From 8fb9984690c878fcd768e967190957441de05d11 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Janne=20He=C3=9F?= Date: Sun, 6 Jun 2021 20:41:37 +0200 Subject: [PATCH 01/13] lib/modules: Drop mkStrict and mkFixStrictness This was deprecated in 2014 and is not used anywhere in the tree. --- lib/default.nix | 4 ++-- lib/modules.nix | 4 ---- 2 files changed, 2 insertions(+), 6 deletions(-) diff --git a/lib/default.nix b/lib/default.nix index ccae0bbc3ab..ccfee2ebe30 100644 --- a/lib/default.nix +++ b/lib/default.nix @@ -115,8 +115,8 @@ let mergeModules' mergeOptionDecls evalOptionValue mergeDefinitions pushDownProperties dischargeProperties filterOverrides sortProperties fixupOptionType mkIf mkAssert mkMerge mkOverride - mkOptionDefault mkDefault mkForce mkVMOverride mkStrict - mkFixStrictness mkOrder mkBefore mkAfter mkAliasDefinitions + mkOptionDefault mkDefault mkForce mkVMOverride + mkOrder mkBefore mkAfter mkAliasDefinitions mkAliasAndWrapDefinitions fixMergeModules mkRemovedOptionModule mkRenamedOptionModule mkMergedOptionModule mkChangedOptionModule mkAliasOptionModule doRename; diff --git a/lib/modules.nix b/lib/modules.nix index 99b9a8a31ea..58c6cda58e4 100644 --- a/lib/modules.nix +++ b/lib/modules.nix @@ -713,10 +713,6 @@ rec { mkForce = mkOverride 50; mkVMOverride = mkOverride 10; # used by ‘nixos-rebuild build-vm’ - mkStrict = builtins.trace "`mkStrict' is obsolete; use `mkOverride 0' instead." (mkOverride 0); - - mkFixStrictness = id; # obsolete, no-op - mkOrder = priority: content: { _type = "order"; inherit priority content; From 685e8ff7dd18828390f4a983568c222f00969047 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Niklas=20Hamb=C3=BCchen?= Date: Thu, 17 Jun 2021 03:15:13 +0200 Subject: [PATCH 02/13] xserver: Generate readable config indentation --- .../services/x11/hardware/libinput.nix | 42 ++++++++-------- nixos/modules/services/x11/xserver.nix | 49 ++++++++++--------- nixos/modules/tasks/trackpoint.nix | 9 ++-- 3 files changed, 52 insertions(+), 48 deletions(-) diff --git a/nixos/modules/services/x11/hardware/libinput.nix b/nixos/modules/services/x11/hardware/libinput.nix index 9b0757153cc..439708bc47e 100644 --- a/nixos/modules/services/x11/hardware/libinput.nix +++ b/nixos/modules/services/x11/hardware/libinput.nix @@ -188,27 +188,27 @@ let cfg = config.services.xserver.libinput; }; mkX11ConfigForDevice = deviceType: matchIs: '' - Identifier "libinput ${deviceType} configuration" - MatchDriver "libinput" - MatchIs${matchIs} "${xorgBool true}" - ${optionalString (cfg.${deviceType}.dev != null) ''MatchDevicePath "${cfg.${deviceType}.dev}"''} - Option "AccelProfile" "${cfg.${deviceType}.accelProfile}" - ${optionalString (cfg.${deviceType}.accelSpeed != null) ''Option "AccelSpeed" "${cfg.${deviceType}.accelSpeed}"''} - ${optionalString (cfg.${deviceType}.buttonMapping != null) ''Option "ButtonMapping" "${cfg.${deviceType}.buttonMapping}"''} - ${optionalString (cfg.${deviceType}.calibrationMatrix != null) ''Option "CalibrationMatrix" "${cfg.${deviceType}.calibrationMatrix}"''} - ${optionalString (cfg.${deviceType}.clickMethod != null) ''Option "ClickMethod" "${cfg.${deviceType}.clickMethod}"''} - Option "LeftHanded" "${xorgBool cfg.${deviceType}.leftHanded}" - Option "MiddleEmulation" "${xorgBool cfg.${deviceType}.middleEmulation}" - Option "NaturalScrolling" "${xorgBool cfg.${deviceType}.naturalScrolling}" - ${optionalString (cfg.${deviceType}.scrollButton != null) ''Option "ScrollButton" "${toString cfg.${deviceType}.scrollButton}"''} - Option "ScrollMethod" "${cfg.${deviceType}.scrollMethod}" - Option "HorizontalScrolling" "${xorgBool cfg.