diff --git a/nixos/modules/services/misc/gitlab.nix b/nixos/modules/services/misc/gitlab.nix index 0b8bd08a22bc..ee59cea38dfd 100644 --- a/nixos/modules/services/misc/gitlab.nix +++ b/nixos/modules/services/misc/gitlab.nix @@ -1063,7 +1063,7 @@ in { chown ${cfg.user}:${cfg.group} ${cfg.registry.certFile} ''; - serviceConfig = { + unitConfig = { ConditionPathExists = "!${cfg.registry.certFile}"; }; }; diff --git a/nixos/modules/services/monitoring/prometheus/exporters/postfix.nix b/nixos/modules/services/monitoring/prometheus/exporters/postfix.nix index 4d3c1fa267e5..53509b7a385b 100644 --- a/nixos/modules/services/monitoring/prometheus/exporters/postfix.nix +++ b/nixos/modules/services/monitoring/prometheus/exporters/postfix.nix @@ -74,11 +74,13 @@ in }; }; serviceOpts = { + after = mkIf cfg.systemd.enable [ cfg.systemd.unit ]; serviceConfig = { DynamicUser = false; # By default, each prometheus exporter only gets AF_INET & AF_INET6, # but AF_UNIX is needed to read from the `showq`-socket. RestrictAddressFamilies = [ "AF_UNIX" ]; + SupplementaryGroups = mkIf cfg.systemd.enable [ "systemd-journal" ]; ExecStart = '' ${pkgs.prometheus-postfix-exporter}/bin/postfix_exporter \ --web.listen-address ${cfg.listenAddress}:${toString cfg.port} \ diff --git a/pkgs/applications/misc/sigi/default.nix b/pkgs/applications/misc/sigi/default.nix index 827c1b71ff2d..28aaf9dd72c8 100644 --- a/pkgs/applications/misc/sigi/default.nix +++ b/pkgs/applications/misc/sigi/default.nix @@ -2,14 +2,14 @@ rustPlatform.buildRustPackage rec { pname = "sigi"; - version = "3.4.0"; + version = "3.4.2"; src = fetchCrate { inherit pname version; - sha256 = "sha256-wqdgrFeB3YuMo/r4ndqRZCz+M1WuUvX2pHHkyNMdnvo="; + sha256 = "sha256-YlTawz09i7k5QxaybKSo4IhECs6UdDSNV+ylIJgKPt4="; }; - cargoSha256 = "sha256-103zhlskzhEj6oUam7YDRWiSPTaV2PPJhzP7QeMBtDQ="; + cargoSha256 = "sha256-L4eIGxQTM+sZWXWZDGtSwsCT54CWLbyPQ9b+Jf6s94U="; nativeBuildInputs = [ installShellFiles ]; # In case anything goes wrong. diff --git a/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix b/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix index 30c9d8435786..53b3e03422d7 100644 --- a/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix +++ b/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix @@ -87,7 +87,7 @@ let fteLibPath = makeLibraryPath [ stdenv.cc.cc gmp ]; # Upstream source - version = "11.0.14"; + version = "11.0.15"; lang = "en-US"; @@ -98,7 +98,7 @@ let "https://tor.eff.org/dist/torbrowser/${version}/tor-browser-linux64-${version}_${lang}.tar.xz" "https://tor.calyxinstitute.org/dist/torbrowser/${version}/tor-browser-linux64-${version}_${lang}.tar.xz" ]; - sha256 = "19lsxdxbdismjrv2kmvm10cmr1x5klc2khlmrybycdw2vx7r41mn"; + sha256 = "1gv44bi3gfg5z46fvs9wy46fgvfshad5kbxl43x3x4r70ps1nc3l"; }; i686-linux = fetchurl { @@ -107,7 +107,7 @@ let "https://tor.eff.org/dist/torbrowser/${version}/tor-browser-linux32-${version}_${lang}.tar.xz" "https://tor.calyxinstitute.org/dist/torbrowser/${version}/tor-browser-linux32-${version}_${lang}.tar.xz" ]; - sha256 = "0hkj4vn5jk3z32mdgzzwmhj5xa4mv5p1nnwqhlsbc3g5b5q8bc7q"; + sha256 = "109291wwcy63k8hs23kx8vffpj4zvywdpy8srwaq367l0ffvfqn2"; }; }; in diff --git a/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix b/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix index cf30841ac9e7..899bb9731590 100644 --- a/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix +++ b/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix @@ -5,26 +5,11 @@ , cups, expat, libuuid, at-spi2-core, libappindicator-gtk3, mesa # Runtime dependencies: , systemd, libnotify, libdbusmenu, libpulseaudio, xdg-utils -# Unfortunately this also overwrites the UI language (not just the spell -# checking language!): -, hunspellDicts, spellcheckerLanguage ? null # E.g. "de_DE" -# For a full list of available languages: -# $ cat pkgs/development/libraries/hunspell/dictionaries.nix | grep "dictFileName =" | awk '{ print $3 }' }: -let - customLanguageWrapperArgs = (with lib; - let - # E.g. "de_DE" -> "de-de" (spellcheckerLanguage -> hunspellDict) - spellLangComponents = splitString "_" spellcheckerLanguage; - hunspellDict = elemAt spellLangComponents 0 + "-" + toLower (elemAt spellLangComponents 1); - in lib.optionalString (spellcheckerLanguage != null) '' - --set HUNSPELL_DICTIONARIES "${hunspellDicts.