commit b8aa4aa6aa857c24a44b09d9978db4d3d248e001 · pyrox.dev/nixpkgs

maintainers/maintainer-list.nix

···

       6912
       6912
        
           githubId = 934284;

     

       6913
       6913
        
           name = "Rouven Czerwinski";

     

       6914
       6914
        
         };

     

       6915
       6915
       +
         EmanuelM153 = {

     

       6916
       6916
       +
           name = "Emanuel";

     

       6917
       6917
       +
           github = "EmanuelM153";

     

       6918
       6918
       +
           githubId = 134736553;

     

       6919
       6919
       +
         };

     

       6915
       6920
        
         emattiza = {

     

       6916
       6921
        
           email = "nix@mattiza.dev";

     

       6917
       6922
        
           github = "emattiza";

+79 -90

nixos/modules/security/acme/default.nix

···

       15
       15
        
         mkAccountHash = acmeServer: data: mkHash "${toString acmeServer} ${data.keyType} ${data.email}";

     

       16
       16
        
         accountDirRoot = "/var/lib/acme/.lego/accounts/";

     

       17
       17
        
       

     

       18
       18
       +
         # Lockdir is acme-setup.service's RuntimeDirectory.

     

       19
       19
       +
         # Since that service is a oneshot with RemainAfterExit,

     

       20
       20
       +
         # the folder will exist during all renewal services.

     

       18
       21
        
         lockdir = "/run/acme/";

     

       19
       22
        
         concurrencyLockfiles = map (n: "${toString n}.lock") (lib.range 1 cfg.maxConcurrentRenewals);

     

       20
       23
        
         # Assign elements of `baseList` to each element of `needAssignmentList`, until the latter is exhausted.

     
···

       104
       107
        
           ];

     

       105
       108
        
         };

     

       106
       109
        
       

     

       107
       107
       -
         # In order to avoid race conditions creating the CA for selfsigned certs,

     

       108
       108
       -
         # we have a separate service which will create the necessary files.

     

       109
       109
       -
         selfsignCAService = {

     

       110
       110
       -
           description = "Generate self-signed certificate authority";

     

       111
       111
       -
       

     

       112
       112
       -
           path = with pkgs; [ minica ];

     

       113
       113
       -
       

     

       114
       114
       -
           unitConfig = {

     

       115
       115
       -
             ConditionPathExists = "!/var/lib/acme/.minica/key.pem";

     

       116
       116
       -
             StartLimitIntervalSec = 0;

     

       117
       117
       -
           };

     

       118
       118
       -
       

     

       119
       119
       -
           serviceConfig = commonServiceConfig // {

     

       120
       120
       -
             StateDirectory = "acme/.minica";

     

       121
       121
       -
             BindPaths = "/var/lib/acme/.minica:/tmp/ca";

     

       122
       122
       -
             UMask = "0077";

     

       123
       123
       -
           };

     

       124
       124
       -
       

     

       125
       125
       -
           # Working directory will be /tmp

     

       126
       126
       -
           script = ''

     

       127
       127
       -
             minica \

     

       128
       128
       -
               --ca-key ca/key.pem \

     

       129
       129
       -
               --ca-cert ca/cert.pem \

     

       130
       130
       -
               --domains selfsigned.local

     

       131
       131
       -
           '';

     

       132
       132
       -
         };

     

       133
       133
       -
       

     

       134
       110
        
         # Ensures that directories which are shared across all certs

     

       135
       111
        
         # exist and have the correct user and group, since group

     

       136
       112
        
         # is configurable on a per-cert basis.

     

       137
       137
       -
         userMigrationService = let

     

       138
       138
       -
           script = with builtins; ''

     

       113
       113
       +
         # writeShellScriptBin is used as it produces a nicer binary name, which

     

       114
       114
       +
         # journalctl will show when the service is running.

     

       115
       115
       +
         privilegedSetupScript = pkgs.writeShellScriptBin "acme-setup-privileged" (

     

       116
       116
       +
           ''

     

       117
       117
       +
             ${lib.optionalString cfg.defaults.enableDebugLogs "set -x"}

     

       118
       118
       +
             set -euo pipefail

     

       119
       119
       +
             cd /var/lib/acme

     

       120
       120
       +
             chmod -R u=rwX,g=,o= .lego/accounts

     

       139
       121
        
             chown -R ${user} .lego/accounts

     

       140
       122
        
           '' + (lib.concatStringsSep "\n" (lib.mapAttrsToList (cert: data: ''

     

       141
       123
        
             for fixpath in ${lib.escapeShellArg cert} .lego/${lib.escapeShellArg cert}; do

     
···

       144
       126
        
                 chown -R ${user}:${data.group} "$fixpath"

     

       145
       127
        
               fi

     

       146
       128
        
             done

     

       147
       147
       -
           '') certConfigs));

     

       148
       148
       -
         in {

     

       149
       149
       -
           description = "Fix owner and group of all ACME certificates";

     

       129
       129
       +
           '') certConfigs))

     

       130
       130
       +
         );

     

       150
       131
        
       

     

       151
       151
       -
           serviceConfig = commonServiceConfig // {

     

       152
       152
       -
             # We don't want this to run every time a renewal happens

     

       153
       153
       -
             RemainAfterExit = true;

     

       132
       132
       +
         # This is defined with lib.mkMerge so that we can separate the config per function.

     

       133
       133
       +
         setupService = lib.mkMerge [

     

       134
       134
       +
           {

     

       135
       135
       +
             description = "Set up the ACME certificate renewal infrastructure";

     

       136
       136
       +
             script = lib.mkBefore ''

     

       137
       137
       +
               ${lib.optionalString cfg.defaults.enableDebugLogs "set -x"}

     

       138
       138
       +
               set -euo pipefail

     

       139
       139
       +
             '';

     

       140
       140
       +
             serviceConfig = commonServiceConfig // {

     

       141
       141
       +
               # This script runs with elevated privileges, denoted by the +

     

       142
       142
       +
               # ExecStartPre is used instead of ExecStart so that the `script` continues to work.

     

       143
       143
       +
               ExecStartPre = "+${lib.getExe privilegedSetupScript}";

     

       154
       144
        
       

     

       155
       155
       -
             # StateDirectory entries are a cleaner, service-level mechanism

     

       156
       156
       -
             # for dealing with persistent service data

     

       157
       157
       -
             StateDirectory = [ "acme" "acme/.lego" "acme/.lego/accounts" ];

     

       158
       158
       -
             StateDirectoryMode = 755;

     

       159
       159
       -
             WorkingDirectory = "/var/lib/acme";

     

       145
       145
       +
               # We don't want this to run every time a renewal happens

     

       146
       146
       +
               RemainAfterExit = true;

     

       160
       147
        
       

     

       161
       161
       -
             # Run the start script as root

     

       162
       162
       -
             ExecStart = "+" + (pkgs.writeShellScript "acme-fixperms" script);

     

       163
       163
       -
           };

     

       164
       164
       -
         };

     

       165
       165
       -
         lockfilePrepareService = {

     

       166
       166
       -
           description = "Manage lock files for acme services";

     

       148
       148
       +
               # StateDirectory entries are a cleaner, service-level mechanism

     

       149
       149
       +
               # for dealing with persistent service data

     

       150
       150
       +
               StateDirectory = [ "acme" "acme/.lego" "acme/.lego/accounts" ];

     

       151
       151
       +
               StateDirectoryMode = "0755";

     

       167
       152
        
       

     

       168
       168
       -
           # ensure all required lock files exist, but none more

     

       169
       169
       -
           script = ''

     

       170
       170
       -
             GLOBIGNORE="${lib.concatStringsSep ":" concurrencyLockfiles}"

     

       171
       171
       -
             rm -f -- *

     

       172
       172
       -
             unset GLOBIGNORE

     

       153
       153
       +
               # Creates ${lockdir}. Earlier RemainAfterExit=true means

     

       154
       154
       +
               # it does not get deleted immediately.

     

       155
       155
       +
               RuntimeDirectory = "acme";

     

       156
       156
       +
               RuntimeDirectoryMode = "0700";

     

       173
       157
        
       

     

       174
       174
       -
             xargs touch <<< "${toString concurrencyLockfiles}"

     

       175
       175
       -
           '';

     

       176
       176
       -
       

     

       177
       177
       -
           serviceConfig = commonServiceConfig // {

     

       178
       178
       -
             # We don't want this to run every time a renewal happens

     

       179
       179
       -
             RemainAfterExit = true;

     

       180
       180
       -
             WorkingDirectory = lockdir;

     

       181
       181
       -
           };

     

       182
       182
       -
         };

     

       158
       158
       +
               # Generally, we don't write anything that should be group accessible.

     

       159
       159
       +
               # Group varies for most ACME units, and setup files are only used

     

       160
       160
       +
               # under the acme user.

     

       161
       161
       +
               UMask = "0077";

     

       162
       162
       +
             };

     

       163
       163
       +
           }

     

       183
       164
        
       

     

       165
       165
       +
           # Avoid race conditions creating the CA for selfsigned certs

     

       166
       166
       +
           (lib.mkIf cfg.preliminarySelfsigned {

     

       167
       167
       +
             path = [ pkgs.minica ];

     

       168
       168
       +
             # Working directory will be /tmp

     

       169
       169
       +
             script = ''

     

       170
       170
       +
               test -e ca/key.pem || minica \

     

       171
       171
       +
                 --ca-key ca/key.pem \

     

       172
       172
       +
                 --ca-cert ca/cert.pem \

     

       173
       173
       +
                 --domains selfsigned.local

     

       174
       174
       +
             '';

     

       175
       175
       +
             serviceConfig = {

     

       176
       176
       +
               StateDirectory = [ "acme/.minica" ];

     

       177
       177
       +
               BindPaths = "/var/lib/acme/.minica:/tmp/ca";

     

       178
       178
       +
             };

     

       179
       179
       +
           })

     

       180
       180
       +
         ];

     

       184
       181
        
       

     

       185
       182
        
         certToConfig = cert: data: let

     

       186
       183
        
           acmeServer = data.server;

     
···

       286
       283
        
       

     

       287
       284
        
           selfsignService = lockfileName: {

     

       288
       285
        
             description = "Generate self-signed certificate for ${cert}";

     

       289
       289
       -
             after = [ "acme-selfsigned-ca.service" "acme-fixperms.service" ] ++ lib.optional (cfg.maxConcurrentRenewals > 0) "acme-lockfiles.service";

     

       290
       290
       -
             requires = [ "acme-selfsigned-ca.service" "acme-fixperms.service" ] ++ lib.optional (cfg.maxConcurrentRenewals > 0) "acme-lockfiles.service";

     

       286
       286
       +
             after = [ "acme-setup.service" ];

     

       287
       287
       +
             requires = [ "acme-setup.service" ];

     

       291
       288
        
       

     

       292
       292
       -
             path = with pkgs; [ minica ];

     

       289
       289
       +
             path = [ pkgs.minica ];

     

       293
       290
        
       

     

       294
       291
        
             unitConfig = {

     

       295
       292
        
               ConditionPathExists = "!/var/lib/acme/${cert}/key.pem";

     
···

       334
       331
        
       

     

       335
       332
        
           renewService = lockfileName: {

     

       336
       333
        
             description = "Renew ACME certificate for ${cert}";

     

       337
       337
       -
             after = [ "network.target" "network-online.target" "acme-fixperms.service" "nss-lookup.target" ] ++ selfsignedDeps ++ lib.optional (cfg.maxConcurrentRenewals > 0) "acme-lockfiles.service";

     

       338
       338
       -
             wants = [ "network-online.target" "acme-fixperms.service" ] ++ selfsignedDeps ++ lib.optional (cfg.maxConcurrentRenewals > 0) "acme-lockfiles.service";

     

       334
       334
       +
             after = [ "network.target" "network-online.target" "acme-setup.service" "nss-lookup.target" ] ++ selfsignedDeps;

     

       335
       335
       +
             wants = [ "network-online.target" ] ++ selfsignedDeps;

     

       336
       336
       +
             requires = [ "acme-setup.service" ];

     

       339
       337
        
       

     

       340
       338
        
             # https://github.com/NixOS/nixpkgs/pull/81371#issuecomment-605526099

     

       341
       339
        
             wantedBy = lib.optionals (!config.boot.isContainer) [ "multi-user.target" ];

     
···

       484
       482
        
               # By default group will have no access to the cert files.

     

       485
       483
        
               # This chmod will fix that.

     

       486
       484
        
               chmod 640 out/*

     

       485
       485
       +
       

     

       486
       486
       +
               # Also ensure safer permissions on the account directory.

     

       487
       487
       +
               chmod -R u=rwX,g=,o= accounts/.

     

       487
       488
        
             '';

     

       488
       489
        
           };

     

       489
       490
        
         };

     
···

       601
       602
        
               '';

     

       602
       603
        
             };

     

       603
       604
        
       

     

       605
       605
       +
             listenHTTP = lib.mkOption {

     

       606
       606
       +
               type = lib.types.nullOr lib.types.str;

     

       607
       607
       +
               inherit (defaultAndText "listenHTTP" null) default defaultText;

     

       608
       608
       +
               example = ":1360";

     

       609
       609
       +
               description = ''

     

       610
       610
       +
                 Interface and port to listen on to solve HTTP challenges

     

       611
       611
       +
                 in the form `[INTERFACE]:PORT`.

     

       612
       612
       +
                 If you use a port other than 80, you must proxy port 80 to this port.

     

       613
       613
       +
               '';

     

       614
       614
       +
             };

     

       615
       615
       +
       

     

       604
       616
        
             dnsProvider = lib.mkOption {

     

       605
       617
        
               type = lib.types.nullOr lib.types.str;

     

       606
       618
        
               inherit (defaultAndText "dnsProvider" null) default defaultText;

     
···

       746
       758
        
               '';

     

       747
       759
        
             };

     

       748
       760
        
       

     

       749
       749
       -
             # This setting must be different for each configured certificate, otherwise

     

       750
       750
       -
             # two or more renewals may fail to bind to the address. Hence, it is not in

     

       751
       751
       -
             # the inheritableOpts.

     

       752
       752
       -
             listenHTTP = lib.mkOption {

     

       753
       753
       -
               type = lib.types.nullOr lib.types.str;

     

       754
       754
       -
               default = null;

     

       755
       755
       -
               example = ":1360";

     

       756
       756
       -
               description = ''

     

       757
       757
       -
                 Interface and port to listen on to solve HTTP challenges

     

       758
       758
       -
                 in the form [INTERFACE]:PORT.

     

       759
       759
       -
                 If you use a port other than 80, you must proxy port 80 to this port.

     

       760
       760
       -
               '';

     

       761
       761
       -
             };

     

       762
       762
       -
       

     

       763
       761
        
             s3Bucket = lib.mkOption {

     

       764
       762
        
               type = lib.types.nullOr lib.types.str;

     

       765
       763
        
               default = null;

     
···

       974
       972
        
       

     

       975
       973
        
             users.groups.acme = {};

     

       976
       974
        
       

     

       977
       977
       -
             # for lock files, still use tmpfiles as they should better reside in /run

     

       978
       978
       -
             systemd.tmpfiles.rules = [

     

       979
       979
       -
               "d ${lockdir} 0700 ${user} - - -"

     

       980
       980
       -
               "Z ${lockdir} 0700 ${user} - - -"

     

       981
       981
       -
             ];

     

       982
       982
       -
       

     

       983
       975
        
             systemd.services = let

     

       984
       976
        
               renewServiceFunctions = lib.mapAttrs' (cert: conf: lib.nameValuePair "acme-${cert}" conf.renewService) certConfigs;

     

       985
       977
        
               renewServices =  if cfg.maxConcurrentRenewals > 0

     
···

       990
       982
        
                 then roundRobinApplyAttrs selfsignServiceFunctions concurrencyLockfiles

     

       991
       983
        
                 else lib.mapAttrs (_: f: f null) selfsignServiceFunctions;

     

       992
       984
        
               in

     

       993
       993
       -
               { "acme-fixperms" = userMigrationService; }

     

       994
       994
       -
               // (lib.optionalAttrs (cfg.maxConcurrentRenewals > 0) {"acme-lockfiles" = lockfilePrepareService; })

     

       985
       985
       +
               { acme-setup = setupService; }

     

       995
       986
        
               // renewServices

     

       996
       996
       -
               // (lib.optionalAttrs (cfg.preliminarySelfsigned) ({

     

       997
       997
       -
               "acme-selfsigned-ca" = selfsignCAService;

     

       998
       998
       -
             } // selfsignServices));

     

       987
       987
       +
               // lib.optionalAttrs cfg.preliminarySelfsigned selfsignServices;

     

       999
       988
        
       

     

       1000
       989
        
             systemd.timers = lib.mapAttrs' (cert: conf: lib.nameValuePair "acme-${cert}" conf.renewTimer) certConfigs;

     

       1001
       990

+46

nixos/modules/services/web-servers/h2o/common.nix

···

       1
       1
       +
       { lib }:

     

       2
       2
       +
       {

     

       3
       3
       +
         tlsRecommendationsOption = lib.mkOption {

     

       4
       4
       +
           type = lib.types.nullOr (

     

       5
       5
       +
             lib.types.enum [

     

       6
       6
       +
               "modern"

     

       7
       7
       +
               "intermediate"

     

       8
       8
       +
               "old"

     

       9
       9
       +
             ]

     

       10
       10
       +
           );

     

       11
       11
       +
           default = null;

     

       12
       12
       +
           example = "intermediate";

     

       13
       13
       +
           description = ''

     

       14
       14
       +
             By default, H2O, without prejudice, will use as many TLS versions &

     

       15
       15
       +
             cipher suites as it & the TLS library (OpenSSL) can support. The user is

     

       16
       16
       +
             expected to hone settings for the security of their server. Setting some

     

       17
       17
       +
             constraints is recommended, & if unsure about what TLS settings to use,

     

       18
       18
       +
             this option gives curated TLS settings recommendations from Mozilla’s

     

       19
       19
       +
             ‘SSL Configuration Generator’ project (see

     

       20
       20
       +
             <https://ssl-config.mozilla.org>) or read more at Mozilla’s Wiki (see

     

       21
       21
       +
             <https://wiki.mozilla.org/Security/Server_Side_TLS>).

     

       22
       22
       +
       

     

       23
       23
       +
             modern

     

       24
       24
       +
             : Services with clients that support TLS 1.3 & don’t need backward

     

       25
       25
       +
               compatibility

     

       26
       26
       +
       

     

       27
       27
       +
             intermediate

     

       28
       28
       +
             : General-purpose servers with a variety of clients, recommended for

     

       29
       29
       +
               almost all systems

     

       30
       30
       +
       

     

       31
       31
       +
             old

     

       32
       32
       +
             : Compatible with a number of very old clients, & should be used only as

     

       33
       33
       +
               a last resort

     

       34
       34
       +
       

     

       35
       35
       +
             The default for all virtual hosts can be set with

     

       36
       36
       +
             services.h2o.defaultTLSRecommendations, but this value can be overridden

     

       37
       37
       +
             on a per-host basis using services.h2o.hosts.<name>.tls.recommmendations.

     

       38
       38
       +
             The settings will also be overidden by manual values set with

     

       39
       39
       +
             services.settings.h2o.hosts.<name>.tls.extraSettings.

     

       40
       40
       +
       

     

       41
       41
       +
             NOTE: older/weaker ciphers might require overriding the OpenSSL version

     

       42
       42
       +
             of H2O (such as `openssl_legacy`). This can be done with

     

       43
       43
       +
             sevices.settings.h2o.package.

     

       44
       44
       +
           '';

     

       45
       45
       +
         };

     

       46
       46
       +
       }

+111 -28

nixos/modules/services/web-servers/h2o/default.nix

···

       6
       6
        
       }:

     

       7
       7
        
       

     

       8
       8
        
       # TODO: Gems includes for Mruby

     

       9
       9
       -
       # TODO: Recommended options

     

       10
       9
        
       let

     

       11
       10
        
         cfg = config.services.h2o;

     

       12
       11
        
         inherit (config.security.acme) certs;

     
···

       21
       20
        
           ;

     

       22
       21
        
       

     

       23
       22
        
         mkCertOwnershipAssertion = import ../../../security/acme/mk-cert-ownership-assertion.nix lib;

     

       23
       23
       +
       

     

       24
       24
       +
         inherit (import ./common.nix { inherit lib; }) tlsRecommendationsOption;

     

       24
       25
        
       

     

       25
       26
        
         settingsFormat = pkgs.formats.yaml { };

     

       26
       27
        
       

     
···

       76
       77
        
             all = certNames'.dependent ++ certNames'.independent;

     

       77
       78
        
           };

     

       78
       79
        
       

     

       80
       80
       +
         mozTLSRecs =

     

       81
       81
       +
           if cfg.defaultTLSRecommendations != null then

     

       82
       82
       +
             let

     

       83
       83
       +
               # NOTE: if updating, *do* verify the changes then adjust ciphers &

     

       84
       84
       +
               # other settings with the tests @

     

       85
       85
       +
               # `nixos/tests/web-servers/h2o/tls-recommendations.nix`

     

       86
       86
       +
               # & run with `nix-build -A nixosTests.h2o.tls-recommendations`

     

       87
       87
       +
               version = "5.7";

     

       88
       88
       +
               git_tag = "v5.7.1";

     

       89
       89
       +
               guidelinesJSON =

     

       90
       90
       +
                 lib.pipe

     

       91
       91
       +
                   {

     

       92
       92
       +
                     urls = [

     

       93
       93
       +
                       "https://ssl-config.mozilla.org/guidelines/${version}.json"

     

       94
       94
       +
                       "https://raw.githubusercontent.com/mozilla/ssl-config-generator/refs/tags/${git_tag}/src/static/guidelines/${version}.json"

     

       95
       95
       +
                     ];

     

       96
       96
       +
                     sha256 = "sha256:1mj2pcb1hg7q2wpgdq3ac8pc2q64wvwvwlkb9xjmdd9jm4hiyny7";

     

       97
       97
       +
                   }

     

       98
       98
       +
                   [

     

       99
       99
       +
                     pkgs.fetchurl

     

       100
       100
       +
                     builtins.readFile

     

       101
       101
       +
                     builtins.fromJSON

     

       102
       102
       +
                   ];

     

       103
       103
       +
             in

     

       104
       104
       +
             guidelinesJSON.configurations

     

       105
       105
       +
           else

     

       106
       106
       +
             null;

     

       107
       107
       +
       

     

       79
       108
        
         hostsConfig = lib.concatMapAttrs (

     

       80
       109
        
           name: value:

     

       81
       110
        
           let

     
···

       130
       159
        
                   ]

     

       131
       160
        
                 )

     

       132
       161
        
                 {

     

       133
       133
       -
                   "${names.server}:${builtins.toString port.TLS}" = value.settings // {

     

       134
       134
       -
                     listen =

     

       135
       135
       -
                       let

     

       136
       136
       -
                         identity =

     

       137
       137
       -
                           value.tls.identity

     

       138
       138
       -
                           ++ lib.optional (builtins.elem names.cert certNames.all) {

     

       139
       139
       -
                             key-file = "${certs.${names.cert}.directory}/key.pem";

     

       140
       140
       -
                             certificate-file = "${certs.${names.cert}.directory}/fullchain.pem";

     

       162
       162
       +
                   "${names.server}:${builtins.toString port.TLS}" =

     

       163
       163
       +
                     let

     

       164
       164
       +
                       tlsRecommendations = lib.attrByPath [ "tls" "recommendations" ] cfg.defaultTLSRecommendations value;

     

       165
       165
       +
       

     

       166
       166
       +
                       hasTLSRecommendations = tlsRecommendations != null && mozTLSRecs != null;

     

       167
       167
       +
       

     

       168
       168
       +
                       # NOTE: Let’s Encrypt has sunset OCSP stapling. Mozilla’s

     

       169
       169
       +
                       # ssl-config-generator is at present still recommending this setting, but

     

       170
       170
       +
                       # this module will skip setting a stapling value as Let’s Encrypt +

     

       171
       171
       +
                       # ACME is the most likely use case.

     

       172
       172
       +
                       #

     

       173
       173
       +
                       # See: https://github.com/mozilla/ssl-config-generator/issues/323

     

       174
       174
       +
                       tlsRecAttrs = lib.optionalAttrs hasTLSRecommendations (

     

       175
       175
       +
                         let

     

       176
       176
       +
                           recs = mozTLSRecs.${tlsRecommendations};

     

       177
       177
       +
                         in

     

       178
       178
       +
                         {

     

       179
       179
       +
                           min-version = builtins.head recs.tls_versions;

     

       180
       180
       +
                           cipher-preference = "server";

     

       181
       181
       +
                           "cipher-suite-tls1.3" = recs.ciphersuites;

     

       182
       182
       +
                         }

     

       183
       183
       +
                         // lib.optionalAttrs (recs.ciphers.openssl != [ ]) {

     

       184
       184
       +
                           cipher-suite = lib.concatStringsSep ":" recs.ciphers.openssl;

     

       185
       185
       +
                         }

     

       186
       186
       +
                       );

     

       187
       187
       +
       

     

       188
       188
       +
                       headerRecAttrs =

     

       189
       189
       +
                         lib.optionalAttrs

     

       190
       190
       +
                           (

     

       191
       191
       +
                             hasTLSRecommendations

     

       192
       192
       +
                             && value.tls != null

     

       193
       193
       +
                             && builtins.elem value.tls.policy [

     

       194
       194
       +
                               "force"

     

       195
       195
       +
                               "only"

     

       196
       196
       +
                             ]

     

       197
       197
       +
                           )

     

       198
       198
       +
                           (

     

       199
       199
       +
                             let

     

       200
       200
       +
                               headerSet = value.settings."header.set" or [ ];

     

       201
       201
       +
                               recs = mozTLSRecs.${tlsRecommendations};

     

       202
       202
       +
                               hsts = "Strict-Transport-Security: max-age=${builtins.toString recs.hsts_min_age}; includeSubDomains; preload";

     

       203
       203
       +
                             in

     

       204
       204
       +
                             {

     

       205
       205
       +
                               "header.set" =

     

       206
       206
       +
                                 if builtins.isString headerSet then

     

       207
       207
       +
                                   [

     

       208
       208
       +
                                     headerSet

     

       209
       209
       +
                                     hsts

     

       210
       210
       +
                                   ]

     

       211
       211
       +
                                 else

     

       212
       212
       +
                                   headerSet ++ [ hsts ];

     

       213
       213
       +
                             }

     

       214
       214
       +
                           );

     

       215
       215
       +
                     in

     

       216
       216
       +
                     value.settings

     

       217
       217
       +
                     // headerRecAttrs

     

       218
       218
       +
                     // {

     

       219
       219
       +
                       listen =

     

       220
       220
       +
                         let

     

       221
       221
       +
                           identity =

     

       222
       222
       +
                             value.tls.identity

     

       223
       223
       +
                             ++ lib.optional (builtins.elem names.cert certNames.all) {

     

       224
       224
       +
                               key-file = "${certs.${names.cert}.directory}/key.pem";

     

       225
       225
       +
                               certificate-file = "${certs.${names.cert}.directory}/fullchain.pem";

     

       226
       226
       +
                             };

     

       227
       227
       +
                         in

     

       228
       228
       +
                         {

     

       229
       229
       +
                           port = port.TLS;

     

       230
       230
       +
                           ssl = (lib.recursiveUpdate tlsRecAttrs value.tls.extraSettings) // {

     

       231
       231
       +
                             inherit identity;

     

       141
       232
        
                           };

     

       142
       142
       -
                       in

     

       143
       143
       -
                       {

     

       144
       144
       -
                         port = port.TLS;

     

       145
       145
       -
                         ssl = value.tls.extraSettings // {

     

       146
       146
       -
                           inherit identity;

     

       147
       233
        
                         };

     

       148
       148
       -
                       };

     

       149
       149
       -
                   };

     

       234
       234
       +
                     };

     

       150
       235
        
                 };

     

       151
       236
        
           in

     

       152
       237
        
           # With a high likelihood of HTTP & ACME challenges being on the same port,

     
···

       184
       269
        
             };

     

       185
       270
        
       

     

       186
       271
        
             package = lib.mkPackageOption pkgs "h2o" {

     

       187
       187
       -
               example = ''

     

       188
       188
       -
                 pkgs.h2o.override {

     

       189
       189
       -
                   withMruby = false;

     

       190
       190
       -
                 };

     

       191
       191
       -
               '';

     

       272
       272
       +
               example = # nix

     

       273
       273
       +
                 ''

     

       274
       274
       +
                   pkgs.h2o.override {

     

       275
       275
       +
                     withMruby = false;

     

       276
       276
       +
                     openssl = pkgs.openssl_legacy;

     

       277
       277
       +
                   }

     

       278
       278
       +
                 '';

     

       192
       279
        
             };

     

       193
       280
        
       

     

       194
       281
        
             defaultHTTPListenPort = mkOption {

     
···

       209
       296
        
               example = 8443;

     

       210
       297
        
             };

     

       211
       298
        
       

     

       299
       299
       +
             defaultTLSRecommendations = tlsRecommendationsOption;

     

       300
       300
       +
       

     

       212
       301
        
             settings = mkOption {

     

       213
       302
        
               type = settingsFormat.type;

     

       214
       303
        
               default = { };

     
···

       216
       305
        
             };

     

       217
       306
        
       

     

       218
       307
        
             hosts = mkOption {

     

       219
       219
       -
               type = types.attrsOf (

     

       220
       220
       -
                 types.submodule (

     

       221
       221
       -
                   import ./vhost-options.nix {

     

       222
       222
       -
                     inherit config lib;

     

       223
       223
       -
                   }

     

       224
       224
       -
                 )

     

       225
       225
       -
               );

     

       308
       308
       +
               type = types.attrsOf (types.submodule (import ./vhost-options.nix { inherit config lib; }));

     

       226
       309
        
               default = { };

     

       227
       310
        
               description = ''

     

       228
       311
        
                 The `hosts` config to be merged with the settings.

+9 -1

nixos/modules/services/web-servers/h2o/vhost-options.nix

···

       1
       1
       -
       { config, lib, ... }:

     

       1
       1
       +
       {

     

       2
       2
       +
         config,

     

       3
       3
       +
         lib,

     

       4
       4
       +
         ...

     

       5
       5
       +
       }:

     

       2
       6
        
       

     

       3
       7
        
       let

     

       4
       8
        
         inherit (lib)

     
···

       6
       10
        
           mkOption

     

       7
       11
        
           types

     

       8
       12
        
           ;

     

       13
       13
       +
       

     

       14
       14
       +
         inherit (import ./common.nix { inherit lib; }) tlsRecommendationsOption;

     

       9
       15
        
       in

     

       10
       16
        
       {

     

       11
       17
        
         options = {

     
···

       128
       134
        
                           ]

     

       129
       135
        
                         '';

     

       130
       136
        
                   };

     

       137
       137
       +
                   recommendations = tlsRecommendationsOption;

     

       131
       138
        
                   extraSettings = mkOption {

     

       132
       139
        
                     type = types.attrs;

     

       133
       140
        
                     default = { };

     
···

       195
       202
        
       

     

       196
       203
        
           settings = mkOption {

     

       197
       204
        
             type = types.attrs;

     

       205
       205
       +
             default = { };

     

       198
       206
        
             description = ''

     

       199
       207
        
               Attrset to be transformed into YAML for host config. Note that the HTTP

     

       200
       208
        
               / TLS configurations will override these config values.

+2 -1

nixos/release-combined.nix

···

       75
       75
        
               (onFullSupported "nixos.iso_gnome")

     

       76
       76
        
               (onFullSupported "nixos.manual")

     

       77
       77
        
               (onSystems [ "aarch64-linux" ] "nixos.sd_image")

     

       78
       78
       -
               (onFullSupported "nixos.tests.acme")

     

       78
       78
       +
               (onFullSupported "nixos.tests.acme.http01-builtin")

     

       79
       79
       +
               (onFullSupported "nixos.tests.acme.dns01")

     

       79
       80
        
               (onSystems [ "x86_64-linux" ] "nixos.tests.boot.biosCdrom")

     

       80
       81
        
               (onSystems [ "x86_64-linux" ] "nixos.tests.boot.biosUsb")

     

       81
       82
        
               (onFullSupported "nixos.tests.boot-stage1")

+8 -2

nixos/release-small.nix

···

       48
       48
        
             dummy

     

       49
       49
        
             ;

     

       50
       50
        
           tests = {

     

       51
       51
       +
             acme = {

     

       52
       52
       +
               inherit (nixos'.tests.acme)

     

       53
       53
       +
                 http01-builtin

     

       54
       54
       +
                 dns01

     

       55
       55
       +
                 ;

     

       56
       56
       +
             };

     

       51
       57
        
             inherit (nixos'.tests)

     

       52
       52
       -
               acme

     

       53
       58
        
               containers-imperative

     

       54
       59
        
               containers-ip

     

       55
       60
        
               firewall

     
···

       135
       140
        
               (map onSupported [

     

       136
       141
        
                 "nixos.dummy"

     

       137
       142
        
                 "nixos.manual"

     

       138
       138
       -
                 "nixos.tests.acme"

     

       143
       143
       +
                 "nixos.tests.acme.http01-builtin"

     

       144
       144
       +
                 "nixos.tests.acme.dns01"

     

       139
       145
        
                 "nixos.tests.containers-imperative"

     

       140
       146
        
                 "nixos.tests.containers-ip"

     

       141
       147
        
                 "nixos.tests.firewall"

-788

nixos/tests/acme.nix

···

       1
       1
       -
       { config, lib, ... }: let

     

       2
       2
       -
       

     

       3
       3
       -
         pkgs = config.node.pkgs;

     

       4
       4
       -
       

     

       5
       5
       -
         commonConfig = ./common/acme/client;

     

       6
       6
       -
       

     

       7
       7
       -
         dnsServerIP = nodes: nodes.dnsserver.networking.primaryIPAddress;

     

       8
       8
       -
       

     

       9
       9
       -
         dnsScript = nodes: let

     

       10
       10
       -
           dnsAddress = dnsServerIP nodes;

     

       11
       11
       -
         in pkgs.writeShellScript "dns-hook.sh" ''

     

       12
       12
       -
           set -euo pipefail

     

       13
       13
       -
           echo '[INFO]' "[$2]" 'dns-hook.sh' $*

     

       14
       14
       -
           if [ "$1" = "present" ]; then

     

       15
       15
       -
             ${pkgs.curl}/bin/curl --data '{"host": "'"$2"'", "value": "'"$3"'"}' http://${dnsAddress}:8055/set-txt

     

       16
       16
       -
           else

     

       17
       17
       -
             ${pkgs.curl}/bin/curl --data '{"host": "'"$2"'"}' http://${dnsAddress}:8055/clear-txt

     

       18
       18
       -
           fi

     

       19
       19
       -
         '';

     

       20
       20
       -
       

     

       21
       21
       -
         dnsConfig = nodes: {

     

       22
       22
       -
           dnsProvider = "exec";

     

       23
       23
       -
           dnsPropagationCheck = false;

     

       24
       24
       -
           environmentFile = pkgs.writeText "wildcard.env" ''

     

       25
       25
       -
             EXEC_PATH=${dnsScript nodes}

     

       26
       26
       -
             EXEC_POLLING_INTERVAL=1

     

       27
       27
       -
             EXEC_PROPAGATION_TIMEOUT=1

     

       28
       28
       -
             EXEC_SEQUENCE_INTERVAL=1

     

       29
       29
       -
           '';

     

       30
       30
       -
         };

     

       31
       31
       -
       

     

       32
       32
       -
         documentRoot = pkgs.runCommand "docroot" {} ''

     

       33
       33
       -
           mkdir -p "$out"

     

       34
       34
       -
           echo hello world > "$out/index.html"

     

       35
       35
       -
         '';

     

       36
       36
       -
       

     

       37
       37
       -
         vhostBase = {

     

       38
       38
       -
           forceSSL = true;

     

       39
       39
       -
           locations."/".root = documentRoot;

     

       40
       40
       -
         };

     

       41
       41
       -
       

     

       42
       42
       -
         vhostBaseHttpd = {

     

       43
       43
       -
           forceSSL = true;

     

       44
       44
       -
           inherit documentRoot;

     

       45
       45
       -
         };

     

       46
       46
       -
       

     

       47
       47
       -
         simpleConfig = {

     

       48
       48
       -
           security.acme = {

     

       49
       49
       -
             certs."http.example.test" = {

     

       50
       50
       -
               listenHTTP = ":80";

     

       51
       51
       -
             };

     

       52
       52
       -
           };

     

       53
       53
       -
       

     

       54
       54
       -
           networking.firewall.allowedTCPPorts = [ 80 ];

     

       55
       55
       -
         };

     

       56
       56
       -
       

     

       57
       57
       -
         # Base specialisation config for testing general ACME features

     

       58
       58
       -
         webserverBasicConfig = {

     

       59
       59
       -
           services.nginx.enable = true;

     

       60
       60
       -
           services.nginx.virtualHosts."a.example.test" = vhostBase // {

     

       61
       61
       -
             enableACME = true;

     

       62
       62
       -
           };

     

       63
       63
       -
         };

     

       64
       64
       -
       

     

       65
       65
       -
         # Generate specialisations for testing a web server

     

       66
       66
       -
         mkServerConfigs = { server, group, vhostBaseData, extraConfig ? {} }: let

     

       67
       67
       -
           baseConfig = { nodes, config, specialConfig ? {} }: lib.mkMerge [

     

       68
       68
       -
             {

     

       69
       69
       -
               security.acme = {

     

       70
       70
       -
                 defaults = (dnsConfig nodes);

     

       71
       71
       -
                 # One manual wildcard cert

     

       72
       72
       -
                 certs."example.test" = {

     

       73
       73
       -
                   domain = "*.example.test";

     

       74
       74
       -
                 };

     

       75
       75
       -
               };

     

       76
       76
       -
       

     

       77
       77
       -
               users.users."${config.services."${server}".user}".extraGroups = ["acme"];

     

       78
       78
       -
       

     

       79
       79
       -
               services."${server}" = {

     

       80
       80
       -
                 enable = true;

     

       81
       81
       -
                 virtualHosts = {

     

       82
       82
       -
                   # Run-of-the-mill vhost using HTTP-01 validation

     

       83
       83
       -
                   "${server}-http.example.test" = vhostBaseData // {

     

       84
       84
       -
                     serverAliases = [ "${server}-http-alias.example.test" ];

     

       85
       85
       -
                     enableACME = true;

     

       86
       86
       -
                   };

     

       87
       87
       -
       

     

       88
       88
       -
                   # Another which inherits the DNS-01 config

     

       89
       89
       -
                   "${server}-dns.example.test" = vhostBaseData // {

     

       90
       90
       -
                     serverAliases = [ "${server}-dns-alias.example.test" ];

     

       91
       91
       -
                     enableACME = true;

     

       92
       92
       -
                     # Set acmeRoot to null instead of using the default of "/var/lib/acme/acme-challenge"

     

       93
       93
       -
                     # webroot + dnsProvider are mutually exclusive.

