Commit Graph
100 Commits
Author SHA1 Message Date
Niklas Hambüchen de1ff3208f thunderbird-78: 78.13.0 -> 78.14.0
Fixes CVE-2021-38495:

https://www.mozilla.org/en-US/security/advisories/mfsa2021-41/#CVE-2021-38495
2021-09-09 22:56:08 +02:00
Niklas Hambüchen 2bb004dde3 thunderbird-91: 91.0.3 -> 91.1.0
Fixes CVE-2021-38495:

https://www.mozilla.org/en-US/security/advisories/mfsa2021-41/#CVE-2021-38495
2021-09-09 22:56:08 +02:00
Niklas Hambüchen d79fc9d53b Merge pull request #136210 from maxeaubrey/21.05_consul_1.9.9
[21.05] consul: 1.9.8 -> 1.9.9
2021-08-30 20:54:36 +02:00
Niklas Hambüchen 2da6605a52 Merge pull request #133468 from rski/release-21.05
CONTRIBUTING.md: Move to repo root, where it is more visible.
2021-08-11 14:01:51 +02:00
Niklas Hambüchen d76b42c680 CONTRIBUTING.md: Move to repo root, where it is more visible.
We found that many users found it difficult to locate this document.

Github supports it in the root, see:
https://docs.github.com/en/communities/setting-up-your-project-for-healthy-contributions/setting-guidelines-for-repository-contributors

(cherry picked from commit 3c29ced243cc032806f680ae67845b9b3a879183)

This fixes the links on the nixos.org website, the stable branch
docs point to master on github, so both master and the release branch
need to have the file in the same location.

fixes https://github.com/NixOS/nixos-homepage/issues/736
2021-08-11 09:42:10 +03:00
Niklas Hambüchen 0a532d8b22 Merge pull request #128818 from NixOS/backport-128546-to-release-21.05
[Backport release-21.05] kubernetes: make tests pass by fixing a conntrack-tools dep and a missing dir
2021-07-27 16:18:00 +02:00
Niklas Hambüchen a165aeceda Merge pull request #130313 from maxeaubrey/21.05_consul_1.9.8
[21.05] consul: 1.9.7 -> 1.9.8
2021-07-16 02:36:15 +02:00
Niklas Hambüchen cdf6905e25 turbovnc: Fix that setting JAVA_HOME breaks vncviewer. Fixes #129582
(cherry picked from commit b7dd636f2475cd199d12cce672390f998f8c81bd)
2021-07-08 05:22:46 +00:00
Niklas Hambüchen df8bcca5fb Merge pull request #128161 from NixOS/backport-128150-to-release-21.05
[Backport release-21.05] etcd: refactor the service to add etcd to systemPackages instead of the etcdctl alias
2021-06-27 14:28:07 +02:00
Niklas Hambüchen b73e47d3d7 nixos/wireguard: Remove .path systemd unit for privkey. Fixes #123203
As per `man systemd.path`:

> When a service unit triggered by a path unit terminates
> (regardless whether it exited successfully or failed),
> monitored paths are checked immediately again,
> **and the service accordingly restarted instantly**.

Thus the existence of the path unit made it impossible to stop the
wireguard service using e.g.

    systemctl stop wireguard-wg0.service

Systemd path units are not intended for program inputs such
as private key files.
This commit simply removes this usage; the private key is still
generated by the `generateKeyServiceUnit`.

(cherry picked from commit d344dccf3dc592242f11ef993acb9ecee8d84796)
2021-05-28 18:28:35 -07:00
Niklas Hambüchen a874a8a98b release notes: Mention wireguard generatePrivateKeyFile permission changes 2021-04-30 19:28:04 +02:00
Niklas Hambüchen 0dc08b4138 wireguard module: generatePrivateKeyFile: Fix chmod security race. Fixes #121288
Until now, the `touch + chmod 600 + write` approach made it possible for
an unprivileged local user read the private key file, by opening
the file after the touch, before the read permissions are restricted.

This was only the case if `generatePrivateKeyFile = true` and the parent
directory of `privateKeyFile` already existed and was readable.

This commit fixes it by using `umask`, which ensures kernel-side that
the `touch` creates the file with the correct permissions atomically.

