diff --git a/nixos/modules/security/wrappers/default.nix b/nixos/modules/security/wrappers/default.nix index ad65f80bb2ca..a8bb0650b11a 100644 --- a/nixos/modules/security/wrappers/default.nix +++ b/nixos/modules/security/wrappers/default.nix @@ -5,8 +5,29 @@ let parentWrapperDir = dirOf wrapperDir; - securityWrapper = sourceProg : pkgs.callPackage ./wrapper.nix { + # This is security-sensitive code, and glibc vulns happen from time to time. + # musl is security-focused and generally more minimal, so it's a better choice here. + # The dynamic linker is still a fairly complex piece of code, and the wrappers are + # quite small, so linking it statically is more appropriate. + securityWrapper = sourceProg : pkgs.pkgsStatic.callPackage ./wrapper.nix { inherit sourceProg; + + # glibc definitions of insecure environment variables + # + # We extract the single header file we need into its own derivation, + # so that we don't have to pull full glibc sources to build wrappers. + # + # They're taken from pkgs.glibc so that we don't have to keep as close + # an eye on glibc changes. Not every relevant variable is in this header, + # so we maintain a slightly stricter list in wrapper.c itself as well. + unsecvars = lib.overrideDerivation (pkgs.srcOnly pkgs.glibc) + ({ name, ... }: { + name = "${name}-unsecvars"; + installPhase = '' + mkdir $out + cp sysdeps/generic/unsecvars.h $out + ''; + }); }; fileModeType = diff --git a/nixos/modules/security/wrappers/wrapper.c b/nixos/modules/security/wrappers/wrapper.c index 2cf1727a31c8..cf19c7a4aa45 100644 --- a/nixos/modules/security/wrappers/wrapper.c +++ b/nixos/modules/security/wrappers/wrapper.c @@ -17,6 +17,9 @@ #include #include +// imported from glibc +#include "unsecvars.h" + #ifndef SOURCE_PROG #error SOURCE_PROG should be defined via preprocessor commandline #endif @@ -151,9 +154,55 @@ static int make_caps_ambient(const char *self_path) { return 0; } +// These are environment variable aliases for glibc tunables. +// This list shouldn't grow further, since this is a legacy mechanism. +// Any future tunables are expected to only be accessible through GLIBC_TUNABLES. +// +// They are not included in the glibc-provided UNSECURE_ENVVARS list, +// since any SUID executable ignores them. This wrapper also serves +// executables that are merely granted ambient capabilities, rather than +// being SUID, and hence don't run in secure mode. We'd like them to +// defend those in depth as well, so we clear these explicitly. +// +// Except for MALLOC_CHECK_ (which is marked SXID_ERASE), these are all +// marked SXID_IGNORE (ignored in secure mode), so even the glibc version +// of this wrapper would leave them intact. +#define UNSECURE_ENVVARS_TUNABLES \ + "MALLOC_CHECK_\0" \ + "MALLOC_TOP_PAD_\0" \ + "MALLOC_PERTURB_\0" \ + "MALLOC_MMAP_THRESHOLD_\0" \ + "MALLOC_TRIM_THRESHOLD_\0" \ + "MALLOC_MMAP_MAX_\0" \ + "MALLOC_ARENA_MAX\0" \ + "MALLOC_ARENA_TEST\0" + int main(int argc, char **argv) { ASSERT(argc >= 1); + int debug = getenv(wrapper_debug) != NULL; + + // Drop insecure environment variables explicitly + // + // glibc does this automatically in SUID binaries, but we'd like to cover this: + // + // a) before it gets to glibc + // b) in binaries that are only granted ambient capabilities by the wrapper, + // but don't run with an altered effective UID/GID, nor directly gain + // capabilities themselves, and thus don't run in secure mode. + // + // We're using musl, which doesn't drop environment variables in secure mode, + // and we'd also like glibc-specific variables to be covered. + // + // If we don't explicitly unset them, it's quite easy to just set LD_PRELOAD, + // have it passed through to the wrapped program, and gain privileges. + for (char *unsec = UNSECURE_ENVVARS_TUNABLES UNSECURE_ENVVARS; *unsec; unsec = strchr(unsec, 0) + 1) { + if (debug) { + fprintf(stderr, "unsetting %s\n", unsec); + } + unsetenv(unsec); + } + // Read the capabilities set on the wrapper and raise them in to // the ambient set so the program we're wrapping receives the // capabilities too! diff --git