Merge remote-tracking branch 'origin/master' into staging-next
Conflicts: nixos/doc/manual/release-notes/rl-2105.xml pkgs/tools/security/sequoia/default.nix
This commit is contained in:
Jonathan Ringer
@@ -0,0 +1,35 @@
|
||||
{ stdenv, lib, python3 }:
|
||||
|
||||
stdenv.mkDerivation {
|
||||
name = "replace-secret";
|
||||
buildInputs = [ python3 ];
|
||||
phases = [ "installPhase" "checkPhase" ];
|
||||
installPhase = ''
|
||||
install -D ${./replace-secret.py} $out/bin/replace-secret
|
||||
patchShebangs $out
|
||||
'';
|
||||
doCheck = true;
|
||||
checkPhase = ''
|
||||
install -m 0600 ${./test/input_file} long_test
|
||||
$out/bin/replace-secret "replace this" ${./test/passwd} long_test
|
||||
$out/bin/replace-secret "and this" ${./test/rsa} long_test
|
||||
diff ${./test/expected_long_output} long_test
|
||||
|
||||
install -m 0600 ${./test/input_file} short_test
|
||||
$out/bin/replace-secret "replace this" <(echo "a") short_test
|
||||
$out/bin/replace-secret "and this" <(echo "b") short_test
|
||||
diff ${./test/expected_short_output} short_test
|
||||
'';
|
||||
meta = with lib; {
|
||||
platforms = platforms.all;
|
||||
maintainers = with maintainers; [ talyz ];
|
||||
license = licenses.mit;
|
||||
description = "Replace a string in one file with a secret from a second file";
|
||||
longDescription = ''
|
||||
Replace a string in one file with a secret from a second file.
|
||||
|
||||
Since the secret is read from a file, it won't be leaked through
|
||||
'/proc/<pid>/cmdline', unlike when 'sed' or 'replace' is used.
|
||||
'';
|
||||
};
|
||||
}
|
||||
+28
@@ -0,0 +1,28 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
import argparse
|
||||
from argparse import RawDescriptionHelpFormatter
|
||||
|
||||
description = """
|
||||
Replace a string in one file with a secret from a second file.
|
||||
|
||||
Since the secret is read from a file, it won't be leaked through
|
||||
'/proc/<pid>/cmdline', unlike when 'sed' or 'replace' is used.
|
||||
"""
|
||||
|
||||
parser = argparse.ArgumentParser(
|
||||
description=description,
|
||||
formatter_class=RawDescriptionHelpFormatter
|
||||
)
|
||||
parser.add_argument("string_to_replace", help="the string to replace")
|
||||
parser.add_argument("secret_file", help="the file containing the secret")
|
||||
parser.add_argument("file", help="the file to perform the replacement on")
