pyrox.dev
1<section xmlns="http://docbook.org/ns/docbook"
2 xmlns:xlink="http://www.w3.org/1999/xlink"
3 xmlns:xi="http://www.w3.org/2001/XInclude"
4 version="5.0"
5 xml:id="sec-release-17.03">
6 <title>Release 17.03 (“Gorilla”, 2017/03/31)</title>
7
8 <section xmlns="http://docbook.org/ns/docbook"
9 xmlns:xlink="http://www.w3.org/1999/xlink"
10 xmlns:xi="http://www.w3.org/2001/XInclude"
11 version="5.0"
12 xml:id="sec-release-17.03-highlights">
13 <title>Highlights</title>
14
15 <para>
16 In addition to numerous new and upgraded packages, this release has the
17 following highlights:
18 </para>
19
20 <itemizedlist>
21 <listitem>
22 <para>
23 Nixpkgs is now extensible through overlays. See the
24 <link
25 xlink:href="https://nixos.org/nixpkgs/manual/#sec-overlays-install">Nixpkgs
26 manual</link> for more information.
27 </para>
28 </listitem>
29 <listitem>
30 <para>
31 This release is based on Glibc 2.25, GCC 5.4.0 and systemd 232. The
32 default Linux kernel is 4.9 and Nix is at 1.11.8.
33 </para>
34 </listitem>
35 <listitem>
36 <para>
37 The default desktop environment now is KDE's Plasma 5. KDE 4 has been
38 removed
39 </para>
40 </listitem>
41 <listitem>
42 <para>
43 The setuid wrapper functionality now supports setting capabilities.
44 </para>
45 </listitem>
46 <listitem>
47 <para>
48 X.org server uses branch 1.19. Due to ABI incompatibilities,
49 <literal>ati_unfree</literal> keeps forcing 1.17 and
50 <literal>amdgpu-pro</literal> starts forcing 1.18.
51 </para>
52 </listitem>
53 <listitem>
54 <para>
55 Cross compilation has been rewritten. See the nixpkgs manual for details.
56 The most obvious breaking change is that in derivations there is no
57 <literal>.nativeDrv</literal> nor <literal>.crossDrv</literal> are now
58 cross by default, not native.
59 </para>
60 </listitem>
61 <listitem>
62 <para>
63 The <literal>overridePackages</literal> function has been rewritten to be
64 replaced by
65 <link
66 xlink:href="https://nixos.org/nixpkgs/manual/#sec-overlays-install">
67 overlays</link>
68 </para>
69 </listitem>
70 <listitem>
71 <para>
72 Packages in nixpkgs can be marked as insecure through listed
73 vulnerabilities. See the
74 <link
75 xlink:href="https://nixos.org/nixpkgs/manual/#sec-allow-insecure">Nixpkgs
76 manual</link> for more information.
77 </para>
78 </listitem>
79 <listitem>
80 <para>
81 PHP now defaults to PHP 7.1
82 </para>
83 </listitem>
84 </itemizedlist>
85 </section>
86
87 <section xmlns="http://docbook.org/ns/docbook"
88 xmlns:xlink="http://www.w3.org/1999/xlink"
89 xmlns:xi="http://www.w3.org/2001/XInclude"
90 version="5.0"
91 xml:id="sec-release-17.03-new-services">
92 <title>New Services</title>
93
94 <para>
95 The following new services were added since the last release:
96 </para>
97
98 <itemizedlist>
99 <listitem>
100 <para>
101 <literal>hardware/ckb.nix</literal>
102 </para>
103 </listitem>
104 <listitem>
105 <para>
106 <literal>hardware/mcelog.nix</literal>
107 </para>
108 </listitem>
109 <listitem>
110 <para>
111 <literal>hardware/usb-wwan.nix</literal>
112 </para>
113 </listitem>
114 <listitem>
115 <para>
116 <literal>hardware/video/capture/mwprocapture.nix</literal>
117 </para>
118 </listitem>
119 <listitem>
120 <para>
121 <literal>programs/adb.nix</literal>
122 </para>
123 </listitem>
124 <listitem>
125 <para>
126 <literal>programs/chromium.nix</literal>
127 </para>
128 </listitem>
129 <listitem>
130 <para>
131 <literal>programs/gphoto2.nix</literal>
132 </para>
133 </listitem>
134 <listitem>
135 <para>
136 <literal>programs/java.nix</literal>
137 </para>
138 </listitem>
139 <listitem>
140 <para>
141 <literal>programs/mtr.nix</literal>
