From 3041889bc6b90ae18f44f99bd6ad5f70f05fb13c Mon Sep 17 00:00:00 2001 From: Sergey Lukjanov Date: Tue, 25 Feb 2020 14:55:48 -0800 Subject: [PATCH 1/9] go_1_14: init at 1.14 and switch to it (cherry picked from commit 8c4a92887fc4c827d6f2fec9c146f5a947cfec7e) --- pkgs/development/compilers/go/1.14.nix | 245 ++++++++++++++++++ .../compilers/go/remove-test-pie-1.14.patch | 34 +++ .../skip-test-extra-files-on-386-1.14.patch | 15 ++ ...kip-test-extra-files-on-aarch32-1.14.patch | 15 ++ pkgs/top-level/all-packages.nix | 20 +- 5 files changed, 325 insertions(+), 4 deletions(-) create mode 100644 pkgs/development/compilers/go/1.14.nix create mode 100644 pkgs/development/compilers/go/remove-test-pie-1.14.patch create mode 100644 pkgs/development/compilers/go/skip-test-extra-files-on-386-1.14.patch create mode 100644 pkgs/development/compilers/go/skip-test-extra-files-on-aarch32-1.14.patch diff --git a/pkgs/development/compilers/go/1.14.nix b/pkgs/development/compilers/go/1.14.nix new file mode 100644 index 000000000000..3651b9361166 --- /dev/null +++ b/pkgs/development/compilers/go/1.14.nix @@ -0,0 +1,245 @@ +{ stdenv, fetchurl, tzdata, iana-etc, runCommand +, perl, which, pkgconfig, patch, procps, pcre, cacert, Security, Foundation +, mailcap, runtimeShell +, buildPackages, pkgsTargetTarget +}: + +let + + inherit (stdenv.lib) optionals optionalString; + + goBootstrap = runCommand "go-bootstrap" {} '' + mkdir $out + cp -rf ${buildPackages.go_bootstrap}/* $out/ + chmod -R u+w $out + find $out -name "*.c" -delete + cp -rf $out/bin/* $out/share/go/bin/ + ''; + + goarch = platform: { + "i686" = "386"; + "x86_64" = "amd64"; + "aarch64" = "arm64"; + "arm" = "arm"; + "armv5tel" = "arm"; + "armv6l" = "arm"; + "armv7l" = "arm"; + }.${platform.parsed.cpu.name} or (throw "Unsupported system"); + +in + +stdenv.mkDerivation rec { + pname = "go"; + version = "1.14"; + + src = fetchurl { + url = "https://dl.google.com/go/go${version}.src.tar.gz"; + sha256 = "12a3nzj4k4p5ica447sjfva9pvvj84a03b4xlg3mhl2nmm33wr3d"; + }; + + # perl is used for testing go vet + nativeBuildInputs = [ perl which pkgconfig patch procps ]; + buildInputs = [ cacert pcre ] + ++ optionals stdenv.isLinux [ stdenv.cc.libc.out ] + ++ optionals (stdenv.hostPlatform.libc == "glibc") [ stdenv.cc.libc.static ]; + + + propagatedBuildInputs = optionals stdenv.isDarwin [ Security Foundation ]; + + hardeningDisable = [ "all" ]; + + prePatch = '' + patchShebangs ./ # replace /bin/bash + + # This source produces shell script at run time, + # and thus it is not corrected by patchShebangs. + substituteInPlace misc/cgo/testcarchive/carchive_test.go \ + --replace '#!/usr/bin/env bash' '#!${runtimeShell}' + + # Patch the mimetype database location which is missing on NixOS. + # but also allow static binaries built with NixOS to run outside nix + sed -i 's,\"/etc/mime.types,"${mailcap}/etc/mime.types\"\,\n\t&,' src/mime/type_unix.go + + # Disabling the 'os/http/net' tests (they want files not available in + # chroot builds) + rm src/net/{listen,parse}_test.go + rm src/syscall/exec_linux_test.go + + # !!! substituteInPlace does not seems to be effective. + # The os test wants to read files in an existing path. Just don't let it be /usr/bin. + sed -i 's,/usr/bin,'"`pwd`", src/os/os_test.go + sed -i 's,/bin/pwd,'"`type -P pwd`", src/os/os_test.go + # Disable the unix socket test + sed -i '/TestShutdownUnix/aif true \{ return\; \}' src/net/net_test.go + # Disable the hostname test + sed -i '/TestHostname/aif true \{ return\; \}' src/os/os_test.go + # ParseInLocation fails the test + sed -i '/TestParseInSydney/aif