This commit also:

* Removes `mkdir --mode 0644 -p "${dirOf values.privateKeyFile}"`
  because setting permissions `drw-r--r--` ("nobody can enter that dir")
  is awkward. `drwx------` would perhaps make sense, like for `.ssh`.
  However, setting the permissions on the private key file is enough,
  and likely better, because `privateKeyFile` is about that file
  specifically and no docs suggest that there's something special
  about its parent dir.
* Removes the `chmod 0400 "${values.privateKeyFile}"`
  because there isn't really a point in removing write access from
  the owner of the private key.
2021-04-30 18:55:38 +02:00
Niklas Hambüchen 296c47d7b2 Merge pull request #116282 from nh2/programs-turbovnc
turbovnc: Add programs.turbovnc, add test for headless software OpenGL
2021-03-19 01:12:33 +01:00
Niklas Hambüchen cbd71a8732 Merge pull request #116343 from nh2/onlyoffice-bin
onlyoffice-bin: init at 6.1.0
2021-03-16 00:43:52 +01:00
Niklas Hambüchen bec3b30b9e onlyoffice-bin: init at 6.1.0
Imported from:

https://github.com/icebox-nix/iceberg/blob/a49fa345b53cdf51a480cb53623a8194fb2d4b56/pkgs/office/onlyoffice-bin/default.nix
2021-03-15 01:06:22 +01:00
Niklas Hambüchen a071431245 maintainers: Add gtrunsec
As requested on https://discourse.nixos.org/t/onlyoffice-desktopeditors-packaged/7226/21
2021-03-15 00:34:56 +01:00
Niklas Hambüchen b46f6cba79 turbovnc: Add programs.turbovnc, add test for headless software OpenGL 2021-03-14 06:27:43 +01:00
Niklas Hambüchen 53ffeb59ff Merge pull request #113657 from nh2/turbovnc
turbovnc: init at 2.2.5
2021-02-28 03:58:07 +01:00
Niklas Hambüchen c834c60ff9 turbovnc: init at 2.2.5
I started out by copying the `tigervnc` derivation, which
does things like re-using `xorg.xorgserver.buildInputs`
(given that these VNC servers are all forks of Xorg),
but then removed that and all the dependencies that did not
appear to be needed or checked for in the CMake output.
2021-02-28 03:36:25 +01:00
Niklas Hambüchen d45cdb2f3e libjpeg-turbo: Optionally build Java wrapper 2021-02-18 19:04:11 +01:00
Niklas Hambüchen da899edeec pkgsStatic.linux-pam: Remove no longer necessary musl patches.
See https://github.com/NixOS/nixpkgs/pull/109906#issuecomment-775630916.

These Alpine patches:

    libpam-fix-build-with-eglibc-2.16.patch
    fix-compat.patch

were removed in:

    https://git.alpinelinux.org/aports/commit/main/linux-pam?id=9ba93cf3f515b4f0b9b3802b84d42c4e436afe8b
2021-02-10 23:06:15 +01:00
Niklas Hambüchen b954e0a12f manual: Element: Fix misleading base_url.
Judging from `"${pkgs.element-web}/config.sample.json"`,
this needs be a URL starting with `https://`; without it one gets:

    Your Element is misconfigured

    Invalid base_url for m.homeserver
2021-01-18 04:43:32 +01:00
Niklas Hambüchen e350b35cce Merge pull request #109103 from taku0/thunderbird-bin-78.6.1
thunderbird,  thunderbird-bin: 78.6.0 -> 78.6.1 [Critical security fix]
2021-01-12 19:36:40 +01:00
Niklas Hambüchen 22b9910f4e Merge pull request #108804 from ketzacoatl/amazon-ec2-utils
Amazon ec2 utils
2021-01-08 20:43:12 +01:00
Niklas Hambüchen 9206c0d115 Merge pull request #41966 from aneeshusa/allow-mutable-shells-for-declarative-users
nixos/users: Allow mutable shells for declarative users
2020-12-31 02:03:22 +01:00
Niklas Hambüchen 7da8c4439d Merge pull request #107332 from jojosch/dbeaver-7.3.1
dbeaver: 7.3.0 -> 7.3.1
2020-12-31 01:54:54 +01:00
Niklas Hambüchen a8f2b9f4d9 Merge pull request #67643 from MetaDark/clonehero
clonehero: init at 0.23.2.2
2020-12-31 01:53:46 +01:00
Niklas Hambüchen 3658b4009f Merge pull request #107265 from sternenseemann/foot-1.6.0
foot: 1.5.1 -> 1.6.2
2020-12-31 01:51:30 +01:00
Niklas Hambüchen 9424925867 Merge pull request #85244 from tomberek/tomberek/amazon-init
amazon-init: add xz to PATH
2020-12-31 01:50:19 +01:00
Niklas Hambüchen 45a219ef21 Merge pull request #107998 from zowoq/ytdl
youtube-dl: 2020.12.29 -> 2020.12.31
2020-12-31 01:44:28 +01:00
Niklas Hambüchen f6b9db7067 Merge pull request #107723 from r-ryantm/auto-update/obsidian
obsidian: 0.9.22 -> 0.10.1
2020-12-31 01:40:11 +01:00
Niklas Hambüchen 5604a20762 Merge pull request #80769 from chkno/nixos-enter-tmp
nixos/nixos-enter: Create /tmp
2020-12-31 01:37:41 +01:00
Niklas Hambüchen db9a28338f Merge pull request #107122 from nh2/thunderbird-gpgme
thunderbird: Add gpg/gpgme dependencies to fix smartcard usage
2020-12-23 22:14:24 +01:00
Niklas Hambüchen 443724873f thunderbird, thunderbird.bin: Refactor: Reorder import lists.
Also `pkgs.lib` -> `lib`.
2020-12-22 02:02:47 +01:00
Niklas Hambüchen e72bd9f089 thunderbird-bin: Add gpg/gpgme dependencies. Fixes #98765 2020-12-22 01:49:45 +01:00
Niklas Hambüchen 2767936180 thunderbird: Add gpg/gpgme dependencies. Fixes #98765.
This enables to configure Thunderbird to use gnupg directly, which is the
official upstream recommendation when using GPG with smartcards, which are not
yet supported by Thunderbird's native GPG support.
2020-12-18 00:36:55 +01:00
Niklas Hambüchen 87413f30a5 Merge pull request #100906 from KAction/openssh
openssh: fix static build
2020-12-09 00:39:56 +01:00
Niklas Hambüchen f1651e1d83 Merge pull request #105487 from kisik21/gst-plugins-good-aarch64
gst-plugins-good: fix aarch64 builds and make raspi deps optional
2020-12-05 17:34:06 +01:00
Niklas Hambüchen 5f598308a5 Merge pull request #105170 from jonringer/fix-libmtp
libmtp: fix sha
2020-11-27 23:20:00 +01:00
Niklas Hambüchen 76aac1eaf3 Merge pull request #104000 from nh2/gphoto-libmtp-from-repo
libmtp, libgphoto2, gphoto2: Switch to Github, allow building from repo
2020-11-25 22:58:58 +01:00
Niklas Hambüchen e3e4fc0711 Merge pull request #104274 from FlorianFranzen/texmacs-1.99.15
texmacs: 1.99.14 -> 1.99.15
2020-11-19 19:04:07 +01:00
Niklas Hambüchen 7c8451d51c Merge pull request #104098 from nh2/issues-104062-gstreamer-libva-linux-only
gst_all_1.gst-plugins-bad: libva is Linux-only
2020-11-19 03:37:22 +01:00
Niklas Hambüchen 691e6e4c26 gst_all_1.gst-plugins-bad: libva/v4l2codecs are Linux-only. Fixes #104062 2020-11-18 21:13:42 +01:00
Niklas Hambüchen c05e9d9537 Merge pull request #104071 from nh2/issues-104062-libmicrodns-unix
libmicrodns: Change platforms to `unix`
2020-11-17 22:35:11 +01:00
Niklas Hambüchen 2a0fbf08da libmicrodns: Change platforms to unix. See #104062.
It builds on Darwin as well.
2020-11-17 22:33:48 +01:00
Niklas Hambüchen 14f2dc1daf Merge pull request #103954 from JesusMtnez/slack
slack: 4.10.3 -> 4.11.1
2020-11-16 23:13:32 +01:00
Niklas Hambüchen 58957e42be gphoto2: Switch to Github, allow building from repo.
Github is where upstream's development happens now,
and building from repo makes adding patches and overriding the commit easier.

