commit e14978f992d9a05cba98e5d47e4708b4610682da · pyrox.dev/nixpkgs

+1 -1

doc/languages-frameworks/cuda.section.md

···

       150
        
       

     

       151
        
       In the scenario you are unable to run the resulting binary: this is arguably the most complicated as it could be any combination of the previous reasons. This type of failure typically occurs when a library attempts to load or open a library it depends on that it does not declare in its `DT_NEEDED` section. As a first step, ensure that dependencies are patched with [`autoAddDriverRunpath`](https://search.nixos.org/packages?channel=unstable&type=packages&query=autoAddDriverRunpath). Failing that, try running the application with [`nixGL`](https://github.com/guibou/nixGL) or a similar wrapper tool. If that works, it likely means that the application is attempting to load a library that is not in the `RPATH` or `RUNPATH` of the binary.

     

       152
        
       

     

       153
       -
       ## Running Docker or Podman containers with CUDA support {#running-docker-or-podman-containers-with-cuda-support}

     

       154
        
       

     

       155
        
       It is possible to run Docker or Podman containers with CUDA support. The recommended mechanism to perform this task is to use the [NVIDIA Container Toolkit](https://docs.nvidia.com/datacenter/cloud-native/container-toolkit/latest/index.html).

     

       156

···

       150
        
       

     

       151
        
       In the scenario you are unable to run the resulting binary: this is arguably the most complicated as it could be any combination of the previous reasons. This type of failure typically occurs when a library attempts to load or open a library it depends on that it does not declare in its `DT_NEEDED` section. As a first step, ensure that dependencies are patched with [`autoAddDriverRunpath`](https://search.nixos.org/packages?channel=unstable&type=packages&query=autoAddDriverRunpath). Failing that, try running the application with [`nixGL`](https://github.com/guibou/nixGL) or a similar wrapper tool. If that works, it likely means that the application is attempting to load a library that is not in the `RPATH` or `RUNPATH` of the binary.

     

       152
        
       

     

       153
       +
       ## Running Docker or Podman containers with CUDA support {#cuda-docker-podman}

     

       154
        
       

     

       155
        
       It is possible to run Docker or Podman containers with CUDA support. The recommended mechanism to perform this task is to use the [NVIDIA Container Toolkit](https://docs.nvidia.com/datacenter/cloud-native/container-toolkit/latest/index.html).

     

       156

+12

maintainers/maintainer-list.nix

···

       2951
        
           githubId = 535135;

     

       2952
        
           name = "Brennon Loveless";

     

       2953
        
         };

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       2954
        
         bluescreen303 = {

     

       2955
        
           email = "mathijs@bluescreen303.nl";

     

       2956
        
           github = "bluescreen303";

     
···

       5867
        
           github = "dsferruzza";

     

       5868
        
           githubId = 1931963;

     

       5869
        
           name = "David Sferruzza";

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       5870
        
         };

     

       5871
        
         dstengele = {

     

       5872
        
           name = "Dennis Stengele";

···

       2951
        
           githubId = 535135;

     

       2952
        
           name = "Brennon Loveless";

     

       2953
        
         };

     

       2954
       +
         bloxx12 = {

     

       2955
       +
           email = "charlie@charlieroot.dev";

     

       2956
       +
           github = "bloxx12";

     

       2957
       +
           githubId = 75451918;

     

       2958
       +
           name = "Charlie Root";

     

       2959
       +
         };

     

       2960
        
         bluescreen303 = {

     

       2961
        
           email = "mathijs@bluescreen303.nl";

     

       2962
        
           github = "bluescreen303";

     
···

       5873
        
           github = "dsferruzza";

     

       5874
        
           githubId = 1931963;

     

       5875
        
           name = "David Sferruzza";

     

       5876
       +
         };

     

       5877
       +
         dsluijk = {

     

       5878
       +
           name = "Dany Sluijk";

     

       5879
       +
           email = "nix@dany.dev";

     

       5880
       +
           github = "dsluijk";

     

       5881
       +
           githubId = 8537327;

     

       5882
        
         };

     

       5883
        
         dstengele = {

     

       5884
        
           name = "Dennis Stengele";

+14

nixos/doc/manual/release-notes/rl-2411.section.md

···

       343
        
         This change requires granting access to the repositories to this user or

     

       344
        
         setting the appropriate one through `services.cgit.some-instance.user`.

     

       345
        
       

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       346
        
       - `nvimpager` was updated to version 0.13.0, which changes the order of user and

     

       347
        
         nvimpager settings: user commands in `-c` and `--cmd` now override the

     

       348
        
         respective default settings because they are executed later.

     
···

       573
        
       - The `services.prometheus.exporters.minio` option has been removed, as it's upstream implementation was broken and unmaintained.

     

       574
        
         Minio now has built-in [Prometheus metrics exposure](https://min.io/docs/minio/linux/operations/monitoring/collect-minio-metrics-using-prometheus.html), which can be used instead.

     

       575
        
       

     

       0
        
       
     

       0
        
       
     

       576
        
       - The `services.patroni.raft` option has been removed, as Raft has been [deprecated by upstream since 3.0.0](https://github.com/patroni/patroni/blob/master/docs/releases.rst#version-300)

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       577
        
       

     

       578
        
       - `services.roundcube.maxAttachmentSize` will multiply the value set with `1.37` to offset overhead introduced by the base64 encoding applied to attachments.

     

       579

···

       343
        
         This change requires granting access to the repositories to this user or

     

       344
        
         setting the appropriate one through `services.cgit.some-instance.user`.

     

       345
        
       

     

       346
       +
       - `gradle_6` was removed due to being [unsupported upstream as of 10 Feb 2023](https://endoflife.date/gradle).

     

       347
       +
         Additionally, it had numerous security vulnerabilities that were only patched

     

       348
       +
         in later versions, such as [CVE-2021-29429](https://nvd.nist.gov/vuln/detail/CVE-2021-32751),

     

       349
       +
         [CVE-2021-29427](https://nvd.nist.gov/vuln/detail/CVE-2021-29427), [CVE-2021-29428](https://nvd.nist.gov/vuln/detail/CVE-2021-29428), and [CVE-2021-32751](https://nvd.nist.gov/vuln/detail/CVE-2021-32751).

     

       350
       +
       

     

       351
        
       - `nvimpager` was updated to version 0.13.0, which changes the order of user and

     

       352
        
         nvimpager settings: user commands in `-c` and `--cmd` now override the

     

       353
        
         respective default settings because they are executed later.

     
···

       578
        
       - The `services.prometheus.exporters.minio` option has been removed, as it's upstream implementation was broken and unmaintained.

     

       579
        
         Minio now has built-in [Prometheus metrics exposure](https://min.io/docs/minio/linux/operations/monitoring/collect-minio-metrics-using-prometheus.html), which can be used instead.

     

       580
        
       

     

       581
       +
       - The `services.prometheus.exporters.tor` option has been removed, as its upstream implementation was broken and unmaintained.

     

       582
       +
       

     

       583
        
       - The `services.patroni.raft` option has been removed, as Raft has been [deprecated by upstream since 3.0.0](https://github.com/patroni/patroni/blob/master/docs/releases.rst#version-300)

     

       584
       +
       

     

       585
       +
       - The `jd-cli` package was removed due to an inactive upstream and a dependency on the shut down

     

       586
       +
         JCenter JAR repository.

     

       587
       +
         Java decompilers already packaged in Nixpkgs include `bytecode-viewer` (GUI), `cfr` (CLI), and `procyon` (CLI).

     

       588
       +
       

     

       589
       +
       - The `jd-gui` package was removed due to an inactive upstream and a dependency on the end-of-life Gradle 6.

     

       590
       +
         Java decompilers already packaged in Nixpkgs include `bytecode-viewer` (GUI), `cfr` (CLI), and `procyon` (CLI).

     

       591
        
       

     

       592
        
       - `services.roundcube.maxAttachmentSize` will multiply the value set with `1.37` to offset overhead introduced by the base64 encoding applied to attachments.

     

       593

+3 -1

nixos/modules/services/monitoring/prometheus/exporters.nix

···

       88
        
           "statsd"

     

       89
        
           "surfboard"

     

       90
        
           "systemd"

     

       91
       -
           "tor"

     

       92
        
           "unbound"

     

       93
        
           "unifi"

     

       94
        
           "unpoller"

     
···

       298
        
               (lib.mkRemovedOptionModule [ "minio" ] ''

     

       299
        
                 The Minio exporter has been removed, as it was broken and unmaintained.

     

       300
        
                 See the 24.11 release notes for more information.

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       301
        
               '')

     

       302
        
             ];

     

       303
        
           };

···

       88
        
           "statsd"

     

       89
        
           "surfboard"

     

       90
        
           "systemd"

     

       0
        
       
     

       91
        
           "unbound"

     

       92
        
           "unifi"

     

       93
        
           "unpoller"

     
···

       297
        
               (lib.mkRemovedOptionModule [ "minio" ] ''

     

       298
        
                 The Minio exporter has been removed, as it was broken and unmaintained.

     

       299
        
                 See the 24.11 release notes for more information.

     

       300
       +
               '')

     

       301
       +
               (lib.mkRemovedOptionModule [ "tor" ] ''

     

       302
       +
                 The Tor exporter has been removed, as it was broken and unmaintained.

     

       303
        
               '')

     

       304
        
             ];

     

       305
        
           };

-43

nixos/modules/services/monitoring/prometheus/exporters/tor.nix

···

       1
       -
       { config, lib, pkgs, options, ... }:

     

       2
       -
       

     

       3
       -
       let

     

       4
       -
         cfg = config.services.prometheus.exporters.tor;

     

       5
       -
         inherit (lib) mkOption types concatStringsSep;

     

       6
       -
       in

     

       7
       -
       {

     

       8
       -
         port = 9130;

     

       9
       -
         extraOpts = {

     

       10
       -
           torControlAddress = mkOption {

     

       11
       -
             type = types.str;

     

       12
       -
             default = "127.0.0.1";

     

       13
       -
             description = ''

     

       14
       -
               Tor control IP address or hostname.

     

       15
       -
             '';

     

       16
       -
           };

     

       17
       -
       

     

       18
       -
           torControlPort = mkOption {

     

       19
       -
             type = types.port;

     

       20
       -
             default = 9051;

     

       21
       -
             description = ''

     

       22
       -
               Tor control port.

     

       23
       -
             '';

     

       24
       -
           };

     

       25
       -
         };

     

       26
       -
         serviceOpts = {

     

       27
       -
           serviceConfig = {

     

       28
       -
             ExecStart = ''

     

       29
       -
               ${pkgs.prometheus-tor-exporter}/bin/prometheus-tor-exporter \

     

       30
       -
                 -b ${cfg.listenAddress} \

     

       31
       -
                 -p ${toString cfg.port} \

     

       32
       -
                 -a ${cfg.torControlAddress} \

     

       33
       -
                 -c ${toString cfg.torControlPort} \

     

       34
       -
                 ${concatStringsSep " \\\n  " cfg.extraFlags}

     

       35
       -
             '';

     

       36
       -
           };

     

       37
       -
       

     

       38
       -
           # CPython requires a process to either have $HOME defined or run as a UID

     

       39
       -
           # defined in /etc/passwd. The latter is false with DynamicUser, so define a

     

       40
       -
           # dummy $HOME. https://bugs.python.org/issue10496

     

       41
       -
           environment = { HOME = "/var/empty"; };

     

       42
       -
         };

     

       43
       -
       }

-19

nixos/tests/prometheus-exporters.nix

···

       1511
        
             '';

     

       1512
        
           };

     

       1513
        
       

     

       1514
       -
           tor = {

     

       1515
       -
             exporterConfig = {

     

       1516
       -
               enable = true;

     

       1517
       -
             };

     

       1518
       -
             metricProvider = {

     

       1519
       -
               # Note: this does not connect the test environment to the Tor network.

     

       1520
       -
               # Client, relay, bridge or exit connectivity are disabled by default.

     

       1521
       -
               services.tor.enable = true;

     

       1522
       -
               services.tor.settings.ControlPort = 9051;

     

       1523
       -
             };

     

       1524
       -
             exporterTest = ''

     

       1525
       -
               wait_for_unit("tor.service")

     

       1526
       -
               wait_for_open_port(9051)

     

       1527
       -
               wait_for_unit("prometheus-tor-exporter.service")

     

       1528
       -
               wait_for_open_port(9130)

     

       1529
       -
               succeed("curl -sSf localhost:9130/metrics | grep 'tor_version{.\\+} 1'")

     

       1530
       -
             '';

     

       1531
       -
           };

     

       1532
       -
       

     

       1533
        
           unpoller = {

     

       1534
        
             nodeName = "unpoller";

     

       1535
        
             exporterConfig.enable = true;

···

       1511
        
             '';

     

       1512
        
           };

     

       1513
        
       

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       1514
        
           unpoller = {

     

       1515
        
             nodeName = "unpoller";

     

       1516
        
             exporterConfig.enable = true;

+3 -3

pkgs/applications/audio/spotify-player/default.nix

···

       34
        
       

     

       35
        
       rustPlatform.buildRustPackage rec {

     

       36
        
         pname = "spotify-player";

     

       37
       -
         version = "0.19.1";

     

       38
        
       

     

       39
        
         src = fetchFromGitHub {

     

       40
        
           owner = "aome510";

     

       41
        
           repo = pname;

     

       42
        
           rev = "refs/tags/v${version}";

     

       43
       -
           hash = "sha256-R8F7s8FPnCe+shNUN/u0qcxFy3IbyfVo2xZ5/E/qwaw=";

     

       44
        
         };

     

       45
        
       

     

       46
       -
         cargoHash = "sha256-7vximGisIIXBrwHXSWQjO08OraaweG7ZT6v+gVdYGVc=";

     

       47
        
       

     

       48
        
         nativeBuildInputs = [

     

       49
        
           pkg-config

···

       34
        
       

     

       35
        
       rustPlatform.buildRustPackage rec {

     

       36
        
         pname = "spotify-player";

     

       37
       +
         version = "0.20.0";

     

       38
        
       

     

       39
        
         src = fetchFromGitHub {

     

       40
        
           owner = "aome510";

     

       41
        
           repo = pname;

     

       42
        
           rev = "refs/tags/v${version}";

     

       43
       +
           hash = "sha256-heycCm2Nwyo+DegMKeXZ+dF+ZqiFT/6P08/28buJc6I=";

     

       44
        
         };

     

       45
        
       

     

       46
       +
         cargoHash = "sha256-U3a/6uF7vOV3QnxqPnooBdvjyyIPLnQXiXtTwKeHAxA=";

     

       47
        
       

     

       48
        
         nativeBuildInputs = [

     

       49
        
           pkg-config

+8 -8

pkgs/applications/editors/vscode/vscode.nix

···

       31
        
         archive_fmt = if stdenv.hostPlatform.isDarwin then "zip" else "tar.gz";

     

       32
        
       

     

       33
        
         sha256 = {

     

       34
       -
           x86_64-linux = "0w452wnzyb4wmr2qqq55dhfb1jd0zqmwf65fbmxdz7jn1jimjjrn";

     

       35
       -
           x86_64-darwin = "1b333snvrw8khryhi5scfhhkg43m3b6ds3nvs24nbvx8k7h69hmm";

     

       36
       -
           aarch64-linux = "12p5cdva14s9sfgyrzg3nylpmgdnmfavwx3xxxmblzq1gcal2g6i";

     

       37
       -
           aarch64-darwin = "1l59fcdvynkl5kyz9bn31mld6pi89nynk1zw645rczjm940pac7p";

     

       38
       -
           armv7l-linux = "07ylija6chg6jc2zcavdr9yw1laniigw57f2gilyjynv1cgjm76r";

     

       39
        
         }.${system} or throwSystem;

     

       40
        
       in

     

       41
        
         callPackage ./generic.nix rec {

     

       42
        
           # Please backport all compatible updates to the stable release.

     

       43
        
           # This is important for the extension ecosystem.

     

       44
       -
           version = "1.94.2";

     

       45
        
           pname = "vscode" + lib.optionalString isInsiders "-insiders";

     

       46
        
       

     

       47
        
           # This is used for VS Code - Remote SSH test

     

       48
       -
           rev = "384ff7382de624fb94dbaf6da11977bba1ecd427";

     

       49
        
       

     

       50
        
           executableName = "code" + lib.optionalString isInsiders "-insiders";

     

       51
        
           longName = "Visual Studio Code" + lib.optionalString isInsiders " - Insiders";

     
···

       69
        
             src = fetchurl {

     

       70
        
               name = "vscode-server-${rev}.tar.gz";

     

       71
        
               url = "https://update.code.visualstudio.com/commit:${rev}/server-linux-x64/stable";

     

       72
       -
               sha256 = "1mj9fg76b9x9r6ql21hbckpni179vfa9j8fiah9rd6ih7sb72048";

     

       73
        
             };

     

       74
        
             stdenv = stdenvNoCC;

     

       75
        
           };

···

       31
        
         archive_fmt = if stdenv.hostPlatform.isDarwin then "zip" else "tar.gz";

     

       32
        
       

     

       33
        
         sha256 = {

     

       34
       +
           x86_64-linux = "12cfks56pz1fljv4zrh4q2k6vai2rpdyw5lbap9y8wa9f5pz0m55";

     

       35
       +
           x86_64-darwin = "0zxmlpilh83grcv6jk2avlxiy2w0a1vbwmv0fjzy6nvdma91j7lj";

     

       36
       +
           aarch64-linux = "1gx5xg54mmkiglwmv8fjppqb8bj0fqn9yg0r5q9kzdhh9702dxsg";

     

       37
       +
           aarch64-darwin = "13wnraa13msz7rxzwk232rwrnbmwx0dpq13aq68zjz80clsf4jgp";

     

       38
       +
           armv7l-linux = "06kngg0scrk8sz3j874iffyci70ng8j8l1v83k572vw847956850";

     

       39
        
         }.${system} or throwSystem;

     

       40
        
       in

     

       41
        
         callPackage ./generic.nix rec {

     

       42
        
           # Please backport all compatible updates to the stable release.

     

       43
        
           # This is important for the extension ecosystem.

     

       44
       +
           version = "1.95.0";

     

       45
        
           pname = "vscode" + lib.optionalString isInsiders "-insiders";

     

       46
        
       

     

       47
        
           # This is used for VS Code - Remote SSH test

     

       48
       +
           rev = "912bb683695358a54ae0c670461738984cbb5b95";

     

       49
        
       

     

       50
        
           executableName = "code" + lib.optionalString isInsiders "-insiders";

     

       51
        
           longName = "Visual Studio Code" + lib.optionalString isInsiders " - Insiders";

     
···

       69
        
             src = fetchurl {

     

       70
        
               name = "vscode-server-${rev}.tar.gz";

     

       71
        
               url = "https://update.code.visualstudio.com/commit:${rev}/server-linux-x64/stable";

     

       72
       +
               sha256 = "1chk0xwsiw6pm6ihjlp9695n0l1wfipwv4h04v5dmm9dcwlarp1m";

     

       73
        
             };

     

       74
        
             stdenv = stdenvNoCC;

     

       75
        
           };

+5 -2

pkgs/applications/graphics/ImageMagick/default.nix

···

       24
        
       , openjpegSupport ? !stdenv.hostPlatform.isMinGW, openjpeg

     

       25
        
       , libwebpSupport ? !stdenv.hostPlatform.isMinGW, libwebp

     

       26
        
       , libheifSupport ? true, libheif

     

       0
        
       
     

       27
        
       , potrace

     

       28
        
       , coreutils

     

       29
        
       , curl

     
···

       76
        
           (lib.withFeature libjxlSupport "jxl")

     

       77
        
           (lib.withFeatureAs ghostscriptSupport "gs-font-dir" "${ghostscript.fonts}/share/fonts")

     

       78
        
           (lib.withFeature ghostscriptSupport "gslib")

     

       0
        
       
     

       79
        
         ] ++ lib.optionals stdenv.hostPlatform.isMinGW [

     

       80
        
           # due to libxml2 being without DLLs ATM

     

       81
        
           "--enable-static" "--disable-shared"

     
···

       113
        
           ++ lib.optional lcms2Support lcms2

     

       114
        
           ++ lib.optional libX11Support libX11

     

       115
        
           ++ lib.optional libXtSupport libXt

     

       116
       -
           ++ lib.optional libwebpSupport libwebp;

     

       0
        
       
     

       117
        
       

     

       118
        
         postInstall = ''

     

       119
        
           (cd "$dev/include" && ln -s ImageMagick* ImageMagick)

     
···

       146
        
           description = "Software suite to create, edit, compose, or convert bitmap images";

     

       147
        
           pkgConfigModules = [ "ImageMagick" "MagickWand" ];

     

       148
        
           platforms = platforms.linux ++ platforms.darwin;

     

       149
       -
           maintainers = with maintainers; [ dotlambda rhendric ];

     

       150
        
           license = licenses.asl20;

     

       151
        
           mainProgram = "magick";

     

       152
        
         };

···

       24
        
       , openjpegSupport ? !stdenv.hostPlatform.isMinGW, openjpeg

     

       25
        
       , libwebpSupport ? !stdenv.hostPlatform.isMinGW, libwebp

     

       26
        
       , libheifSupport ? true, libheif

     

       27
       +
       , fftwSupport ? true, fftw

     

       28
        
       , potrace

     

       29
        
       , coreutils

     

       30
        
       , curl

     
···

       77
        
           (lib.withFeature libjxlSupport "jxl")

     

       78
        
           (lib.withFeatureAs ghostscriptSupport "gs-font-dir" "${ghostscript.fonts}/share/fonts")

     

       79
        
           (lib.withFeature ghostscriptSupport "gslib")

     

       80
       +
           (lib.withFeature fftwSupport "fftw")

     

       81
        
         ] ++ lib.optionals stdenv.hostPlatform.isMinGW [

     

       82
        
           # due to libxml2 being without DLLs ATM

     

       83
        
           "--enable-static" "--disable-shared"

     
···

       115
        
           ++ lib.optional lcms2Support lcms2

     

       116
        
           ++ lib.optional libX11Support libX11

     

       117
        
           ++ lib.optional libXtSupport libXt

     

       118
       +
           ++ lib.optional libwebpSupport libwebp

     

       119
       +
           ++ lib.optional fftwSupport fftw;

     

       120
        
       

     

       121
        
         postInstall = ''

     

       122
        
           (cd "$dev/include" && ln -s ImageMagick* ImageMagick)

     
···

       149
        
           description = "Software suite to create, edit, compose, or convert bitmap images";

     

       150
        
           pkgConfigModules = [ "ImageMagick" "MagickWand" ];

     

       151
        
           platforms = platforms.linux ++ platforms.darwin;

     

       152
       +
           maintainers = with maintainers; [ dotlambda rhendric bloxx12 ];

     

       153
        
           license = licenses.asl20;

     

       154
        
           mainProgram = "magick";

     

       155
        
         };

pkgs/applications/misc/bambu-studio/0001-not-for-upstream-CMakeLists-Link-against-webkit2gtk-.patch pkgs/applications/misc/bambu-studio/patches/0001-not-for-upstream-CMakeLists-Link-against-webkit2gtk-.patch

pkgs/applications/misc/bambu-studio/0002-fix-build-for-gcc-13.diff pkgs/applications/misc/bambu-studio/patches/0002-fix-build-for-gcc-13.diff

+39 -25

pkgs/applications/misc/bambu-studio/default.nix

···

       22
        
         glib,

     

       23
        
         glib-networking,

     

       24
        
         gmp,

     

       25
       -
         gstreamer,

     

       26
       -
         gst-plugins-base,

     

       27
       -
         gst-plugins-bad,

     

       28
       -
         gst-plugins-good,

     

       29
        
         gtest,

     

       30
        
         gtk3,

     

       31
        
         hicolor-icon-theme,

     
···

       36
        
         nlopt,

     

       37
        
         opencascade-occt_7_6,

     

       38
        
         openvdb,

     

       0
        
       
     

       39
        
         pcre,

     

       40
        
         systemd,

     

       41
        
         tbb_2021_11,

     
···

       45
        
         withSystemd ? stdenv.hostPlatform.isLinux,

     

       46
        
       }:

     

       47
        
       let

     

       48
       -
         opencascade-occt = opencascade-occt_7_6;

     

       49
       -
         wxGTK31' = wxGTK31.overrideAttrs (old: {

     

       50
       -
           configureFlags = old.configureFlags ++ [

     

       51
       -
             # Disable noisy debug dialogs

     

       52
       -
             "--enable-debug=no"

     

       53
       -
           ];

     

       54
       -
         });

     

       55
       -
         openvdb_tbb_2021_8 = openvdb.overrideAttrs (old: {

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       56
        
           buildInputs = [

     

       57
        
             openexr

     

       58
        
             boost179

     
···

       65
        
       in

     

       66
        
       stdenv.mkDerivation rec {

     

       67
        
         pname = "bambu-studio";

     

       68
       -
         version = "01.09.00.70";

     

       69
        
       

     

       70
        
         src = fetchFromGitHub {

     

       71
        
           owner = "bambulab";

     

       72
        
           repo = "BambuStudio";

     

       73
        
           rev = "v${version}";

     

       74
       -
           hash = "sha256-RBctBhKo7mjxsP7OJhGfoU1eIiGVuMiAqwwSU+gsMds=";

     

       75
        
         };

     

       76
        
       

     

       77
        
         nativeBuildInputs = [

     
···

       95
        
           glib

     

       96
        
           glib-networking

     

       97
        
           gmp

     

       98
       -
           gstreamer

     

       99
       -
           gst-plugins-base

     

       100
       -
           gst-plugins-bad

     

       101
       -
           gst-plugins-good

     

       102
        
           gtk3

     

       103
        
           hicolor-icon-theme

     

       104
        
           ilmbase

     
···

       106
        
           mesa.osmesa

     

       107
        
           mpfr

     

       108
        
           nlopt

     

       109
       -
           opencascade-occt

     

       110
       -
           openvdb_tbb_2021_8

     

       111
        
           pcre

     

       112
        
           tbb_2021_11

     

       113
        
           webkitgtk_4_0

     

       114
       -
           wxGTK31'

     

       115
        
           xorg.libX11

     

       0
        
       
     

       116
        
         ] ++ lib.optionals withSystemd [ systemd ] ++ checkInputs;

     

       117
        
       

     

       118
        
         patches = [

     

       119
        
           # Fix for webkitgtk linking

     

       120
       -
           ./0001-not-for-upstream-CMakeLists-Link-against-webkit2gtk-.patch

     

       121
        
           # Fix build with cgal-5.6.1+

     

       122
       -
           ./meshboolean-const.patch

     

       0
        
       
     

       0
        
       
     

       123
        
         ];

     

       124
        
       

     

       125
        
         doCheck = true;

     
···

       136
        
         # Disable compiler warnings that clutter the build log.

     

       137
        
         # It seems to be a known issue for Eigen:

     

       138
        
         # http://eigen.tuxfamily.org/bz/show_bug.cgi?id=1221

     

       139
       -
         NIX_CFLAGS_COMPILE = "-Wno-ignored-attributes";

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       140
        
       

     

       141
        
         # prusa-slicer uses dlopen on `libudev.so` at runtime

     

       142
        
         NIX_LDFLAGS = lib.optionalString withSystemd "-ludev";

     
···

       181
        
         meta = with lib; {

     

       182
        
           description = "PC Software for BambuLab's 3D printers";

     

       183
        
           homepage = "https://github.com/bambulab/BambuStudio";

     

       0
        
       
     

       184
        
           license = licenses.agpl3Plus;

     

       185
       -
           maintainers = with maintainers; [ zhaofengli ];

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       186
        
           mainProgram = "bambu-studio";

     

       187
        
           platforms = platforms.linux;

     

       188
        
         };

···

       22
        
         glib,

     

       23
        
         glib-networking,

     

       24
        
         gmp,

     

       25
       +
         gst_all_1,

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       26
        
         gtest,

     

       27
        
         gtk3,

     

       28
        
         hicolor-icon-theme,

     
···

       33
        
         nlopt,

     

       34
        
         opencascade-occt_7_6,

     

       35
        
         openvdb,

     

       36
       +
         opencv,

     

       37
        
         pcre,

     

       38
        
         systemd,

     

       39
        
         tbb_2021_11,

     
···

       43
        
         withSystemd ? stdenv.hostPlatform.isLinux,

     

       44
        
       }:

     

       45
        
       let

     

       46
       +
         wxGTK' =

     

       47
       +
           (wxGTK31.override {

     

       48
       +
             withCurl = true;

     

       49
       +
             withPrivateFonts = true;

     

       50
       +
             withWebKit = true;

     

       51
       +
           }).overrideAttrs

     

       52
       +
             (old: {

     

       53
       +
               configureFlags = old.configureFlags ++ [

     

       54
       +
                 # Disable noisy debug dialogs

     

       55
       +
                 "--enable-debug=no"

     

       56
       +
               ];

     

       57
       +
             });

     

       58
       +
       

     

       59
       +
         openvdb' = openvdb.overrideAttrs (old: {

     

       60
        
           buildInputs = [

     

       61
        
             openexr

     

       62
        
             boost179

     
···

       69
        
       in

     

       70
        
       stdenv.mkDerivation rec {

     

       71
        
         pname = "bambu-studio";

     

       72
       +
         version = "01.09.07.52";

     

       73
        
       

     

       74
        
         src = fetchFromGitHub {

     

       75
        
           owner = "bambulab";

     

       76
        
           repo = "BambuStudio";

     

       77
        
           rev = "v${version}";

     

       78
       +
           hash = "sha256-fhH4N29P/ysdHHbZt+FnBl3+QtTNhbVE3j4ZnFJyJH0=";

     

       79
        
         };

     

       80
        
       

     

       81
        
         nativeBuildInputs = [

     
···

       99
        
           glib

     

       100
        
           glib-networking

     

       101
        
           gmp

     

       102
       +
           gst_all_1.gstreamer

     

       103
       +
           gst_all_1.gst-plugins-base

     

       104
       +
           gst_all_1.gst-plugins-bad

     

       105
       +
           gst_all_1.gst-plugins-good

     

       106
        
           gtk3

     

       107
        
           hicolor-icon-theme

     

       108
        
           ilmbase

     
···

       110
        
           mesa.osmesa

     

       111
        
           mpfr

     

       112
        
           nlopt

     

       113
       +
           opencascade-occt_7_6

     

       114
       +
           openvdb'

     

       115
        
           pcre

     

       116
        
           tbb_2021_11

     

       117
        
           webkitgtk_4_0

     

       118
       +
           wxGTK'

     

       119
        
           xorg.libX11

     

       120
       +
           opencv

     

       121
        
         ] ++ lib.optionals withSystemd [ systemd ] ++ checkInputs;

     

       122
        
       

     

       123
        
         patches = [

     

       124
        
           # Fix for webkitgtk linking

     

       125
       +
           ./patches/0001-not-for-upstream-CMakeLists-Link-against-webkit2gtk-.patch

     

       126
        
           # Fix build with cgal-5.6.1+

     

       127
       +
           ./patches/meshboolean-const.patch

     

       128
       +
           # Fix an issue with

     

       129
       +
           ./patches/dont-link-opencv-world-bambu.patch

     

       130
        
         ];

     

       131
        
       

     

       132
        
         doCheck = true;

     
···

       143
        
         # Disable compiler warnings that clutter the build log.

     

       144
        
         # It seems to be a known issue for Eigen:

     

       145
        
         # http://eigen.tuxfamily.org/bz/show_bug.cgi?id=1221

     

       146
       +
         NIX_CFLAGS_COMPILE = toString [

     

       147
       +
           "-Wno-ignored-attributes"

     

       148
       +
           "-I${opencv.out}/include/opencv4"

     

       149
       +
         ];

     

       150
        
       

     

       151
        
         # prusa-slicer uses dlopen on `libudev.so` at runtime

     

       152
        
         NIX_LDFLAGS = lib.optionalString withSystemd "-ludev";

     
···

       191
        
         meta = with lib; {

     

       192
        
           description = "PC Software for BambuLab's 3D printers";

     

       193
        
           homepage = "https://github.com/bambulab/BambuStudio";

     

       194
       +
           changelog = "https://github.com/bambulab/BambuStudio/releases/tag/v${version}";

     

       195
        
           license = licenses.agpl3Plus;

     

       196
       +
           maintainers = with maintainers; [

     

       197
       +
             zhaofengli

     

       198
       +
             dsluijk

     

       199
       +
           ];

     

       200
        
           mainProgram = "bambu-studio";

     

       201
        
           platforms = platforms.linux;

     

       202
        
         };

pkgs/applications/misc/bambu-studio/dont-link-opencv-world.patch pkgs/applications/misc/bambu-studio/patches/dont-link-opencv-world-orca.patch

pkgs/applications/misc/bambu-studio/meshboolean-const.patch pkgs/applications/misc/bambu-studio/patches/meshboolean-const.patch

+9 -15

pkgs/applications/misc/bambu-studio/orca-slicer.nix

···

       2
        
         lib,

     

       3
        
         fetchFromGitHub,

     

       4
        
         bambu-studio,

     

       5
       -
         opencv,

     

       6
        
       }:

     

       7
        
       bambu-studio.overrideAttrs (

     

       8
        
         finalAttrs: previousAttrs: {

     
···

       16
        
             hash = "sha256-7fusdSYpZb4sYl5L/+81PzMd42Nsejj+kCZsq0f7eIk=";

     

       17
        
           };

     

       18
        
       

     

       19
       -
           patches =

     

       20
       -
             previousAttrs.patches

     

       21
       -
             ++ [

     

       22
       -
               # FIXME: only required for 2.1.1, can be removed in the next version

     

       23
       -
               ./0002-fix-build-for-gcc-13.diff

     

       24
       -
       

     

       25
       -
               ./dont-link-opencv-world.patch

     

       26
       -
             ];

     

       27
       -
       

     

       28
       -
           buildInputs =

     

       29
       -
             previousAttrs.buildInputs

     

       30
       -
             ++ [

     

       31
       -
               opencv

     

       32
       -
             ];

     

       33
        
       

     

       34
        
           preFixup = ''

     

       35
        
             gappsWrapperArgs+=(

···

       2
        
         lib,

     

       3
        
         fetchFromGitHub,

     

       4
        
         bambu-studio,

     

       0
        
       
     

       5
        
       }:

     

       6
        
       bambu-studio.overrideAttrs (

     

       7
        
         finalAttrs: previousAttrs: {

     
···

       15
        
             hash = "sha256-7fusdSYpZb4sYl5L/+81PzMd42Nsejj+kCZsq0f7eIk=";

     

       16
        
           };

     

       17
        
       

     

       18
       +
           patches =[

     

       19
       +
             # FIXME: only required for 2.1.1, can be removed in the next version

     

       20
       +
             ./patches/0002-fix-build-for-gcc-13.diff

     

       21
       +
             # Fix for webkitgtk linking

     

       22
       +
             ./patches/0001-not-for-upstream-CMakeLists-Link-against-webkit2gtk-.patch

     

       23
       +
             # Fix build with cgal-5.6.1+

     

       24
       +
             ./patches/meshboolean-const.patch

     

       25
       +
             ./patches/dont-link-opencv-world-orca.patch

     

       26
       +
           ];

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       27
        
       

     

       28
        
           preFixup = ''

     

       29
        
             gappsWrapperArgs+=(

+14

pkgs/applications/misc/bambu-studio/patches/dont-link-opencv-world-bambu.patch

···

       1
       +
       diff --git a/src/libslic3r/CMakeLists.txt b/src/libslic3r/CMakeLists.txt

     

       2
       +
       index 2cdc525..44e6602 100644

     

       3
       +
       --- a/src/libslic3r/CMakeLists.txt

     

       4
       +
       +++ b/src/libslic3r/CMakeLists.txt

     

       5
       +
       @@ -533,7 +533,8 @@ target_link_libraries(libslic3r

     

       6
       +
            ${OCCT_LIBS}

     

       7
       +
            Clipper2

     

       8
       +
            mcut

     

       9
       +
       -    opencv_world

     

       10
       +
       +    opencv_core

     

       11
       +
       +    opencv_imgproc

     

       12
       +
            )

     

       13
       +
        

     

       14
       +
        if(NOT WIN32)

+13 -8

pkgs/applications/misc/bb/default.nix

···

       1
       -
       { stdenv, lib, fetchurl, darwin, aalib, ncurses, xorg, libmikmod }:

     

       2
        
       

     

       3
        
       stdenv.mkDerivation rec {

     

       4
        
         pname = "bb";

     
···

       9
        
           sha256 = "1i411glxh7g4pfg4gw826lpwngi89yrbmxac8jmnsfvrfb48hgbr";

     

       10
        
         };

     

       11
        
       

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       12
        
         buildInputs = [

     

       13
        
           aalib ncurses libmikmod

     

       14
        
           xorg.libXau xorg.libXdmcp xorg.libX11

     

       15
       -
         ] ++ lib.optional stdenv.hostPlatform.isDarwin darwin.apple_sdk.frameworks.CoreAudio;

     

       16
        
       

     

       17
       -
         postPatch = lib.optionalString stdenv.hostPlatform.isDarwin ''

     

       18
       -
           sed -i -e '/^#include <malloc.h>$/d' *.c

     

       0
        
       
     

       0
        
       
     

       19
        
         '';

     

       20
       -
       

     

       21
       -
         # error: 'regparm' is not valid on this platform

     

       22
       -
         env.NIX_CFLAGS_COMPILE = lib.optionalString (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64)

     

       23
       -
           "-D__STRICT_ANSI__";

     

       24
        
       

     

       25
        
         meta = with lib; {

     

       26
        
           homepage    = "http://aa-project.sourceforge.net/bb";

···

       1
       +
       { stdenv, lib, fetchurl, autoreconfHook, aalib, ncurses, xorg, libmikmod }:

     

       2
        
       

     

       3
        
       stdenv.mkDerivation rec {

     

       4
        
         pname = "bb";

     
···

       9
        
           sha256 = "1i411glxh7g4pfg4gw826lpwngi89yrbmxac8jmnsfvrfb48hgbr";

     

       10
        
         };

     

       11
        
       

     

       12
       +
         patches = [

     

       13
       +
           # add / update include files to get function prototypes

     

       14
       +
           ./included-files-updates.diff

     

       15
       +
         ];

     

       16
       +
       

     

       17
       +
         nativeBuildInputs = [ autoreconfHook ];

     

       18
       +
       

     

       19
        
         buildInputs = [

     

       20
        
           aalib ncurses libmikmod

     

       21
        
           xorg.libXau xorg.libXdmcp xorg.libX11

     

       22
       +
         ];

     

       23
        
       

     

       24
       +
         # regparm attribute is not supported by clang

     

       25
       +
         postPatch = lib.optionalString stdenv.cc.isClang ''

     

       26
       +
           substituteInPlace config.h \

     

       27
       +
             --replace-fail "__attribute__ ((regparm(n)))" ""

     

       28
        
         '';

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       29
        
       

     

       30
        
         meta = with lib; {

     

       31
        
           homepage    = "http://aa-project.sourceforge.net/bb";

+145

pkgs/applications/misc/bb/included-files-updates.diff

···

       1
       +
       diff --git a/bb.c b/bb.c

     

       2
       +
       index 95850ef..6a7cc78 100644

     

       3
       +
       --- a/bb.c

     

       4
       +
       +++ b/bb.c

     

       5
       +
       @@ -23,6 +23,7 @@

     

       6
       +
        

     

       7
       +
        #include <string.h>

     

       8
       +
        #include <stdlib.h>

     

       9
       +
       +#include <time.h>

     

       10
       +
        #include <ctype.h>

     

       11
       +
        #include <aalib.h>

     

       12
       +
        #include "bb.h"

     

       13
       +
       diff --git a/credits.c b/credits.c

     

       14
       +
       index 8514579..b304d8c 100644

     

       15
       +
       --- a/credits.c

     

       16
       +
       +++ b/credits.c

     

       17
       +
       @@ -24,7 +24,6 @@

     

       18
       +
        #include <math.h>

     

       19
       +
        #include <limits.h>

     

       20
       +
        #include <string.h>

     

       21
       +
       -#include <malloc.h>

     

       22
       +
        #include <stdlib.h>

     

       23
       +
        #include "bb.h"

     

       24
       +
        #define STAR 1

     

       25
       +
       diff --git a/credits2.c b/credits2.c

     

       26
       +
       index 65d2431..9dcdf2d 100644

     

       27
       +
       --- a/credits2.c

     

       28
       +
       +++ b/credits2.c

     

       29
       +
       @@ -25,7 +25,6 @@

     

       30
       +
        #include <math.h>

     

       31
       +
        #include <ctype.h>

     

       32
       +
        #include <string.h>

     

       33
       +
       -#include <malloc.h>

     

       34
       +
        #include <stdlib.h>

     

       35
       +
        #include "bb.h"

     

       36
       +
        #define STATE (TIME-starttime)

     

       37
       +
       diff --git a/main.c b/main.c

     

       38
       +
       index ae852a7..c0648b4 100644

     

       39
       +
       --- a/main.c

     

       40
       +
       +++ b/main.c

     

       41
       +
       @@ -21,6 +21,8 @@

     

       42
       +
         * 675 Mass Ave, Cambridge, MA 02139, USA.

     

       43
       +
         */

     

       44
       +
        

     

       45
       +
       +#include <ctype.h>

     

       46
       +
       +#include <string.h>

     

       47
       +
        #include <unistd.h>

     

       48
       +
        #include "timers.h"

     

       49
       +
        #include "bb.h"

     

       50
       +
       diff --git a/messager.c b/messager.c

     

       51
       +
       index 95cc410..5164577 100644

     

       52
       +
       --- a/messager.c

     

       53
       +
       +++ b/messager.c

     

       54
       +
       @@ -22,7 +22,7 @@

     

       55
       +
         */

     

       56
       +
        

     

       57
       +
        #include <string.h>

     

       58
       +
       -#include <malloc.h>

     

       59
       +
       +#include <stdlib.h>

     

       60
       +
        #include "bb.h"

     

       61
       +
        

     

       62
       +
        static int cursor_x, cursor_y;

     

       63
       +
       diff --git a/scene5.c b/scene5.c

     

       64
       +
       index 8d3c798..4a79258 100644

     

       65
       +
       --- a/scene5.c

     

       66
       +
       +++ b/scene5.c

     

       67
       +
       @@ -22,7 +22,7 @@

     

       68
       +
         */

     

       69
       +
        

     

       70
       +
        #include <string.h>

     

       71
       +
       -#include <malloc.h>

     

       72
       +
       +#include <stdlib.h>

     

       73
       +
        #include <math.h>

     

       74
       +
        #include "bb.h"

     

       75
       +
        #include "tex.h"

     

       76
       +
       diff --git a/scene8.c b/scene8.c

     

       77
       +
       index 2bcba1e..72ea231 100644

     

       78
       +
       --- a/scene8.c

     

       79
       +
       +++ b/scene8.c

     

       80
       +
       @@ -22,7 +22,7 @@

     

       81
       +
         */

     

       82
       +
        

     

       83
       +
        #include <math.h>

     

       84
       +
       -#include <malloc.h>

     

       85
       +
       +#include <stdlib.h>

     

       86
       +
        #include "bb.h"

     

       87
       +
        #define STATE1 (TIME-starttime1)

     

       88
       +
        #define STATE (time-starttime)

     

       89
       +
       diff --git a/textform.c b/textform.c

     

       90
       +
       index 859d367..eb9d1cb 100644

     

       91
       +
       --- a/textform.c

     

       92
       +
       +++ b/textform.c

     

       93
       +
       @@ -1,6 +1,6 @@

     

       94
       +
        #include <stdio.h>

     

       95
       +
        #include <string.h>

     

       96
       +
       -#include <malloc.h>

     

       97
       +
       +#include <stdlib.h>

     

       98
       +
        #include <aalib.h>

     

       99
       +
        #include "bb.h"

     

       100
       +
        #define MAXLINES 10000

     

       101
       +
       diff --git a/timers.c b/timers.c

     

       102
       +
       index ac822f7..6342c1b 100644

     

       103
       +
       --- a/timers.c

     

       104
       +
       +++ b/timers.c

     

       105
       +
       @@ -45,12 +45,9 @@

     

       106
       +
        #include <time.h>

     

       107
       +
        #endif

     

       108
       +
           /*HAVE_TIME_H*/

     

       109
       +
       -#include <malloc.h>

     

       110
       +
       +#include <stdlib.h>

     

       111
       +
        #include <stdio.h>

     

       112
       +
        #include <unistd.h>

     

       113
       +
       -#ifndef _MAC

     

       114
       +
       -#include <malloc.h>

     

       115
       +
       -#endif

     

       116
       +
        #ifdef __BEOS__

     

       117
       +
        #include <OS.h>

     

       118
       +
        #endif

     

       119
       +
       diff --git a/uncompfn.c b/uncompfn.c

     

       120
       +
       index d8eaaea..bc707f8 100644

     

       121
       +
       --- a/uncompfn.c

     

       122
       +
       +++ b/uncompfn.c

     

       123
       +
       @@ -21,7 +21,7 @@

     

       124
       +
         * 675 Mass Ave, Cambridge, MA 02139, USA.

     

       125
       +
         */

     

       126
       +
        

     

       127
       +
       -#include <malloc.h>

     

       128
       +
       +#include <stdlib.h>

     

       129
       +
        #include <aalib.h>

     

       130
       +
        #include "bb.h"

     

       131
       +
        

     

       132
       +
       diff --git a/zoom.c b/zoom.c

     

       133
       +
       index 7450095..4b37b2d 100644

     

       134
       +
       --- a/zoom.c

     

       135
       +
       +++ b/zoom.c

     

       136
       +
       @@ -31,9 +31,6 @@

     

       137
       +
        #else

     

       138
       +
        #include <stdlib.h>

     

       139
       +
        #include <stdio.h>

     

       140
       +
       -#ifndef _MAC

     

       141
       +
       -#include <malloc.h>

     

       142
       +
       -#endif

     

       143
       +
        #ifdef __DJGPP__

     

       144
       +
        #include "aconfig.dos"

     

       145
       +
        #else

+7 -2

pkgs/applications/misc/gallery-dl/default.nix

···

       10
        
       

     

       11
        
       buildPythonApplication rec {

     

       12
        
         pname = "gallery-dl";

     

       13
       -
         version = "1.27.6";

     

       14
        
         format = "setuptools";

     

       15
        
       

     

       16
        
         src = fetchPypi {

     

       17
        
           inherit version;

     

       18
        
           pname = "gallery_dl";

     

       19
       -
           hash = "sha256-bxh15aZIupTaHnYM65MAYuYtKx0z2OIQl3WKEU1gO4Q=";

     

       20
        
         };

     

       21
        
       

     

       22
        
         propagatedBuildInputs = [

     
···

       25
        
         ];

     

       26
        
       

     

       27
        
         nativeCheckInputs = [ pytestCheckHook ];

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       28
        
       

     

       29
        
         pytestFlagsArray = [

     

       30
        
           # requires network access

···

       10
        
       

     

       11
        
       buildPythonApplication rec {

     

       12
        
         pname = "gallery-dl";

     

       13
       +
         version = "1.27.7";

     

       14
        
         format = "setuptools";

     

       15
        
       

     

       16
        
         src = fetchPypi {

     

       17
        
           inherit version;

     

       18
        
           pname = "gallery_dl";

     

       19
       +
           hash = "sha256-9YcxD7AH4U2dOhAiUnknwwGFy9pplFFQ7Rn4cOvDdEc=";

     

       20
        
         };

     

       21
        
       

     

       22
        
         propagatedBuildInputs = [

     
···

       25
        
         ];

     

       26
        
       

     

       27
        
         nativeCheckInputs = [ pytestCheckHook ];

     

       28
       +
       

     

       29
       +
         disabledTests = [

     

       30
       +
           # requires network access

     

       31
       +
           "test_init"

     

       32
       +
         ];

     

       33
        
       

     

       34
        
         pytestFlagsArray = [

     

       35
        
           # requires network access

+2 -2

pkgs/applications/misc/gremlin-console/default.nix

···

       2
        
       

     

       3
        
       stdenv.mkDerivation rec {

     

       4
        
         pname = "gremlin-console";

     

       5
       -
         version = "3.7.2";

     

       6
        
         src = fetchzip {

     

       7
        
           url = "https://downloads.apache.org/tinkerpop/${version}/apache-tinkerpop-gremlin-console-${version}-bin.zip";

     

       8
       -
           sha256 = "sha256-lIrqMvI/sYGu36X3jNptoIz7mPVomk8YCIR/6y8mpEc=";

     

       9
        
         };

     

       10
        
       

     

       11
        
         nativeBuildInputs = [ makeWrapper ];

···

       2
        
       

     

       3
        
       stdenv.mkDerivation rec {

     

       4
        
         pname = "gremlin-console";

     

       5
       +
         version = "3.7.3";

     

       6
        
         src = fetchzip {

     

       7
        
           url = "https://downloads.apache.org/tinkerpop/${version}/apache-tinkerpop-gremlin-console-${version}-bin.zip";

     

       8
       +
           sha256 = "sha256-27S1ukq9rHncFuPBZmwIP/bKuPYm3AxdBK3PliYTGEQ=";

     

       9
        
         };

     

       10
        
       

     

       11
        
         nativeBuildInputs = [ makeWrapper ];

+6 -6

pkgs/applications/video/qctools/default.nix

···

       1
       -
       { lib, stdenv, fetchurl, qmake, wrapQtAppsHook, ffmpeg, qtmultimedia, qwt }:

     

       2
        
       

     

       3
        
       stdenv.mkDerivation rec {

     

       4
        
         pname = "qctools";

     
···

       13
        
       

     

       14
        
         nativeBuildInputs = [ qmake wrapQtAppsHook ];

     

       15
        
       

     

       16
       -
         buildInputs = [ ffmpeg qtmultimedia qwt ];

     

       17
        
       

     

       18
        
         installPhase = ''

     

       19
        
           runHook preInstall

     
···

       30
        
           runHook postInstall

     

       31
        
         '';

     

       32
        
       

     

       33
       -
         meta = with lib; {

     

       34
        
           description = "Audiovisual analytics and filtering of video files";

     

       35
        
           homepage = "https://mediaarea.net/QCTools";

     

       36
       -
           license = licenses.gpl3Only;

     

       37
       -
           maintainers = with maintainers; [ orivej ];

     

       38
       -
           platforms = platforms.linux;

     

       39
        
         };

     

       40
        
       }

···

       1
       +
       { lib, stdenv, fetchurl, qmake, wrapQtAppsHook, ffmpeg_6, qtmultimedia, qwt }:

     

       2
        
       

     

       3
        
       stdenv.mkDerivation rec {

     

       4
        
         pname = "qctools";

     
···

       13
        
       

     

       14
        
         nativeBuildInputs = [ qmake wrapQtAppsHook ];

     

       15
        
       

     

       16
       +
         buildInputs = [ ffmpeg_6 qtmultimedia qwt ];

     

       17
        
       

     

       18
        
         installPhase = ''

     

       19
        
           runHook preInstall

     
···

       30
        
           runHook postInstall

     

       31
        
         '';

     

       32
        
       

     

       33
       +
         meta = {

     

       34
        
           description = "Audiovisual analytics and filtering of video files";

     

       35
        
           homepage = "https://mediaarea.net/QCTools";

     

       36
       +
           license = lib.licenses.gpl3Only;

     

       37
       +
           maintainers = with lib.maintainers; [ orivej ];

     

       38
       +
           platforms = lib.platforms.linux;

     

       39
        
         };

     

       40
        
       }

+28

pkgs/by-name/ar/armitage/gradle-8.patch

···

       1
       +
       Upstream PR: https://github.com/r00t0v3rr1d3/armitage/pull/1

     

       2
       +
       diff --git a/armitage/build.gradle b/armitage/build.gradle

     

       3
       +
       index 43a5d08..50ae084 100644

     

       4
       +
       --- a/armitage/build.gradle

     

       5
       +
       +++ b/armitage/build.gradle

     

       6
       +
       @@ -19,7 +19,7 @@ jar {

     

       7
       +
            from {

     

       8
       +
                configurations.compileClasspath.filter { it.exists() }.collect { it.isDirectory() ? it : zipTree(it) }

     

       9
       +
            }

     

       10
       +
       -    archiveName 'armitage.jar'

     

       11
       +
       +    archiveFileName.set 'armitage.jar'

     

       12
       +
        }

     

       13
       +
        

     

       14
       +
        dependencies {

     

       15
       +
       diff --git a/cortana/build.gradle b/cortana/build.gradle

     

       16
       +
       index c7d08bb..aa54635 100644

     

       17
       +
       --- a/cortana/build.gradle

     

       18
       +
       +++ b/cortana/build.gradle

     

       19
       +
       @@ -19,7 +19,8 @@ jar {

     

       20
       +
            from {

     

       21
       +
                configurations.compileClasspath.filter { it.exists() }.collect { it.isDirectory() ? it : zipTree(it) }

     

       22
       +
            }

     

       23
       +
       -    archiveName 'cortana.jar'

     

       24
       +
       +    duplicatesStrategy DuplicatesStrategy.INCLUDE

     

       25
       +
       +    archiveFileName.set 'cortana.jar'

     

       26
       +
        }

     

       27
       +
        

     

       28
       +
        dependencies {

+3 -3

pkgs/by-name/ar/armitage/package.nix

···

       3
        
       , fetchurl

     

       4
        
       , fetchFromGitHub

     

       5
        
       , jdk11

     

       6
       -
       , gradle_6

     

       7
        
       , metasploit

     

       8
        
       , makeWrapper

     

       9
        
       , makeDesktopItem

     
···

       14
        
       let

     

       15
        
         pname = "armitage";

     

       16
        
         version = "unstable-2022-12-05";

     

       17
       -
       

     

       18
       -
         gradle = gradle_6;

     

       19
        
       

     

       20
        
         src = fetchFromGitHub {

     

       21
        
           owner = "r00t0v3rr1d3";

     
···

       45
        
             url = "https://gitlab.com/kalilinux/packages/armitage/-/raw/042beb7494a10227761ecb3ddabf4019bbb78681/debian/patches/fix-meterpreter.patch";

     

       46
        
             hash = "sha256-p4fs5xFdC2apW0U8x8u9S4p5gq3Eiv+0E4CGccQZYKY=";

     

       47
        
           })

     

       0
        
       
     

       0
        
       
     

       48
        
         ];

     

       49
        
       

     

       50
        
       in

···

       3
        
       , fetchurl

     

       4
        
       , fetchFromGitHub

     

       5
        
       , jdk11

     

       6
       +
       , gradle

     

       7
        
       , metasploit

     

       8
        
       , makeWrapper

     

       9
        
       , makeDesktopItem

     
···

       14
        
       let

     

       15
        
         pname = "armitage";

     

       16
        
         version = "unstable-2022-12-05";

     

       0
        
       
     

       0
        
       
     

       17
        
       

     

       18
        
         src = fetchFromGitHub {

     

       19
        
           owner = "r00t0v3rr1d3";

     
···

       43
        
             url = "https://gitlab.com/kalilinux/packages/armitage/-/raw/042beb7494a10227761ecb3ddabf4019bbb78681/debian/patches/fix-meterpreter.patch";

     

       44
        
             hash = "sha256-p4fs5xFdC2apW0U8x8u9S4p5gq3Eiv+0E4CGccQZYKY=";

     

       45
        
           })

     

       46
       +
           # Update for Gradle 8 (https://github.com/r00t0v3rr1d3/armitage/pull/1)

     

       47
       +
           ./gradle-8.patch

     

       48
        
         ];

     

       49
        
       

     

       50
        
       in

+3 -3

pkgs/by-name/at/atproto-goat/package.nix

···

       7
        
       

     

       8
        
       buildGoModule rec {

     

       9
        
         pname = "atproto-goat";

     

       10
       -
         version = "0-unstable-2024-10-08";

     

       11
        
       

     

       12
        
         src = fetchFromGitHub {

     

       13
        
           owner = "bluesky-social";

     

       14
        
           repo = "indigo";

     

       15
       -
           rev = "06bacb465af714feb77609566aba15ab1ed41e24";

     

       16
       -
           hash = "sha256-wWsE3sAGZQmOBVqTgy4RjoU8zmtuvyQIj9DjwSbtmKw=";

     

       17
        
         };

     

       18
        
       

     

       19
        
         postPatch = ''

···

       7
        
       

     

       8
        
       buildGoModule rec {

     

       9
        
         pname = "atproto-goat";

     

       10
       +
         version = "0-unstable-2024-10-29";

     

       11
        
       

     

       12
        
         src = fetchFromGitHub {

     

       13
        
           owner = "bluesky-social";

     

       14
        
           repo = "indigo";

     

       15
       +
           rev = "983ce4a481a32a3eb2944c4c76e885d0f6006f83";

     

       16
       +
           hash = "sha256-Jo3pI4uRyKh3yV03ijOcg+Uyu75Spmy/VS116MVgleU=";

     

       17
        
         };

     

       18
        
       

     

       19
        
         postPatch = ''

pkgs/by-name/au/auto-patchelf/auto-patchelf.py pkgs/by-name/au/auto-patchelf/src/auto-patchelf.py

+1 -6

pkgs/by-name/au/auto-patchelf/package.nix

···

       8
        
         version = "0-unstable-2024-08-14";

     

       9
        
         pyproject = false;

     

       10
        
       

     

       11
       -
         src = lib.fileset.toSource {

     

       12
       -
           root = ./.;

     

       13
       -
           fileset = lib.fileset.unions [

     

       14
       -
             ./auto-patchelf.py

     

       15
       -
           ];

     

       16
       -
         };

     

       17
        
       

     

       18
        
         dependencies = with python3Packages; [

     

       19
        
           pyelftools

···

       8
        
         version = "0-unstable-2024-08-14";

     

       9
        
         pyproject = false;

     

       10
        
       

     

       11
       +
         src = ./src;

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       12
        
       

     

       13
        
         dependencies = with python3Packages; [

     

       14
        
           pyelftools

+4 -6

pkgs/by-name/aw/awscli2/package.nix

···

       62
        
       in

     

       63
        
       py.pkgs.buildPythonApplication rec {

     

       64
        
         pname = "awscli2";

     

       65
       -
         version = "2.17.64"; # N.B: if you change this, check if overrides are still up-to-date

     

       66
        
         pyproject = true;

     

       67
        
       

     

       68
        
         src = fetchFromGitHub {

     

       69
        
           owner = "aws";

     

       70
        
           repo = "aws-cli";

     

       71
        
           rev = "refs/tags/${version}";

     

       72
       -
           hash = "sha256-Hq86KhAIATSz3dF1zO6aSdZQAfLs4EcRqWglAOJUVGk=";

     

       73
        
         };

     

       74
        
       

     

       75
       -
         patches = [ ];

     

       76
       -
       

     

       77
        
         postPatch = ''

     

       78
        
           substituteInPlace pyproject.toml \

     

       79
       -
             --replace-fail 'awscrt>=0.19.18,<=0.21.2' 'awscrt>=0.19.18' \

     

       80
       -
             --replace-fail 'cryptography>=40.0.0,<40.0.2' 'cryptography>=43.0.0' \

     

       81
        
             --replace-fail 'distro>=1.5.0,<1.9.0' 'distro>=1.5.0' \

     

       82
        
             --replace-fail 'docutils>=0.10,<0.20' 'docutils>=0.10' \

     

       83
        
             --replace-fail 'prompt-toolkit>=3.0.24,<3.0.39' 'prompt-toolkit>=3.0.24'

···

       62
        
       in

     

       63
        
       py.pkgs.buildPythonApplication rec {

     

       64
        
         pname = "awscli2";

     

       65
       +
         version = "2.18.15"; # N.B: if you change this, check if overrides are still up-to-date

     

       66
        
         pyproject = true;

     

       67
        
       

     

       68
        
         src = fetchFromGitHub {

     

       69
        
           owner = "aws";

     

       70
        
           repo = "aws-cli";

     

       71
        
           rev = "refs/tags/${version}";

     

       72
       +
           hash = "sha256-dm4Z3WsFq5GQN6gvi5OS9J96PqhGx8Qz2OsHwUBrsAs=";

     

       73
        
         };

     

       74
        
       

     

       0
        
       
     

       0
        
       
     

       75
        
         postPatch = ''

     

       76
        
           substituteInPlace pyproject.toml \

     

       77
       +
             --replace-fail 'awscrt>=0.19.18,<=0.22.0' 'awscrt>=0.22.0' \

     

       78
       +
             --replace-fail 'cryptography>=40.0.0,<43.0.2' 'cryptography>=43.0.0' \

     

       79
        
             --replace-fail 'distro>=1.5.0,<1.9.0' 'distro>=1.5.0' \

     

       80
        
             --replace-fail 'docutils>=0.10,<0.20' 'docutils>=0.10' \

     

       81
        
             --replace-fail 'prompt-toolkit>=3.0.24,<3.0.39' 'prompt-toolkit>=3.0.24'

+2 -2

pkgs/by-name/bi/bitbake-language-server/package.nix

···

       7
        
       

     

       8
        
       python3.pkgs.buildPythonApplication rec {

     

       9
        
         pname = "bitbake-language-server";

     

       10
       -
         version = "0.0.14";

     

       11
        
         format = "pyproject";

     

       12
        
       

     

       13
        
         src = fetchFromGitHub {

     

       14
        
           owner = "Freed-Wu";

     

       15
        
           repo = pname;

     

       16
        
           rev = version;

     

       17
       -
           hash = "sha256-aGj9lW420A+iTQWSCdIITAJj3p89VUkPvdhQ/0M6uXo=";

     

       18
        
         };

     

       19
        
       

     

       20
        
         nativeBuildInputs = with python3.pkgs; [

···

       7
        
       

     

       8
        
       python3.pkgs.buildPythonApplication rec {

     

       9
        
         pname = "bitbake-language-server";

     

       10
       +
         version = "0.0.15";

     

       11
        
         format = "pyproject";

     

       12
        
       

     

       13
        
         src = fetchFromGitHub {

     

       14
        
           owner = "Freed-Wu";

     

       15
        
           repo = pname;

     

       16
        
           rev = version;

     

       17
       +
           hash = "sha256-NLDQ2P5peweugkoNYskpCyCEgBwVFA7RTs8+NvH8fj8=";

     

       18
        
         };

     

       19
        
       

     

       20
        
         nativeBuildInputs = with python3.pkgs; [

+59

pkgs/by-name/ct/ctune/cmake_disable_git_clone.patch

···

       1
       +
       diff --git a/CMakeLists.txt b/CMakeLists.txt

     

       2
       +
       index 1a30d61..bea8d7c 100644

     

       3
       +
       --- a/CMakeLists.txt

     

       4
       +
       +++ b/CMakeLists.txt

     

       5
       +
       @@ -50,13 +50,6 @@ include(FetchContent)

     

       6
       +
        

     

       7
       +
        set(CMAKE_VERBOSE_MAKEFILE ON)

     

       8
       +
        

     

       9
       +
       -#========================================== PRE-CHECKS ============================================#

     

       10
       +
       -include(FindGit)

     

       11
       +
       -find_package(Git)

     

       12
       +
       -

     

       13
       +
       -if (NOT Git_FOUND)

     

       14
       +
       -    message(FATAL_ERROR "Required package 'Git' not found on system.")

