From 54671317585c9d082e354c45a07e0a7691beb9ea Mon Sep 17 00:00:00 2001 From: Konrad Borowski Date: Sat, 11 Dec 2021 22:43:17 +0100 Subject: [PATCH 01/15] metabase: 0.38.0 -> 0.38.6 --- pkgs/servers/metabase/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/servers/metabase/default.nix b/pkgs/servers/metabase/default.nix index d64279bf7e17..f0b0207348bf 100644 --- a/pkgs/servers/metabase/default.nix +++ b/pkgs/servers/metabase/default.nix @@ -2,11 +2,11 @@ stdenv.mkDerivation rec { pname = "metabase"; - version = "0.38.0"; + version = "0.38.6"; src = fetchurl { url = "https://downloads.metabase.com/v${version}/metabase.jar"; - sha256 = "170fj2cc7drh6c1dgl60f9n79vfrsw2v57lmds677naxnq254jhp"; + sha256 = "0agjz8cw70bpddmyrd5l2rg442bjpgrx6qi2nn1d33kbin7klvj5"; }; nativeBuildInputs = [ makeWrapper ]; From c5cece7d8b4ba5ab96f0b9794f06c6b28dec31df Mon Sep 17 00:00:00 2001 From: Konrad Borowski Date: Sat, 11 Dec 2021 00:11:52 +0100 Subject: [PATCH 02/15] metabase: add passthru tests (cherry picked from commit 9eee84f9f067195c9901326f30f39bc0c0b680a2) --- pkgs/servers/metabase/default.nix | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/pkgs/servers/metabase/default.nix b/pkgs/servers/metabase/default.nix index f0b0207348bf..55a2fbacf01b 100644 --- a/pkgs/servers/metabase/default.nix +++ b/pkgs/servers/metabase/default.nix @@ -1,4 +1,4 @@ -{ lib, stdenv, fetchurl, makeWrapper, jdk11 }: +{ lib, stdenv, fetchurl, makeWrapper, jdk11, nixosTests }: stdenv.mkDerivation rec { pname = "metabase"; @@ -24,4 +24,7 @@ stdenv.mkDerivation rec { platforms = platforms.all; maintainers = with maintainers; [ schneefux thoughtpolice mmahut ]; }; + passthru.tests = { + inherit (nixosTests) metabase; + }; } From d7e0ee3b3af63d91327cdde398105dbf557c5b45 Mon Sep 17 00:00:00 2001 From: Joerie de Gram Date: Sat, 11 Dec 2021 20:02:15 +0100 Subject: [PATCH 03/15] zap: 2.11.0 -> 2.11.1 Fixes CVE-2021-44228 #150288 (cherry picked from commit be4883e2181a7f9e1513be091ea573f9f2411c81) --- pkgs/tools/networking/zap/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/tools/networking/zap/default.nix b/pkgs/tools/networking/zap/default.nix index 69c5f165b276..8fdf8a38f317 100644 --- a/pkgs/tools/networking/zap/default.nix +++ b/pkgs/tools/networking/zap/default.nix @@ -2,10 +2,10 @@ stdenv.mkDerivation rec { pname = "zap"; - version = "2.11.0"; + version = "2.11.1"; src = fetchurl { url = "https://github.com/zaproxy/zaproxy/releases/download/v${version}/ZAP_${version}_Linux.tar.gz"; - sha256 = "sha256-wr64T3+ps5r2V72z4NDbqWQlJX6kjg6LIu7szY1VaB4="; + sha256 = "0b1qqrjm4m76djy0az9hnz3rqpz1qkql4faqmi7gkx33b1p6d0sz"; }; buildInputs = [ jre ]; From b3213c1520ca0ecd02d582af60d40fa5be4e54ff Mon Sep 17 00:00:00 2001 From: Zhaofeng Li Date: Sat, 11 Dec 2021 15:04:00 -0800 Subject: [PATCH 04/15] unifi6: 6.4.54 -> 6.5.54 (cherry picked from commit 48feb21a3c2118c7eea3c28169c9a7349b556e74) --- pkgs/servers/unifi/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/servers/unifi/default.nix