commit 79542ad7f3c4264da04f7bb96600ecdae877fc1f · pyrox.dev/nixpkgs

+3

.github/workflows/eval.yml

···

       75
       75
        
               with:

     

       76
       76
        
                 extra_nix_config: sandbox = true

     

       77
       77
        
       

     

       78
       78
       +
             - name: Ensure flake outputs on all systems still evaluate

     

       79
       79
       +
               run: nix --experimental-features 'nix-command flakes' flake check --all-systems --no-build ./nixpkgs

     

       80
       80
       +
       

     

       78
       81
        
             - name: Query nixpkgs with aliases enabled to check for basic syntax errors

     

       79
       82
        
               run: |

     

       80
       83
        
                 time nix-env -I ./nixpkgs -f ./nixpkgs -qa '*' --option restrict-eval true --option allow-import-from-derivation false >/dev/null

+25 -6

flake.nix

···

       98
       98
        
       

     

       99
       99
        
             checks = forAllSystems (

     

       100
       100
        
               system:

     

       101
       101
       -
               {

     

       102
       102
       -
                 tarball = jobs.${system}.tarball;

     

       103
       103
       -
               }

     

       101
       101
       +
               { }

     

       102
       102
       +
               //

     

       103
       103
       +
                 lib.optionalAttrs

     

       104
       104
       +
                   (

     

       105
       105
       +
                     # Exclude x86_64-freebsd because "Failed to evaluate rustc-wrapper-1.85.0: «broken»: is marked as broken"

     

       106
       106
       +
                     system != "x86_64-freebsd"

     

       107
       107
       +
                   )

     

       108
       108
       +
                   {

     

       109
       109
       +
                     tarball = jobs.${system}.tarball;

     

       110
       110
       +
                   }

     

       104
       111
        
               //

     

       105
       112
        
                 lib.optionalAttrs

     

       106
       113
        
                   (

     

       107
       114
        
                     self.legacyPackages.${system}.stdenv.hostPlatform.isLinux

     

       108
       115
        
                     # Exclude power64 due to "libressl is not available on the requested hostPlatform" with hostPlatform being power64

     

       109
       116
        
                     && !self.legacyPackages.${system}.targetPlatform.isPower64

     

       117
       117
       +
                     # Exclude armv6l-linux because "cannot bootstrap GHC on this platform ('armv6l-linux' with libc 'defaultLibc')"

     

       118
       118
       +
                     && system != "armv6l-linux"

     

       119
       119
       +
                     # Exclude riscv64-linux because "cannot bootstrap GHC on this platform ('riscv64-linux' with libc 'defaultLibc')"

     

       120
       120
       +
                     && system != "riscv64-linux"

     

       110
       121
        
                   )

     

       111
       122
        
                   {

     

       112
       123
        
                     # Test that ensures that the nixosSystem function can accept a lib argument

     
···

       156
       167
        
                     system != "armv6l-linux"

     

       157
       168
        
                     # Exclude riscv64-linux because "Package ‘ghc-9.6.6’ in .../pkgs/development/compilers/ghc/common-hadrian.nix:579 is not available on the requested hostPlatform"

     

       158
       169
        
                     && system != "riscv64-linux"

     

       159
       159
       -
                     # Exclude FreeBSD because "Package ‘ghc-9.6.6’ in .../pkgs/development/compilers/ghc/common-hadrian.nix:579 is not available on the requested hostPlatform"

     

       160
       160
       -
                     && !self.legacyPackages.${system}.stdenv.hostPlatform.isFreeBSD

     

       170
       170
       +
                     # Exclude x86_64-freebsd because "Package ‘ghc-9.6.6’ in .../pkgs/development/compilers/ghc/common-hadrian.nix:579 is not available on the requested hostPlatform"

     

       171
       171
       +
                     && system != "x86_64-freebsd"

     

       161
       172
        
                   )

     

       162
       173
        
                   {

     

       163
       174
        
                     /**

     
···

       167
       178
        
                   }

     

       168
       179
        
             );

     

       169
       180
        
       

     

       170
       170
       -
             formatter = forAllSystems (system: (import ./ci { inherit system; }).fmt.pkg);

     

       181
       181
       +
             formatter = lib.filterAttrs (

     

       182
       182
       +
               system: _:

     

       183
       183
       +
               # Exclude armv6l-linux because "cannot bootstrap GHC on this platform ('armv6l-linux' with libc 'defaultLibc')"

     

       184
       184
       +
               system != "armv6l-linux"

     

       185
       185
       +
               # Exclude riscv64-linux because "cannot bootstrap GHC on this platform ('riscv64-linux' with libc 'defaultLibc')"

     

       186
       186
       +
               && system != "riscv64-linux"

     

       187
       187
       +
               # Exclude x86_64-freebsd because "Package ‘go-1.22.12-freebsd-amd64-bootstrap’ in /nix/store/0yw40qnrar3lvc5hax5n49abl57apjbn-source/pkgs/development/compilers/go/binary.nix:50 is not available on the requested hostPlatform"

     

       188
       188
       +
               && system != "x86_64-freebsd"

     

       189
       189
       +
             ) (forAllSystems (system: (import ./ci { inherit system; }).fmt.pkg));

     

       171
       190
        
       

     

       172
       191
        
             /**

     

       173
       192
        
               A nested structure of [packages](https://nix.dev/manual/nix/latest/glossary#package-attribute-set) and other values.

+2

nixos/doc/manual/release-notes/rl-2505.section.md

···

       166
       166
        
       

     

       167
       167
        
       - [mqtt-exporter](https://github.com/kpetremann/mqtt-exporter/), a Prometheus exporter for exposing messages from MQTT. Available as [services.prometheus.exporters.mqtt](#opt-services.prometheus.exporters.mqtt.enable).

     

       168
       168
        
       

     

       169
       169
       +
       - [pocket-id](https://pocket-id.org/), an OIDC provider with passkeys support. Available as [services.pocket-id](#opt-services.pocket-id.enable).

     

       170
       170
       +
       

     

       169
       171
        
       - [nvidia-gpu](https://github.com/utkuozdemir/nvidia_gpu_exporter), a Prometheus exporter that scrapes `nvidia-smi` for GPU metrics. Available as [services.prometheus.exporters.nvidia-gpu](#opt-services.prometheus.exporters.nvidia-gpu.enable).

     

       170
       172
        
       

     

       171
       173
        
       - [OpenGamepadUI](https://github.com/ShadowBlip/OpenGamepadUI/), an open source gamepad-native game launcher and overlay for Linux. Available as [programs.opengamepadui](#opt-programs.opengamepadui.enable).

+1

nixos/modules/module-list.nix

···

       1419
       1419
        
         ./services/security/paretosecurity.nix

     

       1420
       1420
        
         ./services/security/pass-secret-service.nix

     

       1421
       1421
        
         ./services/security/physlock.nix

     

       1422
       1422
       +
         ./services/security/pocket-id.nix

     

       1422
       1423
        
         ./services/security/shibboleth-sp.nix

     

       1423
       1424
        
         ./services/security/sks.nix

     

       1424
       1425
        
         ./services/security/sshguard.nix

+11 -9

nixos/modules/services/misc/paperless.nix

···

       421
       421
        
                 };

     

       422
       422
        
                 environment = env;

     

       423
       423
        
       

     

       424
       424
       -
                 preStart =

     

       425
       425
       -
                   ''

     

       424
       424
       +
                 preStart = ''

     

       426
       425
        
                     # remove old papaerless-manage symlink

     

       427
       426
        
                     # TODO: drop with NixOS 25.11

     

       428
       427
        
                     [[ -L '${cfg.dataDir}/paperless-manage' ]] && rm '${cfg.dataDir}/paperless-manage'

     
···

       448
       447
        
                         ${cfg.package}/bin/paperless-ngx document_index reindex

     

       449
       448
        
                       fi

     

       450
       449
        
       

     

       451
       451
       -
                       echo ${cfg.package.version} > "$versionFile"

     

       450
       450
       +
                     echo ${cfg.package.version} > "$versionFile"

     

       451
       451
       +
                   fi

     

       452
       452
       +
       

     

       453
       453
       +
                   if ${lib.boolToString (cfg.passwordFile != null)} || [[ -n $PAPERLESS_ADMIN_PASSWORD ]]; then

     

       454
       454
       +
                     export PAPERLESS_ADMIN_USER="''${PAPERLESS_ADMIN_USER:-admin}"

     

       455
       455
       +
                     if [[ -e $CREDENTIALS_DIRECTORY/PAPERLESS_ADMIN_PASSWORD ]]; then

     

       456
       456
       +
                       PAPERLESS_ADMIN_PASSWORD=$(cat "$CREDENTIALS_DIRECTORY/PAPERLESS_ADMIN_PASSWORD")

     

       457
       457
       +
                       export PAPERLESS_ADMIN_PASSWORD

     

       452
       458
        
                     fi

     

       453
       453
       -
                   ''

     

       454
       454
       -
                   + lib.optionalString (cfg.passwordFile != null) ''

     

       455
       455
       -
                     export PAPERLESS_ADMIN_USER="''${PAPERLESS_ADMIN_USER:-admin}"

     

       456
       456
       -
                     PAPERLESS_ADMIN_PASSWORD=$(cat "$CREDENTIALS_DIRECTORY/PAPERLESS_ADMIN_PASSWORD")

     

       457
       457
       -
                     export PAPERLESS_ADMIN_PASSWORD

     

       458
       459
        
                     superuserState="$PAPERLESS_ADMIN_USER:$PAPERLESS_ADMIN_PASSWORD"

     

       459
       460
        
                     superuserStateFile="${cfg.dataDir}/superuser-state"

     

       460
       461
        
       

     
···

       462
       463
        
                       ${cfg.package}/bin/paperless-ngx manage_superuser

     

       463
       464
        
                       echo "$superuserState" > "$superuserStateFile"

     

       464
       465
        
                     fi

     

       465
       465
       -
                   '';

     

       466
       466
       +
                   fi

     

       467
       467
       +
                 '';

     

       466
       468
        
                 requires = lib.optional cfg.database.createLocally "postgresql.service";

     

       467
       469
        
                 after =

     

       468
       470
        
                   lib.optional enableRedis "redis-paperless.service"

+14

nixos/modules/services/security/paretosecurity.nix

···

       24
       24
        
           # dependencies here. This creates the necessary symlinks in the proper locations.

     

       25
       25
        
           systemd.sockets.paretosecurity.wantedBy = [ "sockets.target" ];

     

       26
       26
        
       

     

       27
       27
       +
           # In NixOS, systemd services are configured with minimal PATH. However,

     

       28
       28
       +
           # paretosecurity helper looks for installed software to do its job, so

     

       29
       29
       +
           # it needs the full system PATH. For example, it runs `iptables` to see if

     

       30
       30
       +
           # firewall is configured. And it looks for various password managers to see

     

       31
       31
       +
           # if one is installed.

     

       32
       32
       +
           # The `paretosecurity-user` timer service that is configured lower has

     

       33
       33
       +
           # the same need.

     

       34
       34
       +
           systemd.services.paretosecurity.serviceConfig.Environment = [

     

       35
       35
       +
             "PATH=${config.system.path}/bin:${config.system.path}/sbin"

     

       36
       36
       +
           ];

     

       37
       37
       +
       

     

       27
       38
        
           # Enable the tray icon and timer services if the trayIcon option is enabled

     

       28
       39
        
           systemd.user = lib.mkIf config.services.paretosecurity.trayIcon {

     

       29
       40
        
             services.paretosecurity-trayicon = {

     
···

       31
       42
        
             };

     

       32
       43
        
             services.paretosecurity-user = {

     

       33
       44
        
               wantedBy = [ "graphical-session.target" ];

     

       45
       45
       +
               serviceConfig.Environment = [

     

       46
       46
       +
                 "PATH=${config.system.path}/bin:${config.system.path}/sbin"

     

       47
       47
       +
               ];

     

       34
       48
        
             };

     

       35
       49
        
             timers.paretosecurity-user = {

     

       36
       50
        
               wantedBy = [ "timers.target" ];

+278

nixos/modules/services/security/pocket-id.nix

···

       1
       1
       +
       {

     

       2
       2
       +
         lib,

     

       3
       3
       +
         pkgs,

     

       4
       4
       +
         config,

     

       5
       5
       +
         ...

     

       6
       6
       +
       }:

     

       7
       7
       +
       

     

       8
       8
       +
       let

     

       9
       9
       +
         inherit (lib)

     

       10
       10
       +
           mkEnableOption

     

       11
       11
       +
           mkIf

     

       12
       12
       +
           mkOption

     

       13
       13
       +
           optionalAttrs

     

       14
       14
       +
           optional

     

       15
       15
       +
           mkPackageOption

     

       16
       16
       +
           ;

     

       17
       17
       +
         inherit (lib.types)

     

       18
       18
       +
           bool

     

       19
       19
       +
           path

     

       20
       20
       +
           str

     

       21
       21
       +
           submodule

     

       22
       22
       +
           ;

     

       23
       23
       +
       

     

       24
       24
       +
         cfg = config.services.pocket-id;

     

       25
       25
       +
       

     

       26
       26
       +
         format = pkgs.formats.keyValue { };

     

       27
       27
       +
         settingsFile = format.generate "pocket-id-env-vars" cfg.settings;

     

       28
       28
       +
       in

     

       29
       29
       +
       {

     

       30
       30
       +
         meta.maintainers = with lib.maintainers; [

     

       31
       31
       +
           gepbird

     

       32
       32
       +
           ymstnt

     

       33
       33
       +
         ];

     

       34
       34
       +
       

     

       35
       35
       +
         options.services.pocket-id = {

     

       36
       36
       +
           enable = mkEnableOption "Pocket ID server";

     

       37
       37
       +
       

     

       38
       38
       +
           package = mkPackageOption pkgs "pocket-id" { };

     

       39
       39
       +
       

     

       40
       40
       +
           environmentFile = mkOption {

     

       41
       41
       +
             type = path;

     

       42
       42
       +
             description = ''

     

       43
       43
       +
               Path to an environment file loaded for the Pocket ID service.

     

       44
       44
       +
       

     

       45
       45
       +
               This can be used to securely store tokens and secrets outside of the world-readable Nix store.

     

       46
       46
       +
       

     

       47
       47
       +
               Example contents of the file:

     

       48
       48
       +
               MAXMIND_LICENSE_KEY=your-license-key

     

       49
       49
       +
             '';

     

       50
       50
       +
             default = "/dev/null";

     

       51
       51
       +
             example = "/var/lib/secrets/pocket-id";

     

       52
       52
       +
           };

     

       53
       53
       +
       

     

       54
       54
       +
           settings = mkOption {

     

       55
       55
       +
             type = submodule {

     

       56
       56
       +
               freeformType = format.type;

     

       57
       57
       +
       

     

       58
       58
       +
               options = {

     

       59
       59
       +
                 PUBLIC_APP_URL = mkOption {

     

       60
       60
       +
                   type = str;

     

       61
       61
       +
                   description = ''

     

       62
       62
       +
                     The URL where you will access the app.