142 </para>
143 </listitem>
144 <listitem>
145 <para>
146 <literal>programs/oblogout.nix</literal>
147 </para>
148 </listitem>
149 <listitem>
150 <para>
151 <literal>programs/vim.nix</literal>
152 </para>
153 </listitem>
154 <listitem>
155 <para>
156 <literal>programs/wireshark.nix</literal>
157 </para>
158 </listitem>
159 <listitem>
160 <para>
161 <literal>security/dhparams.nix</literal>
162 </para>
163 </listitem>
164 <listitem>
165 <para>
166 <literal>services/audio/ympd.nix</literal>
167 </para>
168 </listitem>
169 <listitem>
170 <para>
171 <literal>services/computing/boinc/client.nix</literal>
172 </para>
173 </listitem>
174 <listitem>
175 <para>
176 <literal>services/continuous-integration/buildbot/master.nix</literal>
177 </para>
178 </listitem>
179 <listitem>
180 <para>
181 <literal>services/continuous-integration/buildbot/worker.nix</literal>
182 </para>
183 </listitem>
184 <listitem>
185 <para>
186 <literal>services/continuous-integration/gitlab-runner.nix</literal>
187 </para>
188 </listitem>
189 <listitem>
190 <para>
191 <literal>services/databases/riak-cs.nix</literal>
192 </para>
193 </listitem>
194 <listitem>
195 <para>
196 <literal>services/databases/stanchion.nix</literal>
197 </para>
198 </listitem>
199 <listitem>
200 <para>
201 <literal>services/desktops/gnome3/gnome-terminal-server.nix</literal>
202 </para>
203 </listitem>
204 <listitem>
205 <para>
206 <literal>services/editors/infinoted.nix</literal>
207 </para>
208 </listitem>
209 <listitem>
210 <para>
211 <literal>services/hardware/illum.nix</literal>
212 </para>
213 </listitem>
214 <listitem>
215 <para>
216 <literal>services/hardware/trezord.nix</literal>
217 </para>
218 </listitem>
219 <listitem>
220 <para>
221 <literal>services/logging/journalbeat.nix</literal>
222 </para>
223 </listitem>
224 <listitem>
225 <para>
226 <literal>services/mail/offlineimap.nix</literal>
227 </para>
228 </listitem>
229 <listitem>
230 <para>
231 <literal>services/mail/postgrey.nix</literal>
232 </para>
233 </listitem>
234 <listitem>
235 <para>
236 <literal>services/misc/couchpotato.nix</literal>
237 </para>
238 </listitem>
239 <listitem>
240 <para>
241 <literal>services/misc/docker-registry.nix</literal>
242 </para>
243 </listitem>
244 <listitem>
245 <para>
246 <literal>services/misc/errbot.nix</literal>
247 </para>
248 </listitem>
249 <listitem>
250 <para>
251 <literal>services/misc/geoip-updater.nix</literal>
252 </para>
253 </listitem>
254 <listitem>
255 <para>
256 <literal>services/misc/gogs.nix</literal>
257 </para>
258 </listitem>
259 <listitem>
260 <para>
261 <literal>services/misc/leaps.nix</literal>
262 </para>
263 </listitem>
264 <listitem>
265 <para>
266 <literal>services/misc/nix-optimise.nix</literal>
267 </para>
268 </listitem>
269 <listitem>
270 <para>
271 <literal>services/misc/ssm-agent.nix</literal>
272 </para>
273 </listitem>
274 <listitem>
275 <para>
276 <literal>services/misc/sssd.nix</literal>
277 </para>
278 </listitem>
279 <listitem>
280 <para>
281 <literal>services/monitoring/arbtt.nix</literal>
282 </para>
283 </listitem>
284 <listitem>
285 <para>
286 <literal>services/monitoring/netdata.nix</literal>
287 </para>
288 </listitem>
289 <listitem>
290 <para>
291 <literal>services/monitoring/prometheus/default.nix</literal>
292 </para>
293 </listitem>
294 <listitem>
295 <para>
296 <literal>services/monitoring/prometheus/alertmanager.nix</literal>
297 </para>
298 </listitem>
299 <listitem>
300 <para>
301 <literal>services/monitoring/prometheus/blackbox-exporter.nix</literal>
302 </para>
303 </listitem>
304 <listitem>
305 <para>
306 <literal>services/monitoring/prometheus/json-exporter.nix</literal>
