From 9e7404c91dfca4ac4383f9f29754827ede0a37ce Mon Sep 17 00:00:00 2001 From: Thomas Gerbet Date: Fri, 6 Jan 2023 10:13:56 +0100 Subject: [PATCH 01/15] grub2: apply security patches Fixes CVE-2021-3981, CVE-2021-3695, CVE-2021-3696, CVE-2021-3697, CVE-2022-28733, CVE-2022-28734, CVE-2022-28735, CVE-2022-28736, CVE-2022-28737, CVE-2022-2601 and CVE-2022-3775. https://lists.gnu.org/archive/html/grub-devel/2022-06/msg00035.html https://lists.gnu.org/archive/html/grub-devel/2022-11/msg00059.html (cherry picked from commit df5d6a371ae1488b55795645afd172c1a5281f7c) --- pkgs/tools/misc/grub/2.0x.nix | 236 ++++++++++++++++++++++++++++++++++ 1 file changed, 236 insertions(+) diff --git a/pkgs/tools/misc/grub/2.0x.nix b/pkgs/tools/misc/grub/2.0x.nix index 58ed620ffd08..556b0672fa03 100644 --- a/pkgs/tools/misc/grub/2.0x.nix +++ b/pkgs/tools/misc/grub/2.0x.nix @@ -78,6 +78,242 @@ stdenv.mkDerivation rec { url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=000b5cd04fd228f9741f5dca0491636bc0b89eb8"; sha256 = "sha256-Mex3qQ0lW7ZCv7ZI7MSSqbylJXZ5RTbR4Pv1+CJ0ciM="; }) + (fetchpatch { + name = "CVE-2021-3981.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=0adec29674561034771c13e446069b41ef41e4d4"; + sha256 = "sha256-3vkvWjcSv0hyY2EX3ig2EXEe+XLiRsXYlcd5kpY4wXw="; + }) + # June 2022 security patches + # https://lists.gnu.org/archive/html/grub-devel/2022-06/msg00035.html + (fetchpatch { + name = "CVE-2021-3695.CVE-2021-3696.CVE-2021-3697.CVE-2022-28733.CVE-2022-28734.CVE-2022-28735.CVE-2022-28736.CVE-2022-28737.1.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=1469983ebb9674753ad333d37087fb8cb20e1dce"; + sha256 = "sha256-oB4S0jvIXsDPcjIz1E2LKm7gwdvZjywuI1j0P6JQdJg="; + }) + (fetchpatch { + name = "CVE-2021-3695.CVE-2021-3696.CVE-2021-3697.CVE-2022-28733.CVE-2022-28734.CVE-2022-28735.CVE-2022-28736.CVE-2022-28737.2.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=14ceb3b3ff6db664649138442b6562c114dcf56e"; + sha256 = "sha256-mKe8gzd0U4PbV8z3TWCdvv7UugEgYaVIkB4dyMrSGEE="; + }) + (fetchpatch { + name = "CVE-2021-3695.CVE-2021-3696.CVE-2021-3697.CVE-2022-28733.CVE-2022-28734.CVE-2022-28735.CVE-2022-28736.CVE-2022-28737.3.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=04c86e0bb7b58fc2f913f798cdb18934933e532d"; + sha256 = "sha256-sA+PTlk4hwYOVKRZBHkEskabzmsf47Hi4h3mzWOFjwM="; + }) + (fetchpatch { + name = "CVE-2021-3695.CVE-2021-3696.CVE-2021-3697.CVE-2022-28733.CVE-2022-28734.CVE-2022-28735.CVE-2022-28736.CVE-2022-28737.4.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=6fe755c5c07bb386fda58306bfd19e4a1c974c53"; + sha256 = "sha256-8zmFocUfnjSyhYitUFDHoilHDnm1NJmhcKwO9dueV3k="; + }) + (fetchpatch { + name = "CVE-2021-3695.CVE-2021-3696.CVE-2021-3697.CVE-2022-28733.CVE-2022-28734.CVE-2022-28735.CVE-2022-28736.CVE-2022-28737.5.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=f1ce0e15e70ea1aafcfa26ad93e7585f65783c6f"; + sha256 = "sha256-Wrlam6CRPUAHbKqe/X1YLcRxJ2LQTtmQ/Y66gxUlqK4="; + }) + (fetchpatch { + name = "CVE-2021-3695.CVE-2021-3696.CVE-2021-3697.CVE-2022-28733.CVE-2022-28734.CVE-2022-28735.CVE-2022-28736.CVE-2022-28737.6.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=5bff31cdb6b93d738f850834e6291df1d0b136fa"; + sha256 = "sha256-ReLWSePXjRweymsVAL/uoBgYMWt9vRDcY3iXlDNZT0w="; + }) + (fetchpatch { + name = "CVE-2021-3695.CVE-2021-3696.CVE-2021-3697.CVE-2022-28733.CVE-2022-28734.CVE-2022-28735.CVE-2022-28736.CVE-2022-28737.7.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=347880a13c239b4c2811c94c9a7cf78b607332e3"; + sha256 = "sha256-07hpHuJFw95xGoJ/6ej7i6HlCFb2QRxP3arvRjKW4uU="; + }) + ## Needed to apply patch 8 + (fetchpatch { + name = "video-remove-trailing-whitespaces.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=1f48917d8ddb490dcdc70176e0f58136b7f7811a"; + sha256 = "sha256-/yf/LGpwYcQ36KITzmiFfg4BvhcApKbrlFzjKK8V2kI="; + }) + (fetchpatch { + name = "CVE-2021-3695.CVE-2021-3696.CVE-2021-3697.CVE-2022-28733.CVE-2022-28734.CVE-2022-28735.CVE-2022-28736.CVE-2022-28737.8.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=e623866d9286410156e8b9d2c82d6253a1b22d08"; + sha256 = "sha256-zFxP6JY5Q9s3yJHdkbZ2w+dXFKeOCXjFnQKadB5HLCg="; + }) + (fetchpatch { + name = "CVE-2021-3695.CVE-2021-3696.CVE-2021-3697.CVE-2022-28733.CVE-2022-28734.CVE-2022-28735.CVE-2022-28736.CVE-2022-28737.9.