public/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
144,776 Commits 1 Branch 0 Tags
38094de6b67701960c2383f60fbf37448473faf8
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Joachim Fasting b9c953eb19 nixos/tests/tor: a minimal test 
For now check that the default client config boots.

Ideas for the future:
- Expand on control via netcat
- Configure a circuit of nodes exercise various configs (e.g., check
  that a client node can access a hidden www service).  Needs setting up
  authoritative directory servers &c.
 2018-06-21 00:26:44 +02:00
Joachim Fasting c449f0b55c nixos/tor: grammer fix, advise -> advice 
Seems to me that the noun form is more appropriate here.
 2018-06-18 12:40:09 +02:00
Joachim Fasting e701948f5a tor: 0.3.3.6 -> 0.3.3.7 2018-06-12 22:33:33 +02:00
Joachim Fasting fc618a15e8 tor-browser-bundle-bin: 7.5.4 -> 7.5.5 2018-06-09 22:10:08 +02:00
Joachim Fasting 2be28b1df5 Revert "Merge pull request #38263 from lopsided98/grub-initrd-secrets" 
This reverts commit c06d7950f1, reversing
changes made to 4c25fbe338.

See https://github.com/NixOS/nixpkgs/issues/41608
 2018-06-07 14:24:59 +02:00
Joachim Fasting 1c14927d69 tor: 0.3.2.10 -> 0.3.3.6 
First stable release in the 0.3.3.x series
 2018-05-23 21:49:14 +02:00
Joachim Fasting b15da3e330 tor-browser-bundle-bin: 7.5.3 -> 7.5.4 2018-05-11 14:08:08 +02:00
Joachim Fasting 9df35787f1 tor-browser-bundle-bin: allow unset XAUTHORITY 
Apparently this can happen on e.g., fedora.

Closes https://github.com/NixOS/nixpkgs/issues/38671
 2018-04-29 12:17:30 +02:00
Joachim Fasting 33615ccfa5 linux_hardened: enforce usercopy whitelisting 
The default is to warn only
 2018-04-29 12:17:24 +02:00
Joachim Fasting 707a1ce0da tor-browser-bundle-bin: 7.5.2 -> 7.5.3 2018-03-27 18:10:58 +02:00
Joachim Fasting f5a48fe3c9 electrum: 3.1.0 -> 3.1.1 2018-03-27 18:10:49 +02:00
Joachim Fasting d09b4d7b2e tor-browser-bundle-bin: 7.5.1 -> 7.5.2 2018-03-26 12:27:44 +02:00
Joachim Fasting 4e1083256b Revert "Merge pull request #35636 from ryantm/auto-update/emscripten-1.37.16-to-1.37.34" 
This reverts commit 5c02b9ab33, reversing
changes made to 2f2ad74369.

https://github.com/NixOS/nixpkgs/pull/35636#issuecomment-373171672
 2018-03-14 22:08:01 +01:00
Joachim Fasting 6f9a9e8876 tor-browser-bundle-bin: 7.5 -> 7.5.1 2018-03-14 21:58:35 +01:00
Joachim Fasting fb8a85f631 ntbtls: 0.1.1 -> 0.1.2 2018-03-11 01:33:57 +01:00
Joachim Fasting 53f057f21b electrum: 3.0.6 -> 3.1.0 2018-03-06 23:30:05 +01:00
Joachim Fasting 9c0e9f6a30 tor: initial updateScript 
Tested briefly, seems to work okay. The gpg stuff could be better,
however.
 2018-03-04 23:47:01 +01:00
Joachim Fasting e4581f05e4 tor: 0.3.2.9 -> 0.3.2.10 
Contains fixes for TROVE-2018-001, TROVE-2018-002, TROVE-2018-003, and
TROVE-2018-004.
 2018-03-04 13:12:49 +01:00
Joachim Fasting 05f5cdcf66 Revert "Merge pull request #30031 from dtzWill/update/leo-5.6" 
This reverts commit 67c5cb23e9, reversing
changes made to 431c004fbd.