b/pkgs/servers/unifi/default.nix index 5209927c506d..3d3ac89e6c0d 100644 --- a/pkgs/servers/unifi/default.nix +++ b/pkgs/servers/unifi/default.nix @@ -52,7 +52,7 @@ in rec { }; unifi6 = generic { - version = "6.4.54"; - sha256 = "05z0r47p6cl7yi7f9a40xrsr61ndm2904vway59q1acws5i5mm9g"; + version = "6.5.54"; + sha256 = "sha256-M2gYqKZi0czFgfWx0tTW43b+aUVqS6Mg+misRB9/Fes="; }; } From 5bbf1ed27144b52ce00309ebbddf8fef28fae1b9 Mon Sep 17 00:00:00 2001 From: Zhaofeng Li Date: Sat, 11 Dec 2021 15:04:24 -0800 Subject: [PATCH 05/15] nixos/unifi: Apply log4j2 mitigation (cherry picked from commit e992604bf0b4afb4c3e8ccad04d6ea69bba49681) --- nixos/modules/services/networking/unifi.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/nixos/modules/services/networking/unifi.nix b/nixos/modules/services/networking/unifi.nix index 53ad4df477fc..174e919f988b 100644 --- a/nixos/modules/services/networking/unifi.nix +++ b/nixos/modules/services/networking/unifi.nix @@ -7,6 +7,7 @@ let @${cfg.jrePackage}/bin/java java \ ${optionalString (cfg.initialJavaHeapSize != null) "-Xms${(toString cfg.initialJavaHeapSize)}m"} \ ${optionalString (cfg.maximumJavaHeapSize != null) "-Xmx${(toString cfg.maximumJavaHeapSize)}m"} \ + ${optionalString (lib.versionOlder cfg.unifiPackage.version "6.5.54") "-Dlog4j2.formatMsgNoLookups=true"} \ -jar ${stateDir}/lib/ace.jar ''; in From 53563b81ea8356b6afc935de421c6d5832a8fd5a Mon Sep 17 00:00:00 2001 From: "Yestin L. Harrison" Date: Thu, 25 Nov 2021 20:06:25 -0800 Subject: [PATCH 06/15] camlp4: add new versions (cherry picked from commit f389b36d2681b6b06508de8e26ca5dfee88aed55) --- pkgs/development/tools/ocaml/camlp4/default.nix | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) diff --git a/pkgs/development/tools/ocaml/camlp4/default.nix b/pkgs/development/tools/ocaml/camlp4/default.nix index fffa426ba4c9..acf1730af1bc 100644 --- a/pkgs/development/tools/ocaml/camlp4/default.nix +++ b/pkgs/development/tools/ocaml/camlp4/default.nix @@ -1,6 +1,6 @@ { lib, stdenv, fetchzip, which, ocaml, ocamlbuild }: -if lib.versionAtLeast ocaml.version "4.09" +if lib.versionAtLeast ocaml.version "4.14" then throw "camlp4 is not available for OCaml ${ocaml.version}" else @@ -26,6 +26,21 @@ let param = { "4.08" = { version = "4.08+1"; sha256 = "0qplawvxwai25bi27niw2cgz2al01kcnkj8wxwhxslpi21z6pyx1"; }; + "4.09" = { + version = "4.09+1"; + sha256 = "1gr33x6xs1rs0bpyq4vzyfxd6vn47jfkg8imi81db2r0cbs0kxx1"; }; + "4.10" = { + version = "4.10+1"; + sha256 = "093bc1c28wid5li0jwglnd4p3csxw09fmbs9ffybq2z41a5mgay6"; }; + "4.11" = { + version = "4.11+1"; + sha256 = "0sn7f6im940qh0ixmx1k738xrwwdvy9g7r19bv5218jb6mh0g068"; }; + "4.12" = { + version = "4.12+1"; + sha256 = "1cfk5ppnd511vzsr9gc0grxbafmh0m3m897aij198rppzxps5kyz"; }; + "4.13" = { + version = "4.13+1"; + sha256 = "0fzxa1zdhk74mlxpin7p90flks6sp4gkc0mfclmj9zak15rii55n"; }; }.