commit afe3fd192f12fe724fc878b384e7a84aa5235d2b · pyrox.dev/nixpkgs

+1 -1

nixos/doc/manual/release-notes/rl-2105.xml

···

       330
       330
        
          </listitem>

     

       331
       331
        
          <listitem>

     

       332
       332
        
           <para>

     

       333
       333
       -
             <literal>vim</literal> switched to Python 3, dropping all Python 2 support.

     

       333
       333
       +
             <literal>vim</literal> and <literal>neovim</literal> switched to Python 3, dropping all Python 2 support.

     

       334
       334
        
           </para>

     

       335
       335
        
          </listitem>

     

       336
       336
        
          <listitem>

+69 -7

nixos/modules/services/misc/home-assistant.nix

···

       245
       245
        
               rm -f "${cfg.configDir}/ui-lovelace.yaml"

     

       246
       246
        
               ln -s ${lovelaceConfigFile} "${cfg.configDir}/ui-lovelace.yaml"

     

       247
       247
        
             '');

     

       248
       248
       -
             serviceConfig = {

     

       249
       249
       -
               ExecStart = "${package}/bin/hass --config '${cfg.configDir}'";

     

       248
       248
       +
             serviceConfig = let

     

       249
       249
       +
               # List of capabilities to equip home-assistant with, depending on configured components

     

       250
       250
       +
               capabilities = [

     

       251
       251
       +
                 # Empty string first, so we will never accidentally have an empty capability bounding set

     

       252
       252
       +
                 # https://github.com/NixOS/nixpkgs/issues/120617#issuecomment-830685115

     

       253
       253
       +
                 ""

     

       254
       254
       +
               ] ++ (unique (optionals (useComponent "bluetooth_tracker" || useComponent "bluetooth_le_tracker") [

     

       255
       255
       +
                 # Required for interaction with hci devices and bluetooth sockets

     

       256
       256
       +
                 # https://www.home-assistant.io/integrations/bluetooth_le_tracker/#rootless-setup-on-core-installs

     

       257
       257
       +
                 "CAP_NET_ADMIN"

     

       258
       258
       +
                 "CAP_NET_RAW"

     

       259
       259
       +
               ] ++ lib.optionals (useComponent "emulated_hue") [

     

       260
       260
       +
                 # Alexa looks for the service on port 80

     

       261
       261
       +
                 # https://www.home-assistant.io/integrations/emulated_hue

     

       262
       262
       +
                 "CAP_NET_BIND_SERVICE"

     

       263
       263
       +
               ] ++ lib.optionals (useComponent "nmap_tracker") [

     

       264
       264
       +
                 # https://www.home-assistant.io/integrations/nmap_tracker#linux-capabilities

     

       265
       265
       +
                 "CAP_NET_ADMIN"

     

       266
       266
       +
                 "CAP_NET_BIND_SERVICE"

     

       267
       267
       +
                 "CAP_NET_RAW"

     

       268
       268
       +
               ]));

     

       269
       269
       +
             in {

     

       270
       270
       +
               ExecStart = "${package}/bin/hass --runner --config '${cfg.configDir}'";

     

       250
       271
        
               ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";

     

       251
       272
        
               User = "hass";

     

       252
       273
        
               Group = "hass";

     

       253
       274
        
               Restart = "on-failure";

     

       275
       275
       +
               RestartForceExitStatus = "100";

     

       276
       276
       +
               SuccessExitStatus = "100";

     

       277
       277
       +
               KillSignal = "SIGINT";

     

       278
       278
       +
       

     

       279
       279
       +
               # Hardening

     

       280
       280
       +
               AmbientCapabilities = capabilities;

     

       281
       281
       +
               CapabilityBoundingSet = capabilities;

     

       282
       282
       +
               DeviceAllow = [

     

       283
       283
       +
                 "char-ttyACM rw"

     

       284
       284
       +
                 "char-ttyAMA rw"

     

       285
       285
       +
                 "char-ttyUSB rw"

     

       286
       286
       +
               ];

     

       287
       287
       +
               DevicePolicy = "closed";

     

       288
       288
       +
               LockPersonality = true;

     

       289
       289
       +
               MemoryDenyWriteExecute = true;

     

       290
       290
       +
               NoNewPrivileges = true;

     

       291
       291
       +
               PrivateTmp = true;

     

       292
       292
       +
               PrivateUsers = false; # prevents gaining capabilities in the host namespace

     

       293
       293
       +
               ProtectClock = true;

     

       294
       294
       +
               ProtectControlGroups = true;

     

       295
       295
       +
               ProtectHome = true;

     

       296
       296
       +
               ProtectHostname = true;

     

       297
       297
       +
               ProtectKernelLogs = true;

     

       298
       298
       +
               ProtectKernelModules = true;

     

       299
       299
       +
               ProtectKernelTunables = true;

     

       300
       300
       +
               ProtectProc = "invisible";

     

       301
       301
       +
               ProcSubset = "pid";

     

       254
       302
        
               ProtectSystem = "strict";

     

       303
       303
       +
               RemoveIPC = true;

     

       255
       304
        
               ReadWritePaths = let

     

       305
       305
       +
                 # Allow rw access to explicitly configured paths

     

       256
       306
        
                 cfgPath = [ "config" "homeassistant" "allowlist_external_dirs" ];

     

       257
       307
        
                 value = attrByPath cfgPath [] cfg;

     