     

       15
       +
       -endif ()

     

       16
       +
        

     

       17
       +
        #======================================== LIB IMPORTS =============================================#

     

       18
       +
        # ======= #

     

       19
       +
       @@ -68,28 +61,9 @@ include_directories(${OPENSSL_INCLUDE_DIR})

     

       20
       +
        # ============== #

     

       21
       +
        # JSON-C library #

     

       22
       +
        # ============== #

     

       23
       +
       -set(JSONC_DOWNLOAD_PATH "${TEMP_DIR_PATH}/libjsonc")

     

       24
       +
       -set(JSONC_INSTALL_PATH "${CMAKE_EXTERNAL_OUTPUT_DIRECTORY}")

     

       25
       +
       -

     

       26
       +
       -add_custom_target(make-jsonc-install-dir ALL

     

       27
       +
       -        COMMAND ${CMAKE_COMMAND} -E make_directory ${JSONC_INSTALL_PATH}

     

       28
       +
       -)

     

       29
       +
       -

     

       30
       +
       -ExternalProject_Add(libjsonc

     

       31
       +
       -        PREFIX         "${JSONC_DOWNLOAD_PATH}"

     

       32
       +
       -        SOURCE_DIR     "${JSONC_DOWNLOAD_PATH}/src/libjsonc-build"

     

       33
       +
       -        GIT_REPOSITORY "https://github.com/json-c/json-c.git"

     

       34
       +
       -        CMAKE_ARGS     "-DBUILD_STATIC_LIBS=ON"

     

       35
       +
       -                       "-DBUILD_SHARED_LIBS=OFF"

     

       36
       +
       -                       "-DCMAKE_INSTALL_PREFIX:PATH=${JSONC_INSTALL_PATH}"

     

       37
       +
       -                       "-DHAVE_ARC4RANDOM=OFF"

     

       38
       +
       -                       "-DCMAKE_BUILD_TYPE=release"

     

       39
       +
       -)

     

       40
       +
       -

     

       41
       +
       -set(JSONC_LIBRARIES

     

       42
       +
       -        ${CMAKE_EXTERNAL_OUTPUT_DIRECTORY}/lib/libjson-c.a

     

       43
       +
       -        bsd

     

       44
       +
       -)

     

       45
       +
       +find_package(PkgConfig REQUIRED)

     

       46
       +
       +pkg_check_modules(JSONC REQUIRED json-c)

     

       47
       +
       +include_directories(${JSONC_INCLUDE_DIRS})

     

       48
       +
        

     

       49
       +
        # ============ #

     

       50
       +
        # Curl library #

     

       51
       +
       @@ -408,7 +382,7 @@ add_subdirectory(docs)

     

       52
       +
        #endforeach()

     

       53
       +
        

     

       54
       +
        add_executable(ctune ${SOURCE_FILES})

     

       55
       +
       -add_dependencies(ctune ctune_logger libjsonc)

     

       56
       +
       +add_dependencies(ctune ctune_logger)

     

       57
       +
        include_directories(${CMAKE_EXTERNAL_OUTPUT_DIRECTORY}/include)

     

       58
       +
        

     

       59
       +
        add_dependencies(ctune ${CTUNE_PLUGIN_LIST_AUDIO_PLAYER})

+66

pkgs/by-name/ct/ctune/package.nix

···

       1
       +
       {

     

       2
       +
         stdenv,

     

       3
       +
         lib,

     

       4
       +
         fetchFromGitHub,

     

       5
       +
         openssl,

     

       6
       +
         curl,

     

       7
       +
         ffmpeg,

     

       8
       +
         vlc,

     

       9
       +
         SDL2,

     

       10
       +
         lame,

     

       11
       +
         json_c,

     

       12
       +
         cmake,

     

       13
       +
         pkg-config,

     

       14
       +
         ncurses,

     

       15
       +
         libuuid,

     

       16
       +
         pandoc,

     

       17
       +
       }:

     

       18
       +
       stdenv.mkDerivation (finalAttrs: {

     

       19
       +
         pname = "ctune";

     

       20
       +
         version = "1.3.2";

     

       21
       +
       

     

       22
       +
         src = fetchFromGitHub {

     

       23
       +
           owner = "An7ar35";

     

       24
       +
           repo = "ctune";

     

       25
       +
           rev = "refs/tags/v${finalAttrs.version}";

     

       26
       +
           hash = "sha256-fy7Wb4R6HDa+cLxI5YWq67gxw1XS/iDDN4M3Rn7GYeI=";

     

       27
       +
         };

     

       28
       +
       

     

       29
       +
         nativeBuildInputs = [

     

       30
       +
           cmake

     

       31
       +
           pkg-config

     

       32
       +
           pandoc

     

       33
       +
         ];

     

       34
       +
       

     

       35
       +
         buildInputs = [

     

       36
       +
           openssl

     

       37
       +
           curl

     

       38
       +
           ffmpeg

     

       39
       +
           vlc

     

       40
       +
           SDL2

     

       41
       +
           lame

     

       42
       +
           json_c

     

       43
       +
           ncurses

     

       44
       +
           libuuid

     

       45
       +
         ];

     

       46
       +
       

     

       47
       +
         strictDeps = true;

     

       48
       +
       

     

       49
       +
         cmakeFlags = [

     

       50
       +
           # Avoid a wrong nested install path location

     

       51
       +
           # Set to "$out" instead of "$out/$out"

     

       52
       +
           "-DCMAKE_INSTALL_PREFIX=''"

     

       53
       +
         ];

     

       54
       +
       

     

       55
       +
         patches = [ ./cmake_disable_git_clone.patch ];

     

       56
       +
       

     

       57
       +
         meta = {

     

       58
       +
           description = "A nice terminal nCurses (tui) internet radio player for Linux, browse and search from api.radio-browser.info";

     

       59
       +
           homepage = " https://github.com/An7ar35/ctune";

     

       60
       +
           changelog = "https://github.com/An7ar35/ctune/blob/master/CHANGELOG.md";

     

       61
       +
           license = lib.licenses.agpl3Plus;

     

       62
       +
           maintainers = with lib.maintainers; [ theobori ];

     

       63
       +
           mainProgram = "ctune";

     

       64
       +
           platforms = lib.platforms.linux;

     

       65
       +
         };

     

       66
       +
       })

+1 -1

pkgs/by-name/fa/facter/Gemfile.lock

···

       1
        
       GEM

     

       2
        
         remote: https://rubygems.org/

     

       3
        
         specs:

     

       4
       -
           facter (4.8.0)

     

       5
        
             hocon (~> 1.3)

     

       6
        
             thor (>= 1.0.1, < 1.3)

     

       7
        
           hocon (1.4.0)

···

       1
        
       GEM

     

       2
        
         remote: https://rubygems.org/

     

       3
        
         specs:

     

       4
       +
           facter (4.10.0)

     

       5
        
             hocon (~> 1.3)

     

       6
        
             thor (>= 1.0.1, < 1.3)

     

       7
        
           hocon (1.4.0)

+2 -2

pkgs/by-name/fa/facter/gemset.nix

···

       5
        
           platforms = [];

     

       6
        
           source = {

     

       7
        
             remotes = ["https://rubygems.org"];

     

       8
       -
             sha256 = "1130mzk90pi0y9fnraqqak7gcfg61dhx92axwnhchbpw09akfl09";

     

       9
        
             type = "gem";

     

       10
        
           };

     

       11
       -
           version = "4.8.0";

     

       12
        
         };

     

       13
        
         hocon = {

     

       14
        
           groups = ["default"];

···

       5
        
           platforms = [];

     

       6
        
           source = {

     

       7
        
             remotes = ["https://rubygems.org"];

     

       8
       +
             sha256 = "17d561xf4s5016fm9jkfkkafn6660g04fz1yp5xfvkb0j4xj32mp";

     

       9
        
             type = "gem";

     

       10
        
           };

     

       11
       +
           version = "4.10.0";

     

       12
        
         };

     

       13
        
         hocon = {

     

       14
        
           groups = ["default"];

+41

pkgs/by-name/he/hexyl/package.nix

···

       1
       +
       {

     

       2
       +
         lib,

     

       3
       +
         rustPlatform,

     

       4
       +
         fetchFromGitHub,

     

       5
       +
       }:

     

       6
       +
       

     

       7
       +
       rustPlatform.buildRustPackage rec {

     

       8
       +
         pname = "hexyl";

     

       9
       +
         version = "0.15.0";

     

       10
       +
       

     

       11
       +
         src = fetchFromGitHub {

     

       12
       +
           owner = "sharkdp";

     

       13
       +
           repo = "hexyl";

     

       14
       +
           rev = "refs/tags/v${version}";

     

       15
       +
           hash = "sha256-v/mB0W/AyoJSoK00pqxpfMGZR/4DkkTCnPU6eorl/GI=";

     

       16
       +
         };

     

       17
       +
       

     

       18
       +
         cargoHash = "sha256-QaOp7dCXfkIpxAJ+J+Pt9op3uj+LYoYvR78BmHBgnqE=";

     

       19
       +
       

     

       20
       +
         meta = {

     

       21
       +
           description = "Command-line hex viewer";

     

       22
       +
           longDescription = ''

     

       23
       +
             `hexyl` is a simple hex viewer for the terminal. It uses a colored

     

       24
       +
             output to distinguish different categories of bytes (NULL bytes,

     

       25
       +
             printable ASCII characters, ASCII whitespace characters, other ASCII

     

       26
       +
             characters and non-ASCII).

     

       27
       +
           '';

     

       28
       +
           homepage = "https://github.com/sharkdp/hexyl";

     

       29
       +
           changelog = "https://github.com/sharkdp/hexyl/blob/v${version}/CHANGELOG.md";

     

       30
       +
           license = with lib.licenses; [

     

       31
       +
             asl20

     

       32
       +
             mit

     

       33
       +
           ];

     

       34
       +
           maintainers = with lib.maintainers; [

     

       35
       +
             dywedir

     

       36
       +
             figsoda

     

       37
       +
             SuperSandro2000

     

       38
       +
           ];

     

       39
       +
           mainProgram = "hexyl";

     

       40
       +
         };

     

       41
       +
       }

pkgs/by-name/ma/matrix-hebbot/package.nix pkgs/by-name/he/hebbot/package.nix

+2 -2

pkgs/by-name/mu/mullvad-browser/package.nix

···

       90
        
             ++ lib.optionals mediaSupport [ ffmpeg ]

     

       91
        
         );

     

       92
        
       

     

       93
       -
         version = "13.5.7";

     

       94
        
       

     

       95
        
         sources = {

     

       96
        
           x86_64-linux = fetchurl {

     
···

       102
        
               "https://tor.eff.org/dist/mullvadbrowser/${version}/mullvad-browser-linux-x86_64-${version}.tar.xz"

     

       103
        
               "https://tor.calyxinstitute.org/dist/mullvadbrowser/${version}/mullvad-browser-linux-x86_64-${version}.tar.xz"

     

       104
        
             ];

     

       105
       -
             hash = "sha256-Te6Cw3fUs4XGz07lL54bKUU9HYC5soaKFlbWGujd/oU=";

     

       106
        
           };

     

       107
        
         };

     

       108

···

       90
        
             ++ lib.optionals mediaSupport [ ffmpeg ]

     

       91
        
         );

     

       92
        
       

     

       93
       +
         version = "13.5.9";

     

       94
        
       

     

       95
        
         sources = {

     

       96
        
           x86_64-linux = fetchurl {

     
···

       102
        
               "https://tor.eff.org/dist/mullvadbrowser/${version}/mullvad-browser-linux-x86_64-${version}.tar.xz"

     

       103
        
               "https://tor.calyxinstitute.org/dist/mullvadbrowser/${version}/mullvad-browser-linux-x86_64-${version}.tar.xz"

     

       104
        
             ];

     

       105
       +
             hash = "sha256-hyFYI42IfFY0vqkqInkLQAWSY8flsmWGN8CaXBwXbGA=";

     

       106
        
           };

     

       107
        
         };

     

       108

+6 -11

pkgs/by-name/or/orbiton/package.nix

···

       4
        
       

     

       5
        
       buildGoModule rec {

     

       6
        
         pname = "orbiton";

     

       7
       -
         version = "2.65.12";

     

       8
        
       

     

       9
        
         src = fetchFromGitHub {

     

       10
        
           owner = "xyproto";

     

       11
        
           repo = "orbiton";

     

       12
        
           rev = "v${version}";

     

       13
       -
           hash = "sha256-1KVw2dj//6vwUUj1jVWe2J/9F6J8BQsvCAEbJZnW26c=";

     

       14
        
         };

     

       15
        
       

     

       16
        
         vendorHash = null;

     

       17
        
       

     

       18
       -
         postPatch = lib.optionalString stdenv.hostPlatform.isDarwin ''

     

       19
       -
           substituteInPlace Makefile \

     

       20
       -
             --replace "-Wl,--as-needed" ""

     

       21
       -
       

     

       22
       -
           # Requires impure pbcopy and pbpaste

     

       23
       -
           substituteInPlace v2/pbcopy_test.go \

     

       24
       -
             --replace TestPBcopy SkipTestPBcopy

     

       25
       -
         '';

     

       26
       -
       

     

       27
        
         nativeBuildInputs = [ installShellFiles makeWrapper pkg-config ];

     

       28
        
       

     

       29
        
         buildInputs = lib.optional withGui vte;

     

       30
        
       

     

       31
        
         preBuild = "cd v2";

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       32
        
       

     

       33
        
         postInstall = ''

     

       34
        
           cd ..

···

       4
        
       

     

       5
        
       buildGoModule rec {

     

       6
        
         pname = "orbiton";

     

       7
       +
         version = "2.67.1";

     

       8
        
       

     

       9
        
         src = fetchFromGitHub {

     

       10
        
           owner = "xyproto";

     

       11
        
           repo = "orbiton";

     

       12
        
           rev = "v${version}";

     

       13
       +
           hash = "sha256-/5USD588kr3uB/Zs1ASKVgxH4kAWZCNBrZL7qqx49gU=";

     

       14
        
         };

     

       15
        
       

     

       16
        
         vendorHash = null;

     

       17
        
       

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       18
        
         nativeBuildInputs = [ installShellFiles makeWrapper pkg-config ];

     

       19
        
       

     

       20
        
         buildInputs = lib.optional withGui vte;

     

       21
        
       

     

       22
        
         preBuild = "cd v2";

     

       23
       +
       

     

       24
       +
         checkFlags = [

     

       25
       +
           "-skip=TestPBcopy" # Requires impure pbcopy and pbpaste

     

       26
       +
         ];

     

       27
        
       

     

       28
        
         postInstall = ''

     

       29
        
           cd ..

+1 -1

pkgs/by-name/pd/pdk/Gemfile

···

       1
        
       source 'https://rubygems.org'

     

       2
       -
       gem 'pdk', '3.2.0'

···

       1
        
       source 'https://rubygems.org'

     

       2
       +
       gem 'pdk', '3.3.0'

+17 -11

pkgs/by-name/pd/pdk/Gemfile.lock

···

       1
        
       GEM

     

       2
        
         remote: https://rubygems.org/

     

       3
        
         specs:

     

       4
       -
           addressable (2.8.6)

     

       5
       -
             public_suffix (>= 2.0.2, < 6.0)

     

       6
       -
           childprocess (4.1.0)

     

       7
       -
           cri (2.15.11)

     

       0
        
       
     

       8
        
           deep_merge (1.2.2)

     

       9
        
           diff-lcs (1.5.1)

     

       10
        
           ffi (1.17.0)

     

       11
        
           hitimes (2.0.0)

     

       12
       -
           json-schema (4.3.0)

     

       13
        
             addressable (>= 2.8)

     

       14
        
           json_pure (2.6.3)

     

       15
       -
           minitar (0.9)

     

       0
        
       
     

       16
        
           pastel (0.8.0)

     

       17
        
             tty-color (~> 0.5)

     

       18
        
           pathspec (1.1.3)

     

       19
       -
           pdk (3.2.0)

     

       20
        
             bundler (>= 2.1.0, < 3.0.0)

     

       21
       -
             childprocess (~> 4.1.0)

     

       22
        
             cri (~> 2.15.11)

     

       23
        
             deep_merge (~> 1.2.2)

     

       24
        
             diff-lcs (>= 1.5.0)

     
···

       28
        
             json_pure (~> 2.6.3)

     

       29
        
             minitar (~> 0.8)

     

       30
        
             pathspec (~> 1.1)

     

       0
        
       
     

       31
        
             tty-prompt (~> 0.23)

     

       32
        
             tty-spinner (~> 0.9)

     

       33
        
             tty-which (~> 0.5)

     

       34
       -
           public_suffix (5.0.5)

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       35
        
           tty-color (0.6.0)

     

       36
        
           tty-cursor (0.7.1)

     

       37
        
           tty-prompt (0.23.1)

     
···

       51
        
         ruby

     

       52
        
       

     

       53
        
       DEPENDENCIES

     

       54
       -
         pdk (= 3.2.0)

     

       55
        
       

     

       56
        
       BUNDLED WITH

     

       57
       -
          2.5.9

···

       1
        
       GEM

     

       2
        
         remote: https://rubygems.org/

     

       3
        
         specs:

     

       4
       +
           addressable (2.8.7)

     

       5
       +
             public_suffix (>= 2.0.2, < 7.0)

     

       6
       +
           childprocess (5.1.0)

     

       7
       +
             logger (~> 1.5)

     

       8
       +
           cri (2.15.12)

     

       9
        
           deep_merge (1.2.2)

     

       10
        
           diff-lcs (1.5.1)

     

       11
        
           ffi (1.17.0)

     

       12
        
           hitimes (2.0.0)

     

       13
       +
           json-schema (4.3.1)

     

       14
        
             addressable (>= 2.8)

     

       15
        
           json_pure (2.6.3)

     

       16
       +
           logger (1.6.1)

     

       17
       +
           minitar (0.12.1)

     

       18
        
           pastel (0.8.0)

     

       19
        
             tty-color (~> 0.5)

     

       20
        
           pathspec (1.1.3)

     

       21
       +
           pdk (3.3.0)

     

       22
        
             bundler (>= 2.1.0, < 3.0.0)

     

       23
       +
             childprocess (~> 5.0)

     

       24
        
             cri (~> 2.15.11)

     

       25
        
             deep_merge (~> 1.2.2)

     

       26
        
             diff-lcs (>= 1.5.0)

     
···

       30
        
             json_pure (~> 2.6.3)

     

       31
        
             minitar (~> 0.8)

     

       32
        
             pathspec (~> 1.1)

     

       33
       +
             puppet-modulebuilder (~> 1.0)

     

       34
        
             tty-prompt (~> 0.23)

     

       35
        
             tty-spinner (~> 0.9)

     

       36
        
             tty-which (~> 0.5)

     

       37
       +
           public_suffix (6.0.1)

     

       38
       +
           puppet-modulebuilder (1.1.0)

     

       39
       +
             minitar (~> 0.9)

     

       40
       +
             pathspec (>= 0.2.1, < 3.0.0)

     

       41
        
           tty-color (0.6.0)

     

       42
        
           tty-cursor (0.7.1)

     

       43
        
           tty-prompt (0.23.1)

     
···

       57
        
         ruby

     

       58
        
       

     

       59
        
       DEPENDENCIES

     

       60
       +
         pdk (= 3.3.0)

     

       61
        
       

     

       62
        
       BUNDLED WITH

     

       63
       +
          2.5.16

+37 -15

pkgs/by-name/pd/pdk/gemset.nix

···

       5
        
           platforms = [];

     

       6
        
           source = {

     

       7
        
             remotes = ["https://rubygems.org"];

     

       8
       -
             sha256 = "0irbdwkkjwzajq1ip6ba46q49sxnrl2cw7ddkdhsfhb6aprnm3vr";

     

       9
        
             type = "gem";

     

       10
        
           };

     

       11
       -
           version = "2.8.6";

     

       12
        
         };

     

       13
        
         childprocess = {

     

       0
        
       
     

       14
        
           groups = ["default"];

     

       15
        
           platforms = [];

     

       16
        
           source = {

     

       17
        
             remotes = ["https://rubygems.org"];

     

       18
       -
             sha256 = "1lvcp8bsd35g57f7wz4jigcw2sryzzwrpcgjwwf3chmjrjcww5in";

     

       19
        
             type = "gem";

     

       20
        
           };

     

       21
       -
           version = "4.1.0";

     

       22
        
         };

     

       23
        
         cri = {

     

       24
        
           groups = ["default"];

     

       25
        
           platforms = [];

     

       26
        
           source = {

     

       27
        
             remotes = ["https://rubygems.org"];

     

       28
       -
             sha256 = "1bhsgnjav94mz5vf3305gxz1g34gm9kxvnrn1dkz530r8bpj0hr5";

     

       29
        
             type = "gem";

     

       30
        
           };

     

       31
       -
           version = "2.15.11";

     

       32
        
         };

     

       33
        
         deep_merge = {

     

       34
        
           groups = ["default"];

     
···

       76
        
           platforms = [];

     

       77
        
           source = {

     

       78
        
             remotes = ["https://rubygems.org"];

     

       79
       -
             sha256 = "1ljqbpjc5aa8a2cgq8f64iwbx7rr9dqvpk7v8n5jpslyz6mvyddc";

     

       80
        
             type = "gem";

     

       81
        
           };

     

       82
       -
           version = "4.3.0";

     

       83
        
         };

     

       84
        
         json_pure = {

     

       85
        
           groups = ["default"];

     
···

       91
        
           };

     

       92
        
           version = "2.6.3";

     

       93
        
         };

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       94
        
         minitar = {

     

       95
        
           groups = ["default"];

     

       96
        
           platforms = [];

     

       97
        
           source = {

     

       98
        
             remotes = ["https://rubygems.org"];

     

       99
       -
             sha256 = "126mq86x67d1p63acrfka4zx0cx2r0vc93884jggxnrmmnzbxh13";

     

       100
        
             type = "gem";

     

       101
        
           };

     

       102
       -
           version = "0.9";

     

       103
        
         };

     

       104
        
         pastel = {

     

       105
        
           dependencies = ["tty-color"];

     
···

       123
        
           version = "1.1.3";

     

       124
        
         };

     

       125
        
         pdk = {

     

       126
       -
           dependencies = ["childprocess" "cri" "deep_merge" "diff-lcs" "ffi" "hitimes" "json-schema" "json_pure" "minitar" "pathspec" "tty-prompt" "tty-spinner" "tty-which"];

     

       127
        
           groups = ["default"];

     

       128
        
           platforms = [];

     

       129
        
           source = {

     

       130
        
             remotes = ["https://rubygems.org"];

     

       131
       -
             sha256 = "1avc2dgcdi9l6xam9crka790jhpx04536387f1vq2p9yqpr5lw7h";

     

       132
        
             type = "gem";

     

       133
        
           };

     

       134
       -
           version = "3.2.0";

     

       135
        
         };

     

       136
        
         public_suffix = {

     

       137
        
           groups = ["default"];

     

       138
        
           platforms = [];

     

       139
        
           source = {

     

       140
        
             remotes = ["https://rubygems.org"];

     

       141
       -
             sha256 = "14y4vzjwf5gp0mqgs880kis0k7n2biq8i6ci6q2n315kichl1hvj";

     

       142
        
             type = "gem";

     

       143
        
           };

     

       144
       -
           version = "5.0.5";

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       145
        
         };

     

       146
        
         tty-color = {

     

       147
        
           groups = ["default"];

···

       5
        
           platforms = [];

     

       6
        
           source = {

     

       7
        
             remotes = ["https://rubygems.org"];

     

       8
       +
             sha256 = "0cl2qpvwiffym62z991ynks7imsm87qmgxf0yfsmlwzkgi9qcaa6";

     

       9
        
             type = "gem";

     

       10
        
           };

     

       11
       +
           version = "2.8.7";

     

       12
        
         };

     

       13
        
         childprocess = {

     

       14
       +
           dependencies = ["logger"];

     

       15
        
           groups = ["default"];

     

       16
        
           platforms = [];

     

       17
        
           source = {

     

       18
        
             remotes = ["https://rubygems.org"];

     

       19
       +
             sha256 = "1v5nalaarxnfdm6rxb7q6fmc6nx097jd630ax6h9ch7xw95li3cs";

     

       20
        
             type = "gem";

     

       21
        
           };

     

       22
       +
           version = "5.1.0";

     

       23
        
         };

     

       24
        
         cri = {

     

       25
        
           groups = ["default"];

     

       26
        
           platforms = [];

     

       27
        
           source = {

     

       28
        
             remotes = ["https://rubygems.org"];

     

       29
       +
             sha256 = "1rank6i9p2drwdcmhan6ifkzrz1v3mwpx47fwjl75rskxwjfkgwa";

     

       30
        
             type = "gem";

     

       31
        
           };

     

       32
       +
           version = "2.15.12";

     

       33
        
         };

     

       34
        
         deep_merge = {

     

       35
        
           groups = ["default"];

     
···

       77
        
           platforms = [];

     

       78
        
           source = {

     

       79
        
             remotes = ["https://rubygems.org"];

     

       80
       +
             sha256 = "09bq393nrxa7hmphc3li8idgxdnb5hwgj15d0q5qsh4l5g1qvrnm";

     

       81
        
             type = "gem";

     

       82
        
           };

     

       83
       +
           version = "4.3.1";

     

       84
        
         };

     

       85
        
         json_pure = {

     

       86
        
           groups = ["default"];

     
···

       92
        
           };

     

       93
        
           version = "2.6.3";

     

       94
        
         };

     

       95
       +
         logger = {

     

       96
       +
           groups = ["default"];

     

       97
       +
           platforms = [];

     

       98
       +
           source = {

     

       99
       +
             remotes = ["https://rubygems.org"];

     

       100
       +
             sha256 = "0lwncq2rf8gm79g2rcnnyzs26ma1f4wnfjm6gs4zf2wlsdz5in9s";

     

       101
       +
             type = "gem";

     

       102
       +
           };

     

       103
       +
           version = "1.6.1";

     

       104
       +
         };

     

       105
        
         minitar = {

     

       106
        
           groups = ["default"];

     

       107
        
           platforms = [];

     

       108
        
           source = {

     

       109
        
             remotes = ["https://rubygems.org"];

     

       110
       +
             sha256 = "0f307mpj4j0gp7iq77xj4p149f4krcvbll9rismng3jcijpbn79s";

     

       111
        
             type = "gem";

     

       112
        
           };

     

       113
       +
           version = "0.12.1";

     

       114
        
         };

     

       115
        
         pastel = {

     

       116
        
           dependencies = ["tty-color"];

     
···

       134
        
           version = "1.1.3";

     

       135
        
         };

     

       136
        
         pdk = {

     

       137
       +
           dependencies = ["childprocess" "cri" "deep_merge" "diff-lcs" "ffi" "hitimes" "json-schema" "json_pure" "minitar" "pathspec" "puppet-modulebuilder" "tty-prompt" "tty-spinner" "tty-which"];

     

       138
        
           groups = ["default"];

     

       139
        
           platforms = [];

     

       140
        
           source = {

     

       141
        
             remotes = ["https://rubygems.org"];

     

       142
       +
             sha256 = "1gildcnii3ayw585as8d8bqhnfb9diqg7n3vmgaz8c5b9wb8c106";

     

       143
        
             type = "gem";

     

       144
        
           };

     

       145
       +
           version = "3.3.0";

     

       146
        
         };

     

       147
        
         public_suffix = {

     

       148
        
           groups = ["default"];

     

       149
        
           platforms = [];

     

       150
        
           source = {

     

       151
        
             remotes = ["https://rubygems.org"];

     

       152
       +
             sha256 = "0vqcw3iwby3yc6avs1vb3gfd0vcp2v7q310665dvxfswmcf4xm31";

     

       153
        
             type = "gem";

     

       154
        
           };

     

       155
       +
           version = "6.0.1";

     

       156
       +
         };

     

       157
       +
         puppet-modulebuilder = {

     

       158
       +
           dependencies = ["minitar" "pathspec"];

     

       159
       +
           groups = ["default"];

     

       160
       +
           platforms = [];

     

       161
       +
           source = {

     

       162
       +
             remotes = ["https://rubygems.org"];

     

       163
       +
             sha256 = "0rh31hq24nkddd83cx7n9ln5bsib3a052hrmn120sq0937337173";

     

       164
       +
             type = "gem";

     

       165
       +
           };

     

       166
       +
           version = "1.1.0";

     

       167
        
         };

     

       168
        
         tty-color = {

     

       169
        
           groups = ["default"];

+137

pkgs/by-name/po/positron-bin/package.nix

···

       1
       +
       {

     

       2
       +
         lib,

     

       3
       +
         _7zz,

     

       4
       +
         alsa-lib,

     

       5
       +
         systemd,

     

       6
       +
         autoPatchelfHook,

     

       7
       +
         blas,

     

       8
       +
         dpkg,

     

       9
       +
         fetchurl,

     

       10
       +
         gtk3,

     

       11
       +
         libglvnd,

     

       12
       +
         libxkbcommon,

     

       13
       +
         makeShellWrapper,

     

       14
       +
         mesa,

     

       15
       +
         musl,

     

       16
       +
         nss,

     

       17
       +
         patchelf,

     

       18
       +
         stdenv,

     

       19
       +
         xorg,

     

       20
       +
       }:

     

       21
       +
       let

     

       22
       +
         pname = "positron-bin";

     

       23
       +
         version = "2024.11.0-116";

     

       24
       +
       in

     

       25
       +
       stdenv.mkDerivation {

     

       26
       +
         inherit version pname;

     

       27
       +
       

     

       28
       +
         src =

     

       29
       +
           if stdenv.isDarwin then

     

       30
       +
             fetchurl {

     

       31
       +
               url = "https://github.com/posit-dev/positron/releases/download/${version}/Positron-${version}.dmg";

     

       32
       +
               hash = "sha256-5Ym42InDgFLGdZk0LYV1H0eC5WzmsYToG1KLdiGgTto=";

     

       33
       +
             }

     

       34
       +
           else

     

       35
       +
             fetchurl {

     

       36
       +
               url = "https://github.com/posit-dev/positron/releases/download/${version}/Positron-${version}.deb";

     

       37
       +
               hash = "sha256-pE25XVYFW8WwyQ7zmox2mmXy6ZCSaXk2gSnPimg7xtU=";

     

       38
       +
             };

     

       39
       +
       

     

       40
       +
         buildInputs =

     

       41
       +
           [ makeShellWrapper ]

     

       42
       +
           ++ lib.optionals stdenv.hostPlatform.isLinux [

     

       43
       +
             alsa-lib

     

       44
       +
             dpkg

     

       45
       +
             gtk3

     

       46
       +
             libglvnd

     

       47
       +
             libxkbcommon

     

       48
       +
             mesa

     

       49
       +
             musl

     

       50
       +
             nss

     

       51
       +
             stdenv.cc.cc

     

       52
       +
             xorg.libX11

     

       53
       +
             xorg.libXcomposite

     

       54
       +
             xorg.libXdamage

     

       55
       +
             xorg.libxkbfile

     

       56
       +
           ]

     

       57
       +
           ++ lib.optionals stdenv.hostPlatform.isDarwin [

     

       58
       +
             blas

     

       59
       +
             patchelf

     

       60
       +
           ];

     

       61
       +
       

     

       62
       +
         nativeBuildInputs =

     

       63
       +
           lib.optionals stdenv.hostPlatform.isLinux [

     

       64
       +
             autoPatchelfHook

     

       65
       +
           ]

     

       66
       +
           ++ lib.optionals stdenv.hostPlatform.isDarwin [

     

       67
       +
             _7zz

     

       68
       +
           ];

     

       69
       +
       

     

       70
       +
         runtimeDependencies = lib.optionals stdenv.hostPlatform.isLinux [

     

       71
       +
           # Needed to fix the "Zygote could not fork" error.

     

       72
       +
           (lib.getLib systemd)

     

       73
       +
         ];

     

       74
       +
       

     

       75
       +
         unpackPhase = ''

     

       76
       +
           runHook preUnpack

     

       77
       +
           ${lib.optionalString stdenv.hostPlatform.isLinux ''dpkg-deb --fsys-tarfile "$src" | tar -x --no-same-owner''}

     

       78
       +
           runHook postUnpack

     

       79
       +
         '';

     

       80
       +
       

     

       81
       +
         installPhase =

     

       82
       +
           if stdenv.hostPlatform.isDarwin then

     

       83
       +
             ''

     

       84
       +
               runHook preInstall

     

       85
       +
               mkdir -p "$out/Applications" "$out/bin"

     

       86
       +
               cp -r . "$out/Applications/Positron.app"

     

       87
       +
       

     

       88
       +
               # Positron will use the system version of BLAS if we don't provide the nix version.

     

       89
       +
               wrapProgram "$out/Applications/Positron.app/Contents/Resources/app/bin/code" \

     

       90
       +
                 --prefix DYLD_INSERT_LIBRARIES : "${lib.makeLibraryPath [ blas ]}/libblas.dylib"

     

       91
       +
       

     

       92
       +
               ln -s "$out/Applications/Positron.app/Contents/Resources/app/bin/code" "$out/bin/positron"

     

       93
       +
               runHook postInstall

     

       94
       +
             ''

     

       95
       +
           else

     

       96
       +
             ''

     

       97
       +
               runHook preInstall

     

       98
       +
               mkdir -p "$out/share"

     

       99
       +
               cp -r usr/share/pixmaps "$out/share/pixmaps"

     

       100
       +
               cp -r usr/share/positron "$out/share/positron"

     

       101
       +
       

     

       102
       +
               mkdir -p "$out/share/applications"

     

       103
       +
               install -m 444 -D usr/share/applications/positron.desktop "$out/share/applications/positron.desktop"

     

       104
       +
               substituteInPlace "$out/share/applications/positron.desktop" \

     

       105
       +
                 --replace-fail \

     

       106
       +
                 "Icon=com.visualstudio.code.oss" \

     

       107
       +
                 "Icon=$out/share/pixmaps/com.visualstudio.code.oss.png" \

     

       108
       +
                 --replace-fail \

     

       109
       +
                 "Exec=/usr/share/positron/positron %F" \

     

       110
       +
                 "Exec=$out/share/positron/.positron-wrapped %F" \

     

       111
       +
                 --replace-fail \

     

       112
       +
                 "/usr/share/positron/positron --new-window %F" \

     

       113
       +
                 "$out/share/positron/.positron-wrapped --new-window %F"

     

       114
       +
       

     

       115
       +
               # Fix libGL.so not found errors.

     

       116
       +
               wrapProgram "$out/share/positron/positron" \

     

       117
       +
                 --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ libglvnd ]}"

     

       118
       +
       

     

       119
       +
               mkdir -p "$out/bin"

     

       120
       +
               ln -s "$out/share/positron/positron" "$out/bin/positron"

     

       121
       +
               runHook postInstall

     

       122
       +
             '';

     

       123
       +
       

     

       124
       +
         passthru.updateScript = ./update.sh;

     

       125
       +
       

     

       126
       +
         meta = with lib; {

     

       127
       +
           description = "Positron, a next-generation data science IDE";

     

       128
       +
           homepage = "https://github.com/posit-dev/positron";

     

       129
       +
           license = licenses.elastic20;

     

       130
       +
           maintainers = with maintainers; [

     

       131
       +
             b-rodrigues

     

       132
       +
             detroyejr

     

       133
       +
           ];

     

       134
       +
           mainProgram = "positron";

     

       135
       +
           platforms = [ "x86_64-linux" ] ++ platforms.darwin;

     

       136
       +
         };

     

       137
       +
       }

+54

pkgs/by-name/po/positron-bin/update.sh

···

       1
       +
       #!/usr/bin/env nix-shell

     

       2
       +
       #! nix-shell -i bash -p curl jq git

     

       3
       +
       

     

       4
       +
       nixpkgs="$(git rev-parse --show-toplevel)"

     

       5
       +
       positron_nix="$nixpkgs/pkgs/by-name/po/positron-bin/package.nix"

     

       6
       +
       

     

       7
       +
       current_version=$(grep -oP "version = \"\K.*\d" $positron_nix)

     

       8
       +
       new_version=$(curl -sSfL \

     

       9
       +
         -H "Accept: application/vnd.github+json" \

     

       10
       +
         -H "X-GitHub-Api-Version: 2022-11-28" \

     

       11
       +
         "https://api.github.com/repos/posit-dev/positron/releases?per_page=1" \

     

       12
       +
         | jq -r '.[0].name')

     

       13
       +
       

     

       14
       +
       if [[ "$new_version" == "$current_version" ]]; then

     

       15
       +
           echo 'Positron is already up to date'

     

       16
       +
           exit 0;

     

       17
       +
       fi

     

       18
       +
       

     

       19
       +
       # Update Darwin hash.

     

       20
       +
       current_hash=$(nix store prefetch-file --json --hash-type sha256 \

     

       21
       +
           "https://github.com/posit-dev/positron/releases/download/${current_version}/Positron-${current_version}.dmg" \

     

       22
       +
           | jq -r .hash)

     

       23
       +
       

     

       24
       +
       new_hash=$(nix store prefetch-file --json --hash-type sha256 \

     

       25
       +
           "https://github.com/posit-dev/positron/releases/download/${new_version}/Positron-${new_version}.dmg" \

     

       26
       +
           | jq -r .hash)

     

       27
       +
       

     

       28
       +
       sed -i "s|$current_hash|$new_hash|g" $positron_nix

     

       29
       +
       

     

       30
       +
       # Update Linux hash.

     

       31
       +
       current_hash=$(nix store prefetch-file --json --hash-type sha256 \

     

       32
       +
           "https://github.com/posit-dev/positron/releases/download/${current_version}/Positron-${current_version}.deb" \

     

       33
       +
           | jq -r .hash)

     

       34
       +
       

     

       35
       +
       new_hash=$(nix store prefetch-file --json --hash-type sha256 \

     

       36
       +
           "https://github.com/posit-dev/positron/releases/download/${new_version}/Positron-${new_version}.deb" \

     

       37
       +
           | jq -r .hash)

     

       38
       +
       

     

       39
       +
       sed -i "s|$current_hash|$new_hash|g" $positron_nix

     

       40
       +
       

     

       41
       +
       # Update version

     

       42
       +
       sed -i "s|$current_version|$new_version|g" $positron_nix

     

       43
       +
       

     

       44
       +
       # Attempt to build.

     

       45
       +
       export NIXPKGS_ALLOW_UNFREE=1

     

       46
       +
       

     

       47
       +
       if ! nix-build -A positron-bin "$nixpkgs"; then

     

       48
       +
         echo "The updated positron-bin failed to build."

     

       49
       +
         exit 1

     

       50
       +
       fi

     

       51
       +
       

     

       52
       +
       # Commit changes

     

       53
       +
       git add "$positron_nix"

     

       54
       +
       git commit -m "positron-bin: ${current_version} -> ${new_version}"

+3 -3

pkgs/by-name/si/simple64-netplay-server/package.nix

···

       6
        
       

     

       7
        
       buildGoModule rec {

     

       8
        
         pname = "simple64-netplay-server";

     

       9
       -
         version = "2024.06.1";

     

       10
        
       

     

       11
        
         src = fetchFromGitHub {

     

       12
        
           owner = "simple64";

     

       13
        
           repo = "simple64-netplay-server";

     

       14
        
           rev = "refs/tags/v${version}";

     

       15
       -
           hash = "sha256-WTEtTzRkXuIusfK6Nbj1aLwXcXyaXQi+j3SsDrvtLKo=";

     

       16
        
         };

     

       17
        
       

     

       18
       -
         vendorHash = "sha256-zfLSti368rBHj17HKDZKtOQQrhVGVa2CaieaDGHcZOk=";

     

       19
        
       

     

       20
        
         meta = {

     

       21
        
           description = "Dedicated server for simple64 netplay";

···

       6
        
       

     

       7
        
       buildGoModule rec {

     

       8
        
         pname = "simple64-netplay-server";

     

       9
       +
         version = "2024.10.1";

     

       10
        
       

     

       11
        
         src = fetchFromGitHub {

     

       12
        
           owner = "simple64";

     

       13
        
           repo = "simple64-netplay-server";

     

       14
        
           rev = "refs/tags/v${version}";

     

       15
       +
           hash = "sha256-p9hHVf1LD95w280ScUkxHKmBJLJ9eiH3WEYV+kaALgQ=";

     

       16
        
         };

     

       17
        
       

     

       18
       +
         vendorHash = "sha256-HeYA/nR0NuP/fPMJXGGuN2eP6vB4yj1yWFfFDyp34QE=";

     

       19
        
       

     

       20
        
         meta = {

     

       21
        
           description = "Dedicated server for simple64 netplay";

+20 -27

pkgs/by-name/sy/syncstorage-rs/Cargo.lock

···

       2458
        
       [[package]]

     

       2459
        
       name = "sentry"

     

       2460
        
       version = "0.34.0"

     

       2461
       -
       source = "registry+https://github.com/rust-lang/crates.io-index"

     

       2462
       -
       checksum = "5484316556650182f03b43d4c746ce0e3e48074a21e2f51244b648b6542e1066"

     

       2463
        
       dependencies = [

     

       2464
        
        "curl",

     

       2465
        
        "httpdate",

     
···

       2473
        
       [[package]]

     

       2474
        
       name = "sentry-backtrace"

     

       2475
        
       version = "0.34.0"

     

       2476
       -
       source = "registry+https://github.com/rust-lang/crates.io-index"

     

       2477
       -
       checksum = "40aa225bb41e2ec9d7c90886834367f560efc1af028f1c5478a6cce6a59c463a"

     

       2478
        
       dependencies = [

     

       2479
        
        "backtrace",

     

       2480
        
        "once_cell",

     
···

       2485
        
       [[package]]

     

       2486
        
       name = "sentry-contexts"

     

       2487
        
       version = "0.34.0"

     

       2488
       -
       source = "registry+https://github.com/rust-lang/crates.io-index"

     

       2489
       -
       checksum = "1a8dd746da3d16cb8c39751619cefd4fcdbd6df9610f3310fd646b55f6e39910"

     

       2490
        
       dependencies = [

     

       2491
        
        "hostname",

     

       2492
        
        "libc",

     
···

       2499
        
       [[package]]

     

       2500
        
       name = "sentry-core"

     

       2501
        
       version = "0.34.0"

     

       2502
       -
       source = "registry+https://github.com/rust-lang/crates.io-index"

     

       2503
       -
       checksum = "161283cfe8e99c8f6f236a402b9ccf726b201f365988b5bb637ebca0abbd4a30"

     

       2504
        
       dependencies = [

     

       2505
        
        "once_cell",

     

       2506
        
        "rand",

     
···

       2512
        
       [[package]]

     

       2513
        
       name = "sentry-debug-images"

     

       2514
        
       version = "0.34.0"

     

       2515
       -
       source = "registry+https://github.com/rust-lang/crates.io-index"

     

       2516
       -
       checksum = "8fc6b25e945fcaa5e97c43faee0267eebda9f18d4b09a251775d8fef1086238a"

     

       2517
        
       dependencies = [

     

       2518
        
        "findshlibs",

     

       2519
        
        "once_cell",

     
···

       2523
        
       [[package]]

     

       2524
        
       name = "sentry-tracing"

     

       2525
        
       version = "0.34.0"

     

       2526
       -
       source = "registry+https://github.com/rust-lang/crates.io-index"

     

       2527
       -
       checksum = "cd3c5faf2103cd01eeda779ea439b68c4ee15adcdb16600836e97feafab362ec"

     

       2528
        
       dependencies = [

     

       2529
        
        "sentry-backtrace",

     

       2530
        
        "sentry-core",

     
···

       2535
        
       [[package]]

     

       2536
        
       name = "sentry-types"

     

       2537
        
       version = "0.34.0"

     

       2538
       -
       source = "registry+https://github.com/rust-lang/crates.io-index"

     

       2539
       -
       checksum = "5d68cdf6bc41b8ff3ae2a9c4671e97426dcdd154cc1d4b6b72813f285d6b163f"

     

       2540
        
       dependencies = [

     

       2541
        
        "debugid",

     

       2542
        
        "hex",

     
···

       2827
        
       

     

       2828
        
       [[package]]

     

       2829
        
       name = "syncserver"

     

       2830
       -
       version = "0.17.9"

     

       2831
        
       dependencies = [

     

       2832
        
        "actix-cors",

     

       2833
        
        "actix-http",

     
···

       2882
        
       

     

       2883
        
       [[package]]

     

       2884
        
       name = "syncserver-common"

     

       2885
       -
       version = "0.17.9"

     

       2886
        
       dependencies = [

     

       2887
        
        "actix-web",

     

       2888
        
        "backtrace",

     
···

       2902
        
       

     

       2903
        
       [[package]]

     

       2904
        
       name = "syncserver-db-common"

     

       2905
       -
       version = "0.17.9"

     

       2906
        
       dependencies = [

     

       2907
        
        "backtrace",

     

       2908
        
        "deadpool",

     
···

       2916
        
       

     

       2917
        
       [[package]]

     

       2918
        
       name = "syncserver-settings"

     

       2919
       -
       version = "0.17.9"

     

       2920
        
       dependencies = [

     

       2921
        
        "config 0.11.0",

     

       2922
        
        "num_cpus",

     
···

       2930
        
       

     

       2931
        
       [[package]]

     

       2932
        
       name = "syncstorage-db"

     

       2933
       -
       version = "0.17.9"

     

       2934
        
       dependencies = [

     

       2935
        
        "async-trait",

     

       2936
        
        "cadence",

     
···

       2953
        
       

     

       2954
        
       [[package]]

     

       2955
        
       name = "syncstorage-db-common"

     

       2956
       -
       version = "0.17.9"

     

       2957
        
       dependencies = [

     

       2958
        
        "async-trait",

     

       2959
        
        "backtrace",

     
···

       2972
        
       

     

       2973
        
       [[package]]

     

       2974
        
       name = "syncstorage-mysql"

     

       2975
       -
       version = "0.17.9"

     

       2976
        
       dependencies = [

     

       2977
        
        "async-trait",

     

       2978
        
        "backtrace",

     
···

       2995
        
       

     

       2996
        
       [[package]]

     

       2997
        
       name = "syncstorage-settings"

     

       2998
       -
       version = "0.17.9"

     

       2999
        
       dependencies = [

     

       3000
        
        "rand",

     

       3001
        
        "serde 1.0.203",

     
···

       3005
        
       

     

       3006
        
       [[package]]

     

       3007
        
       name = "syncstorage-spanner"

     

       3008
       -
       version = "0.17.9"

     

       3009
        
       dependencies = [

     

       3010
        
        "async-trait",

     

       3011
        
        "backtrace",

     
···

       3149
        
       

     

       3150
        
       [[package]]

     

       3151
        
       name = "tokenserver-auth"

     

       3152
       -
       version = "0.17.9"

     

       3153
        
       dependencies = [

     

       3154
        
        "async-trait",

     

       3155
        
        "base64 0.22.1",

     
···

       3176
        
       

     

       3177
        
       [[package]]

     

       3178
        
       name = "tokenserver-common"

     

       3179
       -
       version = "0.17.9"

     

       3180
        
       dependencies = [

     

       3181
        
        "actix-web",

     

       3182
        
        "backtrace",

     
···

       3191
        
       

     

       3192
        
       [[package]]

     

       3193
        
       name = "tokenserver-db"

     

       3194
       -
       version = "0.17.9"

     

       3195
        
       dependencies = [

     

       3196
        
        "async-trait",

     

       3197
        
        "backtrace",

     
···

       3216
        
       

     

       3217
        
       [[package]]

     

       3218
        
       name = "tokenserver-settings"

     

       3219
       -
       version = "0.17.9"

     

       3220
        
       dependencies = [

     

       3221
        
        "jsonwebtoken",

     

       3222
        
        "serde 1.0.203",

···

       2458
        
       [[package]]

     

       2459
        
       name = "sentry"

     

       2460
        
       version = "0.34.0"

     

       2461
       +
       source = "git+https://github.com/getsentry/sentry-rust?rev=1b65b5c#1b65b5c99af975496880e7325218479e0037d097"

     

       0
        
       
     

       2462
        
       dependencies = [

     

       2463
        
        "curl",

     

       2464
        
        "httpdate",

     
···

       2472
        
       [[package]]

     

       2473
        
       name = "sentry-backtrace"

     

       2474
        
       version = "0.34.0"

     

       2475
       +
       source = "git+https://github.com/getsentry/sentry-rust?rev=1b65b5c#1b65b5c99af975496880e7325218479e0037d097"

     

       0
        
       
     

       2476
        
       dependencies = [

     

       2477
        
        "backtrace",

     

       2478
        
        "once_cell",

     
···

       2483
        
       [[package]]

     

       2484
        
       name = "sentry-contexts"

     

       2485
        
       version = "0.34.0"

     

       2486
       +
       source = "git+https://github.com/getsentry/sentry-rust?rev=1b65b5c#1b65b5c99af975496880e7325218479e0037d097"

     

       0
        
       
     

       2487
        
       dependencies = [

     

       2488
        
        "hostname",

     

       2489
        
        "libc",

     
···

       2496
        
       [[package]]

     

       2497
        
       name = "sentry-core"

     

       2498
        
       version = "0.34.0"

     

       2499
       +
       source = "git+https://github.com/getsentry/sentry-rust?rev=1b65b5c#1b65b5c99af975496880e7325218479e0037d097"

     

       0
        
       
     

       2500
        
       dependencies = [

     

       2501
        
        "once_cell",

     

       2502
        
        "rand",

     
···

       2508
        
       [[package]]

     

       2509
        
       name = "sentry-debug-images"

     

       2510
        
       version = "0.34.0"

     

       2511
       +
       source = "git+https://github.com/getsentry/sentry-rust?rev=1b65b5c#1b65b5c99af975496880e7325218479e0037d097"

     

       0
        
       
     

       2512
        
       dependencies = [

     

       2513
        
        "findshlibs",

     

       2514
        
        "once_cell",

     
···

       2518
        
       [[package]]

     

       2519
        
       name = "sentry-tracing"

     

       2520
        
       version = "0.34.0"

     

       2521
       +
       source = "git+https://github.com/getsentry/sentry-rust?rev=1b65b5c#1b65b5c99af975496880e7325218479e0037d097"

     

       0
        
       
     

       2522
        
       dependencies = [

     

       2523
        
        "sentry-backtrace",

     

       2524
        
        "sentry-core",

     
···

       2529
        
       [[package]]

     

       2530
        
       name = "sentry-types"

     

       2531
        
       version = "0.34.0"

     

       2532
       +
       source = "git+https://github.com/getsentry/sentry-rust?rev=1b65b5c#1b65b5c99af975496880e7325218479e0037d097"

     

       0
        
       
     

       2533
        
       dependencies = [

     

       2534
        
        "debugid",

     

       2535
        
        "hex",

     
···

       2820
        
       

     

       2821
        
       [[package]]

     

       2822
        
       name = "syncserver"

     

       2823
       +
       version = "0.17.12"

     

       2824
        
       dependencies = [

     

       2825
        
        "actix-cors",

     

       2826
        
        "actix-http",

     
···

       2875
        
       

     

       2876
        
       [[package]]

     

       2877
        
       name = "syncserver-common"

     

       2878
       +
       version = "0.17.12"

     

       2879
        
       dependencies = [

     

       2880
        
        "actix-web",

     

       2881
        
        "backtrace",

     
···

       2895
        
       

     

       2896
        
       [[package]]

     

       2897
        
       name = "syncserver-db-common"

     

       2898
       +
       version = "0.17.12"

     

       2899
        
       dependencies = [

     

       2900
        
        "backtrace",

     

       2901
        
        "deadpool",

     
···

       2909
        
       

     

       2910
        
       [[package]]

     

       2911
        
       name = "syncserver-settings"

     

       2912
       +
       version = "0.17.12"

     

       2913
        
       dependencies = [

     

       2914
        
        "config 0.11.0",

     

       2915
        
        "num_cpus",

     
···

       2923
        
       

     

       2924
        
       [[package]]

     

       2925
        
       name = "syncstorage-db"

     

       2926
       +
       version = "0.17.12"

     

       2927
        
       dependencies = [

     

       2928
        
        "async-trait",

     

       2929
        
        "cadence",

     
···

       2946
        
       

     

       2947
        
       [[package]]

     

       2948
        
       name = "syncstorage-db-common"

     

       2949
       +
       version = "0.17.12"

     

       2950
        
       dependencies = [

     

       2951
        
        "async-trait",

     

       2952
        
        "backtrace",

     
···

       2965
        
       

     

       2966
        
       [[package]]

     

       2967
        
       name = "syncstorage-mysql"

     

       2968
       +
       version = "0.17.12"

     

       2969
        
       dependencies = [

     

       2970
        
        "async-trait",

     

       2971
        
        "backtrace",

     
···

       2988
        
       

     

       2989
        
       [[package]]

     

       2990
        
       name = "syncstorage-settings"

     

       2991
       +
       version = "0.17.12"

     

       2992
        
       dependencies = [

     

       2993
        
        "rand",

     

       2994
        
        "serde 1.0.203",

     
···

       2998
        
       

     

       2999
        
       [[package]]

     

       3000
        
       name = "syncstorage-spanner"

     

       3001
       +
       version = "0.17.12"

     

       3002
        
       dependencies = [

     

       3003
        
        "async-trait",

     

       3004
        
        "backtrace",

     
···

       3142
        
       

     

       3143
        
       [[package]]

     

       3144
        
       name = "tokenserver-auth"

     

       3145
       +
       version = "0.17.12"

     

       3146
        
       dependencies = [

     

       3147
        
        "async-trait",

     

       3148
        
        "base64 0.22.1",

     
···

       3169
        
       

     

       3170
        
       [[package]]

     

       3171
        
       name = "tokenserver-common"

     

       3172
       +
       version = "0.17.12"

     

       3173
        
       dependencies = [

     

       3174
        
        "actix-web",

     

       3175
        
        "backtrace",

     
···

       3184
        
       

     

       3185
        
       [[package]]

     

       3186
        
       name = "tokenserver-db"

     

       3187
       +
       version = "0.17.12"

     

       3188
        
       dependencies = [

     

       3189
        
        "async-trait",

     

       3190
        
        "backtrace",

     
···

       3209
        
       

     

       3210
        
       [[package]]

     

       3211
        
       name = "tokenserver-settings"

     

       3212
       +
       version = "0.17.12"

     

       3213
        
       dependencies = [

     

       3214
        
        "jsonwebtoken",

     

       3215
        
        "serde 1.0.203",

+6 -2

pkgs/by-name/sy/syncstorage-rs/package.nix

···

       6
        
       , libmysqlclient

     

       7
        
       , makeBinaryWrapper

     

       8
        
       , lib

     

       0
        
       
     

       9
        
       }:

     

       10
        
       

     

       11
        
       let

     
···

       20
        
       

     

       21
        
       rustPlatform.buildRustPackage rec {

     

       22
        
         pname = "syncstorage-rs";

     

       23
       -
         version = "0.17.9";

     

       24
        
       

     

       25
        
         src = fetchFromGitHub {

     

       26
        
           owner = "mozilla-services";

     

       27
        
           repo = pname;

     

       28
        
           rev = "refs/tags/${version}";

     

       29
       -
           hash = "sha256-ezTwAAtt0/jKfA6FtvzuQVFYOODMcD4RFiU3x0Umifk=";

     

       30
        
         };

     

       31
        
       

     

       32
        
         nativeBuildInputs = [

     
···

       49
        
           lockFile = ./Cargo.lock;

     

       50
        
           outputHashes = {

     

       51
        
             "deadpool-0.7.0" = "sha256-yQwn45EuzmPBwuT+iLJ/LLWAkBkW2vF+GLswdbpFVAY=";

     

       0
        
       
     

       52
        
           };

     

       53
        
         };

     

       54
        
       

     

       55
        
         # almost all tests need a DB to test against

     

       56
        
         doCheck = false;

     

       0
        
       
     

       0
        
       
     

       57
        
       

     

       58
        
         meta = {

     

       59
        
           description = "Mozilla Sync Storage built with Rust";

···

       6
        
       , libmysqlclient

     

       7
        
       , makeBinaryWrapper

     

       8
        
       , lib

     

       9
       +
       , nix-update-script

     

       10
        
       }:

     

       11
        
       

     

       12
        
       let

     
···

       21
        
       

     

       22
        
       rustPlatform.buildRustPackage rec {

     

       23
        
         pname = "syncstorage-rs";

     

       24
       +
         version = "0.17.12";

     

       25
        
       

     

       26
        
         src = fetchFromGitHub {

     

       27
        
           owner = "mozilla-services";

     

       28
        
           repo = pname;

     

       29
        
           rev = "refs/tags/${version}";

     

       30
       +
           hash = "sha256-hvKbKbRa5zk+80xmKWeMRjshaS6uybFzb5KdBY19Sl8=";

     

       31
        
         };

     

       32
        
       

     

       33
        
         nativeBuildInputs = [

     
···

       50
        
           lockFile = ./Cargo.lock;

     

       51
        
           outputHashes = {

     

       52
        
             "deadpool-0.7.0" = "sha256-yQwn45EuzmPBwuT+iLJ/LLWAkBkW2vF+GLswdbpFVAY=";

     

       53
       +
             "sentry-0.34.0" = "sha256-BdWz6EIEm2YU3DG3ODkuXCVCMV6srdyx2gXkOxINjHc=";

     

       54
        
           };

     

       55
        
         };

     

       56
        
       

     

       57
        
         # almost all tests need a DB to test against

     

       58
        
         doCheck = false;

     

       59
       +
       

     

       60
       +
         passthru.updateScript = nix-update-script {};

     

       61
        
       

     

       62
        
         meta = {

     

       63
        
           description = "Mozilla Sync Storage built with Rust";

pkgs/development/interpreters/lua-5/interpreter.nix

···

       169
        
             management with incremental garbage collection, making it ideal

     

       170
        
             for configuration, scripting, and rapid prototyping.

