Merge staging-next into staging

Changed files
+558 -65
lib
maintainers
nixos
tests
pkgs
by-name
aa
aarch64-esr-decoder
an
anubis
at
atmos
bl
blackfire
cl
clouddrive2
cp
cppzmq
du
duplicity
ht
htslib
ka
kanboard
ll
llama-cpp
ma
ne
nexusmods-app
pr
pritunl-client
development
compilers
python-modules
llm
llm-perplexity
tools
security
proxmark3
top-level
+2 -2
lib/fetchers.nix
···
}:
fetcher:
let
-
inherit (lib.attrsets) genAttrs intersectAttrs removeAttrs;
-
inherit (lib.trivial) const functionArgs setFunctionArgs;
+
inherit (lib.attrsets) intersectAttrs removeAttrs;
+
inherit (lib.trivial) functionArgs setFunctionArgs;
inherit (commonH hashTypes) hashSet;
fArgs = functionArgs fetcher;
+6
maintainers/maintainer-list.nix
···
githubId = 17029738;
name = "Jean-Charles Quillet";
+
jed-richards = {
+
name = "Jed Richards";
+
email = "jed22richards+nixpkgs@gmail.com";
+
github = "jed-richards";
+
githubId = 123339450;
+
};
jedsek = {
email = "jedsek@qq.com";
github = "Jedsek";
+1 -6
nixos/tests/anubis.nix
···
];
nodes.machine =
-
{
-
config,
-
pkgs,
-
...
-
}:
+
{ config, pkgs, ... }:
{
services.anubis = {
defaultOptions.settings = {
···
machine.succeed('curl -f http://basic.localhost | grep "it works"')
machine.succeed('curl -f http://basic.localhost -H "User-Agent: Mozilla" | grep anubis')
machine.succeed('curl -f http://basic.localhost/metrics | grep anubis_challenges_issued')
-
machine.succeed('curl -f -X POST http://basic.localhost/.within.website/x/cmd/anubis/api/make-challenge -d "redir=/" | grep challenge')
# TCP mode
machine.succeed('curl -f http://tcp.localhost -H "User-Agent: Mozilla" | grep anubis')
+3 -3
pkgs/by-name/aa/aarch64-esr-decoder/package.nix
···
rustPlatform.buildRustPackage rec {
pname = "aarch64-esr-decoder";
-
version = "0.2.3";
+
version = "0.2.4";
src = fetchFromGitHub {
owner = "google";
repo = "aarch64-esr-decoder";
rev = version;
-
hash = "sha256-U9i5L3s4oQOIqlECSaKkHxS2Vzr6SY4tIUpvl3+oSl0=";
+
hash = "sha256-ZpSrz7iwwzNrK+bFTMn5MPx4Zjceao9NKhjAyjuPLWY=";
};
useFetchCargoVendor = true;
-
cargoHash = "sha256-LiNnTNpluQkomQhIOsAnUbbBftTgqgNdpT8heCrBayg=";
+
cargoHash = "sha256-xOBJ8QYiWu5vmkRpttN2CXCXi4bNj+qph31hSkDadjI=";
meta = {
description = "Utility for decoding aarch64 ESR register values";
+4 -4
pkgs/by-name/an/anubis/package.nix
···
buildGoModule (finalAttrs: {
pname = "anubis";
-
version = "1.19.1";
+
version = "1.20.0";
src = fetchFromGitHub {
owner = "TecharoHQ";
repo = "anubis";
tag = "v${finalAttrs.version}";
-
hash = "sha256-aWdkPNwTD+ooaE0PazcOaama7k1a8n5pRxr8X6wm4zs=";
+
hash = "sha256-pdfe2D9KAg/vesTgOi+b5ZVkUkuWhmZC/xYXiiYzlPs=";
};
-
vendorHash = "sha256-wJOGYOWFKep2IFzX+Hia9m1jPG+Rskg8Np9WfEc+TUY=";
+
vendorHash = "sha256-cOl+eVnj6aMKIJCjCM0aacp4/Jg5BhZqFwum+u9tOKE=";
nativeBuildInputs = [
esbuild
···
pname = "anubis-xess";
inherit (finalAttrs) version src;
-
npmDepsHash = "sha256-wI8XCUGq3aI20B++RAT3lc/nBrDMEmE9+810lewzXa0=";
+
npmDepsHash = "sha256-kBnexaBAMgA7QdKevW3mmlSn+QEbkTW//hYVTRFLQeQ=";
buildPhase = ''
runHook preBuild
+3 -3
pkgs/by-name/at/atmos/package.nix
···
buildGoModule (finalAttrs: {
pname = "atmos";
-
version = "1.178.0";
+
version = "1.180.0";
src = fetchFromGitHub {
owner = "cloudposse";
repo = "atmos";
tag = "v${finalAttrs.version}";
-
hash = "sha256-5rChYMwRtJt6jvgzJoU7OkgheJML2vgY/NhJsSE/KCI=";
+
hash = "sha256-/yCgC73J4PVTqmJBW0eLCMVWtsyMGLeF0Rmvx+N/oP8=";
};
-
vendorHash = "sha256-0vHX4P33o6HMQ9k4Awd9+sDoLhbq/8YzrW7dkUeoR7Y=";
+
vendorHash = "sha256-k1zC3tUF2uDAo86J6dZmYOGZcYFBNdSH15cyX2tiZEg=";
ldflags = [
"-s"
+19 -19
pkgs/by-name/bl/blackfire/php-probe.nix
···
phpMajor = lib.versions.majorMinor php.version;
inherit (stdenv.hostPlatform) system;
-
version = "1.92.38";
+
version = "1.92.39";
hashes = {
"x86_64-linux" = {
system = "amd64";
hash = {
-
"8.1" = "sha256-W8VlvHa6vmNbDX5r5FG8pB0vpXRn5hPu61td9aARecA=";
-
"8.2" = "sha256-f3AKwh9mUCoFDaXM+EwTORk0/TFyArtEa+sv7cMZmDs=";
-
"8.3" = "sha256-6zigke1VY439IIxrQg5Dxcggn+7Q0BE/spPycvxdyik=";
-
"8.4" = "sha256-n89OCTUGsWhpc61P9WvKyjdJ52wJHoj6NEb2mcs0whA=";
+
"8.1" = "sha256-SsemBK7XYPmYakcUs3vLY9yh5jg3uQEksrokMztzilU=";