true \{ return\; \}' src/time/format_test.go + # Remove the api check as it never worked + sed -i '/src\/cmd\/api\/run.go/ireturn nil' src/cmd/dist/test.go + # Remove the coverage test as we have removed this utility + sed -i '/TestCoverageWithCgo/aif true \{ return\; \}' src/cmd/go/go_test.go + # Remove the timezone naming test + sed -i '/TestLoadFixed/aif true \{ return\; \}' src/time/time_test.go + # Remove disable setgid test + sed -i '/TestRespectSetgidDir/aif true \{ return\; \}' src/cmd/go/internal/work/build_test.go + # Remove cert tests that conflict with NixOS's cert resolution + sed -i '/TestEnvVars/aif true \{ return\; \}' src/crypto/x509/root_unix_test.go + # TestWritevError hangs sometimes + sed -i '/TestWritevError/aif true \{ return\; \}' src/net/writev_test.go + # TestVariousDeadlines fails sometimes + sed -i '/TestVariousDeadlines/aif true \{ return\; \}' src/net/timeout_test.go + + sed -i 's,/etc/protocols,${iana-etc}/etc/protocols,' src/net/lookup_unix.go + sed -i 's,/etc/services,${iana-etc}/etc/services,' src/net/port_unix.go + + # Disable cgo lookup tests not works, they depend on resolver + rm src/net/cgo_unix_test.go + + '' + optionalString stdenv.isLinux '' + # prepend the nix path to the zoneinfo files but also leave the original value for static binaries + # that run outside a nix server + sed -i 's,\"/usr/share/zoneinfo/,"${tzdata}/share/zoneinfo/\"\,\n\t&,' src/time/zoneinfo_unix.go + + '' + optionalString stdenv.isAarch32 '' + echo '#!${runtimeShell}' > misc/cgo/testplugin/test.bash + '' + optionalString stdenv.isDarwin '' + substituteInPlace src/race.bash --replace \ + "sysctl machdep.cpu.extfeatures | grep -qv EM64T" true + sed -i 's,strings.Contains(.*sysctl.*,true {,' src/cmd/dist/util.go + sed -i 's,"/etc","'"$TMPDIR"'",' src/os/os_test.go + sed -i 's,/_go_os_test,'"$TMPDIR"'/_go_os_test,' src/os/path_test.go + + sed -i '/TestChdirAndGetwd/aif true \{ return\; \}' src/os/os_test.go + sed -i '/TestCredentialNoSetGroups/aif true \{ return\; \}' src/os/exec/exec_posix_test.go + sed -i '/TestRead0/aif true \{ return\; \}' src/os/os_test.go + sed -i '/TestSystemRoots/aif true \{ return\; \}' src/crypto/x509/root_darwin_test.go + + sed -i '/TestGoInstallRebuildsStalePackagesInOtherGOPATH/aif true \{ return\; \}' src/cmd/go/go_test.go + sed -i '/TestBuildDashIInstallsDependencies/aif true \{ return\; \}' src/cmd/go/go_test.go + + sed -i '/TestDisasmExtld/aif true \{ return\; \}' src/cmd/objdump/objdump_test.go + + sed -i 's/unrecognized/unknown/' src/cmd/link/internal/ld/lib.go + + # TestCurrent fails because Current is not implemented on Darwin + sed -i 's/TestCurrent/testCurrent/g' src/os/user/user_test.go + sed -i 's/TestLookup/testLookup/g' src/os/user/user_test.go + + touch $TMPDIR/group $TMPDIR/hosts $TMPDIR/passwd + ''; + + patches = [ + ./remove-tools-1.11.patch + ./ssl-cert-file-1.13.patch + ./remove-test-pie-1.14.patch + ./creds-test.patch + ./go-1.9-skip-flaky-19608.patch + ./go-1.9-skip-flaky-20072.patch + ./skip-external-network-tests.patch + ./skip-nohup-tests.patch + ] ++ [ + # breaks under load: https://github.com/golang/go/issues/25628 + (if stdenv.isAarch32 + then ./skip-test-extra-files-on-aarch32-1.14.patch + else ./skip-test-extra-files-on-386-1.14.patch) + ]; + + postPatch = '' + find . -name '*.orig' -exec rm {} ';' + ''; + + GOOS = stdenv.targetPlatform.parsed.kernel.name; + GOARCH = goarch stdenv.targetPlatform; + # GOHOSTOS/GOHOSTARCH must match the building system, not the host system. + # Go will nevertheless build a for host system that we will copy over in + # the