From 3ef319a54cf7d96b80922b9a7cc56460ee9e48fa Mon Sep 17 00:00:00 2001 From: Pavol Rusnak Date: Sat, 9 Nov 2019 18:47:33 +0100 Subject: [PATCH 01/57] monero: 0.14.1.0 -> 0.15.0.0 (cherry picked from commit 6cc03f3418964075a58224e6eca2ef3996a0aa88) --- .../blockchains/monero/default.nix | 28 +++++++++---------- 1 file changed, 13 insertions(+), 15 deletions(-) diff --git a/pkgs/applications/blockchains/monero/default.nix b/pkgs/applications/blockchains/monero/default.nix index b6f074528616..ce8cf509299b 100644 --- a/pkgs/applications/blockchains/monero/default.nix +++ b/pkgs/applications/blockchains/monero/default.nix @@ -1,5 +1,5 @@ -{ stdenv, fetchgit -, cmake, pkgconfig, git +{ stdenv, fetchFromGitHub +, cmake, pkgconfig , boost, miniupnpc, openssl, unbound, cppzmq , zeromq, pcsclite, readline, libsodium, hidapi , python3Packages @@ -8,36 +8,34 @@ assert stdenv.isDarwin -> IOKit != null; -with stdenv.lib; - stdenv.mkDerivation rec { pname = "monero"; - version = "0.14.1.0"; + version = "0.15.0.0"; - src = fetchgit { - url = "https://github.com/monero-project/monero.git"; - rev = "v${version}"; - sha256 = "1asa197fad81jfv12qgaa7y7pdr1r1pda96m9pvivkh4v30cx0nh"; + src = fetchFromGitHub { + owner = "monero-project"; + repo = "monero"; + rev = "v${version}"; + sha256 = "19y4kcj4agws7swfa3draysb1y18c3xb13r8cg0faxx1dlm0zbnr"; + fetchSubmodules = true; }; - nativeBuildInputs = [ cmake pkgconfig git ]; + nativeBuildInputs = [ cmake pkgconfig ]; buildInputs = [ boost miniupnpc openssl unbound cppzmq zeromq pcsclite readline libsodium hidapi python3Packages.protobuf - ] ++ optionals stdenv.isDarwin [ IOKit CoreData PCSC ]; + ] ++ stdenv.lib.optionals stdenv.isDarwin [ IOKit CoreData PCSC ]; cmakeFlags = [ "-DCMAKE_BUILD_TYPE=Release" "-DBUILD_GUI_DEPS=ON" "-DReadline_ROOT_DIR=${readline.dev}" - ] ++ optional stdenv.isDarwin "-DBoost_USE_MULTITHREADED=OFF"; + ] ++ stdenv.lib.optional stdenv.isDarwin "-DBoost_USE_MULTITHREADED=OFF"; - hardeningDisable = [ "fortify" ]; - - meta = { + meta = with stdenv.lib; { description = "Private, secure, untraceable currency"; homepage = https://getmonero.org/; license = licenses.bsd3; From 95799c88d7adef606e8c69f0186c81f50eae63b3 Mon Sep 17 00:00:00 2001 From: rnhmjoj Date: Sun, 10 Nov 2019 15:44:56 +0100 Subject: [PATCH 02/57] monero: add missing deps (cherry picked from commit 039d299810ba64bf53a7d08713bdcc49370e6d2a) --- pkgs/applications/blockchains/monero/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/applications/blockchains/monero/default.nix b/pkgs/applications/blockchains/monero/default.nix index ce8cf509299b..b526fb61a62e 100644 --- a/pkgs/applications/blockchains/monero/default.nix +++ b/pkgs/applications/blockchains/monero/default.nix @@ -2,7 +2,7 @@ , cmake, pkgconfig , boost, miniupnpc, openssl, unbound, cppzmq , zeromq, pcsclite, readline, libsodium, hidapi -, python3Packages +, python3Packages, randomx, rapidjson , CoreData, IOKit, PCSC }: @@ -25,7 +25,7 @@ stdenv.mkDerivation rec { buildInputs = [ boost miniupnpc openssl unbound cppzmq zeromq pcsclite readline - libsodium hidapi + libsodium hidapi randomx rapidjson python3Packages.protobuf ] ++ stdenv.lib.optionals stdenv.isDarwin [ IOKit CoreData PCSC ]; From 90e94cff33c147735de58a1911403605773eeff8 Mon Sep 17 00:00:00 2001 From: rnhmjoj Date: Sun, 10 Nov 2019 15:46:15 +0100 Subject: [PATCH 03/57] randomx: init at 1.1.6 (cherry picked from commit 8dd85714c0090af415ed35141e6f25646f326323) This is needed to update monero-gui --- .../development/libraries/randomx/default.nix | 24 +++++++++++++++++++ pkgs/top-level/all-packages.nix | 2 ++ 2 files changed, 26 insertions(+) create mode 100644 pkgs/development/libraries/randomx/default.nix diff --git a/pkgs/development/libraries/randomx/default.nix b/pkgs/development/libraries/randomx/default.nix new file mode 100644 index 000000000000..79ce9e413248 --- /dev/null +++ b/pkgs/development/libraries/randomx/default.nix @@ -0,0 +1,24 @@ +{ stdenv, fetchFromGitHub, cmake }: + +stdenv.mkDerivation rec { + pname = "randomX"; + version = "1.1.6"; + + nativeBuildInputs = [ cmake ]; + + src = fetchFromGitHub { + owner = "tevador"; + repo = pname; + rev = "v${version}"; + sha256 = "1qd0rbzgxdy87wwy0n6ca29bcq25j5ndnfgmx8iyf225m4rcwngf"; + }; + + meta = with stdenv.lib; { + description = "Proof of work algorithm based on random code execution"; + homepage = https://github.com/tevador/RandomX; + license = licenses.bsd3; + maintainers = with maintainers; [ rnhmjoj ]; + platforms = platforms.unix; + }; + +} diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index a2f4e9a4adc5..f84cd1696a9e 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -13397,6 +13397,8 @@ in qgnomeplatform = libsForQt5.callPackage ../development/libraries/qgnomeplatform { }; + randomx = callPackage ../development/libraries/randomx { }; + resolv_wrapper = callPackage ../development/libraries/resolv_wrapper { }; rhino = callPackage ../development/libraries/java/rhino { From 2634153ff9ac3ff3246128dd2e0052a91bd493be Mon Sep 17 00:00:00 2001 From: rnhmjoj Date: Sun, 10 Nov 2019 15:46:49 +0100 Subject: [PATCH 04/57] monero-gui: 0.14.1.2 -> 0.15.0.0 (cherry picked from commit c2402b1d13086389e90026e05e225040aacc28c1) --- .../blockchains/monero-gui/default.nix | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/pkgs/applications/blockchains/monero-gui/default.nix b/pkgs/applications/blockchains/monero-gui/default.nix index 92f6f0080219..dde324b39e13 100644 --- a/pkgs/applications/blockchains/monero-gui/default.nix +++ b/pkgs/applications/blockchains/monero-gui/default.nix @@ -1,27 +1,27 @@ -{ mkDerivation, lib, makeDesktopItem, fetchFromGitHub +{ stdenv, wrapQtAppsHook, makeDesktopItem, fetchFromGitHub , qtbase, qmake, qtmultimedia, qttools , qtgraphicaleffects, qtdeclarative , qtlocation, qtquickcontrols, qtquickcontrols2 , qtwebchannel, qtwebengine, qtx11extras, qtxmlpatterns , monero, unbound, readline, boost, libunwind , libsodium, pcsclite, zeromq, cppzmq, pkgconfig -, hidapi +, hidapi, randomx }: -with lib; +with stdenv.lib; -mkDerivation rec { +stdenv.mkDerivation rec { pname = "monero-gui"; - version = "0.14.1.2"; + version = "0.15.0.0"; src = fetchFromGitHub { owner = "monero-project"; repo = "monero-gui"; rev = "v${version}"; - sha256 = "1rm043r6y2mzy8pclnzbjjfxgps8pkfa2b92p66k8y8rdmgq6m1k"; + sha256 = "1shpnly2dym5jhvk8zk10p69mz062dihx979djg74q6hgkhhhqsh"; }; - nativeBuildInputs = [ qmake pkgconfig ]; + nativeBuildInputs = [ qmake pkgconfig wrapQtAppsHook ]; buildInputs = [ qtbase qtmultimedia qtgraphicaleffects @@ -30,7 +30,7 @@ mkDerivation rec { qtwebchannel qtwebengine qtx11extras qtxmlpatterns monero unbound readline boost libunwind libsodium pcsclite zeromq - cppzmq hidapi + cppzmq hidapi randomx ]; patches = [ ./move-log-file.patch ]; From f1a6aa98e4b89079958d47411307419e52a7d93f Mon Sep 17 00:00:00 2001 From: Johan Thomsen Date: Thu, 14 Nov 2019 09:55:43 +0100 Subject: [PATCH 05/57] kubernetes: 1.15.4 -> 1.15.6 --- pkgs/applications/networking/cluster/kubernetes/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/applications/networking/cluster/kubernetes/default.nix b/pkgs/applications/networking/cluster/kubernetes/default.nix index 1ad7ad3e393d..d2ec11042ed3 100644 --- a/pkgs/applications/networking/cluster/kubernetes/default.nix +++ b/pkgs/applications/networking/cluster/kubernetes/default.nix @@ -15,13 +15,13 @@ with lib; stdenv.mkDerivation rec { pname = "kubernetes"; - version = "1.15.4"; + version = "1.15.6"; src = fetchFromGitHub { owner = "kubernetes"; repo = "kubernetes"; rev = "v${version}"; - sha256 = "18wpqrgb1ils4g8ggg217xq4jq30i4m7par2mdjk59pmz7ssm25p"; + sha256 = "1sk76ddhpiv0b2jhmlf3d38y6p64fgj4cpg9d3h92lmah3fqndgk"; }; buildInputs = [ removeReferencesTo makeWrapper which go rsync go-bindata ]; From 130b6f8fc9abca076e31349c8780ba0a4b57e25c Mon Sep 17 00:00:00 2001 From: Will Dietz Date: Wed, 18 Sep 2019 15:38:29 -0500 Subject: [PATCH 06/57] microcodeIntel: 20190618 -> 20190918 (cherry picked from commit d1e1b922fb1e4bf22f4e9f2db3db4bd21cb4139e) --- pkgs/os-specific/linux/microcode/intel.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/os-specific/linux/microcode/intel.nix b/pkgs/os-specific/linux/microcode/intel.nix index 07d6dcb4a5f7..0196718cfd05 100644 --- a/pkgs/os-specific/linux/microcode/intel.nix +++ b/pkgs/os-specific/linux/microcode/intel.nix @@ -2,13 +2,13 @@ stdenv.mkDerivation rec { pname = "microcode-intel"; - version = "20190618"; + version = "20190918"; src = fetchFromGitHub { owner = "intel"; repo = "Intel-Linux-Processor-Microcode-Data-Files"; rev = "microcode-${version}"; - sha256 = "0fdhrpxvsq0rm5mzj82gvmfb3lm7mhc9hwvimv7dl1jaidbp6lvs"; + sha256 = "0v668mfqxn6wzyng68aqaffh75gc215k13n6d5g7zisivvv2bgdp"; }; nativeBuildInputs = [ iucode-tool libarchive ]; From 9ef879befb01a0bb4540f370dd5339e019b88205 Mon Sep 17 00:00:00 2001 From: Will Dietz Date: Tue, 12 Nov 2019 12:35:48 -0600 Subject: [PATCH 07/57] microcodeIntel: 20190918 -> 20191112 https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/releases/tag/microcode-20191112 (cherry picked from commit 911fe47772e0cb4a1a037bb2d1fcf9169ad5aa14) --- pkgs/os-specific/linux/microcode/intel.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/os-specific/linux/microcode/intel.nix b/pkgs/os-specific/linux/microcode/intel.nix index 0196718cfd05..bf76ec74b0ff 100644 --- a/pkgs/os-specific/linux/microcode/intel.nix +++ b/pkgs/os-specific/linux/microcode/intel.nix @@ -2,13 +2,13 @@ stdenv.mkDerivation rec { pname = "microcode-intel"; - version = "20190918"; + version = "20191112"; src = fetchFromGitHub { owner = "intel"; repo = "Intel-Linux-Processor-Microcode-Data-Files"; rev = "microcode-${version}"; - sha256 = "0v668mfqxn6wzyng68aqaffh75gc215k13n6d5g7zisivvv2bgdp"; + sha256 = "059hkl172kk5gcsv87z02vh3vdayk63qa6m6yrsipi1203dmyvzw"; }; nativeBuildInputs = [ iucode-tool libarchive ]; From c71ea1816108d1cee1ddac7df4b33b46347466fd Mon Sep 17 00:00:00 2001 From: Andreas Wiese Date: Thu, 14 Nov 2019 10:22:11 +0100 Subject: [PATCH 08/57] microcodeIntel: 20191112 -> 20191113 https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/releases/tag/microcode-20191113 (cherry picked from commit 9811d579ce5eedd88a41718764e4b0428f7e9117) --- pkgs/os-specific/linux/microcode/intel.