nathan/nixpkgs
1
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2026-10-30 16:10:36 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge e73cff84c5 into haskell-updates

Browse Source
This commit is contained in:
nixpkgs-ci[bot]
2026-10-21 00:28:29 +00:00
committed by GitHub
parent 8c29e20bf3 e73cff84c5
commit 740b8dcb6e
682 changed files with 10128 additions and 5075 deletions
Download Patch File Download Diff File Expand all files Collapse all files

31
doc/languages-frameworks/python.section.md
View File

@@ -656,7 +656,7 @@ are used in [`buildPythonPackage`](#buildpythonpackage-function).
- `pythonRemoveBinBytecode` to remove bytecode from the `/bin` folder.
- `setuptoolsBuildHook` to build a wheel using `setuptools`.
- `sphinxHook` to build documentation and manpages using Sphinx.
- `stestrCheckHook` to run tests with `stestr`.
- `stestrCheckHook` to run tests with `stestr`. See [example usage](#using-stestrcheckhook).
- `venvShellHook` to source a Python 3 `venv` at the `venvDir` location. A
`venv` is created if it does not yet exist. `postVenvCreation` can be used to
to run commands only after venv is first created.
@@ -1633,6 +1633,35 @@ automatically add `pythonRelaxDepsHook` if either `pythonRelaxDeps` or
`pytest` is compatible with `unittest`, so in most cases you can use `pytestCheckHook` instead.
#### Using stestrCheckHook {#using-stestrcheckhook}
`stestrCheckHook` is a hook which will set up (or configure) a [`checkPhase`](#ssec-check-phase) to run `python -m stestr run`:
```nix
{
nativeCheckInputs = [ stestrCheckHook ];
stestrFlags = [
"--test-path"
"tests"
];
}
```
`stestrCheckHook` recognizes the following attributes:
`disabledTests`
: To specify test IDs to exclude, matched exactly (each entry is anchored as `^<id>$`).
`disabledTestsRegex`
: To specify regular expressions of test IDs to exclude, matched unanchored.
`stestrFlags`
: To append additional command-line arguments to `python -m stestr run`.
#### Using sphinxHook {#using-sphinxhook}
The `sphinxHook` is a helpful tool to build documentation and manpages

3
doc/redirects.json
View File

@@ -4369,6 +4369,9 @@
"using-unittestcheckhook": [
"index.html#using-unittestcheckhook"
],
"using-stestrcheckhook": [
"index.html#using-stestrcheckhook"
],
"using-sphinxhook": [
"index.html#using-sphinxhook"
],

6
doc/release-notes/rl-2611.section.md
View File

@@ -75,6 +75,8 @@
Callers that verify messages must now set `allowed_signature_methods` per message or configure `@Net::OAuth::ALLOWED_SIGNATURE_METHODS`; `verify` otherwise throws an exception.
See the [upstream changelog](https://metacpan.org/dist/Net-OAuth/changes) for details.
- `geeqie` has been updated to 3.3, which ports it from GTK3 to GTK4. All `--action` command-line parameters have changed and some default shortcuts now follow GNOME conventions. On first start, shortcuts and `geeqierc.xml` are converted one way, and the old file is kept as a backup. Standalone collection windows were removed in 3.2. See the [upstream NEWS](https://github.com/BestImageViewer/geeqie/blob/v3.3/NEWS).
- []{#x86_64-darwin-26.11}
Support for `x86_64-darwin` has been dropped, due to Apple’s deprecation of the platform and limited build infrastructure and developer time.
@@ -209,6 +211,8 @@
- `tcl.mkTclDerivation` now enables `strictDeps` and `__structuredAttrs`.
- `rssguard` 5.x uses a new database layer. Regenerate your database after upgrading, following the [RSS Guard migration notes](https://rssguard.readthedocs.io/en/stable/contrib/migrate.html).
- `pdns` has been updated from `5.0.x` to `5.1.x`. Please be sure to review the [Upgrade Notes](https://doc.powerdns.com/authoritative/upgrading.html#to-5-1-0) before upgrading. Namely LUA record updates are no longer allowed by default, and the embedded webserver no longer includes a `access-control-allow-origin: *` header by default.
- LibreOffice upstream switched from Fresh/Still stable branches to a single Stable branch; `libreoffice` and `libreoffice-qt` work as before, but more specific aliases like `libreoffice-fresh` should be replaced.
@@ -364,7 +368,7 @@
- All databases of the MySQL family – `mysql`, `mariadb` and `percona` – now provide a client-only package `client` sub-attribute. Use the `<dbname>.client` package if the server components are not needed. The main package continues to ship the client binaries as well.
- Package-URL (PURL, https://github.com/package-url/purl-spec) metadata identifier has been added for `fetchgit`, `fetchpypi` and `fetchFromGithub` fetchers.
- Package-URL (PURL, https://github.com/package-url/purl-spec) metadata identifier has been added for `fetchgit`, `fetchpypi`, `fetchFromGithub` fetchers and to `buildPerlPackage`.
`mkDerivation` has been adjusted to reuse this information.
Package-URLs allow reliably identifying and locating software packages.
Maintainers of derivations using the adapted fetchers should rely on the `drv.src.meta.identifiers.v1.purl` default identifier and can enhance their `drv.meta.identifiers.v1.purls` list once they would like to have additional identifiers.

10
maintainers/github-teams.json
View File

@@ -193,11 +193,12 @@
"description": "Maintain core platform support and packages for macOS and other Apple platforms",
"id": 11265438,
"maintainers": {
"emilazy": 18535642
"emilazy": 18535642,
"reckenrode": 7413633
},
"members": {
"Samasaur1": 30577766,
"reckenrode": 7413633,
"booxter": 90200,
"toonn": 1486805
},
"name": "darwin-core"
@@ -229,7 +230,6 @@
"afh": 16507,
"azuwis": 9315,
"booxter": 90200,
"carlossless": 498906,
"cideM": 4246921,
"cidkidnix": 67574902,
"copumpkin": 2623,
@@ -252,6 +252,7 @@
"jonhermansen": 660911,
"juliusrickert": 5007494,
"jwiegley": 8460,
"karstx": 498906,
"kashw2": 15855440,
"kevingriffin": 209729,
"khaneliman": 1778670,
@@ -312,6 +313,7 @@
},
"members": {
"friedow": 17351844,
"trespaul": 7453891,
"wamirez": 24505474
},
"name": "Documentation Team"
@@ -426,7 +428,7 @@
"Mistyttm": 51770769,
"PaulGrandperrin": 1748936,
"RoGreat": 64620440,
"carlossless": 498906,
"karstx": 498906,
"liamthexpl0rer": 119797945,
"liberodark": 4238928,
"qubitnano": 146656568,

36
maintainers/maintainer-list.nix
View File

@@ -1030,6 +1030,11 @@
githubId = 44871469;
name = "Etienne Wodey";
};
aisk = {
github = "aisk";
githubId = 699636;
name = "An Long";
};
aither64 = {
email = "aither@havefun.cz";
github = "aither64";
@@ -18252,6 +18257,12 @@
githubId = 73405010;
name = "Mart-Mihkel Aun";
};
MartenBE = {
email = "martijn.saelens@protonmail.com";
github = "MartenBE";
githubId = 1958780;
name = "Martijn Saelens";
};
martijnvermaat = {
email = "martijn@vermaat.name";
github = "martijnvermaat";
@@ -30465,6 +30476,12 @@
githubId = 48321566;
name = "Mira Chacku Purakal";
};
twstagg = {
email = "tristinstagg@gmail.com";
github = "twstagg";
githubId = 2766946;
name = "Tristin Stagg";
};
twz123 = {
name = "Tom Wieczorek";
email = "tom@bibbu.net";
@@ -31180,6 +31197,14 @@
githubId = 1771332;
name = "László Vaskó";
};
VlaDexa = {
name = "Vladislav Grechannik";
email = "nixpkgs@vladexa.xyz";
keys = [ { fingerprint = "1E21 85DA D156 B08C 2740 D301 D58B FE42 A558 7A72"; } ];
github = "VlaDexa";
githubId = 52157081;
matrix = "@vladexa:vladexa.xyz";
};
vlinkz = {
email = "vmfuentes64@gmail.com";
github = "vlinkz";
@@ -31455,6 +31480,11 @@
githubId = 158211;
keys = [ { fingerprint = "82CB 91F4 F3E4 04A5 DAB2 78E8 8B99 1293 8FF2 1020"; } ];
};
wangl-cc = {
name = "Loong";
github = "wangl-cc";
githubId = 40141251;
};
wariuccio = {
name = "Wariuccio";
github = "wariuccio";
@@ -32323,6 +32353,12 @@
githubId = 47603387;
name = "Mihók Martin";
};
xsteadfastx = {
email = "marvin@xsteadfastx.org";
github = "xsteadfastx";
githubId = 168397;
name = "Marvin Preuss";
};
xtrayambak = {
github = "xTrayambak";
githubId = 59499552;

9
nixos/doc/manual/release-notes/rl-2611.section.md
View File

@@ -26,10 +26,19 @@
- [openbao-agent](https://openbao.org/docs/agent-and-proxy/agent/), a client daemon that authenticates to OpenBao and renders secrets to files via templates. Available as [services.openbao-agent](#opt-services.openbao-agent.instances).
- [Atlantis](https://github.com/runatlantis/atlantis), a tool for automating Terraform pull requests. Available as [services.atlantis](#opt-services.atlantis.enable).
- [Gradient](https://github.com/wavelens/gradient), a Nix-based continuous integration system. Available as [services.gradient](#opt-services.gradient.enable).
- [Portmaster](https://safing.io/portmaster/), a privacy-focused application
firewall, is available through
[services.portmaster](#opt-services.portmaster.enable).
- [tlsrouter](https://github.com/inetaf/tcpproxy), a TLS proxy that routes
connections to backends based on the TLS SNI (Server Name Indication) of the
TLS handshake, is available through
[services.tlsrouter](#opt-services.tlsrouter.enable).
- [dufs](https://github.com/sigoden/dufs), a file server with WebDAV support,
is available through [services.dufs](#opt-services.dufs.enable).

4
nixos/modules/module-list.nix
View File

@@ -538,6 +538,8 @@
./services/continuous-integration/gitlab-runner/runner.nix
./services/continuous-integration/gocd-agent/default.nix
./services/continuous-integration/gocd-server/default.nix
./services/continuous-integration/gradient/default.nix
./services/continuous-integration/gradient/worker.nix
./services/continuous-integration/hercules-ci-agent/default.nix
./services/continuous-integration/hydra/builder.nix
./services/continuous-integration/hydra/default.nix
@@ -1492,6 +1494,7 @@
./services/networking/tinc.nix
./services/networking/tinydns.nix
./services/networking/tinyproxy.nix
./services/networking/tlsrouter.nix
./services/networking/tmate-ssh-server.nix
./services/networking/tox-bootstrapd.nix
./services/networking/tox-node.nix
@@ -1679,6 +1682,7 @@
./services/web-apps/alps.nix
./services/web-apps/anuko-time-tracker.nix
./services/web-apps/artalk.nix
./services/web-apps/atlantis.nix
./services/web-apps/audiobookshelf.nix
./services/web-apps/baikal.nix
./services/web-apps/bentopdf.nix

5
nixos/modules/programs/upki.nix
View File

@@ -101,6 +101,9 @@ in
};
meta = {
maintainers = [ lib.maintainers.skyesoss ];
maintainers = [
lib.maintainers.skyesoss
lib.maintainers.cpu
];
};
}

5
nixos/modules/security/ca.nix
View File

@@ -8,7 +8,10 @@ let
cfg = config.security.pki;
cacertPackage = pkgs.cacert.override {
blacklist = cfg.caCertificateBlacklist;
blacklist = cfg.caCertificateBlacklist ++ [
# CVE-2026-111943
"Comodo AAA Services root"
];
extraCertificateFiles = cfg.certificateFiles;
extraCertificateStrings = cfg.certificates;
};

10
nixos/modules/security/pam.nix
View File

@@ -375,12 +375,18 @@ let
};
fprintAuth = lib.mkOption {
default = config.services.fprintd.enable;
defaultText = lib.literalExpression "config.services.fprintd.enable";
default = config.services.fprintd.enablePam;
defaultText = lib.literalExpression "config.services.fprintd.enablePam";
type = lib.types.bool;
description = ''
If set, fingerprint reader will be used (if exists and
your fingerprints are enrolled).
::: {.note}
This setting should only be enabled for clients that can ensure
user attention, such as lockscreens.
See https://github.com/NixOS/nixpkgs/issues/442117
:::
'';
};

7
nixos/modules/services/audio/pulseaudio.nix
View File

@@ -295,8 +295,11 @@ in
services.avahi.enable = true;
})
(lib.mkIf cfg.zeroconf.publish.enable {
services.avahi.publish.enable = true;
services.avahi.publish.userServices = true;
services.avahi.settings.publish = {
disable-publishing = false;
disable-user-service-publishing = false;
publish-addresses = true;
};
})
(lib.mkIf cfg.tcp.openFirewall {
networking.firewall.allowedTCPPorts = [ cfg.tcp.port ];

2
nixos/modules/services/backup/syncoid.nix
View File

@@ -435,7 +435,7 @@ in
BindPaths = [
"/dev/zfs"
# Required if outside of /var
config.users.users.syncoid.home
config.users.users.${cfg.user}.home
];
BindReadOnlyPaths = [
builtins.storeDir

538
nixos/modules/services/continuous-integration/gradient/default.nix Normal file
View File

@@ -0,0 +1,538 @@
{
lib,
pkgs,
config,
...
}:
let
cfg = config.services.gradient;
env = cfg.environmentVariables;
workerEnv = cfg.worker.environmentVariables;
serverAddress = "http://${env.GRADIENT_LISTEN_ADDR}:${toString env.GRADIENT_PORT}";
traceDir = env.GRADIENT_LOG_TRACE_DIR or null;
isTrue =
value:
lib.elem value [
true
"true"
];
jsonFormat = pkgs.formats.json { };
stateKeyDefaults = {
users = key: {
username = key;
name = key;
};
projects = key: {
name = key;
display_name = key;
public = false;
};
tasks = key: {
name = key;
display_name = key;
};
integrations = key: { name = key; };
caches = key: {
name = key;
display_name = key;
public = false;
};
roles = key: { name = key; };
api_keys = key: { name = key; };
teams = key: {
name = key;
display_name = key;
};
workers = key: { display_name = key; };
};
state =
builtins.removeAttrs cfg.state [ "validate" ]
// lib.mapAttrs (
collection: keyDefaults:
lib.mapAttrs (key: entry: keyDefaults key // entry) (cfg.state.${collection} or { })
) stateKeyDefaults;
stateJsonFile = jsonFormat.generate "gradient-state.json" state;
validatedStateJsonFile =
if cfg.state.validate then
pkgs.runCommand "gradient-state-validated.json" { __structuredAttrs = true; } ''
${lib.getExe cfg.packages.server} --state-file ${stateJsonFile} --state-validate
cp ${stateJsonFile} $out
''
else
stateJsonFile;
secretVariables = {
jwtFile = "GRADIENT_SECRETS_JWT_FILE";
cryptFile = "GRADIENT_SECRETS_CRYPT_FILE";
databaseUrlFile = "GRADIENT_DATABASE_URL_FILE";
oidcClientSecretFile = "GRADIENT_OIDC_CLIENT_SECRET_FILE";
scimTokenFile = "GRADIENT_SCIM_TOKEN_FILE";
smtpPasswordFile = "GRADIENT_EMAIL_SMTP_PASSWORD_FILE";
s3SecretAccessKeyFile = "GRADIENT_S3_SECRET_ACCESS_KEY_FILE";
githubAppPrivateKeyFile = "GRADIENT_GITHUB_APP_PRIVATE_KEY_FILE";
githubAppWebhookSecretFile = "GRADIENT_GITHUB_APP_WEBHOOK_SECRET_FILE";
sshHostKeyFile = "GRADIENT_SSH_HOST_KEY_FILE";
metricsTokenFile = "GRADIENT_METRICS_TOKEN_FILE";
};
secretFiles = lib.filterAttrs (_: file: file != null) cfg.secrets;
actionSecretFields = {
send_web_request = "token";
send_matrix_message = "access_token";
send_slack_message = "webhook_url";
};
stateCredentials = lib.concatLists (
lib.mapAttrsToList (
_: user:
lib.optional (
user.password_file or null != null
) "gradient_user_${user.username}_password:${user.password_file}"
) state.users
++ lib.mapAttrsToList (_: project: [
"gradient_project_${project.name}_private_key:${project.private_key_file}"
]) state.projects
++ lib.mapAttrsToList (_: cache: [
"gradient_cache_${cache.name}_signing_key:${cache.signing_key_file}"
]) state.caches
++ lib.mapAttrsToList (_: apiKey: [
"gradient_api_${apiKey.name}_key:${apiKey.key_file}"
]) state.api_keys
++ lib.mapAttrsToList (_: worker: [
"gradient_worker_${worker.worker_id}_token:${worker.token_file}"
]) state.workers
++ lib.mapAttrsToList (
_: int:
lib.optional (
int.secret_file or null != null
) "gradient_integration_${int.name}_secret:${int.secret_file}"
++ lib.optional (
int.access_token_file or null != null
) "gradient_integration_${int.name}_token:${int.access_token_file}"
) state.integrations
++ lib.mapAttrsToList (
_: task:
lib.concatMap (
action:
let
field = actionSecretFields.${action.type} or null;
file = if field == null then null else action.config."${field}_file" or null;
in
lib.optional (file != null) "gradient_action_${action.name}_${field}:${file}"
) (task.actions or [ ])
) state.tasks
);
localWorker = cfg.worker.enable && cfg.localWorker;
identityHash = builtins.hashString "sha256" "gradient-local-worker:${config.networking.hostName}";
localIdentity = lib.concatStringsSep "-" [
(builtins.substring 0 8 identityHash)
(builtins.substring 8 4 identityHash)
(builtins.substring 12 4 identityHash)
(builtins.substring 16 4 identityHash)
(builtins.substring 20 12 identityHash)
];
localTokenFile = "${workerEnv.GRADIENT_WORKER_BASE_DIR}/local-token";
localPeersFile = "${workerEnv.GRADIENT_WORKER_BASE_DIR}/local-peers";
in
{
meta.maintainers = pkgs.gradient.meta.maintainers;
options.services.gradient = {
enable = lib.mkEnableOption "Gradient, a Nix-CI for Teams";
packages = {
server = lib.mkPackageOption pkgs "gradient" { };
frontend = lib.mkPackageOption pkgs [ "gradient" "frontend" ] { };
};
domain = lib.mkOption {
type = lib.types.str;
example = "gradient.example.com";
description = "Domain under which Gradient is reachable.";
};
environmentVariables = lib.mkOption {
type =
with lib.types;
lazyAttrsOf (
nullOr (oneOf [
bool
int
str
path
])
);
default = { };
example = {
GRADIENT_OIDC_ENABLE = true;
GRADIENT_OIDC_CLIENT_ID = "gradient";
GRADIENT_OIDC_DISCOVERY_URL = "https://id.example.com/.well-known/openid-configuration";
GRADIENT_GC_INTERVAL_SECS = 600;
};
description = ''
Environment variables of the Gradient server.
The [configuration reference](https://wavelens.github.io/gradient/reference/configuration) lists every variable and its default.
Set a variable to `null` to unset it.
Secrets belong into {option}`services.gradient.secrets`.
'';
};
secrets =
lib.mapAttrs (
_: variable:
lib.mkOption {
type = lib.types.nullOr lib.types.path;
default = null;
description = ''
File containing the secret behind {env}`${variable}`, loaded as a systemd credential.
'';
}
) secretVariables
// {
jwtFile = lib.mkOption {
type = lib.types.path;
description = "File containing the secret used to sign JWTs.";
};
cryptFile = lib.mkOption {
type = lib.types.path;
description = "File containing the key used to encrypt secrets in the database.";
};
};
state = lib.mkOption {
type = lib.types.submodule {
freeformType = jsonFormat.type;
options.validate = lib.mkOption {
type = lib.types.bool;
default = true;
description = ''
Whether to check the state option with the server's `--state-validate` flag at
build time. Schema and reference errors then fail at build time instead of at
runtime.
'';
};
};
default = { };
example = lib.literalExpression ''
{
users.alice = {
email = "alice@example.com";
password_file = "/etc/gradient/secrets/alice_password";
superuser = true;
};
projects.acme-corp = {
private_key_file = "/etc/gradient/secrets/acme_ssh_key";
created_by = "alice";
};
tasks.web-app = {
project = "acme-corp";
repository = "https://github.com/acme-corp/web-app.git";
wildcard = "nixosConfigurations.*.config.system.build.toplevel";
created_by = "alice";
triggers = [
{
type = "polling";
config.interval_secs = 300;
}
];
};
caches.main-cache = {
signing_key_file = "/etc/gradient/secrets/main_cache_key";
projects = [ "acme-corp" ];
created_by = "alice";
};
}
'';
description = ''
Declarative Gradient state, written as JSON to the server's state file.
The [state reference](https://wavelens.github.io/gradient/reference/state) documents the available fields.
Fields naming an entry, such as `name`, `username` and `display_name`, default to its attribute name.
Files in `password_file`, `private_key_file`, `signing_key_file`, `key_file`,
`token_file`, `secret_file`, `access_token_file` and the secret files of task
actions become systemd credentials of the server.
'';
};
localWorker = lib.mkOption {
type = lib.types.bool;
default = cfg.worker.enable;
defaultText = lib.literalExpression "config.services.gradient.worker.enable";
description = ''
Whether to register the {option}`services.gradient.worker` on this host automatically,
with an ID from the hostname and a token and peers file from the first start.
The state-declared team `server` is part of every new project.
'';
};
nginx = {
enable = lib.mkEnableOption "an nginx virtual host for Gradient" // {
default = true;
};
frontend = lib.mkEnableOption "serving the Gradient web frontend" // {
default = true;
};
exposeProto = lib.mkEnableOption "`/proto` for remote workers and federation";
};
postgres.enable = lib.mkEnableOption "a local PostgreSQL database for Gradient";
};
config = lib.mkIf cfg.enable {
assertions = [
{
assertion = cfg.localWorker -> cfg.worker.enable;
message = "Enable services.gradient.worker for services.gradient.localWorker.";
}
];
services = {
gradient = {
environmentVariables = lib.mapAttrs (_: lib.mkDefault) {
GRADIENT_LISTEN_ADDR = "127.0.0.1";
GRADIENT_PORT = 3000;
GRADIENT_USE_TLS = true;
GRADIENT_BASE_DIR = "/var/lib/gradient";
GRADIENT_SERVE_URL = "http${lib.optionalString (isTrue env.GRADIENT_USE_TLS) "s"}://${cfg.domain}";
GRADIENT_FRONTEND_URL = env.GRADIENT_SERVE_URL;
GRADIENT_DATABASE_URL = "postgresql://gradient@localhost/gradient?host=/run/postgresql";
};
state = lib.mkIf localWorker {
teams.server = {
display_name = "Server";
new_projects.workers = true;
};
workers.local = {
display_name = "Local Worker";
worker_id = localIdentity;
token_file = localTokenFile;
team = "server";
};
};
worker = lib.mkIf localWorker {
peersFile = lib.mkDefault localPeersFile;
serverUrl = lib.mkDefault "ws://127.0.0.1:${toString env.GRADIENT_PORT}/proto";
id = lib.mkDefault localIdentity;
};
};
nginx = lib.mkIf cfg.nginx.enable {
enable = true;
virtualHosts.${cfg.domain} = {
enableACME = lib.mkDefault (isTrue env.GRADIENT_USE_TLS);
forceSSL = lib.mkDefault (isTrue env.GRADIENT_USE_TLS);
http2 = true;
http3 = lib.mkDefault (isTrue (env.GRADIENT_USE_QUIC or false));
locations = {
"/" = lib.mkIf cfg.nginx.frontend {
root = "${cfg.packages.frontend}/share/gradient-frontend";
tryFiles = "$uri $uri/ /index.html";
};
"/api/" = {
proxyPass = serverAddress;
proxyWebsockets = true;
extraConfig = ''
client_max_body_size 0;
proxy_buffering off;
proxy_request_buffering off;
proxy_connect_timeout 1h;
proxy_send_timeout 1h;
proxy_read_timeout 1h;
'';
};
"/proto" = lib.mkIf cfg.nginx.exposeProto {
proxyPass = serverAddress;
proxyWebsockets = true;
extraConfig = ''
proxy_buffer_size 256k;
proxy_buffers 4 256k;
proxy_connect_timeout 90d;
proxy_send_timeout 90d;
proxy_read_timeout 90d;
'';
};
"~ ^/cache/[^/]+/proto$" = {
proxyPass = serverAddress;
proxyWebsockets = true;
extraConfig = ''
proxy_buffer_size 256k;
proxy_buffers 4 256k;
proxy_connect_timeout 1d;
proxy_send_timeout 1d;
proxy_read_timeout 1d;
'';
};
"/cache/" = {
proxyPass = serverAddress;
proxyWebsockets = true;
extraConfig = ''
client_max_body_size 0;
proxy_buffering off;
proxy_request_buffering off;
proxy_connect_timeout 1h;
proxy_send_timeout 1h;
proxy_read_timeout 1h;
'';
};
};
};
};
postgresql = lib.mkIf cfg.postgres.enable {
enable = true;
ensureDatabases = [ "gradient" ];
ensureUsers = [
{
name = "gradient";
ensureDBOwnership = true;
}
];
settings = {
max_connections = lib.mkDefault 200;
max_locks_per_transaction = lib.mkDefault 1024;
};
};
};
systemd = {
services.gradient-local-worker-token = lib.mkIf localWorker {
description = "Gradient local worker credentials";
requiredBy = [ "gradient-worker.service" ];
before = [ "gradient-worker.service" ];
serviceConfig = {
Type = "oneshot";
RemainAfterExit = true;
User = "gradient-worker";
Group = "gradient-worker";
StateDirectory = "gradient-worker";
UMask = "0277";
};
script = ''
rm -f ${localTokenFile}.new ${localPeersFile}.new
if [ ! -s ${localTokenFile} ]; then
${lib.getExe pkgs.openssl} rand -base64 48 > ${localTokenFile}.new
mv ${localTokenFile}.new ${localTokenFile}
fi
printf '*:%s\n' "$(cat ${localTokenFile})" > ${localPeersFile}.new
mv ${localPeersFile}.new ${localPeersFile}
'';
};
tmpfiles.settings."10-gradient-trace" = lib.mkIf (traceDir != null) {
${traceDir}.d = {
user = "gradient";
group = "gradient";
mode = "0750";
};
};
services.gradient-server = {
wantedBy = [ "multi-user.target" ];
after = [
"network.target"
"systemd-tmpfiles-setup.service"
]
++ lib.optional cfg.postgres.enable "postgresql.target"
++ lib.optional localWorker "gradient-local-worker-token.service";
requires = lib.optional localWorker "gradient-local-worker-token.service";
serviceConfig = {
Type = "notify";
ExecStart = lib.getExe cfg.packages.server;
TimeoutStartSec = "infinity";
StateDirectory = "gradient";
User = "gradient";
Group = "gradient";
PrivateTmp = true;
ProtectHome = true;
ProtectHostname = true;
ProtectKernelLogs = true;
ProtectKernelModules = true;
ProtectKernelTunables = true;
ProtectProc = "invisible";
ProtectSystem = "strict";
ReadWritePaths = [ env.GRADIENT_BASE_DIR ] ++ lib.optional (traceDir != null) traceDir;
Restart = "on-failure";
RestartSec = 10;
LimitNOFILE = 65535;
RestrictAddressFamilies = [
"AF_INET"
"AF_INET6"
"AF_UNIX"
];
RestrictNamespaces = true;
RestrictRealtime = true;
RestrictSUIDSGID = true;
WorkingDirectory = env.GRADIENT_BASE_DIR;
LoadCredential = [
"gradient_state:${validatedStateJsonFile}"
]
++ lib.mapAttrsToList (name: file: "gradient_${name}:${file}") secretFiles
++ stateCredentials;
};
unitConfig = {
StartLimitIntervalSec = 60;
StartLimitBurst = 5;
};
environment =
lib.mapAttrs (
_: value: if lib.isBool value then lib.boolToString value else lib.mapNullable toString value
) env
// lib.mapAttrs' (
name: _: lib.nameValuePair secretVariables.${name} "%d/gradient_${name}"
) secretFiles
// {
NIX_REMOTE = "daemon";
XDG_CACHE_HOME = "${env.GRADIENT_BASE_DIR}/www/.cache";
GRADIENT_STATE_FILE = "%d/gradient_state";
GRADIENT_CREDENTIALS_DIR = "%d";
};
};
};
users = {
groups.gradient = { };
users.gradient = {
description = "Gradient user";
isSystemUser = true;
home = env.GRADIENT_BASE_DIR;
createHome = true;
group = "gradient";
};
};
};
}