     

       63
       63
       +
                   '';

     

       64
       64
       +
                   default = "http://localhost";

     

       65
       65
       +
                 };

     

       66
       66
       +
       

     

       67
       67
       +
                 TRUST_PROXY = mkOption {

     

       68
       68
       +
                   type = bool;

     

       69
       69
       +
                   description = ''

     

       70
       70
       +
                     Whether the app is behind a reverse proxy.

     

       71
       71
       +
                   '';

     

       72
       72
       +
                   default = false;

     

       73
       73
       +
                 };

     

       74
       74
       +
               };

     

       75
       75
       +
             };

     

       76
       76
       +
       

     

       77
       77
       +
             default = { };

     

       78
       78
       +
       

     

       79
       79
       +
             description = ''

     

       80
       80
       +
               Environment variables that will be passed to Pocket ID, see

     

       81
       81
       +
               [configuration options](https://pocket-id.org/docs/configuration/environment-variables)

     

       82
       82
       +
               for supported values.

     

       83
       83
       +
             '';

     

       84
       84
       +
           };

     

       85
       85
       +
       

     

       86
       86
       +
           dataDir = mkOption {

     

       87
       87
       +
             type = path;

     

       88
       88
       +
             default = "/var/lib/pocket-id";

     

       89
       89
       +
             description = ''

     

       90
       90
       +
               The directory where Pocket ID will store its data, such as the database.

     

       91
       91
       +
             '';

     

       92
       92
       +
           };

     

       93
       93
       +
       

     

       94
       94
       +
           user = mkOption {

     

       95
       95
       +
             type = str;

     

       96
       96
       +
             default = "pocket-id";

     

       97
       97
       +
             description = "User account under which Pocket ID runs.";

     

       98
       98
       +
           };

     

       99
       99
       +
       

     

       100
       100
       +
           group = mkOption {

     

       101
       101
       +
             type = str;

     

       102
       102
       +
             default = "pocket-id";

     

       103
       103
       +
             description = "Group account under which Pocket ID runs.";

     

       104
       104
       +
           };

     

       105
       105
       +
         };

     

       106
       106
       +
       

     

       107
       107
       +
         config = mkIf cfg.enable {

     

       108
       108
       +
           warnings = (

     

       109
       109
       +
             optional (cfg.settings ? MAXMIND_LICENSE_KEY)

     

       110
       110
       +
               "config.services.pocket-id.settings.MAXMIND_LICENSE_KEY will be stored as plaintext in the Nix store. Use config.services.pocket-id.environmentFile instead."

     

       111
       111
       +
           );

     

       112
       112
       +
       

     

       113
       113
       +
           systemd.tmpfiles.rules = [

     

       114
       114
       +
             "d ${cfg.dataDir} 0755 ${cfg.user} ${cfg.group}"

     

       115
       115
       +
           ];

     

       116
       116
       +
       

     

       117
       117
       +
           systemd.services = {

     

       118
       118
       +
             pocket-id-backend = {

     

       119
       119
       +
               description = "Pocket ID backend";

     

       120
       120
       +
               after = [ "network.target" ];

     

       121
       121
       +
               wantedBy = [ "multi-user.target" ];

     

       122
       122
       +
               restartTriggers = [

     

       123
       123
       +
                 cfg.package

     

       124
       124
       +
                 cfg.environmentFile

     

       125
       125
       +
                 settingsFile

     

       126
       126
       +
               ];

     

       127
       127
       +
       

     

       128
       128
       +
               serviceConfig = {

     

       129
       129
       +
                 Type = "simple";

     

       130
       130
       +
                 User = cfg.user;

     

       131
       131
       +
                 Group = cfg.group;

     

       132
       132
       +
                 WorkingDirectory = cfg.dataDir;

     

       133
       133
       +
                 ExecStart = "${cfg.package}/bin/pocket-id-backend";

     

       134
       134
       +
                 Restart = "always";

     

       135
       135
       +
                 EnvironmentFile = [

     

       136
       136
       +
                   cfg.environmentFile

     

       137
       137
       +
                   settingsFile

     

       138
       138
       +
                 ];

     

       139
       139
       +
       

     

       140
       140
       +
                 # Hardening

     

       141
       141
       +
                 AmbientCapabilities = "";

     

       142
       142
       +
                 CapabilityBoundingSet = "";

     

       143
       143
       +
                 DeviceAllow = "";

     

       144
       144
       +
                 DevicePolicy = "closed";

     

       145
       145
       +
                 #IPAddressDeny = "any"; # communicates with the frontend

     

       146
       146
       +
                 LockPersonality = true;

     

       147
       147
       +
                 MemoryDenyWriteExecute = true;

     

       148
       148
       +
                 NoNewPrivileges = true;

     

       149
       149
       +
                 PrivateDevices = true;

     

       150
       150
       +
                 PrivateNetwork = false; # communicates with the frontend

     

       151
       151
       +
                 PrivateTmp = true;

     

       152
       152
       +
                 PrivateUsers = true;

     

       153
       153
       +
                 ProcSubset = "pid";

     

       154
       154
       +
                 ProtectClock = true;

     

       155
       155
       +
                 ProtectControlGroups = true;

     

       156
       156
       +
                 ProtectHome = true;

     

       157
       157
       +
                 ProtectHostname = true;

     

       158
       158
       +
                 ProtectKernelLogs = true;

     

       159
       159
       +
                 ProtectKernelModules = true;

     

       160
       160
       +
                 ProtectKernelTunables = true;

     

       161
       161
       +
                 ProtectProc = "invisible";

     

       162
       162
       +
                 ProtectSystem = "full"; # needs to write in cfg.dataDir

     

       163
       163
       +
                 RemoveIPC = true;

     

       164
       164
       +
                 RestrictAddressFamilies = [

     

       165
       165
       +
                   "AF_INET"

     

       166
       166
       +
                   "AF_INET6"

     

       167
       167
       +
                 ];

     

       168
       168
       +
                 RestrictNamespaces = true;

     

       169
       169
       +
                 RestrictRealtime = true;

     

       170
       170
       +
                 RestrictSUIDSGID = true;

     

       171
       171
       +
                 SystemCallArchitectures = "native";

     

       172
       172
       +
                 SystemCallFilter = lib.concatStringsSep " " [

     

       173
       173
       +
                   "~"

     

       174
       174
       +
                   "@clock"

     

       175
       175
       +
                   "@cpu-emulation"

     

       176
       176
       +
                   "@debug"

     

       177
       177
       +
                   "@module"

     

       178
       178
       +
                   "@mount"

     

       179
       179
       +
                   "@obsolete"

     

       180
       180
       +
                   "@privileged"

     

       181
       181
       +
                   "@raw-io"

     

       182
       182
       +
                   "@reboot"

     

       183
       183
       +
                   #"@resources" # vm test segfaults

     

       184
       184
       +
                   "@swap"

     

       185
       185
       +
                 ];

     

       186
       186
       +
                 UMask = "0077";

     

       187
       187
       +
               };

     

       188
       188
       +
             };

     

       189
       189
       +
       

     

       190
       190
       +
             pocket-id-frontend = {

     

       191
       191
       +
               description = "Pocket ID frontend";

     

       192
       192
       +
               after = [

     

       193
       193
       +
                 "network.target"

     

       194
       194
       +
                 "pocket-id-backend.service"

     

       195
       195
       +
               ];

     

       196
       196
       +
               wantedBy = [ "multi-user.target" ];

     

       197
       197
       +
               restartTriggers = [

     

       198
       198
       +
                 cfg.package

     

       199
       199
       +
                 cfg.environmentFile

     

       200
       200
       +
                 settingsFile

     

       201
       201
       +
               ];

     

       202
       202
       +
       

     

       203
       203
       +
               serviceConfig = {

     

       204
       204
       +
                 Type = "simple";

     

       205
       205
       +
                 User = cfg.user;

     

       206
       206
       +
                 Group = cfg.group;

     

       207
       207
       +
                 ExecStart = "${cfg.package}/bin/pocket-id-frontend";

     

       208
       208
       +
                 Restart = "always";

     

       209
       209
       +
                 EnvironmentFile = [

     

       210
       210
       +
                   cfg.environmentFile

     

       211
       211
       +
                   settingsFile

     

       212
       212
       +
                 ];

     

       213
       213
       +
       

     

       214
       214
       +
                 # Hardening

     

       215
       215
       +
                 AmbientCapabilities = "";

     

       216
       216
       +
                 CapabilityBoundingSet = "";

     

       217
       217
       +
                 DeviceAllow = "";

     

       218
       218
       +
                 DevicePolicy = "closed";

     

       219
       219
       +
                 #IPAddressDeny = "any"; # communicates with the backend and client

     

       220
       220
       +
                 LockPersonality = true;

     

       221
       221
       +
                 MemoryDenyWriteExecute = false; # V8_Fatal segfault

     

       222
       222
       +
                 NoNewPrivileges = true;

     

       223
       223
       +
                 PrivateDevices = true;

     

       224
       224
       +
                 PrivateNetwork = false; # communicates with the backend and client

     

       225
       225
       +
                 PrivateTmp = true;

     

       226
       226
       +
                 PrivateUsers = true;

     

       227
       227
       +
                 ProcSubset = "pid";

     

       228
       228
       +
                 ProtectClock = true;

     

       229
       229
       +
                 ProtectControlGroups = true;

     

       230
       230
       +
                 ProtectHome = true;

     

       231
       231
       +
                 ProtectHostname = true;

     

       232
       232
       +
                 ProtectKernelLogs = true;

     

       233
       233
       +
                 ProtectKernelModules = true;

     

       234
       234
       +
                 ProtectKernelTunables = true;

     

       235
       235
       +
                 ProtectProc = "invisible";

     

       236
       236
       +
                 ProtectSystem = "strict";

     

       237
       237
       +
                 RemoveIPC = true;

     

       238
       238
       +
                 RestrictAddressFamilies = [

     

       239
       239
       +
                   "AF_INET"

     

       240
       240
       +
                   "AF_INET6"

     

       241
       241
       +
                 ];

     

       242
       242
       +
                 RestrictNamespaces = true;

     

       243
       243
       +
                 RestrictRealtime = true;

     

       244
       244
       +
                 RestrictSUIDSGID = true;

     

       245
       245
       +
                 SystemCallArchitectures = "native";

     

       246
       246
       +
                 SystemCallFilter = lib.concatStringsSep " " [

     

       247
       247
       +
                   "~"

     

       248
       248
       +
                   "@clock"

     

       249
       249
       +
                   "@cpu-emulation"

     

       250
       250
       +
                   "@debug"

     

       251
       251
       +
                   "@module"

     

       252
       252
       +
                   "@mount"

     

       253
       253
       +
                   "@obsolete"

     

       254
       254
       +
                   "@privileged"

     

       255
       255
       +
                   "@raw-io"

     

       256
       256
       +
                   "@reboot"

     

       257
       257
       +
                   "@resources"

     

       258
       258
       +
                   "@swap"

     

       259
       259
       +
                 ];

     

       260
       260
       +
                 UMask = "0077";

     

       261
       261
       +
               };

     

       262
       262
       +
             };

     

       263
       263
       +
           };

     

       264
       264
       +
       

     

       265
       265
       +
           users.users = optionalAttrs (cfg.user == "pocket-id") {

     

       266
       266
       +
             pocket-id = {

     

       267
       267
       +
               isSystemUser = true;

     

       268
       268
       +
               group = cfg.group;

     

       269
       269
       +
               description = "Pocket ID backend user";

     

       270
       270
       +
               home = cfg.dataDir;

     

       271
       271
       +
             };

     

       272
       272
       +
           };

     

       273
       273
       +
       

     

       274
       274
       +
           users.groups = optionalAttrs (cfg.group == "pocket-id") {

     

       275
       275
       +
             pocket-id = { };

     

       276
       276
       +
           };

     

       277
       277
       +
         };

     

       278
       278
       +
       }

+11 -7

nixos/modules/services/security/vaultwarden/default.nix

···

       65
       65
        
       

     

       66
       66
        
         vaultwarden = cfg.package.override { inherit (cfg) dbBackend; };

     

       67
       67
        
       

     

       68
       68
       +
         useSendmail = configEnv.USE_SENDMAIL or null == "true";

     

       68
       69
        
       in

     

       69
       70
        
       {

     

       70
       71
        
         imports = [

     
···

       236
       237
        
               DevicePolicy = "closed";

     

       237
       238
        
               LockPersonality = true;

     

       238
       239
        
               MemoryDenyWriteExecute = true;

     

       239
       239
       -
               NoNewPrivileges = true;

     

       240
       240
       -
               PrivateDevices = true;

     

       240
       240
       +
               NoNewPrivileges = !useSendmail;

     

       241
       241
       +
               PrivateDevices = !useSendmail;

     

       241
       242
        
               PrivateTmp = true;

     

       242
       242
       -
               PrivateUsers = true;

     

       243
       243
       +
               PrivateUsers = !useSendmail;

     

       243
       244
        
               ProcSubset = "pid";

     

       244
       245
        
               ProtectClock = true;

     

       245
       246
        
               ProtectControlGroups = true;

     
···

       262
       263
        
               inherit StateDirectory;

     

       263
       264
        
               StateDirectoryMode = "0700";

     

       264
       265
        
               SystemCallArchitectures = "native";

     

       265
       265
       -
               SystemCallFilter = [

     

       266
       266
       -
                 "@system-service"

     

       267
       267
       -
                 "~@privileged"

     

       268
       268
       -
               ];

     

       266
       266
       +
               SystemCallFilter =

     

       267
       267
       +
                 [

     

       268
       268
       +
                   "@system-service"

     

       269
       269
       +
                 ]

     

       270
       270
       +
                 ++ lib.optionals (!useSendmail) [

     

       271
       271
       +
                   "~@privileged"

     

       272
       272
       +
                 ];

     

       269
       273
        
               Restart = "always";

     

       270
       274
        
               UMask = "0077";

     

       271
       275
        
             };

+1 -1

nixos/modules/services/web-apps/archtika.nix

···

       17
       17
        
       in

     

       18
       18
        
       {

     

       19
       19
        
         options.services.archtika = {

     

       20
       20
       -
           enable = mkEnableOption "Whether to enable the archtika service";

     

       20
       20
       +
           enable = mkEnableOption "the archtika CMS";

     

       21
       21
        
       

     

       22
       22
        
           package = mkPackageOption pkgs "archtika" { };

     

       23
       23

+6 -10

nixos/modules/services/web-apps/onlyoffice.nix

···

       114
       114
        
                     proxy_pass http://onlyoffice-docservice/$2$3;

     

       115
       115
        
                   '';

     

       116
       116
        
                   # /etc/nginx/includes/ds-docservice.conf

     

       117
       117
       -
                   #disable caching for api.js

     

       117
       117
       +
                   # disable caching for api.js

     

       118
       118
        
                   "~ ^(\\/[\\d]+\\.[\\d]+\\.[\\d]+[\\.|-][\\w]+)?\\/(web-apps\\/apps\\/api\\/documents\\/api\\.js)$".extraConfig =

     

       119
       119
        
                     ''

     

       120
       120
        
                       expires -1;

     
···

       124
       124
        
                   "~ ^(\\/[\\d]+\\.[\\d]+\\.[\\d]+[\\.|-][\\w]+)?\\/(document_editor_service_worker\\.js)$".extraConfig =

