Question: Describe the bug doesn't run on Darwin, due to some Perl / shebang errors. To Reproduce Steps to reproduce the behavior: Darwin, run the only produced binary , ie. following output is produced: Expected behavior The executable should output its help text when run without arguments: Additional context I managed to get it running using a wrapper script that runs . Notify maintainers Metadata Maintainer information:

rm $out/share/man/man1/dh_strip_nondeterminism.1.gz ''; <del> meta = with lib; { </del> <ins> postInstall = stdenv.lib.optionalString stdenv.isDarwin '' shortenPerlShebang $out/bin/strip-nondeterminism ''; meta = with stdenv.lib; { </ins> description = "A Perl module for stripping bits of non-deterministic information"; homepage = "https://reproducible-builds.org/"; license = licenses.gpl3;


Question:
Describe the bug Bisect indicates as the likely point of breakage. cc To Reproduce
I can't reproduce the error hydra has, it fails earlier for me on current master:
We've had a staging-next merge in the meantime; this symlink problem was fixed by .
Local build works with my changes in . Should this be tested via ofborg? If so how do I do this (can I even do this)?

services.dhcpd4 = { enable = true; interfaces = map (n: "eth${toString n}") vlanIfs; <del> extraConfig = '' '' + flip concatMapStrings vlanIfs (n: '' </del> <ins> extraConfig = flip concatMapStrings vlanIfs (n: '' </ins> subnet 192.168.${toString n}.0 netmask 255.255.255.0 { option routers 192.168.${toString n}.1; <ins> range 192.168.${toString n}.2 192.168.${toString n}.254; </ins> } '') ; <del> machines = lib.flip map vlanIfs (vlan: </del> <ins> machines = flip map vlanIfs (vlan: </ins> { hostName = "client${toString vlan}"; ethernetAddress = qemu-flags.qemuNicMac vlan 1;


