From 645052a47311e0e5b2a5daa608ca5237ec162055 Mon Sep 17 00:00:00 2001 From: Dan Callaghan Date: Sat, 8 Jun 2024 08:28:44 +1000 Subject: [PATCH 1/8] nixos/sssd: fix KCM to use new krb5 settings krb5.libdefaults moved to security.krb5.settings.libdefaults in PR #243169. (cherry picked from commit 375ef3c12778f0e04177c83c76cd803d2a1e4cc5) --- nixos/modules/services/misc/sssd.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nixos/modules/services/misc/sssd.nix b/nixos/modules/services/misc/sssd.nix index 4429b20174d9..f2798c1f30b4 100644 --- a/nixos/modules/services/misc/sssd.nix +++ b/nixos/modules/services/misc/sssd.nix @@ -145,7 +145,7 @@ in { # https://github.com/krb5/krb5/blob/krb5-1.19.3-final/src/include/kcm.h#L43 listenStreams = [ "/var/run/.heim_org.h5l.kcm-socket" ]; }; - krb5.libdefaults.default_ccache_name = "KCM:"; + security.krb5.settings.libdefaults.default_ccache_name = "KCM:"; }) (mkIf cfg.sshAuthorizedKeysIntegration { From 773aa2b0385d83decbd4c472bcb7d7ab16785ac3 Mon Sep 17 00:00:00 2001 From: D3vil0p3r Date: Mon, 16 Sep 2024 18:50:04 +0200 Subject: [PATCH 2/8] villain: 2.1.0 -> 2.2.0 (cherry picked from commit b29051b7f27b83ee507b48834a14f58cb0ab9e8d) --- pkgs/by-name/vi/villain/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/vi/villain/package.nix b/pkgs/by-name/vi/villain/package.nix index 35db4e3d3b7f..ab40f15b50ae 100644 --- a/pkgs/by-name/vi/villain/package.nix +++ b/pkgs/by-name/vi/villain/package.nix @@ -8,14 +8,14 @@ python3Packages.buildPythonApplication rec { pname = "villain"; - version = "2.1.0"; + version = "2.2.0"; pyproject = false; src = fetchFromGitHub { owner = "t3l3machus"; repo = "Villain"; rev = "v${version}"; - hash = "sha256-8MOpbyw4HEJMcv84bNkNLBSZfEmIm3RDSUi0s62t9ko="; + hash = "sha256-7qZ91WEzQg9k9V/FlREW4YLlEnloeVkisDO8q/+bheo="; }; nativeBuildInputs = [ makeWrapper ]; From e6fb8a4224ecf6e44c96bc8e6a3b010cb7de2536 Mon Sep 17 00:00:00 2001 From: Graham Christensen Date: Wed, 18 Sep 2024 23:18:28 -0400 Subject: [PATCH 3/8] amazon-ssm-agent: add the system's software to the path Follow up to #342584. Similarly to that PR, it is surprising that software which was installed by the user isn't available to a script run over ssm by default. When executing commands with ssm, users will now have more predictable access to baked-in software instead of an extremely bare-minimum set currently there. (cherry picked from commit 7547a1f5f862cc013fca1712dfbf300ed86c8161) --- nixos/modules/services/misc/amazon-ssm-agent.nix | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/nixos/modules/services/misc/amazon-ssm-agent.nix b/nixos/modules/services/misc/amazon-ssm-agent.nix index 9ab4a7f96d08..2d22df8e9328 