From 1e0c426c15836b9f6ebf4570120d4047b532f43c Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Mon, 5 Sep 2022 14:11:48 +0200 Subject: [PATCH 1/9] kanidm: 1.1.0-alpha.8 -> 1.1.0-alpha.9 https://github.com/kanidm/kanidm/releases/tag/v1.1.0-alpha.9 Uses a concrete rev, because it relies on additional commits from the release branch that provide build fixes. (cherry picked from commit b6f5b819203d044247f92204d235689640a42634) --- pkgs/servers/kanidm/default.nix | 31 ++++++++++++++----------------- 1 file changed, 14 insertions(+), 17 deletions(-) diff --git a/pkgs/servers/kanidm/default.nix b/pkgs/servers/kanidm/default.nix index f160886fb640..0984a622330c 100644 --- a/pkgs/servers/kanidm/default.nix +++ b/pkgs/servers/kanidm/default.nix @@ -17,16 +17,16 @@ let in rustPlatform.buildRustPackage rec { pname = "kanidm"; - version = "1.1.0-alpha.8"; + version = "1.1.0-alpha.9"; src = fetchFromGitHub { owner = pname; repo = pname; - rev = "v${version}"; - sha256 = "sha256-zMtbE6Y9wXFPBqhmiTMJ3m6bLVZl+c6lRY39DWDlJNo="; + rev = "985462590b1c49b26a0b0ee01e24b1eb01942165"; + hash = "sha256-JtoDuA3NCKmX+wDqav30VwrLeDALYat1iKFWpbYOO1s="; }; - cargoSha256 = "sha256:1l7xqp457zfd9gfjp6f4lzgadfp6112jbip4irazw4084qwj0z6x"; + cargoSha256 = "sha256-pkBkXIG2PF5YMeighQwHwhURWbJabfveyszRIdrQjcA="; KANIDM_BUILD_PROFILE = "release_nixos_${arch}"; @@ -56,25 +56,22 @@ rustPlatform.buildRustPackage rec { pam ]; - # Failing tests, probably due to network issues - checkFlags = [ - "--skip default_entries" - "--skip oauth2_openid_basic_flow" - "--skip test_server" - "--skip test_cache" - ]; + # The UI needs to be in place before the tests are run. + postBuild = '' + # We don't compile the wasm-part form source, as there isn't a rustc for + # wasm32-unknown-unknown in nixpkgs yet. + mkdir $out + cp -r kanidmd_web_ui/pkg $out/ui + ''; preFixup = '' - installShellCompletion --bash $releaseDir/build/completions/*.bash - installShellCompletion --zsh $releaseDir/build/completions/_* + installShellCompletion \ + --bash $releaseDir/build/completions/*.bash \ + --zsh $releaseDir/build/completions/_* # PAM and NSS need fix library names mv $out/lib/libnss_kanidm.so $out/lib/libnss_kanidm.so.2 mv $out/lib/libpam_kanidm.so $out/lib/pam_kanidm.so - - # We don't compile the wasm-part form source, as there isn't a rustc for - # wasm32-unknown-unknown in nixpkgs yet. - cp -r kanidmd_web_ui/pkg $out/ui ''; passthru.tests = { inherit (nixosTests) kanidm; }; From 994cffd997f7b3f2f5f4cc2f6804cb5291743613 Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Mon, 5 Sep 2022 14:56:23 +0200 Subject: [PATCH 2/9] nixos/tests/kanidm: Update recover_account commandline The username is now passed directly as an argument. (cherry picked from commit 9ac9449a0a50d8daf07b08f46a5b49bc28b045ca) --- nixos/tests/kanidm.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nixos/tests/kanidm.nix b/nixos/tests/kanidm.nix index d34f680f5224..852dc53e75d3 100644 --- a/nixos/tests/kanidm.nix +++ b/nixos/tests/kanidm.nix @@ -69,7 +69,7 @@ import ./make-test-python.nix ({ pkgs, ... }: server.wait_until_succeeds("curl -sf https://${serverDomain} | grep Kanidm") server.wait_until_succeeds("ldapsearch -H ldap://[::1]:636 -b '${ldapBaseDN}' -x '(name=test)'") client.wait_until_succeeds("kanidm login -D anonymous && kanidm self whoami | grep anonymous@${serverDomain}") - (rv, result) = server.execute("kanidmd recover_account -d quiet -c ${serverConfigFile} -n admin 2>&1 | rg -o '[A-Za-z0-9]{48}'") + rv, result = server.execute("kanidmd recover_account -c ${serverConfigFile} idm_admin 2>&1 | rg -o '[A-Za-z0-9]{48}'") assert rv == 0 ''; }) From e34c4f85cb1e901bebde4de1d42c7f98753040d4 Mon Sep 17 00:00:00 2001 From: Tako Marks Date: Mon, 5 Sep 2022 20:46:46 +0200 Subject: [PATCH 3/9] nixos/kanidm: Bind mount cacert path in unixd service In order to be able to use the unixd service with the `verify_ca` and `verify_hostnames` set to `true` it needs to be able to read the certificate store. This change bind mounts the cacert paths for the unixd service. (cherry picked from commit 3df41451e3f5179e1d02cf8366f1646ff3eb94ae) --- nixos/modules/services/security/kanidm.