diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix index 59e7f84f4064..af8e12f056c2 100644 --- a/maintainers/maintainer-list.nix +++ b/maintainers/maintainer-list.nix @@ -14342,16 +14342,10 @@ }; mic92 = { email = "joerg@thalheim.io"; - matrix = "@mic92:nixos.dev"; + matrix = "@joerg:thalheim.io"; github = "Mic92"; githubId = 96200; name = "Jörg Thalheim"; - keys = [ - { - # compare with https://keybase.io/Mic92 - fingerprint = "3DEE 1C55 6E1C 3DC5 54F5 875A 003F 2096 411B 5F92"; - } - ]; }; michaeladler = { email = "therisen06@gmail.com"; diff --git a/maintainers/team-list.nix b/maintainers/team-list.nix index 3582789d91f6..1316160b9dc2 100644 --- a/maintainers/team-list.nix +++ b/maintainers/team-list.nix @@ -748,11 +748,14 @@ with lib.maintainers; shortName = "Mercury Employees"; }; + # same as https://github.com/orgs/NixOS/teams/nix-team nix = { members = [ eelco - grahamc - pierron + mic92 + tomberek + roberth + ericson2314 ]; scope = "Maintain the Nix package manager."; shortName = "Nix/nix-cli ecosystem"; diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json index 8c772b70cf1d..7fa41f5e10f7 100644 --- a/pkgs/applications/networking/cluster/terraform-providers/providers.json +++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json @@ -1030,13 +1030,13 @@ "vendorHash": "sha256-4kHMa6WoKYqd9WRecDWm8ea/s4yBFQQ0EHhXdS/x+xM=" }, "proxmox": { - "hash": "sha256-ikXLLNoAjrnGGGI3fHTKFXm8YwqNazE/U39JTjOBsW4=", + "hash": "sha256-dQvJVAxSR0eMeJseDR80MqXX4v7ry794bIr+ilpKBoQ=", "homepage": "https://registry.terraform.io/providers/Telmate/proxmox", "owner": "Telmate", "repo": "terraform-provider-proxmox", - "rev": "v2.9.14", + "rev": "v3.0.1-rc6", "spdx": "MIT", - "vendorHash": "sha256-um4iOwYO6ASv9wpu5Jua9anUZBKly4yVgI224Fk2dOM=" + "vendorHash": "sha256-rD4+m0txQhzw2VmQ56/ZXjtQ9QOufseZGg8TrisgAJo=" }, "rabbitmq": { "hash": "sha256-ArteHTNNUxgiBJamnR1bJFDrvNnqjbJ6D3mj1XlpVUA=", diff --git a/pkgs/by-name/ma/matrix-synapse-unwrapped/package.nix b/pkgs/by-name/ma/matrix-synapse-unwrapped/package.nix index 4fda64cec1d0..40addc79f9ea 100644 --- a/pkgs/by-name/ma/matrix-synapse-unwrapped/package.nix +++ b/pkgs/by-name/ma/matrix-synapse-unwrapped/package.nix @@ -17,20 +17,20 @@ let in python3.pkgs.buildPythonApplication rec { pname = "matrix-synapse"; - version = "1.126.0"; + version = "1.127.1"; format = "pyproject"; src = fetchFromGitHub { owner = "element-hq"; repo = "synapse"; rev = "v${version}"; - hash = "sha256-fEJ4gxftC9oPhmcvbMdwxbZsHVfed9NS8Sjb7BTmTQo="; + hash = "sha256-DNUKbb+d3BBp8guas6apQ4yFeXCc0Ilijtbt1hZkap4="; }; cargoDeps = rustPlatform.fetchCargoVendor { inherit src; name = "${pname}-${version}"; - hash = "sha256-P0JNGaRUd3fiwfPLnXQGeTDTURLgqO6g4KRIs86omYg="; + hash = "sha256-wI3vOfR5UpVFls2wPfgeIEj2+bmWdL3pDSsKfT+ysw8="; }; postPatch = '' diff --git a/pkgs/by-name/ow/owntone/package.nix b/pkgs/by-name/ow/owntone/package.nix index 5246cd9814b2..4fcfb8cd2616 100644 --- a/pkgs/by-name/ow/owntone/package.nix +++ b/pkgs/by-name/ow/owntone/package.nix @@ -37,14 +37,14 @@ }: stdenv.mkDerivation (finalAttrs: { - version = "28.11"; + version = "28.12"; pname = "owntone"; src = fetchFromGitHub { owner = "owntone"; repo = "owntone-server"; tag = "${finalAttrs.version}"; - hash = "sha256-lUelBZy7kAJ9tkvVbmxfXHiANJvhrnQydZkWiuoYTNU="; + hash = "sha256-Mj3G1+Hwa/zl0AM4SO6TcB4W3WJkpIDzrSPEFx0vaEk="; }; nativeBuildInputs = [ diff --git a/pkgs/by-name/yt/yt-dlp/package.nix b/pkgs/by-name/yt/yt-dlp/package.nix index a6dafaf9a74d..05c0bc68b689 100644 --- a/pkgs/by-name/yt/yt-dlp/package.nix +++ b/pkgs/by-name/yt/yt-dlp/package.nix @@ -17,13 +17,13 @@ python3Packages.buildPythonApplication rec { # The websites yt-dlp deals with are a very moving target. That means that # downloads break constantly. Because of that, updates should always be backported # to the latest stable release. - version = "2025.3.21"; + version = "2025.3.25"; pyproject = true; src = fetchPypi { inherit version; pname = "yt_dlp"; - hash = "sha256-W89HsolyVOo4FpNajd5H0kO/9VZ4LM7WsWorhea2gro="; + hash = "sha256-x/QlFvnfMdrvU8yiWQI5QBzzHbfE6spnZnz9gvLgric="; }; build-system = with python3Packages; [ diff --git a/pkgs/servers/sql/percona-server/8_4.nix b/pkgs/servers/sql/percona-server/8_4.nix index 0a43f44c1700..b8728dbb370d 100644 --- a/pkgs/servers/sql/percona-server/8_4.nix +++ b/pkgs/servers/sql/percona-server/8_4.nix @@ -51,11 +51,11 @@ assert !(withJemalloc && withTcmalloc); stdenv.mkDerivation (finalAttrs: { pname = "percona-server"; - version = "8.4.3-3"; + version = "8.4.4-4"; src = fetchurl { url = "https://downloads.percona.com/downloads/Percona-Server-${lib.versions.majorMinor finalAttrs.version}/Percona-Server-${finalAttrs.version}/source/tarball/percona-server-${finalAttrs.version}.tar.gz"; - hash = "sha256-37W0b8zYKErToJBU+aYtCmQjorcDtvuG0YbOwJzuZgo="; + hash = "sha256-10QYJQeCY3pFHmtBIQ72rsagicNJgHvNtbLPvjjUyg4="; }; nativeBuildInputs = [ diff --git a/pkgs/tools/misc/grub/default.nix b/pkgs/tools/misc/grub/default.nix index b5998456798d..f142862139d9 100644 --- a/pkgs/tools/misc/grub/default.nix +++ b/pkgs/tools/misc/grub/default.nix @@ -2,6 +2,7 @@ , gettext, ncurses, libusb-compat-0_1, freetype, qemu, lvm2, unifont, pkg-config , help2man , fetchzip +, fetchpatch , buildPackages , nixosTests , fuse # only needed for grub-mount @@ -76,6 +77,405 @@ stdenv.mkDerivation rec { patches = [ ./fix-bash-completion.patch ./add-hidden-menu-entries.patch + + # https://lists.gnu.org/archive/html/grub-devel/2025-02/msg00024.html + (fetchpatch { + name = "01_implement_grub_strlcpy.