This adds an abstraction/hack to update the latest hardened kernel
independent of linux_latest, which is required as the hardened patches
aren't immediately available ([0] currently doesn't exist).
Currently the Linux hardened patches aren't even available for 5.7 which
was released on 2020-05-31 (already 9 days ago!).
Therefore it is required to keep both linuxPackages_latest_hardened and
linuxPackages_latest_xen_dom0_hardened at 5.6 until the patches for 5.7
are released.
This abstraction makes that task more manageable but we should aim for a
better solution to resolve this or at least a cleaner and more robust
implementation (in the sense of better error messages).
[0]: https://github.com/anthraxx/linux-hardened/releases/tag/5.7.1.a
Changes:
- Copied linux-5.7.nix from linux-5.6.nix
- Add linux_5_7 and linuxPackages_5_7
- Update linux_latest to 5.7
Note:
The kernel patch 'kernelPatches.export_kernel_fpu_functions."5.3"' is
still applied as I copied the list from linux_5_7 (vs. linux_testing).
This patch is probably still required for the ZFS performance.
This fixes a regression from 993baa587c which requires
networking.hostName to be a valid DNS label [0].
Unfortunately we missed the fact that the hostnames may also be empty,
if the user wants to obtain it from a DHCP server. This is even required
by a few modules/images (e.g. Amazon EC2, Azure, and Google Compute).
[0]: https://github.com/NixOS/nixpkgs/pull/76542#issuecomment-638138666
This fixes the output of "hostname --fqdn" (previously the domain name
was not appended). Additionally it's now possible to use the FQDN.
This works by unconditionally adding two entries to /etc/hosts:
127.0.0.1 localhost
::1 localhost
These are the first two entries and therefore gethostbyaddr() will
always resolve "127.0.0.1" and "::1" back to "localhost" [0].
This works because nscd (or rather the nss-files module) returns the
first matching row from /etc/hosts (and ignores the rest).
The FQDN and hostname entries are appended later to /etc/hosts, e.g.:
127.0.0.2 nixos-unstable.test.tld nixos-unstable
::1 nixos-unstable.test.tld nixos-unstable
Note: We use 127.0.0.2 here to follow nss-myhostname (systemd) as close
as possible. This has the advantage that 127.0.0.2 can be resolved back
to the FQDN but also the drawback that applications that only listen to
127.0.0.1 (and not additionally ::1) cannot be reached via the FQDN.
If you would like this to work you can use the following configuration:
```nix
networking.hosts."127.0.0.1" = [
"${config.networking.hostName}.${config.networking.domain}"
config.networking.hostName
];
```
Therefore gethostbyname() resolves "nixos-unstable" to the FQDN
(canonical name): "nixos-unstable.test.tld".
Advantages over the previous behaviour:
- The FQDN will now also be resolved correctly (the entry was missing).
- E.g. the command "hostname --fqdn" will now work as expected.
Drawbacks:
- Overrides entries form the DNS (an issue if e.g. $FQDN should resolve
to the public IP address instead of 127.0.0.1)
- Note: This was already partly an issue as there's an entry for
$HOSTNAME (without the domain part) that resolves to
127.0.1.1 (!= 127.0.0.1).
- Unknown (could potentially cause other unexpected issues, but special
care was taken).
[0]: Some applications do apparently depend on this behaviour (see
c578924) and this is typically the expected behaviour.
Co-authored-by: Florian Klink <flokli@flokli.de>
This will install the HTML and text documentation into a separate output
so that users can install it without having to rebuild Git.
Previously only `doc/git/git-subtree.html` was installed (which is now
in $doc as well).
The current output sizes are as follows:
```
$ du -sh $(nix-build -A git)
47M /nix/store/wyqgalp61kmavx06rams7z8jz177nd8y-git-2.26.2
$ du -sh $(nix-build -A git.doc)
14M /nix/store/6zi22fl5xc3sg23d9shsviinvwk89wvq-git-2.26.2-doc
```
Fixes#86022 (at least partly since the output has to be installed).
Regarding microsoft_gsl: The CMake scripts from Telegram-Desktop did not
find it anymore (I didn't investigate this) and Arch already made this
change during the last update. It's probably best to do the same here
especially since Telegram-Desktop is currently based on GSL 3.0.1 while
our version is still at 2.1.0.
This is useful for use-cases like this (logging to journald):
```
programs.sway.extraSessionCommands = ''
if [ -z "$_SWAY_DID_SYSTEMD_CAT" ]; then
export _SWAY_DID_SYSTEMD_CAT=1
exec ${config.systemd.package}/bin/systemd-cat -t sway "$0" "$@"
fi
# ... (potentially also another exec)
'';
```
Without this change the rest of the extraSessionCommands won't be
executed after the exec since the whole extraSessionCommands block would
be skipped during the re-execution (_SWAY_WRAPPER_ALREADY_EXECUTED is
already set).
The syntax is ${parameter:-word} (i.e. previously this used
"latestTag" instead of the actual value).
(Fixes a regression from #85278.)
Also: Even though getting the latest tag isn't really security critical
(as long as Git itself is secure against untrusted input), I'd prefer to
switch from the Git to the HTTPS protocol (for authentication of the
server and encryption + uses a standard port).
Michael Weiss