307 </para>
308 </listitem>
309 <listitem>
310 <para>
311 <literal>services/monitoring/prometheus/nginx-exporter.nix</literal>
312 </para>
313 </listitem>
314 <listitem>
315 <para>
316 <literal>services/monitoring/prometheus/node-exporter.nix</literal>
317 </para>
318 </listitem>
319 <listitem>
320 <para>
321 <literal>services/monitoring/prometheus/snmp-exporter.nix</literal>
322 </para>
323 </listitem>
324 <listitem>
325 <para>
326 <literal>services/monitoring/prometheus/unifi-exporter.nix</literal>
327 </para>
328 </listitem>
329 <listitem>
330 <para>
331 <literal>services/monitoring/prometheus/varnish-exporter.nix</literal>
332 </para>
333 </listitem>
334 <listitem>
335 <para>
336 <literal>services/monitoring/sysstat.nix</literal>
337 </para>
338 </listitem>
339 <listitem>
340 <para>
341 <literal>services/monitoring/telegraf.nix</literal>
342 </para>
343 </listitem>
344 <listitem>
345 <para>
346 <literal>services/monitoring/vnstat.nix</literal>
347 </para>
348 </listitem>
349 <listitem>
350 <para>
351 <literal>services/network-filesystems/cachefilesd.nix</literal>
352 </para>
353 </listitem>
354 <listitem>
355 <para>
356 <literal>services/network-filesystems/glusterfs.nix</literal>
357 </para>
358 </listitem>
359 <listitem>
360 <para>
361 <literal>services/network-filesystems/ipfs.nix</literal>
362 </para>
363 </listitem>
364 <listitem>
365 <para>
366 <literal>services/networking/dante.nix</literal>
367 </para>
368 </listitem>
369 <listitem>
370 <para>
371 <literal>services/networking/dnscrypt-wrapper.nix</literal>
372 </para>
373 </listitem>
374 <listitem>
375 <para>
376 <literal>services/networking/fakeroute.nix</literal>
377 </para>
378 </listitem>
379 <listitem>
380 <para>
381 <literal>services/networking/flannel.nix</literal>
382 </para>
383 </listitem>
384 <listitem>
385 <para>
386 <literal>services/networking/htpdate.nix</literal>
387 </para>
388 </listitem>
389 <listitem>
390 <para>
391 <literal>services/networking/miredo.nix</literal>
392 </para>
393 </listitem>
394 <listitem>
395 <para>
396 <literal>services/networking/nftables.nix</literal>
397 </para>
398 </listitem>
399 <listitem>
400 <para>
401 <literal>services/networking/powerdns.nix</literal>
402 </para>
403 </listitem>
404 <listitem>
405 <para>
406 <literal>services/networking/pdns-recursor.nix</literal>
407 </para>
408 </listitem>
409 <listitem>
410 <para>
411 <literal>services/networking/quagga.nix</literal>
412 </para>
413 </listitem>
414 <listitem>
415 <para>
416 <literal>services/networking/redsocks.nix</literal>
417 </para>
418 </listitem>
419 <listitem>
420 <para>
421 <literal>services/networking/wireguard.nix</literal>
422 </para>
423 </listitem>
424 <listitem>
425 <para>
426 <literal>services/system/cgmanager.nix</literal>
427 </para>
428 </listitem>
429 <listitem>
430 <para>
431 <literal>services/torrent/opentracker.nix</literal>
432 </para>
433 </listitem>
434 <listitem>
435 <para>
436 <literal>services/web-apps/atlassian/confluence.nix</literal>
437 </para>
438 </listitem>
439 <listitem>
440 <para>
441 <literal>services/web-apps/atlassian/crowd.nix</literal>
442 </para>
443 </listitem>
444 <listitem>
445 <para>
446 <literal>services/web-apps/atlassian/jira.nix</literal>
447 </para>
448 </listitem>
449 <listitem>
450 <para>
451 <literal>services/web-apps/frab.nix</literal>
452 </para>
453 </listitem>
454 <listitem>
455 <para>
456 <literal>services/web-apps/nixbot.nix</literal>
457 </para>
458 </listitem>
459 <listitem>
460 <para>
461 <literal>services/web-apps/selfoss.nix</literal>
462 </para>
463 </listitem>
464 <listitem>
465 <para>
466 <literal>services/web-apps/quassel-webserver.nix</literal>
