stable 51.0.2704.63 => 51.0.2704.103
beta 51.0.2704.63 => 52.0.2743.41
dev 52.0.2743.10 => 53.0.2767.4
This addresses 15 security fixes, including:
* High CVE-2015-1696: Cross-origin bypass in Extension bindings. Credit to
anonymous.
* High CVE-2015-1697: Cross-origin bypass in Blink. Credit to Mariusz
Mlynski.
* Medium CVE-2016-1698: Information leak in Extension bindings. Credit to
Rob Wu.
* Medium CVE-2016-1699: Parameter sanitization failure in DevTools. Credit
to Gregory Panakkal.
* Medium CVE-2016-1700: Use-after-free in Extensions. Credit to Rob Wu.
* Medium CVE-2016-1701: Use-after-free in Autofill. Credit to Rob Wu.
* Medium CVE-2016-1702: Out-of-bounds read in Skia. Credit to cloudfuzzer.
See: http://googlechromereleases.blogspot.com/2016/06/stable-channel-update.html
(cherry picked from commit 1f1f0f049b)
Reason: 18 Security fixes for the stable channel.
This is the original pull request plus some commits from me to bring all
channels to the latest versions, because the fixed security
vulnerabilites might not be fixed in the dev version we had before.
I've tested the whole changeset on my Hydra at:
https://headcounter.org/hydra/eval/322006
Thanks to @srp for the initial commit and thus implicitly also for the
security notice.
Cc: @abbradar
(backported from commit b5f95a5303)
Reason: Lots of security fixes (see e2d067d)
Overview of the updated versions:
beta: 50.0.2661.49 -> 51.0.2704.47
dev: 51.0.2693.2 -> 52.0.2729.3
It has been a while since we had a major Chromium update that compiled
and worked without troubles, but version 52 builds and the VM tests are
successful as well:
https://headcounter.org/hydra/eval/320335
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
(cherry picked from commit ad2c8d3510)
Reason: 50.0.2661.102 fixes a bunch of security vulnerabilities and
we want to have them fixed in beta/dev as well.
This addresses the following security fixes:
* High CVE-2016-1667: Same origin bypass in DOM. Credit to
Mariusz Mlynski.
* High CVE-2016-1668: Same origin bypass in Blink V8 bindings. Credit
to Mariusz Mlynski.
* High CVE-2016-1669: Buffer overflow in V8. Credit to Choongwoo Han.
* Medium CVE-2016-1670: Race condition in loader. Credit to anonymous.
* Medium CVE-2016-1671: Directory traversal using the file scheme on
Android. Credit to Jann Horn.
See: http://googlechromereleases.blogspot.com/2016/05/stable-channel-update.html
Signed-off-by: Scott R. Parish <srparish@gmail.com>
Tested-by: aszlig <aszlig@redmoonstudios.org>
Closes: #15446
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
(cherry picked from commit 5ebf20db0f)
Release announcement, 2016-01-30:
https://www.sigrok.org/blog/major-sigrok-releases-libsigrok-libsigrokdecode-sigrok-cli-pulseview
I first tried updating the projects in separate commits. But later I
found cyclic dependencies, that would break git bisect, so I ended up
squashing the commits:
* libsigrok: 0.3.0 -> 0.4.0
Enable building libsigrokcxx.so, the C++ bindings for libsigrok, by
adding doxygen, glibmm and python as build deps. This is needed for
Pulseview >= 0.3.0. Also update the firmware (sigrok-firmware-fx2lafw)
while at it.
* libsigrokdecode: 0.3.0 -> 0.4.0
* sigrok-cli: 0.5.0 -> 0.6.0
* pulseview: 0.2.0 -> 0.3.0
New dependency: glibmm (due to libsigrokcxx.pc from libsigrok).
Note that collectd is incompatible with the new libsigrok release, so
I let it use the old one (0.3.0).
(cherry picked from commit 300e495101)
The current URL is broken, upstream has moved the download from .../files/ to
.../files_legacy/. But after fixing that, starting hashcat results in:
$ ./result/bin/hashcat
ERROR: this copy of hashcat is outdated. Get a more recent version.
So just update to latest.
New releases are on github, the license is now MIT and there are build
system changes.
(cherry picked from commit 800042b310)
I've built this a lot of times on different machines without getting
compile errors, so I'd assume this to be safe. Of course, the compile
time is very small in comparison to bigger packages but it's still an
annoyance to wait for up to a few minutes, especially during
development.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
(cherry picked from commit 37429a2c74)
So far it was only possible to run john if you've either copied over the
default configuration over to ~/.john and substitute $JOHN with the
right path or set $JOHN to the store path directly.
Both methods are not really a very good user experience, so we're now
patching in the resulting paths into the default rules/configurations.
This also splits off configuration files into $out/etc/john instead of
putting everything into $out/share/john and now also properly installs
the auxiliary programs into $out/bin.
Closes#8792.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
Reported-by: devhell <"^"@regexmail.net>
Cc: @offlinehacker
(cherry picked from commit 902bcf1422)
It prevents john from running with older CPUs such as Core2Duo and gives
an illegal hardware instruction error on these CPUs.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
(cherry picked from commit cf4e2c426e)
Cleanups are mostly stylistic, like putting src more to the top (to make
sure it won't be missed on updates of the version attribute) or using
mkdir -p instead of ensureDir.
The most significant change here is that we update the package to
1.8.0-jumbo-1, which is the latest tag available and contains community
updates which were already in magnumripper/JohnTheRipper@93f061bc41.
We're now also using fetchurl to ensure that we don't need to clone the
whole repository and keep download times low.
And the derivation name is now "john" instead of "JohnTheRipper",
because most users would expect "nix-env -i john" to work.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
(cherry picked from commit 2a1bf2a776)
Merges pull request #15275:
This addresses #15226 and fixes killing of processes before
switching from the initrd to the real root.
Right now, the pkill that is issued not only kills user space
processes but also sends a SIGKILL to kernel threads as well.
Usually these threads ignore signals, but some of these processes do
handle signals, like for example the md module, which happened in
#15226.
It also adds a small check for the swraid installer test and a
standalone test which checks on just that problem, so in the future
this shouldn't happen again.
This has been acked by @edolstra on IRC.
The reason I'm merging this to 15.09 is that this branch fixes#15226
and thus also fixes mdraid setups out there.
Tested using the boot-stage1.nix NixOS test against release-15.09.
As @edolstra pointed out that the kernel module might be painful to
maintain. I strongly disagree because it's only a small module and it's
good to have such a canary in the tests no matter how the bootup process
looks like, so I'm going the masochistic route and try to maintain it.
If it *really* becomes too much maintenance burden, we can still drop or
disable kcanary.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
We don't want to push out a channel update whenever this test fails,
because that might have unexpected and confused side effects and it
*really* means that stage 1 of our boot up is broken.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
We already have a small regression test for #15226 within the swraid
installer test. Unfortunately, we only check there whether the md
kthread got signalled but not whether other rampaging processes are
still alive that *should* have been killed.
So in order to do this we provide multiple canary processes which are
checked after the system has booted up:
* canary1: It's a simple forking daemon which just sleeps until it's
going to be killed. Of course we expect this process to not
be alive anymore after boot up.
* canary2: Similar to canary1, but tries to mimick a kthread to make
sure that it's going to be properly killed at the end of
stage 1.
* canary3: Like canary2, but this time using a @ in front of its
command name to actually prevent it from being killed.
* kcanary: This one is a real kthread and it runs until killed, which
shouldn't be the case.
Tested with and without 67223ee and everything works as expected, at
least on my machine.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
This is a regression test for #15226, so that the test will fail once we
accidentally kill one or more of the md kthreads (aka: if safe mode is
enabled).
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
Unfortunately, pkill doesn't distinguish between kernel and user space
processes, so we need to make sure we don't accidentally kill kernel
threads.
Normally, a kernel thread ignores all signals, but there are a few that
do. A quick grep on the kernel source tree (as of kernel 4.6.0) shows
the following source files which use allow_signal():
drivers/isdn/mISDN/l1oip_core.c
drivers/md/md.c
drivers/misc/mic/cosm/cosm_scif_server.c
drivers/misc/mic/cosm_client/cosm_scif_client.c
drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
drivers/staging/rtl8188eu/core/rtw_cmd.c
drivers/staging/rtl8712/rtl8712_cmd.c
drivers/target/iscsi/iscsi_target.c
drivers/target/iscsi/iscsi_target_login.c
drivers/target/iscsi/iscsi_target_nego.c
drivers/usb/atm/usbatm.c
drivers/usb/gadget/function/f_mass_storage.c
fs/jffs2/background.c
fs/lockd/clntlock.c
fs/lockd/svc.c
fs/nfs/nfs4state.c
fs/nfsd/nfssvc.c
While not all of these are necessarily kthreads and some functionality
may still be unimpeded, it's still quite harmful and can cause
unexpected side-effects, especially because some of these kthreads are
storage-related (which we obviously don't want to kill during bootup).
During discussion at #15226, @dezgeg suggested the following
implementation:
for pid in $(pgrep -v -f '@'); do
if [ "$(cat /proc/$pid/cmdline)" != "" ]; then
kill -9 "$pid"
fi
done
This has a few downsides:
* User space processes which use an empty string in their command line
won't be killed.
* It results in errors during bootup because some shell-related
processes are already terminated (maybe it's pgrep itself, haven't
checked).
* The @ is searched within the full command line, not just at the
beginning of the string. Of course, we already had this until now, so
it's not a problem of his implementation.
I posted an alternative implementation which doesn't suffer from the
first point, but even that one wasn't sufficient:
for pid in $(pgrep -v -f '^@'); do
readlink "/proc/$pid/exe" &> /dev/null || continue
echo "$pid"
done | xargs kill -9
This one spawns a subshell, which would be included in the processes to
kill and actually kills itself during the process.
So what we have now is even checking whether the shell process itself is
in the list to kill and avoids killing it just to be sure.
Also, we don't spawn a subshell anymore and use /proc/$pid/exe to
distinguish between user space and kernel processes like in the comments
of the following StackOverflow answer:
http://stackoverflow.com/a/12231039
We don't need to take care of terminating processes, because what we
actually want IS to terminate the processes.