install phase. + GOHOSTOS = stdenv.buildPlatform.parsed.kernel.name; + GOHOSTARCH = goarch stdenv.buildPlatform; + + # {CC,CXX}_FOR_TARGET must be only set for cross compilation case as go expect those + # to be different from CC/CXX + CC_FOR_TARGET = if (stdenv.buildPlatform != stdenv.targetPlatform) then + "${pkgsTargetTarget.stdenv.cc}/bin/${pkgsTargetTarget.stdenv.cc.targetPrefix}cc" + else + null; + CXX_FOR_TARGET = if (stdenv.buildPlatform != stdenv.targetPlatform) then + "${pkgsTargetTarget.stdenv.cc}/bin/${pkgsTargetTarget.stdenv.cc.targetPrefix}c++" + else + null; + + GOARM = toString (stdenv.lib.intersectLists [(stdenv.hostPlatform.parsed.cpu.version or "")] ["5" "6" "7"]); + GO386 = 387; # from Arch: don't assume sse2 on i686 + CGO_ENABLED = 1; + # Hopefully avoids test timeouts on Hydra + GO_TEST_TIMEOUT_SCALE = 3; + + # Indicate that we are running on build infrastructure + # Some tests assume things like home directories and users exists + GO_BUILDER_NAME = "nix"; + + GOROOT_BOOTSTRAP="${goBootstrap}/share/go"; + + postConfigure = '' + export GOCACHE=$TMPDIR/go-cache + # this is compiled into the binary + export GOROOT_FINAL=$out/share/go + + export PATH=$(pwd)/bin:$PATH + + # Independent from host/target, CC should produce code for the building system. + export CC=${buildPackages.stdenv.cc}/bin/cc + ulimit -a + ''; + + postBuild = '' + (cd src && ./make.bash) + ''; + + doCheck = stdenv.hostPlatform == stdenv.targetPlatform && !stdenv.isDarwin; + + checkPhase = '' + runHook preCheck + (cd src && HOME=$TMPDIR GOCACHE=$TMPDIR/go-cache ./run.bash --no-rebuild) + runHook postCheck + ''; + + preInstall = '' + rm -r pkg/obj + # Contains the wrong perl shebang when cross compiling, + # since it is not used for anything we can deleted as well. + rm src/regexp/syntax/make_perl_groups.pl + '' + (if (stdenv.buildPlatform != stdenv.hostPlatform) then '' + mv bin/*_*/* bin + rmdir bin/*_* + ${optionalString (!(GOHOSTARCH == GOARCH && GOOS == GOHOSTOS)) '' + rm -rf pkg/${GOHOSTOS}_${GOHOSTARCH} pkg/tool/${GOHOSTOS}_${GOHOSTARCH} + ''} + '' else if (stdenv.hostPlatform != stdenv.targetPlatform) then '' + rm -rf bin/*_* + ${optionalString (!(GOHOSTARCH == GOARCH && GOOS == GOHOSTOS)) '' + rm -rf pkg/${GOOS}_${GOARCH} pkg/tool/${GOOS}_${GOARCH} + ''} + '' else ""); + + installPhase = '' + runHook preInstall + mkdir -p $GOROOT_FINAL + cp -a bin pkg src lib misc api doc $GOROOT_FINAL + ln -s $GOROOT_FINAL/bin $out/bin + runHook postInstall + ''; + + setupHook = ./setup-hook.sh; + + disallowedReferences = [ goBootstrap ]; + + meta = with stdenv.lib; { + branch = "1.14"; + homepage = http://golang.org/; + description = "The Go Programming language"; + license = licenses.bsd3; + maintainers = with maintainers; [ cstrahan orivej mic92 rvolosatovs kalbasit Frostman ]; + platforms = platforms.linux ++ platforms.darwin; + }; +} diff --git a/pkgs/development/compilers/go/remove-test-pie-1.14.patch b/pkgs/development/compilers/go/remove-test-pie-1.14.patch new file mode 100644 index 000000000000..218fcd46d892 --- /dev/null +++ b/pkgs/development/compilers/go/remove-test-pie-1.14.patch @@ -0,0 +1,34 @@ +diff --git a/src/cmd/dist/test.go b/src/cmd/dist/test.go +index 56bdfcac19..d7d67ab94d 100644 +--- a/src/cmd/dist/test.go ++++ b/src/cmd/dist/test.go +@@ -580,29 +580,6 @@ func (t *tester) registerTests() { + }) + } + +- // Test internal linking of PIE binaries where it is supported. +- if goos == "linux" && (goarch == "amd64" || goarch == "arm64") { +- t.tests = append(t.tests, distTest{ +- name: "pie_internal", +- heading: "internal linking of -buildmode=pie", +- fn: func(dt *distTest) error { +- t.addCmd(dt, "src", t.goTest(), "reflect", "-buildmode=pie", "-ldflags=-linkmode=internal", t.timeout(60)) +- return nil +- }, +- }) +- // Also test a cgo package. +- if t.cgoEnabled && t.internalLink() { +- t.tests = append(t.tests, distTest{ +- name: "pie_internal_cgo", +- heading: "internal linking of -buildmode=pie", +- fn: func(dt *distTest) error { +- t.addCmd(dt, "src", t.goTest(), "os/user", "-buildmode=pie", "-ldflags=-linkmode=internal", t.timeout(60)) +- return nil +- }, +- }) +- } +- } +- + // sync tests + if goos != "js" { // js doesn't support -cpu=10 + t.tests = append(t.tests, distTest{ diff --git a/pkgs/development/compilers/go/skip-test-extra-files-on-386-1.14.patch b/pkgs/development/compilers/go/skip-test-extra-files-on-386-1.14.patch new file mode 100644 index 000000000000..ab681826499a --- /dev/null +++ b/pkgs/development/compilers/go/skip-test-extra-files-on-386-1.14.patch @@ -0,0 +1,15 @@ +diff --git a/src/os/exec/exec_test.go b/src/os/exec/exec_test.go +index dce66c5c2e..2532224376 100644 +--- a/src/os/exec/exec_test.go ++++ b/src/os/exec/exec_test.go +@@ -627,6 +627,10 @@ func TestExtraFiles(t *testing.T) { + t.Skipf("skipping test on %q", runtime.GOOS) + } + ++ if runtime.GOOS == "linux" && runtime.GOARCH == "386" { ++ t.Skipf("skipping test on %q %q", runtime.GOARCH, runtime.GOOS) ++ } ++ + // Force network usage, to verify the epoll (or whatever) fd + // doesn't leak to the child, + ln, err := net.Listen("tcp", "127.0.0.1:0") diff --git a/pkgs/development/compilers/go/skip-test-extra-files-on-aarch32-1.14.patch b/pkgs/development/compilers/go/skip-test-extra-files-on-aarch32-1.14.patch new file mode 100644 index 000000000000..5251882fce83 --- /dev/null +++ b/pkgs/development/compilers/go/skip-test-extra-files-on-aarch32-1.14.patch @@ -0,0 +1,15 @@ +diff --git a/src/os/exec/exec_test.go b/src/os/exec/exec_test.go +index dce66c5c2e..2532224376 100644 +--- a/src/os/exec/exec_test.go ++++ b/src/os/exec/exec_test.go +@@ -627,6 +627,10 @@ func TestExtraFiles(t *testing.T) { + t.Skipf("skipping test on %q", runtime.GOOS) + } + ++ if runtime.GOOS == "linux" && runtime.GOARCH == "arm" { ++ t.Skipf("skipping test on %q %q", runtime.GOARCH, runtime.GOOS) ++ } ++ + // Force network usage, to verify the epoll (or whatever) fd + // doesn't leak to the child, + ln, err := net.Listen("tcp", "127.0.0.1:0") diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index d8d7e3397573..5847540cf965 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -8344,7 +8344,14 @@ in buildPackages = buildPackages // { stdenv = gcc8Stdenv; }; }); - go = go_1_13; + go_1_14 = callPackage ../development/compilers/go/1.14.nix ({ + inherit (darwin.apple_sdk.frameworks) Security Foundation; + } // lib.optionalAttrs stdenv.isAarch64 { + stdenv = gcc8Stdenv; + buildPackages = buildPackages // { stdenv = gcc8Stdenv; }; + }); + + go = go_1_14; go-repo-root = callPackage ../development/tools/go-repo-root { }; @@ -14928,18 +14935,23 @@ in buildGo113Package = callPackage ../development/go-packages/generic { go = buildPackages.go_1_13; }; + buildGo114Package = callPackage ../development/go-packages/generic { + go = buildPackages.go_1_14; + }; - buildGoPackage = buildGo113Package; + buildGoPackage = buildGo114Package; buildGo112Module = callPackage ../development/go-modules/generic { go = buildPackages.go_1_12; }; - buildGo113Module = callPackage ../development/go-modules/generic { go = buildPackages.go_1_13; }; + buildGo114Module = callPackage ../development/go-modules/generic { + go = buildPackages.go_1_14; + }; - buildGoModule = buildGo113Module; + buildGoModule = buildGo114Module; go2nix = callPackage ../development/tools/go2nix { }; From e378b239f6c94d0e1e49f1f9bf2646b347a205d4 Mon Sep 17 00:00:00 2001 From: Sergey Lukjanov Date: Tue, 25 Feb 2020 16:12:56 -0800 Subject: [PATCH 2/9] grafana: switch to latest go (cherry picked from commit c29045c0908e4512d08a0510deb52a1df7ee0bbc) --- pkgs/top-level/all-packages.nix | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index 5847540cf965..b40b56a8c7cf 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -15260,9 +15260,7 @@ in gofish = callPackage ../servers/gopher/gofish { }; - grafana = callPackage ../servers/monitoring/grafana { - buildGoPackage = buildGo113Package; - }; + grafana = callPackage ../servers/monitoring/grafana { }; grafana-loki = callPackage ../servers/monitoring/loki { }; From e8e569ce79897885fe9f59dd164413f9b7298c4c Mon Sep 17 00:00:00 2001 From: worldofpeace Date: Sun, 1 Mar 2020 18:14:36 -0500 Subject: [PATCH 3/9] wrapGAppsHook: Fix #78803 Add to gappsWrapperArgs in preFixupPhases. (cherry picked from commit 29fc27b4ac358b5325ad356f90da54adf941e663) --- .../setup-hooks/wrap-gapps-hook.sh | 127 +++++++++--------- 1 file changed, 66 insertions(+), 61 deletions(-) diff --git a/pkgs/build-support/setup-hooks/wrap-gapps-hook.sh b/pkgs/build-support/setup-hooks/wrap-gapps-hook.sh index ff0cda7eaf0d..1a46e075dbe7 100644 --- a/pkgs/build-support/setup-hooks/wrap-gapps-hook.sh +++ b/pkgs/build-support/setup-hooks/wrap-gapps-hook.sh @@ -9,6 +9,37 @@ find_gio_modules() { addEnvHooks "${targetOffset:?}" find_gio_modules +gappsWrapperArgsHook() { + if [ -n "$GDK_PIXBUF_MODULE_FILE" ]; then + gappsWrapperArgs+=(--set GDK_PIXBUF_MODULE_FILE "$GDK_PIXBUF_MODULE_FILE") + fi + + if [ -n "$XDG_ICON_DIRS" ]; then + gappsWrapperArgs+=(--prefix XDG_DATA_DIRS : "$XDG_ICON_DIRS") + fi + + if [ -n "$GSETTINGS_SCHEMAS_PATH" ]; then + gappsWrapperArgs+=(--prefix XDG_DATA_DIRS : "$GSETTINGS_SCHEMAS_PATH") + fi + + # Check for prefix as well + if [ -d "${prefix:?}/share" ]; then + gappsWrapperArgs+=(--prefix XDG_DATA_DIRS : "$prefix/share") + fi + + if [ -d "$prefix/lib/gio/modules" ] && [ -n "$(ls -A "$prefix/lib/gio/modules")" ]; then + gappsWrapperArgs+=(--prefix GIO_EXTRA_MODULES : "$prefix/lib/gio/modules") + fi + + for v in ${wrapPrefixVariables:-} GST_PLUGIN_SYSTEM_PATH_1_0 GI_TYPELIB_PATH GRL_PLUGIN_PATH; do + if [ -n "${!v}" ]; then + gappsWrapperArgs+=(--prefix "$v" : "${!v}") + fi + done +} + +preFixupPhases+=" gappsWrapperArgsHook" + wrapGApp() { local program="$1" shift 1 @@ -17,72 +48,46 @@ wrapGApp() { # Note: $gappsWrapperArgs still gets defined even if ${dontWrapGApps-} is set. wrapGAppsHook() { - # guard against running multiple times (e.g. due to propagation) - [ -z "$wrapGAppsHookHasRun" ] || return 0 - wrapGAppsHookHasRun=1 + # guard against running multiple times (e.g. due to propagation) + [ -z "$wrapGAppsHookHasRun" ] || return 0 + wrapGAppsHookHasRun=1 - if [ -n "$GDK_PIXBUF_MODULE_FILE" ]; then - gappsWrapperArgs+=(--set GDK_PIXBUF_MODULE_FILE "$GDK_PIXBUF_MODULE_FILE") - fi + if [[ -z "${dontWrapGApps:-}" ]]; then + targetDirsThatExist=() + targetDirsRealPath=() - if [ -n "$XDG_ICON_DIRS" ]; then - gappsWrapperArgs+=(--prefix XDG_DATA_DIRS : "$XDG_ICON_DIRS") - fi - - if [ -n "$GSETTINGS_SCHEMAS_PATH" ]; then - gappsWrapperArgs+=(--prefix XDG_DATA_DIRS : "$GSETTINGS_SCHEMAS_PATH") - fi - - if [ -d "${prefix:?