From fe5d2e5e34667a9238802a79b438233e21e0de98 Mon Sep 17 00:00:00 2001 From: L-Trump Date: Thu, 22 Oct 2026 12:42:21 +0800 Subject: [PATCH 1/3] easytier: 2.6.4 -> 2.7.0 2.7.0 does not build with cargo-auditable: `cargo metadata` gets the built crate's feature list and applies it to every workspace member, while easytier-core only exposes `smoltcp` through `dep:`. Add the alias back in a small patch. https://github.com/rust-secure-code/cargo-auditable/issues/124 Assisted-by: pi 1.3.0 (DeepSeek V4.1 Flash) --- pkgs/by-name/ea/easytier/package.nix | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/ea/easytier/package.nix b/pkgs/by-name/ea/easytier/package.nix index 46318dbbf2392..112901f843681 100644 --- a/pkgs/by-name/ea/easytier/package.nix +++ b/pkgs/by-name/ea/easytier/package.nix @@ -2,6 +2,7 @@ lib, stdenv, fetchFromGitHub, + fetchpatch2, rustPlatform, protobuf, nixosTests, @@ -17,16 +18,27 @@ rustPlatform.buildRustPackage (finalAttrs: { pname = "easytier"; - version = "2.6.4"; + version = "2.7.0"; src = fetchFromGitHub { owner = "EasyTier"; repo = "EasyTier"; tag = "v${finalAttrs.version}"; - hash = "sha256-lwqpOVKFm85AiBb7NWLAkjSrWSe5pzF0AuEmmDo+v0k="; + hash = "sha256-t/a4V1pMoqr9fVfMGHJUfJPk8VD+mbOxB2Cvb2lsX9Q="; }; - cargoHash = "sha256-c+rOjokrL0U63s1CMfy6KlGI7VoSmtxuQjBNDAagSdg="; + cargoHash = "sha256-/dVCPkDGgvDEUnCb1EfH2Y0Yn48h4mYuUben0GNwvoo="; + + patches = [ + # TODO: remove after next release + # `dep:` in easytier-core drops the implicit `smoltcp` feature that + # cargo-auditable expects; see rust-secure-code/cargo-auditable#124. + (fetchpatch2 { + name = "expose-smoltcp-feature.patch"; + url = "https://github.com/EasyTier/EasyTier/commit/3a0acccf46eff19c88d372a4b06749eccc9fa708.patch?full_index=1"; + hash = "sha256-tV7TtBF8WPmVnVYp7KiaS8Ek48Y/6BmRSICF38Q2ESc="; + }) + ]; nativeBuildInputs = [ protobuf From ffa068ad24508a0fbbd4fc126b8285da8f74cb48 Mon Sep 17 00:00:00 2001 From: L-Trump Date: Thu, 22 Oct 2026 12:42:21 +0800 Subject: [PATCH 2/3] easytier: backport rustls crypto provider selection Backport of https://github.com/EasyTier/EasyTier/pull/2648. --- ...stls-select-ring-provider-explicitly.patch | 23 +++++++++++++++++++ pkgs/by-name/ea/easytier/package.nix | 3 +++ 2 files changed, 26 insertions(+) create mode 100644 pkgs/by-name/ea/easytier/0002-rustls-select-ring-provider-explicitly.patch diff --git a/pkgs/by-name/ea/easytier/0002-rustls-select-ring-provider-explicitly.patch b/pkgs/by-name/ea/easytier/0002-rustls-select-ring-provider-explicitly.patch new file mode 100644 index 0000000000000..a68b27dba389b --- /dev/null +++ b/pkgs/by-name/ea/easytier/0002-rustls-select-ring-provider-explicitly.patch @@ -0,0 +1,23 @@ +# rustls has two backends enabled when easytier-web is built alongside the CLI; +# upstream fix for that is EasyTier/EasyTier#2648 (issue #2607). + +diff --git a/easytier-core/src/connectivity/manual/discovery/implementation.rs b/easytier-core/src/connectivity/manual/discovery/implementation.rs +--- a/easytier-core/src/connectivity/manual/discovery/implementation.rs ++++ b/easytier-core/src/connectivity/manual/discovery/implementation.rs +@@ -187,9 +187,13 @@ where + let root_store = rustls::RootCertStore { + roots: webpki_roots::TLS_SERVER_ROOTS.to_vec(), + }; +- let tls_config = rustls::ClientConfig::builder() +- .with_root_certificates(root_store) +- .with_no_client_auth(); ++ let tls_config = rustls::ClientConfig::builder_with_provider(Arc::new( ++ rustls::crypto::ring::default_provider(), ++ )) ++ .with_safe_default_protocol_versions() ++ .context("selecting HTTPS protocol versions failed")? ++ .with_root_certificates(root_store) ++ .with_no_client_auth(); + let stream = TlsConnector::from(Arc::new(tls_config)) + .connect(server_name, socket) + .await diff --git a/pkgs/by-name/ea/easytier/package.nix b/pkgs/by-name/ea/easytier/package.nix index 112901f843681..1f5d67f164dfa 100644 --- a/pkgs/by-name/ea/easytier/package.nix +++ b/pkgs/by-name/ea/easytier/package.nix @@ -38,6 +38,9 @@ rustPlatform.buildRustPackage (finalAttrs: { url = "https://github.com/EasyTier/EasyTier/commit/3a0acccf46eff19c88d372a4b06749eccc9fa708.patch?full_index=1"; hash = "sha256-tV7TtBF8WPmVnVYp7KiaS8Ek48Y/6BmRSICF38Q2ESc="; }) + # Building easytier-web next to the CLI enables two rustls backends, which + # makes HTTPS peer discovery panic; backport of EasyTier/EasyTier#2648. + ./0002-rustls-select-ring-provider-explicitly.patch ]; nativeBuildInputs = [ From c0cff2bb132943b317407ab4ce477e7a438ac977 Mon Sep 17 00:00:00 2001 From: L-Trump Date: Thu, 22 Oct 2026 12:42:25 +0800 Subject: [PATCH 3/3] nixos/easytier: document 2.7.0 configuration changes --- nixos/doc/manual/release-notes/rl-2611.section.md | 12 ++++++++++++ nixos/modules/services/networking/easytier.nix | 3 ++- pkgs/by-name/ea/easytier/service.nix | 3 ++- 3 files changed, 16 insertions(+), 2 deletions(-) diff --git a/nixos/doc/manual/release-notes/rl-2611.section.md b/nixos/doc/manual/release-notes/rl-2611.section.md index e9def64cc19a4..c1f5b33aceb6f 100644 --- a/nixos/doc/manual/release-notes/rl-2611.section.md +++ b/nixos/doc/manual/release-notes/rl-2611.section.md @@ -180,6 +180,18 @@ +- `easytier` has been updated to 2.7.0 and is stricter about its configuration: + + - [`services.easytier.instances..configServer`](#opt-services.easytier.instances._name_.configServer) + requires a full URL such as `udp://example.com:22020/`; the bare + `` shorthand for the official server was removed. + - The WireGuard portal no longer accepts `client_cidr` or `wg://host:port/CIDR`. + Set `wireguard_private_key` and list the clients under + `vpn_portal_config.clients` with a `virtual_ip` each. + - Unknown keys in the `[flags]` table are rejected instead of being ignored, so + a stale flag now stops the instance with `failed to parse flags` + ([upstream #2670](https://github.com/EasyTier/EasyTier/issues/2670)). + - `services.music-assistant` no longer ships the service API credentials that upstream bundles only in its official release builds. Providers that rely on them (`spotify`, `qobuz`, `apple_music`, `theaudiodb`, `fanarttv`) no longer work out of the box. Register your own diff --git a/nixos/modules/services/networking/easytier.nix b/nixos/modules/services/networking/easytier.nix index 127c72063facf..93325da2b18ad 100644 --- a/nixos/modules/services/networking/easytier.nix +++ b/nixos/modules/services/networking/easytier.nix @@ -134,7 +134,8 @@ let except `hostname` will be ignored. Valid formats are: - full uri for custom server: `udp://example.com:22020/` - - username only for official server: `` + + Since 2.7.0 a full URL is required; a bare `` is rejected. ''; example = "udp://example.com:22020/myusername"; }; diff --git a/pkgs/by-name/ea/easytier/service.nix b/pkgs/by-name/ea/easytier/service.nix index e5cf1cfcbfc8a..29fdee02c6e33 100644 --- a/pkgs/by-name/ea/easytier/service.nix +++ b/pkgs/by-name/ea/easytier/service.nix @@ -50,7 +50,8 @@ in except {option}`easytier.settings.hostname` will be ignored. Valid formats are: - full uri for custom server: `udp://example.com:22020/` - - username only for official server: `` + + Since 2.7.0 a full URL is required; a bare `` is rejected. ''; example = "udp://example.com:22020/myusername"; };