Commit graph

6180 commits

Author SHA1 Message Date
Thomas Tuegel 1b0d9e9ae6 Merge pull request #23819 from ttuegel/freetype
FreeType 2.7.1 and Fontconfig defaults
2017-03-20 11:43:50 -05:00
Will Dietz cb73cb9e62 neo4j service: neo4j-wrapper is deprecated, merge into neo4j.conf 2017-03-19 16:56:53 -05:00
Will Dietz 515fc22263 neo4j service: fix package installed into env to match running service 2017-03-19 16:56:52 -05:00
Michael Walker b29bc8d41c vsftpd: Expose the no_anon_password flag. 2017-03-19 01:53:29 +00:00
Daiderd Jordan a48df6fba6 Merge pull request #22508 from matthewbauer/remove-emacs24macport
emacs24macport: remove
2017-03-18 22:19:20 +01:00
Vladimír Čunát 742b120ddc
Merge branch 'master' into staging
Nontrivial rebuilds from master, again :-/
2017-03-18 11:00:31 +01:00
Will Dietz 63f1a14ae5 neo4j service: increase file limit, per warning emitted at startup (#23961) 2017-03-18 01:03:09 +01:00
Joachim F 9a976c09ba Merge pull request #23963 from dtzWill/feature/irkerd
irker: init at 2017-02-12
2017-03-18 00:35:32 +01:00
Franz Pletz 9536169074
nixos/treewide: remove boolean examples for options
They contain no useful information and increase the length of the
autogenerated options documentation.

See discussion in #18816.
2017-03-17 23:36:19 +01:00
Thomas Tuegel a6fce585e4
nixos/fontconfig: set rendering defaults, not overrides 2017-03-17 13:50:10 -05:00
Thomas Tuegel 354ea69ae4
fontconfig-penultimate: init at 0.2
Also provides a NixOS module.
2017-03-17 13:50:05 -05:00
Joachim F 01f8e2161c Merge pull request #23962 from oxij/nixos/tor-sec
nixos: tor: usability and security fixes
2017-03-17 16:14:41 +01:00
Pascal Bach 3728143cbc prometheus-unifi-exporter: init at 0.4.0 2017-03-17 15:41:22 +01:00
Will Dietz 2807d75dca irkerd service: init 2017-03-17 09:16:32 -05:00
Léo Gaspard 66e54f25a1 dhparams module: condition on enable option (#23661)
Hence, the init/cleanup service only runs when the dhparams module is enabled.
2017-03-17 01:56:13 +01:00
Jan Malakhovski a04782581a nixos: torify: disable by default, add some documentation as of why
This `tsocks` wrapper leaks DNS requests to clearnet, meanwhile Tor comes with
`torsocks` which doesn't.

Previous commits to this file state that all of this still useful somehow.
Assuming that it's true, at least let's not confuse users with two different tools
and don't clash with the `tsocks` binary from nixpkgs by disabling this by default.
2017-03-16 21:06:12 +00:00
Jan Malakhovski 6d25f77a64 nixos: tor: add enableGeoIP 2017-03-16 21:06:12 +00:00
Daiderd Jordan 00ed0f792e Merge pull request #22897 from timor/couchdb-2.0.0
couchdb: add support for version 2.0.0
2017-03-16 22:03:32 +01:00
Profpatsch 6da60bb101 modules/mlmmj: fix a typo in listaddress folder 2017-03-16 18:47:11 +01:00
Graham Christensen e4c0613470 Merge pull request #23674 from c0bw3b/sec/jboss7
JBoss AS: list known vulnerability
2017-03-15 17:33:27 -04:00
Vladimír Čunát e99bc64552
Merge branch 'master' into staging
More larger rebuilds from master, unfortunately.
2017-03-15 19:09:56 +01:00
Pascal Bach a8cca7037e prometheus-fritzbox-exporter: init at 1.0 2017-03-15 17:22:36 +01:00
Volth bcc4c261be lxc: ensure directory /var/lib/lxc/rootfs 2017-03-15 12:42:27 +01:00
Bart Brouns bb3ef8a95c physlock: fix issue 21935 2017-03-15 11:47:02 +01:00
Benjamin Staffin 98e4c5dd45 Merge pull request #23861 from benley/nixos-manual-launcher
nixos: Add a menu launcher for the NixOS manual
2017-03-15 04:37:16 -04:00
Joachim Fasting f122f0147b
nixos/dnscrypt-proxy: log resolver list verification failure
Otherwise, the service unit just fails for no discernable
reason.  Verifcation failure is bad so it ought to be easily
discoverable.
2017-03-15 01:13:08 +01:00
Joachim Fasting de15e7894b
nixos/dnscrypt-proxy: get resolver list from github
The list has disappeared from its ordinary location at
download.dnscrypt.org.
2017-03-15 01:12:46 +01:00
Joachim Fasting 472002f216
nixos/dnscrypt-proxy: remove the resolverList option
This option was initially added to make it easier to use an
up-to-date list, but now that we always use an up-to-date list
from upstream, there's no point to the option.