     

       125
       125
        
                     ''

     

       126
       126
        
                       expires 365d;

     

       127
       127
       -
                       # gzip_static on;

     

       128
       128
       -
                       alias  ${cfg.package}/var/www/onlyoffice/documentserver/sdkjs/common/serviceworker/$2;

     

       127
       127
       +
                       alias ${cfg.package}/var/www/onlyoffice/documentserver/sdkjs/common/serviceworker/$2;

     

       129
       128
        
                     '';

     

       130
       130
       -
                   #suppress logging the unsupported locale error in web-apps

     

       129
       129
       +
                   # suppress logging the unsupported locale error in web-apps

     

       131
       130
        
                   "~ ^(\\/[\\d]+\\.[\\d]+\\.[\\d]+[\\.|-][\\w]+)?\\/(web-apps)(\\/.*\\.json)$".extraConfig = ''

     

       132
       131
        
                     expires 365d;

     

       133
       132
        
                     error_log /dev/null crit;

     

       134
       133
        
                     alias ${cfg.package}/var/www/onlyoffice/documentserver/$2$3;

     

       135
       134
        
                   '';

     

       136
       136
       -
                   #suppress logging the unsupported locale error in plugins

     

       135
       135
       +
                   # suppress logging the unsupported locale error in plugins

     

       137
       136
        
                   "~ ^(\\/[\\d]+\\.[\\d]+\\.[\\d]+[\\.|-][\\w]+)?\\/(sdkjs-plugins)(\\/.*\\.json)$".extraConfig = ''

     

       138
       137
        
                     expires 365d;

     

       139
       138
        
                     error_log /dev/null crit;

     

       140
       140
       -
                     # gzip_static on;

     

       141
       139
        
                     alias ${cfg.package}/var/www/onlyoffice/documentserver/$2$3;

     

       142
       140
        
                   '';

     

       143
       141
        
                   "~ ^(\\/[\\d]+\\.[\\d]+\\.[\\d]+[\\.|-][\\w]+)?\\/(web-apps|sdkjs|sdkjs-plugins|fonts|dictionaries)(\\/.*)$".extraConfig =

     

       144
       142
        
                     ''

     

       145
       143
        
                       expires 365d;

     

       146
       146
       -
                       # gzip_static on;

     

       147
       144
        
                       alias ${cfg.package}/var/www/onlyoffice/documentserver/$2$3;

     

       148
       145
        
                     '';

     

       149
       146
        
                   "~* ^(\\/cache\\/files.*)(\\/.*)".extraConfig = ''

     
···

       302
       299
        
                     ' /run/onlyoffice/config/default.json | sponge /run/onlyoffice/config/default.json

     

       303
       300
        
       

     

       304
       301
        
                   chmod u+w /run/onlyoffice/config/production-linux.json

     

       305
       305
       -
                   jq '

     

       306
       306
       -
                     .FileConverter.converter.x2tPath = "${cfg.x2t}/bin/x2t"

     

       307
       307
       -
                     ' /run/onlyoffice/config/production-linux.json | sponge /run/onlyoffice/config/production-linux.json

     

       302
       302
       +
                   jq '.FileConverter.converter.x2tPath = "${cfg.x2t}/bin/x2t"' \

     

       303
       303
       +
                     /run/onlyoffice/config/production-linux.json | sponge /run/onlyoffice/config/production-linux.json

     

       308
       304
        
       

     

       309
       305
        
                   if psql -d onlyoffice -c "SELECT 'task_result'::regclass;" >/dev/null; then

     

       310
       306
        
                     psql -f ${cfg.package}/var/www/onlyoffice/documentserver/server/schema/postgresql/removetbl.sql

+5 -4

nixos/tests/all-tests.nix

···

       691
       691
        
         leaps = handleTest ./leaps.nix { };

     

       692
       692
        
         lemmy = handleTest ./lemmy.nix { };

     

       693
       693
        
         libinput = handleTest ./libinput.nix { };

     

       694
       694
       -
         librenms = handleTest ./librenms.nix { };

     

       694
       694
       +
         librenms = runTest ./librenms.nix;

     

       695
       695
        
         libresprite = handleTest ./libresprite.nix { };

     

       696
       696
        
         libreswan = runTest ./libreswan.nix;

     

       697
       697
        
         libreswan-nat = runTest ./libreswan-nat.nix;

     
···

       703
       703
        
         libvirtd = handleTest ./libvirtd.nix { };

     

       704
       704
        
         lidarr = handleTest ./lidarr.nix { };

     

       705
       705
        
         lightdm = handleTest ./lightdm.nix { };

     

       706
       706
       -
         lighttpd = handleTest ./lighttpd.nix { };

     

       706
       706
       +
         lighttpd = runTest ./lighttpd.nix;

     

       707
       707
        
         limesurvey = handleTest ./limesurvey.nix { };

     

       708
       708
        
         limine = import ./limine { inherit runTest; };

     

       709
       709
        
         listmonk = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./listmonk.nix { };

     
···

       1039
       1039
        
         pleroma = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./pleroma.nix { };

     

       1040
       1040
        
         plikd = handleTest ./plikd.nix { };

     

       1041
       1041
        
         plotinus = handleTest ./plotinus.nix { };

     

       1042
       1042
       +
         pocket-id = handleTest ./pocket-id.nix { };

     

       1042
       1043
        
         podgrab = handleTest ./podgrab.nix { };

     

       1043
       1044
        
         podman = handleTestOn [ "aarch64-linux" "x86_64-linux" ] ./podman/default.nix { };

     

       1044
       1045
        
         podman-tls-ghostunnel = handleTestOn [

     
···

       1202
       1203
        
         sssd-ldap = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./sssd-ldap.nix { };

     

       1203
       1204
        
         stalwart-mail = handleTest ./stalwart-mail.nix { };

     

       1204
       1205
        
         stargazer = runTest ./web-servers/stargazer.nix;

     

       1205
       1205
       -
         starship = handleTest ./starship.nix { };

     

       1206
       1206
       +
         starship = runTest ./starship.nix;

     

       1206
       1207
        
         stash = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./stash.nix { };

     

       1207
       1208
        
         static-web-server = handleTest ./web-servers/static-web-server.nix { };

     

       1208
       1209
        
         step-ca = handleTestOn [ "x86_64-linux" ] ./step-ca.nix { };

     
···

       1351
       1352
        
         tuptime = handleTest ./tuptime.nix { };

     

       1352
       1353
        
         turbovnc-headless-server = handleTest ./turbovnc-headless-server.nix { };

     

       1353
       1354
        
         turn-rs = handleTest ./turn-rs.nix { };

     

       1354
       1354
       -
         tuxguitar = handleTest ./tuxguitar.nix { };

     

       1355
       1355
       +
         tuxguitar = runTest ./tuxguitar.nix;

     

       1355
       1356
        
         twingate = runTest ./twingate.nix;

     

       1356
       1357
        
         typesense = handleTest ./typesense.nix { };

     

       1357
       1358
        
         ucarp = handleTest ./ucarp.nix { };

+81 -83

nixos/tests/librenms.nix

···

       1
       1
       -
       import ./make-test-python.nix (

     

       2
       2
       -
         { pkgs, lib, ... }:

     

       1
       1
       +
       { pkgs, lib, ... }:

     

       3
       2
        
       

     

       4
       4
       -
         let

     

       5
       5
       -
           api_token = "f87f42114e44b63ad1b9e3c3d33d6fbe"; # random md5 hash

     

       6
       6
       -
           wrong_api_token = "e68ba041fcf1eab923a7a6de3af5f726"; # another random md5 hash

     

       7
       7
       -
         in

     

       8
       8
       -
         {

     

       9
       9
       -
           name = "librenms";

     

       10
       10
       -
           meta.maintainers = lib.teams.wdz.members;

     

       3
       3
       +
       let

     

       4
       4
       +
         api_token = "f87f42114e44b63ad1b9e3c3d33d6fbe"; # random md5 hash

     

       5
       5
       +
         wrong_api_token = "e68ba041fcf1eab923a7a6de3af5f726"; # another random md5 hash

     

       6
       6
       +
       in

     

       7
       7
       +
       {

     

       8
       8
       +
         name = "librenms";

     

       9
       9
       +
         meta.maintainers = lib.teams.wdz.members;

     

       11
       10
        
       

     

       12
       12
       -
           nodes.librenms = {

     

       13
       13
       -
             time.timeZone = "Europe/Berlin";

     

       11
       11
       +
         nodes.librenms = {

     

       12
       12
       +
           time.timeZone = "Europe/Berlin";

     

       14
       13
        
       

     

       15
       15
       -
             environment.systemPackages = with pkgs; [

     

       16
       16
       -
               curl

     

       17
       17
       -
               jq

     

       18
       18
       -
             ];

     

       14
       14
       +
           environment.systemPackages = with pkgs; [

     

       15
       15
       +
             curl

     

       16
       16
       +
             jq

     

       17
       17
       +
           ];

     

       19
       18
        
       

     

       20
       20
       -
             services.librenms = {

     

       21
       21
       -
               enable = true;

     

       22
       22
       -
               hostname = "librenms";

     

       23
       23
       -
               database = {

     

       24
       24
       -
                 createLocally = true;

     

       25
       25
       -
                 host = "localhost";

     

       26
       26
       -
                 database = "librenms";

     

       27
       27
       -
                 username = "librenms";

     

       28
       28
       -
                 passwordFile = pkgs.writeText "librenms-db-pass" "librenmsdbpass";

     

       29
       29
       -
               };

     

       30
       30
       -
               nginx = {

     

       31
       31
       -
                 default = true;

     

       32
       32
       -
               };

     

       33
       33
       -
               enableOneMinutePolling = true;

     

       34
       34
       -
               settings = {

     

       35
       35
       -
                 enable_billing = true;

     

       36
       36
       -
               };

     

       19
       19
       +
           services.librenms = {

     

       20
       20
       +
             enable = true;

     

       21
       21
       +
             hostname = "librenms";

     

       22
       22
       +
             database = {

     

       23
       23
       +
               createLocally = true;

     

       24
       24
       +
               host = "localhost";

     

       25
       25
       +
               database = "librenms";

     

       26
       26
       +
               username = "librenms";

     

       27
       27
       +
               passwordFile = pkgs.writeText "librenms-db-pass" "librenmsdbpass";

     

       28
       28
       +
             };

     

       29
       29
       +
             nginx = {

     

       30
       30
       +
               default = true;

     

       31
       31
       +
             };

     

       32
       32
       +
             enableOneMinutePolling = true;

     

       33
       33
       +
             settings = {

     

       34
       34
       +
               enable_billing = true;

     

       37
       35
        
             };

     

       36
       36
       +
           };

     

       38
       37
        
       

     

       39
       39
       -
             # systemd oneshot to create a dummy admin user and a API token for testing

     

       40
       40
       -
             systemd.services.lnms-api-init = {

     

       41
       41
       -
               description = "LibreNMS API init";

     

       42
       42
       -
               after = [ "librenms-setup.service" ];

     

       43
       43
       -
               wantedBy = [ "multi-user.target" ];

     

       44
       44
       -
               serviceConfig = {

     

       45
       45
       -
                 Type = "oneshot";

     

       46
       46
       -
                 RemainAfterExit = true;

     

       47
       47
       -
                 User = "root";

     

       48
       48
       -
                 Group = "root";

     

       49
       49
       -
               };

     

       50
       50
       -
               script = ''

     

       51
       51
       -
                 API_USER_NAME=api

     

       52
       52
       -
                 API_TOKEN=${api_token} # random md5 hash

     

       38
       38
       +
           # systemd oneshot to create a dummy admin user and a API token for testing

     

       39
       39
       +
           systemd.services.lnms-api-init = {

     

       40
       40
       +
             description = "LibreNMS API init";

     

       41
       41
       +
             after = [ "librenms-setup.service" ];

     

       42
       42
       +
             wantedBy = [ "multi-user.target" ];

     

       43
       43
       +
             serviceConfig = {

     

       44
       44
       +
               Type = "oneshot";

     

       45
       45
       +
               RemainAfterExit = true;

     

       46
       46
       +
               User = "root";

     

       47
       47
       +
               Group = "root";

     

       48
       48
       +
             };

     

       49
       49
       +
             script = ''

     

       50
       50
       +
               API_USER_NAME=api

     

       51
       51
       +
               API_TOKEN=${api_token} # random md5 hash

     

       53
       52
        
       

     

       54
       54
       -
                 # seeding database to get the admin roles

     

       55
       55
       -
                 ${pkgs.librenms}/artisan db:seed --force --no-interaction

     

       53
       53
       +
               # seeding database to get the admin roles

     

       54
       54
       +
               ${pkgs.librenms}/artisan db:seed --force --no-interaction

     

       56
       55
        
       

     

       57
       57
       -
                 # we don't need to know the password, it just has to exist

     

       58
       58
       -
                 API_USER_PASS=$(${pkgs.pwgen}/bin/pwgen -s 64 1)

     

       59
       59
       -
                 ${pkgs.librenms}/artisan user:add $API_USER_NAME -r admin -p $API_USER_PASS

     

       60
       60
       -
                 API_USER_ID=$(${pkgs.mariadb}/bin/mysql -D librenms -N -B -e "SELECT user_id FROM users WHERE username = '$API_USER_NAME';")

     

       56
       56
       +
               # we don't need to know the password, it just has to exist

     

       57
       57
       +
               API_USER_PASS=$(${pkgs.pwgen}/bin/pwgen -s 64 1)

     

       58
       58
       +
               ${pkgs.librenms}/artisan user:add $API_USER_NAME -r admin -p $API_USER_PASS

     

       59
       59
       +
               API_USER_ID=$(${pkgs.mariadb}/bin/mysql -D librenms -N -B -e "SELECT user_id FROM users WHERE username = '$API_USER_NAME';")

     

       61
       60
        
       

     

       62
       62
       -
                 ${pkgs.mariadb}/bin/mysql -D librenms -e "INSERT INTO api_tokens (user_id, token_hash, description) VALUES ($API_USER_ID, '$API_TOKEN', 'API User')"

     

       63
       63
       -
               '';

     

       64
       64
       -
             };

     

       61
       61
       +
               ${pkgs.mariadb}/bin/mysql -D librenms -e "INSERT INTO api_tokens (user_id, token_hash, description) VALUES ($API_USER_ID, '$API_TOKEN', 'API User')"

     

       62
       62
       +
             '';

     

       65
       63
        
           };

     

       64
       64
       +
         };

     

       66
       65
        
       

     

       67
       67
       -
           nodes.snmphost = {

     

       66
       66
       +
         nodes.snmphost = {

     

       68
       67
        
       

     

       69
       69
       -
             services.snmpd = {

     

       70
       70
       -
               enable = true;

     

       71
       71
       -
               openFirewall = true;

     

       68
       68
       +
           services.snmpd = {

     

       69
       69
       +
             enable = true;

     

       70
       70
       +
             openFirewall = true;

     

       72
       71
        
       

     

       73
       73
       -
               configText = ''

     

       74
       74
       -
                 com2sec readonly default public

     

       72
       72
       +
             configText = ''

     

       73
       73
       +
               com2sec readonly default public

     

