The glibc DNS client side resolver is vulnerable to a stack-based buffer
overflow when the getaddrinfo() library function is used. Software using
this function may be exploited with attacker-controlled domain names,
attacker-controlled DNS servers, or through a man-in-the-middle attack.
https://googleonlinesecurity.blogspot.co.uk/2016/02/cve-2015-7547-glibc-getaddrinfo-stack.html
(cherry picked from commit b5aa8a4e64)
Fixes pinned CA root certificate and probing for system CA bundle.
ClosesNixOS/nixops#354.
I'm using fetchFromGitHub now because it's use of fetchzip is more
stable for autogenerated tarballs from GitHub.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
(cherry picked from commit 1d1cf4845f)
The SO major is going to change in the upcoming update of the Hetzner
rescue system, which will cause NixOps to break because it's statically
using the SO major 0 while the new rescue system will have the major
number 1.
I'm still keeping the udevSoMajor attribute to retain backwards-
compatibility with older NixOps versions.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
(cherry picked from commit 3bf3d19759)
Close#9612, close#10235.
The v0.8 build was broken because the CTAN package updated to v0.9 and
CTAN doesn't keep old versions of packages.
Besides bumping the version, this commit changes the src url from the
unversioned CTAN link (which would break the derivation every time a new
version of the package released, as it did yesterday) to the versioned
Github release link.
(cherry picked from commit 126d8dba96)
Remove patches that no longer apply (integrated upstream I guess), but
forward port the part that adds the missing "include <unistd.h>"[1].
Build and run tested.
[1]: http://sourceforge.net/p/meshlab/bugs/342/
(cherry picked from commit af7d5f27d0)
This option requests compatibility with older NixOS releases with
respect to stateful data, in cases where new releases have defaults
that might be incompatible with system state of existing NixOS
deployments. For instance, if we change the default version of
PostgreSQL, existing deployments will break if the new version can't
read databases created by the old version.
So for example, setting
system.stateVersion = "15.07";
requests that options like services.postgresql.package use defaults
corresponding to the 15.07 release branch. Note that
nixos-generate-config emits this option. (In the future, NixOps may
set system.stateVersion to the NixOS release in use when the machine
was created.)
See also #7939 for another motivating example.
(cherry picked from commit d166c854b6)
For example, this allows writing
nix.package = /nix/store/786mlvhd17xvcp2r4jmmay6jj4wj6b7f-nix-1.10pre4206_896428c;
Also, document types.package in the manual.
(cherry picked from commit 214d4fb73c)
Conflicts:
lib/strings.nix
This reverts commit 0ec3901383.
The checks work fine on master, but here they don't.
I don't see why and I'm not digging deeper. It might be
just some bad character in the checked file in this glibc version.
Now the locales for ISOs build again.
Diff of old/new source trees:
$ diff -uNr /nix/store/h600g290a0h8szjhdfvfn4x7janrhd8n-attic-0.15-src/ attic-0.15-today/
diff -uNr /nix/store/h600g290a0h8szjhdfvfn4x7janrhd8n-attic-0.15-src/attic/_version.py attic-0.15-today/attic/_version.py
--- /nix/store/h600g290a0h8szjhdfvfn4x7janrhd8n-attic-0.15-src/attic/_version.py 1970-01-01 01:00:01.000000000 +0100
+++ attic-0.15-today/attic/_version.py 2015-04-15 21:49:03.000000000 +0200
@@ -10,7 +10,7 @@
# versioneer-0.7+ (https://github.com/warner/python-versioneer)
# these strings will be replaced by git during git-archive
-git_refnames = " (HEAD, tag: 0.15, master)"
+git_refnames = " (tag: 0.15)"
git_full = "e815d6da8e15be8ccd09b7a183bb22bad25cf3e6"
So it looks like dynamic git archives can still bite us. Hopefully this
can be fixed upstream (attic) in the future.
Until now, if e.g. the user passed "en_US.UTF-8" instead of "en_US.UTF-8/UTF-8",
the locales would be generated without failing but wouldn't work well.
Now we guard against such mistakes. Real life examples:
https://github.com/fish-shell/fish-shell/issues/1927
(cherry picked from commit eb4a88d8fd)
The only mirror left which still has the .deb for 44.0.2403.89 is
http://mirror.pcbeta.com/, but that one doesn't seem to be reachable
from certain contries.
And according to @CestDiego, it doesn't seem to be reachable from within
the US.
Closes#9021, thanks to @CestDiego for reporting.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
Reported-by: Diego Berrocal <cestdiego@gmail.com>
Tested-by: Diego Berrocal <cestdiego@gmail.com>
(cherry picked from commit 8d34b4a46a)
Close#8696.
Fixes issues found when jwhois attempts to launch terminal browser
(lynx) for HTTP whois queries, for example:
$ whois blah.io
[Querying http://www.io.io/cgi-bin/whois]
[HTTP: Unable to run web browser: /usr/bin/lynx: No such file or directory]
Tested via:
grep lynx \
/nix/store/bymgmn2vvw1n7nbb1isy87xg94s8f2ml-jwhois-4.0/etc/jwhois.conf \
| cut -f2 -d'"' \
| xargs stat -t
(cherry picked from commit a9e2cf0af3)
nvidia's EGL stack looks for libGLESv2.so.2 at runtime (confirmed by
watching strace), however builder.sh only provides a libGLESv2.so.1
symlink.
@vcunat ported to legacy_340; older ones don't produce GLES.
(cherry picked from commit ebe67d3c85)
Also, in some cases, the result of fetchBower is different depending on the
value of $out. For now, it seems that it works best if using a local output
directory before copying to $out.
Currently there are no tests that depend on the JDK. Since we don't
want a release with a broken JDK, make it an explicit dependency of
the "tested" jobs.
(cherry picked from commit 4c0e44c34c)
Conflicts:
nixos/release-small.nix
Generating the file was refactored to be completely in nix.
Functionally it should create the same content as before,
only adding the newlines.
CC recent updaters: @aszlig, @rickynils.
(cherry picked from commit 72d2d59cd4)
These are just trusted-users and allowed-users in nix.conf. It's
useful to have options for them so that different modules can specify
trusted/allowed users.
(cherry picked from commit 1f3f31b2a8)
Conflicts:
nixos/modules/services/misc/nix-daemon.nix
Upstream renamed their binary. This fix is needed since commit
27e0536fb4 ("Updating minidlna to 1.1.4 (2009→2014)").
