nathan/nixpkgs
1
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2026-08-25 17:55:21 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge master into staging-next

Browse Source
This commit is contained in:
nixpkgs-ci[bot]
2026-08-18 06:08:31 +00:00
committed by GitHub
parent 0b485d97a3 89907960aa
commit 7886522f8f
34 changed files with 1450 additions and 793 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
nixos/doc/manual/release-notes/rl-2611.section.md
View File

@@ -166,6 +166,8 @@
- `services.gitlab.registry` has been modified so that the GitLab container registry runs in the `gitlab-container-registry` system user. This behavior can be modified with the `services.gitlab.registry.user` option.
- `fail2ban` has been updated to 1.1.1, which has a few breaking changes compared to 1.1.0 ([changelog](https://github.com/fail2ban/fail2ban/blob/1.1.1/ChangeLog))
- `systemd.user.extraConfig` has been removed in favor of the structured [](#opt-systemd.user.settings.Manager) option. Use `systemd.user.settings.Manager` to set any `systemd-user.conf(5)` option directly. For example, replace `systemd.user.extraConfig = "DefaultTimeoutStartSec=60";` with `systemd.user.settings.Manager.DefaultTimeoutStartSec = 60;`.
- `matrix-appservice-discord` was removed from nixpkgs along with its NixOS module (`services.matrix-appservice-discord`) as it is no longer actively maintained upstream. Use the actively-maintained puppeting bridge [`mautrix-discord`](#opt-services.mautrix-discord.enable) instead.

88
nixos/modules/services/continuous-integration/github-runner/app-token.sh Normal file
View File

@@ -0,0 +1,88 @@
# shellcheck shell=bash
# Request an installation access token for a GitHub App.
#
# Adapted from https://github.com/myoung34/docker-github-actions-runner (MIT,
# Copyright (c) 2020 Marcus Young), see:
# https://github.com/orgs/community/discussions/24743#discussioncomment-3245300
#
# Expects the following environment variables:
# * APP_ID the GitHub App's ID
# * APP_PRIVATE_KEY the GitHub App's PEM-encoded private key (contents)
# * APP_LOGIN the org/user login the App is installed on
# * GITHUB_HOST optional, defaults to github.com (set for GHES)
#
# Prints the installation access token (prefixed with `ghs_`) to stdout.
_GITHUB_HOST=${GITHUB_HOST:="github.com"}
# If the host is not github.com, use the GitHub Enterprise Server API endpoint.
if [[ ${_GITHUB_HOST} == "github.com" ]]; then
URI="https://api.${_GITHUB_HOST}"
else
URI="https://${_GITHUB_HOST}/api/v3"
fi
API_VERSION=v3
API_HEADER="Accept: application/vnd.github.${API_VERSION}+json"
CONTENT_LENGTH_HEADER="Content-Length: 0"
APP_INSTALLATIONS_URI="${URI}/app/installations"
# JWT token issuance and expiration parameters, see:
# https://docs.github.com/en/apps/creating-github-apps/authenticating-with-a-github-app/generating-a-json-web-token-jwt-for-a-github-app
JWT_IAT_DRIFT=60
JWT_EXP_DELTA=600
JWT_JOSE_HEADER='{
"alg": "RS256",
"typ": "JWT"
}'
build_jwt_payload() {
now=$(date +%s)
iat=$((now - JWT_IAT_DRIFT))
jq -c \
--arg iat_str "${iat}" \
--arg exp_delta_str "${JWT_EXP_DELTA}" \
--arg app_id_str "${APP_ID}" \
'
($iat_str | tonumber) as $iat
| ($exp_delta_str | tonumber) as $exp_delta
| ($app_id_str | tonumber) as $app_id
| .iat = $iat
| .exp = ($iat + $exp_delta)
| .iss = $app_id
' <<<"{}" | tr -d '\n'
}
base64url() {
base64 | tr '+/' '-_' | tr -d '=\n'
}
rs256_sign() {
openssl dgst -binary -sha256 -sign <(echo "$1")
}
request_access_token() {
jwt_payload=$(build_jwt_payload)
encoded_jwt_parts=$(base64url <<<"${JWT_JOSE_HEADER}").$(base64url <<<"${jwt_payload}")
encoded_mac=$(echo -n "${encoded_jwt_parts}" | rs256_sign "${APP_PRIVATE_KEY}" | base64url)
generated_jwt="${encoded_jwt_parts}.${encoded_mac}"
auth_header="Authorization: Bearer ${generated_jwt}"
app_installations_response=$(
curl -fsSX GET \
-H "${auth_header}" \
-H "${API_HEADER}" \
"${APP_INSTALLATIONS_URI}"
)
access_token_url=$(echo "${app_installations_response}" | jq --raw-output '.[] | select (.account.login == "'"${APP_LOGIN}"'" and .app_id == '"${APP_ID}"') .access_tokens_url')
curl -fsSX POST \
-H "${CONTENT_LENGTH_HEADER}" \
-H "${auth_header}" \
-H "${API_HEADER}" \
"${access_token_url}" |
jq --raw-output .token
}
request_access_token

179
nixos/modules/services/continuous-integration/github-runner/options.nix
View File

@@ -42,7 +42,8 @@
};
url = lib.mkOption {
type = lib.types.str;
type = lib.types.nullOr lib.types.str;
default = null;
description = ''
Repository to add the runner to.
@@ -55,12 +56,16 @@
Otherwise, you are going to get a `404 NotFound`
from `POST https://api.github.com/actions/runner-registration`
in the configure script.
Mandatory unless `orgs` is used, in which case the URL is taken
from each `orgs.<name>.url` instead and this option is ignored.
'';
example = "https://github.com/nixos/nixpkgs";
};
tokenFile = lib.mkOption {
type = lib.types.path;
type = lib.types.nullOr lib.types.path;
default = null;
description = ''
The full path to a file which contains either
@@ -68,6 +73,10 @@
* a classic PAT
* or a runner registration token
Exactly one of `tokenFile` and `githubApp` must be set. Use
`githubApp` to authenticate via a GitHub App installation instead
of a token file.
Changing this option or the `tokenFile`’s content triggers a new runner registration.
We suggest using the fine-grained PATs. A runner registration token is valid
@@ -126,6 +135,71 @@
default = "auto";
};
githubApp = lib.mkOption {
default = null;
description = ''
Authenticate the runner using a GitHub App installation instead
of a `tokenFile`. Exactly one of `tokenFile` and `githubApp` must
be set.
On every start the service derives a short-lived installation
access token from the App's private key, uses it to fetch a fresh
runner registration token and registers the runner with it. This
avoids storing a long-lived personal access token on the host and
pairs well with `ephemeral` runners.
The App needs read and write access to the
"self-hosted runners" administration of the organisation (or
repository) given in `url`, and must be installed on the `login`
below.
'';
example = lib.literalExpression ''
{
id = 123456;
login = "my-org";
privateKeyFile = "/run/secrets/github-app.pem";
}
'';
type = lib.types.nullOr (
lib.types.submodule {
options = {
id = lib.mkOption {
type = lib.types.int;
description = "The GitHub App's ID (the numeric `App ID`, not the client ID).";
example = 123456;
};
login = lib.mkOption {
type = lib.types.nullOr lib.types.str;
default = null;
description = ''
The organisation (or user) login the GitHub App is
installed on. Used to look up the App installation and,
for organisation-wide runners, as the registration scope.
Mandatory unless `orgs` is used, in which case the login
is taken from each `orgs.<name>.login` instead and this
option is ignored.
Changing this option triggers a new runner registration.
'';
example = "my-org";
};
privateKeyFile = lib.mkOption {
type = lib.types.path;
description = ''
The full path to a file containing the GitHub App's
PEM-encoded private key. The file should be deployed as a
secret and is never copied into the Nix store.
'';
example = "/run/secrets/github-app.pem";
};
};
}
);
};
name = lib.mkOption {
type = lib.types.nullOr lib.types.str;
description = ''
@@ -137,6 +211,107 @@
default = name;
};
count = lib.mkOption {
type = lib.types.ints.positive;
default = 1;
example = 4;
description = ''
Number of identical runner instances to create.
Without `orgs`, this fans the single entry (using the
entry-level `url`) out into `count` runner services:
`github-runner-<name>` for `count == 1` (unchanged) and
`github-runner-<name>-<n>` for `count > 1`. Each instance
registers under a distinct runner name.
With `orgs`, this is the default replica count for every org
that does not set its own; see `orgs.<name>.count`.
Pairs well with `ephemeral`.
'';
};
orgs = lib.mkOption {
default = { };
description = ''
Organisations (or repositories) to serve from this entry.
When set, the entry fans out into one systemd service per runner
named `github-runner-<name>-<org>-<n>`, where `<org>` is the
attribute name and `<n>` ranges over the per-org `count`. The
entry-level `githubApp`/`tokenFile` is shared across every org;
only the App `login` changes per org (defaulting to the
attribute name), so a single GitHub App installed on multiple
orgs serves all of them.
Leaving this empty (the default) keeps the single-runner
behaviour: the entry-level `url`, `name` and auth, fanned out by
the entry-level `count`.
'';
example = lib.literalExpression ''
{
org-a.count = 12;
org-b = {
count = 2;
extraLabels = [ "org-b" ];
};
}
'';
type = lib.types.attrsOf (
lib.types.submodule (
{ name, ... }:
{
options = {
url = lib.mkOption {
type = lib.types.str;
default = "https://github.com/${name}";
defaultText = lib.literalExpression ''"https://github.com/''${name}"'';
description = ''
URL of the organisation (or repository) to connect to.
Defaults to the GitHub URL derived from the attribute name.
'';
};
login = lib.mkOption {
type = lib.types.str;
default = name;
defaultText = lib.literalExpression "\${name}";
description = ''
GitHub login (org or user) the shared `githubApp` is
installed on. Defaults to the attribute name. Ignored
when authenticating via `tokenFile`.
'';
};
count = lib.mkOption {
type = lib.types.ints.positive;
default = config.count;
defaultText = lib.literalMD "the entry-level `count`";
example = 4;
description = ''
Number of identical runner instances to create for this
org. Defaults to the entry-level `count`. Each gets its
own systemd service named `github-runner-<name>-<org>-<n>`
and registers under a distinct runner name. Pairs well
with `ephemeral`.
'';
};
extraLabels = lib.mkOption {
type = lib.types.listOf lib.types.str;
default = [ ];
example = lib.literalExpression ''[ "org-a" ]'';
description = ''
Extra labels added, on top of the entry-level `extraLabels`,
only to this org's runners.
'';
};
};
}
)
);
};
runnerGroup = lib.mkOption {
type = lib.types.nullOr lib.types.str;
description = ''