+
"8.2" = "sha256-lZYsPDkWWUbmG+k5nNcp2GxhzaMj9UCQswRiU7K5N40=";
+
"8.3" = "sha256-5dHAU3EtwzWrKUE9FjevDFRtdfO+dXX8y4wAD0VdTcM=";
+
"8.4" = "sha256-MsUh0OOztJ++vwXuDbQ8Krf1wANQHYhWXSiHAU5pm4M=";
};
};
"i686-linux" = {
system = "i386";
hash = {
-
"8.1" = "sha256-31lJOGL9i8kL22zH8zzYZtxB94ssJiw+qXQRmQilR+c=";
-
"8.2" = "sha256-f+D7DZvLQk6ebLfJ43qFSqWzU6YQoP/7nVGajLRll5g=";
-
"8.3" = "sha256-56/+604Vymb+otL7oria3d/w4b1o8Pt199aXK4nfJC4=";
-
"8.4" = "sha256-K26Dy0S9w0uWTX7GkIjh0jUtaa768B+ls9gq8LXNZUA=";
+
"8.1" = "sha256-lxmH2lg11dP6ivqFq+lB2S87qlKKM7e0W95mfesNrf4=";
+
"8.2" = "sha256-7jTEuXYspgo6zTG0R4pA38cGQVIts0rMHHegJ+FZtUc=";
+
"8.3" = "sha256-aRrM6GnXBaiggwoPLq6U8T1YaXmYm6Zhd3Ex8JKMCuA=";
+
"8.4" = "sha256-tagBg+7FkuK/zsTMG3GmnqPsApdCP8RnqQozY5Nufzk=";
};
};
"aarch64-linux" = {
system = "arm64";
hash = {
-
"8.1" = "sha256-aSjOxMZdP+Lrd4FaXgkbHykmKBn9WuzGumrYpJEKpS8=";
-
"8.2" = "sha256-ckhHA/EYeRlhSrc5nMUl6jS0iAaW1q1sZAYYxjcGOwQ=";
-
"8.3" = "sha256-p3P94uPTbekbxgICuC72NEA5XFpYng2MZI+9L+0R/Ew=";
-
"8.4" = "sha256-KCMRNpS2A5Tb5Td8fpBusu70FNIOfJ+6pYRUgw/5kDg=";
+
"8.1" = "sha256-P6sBM2B/w65P+lInWgn3FxZHX4tS0oo6YELsu8aXmIw=";
+
"8.2" = "sha256-qYglYx4icFch5KJuWCTgC19EowZNzHFIsh5qK7t/gDk=";
+
"8.3" = "sha256-Ob0rg6A7fJBKApGnugV+BAC5HjFc2UpZmxJ0oYnQVRg=";
+
"8.4" = "sha256-+cH7t3ElpNPZUbDEkjkeV8d+74hF3kFzI7xY9ruwy1Y=";
};
};
"aarch64-darwin" = {
system = "arm64";
hash = {
-
"8.1" = "sha256-5JPn9lNsh6NJemCRmrBrTIvhEUQfjmIGbASaoiKoZDo=";
-
"8.2" = "sha256-e9tsXi3SML9HZ81XD5LhGcm7L8Ag9fOvyTo0Gy42YRw=";
-
"8.3" = "sha256-RCmYyrcSi7hfkbGOSp8ywFkm1IFGy0bgu8tmdrTID6c=";
+
"8.1" = "sha256-5EW9BkG154HQ6TrMyan5EhXiGlSRFPXMMTUasIwuC/U=";
+
"8.2" = "sha256-hRjh9Bf04LVBtS08fWMxrE1iyn6SGBQfNNLuSyQPjes=";
+
"8.3" = "sha256-WWsDPQhu1GXMDe6NhlMuVcwi7wGzRLJcJwxItxFCOiI=";
};
};
"x86_64-darwin" = {
system = "amd64";
hash = {
-
"8.1" = "sha256-SuD9iDjxMBt2GZtDXPIjCCl1mEt9K2GciuC7S9ppNZQ=";
-
"8.2" = "sha256-om1L/VQiwdV4D2awuz98ko7Oz9h1GYRtqYZrQRZpy7E=";
-
"8.3" = "sha256-H1xkneOLk7DCPqtbknLlQX2iKe/U6/ilmToOOtiRabs=";
+
"8.1" = "sha256-w56HItrNtHA8jj9K5LhGTKFRX5i9UYJpxVwR0eFQe4E=";
+
"8.2" = "sha256-vkEAVyZ6Vs3VjWb3oNrlRz5zAzPbgIngeoDAHZLme3Q=";
+
"8.3" = "sha256-uzobd13RzYGFrXHyFH0Ud9Qg7AWMPAA5dvHCp7R3HrU=";
};
};
};
+5 -5
pkgs/by-name/cl/clouddrive2/package.nix
···
in
stdenv.mkDerivation (finalAttrs: {
pname = "clouddrive2";
-
version = "0.9.0";
+
version = "0.9.1";
src = fetchurl {
url = "https://github.com/cloud-fs/cloud-fs.github.io/releases/download/v${finalAttrs.version}/clouddrive-2-${os}-${arch}-${finalAttrs.version}.tgz";
hash =
{
-
x86_64-linux = "sha256-snmMDzZ11pAV0UkPWpl74B/ifsTUv91PXBJzQU7a1oI=";
-
aarch64-linux = "sha256-sAD5jnxmMzfb37qleOCeNr1zveqU06slTFtd/E6BZf0=";
-
x86_64-darwin = "sha256-90afw69lf7SjANRadum4GxW3ZAr6eDDnFVhyV3qtWt4=";
-
aarch64-darwin = "sha256-LoCRM6t9ditZfwgmWJGkijpFvC/s2lBItH7j3Qqlfp0=";
+
x86_64-linux = "sha256-xm2kjCtfNvbZmVfd42UX+i4G44fqQsLP4V1iTCdm3PA=";
+
aarch64-linux = "sha256-HMzuRCSVBxwyuRxD23+Yk7bTrayDHi6X0JSvaGZJfvU=";
+
x86_64-darwin = "sha256-hIFCNtSFqjRCtx0/XHl7w5xeHSGrdXiKWLfq68J9GGU=";
+
aarch64-darwin = "sha256-CfATmkbXOlz7fGDGIMPQDAdcY6bxmOq1tcIsQbFGrwQ=";
}
.${stdenv.hostPlatform.system} or (throw "unsupported system ${stdenv.hostPlatform.system}");
};
+2 -2
pkgs/by-name/cp/cppzmq/package.nix
···
stdenv.mkDerivation rec {
pname = "cppzmq";
-
version = "4.10.0";
+
version = "4.11.0";
src = fetchFromGitHub {
owner = "zeromq";
repo = "cppzmq";
rev = "v${version}";
-
sha256 = "sha256-HTdaV1cLbwGYuikS9EAVvAOdLmCoWlvVXlpYsUwY5IA=";
+
sha256 = "sha256-c6IZ5PnuB96NLYHDHdNclYSF4LpqAfFWxVzeP8BzhCE=";
};
nativeBuildInputs = [ cmake ];
+2 -2
pkgs/by-name/du/duplicity/package.nix
···
let
self = python3.pkgs.buildPythonApplication rec {
pname = "duplicity";
-
version = "3.0.4.1";
+
version = "3.0.5.1";
src = fetchFromGitLab {
owner = "duplicity";
repo = "duplicity";
rev = "rel.${version}";
-
hash = "sha256-cVzGdn3a9/Kvu/QYWaTXJ1llkPRvj0g8qb7TUjennws=";
+
hash = "sha256-fL4rvXcLKfEXuy5LKpFjFu+P3be7/T342+BgeO/dfp8=";
};
patches = [
+10 -2
pkgs/by-name/ht/htslib/package.nix
···
lib,
stdenv,
fetchurl,
+
