The resolver is mainly useful for the ACME server, and acme.nix uses its
own DNS server to test DNS-01 challenges.
(cherry picked from commit 21f183a3fe)
Shimming out the Let's Encrypt domain name to reuse client configuration
doesn't work properly (Pebble uses different endpoint URL formats), is
recommended against by upstream,[1] and is unnecessary now that the ACME
module supports specifying an ACME server. This commit changes the tests
to use the domain name acme.test instead, and renames the letsencrypt
node to acme to reflect that it has nothing to do with the ACME server
that Let's Encrypt runs. The imports are renamed for clarity:
* nixos/tests/common/{letsencrypt => acme}/{common.nix => client}
* nixos/tests/common/{letsencrypt => acme}/{default.nix => server}
The test's other domain names are also adjusted to use *.test for
consistency (and to avoid misuse of non-reserved domain names such
as standalone.com).
[1] https://github.com/letsencrypt/pebble/issues/283#issuecomment-545123242
Co-authored-by: Yegor Timoshenko <yegortimoshenko@riseup.net>
(cherry picked from commit d0f04c1623)
This was added in aade4e577b, but the
implementation of the ACME module has been entirely rewritten since
then, and the test seems to run fine on AArch64.
(cherry picked from commit 352e30df8a)
The patch phase runs after the build phase. Which means than when
using an override to override both 'conf' and 'patches' to provide
a custom config file and apply some patches, it doesn't work:
- first the patches applied (optionally changing config.def.h)
- then preBuild is run which overrides config.def.h with the user
supplied one (effectively cancelling previously applied patches)
By copying the config file in the prePatch phase instead, changes
are kept and applied in order.
(cherry picked from commit b584941ab9)
(cherry picked from commit ac374d41c816f7365a3945e657d2beba3962587d)
Backported 32.0.0.363 to release 20.03 for important bug fixes.
Also needed because old upstream release is no longer available.
These values were incorrect. We need to use NIX_LDFLAGS, not
NIX_LD_FLAGS. Also need to prefix all flags with -Wl, for GCC to
accept it.
(cherry picked from commit 184cd9f6ff)
This reverts commit 5532065d06.
As far as I can tell setting RemainAfterExit=true here completely breaks
certificate renewal, which is really bad!
the sytemd timer will activate the service unit every OnCalendar=,
however with RemainAfterExit=true the service is already active! So the
timer doesn't rerun the service!
The commit also broke the actual tests, (As it broke activation too)
but this was fixed later in https://github.com/NixOS/nixpkgs/pull/76052
I wrongly assumed that PR fixed renewal too, which it didn't!
testing renewals is hard, as we need to sleep in tests.
tig recently updated it's bash-completion making it depend on __git-complete from git.
Becase __git-complete is not automatically sourced tig bash completion fails.
Also this PR makes tig completion load on-demand.
(cherry picked from commit f57da8ef0a)
The configuration phase was failing due to:
```
configuring
ERROR at //BUILD.gn:1376:5: Unknown function.
filter_exclude([ "$root_build_dir/foo" ],
^-------------
```
(cherry picked from commit ad3220f9ff)
With #83290 merged the build would fail during the configuration phase:
```
configuring
ERROR at //gn/BUILDCONFIG.gn:85:14: Script returned non-zero exit code.
is_clang = exec_script("gn/is_clang.py",
^----------
Current dir: /build/source/out/Release/
Command: python /build/source/gn/gn/is_clang.py cc c++
Returned 2.
stderr:
python: can't open file '/build/source/gn/gn/is_clang.py': [Errno 2] No such file or directory
```
(cherry picked from commit ad66bbd98b)
This updates gn to the required version for chromiumDev (the recommended
version for the stable release of Chromium isn't sufficient [0]).
[0]: The Chromium build fails during the configuration phase:
ERROR at //mojo/public/tools/bindings/mojom.gni:393:16: Undefined identifier
"cpp_typemaps",
^-------------
(cherry picked from commit a1b4bfe34f)
We only need to wait for network.target to get up, and the
network-addresses-${interfaceName} units are scripted networking only.
(cherry picked from commit a501abd5499d8f82f0991a7b78bcbc4169b0537f)
ZHF: #80379
Fix a failing test.
There are strict rate limits on account creation for Let's Encrypt
certificates. It is important to reuse credentails when possible.
(cherry picked from commit 827d5e6b44)
According to my analysis the last critical fix went into v5.4.23, I have
confirmed this by running WebGL over night and haven't seen a single
i915 GPU hang. Lets remove the notes from the release notes.
The new wording does not assume the user is upgrading.
This is because a user could be setting up a new installation on 20.03
on a server that has a 19.09 or before stateVersion!!
The new wording ensures that confusion is reduced by stating that they
do not have to care about the assumed 16→17 transition.
Then, the wording explains that they should, and how to upgrade to
version 18.
It also reviews the confusing wording about "multiple" upgrades.
* * *
The only thing we cannot really do is stop a fresh install of 17 if
there was no previous install, as it cannot be detected. That makes a
useless upgrade forced for new users with old state versions.
It is also important to state that they must set their package to
Nextcloud 18, as future upgrades to Nextcloud will not allow an uprade
from 17!
I assume future warning messages will exist specifically stating what to
do to go from 18 to 19, then 19 to 20, etc...
(cherry picked from commit a1efbdb600)
Assert that the user doesn't have a bridge configured while
networking.useDHCP is true. Due to new behaviour of dhcpcd [0], this
would result in the bridge not getting an address via DHCP, regardless
of wether it has networking.interfaces.<name?>.useDHCP set or not.
[0] https://roy.marples.name/archives/dhcpcd-discuss/0002621.html
we use stdenv.hostPlatform.uname.processor, which I believe is just like
`uname -p`.
Example values:
```
(import <nixpkgs> { system = "x86_64-linux"; }).stdenv.hostPlatform.uname.processor
"x86_64"
(import <nixpkgs> { system = "aarch64-linux"; }).stdenv.hostPlatform.uname.processor
aarch64
(import <nixpkgs> { system = "armv7l-linux"; }).stdenv.hostPlatform.uname.processor
"armv7l"
```
(cherry picked from commit df8c30fa25)
The volumeID will now be in the format of:
nixos-$EDITON-$RELEASE-$ARCH
an example for the minimal image would look like:
nixos-minimal-20.09-x86-64-linux
(cherry picked from commit 70a8e9ace9)
Otherwise you get errors like this when running `thermald.service` from
the `services.thermald` module:
```
[WARN]22 CPUID levels; family:model:stepping 0x6:8e:a (6:142:10)
[WARN]Polling mode is enabled: 4
[WARN]sensor id 10 : No temp sysfs for reading raw temp
I/O warning : failed to load external entity "/nix/store/7d7cfc1949g7n7ywx47a0dsfz3b3rix5-thermald-1.9.1/etc/thermald/thermal-conf.xml"
[WARN]error: could not parse file /nix/store/7d7cfc1949g7n7ywx47a0dsfz3b3rix5-thermald-1.9.1/etc/thermald/thermal-conf.xml
[WARN]sysfs open failed
I/O warning : failed to load external entity "/nix/store/7d7cfc1949g7n7ywx47a0dsfz3b3rix5-thermald-1.9.1/etc/thermald/thermal-conf.xml"
[WARN]error: could not parse file /nix/store/7d7cfc1949g7n7ywx47a0dsfz3b3rix5-thermald-1.9.1/etc/thermald/thermal-conf.xml
I/O warning : failed to load external entity "/nix/store/7d7cfc1949g7n7ywx47a0dsfz3b3rix5-thermald-1.9.1/etc/thermald/thermal-conf.xml"
[WARN]error: could not parse file /nix/store/7d7cfc1949g7n7ywx47a0dsfz3b3rix5-thermald-1.9.1/etc/thermald/thermal-conf.xml
```
(cherry picked from commit 9fc8856b25)
This avoids glibc verions mismatches in vscode terminal, as
LD_LIBRARY_PATH leaks into terminal and break with user installed
executables.
(cherry picked from commit 40d7ce7828)
kwallet sets a limit of 1000 for a single characters for environment
variables read from the socket[1]. wrapQtApps gives us a huge value
for QT_PLUGIN_PATH (up to 13000 bytes on my system!) Since this was
overflowing, the Qt plugin loading mechanism was hitting a segfault
when it was trying to parse the truncated QT_PLUGIN_PATH.
So for now, we can just unset QT_PLUGIN_PATH in the pam_kwallet_init
script. kwalletd5 has its own QT_PLUGIN_PATH which it can use.
This problem occured on 20.03, but not 19.09. It’s unclear what
changes were made in that time, but likely that previously we weren’t
getting a QT_PLUGIN_PATH set in the plasma5 startup at all. This means
that in 19.09 our QT_PLUGIN_PATH value must have been small enough to
fit into the 1000 char limit.
Fixes#77290
[1]: bc9713e272/src/runtime/kwalletd/main.cpp (L44)
/cc @ttuegel
(cherry picked from commit f0db4de598)
Also removed `pkgs.hydra-flakes` since flake-support has been merged
into master[1]. Because of that, `pkgs.hydra-unstable` is now compiled
against `pkgs.nixFlakes` and currently requires a patch since Hydra's
master doesn't compile[2] atm.
[1] https://github.com/NixOS/hydra/pull/730
[2] https://github.com/NixOS/hydra/pull/732
(cherry picked from commit 0f5c38feed)
This allows to have multiple certificates with the same common name.
Lego uses in its internal directory the common name to name the certificate.
fixes#84409
(cherry picked from commit d7ff6ab94a)
Fixes the following error when attempting to build packages using this
compiler:
<no location info>: error:
Warning: Couldn't figure out LLVM version!