       75
       74
        
       

     

       76
       76
       -
                 group MyROGroup v2c        readonly

     

       77
       77
       -
                 view all    included  .1                               80

     

       78
       78
       -
                 access MyROGroup ""      any       noauth    exact  all    none   none

     

       75
       75
       +
               group MyROGroup v2c        readonly

     

       76
       76
       +
               view all    included  .1                               80

     

       77
       77
       +
               access MyROGroup ""      any       noauth    exact  all    none   none

     

       79
       78
        
       

     

       80
       80
       -
                 syslocation Testcity, Testcountry

     

       81
       81
       -
                 syscontact Testi mc Test <test@example.com>

     

       82
       82
       -
               '';

     

       79
       79
       +
               syslocation Testcity, Testcountry

     

       80
       80
       +
               syscontact Testi mc Test <test@example.com>

     

       81
       81
       +
             '';

     

       83
       82
        
       

     

       84
       84
       -
             };

     

       85
       83
        
           };

     

       84
       84
       +
         };

     

       86
       85
        
       

     

       87
       87
       -
           testScript = ''

     

       88
       88
       -
             start_all()

     

       86
       86
       +
         testScript = ''

     

       87
       87
       +
           start_all()

     

       89
       88
        
       

     

       90
       90
       -
             snmphost.wait_for_unit("snmpd.service")

     

       89
       89
       +
           snmphost.wait_for_unit("snmpd.service")

     

       91
       90
        
       

     

       92
       92
       -
             librenms.wait_for_unit("lnms-api-init.service")

     

       93
       93
       -
             librenms.wait_for_open_port(80)

     

       91
       91
       +
           librenms.wait_for_unit("lnms-api-init.service")

     

       92
       92
       +
           librenms.wait_for_open_port(80)

     

       94
       93
        
       

     

       95
       95
       -
             # Test that we can authenticate against the API

     

       96
       96
       -
             librenms.succeed("curl --fail -H 'X-Auth-Token: ${api_token}' http://localhost/api/v0")

     

       97
       97
       -
             librenms.fail("curl --fail -H 'X-Auth-Token: ${wrong_api_token}' http://localhost/api/v0")

     

       94
       94
       +
           # Test that we can authenticate against the API

     

       95
       95
       +
           librenms.succeed("curl --fail -H 'X-Auth-Token: ${api_token}' http://localhost/api/v0")

     

       96
       96
       +
           librenms.fail("curl --fail -H 'X-Auth-Token: ${wrong_api_token}' http://localhost/api/v0")

     

       98
       97
        
       

     

       99
       99
       -
             # add snmphost as a device

     

       100
       100
       -
             librenms.succeed("curl --fail -X POST -d '{\"hostname\":\"snmphost\",\"version\":\"v2c\",\"community\":\"public\"}' -H 'X-Auth-Token: ${api_token}' http://localhost/api/v0/devices")

     

       98
       98
       +
           # add snmphost as a device

     

       99
       99
       +
           librenms.succeed("curl --fail -X POST -d '{\"hostname\":\"snmphost\",\"version\":\"v2c\",\"community\":\"public\"}' -H 'X-Auth-Token: ${api_token}' http://localhost/api/v0/devices")

     

       101
       100
        
       

     

       102
       102
       -
             # wait until snmphost gets polled

     

       103
       103
       -
             librenms.wait_until_succeeds("test $(curl -H 'X-Auth-Token: ${api_token}' http://localhost/api/v0/devices/snmphost | jq -Mr .devices[0].last_polled) != 'null'")

     

       104
       104
       -
           '';

     

       105
       105
       -
         }

     

       106
       106
       -
       )

     

       101
       101
       +
           # wait until snmphost gets polled

     

       102
       102
       +
           librenms.wait_until_succeeds("test $(curl -H 'X-Auth-Token: ${api_token}' http://localhost/api/v0/devices/snmphost | jq -Mr .devices[0].last_polled) != 'null'")

     

       103
       103
       +
         '';

     

       104
       104
       +
       }

+20 -22

nixos/tests/lighttpd.nix

···

       1
       1
       -
       import ./make-test-python.nix (

     

       2
       2
       -
         { lib, pkgs, ... }:

     

       3
       3
       -
         {

     

       4
       4
       -
           name = "lighttpd";

     

       5
       5
       -
           meta.maintainers = with lib.maintainers; [ bjornfor ];

     

       1
       1
       +
       { lib, pkgs, ... }:

     

       2
       2
       +
       {

     

       3
       3
       +
         name = "lighttpd";

     

       4
       4
       +
         meta.maintainers = with lib.maintainers; [ bjornfor ];

     

       6
       5
        
       

     

       7
       7
       -
           nodes = {

     

       8
       8
       -
             server = {

     

       9
       9
       -
               services.lighttpd.enable = true;

     

       10
       10
       -
               services.lighttpd.document-root = pkgs.runCommand "document-root" { } ''

     

       11
       11
       -
                 mkdir -p "$out"

     

       12
       12
       -
                 echo "hello nixos test" > "$out/file.txt"

     

       13
       13
       -
               '';

     

       14
       14
       -
             };

     

       6
       6
       +
         nodes = {

     

       7
       7
       +
           server = {

     

       8
       8
       +
             services.lighttpd.enable = true;

     

       9
       9
       +
             services.lighttpd.document-root = pkgs.runCommand "document-root" { } ''

     

       10
       10
       +
               mkdir -p "$out"

     

       11
       11
       +
               echo "hello nixos test" > "$out/file.txt"

     

       12
       12
       +
             '';

     

       15
       13
        
           };

     

       14
       14
       +
         };

     

       16
       15
        
       

     

       17
       17
       -
           testScript = ''

     

       18
       18
       -
             start_all()

     

       19
       19
       -
             server.wait_for_unit("lighttpd.service")

     

       20
       20
       -
             res = server.succeed("curl --fail http://localhost/file.txt")

     

       21
       21
       -
             assert "hello nixos test" in res, f"bad server response: '{res}'"

     

       22
       22
       -
             server.succeed("systemctl reload lighttpd")

     

       23
       23
       -
           '';

     

       24
       24
       -
         }

     

       25
       25
       -
       )

     

       16
       16
       +
         testScript = ''

     

       17
       17
       +
           start_all()

     

       18
       18
       +
           server.wait_for_unit("lighttpd.service")

     

       19
       19
       +
           res = server.succeed("curl --fail http://localhost/file.txt")

     

       20
       20
       +
           assert "hello nixos test" in res, f"bad server response: '{res}'"

     

       21
       21
       +
           server.succeed("systemctl reload lighttpd")

     

       22
       22
       +
         '';

     

       23
       23
       +
       }

+9 -2

nixos/tests/paretosecurity.nix

···

       29
       29
        
               package = patchedPareto;

     

       30
       30
        
             };

     

       31
       31
        
       

     

       32
       32
       +
             networking.firewall.enable = true;

     

       33
       33
       +
       

     

       32
       34
        
           };

     

       33
       35
        
       

     

       34
       36
        
         nodes.dashboard =

     
···

       64
       66
        
             services.displayManager.autoLogin = {

     

       65
       67
        
               enable = true;

     

       66
       68
        
               user = "alice";

     

       69
       69
       +
       

     

       70
       70
       +
             };

     

       71
       71
       +
       

     

       72
       72
       +
             virtualisation.resolution = {

     

       73
       73
       +
               x = 640;

     

       74
       74
       +
               y = 480;

     

       67
       75
        
             };

     

       68
       76
        
       

     

       69
       77
        
             environment.systemPackages = [ pkgs.xdotool ];

     
···

       94
       102
        
             + " --skip 21830a4e-84f1-48fe-9c5b-beab436b2cdb"  # Disk encryption

     

       95
       103
        
             + " --skip 44e4754a-0b42-4964-9cc2-b88b2023cb1e"  # Pareto Security is up to date

     

       96
       104
        
             + " --skip f962c423-fdf5-428a-a57a-827abc9b253e"  # Password manager installed

     

       97
       97
       -
             + " --skip 2e46c89a-5461-4865-a92e-3b799c12034a"  # Firewall is enabled

     

       98
       105
        
             + "'"

     

       99
       106
        
           )

     

       100
       107
        
       

     
···

       117
       124
        
           ]:

     

       118
       125
        
               status, out = xfce.systemctl("is-enabled " + unit, "alice")

     

       119
       126
        
               assert status == 0, f"Unit {unit} is not enabled (status: {status}): {out}"

     

       120
       120
       -
           xfce.succeed("xdotool mousemove 850 10")

     

       127
       127
       +
           xfce.succeed("xdotool mousemove 460 10")

     

       121
       128
        
           xfce.wait_for_text("Pareto Security")

     

       122
       129
        
           xfce.succeed("xdotool click 1")

     

       123
       130
        
           xfce.wait_for_text("Run Checks")

+47

nixos/tests/pocket-id.nix

···

       1
       1
       +
       import ./make-test-python.nix (

     

       2
       2
       +
         { lib, ... }:

     

       3
       3
       +
       

     

       4
       4
       +
         {

     

       5
       5
       +
           name = "pocket-id";

     

       6
       6
       +
           meta.maintainers = with lib.maintainers; [

     

       7
       7
       +
             gepbird

     

       8
       8
       +
             ymstnt

     

       9
       9
       +
           ];

     

       10
       10
       +
       

     

       11
       11
       +
           nodes = {

     

       12
       12
       +
             machine =

     

       13
       13
       +
               { ... }:

     

       14
       14
       +
               {

     

       15
       15
       +
                 services.pocket-id = {

     

       16
       16
       +
                   enable = true;

     

       17
       17
       +
                   settings = {

     

       18
       18
       +
                     PORT = 10001;

     

       19
       19
       +
                     INTERNAL_BACKEND_URL = "http://localhost:10002";

     

       20
       20
       +
                     BACKEND_PORT = 10002;

     

       21
       21
       +
                   };

     

       22
       22
       +
                 };

     

       23
       23
       +
               };

     

       24
       24
       +
           };

     

       25
       25
       +
       

     

       26
       26
       +
           testScript =

     

       27
       27
       +
             { nodes, ... }:

     

       28
       28
       +
             let

     

       29
       29
       +
               inherit (nodes.machine.services.pocket-id) settings;

     

       30
       30
       +
               inherit (builtins) toString;

     

       31
       31
       +
             in

     

       32
       32
       +
             ''

     

       33
       33
       +
               machine.wait_for_unit("pocket-id-backend.service")

     

       34
       34
       +
               machine.wait_for_open_port(${toString settings.BACKEND_PORT})

     

       35
       35
       +
               machine.wait_for_unit("pocket-id-frontend.service")

     

       36
       36
       +
               machine.wait_for_open_port(${toString settings.PORT})

     

       37
       37
       +
       

     

       38
       38
       +
               backend_status = machine.succeed("curl -L -o /tmp/backend-output -w '%{http_code}' http://localhost:${toString settings.BACKEND_PORT}/api/users/me")

     

       39
       39
       +
               assert backend_status == "401"

     

       40
       40
       +
               machine.succeed("grep 'You are not signed in' /tmp/backend-output")

     

       41
       41
       +
       

     

       42
       42
       +
               frontend_status = machine.succeed("curl -L -o /tmp/frontend-output -w '%{http_code}' http://localhost:${toString settings.PORT}")

     

       43
       43
       +
               assert frontend_status == "200"

     

       44
       44
       +
               machine.succeed("grep 'Sign in to Pocket ID' /tmp/frontend-output")

     

       45
       45
       +
             '';

     

       46
       46
       +
         }

     

       47
       47
       +
       )

+42 -44

nixos/tests/starship.nix

···

       1
       1
       -
       import ./make-test-python.nix (

     

       2
       2
       -
         { pkgs, ... }:

     

       3
       3
       -
         {

     

       4
       4
       -
           name = "starship";

     

       5
       5
       -
           meta.maintainers = pkgs.starship.meta.maintainers;

     

       1
       1
       +
       { pkgs, ... }:

     

       2
       2
       +
       {

     

       3
       3
       +
         name = "starship";

     

       4
       4
       +
         meta.maintainers = pkgs.starship.meta.maintainers;

     

       6
       5
        
       

     

       7
       7
       -
           nodes.machine = {

     

       8
       8
       -
             programs = {

     

       9
       9
       -
               fish.enable = true;

     

       10
       10
       -
               zsh.enable = true;

     

       6
       6
       +
         nodes.machine = {

     

       7
       7
       +
           programs = {

     

       8
       8
       +
             fish.enable = true;

     

       9
       9
       +
             zsh.enable = true;

     

       11
       10
        
       

     

       12
       12
       -
               starship = {

     

       13
       13
       -
                 enable = true;

     

       14
       14
       -
                 settings.format = "<starship>";

     

       15
       15
       -
               };

     

       11
       11
       +
             starship = {

     

       12
       12
       +
               enable = true;

     

       13
       13
       +
               settings.format = "<starship>";

     

       16
       14
        
             };

     

       15
       15
       +
           };

     

       17
       16
        
       

     

       18
       18
       -
             environment.systemPackages =

     

       19
       19
       -
               map

     

       20
       20
       -
                 (

     

       21
       21
       -
                   shell:

     

       22
       22
       -
                   pkgs.writeScriptBin "expect-${shell}" ''

     

       23
       23
       -
                     #!${pkgs.expect}/bin/expect -f

     

       17
       17
       +
           environment.systemPackages =

     

       18
       18
       +
             map

     

       19
       19
       +
               (

     

       20
       20
       +
                 shell:

     

       21
       21
       +
                 pkgs.writeScriptBin "expect-${shell}" ''

     

       22
       22
       +
                   #!${pkgs.expect}/bin/expect -f

     

       24
       23
        
       

     

       25
       25
       -
                     spawn env TERM=xterm ${shell} -i

     

       24
       24
       +
                   spawn env TERM=xterm ${shell} -i

     

       26
       25
        
       

     

       27
       27
       -
                     expect "<starship>" {

     

       28
       28
       -
                       send "exit\n"

     

       29
       29
       -
                     } timeout {

     

       30
       30
       -
                       send_user "\n${shell} failed to display Starship\n"

     

       31
       31
       -
                       exit 1

     

       32
       32
       -
                     }

     

       26
       26
       +
                   expect "<starship>" {

     

       27
       27
       +
                     send "exit\n"

     

       28
       28
       +
                   } timeout {

     

       29
       29
       +
                     send_user "\n${shell} failed to display Starship\n"

     

       30
       30
       +
                     exit 1

     

       31
       31
       +
                   }

     

       33
       32
        
       

     

       34
       34
       -
                     expect eof

     

       35
       35
       -
                   ''

     

       36
       36
       -
                 )

     

       37
       37
       -
                 [

     

       38
       38
       -
                   "bash"

     

       39
       39
       -
                   "fish"

     

       40
       40
       -
                   "zsh"

     

       41
       41
       -
                 ];

     

       42
       42
       -
           };

     

       33
       33
       +
                   expect eof

     

       34
       34
       +
                 ''

     

       35
       35
       +
               )

     

       36
       36
       +
               [

     

       37
       37
       +
                 "bash"

     

       38
       38
       +
                 "fish"

     

       39
       39
       +
                 "zsh"

     