From now on, you can either use a resolver listed by dnscrypt
upstream or a custom resolver.
2017-03-15 01:12:43 +01:00
Joachim Fasting 540740598e
nixos/dnscrypt-proxy: add example of how to use the cache plugin 2017-03-15 01:12:39 +01:00
Joachim Fasting 719813caf6
nixos/dnscrypt-proxy: replace unimportant options with extraArgs
Removes tcpOnly and ephemeralKeys: reifying them as nixos
options adds little beyond improved discoverability.  Until
17.09 we'll automatically translate these options into extraArgs
for convenience.

Unless reifying an option is necessary for conditional
computation or greatly simplifies configuration/reduces risk of
misconfiguration, it should go into extraArgs instead.
2017-03-15 01:12:37 +01:00
Joachim Fasting 9325c3a616
nixos/dnscrypt-proxy: simplify module logic related to apparmor 2017-03-15 01:12:35 +01:00
Joachim Fasting 83052ef9db
nixos/dnscrypt-proxy: support reload 2017-03-15 01:12:29 +01:00
Franz Pletz 91744f31b0 Merge pull request #23623 from mayflower/fix/users-create-home
nixos/users-groups: chown home on createHome
2017-03-14 23:07:57 +01:00
Bas van Dijk 308c09d41f wordpress: security upgrade: 4.7.2 -> 4.7.3 & other improvements (#23837)
* Moved the wordpress sources derivation to the attribute pkgs.wordpress. This
  makes it easier to override.

* Also introduce the `package` option for the wordpress virtual host config which
  defaults to pkgs.wordpress.

* Also fixed the test in nixos/tests/wordpress.nix.
2017-03-14 16:11:51 +01:00
Benjamin Staffin 638e1b8243 nixos: Add a menu launcher for the NixOS manual 2017-03-14 06:04:43 -04:00
Peter Hoeg 80750f459c Merge pull request #17303 from peterhoeg/iio
iio-sensor-proxy: init at 2.2 and nixos module
2017-03-14 11:16:09 +08:00
Tuomas Tynkkynen aba0b45b86 Merge remote-tracking branch 'upstream/master' into staging
Conflicts:
      pkgs/development/libraries/qt-5/5.7/qtbase/default.nix
2017-03-14 00:49:22 +02:00
Renaud 72619a86c9 JBoss AS: list known vulnerability
CVE-2015-7501

Warning in JBoss module
2017-03-13 18:45:19 +01:00
Thomas Tuegel 65592837b6
freetype: 2.6.5 -> 2.7.1
The Infinality bytecode interpreter is removed in favor of the new v40 TrueType
interpreter. In the past, the Infinality interpreter provided support for
ClearType-style hinting instructions while the default interpreter (then v35)
provided support only for original TrueType-style instructions. The v40
interpreter corrects this deficiency, so the Infinality interpreter is no longer
necessary.

To understand why the Infinality interpreter is no longer necessary, we should
understand how ClearType differs from TrueType and how the v40 interpreter
works. The following is a summary of information available on the FreeType
website [1] mixed with my own editorializing.

TrueType instructions use horizontal and vertical hints to improve glyph
rendering. Before TrueType, fonts were only vertically hinted; horizontal hints
improved rendering by snapping stems to pixel boundaries. Horizontal hinting is
a risk because it can significantly distort glyph shapes and kerning. Extensive
testing at different resolutions is needed to perfect the TrueType
hints. Microsoft invested significant effort to do this with its "Core fonts for
the Web" project, but few other typefaces have seen this level of attention.

With the advent of subpixel rendering, the effective horizontal resolution of
most displays increased significantly. ClearType eschews horizontal hinting in
favor of horizontal supersampling. Most fonts are designed for the Microsoft
bytecode interpreter, which implements a compatibility mode with
TrueType-style (horizontal and vertical) instructions. However, applying the
full horizontal hints to subpixel-rendered fonts leads to color fringes and
inconsistent stem widths. The Infinality interpreter implements several
techniques to mitigate these problems, going so far as to embed font- and
glyph-specific hacks in the interpreter. On the other hand, the v40 interpreter
ignores the horizontal hinting instructions so that glyphs render as they are
intended to on the Microsoft interpreter. Without the horizontal hints, the
problems of glyph and kerning distortion, color fringes, and inconsistent stem
widths--the problems the Infinality interpreter was created to solve--simply
don't occur in the first place.

