json | cut -d ' ' -f1)
505505- mv config.json image/$CONFIG_SHA.json
500500+ # Create image json and image manifest
501501+ imageJson=$(cat ${baseJson} | jq ". + {\"rootfs\": {\"diff_ids\": [], \"type\": \"layers\"}}")
502502+ manifestJson=$(jq -n "[{\"RepoTags\":[\"$imageName:$imageTag\"]}]")
503503+ currentID=$layerID
504504+ while [[ -n "$currentID" ]]; do
505505+ layerChecksum=$(sha256sum image/$currentID/layer.tar | cut -d ' ' -f1)
506506+ imageJson=$(echo "$imageJson" | jq ".history |= [{\"created\": \"${created}\"}] + .")
507507+ imageJson=$(echo "$imageJson" | jq ".rootfs.diff_ids |= [\"sha256:$layerChecksum\"] + .")
508508+ manifestJson=$(echo "$manifestJson" | jq ".[0].Layers |= [\"$currentID/layer.tar\"] + .")
509509+510510+ currentID=$(cat image/$currentID/json | (jshon -e parent -u 2>/dev/null || true))
511511+ done
506512507507- # Create image manifest
508508- LAYER_PATHS=$(find image/ -name layer.tar -printf '"%P" ' | sed 's/" "/","/g')
509509- jq -n "[{\"Config\":\"$CONFIG_SHA.json\",\"RepoTags\":[\"$imageName:$imageTag\"],\"Layers\":[$LAYER_PATHS]}]" > image/manifest.json
513513+ imageJsonChecksum=$(echo "$imageJson" | sha256sum | cut -d ' ' -f1)
514514+ echo "$imageJson" > "image/$imageJsonChecksum.json"
515515+ manifestJson=$(echo "$manifestJson" | jq ".[0].Config = \"$imageJsonChecksum.json\"")
516516+ echo "$manifestJson" > image/manifest.json
510517511518 # Store the json under the name image/repositories.
512519 jshon -n object \
+2-1
pkgs/build-support/emacs/wrapper.nix
···8080 linkPath "$1" "share/emacs/site-lisp" "share/emacs/site-lisp"
8181 }
82828383- for pkg in $requires; do
8383+ # Iterate over the array of inputs (avoiding nix's own interpolation)
8484+ for pkg in "''${requires[@]}"; do
8485 linkEmacsPackage $pkg
8586 done
8687
+1-1
pkgs/data/fonts/junicode/default.nix
···18181919 meta = {
2020 homepage = http://junicode.sourceforge.net/;
2121- description = "A Unicode font";
2121+ description = "A Unicode font for medievalists";
2222 platforms = stdenv.lib.platforms.unix;
2323 };
2424}
+19-18
pkgs/data/fonts/lohit-fonts/default.nix
···11{ stdenv, fetchurl, lib }:
22let
33 fonts = {
44- assamese = { version = "2.91.3" ; sha256 = "0kbdvi8f7vbvsain9zmnj9h43a6bmdkhk5c2wzg15100w7wf6lpq"; };
55- bengali = { version = "2.91.3" ; sha256 = "1wdd2dkqaflf6nm5yc7llkfxin6g0zb2sbcd5g2xbrl0gwwcmkij"; };
66- devanagari = { version = "2.95.2" ; sha256 = "1ss0j0pcfrg1vsypnm0042y4bn7b84mi6lbfsvr6rs89lb5swvn2"; };
77- gujarati = { version = "2.92.2-and-4.2.2" ; sha256 = "1i27yjhn3x31a89x1hjs6rskdwp2kh0hibq1xiz3rgqil2m0jar6"; };
88- gurmukhi = { version = "2.91.0" ; sha256 = "0z8a30mnyhlfvqhnggfk0369hqg779ihqyhcmpxj0sf9dmb1i0mj"; }; # renamed from Punjabi
99- kannada = { version = "2.5.3" ; sha256 = "1x9fb5z1bwmfi0y1fdnzizzjxhbxp272wxznx36063kjf25bb9pi"; };
1010- malayalam = { version = "2.92.0" ; sha256 = "1syv1irxh5xl0z0d5kwankhlmi7s2dg4wpp58nq0mkd3rhm5q8qw"; };
1111- marathi = { version = "2.94.0" ; sha256 = "0y9sca6gbfbafv52v0n2r1xfs8rg6zmqs4vp9sjfc1c6yqhzagl4"; };