58
nixos/modules/services/continuous-integration/github-runner/registration-token.sh Normal file
View File

@@ -0,0 +1,58 @@
# shellcheck shell=bash
# Fetch a self-hosted runner registration token from the GitHub API.
#
# Adapted from https://github.com/myoung34/docker-github-actions-runner (MIT,
# Copyright (c) 2020 Marcus Young).
#
# Expects the following environment variables:
# * ACCESS_TOKEN a token authorized to manage self-hosted runners
# (a GitHub App installation token or a suitable PAT)
# * RUNNER_SCOPE one of `org`, `ent` or `repo`
# * ORG_NAME the org login (for `org` scope)
# * ENTERPRISE_NAME the enterprise slug (for `ent` scope)
# * REPO_URL the repository URL (for `repo` scope)
# * GITHUB_HOST optional, defaults to github.com (set for GHES)
#
# Prints `{"token": ..., "full_url": ...}` to stdout.
_GITHUB_HOST=${GITHUB_HOST:="github.com"}
# If the host is not github.com, use the GitHub Enterprise Server API endpoint.
if [[ ${_GITHUB_HOST} == "github.com" ]]; then
URI="https://api.${_GITHUB_HOST}"
else
URI="https://${_GITHUB_HOST}/api/v3"
fi
API_VERSION=v3
API_HEADER="Accept: application/vnd.github.${API_VERSION}+json"
AUTH_HEADER="Authorization: token ${ACCESS_TOKEN}"
CONTENT_LENGTH_HEADER="Content-Length: 0"
case ${RUNNER_SCOPE} in
org*)
_FULL_URL="${URI}/orgs/${ORG_NAME}/actions/runners/registration-token"
;;
ent*)
_FULL_URL="${URI}/enterprises/${ENTERPRISE_NAME}/actions/runners/registration-token"
;;
*)
_PROTO="https://"
_URL="${REPO_URL/${_PROTO}/}"
_PATH="$(echo "${_URL}" | grep / | cut -d/ -f2-)"
_ACCOUNT="$(echo "${_PATH}" | cut -d/ -f1)"
_REPO="$(echo "${_PATH}" | cut -d/ -f2)"
_FULL_URL="${URI}/repos/${_ACCOUNT}/${_REPO}/actions/runners/registration-token"
;;
esac
RUNNER_TOKEN="$(curl -fsSX POST \
-H "${CONTENT_LENGTH_HEADER}" \
-H "${AUTH_HEADER}" \
-H "${API_HEADER}" \
"${_FULL_URL}" |
jq -r '.token')"
echo "{\"token\": \"${RUNNER_TOKEN}\", \"full_url\": \"${_FULL_URL}\"}"

71
nixos/modules/services/continuous-integration/github-runner/remove-runner.sh Normal file
View File

@@ -0,0 +1,71 @@
# shellcheck shell=bash
# Force-remove a previously registered, offline self-hosted runner via the
# GitHub API. Used before re-registering to avoid orphaned runners piling up in
# the GitHub Actions UI.
#
# Adapted from https://github.com/myoung34/docker-github-actions-runner (MIT,
# Copyright (c) 2020 Marcus Young).
#
# Expects the following environment variables:
# * ACCESS_TOKEN a token authorized to manage self-hosted runners
# * RUNNER_NAME the name of the runner to remove
# * RUNNER_SCOPE one of `org`, `ent` or `repo`
# * ORG_NAME the org login (for `org` scope)
# * ENTERPRISE_NAME the enterprise slug (for `ent` scope)
# * REPO_URL the repository URL (for `repo` scope)
# * GITHUB_HOST optional, defaults to github.com (set for GHES)
_GITHUB_HOST=${GITHUB_HOST:="github.com"}
# If the host is not github.com, use the GitHub Enterprise Server API endpoint.
if [[ ${_GITHUB_HOST} == "github.com" ]]; then
URI="https://api.${_GITHUB_HOST}"
else
URI="https://${_GITHUB_HOST}/api/v3"
fi
API_HEADER="Accept: application/vnd.github+json"
AUTH_HEADER="Authorization: token ${ACCESS_TOKEN}"
CONTENT_LENGTH_HEADER="Content-Length: 0"
runners_url() {
case ${RUNNER_SCOPE} in
org*)
echo "${URI}/orgs/${ORG_NAME}/actions/runners"
;;
ent*)
echo "${URI}/enterprises/${ENTERPRISE_NAME}/actions/runners"
;;
*)
_PROTO="https://"
_URL="${REPO_URL/${_PROTO}/}"
_PATH="$(echo "${_URL}" | grep / | cut -d/ -f2-)"
_ACCOUNT="$(echo "${_PATH}" | cut -d/ -f1)"
_REPO="$(echo "${_PATH}" | cut -d/ -f2)"
echo "${URI}/repos/${_ACCOUNT}/${_REPO}/actions/runners"
;;
esac
}
_RUNNERS_URL="$(runners_url)"
RUNNERS="$(curl -fsSX GET \
-H "${CONTENT_LENGTH_HEADER}" \
-H "${AUTH_HEADER}" \
-H "${API_HEADER}" \
-H "X-GitHub-Api-Version: 2022-11-28" \
"${_RUNNERS_URL}")"
RUNNER_ID=$(echo "$RUNNERS" | jq -r '.runners[] | select( (.name == env.RUNNER_NAME) and (.status == "offline") ) | .id')
if [[ $RUNNER_ID == "" ]]; then
echo "Runner ${RUNNER_NAME} doesn't exist or is online. Nothing to unregister."
exit 0
fi
echo "${RUNNER_NAME} is still registered and offline. Forcing removal..."
curl -fsSX DELETE \
-H "${CONTENT_LENGTH_HEADER}" \
-H "${AUTH_HEADER}" \
-H "${API_HEADER}" \
-H "X-GitHub-Api-Version: 2022-11-28" \
"${_RUNNERS_URL}/${RUNNER_ID}"

