Commit Graph
100 Commits
Author SHA1 Message Date
Pierre Bourdon 4acf0beba1 python3Packages.zodb: fix compatibility with transaction 3.0
zodb build broke with the python3Packages.transaction upgrade that
happened in f054f49840.
2020-01-24 14:02:34 -08:00
Pierre Bourdon a5fc982ea5 prometheus: bundle the webui assets and build the new React UI
v2.14 introduced a new experimental React UI and changed how web assets
are bundled with Prometheus. A separate pre-build command is required to
generate an asset bundle that gets statically linked into the Prometheus
binary.
2019-12-04 15:44:22 +01:00
Pierre Bourdon eb2aa009a3 pythonPackages.pyatmo: 2.3.2 requires requests 2019-11-04 09:06:48 +01:00
Pierre Bourdon a92c42d197 gst-plugins-base: apply patch for CVE-2019-9928
Refactor the patchPhase management for the package along the way to
something more standard.
2019-10-24 08:53:12 +02:00
Pierre Bourdon 63905a7b6f gnupatch: rename patch files to match their CVE ids.
This should be a behavior no-op, but it helps vulnix figure out that we
are up to date regarding security patches.
2019-10-22 09:48:12 +02:00
Pierre Bourdon f15564d72b libtiff: patch for CVE-2019-6128, CVE-2019-14973
CVE-2019-14973.patch is a manually backported of the upstream patch to
work around some minor merge conflicts.
2019-10-22 09:47:40 +02:00
Pierre Bourdon 9dbc3029f7 sudo: 1.8.27 -> 1.8.28 (CVE-2019-14287) 2019-10-14 23:17:45 +02:00
Pierre Bourdon aa74d076c9 zziplib: apply patches for CVE-2018-16548 2019-10-07 04:25:22 +02:00
Pierre Bourdon 17be09a1f0 glibc: patch CVE-2018-11236, CVE-2018-11237
Patches have been imported into nixpkgs and manually edited to avoid
merge conflicts on ChangeLog / NEWS files.
2019-10-03 00:03:11 +02:00
Pierre Bourdon 1b7783072c lua5_1: rename patch file to match its CVE id 2019-10-02 22:13:12 +02:00
Pierre Bourdon 559687498b wpa_supplicant: apply patch for CVE-2019-16275 2019-10-02 21:24:23 +02:00
Pierre Bourdon 01aa4bb7cb vulnix: add missing setuptools dependency
More #68314 related breakage.
2019-10-02 12:46:01 +02:00
Pierre Bourdon 18b607b71b zbar: disable Qt assertions
Greatly decreases zbar-lib transitive closure size: assertion messages
contain paths to Qt header files, causing zbar-lib to depend on
qtbase-dev.

The Qt specific mkDerivation normally does this automatically, but we
can't use it here due to having only a small part of the project being
Qt related.
2019-09-21 03:46:57 +02:00
Pierre Bourdon ad4b97a233 redo-apenwarr: fix source URL 2019-09-20 22:31:08 +02:00
Pierre Bourdon dc5085e6b0 mono: remove dontStrip from derivation
This was introduced in 2010 in 9e16b812 and as far as I can tell the
issue mentioned in the comment does not exist anymore. In a stripped
mono build, I was able to:

- Run "mcs --version" without trouble (original test case)
- Run "keepass" (mono app)
- Build packages that depend on mono (e.g. f# and others).

$ nix path-info -sh
Before: 537.8M
After:  304.3M

$ nix path-info -Sh
Before: 1.2G
After:  867.0M

(Transitive closure size decreases more than the package size itself
because mono ended up depending on gcc through leaked paths in .so files
before.)
2019-09-20 15:25:27 +02:00
Pierre Bourdon 21c92c4a1d mono-zeroconf: remove broken package
No dependencies within nixpkgs, and the package has not built
successfully since 2018-04-29 according to Hydra[1].