     

       94
       94
       -
                     acmeRoot = null;

     

       95
       95
       -
                   };

     

       96
       96
       -
       

     

       97
       97
       -
                   # One using the wildcard certificate

     

       98
       98
       -
                   "${server}-wildcard.example.test" = vhostBaseData // {

     

       99
       99
       -
                     serverAliases = [ "${server}-wildcard-alias.example.test" ];

     

       100
       100
       -
                     useACMEHost = "example.test";

     

       101
       101
       -
                   };

     

       102
       102
       -
                 } // (lib.optionalAttrs (server == "nginx") {

     

       103
       103
       -
                   # The nginx module supports using a different key than the hostname

     

       104
       104
       -
                   different-key = vhostBaseData // {

     

       105
       105
       -
                     serverName = "${server}-different-key.example.test";

     

       106
       106
       -
                     serverAliases = [ "${server}-different-key-alias.example.test" ];

     

       107
       107
       -
                     enableACME = true;

     

       108
       108
       -
                   };

     

       109
       109
       -
                 });

     

       110
       110
       -
               };

     

       111
       111
       -
       

     

       112
       112
       -
               # Used to determine if service reload was triggered

     

       113
       113
       -
               systemd.targets."test-renew-${server}" = {

     

       114
       114
       -
                 wants = [ "acme-${server}-http.example.test.service" ];

     

       115
       115
       -
                 after = [ "acme-${server}-http.example.test.service" "${server}-config-reload.service" ];

     

       116
       116
       -
               };

     

       117
       117
       -
             }

     

       118
       118
       -
             specialConfig

     

       119
       119
       -
             extraConfig

     

       120
       120
       -
           ];

     

       121
       121
       -
         in {

     

       122
       122
       -
           "${server}".configuration = { nodes, config, ... }: baseConfig {

     

       123
       123
       -
             inherit nodes config;

     

       124
       124
       -
           };

     

       125
       125
       -
       

     

       126
       126
       -
           # Test that server reloads when an alias is removed (and subsequently test removal works in acme)

     

       127
       127
       -
           "${server}_remove_alias".configuration = { nodes, config, ... }: baseConfig {

     

       128
       128
       -
             inherit nodes config;

     

       129
       129
       -
             specialConfig = {

     

       130
       130
       -
               # Remove an alias, but create a standalone vhost in its place for testing.

     

       131
       131
       -
               # This configuration results in certificate errors as useACMEHost does not imply

     

       132
       132
       -
               # append extraDomains, and thus we can validate the SAN is removed.

     

       133
       133
       -
               services."${server}" = {

     

       134
       134
       -
                 virtualHosts."${server}-http.example.test".serverAliases = lib.mkForce [];

     

       135
       135
       -
                 virtualHosts."${server}-http-alias.example.test" = vhostBaseData // {

     

       136
       136
       -
                   useACMEHost = "${server}-http.example.test";

     

       137
       137
       -
                 };

     

       138
       138
       -
               };

     

       139
       139
       -
             };

     

       140
       140
       -
           };

     

       141
       141
       -
       

     

       142
       142
       -
           # Test that the server reloads when only the acme configuration is changed.

     

       143
       143
       -
           "${server}_change_acme_conf".configuration = { nodes, config, ... }: baseConfig {

     

       144
       144
       -
             inherit nodes config;

     

       145
       145
       -
             specialConfig = {

     

       146
       146
       -
               security.acme.certs."${server}-http.example.test" = {

     

       147
       147
       -
                 keyType = "ec384";

     

       148
       148
       -
                 # Also test that postRun is exec'd as root

     

       149
       149
       -
                 postRun = "id | grep root";

     

       150
       150
       -
               };

     

       151
       151
       -
             };

     

       152
       152
       -
           };

     

       153
       153
       -
         };

     

       154
       154
       -
       

     

       155
       155
       -
       in {

     

       156
       156
       -
         name = "acme";

     

       157
       157
       -
         meta = {

     

       158
       158
       -
           maintainers = lib.teams.acme.members;

     

       159
       159
       -
           # Hard timeout in seconds. Average run time is about 7 minutes.

     

       160
       160
       -
           timeout = 1800;

     

       161
       161
       -
         };

     

       162
       162
       -
       

     

       163
       163
       -
         nodes = {

     

       164
       164
       -
           # The fake ACME server which will respond to client requests

     

       165
       165
       -
           acme = { nodes, ... }: {

     

       166
       166
       -
             imports = [ ./common/acme/server ];

     

       167
       167
       -
             networking.nameservers = lib.mkForce [ (dnsServerIP nodes) ];

     

       168
       168
       -
           };

     

       169
       169
       -
       

     

       170
       170
       -
           # A fake DNS server which can be configured with records as desired

     

       171
       171
       -
           # Used to test DNS-01 challenge

     

       172
       172
       -
           dnsserver = { nodes, ... }: {

     

       173
       173
       -
             networking.firewall.allowedTCPPorts = [ 8055 53 ];

     

       174
       174
       -
             networking.firewall.allowedUDPPorts = [ 53 ];

     

       175
       175
       -
             systemd.services.pebble-challtestsrv = {

     

       176
       176
       -
               enable = true;

     

       177
       177
       -
               description = "Pebble ACME challenge test server";

     

       178
       178
       -
               wantedBy = [ "network.target" ];

     

       179
       179
       -
               serviceConfig = {

     

       180
       180
       -
                 ExecStart = "${pkgs.pebble}/bin/pebble-challtestsrv -dns01 ':53' -defaultIPv6 '' -defaultIPv4 '${nodes.webserver.networking.primaryIPAddress}'";

     

       181
       181
       -
                 # Required to bind on privileged ports.

     

       182
       182
       -
                 AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];

     

       183
       183
       -
               };

     

       184
       184
       -
             };

     

       185
       185
       -
           };

     

       186
       186
       -
       

     

       187
       187
       -
           # A web server which will be the node requesting certs

     

       188
       188
       -
           webserver = { nodes, config, ... }: {

     

       189
       189
       -
             imports = [ commonConfig ];

     

       190
       190
       -
             networking.nameservers = lib.mkForce [ (dnsServerIP nodes) ];

     

       191
       191
       -
             networking.firewall.allowedTCPPorts = [ 80 443 ];

     

       192
       192
       -
       

     

       193
       193
       -
             # OpenSSL will be used for more thorough certificate validation

     

       194
       194
       -
             environment.systemPackages = [ pkgs.openssl ];

     

       195
       195
       -
       

     

       196
       196
       -
             # Set log level to info so that we can see when the service is reloaded

     

       197
       197
       -
             services.nginx.logError = "stderr info";

     

       198
       198
       -
       

     

       199
       199
       -
             specialisation = {

     

       200
       200
       -
               # Tests HTTP-01 verification using Lego's built-in web server

     

       201
       201
       -
               http01lego.configuration = simpleConfig;

     

       202
       202
       -
       

     

       203
       203
       -
               # account hash generation with default server from <= 23.11

     

       204
       204
       -
               http01lego_legacyAccountHash.configuration = lib.mkMerge [

     

       205
       205
       -
                 simpleConfig

     

       206
       206
       -
                 {

     

       207
       207
       -
                   security.acme.defaults.server = lib.mkForce null;

     

       208
       208
       -
                 }

     

       209
       209
       -
               ];

     

       210
       210
       -
       

     

       211
       211
       -
               renew.configuration = lib.mkMerge [

     

       212
       212
       -
                 simpleConfig

     

       213
       213
       -
                 {

     

       214
       214
       -
                   # Pebble provides 5 year long certs,

     

       215
       215
       -
                   # needs to be higher than that to test renewal

     

       216
       216
       -
                   security.acme.certs."http.example.test".validMinDays = 9999;

     

       217
       217
       -
                 }

     

       218
       218
       -
               ];

     

       219
       219
       -
       

     

       220
       220
       -
               # Tests that account creds can be safely changed.

     

       221
       221
       -
               accountchange.configuration = lib.mkMerge [

     

       222
       222
       -
                 simpleConfig

     

       223
       223
       -
                 {

     

       224
       224
       -
                   security.acme.certs."http.example.test".email = "admin@example.test";

     

       225
       225
       -
                 }

     

       226
       226
       -
               ];

     

       227
       227
       -
       

     

       228
       228
       -
               # First derivation used to test general ACME features

     

       229
       229
       -
               general.configuration = { ... }: let

     

       230
       230
       -
                 caDomain = nodes.acme.test-support.acme.caDomain;

     

       231
       231
       -
                 email = config.security.acme.defaults.email;

     

       232
       232
       -
                 # Exit 99 to make it easier to track if this is the reason a renew failed

     

       233
       233
       -
                 accountCreateTester = ''

     

       234
       234
       -
                   test -e accounts/${caDomain}/${email}/account.json || exit 99

     

       235
       235
       -
                 '';

     

       236
       236
       -
               in lib.mkMerge [

     

       237
       237
       -
                 webserverBasicConfig

     

       238
       238
       -
                 {

     

       239
       239
       -
                   # Used to test that account creation is collated into one service.

     

       240
       240
       -
                   # These should not run until after acme-finished-a.example.test.target

     

       241
       241
       -
                   systemd.services."b.example.test".preStart = accountCreateTester;

     

       242
       242
       -
                   systemd.services."c.example.test".preStart = accountCreateTester;

     

       243
       243
       -
       

     

       244
       244
       -
                   services.nginx.virtualHosts."b.example.test" = vhostBase // {

     

       245
       245
       -
                     enableACME = true;

     

       246
       246
       -
                   };

     

       247
       247
       -
                   services.nginx.virtualHosts."c.example.test" = vhostBase // {

     

       248
       248
       -
                     enableACME = true;

     

       249
       249
       -
                   };

     

       250
       250
       -
                 }

     

       251
       251
       -
               ];

     

       252
       252
       -
       

     

       253
       253
       -
               # Test OCSP Stapling

     

       254
       254
       -
               ocsp_stapling.configuration = { ... }: lib.mkMerge [

     

       255
       255
       -
                 webserverBasicConfig

     

       256
       256
       -
                 {

     

       257
       257
       -
                   security.acme.certs."a.example.test".ocspMustStaple = true;

     

       258
       258
       -
                   services.nginx.virtualHosts."a.example.test" = {

     

       259
       259
       -
                     extraConfig = ''

     

       260
       260
       -
                       ssl_stapling on;

     

       261
       261
       -
                       ssl_stapling_verify on;

     

       262
       262
       -
                     '';

     

       263
       263
       -
                   };

     

       264
       264
       -
                 }

     

       265
       265
       -
               ];

     

       266
       266
       -
       

     

       267
       267
       -
               # Validate service relationships by adding a slow start service to nginx' wants.

     

       268
       268
       -
               # Reproducer for https://github.com/NixOS/nixpkgs/issues/81842

     

       269
       269
       -
               slow_startup.configuration = { ... }: lib.mkMerge [

     

       270
       270
       -
                 webserverBasicConfig

     

       271
       271
       -
                 {

     

       272
       272
       -
                   systemd.services.my-slow-service = {

     

       273
       273
       -
                     wantedBy = [ "multi-user.target" "nginx.service" ];

     

       274
       274
       -
                     before = [ "nginx.service" ];

     

       275
       275
       -
                     preStart = "sleep 5";

     

       276
       276
       -
                     script = "${pkgs.python3}/bin/python -m http.server";

     

       277
       277
       -
                   };

     

       278
       278
       -
       

     

       279
       279
       -
                   services.nginx.virtualHosts."slow.example.test" = {

     

       280
       280
       -
                     forceSSL = true;

     

       281
       281
       -
                     enableACME = true;

     

       282
       282
       -
                     locations."/".proxyPass = "http://localhost:8000";

     

       283
       283
       -
                   };

     

       284
       284
       -
                 }

     

       285
       285
       -
               ];

     

       286
       286
       -
       

     

       287
       287
       -
               concurrency_limit.configuration = {pkgs, ...}: lib.mkMerge [

     

       288
       288
       -
                 webserverBasicConfig {

     

       289
       289
       -
                   security.acme.maxConcurrentRenewals = 1;

     

       290
       290
       -
       

     

       291
       291
       -
                   services.nginx.virtualHosts = {

     

       292
       292
       -
                     "f.example.test" = vhostBase // {

     

       293
       293
       -
                       enableACME = true;

     

       294
       294
       -
                     };

     

       295
       295
       -
                     "g.example.test" = vhostBase // {

     

       296
       296
       -
                       enableACME = true;

     

       297
       297
       -
                     };

     

       298
       298
       -
                     "h.example.test" = vhostBase // {

     

       299
       299
       -
                       enableACME = true;

     

       300
       300
       -
                     };

     

       301
       301
       -
                   };

     

       302
       302
       -
       

     

       303
       303
       -
                   systemd.services = {

     

       304
       304
       -
                     # check for mutual exclusion of starting renew services

     

       305
       305
       -
                     "acme-f.example.test".serviceConfig.ExecPreStart = "+" + (pkgs.writeShellScript "test-f" ''

     

       306
       306
       -
                       test "$(systemctl is-active acme-{g,h}.example.test.service | grep activating | wc -l)" -le 0

     

       307
       307
       -
                       '');

     

       308
       308
       -
                     "acme-g.example.test".serviceConfig.ExecPreStart = "+" + (pkgs.writeShellScript "test-g" ''

     

       309
       309
       -
                       test "$(systemctl is-active acme-{f,h}.example.test.service | grep activating | wc -l)" -le 0

     

       310
       310
       -
                       '');

     

       311
       311
       -
                     "acme-h.example.test".serviceConfig.ExecPreStart = "+" + (pkgs.writeShellScript "test-h" ''

     

       312
       312
       -
                       test "$(systemctl is-active acme-{g,f}.example.test.service | grep activating | wc -l)" -le 0

     

       313
       313
       -
                       '');

     

       314
       314
       -
                     };

     

       315
       315
       -
                 }

     

       316
       316
       -
               ];

     

       317
       317
       -
       

     

       318
       318
       -
               # Test lego internal server (listenHTTP option)

     

       319
       319
       -
               # Also tests useRoot option

     

       320
       320
       -
               lego_server.configuration = { ... }: {

     

       321
       321
       -
                 security.acme.useRoot = true;

     

       322
       322
       -
                 security.acme.certs."lego.example.test" = {

     

       323
       323
       -
                   listenHTTP = ":80";

     

       324
       324
       -
                   group = "nginx";

     

       325
       325
       -
                 };

     

       326
       326
       -
                 services.nginx.enable = true;

     

       327
       327
       -
                 services.nginx.virtualHosts."lego.example.test" = {

     

       328
       328
       -
                   useACMEHost = "lego.example.test";

     

       329
       329
       -
                   onlySSL = true;

     

       330
       330
       -
                 };

     

       331
       331
       -
               };

     

       332
       332
       -
       

     

       333
       333
       -
             # Test compatibility with Caddy

     

       334
       334
       -
             # It only supports useACMEHost, hence not using mkServerConfigs

     

       335
       335
       -
             } // (let

     

       336
       336
       -
               baseCaddyConfig = { nodes, config, ... }: {

     

       337
       337
       -
                 security.acme = {

     

       338
       338
       -
                   defaults = (dnsConfig nodes);

     

       339
       339
       -
                   # One manual wildcard cert

     

       340
       340
       -
                   certs."example.test" = {

     

       341
       341
       -
                     domain = "*.example.test";

     

       342
       342
       -
                   };

     

       343
       343
       -
                 };

     

       344
       344
       -
       

     

       345
       345
       -
                 users.users."${config.services.caddy.user}".extraGroups = ["acme"];

     

       346
       346
       -
       

     

       347
       347
       -
                 services.caddy = {

     

       348
       348
       -
                   enable = true;

     

       349
       349
       -
                   virtualHosts."a.example.test" = {

     

       350
       350
       -
                     useACMEHost = "example.test";

     

       351
       351
       -
                     extraConfig = ''

     

       352
       352
       -
                       root * ${documentRoot}

     

       353
       353
       -
                     '';

     

       354
       354
       -
                   };

     

       355
       355
       -
                 };

     

       356
       356
       -
               };

     

       357
       357
       -
             in {

     

       358
       358
       -
               caddy.configuration = baseCaddyConfig;

     

       359
       359
       -
       

     

       360
       360
       -
               # Test that the server reloads when only the acme configuration is changed.

     

       361
       361
       -
               "caddy_change_acme_conf".configuration = { nodes, config, ... }: lib.mkMerge [

     

       362
       362
       -
                 (baseCaddyConfig {

     

       363
       363
       -
                   inherit nodes config;

     

       364
       364
       -
                 })

     

       365
       365
       -
                 {

     

       366
       366
       -
                   security.acme.certs."example.test" = {

     

       367
       367
       -
                     keyType = "ec384";

     

       368
       368
       -
                   };

     

       369
       369
       -
                 }

     

       370
       370
       -
               ];

     

       371
       371
       -
       

     

       372
       372
       -
             # Test compatibility with Nginx

     

       373
       373
       -
             }) // (mkServerConfigs {

     

       374
       374
       -
                 server = "nginx";

     

       375
       375
       -
                 group = "nginx";

     

       376
       376
       -
                 vhostBaseData = vhostBase;

     

       377
       377
       -
               })

     

       378
       378
       -
       

     

       379
       379
       -
             # Test compatibility with Apache HTTPD

     

       380
       380
       -
               // (mkServerConfigs {

     

       381
       381
       -
                 server = "httpd";

     

       382
       382
       -
                 group = "wwwrun";

     

       383
       383
       -
                 vhostBaseData = vhostBaseHttpd;

     

       384
       384
       -
                 extraConfig = {

     

       385
       385
       -
                   services.httpd.adminAddr = config.security.acme.defaults.email;

     

       386
       386
       -
                 };

     

       387
       387
       -
               });

     

       388
       388
       -
           };

     

       389
       389
       -
       

     

       390
       390
       -
           # The client will be used to curl the webserver to validate configuration

     

       391
       391
       -
           client = { nodes, ... }: {

     

       392
       392
       -
             imports = [ commonConfig ];

     

       393
       393
       -
             networking.nameservers = lib.mkForce [ (dnsServerIP nodes) ];

     

       394
       394
       -
       

     

       395
       395
       -
             # OpenSSL will be used for more thorough certificate validation

     

       396
       396
       -
             environment.systemPackages = [ pkgs.openssl ];

     

       397
       397
       -
           };

     

       398
       398
       -
         };

     

       399
       399
       -
       

     

       400
       400
       -
         testScript = { nodes, ... }:

     

       401
       401
       -
           let

     

       402
       402
       -
             caDomain = nodes.acme.test-support.acme.caDomain;

     

       403
       403
       -
           in

     

       404
       404
       -
           # Note, wait_for_unit does not work for oneshot services that do not have RemainAfterExit=true,

     

       405
       405
       -
           # this is because a oneshot goes from inactive => activating => inactive, and never

     

       406
       406
       -
           # reaches the active state. Targets do not have this issue.

     

       407
       407
       -
           ''

     

       408
       408
       -
             import time

     

       409
       409
       -
       

     

       410
       410
       -
             TOTAL_RETRIES = 20

     

       411
       411
       -
       

     

       412
       412
       -
       

     

       413
       413
       -
             class BackoffTracker(object):

     

       414
       414
       -
                 delay = 1

     

       415
       415
       -
                 increment = 1

     

       416
       416
       -
       

     

       417
       417
       -
                 def handle_fail(self, retries, message) -> int:

     

       418
       418
       -
                     assert retries < TOTAL_RETRIES, message

     

       419
       419
       -
       

     

       420
       420
       -
                     print(f"Retrying in {self.delay}s, {retries + 1}/{TOTAL_RETRIES}")

     

       421
       421
       -
                     time.sleep(self.delay)

     

       422
       422
       -
       

     

       423
       423
       -
                     # Only increment after the first try

     

       424
       424
       -
                     if retries == 0:

     

       425
       425
       -
                         self.delay += self.increment

     

       426
       426
       -
                         self.increment *= 2

     

       427
       427
       -
       

     

       428
       428
       -
                     return retries + 1

     

       429
       429
       -
       

     

       430
       430
       -
                 def protect(self, func):

     

       431
       431
       -
                     def wrapper(*args, retries: int = 0, **kwargs):

     

       432
       432
       -
                         try:

     

       433
       433
       -
                             return func(*args, **kwargs)

     

       434
       434
       -
                         except Exception as err:

     

       435
       435
       -
                             retries = self.handle_fail(retries, err.args)

     

       436
       436
       -
                             return wrapper(*args, retries=retries, **kwargs)

     

       437
       437
       -
       

     

       438
       438
       -
                     return wrapper

     

       439
       439
       -
       

     

       440
       440
       -
       

     

       441
       441
       -
             backoff = BackoffTracker()

     

       442
       442
       -
       

     

       443
       443
       -
       

     

       444
       444
       -
             def switch_to(node, name, allow_fail=False):

     

       445
       445
       -
                 # On first switch, this will create a symlink to the current system so that we can

     

       446
       446
       -
                 # quickly switch between derivations

     

       447
       447
       -
                 root_specs = "/tmp/specialisation"

     

       448
       448
       -
                 node.execute(

     

       449
       449
       -
                     f"test -e {root_specs}"

     

       450
       450
       -
                     f" || ln -s $(readlink /run/current-system)/specialisation {root_specs}"

     

       451
       451
       -
                 )

     

       452
       452
       -
       

     

       453
       453
       -
                 switcher_path = (

     

       454
       454
       -
                     f"/run/current-system/specialisation/{name}/bin/switch-to-configuration"

     

       455
       455
       -
                 )

     

       456
       456
       -
                 rc, _ = node.execute(f"test -e '{switcher_path}'")

     

       457
       457
       -
                 if rc > 0:

     

       458
       458
       -
                     switcher_path = f"/tmp/specialisation/{name}/bin/switch-to-configuration"

     

       459
       459
       -
       

     

       460
       460
       -
                 if not allow_fail:

     

       461
       461
       -
                   node.succeed(

     

       462
       462
       -
                       f"{switcher_path} test"

     

       463
       463
       -
                   )

     

       464
       464
       -
                 else:

     

       465
       465
       -
                   node.execute(

     

       466
       466
       -
                       f"{switcher_path} test"

     

       467
       467
       -
                   )

     

       468
       468
       -
       

     

       469
       469
       -
             # Start a unit explicitly, then wait for it to activate.

     

       470
       470
       -
             # This is used for the acme-finished-* targets, as those

     

       471
       471
       -
             # aren't started by switch-to-configuration, meaning

     

       472
       472
       -
             # wait_for_unit(target) will fail with "no pending jobs"

     

       473
       473
       -
             # if it wins the race and checks the target state before

     

       474
       474
       -
             # the actual unit is started.

     

       475
       475
       -
             def start_and_wait(node, unit):

     

       476
       476
       -
                 node.start_job(unit)

     

       477
       477
       -
                 node.wait_for_unit(unit)

     

       478
       478
       -
       

     

       479
       479
       -
             # Ensures the issuer of our cert matches the chain

     

       480
       480
       -
             # and matches the issuer we expect it to be.

     

       481
       481
       -
             # It's a good validation to ensure the cert.pem and fullchain.pem

     

       482
       482
       -
             # are not still selfsigned after verification

     

       483
       483
       -
             def check_issuer(node, cert_name, issuer):

     

       484
       484
       -
                 for fname in ("cert.pem", "fullchain.pem"):

     

       485
       485
       -
                     actual_issuer = node.succeed(

     

       486
       486
       -
                         f"openssl x509 -noout -issuer -in /var/lib/acme/{cert_name}/{fname}"

     

       487
       487
       -
                     ).partition("=")[2]

     

       488
       488
       -
                     assert (

     

       489
       489
       -
                         issuer.lower() in actual_issuer.lower()

     

       490
       490
       -
                     ), f"{fname} issuer mismatch. Expected {issuer} got {actual_issuer}"

     

       491
       491
       -
       

     

       492
       492
       -
       

     

       493
       493
       -
             # Ensure cert comes before chain in fullchain.pem

     

       494
       494
       -
             def check_fullchain(node, cert_name):

     

       495
       495
       -
                 cert_file = f"/var/lib/acme/{cert_name}/fullchain.pem"

     

       496
       496
       -
                 num_certs = node.succeed(f"grep -o 'END CERTIFICATE' {cert_file}")

     

       497
       497
       -
                 assert len(num_certs.strip().split("\n")) > 1, "Insufficient certs in fullchain.pem"

     

       498
       498
       -
       

     

       499
       499
       -
                 first_cert_data = node.succeed(

     

       500
       500
       -
                     f"grep -m1 -B50 'END CERTIFICATE' {cert_file}"

     

       501
       501
       -
                     " | openssl x509 -noout -text"

     

       502
       502
       -
                 )

     

       503
       503
       -
                 for line in first_cert_data.lower().split("\n"):

     

       504
       504
       -
                     if "dns:" in line:

     

       505
       505
       -
                         print(f"First DNSName in fullchain.pem: {line}")

     

       506
       506
       -
                         assert cert_name.lower() in line, f"{cert_name} not found in {line}"

     

       507
       507
       -
                         return

     

       508
       508
       -
       

     

       509
       509
       -
                 assert False

     

       510
       510
       -
       

     

       511
       511
       -
       

     

       512
       512
       -
             @backoff.protect

     

       513
       513
       -
             def check_connection(node, domain):

     

       514
       514
       -
                 result = node.succeed(

     

       515
       515
       -
                     "openssl s_client -brief -verify 2 -CAfile /tmp/ca.crt"

     

       516
       516
       -
                     f" -servername {domain} -connect {domain}:443 < /dev/null 2>&1"

     

       517
       517
       -
                 )

     

       518
       518
       -
       

     

       519
       519
       -
                 for line in result.lower().split("\n"):

     

       520
       520
       -
                     assert not (

     

       521
       521
       -
                         "verification" in line and "error" in line

     

       522
       522
       -
                     ), f"Failed to connect to https://{domain}"

     

       523
       523
       -
       

     

       524
       524
       -
       

     

       525
       525
       -
             @backoff.protect

     

       526
       526
       -
             def check_connection_key_bits(node, domain, bits):

     

       527
       527
       -
                 result = node.succeed(

     

       528
       528
       -
                     "openssl s_client -CAfile /tmp/ca.crt"

     

       529
       529
       -
                     f" -servername {domain} -connect {domain}:443 < /dev/null"

     

       530
       530
       -
                     " | openssl x509 -noout -text | grep -i Public-Key"

     

       531
       531
       -
                 )

     

       532
       532
       -
                 print("Key type:", result)

     

       533
       533
       -
       

     

       534
       534
       -
                 assert bits in result, f"Did not find expected number of bits ({bits}) in key"

     

       535
       535
       -
       

     

       536
       536
       -
       

     

       537
       537
       -
             @backoff.protect

     

       538
       538
       -
             def check_stapling(node, domain):

     

       539
       539
       -
                 # Pebble doesn't provide a full OCSP responder, so just check the URL

     

       540
       540
       -
                 result = node.succeed(

     

       541
       541
       -
                     "openssl s_client -CAfile /tmp/ca.crt"

     

       542
       542
       -
                     f" -servername {domain} -connect {domain}:443 < /dev/null"

     

       543
       543
       -
                     " | openssl x509 -noout -ocsp_uri"

     

       544
       544
       -
                 )

     

       545
       545
       -
                 print("OCSP Responder URL:", result)

     

       546
       546
       -
       

     

       547
       547
       -
                 assert "${caDomain}:4002" in result.lower(), "OCSP Stapling check failed"

     

       548
       548
       -
       

     

       549
       549
       -
       

     

       550
       550
       -
             @backoff.protect

     

       551
       551
       -
             def download_ca_certs(node):

     

       552
       552
       -
                 node.succeed("curl https://${caDomain}:15000/roots/0 > /tmp/ca.crt")

     

       553
       553
       -
                 node.succeed("curl https://${caDomain}:15000/intermediate-keys/0 >> /tmp/ca.crt")

     

       554
       554
       -
       

     

       555
       555
       -
       

     

       556
       556
       -
             @backoff.protect

     

       557
       557
       -
             def set_a_record(node):

     

       558
       558
       -
                 node.succeed(

     

       559
       559
       -
                     'curl --data \'{"host": "${caDomain}", "addresses": ["${nodes.acme.networking.primaryIPAddress}"]}\' http://${dnsServerIP nodes}:8055/add-a'

     

       560
       560
       -
                 )

     

       561
       561
       -
       

     

       562
       562
       -
       

     

       563
       563
       -
             start_all()

     

       564
       564
       -
       

     

       565
       565
       -
             dnsserver.wait_for_unit("pebble-challtestsrv.service")

     

       566
       566
       -
             client.wait_for_unit("default.target")

     

       567
       567
       -
       

     

       568
       568
       -
             set_a_record(client)

     

       569
       569
       -
       

     

       570
       570
       -
             acme.systemctl("start network-online.target")

     

       571
       571
       -
             acme.wait_for_unit("network-online.target")

     

       572
       572
       -
             acme.wait_for_unit("pebble.service")

     

       573
       573
       -
       

     

       574
       574
       -
             download_ca_certs(client)

     

       575
       575
       -
       

     

       576
       576
       -
             # Perform http-01 w/ lego test first

     

       577
       577
       -
             with subtest("Can request certificate with Lego's built in web server"):

     

       578
       578
       -
                 switch_to(webserver, "http01lego")

     

       579
       579
       -
                 start_and_wait(webserver, "acme-finished-http.example.test.target")

     

       580
       580
       -
                 check_fullchain(webserver, "http.example.test")

     

       581
       581
       -
                 check_issuer(webserver, "http.example.test", "pebble")

     

       582
       582
       -
       

     

       583
       583
       -
             # Perform account hash test

     

       584
       584
       -
             with subtest("Assert that account hash didn't unexpectedly change"):

     

       585
       585
       -
                 hash = webserver.succeed("ls /var/lib/acme/.lego/accounts/")

     

       586
       586
       -
                 print("Account hash: " + hash)

     

       587
       587
       -
                 assert hash.strip() == "d590213ed52603e9128d"

     

       588
       588
       -
       

     

       589
       589
       -
             # Perform renewal test

     

       590
       590
       -
             with subtest("Can renew certificates when they expire"):

     

       591
       591
       -
                 hash = webserver.succeed("sha256sum /var/lib/acme/http.example.test/cert.pem")

     

       592
       592
       -
                 switch_to(webserver, "renew")

     

       593
       593
       -
                 start_and_wait(webserver, "acme-finished-http.example.test.target")

     

       594
       594
       -
                 check_fullchain(webserver, "http.example.test")

     

       595
       595
       -
                 check_issuer(webserver, "http.example.test", "pebble")

     

       596
       596
       -
                 hash_after = webserver.succeed("sha256sum /var/lib/acme/http.example.test/cert.pem")

     

       597
       597
       -
                 assert hash != hash_after

     

       598
       598
       -
       

     

       599
       599
       -
             # Perform account change test

     

       600
       600
       -
             with subtest("Handles email change correctly"):

     

       601
       601
       -
                 hash = webserver.succeed("sha256sum /var/lib/acme/http.example.test/cert.pem")

     

       602
       602
       -
                 switch_to(webserver, "accountchange")

     

       603
       603
       -
                 start_and_wait(webserver, "acme-finished-http.example.test.target")

     

       604
       604
       -
                 check_fullchain(webserver, "http.example.test")

     

       605
       605
       -
                 check_issuer(webserver, "http.example.test", "pebble")

     

       606
       606
       -
                 hash_after = webserver.succeed("sha256sum /var/lib/acme/http.example.test/cert.pem")

     

       607
       607
       -
                 # Has to do a full run to register account, which creates new certs.

     

       608
       608
       -
                 assert hash != hash_after

     

       609
       609
       -
       

     

       610
       610
       -
             # Perform general tests

     

       611
       611
       -
             switch_to(webserver, "general")

     

       612
       612
       -
       

     

       613
       613
       -
             with subtest("Can request certificate with HTTP-01 challenge"):

     

       614
       614
       -
                 start_and_wait(webserver, "acme-finished-a.example.test.target")

     

       615
       615
       -
                 check_fullchain(webserver, "a.example.test")

     

       616
       616
       -
                 check_issuer(webserver, "a.example.test", "pebble")

     

       617
       617
       -
                 webserver.wait_for_unit("nginx.service")

     

       618
       618
       -
                 check_connection(client, "a.example.test")

     

       619
       619
       -
       

     

       620
       620
       -
             with subtest("Runs 1 cert for account creation before others"):

     

       621
       621
       -
                 start_and_wait(webserver, "acme-finished-b.example.test.target")

     

       622
       622
       -
                 start_and_wait(webserver, "acme-finished-c.example.test.target")

     

       623
       623
       -
                 check_connection(client, "b.example.test")

     

       624
       624
       -
                 check_connection(client, "c.example.test")

     

       625
       625
       -
       

     

       626
       626
       -
             with subtest("Certificates and accounts have safe + valid permissions"):

     

       627
       627
       -
                 # Nginx will set the group appropriately when enableACME is used

     

       628
       628
       -
                 group = "nginx"

     

       629
       629
       -
                 webserver.succeed(

     

       630
       630
       -
                     f"test $(stat -L -c '%a %U %G' /var/lib/acme/a.example.test/*.pem | tee /dev/stderr | grep '640 acme {group}' | wc -l) -eq 5"

     

       631
       631
       -
                 )

     

       632
       632
       -
                 webserver.succeed(

     

       633
       633
       -
                     f"test $(stat -L -c '%a %U %G' /var/lib/acme/.lego/a.example.test/**/a.example.test* | tee /dev/stderr | grep '600 acme {group}' | wc -l) -eq 4"

     

       634
       634
       -
                 )

     

       635
       635
       -
                 webserver.succeed(

     

       636
       636
       -
                     f"test $(stat -L -c '%a %U %G' /var/lib/acme/a.example.test | tee /dev/stderr | grep '750 acme {group}' | wc -l) -eq 1"

     

       637
       637
       -
                 )

     

       638
       638
       -
                 webserver.succeed(

     

       639
       639
       -
                     f"test $(find /var/lib/acme/accounts -type f -exec stat -L -c '%a %U %G' {{}} \\; | tee /dev/stderr | grep -v '600 acme {group}' | wc -l) -eq 0"

     

       640
       640
       -
                 )

     

       641
       641
       -
       

     

       642
       642
       -
             # Selfsigned certs tests happen late so we aren't fighting the system init triggering cert renewal

     

       643
       643
       -
             with subtest("Can generate valid selfsigned certs"):

     

       644
       644
       -
                 webserver.succeed("systemctl clean acme-a.example.test.service --what=state")

     

       645
       645
       -
                 webserver.succeed("systemctl start acme-selfsigned-a.example.test.service")

     

       646
       646
       -
                 check_fullchain(webserver, "a.example.test")

     

       647
       647
       -
                 check_issuer(webserver, "a.example.test", "minica")

     

       648
       648
       -
                 # Check selfsigned permissions

     

       649
       649
       -
                 webserver.succeed(

     

       650
       650
       -
                     f"test $(stat -L -c '%a %U %G' /var/lib/acme/a.example.test/*.pem | tee /dev/stderr | grep '640 acme {group}' | wc -l) -eq 5"

     

       651
       651
       -
                 )

     

       652
       652
       -
                 # Will succeed if nginx can load the certs

     

       653
       653
       -
                 webserver.succeed("systemctl start nginx-config-reload.service")

     

       654
       654
       -
       

     

       655
       655
       -
             with subtest("Correctly implements OCSP stapling"):

     

       656
       656
       -
                 switch_to(webserver, "ocsp_stapling")

     

       657
       657
       -
                 start_and_wait(webserver, "acme-finished-a.example.test.target")

     

       658
       658
       -
                 check_stapling(client, "a.example.test")

     

       659
       659
       -
       

     

       660
       660
       -
             with subtest("Can request certificate with HTTP-01 using lego's internal web server"):

     

       661
       661
       -
                 switch_to(webserver, "lego_server")

     

       662
       662
       -
                 start_and_wait(webserver, "acme-finished-lego.example.test.target")

     

       663
       663
       -
                 webserver.wait_for_unit("nginx.service")

     

       664
       664
       -
                 webserver.succeed("echo HENLO && systemctl cat nginx.service")

     

       665
       665
       -
                 webserver.succeed('test "$(stat -c \'%U\' /var/lib/acme/* | uniq)" = "root"')

     

       666
       666
       -
                 check_connection(client, "a.example.test")

     

       667
       667
       -
                 check_connection(client, "lego.example.test")

     

       668
       668
       -
       

     

       669
       669
       -
             with subtest("Can request certificate with HTTP-01 when nginx startup is delayed"):

     

       670
       670
       -
                 webserver.execute("systemctl stop nginx")

     

       671
       671
       -
                 switch_to(webserver, "slow_startup")

     

       672
       672
       -
                 start_and_wait(webserver, "acme-finished-slow.example.test.target")

     

       673
       673
       -
                 check_issuer(webserver, "slow.example.test", "pebble")

     

       674
       674
       -
                 webserver.wait_for_unit("nginx.service")

     

       675
       675
       -
                 check_connection(client, "slow.example.test")

     

       676
       676
       -
       

     

       677
       677
       -
             with subtest("Can limit concurrency of running renewals"):

     

       678
       678
       -
                 switch_to(webserver, "concurrency_limit")

     

       679
       679
       -
                 start_and_wait(webserver, "acme-finished-f.example.test.target")

     

       680
       680
       -
                 start_and_wait(webserver, "acme-finished-g.example.test.target")

     

       681
       681
       -
                 start_and_wait(webserver, "acme-finished-h.example.test.target")

     

       682
       682
       -
                 check_connection(client, "f.example.test")

     

       683
       683
       -
                 check_connection(client, "g.example.test")

     

       684
       684
       -
                 check_connection(client, "h.example.test")

     

       685
       685
       -
       

     

       686
       686
       -
             with subtest("Works with caddy"):

     

       687
       687
       -
                 switch_to(webserver, "caddy")

     

       688
       688
       -
                 start_and_wait(webserver, "acme-finished-example.test.target")

     

       689
       689
       -
                 webserver.wait_for_unit("caddy.service")

     

       690
       690
       -
                 # FIXME reloading caddy is not sufficient to load new certs.

     

       691
       691
       -
                 # Restart it manually until this is fixed.

     

       692
       692
       -
                 webserver.succeed("systemctl restart caddy.service")

     

       693
       693
       -
                 check_connection(client, "a.example.test")

     

       694
       694
       -
       

     

       695
       695
       -
             with subtest("security.acme changes reflect on caddy"):

     

       696
       696
       -
                 switch_to(webserver, "caddy_change_acme_conf")

     

       697
       697
       -
                 start_and_wait(webserver, "acme-finished-example.test.target")

     

       698
       698
       -
                 webserver.wait_for_unit("caddy.service")

     

       699
       699
       -
                 # FIXME reloading caddy is not sufficient to load new certs.

     

       700
       700
       -
                 # Restart it manually until this is fixed.

