nathan/nixpkgs
1
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2026-10-02 13:00:23 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge release-24.05 into staging-next-24.05

Browse Source
This commit is contained in:
github-actions[bot]
2024-09-01 00:18:41 +00:00
committed by GitHub
parent 629cb402d9 4927f77b7a
commit d1c5ae1112
16 changed files with 329 additions and 78 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
nixos/modules/installer/cd-dvd/iso-image.nix
View File

@@ -506,12 +506,7 @@ in
};
isoImage.squashfsCompression = mkOption {
default = with pkgs.stdenv.hostPlatform; "xz -Xdict-size 100% "
+ lib.optionalString isx86 "-Xbcj x86"
# Untested but should also reduce size for these platforms
+ lib.optionalString isAarch "-Xbcj arm"
+ lib.optionalString (isPower && is32bit && isBigEndian) "-Xbcj powerpc"
+ lib.optionalString (isSparc) "-Xbcj sparc";
default = "zstd -Xcompression-level 19";
type = lib.types.nullOr lib.types.str;
description = ''
Compression settings to use for the squashfs nix store.

1
nixos/modules/module-list.nix
View File

@@ -1457,6 +1457,7 @@
./services/web-servers/caddy/default.nix
./services/web-servers/darkhttpd.nix
./services/web-servers/fcgiwrap.nix
./services/web-servers/fcgiwrap-instances.nix
./services/web-servers/garage.nix
./services/web-servers/hitch/default.nix
./services/web-servers/hydron.nix

15
nixos/modules/services/misc/zoneminder.nix
View File

@@ -202,10 +202,11 @@ in {
];
services = {
fcgiwrap = lib.mkIf useNginx {
enable = true;
preforkProcesses = cfg.cameras;
inherit user group;
fcgiwrap.instances.zoneminder = lib.mkIf useNginx {
process.prefork = cfg.cameras;
process.user = user;
process.group = group;
socket = { inherit (config.services.nginx) user group; };
};
mysql = lib.mkIf cfg.database.createLocally {
@@ -225,9 +226,7 @@ in {
default = true;
root = "${pkg}/share/zoneminder/www";
listen = [ { addr = "0.0.0.0"; inherit (cfg) port; } ];
extraConfig = let
fcgi = config.services.fcgiwrap;
in ''
extraConfig = ''
index index.php;
location / {
@@ -257,7 +256,7 @@ in {
fastcgi_param HTTP_PROXY "";
fastcgi_intercept_errors on;
fastcgi_pass ${fcgi.socketType}:${fcgi.socketAddress};
fastcgi_pass unix:${config.services.fcgiwrap.instances.zoneminder.socket.address};
}
location /cache/ {