       258
       308
        
                 allowPaths = if isList value then value else singleton value;

     

       259
       309
        
               in [ "${cfg.configDir}" ] ++ allowPaths;

     

       260
       260
       -
               KillSignal = "SIGINT";

     

       261
       261
       -
               PrivateTmp = true;

     

       262
       262
       -
               RemoveIPC = true;

     

       263
       263
       -
               AmbientCapabilities = "cap_net_raw,cap_net_admin+eip";

     

       310
       310
       +
               RestrictAddressFamilies = [

     

       311
       311
       +
                 "AF_UNIX"

     

       312
       312
       +
                 "AF_INET"

     

       313
       313
       +
                 "AF_INET6"

     

       314
       314
       +
               ] ++ optionals (useComponent "bluetooth_tracker" || useComponent "bluetooth_le_tracker") [

     

       315
       315
       +
                 "AF_BLUETOOTH"

     

       316
       316
       +
               ];

     

       317
       317
       +
               RestrictNamespaces = true;

     

       318
       318
       +
               RestrictRealtime = true;

     

       319
       319
       +
               RestrictSUIDSGID = true;

     

       320
       320
       +
               SupplementaryGroups = [ "dialout" ];

     

       321
       321
       +
               SystemCallArchitectures = "native";

     

       322
       322
       +
               SystemCallFilter = [

     

       323
       323
       +
                 "@system-service"

     

       324
       324
       +
                 "~@privileged"

     

       325
       325
       +
               ];

     

       326
       326
       +
               UMask = "0077";

     

       264
       327
        
             };

     

       265
       328
        
             path = [

     

       266
       329
        
               "/run/wrappers" # needed for ping

     
···

       278
       341
        
             home = cfg.configDir;

     

       279
       342
        
             createHome = true;

     

       280
       343
        
             group = "hass";

     

       281
       281
       -
             extraGroups = [ "dialout" ];

     

       282
       344
        
             uid = config.ids.uids.hass;

     

       283
       345
        
           };

     

       284
       346

+40 -6

nixos/modules/services/networking/mosquitto.nix

···

       20
       20
        
           acl_file ${aclFile}

     

       21
       21
        
           persistence true

     

       22
       22
        
           allow_anonymous ${boolToString cfg.allowAnonymous}

     

       23
       23
       -
           bind_address ${cfg.host}

     

       24
       24
       -
           port ${toString cfg.port}

     

       23
       23
       +
           listener ${toString cfg.port} ${cfg.host}

     

       25
       24
        
           ${passwordConf}

     

       26
       25
        
           ${listenerConf}

     

       27
       26
        
           ${cfg.extraConf}

     
···

       233
       232
        
               ExecStart = "${pkgs.mosquitto}/bin/mosquitto -c ${mosquittoConf}";

     

       234
       233
        
               ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";

     

       235
       234
        
       

     

       236
       236
       -
               ProtectSystem = "strict";

     

       237
       237
       -
               ProtectHome = true;

     

       235
       235
       +
               # Hardening

     

       236
       236
       +
               CapabilityBoundingSet = "";

     

       237
       237
       +
               DevicePolicy = "closed";

     

       238
       238
       +
               LockPersonality = true;

     

       239
       239
       +
               MemoryDenyWriteExecute = true;

     

       240
       240
       +
               NoNewPrivileges = true;

     

       238
       241
        
               PrivateDevices = true;

     

       239
       242
        
               PrivateTmp = true;

     

       240
       240
       -
               ReadWritePaths = "${cfg.dataDir}";

     

       243
       243
       +
               PrivateUsers = true;

     

       244
       244
       +
               ProtectClock = true;

     

       241
       245
        
               ProtectControlGroups = true;

     

       246
       246
       +
               ProtectHome = true;

     

       247
       247
       +
               ProtectHostname = true;

     

       248
       248
       +
               ProtectKernelLogs = true;

     

       242
       249
        
               ProtectKernelModules = true;

     

       243
       250
        
               ProtectKernelTunables = true;

     

       244
       244
       -
               NoNewPrivileges = true;

     

       251
       251
       +
               ProtectProc = "invisible";

     

       252
       252
       +
               ProcSubset = "pid";

     

       253
       253
       +
               ProtectSystem = "strict";

     

       254
       254
       +
               ReadWritePaths = [

     

       255
       255
       +
                 cfg.dataDir

     

       256
       256
       +
                 "/tmp"  # mosquitto_passwd creates files in /tmp before moving them

     

       257
       257
       +
               ];

     

       258
       258
       +
               ReadOnlyPaths = with cfg.ssl; lib.optionals (enable) [

     

       259
       259
       +
                 certfile

     

       260
       260
       +
                 keyfile

     

       261
       261
       +
                 cafile

     

       262
       262
       +
               ];

     

       263
       263
       +
               RemoveIPC = true;

     

       264
       264
       +
               RestrictAddressFamilies = [

     

       265
       265
       +
                 "AF_UNIX"  # for sd_notify() call

     

       266
       266
       +
                 "AF_INET"

     

       267
       267
       +
                 "AF_INET6"

     

       268
       268
       +
               ];

     

       269
       269
       +
               RestrictNamespaces = true;

     

       270
       270
       +
               RestrictRealtime = true;

     

       271
       271
       +
               RestrictSUIDSGID = true;

     

       272
       272
       +
               SystemCallArchitectures = "native";

     

       273
       273
       +
               SystemCallFilter = [

     