The only point where this (and any previous) approach falls short if we
have processes that act like fork bombs, because they might spawn
additional processes between the pgrep and the killing. We can only
address this with process/control groups and this still won't save us
because the root user can escape from that as well.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
Fixes: #15226
Needed for newer 'cryptography', which is needed to fix build against
latest openssl.
Based on 4b23328e39 ("buildPythonPackage: fix more wheels failures").
I think the name 'listenAddress' is more descriptive. Other NixOS
modules that define 'host' either use it as listen address or as address
a client connects to. listenAddress is unambiguous.
The addition of 'host' was added earlier today[1], so not bothering with
./nixos/modules/rename.nix.
[1]: 44ea184997 ("jenkins ci enhancement: add port and prefix option")
(cherry picked from commit c6b251f5d5)
As named these options enable to specify a bind host and url prefix
to be used by jenkins. Adding these options in the config rather than
using extra arguments allows us to re-use those information in other
services using jenkins such as jenkins-job-builder or a reverse proxy.
(cherry picked from commit 44ea184997)
* Perform HTTP HEAD request instead of full GET (lighter weight)
* Don't log output of curl to the journal (it's noise/debug)
* Use explicit http:// URL scheme
* Reduce poll interval from 10s to 2s (respond to state changes
quicker). Probably not relevant on boot (lots of services compete for
the CPU), but online service restarts/reloads should be quicker.
* Pass --fail to curl (should be more robust against false positives)
* Use 4 space indent for shell code.
(cherry picked from commit 78b6e8c319)
The current postStart code holds Jenkins off the "started" state until
Jenkins becomes idle. But it should be enough to wait until Jenkins
start handling HTTP requests to consider it "started".
More reasons why the current approach is bad and we should remove it,
from @coreyoconnor in
https://github.com/NixOS/nixpkgs/issues/14991#issuecomment-216572571:
1. Repeatedly curling for a specific human-readable string to
determine "Active" is fragile. For instance, what happens when jenkins
is localized?
2. The time jenkins takes to initializes is variable. This (at least
used to) depend on the number of jobs and any plugin upgrades requested.
3. Jenkins can be requested to restart from the UI. Which will not
affect the status of the service. This means that the service being
"active" does not imply jenkins is initialized. Downstream services
cannot assume jenkins is initialized if the service is active. Might
as well accept that and remove the initialized test from service
startup.
Fixes#14991.
(cherry picked from commit 51e5beca42)
* It grew a couple of extra (hard) dependencies:
libxcb, cups, xkeyboardconfig
* It is also available in native 64-bit version (yay!)
(cherry picked from commit c27de52d39)
sqlite on release-15.09 is too old, use bundled sqlite instead to fix this
build issue:
configure:24978: checking for sqlite3 >= 3.9.1
configure: error: Library requirements (sqlite3 >= 3.9.1) not met; [...]
This is the same fix as in commit 969c67f48c
("firefox: Fix build").
The option authzldapauthoritative had been removed in 2.4
I pushed this into 16.03 instead of master first. My fault.
(cherry picked from commit 516f47efef)
(cherry picked from commit e1bcc27f1a)
Overview of the updated versions:
stable: 49.0.2623.87 -> 49.0.2623.110
beta: 50.0.2661.26 -> 50.0.2661.49
dev: 50.0.2661.18 -> 51.0.2693.2
Most notably, this includes a series of urgent security fixes:
* CVE-2016-1646: Out-of-bounds read in V8. Credit to Wen Xu from
Tencent KeenLab.
* CVE-2016-1647: Use-after-free in Navigation. Credit to anonymous.
* CVE-2016-1648: Use-after-free in Extensions. Credit to anonymous.
* CVE-2016-1649: Buffer overflow in libANGLE. Credit to lokihardt
working with HP's Zero Day Initiative / Pwn2Own.
* CVE-2016-1650: Denial of service in PageCaptureSaveAsMHTMLFunction
The official release announcement with details about these fixes can be
found here:
http://googlechromereleases.blogspot.de/2016/03/stable-channel-update_24.html
Beta and stable could be also affected, although I didn't do a detailed
check whether that's the case.
As this introduces Chromium 51 as the dev version, I had to make the
following changes to make it build:
* libexif got removed, so let's do that on our end as well.
See https://codereview.chromium.org/1803883002 for details.
* Chromium doesn't seem to compile with our version of libpng, so let's
resort to the bundled libpng for now.
* site_engagement_ui.cc uses isnan outside of std namespace, so
we're fixing that in postPatch using sed.
I have successfully built all versions on i686-linux and x86_64-linux
and tested it using the VM tests.
Test reports can be found at the following evaluation of my Hydra:
https://headcounter.org/hydra/eval/314584
Thanks to @grahamc for reporting this.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
Reported-by: Graham Christensen <graham@grahamc.com>
Fixes: #14299
(cherry picked from commit ef753d210e)
With jails defaulting to 'enabled = true', the sshd jail that NixOS
defines will now be enabled.
[Bjørn: tweak commit message]
(cherry picked from commit f16594e18b)
As of 6041cfe, the upstream-info.nix (back then it was called
sources.nix) is no longer in the source/ subdirectory, so we need to fix
that comment to say that the file is autogenerated from update.sh in the
*same* directory.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
(cherry picked from commit 5ebd629c6f)
This addresses #12794 so that we now have only a single tarball where we
base our build on instead of splitting the source into different outputs
first and then reference the outputs.
The reason I did this in the first place is that we previously built the
sandbox as a different derivation and unpacking the whole source tree
just for building the sandbox was a bit too much.
As we now have namespaces sandbox built in by default we no longer have
that derivation anymore. It still might come up however if we want to
build NaCl as a separate derivation (see #8560), but splitting the
source code into things only NaCl might require is already too much work
and doesn't weight out the benefits.
Another issue with the source splitup is that Hydra now has an output
limit for non-fixed-output derivations which we're already hitting.
Tested the build against the stable channel and it went well, but I
haven't tested running the browser.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
(cherry picked from commit 4f981b4f84)
We always do something like "fetchurl channelProduct", so let's move it
to getChannel directly so we can avoid those fetchurl calls all over the
place.
Also, we can still access subattributes from the fetchurl call if we
need to, so there really is no need to expose the product's attributes
directly.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
(backported from commit 37dbd62a83)
We're going to refactor things anyway, so let's first get rid of
everything that's not used anymore.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
(cherry picked from commit 985df3900d)
We now should have only the default.nix left in the source directory and
we can start to factor out the pieces into the Chromium main derivation
attributes.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
(backported from commit 6041cfe2af)
The "sources.nix" also contains information about where to get binary
packages, so calling it "upstream-info.nix" fits better in terms of
naming.
Also, we're moving it away from the sources dir, because the latter will
soon vanish.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
(backported from commit 2d9a604907)
We're going to reference the patches in the Chromium main build rather
than applying it to the sources. So as a first step, this should keep
the patches away from the "source" subdirectory so we can make it flat.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
(cherry picked from commit d6b11ed722)
I didn't notice that this was opened against the 15.09 branch, so
merging this was a mistake on my part, sorry.
This reverts commit b997ce6237, reversing
changes made to d8a1eaa142.
This folds adding hydra-build-products into the actual ISO generation,
preventing an unnecessary download of the ISO.
(cherry picked from commit 10293b87a9)
Previously this was done in three derivations (one to build the raw
disk image, one to convert to OVA, one to add a hydra-build-products
file). Now it's done in one step to reduce the amount of copying
to/from S3. In particular, not uploading the raw disk image prevents
us from hitting hydra-queue-runner's size limit of 2 GiB.
(cherry picked from commit 5cc7bcda30)
Overview of the updated versions:
stable: 48.0.2564.116 -> 49.0.2623.75
beta: 49.0.2623.63 -> 49.0.2623.75
dev: 50.0.2657.0 -> 50.0.2661.11
Stable and beta are now in par because of the release of a major stable
update.
The release addresses 26 security vulnerabilities, the following with an
assigned CVE:
* CVE-2016-1630: Same-origin bypass in Blink. Credit to Mariusz
Mlynski.
* CVE-2016-1631: Same-origin bypass in Pepper Plugin. Credit to Mariusz
Mlynski.
* CVE-2016-1632: Bad cast in Extensions. Credit to anonymous.
* CVE-2016-1633: Use-after-free in Blink. Credit to cloudfuzzer.
* CVE-2016-1634: Use-after-free in Blink. Credit to cloudfuzzer.
* CVE-2016-1635: Use-after-free in Blink. Credit to Rob Wu.
* CVE-2016-1636: SRI Validation Bypass. Credit to Ryan Lester and
Bryant Zadegan.
* CVE-2015-8126: Out-of-bounds access in libpng. Credit to
joerg.bornemann.
* CVE-2016-1637: Information Leak in Skia. Credit to Keve Nagy.
* CVE-2016-1638: WebAPI Bypass. Credit to Rob Wu.
* CVE-2016-1639: Use-after-free in WebRTC. Credit to Khalil Zhani.
* CVE-2016-1640: Origin confusion in Extensions UI. Credit to Luan
Herrera.
* CVE-2016-1641: Use-after-free in Favicon. Credit to Atte Kettunen of
OUSPG.
The full announcement which also includes the link to the bug tracker
can be found here:
http://googlechromereleases.blogspot.de/2016/03/stable-channel-update.html
Also, the 32bit Chrome package needed for the Flash and Widevine plugins
doesn't exist anymore, because Google has dropped support for 32bit
distros, see here for the announcement:
https://groups.google.com/a/chromium.org/forum/#!topic/chromium-dev/FoE6sL-p6oU
On our end, we need to fix the patch for the plugin paths to work for
the latest dev channel. The change is very minor, because the
nix_plugin_paths_46.patch only doesn't apply because of an iOS-related
ifdef.
