Merge release-23.05 into staging-next-23.05

nixos/modules/hardware/video/displaylink.nix

@@ -26,6 +26,7 @@ in
         Identifier  "DisplayLink"
         MatchDriver "evdi"
         Driver      "modesetting"
+        Option      "TearFree" "true"
         Option      "AccelMethod" "none"
       EndSection
     '';

nixos/modules/services/misc/paperless.nix

@@ -86,8 +86,7 @@ let
     SupplementaryGroups = optional enableRedis redisServer.user;
     SystemCallArchitectures = "native";
     SystemCallFilter = [ "@system-service" "~@privileged @setuid @keyring" ];
-    # Does not work well with the temporary root
-    #UMask = "0066";
+    UMask = "0066";
   };
 in
 {

nixos/modules/services/web-apps/pixelfed.nix

@@ -380,6 +380,12 @@ in {
       };
 
       script = ''
+        # Before running any PHP program, cleanup the code cache.
+        # It's necessary if you upgrade the application otherwise you might
+        # try to import non-existent modules.
+        rm -f ${cfg.runtimeDir}/app.php
+        rm -rf ${cfg.runtimeDir}/cache/*
+
         # Concatenate non-secret .env and secret .env
         rm -f ${cfg.dataDir}/.env
         cp --no-preserve=all ${configFile} ${cfg.dataDir}/.env
@@ -406,11 +412,6 @@ in {
         # Install Horizon
         # FIXME: require write access to public/ — should be done as part of install — pixelfed-manage horizon:publish
 
-        # Before running any PHP program, cleanup the bootstrap.
-        # It's necessary if you upgrade the application otherwise you might
-        # try to import non-existent modules.
-        rm -rf ${cfg.runtimeDir}/bootstrap/*
-
         # Perform the first migration.
         [[ ! -f ${cfg.dataDir}/.initial-migration ]] && pixelfed-manage migrate --force && touch ${cfg.dataDir}/.initial-migration
 

pkgs/development/libraries/libressl/default.nix

@@ -108,12 +108,12 @@ in {
   };
 
   libressl_3_6 = generic {
-    version = "3.6.2";
-    hash = "sha256-S+gP/wc3Rs9QtKjlur4nlayumMaxMqngJRm0Rd+/0DM=";
+    version = "3.6.3";
+    hash = "sha256-h7G7426e7I0K5fBMg9NrLFsOWBeEx+sIFwJe0p6t6jc=";
   };
 
   libressl_3_7 = generic {
-    version = "3.7.2";
-    hash = "sha256-sGqlOP78nGszxNtJMaCaX1LZ0jVyGa/L/32T/hLr9vc=";
+    version = "3.7.3";
+    hash = "sha256-eUjIVqkMglvXJotvhWdKjc0lS65C4iF4GyTj+NwzXbM=";
   };
 }

pkgs/development/libraries/sexp/default.nix

@@ -0,0 +1,48 @@
+{ lib
+, stdenv
+, bzip2
+, cmake
+, fetchFromGitHub
+, gtest
+, pkg-config
+, zlib
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "sexp";
+  version = "0.8.6";
+
+  src = fetchFromGitHub {
+    owner = "rnpgp";
+    repo = "sexp";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-NpDSoBxEM8g/SugLmT8E5+YZPDFIGHa4eXLjdzQxaiw=";
+  };
+
+  buildInputs = [ zlib bzip2 ];
+
+  cmakeFlags = [
+    "-DCMAKE_INSTALL_PREFIX=${placeholder "out"}"
+    "-DBUILD_SHARED_LIBS=on"
+    "-DWITH_SEXP_TESTS=on"
+    "-DDOWNLOAD_GTEST=off"
+    "-DWITH_SEXP_CLI=on"
+    "-DWITH_SANITIZERS=off"
+  ];
+
+  nativeBuildInputs = [ cmake gtest pkg-config ];
+
+  outputs = [ "out" "lib" "dev" ];
+
+  preConfigure = ''
+    echo "v${finalAttrs.version}" > version.txt
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/rnpgp/sexp";
+    description = "S-expressions parser and generator C++ library, fully compliant to [https://people.csail.mit.edu/rivest/Sexp.txt]";
+    license = licenses.mit;
+    platforms = platforms.all;
+    maintainers = with maintainers; [ ribose-jeffreylau ];
+  };
+})

pkgs/development/python-modules/pyprecice/default.nix

@@ -5,6 +5,7 @@
 , mpi4py
 , numpy
 , precice
+, pkgconfig
 , pythonOlder
 }:
 