Make sure you have installed LLVM 3.9
<no location info>: error: ghc: could not execute: opt
(cherry picked from commit 31f557c88f)
Building Chromium 82 requires LLVM 10 for the new argument
"-fintegrated-cc1". LLVM 9 fails with:
clang++: error: unknown argument: '-fintegrated-cc1'
(cherry picked from commit 1d961a4c6d)
This can e.g. save around 150k lines of unnecessary log messages which
take up around 66% of the total lines (based on a log of 80.0.3987.100):
29527 warning: unknown warning option '-Wno-bitwise-conditional-parentheses'; did you mean '-Wno-bitwise-op-parentheses'? [-Wunknown-warning-option]
29527 warning: unknown warning option '-Wno-builtin-assume-aligned-alignment' [-Wunknown-warning-option]
29527 warning: unknown warning option '-Wno-deprecated-copy'; did you mean '-Wno-deprecated'? [-Wunknown-warning-option]
29527 warning: unknown warning option '-Wno-final-dtor-non-final-class'; did you mean '-Wno-abstract-final-class'? [-Wunknown-warning-option]
29527 warning: unknown warning option '-Wno-implicit-int-float-conversion'; did you mean '-Wno-implicit-float-conversion'? [-Wunknown-warning-option]
(cherry picked from commit 9f3914824d)
Many of the tmux plugins had not been updated in some time. This PR:
- Updates all of them to the latest version. This is notable because `tmux 3.0`
has come out recently, and some of them have compatibility fixes for the new
version (e.g., `vim-tmux-navigator`), as well as general performance
improvements and bugfixes for many of them.
- Uses `fetchFromGitHub`, which is both more performant and hashed mirror friendly.
- Adds the standard `version = "unstable-YYYY-MM-DD"`, which makes it easy to
determine at a glance how old/unmaintained some of these are.
- Adds the standard `pname` for overlay friendliness
(cherry picked from commit d5ccc59056)
Adding this as a new attribute as software is likely going to break when
we switch the default from the 1.7 branch to 1.8.
(cherry picked from commit 1859b5a5ae)
Updated the checksum and the version of the brave package.
(cherry picked from commit 7a80ead781153ff40ab35ca02aef9d732e74f7e6)
Reason: The browser must be kept up-to-date
It seems like all QT apps which use dynamic plugins should be wrapped
with `wrapQtAppsHook`. However, rockbox-utility is still not wrapped,
therefore fails to launch.
This change adds `qt5.wrapQtAppsHook` to nativeBuildInputs of
rockbox-utility.
(cherry picked from commit 861df8abd5)
Them removing cerbere and registering with the SessionManager
should make shutdown very fast. This was even done in plank [0]
which was the last factor outside cerbere causing this.
[0]]: a8d2f255b2
Allow build pass by disabling test. Isolated issue to
test_sockets.py::TestAIOSockets::test_sock_close_add_reader_race.
This test is supposed to be skipped, but it isn't for some reason,
so we disable it instead.
See uvloop#284 (https://github.com/MagicStack/uvloop/pull/284)
for full details. Don't know why this test isn't properly skipped.
(cherry picked from commit 364909d535)
This is a backport to support building stable firefox version on the
stable release channel. Firefox has some very strict requirements on
it's dependencies. Since we do not want to use bundled versions of
dependencies this backport is required fore Firefox >=74.
This is a backport to support building stable firefox version on the
stable release channel. Firefox has some very strict requirements on
it's dependencies. Since we do not want to use bundled versions of
dependencies this backport is required fore Firefox >=74.
This is an backward incompatible change from upstream dhcpcd [0], as
this could have easily locked me out of my box.
As dhcpcd doesn't allow to use only a blacklist (denyinterfaces in
dhcpcd.conf) of devices and use all remaining devices, while explicitly
allowing some interfaces like bridges, I think the best option would be
to not change anything about it and just educate the users here about
that edge case and how to solve it.
[0] https://roy.marples.name/archives/dhcpcd-discuss/0002621.html
Because ProtectKernelModules implies NoNewPrivileges, postfix's sendmail
executable, which is setgid, wasn't able to send mail.
(cherry picked from commit fdc36e2c89)
When used as a global override, it breaks most of the options in the
mysql module, such as ensureDatabases, ensureUsers, initialDatabases,
initialScript.
We could use `.client` there, but if the reasoning behind this was
closure size reduction, we now end up with the same (or a bigger)
runtime closure and more complexity.
Apart from the options exposed by the mysql module, the client is also
likely to be required for local backups or DBA tasks anyways.
Instead of dealing with all the increased complexity of this for no
arguable benefit, let's just remove the `withoutClient` argument.
Storage space on mysql servers shouldn't be that much of an issue.
Closes#82428.
(cherry picked from commit 4b8d66aa72)
This allows you to specify the system-wide flake registry. One use is
to pin 'nixpkgs' to the Nixpkgs version used to build the system:
nix.registry.nixpkgs.flake = nixpkgs;
where 'nixpkgs' is a flake input. This ensures that commands like
$ nix run nixpkgs#hello
pull in a minimum of additional store paths.
You can also use this to redirect flakes, e.g.
nix.registry.nixpkgs.to = {
type = "github";
owner = "my-org";
repo = "my-nixpkgs";
};
(cherry picked from commit 74e7ef35fe)
This helps kpathsea to find texmf.cnf in some cases. For example,
dvipng was trying to look for it in
/nix/store/<hash>-texlive-dvipng.bin-2019/ instead of
/nix/store/<hash>-texlive-combined-full-2019/.
(cherry picked from commit 91c9f2ab5c)
cc #83816
The webrtc code suffered from a race condition when used
with Pulseaudio. This lead to audio input breaking every
couple of minutes during a webrtc session.
(cherry picked from commit 81b18c3711)
Backport of llvmPackages_10 since Chromium 83 will depend on it.
See https://github.com/NixOS/nixpkgs/pull/83350#issuecomment-605994185
llvmPackages_10: copy llvmPackages_9
* starting with rc2
* make `lldb` compilable again on Darwin
* separate out manpage creation for `lldb` into a new derivation
* minor tweaks to the patching of sources,
some of which are backportable to earlier versions
(cherry picked from commit f111c6f9ce)
llvmPackages_10: rc2 -> rc3
http://lists.llvm.org/pipermail/llvm-dev/2020-March/139729.html
Additionally cherry-picked 3 commits from `llvm-project/master`:
- llvm/llvm-project@d21664c
- llvm/llvm-project@3a0f6e6
- llvm/llvm-project@87dac7d
such that clang can automatically pick up the polly plugin from the
`llvm-polly` build.
(cherry picked from commit 3a84353edb)
llvmPackages_10: rc3 -> rc4
Only needed to update hashes and the version.
Updated comment for extension handling patch
(cherry picked from commit 0ec3f4e26b)
llvmPackages_10: removed extra polly-build
There is no good reason to have separate builds for polly and no-polly
versions. wwwwwThe reason for the two versions was (as far as I can
tell) to defer rebuilds (see ed60483257).
Polly is now enabled by default.
(cherry picked from commit e9aa8770ea)
llvmPackges_10: rc4 -> rc5
updated versino and hashes for new rc
(cherry picked from commit cdee144dfc)
llvmPackages_10: rc5 -> release
updated hashes and url
updated comment regarding version/release_version to make it clearer
(cherry picked from commit 4665b2a9a2)
fetchpatch can't be used here and fetchurl from GitHub
like in PR #82928 has the risk of breaking the hash later;
fortunately the patches aren't too large.
(cherry picked from commit 2071e3be28)
The build is currently broken due to failure to build `darcs` to fetch the src
package. The homepage is already their GitHub repo, and it appears to be the
active src of development anyways. See #83718
I came across this while debugging this failure:
https://hydra.nixos.org/build/115510612
Note that the `application` dependency *does* succeed on Hydra, because it's
already on local disk in Hydra's store, but I cannot rebuild locally because it
has prefer local builds.
https://hydra.nixos.org/build/115512559
This package is not reproducible on 20.03 or buildable outside of Hydra, so I
intend to backport the fix.
CC @NixOS/nixos-release-managers
ZHF: #80379
(cherry picked from commit 2c5fe63fbe)
It only increases the closure size by 0.5M and users who do not set
the NixOS option `hardware.pulseaudio.package = pkgs.pulseaudioFull;`
will be stumped by their bluetooth audio not working.
(cherry picked from commit e41f3d9ef3)
In contrast to e.g. Telegram or Slack, Skype does not show an app
indicator in the GNOME tray. This is quite annoying, since Skype will
continue to run in the background when its main window is closed, but
there is no way to access it.
This change adds libappindicator-gtk3 to the rpath to enable app
indicator support.
which was deprecated in 2018 and is now gone for good. I guess many
won’t notice because the nix-cache kept the files around?
(cherry picked from commit
b872b8a200 and 29ca177c68)
...and remove superfluous dependency files (*.d).
...and copy dSYM directories on Mac OS when in release=false mode.
(cherry picked from commit 782b304dba)
As it turns out Darwin does most of the things differently then "normal"
systems. They are using a different shared library extension and require
an obscure commandline parameter that has to be added to every build
system out there. That issue seems to be with clang on Darwin as on
Linux that flag isn't required to build the very same tests (when using
clang).
After adjusting these two details the tests are running fine on the
darwin box that I was able to obtain.
(cherry picked from commit c8de31baa6)
* Catalyst::Plugin::Unicode::Encoding has been merged into Catalyst::Runtime
* Test::More is apparently part of Perl core modules since 5.6.2
(cherry picked from commit dc88e94ff1)
- Keberos is a dependency that you really want included in the pkg,
this is also needed to run the test suite by default
(cherry picked from commit 36a1d1023a)
Upgrades Hydra to the latest master/flake branch. To perform this
upgrade, it's needed to do a non-trivial db-migration which provides a
massive performance-improvement[1].
The basic ideas behind multi-step upgrades of services between NixOS versions
have been gathered already[2]. For further context it's recommended to
read this first.
Basically, the following steps are needed:
* Upgrade to a non-breaking version of Hydra with the db-changes
(columns are still nullable here). If `system.stateVersion` is set to
something older than 20.03, the package will be selected
automatically, otherwise `pkgs.hydra-migration` needs to be used.
* Run `hydra-backfill-ids` on the server.
* Deploy either `pkgs.hydra-unstable` (for Hydra master) or
`pkgs.hydra-flakes` (for flakes-support) to activate the optimization.
The steps are also documented in the release-notes and in the module
using `warnings`.
`pkgs.hydra` has been removed as latest Hydra doesn't compile with
`pkgs.nixStable` and to ensure a graceful migration using the newly
introduced packages.
To verify the approach, a simple vm-test has been added which verifies
the migration steps.
[1] https://github.com/NixOS/hydra/pull/711
[2] https://github.com/NixOS/nixpkgs/pull/82353#issuecomment-598269471
(cherry picked from commit bd5324c4fc)
It seems the quoting breaks it just like in da587daae5
(cherry picked from commit e50bb280cbf5339ed671b0a7208e6aba4002c713)
(cherry picked from commit f8ccef5edb)
Due to 9pnet_virtio bugs, /nix is no longer available after
hibernation. It happens to work on x86_64, but not on other
platforms.