Built and tested on my Hydra at:
https://headcounter.org/hydra/eval/311511
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
Fixes: #13665
(cherry picked from commit 8b97ca270e)
spotify: fix repo format
spotify: fix missing ffmpeg_0_10 dependency, fixes#11877
This makes local playback work.
spotify: 0.9.17.1 -> 1.0.19.106
changes by @globin:
used wrapper instead of propagatedUserEnvPkgs for zenity
closes#12191
Signed-off-by: Robin Gloster <mail@glob.in>
spotify: fix icons
spotify: 1.0.19.106 -> 1.0.23.93
spotify: 1.0.23.93 -> 1.0.25.127
The previous version broke because it required SSLv2 support in OpenSSL:
ImportError: /nix/store/c0z7qlycaa2jhqjq0v9vy3j4nw4layw2-python2.7-m2crypto-0.21.1/lib/python2.7/site-packages/M2Crypto/__m2crypto.so: undefined symbol: SSLv2_method
(cherry picked from commit 49f23a6028)
(cherry picked from commit d2c32179fe)
Necessary because the old version was calling SSLv2_server_method,
which OpenSSL no longer provides by default. Fixes#13605.
As stated in the parent commit, the 32bit Chrome package is not
available upstream, so let's at least provide the SHA256 hash for the
64bit package.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
(cherry picked from commit 716b79d3a5)
This release includes the following changes:
o libssh2_session_set_last_error: Add function
o mac: Add support for HMAC-SHA-256 and HMAC-SHA-512
o WinCNG: support for SHA256/512 HMAC
o kex: Added diffie-hellman-group-exchange-sha256 support
o OS/400 crypto library QC3 support
This release includes the following security advisory:
o diffie_hellman_sha256: convert bytes to bits
CVE-2016-0787: http://www.libssh2.org/adv_20160223.html
This release includes the following bugfixes:
o SFTP: Increase speed and datasize in SFTP read
o openssl: make libssh2_sha1 return error code
o openssl: fix memleak in _libssh2_dsa_sha1_verify()
o cmake: include CMake files in the release tarballs
o Fix builds with Visual Studio 2015
o hostkey.c: Fix compiling error when OPENSSL_NO_MD5 is defined
o GNUmakefile: add support for LIBSSH2_LDFLAG_EXTRAS
o GNUmakefile: add -m64 CFLAGS when targeting mingw64
o kex: free server host key before allocating it (again)
o SCP: add libssh2_scp_recv2 to support large (> 2GB) files on windows
o channel: Detect bad usage of libssh2_channel_process_startup
o userauth: Fix off by one error when reading public key file
o kex: removed dupe entry from libssh2_kex_methods
o _libssh2_error: Support allocating the error message
o hostkey: fix invalid memory access if libssh2_dsa_new fails
o hostkey: align code path of ssh_rsa_init to ssh_dss_init
o libssh2.pc.in: fix the output of pkg-config --libs
o wincng: fixed possible memory leak in _libssh2_wincng_hash
o wincng: fixed _libssh2_wincng_hash_final return value
o add OpenSSL 1.1.0-pre2 compatibility
o agent_disconnect_unix: unset the agent fd after closing it
o sftp: stop reading when buffer is full
o sftp: Send at least one read request before reading
o sftp: Don't return EAGAIN if data was written to buffer
o sftp: Check read packet file offset
o configure: build "silent" if possible
o openssl: add OpenSSL 1.1.0-pre3-dev compatibility
o GNUmakefile: list system libs after user libs
(cherry picked from commit 737e808913)
Security fix. See #13473.
From the debian security mailing list:
Several vulnerabilities have been discovered in the chromium web browser.
CVE-2016-1622
It was discovered that a maliciously crafted extension could bypass
the Same Origin Policy.
CVE-2016-1623
Mariusz Mlynski discovered a way to bypass the Same Origin Policy.
CVE-2016-1624
lukezli discovered a buffer overflow issue in the Brotli library.
CVE-2016-1625
Jann Horn discovered a way to cause the Chrome Instant feature to
navigate to unintended destinations.
CVE-2016-1626
An out-of-bounds read issue was discovered in the openjpeg library.
CVE-2016-1627
It was discovered that the Developer Tools did not validate URLs.
CVE-2016-1628
An out-of-bounds read issue was discovered in the pdfium library.
CVE-2016-1629
A way to bypass the Same Origin Policy was discovered in Blink/WebKit,
along with a way to escape the chromium sandbox.
(cherry picked from commit 712d59225e)
It's supposed to fix CVE-2016-0739: weak secret with diffie-hellman.
(cherry picked from commit 0ee46ddffb)
I'm lazy to isolate a patch for CVE itself, so we're getting the usual
bugfixes as well.
GHCJS uses integer-gmp, but cabal2nix generates a dependency list that
includes integer-simple instead. This tweaks the stage2 generator to
replace any instance of integer-simple with integer-gmp.
Things currently still work without this change (assuming
integer-simple is defined as null), as ghcjs includes integer-gmp in
its stage1 packages - so it's always available.
However, this change makes things a bit more explicit, rather than
leaving things to chance. If at any point the stage1 packages are also
split up into separate derivations, the integer-gmp package will need to
be passed along to the packages that depend on it. This change should
prevent some confusion going forward.
(cherry picked from commit 516057ffa9)
Previously, we were compiling Setup.hs with ghcjs (instead of ghc),
and that required that Cabal be available, otherwise the Setup.hs would
fail to compile.
Now that we are compiling Setup.hs with ghc, it's no longer necessary
to add Cabal as a dependency to all ghcjs packages.
(cherry picked from commit e6e9970891)
The glibc DNS client side resolver is vulnerable to a stack-based buffer
overflow when the getaddrinfo() library function is used. Software using
this function may be exploited with attacker-controlled domain names,
attacker-controlled DNS servers, or through a man-in-the-middle attack.
https://googleonlinesecurity.blogspot.co.uk/2016/02/cve-2015-7547-glibc-getaddrinfo-stack.html
(cherry picked from commit b5aa8a4e64)
with the last commit for logstash plugin the bin path was not being used and the executables
were written directly in the root directory
this results in the failure of the logstash service configuration.
additionally the logstash tool itself does not start because it cannot source shell libraries relative
to the current location
This update was generated by hackage2nix v20151217-10-ga610b1b using the following inputs:
- Nixpkgs: 45176e62ca
- Hackage: 4eb7681703
- LTS Haskell: e7c3629999
- Stackage Nightly: a84b3a147a
Some of the original URLs were broken now.
It seems that set of mirrors is preferred and faster than the others.
In the x264 case the source isn't there so http://download.videolan.org
is used instead.
(cherry picked from commit 1e04d875db)
This is a regression introduced by merging the EBS and S3 images. The
EBS images had a special marker /.ebs to prevent the initrd from using
ephemeral storage for the unionfs, but this marker was missing in the
consolidated image.
The fix is to check the file ami-manifest-path on the metadata server
to see if we're an S3-based instance. This does require networking in
the initrd.
Issue #12613.
(cherry picked from commit 06731dfcae)
Generally we shouldn't ship pre-release versions anyway, and we
certainly don't want them to be release blockers. Also, chromium
builds are just too slow to have them blocking the channel (see
https://github.com/NixOS/nixpkgs/issues/12794).
(cherry picked from commit 69ec09f38a)
Bugfix release, mainly for Carddav regression over EWS, also includes an NTLM support enhancement.
Enhancement:
- Improve NTLM support try to send hostname as workstation name instead of UNKNOWN
- Fix notification dialog message
- Prepare ExchangeSessionFactory refactoring
- Fix typo in french translation
- Fix broken Sourceforge link in About dialog
Carddav:
- Carddav: fix regression on contact update with empty field triggering DeleteItemField
- Fixes CVE-2016-1612 CVE-2016-1613 CVE-2016-1614 CVE-2016-1615
CVE-2016-1616 CVE-2016-1617 CVE-2016-1618 CVE-2016-1619 CVE-2016-1620.
- Moves chromium stable and beta channels up one version major.
vcunat made dev channel stay for now, as it wouldn't download otherwise.
This is most of PR #12717.
(cherry picked from commit 8491d0d1ca)
They are security updates. I briefly tested the default version against 15.09.
Having both *-wrapper and *-full attribute names is rather confusing
(what's the difference?). And further, both packages are named
gnuradio-with-packages:
$ nix-env -f. -qaP ".*gnuradio.*"
gnuradio gnuradio-3.7.7.1
gnuradio-osmosdr gnuradio-osmosdr-0.1.4
gnuradio-full gnuradio-with-packages-3.7.7.1
gnuradio-wrapper gnuradio-with-packages-3.7.7.1
Get rid of *-wrapper and rename *-full to *-with-packages, to align it
with the package name.
Now:
$ nix-env -f. -qaP ".*gnuradio.*"
gnuradio gnuradio-3.7.7.1
gnuradio-osmosdr gnuradio-osmosdr-0.1.4
gnuradio-with-packages gnuradio-with-packages-3.7.7.1
And you can customize the *-with-packages variant like this:
gnuradio-with-packages.override { extraPackages = [...]; }
(cherry picked from commit e9ad37e231)
FOR STABLE BRANCH: I added backward compatibility aliases.
ladspa.org has been down for a feew weeks, and I couldn't find info on a
cause or a solution.
Closes#12640.
Signed-off-by: Franz Pletz <fpletz@fnordicwalking.de>
(cherry picked from commit ee9d7f09ea)
Keep old attrnames too, for backward compatibility.
`nix-env -f . -qaP -A eclipses` only prints the new attributes (yay!).
(cherry picked from commit d5c9db8dd3)
This ensures that xfce and most others DMs are preferred over
xterm. Previously slim used directory order, which is undefined.
Of course, it's just lucky that xfce < xterm lexicographically, but
that also applies to the other display managers, AFAIK. We should have
a way to specify a DM order, but that can be accomodated by generating
desktop entries like "<NN>-session.desktop".
Fixes#4300. Parenthetical to #12516.
(cherry picked from commit eeb9231009)
Building config.system.build.isoImage would fail with the following
error using the channel:
ln: failed to create symbolic link
'/nix/store/zz0hzi5imrg4927v6f8mv281qs6v6pbq-nixos-16.03pre69762.e916273/nixos/nixpkgs/.': File exists
The fix skips symlink as it already exists if the channel
nixpkgs copy is used.