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/os-specific/linux/microcode/intel.nix b/pkgs/os-specific/linux/microcode/intel.nix index bf76ec74b0ff..4ada201263f8 100644 --- a/pkgs/os-specific/linux/microcode/intel.nix +++ b/pkgs/os-specific/linux/microcode/intel.nix @@ -2,13 +2,13 @@ stdenv.mkDerivation rec { pname = "microcode-intel"; - version = "20191112"; + version = "20191113"; src = fetchFromGitHub { owner = "intel"; repo = "Intel-Linux-Processor-Microcode-Data-Files"; rev = "microcode-${version}"; - sha256 = "059hkl172kk5gcsv87z02vh3vdayk63qa6m6yrsipi1203dmyvzw"; + sha256 = "04138j9n14197ybkh2vxfjy21wcgvbd183ya4b6k262y9nzjmvsa"; }; nativeBuildInputs = [ iucode-tool libarchive ]; From dd00d0f2ca6195bd5eee5e1b0b1c2a57fa860e5f Mon Sep 17 00:00:00 2001 From: Michael Weiss Date: Thu, 14 Nov 2019 15:26:28 +0100 Subject: [PATCH 09/57] signal-desktop: 1.27.4 -> 1.28.0 (cherry picked from commit 7b77666eb1e4ba5731c84551f50a7e55c3d8095f) Reason: Avoid an expired (unusable) release in the stable release (Signal-Desktop releases expire after 90 days). --- .../networking/instant-messengers/signal-desktop/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix b/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix index 9f1089d7889d..7bb1137c69b0 100644 --- a/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix +++ b/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix @@ -58,7 +58,7 @@ let in stdenv.mkDerivation rec { pname = "signal-desktop"; - version = "1.27.4"; # Please backport all updates to the stable channel. + version = "1.28.0"; # Please backport all updates to the stable channel. # All releases have a limited lifetime and "expire" 90 days after the release. # When releases "expire" the application becomes unusable until an update is # applied. The expiration date for the current release can be extracted with: @@ -68,7 +68,7 @@ in stdenv.mkDerivation rec { src = fetchurl { url = "https://updates.signal.org/desktop/apt/pool/main/s/signal-desktop/signal-desktop_${version}_amd64.deb"; - sha256 = "1aza1s70xzx9qkv7b5mpfi4zgdn5dq3rl03lx3jixij3x3pxg5sj"; + sha256 = "14cd635fax99l5jk70jy0mjnvw01b0gbv666szc4ajamm36l2bkr"; }; phases = [ "unpackPhase" "installPhase" ]; From 791e3871a783e6d944b3f3d3e943fbfa0a422e3f Mon Sep 17 00:00:00 2001 From: PsyanticY Date: Tue, 12 Nov 2019 12:43:04 +0100 Subject: [PATCH 10/57] nixos/grafana: fix smtp enable typo (cherry picked from commit 1f6fbc922ff580e9ae03d00909d494e26c4f0179) --- nixos/modules/services/monitoring/grafana.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nixos/modules/services/monitoring/grafana.nix b/nixos/modules/services/monitoring/grafana.nix index bf1084eecc3a..0f8bc2471e33 100644 --- a/nixos/modules/services/monitoring/grafana.nix +++ b/nixos/modules/services/monitoring/grafana.nix @@ -43,7 +43,7 @@ let ANALYTICS_REPORTING_ENABLED = boolToString cfg.analytics.reporting.enable; - SMTP_ENABLE = boolToString cfg.smtp.enable; + SMTP_ENABLED = boolToString cfg.smtp.enable; SMTP_HOST = cfg.smtp.host; SMTP_USER = cfg.smtp.user; SMTP_PASSWORD = cfg.smtp.password; From 9705b6b8447d4eef620c27aa22e3871d6c0a9e9c Mon Sep 17 00:00:00 2001 From: "Tristan Helmich (omniIT)" Date: Wed, 13 Nov 2019 10:56:32 +0000 Subject: [PATCH 11/57] davmail: 5.2.0 -> 5.4.0 (cherry picked from commit 538815313cb935210f6ee0863fcb16dcefc88999) New release contains bug/security fixes. --- pkgs/applications/networking/davmail/default.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/applications/networking/davmail/default.nix b/pkgs/applications/networking/davmail/default.nix index 589cd04057ee..a84de6380668 100644 --- a/pkgs/applications/networking/davmail/default.nix +++ b/pkgs/applications/networking/davmail/default.nix @@ -2,10 +2,10 @@ stdenv.mkDerivation rec { pname = "davmail"; - version = "5.2.0"; + version = "5.4.0"; src = fetchurl { - url = "mirror://sourceforge/${pname}/${version}/${pname}-${version}-2961.zip"; - sha256 = "0jw6sjg7k7zg8ab0srz6cjjj5hnw5ppxx1w35sw055dlg54fh2m5"; + url = "mirror://sourceforge/${pname}/${version}/${pname}-${version}-3135.zip"; + sha256 = "05n2j5canh046744arvni6yfdsandvjkld93w3p7rg116jrh19gq"; }; sourceRoot = "."; From 83c85b548f5779850d4d2b4cde05afceb5ecf086 Mon Sep 17 00:00:00 2001 From: Nathan van Doorn Date: Thu, 14 Nov 2019 20:19:14 +0100 Subject: [PATCH 12/57] intecture-cli: use openssl 1.0.2 (#70614) (cherry picked from commit 00c866bf6278b33ef1988d292aedb0379973abd4) --- pkgs/top-level/all-packages.nix | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index 56f10349bc78..a0f59873880e 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -3961,7 +3961,9 @@ in intecture-auth = callPackage ../tools/admin/intecture/auth.nix { }; - intecture-cli = callPackage ../tools/admin/intecture/cli.nix { }; + intecture-cli = callPackage ../tools/admin/intecture/cli.nix { + openssl = openssl_1_0_2; + }; intel-media-sdk = callPackage ../development/libraries/intel-media-sdk { }; From 872b6a2f50e384f9df1e5f649c48b92b291f6b21 Mon Sep 17 00:00:00 2001 From: Jan Solanti Date: Sat, 12 Oct 2019 23:18:35 +0300 Subject: [PATCH 13/57] renderdoc: 1.4 -> 1.5 Backport of #71057 Close #71961 (cherry picked from commit 392b36cc9fe543b41a100bc229192839ba236a64) --- .../graphics/renderdoc/default.nix | 36 +++++++++++-------- 1 file changed, 21 insertions(+), 15 deletions(-) diff --git a/pkgs/applications/graphics/renderdoc/default.nix b/pkgs/applications/graphics/renderdoc/default.nix index 594429503a35..426985d312c7 100644 --- a/pkgs/applications/graphics/renderdoc/default.nix +++ b/pkgs/applications/graphics/renderdoc/default.nix @@ -1,32 +1,34 @@ -{ stdenv, fetchFromGitHub, cmake, pkgconfig +{ stdenv, fetchFromGitHub, cmake, pkgconfig, mkDerivation , qtbase, qtx11extras, qtsvg, makeWrapper -, vulkan-loader, xorg -, python3, bison, pcre, automake, autoconf +, vulkan-loader, xorg, python3, python3Packages +, bison, pcre, automake, autoconf, addOpenGLRunpath }: let custom_swig = fetchFromGitHub { owner = "baldurk"; repo = "swig"; - rev = "renderdoc-modified-6"; - sha256 = "00ykqlzx1k9iwqjlc54kfch7cnzsj53hxn7ql70dj3rxqzrnadc0"; + rev = "renderdoc-modified-7"; + sha256 = "15r2m5kcs0id64pa2fsw58qll3jyh71jzc04wy20pgsh2326zis6"; }; + pythonPackages = python3Packages; in -stdenv.mkDerivation rec { - version = "1.4"; +mkDerivation rec { + version = "1.5"; pname = "renderdoc"; src = fetchFromGitHub { owner = "baldurk"; repo = "renderdoc"; rev = "v${version}"; - sha256 = "1iann73r4yzkwnm13h4zqipqrp5i5cnkv27yyap0axz6h3npw94r"; + sha256 = "0a05f6qfq90wrf4fixchp9knx4nhqhwjxl02n03a7k56xzxxnlci"; }; buildInputs = [ qtbase qtsvg xorg.libpthreadstubs xorg.libXdmcp qtx11extras vulkan-loader python3 - ]; + ]; # ++ (with pythonPackages; [pyside2 pyside2-tools shiboken2]); + # TODO: figure out how to make cmake recognise pyside2 - nativeBuildInputs = [ cmake makeWrapper pkgconfig bison pcre automake autoconf ]; + nativeBuildInputs = [ cmake makeWrapper pkgconfig bison pcre automake autoconf addOpenGLRunpath ]; postUnpack = '' cp -r ${custom_swig} swig @@ -40,19 +42,23 @@ stdenv.mkDerivation rec { "-DBUILD_VERSION_DIST_VER=${version}" "-DBUILD_VERSION_DIST_CONTACT=https://github.com/NixOS/nixpkgs/tree/master/pkgs/applications/graphics/renderdoc" "-DBUILD_VERSION_STABLE=ON" - # TODO: add once pyside2 is in nixpkgs - #"-DPYSIDE2_PACKAGE_DIR=${python36Packages.pyside2}" ]; - # Future work: define these in the above array via placeholders + # TODO: define these in the above array via placeholders, once those are widely supported preConfigure = '' cmakeFlags+=" -DVULKAN_LAYER_FOLDER=$out/share/vulkan/implicit_layer.d/" cmakeFlags+=" -DRENDERDOC_SWIG_PACKAGE=$PWD/../swig" ''; + dontWrapQtApps = true; preFixup = '' - wrapProgram $out/bin/qrenderdoc --suffix LD_LIBRARY_PATH : $out/lib --suffix LD_LIBRARY_PATH : ${vulkan-loader}/lib - wrapProgram $out/bin/renderdoccmd --suffix LD_LIBRARY_PATH : $out/lib --suffix LD_LIBRARY_PATH : ${vulkan-loader}/lib + wrapQtApp $out/bin/qrenderdoc --suffix LD_LIBRARY_PATH : "$out/lib:${vulkan-loader}/lib" + wrapProgram $out/bin/renderdoccmd --suffix LD_LIBRARY_PATH : "$out/lib:${vulkan-loader}/lib" + ''; + + # The only documentation for this so far is in pkgs/build-support/add-opengl-runpath/setup-hook.sh + postFixup = '' + addOpenGLRunpath $out/lib/librenderdoc.so ''; enableParallelBuilding = true; From 259a67ca2217f3cd14a1549b1fd44d8273a9a94f Mon Sep 17 00:00:00 2001 From: David Kleuker Date: Fri, 15 Nov 2019 00:32:09 +0100 Subject: [PATCH 14/57] doc/rl-1909: fix language Backport of #71516 (cherry picked from commit d793d53b0d829090b8a38b14384dfcaae9ab1ae5) --- nixos/doc/manual/release-notes/rl-1909.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nixos/doc/manual/release-notes/rl-1909.xml b/nixos/doc/manual/release-notes/rl-1909.xml index 8bd353a34304..4102fe206e19 100644 --- a/nixos/doc/manual/release-notes/rl-1909.xml +++ b/nixos/doc/manual/release-notes/rl-1909.xml @@ -543,7 +543,7 @@ The option is unsupported in combination with - in anticipation of defaulting to it by default. + in anticipation of defaulting to it. It has to be set to false and enabled per interface with From a7ba33139af00b8e0eb9e198f545a9834c8b5461 Mon Sep 17 00:00:00 2001 From: kolaente Date: Thu, 14 Nov 2019 20:09:55 +0100 Subject: [PATCH 15/57] gitea: 1.9.5 -> 1.9.6 (cherry picked from commit c5939e67cddccbed848588ba7d50c5b05041f0e3) --- pkgs/applications/version-management/gitea/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/applications/version-management/gitea/default.nix b/pkgs/applications/version-management/gitea/default.nix index 6a7a42bacc11..4ee67a6a1ef3 100644 --- a/pkgs/applications/version-management/gitea/default.nix +++ b/pkgs/applications/version-management/gitea/default.nix @@ -8,13 +8,13 @@ with stdenv.lib; buildGoPackage rec { pname = "gitea"; - version = "1.9.5"; + version = "1.9.6"; src = fetchFromGitHub { owner = "go-gitea"; repo = "gitea"; rev = "v${version}"; - sha256 = "07isawbasshkgij2mh7pmp6h3ns758ysflngr18z0k2m38ny9h31"; + sha256 = "0ql6hrrc339hrik4yk26bjn5x167c5q4s10kjld5fsgmn2k1nhdb"; # Required to generate the same checksum on MacOS due to unicode encoding differences # More information: https://github.com/NixOS/nixpkgs/pull/48128 extraPostFetch = '' From fdad708700dfc1f2869276981bbbbbdcac550b10 Mon Sep 17 00:00:00 2001 From: Leonhard Markert Date: Tue, 5 Nov 2019 11:57:05 +0100 Subject: [PATCH 16/57] lorri: init at version unstable-2019-10-30 (cherry picked from commit ceccff3439fdbb11ac2025bdd4578970f3c49e28) --- nixos/tests/all-tests.nix | 1 + nixos/tests/lorri/builder.sh | 3 + nixos/tests/lorri/default.nix | 24 ++++++++ nixos/tests/lorri/fake-shell.nix | 5 ++ pkgs/tools/misc/lorri/default.nix | 56 +++++++++++++++++++ .../misc/lorri/runtime-closure.nix.template | 37 ++++++++++++ pkgs/tools/misc/lorri/runtime.nix | 33 +++++++++++ pkgs/top-level/all-packages.nix | 5 +- 8 files changed, 163 insertions(+), 1 deletion(-) create mode 100644 nixos/tests/lorri/builder.sh create mode 100644 nixos/tests/lorri/default.nix create mode 100644 nixos/tests/lorri/fake-shell.nix create mode 100644 pkgs/tools/misc/lorri/default.nix create mode 100644 pkgs/tools/misc/lorri/runtime-closure.nix.template create mode 100644 pkgs/tools/misc/lorri/runtime.nix diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix index 60762de76d33..f0a0414a81ca 100644 --- a/nixos/tests/all-tests.nix +++ b/nixos/tests/all-tests.nix @@ -153,6 +153,7 @@ in login = handleTest ./login.nix {}; loki = handleTest ./loki.nix {}; #logstash = handleTest ./logstash.nix {}; + lorri = handleTest ./lorri/default.nix {}; mailcatcher = handleTest ./mailcatcher.nix {}; mathics = handleTest ./mathics.nix {}; matrix-synapse = handleTest ./matrix-synapse.nix {}; diff --git a/nixos/tests/lorri/builder.sh b/nixos/tests/lorri/builder.sh new file mode 100644 index 000000000000..b586b2bf7985 --- /dev/null +++ b/nixos/tests/lorri/builder.sh @@ -0,0 +1,3 @@ +#!/bin/sh + +printf "%s" "${name:?}" > "${out:?