[1] https://hydra.nixos.org/build/100604053
2019-09-20 14:16:49 +02:00
Pierre Bourdon dd5eb4dbc2 libgdiplus: split package to reduce dependencies closure size
nix path-info -rSh on mono:

Before: /nix/store/p7zix8ypkqdwz86jvirzn0hmqhkbfhf7-mono-5.20.1.27                 1.2G
After:  /nix/store/zwg8d5m2d7hbi1ylh6rq00wyghyyzpsp-mono-5.20.1.27               881.3M

Mostly due to not dragging in cairo-dev, mesa-dev, etc.
2019-09-20 13:28:34 +02:00
Pierre Bourdon eef06df7f5 mcomix: add missing setuptools dependency 2019-09-20 12:11:00 +02:00
Pierre Bourdon 9165e72c7f chiaki: init at 1.0.3 2019-09-15 05:08:45 +02:00
Pierre Bourdon 6a0c11b931 home-assistant: add missing setuptools dependency
Fixes currently broken nixos hass test: https://hydra.nixos.org/build/100923199
2019-09-14 15:23:26 +02:00
Pierre Bourdon 50956385ff deluge: add missing setuptools dependency
Latest staging merge broke nixos/tests/deluge.nix showing an ImportError
for "pkg_resources": https://nix-cache.s3.amazonaws.com/log/h8qzkcjldal5j1925g0r04ncl5afjjnp-vm-test-run-deluge.drv
2019-09-11 09:07:46 +02:00
Pierre Bourdon 04c1fcd09c home-assistant: remove outdated pyyaml_3 pinning
The recent bump to 0.96.2 now requires pyyaml 5.1.1. The PRs upgrading
home-assistant to a newer version and the one pinning to an old PyYAML
version raced each other and we ended up with both submitted.

Fixes home-assistant build.
2019-09-11 08:39:49 +02:00
Pierre Bourdon 39f3ab4961 home-assistant: 0.93.2 -> 0.96.2 2019-08-31 07:53:35 -04:00
Pierre Bourdon 1a1696f9b6 SDL2: don't mix space-separated / lists in cmake config
The SDL2_PATH environment variable is space-separated. However, CMake
lists are semicolon separated, and doing set(list "a" ${var}) will end
up with list containing "a;b c d". This causes downstream users to fail
parsing the include dirs list.

Normalize the include dirs list to a normal CMake semicolon-separated
list using separate_arguments.
2019-08-22 11:41:16 +03:00
Pierre Bourdon fe3dca6e73 warsow,warsow-engine: fix mirror URL
Current one does not resolve. New one is the one currently present on
warsow.net.
2019-08-21 12:27:20 +02:00
Pierre Bourdon f289585d54 efivar: patch build system for reproducibility 2019-08-13 05:21:54 +02:00
Pierre Bourdon 67d1cf4707 nixos/ibus: do not default-install ibus-qt
ibus-qt has not seen a release in 5 years and is only relevant for Qt
4.x, which is becoming more and more rare. Using my current laptop as a
data point, ibus-qt is the only dependency left that drags in qt-4.8.7.
2019-08-10 19:37:12 +02:00
Pierre Bourdon 67b7e70865 nixos/hardened: make pti=on overridable
Introduces a new security.forcePageTableIsolation option (default false
on !hardened, true on hardened) that forces pti=on.
2019-07-30 02:24:56 +02:00
Pierre Bourdon de6fc7fb97 pythonPackages.pyyaml: 5.1 -> 5.1.1 2019-07-21 08:38:22 +02:00
Pierre Bourdon abc9221996 pythonPackages.requests: 2.21.0 -> 2.22.0 2019-07-21 08:38:22 +02:00
Pierre Bourdon d886bc27ed pythonPackages.certifi: 2019.3.9 -> 2019.6.16 2019-07-21 08:38:22 +02:00
Pierre Bourdon 16ad5d5401 pythonPackages.bcrypt: 3.1.6 -> 3.1.7 2019-07-21 08:38:22 +02:00
Pierre Bourdon 6332bc25cd nixos/bind: allow manual additions to zone config fragments 2019-07-20 17:50:37 +02:00
Pierre Bourdon de927db59d keepassxc: partial revert of #54525
Similar to pkgs.bitcoin, QT_PLUGIN_PATH is required in checkPhase to run
the "testcli" test (ironically).
2019-07-20 14:08:27 +02:00
Pierre Bourdon 9e60eab8f5 nixos/malloc: apply allocator settings to systemd units
This uses systemd's system.conf/user.conf "DefaultEnvironment" feature
to set the allocator's LD_PRELOAD near-globally.
2019-05-30 12:07:34 +09:00
Pierre Bourdon 1cc8ea7cb4 nixos/malloc: add scudo from LLVM compiler-rt 2019-05-30 02:35:50 +09:00
Pierre Bourdon fb455c62e0 pythonPackages.fitbit: init at 0.3.0 2019-05-19 01:32:52 +09:00
Pierre Bourdon d5e745f412 pythonPackages.pyatmo: init at 1.10 2019-05-19 01:31:43 +09:00
Pierre Bourdon 5d2bb3d715 nixos/stage-1: "find-libs" shell script is for the host 2019-04-18 15:02:51 +02:00
Pierre Bourdon 03f618d9cf glibc: re-enable stripping in cross builds
References to the host toolchain are leaking through debug symbols in
glibc, causing gnu cross-builds to always depend on the host toolchain.
The decision to not strip was made in 2012 in order to improve GNU/Hurd
support, and I suspect the reasons that justified it back then do not
apply anymore in 2019.