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=ea703528a8581a2ea7e0bad424a70fdf0aec7d8f"; + hash = "sha256-MSMgu1vMG83HRImUUsTyA1YQaIhgEreGGPd+ZDWSI2I="; + }) + (fetchpatch { + name = "02_CVE-2024-45781.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=c1a291b01f4f1dcd6a22b61f1c81a45a966d16ba"; + hash = "sha256-q8ErK+cQzaqwSuhLRFL3AfYBkpgJq1IQmadnlmlz2yw="; + }) + (fetchpatch { + name = "03_CVE-2024-45782_CVE-2024-56737.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=417547c10410b714e43f08f74137c24015f8f4c3"; + hash = "sha256-mRinw27WZ2d1grzyzFGO18yXx72UVBM6Lf5cR8XJfs8="; + }) + (fetchpatch { + name = "04_fs_tar_initialize_name_in_grub_cpio_find_file.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=2c8ac08c99466c0697f704242363fc687f492a0d"; + hash = "sha256-EMGF0B+Fw6tSmllWUJAp1ynzWk+w2C/XM1LmXSReHWg="; + }) + (fetchpatch { + name = "05_CVE-2024-45780.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=0087bc6902182fe5cedce2d034c75a79cf6dd4f3"; + hash = "sha256-IlW5i4EJVoUYPu9/lb0LeytTpzltQuu5fpkFPQNIhls="; + }) + (fetchpatch { + name = "06_fs_f2fs_grub_errno_mount_fails.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=563436258cde64da6b974880abff1bf0959f4da3"; + hash = "sha256-Iu0RPyB+pAnqMT+MTX+TrJbYJsvYPn7jbMgE1jcLh/Q="; + }) + (fetchpatch { + name = "07_CVE-2024-45783.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=f7c070a2e28dfab7137db0739fb8db1dc02d8898"; + hash = "sha256-V1wh2dPeTazmad61jFtOjhq2MdoD+txPWY/AfwwyTZM="; + }) + (fetchpatch { + name = "08_fs_iso9660_grub_errno_mount_fails.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=965db5970811d18069b34f28f5f31ddadde90a97"; + hash = "sha256-6eN1AvZwXkJOQVcjgymy/E7QiAxzL/d0W3KlAZRqUzI="; + }) + (fetchpatch { + name = "09_fs_iso9660_fix_invalid_free.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=1443833a9535a5873f7de3798cf4d8389f366611"; + hash = "sha256-Gt5yMy5Vg9zrDggj3o/TLNt2vT9/6IuHg4Se2p8e8pI="; + }) + (fetchpatch { + name = "10_fs_jfs_fix_oob_read_jfs_getent.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=66175696f3a385b14bdf1ebcda7755834bd2d5fb"; + hash = "sha256-ETbzbc5gvf55sTLjmJOXXC9VH3qcP1Gv5seR/U9NRiY="; + }) + (fetchpatch { + name = "11_fs_jfs_fix_oob_read_caused_by_invalid_dir_slot_index.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=ab09fd0531f3523ac0ef833404526c98c08248f7"; + hash = "sha256-wE6niiIx4BdN800/Eegb6IbBRoMFpXq9kPvatwhWNXY="; + }) + (fetchpatch { + name = "12_fs_jfs_use_full_40_bits_offset_and_address_for_data_extent.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=bd999310fe67f35a66de3bfa2836da91589d04ef"; + hash = "sha256-fbC4oTEIoGWJASzJI5RXfoanrMLTfjFOI51LCUU7Ctg="; + }) + (fetchpatch { + name = "13_fs_jfs_inconsistent_signed_unsigned_types_usage.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=edd995a26ec98654d907a9436a296c2d82bc4b28"; + hash = "sha256-aa1G1vi4bPZejfKEqZokAZTzY9Ea2lyxTrP4drDV9tk="; + }) + (fetchpatch { + name = "14_fs_ext2_fix_out-of-bounds_read_for_inline_extent.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=7e2f750f0a795c4d64ec7dc7591edac8da2e978c"; + hash = "sha256-PtPqZHMU2fy7btRRaaswLyHizplxnygCzDfcg5ievOQ="; + }) + (fetchpatch { + name = "15_fs_ntfs_fix_out-of-bounds_read.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=aff26318783a135562b904ff09e2359893885732"; + hash = "sha256-znN6lkAB9aAhTGKR1038DzOz5nzuTp+7ylHVqRM7HeI="; + }) + (fetchpatch { + name = "16_fs_ntfs_track_the_end_of_the_MFT_attribute_buffer.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=237a71184a32d1ef7732f5f49ed6a89c5fe1c99a"; + hash = "sha256-0I/g0qHkWY6PArPn1UaYRhCrrh9bHknADh34v5eSjjM="; + }) + (fetchpatch { + name = "17_fs_ntfs_use_a_helper_function_to_access_attributes.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=048777bc29043403d077d41a81d0183767b8bc71"; + hash = "sha256-Mm49MSLqCq143r8ruLJm1QoyCoLtOlCBfqoAPwPlv8E="; + }) + # Patch 18 (067b6d225d482280abad03944f04e30abcbdafa1) has been removed because it causes regressions + # https://lists.gnu.org/archive/html/grub-devel/2025-03/msg00067.html + (fetchpatch { + name = "19_fs_xfs_fix_out-of-bounds_read.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=6ccc77b59d16578b10eaf8a4fe85c20b229f0d8a"; + hash = "sha256-FvTzFvfEi3oyxPC/dUHreyzzeVCskaUlYUjpKY/l0DE="; + }) + (fetchpatch { + name = "20_fs_xfs_ensuring_failing_to_mount_sets_a_grub_errno.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=d1d6b7ea58aa5a80a4c4d0666b49460056c8ef0a"; + hash = "sha256-SLdXMmYHq/gRmWrjRrOu5ZYFod84EllUL6hk+gnr3kg="; + }) + (fetchpatch { + name = "21_kern_file_ensure_file_data_is_set.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=a7910687294b29288ac649e71b47493c93294f17"; + hash = "sha256-DabZK9eSToEmSA9dEwtEN+URiVyS9qf6e2Y2UiMuy8Q="; + }) + (fetchpatch { + name = "22_kern_file_implement_filesystem_reference_counting.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=16f196874fbe360a1b3c66064ec15adadf94c57b"; + excludes = [ "grub-core/fs/erofs.c" ]; # Does not exist on 2.12 + hash = "sha256-yGU//1tPaxi+xFKZrsbUAnvgFpwtrIMG+8cPbSud4+U="; + }) + (fetchpatch { + name = "23_prerequisite_1_key_protector_add_key_protectors_framework.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=5d260302da672258444b01239803c8f4d753e3f3"; + hash = "sha256-9WnFN6xMiv+1XMhNHgVEegkhwzp9KpRZI6MIZY/Ih3Q="; + }) + (fetchpatch { + name = "23_prerequisite_2_disk_cryptodisk_allow_user_to_retry_failed_passphrase.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=386b59ddb42fa3f86ddfe557113b25c8fa16f88c"; + hash = "sha256-e1kGQB7wGWvEb2bY3xIpZxE1uzTt9JOKi05jXyUm+bI="; + }) + (fetchpatch { + name = "23_prerequisite_3_cryptodisk_support_key_protectors.