Question:
Describe the bug Recently I noticed that the Electron applications I commonly used ceased to be able to connect to the internet. Spotify, Discord, Slack cannot connect anymore. To Reproduce Steps to reproduce the behavior: latest nixpkgs channel Slack, Spotify or Discord cannot connect to their respective servers Expected behavior They should be able to connect to the internet. Metadata system: host os: multi-user?: sandbox: version: channels(root): nixpkgs:
Got a similar issue, but Discord and Spotify works. For me it's slack-specific. EDIT: Nevermind looks like I am getting only slack from unstable channel :facepalm:
I don’t think it is Electron specific. I see the same issue with qutebrowser
I confirm I can reproduce it with . Might be WebKit related ?
I have issues with qutebrowser aswell, with every https:// site, http:// works. Getting errors like this: But my qutebrowser uses QtWebEngine, not WebKit afaik. I've rolled back so can't double check.
I've been able to track back the issue to the commit Before this commit it works perfectly. EDIT: It seems that there is an update related to in this commit (see ) I believe that could be related to this specific change.
Interestingly, it seems that not all Electron apps are affected. Signal still works, for instance, but Discord and Slack don't.
This also affects Bitwarden and potentially Steam. Temporarily using nss344 for the nss package in Bitwarden & Discord works.
Steam indeed doesn't work.
cc
For reference, so this (hopefully) shows up in search results: ERR_FAILED is the error code qutebrowser shows.
I'm using the canary release and it's working, unfortunately it demands an update from 0.0.104 to 0.0.105
Slack also seems to work with , but not
I see that and had some similar issues with other programs while handling , they fixed it by simply use a previous version of for those programs. Maybe we should do the same ? I'm not completely sure this is the right solution since the list of broken programs seems to be quite long.
Rambox (electron) also seems to be affected
Probably switch the default to the older version? At least that's what this sounds like at a quick look. (i.e. only use the new one for the new Firefox and Thunderbird branches)
Thanks I'm not sure how to achieve this, I will check it out later but if somebody with the knowledge can help that would be really cool :).
So much for "NSS 3.54 shared libraries are backward compatible with all older NSS 3.x shared libraries. A program linked with older NSS 3.x shared libraries will work with NSS 3.54 shared libraries without recompiling or relinking. Furthermore, applications that restrict their use of NSS APIs to the functions listed in NSS Public Functions will remain compatible with future versions of the NSS shared libraries." I guess maybe all of this stuff isn't "restricting their use of NSS APIs to the functions listed in NSS Public Functions". We can switch the default to 3.44.x, but I'm not sure if that will be supported after Firefox ESR 68 is EOL, which will be in a month iirc.
A temp workaround for now is to chuck something like the following in an overlay to build the derivation with the older 3.44 NSS (using discord as an example here):
An alternative workaround that I'm currently using is to replace with in .
Arch has discord (and everything else) using and I'm assuming it works
We use , but I believe this is unrelated ?
is 3.55, if you want to give that a go. Probably doesn't help much, though.
Im aware we're on just wondering if it's an issue affecting other releases on other distros, or a exclusive thing They also appear to have been using for a month too:
Maybe we broke something in the makefile -gyp based build system transition. Apparently that all came down to the default make target being wrong, so what you could do is revert that whole change, append to the makeFlags, update to a newer release, rebuild everything and see if that fixes anything.
Steam, Discord and Bitwarden stopped working for me.
Slack stopped working for me as well. I don't use Steam, Discord, or Bitwarden (the Linux app-- I use it in the browser only). However, using fixed it, as per Thanks!
So for now?
Not sure if related but dropbox doesn't currently work for me.
This might be related, but vscode doesn't connect to the network either. I tried overriding it with nss 3.44 but apparently it doesn't depend on it:
VSCode is pulling nss from atomEnv which is it at On Wed, Jul 29, 2020 at 22:58, Matthew Levan <:
Great. So how would I go about succinctly overriding 's within the expression?
Maybe an overlay for atomEnv. I'm not good with the nix language so I don't have any specifics.
How is everyone using ? It does not exist for me and it clearly does not exist in the stable repo.
No results found.
!
Doesn't show up on stable qutebrowser. ! Works on firefox but can't test unstable qutebrowser because it can't access the internet.
Works here on stable qutebrowser !
Anyways to get back on topic here... How do overlays work and is this the appropriate quick fix for someone like me waiting for a PR to be merged into unstable? theGeekPirate <:
I can't replicate it with so I have no idea what's going on.
The simplest solution is to use the stable version of whichever application(s) is/are causing you trouble until is merged.
Great, thank you. theGeekPirate <:
For someone that has many unstable packages that are broken, is an overlay the way to fix the issue for every conceivable package that depends on the troublesome package without having anonymous functions filled with overrides everywhere?
My Nix-fu isn't great, but I'm assuming there's a way to override nss to use that unstable package globally, instead. Hopefully someone else more knowledgeable can step in and help you.
In case anyone is wondering how to use a package from another channel, .
Thank you for the merge. I've renamed the issue so people that are searching with "my [app] is not connecting anymore" won't get confused by this quite specific nss issue.
Thank you all for finding the source of the problem fast.
This issue has been mentioned on NixOS Discourse. There might be relevant details there:
This issue has been mentioned on NixOS Discourse. There might be relevant details there:
Both channels have updated already to contain the fix.

--target ${target}  -Dhost_arch=${host}  -Duse_system_zlib=1  <ins> --enable-libpkix  </ins> ${stdenv.lib.optionalString stdenv.isDarwin "--clang"}  ${stdenv.lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform) "--disable-tests"}


Question:
, CVSSv3=7.5 (nixos-20.03) CVSSv3=7.5 (nixos-20.03) Scanned versions: nixos-20.03: . May contain false positives. Cc Cc Cc
Backporting update that resolves these ().
Fixed in 20.03 and master.