fetchpatch,
zlib,
bzip2,
xz,
···
stdenv.mkDerivation rec {
pname = "htslib";
-
version = "1.21";
+
version = "1.22";
src = fetchurl {
url = "https://github.com/samtools/htslib/releases/download/${version}/${pname}-${version}.tar.bz2";
-
sha256 = "sha256-hLUQ5zX0ljZB8m/YjIq97oH/TLYhaDEK5xZjaqwPGCM=";
+
hash = "sha256-YlDB3yl9tHdRbmCsjfRe11plLR8lsPN/EvWxcmnq/ek=";
};
+
+
patches = [
+
(fetchpatch {
+
url = "https://github.com/samtools/htslib/commit/31006e1c8edd02eb6321ed9be76b84fca5d20cb6.patch";
+
hash = "sha256-sbnkVmXIbs/Cn/msUUrJpJZCI2DHX5kpGSka2cccZIQ=";
+
})
+
];
# perl is only used during the check phase.
nativeBuildInputs = [ perl ];
+2 -2
pkgs/by-name/ka/kanboard/package.nix
···
stdenvNoCC.mkDerivation (finalAttrs: {
pname = "kanboard";
-
version = "1.2.45";
+
version = "1.2.46";
src = fetchFromGitHub {
owner = "kanboard";
repo = "kanboard";
tag = "v${finalAttrs.version}";
-
hash = "sha256-MGQ+FJcdRx4VZppLnoB9lCC1eIoetbToyvBsWRBRSu4=";
+
hash = "sha256-IYnlBNa4f+ZpOttQHlIZi8wsZYJuB/kWWLwhQK8vdQY=";
};
dontBuild = true;
+2 -2
pkgs/by-name/ll/llama-cpp/package.nix
···
in
effectiveStdenv.mkDerivation (finalAttrs: {
pname = "llama-cpp";
-
version = "5702";
+
version = "5760";
src = fetchFromGitHub {
owner = "ggml-org";
repo = "llama.cpp";
tag = "b${finalAttrs.version}";
-
hash = "sha256-EyDuM7eZzmNUvqwVUKYuUNlXbFF+G8x/+4mL/3YsHCc=";
+
hash = "sha256-sl1lhj40c546YRuCTn6BlmS60Rd2TBKNx4TaQ0I6110=";
leaveDotGit = true;
postFetch = ''
git -C "$out" rev-parse --short HEAD > $out/COMMIT
+27 -4
pkgs/by-name/ma/maven/build-maven-package.nix
···
stdenv,
jdk,
maven,
+
writers,
}:
{
···
let
mvnSkipTests = lib.optionalString (!doCheck) "-DskipTests";
+
+
writeProxySettings = writers.writePython3 "write-proxy-settings" { } ./maven-proxy.py;
+
fetchedMavenDeps = stdenv.mkDerivation (
{
name = "${pname}-${version}-maven-deps";
···
JAVA_HOME = mvnJdk;
+
impureEnvVars = lib.fetchers.proxyImpureEnvVars;
+
buildPhase =
''
runHook preBuild
+
+
MAVEN_EXTRA_ARGS=""
+
+
# handle proxy
+
if [[ -n "''${HTTP_PROXY-}" ]] || [[ -n "''${HTTPS_PROXY-}" ]] || [[ -n "''${NO_PROXY-}" ]];then
+
mvnSettingsFile="$(mktemp -d)/settings.xml"
+
${writeProxySettings} $mvnSettingsFile
+
MAVEN_EXTRA_ARGS="-s=$mvnSettingsFile"
+
fi
+
+
# handle cacert by populating a trust store on the fly
+
if [[ -n "''${NIX_SSL_CERT_FILE-}" ]] && [[ "''${NIX_SSL_CERT_FILE-}" != "/no-cert-file.crt" ]];then
+
keyStoreFile="$(mktemp -d)/keystore"
+
keyStorePwd="$(head -c10 /dev/random | base32)"
+
echo y | ${jdk}/bin/keytool -importcert -file "$NIX_SSL_CERT_FILE" -alias alias -keystore "$keyStoreFile" -storepass "$keyStorePwd"
+
MAVEN_EXTRA_ARGS="$MAVEN_EXTRA_ARGS -Djavax.net.ssl.trustStore=$keyStoreFile -Djavax.net.ssl.trustStorePassword=$keyStorePwd"
+
fi
''
+ lib.optionalString buildOffline ''
-
mvn de.qaware.maven:go-offline-maven-plugin:1.2.8:resolve-dependencies -Dmaven.repo.local=$out/.m2 ${mvnDepsParameters}
+
mvn $MAVEN_EXTRA_ARGS de.qaware.maven:go-offline-maven-plugin:1.2.8:resolve-dependencies -Dmaven.repo.local=$out/.m2 ${mvnDepsParameters}
for artifactId in ${builtins.toString manualMvnArtifacts}
do
echo "downloading manual $artifactId"
-
mvn dependency:get -Dartifact="$artifactId" -Dmaven.repo.local=$out/.m2
+
mvn $MAVEN_EXTRA_ARGS dependency:get -Dartifact="$artifactId" -Dmaven.repo.local=$out/.m2
done
for artifactId in ${builtins.toString manualMvnSources}
···
group=$(echo $artifactId | cut -d':' -f1)
artifact=$(echo $artifactId | cut -d':' -f2)
echo "downloading manual sources $artifactId"
-
mvn dependency:sources -DincludeGroupIds="$group" -DincludeArtifactIds="$artifact" -Dmaven.repo.local=$out/.m2
+
mvn $MAVEN_EXTRA_ARGS dependency:sources -DincludeGroupIds="$group" -DincludeArtifactIds="$artifact" -Dmaven.repo.local=$out/.m2
done
''
+ lib.optionalString (!buildOffline) ''
-
mvn package -Dmaven.repo.local=$out/.m2 ${mvnSkipTests} ${mvnParameters}
+
mvn $MAVEN_EXTRA_ARGS package -Dmaven.repo.local=$out/.m2 ${mvnSkipTests} ${mvnParameters}
''
+ ''
runHook postBuild
+86
pkgs/by-name/ma/maven/maven-proxy.py
···
+
"""
+
Maven doesn't honor HTTP[S]_PROXY and NO_PROXY env vars out of the box.
