Commit graph

250207 commits

Author SHA1 Message Date
Andreas Rammhold 83f0bccc89 stdenv: add -frandom-seed to NIX_CFLAGS_COMPILE for reproducibility
This adds -frandom-seed to each compiler invocation in stdenv. The
object here is to make the compierl invocations produce the same output
every time they are called (for the same derivation). When the
-frandom-seed option is not set the compiler will use a combination of
random numbers (in GCC's case from /dev/urandom) and the durrent time to
produce a "random" input per file. This can (among other things) lead to
different ordering of symbols in the produced object files.

For reason of reproducibility we prefer having the same derivation
produce the exact same outputs. This is not a silver bullet but one way
to tame the compiler.
2020-11-01 19:40:12 +01:00
Jörg Thalheim b7ef4d7dda
Merge pull request #102359 from mweinelt/openldap
[staging] openldap: add patch to fix unauthenticated nullptr dereference in slapd
2020-11-01 18:43:32 +01:00
Martin Weinelt 307abd9eae openldap: add patch to fix unauthenticated nullptr dereference in slapd
This vulnerability does not have a CVE yet.

https://security-tracker.debian.org/tracker/TEMP-0000000-DD4835
https://bugs.openldap.org/show_bug.cgi?id=9370
2020-11-01 18:14:56 +01:00
Florian Klink d64f4d03d5
Merge pull request #101886 from flokli/systemd-more-optional
systemd: introduce more options for a more minimal build
2020-11-01 14:29:45 +01:00
Andreas Rammhold 5219a3ade1 rsync: disable the bundled zlib explicitly
We've been providing zlib as a buildInput for some time now but rsync
still builds (& links) it's own copy of zlib unless we disable it
explicitly. This cuts down on compilation time but otherwise shouldn't
have any side effects.
2020-11-01 12:51:02 +01:00
Frederik Rietdijk 409ca6f1f9 Merge staging-next into staging 2020-11-01 11:06:35 +01:00
Frederik Rietdijk fe9f55907e Merge master into staging-next 2020-11-01 11:06:08 +01:00
Frederik Rietdijk 54f7498601
Merge pull request #101369 from doronbehar/pkg/kdeApplications/qt515
kdeApplications: Use latest qt515 by default
2020-11-01 11:05:05 +01:00
Pavol Rusnak b9222f5158 python3Packages.hidapi: 0.9.0.post3 -> 0.10.0 2020-11-01 10:59:20 +01:00
Pavol Rusnak cbe6c27d22 hidapi: 0.9.0 -> 0.10.0 2020-11-01 10:59:20 +01:00
Alyssa Ross 7bf3d77ed6 groff: set "operating system" for mdoc pages
Prior to this change, man pages from Nixpkgs written using the mdoc(7)
macros would start like this:

    NC(1)                   BSD General Commands Manual                   NC(1)

and end like this:

    BSD                          December 27, 2018                          BSD

No matter what operating system they were run on.

It's far more accurate to say "Nixpkgs General Commands Manual", so
with this patch we configure groff to do just that.  The variable is
called "operating-system", but I think it makes more sense to say
"Nixpkgs" than "NixOS" or something, because packages from Nixpkgs can
run on lots of operating systems, and the important thing is that the
package is from Nixpkgs.
2020-11-01 10:58:48 +01:00
TredwellGit d1d536cc07 openblas: 0.3.10 -> 0.3.12
https://github.com/xianyi/OpenBLAS/releases/tag/v0.3.11
https://github.com/xianyi/OpenBLAS/releases/tag/v0.3.12
2020-11-01 10:58:02 +01:00
Michele Guerini Rocco 93e0a06de4
Merge pull request #102102 from rnhmjoj/cshatag
cshatag: init at 2019-12-03
2020-11-01 10:12:59 +01:00
Frederik Rietdijk 83dde6c52c Merge staging-next into staging 2020-11-01 10:11:12 +01:00
Frederik Rietdijk 7a8d5dc8a6 Merge master into staging-next 2020-11-01 10:10:47 +01:00
Gabriel Ebner f183291ead
Merge pull request #99421 from prusnak/electron
Electron updates
2020-11-01 10:08:48 +01:00
TredwellGit d18c016c2a jbig2dec: 0.18 -> 0.19
https://github.com/ArtifexSoftware/jbig2dec/blob/0.19/CHANGES
2020-11-01 10:04:56 +01:00
Jan Tojnar 6b76a2d004 ghostscript: clean up
* Do not use pkgconfig alias.
* Move version & hash inline.
2020-11-01 10:04:30 +01:00
TredwellGit 2029ca3791 ghostscript: 9.52 -> 9.53.3
https://www.ghostscript.com/doc/9.53.3/News.htm
2020-11-01 10:04:08 +01:00
Peter Hoeg 0444c91a3b pev: 2018-07-22 -> 2020-05-23 2020-11-01 15:34:24 +08:00
Mario Rodas 26d3fbf215
Merge pull request #102310 from r-ryantm/auto-update/git-gone
gitAndTools.git-gone: 0.3.6 -> 0.3.7
2020-10-31 23:00:45 -05:00
Mario Rodas 76fdf69296
Merge pull request #102303 from r-ryantm/auto-update/git-trim
gitAndTools.git-trim: 0.4.0 -> 0.4.2
2020-10-31 22:11:55 -05:00
R. RyanTM 5535343769 gitAndTools.git-gone: 0.3.6 -> 0.3.7 2020-11-01 02:35:57 +00:00
R. RyanTM 0c77c15642 gitAndTools.git-trim: 0.4.0 -> 0.4.2 2020-11-01 01:10:34 +00:00
Austin Seipp b57adad085
Merge pull request #101673 from r-ryantm/auto-update/libndctl
libndctl: 69 -> 70.1
2020-10-31 19:35:32 -05:00
Austin Seipp 4e57249fc3
Merge pull request #102185 from bbigras/chrony
chrony: 3.5.1 -> 4.0
2020-10-31 19:32:29 -05:00
Jan Tojnar 2785a1e08e
Merge pull request #102122 from SuperSandro2000/libthai 2020-11-01 01:25:51 +01:00
Austin Seipp c1a8104f11
Merge pull request #102026 from r-ryantm/auto-update/checksec
checksec: 2.2.3 -> 2.4.0
2020-10-31 19:22:14 -05:00
Austin Seipp 09ff423bef
Merge pull request #102030 from r-ryantm/auto-update/cloudflared
cloudflared: 2020.10.0 -> 2020.10.2
2020-10-31 19:21:45 -05:00
Ryan Mulligan d7b437ab67
Merge pull request #102095 from r-ryantm/auto-update/armadillo
armadillo: 10.1.0 -> 10.1.1
2020-10-31 17:10:10 -07:00
Ryan Mulligan 3099c681bf
Merge pull request #102279 from r-ryantm/auto-update/ffsend
ffsend: 0.2.65 -> 0.2.68
2020-10-31 17:08:33 -07:00
Mario Rodas 705b159498
Merge pull request #102180 from cole-h/zoxide
zoxide: 0.4.3 -> 0.5.0
2020-10-31 18:31:41 -05:00
Sandro Jäckel dfe9e0e458
pango: build with libthai 2020-11-01 00:13:38 +01:00
Sandro Jäckel 0b884cec25
ibus-engines.libthai: init at 0.1.4 2020-11-01 00:13:37 +01:00
Sandro Jäckel e0e37f4261
libthai: init at 0.1.28 2020-11-01 00:13:37 +01:00
Sandro Jäckel 6b72fd5c3b
libdatrie: init at 0.2.12 2020-11-01 00:13:36 +01:00
zimbatm 6cc483b6c2
autogen: make reproducible (#102280) 2020-10-31 23:27:12 +01:00
R. RyanTM ddefc77782 ffsend: 0.2.65 -> 0.2.68 2020-10-31 21:38:01 +00:00
zimbatm c409f69480
pythonPackages.pip: make reproducible (#102222)
The previous attempt wasn't covering all of the bases. It relied on
invoking that pip-install-hook, and didn't apply to pip itself.