a/nixos/modules/security/wrappers/wrapper.nix b/nixos/modules/security/wrappers/wrapper.nix index aec43412404e..da2fca98d5c5 100644 --- a/nixos/modules/security/wrappers/wrapper.nix +++ b/nixos/modules/security/wrappers/wrapper.nix @@ -1,4 +1,4 @@ -{ stdenv, linuxHeaders, sourceProg, debug ? false }: +{ stdenv, unsecvars, linuxHeaders, sourceProg, debug ? false }: # For testing: # $ nix-build -E 'with import {}; pkgs.callPackage ./wrapper.nix { parentWrapperDir = "/run/wrappers"; debug = true; }' stdenv.mkDerivation { @@ -16,6 +16,6 @@ stdenv.mkDerivation { dontStrip = debug; installPhase = '' mkdir -p $out/bin - $CC $CFLAGS ${./wrapper.c} -o $out/bin/security-wrapper + $CC $CFLAGS ${./wrapper.c} -I${unsecvars} -o $out/bin/security-wrapper ''; } diff --git a/nixos/modules/services/web-apps/grocy.nix b/nixos/modules/services/web-apps/grocy.nix index 4d1084e295ff..fe40a3c20941 100644 --- a/nixos/modules/services/web-apps/grocy.nix +++ b/nixos/modules/services/web-apps/grocy.nix @@ -8,6 +8,8 @@ in { options.services.grocy = { enable = mkEnableOption (lib.mdDoc "grocy"); + package = mkPackageOptionMD pkgs "grocy" { }; + hostName = mkOption { type = types.str; description = lib.mdDoc '' @@ -143,7 +145,7 @@ in { services.nginx = { enable = true; virtualHosts."${cfg.hostName}" = mkMerge [ - { root = "${pkgs.grocy}/public"; + { root = "${cfg.package}/public"; locations."/".extraConfig = '' rewrite ^ /index.php; ''; diff --git a/nixos/modules/services/x11/desktop-managers/gnome.nix b/nixos/modules/services/x11/desktop-managers/gnome.nix index a5c7cb16b9d3..ce8f2548a5ad 100644 --- a/nixos/modules/services/x11/desktop-managers/gnome.nix +++ b/nixos/modules/services/x11/desktop-managers/gnome.nix @@ -307,10 +307,9 @@ in gnome-flashback ] ++ map gnome-flashback.mkSystemdTargetForWm flashbackWms; - # gnome-panel needs these for menu applet - environment.sessionVariables.XDG_DATA_DIRS = [ "${pkgs.gnome.gnome-flashback}/share" ]; - # TODO: switch to sessionVariables (resolve conflict) - environment.variables.XDG_CONFIG_DIRS = [ "${pkgs.gnome.gnome-flashback}/etc/xdg" ]; + environment.systemPackages = with pkgs.gnome; [ + gnome-flashback + ]; }) (mkIf serviceCfg.core-os-services.enable { diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix index c221835f9a6a..9c9030469007 100644 --- a/nixos/tests/all-tests.nix +++ b/nixos/tests/all-tests.nix @@ -714,7 +714,7 @@ in { service-runner = handleTest ./service-runner.nix {}; sftpgo = runTest ./sftpgo.nix; sfxr-qt = handleTest ./sfxr-qt.nix {}; - sgtpuzzles = handleTest ./sgtpuzzles.nix {}; + sgt-puzzles = handleTest ./sgt-puzzles.nix {}; shadow = handleTest ./shadow.nix {}; shadowsocks = handleTest ./shadowsocks {}; shattered-pixel-dungeon = handleTest ./shattered-pixel-dungeon.nix {}; diff --git a/nixos/tests/gnome-flashback.nix b/nixos/tests/gnome-flashback.nix index 876d36477c1a..3e59e3fc0340 100644 --- a/nixos/tests/gnome-flashback.nix +++ b/nixos/tests/gnome-flashback.nix @@ -49,9 +49,10 @@ import ./make-test-python.nix ({ pkgs, lib, ...} : { assert "alice" in machine.succeed("getfacl -p /dev/snd/timer") with subtest("Wait for Metacity"): - machine.wait_until_succeeds( - "pgrep metacity" - ) + machine.wait_until_succeeds("pgrep metacity") + + with subtest("Regression test for #233920"): + machine.wait_until_succeeds("pgrep -fa gnome-flashback-media-keys") machine.sleep(20) machine.screenshot("screen") ''; diff --git a/nixos/tests/sgtpuzzles.nix b/nixos/tests/sgt-puzzles.nix similarity index 92% rename from nixos/tests/sgtpuzzles.nix rename to nixos/tests/sgt-puzzles.nix index b8d25d42d312..4c5210bfce77 100644 --- a/nixos/tests/sgtpuzzles.nix +++ b/nixos/tests/sgt-puzzles.nix @@ -1,6 +1,6 @@ import ./make-test-python.nix ({ pkgs, ...} : { - name = "sgtpuzzles"; + name = "sgt-puzzles"; meta = with pkgs.lib.maintainers; { maintainers = [ tomfitzhenry ]; }; @@ -14,7 +14,7 @@ import ./make-test-python.nix ({ pkgs, ...