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/nixos/modules/services/security/kanidm.nix b/nixos/modules/services/security/kanidm.nix index a7c51b9a877f..6d3002166b37 100644 --- a/nixos/modules/services/security/kanidm.nix +++ b/nixos/modules/services/security/kanidm.nix @@ -248,6 +248,8 @@ in "-/etc/localtime" "-/etc/kanidm" "-/etc/static/kanidm" + "-/etc/ssl" + "-/etc/static/ssl" ]; BindPaths = [ # To create the socket From 3a26ffa3085a9a05ba7495f6ae8a92a79a53efd5 Mon Sep 17 00:00:00 2001 From: Tako Marks Date: Tue, 6 Sep 2022 15:11:53 +0200 Subject: [PATCH 4/9] nixos/kanidm: Add unixd test Test makes sure unixd is able to run and is able to query the server. (cherry picked from commit fb3f7d70b438a729f4f10d2e31f546d24bfeb6b2) --- nixos/tests/kanidm.nix | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/nixos/tests/kanidm.nix b/nixos/tests/kanidm.nix index 852dc53e75d3..7f8a4e501777 100644 --- a/nixos/tests/kanidm.nix +++ b/nixos/tests/kanidm.nix @@ -44,6 +44,12 @@ import ./make-test-python.nix ({ pkgs, ... }: enableClient = true; clientSettings = { uri = "https://${serverDomain}"; + verify_ca = true; + verify_hostnames = true; + }; + enablePam = true; + unixSettings = { + pam_allowed_login_groups = [ "shell" ]; }; }; @@ -67,9 +73,11 @@ import ./make-test-python.nix ({ pkgs, ... }: start_all() server.wait_for_unit("kanidm.service") server.wait_until_succeeds("curl -sf https://${serverDomain} | grep Kanidm") - server.wait_until_succeeds("ldapsearch -H ldap://[::1]:636 -b '${ldapBaseDN}' -x '(name=test)'") - client.wait_until_succeeds("kanidm login -D anonymous && kanidm self whoami | grep anonymous@${serverDomain}") + server.succeed("ldapsearch -H ldap://[::1]:636 -b '${ldapBaseDN}' -x '(name=test)'") + client.succeed("kanidm login -D anonymous && kanidm self whoami | grep anonymous@${serverDomain}") rv, result = server.execute("kanidmd recover_account -c ${serverConfigFile} idm_admin 2>&1 | rg -o '[A-Za-z0-9]{48}'") assert rv == 0 + client.wait_for_unit("kanidm-unixd.service") + client.succeed("kanidm_unixd_status | grep working!") ''; }) From d84f54d645dc2a2a7ad5eab0e331acf7048e3d17 Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Sun, 18 Sep 2022 03:51:50 +0200 Subject: [PATCH 5/9] firefox-esr-91-unwrapped: mark vulnerable --- pkgs/applications/networking/browsers/firefox/packages.nix | 3 +++ 1 file changed, 3 insertions(+) diff --git a/pkgs/applications/networking/browsers/firefox/packages.nix b/pkgs/applications/networking/browsers/firefox/packages.nix index c7f326ab5c7c..83223f5c289c 100644 --- a/pkgs/applications/networking/browsers/firefox/packages.nix +++ b/pkgs/applications/networking/browsers/firefox/packages.nix @@ -70,6 +70,9 @@ rec { broken = stdenv.buildPlatform.is32bit; # since Firefox 60, build on 32-bit platforms fails with "out of memory". # not in `badPlatforms` because cross-compilation on 64-bit machine might work. license = lib.licenses.mpl20; + knownVulnerabilities = [ + "Firefox 91.13.0esr was the last release in the 91esr series, which has reached the end of its life. Migrate to the 102esr series instead." + ]; }; tests = [ nixosTests.firefox-esr-91 ]; updateScript = callPackage ./update.nix { From 1006660c0da0fcf8dbbfe9d7a4582bc52550d49e Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Fri, 8 Jul 2022 06:26:52 +0000 Subject: [PATCH 6/9] cmark-gfm: 0.29.0.gfm.3 -> 0.29.0.gfm.4 (cherry picked from commit 55ac327102cf9acc731d7bbd484731592b493586) --- pkgs/development/libraries/cmark-gfm/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/libraries/cmark-gfm/default.nix b/pkgs/development/libraries/cmark-gfm/default.nix index 599ac2b2e7b0..ecfdda3192f4 100644 --- a/pkgs/development/libraries/cmark-gfm/default.nix +++ b/pkgs/development/libraries/cmark-gfm/default.nix @@ -1,13 +1,13 @@ { lib, stdenv, fetchFromGitHub, cmake }: stdenv.mkDerivation rec { pname = "cmark-gfm"; - version = "0.29.0.gfm.3"; + version = "0.29.0.gfm.4"; src = fetchFromGitHub { owner = "github"; repo = "cmark-gfm"; rev = version; - sha256 = "sha256-V3XegSjqKLCMpfnoYHr9/r5fSC2CC7A2jXkAcHUt7eA="; + sha256 = "sha256-touFLrxVQvX75JXYLADq84yIuQ1kl43fVUvZ4qGYoMM="; }; nativeBuildInputs = [ cmake ]; From 32c245781b7ba5d90dbd041470632ed78d9b9070 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Sun, 28 Aug 2022 15:20:37 +0000 Subject: [PATCH 7/9] cmark-gfm: 0.29.0.gfm.4 -> 0.29.0.gfm.5 (cherry picked from commit 8fb82d80fe1133fbbae641b74472cb1bb3b63aae) --- pkgs/development/libraries/cmark-gfm/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/libraries/cmark-gfm/default.nix b/pkgs/development/libraries/cmark-gfm/default.nix index ecfdda3192f4..6edfb1d898af 100644 --- a/pkgs/development/libraries/cmark-gfm/default.nix +++ b/pkgs/development/libraries/cmark-gfm/default.nix @@ -1,13 +1,13 @@ { lib, stdenv, fetchFromGitHub, cmake }: stdenv.mkDerivation rec { pname = "cmark-gfm"; - version = "0.29.0.gfm.4"; + version = "0.29.0.gfm.5"; src = fetchFromGitHub { owner = "github"; repo = "cmark-gfm"; rev = version; - sha256 = "sha256-touFLrxVQvX75JXYLADq84yIuQ1kl43fVUvZ4qGYoMM="; + sha256 = "sha256-HNFxp62xBNo2GbWiiYXco2NMgoOXsnZNdbXgTK1i1JU="; }; nativeBuildInputs = [ cmake ]; From db67252e2ac208743730fa9f39fdcbbc5227f1d2 Mon Sep 17 00:00:00 2001 From: Robert Scott Date: Mon, 19 Sep 2022 15:51:40 +0100 Subject: [PATCH 8/9] cmark-gfm: 0.29.0.gfm.5 -> 0.29.0.gfm.6 (cherry picked from commit 626445f1c731b03b41e785e765f56a15bb6306bc) --- pkgs/development/libraries/cmark-gfm/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/libraries/cmark-gfm/default.nix b/pkgs/development/libraries/cmark-gfm/default.nix index 6edfb1d898af..239577e0732b 100644 --- a/pkgs/development/libraries/cmark-gfm/default.nix +++ b/pkgs/development/libraries/cmark-gfm/default.nix @@ -1,13 +1,13 @@ { lib, stdenv, fetchFromGitHub, cmake }: stdenv.mkDerivation rec { pname = "cmark-gfm"; - version = "0.29.0.gfm.5"; + version = "0.29.0.gfm.6"; src = fetchFromGitHub { owner = "github"; repo = "cmark-gfm"; rev = version; - sha256 = "sha256-HNFxp62xBNo2GbWiiYXco2NMgoOXsnZNdbXgTK1i1JU="; + sha256 = "sha256-ekHY5EGSrJrQwlXNjKpyj7k0Bzq1dYPacRsfNZ8K+lk="; }; nativeBuildInputs = [ cmake ]; From cf8fcef85edde3c867f587b70e3478cbccaff60d Mon Sep 17 00:00:00 2001 From: Shengyu Zhang Date: Tue, 20 Sep 2022 15:36:14 +0800 Subject: [PATCH 9/9] srain: fix homepage See also https://srain.silverrainz.me/blog/migrate-domain.html (cherry picked from commit 198dd79a4a318a4f965763879b8b9541818bc1b4) --- pkgs/applications/networking/irc/srain/default.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkgs/applications/networking/irc/srain/default.nix b/pkgs/applications/networking/irc/srain/default.nix index 302fe96f1eca..a12ecca525f1 100644 --- a/pkgs/applications/networking/irc/srain/default.nix +++ b/pkgs/applications/networking/irc/srain/default.nix @@ -52,7 +52,7 @@ stdenv.mkDerivation rec { meta = with lib; { description = "Modern IRC client written in GTK"; - homepage = "https://srain.im"; + homepage = "https://srain.silverrainz.me"; license = licenses.gpl3Plus; platforms = platforms.linux; maintainers = with maintainers; [ rewine ];