The core issue is that the generated .pyc files embed some of the
temporary paths, which are randomly generated. See
https://r13y.com/diff/bf8c3ca3148ebff9ecf41f294cc60b9f209c006d49699e356969ff32d736f1c6-8806a7cca91fdd300e48736bfcd57c4d0b54c1cc2fd61609f35143170862b59c.html

In this new attempt, the approach is to patch the TempFile
implementation directly, so that it creates stable temporary
directories. We also assume that if SOURCE_DATE_EPOCH is set, we are in
a scenario where reproducible builds are desirable and enter that
branch.

See also https://github.com/pypa/pip/issues/7808
2020-10-31 21:24:36 +01:00
Andreas Rammhold fd0b3839b2
Merge pull request #102249 from rnhmjoj/firefox-audio
nixos/tests/firefox: add audio subtest
2020-10-31 21:23:10 +01:00
zimbatm 7d834eff6c
nixos/manual: make reproducible (#102234) 2020-10-31 21:18:16 +01:00
zimbatm 8f2be9ac36
nss: make reproducible (#102156)
According to
c1fad130dc/build.sh (l129)
the FIPS mode is not enabled by default. Yet we generate the .chk files
that are only meant to be used for that mode. I have a sense that those
have been cargo-culted around.

Adding FIPS is still possible but you have to explictily build the lib
with `pkgs.nss.override { enableFIPS = true; }`

More info on what FIPS is:
https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_Tech_Notes/nss_tech_note6

Other distros wrangling with the same issue:
https://bugzilla.opensuse.org/show_bug.cgi?id=1081723
2020-10-31 21:17:26 +01:00
rnhmjoj f7904ca45b
nixos/tests/firefox: add audio subtest 2020-10-31 20:53:15 +01:00
Philipp Kern ec6b0950ef
nixos/prometheus: Support environmentFile (#97933)
For the same reason Alertmanager supports environmentFile to pass
secrets along, it is useful to support the same for Prometheus'
configuration to store bearer tokens outside the Nix store.
2020-10-31 20:52:13 +01:00
WORLDofPEACE eaaf9254aa
Merge pull request #100520 from hyperfekt/patch-3
nixos-install: add passthrough --keep-going flag
2020-10-31 15:19:51 -04:00
Vincent Laporte 39dbc77b99 ocamlPackages.hex: 1.3.0 → 1.4.0 2020-10-31 20:04:15 +01:00
Vincent Laporte 6f8621dea6 ocamlPackages.fiat-p256: use Dune 2 2020-10-31 20:04:15 +01:00
Matthieu Coudron 36ac62c6d7
Merge pull request #102231 from teto/neovim_fix
neovim: revert change to extraMakeWrapperArgs
2020-10-31 19:36:49 +01:00
Michele Guerini Rocco f93de9dea3
Merge pull request #102170 from rnhmjoj/bdf2psf
bdf2psf: 1.197 -> 1.198
2020-10-31 18:53:08 +01:00
Maximilian Bosch b18d189ab2
Merge pull request #102177 from Ma27/bump-matrix-synapse
matrix-synapse: 1.22.0 -> 1.22.1
2020-10-31 18:47:28 +01:00