|
||||
args = parser.parse_args()
|
||||
|
||||
with open(args.secret_file) as sf, open(args.file, 'r+') as f:
|
||||
old = f.read()
|
||||
secret = sf.read().strip("\n")
|
||||
new_content = old.replace(args.string_to_replace, secret)
|
||||
f.seek(0)
|
||||
f.write(new_content)
|
||||
f.truncate()
|
||||
@@ -0,0 +1,30 @@
|
||||
beginning
|
||||
middle $6$UcbJUl5g$HRMfKNKsLTfVbcQb.P5o0bmZUfHDYkWseMSuZ8F5jSIGZZcI3Jnit23f8ZeZOGi4KL86HVM9RYqrpYySOu/fl0 not this
|
||||
-----BEGIN RSA PRIVATE KEY-----
|
||||
MIIEowIBAAKCAQEAzrru6v5tfwQl6L+rOUjtLo8kbhMUlCLXP7TYngSGrkzPMWe+
|
||||
0gB04UAmiPZXfBmvj5fPqYiFjIaEDHE/SD41vJB/RJKKtId2gCAIHhBLkbr+4+60
|
||||
yEbLkJci5i4kJC1dt8OKFEzXkaVnwOSgjH+0NwO3bstZ+E70zMXS9+NS71qGsIEb
|
||||
5J1TnacwW/u6CdFyakLljWOXOR14rLIpiPBBFLf+oZiepjIhlWXWHqsxZOb7zMI0
|
||||
T4W5WJ2dwGFsJ8rkYaGZ+A5qzYbi/KmHqaSPaNDsyoi7yJhAhKPByALJU916+8QO
|
||||
xOnqZxWGki3PDzCslRwW4i3mGbZlBQMnlfbN3QIDAQABAoIBAHDn1W7QkFrLmCy6
|
||||
6bf6pVdFZF8d2qJhOPAZRClhTXFKj+pqv+QPzcXr9F/fMr6bhK/G+Oqdnlq2aM4m
|
||||
16oMF+spe+impEyeo1CsreJFghBQcb9o8qFjUPBiKvROBP0hLcscZ4BYy29HSBgo
|
||||
harWYEWfqQJA251q+fYQoP0z0WrZKddOZbRRnJ0ICRxAE7IEtDT6EYt8R9oGi2j4
|
||||
/rpdW+rYGjW3TcmzdR7lpVMJRLlbMbSdR8n6cI6rnfySygcoE5tFX5t/YZSNbBPg
|
||||
GebKCbEHYNTTG8bC1qjUyzlbEQ6XYWvFO7HTKU7105XpjYTQFByeo0IVkin0o5KW
|
||||
t7eQWb0CgYEA6zZUWsYoQ13nXEU6Ky89Q9uhesMfaJ/F2X5ikQSRqRvrR3QR+ULe
|
||||
eNnCl10O9SiFpR4b5gSbLSHMffxGN60P1nEO4CiIKE+gOii8Kdk5htIJFy/dcZUc
|
||||
PuPM+zD9/6Is5sAWUZo45bnT6685h6EjM2+6zNZtx/XMjSfWbHaY+HMCgYEA4QAy
|
||||
6ZEgd6FHnNfM/q2o8XU3d6OCdhcu26u6ydnCalbSpPSKWOi6gnHK4ZnGdryXgIYw
|
||||
hRkvYINfiONkShYytotIh4YxUbgpwdvJRyKa2ZdWhcMmtFzZOcEVzQTKBasFT74C
|
||||
Wo0iybZ++XZh3M0+n7oyyx39aR7diZ+/zq6PnG8CgYB8B1QH4cHNdDDRqPd5WhmW
|
||||
NLQ7xbREOSvc+hYDnkMoxz4TmZL4u1gQpdNEeZ+visSeQvg3HGqvK8lnDaYBKdLW
|
||||
IxvS+8yAZSx6PoyqDI+XFh4RCf5dLGGOkBTAyB7Hs761lsiuEwK5sHmdJ/LQIBot
|
||||
v1bjOJb/AA/yxvT8kLUtHQKBgGIA9iwqXJv/EfRNQytDdS0HQ4vHGtJZMr3YRVoa
|
||||
kcZD3yieo4wqguLCsf4mPv4FE3CWAphW6f39+yTi9xIWLSy56nOtjdnsf7PDCh8E
|
||||
AbL5amSFJly1fKDda6OLjHt/jKa5Osk6ZIa8CP6cA/BrLfXg4rL6cyDQouqJPMDH
|
||||
5CHdAoGBAIChjbTyoYvANkoANCK4SuqLUYeiYREfiM3sqHe1xirK1PPHw03ZLITl
|
||||
ltjo9qE6kPXWcTBVckTKGFlntyCT283FC0/vMmHo8dTdtxF4/wSbkqs3ORuJ3p5J
|
||||
cNtLYGD3vgwLmg6tTur4U60XN+tYDzWGteez8J9GwTMfKJmuS9af
|
||||
-----END RSA PRIVATE KEY-----
|
||||
end
