softhsm is used for tests, which don't run when cross-compiling, but it
was accidentally included anyway due to a mistake in the preCheck
conditionals. This fixes the cross build on armv6l.
Using --with-mantype=man slightly mangles ssh docs:
- See #418140 for the discussion of the part of the issue that causes
"Ns" to be interspersed throughout the text, which dates back (and
was reproducible) on nixpkgs from 2007. We discovered several other
unimplemented control sequences, including -nosplit, Qq, and Mt, as
well as the lack of spacing.
- Note the comparisons at https://github.com/numinit/ssh-man-compare.
Has been around since deb889e5f2, possibly
even earlier.
This new configure option attempts to call the following as part of sshd
startup, simply warning if it fails:
`mlockall(MCL_CURRENT | MCL_FUTURE | MCL_ONFAULT)`
From https://man7.org/linux/man-pages/man2/mlock.2.html:
> Since Linux 2.6.9, no limits are placed on the amount of memory
> that a privileged process can lock and the RLIMIT_MEMLOCK soft
> resource limit instead defines a limit on how much memory an
> unprivileged process may lock.
Since sshd is run as root, locking all current and future pages
also will not run into hypothetical OOM issues.
I've never used either of these and I no longer have spare time to maintain these.
Add Philip Taron as maintainer per an in-person conversation at Planet Nix 2025.
Co-authored-by: Philip Taron <philip.taron@gmail.com>
After final improvements to the official formatter implementation,
this commit now performs the first treewide reformat of Nix files using it.
This is part of the implementation of RFC 166.
Only "inactive" files are reformatted, meaning only files that
aren't being touched by any PR with activity in the past 2 months.
This is to avoid conflicts for PRs that might soon be merged.
Later we can do a full treewide reformat to get the rest,
which should not cause as many conflicts.
A CI check has already been running for some time to ensure that new and
already-formatted files are formatted, so the files being reformatted here
should also stay formatted.
This commit was automatically created and can be verified using
nix-build a08b3a4d19.tar.gz \
--argstr baseRev b32a094368
result/bin/apply-formatting $NIXPKGS_PATH
openssh updates can break the sshd in initrd, as proven by the update to
9.8p1 (ref #323796). The corresponding test is not a channel blocker,
but should at least be looked at by maintainers updating openssh.
In preparation for the deprecation of `stdenv.isX`.
These shorthands are not conducive to cross-compilation because they
hide the platforms.
Darwin might get cross-compilation for which the continued usage of `stdenv.isDarwin` will get in the way
One example of why this is bad and especially affects compiler packages
https://www.github.com/NixOS/nixpkgs/pull/343059
There are too many files to go through manually but a treewide should
get users thinking when they see a `hostPlatform.isX` in a place where it
doesn't make sense.
```
fd --type f "\.nix" | xargs sd --fixed-strings "stdenv.is" "stdenv.hostPlatform.is"
fd --type f "\.nix" | xargs sd --fixed-strings "stdenv'.is" "stdenv'.hostPlatform.is"
fd --type f "\.nix" | xargs sd --fixed-strings "clangStdenv.is" "clangStdenv.hostPlatform.is"
fd --type f "\.nix" | xargs sd --fixed-strings "gccStdenv.is" "gccStdenv.hostPlatform.is"
fd --type f "\.nix" | xargs sd --fixed-strings "stdenvNoCC.is" "stdenvNoCC.hostPlatform.is"
fd --type f "\.nix" | xargs sd --fixed-strings "inherit (stdenv) is" "inherit (stdenv.hostPlatform) is"
fd --type f "\.nix" | xargs sd --fixed-strings "buildStdenv.is" "buildStdenv.hostPlatform.is"
fd --type f "\.nix" | xargs sd --fixed-strings "effectiveStdenv.is" "effectiveStdenv.hostPlatform.is"
fd --type f "\.nix" | xargs sd --fixed-strings "originalStdenv.is" "originalStdenv.hostPlatform.is"
```
While preparing this change, I read the git blame on all of the files I
touched. I saw a working lifetime of building this system which we use
every day and love dearly and keep maintained ourselves. I saw commits
from a 14 year range between 2003 to 2017!! I could not be more thankful
for Eelco's work on building large parts of the foundation of nixpkgs
that all of us rely on now.
However, the end date of that range of the files I looked at the blame
on was 2017. I did not see surviving code from any newer date than that.
Looking at the Git logs, Eelco has been working on other things, and
that's totally fine.
However, it means that our maintenance metadata is out of date on a lot
of packages, and *that*'s the reason I am submitting this change. There
are a lot of packages that don't have anyone with their name on them to
be pinged if they need attention, even if they have had recent activity
(although it is never clear if recent activity was just someone fixing
it because ZHF or because the package actually matters to them).
There are a lot of packages with storied history that maybe don't need
to be in the set anymore at all since they have not been touched in
years; or maybe they are simply finished.
Empty maintainer lists should be a sign that we need to figure out who
maintains it or potentially remove it if it has rotted, and allowing the
maintainer list to be empty if it is already not maintained is part of a
healthy repository ecology.
Either way, I would like to have the maintenance metadata not mislead
anyone into sending Eelco emails about packages he doesn't, in practice,
work on anymore. I have not removed his name from everything; there are
some things that he is the upstream for or has worked on more recently,
for instance, like Nix, which I have left alone.
openssh tests are very slow (they take ~30 mins because they are not
parallelized). This makes rebuilding (esp. after changes e.g. to
systemd) painful. Putting the tests into a separate derivation solves
this without losing any testing capability.
Debian does the same: https://packages.debian.org/sid/openssh-tests