467 </para>
468 </listitem>
469 <listitem>
470 <para>
471 <literal>services/x11/unclutter-xfixes.nix</literal>
472 </para>
473 </listitem>
474 <listitem>
475 <para>
476 <literal>services/x11/urxvtd.nix</literal>
477 </para>
478 </listitem>
479 <listitem>
480 <para>
481 <literal>system/boot/systemd-nspawn.nix</literal>
482 </para>
483 </listitem>
484 <listitem>
485 <para>
486 <literal>virtualisation/ecs-agent.nix</literal>
487 </para>
488 </listitem>
489 <listitem>
490 <para>
491 <literal>virtualisation/lxcfs.nix</literal>
492 </para>
493 </listitem>
494 <listitem>
495 <para>
496 <literal>virtualisation/openstack/keystone.nix</literal>
497 </para>
498 </listitem>
499 <listitem>
500 <para>
501 <literal>virtualisation/openstack/glance.nix</literal>
502 </para>
503 </listitem>
504 </itemizedlist>
505 </section>
506
507 <section xmlns="http://docbook.org/ns/docbook"
508 xmlns:xlink="http://www.w3.org/1999/xlink"
509 xmlns:xi="http://www.w3.org/2001/XInclude"
510 version="5.0"
511 xml:id="sec-release-17.03-incompatibilities">
512 <title>Backward Incompatibilities</title>
513
514 <para>
515 When upgrading from a previous release, please be aware of the following
516 incompatible changes:
517 </para>
518
519 <itemizedlist>
520 <listitem>
521 <para>
522 Derivations have no <literal>.nativeDrv</literal> nor
523 <literal>.crossDrv</literal> and are now cross by default, not native.
524 </para>
525 </listitem>
526 <listitem>
527 <para>
528 <literal>stdenv.overrides</literal> is now expected to take
529 <literal>self</literal> and <literal>super</literal> arguments. See
530 <literal>lib.trivial.extends</literal> for what those parameters
531 represent.
532 </para>
533 </listitem>
534 <listitem>
535 <para>
536 <literal>ansible</literal> now defaults to ansible version 2 as version 1
537 has been removed due to a serious
538 <link
539 xlink:href="https://www.computest.nl/advisories/CT-2017-0109_Ansible.txt">
540 vulnerability</link> unpatched by upstream.
541 </para>
542 </listitem>
543 <listitem>
544 <para>
545 <literal>gnome</literal> alias has been removed along with
546 <literal>gtk</literal>, <literal>gtkmm</literal> and several others. Now
547 you need to use versioned attributes, like <literal>gnome3</literal>.
548 </para>
549 </listitem>
550 <listitem>
551 <para>
552 The attribute name of the Radicale daemon has been changed from
553 <literal>pythonPackages.radicale</literal> to <literal>radicale</literal>.
554 </para>
555 </listitem>
556 <listitem>
557 <para>
558 The <literal>stripHash</literal> bash function in
559 <literal>stdenv</literal> changed according to its documentation; it now
560 outputs the stripped name to <literal>stdout</literal> instead of putting
561 it in the variable <literal>strippedName</literal>.
562 </para>
563 </listitem>
564 <listitem>
565 <para>
566 PHP now scans for extra configuration .ini files in /etc/php.d instead of
567 /etc. This prevents accidentally loading non-PHP .ini files that may be in
568 /etc.
569 </para>
570 </listitem>
571 <listitem>
572 <para>
573 Two lone top-level dict dbs moved into <literal>dictdDBs</literal>. This
574 affects: <literal>dictdWordnet</literal> which is now at
575 <literal>dictdDBs.wordnet</literal> and <literal>dictdWiktionary</literal>
576 which is now at <literal>dictdDBs.wiktionary</literal>
577 </para>
578 </listitem>
579 <listitem>
580 <para>
581 Parsoid service now uses YAML configuration format.
582 <literal>service.parsoid.interwikis</literal> is now called
583 <literal>service.parsoid.wikis</literal> and is a list of either API URLs
584 or attribute sets as specified in parsoid's documentation.