${deviceType}.horizontalScrolling}" - Option "SendEventsMode" "${cfg.${deviceType}.sendEventsMode}" - Option "Tapping" "${xorgBool cfg.${deviceType}.tapping}" - Option "TappingDragLock" "${xorgBool cfg.${deviceType}.tappingDragLock}" - Option "DisableWhileTyping" "${xorgBool cfg.${deviceType}.disableWhileTyping}" - ${cfg.${deviceType}.additionalOptions} - ''; + Identifier "libinput ${deviceType} configuration" + MatchDriver "libinput" + MatchIs${matchIs} "${xorgBool true}" + ${optionalString (cfg.${deviceType}.dev != null) ''MatchDevicePath "${cfg.${deviceType}.dev}"''} + Option "AccelProfile" "${cfg.${deviceType}.accelProfile}" + ${optionalString (cfg.${deviceType}.accelSpeed != null) ''Option "AccelSpeed" "${cfg.${deviceType}.accelSpeed}"''} + ${optionalString (cfg.${deviceType}.buttonMapping != null) ''Option "ButtonMapping" "${cfg.${deviceType}.buttonMapping}"''} + ${optionalString (cfg.${deviceType}.calibrationMatrix != null) ''Option "CalibrationMatrix" "${cfg.${deviceType}.calibrationMatrix}"''} + ${optionalString (cfg.${deviceType}.clickMethod != null) ''Option "ClickMethod" "${cfg.${deviceType}.clickMethod}"''} + Option "LeftHanded" "${xorgBool cfg.${deviceType}.leftHanded}" + Option "MiddleEmulation" "${xorgBool cfg.${deviceType}.middleEmulation}" + Option "NaturalScrolling" "${xorgBool cfg.${deviceType}.naturalScrolling}" + ${optionalString (cfg.${deviceType}.scrollButton != null) ''Option "ScrollButton" "${toString cfg.${deviceType}.scrollButton}"''} + Option "ScrollMethod" "${cfg.${deviceType}.scrollMethod}" + Option "HorizontalScrolling" "${xorgBool cfg.${deviceType}.horizontalScrolling}" + Option "SendEventsMode" "${cfg.${deviceType}.sendEventsMode}" + Option "Tapping" "${xorgBool cfg.${deviceType}.tapping}" + Option "TappingDragLock" "${xorgBool cfg.${deviceType}.tappingDragLock}" + Option "DisableWhileTyping" "${xorgBool cfg.${deviceType}.disableWhileTyping}" + ${cfg.${deviceType}.additionalOptions} + ''; in { imports = diff --git a/nixos/modules/services/x11/xserver.nix b/nixos/modules/services/x11/xserver.nix index 4dde4476d2c..50482b3b54e 100644 --- a/nixos/modules/services/x11/xserver.nix +++ b/nixos/modules/services/x11/xserver.nix @@ -81,13 +81,7 @@ let monitors = forEach xrandrHeads (h: '' Option "monitor-${h.config.output}" "${h.name}" ''); - # First option is indented through the space in the config but any - # subsequent options aren't so we need to apply indentation to - # them here - monitorsIndented = if length monitors > 1 - then singleton (head monitors) ++ map (m: " " + m) (tail monitors) - else monitors; - in concatStrings monitorsIndented; + in concatStrings monitors; # Here we chain every monitor from the left to right, so we have: # m4 right of m3 right of m2 right of m1 .----.----.----.----. @@ -138,10 +132,15 @@ let echo '${cfg.filesSection}' >> $out echo 'EndSection' >> $out + echo >> $out echo "$config" >> $out ''; # */ + prefixStringLines = prefix: str: + concatMapStringsSep "\n" (line: prefix + line) (splitString "\n" str); + + indent = prefixStringLines " "; in { @@ -736,29 +735,29 @@ in Section "ServerFlags" Option "AllowMouseOpenFail" "on" Option "DontZap" "${if cfg.enableCtrlAltBackspace then "off" else "on"}" - ${cfg.serverFlagsSection} + ${indent cfg.serverFlagsSection} EndSection Section "Module" - ${cfg.moduleSection} + ${indent cfg.moduleSection} EndSection Section "Monitor" Identifier "Monitor[0]" - ${cfg.monitorSection} + ${indent cfg.monitorSection} EndSection # Additional "InputClass" sections - ${flip concatMapStrings cfg.inputClassSections (inputClassSection: '' - Section "InputClass" - ${inputClassSection} - EndSection + ${flip (concatMapStringsSep "\n") cfg.inputClassSections (inputClassSection: '' + Section "InputClass" + ${indent inputClassSection} + EndSection '')} Section "ServerLayout" Identifier "Layout[all]" - ${cfg.serverLayoutSection} + ${indent cfg.serverLayoutSection} # Reference the Screen sections for each driver. This will # cause the X server to try each in turn. ${flip concatMapStrings (filter (d: d.display) cfg.drivers) (d: '' @@ -781,9 +780,9 @@ in Identifier "Device-${driver.name}[0]" Driver "${driver.driverName or driver.name}" ${if cfg.useGlamor then ''Option "AccelMethod" "glamor"'' else ""} - ${cfg.deviceSection} - ${driver.deviceSection or ""} - ${xrandrDeviceSection} + ${indent cfg.deviceSection} + ${indent (driver.deviceSection or "")} + ${indent xrandrDeviceSection} EndSection ${optionalString driver.display '' @@ -794,18 +793,22 @@ in Monitor "Monitor[0]" ''} - ${cfg.screenSection} - ${driver.screenSection or ""} + ${indent cfg.screenSection} + ${indent (driver.screenSection or "")} ${optionalString (cfg.defaultDepth != 0) '' DefaultDepth ${toString cfg.defaultDepth} ''} ${optionalString - (driver.name != "virtualbox" && + ( + driver.name != "virtualbox" + && (cfg.resolutions != [] || cfg.extraDisplaySettings != "" || - cfg.virtualScreen != null)) + cfg.virtualScreen != null + ) + ) (let f = depth: '' @@ -813,7 +816,7 @@ in Depth ${toString depth} ${optionalString (cfg.resolutions != []) "Modes ${concatMapStrings (res: ''"${toString res.x}x${toString res.y}"'') cfg.resolutions}"} - ${cfg.extraDisplaySettings} + ${indent cfg.extraDisplaySettings} ${optionalString (cfg.virtualScreen != null) "Virtual ${toString cfg.virtualScreen.x} ${toString cfg.virtualScreen.y}"} EndSubSection diff --git a/nixos/modules/tasks/trackpoint.nix b/nixos/modules/tasks/trackpoint.nix index b154cf9f5f0..029d8a00295 100644 --- a/nixos/modules/tasks/trackpoint.nix +++ b/nixos/modules/tasks/trackpoint.nix @@ -87,9 +87,9 @@ with lib; }) (mkIf (cfg.emulateWheel) { - services.xserver.inputClassSections = - ['' - Identifier "Trackpoint Wheel Emulation" + services.xserver.inputClassSections = [ + '' + Identifier "Trackpoint Wheel Emulation" MatchProduct "${if cfg.fakeButtons then "PS/2 Generic Mouse" else "ETPS/2 Elantech TrackPoint|Elantech PS/2 TrackPoint|TPPS/2 IBM TrackPoint|DualPoint Stick|Synaptics Inc. Composite TouchPad / TrackPoint|ThinkPad USB Keyboard with TrackPoint|USB Trackpoint pointing device|Composite TouchPad / TrackPoint|${cfg.device}"}" MatchDevicePath "/dev/input/event*" Option "EmulateWheel" "true" @@ -97,7 +97,8 @@ with lib; Option "Emulate3Buttons" "false" Option "XAxisMapping" "6 7" Option "YAxisMapping" "4 5" - '']; + '' + ]; }) (mkIf cfg.fakeButtons { From 65d318033683154a9e607ab1bf3dff61cfe025d9 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Niklas=20Hamb=C3=BCchen?= Date: Thu, 17 Jun 2021 04:06:26 +0200 Subject: [PATCH 03/13] services.xorg.config: Extend docs --- nixos/modules/services/x11/xserver.nix | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/nixos/modules/services/x11/xserver.nix b/nixos/modules/services/x11/xserver.nix index 4dde4476d2c..124f3eb3132 100644 --- a/nixos/modules/services/x11/xserver.nix +++ b/nixos/modules/services/x11/xserver.nix @@ -358,6 +358,13 @@ in description = '' The contents of the configuration file of the X server (xorg.conf). + + This option is set by multiple modules, and the configs are + concatenated together. + + In Xorg configs the last config entries take precedence, + so you may want to