       40
       40
       +
               ];

     

       41
       41
       +
         };

     

       43
       42
        
       

     

       44
       44
       -
           testScript = ''

     

       45
       45
       -
             start_all()

     

       46
       46
       -
             machine.wait_for_unit("default.target")

     

       43
       43
       +
         testScript = ''

     

       44
       44
       +
           start_all()

     

       45
       45
       +
           machine.wait_for_unit("default.target")

     

       47
       46
        
       

     

       48
       48
       -
             machine.succeed("expect-bash")

     

       49
       49
       -
             machine.succeed("expect-fish")

     

       50
       50
       -
             machine.succeed("expect-zsh")

     

       51
       51
       -
           '';

     

       52
       52
       -
         }

     

       53
       53
       -
       )

     

       47
       47
       +
           machine.succeed("expect-bash")

     

       48
       48
       +
           machine.succeed("expect-fish")

     

       49
       49
       +
           machine.succeed("expect-zsh")

     

       50
       50
       +
         '';

     

       51
       51
       +
       }

+21 -25

nixos/tests/tuxguitar.nix

···

       1
       1
       -
       import ./make-test-python.nix (

     

       2
       2
       -
         { pkgs, ... }:

     

       3
       3
       -
         {

     

       4
       4
       -
           name = "tuxguitar";

     

       5
       5
       -
           meta = with pkgs.lib.maintainers; {

     

       6
       6
       -
             maintainers = [ ];

     

       7
       7
       -
           };

     

       1
       1
       +
       { ... }:

     

       2
       2
       +
       {

     

       3
       3
       +
         name = "tuxguitar";

     

       4
       4
       +
         meta.maintainers = [ ];

     

       8
       5
        
       

     

       9
       9
       -
           nodes.machine =

     

       10
       10
       -
             { config, pkgs, ... }:

     

       11
       11
       -
             {

     

       12
       12
       -
               imports = [

     

       13
       13
       -
                 ./common/x11.nix

     

       14
       14
       -
               ];

     

       6
       6
       +
         nodes.machine =

     

       7
       7
       +
           { config, pkgs, ... }:

     

       8
       8
       +
           {

     

       9
       9
       +
             imports = [

     

       10
       10
       +
               ./common/x11.nix

     

       11
       11
       +
             ];

     

       15
       12
        
       

     

       16
       16
       -
               services.xserver.enable = true;

     

       13
       13
       +
             services.xserver.enable = true;

     

       17
       14
        
       

     

       18
       18
       -
               environment.systemPackages = [ pkgs.tuxguitar ];

     

       19
       19
       -
             };

     

       15
       15
       +
             environment.systemPackages = [ pkgs.tuxguitar ];

     

       16
       16
       +
           };

     

       20
       17
        
       

     

       21
       21
       -
           testScript = ''

     

       22
       22
       -
             machine.wait_for_x()

     

       23
       23
       -
             machine.succeed("tuxguitar >&2 &")

     

       24
       24
       -
             machine.wait_for_window("TuxGuitar - Untitled.tg")

     

       25
       25
       -
             machine.sleep(1)

     

       26
       26
       -
             machine.screenshot("tuxguitar")

     

       27
       27
       -
           '';

     

       28
       28
       -
         }

     

       29
       29
       -
       )

     

       18
       18
       +
         testScript = ''

     

       19
       19
       +
           machine.wait_for_x()

     

       20
       20
       +
           machine.succeed("tuxguitar >&2 &")

     

       21
       21
       +
           machine.wait_for_window("TuxGuitar - Untitled.tg")

     

       22
       22
       +
           machine.sleep(1)

     

       23
       23
       +
           machine.screenshot("tuxguitar")

     

       24
       24
       +
         '';

     

       25
       25
       +
       }

+4 -2

pkgs/applications/networking/browsers/firefox/wrapper.nix

···

       405
       405
        
               + lib.optionalString isDarwin ''

     

       406
       406
        
                 cd "${appPath}"

     

       407
       407
        
       

     

       408
       408
       -
                 # These files have to be copied and not symlinked, otherwise tabs crash.

     

       408
       408
       +
                 # The omni.ja files have to be copied and not symlinked, otherwise tabs crash.

     

       409
       409
        
                 # Maybe related to how omni.ja file is mmapped into memory. See:

     

       410
       410
        
                 # https://github.com/mozilla/gecko-dev/blob/b1662b447f306e6554647914090d4b73ac8e1664/modules/libjar/nsZipArchive.cpp#L204

     

       411
       411
       -
                 for file in $(find . -type l -name "omni.ja"); do

     

       411
       411
       +
                 #

     

       412
       412
       +
                 # The *.dylib files are copied, otherwise some basic functionality, e.g. Crypto API, is broken.

     

       413
       413
       +
                 for file in $(find . -name "omni.ja" -o -name "*.dylib"); do

     

       412
       414
        
                   rm "$file"

     

       413
       415
        
                   cp "${browser}/${appPath}/$file" "$file"

     

       414
       416
        
                 done

+2 -2

pkgs/applications/networking/feedreaders/rssguard/default.nix

···

       9
       9
        
       

     

       10
       10
        
       stdenv.mkDerivation rec {

     

       11
       11
        
         pname = "rssguard";

     

       12
       12
       -
         version = "4.8.1";

     

       12
       12
       +
         version = "4.8.2";

     

       13
       13
        
       

     

       14
       14
        
         src = fetchFromGitHub {

     

       15
       15
        
           owner = "martinrotter";

     

       16
       16
        
           repo = pname;

     

       17
       17
        
           tag = version;

     

       18
       18
       -
           sha256 = "sha256-qWxcjGl4EaLXZ0q6RVy+IKyBcqlx/yYojlGivSXy5Io=";

     

       18
       18
       +
           sha256 = "sha256-C5iA5qK8+FhCUeFtyskY/vd4evaYS3TY1SHAc83/36w=";

     

       19
       19
        
         };

     

       20
       20
        
       

     

       21
       21
        
         buildInputs = [

+7 -4

pkgs/by-name/ar/archtika/package.nix

···

       9
       9
        
       }:

     

       10
       10
        
       

     

       11
       11
        
       let

     

       12
       12
       -
         version = "1.2.0";

     

       12
       12
       +
         version = "1.2.1";

     

       13
       13
        
       

     

       14
       14
        
         src = fetchFromGitHub {

     

       15
       15
        
           owner = "archtika";

     

       16
       16
        
           repo = "archtika";

     

       17
       17
        
           tag = "v${version}";

     

       18
       18
       -
           hash = "sha256-ba9da7LqCE/e2lhRVHD7GOhwOj1fNTBbN/pARPMzIg4=";

     

       18
       18
       +
           hash = "sha256-GffYAtLs12v2Lt1WoKJOG5dZsmzDcySZKFBQwCT9nnY=";

     

       19
       19
        
         };

     

       20
       20
        
       

     

       21
       21
        
         web = buildNpmPackage {

     

       22
       22
        
           name = "web-app";

     

       23
       23
        
           src = "${src}/web-app";

     

       24
       24
       -
           npmDepsHash = "sha256-RTyo7K/Hr1hBGtcBKynrziUInl91JqZl84NkJg16ufA=";

     

       24
       24
       +
           npmDepsHash = "sha256-2udi8vLLvdoZxIyRKLOCfEpEMsooxsIrM1wiua1QPAI=";

     

       25
       25
        
           npmFlags = [ "--legacy-peer-deps" ];

     

       26
       26
        
           installPhase = ''

     

       27
       27
        
             mkdir -p $out/web-app

     
···

       50
       50
        
           api

     

       51
       51
        
         ];

     

       52
       52
        
       

     

       53
       53
       -
         passthru.updateScript = nix-update-script { };

     

       53
       53
       +
         passthru = {

     

       54
       54
       +
           inherit src web;

     

       55
       55
       +
           updateScript = nix-update-script { };

     

       56
       56
       +
         };

     

       54
       57
        
       

     

       55
       58
        
         meta = {

     

       56
       59
        
           description = "Modern, performant and lightweight CMS";

+2 -2

pkgs/by-name/az/azure-cli/package.nix

···

       26
       26
        
       }:

     

       27
       27
        
       

     

       28
       28
        
       let

     

       29
       29
       -
         version = "2.70.0";

     

       29
       29
       +
         version = "2.71.0";

     

       30
       30
        
       

     

       31
       31
        
         src = fetchFromGitHub {

     

       32
       32
        
           name = "azure-cli-${version}-src";

     

       33
       33
        
           owner = "Azure";

     

       34
       34
        
           repo = "azure-cli";

     

       35
       35
        
           rev = "azure-cli-${version}";

     

       36
       36
       -
           hash = "sha256-vvX/LkG8qA53AxVlvq7FSTqbVblvE5xbDq4V0SINCAk=";

     

       36
       36
       +
           hash = "sha256-vtuDgj3UJCmKxYg0OgG59ezQh7HlscNywz61BHDzJF8=";

     

       37
       37
        
         };

     

       38
       38
        
       

     

       39
       39
        
         # put packages that needs to be overridden in the py package scope

+2 -2

pkgs/by-name/az/azurehound/package.nix

···

       7
       7
        
       

     

       8
       8
        
       buildGoModule rec {

     

       9
       9
        
         pname = "azurehound";

     

       10
       10
       -
         version = "2.3.0";

     

       10
       10
       +
         version = "2.3.1";

     

       11
       11
        
       

     

       12
       12
        
         src = fetchFromGitHub {

     

       13
       13
        
           owner = "SpecterOps";

     

       14
       14
        
           repo = "AzureHound";

     

       15
       15
        
           tag = "v${version}";

     

       16
       16
       -
           hash = "sha256-BbwQ3u1SD4AjNjHzT6QB0x7QJAZ59m1DtvhjZapLIx4=";

     

       16
       16
       +
           hash = "sha256-12ae0y3hjeNPwB33J+XP26h+JfFN5M8+bF8CSon1jp4=";

     

       17
       17
        
         };

     

       18
       18
        
       

     

       19
       19
        
         vendorHash = "sha256-FG3207OTzkMEoSvQsTH7Ky9T3ur7glG7k0ERfd12SO0=";

+3 -3

pkgs/by-name/ca/cariddi/package.nix

···

       6
       6
        
       

     

       7
       7
        
       buildGoModule rec {

     

       8
       8
        
         pname = "cariddi";

     

       9
       9
       -
         version = "1.3.5";

     

       9
       9
       +
         version = "1.3.6";

     

       10
       10
        
       

     

       11
       11
        
         src = fetchFromGitHub {

     

       12
       12
        
           owner = "edoardottt";

     

       13
       13
        
           repo = "cariddi";

     

       14
       14
        
           tag = "v${version}";

     

       15
       15
       -
           hash = "sha256-mRrUTRknax3b4hs3frQMzg0GyB3WjMDZJk0RQSAC88U=";

     

       15
       15
       +
           hash = "sha256-ixjHPO0FXKbWOfjMVz1YD+wWpL8wcn2CCO46KF1zb0U=";

     

       16
       16
        
         };

     

       17
       17
        
       

     

       18
       18
       -
         vendorHash = "sha256-ML1aLbrYhs2IxnN2ywKFOpvAV6yuYb8GI+dtoxwJl4A=";

     

       18
       18
       +
         vendorHash = "sha256-7v92+iDAYG0snJjVCX35rLKV/ZEzaVX2au4HOwa/ILU=";

     

       19
       19
        
       

     

       20
       20
        
         ldflags = [

     

       21
       21
        
           "-w"

+24 -5

pkgs/by-name/co/copilot-language-server/package.nix

···

       1
       1
        
       {

     

       2
       2
        
         lib,

     

       3
       3
        
         stdenvNoCC,

     

       4
       4
       +
         buildFHSEnv,

     

       4
       5
        
         fetchzip,

     

       5
       6
        
         nix-update-script,

     

       6
       7
        
       }:

     
···

       24
       25
        
           }

     

       25
       26
        
           ."${stdenvNoCC.hostPlatform.system}"

     

       26
       27
        
             or (throw "Unsupported system: ${stdenvNoCC.hostPlatform.system}");

     

       28
       28
       +
       

     

       29
       29
       +
         executableName = "copilot-language-server";

     

       30
       30
       +
         fhs =

     

       31
       31
       +
           { package }:

     

       32
       32
       +
           buildFHSEnv {

     

       33
       33
       +
             name = package.meta.mainProgram;

     

       34
       34
       +
             version = package.version;

     

       35
       35
       +
             targetPkgs = pkgs: [ pkgs.stdenv.cc.cc.lib ];

     

       36
       36
       +
             runScript = lib.getExe package;

     

       37
       37
       +
       

     

       38
       38
       +
             meta = package.meta // {

     

       39
       39
       +
               description =

     

       40
       40
       +
                 package.meta.description

     

       41
       41
       +
                 + " (FHS-wrapped, expand package details for further information when to use it)";

     

       42
       42
       +
               longDescription = "Use this version if you encounter an error like `Could not start dynamically linked executable` or `SyntaxError: Invalid or unexpected token` (see nixpkgs issue [391730](https://github.com/NixOS/nixpkgs/issues/391730)).";

     

       43
       43
       +
             };

     

       44
       44
       +
           };

     

       27
       45
        
       in

     

       28
       28
       -
       

     

       29
       46
        
       stdenvNoCC.mkDerivation (finalAttrs: {

     

       30
       47
        
         pname = "copilot-language-server";

     

       31
       48
        
         version = "1.294.0";

     
···

       36
       53
        
           stripRoot = false;

     

       37
       54
        
         };

     

       38
       55
        
       

     

       39
       39
       -
         npmDepsHash = "sha256-PLX/mN7xu8gMh2BkkyTncP3+rJ3nBmX+pHxl0ONXbe4=";

     

       40
       56
        
         installPhase = ''

     

       41
       57
        
           runHook preInstall

     

       42
       58
        
       

     

       43
       43
       -
           install -Dt "$out"/bin "${os}-${arch}"/copilot-language-server

     

       59
       59
       +
           install "${os}-${arch}/${executableName}" -Dm755 -t "$out"/bin

     

       44
       60
        
       

     

       45
       61
        
           runHook postInstall

     

       46
       62
        
         '';

     

       47
       63
        
       

     

       48
       64
        
         dontStrip = true;

     

       49
       65
        
       

     

       50
       50
       -
         passthru.updateScript = nix-update-script { };

     

       66
       66
       +
         passthru = {

     

       67
       67
       +
           updateScript = nix-update-script { };

     

       68
       68
       +
           fhs = fhs { package = finalAttrs.finalPackage; };

     

       69
       69
       +
         };

     

       51
       70
        
       

     

       52
       71
        
         meta = {

     

       53
       72
        
           description = "Use GitHub Copilot with any editor or IDE via the Language Server Protocol";

     
···

       60
       79
        
             shortName = "GitHub Copilot License";

     

       61
       80
        
             url = "https://github.com/customer-terms/github-copilot-product-specific-terms";

     

       62
       81
        
           };

     

       63
       63
       -
           mainProgram = "copilot-language-server";

     

       82
       82
       +
           mainProgram = executableName;

     

       64
       83
        
           platforms = [

     

       65
       84
        
             "x86_64-linux"

     