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=210245129c932dc9e1c2748d9d35524fb95b5042"; + sha256 = "sha256-FyZhdTlcRVmn7X2hv93RhWP7NOoEMb7ib/DWveyz3Ew="; + }) + (fetchpatch { + name = "CVE-2021-3695.CVE-2021-3696.CVE-2021-3697.CVE-2022-28733.CVE-2022-28734.CVE-2022-28735.CVE-2022-28736.CVE-2022-28737.10.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=690bee69fae6b4bd911293d6b7e56774e29fdf64"; + sha256 = "sha256-nOAXxebCW/s5M6sjPKdSdx47/PcH1lc0yYT0flVwoC8="; + }) + (fetchpatch { + name = "CVE-2021-3695.CVE-2021-3696.CVE-2021-3697.CVE-2022-28733.CVE-2022-28734.CVE-2022-28735.CVE-2022-28736.CVE-2022-28737.11.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=d5caac8ab79d068ad9a41030c772d03a4d4fbd7b"; + sha256 = "sha256-9fGJJkgZ6+E01MJqVTR1qFITx9EAx41Hv9QNfdqBgu0="; + }) + (fetchpatch { + name = "CVE-2021-3695.CVE-2021-3696.CVE-2021-3697.CVE-2022-28733.CVE-2022-28734.CVE-2022-28735.CVE-2022-28736.CVE-2022-28737.12.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=768ef2199e0265cf455b154f1a80a612f02274c8"; + sha256 = "sha256-2/JJJux5vqXUc77bi3aXRy8NclbvyD/0e6UN8/6Ui3c="; + }) + (fetchpatch { + name = "CVE-2021-3695.CVE-2021-3696.CVE-2021-3697.CVE-2022-28733.CVE-2022-28734.CVE-2022-28735.CVE-2022-28736.CVE-2022-28737.13.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=166a4d61448f74745afe1dac2f2cfb85d04909bf"; + sha256 = "sha256-XxTZ8P8qr4qEXELdHwaRACPeIZ/iixlATLB5RvVQsC8="; + }) + (fetchpatch { + name = "CVE-2021-3695.CVE-2021-3696.CVE-2021-3697.CVE-2022-28733.CVE-2022-28734.CVE-2022-28735.CVE-2022-28736.CVE-2022-28737.14.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=22a3f97d39f6a10b08ad7fd1cc47c4dcd10413f6"; + sha256 = "sha256-bzB2gmGvWR2ylvMw779KQ/VHBBMsDNbG96eg9qQlljA="; + }) + (fetchpatch { + name = "CVE-2021-3695.CVE-2021-3696.CVE-2021-3697.CVE-2022-28733.CVE-2022-28734.CVE-2022-28735.CVE-2022-28736.CVE-2022-28737.15.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=830a9628b2c9e1b6388af624aaf4a80818ed6be0"; + sha256 = "sha256-8fna2VbbUw8zBx77osaOOHlZFgRrHqwQK87RoUtCF6w="; + }) + (fetchpatch { + name = "CVE-2021-3695.CVE-2021-3696.CVE-2021-3697.CVE-2022-28733.CVE-2022-28734.CVE-2022-28735.CVE-2022-28736.CVE-2022-28737.16.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=3e4817538de828319ba6d59ced2fbb9b5ca13287"; + sha256 = "sha256-iCZAyRS/a15x5aJCJBYl9nw6Hc3WRCUG7zF5V+OwDKg="; + }) + (fetchpatch { + name = "CVE-2021-3695.CVE-2021-3696.CVE-2021-3697.CVE-2022-28733.CVE-2022-28734.CVE-2022-28735.CVE-2022-28736.CVE-2022-28737.17.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=f407e34f3871a4c402bbd516e7c28ea193cef1b7"; + sha256 = "sha256-S45cLZNTWapAodKudUz2fMjnPsW6vbtNz0bIvIBGmu4="; + }) + (fetchpatch { + name = "CVE-2021-3695.CVE-2021-3696.CVE-2021-3697.CVE-2022-28733.CVE-2022-28734.CVE-2022-28735.CVE-2022-28736.CVE-2022-28737.18.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=c1b7eef9fa4aaefbf7d0507505c3bb2914e1ad6b"; + sha256 = "sha256-TWPfEAOePwC77yiVdsTSZIjfsMp7+0XabCz9K3FlV7w="; + }) + ## Needed to apply patch 19 + (fetchpatch { + name = "net-remove-trailing-whitespaces.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=e453a4a64392a41bc7b37f890aceb358112d1687"; + sha256 = "sha256-JCbUB77Y6js5u99uJ9StDxNjjahNy4nO3crK8/GvmPY="; + }) + (fetchpatch { + name = "CVE-2021-3695.CVE-2021-3696.CVE-2021-3697.CVE-2022-28733.CVE-2022-28734.CVE-2022-28735.CVE-2022-28736.CVE-2022-28737.19.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=96abf4fb9d829f4a405d5df39bc74bbccbd0e322"; + sha256 = "sha256-6E2MKO5kauFA1TA8YkUgIUusniwHS2Sr44A/a7ZqDCo="; + }) + (fetchpatch { + name = "CVE-2021-3695.CVE-2021-3696.CVE-2021-3697.CVE-2022-28733.CVE-2022-28734.CVE-2022-28735.CVE-2022-28736.CVE-2022-28737.20.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=ee9652031491326736714a988fbbaeab8ef9255c"; + sha256 = "sha256-E21q+Mj+JBQlUW0pe4zbaoL3ErXmCanyizwAsRYYZHk="; + }) + (fetchpatch { + name = "CVE-2021-3695.CVE-2021-3696.CVE-2021-3697.CVE-2022-28733.CVE-2022-28734.CVE-2022-28735.CVE-2022-28736.CVE-2022-28737.21.