(cherry picked from commit d85fb28414)
fix: Adding libtool to allow darwin compiles
Libtool seems to be required for mongodb to compile on darwin.
fix: Marking MongoDB as broken on aarch64
fix: Adding libtools to the pkg imports
Update mongodb to 4.0.4
(cherry picked from commit e9bec1adf6)
According to the Cargo documentation:
> The build script does not have access to the dependencies listed in
> the dependencies or dev-dependencies section (they’re not built
> yet!). Also, build dependencies are not available to the package
> itself unless also explicitly added in the [dependencies] table.
https://doc.rust-lang.org/cargo/reference/build-scripts.html
This change separates linkage of regular dependencies and build
dependencies.
(cherry picked from commit ea6e048c37)
* Make errors include the crate name and make them much more prominent.
* Move more code into lib.sh
* Already source generated logging code and lib.sh in configure
(cherry picked from commit 04e7462ee6)
By overriding each dependency on every level of the dependency tree we
are creating a lot of unnecessary instances of the same derivation
Looking at the output size of `nix-instantiate --trace-function-calls
-vvvv …` and the execution time I got about a 10x improvement after
applying this change.
It was probably good intentions that lead to these overrides but in
practice no tooling (that I know of) really needs this. `carnix` and
`crate2nix` are fine without those overrides. Furthermore I believe that
it is the job of the tooling around `buildRustCrate` to provide a
coherent set of overrides. By not enforcing all of the overrides, debug
flags, verbosity, … to be the same throughout the closure we also allow
consumers to override specific aspects of the crates. Some (older?)
crates might need different `crateOverrides` then newer crates with the
same name. Currently such situations can not (easily) be implemented
with the override in-place.
(cherry picked from commit be5597fc9d)
Currently fails to build on python 3.8 due to an overly restrictive version bound.
ZHF: #80379
CC @NixOS/nixos-release-managers
(cherry picked from commit a65e052e4c)
If the host network stack is slow to start, the alertmanager fails to
start with this error message:
caller=main.go:256 msg="unable to initialize gossip mesh" err="create memberlist: Failed to get final advertise address: No private IP address found, and explicit IP not provided"
This bug can be reproduced by shutting down the network stack and
restarting the alertmanager.
Note I don't know why I didn't hit this issue with previous
alertmanager releases.
(cherry picked from commit 39621bb8de)
dependencies:
perlPackages.BytesRandomSecure: init at 0.29
perlPackages.CryptRandomSeed: init at 0.03
perlPackages.CryptRandomTESHA2: init at 0.01
(cherry picked from commit 3aade16ff3)
While our ETag patch works pretty fine if it comes to serving data off
store paths, it unfortunately broke something that might be a bit more
common, namely when using regexes to extract path components of
location directives for example.
Recently, @devhell has reported a bug with a nginx location directive
like this:
location ~^/\~([a-z0-9_]+)(/.*)?$" {
alias /home/$1/public_html$2;
}
While this might look harmless at first glance, it does however cause
issues with our ETag patch. The alias directive gets broken up by nginx
like this:
*2 http script copy: "/home/"
*2 http script capture: "foo"
*2 http script copy: "/public_html/"
*2 http script capture: "bar.txt"
In our patch however, we use realpath(3) to get the canonicalised path
from ngx_http_core_loc_conf_s.root, which returns the *configured* value
from the root or alias directive. So in the example above, realpath(3)
boils down to the following syscalls:
lstat("/home", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0
lstat("/home/$1", 0x7ffd08da6f60) = -1 ENOENT (No such file or directory)
During my review[1] of the initial patch, I didn't actually notice that
what we're doing here is returning NGX_ERROR if the realpath(3) call
fails, which in turn causes an HTTP 500 error.
Since our patch actually made the canonicalisation (and thus additional
syscalls) necessary, we really shouldn't introduce an additional error
so let's - at least for now - silently skip return value if realpath(3)
has failed.
However since we're using the unaltered root from the config we have
another issue, consider this root:
/nix/store/...-abcde/$1
Calling realpath(3) on this path will fail (except if there's a file
called "$1" of course), so even this fix is not enough because it
results in the ETag not being set to the store path hash.
While this is very ugly and we should fix this very soon, it's not as
serious as getting HTTP 500 errors for serving static files.
I added a small NixOS VM test, which uses the example above as a
regression test.
It seems that my memory is failing these days, since apparently I *knew*
about this issue since digging for existing issues in nixpkgs, I found
this similar pull request which I even reviewed:
https://github.com/NixOS/nixpkgs/pull/66532
However, since the comments weren't addressed and the author hasn't
responded to the pull request, I decided to keep this very commit and do
a follow-up pull request.
[1]: https://github.com/NixOS/nixpkgs/pull/48337
Signed-off-by: aszlig <aszlig@nix.build>
Reported-by: @devhell
Acked-by: @7c6f434c
Acked-by: @yorickvP
Merges: https://github.com/NixOS/nixpkgs/pull/80671
Fixes: https://github.com/NixOS/nixpkgs/pull/66532
(cherry picked from commit e1d63ada02)
This makes it possible to use chromium headless with WebGL
(e.g. for webdriver tests) without having to rebuild from source.
The upstram default is to enable, thus simply removing our disabling switch.
Also fixes#41918.
(cherry picked from commit 015bb28ae1)
Fixes broken build by backporting https://github.com/NixOS/nixpkgs/pull/81577
and previous update.
CC @NixOS/nixos-release-managers
ZHF: #80379
(cherry picked from commit 908c6e8214a3933d43f55f5c4ae6df0572c34568)
The app is still maintained upstream, but they aren't cutting releases on
crates.io anymore:
https://crates.io/crates/ion-shell
This fixes the build with the latest Rust toolchain by upgrading to the current
commit off the project's `master`.
ZHF: #80379
(cherry picked from commit 16cdff0711)
It is currently failing on master and 20.03. I spent some time reading the src
code but was not able to figure out why the env var activation is not working.
Since this is currently failing, and since it's dying alongside python 2 anyways
I propose we just disable the 1 failing test.
There's some more information inline in the comment if someone wants to fix this
or dig further.
(cherry picked from commit 643d10295d)
It's impossible to move two major-versions forward when upgrading
Nextcloud. This is an issue when comming from 19.09 (using Nextcloud 16)
and trying to upgrade to 20.03 (using Nextcloud 18 by default).
This patch implements the measurements discussed in #82056 and #82353 to
improve the update process and to circumvent similar issues in the
future:
* `pkgs.nextcloud` has been removed in favor of versioned attributes
(currently `pkgs.nextcloud17` and `pkgs.nextcloud18`). With that
approach we can safely backport major-releases in the future to
simplify those upgrade-paths and we can select one of the
major-releases as default depending on the configuration (helpful to
decide whether e.g. `pkgs.nextcloud17` or `pkgs.nextcloud18` should be
used on 20.03 and `master` atm).
* If `system.stateVersion` is older than `20.03`, `nextcloud17` will be
used (which is one major-release behind v16 from 19.09). When using a
package older than the latest major-release available (currently v18),
the evaluation will cause a warning which describes the issue and
suggests next steps.
To make those package-selections easier, a new option to define the
package to be used for the service (namely
`services.nextcloud.package`) was introduced.
* If `pkgs.nextcloud` exists (e.g. due to an overlay which was used to
provide more recent Nextcloud versions on older NixOS-releases), an
evaluation error will be thrown by default: this is to make sure that
`services.nextcloud.package` doesn't use an older version by accident
after checking the state-version. If `pkgs.nextcloud` is added
manually, it needs to be declared explicitly in
`services.nextcloud.package`.
* The `nixos/nextcloud`-documentation contains a
"Maintainer information"-chapter which describes how to roll out new
Nextcloud releases and how to deal with old (and probably unsafe)
versions.
Closes#82056
(cherry picked from commit 702f645aa8)
This reverts commit 7cb100b683.
This appears to break at least the `container`-backend of `nixops`: when
running `switch-to-configuration` within `nixos-container run`, the
running `systemd`-instance gets reloaded which appears to kill the
`systemd-run` command and causes `nixos-container run` to hang.
The full issue is reported in the original PR[1].
[1] https://github.com/NixOS/nixpkgs/pull/67332#issuecomment-604145869
There were a number of fixes that were not backported. I made a branch
with those cherry-picked fixes to be merged into both 20.03 and master
(not changing master), to ensure the two release branches didn't diverge
when they shouldn't.
I like this "apply the fixes to the comment ancester and then merge
both" approach because it makes it much easier to avoid backporting
issues. I suspect I'll be making more fixes to both in the future.
Some changes were made after final review of the package. There was a
missing runtime dependency that was discovered after merge of the
backport
(cherry picked from commit 9fe4a634c1)
Reason: The dependency can make the package work or not
The build is currently broken on master and 20.03. This upgrades to the latest
version and also disables the bad py2 test. I spent a long time trying to figure
out what the issue is, but since it's disabled upstream on python3 anyways let's
just skip it on python2 as well.
ZHF: #80379
(cherry picked from commit e9979380cf325912ccbd2c945a7963d667f1b76d)
Since #81475 this caused the wrapper to be empty of entries from
wrapGAppsHook because the wrapGAppsHook function doesn't add
them anymore, and was moved to gappsWrapperArgsHook. Instead
of just running that in postBuild it's more future proof to make this
use stdenv.mkDerivation because we want to mess around with the
generic builder.
(cherry picked from commit a9e7e93311)
Since #81475 this caused the wrapper to be empty of entries from
wrapGAppsHook because the wrapGAppsHook function doesn't add
them anymore, and was moved to gappsWrapperArgsHook. Instead
of just running that in postBuild it's more future proof to make this
use stdenv.mkDerivation because we want to mess around with the
generic builder.
(cherry picked from commit db41c787f4)
The tag points to the same commit hash, so the binary
is unchanged.
Signed-off-by: David Anderson <dave@natulte.net>
(cherry picked from commit 3fa813e820)
Fixes a severe bug with subnet routing.
Signed-off-by: David Anderson <dave@natulte.net>
(cherry picked from commit f61f686dfea53a0e5bb3faf0a5307dcc8f8d03aa)
Up to including nixos-19.09 configure fall back and included right
libraries. Since nixos-20.03 pkg-config returns a valid value for opengl, but
opengl misses glx symbols.