       66
       85
        
             "aarch64-linux"

+2 -2

pkgs/by-name/er/erlang-language-platform/package.nix

···

       14
       14
        
       

     

       15
       15
        
         hashes = {

     

       16
       16
        
           linux-aarch64-unknown-linux-gnu = "sha256-i6XsOK8csrJ/9TDzltA7mGjdutLZONFiYGV5tqSCy8o=";

     

       17
       17
       -
           linux-x86_64-unknown-linux-gnu = "sha256-gBIzG0LaP9qxivkr47JpBu1z9km7o/1Wppk/6k2WslE=";

     

       17
       17
       +
           linux-x86_64-unknown-linux-gnu = "sha256-XK3DPWIdPDoIL10EATa8p1bnlpZaOzOdU0LnuKbj++E=";

     

       18
       18
        
           macos-aarch64-apple-darwin = "sha256-8e5duQYDVFyZejMjuZPuWhg1on3CBku9eBuilG5p1BY=";

     

       19
       19
        
           macos-x86_64-apple-darwin = "sha256-dnouUBUUAkMr1h+IJWYamxmk8IC7JdeIUS9/YI0GzOU=";

     

       20
       20
        
         };

     

       21
       21
        
       in

     

       22
       22
        
       stdenv.mkDerivation rec {

     

       23
       23
        
         pname = "erlang-language-platform";

     

       24
       24
       -
         version = "2025-02-13";

     

       24
       24
       +
         version = "2025-04-02";

     

       25
       25
        
       

     

       26
       26
        
         src = fetchurl {

     

       27
       27
        
           url = "https://github.com/WhatsApp/erlang-language-platform/releases/download/${version}/elp-${release}-otp-26.2.tar.gz";

+7

pkgs/by-name/go/gojq/package.nix

···

       4
       4
        
         fetchFromGitHub,

     

       5
       5
        
         testers,

     

       6
       6
        
         gojq,

     

       7
       7
       +
         installShellFiles,

     

       7
       8
        
       }:

     

       8
       9
        
       

     

       9
       10
        
       buildGoModule rec {

     
···

       23
       24
        
           "-s"

     

       24
       25
        
           "-w"

     

       25
       26
        
         ];

     

       27
       27
       +
       

     

       28
       28
       +
         nativeBuildInputs = [ installShellFiles ];

     

       29
       29
       +
       

     

       30
       30
       +
         postInstall = ''

     

       31
       31
       +
           installShellCompletion --cmd gojq --zsh _gojq

     

       32
       32
       +
         '';

     

       26
       33
        
       

     

       27
       34
        
         passthru.tests.version = testers.testVersion {

     

       28
       35
        
           package = gojq;

+3 -3

pkgs/by-name/go/gosec/package.nix

···

       6
       6
        
       

     

       7
       7
        
       buildGoModule rec {

     

       8
       8
        
         pname = "gosec";

     

       9
       9
       -
         version = "2.22.2";

     

       9
       9
       +
         version = "2.22.3";

     

       10
       10
        
       

     

       11
       11
        
         src = fetchFromGitHub {

     

       12
       12
        
           owner = "securego";

     

       13
       13
        
           repo = pname;

     

       14
       14
        
           rev = "v${version}";

     

       15
       15
       -
           hash = "sha256-j9MRMtINGPn4Hn9Z3+19/Q+Weu277WVONXKtJf9x5Cc=";

     

       15
       15
       +
           hash = "sha256-MQ/dDK2t9H7bSsr5MMtlKySLAJIDimRbpATHyOYxrBo=";

     

       16
       16
        
         };

     

       17
       17
        
       

     

       18
       18
       -
         vendorHash = "sha256-lZFTmf4/J3NDdawfp2WpPoaVxepbyazIyC8ahOwPcZo=";

     

       18
       18
       +
         vendorHash = "sha256-R1w+dHx3Aond6DmwCHRVZXmUABWfpsbLgcDW67Ukz0E=";

     

       19
       19
        
       

     

       20
       20
        
         subPackages = [

     

       21
       21
        
           "cmd/gosec"

+2 -2

pkgs/by-name/gr/grafana-loki/package.nix

···

       12
       12
        
       }:

     

       13
       13
        
       

     

       14
       14
        
       buildGoModule rec {

     

       15
       15
       -
         version = "3.4.2";

     

       15
       15
       +
         version = "3.4.3";

     

       16
       16
        
         pname = "grafana-loki";

     

       17
       17
        
       

     

       18
       18
        
         src = fetchFromGitHub {

     

       19
       19
        
           owner = "grafana";

     

       20
       20
        
           repo = "loki";

     

       21
       21
        
           rev = "v${version}";

     

       22
       22
       -
           hash = "sha256-GE92NlFCOk6qFtrgeBvLDI0OkmWaJ1j07Q14+jgi9+w=";

     

       22
       22
       +
           hash = "sha256-1tI9X2eIKuWEWJBbN4UAw8yeRrjgfqcenJyTNMk5rqU=";

     

       23
       23
        
         };

     

       24
       24
        
       

     

       25
       25
        
         vendorHash = null;

+14 -15

pkgs/by-name/jn/jnv/package.nix

···

       2
       2
        
         lib,

     

       3
       3
        
         rustPlatform,

     

       4
       4
        
         fetchFromGitHub,

     

       5
       5
       -
         stdenv,

     

       6
       6
       -
         darwin,

     

       5
       5
       +
         versionCheckHook,

     

       6
       6
       +
         nix-update-script,

     

       7
       7
        
       }:

     

       8
       8
       -
       rustPlatform.buildRustPackage rec {

     

       8
       8
       +
       

     

       9
       9
       +
       rustPlatform.buildRustPackage (finalAttrs: {

     

       9
       10
        
         pname = "jnv";

     

       10
       11
        
         version = "0.6.0";

     

       11
       12
        
       

     

       12
       13
        
         src = fetchFromGitHub {

     

       13
       14
        
           owner = "ynqa";

     

       14
       15
        
           repo = "jnv";

     

       15
       15
       -
           rev = "v${version}";

     

       16
       16
       +
           tag = "v${finalAttrs.version}";

     

       16
       17
        
           hash = "sha256-HKZ+hF5Y7vTA4EODSAd9xYJHaipv5YukTl470ejPLtM=";

     

       17
       18
        
         };

     

       18
       19
        
       

     

       19
       20
        
         useFetchCargoVendor = true;

     

       20
       21
        
         cargoHash = "sha256-VLVoURqmUhhekNZ0a75bwjvSiLfaQ79IlltbmWVyBrI=";

     

       21
       22
        
       

     

       22
       22
       -
         buildInputs = lib.optional stdenv.hostPlatform.isDarwin (

     

       23
       23
       -
           with darwin.apple_sdk.frameworks;

     

       24
       24
       -
           [

     

       25
       25
       -
             CoreGraphics

     

       26
       26
       -
             AppKit

     

       27
       27
       -
           ]

     

       28
       28
       -
         );

     

       23
       23
       +
         nativeInstallCheckInputs = [ versionCheckHook ];

     

       24
       24
       +
         versionCheckProgramArg = "--version";

     

       25
       25
       +
         doInstallCheck = true;

     

       26
       26
       +
       

     

       27
       27
       +
         passthru.updateScript = nix-update-script { };

     

       29
       28
        
       

     

       30
       30
       -
         meta = with lib; {

     

       29
       29
       +
         meta = {

     

       31
       30
        
           description = "Interactive JSON filter using jq";

     

       32
       31
        
           mainProgram = "jnv";

     

       33
       32
        
           homepage = "https://github.com/ynqa/jnv";

     

       34
       34
       -
           license = with licenses; [ mit ];

     

       35
       35
       -
           maintainers = with maintainers; [

     

       33
       33
       +
           license = with lib.licenses; [ mit ];

     

       34
       34
       +
           maintainers = with lib.maintainers; [

     

       36
       35
        
             nealfennimore

     

       37
       36
        
             nshalman

     

       38
       37
        
           ];

     

       39
       38
        
         };

     

       40
       40
       -
       }

     

       39
       39
       +
       })

+3 -3

pkgs/by-name/ka/kanata/package.nix

···

       12
       12
        
       }:

     

       13
       13
        
       rustPlatform.buildRustPackage rec {

     

       14
       14
        
         pname = "kanata";

     

       15
       15
       -
         version = "1.8.0";

     

       15
       15
       +
         version = "1.8.1";

     

       16
       16
        
       

     

       17
       17
        
         src = fetchFromGitHub {

     

       18
       18
        
           owner = "jtroo";

     

       19
       19
        
           repo = "kanata";

     

       20
       20
        
           rev = "v${version}";

     

       21
       21
       -
           sha256 = "sha256-RTFP063NGNfjlOlZ4wghpcUQEmmj73Xlu3KPIxeUI/I=";

     

       21
       21
       +
           sha256 = "sha256-w/PeSqj51gJOWmAV5UPMprntdzinX/IL49D2ZUMfeSM=";

     

       22
       22
        
         };

     

       23
       23
        
       

     

       24
       24
        
         useFetchCargoVendor = true;

     

       25
       25
       -
         cargoHash = "sha256-/r4u7pM7asCvG3LkbuP1Y63WVls1uZtV/L3cSOzUXr4=";

     

       25
       25
       +
         cargoHash = "sha256-T9fZxv3aujYparzVphfYBJ+5ti/T1VkeCeCqWPyllY8=";

     

       26
       26
        
       

     

       27
       27
        
         buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [

     

       28
       28
        
           apple-sdk_13

+2 -2

pkgs/by-name/mi/mill/package.nix

···

       8
       8
        
       

     

       9
       9
        
       stdenv.mkDerivation (finalAttrs: {

     

       10
       10
        
         pname = "mill";

     

       11
       11
       -
         version = "0.12.9";

     

       11
       11
       +
         version = "0.12.10";

     

       12
       12
        
       

     

       13
       13
        
         src = fetchurl {

     

       14
       14
        
           url = "https://repo1.maven.org/maven2/com/lihaoyi/mill-dist/${finalAttrs.version}/mill-dist-${finalAttrs.version}-assembly.jar";

     

       15
       15
       -
           hash = "sha256-Ntqzivy8dfsRlBclPNsWOZ4h1Xk7D3UJV7GLVGIEcAU=";

     

       15
       15
       +
           hash = "sha256-TESwISFz4Xf/F4kgnaTQbi/uVrc75bearih8mydPqHM=";

     

       16
       16
        
         };

     

       17
       17
        
       

     

       18
       18
        
         nativeBuildInputs = [ makeWrapper ];

+41 -43

pkgs/by-name/ni/nix-update/package.nix

···

       6
       6
        
         nix-prefetch-git,

     

       7
       7
        
         nixpkgs-review,

     

       8
       8
        
         python3Packages,

     

       9
       9
       +
         nix-update,

     

       9
       10
        
       }:

     

       10
       11
        
       

     

       11
       11
       -
       let

     

       12
       12
       -
         self = python3Packages.buildPythonApplication {

     

       13
       13
       -
           pname = "nix-update";

     

       14
       14
       -
           version = "1.10.0";

     

       15
       15
       -
           pyproject = true;

     

       12
       12
       +
       python3Packages.buildPythonApplication rec {

     

       13
       13
       +
         pname = "nix-update";

     

       14
       14
       +
         version = "1.11.0";

     

       15
       15
       +
         pyproject = true;

     

       16
       16
        
       

     

       17
       17
       -
           src = fetchFromGitHub {

     

       18
       18
       -
             owner = "Mic92";

     

       19
       19
       -
             repo = "nix-update";

     

       20
       20
       -
             tag = self.version;

     

       21
       21
       -
             hash = "sha256-fGs/EdCEoDA9N5gPtHU6CaDZo9e/aqW6pm6atsjK7PI=";

     

       22
       22
       -
           };

     

       17
       17
       +
         src = fetchFromGitHub {

     

       18
       18
       +
           owner = "Mic92";

     

       19
       19
       +
           repo = "nix-update";

     

       20
       20
       +
           tag = version;

     

       21
       21
       +
           hash = "sha256-G5YehePEMhTgxCnLp8Dg+bDHvOe+QltlCkQHVwMtYx0=";

     

       22
       22
       +
         };

     

       23
       23
        
       

     

       24
       24
       -
           build-system = [ python3Packages.setuptools ];

     

       24
       24
       +
         build-system = [ python3Packages.setuptools ];

     

       25
       25
        
       

     

       26
       26
       -
           makeWrapperArgs = [

     

       27
       27
       -
             "--prefix"

     

       28
       28
       -
             "PATH"

     

       29
       29
       -
             ":"

     

       30
       30
       -
             (lib.makeBinPath [

     

       31
       31
       -
               nix

     

       32
       32
       -
               nix-prefetch-git

     

       33
       33
       -
               nixpkgs-review

     

       34
       34
       -
             ])

     

       35
       35
       -
           ];

     

       26
       26
       +
         makeWrapperArgs = [

     

       27
       27
       +
           "--prefix"

     

       28
       28
       +
           "PATH"

     

       29
       29
       +
           ":"

     

       30
       30
       +
           (lib.makeBinPath [

     

       31
       31
       +
             nix

     

       32
       32
       +
             nix-prefetch-git

     

       33
       33
       +
             nixpkgs-review

     

       34
       34
       +
           ])

     

       35
       35
       +
         ];

     

       36
       36
        
       

     

       37
       37
       -
           checkPhase = ''

     

       38
       38
       -
             runHook preCheck

     

       37
       37
       +
         checkPhase = ''

     

       38
       38
       +
           runHook preCheck

     

       39
       39
        
       

     

       40
       40
       -
             $out/bin/nix-update --help >/dev/null

     

       40
       40
       +
           $out/bin/nix-update --help >/dev/null

     

       41
       41
        
       

     

       42
       42
       -
             runHook postCheck

     

       43
       43
       -
           '';

     

       42
       42
       +
           runHook postCheck

     

       43
       43
       +
         '';

     

       44
       44
        
       

     

       45
       45
       -
           passthru = {

     

       46
       46
       -
             nix-update-script = callPackage ./nix-update-script.nix { nix-update = self; };

     

       47
       47
       -
           };

     

       45
       45
       +
         passthru = {

     

       46
       46
       +
           nix-update-script = callPackage ./nix-update-script.nix { inherit nix-update; };

     

       47
       47
       +
         };

     

       48
       48
        
       

     

       49
       49
       -
           meta = {

     

       50
       50
       -
             description = "Swiss-knife for updating nix packages";

     

       51
       51
       -
             homepage = "https://github.com/Mic92/nix-update/";

     

       52
       52
       -
             changelog = "https://github.com/Mic92/nix-update/releases/tag/${self.version}";

     

       53
       53
       -
             license = lib.licenses.mit;

     

       54
       54
       -
             maintainers = with lib.maintainers; [

     

       55
       55
       -
               figsoda

     

       56
       56
       -
               mic92

     

       57
       57
       -
             ];

     

       58
       58
       -
             mainProgram = "nix-update";

     

       59
       59
       -
           };

     

       49
       49
       +
         meta = {

     

       50
       50
       +
           description = "Swiss-knife for updating nix packages";

     

       51
       51
       +
           homepage = "https://github.com/Mic92/nix-update/";

     