1212- nepali = { version = "2.94.0" ; sha256 = "0c56141rpxc30581i3gisg8kfaadxhqjhgshni6g7a7rn6l4dx17"; };
1313- odia = { version = "2.91.0" ; sha256 = "15iz9kdf9k5m8wcn2iqlqjm758ac3hvnk93va6kac06frxnhw9lp"; }; # renamed from Oriya
1414- tamil-classical = { version = "2.5.3" ; sha256 = "0ci4gk8qhhysjza69nncgmqmal8s4n8829icamvlzbmjdd4s2pij"; };
1515- tamil = { version = "2.91.1" ; sha256 = "1ir6kjl48apwk41xbpj0x458k108s7i61yzpkfhqcy1fkcr7cngj"; };
1616- telugu = { version = "2.5.4" ; sha256 = "06gdba7690y20l7nsi8fnnimim5hlq7hik0mpk2fzw4w39hjybk9"; };
44+ assamese = { label = "Assamese"; version = "2.91.3" ; sha256 = "0kbdvi8f7vbvsain9zmnj9h43a6bmdkhk5c2wzg15100w7wf6lpq"; };
55+ bengali = { label = "Bengali"; version = "2.91.3" ; sha256 = "1wdd2dkqaflf6nm5yc7llkfxin6g0zb2sbcd5g2xbrl0gwwcmkij"; };
66+ devanagari = { label = "Devanagari script"; version = "2.95.2" ; sha256 = "1ss0j0pcfrg1vsypnm0042y4bn7b84mi6lbfsvr6rs89lb5swvn2"; };
77+ gujarati = { label = "Gujarati"; version = "2.92.2-and-4.2.2" ; sha256 = "1i27yjhn3x31a89x1hjs6rskdwp2kh0hibq1xiz3rgqil2m0jar6"; };
88+ gurmukhi = { label = "Gurmukhi script"; version = "2.91.0" ; sha256 = "0z8a30mnyhlfvqhnggfk0369hqg779ihqyhcmpxj0sf9dmb1i0mj"; }; # renamed from Punjabi
99+ kannada = { label = "Kannada"; version = "2.5.3" ; sha256 = "1x9fb5z1bwmfi0y1fdnzizzjxhbxp272wxznx36063kjf25bb9pi"; };
1010+ malayalam = { label = "Malayalam"; version = "2.92.0" ; sha256 = "1syv1irxh5xl0z0d5kwankhlmi7s2dg4wpp58nq0mkd3rhm5q8qw"; };
1111+ marathi = { label = "Marathi"; version = "2.94.0" ; sha256 = "0y9sca6gbfbafv52v0n2r1xfs8rg6zmqs4vp9sjfc1c6yqhzagl4"; };
1212+ nepali = { label = "Nepali"; version = "2.94.0" ; sha256 = "0c56141rpxc30581i3gisg8kfaadxhqjhgshni6g7a7rn6l4dx17"; };
1313+ odia = { label = "Odia"; version = "2.91.0" ; sha256 = "15iz9kdf9k5m8wcn2iqlqjm758ac3hvnk93va6kac06frxnhw9lp"; }; # renamed from Oriya
1414+ tamil-classical = { label = "Classical Tamil"; version = "2.5.3" ; sha256 = "0ci4gk8qhhysjza69nncgmqmal8s4n8829icamvlzbmjdd4s2pij"; };
1515+ tamil = { label = "Tamil"; version = "2.91.1" ; sha256 = "1ir6kjl48apwk41xbpj0x458k108s7i61yzpkfhqcy1fkcr7cngj"; };
1616+ telugu = { label = "Telugu"; version = "2.5.4" ; sha256 = "06gdba7690y20l7nsi8fnnimim5hlq7hik0mpk2fzw4w39hjybk9"; };
1717 };
1818 gplfonts = {
1919 # GPL fonts removed from later releases
2020- kashmiri = { version = "2.4.3" ; sha256 = "0ax8xzv4pz17jnsjdklawncsm2qn7176wbxykswygpzdd5lr0gg9"; };
2121- konkani = { version = "2.4.3" ; sha256 = "03zc27z26a60aaggrqx4d6l0jgggciq8p83v6vgg0k6l3apvcp45"; };
2222- maithili = { version = "2.4.3" ; sha256 = "0aqwnhq1namvvb77f2vssahixqf4xay7ja4q8qc312wxkajdqh4a"; };
2323- sindhi = { version = "2.4.3" ; sha256 = "00imfbn01yc2g5zdyydks9w3ndkawr66l9qk2idlvw3yz3sw2kf1"; };
2020+ kashmiri = { label = "Kashmiri"; version = "2.4.3" ; sha256 = "0ax8xzv4pz17jnsjdklawncsm2qn7176wbxykswygpzdd5lr0gg9"; };
2121+ konkani = { label = "Konkani"; version = "2.4.3" ; sha256 = "03zc27z26a60aaggrqx4d6l0jgggciq8p83v6vgg0k6l3apvcp45"; };