On master branch there was a different commit (42a5ad5c5e) that
updated both minidlna package and the NixOS service at the same time, so
this commit is just for the release-14.12 branch.
In general, you don't want a .tar.gz file to be served with
"Content-Encoding: x-gzip", because this causes browsers (like Chrome
or "curl --compressed") to decompress the file on the fly. So you end
up with a .tar rather than .tar.gz file, which is unexpected.
If people want such encodings, they should set them in their own NixOS
configuration.
(cherry picked from commit 9fa19cfcea)
Fixes creating of admin accounts, which is used by NixOps to deploy new
servers. Props to @rbvermaa for reporting the issue and testing it with
NixOps.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
(cherry picked from commit 9b8f66180f)
CC @bjornfor:
Version 6.5.0 has disappeared from Cadsoft's FTP site. This is the
closest version that's still available. Not extensively tested, but
works fine here.
Current version is 7.3.0. I leave that to someone more interested.
(cherry picked from commit 655cda730d)
This solves the problem that modprobe does not know about $MODULE_DIR
when run via sudo, and instead wrongly tries to read /lib/modules/:
$ sudo strace -efile modprobe foo |& grep modules
open("/lib/modules/3.14.37/modules.softdep", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
open("/lib/modules/3.14.37/modules.dep.bin", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
open("/lib/modules/3.14.37/modules.dep.bin", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
open("/lib/modules/3.14.37/modules.alias.bin", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
Without this patch, one would have to use sudo -E (preserves environment
vars). But that option is reserved for sudo users with extra rights
(SETENV), so it's not a solution.
environment.sessionVariables are set by PAM, so they are included in the
environment used by sudo.
(cherry picked from commit 74d5adcb4d)
This patch resolves https://github.com/NixOS/nixpkgs/issues/6395. Deep
cloning is useful in combination with 'leaveDotGit' for builds that want
to run "git describe" to obtain a proper version string, etc., like the
'haskellngPackages.cabal2nix' package does.
(cherry picked from commit 5d02f0e854)
Conflicts:
pkgs/build-support/fetchgit/default.nix
This solves the problem of e.g. mutt not finding mail unless the user
sets MAIL=/var/spool/mail/$USER.
The default MAIL variable seems come from bash. Reasons for adding
symlink instead of changing MAIL default in bash:
- No need to rebuild world
- FHS recommends /var/mail over /var/spool/mail anyway[1]. Better fix
NixOS mail location than change MAIL in bash to something that doesn't
work on non-NixOS (however unlikely that users run nixpkgs bash on a
non-NixOS distro...).
[1] http://www.pathname.com/fhs/pub/fhs-2.3.html#VARMAILUSERMAILBOXFILES
(cherry picked from commit 12e84c6378)
It randomly crashes
Kernel panic - not syncing: assertion "i && sym_get_cam_status(cp->cmd) == DID_SOFT_ERROR" failed: file "/tmp/nix-build-linux-3.14.43.drv-0/linux-3.14.43/drivers/scsi/sym53c8xx_2/sym_hipd.c", line 3399
Rumour has it this is fixed in newer versions of QEMU or the kernel,
so I'm only disabling it on the 14.12 branch.
http://hydra.nixos.org/build/22836392
Producing output makes it hard to restart builds that failed for
intermittent reasons (like timeouts). So let's not do that.
(cherry picked from commit 13dcb35233)
This commit eliminates a patch which hard-coded an example configuration file as the program's default settings and prevented the program from reading a user's configuration file.
(cherry picked from commit 37fb8fb9ca)
Signed-off-by: Domen Kožar <domen@dev.si>
Had to add file type logic in debClosureGenerator because Packages.bz2
is not available for Jessie - only Packages.xz is.
(cherry picked from commit c7ac0ed3eb)
The (dynamically generated) compressed archive has changed. Switch from
fetchurl to fetchzip to not get bitten by that again.
(cherry picked from commit b217d9a4dd)
A buildInput was missing to get the right schemas path.
The symptoms of the issue this fixes are:
** (WebKitWebProcess:): WARNING **: Error retrieving accessibility bus address: org.freedesktop.DBus.Error.ServiceUnknown: The name org.a11y.Bus was not provided by any .service files
(process:): GLib-GIO-ERROR **: Settings schema 'org.gnome.system.proxy' is not installed
(WebKitWebProcess:): GLib-GIO-ERROR **: Settings schema 'org.gnome.system.proxy' is not installed
The man page for ssh-keygen(1) has a section "MODULI GENERATION" that describes
how to generate your own moduli file. The following script might also be helpful:
| #! /usr/bin/env bash
|
| moduliFiles=()
|
| generateModuli()
| {
| ssh-keygen -G "moduli-$1.candidates" -b "$1"
| ssh-keygen -T "moduli-$1" -f "moduli-$1.candidates"
| rm "moduli-$1.candidates"
| }
|
| for (( i=0 ; i <= 16 ; ++i )); do
| let bitSize="2048 + i * 128"
| generateModuli "$bitSize" &
| moduliFiles+=( "moduli-$bitSize" )
| done
| wait
|
| echo >moduli "# Time Type Tests Tries Size Generator Modulus"
| cat >>moduli "${moduliFiles[@]}"
| rm "${moduliFiles[@]}"
Note that generating moduli takes a long time, i.e. several hours on a fast
machine!
This patch resolves https://github.com/NixOS/nixpkgs/pull/5870.
(cherry picked from commit 86d299bc6e)
If a kernel without CONFIG_UEVENT_HELPER set is used with NixOS, the file
/proc/sys/kernel/hotplug does not exist. Before writing to it to disable
this deprecated mechanism, we have to ensure it actually exists because
otherwise the activation script will fail.
(cherry picked from commit 16d25f4fa6)
This service only needs to run once on system startup, so it doesn't
need to be restarted by switch-to-configuration.