230
nixos/modules/services/continuous-integration/github-runner/service.nix
View File

@@ -9,6 +9,22 @@
lib.flip lib.mapAttrsToList config.services.github-runners (
name: cfg:
map (lib.mkIf cfg.enable) [
{
assertion = (cfg.tokenFile == null) != (cfg.githubApp == null);
message = "`services.github-runners.${name}`: Exactly one of `tokenFile` and `githubApp` must be set";
}
{
assertion = cfg.orgs != { } || cfg.url != null;
message = "`services.github-runners.${name}`: `url` must be set unless `orgs` is used";
}
{
assertion = cfg.orgs != { } || cfg.githubApp == null || cfg.githubApp.login != null;
message = "`services.github-runners.${name}`: `githubApp.login` must be set unless `orgs` is used (the login is then derived per org)";
}
{
assertion = cfg.orgs != { } || cfg.count == 1 || cfg.name != null;
message = "`services.github-runners.${name}`: `name` must not be null when `count > 1` (each replica needs a distinct registration name)";
}
{
assertion = !cfg.noDefaultLabels || (cfg.extraLabels != [ ]);
message = "`services.github-runners.${name}`: The `extraLabels` option is mandatory if `noDefaultLabels` is set";
@@ -24,8 +40,49 @@
config.systemd.services =
let
enabledRunners = lib.filterAttrs (_: cfg: cfg.enable) config.services.github-runners;
runnerInstances = lib.concatMapAttrs (
name: cfg:
if cfg.orgs == { } then
# Single org/repo (entry-level `url`), fanned out by `count`. For
# `count == 1` the service keeps the bare `github-runner-<name>` name
# for backwards compatibility; `count > 1` suffixes `-<n>`.
let
suffixes = if cfg.count == 1 then [ "" ] else map (n: "-${toString n}") (lib.range 1 cfg.count);
in
lib.listToAttrs (
map (
suffix:
lib.nameValuePair "${name}${suffix}" (
cfg // { name = if cfg.name == null then null else "${cfg.name}${suffix}"; }
)
) suffixes
)
else
lib.listToAttrs (
lib.concatLists (
lib.flip lib.mapAttrsToList cfg.orgs (
orgName: org:
map (
n:
let
key = "${name}-${orgName}-${toString n}";
in
lib.nameValuePair key (
cfg
// {
url = org.url;
name = key;
extraLabels = cfg.extraLabels ++ org.extraLabels;
githubApp = if cfg.githubApp == null then null else cfg.githubApp // { login = org.login; };
}
)
) (lib.range 1 org.count)
)
)
)
) enabledRunners;
in
(lib.flip lib.mapAttrs' enabledRunners (
(lib.flip lib.mapAttrs' runnerInstances (
name: cfg:
let
svcName = "github-runner-${name}";
@@ -41,6 +98,66 @@
currentConfigTokenFilename = ".current-token";
workDir = if cfg.workDir == null then runtimeDir else cfg.workDir;
newConfigTokenPath = "$STATE_DIRECTORY/.new-token";
currentConfigTokenPath = "$STATE_DIRECTORY/${currentConfigTokenFilename}";
# Wrapper script which expects the full path of the state, working and logs
# directory as arguments. Overrides the respective systemd variables to provide
# unambiguous directory names. This becomes relevant, for example, if the
# caller overrides any of the StateDirectory=, RuntimeDirectory= or LogDirectory=
# to contain more than one directory. This causes systemd to set the respective
# environment variables with the path of all of the given directories, separated
# by a colon.
writeScript =
scriptName: lines:
pkgs.writeShellScript "${svcName}-${scriptName}.sh" ''
set -euo pipefail
STATE_DIRECTORY="$1"
WORK_DIRECTORY="$2"
LOGS_DIRECTORY="$3"
${lines}
'';
ghUrlPath = lib.removePrefix "https://github.com/" cfg.url;
ghUrlSegments = lib.filter (s: s != "") (lib.splitString "/" ghUrlPath);
runnerScope = if lib.length ghUrlSegments >= 2 then "repo" else "org";
appHelper =
helperName: scriptFile:
pkgs.writeShellApplication {
name = helperName;
runtimeInputs = with pkgs; [
jq
curl
openssl
coreutils
];
excludeShellChecks = [
"SC2154"
"SC2116"
];
text = builtins.readFile scriptFile;
};
fetchAccessToken = appHelper "github-app-access-token" ./app-token.sh;
fetchRegistrationToken = appHelper "github-runner-registration-token" ./registration-token.sh;
removeRunner = appHelper "github-runner-remove" ./remove-runner.sh;
appEnv = lib.optionalString (cfg.githubApp != null) ''
export APP_ID=${toString cfg.githubApp.id}
export APP_LOGIN=${lib.escapeShellArg cfg.githubApp.login}
APP_PRIVATE_KEY="$(cat ${lib.escapeShellArg cfg.githubApp.privateKeyFile})"
export APP_PRIVATE_KEY
export RUNNER_SCOPE=${runnerScope}
export ORG_NAME=${lib.escapeShellArg cfg.githubApp.login}
export REPO_URL=${lib.escapeShellArg cfg.url}
${
if cfg.name != null then
"export RUNNER_NAME=${lib.escapeShellArg cfg.name}"
else
''export RUNNER_NAME="$(uname -n)"''
}
'';
in
lib.nameValuePair svcName {
description = "GitHub Actions runner";
@@ -84,24 +201,6 @@
# - Set up the directory structure by creating the necessary symlinks.
ExecStartPre =
let
# Wrapper script which expects the full path of the state, working and logs
# directory as arguments. Overrides the respective systemd variables to provide
# unambiguous directory names. This becomes relevant, for example, if the
# caller overrides any of the StateDirectory=, RuntimeDirectory= or LogDirectory=
# to contain more than one directory. This causes systemd to set the respective
# environment variables with the path of all of the given directories, separated
# by a colon.
writeScript =
name: lines:
pkgs.writeShellScript "${svcName}-${name}.sh" ''
set -euo pipefail
STATE_DIRECTORY="$1"
WORK_DIRECTORY="$2"
LOGS_DIRECTORY="$3"
${lines}
'';
runnerRegistrationConfig = lib.getAttrs [
"ephemeral"
"extraLabels"
@@ -114,8 +213,6 @@
] cfg;
newConfigPath = builtins.toFile "${svcName}-config.json" (builtins.toJSON runnerRegistrationConfig);
currentConfigPath = "$STATE_DIRECTORY/.nixos-current-config.json";
newConfigTokenPath = "$STATE_DIRECTORY/.new-token";
currentConfigTokenPath = "$STATE_DIRECTORY/${currentConfigTokenFilename}";
runnerCredFiles = [
".credentials"
@@ -164,6 +261,23 @@
# Always clean workDir
find -H "$WORK_DIRECTORY" -mindepth 1 -delete
'';
unconfigureRunnerGitHubApp = writeScript "unconfigure-github-app" ''
${appEnv}
ACCESS_TOKEN="$(${lib.getExe' fetchAccessToken "github-app-access-token"})"
export ACCESS_TOKEN
${lib.getExe' removeRunner "github-runner-remove"} || true
find "$STATE_DIRECTORY/" -mindepth 1 -delete
umask 000
${lib.getExe' fetchRegistrationToken "github-runner-registration-token"} \
| ${pkgs.jq}/bin/jq -r '.token' > "${newConfigTokenPath}"
install --mode=600 "${newConfigTokenPath}" "${currentConfigTokenPath}"
# Always clean workDir
find -H "$WORK_DIRECTORY" -mindepth 1 -delete
'';
configureRunner =
writeScript "configure" # bash
''
@@ -185,24 +299,33 @@
${lib.optionalString cfg.noDefaultLabels "--no-default-labels"}
)
token=$(<"${newConfigTokenPath}")
case ${cfg.tokenType} in
access)
args+=(--pat "$token")
;;
registration)
args+=(--token "$token")
;;
auto)
# If the token file contains a PAT (i.e., it starts with "ghp_" or "github_pat_"),
# we have to use the --pat option, if it is not a PAT, we assume it contains a
# registration token and use the --token option
if [[ "$token" =~ ^gh[a-z]+_* ]] || [[ "$token" =~ ^github_pat_* ]]; then
args+=(--pat "$token")
${
if cfg.githubApp != null then
''
args+=(--token "$token")
''
else
args+=(--token "$token")
fi
;;
esac
''
case ${cfg.tokenType} in
access)
args+=(--pat "$token")
;;
registration)
args+=(--token "$token")
;;
auto)
# If the token file contains a PAT (i.e., it starts with "ghp_" or "github_pat_"),
# we have to use the --pat option, if it is not a PAT, we assume it contains a
# registration token and use the --token option
if [[ "$token" =~ ^gh[a-z]+_* ]] || [[ "$token" =~ ^github_pat_* ]]; then
args+=(--pat "$token")
else
args+=(--token "$token")
fi
;;
esac
''
}
${cfg.package}/bin/Runner.Listener configure "''${args[@]}"
# Move the automatically created _diag dir to the logs dir
mkdir -p "$STATE_DIRECTORY/_diag"
@@ -234,11 +357,33 @@
}"
)
[
"+${unconfigureRunner}" # runs as root
# runs as root
"+${if cfg.githubApp != null then unconfigureRunnerGitHubApp else unconfigureRunner}"
configureRunner
setupWorkDir
];
ExecStopPost = lib.optionals (cfg.githubApp != null) (
let
unregister = writeScript "unregister-github-app" ''
${appEnv}
ACCESS_TOKEN="$(${lib.getExe' fetchAccessToken "github-app-access-token"})"
export ACCESS_TOKEN
${lib.getExe' removeRunner "github-runner-remove"} || true
'';
in
map (
x:
"${x} ${
lib.escapeShellArgs [
stateDir
workDir
logsDir
]
}"
) [ "-+${unregister}" ] # runs as root
);
# If running in ephemeral mode, restart the service on-exit (i.e., successful de-registration of the runner)
# to trigger a fresh registration.
Restart = if cfg.ephemeral then "on-success" else "no";
@@ -256,11 +401,12 @@
WorkingDirectory = workDir;
InaccessiblePaths = [
# Token file path given in the configuration, if visible to the service
"-${cfg.tokenFile}"
# Token file in the state directory
"${stateDir}/${currentConfigTokenFilename}"
];
]
# Token file path given in the configuration, if visible to the service
++ lib.optional (cfg.tokenFile != null) "-${cfg.tokenFile}"
++ lib.optional (cfg.githubApp != null) "-${cfg.githubApp.privateKeyFile}";
KillSignal = "SIGINT";