+
Instead, it expects the user to configure a settings.xml file.
+
We however impurely pass only these env vars in FODs.
+
This creates the XML file on demand, if one or more env vars is set.
+
"""
+
+
import os
+
import sys
+
from urllib.parse import urlparse
+
+
+
def parse_proxy_url(url):
+
if url is None:
+
return None
+
parsed = urlparse(url)
+
+
if parsed.hostname is None:
+
print(f"Failed to parse proxy URL {url}, ignoring", file=sys.stderr)
+
return None
+
+
return {
+
'protocol': parsed.scheme or 'http',
+
'host': parsed.hostname,
+
'port': parsed.port or (443 if parsed.scheme == 'https' else 80),
+
'username': parsed.username,
+
'password': parsed.password
+
}
+
+
+
def format_proxy_block(proxy, id_suffix, non_proxy_hosts):
+
auth = ""
+
if proxy.get("username"):
+
auth += f" <username>{proxy['username']}</username>\n"
+
if proxy.get("password"):
+
auth += f" <password>{proxy['password']}</password>\n"
+
+
np_hosts = ""
+
if non_proxy_hosts:
+
np_hosts = f" <nonProxyHosts>{non_proxy_hosts}</nonProxyHosts>\n"
+
+
return f""" <proxy>
+
<id>{id_suffix}-proxy</id>
+
<active>true</active>
+
<protocol>{proxy['protocol']}</protocol>
+
<host>{proxy['host']}</host>
+
<port>{proxy['port']}</port>
+
{auth}{np_hosts} </proxy>"""
+
+
+
def main(output_path):
+
http_proxy = parse_proxy_url(os.environ.get("HTTP_PROXY"))
+
https_proxy = parse_proxy_url(os.environ.get("HTTPS_PROXY"))
+
non_proxy_hosts = os.environ.get("NO_PROXY", "").replace(",", "|")
+
+
proxy_blocks = []
+
+
if http_proxy:
+
proxy_blocks.append(
+
format_proxy_block(http_proxy, "http", non_proxy_hosts)
+
)
+
if https_proxy and https_proxy != http_proxy:
+
proxy_blocks.append(
+
format_proxy_block(https_proxy, "https", non_proxy_hosts)
+
)
+
+
settings_xml = f"""<?xml version="1.0" encoding="UTF-8"?>
+
<settings xmlns="http://maven.apache.org/SETTINGS/1.0.0"
+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+
xsi:schemaLocation="http://maven.apache.org/SETTINGS/1.0.0
+
http://maven.apache.org/xsd/settings-1.0.0.xsd">
+
<proxies>
+
{'\n'.join(proxy_blocks)}
+
</proxies>
+
</settings>
+
"""
+
+
with open(output_path, "w") as f:
+
f.write(settings_xml)
+
+
print(f"Generated Maven settings.xml at {output_path}")
+
+
+
if __name__ == "__main__":
+
output_file = sys.argv[1] if len(sys.argv) > 1 else "settings.xml"
+
main(output_file)
+34 -3
pkgs/by-name/ne/nexusmods-app/package.nix
···
_7zz,
avalonia,
buildDotnetModule,
-
copyDesktopItems,
desktop-file-utils,
dotnetCorePackages,
fetchgit,
···
nativeCheckInputs = [ _7zz ];
nativeBuildInputs = [
-
copyDesktopItems
imagemagick # For resizing SVG icon in postInstall
];
···
];
postInstall = ''
+
${lib.strings.toShellVars {
+
inherit (finalAttrs.meta) mainProgram;
+
INSTALL_EXEC = "\${INSTALL_EXEC}";
+
INSTALL_TRYEXEC = "\${INSTALL_TRYEXEC}";
+
}}
+
# Desktop entry
# As per #308324, use mainProgram from PATH, instead of $out/bin/NexusMods.App
install -D -m 444 -t $out/share/applications src/NexusMods.App/com.nexusmods.app.desktop
substituteInPlace $out/share/applications/com.nexusmods.app.desktop \
-
--replace-fail '${"$"}{INSTALL_EXEC}' "${finalAttrs.meta.mainProgram}"
+
--replace-fail "$INSTALL_EXEC" "$mainProgram" \
+
--replace-fail "$INSTALL_TRYEXEC" "$mainProgram"
# AppStream metadata
install -D -m 444 -t $out/share/metainfo src/NexusMods.App/com.nexusmods.app.metainfo.xml
···
++ lib.optionals (!_7zz.meta.unfree) [
"NexusMods.Games.FOMOD.Tests.FomodXmlInstallerTests.InstallsFilesSimple_UsingRar"
];
+
+
doInstallCheck = true;
+
+
nativeInstallCheckInputs = [
+
desktop-file-utils
+
];
+
+
# Upstream use ${...} templates in the desktop entry, so assert that we haven't missed any
+
# See https://github.com/NixOS/nixpkgs/issues/421241
+
installCheckPhase = ''
+
runHook preInstallCheck
+
+
echo 'Checking for issues in $out/share/applications/com.nexusmods.app.desktop'
+
(
+
cd $out/share/applications
+
desktop-file-validate com.nexusmods.app.desktop
+
if grep '\$' com.nexusmods.app.desktop \
+
--with-filename --line-number
+
then
+
echo 'error: unexpected "$"'
+
exit 1
+
fi
+
) &>/dev/stderr
+
+