(cherry picked from commit d315b3d267)
Previously top-level/python-packages.nix called spyder-kernels v0.5 for
Py2k. Now both v0.5 and v1.8 (default.nix) are in pythonPackages, as
required by cq-editor and spyder v4 respectively.
v0.5 also now comes from GitHub instead of PyPi, with checks enabled.
(cherry picked from commit a1f45198148197dbf2a460be17a7fb50686b1b4e)
NixOS 20.03 is built on kernel 5.4 and 19.09 is on 4.19, so we should update
this option to the highest value possible, per linked upstream instructions from
Amazon.
(cherry picked from commit 129176452c)
While renaming `networking.defaultMailServer` directly to
`services.ssmtp` is shorter and probably clearer, it causes eval errors
due to the second rename (directDelivery -> enable) when using e.g. `lib.mkForce`.
For instance,
``` nix
{ lib, ... }: {
networking.defaultMailServer = {
hostName = "localhost";
directDelivery = lib.mkForce true;
domain = "example.org";
};
}
```
would break with the following (rather confusing) error:
```
error: The option value `services.ssmtp.enable' in `/home/ma27/Projects/nixpkgs/nixos/modules/programs/ssmtp.nix' is not of type `boolean'.
(use '--show-trace' to show detailed location information)
```
(cherry picked from commit fc316f7b31)
Updates `gitea` to the latest version available[1]. Also ensured that
upgrading from `gitea-1.9` (used on NixOS 19.09) to `1.11.3` works
seamlessly.
The derivation required a few more changes this time since `gitea` uses
`npm` now to build the frontend[2]. When using the default tarball from
GitHub, we'd have to build the frontend manually. By fetching a custom
tarball published on every release, we get a prebuilt frontend
(as it was the case on previous versions) and build the backend only from
source.
Co-authored-by: kolaente <k@knt.li>
Closes#80175
[1] https://github.com/go-gitea/gitea/releases/tag/v1.11.3
[2] https://github.com/go-gitea/gitea/issues/10253
(cherry picked from commit cbceee8e97)
Previously, systemd.network.links was only respected with networkd
enabled, but it's really udev taking care of links, no matter if
networkd is enabled or not.
With our module fixed, there's no need to manually manage the text file
anymore.
This was originally applied in 3d1079a20d,
but was reverted due to 1115959a8d causing
evaluation errors on hydra.
(cherry picked from commit 4e53f84c79)
This mirrors the behaviour of systemd - It's udev that parses `.link`
files, not `systemd-networkd`.
This was originally applied in 36ef112a47,
but was reverted due to 1115959a8d causing
evaluation errors on hydra.
(cherry picked from commit 355c58e485)
nixos/manual: fix build
(cherry picked from commit d96bd3394b)
Keep brave updated to the latest release
(cherry picked from commit 418e3e41cf22753911c5f474d8bd89252ec76ce0)
Reasons: Keep the browser up-to-date as much as possible.
Simply keep up to date the cli since it is used to connect to a VPN.
(cherry picked from commit eb96574e9df3aba387c4abe902b154398271becf)
Reason: A tool to communicate with a VPN provider should be kept
up-to-date
The release-20.03-aarch64 jobset on hydra only evals for aarch64, so the
x86_64 jobs do not exists. We need to make sure that the tested job only
aggregates jobs that actually exist.
This commit solves the issue by generating the tested job constituents
names based on the supported systems.
The hydraPlatforms have to be set on the kicad package itself, that can be
checked using:
echo ":p { inherit kicad kicad-small kicad-unstable; }" | nix repl ./pkgs/top-level/release.nix
This commit disables build of all kicad variants that require downloading
packages3d, which currently fail on hydra with the "Output limit exceeded"
status. This leaves Hydra with only building the kicad-small, which will allow
us to cache the build of kicad-base as well as all libraries except of
packages3d.
(cherry picked from commit ebe5f10794)
This fixes the build, also of
- eths-rlp
- vorbiscomment
- webify
which depend on binary-strict. Everything else that depends on
binary-strict remains broken, so this commit shouldn't break anything
that wasn't broken yet.
- Reverting the version of Starlette as FastAPI can not use anything
greater than 0.12.12. FastAPI is Starlette's only dependent.
- Use fetchurl instead of fetchPypi as this is now the preferred
method. This also makes the tests pass and, thus, the build, which
was failing.
Fixes#78744
My previous change broke when there are more packages than the maximum
number of layers. I had assumed that the `store-path-to-layer.sh` was
only ever passed a single store path, but that is not the case if
there are multiple packages going into the final layer. To fix this, we
loop through the paths going into the final layer, appending them to the
tar file and making sure they end up at the right path.
Fixes#61867 and #61505, bumps the ocaml version unison is built
against to 4.08. The patches included here appear in the trunk version
of unison, but were not backported to 2.51.2.
(cherry picked from commit 3355e8d1ca)
* Linkify all service options used in the code-examples.
* Demonstrated the use of `riot-web.override {}`.
* Moved the example how to configure a postgresql-database for
`matrix-synapse` to this document from the 20.03 release-notes.
(cherry picked from commit 849e16888f)
Announced in [1], versioned tarballs allow to make sure that a
specific version is fetched. This does not guarantee that all previous
versions are retained on the main mirrors.
Logically, we would want to first try to download versioned tarballs
from any mirror and only then try the unversioned ones. But right now
we only have two mirrors and only some of the tarballs are versioned
in texlive-2019, so the order is changed to not hammer the weak
tug.org mirror.
[1] https://tug.org/pipermail/tex-live/2019-September/044086.html
(cherry picked from commit 9f44a61f39)
The biber package is now at 2.14, but TextBibTeX is still required.
Few changes were needed for newly introduced scripts-extra path. This
broke some of our old tricks which were relying on having writable
script directories. The changes to the script locations made buildEnv
create symlinks to the script directories instead of directories of
symlinks to scripts. The changes to texlinks.sh and texlive/TeXLive
perl path were made because of this.
(cherry picked from commit 9752593eb0)
The shell script doesn't work very well in non-GNU environments like
darwin. This provides an implementation that uses just a single GNU tool
- gawk, thus reduces number of points of failure.
(cherry picked from commit d9fb53ddd6)
The package doesn't have a testsuite, but fails as the checkPhase is
missing appropriate locale configuration (usually taken from
`pkgs.glibcLocales`). Entirely disabling the `checkPhase` for now as
it's basically a no-op.
ZHF: #80379
See also https://hydra.nixos.org/build/114125176
(cherry picked from commit 1505633e2f)
These patches are gathered from different sources,
such as https://patchwork.kernel.org/patch/10862231/ for the
`gettid` patch.
Another patch comes from the issue in the AFL repository.
The ultimate goal is to get these patches upstream as well,
so we don't keep these general patches only within nixos.
A PR is created against Google/AFL
https://github.com/google/AFL/pull/79,
but it might take a while before it's landed, considering the history
of the project (there are more PRs open).
ZHF: #80379
Fixes issue #82232
Running haproxy with "DynamicUser = true" doesn't really work, since
it prohibits specifying a TLS certificate bundle with limited
permissions. This revives the haproxy user and group, but makes them
dynamically allocated by NixOS, rather than statically allocated. It
also adds options to specify which user and group haproxy runs as.
(cherry picked from commit bb7ad853fb)
The previously committed checksums seem to have been mistakenly taken
directly from fetchurl without fetchpatch normalization.
(cherry picked from commit adfb8a039b)
We started having issues with `pkgs.dockerTools.pullImage`, were it
would fail with:
```
FATA[0000] Error loading trust policy: open /etc/containers/policy.json: no such file or directory
```
It turns out that since `skopeo` was bumped to `0.1.40`, it was
accidentally no longer being built with a default policy.
This may happen again, see https://github.com/containers/skopeo/issues/787
(cherry picked from commit a646f4b454)
* The 'arm.patch' patch doesn't apply anymore.
* The 'build-arm-libopus.patch' patch isn't required anymore.
* See the mozilla phabricator link for the added patch.
Additionally, we are now *always* undconditionally applying all patches
to all architectures. That is, unless they have undesirable
side-effects, but those might not be fit for inclusion.
By applying all patches all the time, they'll be removed or replaced
when they stop applying.
(cherry picked from commit d4446c563d)
This package was last released in 2017, and no longer compiles with the latest
Rust compiler. It has just 1 commit from someone other than the original author
and appears to be a dead project.
(cherry picked from commit 27a0a1376b)
This avoids a possible surprise if the user is using `nixpkgs.system`
and `nesting.children`. `nesting.children` is expected to ignore all
parent configuration so we shouldn't propagate the user-facing option
`nixpkgs.system`. To avoid doing so, we introduce a new internal
option for holding the value passed to eval-config.nix, and use that
when recursing for nesting.
(cherry picked from commit ce416779bb)
The current behavior lets `system` default to
`builtins.currentSystem`. The system value specified to
`eval-config.nix` has very low precedence, so this should compose
properly.
Fixes#80806
(cherry picked from commit b83164a049)
In case of invalid chars, the error-message references "perl variables"
which is not the case here as the python-based framework is used.
(cherry picked from commit 6d14bac048)
Previously, systemd.network.links was only respected with networkd
enabled, but it's really udev taking care of links, no matter if
networkd is enabled or not.
With our module fixed, there's no need to manually manage the text file
anymore.
(cherry picked from commit 3d1079a20d)
The better way to fix this would be to backport the upstream sphinx
patch:
faedcc48cc
Unfortunately it doesn't apply cleanly and isn't worth the effort
of backporting. Let's hope we can switch to python3 sage and the recent
sphinx version that comes with it before this becomes a problem.
(cherry picked from commit 7133577405)
This is useful when buildLayeredImage is called in a generic way
that should allow simple (base) images to be built, which may not
reference any store paths.
(cherry picked from commit 6dab1b50a6)
Signed-off-by: Domen Kožar <domen@dev.si>
The current version of glibc implements support for kernels down to
3.2.0 (and we make sure to enable such support with apporopriate
--enable-kernel setting). The current RHEL6 operating system is based on
a maintained kernel based on 2.6.32 with lots of backports. We provide
basic support for this specific kernel by patching glibc to provide an
exception for this specific version of kernel. This allows for nixpkgs
software distribution to work on RHEL6 and it does so quite well with
almost no problems. There are, however, a few syscalls that are missing
in the 2.6.32 kernel, one of which is prlimit64. This commit provides a
fallback that uses an older {get,set}rlimit syscalls in cases when
prlimit64 is not available. This should streamline the experience for
nixpkgs users wanting to run it on RHEL6, namely, this fixes one of the
tests in findutils.