${ocaml.meta.branch}; in From 675049c5c1a37b7fc0d0f96a3baded34dafc3a06 Mon Sep 17 00:00:00 2001 From: Felix Buehler Date: Tue, 7 Dec 2021 22:08:49 +0100 Subject: [PATCH 07/15] why3.withProvers: add dontUnpack (cherry picked from commit 6e0bc1f976829203e37cd35205b9ff58341c619d) --- pkgs/applications/science/logic/why3/with-provers.nix | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/pkgs/applications/science/logic/why3/with-provers.nix b/pkgs/applications/science/logic/why3/with-provers.nix index fc08f5d7c85e..826473b38e9f 100644 --- a/pkgs/applications/science/logic/why3/with-provers.nix +++ b/pkgs/applications/science/logic/why3/with-provers.nix @@ -17,9 +17,11 @@ stdenv.mkDerivation { nativeBuildInputs = [ makeWrapper ]; buildInputs = [ why3 ] ++ provers; + dontUnpack = true; + buildPhase = '' mkdir -p $out/share/why3/ - why3 config --detect-provers -C $out/share/why3/why3.conf + why3 config detect -C $out/share/why3/why3.conf awk -i inplace -f ${configAwkScript} $out/share/why3/why3.conf ''; From 6e7ff9d3380c871757e9705b6aebc057a4dfeae5 Mon Sep 17 00:00:00 2001 From: Maximilian Bosch Date: Mon, 13 Dec 2021 01:51:52 +0100 Subject: [PATCH 08/15] signald: incorporate log4j update for CVE-2021-44228 Equivalent to 79ab6a83828ecee660e362e6c97384ff0489f9b2 on `master`, but against 0.14.1. Relevant for #150288 --- .../instant-messengers/signald/default.nix | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) diff --git a/pkgs/applications/networking/instant-messengers/signald/default.nix b/pkgs/applications/networking/instant-messengers/signald/default.nix index 649cc8843d2e..e435d283a55f 100644 --- a/pkgs/applications/networking/instant-messengers/signald/default.nix +++ b/pkgs/applications/networking/instant-messengers/signald/default.nix @@ -1,10 +1,16 @@ { lib, stdenv, fetchurl, fetchFromGitLab, jre_headless, coreutils, gradle_6, git, perl -, makeWrapper }: +, makeWrapper, fetchpatch +}: let pname = "signald"; version = "0.14.1"; + log4j-update-cve-2021-44228 = fetchpatch { + url = "https://gitlab.com/signald/signald/-/commit/7f668062ab9ffa09a49d171e995f57cf0a0803a7.patch"; + sha256 = "sha256-504je6hKciUGelVCGZjxGjHi1qZQaovagXD5PBQP+mM="; + }; + src = fetchFromGitLab { owner = pname; repo = pname; @@ -26,6 +32,7 @@ let deps = stdenv.mkDerivation { name = "${pname}-deps"; inherit src version postPatch; + patches = [ log4j-update-cve-2021-44228 ]; nativeBuildInputs = [ gradle_6 perl ]; buildPhase = '' export GRADLE_USER_HOME=$(mktemp -d) @@ -43,15 +50,18 @@ let outputHashMode = "recursive"; # Downloaded jars differ by platform outputHash = { - x86_64-linux = "/gJFoT+vvdSWr33oI44XiZXlFfyUjtRVB1M6CMzSztM="; - aarch64-linux = "v71stMWBbNALasfGAHvsVTBaDOZfpKK3sQrjNJ6FG1A="; + x86_64-linux = "sha256-Tn0x5MJJMe04Du+eFGAkdvh/7Sgb7pf2FtBiRyCvjo8="; + aarch64-linux = "sha256-T/Cj/QxlW48xW6l+O3K4fFA19fulOB8nk9dRoiP1sys="; }.