     

       171
        
           '';

     

       0
        
       
     

       172
        
           license = lib.licenses.mit;

     

       173
        
           platforms = lib.platforms.unix;

     

       174
        
         };

···

       169
        
             management with incremental garbage collection, making it ideal

     

       170
        
             for configuration, scripting, and rapid prototyping.

     

       171
        
           '';

     

       172
       +
           mainProgram = "lua";

     

       173
        
           license = lib.licenses.mit;

     

       174
        
           platforms = lib.platforms.unix;

     

       175
        
         };

+39

pkgs/development/python-modules/automower-ble/default.nix

···

       1
       +
       {

     

       2
       +
         lib,

     

       3
       +
         bleak,

     

       4
       +
         buildPythonPackage,

     

       5
       +
         fetchFromGitHub,

     

       6
       +
         setuptools,

     

       7
       +
         pytestCheckHook,

     

       8
       +
         pythonOlder,

     

       9
       +
       }:

     

       10
       +
       

     

       11
       +
       buildPythonPackage rec {

     

       12
       +
         pname = "automower-ble";

     

       13
       +
         version = "0.2.0";

     

       14
       +
         pyproject = true;

     

       15
       +
       

     

       16
       +
         disabled = pythonOlder "3.10";

     

       17
       +
       

     

       18
       +
         src = fetchFromGitHub {

     

       19
       +
           owner = "alistair23";

     

       20
       +
           repo = "AutoMower-BLE";

     

       21
       +
           rev = "refs/tags/${version}";

     

       22
       +
           hash = "sha256-BWfRXz78e1Xq0fNOGJ2IFnjNqfH3oD5VIGMxyCPtEUw=";

     

       23
       +
         };

     

       24
       +
       

     

       25
       +
         build-system = [ setuptools ];

     

       26
       +
       

     

       27
       +
         dependencies = [ bleak ];

     

       28
       +
       

     

       29
       +
         nativeCheckInputs = [ pytestCheckHook ];

     

       30
       +
       

     

       31
       +
         pythonImportsCheck = [ "automower_ble" ];

     

       32
       +
       

     

       33
       +
         meta = {

     

       34
       +
           description = "Module to connect to Husqvarna Automower Connect";

     

       35
       +
           homepage = "https://github.com/alistair23/AutoMower-BLE";

     

       36
       +
           license = lib.licenses.gpl3Only;

     

       37
       +
           maintainers = with lib.maintainers; [ fab ];

     

       38
       +
         };

     

       39
       +
       }

+2 -2

pkgs/development/python-modules/aw-client/default.nix

···

       16
        
       

     

       17
        
       buildPythonPackage rec {

     

       18
        
         pname = "aw-client";

     

       19
       -
         version = "0.5.13";

     

       20
        
       

     

       21
        
         format = "pyproject";

     

       22
        
       

     
···

       25
        
           owner = "ActivityWatch";

     

       26
        
           repo = "aw-client";

     

       27
        
           rev = "v${version}";

     

       28
       -
           sha256 = "sha256-A9f1Wj4F6qRvCVj3iRQvsnILewJK1L5tfI2MnAXZ4nY=";

     

       29
        
         };

     

       30
        
       

     

       31
        
         disabled = pythonOlder "3.8";

···

       16
        
       

     

       17
        
       buildPythonPackage rec {

     

       18
        
         pname = "aw-client";

     

       19
       +
         version = "0.5.14";

     

       20
        
       

     

       21
        
         format = "pyproject";

     

       22
        
       

     
···

       25
        
           owner = "ActivityWatch";

     

       26
        
           repo = "aw-client";

     

       27
        
           rev = "v${version}";

     

       28
       +
           sha256 = "sha256-HTyhQz/RaNdCtJIV6YHEd6Yhu9VRJ8E9XdN7NcoO8ao=";

     

       29
        
         };

     

       30
        
       

     

       31
        
         disabled = pythonOlder "3.8";

+11 -13

pkgs/development/python-modules/ftfy/default.nix

···

       1
        
       {

     

       2
        
         lib,

     

       3
        
         buildPythonPackage,

     

       4
       -
         fetchPypi,

     

       5
        
         pythonOlder,

     

       6
        
       

     

       7
        
         # build-system

     

       8
       -
         poetry-core,

     

       9
        
       

     

       10
        
         # dependencies

     

       11
        
         wcwidth,

     
···

       17
        
       

     

       18
        
       buildPythonPackage rec {

     

       19
        
         pname = "ftfy";

     

       20
       -
         version = "6.2.3";

     

       21
        
         pyproject = true;

     

       22
        
       

     

       23
       -
         disabled = pythonOlder "3.7";

     

       24
        
       

     

       25
       -
         src = fetchPypi {

     

       26
       -
           inherit pname version;

     

       27
       -
           hash = "sha256-ebUFmI8p1XelipBpr+dVU6AqRuQt5gkcBmDNxngSutw=";

     

       0
        
       
     

       0
        
       
     

       28
        
         };

     

       29
        
       

     

       30
       -
         build-system = [ poetry-core ];

     

       31
        
       

     

       32
        
         dependencies = [ wcwidth ];

     

       33
        
       

     
···

       42
        
           export PATH=$out/bin:$PATH

     

       43
        
         '';

     

       44
        
       

     

       45
       -
         disabledTestPaths = [

     

       46
       -
           # Calls poetry and fails to match output exactly

     

       47
       -
           "tests/test_cli.py"

     

       48
       -
         ];

     

       49
       -
       

     

       50
        
         meta = with lib; {

     

       0
        
       
     

       51
        
           description = "Given Unicode text, make its representation consistent and possibly less broken";

     

       52
        
           mainProgram = "ftfy";

     

       53
        
           homepage = "https://github.com/LuminosoInsight/python-ftfy";

···

       1
        
       {

     

       2
        
         lib,

     

       3
        
         buildPythonPackage,

     

       4
       +
         fetchFromGitHub,

     

       5
        
         pythonOlder,

     

       6
        
       

     

       7
        
         # build-system

     

       8
       +
         hatchling,

     

       9
        
       

     

       10
        
         # dependencies

     

       11
        
         wcwidth,

     
···

       17
        
       

     

       18
        
       buildPythonPackage rec {

     

       19
        
         pname = "ftfy";

     

       20
       +
         version = "6.3.1";

     

       21
        
         pyproject = true;

     

       22
        
       

     

       23
       +
         disabled = pythonOlder "3.9";

     

       24
        
       

     

       25
       +
         src = fetchFromGitHub {

     

       26
       +
           owner = "rspeer";

     

       27
       +
           repo = "python-ftfy";

     

       28
       +
           rev = "refs/tags/v${version}";

     

       29
       +
           hash = "sha256-TmwDJeUDcF+uOB2X5tMmnf9liCI9rP6dYJVmJoaqszo=";

     

       30
        
         };

     

       31
        
       

     

       32
       +
         build-system = [ hatchling ];

     

       33
        
       

     

       34
        
         dependencies = [ wcwidth ];

     

       35
        
       

     
···

       44
        
           export PATH=$out/bin:$PATH

     

       45
        
         '';

     

       46
        
       

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       47
        
         meta = with lib; {

     

       48
       +
           changelog = "https://github.com/rspeer/python-ftfy/blob/${src.rev}/CHANGELOG.md";

     

       49
        
           description = "Given Unicode text, make its representation consistent and possibly less broken";

     

       50
        
           mainProgram = "ftfy";

     

       51
        
           homepage = "https://github.com/LuminosoInsight/python-ftfy";

+67

pkgs/development/python-modules/go2rtc-client/default.nix

···

       1
       +
       {

     

       2
       +
         lib,

     

       3
       +
         aiohttp,

     

       4
       +
         aioresponses,

     

       5
       +
         awesomeversion,

     

       6
       +
         buildPythonPackage,

     

       7
       +
         fetchFromGitHub,

     

       8
       +
         hatchling,

     

       9
       +
         mashumaro,

     

       10
       +
         orjson,

     

       11
       +
         pytest-asyncio,

     

       12
       +
         pytest-cov-stub,

     

       13
       +
         pytestCheckHook,

     

       14
       +
         pythonOlder,

     

       15
       +
         syrupy,

     

       16
       +
         webrtc-models,

     

       17
       +
       }:

     

       18
       +
       

     

       19
       +
       buildPythonPackage rec {

     

       20
       +
         pname = "go2rtc-client";

     

       21
       +
         version = "0.0.1b2";

     

       22
       +
         pyproject = true;

     

       23
       +
       

     

       24
       +
         disabled = pythonOlder "3.12";

     

       25
       +
       

     

       26
       +
         src = fetchFromGitHub {

     

       27
       +
           owner = "home-assistant-libs";

     

       28
       +
           repo = "python-go2rtc-client";

     

       29
       +
           rev = "refs/tags/${version}";

     

       30
       +
           hash = "sha256-q1NDHauYy8C3tlIpt6J0iMj0TNtBv2j9aU/IE5CgBjg=";

     

       31
       +
         };

     

       32
       +
       

     

       33
       +
         postPatch = ''

     

       34
       +
           substituteInPlace pyproject.toml \

     

       35
       +
             --replace-fail 'version = "0.0.0"' 'version = "${version}"'

     

       36
       +
         '';

     

       37
       +
       

     

       38
       +
         pythonRelaxDeps = [ "orjson" ];

     

       39
       +
       

     

       40
       +
         build-system = [ hatchling ];

     

       41
       +
       

     

       42
       +
         dependencies = [

     

       43
       +
           aiohttp

     

       44
       +
           awesomeversion

     

       45
       +
           mashumaro

     

       46
       +
           orjson

     

       47
       +
           webrtc-models

     

       48
       +
         ];

     

       49
       +
       

     

       50
       +
         nativeCheckInputs = [

     

       51
       +
           aioresponses

     

       52
       +
           pytest-asyncio

     

       53
       +
           pytest-cov-stub

     

       54
       +
           pytestCheckHook

     

       55
       +
           syrupy

     

       56
       +
         ];

     

       57
       +
       

     

       58
       +
         pythonImportsCheck = [ "go2rtc_client" ];

     

       59
       +
       

     

       60
       +
         meta = {

     

       61
       +
           description = "Module for interacting with go2rtc";

     

       62
       +
           homepage = "https://github.com/home-assistant-libs/python-go2rtc-client";

     

       63
       +
           changelog = "https://github.com/home-assistant-libs/python-go2rtc-client/releases/tag/${version}";

     

       64
       +
           license = lib.licenses.asl20;

     

       65
       +
           maintainers = with lib.maintainers; [ ];

     

       66
       +
         };

     

       67
       +
       }

+2 -2

pkgs/development/python-modules/jupyterlab-git/default.nix

···

       21
        
       

     

       22
        
       buildPythonPackage rec {

     

       23
        
         pname = "jupyterlab-git";

     

       24
       -
         version = "0.50.1";

     

       25
        
         pyproject = true;

     

       26
        
       

     

       27
        
         disabled = pythonOlder "3.8";

     
···

       29
        
         src = fetchPypi {

     

       30
        
           pname = "jupyterlab_git";

     

       31
        
           inherit version;

     

       32
       -
           hash = "sha256-v08Go/vCsquE6l1SMmqg4LjM9OmjNX+jGKEZVg4cak0=";

     

       33
        
         };

     

       34
        
       

     

       35
        
         nativeBuildInputs = [

···

       21
        
       

     

       22
        
       buildPythonPackage rec {

     

       23
        
         pname = "jupyterlab-git";

     

       24
       +
         version = "0.50.2";

     

       25
        
         pyproject = true;

     

       26
        
       

     

       27
        
         disabled = pythonOlder "3.8";

     
···

       29
        
         src = fetchPypi {

     

       30
        
           pname = "jupyterlab_git";

     

       31
        
           inherit version;

     

       32
       +
           hash = "sha256-zu/chWMsr0maBItDRFnQO15iFmWAHp23GXvUhvXTNDM=";

     

       33
        
         };

     

       34
        
       

     

       35
        
         nativeBuildInputs = [

+4 -4

pkgs/development/python-modules/pyexploitdb/default.nix

···

       10
        
       

     

       11
        
       buildPythonPackage rec {

     

       12
        
         pname = "pyexploitdb";

     

       13
       -
         version = "0.2.41";

     

       14
        
         pyproject = true;

     

       15
        
       

     

       16
        
         disabled = pythonOlder "3.7";

     
···

       18
        
         src = fetchPypi {

     

       19
        
           pname = "pyExploitDb";

     

       20
        
           inherit version;

     

       21
       -
           hash = "sha256-QwMD7V1BSmFBZ7mazo7TnuZijm8MC/M/oKMV4nh1v5A=";

     

       22
        
         };

     

       23
        
       

     

       24
        
         build-system = [ setuptools ];

     
···

       35
        
       

     

       36
        
         meta = with lib; {

     

       37
        
           description = "Library to fetch the most recent exploit-database";

     

       38
       -
           homepage = "https://github.com/GoVanguard/pyExploitDb";

     

       39
       -
           changelog = "https://github.com/GoVanguard/pyExploitDb/blob/master/ChangeLog.md";

     

       40
        
           license = licenses.gpl3Plus;

     

       41
        
           maintainers = with maintainers; [ fab ];

     

       42
        
         };

···

       10
        
       

     

       11
        
       buildPythonPackage rec {

     

       12
        
         pname = "pyexploitdb";

     

       13
       +
         version = "0.2.53";

     

       14
        
         pyproject = true;

     

       15
        
       

     

       16
        
         disabled = pythonOlder "3.7";

     
···

       18
        
         src = fetchPypi {

     

       19
        
           pname = "pyExploitDb";

     

       20
        
           inherit version;

     

       21
       +
           hash = "sha256-NebM8nhIo4Hgf7iwSV2utcrqR1kLh+cpmqV1Gc9r8cw=";

     

       22
        
         };

     

       23
        
       

     

       24
        
         build-system = [ setuptools ];

     
···

       35
        
       

     

       36
        
         meta = with lib; {

     

       37
        
           description = "Library to fetch the most recent exploit-database";

     

       38
       +
           homepage = "https://github.com/Hackman238/pyExploitDb/pyExploitDb";

     

       39
       +
           changelog = "https://github.com/Hackman238/pyExploitDb/pyExploitDb/blob/master/ChangeLog.md";

     

       40
        
           license = licenses.gpl3Plus;

     

       41
        
           maintainers = with maintainers; [ fab ];

     

       42
        
         };

+2 -2

pkgs/development/python-modules/sagemaker-core/default.nix

···

       25
        
       

     

       26
        
       buildPythonPackage rec {

     

       27
        
         pname = "sagemaker-core";

     

       28
       -
         version = "1.0.10";

     

       29
        
         pyproject = true;

     

       30
        
       

     

       31
        
         src = fetchFromGitHub {

     

       32
        
           owner = "aws";

     

       33
        
           repo = "sagemaker-core";

     

       34
        
           rev = "refs/tags/v${version}";

     

       35
       -
           hash = "sha256-UloQJ5B10XXPbwsktVZzjcW7BLW8wCAw3wGmAkSl6wc=";

     

       36
        
         };

     

       37
        
       

     

       38
        
         build-system = [

···

       25
        
       

     

       26
        
       buildPythonPackage rec {

     

       27
        
         pname = "sagemaker-core";

     

       28
       +
         version = "1.0.11";

     

       29
        
         pyproject = true;

     

       30
        
       

     

       31
        
         src = fetchFromGitHub {

     

       32
        
           owner = "aws";

     

       33
        
           repo = "sagemaker-core";

     

       34
        
           rev = "refs/tags/v${version}";

     

       35
       +
           hash = "sha256-6r8roHMJ4s/+mGiPeMVZ9wagdXNJQ3+tUFZ/7T+NQBc=";

     

       36
        
         };

     

       37
        
       

     

       38
        
         build-system = [

+33

pkgs/development/python-modules/sphinx-lv2-theme/default.nix

···

       1
       +
       {

     

       2
       +
         buildPythonPackage,

     

       3
       +
         lib,

     

       4
       +
         fetchFromGitLab,

     

       5
       +
         setuptools,

     

       6
       +
         sphinx,

     

       7
       +
       }:

     

       8
       +
       

     

       9
       +
       buildPythonPackage rec {

     

       10
       +
         pname = "sphinx-lv2-theme";

     

       11
       +
         version = "1.4.2";

     

       12
       +
         pyproject = true;

     

       13
       +
       

     

       14
       +
         src = fetchFromGitLab {

     

       15
       +
           owner = "LV2";

     

       16
       +
           repo = "sphinx_lv2_theme";

     

       17
       +
           rev = "v${version}";

     

       18
       +
           hash = "sha256-x3h2hOQIyzOmnh58WMHjuOARdML1sDiVAf7m0YghhJ4=";

     

       19
       +
         };

     

       20
       +
       

     

       21
       +
         build-system = [ setuptools ];

     

       22
       +
       

     

       23
       +
         dependencies = [ sphinx ];

     

       24
       +
       

     

       25
       +
         pythonImportsCheck = [ "sphinx_lv2_theme" ];

     

       26
       +
       

     

       27
       +
         meta = {

     

       28
       +
           description = "Sphinx theme in the style of the LV2 plugin";

     

       29
       +
           homepage = "https://gitlab.com/lv2/sphinx_lv2_theme";

     

       30
       +
           license = lib.licenses.isc;

     

       31
       +
           maintainers = with lib.maintainers; [ samueltardieu ];

     

       32
       +
         };

     

       33
       +
       }

+4 -5

pkgs/development/python-modules/thinqconnect/default.nix

···

       10
        
       }:

     

       11
        
       

     

       12
        
       buildPythonPackage rec {

     

       13
       -
         pname = "pythinqconnect";

     

       14
       -
         version = "0.9.7-unstable-2024-09-09";

     

       15
        
         pyproject = true;

     

       16
        
       

     

       17
        
         disabled = pythonOlder "3.10";

     
···

       19
        
         src = fetchFromGitHub {

     

       20
        
           owner = "thinq-connect";

     

       21
        
           repo = "pythinqconnect";

     

       22
       -
           # https://github.com/thinq-connect/pythinqconnect/issues/1

     

       23
       -
           rev = "39d535a2a5d1067a110eea37ae92002d0793b7e9";

     

       24
       -
           hash = "sha256-+nQAUqg5rB2eJgPBJJR8NsQ1O2Wb4UsbBQVPir1jyAU=";

     

       25
        
         };

     

       26
        
       

     

       27
        
         build-system = [ setuptools ];

···

       10
        
       }:

     

       11
        
       

     

       12
        
       buildPythonPackage rec {

     

       13
       +
         pname = "thinqconnect";

     

       14
       +
         version = "0.9.9";

     

       15
        
         pyproject = true;

     

       16
        
       

     

       17
        
         disabled = pythonOlder "3.10";

     
···

       19
        
         src = fetchFromGitHub {

     

       20
        
           owner = "thinq-connect";

     

       21
        
           repo = "pythinqconnect";

     

       22
       +
           rev = "refs/tags/${version}";

     

       23
       +
           hash = "sha256-G6fg+mXrUnSkfpeJAvDXEu57UgkYEObErEnds2PK13Y=";

     

       0
        
       
     

       24
        
         };

     

       25
        
       

     

       26
        
         build-system = [ setuptools ];

+7 -15

pkgs/development/python-modules/walrus/default.nix

···

       1
        
       {

     

       2
        
         lib,

     

       3
       -
         pkgs,

     

       4
        
         buildPythonPackage,

     

       5
        
         fetchFromGitHub,

     

       0
        
       
     

       6
        
         pythonOlder,

     

       7
        
         redis,

     

       0
        
       
     

       8
        
         unittestCheckHook,

     

       9
       -
         fetchpatch,

     

       10
        
       }:

     

       11
        
       

     

       12
        
       buildPythonPackage rec {

     

       13
        
         pname = "walrus";

     

       14
       -
         version = "0.9.3";

     

       15
       -
         format = "setuptools";

     

       16
        
       

     

       17
        
         disabled = pythonOlder "3.7";

     

       18
        
       

     
···

       20
        
           owner = "coleifer";

     

       21
        
           repo = "walrus";

     

       22
        
           rev = "refs/tags/${version}";

     

       23
       -
           hash = "sha256-jinYMGSBAY8HTg92qU/iU5vGIrrDr5SeQG0XjsBVfcc=";

     

       24
        
         };

     

       25
        
       

     

       26
       -
         patches = [

     

       27
       -
           # distutils has been deprecated, this wraps its import inside a try-catch

     

       28
       -
           # and fallsback to a fallback import.

     

       29
       -
           # Should not be necessary in future versions.

     

       30
       -
           (fetchpatch {

     

       31
       -
             url = "https://github.com/coleifer/walrus/commit/79e20c89aa4015017ef8a3e0b5c27ca2731dc9b2.patch";

     

       32
       -
             hash = "sha256-hCpvki6SV3KYhicjjUMP4VrKMEerMjq2n1BgozXKDO8=";

     

       33
       -
           })

     

       34
       -
         ];

     

       35
        
       

     

       36
       -
         propagatedBuildInputs = [ redis ];

     

       37
        
       

     

       38
        
         nativeCheckInputs = [ unittestCheckHook ];

     

       39

···

       1
        
       {

     

       2
        
         lib,

     

       0
        
       
     

       3
        
         buildPythonPackage,

     

       4
        
         fetchFromGitHub,

     

       5
       +
         pkgs,

     

       6
        
         pythonOlder,

     

       7
        
         redis,

     

       8
       +
         setuptools,

     

       9
        
         unittestCheckHook,

     

       0
        
       
     

       10
        
       }:

     

       11
        
       

     

       12
        
       buildPythonPackage rec {

     

       13
        
         pname = "walrus";

     

       14
       +
         version = "0.9.4";

     

       15
       +
         pyproject = true;

     

       16
        
       

     

       17
        
         disabled = pythonOlder "3.7";

     

       18
        
       

     
···

       20
        
           owner = "coleifer";

     

       21
        
           repo = "walrus";

     

       22
        
           rev = "refs/tags/${version}";

     

       23
       +
           hash = "sha256-cvoRiaGGTpZWfSE6DDT6GwDmc/TC/Z/E76Qy9Zzkpsw=";

     

       24
        
         };

     

       25
        
       

     

       26
       +
         build-system = [ setuptools ];

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       27
        
       

     

       28
       +
         dependencies = [ redis ];

     

       29
        
       

     

       30
        
         nativeCheckInputs = [ unittestCheckHook ];

     

       31

+59

pkgs/development/python-modules/webrtc-models/default.nix

···

       1
       +
       {

     

       2
       +
         lib,

     

       3
       +
         buildPythonPackage,

     

       4
       +
         fetchFromGitHub,

     

       5
       +
         hatchling,

     

       6
       +
         mashumaro,

     

       7
       +
         orjson,

     

       8
       +
         pytest-asyncio,

     

       9
       +
         pytest-cov-stub,

     

       10
       +
         pytestCheckHook,

     

       11
       +
         pythonOlder,

     

       12
       +
         syrupy,

     

       13
       +
       }:

     

       14
       +
       

     

       15
       +
       buildPythonPackage rec {

     

       16
       +
         pname = "webrtc-models";

     

       17
       +
         version = "0.1.0";

     

       18
       +
         pyproject = true;

     

       19
       +
       

     

       20
       +
         disabled = pythonOlder "3.12";

     

       21
       +
       

     

       22
       +
         src = fetchFromGitHub {

     

       23
       +
           owner = "home-assistant-libs";

     

       24
       +
           repo = "python-webrtc-models";

     

       25
       +
           rev = "refs/tags/${version}";

     

       26
       +
           hash = "sha256-Wmz+P4FFJJZujWF0SR6HVERNNO7xSM1iCayg6tmVyso=";

     

       27
       +
         };

     

       28
       +
       

     

       29
       +
         postPatch = ''

     

       30
       +
           substituteInPlace pyproject.toml \

     

       31
       +
             --replace-fail 'version = "0.0.0"' 'version = "${version}"'

     

       32
       +
         '';

     

       33
       +
       

     

       34
       +
         pythonRelaxDeps = [ "orjson" ];

     

       35
       +
       

     

       36
       +
         build-system = [ hatchling ];

     

       37
       +
       

     

       38
       +
         dependencies = [

     

       39
       +
           mashumaro

     

       40
       +
           orjson

     

       41
       +
         ];

     

       42
       +
       

     

       43
       +
         nativeCheckInputs = [

     

       44
       +
           pytest-asyncio

     

       45
       +
           pytest-cov-stub

     

       46
       +
           pytestCheckHook

     

       47
       +
           syrupy

     

       48
       +
         ];

     

       49
       +
       

     

       50
       +
         pythonImportsCheck = [ "webrtc_models" ];

     

       51
       +
       

     

       52
       +
         meta = {

     

       53
       +
           description = "WebRTC models as Python dataclasses with mashumaro";

     

       54
       +
           homepage = "https://github.com/home-assistant-libs/python-webrtc-models";

     

       55
       +
           changelog = "https://github.com/home-assistant-libs/python-webrtc-models/releases/tag/${version}";

     

       56
       +
           license = lib.licenses.asl20;

     

       57
       +
           maintainers = with lib.maintainers; [ fab ];

     

       58
       +
         };

     

       59
       +
       }

-12

pkgs/development/tools/build-managers/gradle/default.nix

···

       195
        
           defaultJava = jdk17;

     

       196
        
         };

     

       197
        
       

     

       198
       -
         gradle_6 = gen {

     

       199
       -
           version = "6.9.4";

     

       200
       -
           hash = "sha256-PiQCKFON6fGHcqV06ZoLqVnoPW7zUQFDgazZYxeBOJo=";

     

       201
       -
           defaultJava = jdk11;

     

       202
       -
           meta.knownVulnerabilities = [

     

       203
       -
             "CVE-2021-29429: '[...]files created with open permissions in the system temporary directory can allow an attacker to access information downloaded by Gradle[...]'"

     

       204
       -
             "CVE-2021-29427: '[...]there is a vulnerability which can lead to information disclosure and/or dependency poisoning[...] In some cases, Gradle may ignore content filters and search all repositories for dependencies. This only occurs when repository content filtering is used from within a `pluginManagement` block in a settings file.'"

     

       205
       -
             "CVE-2021-29428: '[...]the system temporary directory can be created with open permissions that allow multiple users to create and delete files within it. Gradle builds could be vulnerable to a local privilege escalation from an attacker quickly deleting and recreating files in the system temporary directory.'"

     

       206
       -
             "CVE-2021-32751: '[...]start scripts generated by the `application` plugin and the `gradlew` script are both vulnerable to arbitrary code execution when an attacker is able to change environment variables for the user running the script[...]'"

     

       207
       -
           ];

     

       208
       -
         };

     

       209
       -
       

     

       210
        
         wrapGradle = {

     

       211
        
             lib, callPackage, mitm-cache, substituteAll, symlinkJoin, concatTextFile, makeSetupHook, nix-update-script

     

       212
        
           }:

···

       195
        
           defaultJava = jdk17;

     

       196
        
         };

     

       197
        
       

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       198
        
         wrapGradle = {

     

       199
        
             lib, callPackage, mitm-cache, substituteAll, symlinkJoin, concatTextFile, makeSetupHook, nix-update-script

     

       200
        
           }:

+3 -3

pkgs/servers/home-assistant/custom-lovelace-modules/mushroom/default.nix

···

       5
        
       

     

       6
        
       buildNpmPackage rec {

     

       7
        
         pname = "mushroom";

     

       8
       -
         version = "4.0.7";

     

       9
        
       

     

       10
        
         src = fetchFromGitHub {

     

       11
        
           owner = "piitaya";

     

       12
        
           repo = "lovelace-mushroom";

     

       13
        
           rev = "v${version}";

     

       14
       -
           hash = "sha256-97FW4kNPaoP501xD0W/PjmykwhLbLz7yHVNZiwl/clE=";

     

       15
        
         };

     

       16
        
       

     

       17
       -
         npmDepsHash = "sha256-Gpt17teEbBMHU8teiH66fjZmgq+6v/XovTVxNfHFTg4=";

     

       18
        
       

     

       19
        
         installPhase = ''

     

       20
        
           runHook preInstall

···

       5
        
       

     

       6
        
       buildNpmPackage rec {

     

       7
        
         pname = "mushroom";

     

       8
       +
         version = "4.0.8";

     

       9
        
       

     

       10
        
         src = fetchFromGitHub {

     

       11
        
           owner = "piitaya";

     

       12
        
           repo = "lovelace-mushroom";

     

       13
        
           rev = "v${version}";

     

       14
       +
           hash = "sha256-jwL/LrnQsjwv9Wt+jmJKE7jJ3YO8K7eBkxkvAvCbg7g=";

     

       15
        
         };

     

       16
        
       

     

       17
       +
         npmDepsHash = "sha256-fzmVRmX1lBy+t7gRCUfw2ONYyKDUs6IkSnAstiYJ7qg=";

     

       18
        
       

     

       19
        
         installPhase = ''

     

       20
        
           runHook preInstall

+41

pkgs/servers/monitoring/nagios-plugins/openbsd_snmp3_check/default.nix

···

       1
       +
       {

     

       2
       +
         fetchFromGitHub,

     

       3
       +
         lib,

     

       4
       +
         nix-update-script,

     

       5
       +
         openbsd_snmp3_check,

     

       6
       +
         python3Packages,

     

       7
       +
         testers,

     

       8
       +
       }:

     

       9
       +
       python3Packages.buildPythonApplication rec {

     

       10
       +
         pname = "openbsd_snmp3_check";

     

       11
       +
         version = "0.55";

     

       12
       +
         pyproject = false;

     

       13
       +
       

     

       14
       +
         src = fetchFromGitHub {

     

       15
       +
           owner = "alexander-naumov";

     

       16
       +
           repo = "openbsd_snmp3_check";

     

       17
       +
           rev = "v${version}";

     

       18
       +
           hash = "sha256-qDYANMvQU72f9wz8os7S1PfBH08AAqhtWLHVuSmkub4=";

     

       19
       +
         };

     

       20
       +
       

     

       21
       +
         postInstall = ''

     

       22
       +
           install -Dm755 openbsd_snmp3.py $out/bin/openbsd_snmp3.py

     

       23
       +
         '';

     

       24
       +
       

     

       25
       +
         passthru = {

     

       26
       +
           updateScript = nix-update-script { };

     

       27
       +
           tests.version = testers.testVersion {

     

       28
       +
             package = openbsd_snmp3_check;

     

       29
       +
           };

     

       30
       +
         };

     

       31
       +
       

     

       32
       +
         meta = with lib; {

     

       33
       +
           changelog = "https://github.com/alexander-naumov/openbsd_snmp3_check/releases/tag/v${version}";

     

       34
       +
           description = "SNMP v3 check for OpenBSD systems state monitoring";

     

       35
       +
           homepage = "https://github.com/alexander-naumov/openbsd_snmp3_check";

     

       36
       +
           license = with licenses; [ bsd3 ];

     

       37
       +
           platforms = platforms.unix;

     

       38
       +
           maintainers = with maintainers; [ jwillikers ];

     

       39
       +
           mainProgram = "openbsd_snmp3.py";

     

       40
       +
         };

     

       41
       +
       }

pkgs/servers/monitoring/nagios-plugins/plugins.nix

···

       13
        
       

     

       14
        
         inherit (callPackage ./labs_consol_de { }) check_mssql_health check_nwc_health check_ups_health;

     

       15
        
         manubulon-snmp-plugins = callPackage ./manubulon-snmp-plugins { };

     

       0
        
       
     

       16
        
       }

···

       13
        
       

     

       14
        
         inherit (callPackage ./labs_consol_de { }) check_mssql_health check_nwc_health check_ups_health;

     

       15
        
         manubulon-snmp-plugins = callPackage ./manubulon-snmp-plugins { };

     

       16
       +
         openbsd_snmp3_check = callPackage ./openbsd_snmp3_check { };

     

       17
        
       }

-40

pkgs/servers/monitoring/prometheus/tor-exporter.nix

···

       1
       -
       { lib, fetchFromGitHub, python3Packages, nixosTests }:

     

       2
       -
       

     

       3
       -
       python3Packages.buildPythonApplication rec {

     

       4
       -
         pname = "tor-exporter";

     

       5
       -
         version = "0.4";

     

       6
       -
       

     

       7
       -
         # Just a single .py file to use as the application's main entry point.

     

       8
       -
         format = "other";

     

       9
       -
       

     

       10
       -
         src = fetchFromGitHub {

     

       11
       -
           rev = "v${version}";

     

       12
       -
           owner = "atx";

     

       13
       -
           repo = "prometheus-tor_exporter";

     

       14
       -
           sha256 = "1gzf42z0cgdqijbi9cwpjkqzkvnabaxkkfa5ac5h27r3pxx3q4n0";

     

       15
       -
         };

     

       16
       -
       

     

       17
       -
         propagatedBuildInputs = with python3Packages; [ prometheus-client stem retrying ];

     

       18
       -
       

     

       19
       -
         installPhase = ''

     

       20
       -
           mkdir -p $out/share/

     

       21
       -
           cp prometheus-tor-exporter.py $out/share/

     

       22
       -
         '';

     

       23
       -
       

     

       24
       -
         fixupPhase = ''

     

       25
       -
           makeWrapper "${python3Packages.python.interpreter}" "$out/bin/prometheus-tor-exporter" \

     

       26
       -
                 --set PYTHONPATH "$PYTHONPATH" \

     

       27
       -
                 --add-flags "$out/share/prometheus-tor-exporter.py"

     

       28
       -
         '';

     

       29
       -
       

     

       30
       -
         passthru.tests = { inherit (nixosTests.prometheus-exporters) tor; };

     

       31
       -
       

     

       32
       -
         meta = with lib; {

     

       33
       -
           description = "Prometheus exporter that exposes metrics from a Tor daemon";

     

       34
       -
           mainProgram = "prometheus-tor-exporter";

     

       35
       -
           homepage = "https://github.com/atx/prometheus-tor_exporter";

     

       36
       -
           license = licenses.mit;

     

       37
       -
           maintainers = with maintainers; [ Scrumplex ];

     

       38
       -
           platforms = platforms.unix;

     

       39
       -
         };

     

       40
       -
       }

+4 -4

pkgs/servers/teleport/15/default.nix

···

       1
        
       { wasm-bindgen-cli, ... }@args:

     

       2
        
       import ../generic.nix (args // {

     

       3
       -
         version = "15.4.11";

     

       4
       -
         hash = "sha256-vmJ76aRAsbSGXZ2HcuryOlUYrUOPMP6MaI8OjxxyiZ4=";

     

       5
       -
         vendorHash = "sha256-oJo8Ga6TAUz1xSYiRckzq8zZvgIZFCeEwZbiyyVOdkI=";

     

       6
       -
         yarnHash = "sha256-5ppgBa5CyQ49FSFhdWDbTcCTdt0vsXAzNTeyG4r7crg=";

     

       7
        
         cargoLock = {

     

       8
        
           lockFile = ./Cargo.lock;

     

       9
        
           outputHashes = {

···

       1
        
       { wasm-bindgen-cli, ... }@args:

     

       2
        
       import ../generic.nix (args // {

     

       3
       +
         version = "15.4.21";

     

       4
       +
         hash = "sha256-n5dAJ5ilq5nHo3neQzCUFnDRwLhArwleMSho4/g0MT4=";

     

       5
       +
         vendorHash = "sha256-bW8ztNeSzxUNtbuBtxIya9TeGfktC+/fz9iXB0GL0Mg=";

     

       6
       +
         yarnHash = "sha256-ZaLLrcwAeq6TQ1SaA2few4s0HqktOZEpxCTcNGloGfk=";

     

       7
        
         cargoLock = {

     

       8
        
           lockFile = ./Cargo.lock;

     

       9
        
           outputHashes = {

+3 -3

pkgs/servers/teleport/16/default.nix

···

       1
        
       { wasm-bindgen-cli, ... }@args:

     

       2
        
       import ../generic.nix (args // {

     

       3
       -
         version = "16.2.0";

     

       4
       -
         hash = "sha256-3LLoO7SNJfEfDEU7JnAhmAOIdRO+TkgiJKjT8sqzelo=";

     

       5
        
         vendorHash = "sha256-iyYfht0aB9Vv2hsaqrieFHXbDhlotKQYfLn4JFqpve8=";

     

       6
       -
         pnpmHash = "sha256-lcev7VwTcuCuced8uZzLoobREWtNRDFRFdfmabJPLtc=";

     

       7
        
         cargoLock = {

     

       8
        
           lockFile = ./Cargo.lock;

     

       9
        
           outputHashes = {

···

       1
        
       { wasm-bindgen-cli, ... }@args:

     

       2
        
       import ../generic.nix (args // {

     

       3
       +
         version = "16.4.6";

     

       4
       +
         hash = "sha256-TdOCFs6YeqINM8aPryrjYPaXEjc/gIqu7kzVYDnMsjg=";

     

       5
        
         vendorHash = "sha256-iyYfht0aB9Vv2hsaqrieFHXbDhlotKQYfLn4JFqpve8=";

     

       6
       +
         pnpmHash = "sha256-NF45Wp4itYud01VzxC8bRHZ3xZ1T1du1QmZTDMS5nOk=";

     

       7
        
         cargoLock = {

     

       8
        
           lockFile = ./Cargo.lock;

     

       9
        
           outputHashes = {

+1 -1

pkgs/servers/teleport/generic.nix

···

       150
        
         patches = extPatches ++ [

     

       151
        
           ./0001-fix-add-nix-path-to-exec-env.patch

     

       152
        
           ./rdpclient.patch

     

       153
       -
           (if lib.versionAtLeast version "16" then ./tsh_16.patch else ./tsh.patch)

     

       154
        
         ];

     

       155
        
       

     

       156
        
         # Reduce closure size for client machines

···

       150
        
         patches = extPatches ++ [

     

       151
        
           ./0001-fix-add-nix-path-to-exec-env.patch

     

       152
        
           ./rdpclient.patch

     

       153
       +
           ./tsh.patch

     

       154
        
         ];

     

       155
        
       

     

       156
        
         # Reduce closure size for client machines

+1 -1

pkgs/servers/teleport/tsh.patch

···

       11
        
        	if err != nil {

     

       12
        
        		return trace.Wrap(err)

     

       13
        
        	}

     

       14
       -
       +	cf.executablePath = path.Dir(tempBinaryPath) + "/tsh"

     

       15
        
        

     

       16
        
        	// configs

     

       17
        
        	setEnvFlags(&cf)

···

       11
        
        	if err != nil {

     

       12
        
        		return trace.Wrap(err)

     

       13
        
        	}

     

       14
       +
       +	cf.executablePath = filepath.Dir(tempBinaryPath) + "/tsh"

     

       15
        
        

     

       16
        
        	// configs

     

       17
        
        	setEnvFlags(&cf)

-17

pkgs/servers/teleport/tsh_16.patch

···

       1
       -
       diff --git a/tool/tsh/common/tsh.go b/tool/tsh/common/tsh.go

     

       2
       -
       index 5de21c69d0..3995c19e3c 100644

     

       3
       -
       --- a/tool/tsh/common/tsh.go

     

       4
       -
       +++ b/tool/tsh/common/tsh.go

     

       5
       -
       @@ -1084,10 +1084,11 @@ func Run(ctx context.Context, args []string, opts ...CliOption) error {

     

       6
       -
        

     

       7
       -
        	var err error

     

       8
       -
        

     

       9
       -
       -	cf.executablePath, err = os.Executable()

     

       10
       -
       +	tempBinaryPath, err := os.Executable()

     

       11
       -
        	if err != nil {

     

       12
       -
        		return trace.Wrap(err)

     

       13
       -
        	}

     

       14
       -
       +	cf.executablePath = filepath.Dir(tempBinaryPath) + "/tsh"

     

       15
       -
        

     

       16
       -
        	// configs

     

       17
       -
        	setEnvFlags(&cf)

+2 -2

pkgs/servers/web-apps/nifi/default.nix

···

       2
        
       

     

       3
        
       stdenv.mkDerivation rec {

     

       4
        
         pname = "nifi";

     

       5
       -
         version = "1.27.0";

     

       6
        
       

     

       7
        
         src = fetchzip {

     

       8
        
           url = "mirror://apache/nifi/${version}/nifi-${version}-bin.zip";

     

       9
       -
           hash = "sha256-D3o7MLn8vdDqzk6/AJ7Lmq6Yx2swy8CwOyDTlxFSVME=";

     

       10
        
         };

     

       11
        
       

     

       12
        
         nativeBuildInputs = [ makeWrapper ];

···

       2
        
       

     

       3
        
       stdenv.mkDerivation rec {

     

       4
        
         pname = "nifi";

     

       5
       +
         version = "1.28.0";

     

       6
        
       

     

       7
        
         src = fetchzip {

     

       8
        
           url = "mirror://apache/nifi/${version}/nifi-${version}-bin.zip";

     

       9
       +
           hash = "sha256-EQqosdwNdaSUIcP3QlvzJZhDNu1JbHg08FlnZo6ogmQ=";

     

       10
        
         };

     

       11
        
       

     

       12
        
         nativeBuildInputs = [ makeWrapper ];

+3 -3

pkgs/servers/x11/xorg/default.nix

···

       1018
        
         # THIS IS A GENERATED FILE.  DO NOT EDIT!

     

       1019
        
         libAppleWM = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, libX11, libXext, testers }: stdenv.mkDerivation (finalAttrs: {

     

       1020
        
           pname = "libAppleWM";

     

       1021
       -
           version = "1.4.1";

     

       1022
        
           builder = ./builder.sh;

     

       1023
        
           src = fetchurl {

     

       1024
       -
             url = "mirror://xorg/individual/lib/libAppleWM-1.4.1.tar.bz2";

     

       1025
       -
             sha256 = "0r8x28n45q89x91mz8mv0zkkcxi8wazkac886fyvflhiv2y8ap2y";

     

       1026
        
           };

     

       1027
        
           hardeningDisable = [ "bindnow" "relro" ];

     

       1028
        
           strictDeps = true;

···

       1018
        
         # THIS IS A GENERATED FILE.  DO NOT EDIT!

     

       1019
        
         libAppleWM = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, libX11, libXext, testers }: stdenv.mkDerivation (finalAttrs: {

     

       1020
        
           pname = "libAppleWM";

     

       1021
       +
           version = "be972ebc3a97292e7d2b2350eff55ae12df99a42";

     

       1022
        
           builder = ./builder.sh;

     

       1023
        
           src = fetchurl {

     

       1024
       +
             url = "https://gitlab.freedesktop.org/xorg/lib/libAppleWM/-/archive/be972ebc3a97292e7d2b2350eff55ae12df99a42/libAppleWM-be972ebc3a97292e7d2b2350eff55ae12df99a42.tar.bz2";

     

       1025
       +
             sha256 = "1hrq03pahmrbb05r6a7j7m1nxl65wlfi6d2lwm1kvra63q91f9ph";

     

       1026
        
           };

     

       1027
        
           hardeningDisable = [ "bindnow" "relro" ];

     

       1028
        
           strictDeps = true;

+2 -4

pkgs/servers/x11/xorg/overrides.nix

···

       169
        
         });

     

       170
        
       

     

       171
        
         libAppleWM = super.libAppleWM.overrideAttrs (attrs: {

     

       172
       -
           buildInputs = attrs.buildInputs ++ [ ApplicationServices ];

     

       173
       -
           preConfigure = ''

     

       174
       -
             substituteInPlace src/Makefile.in --replace -F/System -F${ApplicationServices}

     

       175
       -
           '';

     

       176
        
         });

     

       177
        
       

     

       178
        
         libXau = super.libXau.overrideAttrs (attrs: {

···

       169
        
         });

     

       170
        
       

     

       171
        
         libAppleWM = super.libAppleWM.overrideAttrs (attrs: {

     

       172
       +
           nativeBuildInputs = attrs.nativeBuildInputs ++ [ autoreconfHook ];

     

       173
       +
           buildInputs =  attrs.buildInputs ++ [ xorg.utilmacros ];

     

       0
        
       
     

       0
        
       
     

       174
        
         });

     

       175
        
       

     

       176
        
         libXau = super.libXau.overrideAttrs (attrs: {

+1 -1

pkgs/servers/x11/xorg/tarballs.list

···

       165
        
       mirror://xorg/individual/font/font-util-1.4.1.tar.xz

     

       166
        
       mirror://xorg/individual/font/font-winitzki-cyrillic-1.0.4.tar.xz

     

       167
        
       mirror://xorg/individual/font/font-xfree86-type1-1.0.5.tar.xz

     

       168
       -
       mirror://xorg/individual/lib/libAppleWM-1.4.1.tar.bz2

     

       169
        
       mirror://xorg/individual/lib/libdmx-1.1.5.tar.xz

     

       170
        
       mirror://xorg/individual/lib/libfontenc-1.1.8.tar.xz

     

       171
        
       mirror://xorg/individual/lib/libFS-1.0.10.tar.xz

···

       165
        
       mirror://xorg/individual/font/font-util-1.4.1.tar.xz

     

       166
        
       mirror://xorg/individual/font/font-winitzki-cyrillic-1.0.4.tar.xz

     

       167
        
       mirror://xorg/individual/font/font-xfree86-type1-1.0.5.tar.xz

     

       168
       +
       https://gitlab.freedesktop.org/xorg/lib/libAppleWM/-/archive/be972ebc3a97292e7d2b2350eff55ae12df99a42/libAppleWM-be972ebc3a97292e7d2b2350eff55ae12df99a42.tar.bz2

     

       169
        
       mirror://xorg/individual/lib/libdmx-1.1.5.tar.xz

     

       170
        
       mirror://xorg/individual/lib/libfontenc-1.1.8.tar.xz

     

       171
        
       mirror://xorg/individual/lib/libFS-1.0.10.tar.xz

-30

pkgs/tools/misc/hexyl/default.nix

···

       1
       -
       { lib, rustPlatform, fetchFromGitHub }:

     

       2
       -
       

     

       3
       -
       rustPlatform.buildRustPackage rec {

     

       4
       -
         pname = "hexyl";

     

       5
       -
         version = "0.14.0";

     

       6
       -
       

     

       7
       -
         src = fetchFromGitHub {

     

       8
       -
           owner = "sharkdp";

     

       9
       -
           repo = pname;

     

       10
       -
           rev = "v${version}";

     

       11
       -
           hash = "sha256-di7SBuB4LsnqlP3BdMcsSLj4zpyKA/ninVpRyR9AJaI=";

     

       12
       -
         };

     

       13
       -
       

     

       14
       -
         cargoHash = "sha256-fXrdOiCmRgMPJxZIS/SkTkZZkag8ZUhNnMlU4k1m/+0=";

     

       15
       -
       

     

       16
       -
         meta = with lib; {

     

       17
       -
           description = "Command-line hex viewer";

     

       18
       -
           longDescription = ''

     

       19
       -
             `hexyl` is a simple hex viewer for the terminal. It uses a colored

     

       20
       -
             output to distinguish different categories of bytes (NULL bytes,

     

       21
       -
             printable ASCII characters, ASCII whitespace characters, other ASCII

     

       22
       -
             characters and non-ASCII).

     

       23
       -
           '';

     

       24
       -
           homepage = "https://github.com/sharkdp/hexyl";

     

       25
       -
           changelog = "https://github.com/sharkdp/hexyl/blob/v${version}/CHANGELOG.md";

     

       26
       -
           license = with licenses; [ asl20 /* or */ mit ];

     

       27
       -
           maintainers = with maintainers; [ dywedir figsoda SuperSandro2000 ];

     

       28
       -
           mainProgram = "hexyl";

     

       29
       -
         };

     

       30
       -
       }

+2 -2

pkgs/tools/misc/panoply/default.nix

···

       8
        
       

     

       9
        
       stdenvNoCC.mkDerivation rec {

     

       10
        
         pname = "panoply";

     

       11
       -
         version = "5.5.3";

     

       12
        
       

     

       13
        
         src = fetchurl {

     

       14
        
           url = "https://www.giss.nasa.gov/tools/panoply/download/PanoplyJ-${version}.tgz";

     

       15
       -
           hash = "sha256-TCuCLWMVp7t0JpHA6TbwUdURj/aBggzLa9I7llRY0TU=";

     

       16
        
         };

     

       17
        
       

     

       18
        
         nativeBuildInputs = [ makeWrapper ];

···

       8
        
       

     

       9
        
       stdenvNoCC.mkDerivation rec {

     

       10
        
         pname = "panoply";

     

       11
       +
         version = "5.5.4";

     

       12
        
       

     

       13
        
         src = fetchurl {

     

       14
        
           url = "https://www.giss.nasa.gov/tools/panoply/download/PanoplyJ-${version}.tgz";

     

       15
       +
           hash = "sha256-rC2vQcaanK2nNSDtiXNhyBiV0SN3QqtwU8WNBc7D/Nw=";

     

       16
        
         };

     

       17
        
       

     

       18
        
         nativeBuildInputs = [ makeWrapper ];

pkgs/tools/package-management/nix/common.nix

···

       16
        
         atLeast210 = lib.versionAtLeast version "2.10pre";

     

       17
        
         atLeast213 = lib.versionAtLeast version "2.13pre";

     

       18
        
         atLeast214 = lib.versionAtLeast version "2.14pre";

     

       0
        
       
     

       19
        
         atLeast219 = lib.versionAtLeast version "2.19pre";

     

       20
        
         atLeast220 = lib.versionAtLeast version "2.20pre";

     

       21
        
         atLeast221 = lib.versionAtLeast version "2.21pre";

     
···

       42
        
       , callPackage

     

       43
        
       , coreutils

     

       44
        
       , curl

     

       0
        
       
     

       45
        
       , docbook_xsl_ns

     

       46
        
       , docbook5

     

       47
        
       , editline

     
···

       158
        
           libseccomp

     

       159
        
         ] ++ lib.optionals withAWS [

     

       160
        
           aws-sdk-cpp

     

       0
        
       
     

       0
        
       
     

       161
        
         ];

     

       162
        
       

     

       163

···

       16
        
         atLeast210 = lib.versionAtLeast version "2.10pre";

     

       17
        
         atLeast213 = lib.versionAtLeast version "2.13pre";

     

       18
        
         atLeast214 = lib.versionAtLeast version "2.14pre";

     

       19
       +
         atLeast218 = lib.versionAtLeast version "2.18pre";

     

       20
        
         atLeast219 = lib.versionAtLeast version "2.19pre";

     

       21
        
         atLeast220 = lib.versionAtLeast version "2.20pre";

     

       22
        
         atLeast221 = lib.versionAtLeast version "2.21pre";

     
···

       43
        
       , callPackage

     

       44
        
       , coreutils

     

       45
        
       , curl

     

       46
       +
       , darwin

     

       47
        
       , docbook_xsl_ns

     

       48
        
       , docbook5

     

       49
        
       , editline

     
···

       160
        
           libseccomp

     

       161
        
         ] ++ lib.optionals withAWS [

     

       162
        
           aws-sdk-cpp

     

       163
       +
         ] ++ lib.optional (atLeast218 && stdenv.hostPlatform.isDarwin) [

     

       164
       +
           darwin.apple_sdk.libs.sandbox

     

       165
        
         ];

     

       166
        
       

     

       167

+51

pkgs/tools/package-management/nix/default.nix

···

       178
        
           version = "2.18.8";

     

       179
        
           hash = "sha256-0rHRifdjzzxMh/im8pRx6XoY62irDTDUes+Pn0CR65I=";

     

       180
        
           self_attribute_name = "nix_2_18";

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       181
        
         };

     

       182
        
       

     

       183
        
         nix_2_19 = common {

     

       184
        
           version = "2.19.6";

     

       185
        
           hash = "sha256-XT5xiwOLgXf+TdyOjbJVOl992wu9mBO25WXHoyli/Tk=";

     

       186
        
           self_attribute_name = "nix_2_19";

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       187
        
         };

     

       188
        
       

     

       189
        
         nix_2_20 = common {

     

       190
        
           version = "2.20.8";

     

       191
        
           hash = "sha256-M2tkMtjKi8LDdNLsKi3IvD8oY/i3rtarjMpvhybS3WY=";

     

       192
        
           self_attribute_name = "nix_2_20";

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       193
        
         };

     

       194
        
       

     

       195
        
         nix_2_21 = common {

     

       196
        
           version = "2.21.4";

     

       197
        
           hash = "sha256-c6nVZ0pSrfhFX3eVKqayS+ioqyAGp3zG9ZPO5rkXFRQ=";

     

       198
        
           self_attribute_name = "nix_2_21";

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       199
        
         };

     

       200
        
       

     

       201
        
         nix_2_22 = common {

     

       202
        
           version = "2.22.3";

     

       203
        
           hash = "sha256-l04csH5rTWsK7eXPWVxJBUVRPMZXllFoSkYFTq/i8WU=";

     

       204
        
           self_attribute_name = "nix_2_22";

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       205
        
         };

     

       206
        
       

     

       207
        
         nix_2_23 = common {

     

       208
        
           version = "2.23.3";

     

       209
        
           hash = "sha256-lAoLGVIhRFrfgv7wcyduEkyc83QKrtsfsq4of+WrBeg=";

     

       210
        
           self_attribute_name = "nix_2_23";

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       211
        
         };

     

       212
        
       

     

       213
        
         nix_2_24 = (common {

     

       214
        
           version = "2.24.9";

     

       215
        
           hash = "sha256-OwJByTdCz1t91ysBqynK+ifszkoIGEXUn6HE2t82+c8=";

     

       216
        
           self_attribute_name = "nix_2_24";

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       217
        
         }).override (lib.optionalAttrs (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86_64) {

     

       218
        
           # Fix the following error with the default x86_64-darwin SDK:

     

       219
        
           #

     
···

       234
        
             rev = "ca3fc1693b309ab6b8b0c09408a08d0055bf0363";

     

       235
        
             hash = "sha256-Hp7dkx7zfB9a4l5QusXUob0b1T2qdZ23LFo5dcp3xrU=";

     

       236
        
           };

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       237
        
           self_attribute_name = "git";

     

       238
        
         }).override (lib.optionalAttrs (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86_64) {

     

       239
        
           # Fix the following error with the default x86_64-darwin SDK:

···

       178
        
           version = "2.18.8";

     

       179
        
           hash = "sha256-0rHRifdjzzxMh/im8pRx6XoY62irDTDUes+Pn0CR65I=";

     

       180
        
           self_attribute_name = "nix_2_18";

     

       181
       +
           patches = [

     

       182
       +
             ./patches/2_18/0001-fix-Run-all-derivation-builders-inside-the-sandbox-o.patch

     

       183
       +
             ./patches/2_18/0002-local-derivation-goal-Print-sandbox-error-detail-on-.patch

     

       184
       +
             ./patches/2_18/0003-local-derivation-goal-Refactor.patch

     

       185
       +
             ./patches/2_18/0004-local-derivation-goal-Move-builder-preparation-to-no.patch

     

       186
       +
           ];

     

       187
        
         };

     

       188
        
       

     

       189
        
         nix_2_19 = common {

     

       190
        
           version = "2.19.6";

     

       191
        
           hash = "sha256-XT5xiwOLgXf+TdyOjbJVOl992wu9mBO25WXHoyli/Tk=";

     

       192
        
           self_attribute_name = "nix_2_19";

     

       193
       +
           patches = [

     

       194
       +
             ./patches/2_19/0001-fix-Run-all-derivation-builders-inside-the-sandbox-o.patch

     

       195
       +
             ./patches/2_19/0002-local-derivation-goal-Print-sandbox-error-detail-on-.patch

     

       196
       +
             ./patches/2_19/0003-local-derivation-goal-Refactor.patch

     

       197
       +
             ./patches/2_19/0004-local-derivation-goal-Move-builder-preparation-to-no.patch

     

       198
       +
           ];

     

       199
        
         };

     

       200
        
       

     

       201
        
         nix_2_20 = common {

     

       202
        
           version = "2.20.8";

     

       203
        
           hash = "sha256-M2tkMtjKi8LDdNLsKi3IvD8oY/i3rtarjMpvhybS3WY=";

     

       204
        
           self_attribute_name = "nix_2_20";

     

       205
       +
           patches = [

     

       206
       +
             ./patches/2_20/0001-fix-Run-all-derivation-builders-inside-the-sandbox-o.patch

     

       207
       +
             ./patches/2_20/0002-local-derivation-goal-Print-sandbox-error-detail-on-.patch

     

       208
       +
             ./patches/2_20/0003-local-derivation-goal-Refactor.patch

     

       209
       +
             ./patches/2_20/0004-local-derivation-goal-Move-builder-preparation-to-no.patch

     

       210
       +
           ];

     

       211
        
         };

     

       212
        
       

     

       213
        
         nix_2_21 = common {

     

       214
        
           version = "2.21.4";

     

       215
        
           hash = "sha256-c6nVZ0pSrfhFX3eVKqayS+ioqyAGp3zG9ZPO5rkXFRQ=";

     

       216
        
           self_attribute_name = "nix_2_21";

     

       217
       +
           patches = [

     

       218
       +
             ./patches/2_21/0001-fix-Run-all-derivation-builders-inside-the-sandbox-o.patch

     

       219
       +
             ./patches/2_21/0002-local-derivation-goal-Print-sandbox-error-detail-on-.patch

     

       220
       +
             ./patches/2_21/0003-local-derivation-goal-Refactor.patch

     

       221
       +
             ./patches/2_21/0004-local-derivation-goal-Move-builder-preparation-to-no.patch

     

       222
       +
           ];

     

       223
        
         };

     

       224
        
       

     

       225
        
         nix_2_22 = common {

     

       226
        
           version = "2.22.3";

     

       227
        
           hash = "sha256-l04csH5rTWsK7eXPWVxJBUVRPMZXllFoSkYFTq/i8WU=";

     

       228
        
           self_attribute_name = "nix_2_22";

     

       229
       +
           patches = [

     

       230
       +
             ./patches/2_22/0001-fix-Run-all-derivation-builders-inside-the-sandbox-o.patch

     

       231
       +
             ./patches/2_22/0002-local-derivation-goal-Print-sandbox-error-detail-on-.patch

     

       232
       +
             ./patches/2_22/0003-local-derivation-goal-Refactor.patch

     

       233
       +
             ./patches/2_22/0004-local-derivation-goal-Move-builder-preparation-to-no.patch

     

       234
       +
           ];

     

       235
        
         };

     

       236
        
       

     

       237
        
         nix_2_23 = common {

     

       238
        
           version = "2.23.3";

     

       239
        
           hash = "sha256-lAoLGVIhRFrfgv7wcyduEkyc83QKrtsfsq4of+WrBeg=";

     

       240
        
           self_attribute_name = "nix_2_23";

     

       241
       +
           patches = [

     

       242
       +
             ./patches/2_23/0001-fix-Run-all-derivation-builders-inside-the-sandbox-o.patch

     

       243
       +
             ./patches/2_23/0002-local-derivation-goal-Print-sandbox-error-detail-on-.patch

     

       244
       +
             ./patches/2_23/0003-local-derivation-goal-Refactor.patch

     

       245
       +
             ./patches/2_23/0004-local-derivation-goal-Move-builder-preparation-to-no.patch

     

       246
       +
           ];

     

       247
        
         };

     

       248
        
       

     

       249
        
         nix_2_24 = (common {

     

       250
        
           version = "2.24.9";

     

       251
        
           hash = "sha256-OwJByTdCz1t91ysBqynK+ifszkoIGEXUn6HE2t82+c8=";

     

       252
        
           self_attribute_name = "nix_2_24";

     

       253
       +
           patches = [

     

       254
       +
             ./patches/2_24/0001-fix-Run-all-derivation-builders-inside-the-sandbox-o.patch

     

       255
       +
             ./patches/2_24/0002-packaging-Add-darwin-lsandbox-in-meson.patch

     

       256
       +
             ./patches/2_24/0003-local-derivation-goal-Print-sandbox-error-detail-on-.patch

     

       257
       +
             ./patches/2_24/0004-local-derivation-goal-Refactor.patch

     

       258
       +
             ./patches/2_24/0005-local-derivation-goal-Move-builder-preparation-to-no.patch

     

       259
       +
           ];

     

       260
        
         }).override (lib.optionalAttrs (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86_64) {

     

       261
        
           # Fix the following error with the default x86_64-darwin SDK:

     

       262
        
           #

     
···

       277
        
             rev = "ca3fc1693b309ab6b8b0c09408a08d0055bf0363";

     

       278
        
             hash = "sha256-Hp7dkx7zfB9a4l5QusXUob0b1T2qdZ23LFo5dcp3xrU=";

     

       279
        
           };

     

       280
       +
          patches = [

     

       281
       +
            ./patches/git/0001-Fix-meson-build-on-darwin.patch

     

       282
       +
            ./patches/git/0002-fix-Run-all-derivation-builders-inside-the-sandbox-o.patch

     

       283
       +
            ./patches/git/0003-packaging-Add-darwin-lsandbox-in-meson.patch

     

       284
       +
            ./patches/git/0004-local-derivation-goal-Print-sandbox-error-detail-on-.patch

     

       285
       +
            ./patches/git/0005-local-derivation-goal-Refactor.patch

     

       286
       +
            ./patches/git/0006-local-derivation-goal-Move-builder-preparation-to-no.patch

     

       287
       +
          ];

     

       288
        
           self_attribute_name = "git";

     

       289
        
         }).override (lib.optionalAttrs (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86_64) {

     

       290
        
           # Fix the following error with the default x86_64-darwin SDK:

+315

pkgs/tools/package-management/nix/patches/2_18/0001-fix-Run-all-derivation-builders-inside-the-sandbox-o.patch

···

       1
       +
       From 3c4bc6929eb13cf648c54931a28797bb1c289052 Mon Sep 17 00:00:00 2001

     

       2
       +
       From: Puck Meerburg <puck@puckipedia.com>

     

       3
       +
       Date: Fri, 1 Mar 2024 11:42:24 -0500

     

       4
       +
       Subject: [PATCH 1/4] fix: Run all derivation builders inside the sandbox on

     

       5
       +
        macOS

     

       6
       +
       MIME-Version: 1.0

     

       7
       +
       Content-Type: text/plain; charset=UTF-8

     

       8
       +
       Content-Transfer-Encoding: 8bit

     

       9
       +
       

     

       10
       +
       Signed-off-by: Jörg Thalheim <joerg@thalheim.io>

     

       11
       +
       ---

     

       12
       +
        configure.ac                                |   6 +-

     

       13
       +
        flake.nix                                   |   1 +

     

       14
       +
        src/libstore/build/local-derivation-goal.cc | 221 ++++++++++----------

     

       15
       +
        3 files changed, 114 insertions(+), 114 deletions(-)

     

       16
       +
       

     

       17
       +
       diff --git a/configure.ac b/configure.ac

     

       18
       +
       index 4e50d0913..44852ad79 100644

     

       19
       +
       --- a/configure.ac

     

       20
       +
       +++ b/configure.ac

     

       21
       +
       @@ -58,13 +58,17 @@ AC_CHECK_TOOL([AR], [ar])

     

       22
       +
        AC_SYS_LARGEFILE

     

       23
       +
        

     

       24
       +
        

     

       25
       +
       -# Solaris-specific stuff.