74
nixos/tests/github-runner.nix
View File

@@ -6,6 +6,11 @@
};
nodes.machine =
{ pkgs, ... }:
let
appPrivateKey = pkgs.runCommand "github-app.pem" {
nativeBuildInputs = [ pkgs.openssl ];
} "openssl genrsa -out $out 2048";
in
{
services.github-runners.test = {
enable = true;
@@ -19,6 +24,55 @@
tokenFile = builtins.toFile "github-runner.token" "not-so-secret";
};
# Runner authenticated via a GitHub App installation. This exercises the
# module evaluation and the App authentication code path up to the point it
# contacts the (stubbed) GitHub API; a successful registration would
# require talking to the real API.
services.github-runners.test-app = {
enable = true;
url = "https://github.com/yaxitech";
githubApp = {
id = 123456;
login = "yaxitech";
privateKeyFile = appPrivateKey;
};
};
# A single org/repo entry with `count > 1` fans out into one systemd
# service per replica, named `github-runner-<name>-<n>`.
services.github-runners.test-replicas = {
enable = true;
url = "https://github.com/yaxitech";
tokenFile = builtins.toFile "github-runner.token" "not-so-secret";
count = 2;
};
# A single entry with `orgs` fans out into one systemd service per org and
# per replica, named `github-runner-<name>-<org>-<n>`.
services.github-runners.test-orgs = {
enable = true;
tokenFile = builtins.toFile "github-runner.token" "not-so-secret";
orgs = {
yaxitech.count = 2;
another = { };
};
};
# `orgs` combined with a shared GitHub App: the same App is used for every
# org and only the per-org `login` changes (derived from the attribute
# name), so no entry-level `githubApp.login` is needed.
services.github-runners.test-orgs-app = {
enable = true;
githubApp = {
id = 123456;
privateKeyFile = appPrivateKey;
};
orgs = {
yaxitech = { };
"another-org" = { };
};
};
systemd.services.dummy-github-com = {
wantedBy = [ "multi-user.target" ];
before = [ "github-runner-test.service" ];
@@ -42,6 +96,26 @@
machine.wait_until_succeeds("test -f /tmp/registration-connect")
# The GitHub App runner unit is generated and wired to the App auth path.
machine.succeed("systemctl cat github-runner-test-app.service | grep -F unconfigure-github-app")
# `count > 1` on a single entry fans out into one unit per replica with a
# `-<n>` suffix; there is no bare unit.
machine.succeed("systemctl cat github-runner-test-replicas-1.service")
machine.succeed("systemctl cat github-runner-test-replicas-2.service")
machine.fail("systemctl cat github-runner-test-replicas.service")
# `orgs` fans out into one unit per org and replica; there is no bare unit.
machine.succeed("systemctl cat github-runner-test-orgs-yaxitech-1.service")
machine.succeed("systemctl cat github-runner-test-orgs-yaxitech-2.service")
machine.succeed("systemctl cat github-runner-test-orgs-another-1.service")
machine.fail("systemctl cat github-runner-test-orgs.service")
# `orgs` with a shared GitHub App generates one App-authenticated unit per
# org, each with its per-org login derived from the attribute name.
machine.succeed("systemctl cat github-runner-test-orgs-app-yaxitech-1.service | grep -F unconfigure-github-app")
machine.succeed("systemctl cat github-runner-test-orgs-app-another-org-1.service | grep -F unconfigure-github-app")
machine.fail("systemctl list-unit-files | grep test-disabled")
'';
}

25
pkgs/applications/editors/emacs/elisp-packages/manual-packages/cognitive-complexity/package.nix Normal file
View File

@@ -0,0 +1,25 @@
{
lib,
unstableGitUpdater,
melpaBuild,
fetchFromGitHub,
}:
melpaBuild {
pname = "cognitive-complexity";
version = "0-unstable-2026-04-14";
src = fetchFromGitHub {
owner = "emacs-vs";
repo = "cognitive-complexity";
rev = "b45afe9bf65943f985b645cea514212dc734349b";
hash = "sha256-wPS/2yIQjqFWqlyf1qpd+FrvVH5KBL+kpSCW3bgmDL8=";
};
passthru.updateScript = unstableGitUpdater { };
meta = {
homepage = "https://github.com/emacs-vs/cognitive-complexity";
description = "Show cognitive complexity of code";
license = lib.licenses.gpl3Plus;
maintainers = with lib.maintainers; [ johnhamelink ];
};
}

4
pkgs/applications/editors/vscode/extensions/oxc.oxc-vscode/default.nix
View File

@@ -10,8 +10,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
mktplcRef = {
publisher = "oxc";
name = "oxc-vscode";
version = "1.59.0";
hash = "sha256-avfW91oF8PGCoDYocC744wpQ3zE8fv5582n55Ugb8k8=";
version = "1.60.0";
hash = "sha256-LTkZNz6EnBre4TguSKZJaZ6vdn9cFNqsYgw+ueFT7oc=";
};
nativeBuildInputs = [

1238
pkgs/applications/networking/browsers/firefox-bin/release_sources.nix
View File

File diff suppressed because it is too large Load Diff

4
pkgs/applications/networking/browsers/firefox/packages/firefox-esr-140.nix
View File