     

       701
       701
       -
                 webserver.succeed("systemctl restart caddy.service")

     

       702
       702
       -
                 check_connection_key_bits(client, "a.example.test", "384")

     

       703
       703
       -
       

     

       704
       704
       -
             common_domains = ["http", "dns", "wildcard"]

     

       705
       705
       -
             for server, logsrc, domains in [

     

       706
       706
       -
                 ("nginx", "journalctl -n 30 -u nginx.service", common_domains + ["different-key"]),

     

       707
       707
       -
                 ("httpd", "tail -n 30 /var/log/httpd/*.log", common_domains),

     

       708
       708
       -
             ]:

     

       709
       709
       -
                 wait_for_server = lambda: webserver.wait_for_unit(f"{server}.service")

     

       710
       710
       -
                 with subtest(f"Works with {server}"):

     

       711
       711
       -
                     try:

     

       712
       712
       -
                         switch_to(webserver, server)

     

       713
       713
       -
                         for domain in domains:

     

       714
       714
       -
                             if domain != "wildcard":

     

       715
       715
       -
                                 start_and_wait(

     

       716
       716
       -
                                     webserver,

     

       717
       717
       -
                                     f"acme-finished-{server}-{domain}.example.test.target"

     

       718
       718
       -
                                 )

     

       719
       719
       -
                     except Exception as err:

     

       720
       720
       -
                         _, output = webserver.execute(

     

       721
       721
       -
                             f"{logsrc} && ls -al /var/lib/acme/acme-challenge"

     

       722
       722
       -
                         )

     

       723
       723
       -
                         print(output)

     

       724
       724
       -
                         raise err

     

       725
       725
       -
       

     

       726
       726
       -
                     wait_for_server()

     

       727
       727
       -
       

     

       728
       728
       -
                     for domain in domains:

     

       729
       729
       -
                         if domain != "wildcard":

     

       730
       730
       -
                             check_issuer(webserver, f"{server}-{domain}.example.test", "pebble")

     

       731
       731
       -
                     for domain in domains:

     

       732
       732
       -
                         check_connection(client, f"{server}-{domain}.example.test")

     

       733
       733
       -
                         check_connection(client, f"{server}-{domain}-alias.example.test")

     

       734
       734
       -
       

     

       735
       735
       -
                 test_domain = f"{server}-{domains[0]}.example.test"

     

       736
       736
       -
       

     

       737
       737
       -
                 with subtest(f"Can reload {server} when timer triggers renewal"):

     

       738
       738
       -
                     # Switch to selfsigned first

     

       739
       739
       -
                     webserver.succeed(f"systemctl clean acme-{test_domain}.service --what=state")

     

       740
       740
       -
                     webserver.succeed(f"systemctl start acme-selfsigned-{test_domain}.service")

     

       741
       741
       -
                     check_issuer(webserver, test_domain, "minica")

     

       742
       742
       -
                     webserver.succeed(f"systemctl start {server}-config-reload.service")

     

       743
       743
       -
                     webserver.succeed(f"systemctl start test-renew-{server}.target")

     

       744
       744
       -
                     check_issuer(webserver, test_domain, "pebble")

     

       745
       745
       -
                     check_connection(client, test_domain)

     

       746
       746
       -
       

     

       747
       747
       -
                 with subtest("Can remove an alias from a domain + cert is updated"):

     

       748
       748
       -
                     test_alias = f"{server}-{domains[0]}-alias.example.test"

     

       749
       749
       -
                     switch_to(webserver, f"{server}_remove_alias")

     

       750
       750
       -
                     wait_for_server()

     

       751
       751
       -
                     start_and_wait(webserver, f"acme-finished-{test_domain}.target")

     

       752
       752
       -
                     wait_for_server()

     

       753
       753
       -
                     check_connection(client, test_domain)

     

       754
       754
       -
                     rc, _s = client.execute(

     

       755
       755
       -
                         f"openssl s_client -CAfile /tmp/ca.crt -connect {test_alias}:443"

     

       756
       756
       -
                         " </dev/null 2>/dev/null | openssl x509 -noout -text"

     

       757
       757
       -
                         f" | grep DNS: | grep {test_alias}"

     

       758
       758
       -
                     )

     

       759
       759
       -
                     assert rc > 0, "Removed extraDomainName was not removed from the cert"

     

       760
       760
       -
       

     

       761
       761
       -
                 with subtest("security.acme changes reflect on web server"):

     

       762
       762
       -
                     # Switch back to normal server config first, reset everything.

     

       763
       763
       -
                     switch_to(webserver, server)

     

       764
       764
       -
                     wait_for_server()

     

       765
       765
       -
                     switch_to(webserver, f"{server}_change_acme_conf")

     

       766
       766
       -
                     start_and_wait(webserver, f"acme-finished-{test_domain}.target")

     

       767
       767
       -
                     wait_for_server()

     

       768
       768
       -
                     check_connection_key_bits(client, test_domain, "384")

     

       769
       769
       -
       

     

       770
       770
       -
             # Perform http-01 w/ lego test again, but using the pre-24.05 account hashing

     

       771
       771
       -
             # (see https://github.com/NixOS/nixpkgs/pull/317257)

     

       772
       772
       -
             with subtest("Check account hashing compatibility with pre-24.05 settings"):

     

       773
       773
       -
                 webserver.succeed("rm -rf /var/lib/acme/.lego/accounts/*")

     

       774
       774
       -
                 switch_to(webserver, "http01lego_legacyAccountHash", allow_fail=True)

     

       775
       775
       -
                 # unit is failed, but in a way that this throws no exception:

     

       776
       776
       -
                 try:

     

       777
       777
       -
                   start_and_wait(webserver, "acme-finished-http.example.test.target")

     

       778
       778
       -
                 except Exception:

     

       779
       779
       -
                   # The unit is allowed – or even expected – to fail due to not being able to

     

       780
       780
       -
                   # reach the actual letsencrypt server. We only use it for serialising the

     

       781
       781
       -
                   # test execution, such that the account check is done after the service run

     

       782
       782
       -
                   # involving the account creation has been executed at least once.

     

       783
       783
       -
                   pass

     

       784
       784
       -
                 hash = webserver.succeed("ls /var/lib/acme/.lego/accounts/")

     

       785
       785
       -
                 print("Account hash: " + hash)

     

       786
       786
       -
                 assert hash.strip() == "1ccf607d9aa280e9af00"

     

       787
       787
       -
           '';

     

       788
       788
       -
       }

+120

nixos/tests/acme/caddy.nix

···

       1
       1
       +
       {

     

       2
       2
       +
         config,

     

       3
       3
       +
         lib,

     

       4
       4
       +
         pkgs,

     

       5
       5
       +
         ...

     

       6
       6
       +
       }:

     

       7
       7
       +
       let

     

       8
       8
       +
         domain = "example.test";

     

       9
       9
       +
       in

     

       10
       10
       +
       {

     

       11
       11
       +
         # Caddy only supports useACMEHost, hence we use a distinct test suite

     

       12
       12
       +
         name = "caddy";

     

       13
       13
       +
         meta = {

     

       14
       14
       +
           maintainers = lib.teams.acme.members;

     

       15
       15
       +
           # Hard timeout in seconds. Average run time is about 60 seconds.

     

       16
       16
       +
           timeout = 180;

     

       17
       17
       +
         };

     

       18
       18
       +
       

     

       19
       19
       +
         nodes = {

     

       20
       20
       +
           # The fake ACME server which will respond to client requests

     

       21
       21
       +
           acme =

     

       22
       22
       +
             { nodes, ... }:

     

       23
       23
       +
             {

     

       24
       24
       +
               imports = [ ../common/acme/server ];

     

       25
       25
       +
             };

     

       26
       26
       +
       

     

       27
       27
       +
           caddy =

     

       28
       28
       +
             { nodes, config, ... }:

     

       29
       29
       +
             let

     

       30
       30
       +
               fqdn = config.networking.fqdn;

     

       31
       31
       +
             in

     

       32
       32
       +
             {

     

       33
       33
       +
               imports = [ ../common/acme/client ];

     

       34
       34
       +
               networking.domain = domain;

     

       35
       35
       +
               networking.firewall.allowedTCPPorts = [

     

       36
       36
       +
                 80

     

       37
       37
       +
                 443

     

       38
       38
       +
               ];

     

       39
       39
       +
       

     

       40
       40
       +
               # Resolve the vhosts the easy way

     

       41
       41
       +
               networking.hosts."127.0.0.1" = [

     

       42
       42
       +
                 "caddy-alt.${domain}"

     

       43
       43
       +
               ];

     

       44
       44
       +
       

     

       45
       45
       +
               # OpenSSL will be used for more thorough certificate validation

     

       46
       46
       +
               environment.systemPackages = [ pkgs.openssl ];

     

       47
       47
       +
       

     

       48
       48
       +
               security.acme.certs."${fqdn}" = {

     

       49
       49
       +
                 listenHTTP = ":8080";

     

       50
       50
       +
                 reloadServices = [ "caddy.service" ];

     

       51
       51
       +
               };

     

       52
       52
       +
       

     

       53
       53
       +
               users.users."${config.services.caddy.user}".extraGroups = [ "acme" ];

     

       54
       54
       +
       

     

       55
       55
       +
               services.caddy = {

     

       56
       56
       +
                 enable = true;

     

       57
       57
       +
                 # FIXME reloading caddy is not sufficient to load new certs.

     

       58
       58
       +
                 # Restart it manually until this is fixed.

     

       59
       59
       +
                 enableReload = false;

     

       60
       60
       +
                 globalConfig = ''

     

       61
       61
       +
                   auto_https off

     

       62
       62
       +
                 '';

     

       63
       63
       +
                 virtualHosts."${fqdn}:443" = {

     

       64
       64
       +
                   useACMEHost = fqdn;

     

       65
       65
       +
                 };

     

       66
       66
       +
                 virtualHosts.":80".extraConfig = ''

     

       67
       67
       +
                   reverse_proxy localhost:8080

     

       68
       68
       +
                 '';

     

       69
       69
       +
               };

     

       70
       70
       +
       

     

       71
       71
       +
               specialisation.add_domain.configuration = {

     

       72
       72
       +
                 security.acme.certs.${fqdn}.extraDomainNames = [

     

       73
       73
       +
                   "caddy-alt.${domain}"

     

       74
       74
       +
                 ];

     

       75
       75
       +
               };

     

       76
       76
       +
             };

     

       77
       77
       +
         };

     

       78
       78
       +
       

     

       79
       79
       +
         testScript =

     

       80
       80
       +
           { nodes, ... }:

     

       81
       81
       +
           ''

     

       82
       82
       +
             ${(import ./utils.nix).pythonUtils}

     

       83
       83
       +
       

     

       84
       84
       +
             domain = "${domain}"

     

       85
       85
       +
             ca_domain = "${nodes.acme.test-support.acme.caDomain}"

     

       86
       86
       +
             fqdn = "${nodes.caddy.networking.fqdn}"

     

       87
       87
       +
       

     

       88
       88
       +
             acme.start()

     

       89
       89
       +
             wait_for_running(acme)

     

       90
       90
       +
             acme.wait_for_open_port(443)

     

       91
       91
       +
       

     

       92
       92
       +
             with subtest("Boot and acquire a new cert"):

     

       93
       93
       +
                 caddy.start()

     

       94
       94
       +
                 wait_for_running(caddy)

     

       95
       95
       +
       

     

       96
       96
       +
                 check_issuer(caddy, fqdn, "pebble")

     

       97
       97
       +
                 check_domain(caddy, fqdn, fqdn)

     

       98
       98
       +
       

     

       99
       99
       +
                 download_ca_certs(caddy, ca_domain)

     

       100
       100
       +
                 check_connection(caddy, fqdn)

     

       101
       101
       +
       

     

       102
       102
       +
             with subtest("Can run on selfsigned certificates"):

     

       103
       103
       +
                 # Switch to selfsigned first

     

       104
       104
       +
                 caddy.succeed(f"systemctl clean acme-{fqdn}.service --what=state")

     

       105
       105
       +
                 caddy.succeed(f"systemctl start acme-selfsigned-{fqdn}.service")

     

       106
       106
       +
                 check_issuer(caddy, fqdn, "minica")

     

       107
       107
       +
                 caddy.succeed("systemctl restart caddy.service")

     

       108
       108
       +
                 # Check that the web server has picked up the selfsigned cert

     

       109
       109
       +
                 check_connection(caddy, fqdn, minica=True)

     

       110
       110
       +
                 caddy.succeed(f"systemctl start acme-{fqdn}.service")

     

       111
       111
       +
                 # This may fail a couple of times before caddy is restarted

     

       112
       112
       +
                 check_issuer(caddy, fqdn, "pebble")

     

       113
       113
       +
                 check_connection(caddy, fqdn)

     

       114
       114
       +
       

     

       115
       115
       +
             with subtest("security.acme changes reflect on caddy"):

     

       116
       116
       +
                 check_connection(caddy, f"caddy-alt.{domain}", fail=True)

     

       117
       117
       +
                 switch_to(caddy, "add_domain")

     

       118
       118
       +
                 check_connection(caddy, f"caddy-alt.{domain}")

     

       119
       119
       +
           '';

     

       120
       120
       +
       }

+56

nixos/tests/acme/default.nix

···

       1
       1
       +
       { runTest }:

     

       2
       2
       +
       {

     

       3
       3
       +
         http01-builtin = runTest ./http01-builtin.nix;

     

       4
       4
       +
         dns01 = runTest ./dns01.nix;

     

       5
       5
       +
         caddy = runTest ./caddy.nix;

     

       6
       6
       +
         nginx = runTest (

     

       7
       7
       +
           import ./webserver.nix {

     

       8
       8
       +
             serverName = "nginx";

     

       9
       9
       +
             group = "nginx";

     

       10
       10
       +
             baseModule = {

     

       11
       11
       +
               services.nginx = {

     

       12
       12
       +
                 enable = true;

     

       13
       13
       +
                 enableReload = true;

     

       14
       14
       +
                 logError = "stderr info";

     

       15
       15
       +
                 # This tests a number of things at once:

     

       16
       16
       +
                 #   - Self-signed certs are in place before the webserver startup

     

       17
       17
       +
                 #   - Nginx is started before acme renewal is attempted

     

       18
       18
       +
                 #   - useACMEHost behaves as expected

     

       19
       19
       +
                 #   - acmeFallbackHost behaves as expected

     

       20
       20
       +
                 virtualHosts.default = {

     

       21
       21
       +
                   default = true;

     

       22
       22
       +
                   addSSL = true;

     

       23
       23
       +
                   useACMEHost = "proxied.example.test";

     

       24
       24
       +
                   acmeFallbackHost = "localhost:8080";

     

       25
       25
       +
                   # lego will refuse the request if the host header is not correct

     

       26
       26
       +
                   extraConfig = ''

     

       27
       27
       +
                     proxy_set_header Host $host;

     

       28
       28
       +
                   '';

     

       29
       29
       +
                 };

     

       30
       30
       +
               };

     

       31
       31
       +
             };

     

       32
       32
       +
           }

     

       33
       33
       +
         );

     

       34
       34
       +
         httpd = runTest (

     

       35
       35
       +
           import ./webserver.nix {

     

       36
       36
       +
             serverName = "httpd";

     

       37
       37
       +
             group = "wwwrun";

     

       38
       38
       +
             baseModule = {

     

       39
       39
       +
               services.httpd = {

     

       40
       40
       +
                 enable = true;

     

       41
       41
       +
                 # This is the default by virtue of being the first defined vhost.

     

       42
       42
       +
                 virtualHosts.default = {

     

       43
       43
       +
                   addSSL = true;

     

       44
       44
       +
                   useACMEHost = "proxied.example.test";

     

       45
       45
       +
                   locations."/.well-known/acme-challenge" = {

     

       46
       46
       +
                     proxyPass = "http://localhost:8080/.well-known/acme-challenge";

     

       47
       47
       +
                     extraConfig = ''

     

       48
       48
       +
                       ProxyPreserveHost On

     

       49
       49
       +
                     '';

     

       50
       50
       +
                   };

     

       51
       51
       +
                 };

     

       52
       52
       +
               };

     

       53
       53
       +
             };

     

       54
       54
       +
           }

     

       55
       55
       +
         );

     

       56
       56
       +
       }

+118

nixos/tests/acme/dns01.nix

···

       1
       1
       +
       {

     

       2
       2
       +
         config,

     

       3
       3
       +
         lib,

     

       4
       4
       +
         pkgs,

     

       5
       5
       +
         ...

     

       6
       6
       +
       }:

     

       7
       7
       +
       let

     

       8
       8
       +
         domain = "example.test";

     

       9
       9
       +
       

     

       10
       10
       +
         dnsServerIP = nodes: nodes.dnsserver.networking.primaryIPAddress;

     

       11
       11
       +
       

     

       12
       12
       +
         dnsScript = pkgs.writeShellScript "dns-hook.sh" ''

     

       13
       13
       +
           set -euo pipefail

     

       14
       14
       +
           echo '[INFO]' "[$2]" 'dns-hook.sh' $*

     

       15
       15
       +
           if [ "$1" = "present" ]; then

     

       16
       16
       +
             ${pkgs.curl}/bin/curl --data @- http://dnsserver.test:8055/set-txt << EOF

     

       17
       17
       +
             {"host": "$2", "value": "$3"}

     

       18
       18
       +
           EOF

     

       19
       19
       +
           else

     

       20
       20
       +
             ${pkgs.curl}/bin/curl --data @- http://dnsserver.test:8055/clear-txt << EOF

     

       21
       21
       +
             {"host": "$2"}

     

       22
       22
       +
           EOF

     

       23
       23
       +
           fi

     

       24
       24
       +
         '';

     

       25
       25
       +
       in

     

       26
       26
       +
       {

     

       27
       27
       +
         name = "dns01";

     

       28
       28
       +
         meta = {

     

       29
       29
       +
           maintainers = lib.teams.acme.members;

     

       30
       30
       +
           # Hard timeout in seconds. Average run time is about 60 seconds.

     

       31
       31
       +
           timeout = 180;

     

       32
       32
       +
         };

     

       33
       33
       +
       

     

       34
       34
       +
         nodes = {

     

       35
       35
       +
           # The fake ACME server which will respond to client requests

     

       36
       36
       +
           acme =

     

       37
       37
       +
             { nodes, ... }:

     

       38
       38
       +
             {

     

       39
       39
       +
               imports = [ ../common/acme/server ];

     

       40
       40
       +
               networking.nameservers = lib.mkForce [ (dnsServerIP nodes) ];

     

       41
       41
       +
             };

     

       42
       42
       +
       

     

       43
       43
       +
           # A fake DNS server which can be configured with records as desired

     

       44
       44
       +
           # Used to test DNS-01 challenge

     

       45
       45
       +
           dnsserver =

     

       46
       46
       +
             { nodes, ... }:

     

       47
       47
       +
             {

     

       48
       48
       +
               networking = {

     

       49
       49
       +
                 firewall.allowedTCPPorts = [

     

       50
       50
       +
                   8055

     

       51
       51
       +
                   53

     

       52
       52
       +
                 ];

     

       53
       53
       +
                 firewall.allowedUDPPorts = [ 53 ];

     

       54
       54
       +
       

     

       55
       55
       +
                 # nixos/lib/testing/network.nix will provide name resolution via /etc/hosts

     

       56
       56
       +
                 # for all nodes based on their host names and domain

     

       57
       57
       +
                 hostName = "dnsserver";

     

       58
       58
       +
                 domain = "test";

     

       59
       59
       +
               };

     

       60
       60
       +
               systemd.services.pebble-challtestsrv = {

     

       61
       61
       +
                 enable = true;

     

       62
       62
       +
                 description = "Pebble ACME challenge test server";

     

       63
       63
       +
                 wantedBy = [ "network.target" ];

     

       64
       64
       +
                 serviceConfig = {

     

       65
       65
       +
                   ExecStart = "${pkgs.pebble}/bin/pebble-challtestsrv -dns01 ':53' -defaultIPv6 '' -defaultIPv4 '${nodes.client.networking.primaryIPAddress}'";

     

       66
       66
       +
                   # Required to bind on privileged ports.

     

       67
       67
       +
                   AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];

     

       68
       68
       +
                 };

     

       69
       69
       +
               };

     

       70
       70
       +
             };

     

       71
       71
       +
       

     

       72
       72
       +
           client =

     

       73
       73
       +
             { nodes, ... }:

     

       74
       74
       +
             {

     

       75
       75
       +
               imports = [ ../common/acme/client ];

     

       76
       76
       +
               networking.domain = domain;

     

       77
       77
       +
               networking.nameservers = lib.mkForce [ (dnsServerIP nodes) ];

     

       78
       78
       +
       

     

       79
       79
       +
               # OpenSSL will be used for more thorough certificate validation

     

       80
       80
       +
               environment.systemPackages = [ pkgs.openssl ];

     

       81
       81
       +
       

     

       82
       82
       +
               security.acme.certs."${domain}" = {

     

       83
       83
       +
                 domain = "*.${domain}";

     

       84
       84
       +
                 dnsProvider = "exec";

     

       85
       85
       +
                 dnsPropagationCheck = false;

     

       86
       86
       +
                 environmentFile = pkgs.writeText "wildcard.env" ''

     

       87
       87
       +
                   EXEC_PATH=${dnsScript}

     

       88
       88
       +
                   EXEC_POLLING_INTERVAL=1

     

       89
       89
       +
                   EXEC_PROPAGATION_TIMEOUT=1

     

       90
       90
       +
                   EXEC_SEQUENCE_INTERVAL=1

     

       91
       91
       +
                 '';

     

       92
       92
       +
               };

     

       93
       93
       +
             };

     

       94
       94
       +
         };

     

       95
       95
       +
       

     

       96
       96
       +
         testScript = ''

     

       97
       97
       +
           ${(import ./utils.nix).pythonUtils}

     

       98
       98
       +
       

     

       99
       99
       +
           cert = "${domain}"

     

       100
       100
       +
       

     

       101
       101
       +
           dnsserver.start()

     

       102
       102
       +
           acme.start()

     

       103
       103
       +
       

     

       104
       104
       +
           wait_for_running(dnsserver)

     

       105
       105
       +
           dnsserver.wait_for_open_port(53)

     

       106
       106
       +
           wait_for_running(acme)

     

       107
       107
       +
           acme.wait_for_open_port(443)

     

       108
       108
       +
       

     

       109
       109
       +
           with subtest("Boot and acquire a new cert"):

     

       110
       110
       +
               client.start()

     

       111
       111
       +
               wait_for_running(client)

     

       112
       112
       +
       

     

       113
       113
       +
               check_issuer(client, cert, "pebble")

     

       114
       114
       +
               check_domain(client, cert, cert, fail=True)

     

       115
       115
       +
               check_domain(client, cert, f"toodeep.nesting.{cert}", fail=True)

     

       116
       116
       +
               check_domain(client, cert, f"whatever.{cert}")

     

       117
       117
       +
         '';

     

       118
       118
       +
       }

+215

nixos/tests/acme/http01-builtin.nix

···

       1
       1
       +
       {

     

       2
       2
       +
         config,

     

       3
       3
       +
         lib,

     

       4
       4
       +
         pkgs,

     

       5
       5
       +
         ...

     

       6
       6
       +
       }:

     

       7
       7
       +
       let

     

       8
       8
       +
         domain = "example.test";

     

       9
       9
       +
       in

     

       10
       10
       +
       {

     

       11
       11
       +
         name = "http01-builtin";

     

       12
       12
       +
         meta = {

     

       13
       13
       +
           maintainers = lib.teams.acme.members;

     

       14
       14
       +
           # Hard timeout in seconds. Average run time is about 90 seconds.

     

       15
       15
       +
           timeout = 300;

     

       16
       16
       +
         };

     

       17
       17
       +
       

     

       18
       18
       +
         nodes = {

     

       19
       19
       +
           # The fake ACME server which will respond to client requests

     

       20
       20
       +
           acme =

     

       21
       21
       +
             { nodes, ... }:

     

       22
       22
       +
             {

     

       23
       23
       +
               imports = [ ../common/acme/server ];

     

       24
       24
       +
             };

     

       25
       25
       +
       

     

       26
       26
       +
           builtin =

     

       27
       27
       +
             { nodes, config, ... }:

     

       28
       28
       +
             {

     

       29
       29
       +
               imports = [ ../common/acme/client ];

     

       30
       30
       +
               networking.domain = domain;

     

       31
       31
       +
               networking.firewall.allowedTCPPorts = [ 80 ];

     

       32
       32
       +
       

     

       33
       33
       +
               # OpenSSL will be used for more thorough certificate validation

     

       34
       34
       +
               environment.systemPackages = [ pkgs.openssl ];

     

       35
       35
       +
       

     

       36
       36
       +
               security.acme.certs."${config.networking.fqdn}" = {

     

       37
       37
       +
                 listenHTTP = ":80";

     

       38
       38
       +
               };

     

       39
       39
       +
       

     

       40
       40
       +
               specialisation = {

     

       41
       41
       +
                 renew.configuration = {

     

       42
       42
       +
                   # Pebble provides 5 year long certs,

     

       43
       43
       +
                   # needs to be higher than that to test renewal

     

       44
       44
       +
                   security.acme.certs."${config.networking.fqdn}".validMinDays = 9999;

     

       45
       45
       +
                 };

     

       46
       46
       +
       

     

       47
       47
       +
                 accountchange.configuration = {

     

       48
       48
       +
                   security.acme.certs."${config.networking.fqdn}".email = "admin@example.test";

     

       49
       49
       +
                 };

     

       50
       50
       +
       

     

       51
       51
       +
                 keytype.configuration = {

     

       52
       52
       +
                   security.acme.certs."${config.networking.fqdn}".keyType = "ec384";

     

       53
       53
       +
                 };

     

       54
       54
       +
       

     

       55
       55
       +
                 # Perform http-01 test again, but using the pre-24.05 account hashing

     

       56
       56
       +
                 # (see https://github.com/NixOS/nixpkgs/pull/317257)

     

       57
       57
       +
                 # The hash is deterministic in this case - only based on keyType and email.

     

       58
       58
       +
                 # Note: This test is making the assumption that the acme module will create

     

       59
       59
       +
                 # the account directory regardless of internet connectivity or server reachability.

     

       60
       60
       +
                 legacy_account_hash.configuration = {

     

       61
       61
       +
                   security.acme.defaults.server = lib.mkForce null;

     

       62
       62
       +
                 };

     

       63
       63
       +
       

     

       64
       64
       +
                 ocsp_stapling.configuration = {

     

       65
       65
       +
                   security.acme.certs."${config.networking.fqdn}".ocspMustStaple = true;

     

       66
       66
       +
                 };

     

       67
       67
       +
       

     

       68
       68
       +
                 preservation.configuration = { };

     

       69
       69
       +
       

     

       70
       70
       +
                 add_cert_and_domain.configuration = {

     

       71
       71
       +
                   security.acme.certs = {

     

       72
       72
       +
                     "${config.networking.fqdn}" = {

     

       73
       73
       +
                       extraDomainNames = [

     

       74
       74
       +
                         "builtin-alt.${domain}"

     

       75
       75
       +
                       ];

     

       76
       76
       +
                     };

     

       77
       77
       +
                     # We can assume that if renewal succeeds then the account creation leader

     

       78
       78
       +
                     # logic is working, since only one service could bind to port 80 at the same time.

     

       79
       79
       +
                     "builtin-2.${domain}".listenHTTP = ":80";

     

       80
       80
       +
                   };

     

       81
       81
       +
                   # To make sure it's the account creation leader that is doing the work.

     

       82
       82
       +
                   security.acme.maxConcurrentRenewals = 10;

     

       83
       83
       +
                 };

     

       84
       84
       +
       

     

       85
       85
       +
                 concurrency.configuration = {

     

       86
       86
       +
                   # As above, relying on port binding behaviour to assert that concurrency limit

     

       87
       87
       +
                   # prevents > 1 service running at a time.

     

       88
       88
       +
                   security.acme.maxConcurrentRenewals = 1;

     

       89
       89
       +
                   security.acme.certs = {

     

       90
       90
       +
                     "${config.networking.fqdn}" = {

     

       91
       91
       +
                       extraDomainNames = [

     

       92
       92
       +
                         "builtin-alt.${domain}"

     

       93
       93
       +
                       ];

     

       94
       94
       +
                     };

     

       95
       95
       +
                     "builtin-2.${domain}" = {

     

       96
       96
       +
                       extraDomainNames = [ "builtin-2-alt.${domain}" ];

     

       97
       97
       +
                       listenHTTP = ":80";

     

       98
       98
       +
                     };

     

       99
       99
       +
                     "builtin-3.${domain}".listenHTTP = ":80";

     

       100
       100
       +
                   };

     

       101
       101
       +
                 };

     

       102
       102
       +
               };

     

       103
       103
       +
             };

     

       104
       104
       +
         };

     

       105
       105
       +
       

     

       106
       106
       +
         testScript =

     

       107
       107
       +
           { nodes, ... }:

     

       108
       108
       +
           let

     

       109
       109
       +
             certName = nodes.builtin.networking.fqdn;

     

       110
       110
       +
             caDomain = nodes.acme.test-support.acme.caDomain;

     

       111
       111
       +
           in

     

       112
       112
       +
           ''

     

       113
       113
       +
             ${(import ./utils.nix).pythonUtils}

     

       114
       114
       +
       

     

       115
       115
       +
             domain = "${domain}"

     

       116
       116
       +
             cert = "${certName}"

     

       117
       117
       +
             cert2 = "builtin-2." + domain

     

       118
       118
       +
             cert3 = "builtin-3." + domain

     

       119
       119
       +
             legacy_account_dir = "/var/lib/acme/.lego/accounts/1ccf607d9aa280e9af00"

     

       120
       120
       +
       

     

       121
       121
       +
             acme.start()

     

       122
       122
       +
             wait_for_running(acme)

     

       123
       123
       +
             acme.wait_for_open_port(443)

     

       124
       124
       +
       

     

       125
       125
       +
             with subtest("Boot and acquire a new cert"):

     

       126
       126
       +
                 builtin.start()

     

       127
       127
       +
                 wait_for_running(builtin)

     

       128
       128
       +
       

     

       129
       129
       +
                 check_issuer(builtin, cert, "pebble")

     

       130
       130
       +
                 check_domain(builtin, cert, cert)

     

       131
       131
       +
       

     

       132
       132
       +
             with subtest("Validate permissions"):

     

       133
       133
       +
                 check_permissions(builtin, cert, "acme")

     

       134
       134
       +
       

     

       135
       135
       +
             with subtest("Check renewal behaviour"):

     

       136
       136
       +
                 # First, test no-op behaviour

     

       137
       137
       +
                 hash = builtin.succeed(f"sha256sum /var/lib/acme/{cert}/cert.pem")

     

       138
       138
       +
                 # old_hash will be used in the preservation tests later

     

       139
       139
       +
                 old_hash = hash

     

       140
       140
       +
                 builtin.succeed(f"systemctl start acme-{cert}.service")

     

       141
       141
       +
                 hash_after = builtin.succeed(f"sha256sum /var/lib/acme/{cert}/cert.pem")

     

       142
       142
       +
                 assert hash == hash_after, "Certificate was unexpectedly changed"

     

       143
       143
       +
       

     

       144
       144
       +
                 switch_to(builtin, "renew")

     

       145
       145
       +
                 check_issuer(builtin, cert, "pebble")

     

       146
       146
       +
                 hash_after = builtin.succeed(f"sha256sum /var/lib/acme/{cert}/cert.pem | tee /dev/stderr")

     

       147
       147
       +
                 assert hash != hash_after, "Certificate was not renewed"

     

       148
       148
       +
       

     

       149
       149
       +
             with subtest("Handles email change correctly"):

     

       150
       150
       +
                 hash = builtin.succeed(f"sha256sum /var/lib/acme/{cert}/cert.pem")

     

       151
       151
       +
                 switch_to(builtin, "accountchange")

     

       152
       152
       +
                 check_issuer(builtin, cert, "pebble")

     

       153
       153
       +
                 # Check that there are now 2 account directories

     

       154
       154
       +
                 builtin.succeed("test $(ls -1 /var/lib/acme/.lego/accounts | tee /dev/stderr | wc -l) -eq 2")

     

       155
       155
       +
                 hash_after = builtin.succeed(f"sha256sum /var/lib/acme/{cert}/cert.pem")

     

       156
       156
       +
                 # Has to do a full run to register account, which creates new certs.

     

       157
       157
       +
                 assert hash != hash_after, "Certificate was not renewed"

     

       158
       158
       +
                 # Remove the new account directory

     

       159
       159
       +
                 builtin.succeed(

     

       160
       160
       +
                     "cd /var/lib/acme/.lego/accounts"

     

       161
       161
       +
                     " && ls -1 --sort=time | tee /dev/stderr | head -1 | xargs rm -rf"

     

       162
       162
       +
                 )

     

       163
       163
       +
                 # old_hash will be used in the preservation tests later

     

       164
       164
       +
                 old_hash = hash_after

     

       165
       165
       +
       

     

       166
       166
       +
             with subtest("Correctly implements OCSP stapling"):

     

       167
       167
       +
                 check_stapling(builtin, cert, "${caDomain}", fail=True)

     

       168
       168
       +
                 switch_to(builtin, "ocsp_stapling")

     

       169
       169
       +
                 check_stapling(builtin, cert, "${caDomain}")

     

       170
       170
       +
       

     

       171
       171
       +
             with subtest("Handles keyType change correctly"):

     

       172
       172
       +
                 check_key_bits(builtin, cert, 256)

     

       173
       173
       +
                 switch_to(builtin, "keytype")

     

       174
       174
       +
                 check_key_bits(builtin, cert, 384)

     

       175
       175
       +
                 # keyType is part of the accountHash, thus a new account will be created

     

       176
       176
       +
                 builtin.succeed("test $(ls -1 /var/lib/acme/.lego/accounts | tee /dev/stderr | wc -l) -eq 2")

     

       177
       177
       +
       

     

       178
       178
       +
             with subtest("Reuses generated, valid certs from previous configurations"):

     

       179
       179
       +
                 # Right now, the hash should not match due to the previous test

     

       180
       180
       +
                 hash = builtin.succeed(f"sha256sum /var/lib/acme/{cert}/cert.pem | tee /dev/stderr")

     

       181
       181
       +
                 assert hash != old_hash, "Expected certificate to differ"

     

       182
       182
       +
                 switch_to(builtin, "preservation")

     

       183
       183
       +
                 hash = builtin.succeed(f"sha256sum /var/lib/acme/{cert}/cert.pem | tee /dev/stderr")

     

       184
       184
       +
                 assert hash == old_hash, "Expected certificate to match from older configuration"

     

       185
       185
       +
       

     

       186
       186
       +
             with subtest("Add a new cert, extend existing cert domains"):

     

       187
       187
       +
                 check_domain(builtin, cert, f"builtin-alt.{domain}", fail=True)

     

       188
       188
       +
                 switch_to(builtin, "add_cert_and_domain")

     

       189
       189
       +
                 check_issuer(builtin, cert, "pebble")

     

       190
       190
       +
                 check_domain(builtin, cert, f"builtin-alt.{domain}")

     

       191
       191
       +
                 check_issuer(builtin, cert2, "pebble")

     

       192
       192
       +
                 check_domain(builtin, cert2, cert2)

     

       193
       193
       +
                 # There should not be a new account folder created

     

       194
       194
       +
                 builtin.succeed("test $(ls -1 /var/lib/acme/.lego/accounts | tee /dev/stderr | wc -l) -eq 2")

     

       195
       195
       +
       

     

       196
       196
       +
             with subtest("Check account hashing compatibility with pre-24.05 settings"):

     

       197
       197
       +
                 switch_to(builtin, "legacy_account_hash", fail=True)

     

       198
       198
       +
                 builtin.succeed(f"stat {legacy_account_dir} > /dev/stderr && rm -rf {legacy_account_dir}")

     

       199
       199
       +
       

     

       200
       200
       +
             with subtest("Ensure Concurrency limits work"):

     

       201
       201
       +
                 switch_to(builtin, "concurrency")

     

       202
       202
       +
                 check_issuer(builtin, cert3, "pebble")

     

       203
       203
       +
                 check_domain(builtin, cert3, cert3)

     

       204
       204
       +
       

     

       205
       205
       +
             with subtest("Generate self-signed certs"):

     

       206
       206
       +
                 check_issuer(builtin, cert, "pebble")

     

       207
       207
       +
                 builtin.succeed(f"systemctl clean acme-{cert}.service --what=state")

     

       208
       208
       +
                 builtin.succeed(f"systemctl start acme-selfsigned-{cert}.service")

     

       209
       209
       +
                 check_issuer(builtin, cert, "minica")

     

       210
       210
       +
                 check_domain(builtin, cert, cert)

     

       211
       211
       +
       

     

       212
       212
       +
             with subtest("Validate permissions (self-signed)"):

     

       213
       213
       +
                 check_permissions(builtin, cert, "acme")

     

       214
       214
       +
           '';

     

       215
       215
       +
       }

+166

nixos/tests/acme/python-utils.py

···

       1
       1
       +
       #!/usr/bin/env python3

     

       2
       2
       +
       import time

     

       3
       3
       +
       

     

       4
       4
       +
       TOTAL_RETRIES = 20

     

       5
       5
       +
       

     

       6
       6
       +
       

     

       7
       7
       +
       def run(node, cmd, fail=False):

     

       8
       8
       +
           if fail:

     

       9
       9
       +
               return node.fail(cmd)

     

       10
       10
       +
           else:

     

       11
       11
       +
               return node.succeed(cmd)

     

       12
       12
       +
       

     

       13
       13
       +
       # Waits for the system to finish booting or switching configuration

     

       14
       14
       +
       def wait_for_running(node):

     

       15
       15
       +
           node.succeed("systemctl is-system-running --wait")

     

       16
       16
       +
       

     

       17
       17
       +
       # On first switch, this will create a symlink to the current system so that we can

     

       18
       18
       +
       # quickly switch between derivations

     

       19
       19
       +
       def switch_to(node, name, fail=False) -> None:

     

       20
       20
       +
           root_specs = "/tmp/specialisation"

     

       21
       21
       +
           node.execute(

     

       22
       22
       +
               f"test -e {root_specs}"

     

       23
       23
       +
               f" || ln -s $(readlink /run/current-system)/specialisation {root_specs}"

     

       24
       24
       +
           )

     

       25
       25
       +
       

     

       26
       26
       +
           switcher_path = (

     

       27
       27
       +
               f"/run/current-system/specialisation/{name}/bin/switch-to-configuration"

     

       28
       28
       +
           )

     

       29
       29
       +
           rc, _ = node.execute(f"test -e '{switcher_path}'")

     

       30
       30
       +
           if rc > 0:

     

       31
       31
       +
               switcher_path = f"/tmp/specialisation/{name}/bin/switch-to-configuration"

     

       32
       32
       +
       

     

       33
       33
       +
           cmd = f"{switcher_path} test"

     

       34
       34
       +
           run(node, cmd, fail=fail)

     

       35
       35
       +
           if not fail:

     

       36
       36
       +
               wait_for_running(node)

     

       37
       37
       +
       

     

       38
       38
       +
       # Ensures the issuer of our cert matches the chain

     

       39
       39
       +
       # and matches the issuer we expect it to be.

