···563563564564- `make-disk-image` handles `contents` arguments that are directories better, fixing a bug where it used to put them in a subdirectory of the intended `target`.565565566566+- The option `services.jitsi-videobridge.apis` has been renamed to `colibriRestApi` and turned into a boolean. Setting it to `true` will enable the private rest API, useful for monitoring using `services.prometheus.exporters.jitsi.enable`. Learn more about the API: "[The COLIBRI control interface (/colibri/)](https://github.com/jitsi/jitsi-videobridge/blob/v2.3/doc/rest.md)".567567+566568## Detailed migration information {#sec-release-23.05-migration}567569568570### Pipewire configuration overrides {#sec-release-23.05-migration-pipewire}
···172172173173 emptyRepo = mkOption {174174 type = types.bool;175175- default = false;176176- description = lib.mdDoc "If set to true, the repo won't be initialized with help files";175175+ default = true;176176+ description = lib.mdDoc "If set to false, the repo will be initialized with help files";177177 };178178179179 settings = mkOption {···331331332332 preStart = ''333333 if [[ ! -f "$IPFS_PATH/config" ]]; then334334- ipfs init ${optionalString cfg.emptyRepo "-e"}334334+ ipfs init --empty-repo=${lib.boolToString cfg.emptyRepo}335335 else336336 # After an unclean shutdown this file may exist which will cause the config command to attempt to talk to the daemon. This will hang forever if systemd is holding our sockets open.337337 rm -vf "$IPFS_PATH/api"
···4343 muc_nickname = xmppConfig.mucNickname;4444 disable_certificate_verification = xmppConfig.disableCertificateVerification;4545 });4646+ apis.rest.enabled = cfg.colibriRestApi;4647 };4748 };4849···5150 jvbConfig = recursiveUpdate defaultJvbConfig cfg.config;5251in5352{5353+ imports = [5454+ (mkRemovedOptionModule [ "services" "jitsi-videobridge" "apis" ]5555+ "services.jitsi-videobridge.apis was broken and has been migrated into the boolean option services.jitsi-videobridge.colibriRestApi. It is set to false by default, setting it to true will correctly enable the private /colibri rest API."5656+ )5757+ ];5458 options.services.jitsi-videobridge = with types; {5559 enable = mkEnableOption (lib.mdDoc "Jitsi Videobridge, a WebRTC compatible video router");5660···198192 '';199193 };200194201201- apis = mkOption {202202- type = with types; listOf str;195195+ colibriRestApi = mkOption {196196+ type = bool;203197 description = lib.mdDoc ''204204- What is passed as --apis= parameter. If this is empty, "none" is passed.205205- Needed for monitoring jitsi.198198+ Whether to enable the private rest API for the COLIBRI control interface.199199+ Needed for monitoring jitsi, enabling scraping of the /colibri/stats endpoint.206200 '';207207- default = [];208208- example = literalExpression "[ \"colibri\" \"rest\" ]";201201+ default = false;209202 };210203 };211204···238233 "export ${toVarName name}=$(cat ${xmppConfig.passwordFile})\n"239234 ) cfg.xmppConfigs))240235 + ''241241- ${pkgs.jitsi-videobridge}/bin/jitsi-videobridge --apis=${if (cfg.apis == []) then "none" else concatStringsSep "," cfg.apis}236236+ ${pkgs.jitsi-videobridge}/bin/jitsi-videobridge242237 '';243238244239 serviceConfig = {
···6677rustPlatform.buildRustPackage rec {88 pname = "system76-keyboard-configurator";99- version = "1.3.1";99+ version = "1.3.2";10101111 src = fetchFromGitHub {1212 owner = "pop-os";1313 repo = "keyboard-configurator";1414 rev = "v${version}";1515- sha256 = "sha256-k9VmEg/HZECUwHaD491ZmfGUxZ14hLOaJD5x3zMK2jI=";1515+ sha256 = "sha256-21cn43qyKg8jL6FF8D9H7dgcgSKggqaxb4cJVc0ljl0=";1616 };17171818 nativeBuildInputs = [···2828 udev2929 ];30303131- cargoHash = "sha256-0SFph9quh4QWR3nU5IJr4FyLGqrYvmHcZHDRli6phsc=";3131+ cargoHash = "sha256-9VjrDE/1VAgNrRmSYxCYKPrnilPQF+OXAYpFkF2lpAE=";32323333 meta = with lib; {3434 description = "Keyboard configuration application for System76 keyboards and laptops";