{stdenv , removeReferencesTo , lib <del> , fetchFromGitHub </del> <ins> , fetchurl </ins> , utillinux <ins> , gpgme </ins> , openssl <ins> , libuuid </ins> , coreutils , go , which , makeWrapper <ins> , cryptsetup </ins> , squashfsTools , buildGoPackage}:


Question:
, CVSSv3=7.5 (nixos-20.03) CVSSv3=7.5 (nixos-20.03) Scanned versions: nixos-20.03: . May contain false positives. Cc Cc Cc
Backporting update that resolves these ().
Fixed in 20.03 and master.

buildGoPackage rec { pname = "singularity"; <del> version = "3.2.1"; </del> <ins> version = "3.6.1"; </ins> <del> src = fetchFromGitHub { owner = "sylabs"; repo = "singularity"; rev = "v${version}"; sha256 = "14lhxwy21s7q081x7kbnvkjsbxgsg2f181qlzmlxcn6n7gfav3kj"; </del> <ins> src = fetchurl { url = "https://github.com/hpcng/singularity/releases/download/v${version}/singularity-${version}.tar.gz"; sha256 = "070jj6kbiw23sd2p4xhvmyb8gd83imwgisdf18ahkwp7dq85db3c"; </ins> }; goPackagePath = "github.com/sylabs/singularity"; goDeps = ./deps.nix; <del> buildInputs = [ openssl ]; nativeBuildInputs = [ removeReferencesTo utillinux which makeWrapper ]; </del> <ins> buildInputs = [ gpgme openssl libuuid ]; nativeBuildInputs = [ removeReferencesTo utillinux which makeWrapper cryptsetup ]; </ins> propagatedBuildInputs = [ coreutils squashfsTools ]; <del> prePatch = '' substituteInPlace internal/pkg/build/copy/copy.go  </del> <ins> postPatch = '' substituteInPlace internal/pkg/build/files/copy.go  </ins> --replace /bin/cp ${coreutils}/bin/cp '';


Question:
, CVSSv3=7.5 (nixos-20.03) CVSSv3=7.5 (nixos-20.03) Scanned versions: nixos-20.03: . May contain false positives. Cc Cc Cc
Backporting update that resolves these ().
Fixed in 20.03 and master.

# Don't install SUID binaries sed -i 's/-m 4755/-m 755/g' builddir/Makefile ''; buildPhase = '' <ins> runHook preBuild </ins> make -C builddir <ins> runHook postBuild </ins> ''; installPhase = '' <ins> runHook preInstall </ins> make -C builddir install LOCALSTATEDIR=$bin/var chmod 755 $bin/libexec/singularity/bin/starter-suid <del> wrapProgram $bin/bin/singularity --prefix PATH : ${stdenv.lib.makeBinPath propagatedBuildInputs} </del> <ins> # Explicitly configure paths in the config file sed -i 's|^# mksquashfs path =.*$|mksquashfs path = ${stdenv.lib.makeBinPath [squashfsTools]}/mksquashfs|' $bin/etc/singularity/singularity.conf sed -i 's|^# cryptsetup path =.*$|cryptsetup path = ${stdenv.lib.makeBinPath [cryptsetup]}/cryptsetup|' $bin/etc/singularity/singularity.conf runHook postInstall </ins> ''; postFixup = '' <del> find $bin/ -type f -executable -exec remove-references-to -t ${go} '{}' + || true # These etc scripts shouldn't have their paths patched cp etc/actions/* $bin/etc/singularity/actions/ </del> <ins> find $bin/libexec/ -type f -executable -exec remove-references-to -t ${go} '{}' + || true </ins> ''; meta = with stdenv.lib; { <del> homepage = http://www.sylabs.io/; </del> <ins> homepage = "http://www.sylabs.io/"; </ins> description = "Application containers for linux"; license = licenses.bsd3; platforms = platforms.linux;


Question:
, CVSSv3=7.5 (nixos-20.03) CVSSv3=7.5 (nixos-20.03) Scanned versions: nixos-20.03: . May contain false positives. Cc Cc Cc
Backporting update that resolves these ().
Fixed in 20.03 and master.

cd .. mkdir -p /var/singularity/mnt/{container,final,overlay,session,source} echo "root:x:0:0:System administrator:/root:/bin/sh" > /etc/passwd <ins> echo > /etc/resolv.conf </ins> TMPDIR=$(pwd -P) singularity build $out ./img '');