       274
       274
       +
                 "@system-service"

     

       275
       275
       +
                 "~@privileged"

     

       276
       276
       +
                 "~@resources"

     

       277
       277
       +
               ];

     

       278
       278
       +
               UMask = "0077";

     

       245
       279
        
             };

     

       246
       280
        
             preStart = ''

     

       247
       281
        
               rm -f ${cfg.dataDir}/passwd

+12 -4

nixos/tests/home-assistant.nix

···

       1
       1
       -
       import ./make-test-python.nix ({ pkgs, ... }:

     

       1
       1
       +
       import ./make-test-python.nix ({ pkgs, lib, ... }:

     

       2
       2
        
       

     

       3
       3
        
       let

     

       4
       4
        
         configDir = "/var/lib/foobar";

     
···

       6
       6
        
         mqttPassword = "secret";

     

       7
       7
        
       in {

     

       8
       8
        
         name = "home-assistant";

     

       9
       9
       -
         meta = with pkgs.lib; {

     

       10
       10
       -
           maintainers = with maintainers; [ dotlambda ];

     

       11
       11
       -
         };

     

       9
       9
       +
         meta.maintainers = lib.teams.home-assistant.members;

     

       12
       10
        
       

     

       13
       11
        
         nodes.hass = { pkgs, ... }: {

     

       14
       12
        
           environment.systemPackages = with pkgs; [ mosquitto ];

     
···

       47
       45
        
                 payload_on = "let_there_be_light";

     

       48
       46
        
                 payload_off = "off";

     

       49
       47
        
               }];

     

       48
       48
       +
               emulated_hue = {

     

       49
       49
       +
                 host_ip = "127.0.0.1";

     

       50
       50
       +
                 listen_port = 80;

     

       51
       51
       +
               };

     

       50
       52
        
               logger = {

     

       51
       53
        
                 default = "info";

     

       52
       54
        
                 logs."homeassistant.components.mqtt" = "debug";

     
···

       82
       84
        
               hass.succeed(

     

       83
       85
        
                   "mosquitto_pub -V mqttv5 -t home-assistant/test -u ${mqttUsername} -P '${mqttPassword}' -m let_there_be_light"

     

       84
       86
        
               )

     

       87
       87
       +
           with subtest("Check that capabilities are passed for emulated_hue to bind to port 80"):

     

       88
       88
       +
               hass.wait_for_open_port(80)

     

       89
       89
       +
               hass.succeed("curl --fail http://localhost:80/description.xml")

     

       85
       90
        
           with subtest("Print log to ease debugging"):

     

       86
       91
        
               output_log = hass.succeed("cat ${configDir}/home-assistant.log")

     

       87
       92
        
               print("\n### home-assistant.log ###\n")

     
···

       93
       98
        
           # example line: 2020-06-20 10:01:32 DEBUG (MainThread) [homeassistant.components.mqtt] Received message on home-assistant/test: b'let_there_be_light'

     

       94
       99
        
           with subtest("Check we received the mosquitto message"):

     

       95
       100
        
               assert "let_there_be_light" in output_log

     

       101
       101
       +
       

     

       102
       102
       +
           with subtest("Check systemd unit hardening"):

     

       103
       103
       +
               hass.log(hass.succeed("systemd-analyze security home-assistant.service"))

     

       96
       104
        
         '';

     

       97
       105
        
       })

+4 -1

nixos/tests/mosquitto.nix

···

       1
       1
       -
       import ./make-test-python.nix ({ pkgs, ... }:

     

       1
       1
       +
       import ./make-test-python.nix ({ pkgs, lib, ... }:

     

       2
       2
        
       

     

       3
       3
        
       let

     

       4
       4
        
         port = 1888;

     
···

       30
       30
        
                 ];

     

       31
       31
        
               };

     

       32
       32
        
             };

     

       33
       33
       +
       

     

       34
       34
       +
             # disable private /tmp for this test

     

       35
       35
       +
             systemd.services.mosquitto.serviceConfig.PrivateTmp = lib.mkForce false;

     

       33
       36
        
           };

     

       34
       37
        
       

     

       35
       38
        
           client1 = client;

+2 -2

pkgs/applications/editors/neovim/default.nix

···

       6
       6
        
       

     

       7
       7
        
       # now defaults to false because some tests can be flaky (clipboard etc)

     

       8
       8
        
       , doCheck ? false

     

       9
       9
       -
       , nodejs ? null, fish ? null, python ? null

     

       9
       9
       +
       , nodejs ? null, fish ? null, python3 ? null

     

       10
       10
        
       }:

     

       11
       11
        
       

     

       12
       12
        
       with lib;

     
···

       19
       19
        
             ]

     

       20
       20
        
           ));

     

       21
       21
        
       

     

       22
       22
       -
         pyEnv = python.withPackages(ps: [ ps.pynvim ps.msgpack ]);

     

       22
       22
       +
         pyEnv = python3.withPackages(ps: with ps; [ pynvim msgpack ]);

     

       23
       23
        
       

     

       24
       24
        
         # FIXME: this is verry messy and strange.

     

       25
       25
        
         # see https://github.com/NixOS/nixpkgs/pull/80528

+2 -2

pkgs/applications/editors/neovim/neovim-qt.nix

···

       1
       1
        
       { lib, mkDerivation, fetchFromGitHub, cmake, doxygen, makeWrapper

     