See also discussion in guix:
https://lists.gnu.org/archive/html/guix-devel/2018-03/msg00356.html
(cherry picked from commit 6740593bdd)
Version 1.1.11 (2020-03-08)
Compatibility notes:
When upgrading from borg 1.0.x to 1.1.x, please note:
read all the compatibility notes for 1.1.0*, starting from 1.1.0b1.
borg upgrade: you do not need to and you also should not run it.
borg might ask some security-related questions once after upgrading. You can answer them either manually or via environment variable. One known case is if you use unencrypted repositories, then it will ask about a unknown unencrypted repository one time.
your first backup with 1.1.x might be significantly slower (it might completely read, chunk, hash a lot files) - this is due to the --files-cache mode change (and happens every time you change mode). You can avoid the one-time slowdown by using the pre-1.1.0rc4-compatible mode (but that is less safe for detecting changed files than the default). See the --files-cache docs for details.
1.1.11 removes WSL autodetection (Windows 10 Subsystem for Linux). If WSL still has a problem with sync_file_range, you need to set BORG_WORKAROUNDS=basesyncfile in the borg process environment to work around the WSL issue.
Fixes:
fixed potential index corruption / data loss issue due to bug in hashindex_set, #4829 Please read and follow the more detailled notes close to the top of this document.
upgrade bundled xxhash to 0.7.3, #4891 0.7.2 is the minimum requirement for correct operations on ARMv6 in non-fixup mode, where unaligned memory accesses cause bus errors. 0.7.3 adds some speedups and libxxhash 0.7.3 even has a pkg-config file now.
upgrade bundled lz4 to 1.9.2
upgrade bundled zstd to 1.4.4
fix crash when upgrading erroneous hints file, #4922
extract:
fix KeyError for "partial" extraction, #4607
fix "partial" extract for hardlinked contentless file types, #4725
fix preloading for old (0.xx) remote servers, #4652
fix confusing output of borg extract --list --strip-components, #4934
delete: after double-force delete, warn about necessary repair, #4704
create: give invalid repo error msg if repo config not found, #4411
mount: fix FUSE mount missing st_birthtime, #4763#4767
check: do not stumble over invalid item key, #4845
info: if the archive doesn't exist, print a pretty message, #4793
SecurityManager.known(): check all files, #4614
Repository.open: use stat() to check for repo dir, #4695
Repository.check_can_create_repository: use stat() to check, #4695
fix invalid archive error message
fix optional/non-optional location arg, #4541
commit-time free space calc: ignore bad compact map entries, #4796
ignore EACCES (errno 13) when hardlinking the old config, #4730
--prefix / -P: fix processing, avoid argparse issue, #4769
New features:
enable placeholder usage in all extra archive arguments
new BORG_WORKAROUNDS mechanism, basesyncfile, #4710
recreate: support --timestamp option, #4745
support platforms without os.link (e.g. Android with Termux), #4901 if we don't have os.link, we just extract another copy instead of making a hardlink.
support linux platforms without sync_file_range (e.g. Android 7 with Termux), #4905
Other:
ignore --stats when given with --dry-run, but continue, #4373
add some ProgressIndicator msgids to code / fix docs, #4935
elaborate on "Calculating size" message
argparser: always use REPOSITORY in metavar, also use more consistent help phrasing.
check: improve error output for matching index size, see #4829
docs:
changelog: add advisory about hashindex_set bug #4829
better describe BORG_SECURITY_DIR, BORG_CACHE_DIR, #4919
infos about cache security assumptions, #4900
add FAQ describing difference between a local repo vs. repo on a server.
document how to test exclusion patterns without performing an actual backup
timestamps in the files cache are now usually ctime, #4583
fix bad reference to borg compact (does not exist in 1.1), #4660
create: borg 1.1 is not future any more
extract: document limitation "needs empty destination", #4598
how to supply a passphrase, use crypto devices, #4549
fix osxfuse github link in installation docs
add example of exclude-norecurse rule in help patterns
update macOS Brew link
add note about software for automating backups, #4581
AUTHORS: mention copyright+license for bundled msgpack
fix various code blocks in the docs, #4708
updated docs to cover use of temp directory on remote, #4545
add restore docs, #4670
add a pull backup / push restore how-to, #1552
add FAQ how to retain original paths, #4532
explain difference between --exclude and --pattern, #4118
add FAQs for SSH connection issues, #3866
improve password FAQ, #4591
reiterate that 'file cache names are absolute' in FAQ
tests:
cope with ANY error when importing pytest into borg.testsuite, #4652
fix broken test that relied on improper zlib assumptions
test_fuse: filter out selinux xattrs, #4574
travis / vagrant:
misc python versions removed / changed (due to openssl 1.1 compatibility) or added (3.7 and 3.8, for better borg compatibility testing)
binary building is on python 3.5.9 now
vagrant:
add new boxes: ubuntu 18.04 and 20.04, debian 10
update boxes: openindiana, darwin, netbsd
remove old boxes: centos 6
darwin: updated osxfuse to 3.10.4
use debian/ubuntu pip/virtualenv packages
rather use python 3.6.2 than 3.6.0, fixes coverage/sqlite3 issue
use requirements.d/development.lock.txt to avoid compat issues
travis:
darwin: backport some install code / order from master
remove deprecated keyword "sudo" from travis config
allow osx builds to fail, #4955 this is due to travis-ci frequently being so slow that the OS X builds just fail because they exceed 50 minutes and get killed by travis.
(cherry picked from commit dbff9b5479)
This prevents confusion by nix-env when installing packages by
derivation name, since there is another package named dust already
(cherry picked from commit ad126ee28e)
Includes some bugfixes/cleanups to the scripts and packaging, a run of the
updater and a bump of the version.
Fixes#75863
(cherry picked from commit 9131efe52d)
This fixes the situtation where, if `/usr/share/zoneinfo` was
inaccessible/didn't otherwise exist, `howard-hinnant-date` would
download and drop a `~/Downloads/tzdata` directory containing some
timezone information from IANA [1]. To avoid this, we make use of the
`tzdata`'s `zoneinfo`, preventing the dropping of random directories and
files.
[1] https://data.iana.org/time-zones/releases/tzdata2019c.tar.gz
(cherry picked from commit 25057960ce)
This fixes a bug which breaks the clock module. See
<https://github.com/Alexays/Waybar/issues/566>.
- Fix misspelled option. mkRenamedOptionModule is not used because the
option hasn't really worked before.
- Add missing cfg.telemetryPath arg to ExecStart.
- Fix mkdir invocation in test.
(cherry picked from commit e7ed7901a8)
The allowed values have changed in bd3319d28c.
0.15:
--log.level="info" Only log messages with the given severity or above. Valid levels: [debug, info, warn, error, fatal]
--log.format="logger:stderr"
Set the log target and format. Example: "logger:syslog?appname=bob&local=7" or "logger:stdout?json=true"
0.17:
--log.level=info Only log messages with the given severity or above. One of: [debug, info, warn, error]
--log.format=logfmt Output format of log messages. One of: [logfmt, json]
(cherry picked from commit 87f87fb3e9)
drive-by contributions, as I was playing around with this (it has better
support for the `num` library, it seems.)
js_of_ocaml: 3.4.0 -> 3.5.2
ocamlPackages.js_of_ocaml-ppx_deriving_json: use ppxlib-0.12.0
ocamlPackages.eliom: 6.8.0 → 6.10.1
ocamlPackages.ocsigen-toolkit: 2.2.0 → 2.5.0
ocamlPackages.ocsigen-start: 2.7.0 → 2.16.1
Co-authored-by: Vincent Laporte <Vincent.Laporte@gmail.com>
(cherry picked from commit 2d2a5a9b63)
Includes multiple security fixes mentioned in
https://about.gitlab.com/releases/2020/03/04/gitlab-12-dot-8-dot-2-released/
(unfortunately, no CVE numbers as of yet)
- Directory Traversal to Arbitrary File Read
- Account Takeover Through Expired Link
- Server Side Request Forgery Through Deprecated Service
- Group Two-Factor Authentication Requirement Bypass
- Stored XSS in Merge Request Pages
- Stored XSS in Merge Request Submission Form
- Stored XSS in File View
- Stored XSS in Grafana Integration
- Contribution Analytics Exposed to Non-members
- Incorrect Access Control in Docker Registry via Deploy Tokens
- Denial of Service via Permission Checks
- Denial of Service in Design For Public Issue
- GitHub Tokens Displayed in Plaintext on Integrations Page
- Incorrect Access Control via LFS Import
- Unescaped HTML in Header
- Private Merge Request Titles Leaked via Widget
- Project Namespace Exposed via Vulnerability Feedback Endpoint
- Denial of Service Through Recursive Requests
- Project Authorization Not Being Updated
- Incorrect Permission Level For Group Invites
- Disclosure of Private Group Epic Information
- User IP Address Exposed via Badge images
- Update postgresql (GitLab Omnibus)
(cherry-picked from commit c25756f91c)
Since we split wrapGAppsHook and move its variable initialization to preFixupPhases in #81475, it was getting run before glibPreFixupPhase which sets GSETTINGS_SCHEMAS_PATH variable gappsWrapperArgsHook depends on. Let's introduce this ugly hack to ensure glibPreFixupPhase will run before gappsWrapperArgsHook.
(cherry picked from commit 8e4f502fc6)
As outlined in #71447, postCommands should always be run if networking
in initrd is enabled. regardless if the configuration actually
succeeded.
(cherry picked from commit 589789997f)
The backport of this patch has been requested in #79532[1]. The diff is
slightly off the original commit since some changes from
ea7d02406b were needed, however this
commit shouldn't be backported as it potentially breaks existing setups.
[1] https://github.com/NixOS/nixpkgs/pull/79532#issuecomment-593511638
The way ruby loads gems and keeps track of their paths seems to not
always work very well when the gems are accessed through
symlinks. Ruby will then complain that the same files are loaded
multiple times; it relies on the file's full path to determine whether
the file is loaded or not.
This adds an option to simply copy all gem files into the environment
instead, which gets rid of this issue, but may instead result in major
file duplication.