} : services.xserver.enable = true; environment.systemPackages = with pkgs; [ - sgtpuzzles + sgt-puzzles ]; }; diff --git a/pkgs/applications/networking/cluster/terraform/default.nix b/pkgs/applications/networking/cluster/terraform/default.nix index a13dbfb54363..e6c122a53910 100644 --- a/pkgs/applications/networking/cluster/terraform/default.nix +++ b/pkgs/applications/networking/cluster/terraform/default.nix @@ -53,7 +53,7 @@ let "Tool for building, changing, and versioning infrastructure"; homepage = "https://www.terraform.io/"; changelog = "https://github.com/hashicorp/terraform/blob/v${version}/CHANGELOG.md"; - license = licenses.mpl20; + license = licenses.bsl11; maintainers = with maintainers; [ Chili-Man babariviere @@ -167,9 +167,9 @@ rec { mkTerraform = attrs: pluggable (generic attrs); terraform_1 = mkTerraform { - version = "1.5.7"; - hash = "sha256-pIhwJfa71/gW7lw/KRFBO4Q5Z5YMcTt3r9kD25k8cqM="; - vendorHash = "sha256-lQgWNMBf+ioNxzAV7tnTQSIS840XdI9fg9duuwoK+U4="; + version = "1.6.0"; + hash = "sha256-R1phgtGn9hyNqa0wR1zY9uThTJSIj7TuK5ekXx48QP0="; + vendorHash = "sha256-V7S+IzHfBhIHo0xCvHJ75gOmvVbJd2k8XBdvLG1dcsc="; patches = [ ./provider-path-0_15.patch ]; passthru = { inherit plugins; diff --git a/pkgs/applications/terminal-emulators/kitty/default.nix b/pkgs/applications/terminal-emulators/kitty/default.nix index 1c1f87e1a407..f120b5290ec1 100644 --- a/pkgs/applications/terminal-emulators/kitty/default.nix +++ b/pkgs/applications/terminal-emulators/kitty/default.nix @@ -29,20 +29,20 @@ with python3Packages; buildPythonApplication rec { pname = "kitty"; - version = "0.30.0"; + version = "0.30.1"; format = "other"; src = fetchFromGitHub { owner = "kovidgoyal"; repo = "kitty"; rev = "refs/tags/v${version}"; - hash = "sha256-M6qFkeUp2rBudO2PiLN2VSrmut68c9mjjUr07WEX9VY="; + hash = "sha256-zjXwiRo6Jw3K0iDf05f04MCtg1qKABah7x07CwvW0/0="; }; goModules = (buildGoModule { pname = "kitty-go-modules"; inherit src version; - vendorHash = "sha256-53Y2S/P2fWT9STZFTdlkESxHNpoAggifZJ0+WXCzbkU="; + vendorHash = "sha256-KDqzcJbI2f91wlrjVWgUmut4nhXA/rO9q5q3FaDWnfc="; }).goModules; buildInputs = [ diff --git a/pkgs/applications/version-management/gitoxide/default.nix b/pkgs/applications/version-management/gitoxide/default.nix index 21f4d870894e..64efc4731a17 100644 --- a/pkgs/applications/version-management/gitoxide/default.nix +++ b/pkgs/applications/version-management/gitoxide/default.nix @@ -13,16 +13,16 @@ rustPlatform.buildRustPackage rec { pname = "gitoxide"; - version = "0.29.0"; + version = "0.30.0"; src = fetchFromGitHub { owner = "Byron"; repo = "gitoxide"; rev = "v${version}"; - hash = "sha256-Ry5QvOoj4iSQZr1O+Y6qSHzhmm77nbkLjCcdPOhxR18="; + hash = "sha256-VJZwNLFePUNIRHEyiEr1tiLaB2tuL6Ah81LNuM/1H14="; }; - cargoHash = "sha256-WZctsAxGojrGufF8CwUiw1xWzn9qVZUphDE3KmGTGy4="; + cargoHash = "sha256-vEp0wLxmmmv33oRO7eOxOoOsV87/7DQ8db5RUfqUb88="; nativeBuildInputs = [ cmake pkg-config ]; diff --git a/pkgs/development/embedded/wch-isp/default.nix b/pkgs/development/embedded/wch-isp/default.nix index a08afa5729af..4bc2e0615724 100644 --- a/pkgs/development/embedded/wch-isp/default.nix +++ b/pkgs/development/embedded/wch-isp/default.nix @@ -2,13 +2,13 @@ stdenv.mkDerivation rec { pname = "wch-isp"; - version = "0.2.5"; + version = "0.3.0"; src = fetchFromGitHub { owner = "jmaselbas"; repo = pname; rev = "v${version}"; - hash = "sha256-JF1g2Qb1gG93lSaDQvltT6jCYk/dKntsIJPkQXYUvX4="; + hash = "sha256-cbQJgHZAdSfzRsf/srMlRd+QgGUPpP5r3kBTNCgINDw="; }; nativeBuildInputs = [ pkg-config ]; diff --git a/pkgs/development/libraries/libsmi/default.nix b/pkgs/development/libraries/libsmi/default.nix index 9b71a91efed2..14139d849dc7 100644 --- a/pkgs/development/libraries/libsmi/default.nix +++ b/pkgs/development/libraries/libsmi/default.nix @@ -9,6 +9,8 @@ stdenv.mkDerivation rec { sha256 = "1lslaxr2qcj6hf4naq5n5mparfhmswsgq4wa7zm2icqvvgdcq6pj"; }; + env.NIX_CFLAGS_COMPILE = "-std=gnu90"; + meta = with lib; { description = "A Library to Access SMI MIB Information"; homepage = "https://www.ibr.cs.tu-bs.de/projects/libsmi/index.html"; diff --git a/pkgs/development/python-modules/alexapy/default.nix b/pkgs/development/python-modules/alexapy/default.nix index e0326ded4b68..2aeebd0239f7 100644 --- a/pkgs/development/python-modules/alexapy/default.nix +++ b/pkgs/development/python-modules/alexapy/default.nix @@ -19,8 +19,8 @@ buildPythonPackage rec { pname = "alexapy"; - version = "1.27.1"; - format = "pyproject"; + version = "1.27.4"; + pyproject = true; disabled = pythonOlder "3.10"; @@ -28,7 +28,7 @@ buildPythonPackage rec { owner = "keatontaylor"; repo = "alexapy"; rev = "refs/tags/v${version}"; - hash = "sha256-pMTVZ2iE/a1yNsWhmxkIQFkl18x06ZLjslj8hjKVBEA="; + hash = "sha256-Z7h6VX4cwcepo0Kxq9GdHv+XFNg/0s/OhJ/iHubhovs="; }; pythonRelaxDeps = [ @@ -64,7 +64,7 @@ buildPythonPackage rec { meta = with lib; { description = "Python Package for controlling Alexa devices (echo dot, etc) programmatically"; homepage = "https://gitlab.com/keatontaylor/alexapy"; - changelog = "https://gitlab.com/keatontaylor/alexapy/-/blob/${src.rev}/CHANGELOG.md"; + changelog = "https://gitlab.com/keatontaylor/alexapy/-/blob/v${version}/CHANGELOG.md"; license = licenses.asl20; maintainers = with maintainers; [ fab ]; }; diff --git a/pkgs/development/python-modules/astropy/default.nix b/pkgs/development/python-modules/astropy/default.nix index 8ee70bf64044..0a70e40e9e8a 100644 --- a/pkgs/development/python-modules/astropy/default.nix +++ b/pkgs/development/python-modules/astropy/default.nix @@ -26,25 +26,15 @@ buildPythonPackage rec { pname = "astropy"; - version = "5.3.3"; + version = "5.3.4"; format = "pyproject"; disabled = pythonOlder "3.8"; # according to setup.cfg src = fetchPypi { inherit pname version; - hash = "sha256-AzDfn116IlQ2fpuM9EJVuhBwsGEjGIxqcu3BgEk/k7s="; + hash = "sha256-1JD34vqsLMwBySRCAtYpFUJZr4qXkQTO2J3ErOTm8dg="; }; - patches = [ - # Fixes running tests in parallel issue - # https://github.com/astropy/astropy/issues/15316. Fix from - # https://github.com/astropy/astropy/pull/15327 - (fetchpatch { - url = "https://github.com/astropy/astropy/commit/1042c0fb06a992f683bdc1eea2beda0b846ed356.patch"; - hash = "sha256-bApAcGBRrJ94thhByoYvdqw2e6v77+FmTfgmGcE6MMk="; - }) - ]; - # Relax cython dependency to allow this to build, upstream only doesn't # support cython 3 as of writing. See: # https://github.com/astropy/astropy/issues/15315 @@ -85,6 +75,11 @@ buildPythonPackage rec { pythonImportsCheck = [ "astropy" ]; + disabledTests = [ + # May fail due to parallelism, see: + # https://github.com/astropy/astropy/issues/15441 + "TestUnifiedOutputRegistry" + ]; meta = { description = "Astronomy/Astrophysics library for Python"; diff --git a/pkgs/development/python-modules/camel-converter/default.nix b/pkgs/development/python-modules/camel-converter/default.nix index cc9c345d3fb0..176c49819dbf 100644 --- a/pkgs/development/python-modules/camel-converter/default.nix +++ b/pkgs/development/python-modules/camel-converter/default.nix @@ -9,7 +9,7 @@ buildPythonPackage rec { pname = "camel-converter"; - version = "3.0.2"; + version = "3.0.3"; format = "pyproject"; disabled = pythonOlder "3.8"; @@ -18,7 +18,7 @@ buildPythonPackage rec { owner = "sanders41"; repo = pname; rev = "refs/tags/v${version}"; - hash = "sha256-XKtWR9dmSMfqkJYUHDQtWBLG3CHrbrI5lNtPUTShmBE="; + hash = "sha256-0sNb1zg8cnDjQQnStfe1k8uB1GpmNtd/VwqSqTcLmj0="; }; postPatch = '' diff --git a/pkgs/development/python-modules/django-reversion/default.nix b/pkgs/development/python-modules/django-reversion/default.nix index e85e89e2b6c9..2559cc1fbf5c 100644 --- a/pkgs/development/python-modules/django-reversion/default.nix +++ b/pkgs/development/python-modules/django-reversion/default.nix @@ -7,14 +7,14 @@ buildPythonPackage rec { pname = "django-reversion"; - version = "5.0.5"; + version = "5.0.6"; format = "setuptools"; disabled = pythonOlder "3.7"; src = fetchPypi { inherit pname version; - hash = "sha256-JTxpGwpOC+He7Atiw4yfu3W25aj9gdO1iib0YTWXAQY="; + hash = "sha256-buJalwcN2hTz4IK4uZm/vstKnwgv8fhR40TQVqGMk0w="; }; propagatedBuildInputs = [ @@ -31,6 +31,7 @@ src = fetchPypi { meta = with lib; { description = "An extension to the Django web framework that provides comprehensive version control facilities"; homepage = "https://github.com/etianen/django-reversion"; + changelog = "https://github.com/etianen/django-reversion/blob/v${version}/CHANGELOG.rst"; license = licenses.bsd3; maintainers = with maintainers; [ ]; }; diff --git a/pkgs/development/python-modules/esig/default.nix b/pkgs/development/python-modules/esig/default.nix new file mode 100644 index 000000000000..f0183917c2c6 --- /dev/null +++ b/pkgs/development/python-modules/esig/default.nix @@ -0,0 +1,60 @@ +{ lib +, buildPythonPackage +, fetchPypi +, cmake +, ninja +, oldest-supported-numpy +, scikit-build +, setuptools +, numpy +, iisignature +, boost +}: + +buildPythonPackage rec { + pname = "esig"; + version = "0.9.8.3"; + pyproject = true; + + src = fetchPypi { + inherit pname version; + hash = "sha256-BGZaJSrpNSwZMHBYFDmDVPZOtgam/EVyh5Y5FAB8e1o="; + }; + + buildInputs = [ + boost + ]; + + dontUseCmakeConfigure = true; + + nativeBuildInputs = [ + cmake + ninja + oldest-supported-numpy + scikit-build + setuptools + ]; + + propagatedBuildInputs = [ + numpy + ]; + + passthru.optional-dependencies = { + iisignature = [ + iisignature + ]; + }; + + # PyPI tarball has no tests + doCheck = false; + + pythonImportsCheck = [ "esig" ]; + + meta = with lib; { + description = "This package provides \"rough path\" tools for analysing vector time series"; + homepage = "https://github.com/datasig-ac-uk/esig"; + changelog = "https://github.com/datasig-ac-uk/esig/blob/release/CHANGELOG"; + license = licenses.gpl3Only; + maintainers = with maintainers; [ mbalatsko ]; + }; +} diff --git a/pkgs/development/python-modules/garth/default.nix b/pkgs/development/python-modules/garth/default.nix index 92ce1294388e..45ba76913a32 100644 --- a/pkgs/development/python-modules/garth/default.nix +++ b/pkgs/development/python-modules/garth/default.nix @@ -12,14 +12,14 @@ buildPythonPackage rec { pname = "garth"; - version = "0.4.37"; + version = "0.4.38"; format = "pyproject"; disabled = pythonOlder "3.9"; src = fetchPypi { inherit pname version; - hash = "sha256-7mq661cW67EvvJ1s2W5Ybw+oiDz9vdmmt/ljt/llIoo="; + hash = "sha256-c+wSXADcgl7DpJJxGUus3oA4v+DmjGwjKfp0tJbcxb8="; }; nativeBuildInputs = [ diff --git a/pkgs/development/python-modules/google-cloud-container/default.nix b/pkgs/development/python-modules/google-cloud-container/default.nix index a79c74b3de08..2ee87fac60c2 100644 --- a/pkgs/development/python-modules/google-cloud-container/default.nix +++ b/pkgs/development/python-modules/google-cloud-container/default.nix @@ -13,14 +13,14 @@ buildPythonPackage rec { pname = "google-cloud-container"; - version = "2.31.0"; + version = "2.32.0"; format = "setuptools"; disabled = pythonOlder "3.7"; src = fetchPypi { inherit pname version; - hash = "sha256-PGrG29a5tq41hn8zzJWdAy4Dju1O5ZPYhZ+CcsBraAY="; + hash = "sha256-aU+42neWNlPhxw+mCSi0oR+vjh8VgKOQJQU6PhvM5t4="; }; propagatedBuildInputs = [ diff --git a/pkgs/development/python-modules/iisignature/default.nix b/pkgs/development/python-modules/iisignature/default.nix new file mode 100644 index 000000000000..1ddfd05b5326 --- /dev/null +++ b/pkgs/development/python-modules/iisignature/default.nix @@ -0,0 +1,39 @@ +{ lib +, buildPythonPackage +, fetchPypi +, setuptools +, wheel +, numpy +}: + +buildPythonPackage rec { + pname = "iisignature"; + version = "0.24"; + pyproject = true; + + src = fetchPypi { + inherit pname version; + hash = "sha256-C5MUxui4BIf68yMZH7NZhq1CJuhrDGfPCjspObaVucY="; + }; + + nativeBuildInputs = [ + setuptools + wheel + ]; + + propagatedBuildInputs = [ + numpy + ]; + + # PyPI tarball has no tests + doCheck = false; + + pythonImportsCheck = [ "iisignature" ]; + + meta = with lib; { + description = "Iterated integral signature calculations"; + homepage = "https://pypi.org/project/iisignature"; + license = licenses.mit; + maintainers = with maintainers; [ mbalatsko ]; + }; +} diff --git a/pkgs/development/python-modules/junos-eznc/default.nix b/pkgs/development/python-modules/junos-eznc/default.nix index d50dd571764b..e6499c5196d1 100644 --- a/pkgs/development/python-modules/junos-eznc/default.nix +++ b/pkgs/development/python-modules/junos-eznc/default.nix @@ -22,7 +22,7 @@ buildPythonPackage