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=ad0c52784a375cecaa8715d7deadcf5d65baf173"; + hash = "sha256-+YIvUYA3fLiOFFsXDrQjqjWFluzLa7N1tv0lwq8BqCs="; + }) + (fetchpatch { + name = "23_prerequisite_4_cryptodisk_fallback_to_passphrase.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=6abf8af3c54abc04c4ec71c75d10fcfbc190e181"; + hash = "sha256-eMu9rW4iJucDAsTQMJD1XE6dDIcUmn02cGqIaqBbO3o="; + }) + (fetchpatch { + name = "23_prerequisite_5_cryptodisk_wipe_out_the_cached_keys_from_protectors.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=b35480b48e6f9506d8b7ad8a3b5206d29c24ea95"; + hash = "sha256-5L6Rr+X5Z+Ip91z8cpLcatDW1vyEoZa1icL2oMXPXuI="; + }) + (fetchpatch { + name = "23_prerequisite_6_cli_lock_add_build_option_to_block_command_line_interface.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=bb65d81fe320e4b20d0a9b32232a7546eb275ecc"; + hash = "sha256-HxXgtvEhtaIjXbOcxJHNpD9/NVOv3uXPnue7cagEMu8="; + }) + (fetchpatch { + name = "23_CVE-2024-49504.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=13febd78db3cd85dcba67d8ad03ad4d42815f11e"; + hash = "sha256-U7lNUb4iVAyQ1yEg5ECHCQGE51tKvY13T9Ji09Q1W9Y="; + }) + (fetchpatch { + name = "24_disk_loopback_reference_tracking_for_the_loopback.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=67f70f70a36b6e87a65f928fe1e840a12eafb7ae"; + hash = "sha256-sWBnSF3rAuY1A/IIK1Pc+BqTvyK3j7+lLEhvImtBQMA="; + }) + (fetchpatch { + name = "25_kern_disk_limit_recursion_depth.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=18212f0648b6de7d71d4c8f41eb4d8b78b3a299b"; + hash = "sha256-HiVzXUNs45Fxh4DSqO8wAxSBM7CaYU/bix0PVBcIHGw="; + }) + (fetchpatch { + name = "26_kern_partition_limit_recursion_in_part_iterate.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=8a7103fddfd6664f41081f3bb88eebbf2871da2a"; + hash = "sha256-Nw1VFRVww1VSDSBkRrnTGeaA2PKCitugM12XH6X/2YI="; + }) + (fetchpatch { + name = "27_script_execute_limit_the_recursion_depth.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=d8a937ccae5c6d86dc4375698afca5cefdcd01e1"; + hash = "sha256-YOAdPMZ2iBNMzIwAXFkkyTMKh4ptZUQ0J3v9EjnRlbo="; + }) + (fetchpatch { + name = "28_net_unregister_net_default_ip_and_net_default_mac_variables_hooks_on_unload.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=a1dd8e59da26f1a9608381d3a1a6c0f465282b1d"; + hash = "sha256-7fqdkhFqLECzhz1OLavkHrE9ktDAEmx9ZxZayNr/Eo4="; + }) + (fetchpatch { + name = "29_net_remove_variables_hooks_when_interface_is_unregisted.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=aa8b4d7facef7b75a2703274b1b9d4e0e734c401"; + hash = "sha256-m3VLDbJlwchV5meEpU4LJrDxBtA80qvYcVMJinHLnac="; + }) + (fetchpatch { + name = "30_CVE-2025-0624.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=5eef88152833062a3f7e017535372d64ac8ef7e1"; + hash = "sha256-DvhzHnenAmO9SZpi4kU+0GhyKZB4q4xQYuNJgEhJmn0="; + }) + (fetchpatch { + name = "31_net_tftp_fix_stack_buffer_overflow_in_tftp_open.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=0707accab1b9be5d3645d4700dde3f99209f9367"; + hash = "sha256-16NrpWFSE4jFT2uxmJg16jChw8HiGRTol25XQXNQ5l4="; + }) + (fetchpatch { + name = "32_CVE-2024-45774.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=2c34af908ebf4856051ed29e46d88abd2b20387f"; + hash = "sha256-OWmF+fp2TmetQjV4EWMcESW8u52Okkb5C5IPLfczyv4="; + }) + (fetchpatch { + name = "33_kern_dl_fix_for_an_integer_overflow_in_grub_dl_ref.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=500e5fdd82ca40412b0b73f5e5dda38e4a3af96d"; + hash = "sha256-FNqOWo+oZ4/1sCbTi2uaeKchUxwAKXtbzhScezm0yxk="; + }) + # Patch 34 (https://git.savannah.gnu.org/cgit/grub.git/patch/?id=d72208423dcabf9eb4a3bcb17b6b31888396bd49) + # is skipped, grub_dl_set_mem_attrs() does not exist on 2.12 + (fetchpatch { + name = "35_kern_dl_check_for_the_SHF_INFO_LINK_flag_in_grub_dl_relocate_symbols.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=98ad84328dcabfa603dcf5bd217570aa6b4bdd99"; + hash = "sha256-Zi4Pj2NbodL0VhhO5MWhvErb8xmA7Li0ur0MxpgQjzg="; + }) + (fetchpatch { + name = "36_CVE-2024-45775.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=05be856a8c3aae41f5df90cab7796ab7ee34b872"; + hash = "sha256-T6DO8iuImQTP7hPaCAHMtFnheQoCkZ6w+kfNolLPmrY="; + }) + (fetchpatch { + name = "37_commands_ls_fix_NULL_dereference.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=0bf56bce47489c059e50e61a3db7f682d8c44b56"; + hash = "sha256-h5okwqv4ZFahP3ANUbsk1fiSV4pwEnxUExeBgQ4tiTI="; + }) + (fetchpatch { + name = "38_CVE-2025-0622.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=2123c5bca7e21fbeb0263df4597ddd7054700726"; + hash = "sha256-tFE7VgImGZWDICyvHbrI1hqW6/XohgdTmk21MzljMGw="; + }) + (fetchpatch { + name = "39_CVE-2025-0622.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=9c16197734ada8d0838407eebe081117799bfe67"; + hash = "sha256-tTeuEvadKbXVuY0m0dKtTr11Lpb3yQi4zk0bpwrMOeA="; + }) + (fetchpatch { + name = "40_CVE-2025-0622.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=7580addfc8c94cedb0cdfd7a1fd65b539215e637"; + hash = "sha256-khRLpWqE7hzzoqssVkGFMjAv09T+uHn13Q9pCpogMms="; + }) + (fetchpatch { + name = "41_CVE-2024-45776.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=09bd6eb58b0f71ec273916070fa1e2de16897a91"; + hash = "sha256-yrl/6XUdKQg/MLe8KFuFoRRbQSyOhDmyvnWBV+sr3EY="; + }) + (fetchpatch { + name = "42_CVE-2024-45777.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=b970a5ed967816bbca8225994cd0ee2557bad515"; + hash = "sha256-Vl5Emw3O3Ba2hD1GCWune4PGduDDPO0gM5u+zx/OwKo="; + }) + (fetchpatch { + name = "43_CVE-2025-0690.