(cherry picked from commit 4239e276ea)
Otherwise, simultaneous invocations of /etc/profile can fail, e.g.
mkdir: cannot create directory ‘/.nix-defexpr’: File exists
(cherry picked from commit 11a9774c75)
dropbox: 3.4.4
dropbox-cli: 2015.02.12
This contains the following commits from staging:
29398fd6b1 dropbox[-cli]: update to latest versions
7ed4beec55 Update dropbox[-cli] to latest
75c4f136ca dropbox-cli: make `dropbox start` work
f12536f151 dropbox: use bundled librsync (working)
bd6a15d6d3 dropbox: rm qt.conf
115e8110f7 dropbox: wrap for LD_LIBRARY_PATH (runtime loads)
d36af8e0ae dropbox: don't wrap with Mesa
32643c010e dropbox: update to 3.2.6 (fixed)
52cc26eb3e Revert "Revert "dropbox: update to version 3.2.6""
a9b2dee6e6 Revert "dropbox: update to version 3.2.6"
7c37b4d672 dropbox: update to version 3.2.6
Specifically, this fixes dnsmasq, which failed with
Apr 16 19:00:30 mandark dnsmasq[23819]: dnsmasq: DBus error: Connection ":1.260" is not allowed to own the service "uk.org.thekelleys.dnsmasq" due to security policies in the configuration file
Apr 16 19:00:30 mandark dnsmasq[23819]: DBus error: Connection ":1.260" is not allowed to own the service "uk.org.thekelleys.dnsmasq" due to security policies in the configuration file
after being enabled, due to dbus not being reloaded.
(cherry picked from commit 5a5a43ea25)
This is to ensure that Hydra will build the hardened version of
VirtualBox and it's also lowPrio to avoid being accidentally installed
into a user's environment.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
(cherry picked from commit 142b12c864)
Needed to be able to run 'make serve' in a pelican directory, else this
happens:
$ make serve
cd /home/bfo/pelican-test/output && python -m pelican.server
/run/current-system/sw/bin/python: No module named markupsafe
make: *** [serve] Error 1
(cherry picked from commit 48b5ad912f)
That way sending mail with mutt works on NixOS too, without having to
manually change mutt's config on your system. sendmail will be found in
$PATH at runtime, and thus the setuid wrapper will be used, if
available.
(cherry picked from commit 6e0d0636a1)
From http://www.hping.org/:
"Hping works on the following unix-like systems: Linux, FreeBSD,
NetBSD, OpenBSD, Solaris, MacOs X, Windows."
(cherry picked from commit c1556f70d7)
Release notes: http://slic3r.org/releases/1.2.6
Slic3r needs additional dependency, 'threads'. Add it.
In addition to bug fixes and some new features, this update stops Slic3r
from printing this on startup:
Running Slic3r under Perl >= 5.16 is not supported nor recommended
We don't have perl < 5.16 anymore, so we better update slic3r.
(cherry picked from commit 962690cc18)
Signed-off-by: Domen Kožar <domen@dev.si>
Slic3r dropped this dependency in v1.1.0 and we have v1.2.x.
And more importantly, BoostGeometryUtils is currently broken (fails on
newer Perl versions), so this patch unbreaks Slic3r.
(cherry picked from commit 7273ca19b3)
Many bus clients get hopelessly confused when dbus-daemon is
restarted. So let's not do that.
Of course, this is not ideal either, because we end up stuck with a
possibly outdated dbus-daemon. But that issue will become irrelevant
in the glorious kdbus-based future.
Hopefully this also gets rid of systemd getting stuck after
dbus-daemon is restarted:
Apr 01 15:37:50 mandark systemd[1]: Failed to register match for Disconnected message: Connection timed out
Apr 01 15:37:50 mandark systemd[1]: Looping too fast. Throttling execution a little.
Apr 01 15:37:51 mandark systemd[1]: Looping too fast. Throttling execution a little.
...
(cherry picked from commit 1c39a47ac8)
Since we restart all active target units (of which there are many),
it's hard to see the units that actually matter. So don't print that
we're starting target units that are already active.
(cherry picked from commit 475df1a350)
‘nixos-rebuild dry-activate’ builds the new configuration and then
prints what systemd services would be stopped, restarted etc. if the
configuration were actually activated. This could be extended later to
show other activation actions (like uids being deleted).
To prevent confusion, ‘nixos-rebuild dry-run’ has been renamed to
‘nixos-rebuild dry-build’.
(cherry picked from commit a574065a81)
I don't know what changed, but apparently something did. We're using
fetchzip and the 0.14 tag doesn't seem to have moved (AFAICS).
Build and run-tested.
For reference, the (current) annotated tag '0.14' is dated
"Wed Dec 17 23:32:11 2014 +0100" and points to commit
f342621dff8065b29aeda238ccce5ac92d04f5b6 ("Preparing release").
(cherry picked from commit 2c89d0b82d)
Fixes build against linux 3.14.36+.
Also
* It works with linux 3.12 now, so remove that assert
* Remove unneeded patches (merged upstream)
(cherry picked from commit ff9bc81946)
It produces a package over 4 GB large, and takes several hours to
build (probably because of the overhead of copying that 4 GB image).
(cherry picked from commit 433d30b877)
The default xorgserver is now on 1.16 and so the patch needs to change.
The 116 patch is not in 1.3.1 so we also need to upgrade.
I don't know how to compute this filename since the xorgserver derivation
doesn't have a version attribute.