2222+ maithili = { label = "Maithili"; version = "2.4.3" ; sha256 = "0aqwnhq1namvvb77f2vssahixqf4xay7ja4q8qc312wxkajdqh4a"; };
2323+ sindhi = { label = "Sindhi"; version = "2.4.3" ; sha256 = "00imfbn01yc2g5zdyydks9w3ndkawr66l9qk2idlvw3yz3sw2kf1"; };
2424 };
2525- mkpkg = license: name: {version, sha256}:
2525+ mkpkg = license: name: {label, version, sha256}:
2626 stdenv.mkDerivation {
2727 name = "lohit-${name}-${version}";
2828···44444545 meta = {
4646 inherit license;
4747+ description = "Free and open source fonts for Indian languages (" + label + ")";
4748 homepage = https://fedorahosted.org/lohit/;
4849 maintainers = [ lib.maintainers.mathnerd314 lib.maintainers.ttuegel ];
4950 # Set a non-zero priority to allow easy overriding of the
···2525# * enabling/disabling certain features in packages
2626#
2727# If you have an override of this kind, see configuration-common.nix instead.
2828-{ pkgs }:
2828+{ pkgs, haskellLib }:
29293030-with import ./lib.nix { inherit pkgs; };
3030+with haskellLib;
31313232# All of the overrides in this set should look like:
3333#
···11# This expression takes a file like `hackage-packages.nix` and constructs
22# a full package set out of that.
3344-# required dependencies:
55-{ pkgs, stdenv, all-cabal-hashes }:
44+{ # package-set used for non-haskell dependencies (all of nixpkgs)
55+ pkgs
6677-# arguments:
88-# * ghc package to use
99-# * package-set: a function that takes { pkgs, stdenv, callPackage } as first arg and `self` as second
1010-# * extensible-self: the final, fully overriden package set usable with the nixpkgs fixpoint overriding functionality
1111-{ ghc, package-set, extensible-self }:
77+, # stdenv to use for building haskell packages
88+ stdenv
99+1010+, haskellLib
1111+1212+, # hashes for downloading Hackage packages
1313+ all-cabal-hashes
1414+1515+, # compiler to use
1616+ ghc
1717+1818+, # A function that takes `{ pkgs, stdenv, callPackage }` as the first arg and `self`
1919+ # as second, and returns a set of haskell packages
2020+ package-set
2121+2222+, # The final, fully overriden package set usable with the nixpkgs fixpoint
2323+ # overriding functionality
2424+ extensible-self
2525+}:
12261327# return value: a function from self to the package set
1428self: let
15291630 inherit (stdenv.lib) fix' extends makeOverridable;
1717- inherit (import ./lib.nix { inherit pkgs; }) overrideCabal;
3131+ inherit (haskellLib) overrideCabal;
18321933 mkDerivationImpl = pkgs.callPackage ./generic-builder.nix {
2034 inherit stdenv;
···1414 sha256 = "1bd0rv93pxlv58c0x1d4dsjq4pg5qwrm2p7qw83pca7izlncgvfr";
1515 };
16161717+ goDeps = ./deps.nix;
1818+1719 meta = with stdenv.lib; {
1820 description = "A tool for creating identical machine images for multiple platforms from a single source configuration";
1921 homepage = http://www.packer.io;
···167167 BONDING m
168168 NET_L3_MASTER_DEV? y
169169 NET_FOU_IP_TUNNELS? y
170170+ IP_NF_TARGET_REDIRECT m
170171171172 # Wireless networking.