runHook postInstallCheck
+
'';
passthru.updateScript = nix-update-script { };
+12 -1
pkgs/by-name/pr/pritunl-client/package.nix
···
iproute2,
openvpn,
electron,
+
wireguard-tools,
+
withWireguard ? stdenv.hostPlatform.isLinux,
}:
let
version = "1.3.4275.94";
···
--prefix PATH : ${lib.makeBinPath hookScriptsDeps} \
--add-flags "--setenv PATH \$PATH"
'';
+
pritunlDeps =
+
[
+
openvpn-wrapped
+
]
+
++ lib.optionals withWireguard [
+
openresolv
+
coreutils
+
wireguard-tools
+
];
in
lib.optionalString stdenv.hostPlatform.isLinux ''
wrapProgram $out/bin/pritunl-client-service \
-
--prefix PATH : "${lib.makeBinPath ([ openvpn-wrapped ])}"
+
--prefix PATH : "${lib.makeBinPath pritunlDeps}"
'';
passthru.updateScript = nix-update-script { };
};
+49
pkgs/development/compilers/dotnet/vmr-compiler-opt-v8.patch
···
+
diff --git a/src/runtime/src/native/corehost/corehost.cpp b/src/runtime/src/native/corehost/corehost.cpp
+
index 5edc2fbf5d5..1b3f5b1a23a 100644
+
--- a/src/runtime/src/native/corehost/corehost.cpp
+
+++ b/src/runtime/src/native/corehost/corehost.cpp
+
@@ -40,14 +40,27 @@
+
#define EMBED_HASH_LO_PART_UTF8 "74e592c2fa383d4a3960714caef0c4f2"
+
#define EMBED_HASH_FULL_UTF8 (EMBED_HASH_HI_PART_UTF8 EMBED_HASH_LO_PART_UTF8) // NUL terminated
+
+
+// This avoids compiler optimization which cause EMBED_HASH_HI_PART_UTF8 EMBED_HASH_LO_PART_UTF8
+
+// to be placed adjacent causing them to match EMBED_HASH_FULL_UTF8 when searched for replacing.
+
+// See https://github.com/dotnet/runtime/issues/109611 for more details.
+
+static bool compare_memory_nooptimization(volatile const char* a, volatile const char* b, size_t length)
+
+{
+
+ for (size_t i = 0; i < length; i++)
+
+ {
+
+ if (*a++ != *b++)
+
+ return false;
+
+ }
+
+ return true;
+
+}
+
+
+
bool is_exe_enabled_for_execution(pal::string_t* app_dll)
+
{
+
constexpr int EMBED_SZ = sizeof(EMBED_HASH_FULL_UTF8) / sizeof(EMBED_HASH_FULL_UTF8[0]);
+
constexpr int EMBED_MAX = (EMBED_SZ > 1025 ? EMBED_SZ : 1025); // 1024 DLL name length, 1 NUL
+
+
// Contains the EMBED_HASH_FULL_UTF8 value at compile time or the managed DLL name replaced by "dotnet build".
+
- // Must not be 'const' because std::string(&embed[0]) below would bind to a const string ctor plus length
+
- // where length is determined at compile time (=64) instead of the actual length of the string at runtime.
+
+ // Must not be 'const' because strlen below could be determined at compile time (=64) instead of the actual
+
+ // length of the string at runtime.
+
static char embed[EMBED_MAX] = EMBED_HASH_FULL_UTF8; // series of NULs followed by embed hash string
+
+
static const char hi_part[] = EMBED_HASH_HI_PART_UTF8;
+
@@ -64,10 +77,10 @@ bool is_exe_enabled_for_execution(pal::string_t* app_dll)
+
size_t hi_len = (sizeof(hi_part) / sizeof(hi_part[0])) - 1;
+
size_t lo_len = (sizeof(lo_part) / sizeof(lo_part[0])) - 1;
+
+
- std::string binding(&embed[0]);
+
- if ((binding.size() >= (hi_len + lo_len)) &&
+
- binding.compare(0, hi_len, &hi_part[0]) == 0 &&
+
- binding.compare(hi_len, lo_len, &lo_part[0]) == 0)
+
+ size_t binding_len = strlen(&embed[0]);
+
+ if ((binding_len >= (hi_len + lo_len))
+
+ && compare_memory_nooptimization(&embed[0], hi_part, hi_len) == 0
+
+ && compare_memory_nooptimization(&embed[hi_len], lo_part, lo_len))
+
{
+
trace::error(_X("This executable is not bound to a managed DLL to execute. The binding value is: '%s'"), app_dll->c_str());
+
return false;
+220
pkgs/development/compilers/dotnet/vmr-compiler-opt-v9.patch
···
+
From 4e333377f97ab8f0f47ba7606844c34cb61d1db0 Mon Sep 17 00:00:00 2001
+
From: Omair Majid <omajid@redhat.com>
+
Date: Mon, 9 Dec 2024 17:44:10 -0500
+
Subject: [PATCH 1/4] Avoid all compiler optimization on embedded apphost hash
+
+
We assume that there is a single copy of the apphost hash in the apphost
+
binary. And that it hasn't been modified by the compiler. However, the
+
compiler can optimize the hash multiple ways, including re-ordering
+
elements of the hash or duplicating the contents of the hash. This can
+
currently happen under certain compiler versions and optimization flags.