${stdenv.system} or (throw "Unsupported platform"); }; in stdenv.mkDerivation rec { inherit pname src version postPatch; - patches = [ ./gradle-plugin.patch ]; + patches = [ + ./gradle-plugin.patch + log4j-update-cve-2021-44228 + ]; buildPhase = '' runHook preBuild From c95b2e99529891b1d52e065c34dd50c136151bcb Mon Sep 17 00:00:00 2001 From: Vincent Laporte Date: Sun, 12 Dec 2021 20:44:15 +0100 Subject: [PATCH 09/15] jackline: use default version of OCaml (cherry picked from commit a106f705050b5ecbc70d2e1d753429efa9db8198) --- pkgs/top-level/all-packages.nix | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index 581dd675eb37..13de9124e882 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -25793,9 +25793,7 @@ with pkgs; indigenous-desktop = callPackage ../applications/networking/feedreaders/indigenous-desktop { }; - jackline = callPackage ../applications/networking/instant-messengers/jackline { - ocamlPackages = ocaml-ng.ocamlPackages_4_08; - }; + jackline = callPackage ../applications/networking/instant-messengers/jackline { }; leftwm = callPackage ../applications/window-managers/leftwm { }; From 4b0c83f02f83c160a30b668982369d029d46c7d7 Mon Sep 17 00:00:00 2001 From: Philipp Date: Mon, 13 Dec 2021 17:02:15 +0100 Subject: [PATCH 10/15] element-*: 1.9.6 -> 1.9.7 (cherry picked from commit 691111d99ff41e0e1bf70d4199302fe305919b73) --- .../element/element-desktop-package.json | 4 ++-- .../networking/instant-messengers/element/pin.json | 8 ++++---- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/pkgs/applications/networking/instant-messengers/element/element-desktop-package.json b/pkgs/applications/networking/instant-messengers/element/element-desktop-package.json index c958137ab9f8..88ac40b4134f 100644 --- a/pkgs/applications/networking/instant-messengers/element/element-desktop-package.json +++ b/pkgs/applications/networking/instant-messengers/element/element-desktop-package.json @@ -2,7 +2,7 @@ "name": "element-desktop", "productName": "Element", "main": "lib/electron-main.js", - "version": "1.9.6", + "version": "1.9.7", "description": "A feature-rich client for Matrix.org", "author": "Element", "repository": { @@ -83,7 +83,7 @@ }, "build": { "appId": "im.riot.app", - "electronVersion": "13.5.1", + "electronVersion": "13.5.2", "files": [ "package.json", { diff --git a/pkgs/applications/networking/instant-messengers/element/pin.json b/pkgs/applications/networking/instant-messengers/element/pin.json index 599f0a1754cf..c711956791ac 100644 --- a/pkgs/applications/networking/instant-messengers/element/pin.json +++ b/pkgs/applications/networking/instant-messengers/element/pin.json @@ -1,6 +1,6 @@ { - "version": "1.9.6", - "desktopSrcHash": "AJLKp9VbNF0XvcQe6t0/pw1hiVCgRiRb27KJooQ2NlQ=", - "desktopYarnHash": "1xa8vrqj3g3hfhzrk8m7yr57my9ipyyhw8vsx4m86v8i1iqrpmnm", - "webHash": "161w6i122i81jyb23mpxlf7k5wx2v4c6ai2liywn89q74hj3axr5" + "version": "1.9.7", + "desktopSrcHash": "bUzIIPNVgK2whQJoEZOaoa+jsJx4No+xji6hXK6wxFY=", + "desktopYarnHash": "1n9dqpvq31k94mx5s1dgqavaxdd0jrzcwdx106c5dnq6xnxs941p", + "webHash": "1fx1nznqbwvs84kpc239ms9kpzy9p72hrz3qqbzay8p9x4gc1ws3" } From e0cb1d319944823371341689fafd6ad4fb6c72fd Mon Sep 17 00:00:00 2001 From: Yureka Date: Mon, 13 Dec 2021 17:30:34 +0100 Subject: [PATCH 11/15] schildichat: 1.9.0-sc.1 -> 1.9.7-sc.1 (cherry