Question: Describe the bug xscreensaver-demo is both a way to preview individual screensavers and the frontend for configuring xscreensaver. It should be installed alongside all the other xscreensaver binaries; however, it isn't, although its man page is. To Reproduce Steps to reproduce the behavior: Expected behavior is available in . Notify maintainers (raskin) Metadata system: host os: multi-user?: sandbox: version: channels(root): nixpkgs: Maintainer information:

{ stdenv, fetchurl, pkgconfig, bc, perl, perlPackages, pam, libXext, libXScrnSaver, libX11 , libXrandr, libXmu, libXxf86vm, libXrender, libXxf86misc, libjpeg, libGLU, libGL, gtk2 <del> , libxml2, libglade, intltool, xorg, makeWrapper, gle </del> <ins> , libxml2, libglade, intltool, xorg, makeWrapper, gle, gdk-pixbuf, gdk-pixbuf-xlib </ins> , forceInstallAllHacks ? false }:


Question: Describe the bug xscreensaver-demo is both a way to preview individual screensavers and the frontend for configuring xscreensaver. It should be installed alongside all the other xscreensaver binaries; however, it isn't, although its man page is. To Reproduce Steps to reproduce the behavior: Expected behavior is available in . Notify maintainers (raskin) Metadata system: host os: multi-user?: sandbox: version: channels(root): nixpkgs: Maintainer information:

buildInputs = [ pkgconfig bc perl libjpeg libGLU libGL gtk2 libxml2 libglade pam libXext libXScrnSaver libX11 libXrandr libXmu libXxf86vm libXrender <del> libXxf86misc intltool xorg.appres makeWrapper gle </del> <ins> libXxf86misc intltool xorg.appres makeWrapper gle gdk-pixbuf gdk-pixbuf-xlib </ins> ]; preConfigure =


Question: Dokuwiki login page does not work (timeout) when https is not enabled in the webserver. Steps to reproduce the behavior: Add some user using the usersFile option and disable and options. Click on "Log In" in the top right, fill in form, and click the login button. The page now redirects to a non-existing https url. Disabling these options should allow Dokuwiki to work on a non-HTTPS enabled webserver. Currently when trying to login, the page will time out as the wiki redirects the user to a https version of the url. While the default https enabled webserver is good for security, it is not always needed or wanted. For example, when you have the wiki on an internal trusted network with no access from the internet such as a wireguard VPN of a few personal devices. In that situation, the SSL adds no value and makes it harder to use, as you would need to distribute self signed certificates to all your devices.

enable = true; virtualHosts = mapAttrs (hostName: cfg:  mkMerge [ cfg.nginx { root = mkForce "${pkg hostName cfg}/share/dokuwiki"; <del> extraConfig = "fastcgi_param HTTPS on;"; </del> <ins> extraConfig = lib.optionalString (cfg.nginx.addSSL || cfg.nginx.forceSSL || cfg.nginx.onlySSL || cfg.nginx.enableACME) "fastcgi_param HTTPS on;"; </ins> locations."~ /(conf/|bin/|inc/|install.php)" = { extraConfig = "deny all;";


Question: Dokuwiki login page does not work (timeout) when https is not enabled in the webserver. Steps to reproduce the behavior: Add some user using the usersFile option and disable and options. Click on "Log In" in the top right, fill in form, and click the login button. The page now redirects to a non-existing https url. Disabling these options should allow Dokuwiki to work on a non-HTTPS enabled webserver. Currently when trying to login, the page will time out as the wiki redirects the user to a https version of the url. While the default https enabled webserver is good for security, it is not always needed or wanted. For example, when you have the wiki on an internal trusted network with no access from the internet such as a wireguard VPN of a few personal devices. In that situation, the SSL adds no value and makes it harder to use, as you would need to distribute self signed certificates to all your devices.

fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; fastcgi_param REDIRECT_STATUS 200; fastcgi_pass unix:${config.services.phpfpm.pools."dokuwiki-${hostName}".socket}; <del> fastcgi_param HTTPS on; </del> <ins> ${lib.optionalString (cfg.nginx.addSSL || cfg.nginx.forceSSL || cfg.nginx.onlySSL || cfg.nginx.enableACME) "fastcgi_param HTTPS on;"} </ins> ''; }; }]) eachSite;