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=dad8f502974ed9ad0a70ae6820d17b4b142558fc"; + hash = "sha256-DeWOncndX2VM8w1lb5fd5wHAZrI+ChB5Pj9XbUIfDWY="; + }) + (fetchpatch { + name = "44_commands_test_stack_overflow_due_to_unlimited_recursion_depth.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=c68b7d23628a19da67ebe2e06f84165ee04961af"; + hash = "sha256-aputM9KqkB/cK8hBiU9VXbu0LpLNlNCMVIeE9h2pMgY="; + }) + (fetchpatch { + name = "45_CVE-2025-1118.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=34824806ac6302f91e8cabaa41308eaced25725f"; + hash = "sha256-PKQs+fCwj4a9p4hbMqAT3tFNoAOw4xnbKmCwjPUgEOc="; + }) + (fetchpatch { + name = "46_commands_memrw_disable_memory_reading_in_lockdown_mode.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=340e4d058f584534f4b90b7dbea2b64a9f8c418c"; + hash = "sha256-NiMIUnfRreDBw+k4yxUzoRNMFL8pkJhVtkINVgmv5XA="; + }) + (fetchpatch { + name = "47_commands_hexdump_disable_memory_reading_in_lockdown_mode.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=5f31164aed51f498957cdd6ed733ec71a8592c99"; + hash = "sha256-NA7QjxZ9FP+WwiOveqLkbZqsF7hULIyaVS3gNaSUXJE="; + }) + (fetchpatch { + name = "48_CVE-2024-45778_CVE-2024-45779.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=26db6605036bd9e5b16d9068a8cc75be63b8b630"; + hash = "sha256-1+ImwkF/qsejWs2lpyO6xbcqVo2NJGv32gjrP8mEPnI="; + }) + (fetchpatch { + name = "49_CVE-2025-0677_CVE-2025-0684_CVE-2025-0685_CVE-2025-0686_CVE-2025-0689.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=c4bc55da28543d2522a939ba4ee0acde45f2fa74"; + hash = "sha256-qrlErSImMX8eXJHkXjOe5GZ6lWOya5SVpNoiqyEM1lE="; + }) + (fetchpatch { + name = "50_disk_use_safe_math_macros_to_prevent_overflows.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=c407724dad6c3e2fc1571e57adbda71cc03f82aa"; + hash = "sha256-kkAjxXvCdzwqh+oWtEF3qSPiUX9cGWO6eSFVeo7WJzQ="; + }) + (fetchpatch { + name = "51_disk_prevent_overflows_when_allocating_memory_for_arrays.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=d8151f98331ee4d15fcca59edffa59246d8fc15f"; + hash = "sha256-2U+gMLigOCCg3P1GB615xQ0B9PDA6j92tt1ba3Tqg+E="; + }) + (fetchpatch { + name = "52_disk_check_if_returned_pointer_for_allocated_memory_is_NULL.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=33bd6b5ac5c77b346769ab5284262f94e695e464"; + hash = "sha256-+BaJRskWP/YVEdvIxMvEydjQx2LpLlGphRtZjiOUxJ0="; + }) + (fetchpatch { + name = "53_disk_ieee1275_ofdisk_call_grub_ieee1275_close_when_grub_malloc_fails.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=fbaddcca541805c333f0fc792b82772594e73753"; + hash = "sha256-9sGA41HlB/8rtT/fMfkDo4ZJMXBSr+EyN92l/0gDfl4="; + }) + (fetchpatch { + name = "54_fs_use_safe_math_macros_to_prevent_overflows.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=6608163b08a7a8be4b0ab2a5cd4593bba07fe2b7"; + excludes = [ "grub-core/fs/erofs.c" ]; # Does not exist on 2.12 + hash = "sha256-mW4MH5VH5pDxCaFhNh/4mEcYloga56p8vCi7X4kSaek="; + }) + (fetchpatch { + name = "55_CVE-2025-0678_CVE-2025-1125.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=84bc0a9a68835952ae69165c11709811dae7634e"; + hash = "sha256-rCliqM2+k7rTGNpdHFkg3pHvuISjoG0MQr6/8lIvwK4="; + }) + (fetchpatch { + name = "56_fs_prevent_overflows_when_assigning_returned_values_from_read_number.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=cde9f7f338f8f5771777f0e7dfc423ddf952ad31"; + hash = "sha256-dN3HJXNIYtaUZL0LhLabC4VKK6CVC8km9UTw/ln/6ys="; + }) + (fetchpatch { + name = "57_fs_zfs_use_safe_math_macros_to_prevent_overflows.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=88e491a0f744c6b19b6d4caa300a576ba56db7c9"; + hash = "sha256-taSuKyCf9+TiQZcF26yMWpDDQqCfTdRuZTqB9aEz3aA="; + }) + (fetchpatch { + name = "58_fs_zfs_prevent_overflows_when_allocating_memory_for_arrays.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=7f38e32c7ebeaebb79e2c71e3c7d5ea367d3a39c"; + hash = "sha256-E5VmP7I4TAEXxTz3j7mi/uIr9kOSzMoPHAYAbyu56Xk="; + }) + (fetchpatch { + name = "59_fs_zfs_check_if_returned_pointer_for_allocated_memory_is_NULL.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=13065f69dae0eeb60813809026de5bd021051892"; + hash = "sha256-1W//rHUspDS+utdNc069J8lX1ONfoBKiJYnUt46C/D0="; + }) + (fetchpatch { + name = "60_fs_zfs_add_missing_NULL_check_after_grub_strdup_call.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=dd6a4c8d10e02ca5056681e75795041a343636e4"; + hash = "sha256-iFLEkz5G6aQ8FXGuY7/wgN4d4o0+sUxWMKYIFcQ/H+o="; + }) + (fetchpatch { + name = "61_net_use_safe_math_macros_to_prevent_overflows.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=4beeff8a31c4fb4071d2225533cfa316b5a58391"; + hash = "sha256-/gs5ZhplQ1h7PWw0p+b5+0OxmRcvDRKWHj39ezhivcg="; + }) + (fetchpatch { + name = "62_net_prevent_overflows_when_allocating_memory_for_arrays.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=dee2c14fd66bc497cdc74c69fde8c9b84637c8eb"; + hash = "sha256-cO02tCGEeQhQF0TmgtNOgUwRLnNgmxhEefo1gtSlFOk="; + }) + (fetchpatch { + name = "63_net_check_if_returned_pointer_for_allocated_memory_is_NULL.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=1c06ec900591d1fab6fbacf80dc010541d0a5ec8"; + hash = "sha256-oSRhWWVraitoVDqGlFOVzdCkaNqFGOHLjJu75CSc388="; + }) + (fetchpatch { + name = "64_fs_sfs_check_if_allocated_memory_is_NULL.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=e3c578a56f9294e286b6028ca7c1def997a17b15"; + hash = "sha256-7tvFbmjWmWmmRykQjMvZV6IYlhSS8oNR7YfaO5XXAfU="; + }) + (fetchpatch { + name = "65_script_execute_fix_potential_underflow_and_NULL.