172173 CFG80211_WEXT? y # Without it, ipw2200 drivers don't build
···11+{ stdenv, fetchFromGitHub }:
22+33+stdenv.mkDerivation rec {
44+ name = "flockit-${version}";
55+ version = "2012-08-11";
66+77+ src = fetchFromGitHub {
88+ owner = "smerritt";
99+ repo = "flockit";
1010+ rev = "5c2b2092f8edcc8e3e2eb6ef66c968675dbfa686";
1111+ sha256 = "0vajck9q2677gpn9a4flkyz7mw69ql1647cjwqh834nrcr2b5164";
1212+ };
1313+1414+ installPhase = ''
1515+ mkdir -p $out/lib $out/bin
1616+ cp ./libflockit.so $out/lib
1717+1818+ (cat <<EOI
1919+ #!/bin/sh
2020+ env LD_PRELOAD="$out/lib/libflockit.so" FLOCKIT_FILE_PREFIX=\$1 \''${@:2}
2121+ EOI
2222+ ) > $out/bin/flockit
2323+ chmod +x $out/bin/flockit
2424+ '';
2525+2626+ meta = with stdenv.lib; {
2727+ description = "LD_PRELOAD shim to add file locking to programs that don't do it (I'm looking at you, rsync!)";
2828+ longDescription = ''
2929+ This library and tool exists solely because rsync doesn't have file locking.
3030+3131+ It's not used like a normal library; you don't link against it, and you
3232+ don't have to patch your source code to use it. It's inserted between your
3333+ program and its libraries by use of LD_PRELOAD.
3434+3535+ For example:
3636+3737+ $ env LD_PRELOAD=$(nix-build -A pkgs.flockit)/lib/libflockit.so FLOCKIT_FILE_PREFIX=test rsync SRC DEST
3838+3939+ Besides the library a handy executable is provided which can simplify the above to:
4040+4141+ $ $(nix-build -A pkgs.flockit)/bin/flockit test rsync SRC DEST
4242+4343+ Also see the following blog post:
4444+ https://www.swiftstack.com/blog/2012/08/15/old-school-monkeypatching/
4545+ '';
4646+ homepage = https://github.com/smerritt/flockit;
4747+ license = licenses.asl20;
4848+ platforms = platforms.linux;
4949+ maintainers = [ maintainers.basvandijk ];
5050+ };
5151+}
+3-3
pkgs/tools/backup/restic/default.nix
···2233buildGoPackage rec {
44 name = "restic-${version}";
55- version = "0.7.0";
55+ version = "0.7.1";
6677 goPackagePath = "github.com/restic/restic";
88···1010 owner = "restic";
1111 repo = "restic";
1212 rev = "v${version}";
1313- sha256 = "1whzzma2c199i604qy1a807zhi8qgri1r9bbxl5l7wlfh7x0n6sd";
1313+ sha256 = "07614wp0b6kjl8lq3qir271g0s2h8wvpdh43wsz1k6bip60nmqbf";
1414 };
15151616 buildPhase = ''
···2626 meta = with stdenv.lib; {
2727 homepage = https://restic.github.io;
2828 description = "A backup program that is fast, efficient and secure";
2929- platforms = platforms.linux;
2929+ platforms = platforms.linux ++ platforms.darwin;
3030 license = licenses.bsd2;
3131 maintainers = [ maintainers.mbrgm ];
3232 };
···2020 new font where all glyphs are bytecode hinted using the
2121 information given by FreeType’s auto-hinting module.
2222 '';
2323- homepage = http://www.freetype.org/ttfautohint/;
2323+ homepage = https://www.freetype.org/ttfautohint;
2424 license = licenses.gpl2Plus; # or the FreeType License (BSD + advertising clause)
2525 maintainers = with maintainers; [ goibhniu ndowens ];
2626 platforms = platforms.linux;
+303
pkgs/tools/networking/envoy/default.nix
···11+{ stdenv, lib, fetchFromGitHub, pkgconfig, bazel, c-ares, backward-cpp
22+, libevent, gtest, gperftools, http-parser, lightstep-tracer-cpp
33+, nghttp2, protobuf3_2, tclap, rapidjson, spdlog, boringssl, buildEnv
44+}:
55+66+let
77+ protobuf_bzl =
88+ fetchFromGitHub {
99+ owner = "htuch";
1010+ repo = "protobuf";
1111+ rev = "d490587268931da78c942a6372ef57bb53db80da";
1212+ sha256 = "100494s66xclw88bdnpb6d386vgw0gwz90sni37q7fqmi9w99z6v";
1313+ };
1414+1515+ # Based on ci/prebuilt/BUILD
1616+ #
1717+ # The paths have been fixed up, and the static archives have been replaced
1818+ # with dynamic libraries where presently possible.