Also use pname+version, see #103997.
2020-11-16 22:42:56 +01:00
Niklas Hambüchen 25b7b8895c libgphoto: Switch to Github, allow building from repo.
Github is where upstream's development happens now,
and building from repo makes adding patches and overriding the commit easier.

Also use pname+version, see #103997.
2020-11-16 22:42:56 +01:00
Niklas Hambüchen c75b9da41d libmtp: Switch to Github, allow building from repo.
Github is where upstream's development happens now,
and building from repo makes adding patches and overriding the commit easier.

Also use pname+version, see #103997.
2020-11-16 22:42:53 +01:00
Niklas Hambüchen 0ce17eace8 Merge pull request #103984 from ehmry/lz4-1.9.3
lz4: 1.9.2 -> 1.9.3
2020-11-16 21:30:37 +01:00
Niklas Hambüchen cdbc633771 Merge pull request #103334 from nh2/libe57format-fix-cmake
libe57format: Fix dependents not finding its cmake config
2020-11-10 21:11:28 +01:00
Niklas Hambüchen b972ca801d libe57format: Fix dependents not finding its cmake config 2020-11-10 20:26:18 +01:00
Niklas Hambüchen 91b20fb1aa roundcube service: Restart on config changes.
Until now, e.g. `extraConfig` changes did not reflect in
the system on `nixos-rebuild switch`.
2020-11-08 22:20:18 +01:00
Niklas Hambüchen 1c460c0a5c Merge pull request #103147 from nh2/nginx-sandbox-protecthome-release-notes
manual: nginx: Mention ProtectHome in release notes. See #85567
2020-11-08 18:01:03 +01:00
Niklas Hambüchen 2e7b320931 manual: nginx: Remove reference to stateDir from release notes. Fixes #102211.
Fixed wording taken from:
https://github.com/NixOS/nixpkgs/issues/102211#issuecomment-719976230
2020-11-08 17:55:11 +01:00
Niklas Hambüchen 2f845dccbf manual: nginx: Mention ProtectHome in release notes. See #85567.
See https://github.com/NixOS/nixpkgs/pull/85567#pullrequestreview-525820684
2020-11-08 17:03:07 +01:00
Niklas Hambüchen ca94c1f0cb Merge pull request #103035 from nh2/texmacs-1.99.14
texmacs: 1.99.13 -> 1.99.14
2020-11-08 01:18:10 +01:00
Niklas Hambüchen 01a3fcc659 Merge pull request #100195 from nh2/redis-listen-loopback-default
redis service: Listen on localhost by default
2020-11-08 01:17:19 +01:00
Niklas Hambüchen 169ab0b89f redis service: Listen on localhost by default. Fixes #100192.
All other database servers in NixOS also use this safe-by-default setting.
2020-11-08 01:15:33 +01:00
Niklas Hambüchen b5008f9e30 texmacs: 1.99.13 -> 1.99.14 2020-11-06 20:54:12 +01:00
Niklas Hambüchen 02d0df518e Merge pull request #97512 from lf-/StartLimitIntervalSec
nixos/modules: fix systemd start rate-limits
2020-10-31 18:13:23 +01:00
Niklas Hambüchen 441abe9949 release notes: Document deprecation warning for StartLimitInterval in [Service] 2020-10-31 18:11:03 +01:00
Niklas Hambüchen c178fe4bbb nixos/modules: Reformat warnings section 2020-10-31 16:50:25 +01:00
Niklas Hambüchen bc2b206f3a Merge pull request #102032 from paralin/fix-gstreamer-plugins-base-xext
gstreamer: needs Xext build input when x11 is enabled
2020-10-29 15:44:27 +01:00
Niklas Hambüchen e5b345c09d Merge pull request #99345 from nh2/gstreamer-1.18.0
gstreamer: 1.16.2 -> 1.18.0
2020-10-29 14:04:16 +01:00
Niklas Hambüchen c06f86d591 Merge pull request #101879 from sikmir/cloudcompare
cloudcompare: 2.11.0 → 2.11.2
2020-10-28 13:43:31 +01:00
Niklas Hambüchen 38c52994a6 pitivi: 0.999 -> 2020.09.1 2020-10-24 02:02:09 +02:00
Niklas Hambüchen 9ba3714f10 pitivi: Use gst-transcoder from gst-plugins-bad 2020-10-24 02:02:09 +02:00
Niklas Hambüchen 7fddef376e gst_all_1.gst-plugins-bad: Add upstream patch to fix SRT usage 2020-10-24 02:02:09 +02:00
Niklas Hambüchen 0672de5b89 gstreamer: 1.16.2 -> 1.18.0
Fixes #98769.