}" diff --git a/nixos/tests/lorri/default.nix b/nixos/tests/lorri/default.nix new file mode 100644 index 000000000000..d5bb979789a6 --- /dev/null +++ b/nixos/tests/lorri/default.nix @@ -0,0 +1,24 @@ +import ../make-test.nix { + machine = { pkgs, ... }: { + imports = [ ../../modules/profiles/minimal.nix ]; + environment.systemPackages = [ pkgs.lorri ]; + }; + + testScript = '' + # Copy files over + $machine->succeed( + "cp '${./fake-shell.nix}' shell.nix", + "cp '${./builder.sh}' builder.sh" + ); + + # Start the daemon and wait until it is ready + $machine->execute("lorri daemon > lorri.stdout 2> lorri.stderr &"); + $machine->waitUntilSucceeds("grep --fixed-strings 'lorri: ready' lorri.stdout"); + + # Ping the daemon + $machine->execute("lorri ping_ \$(readlink -f shell.nix)"); + + # Wait for the daemon to finish the build + $machine->waitUntilSucceeds("grep --fixed-strings 'OutputPaths' lorri.stdout"); + ''; +} diff --git a/nixos/tests/lorri/fake-shell.nix b/nixos/tests/lorri/fake-shell.nix new file mode 100644 index 000000000000..9de9d247e542 --- /dev/null +++ b/nixos/tests/lorri/fake-shell.nix @@ -0,0 +1,5 @@ +derivation { + system = builtins.currentSystem; + name = "fake-shell"; + builder = ./builder.sh; +} diff --git a/pkgs/tools/misc/lorri/default.nix b/pkgs/tools/misc/lorri/default.nix new file mode 100644 index 000000000000..914578c47ec9 --- /dev/null +++ b/pkgs/tools/misc/lorri/default.nix @@ -0,0 +1,56 @@ +{ stdenv +, pkgs +, fetchFromGitHub +, rustPlatform + # Updater script +, runtimeShell +, writeScript + # Tests +, nixosTests + # Apple dependencies +, CoreServices +, Security +, cf-private +}: + +rustPlatform.buildRustPackage rec { + pname = "lorri"; + version = "unstable-2019-10-30"; + + meta = with stdenv.lib; { + description = "Your project's nix-env"; + homepage = "https://github.com/target/lorri"; + license = licenses.asl20; + maintainers = with maintainers; [ grahamc Profpatsch ]; + }; + + src = fetchFromGitHub { + owner = "target"; + repo = pname; + # Run `eval $(nix-build -A lorri.updater)` after updating the revision! + rev = "03f10395943449b1fc5026d3386ab8c94c520ee3"; + sha256 = "0fcl79ndaziwd8d74mk1lsijz34p2inn64b4b4am3wsyk184brzq"; + }; + + cargoSha256 = "1daff4plh7hwclfp21hkx4fiflh9r80y2c7k2sd3zm4lmpy0jpfz"; + doCheck = false; + + BUILD_REV_COUNT = src.revCount or 1; + RUN_TIME_CLOSURE = pkgs.callPackage ./runtime.nix {}; + + nativeBuildInputs = with pkgs; [ nix direnv which ]; + buildInputs = + stdenv.lib.optionals stdenv.isDarwin [ CoreServices Security cf-private ]; + + passthru = { + updater = with builtins; writeScript "copy-runtime-nix.sh" '' + #!${runtimeShell} + set -euo pipefail + cp ${src}/nix/runtime.nix ${toString ./runtime.nix} + cp ${src}/nix/runtime-closure.nix.template ${toString ./runtime-closure.nix.template} + ''; + tests = { + nixos = nixosTests.lorri; + }; + }; +} diff --git a/pkgs/tools/misc/lorri/runtime-closure.nix.template b/pkgs/tools/misc/lorri/runtime-closure.nix.template new file mode 100644 index 000000000000..2cb2ec4bbb9f --- /dev/null +++ b/pkgs/tools/misc/lorri/runtime-closure.nix.template @@ -0,0 +1,37 @@ +# Nix with sandboxing requires every path used at build time be +# explicitly declared. If we simply passed in the paths, they +# would be copied in as sources. Using builtins.storePath we're +# able to tell Nix that, no, in fact, treat these not as sources +# to copy, but instead of a regular store path. +# +# Include the explicit closure, too, otherwise we'll get mysterious +# "file not found" errors due to the glibc interpreter being +# missing. +let + # Magic inspired by Nix's config.nix: + # https://github.com/NixOS/nix/blob/f9a2ea44867cd1dbb408bca4df0ced806137b7f7/corepkgs/config.nix.in#L23 + # + # If the dependency is in the Nix store we're using, refer to + # it as a literal store path. If it isn't, refer to it "normally". + # + # This makes sandboxing happy when in a nix-build, and the + # evaluation happy when in a «cargo build». + tools_build_host = @tools_build_host@; + + # Compare the stringified version of the tools_build_host Nix store + # path to the evaluator's stringified Nix store path. Otherwise, + # Nix will read the sources in to the /nix/store, and, well, + # you can only copy the /nix/store in to the /nix/store so many + # times before you run out of disk space. + dep = if ("${toString (dirOf tools_build_host)}" == "${toString builtins.storeDir}") + then (builtins.trace "using storePath" builtins.storePath) + else (builtins.trace "using toString" toString) # assume we have no sandboxing + ; + + tools = dep tools_build_host; + +in { + path = "${tools}/bin"; + builder = "${tools}/bin/bash"; + closure = import @runtime_closure_list@ { inherit dep; }; +} diff --git a/pkgs/tools/misc/lorri/runtime.nix b/pkgs/tools/misc/lorri/runtime.nix new file mode 100644 index 000000000000..71bc89b5af32 --- /dev/null +++ b/pkgs/tools/misc/lorri/runtime.nix @@ -0,0 +1,33 @@ +{ + # Plumbing tools: + closureInfo, runCommand, writeText, buildEnv, + + # Actual dependencies to propagate: + bash, coreutils }: +let + tools = buildEnv { + name = "lorri-runtime-tools"; + paths = [ coreutils bash ]; + }; + + runtimeClosureInfo = closureInfo { + rootPaths = [ tools ]; + }; + + closureToNix = runCommand "closure.nix" {} + '' + ( + echo '{ dep, ... }: [' + sed -E 's/^(.*)$/ (dep \1)/' ${runtimeClosureInfo}/store-paths + echo ']' + ) > $out + ''; + + runtimeClosureInfoAsNix = runCommand "runtime-closure.nix" { + runtime_closure_list = closureToNix; + tools_build_host = tools; + } + '' + substituteAll ${./runtime-closure.nix.template} $out + ''; +in runtimeClosureInfoAsNix diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index a0f59873880e..67adb02fe3e9 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -8170,7 +8170,10 @@ in llvmPackages_latest = llvmPackages_8; - lorri = throw "lorri is not stable yet. Please go to https://github.com/target/lorri and follow the installation instructions there, for the time being."; + lorri = callPackage ../tools/misc/lorri { + inherit (darwin) cf-private; + inherit (darwin.apple_sdk.frameworks) CoreServices Security; + }; manticore = callPackage ../development/compilers/manticore { }; From eda44a6d29bd60853eb1cf624844380c107b1abe Mon Sep 17 00:00:00 2001 From: Leonhard Markert Date: Fri, 8 Nov 2019 18:18:03 +0100 Subject: [PATCH 17/57] lorri service module: init (cherry picked from commit e5db97d2b002a57d6fac70d1f0a8314d25e94f28) --- nixos/modules/module-list.nix | 1 + nixos/modules/services/development/lorri.nix | 45 ++++++++++++++++++++ 2 files changed, 46 insertions(+) create mode 100644 nixos/modules/services/development/lorri.nix diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix index 24f5e3f40fa1..3d3232cc3786 100644 --- a/nixos/modules/module-list.nix +++ b/nixos/modules/module-list.nix @@ -316,6 +316,7 @@ ./services/development/bloop.nix ./services/development/hoogle.nix ./services/development/jupyter/default.nix + ./services/development/lorri.nix ./services/editors/emacs.nix ./services/editors/infinoted.nix ./services/games/factorio.nix diff --git a/nixos/modules/services/development/lorri.nix b/nixos/modules/services/development/lorri.nix new file mode 100644 index 000000000000..618785ee53ca --- /dev/null +++ b/nixos/modules/services/development/lorri.nix @@ -0,0 +1,45 @@ +{ config, lib, pkgs, ... }: + +let + cfg = config.services.lorri; + socketPath = "lorri/daemon.socket"; +in { + options = { + services.lorri = { + enable = lib.mkOption { + default = false; + type = lib.types.bool; + description = '' + Enables the daemon for `lorri`, a nix-shell replacement for project + development. The socket-activated daemon starts on the first request + issued by the `lorri` command. + ''; + }; + }; + }; + + config = lib.mkIf cfg.enable { + systemd.user.sockets.lorri = { + description = "Socket for Lorri Daemon"; + wantedBy = [ "sockets.target" ]; + socketConfig = { + ListenStream = "%t/${socketPath}"; + RuntimeDirectory = "lorri"; + }; + }; + + systemd.user.services.lorri = { + description = "Lorri Daemon"; + requires = [ "lorri.socket" ]; + after = [ "lorri.socket" ]; + path = with pkgs; [ config.nix.package gnutar gzip ]; + serviceConfig = { + ExecStart = "${pkgs.lorri}/bin/lorri daemon"; + PrivateTmp = true; + ProtectSystem = "strict"; + ProtectHome = "read-only"; + Restart = "on-failure"; + }; + }; + }; +} From 78486a86fc957c33d1e6e5df51be8fd4b39a397a Mon Sep 17 00:00:00 2001 From: Florian Klink Date: Fri, 15 Nov 2019 16:41:00 +0100 Subject: [PATCH 18/57] nixos/lorri: add to environment.systemPackages most likely, people enabling the lorri module also want to use it, without explicitly having to add it to users.users..packages. cc @curiousleo @Profpatsch (cherry picked from commit fd7d88f6035bdec48d34beee1a46228eb4dda1b6) --- nixos/modules/services/development/lorri.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/nixos/modules/services/development/lorri.nix b/nixos/modules/services/development/lorri.nix index 618785ee53ca..68264ee869d1 100644 --- a/nixos/modules/services/development/lorri.nix +++ b/nixos/modules/services/development/lorri.nix @@ -41,5 +41,7 @@ in { Restart = "on-failure"; }; }; + + environment.systemPackages = [ pkgs.lorri ]; }; } From d76f279a65ed7dab17faacf58bbb3a07cfe97e5b Mon Sep 17 00:00:00 2001 From: Linus Heckemann Date: Fri, 15 Nov 2019 17:59:55 +0100 Subject: [PATCH 19/57] pythonPackages.nixpart: unmark broken (cherry picked from commit 75667c2916d4bd60db2f5a1f1838d67af87a3610) --- pkgs/tools/filesystems/nixpart/default.nix | 1 - 1 file changed, 1 deletion(-) diff --git a/pkgs/tools/filesystems/nixpart/default.nix b/pkgs/tools/filesystems/nixpart/default.nix index 8f59ff809a83..809c5256873e 100644 --- a/pkgs/tools/filesystems/nixpart/default.nix +++ b/pkgs/tools/filesystems/nixpart/default.nix @@ -16,6 +16,5 @@ buildPythonApplication rec { license = stdenv.lib.licenses.gpl2Plus; maintainers = [ stdenv.lib.maintainers.aszlig ]; platforms = stdenv.lib.platforms.linux; - broken = true; }; } From 02380e784167cda7e454120f9bae9dd3618d5fa3 Mon Sep 17 00:00:00 2001 From: Nathan Yong Date: Fri, 18 Oct 2019 09:26:28 +1100 Subject: [PATCH 20/57] p4v: explicitly depend on openssl 1.0 series The 2017.3 version of p4v is linked against `libssl.so.1.0.0`. Since the default openssl in NixOS 2019.09 has been changed to openssl 1.1, the p4v package must now import the openssl_1_0_2 derivation. (cherry picked from commit 1ced63da766965bdda53675a12627401c42a50cc) cc #71301 Closes: #73456 --- pkgs/applications/version-management/p4v/default.