@@ -8,11 +8,11 @@
buildMozillaMach rec {
pname = "firefox";
version = "140.13.0esr";
version = "140.14.0esr";
applicationName = "Firefox ESR";
src = fetchurl {
url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
sha512 = "937a4103d71c5e1e4bf051821729f6ea70b5c18d444930a487695cc23d74712a0134047248f6ac02305e01becb705426a55b9d89739f02a01eda01ecf5bc27f1";
sha512 = "0609cca9bfaecbff56cdf13458534bd8cfa43f139056867d3b6394a767281599ee600f83165ad25565ced59b552592aa84431357458ccecfbe5bf104dca501c7";
};
meta = {

4
pkgs/applications/networking/browsers/firefox/packages/firefox-esr-153.nix
View File

@@ -8,11 +8,11 @@
buildMozillaMach rec {
pname = "firefox";
version = "153.0esr";
version = "153.1.0esr";
applicationName = "Firefox ESR";
src = fetchurl {
url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
sha512 = "3ea7956ef2fdcaa86430ef922f04484cbb1a3faf447e035107159fcd5ecd8d0a0e4507a332fc3d7b66e4308c38733bd0624affd7629447b89c655a9ea0fb0936";
sha512 = "0e5be18878a1bb8575d4ff03b499a092663fcd1779a05b59b82a8b663a3d7047cf3d6f971faeb3d1262f83b23022a703a2033e8ea38bcbd9c85f44bdd35d86c1";
};
meta = {

4
pkgs/applications/networking/browsers/firefox/packages/firefox.nix
View File

@@ -9,10 +9,10 @@
buildMozillaMach rec {
pname = "firefox";
version = "153.0.4";
version = "154.0";
src = fetchurl {
url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
sha512 = "9081beed7f08797c2128094169cf95af4a35e208fd22bba709bfb1a19e15d15aa484fccae71154d2ae0ff955bf629cd634cc7ed6b180371aea792daf7c689ff7";
sha512 = "a77cd664982add628681167ef5939bd6bf0c894aa380cca66f9b5fb265947874d1e819d42264f1dd07c843f8a6dc020da268cca9ff1e064fca019de91af9b996";
};
meta = {

25
pkgs/by-name/fa/fail2ban/package.nix
View File

@@ -2,7 +2,6 @@
lib,
stdenv,
fetchFromGitHub,
fetchpatch,
python3,
installShellFiles,
nixosTests,
@@ -10,7 +9,7 @@
python3.pkgs.buildPythonApplication (finalAttrs: {
pname = "fail2ban";
version = "1.1.0";
version = "1.1.1";
pyproject = true;
__structuredAttrs = true;
@@ -20,7 +19,7 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
owner = "fail2ban";
repo = "fail2ban";
tag = finalAttrs.version;
hash = "sha256-0xPNhbu6/p/cbHOr5Y+PXbMbt5q/S13S5100ZZSdylE=";
hash = "sha256-6L8lSoFdf/KL1AQfN0lfGthEfeLlxodVsMI3LXCq+XY=";
};
outputs = [
@@ -44,8 +43,7 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
dependencies =
with python3.pkgs;
[ distutils ]
++ lib.optionals stdenv.hostPlatform.isLinux [
lib.optionals stdenv.hostPlatform.isLinux [
systemd-python
pyinotify
];
@@ -59,19 +57,6 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
doCheck = false;
patches = [
# Adjust sshd filter for OpenSSH 9.8 new daemon name - remove next release
(fetchpatch {
url = "https://github.com/fail2ban/fail2ban/commit/2fed408c05ac5206b490368d94599869bd6a056d.patch";
hash = "sha256-uyrCdcBm0QyA97IpHzuGfiQbSSvhGH6YaQluG5jVIiI=";
})
# filter.d/sshd.conf: ungroup (unneeded for _daemon) - remove next release
(fetchpatch {
url = "https://github.com/fail2ban/fail2ban/commit/50ff131a0fd8f54fdeb14b48353f842ee8ae8c1a.patch";
hash = "sha256-YGsUPfQRRDVqhBl7LogEfY0JqpLNkwPjihWIjfGdtnQ=";
})
];
preInstall = ''
substituteInPlace setup.py --replace /usr/share/doc/ share/doc/
@@ -84,11 +69,9 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
sitePackages = "$out/${python3.sitePackages}";
in
''
install -m 644 -D -t "$out/lib/systemd/system" build/fail2ban.service
install -m 644 -D -t "$out/lib/systemd/system" build/fail2ban.service build/fail2ban.socket
# Replace binary paths
sed -i "s#build/bdist.*/wheel/fail2ban.*/scripts/#$out/bin/#g" $out/lib/systemd/system/fail2ban.service
# Delete creating the runtime directory, systemd does that
sed -i "/ExecStartPre/d" $out/lib/systemd/system/fail2ban.service
# see https://github.com/NixOS/nixpkgs/issues/4968
rm -r "${sitePackages}/etc"

4
pkgs/by-name/gh/gh-ost/package.nix
View File

@@ -7,13 +7,13 @@
buildGoModule (finalAttrs: {
pname = "gh-ost";
version = "1.1.10";
version = "1.1.11";
src = fetchFromGitHub {
owner = "github";
repo = "gh-ost";
tag = "v${finalAttrs.version}";
hash = "sha256-1QdGPAvQgh533oAFwVxtGKPGJ7rfq7tG/zy8VUqJLq0=";
hash = "sha256-zmq2KqNjFb4htk5Wl0eA4Ef0bR16jto9YVFbVESehFI=";
};
vendorHash = null;

4
pkgs/by-name/gl/glaze/package.nix
View File

@@ -11,13 +11,13 @@
stdenv.mkDerivation (finalAttrs: {
pname = "glaze";
version = "8.0.0";
version = "8.1.0";
src = fetchFromGitHub {
owner = "stephenberry";
repo = "glaze";
tag = "v${finalAttrs.version}";
hash = "sha256-UQsR+b7FHGcC/nNpc7ffRurIyN3xM12PwN2UkrV1dRo=";
hash = "sha256-pPhXoPLpS4N1X3SVB6Ww+aCAo0vBA0ZD+2rhef8P+sA=";
};
nativeBuildInputs = [ cmake ];

8
pkgs/by-name/he/hevi/package.nix
View File

@@ -1,6 +1,6 @@
{
callPackage,
fetchFromGitHub,
fetchFromCodeberg,
lib,
stdenv,
zig_0_13,
@@ -13,8 +13,8 @@ stdenv.mkDerivation (finalAttrs: {
pname = "hevi";
version = "1.1.0";
src = fetchFromGitHub {
owner = "Arnau478";
src = fetchFromCodeberg {
owner = "arnauc";
repo = "hevi";
tag = "v${finalAttrs.version}";
hash = "sha256-wnpuM2qlbeDIupDPQPKdWmjAKepCG0+u3uxcLDFB09w=";
@@ -30,7 +30,7 @@ stdenv.mkDerivation (finalAttrs: {
meta = {
description = "Hex viewer";
homepage = "https://github.com/Arnau478/hevi";
homepage = "https://codeberg.org/arnauc/hevi";
license = lib.licenses.gpl3Only;
maintainers = [ lib.maintainers.jmbaur ];
mainProgram = "hevi";

8
pkgs/by-name/hy/hyprland/package.nix
View File

@@ -14,6 +14,7 @@
glslang,
hyprcursor,
hyprgraphics,
hyprland-protocols,
hyprland-qtutils,
hyprlang,
hyprutils,
@@ -38,6 +39,7 @@
readline,
systemd,
tomlplusplus,
udis86,
uwsm,
wayland,
wayland-protocols,
@@ -90,9 +92,8 @@ customStdenv.mkDerivation (finalAttrs: {
src = fetchFromGitHub {
owner = "hyprwm";
repo = "hyprland";
fetchSubmodules = true;
tag = "v${finalAttrs.version}";
hash = "sha256-jOcfiv+Zs2iz5oTIQcJXZ0+5MfqW0oLgGxD0cKdmXpE=";
hash = "sha256-IptZjFf/bE9lv8SQLef4Wmn3KOs3BwchYr6aFcCJ9NI=";
};
postPatch = ''
@@ -140,7 +141,6 @@ customStdenv.mkDerivation (finalAttrs: {
cmake
pkg-config
wayland-scanner
# for udis86
python3
];
@@ -158,6 +158,7 @@ customStdenv.mkDerivation (finalAttrs: {
glslang
hyprcursor.dev
hyprgraphics
hyprland-protocols
hyprlang
hyprutils
lcms2
@@ -176,6 +177,7 @@ customStdenv.mkDerivation (finalAttrs: {
re2
readline
tomlplusplus
udis86
wayland
wayland-protocols
]