585 </para>
586 </listitem>
587 <listitem>
588 <para>
589 <literal>Ntpd</literal> was replaced by
590 <literal>systemd-timesyncd</literal> as the default service to synchronize
591 system time with a remote NTP server. The old behavior can be restored by
592 setting <literal>services.ntp.enable</literal> to <literal>true</literal>.
593 Upstream time servers for all NTP implementations are now configured using
594 <literal>networking.timeServers</literal>.
595 </para>
596 </listitem>
597 <listitem>
598 <para>
599 <literal>service.nylon</literal> is now declared using named instances. As
600 an example:
601<programlisting>
602 services.nylon = {
603 enable = true;
604 acceptInterface = "br0";
605 bindInterface = "tun1";
606 port = 5912;
607 };
608</programlisting>
609 should be replaced with:
610<programlisting>
611 services.nylon.myvpn = {
612 enable = true;
613 acceptInterface = "br0";
614 bindInterface = "tun1";
615 port = 5912;
616 };
617</programlisting>
618 this enables you to declare a SOCKS proxy for each uplink.
619 </para>
620 </listitem>
621 <listitem>
622 <para>
623 <literal>overridePackages</literal> function no longer exists. It is
624 replaced by
625 <link
626 xlink:href="https://nixos.org/nixpkgs/manual/#sec-overlays-install">
627 overlays</link>. For example, the following code:
628<programlisting>
629 let
630 pkgs = import <nixpkgs> {};
631 in
632 pkgs.overridePackages (self: super: ...)
633</programlisting>
634 should be replaced by:
635<programlisting>
636 let
637 pkgs = import <nixpkgs> {};
638 in
639 import pkgs.path { overlays = [(self: super: ...)]; }
640</programlisting>
641 </para>
642 </listitem>
643 <listitem>
644 <para>
645 Autoloading connection tracking helpers is now disabled by default. This
646 default was also changed in the Linux kernel and is considered insecure if
647 not configured properly in your firewall. If you need connection tracking
648 helpers (i.e. for active FTP) please enable
649 <literal>networking.firewall.autoLoadConntrackHelpers</literal> and tune
650 <literal>networking.firewall.connectionTrackingModules</literal> to suit
651 your needs.
652 </para>
653 </listitem>
654 <listitem>
655 <para>
656 <literal>local_recipient_maps</literal> is not set to empty value by
657 Postfix service. It's an insecure default as stated by Postfix
658 documentation. Those who want to retain this setting need to set it via
659 <literal>services.postfix.extraConfig</literal>.
660 </para>
661 </listitem>
662 <listitem>
663 <para>
664 Iputils no longer provide ping6 and traceroute6. The functionality of
665 these tools has been integrated into ping and traceroute respectively. To
666 enforce an address family the new flags <literal>-4</literal> and
667 <literal>-6</literal> have been added. One notable incompatibility is that
668 specifying an interface (for link-local IPv6 for instance) is no longer
669 done with the <literal>-I</literal> flag, but by encoding the interface
670 into the address (<literal>ping fe80::1%eth0</literal>).
671 </para>
672 </listitem>
673 <listitem>
674 <para>
675 The socket handling of the <literal>services.rmilter</literal> module has
676 been fixed and refactored. As rmilter doesn't support binding to more than
677 one socket, the options <literal>bindUnixSockets</literal> and
678 <literal>bindInetSockets</literal> have been replaced by
679 <literal>services.rmilter.bindSocket.*</literal>. The default is still a
680 unix socket in <literal>/run/rmilter/rmilter.sock</literal>. Refer to the
681 options documentation for more information.
682 </para>
683 </listitem>
684 <listitem>
685 <para>
686 The <literal>fetch*</literal> functions no longer support md5, please use
687 sha256 instead.
688 </para>
689 </listitem>
690 <listitem>
691 <para>
692 The dnscrypt-proxy module interface has been streamlined around the
693 <option>extraArgs</option> option. Where possible, legacy option
694 declarations are mapped to <option>extraArgs</option> but will emit
695 warnings. The <option>resolverList</option> has been outright removed: to
696 use an unlisted resolver, use the <option>customResolver</option> option.