I failed to notice that this depends on a package that had since
been removed. My bad :(
 2018-02-17 12:21:26 +01:00
Joachim Fasting eff73c6698 tor-browser-bundle-bin: 7.0.11 -> 7.5 2018-01-27 01:05:38 +01:00
Joachim Fasting 87677d0390 tor: 0.3.1.9 -> 0.3.2.9 
- Adds next-generation onion services[1]
- Lots of fixes, e.g., for CVE-2017-8821, CVE-2017-8820, CVE-2017-8823,
  CVE-2017-8819, CVE-2017-8822, CVE-2017-8822
- Adds new option `NoExec` to disallow exec syscalls
 2018-01-13 18:22:45 +01:00
Joachim Fasting e5d9d61d65 electrum: 3.0.4 -> 3.0.5 
Still more work to fix RPC vulns
 2018-01-08 09:10:14 +01:00
Joachim Fasting 5dc2853981 nixos/dnscrypt-proxy: remove 
The upstream project ceased.

See https://github.com/NixOS/nixpkgs/issues/33540
 2018-01-07 17:00:32 +01:00
Joachim Fasting 3b367119ee tinycc: 0.9.27pre-20171016 -> 0.9.27 2017-12-18 16:06:42 +01:00
Joachim Fasting 97ab2f0d8b electrum: 3.0.2 -> 3.0.3 
Note that due to runtime impurities, non-NixOS users must prepend and export
QT_PLUGIN_PATH=${qt5.qtbase.qtPluginPrefix}
and
LD_LIBRARY_PATH=/run/opengl-driver/lib
before running electrum, lest it fail to find runtime dependencies or pick
up mismatching libraries from the host system.
 2017-12-12 14:32:42 +01:00
Joachim Fasting eae2aa7eae tor-browser-bundle-bin: 7.0.10 -> 7.0.11 2017-12-10 00:32:59 +01:00
Joachim Fasting df0300cf67 tor-browser-bundle-bin: 7.0.9 -> 7.0.10 2017-11-15 22:10:52 +01:00
Joachim Fasting 870c86d0ee linux_hardened: structleak covers structs passed by address 2017-11-15 22:10:50 +01:00
Joachim Fasting 8ecae36963 linux_hardened: enable slab freelist hardening 2017-11-15 22:10:44 +01:00
Joachim Fasting cd722e1678 surf: use https 2017-11-08 01:04:13 +01:00
Joachim Fasting 86bc99cc8a tor-browser-bundle-bin: 7.0.8 -> 7.0.9 2017-11-04 12:19:58 +01:00
Joachim Fasting 2b496a80ff tor-browser-bundle-bin: 7.0.7 -> 7.0.8 2017-10-26 22:39:35 +02:00
Joachim Fasting 5a64e446ff tor: 0.3.1.7 -> 0.3.1.8 
Quoth the release notes:

> It includes several bugfixes, including a bugfix for a crash issue that
had affected relays under memory pressure. It also adds a new directory
authority, Bastet.
 2017-10-26 22:39:24 +02:00
Joachim Fasting a09d626053 tor-browser-bundle-bin: support installing extensions 
Closes https://github.com/NixOS/nixpkgs/issues/30443
 2017-10-20 15:26:46 +02:00
Joachim Fasting eba08858cc tor-browser-bundle-bin: 7.0.6 -> 7.0.7 2017-10-20 15:26:31 +02:00
Joachim Fasting a8a38feeeb lkl: 2017-08-09 -> 2017-10-18 
Based on linux 4.13
 2017-10-18 22:11:37 +02:00
Joachim Fasting 5c732e3c46 tinycc: 0.9.27pre-20170924 -> 0.9.27pre-20171016 2017-10-18 22:11:32 +02:00
Joachim Fasting 6d31872885 tor-browser-bundle.noscript: 5.0.10 -> 5.1.2 2017-10-18 22:11:28 +02:00
Joachim Fasting 9cf5492a7b tor-browser-bundle.https-everywhere: 2017.9.12 -> 2017.10.4 2017-10-18 22:11:23 +02:00
Joachim Fasting 9c8a0c0bcc tor-browser-bundle.tor-launcher: 0.2.12.3 -> 0.2.13 2017-10-18 22:11:17 +02:00
Joachim Fasting 05b2f85590 tor-browser-bundle-bin: 7.0.5 -> 7.0.6 2017-10-03 02:42:51 +02:00
Joachim Fasting 378811fe2d libsodium: 1.0.13 -> 1.0.15 2017-10-03 02:42:49 +02:00
Joachim Fasting f4f594e359 tor-browser-bundle: geoip support 2017-10-03 02:42:48 +02:00
Joachim Fasting ba689a2740 tor-browser-bundle: support transports obfs2,obfs3 2017-10-03 02:42:47 +02:00
Joachim Fasting ae4c8e0889 tor-browser-bundle: bump https-everywhere to 2017.9.12 2017-10-03 02:42:41 +02:00
Joachim Fasting 387f1c75f5 tor-browser-bundle: minor refactorings 2017-09-28 15:40:18 +02:00
Joachim Fasting 3ec05d6237 tor-browser-bundle: feature parity with the binary bundle 
This will be factored later (eventually both will be subsumed by a more
generic construct).

Don't bother with pulseaudio support, however.
 2017-09-28 15:40:10 +02:00
Joachim Fasting 35c15d4a61 tinycc: 0.9.27pre-20170911 -> 0.9.27pre-20170924 
Improves `long` handling
 2017-09-28 03:06:11 +02:00
Joachim Fasting a06f839439 nixos/release-notes: notable changes to the dnscrypt-proxy service 2017-09-27 23:47:15 +02:00
Joachim Fasting 931da53e50 tor-browser-bundle: support passing additional extensions 2017-09-27 22:58:12 +02:00
Joachim Fasting 2651602c17 tor-browser-bundle: factor out extensions 2017-09-27 22:58:07 +02:00
Joachim Fasting 206e4a6d69 tor-browser-bundle: basic checks for the wrapper script 2017-09-26 23:17:12 +02:00
Joachim Fasting fc44e91ad5 tor-browser-bundle: use fonts from Nixpkgs 2017-09-26 23:17:11 +02:00
Joachim Fasting f05d50f36c tor-browser-bundle: approximate upstream bundle & purity control 2017-09-26 23:17:10 +02:00
Joachim Fasting 93b9109b46 tor-browser-bundle: clear pref bootstrappedAddons for purity 2017-09-26 23:17:09 +02:00
Joachim Fasting 0c26be5bd2 tor-browser-bundle: improve organization of distribution dir 
Store TBB specific files under TorBrowser-Data
 2017-09-26 23:17:08 +02:00
Joachim Fasting 346661d77b tor-browser-bundle: redo extensions 2017-09-26 23:17:08 +02:00
Joachim Fasting fe3b95e749 tor-browser-bundle: customization via extraPrefs 2017-09-26 23:17:02 +02:00
Joachim Fasting 19ecb7f287 tor-browser-bundle: init at 7.0.1 (from source) 
The original browser bundle expects to run from a bundled directory,
typically under user's home.  This version creates a firefox distribution
with preloaded extensions and settings that functions more like an
ordinary firefox installation.

The approach used here could be generalized to allow specification of
custom firefox distributions.  Eventually, the code will be factored so
that the tbb is just an instance of that more general construct (firefox
base + extensions + prefs).

Currently, we use the latest upstream versions of extensions and so on.
Eventually we want to track the upstream bundle more closely and ideally
use the exact same inputs (firefox source, extension sources).

To avoid mixing up profile data, all runtime state is stored under
$XDG_DATA_HOME/tor-browser.