Fixes#10367
(cherry picked from commit 75284b09e1 by
falsifian)
This has been introduced by me in 690a845 and discovered by @vcunat in
his comment over at:
690a845de9 (commitcomment-14209868)
It's really a bit ugly to have builds running during evaluation, but
back when I made that commit the reason was to avoid having to shell
quote the hell out of it (see the comment in mkPluginInfo for the
reason).
Now we propagate plugin flags and environment variables as a list of
arguments in a plain file that's appended verbatim to makeWrapper, so
it shouldn't do any builds anymore during instantiation.
I have tested this with both just WideVine and just Flash enabled as
well as both in combination and none of the plugins and the output seems
correct. However I didn't test to run Chromium with the new
implementation.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
Reported-by: Vladimír Čunát <vcunat@gmail.com>
(cherry picked from commit 38c77bb72c)
When a new version of colordiff is released the old tarball is moved to
the archive directory. This breaks builds until the derivation is
updated to the new version. This commit lets fetchurl know about the
archive URL.
Unfortunately the `readFile`/`writeText` functions forces realisation of
the eclipse package at evaluation time. By creating the configuration
file inside the build command we avoid realisation until installation.
(cherry picked from commit 40890b2b95)
Pull request #12508. Fixes ATI unfree drivers; I cannot test this myself, but
reportedly they don't work at all now (#11817), so this can't make things worse.
- Removed a collision in the nix store
- Removed dependency on qt
- Fixed opengl and direct rendering by correcting some link paths
- Some code refactored in builder.sh
- Comments added/modified
This pull request fixes#11740 and I recommend that it be considered
as a hotfix for the stable channel due to the fact that opengl
and direct rendering are broken there too.
(cherry picked from commit 722c616b8f)
Without less, we get:
```
2016-01-22 10:31:59,098 - MainThread - awscli.help - DEBUG - Running command: ['groff', '-man', '-T', 'ascii']
2016-01-22 10:31:59,109 - MainThread - awscli.help - DEBUG - Running command: ['less', '-R']
2016-01-22 10:31:59,111 - MainThread - awscli.clidriver - DEBUG - Exception caught in main()
Traceback (most recent call last):
File "/nix/store/jmgflkyf1yfz6an82pvhq084mp1j0bjn-awscli-1.7.41/lib/python2.7/site-packages/awscli/clidriver.py", line 183, in main
return command_table[parsed_args.command](remaining, parsed_args)
File "/nix/store/jmgflkyf1yfz6an82pvhq084mp1j0bjn-awscli-1.7.41/lib/python2.7/site-packages/awscli/help.py", line 245, in __call__
self.renderer.render(self.doc.getvalue())
File "/nix/store/jmgflkyf1yfz6an82pvhq084mp1j0bjn-awscli-1.7.41/lib/python2.7/site-packages/awscli/help.py", line 81, in render
self._send_output_to_pager(converted_content)
File "/nix/store/jmgflkyf1yfz6an82pvhq084mp1j0bjn-awscli-1.7.41/lib/python2.7/site-packages/awscli/help.py", line 86, in _send_output_to_pager
p = self._popen(cmdline, stdin=PIPE)
File "/nix/store/jmgflkyf1yfz6an82pvhq084mp1j0bjn-awscli-1.7.41/lib/python2.7/site-packages/awscli/help.py", line 90, in _popen
return Popen(*args, **kwargs)
File "/nix/store/6a1x9r9wywa27v9gvp0yqgq0mmkfa3ww-python-2.7.11/lib/python2.7/subprocess.py", line 710, in __init__
errread, errwrite)
File "/nix/store/6a1x9r9wywa27v9gvp0yqgq0mmkfa3ww-python-2.7.11/lib/python2.7/subprocess.py", line 1335, in _execute_child
raise child_exception
OSError: [Errno 2] No such file or directory
2016-01-22 10:31:59,112 - MainThread - awscli.clidriver - DEBUG - Exiting with rc 255
[Errno 2] No such file or directory
```
Import less along with groff
Fixes#12549.
(cherry picked from commit 4a6602c3cd)
New versions of GHC allow us to specify those things on the
command-line, so the build.mk file is no longer necessary.
(cherry picked from commit 878692e645)
The new GHC version contains a patch [1] that passes linker and compiler flags
to GCC via response files rather than directly on the command-line. This is
supposed to be beneficial on Windows and other platforms that have trouble
dealing with long argument lists. On NixOS, however, this feature breaks the
flag handling provided by gcc-wrapper [2] and therefore causes the entire GHC
build to fail.
This issue has been reported upstream at [3]. It's not clear yet how to remedy
this problem, but until we've figured that out we just don't pass compiler flags
in response files on NixOS to fix https://github.com/NixOS/nixpkgs/issues/10752.
[1] 296bc70b5f
[2] https://github.com/NixOS/nixpkgs/issues/11762
[3] https://ghc.haskell.org/trac/ghc/ticket/11147
(cherry picked from commit a421e7bd4a)
grsecurity still holds a reference to it,
but I prefer it to fail than to use a version
that is most likely not secure anymore.
(cherry picked from commit 4824f73cb3)
It should be possible to build binaries without data and then compose by
a wrapper, e.g. similarly to what simutrans does.
(cherry picked from commit c860e27ef2)
Built and run Beta and Stable locally. Dev is surrently superseded by Stable so
it doesn't matter much.
- Dev: 47.0.2508.0 -> 48.0.2564.22
- Beta: 46.0.2490.64 -> 48.0.2564.23
- Stable: 45.0.2454.101 -> 47.0.2526.73
Changed the SSL dependencies to the supported configuration on Linux (according
to Torne @Freenode/#chromium-support).
- NSS is a dependency since it is used to access the ceritiface store.
- Dropped system OpenSSL support, the bundled BoringSSL is used.
This probably fixes issue #10555. Note that without this adjustment the build
fails even.
Dropped uneeded old patches.
(cherry picked from commit b9093f1c64)
Some previous updates were skipped, which resulted into trivial conflicts.
For instance, a binary like libfoo.so will cause a symlink
lib/debug/libfoo.so.debug -> .build-id/<build-ID>.debug to be
created. This is primarily useful for use with eu-addr2line, if you
know the name of a binary and the relative address, but not the build
ID.
(cherry picked from commit 2fcee55e5f)
This addresses CVE-2015-8618 (a vulnerability in math/big)
This issue can affect RSA computations in crypto/rsa, which is used by
crypto/tls. TLS servers on 32-bit systems could plausibly leak their RSA
private key due to this issue. Other protocol implementations that
create many RSA signatures could also be impacted in the same way.
https://groups.google.com/forum/#!topic/golang-dev/MEATuOi_ei4
Backported to 15.09 from 174221b744
Silly ./configure, it looks for dbus file from gnome-shell in the
installation tree of the package it is configuring. Fix by copying the
needed file from gnome-shell before ./configure is run.
This change makes gnome-shell a build time dependency (not runtime).
(cherry picked from commit 3d81213509)
This hopefully fixes intermittent initrd failures where udevd cannot
create a Unix domain socket:
machine# running udev...
machine# error getting socket: Address family not supported by protocol
machine# error initializing udev control socket
machine# error getting socket: Address family not supported by protocol
The "unix" kernel module is supposed to be loaded automatically, and
clearly that works most of the time, but maybe there is a race
somewhere. In any case, no sane person would run a kernel without Unix
domain sockets, so we may as well make it builtin.
http://hydra.nixos.org/build/30001448
(cherry picked from commit e4b4e9b986)
(cherry picked from commit 9a82dd87f7)
Reason: Importing devices from /dev/disk/by-id can prevent certain bugs
that lead to ZFS pool corruption, as mentioned in #11668.
That said, although this adds the option to import from /dev/disk/by-id,
I'm not yet changing the default import path in the stable channel
because possibly some block devices may not show up in /dev/disk/by-id,
causing a perfectly-working system to become unbootable. It's probably
safer to battle test the new default path in the unstable channel
instead, and let it become part of the stable channel as part of the
next NixOS release.
Previously this barfed with:
updating GRUB 2 menu...
fileparse(): need a valid pathname at /nix/store/zldbbngl0f8g5iv4rslygxwp0dbg1624-install-grub.pl line 391.
warning: error(s) occured while switching to the new configuration
(cherry picked from commit 1ba2015450)
This hopefully fixes intermittent test failures like
http://hydra.nixos.org/build/29962437
router# [ 240.128835] INFO: task mke2fs:99 blocked for more than 120 seconds.
router# [ 240.130135] Not tainted 3.18.25 #1-NixOS
router# [ 240.131110] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
assuming that these are caused by high load on the host.
(cherry picked from commit 6d02d7e740)
... because we make it built-in by default.
I can't imagine anyone who wanted to purge this module from his/her system,
so let's keep it simple, at least for now.
(cherry picked from commit 0e1fe66aad)
This change should "only" get rid of an annoying error in logs.
Currently the package is built with /var in $out/var. That fails when it
tries to create/write things at runtime (nix store is read-only).
Instead, tell it to use /var (global directory) and fixup the
installation phase so it doesn't touch /var (leave that for runtime).
This unbreaks the colord dbus service, which apparently is needed by
cups to create color profiles for printers.
(cherry picked from commit 9cdf17e822)
Adding this package to environment.systemPackages stops the
"Add new printer" button in gnome-control-center from being grayed out
and stops it from printing:
(gnome-control-center:16664): printers-cc-panel-WARNING **: Your system does not have the cups-pk-helper's policy "org.opensuse.cupspkhelper.mechanism.all-edit" installed. Please check your installation
But completing the printer setup requires some additional packaging
work. This is what happens when trying to _add_ a printer:
(gnome-control-center:18733): printers-cc-panel-WARNING **: GDBus.Error:org.freedesktop.DBus.Error.ServiceUnknown: The name org.fedoraproject.Config.Printing was not provided by any .service files
(gnome-control-center:18733): printers-cc-panel-WARNING **: GDBus.Error:org.freedesktop.DBus.Error.ServiceUnknown: The name org.freedesktop.PackageKit was not provided by any .service files
(cherry picked from commit 92a0140ff8)
Communication happens on Github so names should be consistent.
(cherry picked from commit 2b6dcdfcd0)
Best be consistent with active release branches as well.