@@ -24,6 +25,7 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     cython
+    pkgconfig
   ];
 
   propagatedBuildInputs = [

pkgs/development/tools/misc/strace/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "strace";
-  version = "6.3";
+  version = "6.4";
 
   src = fetchurl {
     url = "https://strace.io/files/${version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-4Xh44wFQbBzDAWERGK0U7+5/i872Oyes5dKQrM57tzE=";
+    sha256 = "sha256-J5h9usV/39JgxttNyDKN81yVxoZ8ij1DcdWc3PTrkjg=";
   };
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];

pkgs/os-specific/linux/displaylink/default.nix

@@ -20,22 +20,22 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "displaylink";
-  version = "5.6.1-59.184";
+  version = "5.7.0-61.129";
 
   src = requireFile rec {
-    name = "displaylink-561.zip";
-    sha256 = "1hihsz35ccydzx04r8r9kz0hvqwj5fgr8zpzvwyhfxp2m549f9w9";
+    name = "displaylink-570.zip";
+    sha256 = "807f1c203ac1e71c6f1f826493b9bb32e277f07cb2cf48537bf8cfdc68dd1515";
     message = ''
       In order to install the DisplayLink drivers, you must first
       comply with DisplayLink's EULA and download the binaries and
       sources from here:
 
-      https://www.synaptics.com/products/displaylink-graphics/downloads/ubuntu-5.6.1
+      https://www.synaptics.com/products/displaylink-graphics/downloads/ubuntu-5.7
 
       Once you have downloaded the file, please use the following
       commands and re-run the installation:
 
-      mv \$PWD/"DisplayLink USB Graphics Software for Ubuntu5.6.1-EXE.zip" \$PWD/${name}
+      mv \$PWD/"DisplayLink USB Graphics Software for Ubuntu5.7-EXE.zip" \$PWD/${name}
       nix-prefetch-url file://\$PWD/${name}
     '';
   };

pkgs/servers/web-apps/pixelfed/default.nix

@@ -28,17 +28,19 @@ let
   });
 in package.override rec {
   pname = "pixelfed";
-  version = "0.11.5";
+  version = "0.11.8";
 
-  # GitHub distribution does not include vendored files
   src = fetchFromGitHub {
     owner = "pixelfed";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-ZrvYKMSx5WymWR46/UKr5jCsclXXzBeY21ju22zeqN0=";
+    hash = "sha256-du+xwSrMqt4KIzQRUos6EmVBRp+39gHuoLSRsgLe1CQ=";
   };
 
-  passthru.tests = { inherit (nixosTests) pixelfed; };
+  passthru = {
+    tests = { inherit (nixosTests) pixelfed; };
+    updateScript = ./update.sh;
+  };
 
   meta = with lib; {
     description = "A federated image sharing platform";

pkgs/servers/web-apps/pixelfed/update.sh

@@ -0,0 +1,36 @@
+#!/usr/bin/env nix-shell
+#! nix-shell -I nixpkgs=../../../.. -i bash -p nix curl jq nix-update
+
+# check if composer2nix is installed
+if ! command -v composer2nix &> /dev/null; then
+  echo "Please install composer2nix (https://github.com/svanderburg/composer2nix) to run this script."
+  exit 1
+fi
+
+CURRENT_VERSION=$(nix eval -f ../../../.. --raw pixelfed.version)
+TARGET_VERSION_REMOTE=$(curl ${GITHUB_TOKEN:+" -u \":$GITHUB_TOKEN\""} https://api.github.com/repos/pixelfed/pixelfed/releases/latest | jq -r ".tag_name")
+TARGET_VERSION=${TARGET_VERSION_REMOTE:1}
+PIXELFED=https://github.com/pixelfed/pixelfed/raw/$TARGET_VERSION_REMOTE
+SHA256=$(nix-prefetch-url --unpack "https://github.com/pixelfed/pixelfed/archive/v$TARGET_VERSION/pixelfed.tar.gz")
+SRI_HASH=$(nix hash to-sri --type sha256 "$SHA256")
+
+if [[ "$CURRENT_VERSION" == "$TARGET_VERSION" ]]; then
+  echo "pixelfed is up-to-date: ${CURRENT_VERSION}"
+  exit 0
+fi
+
+curl -LO "$PIXELFED/composer.json"
+curl -LO "$PIXELFED/composer.lock"
+
+composer2nix --name "pixelfed" \
+  --composition=composition.nix \
+  --no-dev
+rm composer.json composer.lock
+
+# change version number
+sed -e "s/version =.*;/version = \"$TARGET_VERSION\";/g" \
+    -e "s/hash =.*;/hash = \"$SRI_HASH\";/g" \
+    -i ./default.nix
+
+cd ../../../..
+nix-build -A pixelfed