Major TODO items
- Pluggable transports
- Upstream TBB version parity
- Avoid fetchgit
- Build NoScript from source (no upstream source repo, however, must rely
  on third-parties)
- Improved notation for packaging extensions
- Feature parity with the binary bundle (apulse and runtime purity, in
  particular)
 2017-09-26 14:55:49 +02:00
Joachim Fasting 799c1218cd tor-browser-bundle-bin: default to dmix 
To support multiple playback streams
 2017-09-25 16:11:57 +02:00
Joachim Fasting 4429559aa1 mg: 20161005 -> 20170828 2017-09-25 14:02:37 +02:00
Joachim Fasting c951a0ad07 encfs: 1.9.1 -> 1.9.2 
See https://github.com/vgough/encfs/releases/tag/v1.9.2
 2017-09-23 23:56:44 +02:00
Joachim Fasting cb94feb2d1 openafs-client: 1.6.21 -> 1.6.21.1 
Per https://www.openafs.org/dl/openafs/1.6.21.1/RELNOTES-1.6.21.1
this release adds support for linux 4.13

Related to https://github.com/NixOS/nixpkgs/issues/28643
 2017-09-23 23:56:38 +02:00
Joachim Fasting 09a09c892c tor-browser-bundle-bin: support audio playback without pulseaudio 
Still a little rough around the edges but does work.  Defaults to using
the default plughw; set the APULSE_PLAYBACK_DEVICE envvar to override.
 2017-09-23 21:43:19 +02:00
Joachim Fasting c97e5f2670 apulse: 0.1.6 -> 0.1.10 2017-09-23 21:43:17 +02:00
Joachim Fasting 69e3817eb6 tor-browser-bundle-bin: optionally disable multiprocess support 
Multiprocess tabs always crash, as first reported by the issue mentioned
below.  It is now consistently reproducible both on NixOS and non-NixOS
for me, so I've decided to add a toggle to conveniently disable
multiprocess support as a work-around.

Closes https://github.com/NixOS/nixpkgs/issues/27759 but does
not really fix the underlying problem ...
 2017-09-23 00:17:42 +02:00
Joachim Fasting 1df6cf5d1d nixos/lock-kernel-modules: fix deferred fileSystem mounts 
Ensure that modules required by all declared fileSystems are explicitly
loaded.  A little ugly but fixes the deferred mount test.