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/applications/version-management/p4v/default.nix b/pkgs/applications/version-management/p4v/default.nix index 0020c8c2189e..317cbfde85b0 100644 --- a/pkgs/applications/version-management/p4v/default.nix +++ b/pkgs/applications/version-management/p4v/default.nix @@ -1,4 +1,4 @@ -{ stdenv, fetchurl, lib, qtbase, qtmultimedia, qtscript, qtsensors, qtwebkit, openssl, xkeyboard_config, wrapQtAppsHook }: +{ stdenv, fetchurl, lib, qtbase, qtmultimedia, qtscript, qtsensors, qtwebkit, openssl_1_0_2, xkeyboard_config, wrapQtAppsHook }: stdenv.mkDerivation rec { pname = "p4v"; @@ -19,7 +19,7 @@ stdenv.mkDerivation rec { qtscript qtsensors qtwebkit - openssl + openssl_1_0_2 ]; dontWrapQtApps = true; @@ -43,6 +43,6 @@ stdenv.mkDerivation rec { homepage = https://www.perforce.com; license = stdenv.lib.licenses.unfreeRedistributable; platforms = [ "x86_64-linux" ]; - maintainers = [ stdenv.lib.maintainers.nioncode ]; + maintainers = with stdenv.lib.maintainers; [ nathyong nioncode ]; }; } From 1087833d74174cddc3aa1f27a8dff031d6ae674e Mon Sep 17 00:00:00 2001 From: "EEva (JPotier)" Date: Mon, 4 Nov 2019 19:08:57 +0200 Subject: [PATCH 21/57] vault: fix config when file backend is used When the option services.vault.storageBackend is set to "file", a systemd.tmpfiles.rules was added, with extraneous []. These are not needed and have been removed. (cherry picked from commit 9b78e5f35d209754bd539a7f026ab6d3ada2d67d) --- nixos/modules/services/security/vault.nix | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/nixos/modules/services/security/vault.nix b/nixos/modules/services/security/vault.nix index d5962ba9af90..b0ab8fadcbec 100644 --- a/nixos/modules/services/security/vault.nix +++ b/nixos/modules/services/security/vault.nix @@ -119,9 +119,8 @@ in }; users.groups.vault.gid = config.ids.gids.vault; - systemd.tmpfiles.rules = optional (cfg.storagePath != null) [ - "d '${cfg.storagePath}' 0700 vault vault - -" - ]; + systemd.tmpfiles.rules = optional (cfg.storagePath != null) + "d '${cfg.storagePath}' 0700 vault vault - -"; systemd.services.vault = { description = "Vault server daemon"; From 9104be2ee08f2fea20e0809ac667a99f2c37582b Mon Sep 17 00:00:00 2001 From: Herwig Hochleitner Date: Sat, 16 Nov 2019 02:01:10 +0100 Subject: [PATCH 22/57] nextcloud: 16.0.5 -> 16.0.6 --- pkgs/servers/nextcloud/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/servers/nextcloud/default.nix b/pkgs/servers/nextcloud/default.nix index c99ccc6e3cc4..29f0b196f077 100644 --- a/pkgs/servers/nextcloud/default.nix +++ b/pkgs/servers/nextcloud/default.nix @@ -2,11 +2,11 @@ stdenv.mkDerivation rec { pname = "nextcloud"; - version = "16.0.5"; + version = "16.0.6"; src = fetchurl { url = "https://download.nextcloud.com/server/releases/${pname}-${version}.tar.bz2"; - sha256 = "0lg5zaakfdngrh0ida0qbq76jbiab5fv46jziqf77zbnlx7wc2c7"; + sha256 = "1hnbrvl77772rcl4kfzzwd1mlyl2f1f557gfn4hcnpl4a62q1rr3"; }; installPhase = '' From 3efadb072876b1a55f9ce98c2e13d78d2e769626 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fabian=20M=C3=B6ller?= Date: Wed, 25 Sep 2019 21:36:39 +0200 Subject: [PATCH 23/57] teamspeak-client: fix stuck build --- .../networking/instant-messengers/teamspeak/client.nix | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/pkgs/applications/networking/instant-messengers/teamspeak/client.nix b/pkgs/applications/networking/instant-messengers/teamspeak/client.nix index 3c532fa506a5..eaf9a8f47e51 100644 --- a/pkgs/applications/networking/instant-messengers/teamspeak/client.nix +++ b/pkgs/applications/networking/instant-messengers/teamspeak/client.nix @@ -1,6 +1,6 @@ { stdenv, fetchurl, makeWrapper, makeDesktopItem, zlib, glib, libpng, freetype, openssl , xorg, fontconfig, qtbase, qtwebengine, qtwebchannel, qtsvg, xkeyboard_config, alsaLib -, libpulseaudio ? null, libredirect, quazip, less, which, unzip, llvmPackages +, libpulseaudio ? null, libredirect, quazip, which, unzip, llvmPackages, writeShellScriptBin }: let @@ -26,6 +26,8 @@ let categories = "Network"; }; + fakeLess = writeShellScriptBin "less" "cat"; + in stdenv.mkDerivation rec { @@ -46,11 +48,11 @@ stdenv.mkDerivation rec { sha256 = "1bywmdj54glzd0kffvr27r84n4dsd0pskkbmh59mllbxvj0qwy7f"; }; - buildInputs = [ makeWrapper less which unzip ]; + nativeBuildInputs = [ makeWrapper fakeLess which unzip ]; unpackPhase = '' - echo -e 'q\ny' | sh -xe $src + echo -e '\ny' | sh -xe $src cd TeamSpeak* ''; From 02fa463527122d47b1cc328f63b1011c10fe6306 Mon Sep 17 00:00:00 2001 From: ahiaao Date: Sat, 16 Nov 2019 00:11:14 -0800 Subject: [PATCH 24/57] lispPackages.cl-mysql: fix build --- .../lisp-modules/quicklisp-to-nix-overrides.nix | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/pkgs/development/lisp-modules/quicklisp-to-nix-overrides.nix b/pkgs/development/lisp-modules/quicklisp-to-nix-overrides.nix index 052bfb119498..a7e1f44f5984 100644 --- a/pkgs/development/lisp-modules/quicklisp-to-nix-overrides.nix +++ b/pkgs/development/lisp-modules/quicklisp-to-nix-overrides.nix @@ -77,7 +77,14 @@ $out/lib/common-lisp/query-fs" }; }; cffi = addNativeLibs [pkgs.libffi]; - cl-mysql = addNativeLibs [pkgs.mysql]; + cl-mysql = x: { + propagatedBuildInputs = [pkgs.mysql.connector-c]; + overrides = y: (x.overrides y) // { + prePatch = ((x.overrides y).prePatch or "") + '' + sed -i 's,libmysqlclient_r,${pkgs.mysql.connector-c}/lib/mysql/libmysqlclient_r,' system.lisp + ''; + }; + }; cl-ppcre-template = x: { overrides = y: (x.overrides y) // { postPatch = '' From 1af15eb91dfc6596e09a1e0c48296afb8dd54a15 Mon Sep 17 00:00:00 2001 From: xrelkd <46590321+xrelkd@users.noreply.github.com> Date: Tue, 29 Oct 2019 07:58:22 +0800 Subject: [PATCH 25/57] youtube-dl: 2019.10.22 -> 2019.10.29 (cherry picked from commit 215dbc52531e06c06297848c382080602567d2ca) --- pkgs/tools/misc/youtube-dl/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/tools/misc/youtube-dl/default.nix b/pkgs/tools/misc/youtube-dl/default.nix index b523a86bd567..610738daebdf 100644 --- a/pkgs/tools/misc/youtube-dl/default.nix +++ b/pkgs/tools/misc/youtube-dl/default.nix @@ -18,11 +18,11 @@ buildPythonPackage rec { # The websites youtube-dl deals with are a very moving target. That means that # downloads break constantly. Because of that, updates should always be backported # to the latest stable release. - version = "2019.10.22"; + version = "2019.10.29"; src = fetchurl { url = "https://yt-dl.org/downloads/${version}/${pname}-${version}.tar.gz"; - sha256 = "06wg6wpyq0fawjxjrhd7zasfjr9b6w9wsk2amiqdl712zqlq2rwb"; + sha256 = "1lq6ycjbx07831s24yx42q6m6svas4mf02vbszw0965dbbzs7vp4"; }; nativeBuildInputs = [ makeWrapper ]; From bc9a9cc03f9b6980849654e613bea3739e5b215d Mon Sep 17 00:00:00 2001 From: xrelkd <46590321+xrelkd@users.noreply.github.com> Date: Tue, 5 Nov 2019 08:08:53 +0800 Subject: [PATCH 26/57] youtube-dl: 2019.10.29 -> 2019.11.05 (cherry picked from commit a17cda6ddf06970522dd57a352496c29027c18af) --- pkgs/tools/misc/youtube-dl/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/tools/misc/youtube-dl/default.nix b/pkgs/tools/misc/youtube-dl/default.nix index 610738daebdf..bc198eb595b6 100644 --- a/pkgs/tools/misc/youtube-dl/default.nix +++ b/pkgs/tools/misc/youtube-dl/default.nix @@ -18,11 +18,11 @@ buildPythonPackage rec { # The websites youtube-dl deals with are a very moving target. That means that # downloads break constantly. Because of that, updates should always be backported # to the latest stable release. - version = "2019.10.29"; + version = "2019.11.05"; src = fetchurl { url = "https://yt-dl.org/downloads/${version}/${pname}-${version}.tar.gz"; - sha256 = "1lq6ycjbx07831s24yx42q6m6svas4mf02vbszw0965dbbzs7vp4"; + sha256 = "129461i4103slqj3nq69djnlmgjj3lfgmazn41avc5g967w29b85"; }; nativeBuildInputs = [ makeWrapper ]; From 7d2b90439d54c760a19301aa0189d271861615d0 Mon Sep 17 00:00:00 2001 From: pacien Date: Sat, 16 Nov 2019 16:40:03 +0100 Subject: [PATCH 27/57] Revert "ncmpc: 0.35 -> 0.36" ncmpc 0.36 isn't compatible with mpd 0.20 which is the version packaged on the release-19.09 branch. See https://github.com/NixOS/nixpkgs/pull/73000#issuecomment-551786649. This reverts commit 245f5ec32226b13909901e1427314a6fa5daaff5. --- pkgs/applications/audio/ncmpc/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/applications/audio/ncmpc/default.nix b/pkgs/applications/audio/ncmpc/default.nix index db788dcc9eb2..4fa9626332be 100644 --- a/pkgs/applications/audio/ncmpc/default.nix +++ b/pkgs/applications/audio/ncmpc/default.nix @@ -3,13 +3,13 @@ stdenv.mkDerivation rec { pname = "ncmpc"; - version = "0.36"; + version = "0.35"; src = fetchFromGitHub { owner = "MusicPlayerDaemon"; repo = "ncmpc"; rev = "v${version}"; - sha256 = "1ssmk1p43gjhcqi86sh6b7csqpwwpf3hs32cmnylv6pmbcwbs69h"; + sha256 = "0hhc5snxy5fbg47ynz4b7fkmzdy974zxqr0cqc6kh15yvbr25ikh"; }; buildInputs = [ glib ncurses mpd_clientlib boost ]; From ad0b94bcfa7ececc58faaec537977c3a168cdd4a Mon Sep 17 00:00:00 2001 From: Herwig Hochleitner Date: Sat, 16 Nov 2019 17:11:54 +0100 Subject: [PATCH 28/57] flashplayer: 32.0.0.270 -> 32.0.0.293 (cherry picked from commit 8c997725a288f140703b3fbb836e70acf58557e3) --- .../networking/browsers/chromium/plugins.nix | 4 ++-- .../browsers/mozilla-plugins/flashplayer/default.nix | 10 +++++----- .../mozilla-plugins/flashplayer/standalone.nix | 6 +++--- 3 files changed, 10 insertions(+), 10 deletions(-) diff --git a/pkgs/applications/networking/browsers/chromium/plugins.nix b/pkgs/applications/networking/browsers/chromium/plugins.nix index 057118567439..3abdef62eefc 100644 --- a/pkgs/applications/networking/browsers/chromium/plugins.nix +++ b/pkgs/applications/networking/browsers/chromium/plugins.nix @@ -45,11 +45,11 @@ let flash = stdenv.mkDerivation rec { pname = "flashplayer-ppapi"; - version = "32.0.0.270"; + version = "32.0.0.293"; src = fetchzip { url = "https://fpdownload.adobe.com/pub/flashplayer/pdc/${version}/flash_player_ppapi_linux.x86_64.tar.gz"; - sha256 = "1z8nfw7b3dsy79gb50bmmdjz66j5gx6m0hkw1abp35xdgh2sz2ak"; + sha256 = "0rgriqdbyrzpm1bcph35bhzd5dz21yim56z93hkmbpdqg7767dwm"; stripRoot = false; }; diff --git a/pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/default.nix b/pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/default.nix index 29954e4129e0..585b7426eb67 100644 --- a/pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/default.nix +++ b/pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/default.nix @@ -74,7 +74,7 @@ let in stdenv.mkDerivation rec { pname = "flashplayer"; - version = "32.0.0.270"; + version = "32.0.0.293"; src = fetchurl { url = @@ -85,14 +85,14 @@ stdenv.mkDerivation rec { sha256 = if debug then if arch == "x86_64" then - "1c3dn4gkl40i5sjkvpbkn9fl82vjhy1v7dhrayk3ncfsxcyvbcm0" + "0lz1na68gdi9n23hfj5c731dbskm9684cwar7ji8yjfhfryfg5yn" else - "1g7i9mihn5g9i71xyf805k19yk41vsr85gzk87gm426m0hcgg89i" + "10gm2ynndlyk66fndfbh7ah5ssqpyw8415i10n3lpw940x201dk0" else if arch == "x86_64" then - "16lxgkbr2hg49vhc7414zkh1kblhysf779854faay308ml3i5kdw" + "0hmlv0v9lbgxrmz0n7czfnrbrwjwxhy99gsr5g1m0aqgw0y61clc" else - "0jrdzm8pw7aq32w7m4rvkhj7mmqyddh5yxpj7q3d9hxrwshkikvj"; + "0qdw4f48xhnkzdly3jz63v14nmzd0gg49az5wxb08ghs8laaqlik"; }; nativeBuildInputs = [ unzip ]; diff --git a/pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/standalone.nix b/pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/standalone.nix index 27ec18aa6c88..0f7ded95f40f 100644 --- a/pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/standalone.nix +++ b/pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/standalone.nix @@ -50,7 +50,7 @@ stdenv.mkDerivation { pname = "flashplayer-standalone"; - version = "32.0.0.270"; + version = "32.0.0.293"; src = fetchurl { url = @@ -60,9 +60,9 @@ stdenv.mkDerivation { "https://fpdownload.macromedia.com/pub/flashplayer/updaters/32/flash_player_sa_linux.x86_64.tar.gz"; sha256 = if debug then - "0k5azrl92hkbn7adjz7s2lv8h59n7gsjrcprqdc485i4f7sjmkwj" + "13mrknvl3yd8vrcs7mp6szz6f9ssfs72apzvc60f9qfwkhiwlg87" else - "1la5s4wxchfpl8in576xj675yrg84pify22pwf063h0jg3rdgi68"; + "0isvmzyi4isxvxxc5ksplcqc5cafpvbrln3dddpms8zps2dxpyzi"; }; nativeBuildInputs = [ unzip ]; From 2437bb394392322d28d4244a63ab9b7ae8cc18dd Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= Date: Sat, 16 Nov 2019 18:26:13 +0100 Subject: [PATCH 29/57] Merge #72958: libexif: fix CVE-2018-20030 (cherry picked from commit 908f6240d89293dbcdc41758ac0b6f2c1a7107e8) Fixes #70104. --- .../development/libraries/libexif/default.nix | 25 +++++++++++++------ 1 file changed, 18 insertions(+), 7 deletions(-) diff --git a/pkgs/development/libraries/libexif/default.nix b/pkgs/development/libraries/libexif/default.nix index 5a8f5126680e..833ccf5dca5d 100644 --- a/pkgs/development/libraries/libexif/default.nix +++ b/pkgs/development/libraries/libexif/default.nix @@ -9,21 +9,32 @@ stdenv.mkDerivation rec { }; patches = [ - (fetchpatch { - name = "CVE-2017-7544.patch"; - url = https://sourceforge.net/p/libexif/bugs/_discuss/thread/fc394c4b/489a/attachment/xx.pat; - sha256 = "1qgk8hgnxr8d63jsc4vljxz9yg33mbml280dq4a6050rmk9wq4la"; - }) + (fetchpatch { + name = "CVE-2017-7544.patch"; + url = "https://github.com/libexif/libexif/commit/c39acd1692023b26290778a02a9232c873f9d71a.patch"; + sha256 = "0xgx6ly2i4q05shb61mfx6njwf1yp347jkznm0ka4m85i41xm6sd"; + }) + (fetchpatch { + name = "CVE-2018-20030-1.patch"; + url = "https://github.com/libexif/libexif/commit/5d28011c40ec86cf52cffad541093d37c263898a.patch"; + sha256 = "1wv8s962wmbn2m2xypgirf12g6msrbplpsmd5bh86irfwhkcppj3"; + }) + (fetchpatch { + name = "CVE-2018-20030-2.patch"; + url = "https://github.com/libexif/libexif/commit/6aa11df549114ebda520dde4cdaea2f9357b2c89.patch"; + sha256 = "01aqvz63glwq6wg0wr7ykqqghb4abgq77ghvhizbzadg1k4h7drx"; + excludes = [ "NEWS" ]; + }) ]; - patchFlags = "-p0"; buildInputs = [ gettext ]; meta = { - homepage = http://libexif.sourceforge.net/; + homepage = https://libexif.github.io/; description = "A library to read and manipulate EXIF data in digital photographs"; license = stdenv.lib.licenses.lgpl21; platforms = stdenv.lib.platforms.unix; + maintainers = [ stdenv.lib.maintainers.erictapen ]; }; } From 271024c6d5ed94a886e52d02782e266722a060c0 Mon Sep 17 00:00:00 2001 From: Tim Steinbach Date: Sat, 16 Nov 2019 13:18:34 -0500 Subject: [PATCH 30/57] linux: 4.4.201 -> 4.4.202 --- pkgs/os-specific/linux/kernel/linux-4.4.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/os-specific/linux/kernel/linux-4.4.nix b/pkgs/os-specific/linux/kernel/linux-4.4.nix index a6d9dbe1abef..35bd141ae468 100644 --- a/pkgs/os-specific/linux/kernel/linux-4.4.nix +++ b/pkgs/os-specific/linux/kernel/linux-4.4.nix @@ -1,11 +1,11 @@ { stdenv, buildPackages, fetchurl, perl, buildLinux, ... } @ args: buildLinux (args // rec { - version = "4.4.201"; + version = "4.4.202"; extraMeta.branch = "4.4"; src = fetchurl { url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz"; - sha256 = "120kci4kmc48zcw16lhxmh71kaxm9ac5qxik36q3a20czg28b2m7"; + sha256 = "0adrmps7izfqy0yn4440isxvigslwzk1a375r9kh86idwbmcxb7x"; }; } // (args.argsOverride or {})) From c3eba36eddfaefb6d2ffca24f8713b1c8c8b12b9 Mon Sep 17 00:00:00 2001 From: Tim Steinbach Date: Sat, 16 Nov 2019 13:18:51 -0500 Subject: [PATCH 31/57] linux: 4.9.201 -> 4.9.202 --- pkgs/os-specific/linux/kernel/linux-4.9.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/os-specific/linux/kernel/linux-4.9.nix b/pkgs/os-specific/linux/kernel/linux-4.9.nix index 3dc151685171..cb9d5a71dd90 100644 --- a/pkgs/os-specific/linux/kernel/linux-4.9.nix +++ b/pkgs/os-specific/linux/kernel/linux-4.9.nix @@ -1,11 +1,11 @@ { stdenv, buildPackages, fetchurl, perl, buildLinux, ... } @ args: buildLinux (args // rec { - version = "4.9.201"; + version = "4.9.202"; extraMeta.branch = "4.9"; src = fetchurl { url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz"; - sha256 = "125xmh5h1zmfniidpjljny53qkl4phpxaali69i66lajscxx8grq"; + sha256 = "1gsfbvsswpwj6r56ynb6mmx7dc8hp9yhi7sfr0hhii0gs4ffq241"; }; } // (args.argsOverride or {})) From 48449d6e35b2f4eb60ceb639734fb4ba8375b185 Mon Sep 17 00:00:00 2001 From: c0bw3b Date: Sat, 16 Nov 2019 19:44:58 +0100 Subject: [PATCH 32/57] electrum-dash: mark as vulnerable CVE-2018-1000022 in electrum (cherry picked from commit a50507a6cce1bf49a667de23fb7d3355eedb8f3d) --- pkgs/applications/misc/electrum/dash.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/pkgs/applications/misc/electrum/dash.nix b/pkgs/applications/misc/electrum/dash.nix index 8ba562de1cb7..fc5192bb5e47 100644 --- a/pkgs/applications/misc/electrum/dash.nix +++ b/pkgs/applications/misc/electrum/dash.nix @@ -42,5 +42,6 @@ python2Packages.buildPythonApplication rec { homepage = https://github.com/dashpay/electrum-dash; license = licenses.gpl3; maintainers = with maintainers; [ np ]; + knownVulnerabilities = [ "CVE-2018-1000022" ]; }; } From ca5abe5d38f4a93819a0db0809dd3924dc34a2d8 Mon Sep 17 00:00:00 2001 From: pacien Date: Sat, 16 Nov 2019 23:13:24 +0100 Subject: [PATCH 33/57] imagemagick: 6.9.10-69 -> 6.9.10-71 (cherry picked from commit 6a059ee5fe91d87ec376c8ed3f2e01fc6723007b) --- pkgs/applications/graphics/ImageMagick/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/applications/graphics/ImageMagick/default.nix b/pkgs/applications/graphics/ImageMagick/default.nix index 2a4845659565..9cfccc7425bb 100644 --- a/pkgs/applications/graphics/ImageMagick/default.nix +++ b/pkgs/applications/graphics/ImageMagick/default.nix @@ -13,8 +13,8 @@ let else throw "ImageMagick is not supported on this platform."; cfg = { - version = "6.9.10-69"; - sha256 = "0l4lllis16gbwjpvvsyfz91i9nq11zb3lg2zlmyay7v5697jshh6"; + version = "6.9.10-71"; + sha256 = "0c69xmr8k8c4dplgzxydm30s2dr8biq71x07hc15bw196nsx3srr"; patches = []; } # Freeze version on mingw so we don't need to port the patch too often. From fdb3cd2b7a6231bdfcaea3049d7d136f9c260ca7 Mon Sep 17 00:00:00 2001 From: ahiaao Date: Sat, 16 Nov 2019 22:57:42 -0800 Subject: [PATCH 34/57] retext: fix chardet override --- pkgs/applications/editors/retext/default.nix | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/pkgs/applications/editors/retext/default.nix b/pkgs/applications/editors/retext/default.nix index d1028ec6ce8d..31b75c718206 100644 --- a/pkgs/applications/editors/retext/default.nix +++ b/pkgs/applications/editors/retext/default.nix @@ -9,7 +9,7 @@ let python = let packageOverrides = self: super: { markdown = super.markdown.overridePythonAttrs(old: { - src = super.fetchPypi { + src = super.fetchPypi { version = "3.0.1"; pname = "Markdown"; sha256 = "d02e0f9b04c500cde6637c11ad7c72671f359b87b9fe924b2383649d8841db7c"; @@ -17,11 +17,12 @@ let }); chardet = super.chardet.overridePythonAttrs(old: { - src = super.fetchPypi { + src = super.fetchPypi { version = "2.3.0"; pname = "chardet"; sha256 = "e53e38b3a4afe6d1132de62b7400a4ac363452dc5dfcf8d88e8e0cce663c68aa"; }; + patches = []; }); }; in python3.override { inherit packageOverrides; }; From 60830a3ce48add5b8289a0316d99698f73872f4e Mon Sep 17 00:00:00 2001 From: ahiaao Date: Sat, 16 Nov 2019 23:45:57 -0800 Subject: [PATCH 35/57] retext: properly wrap with wrapQtApp --- pkgs/applications/editors/retext/default.nix | 7 +++---- pkgs/top-level/all-packages.nix | 2 +- 2 files changed, 4 insertions(+), 5 deletions(-) diff --git a/pkgs/applications/editors/retext/default.nix b/pkgs/applications/editors/retext/default.nix index 31b75c718206..e97423892616 100644 --- a/pkgs/applications/editors/retext/default.nix +++ b/pkgs/applications/editors/retext/default.nix @@ -1,4 +1,4 @@ -{ stdenv, python3, fetchFromGitHub, makeWrapper, buildEnv, aspellDicts +{ stdenv, python3, fetchFromGitHub, wrapQtAppsHook, buildEnv, aspellDicts # Use `lib.collect lib.isDerivation aspellDicts;` to make all dictionaries # available. , enchantAspellDicts ? with aspellDicts; [ en en-computers en-science ] @@ -42,12 +42,11 @@ in python.pkgs.buildPythonApplication { doCheck = false; - nativeBuildInputs = [ makeWrapper ]; + nativeBuildInputs = [ wrapQtAppsHook ]; propagatedBuildInputs = [ pythonEnv ]; postInstall = '' - mv $out/bin/retext $out/bin/.retext - makeWrapper "$out/bin/.retext" "$out/bin/retext" \ + wrapQtApp "$out/bin/retext" \ --set ASPELL_CONF "dict-dir ${buildEnv { name = "aspell-all-dicts"; paths = map (path: "${path}/lib/aspell") enchantAspellDicts; diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index 67adb02fe3e9..da47d45ab0b3 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -5763,7 +5763,7 @@ in redsocks = callPackage ../tools/networking/redsocks { }; - retext = callPackage ../applications/editors/retext { }; + retext = libsForQt5.callPackage ../applications/editors/retext { }; richgo = callPackage ../development/tools/richgo { }; From 6c6423ae12029fbd5c5eb6f80f557d0ecb82eedd Mon Sep 17 00:00:00 2001 From: rnhmjoj Date: Sat, 26 Oct 2019 10:56:17 +0200 Subject: [PATCH 36/57] nixos/magnetico: fixes (cherry picked from commit dda2f6415fc2b01bf3ee705e59778394c6edd0f9) --- nixos/modules/services/torrent/magnetico.nix | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/nixos/modules/services/torrent/magnetico.nix b/nixos/modules/services/torrent/magnetico.nix index 02fa2ac0750a..926d02d85557 100644 --- a/nixos/modules/services/torrent/magnetico.nix +++ b/nixos/modules/services/torrent/magnetico.nix @@ -35,6 +35,7 @@ let (if (cfg.web.credentialsFile != null || cfg.web.credentials != { }) then "--credentials=${toString credFile}" else "--no-auth") + "--addr=${address}:${toString port}" ] ++ extraOptions); in { @@ -201,7 +202,7 @@ in { assertions = [ { - assertion = cfg.web.credentialsFile != null || cfg.web.credentials != { }; + assertion = cfg.web.credentialsFile == null || cfg.web.credentials == { }; message = '' The options services.magnetico.web.credentialsFile and services.magnetico.web.credentials are mutually exclusives. From c01eda58b0fa03db32a9757064c529a20bd59fb8 Mon Sep 17 00:00:00 2001 From: rnhmjoj Date: Wed, 13 Nov 2019 22:50:06 +0100 Subject: [PATCH 37/57] nixos/magnetico: order after network.target (cherry picked from commit 84648672421cb6a360cb226356c8209670fc8c27) --- nixos/modules/services/torrent/magnetico.