       2
       2
       -
       , msgpack, neovim, pythonPackages, qtbase }:

     

       2
       2
       +
       , msgpack, neovim, python3Packages, qtbase }:

     

       3
       3
        
       

     

       4
       4
        
       mkDerivation rec {

     

       5
       5
        
         pname = "neovim-qt-unwrapped";

     
···

       20
       20
        
         buildInputs = [

     

       21
       21
        
           neovim.unwrapped # only used to generate help tags at build time

     

       22
       22
        
           qtbase

     

       23
       23
       -
         ] ++ (with pythonPackages; [

     

       23
       23
       +
         ] ++ (with python3Packages; [

     

       24
       24
        
           jinja2 python msgpack

     

       25
       25
        
         ]);

     

       26
       26

+19 -4

pkgs/applications/editors/neovim/neovim-remote.nix

···

       1
       1
       -
       { lib, fetchFromGitHub, pythonPackages }:

     

       1
       1
       +
       { lib

     

       2
       2
       +
       , fetchFromGitHub

     

       3
       3
       +
       , python3

     

       4
       4
       +
       , neovim

     

       5
       5
       +
       }:

     

       2
       6
        
       

     

       3
       7
        
       with lib;

     

       4
       8
        
       

     

       5
       5
       -
       pythonPackages.buildPythonApplication rec {

     

       9
       9
       +
       with python3.pkgs; buildPythonApplication rec {

     

       6
       10
        
         pname = "neovim-remote";

     

       7
       11
        
         version = "2.4.0";

     

       8
       8
       -
         disabled = !pythonPackages.isPy3k;

     

       9
       12
        
       

     

       10
       13
        
         src = fetchFromGitHub {

     

       11
       14
        
           owner = "mhinz";

     
···

       14
       17
        
           sha256 = "0jlw0qksak4bdzddpsj74pm2f2bgpj3cwrlspdjjy0j9qzg0mpl9";

     

       15
       18
        
         };

     

       16
       19
        
       

     

       17
       17
       -
         propagatedBuildInputs = with pythonPackages; [

     

       20
       20
       +
         propagatedBuildInputs = [

     

       18
       21
        
           pynvim

     

       19
       22
        
           psutil

     

       20
       23
        
           setuptools

     

       24
       24
       +
         ];

     

       25
       25
       +
       

     

       26
       26
       +
         checkInputs = [

     

       27
       27
       +
           neovim

     

       28
       28
       +
           pytestCheckHook

     

       29
       29
       +
         ];

     

       30
       30
       +
       

     

       31
       31
       +
         disabledTests = [

     

       32
       32
       +
           # these tests get stuck and never return

     

       33
       33
       +
           "test_escape_filenames_properly"

     

       34
       34
       +
           "test_escape_single_quotes_in_filenames"

     

       35
       35
       +
           "test_escape_double_quotes_in_filenames"

     

       21
       36
        
         ];

     

       22
       37
        
       

     

       23
       38
        
         meta = {

+1 -2

pkgs/applications/editors/neovim/qt.nix

···

       1
       1
       -
       { lib, stdenv, mkDerivation, fetchFromGitHub, cmake, doxygen, makeWrapper

     

       2
       2
       -
       , msgpack, neovim, pythonPackages, qtbase, neovim-qt-unwrapped }:

     

       1
       1
       +
       { stdenv, makeWrapper, neovim, neovim-qt-unwrapped }:

     

       3
       2
        
       

     

       4
       3
        
       let

     

       5
       4
        
         unwrapped = neovim-qt-unwrapped;

+5 -12

pkgs/applications/editors/neovim/utils.nix

···

       4
       4
        
       , neovim-unwrapped

     

       5
       5
        
       , bundlerEnv

     

       6
       6
        
       , ruby

     

       7
       7
       -
       , pythonPackages

     

       8
       7
        
       , python3Packages

     

       9
       8
        
       , writeText

     

       10
       9
        
       , wrapNeovimUnstable

     
···

       48
       47
        
             requiredPlugins = vimUtils.requiredPlugins configure;

     

       49
       48
        
             getDeps = attrname: map (plugin: plugin.${attrname} or (_: [ ]));

     

       50
       49
        
       

     

       51
       51
       -
             pluginPython2Packages = getDeps "pythonDependencies" requiredPlugins;

     

       52
       52
       -
             python2Env = pythonPackages.python.withPackages (ps:

     

       53
       53
       -
               [ ps.pynvim ]

     

       54
       54
       -
               ++ (extraPython2Packages ps)

     

       55
       55
       -
               ++ (lib.concatMap (f: f ps) pluginPython2Packages));

     

       56
       56
       -
       

     

       57
       50
        
             pluginPython3Packages = getDeps "python3Dependencies" requiredPlugins;

     

       58
       51
        
             python3Env = python3Packages.python.withPackages (ps:

     

       59
       52
        
               [ ps.pynvim ]

     
···

       69
       62
        
             # While the latter tells nvim that this provider is not available

     

       70
       63
        
             hostprog_check_table = {

     

       71
       64
        
               node = withNodeJs;

     

       72
       72
       -
               python = withPython2;

     

       73
       65
        
               python3 = withPython3;

     

       74
       66
        
               ruby = withRuby;

     

       75
       67
        
             };

     
···

       99
       91
        
             manifestRc = vimUtils.vimrcContent (configure // { customRC = ""; });

     

       100
       92
        
             neovimRcContent = vimUtils.vimrcContent configure;

