diff --git a/pkgs/applications/editors/pulsar/001-patch-wrapper.patch b/pkgs/applications/editors/pulsar/001-patch-wrapper.patch index 252dc5328ef2..2270ad3c8aea 100644 --- a/pkgs/applications/editors/pulsar/001-patch-wrapper.patch +++ b/pkgs/applications/editors/pulsar/001-patch-wrapper.patch @@ -1,27 +1,11 @@ --- a/resources/pulsar.sh 2023-03-16 04:11:14.000000000 +0100 +++ b/resources/pulsar.sh 2023-03-24 14:37:13.468813964 +0100 -@@ -123,22 +123,9 @@ +@@ -123,7 +123,7 @@ elif [ $OS == 'Linux' ]; then SCRIPT=$(readlink -f "$0") - PULSAR_PATH="/opt/Pulsar/pulsar" + # PULSAR_PATH is set-up via `wrapProgram` in the postFixup phase - -- #Will allow user to get context menu on cinnamon desktop enviroment -- #Add a check to make sure that DESKTOP_SESSION is set before attempting to grep it -- #expr substr is expecting 3 arguments string, index, length -- #If grep doesnt find anything is provides an empty string which causes the expr: syntax error: missing argument after '8' error - see pulsar-edit/pulsar#174 -- #Im also not quite sure why they used grep instead of simply [ "${DESKTOP_SESSION}" == "cinnamon" ] -- if [ -n "${DESKTOP_SESSION}" ] && [ "$(expr substr $(printenv | grep 'DESKTOP_SESSION=') 17 8)" == "cinnamon" ]; then -- #This local path is almost assuredly wrong as it shouldnt exist in a standard install -- ACTION_PATH="resources/linux/desktopenviroment/cinnamon/pulsar.nemo_action" -- -- #Validate the file exists before attempting to copy it -- if [ -f "${ACTION_PATH}" ]; then -- cp "${$ACTION_PATH}" "/usr/share/nemo/actions/pulsar.nemo_action" -- fi -- fi -+ # We remove the nemo integration. It is handled by the postFixup phase #Set tmpdir only if tmpdir is unset : ${TMPDIR:=/tmp} diff --git a/pkgs/applications/editors/pulsar/default.nix b/pkgs/applications/editors/pulsar/default.nix index 85b28061e45d..fe850a8f427f 100644 --- a/pkgs/applications/editors/pulsar/default.nix +++ b/pkgs/applications/editors/pulsar/default.nix @@ -23,13 +23,13 @@ let pname = "pulsar"; - version = "1.104.0"; + version = "1.106.0"; sourcesPath = { x86_64-linux.tarname = "Linux.${pname}-${version}.tar.gz"; - x86_64-linux.hash = "sha256-HEMUQVNPb6qWIXX25N79HwHo7j11MyFiBRsq9otdAL8="; + x86_64-linux.hash = "sha256-Wd0z6kHd6qZgrgZBxZQjwVC1dDqYtJ94L7aAnbuJoO8="; aarch64-linux.tarname = "ARM.Linux.${pname}-${version}-arm64.tar.gz"; - aarch64-linux.hash = "sha256-f+s54XtLLdhTFY9caKTKngJF6zLai0F7ur9v37bwuNE="; + aarch64-linux.hash = "sha256-Xadjqw8PRrq0ksif6te0gxn8xeYTCYnJcsrezfl2SYs="; }.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}"); additionalLibs = lib.makeLibraryPath [ @@ -119,7 +119,7 @@ stdenv.mkDerivation rec { # But asar complains because the node_gyp unpacked dependency uses a prebuilt Python3 itself rm $opt/resources/app.asar.unpacked/node_modules/tree-sitter-bash/build/node_gyp_bins/python3 - ln -s ${python3}/bin/python3 $opt/resources/app.asar.unpacked/node_modules/tree-sitter-bash/build/node_gyp_bins/python3 + ln -s ${python3.interpreter} $opt/resources/app.asar.unpacked/node_modules/tree-sitter-bash/build/node_gyp_bins/python3 '' + '' # Patch the bundled node executables find $opt -name "*.node" -exec patchelf --set-rpath "${newLibpath}:$opt" {} \; diff --git a/pkgs/applications/editors/pulsar/update.mjs b/pkgs/applications/editors/pulsar/update.mjs index 