+2-2
pkgs/applications/networking/kubo/default.nix
···2233buildGoModule rec {44 pname = "kubo";55- version = "0.19.2"; # When updating, also check if the repo version changed and adjust repoVersion below55+ version = "0.20.0"; # When updating, also check if the repo version changed and adjust repoVersion below66 rev = "v${version}";7788 passthru.repoVersion = "13"; # Also update kubo-migrator when changing the repo version···1010 # Kubo makes changes to it's source tarball that don't match the git source.1111 src = fetchurl {1212 url = "https://github.com/ipfs/kubo/releases/download/${rev}/kubo-source.tar.gz";1313- hash = "sha256-HPhlKAavINaN0SJHWmeJRx43jfeHeYDZb3/dZ55kMLI=";1313+ hash = "sha256-3Oj/x3EkceNO8/Ik7+U43wi1aL0lYJi1FA0AjtdJRDI=";1414 };15151616 # tarball contains multiple files/directories
···19192020# Pin openssl to match the version bundled with our supported Rubies.2121# See https://stdgems.org/openssl/#gem-version.2222-gem 'openssl', '2.2.2'2222+gem 'openssl', '3.0.2'2323gem 'ipaddr', '~> 1.2.5'24242525# Responders respond_to and respond_with
···66 name = "npm-config-hook";77 substitutions = {88 nodeSrc = srcOnly nodejs;99+ nodeGyp = "${buildPackages.nodejs}/lib/node_modules/npm/node_modules/node-gyp/bin/node-gyp.js";9101011 # Specify `diff`, `jq`, and `prefetch-npm-deps` by abspath to ensure that the user's build1112 # inputs do not cause us to find the wrong binaries.
···33npmConfigHook() {44 echo "Executing npmConfigHook"5566+ # Use npm patches in the nodejs package77+ export NIX_NODEJS_BUILDNPMPACKAGE=188+ export prefetchNpmDeps="@prefetchNpmDeps@"99+610 echo "Configuring npm"711812 export HOME="$TMPDIR"913 export npm_config_nodedir="@nodeSrc@"1414+ export npm_config_node_gyp="@nodeGyp@"10151116 if [ -z "${npmDeps-}" ]; then1217 echo···98939994 patchShebangs node_modules10095101101- local -r lockfileVersion="$(@jq@ .lockfileVersion package-lock.json)"102102-103103- if (( lockfileVersion < 2 )); then104104- # This is required because npm consults a hidden lockfile in node_modules to figure out105105- # what to create bin links for. When using an old lockfile offline, this hidden lockfile106106- # contains insufficent data, making npm silently fail to create links. The hidden lockfile107107- # is bypassed when any file in node_modules is newer than it. Thus, we create a file when108108- # using an old lockfile, so bin links work as expected without having to downgrade Node or npm.109109- touch node_modules/.meow110110- fi111111-112112- npm rebuild "${npmRebuildFlags[@]}" "${npmFlags[@]}"113113-114114- if (( lockfileVersion < 2 )); then115115- rm node_modules/.meow116116- fi9696+ npm rebuild $npmRebuildFlags "${npmRebuildFlagsArray[@]}" $npmFlags "${npmFlagsArray[@]}"1179711898 patchShebangs node_modules11999
···2233stdenvNoCC.mkDerivation rec {44 pname = "victor-mono";55- version = "1.5.4";55+ version = "1.5.5";6677 # Upstream prefers we download from the website,88 # but we really insist on a more versioned resource.···1414 src = fetchzip {1515 url = "https://github.com/rubjo/victor-mono/raw/v${version}/public/VictorMonoAll.zip";1616 stripRoot = false;1717- hash = "sha256-E8j1bfYrM8yRtasiwgTvyE4EYx2LyAbmw3MXH1l+owk=";1717+ hash = "sha256-l8XeKE9PtluiazZO0PXfkGCcnm5o+VZdL7NZ6w0tp80=";1818 };19192020 installPhase = ''