Closure size before:
/nix/store/v5pxj0bgg627hic2khk4d43z6cjp5v7d-hello-2.10-armv7l-unknown-linux-gnueabihf                            596.8M

After:
/nix/store/llp1ncmpar406rc2vhj7g5ix4yqwna3n-hello-2.10-armv7l-unknown-linux-gnueabihf     23.6M
2019-04-17 19:53:53 +02:00
Pierre Bourdon b3c17c9d85 pinentry: fix libassuan and libgpg-error detection in cross builds 2019-04-16 18:58:47 +02:00
Pierre Bourdon a19fbaf39b ibus-packages.mozc: pin to protobuf 3.6
https://github.com/google/mozc/issues/460
2019-04-16 03:47:34 +02:00
Pierre Bourdon c9c0e7c1b0 nilfs-utils: fix cross-compilation issue caused by AC_FUNC_MALLOC 2019-04-06 15:55:50 +02:00
Pierre Bourdon 2306fa644c libsecret: pass libgcrypt prefix to ./configure
Fixes cross compilation builds not finding the libgcrypt-config binary.
2019-04-06 15:06:30 +02:00
Pierre Bourdon c689a3bad9 xkeyboard-config: intltool should be a nativeBuildInput (#59048) 2019-04-06 12:35:12 +00:00
Pierre Bourdon f8eec8dc34 environment.noXlibs: disable gnome3 support for pinentry (#59051) 2019-04-06 10:06:55 +00:00
Pierre Bourdon 91c46d17d5 ghostscript: add patch for CVE-2019-6116
This is tagged as version 9.26a in the ghostpdl repo, but unfortunately
there are no tarballs released with that version number so far. We'll
continue calling this version 9.26 for now for simplicity's sake (and we
can switch to 9.26a and remove the patch when it's properly released).

Fixes #58262
Fixes #58089
2019-03-26 02:46:57 +01:00
Pierre Bourdon 57ffe86efa zbar: 0.10 -> 0.22
The original upstream at http://zbar.sourceforge.net/ has not produced a
new release or a new commit on their repository in about 7 years. Most
distros (Debian, Gentoo, Arch, ...) have switched already to the more
maintained fork at https://github.com/mchehab/zbar

Update dependencies from qt4 to qt5, reducing "electrum" closure size in
the process (now only depends on one Qt version).
2019-03-25 10:28:34 +01:00
Pierre Bourdon 6beffff797 pythonPackages.dnslib: init at 0.9.9 (#57101) 2019-03-25 08:57:58 +01:00
Pierre Bourdon 0489e8c560 nginx-sso: 0.16.0 -> 0.16.1 2019-03-17 22:33:28 +01:00
Pierre Bourdon abe667ce06 tpm2-tools: 3.1.3 -> 3.1.4 2019-03-15 01:34:24 +01:00
Pierre Bourdon 19601561ed imgurbash2: 2.1 -> 3.1 2019-03-12 08:04:58 +01:00
Pierre Bourdon a9cf5c27ec imagemagickBig: revert meta.broken to false 2019-03-11 00:13:02 +01:00
Pierre Bourdon 128bb7be2a ghostscript: link against "systemwide" liblcms2
GS ships with a fork of lcms2 ("lcms2mt"), but the ABI separation
between the fork and the original seems insufficient. If libgs is linked
alongside liblcms2 (for example, this is the case with imagemagick) then
it will call into the original library instead of the fork, causing
segfaults.

Follow the example of both Arch and Debian in this regard -- they both
use the systemwide lib instead of the fork.
2019-03-11 00:07:18 +01:00
Pierre Bourdon 18bc8203a1 nixos/firewall: canonicalize firewall ports lists
Fixes #56086.
2019-03-09 20:02:04 +01:00
Pierre Bourdon 843215ac1c nixos/firewall: use types.port where appropriate 2019-03-09 19:45:11 +01:00
Pierre Bourdon f20a66084f pythonPackages.protobuf: propagate native pkgs.protobuf input
Python packages depending on the protobuf library often use the "protoc"
tool from pkgs.protobuf to codegen at build time.