There are also security concerns which motivate removing the Infinality patches.
Although there is an updated version of the Infinality interpreter for FreeType
2.7, the lack of a consistent upstream maintainer is a security concern. The
interpreter is a Turing-complete virtual machine which has had security
vulnerabilities in the past. While the default interpreter is used in billions
of devices and is maintained by an active developer, the Infinality interpreter
is neither scrutinized nor maintained. We will probably never know if there are
defects in the Infinality interpreter, and if they were discovered they would
likely never be fixed. I do not think that is an acceptable situtation for a
core library like FreeType.

Dropping the Infinality patches means that font rendering will be less
customizable. I think this is an acceptable trade-off. The Infinality
interpreter made many compromises to mitigate the problems with horizontal
hinting; the main purpose of customization is to tailor these compromises to the
user's preferences. The new interpreter does not have to make these compromises
because it renders fonts as their designers intended, so this level of
customization is not necessary.

The Infinality-associated patches are also removed from cairo. These patches
only set the default rendering options in case they aren't set though
Fontconfig. On NixOS, the rendering options are always set in Fontconfig, so
these patches never actually did anything for us!

The Fontconfig test suite is patched to account for a quirk in the way PCF fonts
are named.

The fontconfig option `hintstyle` is no longer configurable in NixOS. This
option selects the TrueType interpreter; the v40 interpreter is `hintslight` and
the older v35 interpreter is `hintmedium` or `hintfull` (which have actually
always been the same thing). The setting may still be changed through the
`localConf` option or by creating a user Fontconfig file.

Users with HiDPI displays should probably disable hinting and antialiasing: at
best they have no visible effect.

The fontconfig-ultimate settings are still available in NixOS, but they are no
longer the default. They still work, but their main purpose is to set rendering
quirks which are no longer necessary and may actually be
detrimental (e.g. setting `hintfull` for some fonts). Also, the vast array of
font substitutions provided is not an appropriate default; the default setting
should be to give the user the font they asked for.

[1]. https://www.freetype.org/freetype2/docs/subpixel-hinting.html
2017-03-12 17:31:33 -05:00
Jörg Thalheim 9e6fe2e4f2 Merge pull request #23765 from benley/ykpers-duplicate
ykpers: consolidate into yubikey-personalization
2017-03-12 22:26:32 +01:00
Vladimír Čunát 50fadc8b18
cups: split the $lib output
This saves > 10 MB from most closures.
Printing test succeeds on x86_64-linux.
2017-03-12 18:36:30 +01:00
Rodney Lorrimar f488b1811b
pumpio service: don't keep secrets in nix store
Added extra config options to allow reading passwords from file rather
than the world-readable nix store.

The full config.json file is created at service startup.

Relevant to #18881
2017-03-12 16:01:02 +01:00
Rodney Lorrimar f1a1490135
pumpio service: adjust upload directory config for 3.0.0
These changes are backwards compatible.
2017-03-12 16:00:57 +01:00
zetok 4ca17dd6c0 gresecurity docs: fix incorrect option (#23789) 2017-03-12 15:05:14 +01:00
Benjamin Staffin f474f82860 ykpers: consolidate into yubikey-personalization
Looks like this accidentally got packaged twice.
2017-03-11 16:23:00 -05:00
Franz Pletz 323d0fdd5a
phpfpm module: set correct nixos sendmail path 2017-03-11 09:39:12 +01:00
Daiderd Jordan b52af49d36
virtualisation-xen: fix defaultText interpolation 2017-03-11 00:09:22 +01:00
Joachim Fasting bb6361b81a
nixos/dnscrypt-proxy: grant daemon access to load plugins 2017-03-10 18:54:54 +01:00
Joachim Fasting 5279ec111f
nixos/dnscrypt-proxy docs: reword section on forwarding
Newer versions of DNSCrypt proxy *can* cache lookups (via
plugin); make the wording more neutral wrt. why one might want
to run the proxy in a forwarding setup.
2017-03-10 18:54:52 +01:00
Joachim Fasting c0a8a9205b
nixos/dnscrypt-proxy: inline option renamings
In an effort to make the module more self-contained.
2017-03-10 18:54:51 +01:00