     

       26
       +
       +# OS-specific stuff.

     

       27
       +
        AC_STRUCT_DIRENT_D_TYPE

     

       28
       +
        case "$host_os" in

     

       29
       +
          solaris*)

     

       30
       +
            # Solaris requires -lsocket -lnsl for network functions

     

       31
       +
            LDFLAGS="-lsocket -lnsl $LDFLAGS"

     

       32
       +
            ;;

     

       33
       +
       +  darwin*)

     

       34
       +
       +    # Need to link to libsandbox.

     

       35
       +
       +    LDFLAGS="-lsandbox $LDFLAGS"

     

       36
       +
       +    ;;

     

       37
       +
        esac

     

       38
       +
        

     

       39
       +
        

     

       40
       +
       diff --git a/flake.nix b/flake.nix

     

       41
       +
       index 6c9bef4d8..66ac1bfd8 100644

     

       42
       +
       --- a/flake.nix

     

       43
       +
       +++ b/flake.nix

     

       44
       +
       @@ -173,6 +173,7 @@

     

       45
       +
                    boost

     

       46
       +
                    lowdown-nix

     

       47
       +
                  ]

     

       48
       +
       +          ++ lib.optionals stdenv.isDarwin [darwin.apple_sdk.libs.sandbox]

     

       49
       +
                  ++ lib.optionals stdenv.isLinux [(libseccomp.overrideAttrs (_: rec {

     

       50
       +
                    version = "2.5.5";

     

       51
       +
                    src = fetchurl {

     

       52
       +
       diff --git a/src/libstore/build/local-derivation-goal.cc b/src/libstore/build/local-derivation-goal.cc

     

       53
       +
       index 4d690beaf..fb83cfdc7 100644

     

       54
       +
       --- a/src/libstore/build/local-derivation-goal.cc

     

       55
       +
       +++ b/src/libstore/build/local-derivation-goal.cc

     

       56
       +
       @@ -53,6 +53,10 @@

     

       57
       +
        #if __APPLE__

     

       58
       +
        #include <spawn.h>

     

       59
       +
        #include <sys/sysctl.h>

     

       60
       +
       +#include <sandbox.h>

     

       61
       +
       +

     

       62
       +
       +/* This definition is undocumented but depended upon by all major browsers. */

     

       63
       +
       +extern "C" int sandbox_init_with_parameters(const char *profile, uint64_t flags, const char *const parameters[], char **errorbuf);

     

       64
       +
        #endif

     

       65
       +
        

     

       66
       +
        #include <pwd.h>

     

       67
       +
       @@ -2034,141 +2038,132 @@ void LocalDerivationGoal::runChild()

     

       68
       +
        

     

       69
       +
                std::string builder = "invalid";

     

       70
       +
        

     

       71
       +
       -        if (drv->isBuiltin()) {

     

       72
       +
       -            ;

     

       73
       +
       -        }

     

       74
       +
        #if __APPLE__

     

       75
       +
       -        else {

     

       76
       +
       -            /* This has to appear before import statements. */

     

       77
       +
       -            std::string sandboxProfile = "(version 1)\n";

     

       78
       +
       -

     

       79
       +
       -            if (useChroot) {

     

       80
       +
       -

     

       81
       +
       -                /* Lots and lots and lots of file functions freak out if they can't stat their full ancestry */

     

       82
       +
       -                PathSet ancestry;

     

       83
       +
       -

     

       84
       +
       -                /* We build the ancestry before adding all inputPaths to the store because we know they'll

     

       85
       +
       -                   all have the same parents (the store), and there might be lots of inputs. This isn't

     

       86
       +
       -                   particularly efficient... I doubt it'll be a bottleneck in practice */

     

       87
       +
       -                for (auto & i : dirsInChroot) {

     

       88
       +
       -                    Path cur = i.first;

     

       89
       +
       -                    while (cur.compare("/") != 0) {

     

       90
       +
       -                        cur = dirOf(cur);

     

       91
       +
       -                        ancestry.insert(cur);

     

       92
       +
       -                    }

     

       93
       +
       -                }

     

       94
       +
       +        /* This has to appear before import statements. */

     

       95
       +
       +        std::string sandboxProfile = "(version 1)\n";

     

       96
       +
        

     

       97
       +
       -                /* And we want the store in there regardless of how empty dirsInChroot. We include the innermost

     

       98
       +
       -                   path component this time, since it's typically /nix/store and we care about that. */

     

       99
       +
       -                Path cur = worker.store.storeDir;

     

       100
       +
       +        if (useChroot) {

     

       101
       +
       +

     

       102
       +
       +            /* Lots and lots and lots of file functions freak out if they can't stat their full ancestry */

     

       103
       +
       +            PathSet ancestry;

     

       104
       +
       +

     

       105
       +
       +            /* We build the ancestry before adding all inputPaths to the store because we know they'll

     

       106
       +
       +                all have the same parents (the store), and there might be lots of inputs. This isn't

     

       107
       +
       +                particularly efficient... I doubt it'll be a bottleneck in practice */

     

       108
       +
       +            for (auto & i : dirsInChroot) {

     

       109
       +
       +                Path cur = i.first;

     

       110
       +
                        while (cur.compare("/") != 0) {

     

       111
       +
       -                    ancestry.insert(cur);

     

       112
       +
                            cur = dirOf(cur);

     

       113
       +
       +                    ancestry.insert(cur);

     

       114
       +
                        }

     

       115
       +
       +            }

     

       116
       +
        

     

       117
       +
       -                /* Add all our input paths to the chroot */

     

       118
       +
       -                for (auto & i : inputPaths) {

     

       119
       +
       -                    auto p = worker.store.printStorePath(i);

     

       120
       +
       -                    dirsInChroot[p] = p;

     

       121
       +
       -                }

     

       122
       +
       -

     

       123
       +
       -                /* Violations will go to the syslog if you set this. Unfortunately the destination does not appear to be configurable */

     

       124
       +
       -                if (settings.darwinLogSandboxViolations) {

     

       125
       +
       -                    sandboxProfile += "(deny default)\n";

     

       126
       +
       -                } else {

     

       127
       +
       -                    sandboxProfile += "(deny default (with no-log))\n";

     

       128
       +
       -                }

     

       129
       +
       +            /* And we want the store in there regardless of how empty dirsInChroot. We include the innermost

     

       130
       +
       +                path component this time, since it's typically /nix/store and we care about that. */

     

       131
       +
       +            Path cur = worker.store.storeDir;

     

       132
       +
       +            while (cur.compare("/") != 0) {

     

       133
       +
       +                ancestry.insert(cur);

     

       134
       +
       +                cur = dirOf(cur);

     

       135
       +
       +            }

     

       136
       +
        

     

       137
       +
       -                sandboxProfile +=

     

       138
       +
       -                    #include "sandbox-defaults.sb"

     

       139
       +
       -                    ;

     

       140
       +
       +            /* Add all our input paths to the chroot */

     

       141
       +
       +            for (auto & i : inputPaths) {

     

       142
       +
       +                auto p = worker.store.printStorePath(i);

     

       143
       +
       +                dirsInChroot[p] = p;

     

       144
       +
       +            }

     

       145
       +
        

     

       146
       +
       -                if (!derivationType->isSandboxed())

     

       147
       +
       -                    sandboxProfile +=

     

       148
       +
       -                        #include "sandbox-network.sb"

     

       149
       +
       -                        ;

     

       150
       +
       -

     

       151
       +
       -                /* Add the output paths we'll use at build-time to the chroot */

     

       152
       +
       -                sandboxProfile += "(allow file-read* file-write* process-exec\n";

     

       153
       +
       -                for (auto & [_, path] : scratchOutputs)

     

       154
       +
       -                    sandboxProfile += fmt("\t(subpath \"%s\")\n", worker.store.printStorePath(path));

     

       155
       +
       -

     

       156
       +
       -                sandboxProfile += ")\n";

     

       157
       +
       -

     

       158
       +
       -                /* Our inputs (transitive dependencies and any impurities computed above)

     

       159
       +
       -

     

       160
       +
       -                   without file-write* allowed, access() incorrectly returns EPERM

     

       161
       +
       -                 */

     

       162
       +
       -                sandboxProfile += "(allow file-read* file-write* process-exec\n";

     

       163
       +
       -                for (auto & i : dirsInChroot) {

     

       164
       +
       -                    if (i.first != i.second.source)

     

       165
       +
       -                        throw Error(

     

       166
       +
       -                            "can't map '%1%' to '%2%': mismatched impure paths not supported on Darwin",

     

       167
       +
       -                            i.first, i.second.source);

     

       168
       +
       -

     

       169
       +
       -                    std::string path = i.first;

     

       170
       +
       -                    struct stat st;

     

       171
       +
       -                    if (lstat(path.c_str(), &st)) {

     

       172
       +
       -                        if (i.second.optional && errno == ENOENT)

     

       173
       +
       -                            continue;

     

       174
       +
       -                        throw SysError("getting attributes of path '%s", path);

     

       175
       +
       -                    }

     

       176
       +
       -                    if (S_ISDIR(st.st_mode))

     

       177
       +
       -                        sandboxProfile += fmt("\t(subpath \"%s\")\n", path);

     

       178
       +
       -                    else

     

       179
       +
       -                        sandboxProfile += fmt("\t(literal \"%s\")\n", path);

     

       180
       +
       -                }

     

       181
       +
       -                sandboxProfile += ")\n";

     

       182
       +
       +            /* Violations will go to the syslog if you set this. Unfortunately the destination does not appear to be configurable */

     

       183
       +
       +            if (settings.darwinLogSandboxViolations) {

     

       184
       +
       +                sandboxProfile += "(deny default)\n";

     

       185
       +
       +            } else {

     

       186
       +
       +                sandboxProfile += "(deny default (with no-log))\n";

     

       187
       +
       +            }

     

       188
       +
        

     

       189
       +
       -                /* Allow file-read* on full directory hierarchy to self. Allows realpath() */

     

       190
       +
       -                sandboxProfile += "(allow file-read*\n";

     

       191
       +
       -                for (auto & i : ancestry) {

     

       192
       +
       -                    sandboxProfile += fmt("\t(literal \"%s\")\n", i);

     

       193
       +
       -                }

     

       194
       +
       -                sandboxProfile += ")\n";

     

       195
       +
       +            sandboxProfile +=

     

       196
       +
       +                #include "sandbox-defaults.sb"

     

       197
       +
       +                ;

     

       198
       +
        

     

       199
       +
       -                sandboxProfile += additionalSandboxProfile;

     

       200
       +
       -            } else

     

       201
       +
       +            if (!derivationType->isSandboxed())

     

       202
       +
                        sandboxProfile +=

     

       203
       +
       -                    #include "sandbox-minimal.sb"

     

       204
       +
       +                    #include "sandbox-network.sb"

     

       205
       +
                            ;

     

       206
       +
        

     

       207
       +
       -            debug("Generated sandbox profile:");

     

       208
       +
       -            debug(sandboxProfile);

     

       209
       +
       +            /* Add the output paths we'll use at build-time to the chroot */

     

       210
       +
       +            sandboxProfile += "(allow file-read* file-write* process-exec\n";

     

       211
       +
       +            for (auto & [_, path] : scratchOutputs)

     

       212
       +
       +                sandboxProfile += fmt("\t(subpath \"%s\")\n", worker.store.printStorePath(path));

     

       213
       +
        

     

       214
       +
       -            Path sandboxFile = tmpDir + "/.sandbox.sb";

     

       215
       +
       +            sandboxProfile += ")\n";

     

       216
       +
        

     

       217
       +
       -            writeFile(sandboxFile, sandboxProfile);

     

       218
       +
       +            /* Our inputs (transitive dependencies and any impurities computed above)

     

       219
       +
        

     

       220
       +
       -            bool allowLocalNetworking = parsedDrv->getBoolAttr("__darwinAllowLocalNetworking");

     

       221
       +
       +                without file-write* allowed, access() incorrectly returns EPERM

     

       222
       +
       +                */

     

       223
       +
       +            sandboxProfile += "(allow file-read* file-write* process-exec\n";

     

       224
       +
       +            for (auto & i : dirsInChroot) {

     

       225
       +
       +                if (i.first != i.second.source)

     

       226
       +
       +                    throw Error(

     

       227
       +
       +                        "can't map '%1%' to '%2%': mismatched impure paths not supported on Darwin",

     

       228
       +
       +                        i.first, i.second.source);

     

       229
       +
        

     

       230
       +
       -            /* The tmpDir in scope points at the temporary build directory for our derivation. Some packages try different mechanisms

     

       231
       +
       -               to find temporary directories, so we want to open up a broader place for them to dump their files, if needed. */

     

       232
       +
       -            Path globalTmpDir = canonPath(defaultTempDir(), true);

     

       233
       +
       +                std::string path = i.first;

     

       234
       +
       +                struct stat st;

     

       235
       +
       +                if (lstat(path.c_str(), &st)) {

     

       236
       +
       +                    if (i.second.optional && errno == ENOENT)

     

       237
       +
       +                        continue;

     

       238
       +
       +                    throw SysError("getting attributes of path '%s", path);

     

       239
       +
       +                }

     

       240
       +
       +                if (S_ISDIR(st.st_mode))

     

       241
       +
       +                    sandboxProfile += fmt("\t(subpath \"%s\")\n", path);

     

       242
       +
       +                else

     

       243
       +
       +                    sandboxProfile += fmt("\t(literal \"%s\")\n", path);

     

       244
       +
       +            }

     

       245
       +
       +            sandboxProfile += ")\n";

     

       246
       +
        

     

       247
       +
       -            /* They don't like trailing slashes on subpath directives */

     

       248
       +
       -            while (!globalTmpDir.empty() && globalTmpDir.back() == '/')

     

       249
       +
       -                globalTmpDir.pop_back();

     

       250
       +
       +            /* Allow file-read* on full directory hierarchy to self. Allows realpath() */

     

       251
       +
       +            sandboxProfile += "(allow file-read*\n";

     

       252
       +
       +            for (auto & i : ancestry) {

     

       253
       +
       +                sandboxProfile += fmt("\t(literal \"%s\")\n", i);

     

       254
       +
       +            }

     

       255
       +
       +            sandboxProfile += ")\n";

     

       256
       +
        

     

       257
       +
       -            if (getEnv("_NIX_TEST_NO_SANDBOX") != "1") {

     

       258
       +
       -                builder = "/usr/bin/sandbox-exec";

     

       259
       +
       -                args.push_back("sandbox-exec");

     

       260
       +
       -                args.push_back("-f");

     

       261
       +
       -                args.push_back(sandboxFile);

     

       262
       +
       -                args.push_back("-D");

     

       263
       +
       -                args.push_back("_GLOBAL_TMP_DIR=" + globalTmpDir);

     

       264
       +
       -                if (allowLocalNetworking) {

     

       265
       +
       -                    args.push_back("-D");

     

       266
       +
       -                    args.push_back(std::string("_ALLOW_LOCAL_NETWORKING=1"));

     

       267
       +
       -                }

     

       268
       +
       -                args.push_back(drv->builder);

     

       269
       +
       -            } else {

     

       270
       +
       -                builder = drv->builder;

     

       271
       +
       -                args.push_back(std::string(baseNameOf(drv->builder)));

     

       272
       +
       +            sandboxProfile += additionalSandboxProfile;

     

       273
       +
       +        } else

     

       274
       +
       +            sandboxProfile +=

     

       275
       +
       +                #include "sandbox-minimal.sb"

     

       276
       +
       +                ;

     

       277
       +
       +

     

       278
       +
       +        debug("Generated sandbox profile:");

     

       279
       +
       +        debug(sandboxProfile);

     

       280
       +
       +

     

       281
       +
       +        bool allowLocalNetworking = parsedDrv->getBoolAttr("__darwinAllowLocalNetworking");

     

       282
       +
       +

     

       283
       +
       +        /* The tmpDir in scope points at the temporary build directory for our derivation. Some packages try different mechanisms

     

       284
       +
       +            to find temporary directories, so we want to open up a broader place for them to dump their files, if needed. */

     

       285
       +
       +        Path globalTmpDir = canonPath(defaultTempDir(), true);

     

       286
       +
       +

     

       287
       +
       +        /* They don't like trailing slashes on subpath directives */

     

       288
       +
       +        while (!globalTmpDir.empty() && globalTmpDir.back() == '/')

     

       289
       +
       +            globalTmpDir.pop_back();

     

       290
       +
       +

     

       291
       +
       +        if (getEnv("_NIX_TEST_NO_SANDBOX") != "1") {

     

       292
       +
       +            Strings sandboxArgs;

     

       293
       +
       +            sandboxArgs.push_back("_GLOBAL_TMP_DIR");

     

       294
       +
       +            sandboxArgs.push_back(globalTmpDir);

     

       295
       +
       +            if (allowLocalNetworking) {

     

       296
       +
       +                sandboxArgs.push_back("_ALLOW_LOCAL_NETWORKING");

     

       297
       +
       +                sandboxArgs.push_back("1");

     

       298
       +
       +            }

     

       299
       +
       +            if (sandbox_init_with_parameters(sandboxProfile.c_str(), 0, stringsToCharPtrs(sandboxArgs).data(), NULL)) {

     

       300
       +
       +                writeFull(STDERR_FILENO, "failed to configure sandbox\n");

     

       301
       +
       +                _exit(1);

     

       302
       +
                    }

     

       303
       +
                }

     

       304
       +
       +

     

       305
       +
       +        builder = drv->builder;

     

       306
       +
       +        args.push_back(std::string(baseNameOf(drv->builder)));

     

       307
       +
        #else

     

       308
       +
       -        else {

     

       309
       +
       +        if (!drv->isBuiltin()) {

     

       310
       +
                    builder = drv->builder;

     

       311
       +
                    args.push_back(std::string(baseNameOf(drv->builder)));

     

       312
       +
                }

     

       313
       +
       -- 

     

       314
       +
       2.46.1

     

       315
       +

+34

pkgs/tools/package-management/nix/patches/2_18/0002-local-derivation-goal-Print-sandbox-error-detail-on-.patch

···

       1
       +
       From 4ac099d6ab4b6851aeb8b7a1e37f5794716d5138 Mon Sep 17 00:00:00 2001

     

       2
       +
       From: Robert Hensing <robert@roberthensing.nl>

     

       3
       +
       Date: Thu, 3 Oct 2024 12:44:12 +0200

     

       4
       +
       Subject: [PATCH 2/4] local-derivation-goal: Print sandbox error detail on

     

       5
       +
        darwin

     

       6
       +
       MIME-Version: 1.0

     

       7
       +
       Content-Type: text/plain; charset=UTF-8

     

       8
       +
       Content-Transfer-Encoding: 8bit

     

       9
       +
       

     

       10
       +
       Co-Authored-By: Théophane Hufschmitt <theophane.hufschmitt@tweag.io>

     

       11
       +
       Signed-off-by: Jörg Thalheim <joerg@thalheim.io>

     

       12
       +
       ---

     

       13
       +
        src/libstore/build/local-derivation-goal.cc | 5 +++--

     

       14
       +
        1 file changed, 3 insertions(+), 2 deletions(-)

     

       15
       +
       

     

       16
       +
       diff --git a/src/libstore/build/local-derivation-goal.cc b/src/libstore/build/local-derivation-goal.cc

     

       17
       +
       index fb83cfdc7..d41d1c1e5 100644

     

       18
       +
       --- a/src/libstore/build/local-derivation-goal.cc

     

       19
       +
       +++ b/src/libstore/build/local-derivation-goal.cc

     

       20
       +
       @@ -2154,8 +2154,9 @@ void LocalDerivationGoal::runChild()

     

       21
       +
                        sandboxArgs.push_back("_ALLOW_LOCAL_NETWORKING");

     

       22
       +
                        sandboxArgs.push_back("1");

     

       23
       +
                    }

     

       24
       +
       -            if (sandbox_init_with_parameters(sandboxProfile.c_str(), 0, stringsToCharPtrs(sandboxArgs).data(), NULL)) {

     

       25
       +
       -                writeFull(STDERR_FILENO, "failed to configure sandbox\n");

     

       26
       +
       +            char * sandbox_errbuf = nullptr;

     

       27
       +
       +            if (sandbox_init_with_parameters(sandboxProfile.c_str(), 0, stringsToCharPtrs(sandboxArgs).data(), &sandbox_errbuf)) {

     

       28
       +
       +                writeFull(STDERR_FILENO, fmt("failed to configure sandbox: %s\n", sandbox_errbuf ? sandbox_errbuf : "(null)"));

     

       29
       +
                        _exit(1);

     

       30
       +
                    }

     

       31
       +
                }

     

       32
       +
       -- 

     

       33
       +
       2.46.1

     

       34
       +

+41

pkgs/tools/package-management/nix/patches/2_18/0003-local-derivation-goal-Refactor.patch

···

       1
       +
       From 6fe3a5e26def808b99856099d74aa3017ecf6d9d Mon Sep 17 00:00:00 2001

     

       2
       +
       From: Robert Hensing <robert@roberthensing.nl>

     

       3
       +
       Date: Thu, 3 Oct 2024 12:50:27 +0200

     

       4
       +
       Subject: [PATCH 3/4] local-derivation-goal: Refactor

     

       5
       +
       MIME-Version: 1.0

     

       6
       +
       Content-Type: text/plain; charset=UTF-8

     

       7
       +
       Content-Transfer-Encoding: 8bit

     

       8
       +
       

     

       9
       +
       This works because the `builder` and `args` variables are only used

     

       10
       +
       in the non-builtin code path.

     

       11
       +
       

     

       12
       +
       Co-Authored-By: Théophane Hufschmitt <theophane.hufschmitt@tweag.io>

     

       13
       +
       Signed-off-by: Jörg Thalheim <joerg@thalheim.io>

     

       14
       +
       ---

     

       15
       +
        src/libstore/build/local-derivation-goal.cc | 5 +----

     

       16
       +
        1 file changed, 1 insertion(+), 4 deletions(-)

     

       17
       +
       

     

       18
       +
       diff --git a/src/libstore/build/local-derivation-goal.cc b/src/libstore/build/local-derivation-goal.cc

     

       19
       +
       index d41d1c1e5..faecc403b 100644

     

       20
       +
       --- a/src/libstore/build/local-derivation-goal.cc

     

       21
       +
       +++ b/src/libstore/build/local-derivation-goal.cc

     

       22
       +
       @@ -2160,15 +2160,12 @@ void LocalDerivationGoal::runChild()

     

       23
       +
                        _exit(1);

     

       24
       +
                    }

     

       25
       +
                }

     

       26
       +
       +#endif

     

       27
       +
        

     

       28
       +
       -        builder = drv->builder;

     

       29
       +
       -        args.push_back(std::string(baseNameOf(drv->builder)));

     

       30
       +
       -#else

     

       31
       +
                if (!drv->isBuiltin()) {

     

       32
       +
                    builder = drv->builder;

     

       33
       +
                    args.push_back(std::string(baseNameOf(drv->builder)));

     

       34
       +
                }

     

       35
       +
       -#endif

     

       36
       +
        

     

       37
       +
                for (auto & i : drv->args)

     

       38
       +
                    args.push_back(rewriteStrings(i, inputRewrites));

     

       39
       +
       -- 

     

       40
       +
       2.46.1

     

       41
       +

+75

pkgs/tools/package-management/nix/patches/2_18/0004-local-derivation-goal-Move-builder-preparation-to-no.patch

···

       1
       +
       From d219faa93badcfc8134c81ba0d2b821775eb947c Mon Sep 17 00:00:00 2001

     

       2
       +
       From: Robert Hensing <robert@roberthensing.nl>

     

       3
       +
       Date: Thu, 3 Oct 2024 12:57:00 +0200

     

       4
       +
       Subject: [PATCH 4/4] local-derivation-goal: Move builder preparation to

     

       5
       +
        non-builtin code path

     

       6
       +
       MIME-Version: 1.0

     

       7
       +
       Content-Type: text/plain; charset=UTF-8

     

       8
       +
       Content-Transfer-Encoding: 8bit

     

       9
       +
       

     

       10
       +
       Signed-off-by: Jörg Thalheim <joerg@thalheim.io>

     

       11
       +
       ---

     

       12
       +
        src/libstore/build/local-derivation-goal.cc | 25 +++++++++------------

     

       13
       +
        1 file changed, 10 insertions(+), 15 deletions(-)

     

       14
       +
       

     

       15
       +
       diff --git a/src/libstore/build/local-derivation-goal.cc b/src/libstore/build/local-derivation-goal.cc

     

       16
       +
       index faecc403b..23d5d5e3f 100644

     

       17
       +
       --- a/src/libstore/build/local-derivation-goal.cc

     

       18
       +
       +++ b/src/libstore/build/local-derivation-goal.cc

     

       19
       +
       @@ -2033,11 +2033,6 @@ void LocalDerivationGoal::runChild()

     

       20
       +
                        throw SysError("setuid failed");

     

       21
       +
                }

     

       22
       +
        

     

       23
       +
       -        /* Fill in the arguments. */

     

       24
       +
       -        Strings args;

     

       25
       +
       -

     

       26
       +
       -        std::string builder = "invalid";

     

       27
       +
       -

     

       28
       +
        #if __APPLE__

     

       29
       +
                /* This has to appear before import statements. */

     

       30
       +
                std::string sandboxProfile = "(version 1)\n";

     

       31
       +
       @@ -2162,14 +2157,6 @@ void LocalDerivationGoal::runChild()

     

       32
       +
                }

     

       33
       +
        #endif

     

       34
       +
        

     

       35
       +
       -        if (!drv->isBuiltin()) {

     

       36
       +
       -            builder = drv->builder;

     

       37
       +
       -            args.push_back(std::string(baseNameOf(drv->builder)));

     

       38
       +
       -        }

     

       39
       +
       -

     

       40
       +
       -        for (auto & i : drv->args)

     

       41
       +
       -            args.push_back(rewriteStrings(i, inputRewrites));

     

       42
       +
       -

     

       43
       +
                /* Indicate that we managed to set up the build environment. */

     

       44
       +
                writeFull(STDERR_FILENO, std::string("\2\n"));

     

       45
       +
        

     

       46
       +
       @@ -2199,6 +2186,14 @@ void LocalDerivationGoal::runChild()

     

       47
       +
                    }

     

       48
       +
                }

     

       49
       +
        

     

       50
       +
       +        // Now builder is not builtin

     

       51
       +
       +

     

       52
       +
       +        Strings args;

     

       53
       +
       +        args.push_back(std::string(baseNameOf(drv->builder)));

     

       54
       +
       +

     

       55
       +
       +        for (auto & i : drv->args)

     

       56
       +
       +            args.push_back(rewriteStrings(i, inputRewrites));

     

       57
       +
       +

     

       58
       +
        #if __APPLE__

     

       59
       +
                posix_spawnattr_t attrp;

     

       60
       +
        

     

       61
       +
       @@ -2220,9 +2215,9 @@ void LocalDerivationGoal::runChild()

     

       62
       +
                    posix_spawnattr_setbinpref_np(&attrp, 1, &cpu, NULL);

     

       63
       +
                }

     

       64
       +
        

     

       65
       +
       -        posix_spawn(NULL, builder.c_str(), NULL, &attrp, stringsToCharPtrs(args).data(), stringsToCharPtrs(envStrs).data());

     

       66
       +
       +        posix_spawn(NULL, drv->builder.c_str(), NULL, &attrp, stringsToCharPtrs(args).data(), stringsToCharPtrs(envStrs).data());

     

       67
       +
        #else

     

       68
       +
       -        execve(builder.c_str(), stringsToCharPtrs(args).data(), stringsToCharPtrs(envStrs).data());

     

       69
       +
       +        execve(drv->builder.c_str(), stringsToCharPtrs(args).data(), stringsToCharPtrs(envStrs).data());

     

       70
       +
        #endif

     

       71
       +
        

     

       72
       +
                throw SysError("executing '%1%'", drv->builder);

     

       73
       +
       -- 

     

       74
       +
       2.46.1

     

       75
       +

+312

pkgs/tools/package-management/nix/patches/2_19/0001-fix-Run-all-derivation-builders-inside-the-sandbox-o.patch

···

       1
       +
       From 172734f47a8062285cec0055133efcc45df03e54 Mon Sep 17 00:00:00 2001

     

       2
       +
       From: Puck Meerburg <puck@puckipedia.com>

     

       3
       +
       Date: Fri, 1 Mar 2024 11:42:24 -0500

     

       4
       +
       Subject: [PATCH 1/4] fix: Run all derivation builders inside the sandbox on

     

       5
       +
        macOS

     

       6
       +
       MIME-Version: 1.0

     

       7
       +
       Content-Type: text/plain; charset=UTF-8

     

       8
       +
       Content-Transfer-Encoding: 8bit

     

       9
       +
       

     

       10
       +
       Signed-off-by: Jörg Thalheim <joerg@thalheim.io>

     

       11
       +
       ---

     

       12
       +
        configure.ac                                |   6 +-

     

       13
       +
        flake.nix                                   |   1 +

     

       14
       +
        src/libstore/build/local-derivation-goal.cc | 217 ++++++++++----------

     

       15
       +
        3 files changed, 112 insertions(+), 112 deletions(-)

     

       16
       +
       

     

       17
       +
       diff --git a/configure.ac b/configure.ac

     

       18
       +
       index 281ba2c32..6d73804e2 100644

     

       19
       +
       --- a/configure.ac

     

       20
       +
       +++ b/configure.ac

     

       21
       +
       @@ -58,13 +58,17 @@ AC_CHECK_TOOL([AR], [ar])

     

       22
       +
        AC_SYS_LARGEFILE

     

       23
       +
        

     

       24
       +
        

     

       25
       +
       -# Solaris-specific stuff.

     

       26
       +
       +# OS-specific stuff.

     

       27
       +
        AC_STRUCT_DIRENT_D_TYPE

     

       28
       +
        case "$host_os" in

     

       29
       +
          solaris*)

     

       30
       +
            # Solaris requires -lsocket -lnsl for network functions

     

       31
       +
            LDFLAGS="-lsocket -lnsl $LDFLAGS"

     

       32
       +
            ;;

     

       33
       +
       +  darwin*)

     

       34
       +
       +    # Need to link to libsandbox.

     

       35
       +
       +    LDFLAGS="-lsandbox $LDFLAGS"

     

       36
       +
       +    ;;

     

       37
       +
        esac

     

       38
       +
        

     

       39
       +
        

     

       40
       +
       diff --git a/flake.nix b/flake.nix

     

       41
       +
       index 6deb09f22..98f9cc25f 100644

     

       42
       +
       --- a/flake.nix

     

       43
       +
       +++ b/flake.nix

     

       44
       +
       @@ -202,6 +202,7 @@

     

       45
       +
                    libsodium

     

       46
       +
                  ]

     

       47
       +
                  ++ lib.optionals stdenv.isLinux [libseccomp]

     

       48
       +
       +          ++ lib.optionals stdenv.isDarwin [darwin.apple_sdk.libs.sandbox]

     

       49
       +
                  ++ lib.optional stdenv.hostPlatform.isx86_64 libcpuid;

     

       50
       +
        

     

       51
       +
                checkDeps = [

     

       52
       +
       diff --git a/src/libstore/build/local-derivation-goal.cc b/src/libstore/build/local-derivation-goal.cc

     

       53
       +
       index b6c7666e5..effd9c613 100644

     

       54
       +
       --- a/src/libstore/build/local-derivation-goal.cc

     

       55
       +
       +++ b/src/libstore/build/local-derivation-goal.cc

     

       56
       +
       @@ -55,6 +55,10 @@

     

       57
       +
        #if __APPLE__

     

       58
       +
        #include <spawn.h>

     

       59
       +
        #include <sys/sysctl.h>

     

       60
       +
       +#include <sandbox.h>

     

       61
       +
       +

     

       62
       +
       +/* This definition is undocumented but depended upon by all major browsers. */

     

       63
       +
       +extern "C" int sandbox_init_with_parameters(const char *profile, uint64_t flags, const char *const parameters[], char **errorbuf);

     

       64
       +
        #endif

     

       65
       +
        

     

       66
       +
        #include <pwd.h>

     

       67
       +
       @@ -2031,140 +2035,131 @@ void LocalDerivationGoal::runChild()

     

       68
       +
        

     

       69
       +
                std::string builder = "invalid";

     

       70
       +
        

     

       71
       +
       -        if (drv->isBuiltin()) {

     

       72
       +
       -            ;

     

       73
       +
       -        }

     

       74
       +
        #if __APPLE__

     

       75
       +
       -        else {

     

       76
       +
       -            /* This has to appear before import statements. */

     

       77
       +
       -            std::string sandboxProfile = "(version 1)\n";

     

       78
       +
       -

     

       79
       +
       -            if (useChroot) {

     

       80
       +
       -

     

       81
       +
       -                /* Lots and lots and lots of file functions freak out if they can't stat their full ancestry */

     

       82
       +
       -                PathSet ancestry;

     

       83
       +
       -

     

       84
       +
       -                /* We build the ancestry before adding all inputPaths to the store because we know they'll

     

       85
       +
       -                   all have the same parents (the store), and there might be lots of inputs. This isn't

     

       86
       +
       -                   particularly efficient... I doubt it'll be a bottleneck in practice */

     

       87
       +
       -                for (auto & i : pathsInChroot) {

     

       88
       +
       -                    Path cur = i.first;

     

       89
       +
       -                    while (cur.compare("/") != 0) {

     

       90
       +
       -                        cur = dirOf(cur);

     

       91
       +
       -                        ancestry.insert(cur);

     

       92
       +
       -                    }

     

       93
       +
       -                }

     

       94
       +
       +        /* This has to appear before import statements. */

     

       95
       +
       +        std::string sandboxProfile = "(version 1)\n";

     

       96
       +
        

     

       97
       +
       -                /* And we want the store in there regardless of how empty pathsInChroot. We include the innermost

     

       98
       +
       -                   path component this time, since it's typically /nix/store and we care about that. */

     

       99
       +
       -                Path cur = worker.store.storeDir;

     

       100
       +
       +        if (useChroot) {

     

       101
       +
       +

     

       102
       +
       +            /* Lots and lots and lots of file functions freak out if they can't stat their full ancestry */

     

       103
       +
       +            PathSet ancestry;

     

       104
       +
       +

     

       105
       +
       +            /* We build the ancestry before adding all inputPaths to the store because we know they'll

     

       106
       +
       +                all have the same parents (the store), and there might be lots of inputs. This isn't

     

       107
       +
       +                particularly efficient... I doubt it'll be a bottleneck in practice */

     

       108
       +
       +            for (auto & i : pathsInChroot) {

     

       109
       +
       +                Path cur = i.first;

     

       110
       +
                        while (cur.compare("/") != 0) {

     

       111
       +
       -                    ancestry.insert(cur);

     

       112
       +
                            cur = dirOf(cur);

     

       113
       +
       +                    ancestry.insert(cur);

     

       114
       +
                        }

     

       115
       +
       +            }

     

       116
       +
        

     

       117
       +
       -                /* Add all our input paths to the chroot */

     

       118
       +
       -                for (auto & i : inputPaths) {

     

       119
       +
       -                    auto p = worker.store.printStorePath(i);

     

       120
       +
       -                    pathsInChroot[p] = p;

     

       121
       +
       -                }

     

       122
       +
       +            /* And we want the store in there regardless of how empty pathsInChroot. We include the innermost

     

       123
       +
       +                path component this time, since it's typically /nix/store and we care about that. */

     

       124
       +
       +            Path cur = worker.store.storeDir;

     

       125
       +
       +            while (cur.compare("/") != 0) {

     

       126
       +
       +                ancestry.insert(cur);

     

       127
       +
       +                cur = dirOf(cur);

     

       128
       +
       +            }

     

       129
       +
        

     

       130
       +
       -                /* Violations will go to the syslog if you set this. Unfortunately the destination does not appear to be configurable */

     

       131
       +
       -                if (settings.darwinLogSandboxViolations) {

     

       132
       +
       -                    sandboxProfile += "(deny default)\n";

     

       133
       +
       -                } else {

     

       134
       +
       -                    sandboxProfile += "(deny default (with no-log))\n";

     

       135
       +
       -                }

     

       136
       +
       +            /* Add all our input paths to the chroot */

     

       137
       +
       +            for (auto & i : inputPaths) {

     

       138
       +
       +                auto p = worker.store.printStorePath(i);

     

       139
       +
       +                pathsInChroot[p] = p;

     

       140
       +
       +            }

     

       141
       +
       +

     

       142
       +
       +            /* Violations will go to the syslog if you set this. Unfortunately the destination does not appear to be configurable */

     

       143
       +
       +            if (settings.darwinLogSandboxViolations) {

     

       144
       +
       +                sandboxProfile += "(deny default)\n";

     

       145
       +
       +            } else {

     

       146
       +
       +                sandboxProfile += "(deny default (with no-log))\n";

     

       147
       +
       +            }

     

       148
       +
        

     

       149
       +
       +            sandboxProfile +=

     

       150
       +
       +                #include "sandbox-defaults.sb"

     

       151
       +
       +                ;

     

       152
       +
       +

     

       153
       +
       +            if (!derivationType->isSandboxed())

     

       154
       +
                        sandboxProfile +=

     

       155
       +
       -                    #include "sandbox-defaults.sb"

     

       156
       +
       +                    #include "sandbox-network.sb"

     

       157
       +
                            ;

     

       158
       +
        

     

       159
       +
       -                if (!derivationType->isSandboxed())

     

       160
       +
       -                    sandboxProfile +=

     

       161
       +
       -                        #include "sandbox-network.sb"

     

       162
       +
       -                        ;

     

       163
       +
       -

     

       164
       +
       -                /* Add the output paths we'll use at build-time to the chroot */

     

       165
       +
       -                sandboxProfile += "(allow file-read* file-write* process-exec\n";

     

       166
       +
       -                for (auto & [_, path] : scratchOutputs)

     

       167
       +
       -                    sandboxProfile += fmt("\t(subpath \"%s\")\n", worker.store.printStorePath(path));

     

       168
       +
       -

     

       169
       +
       -                sandboxProfile += ")\n";

     

       170
       +
       -

     

       171
       +
       -                /* Our inputs (transitive dependencies and any impurities computed above)

     

       172
       +
       -

     

       173
       +
       -                   without file-write* allowed, access() incorrectly returns EPERM

     

       174
       +
       -                 */

     

       175
       +
       -                sandboxProfile += "(allow file-read* file-write* process-exec\n";

     

       176
       +
       -                for (auto & i : pathsInChroot) {

     

       177
       +
       -                    if (i.first != i.second.source)

     

       178
       +
       -                        throw Error(

     

       179
       +
       -                            "can't map '%1%' to '%2%': mismatched impure paths not supported on Darwin",

     

       180
       +
       -                            i.first, i.second.source);

     

       181
       +
       -

     

       182
       +
       -                    std::string path = i.first;

     

       183
       +
       -                    struct stat st;

     

       184
       +
       -                    if (lstat(path.c_str(), &st)) {

     

       185
       +
       -                        if (i.second.optional && errno == ENOENT)

     

       186
       +
       -                            continue;

     

       187
       +
       -                        throw SysError("getting attributes of path '%s", path);

     

       188
       +
       -                    }

     

       189
       +
       -                    if (S_ISDIR(st.st_mode))

     

       190
       +
       -                        sandboxProfile += fmt("\t(subpath \"%s\")\n", path);

     

       191
       +
       -                    else

     

       192
       +
       -                        sandboxProfile += fmt("\t(literal \"%s\")\n", path);

     

       193
       +
       -                }

     

       194
       +
       -                sandboxProfile += ")\n";

     

       195
       +
       +            /* Add the output paths we'll use at build-time to the chroot */

     

       196
       +
       +            sandboxProfile += "(allow file-read* file-write* process-exec\n";

     

       197
       +
       +            for (auto & [_, path] : scratchOutputs)

     

       198
       +
       +                sandboxProfile += fmt("\t(subpath \"%s\")\n", worker.store.printStorePath(path));

     

       199
       +
        

     

       200
       +
       -                /* Allow file-read* on full directory hierarchy to self. Allows realpath() */

     

       201
       +
       -                sandboxProfile += "(allow file-read*\n";

     

       202
       +
       -                for (auto & i : ancestry) {

     

       203
       +
       -                    sandboxProfile += fmt("\t(literal \"%s\")\n", i);

     

       204
       +
       -                }

     

       205
       +
       -                sandboxProfile += ")\n";

     

       206
       +
       +            sandboxProfile += ")\n";

     

       207
       +
        

     

       208
       +
       -                sandboxProfile += additionalSandboxProfile;

     

       209
       +
       -            } else

     

       210
       +
       -                sandboxProfile +=

     

       211
       +
       -                    #include "sandbox-minimal.sb"

     

       212
       +
       -                    ;

     

       213
       +
       +            /* Our inputs (transitive dependencies and any impurities computed above)

     

       214
       +
       +

     

       215
       +
       +                without file-write* allowed, access() incorrectly returns EPERM

     

       216
       +
       +                */

     

       217
       +
       +            sandboxProfile += "(allow file-read* file-write* process-exec\n";

     

       218
       +
       +            for (auto & i : pathsInChroot) {

     

       219
       +
       +                if (i.first != i.second.source)

     

       220
       +
       +                    throw Error(

     

       221
       +
       +                        "can't map '%1%' to '%2%': mismatched impure paths not supported on Darwin",

     

       222
       +
       +                        i.first, i.second.source);

     

       223
       +
       +

     

       224
       +
       +                std::string path = i.first;

     

       225
       +
       +                struct stat st;

     

       226
       +
       +                if (lstat(path.c_str(), &st)) {

     

       227
       +
       +                    if (i.second.optional && errno == ENOENT)

     

       228
       +
       +                        continue;

     

       229
       +
       +                    throw SysError("getting attributes of path '%s", path);

     

       230
       +
       +                }

     

       231
       +
       +                if (S_ISDIR(st.st_mode))

     

       232
       +
       +                    sandboxProfile += fmt("\t(subpath \"%s\")\n", path);

     

       233
       +
       +                else

     

       234
       +
       +                    sandboxProfile += fmt("\t(literal \"%s\")\n", path);

     

       235
       +
       +            }

     

       236
       +
       +            sandboxProfile += ")\n";

     

       237
       +
        

     

       238
       +
       -            debug("Generated sandbox profile:");

     

       239
       +
       -            debug(sandboxProfile);

     

       240
       +
       +            /* Allow file-read* on full directory hierarchy to self. Allows realpath() */

     

       241
       +
       +            sandboxProfile += "(allow file-read*\n";

     

       242
       +
       +            for (auto & i : ancestry) {

     

       243
       +
       +                sandboxProfile += fmt("\t(literal \"%s\")\n", i);

     

       244
       +
       +            }

     

       245
       +
       +            sandboxProfile += ")\n";

     

       246
       +
        

     

       247
       +
       -            Path sandboxFile = tmpDir + "/.sandbox.sb";

     

       248
       +
       +            sandboxProfile += additionalSandboxProfile;

     

       249
       +
       +        } else

     

       250
       +
       +            sandboxProfile +=

     

       251
       +
       +                #include "sandbox-minimal.sb"

     

       252
       +
       +                ;

     

       253
       +
        

     

       254
       +
       -            writeFile(sandboxFile, sandboxProfile);

     

       255
       +
       +        debug("Generated sandbox profile:");

     

       256
       +
       +        debug(sandboxProfile);

     

       257
       +
        

     

       258
       +
       -            bool allowLocalNetworking = parsedDrv->getBoolAttr("__darwinAllowLocalNetworking");

     

       259
       +
       +        bool allowLocalNetworking = parsedDrv->getBoolAttr("__darwinAllowLocalNetworking");

     

       260
       +
        

     

       261
       +
       -            /* The tmpDir in scope points at the temporary build directory for our derivation. Some packages try different mechanisms

     

       262
       +
       -               to find temporary directories, so we want to open up a broader place for them to dump their files, if needed. */

     

       263
       +
       -            Path globalTmpDir = canonPath(getEnvNonEmpty("TMPDIR").value_or("/tmp"), true);

     

       264
       +
       +        /* The tmpDir in scope points at the temporary build directory for our derivation. Some packages try different mechanisms

     

       265
       +
       +            to find temporary directories, so we want to open up a broader place for them to dump their files, if needed. */

     

       266
       +
       +        Path globalTmpDir = canonPath(getEnvNonEmpty("TMPDIR").value_or("/tmp"), true);

     

       267
       +
        

     

       268
       +
       -            /* They don't like trailing slashes on subpath directives */

     

       269
       +
       -            if (globalTmpDir.back() == '/') globalTmpDir.pop_back();

     

       270
       +
       +        /* They don't like trailing slashes on subpath directives */

     

       271
       +
       +        if (globalTmpDir.back() == '/') globalTmpDir.pop_back();

     

       272
       +
        

     

       273
       +
       -            if (getEnv("_NIX_TEST_NO_SANDBOX") != "1") {

     

       274
       +
       -                builder = "/usr/bin/sandbox-exec";

     

       275
       +
       -                args.push_back("sandbox-exec");

     

       276
       +
       -                args.push_back("-f");

     

       277
       +
       -                args.push_back(sandboxFile);

     

       278
       +
       -                args.push_back("-D");

     

       279
       +
       -                args.push_back("_GLOBAL_TMP_DIR=" + globalTmpDir);

     

       280
       +
       -                if (allowLocalNetworking) {

     

       281
       +
       -                    args.push_back("-D");

     

       282
       +
       -                    args.push_back(std::string("_ALLOW_LOCAL_NETWORKING=1"));

     

       283
       +
       -                }

     

       284
       +
       -                args.push_back(drv->builder);

     

       285
       +
       -            } else {

     

       286
       +
       -                builder = drv->builder;

     

       287
       +
       -                args.push_back(std::string(baseNameOf(drv->builder)));

     

       288
       +
       +        if (getEnv("_NIX_TEST_NO_SANDBOX") != "1") {

     

       289
       +
       +            Strings sandboxArgs;

     

       290
       +
       +            sandboxArgs.push_back("_GLOBAL_TMP_DIR");

     

       291
       +
       +            sandboxArgs.push_back(globalTmpDir);

     

       292
       +
       +            if (allowLocalNetworking) {

     

       293
       +
       +                sandboxArgs.push_back("_ALLOW_LOCAL_NETWORKING");

     

       294
       +
       +                sandboxArgs.push_back("1");

     

       295
       +
       +            }

     

       296
       +
       +            if (sandbox_init_with_parameters(sandboxProfile.c_str(), 0, stringsToCharPtrs(sandboxArgs).data(), NULL)) {

     

       297
       +
       +                writeFull(STDERR_FILENO, "failed to configure sandbox\n");

     

       298
       +
       +                _exit(1);

     

       299
       +
                    }

     

       300
       +
                }

     

       301
       +
       +

     

       302
       +
       +        builder = drv->builder;

     

       303
       +
       +        args.push_back(std::string(baseNameOf(drv->builder)));

     

       304
       +
        #else

     

       305
       +
       -        else {

     

       306
       +
       +        if (!drv->isBuiltin()) {

     

       307
       +
                    builder = drv->builder;

     

       308
       +
                    args.push_back(std::string(baseNameOf(drv->builder)));

     

       309
       +
                }

     

       310
       +
       -- 

     

       311
       +
       2.46.1

     

       312
       +

+34

pkgs/tools/package-management/nix/patches/2_19/0002-local-derivation-goal-Print-sandbox-error-detail-on-.patch

···

       1
       +
       From 4a5018019e969537fdba36314fe5c19fe91828af Mon Sep 17 00:00:00 2001

     

       2
       +
       From: Robert Hensing <robert@roberthensing.nl>

     

       3
       +
       Date: Thu, 3 Oct 2024 12:44:12 +0200

     

       4
       +
       Subject: [PATCH 2/4] local-derivation-goal: Print sandbox error detail on

     

       5
       +
        darwin

     

       6
       +
       MIME-Version: 1.0

     

       7
       +
       Content-Type: text/plain; charset=UTF-8

     

       8
       +
       Content-Transfer-Encoding: 8bit

     

       9
       +
       

     

       10
       +
       Co-Authored-By: Théophane Hufschmitt <theophane.hufschmitt@tweag.io>

     

       11
       +
       Signed-off-by: Jörg Thalheim <joerg@thalheim.io>

     

       12
       +
       ---

     

       13
       +
        src/libstore/build/local-derivation-goal.cc | 5 +++--

     

       14
       +
        1 file changed, 3 insertions(+), 2 deletions(-)

     

       15
       +
       

     

       16
       +
       diff --git a/src/libstore/build/local-derivation-goal.cc b/src/libstore/build/local-derivation-goal.cc

     

       17
       +
       index effd9c613..a67347b59 100644

     

       18
       +
       --- a/src/libstore/build/local-derivation-goal.cc

     

       19
       +
       +++ b/src/libstore/build/local-derivation-goal.cc

     

       20
       +
       @@ -2150,8 +2150,9 @@ void LocalDerivationGoal::runChild()

     

       21
       +
                        sandboxArgs.push_back("_ALLOW_LOCAL_NETWORKING");

     

       22
       +
                        sandboxArgs.push_back("1");

     

       23
       +
                    }

     

       24
       +
       -            if (sandbox_init_with_parameters(sandboxProfile.c_str(), 0, stringsToCharPtrs(sandboxArgs).data(), NULL)) {

     

       25
       +
       -                writeFull(STDERR_FILENO, "failed to configure sandbox\n");

     

       26
       +
       +            char * sandbox_errbuf = nullptr;

     

       27
       +
       +            if (sandbox_init_with_parameters(sandboxProfile.c_str(), 0, stringsToCharPtrs(sandboxArgs).data(), &sandbox_errbuf)) {

     

       28
       +
       +                writeFull(STDERR_FILENO, fmt("failed to configure sandbox: %s\n", sandbox_errbuf ? sandbox_errbuf : "(null)"));

     

       29
       +
                        _exit(1);

     

       30
       +
                    }

     

       31
       +
                }

     

       32
       +
       -- 

     

       33
       +
       2.46.1

     

       34
       +

+41

pkgs/tools/package-management/nix/patches/2_19/0003-local-derivation-goal-Refactor.patch

···

       1
       +
       From f9e5b3b52323fdcac4e21bfec4d03bd66ea6a503 Mon Sep 17 00:00:00 2001

     

       2
       +
       From: Robert Hensing <robert@roberthensing.nl>

     

       3
       +
       Date: Thu, 3 Oct 2024 12:50:27 +0200

     

       4
       +
       Subject: [PATCH 3/4] local-derivation-goal: Refactor

     

       5
       +
       MIME-Version: 1.0

     

       6
       +
       Content-Type: text/plain; charset=UTF-8

     

       7
       +
       Content-Transfer-Encoding: 8bit

     

       8
       +
       

     

       9
       +
       This works because the `builder` and `args` variables are only used

     

       10
       +
       in the non-builtin code path.

     

       11
       +
       

     

       12
       +
       Co-Authored-By: Théophane Hufschmitt <theophane.hufschmitt@tweag.io>

     

       13
       +
       Signed-off-by: Jörg Thalheim <joerg@thalheim.io>

     

       14
       +
       ---

     

       15
       +
        src/libstore/build/local-derivation-goal.cc | 5 +----

     

       16
       +
        1 file changed, 1 insertion(+), 4 deletions(-)

     

       17
       +
       

     

       18
       +
       diff --git a/src/libstore/build/local-derivation-goal.cc b/src/libstore/build/local-derivation-goal.cc

     

       19
       +
       index a67347b59..eeb2635ee 100644

     

       20
       +
       --- a/src/libstore/build/local-derivation-goal.cc

     

       21
       +
       +++ b/src/libstore/build/local-derivation-goal.cc

     

       22
       +
       @@ -2156,15 +2156,12 @@ void LocalDerivationGoal::runChild()

     

       23
       +
                        _exit(1);

     

       24
       +
                    }

     

       25
       +
                }

     

       26
       +
       +#endif

     

       27
       +
        

     

       28
       +
       -        builder = drv->builder;

     

       29
       +
       -        args.push_back(std::string(baseNameOf(drv->builder)));

     

       30
       +
       -#else

     

       31
       +
                if (!drv->isBuiltin()) {

     

       32
       +
                    builder = drv->builder;

     

       33
       +
                    args.push_back(std::string(baseNameOf(drv->builder)));

     

       34
       +
                }

     

       35
       +
       -#endif

     

       36
       +
        

     

       37
       +
                for (auto & i : drv->args)

     

       38
       +
                    args.push_back(rewriteStrings(i, inputRewrites));

     

       39
       +
       -- 

     

       40
       +
       2.46.1

     

       41
       +

+75

pkgs/tools/package-management/nix/patches/2_19/0004-local-derivation-goal-Move-builder-preparation-to-no.patch

···

       1
       +
       From 126a1fd3385175ac94ae4000a9798e0cafb3c168 Mon Sep 17 00:00:00 2001

     

       2
       +
       From: Robert Hensing <robert@roberthensing.nl>

     

       3
       +
       Date: Thu, 3 Oct 2024 12:57:00 +0200

     

       4
       +
       Subject: [PATCH 4/4] local-derivation-goal: Move builder preparation to

     

       5
       +
        non-builtin code path

     

       6
       +
       MIME-Version: 1.0

     

       7
       +
       Content-Type: text/plain; charset=UTF-8

     

       8
       +
       Content-Transfer-Encoding: 8bit

     

       9
       +
       

     

       10
       +
       Signed-off-by: Jörg Thalheim <joerg@thalheim.io>

     

       11
       +
       ---

     

       12
       +
        src/libstore/build/local-derivation-goal.cc | 25 +++++++++------------

     

       13
       +
        1 file changed, 10 insertions(+), 15 deletions(-)

     

       14
       +
       

     

       15
       +
       diff --git a/src/libstore/build/local-derivation-goal.cc b/src/libstore/build/local-derivation-goal.cc

     

       16
       +
       index eeb2635ee..e29330f0e 100644

     

       17
       +
       --- a/src/libstore/build/local-derivation-goal.cc

     

       18
       +
       +++ b/src/libstore/build/local-derivation-goal.cc

     

       19
       +
       @@ -2030,11 +2030,6 @@ void LocalDerivationGoal::runChild()

     

       20
       +
                        throw SysError("setuid failed");

     

       21
       +
                }

     

       22
       +
        

     

       23
       +
       -        /* Fill in the arguments. */

     

       24
       +
       -        Strings args;

     

       25
       +
       -

     

       26
       +
       -        std::string builder = "invalid";

     

       27
       +
       -

     

       28
       +
        #if __APPLE__

     

       29
       +
                /* This has to appear before import statements. */

     

       30
       +
                std::string sandboxProfile = "(version 1)\n";

     

       31
       +
       @@ -2158,14 +2153,6 @@ void LocalDerivationGoal::runChild()

     

       32
       +
                }

     

       33
       +
        #endif

     

       34
       +
        

     

       35
       +
       -        if (!drv->isBuiltin()) {

     

       36
       +
       -            builder = drv->builder;

     

       37
       +
       -            args.push_back(std::string(baseNameOf(drv->builder)));

     

       38
       +
       -        }

     

       39
       +
       -

     

       40
       +
       -        for (auto & i : drv->args)

     

       41
       +
       -            args.push_back(rewriteStrings(i, inputRewrites));

     

       42
       +
       -

     

       43
       +
                /* Indicate that we managed to set up the build environment. */

     

       44
       +
                writeFull(STDERR_FILENO, std::string("\2\n"));

     

       45
       +
        

     

       46
       +
       @@ -2195,6 +2182,14 @@ void LocalDerivationGoal::runChild()

     

       47
       +
                    }

     

       48
       +
                }

     

       49
       +
        

     

       50
       +
       +        // Now builder is not builtin

     

       51
       +
       +

     

       52
       +
       +        Strings args;

     

       53
       +
       +        args.push_back(std::string(baseNameOf(drv->builder)));

     

       54
       +
       +

     

       55
       +
       +        for (auto & i : drv->args)

     

       56
       +
       +            args.push_back(rewriteStrings(i, inputRewrites));

     

       57
       +
       +

     

       58
       +
        #if __APPLE__

     

       59
       +
                posix_spawnattr_t attrp;

     

       60
       +
        

     

       61
       +
       @@ -2216,9 +2211,9 @@ void LocalDerivationGoal::runChild()

     

       62
       +
                    posix_spawnattr_setbinpref_np(&attrp, 1, &cpu, NULL);

     

       63
       +
                }

     

       64
       +
        

     

       65
       +
       -        posix_spawn(NULL, builder.c_str(), NULL, &attrp, stringsToCharPtrs(args).data(), stringsToCharPtrs(envStrs).data());

     

       66
       +
       +        posix_spawn(NULL, drv->builder.c_str(), NULL, &attrp, stringsToCharPtrs(args).data(), stringsToCharPtrs(envStrs).data());

     

       67
       +
        #else

     

       68
       +
       -        execve(builder.c_str(), stringsToCharPtrs(args).data(), stringsToCharPtrs(envStrs).data());

     

       69
       +
       +        execve(drv->builder.c_str(), stringsToCharPtrs(args).data(), stringsToCharPtrs(envStrs).data());

     

       70
       +
        #endif

     

       71
       +
        

     

       72
       +
                throw SysError("executing '%1%'", drv->builder);

     

       73
       +
       -- 

     

       74
       +
       2.46.1

     

       75
       +

+320

pkgs/tools/package-management/nix/patches/2_20/0001-fix-Run-all-derivation-builders-inside-the-sandbox-o.patch

···

       1
       +
       From aa54b01af503644a393e4e4055c4ce2a23ce9139 Mon Sep 17 00:00:00 2001

     

       2
       +
       From: Puck Meerburg <puck@puckipedia.com>

     

       3
       +
       Date: Fri, 1 Mar 2024 11:42:24 -0500

     

       4
       +
       Subject: [PATCH 1/4] fix: Run all derivation builders inside the sandbox on

     

       5
       +
        macOS

     

       6
       +
       MIME-Version: 1.0

     

       7
       +
       Content-Type: text/plain; charset=UTF-8

     

       8
       +
       Content-Transfer-Encoding: 8bit

     

       9
       +
       

     

       10
       +
       Signed-off-by: Jörg Thalheim <joerg@thalheim.io>

     

       11
       +
       ---

     

       12
       +
        configure.ac                                |   6 +-

     

       13
       +
        package.nix                                 |   2 +

     

       14
       +
        src/libstore/build/local-derivation-goal.cc | 217 ++++++++++----------

     

       15
       +
        3 files changed, 113 insertions(+), 112 deletions(-)

     

       16
       +
       

     

       17
       +
       diff --git a/configure.ac b/configure.ac

     

       18
       +
       index 8c29c1e62..8c524fd93 100644

     

       19
       +
       --- a/configure.ac

     

       20
       +
       +++ b/configure.ac

     

       21
       +
       @@ -58,13 +58,17 @@ AC_CHECK_TOOL([AR], [ar])

     

       22
       +
        AC_SYS_LARGEFILE

     

       23
       +
        

     

       24
       +
        

     

       25
       +
       -# Solaris-specific stuff.