100644 --- a/nixos/modules/services/misc/amazon-ssm-agent.nix +++ b/nixos/modules/services/misc/amazon-ssm-agent.nix @@ -45,7 +45,12 @@ in { after = [ "network-online.target" ]; wantedBy = [ "multi-user.target" ]; - path = [ fake-lsb-release pkgs.coreutils ]; + path = [ + fake-lsb-release + pkgs.coreutils + "/run/wrappers" + "/run/current-system/sw" + ]; serviceConfig = { ExecStart = "${cfg.package}/bin/amazon-ssm-agent"; From b1d27e13229408717e5c1d1511a7f0194d923bdf Mon Sep 17 00:00:00 2001 From: Graham Christensen Date: Tue, 17 Sep 2024 12:48:15 -0400 Subject: [PATCH 4/8] amazon-init: include the general system's software and wrappers in PATH It is surprising that software which was installed by the user at AMI generation time isn't available to a script run over user data by default. When authoring user data to execute at startup, users will now have more predictable access to baked-in software instead of an extremely bare-minimum set currently there. (cherry picked from commit 76b614be3994c6c1fa054d1b4cc8b3ad72d79c3e) --- nixos/modules/virtualisation/amazon-init.nix | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/nixos/modules/virtualisation/amazon-init.nix b/nixos/modules/virtualisation/amazon-init.nix index 612f6c5bc765..1a65686af37c 100644 --- a/nixos/modules/virtualisation/amazon-init.nix +++ b/nixos/modules/virtualisation/amazon-init.nix @@ -75,6 +75,11 @@ in { after = [ "multi-user.target" ]; requires = [ "network-online.target" ]; + path = [ + "/run/wrappers" + "/run/current-system/sw" + ]; + restartIfChanged = false; unitConfig.X-StopOnRemoval = false; From 4efa2759e539733681d96051a5997a9c159a4725 Mon Sep 17 00:00:00 2001 From: Sean Buckley Date: Thu, 19 Sep 2024 19:23:57 -0400 Subject: [PATCH 5/8] brave: 1.69.168 -> 1.70.117 https://community.brave.com/t/release-channel-1-70-117/569641 (cherry picked from commit c85d4998d19a1e4bfbe55330b1b2166c2f90475f) --- pkgs/applications/networking/browsers/brave/default.nix | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/pkgs/applications/networking/browsers/brave/default.nix b/pkgs/applications/networking/browsers/brave/default.nix index a78454196e39..1dddb46519fc 100644 --- a/pkgs/applications/networking/browsers/brave/default.nix +++ b/pkgs/applications/networking/browsers/brave/default.nix @@ -6,17 +6,17 @@ callPackage ./make-brave.nix (removeAttrs args [ "callPackage" ]) if stdenv.isAarch64 then rec { pname = "brave"; - version = "1.69.168"; + version = "1.70.117"; url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_arm64.deb"; - hash = "sha256-ZSFhbj/Tw+jOaFP2HHnn74DO2w4l37upS+rxLcF5P9I="; + hash = "sha256-FUomXWnIbuW8H0/r+fKEmMG8qO0vBAKUS9kijCbH5Mc="; platform = "aarch64-linux"; } else if stdenv.isx86_64 then rec { pname = "brave"; - version = "1.69.168"; + version = "1.70.117"; url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_amd64.deb"; - hash = "sha256-smLyA4eZAw62BfbPPFKjKaZd8FJ1FMSV1SUWXCFCzD4="; + hash = "sha256-54puHFpg3zqgORoqale9ZNgokn7q8fbI+240azFqrlQ="; platform = "x86_64-linux"; } else From a280bb1899be8353bf5a92054471b51a6c05d13b Mon Sep 17 00:00:00 2001 From: DontEatOreo <57304299+DontEatOreo@users.noreply.github.com> Date: Mon, 23 Sep 2024 16:40:06 +0300 Subject: [PATCH 6/8] koboldcpp: 1.74 -> 1.75.2 Changelog: https://github.com/LostRuins/koboldcpp/releases/tag/v1.75.2 Diff: https://github.com/LostRuins/koboldcpp/compare/v1.74...v1.75.2 (cherry picked from commit 6539d1b561284a7c83315476b14ef1e893c66b19) --- pkgs/by-name/ko/koboldcpp/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/ko/koboldcpp/package.nix b/pkgs/by-name/ko/koboldcpp/package.nix index 6b4a942fd484..85053dc716ce 100644 --- a/pkgs/by-name/ko/koboldcpp/package.nix +++ b/pkgs/by-name/ko/koboldcpp/package.nix @@ -53,13 +53,13 @@ let in effectiveStdenv.mkDerivation (finalAttrs: { pname = "koboldcpp"; - version = "1.74"; + version = "1.75.2"; src = fetchFromGitHub { owner = "LostRuins"; repo = "koboldcpp"; rev = "refs/tags/v${finalAttrs.version}"; - hash = "sha256-tGG1+EGlCUmFpx/axijonOXydurwFxqjuoeDwHxC+pc="; + hash = "sha256-olMlYzde97RSx0OmDULSOFlM3imUq3AVxQdXyYBPd3Q="; }; enableParallelBuilding = true; From 3d3fe6e656e92b74da7cf74f80f8845a7032f622 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Tue, 24 Sep 2024 09:14:05 +0200 Subject: [PATCH 7/8] [Backport release-24.05] rustdesk-flutter: add missing libayatana-appindicator patch (#343894) rustdesk-flutter: add missing libayatana-appindicator patch (#343742) * rustdesk-flutter: nixfmt * rustdesk-flutter: add missing libayatana-appindicator patch (cherry picked from commit a0a0b4d63bdc89990c7009dc6b0beb5ee36efe6b) Co-authored-by: Bot_wxt1221 <3264117476@qq.com> --- pkgs/by-name/ru/rustdesk-flutter/package.nix | 131 +++++++++++-------- 1 file changed, 74 insertions(+), 57 deletions(-) diff --git a/pkgs/by-name/ru/rustdesk-flutter/package.nix b/pkgs/by-name/ru/rustdesk-flutter/package.nix index aa403cc04b9e..18e2234a355a 100644 --- a/pkgs/by-name/ru/rustdesk-flutter/package.nix +++ b/pkgs/by-name/ru/rustdesk-flutter/package.nix @@ -1,28 +1,31 @@ -{ lib -, clangStdenv -, cargo -, copyDesktopItems -, fetchFromGitHub -, flutter316 -, ffmpeg -, gst_all_1 -, fuse3 -, libXtst -, libaom -, libopus -, libpulseaudio -, libva -, libvdpau -, libvpx -, libxkbcommon -, libyuv -, pam -, makeDesktopItem -, rustPlatform -, rustc -, rustfmt -, xdotool -}: let +{ + lib, + clangStdenv, + cargo, + copyDesktopItems, + fetchFromGitHub, + flutter316, + ffmpeg, + gst_all_1, + fuse3, + libXtst, + libaom, + libopus, + libpulseaudio, + libva, + libvdpau, + libvpx, + libxkbcommon, + libyuv, + pam, + makeDesktopItem, + rustPlatform, + libayatana-appindicator, + rustc, + rustfmt, + xdotool, +}: +let flutterRustBridge = rustPlatform.buildRustPackage rec { pname = "flutter_rust_bridge_codegen"; @@ -36,13 +39,17 @@ }; cargoHash = "sha256-dDyiptG9TKes+fXx2atwx697SWH7Rltx6xVubtTn7FM="; - cargoBuildFlags = [ "--package" "flutter_rust_bridge_codegen" ]; + cargoBuildFlags = [ + "--package" + "flutter_rust_bridge_codegen" + ]; doCheck = false; }; sharedLibraryExt = rustc.stdenv.hostPlatform.extensions.sharedLibrary; -in flutter316.buildFlutterApplication rec { +in +flutter316.buildFlutterApplication rec { pname = "rustdesk"; version = "1.3.0"; src = fetchFromGitHub { @@ -76,34 +83,34 @@ in flutter316.buildFlutterApplication rec { # and fixing the resulting errors by removing the other registry deps. lockFile = ./Cargo.lock; outputHashes = { - "android-wakelock-0.1.0" = "sha256-09EH/U1BBs3l4galQOrTKmPUYBgryUjfc/rqPZhdYc4="; - "arboard-3.4.0" = "sha256-lZIG5z115ExR6DcUut1rk9MrYFzSyCYH9kNGIikOPJM="; - "cacao-0.4.0-beta2" = "sha256-U5tCLeVxjmZCm7ti1u71+i116xmozPaR69pCsA4pxrM="; - "clipboard-master-4.0.0-beta.6" = "sha256-GZyzGMQOZ0iwGNZa/ZzFp8gU2tQVWZBpAbim8yb6yZA="; - "confy-0.4.0-2" = "sha256-V7BCKISrkJIxWC3WT5+B5Vav86YTQvdO9TO6A++47FU="; - "core-foundation-0.9.3" = "sha256-iB4OVmWZhuWbs9RFWvNc+RNut6rip2/50o5ZM6c0c3g="; - "evdev-0.11.5" = "sha256-aoPmjGi/PftnH6ClEWXHvIj0X3oh15ZC1q7wPC1XPr0="; - "hwcodec-0.7.0" = "sha256-pfzcaD7h/U5ou+P7qRLR56iXOkm043rF74y+Q0FsVLo="; - "impersonate_system-0.1.0" = "sha256-pIV7s2qGoCIUrhaRovBDCJaGQ/pMdJacDXJmeBpkcyI="; - "keepawake-0.4.3" = "sha256-cqSpkq/PCz+5+ZUyPy5hF6rP3fBzuZDywyxMUQ50Rk4="; - "machine-uid-0.3.0" = "sha256-rEOyNThg6p5oqE9URnxSkPtzyW8D4zKzLi9pAnzTElE="; - "magnum-opus-0.4.0" = "sha256-T4qaYOl8lCK1h9jWa9KqGvnVfDViT9Ob5R+YgnSw2tg="; - "pam-0.7.0" = "sha256-o47tVoFlW9RiL7O8Lvuwz7rMYQHO+5TG27XxkAdHEOE="; - "pam-sys-1.0.0-alpha4" = "sha256-5HIErVWnanLo5054NgU+DEKC2wwyiJ8AHvbx0BGbyWo="; - "parity-tokio-ipc-0.7.3-4" = "sha256-PKw2Twd2ap+tRrQxqg8T1FvpoeKn0hvBqn1Z44F1LcY="; - "rdev-0.5.0-2" = "sha256-KrzNa4sKyuVw3EV/Ec9VBNRyJy7QFR2Gu4c2WkltwUw="; - "reqwest-0.11.23" = "sha256-kEUT+gs4ziknDiGdPMLnj5pmxC5SBpLopZ8jZ34GDWc="; - "rust-pulsectl-0.2.12" = "sha256-8jXTspWvjONFcvw9/Z8C43g4BuGZ3rsG32tvLMQbtbM="; - "sciter-rs-0.5.57" = "sha256-5Nd9npdx8yQJEczHv7WmSmrE1lBfvp5z7BubTbYBg3E="; - "sysinfo-0.29.10" = "sha256-/UsFAvlWs/F7X1xT+97Fx+pnpCguoPHU3hTynqYMEs4="; - "tao-0.25.0" = "sha256-kLmx1z9Ybn/hDt2OcszEjtZytQIE