(cherry picked from commit dc1ea2e968)
Errata: https://github.com/openssl/openssl/blob/OpenSSL_1_0_1-stable/NEWS
Major changes between OpenSSL 1.0.1l and OpenSSL 1.0.1m [19 Mar 2015]
o Segmentation fault in ASN1_TYPE_cmp fix (CVE-2015-0286)
o ASN.1 structure reuse memory corruption fix (CVE-2015-0287)
o PKCS7 NULL pointer dereferences fix (CVE-2015-0289)
o DoS via reachable assert in SSLv2 servers fix (CVE-2015-0293)
o Use After Free following d2i_ECPrivatekey error fix (CVE-2015-0209)
o X509_to_X509_REQ NULL pointer deref fix (CVE-2015-0288)
o Removed the export ciphers from the DEFAULT ciphers
Errata: https://github.com/openssl/openssl/blob/OpenSSL_1_0_1-stable/NEWS
Major changes between OpenSSL 1.0.1l and OpenSSL 1.0.1m [19 Mar 2015]
o Segmentation fault in ASN1_TYPE_cmp fix (CVE-2015-0286)
o ASN.1 structure reuse memory corruption fix (CVE-2015-0287)
o PKCS7 NULL pointer dereferences fix (CVE-2015-0289)
o DoS via reachable assert in SSLv2 servers fix (CVE-2015-0293)
o Use After Free following d2i_ECPrivatekey error fix (CVE-2015-0209)
o X509_to_X509_REQ NULL pointer deref fix (CVE-2015-0288)
o Removed the export ciphers from the DEFAULT ciphers
New maintenance release, changes:
* VMM: emulation fix for the ENTER instruction under certain
conditions; fixes Solaris 10 guests (VT-x without unrestricted guest
execution)
* VMM: fix for handling NMIs on Linux hosts with X2APIC enabled
* NAT/NAT Network: fix connection drops when the host's DHCP lease was
renewed (4.3.22 regression; Windows hosts only)
* NAT: don't crash on an empty domain list when switching the DNS host
configuration (4.3.22 regression; Mac OS X hosts only)
* PXE: re-enable it on Windows hosts (4.3.22 regression; Windows hosts
only)
* Shared Folders: fixed a problem with Windows guests (4.3.22
regression)
* Audio: improved record quality when using the DirectSound audio
backend
* VBoxManage: when executing the controlvm command take care that the
corresponding VM runtime changes are saved permanently
* Windows Installer: properly install the 32-bit version of VBoxRes.dll
on 32-bit hosts
* Linux hosts / guests: Linux 4.0 fixes
* OS/2 Additions: fixed mouse integration (4.3.22 regression)
* X11 Additions: fixed a sporadic failure to deactivate virtual screens
Full changelog with bug IDs can be found at:
https://www.virtualbox.org/wiki/Changelog
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
(cherry picked from commit 54a8e13f2a)
* Don't "externalize url/rev/sha256 to permit easier override".
Just override 'src' itself. Then you can get the source from anywhere,
not just git. I needed to touch this anyway, because I want to use
fetchzip instead of fetchgit for releases (no need to clone repo).
* Latest release has "make install" improvements, simplifying our
install.
(cherry picked from commit c47a3b0663)
If the host is shutting down, machinectl may fail because it's
bus-activated and D-Bus will be shutting down. So just send a signal
to the leader process directly.
Fixes#6212.
(cherry picked from commit 307064ceb5)
Instead, figure out VERSION at build-time. This simplifies using
overrideDerivation (no need to copy and modify installPhase).
Also add a check that the file exists (catch potential failure early).
(cherry picked from commit fc966aead0)
Conflicts:
pkgs/development/tools/build-managers/gradle/default.nix
I find octave quite unusable, without its help pages. Recently it started to
require gnuplot to generate them (even the text-only).
I also enabled parallel building. A comment from 2012 said about spurious
failures if it were enabled, but I don't know if these happen again. Let's
enable it to see.
This reverts commit 84bd62da0a.
The reason I'm reverting this is that the implications this had on the
IO load of Hydra are fixed by ba0f957d7b.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
Since Chromium version 42, we have a new user namespaces sandbox in the
upstream project. It's more integrated so the chrome://sandbox page
reports it as "Namespace Sandbox" instead of SUID sandbox, which we were
re-using (or abusing?) in our patch.
So if either "SUID Sandbox" or "Namespace Sandbox" reports with "Yes",
it's fine on our side.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
(cherry picked from commit 9de4caddc1)
So far we've done the source code split up by using the generic
unpackPhase and copying it all over into the different outputs.
However, this had the problem of generating the I/O load of about three
times the size of the source tree: First at fetchurl of the tarball
(although it's not as much because it's compressed), second at
unpackPhase and third at installPhase.
Now we don't use installPhase anymore and directly unpack into the
output paths, which unfortunately becomes quite a bit more complex
because we need to transform the paths of the tar file on the fly.
I've also tried using GNU Tar's --to-command option to even untar *and*
patch it at the same time, but forking for every single file in the
tarball gets REALLY slow and also gets even more complex than this two
stage approach because you need to make sure that the patch file is
applied correctly, for example for files that don't yet exist but are to
be created by the patch file.
We're using --anchored and --no-wildcards-match-slash here to prevent
accidentally excluding files we don't want to exclude. One example is
something like v8/tools/gyp/v8.gyp.
So the current approach is some compromise between complexity and speed
and should hopefully get rid of the Hydra build timeouts by lowering I/O
load.
See here for examples of builds having this issue:
http://hydra.nixos.org/build/19045023http://hydra.nixos.org/build/19044973http://hydra.nixos.org/build/19044968http://hydra.nixos.org/build/19045019
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
(cherry picked from commit c92dbffeac)
Overview of the updated versions:
stable: 40.0.2214.91 -> 40.0.2214.115
beta: 41.0.2272.16 -> 41.0.2272.64
dev: 41.0.2272.16 -> 42.0.2305.3
Introduces 42.0.2305.3 as the new dev version, which no longer requires
our user namespaces sandbox patch. Thanks to everyone participating in
https://crbug.com/312380 for finally having this upstream.
In the course of supporting the official namespace sandbox (that's what
the user namespace sandbox is called), a few things needed to be fixed
for version 42:
* Add an updated nix_plugin_paths.patch, because the old
one tries to patch the path for libpdf, which is now natively included
in Chromium.
* Don't copy libpdf.so to libexec path for version 42, it's no longer
needed as it's completely built-in now.
* Disable SUID sandbox directly in the source instead of going the easy
route of passing --disable-setuid-sandbox. The reason is that with
the command line flag a nasty nagbar will appear.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
(cherry picked from commit 0aad4b7ee4)
- Things didn't work very well before, as libs were only dlopened and
not found. Fixes#5716.
- Newer releases need autotools to build (and git), leading to some bloat.
- Also, more things are installed by default, increasing the output size.
(cherry picked from commit f9c59ca168)
(A Scheme subset for Atmel microcontrollers.)
Use of the actual git HEAD because the actual tarball compiles but
segfault at runtime.
Upload the BLINK.ms sample on arduino board (/dev/ttyACM0):
```sh
$ sudo ./result/bin/microscheme -m UNO -d /dev/ttyACM0 -auc ~/repo/perso/microscheme/examples/BLINK.ms
Microscheme 0.8, (C) Ryan Suchocki
>> Treeshaker: After 4 rounds: 84 globals purged! 22 bytes will be
reserved.
>> 18 lines compiled OK
>> Assembling...
>> Uploading...
avrdude: AVR device initialized and ready to accept instructions
Reading | ################################################## | 100%
0.00s
avrdude: Device signature = 0x1e950f
avrdude: reading input file
"/home/tony/repo/perso/microscheme/examples/BLINK.hex"
avrdude: writing flash (2080 bytes):
Writing | ################################################## | 100%
0.35s
avrdude: 2080 bytes of flash written
avrdude: safemode: Fuses OK (E:00, H:00, L:00)
avrdude done. Thank you.