     

       26
       +
       +# OS-specific stuff.

     

       27
       +
        AC_STRUCT_DIRENT_D_TYPE

     

       28
       +
        case "$host_os" in

     

       29
       +
          solaris*)

     

       30
       +
            # Solaris requires -lsocket -lnsl for network functions

     

       31
       +
            LDFLAGS="-lsocket -lnsl $LDFLAGS"

     

       32
       +
            ;;

     

       33
       +
       +  darwin*)

     

       34
       +
       +    # Need to link to libsandbox.

     

       35
       +
       +    LDFLAGS="-lsandbox $LDFLAGS"

     

       36
       +
       +    ;;

     

       37
       +
        esac

     

       38
       +
        

     

       39
       +
        

     

       40
       +
       diff --git a/package.nix b/package.nix

     

       41
       +
       index d1d14d10e..40283ffcf 100644

     

       42
       +
       --- a/package.nix

     

       43
       +
       +++ b/package.nix

     

       44
       +
       @@ -24,6 +24,7 @@

     

       45
       +
        , libgit2

     

       46
       +
        , libseccomp

     

       47
       +
        , libsodium

     

       48
       +
       +, darwin

     

       49
       +
        , lowdown

     

       50
       +
        , mdbook

     

       51
       +
        , mdbook-linkcheck

     

       52
       +
       @@ -233,6 +234,7 @@ in {

     

       53
       +
            gtest

     

       54
       +
            rapidcheck

     

       55
       +
          ] ++ lib.optional stdenv.isLinux libseccomp

     

       56
       +
       +    ++ lib.optional stdenv.hostPlatform.isDarwin darwin.apple_sdk.libs.sandbox

     

       57
       +
            ++ lib.optional stdenv.hostPlatform.isx86_64 libcpuid

     

       58
       +
            # There have been issues building these dependencies

     

       59
       +
            ++ lib.optional (stdenv.hostPlatform == stdenv.buildPlatform && (stdenv.isLinux || stdenv.isDarwin))

     

       60
       +
       diff --git a/src/libstore/build/local-derivation-goal.cc b/src/libstore/build/local-derivation-goal.cc

     

       61
       +
       index b8228bc11..9ab676429 100644

     

       62
       +
       --- a/src/libstore/build/local-derivation-goal.cc

     

       63
       +
       +++ b/src/libstore/build/local-derivation-goal.cc

     

       64
       +
       @@ -57,6 +57,10 @@

     

       65
       +
        #if __APPLE__

     

       66
       +
        #include <spawn.h>

     

       67
       +
        #include <sys/sysctl.h>

     

       68
       +
       +#include <sandbox.h>

     

       69
       +
       +

     

       70
       +
       +/* This definition is undocumented but depended upon by all major browsers. */

     

       71
       +
       +extern "C" int sandbox_init_with_parameters(const char *profile, uint64_t flags, const char *const parameters[], char **errorbuf);

     

       72
       +
        #endif

     

       73
       +
        

     

       74
       +
        #include <pwd.h>

     

       75
       +
       @@ -2023,140 +2027,131 @@ void LocalDerivationGoal::runChild()

     

       76
       +
        

     

       77
       +
                std::string builder = "invalid";

     

       78
       +
        

     

       79
       +
       -        if (drv->isBuiltin()) {

     

       80
       +
       -            ;

     

       81
       +
       -        }

     

       82
       +
        #if __APPLE__

     

       83
       +
       -        else {

     

       84
       +
       -            /* This has to appear before import statements. */

     

       85
       +
       -            std::string sandboxProfile = "(version 1)\n";

     

       86
       +
       -

     

       87
       +
       -            if (useChroot) {

     

       88
       +
       -

     

       89
       +
       -                /* Lots and lots and lots of file functions freak out if they can't stat their full ancestry */

     

       90
       +
       -                PathSet ancestry;

     

       91
       +
       -

     

       92
       +
       -                /* We build the ancestry before adding all inputPaths to the store because we know they'll

     

       93
       +
       -                   all have the same parents (the store), and there might be lots of inputs. This isn't

     

       94
       +
       -                   particularly efficient... I doubt it'll be a bottleneck in practice */

     

       95
       +
       -                for (auto & i : pathsInChroot) {

     

       96
       +
       -                    Path cur = i.first;

     

       97
       +
       -                    while (cur.compare("/") != 0) {

     

       98
       +
       -                        cur = dirOf(cur);

     

       99
       +
       -                        ancestry.insert(cur);

     

       100
       +
       -                    }

     

       101
       +
       -                }

     

       102
       +
       +        /* This has to appear before import statements. */

     

       103
       +
       +        std::string sandboxProfile = "(version 1)\n";

     

       104
       +
        

     

       105
       +
       -                /* And we want the store in there regardless of how empty pathsInChroot. We include the innermost

     

       106
       +
       -                   path component this time, since it's typically /nix/store and we care about that. */

     

       107
       +
       -                Path cur = worker.store.storeDir;

     

       108
       +
       +        if (useChroot) {

     

       109
       +
       +

     

       110
       +
       +            /* Lots and lots and lots of file functions freak out if they can't stat their full ancestry */

     

       111
       +
       +            PathSet ancestry;

     

       112
       +
       +

     

       113
       +
       +            /* We build the ancestry before adding all inputPaths to the store because we know they'll

     

       114
       +
       +                all have the same parents (the store), and there might be lots of inputs. This isn't

     

       115
       +
       +                particularly efficient... I doubt it'll be a bottleneck in practice */

     

       116
       +
       +            for (auto & i : pathsInChroot) {

     

       117
       +
       +                Path cur = i.first;

     

       118
       +
                        while (cur.compare("/") != 0) {

     

       119
       +
       -                    ancestry.insert(cur);

     

       120
       +
                            cur = dirOf(cur);

     

       121
       +
       +                    ancestry.insert(cur);

     

       122
       +
                        }

     

       123
       +
       +            }

     

       124
       +
        

     

       125
       +
       -                /* Add all our input paths to the chroot */

     

       126
       +
       -                for (auto & i : inputPaths) {

     

       127
       +
       -                    auto p = worker.store.printStorePath(i);

     

       128
       +
       -                    pathsInChroot[p] = p;

     

       129
       +
       -                }

     

       130
       +
       +            /* And we want the store in there regardless of how empty pathsInChroot. We include the innermost

     

       131
       +
       +                path component this time, since it's typically /nix/store and we care about that. */

     

       132
       +
       +            Path cur = worker.store.storeDir;

     

       133
       +
       +            while (cur.compare("/") != 0) {

     

       134
       +
       +                ancestry.insert(cur);

     

       135
       +
       +                cur = dirOf(cur);

     

       136
       +
       +            }

     

       137
       +
        

     

       138
       +
       -                /* Violations will go to the syslog if you set this. Unfortunately the destination does not appear to be configurable */

     

       139
       +
       -                if (settings.darwinLogSandboxViolations) {

     

       140
       +
       -                    sandboxProfile += "(deny default)\n";

     

       141
       +
       -                } else {

     

       142
       +
       -                    sandboxProfile += "(deny default (with no-log))\n";

     

       143
       +
       -                }

     

       144
       +
       +            /* Add all our input paths to the chroot */

     

       145
       +
       +            for (auto & i : inputPaths) {

     

       146
       +
       +                auto p = worker.store.printStorePath(i);

     

       147
       +
       +                pathsInChroot[p] = p;

     

       148
       +
       +            }

     

       149
       +
       +

     

       150
       +
       +            /* Violations will go to the syslog if you set this. Unfortunately the destination does not appear to be configurable */

     

       151
       +
       +            if (settings.darwinLogSandboxViolations) {

     

       152
       +
       +                sandboxProfile += "(deny default)\n";

     

       153
       +
       +            } else {

     

       154
       +
       +                sandboxProfile += "(deny default (with no-log))\n";

     

       155
       +
       +            }

     

       156
       +
        

     

       157
       +
       +            sandboxProfile +=

     

       158
       +
       +                #include "sandbox-defaults.sb"

     

       159
       +
       +                ;

     

       160
       +
       +

     

       161
       +
       +            if (!derivationType->isSandboxed())

     

       162
       +
                        sandboxProfile +=

     

       163
       +
       -                    #include "sandbox-defaults.sb"

     

       164
       +
       +                    #include "sandbox-network.sb"

     

       165
       +
                            ;

     

       166
       +
        

     

       167
       +
       -                if (!derivationType->isSandboxed())

     

       168
       +
       -                    sandboxProfile +=

     

       169
       +
       -                        #include "sandbox-network.sb"

     

       170
       +
       -                        ;

     

       171
       +
       -

     

       172
       +
       -                /* Add the output paths we'll use at build-time to the chroot */

     

       173
       +
       -                sandboxProfile += "(allow file-read* file-write* process-exec\n";

     

       174
       +
       -                for (auto & [_, path] : scratchOutputs)

     

       175
       +
       -                    sandboxProfile += fmt("\t(subpath \"%s\")\n", worker.store.printStorePath(path));

     

       176
       +
       -

     

       177
       +
       -                sandboxProfile += ")\n";

     

       178
       +
       -

     

       179
       +
       -                /* Our inputs (transitive dependencies and any impurities computed above)

     

       180
       +
       -

     

       181
       +
       -                   without file-write* allowed, access() incorrectly returns EPERM

     

       182
       +
       -                 */

     

       183
       +
       -                sandboxProfile += "(allow file-read* file-write* process-exec\n";

     

       184
       +
       -                for (auto & i : pathsInChroot) {

     

       185
       +
       -                    if (i.first != i.second.source)

     

       186
       +
       -                        throw Error(

     

       187
       +
       -                            "can't map '%1%' to '%2%': mismatched impure paths not supported on Darwin",

     

       188
       +
       -                            i.first, i.second.source);

     

       189
       +
       -

     

       190
       +
       -                    std::string path = i.first;

     

       191
       +
       -                    struct stat st;

     

       192
       +
       -                    if (lstat(path.c_str(), &st)) {

     

       193
       +
       -                        if (i.second.optional && errno == ENOENT)

     

       194
       +
       -                            continue;

     

       195
       +
       -                        throw SysError("getting attributes of path '%s", path);

     

       196
       +
       -                    }

     

       197
       +
       -                    if (S_ISDIR(st.st_mode))

     

       198
       +
       -                        sandboxProfile += fmt("\t(subpath \"%s\")\n", path);

     

       199
       +
       -                    else

     

       200
       +
       -                        sandboxProfile += fmt("\t(literal \"%s\")\n", path);

     

       201
       +
       -                }

     

       202
       +
       -                sandboxProfile += ")\n";

     

       203
       +
       +            /* Add the output paths we'll use at build-time to the chroot */

     

       204
       +
       +            sandboxProfile += "(allow file-read* file-write* process-exec\n";

     

       205
       +
       +            for (auto & [_, path] : scratchOutputs)

     

       206
       +
       +                sandboxProfile += fmt("\t(subpath \"%s\")\n", worker.store.printStorePath(path));

     

       207
       +
        

     

       208
       +
       -                /* Allow file-read* on full directory hierarchy to self. Allows realpath() */

     

       209
       +
       -                sandboxProfile += "(allow file-read*\n";

     

       210
       +
       -                for (auto & i : ancestry) {

     

       211
       +
       -                    sandboxProfile += fmt("\t(literal \"%s\")\n", i);

     

       212
       +
       -                }

     

       213
       +
       -                sandboxProfile += ")\n";

     

       214
       +
       +            sandboxProfile += ")\n";

     

       215
       +
        

     

       216
       +
       -                sandboxProfile += additionalSandboxProfile;

     

       217
       +
       -            } else

     

       218
       +
       -                sandboxProfile +=

     

       219
       +
       -                    #include "sandbox-minimal.sb"

     

       220
       +
       -                    ;

     

       221
       +
       +            /* Our inputs (transitive dependencies and any impurities computed above)

     

       222
       +
       +

     

       223
       +
       +                without file-write* allowed, access() incorrectly returns EPERM

     

       224
       +
       +                */

     

       225
       +
       +            sandboxProfile += "(allow file-read* file-write* process-exec\n";

     

       226
       +
       +            for (auto & i : pathsInChroot) {

     

       227
       +
       +                if (i.first != i.second.source)

     

       228
       +
       +                    throw Error(

     

       229
       +
       +                        "can't map '%1%' to '%2%': mismatched impure paths not supported on Darwin",

     

       230
       +
       +                        i.first, i.second.source);

     

       231
       +
       +

     

       232
       +
       +                std::string path = i.first;

     

       233
       +
       +                struct stat st;

     

       234
       +
       +                if (lstat(path.c_str(), &st)) {

     

       235
       +
       +                    if (i.second.optional && errno == ENOENT)

     

       236
       +
       +                        continue;

     

       237
       +
       +                    throw SysError("getting attributes of path '%s", path);

     

       238
       +
       +                }

     

       239
       +
       +                if (S_ISDIR(st.st_mode))

     

       240
       +
       +                    sandboxProfile += fmt("\t(subpath \"%s\")\n", path);

     

       241
       +
       +                else

     

       242
       +
       +                    sandboxProfile += fmt("\t(literal \"%s\")\n", path);

     

       243
       +
       +            }

     

       244
       +
       +            sandboxProfile += ")\n";

     

       245
       +
        

     

       246
       +
       -            debug("Generated sandbox profile:");

     

       247
       +
       -            debug(sandboxProfile);

     

       248
       +
       +            /* Allow file-read* on full directory hierarchy to self. Allows realpath() */

     

       249
       +
       +            sandboxProfile += "(allow file-read*\n";

     

       250
       +
       +            for (auto & i : ancestry) {

     

       251
       +
       +                sandboxProfile += fmt("\t(literal \"%s\")\n", i);

     

       252
       +
       +            }

     

       253
       +
       +            sandboxProfile += ")\n";

     

       254
       +
        

     

       255
       +
       -            Path sandboxFile = tmpDir + "/.sandbox.sb";

     

       256
       +
       +            sandboxProfile += additionalSandboxProfile;

     

       257
       +
       +        } else

     

       258
       +
       +            sandboxProfile +=

     

       259
       +
       +                #include "sandbox-minimal.sb"

     

       260
       +
       +                ;

     

       261
       +
        

     

       262
       +
       -            writeFile(sandboxFile, sandboxProfile);

     

       263
       +
       +        debug("Generated sandbox profile:");

     

       264
       +
       +        debug(sandboxProfile);

     

       265
       +
        

     

       266
       +
       -            bool allowLocalNetworking = parsedDrv->getBoolAttr("__darwinAllowLocalNetworking");

     

       267
       +
       +        bool allowLocalNetworking = parsedDrv->getBoolAttr("__darwinAllowLocalNetworking");

     

       268
       +
        

     

       269
       +
       -            /* The tmpDir in scope points at the temporary build directory for our derivation. Some packages try different mechanisms

     

       270
       +
       -               to find temporary directories, so we want to open up a broader place for them to dump their files, if needed. */

     

       271
       +
       -            Path globalTmpDir = canonPath(getEnvNonEmpty("TMPDIR").value_or("/tmp"), true);

     

       272
       +
       +        /* The tmpDir in scope points at the temporary build directory for our derivation. Some packages try different mechanisms

     

       273
       +
       +            to find temporary directories, so we want to open up a broader place for them to dump their files, if needed. */

     

       274
       +
       +        Path globalTmpDir = canonPath(getEnvNonEmpty("TMPDIR").value_or("/tmp"), true);

     

       275
       +
        

     

       276
       +
       -            /* They don't like trailing slashes on subpath directives */

     

       277
       +
       -            if (globalTmpDir.back() == '/') globalTmpDir.pop_back();

     

       278
       +
       +        /* They don't like trailing slashes on subpath directives */

     

       279
       +
       +        if (globalTmpDir.back() == '/') globalTmpDir.pop_back();

     

       280
       +
        

     

       281
       +
       -            if (getEnv("_NIX_TEST_NO_SANDBOX") != "1") {

     

       282
       +
       -                builder = "/usr/bin/sandbox-exec";

     

       283
       +
       -                args.push_back("sandbox-exec");

     

       284
       +
       -                args.push_back("-f");

     

       285
       +
       -                args.push_back(sandboxFile);

     

       286
       +
       -                args.push_back("-D");

     

       287
       +
       -                args.push_back("_GLOBAL_TMP_DIR=" + globalTmpDir);

     

       288
       +
       -                if (allowLocalNetworking) {

     

       289
       +
       -                    args.push_back("-D");

     

       290
       +
       -                    args.push_back(std::string("_ALLOW_LOCAL_NETWORKING=1"));

     

       291
       +
       -                }

     

       292
       +
       -                args.push_back(drv->builder);

     

       293
       +
       -            } else {

     

       294
       +
       -                builder = drv->builder;

     

       295
       +
       -                args.push_back(std::string(baseNameOf(drv->builder)));

     

       296
       +
       +        if (getEnv("_NIX_TEST_NO_SANDBOX") != "1") {

     

       297
       +
       +            Strings sandboxArgs;

     

       298
       +
       +            sandboxArgs.push_back("_GLOBAL_TMP_DIR");

     

       299
       +
       +            sandboxArgs.push_back(globalTmpDir);

     

       300
       +
       +            if (allowLocalNetworking) {

     

       301
       +
       +                sandboxArgs.push_back("_ALLOW_LOCAL_NETWORKING");

     

       302
       +
       +                sandboxArgs.push_back("1");

     

       303
       +
       +            }

     

       304
       +
       +            if (sandbox_init_with_parameters(sandboxProfile.c_str(), 0, stringsToCharPtrs(sandboxArgs).data(), NULL)) {

     

       305
       +
       +                writeFull(STDERR_FILENO, "failed to configure sandbox\n");

     

       306
       +
       +                _exit(1);

     

       307
       +
                    }

     

       308
       +
                }

     

       309
       +
       +

     

       310
       +
       +        builder = drv->builder;

     

       311
       +
       +        args.push_back(std::string(baseNameOf(drv->builder)));

     

       312
       +
        #else

     

       313
       +
       -        else {

     

       314
       +
       +        if (!drv->isBuiltin()) {

     

       315
       +
                    builder = drv->builder;

     

       316
       +
                    args.push_back(std::string(baseNameOf(drv->builder)));

     

       317
       +
                }

     

       318
       +
       -- 

     

       319
       +
       2.46.1

     

       320
       +

+34

pkgs/tools/package-management/nix/patches/2_20/0002-local-derivation-goal-Print-sandbox-error-detail-on-.patch

···

       1
       +
       From b78e489f79165457b59faa2270fd89769d0fc17d Mon Sep 17 00:00:00 2001

     

       2
       +
       From: Robert Hensing <robert@roberthensing.nl>

     

       3
       +
       Date: Thu, 3 Oct 2024 12:44:12 +0200

     

       4
       +
       Subject: [PATCH 2/4] local-derivation-goal: Print sandbox error detail on

     

       5
       +
        darwin

     

       6
       +
       MIME-Version: 1.0

     

       7
       +
       Content-Type: text/plain; charset=UTF-8

     

       8
       +
       Content-Transfer-Encoding: 8bit

     

       9
       +
       

     

       10
       +
       Co-Authored-By: Théophane Hufschmitt <theophane.hufschmitt@tweag.io>

     

       11
       +
       Signed-off-by: Jörg Thalheim <joerg@thalheim.io>

     

       12
       +
       ---

     

       13
       +
        src/libstore/build/local-derivation-goal.cc | 5 +++--

     

       14
       +
        1 file changed, 3 insertions(+), 2 deletions(-)

     

       15
       +
       

     

       16
       +
       diff --git a/src/libstore/build/local-derivation-goal.cc b/src/libstore/build/local-derivation-goal.cc

     

       17
       +
       index 9ab676429..8476e038e 100644

     

       18
       +
       --- a/src/libstore/build/local-derivation-goal.cc

     

       19
       +
       +++ b/src/libstore/build/local-derivation-goal.cc

     

       20
       +
       @@ -2142,8 +2142,9 @@ void LocalDerivationGoal::runChild()

     

       21
       +
                        sandboxArgs.push_back("_ALLOW_LOCAL_NETWORKING");

     

       22
       +
                        sandboxArgs.push_back("1");

     

       23
       +
                    }

     

       24
       +
       -            if (sandbox_init_with_parameters(sandboxProfile.c_str(), 0, stringsToCharPtrs(sandboxArgs).data(), NULL)) {

     

       25
       +
       -                writeFull(STDERR_FILENO, "failed to configure sandbox\n");

     

       26
       +
       +            char * sandbox_errbuf = nullptr;

     

       27
       +
       +            if (sandbox_init_with_parameters(sandboxProfile.c_str(), 0, stringsToCharPtrs(sandboxArgs).data(), &sandbox_errbuf)) {

     

       28
       +
       +                writeFull(STDERR_FILENO, fmt("failed to configure sandbox: %s\n", sandbox_errbuf ? sandbox_errbuf : "(null)"));

     

       29
       +
                        _exit(1);

     

       30
       +
                    }

     

       31
       +
                }

     

       32
       +
       -- 

     

       33
       +
       2.46.1

     

       34
       +

+41

pkgs/tools/package-management/nix/patches/2_20/0003-local-derivation-goal-Refactor.patch

···

       1
       +
       From db6bcf3f7714929d5a21b655c5f8ccd2ddbdf7f2 Mon Sep 17 00:00:00 2001

     

       2
       +
       From: Robert Hensing <robert@roberthensing.nl>

     

       3
       +
       Date: Thu, 3 Oct 2024 12:50:27 +0200

     

       4
       +
       Subject: [PATCH 3/4] local-derivation-goal: Refactor

     

       5
       +
       MIME-Version: 1.0

     

       6
       +
       Content-Type: text/plain; charset=UTF-8

     

       7
       +
       Content-Transfer-Encoding: 8bit

     

       8
       +
       

     

       9
       +
       This works because the `builder` and `args` variables are only used

     

       10
       +
       in the non-builtin code path.

     

       11
       +
       

     

       12
       +
       Co-Authored-By: Théophane Hufschmitt <theophane.hufschmitt@tweag.io>

     

       13
       +
       Signed-off-by: Jörg Thalheim <joerg@thalheim.io>

     

       14
       +
       ---

     

       15
       +
        src/libstore/build/local-derivation-goal.cc | 5 +----

     

       16
       +
        1 file changed, 1 insertion(+), 4 deletions(-)

     

       17
       +
       

     

       18
       +
       diff --git a/src/libstore/build/local-derivation-goal.cc b/src/libstore/build/local-derivation-goal.cc

     

       19
       +
       index 8476e038e..12b67df69 100644

     

       20
       +
       --- a/src/libstore/build/local-derivation-goal.cc

     

       21
       +
       +++ b/src/libstore/build/local-derivation-goal.cc

     

       22
       +
       @@ -2148,15 +2148,12 @@ void LocalDerivationGoal::runChild()

     

       23
       +
                        _exit(1);

     

       24
       +
                    }

     

       25
       +
                }

     

       26
       +
       +#endif

     

       27
       +
        

     

       28
       +
       -        builder = drv->builder;

     

       29
       +
       -        args.push_back(std::string(baseNameOf(drv->builder)));

     

       30
       +
       -#else

     

       31
       +
                if (!drv->isBuiltin()) {

     

       32
       +
                    builder = drv->builder;

     

       33
       +
                    args.push_back(std::string(baseNameOf(drv->builder)));

     

       34
       +
                }

     

       35
       +
       -#endif

     

       36
       +
        

     

       37
       +
                for (auto & i : drv->args)

     

       38
       +
                    args.push_back(rewriteStrings(i, inputRewrites));

     

       39
       +
       -- 

     

       40
       +
       2.46.1

     

       41
       +

+75

pkgs/tools/package-management/nix/patches/2_20/0004-local-derivation-goal-Move-builder-preparation-to-no.patch

···

       1
       +
       From 55be7deee1471e77e3ad408c5e23842df0d5bc28 Mon Sep 17 00:00:00 2001

     

       2
       +
       From: Robert Hensing <robert@roberthensing.nl>

     

       3
       +
       Date: Thu, 3 Oct 2024 12:57:00 +0200

     

       4
       +
       Subject: [PATCH 4/4] local-derivation-goal: Move builder preparation to

     

       5
       +
        non-builtin code path

     

       6
       +
       MIME-Version: 1.0

     

       7
       +
       Content-Type: text/plain; charset=UTF-8

     

       8
       +
       Content-Transfer-Encoding: 8bit

     

       9
       +
       

     

       10
       +
       Signed-off-by: Jörg Thalheim <joerg@thalheim.io>

     

       11
       +
       ---

     

       12
       +
        src/libstore/build/local-derivation-goal.cc | 25 +++++++++------------

     

       13
       +
        1 file changed, 10 insertions(+), 15 deletions(-)

     

       14
       +
       

     

       15
       +
       diff --git a/src/libstore/build/local-derivation-goal.cc b/src/libstore/build/local-derivation-goal.cc

     

       16
       +
       index 12b67df69..ada86dbb8 100644

     

       17
       +
       --- a/src/libstore/build/local-derivation-goal.cc

     

       18
       +
       +++ b/src/libstore/build/local-derivation-goal.cc

     

       19
       +
       @@ -2022,11 +2022,6 @@ void LocalDerivationGoal::runChild()

     

       20
       +
                        throw SysError("setuid failed");

     

       21
       +
                }

     

       22
       +
        

     

       23
       +
       -        /* Fill in the arguments. */

     

       24
       +
       -        Strings args;

     

       25
       +
       -

     

       26
       +
       -        std::string builder = "invalid";

     

       27
       +
       -

     

       28
       +
        #if __APPLE__

     

       29
       +
                /* This has to appear before import statements. */

     

       30
       +
                std::string sandboxProfile = "(version 1)\n";

     

       31
       +
       @@ -2150,14 +2145,6 @@ void LocalDerivationGoal::runChild()

     

       32
       +
                }

     

       33
       +
        #endif

     

       34
       +
        

     

       35
       +
       -        if (!drv->isBuiltin()) {

     

       36
       +
       -            builder = drv->builder;

     

       37
       +
       -            args.push_back(std::string(baseNameOf(drv->builder)));

     

       38
       +
       -        }

     

       39
       +
       -

     

       40
       +
       -        for (auto & i : drv->args)

     

       41
       +
       -            args.push_back(rewriteStrings(i, inputRewrites));

     

       42
       +
       -

     

       43
       +
                /* Indicate that we managed to set up the build environment. */

     

       44
       +
                writeFull(STDERR_FILENO, std::string("\2\n"));

     

       45
       +
        

     

       46
       +
       @@ -2187,6 +2174,14 @@ void LocalDerivationGoal::runChild()

     

       47
       +
                    }

     

       48
       +
                }

     

       49
       +
        

     

       50
       +
       +        // Now builder is not builtin

     

       51
       +
       +

     

       52
       +
       +        Strings args;

     

       53
       +
       +        args.push_back(std::string(baseNameOf(drv->builder)));

     

       54
       +
       +

     

       55
       +
       +        for (auto & i : drv->args)

     

       56
       +
       +            args.push_back(rewriteStrings(i, inputRewrites));

     

       57
       +
       +

     

       58
       +
        #if __APPLE__

     

       59
       +
                posix_spawnattr_t attrp;

     

       60
       +
        

     

       61
       +
       @@ -2208,9 +2203,9 @@ void LocalDerivationGoal::runChild()

     

       62
       +
                    posix_spawnattr_setbinpref_np(&attrp, 1, &cpu, NULL);

     

       63
       +
                }

     

       64
       +
        

     

       65
       +
       -        posix_spawn(NULL, builder.c_str(), NULL, &attrp, stringsToCharPtrs(args).data(), stringsToCharPtrs(envStrs).data());

     

       66
       +
       +        posix_spawn(NULL, drv->builder.c_str(), NULL, &attrp, stringsToCharPtrs(args).data(), stringsToCharPtrs(envStrs).data());

     

       67
       +
        #else

     

       68
       +
       -        execve(builder.c_str(), stringsToCharPtrs(args).data(), stringsToCharPtrs(envStrs).data());

     

       69
       +
       +        execve(drv->builder.c_str(), stringsToCharPtrs(args).data(), stringsToCharPtrs(envStrs).data());

     

       70
       +
        #endif

     

       71
       +
        

     

       72
       +
                throw SysError("executing '%1%'", drv->builder);

     

       73
       +
       -- 

     

       74
       +
       2.46.1

     

       75
       +

+320

pkgs/tools/package-management/nix/patches/2_21/0001-fix-Run-all-derivation-builders-inside-the-sandbox-o.patch

···

       1
       +
       From ae8a38d29cc0fbd6394acd72fdaaa62b3798f698 Mon Sep 17 00:00:00 2001

     

       2
       +
       From: Puck Meerburg <puck@puckipedia.com>

     

       3
       +
       Date: Fri, 1 Mar 2024 11:42:24 -0500

     

       4
       +
       Subject: [PATCH 1/4] fix: Run all derivation builders inside the sandbox on

     

       5
       +
        macOS

     

       6
       +
       MIME-Version: 1.0

     

       7
       +
       Content-Type: text/plain; charset=UTF-8

     

       8
       +
       Content-Transfer-Encoding: 8bit

     

       9
       +
       

     

       10
       +
       Signed-off-by: Jörg Thalheim <joerg@thalheim.io>

     

       11
       +
       ---

     

       12
       +
        configure.ac                                |   6 +-

     

       13
       +
        package.nix                                 |   2 +

     

       14
       +
        src/libstore/build/local-derivation-goal.cc | 217 ++++++++++----------

     

       15
       +
        3 files changed, 113 insertions(+), 112 deletions(-)

     

       16
       +
       

     

       17
       +
       diff --git a/configure.ac b/configure.ac

     

       18
       +
       index 676b145a5..f6fa35c81 100644

     

       19
       +
       --- a/configure.ac

     

       20
       +
       +++ b/configure.ac

     

       21
       +
       @@ -62,13 +62,17 @@ AC_CHECK_TOOL([AR], [ar])

     

       22
       +
        AC_SYS_LARGEFILE

     

       23
       +
        

     

       24
       +
        

     

       25
       +
       -# Solaris-specific stuff.

     

       26
       +
       +# OS-specific stuff.

     

       27
       +
        AC_STRUCT_DIRENT_D_TYPE

     

       28
       +
        case "$host_os" in

     

       29
       +
          solaris*)

     

       30
       +
            # Solaris requires -lsocket -lnsl for network functions

     

       31
       +
            LDFLAGS="-lsocket -lnsl $LDFLAGS"

     

       32
       +
            ;;

     

       33
       +
       +  darwin*)

     

       34
       +
       +    # Need to link to libsandbox.

     

       35
       +
       +    LDFLAGS="-lsandbox $LDFLAGS"

     

       36
       +
       +    ;;

     

       37
       +
        esac

     

       38
       +
        

     

       39
       +
        

     

       40
       +
       diff --git a/package.nix b/package.nix

     

       41
       +
       index 7d9a39771..de2e1aff1 100644

     

       42
       +
       --- a/package.nix

     

       43
       +
       +++ b/package.nix

     

       44
       +
       @@ -25,6 +25,7 @@

     

       45
       +
        , libseccomp

     

       46
       +
        , libsodium

     

       47
       +
        , man

     

       48
       +
       +, darwin

     

       49
       +
        , lowdown

     

       50
       +
        , mdbook

     

       51
       +
        , mdbook-linkcheck

     

       52
       +
       @@ -239,6 +240,7 @@ in {

     

       53
       +
            gtest

     

       54
       +
            rapidcheck

     

       55
       +
          ] ++ lib.optional stdenv.isLinux libseccomp

     

       56
       +
       +    ++ lib.optional stdenv.hostPlatform.isDarwin darwin.apple_sdk.libs.sandbox

     

       57
       +
            ++ lib.optional stdenv.hostPlatform.isx86_64 libcpuid

     

       58
       +
            # There have been issues building these dependencies

     

       59
       +
            ++ lib.optional (stdenv.hostPlatform == stdenv.buildPlatform && (stdenv.isLinux || stdenv.isDarwin))

     

       60
       +
       diff --git a/src/libstore/build/local-derivation-goal.cc b/src/libstore/build/local-derivation-goal.cc

     

       61
       +
       index 710304b67..c73b30b80 100644

     

       62
       +
       --- a/src/libstore/build/local-derivation-goal.cc

     

       63
       +
       +++ b/src/libstore/build/local-derivation-goal.cc

     

       64
       +
       @@ -58,6 +58,10 @@

     

       65
       +
        #if __APPLE__

     

       66
       +
        #include <spawn.h>

     

       67
       +
        #include <sys/sysctl.h>

     

       68
       +
       +#include <sandbox.h>

     

       69
       +
       +

     

       70
       +
       +/* This definition is undocumented but depended upon by all major browsers. */

     

       71
       +
       +extern "C" int sandbox_init_with_parameters(const char *profile, uint64_t flags, const char *const parameters[], char **errorbuf);

     

       72
       +
        #endif

     

       73
       +
        

     

       74
       +
        #include <pwd.h>

     

       75
       +
       @@ -2018,140 +2022,131 @@ void LocalDerivationGoal::runChild()

     

       76
       +
        

     

       77
       +
                std::string builder = "invalid";

     

       78
       +
        

     

       79
       +
       -        if (drv->isBuiltin()) {

     

       80
       +
       -            ;

     

       81
       +
       -        }

     

       82
       +
        #if __APPLE__

     

       83
       +
       -        else {

     

       84
       +
       -            /* This has to appear before import statements. */

     

       85
       +
       -            std::string sandboxProfile = "(version 1)\n";

     

       86
       +
       -

     

       87
       +
       -            if (useChroot) {

     

       88
       +
       -

     

       89
       +
       -                /* Lots and lots and lots of file functions freak out if they can't stat their full ancestry */

     

       90
       +
       -                PathSet ancestry;

     

       91
       +
       -

     

       92
       +
       -                /* We build the ancestry before adding all inputPaths to the store because we know they'll

     

       93
       +
       -                   all have the same parents (the store), and there might be lots of inputs. This isn't

     

       94
       +
       -                   particularly efficient... I doubt it'll be a bottleneck in practice */

     

       95
       +
       -                for (auto & i : pathsInChroot) {

     

       96
       +
       -                    Path cur = i.first;

     

       97
       +
       -                    while (cur.compare("/") != 0) {

     

       98
       +
       -                        cur = dirOf(cur);

     

       99
       +
       -                        ancestry.insert(cur);

     

       100
       +
       -                    }

     

       101
       +
       -                }

     

       102
       +
       +        /* This has to appear before import statements. */

     

       103
       +
       +        std::string sandboxProfile = "(version 1)\n";

     

       104
       +
        

     

       105
       +
       -                /* And we want the store in there regardless of how empty pathsInChroot. We include the innermost

     

       106
       +
       -                   path component this time, since it's typically /nix/store and we care about that. */

     

       107
       +
       -                Path cur = worker.store.storeDir;

     

       108
       +
       +        if (useChroot) {

     

       109
       +
       +

     

       110
       +
       +            /* Lots and lots and lots of file functions freak out if they can't stat their full ancestry */

     

       111
       +
       +            PathSet ancestry;

     

       112
       +
       +

     

       113
       +
       +            /* We build the ancestry before adding all inputPaths to the store because we know they'll

     

       114
       +
       +                all have the same parents (the store), and there might be lots of inputs. This isn't

     

       115
       +
       +                particularly efficient... I doubt it'll be a bottleneck in practice */

     

       116
       +
       +            for (auto & i : pathsInChroot) {

     

       117
       +
       +                Path cur = i.first;

     

       118
       +
                        while (cur.compare("/") != 0) {

     

       119
       +
       -                    ancestry.insert(cur);

     

       120
       +
                            cur = dirOf(cur);

     

       121
       +
       +                    ancestry.insert(cur);

     

       122
       +
                        }

     

       123
       +
       +            }

     

       124
       +
        

     

       125
       +
       -                /* Add all our input paths to the chroot */

     

       126
       +
       -                for (auto & i : inputPaths) {

     

       127
       +
       -                    auto p = worker.store.printStorePath(i);

     

       128
       +
       -                    pathsInChroot[p] = p;

     

       129
       +
       -                }

     

       130
       +
       +            /* And we want the store in there regardless of how empty pathsInChroot. We include the innermost

     

       131
       +
       +                path component this time, since it's typically /nix/store and we care about that. */

     

       132
       +
       +            Path cur = worker.store.storeDir;

     

       133
       +
       +            while (cur.compare("/") != 0) {

     

       134
       +
       +                ancestry.insert(cur);

     

       135
       +
       +                cur = dirOf(cur);

     

       136
       +
       +            }

     

       137
       +
        

     

       138
       +
       -                /* Violations will go to the syslog if you set this. Unfortunately the destination does not appear to be configurable */

     

       139
       +
       -                if (settings.darwinLogSandboxViolations) {

     

       140
       +
       -                    sandboxProfile += "(deny default)\n";

     

       141
       +
       -                } else {

     

       142
       +
       -                    sandboxProfile += "(deny default (with no-log))\n";

     

       143
       +
       -                }

     

       144
       +
       +            /* Add all our input paths to the chroot */

     

       145
       +
       +            for (auto & i : inputPaths) {

     

       146
       +
       +                auto p = worker.store.printStorePath(i);

     

       147
       +
       +                pathsInChroot[p] = p;

     

       148
       +
       +            }

     

       149
       +
       +

     

       150
       +
       +            /* Violations will go to the syslog if you set this. Unfortunately the destination does not appear to be configurable */

     

       151
       +
       +            if (settings.darwinLogSandboxViolations) {

     

       152
       +
       +                sandboxProfile += "(deny default)\n";

     

       153
       +
       +            } else {

     

       154
       +
       +                sandboxProfile += "(deny default (with no-log))\n";

     

       155
       +
       +            }

     

       156
       +
        

     

       157
       +
       +            sandboxProfile +=

     

       158
       +
       +                #include "sandbox-defaults.sb"

     

       159
       +
       +                ;

     

       160
       +
       +

     

       161
       +
       +            if (!derivationType->isSandboxed())

     

       162
       +
                        sandboxProfile +=

     

       163
       +
       -                    #include "sandbox-defaults.sb"

     

       164
       +
       +                    #include "sandbox-network.sb"

     

       165
       +
                            ;

     

       166
       +
        

     

       167
       +
       -                if (!derivationType->isSandboxed())

     

       168
       +
       -                    sandboxProfile +=

     

       169
       +
       -                        #include "sandbox-network.sb"

     

       170
       +
       -                        ;

     

       171
       +
       -

     

       172
       +
       -                /* Add the output paths we'll use at build-time to the chroot */

     

       173
       +
       -                sandboxProfile += "(allow file-read* file-write* process-exec\n";

     

       174
       +
       -                for (auto & [_, path] : scratchOutputs)

     

       175
       +
       -                    sandboxProfile += fmt("\t(subpath \"%s\")\n", worker.store.printStorePath(path));

     

       176
       +
       -

     

       177
       +
       -                sandboxProfile += ")\n";

     

       178
       +
       -

     

       179
       +
       -                /* Our inputs (transitive dependencies and any impurities computed above)

     

       180
       +
       -

     

       181
       +
       -                   without file-write* allowed, access() incorrectly returns EPERM

     

       182
       +
       -                 */

     

       183
       +
       -                sandboxProfile += "(allow file-read* file-write* process-exec\n";

     

       184
       +
       -                for (auto & i : pathsInChroot) {

     

       185
       +
       -                    if (i.first != i.second.source)

     

       186
       +
       -                        throw Error(

     

       187
       +
       -                            "can't map '%1%' to '%2%': mismatched impure paths not supported on Darwin",

     

       188
       +
       -                            i.first, i.second.source);

     

       189
       +
       -

     

       190
       +
       -                    std::string path = i.first;

     

       191
       +
       -                    struct stat st;

     

       192
       +
       -                    if (lstat(path.c_str(), &st)) {

     

       193
       +
       -                        if (i.second.optional && errno == ENOENT)

     

       194
       +
       -                            continue;

     

       195
       +
       -                        throw SysError("getting attributes of path '%s", path);

     

       196
       +
       -                    }

     

       197
       +
       -                    if (S_ISDIR(st.st_mode))

     

       198
       +
       -                        sandboxProfile += fmt("\t(subpath \"%s\")\n", path);

     

       199
       +
       -                    else

     

       200
       +
       -                        sandboxProfile += fmt("\t(literal \"%s\")\n", path);

     

       201
       +
       -                }

     

       202
       +
       -                sandboxProfile += ")\n";

     

       203
       +
       +            /* Add the output paths we'll use at build-time to the chroot */

     

       204
       +
       +            sandboxProfile += "(allow file-read* file-write* process-exec\n";

     

       205
       +
       +            for (auto & [_, path] : scratchOutputs)

     

       206
       +
       +                sandboxProfile += fmt("\t(subpath \"%s\")\n", worker.store.printStorePath(path));

     

       207
       +
        

     

       208
       +
       -                /* Allow file-read* on full directory hierarchy to self. Allows realpath() */

     

       209
       +
       -                sandboxProfile += "(allow file-read*\n";

     

       210
       +
       -                for (auto & i : ancestry) {

     

       211
       +
       -                    sandboxProfile += fmt("\t(literal \"%s\")\n", i);

     

       212
       +
       -                }

     

       213
       +
       -                sandboxProfile += ")\n";

     

       214
       +
       +            sandboxProfile += ")\n";

     

       215
       +
        

     

       216
       +
       -                sandboxProfile += additionalSandboxProfile;

     

       217
       +
       -            } else

     

       218
       +
       -                sandboxProfile +=

     

       219
       +
       -                    #include "sandbox-minimal.sb"

     

       220
       +
       -                    ;

     

       221
       +
       +            /* Our inputs (transitive dependencies and any impurities computed above)

     

       222
       +
       +

     

       223
       +
       +                without file-write* allowed, access() incorrectly returns EPERM

     

       224
       +
       +                */

     

       225
       +
       +            sandboxProfile += "(allow file-read* file-write* process-exec\n";

     

       226
       +
       +            for (auto & i : pathsInChroot) {

     

       227
       +
       +                if (i.first != i.second.source)

     

       228
       +
       +                    throw Error(

     

       229
       +
       +                        "can't map '%1%' to '%2%': mismatched impure paths not supported on Darwin",

     

       230
       +
       +                        i.first, i.second.source);

     

       231
       +
       +

     

       232
       +
       +                std::string path = i.first;

     

       233
       +
       +                struct stat st;

     

       234
       +
       +                if (lstat(path.c_str(), &st)) {

     

       235
       +
       +                    if (i.second.optional && errno == ENOENT)

     

       236
       +
       +                        continue;

     

       237
       +
       +                    throw SysError("getting attributes of path '%s", path);

     

       238
       +
       +                }

     

       239
       +
       +                if (S_ISDIR(st.st_mode))

     

       240
       +
       +                    sandboxProfile += fmt("\t(subpath \"%s\")\n", path);

     

       241
       +
       +                else

     

       242
       +
       +                    sandboxProfile += fmt("\t(literal \"%s\")\n", path);

     

       243
       +
       +            }

     

       244
       +
       +            sandboxProfile += ")\n";

     

       245
       +
        

     

       246
       +
       -            debug("Generated sandbox profile:");

     

       247
       +
       -            debug(sandboxProfile);

     

       248
       +
       +            /* Allow file-read* on full directory hierarchy to self. Allows realpath() */

     

       249
       +
       +            sandboxProfile += "(allow file-read*\n";

     

       250
       +
       +            for (auto & i : ancestry) {

     

       251
       +
       +                sandboxProfile += fmt("\t(literal \"%s\")\n", i);

     

       252
       +
       +            }

     

       253
       +
       +            sandboxProfile += ")\n";

     

       254
       +
        

     

       255
       +
       -            Path sandboxFile = tmpDir + "/.sandbox.sb";

     

       256
       +
       +            sandboxProfile += additionalSandboxProfile;

     

       257
       +
       +        } else

     

       258
       +
       +            sandboxProfile +=

     

       259
       +
       +                #include "sandbox-minimal.sb"

     

       260
       +
       +                ;

     

       261
       +
        

     

       262
       +
       -            writeFile(sandboxFile, sandboxProfile);

     

       263
       +
       +        debug("Generated sandbox profile:");

     

       264
       +
       +        debug(sandboxProfile);

     

       265
       +
        

     

       266
       +
       -            bool allowLocalNetworking = parsedDrv->getBoolAttr("__darwinAllowLocalNetworking");

     

       267
       +
       +        bool allowLocalNetworking = parsedDrv->getBoolAttr("__darwinAllowLocalNetworking");

     

       268
       +
        

     

       269
       +
       -            /* The tmpDir in scope points at the temporary build directory for our derivation. Some packages try different mechanisms

     

       270
       +
       -               to find temporary directories, so we want to open up a broader place for them to dump their files, if needed. */

     

       271
       +
       -            Path globalTmpDir = canonPath(getEnvNonEmpty("TMPDIR").value_or("/tmp"), true);

     

       272
       +
       +        /* The tmpDir in scope points at the temporary build directory for our derivation. Some packages try different mechanisms

     

       273
       +
       +            to find temporary directories, so we want to open up a broader place for them to dump their files, if needed. */

     

       274
       +
       +        Path globalTmpDir = canonPath(getEnvNonEmpty("TMPDIR").value_or("/tmp"), true);

     

       275
       +
        

     

       276
       +
       -            /* They don't like trailing slashes on subpath directives */

     

       277
       +
       -            if (globalTmpDir.back() == '/') globalTmpDir.pop_back();

     

       278
       +
       +        /* They don't like trailing slashes on subpath directives */

     

       279
       +
       +        if (globalTmpDir.back() == '/') globalTmpDir.pop_back();

     

       280
       +
        

     

       281
       +
       -            if (getEnv("_NIX_TEST_NO_SANDBOX") != "1") {

     

       282
       +
       -                builder = "/usr/bin/sandbox-exec";

     

       283
       +
       -                args.push_back("sandbox-exec");

     

       284
       +
       -                args.push_back("-f");

     

       285
       +
       -                args.push_back(sandboxFile);

     

       286
       +
       -                args.push_back("-D");

     

       287
       +
       -                args.push_back("_GLOBAL_TMP_DIR=" + globalTmpDir);

     

       288
       +
       -                if (allowLocalNetworking) {

     

       289
       +
       -                    args.push_back("-D");

     

       290
       +
       -                    args.push_back(std::string("_ALLOW_LOCAL_NETWORKING=1"));

     

       291
       +
       -                }

     

       292
       +
       -                args.push_back(drv->builder);

     

       293
       +
       -            } else {

     

       294
       +
       -                builder = drv->builder;

     

       295
       +
       -                args.push_back(std::string(baseNameOf(drv->builder)));

     

       296
       +
       +        if (getEnv("_NIX_TEST_NO_SANDBOX") != "1") {

     

       297
       +
       +            Strings sandboxArgs;

     

       298
       +
       +            sandboxArgs.push_back("_GLOBAL_TMP_DIR");

     

       299
       +
       +            sandboxArgs.push_back(globalTmpDir);

     

       300
       +
       +            if (allowLocalNetworking) {

     

       301
       +
       +                sandboxArgs.push_back("_ALLOW_LOCAL_NETWORKING");

     

       302
       +
       +                sandboxArgs.push_back("1");

     

       303
       +
       +            }

     

       304
       +
       +            if (sandbox_init_with_parameters(sandboxProfile.c_str(), 0, stringsToCharPtrs(sandboxArgs).data(), NULL)) {

     

       305
       +
       +                writeFull(STDERR_FILENO, "failed to configure sandbox\n");

     

       306
       +
       +                _exit(1);

     

       307
       +
                    }

     

       308
       +
                }

     

       309
       +
       +

     

       310
       +
       +        builder = drv->builder;

     

       311
       +
       +        args.push_back(std::string(baseNameOf(drv->builder)));

     

       312
       +
        #else

     

       313
       +
       -        else {

     

       314
       +
       +        if (!drv->isBuiltin()) {

     

       315
       +
                    builder = drv->builder;

     

       316
       +
                    args.push_back(std::string(baseNameOf(drv->builder)));

     

       317
       +
                }

     

       318
       +
       -- 

     

       319
       +
       2.46.1

     

       320
       +

+34

pkgs/tools/package-management/nix/patches/2_21/0002-local-derivation-goal-Print-sandbox-error-detail-on-.patch

···

       1
       +
       From b429e96583e2d005c77df8c82261022397f20648 Mon Sep 17 00:00:00 2001

     

       2
       +
       From: Robert Hensing <robert@roberthensing.nl>

     

       3
       +
       Date: Thu, 3 Oct 2024 12:44:12 +0200

     

       4
       +
       Subject: [PATCH 2/4] local-derivation-goal: Print sandbox error detail on

     

       5
       +
        darwin

     

       6
       +
       MIME-Version: 1.0

     

       7
       +
       Content-Type: text/plain; charset=UTF-8

     

       8
       +
       Content-Transfer-Encoding: 8bit

     

       9
       +
       

     

       10
       +
       Co-Authored-By: Théophane Hufschmitt <theophane.hufschmitt@tweag.io>

     

       11
       +
       Signed-off-by: Jörg Thalheim <joerg@thalheim.io>

     

       12
       +
       ---

     

       13
       +
        src/libstore/build/local-derivation-goal.cc | 5 +++--

     

       14
       +
        1 file changed, 3 insertions(+), 2 deletions(-)

     

       15
       +
       

     

       16
       +
       diff --git a/src/libstore/build/local-derivation-goal.cc b/src/libstore/build/local-derivation-goal.cc

     

       17
       +
       index c73b30b80..e6f4c397d 100644

     

       18
       +
       --- a/src/libstore/build/local-derivation-goal.cc

     

       19
       +
       +++ b/src/libstore/build/local-derivation-goal.cc

     

       20
       +
       @@ -2137,8 +2137,9 @@ void LocalDerivationGoal::runChild()

     

       21
       +
                        sandboxArgs.push_back("_ALLOW_LOCAL_NETWORKING");

     

       22
       +
                        sandboxArgs.push_back("1");

     

       23
       +
                    }

     

       24
       +
       -            if (sandbox_init_with_parameters(sandboxProfile.c_str(), 0, stringsToCharPtrs(sandboxArgs).data(), NULL)) {

     

       25
       +
       -                writeFull(STDERR_FILENO, "failed to configure sandbox\n");

     

       26
       +
       +            char * sandbox_errbuf = nullptr;

     

       27
       +
       +            if (sandbox_init_with_parameters(sandboxProfile.c_str(), 0, stringsToCharPtrs(sandboxArgs).data(), &sandbox_errbuf)) {

     

       28
       +
       +                writeFull(STDERR_FILENO, fmt("failed to configure sandbox: %s\n", sandbox_errbuf ? sandbox_errbuf : "(null)"));

     

       29
       +
                        _exit(1);

     

       30
       +
                    }

     

       31
       +
                }

     

       32
       +
       -- 

     

       33
       +
       2.46.1

     

       34
       +

+41

pkgs/tools/package-management/nix/patches/2_21/0003-local-derivation-goal-Refactor.patch

···

       1
       +
       From 74b93c1edba00c2601e20b8acdcc78e29bd3f092 Mon Sep 17 00:00:00 2001

     

       2
       +
       From: Robert Hensing <robert@roberthensing.nl>

     

       3
       +
       Date: Thu, 3 Oct 2024 12:50:27 +0200

     

       4
       +
       Subject: [PATCH 3/4] local-derivation-goal: Refactor

     

       5
       +
       MIME-Version: 1.0

     

       6
       +
       Content-Type: text/plain; charset=UTF-8

     

       7
       +
       Content-Transfer-Encoding: 8bit

     

       8
       +
       

     

       9
       +
       This works because the `builder` and `args` variables are only used

     

       10
       +
       in the non-builtin code path.

     

       11
       +
       

     

       12
       +
       Co-Authored-By: Théophane Hufschmitt <theophane.hufschmitt@tweag.io>

     

       13
       +
       Signed-off-by: Jörg Thalheim <joerg@thalheim.io>

     

       14
       +
       ---

     

       15
       +
        src/libstore/build/local-derivation-goal.cc | 5 +----

     

       16
       +
        1 file changed, 1 insertion(+), 4 deletions(-)

     

       17
       +
       

     

       18
       +
       diff --git a/src/libstore/build/local-derivation-goal.cc b/src/libstore/build/local-derivation-goal.cc

     

       19
       +
       index e6f4c397d..e81818fa8 100644

     

       20
       +
       --- a/src/libstore/build/local-derivation-goal.cc

     

       21
       +
       +++ b/src/libstore/build/local-derivation-goal.cc

     

       22
       +
       @@ -2143,15 +2143,12 @@ void LocalDerivationGoal::runChild()

     

       23
       +
                        _exit(1);

     

       24
       +
                    }

     

       25
       +
                }

     

       26
       +
       +#endif

     

       27
       +
        

     

       28
       +
       -        builder = drv->builder;

     

       29
       +
       -        args.push_back(std::string(baseNameOf(drv->builder)));

     

       30
       +
       -#else

     

       31
       +
                if (!drv->isBuiltin()) {

     

       32
       +
                    builder = drv->builder;

     

       33
       +
                    args.push_back(std::string(baseNameOf(drv->builder)));

     

       34
       +
                }

     

       35
       +
       -#endif

     

       36
       +
        

     

       37
       +
                for (auto & i : drv->args)

     

       38
       +
                    args.push_back(rewriteStrings(i, inputRewrites));

     

       39
       +
       -- 

     

       40
       +
       2.46.1

     

       41
       +

+75

pkgs/tools/package-management/nix/patches/2_21/0004-local-derivation-goal-Move-builder-preparation-to-no.patch

···

       1
       +
       From c8de35f74cbce58651c3b64ba66061040f546b9f Mon Sep 17 00:00:00 2001

     

       2
       +
       From: Robert Hensing <robert@roberthensing.nl>

     

       3
       +
       Date: Thu, 3 Oct 2024 12:57:00 +0200

     

       4
       +
       Subject: [PATCH 4/4] local-derivation-goal: Move builder preparation to

     

       5
       +
        non-builtin code path

     

       6
       +
       MIME-Version: 1.0

     

       7
       +
       Content-Type: text/plain; charset=UTF-8

     

       8
       +
       Content-Transfer-Encoding: 8bit

     

       9
       +
       

     

       10
       +
       Signed-off-by: Jörg Thalheim <joerg@thalheim.io>

     

       11
       +
       ---

     

       12
       +
        src/libstore/build/local-derivation-goal.cc | 25 +++++++++------------

     

       13
       +
        1 file changed, 10 insertions(+), 15 deletions(-)

     

       14
       +
       

     

       15
       +
       diff --git a/src/libstore/build/local-derivation-goal.cc b/src/libstore/build/local-derivation-goal.cc

     

       16
       +
       index e81818fa8..078f1a5be 100644

     

       17
       +
       --- a/src/libstore/build/local-derivation-goal.cc

     

       18
       +
       +++ b/src/libstore/build/local-derivation-goal.cc

     

       19
       +
       @@ -2017,11 +2017,6 @@ void LocalDerivationGoal::runChild()

     

       20
       +
                        throw SysError("setuid failed");

     

       21
       +
                }

     

       22
       +
        

     

       23
       +
       -        /* Fill in the arguments. */

     

       24
       +
       -        Strings args;

     

       25
       +
       -

     

       26
       +
       -        std::string builder = "invalid";

     

       27
       +
       -

     

       28
       +
        #if __APPLE__

     

       29
       +
                /* This has to appear before import statements. */

     

       30
       +
                std::string sandboxProfile = "(version 1)\n";

     

       31
       +
       @@ -2145,14 +2140,6 @@ void LocalDerivationGoal::runChild()

     

       32
       +
                }

     

       33
       +
        #endif

     

       34
       +
        

     

       35
       +
       -        if (!drv->isBuiltin()) {

     

       36
       +
       -            builder = drv->builder;

     

       37
       +
       -            args.push_back(std::string(baseNameOf(drv->builder)));

     

       38
       +
       -        }

     

       39
       +
       -

     

       40
       +
       -        for (auto & i : drv->args)

     

       41
       +
       -            args.push_back(rewriteStrings(i, inputRewrites));

     

       42
       +
       -

     

       43
       +
                /* Indicate that we managed to set up the build environment. */

     

       44
       +
                writeFull(STDERR_FILENO, std::string("\2\n"));

     

       45
       +
        

     

       46
       +
       @@ -2183,6 +2170,14 @@ void LocalDerivationGoal::runChild()

     

       47
       +
                    }

     

       48
       +
                }

     

       49
       +
        

     

       50
       +
       +        // Now builder is not builtin

     

       51
       +
       +

     

       52
       +
       +        Strings args;

     

       53
       +
       +        args.push_back(std::string(baseNameOf(drv->builder)));

     

       54
       +
       +

     

       55
       +
       +        for (auto & i : drv->args)

     

       56
       +
       +            args.push_back(rewriteStrings(i, inputRewrites));

     

       57
       +
       +

     

       58
       +
        #if __APPLE__

     

       59
       +
                posix_spawnattr_t attrp;

     

       60
       +
        

     

       61
       +
       @@ -2204,9 +2199,9 @@ void LocalDerivationGoal::runChild()

     

       62
       +
                    posix_spawnattr_setbinpref_np(&attrp, 1, &cpu, NULL);

     

       63
       +
                }

     

       64
       +
        

     

       65
       +
       -        posix_spawn(NULL, builder.c_str(), NULL, &attrp, stringsToCharPtrs(args).data(), stringsToCharPtrs(envStrs).data());

     

       66
       +
       +        posix_spawn(NULL, drv->builder.c_str(), NULL, &attrp, stringsToCharPtrs(args).data(), stringsToCharPtrs(envStrs).data());

     

       67
       +
        #else

     

       68
       +
       -        execve(builder.c_str(), stringsToCharPtrs(args).data(), stringsToCharPtrs(envStrs).data());

     

       69
       +
       +        execve(drv->builder.c_str(), stringsToCharPtrs(args).data(), stringsToCharPtrs(envStrs).data());

     

       70
       +
        #endif

     

       71
       +
        

     

       72
       +
                throw SysError("executing '%1%'", drv->builder);

     

       73
       +
       -- 

     

       74
       +
       2.46.1

     

       75
       +

+327

pkgs/tools/package-management/nix/patches/2_22/0001-fix-Run-all-derivation-builders-inside-the-sandbox-o.patch

···

       1
       +
       From 8217054e3554ffd376f42fb0a65087a7af2ddfab Mon Sep 17 00:00:00 2001

     

       2
       +
       From: Puck Meerburg <puck@puckipedia.com>

     

       3
       +
       Date: Fri, 1 Mar 2024 11:42:24 -0500

     

       4
       +
       Subject: [PATCH 1/4] fix: Run all derivation builders inside the sandbox on

     

       5
       +
        macOS

     

       6
       +
       MIME-Version: 1.0

     

       7
       +
       Content-Type: text/plain; charset=UTF-8

     

       8
       +
       Content-Transfer-Encoding: 8bit

     

       9
       +
       

     

       10
       +
       Signed-off-by: Jörg Thalheim <joerg@thalheim.io>

     

       11
       +
       ---

     

       12
       +
        configure.ac                                  |   6 +-

     

       13
       +
        package.nix                                   |   5 +-

     

       14
       +
        .../unix/build/local-derivation-goal.cc       | 223 +++++++++---------

     

       15
       +
        3 files changed, 118 insertions(+), 116 deletions(-)

     

       16
       +
       

     

       17
       +
       diff --git a/configure.ac b/configure.ac

     

       18
       +
       index 8f60bf4be..5e67e04be 100644

     

       19
       +
       --- a/configure.ac

     

       20
       +
       +++ b/configure.ac

     

       21
       +
       @@ -62,13 +62,17 @@ AC_CHECK_TOOL([AR], [ar])

     

       22
       +
        AC_SYS_LARGEFILE

     

       23
       +
        

     

       24
       +
        

     

       25
       +
       -# Solaris-specific stuff.