This fixes a few regressions from 5c7531872f
2019-03-03 08:07:56 +01:00
Pierre Bourdon b5d341e7f9 tpm2-tss: 2.2.0 -> 2.2.1 2019-03-01 01:25:38 +01:00
Pierre Bourdon 7541e4f8ac llvm/7/compiler-rt: define CMAKE_*_COMPILER_TARGET unconditionally
When building with -DCOMPILER_RT_DEFAULT_TARGET_ONLY=ON the compiler-rt
CMake configuration attempts to use CMAKE_*_COMPILER_TARGET variables,
which are usually only defined in cross-compilation mode.
2019-02-28 04:29:05 +01:00
Pierre Bourdon 244b4b0544 nginx-sso: 0.15.1 -> 0.16.0 2019-02-24 23:17:16 +01:00
Pierre Bourdon 3f0a59314c wpa_supplicant: 2.6 -> 2.7 (#55926) 2019-02-24 00:47:11 +01:00
Pierre Bourdon ce15dafc7d git: build diff-highlight if Perl support is enabled
Fixes #27671.

git/git@0c977dbc81 made that script
require an extra build step.
2019-02-20 01:11:32 +01:00
Pierre Bourdon d21e4f1ab4 tpm2-tools: init at 3.1.3 2019-02-19 20:02:31 +01:00
Pierre Bourdon 0cb599293b tpm2-tss: init at 2.2.0 2019-02-19 20:02:31 +01:00
Pierre Bourdon 67d912af0a ibm-sw-tpm2: init at 1332 2019-02-19 20:02:31 +01:00
Pierre Bourdon a13a0d7868 electrum: 3.3.2 -> 3.3.4 2019-02-19 17:01:57 +01:00
Pierre Bourdon 705167a5dc unzip: patch CVE-2018-18384
Patch from https://sourceforge.net/p/infozip/bugs/53/
2019-02-17 05:55:30 +01:00
Pierre Bourdon da9fdcb1f0 libu2f-host: 1.1.6 -> 1.1.7 (CVE-2018-20340) 2019-02-11 21:03:06 +01:00
Pierre Bourdon c0829a0859 nixos/tests/gitea: fix eval warnings
trace: warning: config.services.gitea.database.password will be stored as plaintext
        in the Nix store. Use database.passwordFile instead.

(Arguably, this shouldn't be a warning at all. But making it happy is
easier than having a debate on the value of this warning.)
2019-02-11 03:13:03 +01:00
Pierre Bourdon f90a60a33c nixos/tests/ndppd: fix eval warnings
trace: warning: The options services.ndppd.interface and services.ndppd.network will probably be removed soon,
please use services.ndppd.proxies.<interface>.rules.<network> instead.
2019-02-11 03:12:56 +01:00
Pierre Bourdon 4b959cd354 nixos/tests/rspamd: fix eval warnings
trace: warning: The option `services.rspamd.bindUISocket' defined in `<unknown-file>' has been renamed to `services.rspamd.workers.controller.bindSockets'.
trace: warning: The option `services.rspamd.bindSocket' defined in `<unknown-file>' has been renamed to `services.rspamd.workers.normal.bindSockets'.
trace: warning: The option `services.rspamd.workers.”rspamd_proxy".type` defined in `<unknown-file>' has enum value `proxy` which has been renamed to `rspamd_proxy`
2019-02-11 02:59:55 +01:00
Pierre Bourdon a8da72b012 nixos/tests/postgresql: fix regression from #55106 2019-02-04 03:56:43 +01:00
Pierre Bourdon 25c2d1cd3e glowing-bear: init at 0.7.1 2019-02-03 19:39:59 +01:00
Pierre Bourdon 3674bdf204 nixos/tasks/encrypted-devices: fix regression from #54637
27982b408e introduced a bug when
refactoring the encrypted-devices module, causing some encrypted
filesystem options to not be recognized anymore.

See e.g. https://hydra.nixos.org/build/88145490
2019-02-02 17:31:31 +01:00
Pierre Bourdon 20b1febace nixos/tests: add nginx-sso basic functionality test 2019-01-29 19:54:14 +01:00
Pierre Bourdon 43fcfc274d nixos: add nginx-sso service 2019-01-29 19:54:14 +01:00
Pierre Bourdon aa000aa3a0 nginx-sso: init at 0.15.1 2019-01-29 19:52:48 +01:00
Pierre Bourdon 8769d2d58c nixos kernel.nix: add an option to customize the kernel RANDSTRUCT seed 2019-01-24 01:42:17 +01:00
Pierre Bourdon a258015d3a kernel: extend the RANDSTRUCT seed with a user-configurable section 2019-01-24 01:42:16 +01:00
Pierre Bourdon b26c824da3 Revert "Revert "Revert "linux-hardened: Disable GCC_PLUGIN_RANDSTRUCT"""
The issue with out-of-tree modules has been addressed and the feature
should now be good to re-enable again.