>> Cleaning Up...
>> Finished.
```
(cherry picked from commit 172d78923b)
There is no "standard" location for the certificate bundle, so many
programs/libraries have various hard-coded default locations that
don't exist on NixOS. To make these more likely to work, provide
some symlinks.
(cherry picked from commit d180a67b4223b35a39defff115723719190e6362)
Found via RedHat bug 1174792. It was not clear whether these address a
NULL dereference and a division by zero.
(Cherry-picked from cf11e285997d7c06e546987212a7a2c69f9e08d7.)
This test sometimes fails with
Kernel panic - not syncing: assertion "i && sym_get_cam_status(cp->cmd) == DID_SOFT_ERROR" failed: file "/tmp/nix-build-linux-3.14.32.drv-0/linux-3.14.32/drivers/scsi/sym53c8xx_2/sym_hipd.c", line 3399
after "sd 2:0:0:0: ABORT operation timed-out."
Since we don't care all that much about GRUB 1 anymore, don't make the
release depend on it.
http://hydra.nixos.org/build/19563197
(cherry picked from commit 1907ca8a2a)
Some modules wouldn't load crc32c dependency due to module renaming.
(cherry picked from commit 57f2d329ac)
Conflicts (simple):
pkgs/top-level/all-packages.nix
- use mach for building (the way Mozilla devs use),
- use --disable-debug-symbols to reduce build-time resource consumption
(cherry picked from commit 07966befee)
[Now without the "stdenv.glibc" reference, which is unavailable on
darwin. It seems the dynamic linker finds libc/libm without it being
explicitly in RPATH, so we can just drop it.]
This commit adds the graphical Arduino IDE, built from the arduino-core
expression.
Also:
- Add libusb to RPATH for avrdude. Without this, avrdude is broken.
Possible TODO: replace bundled avrdude with the one from nixpkgs.
- Use "cp -r ./build/linux/work/*", so example sketeches, the HTML
reference documentation and the 'arduino' shell script that starts the
IDE gets included.
- Make meta.description slightly more generic, to cover both GUI/core
variants.
(cherry picked from commit e10704335a)
Fixes#6193.
Disabling docs generation might be another alternative
to the build-time dependency blowup.
(cherry picked from commit 346c8d7a98)
Conflicts (simple):
pkgs/tools/X11/xdg-utils/default.nix
This commit adds the graphical Arduino IDE, built from the arduino-core
expression.
Also:
- Add libusb to RPATH for avrdude. Without this, avrdude is broken.
Possible TODO: replace bundled avrdude with the one from nixpkgs.
- Use "cp -r ./build/linux/work/*", so example sketeches, the HTML
reference documentation and the 'arduino' shell script that starts the
IDE gets included.
- Make meta.description slightly more generic, to cover both GUI/core
variants.
(cherry picked from commit ca982158bf)
The first description is a (incorrect) copy/paste from the 'vsftpd'
module, and the second option lacks a 'dot' at the end.
(cherry picked from commit ee52a61e3a)
spek is an accoustic spectrum analyzer. It helps analyse your audio
files by showing their spectrogram.
http://spek.cc/
(cherry picked from commit b26a6e8a23)
This prevents nix-env collisions with other packages like Hipchat due
to private copies of libQtWebKit.so.4 and other libraries.
(cherry picked from commit 3ea88fec96)
Conflicts:
pkgs/applications/audio/spotify/default.nix
We're propagating the plugin flags by importing from another Nix
expression file, which in turn exports the Nix path to the wrapper. This
causes that the store path isn't referenced in the wrapper and the path
isn't recognized by scanning the wrapper script (only those already
referenced at build time are).
So let's add the activated plugins to the buildInputs of the wrapper.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
(cherry picked from commit 9343f6f461)
Chromium is quite memory hungry and we frequently get random crashes in
the tests, so let's set it to 1024 MB because new releases of Chromium
most probably won't consume *less* memory.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
(cherry picked from commit eae32fb798)
This brings a new stable version 40.0.2214.91 along with a beta update
to version 41.0.2272.16, the dev channel is still stuck at version
41.0.2272.12 and within the next days will jump to version 42.
For this reason, I've done some cheating here and brought the beta
channel in par with the dev channel, because dev is older than beta on
OmahaProxy.
Here's an overview of the channel upgrades:
stable: 39.0.2171.65 -> 40.0.2214.91 [1]
beta: 40.0.2214.10 -> 41.0.2272.16 [1] [2] [3]
dev: 41.0.2224.3 -> 41.0.2272.16 [1] [2] [3]
[1]: We needed to patch in locations of lib{pci,udev}.so, because
Chromium tries to load them at runtime. For version 41 startup will
fail if it is unable to load libudev, but it also has the advantage
that this fixes GPU detection using libpci in the stable version,
which in turn could fix a few bugs on NixOS.
[2]: The upstream Debian package for the binary plugins now uses XZ
compression for the enclosed data tarball.
[3]: Chromium 41 needs {shapshot,natives}_blob.bin in order to start up,
so let's cp it among with the .pak files to avoid adding a
conditional for version 40.
The release annoucement of the stable channel update can be found here:
http://googlechromereleases.blogspot.de/2015/01/stable-update.html
Note that this release contains 62 security fixes(!) and I'm hereby
apologizing for the delay of this update.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
(cherry picked from commit ced5afc38c even
though it's a major version upgrade, it simply has too many security
updates to even *think* about trying to backport them)
I think this has been accidentally dropped by a099ca4, at least there is
no reason stated, why it shouldn't be included, so I'm bringing it back.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
(cherry picked from commit 6308cba3fa)
The renaming of options define the original value for the new attribute
path. This works well if there is only *one* target, but if there are
more, we end up recursing into the attribute set of the option
definition itself.
We now check for that within the parent recursion node (we can't check
that from the subnode, because we lack that information about whether
it's defined multiple times) and if the subnode consist entirely of a
list of definitions, we use mkMerge on it.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
(cherry picked from commit 127c928c23)
Writing the gid_map is already non-fatal, but the actual sandbox process
still tries to setresgid() to nogroup (usually 65534). This however
fails, because if user namespace sandboxing is present, the namespace
doesn't have CAP_SETGID at this point.