1919+ #
2020+ # At the moment, this doesn't _need_ to be a map that we dynamically create a
2121+ # BUILD file from (we could instead just include the contents directly);
2222+ # however, this sets us up to be ready if we (or upstream) decide to split
2323+ # things into multiple bazel repos, instead of one.
2424+ ccTargets = {
2525+ ares = {
2626+ pkg = c-ares;
2727+ srcs = ''["lib/libcares.so"]'';
2828+ hdrs = ''glob(["include/ares*.h"])'';
2929+ includes = ''["include"]'';
3030+ };
3131+3232+ backward = {
3333+ pkg = backward-cpp;
3434+ hdrs = ''["include/backward.hpp"]'';
3535+ includes = ''["include"]'';
3636+ };
3737+3838+ crypto = {
3939+ pkg = boringssl;
4040+ srcs = ''["lib/libcrypto.a"]'';
4141+ hdrs = ''glob(["include/openssl/**/*.h"])'';
4242+ includes = ''["include"]'';
4343+ };
4444+4545+ event = {
4646+ pkg = libevent;
4747+ srcs = ''["lib/libevent.so"]'';
4848+ hdrs = ''glob(["include/event2/**/*.h"])'';
4949+ includes = ''["include"]'';
5050+ };
5151+5252+ event_pthreads = {
5353+ pkg = libevent;
5454+ srcs = ''["lib/libevent_pthreads.so"]'';
5555+ deps = ''[":event"]'';
5656+ };
5757+5858+ googletest = {
5959+ pkg = gtest;
6060+ srcs = ''[ "lib/libgmock.so", "lib/libgtest.so" ]'';
6161+ hdrs = ''glob(["include/gmock/**/*.h", "include/gtest/**/*.h"])'';
6262+ includes = ''["include"]'';
6363+ };
6464+6565+ http_parser = {
6666+ pkg = http-parser;
6767+ srcs = ''["lib/libhttp_parser.so"]'';
6868+ hdrs = ''glob(["include/http_parser.h"])'';
6969+ includes = ''["include"]'';
7070+ };
7171+7272+ lightstep = {
7373+ pkg = lightstep-tracer-cpp;
7474+ srcs = ''["lib/liblightstep_core_cxx11.a"]'';
7575+ hdrs = ''glob([ "include/lightstep/**/*.h", "include/mapbox_variant/**/*.hpp" ]) + [ "include/collector.pb.h", "include/lightstep_carrier.pb.h" ]'';
7676+ includes = ''["include"]'';
7777+ deps = ''[":protobuf"]'';
7878+ };
7979+8080+ nghttp2 = {
8181+ pkg = nghttp2;
8282+ srcs = ''["lib/libnghttp2.so"]'';
8383+ hdrs = ''glob(["include/nghttp2/**/*.h"])'';
8484+ includes = ''["include"]'';
8585+ };
8686+8787+ protobuf = {
8888+ pkg = protobuf3_2;
8989+ srcs = ''glob(["lib/libproto*.so"])'';
9090+ hdrs = ''glob(["include/google/protobuf/**/*.h"])'';
9191+ includes = ''["include"]'';
9292+ };
9393+9494+ rapidjson = {
9595+ pkg = rapidjson;
9696+ hdrs = ''glob(["include/rapidjson/**/*.h"])'';
9797+ includes = ''["include"]'';
9898+ };
9999+100100+ spdlog = {
101101+ pkg = spdlog;
102102+ name = "spdlog";
103103+ hdrs = ''glob([ "include/spdlog/**/*.cc", "include/spdlog/**/*.h" ])'';
104104+ includes = ''["include"]'';
105105+ };
106106+107107+ ssl = {
108108+ pkg = boringssl;
109109+ srcs = ''["lib/libssl.a"]'';
110110+ deps = ''[":crypto"]'';
111111+ };
112112+113113+ tclap = {
114114+ pkg = tclap;
115115+ hdrs = ''glob(["include/tclap/**/*.h"])'';
116116+ includes = ''["include"]'';
117117+ };
118118+119119+ tcmalloc_and_profiler = {
120120+ pkg = gperftools;
121121+ srcs = ''["lib/libtcmalloc_and_profiler.so"]'';
122122+ hdrs = ''glob(["include/gperftools/**/*.h"])'';
123123+ strip_include_prefix = ''"include"'';
124124+ };
125125+ };
126126+127127+ # Generate the BUILD file.