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=d13b6e8ebd10b4eb16698a002aa40258cf6e6f0e"; + hash = "sha256-paMWaAIImzxtufUrVF5v4T4KnlDAJIPhdaHznu5CyZ8="; + }) + (fetchpatch { + name = "66_osdep_unix_getroot_fix_potential_underflow.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=66733f7c7dae889861ea3ef3ec0710811486019e"; + hash = "sha256-/14HC1kcW7Sy9WfJQFfC+YnvS/GNTMP+Uy6Dxd3zkwc="; + }) + (fetchpatch { + name = "67_misc_ensure_consistent_overflow_error_messages.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=f8795cde217e21539c2f236bcbb1a4bf521086b3"; + hash = "sha256-4X7wr1Tg16xDE9FO6NTlgkfLV5zFKmajeaOspIqcCuI="; + }) + (fetchpatch { + name = "68_bus_usb_ehci_define_GRUB_EHCI_TOGGLE_as_grub_uint32_t.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=9907d9c2723304b42cf6da74f1cc6c4601391956"; + hash = "sha256-D8xaI8g7ffGGmZqqeS8wxWIFLUWUBfmHwMVOHkYTc2I="; + }) + (fetchpatch { + name = "69_normal_menu_use_safe_math_to_avoid_an_integer_overflow.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=5b36a5210e21bee2624f8acc36aefd8f10266adb"; + hash = "sha256-UourmM0Zlaj4o+SnYi5AtjfNujDOt+2ez2XH/uWyiaM="; + }) + (fetchpatch { + name = "70_kern_partition_add_sanity_check_after_grub_strtoul_call.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=8e6e87e7923ca2ae880021cb42a35cc9bb4c8fe2"; + hash = "sha256-4keMUu6ZDKmuSQlFnldV15dDGUibsnSvoEWhLsqWieI="; + }) + (fetchpatch { + name = "71_kern_misc_add_sanity_check_after_grub_strtoul_call.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=a8d6b06331a75d75b46f3dd6cc6fcd40dcf604b7"; + hash = "sha256-2Mpe1sqyuoUPyMAKGZTNzG/ig3G3K8w0gia7lc508Rg="; + }) + (fetchpatch { + name = "72_loader_i386_linux_cast_left_shift_to_grub_uint32_t.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=490a6ab71cebd96fae7a1ceb9067484f5ccbec2a"; + hash = "sha256-e49OC1EBaX0/nWTTXT5xE5apTJPQV0myP5Ohxn9Wwa8="; + }) + (fetchpatch { + name = "73_loader_i386_bsd_use_safe_math_to_avoid_underflow.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=4dc6166571645780c459dde2cdc1b001a5ec844c"; + hash = "sha256-e8X+oBvejcFNOY1Tp/f6QqCDwrgK7f9u1F8SdO/dhy4="; + }) + (fetchpatch { + # Fixes 7e2f750f0a (security patch 14/73) + name = "fs_ext2_rework_out-of-bounds_read_for_inline_and_external_extents.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=348cd416a3574348f4255bf2b04ec95938990997"; + hash = "sha256-WBLYQxv8si2tvdPAvbm0/4NNqYWBMJpFV4GC0HhN/kE="; + }) ]; postPatch = if kbdcompSupport then '' diff --git a/pkgs/tools/networking/veilid/default.nix b/pkgs/tools/networking/veilid/default.nix index ca1c022b8018..d6c66cc514cd 100644 --- a/pkgs/tools/networking/veilid/default.nix +++ b/pkgs/tools/networking/veilid/default.nix @@ -15,24 +15,17 @@ rustPlatform.buildRustPackage rec { pname = "veilid"; - version = "0.4.3"; + version = "0.4.4"; src = fetchFromGitLab { owner = "veilid"; repo = pname; rev = "v${version}"; - hash = "sha256-D6mfYiUj9W+2l/is/KkzwIQ1Erbapf5dl4uWGKd42r4="; + hash = "sha256-p9bQ90zUXVeVPUDuns+gmZb9SJHpAVrJOHe+RvEru7w="; }; - cargoLock = { - lockFile = ./Cargo.lock; - outputHashes = { - "ansi-parser-0.9.1" = "sha256-Vdjt8QDstrfxYfklZ5vYPGhVNG1BVh4cpKGwvvsHlS4="; - "cursive-0.20.0" = "sha256-EGKO7JVN9hIqADKKC3mUHHOCSxMjPoXzYBZujzdgk3E="; - "cursive_buffered_backend-0.6.1" = "sha256-+sTJnp570HupwaJxV2x+oKyLwNmqQ4HqOH2P1s9Hhw8="; - "cursive_table_view-0.14.0" = "sha256-haos82qtobMsFCP3sNRu5u1mki4bsjrV+eqFxUGIHqk="; - }; - }; + useFetchCargoVendor = true; + cargoHash = "sha256-xbtlZ7PP+RHPlW4a9UCmaCOcsQkDyPim3yPObbXVqns="; nativeBuildInputs = [ capnproto diff --git a/pkgs/tools/package-management/nix/common.nix b/pkgs/tools/package-management/nix/common.nix index daae2ed63586..b9cc226428ba 100644 --- a/pkgs/tools/package-management/nix/common.nix +++ b/pkgs/tools/package-management/nix/common.nix @@ -5,7 +5,7 @@ , hash ? null , src ? fetchFromGitHub { owner = "NixOS"; repo = "nix"; rev = version; inherit hash; } , patches ? [ ] -, maintainers ? with lib.maintainers; [ eelco lovesegfault artturin ] +, maintainers ? lib.teams.nix.members ++ [ lib.maintainers.lovesegfault lib.maintainers.artturin ] , self_attribute_name }@args: assert (hash == null) -> (src != null); diff --git a/pkgs/tools/package-management/nix/default.nix b/pkgs/tools/package-management/nix/default.nix index 6dc26a527f37..f00a78ba6615 100644 --- a/pkgs/tools/package-management/nix/default.nix +++ b/pkgs/tools/package-management/nix/default.nix @@ -1,24 +1,25 @@ -{ lib -, config -, stdenv -, aws-sdk-cpp -, boehmgc -, libgit2 -, callPackage -, fetchFromGitHub -, fetchpatch -, fetchpatch2 -, runCommand -, buildPackages -, Security -, pkgs -, pkgsi686Linux -, pkgsStatic -, nixosTests +{ + lib, + config, + stdenv, + aws-sdk-cpp, + boehmgc, + libgit2, + callPackage, + fetchFromGitHub, + fetchpatch, + fetchpatch2, + runCommand, + buildPackages, + Security, + pkgs, + pkgsi686Linux, + pkgsStatic, + nixosTests, -, storeDir ? "/nix/store" -, stateDir ? "/nix/var" -, confDir ? "/etc" + storeDir ? "/nix/store", + stateDir ? "/nix/var", + confDir ? "/etc", }: let boehmgc-nix_2_3 = boehmgc.override { enableLargeConfig = true; }; @@ -31,96 +32,118 @@ let }); # old nix fails to build with newer aws-sdk-cpp and the patch doesn't apply - aws-sdk-cpp-old-nix = (aws-sdk-cpp.override { - apis = [ "s3" "transfer" ]; - customMemoryManagement = false; - }).overrideAttrs (args: rec { - # intentionally overriding postPatch - version = "1.9.294"; + aws-sdk-cpp-old-nix = + (aws-sdk-cpp.override { + apis = [ + "s3" + "transfer" + ]; + customMemoryManagement = false; + }).overrideAttrs + (args: rec { + # intentionally overriding postPatch + version = "1.9.294"; - src = fetchFromGitHub { - owner = "aws"; - repo = "aws-sdk-cpp"; - rev = version; - hash = "sha256-Z1eRKW+8nVD53GkNyYlZjCcT74MqFqqRMeMc33eIQ9g="; - }; - postPatch = '' - # Avoid blanket -Werror to evade build failures on less - # tested compilers. - substituteInPlace cmake/compiler_settings.cmake \ - --replace '"-Werror"' ' ' + src = fetchFromGitHub { + owner = "aws"; + repo = "aws-sdk-cpp"; + rev = version; + hash = "sha256-Z1eRKW+8nVD53GkNyYlZjCcT74MqFqqRMeMc33eIQ9g="; + }; + postPatch = + '' + # Avoid blanket -Werror to evade build failures on less + # tested compilers. + substituteInPlace cmake/compiler_settings.cmake \ + --replace '"-Werror"' ' ' - # Missing includes for GCC11 - sed '5i#include ' -i \ - aws-cpp-sdk-cloudfront-integration-tests/CloudfrontOperationTest.cpp \ - aws-cpp-sdk-cognitoidentity-integration-tests/IdentityPoolOperationTest.cpp \ - aws-cpp-sdk-dynamodb-integration-tests/TableOperationTest.cpp \ - aws-cpp-sdk-elasticfilesystem-integration-tests/ElasticFileSystemTest.cpp \ - aws-cpp-sdk-lambda-integration-tests/FunctionTest.cpp \ - aws-cpp-sdk-mediastore-data-integration-tests/MediaStoreDataTest.cpp \ - aws-cpp-sdk-queues/source/sqs/SQSQueue.cpp \ - aws-cpp-sdk-redshift-integration-tests/RedshiftClientTest.cpp \ - aws-cpp-sdk-s3-crt-integration-tests/BucketAndObjectOperationTest.cpp \ - aws-cpp-sdk-s3-integration-tests/BucketAndObjectOperationTest.cpp \ - aws-cpp-sdk-s3control-integration-tests/S3ControlTest.cpp \ - aws-cpp-sdk-sqs-integration-tests/QueueOperationTest.cpp \ - aws-cpp-sdk-transfer-tests/TransferTests.cpp - # Flaky on Hydra - rm aws-cpp-sdk-core-tests/aws/auth/AWSCredentialsProviderTest.cpp - # Includes aws-c-auth private headers, so only works with submodule build - rm aws-cpp-sdk-core-tests/aws/auth/AWSAuthSignerTest.cpp - # TestRandomURLMultiThreaded fails - rm aws-cpp-sdk-core-tests/http/HttpClientTest.cpp - '' + lib.optionalString aws-sdk-cpp.stdenv.hostPlatform.isi686 '' - # EPSILON is exceeded - rm aws-cpp-sdk-core-tests/aws/client/AdaptiveRetryStrategyTest.cpp - ''; + # Missing includes for GCC11 + sed '5i#include ' -i \ + aws-cpp-sdk-cloudfront-integration-tests/CloudfrontOperationTest.cpp \ + aws-cpp-sdk-cognitoidentity-integration-tests/IdentityPoolOperationTest.cpp \ + aws-cpp-sdk-dynamodb-integration-tests/TableOperationTest.cpp \ + aws-cpp-sdk-elasticfilesystem-integration-tests/ElasticFileSystemTest.cpp \ + aws-cpp-sdk-lambda-integration-tests/FunctionTest.cpp \ + aws-cpp-sdk-mediastore-data-integration-tests/MediaStoreDataTest.cpp \ + aws-cpp-sdk-queues/source/sqs/SQSQueue.cpp \ + aws-cpp-sdk-redshift-integration-tests/RedshiftClientTest.cpp \ + aws-cpp-sdk-s3-crt-integration-tests/BucketAndObjectOperationTest.cpp \ + aws-cpp-sdk-s3-integration-tests/BucketAndObjectOperationTest.cpp \ + aws-cpp-sdk-s3control-integration-tests/S3ControlTest.cpp \ + aws-cpp-sdk-sqs-integration-tests/QueueOperationTest.cpp \ + aws-cpp-sdk-transfer-tests/TransferTests.cpp + # Flaky on Hydra + rm aws-cpp-sdk-core-tests/aws/auth/AWSCredentialsProviderTest.cpp + # Includes aws-c-auth private headers, so only works with submodule build + rm aws-cpp-sdk-core-tests/aws/auth/AWSAuthSignerTest.cpp + # TestRandomURLMultiThreaded fails + rm aws-cpp-sdk-core-tests/http/HttpClientTest.cpp + '' + + lib.optionalString aws-sdk-cpp.stdenv.hostPlatform.isi686 '' + # EPSILON is exceeded + rm aws-cpp-sdk-core-tests/aws/client/AdaptiveRetryStrategyTest.cpp + ''; - patches = (args.patches or [ ]) ++ [ ./patches/aws-sdk-cpp-TransferManager-ContentEncoding.patch ]; + patches = (args.patches or [ ]) ++ [ ./patches/aws-sdk-cpp-TransferManager-ContentEncoding.patch ]; - # only a stripped down version is build which takes a lot less resources to build - requiredSystemFeatures = [ ]; - }); + # only a stripped down version is build which takes a lot less resources to build + requiredSystemFeatures = [ ]; + }); - aws-sdk-cpp-nix = (aws-sdk-cpp.override { - apis = [ "s3" "transfer" ]; - customMemoryManagement = false; - }).overrideAttrs { - # only a stripped down version is build which takes a lot less resources to build - requiredSystemFeatures = [ ]; - }; + aws-sdk-cpp-nix = + (aws-sdk-cpp.override { + apis = [ + "s3" + "transfer" + ]; + customMemoryManagement = false; + }).overrideAttrs + { + # only a stripped down version is build which takes a lot less resources to build + requiredSystemFeatures = [ ]; + }; libgit2-thin-packfile = libgit2.overrideAttrs (args: { - nativeBuildInputs = args.nativeBuildInputs or [] + nativeBuildInputs = + args.nativeBuildInputs or [ ] # gitMinimal does not build on Windows. See packbuilder patch. ++ lib.optionals (!stdenv.hostPlatform.isWindows) [ # Needed for `git apply`; see `prePatch` buildPackages.gitMinimal ]; # Only `git apply` can handle git binary patches - prePatch = args.prePatch or "" + prePatch = + args.prePatch or "" + lib.optionalString (!stdenv.hostPlatform.isWindows) '' patch() { git apply } ''; # taken from https://github.com/NixOS/nix/tree/master/packaging/patches - patches = (args.patches or []) ++ [ - ./patches/libgit2-mempack-thin-packfile.patch - ] ++ lib.optionals (!stdenv.hostPlatform.isWindows) [ - ./patches/libgit2-packbuilder-callback-interruptible.patch - ]; + patches = + (args.patches or [ ]) + ++ [ + ./patches/libgit2-mempack-thin-packfile.patch + ] + ++ lib.optionals (!stdenv.hostPlatform.isWindows) [ + ./patches/libgit2-packbuilder-callback-interruptible.patch + ]; }); - common = args: - callPackage - (import ./common.nix ({ inherit lib fetchFromGitHub; } // args)) - { - inherit Security storeDir stateDir confDir; - boehmgc = boehmgc-nix; - aws-sdk-cpp = if lib.versionAtLeast args.version "2.12pre" then aws-sdk-cpp-nix else aws-sdk-cpp-old-nix; - libgit2 = if lib.versionAtLeast args.version "2.25.0" then libgit2-thin-packfile else libgit2; - }; + common = + args: + callPackage (import ./common.nix ({ inherit lib fetchFromGitHub; } // args)) { + inherit + Security + storeDir + stateDir + confDir + ; + boehmgc = boehmgc-nix; + aws-sdk-cpp = + if lib.versionAtLeast args.version "2.12pre" then aws-sdk-cpp-nix else aws-sdk-cpp-old-nix; + libgit2 = if lib.versionAtLeast args.version "2.25.0" then libgit2-thin-packfile else libgit2; + }; # https://github.com/NixOS/nix/pull/7585 patch-monitorfdhup = fetchpatch2 { @@ -131,170 +154,208 @@ let # Intentionally does not support overrideAttrs etc # Use only for tests that are about the package relation to `pkgs` and/or NixOS. - addTestsShallowly = tests: pkg: pkg // { - tests = pkg.tests // tests; - # In case someone reads the wrong attribute - passthru.tests = pkg.tests // tests; - }; + addTestsShallowly = + tests: pkg: + pkg + // { + tests = pkg.tests // tests; + # In case someone reads the wrong attribute + passthru.tests = pkg.tests // tests; + }; - addFallbackPathsCheck = pkg: addTestsShallowly - { nix-fallback-paths = - runCommand "test-nix-fallback-paths-version-equals-nix-stable" { - paths = lib.concatStringsSep "\n" (builtins.attrValues (import ../../../../nixos/modules/installer/tools/nix-fallback-paths.nix)); - } '' - # NOTE: name may contain cross compilation details between the pname - # and version this is permitted thanks to ([^-]*-)* - if [[ "" != $(grep -vE 'nix-([^-]*-)*${lib.strings.replaceStrings ["."] ["\\."] pkg.version}$' <<< "$paths") ]]; then - echo "nix-fallback-paths not up to date with nixVersions.stable (nix-${pkg.version})" - echo "The following paths are not up to date:" - grep -v 'nix-${pkg.version}$' <<< "$paths" - echo - echo "Fix it by running in nixpkgs:" - echo - echo "curl https://releases.nixos.org/nix/nix-${pkg.version}/fallback-paths.nix >nixos/modules/installer/tools/nix-fallback-paths.nix" - echo - exit 1 - else - echo "nix-fallback-paths versions up to date" - touch $out - fi - ''; - } - pkg; + addFallbackPathsCheck = + pkg: + addTestsShallowly { + nix-fallback-paths = + runCommand "test-nix-fallback-paths-version-equals-nix-stable" + { + paths = lib.concatStringsSep "\n" ( + builtins.attrValues (import ../../../../nixos/modules/installer/tools/nix-fallback-paths.nix) + ); + } + '' + # NOTE: name may contain cross compilation details between the pname + # and version this is permitted thanks to ([^-]*-)* + if [[ "" != $(grep -vE 'nix-([^-]*-)*${ + lib.strings.replaceStrings [ "." ] [ "\\." ] pkg.version + }$' <<< "$paths") ]]; then + echo "nix-fallback-paths not up to date with nixVersions.stable (nix-${pkg.version})" + echo "The following paths are not up to date:" + grep -v 'nix-${pkg.version}$' <<< "$paths" + echo + echo "Fix it by running in nixpkgs:" + echo + echo "curl https://releases.nixos.org/nix/nix-${pkg.version}/fallback-paths.nix >nixos/modules/installer/tools/nix-fallback-paths.nix" + echo + exit 1 + else + echo "nix-fallback-paths versions up to date" + touch $out + fi + ''; + } pkg; # (meson based packaging) # Add passthru tests to the package, and re-expose package set overriding # functions. This will not incorporate the tests into the package set. # TODO (roberth): add package-set level overriding to the "everything" package. - addTests = selfAttributeName: pkg: + addTests = + selfAttributeName: pkg: let tests = - pkg.tests or {} + pkg.tests or { } // import ./tests.nix { - inherit runCommand lib stdenv pkgs pkgsi686Linux pkgsStatic nixosTests; + inherit + runCommand + lib + stdenv + pkgs + pkgsi686Linux + pkgsStatic + nixosTests + ; inherit (pkg) version src; nix = pkg; self_attribute_name = selfAttributeName; }; in # preserve old pkg, including overrideSource, etc - pkg // { - tests = pkg.tests or {} // tests; - passthru = pkg.passthru or {} // { - tests = lib.warn "nix.passthru.tests is deprecated. Use nix.tests instead." pkg.passthru.tests or {} // tests; + pkg + // { + tests = pkg.tests or { } // tests; + passthru = pkg.passthru or { } // { + tests = + lib.warn "nix.passthru.tests is deprecated. Use nix.tests instead." pkg.passthru.tests or { } + // tests; }; }; -in lib.makeExtensible (self: ({ - nix_2_3 = ((common { - version = "2.3.18"; - hash = "sha256-jBz2Ub65eFYG+aWgSI3AJYvLSghio77fWQiIW1svA9U="; - patches = [ - patch-monitorfdhup - ]; - self_attribute_name = "nix_2_3"; - maintainers = with lib.maintainers; [ flokli ]; - }).override { boehmgc = boehmgc-nix_2_3; }).overrideAttrs { - # https://github.com/NixOS/nix/issues/10222 - # spurious test/add.sh failures - enableParallelChecking = false; - }; +in +lib.makeExtensible ( + self: + ( + { + nix_2_3 = + ( + (common { + version = "2.3.18"; + hash = "sha256-jBz2Ub65eFYG+aWgSI3AJYvLSghio77fWQiIW1svA9U="; + patches = [ + patch-monitorfdhup + ]; + self_attribute_name = "nix_2_3"; + maintainers = with lib.maintainers; [ flokli ]; + }).override + { boehmgc = boehmgc-nix_2_3; } + ).overrideAttrs + { + # https://github.com/NixOS/nix/issues/10222 + # spurious test/add.sh failures + enableParallelChecking = false; + }; - nix_2_18 = common { - version = "2.18.9"; - hash = "sha256-RrOFlDGmRXcVRV2p2HqHGqvzGNyWoD0Dado/BNlJ1SI="; - self_attribute_name = "nix_2_18"; - }; + nix_2_18 = common { + version = "2.18.9"; + hash = "sha256-RrOFlDGmRXcVRV2p2HqHGqvzGNyWoD0Dado/BNlJ1SI="; + self_attribute_name = "nix_2_18"; + }; - nix_2_19 = common { - version = "2.19.7"; - hash = "sha256-CkT1SNwRYYQdN2X4cTt1WX3YZfKZFWf7O1YTEo1APfc="; - self_attribute_name = "nix_2_19"; - }; + nix_2_19 = common { + version = "2.19.7"; + hash = "sha256-CkT1SNwRYYQdN2X4cTt1WX3YZfKZFWf7O1YTEo1APfc="; + self_attribute_name = "nix_2_19"; + }; - nix_2_20 = common { - version = "2.20.9"; - hash = "sha256-b7smrbPLP/wcoBFCJ8j1UDNj0p4jiKT/6mNlDdlrOXA="; - self_attribute_name = "nix_2_20"; - }; + nix_2_20 = common { + version = "2.20.9"; + hash = "sha256-b7smrbPLP/wcoBFCJ8j1UDNj0p4jiKT/6mNlDdlrOXA="; + self_attribute_name = "nix_2_20"; + }; - nix_2_21 = common { - version = "2.21.5"; - hash = "sha256-/+TLpd6hvYMJFoeJvVZ+bZzjwY/jP6CxJRGmwKcXbI0="; - self_attribute_name = "nix_2_21"; - }; + nix_2_21 = common { + version = "2.21.5"; + hash = "sha256-/+TLpd6hvYMJFoeJvVZ+bZzjwY/jP6CxJRGmwKcXbI0="; + self_attribute_name = "nix_2_21"; + }; - nix_2_22 = common { - version = "2.22.4"; - hash = "sha256-JWjJzMA+CeyImMgP2dhSBHQW4CS8wg7fc2zQ4WdKuBo="; - self_attribute_name = "nix_2_22"; - }; + nix_2_22 = common { + version = "2.22.4"; + hash = "sha256-JWjJzMA+CeyImMgP2dhSBHQW4CS8wg7fc2zQ4WdKuBo="; + self_attribute_name = "nix_2_22"; + }; - nix_2_23 = common { - version = "2.23.4"; - hash = "sha256-rugH4TUicHEdVfy3UuAobFIutqbuVco8Yg/z81g7clE="; - self_attribute_name = "nix_2_23"; - }; + nix_2_23 = common { + version = "2.23.4"; + hash = "sha256-rugH4TUicHEdVfy3UuAobFIutqbuVco8Yg/z81g7clE="; + self_attribute_name = "nix_2_23"; + }; - nix_2_24 = common { - version = "2.24.12"; - hash = "sha256-lPiheE0D146tstoUInOUf1451stezrd8j6H6w7+RCv8="; - self_attribute_name = "nix_2_24"; - }; + nix_2_24 = common { + version = "2.24.12"; + hash = "sha256-lPiheE0D146tstoUInOUf1451stezrd8j6H6w7+RCv8="; + self_attribute_name = "nix_2_24"; + }; - nix_2_25 = common { - version = "2.25.2"; - hash = "sha256-MZNpb4awWHXU+kGmH58VUB7M9l6UVo33riuQLTbMh4E="; - self_attribute_name = "nix_2_25"; - }; + nix_2_25 = common { + version = "2.25.2"; + hash = "sha256-MZNpb4awWHXU+kGmH58VUB7M9l6UVo33riuQLTbMh4E="; + self_attribute_name = "nix_2_25"; + }; - nix_2_26 = addTests "nix_2_26" (callPackage ./vendor/2_26/componentized.nix { - inherit (self.nix_2_24.meta) maintainers; - inherit libgit2-thin-packfile; - }); + nix_2_26 = addTests "nix_2_26" ( + callPackage ./vendor/2_26/componentized.nix { + inherit (self.nix_2_24.meta) maintainers; + inherit libgit2-thin-packfile; + } + ); - git = common rec { - version = "2.25.0"; - suffix = "pre20241101_${lib.substring 0 8 src.rev}"; - src = fetchFromGitHub { - owner = "NixOS"; - repo = "nix"; - rev = "2e5759e3778c460efc5f7cfc4cb0b84827b5ffbe"; - hash = "sha256-E1Sp0JHtbD1CaGO3UbBH6QajCtOGqcrVfPSKL0n63yo="; - }; - self_attribute_name = "git"; - }; + git = common rec { + version = "2.25.0"; + suffix = "pre20241101_${lib.substring 0 8 src.rev}"; + src = fetchFromGitHub { + owner = "NixOS"; + repo = "nix"; + rev = "2e5759e3778c460efc5f7cfc4cb0b84827b5ffbe"; + hash = "sha256-E1Sp0JHtbD1CaGO3UbBH6QajCtOGqcrVfPSKL0n63yo="; + }; + self_attribute_name = "git"; + }; - latest = self.nix_2_24; + latest = self.nix_2_24; - # The minimum Nix version supported by Nixpkgs - # Note that some functionality *might* have been backported into this Nix version, - # making this package an inaccurate representation of what features are available - # in the actual lowest minver.nix *patch* version. - minimum = - let - minver = import ../../../../lib/minver.nix; - major = lib.versions.major minver; - minor = lib.versions.minor minver; - attribute = "nix_${major}_${minor}"; - nix = self.${attribute}; - in - if ! self ? ${attribute} then - throw "The minimum supported Nix version is ${minver} (declared in lib/minver.nix), but pkgs.nixVersions.${attribute} does not exist." - else - nix; + # The minimum Nix version supported by Nixpkgs + # Note that some functionality *might* have been backported into this Nix version, + # making this package an inaccurate representation of what features are available + # in the actual lowest minver.nix *patch* version. + minimum = + let + minver = import ../../../../lib/minver.nix; + major = lib.versions.major minver; + minor = lib.versions.minor minver; + attribute = "nix_${major}_${minor}"; + nix = self.${attribute}; + in + if !self ? ${attribute} then + throw "The minimum supported Nix version is ${minver} (declared in lib/minver.nix), but pkgs.nixVersions.${attribute} does not exist." + else + nix; - # Read ./README.md before bumping a major release - stable = addFallbackPathsCheck self.nix_2_24; -} // lib.optionalAttrs config.allowAliases ( - lib.listToAttrs (map ( - minor: - let - attr = "nix_2_${toString minor}"; - in - lib.nameValuePair attr (throw "${attr} has been removed") - ) (lib.range 4 17)) - // { - unstable = throw "nixVersions.unstable has been removed. For bleeding edge (Nix master, roughly weekly updated) use nixVersions.git, otherwise use nixVersions.latest."; - } -))) + # Read ./README.md before bumping a major release + stable = addFallbackPathsCheck self.nix_2_24; + } + // lib.optionalAttrs config.allowAliases ( + lib.listToAttrs ( + map ( + minor: + let + attr = "nix_2_${toString minor}"; + in + lib.nameValuePair attr (throw "${attr} has been removed") + ) (lib.range 4 17) + ) + // { + unstable = throw "nixVersions.unstable has been removed. For bleeding edge (Nix master, roughly weekly updated) use nixVersions.git, otherwise use nixVersions.latest."; + } + ) + ) +)