This reverts commit 865f7a14b4.
2019-01-11 12:35:16 +01:00
Pierre Bourdon 1b9bf8fa75 kernel: make the RANDSTRUCT seed deterministic 2019-01-11 12:35:16 +01:00
Pierre Bourdon 0f7ca26a48 kernel/hardened-config.nix: add STACKLEAK plugin on 4.20+ 2019-01-04 22:24:50 +01:00
Pierre Bourdon 9dc0d94896 kernel/hardened-config.nix: re-enable GCC plugins 2019-01-04 22:24:50 +01:00
Pierre Bourdon c789f642f0 kernel/generic.nix: provide required dependencies for GCC plugins builds 2019-01-04 22:24:50 +01:00
Pierre Bourdon d132c08aa1 wget: 1.20 -> 1.20.1 (CVE-2018-20483) 2018-12-29 13:00:58 +01:00
Pierre Bourdon 3873f43fc3 prometheus/exporters: fix regression in DynamicUser behavior
Instead of setting User/Group only when DynamicUser is disabled, the
previous version of the code set it only when it was enabled. This
caused services with DynamicUser enabled to actually run as nobody, and
services without DynamicUser enabled to run as root.

Regression from fbb7e0c82f.
2018-12-05 11:26:38 +01:00
Pierre Bourdon 199b4c4743 prometheus/exporters/tor: make CPython happy by defining $HOME 2018-12-05 11:26:38 +01:00
Pierre Bourdon ec3d829257 php72: 7.2.11 -> 7.2.12 2018-11-27 02:56:22 +01:00
Pierre Bourdon 8221da343e php71: 7.1.23 -> 7.1.24 2018-11-27 02:56:22 +01:00
Pierre Bourdon ea10173045 php: align Darwin and Linux versions again
Instead of pinning Darwin to older versions, add small patches to
configure.in (7.1) / configure.ac (7.2) to fix the build of the intl
extension on recent PHP versions on Darwin.

fix-paths-php7.patch also required changes -- since we now run autoconf
at build time (through ./buildconf), it needs to patch the input .m4
files instead of ./configure directly.
2018-11-27 02:56:17 +01:00
Pierre Bourdon 90720d0139 curl: cherry-pick upstream patch for ipv6 url parsing
Upstream bug: curl/curl#3218.

This causes nixos/tests/ipv6.nix to fix since the last staging merge.
2018-11-22 09:58:34 +01:00
Pierre Bourdon 2f11166f43 kpcli: fix wrong program name in prompt (#50845) 2018-11-20 18:46:19 +01:00
Pierre Bourdon 74598ca8d3 nixos.tests.keymap: use new name of the colemak/en-latin9 keymap
Commit f1987fb58f renamed colemak/en-latin9 to
colemak/colemak, but the keymap test wasn't adjusted to refer to the new path.
2018-11-20 04:11:39 +01:00
Pierre Bourdon 6b1d3dc590 doc/reviewing-contributions: fix build error
Regression from #50674. Section IDs cannot contain spaces.
2018-11-20 03:46:34 +01:00
Pierre Bourdon 08f24cadaa syncthing-relay module: init 2018-11-19 01:09:54 +01:00
Pierre Bourdon cf58856d90 nixos/prometheus: add webExternalUrl option
Similar to the prometheus.alertmanager.webExternalUrl option, but for
Prometheus itself.
2018-10-20 13:45:55 +02:00
Pierre Bourdon 259cf8812b dolphin-emu: fix metadata (GPLv2 -> GPLv2+, http -> https)
Dolphin has been GPLv2+ since 2015.
2018-10-15 03:28:17 +02:00
Pierre Bourdon 01d1f77681 tests/prometheus-exporters: add new Tor exporter
This new exporter was added in #48307.
2018-10-14 20:12:07 -05:00
Pierre Bourdon 86d644f8cc prometheus-tor-exporter: init at 0.3
Upstream: https://github.com/atx/prometheus-tor_exporter
2018-10-13 10:10:29 +02:00
Pierre Bourdon 5410e6b6b6 maintainers: add delroth 2018-10-13 10:10:29 +02:00