6
pkgs/by-name/me/meilisearch/package.nix
View File

@@ -8,18 +8,18 @@
rustPlatform.buildRustPackage (finalAttrs: {
pname = "meilisearch";
version = "1.52.0";
version = "1.53.1";
src = fetchFromGitHub {
owner = "meilisearch";
repo = "meilisearch";
tag = "v${finalAttrs.version}";
hash = "sha256-KEDIfExREDrAVHkJe7DjTOy0KP0d89UGmcTqh5yQAC4=";
hash = "sha256-MQ3W8Y4ewJZA+ciBGKjGuV90ae4RaMJS+PIjCGGOV7A=";
};
cargoBuildFlags = [ "--package=meilisearch" ];
cargoHash = "sha256-S5nS99wvL2iVPSlHO1ThIDVIW1yDka3g2mm2ZAw4LZs=";
cargoHash = "sha256-Rovn1xw3Bg7J+FeIMHQP2BW5IpDyCORud8VXIU8UpqI=";
# Default features include mini dashboard which downloads something from the internet.
buildNoDefaultFeatures = true;

9
pkgs/by-name/mi/mise/package.nix
View File

@@ -22,16 +22,16 @@
rustPlatform.buildRustPackage (finalAttrs: {
pname = "mise";
version = "2026.8.3";
version = "2026.8.6";
src = fetchFromGitHub {
owner = "jdx";
repo = "mise";
tag = "v${finalAttrs.version}";
hash = "sha256-tYn54Loo3sSEgRhgu1g5m/t5qL+EKQnvrnfHCuDDbyY=";
hash = "sha256-dm+cIb6i+npYSIUfxaEi3ohumeT9lXXlQwYREndwZFE=";
};
cargoHash = "sha256-fzZswzDMIKMx7R53Jxc9m/7I8Bcd2fdPJKmHsjWFqhw=";
cargoHash = "sha256-VzRNo2fa4n4oOw27itjFebKpIhSdm8UmI/xdBBJIh9g=";
nativeBuildInputs = [
installShellFiles
@@ -83,7 +83,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
++ lib.optionals (stdenv.hostPlatform.isDarwin) [
# shell out to macOS system binaries that the darwin sandbox refuses to exec
"--skip=system::defaults::tests::test_status_missing_keys_are_unset"
"--skip=system::packages::brew::cask::tests::upgrades_app_with_protected_existing_contents"
# we don't care about brew tests and a lot of them fails here
"--skip=system::packages::brew::cask::tests::"
];
cargoTestFlags = [ "--all-features" ];

8
pkgs/by-name/ol/olympus-unwrapped/package.nix
View File

@@ -22,9 +22,9 @@ let
phome = "$out/lib/olympus";
# The following variables are to be updated by the update script.
version = "26.08.04.01";
buildId = "5755"; # IMPORTANT: This line is matched with regex in update.sh.
rev = "f70fb434a072b34f25d2adc83da76a1e36748242";
version = "26.07.27.01";
buildId = "5729"; # IMPORTANT: This line is matched with regex in update.sh.
rev = "27b8912f014cebb985a9216efef82f1cfe0eb016";
in
buildDotnetModule {
pname = "olympus-unwrapped";
@@ -37,7 +37,7 @@ buildDotnetModule {
owner = "EverestAPI";
repo = "Olympus";
fetchSubmodules = true; # Required. See upstream's README.
hash = "sha256-/cnzAcmRB7wVylLlddgO2lgB9J9hR81zLIYDiiXieak=";
hash = "sha256-XLP0OOI+qb10pZ135BBVw9MI4s7fFIEmXJVgKbxW6oA=";
};
nativeBuildInputs = [

14
pkgs/by-name/pa/pay-respects/package.nix
View File

@@ -3,6 +3,8 @@
fetchFromCodeberg,
rustPlatform,
versionCheckHook,
withRuntimeRules ? true,
withRequestAi ? true,
}:
rustPlatform.buildRustPackage (finalAttrs: {
pname = "pay-respects";
@@ -25,14 +27,14 @@ rustPlatform.buildRustPackage (finalAttrs: {
cargoBuildFlags = [
"-p pay-respects"
"-p pay-respects-module-runtime-rules"
"-p pay-respects-module-request-ai"
];
]
++ lib.optional withRuntimeRules "-p pay-respects-module-runtime-rules"
++ lib.optional withRequestAi "-p pay-respects-module-request-ai";
cargoTestFlags = [
"-p pay-respects"
"-p pay-respects-module-runtime-rules"
"-p pay-respects-module-request-ai"
];
]
++ lib.optional withRuntimeRules "-p pay-respects-module-runtime-rules"
++ lib.optional withRequestAi "-p pay-respects-module-request-ai";
nativeInstallCheckInputs = [ versionCheckHook ];
doInstallCheck = true;

4
pkgs/by-name/pl/plasmusic-toolbar/package.nix
View File

@@ -7,13 +7,13 @@
}:
stdenvNoCC.mkDerivation (finalAttrs: {
pname = "plasmusic-toolbar";
version = "4.2.0";
version = "4.3.1";
src = fetchFromGitHub {
owner = "ccatterina";
repo = "plasmusic-toolbar";
tag = "v${finalAttrs.version}";
hash = "sha256-OBRjHsFwwUOkx1tOgr9ZFT8EJ7wf6yz6Hv/RXlX8T0Q=";
hash = "sha256-rb8jK52sFE4HFZOgvzFnavEzuqc1LtIdx9AWhUhuhJk=";
};
installPhase = ''

6
pkgs/by-name/ra/radicle-explorer/package.nix
View File

@@ -23,13 +23,13 @@ in
buildNpmPackage (finalAttrs: {
pname = "radicle-explorer";
version = "0-unstable-2026-07-29";
version = "0-unstable-2026-08-12";
src = fetchFromRadicle {
seed = "seed.radicle.dev";
repo = "z4V1sjrXqjvFdnCUbxPFqd5p4DtH5";
rev = "427cece9850944d30f0d49ccd016f98dacd77d75";
hash = "sha256-FC78GCaC8IcBtXDRotYcaw040cggGWnrI2lgnWLwU68=";
rev = "ab514fe0d477c7cf7e0d5f24b63e302e755f98cf";
hash = "sha256-PGnOVKj1R5fWGeDJJJW0U0qdTBV5SHoY/VLtzFPg/Tw=";
};
npmDepsHash = "sha256-L/JOhI7KVXNDGHzk8RVNNcd8hHL+I7YKVg8sZyRSBtA=";

19
pkgs/by-name/ud/udis86/package.nix
View File

@@ -2,30 +2,21 @@
lib,
stdenv,
fetchFromGitHub,
fetchpatch,
autoreconfHook,
python3,
}:
stdenv.mkDerivation {
pname = "udis86";
version = "unstable-2014-12-25";
version = "1.7.2-unstable-2022-10-13";
src = fetchFromGitHub {
owner = "vmt";
owner = "canihavesomecoffee";
repo = "udis86";
rev = "56ff6c87c11de0ffa725b14339004820556e343d";
hash = "sha256-bmm1rgzZeStQJXEmcT8vnplsnmgN3LJlYs7COmqsDU8=";
rev = "5336633af70f3917760a6d441ff02d93477b0c86";
hash = "sha256-HifdUQPGsKQKQprByeIznvRLONdOXeolOsU5nkwIv3g=";
};
patches = [
(fetchpatch {
name = "support-python3-for-building";
url = "https://github.com/vmt/udis86/commit/3c05ce60372cb2eba39d6eb87ac05af8a664e1b1.patch";
hash = "sha256-uF4Cwt7UMkyd0RX6cCMQt9xvkkUNQvTDH/Z/6nHtVT8=";
})
];
nativeBuildInputs = [
autoreconfHook
python3
@@ -43,7 +34,7 @@ stdenv.mkDerivation {
];
meta = {
homepage = "https://udis86.sourceforge.net";
homepage = "https://github.com/canihavesomecoffee/udis86";
license = lib.licenses.bsd2;
maintainers = with lib.maintainers; [ timor ];
mainProgram = "udcli";