226
nixos/modules/services/continuous-integration/gradient/worker.nix Normal file
View File

@@ -0,0 +1,226 @@
{
lib,
pkgs,
config,
...
}:
let
cfg = config.services.gradient.worker;
env = cfg.environmentVariables;
gcrootsDir = env.GRADIENT_WORKER_GCROOTS_DIR or "";
traceDir = env.GRADIENT_WORKER_LOG_TRACE_DIR or null;
in
{
options.services.gradient.worker = {
enable = lib.mkEnableOption "the Gradient worker";
packages = {
gradient = lib.mkPackageOption pkgs "gradient" { };
nix = lib.mkOption {
type = lib.types.package;
default = cfg.packages.gradient.nix;
defaultText = lib.literalExpression "config.services.gradient.worker.packages.gradient.nix";
description = ''
Nix package providing the {command}`nix` for system feature detection.
The default is Gradient's Nix fork, matching the worker's embedded evaluator.
'';
};
git = lib.mkOption {
type = lib.types.package;
default = config.programs.git.package;
defaultText = lib.literalExpression "config.programs.git.package";
description = "Git package available to the worker for cloning repositories.";
};
ssh = lib.mkOption {
type = lib.types.package;
default = config.programs.ssh.package;
defaultText = lib.literalExpression "config.programs.ssh.package";
description = ''
OpenSSH package used as {env}`GIT_SSH_COMMAND` to fetch private flake inputs.
'';
};
};
environmentVariables = lib.mkOption {
type =
with lib.types;
lazyAttrsOf (
nullOr (oneOf [
bool
int
str
path
])
);
default = { };
example = {
GRADIENT_WORKER_BUILD_MAX_CONCURRENT = 8;
};
description = ''
Environment variables of the Gradient worker.
The [configuration reference](https://wavelens.github.io/gradient/reference/configuration) lists every variable and its default.
Set a variable to `null` to unset it.
'';
};
peersFile = lib.mkOption {
type = lib.types.nullOr lib.types.path;
default = null;
description = ''
File of peer tokens for challenge-response authentication with the server,
with `peer_id:token` per line and `#` starting a comment.
```
<uuid>:<token>
*:<token>
```
Use peer ID `*` to match any UUID in the server's challenge.
Tokens are 48 byte random secrets, for example from {command}`openssl rand -base64 48`.
Register them via the API through `POST /api/v1/projects/{project}/workers`.
Set it to `null` for open mode without authentication; avoid that in a production setup.
'';
};
id = lib.mkOption {
type = lib.types.nullOr lib.types.str;
default = null;
example = "00000000-0000-0000-0000-000000000000";
description = "UUID identifying the worker to the Gradient server.";
};
serverUrl = lib.mkOption {
type = lib.types.nullOr lib.types.str;
default = null;
example = "wss://gradient.example.com/proto";
description = "WebSocket URL of the Gradient server the worker connects to.";
};
};
config = lib.mkIf cfg.enable {
services = {
gradient.worker.environmentVariables = lib.mapAttrs (_: lib.mkDefault) {
GRADIENT_WORKER_BASE_DIR = "/var/lib/gradient-worker";
GRADIENT_WORKER_GCROOTS_DIR = "/nix/var/nix/gcroots/gradient";
GRADIENT_WORKER_LISTEN_ADDR = "127.0.0.1";
GRADIENT_WORKER_PORT = 3100;
GRADIENT_WORKER_NIX_BIN = lib.getExe' cfg.packages.nix "nix";
GRADIENT_WORKER_SSH_BIN = lib.getExe' cfg.packages.ssh "ssh";
GRADIENT_WORKER_CAPABILITIES_FETCH = true;
GRADIENT_WORKER_CAPABILITIES_EVAL = true;
GRADIENT_WORKER_CAPABILITIES_BUILD = true;
};
};
systemd = {
tmpfiles.settings."10-gradient-worker" =
lib.optionalAttrs (gcrootsDir != "") {
${gcrootsDir}.d = {
user = "gradient-worker";
group = "gradient-worker";
mode = "0755";
};
}
// lib.optionalAttrs (traceDir != null) {
${traceDir}.d = {
user = "gradient-worker";
group = "gradient-worker";
mode = "0750";
};
};
services.gradient-worker = {
wantedBy = [ "multi-user.target" ];
after = [
"network.target"
"systemd-tmpfiles-setup.service"
];
path = [
cfg.packages.git
cfg.packages.nix
cfg.packages.ssh
];
serviceConfig = {
Type = "notify";
ExecStart = lib.getExe' cfg.packages.gradient "gradient-worker";
StateDirectory = "gradient-worker";
User = "gradient-worker";
Group = "gradient-worker";
PrivateTmp = true;
ProtectHome = true;
ProtectHostname = true;
ProtectKernelLogs = true;
ProtectKernelModules = true;
ProtectKernelTunables = true;
ProtectProc = "invisible";
ProtectSystem = "strict";
ReadWritePaths = [
env.GRADIENT_WORKER_BASE_DIR
]
++ lib.optional (gcrootsDir != "") gcrootsDir
++ lib.optional (traceDir != null) traceDir;
Restart = "on-failure";
RestartSec = 10;
KillMode = "mixed";
LimitNOFILE = 65535;
RestrictAddressFamilies = [
"AF_INET"
"AF_INET6"
"AF_UNIX"
];
RestrictNamespaces = true;
RestrictRealtime = true;
RestrictSUIDSGID = true;
WorkingDirectory = env.GRADIENT_WORKER_BASE_DIR;
LoadCredential = lib.optional (cfg.peersFile != null) "gradient_worker_peers:${cfg.peersFile}";
};
unitConfig = {
StartLimitIntervalSec = 60;
StartLimitBurst = 5;
};
environment =
lib.mapAttrs (
_: value: if lib.isBool value then lib.boolToString value else lib.mapNullable toString value
) env
// {
NIX_REMOTE = "daemon";
XDG_CACHE_HOME = "${env.GRADIENT_WORKER_BASE_DIR}/www/.cache";
}
// lib.optionalAttrs (cfg.peersFile != null) {
GRADIENT_WORKER_PEERS_FILE = "%d/gradient_worker_peers";
}
// lib.optionalAttrs (cfg.id != null) {
GRADIENT_WORKER_ID = cfg.id;
}
// lib.optionalAttrs (cfg.serverUrl != null) {
GRADIENT_WORKER_SERVER_URL = cfg.serverUrl;
};
};
};
nix.settings = {
trusted-users = [ "gradient-worker" ];
experimental-features = [
"nix-command"
"flakes"
"ca-derivations"
];
};
users = {
groups.gradient-worker = { };
users.gradient-worker = {
description = "Gradient Worker user";
isSystemUser = true;
home = env.GRADIENT_WORKER_BASE_DIR;
createHome = true;
group = "gradient-worker";
};
};
};
}

7
nixos/modules/services/misc/guix/default.nix
View File

@@ -277,8 +277,11 @@ in
# Guix uses Avahi (through guile-avahi) both for the auto-discovering and
# advertising substitute servers in the local network.
services.avahi.enable = lib.mkDefault true;
services.avahi.publish.enable = lib.mkDefault true;
services.avahi.publish.userServices = lib.mkDefault true;
services.avahi.settings.publish = {
disable-publishing = lib.mkDefault false;
disable-user-service-publishing = lib.mkDefault false;
publish-addresses = lib.mkDefault true;
};
# It's similar to Nix daemon so there's no question whether or not this
# should be sandboxed.

10
nixos/modules/services/misc/ntfy-sh.nix
View File

@@ -109,7 +109,8 @@ in
services.ntfy-sh.settings = {
auth-file = lib.mkDefault "/var/lib/ntfy-sh/user.db";
listen-http = if cfg.nginx.enable then "[::1]:${cfg.nginx.port}" else lib.mkDefault "[::1]:2586";
listen-http =
if cfg.nginx.enable then "[::1]:${toString cfg.nginx.port}" else lib.mkDefault "[::1]:2586";
attachment-cache-dir = lib.mkDefault "/var/lib/ntfy-sh/attachments";
cache-file = lib.mkDefault "/var/lib/ntfy-sh/cache-file.db";
};
@@ -147,12 +148,13 @@ in
};
services.nginx = lib.mkIf cfg.nginx.enable {
enable = true;
enable = lib.mkDefault true;
virtualHosts."${cfg.nginx.virtualHost}" = {
forceSSL = true;
forceSSL = lib.mkDefault true;
locations."/" = {
proxyPass = "http://[::1]:${cfg.nginx.port}";
proxyPass = "http://[::1]:${toString cfg.nginx.port}";
proxyWebsockets = true;
extraConfig = ''
proxy_connect_timeout 3m;

72
nixos/modules/services/monitoring/prometheus/exporters/nvidia-gpu.nix
View File

@@ -2,27 +2,81 @@
config,
lib,
pkgs,
utils,
...
}:
let
cfg = config.services.prometheus.exporters.nvidia-gpu;
inherit (lib)
cli
concatStringsSep
filterAttrs
mkOption
mkPackageOption
types
;
in
{
port = 9835;
serviceOpts = {
serviceConfig = {
ExecStart = ''
${pkgs.prometheus-nvidia-gpu-exporter}/bin/nvidia_gpu_exporter \
--web.listen-address ${cfg.listenAddress}:${toString cfg.port} \
--nvidia-smi-command ${config.hardware.nvidia.package.bin}/bin/nvidia-smi \
${concatStringsSep " " cfg.extraFlags}
'';
PrivateDevices = false;
extraOpts = {
package = mkPackageOption pkgs "prometheus-nvidia-gpu-exporter" { };
settings = mkOption {
type = types.submodule {
freeformType = types.attrsOf (
types.oneOf [
types.bool
types.str
(types.listOf types.str)
]
);
options = {
"collect.backend" = mkOption {
type = types.enum [
"exec"
"nvml"
"demo"
];
default = "exec";
description = "How to collect GPU metrics.";
};
"nvidia-smi-command" = mkOption {
type = types.str;
default = "${config.hardware.nvidia.package.bin}/bin/nvidia-smi";
defaultText = lib.literalExpression ''
"''${config.hardware.nvidia.package.bin}/bin/nvidia-smi"
'';
description = "Path or command to be used for the nvidia-smi executable.";
};
"web.listen-address" = mkOption {
type = types.str;
default = "${cfg.listenAddress}:${toString cfg.port}";
defaultText = lib.literalExpression ''
"''${config.services.prometheus.exporters.nvidia-gpu.listenAddress}:''${toString config.services.prometheus.exporters.nvidia-gpu.port}"
'';
description = "Addresses on which to expose metrics and web interface.";
};
};
};
description = "Command line flags from the --help text of the exporter.";
};
};
serviceOpts = {
serviceConfig =
let
settings = filterAttrs (
# specifying nvidia-smi-command when collect.backend isn't 'exec' errors
n: v: if n == "nvidia-smi-command" && cfg.settings."collect.backend" != "exec" then false else true
) cfg.settings;
in
{
ExecStart = ''
${lib.getExe cfg.package} \
${utils.escapeSystemdExecArgs (cli.toCommandLineGNU { explicitBool = false; } settings)} \
${concatStringsSep " " cfg.extraFlags}
'';
PrivateDevices = false;
};
wantedBy = [ "multi-user.target" ];
};
}

779
nixos/modules/services/networking/avahi-daemon.nix
View File

@@ -7,53 +7,183 @@
let
cfg = config.services.avahi;
avahiDaemonConf =
with cfg;
pkgs.writeText "avahi-daemon.conf" ''
[server]
${
# Users can set `networking.hostName' to the empty string, when getting
# a host name from DHCP. In that case, let Avahi take whatever the
# current host name is; setting `host-name' to the empty string in
# `avahi-daemon.conf' would be invalid.
lib.optionalString (hostName != "") "host-name=${hostName}"
}
browse-domains=${lib.concatStringsSep ", " browseDomains}
use-ipv4=${lib.boolToYesNo ipv4}
use-ipv6=${lib.boolToYesNo ipv6}
${lib.optionalString (
allowInterfaces != null
) "allow-interfaces=${lib.concatStringsSep "," allowInterfaces}"}
${lib.optionalString (
denyInterfaces != null
) "deny-interfaces=${lib.concatStringsSep "," denyInterfaces}"}
${lib.optionalString (domainName != null) "domain-name=${domainName}"}
allow-point-to-point=${lib.boolToYesNo allowPointToPoint}
${lib.optionalString (cacheEntriesMax != null) "cache-entries-max=${toString cacheEntriesMax}"}
settingsFormat = pkgs.formats.ini {
mkKeyValue = lib.generators.mkKeyValueDefault {
mkValueString =
v: if lib.isBool v then lib.boolToYesNo v else lib.generators.mkValueStringDefault { } v;
} "=";
listToValue = lib.concatMapStringsSep ", " (lib.generators.mkValueStringDefault { });
};
[wide-area]
enable-wide-area=${lib.boolToYesNo wideArea}
settings =
let
filteredSettings = lib.filterAttrsRecursive (_: v: v != null) cfg.settings;
in
filteredSettings
// {
server = lib.removeAttrs (filteredSettings.server or { }) (
lib.optional ((filteredSettings.server."host-name" or null) == "") "host-name"
);
};
[publish]
disable-publishing=${lib.boolToYesNo (!publish.enable)}
disable-user-service-publishing=${lib.boolToYesNo (!publish.userServices)}
publish-addresses=${lib.boolToYesNo (publish.userServices || publish.addresses)}
publish-hinfo=${lib.boolToYesNo publish.hinfo}
publish-workstation=${lib.boolToYesNo publish.workstation}
publish-domain=${lib.boolToYesNo publish.domain}
[reflector]
enable-reflector=${lib.boolToYesNo reflector}
${extraConfig}
'';
avahiDaemonConf = pkgs.concatText "avahi-daemon.conf" [
(settingsFormat.generate "avahi-daemon.conf" settings)
(pkgs.writeText "avahi-daemon-extra.conf" cfg.extraConfig)
];
in
{
imports = [
(lib.mkRenamedOptionModule
[ "services" "avahi" "interfaces" ]
[ "services" "avahi" "allowInterfaces" ]
[
"services"
"avahi"
"settings"
"server"
"allow-interfaces"
]
)
(lib.mkRenamedOptionModule [ "services" "avahi" "nssmdns" ] [ "services" "avahi" "nssmdns4" ])
(lib.mkRenamedOptionModule
[ "services" "avahi" "hostName" ]
[
"services"
"avahi"
"settings"
"server"
"host-name"
]
)
(lib.mkRenamedOptionModule
[ "services" "avahi" "domainName" ]
[
"services"
"avahi"
"settings"
"server"
"domain-name"
]
)
(lib.mkRenamedOptionModule
[ "services" "avahi" "browseDomains" ]
[
"services"
"avahi"
"settings"
"server"
"browse-domains"
]
)
(lib.mkRenamedOptionModule
[ "services" "avahi" "ipv4" ]
[
"services"
"avahi"
"settings"
"server"
"use-ipv4"
]
)
(lib.mkRenamedOptionModule
[ "services" "avahi" "ipv6" ]
[
"services"
"avahi"
"settings"
"server"
"use-ipv6"
]
)
(lib.mkRenamedOptionModule
[ "services" "avahi" "allowInterfaces" ]
[
"services"
"avahi"
"settings"
"server"
"allow-interfaces"
]
)
(lib.mkRenamedOptionModule
[ "services" "avahi" "denyInterfaces" ]
[
"services"
"avahi"
"settings"
"server"
"deny-interfaces"
]
)
(lib.mkRenamedOptionModule
[ "services" "avahi" "allowPointToPoint" ]
[
"services"
"avahi"
"settings"
"server"
"allow-point-to-point"
]
)
(lib.mkRenamedOptionModule
[ "services" "avahi" "reflector" ]
[
"services"
"avahi"
"settings"
"reflector"
"enable-reflector"
]
)
(lib.mkRenamedOptionModule
[ "services" "avahi" "cacheEntriesMax" ]
[
"services"
"avahi"
"settings"
"server"
"cache-entries-max"
]
)
(lib.mkRenamedOptionModule
[ "services" "avahi" "publish" "addresses" ]
[
"services"
"avahi"
"settings"
"publish"
"publish-addresses"
]
)
(lib.mkRenamedOptionModule
[ "services" "avahi" "publish" "hinfo" ]
[
"services"
"avahi"
"settings"
"publish"
"publish-hinfo"
]
)
(lib.mkRenamedOptionModule
[ "services" "avahi" "publish" "workstation" ]
[
"services"
"avahi"
"settings"
"publish"
"publish-workstation"
]
)
(lib.mkRenamedOptionModule
[ "services" "avahi" "publish" "domain" ]
[
"services"
"avahi"
"settings"
"publish"
"publish-domain"
]
)
];
options.services.avahi = {
@@ -70,67 +200,143 @@ in
package = lib.mkPackageOption pkgs "avahi" { };
hostName = lib.mkOption {
type = lib.types.str;
default = config.networking.hostName;
defaultText = lib.literalExpression "config.networking.hostName";
settings = lib.mkOption {
type = lib.types.submodule {
freeformType = settingsFormat.type;
options = {
server = {
"host-name" = lib.mkOption {
type = lib.types.nullOr lib.types.str;
default = null;
description = ''
Host name advertised on the LAN. If unset, Avahi will use the
system host name.
'';
};
domain-name = lib.mkOption {
type = lib.types.nullOr lib.types.str;
default = "local";
description = "Domain name for all advertisements.";
};
browse-domains = lib.mkOption {
type = lib.types.listOf lib.types.str;
default = [ ];
description = "List of non-local DNS domains to be browsed.";
};
use-ipv4 = lib.mkOption {
type = lib.types.bool;
default = true;
description = "Whether to use IPv4.";
};
use-ipv6 = lib.mkOption {
type = lib.types.bool;
default = config.networking.enableIPv6;
defaultText = lib.literalExpression "config.networking.enableIPv6";
description = "Whether to use IPv6.";
};
allow-interfaces = lib.mkOption {
type = lib.types.nullOr (lib.types.listOf lib.types.str);
default = null;
description = ''
List of network interfaces that should be used by the {command}`avahi-daemon`.
Other interfaces will be ignored. If `null`, all local interfaces
except loopback and point-to-point will be used.
'';
};
deny-interfaces = lib.mkOption {
type = lib.types.nullOr (lib.types.listOf lib.types.str);
default = null;
description = ''
List of network interfaces that should be ignored by the
{command}`avahi-daemon`. Other unspecified interfaces will be
used, unless `allow-interfaces` is set. This option takes
precedence over `allow-interfaces`.
'';
};
allow-point-to-point = lib.mkOption {
type = lib.types.bool;
default = false;
description = ''
Whether to use POINTTOPOINT interfaces. Might make mDNS
unreliable due to usually large latencies with such links and
opens a potential security hole by allowing mDNS access from
Internet connections.
'';
};
cache-entries-max = lib.mkOption {
type = lib.types.nullOr lib.types.int;
default = null;
description = ''
Number of resource records to be cached per interface. Use 0 to
disable caching. Avahi daemon defaults to 4096 if not set.
'';
};
};
publish = {
disable-publishing = lib.mkOption {
type = lib.types.bool;
default = true;
description = "Whether to disable publishing in general.";
};
disable-user-service-publishing = lib.mkOption {
type = lib.types.bool;
default = true;
description = "Whether to disable publishing user services.";
};
publish-addresses = lib.mkOption {
type = lib.types.bool;
default = false;
description = "Whether to register mDNS address records for all local IP addresses.";
};
publish-hinfo = lib.mkOption {
type = lib.types.bool;
default = false;
description = ''
Whether to register a mDNS HINFO record which contains
information about the local operating system and CPU.
'';
};
publish-workstation = lib.mkOption {
type = lib.types.bool;
default = false;
description = ''
Whether to register a service of type "_workstation._tcp" on the
local LAN.
'';
};
publish-domain = lib.mkOption {
type = lib.types.bool;
default = false;
description = "Whether to announce the locally used domain name for browsing by other hosts.";
};
};
reflector.enable-reflector = lib.mkOption {
type = lib.types.bool;
default = false;
description = "Reflect incoming mDNS requests to all allowed network interfaces.";
};
};
};
default = { };
description = ''
Host name advertised on the LAN. If not set, avahi will use the value
of {option}`config.networking.hostName`.
'';
};
domainName = lib.mkOption {
type = lib.types.str;
default = "local";
description = ''
Domain name for all advertisements.
'';
};
browseDomains = lib.mkOption {
type = lib.types.listOf lib.types.str;
default = [ ];
example = [
"0pointer.de"
"zeroconf.org"
];
description = ''
List of non-local DNS domains to be browsed.
'';
};
ipv4 = lib.mkOption {
type = lib.types.bool;
default = true;
description = "Whether to use IPv4.";
};
ipv6 = lib.mkOption {
type = lib.types.bool;
default = config.networking.enableIPv6;
defaultText = lib.literalExpression "config.networking.enableIPv6";
description = "Whether to use IPv6.";
};
allowInterfaces = lib.mkOption {
type = lib.types.nullOr (lib.types.listOf lib.types.str);
default = null;
description = ''
List of network interfaces that should be used by the {command}`avahi-daemon`.
Other interfaces will be ignored. If `null`, all local interfaces
except loopback and point-to-point will be used.
'';
};
denyInterfaces = lib.mkOption {
type = lib.types.nullOr (lib.types.listOf lib.types.str);
default = null;
description = ''
List of network interfaces that should be ignored by the
{command}`avahi-daemon`. Other unspecified interfaces will be used,
unless {option}`allowInterfaces` is set. This option takes precedence
over {option}`allowInterfaces`.
Configuration for {file}`avahi-daemon.conf` as a Nix attribute set.
See {manpage}`avahi-daemon.conf(5)` for available options.
'';
};
@@ -143,16 +349,6 @@ in
'';
};
allowPointToPoint = lib.mkOption {
type = lib.types.bool;
default = false;
description = ''
Whether to use POINTTOPOINT interfaces. Might make mDNS unreliable due to usually large
latencies with such links and opens a potential security hole by allowing mDNS access from Internet
connections.
'';
};
wideArea = lib.mkOption {
type = lib.types.bool;
default = false;
@@ -163,12 +359,6 @@ in
'';
};
reflector = lib.mkOption {
type = lib.types.bool;
default = false;
description = "Reflect incoming mDNS requests to all allowed network interfaces.";
};
extraServiceFiles = lib.mkOption {
type = with lib.types; attrsOf (either str path);
default = { };
@@ -196,45 +386,18 @@ in
publish = {
enable = lib.mkOption {
type = lib.types.bool;
default = false;
type = lib.types.nullOr lib.types.bool;
default = null;
visible = false;
description = "Whether to allow publishing in general.";
};
userServices = lib.mkOption {
type = lib.types.bool;
default = false;
type = lib.types.nullOr lib.types.bool;
default = null;
visible = false;
description = "Whether to publish user services. Will set `addresses=true`.";
};
addresses = lib.mkOption {
type = lib.types.bool;
default = false;
description = "Whether to register mDNS address records for all local IP addresses.";
};
hinfo = lib.mkOption {
type = lib.types.bool;
default = false;
description = ''
Whether to register a mDNS HINFO record which contains information about the
local operating system and CPU.
'';
};
workstation = lib.mkOption {
type = lib.types.bool;
default = false;
description = ''
Whether to register a service of type "_workstation._tcp" on the local LAN.
'';
};
domain = lib.mkOption {
type = lib.types.bool;
default = false;
description = "Whether to announce the locally used domain name for browsing by other hosts.";
};
};
nssmdns4 = lib.mkOption {
@@ -284,15 +447,6 @@ in
'';
};
cacheEntriesMax = lib.mkOption {
type = lib.types.nullOr lib.types.int;
default = null;
description = ''
Number of resource records to be cached per interface. Use 0 to
disable caching. Avahi daemon defaults to 4096 if not set.
'';
};
extraConfig = lib.mkOption {
type = lib.types.lines;
default = "";
@@ -304,155 +458,186 @@ in
debug = lib.mkEnableOption "debug logging";
};
config = lib.mkIf cfg.enable {
warnings = [
(lib.mkIf cfg.wideArea "Enabling `services.avahi.wideArea` exposes this system to `CVE-2024-52615`.")
];
config = lib.mkMerge [
{
assertions = [
{
assertion = cfg.nssmdnsFull -> (cfg.nssmdns4 || cfg.nssmdns6);
message = ''
`services.avahi.nssmdnsFull` requires one or both of `services.avahi.nssmdns4` and/or `services.avahi.nssmdns6` to be enabled.
'';
}
];
assertions = [
{
assertion = cfg.nssmdnsFull -> (cfg.nssmdns4 || cfg.nssmdns6);
message = ''
`services.avahi.nssmdnsFull` requires one or both of `services.avahi.nssmdns4` and/or `services.avahi.nssmdns6` to be enabled.
'';
}
];
warnings = [
(lib.mkIf cfg.wideArea "Enabling `services.avahi.wideArea` exposes this system to `CVE-2024-52615`.")
]
++ lib.optional (cfg.publish.enable != null) ''
The option `services.avahi.publish.enable` is obsolete. Use
`services.avahi.settings.publish."disable-publishing" = false;` instead.
''
++ lib.optional (cfg.publish.userServices != null) ''
The option `services.avahi.publish.userServices` is obsolete. Use
`services.avahi.settings.publish.disable-user-service-publishing = false;`
and `services.avahi.settings.publish.publish-addresses = true;` instead.
'';
users.users.avahi = {
description = "avahi-daemon privilege separation user";
home = "/var/empty";
group = "avahi";
isSystemUser = true;
};
services.avahi.settings = lib.mkMerge [
(lib.mkIf (config.networking.hostName != "") {
server.host-name = lib.mkDefault config.networking.hostName;
})
(lib.mkIf (cfg.publish.enable != null) {
publish.disable-publishing = lib.mkDefault (!cfg.publish.enable);
})
(lib.mkIf (cfg.publish.userServices != null) {
publish.disable-user-service-publishing = lib.mkDefault (!cfg.publish.userServices);
})
(lib.mkIf (cfg.publish.userServices == true) {
publish.publish-addresses = lib.mkDefault true;
})
(lib.mkIf cfg.wideArea {
wide-area.enable-wide-area = lib.mkDefault true;
})
];
}
users.groups.avahi = { };
(lib.mkIf cfg.enable {
users.users.avahi = {
description = "avahi-daemon privilege separation user";
home = "/var/empty";
group = "avahi";
isSystemUser = true;
};
system.nssModules = lib.optional (cfg.nssmdns4 || cfg.nssmdns6) pkgs.nssmdns;
system.nssDatabases.hosts =
let
mdns =
if (cfg.nssmdns4 && cfg.nssmdns6) then
"mdns"
else if (!cfg.nssmdns4 && cfg.nssmdns6) then
"mdns6"
else if (cfg.nssmdns4 && !cfg.nssmdns6) then
"mdns4"
else
"";
in
lib.optionals (cfg.nssmdns4 || cfg.nssmdns6) (
lib.mkMerge [
(lib.mkBefore [ "${mdns}_minimal [NOTFOUND=return]" ]) # before resolve
(lib.mkAfter (lib.optional cfg.nssmdnsFull "${mdns}")) # after dns
]
users.groups.avahi = { };
system.nssModules = lib.optional (cfg.nssmdns4 || cfg.nssmdns6) pkgs.nssmdns;
system.nssDatabases.hosts =
let
mdns =
if (cfg.nssmdns4 && cfg.nssmdns6) then
"mdns"
else if (!cfg.nssmdns4 && cfg.nssmdns6) then
"mdns6"
else if (cfg.nssmdns4 && !cfg.nssmdns6) then
"mdns4"
else
"";
in
lib.optionals (cfg.nssmdns4 || cfg.nssmdns6) (
lib.mkMerge [
(lib.mkBefore [ "${mdns}_minimal [NOTFOUND=return]" ]) # before resolve
(lib.mkAfter (lib.optional cfg.nssmdnsFull "${mdns}")) # after dns
]
);
environment.systemPackages = [ cfg.package ];
environment.etc = (
lib.mapAttrs' (
n: v:
lib.nameValuePair "avahi/services/${n}.service" {
${if lib.types.path.check v then "source" else "text"} = v;
}
) cfg.extraServiceFiles
);
environment.systemPackages = [ cfg.package ];
environment.etc = (
lib.mapAttrs' (
n: v:
lib.nameValuePair "avahi/services/${n}.service" {
${if lib.types.path.check v then "source" else "text"} = v;
}
) cfg.extraServiceFiles
);
systemd.sockets.avahi-daemon = {
description = "Avahi mDNS/DNS-SD Stack Activation Socket";
listenStreams = [ "/run/avahi-daemon/socket" ];
wantedBy = [ "sockets.target" ];
after = [
# Ensure that `/run/avahi-daemon` owned by `avahi` is created by `systemd.tmpfiles.rules` before the `avahi-daemon.socket`,
# otherwise `avahi-daemon.socket` will automatically create it owned by `root`, which will cause `avahi-daemon.service` to fail.
"systemd-tmpfiles-setup.service"
];
};
systemd.tmpfiles.rules = [ "d /run/avahi-daemon - avahi avahi -" ];
systemd.services.avahi-daemon = {
description = "Avahi mDNS/DNS-SD Stack";
wantedBy = [ "multi-user.target" ];
requires = [ "avahi-daemon.socket" ];
documentation = [
"man:avahi-daemon(8)"
"man:avahi-daemon.conf(5)"
"man:avahi.hosts(5)"
"man:avahi.service(5)"
];
# Make NSS modules visible so that `avahi_nss_support ()' can
# return a sensible value.
environment.LD_LIBRARY_PATH = config.system.nssModules.path;
path = [
pkgs.coreutils
cfg.package
];
serviceConfig = {
NotifyAccess = "main";
BusName = "org.freedesktop.Avahi";
Type = "dbus";
ExecStart = "${cfg.package}/sbin/avahi-daemon --syslog -f ${avahiDaemonConf} ${lib.optionalString cfg.debug "--debug"}";
ConfigurationDirectory = "avahi/services";
# Hardening
CapabilityBoundingSet = [
# https://github.com/avahi/avahi/blob/v0.9-rc1/avahi-daemon/caps.c#L38
"CAP_SYS_CHROOT"
"CAP_SETUID"
"CAP_SETGID"
systemd.sockets.avahi-daemon = {
description = "Avahi mDNS/DNS-SD Stack Activation Socket";
listenStreams = [ "/run/avahi-daemon/socket" ];
wantedBy = [ "sockets.target" ];
after = [
# Ensure that `/run/avahi-daemon` owned by `avahi` is created by `systemd.tmpfiles.rules` before the `avahi-daemon.socket`,
# otherwise `avahi-daemon.socket` will automatically create it owned by `root`, which will cause `avahi-daemon.service` to fail.
"systemd-tmpfiles-setup.service"
];
DevicePolicy = "closed";
LockPersonality = true;
MemoryDenyWriteExecute = true;
NoNewPrivileges = true;
PrivateDevices = true;
PrivateTmp = true;
PrivateUsers = false;
ProcSubset = "pid";
ProtectClock = true;
ProtectControlGroups = true;
ProtectHome = true;
ProtectHostname = true;
ProtectKernelLogs = true;
ProtectKernelModules = true;
ProtectKernelTunables = true;
ProtectProc = "invisible";
ProtectSystem = "strict";
RestrictAddressFamilies = [
"AF_INET"
"AF_INET6"
"AF_NETLINK"
"AF_UNIX"
];
RestrictNamespaces = true;
RestrictRealtime = true;
RestrictSUIDSGID = true;
SystemCallArchitectures = "native";
SystemCallFilter = [
"@system-service"
"~@privileged"
"@chown setgroups setresuid"
]
++ lib.optionals pkgs.stdenv.hostPlatform.is32bit [
# glibc's setresuid()/setgroups() invoke the kernel's 32-bit compat
# syscalls (setresuid32/setgroups32) on 32-bit architectures --
# distinct syscalls from the ones already allowlisted above, so
# without these 2, avahi-daemon is killed with SIGSYS as soon as it
# tries to drop privileges.
"setgroups32"
"setresuid32"
];
UMask = "0077";
};
};
services.dbus.enable = true;
services.dbus.packages = [ cfg.package ];
systemd.tmpfiles.rules = [ "d /run/avahi-daemon - avahi avahi -" ];
networking.firewall.allowedUDPPorts = lib.mkIf cfg.openFirewall [ 5353 ];
};
systemd.services.avahi-daemon = {
description = "Avahi mDNS/DNS-SD Stack";
wantedBy = [ "multi-user.target" ];
requires = [ "avahi-daemon.socket" ];
documentation = [
"man:avahi-daemon(8)"
"man:avahi-daemon.conf(5)"
"man:avahi.hosts(5)"
"man:avahi.service(5)"
];
# Make NSS modules visible so that `avahi_nss_support ()' can
# return a sensible value.
environment.LD_LIBRARY_PATH = config.system.nssModules.path;
path = [
pkgs.coreutils
cfg.package
];
serviceConfig = {
NotifyAccess = "main";
BusName = "org.freedesktop.Avahi";
Type = "dbus";
ExecStart = "${cfg.package}/sbin/avahi-daemon --syslog -f ${avahiDaemonConf} ${lib.optionalString cfg.debug "--debug"}";
ConfigurationDirectory = "avahi/services";
# Hardening
CapabilityBoundingSet = [
# https://github.com/avahi/avahi/blob/v0.9-rc1/avahi-daemon/caps.c#L38
"CAP_SYS_CHROOT"
"CAP_SETUID"
"CAP_SETGID"
];
DevicePolicy = "closed";
LockPersonality = true;
MemoryDenyWriteExecute = true;
NoNewPrivileges = true;
PrivateDevices = true;
PrivateTmp = true;
PrivateUsers = false;
ProcSubset = "pid";
ProtectClock = true;
ProtectControlGroups = true;
ProtectHome = true;
ProtectHostname = true;
ProtectKernelLogs = true;
ProtectKernelModules = true;
ProtectKernelTunables = true;
ProtectProc = "invisible";
ProtectSystem = "strict";
RestrictAddressFamilies = [
"AF_INET"
"AF_INET6"
"AF_NETLINK"
"AF_UNIX"
];
RestrictNamespaces = true;
RestrictRealtime = true;
RestrictSUIDSGID = true;
SystemCallArchitectures = "native";
SystemCallFilter = [
"@system-service"
"~@privileged"
"@chown setgroups setresuid"
]
++ lib.optionals pkgs.stdenv.hostPlatform.is32bit [
# glibc's setresuid()/setgroups() invoke the kernel's 32-bit compat
# syscalls (setresuid32/setgroups32) on 32-bit architectures --
# distinct syscalls from the ones already allowlisted above, so
# without these 2, avahi-daemon is killed with SIGSYS as soon as it
# tries to drop privileges.
"setgroups32"
"setresuid32"
];
UMask = "0077";
};
};
services.dbus.enable = true;
services.dbus.packages = [ cfg.package ];
networking.firewall.allowedUDPPorts = lib.mkIf cfg.openFirewall [ 5353 ];
})
];
}