697 </para>
698 </listitem>
699 <listitem>
700 <para>
701 torbrowser now stores local state under
702 <filename>~/.local/share/tor-browser</filename> by default. Any browser
703 profile data from the old location, <filename>~/.torbrowser4</filename>,
704 must be migrated manually.
705 </para>
706 </listitem>
707 <listitem>
708 <para>
709 The ihaskell, monetdb, offlineimap and sitecopy services have been
710 removed.
711 </para>
712 </listitem>
713 </itemizedlist>
714 </section>
715
716 <section xmlns="http://docbook.org/ns/docbook"
717 xmlns:xlink="http://www.w3.org/1999/xlink"
718 xmlns:xi="http://www.w3.org/2001/XInclude"
719 version="5.0"
720 xml:id="sec-release-17.03-notable-changes">
721 <title>Other Notable Changes</title>
722
723 <itemizedlist>
724 <listitem>
725 <para>
726 Module type system have a new extensible option types feature that allow
727 to extend certain types, such as enum, through multiple option
728 declarations of the same option across multiple modules.
729 </para>
730 </listitem>
731 <listitem>
732 <para>
733 <literal>jre</literal> now defaults to GTK+ UI by default. This improves
734 visual consistency and makes Java follow system font style, improving the
735 situation on HighDPI displays. This has a cost of increased closure size;
736 for server and other headless workloads it's recommended to use
737 <literal>jre_headless</literal>.
738 </para>
739 </listitem>
740 <listitem>
741 <para>
742 Python 2.6 interpreter and package set have been removed.
743 </para>
744 </listitem>
745 <listitem>
746 <para>
747 The Python 2.7 interpreter does not use modules anymore. Instead, all
748 CPython interpreters now include the whole standard library except for
749 `tkinter`, which is available in the Python package set.
750 </para>
751 </listitem>
752 <listitem>
753 <para>
754 Python 2.7, 3.5 and 3.6 are now built deterministically and 3.4 mostly.
755 Minor modifications had to be made to the interpreters in order to
756 generate deterministic bytecode. This has security implications and is
757 relevant for those using Python in a <literal>nix-shell</literal>. See the
758 Nixpkgs manual for details.
759 </para>
760 </listitem>
761 <listitem>
762 <para>
763 The Python package sets now use a fixed-point combinator and the sets are
764 available as attributes of the interpreters.
765 </para>
766 </listitem>
767 <listitem>
768 <para>
769 The Python function <literal>buildPythonPackage</literal> has been
770 improved and can be used to build from Setuptools source, Flit source, and
771 precompiled Wheels.
772 </para>
773 </listitem>
774 <listitem>
775 <para>
776 When adding new or updating current Python libraries, the expressions
777 should be put in separate files in
778 <literal>pkgs/development/python-modules</literal> and called from
779 <literal>python-packages.nix</literal>.
780 </para>
781 </listitem>
782 <listitem>
783 <para>
784 The dnscrypt-proxy service supports synchronizing the list of public
785 resolvers without working DNS resolution. This fixes issues caused by the
786 resolver list becoming outdated. It also improves the viability of
787 DNSCrypt only configurations.
788 </para>
789 </listitem>
790 <listitem>
791 <para>
792 Containers using bridged networking no longer lose their connection after
793 changes to the host networking.
794 </para>
795 </listitem>
796 <listitem>
797 <para>
798 ZFS supports pool auto scrubbing.
799 </para>
800 </listitem>
801 <listitem>
802 <para>
803 The bind DNS utilities (e.g. dig) have been split into their own output
804 and are now also available in <literal>pkgs.dnsutils</literal> and it is
805 no longer necessary to pull in all of <literal>bind</literal> to use them.
806 </para>
807 </listitem>
808 <listitem>
809 <para>
810 Per-user configuration was moved from <filename>~/.nixpkgs</filename> to
811 <filename>~/.config/nixpkgs</filename>. The former is still valid for
812 <filename>config.nix</filename> for backwards compatibility.
813 </para>
814 </listitem>
815 </itemizedlist>
816 </section>
817</section>