       52
       52
       +
           changelog = "https://github.com/Mic92/nix-update/releases/tag/${version}";

     

       53
       53
       +
           license = lib.licenses.mit;

     

       54
       54
       +
           maintainers = with lib.maintainers; [

     

       55
       55
       +
             figsoda

     

       56
       56
       +
             mic92

     

       57
       57
       +
           ];

     

       58
       58
       +
           mainProgram = "nix-update";

     

       60
       59
        
         };

     

       61
       61
       -
       in

     

       62
       62
       -
       self

     

       60
       60
       +
       }

+1 -1

pkgs/by-name/ni/nixfmt-rfc-style/date.txt

+2 -2

pkgs/by-name/ni/nixfmt-rfc-style/generated-package.nix

···

       25
       25
        
         pname = "nixfmt";

     

       26
       26
        
         version = "0.6.0";

     

       27
       27
        
         src = fetchzip {

     

       28
       28
       -
           url = "https://github.com/nixos/nixfmt/archive/3261d1016ecc753c59ff92767a257f91b587e705.tar.gz";

     

       29
       29
       -
           sha256 = "0jk6mgp710iwxyc7wa5kzz0p0rpcwbbs21smnv14cyii0jniz42s";

     

       28
       28
       +
           url = "https://github.com/nixos/nixfmt/archive/65af4b69133d19f534d97746c97c2d5b464f43b4.tar.gz";

     

       29
       29
       +
           sha256 = "0l0w3janvss1n1j7qkcml97zndm2jm2gbrzzs9d8l0ixnrw0cd5r";

     

       30
       30
        
         };

     

       31
       31
        
         isLibrary = true;

     

       32
       32
        
         isExecutable = true;

+3 -3

pkgs/by-name/on/onlyoffice-documentserver/package.nix

···

       61
       61
        
             mkdir -p var/lib/onlyoffice/ var/www/onlyoffice/documentserver/fonts/

     

       62
       62
        
       

     

       63
       63
        
             # see usr/bin/documentserver-flush-cache.sh

     

       64
       64
       -
             cp var/www/onlyoffice/documentserver/web-apps/apps/api/documents/api.js.tpl var/www/onlyoffice/documentserver/web-apps/apps/api/documents/api.js

     

       65
       65
       -
             HASH=$(basename $out | cut -d '-' -f 1)

     

       66
       66
       -
             sed -i "s/{{HASH_POSTFIX}}/$HASH/g" var/www/onlyoffice/documentserver/web-apps/apps/api/documents/api.js

     

       64
       64
       +
             cp var/www/onlyoffice/documentserver/web-apps/apps/api/documents/api.js{.tpl,}

     

       65
       65
       +
             substituteInPlace var/www/onlyoffice/documentserver/web-apps/apps/api/documents/api.js \

     

       66
       66
       +
               --replace-fail '{{HASH_POSTFIX}}' "$(basename $out | cut -d '-' -f 1)"

     

       67
       67
        
       

     

       68
       68
        
             mv * $out/

     

       69
       69
        
           '';

+3 -3

pkgs/by-name/pa/paretosecurity/package.nix

···

       9
       9
        
       

     

       10
       10
        
       buildGoModule rec {

     

       11
       11
        
         pname = "paretosecurity";

     

       12
       12
       -
         version = "0.0.96";

     

       12
       12
       +
         version = "0.1.3";

     

       13
       13
        
       

     

       14
       14
        
         src = fetchFromGitHub {

     

       15
       15
        
           owner = "ParetoSecurity";

     

       16
       16
        
           repo = "agent";

     

       17
       17
        
           rev = version;

     

       18
       18
       -
           hash = "sha256-SyeIGSDvrnOvyOJ0zC8CulpaMa+iZeRaMTJUSydz2tw=";

     

       18
       18
       +
           hash = "sha256-ovyfHqLCf5U3UR1HfoA+UQhqLZ6IaILcpqptPRQsb60=";

     

       19
       19
        
         };

     

       20
       20
        
       

     

       21
       21
       -
         vendorHash = "sha256-O/OF3Y6HiiikMxf657k9eIM7UfkicIImAUxVVf/TgR8=";

     

       21
       21
       +
         vendorHash = "sha256-7mKAFkKGpBOjXc3J/sfF3k3pJF53tFybXZgbfJInuSY=";

     

       22
       22
        
         proxyVendor = true;

     

       23
       23
        
       

     

       24
       24
        
         ldflags = [

+2 -2

pkgs/by-name/pl/plemoljp-hs/package.nix

···

       6
       6
        
       

     

       7
       7
        
       stdenvNoCC.mkDerivation rec {

     

       8
       8
        
         pname = "plemoljp-hs";

     

       9
       9
       -
         version = "2.0.3";

     

       9
       9
       +
         version = "2.0.4";

     

       10
       10
        
       

     

       11
       11
        
         src = fetchzip {

     

       12
       12
        
           url = "https://github.com/yuru7/PlemolJP/releases/download/v${version}/PlemolJP_HS_v${version}.zip";

     

       13
       13
       -
           hash = "sha256-rKWZMIK6TP6IV6KjFGuZE2S6IiMtjtHZeWM44tULduk=";

     

       13
       13
       +
           hash = "sha256-+pRbMgRaIbsXo8e7rQre377F8LhbK9rBjG/vYrdeFQM=";

     

       14
       14
        
         };

     

       15
       15
        
       

     

       16
       16
        
         installPhase = ''

+2 -2

pkgs/by-name/pl/plemoljp/package.nix

···

       6
       6
        
       

     

       7
       7
        
       stdenvNoCC.mkDerivation rec {

     

       8
       8
        
         pname = "plemoljp";

     

       9
       9
       -
         version = "2.0.3";

     

       9
       9
       +
         version = "2.0.4";

     

       10
       10
        
       

     

       11
       11
        
         src = fetchzip {

     

       12
       12
        
           url = "https://github.com/yuru7/PlemolJP/releases/download/v${version}/PlemolJP_v${version}.zip";

     

       13
       13
       -
           hash = "sha256-cT2BpD2PoAd38uYCQlq5fv9NYgwInblrYdK/XDEmOWI=";

     

       13
       13
       +
           hash = "sha256-pajE86IK05mm3Z507bvoMGy8JJwuGWZnUiSrXndiBTk=";

     

       14
       14
        
         };

     

       15
       15
        
       

     

       16
       16
        
         installPhase = ''

+119

pkgs/by-name/po/pocket-id/package.nix

···

       1
       1
       +
       {

     

       2
       2
       +
         lib,

     

       3
       3
       +
         fetchFromGitHub,

     

       4
       4
       +
         buildGoModule,

     

       5
       5
       +
         buildNpmPackage,

     

       6
       6
       +
         fetchurl,

     

       7
       7
       +
         makeWrapper,

     

       8
       8
       +
         nodejs,

     

       9
       9
       +
         stdenvNoCC,

     

       10
       10
       +
         nixosTests,

     

       11
       11
       +
         nix-update-script,

     

       12
       12
       +
       }:

     

       13
       13
       +
       

     

       14
       14
       +
       let

     

       15
       15
       +
         version = "0.45.0";

     

       16
       16
       +
         src = fetchFromGitHub {

     

       17
       17
       +
           owner = "pocket-id";

     

       18
       18
       +
           repo = "pocket-id";

     

       19
       19
       +
           tag = "v${version}";

     

       20
       20
       +
           hash = "sha256-x5Y3ArkIPxiE6avk9DNyFdfkc/pY6h3JH3PZCS8U/GM=";

     

       21
       21
       +
         };

     

       22
       22
       +
       

     

       23
       23
       +
         backend = buildGoModule {

     

       24
       24
       +
           pname = "pocket-id-backend";

     

       25
       25
       +
           inherit version src;

     

       26
       26
       +
       

     

       27
       27
       +
           sourceRoot = "${src.name}/backend";

     

       28
       28
       +
       

     

       29
       29
       +
           vendorHash = "sha256-mqpBP+A2X5ome1Ppg/Kki0C+A77jFtWzUjI/RN+ZCzg=";

     

       30
       30
       +
       

     

       31
       31
       +
           preFixup = ''

     

       32
       32
       +
             mv $out/bin/cmd $out/bin/pocket-id-backend

     

       33
       33
       +
           '';

     

       34
       34
       +
         };

     

       35
       35
       +
       

     

       36
       36
       +
         frontend = buildNpmPackage (finalAttrs: {

     

       37
       37
       +
           pname = "pocket-id-frontend";

     

       38
       38
       +
           inherit version src;

     

       39
       39
       +
       

     

       40
       40
       +
           sourceRoot = "${src.name}/frontend";

     

       41
       41
       +
       

     

       42
       42
       +
           npmDepsHash = "sha256-cpmZzlz+wusfRLN4iIGdk+I4SWrX/gk2fbhg+Gg3paw=";

     

       43
       43
       +
           npmFlags = [ "--legacy-peer-deps" ];

     

       44
       44
       +
       

     

       45
       45
       +
           nativeBuildInputs = [

     

       46
       46
       +
             makeWrapper

     

       47
       47
       +
           ];

     

       48
       48
       +
       

     

       49
       49
       +
           installPhase = ''

     

       50
       50
       +
             runHook preInstall

     

       51
       51
       +
       

     

       52
       52
       +
             # even though vite build creates most of the minified js files,

     

       53
       53
       +
             # it still needs a few packages from node_modules, try to strip that

     

       54
       54
       +
             npm prune --omit=dev --omit=optional $npmFlags

     

       55
       55
       +
             # larger seemingly unused packages

     

       56
       56
       +
             rm -r node_modules/{lucide-svelte,bits-ui,jiti,@swc,.bin}

     

       57
       57
       +
             # unused file types

     

       58
       58
       +
             for pattern in '*.map' '*.map.js' '*.ts'; do

     

       59
       59
       +
               find . -type f -name "$pattern" -exec rm {} +

     

       60
       60
       +
             done

     

       61
       61
       +
       

     

       62
       62
       +
             mkdir -p $out/{bin,lib/pocket-id-frontend}

     

       63
       63
       +
             cp -r build $out/lib/pocket-id-frontend/dist

     

       64
       64
       +
             cp -r node_modules $out/lib/pocket-id-frontend/node_modules

     

       65
       65
       +
             makeWrapper ${lib.getExe nodejs} $out/bin/pocket-id-frontend \

     

       66
       66
       +
               --add-flags $out/lib/pocket-id-frontend/dist/index.js

     

       67
       67
       +
       

     

       68
       68
       +
             runHook postInstall

     

       69
       69
       +
           '';

     

       70
       70
       +
         });

     

       71
       71
       +
       

     

       72
       72
       +
       in

     

       73
       73
       +
       stdenvNoCC.mkDerivation rec {

     

       74
       74
       +
         pname = "pocket-id";

     

       75
       75
       +
         inherit

     

       76
       76
       +
           version

     

       77
       77
       +
           src

     

       78
       78
       +
           backend

     

       79
       79
       +
           frontend

     

       80
       80
       +
           ;

     

       81
       81
       +
       

     

       82
       82
       +
         dontUnpack = true;

     

       83
       83
       +
       

     

       84
       84
       +
         installPhase = ''

     

       85
       85
       +
           runHook preInstall

     

       86
       86
       +
       

     

       87
       87
       +
           mkdir -p $out/bin

     

       88
       88
       +
           ln -s ${backend}/bin/pocket-id-backend $out/bin/pocket-id-backend

     

       89
       89
       +
           ln -s ${frontend}/bin/pocket-id-frontend $out/bin/pocket-id-frontend

     

       90
       90
       +
       

     

       91
       91
       +
           runHook postInstall

     

       92
       92
       +
         '';

     

       93
       93
       +
       

     

       94
       94
       +
         passthru = {

     

       95
       95
       +
           tests = {

     

       96
       96
       +
             inherit (nixosTests) pocket-id;

     

       97
       97
       +
           };

     

       98
       98
       +
           updateScript = nix-update-script {

     

       99
       99
       +
             extraArgs = [

     

       100
       100
       +
               "--subpackage"

     

       101
       101
       +
               "backend"

     

       102
       102
       +
               "--subpackage"

     

       103
       103
       +
               "frontend"

     

       104
       104
       +
             ];

     

       105
       105
       +
           };

     

       106
       106
       +
         };

     

       107
       107
       +
       

     

       108
       108
       +
         meta = {

     

       109
       109
       +
           description = "OIDC provider with passkeys support";

     

       110
       110
       +
           homepage = "https://pocket-id.org";

     

       111
       111
       +
           changelog = "https://github.com/pocket-id/pocket-id/releases/tag/v${version}";

     

       112
       112
       +
           license = lib.licenses.bsd2;

     

       113
       113
       +
           maintainers = with lib.maintainers; [

     

       114
       114
       +
             gepbird

     

       115
       115
       +
             ymstnt

     

       116
       116
       +
           ];

     

       117
       117
       +
           platforms = lib.platforms.unix;

     

       118
       118
       +
         };

     

       119
       119
       +
       }

+3

pkgs/by-name/rd/rdkafka/package.nix

···

       8
       8
        
         curl,

     

       9
       9
        
         cmake,

     

       10
       10
        
         ninja,

     

       11
       11
       +
         deterministic-host-uname,

     

       11
       12
        
       }:

     

       12
       13
        
       

     

       13
       14
        
       stdenv.mkDerivation (finalAttrs: {

     
···

       29
       30
        
         nativeBuildInputs = [

     

       30
       31
        
           cmake

     

       31
       32
        
           ninja

     

       33
       33
       +
           # cross: build system uses uname to determine host system

     

       34
       34
       +
           deterministic-host-uname

     

       32
       35
        
         ];

     

       33
       36
        
       

     

       34
       37
        
         buildInputs = [

+2 -2

pkgs/by-name/ti/tippecanoe/package.nix

···

       10
       10
        
       

     

       11
       11
        
       stdenv.mkDerivation (finalAttrs: {

     

       12
       12
        
         pname = "tippecanoe";

     

       13
       13
       -
         version = "2.75.1";

     

       13
       13
       +
         version = "2.77.0";

     

       14
       14
        
       

     

       15
       15
        
         src = fetchFromGitHub {

     

       16
       16
        
           owner = "felt";

     

       17
       17
        
           repo = "tippecanoe";

     

       18
       18
        
           tag = finalAttrs.version;

     

       19
       19
       -
           hash = "sha256-rBuk34lOrp9aW7yK0LOTRqFJg3J8IogR01kcFhgK12Y=";

     

       19
       19
       +
           hash = "sha256-7yRrUn1U0iERlix/8/oaMaizlpzqdiSIHj298ykaJjE=";

     

       20
       20
        
         };

     

       21
       21
        
       

     

       22
       22
        
         buildInputs = [

+2 -2

pkgs/by-name/yt/ytui-music/package.nix

···

       8
       8
        
         stdenv,

     

       9
       9
        
         darwin,

     

       10
       10
        
         mpv,

     

       11
       11
       -
         youtube-dl,

     

       11
       11
       +
         yt-dlp,

     

       12
       12
        
         makeBinaryWrapper,

     

       13
       13
        
       }:

     

       14
       14
        
       

     
···

       49
       49
        
       

     

       50
       50
        
         postInstall = ''

