Existing deployments using MySQL or Percona Server with `services.mysql`
do not restrict authentication to the root@localhost user allowing any
user on the system to log in without a password.
With this changes:
* new deployments will use the `auth_socket` authentication by default
to only allow the local root user to log in as the MySQL root user
* existing deployments with a stateVersion > 26.05 will also be moved to
the `auth_socket` authentication
* existing deployments with a stateVersion <= 26.05 have a warning
logged when the local authentication seems to be open
Users can disable this behavior by setting `services.mysql.secureSuperUserByDefault`
to `false`.
Upstream v18.8.0 added an ext-idle-notify helper for Wayland idle
detection, built from electron/wayland-idle-helper/ with Rust. The
helper is built separately as an inline rustPlatform.buildRustPackage
derivation.
Also updates the desktop entry to match upstream.
Assisted-by: opencode deepseek-v4-flash-free
This is the root cause of https://github.com/NixOS/nixpkgs/issues/380166
This was added in 825923a051 which does not look
correct to me. I checked my system and all relevant sub-directories of
`/etc/xdg/` are explicitly declared to be linked.
Since then people may have started depending on this, so this is
a breaking change.
From the README:
> `authproto_pamtester`: Authenticates via PAM using pamtester. Shouldn't
be required unless you can't compile `authproto_pam`. Only supports simple
password based conversations.
And:
> `authproto_htpasswd`: Authenticates via a htpasswd style file stored in
`~/.xsecurelock.pw`. To generate this file, run: `( umask 077; htpasswd -cB
~/.xsecurelock.pw "$USER" )` Use this only if you for some reason can't use
PAM!
Given that this package is built against PAM, there's no good reason to
include these two modules by default.
Currently, you need to override `stdenv.hostPlatform` to request a
compressed kernel on AArch64, and the kernel configuration is split
between the central structured configuration and string snippets in
platform definitions. This has consequently made the latter bitrot
terribly. Since the platform‐specific logic is now very limited after
cleaning up the detritus, we can move it into the kernel derivation
and expose the relevant configuration there for anyone who wants to
customize it further or needs to read it out.
Co-authored-by: zowoq <59103226+zowoq@users.noreply.github.com>
Now that ARMv5 no longer uses `uImage`, there’s no point in keeping
around support for this deprecated format that the rest of the NixOS
infrastructure doesn’t handle. Modern U‐Boot setups should not
be affected in any way by this.
The `sheevaplug` kernel configuration was added a very long time
ago and has not been adjusted for years. `pogoplug4` was identical
to `sheevaplug` except for an even more stripped‐down kernel
configuration, no device tree support, and a different load address
for the uImage.
These days, the stock kernel configuration builds and there has been
an upstream device tree for the Pogoplug Series 4 for years; unify
`sheevaplug` and `pogoplug4` into an `armv5tel-multiplatform` that
uses the standard configuration.
ARMv5 was also the only platform that defaulted to uImage, the [legacy
U‐Boot image format] that is deprecated upstream. Our bootloader
machinery in NixOS does not handle these images in any special way
and even the original ARMv6 Raspberry Pi platform defaults to the
standard zImage. We switch `armv5tel-multiplatform` to zImage to match.
[legacy U‐Boot image format]: https://docs.u-boot.org/en/latest/usage/cmd/bootm.html#legacy-boot
It is of course natural to worry about backwards compatibility
here: this switches to a different kernel image format and drops
support for root on NFS along with random oddities like KGDB and
LatencyTOP. Renaming the platform is intended to help mitigate
this risk.
The reality, however, is that it is currently very
difficult to build a configuration for ARMv5. I found
<https://github.com/thefloweringash/sheevaplug-nix> online as
an example configuration from many years ago; it already set
`autoModules`, and builds U‐Boot using `CONFIG_DISTRO_DEFAULTS`,
which should work out of the box without requiring the legacy U‐Boot
image format.
Even then, however, I confirmed with the author that it hasn’t
been used in years, and I could barely get it to build with
a modern Nixpkgs: OpenSSH is broken, Nix is broken, multiple
default `environment.systemPackages` in the SD image profile
are broken, `boot.initrd.includeDefaultModules` is broken, and
`hardware.enableAllHardware` is broken.
I conclude that if anyone is actively building systems on ARMv5, they
have a forked Nixpkgs or a very custom setup. Given our general move
to standard boot chains and no platform‐specific hacks, and the
decaying state of our unofficial support for 32‐bit ARM, I think
it is not worth maintaining support for the legacy image format for
this one ancient platform.
If anyone is running a heavily stripped‐down NixOS configuration on
mission‐critical SheevaPlugs using a custom Nix‐free deployment
setup relying on the legacy U‐Boot image format and somehow none
of these kernel changes manage to loudly break their build, hopefully
they’ll at least notice the release notes entry! Otherwise there’s
always JTAG…
fetcherVersion = 1 and 2 were deprecated in the 26.05 release and
scheduled for removal in 26.11. Remove them from supportedFetcherVersions
and replace the deprecation warning with a hard throw that points users
at the migration to fetcherVersion = 3.
No in-tree package still uses fetcherVersion = 1 or 2. The now-unreachable
v1/v2 code paths are removed in a follow-up commit.
Assisted-by: claude-code with claude-opus-4-7[1m]-xhigh
The current uhttpmock package refers to the 0.5.x release series/0.0
ABI. This is outdated, relies on the insecure libsoup 2.4, and has no
in-tree dependents. Thus, we drop it.
`librest` in Nixpkgs currently refers to the old 0.8 release. The
current release version is 0.10, which is in Nixpkgs as `librest_1_0`
(since both needed to coexist for some time while dependents were
migrated). Since the old librest version was dependent on insecure
libraries (libsoup 2.4) and has no in-tree dependents, we drop it. We
also rename `librest_1_0` to `librest`, as that's the most
straightforward name, and migrate it to `pkgs/by-name` for cleanliness.
Fixes odd bulletpoints and bare URLs that are prohibited by most
Markdown linters and specs.
Signed-off-by: NotAShelf <raf@notashelf.dev>
Change-Id: Iae14dce3d158ac11c59d9117694ccde46a6a6964