+
+
Try and avoid that by marking the hash as a volatile string and
+
implementing comparisons/copying/initialization that respects that.
+
+
Fixes: #109611
+
---
+
src/runtime/src/native/corehost/corehost.cpp | 31 ++++++++++++++++++++++++++-----
+
1 file changed, 26 insertions(+), 5 deletions(-)
+
+
diff --git a/src/runtime/src/native/corehost/corehost.cpp b/src/runtime/src/native/corehost/corehost.cpp
+
index 6de7acfbd08576..6d40a337d574a2 100644
+
--- a/src/runtime/src/native/corehost/corehost.cpp
+
+++ b/src/runtime/src/native/corehost/corehost.cpp
+
@@ -40,6 +40,24 @@
+
#define EMBED_HASH_LO_PART_UTF8 "74e592c2fa383d4a3960714caef0c4f2"
+
#define EMBED_HASH_FULL_UTF8 (EMBED_HASH_HI_PART_UTF8 EMBED_HASH_LO_PART_UTF8) // NUL terminated
+
+
+void to_non_volatile(volatile const char* cstr, char* output, size_t length)
+
+{
+
+ for (size_t i = 0; i < length; i++)
+
+ {
+
+ output[i] = cstr[i];
+
+ }
+
+}
+
+
+
+bool compare_memory_nooptimization(volatile const char* a, volatile const char* b, size_t length)
+
+{
+
+ for (size_t i = 0; i < length; i++)
+
+ {
+
+ if (*a++ != *b++)
+
+ return false;
+
+ }
+
+ return true;
+
+}
+
+
+
bool is_exe_enabled_for_execution(pal::string_t* app_dll)
+
{
+
constexpr int EMBED_SZ = sizeof(EMBED_HASH_FULL_UTF8) / sizeof(EMBED_HASH_FULL_UTF8[0]);
+
@@ -48,18 +66,21 @@ bool is_exe_enabled_for_execution(pal::string_t* app_dll)
+
// Contains the EMBED_HASH_FULL_UTF8 value at compile time or the managed DLL name replaced by "dotnet build".
+
// Must not be 'const' because std::string(&embed[0]) below would bind to a const string ctor plus length
+
// where length is determined at compile time (=64) instead of the actual length of the string at runtime.
+
- static char embed[EMBED_MAX] = EMBED_HASH_FULL_UTF8; // series of NULs followed by embed hash string
+
+ volatile static char embed[EMBED_MAX] = EMBED_HASH_FULL_UTF8; // series of NULs followed by embed hash string
+
+
static const char hi_part[] = EMBED_HASH_HI_PART_UTF8;
+
static const char lo_part[] = EMBED_HASH_LO_PART_UTF8;
+
+
- if (!pal::clr_palstring(embed, app_dll))
+
+ char working_copy_embed[EMBED_MAX];
+
+ to_non_volatile(embed, working_copy_embed, EMBED_MAX);
+
+
+
+ if (!pal::clr_palstring(&working_copy_embed[0], app_dll))
+
{
+
trace::error(_X("The managed DLL bound to this executable could not be retrieved from the executable image."));
+
return false;
+
}
+
+
- std::string binding(&embed[0]);
+
+ std::string binding(&working_copy_embed[0]);
+
+
// Check if the path exceeds the max allowed size
+
if (binding.size() > EMBED_MAX - 1) // -1 for null terminator
+
@@ -74,8 +95,8 @@ bool is_exe_enabled_for_execution(pal::string_t* app_dll)
+
size_t hi_len = (sizeof(hi_part) / sizeof(hi_part[0])) - 1;
+
size_t lo_len = (sizeof(lo_part) / sizeof(lo_part[0])) - 1;
+
if (binding.size() >= (hi_len + lo_len)
+
- && binding.compare(0, hi_len, &hi_part[0]) == 0
+
- && binding.compare(hi_len, lo_len, &lo_part[0]) == 0)
+
+ && compare_memory_nooptimization(binding.c_str(), hi_part, hi_len)
+
+ && compare_memory_nooptimization(binding.substr(hi_len).c_str(), lo_part, lo_len))
+
{
+
trace::error(_X("This executable is not bound to a managed DLL to execute. The binding value is: '%s'"), app_dll->c_str());
+
return false;
+
+
From 2c67debff3f84519b7b5cba49232aaa2396a9f3e Mon Sep 17 00:00:00 2001
+
From: Aaron R Robinson <arobins@microsoft.com>
+
Date: Wed, 26 Mar 2025 20:40:51 -0700
+
Subject: [PATCH 2/4] Apply feedback
+
+
---
+
src/runtime/src/native/corehost/corehost.cpp | 20 ++++++--------------
+
1 file changed, 6 insertions(+), 14 deletions(-)
+
+
diff --git a/src/runtime/src/native/corehost/corehost.cpp b/src/runtime/src/native/corehost/corehost.cpp
+
index 6d40a337d574a2..9d2648c0ba84fa 100644
+
--- a/src/runtime/src/native/corehost/corehost.cpp
+
+++ b/src/runtime/src/native/corehost/corehost.cpp
+
@@ -40,14 +40,9 @@
+
#define EMBED_HASH_LO_PART_UTF8 "74e592c2fa383d4a3960714caef0c4f2"
+
#define EMBED_HASH_FULL_UTF8 (EMBED_HASH_HI_PART_UTF8 EMBED_HASH_LO_PART_UTF8) // NUL terminated
+
+
-void to_non_volatile(volatile const char* cstr, char* output, size_t length)
+
-{
+
- for (size_t i = 0; i < length; i++)
+
- {
+
- output[i] = cstr[i];
+
- }
+
-}
+
-
+
+// This is a workaround for a compiler workaround that
+
+// causes issues with inserting multiple static strings.