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/nixos/modules/services/torrent/magnetico.nix b/nixos/modules/services/torrent/magnetico.nix index 926d02d85557..e2774281c803 100644 --- a/nixos/modules/services/torrent/magnetico.nix +++ b/nixos/modules/services/torrent/magnetico.nix @@ -177,7 +177,7 @@ in { systemd.services.magneticod = { description = "Magnetico DHT crawler"; wantedBy = [ "multi-user.target" ]; - after = [ "network-online.target" ]; + after = [ "network.target" ]; serviceConfig = { User = "magnetico"; @@ -189,7 +189,7 @@ in { systemd.services.magneticow = { description = "Magnetico web interface"; wantedBy = [ "multi-user.target" ]; - after = [ "network-online.target" "magneticod.service"]; + after = [ "network.target" "magneticod.service"]; serviceConfig = { User = "magnetico"; From 2c8221484489c7b4c1e666f56ca2b77a1dc1f23c Mon Sep 17 00:00:00 2001 From: ahiaao Date: Sun, 17 Nov 2019 01:53:00 -0800 Subject: [PATCH 38/57] qca2-qt5: Fix build by using correct c++ standard --- pkgs/development/libraries/qca2/c++11.patch | 15 +++++++++++++++ pkgs/development/libraries/qca2/default.nix | 2 ++ 2 files changed, 17 insertions(+) create mode 100644 pkgs/development/libraries/qca2/c++11.patch diff --git a/pkgs/development/libraries/qca2/c++11.patch b/pkgs/development/libraries/qca2/c++11.patch new file mode 100644 index 000000000000..2d6f186873d9 --- /dev/null +++ b/pkgs/development/libraries/qca2/c++11.patch @@ -0,0 +1,15 @@ +diff --git a/CMakeLists.txt b/CMakeLists.txt +index 453fd8a..be294cc 100644 +--- a/CMakeLists.txt ++++ b/CMakeLists.txt +@@ -126,8 +126,8 @@ if (CMAKE_COMPILER_IS_GNUCXX) + set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -Wcast-align") + endif() + +- set ( CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -Wno-long-long -ansi -Wundef -Werror-implicit-function-declaration -Wchar-subscripts -Wall -W -Wpointer-arith -Wwrite-strings -Wformat-security -Wmissing-format-attribute -fno-common") +- set ( CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -Wnon-virtual-dtor -Wno-long-long -ansi -Wundef -Wchar-subscripts -Wall -W -Wpointer-arith -Wwrite-strings -Wformat-security -fno-check-new -fno-common") ++ set ( CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -Wno-long-long -std=c++11 -Wundef -Werror-implicit-function-declaration -Wchar-subscripts -Wall -W -Wpointer-arith -Wwrite-strings -Wformat-security -Wmissing-format-attribute -fno-common") ++ set ( CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -Wnon-virtual-dtor -Wno-long-long -std=c++11 -Wundef -Wchar-subscripts -Wall -W -Wpointer-arith -Wwrite-strings -Wformat-security -fno-check-new -fno-common") + endif (CMAKE_SYSTEM_NAME MATCHES Linux) + endif (CMAKE_COMPILER_IS_GNUCXX) + diff --git a/pkgs/development/libraries/qca2/default.nix b/pkgs/development/libraries/qca2/default.nix index 19b11a60e7b6..ba37026517da 100644 --- a/pkgs/development/libraries/qca2/default.nix +++ b/pkgs/development/libraries/qca2/default.nix @@ -15,6 +15,8 @@ stdenv.mkDerivation rec { enableParallelBuilding = true; + patches = stdenv.lib.optional (builtins.compareVersions qt.version "5.0.0" >= 0) [ ./c++11.patch ]; + # tells CMake to use this CA bundle file if it is accessible preConfigure = '' export QC_CERTSTORE_PATH=/etc/ssl/certs/ca-certificates.crt From 728f74ef9cfd942d509c2554fbb4a47d4dfc3313 Mon Sep 17 00:00:00 2001 From: rnhmjoj Date: Sun, 17 Nov 2019 10:58:17 +0100 Subject: [PATCH 39/57] nixos/tests: add magnetico test --- nixos/tests/all-tests.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix index f0a0414a81ca..c5191b9eb2d8 100644 --- a/nixos/tests/all-tests.nix +++ b/nixos/tests/all-tests.nix @@ -154,6 +154,7 @@ in loki = handleTest ./loki.nix {}; #logstash = handleTest ./logstash.nix {}; lorri = handleTest ./lorri/default.nix {}; + magnetico = handleTest ./magnetico.nix {}; mailcatcher = handleTest ./mailcatcher.nix {}; mathics = handleTest ./mathics.nix {}; matrix-synapse = handleTest ./matrix-synapse.nix {}; From 5f506b95f9f6290f4c46f523cc3f5cef581c5666 Mon Sep 17 00:00:00 2001 From: Lily Ballard Date: Sun, 17 Nov 2019 17:16:47 -0800 Subject: [PATCH 40/57] macvim: Add -headerpad_max_install_names (#73592) We were adding this to the compilation of MacVim, but not to the compilation of the separate Vim binary. We may not actually need it for MacVim at all, but omitting it for the Vim binary meant our postInstall phase would fail for some people. Fixes #73514 (cherry picked from commit 505f913ceb37f1bcc13598f0ec58f0b741a954c3) --- pkgs/applications/editors/vim/macvim.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/pkgs/applications/editors/vim/macvim.nix b/pkgs/applications/editors/vim/macvim.nix index 7c89d07a7ecc..e73d049a48d7 100644 --- a/pkgs/applications/editors/vim/macvim.nix +++ b/pkgs/applications/editors/vim/macvim.nix @@ -72,6 +72,7 @@ stdenv.mkDerivation { "--with-tclsh=${tcl}/bin/tclsh" "--with-tlib=ncurses" "--with-compiledby=Nix" + "LDFLAGS=-headerpad_max_install_names" ]; makeFlags = ''PREFIX=$(out) CPPFLAGS="-Wno-error"''; From d85d3c85024596ffa0a1729439ddd20dc60768ed Mon Sep 17 00:00:00 2001 From: Jonathan Ringer Date: Mon, 7 Oct 2019 14:30:48 -0700 Subject: [PATCH 41/57] pythonPackages.cartopy: fix tests --- pkgs/development/python-modules/cartopy/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/python-modules/cartopy/default.nix b/pkgs/development/python-modules/cartopy/default.nix index 117b6fed5971..a3f90b3282ae 100644 --- a/pkgs/development/python-modules/cartopy/default.nix +++ b/pkgs/development/python-modules/cartopy/default.nix @@ -1,5 +1,5 @@ { buildPythonPackage, lib, fetchPypi -, pytest, filelock, mock, pep8 +, pytest_4, filelock, mock, pep8 , cython, isPy27 , six, pyshp, shapely, geos, numpy , gdal, pillow, matplotlib, pyepsg, pykdtree, scipy, owslib, fiona @@ -17,7 +17,7 @@ buildPythonPackage rec { sha256 = "0q9ckfi37cxj7jwnqnzij62vwcf4krccx576vv5lhvpgvplxjjs2"; }; - checkInputs = [ filelock mock pytest pep8 ]; + checkInputs = [ filelock mock pytest_4 pep8 ]; # several tests require network connectivity: we disable them. # also py2.7's tk is over-eager in trying to open an x display, From 240381bc733bdb5635abf5c7fd010b84b73c6c07 Mon Sep 17 00:00:00 2001 From: Jonathan Ringer Date: Mon, 7 Oct 2019 18:29:53 -0700 Subject: [PATCH 42/57] pythonPackages.fiona: fix linking issue --- pkgs/development/python-modules/fiona/default.nix | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/pkgs/development/python-modules/fiona/default.nix b/pkgs/development/python-modules/fiona/default.nix index 6dd74742741e..d6e4ef8d1bb7 100644 --- a/pkgs/development/python-modules/fiona/default.nix +++ b/pkgs/development/python-modules/fiona/default.nix @@ -1,6 +1,6 @@ -{ stdenv, buildPythonPackage, fetchPypi, isPy3k, pythonOlder +{ stdenv, lib, buildPythonPackage, fetchPypi, isPy3k, pythonOlder , attrs, click, cligj, click-plugins, six, munch, enum34 -, pytest, boto3, mock +, pytest, boto3, mock, giflib , gdal_2 # can't bump to 3 yet, https://github.com/Toblerity/Fiona/issues/745 }: @@ -13,7 +13,7 @@ buildPythonPackage rec { sha256 = "0gpvdrayam4qvpqvz0911nlyvf7ib3slsyml52qx172vhpldycgs"; }; - CXXFLAGS = stdenv.lib.optionalString stdenv.cc.isClang "-std=c++11"; + CXXFLAGS = lib.optionalString stdenv.cc.isClang "-std=c++11"; nativeBuildInputs = [ gdal_2 # for gdal-config @@ -21,7 +21,7 @@ buildPythonPackage rec { buildInputs = [ gdal_2 - ]; + ] ++ lib.optionals stdenv.cc.isClang [ giflib ]; propagatedBuildInputs = [ attrs @@ -30,12 +30,12 @@ buildPythonPackage rec { click-plugins six munch - ] ++ stdenv.lib.optional (!isPy3k) enum34; + ] ++ lib.optional (!isPy3k) enum34; checkInputs = [ pytest boto3 - ] ++ stdenv.lib.optional (pythonOlder "3.4") mock; + ] ++ lib.optional (pythonOlder "3.4") mock; checkPhase = '' rm -r fiona # prevent importing local fiona @@ -45,7 +45,7 @@ buildPythonPackage rec { and not test_*_wheel" ''; - meta = with stdenv.lib; { + meta = with lib; { description = "OGR's neat, nimble, no-nonsense API for Python"; homepage = http://toblerity.org/fiona/; license = licenses.bsd3; From e6d584f6dd22b587d5cdf5019f5e7dd2be370f61 Mon Sep 17 00:00:00 2001 From: Renaud Date: Mon, 18 Nov 2019 10:31:06 +0100 Subject: [PATCH 43/57] skypeforlinux: 8.51.0.86 -> 8.51.0.92 --- .../networking/instant-messengers/skypeforlinux/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/applications/networking/instant-messengers/skypeforlinux/default.nix b/pkgs/applications/networking/instant-messengers/skypeforlinux/default.nix index 709f4ce7bfe2..1eff219f68ef 100644 --- a/pkgs/applications/networking/instant-messengers/skypeforlinux/default.nix +++ b/pkgs/applications/networking/instant-messengers/skypeforlinux/default.nix @@ -7,7 +7,7 @@ let # Please keep the version x.y.0.z and do not update to x.y.76.z because the # source of the latter disappears much faster. - version = "8.51.0.86"; + version = "8.51.0.92"; rpath = stdenv.lib.makeLibraryPath [ alsaLib @@ -60,7 +60,7 @@ let if stdenv.hostPlatform.system == "x86_64-linux" then fetchurl { url = "https://repo.skype.com/deb/pool/main/s/skypeforlinux/skypeforlinux_${version}_amd64.deb"; - sha256 = "0c00i2fg55vkycly9wqy8qss9wsils3n0apl8kqisk0ihghds814"; + sha256 = "11x13c7z70iaq86pyy5nqc0mcfdr7vjpjkxw6kdyjhqyxs6q6ipf"; } else throw "Skype for linux is not supported on ${stdenv.hostPlatform.system}"; From e7d376a26b24ff89618fa5440f7e91caa23d88fc Mon Sep 17 00:00:00 2001 From: Martin Milata Date: Fri, 4 Oct 2019 22:38:58 +0200 Subject: [PATCH 44/57] nixos/matomo: add test cherry-pick: removed matomo-beta test because there's no beta package --- nixos/tests/all-tests.nix | 1 + nixos/tests/matomo.nix | 39 +++++++++++++++++++++++++++++++++++++++ 2 files changed, 40 insertions(+) create mode 100644 nixos/tests/matomo.nix diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix index c5191b9eb2d8..e351d0d4bab5 100644 --- a/nixos/tests/all-tests.nix +++ b/nixos/tests/all-tests.nix @@ -157,6 +157,7 @@ in magnetico = handleTest ./magnetico.nix {}; mailcatcher = handleTest ./mailcatcher.nix {}; mathics = handleTest ./mathics.nix {}; + matomo = handleTest ./matomo.nix {}; matrix-synapse = handleTest ./matrix-synapse.nix {}; mediawiki = handleTest ./mediawiki.nix {}; memcached = handleTest ./memcached.nix {}; diff --git a/nixos/tests/matomo.nix b/nixos/tests/matomo.nix new file mode 100644 index 000000000000..9d9d5ab3bc89 --- /dev/null +++ b/nixos/tests/matomo.nix @@ -0,0 +1,39 @@ +{ system ? builtins.currentSystem, config ? { } +, pkgs ? import ../.. { inherit system config; } }: + +with import ../lib/testing.nix { inherit system pkgs; }; +with pkgs.lib; + +let + matomoTest = package: + makeTest { + machine = { config, pkgs, ... }: { + services.matomo = { + package = package; + enable = true; + nginx = { + forceSSL = false; + enableACME = false; + }; + }; + services.mysql = { + enable = true; + package = pkgs.mysql; + }; + services.nginx.enable = true; + }; + + testScript = '' + startAll; + $machine->waitForUnit("mysql.service"); + $machine->waitForUnit("phpfpm-matomo.service"); + $machine->waitForUnit("nginx.service"); + $machine->succeed("curl -sSfL http://localhost/ | grep 'Matomo[^<]*Installation'"); + ''; + }; +in { + matomo = matomoTest pkgs.matomo // { + name = "matomo"; + meta.maintainers = with maintainers; [ florianjacob kiwi ]; + }; +} From 950d849913245c21eefbc78a8fc50921fe626ddd Mon Sep 17 00:00:00 2001 From: Robert Djubek <envy1988@gmail.com> Date: Tue, 24 Sep 2019 08:03:06 +0000 Subject: [PATCH 45/57] nixos/matomo: fix deprecation warnings Fixes the phpfpm deprecation warnings about listen and extraConfig by using fpm.socket and settings. Removes phpfpmProcessManagerConfig. --- nixos/modules/rename.nix | 3 +- .../modules/services/web-apps/matomo-doc.xml | 2 +- nixos/modules/services/web-apps/matomo.nix | 56 ++++++++----------- 3 files changed, 25 insertions(+), 36 deletions(-) diff --git a/nixos/modules/rename.nix b/nixos/modules/rename.nix index 0f56c5c1072b..82d5dd762975 100644 --- a/nixos/modules/rename.nix +++ b/nixos/modules/rename.nix @@ -133,7 +133,8 @@ with lib; # piwik was renamed to matomo (mkRenamedOptionModule [ "services" "piwik" "enable" ] [ "services" "matomo" "enable" ]) (mkRenamedOptionModule [ "services" "piwik" "webServerUser" ] [ "services" "matomo" "webServerUser" ]) - (mkRenamedOptionModule [ "services" "piwik" "phpfpmProcessManagerConfig" ] [ "services" "matomo" "phpfpmProcessManagerConfig" ]) + (mkRemovedOptionModule [ "services" "piwik" "phpfpmProcessManagerConfig" ] "Use services.phpfpm.pools.