Unfortunately, yesterday Nix got reverted to a version with broken
passAsFile implementation on some Hydra machines, so we have corrupted
files again. (E.g. http://hydra.nixos.org/build/29777678.) Forcing
another gratuitous rebuild to get rid of them.
vcunat refactored a bit (too long line, etc.) and reordered the URLs.
(cherry picked from commit bc6e050f21)
This will be useful mainly here on older branches.
We seem to be in an unfortunate situation: booting without 'nomodeset'
causes hangs when booting on some NVIDIA cards (6948c3ab80), but on the
other hand adding 'nomodeset' prevents X from starting on other hardware
(e.g. issue #10381 and my Thinkpad X250 with an integrated Broadwell GPU).
Attempt to remedy this situation a bit by adding a separate entry in the
ISOLINUX menu (with the non-'nomodeset' being the default).
(cherry picked from commit 269f261c73)
Previously the gems defaulted to "ruby" as the name and
"${ruby-version}-${gem-name}-${gem-version}" as the version,
which was just insane.
https://github.com/NixOS/nixpkgs/issues/9771#issuecomment-141041414
Noone is reacting so it's high time to take at least some action.
/cc @cstrahan.
(cherry picked from commit fdf3aa9923)
The renaming seems rather unlikely to break anything,
and it seems very useful (to some people at least).
Fixes the following libgdata build error:
```
CCLD gdata/libgdata.la
/nix/store/5kdjp8200hazaydx0dmwn5qghqkyi3py-binutils-2.23.1/bin/ld: cannot find -lssl3
/nix/store/5kdjp8200hazaydx0dmwn5qghqkyi3py-binutils-2.23.1/bin/ld: cannot find -lsmime3
/nix/store/5kdjp8200hazaydx0dmwn5qghqkyi3py-binutils-2.23.1/bin/ld: cannot find -lnss3
/nix/store/5kdjp8200hazaydx0dmwn5qghqkyi3py-binutils-2.23.1/bin/ld: cannot find -lnssutil3
collect2: error: ld returned 1 exit status
```
(cherry picked from commit 996a0a9abf)
It stopped building even here on 15.09, perhaps after `nss` update.
The 'gitAndTools.gitAnnex' attribute referred to a minimal build of git-annex
that lacked advanced features, like the Assistant. This commit switches the
attribute to the full version.
Fixes https://github.com/NixOS/nixpkgs/issues/11708.
Tarballs.nixos.org is now stored in an S3 bucket rather than an EBS
volume. Redirects are used to simulate symlinks.
The function find-tarballs.nix now filters out fetchzip, fetchpatch
and the like.
(cherry picked from commit 567e002545)
Otherwise, if the upstream mirror changes (rather than deletes) a
file, then tarballs.nixos.org won't be used even if it has a copy of
the original file, and so we'll get a hash mismatch.
(cherry picked from commit bb672805cd)
The list we had before contained a lot of junk, i.e. sites that were no
longer online or no longer in sync. The new list of sites comes from
https://gnupg.org/download/index.html.
(cherry picked from commit 65f3932f6e)
Upgrade message: http://sourceforge.net/p/davmail/mailman/message/34597887/
This new release contains a lot of fixes from user feedback, a new
-notray command line
option to force window mode and avoid tricky tray icon issues on Linux
and native
smartcard support on Windows.
Caldav:
- Caldav: Map additional priority levels
- Caldav: fix missing LAST-MODIFIED in events
Enhancements:
- Improved tray icon with alpha blend
- Fix imports
- Prepare mutual SSL authentication between client and DavMail
implementation
- Implement -notray command line option as a workaround for broken SWT
and Unity issues
- Change warning messages to debug in close method
- Improve client certificate dialog, build description from certificate
- Exclude client certificates not issued by server provided issuers list
IMAP:
- IMAP: Additional translations and doc for new IMAP setting
- IMAP: Merge patch by Mauro Cicognini, add a new setting to always send
approximate message in RFC822.SIZE to avoid downloading full message body
- IMAP: fix regression with quotes inside folder names
- IMAP: handle quotes inside folder names correctly
OSX:
- OSX link local address on loopback interface
- Exclude arguments starting with dash to avoid patch 38 regression on OSX
Documentation:
- Doc: Document -notray option
- Switch to OpenHub instead of Ohloh
EWS:
- EWS: prepare distribution list implementation
- Fix#254 davmail.exchange.ews.EWSException:
ErrorIncorrectUpdatePropertyCount
Linux:
- Refresh davmail.spec, make RPM noarch
- Handle missing or broken SWT library
Windows:
- Windows: Make MSCAPI keystore type available in Settings for Windows
native smartcard support
- Instantiate MSCAPI explicitly to access Windows Smartcards
- Enable native Windows SmartCard access through MSCAPI (no PKCS11
config required)
Carddav:
- Carddav: Test case for comma in ADR field
- Carddav: Do not replace comma on ADR field, see support request 255
- Caldav: Ignore missing END:VCALENDAR line on modified occurrences
- CardDav: Add empty property test case
These functions used to live in pkgs/development/haskell-modules/default.nix,
but they are generic, really, and should be easily accessible to everyone.
(cherry picked from commit 405fda497a)
The R people don't bother providing stable URLs for their package
releases. Released versions are edited or flat-out disappear at will,
which causes us a bit of trouble, like in [1]. Hopefully, enabling R
builds on Hydra will mitigate those problems by caching the release
tarballs.
[1] https://github.com/NixOS/nixpkgs/issues/11230
This update was generated by hackage2nix v20150922-36-ge0ee7ef using the following inputs:
- Nixpkgs: 29fff27a55
- Hackage: fccc42cccb
- LTS Haskell: 1ae555e197
- Stackage Nightly: ec7b421c66
When building with Qt 5.4 this is not a problem, but with Qt 5.5 (tested
locally), it is clear that this dependency is missing:
$ ./result/bin/qtcreator
file:///nix/store/zmpf6ydrjdydd85wh6splpywv6aj4782-qtcreator-3.4.2/share/qtcreator/welcomescreen/welcomescreen.qml:31:1:
module "QtQuick" is not installed
import QtQuick 2.1
^
With Qt 5.4 something else is pulling in the qtdeclarative dependency,
it can be seen in the qtcreator wrapper script.
Note to self: "import QtQuick" != qtquickcontrols. QtQuick is
apparently located in the qtdeclarative module.
(cherry picked from commit ff4d8513b4)
Without this, configure will say:
Checking for openal... no
/tmp/nix-build-qtmultimedia-5.5.0.drv-0/qtmultimedia-opensource-src-5.5.0/qtmultimedia.pro:28:
Variable GST_VERSION is not defined.
Checking for resourcepolicy... no
And there may be application runtime errors like
defaultServiceProvider::requestService(): no service found for - "org.qt-project.qt.camera"
After this fix, configure will say:
Checking for openal... no
Checking for gstreamer... yes
Checking for gstreamer_photography... no
Checking for gstreamer_encodingprofiles... yes
Checking for gstreamer_appsrc... yes
Checking for linux_v4l... yes
Checking for resourcepolicy... no
And the above runtime error will not appear.
This fix is similar to 449b6028 ("qt5.multimedia: fix gstreamer
support."), except with Qt 5.5 we also need to set GST_VERSION.
(cherry picked from commit 2cec70ce6c)
(cherry picked from commit 9fa17aa293)
Resolve conflicts in kde-frameworks by removing the change (that
package/version doesn't exist in release-15.09).
(cherry picked from commit d57e50d840)
I resolved some trivial conflicts: drop changes to packages that have
been switched to qt55 in master, but not in release-15.09.
addToSearchPath already checks if the directory exists before adding it
to the path; it's not necessary to check it again.
(cherry picked from commit ebb9c07168)
The runtime paths QT_PLUGIN_PATH, QML_IMPORT_PATH, QML2_IMPORT_PATH, and
XDG_DATA_DIRS did not include the appropriate paths from the current
package being built because addToSearchPath does not add directories
which don't exist.
(cherry picked from commit b44923561b)
Close#10867.
It means that settings couldn't be saved. The issue appeared
since upgrade to nixos 15.09 and fall as part of #4415.
Tested on nixos.
- No longer has a stderr when running the application.
- Settings are effectively saved.
(cherry picked from commit 34eb56e16b)
The package has been cherry-picked into the 15.09 release at 9bae8f6,
unfortunately without the fixes that were introduced by the upgrades in
linux-testing.
As it is now the current "_latest" in 15.09, we really don't want the
build to fail.
This is a partial cherry-pick from 9fbbbd5 because that commit was
updating linux-testing as well.
Tested with the latestKernel.login VM test.
Signed-off-by: William A. Kennington III <william@wkennington.com>
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
This option allows to define (declarative) Jenkins jobs, using Jenkins
Job Builder (JJB) as backend.
Example:
services.jenkins = {
enable = true;
jobBuilder = {
enable = true;
yamlJobs = ''
- job:
name: jenkins-job-test
builders:
- shell: echo 'Hello world!'
'';
};
};
Jobs can be defined using YAML, JSON and Nix.
Note that it really is declarative configuration; if you remove a
previously defined job, the module will remove the jobdir under
$JENKINS_HOME.
Jobs managed through the Jenkins WebUI (or by other means) are not
touched by this module.
Changes v1 -> v2:
* add nixJobs
* let jsonJobs take a list of strings (allows merge)
* 4 space indent in shell code
(cherry picked from commit 27f41d8c0a)
Close#10444, fixes#8749.
For some reason it's more involved than just setting gyp configuration,
we also have to set some definitions in widevine_cdm_version.h according
to the comments left in the file. Arch Linux does this already and so we
should probably just use the patch they created while getting Netflix to
work:
https://code.google.com/p/chromium/issues/detail?id=429452#c16
(cherry picked from commit 492ccdd52d)
Signed-off-by: Domen Kožar <domen@dev.si>
Fixes pinned CA root certificate and probing for system CA bundle.
ClosesNixOS/nixops#354.
I'm using fetchFromGitHub now because it's use of fetchzip is more
stable for autogenerated tarballs from GitHub.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
(cherry picked from commit 1d1cf4845f)
This reverts commit 3e1eae1187.