103
nixos/modules/services/networking/cgit.nix
View File

@@ -25,14 +25,14 @@ let
regexLocation = cfg: regexEscape (stripLocation cfg);
mkFastcgiPass = cfg: ''
mkFastcgiPass = name: cfg: ''
${if cfg.nginx.location == "/" then ''
fastcgi_param PATH_INFO $uri;
'' else ''
fastcgi_split_path_info ^(${regexLocation cfg})(/.+)$;
fastcgi_param PATH_INFO $fastcgi_path_info;
''
}fastcgi_pass unix:${config.services.fcgiwrap.socketAddress};
}fastcgi_pass unix:${config.services.fcgiwrap.instances."cgit-${name}".socket.address};
'';
cgitrcLine = name: value: "${name}=${
@@ -72,25 +72,11 @@ let
${cfg.extraConfig}
'';
mkCgitReposDir = cfg:
if cfg.scanPath != null then
cfg.scanPath
else
pkgs.runCommand "cgit-repos" {
preferLocalBuild = true;
allowSubstitutes = false;
} ''
mkdir -p "$out"
${
concatStrings (
mapAttrsToList
(name: value: ''
ln -s ${escapeShellArg value.path} "$out"/${escapeShellArg name}
'')
cfg.repos
)
}
'';
fcgiwrapUnitName = name: "fcgiwrap-cgit-${name}";
fcgiwrapRuntimeDir = name: "/run/${fcgiwrapUnitName name}";
gitProjectRoot = name: cfg: if cfg.scanPath != null
then cfg.scanPath
else "${fcgiwrapRuntimeDir name}/repos";
in
{
@@ -154,6 +140,30 @@ in
type = types.lines;
default = "";
};
user = mkOption {
description = ''
User to run the cgit service as.
Defaults to "root" for compatibility with legacy setups.
Will default to the unprivileged user "cgit" in NixOS 24.11.
'';
type = types.str;
default = "root";
example = "cgit";
};
group = mkOption {
description = ''
Group to run the cgit service as.
Defaults to "root" for compatibility with legacy setups.
Will default to the unprivileged user "cgit" in NixOS 24.11.
'';
type = types.str;
default = "root";
example = "cgit";
};
};
}));
};
@@ -165,18 +175,55 @@ in
message = "Exactly one of services.cgit.${vhost}.scanPath or services.cgit.${vhost}.repos must be set.";
}) cfgs;
services.fcgiwrap.enable = true;
warnings = flatten (flip mapAttrsToList cfgs (inst: cfg:
optional (cfg.user == "root") ''
`services.cgit.${inst}` is configured to run as root.
This has security implications. See advisory: https://discourse.nixos.org/t/51419
It is recommended to set an unprivileged user explicitly.
This default user will be set to "cgit" in NixOS 24.11.
''
));
users = mkMerge (flip mapAttrsToList cfgs (_: cfg: {
users.${cfg.user} = {
isSystemUser = true;
inherit (cfg) group;
};
groups.${cfg.group} = { };
}));
services.fcgiwrap.instances = flip mapAttrs' cfgs (name: cfg:
nameValuePair "cgit-${name}" {
process = { inherit (cfg) user group; };
socket = { inherit (config.services.nginx) user group; };
}
);
systemd.services = flip mapAttrs' cfgs (name: cfg:
nameValuePair (fcgiwrapUnitName name)
(mkIf (cfg.repos != { }) {
serviceConfig.RuntimeDirectory = fcgiwrapUnitName name;
preStart = ''
GIT_PROJECT_ROOT=${escapeShellArg (gitProjectRoot name cfg)}
mkdir -p "$GIT_PROJECT_ROOT"
cd "$GIT_PROJECT_ROOT"
${concatLines (flip mapAttrsToList cfg.repos (name: repo: ''
ln -s ${escapeShellArg repo.path} ${escapeShellArg name}
''))}
'';
}
));
services.nginx.enable = true;
services.nginx.virtualHosts = mkMerge (mapAttrsToList (_: cfg: {
services.nginx.virtualHosts = mkMerge (mapAttrsToList (name: cfg: {
${cfg.nginx.virtualHost} = {
locations = (
genAttrs'
[ "cgit.css" "cgit.png" "favicon.ico" "robots.txt" ]
(name: nameValuePair "= ${stripLocation cfg}/${name}" {
(fileName: nameValuePair "= ${stripLocation cfg}/${fileName}" {
extraConfig = ''
alias ${cfg.package}/cgit/${name};
alias ${cfg.package}/cgit/${fileName};
'';
})
) // {
@@ -184,10 +231,10 @@ in
fastcgiParams = rec {
SCRIPT_FILENAME = "${pkgs.git}/libexec/git-core/git-http-backend";
GIT_HTTP_EXPORT_ALL = "1";
GIT_PROJECT_ROOT = mkCgitReposDir cfg;
GIT_PROJECT_ROOT = gitProjectRoot name cfg;
HOME = GIT_PROJECT_ROOT;
};
extraConfig = mkFastcgiPass cfg;
extraConfig = mkFastcgiPass name cfg;
};
"${stripLocation cfg}/" = {
fastcgiParams = {
@@ -196,7 +243,7 @@ in
HTTP_HOST = "$server_name";
CGIT_CONFIG = mkCgitrc cfg;
};
extraConfig = mkFastcgiPass cfg;
extraConfig = mkFastcgiPass name cfg;
};
};
};