use lib.mkAfter on this option + to override NixOS's defaults. ''; }; From 8f966a153fc45d4741bc9784a0aa486ecc79ecec Mon Sep 17 00:00:00 2001 From: "R. RyanTM" Date: Fri, 18 Jun 2021 09:41:50 +0000 Subject: [PATCH 04/13] atomicparsley: 20210124.204813.840499f -> 20210617.200601.1ac7c08 --- pkgs/tools/video/atomicparsley/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/tools/video/atomicparsley/default.nix b/pkgs/tools/video/atomicparsley/default.nix index d07d6e53429..92059699e98 100644 --- a/pkgs/tools/video/atomicparsley/default.nix +++ b/pkgs/tools/video/atomicparsley/default.nix @@ -2,13 +2,13 @@ stdenv.mkDerivation rec { pname = "atomicparsley"; - version = "20210124.204813.840499f"; + version = "20210617.200601.1ac7c08"; src = fetchFromGitHub { owner = "wez"; repo = pname; rev = version; - sha256 = "sha256-/bkfgIWlQobaiad2WD7DUUrTwfYurP7YAINaLTwBEcE="; + sha256 = "sha256-IhZe0vM41JhO8H79ZrRx4FRA4zfB6X0daC8QoE5MHmU="; }; nativeBuildInputs = [ cmake ]; From bedf7abd6a1ceb3ebd15e26aabbd769c8620fd10 Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Tue, 22 Jun 2021 14:23:29 +0200 Subject: [PATCH 05/13] ansible: 2.11.1 -> 2.11.2 --- pkgs/development/python-modules/ansible/core.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/python-modules/ansible/core.nix b/pkgs/development/python-modules/ansible/core.nix index b300771b346..45ce2b8778a 100644 --- a/pkgs/development/python-modules/ansible/core.nix +++ b/pkgs/development/python-modules/ansible/core.nix @@ -23,11 +23,11 @@ buildPythonPackage rec { pname = "ansible-core"; - version = "2.11.1"; + version = "2.11.2"; src = fetchPypi { inherit pname version; - sha256 = "sha256-fnWCepTUfRw+GTDXCPDvY3o6uaIfdXqvVd6rbp9HxoI="; + sha256 = "1syadgzn5ww5bhq9s2py4h1hkh11h7aac5b37zi8rw2xfvdc7r2s"; }; # ansible_connection is already wrapped, so don't pass it through From 10be06813dcd89516ceba01e6891a742bdcf63ef Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Tue, 22 Jun 2021 15:02:09 +0200 Subject: [PATCH 06/13] ansible_2_10: 2.10.10 -> 2.10.11 --- pkgs/development/python-modules/ansible/base.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/python-modules/ansible/base.nix b/pkgs/development/python-modules/ansible/base.nix index 99a63d69939..06f53423219 100644 --- a/pkgs/development/python-modules/ansible/base.nix +++ b/pkgs/development/python-modules/ansible/base.nix @@ -22,11 +22,11 @@ buildPythonPackage rec { pname = "ansible-base"; - version = "2.10.10"; + version = "2.10.11"; src = fetchPypi { inherit pname version; - sha256 = "046ynyk9ldw35jbyw6jp0dmms735cd5i1f046f2lis8xv27bci3p"; + sha256 = "0jr3cxqiami9k07g2kmvfp54iafbcnd1d66l8fdnaqka5bc19wdw"; }; # ansible_connection is already wrapped, so don't pass it through From e578f0f7d06ef94030d45298296d6b8b2a61b97d Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Tue, 22 Jun 2021 15:06:58 +0200 Subject: [PATCH 07/13] ansible_2_9: 2.9.22 -> 2.9.23 --- pkgs/development/python-modules/ansible/legacy.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/python-modules/ansible/legacy.nix b/pkgs/development/python-modules/ansible/legacy.nix index 174ab6dc6c4..12eed6bdb29 100644 --- a/pkgs/development/python-modules/ansible/legacy.nix +++ b/pkgs/development/python-modules/ansible/legacy.nix @@ -18,13 +18,13 @@ buildPythonPackage rec { pname = "ansible"; - version = "2.9.22"; + version = "2.9.23"; src = fetchFromGitHub { owner = "ansible"; repo = "ansible"; rev = "v${version}"; - sha256 = "0gkv59cfxzs0ahgkxmmx9sqnfb2xqr10q4yh2662nbzajmvqmfgm"; + sha256 = "0mikykpzyqpmaiczz53f71mcyc4qvahi9ckn7wgfx7sw7s2z3skk"; }; prePatch = '' From