Important changes from https://gstreamer.freedesktop.org/releases/1.18/:

* `gst-validate` was renamed to `gst-devtools` upstream:

    > * the `gst-validate` tarball has been superseded by
    >   the `gst-devtools` tarball for consistency with the git module name.

* `gst-python` is now Python 3 only:

    > * Python 2.x is no longer supported
2020-10-24 02:02:09 +02:00
Niklas Hambüchen 036a415cf6 Merge pull request #101432 from nh2/pdal-2.2.0
pdal: 2.1.0 -> 2.2.0
2020-10-23 21:37:57 +00:00
Niklas Hambüchen 5aa96b68cc pdal: 2.1.0 -> 2.2.0 2020-10-23 02:41:40 +02:00
Niklas Hambüchen e186f0e161 pitivi: Fix .svg loading at startup, see #56943 #89691 2020-10-23 01:26:32 +02:00
Niklas Hambüchen 8f8e6dcd6b Merge pull request #101308 from nh2/srt-1.4.2
srt: 1.4.1 -> 1.4.2
2020-10-22 20:35:52 +00:00
Niklas Hambüchen 4bf0061d28 pitivi: Fix .svg loading at startup, see #56943 #89691 2020-10-22 18:36:53 +02:00
Niklas Hambüchen 1c20e2c9f2 rspamd: add passthru.tests 2020-10-22 02:36:53 +02:00
Niklas Hambüchen 70a924fa80 meson: Patch out default boost search paths. See #86131.
Avoids impure builds on unsandboxed non-NixOS builds, see:
https://github.com/NixOS/nixpkgs/issues/86131#issuecomment-711051774
2020-10-20 21:02:43 +02:00
Niklas Hambüchen a280022c23 Merge pull request #100904 from r-ryantm/auto-update/consul
consul: 1.8.3 -> 1.8.4
2020-10-18 03:26:15 +00:00
Niklas Hambüchen ff7792dd05 rspamd: 2.5 -> 2.6 2020-10-11 07:28:16 +02:00
Niklas Hambüchen 471eabc16e srt: 1.4.1 -> 1.4.2 2020-10-02 03:01:20 +02:00
Niklas Hambüchen 3c6ed1a798 Merge pull request #98140 from nh2/ntfy-python3
ntfy: Switch to python3. Also fixes test failure
2020-09-17 16:12:03 +02:00
Niklas Hambüchen 35593698d5 ntfy: Switch to python3. Also fixes test failure.
Fixes test error:

    AttributeError: 'module' object has no attribute 'test_prowl'
2020-09-17 03:17:49 +02:00
Niklas Hambüchen 40ec591132 Merge pull request #97363 from r-ryantm/auto-update/consul
consul: 1.8.0 -> 1.8.3
2020-09-08 02:08:18 +02:00
Niklas Hambüchen 5829744d44 Merge pull request #97084 from bbigras/hotspot
hotspot: 1.2.0 -> 1.3.0
2020-09-04 15:41:40 +02:00
Niklas Hambüchen 0e3c8a95da musl: 1.1.24 -> 1.2.0
The libdrm `musl-ioctl.patch` is no longer necessary, see:
https://github.com/openembedded/openembedded-core/commit/015e631cd18d982df03d4c829c0f8229a2face38
2020-08-16 13:10:50 +00:00
Niklas Hambüchen e2eb3289b0 Merge pull request #94207 from nh2/mesa-musl-fix-Werror-int-conversion-errors
mesa: Fix `-Werror=int-conversion` build error on musl.
2020-08-13 16:13:46 +02:00
Niklas Hambüchen 85d08220d5 mesa: Fix -Werror=int-conversion build error on musl.
Upstream PR I made: https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/6121
2020-08-12 03:40:44 +02:00
Niklas Hambüchen 388076f985 Merge pull request #94205 from nh2/ilmbase-non-glibc-fpstate
openexr, ilmbase: Fix compilation on non-glibc.
2020-08-11 00:39:00 +02:00
Niklas Hambüchen d9393731e6 openexr, ilmbase: Fix compilation on non-glibc.
Tested with musl.