9
nixos/modules/services/networking/smokeping.nix
View File

@@ -328,6 +328,7 @@ in
};
preStart = ''
mkdir -m 0755 -p ${smokepingHome}/cache ${smokepingHome}/data
chown -R ${cfg.user}:${cfg.user} ${smokepingHome}/{cache,data}
ln -snf ${cfg.package}/htdocs/css ${smokepingHome}/css
ln -snf ${cfg.package}/htdocs/js ${smokepingHome}/js
ln -snf ${cgiHome} ${smokepingHome}/smokeping.fcgi
@@ -337,7 +338,11 @@ in
};
# use nginx to serve the smokeping web service
services.fcgiwrap.enable = mkIf cfg.webService true;
services.fcgiwrap.instances.smokeping = mkIf cfg.webService {
process.user = cfg.user;
process.group = cfg.user;
socket = { inherit (config.services.nginx) user group; };
};
services.nginx = mkIf cfg.webService {
enable = true;
virtualHosts."smokeping" = {
@@ -349,7 +354,7 @@ in
locations."/smokeping.fcgi" = {
extraConfig = ''
include ${config.services.nginx.package}/conf/fastcgi_params;
fastcgi_pass unix:${config.services.fcgiwrap.socketAddress};
fastcgi_pass unix:${config.services.fcgiwrap.instances.smokeping.socket.address};
fastcgi_param SCRIPT_FILENAME ${smokepingHome}/smokeping.fcgi;
fastcgi_param DOCUMENT_ROOT ${smokepingHome};
'';

136
nixos/modules/services/web-servers/fcgiwrap-instances.nix Normal file
View File

@@ -0,0 +1,136 @@
{ config, lib, pkgs, ... }:
with lib;
let
forEachInstance = f: flip mapAttrs' config.services.fcgiwrap.instances (
name: cfg: nameValuePair "fcgiwrap-${name}" (f cfg)
);
in {
options.services.fcgiwrap.instances = mkOption {
description = "Configuration for fcgiwrap instances.";
default = { };
type = types.attrsOf (types.submodule ({ config, ... }: { options = {
process.prefork = mkOption {
type = types.ints.positive;
default = 1;
description = "Number of processes to prefork.";
};
process.user = mkOption {
type = types.nullOr types.str;
default = null;
description = ''
User as which this instance of fcgiwrap will be run.
Set to `null` (the default) to use a dynamically allocated user.
'';
};
process.group = mkOption {
type = types.nullOr types.str;
default = null;
description = "Group as which this instance of fcgiwrap will be run.";
};
socket.type = mkOption {
type = types.enum [ "unix" "tcp" "tcp6" ];
default = "unix";
description = "Socket type: 'unix', 'tcp' or 'tcp6'.";
};
socket.address = mkOption {
type = types.str;
default = "/run/fcgiwrap-${config._module.args.name}.sock";
example = "1.2.3.4:5678";
description = ''
Socket address.
In case of a UNIX socket, this should be its filesystem path.
'';
};
socket.user = mkOption {
type = types.nullOr types.str;
default = null;
description = ''
User to be set as owner of the UNIX socket.
'';
};
socket.group = mkOption {
type = types.nullOr types.str;
default = null;
description = ''
Group to be set as owner of the UNIX socket.
'';
};
socket.mode = mkOption {
type = types.nullOr types.str;
default = if config.socket.type == "unix" then "0600" else null;
defaultText = literalExpression ''
if config.socket.type == "unix" then "0600" else null
'';
description = ''
Mode to be set on the UNIX socket.
Defaults to private to the socket's owner.
'';
};
}; }));
};
config = {
assertions = concatLists (mapAttrsToList (name: cfg: [
{
assertion = cfg.socket.type == "unix" -> cfg.socket.user != null;
message = "Socket owner is required for the UNIX socket type.";
}
{
assertion = cfg.socket.type == "unix" -> cfg.socket.group != null;
message = "Socket owner is required for the UNIX socket type.";
}
{
assertion = cfg.socket.user != null -> cfg.socket.type == "unix";
message = "Socket owner can only be set for the UNIX socket type.";
}
{
assertion = cfg.socket.group != null -> cfg.socket.type == "unix";
message = "Socket owner can only be set for the UNIX socket type.";
}
{
assertion = cfg.socket.mode != null -> cfg.socket.type == "unix";
message = "Socket mode can only be set for the UNIX socket type.";
}
]) config.services.fcgiwrap.instances);
systemd.services = forEachInstance (cfg: {
after = [ "nss-user-lookup.target" ];
wantedBy = optional (cfg.socket.type != "unix") "multi-user.target";
serviceConfig = {
ExecStart = ''
${pkgs.fcgiwrap}/sbin/fcgiwrap ${cli.toGNUCommandLineShell {} ({
c = cfg.process.prefork;
} // (optionalAttrs (cfg.socket.type != "unix") {
s = "${cfg.socket.type}:${cfg.socket.address}";
}))}
'';
} // (if cfg.process.user != null then {
User = cfg.process.user;
Group = cfg.process.group;
} else {
DynamicUser = true;
});
});
systemd.sockets = forEachInstance (cfg: mkIf (cfg.socket.type == "unix") {
wantedBy = [ "sockets.target" ];
socketConfig = {
ListenStream = cfg.socket.address;
SocketUser = cfg.socket.user;
SocketGroup = cfg.socket.group;
SocketMode = cfg.socket.mode;
};
});
};
}