5
nixos/modules/services/networking/netbird.nix
View File

@@ -14,7 +14,6 @@ let
getExe
listToAttrs
literalExpression
maintainers
makeBinPath
mapAttrs'
mapAttrsToList
@@ -73,9 +72,7 @@ let
nixosConfig = config;
in
{
meta.maintainers = with maintainers; [
nazarewk
];
meta.maintainers = [ ];
meta.doc = ./netbird.md;
imports = [

7
nixos/modules/services/networking/shairport-sync.nix
View File

@@ -124,8 +124,11 @@ in
];
services.avahi.enable = true;
services.avahi.publish.enable = true;
services.avahi.publish.userServices = true;
services.avahi.settings.publish = {
disable-publishing = false;
disable-user-service-publishing = false;
publish-addresses = true;
};
services.shairport-sync.settings = {
general.output_backend = lib.mkDefault "pulseaudio";

108
nixos/modules/services/networking/tlsrouter.nix Normal file
View File

@@ -0,0 +1,108 @@
{
config,
lib,
pkgs,
...
}:
let
inherit (lib)
concatStringsSep
getExe
literalExpression
maintainers
mapAttrsToList
mkIf
mkOption
mkPackageOption
optionalString
types
;
cfg = config.services.tlsrouter;
configFile = pkgs.writeText "tlsrouter.conf" (
concatStringsSep "\n" (
mapAttrsToList (src: opts: "${src} ${opts.backend}${optionalString opts.proxy " PROXY"}") cfg.routes
)
);
in
{
options.services.tlsrouter = {
enable = lib.mkEnableOption "TLS SNI router";
routes = mkOption {
type = types.attrsOf (
types.submodule {
options.proxy = mkOption {
type = types.bool;
default = false;
description = "If your backend supports HAProxy's PROXY protocol, you can enable it to receive the real client ip:port";
};
options.backend = mkOption {
type = types.nonEmptyStr;
description = "Backend address";
example = "localhost:1234";
};
}
);
description = "TLSRouter requires a configuration that tells it what backend to use for a given hostname";
example = literalExpression ''
{
# Basic hostname -> backend mapping
"go.universe.tf".backend = "localhost:1234";
# DNS wildcards are understood as well.
"*.go.universe.tf".backend = "1.2.3.4:8080";
# DNS wildcards can go anywhere in name.
"google.*".backend = "10.20.30.40:443";
# RE2 regexes are also available
"/(alpha|beta|gamma)\\.mon(itoring)?\\.dave\\.tf/".backend = "100.200.100.200:443";
# If your backend supports HAProxy's PROXY protocol, you can enable
# it to receive the real client ip:port.
"fancy.backend" = {
backend = "2.3.4.5:443";
proxy = true;
};
}
'';
};
listen = mkOption {
default = ":443";
type = types.str;
description = "Set the listen address.";
};
helloTimeout = mkOption {
default = "3s";
type = types.str;
description = "How long to wait for the start of the TLS handshake.";
};
package = mkPackageOption pkgs "tlsrouter" { };
};
config = mkIf cfg.enable {
systemd.services.tlsrouter = {
description = "TLS SNI router";
after = [ "network.target" ];
wantedBy = [ "multi-user.target" ];
serviceConfig = {
PermissionsStartOnly = true;
LimitNPROC = 512;
LimitNOFILE = 1048576;
CapabilityBoundingSet = "cap_net_bind_service";
AmbientCapabilities = "cap_net_bind_service";
NoNewPrivileges = true;
DynamicUser = true;
ExecStart = "${getExe cfg.package} -conf ${configFile} -listen ${cfg.listen} -hello-timeout ${cfg.helloTimeout}";
Restart = "on-failure";
};
};
};
meta.maintainers = [ maintainers.xsteadfastx ];
}

24
nixos/modules/services/security/fprintd.nix
View File

@@ -21,6 +21,23 @@ in
enable = lib.mkEnableOption "fprintd daemon and PAM module for fingerprint readers handling";
enablePam = lib.mkOption {
type = lib.types.bool;
default = cfg.enable;
defaultText = lib.literalExpression "config.services.fprintd.enable";
description = ''
When enabled, PAM services will be configured to use fprintd for authorization.
:::{.note}
Enabling this option will add fingerprint-based authorization to all
PAM services, including those which can authorize users in the background.
If this is undesired, you can override this setting on a per-service
basis through `config.security.pam.services.<name>.fprintAuth`.
See https://github.com/NixOS/nixpkgs/issues/442117
:::
'';
};
package = lib.mkOption {
type = lib.types.package;
default = fprintdPkg;
@@ -49,6 +66,13 @@ in
config = lib.mkIf cfg.enable {
assertions = [
{
assertion = cfg.enablePam -> cfg.enable;
message = "fprintd.enablePam depends on fprintd.enable";
}
];
services.dbus.packages = [ cfg.package ];
environment.systemPackages = [ cfg.package ];

195
nixos/modules/services/web-apps/atlantis.nix Normal file
View File

@@ -0,0 +1,195 @@
{
config,
lib,
pkgs,
utils,
...
}:
let
cfg = config.services.atlantis;
settingsFormat = pkgs.formats.yaml { };
in
{
options.services.atlantis = {
enable = lib.mkEnableOption "Atlantis service";
package = lib.mkPackageOption pkgs "atlantis" { };
user = lib.mkOption {
type = lib.types.str;
default = "atlantis";
description = "User account under which Atlantis runs.";
};
group = lib.mkOption {
type = lib.types.str;
default = "atlantis";
description = "Group account under which Atlantis runs.";
};
extraPackages = lib.mkOption {
type = lib.types.listOf lib.types.package;
default = [ ];
example = lib.literalExpression "[ pkgs.opentofu pkgs.nix ]";
description = ''
Extra packages to add to the Atlantis service PATH.
'';
};
settings = lib.mkOption {
description = ''
Settings written to the Atlantis server YAML configuration file.
The generated file is stored in the Nix store and readable by other
users. Keep secrets out of this option. Use
{option}`services.atlantis.environmentFile` to provide secret values
as environment variables, or {option}`services.atlantis.credentials`
to provide secret files whose paths are exposed as environment
variables.
See the docs for details:
<https://www.runatlantis.io/docs/server-configuration.html>
'';
example = lib.literalExpression ''
{
atlantis-url = "https://atlantis.example.com";
gh-user = "github_user";
repo-allowlist = "github.com/yourorg/yourrepo";
default-tf-version = "1.12.2";
}
'';
type = lib.types.submodule {
freeformType = settingsFormat.type;
options.port = lib.mkOption {
type = lib.types.port;
default = 4141;
description = "Port on which Atlantis listens.";
};
};
default = { };
};
extraArgs = lib.mkOption {
type = lib.types.listOf lib.types.str;
default = [ ];
example = [ "--verbose" ];
description = ''
Extra command-line arguments to pass to `atlantis server`.
'';
};
openFirewall = lib.mkOption {
type = lib.types.bool;
default = false;
description = ''
Whether to open the firewall port for Atlantis.
'';
};
environmentFile = lib.mkOption {
type = lib.types.nullOr lib.types.path;
default = null;
example = "/run/secrets/atlantis";
description = ''
Environment file containing secrets.
Restart Atlantis to load changes to the file.
'';
};
environment = lib.mkOption {
type = lib.types.attrsOf lib.types.str;
default = { };
description = ''
Environment variables to pass to Atlantis and its Terraform subprocesses.
'';
example = lib.literalExpression ''
{
ATLANTIS_GH_USER = "atlantis-bot";
}
'';
};
credentials = lib.mkOption {
type = lib.types.attrsOf lib.types.path;
default = { };
description = ''
Secret files to pass to Atlantis and its Terraform subprocesses. Each
attribute name is exported with the systemd credential path as its
value. For example, a `TF_VAR_` attribute lets Terraform consume the
file with `file(var.<name>)`. Values are loaded with systemd
`LoadCredential`. Restart Atlantis to load changes to the files.
'';
example = lib.literalExpression ''
{
TF_VAR_example_secret_file = "/run/secrets/example";
}
'';
};
dataDir = lib.mkOption {
description = "Data directory for Atlantis.";
default = "/var/lib/atlantis";
type = lib.types.path;
};
};
config = lib.mkIf cfg.enable {
assertions = [
{
assertion = builtins.intersectAttrs cfg.credentials cfg.environment == { };
message = "services.atlantis.credentials and services.atlantis.environment must not define the same environment variable names.";
}
];
networking.firewall.allowedTCPPorts = lib.optional cfg.openFirewall cfg.settings.port;
systemd = {
services.atlantis = {
description = "Atlantis Terraform Pull Request Automation Service";
after = [ "network.target" ];
wants = [ "network.target" ];
wantedBy = [ "multi-user.target" ];
path = [
pkgs.git
pkgs.bash
pkgs.conftest
]
++ cfg.extraPackages;
environment = (lib.mapAttrs (name: _: "%d/${name}") cfg.credentials) // cfg.environment;
serviceConfig = {
StateDirectory = lib.mkIf (cfg.dataDir == "/var/lib/atlantis") "atlantis";
StateDirectoryMode = "0700";
WorkingDirectory = cfg.dataDir;
User = cfg.user;
Group = cfg.group;
PrivateTmp = true;
RestartSec = "5s";
EnvironmentFile = lib.mkIf (cfg.environmentFile != null) cfg.environmentFile;
LoadCredential = lib.mapAttrsToList (name: path: "${name}:${path}") cfg.credentials;
ExecStart = utils.escapeSystemdExecArgs (
[
(lib.getExe cfg.package)
"server"
"--config"
(settingsFormat.generate "atlantis-config.yaml" cfg.settings)
]
++ cfg.extraArgs
);
Restart = "on-failure";
};
};
};
users.users = lib.optionalAttrs (cfg.user == "atlantis") {
atlantis = {
description = "Atlantis user";
home = cfg.dataDir;
createHome = true;
group = cfg.group;
isSystemUser = true;
};
};
users.groups = lib.optionalAttrs (cfg.group == "atlantis") {
atlantis = { };
};
};
}

49
nixos/modules/system/boot/zswap.nix
View File

@@ -20,6 +20,12 @@ let
# Check if kernel supports zsmalloc as zswap backend (>= 6.3)
zsmallocSupported = versionAtLeast kernelVersion "6.3";
# Check if kernel supports zbud and z3fold backends (< 6.15)
zbudSupported = versionOlder kernelVersion "6.15";
# Check if kernel supports zpool abstraction and configuration (< 6.18)
zpoolSupported = versionOlder kernelVersion "6.18";
in
{
options.boot.zswap = {
@@ -54,6 +60,7 @@ in
type = types.enum [
"zsmalloc"
"zbud"
"z3fold"
];
default = if zsmallocSupported then "zsmalloc" else "zbud";
defaultText = literalExpression "if kernel >= 6.3 then \"zsmalloc\" else \"zbud\"";
@@ -62,7 +69,7 @@ in
'zsmalloc' is strongly recommended for kernels >= 6.3 as it offers the best density.
For older kernels, 'zbud' is the fallback.
Note: 'z3fold' was removed from Linux kernel 6.8 and later.
Note: 'zbud' and 'z3fold' were removed from Linux kernel 6.15 and later.
'';
};
@@ -108,6 +115,22 @@ in
on systems with limited memory.
'';
};
dynamicSwap = mkOption {
type = types.bool;
default = config.services.swapspace.enable;
defaultText = literalExpression "config.services.swapspace.enable";
visible = false;
description = ''
Zswap requires a swap device to work properly. By default, the zswap
module checks for an entry in 'swapDevices' to ensure this condition
is met. However, some setups add swap devices dynamically, such as with
GPT partition auto discovery or 'services.swapspace'.
Set this value to true to assert that a swap device will be added
dynamically, and bypass the check for a 'swapDevices' entry.
'';
};
};
config = mkIf cfg.enable {
@@ -115,11 +138,11 @@ in
boot.kernelParams = [
"zswap.enabled=1"
"zswap.compressor=${cfg.compressor}"
"zswap.zpool=${cfg.zpool}"
"zswap.max_pool_percent=${toString cfg.maxPoolPercent}"
"zswap.accept_threshold_percent=${toString cfg.acceptThresholdPercent}"
"zswap.shrinker_enabled=${if cfg.shrinkerEnabled then "1" else "0"}"
];
]
++ optional zpoolSupported "zswap.zpool=${cfg.zpool}";
# 2. Dependency management: ensure required modules are included in initrd or kernel
# This ensures Zswap is ready early in the boot process (before swap is mounted)
@@ -133,11 +156,11 @@ in
boot.kernel.sysfs.module.zswap.parameters = {
enabled = true;
compressor = cfg.compressor;
zpool = cfg.zpool;
max_pool_percent = cfg.maxPoolPercent;
accept_threshold_percent = cfg.acceptThresholdPercent;
shrinker_enabled = true;
};
shrinker_enabled = cfg.shrinkerEnabled;
}
// optionalAttrs zpoolSupported { zpool = cfg.zpool; };
assertions = [
{
@@ -154,7 +177,7 @@ in
'';
}
{
assertion = config.swapDevices != [ ];
assertion = config.swapDevices != [ ] || cfg.dynamicSwap;
message = ''
Zswap requires at least one physical swap device to function as a backing store.
@@ -164,6 +187,9 @@ in
device = "/var/lib/swapfile";
size = 16 * 1024; # 16GB
} ];
If swap devices will be added dynamically (eg. by GPT partition auto discovery),
set 'boot.zswap.dynamicSwap = true' to bypass this check.
'';
}
{
@@ -175,6 +201,15 @@ in
Please use 'zbud' instead: boot.zswap.zpool = "zbud";
'';
}
{
assertion = (cfg.zpool != "zsmalloc") -> zbudSupported;
message = ''
Zswap allocators 'zbud' and 'z3fold' are not supported on kernel version ${kernelVersion}.
Support for zbud and z3fold in Zswap was removed in Linux 6.15 in favor of zsmalloc.
Please use 'zsmalloc' instead: boot.zswap.zpool = "zsmalloc";
'';
}
];
};

2
nixos/tests/all-tests.nix
View File

@@ -296,6 +296,7 @@ in
artalk = runTest ./artalk.nix;
asynch = runTest ./asynch.nix;
atd = runTest ./atd.nix;
atlantis = runTest ./atlantis.nix;
atop = import ./atop.nix { inherit pkgs runTest; };
atticd = runTest ./atticd.nix;
attr = pkgs.callPackage ./attr.nix { };
@@ -1954,6 +1955,7 @@ in
tinyproxy = runTest ./tinyproxy.nix;
tinywl = runTest ./tinywl.nix;
tlshd = runTest ./tlshd.nix;
tlsrouter = runTest ./tlsrouter.nix;
tlsrpt = runTest ./tlsrpt.nix;
tmate-ssh-server = runTest ./tmate-ssh-server.nix;
tomcat = runTest ./tomcat.nix;