86
pkgs/by-name/v2/v2rayn/deps.json generated
View File

@@ -9,6 +9,11 @@
"version": "12.1.0",
"hash": "sha256-G824thlSx6grixZdFX0yonwGXQYequFLwFAyhEyuPzk="
},
{
"pname": "Avalonia",
"version": "12.1.1",
"hash": "sha256-GTv2rouQKTrLcryoodYujka0YKSFJ/Xx8Y9ikHPZ130="
},
{
"pname": "Avalonia.Angle.Windows.Natives",
"version": "2.1.27548.20260419",
@@ -26,33 +31,33 @@
},
{
"pname": "Avalonia.Controls.DataGrid",
"version": "12.1.0",
"hash": "sha256-ivrjda3meZJMpoCglss5cYXxeldsR8li76tILwNQO/g="
"version": "12.1.2",
"hash": "sha256-EKv+UnSScgONwbIY9NLTRHyGlK9QTCvXIT/bFP+13Go="
},
{
"pname": "Avalonia.Desktop",
"version": "12.1.0",
"hash": "sha256-bKqjBBIqTmFJ6qX4HHzHUM0B8qWOL6bQWX+FSkDEHI0="
"version": "12.1.1",
"hash": "sha256-b7yunwfT7+hBPzW3hh+PX6s8sYpVfIpum7QxPiUNQAA="
},
{
"pname": "Avalonia.FreeDesktop",
"version": "12.1.0",
"hash": "sha256-ba4NDAxe4kp8TooGwws1HekMdF9MBezHbsYZb2Agjt4="
"version": "12.1.1",
"hash": "sha256-w61F1fA/RZdT25xtJWRes2SEYS1ixc797cUOfRu4tmM="
},
{
"pname": "Avalonia.FreeDesktop.AtSpi",
"version": "12.1.0",
"hash": "sha256-3CVUOuKLXjTvcEYozutyX/gLmjM5TsE69pSKM1CBaqE="
"version": "12.1.1",
"hash": "sha256-c+B2eV5v/gZgBZqj4Z1QeJbHgyPJEenyFCutiQBUwRU="
},
{
"pname": "Avalonia.HarfBuzz",
"version": "12.1.0",
"hash": "sha256-0uxtp+KmAFQz78Szvxa4hwo/vLNSkdgvcCynpaSeCjQ="
"version": "12.1.1",
"hash": "sha256-7lChqcimsELWLlx3J1VhHJq3V0AoZ5iSHstZrT7ItBA="
},
{
"pname": "Avalonia.Native",
"version": "12.1.0",
"hash": "sha256-fshmU1Px5n8nRGmKKevLi0zPgyZJSNF3N0bqdiYQFPg="
"version": "12.1.1",
"hash": "sha256-1VfWF3vFifgBiuM1LV6v6s6Dbh0uUQ+CHL3PxmtWlVI="
},
{
"pname": "Avalonia.Remote.Protocol",
@@ -64,20 +69,25 @@
"version": "12.1.0",
"hash": "sha256-PXrrCyFLIdrcEnNUz2ZzjFjs65hVaxEm5h/ux8tOo0k="
},
{
"pname": "Avalonia.Remote.Protocol",
"version": "12.1.1",
"hash": "sha256-Ewx9x7XsVrmv3Z2TkqVzTASxloSijLftrkYB9YK5MBE="
},
{
"pname": "Avalonia.Skia",
"version": "12.1.0",
"hash": "sha256-6f/isIqnWUCEeWlfooN32tkbi78DKdBBuTka70br9U4="
"version": "12.1.1",
"hash": "sha256-9oPb5fXc395iy4vuDMdeO5vsldn5JHlso2J72ov6TyU="
},
{
"pname": "Avalonia.Win32",
"version": "12.1.0",
"hash": "sha256-eU0pezq/1PLB/iDGDt9NWn183uSr29P3Nr58vYsQztM="
"version": "12.1.1",
"hash": "sha256-4jzrk/5p3/WF6/ZyaI07TL4O4HM8NnjaHk71H7H6GUw="
},
{
"pname": "Avalonia.X11",
"version": "12.1.0",
"hash": "sha256-n2QWzUw5UsDtMEHI/MSkbPFucdStdz/1gLDqVR5zW/A="
"version": "12.1.1",
"hash": "sha256-/D2+LG3fiOeKprFV82EMzNoKfxSXfh3pDvb+MzNl4Kg="
},
{
"pname": "AvaloniaUI.DiagnosticsSupport",
@@ -86,8 +96,8 @@
},
{
"pname": "CliWrap",
"version": "3.10.2",
"hash": "sha256-PtRWN6tfZ/uT6o1JrLDj624feJgD5iDS4ywsYwEhQ6c="
"version": "3.10.4",
"hash": "sha256-Imb2SFLSr0QZgM0A1jhtAhqdXU1tAEUd0xkdCMR/gYw="
},
{
"pname": "DialogHost.Avalonia",
@@ -131,8 +141,8 @@
},
{
"pname": "Irihi.Avalonia.Shared",
"version": "0.4.0",
"hash": "sha256-flrIM8LVUYr+3IAL1aRv+F266bBaTDs+M8ra3YG9JTE="
"version": "0.5.0",
"hash": "sha256-9vM4MP0mfoQycEfB5EtXNiubMJtQadHkxqrkP4R6ALE="
},
{
"pname": "MicroCom.Runtime",
@@ -186,18 +196,18 @@
},
{
"pname": "ReactiveUI",
"version": "24.0.0",
"hash": "sha256-p2sBS7NEnM5P3zw/kqqPBZAYhxsEqBhfc79gRw6U+1M="
"version": "24.1.0",
"hash": "sha256-RViUnny6anqsSKiB4bT3O9DCryK6QElDd0fySu1tULQ="
},
{
"pname": "ReactiveUI.Avalonia",
"version": "12.1.0",
"hash": "sha256-tJQ/mggb8Krt7GV7s/Vm2mwdKO5MyCLemmX9oJwmloc="
"version": "12.1.1",
"hash": "sha256-+R+16JubbzVgEYF8X/FXsmU9gbi5N9359GiAEb+d9WU="
},
{
"pname": "ReactiveUI.Core",
"version": "24.0.0",
"hash": "sha256-Dvt6jANQJDlKli7nVNZ3Xnqk/JiUc5Sqv3Ej8CCscRY="
"version": "24.1.0",
"hash": "sha256-YLsqJ1eIGszO6VDDKLydXXeU94aOU0o/QUBrnt+icPk="
},
{
"pname": "ReactiveUI.Disposables",
@@ -226,23 +236,23 @@
},
{
"pname": "ReactiveUI.SourceGenerators",
"version": "3.1.0",
"hash": "sha256-qf/pRuvyYcJ1uHfWqRJlc5rwEnaGY2vPNAp3AdCa/XA="
"version": "3.2.0",
"hash": "sha256-QHjOjNSxZG+16xcie7uO4Uf+9QJlYdaecEx1oQOrtH0="
},
{
"pname": "ReactiveUI.SourceGenerators.Analyzers.CodeFixes",
"version": "3.1.0",
"hash": "sha256-qwKrOsQpnMP9Ggkq6WWFfYTjaKL5LJVJc81dUX2AVb4="
"version": "3.2.0",
"hash": "sha256-9JNs03x9xCchfY44XZYBW9EFHno3d4FVpXexpnf5P1w="
},
{
"pname": "Repobot.SQLite.Unofficial",
"version": "3.53.3.10",
"hash": "sha256-oliqMA1sdGPcmm9R2DYZzjtkMC8AamkPFu53wx2Sx6g="
"version": "3.53.4.1",
"hash": "sha256-uwdbTPGJm77zskpRYhB70FiKvOeQbcO4gD9G7Np9iUg="
},
{
"pname": "Semi.Avalonia",
"version": "12.1.0",
"hash": "sha256-rSCXZF7JQBmzY7bRo3a0AdjzrtJVVl6kw+pSI76uIjg="
"version": "12.1.0.1",
"hash": "sha256-EhraFSkS4tPoVSz1BE/Jhb/IJtQvJcdqED8emsrI9YY="
},
{
"pname": "Semi.Avalonia.AvaloniaEdit",
@@ -251,8 +261,8 @@
},
{
"pname": "Semi.Avalonia.DataGrid",
"version": "12.1.0",
"hash": "sha256-YsqH7gD4nK0WOjspUwp7hC6CLXZg9X8IH5BiN4/ZKQQ="
"version": "12.1.0.1",
"hash": "sha256-N/M6G15SwRiHwnYpUs7J971SF/AS8+i3087NZOHySpY="
},
{
"pname": "SkiaSharp",