     

       40
       40
       +
       # It's a good validation to ensure the cert.pem and fullchain.pem

     

       41
       41
       +
       # are not still selfsigned after verification

     

       42
       42
       +
       def check_issuer(node, cert_name, issuer) -> None:

     

       43
       43
       +
           for fname in ("cert.pem", "fullchain.pem"):

     

       44
       44
       +
               actual_issuer = node.succeed(

     

       45
       45
       +
                   f"openssl x509 -noout -issuer -in /var/lib/acme/{cert_name}/{fname}"

     

       46
       46
       +
               ).partition("=")[2]

     

       47
       47
       +
               assert (

     

       48
       48
       +
                   issuer.lower() in actual_issuer.lower()

     

       49
       49
       +
               ), f"{fname} issuer mismatch. Expected {issuer} got {actual_issuer}"

     

       50
       50
       +
       

     

       51
       51
       +
       # Ensures the provided domain matches with the given cert

     

       52
       52
       +
       def check_domain(node, cert_name, domain, fail=False) -> None:

     

       53
       53
       +
           cmd = f"openssl x509 -noout -checkhost '{domain}' -in /var/lib/acme/{cert_name}/cert.pem"

     

       54
       54
       +
           run(node, cmd, fail=fail)

     

       55
       55
       +
       

     

       56
       56
       +
       # Ensures the required values for OCSP stapling are present

     

       57
       57
       +
       # Pebble doesn't provide a full OCSP responder, so just checks the URL

     

       58
       58
       +
       def check_stapling(node, cert_name, ca_domain, fail=False):

     

       59
       59
       +
           rc, _ = node.execute(

     

       60
       60
       +
               f"openssl x509 -noout -ocsp_uri -in /var/lib/acme/{cert_name}/cert.pem"

     

       61
       61
       +
               f" | grep -i 'http://{ca_domain}:4002' 2>&1",

     

       62
       62
       +
           )

     

       63
       63
       +
           assert rc == 0 or fail, "Failed to find OCSP URI in issued certificate"

     

       64
       64
       +
           run(

     

       65
       65
       +
               node,

     

       66
       66
       +
               f"openssl x509 -noout -ext tlsfeature -in /var/lib/acme/{cert_name}/cert.pem"

     

       67
       67
       +
               f" | grep -iv 'no extensions' 2>&1",

     

       68
       68
       +
               fail=fail,

     

       69
       69
       +
           )

     

       70
       70
       +
       

     

       71
       71
       +
       # Checks the keyType by validating the number of bits

     

       72
       72
       +
       def check_key_bits(node, cert_name, bits, fail=False):

     

       73
       73
       +
           run(

     

       74
       74
       +
               node,

     

       75
       75
       +
               f"openssl x509 -noout -text -in /var/lib/acme/{cert_name}/cert.pem"

     

       76
       76
       +
               f" | grep -i Public-Key | grep {bits} | tee /dev/stderr",

     

       77
       77
       +
               fail=fail,

     

       78
       78
       +
           )

     

       79
       79
       +
       

     

       80
       80
       +
       # Ensure cert comes before chain in fullchain.pem

     

       81
       81
       +
       def check_fullchain(node, cert_name):

     

       82
       82
       +
           cert_file = f"/var/lib/acme/{cert_name}/fullchain.pem"

     

       83
       83
       +
           num_certs = node.succeed(f"grep -o 'END CERTIFICATE' {cert_file}")

     

       84
       84
       +
           assert len(num_certs.strip().split("\n")) > 1, "Insufficient certs in fullchain.pem"

     

       85
       85
       +
       

     

       86
       86
       +
           first_cert_data = node.succeed(

     

       87
       87
       +
               f"grep -m1 -B50 'END CERTIFICATE' {cert_file}"

     

       88
       88
       +
               " | openssl x509 -noout -text"

     

       89
       89
       +
           )

     

       90
       90
       +
           for line in first_cert_data.lower().split("\n"):

     

       91
       91
       +
               if "dns:" in line:

     

       92
       92
       +
                   print(f"First DNSName in fullchain.pem: {line}")

     

       93
       93
       +
                   assert cert_name.lower() in line, f"{cert_name} not found in {line}"

     

       94
       94
       +
                   return

     

       95
       95
       +
       

     

       96
       96
       +
           assert False

     

       97
       97
       +
       

     

       98
       98
       +
       # Checks the permissions in the cert directories are as expected

     

       99
       99
       +
       def check_permissions(node, cert_name, group):

     

       100
       100
       +
           stat = "stat -L -c '%a %U %G' "

     

       101
       101
       +
           node.succeed(

     

       102
       102
       +
               f"test $({stat} /var/lib/acme/{cert_name}/*.pem"

     

       103
       103
       +
               f" | tee /dev/stderr | grep -v '640 acme {group}' | wc -l) -eq 0"

     

       104
       104
       +
           )

     

       105
       105
       +
           node.succeed(

     

       106
       106
       +
               f"test $({stat} /var/lib/acme/.lego/{cert_name}/*/{cert_name}*"

     

       107
       107
       +
               f" | tee /dev/stderr | grep -v '600 acme {group}' | wc -l) -eq 0"

     

       108
       108
       +
           )

     

       109
       109
       +
           node.succeed(

     

       110
       110
       +
               f"test $({stat} /var/lib/acme/{cert_name}"

     

       111
       111
       +
               f" | tee /dev/stderr | grep -v '750 acme {group}' | wc -l) -eq 0"

     

       112
       112
       +
           )

     

       113
       113
       +
           node.succeed(

     

       114
       114
       +
               f"test $(find /var/lib/acme/.lego/accounts -type f -exec {stat} {{}} \\;"

     

       115
       115
       +
               f" | tee /dev/stderr | grep -v '600 acme {group}' | wc -l) -eq 0"

     

       116
       116
       +
           )

     

       117
       117
       +
       

     

       118
       118
       +
       # BackoffTracker provides a robust system for handling test retries

     

       119
       119
       +
       class BackoffTracker:

     

       120
       120
       +
           delay = 1

     

       121
       121
       +
           increment = 1

     

       122
       122
       +
       

     

       123
       123
       +
           def handle_fail(self, retries, message) -> int:

     

       124
       124
       +
               assert retries < TOTAL_RETRIES, message

     

       125
       125
       +
       

     

       126
       126
       +
               print(f"Retrying in {self.delay}s, {retries + 1}/{TOTAL_RETRIES}")

     

       127
       127
       +
               time.sleep(self.delay)

     

       128
       128
       +
       

     

       129
       129
       +
               # Only increment after the first try

     

       130
       130
       +
               if retries == 0:

     

       131
       131
       +
                   self.delay += self.increment

     

       132
       132
       +
                   self.increment *= 2

     

       133
       133
       +
       

     

       134
       134
       +
               return retries + 1

     

       135
       135
       +
       

     

       136
       136
       +
           def protect(self, func):

     

       137
       137
       +
               def wrapper(*args, retries: int = 0, **kwargs):

     

       138
       138
       +
                   try:

     

       139
       139
       +
                       return func(*args, **kwargs)

     

       140
       140
       +
                   except Exception as err:

     

       141
       141
       +
                       retries = self.handle_fail(retries, err.args)

     

       142
       142
       +
                       return wrapper(*args, retries=retries, **kwargs)

     

       143
       143
       +
       

     

       144
       144
       +
               return wrapper

     

       145
       145
       +
       

     

       146
       146
       +
       

     

       147
       147
       +
       backoff = BackoffTracker()

     

       148
       148
       +
       

     

       149
       149
       +
       

     

       150
       150
       +
       @backoff.protect

     

       151
       151
       +
       def download_ca_certs(node, ca_domain):

     

       152
       152
       +
           node.succeed(f"curl https://{ca_domain}:15000/roots/0 > /tmp/ca.crt")

     

       153
       153
       +
           node.succeed(f"curl https://{ca_domain}:15000/intermediate-keys/0 >> /tmp/ca.crt")

     

       154
       154
       +
       

     

       155
       155
       +
       

     

       156
       156
       +
       @backoff.protect

     

       157
       157
       +
       def check_connection(node, domain, fail=False, minica=False):

     

       158
       158
       +
           cafile = "/tmp/ca.crt"

     

       159
       159
       +
           if minica:

     

       160
       160
       +
               cafile = "/var/lib/acme/.minica/cert.pem"

     

       161
       161
       +
           run(node,

     

       162
       162
       +
               f"openssl s_client -brief -CAfile {cafile}"

     

       163
       163
       +
               f" -verify 2 -verify_return_error -verify_hostname {domain}"

     

       164
       164
       +
               f" -servername {domain} -connect {domain}:443 < /dev/null",

     

       165
       165
       +
               fail=fail,

     

       166
       166
       +
           )

nixos/tests/acme/utils.nix

···

       1
       1
       +
       {

     

       2
       2
       +
         # Helper functions for python

     

       3
       3
       +
         pythonUtils = builtins.readFile ./python-utils.py;

     

       4
       4
       +
       }

+185

nixos/tests/acme/webserver.nix

···

       1
       1
       +
       {

     

       2
       2
       +
         serverName,

     

       3
       3
       +
         group,

     

       4
       4
       +
         baseModule,

     

       5
       5
       +
         domain ? "example.test",

     

       6
       6
       +
       }:

     

       7
       7
       +
       {

     

       8
       8
       +
         config,

     

       9
       9
       +
         lib,

     

       10
       10
       +
         pkgs,

     

       11
       11
       +
         ...

     

       12
       12
       +
       }:

     

       13
       13
       +
       {

     

       14
       14
       +
         name = serverName;

     

       15
       15
       +
         meta = {

     

       16
       16
       +
           maintainers = lib.teams.acme.members;

     

       17
       17
       +
           # Hard timeout in seconds. Average run time is about 100 seconds.

     

       18
       18
       +
           timeout = 300;

     

       19
       19
       +
         };

     

       20
       20
       +
       

     

       21
       21
       +
         nodes = {

     

       22
       22
       +
           # The fake ACME server which will respond to client requests

     

       23
       23
       +
           acme =

     

       24
       24
       +
             { nodes, ... }:

     

       25
       25
       +
             {

     

       26
       26
       +
               imports = [ ../common/acme/server ];

     

       27
       27
       +
             };

     

       28
       28
       +
       

     

       29
       29
       +
           webserver =

     

       30
       30
       +
             { nodes, ... }:

     

       31
       31
       +
             {

     

       32
       32
       +
               imports = [

     

       33
       33
       +
                 ../common/acme/client

     

       34
       34
       +
                 baseModule

     

       35
       35
       +
               ];

     

       36
       36
       +
               networking.domain = domain;

     

       37
       37
       +
               networking.firewall.allowedTCPPorts = [

     

       38
       38
       +
                 80

     

       39
       39
       +
                 443

     

       40
       40
       +
               ];

     

       41
       41
       +
       

     

       42
       42
       +
               # Resolve the vhosts the easy way

     

       43
       43
       +
               networking.hosts."127.0.0.1" = [

     

       44
       44
       +
                 "proxied.${domain}"

     

       45
       45
       +
                 "certchange.${domain}"

     

       46
       46
       +
                 "zeroconf.${domain}"

     

       47
       47
       +
                 "zeroconf2.${domain}"

     

       48
       48
       +
                 "nullroot.${domain}"

     

       49
       49
       +
               ];

     

       50
       50
       +
       

     

       51
       51
       +
               # OpenSSL will be used for more thorough certificate validation

     

       52
       52
       +
               environment.systemPackages = [ pkgs.openssl ];

     

       53
       53
       +
       

     

       54
       54
       +
               # Used to determine if service reload was triggered.

     

       55
       55
       +
               # This does not provide a guarantee that the webserver is finished reloading,

     

       56
       56
       +
               # to handle that there is retry logic wrapping any connectivity checks.

     

       57
       57
       +
               systemd.targets."renew-triggered" = {

     

       58
       58
       +
                 wantedBy = [ "${serverName}-config-reload.service" ];

     

       59
       59
       +
                 after = [ "${serverName}-config-reload.service" ];

     

       60
       60
       +
               };

     

       61
       61
       +
       

     

       62
       62
       +
               security.acme.certs."proxied.${domain}" = {

     

       63
       63
       +
                 listenHTTP = ":8080";

     

       64
       64
       +
                 group = group;

     

       65
       65
       +
               };

     

       66
       66
       +
       

     

       67
       67
       +
               specialisation = {

     

       68
       68
       +
                 # Test that the web server is correctly reloaded when the cert changes

     

       69
       69
       +
                 certchange.configuration = {

     

       70
       70
       +
                   security.acme.certs."proxied.${domain}".extraDomainNames = [

     

       71
       71
       +
                     "certchange.${domain}"

     

       72
       72
       +
                   ];

     

       73
       73
       +
                 };

     

       74
       74
       +
       

     

       75
       75
       +
                 # A useful transitional step before other tests, and tests behaviour

     

       76
       76
       +
                 # of removing an extra domain from a cert.

     

       77
       77
       +
                 certundo.configuration = { };

     

       78
       78
       +
       

     

       79
       79
       +
                 # Tests these features:

     

       80
       80
       +
                 #   - enableACME behaves as expected

     

       81
       81
       +
                 #   - serverAliases are appended to extraDomainNames

     

       82
       82
       +
                 #   - Correct routing to the specific virtualHost for a cert

     

       83
       83
       +
                 # Inherits previous test config

     

       84
       84
       +
                 zeroconf.configuration = {

     

       85
       85
       +
                   services.${serverName}.virtualHosts."zeroconf.${domain}" = {

     

       86
       86
       +
                     addSSL = true;

     

       87
       87
       +
                     enableACME = true;

     

       88
       88
       +
                     serverAliases = [ "zeroconf2.${domain}" ];

     

       89
       89
       +
                   };

     

       90
       90
       +
                 };

     

       91
       91
       +
       

     

       92
       92
       +
                 # Test that serverAliases are correctly removed which triggers

     

       93
       93
       +
                 # cert regeneration and service reload.

     

       94
       94
       +
                 rmalias.configuration = {

     

       95
       95
       +
                   services.${serverName}.virtualHosts."zeroconf.${domain}" = {

     

       96
       96
       +
                     addSSL = true;

     

       97
       97
       +
                     enableACME = true;

     

       98
       98
       +
                   };

     

       99
       99
       +
                 };

     

       100
       100
       +
       

     

       101
       101
       +
                 # Test that "acmeRoot = null" still results in

     

       102
       102
       +
                 # valid cert generation by inheriting defaults.

     

       103
       103
       +
                 nullroot.configuration = {

     

       104
       104
       +
                   security.acme.defaults.listenHTTP = ":8080";

     

       105
       105
       +
                   services.${serverName}.virtualHosts."nullroot.${domain}" = {

     

       106
       106
       +
                     onlySSL = true;

     

       107
       107
       +
                     enableACME = true;

     

       108
       108
       +
                     acmeRoot = null;

     

       109
       109
       +
                   };

     

       110
       110
       +
                 };

     

       111
       111
       +
               };

     

       112
       112
       +
             };

     

       113
       113
       +
         };

     

       114
       114
       +
       

     

       115
       115
       +
         testScript =

     

       116
       116
       +
           { nodes, ... }:

     

       117
       117
       +
           ''

     

       118
       118
       +
             ${(import ./utils.nix).pythonUtils}

     

       119
       119
       +
       

     

       120
       120
       +
             domain = "${domain}"

     

       121
       121
       +
             ca_domain = "${nodes.acme.test-support.acme.caDomain}"

     

       122
       122
       +
             fqdn = f"proxied.{domain}"

     

       123
       123
       +
       

     

       124
       124
       +
             acme.start()

     

       125
       125
       +
             wait_for_running(acme)

     

       126
       126
       +
             acme.wait_for_open_port(443)

     

       127
       127
       +
       

     

       128
       128
       +
             with subtest("Acquire a cert through a proxied lego"):

     

       129
       129
       +
                 webserver.start()

     

       130
       130
       +
                 webserver.succeed("systemctl is-system-running --wait")

     

       131
       131
       +
                 wait_for_running(webserver)

     

       132
       132
       +
                 download_ca_certs(webserver, ca_domain)

     

       133
       133
       +
                 check_connection(webserver, fqdn)

     

       134
       134
       +
       

     

       135
       135
       +
             with subtest("Can run on selfsigned certificates"):

     

       136
       136
       +
                 # Switch to selfsigned first

     

       137
       137
       +
                 webserver.succeed(f"systemctl clean acme-{fqdn}.service --what=state")

     

       138
       138
       +
                 webserver.succeed(f"systemctl start acme-selfsigned-{fqdn}.service")

     

       139
       139
       +
                 check_issuer(webserver, fqdn, "minica")

     

       140
       140
       +
                 webserver.succeed("systemctl restart ${serverName}-config-reload.service")

     

       141
       141
       +
                 # Check that the web server has picked up the selfsigned cert

     

       142
       142
       +
                 check_connection(webserver, fqdn, minica=True)

     

       143
       143
       +
                 webserver.succeed("systemctl stop renew-triggered.target")

     

       144
       144
       +
                 webserver.succeed(f"systemctl start acme-{fqdn}.service")

     

       145
       145
       +
                 webserver.wait_for_unit("renew-triggered.target")

     

       146
       146
       +
                 check_issuer(webserver, fqdn, "pebble")

     

       147
       147
       +
                 check_connection(webserver, fqdn)

     

       148
       148
       +
       

     

       149
       149
       +
             with subtest("security.acme changes reflect on web server part 1"):

     

       150
       150
       +
                 check_connection(webserver, f"certchange.{domain}", fail=True)

     

       151
       151
       +
                 switch_to(webserver, "certchange")

     

       152
       152
       +
                 webserver.wait_for_unit("renew-triggered.target")

     

       153
       153
       +
                 check_connection(webserver, f"certchange.{domain}")

     

       154
       154
       +
                 check_connection(webserver, fqdn)

     

       155
       155
       +
       

     

       156
       156
       +
             with subtest("security.acme changes reflect on web server part 2"):

     

       157
       157
       +
                 check_connection(webserver, f"certchange.{domain}")

     

       158
       158
       +
                 switch_to(webserver, "certundo")

     

       159
       159
       +
                 webserver.wait_for_unit("renew-triggered.target")

     

       160
       160
       +
                 check_connection(webserver, f"certchange.{domain}", fail=True)

     

       161
       161
       +
                 check_connection(webserver, fqdn)

     

       162
       162
       +
       

     

       163
       163
       +
             with subtest("Zero configuration SSL certificates for a vhost"):

     

       164
       164
       +
                 check_connection(webserver, f"zeroconf.{domain}", fail=True)

     

       165
       165
       +
                 switch_to(webserver, "zeroconf")

     

       166
       166
       +
                 webserver.wait_for_unit("renew-triggered.target")

     

       167
       167
       +
                 check_connection(webserver, f"zeroconf.{domain}")

     

       168
       168
       +
                 check_connection(webserver, f"zeroconf2.{domain}")

     

       169
       169
       +
                 check_connection(webserver, fqdn)

     

       170
       170
       +
       

     

       171
       171
       +
             with subtest("Removing an alias from a vhost"):

     

       172
       172
       +
                 check_connection(webserver, f"zeroconf2.{domain}")

     

       173
       173
       +
                 switch_to(webserver, "rmalias")

     

       174
       174
       +
                 webserver.wait_for_unit("renew-triggered.target")

     

       175
       175
       +
                 check_connection(webserver, f"zeroconf2.{domain}", fail=True)

     

       176
       176
       +
                 check_connection(webserver, f"zeroconf.{domain}")

     

       177
       177
       +
                 check_connection(webserver, fqdn)

     

       178
       178
       +
       

     

       179
       179
       +
             with subtest("Create cert using inherited default validation mechanism"):

     

       180
       180
       +
                 check_connection(webserver, f"nullroot.{domain}", fail=True)

     

       181
       181
       +
                 switch_to(webserver, "nullroot")

     

       182
       182
       +
                 webserver.wait_for_unit("renew-triggered.target")

     

       183
       183
       +
                 check_connection(webserver, f"nullroot.{domain}")

     

       184
       184
       +
           '';

     

       185
       185
       +
       }

+1 -1

nixos/tests/all-tests.nix

···

       146
       146
        
       

     

       147
       147
        
         _3proxy = runTest ./3proxy.nix;

     

       148
       148
        
         aaaaxy = runTest ./aaaaxy.nix;

     

       149
       149
       -
         acme = runTest ./acme.nix;

     

       149
       149
       +
         acme = import ./acme/default.nix { inherit runTest; };

     

       150
       150
        
         acme-dns = handleTest ./acme-dns.nix {};

     

       151
       151
        
         actual = handleTest ./actual.nix {};

     

       152
       152
        
         adguardhome = runTest ./adguardhome.nix;

+46 -65

nixos/tests/common/acme/server/default.nix

···

       6
       6
        
       # the test certificate into security.pki.certificateFiles or into package

     

       7
       7
        
       # overlays.

     

       8
       8
        
       #

     

       9
       9
       -
       # Another value that's needed if you don't use a custom resolver (see below for

     

       10
       10
       -
       # notes on that) is to add the acme node as a nameserver to every node

     

       11
       11
       -
       # that needs to acquire certificates using ACME, because otherwise the API host

     

       12
       12
       -
       # for acme.test can't be resolved.

     

       13
       13
       -
       #

     

       14
       14
       -
       # A configuration example of a full node setup using this would be this:

     

       15
       15
       -
       #

     

       16
       16
       -
       # {

     

       17
       17
       -
       #   acme = import ./common/acme/server;

     

       18
       18
       -
       #

     

       19
       19
       -
       #   example = { nodes, ... }: {

     

       20
       20
       -
       #     networking.nameservers = [

     

       21
       21
       -
       #       nodes.acme.networking.primaryIPAddress

     

       22
       22
       -
       #     ];

     

       23
       23
       -
       #     security.pki.certificateFiles = [

     

       24
       24
       -
       #       nodes.acme.test-support.acme.caCert

     

       25
       25
       -
       #     ];

     

       26
       26
       -
       #   };

     

       27
       27
       -
       # }

     

       28
       28
       -
       #

     

       29
       29
       -
       # By default, this module runs a local resolver, generated using resolver.nix

     

       30
       30
       -
       # from the parent directory to automatically discover all zones in the network.

     

       31
       31
       -
       #

     

       32
       32
       -
       # If you do not want this and want to use your own resolver, you can just

     

       33
       33
       -
       # override networking.nameservers like this:

     

       34
       34
       -
       #

     

       35
       35
       -
       # {

     

       36
       36
       -
       #   acme = { nodes, lib, ... }: {

     

       37
       37
       -
       #     imports = [ ./common/acme/server ];

     

       38
       38
       -
       #     networking.nameservers = lib.mkForce [

     

       39
       39
       -
       #       nodes.myresolver.networking.primaryIPAddress

     

       40
       40
       -
       #     ];

     

       41
       41
       -
       #   };

     

       42
       42
       -
       #

     

       43
       43
       -
       #   myresolver = ...;

     

       44
       44
       -
       # }

     

       45
       45
       -
       #

     

       46
       46
       -
       # Keep in mind, that currently only _one_ resolver is supported, if you have

     

       47
       47
       -
       # more than one resolver in networking.nameservers only the first one will be

     

       48
       48
       -
       # used.

     

       49
       49
       -
       #

     

       50
       50
       -
       # Also make sure that whenever you use a resolver from a different test node

     

       51
       51
       -
       # that it has to be started _before_ the ACME service.

     

       9
       9
       +
       # The hosts file of this node will be populated with a mapping of certificate

     

       10
       10
       +
       # domains (including extraDomainNames) to their parent nodes in the test suite.

     

       11
       11
       +
       # This negates the need for a DNS server for most testing. You can still specify

     

       12
       12
       +
       # a custom nameserver/resolver if necessary for other reasons.

     

       52
       13
        
       {

     

       53
       14
        
         config,

     

       54
       15
        
         pkgs,

     

       55
       16
        
         lib,

     

       17
       17
       +
         nodes ? { },

     

       56
       18
        
         ...

     

       57
       19
        
       }:

     

       58
       20
        
       let

     
···

       75
       37
        
       

     

       76
       38
        
       in

     

       77
       39
        
       {

     

       78
       78
       -
         imports = [ ../../resolver.nix ];

     

       79
       79
       -
       

     

       80
       40
        
         options.test-support.acme = {

     

       81
       41
        
           caDomain = lib.mkOption {

     

       82
       42
        
             type = lib.types.str;

     
···

       100
       60
        
         };

     

       101
       61
        
       

     

       102
       62
        
         config = {

     

       103
       103
       -
           test-support = {

     

       104
       104
       -
             resolver.enable =

     

       63
       63
       +
           networking = {

     

       64
       64
       +
             firewall.allowedTCPPorts = [

     

       65
       65
       +
               80

     

       66
       66
       +
               443

     

       67
       67
       +
               15000

     

       68
       68
       +
               4002

     

       69
       69
       +
             ];

     

       70
       70
       +
       

     

       71
       71
       +
             # Match the caDomain - nixos/lib/testing/network.nix will then add a record for us to

     

       72
       72
       +
             # all nodes in /etc/hosts

     

       73
       73
       +
             hostName = "acme";

     

       74
       74
       +
             domain = "test";

     

       75
       75
       +
       

     

       76
       76
       +
             # Extend /etc/hosts to resolve all configured certificates to their hosts.

     

       77
       77
       +
             # This way, no DNS server will be needed to validate HTTP-01 certs.

     

       78
       78
       +
             hosts = lib.attrsets.concatMapAttrs (

     

       79
       79
       +
               _: node:

     

       105
       80
        
               let

     

       106
       106
       -
                 isLocalResolver = config.networking.nameservers == [ "127.0.0.1" ];

     

       81
       81
       +
                 inherit (node.networking) primaryIPAddress primaryIPv6Address;

     

       82
       82
       +
                 ips = builtins.filter (ip: ip != "") [

     

       83
       83
       +
                   primaryIPAddress

     

       84
       84
       +
                   primaryIPv6Address

     

       85
       85
       +
                 ];

     

       86
       86
       +
                 names = lib.lists.unique (

     

       87
       87
       +
                   lib.lists.flatten (

     

       88
       88
       +
                     lib.lists.concatMap

     

       89
       89
       +
                       (

     

       90
       90
       +
                         cfg:

     

       91
       91
       +
                         lib.attrsets.mapAttrsToList (

     

       92
       92
       +
                           domain: cfg:

     

       93
       93
       +
                           builtins.map (builtins.replaceStrings [ "*." ] [ "" ]) ([ domain ] ++ cfg.extraDomainNames)

     

       94
       94
       +
                         ) cfg.configuration.security.acme.certs

     

       95
       95
       +
                       )

     

       96
       96
       +
                       # A specialisation's config is nested under its configuration attribute.

     

       97
       97
       +
                       # For ease of use, nest the root node's configuration simiarly.

     

       98
       98
       +
                       ([ { configuration = node; } ] ++ (builtins.attrValues node.specialisation))

     

       99
       99
       +
                   )

     

       100
       100
       +
                 );

     

       107
       101
        
               in

     

       108
       108
       -
               lib.mkOverride 900 isLocalResolver;

     

       102
       102
       +
               builtins.listToAttrs (builtins.map (ip: lib.attrsets.nameValuePair ip names) ips)

     

       103
       103
       +
             ) nodes;

     

       109
       104
        
           };

     

       110
       105
        
       

     

       111
       111
       -
           # This has priority 140, because modules/testing/test-instrumentation.nix

     

       112
       112
       -
           # already overrides this with priority 150.

     

       113
       113
       -
           networking.nameservers = lib.mkOverride 140 [ "127.0.0.1" ];

     

       114
       114
       -
           networking.firewall.allowedTCPPorts = [

     

       115
       115
       -
             80

     

       116
       116
       -
             443

     

       117
       117
       -
             15000

     

       118
       118
       -
             4002

     

       119
       119
       -
           ];

     

       120
       120
       -
       

     

       121
       121
       -
           networking.extraHosts = ''

     

       122
       122
       -
             127.0.0.1 ${domain}

     

       123
       123
       -
             ${config.networking.primaryIPAddress} ${domain}

     

       124
       124
       -
           '';

     

       125
       125
       -
       

     

       126
       106
        
           systemd.services = {

     

       127
       107
        
             pebble = {

     

       128
       108
        
               enable = true;

     
···

       130
       110
        
               wantedBy = [ "network.target" ];

     

       131
       111
        
               environment = {

     

       132
       112
        
                 # We're not testing lego, we're just testing our configuration.

     

       133
       133
       -
                 # No need to sleep.

     

       113
       113
       +
                 # No need to sleep or randomly fail nonces.

     

       134
       114
        
                 PEBBLE_VA_NOSLEEP = "1";

     

       115
       115
       +
                 PEBBLE_WFE_NONCEREJECT = "0";

     

       135
       116
        
               };

     

       136
       117
        
       

     

       137
       118
        
               serviceConfig = {

-184

nixos/tests/common/resolver.nix

···

       1
       1
       -
       # This module automatically discovers zones in BIND and NSD NixOS

     

       2
       2
       -
       # configurations and creates zones for all definitions of networking.extraHosts

     

       3
       3
       -
       # (except those that point to 127.0.0.1 or ::1) within the current test network

     

       4
       4
       -
       # and delegates these zones using a fake root zone served by a BIND recursive

     

       5
       5
       -
       # name server.

     

       6
       6
       -
       {

     

       7
       7
       -
         config,

     

       8
       8
       -
         nodes,

     

       9
       9
       -
         pkgs,

     

       10
       10
       -
         lib,

     

       11
       11
       -
         ...

     

       12
       12
       -
       }:

     

       13
       13
       -
       

     

       14
       14
       -
       {

     

       15
       15
       -
         options.test-support.resolver.enable = lib.mkOption {

     

       16
       16
       -
           type = lib.types.bool;

     

       17
       17
       -
           default = true;

     

       18
       18
       -
           internal = true;

     

       19
       19
       -
           description = ''

     

       20
       20
       -
             Whether to enable the resolver that automatically discovers zone in the

     

       21
       21
       -
             test network.

     

       22
       22
       -
       

     

       23
       23
       -
             This option is `true` by default, because the module

     

       24
       24
       -
             defining this option needs to be explicitly imported.

     

       25
       25
       -
       

     

       26
       26
       -
             The reason this option exists is for the

     

       27
       27
       -
             {file}`nixos/tests/common/acme/server` module, which

     

       28
       28
       -
             needs that option to disable the resolver once the user has set its own

     

       29
       29
       -
             resolver.

     

       30
       30
       -
           '';

     

       31
       31
       -
         };

     

       32
       32
       -
       

     

       33
       33
       -
         config = lib.mkIf config.test-support.resolver.enable {

     

       34
       34
       -
           networking.firewall.enable = false;

     

       35
       35
       -
           services.bind.enable = true;

     

       36
       36
       -
           services.bind.cacheNetworks = lib.mkForce [ "any" ];

     

       37
       37
       -
           services.bind.forwarders = lib.mkForce [ ];

     

       38
       38
       -
           services.bind.zones = lib.singleton {

     

       39
       39
       -
             name = ".";

     

       40
       40
       -
             master = true;

     

       41
       41
       -
             file =

     

       42
       42
       -
               let

     

       43
       43
       -
                 addDot = zone: zone + lib.optionalString (!lib.hasSuffix "." zone) ".";

     

       44
       44
       -
                 mkNsdZoneNames = zones: map addDot (lib.attrNames zones);

     

       45
       45
       -
                 mkBindZoneNames = zones: map addDot (lib.attrNames zones);

     

       46
       46
       -
                 getZones = cfg: mkNsdZoneNames cfg.services.nsd.zones ++ mkBindZoneNames cfg.services.bind.zones;

     

       47
       47
       -
       

     

       48
       48
       -
                 getZonesForNode = attrs: {

     

       49
       49
       -
                   ip = attrs.config.networking.primaryIPAddress;

     

       50
       50
       -
                   zones = lib.filter (zone: zone != ".") (getZones attrs.config);

     

       51
       51
       -
                 };

     

       52
       52
       -
       

     

       53
       53
       -
                 zoneInfo = lib.mapAttrsToList (lib.const getZonesForNode) nodes;

     

       54
       54
       -
       

     

       55
       55
       -
                 # A and AAAA resource records for all the definitions of

     

       56
       56
       -
                 # networking.extraHosts except those for 127.0.0.1 or ::1.

     

       57
       57
       -
                 #

     

       58
       58
       -
                 # The result is an attribute set with keys being the host name and the

     

       59
       59
       -
                 # values are either { ipv4 = ADDR; } or { ipv6 = ADDR; } where ADDR is

     

       60
       60
       -
                 # the IP address for the corresponding key.

     

       61
       61
       -
                 recordsFromExtraHosts =

     

       62
       62
       -
                   let

     

       63
       63
       -
                     getHostsForNode = lib.const (n: n.config.networking.extraHosts);

     

       64
       64
       -
                     allHostsList = lib.mapAttrsToList getHostsForNode nodes;

     

       65
       65
       -
                     allHosts = lib.concatStringsSep "\n" allHostsList;

     

       66
       66
       -
       

     

       67
       67
       -
                     reIp = "[a-fA-F0-9.:]+";

     

       68
       68
       -
                     reHost = "[a-zA-Z0-9.-]+";

     

       69
       69
       -
       

     

       70
       70
       -
                     matchAliases =

     

       71
       71
       -
                       str:

     

       72
       72
       -
                       let

     

       73
       73
       -
                         matched = builtins.match "[ \t]+(${reHost})(.*)" str;

     

       74
       74
       -
                         continue = lib.singleton (lib.head matched) ++ matchAliases (lib.last matched);

     

       75
       75
       -
                       in

     

       76
       76
       -
                       lib.optional (matched != null) continue;

     

       77
       77
       -
       

     

       78
       78
       -
                     matchLine =

     

       79
       79
       -
                       str:

     

       80
       80
       -
                       let

     

       81
       81
       -
                         result = builtins.match "[ \t]*(${reIp})[ \t]+(${reHost})(.*)" str;

     

       82
       82
       -
                       in

     

       83
       83
       -
                       if result == null then

     

       84
       84
       -
                         null

     

       85
       85
       -
                       else

     

       86
       86
       -
                         {

     

       87
       87
       -
                           ipAddr = lib.head result;

     

       88
       88
       -
                           hosts = lib.singleton (lib.elemAt result 1) ++ matchAliases (lib.last result);

     

       89
       89
       -
                         };

     

       90
       90
       -
       

     

       91
       91
       -
                     skipLine =

     

       92
       92
       -
                       str:

     

       93
       93
       -
                       let

     

       94
       94
       -
                         rest = builtins.match "[^\n]*\n(.*)" str;

     

       95
       95
       -
                       in

     

       96
       96
       -
                       if rest == null then "" else lib.head rest;

     

       97
       97
       -
       

     

       98
       98
       -
                     getEntries =

     

       99
       99
       -
                       str: acc:

     

       100
       100
       -
                       let

     

       101
       101
       -
                         result = matchLine str;

     

       102
       102
       -
                         next = getEntries (skipLine str);

     

       103
       103
       -
                         newEntry = acc ++ lib.singleton result;

     

       104
       104
       -
                         continue = if result == null then next acc else next newEntry;

     

       105
       105
       -
                       in

     

       106
       106
       -
                       if str == "" then acc else continue;

     

       107
       107
       -
       

     

       108
       108
       -
                     isIPv6 = str: builtins.match ".*:.*" str != null;

     

       109
       109
       -
                     loopbackIps = [

     

       110
       110
       -
                       "127.0.0.1"

     

       111
       111
       -
                       "::1"

     

       112
       112
       -
                     ];

     

       113
       113
       -
                     filterLoopback = lib.filter (e: !lib.elem e.ipAddr loopbackIps);

     

       114
       114
       -
       

     

       115
       115
       -
                     allEntries = lib.concatMap (

     

       116
       116
       -
                       entry:

     

       117
       117
       -
                       map (host: {

     

       118
       118
       -
                         inherit host;

     

       119
       119
       -
                         ${if isIPv6 entry.ipAddr then "ipv6" else "ipv4"} = entry.ipAddr;

     

       120
       120
       -
                       }) entry.hosts

     

       121
       121
       -
                     ) (filterLoopback (getEntries (allHosts + "\n") [ ]));

     

       122
       122
       -
       

     

       123
       123
       -
                     mkRecords =

     

       124
       124
       -
                       entry:

     

       125
       125
       -
                       let

     

       126
       126
       -
                         records =

     

       127
       127
       -
                           lib.optional (entry ? ipv6) "AAAA ${entry.ipv6}"

     

       128
       128
       -
                           ++ lib.optional (entry ? ipv4) "A ${entry.ipv4}";

     

       129
       129
       -
                         mkRecord = typeAndData: "${entry.host}. IN ${typeAndData}";

     

       130
       130
       -
                       in

     

       131
       131
       -
                       lib.concatMapStringsSep "\n" mkRecord records;

     

       132
       132
       -
       

     

       133
       133
       -
                   in

     

       134
       134
       -
                   lib.concatMapStringsSep "\n" mkRecords allEntries;

     

       135
       135
       -
       

     

       136
       136
       -
                 # All of the zones that are subdomains of existing zones.

     

       137
       137
       -
                 # For example if there is only "example.com" the following zones would

     

       138
       138
       -
                 # be 'subZones':

     

       139
       139
       -
                 #

     

       140
       140
       -
                 #  * foo.example.com.

     

       141
       141
       -
                 #  * bar.example.com.

     

       142
       142
       -
                 #

     

       143
       143
       -
                 # While the following would *not* be 'subZones':

     

       144
       144
       -
                 #

     

       145
       145
       -
                 #  * example.com.

     

       146
       146
       -
                 #  * com.

     

       147
       147
       -
                 #

     

       148
       148
       -
                 subZones =

     

       149
       149
       -
                   let

     

       150
       150
       -
                     allZones = lib.concatMap (zi: zi.zones) zoneInfo;

     

       151
       151
       -
                     isSubZoneOf = z1: z2: lib.hasSuffix z2 z1 && z1 != z2;

     

       152
       152
       -
                   in

     

       153
       153
       -
                   lib.filter (z: lib.any (isSubZoneOf z) allZones) allZones;

     

       154
       154
       -
       

     

       155
       155
       -
                 # All the zones without 'subZones'.

     

       156
       156
       -
                 filteredZoneInfo = map (

     

       157
       157
       -
                   zi:

     

       158
       158
       -
                   zi

     

       159
       159
       -
                   // {

     

       160
       160
       -
                     zones = lib.filter (x: !lib.elem x subZones) zi.zones;

     

       161
       161
       -
                   }

     

       162
       162
       -
                 ) zoneInfo;

     

       163
       163
       -
       

     

       164
       164
       -
               in

     

       165
       165
       -
               pkgs.writeText "fake-root.zone" ''

     

       166
       166
       -
                 $TTL 3600

     

       167
       167
       -
                 . IN SOA ns.fakedns. admin.fakedns. ( 1 3h 1h 1w 1d )

     

       168
       168
       -
                 ns.fakedns. IN A ${config.networking.primaryIPAddress}

     

       169
       169
       -
                 . IN NS ns.fakedns.

     

       170
       170
       -
                 ${lib.concatImapStrings (

     

       171
       171
       -
                   num:

     

       172
       172
       -
                   { ip, zones }:

     

       173
       173
       -
                   ''

     

       174
       174
       -
                     ns${toString num}.fakedns. IN A ${ip}

     

       175
       175
       -
                     ${lib.concatMapStrings (zone: ''

     

       176
       176
       -
                       ${zone} IN NS ns${toString num}.fakedns.