2e4155d87422..4f3d2993e973 100755 --- a/pkgs/applications/editors/pulsar/update.mjs +++ b/pkgs/applications/editors/pulsar/update.mjs @@ -13,6 +13,17 @@ const constants = { targetFile: new URL("default.nix", import.meta.url).pathname, }; +async function utf16ToUtf8(blob) { + // Sometime, upstream saves the SHA256SUMS.txt file in UTF-16, which absolutely breaks node's string handling + // So we need to convert this blob to UTF-8 + + // We need to skip the first 2 bytes, which are the BOM + const arrayBuffer = await blob.slice(2).arrayBuffer(); + const buffer = Buffer.from(arrayBuffer); + const utf8String = buffer.toString('utf16le'); + return utf8String; +} + async function getLatestVersion() { const requestResult = await fetch(constants.githubUrl); if (!requestResult.ok) { @@ -37,6 +48,7 @@ async function getSha256Sum(hashFileContent, targetFile) { let sha256 = hashFileContent. split('\n'). + map(line => line.replace("\r", "")). // Side-effect of the UTF-16 conversion, if the file was created from Windows filter((line) => line.endsWith(targetFile))[0]. split(' ')[0]; @@ -47,14 +59,21 @@ async function getSha256Sums(newVersion) { // Upstream provides a file with the hashes of the files, but it's not in the SRI format, and it refers to the compressed tarball // So let's just use nix-prefetch-url to get the hashes of the decompressed tarball, and `nix hash to-sri` to convert them to SRI format const hashFileUrl = constants.sha256FileURL(newVersion); - const hashFileContent = await fetch(hashFileUrl).then((response) => response.text()); + const hashFileContent = await fetch(hashFileUrl).then((response) => response.blob()); + const headerbuffer = await hashFileContent.slice(0, 2).arrayBuffer() + const header = Buffer.from(headerbuffer).toString('hex'); + + // We must detect if it's UTF-16 or UTF-8. If it's UTF-16, we must convert it to UTF-8, otherwise just use it as-is + const hashFileContentString = header == 'fffe' ? + await utf16ToUtf8(hashFileContent) : + await hashFileContent.text(); let x86_64; let aarch64; console.log("Getting new hashes"); let promises = [ - getSha256Sum(hashFileContent, constants.x86_64FileName(newVersion)).then((hash) => { x86_64 = hash; }), - getSha256Sum(hashFileContent, constants.aarch64FileName(newVersion)).then((hash) => { aarch64 = hash; }), + getSha256Sum(hashFileContentString, constants.x86_64FileName(newVersion)).then((hash) => { x86_64 = hash; }), + getSha256Sum(hashFileContentString, constants.aarch64FileName(newVersion)).then((hash) => { aarch64 = hash; }), ]; await Promise.all(promises); return { x86_64, aarch64 }; diff --git a/pkgs/applications/emulators/retroarch/retroarch-joypad-autoconfig.nix b/pkgs/applications/emulators/retroarch/retroarch-joypad-autoconfig.nix new file mode 100644 index 000000000000..92ba7f20c8b3 --- /dev/null +++ b/pkgs/applications/emulators/retroarch/retroarch-joypad-autoconfig.nix @@ -0,0 +1,28 @@ +{ lib +, stdenvNoCC +, fetchFromGitHub +}: + +stdenvNoCC.mkDerivation rec { + pname = "retroarch-joypad-autoconfig"; + version = "1.15.0"; + + src = fetchFromGitHub { + owner = "libretro"; + repo = "retroarch-joypad-autoconfig"; + rev = "v${version}"; + hash = "sha256-/F2Y08uDA/pIIeLiLfOQfGVjX2pkuOqPourlx2RbZ28="; + }; + + makeFlags = [ + "PREFIX=$(out)" + ]; + + meta = with lib; { + description = "Joypad