     

       101
       93
        
           in

     

       94
       94
       +
           assert withPython2 -> throw "Python2 support has been removed from neovim, please remove withPython2 and extraPython2Packages.";

     

       95
       95
       +
       

     

       102
       96
        
           args // {

     

       103
       97
        
             wrapperArgs = makeWrapperArgs;

     

       104
       98
        
             inherit neovimRcContent;

     

       105
       99
        
             inherit manifestRc;

     

       106
       106
       -
             inherit python2Env;

     

       107
       100
        
             inherit python3Env;

     

       108
       101
        
             inherit withNodeJs;

     

       109
       102
        
           } // lib.optionalAttrs withRuby {

     
···

       120
       113
        
         # to keep backwards compatibility

     

       121
       114
        
         legacyWrapper = neovim: {

     

       122
       115
        
           extraMakeWrapperArgs ? ""

     

       123
       123
       -
           , withPython ? true

     

       116
       116
       +
           , withPython ? false

     

       124
       117
        
           /* the function you would have passed to python.withPackages */

     

       125
       118
        
           , extraPythonPackages ? (_: [])

     

       126
       119
        
           /* the function you would have passed to python.withPackages */

     
···

       138
       131
        
             else funOrList);

     

       139
       132
        
       

     

       140
       133
        
             res = makeNeovimConfig {

     

       141
       141
       -
               withPython2 = withPython;

     

       142
       142
       -
               extraPythonPackages = compatFun extraPythonPackages;

     

       143
       134
        
               inherit withPython3;

     

       144
       135
        
               extraPython3Packages = compatFun extraPython3Packages;

     

       145
       136
        
               inherit withNodeJs withRuby viAlias vimAlias;

     

       146
       137
        
               inherit configure;

     

       147
       138
        
             };

     

       148
       139
        
           in

     

       140
       140
       +
           assert withPython -> throw "Python2 support has been removed from neovim, please remove withPython and extraPythonPackages.";

     

       141
       141
       +
       

     

       149
       142
        
           wrapNeovimUnstable neovim (res // {

     

       150
       143
        
             wrapperArgs = lib.escapeShellArgs (

     

       151
       144
        
               res.wrapperArgs ++ lib.optionals (configure != {}) [

+3 -5

pkgs/applications/editors/neovim/wrapper.nix

···

       3
       3
        
       , bundlerEnv, ruby

     

       4
       4
        
       , nodejs

     

       5
       5
        
       , nodePackages

     

       6
       6
       -
       , pythonPackages

     

       7
       6
        
       , python3Packages

     

       8
       7
        
       }:

     

       9
       8
        
       with lib;

     
···

       15
       14
        
             # should contain all args but the binary

     

       16
       15
        
             wrapperArgs ? ""

     

       17
       16
        
           , manifestRc ? null

     

       18
       18
       -
           , withPython2 ? true, python2Env ? null

     

       17
       17
       +
           , withPython2 ? false

     

       19
       18
        
           , withPython3 ? true,  python3Env ? null

     

       20
       19
        
           , withNodeJs ? false

     

       21
       20
        
           , rubyEnv ? null

     
···

       35
       34
        
           [ "${neovim}/bin/nvim" "${placeholder "out"}/bin/nvim" ] ++

     

       36
       35
        
             [ "--set" "NVIM_SYSTEM_RPLUGIN_MANIFEST" "${placeholder "out"}/rplugin.vim" ];

     

       37
       36
        
         in

     

       37
       37
       +
         assert withPython2 -> throw "Python2 support has been removed from the neovim wrapper, please remove withPython2 and python2Env.";

     

       38
       38
       +
       

     

       38
       39
        
         symlinkJoin {

     

       39
       40
        
             name = "neovim-${lib.getVersion neovim}";

     

       40
       41
        
             # Remove the symlinks created by symlinkJoin which we need to perform

     
···

       43
       44
        
               rm $out/share/applications/nvim.desktop

     

       44
       45
        
               substitute ${neovim}/share/applications/nvim.desktop $out/share/applications/nvim.desktop \

     

       45
       46
        
                 --replace 'Name=Neovim' 'Name=WrappedNeovim'

     

       46
       46
       -
             ''

     

       47
       47
       -
             + optionalString withPython2 ''

     

       48
       48
       -
               makeWrapper ${python2Env}/bin/python $out/bin/nvim-python --unset PYTHONPATH

     

       49
       47
        
             ''

     

       50
       48
        
             + optionalString withPython3 ''

     

       51
       49
        
               makeWrapper ${python3Env}/bin/python3 $out/bin/nvim-python3 --unset PYTHONPATH

+66 -4

pkgs/applications/editors/vscode/generic.nix

···

       1
       1
        
       { stdenv, lib, makeDesktopItem

     

       2
       2
        
       , unzip, libsecret, libXScrnSaver, libxshmfence, wrapGAppsHook

     

       3
       3
        
       , gtk2, atomEnv, at-spi2-atk, autoPatchelfHook

     

       4
       4
       -
       , systemd, fontconfig, libdbusmenu

     

       4
       4
       +
       , systemd, fontconfig, libdbusmenu, buildFHSUserEnvBubblewrap

     

       5
       5
       +
       , writeShellScriptBin

     

       5
       6
        
       

     

       6
       7
        
       # Populate passthru.tests

     

       7
       8
        
       , tests

     
···

       13
       14
        
       