<name>.settings") + (mkRemovedOptionModule [ "services" "matomo" "phpfpmProcessManagerConfig" ] "Use services.phpfpm.pools.<name>.settings") (mkRenamedOptionModule [ "services" "piwik" "nginx" ] [ "services" "matomo" "nginx" ]) # tarsnap diff --git a/nixos/modules/services/web-apps/matomo-doc.xml b/nixos/modules/services/web-apps/matomo-doc.xml index 8485492c51c7..79cece551d34 100644 --- a/nixos/modules/services/web-apps/matomo-doc.xml +++ b/nixos/modules/services/web-apps/matomo-doc.xml @@ -105,7 +105,7 @@ GRANT ALL PRIVILEGES ON matomo.* TO 'matomo'@'localhost'; <para> You can use other web servers by forwarding calls for <filename>index.php</filename> and <filename>piwik.php</filename> to the - <literal>/run/phpfpm-matomo.sock</literal> fastcgi unix socket. You can use + <literal><link linkend="opt-services.phpfpm.pools._name_.socket">services.phpfpm.pools.<name>.socket</link></literal> fastcgi unix socket. You can use the nginx configuration in the module code as a reference to what else should be configured. </para> diff --git a/nixos/modules/services/web-apps/matomo.nix b/nixos/modules/services/web-apps/matomo.nix index 1e34aff8d171..352cc4c647bc 100644 --- a/nixos/modules/services/web-apps/matomo.nix +++ b/nixos/modules/services/web-apps/matomo.nix @@ -2,15 +2,13 @@ with lib; let cfg = config.services.matomo; + fpm = config.services.phpfpm.pools.${pool}; user = "matomo"; dataDir = "/var/lib/${user}"; deprecatedDataDir = "/var/lib/piwik"; pool = user; - # it's not possible to use /run/phpfpm/${pool}.sock because /run/phpfpm/ is root:root 0770, - # and therefore is not accessible by the web server. - phpSocket = "/run/phpfpm-${pool}.sock"; phpExecutionUnit = "phpfpm-${pool}"; databaseService = "mysql.service"; @@ -50,7 +48,7 @@ in { default = null; example = "lighttpd"; description = '' - Name of the web server user that forwards requests to the ${phpSocket} fastcgi socket for Matomo if the nginx + Name of the web server user that forwards requests to <option>services.phpfpm.pools.<name>.socket</option> the fastcgi socket for Matomo if the nginx option is not used. Either this option or the nginx option is mandatory. If you want to use another webserver than nginx, you need to set this to that server's user and pass fastcgi requests to `index.php`, `matomo.php` and `piwik.php` (legacy name) to this socket. @@ -71,25 +69,6 @@ in { ''; }; - phpfpmProcessManagerConfig = mkOption { - type = types.str; - default = '' - ; default phpfpm process manager settings - pm = dynamic - pm.max_children = 75 - pm.start_servers = 10 - pm.min_spare_servers = 5 - pm.max_spare_servers = 20 - pm.max_requests = 500 - - ; log worker's stdout, but this has a performance hit - catch_workers_output = yes - ''; - description = '' - Settings for phpfpm's process manager. You might need to change this depending on the load for Matomo. - ''; - }; - nginx = mkOption { type = types.nullOr (types.submodule ( recursiveUpdate @@ -233,15 +212,24 @@ in { else if (cfg.webServerUser != null) then cfg.webServerUser else ""; in { ${pool} = { - listen = phpSocket; - extraConfig = '' - listen.owner = ${socketOwner} - listen.group = root - listen.mode = 0600 - user = ${user} - env[PIWIK_USER_PATH] = ${dataDir} - ${cfg.phpfpmProcessManagerConfig} + inherit user; + phpOptions = '' + error_log = 'stderr' + log_errors = on ''; + settings = mapAttrs (name: mkDefault) { + "listen.owner" = socketOwner; + "listen.group" = "root"; + "listen.mode" = "0660"; + "pm" = "dynamic"; + "pm.max_children" = 75; + "pm.start_servers" = 10; + "pm.min_spare_servers" = 5; + "pm.max_spare_servers" = 20; + "pm.max_requests" = 500; + "catch_workers_output" = true; + }; + phpEnv.PIWIK_USER_PATH = dataDir; }; }; @@ -264,15 +252,15 @@ in { }; # allow index.php for webinterface locations."= /index.php".extraConfig = '' - fastcgi_pass unix:${phpSocket}; + fastcgi_pass unix:${fpm.socket}; ''; # allow matomo.php for tracking locations."= /matomo.php".extraConfig = '' - fastcgi_pass unix:${phpSocket}; + fastcgi_pass unix:${fpm.socket}; ''; # allow piwik.php for tracking (deprecated name) locations."= /piwik.php".extraConfig = '' - fastcgi_pass unix:${phpSocket}; + fastcgi_pass unix:${fpm.socket}; ''; # Any other attempt to access any php files is forbidden locations."~* ^.+\\.php$".extraConfig = '' From a1355b9b83c4649016f7550d1a0ed21c468314ab Mon Sep 17 00:00:00 2001 From: Michael Fellinger <michael.fellinger@iohk.io> Date: Wed, 9 Oct 2019 13:03:06 +0200 Subject: [PATCH 46/57] nginx: add map_hash_*_size options (cherry picked from commit 2d0b34aa1cb36f0af8479602ae149c59e4f0fbf3) --- .../services/web-servers/nginx/default.nix | 25 +++++++++++++++++++ 1 file changed, 25 insertions(+) diff --git a/nixos/modules/services/web-servers/nginx/default.nix b/nixos/modules/services/web-servers/nginx/default.nix index b94b338fd4a6..e8235881bd31 100644 --- a/nixos/modules/services/web-servers/nginx/default.nix +++ b/nixos/modules/services/web-servers/nginx/default.nix @@ -120,6 +120,14 @@ let include ${recommendedProxyConfig}; ''} + ${optionalString (cfg.mapHashBucketSize != null) '' + map_hash_bucket_size ${toString cfg.mapHashBucketSize}; + ''} + + ${optionalString (cfg.mapHashMaxSize != null) '' + map_hash_max_size ${toString cfg.mapHashMaxSize}; + ''} + # $connection_upgrade is used for websocket proxying map $http_upgrade $connection_upgrade { default upgrade; @@ -508,6 +516,23 @@ in ''; }; + mapHashBucketSize = mkOption { + type = types.nullOr (types.enum [ 32 64 128 ]); + default = null; + description = '' + Sets the bucket size for the map variables hash tables. Default + value depends on the processor’s cache line size. + ''; + }; + + mapHashMaxSize = mkOption { + type = types.nullOr types.ints.positive; + default = null; + description = '' + Sets the maximum size of the map variables hash tables. + ''; + }; + resolver = mkOption { type = types.submodule { options = { From fad0a4718dee9544793df66f730daa8c1703e776 Mon Sep 17 00:00:00 2001 From: Matthew Bauer <mjbauer95@gmail.com> Date: Fri, 1 Nov 2019 11:18:41 -0400 Subject: [PATCH 47/57] ledger-udev-rules: update to 2019-05-30 Fixes #71201 (cherry picked from commit ff066a107bbaf17808462d7d986ff43234c66535) --- pkgs/os-specific/linux/ledger-udev-rules/default.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/os-specific/linux/ledger-udev-rules/default.nix b/pkgs/os-specific/linux/ledger-udev-rules/default.nix index 96c60f6ea56e..e61bac510e69 100644 --- a/pkgs/os-specific/linux/ledger-udev-rules/default.nix +++ b/pkgs/os-specific/linux/ledger-udev-rules/default.nix @@ -2,13 +2,13 @@ stdenv.mkDerivation { pname = "ledger-udev-rules"; - version = "unstable-2019-02-13"; + version = "unstable-2019-05-30"; src = fetchFromGitHub { owner = "LedgerHQ"; repo = "udev-rules"; - rev = "20cc1651eb551c4855aaa56628c77eaeb3031c22"; - sha256 = "0riydkc4in10pv4qlrvbg3w78qsvxly5caa3zwyqcmsm5fmprqky"; + rev = "765b7fdf57b20fd9326cedf48ee52e905024ab4f"; + sha256 = "10a42al020zpkx918y6b1l9az45vk3921b2l1mx87w3m0ad9qvif"; }; dontBuild = true; From 40fcdac3cb45aaf69eb3f2aada29ad734cbacfd4 Mon Sep 17 00:00:00 2001 From: Jonathan Ringer <jonringer117@gmail.com> Date: Fri, 15 Nov 2019 18:09:59 -0800 Subject: [PATCH 48/57] steam: use 32bit version of libva (cherry picked from commit 87c674daef8e2b19e6c88363a9c7f54e17526e87) --- pkgs/games/steam/chrootenv.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkgs/games/steam/chrootenv.nix b/pkgs/games/steam/chrootenv.nix index 0de961e6d49f..3be1f5229743 100644 --- a/pkgs/games/steam/chrootenv.nix +++ b/pkgs/games/steam/chrootenv.nix @@ -75,7 +75,7 @@ in buildFHSUserEnv rec { xorg.libX11 xorg.libXfixes libGL - libva + pkgsi686Linux.libva # Not formally in runtime but needed by some games at-spi2-atk From 96c9578020133fe64feab90c00f3cb880d53ad0d Mon Sep 17 00:00:00 2001 From: Rob Vermaas <rob.vermaas@gmail.com> Date: Tue, 19 Nov 2019 11:09:12 +0100 Subject: [PATCH 49/57] nixpart0: remove broken, fix build for (local) pykickstart dep (cherry picked from commit 302396fc420edc7b74becd249c56898aae99fe44) --- pkgs/tools/filesystems/nixpart/0.4/pykickstart.nix | 1 - 1 file changed, 1 deletion(-) diff --git a/pkgs/tools/filesystems/nixpart/0.4/pykickstart.nix b/pkgs/tools/filesystems/nixpart/0.4/pykickstart.nix index 8a1fce780378..9d067359c44a 100644 --- a/pkgs/tools/filesystems/nixpart/0.4/pykickstart.nix +++ b/pkgs/tools/filesystems/nixpart/0.4/pykickstart.nix @@ -19,7 +19,6 @@ buildPythonApplication rec { propagatedBuildInputs = [ urlgrabber ]; checkPhase = '' - export PYTHONPATH="$PYTHONPATH:." ${python}/bin/${python.executable} tests/baseclass.py -vv ''; From cad09e9374e3295c2019cb6f0d9c0cb21f84b9f6 Mon Sep 17 00:00:00 2001 From: Dima <dgoldin+github@protonmail.ch> Date: Tue, 19 Nov 2019 14:20:33 +0100 Subject: [PATCH 50/57] samba: 4.10.8 -> 4.10.10 - security Addresses issue: https://github.com/NixOS/nixpkgs/issues/73682 Samba fixes overview for reference: https://www.samba.org/samba/history/security.html (cherry picked from commit 0de2c3011e880d0335ad298b1db935c5823d0d4d) --- pkgs/servers/samba/4.x.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/servers/samba/4.x.nix b/pkgs/servers/samba/4.x.nix index 044acbe17207..f92c5aaa2100 100644 --- a/pkgs/servers/samba/4.x.nix +++ b/pkgs/servers/samba/4.x.nix @@ -20,11 +20,11 @@ with lib; stdenv.mkDerivation rec { pname = "samba"; - version = "4.10.8"; + version = "4.10.10"; src = fetchurl { url = "mirror://samba/pub/samba/stable/${pname}-${version}.tar.gz"; - sha256 = "1x0hlhb674fndfkmimjicnzs543n3i8465a5ifcmjwvzavxha7y4"; + sha256 = "19b653rr2i9snvapik58phbqj38cxjdlyx6nl3m2y3k1a55p633h"; }; outputs = [ "out" "dev" "man" ]; From 0afec75e0cdf4d77cf36db749acfdad35a1d95b2 Mon Sep 17 00:00:00 2001 From: Will Dietz <w@wdtz.org> Date: Sun, 6 Oct 2019 19:31:23 -0500 Subject: [PATCH 51/57] ktorrent: mkDerivation (cherry picked from commit d6451a796bab18599e1585f9b682369ad815afc9) --- pkgs/applications/networking/p2p/ktorrent/default.