     

       51
       51
        
           wrapProgram $out/bin/ytui_music \

     

       52
       52
       -
             --prefix PATH : ${lib.makeBinPath [ youtube-dl ]}

     

       52
       52
       +
             --prefix PATH : ${lib.makeBinPath [ yt-dlp ]}

     

       53
       53
        
         '';

     

       54
       54
        
       

     

       55
       55
        
         doInstallCheck = true;

+3 -3

pkgs/by-name/zw/zwave-js-ui/package.nix

···

       7
       7
        
       

     

       8
       8
        
       buildNpmPackage rec {

     

       9
       9
        
         pname = "zwave-js-ui";

     

       10
       10
       -
         version = "9.32.0";

     

       10
       10
       +
         version = "10.1.2";

     

       11
       11
        
       

     

       12
       12
        
         src = fetchFromGitHub {

     

       13
       13
        
           owner = "zwave-js";

     

       14
       14
        
           repo = "zwave-js-ui";

     

       15
       15
        
           tag = "v${version}";

     

       16
       16
       -
           hash = "sha256-DZm3IoLc28YMbwWL6+qHd5BSyRQswRatEvGmwuIzBZM=";

     

       16
       16
       +
           hash = "sha256-j56kDnMw/YX6ONkIjPjopsu6xE2Kt1cZV5u+tX2TqlM=";

     

       17
       17
        
         };

     

       18
       18
       -
         npmDepsHash = "sha256-FZ/iStpC5DiNthV42/QAzek261ZUAL1DOEIixVlArZ0=";

     

       18
       18
       +
         npmDepsHash = "sha256-hkfDztDtLug9qdxi9NRWnzCN6Parv27stVknZ0cSYpo=";

     

       19
       19
        
       

     

       20
       20
        
         passthru.tests.zwave-js-ui = nixosTests.zwave-js-ui;

     

       21
       21

+2 -2

pkgs/development/beam-modules/erlfmt/default.nix

···

       6
       6
        
       

     

       7
       7
        
       rebar3Relx rec {

     

       8
       8
        
         pname = "erlfmt";

     

       9
       9
       -
         version = "1.6.0";

     

       9
       9
       +
         version = "1.6.1";

     

       10
       10
        
         releaseType = "escript";

     

       11
       11
        
         src = fetchFromGitHub {

     

       12
       12
        
           owner = "WhatsApp";

     

       13
       13
        
           repo = "erlfmt";

     

       14
       14
       -
           sha256 = "sha256-p4cdnKDY02XqdFOkijhOo527eZenfMF8J2dbuvH/hcY=";

     

       14
       14
       +
           sha256 = "sha256-O7+7dMgmnNd9hHuRcJqMAI0gmONz5EO3qSlUC3tufh0=";

     

       15
       15
        
           rev = "v${version}";

     

       16
       16
        
         };

     

       17
       17
        
         meta = with lib; {

+2 -2

pkgs/development/interpreters/erlang/27.nix

···

       1
       1
        
       { mkDerivation }:

     

       2
       2
        
       

     

       3
       3
        
       mkDerivation {

     

       4
       4
       -
         version = "27.3.1";

     

       5
       5
       -
         sha256 = "sha256-VuVRwcS2TgDYT7buLMHOe8r0AWM+R9DxydcHErAy8xw=";

     

       4
       4
       +
         version = "27.3.2";

     

       5
       5
       +
         sha256 = "sha256-Pybkcm3pLt0wV+S9ia/BAmM1AKp/nVSAckEzNn4KjSg=";

     

       6
       6
        
       }

+5 -2

pkgs/development/python-modules/aider-chat/default.nix

···

       112
       112
        
         torch,

     

       113
       113
        
         nltk,

     

       114
       114
        
         boto3,

     

       115
       115
       +
         nix-update-script,

     

       115
       116
        
       }:

     

       116
       117
        
       

     

       117
       118
        
       let

     
···

       123
       124
        
           ];

     

       124
       125
        
         };

     

       125
       126
        
       

     

       126
       126
       -
         version = "0.80.0";

     

       127
       127
       +
         version = "0.81.0";

     

       127
       128
        
         aider-chat = buildPythonPackage {

     

       128
       129
        
           pname = "aider-chat";

     

       129
       130
        
           inherit version;

     
···

       136
       137
        
             owner = "Aider-AI";

     

       137
       138
        
             repo = "aider";

     

       138
       139
        
             tag = "v${version}";

     

       139
       139
       -
             hash = "sha256-W3GO5+0rprQHmn1upL3pcXuv2e9Wir6TW0tUnvZj48E=";

     

       140
       140
       +
             hash = "sha256-xWOXsffLAVBZvJM8PuAJ12IrmNLfXuqHrbIMtPM1leE=";

     

       140
       141
        
           };

     

       141
       142
        
       

     

       142
       143
        
           pythonRelaxDeps = true;

     
···

       365
       366
        
                   makeWrapperArgs = makeWrapperArgs ++ playwrightArgs ++ helpArgs;

     

       366
       367
        
                 }

     

       367
       368
        
               );

     

       369
       369
       +
       

     

       370
       370
       +
             updateScript = nix-update-script { };

     

       368
       371
        
           };

     

       369
       372
        
       

     

       370
       373
        
           meta = {

+2 -1

pkgs/development/python-modules/azure-mgmt-keyvault/default.nix

···

       17
       17
        
         disabled = pythonOlder "3.8";

     

       18
       18
        
       

     

       19
       19
        
         src = fetchPypi {

     

       20
       20
       -
           inherit pname version;

     

       20
       20
       +
           pname = "azure_mgmt_keyvault";

     

       21
       21
       +
           inherit version;

     

       21
       22
        
           hash = "sha256-/PsTZoUpJvKjEeG8bmp4brioof1G5gJdTBFO3iy0ZC4=";

     

       22
       23
        
         };

     

       23
       24

+2 -2

pkgs/development/python-modules/microsoft-security-utilities-secret-masker/default.nix

···

       8
       8
        
       

     

       9
       9
        
       buildPythonPackage rec {

     

       10
       10
        
         pname = "microsoft-security-utilities-secret-masker";

     

       11
       11
       -
         version = "1.0.0b3";

     

       11
       11
       +
         version = "1.0.0b4";

     

       12
       12
        
         pyproject = true;

     

       13
       13
        
       

     

       14
       14
        
         src = fetchPypi {

     

       15
       15
        
           pname = "microsoft_security_utilities_secret_masker";

     

       16
       16
        
           inherit version;

     

       17
       17
       -
           hash = "sha256-0EVIIwxno70stGCyjnH+bKwWj0jwbXapadnKR732c0M=";

     

       17
       17
       +
           hash = "sha256-owvTYawYyLUvaEQHa8JkZTNZSeqcegBNlfUZbsb97z4=";

     

       18
       18
        
         };

     

       19
       19
        
       

     

       20
       20
        
         build-system = [

+2 -2

pkgs/development/python-modules/posthog/default.nix

···

       19
       19
        
       

     

       20
       20
        
       buildPythonPackage rec {

     

       21
       21
        
         pname = "posthog";

     

       22
       22
       -
         version = "3.18.1";

     

       22
       22
       +
         version = "3.23.0";

     

       23
       23
        
         pyproject = true;

     

       24
       24
        
       

     

       25
       25
        
         src = fetchFromGitHub {

     

       26
       26
        
           owner = "PostHog";

     

       27
       27
        
           repo = "posthog-python";

     

       28
       28
        
           tag = "v${version}";

     

       29
       29
       -
           hash = "sha256-1jJACzDf8J4Vsrvtj0PgeK1Ck2Bzy5ThHm0Ohd+LyYs=";

     

       29
       29
       +
           hash = "sha256-+nmCmO1vPnNgZJdZSWwapeFfckNXEcdc/129yaLygf8=";

     

       30
       30
        
         };

     

       31
       31
        
       

     

       32
       32
        
         build-system = [ setuptools ];

+3 -3

pkgs/development/python-modules/xiaomi-ble/default.nix

···

       19
       19
        
       

     

       20
       20
        
       buildPythonPackage rec {

     

       21
       21
        
         pname = "xiaomi-ble";

     

       22
       22
       -
         version = "0.35.0";

     

       22
       22
       +
         version = "0.36.0";

     

       23
       23
        
         pyproject = true;

     

       24
       24
        
       

     

       25
       25
        
         disabled = pythonOlder "3.9";

     
···

       28
       28
        
           owner = "Bluetooth-Devices";

     

       29
       29
        
           repo = "xiaomi-ble";

     

       30
       30
        
           tag = "v${version}";

     

       31
       31
       -
           hash = "sha256-+mXn5R9zRjTPKqzB0vFHSO2+Jx+61K7/Ksp+jmMUDo4=";

     

       31
       31
       +
           hash = "sha256-qk8eoPuyU8deEuQkRRtTt1AxIpjaXaS/byDxMfZnLgI=";

     

       32
       32
        
         };

     

       33
       33
        
       

     

       34
       34
        
         build-system = [ poetry-core ];

     
···

       57
       57
        
         meta = with lib; {

     

       58
       58
        
           description = "Library for Xiaomi BLE devices";

     

       59
       59
        
           homepage = "https://github.com/Bluetooth-Devices/xiaomi-ble";

     

       60
       60
       -
           changelog = "https://github.com/Bluetooth-Devices/xiaomi-ble/releases/tag/v${version}";

     

       60
       60
       +
           changelog = "https://github.com/Bluetooth-Devices/xiaomi-ble/releases/tag/${src.tag}";

     

       61
       61
        
           license = licenses.mit;

     

       62
       62
        
           maintainers = with maintainers; [ fab ];

     

       63
       63
        
         };

+1 -1

pkgs/os-specific/linux/kernel/htmldocs.nix

···

       19
       19
        
           patchShebangs \

     

       20
       20
        
             Documentation/sphinx/parse-headers.pl \

     

       21
       21
        
             scripts/{get_abi.pl,get_feat.pl,kernel-doc,sphinx-pre-install} \

     

       22
       22
       -
             tools/net/ynl/ynl-gen-rst.py

     

       22
       22
       +
             tools/net/ynl/pyynl/ynl_gen_rst.py

     

       23
       23
        
         '';

     

       24
       24
        
       

     

       25
       25
        
         FONTCONFIG_FILE = makeFontsConf {

+12

pkgs/servers/home-assistant/default.nix

···

       151
       151
        
               ];

     

       152
       152
        
             });

     

       153
       153
        
       

     

       154
       154
       +
             # Pinned due to home-assistant still needing 1.10.0 verison

     

       155
       155
       +
             # Remove this when home-assistant upates the jellyfin-apiclient-python version

     

       156
       156
       +
             jellyfin-apiclient-python = super.jellyfin-apiclient-python.overridePythonAttrs (oldAttrs: rec {

     

       157
       157
       +
               version = "1.10.0";

     

       158
       158
       +
               src = fetchFromGitHub {

     

       159
       159
       +
                 owner = "jellyfin";

     

       160
       160
       +
                 repo = "jellyfin-apiclient-python";

     

       161
       161
       +
                 tag = "v${version}";

     

       162
       162
       +
                 hash = "sha256-H1FqypNuVIZ17cFdNDEmmKICswxJkUGq2LhlingbCVk=";

     

       163
       163
       +
               };

     

       164
       164
       +
             });

     

       165
       165
       +
       

     

       154
       166
        
             # acme and thus hass-nabucasa doesn't support josepy v2

     

       155
       167
        
             # https://github.com/certbot/certbot/issues/10185

     

       156
       168
        
             josepy = super.josepy.overridePythonAttrs (old: rec {

+2 -2

pkgs/tools/security/trufflehog/default.nix

···

       8
       8
        
       

     

       9
       9
        
       buildGoModule rec {

     

       10
       10
        
         pname = "trufflehog";

     

       11
       11
       -
         version = "3.88.20";

     

       11
       11
       +
         version = "3.88.21";

     

       12
       12
        
       

     

       13
       13
        
         src = fetchFromGitHub {

     

       14
       14
        
           owner = "trufflesecurity";

     

       15
       15
        
           repo = "trufflehog";

     

       16
       16
        
           tag = "v${version}";

     

       17
       17
       -
           hash = "sha256-JLBHg1hCTOOBRTJbjXJitILD/HSmH1WDuzm0t3/OJaA=";

     

       17
       17
       +
           hash = "sha256-hUBUpsfVKifeQ9DpeNKwBGnoLH1OK2T4IOb7yFWxz+Q=";

     

       18
       18
        
         };

     

       19
       19
        
       

     

       20
       20
        
         vendorHash = "sha256-vJl2gIS14NA9nV9j+81xKv3NnsDce4V7XoeipOZV+wI=";

+3 -4

pkgs/tools/virtualization/mkosi/default.nix

···

       2
       2
        
         lib,

     

       3
       3
        
         fetchFromGitHub,

     

       4
       4
        
         stdenv,

     

       5
       5
       +
         python,

     

       5
       6
        
         systemd,

     

       6
       7
        
         pandoc,

     

       7
       8
        
         kmod,

     
···

       15
       16
        
         replaceVars,

     

       16
       17
        
       

     

       17
       18
        
         # Python packages

     

       18
       18
       -
         python,

     

       19
       19
        
         setuptools,

     

       20
       20
        
         setuptools-scm,

     

       21
       21
        
         wheel,

     

       22
       22
        
         buildPythonApplication,

     

       23
       23
        
         pytestCheckHook,

     

       24
       24
       -
         pefile,

     

       25
       24
        
       

     

       26
       25
        
         # Optional dependencies

     

       27
       26
        
         withQemu ? false,

     
···

       46
       45
        
           withKernelInstall = true;

     

       47
       46
        
         };

     

       48
       47
        
       

     

       49
       49
       -
         python3pefile = python.withPackages (_: [ pefile ]);

     

       48
       48
       +
         pythonWithPefile = python.withPackages (ps: [ ps.pefile ]);

     

       50
       49
        
       

     

       51
       50
        
         deps =

     

       52
       51
        
           [

     
···

       85
       84
        
           [

     

       86
       85
        
             (replaceVars ./0001-Use-wrapped-binaries-instead-of-Python-interpreter.patch {

     

       87
       86
        
               UKIFY = "${systemdForMkosi}/lib/systemd/ukify";

     

       88
       88
       -
               PYTHON_PEFILE = "${python3pefile}/bin/python3.12";

     

       87
       87
       +
               PYTHON_PEFILE = lib.getExe pythonWithPefile;

     

       89
       88
        
               NIX_PATH = toString (lib.makeBinPath deps);

     

       90
       89
        
               MKOSI_SANDBOX = null; # will be replaced in postPatch

     

       91
       90
        
             })

+2

pkgs/top-level/all-packages.nix

···

       359
       359
        
       

     

       360
       360
        
         coolercontrol = recurseIntoAttrs (callPackage ../applications/system/coolercontrol { });

     

       361
       361
        
       

     

       362
       362
       +
         copilot-language-server-fhs = copilot-language-server.fhs;

     

       363
       363
       +
       

     

       362
       364
        
         curv = callPackage ../by-name/cu/curv/package.nix {

     

       363
       365
        
           openexr = openexr_3;

     

       364
       366
        
         };