ca618d6401631cf2c82c81220c54e774b514297f Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Tue, 22 Jun 2021 16:14:07 +0200 Subject: [PATCH 08/13] ansible, ansible_2_10: internalize collections package This drops the python3Packages.ansible-collections attribute in favor of a local callPackage that overwrites the collections package per ansible version. --- pkgs/development/python-modules/ansible/base.nix | 12 +++++++++++- .../python-modules/ansible/collections.nix | 10 ++++++---- pkgs/development/python-modules/ansible/core.nix | 12 +++++++++++- pkgs/top-level/python-packages.nix | 2 -- 4 files changed, 28 insertions(+), 8 deletions(-) diff --git a/pkgs/development/python-modules/ansible/base.nix b/pkgs/development/python-modules/ansible/base.nix index 06f53423219..0a5cc01d929 100644 --- a/pkgs/development/python-modules/ansible/base.nix +++ b/pkgs/development/python-modules/ansible/base.nix @@ -1,8 +1,8 @@ { lib +, callPackage , buildPythonPackage , fetchPypi , installShellFiles -, ansible-collections , cryptography , jinja2 , junit-xml @@ -20,6 +20,12 @@ , xmltodict }: +let + ansible-collections = callPackage ./collections.nix { + version = "3.4.0"; # must be < 4.0 + sha256 = "096rbgz730njk0pg8qnc27mmz110wqrw354ca9gasb7rqg0f4d6a"; + }; +in buildPythonPackage rec { pname = "ansible-base"; version = "2.10.11"; @@ -69,6 +75,10 @@ buildPythonPackage rec { # internal import errors, missing dependencies doCheck = false; + passthru = { + collections = ansible-collections; + }; + meta = with lib; { description = "Radically simple IT automation"; homepage = "https://www.ansible.com"; diff --git a/pkgs/development/python-modules/ansible/collections.nix b/pkgs/development/python-modules/ansible/collections.nix index 9547b9a0918..05aa0b2b294 100644 --- a/pkgs/development/python-modules/ansible/collections.nix +++ b/pkgs/development/python-modules/ansible/collections.nix @@ -14,21 +14,23 @@ , xmltodict , withJunos ? false , withNetbox ? false + +, version +, sha256 }: buildPythonPackage rec { pname = "ansible"; - version = "3.4.0"; + inherit version; format = "setuptools"; src = fetchPypi { - inherit pname version; - sha256 = "096rbgz730njk0pg8qnc27mmz110wqrw354ca9gasb7rqg0f4d6a"; + inherit pname version sha256; }; postPatch = '' # make ansible-base depend on ansible-collection, not the other way around - sed -i '/ansible-base/d' setup.py + sed -Ei '/ansible-(base|core)/d' setup.py ''; propagatedBuildInputs = lib.unique ([ diff --git a/pkgs/development/python-modules/ansible/core.nix b/pkgs/development/python-modules/ansible/core.nix index 45ce2b8778a..4dd606c9adb 100644 --- a/pkgs/development/python-modules/ansible/core.nix +++ b/pkgs/development/python-modules/ansible/core.nix @@ -1,8 +1,8 @@ { lib +, callPackage , buildPythonPackage , fetchPypi , installShellFiles -, ansible-collections , cryptography , jinja2 , junit-xml @@ -21,6 +21,12 @@ , xmltodict }: +let + ansible-collections = callPackage ./collections.nix { + version = "4.1.0"; + sha256 = "0rrivq1g0vizah8zmf012lzig2xxfk5x1371k16s3nn4zfkwqqgm"; + }; +in buildPythonPackage rec { pname = "ansible-core"; version = "2.11.2"; @@ -74,6 +80,10 @@ buildPythonPackage rec { # internal import errors, missing dependencies doCheck = false; + passthru = { + collections = ansible-collections; + }; + meta = with lib; { description = "Radically simple IT automation"; homepage = "https://www.ansible.com"; diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix index c192dd10979..1fae8d16c1c 100644 --- a/pkgs/top-level/python-packages.nix +++ b/pkgs/top-level/python-packages.nix @@ -441,8 +441,6 @@ in { ansible-base = callPackage ../development/python-modules/ansible/base.nix { }; - ansible-collections = callPackage ../development/python-modules/ansible/collections.nix { }; - ansible-core = callPackage ../development/python-modules/ansible/core.nix { }; ansible-kernel = callPackage ../development/python-modules/ansible-kernel { }; From 50140f70d5cbb9d388df345c0eaf693c128f6487 Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Tue, 22 Jun 2021 20:06:11 +0200 Subject: [PATCH 09/13] python3Packages.resolvelib: 0.7.0 -> 0.7.1 --- pkgs/development/python-modules/resolvelib/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/python-modules/resolvelib/default.nix b/pkgs/development/python-modules/resolvelib/default.nix index db3ecbcc86e..a146cac392f 100644 --- a/pkgs/development/python-modules/resolvelib/default.nix +++ b/pkgs/development/python-modules/resolvelib/default.nix @@ -7,13 +7,13 @@ buildPythonPackage rec { pname = "resolvelib"; - version = "0.7.0"; + version = "0.7.1"; src = fetchFromGitHub { owner = "sarugaku"; repo = "resolvelib"; rev = version; - sha256 = "0r7cxwrfvpqz4kd7pdf8fsynzlmi6c754jd5hzd6vssc1zlyvvhx"; + sha256 = "1fqz75riagizihvf4j7wc3zjw6kmg1dd8sf49aszyml105kb33n8"; }; checkInputs = [ From c8fe353d8be0cb96e91fae004afb0b2d7b02c502 Mon Sep 17 00:00:00 2001 From: Michael Weiss Date: Tue, 22 Jun 2021 23:56:53 +0200 Subject: [PATCH 10/13] chromiumDev: 93.0.4542.2 -> 93.0.4549.3 --- .../networking/browsers/chromium/common.nix | 6 ------ .../networking/browsers/chromium/upstream-info.json | 12 ++++++------ 2 files changed, 6 insertions(+), 12 deletions(-) diff --git a/pkgs/applications/networking/browsers/chromium/common.nix b/pkgs/applications/networking/browsers/chromium/common.nix index d036f086b03..18565f31a2f 100644 --- a/pkgs/applications/networking/browsers/chromium/common.nix +++ b/pkgs/applications/networking/browsers/chromium/common.nix @@ -175,12 +175,6 @@ let sha256 = "1bxdhxmiy6h4acq26lq43x2mxx6rawmfmlgsh5j7w8kyhkw5af0c"; revert = true; }) - # To fix building from a release tarball (which we do): - (githubPatch { - # Revert back to generating chromium_git_revision.h via version.py - commit = "bd524d08f8465364d12d32a84fd1aa983aecc502"; - sha256 = "1jsxidg5jzwkrcpx3lylx4gyg56zjyd7sc957kaaqqc853bn83b4"; - }) ]; postPatch = '' diff --git a/pkgs/applications/networking/browsers/chromium/upstream-info.json b/pkgs/applications/networking/browsers/chromium/upstream-info.json index e904409a178..7e20a17d6e0 100644 --- a/pkgs/applications/networking/browsers/chromium/upstream-info.json +++ b/pkgs/applications/networking/browsers/chromium/upstream-info.json @@ -31,15 +31,15 @@ } }, "dev": { - "version": "93.0.4542.2", - "sha256": "0sfyi52kaxg5mllcvn61285fjnj72vglv9fjf36ri93v6gh34rgw", - "sha256bin64": "0hk31b9nk834gykv977dv7f1hyl7jp527bx5ldxhwcy27333h1hr", + "version": "93.0.4549.3", + "sha256": "0bkr67n1d75ayd1d9sa57c99j85r83gadzfs8iw7kwiha9g0mjgp", + "sha256bin64": "1hac6m668nrdzvfqx3vyc74pnx8lf973m1jxnm3cfy83g7wynphz", "deps": { "gn": { - "version": "2021-06-11", + "version": "2021-06-18", "url": "https://gn.googlesource.com/gn", - "rev": "e0c476ffc83dc10897cb90b45c03ae2539352c5c", - "sha256": "01p5w57kksihzg9nb5096a74cw2rp8zzgdjcjm1pgrqvd1mxpjm4" + "rev": "170c2dba1e0c0299fe8c6a441caf2f2352a42ae0", + "sha256": "1ylx8a5fxq7aciqs0mx7fld763sqkqn39lb9k951w6gksm15lrn3" } } }, From 150a2f0b2eed02fd3e8a22047245870600071160 Mon Sep 17 00:00:00 2001 From: Michael Weiss Date: Wed, 23 Jun 2021 00:10:49 +0200 Subject: [PATCH 11/13] signal-desktop: 5.5.0 -> 5.6.1 --- .../networking/instant-messengers/signal-desktop/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix b/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix index 4217c9ec60a..708b5713864 100644 --- a/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix +++ b/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix @@ -28,7 +28,7 @@ let else ""); in stdenv.mkDerivation rec { pname = "signal-desktop"; - version = "5.5.0"; # Please backport all updates to the stable channel. + version = "5.6.1"; # Please backport all updates to the stable channel. # All releases have a limited lifetime and "expire" 90 days after the release. # When releases "expire" the application becomes unusable until an update is # applied. The expiration date for the current release can be extracted with: @@ -38,7 +38,7 @@ in stdenv.mkDerivation rec { src = fetchurl { url = "https://updates.signal.org/desktop/apt/pool/main/s/signal-desktop/signal-desktop_${version}_amd64.deb"; - sha256 = "0l12hwwv0ks2hgp1xc5nmn5rcqzwxdpjqhwysix550m26bz4jczp"; + sha256 = "00q99r3p49fa5j54h1faxrzxfgz1pkx86b1jg3vi94hddlw3xm9c"; }; nativeBuildInputs = [ From a48fea4c5e53bace66f1730877e7b16178e5f7ea Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Niklas=20Hamb=C3=BCchen?= Date: Sun, 11 Oct 2020 17:27:49 +0200 Subject: [PATCH 12/13] sshd service: Default to INFO logLevel (upstream default). The previous justification for using "VERBOSE" is incorrect, because OpenSSH does use level INFO to log "which key was used to log in" for sccessful logins, see: https://github.com/openssh/openssh-portable/blob/6247812c76f70b2245f3c23f5074665b3d436cae/auth.c#L323-L328 Also update description to the wording of the sshd_config man page. `fail2ban` needs, sshd to be "VERBOSE" to work well, thus the `fail2ban` module sets it to "VERBOSE" if enabled. The docs are updated accordingly. --- .../from_md/release-notes/rl-2111.section.xml | 23 +++++++++++++++++-- .../manual/release-notes/rl-2111.section.md | 4 ++++ .../modules/services/networking/ssh/sshd.nix | 7 ++---- nixos/modules/services/security/fail2ban.nix | 19 ++++++++++++++- 4 files changed, 45 insertions(+), 8 deletions(-) diff --git a/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml b/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml index 8a3c982fcb9..08b1d779e75 100644 --- a/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml +++ b/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml @@ -321,7 +321,26 @@
Other Notable Changes - - + + + + The setting + services.openssh.logLevel + "VERBOSE" + "INFO". This brings NixOS in line + with upstream and other Linux distributions, and reduces log + spam on servers due to bruteforcing botnets. + + + However, if + services.fail2ban.enable + is true, the fail2ban + will override the verbosity to + "VERBOSE", so that + fail2ban can observe the failed login + attempts from the SSH logs. + + +
diff --git a/nixos/doc/manual/release-notes/rl-2111.section.md b/nixos/doc/manual/release-notes/rl-2111.section.md index f7578c8ddee..c19b46c5def 100644 --- a/nixos/doc/manual/release-notes/rl-2111.section.md +++ b/nixos/doc/manual/release-notes/rl-2111.section.md @@ -79,3 +79,7 @@ In addition to numerous new and upgraded packages, this release has the followin old 2.7.7 version. ## Other Notable Changes {#sec-release-21.11-notable-changes} + +- The setting [`services.openssh.logLevel`](options.html#opt-services.openssh.logLevel) `"VERBOSE"` `"INFO"`. This brings NixOS in line with upstream and other Linux distributions, and reduces log spam on servers due to bruteforcing botnets. + + However, if [`services.fail2ban.enable`](options.html#opt-services.fail2ban.enable) is `true`, the `fail2ban` will override the verbosity to `"VERBOSE"`, so that `fail2ban` can observe the failed login attempts from the SSH logs. diff --git a/nixos/modules/services/networking/ssh/sshd.nix b/nixos/modules/services/networking/ssh/sshd.nix index 227dfe834b2..91caa2ccb42 100644 --- a/nixos/modules/services/networking/ssh/sshd.nix +++ b/nixos/modules/services/networking/ssh/sshd.nix @@ -351,15 +351,12 @@ in logLevel = mkOption { type = types.enum [ "QUIET" "FATAL" "ERROR" "INFO" "VERBOSE" "DEBUG" "DEBUG1" "DEBUG2" "DEBUG3" ]; - default = "VERBOSE"; + default = "INFO"; # upstream default description = '' Gives the verbosity level that is used when logging messages from sshd(8). The possible values are: - QUIET, FATAL, ERROR, INFO, VERBOSE, DEBUG, DEBUG1, DEBUG2, and DEBUG3. The default is VERBOSE. DEBUG and DEBUG1 + QUIET, FATAL, ERROR, INFO, VERBOSE, DEBUG, DEBUG1, DEBUG2, and DEBUG3. The default is INFO. DEBUG and DEBUG1 are equivalent. DEBUG2 and DEBUG3 each specify higher levels of debugging output. Logging with a DEBUG level violates the privacy of users and is not recommended. - - LogLevel VERBOSE logs user's key fingerprint on login. - Needed to have a clear audit track of which key was used to log in. ''; }; diff --git a/nixos/modules/services/security/fail2ban.nix b/nixos/modules/services/security/fail2ban.nix index 07702bfb9d0..499d3466750 100644 --- a/nixos/modules/services/security/fail2ban.nix +++ b/nixos/modules/services/security/fail2ban.nix @@ -45,7 +45,12 @@ in enable = mkOption { default = false; type = types.bool; - description = "Whether to enable the fail2ban service."; + description = '' + Whether to enable the fail2ban service. + + See the documentation of + for what jails are enabled by default. + ''; }; package = mkOption { @@ -221,6 +226,15 @@ in defined in /etc/fail2ban/action.d, while filters are defined in /etc/fail2ban/filter.d. + + NixOS comes with a default sshd jail; + for it to work well, + should be set to + "VERBOSE" or higher so that fail2ban + can observe failed login attempts. + This module sets it to "VERBOSE" if + not set otherwise, so enabling fail2ban can make SSH logs + more verbose. ''; }; @@ -313,6 +327,9 @@ in banaction_allports = ${cfg.banaction-allports} ''; # Block SSH if there are too many failing connection attempts. + # Benefits from verbose sshd logging to observe failed login attempts, + # so we set that here unless the user overrode it. + services.openssh.logLevel = lib.mkDefault "VERBOSE"; services.fail2ban.jails.sshd = mkDefault '' enabled = true port = ${concatMapStringsSep "," (p: toString p) config.services.openssh.ports} From 7e3d8fc66ba295cd2278fe231794c75710e86df5 Mon Sep 17 00:00:00 2001 From: "R. RyanTM" Date: Sun, 20 Jun 2021 15:22:25 +0000 Subject: [PATCH 13/13] byacc: 20210520 -> 20210619 --- pkgs/development/tools/parsing/byacc/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/tools/parsing/byacc/default.nix b/pkgs/development/tools/parsing/byacc/default.nix index 50e8101c17a..f71b28d7e12 100644 --- a/pkgs/development/tools/parsing/byacc/default.nix +++ b/pkgs/development/tools/parsing/byacc/default.nix @@ -2,14 +2,14 @@ stdenv.mkDerivation rec { pname = "byacc"; - version = "20210520"; + version = "20210619"; src = fetchurl { urls = [ "ftp://ftp.invisible-island.net/byacc/${pname}-${version}.tgz" "https://invisible-mirror.net/archives/byacc/${pname}-${version}.tgz" ]; - sha256 = "sha256-19MdrnLLlzSC73+XVgmuQBzMEu4/sWi2emlSbGCv5D4="; + sha256 = "sha256-rN1ggNz5NXMqCOyOjEwWHGZs1W2MSQc5xtu2JnpJjA4="; }; configureFlags = [