47
nixos/modules/services/web-servers/fcgiwrap.nix
View File

@@ -4,6 +4,18 @@ with lib;
let
cfg = config.services.fcgiwrap;
deprecationNote = ''
This global instance option is deprecated in favour of per-instance
options configured through `services.fcgiwrap.instances.*`.
'';
securityWarning = ''
The fcgiwrap module is configured with a global shared instance.
This has security implications. See advisory: https://discourse.nixos.org/t/51419
Isolated instances should instead be configured through `services.fcgiwrap.instances.*'.
The global options at `services.fcgiwrap.*` will be removed in NixOS 24.11.
'';
in {
options = {
@@ -11,43 +23,66 @@ in {
enable = mkOption {
type = types.bool;
default = false;
description = "Whether to enable fcgiwrap, a server for running CGI applications over FastCGI.";
description = "Whether to enable fcgiwrap, a server for running CGI applications over FastCGI." + deprecationNote;
};
allowGlobalInstanceLocalPrivilegeEscalation = mkOption {
type = types.bool;
default = false;
description = ''
The global instance of fcgiwrap configured through this module
has a local privilege escalation vulnerability.
Set this option to true to accept the risk and bypass the evaluation
failure regardless.
'';
};
preforkProcesses = mkOption {
type = types.int;
default = 1;
description = "Number of processes to prefork.";
description = "Number of processes to prefork." + deprecationNote;
};
socketType = mkOption {
type = types.enum [ "unix" "tcp" "tcp6" ];
default = "unix";
description = "Socket type: 'unix', 'tcp' or 'tcp6'.";
description = "Socket type: 'unix', 'tcp' or 'tcp6'." + deprecationNote;
};
socketAddress = mkOption {
type = types.str;
default = "/run/fcgiwrap.sock";
example = "1.2.3.4:5678";
description = "Socket address. In case of a UNIX socket, this should be its filesystem path.";
description = "Socket address. In case of a UNIX socket, this should be its filesystem path." + deprecationNote;
};
user = mkOption {
type = types.nullOr types.str;
default = null;
description = "User permissions for the socket.";
description = "User permissions for the socket." + deprecationNote;
};
group = mkOption {
type = types.nullOr types.str;
default = null;
description = "Group permissions for the socket.";
description = "Group permissions for the socket." + deprecationNote;
};
};
};
config = mkIf cfg.enable {
assertions = [
{
assertion = cfg.allowGlobalInstanceLocalPrivilegeEscalation;
message = securityWarning + ''
To temporarily accept the risk and continue using the global instance,
set `services.fcgiwrap.allowGlobalInstanceLocalPrivilegeEscalation` to true.
'';
}
];
warnings = [ securityWarning ];
systemd.services.fcgiwrap = {
after = [ "nss-user-lookup.target" ];
wantedBy = optional (cfg.socketType != "unix") "multi-user.target";