No vulnerabilities are know so far (to me), but still I'd go this way.
Especially for 20.03 it seems better to deprecate it before official
release happens.
Current casualties:
$ ./maintainers/scripts/rebuild-amount.sh --print HEAD HEAD^
Estimating rebuild amount by counting changed Hydra jobs.
87 x86_64-darwin
161 x86_64-linux
(cherry picked from commit 7cda2823be)
Also python34 is not supported:
979e6fd2db
nixpkgs doesn't provide python34 anymore, so pythonOlder "3.5" is always
true and can be removed.
(cherry picked from commit d35009ee63)
cc #80940
This makes predictable interfaces names available as soon as possible
with udev by adding the default network link units to initrd which are read
by udev. Also adds some udev rules that are needed but which would normally
loaded from the udev store path which is not included in the initrd.
(cherry picked from commit 44e289f93b)
I am not sure if we still need the old packages, nothing explicitly
depends on polyml56 or polyml57 according to a grep, not sure if
external packages might (hol and isabelle depend on polyml, the latest
version).
(cherry picked from commit f4c29ebfc2)
New libffi doesn't have FFI_SYSV for x86/64 unix, this pulls in the
commit for the upstream version which fixes it, and ports that patch to
the 5.7 version. The 5.6 version is unchanged.
For ZHF: #80379
(cherry picked from commit f8c402ecad)
This bumps to the latest state of the systemd 242 stable, published at
https://github.com/systemd/systemd-stable/tree/v243-stable.
Should cover CVE-2020-1712.
Git Log:
f8dd0f2f15 (tag: v243.7, systemd-stable/v243-stable) Revert "Support Plugable UD-PRO8 dock"
1a5428c2ab hibernate-resume-generator: wait "infinitely" for the resume device
eb3148c468 (tag: v243.6) hwdb: update to v245-rc1
f14fa558ae Fix typo in function name
fb21e13e8e polkit: when authorizing via PK let's re-resolve callback/userdata instead of caching it
2e504c92d1 sd-bus: introduce API for re-enqueuing incoming messages
4d80c8f158 polkit: use structured initialization
54791aff01 polkit: on async pk requests, re-validate action/details
81532beddc polkit: reuse some common bus message appending code
4441844d58 bus-polkit: rename return error parameter to ret_error
31a1d569db shared: split out polkit stuff from bus-util.c → bus-polkit.c
560eb5babf test: adapt to the new capsh format
275b266bde meson: update efi path detection to gnu-efi-3.0.11
9239154545 presets: "disable" all passive targets by default
a827c41851 shared/sysctl-util: normalize repeated slashes or dots to a single value
fb1bfd6804 dhcp6: do not use T1 and T2 longer than one provided by the lease
ca43a515c6 network: fix implicit type conversion warning by GCC-10
421eca7edf bootspec: parse random-seed-mode line in loader.conf
34e21fc6de sd-boot: fix typo
df7b3a05c9 test: Synchronize journal before reading from it
9326efee71 sd-bus: fix introspection bug in signal parameter names
7bbdc56aaf efi: fix build.
486f8ca365 generator: order growfs for the root fs after systemd-remount-fs
56d442e29d loginctl: use /org/freedesktop/login1/session/auto when "lock-session" is called without argument
6ed1152282 Documentation update for x-systemd.{before,after}
dba3efa34a man: fix typo in systemd.netdev Xfrm example
6f9a8621d8 timesyncd: log louder when we refuse a server due to root distance
0637255d3b resolved: drop DNSSEC root key that is not valid anymore
9a135baa40 journal: don't use startswith() on something that is not a NUL-terminated string
1ff3972a0f test: add test for https://github.com/systemd/systemd/issues/14560
cac79b606b core: make sure StandardInput=file: doesn't get dup'ed to stdout/stderr by default
906ba9a67d pkgconf: add full generator paths
01b93e2c68 tree-wide: we forgot to destroy some bus errors
5c9455657e mount: make checks on perpetual mount units more lax
28c58beca1 core: never allow perpetual units to be masked
d3b044b3e7 typo: "May modify to" -> "May modify"
fd378d3d3c sysctl: downgrade message when we have no permission
db4fbf5c61 Clarify journald.conf MaxLevelStore documentation
c8365f71c0 logind: refuse overriding idle hint on tty sessions
cd91f567b6 cgroup: update only siblings that got realized once
c672dcd212 mount: mark an existing "mounting" unit from /proc/self/mountinfo as "just_mounted"
a592a40564 journalctl: Correctly handle combination of --reverse and --lines (fixes#1596)
0aa144ab1d journalctl: Correctly handle --show-cursor in combination with --until or --since and --reverse
3b803a5e66 core: fix re-realization of cgroup siblings
7549dd40fc core: propagate service state to socket in more load states
af6df343b2 man: describe "symlink" and "systemctl link" explicitly in UNIT FILE LOAD PATH
a3c1ce25a7 core: be more restrictive on the dependency types we allow to be created transiently
2b9ec8384c udev: don't import parent ID_FS_ data on partitions
ecd95c507c man: fix option name
0d4f06156b Support Plugable UD-PRO8 dock
7fba869abd gpt-auto: don't assume XBOOTLDR is vfat
494c281b67 man: fix documentation of IBM VIO device naming
7271fb056a man: slightly extend documentation on difference between ID_NET_NAME_ONBOARD and ID_NET_LABEL_ONBOARD
852ae28e68 boot: fix osrel parser
2613200370 udev: do not use exact match of file permission
46477397c1 network: lower the log-level of harmless message
7163b1fe86 hwdb: ignore keys added in kernel 5.5
92f90837dc systemctl: skip non-existent units in the 'cat' verb
a67227cc99 systemd.exec: document the file system for EnvironmentFile paths
cfb4c0aca5 systemd-analyze: fixed typo in documentation
017fddd998 test-condition: fix group check condition
9d5e3cb774 umount: show correct error message
252f1a5277 Revert "Drop dbus activation stub service"
20bbfac95e man: add section about user manager units
c93ef60212 man: add remote-*.targets to the bootup sequence
55e0f99689 time-util: also use 32bit hack on EOVERFLOW
7afe2ecb02 [man] note which UID ranges will get user journals
a43b67a4c9 [man] fix URL
dedb26a8d6 analyze: badness if neither of RootImage and RootDirectory exists
714c93862a initrd: make udev cleanup service confict trigger and settle too
8932407ae1 man: we support growing xfs too these days
19af11dc07 time-util: deal with systems where userspace has 64bit time_t but kernel does not
c90229d81d [import] fix stdin/stdout pipe behavior in import/export tar/raw
39910328da cryptsetup-generator: unconfuse writing of the device timeout
fc5e6c87a4 shared/install: log syntax error for invalid DefaultInstance=
409c94a407 shared/install: provide a nicer error message for invalid WantedBy=/Required= values
70e8c1978a seccomp: real syscall numbers are >= 0
a0a1977d9a seccomp: more comprehensive protection against libseccomp's __NR_xyz namespace invasion
7f936c60d5 network: set ipv6 mtu after link-up or device mtu change
b59d88cc62 man: fix typo in net-naming-scheme man page
c5e5ac0958 man: fix typos (#14304)
9a2f26564d ipv4ll: do not reset conflict counter on restart
bc9e1ebfdd Fix typo (duplicate "or")
c6cb71b7e7 network: if /sys is rw, then udev should be around
67dcdfd956 nspawn: do not fail if udev is not running
a7938a1bc6 Create parent directories when creating systemd-private subdirs
53aa44f873 network: do not return error but return UINT64_MAX if speed meter is disabled
65abf12674 core: swap priority can be negative
b1cf452ff5 systemctl: enhance message about kexec missing kernel
07a0e5b425 man: use mkswap@ instead of makeswap@
57dc017c6b journald: don't ask for the machine ID if we don't need it
ac392a57c0 journalctl: pager_close() calls fflush(stdout) anyway as first thing
ee7dfadc82 journald: remove unused field
471073f1b5 journalctl: return EOPNOTSUPP if pcre is not enabled
002ededb61 man: drop reference to machined, add one for journald instead
fd3bd4be3b pid1: make TimeoutAbortSec settable for transient units
eb2ef4d664 pid1: fix setting of DefaultTimeoutAbortSec
1d75e29b23 shared/ask-password-api: modify keyctl break value
a16b1ee7e5 cryptsetup: reduce the chance that we will be OOM killed
4836fb010a core: write out correct field name when creating transient service units
3e2c547f6d udevd: don't use monitor after manager_exit()
d42f7d45a8 Revert "udevd: fix crash when workers time out after exit is signal caught"
c9a287eee8 man/systemd.link: Add missing verb *be*
a67a3ae04b man: document all pager variables for systemctl and systemd
3a8fce3f38 core.timer: fix "systemd-analyze dump" and docs syntax inconsistencies wrt OnTimezoneChange=
fdffd284b6 core/service: downgrade "scheduling restart" message to debug
733e7f19d3 travis: add missing closing quote sign
0d7b7817fc systemd-tmpfiles: don't install timer when service isn't installed either
0e7f83cd2b pam_systemd: prolong method call timeout when allocating session
(cherry picked from commit 53488b27be)
* remove no-op substitution of s6_addr16 -> s6_addr
This string doesn't exist anymore in that file.
* clean up configureFlags
(cherry picked from commit 43ec75d470)
This adds a patch from debian to switch ipmitool to openssl 1.1.
Upstream seems to already carry a version of this but that is yet to be
part of a release.
(cherry picked from commit ad19bb5ff8)
Also separate directory and file permissions so the certificate files
don't end up with the executable bit.
Fixes#81335
(cherry picked from commit 3575555fa8)
This package uses CMake's install(EXPORT ...) command which assumes that
libraries are installed in the same location as the CMake files.
(cherry picked from commit bdbbe6f34f)
The current weekly setting causes every NixOS server to try to renew
its certificate at midnight on the dot on Monday. This contributes to
the general problem of periodic load spikes for Let's Encrypt; NixOS
is probably not a major contributor to that problem, but we can lead by
example by picking good defaults here.
The values here were chosen after consulting with @yuriks, an SRE at
Let's Encrypt:
* Randomize the time certificates are renewed within a 24 hour period.
* Check for renewal every 24 hours, to ensure the certificate is always
renewed before an expiry notice is sent out.