     

       177
       177
       -
                     '') zones}

     

       178
       178
       -
                   ''

     

       179
       179
       -
                 ) (lib.filter (zi: zi.zones != [ ]) filteredZoneInfo)}

     

       180
       180
       -
                 ${recordsFromExtraHosts}

     

       181
       181
       -
               '';

     

       182
       182
       -
           };

     

       183
       183
       -
         };

     

       184
       184
       -
       }

+4 -1

nixos/tests/web-apps/gotosocial.nix

···

       13
       13
        
               settings = {

     

       14
       14
        
                 host = "localhost:8081";

     

       15
       15
        
                 port = 8081;

     

       16
       16
       +
                 instance-stats-mode = "serve";

     

       16
       17
        
               };

     

       17
       18
        
             };

     

       18
       19
        
           };

     
···

       21
       22
        
           machine.wait_for_unit("gotosocial.service")

     

       22
       23
        
           machine.wait_for_unit("postgresql.service")

     

       23
       24
        
           machine.wait_for_open_port(8081)

     

       25
       25
       +
           # Database migrations are running, wait until gotosocial no longer serves 503

     

       26
       26
       +
           machine.wait_until_succeeds("curl -sS -f http://localhost:8081/readyz", timeout=300)

     

       24
       27
        
       

     

       25
       28
        
           # check user registration via cli

     

       26
       29
        
           machine.succeed("gotosocial-admin account create --username nickname --email email@example.com --password kurtz575VPeBgjVm")

     

       27
       27
       -
           machine.succeed("curl -sS -f http://localhost:8081/nodeinfo/2.0 | jq '.usage.users.total' | grep -q '^1$'")

     

       30
       30
       +
           machine.wait_until_succeeds("curl -sS -f http://localhost:8081/nodeinfo/2.0 | jq '.usage.users.total' | grep -q '^1$'")

     

       28
       31
        
         '';

     

       29
       32
        
       }

nixos/tests/web-servers/h2o/default.nix

···

       13
       13
        
       {

     

       14
       14
        
         basic = handleTestOn supportedSystems ./basic.nix { inherit system; };

     

       15
       15
        
         mruby = handleTestOn supportedSystems ./mruby.nix { inherit system; };

     

       16
       16
       +
         tls-recommendations = handleTestOn supportedSystems ./tls-recommendations.nix { inherit system; };

     

       16
       17
        
       }

+115

nixos/tests/web-servers/h2o/tls-recommendations.nix

···

       1
       1
       +
       import ../../make-test-python.nix (

     

       2
       2
       +
         { lib, pkgs, ... }:

     

       3
       3
       +
       

     

       4
       4
       +
         let

     

       5
       5
       +
           domain = "acme.test";

     

       6
       6
       +
           port = 8443;

     

       7
       7
       +
       

     

       8
       8
       +
           hello_txt =

     

       9
       9
       +
             name:

     

       10
       10
       +
             pkgs.writeTextFile {

     

       11
       11
       +
               name = "/hello_${name}.txt";

     

       12
       12
       +
               text = "Hello, ${name}!";

     

       13
       13
       +
             };

     

       14
       14
       +
       

     

       15
       15
       +
           mkH2OServer =

     

       16
       16
       +
             recommendations:

     

       17
       17
       +
             { pkgs, lib, ... }:

     

       18
       18
       +
             {

     

       19
       19
       +
               services.h2o = {

     

       20
       20
       +
                 enable = true;

     

       21
       21
       +
                 package = pkgs.h2o.override (

     

       22
       22
       +
                   lib.optionalAttrs

     

       23
       23
       +
                     (builtins.elem recommendations [

     

       24
       24
       +
                       "intermediate"

     

       25
       25
       +
                       "old"

     

       26
       26
       +
                     ])

     

       27
       27
       +
                     {

     

       28
       28
       +
                       openssl = pkgs.openssl_legacy;

     

       29
       29
       +
                     }

     

       30
       30
       +
                 );

     

       31
       31
       +
                 defaultTLSRecommendations = "modern"; # prove overridden

     

       32
       32
       +
                 hosts = {

     

       33
       33
       +
                   "${domain}" = {

     

       34
       34
       +
                     tls = {

     

       35
       35
       +
                       inherit port recommendations;

     

       36
       36
       +
                       policy = "force";

     

       37
       37
       +
                       identity = [

     

       38
       38
       +
                         {

     

       39
       39
       +
                           key-file = ../../common/acme/server/acme.test.key.pem;

     

       40
       40
       +
                           certificate-file = ../../common/acme/server/acme.test.cert.pem;

     

       41
       41
       +
                         }

     

       42
       42
       +
                       ];

     

       43
       43
       +
                     };

     

       44
       44
       +
                     settings = {

     

       45
       45
       +
                       paths."/"."file.file" = "${hello_txt recommendations}";

     

       46
       46
       +
                     };

     

       47
       47
       +
                   };

     

       48
       48
       +
                 };

     

       49
       49
       +
                 settings = {

     

       50
       50
       +
                   ssl-offload = "kernel";

     

       51
       51
       +
                 };

     

       52
       52
       +
               };

     

       53
       53
       +
       

     

       54
       54
       +
               security.pki.certificates = [

     

       55
       55
       +
                 (builtins.readFile ../../common/acme/server/ca.cert.pem)

     

       56
       56
       +
               ];

     

       57
       57
       +
       

     

       58
       58
       +
               networking = {

     

       59
       59
       +
                 firewall.allowedTCPPorts = [ port ];

     

       60
       60
       +
                 extraHosts = "127.0.0.1 ${domain}";

     

       61
       61
       +
               };

     

       62
       62
       +
             };

     

       63
       63
       +
         in

     

       64
       64
       +
         {

     

       65
       65
       +
           name = "h2o-tls-recommendations";

     

       66
       66
       +
       

     

       67
       67
       +
           meta = {

     

       68
       68
       +
             maintainers = with lib.maintainers; [ toastal ];

     

       69
       69
       +
           };

     

       70
       70
       +
       

     

       71
       71
       +
           nodes = {

     

       72
       72
       +
             server_modern = mkH2OServer "modern";

     

       73
       73
       +
             server_intermediate = mkH2OServer "intermediate";

     

       74
       74
       +
             server_old = mkH2OServer "old";

     

       75
       75
       +
           };

     

       76
       76
       +
       

     

       77
       77
       +
           testScript =

     

       78
       78
       +
             let

     

       79
       79
       +
               portStr = builtins.toString port;

     

       80
       80
       +
             in

     

       81
       81
       +
             # python

     

       82
       82
       +
             ''

     

       83
       83
       +
               curl_basic = "curl -v --tlsv1.3 --http2 'https://${domain}:${portStr}/'"

     

       84
       84
       +
               curl_head = "curl -v --head 'https://${domain}:${portStr}/'"

     

       85
       85
       +
               curl_max_tls1_2 ="curl -v --tlsv1.0 --tls-max 1.2 'https://${domain}:${portStr}/'"

     

       86
       86
       +
               curl_max_tls1_2_intermediate_cipher ="curl -v --tlsv1.0 --tls-max 1.2 --ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256' 'https://${domain}:${portStr}/'"

     

       87
       87
       +
               curl_max_tls1_2_old_cipher ="curl -v --tlsv1.0 --tls-max 1.2 --ciphers 'ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA256' 'https://${domain}:${portStr}/'"

     

       88
       88
       +
       

     

       89
       89
       +
               server_modern.wait_for_unit("h2o.service")

     

       90
       90
       +
               modern_response = server_modern.succeed(curl_basic)

     

       91
       91
       +
               assert "Hello, modern!" in modern_response

     

       92
       92
       +
               modern_head = server_modern.succeed(curl_head)

     

       93
       93
       +
               assert "strict-transport-security" in modern_head

     

       94
       94
       +
               server_modern.fail(curl_max_tls1_2)

     

       95
       95
       +
       

     

       96
       96
       +
               server_intermediate.wait_for_unit("h2o.service")

     

       97
       97
       +
               intermediate_response = server_intermediate.succeed(curl_basic)

     

       98
       98
       +
               assert "Hello, intermediate!" in intermediate_response

     

       99
       99
       +
               intermediate_head = server_modern.succeed(curl_head)

     

       100
       100
       +
               assert "strict-transport-security" in intermediate_head

     

       101
       101
       +
               server_intermediate.succeed(curl_max_tls1_2)

     

       102
       102
       +
               server_intermediate.succeed(curl_max_tls1_2_intermediate_cipher)

     

       103
       103
       +
               server_intermediate.fail(curl_max_tls1_2_old_cipher)

     

       104
       104
       +
       

     

       105
       105
       +
               server_old.wait_for_unit("h2o.service")

     

       106
       106
       +
               old_response = server_old.succeed(curl_basic)

     

       107
       107
       +
               assert "Hello, old!" in old_response

     

       108
       108
       +
               old_head = server_modern.succeed(curl_head)

     

       109
       109
       +
               assert "strict-transport-security" in old_head

     

       110
       110
       +
               server_old.succeed(curl_max_tls1_2)

     

       111
       111
       +
               server_old.succeed(curl_max_tls1_2_intermediate_cipher)

     

       112
       112
       +
               server_old.succeed(curl_max_tls1_2_old_cipher)

     

       113
       113
       +
             '';

     

       114
       114
       +
         }

     

       115
       115
       +
       )

+3 -3

pkgs/applications/blockchains/polkadot/default.nix

···

       18
       18
        
       in

     

       19
       19
        
       rustPlatform.buildRustPackage rec {

     

       20
       20
        
         pname = "polkadot";

     

       21
       21
       -
         version = "2412-1";

     

       21
       21
       +
         version = "2412-2";

     

       22
       22
        
       

     

       23
       23
        
         src = fetchFromGitHub {

     

       24
       24
        
           owner = "paritytech";

     

       25
       25
        
           repo = "polkadot-sdk";

     

       26
       26
        
           rev = "polkadot-stable${version}";

     

       27
       27
       -
           hash = "sha256-wvtK+xbq8MLx77ad+x8gzPyL5ScFxHFt6rlZUAzc0CU=";

     

       27
       27
       +
           hash = "sha256-iFlC/KQaq7RoQqnlOjIwxrMBdwarrNXfKyE2b1XXfzU=";

     

       28
       28
        
       

     

       29
       29
        
           # the build process of polkadot requires a .git folder in order to determine

     

       30
       30
        
           # the git commit hash that is being built and add it to the version string.

     
···

       46
       46
        
         '';

     

       47
       47
        
       

     

       48
       48
        
         useFetchCargoVendor = true;

     

       49
       49
       -
         cargoHash = "sha256-c88vE2DxjngARu0NSZR4NVEYK4OiSxIETVRY6K5CbVs=";

     

       49
       49
       +
         cargoHash = "sha256-P/pNmW6vQAB4gEDaPFYJQsqUlSBSX1krcU7C6ngRk5Q=";

     

       50
       50
        
       

     

       51
       51
        
         buildType = "production";

     

       52
       52
        
         buildAndTestSubdir = "polkadot";

+18 -16

pkgs/applications/misc/qelectrotech/default.nix

···

       1
       1
        
       {

     

       2
       2
        
         lib,

     

       3
       3
        
         stdenv,

     

       4
       4
       -
         mkDerivation,

     

       5
       5
       -
         fetchzip,

     

       4
       4
       +
         fetchFromGitHub,

     

       6
       5
        
         installShellFiles,

     

       7
       6
        
         pkg-config,

     

       8
       7
        
         qmake,

     

       9
       8
        
         qtbase,

     

       10
       9
        
         kcoreaddons,

     

       11
       10
        
         kwidgetsaddons,

     

       11
       11
       +
         qtsvg,

     

       12
       12
       +
         wrapQtAppsHook,

     

       12
       13
        
       }:

     

       13
       14
        
       

     

       14
       14
       -
       mkDerivation rec {

     

       15
       15
       +
       stdenv.mkDerivation rec {

     

       15
       16
        
         pname = "qelectrotech";

     

       16
       16
       -
         version = "0.8.0";

     

       17
       17
       +
         version = "0.9.0";

     

       17
       18
        
       

     

       18
       18
       -
         src = fetchzip {

     

       19
       19
       -
           url = "https://git.tuxfamily.org/qet/qet.git/snapshot/qet-${version}.tar.gz";

     

       20
       20
       -
           sha256 = "sha256-op2vnMPF9bNnHGphWFB/HEeoThE6tX+9UvX8LWVwkzI=";

     

       19
       19
       +
         src = fetchFromGitHub {

     

       20
       20
       +
           owner = "qelectrotech";

     

       21
       21
       +
           repo = "qelectrotech-source-mirror";

     

       22
       22
       +
           tag = "0.9";

     

       23
       23
       +
           hash = "sha256-tj8q+mRVtdeDXbpiv4retdbNiIfvAFlutXn7BmjqFYU=";

     

       21
       24
        
         };

     

       22
       25
        
       

     

       23
       26
        
         postPatch = ''

     

       24
       27
        
           substituteInPlace qelectrotech.pro \

     

       25
       25
       -
             --replace 'GIT_COMMIT_SHA="\\\"$(shell git -C \""$$_PRO_FILE_PWD_"\" rev-parse --verify HEAD)\\\""' \

     

       28
       28
       +
             --replace-fail 'GIT_COMMIT_SHA="\\\"$(shell git -C \""$$_PRO_FILE_PWD_"\" rev-parse --verify HEAD)\\\""' \

     

       26
       29
        
                       'GIT_COMMIT_SHA="\\\"${version}\\\""' \

     

       27
       27
       -
             --replace "COMPIL_PREFIX              = '/usr/local/'" \

     

       30
       30
       +
             --replace-fail "COMPIL_PREFIX              = '/usr/local/'" \

     

       28
       31
        
                       "COMPIL_PREFIX              = '$out/'" \

     

       29
       29
       -
             --replace "INSTALL_PREFIX             = '/usr/local/'" \

     

       32
       32
       +
             --replace-fail "INSTALL_PREFIX             = '/usr/local/'" \

     

       30
       33
        
                       "INSTALL_PREFIX             = '$out/'"

     

       31
       34
        
         '';

     

       32
       35
        
       

     
···

       34
       37
        
           installShellFiles

     

       35
       38
        
           pkg-config

     

       36
       39
        
           qmake

     

       40
       40
       +
           wrapQtAppsHook

     

       37
       41
        
         ];

     

       38
       42
        
       

     

       39
       43
        
         buildInputs = [

     

       40
       44
        
           kcoreaddons

     

       41
       45
        
           kwidgetsaddons

     

       42
       46
        
           qtbase

     

       47
       47
       +
           qtsvg

     

       43
       48
        
         ];

     

       44
       49
        
       

     

       45
       50
        
         qmakeFlags = [

     
···

       52
       57
        
           install -Dm555 qelectrotech $out/bin/qelectrotech

     

       53
       58
        
       

     

       54
       59
        
           install -Dm444 -t $out/share/applications misc/qelectrotech.desktop

     

       55
       55
       -
           install -Dm444 -t $out/share/applications misc/x-qet-titleblock.desktop

     

       56
       56
       -
           install -Dm444 -t $out/share/applications misc/x-qet-element.desktop

     

       57
       57
       -
           install -Dm444 -t $out/share/applications misc/x-qet-project.desktop

     

       58
       60
        
       

     

       59
       61
        
           mkdir -p $out/share/qelectrotech

     

       60
       62
        
           cp -r elements $out/share/qelectrotech

     
···

       68
       70
        
           runHook postInstall

     

       69
       71
        
         '';

     

       70
       72
        
       

     

       71
       71
       -
         meta = with lib; {

     

       73
       73
       +
         meta = {

     

       72
       74
        
           description = "Free software to create electric diagrams";

     

       73
       75
        
           mainProgram = "qelectrotech";

     

       74
       76
        
           homepage = "https://qelectrotech.org/";

     

       75
       75
       -
           license = licenses.gpl2;

     

       76
       76
       -
           maintainers = with maintainers; [ yvesf ];

     

       77
       77
       +
           license = lib.licenses.gpl2;

     

       78
       78
       +
           maintainers = with lib.maintainers; [ yvesf ];

     

       77
       79
        
           platforms = qtbase.meta.platforms;

     

       78
       80
        
           broken = stdenv.hostPlatform.isDarwin;

     

       79
       81
        
         };

+2 -2

pkgs/applications/networking/browsers/firefox/wrapper.nix

···

       1
       1
       -
       { stdenv, lib, makeDesktopItem, makeBinaryWrapper, lndir, config

     

       1
       1
       +
       { stdenv, lib, makeDesktopItem, makeWrapper, lndir, config

     

       2
       2
        
       , buildPackages

     

       3
       3
        
       , jq, xdg-utils, writeText

     

       4
       4
        
       

     
···

       219
       219
        
                     };

     

       220
       220
        
                   }));

     

       221
       221
        
       

     

       222
       222
       -
             nativeBuildInputs = [ makeBinaryWrapper lndir jq ];

     

       222
       222
       +
             nativeBuildInputs = [ makeWrapper lndir jq ];

     

       223
       223
        
             buildInputs = [ browser.gtk3 ];

     

       224
       224
        
       

     

       225
       225
        
             makeWrapperArgs = [

+5 -2

pkgs/applications/science/math/glsurf/default.nix

···

       50
       50
        
           ]);

     

       51
       51
        
       

     

       52
       52
        
         postPatch = ''

     

       53
       53
       -
           for f in callbacks*/Makefile src/Makefile; do

     

       54
       54
       -
             substituteInPlace "$f" --replace "+camlp4" \

     

       53
       53
       +
           for f in callbacks*/Makefile; do

     

       54
       54
       +
             substituteInPlace "$f" --replace-warn "+camlp4" \

     

       55
       55
        
               "${ocamlPackages.camlp4}/lib/ocaml/${ocamlPackages.ocaml.version}/site-lib/camlp4"

     

       56
       56
        
           done

     

       57
       57
        
       

     

       58
       58
        
           # Fatal error: exception Sys_error("Mutex.unlock: Operation not permitted")

     

       59
       59
        
           sed -i "/gl_started/d" src/draw.ml* src/main.ml

     

       60
       60
       +
       

     

       61
       61
       +
           # Compatibility with camlimages ≥ 5.0.5

     

       62
       62
       +
           substituteInPlace src/Makefile --replace-warn camlimages.all_formats camlimages.core

     

       60
       63
        
         '';

     

       61
       64
        
       

     

       62
       65
        
         installPhase = ''

+9 -10

pkgs/applications/video/obs-studio/plugins/obs-source-switcher.nix

···

       6
       6
        
         obs-studio,

     

       7
       7
        
       }:

     

       8
       8
        
       

     

       9
       9
       -
       stdenv.mkDerivation rec {

     

       9
       9
       +
       stdenv.mkDerivation {

     

       10
       10
        
         pname = "obs-source-switcher";

     

       11
       11
       -
         version = "0.4.1";

     

       11
       11
       +
         version = "0.4.3";

     

       12
       12
        
       

     

       13
       13
        
         src = fetchFromGitHub {

     

       14
       14
        
           owner = "exeldro";

     

       15
       15
        
           repo = "obs-source-switcher";

     

       16
       16
       -
           rev = "8babf207d140e52114b6db63d98749d7a0a2758b";

     

       17
       17
       -
           sha256 = "sha256-J/NdIGsSXCtSOGF72pJZqqN5Y73eJfrA72LgZcTlP5o=";

     

       16
       16
       +
           rev = "b229f40faceb0bb39cea41ce0ce2f2f236c0cbd1";

     

       17
       17
       +
           hash = "sha256-5io2uMvPdHQAWFDqLyXLC6nxTEjkrk8v4v8XwGsPF7U=";

     

       18
       18
        
         };

     

       19
       19
        
       

     

       20
       20
        
         nativeBuildInputs = [ cmake ];

     

       21
       21
       +
       

     

       21
       22
        
         buildInputs = [ obs-studio ];

     

       22
       23
        
       

     

       23
       23
       -
         cmakeFlags = [

     

       24
       24
       -
           "-DBUILD_OUT_OF_TREE=On"

     

       25
       25
       -
         ];

     

       24
       24
       +
         cmakeFlags = [ "-DBUILD_OUT_OF_TREE=On" ];

     

       26
       25
        
       

     

       27
       26
        
         postInstall = ''

     

       28
       27
        
           rm -rf $out/obs-plugins $out/data

     

       29
       28
        
         '';

     

       30
       29
        
       

     

       31
       31
       -
         meta = with lib; {

     

       30
       30
       +
         meta = {

     

       32
       31
        
           description = "Plugin for OBS Studio to switch between a list of sources";

     

       33
       32
        
           homepage = "https://github.com/exeldro/obs-source-switcher";

     

       34
       34
       -
           maintainers = with maintainers; [ flexiondotorg ];

     

       35
       35
       -
           license = licenses.gpl2Plus;

     

       33
       33
       +
           maintainers = with lib.maintainers; [ flexiondotorg ];

     

       34
       34
       +
           license = lib.licenses.gpl2Plus;

     

       36
       35
        
           platforms = [

     

       37
       36
        
             "x86_64-linux"

     

       38
       37
        
             "i686-linux"

+3 -3

pkgs/by-name/ai/aiken/package.nix

···

       10
       10
        
       

     

       11
       11
        
       rustPlatform.buildRustPackage rec {

     

       12
       12
        
         pname = "aiken";

     

       13
       13
       -
         version = "1.1.11";

     

       13
       13
       +
         version = "1.1.12";

     

       14
       14
        
       

     

       15
       15
        
         src = fetchFromGitHub {

     

       16
       16
        
           owner = "aiken-lang";

     

       17
       17
        
           repo = "aiken";

     

       18
       18
        
           rev = "v${version}";

     

       19
       19
       -
           hash = "sha256-RCMUF9+dj+zJM1tyuUs2oOMk+5xdHrzWYejuOPd/Ngc=";

     

       19
       19
       +
           hash = "sha256-QxIkqS+lqZjyuXUghSSd+4ud4Vrce7MgLrk2a5AQGmU=";

     

       20
       20
        
         };

     

       21
       21
        
       

     

       22
       22
        
         useFetchCargoVendor = true;

     

       23
       23
       -
         cargoHash = "sha256-R6jTr4F+ZbRracW8yQdpDHHerzbJy1jQYr/ttFSwCWc=";

     

       23
       23
       +
         cargoHash = "sha256-vbwYoBDTdAHCpCOJEdVo9Ir8wd4284pgYjyQuy/STHc=";

     

       24
       24
        
       

     

       25
       25
        
         buildInputs =

     

       26
       26
        
           [ openssl ]

+3 -3

pkgs/by-name/an/ankama-launcher/package.nix

···

       5
       5
        
       }:

     

       6
       6
        
       let

     

       7
       7
        
         pname = "ankama-launcher";

     

       8
       8
       -
         version = "3.12.30";

     

       8
       8
       +
         version = "3.12.35";

     

       9
       9
        
       

     

       10
       10
        
         # The original URL for the launcher is:

     

       11
       11
        
         # https://launcher.cdn.ankama.com/installers/production/Ankama%20Launcher-Setup-x86_64.AppImage

     

       12
       12
        
         # As it does not encode the version, we use the wayback machine (web.archive.org) to get a fixed URL.

     

       13
       13
        
         # To update the client, head to web.archive.org and create a new snapshot of the download page.

     

       14
       14
        
         src = fetchurl {

     

       15
       15
       -
           url = "https://web.archive.org/web/20250203095353/https://launcher.cdn.ankama.com/installers/production/Ankama%20Launcher-Setup-x86_64.AppImage";

     

       16
       16
       -
           hash = "sha256-qgWhC/xWUQpIoCNZcRxBPGpbNTFGysIF2N9a1MsxCFk=";

     

       15
       15
       +
           url = "https://web.archive.org/web/20250217184754/https://launcher.cdn.ankama.com/installers/production/Ankama%20Launcher-Setup-x86_64.AppImage";

     

       16
       16
       +
           hash = "sha256-/M5Wymahq0JWRgATRWoFoFFJ4qxu/cJvSqoz81/euug=";

     

       17
       17
        
         };

     

       18
       18
        
       

     

       19
       19
        
         appimageContents = appimageTools.extract { inherit pname version src; };

+3 -3

pkgs/by-name/ba/balena-cli/package.nix

···

       22
       22
        
       in

     

       23
       23
        
       buildNpmPackage' rec {

     

       24
       24
        
         pname = "balena-cli";

     

       25
       25
       -
         version = "20.2.3";

     

       25
       25
       +
         version = "20.2.7";

     

       26
       26
        
       

     

       27
       27
        
         src = fetchFromGitHub {

     

       28
       28
        
           owner = "balena-io";

     

       29
       29
        
           repo = "balena-cli";

     

       30
       30
        
           rev = "v${version}";

     

       31
       31
       -
           hash = "sha256-sJksNbsGBzH1tjqAv0kX++J7NCj1fu64Bi/i3Tp8R9E=";

     

       31
       31
       +
           hash = "sha256-D6GZRkA+O6vuz1ntUT8Hz0fCEv6xlHx7sG6BrLzJm/k=";

     

       32
       32
        
         };

     

       33
       33
        
       

     

       34
       34
       -
         npmDepsHash = "sha256-t1ZTQOuEvRcy9Zl9qqi8DDH2EVkjrBaTX4pTuRGl2ww=";

     

       34
       34
       +
         npmDepsHash = "sha256-x9/qwDJH0AlWehUlsFQdNHI53YWh2DHX/19VDA7vJc4=";

     

       35
       35
        
       

     

       36
       36
        
         postPatch = ''

     

       37
       37
        
           ln -s npm-shrinkwrap.json package-lock.json

pkgs/by-name/ca/caddy/package.nix

···

       77
       77
        
               command = "${caddy}/bin/caddy version";

     

       78
       78
        
               package = caddy;

     

       79
       79
        
             };

     

       80
       80
       +
             acme-integration = nixosTests.acme.caddy;

     

       80
       81
        
           };

     

       81
       82
        
           withPlugins = callPackage ./plugins.nix { inherit caddy; };

     

       82
       83
        
         };

+7 -4

pkgs/by-name/cl/claude-code/package-lock.json

···

       5
       5
        
         "packages": {

     

       6
       6
        
           "": {

     

       7
       7
        
             "dependencies": {

     

       8
       8
       -
               "@anthropic-ai/claude-code": "^0.2.9"

     

       8
       8
       +
               "@anthropic-ai/claude-code": "^0.2.14"

     

       9
       9
        
             }

     

       10
       10
        
           },

     

       11
       11
        
           "node_modules/@anthropic-ai/claude-code": {

     

       12
       12
       -
             "version": "0.2.9",

     

       13
       13
       -
             "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-0.2.9.tgz",

     

       14
       14
       -
             "integrity": "sha512-UGSEQbgDvhlEXC8rf5ASDXRSaq6Nfd4owY7k9bDdRhX9N5q8cMN+5vfTN1ezZhBcRFMOnpEK4eRSEgXW3eDeOQ==",

     

       12
       12
       +
             "version": "0.2.14",

     

       13
       13
       +
             "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-0.2.14.tgz",

     

       14
       14
       +
             "integrity": "sha512-p729wIUq9/K/TecpE64nzWKEZJ1qddn20eQg1nUoMdEQtwWjwWYiecwJ6lDxCmNRWr0ukC7ovu0Kgtmh+uOPYg==",

     

       15
       15
        
             "license": "SEE LICENSE IN README.md",

     

       16
       16
       +
             "os": [

     

       17
       17
       +
               "!win32"

     

       18
       18
       +
             ],

     

       16
       19
        
             "bin": {

     

       17
       20
        
               "claude": "cli.mjs"

     

       18
       21
        
             },

+3 -3

pkgs/by-name/cl/claude-code/package.nix

···

       6
       6
        
       

     

       7
       7
        
       buildNpmPackage rec {

     

       8
       8
        
         pname = "claude-code";

     

       9
       9
       -
         version = "0.2.9";

     

       9
       9
       +
         version = "0.2.14";

     

       10
       10
        
       

     

       11
       11
        
         src = fetchzip {

     

       12
       12
        
           url = "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-${version}.tgz";

     

       13
       13
       -
           hash = "sha256-NB+pfpXrjTvvs4o81dsLhyOCvDBCF6ANkAgTnxCaF9Q=";

     

       13
       13
       +
           hash = "sha256-Q/+Wa3RhY2XZc/0afAvCczLtnSVjoAWvhf2VEDHk+D8=";

     

       14
       14
        
         };

     

       15
       15
        
       

     

       16
       16
       -
         npmDepsHash = "sha256-2v9wCcaOgA3RezX/pnqigsn6XhKcqP2adM2IGRhiHgc=";

     

       16
       16
       +
         npmDepsHash = "sha256-61JgKMXN03LIWcCi9CrSGhtOUJmRurnSSdt2iYHYkEs=";

     

       17
       17
        
       

     

       18
       18
        
         postPatch = ''

     

       19
       19
        
           cp ${./package-lock.json} package-lock.json

+24 -23

pkgs/by-name/co/cosmic-applibrary/package.nix

···

       3
       3
        
         fetchFromGitHub,

     

       4
       4
        
         stdenv,

     

       5
       5
        
         rustPlatform,

     

       6
       6
       +
         libcosmicAppHook,

     

       6
       7
        
         just,

     

       7
       7
       -
         pkg-config,

     

       8
       8
       -
         makeBinaryWrapper,

     

       9
       9
       -
         libxkbcommon,

     

       10
       10
       -
         wayland,

     

       8
       8
       +
         nix-update-script,

     

       11
       9
        
       }:

     

       12
       10
        
       rustPlatform.buildRustPackage rec {

     

       13
       11
        
         pname = "cosmic-applibrary";

     

       14
       14
       -
         version = "0-unstable-2024-02-09";

     

       12
       12
       +
         version = "1.0.0-alpha.6";

     

       15
       13
        
       

     

       16
       14
        
         src = fetchFromGitHub {

     

       17
       15
        
           owner = "pop-os";

     

       18
       18
       -
           repo = pname;

     

       19
       19
       -
           rev = "e214e9867876c96b24568d8a45aaca2936269d9b";

     

       20
       20
       -
           hash = "sha256-fZxDRktiHHmj7X3e5VyJJMO081auOpSMSsBnJdhhtR8=";

     

       16
       16
       +
           repo = "cosmic-applibrary";

     

       17
       17
       +
           tag = "epoch-${version}";

     

       18
       18
       +
           hash = "sha256-hJOM5dZdLq6uYfhfspZzpbHgUOK/FWuIXuFPoisS8DU=";

     

       21
       19
        
         };

     

       22
       20
        
       

     

       23
       21
        
         useFetchCargoVendor = true;

     

       24
       24
       -
         cargoHash = "sha256-WCS1jCfnanILXGLq96+FI0gM1o4FIJQtSgZg86fe86E=";

     

       22
       22
       +
         cargoHash = "sha256-95jTSn0yYj2PNVtfumfD1rPf1yLXHUi60FBqENK8CSw=";

     

       25
       23
        
       

     

       26
       24
        
         nativeBuildInputs = [

     

       27
       25
        
           just

     

       28
       28
       -
           pkg-config

     

       29
       29
       -
           makeBinaryWrapper

     

       30
       30
       -
         ];

     

       31
       31
       -
         buildInputs = [

     

       32
       32
       -
           libxkbcommon

     

       33
       33
       -
           wayland

     

       26
       26
       +
           libcosmicAppHook

     

       34
       27
        
         ];

     

       35
       28
        
       

     

       36
       29
        
         dontUseJustBuild = true;

     

       30
       30
       +
         dontUseJustCheck = true;

     

       37
       31
        
       

     

       38
       32
        
         justFlags = [

     

       39
       33
        
           "--set"

     
···

       48
       42
        
           substituteInPlace justfile --replace '#!/usr/bin/env' "#!$(command -v env)"

     

       49
       43
        
         '';

     

       50
       44
        
       

     

       51
       51
       -
         postInstall = ''

     

       52
       52
       -
           wrapProgram $out/bin/cosmic-app-library \

     

       53
       53
       -
             --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ wayland ]}"

     

       54
       54
       -
         '';

     

       45
       45
       +
         passthru.updateScript = nix-update-script {

     

       46
       46
       +
           extraArgs = [

     

       47
       47
       +
             "--version"

     

       48
       48
       +
             "unstable"

     

       49
       49
       +
             "--version-regex"

     

       50
       50
       +
             "epoch-(.*)"

     

       51
       51
       +
           ];

     

       52
       52
       +
         };

     

       55
       53
        
       

     

       56
       56
       -
         meta = with lib; {

     

       54
       54
       +
         meta = {

     

       57
       55
        
           homepage = "https://github.com/pop-os/cosmic-applibrary";

     

       58
       56
        
           description = "Application Template for the COSMIC Desktop Environment";

     

       59
       59
       -
           license = licenses.gpl3Only;

     

       60
       60
       -
           maintainers = with maintainers; [ nyabinary ];

     

       61
       61
       -
           platforms = platforms.linux;

     

       57
       57
       +
           license = lib.licenses.gpl3Only;

     

       58
       58
       +
           maintainers = with lib.maintainers; [

     

       59
       59
       +
             nyabinary

     

       60
       60
       +
             HeitorAugustoLN

     

       61
       61
       +
           ];

     

       62
       62
       +
           platforms = lib.platforms.linux;

     

       62
       63
        
           mainProgram = "cosmic-app-library";

     

       63
       64
        
         };

     

       64
       65
        
       }

+2 -2

pkgs/by-name/ex/exiv2/package.nix

···

       20
       20
        
       

     

       21
       21
        
       stdenv.mkDerivation rec {

     

       22
       22
        
         pname = "exiv2";

     

       23
       23
       -
         version = "0.28.4";

     

       23
       23
       +
         version = "0.28.5";

     

       24
       24
        
       

     

       25
       25
        
         outputs = [

     

       26
       26
        
           "out"

     
···

       34
       34
        
           owner = "exiv2";

     

       35
       35
        
           repo = "exiv2";

     

       36
       36
        
           rev = "v${version}";

     

       37
       37
       -
           hash = "sha256-3xSN1erwNn//jrpO3fAG/jVb2jOSIBQNDd7HHKecJQg=";

     

       37
       37
       +
           hash = "sha256-+Fe0+wkWWtM3MNgY6qp34/kC8jkOjOLusnd9WquYpA8=";

     

       38
       38
        
         };

     

       39
       39
        
       

     

       40
       40
        
         nativeBuildInputs = [

+108 -378

pkgs/by-name/fs/fsautocomplete/deps.json

···

       60
       60
        
           "hash": "sha256-qLDLd8xZia6eDCt3PmZbnF6BtBBAHHYwe2CCPqTvSnY="

     

       61
       61
        
         },

     

       62
       62
        
         {

     

       63
       63
       +
           "pname": "fantomas",

     

       64
       64
       +
           "version": "7.0.0",

     

       65
       65
       +
           "hash": "sha256-v4bXmvjZOYxl5RSIHuqVfDzBQdRz5SrmzZtD6SeEYTY="

     

       66
       66
       +
         },

     

       67
       67
       +
         {

     

       63
       68
        
           "pname": "Fantomas.Client",

     

       64
       69
        
           "version": "0.9.1",

     

       65
       70
        
           "hash": "sha256-KIHugHvwgaCVD/XQ0FjeZKhiSzzHJyovVPtM5IzttJI="

     
···

       81
       86
        
         },

     

       82
       87
        
         {

     

       83
       88
        
           "pname": "FSharp.Analyzers.SDK",

     

       84
       84
       -
           "version": "0.28.0",

     

       85
       85
       -
           "hash": "sha256-3pB20Niv5q65D4BSCqkMUZk24MeO556kRlv0RXdUzYI="

     

       89
       89
       +
           "version": "0.29.0",

     

       90
       90
       +
           "hash": "sha256-hhyLzVyNO7lAm9RbQao15+d8gt9yYK2+Rem3yAoA+zw="

     

       86
       91
        
         },

     

       87
       92
        
         {

     

       88
       93
        
           "pname": "FSharp.Compiler.Service",

     

       89
       89
       -
           "version": "43.9.100",

     

       90
       90
       -
           "hash": "sha256-9mMAYbS0c5Z/9SQ31NaBmDmZxr7hsX4144an5Yc8RgU="

     

       94
       94
       +
           "version": "43.9.201",

     

       95
       95
       +
           "hash": "sha256-YYo2O873Za3uXXdeOFCkIAToF8Txae1W2d5PuJ3dy/Y="

     

       91
       96
        
         },

     

       92
       97
        
         {

     

       93
       98
        
           "pname": "FSharp.Control.AsyncSeq",

     
···

       101
       106
        
         },

     

       102
       107
        
         {

     

       103
       108
        
           "pname": "FSharp.Core",

     

       104
       104
       -
           "version": "4.3.4",

     

       105
       105
       -
           "hash": "sha256-styyo+6mJy+yxE0NZG/b1hxkAjPOnJfMgd9zWzCJ5uk="

     

       106
       106
       -
         },

     

       107
       107
       -
         {

     

       108
       108
       -
           "pname": "FSharp.Core",

     

       109
       109
       -
           "version": "4.7.0",

     

       110
       110
       -
           "hash": "sha256-7aa4bga9XWLkq7J5KXv8Bilf1KGum77lSUqp+ooYIUg="

     

       111
       111
       -
         },

     

       112
       112
       -
         {

     

       113
       113
       -
           "pname": "FSharp.Core",

     

       114
       114
       -
           "version": "4.7.2",

     

       115
       115
       -
           "hash": "sha256-1eDe16w8+syA35AtrSiViMHQYgwBqmdViS4yCa4AMZ8="

     

       116
       116
       -
         },

     

       117
       117
       -
         {

     

       118
       118
       -
           "pname": "FSharp.Core",

     

       119
       119
       -
           "version": "5.0.1",

     

       120
       120
       -
           "hash": "sha256-WPkytjnHlThxzYlPvmpICMfR+4ANTiWNGjEA6LoAcBA="

     

       121
       121
       -
         },

     

       122
       122
       -
         {

     

       123
       123
       -
           "pname": "FSharp.Core",

     

       124
       124
       -
           "version": "6.0.0",

     

       125
       125
       -
           "hash": "sha256-aQDRgiGC7iTyzNEmvyd2RBCDcLG0I1dbfncHlkbeUMI="

     

       126
       126
       -
         },

     

       127
       127
       -
         {

     

       128
       128
       -
           "pname": "FSharp.Core",

     

       129
       129
       -
           "version": "6.0.1",

     

       130
       130
       -
           "hash": "sha256-Ehsgt3nCJijpaVuJguC1TPVEKSkJd6PSc07D2ZQSemI="

     

       131
       131
       -
         },

     

       132
       132
       -
         {

     

       133
       133
       -
           "pname": "FSharp.Core",

     

       134
       134
       -
           "version": "7.0.300",

     

       135
       135
       -
           "hash": "sha256-pDi6WWiwxmpceSUON1UWDNSOSDP8M5n0nSxF1yy59QQ="

     

       136
       136
       -
         },

     

       137
       137
       -
         {

     

       138
       138
       -
           "pname": "FSharp.Core",

     

       139
       139
       -
           "version": "8.0.101",

     

       140
       140
       -
           "hash": "sha256-MS6Z8dFRaGn1KxxCr6lScK3AQdksZ7VcphloE6dlL18="

     

       141
       141
       -
         },

     

       142
       142
       -
         {

     

       143
       143
       -
           "pname": "FSharp.Core",

     

       144
       144
       -
           "version": "9.0.100",

     

       145
       145
       -
           "hash": "sha256-V1q3CjbRvWZqxpi6cXD/R0F7pyXGGtH83M5Z/ITDrp8="

     

       109
       109
       +
           "version": "9.0.201",

     

       110
       110
       +
           "hash": "sha256-38Y0QFg/knogSJtxDVpVXKo5n4zAo8zaffeT6tbhahk="

     

       146
       111
        
         },

     

       147
       112
        
         {

     

       148
       113
        
           "pname": "FSharp.Data.Adaptive",

     

       149
       149
       -
           "version": "1.2.16",

     

       150
       150
       -
           "hash": "sha256-H6kc8WMztWG03xISlMJolg8y+RSNdvPF7lY4biNuNfI="

     

       114
       114
       +
           "version": "1.2.18",

     

       115
       115
       +
           "hash": "sha256-xy1lJ+gZMlL1lIO42EVKpQHSU72yTezIaAQ76WwIvGo="

     

       151
       116
        
         },

     

       152
       117
        
         {

     

       153
       118
        
           "pname": "FSharp.Formatting",

     
···

       191
       156
        
         },

     

       192
       157
        
         {

     

       193
       158
        
           "pname": "Google.Protobuf",

     

       194
       194
       -
           "version": "3.22.5",

     

       195
       195
       -
           "hash": "sha256-KuPCqobX6vE9RYElAN9vw+FPonFipms7kE/cRDCLmSQ="

     

       196
       196
       -
         },

     

       197
       197
       -
         {

     

       198
       198
       -
           "pname": "Google.Protobuf",

     

       199
       159
        
           "version": "3.28.3",

     