···11+This patch is based off of npm tag v8.19.4.22+33+This introduces fixes for 4 issues:44+55+1. When node-gyp is included as a dependency in a project, any scripts that run it will not use the copy included in Node. This is problematic because we patch node-gyp to work without xcbuild on Darwin, leading to these packages failing to build with a sandbox on Darwin.66+2. When a Git dependency contains install scripts, it has to be built just like any other package. Thus, we need to patch shebangs appropriately, just like in npmConfigHook.77+3. We get useless warnings that clog up logs when using a v1 lockfile, so we silence them.88+4. npm looks at a hidden lockfile to determine if files have binaries to link into `node_modules/.bin`. When using a v1 lockfile offline, this lockfile does not contain enough info, leading to binaries for packages such as Webpack not being available to scripts. We used to work around this by making npm ignore the hidden lockfile by creating a file, but now we just disable the code path entirely.99+1010+To update:1111+1. Run `git diff` from an npm checkout1212+2. Run `fix-npm-patch-paths.sh`1313+3. Include/update this frontmatter, please!1414+1515+diff --git a/deps/npm/node_modules/@npmcli/run-script/lib/set-path.js b/deps/npm/node_modules/@npmcli/run-script/lib/set-path.js1616+index c59c270d9..98785192f 1006441717+--- a/deps/npm/node_modules/@npmcli/run-script/lib/set-path.js1818++++ b/deps/npm/node_modules/@npmcli/run-script/lib/set-path.js1919+@@ -12,7 +12,10 @@ const setPATH = (projectPath, binPaths, env) => {2020+ .reduce((set, p) => set.concat(p.filter(concatted => !set.includes(concatted))), [])2121+ .join(delimiter)2222+2323+- const pathArr = []2424++ // Ensure when using buildNpmPackage hooks that Node.js'2525++ // bundled copy of node-gyp is used, instead of any copy2626++ // pulled in as a dependency.2727++ const pathArr = process.env['NIX_NODEJS_BUILDNPMPACKAGE'] ? [nodeGypPath, PATH] : [];2828+ if (binPaths) {2929+ pathArr.push(...binPaths)3030+ }3131+@@ -26,7 +29,8 @@ const setPATH = (projectPath, binPaths, env) => {3232+ pp = p3333+ p = dirname(p)3434+ } while (p !== pp)3535+- pathArr.push(nodeGypPath, PATH)3636++ if (!process.env['NIX_NODEJS_BUILDNPMPACKAGE']) { pathArr.push(nodeGypPath, PATH) }3737++3838+3939+ const pathVal = pathArr.join(delimiter)4040+4141+diff --git a/deps/npm/node_modules/pacote/lib/git.js b/deps/npm/node_modules/pacote/lib/git.js4242+index c4819b4fd..7efbeef05 1006444343+--- a/deps/npm/node_modules/pacote/lib/git.js4444++++ b/deps/npm/node_modules/pacote/lib/git.js4545+@@ -186,6 +186,24 @@ class GitFetcher extends Fetcher {4646+ }4747+ noPrepare.push(this.resolved)4848+4949++ if (process.env['NIX_NODEJS_BUILDNPMPACKAGE']) {5050++ const spawn = require('@npmcli/promise-spawn')5151++5252++ const npmWithNixFlags = (args, cmd) => spawn('bash', ['-c', 'npm ' + args + ` $npm${cmd}Flags "$\{npm${cmd}FlagsArray[@]}" $npmFlags "$\{npmFlagsArray[@]}"`], { cwd: dir, env: { ...process.env, _PACOTE_NO_PREPARE_: noPrepare.join('\n') } }, { message: `\`npm ${args}\` failed` })5353++ const patchShebangs = () => spawn('bash', ['-c', 'source $stdenv/setup; patchShebangs node_modules'], { cwd: dir })5454++5555++ // the DirFetcher will do its own preparation to run the prepare scripts5656++ // All we have to do is put the deps in place so that it can succeed.5757++ //5858++ // We ignore this.npmConfig to maintain an environment that's as close5959++ // to the rest of the build as possible.6060++ return spawn('bash', ['-c', '$prefetchNpmDeps --fixup-lockfile package-lock.json'], { cwd: dir })6161++ .then(() => npmWithNixFlags('ci --ignore-scripts', 'Install'))6262++ .then(patchShebangs)6363++ .then(() => npmWithNixFlags('rebuild', 'Rebuild'))6464++ .then(patchShebangs)6565++ }6666++6767+ // the DirFetcher will do its own preparation to run the prepare scripts6868+ // All we have to do is put the deps in place so that it can succeed.6969+ return npm(7070+diff --git a/deps/npm/node_modules/@npmcli/arborist/lib/arborist/build-ideal-tree.js b/deps/npm/node_modules/@npmcli/arborist/lib/arborist/build-ideal-tree.js7171+index e9a8720d7..b29ad0185 1006447272+--- a/deps/npm/node_modules/@npmcli/arborist/lib/arborist/build-ideal-tree.js7373++++ b/deps/npm/node_modules/@npmcli/arborist/lib/arborist/build-ideal-tree.js7474+@@ -744,7 +744,7 @@ This is a one-time fix-up, please be patient...7575+ node.package = { ...mani, _id: `${mani.name}@${mani.version}` }7676+ } catch (er) {7777+ const warning = `Could not fetch metadata for ${name}@${id}`7878+- log.warn(heading, warning, er)7979++ if (!process.env['NIX_NODEJS_BUILDNPMPACKAGE']) { log.warn(heading, warning, er) }8080+ }8181+ this.finishTracker(t)8282+ })8383+diff --git a/deps/npm/node_modules/@npmcli/arborist/lib/arborist/load-actual.js b/deps/npm/node_modules/@npmcli/arborist/lib/arborist/load-actual.js8484+index 7ab65f5b0..12f563a50 1006448585+--- a/deps/npm/node_modules/@npmcli/arborist/lib/arborist/load-actual.js8686++++ b/deps/npm/node_modules/@npmcli/arborist/lib/arborist/load-actual.js8787+@@ -143,7 +143,7 @@ module.exports = cls => class ActualLoader extends cls {8888+ this[_actualTree].assertRootOverrides()8989+9090+ // if forceActual is set, don't even try the hidden lockfile9191+- if (!forceActual) {9292++ if (!forceActual && !process.env['NIX_NODEJS_BUILDNPMPACKAGE']) {9393+ // Note: hidden lockfile will be rejected if it's not the latest thing9494+ // in the folder, or if any of the entries in the hidden lockfile are9595+ // missing.
···11+This patch is based off of npm tag v9.1.5.22+33+This introduces fixes for 4 issues:44+55+1. When node-gyp is included as a dependency in a project, any scripts that run it will not use the copy included in Node. This is problematic because we patch node-gyp to work without xcbuild on Darwin, leading to these packages failing to build with a sandbox on Darwin.66+2. When a Git dependency contains install scripts, it has to be built just like any other package. Thus, we need to patch shebangs appropriately, just like in npmConfigHook.77+3. We get useless warnings that clog up logs when using a v1 lockfile, so we silence them.88+4. npm looks at a hidden lockfile to determine if files have binaries to link into `node_modules/.bin`. When using a v1 lockfile offline, this lockfile does not contain enough info, leading to binaries for packages such as Webpack not being available to scripts. We used to work around this by making npm ignore the hidden lockfile by creating a file, but now we just disable the code path entirely.99+1010+To update:1111+1. Run `git diff` from an npm checkout1212+2. Run `fix-npm-patch-paths.sh`1313+3. Include/update this frontmatter, please!1414+1515+diff --git a/deps/npm/node_modules/@npmcli/run-script/lib/set-path.js b/deps/npm/node_modules/@npmcli/run-script/lib/set-path.js1616+index c59c270d9..98785192f 1006441717+--- a/deps/npm/node_modules/@npmcli/run-script/lib/set-path.js1818++++ b/deps/npm/node_modules/@npmcli/run-script/lib/set-path.js1919+@@ -12,7 +12,10 @@ const setPATH = (projectPath, binPaths, env) => {2020+ .reduce((set, p) => set.concat(p.filter(concatted => !set.includes(concatted))), [])2121+ .join(delimiter)2222+2323+- const pathArr = []2424++ // Ensure when using buildNpmPackage hooks that Node.js'2525++ // bundled copy of node-gyp is used, instead of any copy2626++ // pulled in as a dependency.2727++ const pathArr = process.env['NIX_NODEJS_BUILDNPMPACKAGE'] ? [nodeGypPath, PATH] : [];2828+ if (binPaths) {2929+ pathArr.push(...binPaths)3030+ }3131+@@ -26,7 +29,8 @@ const setPATH = (projectPath, binPaths, env) => {3232+ pp = p3333+ p = dirname(p)3434+ } while (p !