     

       14
       15
        
       let

     

       15
       16
        
         inherit (stdenv.hostPlatform) system;

     

       16
       16
       -
       in

     

       17
       17
       -
         stdenv.mkDerivation {

     

       17
       17
       +
         unwrapped = stdenv.mkDerivation {

     

       18
       18
        
       

     

       19
       19
        
           inherit pname version src sourceRoot;

     

       20
       20
        
       

     

       21
       21
        
           passthru = {

     

       22
       22
        
             inherit executableName tests;

     

       23
       23
       +
             fhs = fhs {};

     

       24
       24
       +
             fhsWithPackages = f: fhs { additionalPkgs = f; };

     

       23
       25
        
           };

     

       24
       26
        
       

     

       25
       27
        
           desktopItem = makeDesktopItem {

     
···

       97
       99
        
           '';

     

       98
       100
        
       

     

       99
       101
        
           inherit meta;

     

       100
       100
       -
         }

     

       102
       102
       +
         };

     

       103
       103
       +
       

     

       104
       104
       +
         # Vscode and variants allow for users to download and use extensions

     

       105
       105
       +
         # which often include the usage of pre-built binaries.

     

       106
       106
       +
         # This has been an on-going painpoint for many users, as

     

       107
       107
       +
         # a full extension update cycle has to be done through nixpkgs

     

       108
       108
       +
         # in order to create or update extensions.

     

       109
       109
       +
         # See: #83288 #91179 #73810 #41189

     

       110
       110
       +
         #

     

       111
       111
       +
         # buildFHSUserEnv allows for users to use the existing vscode

     

       112
       112
       +
         # extension tooling without significant pain.

     

       113
       113
       +
         fhs = { additionalPkgs ? pkgs: [] }: buildFHSUserEnvBubblewrap {

     

       114
       114
       +
           # also determines the name of the wrapped command

     

       115
       115
       +
           name = executableName;

     

       116
       116
       +
       

     

       117
       117
       +
           # additional libraries which are commonly needed for extensions

     

       118
       118
       +
           targetPkgs = pkgs: (with pkgs; [

     

       119
       119
       +
             # ld-linux-x86-64-linux.so.2 and others

     

       120
       120
       +
             glibc

     

       121
       121
       +
       

     

       122
       122
       +
             # dotnet

     

       123
       123
       +
             curl

     

       124
       124
       +
             icu

     

       125
       125
       +
             libunwind

     

       126
       126
       +
             libuuid

     

       127
       127
       +
             openssl

     

       128
       128
       +
             zlib

     

       129
       129
       +
       

     

       130
       130
       +
             # mono

     

       131
       131
       +
             krb5

     

       132
       132
       +
           ]) ++ additionalPkgs pkgs;

     

       133
       133
       +
       

     

       134
       134
       +
           # restore desktop item icons

     

       135
       135
       +
           extraInstallCommands = ''

     

       136
       136
       +
             mkdir -p $out/share/applications

     

       137
       137
       +
             for item in ${unwrapped}/share/applications/*.desktop; do

     

       138
       138
       +
               ln -s $item $out/share/applications/

     

       139
       139
       +
             done

     

       140
       140
       +
           '';

     

       141
       141
       +
       

     

       142
       142
       +
           runScript = "${unwrapped}/bin/${executableName}";

     

       143
       143
       +
       

     

       144
       144
       +
           # vscode likes to kill the parent so that the

     

       145
       145
       +
           # gui application isn't attached to the terminal session

     

       146
       146
       +
           dieWithParent = false;

     

       147
       147
       +
       

     

       148
       148
       +
           passthru = {

     

       149
       149
       +
             inherit executableName;

     

       150
       150
       +
             inherit (unwrapped) pname version; # for home-manager module

     

       151
       151
       +
           };

     

       152
       152
       +
       

     

       153
       153
       +
           meta = meta // {

     

       154
       154
       +
             description = ''

     

       155
       155
       +
               Wrapped variant of ${pname} which launches in a FHS compatible envrionment.

     

       156
       156
       +
               Should allow for easy usage of extensions without nix-specific modifications.

     

       157
       157
       +
             '';

     

       158
       158
       +
           };

     

       159
       159
       +
         };

     

       160
       160
       +
       in

     

       161
       161
       +
         unwrapped

     

       162
       162
       +

+3 -3

pkgs/applications/networking/cluster/kubelogin-oidc/default.nix

···

       2
       2
        
       

     

       3
       3
        
       buildGoModule rec {

     

       4
       4
        
         pname = "kubelogin";

     

       5
       5
       -
         version = "1.23.0";

     

       5
       5
       +
         version = "1.23.1";

     

       6
       6
        
       

     

       7
       7
        
         src = fetchFromGitHub {

     

       8
       8
        
           owner = "int128";

     

       9
       9
        
           repo = pname;

     

       10
       10
        
           rev = "v${version}";

     

       11
       11
       -
           sha256 = "0n94nx17c6ln2nd6d9yr93vc251y1xphq1wj2vzs4j2l8dqfyjpn";

     

       11
       11
       +
           sha256 = "sha256-YK/QGx6QzSeyeZ61KgdYO3POJQFK1F6yJayd2gcRWS4=";

     

       12
       12
        
         };

     

       13
       13
        
       

     

       14
       14
        
         subPackages = ["."];

     

       15
       15
        
       

     