       200
       160
        
           "hash": "sha256-jiA/FeYEEk/u9O1gtdnOzatym+/uHyaRJSdp34TOb1o="

     

       201
       161
        
         },

     
···

       213
       173
        
           "pname": "Grpc.Core.Api",

     

       214
       174
        
           "version": "2.66.0",

     

       215
       175
        
           "hash": "sha256-XVZmvlUK0t4bWaIBUAoAm007VhUdUvSSlCDh6P4IV9c="

     

       216
       216
       -
         },

     

       217
       217
       -
         {

     

       218
       218
       -
           "pname": "Grpc.Net.Client",

     

       219
       219
       -
           "version": "2.52.0",

     

       220
       220
       -
           "hash": "sha256-4Rhb8PIoV2BiohfRwzx1GYDPbcfqxGAmL2uB0atFFTk="

     

       221
       176
        
         },

     

       222
       177
        
         {

     

       223
       178
        
           "pname": "Grpc.Net.Client",

     
···

       266
       221
        
         },

     

       267
       222
        
         {

     

       268
       223
        
           "pname": "Ionide.ProjInfo",

     

       269
       269
       -
           "version": "0.68.0",

     

       270
       270
       -
           "hash": "sha256-aRkn1YxZquU+eTIZ7kLOmqnKxzCY/fm3sO539MlnnRw="

     

       224
       224
       +
           "version": "0.70.2",

     

       225
       225
       +
           "hash": "sha256-Y606emyiJ+ZgS5NH578WURySaVc/yo2OA7rWbOH57jA="

     

       271
       226
        
         },

     

       272
       227
        
         {

     

       273
       228
        
           "pname": "Ionide.ProjInfo.FCS",

     

       274
       274
       -
           "version": "0.68.0",

     

       275
       275
       -
           "hash": "sha256-L/v/iwv0Lyrrb/53waIUtTUcRff0mHeNOvXI8FOpllE="

     

       229
       229
       +
           "version": "0.70.2",

     

       230
       230
       +
           "hash": "sha256-ufDkvztQZCtGTdegsIFIbixWTvIJwmNwhis2kb2OFU8="

     

       276
       231
        
         },

     

       277
       232
        
         {

     

       278
       233
        
           "pname": "Ionide.ProjInfo.ProjectSystem",

     

       279
       279
       -
           "version": "0.68.0",

     

       280
       280
       -
           "hash": "sha256-rnoHnT3wSLrwrGa15Uod6PbpvX41i8yOjchxxQA/A44="

     

       281
       281
       -
         },

     

       282
       282
       -
         {

     

       283
       283
       -
           "pname": "Ionide.ProjInfo.Sln",

     

       284
       284
       -
           "version": "0.68.0",

     

       285
       285
       -
           "hash": "sha256-wtF91XZWw9W6X2ignQi0M5dxGY8pmaC+4fQWmhAjn8o="

     

       234
       234
       +
           "version": "0.70.2",

     

       235
       235
       +
           "hash": "sha256-3C+vn7ROgGWxjaHaACaUENYcAt9jYrnquBebQ2eo1y0="

     

       286
       236
        
         },

     

       287
       237
        
         {

     

       288
       238
        
           "pname": "LinkDotNet.StringBuilder",

     
···

       296
       246
        
         },

     

       297
       247
        
         {

     

       298
       248
        
           "pname": "MessagePack",

     

       299
       299
       -
           "version": "2.5.108",

     

       300
       300
       -
           "hash": "sha256-+vMXyEbfutY5WOFuFnNF24uLcKJTTdntVrVlSJH4yjI="

     

       301
       301
       -
         },

     

       302
       302
       -
         {

     

       303
       303
       -
           "pname": "MessagePack",

     

       304
       249
        
           "version": "2.5.192",

     

       305
       250
        
           "hash": "sha256-M9QUEAIeSoSgO3whVkOou0F8kbKCNJ7HHAvTZgytkPU="

     

       306
       251
        
         },

     
···

       310
       255
        
           "hash": "sha256-DLtncnaQ9Sp5YmWm89+2w3InhdU1ZQxnJgbonAq/1aM="

     

       311
       256
        
         },

     

       312
       257
        
         {

     

       313
       313
       -
           "pname": "Microsoft.AspNetCore.App.Ref",

     

       314
       314
       -
           "version": "6.0.36",

     

       315
       315
       -
           "hash": "sha256-9jDkWbjw/nd8yqdzVTagCuqr6owJ/DUMi4BlUZT4hWU="

     

       316
       316
       -
         },

     

       317
       317
       -
         {

     

       318
       318
       -
           "pname": "Microsoft.AspNetCore.App.Runtime.linux-arm64",

     

       319
       319
       -
           "version": "6.0.36",

     

       320
       320
       -
           "hash": "sha256-JQULJyF0ivLoUU1JaFfK/HHg+/qzpN7V2RR2Cc+WlQ4="

     

       321
       321
       -
         },

     

       322
       322
       -
         {

     

       323
       323
       -
           "pname": "Microsoft.AspNetCore.App.Runtime.linux-x64",

     

       324
       324
       -
           "version": "6.0.36",

     

       325
       325
       -
           "hash": "sha256-zUsVIpV481vMLAXaLEEUpEMA9/f1HGOnvaQnaWdzlyY="

     

       326
       326
       -
         },

     

       327
       327
       -
         {

     

       328
       328
       -
           "pname": "Microsoft.AspNetCore.App.Runtime.osx-arm64",

     

       329
       329
       -
           "version": "6.0.36",

     

       330
       330
       -
           "hash": "sha256-2seqZcz0JeUjkzh3QcGa9TcJ4LUafpFjTRk+Nm8T6T0="

     

       331
       331
       -
         },

     

       332
       332
       -
         {

     

       333
       333
       -
           "pname": "Microsoft.AspNetCore.App.Runtime.osx-x64",

     

       334
       334
       -
           "version": "6.0.36",

     

       335
       335
       -
           "hash": "sha256-yxLafxiBKkvfkDggPk0P9YZIHBkDJOsFTO7/V9mEHuU="

     

       336
       336
       -
         },

     

       337
       337
       -
         {

     

       338
       258
        
           "pname": "Microsoft.Bcl.AsyncInterfaces",

     

       339
       339
       -
           "version": "8.0.0",

     

       340
       340
       -
           "hash": "sha256-9aWmiwMJKrKr9ohD1KSuol37y+jdDxPGJct3m2/Bknw="

     

       341
       341
       -
         },

     

       342
       342
       -
         {

     

       343
       343
       -
           "pname": "Microsoft.Bcl.AsyncInterfaces",

     

       344
       344
       -
           "version": "9.0.0",

     

       345
       345
       -
           "hash": "sha256-BsXNOWEgfFq3Yz7VTtK6m/ov4/erRqyBzieWSIpmc1U="

     

       259
       259
       +
           "version": "9.0.1",

     

       260
       260
       +
           "hash": "sha256-A3W2Hvhlf1ODx1NYWHwUyziZOGMaDPvXHZ/ubgNLYJA="

     

       346
       261
        
         },

     

       347
       262
        
         {

     

       348
       263
        
           "pname": "Microsoft.Bcl.Cryptography",

     

       349
       349
       -
           "version": "9.0.0",

     

       350
       350
       -
           "hash": "sha256-yEji2HL9c5zgrNd0XsAwWTLIEi0z89hD0meJzneUoJM="

     

       264
       264
       +
           "version": "9.0.1",

     

       265
       265
       +
           "hash": "sha256-m0ZMScw9lHN+MnxgM5VpVUyOs0H09XmzqeYvCJ/1CG8="

     

       351
       266
        
         },

     

       352
       267
        
         {

     

       353
       268
        
           "pname": "Microsoft.Bcl.HashCode",

     
···

       388
       303
        
           "pname": "Microsoft.CodeAnalysis.Analyzers",

     

       389
       304
        
           "version": "3.11.0",

     

       390
       305
        
           "hash": "sha256-hQ2l6E6PO4m7i+ZsfFlEx+93UsLPo4IY3wDkNG11/Sw="

     

       391
       391
       -
         },

     

       392
       392
       -
         {

     

       393
       393
       -
           "pname": "Microsoft.CodeAnalysis.Analyzers",

     

       394
       394
       -
           "version": "3.3.4",

     

       395
       395
       -
           "hash": "sha256-qDzTfZBSCvAUu9gzq2k+LOvh6/eRvJ9++VCNck/ZpnE="

     

       396
       306
        
         },

     

       397
       307
        
         {

     

       398
       308
        
           "pname": "Microsoft.CodeAnalysis.Common",

     
···

       441
       351
        
         },

     

       442
       352
        
         {

     

       443
       353
        
           "pname": "Microsoft.Diagnostics.Tracing.TraceEvent",

     

       444
       444
       -
           "version": "3.1.17",

     

       445
       445
       -
           "hash": "sha256-vfVqz7GTFNC/JrrHgZ7WkPe/sNHyI29fq6XXS9ks2A4="

     

       354
       354
       +
           "version": "3.1.18",

     

       355
       355
       +
           "hash": "sha256-SabdlRagFuZRIBvJ6HwW6PyGbaGdYtC+7kqE1ygWqA8="

     

       446
       356
        
         },

     

       447
       357
        
         {

     

       448
       358
        
           "pname": "Microsoft.DotNet.PlatformAbstractions",

     
···

       451
       361
        
         },

     

       452
       362
        
         {

     

       453
       363
        
           "pname": "Microsoft.Extensions.Caching.Abstractions",

     

       454
       454
       -
           "version": "9.0.0",

     

       455
       455
       -
           "hash": "sha256-hDau5OMVGIg4sc5+ofe14ROqwt63T0NSbzm/Cv0pDrY="

     

       364
       364
       +
           "version": "9.0.1",

     

       365
       365
       +
           "hash": "sha256-4mBy8VC4rrDt8ZGyDCgpUqlHYxRTsAXh8H8HXXo6pd0="

     

       456
       366
        
         },

     

       457
       367
        
         {

     

       458
       368
        
           "pname": "Microsoft.Extensions.Caching.Memory",

     

       459
       459
       -
           "version": "9.0.0",

     

       460
       460
       -
           "hash": "sha256-OZVOVGZOyv9uk5XGJrz6irBkPNjxnBxjfSyW30MnU0s="

     

       369
       369
       +
           "version": "9.0.1",

     

       370
       370
       +
           "hash": "sha256-NZV/R7g0CszBcE5Tjhfb2xX9i2rHT+Xc5QaxbhzRsg8="

     

       461
       371
        
         },

     

       462
       372
        
         {

     

       463
       373
        
           "pname": "Microsoft.Extensions.Configuration",

     

       464
       464
       -
           "version": "9.0.0",

     

       465
       465
       -
           "hash": "sha256-uBLeb4z60y8z7NelHs9uT3cLD6wODkdwyfJm6/YZLDM="

     

       374
       374
       +
           "version": "9.0.1",

     

       375
       375
       +
           "hash": "sha256-QKWRIGi8RaZjheuW9gMouXa3oaL/nMwlmg28/xxEvgs="

     

       466
       376
        
         },

     

       467
       377
        
         {

     

       468
       378
        
           "pname": "Microsoft.Extensions.Configuration.Abstractions",

     

       469
       469
       -
           "version": "9.0.0",

     

       470
       470
       -
           "hash": "sha256-xtG2USC9Qm0f2Nn6jkcklpyEDT3hcEZOxOwTc0ep7uc="

     

       379
       379
       +
           "version": "9.0.1",

     

       380
       380
       +
           "hash": "sha256-r3iWP+kwKo4Aib8SGo91kKWR5WusLrbFHUAw5uKQeNA="

     

       471
       381
        
         },

     

       472
       382
        
         {

     

       473
       383
        
           "pname": "Microsoft.Extensions.Configuration.Binder",

     

       474
       474
       -
           "version": "9.0.0",

     

       475
       475
       -
           "hash": "sha256-6ajYWcNOQX2WqftgnoUmVtyvC1kkPOtTCif4AiKEffU="

     

       384
       384
       +
           "version": "9.0.1",

     

       385
       385
       +
           "hash": "sha256-uq6i0gTobSTqaNm/0XZuv8GGjFpnvgwXnCCPWl9FP9g="

     

       476
       386
        
         },

     

       477
       387
        
         {

     

       478
       388
        
           "pname": "Microsoft.Extensions.DependencyInjection",

     

       479
       479
       -
           "version": "9.0.0",

     

       480
       480
       -
           "hash": "sha256-dAH52PPlTLn7X+1aI/7npdrDzMEFPMXRv4isV1a+14k="

     

       389
       389
       +
           "version": "9.0.1",

     

       390
       390
       +
           "hash": "sha256-Kt9fczXVeOIlvwuxXdQDKRfIZKClay0ESGUIAJpYiOw="

     

       481
       391
        
         },

     

       482
       392
        
         {

     

       483
       393
        
           "pname": "Microsoft.Extensions.DependencyInjection.Abstractions",

     

       484
       484
       -
           "version": "9.0.0",

     

       485
       485
       -
           "hash": "sha256-CncVwkKZ5CsIG2O0+OM9qXuYXh3p6UGyueTHSLDVL+c="

     

       486
       486
       -
         },

     

       487
       487
       -
         {

     

       488
       488
       -
           "pname": "Microsoft.Extensions.DependencyModel",

     

       489
       489
       -
           "version": "5.0.0",

     

       490
       490
       -
           "hash": "sha256-vUwAWMxXiMW+JOiQE5fcJycOfJJzO87ESYAsEPsPqtY="

     

       394
       394
       +
           "version": "9.0.1",

     

       395
       395
       +
           "hash": "sha256-2tWVTPHsw1NG2zO0zsxvi1GybryqeE1V00ZRE66YZB4="

     

       491
       396
        
         },

     

       492
       397
        
         {

     

       493
       398
        
           "pname": "Microsoft.Extensions.DependencyModel",

     

       494
       494
       -
           "version": "9.0.0",

     

       495
       495
       -
           "hash": "sha256-xirwlMWM0hBqgTneQOGkZ8l45mHT08XuSSRIbprgq94="

     

       399
       399
       +
           "version": "9.0.1",

     

       400
       400
       +
           "hash": "sha256-x+1GlrYNoN+UsooEUV2cr8TPPyx5Ni/vB6pJpspM8kw="

     

       496
       401
        
         },

     

       497
       402
        
         {

     

       498
       403
        
           "pname": "Microsoft.Extensions.Diagnostics.Abstractions",

     

       499
       499
       -
           "version": "9.0.0",

     

       500
       500
       -
           "hash": "sha256-wG1LcET+MPRjUdz3HIOTHVEnbG/INFJUqzPErCM79eY="

     

       404
       404
       +
           "version": "9.0.1",

     

       405
       405
       +
           "hash": "sha256-/JkeyAQ//lfuHrWbq8ZFrHZiLvIXSnBj0MG0rU8eggQ="

     

       501
       406
        
         },

     

       502
       407
        
         {

     

       503
       408
        
           "pname": "Microsoft.Extensions.Logging",

     

       504
       504
       -
           "version": "9.0.0",

     

       505
       505
       -
           "hash": "sha256-kR16c+N8nQrWeYLajqnXPg7RiXjZMSFLnKLEs4VfjcM="

     

       409
       409
       +
           "version": "9.0.1",

     

       410
       410
       +
           "hash": "sha256-IjszwetJ/r1NvwVyh+/SlavabNt9UXf3ZSGP9gGwnkk="

     

       506
       411
        
         },

     

       507
       412
        
         {

     

       508
       413
        
           "pname": "Microsoft.Extensions.Logging.Abstractions",

     

       509
       509
       -
           "version": "6.0.0",

     

       510
       510
       -
           "hash": "sha256-QNqcQ3x+MOK7lXbWkCzSOWa/2QyYNbdM/OEEbWN15Sw="

     

       511
       511
       -
         },

     

       512
       512
       -
         {

     

       513
       513
       -
           "pname": "Microsoft.Extensions.Logging.Abstractions",

     

       514
       514
       -
           "version": "9.0.0",

     

       515
       515
       -
           "hash": "sha256-iBTs9twjWXFeERt4CErkIIcoJZU1jrd1RWCI8V5j7KU="

     

       414
       414
       +
           "version": "9.0.1",

     

       415
       415
       +
           "hash": "sha256-aFZeUno9yLLbvtrj53gA7oD41vxZZYkrJhlOghpMEjo="

     

       516
       416
        
         },

     

       517
       417
        
         {

     

       518
       418
        
           "pname": "Microsoft.Extensions.Logging.Configuration",

     

       519
       519
       -
           "version": "9.0.0",

     

       520
       520
       -
           "hash": "sha256-ysPjBq64p6JM4EmeVndryXnhLWHYYszzlVpPxRWkUkw="

     

       419
       419
       +
           "version": "9.0.1",

     

       420
       420
       +
           "hash": "sha256-O7LaPjMs2PslVj/BUcXb1LeKFRClJZ6AsxlpdKxnng4="

     

       521
       421
        
         },

     

       522
       422
        
         {

     

       523
       423
        
           "pname": "Microsoft.Extensions.Options",

     

       524
       524
       -
           "version": "9.0.0",

     

       525
       525
       -
           "hash": "sha256-DT5euAQY/ItB5LPI8WIp6Dnd0lSvBRP35vFkOXC68ck="

     

       424
       424
       +
           "version": "9.0.1",

     

       425
       425
       +
           "hash": "sha256-wOKd/0+kRK3WrGA2HmS/KNYUTUwXHmTAD5IsClTFA10="

     

       526
       426
        
         },

     

       527
       427
        
         {

     

       528
       428
        
           "pname": "Microsoft.Extensions.Options.ConfigurationExtensions",

     

       529
       529
       -
           "version": "9.0.0",

     

       530
       530
       -
           "hash": "sha256-r1Z3sEVSIjeH2UKj+KMj86har68g/zybSqoSjESBcoA="

     

       429
       429
       +
           "version": "9.0.1",

     

       430
       430
       +
           "hash": "sha256-pzc49CPyBlSoyflWvW6J+xqk2RXEVfPczcDiR0Aj9xA="

     

       531
       431
        
         },

     

       532
       432
        
         {

     

       533
       433
        
           "pname": "Microsoft.Extensions.Primitives",

     

       534
       534
       -
           "version": "9.0.0",

     

       535
       535
       -
           "hash": "sha256-ZNLusK1CRuq5BZYZMDqaz04PIKScE2Z7sS2tehU7EJs="

     

       434
       434
       +
           "version": "9.0.1",

     

       435
       435
       +
           "hash": "sha256-tdbtoC7eQGW5yh66FWCJQqmFJkNJD+9e6DDKTs7YAjs="

     

       536
       436
        
         },

     

       537
       437
        
         {

     

       538
       438
        
           "pname": "Microsoft.NET.StringTools",

     
···

       540
       440
        
           "hash": "sha256-cZnnBoiUIZOGMUy31sIMAn3gAd4VgSBFFe8pNfzQBtA="

     

       541
       441
        
         },

     

       542
       442
        
         {

     

       543
       543
       -
           "pname": "Microsoft.NET.StringTools",

     

       544
       544
       -
           "version": "17.6.3",

     

       545
       545
       -
           "hash": "sha256-H2Qw8x47WyFOd/VmgRmGMc+uXySgUv68UISgK8Frsjw="

     

       546
       546
       -
         },

     

       547
       547
       -
         {

     

       548
       443
        
           "pname": "Microsoft.NET.Test.Sdk",

     

       549
       444
        
           "version": "17.12.0",

     

       550
       445
        
           "hash": "sha256-DKFEbhh2wPzahNeHdEoFig8tZh/LEVrFc5+zpT43Btg="

     

       551
       446
        
         },

     

       552
       447
        
         {

     

       553
       553
       -
           "pname": "Microsoft.NETCore.App.Host.linux-arm64",

     

       554
       554
       -
           "version": "6.0.36",

     

       555
       555
       -
           "hash": "sha256-9lC/LYnthYhjkWWz2kkFCvlA5LJOv11jdt59SDnpdy0="

     

       556
       556
       -
         },

     

       557
       557
       -
         {

     

       558
       558
       -
           "pname": "Microsoft.NETCore.App.Host.linux-x64",

     

       559
       559
       -
           "version": "6.0.36",

     

       560
       560
       -
           "hash": "sha256-VFRDzx7LJuvI5yzKdGmw/31NYVbwHWPKQvueQt5xc10="

     

       561
       561
       -
         },

     

       562
       562
       -
         {

     

       563
       563
       -
           "pname": "Microsoft.NETCore.App.Host.osx-arm64",

     

       564
       564
       -
           "version": "6.0.36",

     

       565
       565
       -
           "hash": "sha256-DaSWwYACJGolEBuMhzDVCj/rQTdDt061xCVi+gyQnuo="

     

       566
       566
       -
         },

     

       567
       567
       -
         {

     

       568
       568
       -
           "pname": "Microsoft.NETCore.App.Host.osx-x64",

     

       569
       569
       -
           "version": "6.0.36",

     

       570
       570
       -
           "hash": "sha256-FrRny9EI6HKCKQbu6mcLj5w4ooSRrODD4Vj2ZMGnMd4="

     

       571
       571
       -
         },

     

       572
       572
       -
         {

     

       573
       573
       -
           "pname": "Microsoft.NETCore.App.Ref",

     

       574
       574
       -
           "version": "6.0.36",

     

       575
       575
       -
           "hash": "sha256-9LZgVoIFF8qNyUu8kdJrYGLutMF/cL2K82HN2ywwlx8="

     

       576
       576
       -
         },

     

       577
       577
       -
         {

     

       578
       578
       -
           "pname": "Microsoft.NETCore.App.Runtime.linux-arm64",

     

       579
       579
       -
           "version": "6.0.36",

     

       580
       580
       -
           "hash": "sha256-k3rxvUhCEU0pVH8KgEMtkPiSOibn+nBh+0zT2xIfId8="

     

       581
       581
       -
         },

     

       582
       582
       -
         {

     

       583
       583
       -
           "pname": "Microsoft.NETCore.App.Runtime.linux-x64",

     

       584
       584
       -
           "version": "6.0.36",

     

       585
       585
       -
           "hash": "sha256-U8wJ2snSDFqeAgDVLXjnniidC7Cr5aJ1/h/BMSlyu0c="

     

       586
       586
       -
         },

     

       587
       587
       -
         {

     

       588
       588
       -
           "pname": "Microsoft.NETCore.App.Runtime.osx-arm64",

     

       589
       589
       -
           "version": "6.0.36",

     

       590
       590
       -
           "hash": "sha256-UfLcrL2Gj/OLz0s92Oo+OCJeDpZFAcQLPLiSNND8D5Y="

     

       591
       591
       -
         },

     

       592
       592
       -
         {

     

       593
       593
       -
           "pname": "Microsoft.NETCore.App.Runtime.osx-x64",

     

       594
       594
       -
           "version": "6.0.36",

     

       595
       595
       -
           "hash": "sha256-0xIJYFzxdMcnCj3wzkFRQZSnQcPHzPHMzePRIOA3oJs="

     

       596
       596
       -
         },

     

       597
       597
       -
         {

     

       598
       448
        
           "pname": "Microsoft.NETCore.Platforms",

     

       599
       449
        
           "version": "5.0.0",

     

       600
       450
        
           "hash": "sha256-LIcg1StDcQLPOABp4JRXIs837d7z0ia6+++3SF3jl1c="

     
···

       620
       470
        
           "hash": "sha256-rf8Sh0fQq44Sneuvs64unkkIHg8kOjDGWE35j9iLx5I="

     

       621
       471
        
         },

     

       622
       472
        
         {

     

       623
       623
       -
           "pname": "Microsoft.VisualStudio.Threading",

     

       624
       624
       -
           "version": "17.10.48",

     

       625
       625
       -
           "hash": "sha256-WL8c7TjDBHGjsVLMMPf9cin8rirzOdxusEBQlkUfiVU="

     

       473
       473
       +
           "pname": "Microsoft.VisualStudio.SolutionPersistence",

     

       474
       474
       +
           "version": "1.0.28",

     

       475
       475
       +
           "hash": "sha256-7BmeidGDb19wfvpaYA91luCFE1CStb8iLlnyJhVCJ6w="

     

       626
       476
        
         },

     

       627
       477
        
         {

     

       628
       478
        
           "pname": "Microsoft.VisualStudio.Threading",

     
···

       631
       481
        
         },

     

       632
       482
        
         {

     

       633
       483
        
           "pname": "Microsoft.VisualStudio.Threading.Analyzers",

     

       634
       634
       -
           "version": "17.10.48",

     

       635
       635
       -
           "hash": "sha256-EvZGbyxtrJDvHZwsQbZDXtVfWiy0f58oCdTdSzD34wI="

     

       636
       636
       -
         },

     

       637
       637
       -
         {

     

       638
       638
       -
           "pname": "Microsoft.VisualStudio.Threading.Analyzers",

     

       639
       484
        
           "version": "17.12.19",

     

       640
       485
        
           "hash": "sha256-7EteBGfUDOOpDihazJ4XGuPA2dvdc7HkpV8zTVl3FdQ="

     

       641
       486
        
         },

     
···

       656
       501
        
         },

     

       657
       502
        
         {

     

       658
       503
        
           "pname": "Nerdbank.Streams",

     

       659
       659
       -
           "version": "2.11.74",

     

       660
       660
       -
           "hash": "sha256-asIdaqCIjZspTA+hhtjKNajpCo+ZQi3erZLCpBQ5No4="

     

       661
       661
       -
         },

     

       662
       662
       -
         {

     

       663
       663
       -
           "pname": "Nerdbank.Streams",

     

       664
       504
        
           "version": "2.11.79",

     

       665
       505
        
           "hash": "sha256-1bzibVcSH8LJMR8Nb6Q0q/7fieTgxRnVY4C1RvRbrrI="

     

       666
       666
       -
         },

     

       667
       667
       -
         {

     

       668
       668
       -
           "pname": "Newtonsoft.Json",

     

       669
       669
       -
           "version": "13.0.1",

     

       670
       670
       -
           "hash": "sha256-K2tSVW4n4beRPzPu3rlVaBEMdGvWSv/3Q1fxaDh4Mjo="

     

       671
       506
        
         },

     

       672
       507
        
         {

     

       673
       508
        
           "pname": "Newtonsoft.Json",

     
···

       688
       523
        
           "pname": "OpenTelemetry.Api",

     

       689
       524
        
           "version": "1.10.0",

     

       690
       525
        
           "hash": "sha256-ZSpQFnNgkk3dO8Q7yokJ/VSl4wp5PuIv9nduxgC6UxU="

     

       691
       691
       -
         },

     

       692
       692
       -
         {

     

       693
       693
       -
           "pname": "OpenTelemetry.Api",

     

       694
       694
       -
           "version": "1.9.0",

     

       695
       695
       -
           "hash": "sha256-raXpHi2DZ3mSLn9dnJYF64XaP23epdfu8zgagSpm8+4="

     

       696
       526
        
         },

     

       697
       527
        
         {

     

       698
       528
        
           "pname": "OpenTelemetry.Api.ProviderBuilderExtensions",

     
···

       826
       656
        
         },

     

       827
       657
        
         {

     

       828
       658
        
           "pname": "Serilog",

     

       829
       829
       -
           "version": "3.1.1",

     

       830
       830
       -
           "hash": "sha256-L263y8jkn7dNFD2jAUK6mgvyRTqFe39i1tRhVZsNZTI="

     

       831
       831
       -
         },

     

       832
       832
       -
         {

     

       833
       833
       -
           "pname": "Serilog",

     

       834
       834
       -
           "version": "4.0.0",

     

       835
       835
       -
           "hash": "sha256-j8hQ5TdL1TjfdGiBO9PyHJFMMPvATHWN1dtrrUZZlNw="

     

       836
       836
       -
         },

     

       837
       837
       -
         {

     

       838
       838
       -
           "pname": "Serilog",

     

       839
       659
        
           "version": "4.1.0",

     

       840
       660
        
           "hash": "sha256-r89nJ5JE5uZlsRrfB8QJQ1byVVfCWQbySKQ/m9PYj0k="

     

       841
       661
        
         },

     
···

       856
       676
        
         },

     

       857
       677
        
         {

     

       858
       678
        
           "pname": "StreamJsonRpc",

     

       859
       859
       -
           "version": "2.16.36",

     

       860
       860
       -
           "hash": "sha256-XLCQsY7xu67E8E7WJIvjHtk3iobREPCiljW8jNpfi68="

     

       861
       861
       -
         },

     

       862
       862
       -
         {

     

       863
       863
       -
           "pname": "StreamJsonRpc",

     

       864
       864
       -
           "version": "2.20.17",

     

       865
       865
       -
           "hash": "sha256-0uUM1JUC6NLjQOPhpEIKCt0zkd/Sh8FjMCjI2j+TYxw="

     

       866
       866
       -
         },

     

       867
       867
       -
         {

     

       868
       868
       -
           "pname": "StreamJsonRpc",

     

       869
       869
       -
           "version": "2.8.28",

     

       870
       870
       -
           "hash": "sha256-iMesOucDwxjGDw2cBKDDzxZskjC1Mc0bszI/frB6qpA="

     

       871
       871
       -
         },

     

       872
       872
       -
         {

     

       873
       873
       -
           "pname": "System.Buffers",

     

       874
       874
       -
           "version": "4.5.1",

     

       875
       875
       -
           "hash": "sha256-wws90sfi9M7kuCPWkv1CEYMJtCqx9QB/kj0ymlsNaxI="

     

       679
       679
       +
           "version": "2.20.20",

     

       680
       680
       +
           "hash": "sha256-t0DVjJejQBPk+LukHVuXSe0M2QWpDJt7W7q4DRR4OI4="

     

       876
       681
        
         },

     

       877
       682
        
         {

     

       878
       683
        
           "pname": "System.Buffers",

     
···

       896
       701
        
         },

     

       897
       702
        
         {

     

       898
       703
        
           "pname": "System.Collections.Immutable",

     

       899
       899
       -
           "version": "6.0.0",

     

       900
       900
       -
           "hash": "sha256-DKEbpFqXCIEfqp9p3ezqadn5b/S1YTk32/EQK+tEScs="

     

       901
       901
       -
         },

     

       902
       902
       -
         {

     

       903
       903
       -
           "pname": "System.Collections.Immutable",

     

       904
       904
       -
           "version": "8.0.0",

     

       905
       905
       -
           "hash": "sha256-F7OVjKNwpqbUh8lTidbqJWYi476nsq9n+6k0+QVRo3w="

     

       906
       906
       -
         },

     

       907
       907
       -
         {

     

       908
       908
       -
           "pname": "System.Collections.Immutable",

     

       909
       909
       -
           "version": "9.0.0",

     

       910
       910
       -
           "hash": "sha256-+6q5VMeoc5bm4WFsoV6nBXA9dV5pa/O4yW+gOdi8yac="

     

       704
       704
       +
           "version": "9.0.1",

     

       705
       705
       +
           "hash": "sha256-23od93P7QHRzlL5NtKNUDujiYGeXRkkw7lXkyN4zOGY="

     

       911
       706
        
         },

     

       912
       707
        
         {

     

       913
       708
        
           "pname": "System.CommandLine",

     
···

       921
       716
        
         },

     

       922
       717
        
         {

     

       923
       718
        
           "pname": "System.Composition",

     

       924
       924
       -
           "version": "8.0.0",

     

       925
       925
       -
           "hash": "sha256-rA118MFj6soKN++BvD3y9gXAJf0lZJAtGARuznG5+Xg="

     

       926
       926
       -
         },

     

       927
       927
       -
         {

     

       928
       928
       -
           "pname": "System.Composition",

     

       929
       929
       -
           "version": "9.0.0",

     

       930
       930
       -
           "hash": "sha256-FehOkQ2u1p8mQ0/wn3cZ+24HjhTLdck8VZYWA1CcgbM="

     

       719
       719
       +
           "version": "9.0.1",

     

       720
       720
       +
           "hash": "sha256-KUJnkjMNNJ2b/1664xflRM9AmAs00PkmXLfbTnNdL6U="

     

       931
       721
        
         },

     

       932
       722
        
         {

     

       933
       723
        
           "pname": "System.Composition.AttributedModel",

     

       934
       934
       -
           "version": "9.0.0",

     

       935
       935
       -
           "hash": "sha256-a7y7H6zj+kmYkllNHA402DoVfY9IaqC3Ooys8Vzl24M="

     

       724
       724
       +
           "version": "9.0.1",

     

       725
       725
       +
           "hash": "sha256-93Q8jFzbF0tEhk+UAHoULA+DWiwgrKiBxcm8k/dQ75M="

     

       936
       726
        
         },

     

       937
       727
        
         {

     

       938
       728
        
           "pname": "System.Composition.Convention",

     

       939
       939
       -
           "version": "9.0.0",

     

       940
       940
       -
           "hash": "sha256-tw4vE5JRQ60ubTZBbxoMPhtjOQCC3XoDFUH7NHO7o8U="

     

       729
       729
       +
           "version": "9.0.1",

     

       730
       730
       +
           "hash": "sha256-FQihbXN3FkEiPprS5XLDIbYLye3RI0yHba099oDuIxY="

     

       941
       731
        
         },

     

       942
       732
        
         {

     

       943
       733
        
           "pname": "System.Composition.Hosting",

     

       944
       944
       -
           "version": "9.0.0",

     

       945
       945
       -
           "hash": "sha256-oOxU+DPEEfMCuNLgW6wSkZp0JY5gYt44FJNnWt+967s="

     

       734
       734
       +
           "version": "9.0.1",

     

       735
       735
       +
           "hash": "sha256-jas95z5TZo4VtLIev6Ixqfh0Xv54CI7zCzJ8867bpVE="

     

       946
       736
        
         },

     

       947
       737
        
         {

     

       948
       738
        
           "pname": "System.Composition.Runtime",

     

       949
       949
       -
           "version": "9.0.0",

     

       950
       950
       -
           "hash": "sha256-AyIe+di1TqwUBbSJ/sJ8Q8tzsnTN+VBdJw4K8xZz43s="

     

       739
       739
       +
           "version": "9.0.1",

     

       740
       740
       +
           "hash": "sha256-wAciMAsH7WR8ETiulgFhBRLBihdNEXb8Zjtzook2UQ4="

     

       951
       741
        
         },

     

       952
       742
        
         {

     

       953
       743
        
           "pname": "System.Composition.TypedParts",

     

       954
       954
       -
           "version": "9.0.0",

     

       955
       955
       -
           "hash": "sha256-F5fpTUs3Rr7yP/NyIzr+Xn5NdTXXp8rrjBnF9UBBUog="

     

       744
       744
       +
           "version": "9.0.1",

     

       745
       745
       +
           "hash": "sha256-fyLCfmGKgUSIpizl6OiSX61Td9xmLjii/PDQAowCihc="

     

       956
       746
        
         },

     

       957
       747
        
         {

     

       958
       748
        
           "pname": "System.Configuration.ConfigurationManager",

     

       959
       959
       -
           "version": "8.0.0",

     

       960
       960
       -
           "hash": "sha256-xhljqSkNQk8DMkEOBSYnn9lzCSEDDq4yO910itptqiE="

     

       961
       961
       -
         },

     

       962
       962
       -
         {

     

       963
       963
       -
           "pname": "System.Configuration.ConfigurationManager",

     

       964
       964
       -
           "version": "9.0.0",

     

       965
       965
       -
           "hash": "sha256-+pLnTC0YDP6Kjw5DVBiFrV/Q3x5is/+6N6vAtjvhVWk="

     

       749
       749
       +
           "version": "9.0.1",

     

       750
       750
       +
           "hash": "sha256-jsaxEBDfR4/N6v0lS4dOCLhu6/+IcqYtWL0Y8kCa10s="

     

       966
       751
        
         },

     

       967
       752
        
         {

     

       968
       753
        
           "pname": "System.Diagnostics.Debug",

     
···

       971
       756
        
         },

     

       972
       757
        
         {

     

       973
       758
        
           "pname": "System.Diagnostics.DiagnosticSource",

     

       974
       974
       -
           "version": "8.0.0",

     

       975
       975
       -
           "hash": "sha256-+aODaDEQMqla5RYZeq0Lh66j+xkPYxykrVvSCmJQ+Vs="

     

       976
       976
       -
         },

     

       977
       977
       -
         {

     

       978
       978
       -
           "pname": "System.Diagnostics.DiagnosticSource",

     

       979
       979
       -
           "version": "9.0.0",

     

       980
       980
       -
           "hash": "sha256-1VzO9i8Uq2KlTw1wnCCrEdABPZuB2JBD5gBsMTFTSvE="

     

       759
       759
       +
           "version": "9.0.1",

     

       760
       760
       +
           "hash": "sha256-nIIvVK+5uyOhAuU2sERNADK4N/A/x0MilBH/EAr1gOA="

     

       981
       761
        
         },

     

       982
       762
        
         {

     

       983
       763
        
           "pname": "System.Diagnostics.EventLog",

     

       984
       984
       -
           "version": "9.0.0",

     

       985
       985
       -
           "hash": "sha256-tPvt6yoAp56sK/fe+/ei8M65eavY2UUhRnbrREj/Ems="

     

       764
       764
       +
           "version": "9.0.1",

     

       765
       765
       +
           "hash": "sha256-pqqZyEm/9Gsp1zT5WJeVX47S2MvoiGGgG1S2Ud/aIqo="

     

       986
       766
        
         },

     

       987
       767
        
         {

     

       988
       768
        
           "pname": "System.Diagnostics.Tracing",

     
···

       991
       771
        
         },

     

       992
       772
        
         {

     

       993
       773
        
           "pname": "System.Formats.Asn1",

     

       994
       994
       -
           "version": "9.0.0",

     

       995
       995
       -
           "hash": "sha256-LHyYt3rzKjPzxCHW/cynkBBzkl4I2h5wW6WYWG0k1w4="

     

       774
       774
       +
           "version": "9.0.1",

     

       775
       775
       +
           "hash": "sha256-6IrTTFmnKDz3jkfDQ9wvfGJ2Cb8TIAt9h1Xj5cKCJ5Q="

     

       996
       776
        
         },

     

       997
       777
        
         {

     

       998
       778
        
           "pname": "System.Formats.Nrbf",

     

       999
       999
       -
           "version": "9.0.0",

     

       1000
       1000
       -
           "hash": "sha256-c4qf6CocQUZB0ySGQd8s15PXY7xfrjQqMGXxkwytKyw="

     

       779
       779
       +
           "version": "9.0.1",

     

       780
       780
       +
           "hash": "sha256-AyJTbJRuDeynPxO8C9ciDJqFGE+Quktas+naqvJfcjk="

     

       1001
       781
        
         },

     

       1002
       782
        
         {

     

       1003
       783
        
           "pname": "System.Globalization",

     
···

       1031
       811
        
         },

     

       1032
       812
        
         {

     

       1033
       813
        
           "pname": "System.IO.Pipelines",

     

       1034
       1034
       -
           "version": "8.0.0",

     

       1035
       1035
       -
           "hash": "sha256-LdpB1s4vQzsOODaxiKstLks57X9DTD5D6cPx8DE1wwE="

     

       1036
       1036
       -
         },

     

       1037
       1037
       -
         {

     

       1038
       1038
       -
           "pname": "System.IO.Pipelines",

     

       1039
       1039
       -
           "version": "9.0.0",

     

       1040
       1040
       -
           "hash": "sha256-vb0NrPjfEao3kfZ0tavp2J/29XnsQTJgXv3/qaAwwz0="

     

       814
       814
       +
           "version": "9.0.1",

     

