readelf which makes most of checks should come from binutils package instead of elfutils
E.g. the PIE check from checksec, different readelf gives different result:
(elfutils)
$ /nix/store/rgrji20513g19ci0sa6jydm86gpf4j42-elfutils-0.158/bin/readelf -d /nix/store/q1sbn93v4k3166s091s9biygv9srv8qa-nginx-1.6.2/bin/nginx
2>/dev/null |grep -q '(DEBUG)' ; echo $?
1
(binutils)
$ /nix/store/b8qhjrwf8sf9ggkjxqqav7f1m6w83bh0-binutils-2.23.1/bin/readelf -d /nix/store/q1sbn93v4k3166s091s9biygv9srv8qa-nginx-1.6.2/bin/nginx
2>/dev/null | grep -q '(DEBUG)' ; echo $?
0
cherrytree - A hierarchical note taking application, featuring rich text
and syntax highlighting, storing data in a single xml or sqlite file.
This commit also adds PyGtkSourceView - a Python wrapper for the GtkSourceView widget library.
Official page http://www.giuspen.com/cherrytree
The program is useful for evaluating pseudorandom number generators
for encryption and statistical sampling applications, compression
algorithms, and other applications where the information density of a
file is of interest.
Official page http://www.fourmilab.ch/random/
socat: Update from 1.7.2.4 to 1.7.3.0, fixes a possible denial of service attack
(CVE Id pending), improves SSL client security, and provides a couple of bug and
porting fixes.
Among new features, socat now enables OpenSSL server side use of ECDHE ciphers,
providing PFS (Perfect Forward Secrecy)
http://www.dest-unreach.org/socat/doc/CHANGES
Absolute path is required when one has such postfix configuration
where he/she needs to specify the actual (real) path to active dovecot
config.
Without this commit applied, the dovecot is running in such way:
/nix/store/hashAAA-dovecot-ver/sbin/dovecot -F -c /nix/store/hashBBB-dovecot2.conf
and postfix can't be aware of the value of "hashBBB" via services.postfix.extraConfig = '' ... '';
(it can only be aware of "hashAAA" with ${pkgs.dovecot} parameter)
Also enable Restart on-failure.
Edit: set RestartSec to 1s
Adding Restart, RestartSec, StartLimitInterval to ensure that the service
is started in case if it can't assign (bind) the address as often it takes longer
for the network (e.g. dhcpcd) to get the IP assigned.
Andrey Arapov