       16
       16
       -
         vendorSha256 = "1dvrk6z6k66wawgb50n8hbgdd8fly399mlbgnvxi671vfi7lkz09";

     

       16
       16
       +
         vendorSha256 = "sha256-tnjgs8Ziqdo1ciVOWtL0D8puv2SZGqSHgo2SV7N8F0M=";

     

       17
       17
        
       

     

       18
       18
        
         # Rename the binary instead of symlinking to avoid conflict with the

     

       19
       19
        
         # Azure version of kubelogin

+10 -2

pkgs/build-support/build-fhs-userenv-bubblewrap/default.nix

···

       14
       14
        
       , unshareNet ? false

     

       15
       15
        
       , unshareUts ? true

     

       16
       16
        
       , unshareCgroup ? true

     

       17
       17
       +
       , dieWithParent ? true

     

       17
       18
        
       , ...

     

       18
       19
        
       }:

     

       19
       20
        
       

     
···

       22
       23
        
         buildFHSEnv = callPackage ./env.nix { };

     

       23
       24
        
       

     

       24
       25
        
         env = buildFHSEnv (removeAttrs args [

     

       25
       25
       -
           "runScript" "extraInstallCommands" "meta" "passthru"

     

       26
       26
       +
           "runScript" "extraInstallCommands" "meta" "passthru" "dieWithParent"

     

       26
       27
        
           "unshareUser" "unshareCgroup" "unshareUts" "unshareNet" "unsharePid" "unshareIpc"

     

       27
       28
        
         ]);

     

       28
       29
        
       

     
···

       30
       31
        
           files = [

     

       31
       32
        
             # NixOS Compatibility

     

       32
       33
        
             "static"

     

       34
       34
       +
             "nix" # mainly for nixUnstable users, but also for access to nix/netrc

     

       35
       35
       +
             # Shells

     

       36
       36
       +
             "bashrc"

     

       37
       37
       +
             "zshenv"

     

       38
       38
       +
             "zshrc"

     

       39
       39
       +
             "zinputrc"

     

       40
       40
       +
             "zprofile"

     

       33
       41
        
             # Users, Groups, NSS

     

       34
       42
        
             "passwd"

     

       35
       43
        
             "group"

     
···

       136
       144
        
             ${lib.optionalString unshareNet "--unshare-net"}

     

       137
       145
        
             ${lib.optionalString unshareUts "--unshare-uts"}

     

       138
       146
        
             ${lib.optionalString unshareCgroup "--unshare-cgroup"}

     

       139
       139
       -
             --die-with-parent

     

       147
       147
       +
             ${lib.optionalString dieWithParent "--die-with-parent"}

     

       140
       148
        
             --ro-bind /nix /nix

     

       141
       149
        
             # Our glibc will look for the cache in its own path in `/nix/store`.

     

       142
       150
        
             # As such, we need a cache to exist there, because pressure-vessel

+7 -3

pkgs/data/icons/tela-icon-theme/default.nix

···

       1
       1
       -
       { fetchFromGitHub, gtk3, hicolor-icon-theme, jdupes, lib, stdenv }:

     

       1
       1
       +
       { fetchFromGitHub, gtk3, hicolor-icon-theme, jdupes, lib, stdenvNoCC }:

     

       2
       2
        
       

     

       3
       3
       -
       stdenv.mkDerivation rec {

     

       3
       3
       +
       stdenvNoCC.mkDerivation rec {

     

       4
       4
        
         pname = "tela-icon-theme";

     

       5
       5
        
         version = "2021-01-21";

     

       6
       6
        
       

     
···

       17
       17
        
       

     

       18
       18
        
         dontDropIconThemeCache = true;

     

       19
       19
        
       

     

       20
       20
       +
         # These fixup steps are slow and unnecessary.

     

       21
       21
       +
         dontPatchELF = true;

     

       22
       22
       +
         dontRewriteSymlinks = true;

     

       23
       23
       +
       

     

       20
       24
        
         installPhase = ''

     

       21
       25
        
           runHook preInstall

     

       22
       26
        
       

     
···

       31
       35
        
         meta = with lib; {

     

       32
       36
        
           description = "A flat colorful Design icon theme";

     

       33
       37
        
           homepage = "https://github.com/vinceliuice/tela-icon-theme";

     

       34
       34
       -
           license = licenses.gpl3Plus;

     

       38
       38
       +
           license = licenses.gpl3Only;

     

       35
       39
        
           platforms = platforms.unix;

     

       36
       40
        
           maintainers = with maintainers; [ figsoda ];

     

       37
       41
        
         };

+6 -1

pkgs/development/libraries/py3c/default.nix

···

       11
       11
        
           sha256 = "04i2z7hrig78clc59q3i1z2hh24g7z1bfvxznlzxv00d4s57nhpi";

     

       12
       12
        
         };

     

       13
       13
        
       

     

       14
       14
       +
         postPatch = lib.optionalString stdenv.cc.isClang ''

     

       15
       15
       +
           substituteInPlace test/setup.py \

     

       16
       16
       +
             --replace "'-Werror', " ""

     

       17
       17
       +
         '';

     

       18
       18
       +
       

     

       14
       19
        
         makeFlags = [

     

       15
       20
        
           "prefix=${placeholder "out"}"

     

       16
       21
        
         ];

     
···

       26
       31
        
           homepage = "https://github.com/encukou/py3c";

     

       27
       32
        
           description = "Python 2/3 compatibility layer for C extensions";