       815
       815
       +
           "hash": "sha256-CnmDanknCGbNnoDjgZw62M/Grg8IMTJDa8x3P07UR2A="

     

       1041
       816
        
         },

     

       1042
       817
        
         {

     

       1043
       818
        
           "pname": "System.Linq",

     
···

       1048
       823
        
           "pname": "System.Management",

     

       1049
       824
        
           "version": "8.0.0",

     

       1050
       825
        
           "hash": "sha256-HwpfDb++q7/vxR6q57mGFgl5U0vxy+oRJ6orFKORfP0="

     

       1051
       1051
       -
         },

     

       1052
       1052
       -
         {

     

       1053
       1053
       -
           "pname": "System.Memory",

     

       1054
       1054
       -
           "version": "4.5.5",

     

       1055
       1055
       -
           "hash": "sha256-EPQ9o1Kin7KzGI5O3U3PUQAZTItSbk9h/i4rViN3WiI="

     

       1056
       826
        
         },

     

       1057
       827
        
         {

     

       1058
       828
        
           "pname": "System.Memory",

     
···

       1071
       841
        
         },

     

       1072
       842
        
         {

     

       1073
       843
        
           "pname": "System.Numerics.Vectors",

     

       1074
       1074
       -
           "version": "4.5.0",

     

       1075
       1075
       -
           "hash": "sha256-qdSTIFgf2htPS+YhLGjAGiLN8igCYJnCCo6r78+Q+c8="

     

       1076
       1076
       -
         },

     

       1077
       1077
       -
         {

     

       1078
       1078
       -
           "pname": "System.Numerics.Vectors",

     

       1079
       844
        
           "version": "4.6.0",

     

       1080
       845
        
           "hash": "sha256-fKS3uWQ2HmR69vNhDHqPLYNOt3qpjiWQOXZDHvRE1HU="

     

       1081
       846
        
         },

     
···

       1101
       866
        
         },

     

       1102
       867
        
         {

     

       1103
       868
        
           "pname": "System.Reflection.Emit.Lightweight",

     

       1104
       1104
       -
           "version": "4.6.0",

     

       1105
       1105
       -
           "hash": "sha256-913OIkt3v3N12Yke328IRxTtgYUQYNs/eSzOs8wUPkM="

     

       1106
       1106
       -
         },

     

       1107
       1107
       -
         {

     

       1108
       1108
       -
           "pname": "System.Reflection.Emit.Lightweight",

     

       1109
       869
        
           "version": "4.7.0",

     

       1110
       870
        
           "hash": "sha256-V0Wz/UUoNIHdTGS9e1TR89u58zJjo/wPUWw6VaVyclU="

     

       1111
       871
        
         },

     

       1112
       872
        
         {

     

       1113
       873
        
           "pname": "System.Reflection.Metadata",

     

       1114
       1114
       -
           "version": "6.0.0",

     

       1115
       1115
       -
           "hash": "sha256-VJHXPjP05w6RE/Swu8wa2hilEWuji3g9bl/6lBMSC/Q="

     

       1116
       1116
       -
         },

     

       1117
       1117
       -
         {

     

       1118
       1118
       -
           "pname": "System.Reflection.Metadata",

     

       1119
       1119
       -
           "version": "8.0.0",

     

       1120
       1120
       -
           "hash": "sha256-dQGC30JauIDWNWXMrSNOJncVa1umR1sijazYwUDdSIE="

     

       1121
       1121
       -
         },

     

       1122
       1122
       -
         {

     

       1123
       1123
       -
           "pname": "System.Reflection.Metadata",

     

       1124
       1124
       -
           "version": "9.0.0",

     

       1125
       1125
       -
           "hash": "sha256-avEWbcCh7XgpsSesnR3/SgxWi/6C5OxjR89Jf/SfRjQ="

     

       874
       874
       +
           "version": "9.0.1",

     

       875
       875
       +
           "hash": "sha256-7YYxXbXteRDhIFNbJbJ3jcYWOTArHJmyA6KpUyxNmbw="

     

       1126
       876
        
         },

     

       1127
       877
        
         {

     

       1128
       878
        
           "pname": "System.Reflection.MetadataLoadContext",

     

       1129
       1129
       -
           "version": "9.0.0",

     

       1130
       1130
       -
           "hash": "sha256-voF8Csk1WLPikMRrKmGxUOtM9k6W4RB2JAfwjsaF8oo="

     

       879
       879
       +
           "version": "9.0.1",

     

       880
       880
       +
           "hash": "sha256-kWm31a0unw/H8SjxaabVYKInR40bTAL9JnGQEVQGTsU="

     

       1131
       881
        
         },

     

       1132
       882
        
         {

     

       1133
       883
        
           "pname": "System.Reflection.Primitives",

     
···

       1141
       891
        
         },

     

       1142
       892
        
         {

     

       1143
       893
        
           "pname": "System.Resources.Extensions",

     

       1144
       1144
       -
           "version": "9.0.0",

     

       1145
       1145
       -
           "hash": "sha256-y2gLEMuAy6QfEyNJxABC/ayMWGnwlpX735jsUQLktho="

     

       894
       894
       +
           "version": "9.0.1",

     

       895
       895
       +
           "hash": "sha256-fHBGEo8jNIfsvrQsFYrtBdBxUq/M/MAA10+LKlSs7Ss="

     

       1146
       896
        
         },

     

       1147
       897
        
         {

     

       1148
       898
        
           "pname": "System.Resources.ResourceManager",

     
···

       1153
       903
        
           "pname": "System.Runtime",

     

       1154
       904
        
           "version": "4.3.1",

     

       1155
       905
        
           "hash": "sha256-R9T68AzS1PJJ7v6ARz9vo88pKL1dWqLOANg4pkQjkA0="

     

       1156
       1156
       -
         },

     

       1157
       1157
       -
         {

     

       1158
       1158
       -
           "pname": "System.Runtime.CompilerServices.Unsafe",

     

       1159
       1159
       -
           "version": "6.0.0",

     

       1160
       1160
       -
           "hash": "sha256-bEG1PnDp7uKYz/OgLOWs3RWwQSVYm+AnPwVmAmcgp2I="

     

       1161
       906
        
         },

     

       1162
       907
        
         {

     

       1163
       908
        
           "pname": "System.Runtime.CompilerServices.Unsafe",

     
···

       1221
       966
        
         },

     

       1222
       967
        
         {

     

       1223
       968
        
           "pname": "System.Security.Cryptography.Pkcs",

     

       1224
       1224
       -
           "version": "9.0.0",

     

       1225
       1225
       -
           "hash": "sha256-AjG14mGeSc2Ka4QSelGBM1LrGBW3VJX60lnihKyJjGY="

     

       969
       969
       +
           "version": "9.0.1",

     

       970
       970
       +
           "hash": "sha256-8j3cZYi1A9r9ssP+mZ/vmoVziXxQfdVmmvVpzacrtYo="

     

       1226
       971
        
         },

     

       1227
       972
        
         {

     

       1228
       973
        
           "pname": "System.Security.Cryptography.Primitives",

     
···

       1231
       976
        
         },

     

       1232
       977
        
         {

     

       1233
       978
        
           "pname": "System.Security.Cryptography.ProtectedData",

     

       1234
       1234
       -
           "version": "9.0.0",

     

       1235
       1235
       -
           "hash": "sha256-gPgPU7k/InTqmXoRzQfUMEKL3QuTnOKowFqmXTnWaBQ="

     

       979
       979
       +
           "version": "9.0.1",

     

       980
       980
       +
           "hash": "sha256-U2c8q6vD+O42zNTGRSAbsdj+r3+nXegoDYdB/Qm4nvU="

     

       1236
       981
        
         },

     

       1237
       982
        
         {

     

       1238
       983
        
           "pname": "System.Security.Cryptography.X509Certificates",

     
···

       1241
       986
        
         },

     

       1242
       987
        
         {

     

       1243
       988
        
           "pname": "System.Security.Cryptography.Xml",

     

       1244
       1244
       -
           "version": "9.0.0",

     

       1245
       1245
       -
           "hash": "sha256-SQJWwAFrJUddEU6JiZB52FM9tGjRlJAYH8oYVzG5IJU="

     

       989
       989
       +
           "version": "9.0.1",

     

       990
       990
       +
           "hash": "sha256-7kxs0pLGYK5OqUHsXCaHgEbuHFw6PnWagZweChxiGBk="

     

       1246
       991
        
         },

     

       1247
       992
        
         {

     

       1248
       993
        
           "pname": "System.Security.Principal.Windows",

     
···

       1256
       1001
        
         },

     

       1257
       1002
        
         {

     

       1258
       1003
        
           "pname": "System.Text.Encoding.CodePages",

     

       1259
       1259
       -
           "version": "7.0.0",

     

       1260
       1260
       -
           "hash": "sha256-eCKTVwumD051ZEcoJcDVRGnIGAsEvKpfH3ydKluHxmo="

     

       1261
       1261
       -
         },

     

       1262
       1262
       -
         {

     

       1263
       1263
       -
           "pname": "System.Text.Encoding.CodePages",

     

       1264
       1264
       -
           "version": "9.0.0",

     

       1265
       1265
       -
           "hash": "sha256-OvtGrWDjuXdcIuMV504IDiBq9g8vtRIcn5w25x4W9HE="

     

       1004
       1004
       +
           "version": "9.0.1",

     

       1005
       1005
       +
           "hash": "sha256-9ZQvC7M87NJ7dFRkBHE30yWXftKdcmFbSTkdazmxx2w="

     

       1266
       1006
        
         },

     

       1267
       1007
        
         {

     

       1268
       1008
        
           "pname": "System.Text.Encodings.Web",

     

       1269
       1269
       -
           "version": "9.0.0",

     

       1270
       1270
       -
           "hash": "sha256-WGaUklQEJywoGR2jtCEs5bxdvYu5SHaQchd6s4RE5x0="

     

       1009
       1009
       +
           "version": "9.0.1",

     

       1010
       1010
       +
           "hash": "sha256-iuAVcTiiZQLCZjDfDqdLLPHqZdZqvFabwLFHiVYdRJo="

     

       1271
       1011
        
         },

     

       1272
       1012
        
         {

     

       1273
       1013
        
           "pname": "System.Text.Json",

     

       1274
       1274
       -
           "version": "9.0.0",

     

       1275
       1275
       -
           "hash": "sha256-aM5Dh4okLnDv940zmoFAzRmqZre83uQBtGOImJpoIqk="

     

       1014
       1014
       +
           "version": "9.0.1",

     

       1015
       1015
       +
           "hash": "sha256-2dqE+Mx5eJZ8db74ofUiUXHOSxDCmXw5n9VC9w4fUr0="

     

       1276
       1016
        
         },

     

       1277
       1017
        
         {

     

       1278
       1018
        
           "pname": "System.Text.RegularExpressions",

     
···

       1286
       1026
        
         },

     

       1287
       1027
        
         {

     

       1288
       1028
        
           "pname": "System.Threading.Channels",

     

       1289
       1289
       -
           "version": "7.0.0",

     

       1290
       1290
       -
           "hash": "sha256-Cu0gjQsLIR8Yvh0B4cOPJSYVq10a+3F9pVz/C43CNeM="

     

       1291
       1291
       -
         },

     

       1292
       1292
       -
         {

     

       1293
       1293
       -
           "pname": "System.Threading.Channels",

     

       1294
       1294
       -
           "version": "9.0.0",

     

       1295
       1295
       -
           "hash": "sha256-depIorJqzjyWew0+aBRgbGh88KWivbp9RrtWZHFr+pI="

     

       1029
       1029
       +
           "version": "9.0.1",

     

       1030
       1030
       +
           "hash": "sha256-vhMteiuJiLPcKFAPsi9Nlx9WDyO+ZyzrLe+ZwvulD3g="

     

       1296
       1031
        
         },

     

       1297
       1032
        
         {

     

       1298
       1033
        
           "pname": "System.Threading.Tasks",

     
···

       1301
       1036
        
         },

     

       1302
       1037
        
         {

     

       1303
       1038
        
           "pname": "System.Threading.Tasks.Dataflow",

     

       1304
       1304
       -
           "version": "9.0.0",

     

       1305
       1305
       -
           "hash": "sha256-nRzcFvLBpcOfyIJdCCZq5vDKZN0xHVuB8yCXoMrwZJA="

     

       1306
       1306
       -
         },

     

       1307
       1307
       -
         {

     

       1308
       1308
       -
           "pname": "System.Threading.Tasks.Extensions",

     

       1309
       1309
       -
           "version": "4.5.4",

     

       1310
       1310
       -
           "hash": "sha256-owSpY8wHlsUXn5xrfYAiu847L6fAKethlvYx97Ri1ng="

     

       1039
       1039
       +
           "version": "9.0.1",

     

       1040
       1040
       +
           "hash": "sha256-8U695SoAQZlWXHXVfiGpG9qePQUb9SfqaBRYYeaFaGY="

     

       1311
       1041
        
         },

     

       1312
       1042
        
         {

     

       1313
       1043
        
           "pname": "System.Threading.Tasks.Extensions",

+13 -5

pkgs/by-name/fs/fsautocomplete/package.nix

···

       4
       4
        
         fetchFromGitHub,

     

       5
       5
        
         dotnetCorePackages,

     

       6
       6
        
         testers,

     

       7
       7
       +
         _experimental-update-script-combinators,

     

       8
       8
       +
         nix-update-script,

     

       7
       9
        
       }:

     

       8
       10
        
       

     

       9
       9
       -
       buildDotnetModule (finalAttrs: rec {

     

       11
       11
       +
       buildDotnetModule (finalAttrs: {

     

       10
       12
        
         pname = "fsautocomplete";

     

       11
       11
       -
         version = "0.75.0";

     

       13
       13
       +
         version = "0.77.2";

     

       12
       14
        
       

     

       13
       15
        
         src = fetchFromGitHub {

     

       14
       16
        
           owner = "fsharp";

     

       15
       17
        
           repo = "FsAutoComplete";

     

       16
       16
       -
           rev = "v${version}";

     

       17
       17
       -
           hash = "sha256-+IkoXj7l6a/iPigIVy334XiwQFm/pD63FWpV2r0x84c=";

     

       18
       18
       +
           rev = "v${finalAttrs.version}";

     

       19
       19
       +
           hash = "sha256-rCfiWzVsK9lvo4uMNrgWdXsjrvBQDZOyFpKxKdbT/3g=";

     

       18
       20
        
         };

     

       19
       21
        
       

     

       20
       22
        
         nugetDeps = ./deps.json;

     
···

       34
       36
        
       

     

       35
       37
        
         useDotnetFromEnv = true;

     

       36
       38
        
       

     

       37
       37
       -
         passthru.tests.version = testers.testVersion { package = finalAttrs.finalPackage; };

     

       39
       39
       +
         passthru = {

     

       40
       40
       +
           tests.version = testers.testVersion { package = finalAttrs.finalPackage; };

     

       41
       41
       +
           updateScript = _experimental-update-script-combinators.sequence [

     

       42
       42
       +
             (nix-update-script { })

     

       43
       43
       +
             finalAttrs.passthru.fetch-deps

     

       44
       44
       +
           ];

     

       45
       45
       +
         };

     

       38
       46
        
       

     

       39
       47
        
         meta = with lib; {

     

       40
       48
        
           description = "FsAutoComplete project (FSAC) provides a backend service for rich editing or intellisense features for editors";

+11 -9

pkgs/by-name/gi/git-big-picture/package.nix

···

       1
       1
        
       {

     

       2
       2
        
         lib,

     

       3
       3
        
         python3Packages,

     

       4
       4
       -
         fetchPypi,

     

       4
       4
       +
         fetchFromGitHub,

     

       5
       5
        
         git,

     

       6
       6
        
         graphviz,

     

       7
       7
        
       }:

     

       8
       8
        
       

     

       9
       9
        
       python3Packages.buildPythonApplication rec {

     

       10
       10
        
         pname = "git-big-picture";

     

       11
       11
       -
         version = "1.1.1";

     

       12
       12
       -
         format = "wheel";

     

       11
       11
       +
         version = "1.3.0";

     

       12
       12
       +
         pyproject = true;

     

       13
       13
        
       

     

       14
       14
       -
         src = fetchPypi {

     

       15
       15
       -
           inherit format version;

     

       16
       16
       -
           pname = "git_big_picture"; # underscores needed for working download URL

     

       17
       17
       -
           python = "py3"; # i.e. no Python 2.7

     

       18
       18
       -
           sha256 = "a20a480057ced1585c4c38497d27a5012f12dd29697313f0bb8fa6ddbb5c17d8";

     

       14
       14
       +
         src = fetchFromGitHub {

     

       15
       15
       +
           owner = "git-big-picture";

     

       16
       16
       +
           repo = "git-big-picture";

     

       17
       17
       +
           tag = "v${version}";

     

       18
       18
       +
           hash = "sha256-aBwSw7smeRkkXSPY02Cs+jFI1wvgj1JisUny+R8G59E=";

     

       19
       19
        
         };

     

       20
       20
       +
       

     

       21
       21
       +
         build-system = with python3Packages; [ setuptools ];

     

       20
       22
        
       

     

       21
       23
        
         postFixup = ''

     

       22
       24
        
           wrapProgram $out/bin/git-big-picture \

     

       23
       23
       -
             --prefix PATH ":" ${

     

       25
       25
       +
             --prefix PATH : ${

     

       24
       26
        
               lib.makeBinPath [

     

       25
       27
        
                 git

     

       26
       28
        
                 graphviz

+5 -5

pkgs/by-name/go/google-chrome/package.nix

···

       171
       171
        
       

     

       172
       172
        
         linux = stdenv.mkDerivation (finalAttrs: {

     

       173
       173
        
           inherit pname meta passthru;

     

       174
       174
       -
           version = "133.0.6943.126";

     

       174
       174
       +
           version = "133.0.6943.141";

     

       175
       175
        
       

     

       176
       176
        
           src = fetchurl {

     

       177
       177
        
             url = "https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-stable/google-chrome-stable_${finalAttrs.version}-1_amd64.deb";

     

       178
       178
       -
             hash = "sha256-B1kPoPMgPOwusxosWzge4d6jQwV0A10fwL2gcrzYu/4=";

     

       178
       178
       +
             hash = "sha256-iMW9V3dARAG7kJgCCWIT0OBDsxYqDnp+CpwgcjAT8zI=";

     

       179
       179
        
           };

     

       180
       180
        
       

     

       181
       181
        
           # With strictDeps on, some shebangs were not being patched correctly

     
···

       274
       274
        
       

     

       275
       275
        
         darwin = stdenvNoCC.mkDerivation (finalAttrs: {

     

       276
       276
        
           inherit pname meta passthru;

     

       277
       277
       -
           version = "133.0.6943.127";

     

       277
       277
       +
           version = "133.0.6943.142";

     

       278
       278
        
       

     

       279
       279
        
           src = fetchurl {

     

       280
       280
       -
             url = "http://dl.google.com/release2/chrome/ac4k2kxfjhk4ggh2tvxk4t47hl7q_133.0.6943.127/GoogleChrome-133.0.6943.127.dmg";

     

       281
       281
       -
             hash = "sha256-baWFgjwcHg1Y3jNdIpcARFoaK0GZgqFe0bM2xtXsJtA=";

     

       280
       280
       +
             url = "http://dl.google.com/release2/chrome/ejubi5y7bpapjhrevtxffszuji_133.0.6943.142/GoogleChrome-133.0.6943.142.dmg";

     

       281
       281
       +
             hash = "sha256-cDnCnswvtRkyrwv52/GFHPTsmRZItN3rgqqc62mS7Ao=";

     

       282
       282
        
           };

     

       283
       283
        
       

     

       284
       284
        
           dontPatch = true;

+3 -3

pkgs/by-name/go/gotosocial/package.nix

···

       9
       9
        
         owner = "superseriousbusiness";

     

       10
       10
        
         repo = "gotosocial";

     

       11
       11
        
       

     

       12
       12
       -
         version = "0.17.4";

     

       12
       12
       +
         version = "0.18.1";

     

       13
       13
        
       

     

       14
       14
        
         web-assets = fetchurl {

     

       15
       15
        
           url = "https://github.com/${owner}/${repo}/releases/download/v${version}/${repo}_${version}_web-assets.tar.gz";

     

       16
       16
       -
           hash = "sha256-esip1xGB0NroYRlKLNEs/o3J2G2nQyOIZTdDpVuY5Ag=";

     

       16
       16
       +
           hash = "sha256-5MSABLPyTbFMTno9vUDvLT9h7oQM6eNUuwD+dsHiCLo=";

     

       17
       17
        
         };

     

       18
       18
        
       in

     

       19
       19
        
       buildGoModule rec {

     
···

       23
       23
        
         src = fetchFromGitHub {

     

       24
       24
        
           inherit owner repo;

     

       25
       25
        
           tag = "v${version}";

     

       26
       26
       -
           hash = "sha256-OikJkTc2UK74eGy8AjEAk8cyRL57QReM0J6tXr9EAjw=";

     

       26
       26
       +
           hash = "sha256-4jV1G1HwpIST2Y27RAhJB3CoJevwuhxdzi615hj0Qv0=";

     

       27
       27
        
         };

     

       28
       28
        
       

     

       29
       29
        
         vendorHash = null;

+4 -4

pkgs/by-name/ho/hoppscotch/package.nix

···

       8
       8
        
       

     

       9
       9
        
       let

     

       10
       10
        
         pname = "hoppscotch";

     

       11
       11
       -
         version = "24.12.0-0";

     

       11
       11
       +
         version = "25.1.1-0";

     

       12
       12
        
       

     

       13
       13
        
         src =

     

       14
       14
        
           fetchurl

     

       15
       15
        
             {

     

       16
       16
        
               aarch64-darwin = {

     

       17
       17
        
                 url = "https://github.com/hoppscotch/releases/releases/download/v${version}/Hoppscotch_mac_aarch64.dmg";

     

       18
       18
       -
                 hash = "sha256-pM9s5rRb/VswJECK44Ku2rSa4a7kpKhJM9t6uR/6B9A=";

     

       18
       18
       +
                 hash = "sha256-1KYc96WUlybXhgPeT97w1mLE2zxmohIhvNMCmEb5Vf0=";

     

       19
       19
        
               };

     

       20
       20
        
               x86_64-darwin = {

     

       21
       21
        
                 url = "https://github.com/hoppscotch/releases/releases/download/v${version}/Hoppscotch_mac_x64.dmg";

     

       22
       22
       -
                 hash = "sha256-vXZSeogWBJt7ev0bmWB5MWYcePgq1noG3djU8kjZumQ=";

     

       22
       22
       +
                 hash = "sha256-wdqgzTXFL7Dvq1DOrjyPE4O3OYfpvmRSLzk+HBJIaTU=";

     

       23
       23
        
               };

     

       24
       24
        
               x86_64-linux = {

     

       25
       25
        
                 url = "https://github.com/hoppscotch/releases/releases/download/v${version}/Hoppscotch_linux_x64.AppImage";

     

       26
       26
       -
                 hash = "sha256-iwSqGcaQqFawGhT4vWKQp63ZoHGjssNYJ3ByvKJacU0=";

     

       26
       26
       +
                 hash = "sha256-M9fQx4NBotLPe8i43E1uqHpFeoXdHGQePp4zgzbzDdM=";

     

       27
       27
        
               };

     

       28
       28
        
             }

     

       29
       29
        
             .${stdenv.system} or (throw "Unsupported system: ${stdenv.system}");

+2 -2

pkgs/by-name/ku/kubo/package.nix

···

       8
       8
        
       

     

       9
       9
        
       buildGoModule rec {

     

       10
       10
        
         pname = "kubo";

     

       11
       11
       -
         version = "0.33.1"; # When updating, also check if the repo version changed and adjust repoVersion below

     

       11
       11
       +
         version = "0.33.2"; # When updating, also check if the repo version changed and adjust repoVersion below

     

       12
       12
        
         rev = "v${version}";

     

       13
       13
        
       

     

       14
       14
        
         passthru.repoVersion = "16"; # Also update kubo-migrator when changing the repo version

     
···

       16
       16
        
         # Kubo makes changes to its source tarball that don't match the git source.

     

       17
       17
        
         src = fetchurl {

     

       18
       18
        
           url = "https://github.com/ipfs/kubo/releases/download/${rev}/kubo-source.tar.gz";

     

       19
       19
       -
           hash = "sha256-ybsQ25tuRPCp5XKZyxpq/a0x/h69P41+SLukro1xuMc=";

     

       19
       19
       +
           hash = "sha256-PSXX1mLteeLpaq74PnWeDy+E6E3uVWr1c5+FTMBKc5g=";

     

       20
       20
        
         };

     

       21
       21
        
       

     

       22
       22
        
         # tarball contains multiple files/directories

+4 -1

pkgs/by-name/le/lego/package.nix

···

       29
       29
        
           mainProgram = "lego";

     

       30
       30
        
         };

     

       31
       31
        
       

     

       32
       32
       -
         passthru.tests.lego = nixosTests.acme;

     

       32
       32
       +
         passthru.tests = {

     

       33
       33
       +
           lego-http = nixosTests.acme.http01-builtin;

     

       34
       34
       +
           lego-dns = nixosTests.acme.dns01-builtin;

     

       35
       35
       +
         };

     

       33
       36
        
       }

+81

pkgs/by-name/op/open-adventure/package.nix

···

       1
       1
       +
       {

     

       2
       2
       +
         lib,

     

       3
       3
       +
         stdenv,

     

       4
       4
       +
         fetchFromGitLab,

     

       5
       5
       +
         python3Packages,

     

       6
       6
       +
         pkg-config,

     

       7
       7
       +
         libedit,

     

       8
       8
       +
         cppcheck,

     

       9
       9
       +
         coreutils,

     

       10
       10
       +
         asciidoctor,

     

       11
       11
       +
       }:

     

       12
       12
       +
       

     

       13
       13
       +
       stdenv.mkDerivation (finalAttrs: {

     

       14
       14
       +
         pname = "open-adventure";

     

       15
       15
       +
         version = "1.20";

     

       16
       16
       +
         src = fetchFromGitLab {

     

       17
       17
       +
           owner = "esr";

     

       18
       18
       +
           repo = "open-adventure";

     

       19
       19
       +
           tag = finalAttrs.version;

     

       20
       20
       +
           hash = "sha256-xbsMz99CNLhpM6BSJVcRzxPB6tUYfPy/3Z+8BKt8b1E=";

     

       21
       21
       +
         };

     

       22
       22
       +
       

     

       23
       23
       +
         nativeBuildInputs = [

     

       24
       24
       +
           python3Packages.python

     

       25
       25
       +
           pkg-config

     

       26
       26
       +
           asciidoctor

     

       27
       27
       +
         ];

     

       28
       28
       +
       

     

       29
       29
       +
         buildInputs = [

     

       30
       30
       +
           python3Packages.pyyaml

     

       31
       31
       +
           libedit

     

       32
       32
       +
         ];

     

       33
       33
       +
       

     

       34
       34
       +
         doCheck = true;

     

       35
       35
       +
       

     

       36
       36
       +
         nativeCheckInputs = [

     

       37
       37
       +
           python3Packages.pylint

     

       38
       38
       +
           cppcheck

     

       39
       39
       +
         ];

     

       40
       40
       +
       

     

       41
       41
       +
         postPatch = ''

     

       42
       42
       +
           patchShebangs --build make_dungeon.py

     

       43
       43
       +
       

     

       44
       44
       +
           # https://gitlab.com/esr/open-adventure/-/issues/70

     

       45
       45
       +
           substituteInPlace Makefile --replace-fail "--template " "--template="

     

       46
       46
       +
       

     

       47
       47
       +
           substituteInPlace tests/tapview --replace-fail "/bin/echo" ${lib.getExe' coreutils "echo"}

     

       48
       48
       +
         '';

     

       49
       49
       +
       

     

       50
       50
       +
         buildFlags = [

     

       51
       51
       +
           "advent.6"

     

       52
       52
       +
         ];

     

       53
       53
       +
       

     

       54
       54
       +
         installPhase = ''

     

       55
       55
       +
           runHook preInstall

     

       56
       56
       +
       

     

       57
       57
       +
           mkdir -vp "$out/bin" "$out/share/man/man6" "$out/share/applications/" "$out/share/icons/hicolor/scalable/apps"

     

       58
       58
       +
           install -m 555 ./advent $out/bin

     

       59
       59
       +
           install -m 444 ./advent.6 $out/share/man/man6

     

       60
       60
       +
           install -m 444 ./advent.desktop $out/share/applications

     

       61
       61
       +
           install -m 444 ./advent.svg $out/share/icons/hicolor/scalable/apps

     

       62
       62
       +
       

     

       63
       63
       +
           runHook postInstall

     

       64
       64
       +
         '';

     

       65
       65
       +
       

     

       66
       66
       +
         meta = {

     

       67
       67
       +
           description = "Forward-port of the Crowther/Woods Adventure 2.5 game from 1995";

     

       68
       68
       +
           longDescription = ''

     

       69
       69
       +
             This code is a forward-port of the Crowther/Woods Adventure 2.5 game

     

       70
       70
       +
             from 1995, last version in the main line of Colossal Cave Adventure

     

       71
       71
       +
             development written by Crowther and Woods. The authors have given

     

       72
       72
       +
             permission and encouragement to this release.

     

       73
       73
       +
           '';

     

       74
       74
       +
           license = lib.licenses.bsd2;

     

       75
       75
       +
           mainProgram = "advent";

     

       76
       76
       +
           homepage = "http://www.catb.org/~esr/open-adventure/";

     

       77
       77
       +
           changelog = "https://gitlab.com/esr/open-adventure/-/blob/${finalAttrs.version}/NEWS.adoc";

     

       78
       78
       +
           maintainers = with lib.maintainers; [ EmanuelM153 ];

     

       79
       79
       +
           platforms = lib.platforms.all;

     

       80
       80
       +
         };

     

       81
       81
       +
       })

+2 -1

pkgs/by-name/pe/pebble/package.nix

···

       25
       25
        
         ];

     

       26
       26
        
       

     

       27
       27
        
         passthru.tests = {

     

       28
       28
       -
           smoke-test = nixosTests.acme;

     

       28
       28
       +
           smoke-test-http = nixosTests.acme.http01-builtin;

     

       29
       29
       +
           smoke-test-dns = nixosTests.acme.dns01;

     

       29
       30
        
         };

     

       30
       31
        
       

     

       31
       32
        
         meta = {

+11 -10

pkgs/by-name/ra/radsecproxy/package.nix

···

       9
       9
        
       

     

       10
       10
        
       stdenv.mkDerivation rec {

     

       11
       11
        
         pname = "radsecproxy";

     

       12
       12
       -
         version = "1.9.3";

     

       12
       12
       +
         version = "1.11.1";

     

       13
       13
        
       

     

       14
       14
        
         src = fetchFromGitHub {

     

       15
       15
       -
           owner = pname;

     

       16
       16
       -
           repo = pname;

     

       17
       17
       -
           rev = version;

     

       18
       18
       -
           sha256 = "sha256-4w5aQIh3loHrxFGhWt6pW2jgj/JuqQSYmNsnAkEuKoI=";

     

       15
       15
       +
           owner = "radsecproxy";

     

       16
       16
       +
           repo = "radsecproxy";

     

       17
       17
       +
           tag = version;

     

       18
       18
       +
           hash = "sha256-2+NDcz2RGRa30+XXS/PT5rjjKJYEnibYY3mVWjDv7Jk=";

     

       19
       19
        
         };

     

       20
       20
        
       

     

       21
       21
        
         nativeBuildInputs = [ autoreconfHook ];

     

       22
       22
       +
       

     

       22
       23
        
         buildInputs = [

     

       23
       24
        
           openssl

     

       24
       25
        
           nettle

     

       25
       26
        
         ];

     

       26
       27
        
       

     

       27
       28
        
         configureFlags = [

     

       28
       28
       -
           "--with-ssl=${openssl.dev}"

     

       29
       29
       +
           "--with-openssl=${openssl.dev}"

     

       29
       30
        
           "--sysconfdir=/etc"

     

       30
       31
        
           "--localstatedir=/var"

     

       31
       32
        
         ];

     

       32
       33
        
       

     

       33
       33
       -
         meta = with lib; {

     

       34
       34
       +
         meta = {

     

       34
       35
        
           homepage = "https://radsecproxy.github.io/";

     

       35
       36
        
           description = "Generic RADIUS proxy that supports both UDP and TLS (RadSec) RADIUS transports";

     

       36
       36
       -
           license = licenses.bsd3;

     

       37
       37
       -
           maintainers = with maintainers; [ sargon ];

     

       38
       38
       -
           platforms = with platforms; linux;

     

       37
       37
       +
           license = lib.licenses.bsd3;

     

       38
       38
       +
           maintainers = with lib.maintainers; [ sargon ];

     

       39
       39
       +
           platforms = with lib.platforms; linux;

     

       39
       40
        
         };

     

       40
       41
        
       }

+7 -2

pkgs/by-name/sn/snyk/package.nix

···

       8
       8
        
       }:

     

       9
       9
        
       

     

       10
       10
        
       let

     

       11
       11
       -
         version = "1.1295.2";

     

       11
       11
       +
         version = "1.1295.3";

     

       12
       12
        
       in

     

       13
       13
        
       buildNpmPackage {

     

       14
       14
        
         pname = "snyk";

     
···

       18
       18
        
           owner = "snyk";

     

       19
       19
        
           repo = "cli";

     

       20
       20
        
           tag = "v${version}";

     

       21
       21
       -
           hash = "sha256-cHOIToO9xr+CNS0llwffaTUdhUqFbFcZcrPnBeD+JxE=";

     

       21
       21
       +
           hash = "sha256-I7x+HjucTEhiAC6bocMeQO/eAWHYcqwA9FXYvcef3Og=";

     

       22
       22
        
         };

     

       23
       23
        
       

     

       24
       24
        
         npmDepsHash = "sha256-RuIavwtTbgo5Ni7oGH2i5VAcVxfS4wKKSX6qHD8CHIw=";

     
···

       26
       26
        
         postPatch = ''

     

       27
       27
        
           substituteInPlace package.json \

     

       28
       28
        
             --replace-fail '"version": "1.0.0-monorepo"' '"version": "${version}"'

     

       29
       29
       +
         '';

     

       30
       30
       +
       

     

       31
       31
       +
         postInstall = ''

     

       32
       32
       +
           # Remove dangling symlinks created during installation (remove -delete to just see the files, or -print '%l\n' to see the target

     

       33
       33
       +
           find -L $out -type l -print -delete

     

       29
       34
        
         '';

     

       30
       35
        
       

     

       31
       36
        
         nodejs = nodejs_20;

+3 -3

pkgs/by-name/sy/symfony-cli/package.nix

···

       11
       11
        
       

     

       12
       12
        
       buildGoModule rec {

     

       13
       13
        
         pname = "symfony-cli";

     

       14
       14
       -
         version = "5.10.9";

     

       15
       15
       -
         vendorHash = "sha256-UqaRZPCgjiexeeylfP8p0rye6oc+rWac87p8KbVKrdc=";

     

       14
       14
       +
         version = "5.11.0";

     

       15
       15
       +
         vendorHash = "sha256-6DNirMtVuuWJziDy6HeJxHQnV2f7jmie7kcXvUDfN94=";

     

       16
       16
        
       

     

       17
       17
        
         src = fetchFromGitHub {

     

       18
       18
        
           owner = "symfony-cli";

     

       19
       19
        
           repo = "symfony-cli";

     

       20
       20
        
           rev = "v${version}";

     

       21
       21
       -
           hash = "sha256-Y7wtWrEe1/aftHGdwRA+1Uw9vHJRST9yjhFGYVEgdgo=";

     

       21
       21
       +
           hash = "sha256-r8B9lFcTG0TWb3U8eRzg9SkwUY90805wdFlmPbtMywk=";

     

       22
       22
        
           leaveDotGit = true;

     

       23
       23
        
           postFetch = ''

     

       24
       24
        
             git --git-dir $out/.git log -1 --pretty=%cd --date=format:'%Y-%m-%dT%H:%M:%SZ' > $out/SOURCE_DATE

+3 -3

pkgs/by-name/up/upx/package.nix

···

       9
       9
        
       

     

       10
       10
        
       stdenv.mkDerivation (finalAttrs: {

     

       11
       11
        
         pname = "upx";

     

       12
       12
       -
         version = "4.2.4";

     

       12
       12
       +
         version = "5.0.0";

     

       13
       13
        
         src = fetchFromGitHub {

     

       14
       14
        
           owner = "upx";

     

       15
       15
        
           repo = "upx";

     

       16
       16
       -
           rev = "v${finalAttrs.version}";

     

       16
       16
       +
           tag = "v${finalAttrs.version}";

     

       17
       17
        
           fetchSubmodules = true;

     

       18
       18
       -
           hash = "sha256-r36BD5f/sQSz3GjvreOptc7atIaaBZKpU+7qm+BKLss=";

     

       18
       18
       +
           hash = "sha256-LWir7Quf53G3Q9Lyw+sokn7Rtes2DxeZD8UsYviy3aA=";

     

       19
       19
        
         };

     

       20
       20
        
       

     

       21
       21
        
         nativeBuildInputs = [ cmake ];

+8 -3

pkgs/by-name/vt/vtsls/package.nix

···

       5
       5
        
         nodejs_22,

     

       6
       6
        
         gitMinimal,

     

       7
       7
        
         pnpm_8,

     

       8
       8
       +
         nix-update-script,

     

       8
       9
        
       }:

     

       9
       10
        
       

     

       10
       11
        
       stdenv.mkDerivation (finalAttrs: {

     

       11
       12
        
         pname = "vtsls";

     

       12
       12
       -
         version = "0.2.6";

     

       13
       13
       +
         version = "0.2.8";

     

       13
       14
        
       

     

       14
       15
        
         src = fetchFromGitHub {

     

       15
       16
        
           owner = "yioneko";

     

       16
       17
        
           repo = "vtsls";

     

       17
       18
        
           rev = "server-v${finalAttrs.version}";

     

       18
       18
       -
           hash = "sha256-HCi9WLh4IEfhgkQNUVk6IGkQfYagg805Rix78zG6xt0=";

     

       19
       19
       +
           hash = "sha256-Ng+aOBnxFRbMjoUy6+DvIk2yVpvJT+AMsbvDb+IlYpY=";

     

       19
       20
        
           fetchSubmodules = true;

     

       20
       21
        
         };

     

       21
       22
        
       

     
···

       37
       38
        
             src

     

       38
       39
        
             version

     

       39
       40
        
             ;

     

       40
       40
       -
           hash = "sha256-4XxQ0Z2atTBItrD9iY7q5rJaCmb1EeDBvQ5+L3ceRXI=";

     

       41
       41
       +
           hash = "sha256-xenPpKsIjEIyVeZDjwjLaBbpWLqWQDBaLLfyzxtrsTI=";

     

       41
       42
        
         };

     

       42
       43
        
       

     

       43
       44
        
         # Patches to get submodule sha from file instead of 'git submodule status'

     
···

       81
       82
        
       

     

       82
       83
        
           runHook postInstall

     

       83
       84
        
         '';

     

       85
       85
       +
       

     

       86
       86
       +
         passthru = {

     

       87
       87
       +
           updateScript = nix-update-script { };

     

       88
       88
       +
         };

     

       84
       89
        
       

     

       85
       90
        
         meta = {

     

       86
       91
        
           description = "LSP wrapper for typescript extension of vscode.";

+38

pkgs/by-name/wa/wasm-language-tools/package.nix

···

       1
       1
       +
       {

     