128128+ buildFile =
129129+ let field = name: attrs:
130130+ if attrs ? "${name}" then " ${name} = ${attrs.${name}},\n" else "";
131131+ in
132132+ ''
133133+ licenses(["notice"]) # Apache 2
134134+135135+ package(default_visibility = ["//visibility:public"])
136136+137137+ '' +
138138+ lib.concatStringsSep "\n\n" (
139139+ lib.mapAttrsToList (name: value:
140140+ "cc_library(\n"
141141+ + " name = \"${name}\",\n"
142142+ + field "srcs" value
143143+ + field "hdrs" value
144144+ + field "deps" value
145145+ + field "includes" value
146146+ + field "strip_include_prefix" value
147147+ + ")"
148148+ ) ccTargets
149149+ ) + ''
150150+151151+ filegroup(
152152+ name = "protoc",
153153+ srcs = ["bin/protoc"],
154154+ )
155155+ '';
156156+157157+ workspaceFile =
158158+ ''
159159+ workspace(name = "nix")
160160+161161+ load("//bazel:repositories.bzl", "envoy_dependencies")
162162+ load("//bazel:cc_configure.bzl", "cc_configure")
163163+164164+ new_local_repository(
165165+ name = "nix_envoy_deps",
166166+ path = "${repoEnv}",
167167+ build_file = "nix_envoy_deps.BUILD"
168168+ )
169169+170170+ envoy_dependencies(
171171+ path = "@nix_envoy_deps//",
172172+ skip_protobuf_bzl = True,
173173+ )
174174+175175+ new_local_repository(
176176+ name = "protobuf_bzl",
177177+ path = "${protobuf_bzl}",
178178+ # We only want protobuf.bzl, so don't support building out of this repo.
179179+ build_file_content = "",
180180+ )
181181+182182+ cc_configure()
183183+ '';
184184+185185+ # The tree we'll use for our new_local_repository in our generated WORKSPACE.
186186+ repoEnv = buildEnv {
187187+ name = "repo-env";
188188+ paths = lib.concatMap (p:
189189+ lib.unique [(lib.getBin p) (lib.getLib p) (lib.getDev p)]
190190+ ) allDeps;
191191+ };
192192+193193+ rpath = stdenv.lib.makeLibraryPath (allDeps ++ [ stdenv.cc.cc ]);
194194+195195+ allDeps = [
196196+ c-ares
197197+ backward-cpp
198198+ libevent
199199+ gtest
200200+ gperftools
201201+ http-parser
202202+ lightstep-tracer-cpp
203203+ nghttp2
204204+ protobuf3_2
205205+ tclap
206206+ rapidjson
207207+ spdlog
208208+ boringssl
209209+ ];
210210+211211+ # Envoy checks at runtime that the git sha is valid,
212212+ # so we really can't avoid putting some sort of sha here.
213213+ rev = "3afc7712a04907ffd25ed497626639febfe65735";
214214+215215+in
216216+217217+stdenv.mkDerivation rec {
218218+ name = "envoy-${version}";
219219+ version = "1.3.0";
220220+221221+ src = fetchFromGitHub {
222222+ owner = "lyft";
223223+ repo = "envoy";
224224+ rev = "v${version}";
225225+ sha256 = "0j1c9lyvncyhiq3kyhx91ckcjd2h68x56js7xb6ni6bzxinv6zb6";
226226+ };
227227+228228+ nativeBuildInputs = [
229229+ pkgconfig bazel
230230+ ];
231231+232232+ buildInputs = allDeps;
233233+234234+ patches = [ ./nixos.patch ];
235235+236236+ hardeningDisable = "all";
237237+ dontPatchELF = true;
238238+ dontStrip = true;
239239+240240+ # set up our workspace,
241241+ # and prevent an error where bazel/get_workspace_status tries to determine the
242242+ # version by invoking git.