+
+// See https://github.com/dotnet/runtime/issues/109611 for more details.
+
bool compare_memory_nooptimization(volatile const char* a, volatile const char* b, size_t length)
+
{
+
for (size_t i = 0; i < length; i++)
+
@@ -66,21 +61,18 @@ bool is_exe_enabled_for_execution(pal::string_t* app_dll)
+
// Contains the EMBED_HASH_FULL_UTF8 value at compile time or the managed DLL name replaced by "dotnet build".
+
// Must not be 'const' because std::string(&embed[0]) below would bind to a const string ctor plus length
+
// where length is determined at compile time (=64) instead of the actual length of the string at runtime.
+
- volatile static char embed[EMBED_MAX] = EMBED_HASH_FULL_UTF8; // series of NULs followed by embed hash string
+
+ static char embed[EMBED_MAX] = EMBED_HASH_FULL_UTF8; // series of NULs followed by embed hash string
+
+
static const char hi_part[] = EMBED_HASH_HI_PART_UTF8;
+
static const char lo_part[] = EMBED_HASH_LO_PART_UTF8;
+
+
- char working_copy_embed[EMBED_MAX];
+
- to_non_volatile(embed, working_copy_embed, EMBED_MAX);
+
-
+
- if (!pal::clr_palstring(&working_copy_embed[0], app_dll))
+
+ if (!pal::clr_palstring(embed, app_dll))
+
{
+
trace::error(_X("The managed DLL bound to this executable could not be retrieved from the executable image."));
+
return false;
+
}
+
+
- std::string binding(&working_copy_embed[0]);
+
+ std::string binding(&embed[0]);
+
+
// Check if the path exceeds the max allowed size
+
if (binding.size() > EMBED_MAX - 1) // -1 for null terminator
+
+
From 854143d39e7725d82547032f1ab47ea5da062b9f Mon Sep 17 00:00:00 2001
+
From: Aaron R Robinson <arobins@microsoft.com>
+
Date: Thu, 27 Mar 2025 19:04:09 -0700
+
Subject: [PATCH 3/4] Feedback
+
+
---
+
src/runtime/src/native/corehost/corehost.cpp | 16 ++++++++--------
+
1 file changed, 8 insertions(+), 8 deletions(-)
+
+
diff --git a/src/runtime/src/native/corehost/corehost.cpp b/src/runtime/src/native/corehost/corehost.cpp
+
index 9d2648c0ba84fa..36902ccfa56c04 100644
+
--- a/src/runtime/src/native/corehost/corehost.cpp
+
+++ b/src/runtime/src/native/corehost/corehost.cpp
+
@@ -40,10 +40,10 @@
+
#define EMBED_HASH_LO_PART_UTF8 "74e592c2fa383d4a3960714caef0c4f2"
+
#define EMBED_HASH_FULL_UTF8 (EMBED_HASH_HI_PART_UTF8 EMBED_HASH_LO_PART_UTF8) // NUL terminated
+
+
-// This is a workaround for a compiler workaround that
+
-// causes issues with inserting multiple static strings.
+
+// This avoids compiler optimization which cause EMBED_HASH_HI_PART_UTF8 EMBED_HASH_LO_PART_UTF8
+
+// to be placed adjacent causing them to match EMBED_HASH_FULL_UTF8 when searched for replacing.
+
// See https://github.com/dotnet/runtime/issues/109611 for more details.
+
-bool compare_memory_nooptimization(volatile const char* a, volatile const char* b, size_t length)
+
+static bool compare_memory_nooptimization(volatile const char* a, volatile const char* b, size_t length)
+
{
+
for (size_t i = 0; i < length; i++)
+
{
+
@@ -72,10 +72,10 @@ bool is_exe_enabled_for_execution(pal::string_t* app_dll)
+
return false;
+
}
+
+
- std::string binding(&embed[0]);
+
+ size_t binding_len = strlen(&embed[0]);
+
+
// Check if the path exceeds the max allowed size
+
- if (binding.size() > EMBED_MAX - 1) // -1 for null terminator
+
+ if (binding_len > EMBED_MAX - 1) // -1 for null terminator
+
{
+
trace::error(_X("The managed DLL bound to this executable is longer than the max allowed length (%d)"), EMBED_MAX - 1);
+
return false;
+
@@ -86,9 +86,9 @@ bool is_exe_enabled_for_execution(pal::string_t* app_dll)
+
// So use two parts of the string that will be unaffected by the edit.