197
nixos/tests/atlantis.nix Normal file
View File

@@ -0,0 +1,197 @@
{ pkgs, ... }:
let
inherit (pkgs) lib;
mainTf = pkgs.writeText "main.tf" ''
terraform {
required_version = ">= 1.0.0"
}
resource "terraform_data" "example" {
input = "hello-atlantis"
}
'';
in
{
name = "atlantis";
meta.maintainers = pkgs.atlantis.meta.maintainers ++ [ lib.maintainers.jwygoda ];
nodes.machine =
{ lib, pkgs, ... }:
{
virtualisation.memorySize = 2048;
services.gitea = {
enable = true;
database.type = "sqlite3";
settings = {
server.ROOT_URL = "http://127.0.0.1:3000/";
service.DISABLE_REGISTRATION = true;
security.ALLOWED_HOST_LIST = "loopback";
};
};
services.atlantis = {
enable = true;
openFirewall = true;
extraPackages = [ pkgs.opentofu ];
environmentFile = "/run/secrets/atlantis.env";
credentials.TF_VAR_example_secret_file = "/run/secrets/example";
settings = {
atlantis-url = "http://127.0.0.1:4141";
gitea-base-url = "http://127.0.0.1:3000";
gitea-user = "test";
gitea-webhook-secret = "webhooksecret";
repo-allowlist = "*";
write-git-creds = true;
default-tf-distribution = "opentofu";
default-tf-version = pkgs.opentofu.version;
tf-download = false;
};
};
# Start Atlantis after Gitea user & API token are initialized
systemd.services.atlantis.wantedBy = lib.mkForce [ ];
environment.systemPackages = with pkgs; [
curl
git
gitea
jq
opentofu
];
};
testScript = ''
import json
start_all()
machine.wait_for_unit("gitea.service")
machine.wait_for_open_port(3000)
machine.succeed("curl --fail http://127.0.0.1:3000/")
with subtest("Initialize Gitea admin user and API token"):
machine.succeed(
"su -l gitea -c 'GITEA_WORK_DIR=/var/lib/gitea ${lib.getExe pkgs.gitea} admin user create "
"--username test --password totallysafe --email test@localhost --admin'"
)
api_token = machine.succeed(
"curl --fail -s -X POST http://test:totallysafe@127.0.0.1:3000/api/v1/users/test/tokens "
"-H 'Accept: application/json' -H 'Content-Type: application/json' "
"-d '{\"name\":\"atlantis\",\"scopes\":[\"all\"]}' | jq -r '.sha1'"
).strip()
with subtest("Create repository and webhook for Atlantis"):
machine.succeed(
"curl --fail -s -X POST http://127.0.0.1:3000/api/v1/user/repos "
f"-H 'Authorization: token {api_token}' -H 'Content-Type: application/json' "
"-d '{\"name\":\"infra\",\"auto_init\":true,\"default_branch\":\"main\"}'"
)
webhook_payload = json.dumps({
"type": "gitea",
"config": {
"url": "http://127.0.0.1:4141/events",
"content_type": "json",
"secret": "webhooksecret",
},
"events": ["push", "pull_request", "issue_comment"],
"active": True,
})
machine.succeed(
f"curl --fail -s -X POST http://127.0.0.1:3000/api/v1/repos/test/infra/hooks "
f"-H 'Authorization: token {api_token}' -H 'Content-Type: application/json' "
f"-d '{webhook_payload}'"
)
with subtest("Start Atlantis service"):
machine.succeed("mkdir -p /run/secrets /run/secret-targets")
machine.succeed(f"echo ATLANTIS_GITEA_TOKEN={api_token} > /run/secret-targets/atlantis.env.1")
machine.succeed("ln -s /run/secret-targets/atlantis.env.1 /run/secrets/atlantis.env")
machine.succeed("echo original > /run/secret-targets/example.1")
machine.succeed("ln -s /run/secret-targets/example.1 /run/secrets/example")
machine.succeed("systemctl start atlantis.service")
machine.wait_for_unit("atlantis.service")
machine.wait_for_open_port(4141)
machine.succeed("curl --fail http://127.0.0.1:4141/healthz")
with subtest("Push branch with Terraform configuration and open Pull Request"):
machine.succeed("git config --global user.email test@localhost")
machine.succeed("git config --global user.name test")
machine.succeed(
f"git clone http://test:{api_token}@127.0.0.1:3000/test/infra.git /tmp/infra"
)
machine.succeed("git -C /tmp/infra checkout -b add-tf")
machine.succeed("cp ${mainTf} /tmp/infra/main.tf")
machine.succeed("git -C /tmp/infra add main.tf")
machine.succeed("git -C /tmp/infra commit -m 'Add terraform resource'")
machine.succeed("git -C /tmp/infra push origin add-tf")
pr_payload = json.dumps({
"base": "main",
"head": "add-tf",
"title": "Add Terraform resource",
})
machine.succeed(
f"curl --fail -s -X POST http://127.0.0.1:3000/api/v1/repos/test/infra/pulls "
f"-H 'Authorization: token {api_token}' -H 'Content-Type: application/json' "
f"-d '{pr_payload}'"
)
with subtest("Verify Atlantis automatically runs plan on PR"):
machine.wait_until_succeeds(
f"curl --fail -s http://127.0.0.1:3000/api/v1/repos/test/infra/issues/1/comments "
f"-H 'Authorization: token {api_token}' | jq -r '.[].body' | grep -i 'Plan: 1 to add'"
)
with subtest("Verify Atlantis executes apply on comment"):
apply_comment = json.dumps({"body": "atlantis apply"})
machine.succeed(
f"curl --fail -s -X POST http://127.0.0.1:3000/api/v1/repos/test/infra/issues/1/comments "
f"-H 'Authorization: token {api_token}' -H 'Content-Type: application/json' "
f"-d '{apply_comment}'"
)
machine.wait_until_succeeds(
f"curl --fail -s http://127.0.0.1:3000/api/v1/repos/test/infra/issues/1/comments "
f"-H 'Authorization: token {api_token}' | jq -r '.[].body' | grep -i 'Apply complete'"
)
def main_pid():
return machine.succeed("systemctl show atlantis.service --property=MainPID --value").strip()
def restart_atlantis(previous_pid):
machine.succeed("systemctl restart atlantis.service")
machine.wait_until_succeeds(
"pid=$(systemctl show atlantis.service --property=MainPID --value); "
f"test $pid -gt 0 && test $pid -ne {previous_pid} && "
"curl --fail http://127.0.0.1:4141/healthz"
)
def credential_value():
return machine.succeed(
f"cat /proc/{main_pid()}/root/run/credentials/atlantis.service/TF_VAR_example_secret_file"
).strip()
with subtest("Credentials are exposed through their systemd credential paths"):
machine.succeed(
"grep -zFxq TF_VAR_example_secret_file=/run/credentials/atlantis.service/TF_VAR_example_secret_file "
f"/proc/{main_pid()}/environ"
)
assert credential_value() == "original"
with subtest("Restarting Atlantis loads updated credential contents through a symlink"):
previous_pid = main_pid()
machine.succeed("echo updated > /run/secret-targets/example.1")
restart_atlantis(previous_pid)
assert credential_value() == "updated"
with subtest("Restarting Atlantis loads updated environment file contents through a symlink"):
previous_pid = main_pid()
machine.succeed(
f"printf 'ATLANTIS_GITEA_TOKEN={api_token}\\nROTATION_TEST=rotated\\n' > /run/secret-targets/atlantis.env.1"
)
restart_atlantis(previous_pid)
machine.succeed(f"grep -zFxq ROTATION_TEST=rotated /proc/{main_pid()}/environ")
'';
}

12
nixos/tests/avahi.nix
View File

@@ -19,11 +19,13 @@
services.avahi = {
enable = true;
nssmdns4 = true;
publish.addresses = true;
publish.domain = true;
publish.enable = true;
publish.userServices = true;
publish.workstation = true;
settings.publish = {
disable-publishing = false;
disable-user-service-publishing = false;
publish-addresses = true;
publish-domain = true;
publish-workstation = true;
};
extraServiceFiles.ssh = "${pkgs.avahi}/etc/avahi/services/ssh.service";
debug = true;
};

6
nixos/tests/taskchampion-sync-server.nix
View File

@@ -2,7 +2,7 @@
{
name = "taskchampion-sync-server";
nodes = {
containers = {
server = {
services.taskchampion-sync-server.enable = true;
services.taskchampion-sync-server.host = "0.0.0.0";
@@ -15,9 +15,9 @@
};
};
testScript =
{ nodes, ... }:
{ containers, ... }:
let
cfg = nodes.server.services.taskchampion-sync-server;
cfg = containers.server.services.taskchampion-sync-server;
port = toString cfg.port;
# Generated with uuidgen
uuid = "bf01376e-04a4-435a-9263-608567531af3";

42
nixos/tests/tlsrouter.nix Normal file
View File

@@ -0,0 +1,42 @@
{ lib, pkgs, ... }:
{
name = "tlsrouter";
meta.maintainers = with lib.maintainers; [ xsteadfastx ];
nodes.node = {
services = {
caddy = {
enable = true;
configFile = pkgs.writeText "Caddyfile" ''
{
https_port 3000
}
foo.bar.tld {
tls internal
respond "hello world"
}
'';
};
tlsrouter = {
enable = true;
routes."foo.bar.tld".backend = "127.0.0.1:3000";
};
};
};
testScript = ''
start_all()
node.wait_for_unit("caddy")
node.wait_for_open_port(3000)
node.wait_for_unit("tlsrouter")
node.wait_for_open_port(443)
node.succeed("curl --fail -k --resolve foo.bar.tld:443:127.0.0.1 https://foo.bar.tld | grep hello")
'';
}

19
pkgs/applications/editors/emacs/build-support/tests/with-packages.el
View File

@@ -276,15 +276,16 @@ This is a regression test for URL `https://github.com/NixOS/nixpkgs/pull/538964'
(file-exists-p (file-name-parent-directory eln-dir)))))))
(defun with-packages-fonts-of-requested-packages-are-available ()
(let ((font "Hack"))
(append
(let ((graphical-frame (make-frame-on-display (getenv "DISPLAY"))))
(unwind-protect
(list (display-graphic-p graphical-frame)
(member font (font-family-list graphical-frame)))
(delete-frame graphical-frame)))
;; Subprocess does not see wrapper-added fonts.
(list (equal 1 (call-process "fc-list" nil nil nil "--quiet" font))))))
(cl-loop
for font in '("Hack" ; Directly added by the wrapper.
"all-the-icons") ; Indirectly added by the wrapper.
append (let ((graphical-frame (make-frame-on-display (getenv "DISPLAY"))))
(unwind-protect
(list (display-graphic-p graphical-frame)
(member font (font-family-list graphical-frame)))
(delete-frame graphical-frame)))
;; Subprocess does not see wrapper-added fonts.
collect (equal 1 (call-process "fc-list" nil nil nil "--quiet" font))))
(define-with-packages-non-batch-ert-tests
with-packages-early-default-is-loaded

1
pkgs/applications/editors/emacs/build-support/tests/with-packages.nix
View File

@@ -19,6 +19,7 @@ let
runtimeInputs = [
(emacs.pkgs.withPackages (epkgs: [
hack-font
epkgs.all-the-icons
epkgs.dash
epkgs.flx-ido
(epkgs.callPackage (mkEpkg {

4
pkgs/applications/editors/emacs/elisp-packages/melpa-packages.nix
View File

@@ -776,6 +776,8 @@ let
# https://github.com/gergelypolonkai/alert-termux/issues/2
alert-termux = addPackageRequires super.alert-termux [ self.alert ];
all-the-icons = addPackageRequires super.all-the-icons [ pkgs.emacs-all-the-icons-fonts ];
# https://github.com/magnars/angular-snippets.el/issues/7
angular-snippets = addPackageRequires super.angular-snippets [ self.yasnippet ];
@@ -1463,6 +1465,8 @@ let
# empty tools/ncl-mode-keywords.el causing native-compiler-error-empty-byte
ncl-mode = ignoreCompilationError super.ncl-mode;
nerd-icons = addPackageRequires super.nerd-icons [ pkgs.nerd-fonts.symbols-only ];
# missing optional dependencies
netease-cloud-music = addPackageRequires super.netease-cloud-music [ self.async ];

118
pkgs/applications/editors/vim/plugins/generated.nix
View File

@@ -461,12 +461,12 @@ final: prev: {
SchemaStore-nvim = buildVimPlugin {
pname = "SchemaStore.nvim";
version = "0-unstable-2026-10-12";
version = "0-unstable-2026-10-15";
src = fetchFromGitHub {
owner = "b0o";
repo = "SchemaStore.nvim";
rev = "9ec57eeac6e2e14b7b9b9e74dc8b0ca4954a684b";
hash = "sha256-BBnr1dlLiaWNShjbAUF3I3EhusQ0fNbca7mstyrNhNI=";
rev = "7fca30f2890a6acf9d21d194876c6ac960d92070";
hash = "sha256-MAm4hVrZRYXNSBeUKlVr3GuDOkSXrvxYzGzJ0dQ9Vrs=";
};
meta.homepage = "https://github.com/b0o/SchemaStore.nvim/";
meta.license = getLicenseFromSpdxId "Apache-2.0";
@@ -1079,12 +1079,12 @@ final: prev: {
astrocore = buildVimPlugin {
pname = "astrocore";
version = "3.1.1";
version = "3.1.2";
src = fetchFromGitHub {
owner = "AstroNvim";
repo = "astrocore";
tag = "v3.1.1";
hash = "sha256-EBCcsVcdZtrHY7QO+/qc0Yf9tXR1HpOYF+txAv6kbSM=";
tag = "v3.1.2";
hash = "sha256-rdn45y1i9YgqwoyGyzLS+fy7gh83XUSfSf8L5ek/hLo=";
};
meta.homepage = "https://github.com/AstroNvim/astrocore/";
meta.license = getLicenseFromSpdxId "GPL-3.0-only";
@@ -1289,12 +1289,12 @@ final: prev: {
atlas-nvim = buildVimPlugin {
pname = "atlas.nvim";
version = "0.8.0";
version = "0.8.2";
src = fetchFromGitHub {
owner = "emrearmagan";
repo = "atlas.nvim";
tag = "0.8.0";
hash = "sha256-Hjl8SsHNtiZ3lqbg1ZVMeipzHBW0/HX7Q3o8OZ8/zOc=";
tag = "0.8.2";
hash = "sha256-qjVbG6lTJdkMIpRMZqWbuBsITD671ZW+w8gzcpRKe9Q=";
};
meta.homepage = "https://github.com/emrearmagan/atlas.nvim/";
meta.license = getLicenseFromSpdxId "MIT";
@@ -5336,12 +5336,12 @@ final: prev: {
diffview-plus-nvim = buildVimPlugin {
pname = "diffview-plus.nvim";
version = "0.38";
version = "0.39";
src = fetchFromGitHub {
owner = "dlyongemallo";
repo = "diffview-plus.nvim";
tag = "v0.38";
hash = "sha256-g9pzU0BmW4TapywQj344PzvKWWSiybt1tUZL1oIoTLI=";
tag = "v0.39";
hash = "sha256-0Zu2HPU9rzsyIOVLPWB9ABmfu5UffYkJtkIQUtBLVOs=";
};
meta.homepage = "https://github.com/dlyongemallo/diffview-plus.nvim/";
meta.license = unfree;
@@ -6837,11 +6837,11 @@ final: prev: {
gitlab-vim = buildVimPlugin {
pname = "gitlab.vim";
version = "1.1.0-unstable-2026-10-09";
version = "1.1.0-unstable-2026-10-14";
src = fetchgit {
url = "https://gitlab.com/gitlab-org/editor-extensions/gitlab.vim";
rev = "e36c687410733b9a8318b98bd01561f9482cf43b";
hash = "sha256-e0IRUo02QhEZOX9NMhsN7ixV7lMn9rhXduN0ORcmKBA=";
rev = "a867a65a65d9d236164ed009fb534813d2e2c60b";
hash = "sha256-gv3sQkHA5J07J2qfuB6Hw/9LdC+vG9r58j4UT5t2U1s=";
};
meta.homepage = "https://gitlab.com/gitlab-org/editor-extensions/gitlab.vim";
meta.license = unfree;
@@ -7761,12 +7761,12 @@ final: prev: {
hunk-nvim = buildVimPlugin {
pname = "hunk.nvim";
version = "1.10.0";
version = "1.11.0";
src = fetchFromGitHub {
owner = "julienvincent";
repo = "hunk.nvim";
tag = "v1.10.0";
hash = "sha256-HcQNn1qsY9seuyLjX1Z9FCSRs3cdoxYDL3lZIOjwwog=";
tag = "v1.11.0";
hash = "sha256-zbjwCqgokAlYM2zADhotSr/XDpgcF9O/NFeH/bCyxFs=";
};
meta.homepage = "https://github.com/julienvincent/hunk.nvim/";
meta.license = getLicenseFromSpdxId "MIT";
@@ -8490,12 +8490,12 @@ final: prev: {
kanagawa-paper-nvim = buildVimPlugin {
pname = "kanagawa-paper.nvim";
version = "4.0.0-unstable-2026-05-26";
version = "4.1.0";
src = fetchFromGitHub {
owner = "thesimonho";
repo = "kanagawa-paper.nvim";
rev = "ecf19801a2673054c19421d82b766f7641688320";
hash = "sha256-yzu0EvZseFlLB1Flho6WigMnuLL3inLIflxPU3LUPv0=";
tag = "v4.1.0";
hash = "sha256-Xvbmnnpns/mkOgjeWHxf7yC8BPKNsdIS0U4+7LbIZf4=";
};
meta.homepage = "https://github.com/thesimonho/kanagawa-paper.nvim/";
meta.license = getLicenseFromSpdxId "MIT";
@@ -10883,12 +10883,12 @@ final: prev: {
multicursor-nvim = buildVimPlugin {
pname = "multicursor.nvim";
version = "0-unstable-2026-03-24";
version = "0-unstable-2026-10-15";
src = fetchFromGitHub {
owner = "jake-stewart";
repo = "multicursor.nvim";
rev = "704b99f10a72cc05d370cfeb294ff83412a8ab55";
hash = "sha256-JHl8Z7ESrWus2I6Pe+6gmdgCAZOzAKX7kimy71sAoe4=";
rev = "c574bfc1f7e63dfea3e64b8453c9f7c660127238";
hash = "sha256-tVaV4upuRCWOlRroVq6U8RM6apgDigWdQ0b/0xtnaZ0=";
};
meta.homepage = "https://github.com/jake-stewart/multicursor.nvim/";
meta.license = getLicenseFromSpdxId "MIT";
@@ -11275,12 +11275,12 @@ final: prev: {
neoconf-nvim = buildVimPlugin {
pname = "neoconf.nvim";
version = "1.4.0-unstable-2026-10-13";
version = "1.4.0-unstable-2026-10-15";
src = fetchFromGitHub {
owner = "folke";
repo = "neoconf.nvim";
rev = "f64f69999d545e5474ce71401140053e4d47d94f";
hash = "sha256-EMQWZOAF84kqhL/wn4EYA46mU2XSvosGKjKAHXRDVsY=";
rev = "7bef87a16e161b3311b76ec5aa4ad8581935788e";
hash = "sha256-AyD3bmf+3qlwC77ViC5+KUn4DI/dmQnAzkgLwUS0J3Q=";
};
meta.homepage = "https://github.com/folke/neoconf.nvim/";
meta.license = getLicenseFromSpdxId "Apache-2.0";
@@ -11359,12 +11359,12 @@ final: prev: {
neogit = buildVimPlugin {
pname = "neogit";
version = "3.0.0-unstable-2026-10-13";
version = "3.0.0-unstable-2026-10-14";
src = fetchFromGitHub {
owner = "NeogitOrg";
repo = "neogit";
rev = "fb6a56256174e28d8bb1c05a3172712d5c7b0ec5";
hash = "sha256-KZYhfu1aTRs3k0bFhMDoLtxjeIo3mRilcDiCF4KtDbY=";
rev = "a6549816e62cec7037f1549d8f1659d45635370c";
hash = "sha256-B2phtEz/UfqooGgIy2RGmKgTiYOOwMP1nIr1qKp9Uy0=";
};
meta.homepage = "https://github.com/NeogitOrg/neogit/";
meta.license = getLicenseFromSpdxId "MIT";
@@ -14042,12 +14042,12 @@ final: prev: {
nvim-treesitter = buildVimPlugin {
pname = "nvim-treesitter";
version = "0.10.0-unstable-2026-10-10";
version = "0.10.0-unstable-2026-10-14";
src = fetchFromGitHub {
owner = "nvim-treesitter";
repo = "nvim-treesitter";
rev = "1a4f47b03dfe92d28de7d5654c67327ef008c9e6";
hash = "sha256-lqltLeAEVJLXOhmhcKEDPTZYWYcjOHWaILZyMM3rZx4=";
rev = "ca581c3436fc2b236847f5b739ebc263739e5ca6";
hash = "sha256-2KMktps3gP0nkQDxbsWACbBQRhToEFbdIAeXyEirxAY=";
};
meta.homepage = "https://github.com/nvim-treesitter/nvim-treesitter/";
meta.license = getLicenseFromSpdxId "Apache-2.0";
@@ -14504,12 +14504,12 @@ final: prev: {
octo-nvim = buildVimPlugin {
pname = "octo.nvim";
version = "0-unstable-2026-10-09";
version = "0-unstable-2026-10-13";
src = fetchFromGitHub {
owner = "pwntester";
repo = "octo.nvim";
rev = "4da45270d8d50df74719b1886270419337ee7005";
hash = "sha256-0QlHlo7EoXkcUunqtcurusOS3x/PSxp0gGrTOdFtiGo=";
rev = "8461d99d13cca243f89848bf4d9fadee096f0a48";
hash = "sha256-HZOX3QIZ6XZVuiSnr9rbdmd7yNk+uDznC98GcEb9qBE=";
};
meta.homepage = "https://github.com/pwntester/octo.nvim/";
meta.license = getLicenseFromSpdxId "MIT";
@@ -15121,12 +15121,12 @@ final: prev: {
persisted-nvim = buildVimPlugin {
pname = "persisted.nvim";
version = "3.1.0";
version = "3.1.1";
src = fetchFromGitHub {
owner = "olimorris";
repo = "persisted.nvim";
tag = "v3.1.0";
hash = "sha256-DCO1ztkXaS2QJF/nrUB3DQg838MepjiJ+zGUY7z6VFo=";
tag = "v3.1.1";
hash = "sha256-60EEsubE0DiRpnoTslpvj4pMKK/TjubLA5UxEytuJUI=";
};
meta.homepage = "https://github.com/olimorris/persisted.nvim/";
meta.license = getLicenseFromSpdxId "MIT";
@@ -18319,12 +18319,12 @@ final: prev: {
tiny-glimmer-nvim = buildVimPlugin {
pname = "tiny-glimmer.nvim";
version = "0-unstable-2026-07-05";
version = "0-unstable-2026-10-15";
src = fetchFromGitHub {
owner = "rachartier";
repo = "tiny-glimmer.nvim";
rev = "9a48d8a7436231cb16d47c88f924702e5602870a";
hash = "sha256-ONv/NE4D5vWNV56oJc/h5/nniOWjH5eUG0Q80dMVSxg=";
rev = "b35d4f7b0eaedb75ff99fa694f4d1ea2ce8ce6c8";
hash = "sha256-J6DZcSDLhHLvMya/P5ylbHltfP7cdifMX4SFWbJyidg=";
};
meta.homepage = "https://github.com/rachartier/tiny-glimmer.nvim/";
meta.license = getLicenseFromSpdxId "MIT";
@@ -20609,8 +20609,8 @@ final: prev: {
src = fetchFromGitHub {
owner = "sergioia-dev";
repo = "vim-dadbod-manager-ui";
rev = "ab5ea7b71cec9a753b90a0f8e8b2c9267b8c83bf";
hash = "sha256-9x3RkiL9rLhJ1dhLlNdnGd9BqXY3mZGjEzqWWr89R0Q=";
rev = "af428003c97f733be565aa0c8a1e9ce66de415bc";
hash = "sha256-B6E3stJIDaEFCAU4QkgvL7WMCElwHfKdtzkcspibboE=";
};
meta.homepage = "https://github.com/sergioia-dev/vim-dadbod-manager-ui/";
meta.license = getLicenseFromSpdxId "MIT";
@@ -22553,12 +22553,12 @@ final: prev: {
vim-lsp = buildVimPlugin {
pname = "vim-lsp";
version = "0.1.4-unstable-2026-10-04";
version = "0.1.4-unstable-2026-10-15";
src = fetchFromGitHub {
owner = "prabirshrestha";
repo = "vim-lsp";
rev = "81481196aa69036d6cdf96cd9374d4827a708ba4";
hash = "sha256-vT82SU78WM95c9DfGQcQ4vhCdJl9yOCMoeLMYQprO/A=";
rev = "977e704cdbbbbc89a54f8f226d3468b0aa0405c9";
hash = "sha256-cOsDjV3g8Qa3wrPS61hyVbNYk8I+GMZX5u64mFMzBBY=";
};
meta.homepage = "https://github.com/prabirshrestha/vim-lsp/";
meta.license = getLicenseFromSpdxId "MIT";
@@ -22595,12 +22595,12 @@ final: prev: {
vim-lsp-settings = buildVimPlugin {
pname = "vim-lsp-settings";
version = "0.0.1-unstable-2026-10-01";
version = "0.0.1-unstable-2026-10-15";
src = fetchFromGitHub {
owner = "mattn";
repo = "vim-lsp-settings";
rev = "adbd9698b7cd417d76038487fc9158208c1e8566";
hash = "sha256-X8Yo3XYFodgpp9R1KFzsyj292iIbY/QPwU4jn/LU7LM=";
rev = "d33977aad57dffe813219ab6dff8e3dbc15a7ba4";
hash = "sha256-mRDfOjMITxyQmHeXFg7NCaB3RA4KIGQa2QFYItfzvpI=";
};
meta.homepage = "https://github.com/mattn/vim-lsp-settings/";
meta.license = getLicenseFromSpdxId "MIT";
@@ -23491,12 +23491,12 @@ final: prev: {
vim-plug = buildVimPlugin {
pname = "vim-plug";
version = "0.14.0-unstable-2026-10-05";
version = "0.14.0-unstable-2026-10-15";
src = fetchFromGitHub {
owner = "junegunn";
repo = "vim-plug";
rev = "4da42e9a5c948fb82970d522bd14cbab3d122ff1";
hash = "sha256-7HFv5WPSaEGe//d0iddCO5SL4j5IlnY3UTKL7RoEtKY=";
rev = "7e5aae5e1187842cb0b1d8def986e48d481c4410";
hash = "sha256-b2AMS15l1j/5v8IYdhz8JDGW+UvmbqUN3YS4uO4CYsE=";
};
meta.homepage = "https://github.com/junegunn/vim-plug/";
meta.license = getLicenseFromSpdxId "MIT";
@@ -26038,12 +26038,12 @@ final: prev: {
windsurf-vim = buildVimPlugin {
pname = "windsurf.vim";
version = "1.20.8-unstable-2026-01-22";
version = "1.20.8-unstable-2026-03-31";
src = fetchFromGitHub {
owner = "Exafunction";
repo = "windsurf.vim";
rev = "3c0a4f8a7be75113a6e19be13b7cc37210d6e26a";
hash = "sha256-wjpdX37kdgIKHS39LPKYcWTawQ4rc8KYf3ezt+5WL94=";
rev = "c5c027c31ba8afd38a718c650f363437fbaeb4bc";
hash = "sha256-1TVly5tNSRYuJ1e/wzO0vOTOQBR8YE8yLtQChhl56no=";
};
meta.homepage = "https://github.com/Exafunction/windsurf.vim/";
meta.license = getLicenseFromSpdxId "MIT";
@@ -26178,12 +26178,12 @@ final: prev: {
xmake-nvim = buildVimPlugin {
pname = "xmake.nvim";
version = "3.1.5";
version = "3.1.6";
src = fetchFromGitHub {
owner = "Mythos-404";
repo = "xmake.nvim";
tag = "v3.1.5";
hash = "sha256-MkChUCntWqgmAKnaYGT38dSgQaLLyc7liXdZWx4061Q=";
tag = "v3.1.6";
hash = "sha256-R5NrYIuNJi5j2AsS+U2rDktOxa85haFJJ3m1lwCAxpw=";
};
meta.homepage = "https://github.com/Mythos-404/xmake.nvim/";
meta.license = getLicenseFromSpdxId "MIT";