12
pkgs/applications/networking/browsers/microsoft-edge/default.nix
View File

@@ -1,20 +1,20 @@
{
beta = import ./browser.nix {
channel = "beta";
version = "128.0.2739.5";
version = "128.0.2739.42";
revision = "1";
hash = "sha256-y+587iVWgPk2a1P/F2iwSW1NEnAJaigL6rlVmqaIDJk=";
hash = "sha256-VcBn2WL4rdAeEa62XT/dhC2OFLsV0Q/Sp6hqgmc/e0Y=";
};
dev = import ./browser.nix {
channel = "dev";
version = "128.0.2739.5";
version = "129.0.2779.0";
revision = "1";
hash = "sha256-zY3iGbeYlOoArNNdF1qNwdtp25P0uWJmVMEK7kJIiqQ=";
hash = "sha256-hlamsHTpBMGwOICga0k874q8+xuaZFMofFLG/EvB0NU=";
};
stable = import ./browser.nix {
channel = "stable";
version = "127.0.2651.86";
version = "128.0.2739.42";
revision = "1";
hash = "sha256-1Dh+OoTrghn9ArvEnBZCkLnUf0m0qnkEtCoWjA8QId4=";
hash = "sha256-AwdZX2Ens2+rhHLYV0efYsXYBTs2a57HyGz2k+IDMeQ=";
};
}

6
pkgs/applications/networking/cluster/argocd/default.nix
View File

@@ -2,17 +2,17 @@
buildGoModule rec {
pname = "argocd";
version = "2.11.3";
version = "2.11.7";
src = fetchFromGitHub {
owner = "argoproj";
repo = "argo-cd";
rev = "v${version}";
hash = "sha256-qSrMqByhOitRltYaVjIeubuoTR74x/pQ1Ad+uTPdpJU=";
hash = "sha256-/gbclPcYSDobwftFi0CECgBp6PNqxHW9svP3A5y8eEY=";
};
proxyVendor = true; # darwin/linux hash mismatch
vendorHash = "sha256-atgNLlHoX+KBtJcYZNqNsYBK0cVGI/k2mXvmcr6wWN4=";
vendorHash = "sha256-y6B//zal2OyzZ1slC+x3vxHasFTM+xD+/6Sd2AFHFgY=";
# Set target as ./cmd per cli-local
# https://github.com/argoproj/argo-cd/blob/master/Makefile#L227

46
pkgs/tools/backup/bup/default.nix → pkgs/by-name/bu/bup/package.nix
View File

@@ -1,15 +1,33 @@
{ lib, stdenv, fetchFromGitHub, makeWrapper
, perl, pandoc, python3, git
, par2cmdline ? null, par2Support ? true
{
lib,
stdenv,
fetchFromGitHub,
makeWrapper,
perl,
pandoc,
python3,
git,
par2Support ? true,
par2cmdline ? null,
}:
assert par2Support -> par2cmdline != null;
let
version = "0.33.3";
version = "0.33.4";
pythonDeps = with python3.pkgs; [ setuptools tornado ]
++ lib.optionals (!stdenv.isDarwin) [ pyxattr pylibacl fuse ];
pythonDeps =
with python3.pkgs;
[
setuptools
tornado
]
++ lib.optionals (!stdenv.isDarwin) [
pyxattr
pylibacl
fuse
];
in
stdenv.mkDerivation {
@@ -20,11 +38,18 @@ stdenv.mkDerivation {
repo = "bup";
owner = "bup";
rev = version;
hash = "sha256-w7yPs7hG4v0Kd9i2tYhWH7vW95MAMfI/8g61MB6bfps=";
hash = "sha256-9rWzHONcu4W/JcnDUGPbuGksroODbhdL6bNF+3Dd2ag=";
};
buildInputs = [ git python3 ];
nativeBuildInputs = [ pandoc perl makeWrapper ];
buildInputs = [
git
python3
];
nativeBuildInputs = [
pandoc
perl
makeWrapper
];
postPatch = "patchShebangs .";
@@ -37,7 +62,8 @@ stdenv.mkDerivation {
"LIBDIR=$(out)/lib/bup"
];
env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-Wno-error=implicit-function-declaration -Wno-error=implicit-int";
env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang
"-Wno-error=implicit-function-declaration -Wno-error=implicit-int";
postInstall = ''
wrapProgram $out/bin/bup \