Question:
Describe the bug error: --- Error --- build-remote build of '/nix/store/x4nz3kqn24vlz257hm8mnsvrn6ggfsrs-v4l-utils-' on 'ssh://root failed: builder for '/nix/store/x4nz3kqn24vlz257hm8mnsvrn6ggfsrs-v4l-utils-' failed with exit code 2 error: --- Error
-------------------------------------------------------- nix builder for '/nix/store/x4nz3kqn24vlz257hm8mnsvrn6ggfsrs-v4l-utils-' failed with exit code 1; last 10 log lines: ../../utils/libcecutil/cec- ../../include/linux/cec.h ../../utils/libcecutil/cec-htng.h ../../include/linux/cec-funcs.h ../../utils/libcecutil/cec-htng-funcs.h /nix/store/j8vysakw78bpgngba32hfwwikqda9yx2-bash-4.4-p23/bin/bash: ../../utils/libcecutil/cec- /usr/bin/perl: bad interpreter: No such file or directory make[3]: [Makefile:782: gen.intermediate] Error 126 make[3]: Leaving directory '/build/v4l-utils-1.20.0/utils/libcecutil' make[2]: [Makefile:482: all-recursive] Error 1 make[2]: Leaving directory '/build/v4l-utils-1.20.0/utils' make[1]: [Makefile:591: all-recursive] Error 1 make[1]: Leaving directory '/build/v4l-utils-1.20.0' make: [Makefile:518: all] Error 2 builder for '/nix/store/x4nz3kqn24vlz257hm8mnsvrn6ggfsrs-v4l-utils-' failed with exit code 2 error: --- Error
-------------------------------------------------------- nix 1 dependencies of derivation '/nix/store/2544nk822aa38adwvdgk8kc1zyxf1wgd-system-' failed to build we need another . PR incoming... I'm on

postPatch = '' patchShebangs utils/cec-ctl/msg2ctl.pl <ins> patchShebangs utils/libcecutil/cec-gen.pl </ins> ''; meta = with stdenv.lib; {


Question:
Describe the bug as described in , the build fails with: To Reproduce Steps to reproduce the behavior: Since this is a dependency of openjdk14, reproduce with: Additional context This broke somewhere between and ; I'm bisecting now. Notify maintainers <!-- Please @ people who are in the list of the offending package or module. If in doubt, check for whoever last touched something. -- Metadata system: host os: multi-user?: sandbox: version: nixpkgs: Maintainer information:
I could've sworn I tested this back when I was working on ... rebuilding from those commits now to confirm.
Yeah, somehow the release fixes this, but I don't know how.

postFixup = '' # Remove references to bootstrap. find "$out" -name *.so | while read lib; do <del> new_refs="$(patchelf --print-rpath "$lib" | sed -E 's,:?${openjdk11_headless}[^:]*,,')" </del> <ins> new_refs="$(patchelf --print-rpath "$lib" | sed -E 's,:?${lib.escape ["+"] openjdk11_headless.outPath}[^:]*,,')" </ins> patchelf --set-rpath "$new_refs" "$lib" done '';


Question: Describe the bug A clear and concise description of what the bug is. If I try to use the function in from the command line I get an error: To Reproduce Steps to reproduce the behavior: is printed to console Expected behavior A clear and concise description of what you expected to happen. should define so works. Screenshots If applicable, add screenshots to help explain your problem. Additional context Add any other context about the problem here. Currently NixOS modules (, ) handle this for the most part, but it would be nice to avoid duplication and have this defined once - in the package instead of modules. Notify maintainers <!-- Please @ people who are in the list of the offending package or module. If in doubt, check for whoever last touched something. -- Metadata Please run and paste the result. system: host os: multi-user?: sandbox: version: channels(root): nixpkgs: Maintainer information:

{ callPackage, lib, stdenv, nixosTests, config, fetchurl, makeWrapper , symlinkJoin, writeText, autoconf, automake, bison, flex, libtool , pkgconfig, re2c, apacheHttpd, libargon2, libxml2, pcre, pcre2 <del> , systemd, valgrind, xcbuild </del> <ins> , systemd, system-sendmail, valgrind, xcbuild </ins> , version , sha256


Question: Describe the bug A clear and concise description of what the bug is. If I try to use the function in from the command line I get an error: To Reproduce Steps to reproduce the behavior: is printed to console Expected behavior A clear and concise description of what you expected to happen. should define so works. Screenshots If applicable, add screenshots to help explain your problem. Additional context Add any other context about the problem here. Currently NixOS modules (, ) handle this for the most part, but it would be nice to avoid duplication and have this defined once - in the package instead of modules. Notify maintainers <!-- Please @ people who are in the list of the offending package or module. If in doubt, check for whoever last touched something. -- Metadata Please run and paste the result. system: host os: multi-user?: sandbox: version: channels(root): nixpkgs: Maintainer information:

++ lib.optional systemdSupport "--with-fpm-systemd" ++ lib.optional valgrindSupport "--with-valgrind=${valgrind.dev}" ++ lib.optional ztsSupport "--enable-maintainer-zts" <ins> # Sendmail ++ [ "PROG_SENDMAIL=${system-sendmail}/bin/sendmail" ] </ins> ; hardeningDisable = [ "bindnow" ];


Question:
Describe the bug peek fails to build on macOS To Reproduce Clone then Notify maintainers Log
I marked this as stale due to inactivity. →
sadly its not supported though getting keybinder3 to compile would be good
I marked this as stale due to inactivity. →

"-Dtests=false" "-Dtracker3=${lib.boolToString trackerSupport}" "-Dbroadway_backend=${lib.boolToString broadwaySupport}" <ins> "-Dx11_backend=${lib.boolToString x11Support}" "-Dquartz_backend=${lib.boolToString (stdenv.isDarwin && !x11Support)}" </ins> ]; doCheck = false; # needs X11


Question:
Describe the bug peek fails to build on macOS To Reproduce Clone then Notify maintainers Log
I marked this as stale due to inactivity. →
sadly its not supported though getting keybinder3 to compile would be good
I marked this as stale due to inactivity. →

NIX_CFLAGS_COMPILE = "-DG_ENABLE_DEBUG -DG_DISABLE_CAST_CHECKS"; postPatch = '' <ins> # See https://github.com/NixOS/nixpkgs/issues/132259 substituteInPlace meson.build  --replace "x11_enabled = false" "" </ins> files=( build-aux/meson/post-install.py demos/gtk-demo/geninclude.py


Question:
Describe the bug peek fails to build on macOS To Reproduce Clone then Notify maintainers Log
I marked this as stale due to inactivity. →
sadly its not supported though getting keybinder3 to compile would be good
I marked this as stale due to inactivity. →

description = "Library for registering global key bindings"; homepage = "https://github.com/kupferlauncher/keybinder/"; license = licenses.mit; <del> platforms = platforms.linux; </del> <ins> platforms = platforms.unix; </ins> maintainers = [ maintainers.cstrahan ]; }; }


Question:
Describe the bug peek fails to build on macOS To Reproduce Clone then Notify maintainers Log
I marked this as stale due to inactivity. →
sadly its not supported though getting keybinder3 to compile would be good
I marked this as stale due to inactivity. →

}; keybinder3 = callPackage ../development/libraries/keybinder3 { <ins> gtk3 = if stdenv.isDarwin then gtk3-x11 else gtk3; </ins> automake = automake111x; };