}/share" ]; then - gappsWrapperArgs+=(--prefix XDG_DATA_DIRS : "$prefix/share") - fi - - if [ -d "$prefix/lib/gio/modules" ] && [ -n "$(ls -A "$prefix/lib/gio/modules")" ] ; then - gappsWrapperArgs+=(--prefix GIO_EXTRA_MODULES : "$prefix/lib/gio/modules") - fi - - for v in ${wrapPrefixVariables:-} GST_PLUGIN_SYSTEM_PATH_1_0 GI_TYPELIB_PATH GRL_PLUGIN_PATH; do - if [ -n "${!v}" ]; then - gappsWrapperArgs+=(--prefix "$v" : "${!v}") - fi - done - - if [[ -z "${dontWrapGApps:-}" ]]; then - targetDirsThatExist=() - targetDirsRealPath=() - - # wrap binaries - targetDirs=( "${prefix}/bin" "${prefix}/libexec" ) - for targetDir in "${targetDirs[@]}"; do - if [[ -d "${targetDir}" ]]; then - targetDirsThatExist+=("${targetDir}") - targetDirsRealPath+=("$(realpath "${targetDir}")/") - find "${targetDir}" -type f -executable -print0 \ - | while IFS= read -r -d '' file; do - echo "Wrapping program '${file}'" - wrapGApp "${file}" + # wrap binaries + targetDirs=("${prefix}/bin" "${prefix}/libexec") + for targetDir in "${targetDirs[@]}"; do + if [[ -d "${targetDir}" ]]; then + targetDirsThatExist+=("${targetDir}") + targetDirsRealPath+=("$(realpath "${targetDir}")/") + find "${targetDir}" -type f -executable -print0 | + while IFS= read -r -d '' file; do + echo "Wrapping program '${file}'" + wrapGApp "${file}" + done + fi done - fi - done - # wrap links to binaries that point outside targetDirs - # Note: links to binaries within targetDirs do not need - # to be wrapped as the binaries have already been wrapped - if [[ ${#targetDirsThatExist[@]} -ne 0 ]]; then - find "${targetDirsThatExist[@]}" -type l -xtype f -executable -print0 \ - | while IFS= read -r -d '' linkPath; do - linkPathReal=$(realpath "${linkPath}") - for targetPath in "${targetDirsRealPath[@]}"; do - if [[ "$linkPathReal" == "$targetPath"* ]]; then - echo "Not wrapping link: '$linkPath' (already wrapped)" - continue 2 - fi - done - echo "Wrapping link: '$linkPath'" - wrapGApp "${linkPath}" - done + # wrap links to binaries that point outside targetDirs + # Note: links to binaries within targetDirs do not need + # to be wrapped as the binaries have already been wrapped + if [[ ${#targetDirsThatExist[@]} -ne 0 ]]; then + find "${targetDirsThatExist[@]}" -type l -xtype f -executable -print0 | + while IFS= read -r -d '' linkPath; do + linkPathReal=$(realpath "${linkPath}") + for targetPath in "${targetDirsRealPath[@]}"; do + if [[ "$linkPathReal" == "$targetPath"* ]]; then + echo "Not wrapping link: '$linkPath' (already wrapped)" + continue 2 + fi + done + echo "Wrapping link: '$linkPath'" + wrapGApp "${linkPath}" + done + fi fi - fi } fixupOutputHooks+=(wrapGAppsHook) From da48691741c026d27a2591bba21cdf0e51b03afa Mon Sep 17 00:00:00 2001 From: "R. RyanTM" Date: Sun, 1 Mar 2020 21:50:41 +0000 Subject: [PATCH 4/9] at-spi2-atk: 2.34.1 -> 2.34.2 (cherry picked from commit deec2268c9268f936aa9094c620cc145eb8ef18c) --- pkgs/development/libraries/at-spi2-atk/default.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/development/libraries/at-spi2-atk/default.nix b/pkgs/development/libraries/at-spi2-atk/default.nix index f63a341e26ea..f16b38e3fd84 100644 --- a/pkgs/development/libraries/at-spi2-atk/default.nix +++ b/pkgs/development/libraries/at-spi2-atk/default.nix @@ -16,11 +16,11 @@ stdenv.mkDerivation rec { pname = "at-spi2-atk"; - version = "2.34.1"; + version = "2.34.2"; src = fetchurl { url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz"; - sha256 = "05ncp7s5nddjinffs26mcvpbd63vk1m3cv5y530p3plgfhqgjvbp"; + sha256 = "1w7l4xg00qx3dwhn0zaa64daiv5f073hdvjdxh0mrw7fw37264wh"; }; nativeBuildInputs = [ meson ninja pkgconfig ]; @@ -36,7 +36,7 @@ stdenv.mkDerivation rec { meta = with stdenv.lib; { description = "D-Bus bridge for Assistive