2
pkgs/applications/editors/vim/plugins/luaPackagePlugins.nix
View File

@@ -25,6 +25,8 @@ let
"lze"
"lzextras"
"lzn-auto-require"
"mega-cmdparse"
"mega-logging"
"middleclass"
"mini-test"
"neorg"

8
pkgs/applications/editors/vim/plugins/non-generated/avante-nvim/default.nix
View File

@@ -12,18 +12,18 @@
perl,
}:
let
version = "0.2.3";
version = "0.4.2";
src = fetchFromGitHub {
owner = "yetone";
repo = "avante.nvim";
tag = "v${version}";
hash = "sha256-VJN2ero5ndLqfmMImUF9fqbUKku6Q1CypjK5Q+SB0ck=";
hash = "sha256-Xh/Y9dDur5oXJRavAxQIwRNg9/3ofAREkAxmM/0Tyks=";
};
avante-nvim-lib = rustPlatform.buildRustPackage {
pname = "avante-nvim-lib";
inherit version src;
cargoHash = "sha256-F0SJ4iv/oL2560KmqH7Sun3F+yXR44daYFbOQRsYlDg=";
cargoHash = "sha256-Mtku+MLkDdBYN5xj2x4XbyFXFZ+qTfl1eX2g9VcfpFU=";
nativeBuildInputs = [
pkg-config
@@ -56,6 +56,8 @@ vimUtils.buildVimPlugin {
dependencies = with vimPlugins; [
dressing-nvim
img-clip-nvim
mega-cmdparse
mega-logging
nui-nvim
nvim-treesitter
plenary-nvim

4
pkgs/applications/editors/vim/plugins/non-generated/fff-nvim/default.nix
View File

@@ -5,7 +5,7 @@
nix-update-script,
openssl,
perl,
zig,
zig_0_16,
gitMinimal,
pkg-config,
stdenv,
@@ -45,7 +45,7 @@ let
perl
rustPlatform.bindgenHook
writableTmpDirAsHomeHook
zig
zig_0_16
];
dontUseZigConfigure = true;

6
pkgs/applications/editors/vim/plugins/non-generated/hermes-nvim/default.nix
View File

@@ -17,11 +17,11 @@
}:
let
version = "0.14.0";
version = "0.17.0";
src = fetchzip {
url = "https://github.com/Ruddickmg/hermes.nvim/archive/refs/tags/v${version}.tar.gz";
hash = "sha256-YUe+Mg1StwcxpcIcWr9T/32nkH921UranMM0bE+7lu8=";
hash = "sha256-QFrf8xe9beUznRCnClVLGTdMw9buFQk0QOAWED2+PQE=";
};
dejavuFont = fetchzip {
@@ -61,7 +61,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
inherit version src;
__structuredAttrs = true;
cargoHash = "sha256-X1YI0iT3/5hncU0M5qJY+12nO6Et4B/xqwvjaq8AV1Q=";
cargoHash = "sha256-5dd/Z8GyXgR50LydWKz+8y4BWpR6bOoYu+5K9lRF4yc=";
cargoBuildFeatures = [ "with-icons" ];

8
pkgs/applications/editors/vim/plugins/non-generated/jupynvim/default.nix
View File

@@ -6,12 +6,12 @@
vimUtils,
}:
let
version = "0.4.5";
version = "0.4.6";
src = fetchFromGitHub {
owner = "sheng-tse";
repo = "jupynvim";
tag = "v${version}";
hash = "sha256-G8vyhsTfHtbE7foqj1HNJNMg3TYeO/Nd4ofRS+SVPUo=";
hash = "sha256-EQMjMlYd6x6E59JQ1EUFSXK5CYv8I87TqMWsNKanE/c=";
};
jupynvim-core = rustPlatform.buildRustPackage {
pname = "jupynvim-core";
@@ -19,7 +19,7 @@ let
sourceRoot = "${src.name}/core";
cargoHash = "sha256-7zMuo7evZrer8CXAwbrZtLv/LdOuoZK95sMgyqs5P0I=";
cargoHash = "sha256-oYUd62xmJ/MwRwGpfRmsnRgW6ggllOHzoczeVXV5hNE=";
meta.mainProgram = "jupynvim-core";
};
@@ -33,7 +33,7 @@ vimUtils.buildVimPlugin {
postInstall = ''
rm -rf $out/core
substituteInPlace $out/lua/jupynvim/backend/connect.lua \
--replace-fail 'M._plugin_root() .. "/core/target/release/jupynvim-core"' \
--replace-fail 'root .. "/core/target/release/jupynvim-core"' \
'"${lib.getExe jupynvim-core}"'
'';

8
pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix
View File

@@ -21,22 +21,22 @@ vscode-utils.buildVscodeMarketplaceExtension (finalAttrs: {
sources = {
"x86_64-linux" = {
arch = "linux-x64";
hash = "sha256-CxcRJM0kr9GWqHDqklgwnfv7l+a42NUl19uzIl/sxQA=";
hash = "sha256-JMT/DMsOWe1H0TY3RZ+46S2Yy8MLF2n/JQpzLgRJMj0=";
};
"aarch64-linux" = {
arch = "linux-arm64";
hash = "sha256-g26KjS0tAj5aN+8WLwnEMTE6aiyNPJLRPvtD6rQklos=";
hash = "sha256-e0aTYtb4U3qvlG90jEbiLD6SGouw8T54wUrlp3lYeO0=";
};
"aarch64-darwin" = {
arch = "darwin-arm64";
hash = "sha256-a9rAHqk4oYcM3FG/ghMci72SxHMuS3EzNVpsC56OP3g=";
hash = "sha256-V4bwOucx9C5t+nVhiKfJtW6mTP46mS4l41KJ+M3lN6k=";
};
};
in
{
name = "claude-code";
publisher = "anthropic";
version = "2.1.301";
version = "2.1.304";
}
// sources.${stdenvNoCC.hostPlatform.system}
or (throw "Unsupported system ${stdenvNoCC.hostPlatform.system}");

8
pkgs/applications/editors/vscode/extensions/charliermarsh.ruff/default.nix
View File

@@ -12,22 +12,22 @@ vscode-utils.buildVscodeMarketplaceExtension {
sources = {
"x86_64-linux" = {
arch = "linux-x64";
hash = "sha256-rcF2hINVWsnGkOoGz/pCbUngaK9p/Wan03qSTnxB/Xs=";
hash = "sha256-nFumCRoZZe2Qyq6XvFMbtMslndCkWzC0MSHTQlZ6MyY=";
};
"aarch64-linux" = {
arch = "linux-arm64";
hash = "sha256-j7pv4MICFzqfFCI+dmgB7xtnMRIXkgRYyEBzIZaJwNI=";
hash = "sha256-KVyK1nbpyjl2PhOIktR99GkyJkWwzlLNdUT5neVCvCw=";
};
"aarch64-darwin" = {
arch = "darwin-arm64";
hash = "sha256-ef52k2aBnFnTdrUWyw5n4tIaMHXaOpWTW+3DWIai1+o=";
hash = "sha256-+rgs3o4FPEQheU5NZxjnihZsGqcq4gJh45RzfQlGLRA=";
};
};
in
{
name = "ruff";
publisher = "charliermarsh";
version = "2026.84.0";
version = "2026.88.0";
}
// sources.${stdenvNoCC.hostPlatform.system}
or (throw "Unsupported system ${stdenvNoCC.hostPlatform.system}");

28
pkgs/applications/editors/vscode/extensions/default.nix
View File

@@ -365,8 +365,8 @@ let
mktplcRef = {
publisher = "arktypeio";
name = "arkdark";
version = "6.6.0";
hash = "sha256-9QsHaH8mXM7D7QE5+xTFrGyxh6MShPF9Wk0hFHpxk8A=";
version = "6.6.1";
hash = "sha256-+jTZeGkJkWeOQONXup9Bbfe6FGHQwDD4Cn6POLddUPE=";
};
meta = {
description = "Syntax highlighting and inline errors for ArkType";
@@ -499,8 +499,8 @@ let
mktplcRef = {
publisher = "ban";
name = "spellright";
version = "3.0.154";
hash = "sha256-vGzmzY78FOS8ZsrT1YpTNOUJprW4rZHVuM83cZz6V+Q=";
version = "3.0.156";
hash = "sha256-UHtSqdQ19RT9deshH7F7lZSAgXse/lBFd3xWWcDuGuY=";
};
meta = {
description = "Visual Studio Code extension for Spellchecker";
@@ -1131,8 +1131,8 @@ let
mktplcRef = {
name = "vscode-cue";
publisher = "cuelangorg";
version = "0.0.21";
hash = "sha256-aSyTgGZt9AMZopmPLHb3Mc2RxUGZH87eMtOPX8DlgWQ=";
version = "0.0.23";
hash = "sha256-iu5oHsnTXPa+xzDse2Ei9hVn4THSkiNJvBkGp1vfEwA=";
};
meta = {
description = "The official CUE extension for VS Code, providing syntax highlighting and language server integration (LSP)";
@@ -1364,8 +1364,8 @@ let
mktplcRef = {
publisher = "discloud";
name = "discloud";
version = "2.29.14";
hash = "sha256-u/Up1H2yaRLq6LtNnth9E8+gTy+Gdh2O8Bh1FEu/JtY=";
version = "2.30.0";
hash = "sha256-z3ZMVLjH2TEEKqcXCicsi+ErGlmPlYykHitiWRGWCjM=";
};
meta = {
changelog = "https://marketplace.visualstudio.com/items/discloud.discloud/changelog";
@@ -2598,8 +2598,8 @@ let
mktplcRef = {
publisher = "jellyedwards";
name = "gitsweep";
version = "1.0.0";
hash = "sha256-XBD8rN6E/0GjZ3zXgR45MN9v4PYrEXBSzN7+CcLrRsg=";
version = "1.0.2";
hash = "sha256-UIYtBNNtvJYMw9JoZlRoeso9fjDCT9uYERy7c9bMKyw=";
};
meta = {
changelog = "https://marketplace.visualstudio.com/items/jellyedwards.gitsweep/changelog";
@@ -4911,8 +4911,8 @@ let
mktplcRef = {
name = "emacs-mcx";
publisher = "tuttieee";
version = "0.111.3";
hash = "sha256-yMiEvC7zCVnBSSo+HvK9m7RbD6Bmv7zwKabOtlsEXjE=";
version = "0.111.5";
hash = "sha256-Giq1ueINXsx1V4wSNRGGNej5r5njTXHEdpPI/l13JpY=";
};
meta = {
changelog = "https://github.com/whitphx/vscode-emacs-mcx/blob/main/CHANGELOG.md";
@@ -5234,8 +5234,8 @@ let
mktplcRef = {
name = "vscode-java-pack";
publisher = "vscjava";
version = "0.31.1";
hash = "sha256-SfrsL27uQyrtsNyqZe0q5Fv5sHMwRvBZ+iS6/JIpFVo=";
version = "0.31.2";
hash = "sha256-CNq8jhhVgc3doJNRGkvggwDgdATUzZsS08SAfk7qzto=";
};
meta = {
description = "Popular extensions for Java development that provides Java IntelliSense, debugging, testing, Maven/Gradle support, project management and more";

4
pkgs/applications/editors/vscode/extensions/ms-windows-ai-studio.windows-ai-studio/default.nix
View File

@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
mktplcRef = {
name = "windows-ai-studio";
publisher = "ms-windows-ai-studio";
version = "1.6.15";
hash = "sha256-MKx4yZGSXW/+0+zuYbLPWyAqVV+BD53XRGTztm6NSIo=";
version = "1.6.16";
hash = "sha256-sH21cTA04CUCKcW1vDtnihGDiVJXyGHy2wa0yHjHZ1w=";
};
meta = {

2
pkgs/applications/editors/vscode/extensions/myriad-dreamin.tinymist/default.nix
View File

@@ -11,7 +11,7 @@ vscode-utils.buildVscodeMarketplaceExtension {
name = "tinymist";
publisher = "myriad-dreamin";
inherit (tinymist) version;
hash = "sha256-mTcTEvBsycCL2BW9EnmKJfyZN3aL6B/G8l8lnBTBojo=";
hash = "sha256-ajD967fS5Y7c9uDJHPteBW5AfhUmFVQgdbi+mCy/jMk=";
};
__structuredAttrs = true;

4
pkgs/applications/editors/vscode/extensions/streetsidesoftware.code-spell-checker-german/default.nix
View File

@@ -4,8 +4,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
mktplcRef = {
name = "code-spell-checker-german";
publisher = "streetsidesoftware";
version = "2.3.4";
hash = "sha256-zc0cv4AOswvYcC4xJOq2JEPMQ5qTj9Dad5HhxtNETEs=";
version = "3.0.0";
hash = "sha256-ajuyJXBmJARxxhnr6Hd1oy/IPElY1pfzxYr27SoWS9I=";
};
meta = {
changelog = "https://marketplace.visualstudio.com/items/streetsidesoftware.code-spell-checker-german/changelog";

8
pkgs/applications/editors/vscode/extensions/tombi-toml.tombi/default.nix
View File

@@ -7,15 +7,15 @@
let
supported = {
x86_64-linux = {
hash = "sha256-fGcPMeJKJE3QRy85xUWbYemjtKMQ6Tlx181qyBXfGd8=";
hash = "sha256-pIecZPe2514vlaliUkPL6dzbZmSzApJqkUjRvDVGplc=";
arch = "linux-x64";
};
aarch64-linux = {
hash = "sha256-rXpGVuOtCTvuHQQVVB+KMMrGsKEJz9pBpzu6VWLm4M8=";
hash = "sha256-dqF+KY6Nzr4SUfp3ToYN6uNFpA1xXhJAnv0jIgOFnjs=";
arch = "linux-arm64";
};
aarch64-darwin = {
hash = "sha256-tS1kyYLg8+tIE+eFhSUzQWymYDX8aw9oOB0chsIrp+M=";
hash = "sha256-PH4PEjhFS9wzvF2iq1E9OrslYrtag5x6NrBMdALhA4c=";
arch = "darwin-arm64";
};
};
@@ -30,7 +30,7 @@ vscode-utils.buildVscodeMarketplaceExtension {
mktplcRef = base // {
name = "tombi";
publisher = "tombi-toml";
version = "1.7.3";
version = "1.8.9";
};
meta = {
description = "TOML Language Server";

8
pkgs/applications/editors/vscode/extensions/visualjj.visualjj/default.nix
View File

@@ -13,22 +13,22 @@ vscode-utils.buildVscodeMarketplaceExtension {
sources = {
"x86_64-linux" = {
arch = "linux-x64";
hash = "sha256-41D15WSCK67DK1ArIOgbApndYYq6X0Br1cDajjkhHsE=";
hash = "sha256-YS/fX1utdHoPR2OgtQpvLA/gSePlfPieOGqgVrLiqQs=";
};
"aarch64-linux" = {
arch = "linux-arm64";
hash = "sha256-gWBEMWsootSivCnPI0q0VqMvw3vaQUS+AYTrGd9mV20=";
hash = "sha256-Z4sbBQ/wB/FlBh1K65AA2z9IWce11o2CSO12IJqTyZg=";
};
"aarch64-darwin" = {
arch = "darwin-arm64";
hash = "sha256-Qs3+dRfHs3iZ+mS1uj6o4vPrMF66NgH/8Xmpyo6vTeE=";
hash = "sha256-ovVwNVSHP0LNHOY8oGsV3JZ3N6wS0ZSpJfd6aPHpoS4=";
};
};
in
{
name = "visualjj";
publisher = "visualjj";
version = "0.35.4";
version = "0.36.1";
}
// sources.${stdenvNoCC.hostPlatform.system}
or (throw "Unsupported system ${stdenvNoCC.hostPlatform.system}");

4
pkgs/applications/misc/zathura/core/default.nix
View File

@@ -36,7 +36,7 @@
stdenv.mkDerivation (finalAttrs: {
pname = "zathura";
version = "2026.07.18";
version = "2026.10.4";
strictDeps = true;
__structuredAttrs = true;
@@ -45,7 +45,7 @@ stdenv.mkDerivation (finalAttrs: {
owner = "pwmt";
repo = "zathura";
tag = finalAttrs.version;
hash = "sha256-LngYOW1dNR+x/4Yh1W07dTxidqK0FOvJOl2RRecchvE=";
hash = "sha256-g3FWbuPI2fhBHIHRynDiRjB0eZOf4nAcVfg/OA2EEPw=";
};
outputs = [

1238
pkgs/applications/networking/browsers/firefox-bin/release_sources.nix
View File

File diff suppressed because it is too large Load Diff

4
pkgs/applications/networking/browsers/firefox/packages/firefox-esr-153.nix
View File

@@ -8,11 +8,11 @@
buildMozillaMach rec {
pname = "firefox";
version = "153.5.0esr";
version = "153.5.1esr";
applicationName = "Firefox ESR";
src = fetchurl {
url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
sha512 = "9acb8d1a4b241767e39da36d6f520d4edaae0f237f311496beeed10e2383cf399b0af11cac6984d425b620af0ecba3e67808637ec74733c7d23186d0dd2bd5d4";
sha512 = "9dccf8c5383653ddcf807b500889a91f9b9d56a512dab88a2683755ae6cb0c4b5d0788faa9541e5709a2b783002ee9f434020a43c8a43653038a2c3decd9f2c1";
};
meta = {

4
pkgs/applications/networking/browsers/firefox/packages/firefox.nix
View File

@@ -9,10 +9,10 @@
buildMozillaMach rec {
pname = "firefox";
version = "158.0";
version = "158.0.1";
src = fetchurl {
url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
sha512 = "14b8ffdc325a234061db14dea9bd144786dc2c84468a5dfe2bb70bb9558f63f73427cf244eaf461010ee01dfdf04f2cae68bae9f07b4820603a4bcd4462f7960";
sha512 = "a5cc16a63f4b43f01bc26e2feb12e54e5281aebdc81775cbc0e8d77dd5ceefa5055e78d2a6ad54895c397d414d1fac13d49ddf28099f534269a6a166dedafa5e";
};
meta = {

36
pkgs/applications/networking/cluster/terraform-providers/providers.json
View File

@@ -54,20 +54,20 @@
"vendorHash": "sha256-GIKSIlWD+TTm0EsUu9ga3emENwGLXMDYqp//BmjNwDA="
},
"aminueza_minio": {
"hash": "sha256-Qyj7913SxoGFWT+0j34sm99e609BxmvQEifVTVMM1AM=",
"hash": "sha256-57IhDRu6YrJgXl2bkCeIeRIs4702wb0z/52eJoTAp70=",
"homepage": "https://registry.terraform.io/providers/aminueza/minio",
"owner": "aminueza",
"repo": "terraform-provider-minio",
"rev": "v3.44.0",
"rev": "v3.45.0",
"spdx": "AGPL-3.0",
"vendorHash": "sha256-wpPKseArd+TbQq03QZZuUHQ/l9ttYFE5o2X1HNmxaNI="
"vendorHash": "sha256-hKSqgc+Gf0vzQuXKlErWVC/EbHatu/9oTW25PnRMyxQ="
},
"archessmn_powerdns": {
"hash": "sha256-1bjQFu3k0ERBga94pQ8HZjbfu3qlxnMQLjSkDU6Vp/I=",
"hash": "sha256-gQRB8tnFHhXNId9J8947ffizIWTKEetOnc+QMnjaB48=",
"homepage": "https://registry.terraform.io/providers/archessmn/powerdns",
"owner": "archessmn",
"repo": "terraform-provider-powerdns",
"rev": "v1.0.6",
"rev": "v1.0.7",
"spdx": "MPL-2.0",
"vendorHash": null
},
@@ -218,11 +218,11 @@
"vendorHash": "sha256-KS76AlIyquah/b/uwM4qotBgEbpGwF54gx2u6mQpJ4E="
},
"cloudamqp_cloudamqp": {
"hash": "sha256-Ob9Drm63Kwss4qaYCxymjNqtWuKQi+OV26BUE1dcJ90=",
"hash": "sha256-adpGr2j0jBFW+0QxtSgTiEyxlKoBp/fw6oINxefhCl4=",
"homepage": "https://registry.terraform.io/providers/cloudamqp/cloudamqp",
"owner": "cloudamqp",
"repo": "terraform-provider-cloudamqp",
"rev": "v1.50.1",
"rev": "v1.51.0",
"spdx": "MPL-2.0",
"vendorHash": "sha256-scHNFyHn4VYm8wtuBdVCpgKCzwPhzrC3KBs1YHXPwos="
},
@@ -301,13 +301,13 @@
"vendorHash": "sha256-3o6YRDrq4rQhNAFyqiGJrAoxuAykWw85OExRGSE3kGI="
},
"datadog_datadog": {
"hash": "sha256-wN+0i8O3lv5Fq2aUTcK/JEipYZptSP8An+9qzqYEyDQ=",
"hash": "sha256-Sv/mzOMSerwMFiBFFcj+4bVaJvpAbHVj/MXXclhYpHA=",
"homepage": "https://registry.terraform.io/providers/DataDog/datadog",
"owner": "DataDog",
"repo": "terraform-provider-datadog",
"rev": "v4.25.0",
"rev": "v4.26.0",
"spdx": "MPL-2.0",
"vendorHash": "sha256-ak3IV9d5G9oB5Pxi6kMwFKxBxzkdPTZ/iHehnAeAk+c="
"vendorHash": "sha256-dTbDKR03Inol1G4okCNDso5tZ45BEiUmkXOAmIrRcX0="
},
"datadrivers_nexus": {
"hash": "sha256-+MTyr7voagijpqTb7vswO8PAFZpxz3UWAQLEs0os4+s=",
@@ -526,13 +526,13 @@
"vendorHash": "sha256-nfGvGaNcP6S//nOnXKVsjJrezKxVX+iTiGyN5q4ve78="
},
"hashicorp_aws": {
"hash": "sha256-VOy7rIj2VYF5oBp4LMbMjc7s6jaFF3MbWLFu5r3Tk0Y=",
"hash": "sha256-AAKr8ntbywmxV5UEdlF8gO/SOkPL0pSbcgDK87RF9/0=",
"homepage": "https://registry.terraform.io/providers/hashicorp/aws",
"owner": "hashicorp",
"repo": "terraform-provider-aws",
"rev": "v6.68.0",
"rev": "v6.69.1",
"spdx": "MPL-2.0",
"vendorHash": "sha256-lzMQDtkxt84rQXiiVoj20fnTMGb7S+lR5Igx8RD/X5s="
"vendorHash": "sha256-nv6V/pQ3zGRbSahmy1B8WNxmS/uTcriQ8NBm/KPUNwg="
},
"hashicorp_awscc": {
"hash": "sha256-b4fSBncrRLPhMtt50U3IRzW5Gcpfg1XiRiqa6j4yJO4=",
@@ -1364,11 +1364,11 @@
"vendorHash": "sha256-t799EW0oXtzzHVjbOv5dPQ5V070wg7Y8MZohQ1O70Pk="
},
"tencentcloudstack_tencentcloud": {
"hash": "sha256-s8eSxjf3RXxw3n2xPgcMyBpz0ewoB0IdziZYwjDvVuc=",
"hash": "sha256-ZnauhdsC4e640mkLWi0+UiTt65ISL3nAcjoTdQaLbVk=",
"homepage": "https://registry.terraform.io/providers/tencentcloudstack/tencentcloud",
"owner": "tencentcloudstack",
"repo": "terraform-provider-tencentcloud",
"rev": "v1.83.34",
"rev": "v1.83.36",
"spdx": "MPL-2.0",
"vendorHash": null
},
@@ -1427,13 +1427,13 @@
"vendorHash": "sha256-Bat/S4e5vzT0/XOhJ9zCWLa4IE4owLC6ec1yvEh+c0Y="
},
"topicusonderwijs_octodns": {
"hash": "sha256-ewCWuQlmyrP0mrIz0k+YYUzheeFBPh1bEyRueFC8b3w=",
"hash": "sha256-VqjoDyo9AAxrVPW7uP0ccXy4oZSm6YSLoo/6eqTT9hU=",
"homepage": "https://registry.terraform.io/providers/topicusonderwijs/octodns",
"owner": "topicusonderwijs",
"repo": "terraform-provider-octodns",
"rev": "v1.3.0",
"rev": "v1.4.0",
"spdx": "MPL-2.0",
"vendorHash": "sha256-YDTR4twyHhBqOEPbzMtkO2DWj41VhJ1PAVU3nNVh3l8="
"vendorHash": "sha256-6ivj3olSo9t75jVnow2GvzVGE5JeVtTjWxYDirvSyFc="
},
"trozz_pocketid": {
"hash": "sha256-jRjM8uMpa5FBRqAJY8eM+Sjo72E1et/HyIGEIoK/rXg=",