* Increase the AccuracySec (thus lowering the accuracy(!)), so that
systemd can coalesce the renewal with other timers being run.
(You might be worried that this would defeat the purpose of the time
skewing, but systemd is documented as avoiding this by picking a
random time.)
(cherry picked from commit 7b14bbd734)
* pass IOKit to libfido2
* Add a patch so that cmake uses lld flags when linking
* Upgrade from 1.3.0 to 1.3.1 (based off #80781)
* Specify CMAKE_INSTALL_LIBDIR so that the demo binaries link
correctly on macOS and libfido2.pc specifies correct arguments
(cherry picked from commit 099359afc7)
There have been a couple of patches floating around for about the last
18 months. While they originated with FreeBSD, but they've been
adopted by Gentoo and Debian as well---and the most straightforward
way to get access to them was from the Debian repository.
(cherry picked from commit b6b3e04759)
The subtest was mainly written to demonstrate the VRF-issues with a
5.x-kernel. However this breaks the entire test now as we have 5.4 as
default kernel. Disabling the test for now, I still need to find some
time to investigate.
ZHF: #80379
(cherry picked from commit 58c7a952a1)
We don't compile blender with alembic. The linux build is able to detect
that, but this is not done for darwin. This explicitly disables alembic
to fix blender build on darwin.
(cherry picked from commit ac560382c5)
cc #80155
nixpkgs prefers absolute install names. Replace the manually specified
relative install name with the standard hook.
(cherry picked from commit 1a73b69e20)
cc #81015
* nixos/gdm: Fix pulseaudio tmpfiles structure
Fix the following startup failure of the sound service in the gdm
session that was introduced by #75893:
```
Feb 16 11:44:15 qp pulseaudio[1432]: W: [pulseaudio] core-util.c: Failed to open configuration file '/run/gdm/.config/pulse//daemon.conf': Not a directory
Feb 16 11:44:15 qp pulseaudio[1432]: W: [pulseaudio] daemon-conf.c: Failed to open configuration file: Not a directory
Feb 16 11:44:15 qp systemd[1380]: pulseaudio.service: Main process exited, code=exited, status=1/FAILURE
Feb 16 11:44:15 qp systemd[1380]: pulseaudio.service: Failed with result 'exit-code'.
Feb 16 11:44:15 qp systemd[1380]: Failed to start Sound Service.
```
Co-authored-by: worldofpeace <worldofpeace@protonmail.ch>
(cherry picked from commit 44a4a3839c)
lego already bundles the chain with the certificate,[1] so the current
code, designed for simp_le, was resulting in duplicate certificate
chains, manifesting as "Chain issues: Incorrect order, Extra certs" on
the Qualys SSL Server Test.
cert.pem stays around as a symlink for backwards compatibility.
[1] 5cdc0002e9/acme/api/certificate.go (L40-L44)
(cherry picked from commit 8ecbd97f82)
Also disable tests until upstream test data issues are resolved.
See link in comment in code for more information.
(cherry picked from commit bf88bf47d1)
See https://hackage.haskell.org/package/store-0.7.2/changelog, 0.7.2 is just an
update to fix compilation with vector >= 0.12.1.1
As such this also isn't needed on master, as the new version gets there
automatically through hackage updates
Release notes:
irc: fix crash when receiving a malformed message 352 (who)
irc: fix crash when a new message 005 is received with longer nick prefixes
irc: fix crash when receiving a malformed message 324 (channel mode) (CVE-2020-8955)
(cherry picked from commit 2d77fc3053)
- Drop the Boost patch. The patch does not apply anymore and the new
CMake infrastructure picks up boost.
- Distable setuptools reStructuredText check. This check fails, but
is (as far as I understand) an upstream bug.
- Clean up derivation a bit.
(cherry picked from commit 0688cba0cd)
Ugarit only works with CHICKEN 4, not CHICKEN 5 (which is the default
version in nixpkgs since 69ef0702), so use the compiler and egg tools
from `chickenPackages_4` for ugarit and ugarit-manifest-maker.
(cherry picked from commit a6d39ee9db)
Monotonic timer test expects sleep(200ms) to take at most 1s. On
loaded systems like hydra, it's possible for such a test to take
longer than 1 second.
Tests expecting sleep(200ms) to take at least 175ms weren't removed,
because load shouldn't cause sleep to be shorter.
(cherry picked from commit 58af3177c0)
This reverts commit 6a756af3e7.
Currently zshenv by default only set fpath and HELPDIR without exporting them.
A parent shell would also not set those variables usually as they are shell local.
It also sources a file called set-environment but this is protected by an
environment variable called __NIXOS_SET_ENVIRONMENT_DONE. Hence any modification
done by the parent shell should persist as long as __NIXOS_SET_ENVIRONMENT_DONE
is not unset.
This behavior deviates from what we do in bashrc and breaks common setups such
as tmux/mosh or screen.
Fixes#80437
(cherry picked from commit 55819e6c86)
It fails with:
src/gpu/gl/glx/GrGLMakeNativeInterface_glx.cpp:15:10: fatal error: GL/glx.h: No such file or directory
15 | #include <GL/glx.h>
(cherry picked from commit 3ad2c20fe6)
Otherwise it fails with:
In file included from /build/source/src/allegro/include/allegro/base.h:41,
from /build/source/src/allegro/include/allegro.h:25,
from /build/source/src/./she/alleg4/alleg_surface.h:11,
from /build/source/src/she/alleg4/alleg_surface.cpp:11:
/build/source/src/allegro/include/allegro/alcompat.h:44:22: error: conflicting declaration of C function 'fixed fadd(fixed, fixed)'
44 | AL_ALIAS(fixed fadd(fixed x, fixed y), fixadd(x, y))
| ^~~~
/build/source/src/allegro/include/allegro/internal/alconfig.h:164:49: note: in definition of macro 'AL_ALIAS'
164 | static __attribute__((unused)) __inline__ DECL \
| ^~~~
In file included from /nix/store/y57skwl8a5vbkrjrc30ygdw9vr1p6n19-gcc-9.2.0/include/c++/9.2.0/cmath:45,
from /nix/store/y57skwl8a5vbkrjrc30ygdw9vr1p6n19-gcc-9.2.0/include/c++/9.2.0/math.h:36,
from /build/source/src/./base/base.h:13,
from /build/source/src/./config.h:40,
from /build/source/src/she/alleg4/alleg_surface.cpp:8:
/nix/store/2v6pi2wj3lcsc3j48n7flx9mgqyii1lv-glibc-2.30-dev/include/bits/mathcalls-narrow.h:24:20: note: previous declaration 'float fadd(double, double)'
24 | __MATHCALL_NARROW (__MATHCALL_NAME (add), __MATHCALL_REDIR_NAME (add), 2);
| ^~~~~~~~~~~~~~~
(cherry picked from commit 0ded378b10)
The Hydra build [1] failed because it was unable to link to `LLVM9`; add
`llvmShared` to `passthru` in order to stay up to date with required
LLVM versions. Also quote the homepage URLs, since that's preferred.
[1] https://hydra.nixos.org/build/112989779/nixlog/1
(cherry picked from commit 502c0ee899)
The update checking mechanism references the tests, and thus
dbaafbbf73 turned it into a crash at
startup.
It isn't much use in nixpkgs, so we're better off without it.
(cherry picked from commit 0c403efde9)
The command module references the tests, and since all command modules
get imported at startup, dbaafbbf73
turned it into a startup crash.
Unless you're actively hacking on gsutil, this command isn't much use,
so we're better off without it.
(cherry picked from commit 5bda7e7fb2)
Same as efivar; I believe it doesn't really needs LTO. I checked:
nix build -f nixos/release-combined.nix nixos.iso_minimal.i686-linux
(cherry picked from commit f595677418)
/cc ZHF: #80379
Pantheon's sideload broke:
```
meson.build:17:0: ERROR: Could not generate cargs for flatpak:
Package ostree-1 was not found in the pkg-config search path.
Perhaps you should add the directory containing `ostree-1.pc'
to the PKG_CONFIG_PATH environment variable
Package 'ostree-1', required by 'flatpak', not found
```
https://hydra.nixos.org/build/113077888
ZHF: #80379
(cherry picked from commit 461ea02544)
start_kdeinit reads its environment over a pipe from start_kdeinit_wrapper. For
security, each environment entry must be smaller than 4kb by default. Qt-based
applications in Nixpkgs may have larger environments, and the recent upgrade to
Plasma 5.17 pushed start_kdeinit_wrapper over the limit. The limit is now
extended to 16kb.
This problem was not detected during testing because the failure is silent:
start_kdeinit will continue with an empty environment. In other circumstances,
this strategy might work, but it does not work on NixOS. This failure is now
treated as a fatal error.
Fixes: #79707
(cherry picked from commit c75860918f)
This avoids using NIX_CFLAGS_COMPILE by switching to hardeningDisable.
The hack is also only needed for darwin sources and is not specific to
clang.
Co-authored-by: Dmitry Kalinkin <dmitry.kalinkin@gmail.com>
(cherry picked from commit 5ef4af7afc)
cc #79794
Note that we need to build from a tarball now to get the vendored
crates. A bit ugly to fetch tarballs from Hydra...
(cherry picked from commit dd7f6b0c6b)
Due to the support of the systemd-logind API the udev rules aren't
required anymore which renders this module useless [0].
Note: brightnessctl should now require a working D-Bus setup and a valid
local logind session for this to work.
[0]: https://github.com/NixOS/nixpkgs/pull/79663
(cherry picked from commit 5282bc9a74)
This should improve the speed of bootstrapping process.
Cost of evaluation also decreases a bit,
but I don't expect that will be significant.
(cherry picked from commit f6519103bf)
This leads to inconsistent results between local builds and
Hydra. Also Nix is not a general purpose language, we shouldn't be
parsing .git from inside Nix code.
(cherry picked from commit f0f040c3f7)
See 3fadc45499. Since the beta channel is now also on 81 and the stable
channel will be on 81 soon, it makes sense to already add this
unconditionally for all channels.
(cherry picked from commit 67f349d224)
Backport of #80074.
Some display managers (e.g. SDDM) set the XDG_CURRENT_DESKTOP variable accroding to this parameter.
If this variable is not defined, there will be some problems (e.g. MATE doesn't have icons on the desktop).