     

       28
       33
        
           license = licenses.mit;

     

       29
       29
       -
           maintainers = with maintainers; [ ajs124 ];

     

       34
       34
       +
           maintainers = with maintainers; [ ajs124 dotlambda ];

     

       30
       35
        
         };

     

       31
       36
        
       }

+2 -2

pkgs/development/python-modules/csvw/default.nix

···

       14
       14
        
       

     

       15
       15
        
       buildPythonPackage rec {

     

       16
       16
        
         pname = "csvw";

     

       17
       17
       -
         version = "1.10.1";

     

       17
       17
       +
         version = "1.10.2";

     

       18
       18
        
         disabled = isPy27;

     

       19
       19
        
       

     

       20
       20
        
         src = fetchFromGitHub {

     

       21
       21
        
           owner = "cldf";

     

       22
       22
        
           repo = "csvw";

     

       23
       23
        
           rev = "v${version}";

     

       24
       24
       -
           sha256 = "1764nfa4frjdd7v6wj35y7prnciaqz57wwygy5zfavl4laxn4nxd";

     

       24
       24
       +
           sha256 = "0z0qxlsfxwz1qapxb4d0mz3wkj99d7zi9yrg1cbd2xp7giagb6d4";

     

       25
       25
        
         };

     

       26
       26
        
       

     

       27
       27
        
         patchPhase = ''

+7 -4

pkgs/tools/graphics/pngquant/default.nix

···

       2
       2
        
       

     

       3
       3
        
       stdenv.mkDerivation rec {

     

       4
       4
        
         pname = "pngquant";

     

       5
       5
       -
         version = "2.12.5";

     

       5
       5
       +
         version = "2.14.1";

     

       6
       6
        
       

     

       7
       7
        
         src = fetchFromGitHub {

     

       8
       8
       -
           owner = "pornel";

     

       8
       8
       +
           owner = "kornelski";

     

       9
       9
        
           repo = "pngquant";

     

       10
       10
        
           rev = version;

     

       11
       11
       -
           sha256 = "0sq398iv5cacblz6pb4j2hn16cnszsbkahikdpfq84rb9bj0ya40";

     

       11
       11
       +
           sha256 = "054hi33qp3jc7hv0141wi8drwdg24v5zfp8znwjmz4mcdls8vxbb";

     

       12
       12
        
           fetchSubmodules = true;

     

       13
       13
        
         };

     

       14
       14
        
       

     
···

       17
       17
        
         nativeBuildInputs = [ pkg-config ];

     

       18
       18
        
         buildInputs = [ libpng zlib lcms2 ];

     

       19
       19
        
       

     

       20
       20
       +
         doCheck = true;

     

       21
       21
       +
       

     

       20
       22
        
         meta = with lib; {

     

       21
       23
        
           homepage = "https://pngquant.org/";

     

       22
       24
        
           description = "A tool to convert 24/32-bit RGBA PNGs to 8-bit palette with alpha channel preserved";

     

       25
       25
       +
           changelog = "https://github.com/kornelski/pngquant/raw/${version}/CHANGELOG";

     

       23
       26
        
           platforms = platforms.unix;

     

       24
       24
       -
           license = licenses.gpl3;

     

       27
       27
       +
           license = with licenses; [ gpl3Plus hpnd bsd2 ];

     

       25
       28
        
           maintainers = [ maintainers.volth ];

     

       26
       29
        
         };

     

       27
       30
        
       }

+5 -1

pkgs/top-level/all-packages.nix

···

       26636
       26636
        
       

     

       26637
       26637
        
         gnvim = callPackage ../applications/editors/neovim/gnvim/wrapper.nix { };

     

       26638
       26638
        
       

     

       26639
       26639
       -
         neovim-remote = callPackage ../applications/editors/neovim/neovim-remote.nix { pythonPackages = python3Packages; };

     

       26639
       26639
       +
         neovim-remote = callPackage ../applications/editors/neovim/neovim-remote.nix { };

     

       26640
       26640
        
       

     

       26641
       26641
        
         vis = callPackage ../applications/editors/vis {

     

       26642
       26642
        
           inherit (lua52Packages) lpeg;

     
···

       26754
       26754
        
         };

     

       26755
       26755
        
       

     

       26756
       26756
        
         vscode = callPackage ../applications/editors/vscode/vscode.nix { };

     

       26757
       26757
       +
         vscode-fhs = vscode.fhs;

     

       26758
       26758
       +
         vscode-fhsWithPackages = vscode.fhsWithPackages;

     

       26757
       26759
        
       

     

       26758
       26760
        
         vscode-with-extensions = callPackage ../applications/editors/vscode/with-extensions.nix {};

     

       26759
       26761
        
       

     
···

       26762
       26764
        
         vscode-extensions = recurseIntoAttrs (callPackage ../misc/vscode-extensions {});

     

       26763
       26765
        
       

     

       26764
       26766
        
         vscodium = callPackage ../applications/editors/vscode/vscodium.nix { };

     

       26767
       26767
       +
         vscodium-fhs = vscodium.fhs;

     

       26768
       26768
       +
         vscodium-fhsWithPackages = vscodium.fhsWithPackages;

     

       26765
       26769
        
       

     

       26766
       26770
        
         code-server = callPackage ../servers/code-server {

     

       26767
       26771
        
           inherit (darwin.apple_sdk.frameworks) AppKit Cocoa Security;