13
pkgs/applications/video/kodi/unwrapped.nix
View File

@@ -20,7 +20,7 @@
avahi,
lame,
gettext,
pcre-cpp,
pcre2,
yajl,
fribidi,
which,
@@ -263,6 +263,15 @@ stdenv.mkDerivation (
url = "https://github.com/xbmc/xbmc/commit/29492cbd20d4c90a9c00a30ab525d4d0e81a968b.patch";
hash = "sha256-WNaODPCtRfn30jVU5HbBnAO2Vl/MQp2CYmKOTTyDGZI=";
})
# Upstream only support pcre-cpp which is deprecated and to be removed
# from nixpkgs. This patch moves all usages to pcre2
# See https://github.com/xbmc/xbmc/issues/23184
(fetchpatch {
name = "kodi-21.3-pcre2.patch";
url = "https://gitlab.archlinux.org/archlinux/packaging/packages/kodi/-/raw/9fdc116256e7c610e2045d5bc6fb3c234234a88d/kodi-21.3-pcre2.patch";
hash = "sha256-PJXfuZl8f4WfTjtL5CFMDEQuB40tlTWu7LvkBUeX5DE=";
})
];
# make derivations declared in the let binding available here, so
@@ -287,7 +296,7 @@ stdenv.mkDerivation (
boost
libmicrohttpd
gettext
pcre-cpp
pcre2
yajl
fribidi
libva

8
pkgs/applications/virtualization/virtualbox/default.nix
View File

@@ -43,6 +43,7 @@
xz,
yasm,
glslang,
wrapGAppsHook3,
nixosTests,
# If open-watcom-bin is not passed, VirtualBox will fall back to use
# the shipped alternative sources (assembly).
@@ -133,10 +134,14 @@ stdenv.mkDerivation (finalAttrs: {
yasm
glslang
]
++ optional (!headless) wrapQtAppsHook;
++ optionals (!headless) [
wrapQtAppsHook
wrapGAppsHook3
];
# Wrap manually because we wrap just a small number of executables.
dontWrapQtApps = true;
dontWrapGApps = true;
buildInputs = [
acpica-tools
@@ -385,6 +390,7 @@ stdenv.mkDerivation (finalAttrs: {
preFixup =
optionalString (!headless) ''
qtWrapperArgs+=("''${gappsWrapperArgs[@]}")
wrapQtApp $out/bin/VirtualBox
''
# If hardening is disabled, wrap the VirtualBoxVM binary instead of patching

1
pkgs/build-support/rust/default-crate-overrides.nix
View File

@@ -227,6 +227,7 @@
};
libsqlite3-sys = attrs: {
LIBSQLITE3_SYS_USE_PKG_CONFIG = true;
nativeBuildInputs = [ pkg-config ];
buildInputs = [ sqlite ];
};

41
pkgs/by-name/_3/_3proxy/package.nix
View File

@@ -4,6 +4,9 @@
fetchFromGitHub,
pcre2,
python3,
openssl,
cmake,
pkg-config,
nixosTests,
}:
@@ -18,7 +21,15 @@ stdenv.mkDerivation (finalAttrs: {
sha256 = "sha256-hLxafFU6nJ3I3NT3R24LPD7PBmQ1IZEbrVqvfmMZHIM=";
};
buildInputs = [ pcre2 ];
buildInputs = [
pcre2
openssl
];
nativeBuildInputs = [
cmake
pkg-config
];
nativeCheckInputs = [ python3 ];
@@ -26,32 +37,18 @@ stdenv.mkDerivation (finalAttrs: {
checkPhase = ''
runHook preCheck
python3 tests/run.py -v
python3 ../tests/run.py -v
runHook postCheck
'';
# They use 'install -s', that calls the native strip instead of the cross.
# Don't strip binary on install, we strip it on fixup phase anyway.
postPatch = ''
substituteInPlace Makefile.Linux \
--replace-fail "(INSTALL_BIN) -s" "(INSTALL_BIN)" \
--replace-fail "/usr" ""
substituteInPlace CMakeLists.txt \
--replace-fail " /Library" " Library" \
--replace-fail " /etc" " etc" \
--replace-fail " /opt" " opt" \
--replace-fail "/usr" "usr"
'';
makeFlags = [
"-f Makefile.Linux"
"INSTALL=install"
"DESTDIR=${placeholder "out"}"
"CC:=$(CC)"
];
postInstall = ''
rm -fr $out/var
'';
# common.c:208:9: error: initialization of 'int (*)(struct pollfd *, unsigned int, int)' from incompatible pointer type 'int (*)(struct pollfd *, nfds_t, int)' {aka 'int (*)(struct pollfd *, long unsigned int, int)'}
env.NIX_CFLAGS_COMPILE = "-Wno-error=incompatible-pointer-types";
passthru.tests = {
smoke-test = nixosTests._3proxy;
};
@@ -60,7 +57,7 @@ stdenv.mkDerivation (finalAttrs: {
description = "Tiny free proxy server";
homepage = "https://github.com/3proxy/3proxy";
license = lib.licenses.bsd2;
platforms = lib.platforms.linux;
platforms = lib.platforms.unix;
maintainers = with lib.maintainers; [ misuzu ];
identifiers.cpeParts = lib.meta.cpeFullVersionWithVendor "3proxy" finalAttrs.version;
};

3
pkgs/by-name/_7/_7zip-zstd/package.nix
View File

@@ -12,11 +12,13 @@
&& (stdenv.hostPlatform.isLinux || stdenv.hostPlatform.isWindows),
_experimental-update-script-combinators,
nix-update-script,
_7zz,
enableUnfree ? false,
}:
stdenv.mkDerivation (finalAttrs: {
pname = "7zip-zstd";
version = "26.02-v1.5.7-R2";
inherit (_7zz) setupHook;
src = fetchFromGitHub {
owner = "mcmilk";
@@ -141,7 +143,6 @@ stdenv.mkDerivation (finalAttrs: {
runHook postInstall
'';
setupHook = ./setup-hook.sh;
passthru.updateScript = _experimental-update-script-combinators.sequence [
(nix-update-script {
attrPath = "_7zip-zstd";

12
pkgs/by-name/_7/_7zip-zstd/setup-hook.sh
View File

@@ -1,12 +0,0 @@
unpackCmdHooks+=(_try7zip)
unpackCmdHooks+=(_tryUnpackDmg)
_try7zip() {
if ! [[ $curSrc =~ \.7z$ ]]; then return 1; fi
7z x -snld "$curSrc"
}
_tryUnpackDmg() {
if ! [[ $curSrc =~ \.dmg$ ]]; then return 1; fi
7z x -sns- -snld "$curSrc"
}

2
pkgs/by-name/ac/ace-of-penguins/package.nix
View File

@@ -46,7 +46,7 @@ stdenv.mkDerivation (finalAttrs: {
let
generateItem = gameName: {
name = "ace-of-penguins-${gameName}";
exec = "${placeholder "out"}/bin/${gameName}";
exec = gameName;
comment = "Ace of Penguins ${gameName} Card Game";
desktopName = gameName;
genericName = gameName;

4
pkgs/by-name/ac/acme-client/package.nix
View File

@@ -9,11 +9,11 @@
gccStdenv.mkDerivation (finalAttrs: {
pname = "acme-client";
version = "1.3.7";
version = "1.3.8";
src = fetchurl {
url = "https://files.wolfsden.cz/releases/acme-client/acme-client-${finalAttrs.version}.tar.gz";
hash = "sha256-Mq+6epLcgEnlQ0JAPYCxGQu7EM0VS0Y32PYuvEuliAE=";
hash = "sha256-P+Gp5R4lNIFlwYvfw91pPCtejFBnx51x2/2dWx8v9Ag=";
};
nativeBuildInputs = [

3
pkgs/by-name/ad/advent-of-code-data/package.nix Normal file
View File

@@ -0,0 +1,3 @@
{ python3Packages }:
python3Packages.toPythonApplication python3Packages.advent-of-code-data

39
pkgs/by-name/ag/agentaps/package.nix
View File

@@ -7,51 +7,78 @@
makeWrapper,
wrapGAppsHook4,
versionCheckHook,
alsa-lib,
fontconfig,
freetype,
gtk4,
libGL,
libxcb,
libxkbcommon,
libxml2,
llvmPackages,
qt6,
vulkan-loader,
wayland,
zig_0_16,
}:
rustPlatform.buildRustPackage (finalAttrs: {
pname = "agentaps";
version = "0.5.0";
version = "0.6.0";
__structuredAttrs = true;
src = fetchFromGitHub {
owner = "domenkozar";
owner = "cachix";
repo = "agentaps";
tag = "v${finalAttrs.version}";
hash = "sha256-nPA3kRbWyWWUa8L/dVGXaHCQ9onKL0Loe5mxE+mIfQM=";
hash = "sha256-JBAIr21yk81+pSQnnNXv4hdZEUY9HngYGJP+5/Wqa2I=";
};
cargoHash = "sha256-wg56HjRsGm0noQRD5hdHQkmbe56h3JHfZunuPzko66I=";
cargoHash = "sha256-K3c1FZWUE5bX56OcdO452qrQ4St0HXWZiWFBKWoyjX4=";
zigDeps = zig_0_16.fetchDeps {
inherit (finalAttrs) pname version;
src = "${finalAttrs.cargoDeps}/source-registry-0/gpui-libghostty-0.3.1/vendor/ghostty";
fetchAll = true;
hash = "sha256-l6BjpfE7S/q4D0BIx5p6EfdawgovZ2PtOUWH3eWEuc8=";
};
nativeBuildInputs = [
makeWrapper
pkg-config
qt6.wrapQtAppsHook
wrapGAppsHook4
zig_0_16
];
buildInputs = [
alsa-lib
fontconfig
freetype
gtk4
libGL
libxcb
libxkbcommon
libxml2
llvmPackages.libcxx
qt6.qtbase
vulkan-loader
wayland
];
# Cargo drives the embedded Ghostty build.
dontUseZigBuild = true;
dontUseZigCheck = true;
dontUseZigInstall = true;
postConfigure = ''
export GHOSTTY_ZIG_GLOBAL_CACHE_DIR=$(mktemp -d)
cp -r ${finalAttrs.zigDeps} "$GHOSTTY_ZIG_GLOBAL_CACHE_DIR/p"
chmod -R u+w "$GHOSTTY_ZIG_GLOBAL_CACHE_DIR/p"
mkdir -p "$GHOSTTY_ZIG_GLOBAL_CACHE_DIR/tmp"
'';
nativeCheckInputs = [ git ];
# The login shell test requires /bin/sh and /usr/bin/env, which are absent in the sandbox.
@@ -81,8 +108,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
meta = {
description = "Desktop client for Agent Client Protocol agents";
homepage = "https://github.com/domenkozar/agentaps";
changelog = "https://github.com/domenkozar/agentaps/blob/v${finalAttrs.version}/CHANGELOG.md";
homepage = "https://github.com/cachix/agentaps";
changelog = "https://github.com/cachix/agentaps/blob/v${finalAttrs.version}/CHANGELOG.md";
license = lib.licenses.asl20;
mainProgram = "agentaps";
maintainers = with lib.maintainers; [ domenkozar ];

4
pkgs/by-name/al/alibuild/package.nix
View File

@@ -6,12 +6,12 @@
python3Packages.buildPythonApplication (finalAttrs: {
pname = "alibuild";
version = "1.17.46";
version = "1.17.48";
pyproject = true;
src = fetchPypi {
inherit (finalAttrs) pname version;
hash = "sha256-fF1G5ec6DE1ktcKhGc6U5KGzf8S3jlsMpWjD2hUgrk4=";
hash = "sha256-uxATZVPvdk5TICoSc2yRwRxBNRRd5UC888YWyHv/4tA=";
};
build-system = with python3Packages; [

4
pkgs/by-name/ar/arcdps-log-manager/package.nix
View File

@@ -13,13 +13,13 @@
}:
buildDotnetModule (finalAttrs: {
pname = "arcdps-log-manager";
version = "1.17";
version = "1.17.1";
src = fetchFromGitHub {
owner = "gw2scratch";
repo = "evtc";
tag = "manager-v${finalAttrs.version}";
hash = "sha256-tIR8t19mcAN70Hi5TZcxsx+5WFZZZB8LaadD2HWsGOU=";
hash = "sha256-ZCQr/98KsCI/X9SIbXw4rupNhccOaLMLut07N7bvmwo=";
};
nugetDeps = ./deps.json;

372
pkgs/by-name/as/asn1scc/deps.json generated Normal file
View File

@@ -0,0 +1,372 @@
[
{
"pname": "Argu",
"version": "6.2.5",
"hash": "sha256-5HcZcvco4e8+hgLhzlxk7ZmFVLtZL9LVr7LbmXsLmNU="
},
{
"pname": "coverlet.collector",
"version": "3.2.0",
"hash": "sha256-2aM3pKX5toQQRLKpH5ArzND2Rgq1fSpMsLxcEDbat+M="
},
{
"pname": "FSharp.Collections.ParallelSeq",
"version": "1.2.0",
"hash": "sha256-2/3Bs9shlzkNGvR+m0R9Izb8UUb8VKO60dAlBDiIUls="
},
{
"pname": "FSharp.Core",
"version": "4.6.2",
"hash": "sha256-17QZc+S6FPSiHnrWOEuIxL1Aw1UZiXX0v58KeTuk2Sw="
},
{
"pname": "FSharp.Core",
"version": "6.0.0",
"hash": "sha256-aQDRgiGC7iTyzNEmvyd2RBCDcLG0I1dbfncHlkbeUMI="
},
{
"pname": "FSharp.Core",
"version": "9.0.300-beta.25079.4",
"hash": "sha256-GoHmLWad7fOC4XEVoUWg900H0V29wKxJm0ybEYOnfWU="
},
{
"pname": "FsToolkit.ErrorHandling",
"version": "2.7.0",
"hash": "sha256-J5Mf5ManlsEMcy/DZoIlWAii6lFVJotUBFTwY6G1LUk="
},
{
"pname": "MediatR",
"version": "8.1.0",
"hash": "sha256-dyqhDG1NJjY1b+dj37sMmklGkxAm3zKdhh2lBJ0/HTM="
},
{
"pname": "Microsoft.Bcl.AsyncInterfaces",
"version": "1.0.0",
"hash": "sha256-cC29sl84h4uVyJq2IPiRNk1G27Zx/Ebn7hLPXbMqvQE="
},
{
"pname": "Microsoft.Bcl.AsyncInterfaces",
"version": "1.1.1",
"hash": "sha256-fAcX4sxE0veWM1CZBtXR/Unky+6sE33yrV7ohrWGKig="
},
{
"pname": "Microsoft.Build",
"version": "17.7.2",
"hash": "sha256-k35nFdPxC8t0zAltVSmAJtsepp/ubNIjPOsJ6k8jSqM="
},
{
"pname": "Microsoft.Build.Framework",
"version": "17.7.2",
"hash": "sha256-fNWmVQYFTJDveAGmxEdNqJRAczV6+Ep8RA8clKBJFqw="
},
{
"pname": "Microsoft.CodeCoverage",
"version": "17.7.2",
"hash": "sha256-FfKMhyVEAiRd3VDkotnFHnSmlYGQTh4ZqkEF2+8sriY="
},
{
"pname": "Microsoft.Extensions.Configuration",
"version": "2.0.0",
"hash": "sha256-SSemrjaokMnzOF8ynrgEV6xEh4TlesUE7waW2BLuWns="
},
{
"pname": "Microsoft.Extensions.Configuration",
"version": "3.0.0",
"hash": "sha256-lpP5mBEYnDZIS/ceg8U35Tq/Ve20q8WoGzOw9+6wIJc="
},
{
"pname": "Microsoft.Extensions.Configuration.Abstractions",
"version": "2.0.0",
"hash": "sha256-jveXZPNvx30uWT3q80OA1YaSb4K/KGOhlyun97IXn8Y="
},
{
"pname": "Microsoft.Extensions.Configuration.Abstractions",
"version": "3.0.0",
"hash": "sha256-GJDvt3qFAif5ToFjHgs8imCaUER7yvYJghnlYXiHrHU="
},
{
"pname": "Microsoft.Extensions.Configuration.Binder",
"version": "2.0.0",
"hash": "sha256-7GVLiJupIL3BS5XgB44M95TxzF4KwvVUsShko+pqO98="
},
{
"pname": "Microsoft.Extensions.Configuration.Binder",
"version": "3.0.0",
"hash": "sha256-fyepoZ8UhC9qbFt1eD0crVWoeVYL5l/Skz5Qs4WBJZA="
},
{
"pname": "Microsoft.Extensions.DependencyInjection",
"version": "2.0.0",
"hash": "sha256-+KqiuV8ncy9b1xhtDExh4s4U57tKxqx4pAyr6d//EQU="
},
{
"pname": "Microsoft.Extensions.DependencyInjection",
"version": "3.0.0",
"hash": "sha256-RyT+m4OsHb1csXt5OYtjdx8LIsRlOKEWzSbAm4jfCzM="
},
{
"pname": "Microsoft.Extensions.DependencyInjection.Abstractions",
"version": "2.0.0",
"hash": "sha256-H1rEnq/veRWvmp8qmUsrQkQIcVlKilUNzmmKsxJ0md8="
},
{
"pname": "Microsoft.Extensions.DependencyInjection.Abstractions",
"version": "3.0.0",
"hash": "sha256-dGTb6sHsjZ86fiLnwbauGf9CQdN7G96lCM4ADjaSSBs="
},
{
"pname": "Microsoft.Extensions.Logging",
"version": "3.0.0",
"hash": "sha256-GfRf11n3wZj92l6e0n5uTMY4KdPZCMWQHWraeyhWNKk="
},
{
"pname": "Microsoft.Extensions.Logging.Abstractions",
"version": "3.0.0",
"hash": "sha256-p70uTENWQc0J7ibLHlRHWk3RYZg0DMP3g2m4kAUaoxA="
},
{
"pname": "Microsoft.Extensions.Options",
"version": "2.0.0",
"hash": "sha256-EMvaXxGzueI8lT97bYJQr0kAj1IK0pjnAcWN82hTnzw="
},
{
"pname": "Microsoft.Extensions.Options",
"version": "3.0.0",
"hash": "sha256-43Unnj57IA5OzebT6XMAXylzDDBuk8KNFaR4chRE/e8="
},
{
"pname": "Microsoft.Extensions.Options.ConfigurationExtensions",
"version": "2.0.0",
"hash": "sha256-lD4xwvlLRLdJ2WdaHWGpEIRWOtWcvbr4ccD8v2QeTMc="
},
{
"pname": "Microsoft.Extensions.Primitives",
"version": "2.0.0",
"hash": "sha256-q44LtMvyNEKSvgERvA+BrasKapP92Sc91QR4u2TJ9/Y="
},
{
"pname": "Microsoft.Extensions.Primitives",
"version": "3.0.0",
"hash": "sha256-cwlj0X19gngcOB7kpODhF/h96/L6psMLBIOd2pf3CbU="
},
{
"pname": "Microsoft.NET.StringTools",
"version": "17.7.2",
"hash": "sha256-hQE07TCgcQuyu9ZHVq2gPDb0+xe8ECJUdrgh17bJP4o="
},
{
"pname": "Microsoft.NET.Test.Sdk",
"version": "17.7.2",
"hash": "sha256-EMtV5zcucAcJMGIb/KSqIQnK7PA6aJCgZSobc+5t6SE="
},
{
"pname": "Microsoft.NETCore.Platforms",
"version": "1.1.0",
"hash": "sha256-FeM40ktcObQJk4nMYShB61H/E8B7tIKfl9ObJ0IOcCM="
},
{
"pname": "Microsoft.NETCore.Targets",
"version": "1.1.0",
"hash": "sha256-0AqQ2gMS8iNlYkrD+BxtIg7cXMnr9xZHtKAuN4bjfaQ="
},
{
"pname": "Microsoft.TestPlatform.ObjectModel",
"version": "17.7.2",
"hash": "sha256-uOe3ELE7iAusTBgxhsx78d4lBw28eDTew13ZnW2bsnU="
},
{
"pname": "Microsoft.TestPlatform.TestHost",
"version": "17.7.2",
"hash": "sha256-pox8kez5tgXX4mAiu9qybrlI7oURzPm7YsCd42N4+us="
},
{
"pname": "Microsoft.VisualStudio.Threading",
"version": "16.7.56",
"hash": "sha256-V2HB/0j+I/3iUT7mEVyeF11P/61cSpYcZQa1LnXuoI8="
},
{
"pname": "Microsoft.VisualStudio.Threading.Analyzers",
"version": "16.7.56",
"hash": "sha256-4lsL6hg1mposZ62buQWBud1B4raV8Pl+BkyvM4FraRM="
},
{
"pname": "Microsoft.VisualStudio.Validation",
"version": "15.5.31",
"hash": "sha256-/NWbGyad7wejY8QyxK8YWTgiRiUGjimaBgoLkWxOCao="
},
{
"pname": "Microsoft.Win32.SystemEvents",
"version": "7.0.0",
"hash": "sha256-i6JojctqrqfJ4Wa+BDtaKZEol26jYq5DTQHar2M9B64="
},
{
"pname": "MSTest.TestAdapter",
"version": "3.1.1",
"hash": "sha256-TLysbO9bgiztIap44o875ZPpuVAOC6ueaRTKsiVicXg="
},
{
"pname": "MSTest.TestFramework",
"version": "3.1.1",
"hash": "sha256-Vqu+IDuYjiR39QOJW7GHiH7CeF2cBfNIYYTXmVeeb9E="
},
{
"pname": "Nerdbank.Streams",
"version": "2.6.81",
"hash": "sha256-0Zshmi1IMWj9/MKUieffpgJxKhJyVgBXPKMg9RSDkRs="
},
{
"pname": "Newtonsoft.Json",
"version": "11.0.2",
"hash": "sha256-YhlAbGfwoxQzxb3Hef4iyV9eGdPQJJNd2GgSR0jsBJ0="
},
{
"pname": "Newtonsoft.Json",
"version": "13.0.1",
"hash": "sha256-K2tSVW4n4beRPzPu3rlVaBEMdGvWSv/3Q1fxaDh4Mjo="
},
{
"pname": "NuGet.Frameworks",
"version": "6.5.0",
"hash": "sha256-ElqfN4CcKxT3hP2qvxxObb4mnBlYG89IMxO0Sm5oZ2g="
},
{
"pname": "OmniSharp.Extensions.JsonRpc",
"version": "0.19.5",
"hash": "sha256-iwluvSBBemilT9iW3TDMB1D6bzKx+fgsalNu1tnYjEY="
},
{
"pname": "OmniSharp.Extensions.JsonRpc.Generators",
"version": "0.19.5",
"hash": "sha256-aAvS2DLVWtgLTxRwRDPb7cOALN7Anpejd6jRJLonTNU="
},
{
"pname": "OmniSharp.Extensions.LanguageProtocol",
"version": "0.19.5",
"hash": "sha256-Mcxq+aAYWUpyWVWU8VUgWeFeAuRbQRxjNATSZvjKj7I="
},
{
"pname": "OmniSharp.Extensions.LanguageServer",
"version": "0.19.5",
"hash": "sha256-lWL4Y+zKMCMV5pK4BuLBk0UczIz3anqgUlYqkgGrfTM="
},
{
"pname": "OmniSharp.Extensions.LanguageServer.Shared",
"version": "0.19.5",
"hash": "sha256-cBhiB/69T2b3xu+/D5o+AanglYTuaXU5OfIOW3WtnzE="
},
{
"pname": "Serilog",
"version": "2.10.0",
"hash": "sha256-+8wilkt+VVvW+KFWuLryj7cSFpz9D+sz92KYWICAcSE="
},
{
"pname": "Serilog",
"version": "2.5.0",
"hash": "sha256-oOf6KDVOq/uf/I18N0N/u5q7DPlQ/5T/TLsOtOqdA1M="
},
{
"pname": "Serilog",
"version": "2.8.0",
"hash": "sha256-MBL9AWGV8UthhiHXnqH3EsfIyXnxdLWqAdFa6QvQ2To="
},
{
"pname": "Serilog.Extensions.Logging",
"version": "3.0.1",
"hash": "sha256-KtHMMnepmEpOlHrIGlUkK6Vq1L0iBBnFGavbUtvxOBk="
},
{
"pname": "Serilog.Sinks.Debug",
"version": "2.0.0",
"hash": "sha256-/PLVAE33lTdUEXdahkI5ddFiGZufWnvfsOodQsFB8sQ="
},
{
"pname": "Serilog.Sinks.File",
"version": "4.1.0",
"hash": "sha256-ir1quhEV0eLu65sZfJd+SlTcyJVQ/iJDVJb+4GC6x+c="
},
{
"pname": "System.Configuration.ConfigurationManager",
"version": "4.4.0",
"hash": "sha256-+8wGYllXnIxRzy9dLhZFB88GoPj8ivYXS0KUfcivT8I="
},
{
"pname": "System.Configuration.ConfigurationManager",
"version": "7.0.0",
"hash": "sha256-SgBexTTjRn23uuXvkzO0mz0qOfA23MiS4Wv+qepMLZE="
},
{
"pname": "System.Diagnostics.EventLog",
"version": "7.0.0",
"hash": "sha256-aSK1lQN9a/guffT8jUW+zKc5bOIvKRcds/XbVk766Jo="
},
{
"pname": "System.Drawing.Common",
"version": "7.0.0",
"hash": "sha256-t4FBgTMhuOA5FA23fg0WQOGuH0njV7hJXST/Ln/Znks="
},
{
"pname": "System.IO",
"version": "4.3.0",
"hash": "sha256-ruynQHekFP5wPrDiVyhNiRIXeZ/I9NpjK5pU+HPDiRY="
},
{
"pname": "System.IO.FileSystem.Primitives",
"version": "4.3.0",
"hash": "sha256-LMnfg8Vwavs9cMnq9nNH8IWtAtSfk0/Fy4s4Rt9r1kg="
},
{
"pname": "System.IO.Pipelines",
"version": "4.7.3",
"hash": "sha256-nis1vH2bdwxvbKm00PYvGzIbmCwX9U5AbJFOU3oqVzY="
},
{
"pname": "System.Reactive",
"version": "4.4.1",
"hash": "sha256-inA6nw9CX0g/AeygMwJoARGOY79pli/jLF54CweUqD8="
},
{
"pname": "System.Reflection.MetadataLoadContext",
"version": "7.0.0",
"hash": "sha256-VYl6SFD130K9Aw4eJH16ApJ9Sau4Xu0dcxEip2veuTI="
},
{
"pname": "System.Runtime.Handles",
"version": "4.3.0",
"hash": "sha256-KJ5aXoGpB56Y6+iepBkdpx/AfaJDAitx4vrkLqR7gms="
},
{
"pname": "System.Security.Cryptography.ProtectedData",
"version": "4.4.0",
"hash": "sha256-Ri53QmFX8I8UH0x4PikQ1ZA07ZSnBUXStd5rBfGWFOE="
},
{
"pname": "System.Security.Cryptography.ProtectedData",
"version": "7.0.0",
"hash": "sha256-aS5fVYrujUCkAnth2QQPp8knG169BsK/BX8lqaHRSZc="
},
{
"pname": "System.Security.Permissions",
"version": "7.0.0",
"hash": "sha256-DOFoX+AKRmrkllykHheR8FfUXYx/Ph+I/HYuReQydXI="
},
{
"pname": "System.Text.Encoding",
"version": "4.3.0",
"hash": "sha256-GctHVGLZAa/rqkBNhsBGnsiWdKyv6VDubYpGkuOkBLg="
},
{
"pname": "System.Text.Encoding.Extensions",
"version": "4.3.0",
"hash": "sha256-vufHXg8QAKxHlujPHHcrtGwAqFmsCD6HKjfDAiHyAYc="
},
{
"pname": "System.Threading.Tasks",
"version": "4.3.0",
"hash": "sha256-Z5rXfJ1EXp3G32IKZGiZ6koMjRu0n8C1NGrwpdIen4w="
},
{
"pname": "System.Windows.Extensions",
"version": "7.0.0",
"hash": "sha256-yRivIiENFKMxbSh8SZ/fmKjshwBdFXzbKmZcfDZwKYc="
}
]