Question:
Project description It's a tool to create pet-container using Podman. The container is fully mutable and maps your user home to the container. Metadata homepage URL: source URL: license: Apache-2.0 platforms: Linux
I took a brief look at this a couple of months ago after it was rewritten in go. I'll post what I had if I can find it. It uses meson/ninja as a build system which makes it kind of non-standard and a bit awkward to package compared to other go projects, might be easier to skip it and specify the build/install phases manually. IIRC it also needed completion/profile.d paths to be patched in, had issues trying to mount other paths on NixOS and it wanted flatpak for some reason.
I also took a shot at getting toolbox working a while back, and wrote a nix expression for building the package, but decided to try it out when podman is rolled out in a stable NixOS channel. Now that 20.09 is released, I'm trying it out but I get cryptic errors like the following: I might look into this further when I get the time, but people are welcome to look into this issue to try and fix it. Meanwhile, here's the nix expression to build it: Note that in order to use toolbox on NixOS, you seem to need the following config: People seem to be against usage of buildGoModule (see ), so if people are interested in seeing this in nixpkgs, someone probably needs to port this to buildGoPackage.
Hi , I modified a little your nix expression I a patch to check if exists (it not exists in my system for instance). I also changed to copy to and it's mapping this file inside the container. I'm having the same error. So I tried to start the container using podman, this way: Maybe the problem now is because o cgroups. I don't now.
I had to submit an upstream patch to fix an error introduced in newer builds with ownership of the toolboxRuntimeDirectory. I think this would be good to have, so I'm interested in carrying on the work. I was able to build toolbox (thanks for the derivation). The biggest issue seems to be this. Trying to start a container with yields: See this issue. Seems that the reported issue occured when host and container glibc don't match. The toolbox binary gets bind-mounted into the fedora container, which may cause issues without the requisite store paths also being mounted. See: Toolbox is kinda leaky by design, so this might be a problem. <details<summaryContainer info </summaryWARN[0000] Error initializing configured OCI runtime kata: no valid executable found for OCI runtime kata: invalid argument DEBU[0000] using runtime "/nix/store/jkg2hzkxc2g05gsbpkb8sybh34j78syh-nvidia-podman/bin/nvidia-container-runtime" INFO[0000] Setting parallel job count to 73 DEBU[0000] Called inspect.PersistentPostRunE(/nix/store/h9was55f3ir6b2sq5vc96cpgns3qbfz0-podman-2.2.1/bin/podman --log-level debug inspect --format json --type container fedora-tool </details
I have it running! Hello from vim installed via dnf. It's blocked by my upstream patch which you can follow here: <img width="1278" alt="Screen Shot 2021-01-22 at 4 20 05 AM" src="https://user-"<img width="634" alt="Screen Shot 2021-01-22 at 4 21 13 AM" src="https://user-"
That's great I think toolbox is a great tool to have in NixOS.
Agreed! Please test the PR if you have time :) Thanks for your work!
Very happy to see your interest in Toolbox! I just wanted to point out that Toolbox doesn't actually need Flatpak proper. It's just the daemon which is a D-Bus session service that comes from but is completely separate from the rest of Flatpak. In fact, in Fedora, we ship it is a separate isolated sub-package. The purpose behind this daemon is to keep certain configuration files in the container's synchronized with their counterparts in the host. eg., , , etc.. Anyway, good news is that these days, since Toolbox 0.0.97, the daemon is no longer used for newly created containers, because the functionality has been absorbed into Toolbox itself. One big reason was to enable rootful Toolbox containers (ie., ). Older, preexisting containers will continue to use the daemon, though.
Just a minor note. The actual issue is See the related for an explanation on how we solved it. Ideas for better solutions welcome. :)
I marked this as stale due to inactivity. →
This issue is important to me.
Any update on this? Can this be merged to upstream and closed?
Is there anything that you need from the Toolbx project?
There are two remaining roadblocks. To clarify, I no longer use nixos and will probably not work on this (I still am an active toolbox user, just on Fedora :)) glibc updates. Any time the hash of glibc changes in the nix store, all toolbox containers will break (and need to be recreated). I'm sure there is a clever way around this, either a service that runs after a nix-rebuild that updates the bind mounts, or patching toolbox to update the bind mount on each toolbox enter. These seem very nix (or guix) specific) SDDM issue, there's nothing I think toolbox should do about this. Nixpkgs could consider carrying the sddm patches until merged upstream. Anyone is free to takeover , I won't be continuing it. The PR "works" with the caveat of point 1 not being handled, so you'll have to periodically recreate toolboxes.
after the container creation, it's possible to change the bind mounts and ports? Is there a file to edit?
I found this alternative to toolbox
There's no support for doing it easily through a Toolbx-specific configuration file at the moment. However, you can script something through one of the shell start-up scripts.