${hunspellDict}}/share/hunspell" \ - --set LC_MESSAGES "${spellcheckerLanguage}"''); - -in stdenv.mkDerivation rec { +stdenv.mkDerivation rec { pname = "signal-desktop"; - version = "5.47.0"; # Please backport all updates to the stable channel. + version = "5.48.0"; # Please backport all updates to the stable channel. # All releases have a limited lifetime and "expire" 90 days after the release. # When releases "expire" the application becomes unusable until an update is # applied. The expiration date for the current release can be extracted with: @@ -34,7 +19,7 @@ in stdenv.mkDerivation rec { src = fetchurl { url = "https://updates.signal.org/desktop/apt/pool/main/s/signal-desktop/signal-desktop_${version}_amd64.deb"; - sha256 = "sha256-aQpylo4/pbHP2an1w6DEhRmU3uvntN/tnYhvaWtNGGg="; + sha256 = "sha256-SJ3wO3lDEDyKuNuT8sadLfd3AcxB+DR2J5yKlkBUv24="; }; nativeBuildInputs = [ @@ -123,7 +108,6 @@ in stdenv.mkDerivation rec { preFixup = '' gappsWrapperArgs+=( --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ stdenv.cc.cc ] }" - ${customLanguageWrapperArgs} --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--enable-features=UseOzonePlatform --ozone-platform=wayland}}" --suffix PATH : ${lib.makeBinPath [ xdg-utils ]} ) diff --git a/pkgs/desktops/gnome/core/gnome-remote-desktop/default.nix b/pkgs/desktops/gnome/core/gnome-remote-desktop/default.nix index 111aa6bfefa5..a72012ca57fd 100644 --- a/pkgs/desktops/gnome/core/gnome-remote-desktop/default.nix +++ b/pkgs/desktops/gnome/core/gnome-remote-desktop/default.nix @@ -28,11 +28,11 @@ stdenv.mkDerivation rec { pname = "gnome-remote-desktop"; - version = "42.2"; + version = "42.3"; src = fetchurl { url = "mirror://gnome/sources/${pname}/${lib.versions.major version}/${pname}-${version}.tar.xz"; - hash = "sha256-wcy82MpwN+9ttz9r8rXdOKM2t9gKKpyY32/4g4eP+dU="; + hash = "sha256-opatWPizvawOLg2H2xKpOV5ydwqWDnh/vMG+PwBotkI="; }; nativeBuildInputs = [ diff --git a/pkgs/servers/atlassian/jira.nix b/pkgs/servers/atlassian/jira.nix index e9d38a41c029..6434a756bcd8 100644 --- a/pkgs/servers/atlassian/jira.nix +++ b/pkgs/servers/atlassian/jira.nix @@ -8,11 +8,11 @@ stdenv.mkDerivation rec { pname = "atlassian-jira"; - version = "8.22.2"; + version = "8.22.4"; src = fetchurl { url = "https://product-downloads.atlassian.com/software/jira/downloads/atlassian-jira-software-${version}.tar.gz"; - sha256 = "sha256-j9JUIK4GOdY9rMLPZcWbjWUh/s2ZkoVEQBNAIqHhdYI="; + sha256 = "sha256-Zog0m8tsx8mDLU1rsW5zhhHgyRmi4JGWuy9DV8yp9nY="; }; buildPhase = '' diff --git a/pkgs/tools/security/kdigger/default.nix b/pkgs/tools/security/kdigger/default.nix index 5067d4003274..b552499b10ec 100644 --- a/pkgs/tools/security/kdigger/default.nix +++ b/pkgs/tools/security/kdigger/default.nix @@ -3,18 +3,17 @@ , buildGoModule , fetchFromGitHub , installShellFiles -, fetchpatch }: buildGoModule rec { pname = "kdigger"; - version = "1.2.0"; + version = "1.2.1"; src = fetchFromGitHub { owner = "quarkslab"; repo = pname; rev = "v${version}"; - sha256 = "sha256-j4HIwfRIUpV25DmbQ+9go8aJMEYaFDPxrdr/zGWBeVU="; + sha256 = "sha256-xNOfxJJa0KbrxP1YRDEhnJEmKmpWzXchJWZ/2StR2O0="; # populate values that require us to use git. By doing this in postFetch we # can delete .git afterwards and maintain better reproducibility of the src. leaveDotGit = true; @@ -26,17 +25,11 @@ buildGoModule rec { }; vendorSha256 = "sha256-3vn3MsE/4lBw89wgYgzm0RuJJ5RQTkgS6O74PpfFcUk="; - patches = [ - (fetchpatch { - name = "simplify-ldflags.patch"; - url = "https://github.com/quarkslab/kdigger/pull/2.patch"; - sha256 = "sha256-d/NdoAdnheVgdqr2EF2rNn3gJvbjRZtOKFw2DqWR8TY="; - }) - ]; - nativeBuildInputs = [ installShellFiles ]; + # static to be easily copied into containers since it's an in-pod pen-testing tool CGO_ENABLED = 0; + ldflags = [ "-s" "-w" @@ -76,7 +69,6 @@ buildGoModule rec { ''; license = licenses.asl20; maintainers = with maintainers; [ jk ]; - # aarch64-linux support progress - https://github.com/quarkslab/kdigger/issues/3 - platforms = [ "x86_64-linux" ]; + platforms = [ "x86_64-linux" "aarch64-linux" "x86_64-darwin" ]; }; }