     

       26
       +
       +# OS-specific stuff.

     

       27
       +
        AC_STRUCT_DIRENT_D_TYPE

     

       28
       +
        case "$host_os" in

     

       29
       +
          solaris*)

     

       30
       +
            # Solaris requires -lsocket -lnsl for network functions

     

       31
       +
            LDFLAGS="-lsocket -lnsl $LDFLAGS"

     

       32
       +
            ;;

     

       33
       +
       +  darwin*)

     

       34
       +
       +    # Need to link to libsandbox.

     

       35
       +
       +    LDFLAGS="-lsandbox $LDFLAGS"

     

       36
       +
       +    ;;

     

       37
       +
        esac

     

       38
       +
        

     

       39
       +
        

     

       40
       +
       diff --git a/package.nix b/package.nix

     

       41
       +
       index 59265f522..28be97400 100644

     

       42
       +
       --- a/package.nix

     

       43
       +
       +++ b/package.nix

     

       44
       +
       @@ -27,6 +27,7 @@

     

       45
       +
        , libseccomp

     

       46
       +
        , libsodium

     

       47
       +
        , man

     

       48
       +
       +, darwin

     

       49
       +
        , lowdown

     

       50
       +
        , mdbook

     

       51
       +
        , mdbook-linkcheck

     

       52
       +
       @@ -249,7 +250,9 @@ in {

     

       53
       +
          ] ++ lib.optionals buildUnitTests [

     

       54
       +
            gtest

     

       55
       +
            rapidcheck

     

       56
       +
       -  ] ++ lib.optional stdenv.isLinux (libseccomp.overrideAttrs (_: rec {

     

       57
       +
       +  ]

     

       58
       +
       +    ++ lib.optional stdenv.hostPlatform.isDarwin darwin.apple_sdk.libs.sandbox

     

       59
       +
       +    ++ lib.optional stdenv.isLinux (libseccomp.overrideAttrs (_: rec {

     

       60
       +
            version = "2.5.5";

     

       61
       +
            src = fetchurl {

     

       62
       +
              url = "https://github.com/seccomp/libseccomp/releases/download/v${version}/libseccomp-${version}.tar.gz";

     

       63
       +
       diff --git a/src/libstore/unix/build/local-derivation-goal.cc b/src/libstore/unix/build/local-derivation-goal.cc

     

       64
       +
       index b8ccdf834..449d4b07c 100644

     

       65
       +
       --- a/src/libstore/unix/build/local-derivation-goal.cc

     

       66
       +
       +++ b/src/libstore/unix/build/local-derivation-goal.cc

     

       67
       +
       @@ -58,6 +58,10 @@

     

       68
       +
        #if __APPLE__

     

       69
       +
        #include <spawn.h>

     

       70
       +
        #include <sys/sysctl.h>

     

       71
       +
       +#include <sandbox.h>

     

       72
       +
       +

     

       73
       +
       +/* This definition is undocumented but depended upon by all major browsers. */

     

       74
       +
       +extern "C" int sandbox_init_with_parameters(const char *profile, uint64_t flags, const char *const parameters[], char **errorbuf);

     

       75
       +
        #endif

     

       76
       +
        

     

       77
       +
        #include <pwd.h>

     

       78
       +
       @@ -2026,141 +2030,132 @@ void LocalDerivationGoal::runChild()

     

       79
       +
        

     

       80
       +
                std::string builder = "invalid";

     

       81
       +
        

     

       82
       +
       -        if (drv->isBuiltin()) {

     

       83
       +
       -            ;

     

       84
       +
       -        }

     

       85
       +
        #if __APPLE__

     

       86
       +
       -        else {

     

       87
       +
       -            /* This has to appear before import statements. */

     

       88
       +
       -            std::string sandboxProfile = "(version 1)\n";

     

       89
       +
       -

     

       90
       +
       -            if (useChroot) {

     

       91
       +
       -

     

       92
       +
       -                /* Lots and lots and lots of file functions freak out if they can't stat their full ancestry */

     

       93
       +
       -                PathSet ancestry;

     

       94
       +
       -

     

       95
       +
       -                /* We build the ancestry before adding all inputPaths to the store because we know they'll

     

       96
       +
       -                   all have the same parents (the store), and there might be lots of inputs. This isn't

     

       97
       +
       -                   particularly efficient... I doubt it'll be a bottleneck in practice */

     

       98
       +
       -                for (auto & i : pathsInChroot) {

     

       99
       +
       -                    Path cur = i.first;

     

       100
       +
       -                    while (cur.compare("/") != 0) {

     

       101
       +
       -                        cur = dirOf(cur);

     

       102
       +
       -                        ancestry.insert(cur);

     

       103
       +
       -                    }

     

       104
       +
       -                }

     

       105
       +
       +        /* This has to appear before import statements. */

     

       106
       +
       +        std::string sandboxProfile = "(version 1)\n";

     

       107
       +
       +

     

       108
       +
       +        if (useChroot) {

     

       109
       +
        

     

       110
       +
       -                /* And we want the store in there regardless of how empty pathsInChroot. We include the innermost

     

       111
       +
       -                   path component this time, since it's typically /nix/store and we care about that. */

     

       112
       +
       -                Path cur = worker.store.storeDir;

     

       113
       +
       +            /* Lots and lots and lots of file functions freak out if they can't stat their full ancestry */

     

       114
       +
       +            PathSet ancestry;

     

       115
       +
       +

     

       116
       +
       +            /* We build the ancestry before adding all inputPaths to the store because we know they'll

     

       117
       +
       +               all have the same parents (the store), and there might be lots of inputs. This isn't

     

       118
       +
       +               particularly efficient... I doubt it'll be a bottleneck in practice */

     

       119
       +
       +            for (auto & i : pathsInChroot) {

     

       120
       +
       +                Path cur = i.first;

     

       121
       +
                        while (cur.compare("/") != 0) {

     

       122
       +
       -                    ancestry.insert(cur);

     

       123
       +
                            cur = dirOf(cur);

     

       124
       +
       +                    ancestry.insert(cur);

     

       125
       +
                        }

     

       126
       +
       +            }

     

       127
       +
        

     

       128
       +
       -                /* Add all our input paths to the chroot */

     

       129
       +
       -                for (auto & i : inputPaths) {

     

       130
       +
       -                    auto p = worker.store.printStorePath(i);

     

       131
       +
       -                    pathsInChroot[p] = p;

     

       132
       +
       -                }

     

       133
       +
       -

     

       134
       +
       -                /* Violations will go to the syslog if you set this. Unfortunately the destination does not appear to be configurable */

     

       135
       +
       -                if (settings.darwinLogSandboxViolations) {

     

       136
       +
       -                    sandboxProfile += "(deny default)\n";

     

       137
       +
       -                } else {

     

       138
       +
       -                    sandboxProfile += "(deny default (with no-log))\n";

     

       139
       +
       -                }

     

       140
       +
       +            /* And we want the store in there regardless of how empty pathsInChroot. We include the innermost

     

       141
       +
       +               path component this time, since it's typically /nix/store and we care about that. */

     

       142
       +
       +            Path cur = worker.store.storeDir;

     

       143
       +
       +            while (cur.compare("/") != 0) {

     

       144
       +
       +                ancestry.insert(cur);

     

       145
       +
       +                cur = dirOf(cur);

     

       146
       +
       +            }

     

       147
       +
        

     

       148
       +
       -                sandboxProfile +=

     

       149
       +
       -                    #include "sandbox-defaults.sb"

     

       150
       +
       -                    ;

     

       151
       +
       +            /* Add all our input paths to the chroot */

     

       152
       +
       +            for (auto & i : inputPaths) {

     

       153
       +
       +                auto p = worker.store.printStorePath(i);

     

       154
       +
       +                pathsInChroot[p] = p;

     

       155
       +
       +            }

     

       156
       +
        

     

       157
       +
       -                if (!derivationType->isSandboxed())

     

       158
       +
       -                    sandboxProfile +=

     

       159
       +
       -                        #include "sandbox-network.sb"

     

       160
       +
       -                        ;

     

       161
       +
       -

     

       162
       +
       -                /* Add the output paths we'll use at build-time to the chroot */

     

       163
       +
       -                sandboxProfile += "(allow file-read* file-write* process-exec\n";

     

       164
       +
       -                for (auto & [_, path] : scratchOutputs)

     

       165
       +
       -                    sandboxProfile += fmt("\t(subpath \"%s\")\n", worker.store.printStorePath(path));

     

       166
       +
       -

     

       167
       +
       -                sandboxProfile += ")\n";

     

       168
       +
       -

     

       169
       +
       -                /* Our inputs (transitive dependencies and any impurities computed above)

     

       170
       +
       -

     

       171
       +
       -                   without file-write* allowed, access() incorrectly returns EPERM

     

       172
       +
       -                 */

     

       173
       +
       -                sandboxProfile += "(allow file-read* file-write* process-exec\n";

     

       174
       +
       -                for (auto & i : pathsInChroot) {

     

       175
       +
       -                    if (i.first != i.second.source)

     

       176
       +
       -                        throw Error(

     

       177
       +
       -                            "can't map '%1%' to '%2%': mismatched impure paths not supported on Darwin",

     

       178
       +
       -                            i.first, i.second.source);

     

       179
       +
       -

     

       180
       +
       -                    std::string path = i.first;

     

       181
       +
       -                    auto optSt = maybeLstat(path.c_str());

     

       182
       +
       -                    if (!optSt) {

     

       183
       +
       -                        if (i.second.optional)

     

       184
       +
       -                            continue;

     

       185
       +
       -                        throw SysError("getting attributes of required path '%s", path);

     

       186
       +
       -                    }

     

       187
       +
       -                    if (S_ISDIR(optSt->st_mode))

     

       188
       +
       -                        sandboxProfile += fmt("\t(subpath \"%s\")\n", path);

     

       189
       +
       -                    else

     

       190
       +
       -                        sandboxProfile += fmt("\t(literal \"%s\")\n", path);

     

       191
       +
       -                }

     

       192
       +
       -                sandboxProfile += ")\n";

     

       193
       +
       +            /* Violations will go to the syslog if you set this. Unfortunately the destination does not appear to be configurable */

     

       194
       +
       +            if (settings.darwinLogSandboxViolations) {

     

       195
       +
       +                sandboxProfile += "(deny default)\n";

     

       196
       +
       +            } else {

     

       197
       +
       +                sandboxProfile += "(deny default (with no-log))\n";

     

       198
       +
       +            }

     

       199
       +
        

     

       200
       +
       -                /* Allow file-read* on full directory hierarchy to self. Allows realpath() */

     

       201
       +
       -                sandboxProfile += "(allow file-read*\n";

     

       202
       +
       -                for (auto & i : ancestry) {

     

       203
       +
       -                    sandboxProfile += fmt("\t(literal \"%s\")\n", i);

     

       204
       +
       -                }

     

       205
       +
       -                sandboxProfile += ")\n";

     

       206
       +
       +            sandboxProfile +=

     

       207
       +
       +                #include "sandbox-defaults.sb"

     

       208
       +
       +                ;

     

       209
       +
        

     

       210
       +
       -                sandboxProfile += additionalSandboxProfile;

     

       211
       +
       -            } else

     

       212
       +
       +            if (!derivationType->isSandboxed())

     

       213
       +
                        sandboxProfile +=

     

       214
       +
       -                    #include "sandbox-minimal.sb"

     

       215
       +
       +                    #include "sandbox-network.sb"

     

       216
       +
                            ;

     

       217
       +
        

     

       218
       +
       -            debug("Generated sandbox profile:");

     

       219
       +
       -            debug(sandboxProfile);

     

       220
       +
       -

     

       221
       +
       -            Path sandboxFile = tmpDir + "/.sandbox.sb";

     

       222
       +
       +            /* Add the output paths we'll use at build-time to the chroot */

     

       223
       +
       +            sandboxProfile += "(allow file-read* file-write* process-exec\n";

     

       224
       +
       +            for (auto & [_, path] : scratchOutputs)

     

       225
       +
       +                sandboxProfile += fmt("\t(subpath \"%s\")\n", worker.store.printStorePath(path));

     

       226
       +
        

     

       227
       +
       -            writeFile(sandboxFile, sandboxProfile);

     

       228
       +
       +            sandboxProfile += ")\n";

     

       229
       +
        

     

       230
       +
       -            bool allowLocalNetworking = parsedDrv->getBoolAttr("__darwinAllowLocalNetworking");

     

       231
       +
       +            /* Our inputs (transitive dependencies and any impurities computed above)

     

       232
       +
        

     

       233
       +
       -            /* The tmpDir in scope points at the temporary build directory for our derivation. Some packages try different mechanisms

     

       234
       +
       -               to find temporary directories, so we want to open up a broader place for them to put their files, if needed. */

     

       235
       +
       -            Path globalTmpDir = canonPath(defaultTempDir(), true);

     

       236
       +
       +               without file-write* allowed, access() incorrectly returns EPERM

     

       237
       +
       +             */

     

       238
       +
       +            sandboxProfile += "(allow file-read* file-write* process-exec\n";

     

       239
       +
       +            for (auto & i : pathsInChroot) {

     

       240
       +
       +                if (i.first != i.second.source)

     

       241
       +
       +                    throw Error(

     

       242
       +
       +                        "can't map '%1%' to '%2%': mismatched impure paths not supported on Darwin",

     

       243
       +
       +                        i.first, i.second.source);

     

       244
       +
       +

     

       245
       +
       +                std::string path = i.first;

     

       246
       +
       +                auto optSt = maybeLstat(path.c_str());

     

       247
       +
       +                if (!optSt) {

     

       248
       +
       +                    if (i.second.optional)

     

       249
       +
       +                        continue;

     

       250
       +
       +                    throw SysError("getting attributes of required path '%s", path);

     

       251
       +
       +                }

     

       252
       +
       +                if (S_ISDIR(optSt->st_mode))

     

       253
       +
       +                    sandboxProfile += fmt("\t(subpath \"%s\")\n", path);

     

       254
       +
       +                else

     

       255
       +
       +                    sandboxProfile += fmt("\t(literal \"%s\")\n", path);

     

       256
       +
       +            }

     

       257
       +
       +            sandboxProfile += ")\n";

     

       258
       +
        

     

       259
       +
       -            /* They don't like trailing slashes on subpath directives */

     

       260
       +
       -            while (!globalTmpDir.empty() && globalTmpDir.back() == '/')

     

       261
       +
       -                globalTmpDir.pop_back();

     

       262
       +
       +            /* Allow file-read* on full directory hierarchy to self. Allows realpath() */

     

       263
       +
       +            sandboxProfile += "(allow file-read*\n";

     

       264
       +
       +            for (auto & i : ancestry) {

     

       265
       +
       +                sandboxProfile += fmt("\t(literal \"%s\")\n", i);

     

       266
       +
       +            }

     

       267
       +
       +            sandboxProfile += ")\n";

     

       268
       +
        

     

       269
       +
       -            if (getEnv("_NIX_TEST_NO_SANDBOX") != "1") {

     

       270
       +
       -                builder = "/usr/bin/sandbox-exec";

     

       271
       +
       -                args.push_back("sandbox-exec");

     

       272
       +
       -                args.push_back("-f");

     

       273
       +
       -                args.push_back(sandboxFile);

     

       274
       +
       -                args.push_back("-D");

     

       275
       +
       -                args.push_back("_GLOBAL_TMP_DIR=" + globalTmpDir);

     

       276
       +
       -                if (allowLocalNetworking) {

     

       277
       +
       -                    args.push_back("-D");

     

       278
       +
       -                    args.push_back(std::string("_ALLOW_LOCAL_NETWORKING=1"));

     

       279
       +
       -                }

     

       280
       +
       -                args.push_back(drv->builder);

     

       281
       +
       -            } else {

     

       282
       +
       -                builder = drv->builder;

     

       283
       +
       -                args.push_back(std::string(baseNameOf(drv->builder)));

     

       284
       +
       +            sandboxProfile += additionalSandboxProfile;

     

       285
       +
       +        } else

     

       286
       +
       +            sandboxProfile +=

     

       287
       +
       +                #include "sandbox-minimal.sb"

     

       288
       +
       +                ;

     

       289
       +
       +

     

       290
       +
       +        debug("Generated sandbox profile:");

     

       291
       +
       +        debug(sandboxProfile);

     

       292
       +
       +

     

       293
       +
       +        bool allowLocalNetworking = parsedDrv->getBoolAttr("__darwinAllowLocalNetworking");

     

       294
       +
       +

     

       295
       +
       +        /* The tmpDir in scope points at the temporary build directory for our derivation. Some packages try different mechanisms

     

       296
       +
       +            to find temporary directories, so we want to open up a broader place for them to put their files, if needed. */

     

       297
       +
       +        Path globalTmpDir = canonPath(defaultTempDir(), true);

     

       298
       +
       +

     

       299
       +
       +        /* They don't like trailing slashes on subpath directives */

     

       300
       +
       +        while (!globalTmpDir.empty() && globalTmpDir.back() == '/')

     

       301
       +
       +            globalTmpDir.pop_back();

     

       302
       +
       +

     

       303
       +
       +        if (getEnv("_NIX_TEST_NO_SANDBOX") != "1") {

     

       304
       +
       +            Strings sandboxArgs;

     

       305
       +
       +            sandboxArgs.push_back("_GLOBAL_TMP_DIR");

     

       306
       +
       +            sandboxArgs.push_back(globalTmpDir);

     

       307
       +
       +            if (allowLocalNetworking) {

     

       308
       +
       +                sandboxArgs.push_back("_ALLOW_LOCAL_NETWORKING");

     

       309
       +
       +                sandboxArgs.push_back("1");

     

       310
       +
       +            }

     

       311
       +
       +            if (sandbox_init_with_parameters(sandboxProfile.c_str(), 0, stringsToCharPtrs(sandboxArgs).data(), NULL)) {

     

       312
       +
       +                writeFull(STDERR_FILENO, "failed to configure sandbox\n");

     

       313
       +
       +                _exit(1);

     

       314
       +
                    }

     

       315
       +
                }

     

       316
       +
       +

     

       317
       +
       +        builder = drv->builder;

     

       318
       +
       +        args.push_back(std::string(baseNameOf(drv->builder)));

     

       319
       +
        #else

     

       320
       +
       -        else {

     

       321
       +
       +        if (!drv->isBuiltin()) {

     

       322
       +
                    builder = drv->builder;

     

       323
       +
                    args.push_back(std::string(baseNameOf(drv->builder)));

     

       324
       +
                }

     

       325
       +
       -- 

     

       326
       +
       2.46.1

     

       327
       +

+34

pkgs/tools/package-management/nix/patches/2_22/0002-local-derivation-goal-Print-sandbox-error-detail-on-.patch

···

       1
       +
       From f0677f190d0bd042c3a864508a5307b19a2c2d26 Mon Sep 17 00:00:00 2001

     

       2
       +
       From: Robert Hensing <robert@roberthensing.nl>

     

       3
       +
       Date: Thu, 3 Oct 2024 12:44:12 +0200

     

       4
       +
       Subject: [PATCH 2/4] local-derivation-goal: Print sandbox error detail on

     

       5
       +
        darwin

     

       6
       +
       MIME-Version: 1.0

     

       7
       +
       Content-Type: text/plain; charset=UTF-8

     

       8
       +
       Content-Transfer-Encoding: 8bit

     

       9
       +
       

     

       10
       +
       Co-Authored-By: Théophane Hufschmitt <theophane.hufschmitt@tweag.io>

     

       11
       +
       Signed-off-by: Jörg Thalheim <joerg@thalheim.io>

     

       12
       +
       ---

     

       13
       +
        src/libstore/unix/build/local-derivation-goal.cc | 5 +++--

     

       14
       +
        1 file changed, 3 insertions(+), 2 deletions(-)

     

       15
       +
       

     

       16
       +
       diff --git a/src/libstore/unix/build/local-derivation-goal.cc b/src/libstore/unix/build/local-derivation-goal.cc

     

       17
       +
       index 449d4b07c..b74bd2e64 100644

     

       18
       +
       --- a/src/libstore/unix/build/local-derivation-goal.cc

     

       19
       +
       +++ b/src/libstore/unix/build/local-derivation-goal.cc

     

       20
       +
       @@ -2146,8 +2146,9 @@ void LocalDerivationGoal::runChild()

     

       21
       +
                        sandboxArgs.push_back("_ALLOW_LOCAL_NETWORKING");

     

       22
       +
                        sandboxArgs.push_back("1");

     

       23
       +
                    }

     

       24
       +
       -            if (sandbox_init_with_parameters(sandboxProfile.c_str(), 0, stringsToCharPtrs(sandboxArgs).data(), NULL)) {

     

       25
       +
       -                writeFull(STDERR_FILENO, "failed to configure sandbox\n");

     

       26
       +
       +            char * sandbox_errbuf = nullptr;

     

       27
       +
       +            if (sandbox_init_with_parameters(sandboxProfile.c_str(), 0, stringsToCharPtrs(sandboxArgs).data(), &sandbox_errbuf)) {

     

       28
       +
       +                writeFull(STDERR_FILENO, fmt("failed to configure sandbox: %s\n", sandbox_errbuf ? sandbox_errbuf : "(null)"));

     

       29
       +
                        _exit(1);

     

       30
       +
                    }

     

       31
       +
                }

     

       32
       +
       -- 

     

       33
       +
       2.46.1

     

       34
       +

+41

pkgs/tools/package-management/nix/patches/2_22/0003-local-derivation-goal-Refactor.patch

···

       1
       +
       From 1b39753f4d63465c709d18482945ce680b6f3f1e Mon Sep 17 00:00:00 2001

     

       2
       +
       From: Robert Hensing <robert@roberthensing.nl>

     

       3
       +
       Date: Thu, 3 Oct 2024 12:50:27 +0200

     

       4
       +
       Subject: [PATCH 3/4] local-derivation-goal: Refactor

     

       5
       +
       MIME-Version: 1.0

     

       6
       +
       Content-Type: text/plain; charset=UTF-8

     

       7
       +
       Content-Transfer-Encoding: 8bit

     

       8
       +
       

     

       9
       +
       This works because the `builder` and `args` variables are only used

     

       10
       +
       in the non-builtin code path.

     

       11
       +
       

     

       12
       +
       Co-Authored-By: Théophane Hufschmitt <theophane.hufschmitt@tweag.io>

     

       13
       +
       Signed-off-by: Jörg Thalheim <joerg@thalheim.io>

     

       14
       +
       ---

     

       15
       +
        src/libstore/unix/build/local-derivation-goal.cc | 5 +----

     

       16
       +
        1 file changed, 1 insertion(+), 4 deletions(-)

     

       17
       +
       

     

       18
       +
       diff --git a/src/libstore/unix/build/local-derivation-goal.cc b/src/libstore/unix/build/local-derivation-goal.cc

     

       19
       +
       index b74bd2e64..9b8b3c51b 100644

     

       20
       +
       --- a/src/libstore/unix/build/local-derivation-goal.cc

     

       21
       +
       +++ b/src/libstore/unix/build/local-derivation-goal.cc

     

       22
       +
       @@ -2152,15 +2152,12 @@ void LocalDerivationGoal::runChild()

     

       23
       +
                        _exit(1);

     

       24
       +
                    }

     

       25
       +
                }

     

       26
       +
       +#endif

     

       27
       +
        

     

       28
       +
       -        builder = drv->builder;

     

       29
       +
       -        args.push_back(std::string(baseNameOf(drv->builder)));

     

       30
       +
       -#else

     

       31
       +
                if (!drv->isBuiltin()) {

     

       32
       +
                    builder = drv->builder;

     

       33
       +
                    args.push_back(std::string(baseNameOf(drv->builder)));

     

       34
       +
                }

     

       35
       +
       -#endif

     

       36
       +
        

     

       37
       +
                for (auto & i : drv->args)

     

       38
       +
                    args.push_back(rewriteStrings(i, inputRewrites));

     

       39
       +
       -- 

     

       40
       +
       2.46.1

     

       41
       +

+75

pkgs/tools/package-management/nix/patches/2_22/0004-local-derivation-goal-Move-builder-preparation-to-no.patch

···

       1
       +
       From 9e198a75f76ac08f835975d4b2743e156616a219 Mon Sep 17 00:00:00 2001

     

       2
       +
       From: Robert Hensing <robert@roberthensing.nl>

     

       3
       +
       Date: Thu, 3 Oct 2024 12:57:00 +0200

     

       4
       +
       Subject: [PATCH 4/4] local-derivation-goal: Move builder preparation to

     

       5
       +
        non-builtin code path

     

       6
       +
       MIME-Version: 1.0

     

       7
       +
       Content-Type: text/plain; charset=UTF-8

     

       8
       +
       Content-Transfer-Encoding: 8bit

     

       9
       +
       

     

       10
       +
       Signed-off-by: Jörg Thalheim <joerg@thalheim.io>

     

       11
       +
       ---

     

       12
       +
        .../unix/build/local-derivation-goal.cc       | 25 ++++++++-----------

     

       13
       +
        1 file changed, 10 insertions(+), 15 deletions(-)

     

       14
       +
       

     

       15
       +
       diff --git a/src/libstore/unix/build/local-derivation-goal.cc b/src/libstore/unix/build/local-derivation-goal.cc

     

       16
       +
       index 9b8b3c51b..08366712c 100644

     

       17
       +
       --- a/src/libstore/unix/build/local-derivation-goal.cc

     

       18
       +
       +++ b/src/libstore/unix/build/local-derivation-goal.cc

     

       19
       +
       @@ -2025,11 +2025,6 @@ void LocalDerivationGoal::runChild()

     

       20
       +
                        throw SysError("setuid failed");

     

       21
       +
                }

     

       22
       +
        

     

       23
       +
       -        /* Fill in the arguments. */

     

       24
       +
       -        Strings args;

     

       25
       +
       -

     

       26
       +
       -        std::string builder = "invalid";

     

       27
       +
       -

     

       28
       +
        #if __APPLE__

     

       29
       +
                /* This has to appear before import statements. */

     

       30
       +
                std::string sandboxProfile = "(version 1)\n";

     

       31
       +
       @@ -2154,14 +2149,6 @@ void LocalDerivationGoal::runChild()

     

       32
       +
                }

     

       33
       +
        #endif

     

       34
       +
        

     

       35
       +
       -        if (!drv->isBuiltin()) {

     

       36
       +
       -            builder = drv->builder;

     

       37
       +
       -            args.push_back(std::string(baseNameOf(drv->builder)));

     

       38
       +
       -        }

     

       39
       +
       -

     

       40
       +
       -        for (auto & i : drv->args)

     

       41
       +
       -            args.push_back(rewriteStrings(i, inputRewrites));

     

       42
       +
       -

     

       43
       +
                /* Indicate that we managed to set up the build environment. */

     

       44
       +
                writeFull(STDERR_FILENO, std::string("\2\n"));

     

       45
       +
        

     

       46
       +
       @@ -2192,6 +2179,14 @@ void LocalDerivationGoal::runChild()

     

       47
       +
                    }

     

       48
       +
                }

     

       49
       +
        

     

       50
       +
       +        // Now builder is not builtin

     

       51
       +
       +

     

       52
       +
       +        Strings args;

     

       53
       +
       +        args.push_back(std::string(baseNameOf(drv->builder)));

     

       54
       +
       +

     

       55
       +
       +        for (auto & i : drv->args)

     

       56
       +
       +            args.push_back(rewriteStrings(i, inputRewrites));

     

       57
       +
       +

     

       58
       +
        #if __APPLE__

     

       59
       +
                posix_spawnattr_t attrp;

     

       60
       +
        

     

       61
       +
       @@ -2213,9 +2208,9 @@ void LocalDerivationGoal::runChild()

     

       62
       +
                    posix_spawnattr_setbinpref_np(&attrp, 1, &cpu, NULL);

     

       63
       +
                }

     

       64
       +
        

     

       65
       +
       -        posix_spawn(NULL, builder.c_str(), NULL, &attrp, stringsToCharPtrs(args).data(), stringsToCharPtrs(envStrs).data());

     

       66
       +
       +        posix_spawn(NULL, drv->builder.c_str(), NULL, &attrp, stringsToCharPtrs(args).data(), stringsToCharPtrs(envStrs).data());

     

       67
       +
        #else

     

       68
       +
       -        execve(builder.c_str(), stringsToCharPtrs(args).data(), stringsToCharPtrs(envStrs).data());

     

       69
       +
       +        execve(drv->builder.c_str(), stringsToCharPtrs(args).data(), stringsToCharPtrs(envStrs).data());

     

       70
       +
        #endif

     

       71
       +
        

     

       72
       +
                throw SysError("executing '%1%'", drv->builder);

     

       73
       +
       -- 

     

       74
       +
       2.46.1

     

       75
       +

+323

pkgs/tools/package-management/nix/patches/2_23/0001-fix-Run-all-derivation-builders-inside-the-sandbox-o.patch

···

       1
       +
       From 05994033d58e358ddafe51d1d04626eb76b8a192 Mon Sep 17 00:00:00 2001

     

       2
       +
       From: Puck Meerburg <puck@puckipedia.com>

     

       3
       +
       Date: Fri, 1 Mar 2024 11:42:24 -0500

     

       4
       +
       Subject: [PATCH 1/4] fix: Run all derivation builders inside the sandbox on

     

       5
       +
        macOS

     

       6
       +
       MIME-Version: 1.0

     

       7
       +
       Content-Type: text/plain; charset=UTF-8

     

       8
       +
       Content-Transfer-Encoding: 8bit

     

       9
       +
       

     

       10
       +
       Signed-off-by: Jörg Thalheim <joerg@thalheim.io>

     

       11
       +
       ---

     

       12
       +
        configure.ac                                  |   6 +-

     

       13
       +
        package.nix                                   |   2 +

     

       14
       +
        .../unix/build/local-derivation-goal.cc       | 223 +++++++++---------

     

       15
       +
        3 files changed, 116 insertions(+), 115 deletions(-)

     

       16
       +
       

     

       17
       +
       diff --git a/configure.ac b/configure.ac

     

       18
       +
       index 90a6d45d5..f98a0a5ea 100644

     

       19
       +
       --- a/configure.ac

     

       20
       +
       +++ b/configure.ac

     

       21
       +
       @@ -62,12 +62,16 @@ AC_CHECK_TOOL([AR], [ar])

     

       22
       +
        AC_SYS_LARGEFILE

     

       23
       +
        

     

       24
       +
        

     

       25
       +
       -# Solaris-specific stuff.

     

       26
       +
       +# OS-specific stuff.

     

       27
       +
        case "$host_os" in

     

       28
       +
          solaris*)

     

       29
       +
            # Solaris requires -lsocket -lnsl for network functions

     

       30
       +
            LDFLAGS="-lsocket -lnsl $LDFLAGS"

     

       31
       +
            ;;

     

       32
       +
       +  darwin*)

     

       33
       +
       +    # Need to link to libsandbox.

     

       34
       +
       +    LDFLAGS="-lsandbox $LDFLAGS"

     

       35
       +
       +    ;;

     

       36
       +
        esac

     

       37
       +
        

     

       38
       +
        

     

       39
       +
       diff --git a/package.nix b/package.nix

     

       40
       +
       index cf1654c6a..1dfe7ab31 100644

     

       41
       +
       --- a/package.nix

     

       42
       +
       +++ b/package.nix

     

       43
       +
       @@ -27,6 +27,7 @@

     

       44
       +
        , libseccomp

     

       45
       +
        , libsodium

     

       46
       +
        , man

     

       47
       +
       +, darwin

     

       48
       +
        , lowdown

     

       49
       +
        , mdbook

     

       50
       +
        , mdbook-linkcheck

     

       51
       +
       @@ -250,6 +251,7 @@ in {

     

       52
       +
            gtest

     

       53
       +
            rapidcheck

     

       54
       +
          ] ++ lib.optional stdenv.isLinux libseccomp

     

       55
       +
       +    ++ lib.optional stdenv.hostPlatform.isDarwin darwin.apple_sdk.libs.sandbox

     

       56
       +
            ++ lib.optional stdenv.hostPlatform.isx86_64 libcpuid

     

       57
       +
            # There have been issues building these dependencies

     

       58
       +
            ++ lib.optional (stdenv.hostPlatform == stdenv.buildPlatform && (stdenv.isLinux || stdenv.isDarwin))

     

       59
       +
       diff --git a/src/libstore/unix/build/local-derivation-goal.cc b/src/libstore/unix/build/local-derivation-goal.cc

     

       60
       +
       index ae9c715d6..878644fa5 100644

     

       61
       +
       --- a/src/libstore/unix/build/local-derivation-goal.cc

     

       62
       +
       +++ b/src/libstore/unix/build/local-derivation-goal.cc

     

       63
       +
       @@ -58,6 +58,10 @@

     

       64
       +
        #if __APPLE__

     

       65
       +
        #include <spawn.h>

     

       66
       +
        #include <sys/sysctl.h>

     

       67
       +
       +#include <sandbox.h>

     

       68
       +
       +

     

       69
       +
       +/* This definition is undocumented but depended upon by all major browsers. */

     

       70
       +
       +extern "C" int sandbox_init_with_parameters(const char *profile, uint64_t flags, const char *const parameters[], char **errorbuf);

     

       71
       +
        #endif

     

       72
       +
        

     

       73
       +
        #include <pwd.h>

     

       74
       +
       @@ -2017,141 +2021,132 @@ void LocalDerivationGoal::runChild()

     

       75
       +
        

     

       76
       +
                std::string builder = "invalid";

     

       77
       +
        

     

       78
       +
       -        if (drv->isBuiltin()) {

     

       79
       +
       -            ;

     

       80
       +
       -        }

     

       81
       +
        #if __APPLE__

     

       82
       +
       -        else {

     

       83
       +
       -            /* This has to appear before import statements. */

     

       84
       +
       -            std::string sandboxProfile = "(version 1)\n";

     

       85
       +
       -

     

       86
       +
       -            if (useChroot) {

     

       87
       +
       -

     

       88
       +
       -                /* Lots and lots and lots of file functions freak out if they can't stat their full ancestry */

     

       89
       +
       -                PathSet ancestry;

     

       90
       +
       -

     

       91
       +
       -                /* We build the ancestry before adding all inputPaths to the store because we know they'll

     

       92
       +
       -                   all have the same parents (the store), and there might be lots of inputs. This isn't

     

       93
       +
       -                   particularly efficient... I doubt it'll be a bottleneck in practice */

     

       94
       +
       -                for (auto & i : pathsInChroot) {

     

       95
       +
       -                    Path cur = i.first;

     

       96
       +
       -                    while (cur.compare("/") != 0) {

     

       97
       +
       -                        cur = dirOf(cur);

     

       98
       +
       -                        ancestry.insert(cur);

     

       99
       +
       -                    }

     

       100
       +
       -                }

     

       101
       +
       +        /* This has to appear before import statements. */

     

       102
       +
       +        std::string sandboxProfile = "(version 1)\n";

     

       103
       +
       +

     

       104
       +
       +        if (useChroot) {

     

       105
       +
        

     

       106
       +
       -                /* And we want the store in there regardless of how empty pathsInChroot. We include the innermost

     

       107
       +
       -                   path component this time, since it's typically /nix/store and we care about that. */

     

       108
       +
       -                Path cur = worker.store.storeDir;

     

       109
       +
       +            /* Lots and lots and lots of file functions freak out if they can't stat their full ancestry */

     

       110
       +
       +            PathSet ancestry;

     

       111
       +
       +

     

       112
       +
       +            /* We build the ancestry before adding all inputPaths to the store because we know they'll

     

       113
       +
       +               all have the same parents (the store), and there might be lots of inputs. This isn't

     

       114
       +
       +               particularly efficient... I doubt it'll be a bottleneck in practice */

     

       115
       +
       +            for (auto & i : pathsInChroot) {

     

       116
       +
       +                Path cur = i.first;

     

       117
       +
                        while (cur.compare("/") != 0) {

     

       118
       +
       -                    ancestry.insert(cur);

     

       119
       +
                            cur = dirOf(cur);

     

       120
       +
       +                    ancestry.insert(cur);

     

       121
       +
                        }

     

       122
       +
       +            }

     

       123
       +
        

     

       124
       +
       -                /* Add all our input paths to the chroot */

     

       125
       +
       -                for (auto & i : inputPaths) {

     

       126
       +
       -                    auto p = worker.store.printStorePath(i);

     

       127
       +
       -                    pathsInChroot[p] = p;

     

       128
       +
       -                }

     

       129
       +
       -

     

       130
       +
       -                /* Violations will go to the syslog if you set this. Unfortunately the destination does not appear to be configurable */

     

       131
       +
       -                if (settings.darwinLogSandboxViolations) {

     

       132
       +
       -                    sandboxProfile += "(deny default)\n";

     

       133
       +
       -                } else {

     

       134
       +
       -                    sandboxProfile += "(deny default (with no-log))\n";

     

       135
       +
       -                }

     

       136
       +
       +            /* And we want the store in there regardless of how empty pathsInChroot. We include the innermost

     

       137
       +
       +               path component this time, since it's typically /nix/store and we care about that. */

     

       138
       +
       +            Path cur = worker.store.storeDir;

     

       139
       +
       +            while (cur.compare("/") != 0) {

     

       140
       +
       +                ancestry.insert(cur);

     

       141
       +
       +                cur = dirOf(cur);

     

       142
       +
       +            }

     

       143
       +
        

     

       144
       +
       -                sandboxProfile +=

     

       145
       +
       -                    #include "sandbox-defaults.sb"

     

       146
       +
       -                    ;

     

       147
       +
       +            /* Add all our input paths to the chroot */

     

       148
       +
       +            for (auto & i : inputPaths) {

     

       149
       +
       +                auto p = worker.store.printStorePath(i);

     

       150
       +
       +                pathsInChroot[p] = p;

     

       151
       +
       +            }

     

       152
       +
        

     

       153
       +
       -                if (!derivationType->isSandboxed())

     

       154
       +
       -                    sandboxProfile +=

     

       155
       +
       -                        #include "sandbox-network.sb"

     

       156
       +
       -                        ;

     

       157
       +
       -

     

       158
       +
       -                /* Add the output paths we'll use at build-time to the chroot */

     

       159
       +
       -                sandboxProfile += "(allow file-read* file-write* process-exec\n";

     

       160
       +
       -                for (auto & [_, path] : scratchOutputs)

     

       161
       +
       -                    sandboxProfile += fmt("\t(subpath \"%s\")\n", worker.store.printStorePath(path));

     

       162
       +
       -

     

       163
       +
       -                sandboxProfile += ")\n";

     

       164
       +
       -

     

       165
       +
       -                /* Our inputs (transitive dependencies and any impurities computed above)

     

       166
       +
       -

     

       167
       +
       -                   without file-write* allowed, access() incorrectly returns EPERM

     

       168
       +
       -                 */

     

       169
       +
       -                sandboxProfile += "(allow file-read* file-write* process-exec\n";

     

       170
       +
       -                for (auto & i : pathsInChroot) {

     

       171
       +
       -                    if (i.first != i.second.source)

     

       172
       +
       -                        throw Error(

     

       173
       +
       -                            "can't map '%1%' to '%2%': mismatched impure paths not supported on Darwin",

     

       174
       +
       -                            i.first, i.second.source);

     

       175
       +
       -

     

       176
       +
       -                    std::string path = i.first;

     

       177
       +
       -                    auto optSt = maybeLstat(path.c_str());

     

       178
       +
       -                    if (!optSt) {

     

       179
       +
       -                        if (i.second.optional)

     

       180
       +
       -                            continue;

     

       181
       +
       -                        throw SysError("getting attributes of required path '%s", path);

     

       182
       +
       -                    }

     

       183
       +
       -                    if (S_ISDIR(optSt->st_mode))

     

       184
       +
       -                        sandboxProfile += fmt("\t(subpath \"%s\")\n", path);

     

       185
       +
       -                    else

     

       186
       +
       -                        sandboxProfile += fmt("\t(literal \"%s\")\n", path);

     

       187
       +
       -                }

     

       188
       +
       -                sandboxProfile += ")\n";

     

       189
       +
       +            /* Violations will go to the syslog if you set this. Unfortunately the destination does not appear to be configurable */

     

       190
       +
       +            if (settings.darwinLogSandboxViolations) {

     

       191
       +
       +                sandboxProfile += "(deny default)\n";

     

       192
       +
       +            } else {

     

       193
       +
       +                sandboxProfile += "(deny default (with no-log))\n";

     

       194
       +
       +            }

     

       195
       +
        

     

       196
       +
       -                /* Allow file-read* on full directory hierarchy to self. Allows realpath() */

     

       197
       +
       -                sandboxProfile += "(allow file-read*\n";

     

       198
       +
       -                for (auto & i : ancestry) {

     

       199
       +
       -                    sandboxProfile += fmt("\t(literal \"%s\")\n", i);

     

       200
       +
       -                }

     

       201
       +
       -                sandboxProfile += ")\n";

     

       202
       +
       +            sandboxProfile +=

     

       203
       +
       +                #include "sandbox-defaults.sb"

     

       204
       +
       +                ;

     

       205
       +
        

     

       206
       +
       -                sandboxProfile += additionalSandboxProfile;

     

       207
       +
       -            } else

     

       208
       +
       +            if (!derivationType->isSandboxed())

     

       209
       +
                        sandboxProfile +=

     

       210
       +
       -                    #include "sandbox-minimal.sb"

     

       211
       +
       +                    #include "sandbox-network.sb"

     

       212
       +
                            ;

     

       213
       +
        

     

       214
       +
       -            debug("Generated sandbox profile:");

     

       215
       +
       -            debug(sandboxProfile);

     

       216
       +
       -

     

       217
       +
       -            Path sandboxFile = tmpDir + "/.sandbox.sb";

     

       218
       +
       +            /* Add the output paths we'll use at build-time to the chroot */

     

       219
       +
       +            sandboxProfile += "(allow file-read* file-write* process-exec\n";

     

       220
       +
       +            for (auto & [_, path] : scratchOutputs)

     

       221
       +
       +                sandboxProfile += fmt("\t(subpath \"%s\")\n", worker.store.printStorePath(path));

     

       222
       +
        

     

       223
       +
       -            writeFile(sandboxFile, sandboxProfile);

     

       224
       +
       +            sandboxProfile += ")\n";

     

       225
       +
        

     

       226
       +
       -            bool allowLocalNetworking = parsedDrv->getBoolAttr("__darwinAllowLocalNetworking");

     

       227
       +
       +            /* Our inputs (transitive dependencies and any impurities computed above)

     

       228
       +
        

     

       229
       +
       -            /* The tmpDir in scope points at the temporary build directory for our derivation. Some packages try different mechanisms

     

       230
       +
       -               to find temporary directories, so we want to open up a broader place for them to put their files, if needed. */

     

       231
       +
       -            Path globalTmpDir = canonPath(defaultTempDir(), true);

     

       232
       +
       +               without file-write* allowed, access() incorrectly returns EPERM

     

       233
       +
       +             */

     

       234
       +
       +            sandboxProfile += "(allow file-read* file-write* process-exec\n";

     

       235
       +
       +            for (auto & i : pathsInChroot) {

     

       236
       +
       +                if (i.first != i.second.source)

     

       237
       +
       +                    throw Error(

     

       238
       +
       +                        "can't map '%1%' to '%2%': mismatched impure paths not supported on Darwin",

     

       239
       +
       +                        i.first, i.second.source);

     

       240
       +
       +

     

       241
       +
       +                std::string path = i.first;

     

       242
       +
       +                auto optSt = maybeLstat(path.c_str());

     

       243
       +
       +                if (!optSt) {

     

       244
       +
       +                    if (i.second.optional)

     

       245
       +
       +                        continue;

     

       246
       +
       +                    throw SysError("getting attributes of required path '%s", path);

     

       247
       +
       +                }

     

       248
       +
       +                if (S_ISDIR(optSt->st_mode))

     

       249
       +
       +                    sandboxProfile += fmt("\t(subpath \"%s\")\n", path);

     

       250
       +
       +                else

     

       251
       +
       +                    sandboxProfile += fmt("\t(literal \"%s\")\n", path);

     

       252
       +
       +            }

     

       253
       +
       +            sandboxProfile += ")\n";

     

       254
       +
        

     

       255
       +
       -            /* They don't like trailing slashes on subpath directives */

     

       256
       +
       -            while (!globalTmpDir.empty() && globalTmpDir.back() == '/')

     

       257
       +
       -                globalTmpDir.pop_back();

     

       258
       +
       +            /* Allow file-read* on full directory hierarchy to self. Allows realpath() */

     

       259
       +
       +            sandboxProfile += "(allow file-read*\n";

     

       260
       +
       +            for (auto & i : ancestry) {

     

       261
       +
       +                sandboxProfile += fmt("\t(literal \"%s\")\n", i);

     

       262
       +
       +            }

     

       263
       +
       +            sandboxProfile += ")\n";

     

       264
       +
        

     

       265
       +
       -            if (getEnv("_NIX_TEST_NO_SANDBOX") != "1") {

     

       266
       +
       -                builder = "/usr/bin/sandbox-exec";

     

       267
       +
       -                args.push_back("sandbox-exec");

     

       268
       +
       -                args.push_back("-f");

     

       269
       +
       -                args.push_back(sandboxFile);

     

       270
       +
       -                args.push_back("-D");

     

       271
       +
       -                args.push_back("_GLOBAL_TMP_DIR=" + globalTmpDir);

     

       272
       +
       -                if (allowLocalNetworking) {

     

       273
       +
       -                    args.push_back("-D");

     

       274
       +
       -                    args.push_back(std::string("_ALLOW_LOCAL_NETWORKING=1"));

     

       275
       +
       -                }

     

       276
       +
       -                args.push_back(drv->builder);

     

       277
       +
       -            } else {

     

       278
       +
       -                builder = drv->builder;

     

       279
       +
       -                args.push_back(std::string(baseNameOf(drv->builder)));

     

       280
       +
       +            sandboxProfile += additionalSandboxProfile;

     

       281
       +
       +        } else

     

       282
       +
       +            sandboxProfile +=

     

       283
       +
       +                #include "sandbox-minimal.sb"

     

       284
       +
       +                ;

     

       285
       +
       +

     

       286
       +
       +        debug("Generated sandbox profile:");

     

       287
       +
       +        debug(sandboxProfile);

     

       288
       +
       +

     

       289
       +
       +        bool allowLocalNetworking = parsedDrv->getBoolAttr("__darwinAllowLocalNetworking");

     

       290
       +
       +

     

       291
       +
       +        /* The tmpDir in scope points at the temporary build directory for our derivation. Some packages try different mechanisms

     

       292
       +
       +            to find temporary directories, so we want to open up a broader place for them to put their files, if needed. */

     

       293
       +
       +        Path globalTmpDir = canonPath(defaultTempDir(), true);

     

       294
       +
       +

     

       295
       +
       +        /* They don't like trailing slashes on subpath directives */

     

       296
       +
       +        while (!globalTmpDir.empty() && globalTmpDir.back() == '/')

     

       297
       +
       +            globalTmpDir.pop_back();

     

       298
       +
       +

     

       299
       +
       +        if (getEnv("_NIX_TEST_NO_SANDBOX") != "1") {

     

       300
       +
       +            Strings sandboxArgs;

     

       301
       +
       +            sandboxArgs.push_back("_GLOBAL_TMP_DIR");

     

       302
       +
       +            sandboxArgs.push_back(globalTmpDir);

     

       303
       +
       +            if (allowLocalNetworking) {

     

       304
       +
       +                sandboxArgs.push_back("_ALLOW_LOCAL_NETWORKING");

     

       305
       +
       +                sandboxArgs.push_back("1");

     

       306
       +
       +            }

     

       307
       +
       +            if (sandbox_init_with_parameters(sandboxProfile.c_str(), 0, stringsToCharPtrs(sandboxArgs).data(), NULL)) {

     

       308
       +
       +                writeFull(STDERR_FILENO, "failed to configure sandbox\n");

     

       309
       +
       +                _exit(1);

     

       310
       +
                    }

     

       311
       +
                }

     

       312
       +
       +

     

       313
       +
       +        builder = drv->builder;

     

       314
       +
       +        args.push_back(std::string(baseNameOf(drv->builder)));

     

       315
       +
        #else

     

       316
       +
       -        else {

     

       317
       +
       +        if (!drv->isBuiltin()) {

     

       318
       +
                    builder = drv->builder;

     

       319
       +
                    args.push_back(std::string(baseNameOf(drv->builder)));

     

       320
       +
                }

     

       321
       +
       -- 

     

       322
       +
       2.46.1

     

       323
       +

+34

pkgs/tools/package-management/nix/patches/2_23/0002-local-derivation-goal-Print-sandbox-error-detail-on-.patch

···

       1
       +
       From c43954ffac356b4168cbcfe2a67b4bad3f0dff5d Mon Sep 17 00:00:00 2001

     

       2
       +
       From: Robert Hensing <robert@roberthensing.nl>

     

       3
       +
       Date: Thu, 3 Oct 2024 12:44:12 +0200

     

       4
       +
       Subject: [PATCH 2/4] local-derivation-goal: Print sandbox error detail on

     

       5
       +
        darwin

     

       6
       +
       MIME-Version: 1.0

     

       7
       +
       Content-Type: text/plain; charset=UTF-8

     

       8
       +
       Content-Transfer-Encoding: 8bit

     

       9
       +
       

     

       10
       +
       Co-Authored-By: Théophane Hufschmitt <theophane.hufschmitt@tweag.io>

     

       11
       +
       Signed-off-by: Jörg Thalheim <joerg@thalheim.io>

     

       12
       +
       ---

     

       13
       +
        src/libstore/unix/build/local-derivation-goal.cc | 5 +++--

     

       14
       +
        1 file changed, 3 insertions(+), 2 deletions(-)

     

       15
       +
       

     

       16
       +
       diff --git a/src/libstore/unix/build/local-derivation-goal.cc b/src/libstore/unix/build/local-derivation-goal.cc

     

       17
       +
       index 878644fa5..0df1f0683 100644

     

       18
       +
       --- a/src/libstore/unix/build/local-derivation-goal.cc

     

       19
       +
       +++ b/src/libstore/unix/build/local-derivation-goal.cc

     

       20
       +
       @@ -2137,8 +2137,9 @@ void LocalDerivationGoal::runChild()

     

       21
       +
                        sandboxArgs.push_back("_ALLOW_LOCAL_NETWORKING");

     

       22
       +
                        sandboxArgs.push_back("1");

     

       23
       +
                    }

     

       24
       +
       -            if (sandbox_init_with_parameters(sandboxProfile.c_str(), 0, stringsToCharPtrs(sandboxArgs).data(), NULL)) {

     

       25
       +
       -                writeFull(STDERR_FILENO, "failed to configure sandbox\n");

     

       26
       +
       +            char * sandbox_errbuf = nullptr;

     

       27
       +
       +            if (sandbox_init_with_parameters(sandboxProfile.c_str(), 0, stringsToCharPtrs(sandboxArgs).data(), &sandbox_errbuf)) {

     

       28
       +
       +                writeFull(STDERR_FILENO, fmt("failed to configure sandbox: %s\n", sandbox_errbuf ? sandbox_errbuf : "(null)"));

     

       29
       +
                        _exit(1);

     

       30
       +
                    }

     

       31
       +
                }

     

       32
       +
       -- 

     

       33
       +
       2.46.1

     

       34
       +

+41

pkgs/tools/package-management/nix/patches/2_23/0003-local-derivation-goal-Refactor.patch

···

       1
       +
       From 53b4bdcb8b0f114bea978cffbea325fd73f779b5 Mon Sep 17 00:00:00 2001

     

       2
       +
       From: Robert Hensing <robert@roberthensing.nl>

     

       3
       +
       Date: Thu, 3 Oct 2024 12:50:27 +0200

     

       4
       +
       Subject: [PATCH 3/4] local-derivation-goal: Refactor

     

       5
       +
       MIME-Version: 1.0

     

       6
       +
       Content-Type: text/plain; charset=UTF-8

     

       7
       +
       Content-Transfer-Encoding: 8bit

     

       8
       +
       

     

       9
       +
       This works because the `builder` and `args` variables are only used

     

       10
       +
       in the non-builtin code path.