See also https://github.com/NixOS/nixpkgs/issues/29019
 2017-09-22 23:55:04 +02:00
Joachim Fasting bccaf63067 nixos/hardened test: add failing test-case for deferred mounts 2017-09-22 23:53:27 +02:00
Joachim Fasting 15a4f9d8ef nixos/hardened: simplify script 2017-09-22 23:53:06 +02:00
Joachim Fasting fd3a9e6468 tor: enable parallel building 2017-09-22 22:37:15 +02:00
Joachim Fasting 3e96cee147 hydra: 2017-07-27 -> 2017-09-14 
Builds against recent nixUnstable
 2017-09-21 01:02:02 +02:00
Joachim Fasting 6bf56656f0 snapper: 0.3.3 -> 0.5.0 2017-09-21 00:56:24 +02:00
Joachim Fasting c41af35c04 unbound: 1.6.5 -> 1.6.6 2017-09-20 22:23:05 +02:00
Joachim Fasting 7a1f5bad0c ocamlPackages.csv: fix meta eval 
fetchurl does not expose a meta.homepage attr
 2017-09-20 22:15:26 +02:00
Joachim Fasting 1ee60e98e2 tor: 0.3.0.10 -> 0.3.1.7 2017-09-19 02:36:38 +02:00
Joachim Fasting 40d6414863 lttng-uts: 2.9.1 -> 2.10.0 2017-09-17 09:44:04 +02:00
Joachim Fasting 969db57853 lttng-tools: 2.9.5 -> 2.10.1 2017-09-17 09:44:04 +02:00
Joachim Fasting 7d69e5a18f linuxPackages.lttng-modules: broken on kernels >4.11 2017-09-17 09:44:04 +02:00
Joachim Fasting 9e395545e8 linuxPackages.lttng-modules: 2.9.3 -> 2.10.0 2017-09-17 09:44:04 +02:00
Joachim Fasting 586d04c588 nixos/tests: expand hardened tests 2017-09-16 13:14:07 +02:00
Joachim Fasting e05459584e nixos/release-combined: remove basic kernel tests 
Arguably, breaking linux-latest should not block a release.  Also, booting
the kernel + basic sanity checking is implicitly exercised by every other
vm test.
 2017-09-16 12:45:30 +02:00
Joachim Fasting ffd56ba4f6 nixos/tests: move kernel-params test to misc 2017-09-16 12:45:28 +02:00
Joachim Fasting c85cf60c83 nixos/tests: move sysctl test to misc 2017-09-16 12:45:23 +02:00
Joachim Fasting dd170cd5df hardened-config: build with fortify source 2017-09-16 00:31:25 +02:00
Joachim Fasting 9a763f8f59 hardened-config: enable the randstruct plugin 2017-09-16 00:31:23 +02:00
Joachim Fasting edd0d2f2e9 hardened-config: additional refcount checking 2017-09-16 00:31:17 +02:00
Joachim Fasting 42f2439228 pharo-launcher: fix build 
As noted by @dtzWill at https://github.com/NixOS/nixpkgs/pull/26924/files#r126686231
 2017-09-15 18:47:39 +02:00
Joachim Fasting 3f7ac92175 tinycc: 0.9.27pre-20170821 -> 0.9.27pre-20170911 
Contains various fixes.
 2017-09-15 16:05:00 +02:00
Joachim Fasting aff74b6af7 socklog: fixup implicit function declarations 2017-09-13 18:27:15 +02:00
Joachim Fasting 705f47f50e socklog: properly disable the chkshsgr test 
My previous attempt d438cbb0b6 was
bogus ...
 2017-09-13 18:27:09 +02:00
Joachim Fasting e2ddc7ffd2 libffcall: 1.10 -> 2.0 
Thanks to Bruno Haible for a notifying me of this.
 2017-09-12 15:08:38 +02:00
Joachim Fasting 8aa0618cf0 nixos/hardened: blacklist a few obscure net protocols 2017-09-09 17:37:17 +02:00
Joachim Fasting 2bce0b13e7 nixos/hardened: set mmap_min_addr 
This is set in the hardened linux config as well but sysctl is more
flexible & works with any boot.kernelPackages
 2017-09-09 17:37:15 +02:00
Joachim Fasting f84125c3b1 tor-browser-bundle-bin: runtime purity improvements 
These changes reduce file accesses outside TBB_HOME or the Nix store, as
determined by running under strace -e access,open,stat.
 2017-09-09 17:37:14 +02:00
Joachim Fasting c8f2dbae9f tor-browser-bundle-bin: hard-code path to desktop Icon 2017-09-09 17:37:09 +02:00
Joachim Fasting 5113be54a4 tor-browser-bundle-bin: 7.0.4 -> 7.0.5 2017-09-05 19:20:02 +02:00
Joachim Fasting 004463152a tinycc: 0.9.27pre-20170710 -> 0.9.27pre-20170821 2017-09-02 22:38:06 +02:00
Joachim Fasting bb036a327c nixos/chromium-suid-sandbox: remove reference to grsecurity 2017-09-02 20:35:28 +02:00
Joachim Fasting 268eb4adb7 nixos: purge remaining grsecurity bits 
:(

Fixes https://github.com/NixOS/nixpkgs/issues/28859
 2017-09-02 20:35:24 +02:00
Joachim Fasting 9935806894 nixos/release-notes: grsecurity support removed for 17.09 2017-09-02 20:35:07 +02:00