I PRd the patch upstream: https://github.com/AcademySoftwareFoundation/openexr/pull/798
2020-08-02 15:48:37 +02:00
Niklas Hambüchen 5d6aa8b496 Merge pull request #94126 from nh2/fontforge-fix-cmake-rpath
fontforge: Fix uninterpolated `CMAKE_INSTALL_PREFIX` in RPATH.
2020-07-30 15:44:48 +02:00
Niklas Hambüchen c4c812567f fontforge: Fix uninterpolated CMAKE_INSTALL_PREFIX in RPATH.
This was introduced in https://github.com/NixOS/nixpkgs/pull/89583
and fixed upstream with a master-only patch in
https://github.com/fontforge/fontforge/pull/4232.

Found via
https://github.com/nh2/static-haskell-nix/pull/98#issuecomment-665395399.
2020-07-30 01:40:17 +02:00
Niklas Hambüchen 2f3bec7542 Merge pull request #83302 from chpatrick/meshlab-20.03
meshlab: 20190129-beta -> 2020.03
2020-07-21 15:57:47 +02:00
Niklas Hambüchen 45325b1d24 install-grub.pl: Fix GRUB always reinstalling. (#92756)
See https://github.com/NixOS/nixpkgs/pull/92520#issuecomment-655157990.

In #85895 I accidentally introduced a comparison between an array reference
and an array, which can never be true. Fixed by dereferencing.
2020-07-13 02:16:43 +02:00
Niklas Hambüchen e8c1ff9ef8 grub: Fix incorrect upgrade to new jsonStateLine. See #85895. (#92520)
Fixes error

    Can't use an undefined value as an ARRAY reference at /nix/store/...-install-grub.pl line 642, <FILE> line 5.

with `/boot/grub/state` being:

```
grub
2.04
no
/dev/sda
/boot

```

I am not sure where the trailing empty line can come from; the script does not
seem to write it. In any case, now we handle that situation as well.

Further, ensure that `extraGrubInstallArgs` defaults to the empty array
if its key is not present in the `jsonState`.
2020-07-07 00:53:55 +02:00
Niklas Hambüchen 8da4950baf marktext: 0.16.1 -> 0.16.2 2020-07-06 23:00:19 +02:00
Niklas Hambüchen 42a7167120 marktext: 0.16.0-rc.2 -> 0.16.1.
The upgrade apparently made it necessary to also add `XDG_DATA_DIRS`
to fix the crash mentioned in the added comment.

I copied this solution from:
`pkgs/applications/misc/devdocs-desktop/default.nix`
2020-07-06 22:58:58 +02:00
Niklas Hambüchen d676d5d119 Merge pull request #85895 from nh2/extra-grub-install-flags
grub: Add `boot.loader.grub.extraGrubInstallArgs` option
2020-07-06 22:08:31 +02:00
Niklas Hambüchen a90ae331ec install-grub.pl: Add errno messages to all or die errors.
For example, turns the error

    cannot copy /nix/store/g24xsmmsz46hzi6whv7qwwn17myn3jfq-grub-2.04/share/grub/unicode.pf2 to /boot

into the more useful

    cannot copy /nix/store/g24xsmmsz46hzi6whv7qwwn17myn3jfq-grub-2.04/share/grub/unicode.pf2 to /boot: Read-only file system
2020-07-06 22:07:46 +02:00
Niklas Hambüchen 8665b5ab91 grub: Add boot.loader.grub.extraGrubInstallArgs option.
Useful for when you need to build grub modules into your grub kernel
to get a working boot, as shown in the added example.

To store this new value, we switch to more structural JSON approach.

Using one line per value to store in `/boot/grub/state` gets really messy when
the values are arrays, or even worse, can contain newlines (escaping would be
needed). Further, removing a value from the file would get extra messy
(empty lines we'd have to keep for backwards compatibility).

Thus, from now on we use JSON to store all values we'll need in the future.
2020-07-06 22:07:46 +02:00
Niklas Hambüchen 81c15742ce install-grub.pl: Write state file atomically.
Other files were already written atomically, but not this one.
2020-07-06 22:07:46 +02:00