     

       11
       +
       

     

       12
       +
       Co-Authored-By: Théophane Hufschmitt <theophane.hufschmitt@tweag.io>

     

       13
       +
       Signed-off-by: Jörg Thalheim <joerg@thalheim.io>

     

       14
       +
       ---

     

       15
       +
        src/libstore/unix/build/local-derivation-goal.cc | 5 +----

     

       16
       +
        1 file changed, 1 insertion(+), 4 deletions(-)

     

       17
       +
       

     

       18
       +
       diff --git a/src/libstore/unix/build/local-derivation-goal.cc b/src/libstore/unix/build/local-derivation-goal.cc

     

       19
       +
       index 0df1f0683..9e67283c9 100644

     

       20
       +
       --- a/src/libstore/unix/build/local-derivation-goal.cc

     

       21
       +
       +++ b/src/libstore/unix/build/local-derivation-goal.cc

     

       22
       +
       @@ -2143,15 +2143,12 @@ void LocalDerivationGoal::runChild()

     

       23
       +
                        _exit(1);

     

       24
       +
                    }

     

       25
       +
                }

     

       26
       +
       +#endif

     

       27
       +
        

     

       28
       +
       -        builder = drv->builder;

     

       29
       +
       -        args.push_back(std::string(baseNameOf(drv->builder)));

     

       30
       +
       -#else

     

       31
       +
                if (!drv->isBuiltin()) {

     

       32
       +
                    builder = drv->builder;

     

       33
       +
                    args.push_back(std::string(baseNameOf(drv->builder)));

     

       34
       +
                }

     

       35
       +
       -#endif

     

       36
       +
        

     

       37
       +
                for (auto & i : drv->args)

     

       38
       +
                    args.push_back(rewriteStrings(i, inputRewrites));

     

       39
       +
       -- 

     

       40
       +
       2.46.1

     

       41
       +

+75

pkgs/tools/package-management/nix/patches/2_23/0004-local-derivation-goal-Move-builder-preparation-to-no.patch

···

       1
       +
       From 67b5c7004302cbd344f63ccd306673a9adec4520 Mon Sep 17 00:00:00 2001

     

       2
       +
       From: Robert Hensing <robert@roberthensing.nl>

     

       3
       +
       Date: Thu, 3 Oct 2024 12:57:00 +0200

     

       4
       +
       Subject: [PATCH 4/4] local-derivation-goal: Move builder preparation to

     

       5
       +
        non-builtin code path

     

       6
       +
       MIME-Version: 1.0

     

       7
       +
       Content-Type: text/plain; charset=UTF-8

     

       8
       +
       Content-Transfer-Encoding: 8bit

     

       9
       +
       

     

       10
       +
       Signed-off-by: Jörg Thalheim <joerg@thalheim.io>

     

       11
       +
       ---

     

       12
       +
        .../unix/build/local-derivation-goal.cc       | 25 ++++++++-----------

     

       13
       +
        1 file changed, 10 insertions(+), 15 deletions(-)

     

       14
       +
       

     

       15
       +
       diff --git a/src/libstore/unix/build/local-derivation-goal.cc b/src/libstore/unix/build/local-derivation-goal.cc

     

       16
       +
       index 9e67283c9..1f4bafb56 100644

     

       17
       +
       --- a/src/libstore/unix/build/local-derivation-goal.cc

     

       18
       +
       +++ b/src/libstore/unix/build/local-derivation-goal.cc

     

       19
       +
       @@ -2016,11 +2016,6 @@ void LocalDerivationGoal::runChild()

     

       20
       +
                        throw SysError("setuid failed");

     

       21
       +
                }

     

       22
       +
        

     

       23
       +
       -        /* Fill in the arguments. */

     

       24
       +
       -        Strings args;

     

       25
       +
       -

     

       26
       +
       -        std::string builder = "invalid";

     

       27
       +
       -

     

       28
       +
        #if __APPLE__

     

       29
       +
                /* This has to appear before import statements. */

     

       30
       +
                std::string sandboxProfile = "(version 1)\n";

     

       31
       +
       @@ -2145,14 +2140,6 @@ void LocalDerivationGoal::runChild()

     

       32
       +
                }

     

       33
       +
        #endif

     

       34
       +
        

     

       35
       +
       -        if (!drv->isBuiltin()) {

     

       36
       +
       -            builder = drv->builder;

     

       37
       +
       -            args.push_back(std::string(baseNameOf(drv->builder)));

     

       38
       +
       -        }

     

       39
       +
       -

     

       40
       +
       -        for (auto & i : drv->args)

     

       41
       +
       -            args.push_back(rewriteStrings(i, inputRewrites));

     

       42
       +
       -

     

       43
       +
                /* Indicate that we managed to set up the build environment. */

     

       44
       +
                writeFull(STDERR_FILENO, std::string("\2\n"));

     

       45
       +
        

     

       46
       +
       @@ -2183,6 +2170,14 @@ void LocalDerivationGoal::runChild()

     

       47
       +
                    }

     

       48
       +
                }

     

       49
       +
        

     

       50
       +
       +        // Now builder is not builtin

     

       51
       +
       +

     

       52
       +
       +        Strings args;

     

       53
       +
       +        args.push_back(std::string(baseNameOf(drv->builder)));

     

       54
       +
       +

     

       55
       +
       +        for (auto & i : drv->args)

     

       56
       +
       +            args.push_back(rewriteStrings(i, inputRewrites));

     

       57
       +
       +

     

       58
       +
        #if __APPLE__

     

       59
       +
                posix_spawnattr_t attrp;

     

       60
       +
        

     

       61
       +
       @@ -2204,9 +2199,9 @@ void LocalDerivationGoal::runChild()

     

       62
       +
                    posix_spawnattr_setbinpref_np(&attrp, 1, &cpu, NULL);

     

       63
       +
                }

     

       64
       +
        

     

       65
       +
       -        posix_spawn(NULL, builder.c_str(), NULL, &attrp, stringsToCharPtrs(args).data(), stringsToCharPtrs(envStrs).data());

     

       66
       +
       +        posix_spawn(NULL, drv->builder.c_str(), NULL, &attrp, stringsToCharPtrs(args).data(), stringsToCharPtrs(envStrs).data());

     

       67
       +
        #else

     

       68
       +
       -        execve(builder.c_str(), stringsToCharPtrs(args).data(), stringsToCharPtrs(envStrs).data());

     

       69
       +
       +        execve(drv->builder.c_str(), stringsToCharPtrs(args).data(), stringsToCharPtrs(envStrs).data());

     

       70
       +
        #endif

     

       71
       +
        

     

       72
       +
                throw SysError("executing '%1%'", drv->builder);

     

       73
       +
       -- 

     

       74
       +
       2.46.1

     

       75
       +

+323

pkgs/tools/package-management/nix/patches/2_24/0001-fix-Run-all-derivation-builders-inside-the-sandbox-o.patch

···

       1
       +
       From 170242cf0ca3e9fadbad2004126793634d56623e Mon Sep 17 00:00:00 2001

     

       2
       +
       From: Puck Meerburg <puck@puckipedia.com>

     

       3
       +
       Date: Fri, 1 Mar 2024 11:42:24 -0500

     

       4
       +
       Subject: [PATCH 1/5] fix: Run all derivation builders inside the sandbox on

     

       5
       +
        macOS

     

       6
       +
       MIME-Version: 1.0

     

       7
       +
       Content-Type: text/plain; charset=UTF-8

     

       8
       +
       Content-Transfer-Encoding: 8bit

     

       9
       +
       

     

       10
       +
       Signed-off-by: Jörg Thalheim <joerg@thalheim.io>

     

       11
       +
       ---

     

       12
       +
        configure.ac                                  |   6 +-

     

       13
       +
        package.nix                                   |   2 +

     

       14
       +
        .../unix/build/local-derivation-goal.cc       | 223 +++++++++---------

     

       15
       +
        3 files changed, 116 insertions(+), 115 deletions(-)

     

       16
       +
       

     

       17
       +
       diff --git a/configure.ac b/configure.ac

     

       18
       +
       index 5c22ed176..dff35981b 100644

     

       19
       +
       --- a/configure.ac

     

       20
       +
       +++ b/configure.ac

     

       21
       +
       @@ -62,12 +62,16 @@ AC_CHECK_TOOL([AR], [ar])

     

       22
       +
        AC_SYS_LARGEFILE

     

       23
       +
        

     

       24
       +
        

     

       25
       +
       -# Solaris-specific stuff.

     

       26
       +
       +# OS-specific stuff.

     

       27
       +
        case "$host_os" in

     

       28
       +
          solaris*)

     

       29
       +
            # Solaris requires -lsocket -lnsl for network functions

     

       30
       +
            LDFLAGS="-lsocket -lnsl $LDFLAGS"

     

       31
       +
            ;;

     

       32
       +
       +  darwin*)

     

       33
       +
       +    # Need to link to libsandbox.

     

       34
       +
       +    LDFLAGS="-lsandbox $LDFLAGS"

     

       35
       +
       +    ;;

     

       36
       +
        esac

     

       37
       +
        

     

       38
       +
        

     

       39
       +
       diff --git a/package.nix b/package.nix

     

       40
       +
       index a7c8923e8..fcd1e1898 100644

     

       41
       +
       --- a/package.nix

     

       42
       +
       +++ b/package.nix

     

       43
       +
       @@ -23,6 +23,7 @@

     

       44
       +
        , libseccomp

     

       45
       +
        , libsodium

     

       46
       +
        , man

     

       47
       +
       +, darwin

     

       48
       +
        , lowdown

     

       49
       +
        , mdbook

     

       50
       +
        , mdbook-linkcheck

     

       51
       +
       @@ -235,6 +236,7 @@ in {

     

       52
       +
            gtest

     

       53
       +
            rapidcheck

     

       54
       +
          ] ++ lib.optional stdenv.isLinux libseccomp

     

       55
       +
       +    ++ lib.optional stdenv.hostPlatform.isDarwin darwin.apple_sdk.libs.sandbox

     

       56
       +
            ++ lib.optional stdenv.hostPlatform.isx86_64 libcpuid

     

       57
       +
            # There have been issues building these dependencies

     

       58
       +
            ++ lib.optional (stdenv.hostPlatform == stdenv.buildPlatform && (stdenv.isLinux || stdenv.isDarwin))

     

       59
       +
       diff --git a/src/libstore/unix/build/local-derivation-goal.cc b/src/libstore/unix/build/local-derivation-goal.cc

     

       60
       +
       index 54ca69580..7ce266122 100644

     

       61
       +
       --- a/src/libstore/unix/build/local-derivation-goal.cc

     

       62
       +
       +++ b/src/libstore/unix/build/local-derivation-goal.cc

     

       63
       +
       @@ -58,6 +58,10 @@

     

       64
       +
        #if __APPLE__

     

       65
       +
        #include <spawn.h>

     

       66
       +
        #include <sys/sysctl.h>

     

       67
       +
       +#include <sandbox.h>

     

       68
       +
       +

     

       69
       +
       +/* This definition is undocumented but depended upon by all major browsers. */

     

       70
       +
       +extern "C" int sandbox_init_with_parameters(const char *profile, uint64_t flags, const char *const parameters[], char **errorbuf);

     

       71
       +
        #endif

     

       72
       +
        

     

       73
       +
        #include <pwd.h>

     

       74
       +
       @@ -2039,141 +2043,132 @@ void LocalDerivationGoal::runChild()

     

       75
       +
        

     

       76
       +
                std::string builder = "invalid";

     

       77
       +
        

     

       78
       +
       -        if (drv->isBuiltin()) {

     

       79
       +
       -            ;

     

       80
       +
       -        }

     

       81
       +
        #if __APPLE__

     

       82
       +
       -        else {

     

       83
       +
       -            /* This has to appear before import statements. */

     

       84
       +
       -            std::string sandboxProfile = "(version 1)\n";

     

       85
       +
       -

     

       86
       +
       -            if (useChroot) {

     

       87
       +
       -

     

       88
       +
       -                /* Lots and lots and lots of file functions freak out if they can't stat their full ancestry */

     

       89
       +
       -                PathSet ancestry;

     

       90
       +
       -

     

       91
       +
       -                /* We build the ancestry before adding all inputPaths to the store because we know they'll

     

       92
       +
       -                   all have the same parents (the store), and there might be lots of inputs. This isn't

     

       93
       +
       -                   particularly efficient... I doubt it'll be a bottleneck in practice */

     

       94
       +
       -                for (auto & i : pathsInChroot) {

     

       95
       +
       -                    Path cur = i.first;

     

       96
       +
       -                    while (cur.compare("/") != 0) {

     

       97
       +
       -                        cur = dirOf(cur);

     

       98
       +
       -                        ancestry.insert(cur);

     

       99
       +
       -                    }

     

       100
       +
       -                }

     

       101
       +
       +        /* This has to appear before import statements. */

     

       102
       +
       +        std::string sandboxProfile = "(version 1)\n";

     

       103
       +
       +

     

       104
       +
       +        if (useChroot) {

     

       105
       +
        

     

       106
       +
       -                /* And we want the store in there regardless of how empty pathsInChroot. We include the innermost

     

       107
       +
       -                   path component this time, since it's typically /nix/store and we care about that. */

     

       108
       +
       -                Path cur = worker.store.storeDir;

     

       109
       +
       +            /* Lots and lots and lots of file functions freak out if they can't stat their full ancestry */

     

       110
       +
       +            PathSet ancestry;

     

       111
       +
       +

     

       112
       +
       +            /* We build the ancestry before adding all inputPaths to the store because we know they'll

     

       113
       +
       +               all have the same parents (the store), and there might be lots of inputs. This isn't

     

       114
       +
       +               particularly efficient... I doubt it'll be a bottleneck in practice */

     

       115
       +
       +            for (auto & i : pathsInChroot) {

     

       116
       +
       +                Path cur = i.first;

     

       117
       +
                        while (cur.compare("/") != 0) {

     

       118
       +
       -                    ancestry.insert(cur);

     

       119
       +
                            cur = dirOf(cur);

     

       120
       +
       +                    ancestry.insert(cur);

     

       121
       +
                        }

     

       122
       +
       +            }

     

       123
       +
        

     

       124
       +
       -                /* Add all our input paths to the chroot */

     

       125
       +
       -                for (auto & i : inputPaths) {

     

       126
       +
       -                    auto p = worker.store.printStorePath(i);

     

       127
       +
       -                    pathsInChroot[p] = p;

     

       128
       +
       -                }

     

       129
       +
       -

     

       130
       +
       -                /* Violations will go to the syslog if you set this. Unfortunately the destination does not appear to be configurable */

     

       131
       +
       -                if (settings.darwinLogSandboxViolations) {

     

       132
       +
       -                    sandboxProfile += "(deny default)\n";

     

       133
       +
       -                } else {

     

       134
       +
       -                    sandboxProfile += "(deny default (with no-log))\n";

     

       135
       +
       -                }

     

       136
       +
       +            /* And we want the store in there regardless of how empty pathsInChroot. We include the innermost

     

       137
       +
       +               path component this time, since it's typically /nix/store and we care about that. */

     

       138
       +
       +            Path cur = worker.store.storeDir;

     

       139
       +
       +            while (cur.compare("/") != 0) {

     

       140
       +
       +                ancestry.insert(cur);

     

       141
       +
       +                cur = dirOf(cur);

     

       142
       +
       +            }

     

       143
       +
        

     

       144
       +
       -                sandboxProfile +=

     

       145
       +
       -                    #include "sandbox-defaults.sb"

     

       146
       +
       -                    ;

     

       147
       +
       +            /* Add all our input paths to the chroot */

     

       148
       +
       +            for (auto & i : inputPaths) {

     

       149
       +
       +                auto p = worker.store.printStorePath(i);

     

       150
       +
       +                pathsInChroot[p] = p;

     

       151
       +
       +            }

     

       152
       +
        

     

       153
       +
       -                if (!derivationType->isSandboxed())

     

       154
       +
       -                    sandboxProfile +=

     

       155
       +
       -                        #include "sandbox-network.sb"

     

       156
       +
       -                        ;

     

       157
       +
       -

     

       158
       +
       -                /* Add the output paths we'll use at build-time to the chroot */

     

       159
       +
       -                sandboxProfile += "(allow file-read* file-write* process-exec\n";

     

       160
       +
       -                for (auto & [_, path] : scratchOutputs)

     

       161
       +
       -                    sandboxProfile += fmt("\t(subpath \"%s\")\n", worker.store.printStorePath(path));

     

       162
       +
       -

     

       163
       +
       -                sandboxProfile += ")\n";

     

       164
       +
       -

     

       165
       +
       -                /* Our inputs (transitive dependencies and any impurities computed above)

     

       166
       +
       -

     

       167
       +
       -                   without file-write* allowed, access() incorrectly returns EPERM

     

       168
       +
       -                 */

     

       169
       +
       -                sandboxProfile += "(allow file-read* file-write* process-exec\n";

     

       170
       +
       -                for (auto & i : pathsInChroot) {

     

       171
       +
       -                    if (i.first != i.second.source)

     

       172
       +
       -                        throw Error(

     

       173
       +
       -                            "can't map '%1%' to '%2%': mismatched impure paths not supported on Darwin",

     

       174
       +
       -                            i.first, i.second.source);

     

       175
       +
       -

     

       176
       +
       -                    std::string path = i.first;

     

       177
       +
       -                    auto optSt = maybeLstat(path.c_str());

     

       178
       +
       -                    if (!optSt) {

     

       179
       +
       -                        if (i.second.optional)

     

       180
       +
       -                            continue;

     

       181
       +
       -                        throw SysError("getting attributes of required path '%s", path);

     

       182
       +
       -                    }

     

       183
       +
       -                    if (S_ISDIR(optSt->st_mode))

     

       184
       +
       -                        sandboxProfile += fmt("\t(subpath \"%s\")\n", path);

     

       185
       +
       -                    else

     

       186
       +
       -                        sandboxProfile += fmt("\t(literal \"%s\")\n", path);

     

       187
       +
       -                }

     

       188
       +
       -                sandboxProfile += ")\n";

     

       189
       +
       +            /* Violations will go to the syslog if you set this. Unfortunately the destination does not appear to be configurable */

     

       190
       +
       +            if (settings.darwinLogSandboxViolations) {

     

       191
       +
       +                sandboxProfile += "(deny default)\n";

     

       192
       +
       +            } else {

     

       193
       +
       +                sandboxProfile += "(deny default (with no-log))\n";

     

       194
       +
       +            }

     

       195
       +
        

     

       196
       +
       -                /* Allow file-read* on full directory hierarchy to self. Allows realpath() */

     

       197
       +
       -                sandboxProfile += "(allow file-read*\n";

     

       198
       +
       -                for (auto & i : ancestry) {

     

       199
       +
       -                    sandboxProfile += fmt("\t(literal \"%s\")\n", i);

     

       200
       +
       -                }

     

       201
       +
       -                sandboxProfile += ")\n";

     

       202
       +
       +            sandboxProfile +=

     

       203
       +
       +                #include "sandbox-defaults.sb"

     

       204
       +
       +                ;

     

       205
       +
        

     

       206
       +
       -                sandboxProfile += additionalSandboxProfile;

     

       207
       +
       -            } else

     

       208
       +
       +            if (!derivationType->isSandboxed())

     

       209
       +
                        sandboxProfile +=

     

       210
       +
       -                    #include "sandbox-minimal.sb"

     

       211
       +
       +                    #include "sandbox-network.sb"

     

       212
       +
                            ;

     

       213
       +
        

     

       214
       +
       -            debug("Generated sandbox profile:");

     

       215
       +
       -            debug(sandboxProfile);

     

       216
       +
       -

     

       217
       +
       -            Path sandboxFile = tmpDir + "/.sandbox.sb";

     

       218
       +
       +            /* Add the output paths we'll use at build-time to the chroot */

     

       219
       +
       +            sandboxProfile += "(allow file-read* file-write* process-exec\n";

     

       220
       +
       +            for (auto & [_, path] : scratchOutputs)

     

       221
       +
       +                sandboxProfile += fmt("\t(subpath \"%s\")\n", worker.store.printStorePath(path));

     

       222
       +
        

     

       223
       +
       -            writeFile(sandboxFile, sandboxProfile);

     

       224
       +
       +            sandboxProfile += ")\n";

     

       225
       +
        

     

       226
       +
       -            bool allowLocalNetworking = parsedDrv->getBoolAttr("__darwinAllowLocalNetworking");

     

       227
       +
       +            /* Our inputs (transitive dependencies and any impurities computed above)

     

       228
       +
        

     

       229
       +
       -            /* The tmpDir in scope points at the temporary build directory for our derivation. Some packages try different mechanisms

     

       230
       +
       -               to find temporary directories, so we want to open up a broader place for them to put their files, if needed. */

     

       231
       +
       -            Path globalTmpDir = canonPath(defaultTempDir(), true);

     

       232
       +
       +               without file-write* allowed, access() incorrectly returns EPERM

     

       233
       +
       +             */

     

       234
       +
       +            sandboxProfile += "(allow file-read* file-write* process-exec\n";

     

       235
       +
       +            for (auto & i : pathsInChroot) {

     

       236
       +
       +                if (i.first != i.second.source)

     

       237
       +
       +                    throw Error(

     

       238
       +
       +                        "can't map '%1%' to '%2%': mismatched impure paths not supported on Darwin",

     

       239
       +
       +                        i.first, i.second.source);

     

       240
       +
       +

     

       241
       +
       +                std::string path = i.first;

     

       242
       +
       +                auto optSt = maybeLstat(path.c_str());

     

       243
       +
       +                if (!optSt) {

     

       244
       +
       +                    if (i.second.optional)

     

       245
       +
       +                        continue;

     

       246
       +
       +                    throw SysError("getting attributes of required path '%s", path);

     

       247
       +
       +                }

     

       248
       +
       +                if (S_ISDIR(optSt->st_mode))

     

       249
       +
       +                    sandboxProfile += fmt("\t(subpath \"%s\")\n", path);

     

       250
       +
       +                else

     

       251
       +
       +                    sandboxProfile += fmt("\t(literal \"%s\")\n", path);

     

       252
       +
       +            }

     

       253
       +
       +            sandboxProfile += ")\n";

     

       254
       +
        

     

       255
       +
       -            /* They don't like trailing slashes on subpath directives */

     

       256
       +
       -            while (!globalTmpDir.empty() && globalTmpDir.back() == '/')

     

       257
       +
       -                globalTmpDir.pop_back();

     

       258
       +
       +            /* Allow file-read* on full directory hierarchy to self. Allows realpath() */

     

       259
       +
       +            sandboxProfile += "(allow file-read*\n";

     

       260
       +
       +            for (auto & i : ancestry) {

     

       261
       +
       +                sandboxProfile += fmt("\t(literal \"%s\")\n", i);

     

       262
       +
       +            }

     

       263
       +
       +            sandboxProfile += ")\n";

     

       264
       +
        

     

       265
       +
       -            if (getEnv("_NIX_TEST_NO_SANDBOX") != "1") {

     

       266
       +
       -                builder = "/usr/bin/sandbox-exec";

     

       267
       +
       -                args.push_back("sandbox-exec");

     

       268
       +
       -                args.push_back("-f");

     

       269
       +
       -                args.push_back(sandboxFile);

     

       270
       +
       -                args.push_back("-D");

     

       271
       +
       -                args.push_back("_GLOBAL_TMP_DIR=" + globalTmpDir);

     

       272
       +
       -                if (allowLocalNetworking) {

     

       273
       +
       -                    args.push_back("-D");

     

       274
       +
       -                    args.push_back(std::string("_ALLOW_LOCAL_NETWORKING=1"));

     

       275
       +
       -                }

     

       276
       +
       -                args.push_back(drv->builder);

     

       277
       +
       -            } else {

     

       278
       +
       -                builder = drv->builder;

     

       279
       +
       -                args.push_back(std::string(baseNameOf(drv->builder)));

     

       280
       +
       +            sandboxProfile += additionalSandboxProfile;

     

       281
       +
       +        } else

     

       282
       +
       +            sandboxProfile +=

     

       283
       +
       +                #include "sandbox-minimal.sb"

     

       284
       +
       +                ;

     

       285
       +
       +

     

       286
       +
       +        debug("Generated sandbox profile:");

     

       287
       +
       +        debug(sandboxProfile);

     

       288
       +
       +

     

       289
       +
       +        bool allowLocalNetworking = parsedDrv->getBoolAttr("__darwinAllowLocalNetworking");

     

       290
       +
       +

     

       291
       +
       +        /* The tmpDir in scope points at the temporary build directory for our derivation. Some packages try different mechanisms

     

       292
       +
       +            to find temporary directories, so we want to open up a broader place for them to put their files, if needed. */

     

       293
       +
       +        Path globalTmpDir = canonPath(defaultTempDir(), true);

     

       294
       +
       +

     

       295
       +
       +        /* They don't like trailing slashes on subpath directives */

     

       296
       +
       +        while (!globalTmpDir.empty() && globalTmpDir.back() == '/')

     

       297
       +
       +            globalTmpDir.pop_back();

     

       298
       +
       +

     

       299
       +
       +        if (getEnv("_NIX_TEST_NO_SANDBOX") != "1") {

     

       300
       +
       +            Strings sandboxArgs;

     

       301
       +
       +            sandboxArgs.push_back("_GLOBAL_TMP_DIR");

     

       302
       +
       +            sandboxArgs.push_back(globalTmpDir);

     

       303
       +
       +            if (allowLocalNetworking) {

     

       304
       +
       +                sandboxArgs.push_back("_ALLOW_LOCAL_NETWORKING");

     

       305
       +
       +                sandboxArgs.push_back("1");

     

       306
       +
       +            }

     

       307
       +
       +            if (sandbox_init_with_parameters(sandboxProfile.c_str(), 0, stringsToCharPtrs(sandboxArgs).data(), NULL)) {

     

       308
       +
       +                writeFull(STDERR_FILENO, "failed to configure sandbox\n");

     

       309
       +
       +                _exit(1);

     

       310
       +
                    }

     

       311
       +
                }

     

       312
       +
       +

     

       313
       +
       +        builder = drv->builder;

     

       314
       +
       +        args.push_back(std::string(baseNameOf(drv->builder)));

     

       315
       +
        #else

     

       316
       +
       -        else {

     

       317
       +
       +        if (!drv->isBuiltin()) {

     

       318
       +
                    builder = drv->builder;

     

       319
       +
                    args.push_back(std::string(baseNameOf(drv->builder)));

     

       320
       +
                }

     

       321
       +
       -- 

     

       322
       +
       2.46.1

     

       323
       +

+53

pkgs/tools/package-management/nix/patches/2_24/0002-packaging-Add-darwin-lsandbox-in-meson.patch

···

       1
       +
       From f8a1a149c73113e01c44b73ce9e1005575d52a9a Mon Sep 17 00:00:00 2001

     

       2
       +
       From: Robert Hensing <robert@roberthensing.nl>

     

       3
       +
       Date: Thu, 3 Oct 2024 12:23:17 +0200

     

       4
       +
       Subject: [PATCH 2/5] packaging: Add darwin -lsandbox in meson

     

       5
       +
       MIME-Version: 1.0

     

       6
       +
       Content-Type: text/plain; charset=UTF-8

     

       7
       +
       Content-Transfer-Encoding: 8bit

     

       8
       +
       

     

       9
       +
       Signed-off-by: Jörg Thalheim <joerg@thalheim.io>

     

       10
       +
       ---

     

       11
       +
        src/libstore/meson.build | 5 +++++

     

       12
       +
        src/libstore/package.nix | 2 ++

     

       13
       +
        2 files changed, 7 insertions(+)

     

       14
       +
       

     

       15
       +
       diff --git a/src/libstore/meson.build b/src/libstore/meson.build

     

       16
       +
       index 50b15e15d..b23c85061 100644

     

       17
       +
       --- a/src/libstore/meson.build

     

       18
       +
       +++ b/src/libstore/meson.build

     

       19
       +
       @@ -68,6 +68,11 @@ has_acl_support = cxx.has_header('sys/xattr.h') \

     

       20
       +
          and cxx.has_function('lremovexattr')

     

       21
       +
        configdata.set('HAVE_ACL_SUPPORT', has_acl_support.to_int())

     

       22
       +
        

     

       23
       +
       +if host_machine.system() == 'darwin'

     

       24
       +
       +  sandbox = cxx.find_library('sandbox')

     

       25
       +
       +  deps_other += [sandbox]

     

       26
       +
       +endif

     

       27
       +
       +

     

       28
       +
        subdir('build-utils-meson/threads')

     

       29
       +
        

     

       30
       +
        boost = dependency(

     

       31
       +
       diff --git a/src/libstore/package.nix b/src/libstore/package.nix

     

       32
       +
       index 4582ba0d2..d98bac16d 100644

     

       33
       +
       --- a/src/libstore/package.nix

     

       34
       +
       +++ b/src/libstore/package.nix

     

       35
       +
       @@ -7,6 +7,7 @@

     

       36
       +
        , ninja

     

       37
       +
        , pkg-config

     

       38
       +
        , unixtools

     

       39
       +
       +, darwin

     

       40
       +
        

     

       41
       +
        , nix-util

     

       42
       +
        , boost

     

       43
       +
       @@ -65,6 +66,7 @@ mkMesonDerivation (finalAttrs: {

     

       44
       +
            sqlite

     

       45
       +
          ] ++ lib.optional stdenv.hostPlatform.isLinux libseccomp

     

       46
       +
            # There have been issues building these dependencies

     

       47
       +
       +    ++ lib.optional stdenv.hostPlatform.isDarwin darwin.apple_sdk.libs.sandbox

     

       48
       +
            ++ lib.optional (stdenv.hostPlatform == stdenv.buildPlatform && (stdenv.isLinux || stdenv.isDarwin))

     

       49
       +
              aws-sdk-cpp

     

       50
       +
          ;

     

       51
       +
       -- 

     

       52
       +
       2.46.1

     

       53
       +

+34

pkgs/tools/package-management/nix/patches/2_24/0003-local-derivation-goal-Print-sandbox-error-detail-on-.patch

···

       1
       +
       From ae7a2ea74136363c2f6ac6e624ea95da7abfafcc Mon Sep 17 00:00:00 2001

     

       2
       +
       From: Robert Hensing <robert@roberthensing.nl>

     

       3
       +
       Date: Thu, 3 Oct 2024 12:44:12 +0200

     

       4
       +
       Subject: [PATCH 3/5] local-derivation-goal: Print sandbox error detail on

     

       5
       +
        darwin

     

       6
       +
       MIME-Version: 1.0

     

       7
       +
       Content-Type: text/plain; charset=UTF-8

     

       8
       +
       Content-Transfer-Encoding: 8bit

     

       9
       +
       

     

       10
       +
       Co-Authored-By: Théophane Hufschmitt <theophane.hufschmitt@tweag.io>

     

       11
       +
       Signed-off-by: Jörg Thalheim <joerg@thalheim.io>

     

       12
       +
       ---

     

       13
       +
        src/libstore/unix/build/local-derivation-goal.cc | 5 +++--

     

       14
       +
        1 file changed, 3 insertions(+), 2 deletions(-)

     

       15
       +
       

     

       16
       +
       diff --git a/src/libstore/unix/build/local-derivation-goal.cc b/src/libstore/unix/build/local-derivation-goal.cc

     

       17
       +
       index 7ce266122..706771e8e 100644

     

       18
       +
       --- a/src/libstore/unix/build/local-derivation-goal.cc

     

       19
       +
       +++ b/src/libstore/unix/build/local-derivation-goal.cc

     

       20
       +
       @@ -2159,8 +2159,9 @@ void LocalDerivationGoal::runChild()

     

       21
       +
                        sandboxArgs.push_back("_ALLOW_LOCAL_NETWORKING");

     

       22
       +
                        sandboxArgs.push_back("1");

     

       23
       +
                    }

     

       24
       +
       -            if (sandbox_init_with_parameters(sandboxProfile.c_str(), 0, stringsToCharPtrs(sandboxArgs).data(), NULL)) {

     

       25
       +
       -                writeFull(STDERR_FILENO, "failed to configure sandbox\n");

     

       26
       +
       +            char * sandbox_errbuf = nullptr;

     

       27
       +
       +            if (sandbox_init_with_parameters(sandboxProfile.c_str(), 0, stringsToCharPtrs(sandboxArgs).data(), &sandbox_errbuf)) {

     

       28
       +
       +                writeFull(STDERR_FILENO, fmt("failed to configure sandbox: %s\n", sandbox_errbuf ? sandbox_errbuf : "(null)"));

     

       29
       +
                        _exit(1);

     

       30
       +
                    }

     

       31
       +
                }

     

       32
       +
       -- 

     

       33
       +
       2.46.1

     

       34
       +

+41

pkgs/tools/package-management/nix/patches/2_24/0004-local-derivation-goal-Refactor.patch

···

       1
       +
       From 047ee50db2f660eb3f50fab8f7543ce95e814b7c Mon Sep 17 00:00:00 2001

     

       2
       +
       From: Robert Hensing <robert@roberthensing.nl>

     

       3
       +
       Date: Thu, 3 Oct 2024 12:50:27 +0200

     

       4
       +
       Subject: [PATCH 4/5] local-derivation-goal: Refactor

     

       5
       +
       MIME-Version: 1.0

     

       6
       +
       Content-Type: text/plain; charset=UTF-8

     

       7
       +
       Content-Transfer-Encoding: 8bit

     

       8
       +
       

     

       9
       +
       This works because the `builder` and `args` variables are only used

     

       10
       +
       in the non-builtin code path.

     

       11
       +
       

     

       12
       +
       Co-Authored-By: Théophane Hufschmitt <theophane.hufschmitt@tweag.io>

     

       13
       +
       Signed-off-by: Jörg Thalheim <joerg@thalheim.io>

     

       14
       +
       ---

     

       15
       +
        src/libstore/unix/build/local-derivation-goal.cc | 5 +----

     

       16
       +
        1 file changed, 1 insertion(+), 4 deletions(-)

     

       17
       +
       

     

       18
       +
       diff --git a/src/libstore/unix/build/local-derivation-goal.cc b/src/libstore/unix/build/local-derivation-goal.cc

     

       19
       +
       index 706771e8e..d9738a1ea 100644

     

       20
       +
       --- a/src/libstore/unix/build/local-derivation-goal.cc

     

       21
       +
       +++ b/src/libstore/unix/build/local-derivation-goal.cc

     

       22
       +
       @@ -2165,15 +2165,12 @@ void LocalDerivationGoal::runChild()

     

       23
       +
                        _exit(1);

     

       24
       +
                    }

     

       25
       +
                }

     

       26
       +
       +#endif

     

       27
       +
        

     

       28
       +
       -        builder = drv->builder;

     

       29
       +
       -        args.push_back(std::string(baseNameOf(drv->builder)));

     

       30
       +
       -#else

     

       31
       +
                if (!drv->isBuiltin()) {

     

       32
       +
                    builder = drv->builder;

     

       33
       +
                    args.push_back(std::string(baseNameOf(drv->builder)));

     

       34
       +
                }

     

       35
       +
       -#endif

     

       36
       +
        

     

       37
       +
                for (auto & i : drv->args)

     

       38
       +
                    args.push_back(rewriteStrings(i, inputRewrites));

     

       39
       +
       -- 

     

       40
       +
       2.46.1

     

       41
       +

+75

pkgs/tools/package-management/nix/patches/2_24/0005-local-derivation-goal-Move-builder-preparation-to-no.patch

···

       1
       +
       From 50f83e4bbd9107576399f94449ac9cb4e80d575e Mon Sep 17 00:00:00 2001

     

       2
       +
       From: Robert Hensing <robert@roberthensing.nl>

     

       3
       +
       Date: Thu, 3 Oct 2024 12:57:00 +0200

     

       4
       +
       Subject: [PATCH 5/5] local-derivation-goal: Move builder preparation to

     

       5
       +
        non-builtin code path

     

       6
       +
       MIME-Version: 1.0

     

       7
       +
       Content-Type: text/plain; charset=UTF-8

     

       8
       +
       Content-Transfer-Encoding: 8bit

     

       9
       +
       

     

       10
       +
       Signed-off-by: Jörg Thalheim <joerg@thalheim.io>

     

       11
       +
       ---

     

       12
       +
        .../unix/build/local-derivation-goal.cc       | 25 ++++++++-----------

     

       13
       +
        1 file changed, 10 insertions(+), 15 deletions(-)

     

       14
       +
       

     

       15
       +
       diff --git a/src/libstore/unix/build/local-derivation-goal.cc b/src/libstore/unix/build/local-derivation-goal.cc

     

       16
       +
       index d9738a1ea..2a09e3dd4 100644

     

       17
       +
       --- a/src/libstore/unix/build/local-derivation-goal.cc

     

       18
       +
       +++ b/src/libstore/unix/build/local-derivation-goal.cc

     

       19
       +
       @@ -2038,11 +2038,6 @@ void LocalDerivationGoal::runChild()

     

       20
       +
                        throw SysError("setuid failed");

     

       21
       +
                }

     

       22
       +
        

     

       23
       +
       -        /* Fill in the arguments. */

     

       24
       +
       -        Strings args;

     

       25
       +
       -

     

       26
       +
       -        std::string builder = "invalid";

     

       27
       +
       -

     

       28
       +
        #if __APPLE__

     

       29
       +
                /* This has to appear before import statements. */

     

       30
       +
                std::string sandboxProfile = "(version 1)\n";

     

       31
       +
       @@ -2167,14 +2162,6 @@ void LocalDerivationGoal::runChild()

     

       32
       +
                }

     

       33
       +
        #endif

     

       34
       +
        

     

       35
       +
       -        if (!drv->isBuiltin()) {

     

       36
       +
       -            builder = drv->builder;

     

       37
       +
       -            args.push_back(std::string(baseNameOf(drv->builder)));

     

       38
       +
       -        }

     

       39
       +
       -

     

       40
       +
       -        for (auto & i : drv->args)

     

       41
       +
       -            args.push_back(rewriteStrings(i, inputRewrites));

     

       42
       +
       -

     

       43
       +
                /* Indicate that we managed to set up the build environment. */

     

       44
       +
                writeFull(STDERR_FILENO, std::string("\2\n"));

     

       45
       +
        

     

       46
       +
       @@ -2205,6 +2192,14 @@ void LocalDerivationGoal::runChild()

     

       47
       +
                    }

     

       48
       +
                }

     

       49
       +
        

     

       50
       +
       +        // Now builder is not builtin

     

       51
       +
       +

     

       52
       +
       +        Strings args;

     

       53
       +
       +        args.push_back(std::string(baseNameOf(drv->builder)));

     

       54
       +
       +

     

       55
       +
       +        for (auto & i : drv->args)

     

       56
       +
       +            args.push_back(rewriteStrings(i, inputRewrites));

     

       57
       +
       +

     

       58
       +
        #if __APPLE__

     

       59
       +
                posix_spawnattr_t attrp;

     

       60
       +
        

     

       61
       +
       @@ -2226,9 +2221,9 @@ void LocalDerivationGoal::runChild()

     

       62
       +
                    posix_spawnattr_setbinpref_np(&attrp, 1, &cpu, NULL);

     

       63
       +
                }

     

       64
       +
        

     

       65
       +
       -        posix_spawn(NULL, builder.c_str(), NULL, &attrp, stringsToCharPtrs(args).data(), stringsToCharPtrs(envStrs).data());

     

       66
       +
       +        posix_spawn(NULL, drv->builder.c_str(), NULL, &attrp, stringsToCharPtrs(args).data(), stringsToCharPtrs(envStrs).data());

     

       67
       +
        #else

     

       68
       +
       -        execve(builder.c_str(), stringsToCharPtrs(args).data(), stringsToCharPtrs(envStrs).data());

     

       69
       +
       +        execve(drv->builder.c_str(), stringsToCharPtrs(args).data(), stringsToCharPtrs(envStrs).data());

     

       70
       +
        #endif

     

       71
       +
        

     

       72
       +
                throw SysError("executing '%1%'", drv->builder);

     

       73
       +
       -- 

     

       74
       +
       2.46.1

     

       75
       +

+28

pkgs/tools/package-management/nix/patches/git/0001-Fix-meson-build-on-darwin.patch

···

       1
       +
       From 766263d53ae69d70c5915426e6e8f58abd988226 Mon Sep 17 00:00:00 2001

     

       2
       +
       From: Robert Hensing <robert@roberthensing.nl>

     

       3
       +
       Date: Tue, 22 Oct 2024 15:28:04 +0200

     

       4
       +
       Subject: [PATCH 1/6] Fix meson build on darwin

     

       5
       +
       MIME-Version: 1.0

     

       6
       +
       Content-Type: text/plain; charset=UTF-8

     

       7
       +
       Content-Transfer-Encoding: 8bit

     

       8
       +
       

     

       9
       +
       std::stringbuf is defined in <sstream>

     

       10
       +
       Signed-off-by: Jörg Thalheim <joerg@thalheim.io>

     

       11
       +
       ---

     

       12
       +
        src/libutil/strings.cc | 1 +

     

       13
       +
        1 file changed, 1 insertion(+)

     

       14
       +
       

     

       15
       +
       diff --git a/src/libutil/strings.cc b/src/libutil/strings.cc

     

       16
       +
       index d1c9f700c..c221a43c6 100644

     

       17
       +
       --- a/src/libutil/strings.cc

     

       18
       +
       +++ b/src/libutil/strings.cc

     

       19
       +
       @@ -1,5 +1,6 @@

     

       20
       +
        #include <filesystem>

     

       21
       +
        #include <string>

     

       22
       +
       +#include <sstream>

     

       23
       +
        

     

       24
       +
        #include "strings-inline.hh"

     

       25
       +
        #include "os-string.hh"

     

       26
       +
       -- 

     

       27
       +
       2.46.1

     

       28
       +

+323

pkgs/tools/package-management/nix/patches/git/0002-fix-Run-all-derivation-builders-inside-the-sandbox-o.patch

···

       1
       +
       From d2c880b03f58eb4fdd6d19eb3ffa4345a0477419 Mon Sep 17 00:00:00 2001

     

       2
       +
       From: Puck Meerburg <puck@puckipedia.com>

     

       3
       +
       Date: Fri, 1 Mar 2024 11:42:24 -0500

     

       4
       +
       Subject: [PATCH 2/6] fix: Run all derivation builders inside the sandbox on

     

       5
       +
        macOS

     

       6
       +
       MIME-Version: 1.0

     

       7
       +
       Content-Type: text/plain; charset=UTF-8

     

       8
       +
       Content-Transfer-Encoding: 8bit

     

       9
       +
       

     

       10
       +
       Signed-off-by: Jörg Thalheim <joerg@thalheim.io>

     

       11
       +
       ---

     

       12
       +
        configure.ac                                  |   6 +-

     

       13
       +
        package.nix                                   |   2 +

     

       14
       +
        .../unix/build/local-derivation-goal.cc       | 223 +++++++++---------

     

       15
       +
        3 files changed, 116 insertions(+), 115 deletions(-)

     

       16
       +
       

     

       17
       +
       diff --git a/configure.ac b/configure.ac

     

       18
       +
       index 198198dea..c7c9b3f4b 100644

     

       19
       +
       --- a/configure.ac

     

       20
       +
       +++ b/configure.ac

     

       21
       +
       @@ -62,12 +62,16 @@ AC_CHECK_TOOL([AR], [ar])

     

       22
       +
        AC_SYS_LARGEFILE

     

       23
       +
        

     

       24
       +
        

     

       25
       +
       -# Solaris-specific stuff.

     

       26
       +
       +# OS-specific stuff.

     

       27
       +
        case "$host_os" in

     

       28
       +
          solaris*)

     

       29
       +
            # Solaris requires -lsocket -lnsl for network functions

     

       30
       +
            LDFLAGS="-lsocket -lnsl $LDFLAGS"

     

       31
       +
            ;;

     

       32
       +
       +  darwin*)

     

       33
       +
       +    # Need to link to libsandbox.

     

       34
       +
       +    LDFLAGS="-lsandbox $LDFLAGS"

     

       35
       +
       +    ;;

     

       36
       +
        esac

     

       37
       +
        

     

       38
       +
        

     

       39
       +
       diff --git a/package.nix b/package.nix

     

       40
       +
       index 00621d475..77f1de58c 100644

     

       41
       +
       --- a/package.nix

     

       42
       +
       +++ b/package.nix

     

       43
       +
       @@ -23,6 +23,7 @@

     

       44
       +
        , libseccomp

     

       45
       +
        , libsodium

     

       46
       +
        , man

     

       47
       +
       +, darwin

     

       48
       +
        , lowdown

     

       49
       +
        , mdbook

     

       50
       +
        , mdbook-linkcheck

     

       51
       +
       @@ -232,6 +233,7 @@ in {

     

       52
       +
            gtest

     

       53
       +
            rapidcheck

     

       54
       +
          ] ++ lib.optional stdenv.isLinux libseccomp

     

       55
       +
       +    ++ lib.optional stdenv.hostPlatform.isDarwin darwin.apple_sdk.libs.sandbox

     

       56
       +
            ++ lib.optional stdenv.hostPlatform.isx86_64 libcpuid

     

       57
       +
            # There have been issues building these dependencies

     

       58
       +
            ++ lib.optional (stdenv.hostPlatform == stdenv.buildPlatform && (stdenv.isLinux || stdenv.isDarwin))

     

       59
       +
       diff --git a/src/libstore/unix/build/local-derivation-goal.cc b/src/libstore/unix/build/local-derivation-goal.cc

     

       60
       +
       index b4685b3a7..067755c0d 100644

     

       61
       +
       --- a/src/libstore/unix/build/local-derivation-goal.cc

     

       62
       +
       +++ b/src/libstore/unix/build/local-derivation-goal.cc

     

       63
       +
       @@ -58,6 +58,10 @@

     

       64
       +
        #if __APPLE__

     

       65
       +
        #include <spawn.h>

     

       66
       +
        #include <sys/sysctl.h>

     

       67
       +
       +#include <sandbox.h>

     

       68
       +
       +

     

       69
       +
       +/* This definition is undocumented but depended upon by all major browsers. */

     

       70
       +
       +extern "C" int sandbox_init_with_parameters(const char *profile, uint64_t flags, const char *const parameters[], char **errorbuf);

     

       71
       +
        #endif

     

       72
       +
        

     

       73
       +
        #include <pwd.h>

     

       74
       +
       @@ -2088,141 +2092,132 @@ void LocalDerivationGoal::runChild()

     

       75
       +
        

     

       76
       +
                std::string builder = "invalid";

     

       77
       +
        

     

       78
       +
       -        if (drv->isBuiltin()) {

     

       79
       +
       -            ;

     

       80
       +
       -        }

     

       81
       +
        #if __APPLE__

     

       82
       +
       -        else {

     

       83
       +
       -            /* This has to appear before import statements. */

     

       84
       +
       -            std::string sandboxProfile = "(version 1)\n";

     

       85
       +
       -

     

       86
       +
       -            if (useChroot) {

     

       87
       +
       -

     

       88
       +
       -                /* Lots and lots and lots of file functions freak out if they can't stat their full ancestry */

     

       89
       +
       -                PathSet ancestry;

     

       90
       +
       -

     

       91
       +
       -                /* We build the ancestry before adding all inputPaths to the store because we know they'll

     

       92
       +
       -                   all have the same parents (the store), and there might be lots of inputs. This isn't

     

       93
       +
       -                   particularly efficient... I doubt it'll be a bottleneck in practice */

     

       94
       +
       -                for (auto & i : pathsInChroot) {

     

       95
       +
       -                    Path cur = i.first;

     

       96
       +
       -                    while (cur.compare("/") != 0) {

     

       97
       +
       -                        cur = dirOf(cur);

     

       98
       +
       -                        ancestry.insert(cur);

     

       99
       +
       -                    }

     

       100
       +
       -                }

     

       101
       +
       +        /* This has to appear before import statements. */

     

       102
       +
       +        std::string sandboxProfile = "(version 1)\n";

     

       103
       +
       +

     

       104
       +
       +        if (useChroot) {

     

       105
       +
        

     

       106
       +
       -                /* And we want the store in there regardless of how empty pathsInChroot. We include the innermost

     

       107
       +
       -                   path component this time, since it's typically /nix/store and we care about that. */

     

       108
       +
       -                Path cur = worker.store.storeDir;

     

       109
       +
       +            /* Lots and lots and lots of file functions freak out if they can't stat their full ancestry */

     

       110
       +
       +            PathSet ancestry;

     

       111
       +
       +

     

       112
       +
       +            /* We build the ancestry before adding all inputPaths to the store because we know they'll

     

       113
       +
       +               all have the same parents (the store), and there might be lots of inputs. This isn't

     

       114
       +
       +               particularly efficient... I doubt it'll be a bottleneck in practice */

     

       115
       +
       +            for (auto & i : pathsInChroot) {

     

       116
       +
       +                Path cur = i.first;

     

       117
       +
                        while (cur.compare("/") != 0) {

     

       118
       +
       -                    ancestry.insert(cur);

     

       119
       +
                            cur = dirOf(cur);

     

       120
       +
       +                    ancestry.insert(cur);

     

       121
       +
                        }

     

       122
       +
       +            }

     

       123
       +
        

     

       124
       +
       -                /* Add all our input paths to the chroot */

     

       125
       +
       -                for (auto & i : inputPaths) {

     

       126
       +
       -                    auto p = worker.store.printStorePath(i);

     

       127
       +
       -                    pathsInChroot[p] = p;

     

       128
       +
       -                }

     

       129
       +
       -

     

       130
       +
       -                /* Violations will go to the syslog if you set this. Unfortunately the destination does not appear to be configurable */

     

       131
       +
       -                if (settings.darwinLogSandboxViolations) {

     

       132
       +
       -                    sandboxProfile += "(deny default)\n";

     

       133
       +
       -                } else {

     

       134
       +
       -                    sandboxProfile += "(deny default (with no-log))\n";

     

       135
       +
       -                }

     

       136
       +
       +            /* And we want the store in there regardless of how empty pathsInChroot. We include the innermost

     

       137
       +
       +               path component this time, since it's typically /nix/store and we care about that. */

     

       138
       +
       +            Path cur = worker.store.storeDir;

     

       139
       +
       +            while (cur.compare("/") != 0) {

     

       140
       +
       +                ancestry.insert(cur);

     

       141
       +
       +                cur = dirOf(cur);

     

       142
       +
       +            }

     

       143
       +
        

     

       144
       +
       -                sandboxProfile +=

     

       145
       +
       -                    #include "sandbox-defaults.sb"

     

       146
       +
       -                    ;

     

       147
       +
       +            /* Add all our input paths to the chroot */

     

       148
       +
       +            for (auto & i : inputPaths) {

     

       149
       +
       +                auto p = worker.store.printStorePath(i);

     

       150
       +
       +                pathsInChroot[p] = p;

     

       151
       +
       +            }

     

       152
       +
        

     

       153
       +
       -                if (!derivationType->isSandboxed())

     

       154
       +
       -                    sandboxProfile +=

     

       155
       +
       -                        #include "sandbox-network.sb"

     

       156
       +
       -                        ;

     

       157
       +
       -

     

       158
       +
       -                /* Add the output paths we'll use at build-time to the chroot */

     

       159
       +
       -                sandboxProfile += "(allow file-read* file-write* process-exec\n";

     

       160
       +
       -                for (auto & [_, path] : scratchOutputs)

     

       161
       +
       -                    sandboxProfile += fmt("\t(subpath \"%s\")\n", worker.store.printStorePath(path));

     

       162
       +
       -

     

       163
       +
       -                sandboxProfile += ")\n";

     

       164
       +
       -

     

       165
       +
       -                /* Our inputs (transitive dependencies and any impurities computed above)

     

       166
       +
       -

     

       167
       +
       -                   without file-write* allowed, access() incorrectly returns EPERM

     

       168
       +
       -                 */

     

       169
       +
       -                sandboxProfile += "(allow file-read* file-write* process-exec\n";

     

       170
       +
       -                for (auto & i : pathsInChroot) {

     

       171
       +
       -                    if (i.first != i.second.source)

     

       172
       +
       -                        throw Error(

     

       173
       +
       -                            "can't map '%1%' to '%2%': mismatched impure paths not supported on Darwin",

     

       174
       +
       -                            i.first, i.second.source);

     

       175
       +
       -

     

       176
       +
       -                    std::string path = i.first;

     

       177
       +
       -                    auto optSt = maybeLstat(path.c_str());

     

       178
       +
       -                    if (!optSt) {

     

       179
       +
       -                        if (i.second.optional)

     

       180
       +
       -                            continue;

     

       181
       +
       -                        throw SysError("getting attributes of required path '%s", path);

     

       182
       +
       -                    }

     

       183
       +
       -                    if (S_ISDIR(optSt->st_mode))

     

       184
       +
       -                        sandboxProfile += fmt("\t(subpath \"%s\")\n", path);

     

       185
       +
       -                    else

     

       186
       +
       -                        sandboxProfile += fmt("\t(literal \"%s\")\n", path);

     

       187
       +
       -                }

     

       188
       +
       -                sandboxProfile += ")\n";

     

       189
       +
       +            /* Violations will go to the syslog if you set this. Unfortunately the destination does not appear to be configurable */

     

       190
       +
       +            if (settings.darwinLogSandboxViolations) {

     

       191
       +
       +                sandboxProfile += "(deny default)\n";

     

       192
       +
       +            } else {

     

       193
       +
       +                sandboxProfile += "(deny default (with no-log))\n";

     

       194
       +
       +            }

     

       195
       +
        

     

       196
       +
       -                /* Allow file-read* on full directory hierarchy to self. Allows realpath() */

     

       197
       +
       -                sandboxProfile += "(allow file-read*\n";

     

       198
       +
       -                for (auto & i : ancestry) {

     

       199
       +
       -                    sandboxProfile += fmt("\t(literal \"%s\")\n", i);

     

       200
       +
       -                }

     

       201
       +
       -                sandboxProfile += ")\n";

     

       202
       +
       +            sandboxProfile +=

     

       203
       +
       +                #include "sandbox-defaults.sb"

     

       204
       +
       +                ;

     

       205
       +
        

     

       206
       +
       -                sandboxProfile += additionalSandboxProfile;

     

       207
       +
       -            } else

     

       208
       +
       +            if (!derivationType->isSandboxed())

     

       209
       +
                        sandboxProfile +=

     

       210
       +
       -                    #include "sandbox-minimal.sb"

     

       211
       +
       +                    #include "sandbox-network.sb"

     

       212
       +
                            ;

     

       213
       +
        

     

       214
       +
       -            debug("Generated sandbox profile:");

     

       215
       +
       -            debug(sandboxProfile);

     

       216
       +
       -

     

       217
       +
       -            Path sandboxFile = tmpDir + "/.sandbox.sb";

     

       218
       +
       +            /* Add the output paths we'll use at build-time to the chroot */

     

       219
       +
       +            sandboxProfile += "(allow file-read* file-write* process-exec\n";

     

       220
       +
       +            for (auto & [_, path] : scratchOutputs)

     

       221
       +
       +                sandboxProfile += fmt("\t(subpath \"%s\")\n", worker.store.printStorePath(path));

     

       222
       +
        

     

       223
       +
       -            writeFile(sandboxFile, sandboxProfile);

     

       224
       +
       +            sandboxProfile += ")\n";

     

       225
       +
        

     

       226
       +
       -            bool allowLocalNetworking = parsedDrv->getBoolAttr("__darwinAllowLocalNetworking");

     

       227
       +
       +            /* Our inputs (transitive dependencies and any impurities computed above)

     

       228
       +
        

     

       229
       +
       -            /* The tmpDir in scope points at the temporary build directory for our derivation. Some packages try different mechanisms

     

       230
       +
       -               to find temporary directories, so we want to open up a broader place for them to put their files, if needed. */

     

       231
       +
       -            Path globalTmpDir = canonPath(defaultTempDir(), true);

     

       232
       +
       +               without file-write* allowed, access() incorrectly returns EPERM

     

       233
       +
       +             */

     

       234
       +
       +            sandboxProfile += "(allow file-read* file-write* process-exec\n";

     

       235
       +
       +            for (auto & i : pathsInChroot) {

     

       236
       +
       +                if (i.first != i.second.source)

     

       237
       +
       +                    throw Error(

     

       238
       +
       +                        "can't map '%1%' to '%2%': mismatched impure paths not supported on Darwin",

     

       239
       +
       +                        i.first, i.second.source);

     

       240
       +
       +

     

       241
       +
       +                std::string path = i.first;

     

       242
       +
       +                auto optSt = maybeLstat(path.c_str());

     

       243
       +
       +                if (!optSt) {

     

       244
       +
       +                    if (i.second.optional)

     

       245
       +
       +                        continue;

     

       246
       +
       +                    throw SysError("getting attributes of required path '%s", path);

     

       247
       +
       +                }

     

       248
       +
       +                if (S_ISDIR(optSt->st_mode))

     

       249
       +
       +                    sandboxProfile += fmt("\t(subpath \"%s\")\n", path);

     

       250
       +
       +                else

     

       251
       +
       +                    sandboxProfile += fmt("\t(literal \"%s\")\n", path);

     

       252
       +
       +            }

     

       253
       +
       +            sandboxProfile += ")\n";

     

       254
       +
        

     

       255
       +
       -            /* They don't like trailing slashes on subpath directives */

     

       256
       +
       -            while (!globalTmpDir.empty() && globalTmpDir.back() == '/')

     

       257
       +
       -                globalTmpDir.pop_back();

     

       258
       +
       +            /* Allow file-read* on full directory hierarchy to self. Allows realpath() */

     

       259
       +
       +            sandboxProfile += "(allow file-read*\n";

     

       260
       +
       +            for (auto & i : ancestry) {

     

       261
       +
       +                sandboxProfile += fmt("\t(literal \"%s\")\n", i);

     

       262
       +
       +            }

     

       263
       +
       +            sandboxProfile += ")\n";

     

       264
       +
        

     

       265
       +
       -            if (getEnv("_NIX_TEST_NO_SANDBOX") != "1") {

     

       266
       +
       -                builder = "/usr/bin/sandbox-exec";

     

       267
       +
       -                args.push_back("sandbox-exec");

     

       268
       +
       -                args.push_back("-f");

     

       269
       +
       -                args.push_back(sandboxFile);

     

       270
       +
       -                args.push_back("-D");

     

       271
       +
       -                args.push_back("_GLOBAL_TMP_DIR=" + globalTmpDir);

     

       272
       +
       -                if (allowLocalNetworking) {

     

       273
       +
       -                    args.push_back("-D");

     

       274
       +
       -                    args.push_back(std::string("_ALLOW_LOCAL_NETWORKING=1"));

     

       275
       +
       -                }

     

       276
       +
       -                args.push_back(drv->builder);

     

       277
       +
       -            } else {

     

       278
       +
       -                builder = drv->builder;

     

       279
       +
       -                args.push_back(std::string(baseNameOf(drv->builder)));

     

       280
       +
       +            sandboxProfile += additionalSandboxProfile;

     

       281
       +
       +        } else

     

       282
       +
       +            sandboxProfile +=

     

       283
       +
       +                #include "sandbox-minimal.sb"

     

       284
       +
       +                ;

     

       285
       +
       +

     

       286
       +
       +        debug("Generated sandbox profile:");

     

       287
       +
       +        debug(sandboxProfile);

     

       288
       +
       +

     

       289
       +
       +        bool allowLocalNetworking = parsedDrv->getBoolAttr("__darwinAllowLocalNetworking");

     

       290
       +
       +

     

       291
       +
       +        /* The tmpDir in scope points at the temporary build directory for our derivation. Some packages try different mechanisms

     

       292
       +
       +            to find temporary directories, so we want to open up a broader place for them to put their files, if needed. */

     

       293
       +
       +        Path globalTmpDir = canonPath(defaultTempDir(), true);

     

       294
       +
       +

     

       295
       +
       +        /* They don't like trailing slashes on subpath directives */

     

       296
       +
       +        while (!globalTmpDir.empty() && globalTmpDir.back() == '/')

     

       297
       +
       +            globalTmpDir.pop_back();

     

       298
       +
       +

     

       299
       +
       +        if (getEnv("_NIX_TEST_NO_SANDBOX") != "1") {

     

       300
       +
       +            Strings sandboxArgs;

     

       301
       +
       +            sandboxArgs.push_back("_GLOBAL_TMP_DIR");

     

       302
       +
       +            sandboxArgs.push_back(globalTmpDir);

     

       303
       +
       +            if (allowLocalNetworking) {

     

       304
       +
       +                sandboxArgs.push_back("_ALLOW_LOCAL_NETWORKING");

     

       305
       +
       +                sandboxArgs.push_back("1");

     

       306
       +
       +            }

     

       307
       +
       +            if (sandbox_init_with_parameters(sandboxProfile.c_str(), 0, stringsToCharPtrs(sandboxArgs).data(), NULL)) {

     

       308
       +
       +                writeFull(STDERR_FILENO, "failed to configure sandbox\n");

     

       309
       +
       +                _exit(1);

     

       310
       +
                    }

     

       311
       +
                }

     

       312
       +
       +

     

       313
       +
       +        builder = drv->builder;

     

       314
       +
       +        args.push_back(std::string(baseNameOf(drv->builder)));

     

       315
       +
        #else

     

       316
       +
       -        else {

     

       317
       +
       +        if (!drv->isBuiltin()) {

     

       318
       +
                    builder = drv->builder;

     

       319
       +
                    args.push_back(std::string(baseNameOf(drv->builder)));

     

       320
       +
                }

     

       321
       +
       -- 

     

       322
       +
       2.46.1

     

       323
       +

+53

pkgs/tools/package-management/nix/patches/git/0003-packaging-Add-darwin-lsandbox-in-meson.patch

···

       1
       +
       From f7335530619f9b18d6cc249a297e4dca369101a5 Mon Sep 17 00:00:00 2001

     

       2
       +
       From: Robert Hensing <robert@roberthensing.nl>

     

       3
       +
       Date: Thu, 3 Oct 2024 12:23:17 +0200

     

       4
       +
       Subject: [PATCH 3/6] packaging: Add darwin -lsandbox in meson

     

       5
       +
       MIME-Version: 1.0

     

       6
       +
       Content-Type: text/plain; charset=UTF-8

     

       7
       +
       Content-Transfer-Encoding: 8bit

     

       8
       +
       

     

       9
       +
       Signed-off-by: Jörg Thalheim <joerg@thalheim.io>

     

       10
       +
       ---

     

       11
       +
        src/libstore/meson.build | 5 +++++

     

       12
       +
        src/libstore/package.nix | 2 ++

     

       13
       +
        2 files changed, 7 insertions(+)

     

       14
       +
       

     

       15
       +
       diff --git a/src/libstore/meson.build b/src/libstore/meson.build

     

       16
       +
       index 6a6aabf97..c2aa5bff3 100644

     

       17
       +
       --- a/src/libstore/meson.build

     

       18
       +
       +++ b/src/libstore/meson.build

     

       19
       +
       @@ -69,6 +69,11 @@ has_acl_support = cxx.has_header('sys/xattr.h') \

     

       20
       +
          and cxx.has_function('lremovexattr')

     

       21
       +
        configdata.set('HAVE_ACL_SUPPORT', has_acl_support.to_int())

     

       22
       +
        

     

       23
       +
       +if host_machine.system() == 'darwin'

     

       24
       +
       +  sandbox = cxx.find_library('sandbox')

     

       25
       +
       +  deps_other += [sandbox]

     

       26
       +
       +endif

     

       27
       +
       +

     

       28
       +
        subdir('build-utils-meson/threads')

     

       29
       +
        

     

       30
       +
        boost = dependency(

     

       31
       +
       diff --git a/src/libstore/package.nix b/src/libstore/package.nix

     

       32
       +
       index 9568462b5..f04e3b95f 100644

     

       33
       +
       --- a/src/libstore/package.nix

     

       34
       +
       +++ b/src/libstore/package.nix

     

       35
       +
       @@ -3,6 +3,7 @@

     

       36
       +
        , mkMesonLibrary

     

       37
       +
        

     

       38
       +
        , unixtools

     

       39
       +
       +, darwin

     

       40
       +
        

     

       41
       +
        , nix-util

     

       42
       +
        , boost

     

       43
       +
       @@ -56,6 +57,7 @@ mkMesonLibrary (finalAttrs: {

     

       44
       +
            sqlite

     

       45
       +
          ] ++ lib.optional stdenv.hostPlatform.isLinux libseccomp

     

       46
       +
            # There have been issues building these dependencies

     

       47
       +
       +    ++ lib.optional stdenv.hostPlatform.isDarwin darwin.apple_sdk.libs.sandbox

     

       48
       +
            ++ lib.optional (stdenv.hostPlatform == stdenv.buildPlatform && (stdenv.isLinux || stdenv.isDarwin))

     

       49
       +
              aws-sdk-cpp

     

       50
       +
          ;

     

       51
       +
       -- 

     

       52
       +
       2.46.1

     

       53
       +

+34

pkgs/tools/package-management/nix/patches/git/0004-local-derivation-goal-Print-sandbox-error-detail-on-.patch

···

       1
       +
       From 14d09e0b55898ac22d4cdeade3bf6c4174052ffd Mon Sep 17 00:00:00 2001

     

       2
       +
       From: Robert Hensing <robert@roberthensing.nl>

     

       3
       +
       Date: Thu, 3 Oct 2024 12:44:12 +0200

     

       4
       +
       Subject: [PATCH 4/6] local-derivation-goal: Print sandbox error detail on

     

       5
       +
        darwin

     

       6
       +
       MIME-Version: 1.0

     

       7
       +
       Content-Type: text/plain; charset=UTF-8

     

       8
       +
       Content-Transfer-Encoding: 8bit

     

       9
       +
       

     

       10
       +
       Co-Authored-By: Théophane Hufschmitt <theophane.hufschmitt@tweag.io>

     

       11
       +
       Signed-off-by: Jörg Thalheim <joerg@thalheim.io>

     

       12
       +
       ---

     

       13
       +
        src/libstore/unix/build/local-derivation-goal.cc | 5 +++--

     

       14
       +
        1 file changed, 3 insertions(+), 2 deletions(-)

     

       15
       +
       

     

       16
       +
       diff --git a/src/libstore/unix/build/local-derivation-goal.cc b/src/libstore/unix/build/local-derivation-goal.cc

     

       17
       +
       index 067755c0d..f34d68403 100644

     

       18
       +
       --- a/src/libstore/unix/build/local-derivation-goal.cc

     

       19
       +
       +++ b/src/libstore/unix/build/local-derivation-goal.cc

     

       20
       +
       @@ -2208,8 +2208,9 @@ void LocalDerivationGoal::runChild()

     

       21
       +
                        sandboxArgs.push_back("_ALLOW_LOCAL_NETWORKING");

     

       22
       +
                        sandboxArgs.push_back("1");

     

       23
       +
                    }

     

       24
       +
       -            if (sandbox_init_with_parameters(sandboxProfile.c_str(), 0, stringsToCharPtrs(sandboxArgs).data(), NULL)) {

     

       25
       +
       -                writeFull(STDERR_FILENO, "failed to configure sandbox\n");

     

       26
       +
       +            char * sandbox_errbuf = nullptr;

     

       27
       +
       +            if (sandbox_init_with_parameters(sandboxProfile.c_str(), 0, stringsToCharPtrs(sandboxArgs).data(), &sandbox_errbuf)) {

     

       28
       +
       +                writeFull(STDERR_FILENO, fmt("failed to configure sandbox: %s\n", sandbox_errbuf ? sandbox_errbuf : "(null)"));

     

       29
       +
                        _exit(1);

     

       30
       +
                    }

     

       31
       +
                }

     

       32
       +
       -- 

     

       33
       +
       2.46.1

     

       34
       +

+41

pkgs/tools/package-management/nix/patches/git/0005-local-derivation-goal-Refactor.patch

···

       1
       +
       From 06e27042e176b79561f50decb0fdf836b7bec3f5 Mon Sep 17 00:00:00 2001

     

       2
       +
       From: Robert Hensing <robert@roberthensing.nl>

     

       3
       +
       Date: Thu, 3 Oct 2024 12:50:27 +0200

     

       4
       +
       Subject: [PATCH 5/6] local-derivation-goal: Refactor

     

       5
       +
       MIME-Version: 1.0

     

       6
       +
       Content-Type: text/plain; charset=UTF-8

     

       7
       +
       Content-Transfer-Encoding: 8bit

     

       8
       +
       

     

       9
       +
       This works because the `builder` and `args` variables are only used

     

       10
       +
       in the non-builtin code path.