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/applications/networking/p2p/ktorrent/default.nix b/pkgs/applications/networking/p2p/ktorrent/default.nix index 535991312f1d..e38378d09b32 100644 --- a/pkgs/applications/networking/p2p/ktorrent/default.nix +++ b/pkgs/applications/networking/p2p/ktorrent/default.nix @@ -1,11 +1,11 @@ -{ stdenv, fetchurl, fetchpatch, cmake +{ mkDerivation, lib, fetchurl, fetchpatch, cmake , extra-cmake-modules, qtbase, qtscript , karchive, kcrash, kdnssd, ki18n, kio, knotifications, knotifyconfig , kdoctools, kross, kcmutils, kwindowsystem , libktorrent, taglib, libgcrypt, kplotting }: -stdenv.mkDerivation rec { +mkDerivation rec { pname = "ktorrent"; version = "${libktorrent.mainVersion}"; @@ -24,7 +24,7 @@ stdenv.mkDerivation rec { enableParallelBuilding = true; - meta = with stdenv.lib; { + meta = with lib; { description = "KDE integrated BtTorrent client"; homepage = https://www.kde.org/applications/internet/ktorrent/; license = licenses.gpl2; From 3bccd389cd657824f7a859b490fa2445efdb2b29 Mon Sep 17 00:00:00 2001 From: Robert Scott <code@humanleg.org.uk> Date: Tue, 19 Nov 2019 15:23:30 +0000 Subject: [PATCH 52/57] libextractor: add patch for CVE-2019-15531 (#73728) (cherry picked from commit 593def2396e2a88dbf9a26dcc892772b39c773a7) --- pkgs/development/libraries/libextractor/default.nix | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/pkgs/development/libraries/libextractor/default.nix b/pkgs/development/libraries/libextractor/default.nix index 8fd01dbd506a..ea155440c8d1 100644 --- a/pkgs/development/libraries/libextractor/default.nix +++ b/pkgs/development/libraries/libextractor/default.nix @@ -22,6 +22,12 @@ stdenv.mkDerivation rec { url = "https://git.archlinux.org/svntogit/community.git/plain/trunk/libextractor-exiv2-0.27.patch?h=packages/libextractor&id=4dc53f7fc69210ae571285dface108ed65d8ee53"; sha256 = "0w4gc1q1m1yxsd4hv105nblmif465nw3g5nxzldy0x2rl9mdncg6"; }) + (fetchpatch { + name = "CVE-2019-15531.patch"; + url = "https://git.gnunet.org/libextractor.git/patch/?id=d2b032452241708bee68d02aa02092cfbfba951a"; + sha256 = "01xhcjbzv6p53wz7y2ii76kb8m9iwvnm4ip9w4a0bpgaxqz4b9fw"; + excludes = [ "ChangeLog" ]; + }) ]; preConfigure = From 0c0da42e476f736bedf64324b9f898b2d908ae94 Mon Sep 17 00:00:00 2001 From: Dima <dgoldin+github@protonmail.ch> Date: Tue, 19 Nov 2019 17:25:31 +0100 Subject: [PATCH 53/57] skypeforlinux: Adding archive.org mirror Adding an additional web-archive url to avoid breakage when old versions disappear from upstream. Still keeping original location to not needlessly hit archive.org (it's also slower). (cherry picked from commit ad8c1703ec5a88ab2b2642b57a1e1dafabd2a41e) and resolved conflicts. --- .../networking/instant-messengers/skypeforlinux/default.nix | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/pkgs/applications/networking/instant-messengers/skypeforlinux/default.nix b/pkgs/applications/networking/instant-messengers/skypeforlinux/default.nix index 1eff219f68ef..79d0d5f779d1 100644 --- a/pkgs/applications/networking/instant-messengers/skypeforlinux/default.nix +++ b/pkgs/applications/networking/instant-messengers/skypeforlinux/default.nix @@ -59,7 +59,10 @@ let src = if stdenv.hostPlatform.system == "x86_64-linux" then fetchurl { - url = "https://repo.skype.com/deb/pool/main/s/skypeforlinux/skypeforlinux_${version}_amd64.deb"; + urls = [ + "https://repo.skype.com/deb/pool/main/s/skypeforlinux/skypeforlinux_${version}_amd64.deb" + "https://web.archive.org/web/https://repo.skype.com/deb/pool/main/s/skypeforlinux/skypeforlinux_${version}_amd64.deb" + ]; sha256 = "11x13c7z70iaq86pyy5nqc0mcfdr7vjpjkxw6kdyjhqyxs6q6ipf"; } else From c738f98c915b36b88733fea8c18206639fc4e60e Mon Sep 17 00:00:00 2001 From: Robin Gloster <mail@glob.in> Date: Wed, 20 Nov 2019 10:26:02 +0100 Subject: [PATCH 54/57] nixos/manual: reword installation section Sounded a bit unprofessional and pessimistic. Was actually called out on twitter. (cherry picked from commit 844625708e62d22b9181fa72379d0d62285a5820) --- nixos/doc/manual/installation/installing.xml | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/nixos/doc/manual/installation/installing.xml b/nixos/doc/manual/installation/installing.xml index 8ff920eb5a88..7991c43e01fe 100644 --- a/nixos/doc/manual/installation/installing.xml +++ b/nixos/doc/manual/installation/installing.xml @@ -392,11 +392,11 @@ <filename>hardware-configuration.nix</filename> is included from <filename>configuration.nix</filename> and will be overwritten by future invocations of <command>nixos-generate-config</command>; thus, you - generally should not modify it.) Additionally, you may want to look at + generally should not modify it.) Additionally, you may want to look at <link xlink:href="https://github.com/NixOS/nixos-hardware">Hardware configuration for known-hardware</link> at this point or after installation. - + </para> <note> <para> @@ -418,11 +418,11 @@ Do the installation: <screen> <prompt># </prompt>nixos-install</screen> - Cross fingers. If this fails due to a temporary problem (such as a network - issue while downloading binaries from the NixOS binary cache), you can - just re-run <command>nixos-install</command>. Otherwise, fix your - <filename>configuration.nix</filename> and then re-run - <command>nixos-install</command>. + This will install your system based on the configuration you provided. + If anything fails due to a configuration problem or any other issue + (such as a network outage while downloading binaries from the NixOS + binary cache), you can re-run <command>nixos-install</command> after + fixing your <filename>configuration.nix</filename>. </para> <para> As the last step, <command>nixos-install</command> will ask you to set the From 388810a0b774b1e191357d17f1ba359d9badde2e Mon Sep 17 00:00:00 2001 From: Ivan Kozik <ivan@ludios.org> Date: Tue, 19 Nov 2019 05:13:11 +0000 Subject: [PATCH 55/57] chromium: 78.0.3904.97 -> 78.0.3904.108 CVE-2019-13723 CVE-2019-13724 https://chromereleases.googleblog.com/2019/11/stable-channel-update-for-desktop_18.html (cherry picked from commit 0c8fc2e90e54087b356801a71787264bb79bd131) --- .../browsers/chromium/upstream-info.nix | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/pkgs/applications/networking/browsers/chromium/upstream-info.nix b/pkgs/applications/networking/browsers/chromium/upstream-info.nix index 2e7fcb09560a..bc1b5e9b23c5 100644 --- a/pkgs/applications/networking/browsers/chromium/upstream-info.nix +++ b/pkgs/applications/networking/browsers/chromium/upstream-info.nix @@ -1,18 +1,18 @@ # This file is autogenerated from update.sh in the same directory. { beta = { - sha256 = "1n45pfpjqrpzmy7k2ps498mm273bpzfda58dz78lbdm6r7z3s7av"; - sha256bin64 = "1rf31v1ipix8c6q4blqjrn2ap3pxnlrpfx7037qjpg84zhip0zpc"; - version = "79.0.3945.29"; + sha256 = "0sm6x4z6i6p292l98k0h0v69f29hgfd9l46jg8xbh2jzg9f5fp78"; + sha256bin64 = "1yvy0d2h09cf1w42c93kpw66a2v9yn079zs6qjiqzs07yzxvxjdm"; + version = "79.0.3945.36"; }; dev = { - sha256 = "1zj0nmj1687xsyzlh1hy2wblxv1qgdy2kj9h8bmqhld16laxwqw5"; - sha256bin64 = "1x8wpdz18cflvj2ambqwyhzq206dil4szh1s8paqw1jwncaw7gjf"; - version = "80.0.3962.2"; + sha256 = "0zf434ijk6zw37fricnkb1968nhmb7zlfivf59nx9yh7irbwb4hm"; + sha256bin64 = "1fphf8pwbbirs9fiislg3vav8c4a393lz487sa7f90mzsx84ffiz"; + version = "80.0.3964.0"; }; stable = { - sha256 = "01wx5bi397d80za0sdfwgfbjj6n2ad2i31zmcrhm6wzryjwrmx6i"; - sha256bin64 = "1nwhyasqxkxkx5pn2j9dx95mblj5w7fkh2zwvjz763b331w65ivp"; - version = "78.0.3904.97"; + sha256 = "03jvfz68nvmmrplygf96sh0l347p4h03c8vpw8yrglh6ycwkiigr"; + sha256bin64 = "1knsrdh4vj1zl3v1frzrvzg0pwb64zhq2il7pwskrfcbmsj3gkh6"; + version = "78.0.3904.108"; }; } From cc8e52335572ab9a225671224521dd16a53f0598 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz> Date: Wed, 20 Nov 2019 13:31:03 +0100 Subject: [PATCH 56/57] Merge #45957: nixos manual: releases workflow improvements Let's merge NOW; I'm not doing the same mistake again. (cherry picked from commit e32d55796724ae79f61b3cd42369a0cb8c6671af) --- nixos/doc/manual/development/releases.xml | 21 ++++++++++++--------- 1 file changed, 12 insertions(+), 9 deletions(-) diff --git a/nixos/doc/manual/development/releases.xml b/nixos/doc/manual/development/releases.xml index 1cdec64f69b0..9371af9984d1 100755 --- a/nixos/doc/manual/development/releases.xml +++ b/nixos/doc/manual/development/releases.xml @@ -45,12 +45,12 @@ <listitem> <para> <literal>git tag -a -s -m "Release 17.09-beta" 17.09-beta - && git push --tags</literal> + && git push origin 17.09-beta</literal> </para> </listitem> <listitem> <para> - From the master branch run <literal>git checkout -B + From the master branch run <literal>git checkout -b release-17.09</literal>. </para> </listitem> @@ -157,7 +157,7 @@ <listitem> <para> Release Nix (currently only Eelco Dolstra can do that). - <link xlink:href="https://github.com/NixOS/nixpkgs/commit/53710c752a85f00658882531bc90a23a3d1287e4"> + <link xlink:href="https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/installer/tools/nix-fallback-paths.nix"> Make sure fallback is updated. </link> </para> </listitem> @@ -169,8 +169,8 @@ </listitem> <listitem> <para> - Change <literal>stableBranch</literal> to true and wait for channel to - update. + Change <literal>stableBranch</literal> to <literal>true</literal> in Hydra and wait for + the channel to update. </para> </listitem> </itemizedlist> @@ -193,9 +193,11 @@ </listitem> <listitem> <para> - Update http://nixos.org/nixos/download.html and - http://nixos.org/nixos/manual in - https://github.com/NixOS/nixos-org-configurations + Update the + <link xlink:href="https://github.com/NixOS/nixos-homepage/commit/2a37975d5a617ecdfca94696242b6f32ffcba9f1"><code>NIXOS_SERIES</code></link> + in the + <link xlink:href="https://github.com/NixOS/nixos-homepage">nixos-homepage</link> + repository. </para> </listitem> <listitem> @@ -212,7 +214,8 @@ </listitem> <listitem> <para> - Send an email to nix-dev to announce the release with above information. + Create a new topic on <link xlink:href="https://discourse.nixos.org/">the + Discourse instance</link> to announce the release with the above information. Best to check how previous email was formulated to see what needs to be included. </para> From 9ed32341c7b7a4671fc7d736ca3cd5bc54d3e297 Mon Sep 17 00:00:00 2001 From: Ricardo Ardissone <ricardo.ardissone@gmail.com> Date: Wed, 23 Oct 2019 19:43:40 -0300 Subject: [PATCH 57/57] hedgewars: 1.0.0-beta2 -> 1.0.0 (cherry picked from commit 4de18778a356807feb756822e60a2d38f7e0e7c0) Fixes #73829. --- pkgs/games/hedgewars/default.nix | 13 +++++-------- 1 file changed, 5 insertions(+), 8 deletions(-) diff --git a/pkgs/games/hedgewars/default.nix b/pkgs/games/hedgewars/default.nix index bac7bd345f94..dffeb2ac556d 100644 --- a/pkgs/games/hedgewars/default.nix +++ b/pkgs/games/hedgewars/default.nix @@ -1,5 +1,5 @@ { mkDerivation, SDL2_image, SDL2_ttf, SDL2_net, fpc, ghcWithPackages, ffmpeg, freeglut -, lib, fetchhg, cmake, pkgconfig, lua5_1, SDL2, SDL2_mixer +, lib, fetchurl, cmake, pkgconfig, lua5_1, SDL2, SDL2_mixer , zlib, libpng, libGL, libGLU, physfs , qtbase, qttools , withServer ? true @@ -14,14 +14,11 @@ let in mkDerivation rec { pname = "hedgewars"; - version = "1.0.0-beta2"; + version = "1.0.0"; - # it's crazy slow to fetch the whole repo but the beta versions are not - # released as tarballs - src = fetchhg { - url = "https://hg.hedgewars.org/hedgewars/"; - rev = "dff37ac61dcf"; - sha256 = "1dsq6wfv3d7jfnr068b7ixpnqp0h6mj7zgby6h1viwblgbirri78"; + src = fetchurl { + url = "https://www.hedgewars.org/download/releases/hedgewars-src-${version}.tar.bz2"; + sha256 = "0nqm9w02m0xkndlsj6ys3wr0ik8zc14zgilq7k6fwjrf3zk385i1"; }; nativeBuildInputs = [ cmake pkgconfig qttools ];