Fortunately, the effective GID is already 65534, so we just need to
check whether the target gid matches and only(!) setresgid() if it
doesn't.
So if someone would run a SUID version of the sandbox, it would still
work nonetheless without a negative impact on security.
Fixes#5730, thanks to @wizeman for reporting and initial debugging.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
(cherry picked from commit 536feffc68)
Even though we build from git tag 3.5.403, `ardour --version` reports
3.5-380-g2f6065b. Fix it.
(Another way to fix this is to clone the whole git repo, preserve the
.git/ directory and add git as buildInput so that Ardour can figure out
all this version info stuff by itself.)
(cherry picked from commit 0e3007ec88)
Instead, run things out of $PATH.
Fixes errors like these (on NixOS):
munin-available-plugins/.mysql_slowqueries-wrapped: line 67: /usr/bin/printf: No such file or directory
(Basically, this unbreaks some plugins.)
(cherry picked from commit 412cb5a3a2)
Systemd-nspawn creates /root with 755 permission if it doesn't exist,
which is bad. So we have to create it ourselves before calling
systemd-nspawn.
(cherry picked from commit 3ca275d7ba)
Now that dbus reload has been moved before restarting units,
the reload may fail if dbus has been stopped before.
The reload-or-restart will reload dbus if it's active,
otherwise start it.
Doesn't build with LUA 5.2, so lets explicitly set LUA 5.1 as a
dependency.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
(cherry picked from commit c5354fafce)
The following vulnerabilities have been fixed.
- wnpa-sec-2015-01
The WCCP dissector could crash. (Bug 10720, Bug 10806) CVE-2015-0559,
CVE-2015-0560
- wnpa-sec-2015-02
The LPP dissector could crash. (Bug 10773) CVE-2015-0561
- wnpa-sec-2015-03
The DEC DNA Routing Protocol dissector could crash. (Bug 10724) CVE-2015-0562
- wnpa-sec-2015-04
The SMTP dissector could crash. (Bug 10823) CVE-2015-0563
- wnpa-sec-2015-05
Wireshark could crash while decypting TLS/SSL sessions. Discovered by Noam
Rathaus. CVE-2015-0564
See more at https://www.wireshark.org/docs/relnotes/wireshark-1.12.3.html
(cherry picked from commit 7a1e652130)
This is more of an attempt rather than a real fix (or maybe it is? let's
see) for the corrupted .pyc files during build. I believe the reason we
get these are likely due to several instances of the Python interpreter
that run in parallel and one of these processes might still be writing
the .pyc file.
So, rather than deleting all .pyc files, we now precompile then in order
to avoid any build process trying to generate any .pyc file.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
(cherry picked from commit 597373bbd5)
Without this one cannot mount the backup repository:
$ attic mount /backups/backup.attic mnt
attic: the "llfuse" module is required to use this feature
attic: Exiting with failure status due to previous errors
(cherry picked from commit ca9d370f56)
attic is a deduplication backup program.
This commit is a cherry-pick + squash of the following commits from the
master branch:
1a79e7ffdc attic: fetchurl -> fetchzip
bee4a4e5dc attic: fix sha256
ec5e916f6f attic: add maintainer and platforms
1fde0738ca attic: fix missing modules at runtime
4a0aff5f3b attic: upgrade to 0.14
a8af7f16ce attic: expression cleanup
110333abd3 attic: fix path to OPENSSL headers.
6dc9ea2a2c Package attic-backup.org
Without this, hardware that requires firmware (e.g. Saleae Logic) is
unuseable.
Example error that this fixes:
sr: ezusb: Unable to open firmware file /nix/store/rqgppsz3gwy8jailflf3049fzyzrgkdb-libsigrok-0.3.0/share/sigrok-firmware/fx2lafw-saleae-logic.fw for reading: No such file or directory
sr: fx2lafw: Firmware upload failed for device 0.
(cherry picked from commit e4dd2dcad4)
This makes the Eclipse internal web browser work.
The internal web browser is the default browser, and Eclipse requires
manual configuration for any other (external) web browser. To me this
means the internal browser should be working by default, unless users
will get an error popup if they click any links.
This change increases the closure size from 714 to 880 MiB
(attribute eclipses.eclipse_cpp_43).
(cherry picked from commit f364e3f8e8)
It doesn't work anymore. And anyway, this probably shouldn't have been
a package in the first place (it's just some gdb options).
(cherry picked from commit 4a63787b78)
During install, the bootloader script gets run inside a chroot after the
/etc/group bind-mount is unmounted. Since we're not doing any building,
this should be safe, but really nix should just not care if the group
does not exist when no build is needed.
Fixes#5494
(cherry picked from commit 9245516b46)
Signed-off-by: Domen Kožar <domen@dev.si>
Since the 4.2.8 upgrade, ntpd is broken on NixOS:
Dec 28 19:06:54 hagbard ntpd[27723]: giving up resolving host 1.nixos.pool.ntp.org: Servname not supported for ai_socktype (-8)
This appears to be because DNS resolution doesn't work in chroots
anymore (due to /etc being missing). So disable chroots for now. It's
probably better to use systemd's containment facilities anyway.
(cherry picked from commit ea9d391bb5)
http://support.ntp.org/bin/view/Main/SecurityNotice#Recent_Vulnerabilities
The package would no longer build without libcrypto,
and it wouldn't find it without pkgconfig.
I checked that Debian and Arch do use openssl as a dependency,
so it's probably not so bad a thing to have.
CC maintainer @edolstra.
(cherry picked from commit 0fbc5ddadb)
Foomatic filters contained a 64-char c string hardcoded to /bin/bash.
This caused some filters (at least pdftops) to fail.
I also had to increase the size of the string because nix paths are too
long.
(cherry picked from commit 6a2195c3a5)
Signed-off-by: Domen Kožar <domen@dev.si>
IMHO, having a short timeout (1h) defeats the point of using
ssh-agent, which is not to have to retype passphrases all the time. Of
course, users who want timeouts can set programs.ssh.agentTimeout.
This restores the 14.04 behaviour.
(cherry picked from commit 63c14e259d)
Name has been changed in c9282c65f4.
Users would probably expect "nix-env -i picard" to work, and as picard
isn't a library it doesn't make sense to set a prefix.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
(cherry picked from commit 718666204a)
Especially if the user isn't in the vboxusers group anymore, this gets
VERY noisy, because the VBoxSVC process emits warnings for every single
USB device noting that it's only possible to access it when the user is
in the vboxusers group.