autoconfig files"; + homepage = "https://www.libretro.com/"; + license = licenses.mit; + maintainers = with maintainers; teams.libretro.members ++ [ ]; + platforms = platforms.all; + }; +} diff --git a/pkgs/applications/emulators/retroarch/wrapper.nix b/pkgs/applications/emulators/retroarch/wrapper.nix index afef0bef8a48..4698bbe5bbed 100644 --- a/pkgs/applications/emulators/retroarch/wrapper.nix +++ b/pkgs/applications/emulators/retroarch/wrapper.nix @@ -3,16 +3,28 @@ , makeWrapper , retroarch , symlinkJoin +, runCommand , cores ? [ ] +, settings ? { } }: let + settingsPath = runCommand "declarative-retroarch.cfg" + { + value = lib.concatStringsSep "\n" (lib.mapAttrsToList (n: v: "${n} = \"${v}\"") settings); + passAsFile = [ "value" ]; + } + '' + cp "$valuePath" "$out" + ''; + # All cores should be located in the same path after symlinkJoin, # but let's be safe here coresPath = lib.lists.unique (map (c: c.libretroCore) cores); - wrapperArgs = lib.strings.escapeShellArgs - (lib.lists.flatten - (map (p: [ "--add-flags" "-L ${placeholder "out" + p}" ]) coresPath)); + wrapperArgs = lib.strings.escapeShellArgs ( + (lib.lists.flatten (map (p: [ "--add-flags" "-L ${placeholder "out" + p}" ]) coresPath)) + ++ [ "--add-flags" "--appendconfig=${settingsPath}" ] + ); in symlinkJoin { name = "retroarch-with-cores-${lib.getVersion retroarch}"; diff --git a/pkgs/applications/networking/browsers/palemoon/bin.nix b/pkgs/applications/networking/browsers/palemoon/bin.nix index cdae7b7c552d..ece75ad87257 100644 --- a/pkgs/applications/networking/browsers/palemoon/bin.nix +++ b/pkgs/applications/networking/browsers/palemoon/bin.nix @@ -19,7 +19,7 @@ stdenv.mkDerivation rec { pname = "palemoon-bin"; - version = "32.2.1"; + version = "32.3.1"; src = fetchzip { urls = [ @@ -27,9 +27,9 @@ stdenv.mkDerivation rec { "https://rm-us.palemoon.org/release/palemoon-${version}.linux-x86_64-gtk${if withGTK3 then "3" else "2"}.tar.xz" ]; hash = if withGTK3 then - "sha256-brF9ACAG+JM7bk/JarB208f8ihI/1d90l+6e1pHmC20=" + "sha256-1JYaxxkqgg/gLdZ+uGDB5BI0NKjHO4huk0b/M9QFuII=" else - "sha256-205rhW89Jlk4ICraqndTbJ6/88+ZqhtDOIvhFTiEUz0="; + "sha256-p/Lid6Uv3XTEg+43Gke5VLILhzENHoBP6XjGVHy7wCY="; }; preferLocalBuild = true; diff --git a/pkgs/development/interpreters/elixir/1.15.nix b/pkgs/development/interpreters/elixir/1.15.nix index 6dada168cc37..6c23d3d326f4 100644 --- a/pkgs/development/interpreters/elixir/1.15.nix +++ b/pkgs/development/interpreters/elixir/1.15.nix @@ -1,7 +1,7 @@ { mkDerivation }: mkDerivation { - version = "1.15.0"; - sha256 = "sha256-o5MfA0UG8vpnPCH1EYspzcN62yKZQcz5uVUY47hOL9w="; + version = "1.15.4"; + sha256 = "sha256-0DrfKQPyFX+zurCIZ6RVj9vm1lHSkJSfhiUaRpa3FFo="; # https://hexdocs.pm/elixir/1.15.0/compatibility-and-deprecations.html#compatibility-between-elixir-and-erlang-otp minimumOTPVersion = "24"; escriptPath = "lib/elixir/scripts/generate_app.escript"; diff --git a/pkgs/os-specific/linux/kernel/hardened/patches.json b/pkgs/os-specific/linux/kernel/hardened/patches.json index d61e13b25aec..c1cb0cfe72e3 100644 --- a/pkgs/os-specific/linux/kernel/hardened/patches.json +++ b/pkgs/os-specific/linux/kernel/hardened/patches.json @@ -52,31 +52,31 @@ "6.1": { "patch": { "extra": "-hardened1", - "name": "linux-hardened-6.1.38-hardened1.patch", - "sha256": "0sv8i26xwgw3a36yga79n36a5xbrs3ajn8wdkqn40ydbzp24i0qc", - "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.1.38-hardened1/linux-hardened-6.1.38-hardened1.patch" + "name": "linux-hardened-6.1.39-hardened1.patch", + "sha256": "0j4sgcs6m2mq9dn1v525bymhdhha3x8ivrpfrhqm553q4vdnmbg7", + "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.1.39-hardened1/linux-hardened-6.1.39-hardened1.patch" }, - "sha256": "0hrdh1w9z8bgy4cxqsxfkwa01yincfw1mq1bbwm36zczc0dzk97r", - "version": "6.1.38" + "sha256": "1f45j3ch1ljbacjlg8q45iva9lvwys938rdg0s516mznzlifxpac", + "version": "6.1.39" }, "6.3": { "patch": { "extra": "-hardened1", - "name": "linux-hardened-6.3.12-hardened1.patch", - "sha256": "12dqdn2prr0mczwcy48907wpp235n87pl22gwyfilsxcj94x2wrx", - "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.3.12-hardened1/linux-hardened-6.3.12-hardened1.patch" + "name": "linux-hardened-6.3.13-hardened1.patch", + "sha256": "1iy95awbkrdk5529w9s07axb21l2snab4kifbzjghhz9vwzx22rp", + "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.3.13-hardened1/linux-hardened-6.3.13-hardened1.patch" }, - "sha256": "1mvcirkhqnf03cci3jiq077fs9b42a3xdk3zjkpyim3x43ydwzyb", - "version": "6.3.12" + "sha256": "1ywijjhf19bciip75ppzjjh7bkadd449jr64yg2j5049w9h0aipa", + "version": "6.3.13" }, "6.4": { "patch": { "extra": "-hardened1", - "name": "linux-hardened-6.4.3-hardened1.patch", - "sha256": "1xwy9088f8qy7algv1gad90gd6sv03diz16jvfnk2yb01k4f87wv", - "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.4.3-hardened1/linux-hardened-6.4.3-hardened1.patch" + "name": "linux-hardened-6.4.4-hardened1.patch", + "sha256": "0yy02hn190wvl24z1j9kjmnyxrlp6s9fhkyvqgcm8i56d7d69zhb", + "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.4.4-hardened1/linux-hardened-6.4.4-hardened1.patch" }, - "sha256": "18c8ikghvlr6h9jajy11dldck4h57wl301j14rxg7xhd6qlysd3i", - "version": "6.4.3" + "sha256": "0apzfnn04w6jda9yw5cbgj8784frvqrryb1iw5ad390lwwmlmg4w", + "version": "6.4.4" } } diff --git a/pkgs/os-specific/linux/kernel/linux-6.1.nix b/pkgs/os-specific/linux/kernel/linux-6.1.nix index 31345c786690..b52a2798fcc2 100644 --- a/pkgs/os-specific/linux/kernel/linux-6.1.nix +++ b/pkgs/os-specific/linux/kernel/linux-6.1.nix @@ -3,7 +3,7 @@ with lib; buildLinux (args // rec { - version = "6.1.38"; + version = "6.1.39"; # modDirVersion needs to be x.y.z, will automatically add .0 if needed modDirVersion = versions.pad 3 version; @@ -13,6 +13,6 @@ buildLinux (args // rec { src = fetchurl { url = "mirror://kernel/linux/kernel/v6.x/linux-${version}.tar.xz"; - sha256 = "0hrdh1w9z8bgy4cxqsxfkwa01yincfw1mq1bbwm36zczc0dzk97r"; + sha256 = "1f45j3ch1ljbacjlg8q45iva9lvwys938rdg0s516mznzlifxpac"; }; } // (args.argsOverride or { })) diff --git a/pkgs/os-specific/linux/kernel/linux-6.3.nix b/pkgs/os-specific/linux/kernel/linux-6.3.nix index 4580c8054d3d..0f1a8f9866da 100644 --- a/pkgs/os-specific/linux/kernel/linux-6.3.nix +++ b/pkgs/os-specific/linux/kernel/linux-6.3.nix @@ -3,7 +3,7 @@ with lib; buildLinux (args // rec { - version = "6.3.12"; + version = "6.3.13"; # modDirVersion needs to be x.y.z, will automatically add .0 if needed modDirVersion = versions.pad 3 version; @@ -13,6 +13,6 @@ buildLinux (args // rec { src = fetchurl { url = "mirror://kernel/linux/kernel/v6.x/linux-${version}.tar.xz"; - sha256 = "1mvcirkhqnf03cci3jiq077fs9b42a3xdk3zjkpyim3x43ydwzyb"; + sha256 = "1ywijjhf19bciip75ppzjjh7bkadd449jr64yg2j5049w9h0aipa"; }; } // (args.argsOverride or { })) diff --git a/pkgs/os-specific/linux/kernel/linux-6.4.nix b/pkgs/os-specific/linux/kernel/linux-6.4.nix index 19aa95a1a10d..189f4da7ecae 100644 --- a/pkgs/os-specific/linux/kernel/linux-6.4.nix +++ b/pkgs/os-specific/linux/kernel/linux-6.4.nix @@ -3,7 +3,7 @@ with lib; buildLinux (args // rec { - version = "6.4.3"; + version = "6.4.4"; # modDirVersion needs to be x.y.z, will automatically add .0 if needed modDirVersion = versions.pad 3 version; @@ -13,6 +13,6 @@ buildLinux (args // rec { src = fetchurl { url = "mirror://kernel/linux/kernel/v6.x/linux-${version}.tar.xz"; - sha256 = "18c8ikghvlr6h9jajy11dldck4h57wl301j14rxg7xhd6qlysd3i"; + sha256 = "0apzfnn04w6jda9yw5cbgj8784frvqrryb1iw5ad390lwwmlmg4w"; }; } // (args.argsOverride or { })) diff --git a/pkgs/tools/security/age-plugin-tpm/default.nix b/pkgs/tools/security/age-plugin-tpm/default.nix new file mode 100644 index 000000000000..89291096db9b --- /dev/null +++ b/pkgs/tools/security/age-plugin-tpm/default.nix @@ -0,0 +1,41 @@ +{ lib +, buildGoModule +, fetchFromGitHub +, swtpm +}: + +buildGoModule rec { + pname = "age-plugin-tpm"; + version = "0.1.0"; + + src = fetchFromGitHub { + owner = "Foxboron"; + repo = "age-plugin-tpm"; + rev = "v${version}"; + hash = "sha256-Gp7n2/+vgQbsm/En6PQ1to/W6lvFam4Wh3LHdCZnafc="; + }; + + vendorHash = "sha256-oZni/n2J0N3ZxNhf+RlUWyWeOFwL4+6KUIk6DQF8YpA="; + + postConfigure = '' + substituteInPlace vendor/github.com/foxboron/swtpm_test/swtpm.go \ + --replace "/usr/share/swtpm/swtpm-create-user-config-files" "${swtpm}/share/swtpm/swtpm-create-user-config-files" + ''; + + nativeCheckInputs = [ + swtpm + ]; + + ldflags = [ + "-s" + "-w" + ]; + + meta = with lib; { + description = "TPM 2.0 plugin for age (This software is experimental, use it at your own risk)"; + homepage = "https://github.com/Foxboron/age-plugin-tpm"; + license = licenses.mit; + platforms = platforms.linux; + maintainers = with maintainers; [ kranzes ]; + }; +} diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index 2a4c4a8647dc..f151a92aa1c0 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -2491,19 +2491,24 @@ with pkgs; (builtins.attrValues libretro); }; - wrapRetroArch = { retroarch }: + wrapRetroArch = { retroarch, settings ? {} }: callPackage ../applications/emulators/retroarch/wrapper.nix - { inherit retroarch; }; + { inherit retroarch settings; }; retroarch = wrapRetroArch { retroarch = retroarchBare.override { withAssets = true; withCoreInfo = true; }; + settings = { + joypad_autoconfig_dir = "${retroarch-joypad-autoconfig}/share/libretro/autoconfig"; + }; }; retroarch-assets = callPackage ../applications/emulators/retroarch/retroarch-assets.nix { }; + retroarch-joypad-autoconfig = callPackage ../applications/emulators/retroarch/retroarch-joypad-autoconfig.nix { }; + libretro = recurseIntoAttrs (callPackage ../applications/emulators/retroarch/cores.nix { retroarch = retroarchBare; @@ -6477,6 +6482,8 @@ with pkgs; agebox = callPackage ../tools/security/agebox { }; + age-plugin-tpm = callPackage ../tools/security/age-plugin-tpm { }; + age-plugin-yubikey = darwin.apple_sdk_11_0.callPackage ../tools/security/age-plugin-yubikey { inherit (darwin.apple_sdk_11_0.frameworks) Foundation PCSC IOKit; };