243243+ postUnpack = ''
244244+ cat <<'EOF' > $sourceRoot/WORKSPACE
245245+ ${workspaceFile}
246246+ EOF
247247+248248+ cat <<'EOF' > $sourceRoot/nix_envoy_deps.BUILD
249249+ ${buildFile}
250250+ EOF
251251+252252+ cat <<'EOF' > $sourceRoot/bazel/get_workspace_status
253253+ #!${stdenv.shell}
254254+ echo "BUILD_SCM_REVISION ${rev}"
255255+ echo "BUILD_SCM_STATUS Modified"
256256+ EOF
257257+ '';
258258+259259+ buildPhase = ''
260260+ runHook preBuild
261261+262262+ mkdir .home
263263+ export HOME=$PWD/.home
264264+265265+ BAZEL_OPTIONS="--package_path %workspace%:$PWD"
266266+ BAZEL_BUILD_OPTIONS="\
267267+ --strategy=Genrule=standalone \
268268+ --spawn_strategy=standalone \
269269+ --verbose_failures \
270270+ $BAZEL_OPTIONS \
271271+ --action_env=HOME \
272272+ --action_env=PYTHONUSERBASE \
273273+ --show_task_finish"
274274+275275+ bazel \
276276+ --batch \
277277+ build \
278278+ -s --verbose_failures \
279279+ --experimental_ui \
280280+ $BAZEL_BUILD_OPTIONS \
281281+ -c opt \
282282+ //source/exe:envoy-static
283283+284284+ exe=bazel-bin/source/exe/envoy-static
285285+ chmod +w $exe
286286+ patchelf --set-rpath ${rpath} $exe
287287+288288+ runHook postBuild
289289+ '';
290290+291291+ installPhase = ''
292292+ mkdir -p $out/bin
293293+ mv $exe $out/bin/envoy
294294+ '';
295295+296296+ meta = with lib; {
297297+ description = "L7 proxy and communication bus designed for large modern service oriented architectures";
298298+ homepage = "https://lyft.github.io/envoy/";
299299+ license = licenses.asl20;
300300+ platforms = platforms.linux;
301301+ maintainers = with maintainers; [ cstrahan ];
302302+ };
303303+}
+41
pkgs/tools/networking/envoy/nixos.patch
···11+diff --git a/bazel/cc_configure.bzl b/bazel/cc_configure.bzl
22+index 8a7a69c4f..75526520c 100644
33+--- a/bazel/cc_configure.bzl
44++++ b/bazel/cc_configure.bzl
55+@@ -292,6 +292,8 @@ def _crosstool_content(repository_ctx, cc, cpu_value, darwin):
66+ "-fstack-protector",
77+ # All warnings are enabled. Maybe enable -Werror as well?
88+ "-Wall",
99++
1010++ "-Wno-error=strict-aliasing"
1111+ # Enable a few more warnings that aren't part of -Wall.
1212+ ] + (["-Wthread-safety", "-Wself-assign"] if darwin else [
1313+ "-B" + str(repository_ctx.path(cc).dirname),
1414+@@ -365,10 +367,6 @@ def _opt_content(darwin):
1515+ # Profile first and / or use FDO if you need better performance than this.
1616+ "-O2",
1717+1818+- # Security hardening on by default.
1919+- # Conservative choice; -D_FORTIFY_SOURCE=2 may be unsafe in some cases.
2020+- "-D_FORTIFY_SOURCE=1",
2121+-
2222+ # Disable assertions
2323+ "-DNDEBUG",
2424+2525+diff --git a/bazel/envoy_build_system.bzl b/bazel/envoy_build_system.bzl
2626+index f17671035..7938047bd 100644
2727+--- a/bazel/envoy_build_system.bzl
2828++++ b/bazel/envoy_build_system.bzl
2929+@@ -131,11 +131,9 @@ def envoy_cc_binary(name,
3030+ # --build-id and avoid doing the following.
3131+ '-Wl,--build-id=md5',
3232+ '-Wl,--hash-style=gnu',
3333+- "-static-libstdc++",
3434+- "-static-libgcc",
3535+ ],
3636+ testonly = testonly,
3737+- linkstatic = 1,
3838++ linkstatic = 0,
3939+ visibility = visibility,
4040+ malloc = tcmalloc_external_dep(repository),
4141+ # See above comment on MD5 hash, this is another "force MD5 stamps" to make sure our