49
pkgs/by-name/as/asn1scc/package.nix Normal file
View File

@@ -0,0 +1,49 @@
{
lib,
pkgs,
buildDotnetModule,
callPackage,
dotnetCorePackages,
fetchFromGitHub,
nix-update-script,
testers,
}:
buildDotnetModule (finalAttrs: {
pname = "asn1scc";
version = "4.9.28.0";
src = fetchFromGitHub {
owner = "esa";
repo = "asn1scc";
tag = finalAttrs.version;
hash = "sha256-0hyyeUIK3oAx16DvV4CqCrW131de0f7QLN5/EyU9Qf0=";
};
nativeBuildInputs = with pkgs; [ jre ];
nugetDeps = ./deps.json;
dotnet-sdk = dotnetCorePackages.sdk_10_0;
dotnet-runtime = dotnetCorePackages.runtime_10_0;
executables = [ "asn1scc" ];
passthru = {
updateScript = nix-update-script { };
tests = {
run = callPackage ./test.nix { asn1scc = finalAttrs.finalPackage; };
version = testers.testVersion { package = finalAttrs.finalPackage; };
};
};
__structuredAttrs = true;
strictDeps = true;
meta = {
mainProgram = "asn1scc";
homepage = "https://www.thanassis.space/asn1.html";
description = "Open Source ASN.1 Compiler";
license = lib.licenses.gpl2;
platforms = lib.platforms.unix;
maintainers = with lib.maintainers; [ cve ];
};
})

36
pkgs/by-name/as/asn1scc/test.nix Normal file
View File

@@ -0,0 +1,36 @@
# Compiles a simple ASN.1 file and checks whether the output is valid C.
{
runCommand,
gcc,
asn1scc,
writeText,
}:
let
asn1File = writeText "foo.asn1" ''
FooProtocol DEFINITIONS ::= BEGIN
FooQuestion ::= SEQUENCE {
id INTEGER,
ack BOOLEAN
}
FooAnswer ::= SEQUENCE {
id INTEGER,
ack BOOLEAN
}
END
'';
in
runCommand "asn1scc-test-run"
{
nativeBuildInputs = [
asn1scc
gcc
];
}
''
asn1scc --c-lang ${asn1File}
gcc -c asn1crt.c
gcc -c *-foo.c
touch $out
''

6
pkgs/by-name/as/ast-grep/package.nix
View File

@@ -11,7 +11,7 @@
rustPlatform.buildRustPackage (finalAttrs: {
pname = "ast-grep";
version = "0.50.0";
version = "0.51.0";
__structuredAttrs = true;
@@ -19,7 +19,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
owner = "ast-grep";
repo = "ast-grep";
tag = finalAttrs.version;
hash = "sha256-qrLcPFA6r/p4Tc7s3sVbt/w5RuCfYLLmA+fn9ZKHIk4=";
hash = "sha256-Rij1sHo0Z8dl4a2fyQO05ct242fi3wfWyXEpmL6B40o=";
};
# error: linker `aarch64-linux-gnu-gcc` not found
@@ -27,7 +27,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
rm .cargo/config.toml
'';
cargoHash = "sha256-TrWwhraCQ8saRpASRJi2wmflOA6YD7eCULeRURwHmko=";
cargoHash = "sha256-FRhFfzhf3ycs+3cBBRVE1eMoTu6+Q7kIGR+Dz7JHPzQ=";
nativeBuildInputs = [ installShellFiles ];

5
pkgs/by-name/at/atlantis/package.nix
View File

@@ -2,6 +2,7 @@
lib,
buildGo127Module,
fetchFromGitHub,
nixosTests,
versionCheckHook,
}:
@@ -30,6 +31,10 @@ buildGo127Module (finalAttrs: {
versionCheckProgram = "${placeholder "out"}/bin/atlantis";
versionCheckProgramArg = "version";
passthru.tests = {
inherit (nixosTests) atlantis;
};
meta = {
homepage = "https://github.com/runatlantis/atlantis";
description = "Terraform Pull Request Automation";

4
pkgs/by-name/au/audacious-bare/package.nix
View File

@@ -12,13 +12,13 @@
stdenv.mkDerivation rec {
pname = "audacious";
version = "4.6.1";
version = "4.6.2";
src = fetchFromGitHub {
owner = "audacious-media-player";
repo = "audacious";
rev = "${pname}-${version}";
hash = "sha256-f1ugxM57dYDDq/G+16bXs6++KXnaLwT+mcPY0R371tY=";
hash = "sha256-+WzKbPtY9LuuT8INH4A6fiCoK0Z4RG1drmintQ7Lh5A=";
};
nativeBuildInputs = [

19
pkgs/by-name/au/audiobookshelf/client.nix
View File

@@ -1,23 +1,28 @@
{
src,
version,
routerBasePath,
buildNpmPackage,
nodejs,
}:
buildNpmPackage {
pname = "audiobookshelf-client";
inherit version nodejs;
inherit src version nodejs;
src = "${src}/client";
sourceRoot = "${src.name}/client";
npmDepsHash = "sha256-Rvy/bULWyVkGthfpIGkTMO8Lv1miywwea7jLODfm54Y=";
env = {
# don't download the Cypress binary
CYPRESS_INSTALL_BINARY = 0;
NODE_OPTIONS = "--openssl-legacy-provider";
};
env.ROUTER_BASE_PATH = routerBasePath;
npmRebuildFlags = [ "--ignore-scripts" ];
npmBuildScript = "generate";
installPhase = ''
runHook preInstall
cp -r dist "$out"
runHook postInstall
'';
}

82
pkgs/by-name/au/audiobookshelf/package.nix
View File

@@ -1,32 +1,18 @@
{
lib,
stdenv,
fetchFromGitHub,
buildNpmPackage,
callPackage,
nodejs_24,
ffmpeg_8-full,
nunicode,
util-linux,
python3,
getopt,
typescript_5,
jq,
nixosTests,
nix-update-script,
routerBasePath ? "/audiobookshelf",
}:
let
ffmpeg-full = ffmpeg_8-full;
nodejs = nodejs_24;
wrapper = import ./wrapper.nix {
inherit
stdenv
ffmpeg-full
nunicode
getopt
;
};
in
buildNpmPackage (finalAttrs: {
pname = "audiobookshelf";
version = "2.37.1";
@@ -40,33 +26,60 @@ buildNpmPackage (finalAttrs: {
npmDepsHash = "sha256-xHjZ3E1DGeb5NueP67hEX3vHH0Qlk4LTeZkMEFBhGyE=";
inherit nodejs;
nodejs = nodejs_24;
buildInputs = [ util-linux ];
nativeBuildInputs = [ python3 ];
nativeBuildInputs = [
typescript_5
jq
];
dontNpmBuild = true;
npmInstallFlags = [ "--only-production" ];
npmBuildScript = "build:server";
npmInstallFlags = [ "--omit=dev" ];
client = callPackage ./client.nix { inherit (finalAttrs) src version nodejs; };
makeWrapperArgs = [
"--set"
"FFMPEG_PATH"
(lib.getExe ffmpeg_8-full)
"--set"
"FFPROBE_PATH"
(lib.getExe' ffmpeg_8-full "ffprobe")
"--set"
"NODE_ENV"
"production"
"--set"
"NUSQLITE3_PATH"
"${nunicode.sqlite}/lib/libnusqlite3"
"--set"
"ROUTER_BASE_PATH"
(lib.escapeShellArg routerBasePath)
"--set"
"SKIP_BINARIES_CHECK"
"1"
"--set"
"SOURCE"
"nixpkgs"
];
installPhase = ''
runHook preInstall
mkdir -p $out/opt/client
cp -r index.js server package* node_modules $out/opt/
cp -r ${finalAttrs.client}/lib/node_modules/audiobookshelf-client/dist $out/opt/client/dist
mkdir $out/bin
packageOut="$out/lib/node_modules/$(jq --raw-output '.name' package.json)"
echo '${wrapper}' > $out/bin/audiobookshelf
echo " exec ${finalAttrs.nodejs}/bin/node $out/opt/index.js" >> $out/bin/audiobookshelf
mkdir -p "$packageOut"/{client,dist-server}
cp -r dist-server/{index.js,package.json,server} "$packageOut"/dist-server/
cp -r node_modules package.json "$packageOut"/
cp -r ${finalAttrs.passthru.client} "$packageOut"/client/dist
chmod +x $out/bin/audiobookshelf
nodejsInstallExecutables
runHook postInstall
'';
passthru = {
client = callPackage ./client.nix {
inherit (finalAttrs) src version nodejs;
inherit routerBasePath;
};
tests.basic = nixosTests.audiobookshelf;
updateScript = nix-update-script { extraArgs = [ "--subpackage=client" ]; };
};
@@ -74,14 +87,19 @@ buildNpmPackage (finalAttrs: {
meta = {
homepage = "https://www.audiobookshelf.org/";
description = "Self-hosted audiobook and podcast server";
changelog = "https://github.com/advplyr/audiobookshelf/releases/tag/v${finalAttrs.version}";
license = lib.licenses.gpl3;
changelog = "https://github.com/advplyr/audiobookshelf/releases/tag/${finalAttrs.src.tag}";
license = lib.licenses.gpl3Only;
maintainers = with lib.maintainers; [
jvanbruegge
adamcstephens
tebriel
connor-grady
];
platforms = lib.platforms.linux;
mainProgram = "audiobookshelf";
sourceProvenance = with lib.sourceTypes; [
fromSource
binaryBytecode
];
};
})

68
pkgs/by-name/au/audiobookshelf/wrapper.nix
View File

@@ -1,68 +0,0 @@
{
stdenv,
ffmpeg-full,
nunicode,
getopt,
}:
''
#!${stdenv.shell}
port=8000
host=0.0.0.0
config=$(pwd)/config
metadata=$(pwd)/metadata
LONGOPTS=host:,port:,config:,metadata:,help
args=$(${getopt}/bin/getopt -l "$LONGOPTS" -o h -- "$@")
eval set -- "$args"
while [ $# -ge 1 ]; do
case "$1" in
--)
# No more options left.
shift
break
;;
--host)
host="$2"
shift
;;
--port)
port="$2"
shift
;;
--config)
if [[ "''${2:0:1}" = "/" ]]; then
config="$2"
else
config="$(pwd)/$2"
fi
shift
;;
--metadata)
if [[ "''${2:0:1}" = "/" ]]; then
metadata="$2"
else
metadata="$(pwd)/$2"
fi
shift
;;
--help|-h)
echo "Usage: audiobookshelf [--host <host>] [--port <port>] [--metadata <dir>] [--config <dir>]"
exit 0
;;
esac
shift
done
NODE_ENV=production \
SOURCE=nixpkgs \
SKIP_BINARIES_CHECK=1 \
FFMPEG_PATH=${ffmpeg-full}/bin/ffmpeg \
FFPROBE_PATH=${ffmpeg-full}/bin/ffprobe \
NUSQLITE3_PATH=${nunicode.sqlite}/lib/libnusqlite3 \
CONFIG_PATH="$config" \
METADATA_PATH="$metadata" \
PORT="$port" \
HOST="$host" \''

78
pkgs/by-name/au/ausaxs/cmake-no-fetchcontent.patch
View File

@@ -1,51 +1,45 @@
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -75,7 +75,7 @@
set(DLIB_USE_MKL_FFT OFF)
set(DLIB_USE_FFMPEG OFF)
set(CMAKE_CXX_STANDARD 17) # dlib must be compiled with C++17
- FetchContent_MakeAvailable(dlib)
+ add_subdirectory(dlib)
set(CMAKE_CXX_STANDARD 20) # continue with C++20
@@ -48,12 +48,7 @@
message(FATAL_ERROR "BS.thread_pool headers not found")
endif()
add_compile_definitions("DLIB_AVAILABLE")
@@ -106,7 +106,6 @@
thread_pool
GIT_REPOSITORY https://github.com/bshoshany/thread-pool
)
else()
- FetchContent_Declare(
- thread_pool
- GIT_REPOSITORY https://github.com/bshoshany/thread-pool
- )
- FetchContent_MakeAvailable(thread_pool)
set(BS_THREAD_POOL_INCLUDE_DIR ${thread_pool_SOURCE_DIR}/include)
- set(BS_THREAD_POOL_INCLUDE_DIR ${thread_pool_SOURCE_DIR}/include)
+ set(BS_THREAD_POOL_INCLUDE_DIR ${CMAKE_SOURCE_DIR}/thread_pool/include)
endif()
@@ -121,7 +120,6 @@
gcem
GIT_REPOSITORY https://github.com/klytje/gcem
)
if (POCKETFFT)
@@ -63,13 +58,7 @@
message(FATAL_ERROR "pocketfft headers not found")
endif()
else()
- FetchContent_Declare(
- pocketfft
- GIT_REPOSITORY https://github.com/mreineck/pocketfft
- GIT_TAG c90e55b3d529f8efa40ed01a20de22405f45fc65 # the header-only C++ version lives on the "cpp" branch, which carries no tags
- )
- FetchContent_MakeAvailable(pocketfft)
- set(POCKETFFT_INCLUDE_DIR ${pocketfft_SOURCE_DIR})
+ set(POCKETFFT_INCLUDE_DIR ${CMAKE_SOURCE_DIR}/pocketfft)
endif()
add_compile_definitions("POCKETFFT_AVAILABLE")
endif()
@@ -81,12 +70,7 @@
message(FATAL_ERROR "GCEM headers not found")
endif()
else()
- FetchContent_Declare(
- gcem
- GIT_REPOSITORY https://github.com/klytje/gcem
- )
- FetchContent_MakeAvailable(GCEM)
set(GCEM_INCLUDE_DIR ${gcem_SOURCE_DIR}/include)
- set(GCEM_INCLUDE_DIR ${gcem_SOURCE_DIR}/include)
+ set(GCEM_INCLUDE_DIR ${CMAKE_SOURCE_DIR}/gcem/include)
endif()
@@ -131,7 +129,9 @@
)
unset(compile_options)
-include_directories(${BS_THREAD_POOL_INCLUDE_DIR} ${GCEM_INCLUDE_DIR} ${BACKWARD_INCLUDE_DIR})
+include_directories(${BACKWARD_INCLUDE_DIR})
+add_subdirectory(gcem)
+include_directories(thread_pool/include gcem/include)
############################################
## Find and link CURL ##
--- a/executable/gui/CMakeLists.txt
+++ b/executable/gui/CMakeLists.txt
@@ -6,7 +6,9 @@
nfd
GIT_REPOSITORY https://github.com/btzy/nativefiledialog-extended.git
)
-FetchContent_MakeAvailable(elements CLI11 nfd)
+find_package(CLI11 CONFIG REQUIRED)
+add_subdirectory(${CMAKE_SOURCE_DIR}/elements elements_build)
+add_subdirectory(${CMAKE_SOURCE_DIR}/nfd nfd_build)
# set the path to the elements root & module path
set(ELEMENTS_ROOT "${elements_SOURCE_DIR}")
set_property(

21
pkgs/by-name/au/ausaxs/elements-cmake-no-fetchcontent.patch
View File

@@ -1,21 +0,0 @@
--- a/lib/CMakeLists.txt
+++ b/lib/CMakeLists.txt
@@ -229,7 +229,7 @@
GIT_SUBMODULES_RECURSE ON
)
-FetchContent_MakeAvailable(cycfi_infra)
+add_subdirectory(${CMAKE_SOURCE_DIR}/cycfi_infra cycfi_infra_build)
target_link_libraries(elements PUBLIC cycfi::infra)
###############################################################################
@@ -270,9 +270,7 @@
FetchContent_Declare(
asio
- GIT_REPOSITORY https://github.com/chriskohlhoff/asio.git
- GIT_TAG asio-1-29-0
- GIT_SHALLOW TRUE
+ SOURCE_DIR ${CMAKE_SOURCE_DIR}/asio
)
FetchContent_MakeAvailable(asio)

60
pkgs/by-name/au/ausaxs/package.nix
View File

@@ -4,25 +4,14 @@
fetchFromGitHub,
cmake,
doxygen,
libwebp,
curl,
cli11,
python3,
pkg-config,
cairo,
gtk3,
catch2_3,
backward-cpp,
}:
let
dlib = fetchFromGitHub {
owner = "davisking";
repo = "dlib";
tag = "v20.0";
hash = "sha256-VTX7s0p2AzlvPUsSMXwZiij+UY9g2y+a1YIge9bi0sw=";
};
thread-pool = fetchFromGitHub {
owner = "bshoshany";
repo = "thread-pool";
@@ -37,57 +26,30 @@ let
hash = "sha256-bnWakLHl/afpeFm6S32ku0IkniyIs8X+LE1NmV6p0ho=";
};
elements = fetchFromGitHub {
owner = "cycfi";
repo = "elements";
rev = "71ecd1f4ebc76967c6812b1872db639784e40a2d";
hash = "sha256-F3Dv+QboXfOSaXpbdOeWPtOC8orWGZc8ZBFho/X8Ky8=";
};
nfd = fetchFromGitHub {
owner = "btzy";
repo = "nativefiledialog-extended";
tag = "v1.2.1";
hash = "sha256-GwT42lMZAAKSJpUJE6MYOpSLKUD5o9nSe9lcsoeXgJY=";
};
asio = fetchFromGitHub {
owner = "chriskohlhoff";
repo = "asio";
tag = "asio-1-29-0";
hash = "sha256-5WSrMe9n+8i/ZyvCsa4MMBguYbSz+7FwH0Z5JfHtRGM=";
};
cycfi_infra = fetchFromGitHub {
owner = "cycfi";
repo = "infra";
rev = "2dff97a4b107eced78e426152f5001a2331cb1cf";
hash = "sha256-NmoPYhfsrC5oWFjJ9Ol83sR8aIkyQr6UpaCeZpW58PI=";
fetchSubmodules = true;
pocketfft = fetchFromGitHub {
owner = "mreineck";
repo = "pocketfft";
rev = "c90e55b3d529f8efa40ed01a20de22405f45fc65";
hash = "sha256-K3yvh6i5f9VbAiQPyixgnlDCj4eBWPU8m3BNn+fScdM=";
};
in
stdenv.mkDerivation (finalAttrs: {
pname = "ausaxs";
version = "1.3.0";
version = "1.3.1";
src = fetchFromGitHub {
owner = "AUSAXS";
repo = "AUSAXS";
tag = "v${finalAttrs.version}";
hash = "sha256-H3lozYImLNwQ7FYz3idgBX/o3miSyUxdZ+ZlJQP2Xms=";
hash = "sha256-3w1bTO2qWUic/1Js4VC7YAne20JegPwCWbfChq5lzy0=";
};
patches = [ ./cmake-no-fetchcontent.patch ];
postPatch = ''
cp --recursive --no-preserve=mode ${dlib} dlib
cp --recursive --no-preserve=mode ${thread-pool} thread_pool
cp --recursive --no-preserve=mode ${gcem} gcem
cp --recursive --no-preserve=mode ${nfd} nfd
cp --recursive --no-preserve=mode ${elements} elements
cp --recursive --no-preserve=mode ${asio} asio
cp --recursive --no-preserve=mode ${cycfi_infra} cycfi_infra
patch -p1 -d elements < ${./elements-cmake-no-fetchcontent.patch}
cp --recursive --no-preserve=mode ${pocketfft} pocketfft
'';
nativeBuildInputs = [
@@ -98,20 +60,14 @@ stdenv.mkDerivation (finalAttrs: {
];
buildInputs = [
backward-cpp
catch2_3
curl
cli11
cairo
libwebp
gtk3
];
cmakeFlags = [
(lib.cmakeBool "GUI" true)
(lib.cmakeBool "USE_SYSTEM_CATCH" true)
(lib.cmakeBool "USE_SYSTEM_CLI11" true)
(lib.cmakeBool "USE_SYSTEM_BACKWARD" true)
];
postInstall = ''

4
pkgs/by-name/au/auto-editor/package.nix
View File

@@ -19,13 +19,13 @@
buildNimPackage rec {
pname = "auto-editor";
version = "31.6.0";
version = "31.7.2";
src = fetchFromGitHub {
owner = "WyattBlue";
repo = "auto-editor";
tag = version;
hash = "sha256-N7pQQD6SVl566z3ud3yY/EFiSbIVRFWwNtlJPTPSgsI=";
hash = "sha256-lbVF0PT48cxnm6hR43ULLx7QWV4nIUPeGUkeOuRr2Y0=";
};
lockFile = ./lock.json;

4
pkgs/by-name/au/autotiling-rs/package.nix
View File

@@ -6,13 +6,13 @@
rustPlatform.buildRustPackage (finalAttrs: {
pname = "autotiling-rs";
version = "0.2.0";
version = "0.2.1";
src = fetchFromGitHub {
owner = "ammgws";
repo = "autotiling-rs";
rev = "v${finalAttrs.version}";
sha256 = "sha256-PuWSS2676IGmbjhiMEpHiOPfOoXyqNEQSbb6pd6FUHc=";
sha256 = "sha256-/lJ2lV4gA43Wd49GcDnP5XqJfRZfVX2n7KhlNdA+HtY=";
};
cargoHash = "sha256-E+nn6rMbj1FzN0bl5jX3YnSHotSaXZGp3AdZuGlziv0=";

8
pkgs/by-name/ba/badgemagic-rs/package.nix
View File

@@ -9,16 +9,16 @@
rustPlatform.buildRustPackage {
pname = "badgemagic-rs";
version = "0.1.0-unstable-2025-07-15";
version = "0.1.0-unstable-2026-06-28";
src = fetchFromGitHub {
owner = "fossasia";
repo = "badgemagic-rs";
rev = "5d745ab8fda418204425f3df0e969a98bf479f2d";
hash = "sha256-IyPUPNbXkLNz/cuzVuzrD2iCE1ddeO3xkAOKhbrNU+k=";
rev = "3ac3c13828f8a111ffe0efb35094d9e3c43d6bf8";
hash = "sha256-aCPvMD1qNoEQHvkIdyLwxyEBe4lWHOoiUpYYq9sHmm0=";
};
cargoHash = "sha256-jT/pJLqdWGTpQFlnhuZo1FLqRQJWXCD2tuDB2AEyNPQ=";
cargoHash = "sha256-BjuGanZRCuFjy23JrHQOI6rPMrfTHcj1uvAHkA4/x8c=";
buildFeatures = [ "cli" ];

9
pkgs/by-name/ba/bashate/package.nix
View File

@@ -2,7 +2,6 @@
lib,
fetchPypi,
python3Packages,
versionCheckHook,
}:
python3Packages.buildPythonApplication rec {
@@ -25,16 +24,10 @@ python3Packages.buildPythonApplication rec {
nativeCheckInputs = with python3Packages; [
fixtures
mock
stestr
stestrCheckHook
testtools
];
checkPhase = ''
runHook preCheck
stestr run
runHook postCheck
'';
pythonImportsCheck = [ "bashate" ];
meta = {