|
||||
@@ -0,0 +1,4 @@
|
||||
beginning
|
||||
middle a not this
|
||||
b
|
||||
end
|
||||
@@ -0,0 +1,4 @@
|
||||
beginning
|
||||
middle replace this not this
|
||||
and this
|
||||
end
|
||||
@@ -0,0 +1 @@
|
||||
$6$UcbJUl5g$HRMfKNKsLTfVbcQb.P5o0bmZUfHDYkWseMSuZ8F5jSIGZZcI3Jnit23f8ZeZOGi4KL86HVM9RYqrpYySOu/fl0
|
||||
@@ -0,0 +1,27 @@
|
||||
-----BEGIN RSA PRIVATE KEY-----
|
||||
MIIEowIBAAKCAQEAzrru6v5tfwQl6L+rOUjtLo8kbhMUlCLXP7TYngSGrkzPMWe+
|
||||
0gB04UAmiPZXfBmvj5fPqYiFjIaEDHE/SD41vJB/RJKKtId2gCAIHhBLkbr+4+60
|
||||
yEbLkJci5i4kJC1dt8OKFEzXkaVnwOSgjH+0NwO3bstZ+E70zMXS9+NS71qGsIEb
|
||||
5J1TnacwW/u6CdFyakLljWOXOR14rLIpiPBBFLf+oZiepjIhlWXWHqsxZOb7zMI0
|
||||
T4W5WJ2dwGFsJ8rkYaGZ+A5qzYbi/KmHqaSPaNDsyoi7yJhAhKPByALJU916+8QO
|
||||
xOnqZxWGki3PDzCslRwW4i3mGbZlBQMnlfbN3QIDAQABAoIBAHDn1W7QkFrLmCy6
|
||||
6bf6pVdFZF8d2qJhOPAZRClhTXFKj+pqv+QPzcXr9F/fMr6bhK/G+Oqdnlq2aM4m
|
||||
16oMF+spe+impEyeo1CsreJFghBQcb9o8qFjUPBiKvROBP0hLcscZ4BYy29HSBgo
|
||||
harWYEWfqQJA251q+fYQoP0z0WrZKddOZbRRnJ0ICRxAE7IEtDT6EYt8R9oGi2j4
|
||||
/rpdW+rYGjW3TcmzdR7lpVMJRLlbMbSdR8n6cI6rnfySygcoE5tFX5t/YZSNbBPg
|
||||
GebKCbEHYNTTG8bC1qjUyzlbEQ6XYWvFO7HTKU7105XpjYTQFByeo0IVkin0o5KW
|
||||
t7eQWb0CgYEA6zZUWsYoQ13nXEU6Ky89Q9uhesMfaJ/F2X5ikQSRqRvrR3QR+ULe
|
||||
eNnCl10O9SiFpR4b5gSbLSHMffxGN60P1nEO4CiIKE+gOii8Kdk5htIJFy/dcZUc
|
||||
PuPM+zD9/6Is5sAWUZo45bnT6685h6EjM2+6zNZtx/XMjSfWbHaY+HMCgYEA4QAy
|
||||
6ZEgd6FHnNfM/q2o8XU3d6OCdhcu26u6ydnCalbSpPSKWOi6gnHK4ZnGdryXgIYw
|
||||
hRkvYINfiONkShYytotIh4YxUbgpwdvJRyKa2ZdWhcMmtFzZOcEVzQTKBasFT74C
|
||||
Wo0iybZ++XZh3M0+n7oyyx39aR7diZ+/zq6PnG8CgYB8B1QH4cHNdDDRqPd5WhmW
|
||||
NLQ7xbREOSvc+hYDnkMoxz4TmZL4u1gQpdNEeZ+visSeQvg3HGqvK8lnDaYBKdLW
|
||||
IxvS+8yAZSx6PoyqDI+XFh4RCf5dLGGOkBTAyB7Hs761lsiuEwK5sHmdJ/LQIBot
|
||||
v1bjOJb/AA/yxvT8kLUtHQKBgGIA9iwqXJv/EfRNQytDdS0HQ4vHGtJZMr3YRVoa
|
||||
kcZD3yieo4wqguLCsf4mPv4FE3CWAphW6f39+yTi9xIWLSy56nOtjdnsf7PDCh8E
|
||||
AbL5amSFJly1fKDda6OLjHt/jKa5Osk6ZIa8CP6cA/BrLfXg4rL6cyDQouqJPMDH
|
||||
5CHdAoGBAIChjbTyoYvANkoANCK4SuqLUYeiYREfiM3sqHe1xirK1PPHw03ZLITl
|
||||
ltjo9qE6kPXWcTBVckTKGFlntyCT283FC0/vMmHo8dTdtxF4/wSbkqs3ORuJ3p5J
|
||||
cNtLYGD3vgwLmg6tTur4U60XN+tYDzWGteez8J9GwTMfKJmuS9af
|
||||
-----END RSA PRIVATE KEY-----
|
||||
@@ -1,5 +1,27 @@
|
||||
{ lib, nixosTest, path, writeText, hello, figlet, stdenvNoCC }:
|
||||
{ lib, nixosTest, pkgs, writeText, hello, figlet, stdenvNoCC }:
|
||||
|
||||
# -------------------------------------------------------------------------- #
|
||||
#
|
||||
# trivial-builders test
|
||||
#
|
||||
# -------------------------------------------------------------------------- #
|
||||
#
|
||||
# This file can be run independently (quick):
|
||||
#
|
||||
# $ pkgs/build-support/trivial-builders/test.sh
|
||||
#
|
||||
# or in the build sandbox with a ~20s VM overhead
|
||||
#
|
||||
# $ nix-build -A tests.trivial-builders
|
||||
#
|
||||
# -------------------------------------------------------------------------- #
|
||||
|
||||
let
|
||||
invokeSamples = file:
|
||||
lib.concatStringsSep " " (
|
||||
lib.attrValues (import file { inherit pkgs; })
|
||||
);
|
||||
in
|
||||
nixosTest {
|
||||
name = "nixpkgs-trivial-builders";
|
||||
nodes.machine = { ... }: {
|
||||
@@ -10,11 +32,22 @@ nixosTest {
|
||||
environment.etc."pre-built-paths".source = writeText "pre-built-paths" (
|
||||
builtins.toJSON [hello figlet stdenvNoCC]
|
||||
);
|
||||
environment.variables = {
|
||||
SAMPLE = invokeSamples ./test/sample.nix;
|
||||
REFERENCES = invokeSamples ./test/invoke-writeReferencesToFile.nix;
|
||||
DIRECT_REFS = invokeSamples ./test/invoke-writeDirectReferencesToFile.nix;
|
||||
};
|
||||
};
|
||||
testScript = ''
|
||||
machine.succeed("""
|
||||
cd ${lib.cleanSource path}
|
||||
./pkgs/build-support/trivial-builders/test.sh 2>/dev/console
|
||||
${./test.sh} 2>/dev/console
|
||||
""")
|
||||
'';
|
||||
meta = {
|
||||
license = lib.licenses.mit; # nixpkgs license
|
||||
maintainers = with lib.maintainers; [
|
||||
roberth
|
||||
];
|
||||
description = "Run the Nixpkgs trivial builders tests";
|
||||
};
|
||||
}
|
||||
|
||||
@@ -25,33 +25,32 @@ set -euo pipefail
|
||||
|
||||
cd "$(dirname ${BASH_SOURCE[0]})" # nixpkgs root
|
||||
|
||||
testDirectReferences() {
|
||||
expr="$1"
|
||||
if [[ -z ${SAMPLE:-} ]]; then
|
||||
sample=( `nix-build test/sample.nix` )
|
||||
directRefs=( `nix-build test/invoke-writeDirectReferencesToFile.nix` )
|
||||
references=( `nix-build test/invoke-writeReferencesToFile.nix` )
|
||||
else
|
||||
# Injected by Nix (to avoid evaluating in a derivation)
|
||||
# turn them into arrays
|
||||
sample=($SAMPLE)
|
||||
directRefs=($DIRECT_REFS)
|
||||
references=($REFERENCES)
|
||||
fi
|
||||
|
||||
echo >&2 Testing direct references...