+
size_t hi_len = (sizeof(hi_part) / sizeof(hi_part[0])) - 1;
+
size_t lo_len = (sizeof(lo_part) / sizeof(lo_part[0])) - 1;
+
- if (binding.size() >= (hi_len + lo_len)
+
- && compare_memory_nooptimization(binding.c_str(), hi_part, hi_len)
+
- && compare_memory_nooptimization(binding.substr(hi_len).c_str(), lo_part, lo_len))
+
+ if (binding_len >= (hi_len + lo_len)
+
+ && compare_memory_nooptimization(&embed[0], hi_part, hi_len)
+
+ && compare_memory_nooptimization(&embed[hi_len], lo_part, lo_len))
+
{
+
trace::error(_X("This executable is not bound to a managed DLL to execute. The binding value is: '%s'"), app_dll->c_str());
+
return false;
+
+
From 842d62e499ce6511abf948cf5da8023cc6be8212 Mon Sep 17 00:00:00 2001
+
From: Aaron R Robinson <arobins@microsoft.com>
+
Date: Fri, 28 Mar 2025 15:44:47 -0700
+
Subject: [PATCH 4/4] Feedback
+
+
---
+
src/runtime/src/native/corehost/corehost.cpp | 4 ++--
+
1 file changed, 2 insertions(+), 2 deletions(-)
+
+
diff --git a/src/runtime/src/native/corehost/corehost.cpp b/src/runtime/src/native/corehost/corehost.cpp
+
index 36902ccfa56c04..54eb128cb486bb 100644
+
--- a/src/runtime/src/native/corehost/corehost.cpp
+
+++ b/src/runtime/src/native/corehost/corehost.cpp
+
@@ -59,8 +59,8 @@ bool is_exe_enabled_for_execution(pal::string_t* app_dll)
+
constexpr int EMBED_MAX = (EMBED_SZ > 1025 ? EMBED_SZ : 1025); // 1024 DLL name length, 1 NUL
+
+
// Contains the EMBED_HASH_FULL_UTF8 value at compile time or the managed DLL name replaced by "dotnet build".
+
- // Must not be 'const' because std::string(&embed[0]) below would bind to a const string ctor plus length
+
- // where length is determined at compile time (=64) instead of the actual length of the string at runtime.
+
+ // Must not be 'const' because strlen below could be determined at compile time (=64) instead of the actual
+
+ // length of the string at runtime.
+
static char embed[EMBED_MAX] = EMBED_HASH_FULL_UTF8; // series of NULs followed by embed hash string
+
+
static const char hi_part[] = EMBED_HASH_HI_PART_UTF8;
+2
pkgs/development/compilers/dotnet/vmr.nix
···
patches =
lib.optionals (lib.versionAtLeast version "9" && lib.versionOlder version "10") [
./UpdateNuGetConfigPackageSourcesMappings-don-t-add-em.patch
+
./vmr-compiler-opt-v9.patch
]
++ lib.optionals (lib.versionOlder version "9") [
./fix-aspnetcore-portable-build.patch
+
./vmr-compiler-opt-v8.patch
]
++ lib.optionals (lib.versionAtLeast version "10") [
# src/repos/projects/Directory.Build.targets(106,5): error MSB4018: The "AddSourceToNuGetConfig" task failed unexpectedly.
+57
pkgs/development/python-modules/llm-perplexity/default.nix
···
+
{
+
lib,
+
buildPythonPackage,
+
fetchFromGitHub,
+
+
# build-system
+
setuptools,
+
+
# dependencies
+
llm,
+
openai,
+
+
# tests
+
pytestCheckHook,
+
writableTmpDirAsHomeHook,
+
python-dotenv,
+
pillow,
+
llm-perplexity,
+
}:
+
buildPythonPackage rec {
+
pname = "llm-perplexity";
+
version = "2025.6.0";
+
pyproject = true;
+
+
src = fetchFromGitHub {
+
owner = "hex";
+
repo = "llm-perplexity";
+
tag = version;
+
hash = "sha256-LTf2TY5bjSb7ARXrhWj1ctGuMpnq2Kl/kv/hrgX/m/M=";
+
};
+
+
build-system = [ setuptools ];
+
+
dependencies = [
+
llm
+
openai
+
];
+
+
nativeCheckInputs = [
+
pytestCheckHook
+
writableTmpDirAsHomeHook
+
python-dotenv
+
pillow
+
];
+
+
pythonImportsCheck = [ "llm_perplexity" ];
+
+
passthru.tests = llm.mkPluginTest llm-perplexity;
+
+
meta = {
+
description = "LLM access to pplx-api";
+
homepage = "https://github.com/hex/llm-perplexity";
+
changelog = "https://github.com/hex/llm-perplexity/releases/tag/${version}";
+
license = lib.licenses.asl20;
+
maintainers = with lib.maintainers; [ jed-richards ];
+
};
+
}
+1
pkgs/development/python-modules/llm/default.nix
···
llm-openai-plugin ? false,
llm-openrouter ? false,
llm-pdf-to-images ? false,
+
llm-perplexity ? false,
llm-sentence-transformers ? false,
llm-templates-fabric ? false,
llm-templates-github ? false,
+7 -5
pkgs/tools/security/proxmark3/default.nix
···
assert withBlueshark -> stdenv.hostPlatform.isLinux;
stdenv.mkDerivation (finalAttrs: {
pname = "proxmark3";
-
version = "4.20142";
+
version = "4.20469";
src = fetchFromGitHub {
owner = "RfidResearchGroup";
repo = "proxmark3";
rev = "v${finalAttrs.version}";
-
hash = "sha256-kdwjwydeX8EwJazFzrrk5osv0YVzDVzn2S1sDKRQdR8=";
+
hash = "sha256-Z87YCuNWQ66FTAq7qXUYKI25BEWrXD+YK0GczDmWc9A=";
};
patches = [
···
postPatch = ''
# Remove hardcoded paths on Darwin
substituteInPlace Makefile.defs \
-
--replace "/usr/bin/ar" "ar" \
-
--replace "/usr/bin/ranlib" "ranlib"
+
--replace-fail "/usr/bin/ar" "ar" \
+
--replace-fail "/usr/bin/ranlib" "ranlib"
# Replace hardcoded path to libwhereami
+
# Replace darwin sed syntax with gnused
substituteInPlace client/Makefile \
-
--replace "/usr/include/whereami.h" "${whereami}/include/whereami.h"
+
--replace-fail "/usr/include/whereami.h" "${whereami}/include/whereami.h" \
+
--replace-fail "sed -E -i '''" "sed -i"
'';
nativeBuildInputs = [
+2
pkgs/top-level/python-packages.nix
···
llm-pdf-to-images = callPackage ../development/python-modules/llm-pdf-to-images { };
+
llm-perplexity = callPackage ../development/python-modules/llm-perplexity { };
+
llm-sentence-transformers = callPackage ../development/python-modules/llm-sentence-transformers { };
llm-templates-fabric = callPackage ../development/python-modules/llm-templates-fabric { };