       2
       2
       +
         lib,

     

       3
       3
       +
         rustPlatform,

     

       4
       4
       +
         fetchFromGitHub,

     

       5
       5
       +
         versionCheckHook,

     

       6
       6
       +
         nix-update-script,

     

       7
       7
       +
       }:

     

       8
       8
       +
       

     

       9
       9
       +
       rustPlatform.buildRustPackage rec {

     

       10
       10
       +
         pname = "wasm-language-tools";

     

       11
       11
       +
         version = "0.3.2";

     

       12
       12
       +
       

     

       13
       13
       +
         src = fetchFromGitHub {

     

       14
       14
       +
           owner = "g-plane";

     

       15
       15
       +
           repo = "wasm-language-tools";

     

       16
       16
       +
           tag = "v${version}";

     

       17
       17
       +
           hash = "sha256-f1Mq+1gZZelN12rFTLJHOvdzDAbqufzT9+I6pkJdJMU=";

     

       18
       18
       +
         };

     

       19
       19
       +
       

     

       20
       20
       +
         useFetchCargoVendor = true;

     

       21
       21
       +
         cargoHash = "sha256-P3sxAFZjAlgPrGrw3W+7ufflUz3/Xe7lTXygnSX5Q+4=";

     

       22
       22
       +
       

     

       23
       23
       +
         nativeInstallCheckInputs = [ versionCheckHook ];

     

       24
       24
       +
         versionCheckProgram = "${placeholder "out"}/bin/wat_server";

     

       25
       25
       +
         versionCheckProgramArg = "--version";

     

       26
       26
       +
         doInstallCheck = true;

     

       27
       27
       +
       

     

       28
       28
       +
         passthru.updateScript = nix-update-script { };

     

       29
       29
       +
       

     

       30
       30
       +
         meta = {

     

       31
       31
       +
           description = "Language server and other tools for WebAssembly";

     

       32
       32
       +
           homepage = "https://github.com/g-plane/wasm-language-tools/";

     

       33
       33
       +
           changelog = "https://github.com/g-plane/wasm-language-tools/releases/tag/v${version}/CHANGELOG.md";

     

       34
       34
       +
           license = lib.licenses.mit;

     

       35
       35
       +
           maintainers = with lib.maintainers; [ ethancedwards8 ];

     

       36
       36
       +
           mainProgram = "wat_server";

     

       37
       37
       +
         };

     

       38
       38
       +
       }

+2 -2

pkgs/development/libraries/python-qt/default.nix

···

       11
       11
        
       

     

       12
       12
        
       stdenv.mkDerivation (finalAttrs: {

     

       13
       13
        
         pname = "python-qt";

     

       14
       14
       -
         version = "3.5.7";

     

       14
       14
       +
         version = "3.6.0";

     

       15
       15
        
       

     

       16
       16
        
         src = fetchFromGitHub {

     

       17
       17
        
           owner = "MeVisLab";

     

       18
       18
        
           repo = "pythonqt";

     

       19
       19
        
           rev = "v${finalAttrs.version}";

     

       20
       20
       -
           hash = "sha256-UE0UNp9ArXNFga4MGb80fAQWeq1US5kk7FEZ8tS94OU=";

     

       20
       20
       +
           hash = "sha256-TVtnxb8E18x025lZiZLdgCA7ltLtToI1tsmB6gBh2B4=";

     

       21
       21
        
         };

     

       22
       22
        
       

     

       23
       23
        
         nativeBuildInputs = [

+6 -32

pkgs/development/ocaml-modules/camlimages/camlimages.patch

···

       1
       1
        
       diff --git a/config/xConfigurator.ml b/config/xConfigurator.ml

     

       2
       2
       -
       index 268df4a..73e1850 100644

     

       2
       2
       +
       index 766a35c..1d1aff5 100644

     

       3
       3
        
       --- a/config/xConfigurator.ml

     

       4
       4
        
       +++ b/config/xConfigurator.ml

     

       5
       5
        
       @@ -8,7 +8,7 @@ let (!%) fmt = Printf.sprintf fmt

     
···

       30
       30
        
          let find_program prog =

     

       31
       31
        
            let prog = prog ^ exe in

     

       32
       32
        
       @@ -45,13 +45,13 @@ module Configurator = struct

     

       33
       33
       -
            | s -> 

     

       34
       34
       -
                (* findlib 1.7.3 installs META file for graphics 

     

       33
       33
       +
            | s ->

     

       34
       34
       +
                (* findlib 1.7.3 installs META file for graphics

     

       35
       35
        
                   even when there is no graphics library installed. *)

     

       36
       36
        
       -        let dest = Caml.Filename.temp_file "test" ".cma" in

     

       37
       37
        
       -        let res = match Caml.Sys.command & !% "ocamlfind ocamlc -package %s -o %s -linkpkg" n dest with

     
···

       72
       72
        
       -    let fcalls = Caml.List.map (!% "  ( (void(*)()) (%s) )();") fnames in

     

       73
       73
        
       +    let includes = Stdlib.List.map (!% "#include <%s>") headers in

     

       74
       74
        
       +    let fcalls = Stdlib.List.map (!% "  ( (void(*)()) (%s) )();") fnames in

     

       75
       75
       -
            let code = 

     

       76
       76
       -
              String.concat ~sep:"\n" 

     

       77
       77
       -
              & includes 

     

       78
       78
       -
       diff --git a/core/images.ml b/core/images.ml

     

       79
       79
       -
       index 563ab7e..a53a6a4 100644

     

       80
       80
       -
       --- a/core/images.ml

     

       81
       81
       -
       +++ b/core/images.ml

     

       82
       82
       -
       @@ -102,7 +102,7 @@ let get_extension s =

     

       83
       83
       -
          | _ -> s, ""

     

       84
       84
       -
        

     

       85
       85
       -
        let guess_extension s =

     

       86
       86
       -
       -  let s = String.lowercase s in

     

       87
       87
       -
       +  let s = String.lowercase_ascii s in

     

       88
       88
       -
          match s with

     

       89
       89
       -
          | "gif" -> Gif

     

       90
       90
       -
          | "bmp" -> Bmp

     

       91
       91
       -
       diff --git a/core/units.ml b/core/units.ml

     

       92
       92
       -
       index 634bc9c..ddd6eae 100644

     

       93
       93
       -
       --- a/core/units.ml

     

       94
       94
       -
       +++ b/core/units.ml

     

       95
       95
       -
       @@ -30,7 +30,7 @@ let parse_length s = (* return in pt *)

     

       96
       96
       -
            let digit,unit =

     

       97
       97
       -
              if l > 2 then String.sub s 0 2, String.sub s (l-2) 2 else "", "" in

     

       98
       98
       -
            try

     

       99
       99
       -
       -      (List.assoc (String.lowercase unit) units) *. float_of_string digit

     

       100
       100
       -
       +      (List.assoc (String.lowercase_ascii unit) units) *. float_of_string digit

     

       101
       101
       -
            with

     

       102
       102
       -
            | Not_found -> (* think it is in "pt" *)

     

       103
       103
       -
              float_of_string s in

     

       75
       75
       +
            let code =

     

       76
       76
       +
              String.concat ~sep:"\n"

     

       77
       77
       +
              & includes

+3 -3

pkgs/development/ocaml-modules/camlimages/default.nix

···

       12
       12
        
       

     

       13
       13
        
       buildDunePackage rec {

     

       14
       14
        
         pname = "camlimages";

     

       15
       15
       -
         version = "5.0.4";

     

       15
       15
       +
         version = "5.0.5";

     

       16
       16
        
       

     

       17
       17
        
         minimalOCamlVersion = "4.07";

     

       18
       18
        
       

     
···

       20
       20
        
           owner = "camlspotter";

     

       21
       21
        
           repo = pname;

     

       22
       22
        
           rev = version;

     

       23
       23
       -
           sha256 = "1m2c76ghisg73dikz2ifdkrbkgiwa0hcmp21f2fm2rkbf02rq3f4";

     

       23
       23
       +
           hash = "sha256-/Dkj8IBVPjGCJCXrLOuJtuaa+nD/a9e8/N+TN9ukw4k=";

     

       24
       24
        
         };

     

       25
       25
        
       

     

       26
       26
       -
         # stdio v0.17 compatibility; also replaces `String.lowercase` with `String.lowercase_ascii`

     

       26
       26
       +
         # stdio v0.17 compatibility

     

       27
       27
        
         patches = [ ./camlimages.patch ];

     

       28
       28
        
       

     

       29
       29
        
         nativeBuildInputs = [ cppo ];

+28

pkgs/development/ocaml-modules/mirage-ptime/default.nix

···

       1
       1
       +
       {

     

       2
       2
       +
         lib,

     

       3
       3
       +
         buildDunePackage,

     

       4
       4
       +
         fetchurl,

     

       5
       5
       +
         ptime,

     

       6
       6
       +
         version ? "5.0.0",

     

       7
       7
       +
       }:

     

       8
       8
       +
       

     

       9
       9
       +
       buildDunePackage {

     

       10
       10
       +
         inherit version;

     

       11
       11
       +
       

     

       12
       12
       +
         pname = "mirage-ptime";

     

       13
       13
       +
       

     

       14
       14
       +
         src = fetchurl {

     

       15
       15
       +
           url = "https://github.com/mirage/mirage-ptime/releases/download/v${version}/mirage-ptime-${version}.tbz";

     

       16
       16
       +
           hash = "sha256-1VNWBGjVuU2yWwVzjCSZ8pDuZrFKwitDAuZn8fpENHE=";

     

       17
       17
       +
         };

     

       18
       18
       +
       

     

       19
       19
       +
         propagatedBuildInputs = [ ptime ];

     

       20
       20
       +
       

     

       21
       21
       +
         meta = {

     

       22
       22
       +
           description = "A POSIX clock for MirageOS";

     

       23
       23
       +
           license = lib.licenses.isc;

     

       24
       24
       +
           maintainers = [ lib.maintainers.vbgl ];

     

       25
       25
       +
           changelog = "https://raw.githubusercontent.com/mirage/mirage-ptime/refs/tags/v${version}/CHANGES.md";

     

       26
       26
       +
           homepage = "https://github.com/mirage/mirage-ptime";

     

       27
       27
       +
         };

     

       28
       28
       +
       }

+3 -3

pkgs/development/ocaml-modules/tls/async.nix

···

       4
       4
        
         async,

     

       5
       5
        
         cstruct-async,

     

       6
       6
        
         core,

     

       7
       7
       -
         mirage-crypto-rng-async,

     

       7
       7
       +
         mirage-crypto-rng,

     

       8
       8
        
       }:

     

       9
       9
        
       

     

       10
       10
       -
       buildDunePackage rec {

     

       10
       10
       +
       buildDunePackage {

     

       11
       11
        
         pname = "tls-async";

     

       12
       12
        
       

     

       13
       13
        
         inherit (tls) src version;

     
···

       20
       20
        
           async

     

       21
       21
        
           core

     

       22
       22
        
           cstruct-async

     

       23
       23
       -
           mirage-crypto-rng-async

     

       23
       23
       +
           mirage-crypto-rng

     

       24
       24
        
           tls

     

       25
       25
        
         ];

     

       26
       26

+2 -2

pkgs/development/ocaml-modules/tls/default.nix

···

       18
       18
        
       

     

       19
       19
        
       buildDunePackage rec {

     

       20
       20
        
         pname = "tls";

     

       21
       21
       -
         version = "1.0.4";

     

       21
       21
       +
         version = "2.0.0";

     

       22
       22
        
       

     

       23
       23
        
         src = fetchurl {

     

       24
       24
        
           url = "https://github.com/mirleft/ocaml-tls/releases/download/v${version}/tls-${version}.tbz";

     

       25
       25
       -
           hash = "sha256-yFt8Gh4ipseWEHsnJVld3iYElMDvBrYdn1O+IuHcQug=";

     

       25
       25
       +
           hash = "sha256-aEcNa6hIAHWQjAzGn/6Cq7y7g6t/mI0mYzWhnxLCamI=";

     

       26
       26
        
         };

     

       27
       27
        
       

     

       28
       28
        
         minimalOCamlVersion = "4.08";

+4 -5

pkgs/development/ocaml-modules/tls/eio.nix

···

       5
       5
        
         eio_main,

     

       6
       6
        
         logs,

     

       7
       7
        
         mdx,

     

       8
       8
       -
         mirage-crypto-rng-eio,

     

       8
       8
       +
         mirage-crypto-rng,

     

       9
       9
        
         ptime,

     

       10
       10
        
         tls,

     

       11
       11
        
       }:

     

       12
       12
        
       

     

       13
       13
       -
       buildDunePackage rec {

     

       13
       13
       +
       buildDunePackage {

     

       14
       14
        
         pname = "tls-eio";

     

       15
       15
        
       

     

       16
       16
        
         inherit (tls) src meta version;

     

       17
       17
        
       

     

       18
       18
        
         minimalOCamlVersion = "5.0";

     

       19
       19
        
       

     

       20
       20
       -
         # Tests are not compatible with mirage-crypto-rng 1.2.0

     

       21
       21
       -
         doCheck = false;

     

       20
       20
       +
         doCheck = true;

     

       22
       21
        
         nativeCheckInputs = [

     

       23
       22
        
           mdx.bin

     

       24
       23
        
         ];

     
···

       31
       30
        
         propagatedBuildInputs = [

     

       32
       31
        
           ptime

     

       33
       32
        
           eio

     

       34
       34
       -
           mirage-crypto-rng-eio

     

       33
       33
       +
           mirage-crypto-rng

     

       35
       34
        
           tls

     

       36
       35
        
         ];

     

       37
       36
        
       }

+3 -3

pkgs/development/ocaml-modules/tls/lwt.nix

···

       2
       2
        
         buildDunePackage,

     

       3
       3
        
         tls,

     

       4
       4
        
         lwt,

     

       5
       5
       -
         mirage-crypto-rng-lwt,

     

       5
       5
       +
         mirage-crypto-rng,

     

       6
       6
        
       }:

     

       7
       7
        
       

     

       8
       8
       -
       buildDunePackage rec {

     

       8
       8
       +
       buildDunePackage {

     

       9
       9
        
         pname = "tls-lwt";

     

       10
       10
        
       

     

       11
       11
        
         inherit (tls) src meta version;

     
···

       16
       16
        
       

     

       17
       17
        
         propagatedBuildInputs = [

     

       18
       18
        
           lwt

     

       19
       19
       -
           mirage-crypto-rng-lwt

     

       19
       19
       +
           mirage-crypto-rng

     

       20
       20
        
           tls

     

       21
       21
        
         ];

     

       22
       22
        
       }

+2 -2

pkgs/development/ocaml-modules/tls/mirage.nix

···

       3
       3
        
         tls,

     

       4
       4
        
         fmt,

     

       5
       5
        
         lwt,

     

       6
       6
       -
         mirage-clock,

     

       7
       6
        
         mirage-crypto,

     

       8
       7
        
         mirage-crypto-pk,

     

       9
       8
        
         mirage-flow,

     

       10
       9
        
         mirage-kv,

     

       10
       10
       +
         mirage-ptime,

     

       11
       11
        
         ptime,

     

       12
       12
        
       }:

     

       13
       13
        
       

     
···

       18
       18
        
         propagatedBuildInputs = [

     

       19
       19
        
           fmt

     

       20
       20
        
           lwt

     

       21
       21
       -
           mirage-clock

     

       22
       21
        
           mirage-crypto

     

       23
       22
        
           mirage-crypto-pk

     

       24
       23
        
           mirage-flow

     

       25
       24
        
           mirage-kv

     

       25
       25
       +
           mirage-ptime

     

       26
       26
        
           ptime

     

       27
       27
        
           tls

     

       28
       28
        
         ];

+2 -2

pkgs/development/php-packages/memprof/default.nix

···

       6
       6
        
       }:

     

       7
       7
        
       

     

       8
       8
        
       let

     

       9
       9
       -
         version = "3.0.2";

     

       9
       9
       +
         version = "3.1.0";

     

       10
       10
        
       in

     

       11
       11
        
       buildPecl {

     

       12
       12
        
         inherit version;

     
···

       16
       16
        
           owner = "arnaud-lb";

     

       17
       17
        
           repo = "php-memory-profiler";

     

       18
       18
        
           rev = version;

     

       19
       19
       -
           hash = "sha256-K8YcvCobErBkaWFTkVGLXXguQPOLIgQuRGWJF+HAIRA=";

     

       19
       19
       +
           hash = "sha256-gq+txAU2Fw+Zm1aIu0lwPUHRqtccNcHFpp0fm3f7BnQ=";

     

       20
       20
        
         };

     

       21
       21
        
       

     

       22
       22
        
         configureFlags = [ "--with-judy-dir=${judy}" ];

+2 -2

pkgs/development/python-modules/craft-archives/default.nix

···

       18
       18
        
       

     

       19
       19
        
       buildPythonPackage rec {

     

       20
       20
        
         pname = "craft-archives";

     

       21
       21
       -
         version = "2.0.2";

     

       21
       21
       +
         version = "2.1.0";

     

       22
       22
        
       

     

       23
       23
        
         pyproject = true;

     

       24
       24
        
       

     
···

       26
       26
        
           owner = "canonical";

     

       27
       27
        
           repo = "craft-archives";

     

       28
       28
        
           tag = version;

     

       29
       29
       -
           hash = "sha256-1HEz4d1WLQDDHga7X+V/37n8E7JK/k0z+UDeNEiLOHs=";

     

       29
       29
       +
           hash = "sha256-VjGoAsmdYyoU7ngU69HVNauEk2/vbcEz2tMCTmjheF4=";

     

       30
       30
        
         };

     

       31
       31
        
       

     

       32
       32
        
         postPatch = ''

+2 -2

pkgs/development/python-modules/graph-tool/default.nix

···

       32
       32
        
       in

     

       33
       33
        
       buildPythonPackage rec {

     

       34
       34
        
         pname = "graph-tool";

     

       35
       35
       -
         version = "2.85";

     

       35
       35
       +
         version = "2.91";

     

       36
       36
        
         format = "other";

     

       37
       37
        
       

     

       38
       38
        
         src = fetchurl {

     

       39
       39
        
           url = "https://downloads.skewed.de/graph-tool/graph-tool-${version}.tar.bz2";

     

       40
       40
       -
           hash = "sha256-GX0JUz5G7gtLemwlY1prQvCxIxpuyclo+1LN68j2H9o=";

     

       40
       40
       +
           hash = "sha256-PIUOkrNe/dce8qvSbZ/lwCEuwqB5kPvnMjQI4Sej/QI=";

     

       41
       41
        
         };

     

       42
       42
        
       

     

       43
       43
        
         postPatch = ''

+98 -10

pkgs/development/python-modules/gym/default.nix

···

       1
       1
        
       {

     

       2
       2
        
         lib,

     

       3
       3
       +
         stdenv,

     

       3
       4
        
         buildPythonPackage,

     

       4
       5
        
         fetchFromGitHub,

     

       5
       5
       -
         numpy,

     

       6
       6
       +
       

     

       7
       7
       +
         # build-system

     

       8
       8
       +
         setuptools,

     

       9
       9
       +
       

     

       10
       10
       +
         # dependencies

     

       6
       11
        
         cloudpickle,

     

       12
       12
       +
         numpy,

     

       7
       13
        
         gym-notices,

     

       8
       14
        
         importlib-metadata,

     

       9
       15
        
         pythonOlder,

     

       16
       16
       +
       

     

       17
       17
       +
         # tests

     

       18
       18
       +
         moviepy,

     

       19
       19
       +
         pybox2d,

     

       20
       20
       +
         pygame,

     

       21
       21
       +
         pytestCheckHook,

     

       22
       22
       +
         opencv-python,

     

       10
       23
        
       }:

     

       11
       24
        
       

     

       12
       25
        
       buildPythonPackage rec {

     

       13
       26
        
         pname = "gym";

     

       14
       27
        
         version = "0.26.2";

     

       15
       15
       -
         format = "setuptools";

     

       28
       28
       +
         pyproject = true;

     

       16
       29
        
       

     

       17
       30
        
         src = fetchFromGitHub {

     

       18
       31
        
           owner = "openai";

     

       19
       19
       -
           repo = pname;

     

       32
       32
       +
           repo = "gym";

     

       20
       33
        
           tag = version;

     

       21
       34
        
           hash = "sha256-uJgm8l1SxIRC5PV6BIH/ht/1ucGT5UaUhkFMdusejgA=";

     

       22
       35
        
         };

     

       23
       36
        
       

     

       24
       24
       -
         propagatedBuildInputs = [

     

       37
       37
       +
         # Fix numpy2 compatibility

     

       38
       38
       +
         postPatch = ''

     

       39
       39
       +
           substituteInPlace gym/envs/classic_control/acrobot.py \

     

       40
       40
       +
             --replace-fail "np.float_" "np.float64"

     

       41
       41
       +
       

     

       42
       42
       +
           substituteInPlace gym/utils/passive_env_checker.py \

     

       43
       43
       +
             --replace-fail "np.bool8" "np.bool"

     

       44
       44
       +
       

     

       45
       45
       +
           substituteInPlace tests/envs/test_action_dim_check.py \

     

       46
       46
       +
             --replace-fail "np.cast[dtype](OOB_VALUE)" "np.asarray(OOB_VALUE, dtype=dtype)" \

     

       47
       47
       +
             --replace-fail "np.alltrue" "np.all"

     

       48
       48
       +
       

     

       49
       49
       +
           substituteInPlace tests/spaces/test_box.py \

     

       50
       50
       +
             --replace-fail "np.bool8" "np.bool" \

     

       51
       51
       +
             --replace-fail "np.complex_" "np.complex128"

     

       52
       52
       +
       

     

       53
       53
       +
           substituteInPlace tests/wrappers/test_record_episode_statistics.py \

     

       54
       54
       +
             --replace-fail "np.alltrue" "np.all"

     

       55
       55
       +
         '';

     

       56
       56
       +
       

     

       57
       57
       +
         build-system = [

     

       58
       58
       +
           setuptools

     

       59
       59
       +
         ];

     

       60
       60
       +
       

     

       61
       61
       +
         dependencies = [

     

       25
       62
        
           cloudpickle

     

       26
       63
        
           numpy

     

       27
       64
        
           gym-notices

     

       28
       65
        
         ] ++ lib.optionals (pythonOlder "3.10") [ importlib-metadata ];

     

       29
       29
       -
       

     

       30
       30
       -
         # The test needs MuJoCo that is not free library.

     

       31
       31
       -
         doCheck = false;

     

       32
       66
        
       

     

       33
       67
        
         pythonImportsCheck = [ "gym" ];

     

       34
       68
        
       

     

       35
       35
       -
         meta = with lib; {

     

       69
       69
       +
         nativeCheckInputs = [

     

       70
       70
       +
           moviepy

     

       71
       71
       +
           opencv-python

     

       72
       72
       +
           pybox2d

     

       73
       73
       +
           pygame

     

       74
       74
       +
           pytestCheckHook

     

       75
       75
       +
         ];

     

       76
       76
       +
       

     

       77
       77
       +
         disabledTests =

     

       78
       78
       +
           [

     

       79
       79
       +
             # TypeError: Converting from sequence to b2Vec2, expected int/float arguments index 0

     

       80
       80
       +
             "test_box_actions_out_of_bound"

     

       81
       81
       +
             "test_env_determinism_rollout"

     

       82
       82
       +
             "test_envs_pass_env_checker"

     

       83
       83
       +
             "test_frame_stack"

     

       84
       84
       +
             "test_make_autoreset_true"

     

       85
       85
       +
             "test_passive_checker_wrapper_warnings"

     

       86
       86
       +
             "test_pickle_env"

     

       87
       87
       +
             "test_render_modes"

     

       88
       88
       +
       

     

       89
       89
       +
             # TypeError: in method 'b2RevoluteJoint___SetMotorSpeed', argument 2 of type 'float32'

     

       90
       90
       +
             "test_box_actions_out_of_bound"

     

       91
       91
       +
       

     

       92
       92
       +
             # TypeError: exceptions must be derived from Warning, not <class 'NoneType'>

     

       93
       93
       +
             "test_dict_init"

     

       94
       94
       +
       

     

       95
       95
       +
             # ValueError: setting an array element with a sequence.

     

       96
       96
       +
             # The requested array has an inhomogeneous shape after 1 dimensions.

     

       97
       97
       +
             # The detected shape was (2,) + inhomogeneous part

     

       98
       98
       +
             "test_sample_contains"

     

       99
       99
       +
           ]

     

       100
       100
       +
           ++ lib.optionals stdenv.hostPlatform.isDarwin [

     

       101
       101
       +
             # Fatal Python error: Aborted

     

       102
       102
       +
             # gym/envs/classic_control/cartpole.py", line 227 in render

     

       103
       103
       +
             "test_autoclose"

     

       104
       104
       +
             "test_call_async_vector_env"

     

       105
       105
       +
             "test_call_sync_vector_env"

     

       106
       106
       +
             "test_human_rendering"

     

       107
       107
       +
             "test_make_render_mode"

     

       108
       108
       +
             "test_order_enforcing"

     

       109
       109
       +
             "test_record_simple"

     

       110
       110
       +
             "test_record_video_reset"

     

       111
       111
       +
             "test_record_video_step_trigger"

     

       112
       112
       +
             "test_record_video_using_default_trigger"

     

       113
       113
       +
             "test_record_video_within_vecto"

     

       114
       114
       +
             "test_text_envs"

     

       115
       115
       +
           ];

     

       116
       116
       +
       

     

       117
       117
       +
         disabledTestPaths = lib.optionals stdenv.hostPlatform.isDarwin [

     

       118
       118
       +
           # Fatal Python error: Aborted

     

       119
       119
       +
           # gym/utils/play.py", line 62 in __init__

     

       120
       120
       +
           "tests/utils/test_play.py"

     

       121
       121
       +
         ];

     

       122
       122
       +
       

     

       123
       123
       +
         meta = {

     

       36
       124
        
           description = "Toolkit for developing and comparing your reinforcement learning agents";

     

       37
       125
        
           homepage = "https://www.gymlibrary.dev/";

     

       38
       38
       -
           license = licenses.mit;

     

       39
       39
       -
           maintainers = with maintainers; [ hyphon81 ];

     

       126
       126
       +
           license = lib.licenses.mit;

     

       127
       127
       +
           maintainers = with lib.maintainers; [ GaetanLepage ];

     

       40
       128
        
         };

     

       41
       129
        
       }

+3 -3

pkgs/development/python-modules/pylance/default.nix

···

       34
       34
        
       

     

       35
       35
        
       buildPythonPackage rec {

     

       36
       36
        
         pname = "pylance";

     

       37
       37
       -
         version = "0.23.1";

     

       37
       37
       +
         version = "0.23.2";

     

       38
       38
        
         pyproject = true;

     

       39
       39
        
       

     

       40
       40
        
         src = fetchFromGitHub {

     

       41
       41
        
           owner = "lancedb";

     

       42
       42
        
           repo = "lance";

     

       43
       43
        
           tag = "v${version}";

     

       44
       44
       -
           hash = "sha256-H5C4gaXC/Vvzq/5Mr0ZeO3waJJ+v43IWDOVziSb9rgk=";

     

       44
       44
       +
           hash = "sha256-HVT/39zhcviVkF6dKM+ZIy7vGW6tOWEBUXTEIuFaVno=";

     

       45
       45
        
         };

     

       46
       46
        
       

     

       47
       47
        
         sourceRoot = "${src.name}/python";

     
···

       53
       53
        
             src

     

       54
       54
        
             sourceRoot

     

       55
       55
        
             ;

     

       56
       56
       -
           hash = "sha256-QSqDxkI4O11s34fL397KPCSBKRieNhzAQu2QZuqD3yE=";

     

       56
       56
       +
           hash = "sha256-H5Z6YgaSfRrRPGZVbgNWxcFboS1I65p+08c1VgaL+lE=";

     

       57
       57
        
         };

     

       58
       58
        
       

     

       59
       59
        
         nativeBuildInputs = [

+3 -3

pkgs/kde/generated/sources/plasma.json

···

       130
       130
        
           "hash": "sha256-rsrHJm3HkTqxBMaweOWluLpZkRgfDjsRSwnj1/+tOhQ="

     

       131
       131
        
         },

     

       132
       132
        
         "kwin": {

     

       133
       133
       -
           "version": "6.3.2",

     

       134
       134
       -
           "url": "mirror://kde/stable/plasma/6.3.2/kwin-6.3.2.tar.xz",

     

       135
       135
       -
           "hash": "sha256-NlWYDV7NgODFnXMwwBBjLB29SFfpw8Mm8uMVIK/qnKM="

     

       133
       133
       +
           "version": "6.3.2.1",

     

       134
       134
       +
           "url": "mirror://kde/stable/plasma/6.3.2/kwin-6.3.2.1.tar.xz",

     

       135
       135
       +
           "hash": "sha256-5hI+2isf2fZbNgYf2s+WI0Bo0eJPp6M1Ioj01RsvxMI="

     

       136
       136
        
         },

     

       137
       137
        
         "kwrited": {

     

       138
       138
        
           "version": "6.3.2",

+1 -1

pkgs/servers/http/apache-httpd/2.4.nix

···

       99
       99
        
         passthru = {

     

       100
       100
        
           inherit apr aprutil sslSupport proxySupport ldapSupport luaSupport lua5;

     

       101
       101
        
           tests = {

     

       102
       102
       -
             acme-integration = nixosTests.acme;

     

       102
       102
       +
             acme-integration = nixosTests.acme.httpd;

     

       103
       103
        
             proxy = nixosTests.proxy;

     

       104
       104
        
             php = nixosTests.php.httpd;

     

       105
       105
        
             cross = runCommand "apacheHttpd-test-cross" { } ''

+1 -1

pkgs/servers/http/nginx/generic.nix

···

       300
       300
        
               nginx-unix-socket

     

       301
       301
        
               ;

     

       302
       302
        
             variants = lib.recurseIntoAttrs nixosTests.nginx-variants;

     

       303
       303
       -
             acme-integration = nixosTests.acme;

     

       303
       303
       +
             acme-integration = nixosTests.acme.nginx;

     

       304
       304
        
           } // passthru.tests;

     

       305
       305
        
         };

     

       306
       306

+2 -2

pkgs/servers/x11/xorg/xwayland.nix

···

       52
       52
        
       

     

       53
       53
        
       stdenv.mkDerivation rec {

     

       54
       54
        
         pname = "xwayland";

     

       55
       55
       -
         version = "24.1.5";

     

       55
       55
       +
         version = "24.1.6";

     

       56
       56
        
       

     

       57
       57
        
         src = fetchurl {

     

       58
       58
        
           url = "mirror://xorg/individual/xserver/${pname}-${version}.tar.xz";

     

       59
       59
       -
           hash = "sha256-y0vRcOb6a1RboFZ76PaT0u7M/GLQTGcDfdFPBtqtNh0=";

     

       59
       59
       +
           hash = "sha256-c35hLKNrvfQVqRFkTrdZLPk4mEaEe0f6RtxwW9dU0tc=";

     

       60
       60
        
         };

     

       61
       61
        
       

     

       62
       62
        
         postPatch = ''

pkgs/tools/audio/liquidsoap/full.nix

···

       48
       48
        
         postPatch = ''

     

       49
       49
        
           substituteInPlace src/lang/dune \

     

       50
       50
        
             --replace-warn "(run git rev-parse --short HEAD)" "(run echo -n nixpkgs)"

     

       51
       51
       +
           # Compatibility with camlimages 5.0.5

     

       52
       52
       +
           substituteInPlace src/core/dune \

     

       53
       53
       +
             --replace-warn camlimages.all_formats camlimages.core

     

       51
       54
        
         '';

     

       52
       55
        
       

     

       53
       56
        
         dontConfigure = true;

+9 -7

pkgs/tools/inputmethods/ibus-engines/ibus-libpinyin/default.nix

···

       17
       17
        
         opencc,

     

       18
       18
        
         libsoup_3,

     

       19
       19
        
         json-glib,

     

       20
       20
       +
         libnotify,

     

       20
       21
        
       }:

     

       21
       22
        
       

     

       22
       23
        
       stdenv.mkDerivation rec {

     

       23
       24
        
         pname = "ibus-libpinyin";

     

       24
       24
       -
         version = "1.15.8";

     

       25
       25
       +
         version = "1.16.0";

     

       25
       26
        
       

     

       26
       27
        
         src = fetchFromGitHub {

     

       27
       28
        
           owner = "libpinyin";

     

       28
       29
        
           repo = "ibus-libpinyin";

     

       29
       29
       -
           rev = version;

     

       30
       30
       -
           hash = "sha256-u21avBSSu/78tLoyFI9XGocC7rT/64L5HqQQj3Zg1Mc=";

     

       30
       30
       +
           tag = version;

     

       31
       31
       +
           hash = "sha256-aeyoBfl5x9Jo35vESMmLBbl72Qx5F3JwZHZaBr3c0Jk=";

     

       31
       32
        
         };

     

       32
       33
        
       

     

       33
       34
        
         nativeBuildInputs = [

     
···

       59
       60
        
           opencc

     

       60
       61
        
           libsoup_3

     

       61
       62
        
           json-glib

     

       63
       63
       +
           libnotify

     

       62
       64
        
         ];

     

       63
       65
        
       

     

       64
       64
       -
         meta = with lib; {

     

       66
       66
       +
         meta = {

     

       65
       67
        
           isIbusEngine = true;

     

       66
       68
        
           description = "IBus interface to the libpinyin input method";

     

       67
       67
       -
           license = licenses.gpl3Plus;

     

       68
       68
       -
           maintainers = with maintainers; [

     

       69
       69
       +
           license = lib.licenses.gpl3Plus;

     

       70
       70
       +
           maintainers = with lib.maintainers; [

     

       69
       71
        
             linsui

     

       70
       72
        
             ericsagnes

     

       71
       73
        
           ];

     

       72
       72
       -
           platforms = platforms.linux;

     

       74
       74
       +
           platforms = lib.platforms.linux;

     

       73
       75
        
         };

     

       74
       76
        
       }

+11 -13

pkgs/tools/misc/qt6ct/default.nix

···

       9
       9
        
         qttools,

     

       10
       10
        
         wrapQtAppsHook,

     

       11
       11
        
       }:

     

       12
       12
       -
       let

     

       13
       13
       -
         inherit (lib) getDev;

     

       14
       14
       -
       in

     

       12
       12
       +
       

     

       15
       13
        
       stdenv.mkDerivation (finalAttrs: {

     

       16
       14
        
         pname = "qt6ct";

     

       17
       17
       -
         version = "0.9";

     

       15
       15
       +
         version = "0.10";

     

       18
       16
        
       

     

       19
       17
        
         src = fetchFromGitHub {

     

       20
       20
       -
           owner = "trialuser02";

     

       18
       18
       +
           owner = "ilya-fedin";

     

       21
       19
        
           repo = "qt6ct";

     

       22
       22
       -
           rev = finalAttrs.version;

     

       23
       23
       -
           hash = "sha256-MmN/qPBlsF2mBST+3eYeXaq+7B3b+nTN2hi6CmxrILc=";

     

       20
       20
       +
           tag = finalAttrs.version;

     

       21
       21
       +
           hash = "sha256-ePY+BEpEcAq11+pUMjQ4XG358x3bXFQWwI1UAi+KmLo=";

     

       24
       22
        
         };

     

       25
       23
        
       

     

       26
       24
        
         nativeBuildInputs = [

     
···

       36
       34
        
         ];

     

       37
       35
        
       

     

       38
       36
        
         qmakeFlags = [

     

       39
       39
       -
           "LRELEASE_EXECUTABLE=${getDev qttools}/bin/lrelease"

     

       37
       37
       +
           "LRELEASE_EXECUTABLE=${lib.getDev qttools}/bin/lrelease"

     

       40
       38
        
           "PLUGINDIR=${placeholder "out"}/${qtbase.qtPluginPrefix}"

     

       41
       39
        
           "LIBDIR=${placeholder "out"}/lib"

     

       42
       40
        
         ];

     

       43
       41
        
       

     

       44
       44
       -
         meta = with lib; {

     

       42
       42
       +
         meta = {

     

       45
       43
        
           description = "Qt6 Configuration Tool";

     

       46
       46
       -
           homepage = "https://github.com/trialuser02/qt6ct";

     

       47
       47
       -
           platforms = platforms.linux;

     

       48
       48
       -
           license = licenses.bsd2;

     

       49
       49
       -
           maintainers = with maintainers; [

     

       44
       44
       +
           homepage = "https://github.com/ilya-fedin/qt6ct";

     

       45
       45
       +
           platforms = lib.platforms.linux;

     

       46
       46
       +
           license = lib.licenses.bsd2;

     

       47
       47
       +
           maintainers = with lib.maintainers; [

     

       50
       48
        
             Flakebi

     

       51
       49
        
             Scrumplex

     

       52
       50
        
           ];

+13

pkgs/tools/misc/screen/buffer-overflow-SendCmdMessage.patch

···

       1
       1
       +
       --- a/attacher.c	2025-02-24 20:15:31.701820351 +0100

     

       2
       2
       +
       +++ b/attacher.c	2025-02-24 20:17:05.893826559 +0100

     

       3
       3
       +
       @@ -461,8 +461,8 @@

     

       4
       4
       +
        		size_t len;

     

       5
       5
       +
        		len = strlen(*av) + 1;

     

       6
       6
       +
        		if (p + len >= m.m.command.cmd + ARRAY_SIZE(m.m.command.cmd) - 1)

     

       7
       7
       +
       -			break;

     

       8
       8
       +
       +			Panic(0, "Total length of the command to send too large.\n");

     

       9
       9
       +
       -		strncpy(p, *av, MAXPATHLEN);

     

       10
       10
       +
       +		memcpy(p, *av, len);

     

       11
       11
       +
        		p += len;

     

       12
       12
       +
        	}

     

       13
       13
       +
        	*p = 0;

pkgs/tools/misc/screen/default.nix

···

       26
       26
        
         # We need _GNU_SOURCE so that mallocmock_reset() is defined: https://savannah.gnu.org/bugs/?66416

     

       27
       27
        
         NIX_CFLAGS_COMPILE = lib.optionalString (stdenv.cc.isGNU) "-D_GNU_SOURCE=1 -Wno-int-conversion -Wno-incompatible-pointer-types";

     

       28
       28
        
       

     

       29
       29
       +
         patches = [

     

       30
       30
       +
           # GNU Screen 5.0 uses strncpy incorrectly in SendCmdMessage

     

       31
       31
       +
           # This causes issues detected when using -D_FORTIFY_SOURCE=3

     

       32
       32
       +
           # e.g. https://savannah.gnu.org/bugs/index.php?66215

     

       33
       33
       +
           ./buffer-overflow-SendCmdMessage.patch

     

       34
       34
       +
         ];

     

       35
       35
       +
       

     

       29
       36
        
         nativeBuildInputs = [

     

       30
       37
        
           autoreconfHook

     

       31
       38
        
         ];

pkgs/top-level/ocaml-packages.nix

···

       1216
       1216
        
       

     

       1217
       1217
        
           mirage-protocols = callPackage ../development/ocaml-modules/mirage-protocols { };

     

       1218
       1218
        
       

     

       1219
       1219
       +
           mirage-ptime = callPackage ../development/ocaml-modules/mirage-ptime { };

     

       1220
       1220
       +
       

     

       1219
       1221
        
           mirage-random = callPackage ../development/ocaml-modules/mirage-random { };

     

       1220
       1222
        
       

     

       1221
       1223
        
           mirage-random-test = callPackage ../development/ocaml-modules/mirage-random-test { };