4
pkgs/by-name/v2/v2rayn/package.nix
View File

@@ -26,13 +26,13 @@
buildDotnetModule (finalAttrs: {
pname = "v2rayn";
version = "7.24.5";
version = "7.24.6";
src = fetchFromGitHub {
owner = "2dust";
repo = "v2rayN";
tag = finalAttrs.version;
hash = "sha256-BFhmvfwb0CuiBlbpJ/+NMVB+XdOybGJQCW4h5hjRv9k=";
hash = "sha256-42upbLVLO79/HzDKijP2K6zvCBCURmyL8tj00dgVvys=";
fetchSubmodules = true;
};

6
pkgs/by-name/ya/yazi/plugins/vcs-files/default.nix
View File

@@ -5,13 +5,13 @@
}:
mkYaziPlugin {
pname = "vcs-files.yazi";
version = "0-unstable-2026-07-26";
version = "0-unstable-2026-08-17";
src = fetchFromGitHub {
owner = "yazi-rs";
repo = "plugins";
rev = "4c63ed34bae678b0dfaae44c33bf3fbb5fdda5a6";
hash = "sha256-XakVwNsH/OUCHftW8kTL/VNmVnY/S9xjpMXI79GXZPA=";
rev = "3d25b6705fb1fb7967dfe393cf1b4a2926ebc40b";
hash = "sha256-vEm2AO1tEHnsX93LlxBytjFFNnwpnoZd86WiVQf67BU=";
};
meta = {

6
pkgs/by-name/ze/zennotes-desktop/package.nix
View File

@@ -13,14 +13,14 @@
buildNpmPackage (finalAttrs: {
pname = "zennotes-desktop";
version = "2.28.2";
npmDepsHash = "sha256-t0+Z6kDPRa5wCxkmQfzzXS0Y22s9w8vNXYaxrYlf3+Y=";
version = "2.29.0";
npmDepsHash = "sha256-Hml6oEZxNY6jK+dEDeA6KxfWa7k3/iqkUtlGRwHkO7U=";
src = fetchFromGitHub {
owner = "ZenNotes";
repo = "zennotes";
tag = "v${finalAttrs.version}";
hash = "sha256-kSjCuKYbUaKtCqSTelJ02yO7FMgeTnChItNK1oaAIxc=";
hash = "sha256-naLrqLe5ED5c9OWBAlyP+1ar8wrcAxCEVaAsRDnQpgs=";
};
npmWorkspace = "apps/desktop";

4
pkgs/development/ocaml-modules/pacomb/default.nix
View File

@@ -8,12 +8,12 @@
buildDunePackage (finalAttrs: {
pname = "pacomb";
version = "1.4.3";
version = "1.4.4";
src = fetchFromGitHub {
owner = "craff";
repo = "pacomb";
tag = finalAttrs.version;
hash = "sha256-iS5H/xnMqZjSvrvj5YkBP8j/ChIn/xbQ9xa7WipBUvQ=";
hash = "sha256-wd/81NXXrKLq+SQI2E1ddcIld5tCCdSA9EYfdv8pkE0=";
};
buildInputs = [
ppxlib

4
pkgs/development/python-modules/ale-py/default.nix
View File

@@ -32,7 +32,7 @@
buildPythonPackage (finalAttrs: {
pname = "ale-py";
version = "0.12.0";
version = "0.12.1";
pyproject = true;
__structuredAttrs = true;
@@ -40,7 +40,7 @@ buildPythonPackage (finalAttrs: {
owner = "Farama-Foundation";
repo = "Arcade-Learning-Environment";
tag = "v${finalAttrs.version}";
hash = "sha256-hFbreHk0i4h+JOyvDYcNX3TmwgvxNC5U0l5Xrqqz1zQ=";
hash = "sha256-1oIF45+GZFWuRzXR5Hqh60yc1DZYAlXpsGgf3WiouQE=";
};
# disable lto on darwin, cmake cannot find llvm-ar

4
pkgs/development/python-modules/vllm/default.nix
View File

@@ -703,10 +703,14 @@ buildPythonPackage.override { stdenv = torch.stdenv; } (finalAttrs: {
LunNova # esp. for ROCm
];
badPlatforms = [
# error: could not find git for clone of arm_compute-populate
"aarch64-linux"
# CMake Error at cmake/cpu_extension.cmake:188 (message):
# vLLM CPU backend requires AVX512, AVX2, Power9+ ISA, S390X ISA, ARMv8 or
# RISC-V support.
"aarch64-darwin"
];
broken = cudaSupport;
};
})

24
pkgs/misc/optee-os/default.nix
View File

@@ -55,6 +55,7 @@ let
];
strictDeps = true;
__structuredAttrs = true;
enableParallelBuilding = true;
@@ -112,7 +113,10 @@ let
homepage = "https://github.com/OP-TEE/optee_os";
changelog = "https://github.com/OP-TEE/optee_os/blob/${defaultVersion}/CHANGELOG.md";
license = lib.licenses.bsd2;
maintainers = [ lib.maintainers.jmbaur ];
maintainers = [
lib.maintainers.jmbaur
lib.maintainers.tomfitzhenry
];
}
// extraMeta;
}
@@ -134,4 +138,22 @@ in
extraMakeFlags = [ "PLATFORM_FLAVOR=qemu_armv8a" ];
extraMeta.platforms = [ "aarch64-linux" ];
};
opteeAllwinnerA64 = buildOptee {
platform = "sunxi";
extraMakeFlags = [ "PLATFORM_FLAVOR=sun50i_a64" ];
extraMeta.platforms = [ "aarch64-linux" ];
};
opteeRockchipRK3399 = buildOptee {
platform = "rockchip";
extraMakeFlags = [ "PLATFORM_FLAVOR=rk3399" ];
extraMeta.platforms = [ "aarch64-linux" ];
};
opteeRockchipRK3588 = buildOptee {
platform = "rockchip";
extraMakeFlags = [ "PLATFORM_FLAVOR=rk3588" ];
extraMeta.platforms = [ "aarch64-linux" ];
};
}

9
pkgs/top-level/all-packages.nix
View File

@@ -5181,8 +5181,11 @@ with pkgs;
inherit (callPackage ../misc/optee-os { })
buildOptee
opteeQemuArm
opteeAllwinnerA64
opteeQemuAarch64
opteeQemuArm
opteeRockchipRK3399
opteeRockchipRK3588
;
patchelf = callPackage ../development/tools/misc/patchelf { };
@@ -8584,7 +8587,7 @@ with pkgs;
buildMozillaMach
;
};
firefox-esr-unwrapped = firefox-esr-140-unwrapped;
firefox-esr-unwrapped = firefox-esr-153-unwrapped;
firefox = wrapFirefox firefox-unwrapped { };
firefox-beta = wrapFirefox firefox-beta-unwrapped { };
@@ -8602,7 +8605,7 @@ with pkgs;
wmClass = "firefox-esr";
icon = "firefox-esr";
};
firefox-esr = firefox-esr-140;
firefox-esr = firefox-esr-153;
firefox-bin-unwrapped = callPackage ../applications/networking/browsers/firefox-bin {
inherit (firefox-unwrapped.passthru) applicationName;