+NKTIn9zNr9oEQk="; - "tfc-0.7.0" = "sha256-4plK8ttbHsBPat3/rS+4RhGzirq2Ked2wrU8cQEU1zo="; - "tokio-socks-0.5.2-1" = "sha256-i1dfNatqN4dinMcyAdLhj9hJWVsT10OWpCXsxl7pifI="; - "tray-icon-0.14.3" = "sha256-dSX7LucZaLplRrh6zLwmFzyZN4ZtwIXzAEdZzlu3gQg="; - "wallpaper-3.2.0" = "sha256-p9NRmusdA0wvF6onp1UTL0/4t7XnEAc19sqyGDnfg/Q="; - "webm-1.1.0" = "sha256-p4BMej7yvb8c/dJynRWZmwo2hxAAY96Qx6Qx2DbT8hE="; - "x11-2.19.0" = "sha256-GDCeKzUtvaLeBDmPQdyr499EjEfT6y4diBMzZVEptzc="; - "x11-clipboard-0.8.1" = "sha256-PtqmSD2MwkbLVWbfTSXZW3WEvEnUlo04qieUTjN2whE="; + "android-wakelock-0.1.0" = "sha256-09EH/U1BBs3l4galQOrTKmPUYBgryUjfc/rqPZhdYc4="; + "arboard-3.4.0" = "sha256-lZIG5z115ExR6DcUut1rk9MrYFzSyCYH9kNGIikOPJM="; + "cacao-0.4.0-beta2" = "sha256-U5tCLeVxjmZCm7ti1u71+i116xmozPaR69pCsA4pxrM="; + "clipboard-master-4.0.0-beta.6" = "sha256-GZyzGMQOZ0iwGNZa/ZzFp8gU2tQVWZBpAbim8yb6yZA="; + "confy-0.4.0-2" = "sha256-V7BCKISrkJIxWC3WT5+B5Vav86YTQvdO9TO6A++47FU="; + "core-foundation-0.9.3" = "sha256-iB4OVmWZhuWbs9RFWvNc+RNut6rip2/50o5ZM6c0c3g="; + "evdev-0.11.5" = "sha256-aoPmjGi/PftnH6ClEWXHvIj0X3oh15ZC1q7wPC1XPr0="; + "hwcodec-0.7.0" = "sha256-pfzcaD7h/U5ou+P7qRLR56iXOkm043rF74y+Q0FsVLo="; + "impersonate_system-0.1.0" = "sha256-pIV7s2qGoCIUrhaRovBDCJaGQ/pMdJacDXJmeBpkcyI="; + "keepawake-0.4.3" = "sha256-cqSpkq/PCz+5+ZUyPy5hF6rP3fBzuZDywyxMUQ50Rk4="; + "machine-uid-0.3.0" = "sha256-rEOyNThg6p5oqE9URnxSkPtzyW8D4zKzLi9pAnzTElE="; + "magnum-opus-0.4.0" = "sha256-T4qaYOl8lCK1h9jWa9KqGvnVfDViT9Ob5R+YgnSw2tg="; + "pam-0.7.0" = "sha256-o47tVoFlW9RiL7O8Lvuwz7rMYQHO+5TG27XxkAdHEOE="; + "pam-sys-1.0.0-alpha4" = "sha256-5HIErVWnanLo5054NgU+DEKC2wwyiJ8AHvbx0BGbyWo="; + "parity-tokio-ipc-0.7.3-4" = "sha256-PKw2Twd2ap+tRrQxqg8T1FvpoeKn0hvBqn1Z44F1LcY="; + "rdev-0.5.0-2" = "sha256-KrzNa4sKyuVw3EV/Ec9VBNRyJy7QFR2Gu4c2WkltwUw="; + "reqwest-0.11.23" = "sha256-kEUT+gs4ziknDiGdPMLnj5pmxC5SBpLopZ8jZ34GDWc="; + "rust-pulsectl-0.2.12" = "sha256-8jXTspWvjONFcvw9/Z8C43g4BuGZ3rsG32tvLMQbtbM="; + "sciter-rs-0.5.57" = "sha256-5Nd9npdx8yQJEczHv7WmSmrE1lBfvp5z7BubTbYBg3E="; + "sysinfo-0.29.10" = "sha256-/UsFAvlWs/F7X1xT+97Fx+pnpCguoPHU3hTynqYMEs4="; + "tao-0.25.0" = "sha256-kLmx1z9Ybn/hDt2OcszEjtZytQIE+NKTIn9zNr9oEQk="; + "tfc-0.7.0" = "sha256-4plK8ttbHsBPat3/rS+4RhGzirq2Ked2wrU8cQEU1zo="; + "tokio-socks-0.5.2-1" = "sha256-i1dfNatqN4dinMcyAdLhj9hJWVsT10OWpCXsxl7pifI="; + "tray-icon-0.14.3" = "sha256-dSX7LucZaLplRrh6zLwmFzyZN4ZtwIXzAEdZzlu3gQg="; + "wallpaper-3.2.0" = "sha256-p9NRmusdA0wvF6onp1UTL0/4t7XnEAc19sqyGDnfg/Q="; + "webm-1.1.0" = "sha256-p4BMej7yvb8c/dJynRWZmwo2hxAAY96Qx6Qx2DbT8hE="; + "x11-2.19.0" = "sha256-GDCeKzUtvaLeBDmPQdyr499EjEfT6y4diBMzZVEptzc="; + "x11-clipboard-0.8.1" = "sha256-PtqmSD2MwkbLVWbfTSXZW3WEvEnUlo04qieUTjN2whE="; }; }; dontCargoBuild = true; @@ -147,11 +154,17 @@ in flutter316.buildFlutterApplication rec { prePatch = '' chmod -R +w .. ''; - patchFlags = [ "-p1" "-d" ".." ]; + patchFlags = [ + "-p1" + "-d" + ".." + ]; patches = [ ./make-build-reproducible.patch ]; postPatch = '' + substituteInPlace $cargoDepsCopy/libappindicator-sys-*/src/lib.rs \ + --replace-fail "libayatana-appindicator3.so.1" "${lib.getLib libayatana-appindicator}/lib/libayatana-appindicator3.so.1" substituteInPlace ../Cargo.toml --replace-fail ", \"staticlib\", \"rlib\"" "" # The supplied Cargo.lock doesn't work with our fetcher so copy over the fixed version cp ${./Cargo.lock} ../Cargo.lock @@ -201,7 +214,11 @@ in flutter316.buildFlutterApplication rec { terminal = false; type = "Application"; startupNotify = true; - categories = [ "Network" "RemoteAccess" "GTK" ]; + categories = [ + "Network" + "RemoteAccess" + "GTK" + ]; keywords = [ "internet" ]; actions.new-window = { name = "Open a New Window"; From 4fa7aadebd47967516c0489364f32900a536478a Mon Sep 17 00:00:00 2001 From: Thomas Gerbet Date: Mon, 23 Sep 2024 18:27:02 +0200 Subject: [PATCH 8/8] fetchurl: enable TLS verification when credentials are used This make sure the credentials cannot be leaked in a MITM attack. Note that this change might break some existing deployments if the users tries to fetch resources on endpoints with invalid certificates. The impacted users will have the following choices: * fix the endpoint providing the resource * override SSL_CERT_FILE to either disable the verification (not recommended) or to set it to a path including their CA certificate. (cherry picked from commit a169553f7e3b61b7390106d658dbc718e98ac1a1) --- pkgs/build-support/fetchurl/default.nix | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/pkgs/build-support/fetchurl/default.nix b/pkgs/build-support/fetchurl/default.nix index a9c2c7c46d14..2901501afaab 100644 --- a/pkgs/build-support/fetchurl/default.nix +++ b/pkgs/build-support/fetchurl/default.nix @@ -164,7 +164,8 @@ stdenvNoCC.mkDerivation (( # New-style output content requirements. inherit (hash_) outputHashAlgo outputHash; - SSL_CERT_FILE = if (hash_.outputHash == "" || hash_.outputHash == lib.fakeSha256 || hash_.outputHash == lib.fakeSha512 || hash_.outputHash == lib.fakeHash) + # Disable TLS verification only when we know the hash and no credentials are needed to access the ressource + SSL_CERT_FILE = if (hash_.outputHash == "" || hash_.outputHash == lib.fakeSha256 || hash_.outputHash == lib.fakeSha512 || hash_.outputHash == lib.fakeHash || netrcPhase != null) then "${cacert}/etc/ssl/certs/ca-bundle.crt" else "/no-cert-file.crt";