The pi2 kernel adds "-v7" to LOCALVERSION. We have to trim this out, and make
it like the pi1. Or make it dependant on the pi1/pi2 platform.
Systemd dropped support in 207 (would be nice if configure failed with a bad flag),
so all this does is add an annoying delay if firmware can't be found by the kernel
(cherry picked from commit a7157fa2f0)
While debugging an issue with running NixOps tests, I found out that the
output from debClosureGenerator is not deterministic.
The reason behind this is the way how Provides and Replaces fields are
handled. I haven't yet found out what's the exact issue, but so far
packages "Provides" are more or less picked at random.
So, running the NixOps Hetzner tests we get either mawk, original-awk or
gawk altering on every invocation.
While for the test it isn't poisionous whether wi have mawk or gawk,
having original-awk certainly is, because live-build only works with
mawk or gawk.
The best solution would obviously be to make debClosureGenerator
deterministic, but in the case of "Provides: awk", we can safely pick
mawk by default, because the latter has a "Priority: required" in its
package description.
This also has the advantage that we can safely cherry-pick this to
release-15.09 because it's very unlikely that we'll break the
debClosureGenerator by adding a dependency to commonDebPackages.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
(cherry picked from commit 82d88b5bcb)
Regression introduced by b21fd5d066.
The initialScript is only executed whenever there is a .first-startup in
the dataDir, so silently dropping the file essentially breaks
initialScript functionality.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
(cherry picked from commit 60d407b209)
Needed to be able to run some programs (e.g. tune2fs) in the chroot.
AFAIK, /etc/mtab is deprecated, but programs still use it.
(cherry picked from commit ad49db64da)
This should avoid accidential expansion of variables, i.e. in
"export PATH=/some/path:$PATH"
$PATH would have been expanded in the environment builder!
(cherry picked from commit da38314be6)
The SO major is going to change in the upcoming update of the Hetzner
rescue system, which will cause NixOps to break because it's statically
using the SO major 0 while the new rescue system will have the major
number 1.
I'm still keeping the udevSoMajor attribute to retain backwards-
compatibility with older NixOps versions.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
(cherry picked from commit 3bf3d19759)
Fix failure of 0.98.0 to compile with NixOS 15.09 (due to referencing a
symbol `IOADDRESS` that has been removed from X.org drivers).
(cherry picked from commit 678c81b74d)
Adds support for shared-mime-info to Claws, to fix attachments in
outgoing messages always having MIME type application/octet-stream
because Claws doesn't know where to look, instead complaining:
/nix/store/...-claws-mail-3.11.1/etc/mime.types: fopen: No such file or directory
Moreover, Claws relies on incoming MIME types for knowing when e.g. to
display an attached image, so sending application/octet-stream
unnecessarily is bad.
Tested against release-15.09.
(cherry picked from commit 268b4d5cfe)
Fixes#10290. Lilypond finds its Guile libraries by looking at the path
in argv[0], so it should be hardcoded to the real absolute path to the
executable.
(cherry picked from commit 2de259f574)
Don't pull in all of environment.sessionVariables, only add what's
needed for nix and HTTPS to work (which was the point of the previous
patch).
(cherry picked from commit 04e748e61f)
Jenkins gets (by default) an additional environment of
{ NIX_REMOTE = "daemon"; }
This has the following problems:
1. NIX_REMOTE disappears when users specify additional environment
variables, because defaults have low merge priority.
2. nix cannot be used without additional NIX_PATH envvar, which is
currently missing.
3. If you try to use HTTPS, you'll see that jenkins lacks
SSL_CERT_FILE envvar, causing it to fail.
This commit adds config.environment.sessionVariables and NIX_REMOTE to
the set of variables that are always there for jenkins, making nix and
HTTPS work out of the box.
services.jenkins.environment is now empty by default.
(cherry picked from commit 67723df930)
Commit 9bfe92ecee ("docker: Minor improvements, fix failing test") added
the services.docker.storageDriver option, made it mandatory but didn't
give it a default value. This results in an ugly traceback when users
enable docker, if they don't pay enough attention to also set the
storageDriver option. (An attempt was made to add an assertion, but it
didn't work, possibly because of how "mkMerge" works.)
The arguments against a default value were that the optimal value
depends on the filesystem on the host. This is, AFAICT, only in part
true. (It seems some backends are filesystem agnostic.) Also, docker
itself uses a default storage driver, "devicemapper", when no
--storage-driver=x options are given. Hence, we use the same value as
default.
Add a FIXME comment that 'devicemapper' breaks NixOS VM tests (for yet
unknown reasons), so we still run those with the 'overlay' driver.
Closes#10100 and #10217.
(cherry picked from commit 5f17aeb403)
When using the ZFS storagedriver in docker, it shells out for the ZFS
commands. The path configuration for the systemd task does not include
ZFS, so if the driver is set to ZFS, add ZFS utilities to the PATH.
This will resolve https://github.com/NixOS/nixpkgs/issues/10127
[Bjørn: prefix commit message with "nixos/docker:", remove extra space
before ';']
(cherry picked from commit 791b600aac)
This reverts commit 53746ff9d2 because
it increases default system closure size significantly. It's also
unnecessary - people can always add fonts themselves.
This fixes#10077 because after some debugging it turns out that by
default we don't have a font which is able to display Chinese symbols.
Thanks to @anderspapitto, @kmicu and hyper_ch on IRC to help debugging
this issue, see log at:
http://nixos.org/irc/logs/log.20150926 starting at 19:46
With unifont we have a reasonable fallback font to ensure that every
written language is rendered correctly and thus less surprise for new
users who keep their font settings at the default.
Reported-by: Anders Papitto <anderspapitto@gmail.com>
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
(cherry picked from commit ebf1f51641)
Signed-off-by: Domen Kožar <domen@dev.si>
This update was generated by hackage2nix v20150922-6-g5d5ccfe-dirty using the following inputs:
- Nixpkgs: 7a2a9bbe15
- Hackage: 82f4bbff1b
- LTS Haskell: 831a37566b
- Stackage Nightly: e7fd25c827
(cherry picked from commit 750e15fbd7)
This update was generated by hackage2nix v20150922-6-g5d5ccfe using the following inputs:
- Nixpkgs: d64ca94227
- Hackage: 8f14dec431
- LTS Haskell: 831a37566b
- Stackage Nightly: e7fd25c827
(cherry picked from commit 96c1c16771)
- Update the link to the manual to refer to the proper place.
- Mention LTS Haskell and Stackage Nightly.
- Minor cosmetic to improve readability.
(cherry picked from commit 8e00de424497d2cc6447c529785efa985bd3383c)
The patch only applies for Firefox versions between 37.0 and 40.1.
Because we're on version 41.0 the changes are already included upstream
and thus the patch doesn't apply and is even unnecessary.
As for version 38.3 for ESR, the patch doesn't apply as well if compiled
with enableGTK3. Of course, this is a bit unfortunate but I don't have
the time right now to properly rebase the patch on 38.3.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
Reported-by: devhell <"^"@regexmail.net>
(cherry picked from commit 592f0f7ead)
(cherry picked from commit 449b6028a6)
[Bjørn: Without this, one may get runtime errors like
defaultServiceProvider::requestService(): no service found for - "org.qt-project.qt.camera"
or
The camera service is missing
]
This update was generated by hackage2nix v20150922-6-g5d5ccfe using the following inputs:
- Nixpkgs: f21f116631
- Hackage: f8855b5494
- LTS Haskell: 831a37566b
- Stackage Nightly: 96ef887f31
(cherry picked from commit 0139c51f1b)
This update was generated by hackage2nix v20150922-6-g5d5ccfe using the following inputs:
- Nixpkgs: eaa43c65b3
- Hackage: c048a402d3
- LTS Haskell: c7012a704b
- Stackage Nightly: a74568b554
(cherry picked from commit dacc96be28)
This reduces the wget closure from 377 MiB to 49 MiB, which is in
particular good for EC2 images, since they include wget. The main
changes:
* Disable libpsl - this isn't very big itself, but it pulls in libicu,
which is 36 MiB. It also adds build-time dependencies on packages
like gtk-doc, dblatex, tetex etc.
* Replace gnutls with openssl. The former pulls in runtime
dependencies like guile, python, binutils, gcc, ncurses, etc.
(cherry picked from commit 9e38b81af8)
Seems cleaner.
Hm, there are also loadfiles in $out/share/doc/dbench/loadfiles/
(installed by the upstream build system), but there is no iscsi/
directory in there.
(cherry picked from commit 3f27be8e5d)
Try to build e.g. the Qt5 Camera Example[1] and see that qmake fails to
find <GL/gl.h>. This fixes it.
[1] http://doc.qt.io/qt-5/qtmultimediawidgets-camera-example.html
(Although since nixpkgs qtcreator still lacks 'examples', we have to
download the sources manually and use "qmake && make".)
(cherry picked from commit 583845d00b)
It was complaining about not having write permission to
$HOME/.local/share/user-places.xbel (because .local/share didn't exist
yet).
(cherry picked from commit 1b728846a8)
This prevents seeing lots of warnings about missing hashes/sizes in the
database when running "nix-store --verify --check-contents" for the
first time.
(cherry picked from commit 64aed5e78f)
There is no "root" command in GRUB 2, and it's not needed anyway. This
command delayed HVM boots for a few seconds.
(cherry picked from commit 640dff2918)
Old package expression had two problems:
* source download link was broken
* when working, it downloaded almost 400 MB of data because it cloned
the entire mercurial repo, via http it's only about 140 MB.
[Bjørn: extend commit message]
(cherry picked from commit fb6403aeaa)
The EBS and S3 (instance-store) AMIs are now created from the same
image. HVM instance-store AMIs are also generated.
Disk image generation has been factored out into a function
(nixos/lib/make-disk-image.nix) that can be used to build other kinds
of images.
(cherry picked from commit e018e10ba64e3277f11f4123bc46fc68def970dd)
Since 74209a4 we have initial support for the "vboxsf" (VirtualBox
shared folder) file system support. This will be cherry-picked to
release-15.09 so we need to notice people about the change.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
(cherry picked from commit 39a03b679a)
There were quite a few configuration options which were tagged via
<literal/>, so in order to keep consistency with other docbook manuals
in the source tree, let's use <option/> here.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
(cherry picked from commit 02c2500195)
I'm not quite sure why the official Hydra gets a kernel panic in one of
two VMs using the exact same kernels:
https://hydra.nixos.org/build/26339384
Because the kernel panic happens before stage 1, let's wait for the
first VM to boot up and after the bootup is done, start the second one
in hope that it won't trigger the panic.