rec { pname = "junos-eznc"; - version = "2.6.7"; + version = "2.6.8"; format = "setuptools"; disabled = pythonOlder "3.7"; @@ -31,7 +31,7 @@ buildPythonPackage rec { owner = "Juniper"; repo = "py-junos-eznc"; rev = "refs/tags/${version}"; - hash = "sha256-+hGybznip5RpJm89MLg9JO4B/y50OIdgtmV2FIpZShU="; + hash = "sha256-5xZjuU2U3BodAMQiWZIJ27AZiAwoMm4yJ4qr3DjMd9o="; }; postPatch = '' diff --git a/pkgs/development/python-modules/magic-filter/default.nix b/pkgs/development/python-modules/magic-filter/default.nix index bf85abee73c8..e9d2fb8b8696 100644 --- a/pkgs/development/python-modules/magic-filter/default.nix +++ b/pkgs/development/python-modules/magic-filter/default.nix @@ -8,7 +8,7 @@ buildPythonPackage rec { pname = "magic-filter"; - version = "1.0.11"; + version = "1.0.12"; format = "pyproject"; disabled = pythonOlder "3.7"; @@ -17,7 +17,7 @@ buildPythonPackage rec { owner = "aiogram"; repo = "magic-filter"; rev = "refs/tags/v${version}"; - hash = "sha256-mfSq47UWOLyEDkAsdHsJuVl/rJ4KgiGPpDL7qSKEfws="; + hash = "sha256-MSYIZ/bzngRu6mG3EGblUotSCA+6bi+l3EymFA8NRZA="; }; nativeBuildInputs = [ diff --git a/pkgs/development/python-modules/numpyro/default.nix b/pkgs/development/python-modules/numpyro/default.nix index f301fdac7be9..612be673dbc1 100644 --- a/pkgs/development/python-modules/numpyro/default.nix +++ b/pkgs/development/python-modules/numpyro/default.nix @@ -9,19 +9,20 @@ , tqdm , funsor , pytestCheckHook -, tensorflow-probability +# TODO: uncomment when tensorflow-probability gets fixed. +# , tensorflow-probability }: buildPythonPackage rec { pname = "numpyro"; - version = "0.13.0"; + version = "0.13.2"; format = "setuptools"; disabled = pythonOlder "3.9"; src = fetchPypi { inherit version pname; - hash = "sha256-n+5K6fZlatKkXGVxzKcVhmP5XNuJeeM+GcCJ1Kh/WMk="; + hash = "sha256-Um8LFVGAlMeOaN9uMwycHJzqEnTaxp8FYXIk+m2VTug="; }; propagatedBuildInputs = [ @@ -35,7 +36,8 @@ buildPythonPackage rec { nativeCheckInputs = [ funsor pytestCheckHook - tensorflow-probability + # TODO: uncomment when tensorflow-probability gets fixed. + # tensorflow-probability ]; pythonImportsCheck = [ @@ -62,6 +64,11 @@ buildPythonPackage rec { "test_model_transformation" ]; + # TODO: remove when tensorflow-probability gets fixed. + disabledTestPaths = [ + "test/test_distributions.py" + ]; + meta = with lib; { description = "Library for probabilistic programming with NumPy"; homepage = "https://num.pyro.ai/"; diff --git a/pkgs/development/python-modules/parver/default.nix b/pkgs/development/python-modules/parver/default.nix index d69a9a54e501..b18d7db34766 100644 --- a/pkgs/development/python-modules/parver/default.nix +++ b/pkgs/development/python-modules/parver/default.nix @@ -13,12 +13,12 @@ buildPythonPackage rec { pname = "parver"; - version = "0.4"; + version = "0.5"; format = "pyproject"; src = fetchPypi { inherit pname version; - hash = "sha256-1KPbuTxTNz7poLoFXkhYxEFpsgS5EuSdAD6tlduam8o="; + hash = "sha256-uf3h5ruc6fB+COnEvqjYglxeeOGKAFLQLgK/lRfrR3c="; }; nativeBuildInputs = [ diff --git a/pkgs/development/python-modules/pyfibaro/default.nix b/pkgs/development/python-modules/pyfibaro/default.nix index 534181c6e4df..b1a38f11f6ac 100644 --- a/pkgs/development/python-modules/pyfibaro/default.nix +++ b/pkgs/development/python-modules/pyfibaro/default.nix @@ -11,7 +11,7 @@ buildPythonPackage rec { pname = "pyfibaro"; - version = "0.7.4"; + version = "0.7.5"; format = "pyproject"; disabled = pythonOlder "3.9"; @@ -20,7 +20,7 @@ buildPythonPackage rec { owner = "rappenze"; repo = pname; rev = "refs/tags/${version}"; - hash = "sha256-Z+JWwu40ober/9RNG9DLqlOlQyPwlAO3LhLnpr+4dL8="; + hash = "sha256-hllYxPPbLu3dpjHwXfIvTMW0LWtcglTVfN7youZaXTw="; }; nativeBuildInputs = [ diff --git a/pkgs/development/python-modules/qcelemental/default.nix b/pkgs/development/python-modules/qcelemental/default.nix index 191edbba7eba..78fdcc99d267 100644 --- a/pkgs/development/python-modules/qcelemental/default.nix +++ b/pkgs/development/python-modules/qcelemental/default.nix @@ -14,7 +14,8 @@ buildPythonPackage rec { pname = "qcelemental"; version = "0.26.0"; - format = "pyproject"; + + pyproject = true; disabled = pythonOlder "3.7"; diff --git a/pkgs/development/python-modules/textdistance/default.nix b/pkgs/development/python-modules/textdistance/default.nix index 5b50bd0a3ad0..2c2d5ee23adf 100644 --- a/pkgs/development/python-modules/textdistance/default.nix +++ b/pkgs/development/python-modules/textdistance/default.nix @@ -1,22 +1,32 @@ -{ lib, buildPythonPackage, fetchPypi }: +{ lib +, buildPythonPackage +, fetchPypi +, pythonOlder +}: buildPythonPackage rec { pname = "textdistance"; - version = "4.5.0"; + version = "4.6.0"; + format = "setuptools"; + + disabled = pythonOlder "3.7"; src = fetchPypi { inherit pname version; - hash = "sha256-Nk1D9PZjV0JmLj5s9TcqhoWUFshKPJsu+dZtRPWkOFw="; + hash = "sha256-cyxQMVzU7pRjg4ZDzxnWkiEwLDYDHqpgcMMMwKpdqMo="; }; # There aren't tests doCheck = false; - pythonImportsCheck = [ "textdistance" ]; + pythonImportsCheck = [ + "textdistance" + ]; meta = with lib; { description = "Python library for comparing distance between two or more sequences"; homepage = "https://github.com/life4/textdistance"; + changelog = "https://github.com/life4/textdistance/releases/tag/${version}"; license = licenses.mit; maintainers = with maintainers; [ ]; }; diff --git a/pkgs/development/python-modules/whodap/default.nix b/pkgs/development/python-modules/whodap/default.nix index a666d0a156b5..a322c327b230 100644 --- a/pkgs/development/python-modules/whodap/default.nix +++ b/pkgs/development/python-modules/whodap/default.nix @@ -9,7 +9,7 @@ buildPythonPackage rec { pname = "whodap"; - version = "0.1.9"; + version = "0.1.10"; format = "setuptools"; disabled = pythonOlder "3.8"; @@ -18,7 +18,7 @@ buildPythonPackage rec { owner = "pogzyb"; repo = pname; rev = "refs/tags/v${version}"; - hash = "sha256-0Wxx33AO9g4ACAUwkFkLo2AemK7PxXvZXWgHpu+E96c="; + hash = "sha256-5XDTl8NPrYWs7gPTJRDVCiZN3cWQ53/ojhJivBPHUL0="; }; propagatedBuildInputs = [ diff --git a/pkgs/development/tools/analysis/checkov/default.nix b/pkgs/development/tools/analysis/checkov/default.nix index e4ef7b483497..11332fc835f6 100644 --- a/pkgs/development/tools/analysis/checkov/default.nix +++ b/pkgs/development/tools/analysis/checkov/default.nix @@ -22,14 +22,14 @@ with py.pkgs; buildPythonApplication rec { pname = "checkov"; - version = "2.5.4"; + version = "2.5.6"; format = "setuptools"; src = fetchFromGitHub { owner = "bridgecrewio"; repo = pname; rev = "refs/tags/${version}"; - hash = "sha256-Rp1Q486vbgZmWcxQNy1esRYl0HRWQonicNP0bYdqPtc="; + hash = "sha256-X+JEhoFKT+nxgxABojC8jZiGp8bubJWi0qWNfU9kwDc="; }; patches = [ diff --git a/pkgs/development/tools/memray/default.nix b/pkgs/development/tools/memray/default.nix index 438383ef8633..1a7fb2a91dcc 100644 --- a/pkgs/development/tools/memray/default.nix +++ b/pkgs/development/tools/memray/default.nix @@ -8,13 +8,13 @@ python3.pkgs.buildPythonApplication rec { pname = "memray"; - version = "1.9.1"; + version = "1.10.0"; format = "setuptools"; src = fetchFromGitHub { owner = "bloomberg"; repo = pname; - rev = "refs/tags/v${version}"; + rev = "refs/tags/${version}"; hash = "sha256-DaJ1Hhg7q4ckA5feUx0twOsmy28v5aBBCTUAkn43xAo="; }; @@ -66,6 +66,6 @@ python3.pkgs.buildPythonApplication rec { license = licenses.asl20; maintainers = with maintainers; [ fab ]; platforms = platforms.linux; - changelog = "https://github.com/bloomberg/memray/releases/tag/v${version}"; + changelog = "https://github.com/bloomberg/memray/releases/tag/${version}"; }; } diff --git a/pkgs/games/sgt-puzzles/default.nix b/pkgs/games/sgt-puzzles/default.nix index a161d8d68ef7..8173fb5fe1d2 100644 --- a/pkgs/games/sgt-puzzles/default.nix +++ b/pkgs/games/sgt-puzzles/default.nix @@ -60,15 +60,15 @@ stdenv.mkDerivation rec { ''; passthru = { - tests.sgtpuzzles = nixosTests.sgtpuzzles; - updateScript = writeScript "update-sgtpuzzles" '' + tests.sgt-puzzles = nixosTests.sgt-puzzles; + updateScript = writeScript "update-sgt-puzzles" '' #!/usr/bin/env nix-shell #!nix-shell -i bash -p curl pcre common-updater-scripts set -eu -o pipefail version="$(curl -sI 'https://www.chiark.greenend.org.uk/~sgtatham/puzzles/puzzles.tar.gz' | grep -Fi Location: | pcregrep -o1 'puzzles-([0-9a-f.]