picked from commit 127a5753d338663f25ec04de7b84fe066d80f57e) --- .../networking/instant-messengers/schildichat/pin.json | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/pkgs/applications/networking/instant-messengers/schildichat/pin.json b/pkgs/applications/networking/instant-messengers/schildichat/pin.json index 299598063c01..30ca1e9f475a 100644 --- a/pkgs/applications/networking/instant-messengers/schildichat/pin.json +++ b/pkgs/applications/networking/instant-messengers/schildichat/pin.json @@ -1,6 +1,6 @@ { - "version": "1.9.0-sc.1", - "srcHash": "10swz5gwz1izryzllmjm8mhhd0vqk2cp8qjcmmr5gbzspj7p3xgw", - "webYarnHash": "134llyh0197andpnbmfcxnidcgi3xxnb9v10bwfvrqysgnhb5z8v", - "desktopYarnHash": "150jc6p9kbdz599bdkinrhbhncpamhz35j6rcc008qxg2d9qfhwr" + "version": "1.9.7-sc.1", + "srcHash": "0qrjjwcxa141phsgdz325rrkfmjqdmxc3h917cs9c9kf6cblkxaq", + "webYarnHash": "19c594pql2yz1z15phfdlkwcvrcbm8k058fcq7p0k6840dhif5fd", + "desktopYarnHash": "058ihkljb1swjzvgf8gqci5ghvwapmpcf2bsab3yr66lhps7fhci" } From 27893bd8bf450869cc1826f41a8ff1ef24d2f4fa Mon Sep 17 00:00:00 2001 From: Alvar Penning Date: Mon, 13 Dec 2021 16:12:45 +0100 Subject: [PATCH 12/15] olm: 3.2.6 -> 3.2.8 This security release fixes a "high severity issue" that has not yet been further described. https://matrix.org/blog/2021/12/03/pre-disclosure-upcoming-security-release-of-libolm-and-matrix-js-sdk (cherry picked from commit 74ca17a777e2f1bb58e8c1aa7566c55e838853c1) --- pkgs/development/libraries/olm/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/libraries/olm/default.nix b/pkgs/development/libraries/olm/default.nix index 252bebd9eff5..e5c2d66827bf 100644 --- a/pkgs/development/libraries/olm/default.nix +++ b/pkgs/development/libraries/olm/default.nix @@ -2,14 +2,14 @@ stdenv.mkDerivation rec { pname = "olm"; - version = "3.2.6"; + version = "3.2.8"; src = fetchFromGitLab { domain = "gitlab.matrix.org"; owner = "matrix-org"; repo = pname; rev = version; - sha256 = "1srmw36nxi0z2y5d9adks09p950qm0fscbnrq1fl37fdypvjl1sk"; + sha256 = "1jfhydfcnqpksb2bhi960v3h10prf4v5gx42mm2rp6p0jfbqcy50"; }; nativeBuildInputs = [ cmake ]; From 91b1b0ada3c303ea6b2e34760d65f43a39f3a573 Mon Sep 17 00:00:00 2001 From: sternenseemann Date: Mon, 13 Dec 2021 14:04:18 +0100 Subject: [PATCH 13/15] foot: 1.10.2 -> 1.10.3 https://codeberg.org/dnkl/foot/releases/tag/1.10.3 (cherry picked from commit 3c855f2fd4006a61d5e37aa46fa1d7553fffec15) --- pkgs/applications/terminal-emulators/foot/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/applications/terminal-emulators/foot/default.nix b/pkgs/applications/terminal-emulators/foot/default.nix index 9290f8ce6144..591b16ee8226 100644 --- a/pkgs/applications/terminal-emulators/foot/default.nix +++ b/pkgs/applications/terminal-emulators/foot/default.nix @@ -27,7 +27,7 @@ }: let - version = "1.10.2"; + version = "1.10.3"; # build stimuli file for PGO build and the script to generate it # independently of the foot's build, so we can cache the result @@ -99,7 +99,7 @@ stdenv.mkDerivation rec { owner = "dnkl"; repo = pname; rev = version; - sha256 = "00096c2m8pn4gpafvmg9lhyprwgnsis62bq4qmagnbb49bj5kr9v"; + sha256 = "13v6xqaw3xn1x84dn4gnkiimcsllb19mrbvcdj2fnm8klnrys3gs"; }; depsBuildBuild = [ From 05f265d22a6d4e614e1f31ec203e1ad0b8adbda0 Mon Sep 17 00:00:00 2001 From: Thomas Gerbet Date: Mon, 13 Dec 2021 09:46:47 +0100 Subject: [PATCH 14/15] graylog: 3.3.14 -> 3.3.15 This release included a fix for the Log4j vulnerability. https://www.graylog.org/post/graylog-update-for-log4j (cherry picked from commit 6dd67c31d2828ec8483c60fe54d8fc10af225fc8) --- pkgs/tools/misc/graylog/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/tools/misc/graylog/default.nix b/pkgs/tools/misc/graylog/default.nix index 729cfbc283f9..3fd00a5e411d 100644 --- a/pkgs/tools/misc/graylog/default.nix +++ b/pkgs/tools/misc/graylog/default.nix @@ -2,11 +2,11 @@ stdenv.mkDerivation rec { pname = "graylog"; - version = "3.3.14"; + version = "3.3.15"; src = fetchurl { url = "https://packages.graylog2.org/releases/graylog/graylog-${version}.tgz"; - sha256 = "04dslbvgrraacsw7wydbiv8jc753as2g54wn9sgh3lsryvzrfqfa"; + sha256 = "sha256-/ECHhgLhmLoZ9fjpwGQrGuOW5PBtkB3JUCC9Bgvxr30="; }; dontBuild = true; From e64ab9c9800f17ffef3bfd759bab0485e35f09e5 Mon Sep 17 00:00:00 2001 From: Brian Leung Date: Sun, 12 Dec 2021 22:47:10 -0800 Subject: [PATCH 15/15] emacs: Add sqlite support introduced in Emacs 29 (cherry picked from commit 7c8fae3b8b03d54af48e23de80189622dd4f4970) --- pkgs/applications/editors/emacs/generic.nix | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/pkgs/applications/editors/emacs/generic.nix b/pkgs/applications/editors/emacs/generic.nix index db043140e77a..2a1ed2f8b1a4 100644 --- a/pkgs/applications/editors/emacs/generic.nix +++ b/pkgs/applications/editors/emacs/generic.nix @@ -10,7 +10,7 @@ , Xaw3d, libXcursor, pkg-config, gettext, libXft, dbus, libpng, libjpeg, giflib , libtiff, librsvg, gconf, libxml2, imagemagick, gnutls, libselinux , alsa-lib, cairo, acl, gpm, AppKit, GSS, ImageIO, m17n_lib, libotf -, sigtool, jansson, harfbuzz +, sigtool, jansson, harfbuzz, sqlite , dontRecurseIntoAttrs ,emacsPackagesFor , libgccjit, targetPlatform, makeWrapper # native-comp params , systemd ? null @@ -20,6 +20,7 @@ , withGTK3 ? true, gtk3-x11 ? null, gsettings-desktop-schemas ? null , withXwidgets ? false, webkitgtk ? null, wrapGAppsHook ? null, glib-networking ? null , withMotif ? false, motif ? null +, withSQLite3 ? false , withCsrc ? true , srcRepo ? false, autoreconfHook ? null, texinfo ? null , siteStart ? ./site-start.el @@ -116,6 +117,7 @@ let emacs = stdenv.mkDerivation (lib.optionalAttrs nativeComp { ++ lib.optional (withX && withGTK2) gtk2-x11 ++ lib.optionals (withX && withGTK3) [ gtk3-x11 gsettings-desktop-schemas ] ++ lib.optional (withX && withMotif) motif + ++ lib.optional withSQLite3 sqlite ++ lib.optionals (withX && withXwidgets) [ webkitgtk glib-networking ] ++ lib.optionals withNS [ AppKit GSS ImageIO ] ++ lib.optionals stdenv.isDarwin [ sigtool ]