Fixes https://github.com/NixOS/nixpkgs/issues/71427
(cherry picked from commit f7768c939a)
In 0945178b3c we decided that Perl-based
VM tests should be deprecated and will be removed between 20.03 and
20.09. So let's switch `nixos-build-vms(8)` to python as well (which is
entirely interactive, so other scripts won't break).
In my experience, the test-driver isn't used most of the time, so this
patch is mainly supposed to get rid of the (probably misleading)
deprecation warning when running `nixos-build-vms`. Apart from that, the
interface for python's test-driver is way nicer.
(cherry picked from commit c391343fcd)
Otherwise knot tries to write to non-writable directories.
This for example breaks dnssec signing.
While it's possible to overwrite these path in the configuration,
having a sane defaults is nicer.
(cherry picked from commit 6adc09ed30)
The test script's were unported.
It's unclear whether the preBuild or
postBuild will work as expect, due to
the linting of the test scripts.
(cherry picked from commit fa9af83e96)
3c74e48d9c was a bit too much, it updated
permissions of all files recursively, causing files to be readable by
the group.
This isn't a problem immediately after bootup, but on a new activation,
as tmpfiles.d get restarted then, updating the permission bits of
now-existing files.
This updates the `Z` to be a `z` (the non-recursive variant), and adds a
`d` to ensure a directory is created (which should be covered by the
initrd shell script anyway)
(cherry picked from commit 4c8bdd1c4f)
The nixos/moinmoin module uses gunicorn, however the 20.0 version
dropped python2 support which broke the module as there's no python3
port planned for moinmoin: http://moinmo.in/Python3
(cherry picked from commit d202e9eac2b3e17c8598b941a11025cef31c762f)
Attribute was removed in a4916fdea5 which
will land in 20.03, but breaks evaluation for everyone using
pinentry_qt5 on NixOS 19.09 when updating.
(cherry picked from commit 3d1007716c)
Test binaries are linked to the libraries at their install path, but
those are not installed when checkPhase executes.
(cherry picked from commit 7cc5d84cd7)
According to https://endoflife.software/programming-languages/server-side-scripting/ruby
ruby 2.4 will go end-of-life in march, where the new release of nixpkgs
will be cut. We won't be able to support it for security updates.
Remove all references to ruby_2_4 and add ruby_2_7 instead where
missing.
Mark packages that depend on ruby 2.4 as broken:
* chefdk
* sonic-pi
(cherry picked from commit bcdc90a3a7)
@@ -53,9 +53,9 @@ For package version upgrades and such a one-line commit message is usually suffi
To [backport a change into a release branch](https://nixos.org/nixpkgs/manual/#submitting-changes-stable-release-branches):
1. Take note of the commit in which the change was introduced into `master`.
2. Check out the target _release branch_, e.g. `release-19.09`. Do not use a _channel branch_ like `nixos-19.09` or `nixpkgs-19.09`.
2. Check out the target _release branch_, e.g. `release-20.03`. Do not use a _channel branch_ like `nixos-20.03` or `nixpkgs-20.03`.
3. Use `git cherry-pick -x <original commit>`.
4. Open your backport PR. Make sure to select the release branch (e.g. `release-19.09`) as the target branch of the PR, and link to the PR in which the original change was made to `master`.
4. Open your backport PR. Make sure to select the release branch (e.g. `release-20.03`) as the target branch of the PR, and link to the PR in which the original change was made to `master`.
You can rely on applications depending on the library set the necessary environment variables but that it often easy to miss. Instead we recommend to patch the paths in the source code whenever possible. Here are some examples:
You can rely on applications depending on the library setting the necessary environment variables but that is often easy to miss. Instead we recommend to patch the paths in the source code whenever possible. Here are some examples:
via <option>boot.initrd.luks.fido2Support</option>.
</para>
</listitem>
<listitem>
<para>
Predictably named network interfaces get renamed in stage-1. This means that it is possible
to use the proper interface name for e.g. Dropbear setups.
</para>
<para>
For further reference, please read <linkxlink:href="https://github.com/NixOS/nixpkgs/pull/68953">#68953</link> or the corresponding <linkxlink:href="https://discourse.nixos.org/t/predictable-network-interface-names-in-initrd/4055">discourse thread</link>.
</para>
</listitem>
<listitem>
<para>
The <package>matrix-synapse</package>-package has been updated to
Note that you are required to specify the desired version of PostgreSQL
(e.g. <literal>pkgs.postgresql_11</literal>). Since upgrading your
PostgreSQL version requires a database dump and reload (see below), NixOS
cannot provide a default value for
<xreflinkend="opt-services.postgresql.package"/> such as the most recent
release of PostgreSQL.
Note that you are required to specify the desired version of PostgreSQL (e.g. <literal>pkgs.postgresql_11</literal>). Since upgrading your PostgreSQL version requires a database dump and reload (see below), NixOS cannot provide a default value for <xreflinkend="opt-services.postgresql.package"/> such as the most recent release of PostgreSQL.
</para>
<!--
@@ -51,9 +43,7 @@ Type "help" for help.
-->
<para>
By default, PostgreSQL stores its databases in
<filename>/var/lib/postgresql/$psqlSchema</filename>. You can override this using
<xreflinkend="opt-services.postgresql.dataDir"/>, e.g.
By default, PostgreSQL stores its databases in<filename>/var/lib/postgresql/$psqlSchema</filename>. You can override this using <xreflinkend="opt-services.postgresql.dataDir"/>, e.g.
Major PostgreSQL upgrade requires PostgreSQL downtime and a few imperative steps to be called. To simplify this process, use the following NixOS module:
<programlisting>
containers.temp-pg.config.services.postgresql = {
enable = true;
package = pkgs.postgresql_12;
## set a custom new dataDir
# dataDir = "/some/data/dir";
};
environment.systemPackages =
let newpg = config.containers.temp-pg.config.services.postgresql;
Rebuild nixos configuration with the configuration above added to your <filename>configuration.nix</filename>. Alternatively, add that into separate file and reference it in <literal>imports</literal> list.
</para>
</listitem>
<listitem>
<para>
Login as root (<literal>sudo su -</literal>)
</para>
</listitem>
<listitem>
<para>
Run <literal>upgrade-pg-cluster</literal>. It will stop old postgresql, initialize new one and migrate old one to new one. You may supply arguments like <literal>--jobs 4</literal> and <literal>--link</literal> to speedup migration process. See <linkxlink:href="https://www.postgresql.org/docs/current/pgupgrade.html"/> for details.
</para>
</listitem>
<listitem>
<para>
Change postgresql package in NixOS configuration to the one you were upgrading to, and change <literal>dataDir</literal> to the one you have migrated to. Rebuild NixOS. This should start new postgres using upgraded data directory.
</para>
</listitem>
<listitem>
<para>
After upgrade you may want to <literal>ANALYZE</literal> new db.
Plugins collection for each PostgreSQL version can be accessed with
<literal>.pkgs</literal>. For example, for
<literal>pkgs.postgresql_11</literal> package, its plugin collection is
accessed by <literal>pkgs.postgresql_11.pkgs</literal>:
Plugins collection for each PostgreSQL version can be accessed with<literal>.pkgs</literal>. For example, for <literal>pkgs.postgresql_11</literal> package, its plugin collection is accessed by <literal>pkgs.postgresql_11.pkgs</literal>:
You can build custom PostgreSQL-with-plugins (to be used outside of NixOS) using
function <literal>.withPackages</literal>. For example, creating a custom
PostgreSQL package in an overlay can look like:
You can build custom PostgreSQL-with-plugins (to be used outside of NixOS) using function <literal>.withPackages</literal>. For example, creating a custom PostgreSQL package in an overlay can look like:
Pantheon is the desktop environment created for the elementary OS distribution. It is written from scratch in Vala, utilizing GNOME technologies with GTK 3 and Granite.
</para>
<sectionxml:id="sec-pantheon-enable">
<title>Enabling Pantheon</title>
<para>
All of Pantheon is working in NixOS and the applications should be available, aside from a few <linkxlink:href="https://github.com/NixOS/nixpkgs/issues/58161">exceptions</link>. To enable Pantheon, set
but please be aware using Pantheon without LightDM as a display manager will break screenlocking from the UI. The NixOS module for Pantheon installs all of Pantheon's default applications. If you'd like to not install Pantheon's apps, set
Wingpanel and Switchboard work differently than they do in other distributions, as far as using plugins. You cannot install a plugin globally (like with <option>environment.systemPackages</option>) to start using it. You should instead be using the following options:
to configure the programs with plugs or indicators.
</para>
<para>
The difference in NixOS is both these programs are patched to load plugins from a directory that is the value of an environment variable. All of which is controlled in Nix. If you need to configure the particular packages manually you can override the packages like:
<programlisting>
wingpanel-with-indicators.override {
indicators = [
pkgs.some-special-indicator
];
};
switchboard-with-plugs.override {
plugs = [
pkgs.some-special-plug
];
};
</programlisting>
please note that, like how the NixOS options describe these as extra plugins, this would only add to the default plugins included with the programs. If for some reason you'd like to configure which plugins to use exactly, both packages have an argument for this:
<programlisting>
wingpanel-with-indicators.override {
useDefaultIndicators = false;
indicators = specialListOfIndicators;
};
switchboard-with-plugs.override {
useDefaultPlugs = false;
plugs = specialListOfPlugs;
};
</programlisting>
this could be most useful for testing a particular plug-in in isolation.
I have switched from a different desktop and Pantheon’s theming looks messed up.
</term>
<listitem>
<para>
Open Switchboard and go to: <guilabel>Administration</guilabel> → <guilabel>About</guilabel> → <guilabel>Restore Default Settings</guilabel> → <guibutton>Restore Settings</guibutton>. This will reset any dconf settings to their Pantheon defaults. Note this could reset certain GNOME specific preferences if that desktop was used prior.
This is a known <linkxlink:href="https://github.com/NixOS/nixpkgs/issues/64611">issue</link> and there is no known workaround.
</para>
</listitem>
</varlistentry>
<varlistentryxml:id="sec-pantheon-faq-appcenter">
<term>
Does AppCenter work, or is it available?
</term>
<listitem>
<para>
AppCenter has been available since 20.03, but it is of little use. This is because there is no functioning PackageKit backend for Nix 2.0. In the near future you will be able to install Flatpak applications from AppCenter on NixOS. See this <linkxlink:href="https://github.com/NixOS/nixpkgs/issues/70214">issue</link>.
Some files were not shown because too many files have changed in this diff
Show More
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