So, we now have a debug attribute, where we can enable it when
necessary.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
(cherry picked from commit d45649b415)
At least when we're running in hardening mode, because it's needed there
only for USB support.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
(cherry picked from commit ef691d5c30)
Because we have to rely on setuid wrappers on NixOS, we can't easily
hardcode the executable paths and set it 4755. So for all calls, we need
to change the runtime path executable directory to /var/setuid-wrappers/
and for verification we need to retain the executable directory.
Also note, that usually VBoxNetAdpCtl, VBoxNetDHCP, VBoxNetNAT, VBoxSDL
and VBoxVolInfo don't reside in directories that are commonly in PATH,
but in /usr/lib/virtualbox in most mainstream distros. But because the
names of these executables are distinctive enough to not cause
collisions with other setuid programs, I'll leave it like that and not
patch up setuid-wrappers.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
(cherry picked from commit ac603e208c)
Not really changes anything in functionality, but makes it easier to
change the build type to "debug", for example.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
(cherry picked from commit b69ac6c159)
Just accidentally found this while debugging and it's needed for
fetching a few interface details, not sure however whether because of
this anything has been broken so far.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
(cherry picked from commit 14ef3446e1)
Instead of coping it to $out and later deleting it, we now exclude the
src directory during copy. Also, we no longer cd into the release
directory during installPhase, which should make sure that we are
constantly in $sourceRoot.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
(cherry picked from commit 5a8c5d2768)
TEST needed. I tested on my NixOS Thinkpad with Optimus nvidia and intel
cards. Testing in other architectures is needed.
This patch also improves the regular expressions that scan the build
configuration files to enable the building of a binary utility in
xf86-video-intel: intel-virtual-output. This utility is useful for some
Optimus laptops
DRI3 was added to xorg-server propagatedBuildInputs so now it's inherited
by several projects that can use it.
(cherry picked from commit 06e6d7def2)
The "nix-store" command within the VM test is running without
NIX_REMOTE=daemon and since Nix 1.8 tries to open the store database in
read-write mode even for nix-store -qR.
Now, we're doing this properly and rely on setup hooks, which is the
same method that's used when you're building a library which depends on
blivet.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
(cherry picked from commit 2af435b5cd)
/run/opengl-drivers should contain only libGL-related libraries, not
stuff like udev. Injecting anything into LD_LIBRARY_PATH is dangerous
because it can break applications that expect a different version of
the library.
Caused by eef9a8ac2a. Fixes#5371.
(cherry picked from commit d34c600414)
This is useful for adding extra functionality or defaults to _every_
nixos evaluation.
My use case is overriding behaviour for all nixos tests, for example
setting packageOverrides to newer versions and changing some default
dependencies/settings.
By making this accessible through an environment variable, this can now
be fully accomplished externally. No more need to fork
nixos/nixpkgs (which becomes a maintenance burden), just use the channel
instead and plug in via this envvar.
(cherry picked from commit 73f18fd42f)
These use bannertops, which no longer exists. And they conflicted with
the working banners in cups-filters.
(cherry picked from commit ffdabf02b9)
Signed-off-by: Domen Kožar <domen@dev.si>
It was trying to find "gs" via execve, so use execvpe instead. It's
probably better to use gs's absolute path, but maybe not every
cups-filters user needs it.
(cherry picked from commit fb079432b0)
Signed-off-by: Domen Kožar <domen@dev.si>
It was looking in cups' prefix for the PDF templates. So for instance
printing a CUPS test page wouldn't work.
(cherry picked from commit 0aa452e179)
Signed-off-by: Domen Kožar <domen@dev.si>
Fixes this error, as seen when trying to open a guest VM when
virt-viewer is accessed over ssh with X forwarding:
GLib-GIO-ERROR **: Settings schema 'org.gnome.system.proxy' is not installed
A similar issue was fixed for virt-manager in commit
fb8a2b3be7 ("virt-manager: fix missing
schema error")
(cherry picked from commit a2bb84a936)
We divert to the $out/share/virtualbox directory only if we have
hardening enabled, so let's put the extension pack into
$out/libexec/virtualbox instead if we're compiling without hardening.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
(cherry picked from commit eb561f0798)
The warning was displayed whenever services.virtualboxHost.enable was
true, but if people were to enable hardening, they'd still get that
annoying message.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
(cherry picked from commit e36bec661c)
* Add missing dependency on 'spice_protocol'
* Fix new build error which came now that ./configure enables SPICE support:
building virt-viewer
CCLD virt-viewer
/nix/store/b8qhjrwf8sf9ggkjxqqav7f1m6w83bh0-binutils-2.23.1/bin/ld: cannot find -lgdbm
/nix/store/b8qhjrwf8sf9ggkjxqqav7f1m6w83bh0-binutils-2.23.1/bin/ld: cannot find -lcap
collect2: error: ld returned 1 exit status
Fix by adding gddbm and libcap as inputs. Yes, libcap is needed
_in addition_ to libcap_ng (I tested removing libcap_ng, it failed).
Without this change, virt-viewer cannot be used with guests machines
that uses SPICE.
(cherry picked from commit 477bc03568)
This also makes showvminfo obsolete, as we get the same information from
the hosts log.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
(cherry picked from commit 8bbf1dc80e)
Creates unnecessary cruft in the root users home directory, which we
really don't need. Except the log, but therefore we now cat the log to
stderr and the private temporary directory is cleaned up afterwards.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
(cherry picked from commit d85fabd68c)
This should display a big fat warning that people can hardly miss until
we have fixed the issues with the host-only-interfaces that persist when
hardining is enabled.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
(cherry picked from commit 5d67b17901)
Essentially adds two more VirtualBox VMs to the test and also increases
the memory size of the qemu VM to 768 MB to make sure we don't run out
of memory too soon.
We're testing whether those two VMs can talk to either each other
(currently via ICMP only) or to/from the host via TCP/IP.
Also, this restructures the VM test a bit, so that we now pass in a
custom stage2Init script that has access to the store via a private
mount over the /nix/store that's already in the initrd. The reason why
this is a private mount is that we don't want to shadow the Nix store of
the initrd, essentially breaking cleanup functionality after the custom
stage 2 script (currently this is only "poweroff -f").