8
pkgs/by-name/be/beeper/package.nix
View File

@@ -14,23 +14,23 @@
}:
let
pname = "beeper";
version = "4.3.160";
version = "4.3.209";
inherit (stdenv.hostPlatform) system;
sources = {
x86_64-linux = fetchurl {
url = "https://beeper-desktop.download.beeper.com/builds/Beeper-${version}-x86_64.AppImage";
hash = "sha256-by07u75l8YjMnuL8VZWkAUjTkGmP/qwJoopIMtJX7Tc=";
hash = "sha256-QdoJguVXOHs8xtSL0wEqPv9zKFub66be5DNaFU6KMMc=";
};
aarch64-linux = fetchurl {
url = "https://beeper-desktop.download.beeper.com/builds/Beeper-${version}-arm64.AppImage";
hash = "sha256-4mUxNwPrHbJvYQmX4KdYZcEmfV2MuSOEXrQKgl7DIa0=";
hash = "sha256-2jRxSHK8cE4s8U72po9gIMrhm7IiJL5VPp2vidKLYe0=";
};
aarch64-darwin = fetchurl {
# Zip unpacks cleanly with unzip; the download API redirects to a .dmg.
url = "https://beeper-desktop.download.beeper.com/builds/Beeper-${version}-arm64-mac.zip";
hash = "sha256-XrFxN57uOXIbgL8va/tgWtAaFTDVp9IxDWGJU0Kskbs=";
hash = "sha256-bDXhMdzhtbcD1mEFXhycIG4PX8ep1s1nW7moaEUUXIw=";
};
};

67
pkgs/by-name/bi/bitritter/package.nix Normal file
View File

@@ -0,0 +1,67 @@
{
lib,
stdenv,
fetchFromCodeberg,
rustPlatform,
pkg-config,
wrapGAppsHook4,
meson,
ninja,
rustc,
cargo,
desktop-file-utils,
openssl,
libadwaita,
nix-update-script,
}:
stdenv.mkDerivation (finalAttrs: {
pname = "bitritter";
version = "2026-10";
__structuredAttrs = true;
src = fetchFromCodeberg {
owner = "Chfkch";
repo = "bitritter";
tag = "v${finalAttrs.version}";
hash = "sha256-V3ZpYEAlj+fWbRenNZPyUeLsRCJ0kGp5c05RPmzgz0g=";
};
cargoDeps = rustPlatform.fetchCargoVendor {
inherit (finalAttrs) pname version src;
hash = "sha256-HhvErKWQUQD7Y5skokTBsZVoXqRuoOCiDfJ5SY+trTE=";
};
strictDeps = true;
nativeBuildInputs = [
pkg-config
wrapGAppsHook4
meson
ninja
rustPlatform.cargoSetupHook
rustc
cargo
desktop-file-utils
openssl
];
buildInputs = [
openssl
libadwaita
];
passthru.updateScript = nix-update-script { };
meta = {
description = "A Bitwarden compatible client designed for mobile Linux ";
homepage = "https://bitritter.dev/";
changelog = "https://codeberg.org/Chfkch/bitritter/releases/tag/${finalAttrs.src.tag}";
license = lib.licenses.mit;
maintainers = with lib.maintainers; [
Cameo007
];
mainProgram = "bitritter";
platforms = lib.platforms.linux;
};
})

4
pkgs/by-name/bo/boringssl/package.nix
View File

@@ -13,12 +13,12 @@
# reference: https://boringssl.googlesource.com/boringssl/+/refs/tags/0.20250818.0/BUILDING.md
stdenv.mkDerivation (finalAttrs: {
pname = "boringssl";
version = "0.20260929.0";
version = "0.20261020.0";
src = fetchgit {
url = "https://boringssl.googlesource.com/boringssl";
tag = finalAttrs.version;
hash = "sha256-ccqhnaYFSLp0dkv8PpdFvz+lzV0X9nL23O3rj5RRA0c=";
hash = "sha256-PKIXmxdr8DtYuz54vxxrSNy3qNYakFoGByoTTAHCB08=";
};
nativeBuildInputs = [

4
pkgs/by-name/bu/buildkit/package.nix
View File

@@ -7,13 +7,13 @@
buildGoModule (finalAttrs: {
pname = "buildkit";
version = "0.32.2";
version = "0.34.0";
src = fetchFromGitHub {
owner = "moby";
repo = "buildkit";
rev = "v${finalAttrs.version}";
hash = "sha256-sRSFypb/CZiCISMumVTor9XI4KOCvBhY6UaNUk2Y4t8=";
hash = "sha256-yoZhov85nr9TcpYWPN22PHqr4KGCMjMEa9JRLC5NWAQ=";
};
vendorHash = null;

4
pkgs/by-name/bu/burpsuite/package.nix
View File

@@ -17,7 +17,7 @@ assert lib.assertMsg (
let
pname = "burpsuite";
version = "2026.9.1";
version = "2026.10";
src = fetchurl {
name = "burpsuite.jar";
@@ -26,7 +26,7 @@ let
"https://portswigger.net/burp/releases/download?product=desktop&version=${version}&type=Jar"
"https://web.archive.org/web/https://portswigger.net/burp/releases/download?product=desktop&version=${version}&type=Jar"
];
hash = "sha256-8FgPLvZuZ5VG9TYyd9jBynLNy7v8PcR5HEbPLAUIEZo=";
hash = "sha256-pDpJmu9LRk/Sdp5QNxIWDa2fTr8Mr3FFqZsSqgNQITo=";
};
description = "Integrated platform for performing security testing of web applications";

4
pkgs/by-name/c-/c-periphery/package.nix
View File

@@ -7,13 +7,13 @@
stdenv.mkDerivation (finalAttrs: {
pname = "c-periphery";
version = "2.5.0";
version = "2.5.1";
src = fetchFromGitHub {
owner = "vsergeev";
repo = "c-periphery";
tag = "v${finalAttrs.version}";
hash = "sha256-lGBDf10kolwPrURwUEtiSCJYdyxZqJN/B1SnY08Ytns=";
hash = "sha256-IqQ9gmbh/bkQ6fwYegPPvqpHPTD9TJDQV7sPxuDNw7k=";
};
outputs = [

4
pkgs/by-name/ca/cacert/package.nix
View File

@@ -20,7 +20,7 @@ let
lib.concatStringsSep "\n\n" extraCertificateStrings
);
version = "3.126";
version = "3.131.1";
meta = {
homepage = "https://firefox-source-docs.mozilla.org/security/nss/runbooks/rootstore.html#root-store-consumers";
description = "Bundle of X.509 certificates of public Certificate Authorities (CA)";
@@ -52,7 +52,7 @@ stdenv.mkDerivation {
"https://hg-edge.mozilla.org/projects/nss/raw-file/${tag}/${file}"
"https://raw.githubusercontent.com/nss-dev/nss/refs/tags/${tag}/${file}"
];
hash = "sha256-gbfyV2MzouNg5nP5Etewt6dl2DbHMQA+NIpGysXTcZg=";
hash = "sha256-PsK00kDcEsdH6vRQBh24SvdXxIO72jAvninOtdcL5RA=";
};
unpackPhase = ''

14
pkgs/by-name/ca/cagebreak/package.nix
View File

@@ -13,6 +13,7 @@
meson,
ninja,
nixosTests,
nix-update-script,
pango,
pixman,
pkg-config,
@@ -23,18 +24,18 @@
wayland-scanner,
withXwayland ? true,
xwayland,
wlroots_0_19,
wlroots_0_20,
}:
stdenv.mkDerivation (finalAttrs: {
pname = "cagebreak";
version = "3.1.0";
version = "3.2.0";
src = fetchFromGitHub {
owner = "project-repo";
repo = "cagebreak";
tag = finalAttrs.version;
hash = "sha256-ADRtfzmn8DmDNbiJO3WbhQZiriJoUAG2TxPmx+RwPXE=";
hash = "sha256-N8FNVZXugRKS+yeU53oAYxE7mm83PCIOLivOHnuB5tI=";
};
nativeBuildInputs = [
@@ -59,7 +60,7 @@ stdenv.mkDerivation (finalAttrs: {
systemdLibs
wayland
wayland-protocols
wlroots_0_19
wlroots_0_20
];
mesonFlags = [
@@ -93,5 +94,8 @@ stdenv.mkDerivation (finalAttrs: {
mainProgram = "cagebreak";
};
passthru.tests.basic = nixosTests.cagebreak;
passthru = {
updateScript = nix-update-script { };
tests.basic = nixosTests.cagebreak;
};
})

6
pkgs/by-name/ca/capacities/version.json
View File

@@ -1,5 +1,5 @@
{
"url": "https://web.archive.org/web/20261007144947/https://2vks4.upcloudobjects.com/capacities-desktop-app/Capacities-1.71.19.AppImage",
"sha256": "0v6ra1fxv1h2avwd695mkf9blid4z52pqqacxzma6h10kgwshbgr",
"version": "1.71.19"
"url": "https://web.archive.org/web/20261018115728/https://2vks4.upcloudobjects.com/capacities-desktop-app/Capacities-1.71.32.AppImage",
"sha256": "0rbaq2bn3w1rci4ipjdhx2ryzq82anpyx6qd3y2cin6kv94zn1jf",
"version": "1.71.32"
}

6
pkgs/by-name/ca/cargo-expand/package.nix
View File

@@ -8,16 +8,16 @@
rustPlatform.buildRustPackage (finalAttrs: {
pname = "cargo-expand";
version = "1.0.126";
version = "1.0.127";
src = fetchFromGitHub {
owner = "dtolnay";
repo = "cargo-expand";
tag = finalAttrs.version;
hash = "sha256-YiJyh2bti5eA02MvJxBPUs+xmfGerVy8kUhMMB2jwbo=";
hash = "sha256-IRNIWIvNYVB93Q9yEg3QSBgI4o0pH6Lv3CWI70GjJJM=";
};
cargoHash = "sha256-TjZ8GY7WjkTs5Nvi7w26evcHzcwUz+VAjl9y85+Cj5M=";
cargoHash = "sha256-jFgbAtbMmNnyYE1qiNzWL3DKqSTB5fmd5/n2NmchavM=";
nativeInstallCheckInputs = [ versionCheckHook ];
doInstallCheck = true;

6
pkgs/by-name/ca/cargo-modules/package.nix
View File

@@ -6,16 +6,16 @@
}:
rustPlatform.buildRustPackage (finalAttrs: {
pname = "cargo-modules";
version = "0.27.0";
version = "0.28.0";
src = fetchFromGitHub {
owner = "regexident";
repo = "cargo-modules";
tag = "v${finalAttrs.version}";
hash = "sha256-wwGuf6ev2H19XauDN60T9NS/onY6ZKr99S6nGhK/V98=";
hash = "sha256-tNmzhVaA5RehRxYfhrXKpnk8yh9sbLAKX2R8jrgz6r0=";
};
cargoHash = "sha256-cESCXoETQzy+3Lb/z2jdbPmnyYNEoNUckFsPZWfDF8o=";
cargoHash = "sha256-k+TdO5NNGAWzPpJ7OF5igU4L/Iqt1RAJUObDasAtxEA=";
checkFlags = [
"--skip=cfg_test::with_tests::smoke"

15
pkgs/by-name/ca/cargo-preflight/package.nix
View File

@@ -4,6 +4,8 @@
rustPlatform,
nix-update-script,
pkg-config,
libgit2,
libz,
openssl,
}:
@@ -11,6 +13,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
pname = "cargo-preflight";
version = "0.5.1";
__structuredAttrs = true;
src = fetchFromGitHub {
owner = "supinie";
repo = "cargo-preflight";
@@ -20,9 +24,18 @@ rustPlatform.buildRustPackage (finalAttrs: {
cargoHash = "sha256-q/JbaFr1ISe0OiKeGBQQlZ2TaMTJkLABilibcp98svM=";
env = {
LIBGIT2_NO_VENDOR = 1;
LIBZ_SYS_STATIC = 0;
};
nativeBuildInputs = [ pkg-config ];
buildInputs = [ openssl ];
buildInputs = [
libgit2
libz
openssl
];
passthru.updateScript = nix-update-script { };

2
pkgs/by-name/ca/cassandra-cpp-driver/package.nix
View File

@@ -57,7 +57,7 @@ stdenv.mkDerivation (finalAttrs: {
binary protocol and Cassandra Query Language v3.
'';
license = lib.licenses.asl20;
platforms = lib.platforms.x86_64;
platforms = lib.platforms.linux;
homepage = "https://docs.datastax.com/en/developer/cpp-driver/";
maintainers = [ lib.maintainers.npatsakula ];
};

4
pkgs/by-name/ca/cassette/package.nix
View File

@@ -24,13 +24,13 @@
stdenv.mkDerivation (finalAttrs: {
pname = "cassette";
version = "0.2.4";
version = "0.2.5";
src = fetchFromGitHub {
owner = "Rirusha";
repo = "Cassette";
rev = "v${finalAttrs.version}";
hash = "sha256-ceXEWcSBQMbG9cuhWjtwI0z/gTzI1t5+9qvFcUeKyrQ=";
hash = "sha256-khPigEzhTHPjbXyl6Rye6Vg8JnVEXhOrJ2lAok40K8g=";
};
nativeBuildInputs = [

6
pkgs/by-name/cd/cdk8s-cli/package.nix
View File

@@ -12,18 +12,18 @@
stdenv.mkDerivation (finalAttrs: {
pname = "cdk8s-cli";
version = "2.207.64";
version = "2.207.68";
src = fetchFromGitHub {
owner = "cdk8s-team";
repo = "cdk8s-cli";
tag = "v${finalAttrs.version}";
hash = "sha256-BtaYzxENteC6U7DbbQfebL8e9BWPJl+1w0j4P1702xg=";
hash = "sha256-sEMdJKgkez70avlUmiZEYBURtTTiGnxxl/0elOA22v0=";
};
yarnOfflineCache = fetchYarnDeps {
inherit (finalAttrs) src;
hash = "sha256-6Qiz1/1/OHMiXEAAG2ggt7BJmsTNUSln0SMJs2gFMgM=";
hash = "sha256-2Hpj9yuUoQJjdPrkp2WZ9SjmLPop32O/hpT2aZA6C0Y=";
};
nativeBuildInputs = [

41
pkgs/by-name/cd/cdvd/package.nix Normal file
View File

@@ -0,0 +1,41 @@
{
lib,
stdenv,
fetchFromGitHub,
ncurses,
unstableGitUpdater,
}:
stdenv.mkDerivation {
pname = "cdvd";
version = "0-unstable-2026-09-19";
src = fetchFromGitHub {
owner = "Szmelc-INC";
repo = "cdvd";
rev = "5a6ff849a58e0923a86045bfd90067f8cb7f8d67";
hash = "sha256-X3dRhW3/rvHOPD6SYT+7S3zLPC0GjYiru53gJUSq1BY=";
};
strictDeps = true;
__structuredAttrs = true;
buildInputs = [ ncurses ];
installFlags = [ "BINDIR=$(out)/bin" ];
passthru.updateScript = unstableGitUpdater { hardcodeZeroVersion = true; };
meta = {
description = "Eyecandy screensaver";
longDescription = ''
A tiny C/ncurses eye candy for the command line. It draws a
bouncing DVD logo with a few extra features.
'';
homepage = "https://github.com/Szmelc-INC/cdvd";
license = lib.licenses.gpl3Only;
maintainers = with lib.maintainers; [ yiyu ];
mainProgram = "cdvd";
platforms = lib.platforms.all;
};
}

2
pkgs/by-name/ce/cef-binary/package.nix
View File

@@ -90,7 +90,7 @@ stdenv.mkDerivation {
hash = selectSystem srcHashes;
};
dontStrip = true;
stripDebugList = [ "Release" ];
dontPatchELF = true;

8
pkgs/by-name/ce/cemu/package.nix
View File

@@ -49,6 +49,12 @@ let
hash = "sha256-J4gz4rnydu8JlzqNC/OIoVoRcgeFd6B1Qboxu5drOKY=";
};
};
# Cemu's BOSS requests lead to a 403 error with Pretendo when curl negotiates HTTP/2.
# This makes games that rely on it fail to download their data.
# Example is Splatoon with the Rotation Schedules
# Workaround is to build against curl without HTTP/2 support until it's fixed upstream.
curl' = curl.override { http2Support = false; };
in
stdenv.mkDerivation (finalAttrs: {
pname = "cemu";
@@ -89,7 +95,7 @@ stdenv.mkDerivation (finalAttrs: {
SDL2
boost
cubeb
curl
curl'
fmt_9
glm
glslang

155
pkgs/by-name/cf/cf/package.nix Normal file
View File

@@ -0,0 +1,155 @@
{
lib,
stdenv,
fetchFromGitHub,
callPackage,
fetchPnpmDeps,
pnpmConfigHook,
pnpm_12,
nodejs,
makeBinaryWrapper,
installShellFiles,
autoPatchelfHook,
patchelfUnstable,
cacert,
nix-update-script,
versionCheckHook,
writableTmpDirAsHomeHook,
}:
stdenv.mkDerivation (finalAttrs: {
pname = "cf";
version = "1.0.0-beta.18";
__structuredAttrs = true;
strictDeps = true;
src = fetchFromGitHub {
owner = "cloudflare";
repo = "cf";
tag = "cf@${finalAttrs.version}";
hash = "sha256-3AjBiAO5mlEMMyzTrq5n3gnhyI7WL8vSTIHIo0bt9ig=";
};
pnpmWorkspaces = [ "cf" ];
pnpmDeps = fetchPnpmDeps {
inherit (finalAttrs)
pname
version
src
pnpmWorkspaces
;
pnpm = pnpm_12;
fetcherVersion = 4;
# Avoid pnpm's macOS clone probe leaving v11/links in the dependency archive.
pnpmInstallFlags = [ "--package-import-method=copy" ];
hash = "sha256-N7S2/X/5k1ae8c35K6If61V0cyFwj4TDmUkp+Ctdpes=";
};
nativeBuildInputs = [
nodejs
pnpm_12
pnpmConfigHook
makeBinaryWrapper
installShellFiles
]
++ lib.optionals stdenv.hostPlatform.isLinux [
autoPatchelfHook
# Older patchelf corrupts libvips's .init section when extending its RPATH.
# https://github.com/NixOS/patchelf/issues/639
patchelfUnstable
];
# The npm distribution includes native workerd and sharp binaries.
buildInputs = lib.optionals stdenv.hostPlatform.isLinux [ stdenv.cc.cc.lib ];
env.NODE_OPTIONS = "--max-old-space-size=4096";
buildPhase = ''
runHook preBuild
# Generated commands are committed; the build task regenerates them online.
pnpm --filter cf exec vp pack
runHook postBuild
'';
installPhase = ''
runHook preInstall
mkdir -p $out/bin
pnpm config set --location=project injectWorkspacePackages true
pnpm --filter cf --prod deploy $out/lib/cf
# Replace workerd's postinstall copy with a link to its platform package.
for workerd in $out/lib/cf/node_modules/.pnpm/workerd@*/node_modules/workerd; do
ln -sfr "$workerd"/../@cloudflare/workerd-*/bin/workerd "$workerd/bin/workerd"
done
makeWrapper ${lib.getExe nodejs} $out/bin/cf \
--inherit-argv0 \
--add-flags $out/lib/cf/bin/cf \
--prefix PATH : ${lib.makeBinPath [ nodejs ]} \
--set-default SSL_CERT_FILE ${cacert}/etc/ssl/certs/ca-bundle.crt
ln -s cf $out/bin/cloudflare
runHook postInstall
'';
preFixup = ''
stripExclude+=("*.js" "*.mjs" "*.ts" "*.map" "*.json" "*.md")
'';
doInstallCheck = true;
nativeInstallCheckInputs = [
versionCheckHook
writableTmpDirAsHomeHook
];
versionCheckKeepEnvironment = [ "HOME" ];
postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
for shell in bash zsh fish; do
CF_SEND_TELEMETRY=false DO_NOT_TRACK=1 $out/bin/cf complete "$shell" > "cf.$shell"
# Bash's readonly globals would collide when both names are loaded.
if [[ $shell == bash ]]; then
sed -i 's/ShellCompDirective/__cf_ShellCompDirective/g' "cf.$shell"
fi
installShellCompletion --cmd cf --$shell "cf.$shell"
# Upstream generates scripts for cf even when invoked as cloudflare.
sed 's/cf/cloudflare/g' "cf.$shell" > "cloudflare.$shell"
installShellCompletion --cmd cloudflare --$shell "cloudflare.$shell"
done
'';
passthru.updateScript = nix-update-script {
# Upstream currently publishes beta releases.
extraArgs = [
"--version=unstable"
"--version-regex=cf@(.*)"
];
};
passthru.tests.functional = callPackage ./tests.nix {
inherit nodejs;
cf = finalAttrs.finalPackage;
};
meta = {
description = "Command-line interface for the Cloudflare API and Workers";
homepage = "https://developers.cloudflare.com/cf";
changelog = "https://github.com/cloudflare/cf/blob/cf@${finalAttrs.version}/packages/cli/CHANGELOG.md";
license = with lib.licenses; [
mit
asl20
];
maintainers = with lib.maintainers; [ connornelson ];
mainProgram = "cf";
# The CLI is built from source; npm supplies native binaries and WASM.
sourceProvenance = with lib.sourceTypes; [
fromSource
binaryNativeCode
binaryBytecode
];
# Platforms supported by both Nixpkgs and workerd's npm distribution.
platforms = [
"x86_64-linux"
"aarch64-linux"
"aarch64-darwin"
];
};
})

101
pkgs/by-name/cf/cf/test.mjs Normal file
View File

@@ -0,0 +1,101 @@
import assert from "node:assert/strict";
import { execFile } from "node:child_process";
import { once } from "node:events";
import { createServer } from "node:http";
import { createRequire } from "node:module";
import { dirname, join, resolve } from "node:path";
import { promisify } from "node:util";
const [binary, version, packagePath] = process.argv.slice(2);
const execFileAsync = promisify(execFile);
const environment = {
...process.env,
CF_SEND_TELEMETRY: "false",
DO_NOT_TRACK: "1",
XDG_CONFIG_HOME: resolve("config"),
CLOUDFLARE_REGISTRY_PATH: resolve("registry"),
};
function run(args, executable = binary, extraEnvironment = {}) {
return execFileAsync(executable, args, {
env: { ...environment, ...extraEnvironment },
encoding: "utf8",
timeout: 45000,
killSignal: "SIGKILL",
});
}
const requireCli = createRequire(join(packagePath, "lib/cf/package.json"));
const requireMiniflare = createRequire(requireCli.resolve("miniflare"));
// Regression test for libvips corruption during ELF patching.
const sharp = requireMiniflare("sharp");
const image = await sharp({
create: { width: 1, height: 1, channels: 3, background: "red" },
}).png().toBuffer();
assert.deepEqual([...await sharp(image).raw().toBuffer()], [255, 0, 0]);
console.log("Sharp image conversion works");
for (const executable of [binary, join(dirname(binary), "cloudflare")]) {
const result = await run(["--version"], executable);
assert.ok((result.stdout + result.stderr).includes(version));
}
console.log("Both executable names report the expected version");
const matches = JSON.parse((await run(["cli", "search", "create a DNS record"])).stdout);
assert.equal(matches[0].command, "cf dns records create");
const schema = JSON.parse((await run(["schema", "zones", "create"])).stdout);
assert.equal(schema.httpMethod, "POST");
assert.equal(schema.path, "/zones");
const completions = (await run(["complete", "--", "zones", "c"])).stdout.split("\n");
assert.ok(completions.some((line) => line.split("\t")[0] === "create"));
console.log("Command search, schema metadata, and completion candidates work");
const local = ["--local", "--persist-to", resolve("state")];
const namespace = ["--namespace-id", "nixpkgs-test"];
await run(["kv", "keys", "put", "greeting", "--body", "hello", ...namespace, ...local]);
assert.equal((await run(["kv", "keys", "get", "greeting", "--text", ...namespace, ...local])).stdout, "hello");
console.log("Local KV persists across CLI processes, which exit cleanly");
const database = "38a2e1b9-3a45-4f6e-9d0c-8b7a6c5d4e3f";
await run(["d1", "raw", database, "--sql",
"CREATE TABLE test (value TEXT); INSERT INTO test VALUES ('hello');", ...local]);
const query = JSON.parse((await run([
"d1", "raw", database, "--sql", "SELECT value FROM test;", ...local,
])).stdout);
assert.equal(query[0].success, true);
assert.deepEqual(query[0].results, { columns: ["value"], rows: [["hello"]] });
console.log("Local D1 persists across CLI processes, which exit cleanly");
const requests = [];
const zones = [{ id: "nixpkgs-zone", name: "example.test" }];
const server = createServer((request, response) => {
requests.push({ method: request.method, url: request.url, headers: request.headers });
response.writeHead(200, { "Content-Type": "application/json" });
response.end(JSON.stringify({
success: true,
errors: [],
messages: [],
result: zones,
result_info: { page: 1, per_page: 20, count: 1, total_count: 1 },
}));
});
server.listen(0, "127.0.0.1");
await once(server, "listening");
try {
const baseUrl = `http://127.0.0.1:${server.address().port}/client/v4`;
const result = await run(["zones", "list", "--name", "example.test"], binary, {
CLOUDFLARE_API_TOKEN: "nixpkgs-test-token",
CLOUDFLARE_API_BASE_URL: baseUrl,
});
assert.deepEqual(JSON.parse(result.stdout), zones);
assert.equal(requests.length, 1);
assert.equal(requests[0].method, "GET");
const url = new URL(requests[0].url, baseUrl);
assert.equal(url.pathname, "/client/v4/zones");
assert.equal(url.searchParams.get("name"), "example.test");
assert.equal(requests[0].headers.authorization, "Bearer nixpkgs-test-token");
} finally {
await promisify(server.close.bind(server))();
}
console.log("API commands send the expected authenticated request to a local test server");

19
pkgs/by-name/cf/cf/tests.nix Normal file
View File

@@ -0,0 +1,19 @@
{
cf,
lib,
runCommand,
nodejs,
writableTmpDirAsHomeHook,
}:
runCommand "cf-functional-tests"
{
nativeBuildInputs = [
nodejs
writableTmpDirAsHomeHook
];
}
''
node ${./test.mjs} ${lib.getExe cf} ${cf.version} ${cf}
touch $out
''

Some files were not shown because too many files have changed in this diff Show More