Oddly enough, whenever I run the test on my own Hydra and on my local
machines, I don't get anything like that.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
(cherry picked from commit baf1d1dcd7)
I forgot to do this in da0e642. It shouldn't be a big problem but it's
more clean to destroy the VM once we're done testing.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
(cherry picked from commit 764a767d5f)
We previously had 1024 MB of memory to fit a VirtualBox VM with 512 MB
plus the memory needed of the VirtualBox host VM. That obviously won't
work for two VirtualBox VMs, which are used for testing networking
between two VirtualBox guests.
Now, we have 2048 MB on the qemu guest (the VirtualBox host) and 768 MB
for each VirtualBox guest. That should be enough to fit in two
VirtualBox guests (I hope).
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
(cherry picked from commit 3e6bb402b1)
We don't even have any means to check a VirtualBox shared folder, so
let's not even try to.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
(cherry picked from commit f9766f885d)
The default options for all file systems currently are
"defaults.relatime", which works well on file systems which support the
relatime option.
Unfortunately, this is not the case for the VirtualBox shared folder
filesystem, so until now, you need to set something like:
fileSystems."/foo" = {
device = "foo";
fsType = "vboxsf";
options = "defaults";
};
Otherwise mounting the file system would fail.
Now, we provide only the "defaults" option to the "vboxsf" file system,
so something like this is enough:
fileSystems."/foo" = {
device = "foo";
fsType = "vboxsf";
};
An alternative to that could be to document that you need to set default
options, but we really should do what users expect instead of forcing
them to look up the documentation as to why this has failed.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
(cherry picked from commit cd4caed35a)
Unfortunately, we can't test whether USB is really working, but we can
make sure that VirtualBox has access to the USB devices.
This is essentially testing #9736, which I haven't yet been able to
reproduce though, but it makes sense to test it so it won't happen in
future releases.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
(cherry picked from commit 9a39c2e943)
If built from svn:
$ jtag --version
UrJTAG 0.10 #2051
If built from git:
$ jtag --version
UrJTAG 0.10 #
Also, with svn we don't need to download the web/ subdirectory because
svn supports partial repository clones.
[Bjørn: extend commit message]
(cherry picked from commit 52379183e1)
The package set was generated by hackage2nix v20150922-4-g3df9130 using the following inputs:
- Nixpkgs: 5eb46915ca
- Hackage: 238be6f443
- LTS Haskell: c7012a704b
- Stackage Nightly: a46ea057c9
So far nix-env -qP would prefer e.g. `xlibs.*` to `xorg.*`,
so we just disallow recursing into aliased sets
while keeping them available for explicit usage.
Consequently, `xlibs` references should get killed on the next
regeneration.
(cherry picked from commit c10f7050c5)
(also added 63f3fef08e and 1caa62ae42)
The previous default was $out/lib/debug, which wasn't very useful.
This ensures that you can do
environment.systemPackages = [ pkgs.hello.debug ];
to install debug info.
(cherry picked from commit e636e0a532)
You can now pass
separateDebugInfo = true;
to mkDerivation. This causes debug info to be separated from ELF
binaries and stored in the "debug" output. The advantage is that it
enables installing lean binaries, while still having the ability to
make sense of core dumps, etc.
(cherry picked from commit ec5b66eb4a)
It's another attempt to fix chromium builds.
See http://hydra.nixos.org/build/26086977/nixlog/4/raw
Unpacking sources is actually taking more than 2h so build fails.
Instead, rather build it remotely and then copy over the output as
we don't have limits for download time.
See 089bdce621 for reference
cc @aszlig
It should be safe to use the Nixpkgs LLVM again, now that the approriate
patches have been backported. Hopefully, this will also fix the i686
build.
(cherry picked from 1daa0b39f6)
This is a backport of systemd/systemd@e32886e.
As noted by @ts468 in #9876, systemd-detect-virt will report KVM if
we're running inside VirtualBox 5.x. Instead of just disabling the
check, this essentially fixes systemd to be able to detect VirtualBox
again.
Tested this against nixos/tests/simple.nix (just to make sure systemd is
still working) and nixos/tests/virtualbox.nix (all tests succeed).
Thanks a lot to @ts468 for catching this and also to @domenkozar for
testing various things concerning that bug.
Fixes#9876.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
(cherry picked from commit 389e654e03)
Signed-off-by: Domen Kožar <domen@dev.si>
Addresses #9876 in the way that we want to make sure that VirtualBox 5.x
is going to be properly detected. Right now the result is "kvm", so the
subtest fails as expected with:
error: systemd-detect-virt returned "kvm" instead of "oracle" at (eval
14) line 414, <__ANONIO__> line 92.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
(cherry picked from commit da0e642c2b)
Signed-off-by: Domen Kožar <domen@dev.si>
Booting the demo/installer image won't work if the video memory is too
low. It boots into KDE, shows the background image and doesn't do
anything, according to @domenkozar.
Thanks to @domenkozar for reporting and testing this with 32MB.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
(cherry picked from commit 03730319bd)
Signed-off-by: Domen Kožar <domen@dev.si>
pkgs/os-specific/linux/kernel/common-config.nix defines HIGHMEM64G on
line 441 for 32bit systems, which implies PAE.
We now creating the OVA with PAE support enabled, which fixes bootup of
the image if people are just importing it without setting PAE
explicitly.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
(cherry picked from commit 4e23f1f908)
Signed-off-by: Domen Kožar <domen@dev.si>
This is essentially not only "wrapping" the line but refactoring into a
shorter name which is used in two places.
And yes, I know I'm very pedantic if it comes to whitespaces and line
lengths, but I made sure this doesn't change any functionality:
$ nix-instantiate nixos/tests/virtualbox.nix
...
/nix/store/cldxyrxqvwpqm02cd3lvknnmj4qmblyn-vm-test-run-virtualbox.drv
$ git stash pop
...
$ nix-instantiate nixos/tests/virtualbox.nix
...
/nix/store/cldxyrxqvwpqm02cd3lvknnmj4qmblyn-vm-test-run-virtualbox.drv
$
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
(cherry picked from commit 17f58275a0)
Signed-off-by: Domen Kožar <domen@dev.si>
Instead of manually setting debug to true or false, this should make it
possible to now run the test like this:
nix-build nixos/tests/virtualbox.nix --arg debug true
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
(cherry picked from commit 8f98226f50)
Signed-off-by: Domen Kožar <domen@dev.si>
If true, enable the repository of extra modules for OpenCV.
Build tested.
Based on patch from Bas van Dijk <v.dijk.bas@gmail.com>.
(cherry picked from commit d7a0becf37)
Intel Integrated Performance Primitives (IPP) speeds up parts of OpenCV
on Intel processors (and compatible). It increases the store path from
220 MiB to 300 MiB, so it defaults to off.
Original patch from Bas van Dijk <v.dijk.bas@gmail.com>.
I tried applying the same change to opencv(2.x). OpenCV 2.x didn't
automatically detect IPP, so I reverted the change.
(cherry picked from commit affcf2e030)
Sometimes there are random kernel panics do to the lack of memory in the
qemu guests, but as we're setting the VirtualBox memory size relatively
low, 1024 MB should be enough for the qemu guests.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
(cherry picked from commit 0d4a3ce485)
Signed-off-by: Domen Kožar <domen@dev.si>
We want to check whether DBus functionality is working, so let's make
sure it is running in our mini-initrd.
DBus unfortunately requires to have users properly set up and another
configuration file other than in ${dbus.daemon}/etc/dbus-1/system.conf,
so we do provide that as well.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
(cherry picked from commit 7707c7df7f)
Signed-off-by: Domen Kožar <domen@dev.si>
VirtualBox had support for DBUS even in version 4.x, but it appears that
nothing in our VM test triggered it to load, thus I didn't notice the
runtime error:
rtldrNativeLoad: dlopen('libdbus-1.so.3', RTLD_NOW | RTLD_LOCAL) failed:
libdbus-1.so.3: cannot open shared object file: No such
file or directory
The upstream commits I think are responsible for this to come to surface
are _probably_ (did I ever mention that I love SVN? *cough*) one of
these:
https://www.virtualbox.org/changeset/55664/vboxhttps://www.virtualbox.org/changeset/55602/vbox
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
(cherry picked from commit 89b6831ffd)
Signed-off-by: Domen Kožar <domen@dev.si>
Fixes#9044, close#9667. Thanks to @taku0 for suggesting this solution.
Now we have no modes starting with `/` or `+`.
Rewrite the `-perm` parameters of find:
- completely safe: rewrite `/0100` and `+100` to `-0100`,
- slightly semantics-changing: rewrite `+111` to `-0100`.
I cross-verified the `find` manual pages for Linux, Darwin, FreeBSD.
(cherry picked from commit 8f33b8cc93)
This effectively reverts 86c283824f
("If cuda headers are presented to nix [...]") and all the following
workarounds that was added due to that commit.
As far as I can tell[1] this hack isn't needed anymore. And moving
includes to $out/usr_include causes pain for cudatoolkit users, so
better get rid of it.
In patches that did more than the $out/usr_include workaround, I only
changed the line back to $out/include instead of re-generating the
patches and fully removing the changed line.
[1]: I build tested blender and caffe, and temporarily added
recurseIntoAttrs to rPackages and haskellPackages so that nox-review
could get proper coverage. However, many of the packages do not build
even before this patch. I also built CUDA samples with cudatoolkit7
that ran fine.
(cherry picked from commit 22321f2e58)
Close#9806.
The upstream URL of the Pecita font is often changed in-place resulting
in frequent hash mismatches. With this commit an archived version of the
font is used instead.
(cherry picked from commit 667f26cabf)
Regression introduced in 7ffb1f3bde.