Technology Service Provider Interface (AT-SPI) and Accessibility Toolkit (ATK)"; - homepage = https://gitlab.gnome.org/GNOME/at-spi2-atk; + homepage = "https://gitlab.gnome.org/GNOME/at-spi2-atk"; license = licenses.lgpl21Plus; maintainers = gnome3.maintainers; platforms = platforms.unix; From e544e03110063eee62ca1f1b407c4f7e0739c432 Mon Sep 17 00:00:00 2001 From: Jan Tojnar Date: Wed, 4 Mar 2020 21:19:35 +0100 Subject: [PATCH 5/9] glib.setupHook: run glibPreFixupPhase before gappsWrapperArgsHook Since we split wrapGAppsHook and move its variable initialization to preFixupPhases in #81475, it was getting run before glibPreFixupPhase which sets GSETTINGS_SCHEMAS_PATH variable gappsWrapperArgsHook depends on. Let's introduce this ugly hack to ensure glibPreFixupPhase will run before gappsWrapperArgsHook. (cherry picked from commit 8e4f502fc6a3736f402e320ba7ab3ec630a4cbac) --- pkgs/development/libraries/glib/setup-hook.sh | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/pkgs/development/libraries/glib/setup-hook.sh b/pkgs/development/libraries/glib/setup-hook.sh index 37c750b8db66..5d9c330b62eb 100644 --- a/pkgs/development/libraries/glib/setup-hook.sh +++ b/pkgs/development/libraries/glib/setup-hook.sh @@ -24,4 +24,12 @@ glibPreFixupPhase() { addToSearchPath GSETTINGS_SCHEMAS_PATH "${!outputLib}/share/gsettings-schemas/$name" } -preFixupPhases+=" glibPreFixupPhase" + +# gappsWrapperArgsHook expects GSETTINGS_SCHEMAS_PATH variable to be set by this. +# Until we have dependency mechanism in generic builder, we need to use this ugly hack. +if [[ " ${preFixupPhases:-} " =~ " gappsWrapperArgsHook " ]]; then + preFixupPhases+=" " + preFixupPhases="${preFixupPhases/ gappsWrapperArgsHook / glibPreFixupPhase gappsWrapperArgsHook }" +else + preFixupPhases+=" glibPreFixupPhase" +fi From a0adbb1bdb92561b525dfc7dd3bfff880c5d956e Mon Sep 17 00:00:00 2001 From: "R. RyanTM" Date: Fri, 14 Feb 2020 17:01:59 +0000 Subject: [PATCH 6/9] libarchive: 3.4.1 -> 3.4.2 Fixes CVE-2020-9308. (cherry picked from commit 13a03f402cc75f5db52ebaaac3af2f7d99cb9c27) --- pkgs/development/libraries/libarchive/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/libraries/libarchive/default.nix b/pkgs/development/libraries/libarchive/default.nix index 04b4e409b9bd..779ddfeb589a 100644 --- a/pkgs/development/libraries/libarchive/default.nix +++ b/pkgs/development/libraries/libarchive/default.nix @@ -10,13 +10,13 @@ assert xarSupport -> libxml2 != null; stdenv.mkDerivation rec { pname = "libarchive"; - version = "3.4.1"; + version = "3.4.2"; src = fetchFromGitHub { owner = "libarchive"; repo = "libarchive"; rev = "v${version}"; - sha256 = "0g0kzfl01zy1aabr5jcrh8480mb16vh3pacdhg6mm2bdv2f5w8z1"; + sha256 = "0mjm77wbqs8sbn9j44lj39nwbg6anmgz6pkyfxsww54a4rs0p3iz"; }; outputs = [ "out" "lib" "dev" ]; From 0fc28d7b319a1a3058aabe9f91f546745da3e7ad Mon Sep 17 00:00:00 2001 From: Benjamin Hipple Date: Tue, 18 Feb 2020 21:34:08 -0500 Subject: [PATCH 7/9] bluez: 5.52 -> 5.53 for CVE-2020-0556 See here for details: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00352.html (cherry picked from commit 8f8b6459e9f38bc21df4976265f96b4541b917ec) --- pkgs/os-specific/linux/bluez/default.