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=8f287c3e13da2bf82049e2e464eca7ca4fef0a85"; + sha256 = "sha256-dZ24RwYsHeUrMuiU7PDgPcw+iK9cOd6q+E0xWXbtTkE="; + }) + (fetchpatch { + name = "CVE-2021-3695.CVE-2021-3696.CVE-2021-3697.CVE-2022-28733.CVE-2022-28734.CVE-2022-28735.CVE-2022-28736.CVE-2022-28737.22.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=dad94fffe14be476df5f34a8e5a90ea62a41fe12"; + sha256 = "sha256-06TyTEvSy19dsnXZZoKBGx7ymJVWogr0NorzLflEwY4="; + }) + (fetchpatch { + name = "CVE-2021-3695.CVE-2021-3696.CVE-2021-3697.CVE-2022-28733.CVE-2022-28734.CVE-2022-28735.CVE-2022-28736.CVE-2022-28737.23.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=ec6bfd3237394c1c7dbf2fd73417173318d22f4b"; + sha256 = "sha256-NryxSekO8oSxsnv5G9mFZExm4Pwfc778mslyUDuDhlM="; + }) + (fetchpatch { + name = "CVE-2021-3695.CVE-2021-3696.CVE-2021-3697.CVE-2022-28733.CVE-2022-28734.CVE-2022-28735.CVE-2022-28736.CVE-2022-28737.24.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=b26b4c08e7119281ff30d0fb4a6169bd2afa8fe4"; + sha256 = "sha256-fSH3cxl/76DwkE8dHSR9uao9Vf1sJrhz7SmUSgDNodI="; + }) + (fetchpatch { + name = "CVE-2021-3695.CVE-2021-3696.CVE-2021-3697.CVE-2022-28733.CVE-2022-28734.CVE-2022-28735.CVE-2022-28736.CVE-2022-28737.25.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=4bd9877f62166b7e369773ab92fe24a39f6515f8"; + sha256 = "sha256-VMtR/sF8F1BMKmJ06ZZEPNH/+l0RySy/E6lVWdCyFKE="; + }) + (fetchpatch { + name = "CVE-2021-3695.CVE-2021-3696.CVE-2021-3697.CVE-2022-28733.CVE-2022-28734.CVE-2022-28735.CVE-2022-28736.CVE-2022-28737.26.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=deae293f399dde3773cf37dfa9b77ca7e04ef772"; + sha256 = "sha256-sCC3KE9adavw7jHMTVlxtyuwDFCPRDqT24H3AKUYf68="; + }) + (fetchpatch { + name = "CVE-2021-3695.CVE-2021-3696.CVE-2021-3697.CVE-2022-28733.CVE-2022-28734.CVE-2022-28735.CVE-2022-28736.CVE-2022-28737.27.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=e40b83335bb33d9a2d1c06cc269875b3b3d6c539"; + sha256 = "sha256-cviCfBkzacAtnHGW87RLshhduE4Ym/v2Vq4h/sZDmZg="; + }) + (fetchpatch { + name = "CVE-2021-3695.CVE-2021-3696.CVE-2021-3697.CVE-2022-28733.CVE-2022-28734.CVE-2022-28735.CVE-2022-28736.CVE-2022-28737.28.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=11e1cffb7e2492ddac4ab8d19ce466783adbb957"; + sha256 = "sha256-I1feoneVeU3XkscKfVprWWJfLUnrc5oauMXYDyDxo5M="; + }) + (fetchpatch { + name = "CVE-2021-3695.CVE-2021-3696.CVE-2021-3697.CVE-2022-28733.CVE-2022-28734.CVE-2022-28735.CVE-2022-28736.CVE-2022-28737.29.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=13dce204cf6f3f0f49c9949971052a4c9657c0c0"; + sha256 = "sha256-DzFHxgR9A8FNZ/y9OMeBvTp1K6J5ePyL06dhHQmk7Ik="; + }) + (fetchpatch { + name = "CVE-2021-3695.CVE-2021-3696.CVE-2021-3697.CVE-2022-28733.CVE-2022-28734.CVE-2022-28735.CVE-2022-28736.CVE-2022-28737.30.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=2f4430cc0a44fd8c8aa7aee5c51887667ad3d6c3"; + sha256 = "sha256-AufP/10/auO4NMjYQ7yPDDbYShwGaktyQtqJx2Jasz8="; + }) + # October 2022 security patches + # https://lists.gnu.org/archive/html/grub-devel/2022-11/msg00059.html + (fetchpatch { + name = "CVE-2022-2601.CVE-2022-3775.1.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=f6b6236077f059e64ee315f2d7acb8fa4eda87c5"; + sha256 = "sha256-pk02iVf/u6CdsVjl8HaFBh0Bt473ZQzz5zBp9SoBLtE="; + }) + (fetchpatch { + name = "CVE-2022-2601.CVE-2022-3775.2.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=9c76ec09ae08155df27cd237eaea150b4f02f532"; + sha256 = "sha256-axbEOH5WFkUroGna2XY1f2kq7+B1Cs6LiubIA2EBdiM="; + }) + (fetchpatch { + name = "CVE-2022-2601.CVE-2022-3775.3.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=768e1ef2fc159f6e14e7246e4be09363708ac39e"; + sha256 = "sha256-aKDUVS/Yx1c87NCrt4EG8BlSpkHijUyAJIwbmtzNjD8="; + }) + (fetchpatch { + name = "CVE-2022-2601.CVE-2022-3775.4.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=c51292274ded3259eb04c2f1c8d253ffbdb5216a"; + sha256 = "sha256-OLNOKuAJuHy2MBMnU2xcYM7AaxmDk9fchXhggoDrxJU="; + }) + (fetchpatch { + name = "CVE-2022-2601.CVE-2022-3775.5.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=23843fe8947e4da955a05ad3d1858725bfcb56c8"; + sha256 = "sha256-ptn00nqVJlEb1c6HhoMy9nrBuctH077LM4yXKsK47gc="; + }) + (fetchpatch { + name = "CVE-2022-2601.CVE-2022-3775.6.