diff --git a/.github/workflows/eval.yml b/.github/workflows/eval.yml index 82781f96c736..01149578af78 100644 --- a/.github/workflows/eval.yml +++ b/.github/workflows/eval.yml @@ -75,6 +75,9 @@ jobs: with: extra_nix_config: sandbox = true + - name: Ensure flake outputs on all systems still evaluate + run: nix --experimental-features 'nix-command flakes' flake check --all-systems --no-build ./nixpkgs + - name: Query nixpkgs with aliases enabled to check for basic syntax errors run: | time nix-env -I ./nixpkgs -f ./nixpkgs -qa '*' --option restrict-eval true --option allow-import-from-derivation false >/dev/null diff --git a/flake.nix b/flake.nix index 178c591bf60f..b4b769f6ee7d 100644 --- a/flake.nix +++ b/flake.nix @@ -96,18 +96,25 @@ checks = forAllSystems ( system: - { - tarball = jobs.${system}.tarball; - } + { } + // + lib.optionalAttrs + ( + # Exclude x86_64-freebsd because "Failed to evaluate rustc-wrapper-1.85.0: «broken»: is marked as broken" + system != "x86_64-freebsd" + ) + { + tarball = jobs.${system}.tarball; + } // lib.optionalAttrs ( self.legacyPackages.${system}.stdenv.hostPlatform.isLinux # Exclude power64 due to "libressl is not available on the requested hostPlatform" with hostPlatform being power64 && !self.legacyPackages.${system}.targetPlatform.isPower64 - # Exclude armv6l-linux due to "cannot bootstrap GHC on this platform ('armv6l-linux' with libc 'defaultLibc')" + # Exclude armv6l-linux because "cannot bootstrap GHC on this platform ('armv6l-linux' with libc 'defaultLibc')" && system != "armv6l-linux" - # Exclude riscv64-linux due to "cannot bootstrap GHC on this platform ('riscv64-linux' with libc 'defaultLibc')" + # Exclude riscv64-linux because "cannot bootstrap GHC on this platform ('riscv64-linux' with libc 'defaultLibc')" && system != "riscv64-linux" ) { @@ -158,8 +165,8 @@ system != "armv6l-linux" # Exclude riscv64-linux because "Package ‘ghc-9.6.6’ in .../pkgs/development/compilers/ghc/common-hadrian.nix:579 is not available on the requested hostPlatform" && system != "riscv64-linux" - # Exclude FreeBSD because "Package ‘ghc-9.6.6’ in .../pkgs/development/compilers/ghc/common-hadrian.nix:579 is not available on the requested hostPlatform" - && !self.legacyPackages.${system}.stdenv.hostPlatform.isFreeBSD + # Exclude x86_64-freebsd because "Package ‘ghc-9.6.6’ in .../pkgs/development/compilers/ghc/common-hadrian.nix:579 is not available on the requested hostPlatform" + && system != "x86_64-freebsd" ) { /** @@ -169,7 +176,15 @@ } ); - formatter = forAllSystems (system: (import ./ci { inherit system; }).fmt.pkg); + formatter = lib.filterAttrs ( + system: _: + # Exclude armv6l-linux because "cannot bootstrap GHC on this platform ('armv6l-linux' with libc 'defaultLibc')" + system != "armv6l-linux" + # Exclude riscv64-linux because "cannot bootstrap GHC on this platform ('riscv64-linux' with libc 'defaultLibc')" + && system != "riscv64-linux" + # Exclude x86_64-freebsd because "Package ‘go-1.22.12-freebsd-amd64-bootstrap’ in /nix/store/0yw40qnrar3lvc5hax5n49abl57apjbn-source/pkgs/development/compilers/go/binary.nix:50 is not available on the requested hostPlatform" + && system != "x86_64-freebsd" + ) (forAllSystems (system: (import ./ci { inherit system; }).fmt.pkg)); /** A nested structure of [packages](https://nix.dev/manual/nix/latest/glossary#package-attribute-set) and other values. diff --git