*).tar.gz')" - update-source-version sgtpuzzles "$version" + update-source-version sgt-puzzles "$version" ''; }; diff --git a/pkgs/os-specific/linux/dpdk/default.nix b/pkgs/os-specific/linux/dpdk/default.nix index 78acb45bb3c7..c3bd0c64a4ba 100644 --- a/pkgs/os-specific/linux/dpdk/default.nix +++ b/pkgs/os-specific/linux/dpdk/default.nix @@ -68,7 +68,7 @@ in stdenv.mkDerivation rec { ] # kni kernel driver is currently not compatble with 5.11 ++ lib.optional (mod && kernel.kernelOlder "5.11") "-Ddisable_drivers=kni" - ++ lib.optional (!shared) "-Ddefault_library=static" + ++ [(if shared then "-Ddefault_library=shared" else "-Ddefault_library=static")] ++ lib.optional (machine != null) "-Dmachine=${machine}" ++ lib.optional mod "-Dkernel_dir=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build" ++ lib.optional (withExamples != []) "-Dexamples=${builtins.concatStringsSep "," withExamples}"; diff --git a/pkgs/os-specific/linux/libpsm2/default.nix b/pkgs/os-specific/linux/libpsm2/default.nix index 683448cbe41b..0dab09de4c1c 100644 --- a/pkgs/os-specific/linux/libpsm2/default.nix +++ b/pkgs/os-specific/linux/libpsm2/default.nix @@ -2,7 +2,7 @@ stdenv.mkDerivation rec { pname = "libpsm2"; - version = "11.2.230"; + version = "12.0.1"; preConfigure= '' export UDEVDIR=$out/etc/udev @@ -30,7 +30,7 @@ stdenv.mkDerivation rec { owner = "intel"; repo = "opa-psm2"; rev = "PSM2_${version}"; - sha256 = "sha256-dMfGq067TqstGAWNSZZaZCwvChTyPUsvaPVjFGGzp64="; + sha256 = "sha256-MzocxY+X2a5rJvTo+gFU0U10YzzazR1IxzgEporJyhI="; }; postInstall = '' diff --git a/pkgs/servers/http/nginx/modules.nix b/pkgs/servers/http/nginx/modules.nix index 498119877940..13c8bd7e7c75 100644 --- a/pkgs/servers/http/nginx/modules.nix +++ b/pkgs/servers/http/nginx/modules.nix @@ -508,8 +508,8 @@ let self = { name = "njs"; src = fetchhg { url = "https://hg.nginx.org/njs"; - rev = "0.7.10"; - sha256 = "sha256-/yKzY+BUFxLk8bWo+mqKfRVRsC2moe+WvhaRYIGdr6Y="; + rev = "0.8.1"; + sha256 = "sha256-bFHrcA1ROMwYf+s0EWOXzkru6wvfRLvjvN8BV/r2tMc="; name = "nginx-njs"; }; diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index 385330c17c6c..524e80e09a01 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -38478,12 +38478,15 @@ with pkgs; sfrotz = callPackage ../games/sfrotz { }; - sgtpuzzles = callPackage ../games/sgt-puzzles { }; + sgt-puzzles = callPackage ../games/sgt-puzzles { }; - sgtpuzzles-mobile = callPackage ../games/sgt-puzzles { + sgt-puzzles-mobile = callPackage ../games/sgt-puzzles { isMobile = true; }; + sgtpuzzles = throw "sgtpuzzles has been renamed to sgt-puzzles."; # 2023-10-06 + sgtpuzzles-mobile = throw "sgtpuzzles-mobile has been renamed to sgt-puzzles-mobile."; # 2023-10-06 + shattered-pixel-dungeon = callPackage ../games/shattered-pixel-dungeon { }; shticker-book-unwritten = callPackage ../games/shticker-book-unwritten { }; @@ -41330,7 +41333,7 @@ with pkgs; termpdfpy = python3Packages.callPackage ../applications/misc/termpdf.py { }; - inherit (callPackage ../applications/networking/cluster/terraform { }) + inherit (callPackage ../applications/networking/cluster/terraform { buildGoModule = buildGo121Module; }) mkTerraform terraform_1 terraform_plugins_test diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix index 5c24913824af..95b7030ca971 100644 --- a/pkgs/top-level/python-packages.nix +++ b/pkgs/top-level/python-packages.nix @@ -3555,6 +3555,8 @@ self: super: with self; { es-client = callPackage ../development/python-modules/es-client { }; + esig = callPackage ../development/python-modules/esig { }; + espeak-phonemizer = callPackage ../development/python-modules/espeak-phonemizer { }; esphome-dashboard-api = callPackage ../development/python-modules/esphome-dashboard-api { }; @@ -5210,6 +5212,8 @@ self: super: with self; { inherit (pkgs) igraph; }; + iisignature = callPackage ../development/python-modules/iisignature { }; + ijson = callPackage ../development/python-modules/ijson { }; ilua = callPackage ../development/python-modules/ilua { };