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=b9396daf1c2e3cdc0a1e69b056852e0769fb24de"; + sha256 = "sha256-K7XNneDZjLpZh/C908+5uYsB/0oIdgQqmk0yJrdQLG4="; + }) + (fetchpatch { + name = "CVE-2022-2601.CVE-2022-3775.7.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=1d2015598cc7a9fca4b39186273e3519a88e80c7"; + sha256 = "sha256-s4pZtszH4b/0u85rpzVapZmNQdYEq/wW06SQ3PW/1aU="; + }) + (fetchpatch { + name = "CVE-2022-2601.CVE-2022-3775.8.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=93a786a00163e50c29f0394df198518617e1c9a5"; + sha256 = "sha256-R8x557RMAxJ0ZV2jb6zDmwOPVlk6875q37fNpqKsPT0="; + }) + (fetchpatch { + name = "CVE-2022-2601.CVE-2022-3775.9.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=1eac01c147b4d85d2ec4a7e5671fa4345f2e8549"; + sha256 = "sha256-eOnhmU3pT5cCVnNHcY/BzDjldfs7yh/OGsxa15tGv94="; + }) + (fetchpatch { + name = "CVE-2022-2601.CVE-2022-3775.10.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=992c06191babc1e109caf40d6a07ec6fdef427af"; + sha256 = "sha256-kezNKPcLmFXwyZbXtJbaPTIbE8tijmHIzdC2jsKwrNk="; + }) + (fetchpatch { + name = "CVE-2022-2601.CVE-2022-3775.11.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=9d81f71c6b8f55cf20cd56f5fe29c759df9b48cc"; + sha256 = "sha256-jnniVGy4KvFGFmcOP2YLA46k3cK8vwoByo19ismVUzE="; + }) + (fetchpatch { + name = "CVE-2022-2601.CVE-2022-3775.12.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=22b77b87e10a3a6c9bb9885415bc9a9c678378e6"; + sha256 = "sha256-iYTEqN5997I7MVIg82jt/bbEAYhcgq8fNRCNPpY9ze0="; + }) + (fetchpatch { + name = "CVE-2022-2601.CVE-2022-3775.13.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=1514678888595ef41a968a0c69b7ff769edd1e9c"; + sha256 = "sha256-tgAEoAtaNKJjscjMFkXXiVn59Pa4c+NiQ3iVW6CMrpo="; + }) ]; postPatch = if kbdcompSupport then '' From 0dec3c6e7ee51847794b4cc18bdff52a448bcbae Mon Sep 17 00:00:00 2001 From: Artturin Date: Tue, 10 Jan 2023 18:45:34 +0200 Subject: [PATCH 02/15] nixosTests.installer: bump memorySize Without it the tests sometimes fail because the OOM killer is triggered. https://hydra.nixos.org/build/204713462 (cherry picked from commit 309ed272be60962e4465ae7b8cd2bb5cb1bc4bee) --- nixos/tests/installer.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nixos/tests/installer.nix b/nixos/tests/installer.nix index 9b3c8a762991..b80b7e3081fe 100644 --- a/nixos/tests/installer.nix +++ b/nixos/tests/installer.nix @@ -291,7 +291,7 @@ let # builds stuff in the VM, needs more juice virtualisation.diskSize = 8 * 1024; virtualisation.cores = 8; - virtualisation.memorySize = 1536; + virtualisation.memorySize = 2047; boot.initrd.systemd.enable = systemdStage1; From bac26fc6ab0a3dfa4b0a9190ad150f204e1e6a39 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Tue, 6 Dec 2022 15:33:49 +0000 Subject: [PATCH 03/15] onedrive: 2.4.21 -> 2.4.22 (cherry picked from commit 1218bada61121324257503524468e1036e7fc85b) --- pkgs/applications/networking/sync/onedrive/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/applications/networking/sync/onedrive/default.nix b/pkgs/applications/networking/sync/onedrive/default.nix index 0945de2011b0..78d5fa91ff95 100644 --- a/pkgs/applications/networking/sync/onedrive/default.nix +++ b/pkgs/applications/networking/sync/onedrive/default.nix @@ -14,13 +14,13 @@ stdenv.mkDerivation rec { pname = "onedrive"; - version = "2.4.21"; + version = "2.4.22"; src = fetchFromGitHub { owner = "abraunegg"; repo = pname; rev = "v${version}"; - hash = "sha256-KZVRLXXaJYMqHzjxTfQaD0u7n3ACBEk3fLOmqwybNhM="; + hash = "sha256-/NhZHJEu2s+HlEUb1DqRdrpvrIWrDAtle07+oXMJCdI="; }; nativeBuildInputs = [ autoreconfHook ldc installShellFiles pkg-config ]; From bc2e53e739143c59de47ba7528943fb0613f02d8 Mon Sep 17 00:00:00 2001 From: Ryan Horiguchi Date: Fri, 6 Jan 2023 00:23:09 +0100 Subject: [PATCH 04/15] onedrive: 2.4.22 -> 2.4.23 (cherry picked from commit 09696eab5da6dd3769de874ee7f02f5c2a26b279) --- pkgs/applications/networking/sync/onedrive/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/applications/networking/sync/onedrive/default.nix b/pkgs/applications/networking/sync/onedrive/default.nix index 78d5fa91ff95..d928978d3cf8 100644 --- a/pkgs/applications/networking/sync/onedrive/default.nix +++ b/pkgs/applications/networking/sync/onedrive/default.nix @@ -14,13 +14,13 @@ stdenv.mkDerivation rec { pname = "onedrive"; - version = "2.4.22"; + version = "2.4.23"; src = fetchFromGitHub { owner = "abraunegg"; repo = pname; rev = "v${version}"; - hash = "sha256-/NhZHJEu2s+HlEUb1DqRdrpvrIWrDAtle07+oXMJCdI="; + hash = "sha256-yHpjutZV2u1VhnLxsQIu0NtKnqwtoRn4TM+8tXJ4RNo="; }; nativeBuildInputs = [ autoreconfHook ldc installShellFiles pkg-config ]; From 759532b73f063a85f1ed2eeaba52220e15503a1a Mon Sep 17 00:00:00 2001 From: Michael Weiss Date: Sun, 27 Nov 2022 11:51:09 +0100 Subject: [PATCH 05/15] isync: Fix SSL error "unexpected eof while reading" This seems to be a regression of the switch to OpenSSL3 and affects at least GMail users: https://sourceforge.net/p/isync/mailman/isync-devel/thread/Y2kZ0YgS2Goayshn%40ugly/#msg37731849 Fix #202595 (cherry picked from commit 75eb0688e8f1b64d73107b4c3e9d767c55f97015) --- pkgs/tools/networking/isync/default.nix | 3 + ...r-messages-at-end-of-SSL-connections.patch | 76 +++++++++++++++++++ 2 files changed, 79 insertions(+) create mode 100644 pkgs/tools/networking/isync/work-around-unexpected-EOF-error-messages-at-end-of-SSL-connections.patch diff --git a/pkgs/tools/networking/isync/default.nix b/pkgs/tools/networking/isync/default.nix index 7b04e49da702..d5af78afb66d 100644 --- a/pkgs/tools/networking/isync/default.nix +++ b/pkgs/tools/networking/isync/default.nix @@ -15,6 +15,9 @@ stdenv.mkDerivation rec { patches = [ # Fixes "Fatal: buffer too small" error ./0001-Increase-imap_vprintf-buffer-size.patch + # Fix #202595: SSL error "Socket error: ... unexpected eof while reading" + # Source: https://sourceforge.net/p/isync/isync/ci/b6c36624f04cd388873785c0631df3f2f9ac4bf0/ + ./work-around-unexpected-EOF-error-messages-at-end-of-SSL-connections.patch ]; nativeBuildInputs = [ pkg-config perl ]; diff --git a/pkgs/tools/networking/isync/work-around-unexpected-EOF-error-messages-at-end-of-SSL-connections.patch b/pkgs/tools/networking/isync/work-around-unexpected-EOF-error-messages-at-end-of-SSL-connections.patch new file mode 100644 index 000000000000..9177085ecad7 --- /dev/null +++ b/pkgs/tools/networking/isync/work-around-unexpected-EOF-error-messages-at-end-of-SSL-connections.patch @@ -0,0 +1,76 @@ +From b6c36624f04cd388873785c0631df3f2f9ac4bf0 Mon Sep 17 00:00:00 2001 +From: Oswald Buddenhagen +Date: Mon, 6 Jun 2022 11:55:37 +0200 +Subject: [PATCH] work around "unexpected EOF" error messages at end of SSL + connections + +gmail apparently doesn't send a close notification (SSL_shutdown()) +before closing the TCP socket. +--- + src/drv_imap.c | 7 +++++-- + src/socket.c | 9 +++++++++ + src/socket.h | 1 + + 3 files changed, 15 insertions(+), 2 deletions(-) + +diff --git a/src/drv_imap.c b/src/drv_imap.c +index fb8d165..6286045 100644 +--- a/src/drv_imap.c ++++ b/src/drv_imap.c +@@ -1620,6 +1620,7 @@ imap_socket_read( void *aux ) + error( "IMAP error: unexpected BYE response: %s\n", cmd ); + /* We just wait for the server to close the connection now. */ + ctx->expectEOF = 1; ++ socket_expect_eof( &ctx->conn ); + } else { + /* We still need to wait for the LOGOUT's tagged OK. */ + } +@@ -1882,10 +1883,12 @@ static void + imap_cleanup_p2( imap_store_t *ctx, + imap_cmd_t *cmd ATTR_UNUSED, int response ) + { +- if (response == RESP_NO) ++ if (response == RESP_NO) { + imap_cancel_store( &ctx->gen ); +- else if (response == RESP_OK) ++ } else if (response == RESP_OK) { + ctx->expectEOF = 1; ++ socket_expect_eof( &ctx->conn ); ++ } + } + + /******************* imap_open_store *******************/ +diff --git a/src/socket.c b/src/socket.c +index ac3c847..892cece 100644 +--- a/src/socket.c ++++ b/src/socket.c +@@ -810,6 +810,15 @@ socket_expect_activity( conn_t *conn, int expect ) + conf_wakeup( &conn->fd_timeout, expect ? conn->conf->timeout : -1 ); + } + ++void ++socket_expect_eof( conn_t *sock ) ++{ ++#ifdef SSL_OP_IGNORE_UNEXPECTED_EOF // implies HAVE_LIBSSL ++ if (sock->ssl) ++ SSL_set_options( sock->ssl, SSL_OP_IGNORE_UNEXPECTED_EOF ); ++#endif ++} ++ + int + socket_read( conn_t *conn, char *buf, uint len ) + { +diff --git a/src/socket.h b/src/socket.h +index 5b1edd0..af679aa 100644 +--- a/src/socket.h ++++ b/src/socket.h +@@ -142,6 +142,7 @@ void socket_start_tls(conn_t *conn, void (*cb)( int ok, void *aux ) ); + void socket_start_deflate( conn_t *conn ); + void socket_close( conn_t *sock ); + void socket_expect_activity( conn_t *sock, int expect ); ++void socket_expect_eof( conn_t *sock ); + int socket_read( conn_t *sock, char *buf, uint len ); /* never waits */ + char *socket_read_line( conn_t *sock ); /* don't free return value; never waits */ + typedef enum { KeepOwn = 0, GiveOwn } ownership_t; +-- +2.38.0 + From 1b42b3fba0eb7a1d9b5589c9618cd6c981fad2af Mon Sep 17 00:00:00 2001 From: Yaya Date: Tue, 17 Jan 2023 10:58:47 +0000 Subject: [PATCH 06/15] nextcloud24: 24.0.8 -> 24.0.9 https://nextcloud.com/changelog/#latest24 (cherry picked from commit ef5f4cfd2e9ffddcd684a85e40dcfa79ff6fe758) --- pkgs/servers/nextcloud/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/servers/nextcloud/default.nix b/pkgs/servers/nextcloud/default.nix index 3c0c6d86ef9a..a012e56209c0 100644 --- a/pkgs/servers/nextcloud/default.nix +++ b/pkgs/servers/nextcloud/default.nix @@ -50,8 +50,8 @@ in { ''; nextcloud24 = generic { - version = "24.0.8"; - sha256 = "a5c3a070516debba991355e6b737b261396b15b9f2cd939617611ab0bed99299"; + version = "24.0.9"; + sha256 = "580a3384c9c09aefb8e9b41553d21a6e20001799549dbd25b31dea211d97dd1e"; }; nextcloud25 = generic { From 7f7ba60bf5709270e0063fa28f0f86a38a1c46b1 Mon Sep 17 00:00:00 2001 From: Yaya Date: Tue, 17 Jan 2023 11:00:20 +0000 Subject: [PATCH 07/15] nextcloud25: 25.0.2 -> 25.0.3 https://nextcloud.com/changelog/#latest25 (cherry picked from commit ff2fd5b4d8c5eb8084126b8b10121f8577c3cd8b) --- pkgs/servers/nextcloud/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/servers/nextcloud/default.nix b/pkgs/servers/nextcloud/default.nix index a012e56209c0..5706a40a5925 100644 --- a/pkgs/servers/nextcloud/default.nix +++ b/pkgs/servers/nextcloud/default.nix @@ -55,8 +55,8 @@ in { }; nextcloud25 = generic { - version = "25.0.2"; - sha256 = "d6ab40faa108937bda42395f570ff111f4c97343b55be1420024da3177e37d59"; + version = "25.0.3"; + sha256 = "4b2b1423736ef92469096fe24f61c24cad87a34e07c1c7a81b385d3ea25c00ec"; }; # tip: get the sha with: From b3ff1fe97da369ef4e9347fd7592c251870fbdab Mon Sep 17 00:00:00 2001 From: Sumner Evans Date: Tue, 17 Jan 2023 08:19:59 -0700 Subject: [PATCH 08/15] matrix-synapse: 1.74.0 -> 1.75.0 Signed-off-by: Sumner Evans (cherry picked from commit b9b0d3260e699de1590077812ffed6f146019ba0) --- pkgs/servers/matrix-synapse/default.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/servers/matrix-synapse/default.nix b/pkgs/servers/matrix-synapse/default.nix index 36a967220602..6f1f26c901d9 100644 --- a/pkgs/servers/matrix-synapse/default.nix +++ b/pkgs/servers/matrix-synapse/default.nix @@ -11,20 +11,20 @@ in with python3.pkgs; buildPythonApplication rec { pname = "matrix-synapse"; - version = "1.74.0"; + version = "1.75.0"; format = "pyproject"; src = fetchFromGitHub { owner = "matrix-org"; repo = "synapse"; rev = "v${version}"; - hash = "sha256-UsYodjykcLOgClHegqH598kPoGAI1Z8bLzV5LLE6yLg="; + hash = "sha256-cfvekrZRLbdsUqkkPF8hz9B4qsum1kpIL0aCnJf3HYg="; }; cargoDeps = rustPlatform.fetchCargoTarball { inherit src; name = "${pname}-${version}"; - hash = "sha256-XOW9DRUhGIs8x5tQ9l2A85sNv736uMmfC72f8FX3g/I="; + hash = "sha256-oyXgHqOrMKs+mYGAI4Wn+fuVQWsQJIkPwCY4t+cUlQ4="; }; postPatch = '' From 05cda3a4c812f18ee52ee0cd1e0790b23a202dac Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Thu, 12 Jan 2023 18:17:21 +0000 Subject: [PATCH 09/15] librewolf-unwrapped: 108.0.1-1 -> 108.0.2-1 (cherry picked from commit 4ab1d83449ee92a6954ab679d467e0b690a802fc) --- .../networking/browsers/librewolf/src.json | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/pkgs/applications/networking/browsers/librewolf/src.json b/pkgs/applications/networking/browsers/librewolf/src.json index 9955fd0a936c..ce91f2463717 100644 --- a/pkgs/applications/networking/browsers/librewolf/src.json +++ b/pkgs/applications/networking/browsers/librewolf/src.json @@ -1,11 +1,11 @@ { - "packageVersion": "108.0.1-1", + "packageVersion": "108.0.2-1", "source": { - "rev": "108.0.1-1", - "sha256": "0ix8ri2s8rnpd9nqvwlk50x9hp51y70gb3r6f7lh4ldg2bay08n0" + "rev": "108.0.2-1", + "sha256": "0mzar03yq8vphhxhjzr2n4v9jm8z5j5vaxfzby7wf42pw7p0fml6" }, "firefox": { - "version": "108.0.1", - "sha512": "e6219ed6324422ec293ed96868738e056582bb9f7fb82e59362541f3465c6ebca806d26ecd801156b074c3675bd5a22507b1f1fa53eebf82b7dd35f2b1ff0625" + "version": "108.0.2", + "sha512": "f856ef034fa4a526e19968aed092c9ee99e124d2d271ec1c1bbd091d9a03e23293d69c7a9ae17c43258cde7e73c294534b471e36441e576377854f607c9bfa3a" } } From 71fa0bf8d22b54af1c822adb83eb23547027285b Mon Sep 17 00:00:00 2001 From: Alyssa Ross Date: Tue, 17 Jan 2023 17:44:42 +0000 Subject: [PATCH 10/15] libcddb: depend on libiconv unconditionally libiconv is already defined per-platform. The actual libiconv library won't be built on platforms like Linux where it doesn't need to be, so there's no need to maintain a separate platform list here. Required to build for FreeBSD. (cherry picked from commit b6150a83b181a8c924331a44022d28db9a9aa7d6) --- pkgs/development/libraries/libcddb/default.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkgs/development/libraries/libcddb/default.nix b/pkgs/development/libraries/libcddb/default.nix index 4848f5fcc265..5c41f9fb0bf7 100644 --- a/pkgs/development/libraries/libcddb/default.nix +++ b/pkgs/development/libraries/libcddb/default.nix @@ -9,7 +9,7 @@ stdenv.mkDerivation rec { sha256 = "0fr21a7vprdyy1bq6s99m0x420c9jm5fipsd63pqv8qyfkhhxkim"; }; - buildInputs = lib.optional stdenv.isDarwin libiconv; + buildInputs = [ libiconv ]; configureFlags = lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [ "ac_cv_func_malloc_0_nonnull=yes" From 220239e2340b0c08c24c63387bfb6b9648507673 Mon Sep 17 00:00:00 2001 From: Alyssa Ross Date: Tue, 17 Jan 2023 17:45:26 +0000 Subject: [PATCH 11/15] libcddb: broaden platforms Builds fine for FreeBSD and NetBSD, and the website explicitly calls out Cygwin support. (cherry picked from commit 32b654734274f3bf14328f1b7a035507c6311dab) --- pkgs/development/libraries/libcddb/default.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkgs/development/libraries/libcddb/default.nix b/pkgs/development/libraries/libcddb/default.nix index 5c41f9fb0bf7..79c11d75db1d 100644 --- a/pkgs/development/libraries/libcddb/default.nix +++ b/pkgs/development/libraries/libcddb/default.nix @@ -23,6 +23,6 @@ stdenv.mkDerivation rec { homepage = "http://libcddb.sourceforge.net/"; license = licenses.lgpl2Plus; mainProgram = "cddb_query"; - platforms = platforms.linux ++ platforms.darwin; + platforms = platforms.unix; }; } From 4d9e91346f6e4487dd5533e2d3bf589ee8d061d6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= Date: Wed, 18 Jan 2023 11:45:48 +0100 Subject: [PATCH 12/15] Revert "nixosTests.installer: bump memorySize" This reverts commit 309ed272be60962e4465ae7b8cd2bb5cb1bc4bee. The bump caused nixosTests.installer.luksroot hang, e.g. see https://hydra.nixos.org/build/205951019 (I don't know why.) The OOM issues were avoided by 6dccdc45851 (newer but merged earlier) (cherry picked from commit 2b988c76fd3b6f1f1117b419a83589fb7cea14bf) --- nixos/tests/installer.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nixos/tests/installer.nix b/nixos/tests/installer.nix index b80b7e3081fe..9b3c8a762991 100644 --- a/nixos/tests/installer.nix +++ b/nixos/tests/installer.nix @@ -291,7 +291,7 @@ let # builds stuff in the VM, needs more juice virtualisation.diskSize = 8 * 1024; virtualisation.cores = 8; - virtualisation.memorySize = 2047; + virtualisation.memorySize = 1536; boot.initrd.systemd.enable = systemdStage1; From fdb662147d5a142156a870705ece800bf1e376f4 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Wed, 18 Jan 2023 17:12:13 +0100 Subject: [PATCH 13/15] gitlab: 15.7.3 -> 15.7.5 (#211403) https://about.gitlab.com/releases/2023/01/17/critical-security-release-gitlab-15-7-5-released/ (cherry picked from commit da867f0a02c5c33c39d8238b50188e0963be631d) Co-authored-by: Alexander Sieg --- .../applications/version-management/gitlab/data.json | 12 ++++++------ .../version-management/gitlab/gitaly/default.nix | 4 ++-- .../gitlab/gitlab-workhorse/default.nix | 2 +- 3 files changed, 9 insertions(+), 9 deletions(-) diff --git a/pkgs/applications/version-management/gitlab/data.json b/pkgs/applications/version-management/gitlab/data.json index f3409d88ec70..a36dc3bc2503 100644 --- a/pkgs/applications/version-management/gitlab/data.json +++ b/pkgs/applications/version-management/gitlab/data.json @@ -1,14 +1,14 @@ { - "version": "15.7.3", - "repo_hash": "sha256-uB9LC5S/zxb8fwwvLjKRkZ1DOVKLnjYKAE2LeHXdP5E=", + "version": "15.7.5", + "repo_hash": "sha256-zo1b82y114NpX43rJAWQmUhORM1kQxyiSnonqPUQJmY=", "yarn_hash": "086v3lr4hnz8z8pla1d3mi2smldidmx2z2cmffn830ianpqkk83l", "owner": "gitlab-org", "repo": "gitlab", - "rev": "v15.7.3-ee", + "rev": "v15.7.5-ee", "passthru": { - "GITALY_SERVER_VERSION": "15.7.3", - "GITLAB_PAGES_VERSION": "15.7.3", + "GITALY_SERVER_VERSION": "15.7.5", + "GITLAB_PAGES_VERSION": "15.7.5", "GITLAB_SHELL_VERSION": "14.14.0", - "GITLAB_WORKHORSE_VERSION": "15.7.3" + "GITLAB_WORKHORSE_VERSION": "15.7.5" } } diff --git a/pkgs/applications/version-management/gitlab/gitaly/default.nix b/pkgs/applications/version-management/gitlab/gitaly/default.nix index 3cc28e49ba24..9f217aa65f34 100644 --- a/pkgs/applications/version-management/gitlab/gitaly/default.nix +++ b/pkgs/applications/version-management/gitlab/gitaly/default.nix @@ -11,7 +11,7 @@ let gemdir = ./.; }; - version = "15.7.3"; + version = "15.7.5"; package_version = "v${lib.versions.major version}"; gitaly_package = "gitlab.com/gitlab-org/gitaly/${package_version}"; @@ -22,7 +22,7 @@ let owner = "gitlab-org"; repo = "gitaly"; rev = "v${version}"; - sha256 = "sha256-AcEjwq5dcNsPc3wQJNU1oiGAAqWIFNk8868Xw5ZC/g8="; + sha256 = "sha256-FT77MUcErc/16tChwyNczCLtADTOEzKKTsTlhLI6aV8="; }; vendorSha256 = "sha256-UEEM0mv7d0gmDcsSKbeh4JcTnX4f5oogZnhRpqaNxwY="; diff --git a/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix b/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix index 53c9db51a6df..b164076c28b6 100644 --- a/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix +++ b/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix @@ -5,7 +5,7 @@ in buildGoModule rec { pname = "gitlab-workhorse"; - version = "15.7.3"; + version = "15.7.5"; src = fetchFromGitLab { owner = data.owner; From db157cca83d39cc711699363cacf0954cdb29b27 Mon Sep 17 00:00:00 2001 From: Pierre Bourdon Date: Wed, 18 Jan 2023 17:27:40 +0100 Subject: [PATCH 14/15] sudo: 1.9.12p1 -> 1.9.12p2 (cherry picked from commit b2816206ff5e47ec6e981e932ca9d6142222a29b) --- pkgs/tools/security/sudo/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/tools/security/sudo/default.nix b/pkgs/tools/security/sudo/default.nix index eb55297f643b..d3885acee018 100644 --- a/pkgs/tools/security/sudo/default.nix +++ b/pkgs/tools/security/sudo/default.nix @@ -14,11 +14,11 @@ stdenv.mkDerivation rec { pname = "sudo"; - version = "1.9.12p1"; + version = "1.9.12p2"; src = fetchurl { url = "https://www.sudo.ws/dist/${pname}-${version}.tar.gz"; - hash = "sha256-R1oYqOs9qLKRfOqwY6a69R6gkSjDxH4+DjOrdJe6t9g="; + hash = "sha256-uaCxrg8d3Zvn8+r+cL4F7oH1cvb1NmMsRM1BAbsqhTk="; }; prePatch = '' From 90e9640a66fb435e67c714b115ad3e421c4f4342 Mon Sep 17 00:00:00 2001 From: Alyssa Ross Date: Wed, 18 Jan 2023 12:07:00 +0000 Subject: [PATCH 15/15] perl: don't use libxcrypt on FreeBSD Tested by building pkgsCross.x86_64-freebsd.perl from x86_64-linux. (cherry picked from commit b0997077e77465b0773339b0bd643d424c771fa5) --- pkgs/development/interpreters/perl/default.nix | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/pkgs/development/interpreters/perl/default.nix b/pkgs/development/interpreters/perl/default.nix index 4d95ebf2052b..ce7947a842ca 100644 --- a/pkgs/development/interpreters/perl/default.nix +++ b/pkgs/development/interpreters/perl/default.nix @@ -36,7 +36,16 @@ let optional crossCompiling "mini"; setOutputFlags = false; - propagatedBuildInputs = lib.optional enableCrypt libxcrypt; + # On FreeBSD, if Perl is built with threads support, having + # libxcrypt available will result in a build failure, because + # perl.h will get conflicting definitions of struct crypt_data + # from libc's unistd.h and libxcrypt's crypt.h. + # + # FreeBSD Ports has the same issue building the perl port if + # the libxcrypt port has been installed. + # + # Without libxcrypt, Perl will still find FreeBSD's crypt functions. + propagatedBuildInputs = lib.optional (enableCrypt && !stdenv.isFreeBSD) libxcrypt; disallowedReferences = [ stdenv.cc ];