4
pkgs/development/interpreters/php/8.2.nix
View File

@@ -2,8 +2,8 @@
let
base = callPackage ./generic.nix (_args // {
version = "8.2.21";
hash = "sha256-+Ydv59TZbUGs7RmbWKH3rntmVd3JJnMTX+3tf2k5138=";
version = "8.2.23";
hash = "sha256-98kM2no8HeAfO/t7Rp1S3snrovO4MyCDYAT5wu7K4ms=";
});
in
base.withExtensions ({ all, ... }: with all; ([

4
pkgs/development/interpreters/php/8.3.nix
View File

@@ -2,8 +2,8 @@
let
base = callPackage ./generic.nix (_args // {
version = "8.3.9";
hash = "sha256-lu3G2Ct1A6ZlBUH8R3q9VFbfKN+qjJOI/54x2f4eMRI=";
version = "8.3.11";
hash = "sha256-ZkDiRVCAqJrcQdTle7BPjCv7fuxif+GZr5c7/zTX8O4=";
});
in
base.withExtensions ({ all, ... }: with all; ([

8
pkgs/development/libraries/duckdb/default.nix
View File

@@ -30,6 +30,14 @@ stdenv.mkDerivation (finalAttrs: {
rev = "refs/tags/v${finalAttrs.version}";
};
patches = [
(fetchpatch {
name = "CVE-2024-41672.patch";
url = "https://github.com/duckdb/duckdb/commit/c9b7c98aa0e1cd7363fe8bb8543a95f38e980d8a.patch";
hash = "sha256-Zb962mWIgy2t/0csbwZ8BcLgpdIA9/JpJ0+EWr1Kg1g=";
})
];
outputs = [ "out" "lib" "dev" ];
nativeBuildInputs = [ cmake ninja python3 ];

1
pkgs/development/tools/database/litestream/default.nix
View File

@@ -27,5 +27,6 @@ buildGoModule rec {
license = licenses.asl20;
homepage = "https://litestream.io/";
maintainers = with maintainers; [ fbrs ];
knownVulnerabilities = [ "CVE-2024-41254" ];
};
}

6
pkgs/servers/mattermost/default.nix
View File

@@ -12,13 +12,13 @@ buildGoModule rec {
# See https://docs.mattermost.com/upgrade/extended-support-release.html
# When a new ESR version is available (e.g. 8.1.x -> 9.5.x), update
# the version regex in passthru.updateScript as well.
version = "9.5.8";
version = "9.5.9";
src = fetchFromGitHub {
owner = "mattermost";
repo = "mattermost";
rev = "v${version}";
hash = "sha256-WK3O1t2mMqftH8EB12g1/xzQnnmJxSsBjaGrRk0Hypw=";
hash = "sha256-mGTLn1aV6pB/ubqtYYF1zNRAaLj5IsdQTLhf1LzcNho=";
};
# Needed because buildGoModule does not support go workspaces yet.
@@ -34,7 +34,7 @@ buildGoModule rec {
webapp = fetchurl {
url = "https://releases.mattermost.com/${version}/mattermost-${version}-linux-amd64.tar.gz";
hash = "sha256-gUp/Y0hI3oZkyTnEvyNXtHtPx77MC5zz+Z4b0FdrsqM=";
hash = "sha256-TgaRDIxGBoow1//99bGpp91HNYgdWRnoS09EDAFcHDs=";
};
# Makes nix-update-script pick up the fetchurl for the webapp.

2
pkgs/top-level/all-packages.nix
View File

@@ -6472,8 +6472,6 @@ with pkgs;
bumpver = callPackage ../applications/version-management/bumpver { };
bup = callPackage ../tools/backup/bup { };
bupstash = darwin.apple_sdk_11_0.callPackage ../tools/backup/bupstash { };
burp = callPackage ../tools/backup/burp { };