a/nixos/modules/services/security/paretosecurity.nix b/nixos/modules/services/security/paretosecurity.nix index 9ec196eee6a0..a1080ede8431 100644 --- a/nixos/modules/services/security/paretosecurity.nix +++ b/nixos/modules/services/security/paretosecurity.nix @@ -24,6 +24,17 @@ # dependencies here. This creates the necessary symlinks in the proper locations. systemd.sockets.paretosecurity.wantedBy = [ "sockets.target" ]; + # In NixOS, systemd services are configured with minimal PATH. However, + # paretosecurity helper looks for installed software to do its job, so + # it needs the full system PATH. For example, it runs `iptables` to see if + # firewall is configured. And it looks for various password managers to see + # if one is installed. + # The `paretosecurity-user` timer service that is configured lower has + # the same need. + systemd.services.paretosecurity.serviceConfig.Environment = [ + "PATH=${config.system.path}/bin:${config.system.path}/sbin" + ]; + # Enable the tray icon and timer services if the trayIcon option is enabled systemd.user = lib.mkIf config.services.paretosecurity.trayIcon { services.paretosecurity-trayicon = { @@ -31,6 +42,9 @@ }; services.paretosecurity-user = { wantedBy = [ "graphical-session.target" ]; + serviceConfig.Environment = [ + "PATH=${config.system.path}/bin:${config.system.path}/sbin" + ]; }; timers.paretosecurity-user = { wantedBy = [ "timers.target" ]; diff --git a/nixos/tests/paretosecurity.nix b/nixos/tests/paretosecurity.nix index a2b9317c678f..bf9af17e2f5e 100644 --- a/nixos/tests/paretosecurity.nix +++ b/nixos/tests/paretosecurity.nix @@ -29,6 +29,8 @@ package = patchedPareto; }; + networking.firewall.enable = true; + }; nodes.dashboard = @@ -64,6 +66,12 @@ services.displayManager.autoLogin = { enable = true; user = "alice"; + + }; + + virtualisation.resolution = { + x = 640; + y = 480; }; environment.systemPackages = [ pkgs.xdotool ]; @@ -94,7 +102,6 @@ + " --skip 21830a4e-84f1-48fe-9c5b-beab436b2cdb" # Disk encryption + " --skip 44e4754a-0b42-4964-9cc2-b88b2023cb1e" # Pareto Security is up to date + " --skip f962c423-fdf5-428a-a57a-827abc9b253e" # Password manager installed - + " --skip 2e46c89a-5461-4865-a92e-3b799c12034a" # Firewall is enabled + "'" ) @@ -117,7 +124,7 @@ ]: status, out = xfce.systemctl("is-enabled " + unit, "alice") assert status == 0, f"Unit {unit} is not enabled (status: {status}): {out}" - xfce.succeed("xdotool mousemove 850 10") + xfce.succeed("xdotool mousemove 460 10") xfce.wait_for_text("Pareto Security") xfce.succeed("xdotool click 1") xfce.wait_for_text("Run Checks") diff --git a/pkgs/applications/networking/browsers/firefox/packages/firefox-devedition.nix b/pkgs/applications/networking/browsers/firefox/packages/firefox-devedition.nix index ced9901dd6ee..99a339361f83 100644 --- a/pkgs/applications/networking/browsers/firefox/packages/firefox-devedition.nix +++ b/pkgs/applications/networking/browsers/firefox/packages/firefox-devedition.nix @@ -9,13 +9,13 @@ buildMozillaMach rec { pname = "firefox-devedition"; - version = "137.0b6"; + version = "137.0b10"; applicationName = "Mozilla Firefox Developer Edition"; requireSigning = false; branding = "browser/branding/aurora"; src = fetchurl { url = "mirror://mozilla/devedition/releases/${version}/source/firefox-${version}.source.tar.xz"; - sha512 = "91fb3e010d62805ec29758bb46b3d520dc3a3e2b0f040de4e284aeb5fe812b5b084563f560a229f54a404a5130429d60b35eac15d89f1cb586fd364b61a7f8be"; + sha512 = "ece2e76830b7f3fa0ea3b077948a874315c225da03f9043a5e63900f251aa7f568278aeae5c9b5be89bf07c2d783fbdfd1f2acf37e6dd7db3d82cb7e925e33d6"; }; meta = { diff --git a/pkgs/applications/virtualization/docker/default.nix b/pkgs/applications/virtualization/docker/default.nix index da6883a4ac70..7ef6b9ed0ada 100644 --- a/pkgs/applications/virtualization/docker/default.nix +++ b/pkgs/applications/virtualization/docker/default.nix @@ -32,6 +32,7 @@ rec { runc, tini, libtool, + bash, sqlite, iproute2, docker-buildx, @@ -82,6 +83,10 @@ rec { hash = runcHash; }; + preBuild = '' + substituteInPlace Makefile --replace-warn "/bin/bash" "${lib.getExe bash}" + ''; + # docker/runc already include these patches / are not applicable patches = [ ]; }; @@ -433,15 +438,15 @@ rec { }; docker_27 = callPackage dockerGen rec { - version = "27.3.1"; + version = "27.5.1"; cliRev = "v${version}"; - cliHash = "sha256-Iurud1BwswGZCFgJ04/wl1U9AKcsXDmzFXLFCrjfc0Y="; + cliHash = "sha256-7laxRfssh2aGfJeZI0PsJ/MCiy2npigSmCa1SUlWY4s="; mobyRev = "v${version}"; - mobyHash = "sha256-AKl06k2ePWOFhL3oH086HcLLYs2Da+wLOcGjGnQ0SXE="; - runcRev = "v1.1.14"; - runcHash = "sha256-7PYbSZqCQLTaeFppuNz5mxDlwEyLkA5zpdMhWy1tWmc="; - containerdRev = "v1.7.22"; - containerdHash = "sha256-8IHBKai4PvvTuHPDTgx9wFEBzz4MM7Mwo8Q/bzFRzfk="; + mobyHash = "sha256-q+VCJZ93jvPJQE0xn89prH/6spsarVY3VUEmgwyMxU4="; + runcRev = "v1.2.4"; + runcHash = "sha256-LdYCMxdqDP7rKo6Ek/B1DE6QvUFrltbSJVggkVkXQZo="; + containerdRev = "v1.7.25"; + containerdHash = "sha256-T0F5bwxSCqa4Czs/W01NaAlJJFvgrzkBC1y/r+muivA="; tiniRev = "v0.19.0"; tiniHash = "sha256-ZDKu/8yE5G0RYFJdhgmCdN3obJNyRWv6K/Gd17zc1sI="; }; diff --git a/pkgs/by-name/bi/bird3/package.nix b/pkgs/by-name/bi/bird3/package.nix index 279199cafb4f..40459a43611f 100644 --- a/pkgs/by-name/bi/bird3/package.nix +++ b/pkgs/by-name/bi/bird3/package.nix @@ -11,11 +11,11 @@ stdenv.mkDerivation rec { pname = "bird"; - version = "3.0.1"; + version = "3.1.0"; src = fetchurl { url = "https://bird.network.cz/download/bird-${version}.tar.gz"; - hash = "sha256-iGhAPKqE4lVLtuYK2+fGV+e7fErEGRDjmPNeI2upD6E="; + hash = "sha256-xxY49Xb0MWcEN++dkL6lZZK8VjcB3nhpg/RCJk7Hdiw="; }; nativeBuildInputs = [ diff --git a/pkgs/by-name/lo/lockbook-desktop/package.nix b/pkgs/by-name/lo/lockbook-desktop/package.nix index a119da25c520..e50876658ad2 100644 --- a/pkgs/by-name/lo/lockbook-desktop/package.nix +++ b/pkgs/by-name/lo/lockbook-desktop/package.nix @@ -18,17 +18,17 @@ let in rustPlatform.buildRustPackage rec { pname = "lockbook-desktop"; - version = "0.9.20"; + version = "0.9.21"; src = fetchFromGitHub { owner = "lockbook"; repo = "lockbook"; tag = version; - hash = "sha256-nIh5xgdtaUvc5RbS24GGUHxY41lnL2xdkDs0TD/N2Gw="; + hash = "sha256-SRmfLxF78jR1a/37pU1TLM6nFpmYLRbHJzQIVQtM8/M="; }; useFetchCargoVendor = true; - cargoHash = "sha256-CuUg5QT1s5TJd409O9YD3A3bMNUnfY6MrCIUrzS50j8="; + cargoHash = "sha256-faqbsxXF2AjDE+FMkD1PihacPAvQlD6nkczN4QdsCeM="; nativeBuildInputs = [ pkg-config diff --git a/pkgs/by-name/lo/lockbook/package.nix b/pkgs/by-name/lo/lockbook/package.nix index b7fb28ff49e3..bf9c911ae031 100644 --- a/pkgs/by-name/lo/lockbook/package.nix +++ b/pkgs/by-name/lo/lockbook/package.nix @@ -7,17 +7,17 @@ }: rustPlatform.buildRustPackage rec { pname = "lockbook"; - version = "0.9.20"; + version = "0.9.21"; src = fetchFromGitHub { owner = "lockbook"; repo = "lockbook"; tag = version; - hash = "sha256-nIh5xgdtaUvc5RbS24GGUHxY41lnL2xdkDs0TD/N2Gw="; + hash = "sha256-SRmfLxF78jR1a/37pU1TLM6nFpmYLRbHJzQIVQtM8/M="; }; useFetchCargoVendor = true; - cargoHash = "sha256-CuUg5QT1s5TJd409O9YD3A3bMNUnfY6MrCIUrzS50j8="; + cargoHash = "sha256-faqbsxXF2AjDE+FMkD1PihacPAvQlD6nkczN4QdsCeM="; doCheck = false; # there are no cli tests cargoBuildFlags = [ diff --git a/pkgs/by-name/pa/paretosecurity/package.nix b/pkgs/by-name/pa/paretosecurity/package.nix index e6b5232d75cb..25728d4e32a3 100644 --- a/pkgs/by-name/pa/paretosecurity/package.nix +++ b/pkgs/by-name/pa/paretosecurity/package.nix @@ -9,16 +9,16 @@ buildGoModule rec { pname = "paretosecurity"; - version = "0.0.96"; + version = "0.1.3"; src = fetchFromGitHub { owner = "ParetoSecurity"; repo = "agent"; rev = version; - hash = "sha256-SyeIGSDvrnOvyOJ0zC8CulpaMa+iZeRaMTJUSydz2tw="; + hash = "sha256-ovyfHqLCf5U3UR1HfoA+UQhqLZ6IaILcpqptPRQsb60="; }; - vendorHash = "sha256-O/OF3Y6HiiikMxf657k9eIM7UfkicIImAUxVVf/TgR8="; + vendorHash = "sha256-7mKAFkKGpBOjXc3J/sfF3k3pJF53tFybXZgbfJInuSY="; proxyVendor = true; ldflags = [ diff --git a/pkgs/by-name/ve/vencord/package.nix b/pkgs/by-name/ve/vencord/package.nix index 48c98890d081..63c97ea03c01 100644 --- a/pkgs/by-name/ve/vencord/package.nix +++ b/pkgs/by-name/ve/vencord/package.nix @@ -15,18 +15,18 @@ stdenv.mkDerivation (finalAttrs: { pname = "vencord"; - version = "1.11.7"; + version = "1.11.8"; src = fetchFromGitHub { owner = "Vendicated"; repo = "Vencord"; rev = "v${finalAttrs.version}"; - hash = "sha256-WzmRz0wf/Ss90FmXXp6gaylC0k/k/QkFaFddlnLo+Xk="; + hash = "sha256-Ej04ONaeNt55mbQ5RTKM4MySYsw3UJky9ZK9h1gMEzo="; }; pnpmDeps = pnpm_10.fetchDeps { inherit (finalAttrs) pname src; - hash = "sha256-g9BSVUKpn74D9eIDj/lS1Y6w/+AnhCw++st4s4REn+A="; + hash = "sha256-hO6QKRr4jTfesRDAEGcpFeJmGTGLGMw6EgIvD23DNzw="; }; nativeBuildInputs = [ @@ -39,12 +39,12 @@ stdenv.mkDerivation (finalAttrs: { ESBUILD_BINARY_PATH = lib.getExe ( esbuild.overrideAttrs ( final: _: { - version = "0.25.0"; + version = "0.25.1"; src = fetchFromGitHub { owner = "evanw"; repo = "esbuild"; rev = "v${final.version}"; - hash = "sha256-L9jm94Epb22hYsU3hoq1lZXb5aFVD4FC4x2qNt0DljA="; + hash = "sha256-vrhtdrvrcC3dQoJM6hWq6wrGJLSiVww/CNPlL1N5kQ8="; }; vendorHash = "sha256-+BfxCyg0KkDQpHt/wycy/8CTG6YBA/VJvJFhhzUnSiQ="; } diff --git a/pkgs/development/interpreters/erlang/27.nix b/pkgs/development/interpreters/erlang/27.nix index 8a2955813656..8acd7815772c 100644 --- a/pkgs/development/interpreters/erlang/27.nix +++ b/pkgs/development/interpreters/erlang/27.nix @@ -1,6 +1,6 @@ { mkDerivation }: mkDerivation { - version = "27.3.1"; - sha256 = "sha256-VuVRwcS2TgDYT7buLMHOe8r0AWM+R9DxydcHErAy8xw="; + version = "27.3.2"; + sha256 = "sha256-Pybkcm3pLt0wV+S9ia/BAmM1AKp/nVSAckEzNn4KjSg="; } diff --git a/pkgs/os-specific/linux/kernel/htmldocs.nix b/pkgs/os-specific/linux/kernel/htmldocs.nix index f6c02fc5ea7e..bfd7de475e17 100644 --- a/pkgs/os-specific/linux/kernel/htmldocs.nix +++ b/pkgs/os-specific/linux/kernel/htmldocs.nix @@ -19,7 +19,7 @@ stdenv.mkDerivation { patchShebangs \ Documentation/sphinx/parse-headers.pl \ scripts/{get_abi.pl,get_feat.pl,kernel-doc,sphinx-pre-install} \ - tools/net/ynl/ynl-gen-rst.py + tools/net/ynl/pyynl/ynl_gen_rst.py ''; FONTCONFIG_FILE = makeFontsConf {