== pp)3535+- pathArr.push(nodeGypPath, PATH)3636++ if (!process.env['NIX_NODEJS_BUILDNPMPACKAGE']) { pathArr.push(nodeGypPath, PATH) }3737++3838+3939+ const pathVal = pathArr.join(delimiter)4040+4141+diff --git a/deps/npm/node_modules/pacote/lib/git.js b/deps/npm/node_modules/pacote/lib/git.js4242+index 1fa8b1f96..a026bb50d 1006444343+--- a/deps/npm/node_modules/pacote/lib/git.js4444++++ b/deps/npm/node_modules/pacote/lib/git.js4545+@@ -188,6 +188,24 @@ class GitFetcher extends Fetcher {4646+ }4747+ noPrepare.push(this.resolved)4848+4949++ if (process.env['NIX_NODEJS_BUILDNPMPACKAGE']) {5050++ const spawn = require('@npmcli/promise-spawn')5151++5252++ const npmWithNixFlags = (args, cmd) => spawn('bash', ['-c', 'npm ' + args + ` $npm${cmd}Flags "$\{npm${cmd}FlagsArray[@]}" $npmFlags "$\{npmFlagsArray[@]}"`], { cwd: dir, env: { ...process.env, _PACOTE_NO_PREPARE_: noPrepare.join('\n') } }, { message: `\`npm ${args}\` failed` })5353++ const patchShebangs = () => spawn('bash', ['-c', 'source $stdenv/setup; patchShebangs node_modules'], { cwd: dir })5454++5555++ // the DirFetcher will do its own preparation to run the prepare scripts5656++ // All we have to do is put the deps in place so that it can succeed.5757++ //5858++ // We ignore this.npmConfig to maintain an environment that's as close5959++ // to the rest of the build as possible.6060++ return spawn('bash', ['-c', '$prefetchNpmDeps --fixup-lockfile package-lock.json'], { cwd: dir })6161++ .then(() => npmWithNixFlags('ci --ignore-scripts', 'Install'))6262++ .then(patchShebangs)6363++ .then(() => npmWithNixFlags('rebuild', 'Rebuild'))6464++ .then(patchShebangs)6565++ }6666++6767+ // the DirFetcher will do its own preparation to run the prepare scripts6868+ // All we have to do is put the deps in place so that it can succeed.6969+ return npm(7070+diff --git a/deps/npm/node_modules/@npmcli/arborist/lib/arborist/build-ideal-tree.js b/deps/npm/node_modules/@npmcli/arborist/lib/arborist/build-ideal-tree.js7171+index 2ea66ac33..25e671318 1006447272+--- a/deps/npm/node_modules/@npmcli/arborist/lib/arborist/build-ideal-tree.js7373++++ b/deps/npm/node_modules/@npmcli/arborist/lib/arborist/build-ideal-tree.js7474+@@ -740,7 +740,7 @@ This is a one-time fix-up, please be patient...7575+ node.package = { ...mani, _id: `${mani.name}@${mani.version}` }7676+ } catch (er) {7777+ const warning = `Could not fetch metadata for ${name}@${id}`7878+- log.warn(heading, warning, er)7979++ if (!process.env['NIX_NODEJS_BUILDNPMPACKAGE']) { log.warn(heading, warning, er) }8080+ }8181+ this.finishTracker(t)8282+ })8383+diff --git a/deps/npm/node_modules/@npmcli/arborist/lib/arborist/load-actual.js b/deps/npm/node_modules/@npmcli/arborist/lib/arborist/load-actual.js8484+index 6c3f917c6..ec21d2cc4 1006448585+--- a/deps/npm/node_modules/@npmcli/arborist/lib/arborist/load-actual.js8686++++ b/deps/npm/node_modules/@npmcli/arborist/lib/arborist/load-actual.js8787+@@ -147,7 +147,7 @@ module.exports = cls => class ActualLoader extends cls {8888+ this[_actualTree].assertRootOverrides()8989+9090+ // if forceActual is set, don't even try the hidden lockfile9191+- if (!forceActual) {9292++ if (!forceActual && !process.env['NIX_NODEJS_BUILDNPMPACKAGE']) {9393+ // Note: hidden lockfile will be rejected if it's not the latest thing9494+ // in the folder, or if any of the entries in the hidden lockfile are9595+ // missing.