     

       11
       +
       

     

       12
       +
       Co-Authored-By: Théophane Hufschmitt <theophane.hufschmitt@tweag.io>

     

       13
       +
       Signed-off-by: Jörg Thalheim <joerg@thalheim.io>

     

       14
       +
       ---

     

       15
       +
        src/libstore/unix/build/local-derivation-goal.cc | 5 +----

     

       16
       +
        1 file changed, 1 insertion(+), 4 deletions(-)

     

       17
       +
       

     

       18
       +
       diff --git a/src/libstore/unix/build/local-derivation-goal.cc b/src/libstore/unix/build/local-derivation-goal.cc

     

       19
       +
       index f34d68403..f781a84c6 100644

     

       20
       +
       --- a/src/libstore/unix/build/local-derivation-goal.cc

     

       21
       +
       +++ b/src/libstore/unix/build/local-derivation-goal.cc

     

       22
       +
       @@ -2214,15 +2214,12 @@ void LocalDerivationGoal::runChild()

     

       23
       +
                        _exit(1);

     

       24
       +
                    }

     

       25
       +
                }

     

       26
       +
       +#endif

     

       27
       +
        

     

       28
       +
       -        builder = drv->builder;

     

       29
       +
       -        args.push_back(std::string(baseNameOf(drv->builder)));

     

       30
       +
       -#else

     

       31
       +
                if (!drv->isBuiltin()) {

     

       32
       +
                    builder = drv->builder;

     

       33
       +
                    args.push_back(std::string(baseNameOf(drv->builder)));

     

       34
       +
                }

     

       35
       +
       -#endif

     

       36
       +
        

     

       37
       +
                for (auto & i : drv->args)

     

       38
       +
                    args.push_back(rewriteStrings(i, inputRewrites));

     

       39
       +
       -- 

     

       40
       +
       2.46.1

     

       41
       +

+75

pkgs/tools/package-management/nix/patches/git/0006-local-derivation-goal-Move-builder-preparation-to-no.patch

···

       1
       +
       From d1e0bae55afb3c3ef0bcad5d644b0e04da6279b3 Mon Sep 17 00:00:00 2001

     

       2
       +
       From: Robert Hensing <robert@roberthensing.nl>

     

       3
       +
       Date: Thu, 3 Oct 2024 12:57:00 +0200

     

       4
       +
       Subject: [PATCH 6/6] local-derivation-goal: Move builder preparation to

     

       5
       +
        non-builtin code path

     

       6
       +
       MIME-Version: 1.0

     

       7
       +
       Content-Type: text/plain; charset=UTF-8

     

       8
       +
       Content-Transfer-Encoding: 8bit

     

       9
       +
       

     

       10
       +
       Signed-off-by: Jörg Thalheim <joerg@thalheim.io>

     

       11
       +
       ---

     

       12
       +
        .../unix/build/local-derivation-goal.cc       | 25 ++++++++-----------

     

       13
       +
        1 file changed, 10 insertions(+), 15 deletions(-)

     

       14
       +
       

     

       15
       +
       diff --git a/src/libstore/unix/build/local-derivation-goal.cc b/src/libstore/unix/build/local-derivation-goal.cc

     

       16
       +
       index f781a84c6..dcfaadeef 100644

     

       17
       +
       --- a/src/libstore/unix/build/local-derivation-goal.cc

     

       18
       +
       +++ b/src/libstore/unix/build/local-derivation-goal.cc

     

       19
       +
       @@ -2087,11 +2087,6 @@ void LocalDerivationGoal::runChild()

     

       20
       +
                        throw SysError("setuid failed");

     

       21
       +
                }

     

       22
       +
        

     

       23
       +
       -        /* Fill in the arguments. */

     

       24
       +
       -        Strings args;

     

       25
       +
       -

     

       26
       +
       -        std::string builder = "invalid";

     

       27
       +
       -

     

       28
       +
        #if __APPLE__

     

       29
       +
                /* This has to appear before import statements. */

     

       30
       +
                std::string sandboxProfile = "(version 1)\n";

     

       31
       +
       @@ -2216,14 +2211,6 @@ void LocalDerivationGoal::runChild()

     

       32
       +
                }

     

       33
       +
        #endif

     

       34
       +
        

     

       35
       +
       -        if (!drv->isBuiltin()) {

     

       36
       +
       -            builder = drv->builder;

     

       37
       +
       -            args.push_back(std::string(baseNameOf(drv->builder)));

     

       38
       +
       -        }

     

       39
       +
       -

     

       40
       +
       -        for (auto & i : drv->args)

     

       41
       +
       -            args.push_back(rewriteStrings(i, inputRewrites));

     

       42
       +
       -

     

       43
       +
                /* Indicate that we managed to set up the build environment. */

     

       44
       +
                writeFull(STDERR_FILENO, std::string("\2\n"));

     

       45
       +
        

     

       46
       +
       @@ -2254,6 +2241,14 @@ void LocalDerivationGoal::runChild()

     

       47
       +
                    }

     

       48
       +
                }

     

       49
       +
        

     

       50
       +
       +        // Now builder is not builtin

     

       51
       +
       +

     

       52
       +
       +        Strings args;

     

       53
       +
       +        args.push_back(std::string(baseNameOf(drv->builder)));

     

       54
       +
       +

     

       55
       +
       +        for (auto & i : drv->args)

     

       56
       +
       +            args.push_back(rewriteStrings(i, inputRewrites));

     

       57
       +
       +

     

       58
       +
        #if __APPLE__

     

       59
       +
                posix_spawnattr_t attrp;

     

       60
       +
        

     

       61
       +
       @@ -2275,9 +2270,9 @@ void LocalDerivationGoal::runChild()

     

       62
       +
                    posix_spawnattr_setbinpref_np(&attrp, 1, &cpu, NULL);

     

       63
       +
                }

     

       64
       +
        

     

       65
       +
       -        posix_spawn(NULL, builder.c_str(), NULL, &attrp, stringsToCharPtrs(args).data(), stringsToCharPtrs(envStrs).data());

     

       66
       +
       +        posix_spawn(NULL, drv->builder.c_str(), NULL, &attrp, stringsToCharPtrs(args).data(), stringsToCharPtrs(envStrs).data());

     

       67
       +
        #else

     

       68
       +
       -        execve(builder.c_str(), stringsToCharPtrs(args).data(), stringsToCharPtrs(envStrs).data());

     

       69
       +
       +        execve(drv->builder.c_str(), stringsToCharPtrs(args).data(), stringsToCharPtrs(envStrs).data());

     

       70
       +
        #endif

     

       71
       +
        

     

       72
       +
                throw SysError("executing '%1%'", drv->builder);

     

       73
       +
       -- 

     

       74
       +
       2.46.1

     

       75
       +

+44 -22

pkgs/tools/security/fulcio/default.nix pkgs/by-name/fu/fulcio/package.nix

···

       1
       -
       { lib, buildGoModule, fetchFromGitHub, installShellFiles }:

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       2
        
       

     

       3
        
       buildGoModule rec {

     

       4
        
         pname = "fulcio";

     

       5
       -
         version = "1.6.4";

     

       6
        
       

     

       7
        
         src = fetchFromGitHub {

     

       8
        
           owner = "sigstore";

     

       9
        
           repo = pname;

     

       10
        
           rev = "v${version}";

     

       11
       -
           hash = "sha256-eRf504i9kYQua/p0SNlDGNeXa9ztoyz6M8nukhRyzIY=";

     

       12
        
           # populate values that require us to use git. By doing this in postFetch we

     

       13
        
           # can delete .git afterwards and maintain better reproducibility of the src.

     

       14
        
           leaveDotGit = true;

     
···

       20
        
             find "$out" -name .git -print0 | xargs -0 rm -rf

     

       21
        
           '';

     

       22
        
         };

     

       23
       -
         vendorHash = "sha256-VTJhQrsqwGHq8211N3pUf4fmU4H90gRWYJTdEufNGg4=";

     

       24
        
       

     

       25
        
         nativeBuildInputs = [ installShellFiles ];

     

       26
        
       

     
···

       42
        
         preCheck = ''

     

       43
        
           # test all paths

     

       44
        
           unset subPackages

     

       45
       -
       

     

       46
       -
           # skip test that requires networking

     

       47
       -
           substituteInPlace pkg/config/config_network_test.go \

     

       48
       -
             --replace "TestLoad" "SkipLoad"

     

       49
        
         '';

     

       50
        
       

     

       51
       -
         postInstall = ''

     

       52
       -
           installShellCompletion --cmd fulcio \

     

       53
       -
             --bash <($out/bin/fulcio completion bash) \

     

       54
       -
             --fish <($out/bin/fulcio completion fish) \

     

       55
       -
             --zsh <($out/bin/fulcio completion zsh)

     

       56
       -
         '';

     

       57
        
       

     

       58
       -
         doInstallCheck = true;

     

       59
       -
         installCheckPhase = ''

     

       60
       -
           runHook preInstallCheck

     

       61
       -
           $out/bin/fulcio --help

     

       62
       -
           $out/bin/fulcio version 2>&1 | grep "v${version}"

     

       63
       -
           runHook postInstallCheck

     

       64
       -
         '';

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       65
        
       

     

       66
        
         meta = with lib; {

     

       67
        
           homepage = "https://github.com/sigstore/fulcio";

     
···

       79
        
             disconnected instance.

     

       80
        
           '';

     

       81
        
           license = licenses.asl20;

     

       82
       -
           maintainers = with maintainers; [ lesuisse jk ];

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       83
        
         };

     

       84
        
       }

···

       1
       +
       {

     

       2
       +
         lib,

     

       3
       +
         buildGoModule,

     

       4
       +
         fetchFromGitHub,

     

       5
       +
       

     

       6
       +
         # required for completion and cross-complilation

     

       7
       +
         installShellFiles,

     

       8
       +
         buildPackages,

     

       9
       +
         stdenv,

     

       10
       +
       

     

       11
       +
         # required for testing

     

       12
       +
         testers,

     

       13
       +
         fulcio,

     

       14
       +
       }:

     

       15
        
       

     

       16
        
       buildGoModule rec {

     

       17
        
         pname = "fulcio";

     

       18
       +
         version = "1.6.5";

     

       19
        
       

     

       20
        
         src = fetchFromGitHub {

     

       21
        
           owner = "sigstore";

     

       22
        
           repo = pname;

     

       23
        
           rev = "v${version}";

     

       24
       +
           hash = "sha256-TCWZrTqNXTcTsLqTnwnJPXN+kMYVVwLm2J3Y6gd2CV8=";

     

       25
        
           # populate values that require us to use git. By doing this in postFetch we

     

       26
        
           # can delete .git afterwards and maintain better reproducibility of the src.

     

       27
        
           leaveDotGit = true;

     
···

       33
        
             find "$out" -name .git -print0 | xargs -0 rm -rf

     

       34
        
           '';

     

       35
        
         };

     

       36
       +
         vendorHash = "sha256-3E2Y0UlJMjTiM4ILEiaNqVmt4fWMvCRAqzm//CvRIl4=";

     

       37
        
       

     

       38
        
         nativeBuildInputs = [ installShellFiles ];

     

       39
        
       

     
···

       55
        
         preCheck = ''

     

       56
        
           # test all paths

     

       57
        
           unset subPackages

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       58
        
         '';

     

       59
        
       

     

       60
       +
         checkFlags = [

     

       61
       +
           "-skip=TestLoad"

     

       62
       +
         ];

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       63
        
       

     

       64
       +
         postInstall =

     

       65
       +
           let

     

       66
       +
             fulcio =

     

       67
       +
               if stdenv.buildPlatform.canExecute stdenv.hostPlatform then

     

       68
       +
                 placeholder "out"

     

       69
       +
               else

     

       70
       +
                 buildPackages.fulcio;

     

       71
       +
           in

     

       72
       +
           ''

     

       73
       +
             installShellCompletion --cmd fulcio \

     

       74
       +
               --bash <(${fulcio}/bin/fulcio completion bash) \

     

       75
       +
               --fish <(${fulcio}/bin/fulcio completion fish) \

     

       76
       +
               --zsh <(${fulcio}/bin/fulcio completion zsh)

     

       77
       +
           '';

     

       78
       +
       

     

       79
       +
         passthru.tests.version = testers.testVersion {

     

       80
       +
           package = fulcio;

     

       81
       +
           command = "fulcio version";

     

       82
       +
           version = "v${version}";

     

       83
       +
         };

     

       84
        
       

     

       85
        
         meta = with lib; {

     

       86
        
           homepage = "https://github.com/sigstore/fulcio";

     
···

       98
        
             disconnected instance.

     

       99
        
           '';

     

       100
        
           license = licenses.asl20;

     

       101
       +
           maintainers = with maintainers; [

     

       102
       +
             lesuisse

     

       103
       +
             jk

     

       104
       +
           ];

     

       105
        
         };

     

       106
        
       }

-34

pkgs/tools/security/jd-cli/default.nix

···

       1
       -
       { lib, fetchFromGitHub, jre, makeWrapper, maven }:

     

       2
       -
       

     

       3
       -
       maven.buildMavenPackage rec {

     

       4
       -
         pname = "jd-cli";

     

       5
       -
         version = "1.2.1";

     

       6
       -
       

     

       7
       -
         src = fetchFromGitHub {

     

       8
       -
           owner = "intoolswetrust";

     

       9
       -
           repo = pname;

     

       10
       -
           rev = "${pname}-${version}";

     

       11
       -
           hash = "sha256-rRttA5H0A0c44loBzbKH7Waoted3IsOgxGCD2VM0U/Q=";

     

       12
       -
         };

     

       13
       -
       

     

       14
       -
         mvnHash = "sha256-lEcAq0H8Uacv02ItjVGfxvtRip5206HtpREBrQDzBDo=";

     

       15
       -
       

     

       16
       -
         mvnParameters = "-DskipTests";

     

       17
       -
       

     

       18
       -
         nativeBuildInputs = [ makeWrapper ];

     

       19
       -
       

     

       20
       -
         installPhase = ''

     

       21
       -
           mkdir -p $out/bin $out/share/jd-cli

     

       22
       -
           install -Dm644 jd-cli/target/jd-cli.jar $out/share/jd-cli

     

       23
       -
       

     

       24
       -
           makeWrapper ${jre}/bin/java $out/bin/jd-cli \

     

       25
       -
             --add-flags "-jar $out/share/jd-cli/jd-cli.jar"

     

       26
       -
         '';

     

       27
       -
       

     

       28
       -
         meta = with lib; {

     

       29
       -
           description = "Simple command line wrapper around JD Core Java Decompiler project";

     

       30
       -
           homepage = "https://github.com/intoolswetrust/jd-cli";

     

       31
       -
           license = licenses.gpl3;

     

       32
       -
           maintainers = with maintainers; [ majiir ];

     

       33
       -
         };

     

       34
       -
       }

-96

pkgs/tools/security/jd-gui/default.nix

···

       1
       -
       { lib

     

       2
       -
       , stdenv

     

       3
       -
       , fetchFromGitHub

     

       4
       -
       , fetchpatch

     

       5
       -
       , jre

     

       6
       -
       , jdk

     

       7
       -
       , gradle_6

     

       8
       -
       , makeDesktopItem

     

       9
       -
       , copyDesktopItems

     

       10
       -
       , runtimeShell

     

       11
       -
       }:

     

       12
       -
       

     

       13
       -
       let

     

       14
       -
         pname = "jd-gui";

     

       15
       -
         version = "1.6.6";

     

       16
       -
       

     

       17
       -
         name = "${pname}-${version}";

     

       18
       -
       

     

       19
       -
         src = fetchFromGitHub {

     

       20
       -
           owner = "java-decompiler";

     

       21
       -
           repo = pname;

     

       22
       -
           rev = "v${version}";

     

       23
       -
           hash = "sha256-QHiZPYFwDQzbXVSuhwzQqBRXlkG9QVU+Jl6SKvBoCwQ=";

     

       24
       -
         };

     

       25
       -
       

     

       26
       -
         gradle = gradle_6;

     

       27
       -
       

     

       28
       -
         desktopItem = makeDesktopItem {

     

       29
       -
           name = "jd-gui";

     

       30
       -
           exec = "jd-gui %F";

     

       31
       -
           icon = "jd-gui";

     

       32
       -
           comment = "Java Decompiler JD-GUI";

     

       33
       -
           desktopName = "JD-GUI";

     

       34
       -
           genericName = "Java Decompiler";

     

       35
       -
           mimeTypes = [ "application/java" "application/java-vm" "application/java-archive" ];

     

       36
       -
           categories = [ "Development" "Debugger" ];

     

       37
       -
           startupWMClass = "org-jd-gui-App";

     

       38
       -
         };

     

       39
       -
       

     

       40
       -
       in stdenv.mkDerivation rec {

     

       41
       -
         inherit pname version src;

     

       42
       -
       

     

       43
       -
         patches = [

     

       44
       -
           # https://github.com/java-decompiler/jd-gui/pull/362

     

       45
       -
           (fetchpatch {

     

       46
       -
             name = "nebula-plugin-gradle-6-compatibility.patch";

     

       47
       -
             url = "https://github.com/java-decompiler/jd-gui/commit/91f805f9dc8ce0097460e63c8095ccea870687e6.patch";

     

       48
       -
             hash = "sha256-9eaM9Mx2FaKIhGSOHjATKN/CrtvJeXyrH8Mdx8LNtpE=";

     

       49
       -
           })

     

       50
       -
         ];

     

       51
       -
       

     

       52
       -
         nativeBuildInputs = [ jdk gradle copyDesktopItems ];

     

       53
       -
       

     

       54
       -
         mitmCache = gradle.fetchDeps {

     

       55
       -
           inherit pname;

     

       56
       -
           data = ./deps.json;

     

       57
       -
         };

     

       58
       -
       

     

       59
       -
         __darwinAllowLocalNetworking = true;

     

       60
       -
       

     

       61
       -
         gradleBuildTask = "jar";

     

       62
       -
       

     

       63
       -
         installPhase = let

     

       64
       -
           jar = "$out/share/jd-gui/${name}.jar";

     

       65
       -
         in ''

     

       66
       -
           runHook preInstall

     

       67
       -
       

     

       68
       -
           mkdir -p $out/bin $out/share/{jd-gui,icons/hicolor/128x128/apps}

     

       69
       -
           cp build/libs/${name}.jar ${jar}

     

       70
       -
           cp src/linux/resources/jd_icon_128.png $out/share/icons/hicolor/128x128/apps/jd-gui.png

     

       71
       -
       

     

       72
       -
           cat > $out/bin/jd-gui <<EOF

     

       73
       -
           #!${runtimeShell}

     

       74
       -
           export JAVA_HOME=${jre}

     

       75
       -
           exec ${jre}/bin/java -jar ${jar} "\$@"

     

       76
       -
           EOF

     

       77
       -
           chmod +x $out/bin/jd-gui

     

       78
       -
       

     

       79
       -
           runHook postInstall

     

       80
       -
         '';

     

       81
       -
       

     

       82
       -
         desktopItems = [ desktopItem ];

     

       83
       -
       

     

       84
       -
         meta = with lib; {

     

       85
       -
           description = "Fast Java Decompiler with powerful GUI";

     

       86
       -
           mainProgram = "jd-gui";

     

       87
       -
           homepage    = "https://java-decompiler.github.io/";

     

       88
       -
           sourceProvenance = with sourceTypes; [

     

       89
       -
             fromSource

     

       90
       -
             binaryBytecode  # deps

     

       91
       -
           ];

     

       92
       -
           license     = licenses.gpl3;

     

       93
       -
           platforms   = platforms.unix;

     

       94
       -
           maintainers = [ maintainers.thoughtpolice ];

     

       95
       -
         };

     

       96
       -
       }

-210

pkgs/tools/security/jd-gui/deps.json

···

       1
       -
       {

     

       2
       -
        "!comment": "This is a nixpkgs Gradle dependency lockfile. For more details, refer to the Gradle section in the nixpkgs manual.",

     

       3
       -
        "!version": 1,

     

       4
       -
        "https://jcenter.bintray.com": {

     

       5
       -
         "com/bmuschko#gradle-docker-plugin/3.2.1": {

     

       6
       -
          "jar": "sha256-BfgdS5EdMR7nrEhJ6/eLMD4HdDQY1OiaVZVCK/OAIxQ=",

     

       7
       -
          "pom": "sha256-slOHkvEGJnUa9sjeAgdH/1E4kntOKfL69KjtOsFKzSE="

     

       8
       -
         },

     

       9
       -
         "com/fifesoft#rsyntaxtextarea/3.0.4": {

     

       10
       -
          "jar": "sha256-76a7i/iJ6WnAwIGQ5AsolZbqDO3sA/7yNwGAdcsBSQU=",

     

       11
       -
          "pom": "sha256-Dat8ku0cJsdYs0EjYsDXjQy4v2RB2i5q4FqGPAO3W64="

     

       12
       -
         },

     

       13
       -
         "com/netflix/nebula#gradle-ospackage-plugin/8.5.6": {

     

       14
       -
          "jar": "sha256-sQK7oYx9F4OlcSgZj6/vNYr+/nIVufi783YpFCjvkGk=",

     

       15
       -
          "module": "sha256-CQGrawL62gDjdBsDaCwdRtgDDQQ0aexWDIrl8jrwsYw=",

     

       16
       -
          "pom": "sha256-zr2oKXDuN6bO9Ppzs81hOR+zFWseT5si55TrZ1yUdfs="

     

       17
       -
         },

     

       18
       -
         "com/thoughtworks/xstream#xstream-parent/1.4.10": {

     

       19
       -
          "pom": "sha256-RncMfpQQkzv62s69yR5ekLAjxhoako27hXa2kh2DBsw="

     

       20
       -
         },

     

       21
       -
         "com/thoughtworks/xstream#xstream/1.4.10": {

     

       22
       -
          "jar": "sha256-oVh/NfphdRNgfIbsnm5N5euKzfmjptf3RY+KjECwCFg=",

     

       23
       -
          "pom": "sha256-pKn/aI9xPaPqwEQS5QoMml4XPmkh/kRt2wfUkB2aNBc="

     

       24
       -
         },

     

       25
       -
         "com/yuvimasory#orange-extensions/1.3.0": {

     

       26
       -
          "jar": "sha256-M1gGPRjFV56evw/eRWQOqy1FJ9HummKDyTZ5zqRG3YY=",

     

       27
       -
          "pom": "sha256-MBQbN96epg6iqwnPBCVAc4hHqKG8A1o7a9A2OsMvV7I="

     

       28
       -
         },

     

       29
       -
         "commons-beanutils#commons-beanutils/1.7.0": {

     

       30
       -
          "jar": "sha256-JLyqIMy9x8hWzgwK6hRFZpQ0A+Lp8nvZd5zaHXaCPvQ=",

     

       31
       -
          "pom": "sha256-tqymRloosCdobwJdV3AvkK0NEo4U0c/OygvYcfAIStk="

     

       32
       -
         },

     

       33
       -
         "commons-io#commons-io/2.6": {

     

       34
       -
          "jar": "sha256-+HfTBGYKwqFC84ZbrfyXHex+1zx0fH+NXS9ROcpzZRM=",

     

       35
       -
          "pom": "sha256-DCOGOJOiKR9aev29jRWSOzlIr9h+Vj+jQc3Pbq4zimA="

     

       36
       -
         },

     

       37
       -
         "commons-logging#commons-logging/1.2": {

     

       38
       -
          "jar": "sha256-2t3qHqC+D1aXirMAa4rJKDSv7vvZt+TmMW/KV98PpjY=",

     

       39
       -
          "pom": "sha256-yRq1qlcNhvb9B8wVjsa8LFAIBAKXLukXn+JBAHOfuyA="

     

       40
       -
         },

     

       41
       -
         "edu/sc/seis/gradle#launch4j/2.4.4": {

     

       42
       -
          "jar": "sha256-Q3jZCBGaI9GKG9t0HAnL+KRhoNfFNSFo3PQHZmFC3FY=",

     

       43
       -
          "pom": "sha256-Cfk0ecS6AgtilLVZvLVOHdRNsB+iLGDZLa0o0zHJFqs="

     

       44
       -
         },

     

       45
       -
         "junit#junit/4.12": {

     

       46
       -
          "jar": "sha256-WXIfCAXiI9hLkGd4h9n/Vn3FNNfFAsqQPAwrF/BcEWo=",

     

       47
       -
          "pom": "sha256-kPFj944/+28cetl96efrpO6iWAcUG4XW0SvmfKJUScQ="

     

       48
       -
         },

     

       49
       -
         "net/sf/launch4j#launch4j/3.12": {

     

       50
       -
          "pom": "sha256-rVGWVL75ed10qYwXKlR93sPNhWSAORnj296G05Srvpc="

     

       51
       -
         },

     

       52
       -
         "net/sf/launch4j#launch4j/3.12/core": {

     

       53
       -
          "jar": "sha256-XUbxMJCI4cijjw9KV84ITUZBakNdG5OZW8OFKooysIU="

     

       54
       -
         },

     

       55
       -
         "net/sf/launch4j#launch4j/3.12/workdir-linux64": {

     

       56
       -
          "jar": "sha256-XlgZsoDyUT9EfHBsXejU3OceVlxFMUv0+pv+0MXs57k="

     

       57
       -
         },

     

       58
       -
         "net/sf/proguard#proguard-base/6.1.0": {

     

       59
       -
          "jar": "sha256-gdCEOhP5zuZehDy8c/Km8U/MeyfHxgEDyLxx3umFp24=",

     

       60
       -
          "pom": "sha256-H39OO6GpBYFGL9Jn6eEWfiAcCk9h5pq1DUV/SMBQFXY="

     

       61
       -
         },

     

       62
       -
         "net/sf/proguard#proguard-gradle/6.1.0": {

     

       63
       -
          "jar": "sha256-rQfrlm3lIewsMYLaYg0xpaNTTwXMjmDDlNG41EGCmvQ=",

     

       64
       -
          "pom": "sha256-tEDYJgbG4nVImE2JcLeF8LWCJhvDhhecWS2VMKO6TzQ="

     

       65
       -
         },

     

       66
       -
         "net/sf/proguard#proguard-parent/6.1.0": {

     

       67
       -
          "pom": "sha256-v7pHjLrr8KfIx139/iBxnls33nzAgA+iYjoFgOaJEXE="

     

       68
       -
         },

     

       69
       -
         "org/abego/treelayout#org.abego.treelayout.core/1.0.1": {

     

       70
       -
          "jar": "sha256-grnjYxrMcIwRUhb6ePl3gNioHbt/FfjYIpGh3DqDsdA=",

     

       71
       -
          "pom": "sha256-fIy/ymTpcEQNTyh/NRapbABpKgOU/KHVexKpepbw6hE="

     

       72
       -
         },

     

       73
       -
         "org/antlr#ST4/4.0.8": {

     

       74
       -
          "jar": "sha256-WMqrxAyfdLC1mT/YaOD2SlDAdZCU5qJRqq+tmO38ejs=",

     

       75
       -
          "pom": "sha256-PAiQ3scRdOs7o9QEyp40GQH/awQhgIsAcTsNuxMGwXw="

     

       76
       -
         },

     

       77
       -
         "org/antlr#antlr-master/3.5.2": {

     

       78
       -
          "pom": "sha256-QtkaUx6lEA6wm1QaoALDuQjo8oK9c7bi9S83HvEzG9Y="

     

       79
       -
         },

     

       80
       -
         "org/antlr#antlr-runtime/3.5.2": {

     

       81
       -
          "jar": "sha256-zj/I7LEPOemjzdy7LONQ0nLZzT0LHhjm/nPDuTichzQ=",

     

       82
       -
          "pom": "sha256-RqnCIAu4sSvXEkqnpQl/9JCZkIMpyFGgTLIFFCCqfyU="

     

       83
       -
         },

     

       84
       -
         "org/antlr#antlr4-runtime/4.5": {

     

       85
       -
          "jar": "sha256-tcQNVavm6kxWFPjxHoNy2YQ07TwRKNWLjuoduVWXN6s=",

     

       86
       -
          "pom": "sha256-hRz5esL2utOZacMOx95PhBu2R1J/Rl7CDMur+yKHIpg="

     

       87
       -
         },

     

       88
       -
         "org/antlr#antlr4/4.5": {

     

       89
       -
          "jar": "sha256-do7i3es2pP5kNMgFoTyVI41LZBPlL3ce0meKGEGOMNk=",

     

       90
       -
          "pom": "sha256-4Mhs6hXMEO/K6UuvsOEADmv8xBgUK11ybNe8OyL+dwI="

     

       91
       -
         },

     

       92
       -
         "org/apache#apache/13": {

     

       93
       -
          "pom": "sha256-/1E9sDYf1BI3vvR4SWi8FarkeNTsCpSW+BEHLMrzhB0="

     

       94
       -
         },

     

       95
       -
         "org/apache#apache/18": {

     

       96
       -
          "pom": "sha256-eDEwcoX9R1u8NrIK4454gvEcMVOx1ZMPhS1E7ajzPBc="

     

       97
       -
         },

     

       98
       -
         "org/apache#apache/19": {

     

       99
       -
          "pom": "sha256-kfejMJbqabrCy69tAf65NMrAAsSNjIz6nCQLQPHsId8="

     

       100
       -
         },

     

       101
       -
         "org/apache#apache/21": {

     

       102
       -
          "pom": "sha256-rxDBCNoBTxfK+se1KytLWjocGCZfoq+XoyXZFDU3s4A="

     

       103
       -
         },

     

       104
       -
         "org/apache/ant#ant-launcher/1.10.6": {

     

       105
       -
          "jar": "sha256-wDqhjaSwHJ791kGYNkvC/PL7nqWElxYVup8aCaRoUCY=",

     

       106
       -
          "pom": "sha256-CGuKg9hhebR7pgMeuGiOlGiKAz/qmW8ttwltSLIn6KY="

     

       107
       -
         },

     

       108
       -
         "org/apache/ant#ant-parent/1.10.6": {

     

       109
       -
          "pom": "sha256-n+ReOBBPxGOdqFs4WdeUqT7oMkIrx57D5zfA/QvWmiA="

     

       110
       -
         },

     

       111
       -
         "org/apache/ant#ant-parent/1.9.1": {

     

       112
       -
          "pom": "sha256-kQ71Ysi7ahrZAOGY9U2pG4bQ0o3wG8Eah9tlbZBv1us="

     

       113
       -
         },

     

       114
       -
         "org/apache/ant#ant/1.10.6": {

     

       115
       -
          "jar": "sha256-bFy9iMELt61iTlY3oDdbAQ9AZ/ZJfNj85wtaXxDTtBo=",

     

       116
       -
          "pom": "sha256-AEhxs7RrtMSGoyTlA3CgnKBY72zLhOp6Ceyks/Djx1c="

     

       117
       -
         },

     

       118
       -
         "org/apache/ant#ant/1.9.1": {

     

       119
       -
          "pom": "sha256-wtNC6vx3d7G97/vmCp5NeRIOvV34/PwOY7TesMcOPFQ="

     

       120
       -
         },

     

       121
       -
         "org/apache/commons#commons-compress/1.18": {

     

       122
       -
          "jar": "sha256-Xy3x5GeCXkysWZbUSJDEIBwAC0PAsjz/wHgtKKC+ubA=",

     

       123
       -
          "pom": "sha256-Zyxf6SvT6rQ+jVMzjK1coHO2Up3k6ys4hZo+qmyegRk="

     

       124
       -
         },

     

       125
       -
         "org/apache/commons#commons-compress/1.8": {

     

       126
       -
          "pom": "sha256-OPhEKHDCaR2YIlGfLP+46JxwQQBQt8RsuhdqiCGeRCk="

     

       127
       -
         },

     

       128
       -
         "org/apache/commons#commons-lang3/3.9": {

     

       129
       -
          "jar": "sha256-3i4dzc8++ReozoWGYaBnJqmpRPKOM61/ngi+pE3DwjA=",

     

       130
       -
          "pom": "sha256-pAIkKbmEJbQwGBkVchJ5pS9hDzRki9rEh9TKy76N/rU="

     

       131
       -
         },

     

       132
       -
         "org/apache/commons#commons-parent/33": {

     

       133
       -
          "pom": "sha256-U9ABE1Li5RBvN52vzNrHdU7G8PeCQ8AwXklp9azd+Ps="

     

       134
       -
         },

     

       135
       -
         "org/apache/commons#commons-parent/34": {

     

       136
       -
          "pom": "sha256-Oi5p0G1kHR87KTEm3J4uTqZWO/jDbIfgq2+kKS0Et5w="

     

       137
       -
         },

     

       138
       -
         "org/apache/commons#commons-parent/42": {

     

       139
       -
          "pom": "sha256-zTE0lMZwtIPsJWlyrxaYszDlmPgHACNU63ZUefYEsJw="

     

       140
       -
         },

     

       141
       -
         "org/apache/commons#commons-parent/47": {

     

       142
       -
          "pom": "sha256-io7LVwVTv58f+uIRqNTKnuYwwXr+WSkzaPunvZtC/Lc="

     

       143
       -
         },

     

       144
       -
         "org/apache/commons#commons-parent/48": {

     

       145
       -
          "pom": "sha256-Hh996TcKe3kB8Sjx2s0UIr504/R/lViw954EwGN8oLQ="

     

       146
       -
         },

     

       147
       -
         "org/bouncycastle#bcpg-jdk15on/1.62": {

     

       148
       -
          "jar": "sha256-+EduQ4RO2yAOoLL7OTWVLSI/O2syOmctcxYipLkpQ+A=",

     

       149
       -
          "pom": "sha256-372CfVICQmFhq7AdlCOOakMDsvzWkp5sUpWPjW3wciY="

     

       150
       -
         },

     

       151
       -
         "org/bouncycastle#bcprov-jdk15on/1.62": {

     

       152
       -
          "jar": "sha256-L6CrcbFU2imsE0CXvGu6zZCYfdTEAFUWFZ5klNHVLqI=",

     

       153
       -
          "pom": "sha256-cA/nligsj+84xi/Cw974WM5EmrXzwiCINjYXVth5viY="

     

       154
       -
         },

     

       155
       -
         "org/hamcrest#hamcrest-core/1.3": {

     

       156
       -
          "jar": "sha256-Zv3vkelzk0jfeglqo4SlaF9Oh1WEzOiThqekclHE2Ok=",

     

       157
       -
          "pom": "sha256-/eOGp5BRc6GxA95quCBydYS1DQ4yKC4nl3h8IKZP+pM="

     

       158
       -
         },

     

       159
       -
         "org/hamcrest#hamcrest-parent/1.3": {

     

       160
       -
          "pom": "sha256-bVNflO+2Y722gsnyelAzU5RogAlkK6epZ3UEvBvkEps="

     

       161
       -
         },

     

       162
       -
         "org/jd#jd-core/1.1.3": {

     

       163
       -
          "jar": "sha256-M/YP91x33AiQXnZ2lKOPe2q3kr0uWDH0HitWNUu4Bvs=",

     

       164
       -
          "pom": "sha256-n1Gs7cjKfNmu9LZ3nbLdOkFqcILMtO8Z67VHfBHG6wQ="

     

       165
       -
         },

     

       166
       -
         "org/ow2#ow2/1.5": {

     

       167
       -
          "pom": "sha256-D4obEW52C4/mOJxRuE5LB6cPwRCC1Pk25FO1g91QtDs="

     

       168
       -
         },

     

       169
       -
         "org/ow2/asm#asm/7.1": {

     

       170
       -
          "jar": "sha256-SrL6K20sycyx6qBeoynEB7R7E+0pFfYvjEuMyWJY1N4=",

     

       171
       -
          "pom": "sha256-Dyl0Lq2mWIpGxnn0maZ1Xks5OXZwBPK9nAIBnP0dMYA="

     

       172
       -
         },

     

       173
       -
         "org/redline-rpm#redline/1.2.9": {

     

       174
       -
          "jar": "sha256-zEe5s3Tr9DoPAmv4amdL9uNqVr04lqyIEcUIPTW79OE=",

     

       175
       -
          "pom": "sha256-k94nVXykHsKx/LMHxAhtdDtYdig/41FRUi8oaJjmfGw="

     

       176
       -
         },

     

       177
       -
         "org/slf4j#slf4j-api/1.7.5": {

     

       178
       -
          "jar": "sha256-/jCCUkXSM2yFncONYMD8XzZo2/Kc1YaCjStWZ+w1W5E=",

     

       179
       -
          "pom": "sha256-r6+OdAGbIw0/Vv3XyT+xBwwNyjTz0tWrXeqfxha9XKQ="

     

       180
       -
         },

     

       181
       -
         "org/slf4j#slf4j-parent/1.7.5": {

     

       182
       -
          "pom": "sha256-xDvFoCLb/Z3oK+Iy3/5GIIy8feEsFDhbXagk4zHlNbs="

     

       183
       -
         },

     

       184
       -
         "org/sonatype/oss#oss-parent/7": {

     

       185
       -
          "pom": "sha256-tR+IZ8kranIkmVV/w6H96ne9+e9XRyL+kM5DailVlFQ="

     

       186
       -
         },

     

       187
       -
         "org/sonatype/oss#oss-parent/9": {

     

       188
       -
          "pom": "sha256-+0AmX5glSCEv+C42LllzKyGH7G8NgBgohcFO8fmCgno="

     

       189
       -
         },

     

       190
       -
         "org/tukaani#xz/1.4": {

     

       191
       -
          "pom": "sha256-/kqLT1R/okQ0L7r0pOgPDEg3HYXMQBtYUViRKENiWJI="

     

       192
       -
         },

     

       193
       -
         "org/tukaani#xz/1.8": {

     

       194
       -
          "jar": "sha256-jHlks2/j8MvmRLBPy/+E5JHOgZF9svW/oMuo6VSK/10=",

     

       195
       -
          "pom": "sha256-8p51y4jrSsv35apcCe1V6sLLrmAdY6nzdSMfRUUsEBM="

     

       196
       -
         },

     

       197
       -
         "org/vafer#jdeb/1.8": {

     

       198
       -
          "jar": "sha256-N0/gKgkxTabsghngBVmOdgMjoavktxXMM84+KpvNqTI=",

     

       199
       -
          "pom": "sha256-MQdFSRqXEzi0XcwhFMRt6GWvNOWLI96d2JJfEGFewBY="

     

       200
       -
         },

     

       201
       -
         "xmlpull#xmlpull/1.1.3.1": {

     

       202
       -
          "jar": "sha256-NOCO5iEWBxy7acDtcNFaelsgjWJ5jFnyEgu4kpMky2M=",

     

       203
       -
          "pom": "sha256-jxD/2N8NPpgZyMyEAnCcaySLxTqVTvbkVHDZrjpXNfs="

     

       204
       -
         },

     

       205
       -
         "xpp3#xpp3_min/1.1.4c": {

     

       206
       -
          "jar": "sha256-v8kOnjLQ6rHzl/uXS18VCoFRiDgqxB83KnFJ1bwXgAg=",

     

       207
       -
          "pom": "sha256-tbRqwMCdpBsE28dTRWtIkShWp/+7FJBnaRC1EMRx0T8="

     

       208
       -
         }

     

       209
       -
        }

     

       210
       -
       }

pkgs/top-level/aliases.nix

···

       467
        
         gnuradio3_9Minimal = throw "gnuradio3_9Minimal has been removed because it is not compatible with the latest volk and it had no dependent packages which justified it's distribution"; # Added 2024-07-28

     

       468
        
         gnuradio3_9Packages = throw "gnuradio3_9Minimal has been removed because it is not compatible with the latest volk and it had no dependent packages which justified it's distribution"; # Added 2024-07-28

     

       469
        
         gobby5 = throw "'gobby5' has been renamed to/replaced by 'gobby'"; # Converted to throw 2024-10-17

     

       0
        
       
     

       0
        
       
     

       470
        
       

     

       471
        
         #godot

     

       472
        
       

     
···

       534
        
         jami-client-qt = jami-client; # Added 2022-11-06

     

       535
        
         jami-client = jami; # Added 2023-02-10

     

       536
        
         jami-daemon = jami.daemon; # Added 2023-02-10

     

       0
        
       
     

       0
        
       
     

       537
        
         jsawk = throw "'jsawk' has been removed because it is unmaintained upstream"; # Added 2028-08-07

     

       538
        
       

     

       539
        
         # Julia

     
···

       969
        
         prometheus-dovecot-exporter = dovecot_exporter; # Added 2024-06-10

     

       970
        
         prometheus-openldap-exporter = throw "'prometheus-openldap-exporter' has been removed from nixpkgs, as it was unmaintained"; # Added 2024-09-01

     

       971
        
         prometheus-minio-exporter = throw "'prometheus-minio-exporter' has been removed from nixpkgs, use Minio's built-in Prometheus integration instead"; # Added 2024-06-10

     

       0
        
       
     

       972
        
         protobuf3_24 = protobuf_24;

     

       973
        
         protobuf3_23 = protobuf_23;

     

       974
        
         protobuf3_21 = protobuf_21;

···

       467
        
         gnuradio3_9Minimal = throw "gnuradio3_9Minimal has been removed because it is not compatible with the latest volk and it had no dependent packages which justified it's distribution"; # Added 2024-07-28

     

       468
        
         gnuradio3_9Packages = throw "gnuradio3_9Minimal has been removed because it is not compatible with the latest volk and it had no dependent packages which justified it's distribution"; # Added 2024-07-28

     

       469
        
         gobby5 = throw "'gobby5' has been renamed to/replaced by 'gobby'"; # Converted to throw 2024-10-17

     

       470
       +
         gradle_6 = throw "Gradle 6 has been removed, as it is end-of-life (https://endoflife.date/gradle) and has many vulnerabilities that are not resolved until Gradle 7."; # Added 2024-10-30

     

       471
       +
         gradle_6-unwrapped = throw "Gradle 6 has been removed, as it is end-of-life (https://endoflife.date/gradle) and has many vulnerabilities that are not resolved until Gradle 7."; # Added 2024-10-30

     

       472
        
       

     

       473
        
         #godot

     

       474
        
       

     
···

       536
        
         jami-client-qt = jami-client; # Added 2022-11-06

     

       537
        
         jami-client = jami; # Added 2023-02-10

     

       538
        
         jami-daemon = jami.daemon; # Added 2023-02-10

     

       539
       +
         jd-cli = throw "jd-cli has been removed due to upstream being unmaintained since 2019. Other Java decompilers in Nixpkgs include bytecode-viewer (GUI), cfr (CLI), and procyon (CLI)."; # Added 2024-10-30

     

       540
       +
         jd-gui = throw "jd-gui has been removed due to a dependency on the dead JCenter Bintray. Other Java decompilers in Nixpkgs include bytecode-viewer (GUI), cfr (CLI), and procyon (CLI)."; # Added 2024-10-30

     

       541
        
         jsawk = throw "'jsawk' has been removed because it is unmaintained upstream"; # Added 2028-08-07

     

       542
        
       

     

       543
        
         # Julia

     
···

       973
        
         prometheus-dovecot-exporter = dovecot_exporter; # Added 2024-06-10

     

       974
        
         prometheus-openldap-exporter = throw "'prometheus-openldap-exporter' has been removed from nixpkgs, as it was unmaintained"; # Added 2024-09-01

     

       975
        
         prometheus-minio-exporter = throw "'prometheus-minio-exporter' has been removed from nixpkgs, use Minio's built-in Prometheus integration instead"; # Added 2024-06-10

     

       976
       +
         prometheus-tor-exporter = throw "'prometheus-tor-exporter' has been removed from nixpkgs, as it was broken and unmaintained"; # Added 2024-10-30

     

       977
        
         protobuf3_24 = protobuf_24;

     

       978
        
         protobuf3_23 = protobuf_23;

     

       979
        
         protobuf3_21 = protobuf_21;

+1 -20

pkgs/top-level/all-packages.nix

···

       5156
        
       

     

       5157
        
         hexio = callPackage ../development/tools/hexio { };

     

       5158
        
       

     

       5159
       -
         hexyl = callPackage ../tools/misc/hexyl { };

     

       5160
       -
       

     

       5161
        
         hid-listen = callPackage ../tools/misc/hid-listen { };

     

       5162
        
       

     

       5163
        
         hid-tools = callPackage ../tools/misc/hid-tools { };

     
···

       7656
        
       

     

       7657
        
         fswebcam = callPackage ../os-specific/linux/fswebcam { };

     

       7658
        
       

     

       7659
       -
         fulcio = callPackage ../tools/security/fulcio { };

     

       7660
       -
       

     

       7661
        
         fuseiso = callPackage ../tools/filesystems/fuseiso { };

     

       7662
        
       

     

       7663
        
         fdbPackages = dontRecurseIntoAttrs (callPackage ../servers/foundationdb { });

     
···

       8733
        
         jazzy = callPackage ../development/tools/jazzy { };

     

       8734
        
       

     

       8735
        
         jc = with python3Packages; toPythonApplication jc;

     

       8736
       -
       

     

       8737
       -
         jd-cli = callPackage ../tools/security/jd-cli { };

     

       8738
        
       

     

       8739
        
         jd-diff-patch = callPackage ../development/tools/jd-diff-patch { };

     

       8740
        
       

     

       8741
       -
         jd-gui = callPackage ../tools/security/jd-gui { };

     

       8742
       -
       

     

       8743
        
         jdiskreport = callPackage ../tools/misc/jdiskreport { };

     

       8744
        
       

     

       8745
        
         jekyll = callPackage ../applications/misc/jekyll { };

     
···

       17622
        
         gradleGen = gradle-packages.gen;

     

       17623
        
         wrapGradle = callPackage gradle-packages.wrapGradle { };

     

       17624
        
       

     

       17625
       -
         gradle_6-unwrapped = callPackage gradle-packages.gradle_6 { };

     

       17626
        
         gradle_7-unwrapped = callPackage gradle-packages.gradle_7 { };

     

       17627
        
         gradle_8-unwrapped = callPackage gradle-packages.gradle_8 { };

     

       17628
        
         gradle-unwrapped = gradle_8-unwrapped;

     

       17629
        
       

     

       17630
       -
         gradle_6 = wrapGradle gradle_6-unwrapped null;

     

       17631
        
         gradle_7 = wrapGradle gradle_7-unwrapped null;

     

       17632
        
         gradle_8 = wrapGradle gradle_8-unwrapped null;

     

       17633
        
         gradle = wrapGradle gradle-unwrapped "gradle-unwrapped";

     
···

       24945
        
         prometheus-surfboard-exporter = callPackage ../servers/monitoring/prometheus/surfboard-exporter.nix { };

     

       24946
        
         prometheus-sql-exporter = callPackage ../servers/monitoring/prometheus/sql-exporter.nix { };

     

       24947
        
         prometheus-systemd-exporter = callPackage ../servers/monitoring/prometheus/systemd-exporter.nix { };

     

       24948
       -
         prometheus-tor-exporter = callPackage ../servers/monitoring/prometheus/tor-exporter.nix { };

     

       24949
        
         prometheus-unbound-exporter = callPackage ../servers/monitoring/prometheus/unbound-exporter.nix { };

     

       24950
        
         prometheus-v2ray-exporter = callPackage ../servers/monitoring/prometheus/v2ray-exporter.nix { };

     

       24951
        
         prometheus-varnish-exporter = callPackage ../servers/monitoring/prometheus/varnish-exporter.nix { };

     
···

       32411
        
       

     

       32412
        
         super-slicer-latest = super-slicer.latest;

     

       32413
        
       

     

       32414
       -
         bambu-studio = callPackage ../applications/misc/bambu-studio {

     

       32415
       -
           inherit (gst_all_1) gstreamer gst-plugins-base gst-plugins-bad gst-plugins-good;

     

       32416
       -
       

     

       32417
       -
           wxGTK31 = wxGTK31.override {

     

       32418
       -
             withCurl = true;

     

       32419
       -
             withPrivateFonts = true;

     

       32420
       -
             withWebKit = true;

     

       32421
       -
           };

     

       32422
       -
         };

     

       32423
        
       

     

       32424
        
         orca-slicer = callPackage ../applications/misc/bambu-studio/orca-slicer.nix {};

     

       32425

···

       5156
        
       

     

       5157
        
         hexio = callPackage ../development/tools/hexio { };

     

       5158
        
       

     

       0
        
       
     

       0
        
       
     

       5159
        
         hid-listen = callPackage ../tools/misc/hid-listen { };

     

       5160
        
       

     

       5161
        
         hid-tools = callPackage ../tools/misc/hid-tools { };

     
···

       7654
        
       

     

       7655
        
         fswebcam = callPackage ../os-specific/linux/fswebcam { };

     

       7656
        
       

     

       0
        
       
     

       0
        
       
     

       7657
        
         fuseiso = callPackage ../tools/filesystems/fuseiso { };

     

       7658
        
       

     

       7659
        
         fdbPackages = dontRecurseIntoAttrs (callPackage ../servers/foundationdb { });

     
···

       8729
        
         jazzy = callPackage ../development/tools/jazzy { };

     

       8730
        
       

     

       8731
        
         jc = with python3Packages; toPythonApplication jc;

     

       0
        
       
     

       0
        
       
     

       8732
        
       

     

       8733
        
         jd-diff-patch = callPackage ../development/tools/jd-diff-patch { };

     

       8734
        
       

     

       0
        
       
     

       0
        
       
     

       8735
        
         jdiskreport = callPackage ../tools/misc/jdiskreport { };

     

       8736
        
       

     

       8737
        
         jekyll = callPackage ../applications/misc/jekyll { };

     
···

       17614
        
         gradleGen = gradle-packages.gen;

     

       17615
        
         wrapGradle = callPackage gradle-packages.wrapGradle { };

     

       17616
        
       

     

       0
        
       
     

       17617
        
         gradle_7-unwrapped = callPackage gradle-packages.gradle_7 { };

     

       17618
        
         gradle_8-unwrapped = callPackage gradle-packages.gradle_8 { };

     

       17619
        
         gradle-unwrapped = gradle_8-unwrapped;

     

       17620
        
       

     

       0
        
       
     

       17621
        
         gradle_7 = wrapGradle gradle_7-unwrapped null;

     

       17622
        
         gradle_8 = wrapGradle gradle_8-unwrapped null;

     

       17623
        
         gradle = wrapGradle gradle-unwrapped "gradle-unwrapped";

     
···

       24935
        
         prometheus-surfboard-exporter = callPackage ../servers/monitoring/prometheus/surfboard-exporter.nix { };

     

       24936
        
         prometheus-sql-exporter = callPackage ../servers/monitoring/prometheus/sql-exporter.nix { };

     

       24937
        
         prometheus-systemd-exporter = callPackage ../servers/monitoring/prometheus/systemd-exporter.nix { };

     

       0
        
       
     

       24938
        
         prometheus-unbound-exporter = callPackage ../servers/monitoring/prometheus/unbound-exporter.nix { };

     

       24939
        
         prometheus-v2ray-exporter = callPackage ../servers/monitoring/prometheus/v2ray-exporter.nix { };

     

       24940
        
         prometheus-varnish-exporter = callPackage ../servers/monitoring/prometheus/varnish-exporter.nix { };

     
···

       32400
        
       

     

       32401
        
         super-slicer-latest = super-slicer.latest;

     

       32402
        
       

     

       32403
       +
         bambu-studio = callPackage ../applications/misc/bambu-studio { };

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       32404
        
       

     

       32405
        
         orca-slicer = callPackage ../applications/misc/bambu-studio/orca-slicer.nix {};

     

       32406

pkgs/top-level/python-packages.nix

···

       1036
        
       

     

       1037
        
         automate-home = callPackage ../development/python-modules/automate-home { };

     

       1038
        
       

     

       0
        
       
     

       0
        
       
     

       1039
        
         automx2 = callPackage ../development/python-modules/automx2 { };

     

       1040
        
       

     

       1041
        
         autopage = callPackage ../development/python-modules/autopage { };

     
···

       5165
        
         gntp = callPackage ../development/python-modules/gntp { };

     

       5166
        
       

     

       5167
        
         gnureadline = callPackage ../development/python-modules/gnureadline { };

     

       0
        
       
     

       0
        
       
     

       5168
        
       

     

       5169
        
         goalzero = callPackage ../development/python-modules/goalzero { };

     

       5170
        
       

     
···

       14834
        
       

     

       14835
        
         sphinx-jupyterbook-latex = callPackage ../development/python-modules/sphinx-jupyterbook-latex { };

     

       14836
        
       

     

       0
        
       
     

       0
        
       
     

       14837
        
         sphinx-multitoc-numbering = callPackage ../development/python-modules/sphinx-multitoc-numbering { };

     

       14838
        
       

     

       14839
        
         sphinx-notfound-page = callPackage ../development/python-modules/sphinx-notfound-page { };

     
···

       17537
        
         weblate-schemas = callPackage ../development/python-modules/weblate-schemas { };

     

       17538
        
       

     

       17539
        
         webob = callPackage ../development/python-modules/webob { };

     

       0
        
       
     

       0
        
       
     

       17540
        
       

     

       17541
        
         webrtc-noise-gain = callPackage ../development/python-modules/webrtc-noise-gain { };

     

       17542

···

       1036
        
       

     

       1037
        
         automate-home = callPackage ../development/python-modules/automate-home { };

     

       1038
        
       

     

       1039
       +
         automower-ble = callPackage ../development/python-modules/automower-ble { };

     

       1040
       +
       

     

       1041
        
         automx2 = callPackage ../development/python-modules/automx2 { };

     

       1042
        
       

     

       1043
        
         autopage = callPackage ../development/python-modules/autopage { };

     
···

       5167
        
         gntp = callPackage ../development/python-modules/gntp { };

     

       5168
        
       

     

       5169
        
         gnureadline = callPackage ../development/python-modules/gnureadline { };

     

       5170
       +
       

     

       5171
       +
         go2rtc-client = callPackage ../development/python-modules/go2rtc-client { };

     

       5172
        
       

     

       5173
        
         goalzero = callPackage ../development/python-modules/goalzero { };

     

       5174
        
       

     
···

       14838
        
       

     

       14839
        
         sphinx-jupyterbook-latex = callPackage ../development/python-modules/sphinx-jupyterbook-latex { };

     

       14840
        
       

     

       14841
       +
         sphinx-lv2-theme = callPackage ../development/python-modules/sphinx-lv2-theme { };

     

       14842
       +
       

     

       14843
        
         sphinx-multitoc-numbering = callPackage ../development/python-modules/sphinx-multitoc-numbering { };

     

       14844
        
       

     

       14845
        
         sphinx-notfound-page = callPackage ../development/python-modules/sphinx-notfound-page { };

     
···

       17543
        
         weblate-schemas = callPackage ../development/python-modules/weblate-schemas { };

     

       17544
        
       

     

       17545
        
         webob = callPackage ../development/python-modules/webob { };

     

       17546
       +
       

     

       17547
       +
         webrtc-models = callPackage ../development/python-modules/webrtc-models { };

     

       17548
        
       

     

       17549
        
         webrtc-noise-gain = callPackage ../development/python-modules/webrtc-noise-gain { };

     

       17550