Also added a small notice so that this hopefully won't happen with
future updates.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
(cherry picked from commit 8be8193bd5)
Signed-off-by: Domen Kožar <domen@dev.si>
Before:
$ time journalctl > /dev/null
real 6m12.470s
user 5m51.439s
sys 0m19.265s
After:
real 0m40.067s
user 0m37.717s
sys 0m2.383s
Before:
$ time journalctl --since '2015-08-01' _TRANSPORT=kernel
real 1m9.817s
user 0m13.318s
sys 0m56.626s
After:
real 0m0.689s
user 0m0.521s
sys 0m0.221s
(cherry picked from commit c34953ed24)
(cherry picked from commit dc0fe8ebf40b7724de1ca0b195236854591fdb5f)
Signed-off-by: Domen Kožar <domen@dev.si>
(cherry picked from commit 66214fba8d)
Signed-off-by: Domen Kožar <domen@dev.si>
The patch committed with 88471b684e6544da7691937a9b68cefa49d260d5
makes them work again.
(cherry picked from commit 8b663509b1)
Signed-off-by: Domen Kožar <domen@dev.si>
* Compile with gcc5 to avoid the compiler bug described in
https://gcc.gnu.org/ml/gcc-patches/2014-05/msg02560.html
* Add a patch to fix the many incorrect printf format specifiers and
other sloppy type conversions that gcc5 catches and warns on
(erroring out due to -Werror).
(cherry picked from commit 3129142f80)
Signed-off-by: Domen Kožar <domen@dev.si>
- Replace usage of deprecated CLI flag `--daemon`
- Introduce `storageDriver` option for module
- Fix failing test by using `overlay` storage driver
(cherry picked from commit 9bfe92ecee)
Signed-off-by: Domen Kožar <domen@dev.si>
In 4.1, the build system changed, and it now wants to execute ld like this:
ld -r -o util/scripting-engines/libperf-in.o util/scripting-engines/trace-event-perl.o util/scripting-engines/trace-event-python.o
The actual problem seems to be that `buildInputs = [elfutils ...]`
causes 'ld' to point to elfutils in PATH instead of the usual binutils.
So remove elfutils from buildInputs and set NIX_CFLAGS_* manually. This
is a slight hack, but there is some precedent:
0761f81da7/pkgs/tools/package-management/rpm/default.nix (L13)Fixes#9095.
(cherry picked from commit 710c4c3c9d)
Signed-off-by: Domen Kožar <domen@dev.si>
The v0.8 build was broken because the CTAN package updated to v0.9 and
CTAN doesn't keep old versions of packages.
Besides bumping the version, this commit changes the src url from the
unversioned CTAN link (which would break the derivation every time a new
version of the package released, as it did yesterday) to the versioned
Github release link.
(cherry picked from commit 126d8dba96)
Without this, users are presented with this endless loop:
$ ffplay
The program ‘ffplay’ is currently not installed. You can install it by
typing:
nix-env -i ffmpeg
$ nix-env -i ffmpeg
$ ffplay
The program ‘ffplay’ is currently not installed. You can install it by
typing:
nix-env -i ffmpeg
(cherry picked from commit 6483cf1d91)
Upstream likes to move "old" releases to an archive mirror as soon as a
new one is released. This is now handled for free by mirrors.nix.
(No idea why cs.utah.edu was used to begin with; it's now added to
mirrors.nix. Note that it doesn't support SSL, but that applies to
several others so I don't see the harm.)
(cherry picked from commit 5385a0a82a)
hydraPlatforms now defaults to the value of meta.platforms rather than
defaulting to ghc.meta.hydraPlatforms. This solution is, in fact, still
sub-optimal. See https://github.com/NixOS/nixpkgs/issues/9608 for further
details.
(cherry picked from commit dc5bf39bfe)
This allows us to override the attributes passed to the package set, which is
needed to pass "imagemagickBig" to PerlMagic rather than the normal one (see
next commit).
This patch is brought to you courtesy of the venerable @vcunat.
Changes the option and explicitely sets it for each desktopManager.
Reasoning: Currently,
services.xserver.displayManager.desktopManagerHandlesLidAndPower is set
to true by default. This creates a problem for users without desktop
environments activated, since lid management simply doesn't work
(and they have to be lucky to find this option).
See issue #9671
(cherry picked from commit 44c12dc0ff)
Fixes this problem, when building apps in QtCreator:
...(compile output window)
g++ -Wl,-rpath,/nix/store/1w7h7p6s2srfw2ady90k7072991lrnpp-qtbase-5.4.2/lib \
-o qt-test3 main.o mainwindow.o moc_mainwindow.o \
-L/nix/store/1w7h7p6s2srfw2ady90k7072991lrnpp-qtbase-5.4.2/lib \
-lQt5Widgets -lQt5Gui -lQt5Core -lGL -lpthread
/nix/store/b8qhjrwf8sf9ggkjxqqav7f1m6w83bh0-binutils-2.23.1/bin/ld: cannot find -lGL
collect2: error: ld returned 1 exit status
mesa is already in the closure of Qt, so there is no size increase.
The patch is copied into both qt-5.3 and qt-5.4 directories, like other
patches are.
Note that programs still can _run_ against a different libGL (e.g. one
provided by nvidia) by configuring the dynamic linker. For instance,
NixOS sets the LD_LIBRARY_PATH environment variable to
/run/opengl-driver/lib/, meaning that whatever libGL is found there
will be used instead of the default (mesa).
(cherry picked from commit 06ed82677a)
Prior to this change, if there exists a /lib*/ld-linux*.so.2 on a
system, vimproc will try to load vimproc_linux64.so or
vimproc_linux32.so instead of vimproc_unix.so, which is what nix
actually builds.
(cherry picked from commit a166119486)
This reverts commit c53018c9a1. This
causes problems for "nix-env -qa", so we'll have to come up with a
clean solution first.
Issue #9456.
(cherry picked from commit 3ea329c6aa)
Icons no longer missing (fix#5509).
In `*.desktop` files:
- Replaced absolute path to the the store by the program name.
This is so that files can be dragged elsewhere by the user
(e.g.: desktop, bar) and still work after upgrade + garbage
collection and can be shared between machines.
- Replace program name `soffice` by program name `libreoffice`
so that we're sure the desktop file really refers to our
package's binary and not start office or open office.
Add the possibility of building without the help. This build is
not modular and take a really long time to complete so I want
a mean of improving shortcuts without having to rebuild the
whole thing (see #899). A wrapper script is the next step.
Tested (build and ran the program) with `en_US` only and
without the help module.
(cherry picked from commit d12563475a)
By default `makeWrapper` will not set argv[0] (this is a reversion to
the old default behavior). Based on the breakage we have seen from
changing the default, this is what most people want. The `wrapProgram`
function will send `--argv0 '"$0"'` to `makeWrapper`, i.e. it will
continue to pass-through the argv[0] that the wrapper is called with.
(cherry picked from commit 61cad61ebf)
A derivation of the Hackage package "foo" is called "haskell-foo" if it is a
library, but only "foo" if it is an executable (without a library). This
distinction used to be fine when Haskell packages where visible to operations
like "nix-env -qa" or "nix-env -i", but after our switch to Haskell NG it has
no more purpose. Consequently, this patch removes the name prefix from all
Haskell packages -- every Haskell package is now called exactly like it's
called on Hackage.
Closes https://github.com/NixOS/nixpkgs/pull/9538.
(cherry picked from commit 4a8797d827)
I've checked this with the developer to ensure it isn't blocked
deliberately and she said it was just a problem with the hosting
provider, so it is fine to work around it.
(cherry picked from commit 3c7f1431c0)
See https://github.com/NixOS/nixpkgs/pull/9560.
"Native" Qt audio capture is now broken (patches/time welcome). ALSA
should work just as well and is now enabled by default until Qt is fixed.
(cherry picked from commit be91ec0fd7)
Signed-off-by: Domen Kožar <domen@dev.si>
* Upgrade 1.6.9 -> 1.6.14
* Support all kernels
* Clean up nested smart-quotes that seemed to be causing a build failure
* Remove redundant `assert isLinux`: already checked by meta.platforms
(cherry picked from commit dbf8feb815)
Signed-off-by: Domen Kožar <domen@dev.si>
Currently i686 builds fail because a couple of doctests fail.
The values are correct, but the dtype is missing.
This commit disables doctests.
(cherry picked from commit 46e51883d8)
Signed-off-by: Domen Kožar <domen@dev.si>
In Hydra CI environments, the version strings we get from Hydra don't
necessarily match those hard-coded into the Cabal files. To make those builds
succeed anyway, we have to apply some pattern matching.
(cherry picked from commit 78f1720532)
This package has been broken since 2014-01-20, according to Hydra [1]. I tried
various ad-hoc patching & adding missing dependencies, uncovering yet more
errors. Updating is also out of the question, as nixpkgs already contains the
latest version.
[1]: https://hydra.nixos.org/build/25188337
(cherry picked from commit 624eba1885)
Signed-off-by: Domen Kožar <domen@dev.si>
The same issue was reported here to Debian:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=746854
Apparently this failure only cropped up with g++-4.9, but looking at
the code I have no idea how it ever worked without this patch.
(cherry picked from commit 7f26d95dcf)
Signed-off-by: Domen Kožar <domen@dev.si>
importlib is part of the standard library for Python > 2.6 and PyPy.
Tested with nix-shell for all *Packages.importlib versions.
(cherry picked from commit 50aed1ee10)
Signed-off-by: Domen Kožar <domen@dev.si>
One of the tests explicitly calls python, which will fail with python3.
The issue has been reported upstream,
https://github.com/nipy/nibabel/issues/341
For now, remove the test.
Fix also the license type.
(cherry picked from commit 2927f1a883)
Signed-off-by: Domen Kožar <domen@dev.si>
This should reduce the number of Haskell related build errors to zero on
Linux/x86_64 and (hopefully) on Linux/i686, too. Further efforts are necessary
to achieve the same on Darwin.
This patches is related to https://github.com/NixOS/nixpkgs/issues/9471.
gmpy and gmpy2 are both extension modules that cannot be used with PyPy.
(cherry picked from commit 6ec74dfdef)
Signed-off-by: Domen Kožar <domen@dev.si>
Some files were not shown because too many files have changed in this diff
Show More
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