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/os-specific/linux/bluez/default.nix b/pkgs/os-specific/linux/bluez/default.nix index cf9bcec554c3..844a9faf739c 100644 --- a/pkgs/os-specific/linux/bluez/default.nix +++ b/pkgs/os-specific/linux/bluez/default.nix @@ -15,11 +15,11 @@ stdenv.mkDerivation rec { pname = "bluez"; - version = "5.52"; + version = "5.53"; src = fetchurl { url = "mirror://kernel/linux/bluetooth/${pname}-${version}.tar.xz"; - sha256 = "02jng21lp6fb3c2bh6vf9y7cj4gaxwk29dfc32ncy0lj0gi4q57p"; + sha256 = "1g1qg6dz6hl3csrmz75ixr12lwv836hq3ckb259svvrg62l2vaiq"; }; pythonPath = with python3.pkgs; [ @@ -116,7 +116,7 @@ stdenv.mkDerivation rec { meta = with stdenv.lib; { description = "Bluetooth support for Linux"; - homepage = http://www.bluez.org/; + homepage = "http://www.bluez.org/"; license = with licenses; [ gpl2 lgpl21 ]; platforms = platforms.linux; repositories.git = https://git.kernel.org/pub/scm/bluetooth/bluez.git; From d32805ec3338586e358fb12eea9fa4b976769c4a Mon Sep 17 00:00:00 2001 From: Martin Milata Date: Fri, 13 Mar 2020 02:14:37 +0100 Subject: [PATCH 8/9] libssh: 0.8.7 -> 0.8.8 Fixes CVE-2019-14889, issue #77264. Release notes: https://www.libssh.org/2019/12/10/libssh-0-9-3-and-libssh-0-8-8-security-release/ (cherry picked from commit 7ef8a42ab206adbabcfcd02917efcb3934ae5492) --- pkgs/development/libraries/libssh/default.nix | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/pkgs/development/libraries/libssh/default.nix b/pkgs/development/libraries/libssh/default.nix index 65de6db3b47b..bf6e0a491f2f 100644 --- a/pkgs/development/libraries/libssh/default.nix +++ b/pkgs/development/libraries/libssh/default.nix @@ -1,11 +1,12 @@ { stdenv, fetchurl, pkgconfig, cmake, zlib, openssl, libsodium }: stdenv.mkDerivation rec { - name = "libssh-0.8.7"; + pname = "libssh"; + version = "0.8.8"; src = fetchurl { - url = "https://www.libssh.org/files/0.8/${name}.tar.xz"; - sha256 = "14nmwfnnrhkwcfk5hn7azl905ivbh4wllmsbw5abd80b5yi4qc23"; + url = "https://www.libssh.org/files/0.8/${pname}-${version}.tar.xz"; + sha256 = "1qk5bm9r6199jbfk54f8w24vkl52051g8s3kmq4z2kdc6vbpy4jb"; }; postPatch = '' @@ -22,6 +23,7 @@ stdenv.mkDerivation rec { meta = with stdenv.lib; { description = "SSH client library"; + homepage = "https://libssh.org"; license = licenses.lgpl2Plus; maintainers = with maintainers; [ sander ]; platforms = platforms.all; From 2dab4c10c426416c028f971a222b1169dcbf46c3 Mon Sep 17 00:00:00 2001 From: Martin Milata Date: Thu, 12 Mar 2020 21:54:07 +0100 Subject: [PATCH 9/9] lz4: 1.9.1 -> 1.9.2 (PR #82437) Fixes: https://nvd.nist.gov/vuln/detail/CVE-2019-17543 Release notes: https://github.com/lz4/lz4/releases/tag/v1.9.2 (cherry picked from commit 18ac6ba903828b388c9cfb5bb80bd3fc8667c5ca) --- pkgs/tools/compression/lz4/default.nix | 14 +++----------- 1 file changed, 3 insertions(+), 11 deletions(-) diff --git a/pkgs/tools/compression/lz4/default.nix b/pkgs/tools/compression/lz4/default.nix index 3ce0eac3fc5c..85f35bd3bfcc 100644 --- a/pkgs/tools/compression/lz4/default.nix +++ b/pkgs/tools/compression/lz4/default.nix @@ -4,23 +4,15 @@ stdenv.mkDerivation rec { pname = "lz4"; - version = "1.9.1"; + version = "1.9.2"; src = fetchFromGitHub { - sha256 = "1l1caxrik1hqs40vj3bpv1pikw6b74cfazv5c0v6g48zpcbmshl0"; + sha256 = "0lpaypmk70ag2ks3kf2dl4ac3ba40n5kc1ainkp9wfjawz76mh61"; rev = "v${version}"; repo = pname; owner = pname; }; - patches = [ - # Fix detection of Darwin - (fetchpatch { - url = "https://github.com/lz4/lz4/commit/024216ef7394b6411eeaa5b52d0cec9953a44249.patch"; - sha256 = "0j0j2pr6pkplxf083hlwl5q4cfp86q3wd8mc64bcfcr7ysc5pzl3"; - }) - ]; - # TODO(@Ericson2314): Separate binaries and libraries outputs = [ "out" "dev" ]; @@ -65,7 +57,7 @@ stdenv.mkDerivation rec { multiple GB/s per core, typically reaching RAM speed limits on multi-core systems. ''; - homepage = https://lz4.github.io/lz4/; + homepage = "https://lz4.github.io/lz4/"; license = with licenses; [ bsd2 gpl2Plus ]; platforms = platforms.all; };