pkgs/tools/security/rnp/default.nix

@@ -10,21 +10,24 @@
 , json_c
 , pkg-config
 , python3
+, sexp
 , zlib
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "rnp";
-  version = "0.16.3";
+  version = "0.17.0";
 
   src = fetchFromGitHub {
     owner = "rnpgp";
     repo = "rnp";
-    rev = "v${version}";
-    sha256 = "sha256-kM3gBc5rbLJU7UXvWz4a9c+Ahi/d0z8R9S5t0B9Fts0=";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-4fB7Sl9+ATrJTRnhbNG5BoW3XLxR7IP167RK96+gxj0=";
   };
 
-  buildInputs = [ zlib bzip2 json_c botan2 ];
+  buildInputs = [ zlib bzip2 json_c botan2 sexp ];
+
+  patches = [ ./unbundle-sexp.patch ];
 
   cmakeFlags = [
     "-DCMAKE_INSTALL_PREFIX=${placeholder "out"}"
@@ -43,7 +46,7 @@ stdenv.mkDerivation rec {
   outputs = [ "out" "lib" "dev" ];
 
   preConfigure = ''
-    echo "v${version}" > version.txt
+    echo "v${finalAttrs.version}" > version.txt
   '';
 
   meta = with lib; {
@@ -53,4 +56,4 @@ stdenv.mkDerivation rec {
     platforms = platforms.all;
     maintainers = with maintainers; [ ribose-jeffreylau ];
   };
-}
+})

pkgs/tools/security/rnp/unbundle-sexp.patch

@@ -0,0 +1,38 @@
+diff --git i/CMakeLists.txt w/CMakeLists.txt
+index bb6d40cb..30171e7c 100644
+--- i/CMakeLists.txt
++++ w/CMakeLists.txt
+@@ -176,11 +176,6 @@ if (ENABLE_FUZZERS)
+ endif()
+ add_subdirectory(src/common)
+
+-set(WITH_SEXP_CLI OFF)
+-set(WITH_SEXP_TESTS OFF)
+-set(CMAKE_INSTALL_DEFAULT_COMPONENT_NAME development)
+-add_subdirectory(src/libsexp EXCLUDE_FROM_ALL)
+-
+ add_subdirectory(src/lib)
+ add_subdirectory(src/rnp)
+ add_subdirectory(src/rnpkeys)
+diff --git i/src/lib/CMakeLists.txt w/src/lib/CMakeLists.txt
+index 086ac57d..b219ef06 100755
+--- i/src/lib/CMakeLists.txt
++++ w/src/lib/CMakeLists.txt
+@@ -433,7 +433,7 @@ install(TARGETS librnp
+       COMPONENT development
+   )
+
+-  install(TARGETS librnp-static sexp
++  install(TARGETS librnp-static
+     EXPORT rnp-targets
+     ARCHIVE
+       DESTINATION  "${CMAKE_INSTALL_LIBDIR}"
+@@ -441,7 +441,7 @@ install(TARGETS librnp
+   )
+ else(BUILD_SHARED_LIBS)
+ # static libraries only
+-install(TARGETS librnp sexp
++install(TARGETS librnp
+     EXPORT rnp-targets
+     ARCHIVE
+       DESTINATION  "${CMAKE_INSTALL_LIBDIR}"

pkgs/top-level/all-packages.nix

@@ -12231,6 +12231,8 @@ with pkgs;
 
   sewer = callPackage ../tools/admin/sewer { };
 
+  sexp = callPackage ../development/libraries/sexp { };
+
   sfeed = callPackage ../tools/misc/sfeed { };
 
   sftpman = callPackage ../tools/filesystems/sftpman { };