···11+{ buildGoModule22+, fetchFromGitHub33+, lib44+}:55+66+buildGoModule rec {77+ pname = "oauth2c";88+ version = "1.7.0";99+1010+ src = fetchFromGitHub {1111+ owner = "cloudentity";1212+ repo = pname;1313+ rev = "v${version}";1414+ hash = "sha256-IOfY0lKOeuArO3bI1JjTOXHhCqr3GTfsOHCOI0Qh4xk=";1515+ };1616+1717+ vendorHash = "sha256-euEmslrSbXPVDNZkIguq+ukt74Um4H0+lIXEyCBorjE=";1818+1919+ doCheck = false; # tests want to talk to oauth2c.us.authz.cloudentity.io2020+2121+ meta = with lib; {2222+ homepage = "https://github.com/cloudentity/oauth2c";2323+ description = "User-friendly OAuth2 CLI";2424+ longDescription = ''2525+ oauth2c is a command-line tool for interacting with OAuth 2.02626+ authorization servers. Its goal is to make it easy to fetch access tokens2727+ using any grant type or client authentication method. It is compliant with2828+ almost all basic and advanced OAuth 2.0, OIDC, OIDF FAPI and JWT profiles.2929+ '';3030+ license = licenses.asl20;3131+ maintainers = [ maintainers.flokli ];3232+ platforms = platforms.darwin ++ platforms.linux;3333+ };3434+}
+5-3
pkgs/tools/security/theharvester/default.nix
···5566python3.pkgs.buildPythonApplication rec {77 pname = "theharvester";88- version = "4.2.0";88+ version = "4.3.0";991010 src = fetchFromGitHub {1111 owner = "laramies";1212 repo = pname;1313- rev = version;1414- sha256 = "sha256-P3yp6COwyQnVDfZM198ygu+HLdisRw068aZOVSLl7r4=";1313+ rev = "refs/tags/${version}";1414+ hash = "sha256-9W4xN+ZSNdR5NOnwohNrQVW8JSEKFyKxWTz012uiUm8=";1515 };16161717 propagatedBuildInputs = with python3.pkgs; [···3030 orjson3131 plotly3232 pyppeteer3333+ python-dateutil3334 pyyaml3435 requests3536 retrying···6261 gathers emails, names, subdomains, IPs, and URLs using multiple public data sources.6362 '';6463 homepage = "https://github.com/laramies/theHarvester";6464+ changelog = "https://github.com/laramies/theHarvester/releases/tag/${version}";6565 maintainers = with maintainers; [ c0bw3b treemo ];6666 license = licenses.gpl2Only;6767 };
+1
pkgs/top-level/aliases.nix
···6565 aesop = throw "aesop has been removed from nixpkgs, as it was unmaintained"; # Added 2021-08-056666 ag = throw "'ag' has been renamed to/replaced by 'silver-searcher'"; # Converted to throw 2022-02-226767 aircrackng = throw "'aircrackng' has been renamed to/replaced by 'aircrack-ng'"; # Converted to throw 2022-02-226868+ airfield = throw "airfield has been removed due to being unmaintained"; # Added 2023-05-196869 airtame = throw "airtame has been removed due to being unmaintained"; # Added 2022-01-196970 aleth = throw "aleth (previously packaged as cpp_ethereum) has been removed; abandoned upstream"; # Added 2020-11-307071 alsaLib = alsa-lib; # Added 2021-06-09
···164164 mailman-hyperkitty = throw "Please use pkgs.mailmanPackages.mailman-hyperkitty"; # added 2022-04-29165165 mailman-web = throw "Please use pkgs.mailman-web"; # added 2022-04-29166166 manticore = throw "manticore has been removed because its dependency wasm no longer builds and is unmaintained"; # added 2023-05-20167167+ markerlib = throw "markerlib has been removed because it's abandoned since 2013"; # added 2023-05-19167168 mistune_0_8 = throw "mistune_0_8 was removed because it was outdated and insecure"; # added 2022-08-12168169 mistune_2_0 = mistune; # added 2022-08-12169170 mox = throw "mox was removed because it is unmaintained"; # added 2023-02-21
···1616 # Strip most of attributes when evaluating to spare memory usage1717, scrubJobs ? true1818 # Attributes passed to nixpkgs. Don't build packages marked as unfree.1919-, nixpkgsArgs ? { config = { allowUnfree = false; inHydra = true; }; }1919+, nixpkgsArgs ? { config = {2020+ allowUnfree = false;2121+ inHydra = true;2222+ permittedInsecurePackages = [2323+ # *Exceptionally*, those packages will be cached with their *secure* dependents2424+ # because they will reach EOL in the middle of the 23.05 release2525+ # and it will be too much painful for our users to recompile them2626+ # for no real reason.2727+ # Remove them for 23.11.2828+ "nodejs-16.20.0"2929+ "openssl-1.1.1t"3030+ ];3131+ }; }2032}:21332234with import ./release-lib.nix { inherit supportedSystems scrubJobs nixpkgsArgs; };