|
||||
for i in "${!sample[@]}"; do
|
||||
echo >&2 Checking '#'$i ${sample[$i]} ${directRefs[$i]}
|
||||
diff -U3 \
|
||||
<(sort <$(nix-build --no-out-link --expr "with import ../../.. {}; writeDirectReferencesToFile ($expr)")) \
|
||||
<(nix-store -q --references $(nix-build --no-out-link --expr "with import ../../.. {}; ($expr)") | sort)
|
||||
}
|
||||
<(sort <${directRefs[$i]}) \
|
||||
<(nix-store -q --references ${sample[$i]} | sort)
|
||||
done
|
||||
|
||||
testDirectReferences 'hello'
|
||||
testDirectReferences 'figlet'
|
||||
testDirectReferences 'writeText "hi" "hello"'
|
||||
testDirectReferences 'writeText "hi" "hello ${hello}"'
|
||||
testDirectReferences 'writeText "hi" "hello ${hello} ${figlet}"'
|
||||
|
||||
|
||||
|
||||
testClosure() {
|
||||
expr="$1"
|
||||
echo >&2 Testing closure...
|
||||
for i in "${!sample[@]}"; do
|
||||
echo >&2 Checking '#'$i ${sample[$i]} ${references[$i]}
|
||||
diff -U3 \
|
||||
<(sort <$(nix-build --no-out-link --expr "with import ../../.. {}; writeReferencesToFile ($expr)")) \
|
||||
<(nix-store -q --requisites $(nix-build --no-out-link --expr "with import ../../.. {}; ($expr)") | sort)
|
||||
}
|
||||
|
||||
testClosure 'hello'
|
||||
testClosure 'figlet'
|
||||
testClosure 'writeText "hi" "hello"'
|
||||
testClosure 'writeText "hi" "hello ${hello}"'
|
||||
testClosure 'writeText "hi" "hello ${hello} ${figlet}"'
|
||||
|
||||
<(sort <${references[$i]}) \
|
||||
<(nix-store -q --requisites ${sample[$i]} | sort)
|
||||
done
|
||||
|
||||
echo 'OK!'
|
||||
|
||||
@@ -0,0 +1,4 @@
|
||||
{ pkgs ? import ../../../.. { config = {}; overlays = []; } }:
|
||||
pkgs.lib.mapAttrs
|
||||
(k: v: pkgs.writeDirectReferencesToFile v)
|
||||
(import ./sample.nix { inherit pkgs; })
|
||||
@@ -0,0 +1,4 @@
|
||||
{ pkgs ? import ../../../.. { config = {}; overlays = []; } }:
|
||||
pkgs.lib.mapAttrs
|
||||
(k: v: pkgs.writeReferencesToFile v)
|
||||
(import ./sample.nix { inherit pkgs; })
|
||||
@@ -0,0 +1,15 @@
|
||||
{ pkgs ? import ../../../.. { config = {}; overlays = []; } }:
|
||||
let
|
||||
inherit (pkgs)
|
||||
figlet
|
||||
hello
|
||||
writeText
|
||||
;
|
||||
in
|
||||
{
|
||||
hello = hello;
|
||||
figlet = figlet;
|
||||
norefs = writeText "hi" "hello";
|
||||
helloRef = writeText "hi" "hello ${hello}";
|
||||
helloFigletRef = writeText "hi" "hello ${hello} ${figlet}";
|
||||
}
|
||||
Reference in New Issue
Block a user