Note that setting the hostname inside the VirtualBox VM is *not* for
additional fanciness but to produce a different store path for the VM
image, so that VirtualBox doesn't bail out when trying to use an image
which is already attached to another VM.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
(cherry picked from commit 9bf16a9c33)
Yes, this is only on the package level, so it's possible to use
VirtualBox for example installed by nix-env -i, which of course doesn't
have access to the functionality provided by the various VirtualBox
kernel modules.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
(cherry picked from commit a199eedfce)
Hardening mode in VirtualBox is quite restrictive and on some systems it
could make sense to disable hardening mode, especially while we still
have issues with hostonly networking and other issues[TM] we don't know
or haven't tested yet.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
(cherry picked from commit e03e0ff42a)
We're going to create more than one VirtualBox VM, so let's dynamically
generate subs specific to a particular VirtualBox VM, merging everything
into the testScript and machine expressions.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
(cherry picked from commit 77831e8467)
Currently it pretty much tests starting up virtual machines and just
shutting down afterwards, but for both VBoxManage and the VirtualBox
GUI.
This helps catching errors in hardened mode, however we still need to
test whether networking works the way intended (and I fear that this is
broken at the moment).
The VirtualBox VM is _not_ using hardware virtualization support (thus
we use system = "i686-linux", because x86_64 has no emulation support),
because we're already within a qemu VM, which means it's going to be
slow as hell (that's why I've written own subs just for testing
startup/shutdown/whatnot with respective timeouts).
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
(cherry picked from commit 69858d7743)
Before we do substitutions, the Exec= line is (currently)
"Exec=libreofficedev4.3 --some-arg". Our substitution logic doesn't handle
that, resulting in broken "Exec=$out/bin/sofficedev4.3 --some-arg"
($out/bin/sofficedev4.3 doesn't exist).
Looking at libreoffice source, the .desktop files refer to a UNIXBASISROOTNAME
variable which come from instsetoo_native/util/openoffice.lst.in. Currently, it
can have one of two values, presumably depending on whether the build is
"normal" or "development":
libreoffice${major}.${minor}
libreofficedev${major}.${minor}
Handle both these cases, and also leave the old non-versioned substitution
around, just in case.
Fixes issue #3463.
(cherry picked from commit 64661f0597)
Problems are worked around by using older gcc wrapper for gnat bootstrap.
(from ca441636f1^)
I tried nicer solutions first, but I was unable to fix all problems for hours.
(cherry picked from commit 1a0a161920)
Small typo prevented the post resume script to restart network manager
(cherry picked from commit aba0d8a73d)
Signed-off-by: Domen Kožar <domen@dev.si>
I couldn't find any source that looked reliable, but I guess it's better
than nothing: it's fairly simple patch that fixes the build.
(cherry picked from commit 274a9419c1)
It turns out that installing therubytracer, with dependency on old v8, even
when using source libv8 version is problematic.
(see
http://stackoverflow.com/questions/21666379/problems-installing-gitlab-on-odroid-v8-lib-not-available).
But wait, rails does not even need therubytracer, just any kind of javascript
server side execution framework like nodejs. Well just use that, as also
suggested from different internet sources (look link above), it works just
fine.
We only need to have setuid-root wrappers for VBox{Headless,SDL} and
VirtualBox, otherwise VBoxManage will run as root and NOT drop
privileges!
Fixes#5283.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
(cherry picked from commit 0d71ec8a6e)
I had to make several adjustments to make it work with nixos:
* Replace relative config file lookups with ENV variable.
* Modify gitlab-shell to not clear then environment when running
pre-receive.
* Modify gitlab-shell to write some environment variables into
the .authorized_keys file to make sure gitlab-shell reads the
correct config file.
* Log unicorn output to syslog.
I tried various ways of adding a syslog package but the bundler would
not pick them up. Please fix in a better way if possible.
* Gitlab-runner program wrapper.
This is useful to run e.g. backups etc. with the correct
environment set up.
The current nixos module for VirtualBox unconditionally configures a vboxnet0
network interface at boot. This may be undesired, especially when the user wants
to manage network interfaces in a centralized manner.
(cherry picked from commit 9fa2c35ec8)
Signed-off-by: Domen Kožar <domen@dev.si>
Since we're using HTTPS for the binary cache (introduced in faf0797) by
default, the binary cache should also be available during installation.
The file that is defined in SSL_CERT_FILE outside of the chroot is
copied over to /tmp/ca-cert.crt inside the chroot, so we have an
absolute path we can reference during nixos-install. However, this might
end up with the file not being cleaned up properly from outside of the
store, but neither would be /tmp/root so the cleanup issue needs to be
solved in another place (or commit to be more exact).
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
(cherry picked from commit cf7f15c92c)
Signed-off-by: Domen Kožar <domen@dev.si>
This is work around #5270.
Also bogus path in wrapper got fixed.
CC: maintainers @phreedom, @thoughtpolice.
It would be better to test this as well by someone who actually uses it.
(cherry picked from commit 62e5e2a880)
Using propagatedBuildInputs only works for environment.systemPackages
but not for using nix-env, because on NixOS we already have a default
QT_PLUGIN_PATH set there.
The main reason why I'm using the VLC backend and not providing options
for other Phonon backends is because it's recommended upstream and also
will be directly used (via libvlc) in the upcoming 0.9 release.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
Fixes a few annoying bugs (in my case it's the painting issue that's
most annoying):
* Show error message if saving tags failed.
* Fixed painting issue on search page.
* (OS X & Windows) Fixed crash during collection scan.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
* Drop unneeded patch to fix build error; now included upstream
* Fetch tarball instead of using git
* Drop unneeded autotools deps since we're building from tarball
TODO: Package boost-test library, so that we can run the test suite.
(cherry picked from commit 3871539d3b)
2014-12-08 22:54:44 +01:00
687 changed files with 151152 additions and 11081 deletions
# Set the max octets of the messages written to the log
defmax_octets=(max_octets)
@max_octets=max_octets
end
# Sets the minimum level for messages to be written in the log.
# +level+:: one of <tt>Logger::DEBUG</tt>, <tt>Logger::INFO</tt>, <tt>Logger::WARN</tt>, <tt>Logger::ERROR</tt>, <tt>Logger::FATAL</tt>, <tt>Logger::UNKNOWN</tt>
Some files were not shown because too many files have changed in this diff
Show More
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