<ins> { lib, buildGoModule, fetchFromGitHub, glibc, go-md2man, installShellFiles }: buildGoModule rec { pname = "toolbox"; version = "0.0.99.3"; src = fetchFromGitHub { owner = "containers"; repo = pname; rev = version; hash = "sha256-9HiWgEtaMypLOwXJ6Xg3grLSZOQ4NInZtcvLPV51YO8="; }; patches = [ ./glibc.patch ]; vendorHash = "sha256-k79TcC9voQROpJnyZ0RsqxJnBT83W5Z+D+D3HnuQGsI="; postPatch = '' substituteInPlace src/cmd/create.go --subst-var-by glibc ${glibc} ''; modRoot = "src"; nativeBuildInputs = [ go-md2man installShellFiles ]; ldflags = [ "-s" "-w" "-X github.com/containers/toolbox/pkg/version.currentVersion=${version}" ]; preCheck = "export PATH=$GOPATH/bin:$PATH"; postInstall = '' cd .. for d in doc/*.md; do go-md2man -in $d -out ''${d%.md} done installManPage doc/*.[1-9] installShellCompletion --bash completion/bash/toolbox install profile.d/toolbox.sh -Dt $out/share/profile.d ''; meta = with lib; { homepage = "https://containertoolbx.org"; changelog = "https://github.com/containers/toolbox/releases/tag/${version}"; description = "Tool for containerized command line environments on Linux"; license = licenses.asl20; maintainers = with maintainers; [ urandom ]; }; } </ins>


Question:
Project description It's a tool to create pet-container using Podman. The container is fully mutable and maps your user home to the container. Metadata homepage URL: source URL: license: Apache-2.0 platforms: Linux
I took a brief look at this a couple of months ago after it was rewritten in go. I'll post what I had if I can find it. It uses meson/ninja as a build system which makes it kind of non-standard and a bit awkward to package compared to other go projects, might be easier to skip it and specify the build/install phases manually. IIRC it also needed completion/profile.d paths to be patched in, had issues trying to mount other paths on NixOS and it wanted flatpak for some reason.
I also took a shot at getting toolbox working a while back, and wrote a nix expression for building the package, but decided to try it out when podman is rolled out in a stable NixOS channel. Now that 20.09 is released, I'm trying it out but I get cryptic errors like the following: I might look into this further when I get the time, but people are welcome to look into this issue to try and fix it. Meanwhile, here's the nix expression to build it: Note that in order to use toolbox on NixOS, you seem to need the following config: People seem to be against usage of buildGoModule (see ), so if people are interested in seeing this in nixpkgs, someone probably needs to port this to buildGoPackage.
Hi , I modified a little your nix expression I a patch to check if exists (it not exists in my system for instance). I also changed to copy to and it's mapping this file inside the container. I'm having the same error. So I tried to start the container using podman, this way: Maybe the problem now is because o cgroups. I don't now.
I had to submit an upstream patch to fix an error introduced in newer builds with ownership of the toolboxRuntimeDirectory. I think this would be good to have, so I'm interested in carrying on the work. I was able to build toolbox (thanks for the derivation). The biggest issue seems to be this. Trying to start a container with yields: See this issue. Seems that the reported issue occured when host and container glibc don't match. The toolbox binary gets bind-mounted into the fedora container, which may cause issues without the requisite store paths also being mounted. See: Toolbox is kinda leaky by design, so this might be a problem. <details<summaryContainer info </summaryWARN[0000] Error initializing configured OCI runtime kata: no valid executable found for OCI runtime kata: invalid argument DEBU[0000] using runtime "/nix/store/jkg2hzkxc2g05gsbpkb8sybh34j78syh-nvidia-podman/bin/nvidia-container-runtime" INFO[0000] Setting parallel job count to 73 DEBU[0000] Called inspect.PersistentPostRunE(/nix/store/h9was55f3ir6b2sq5vc96cpgns3qbfz0-podman-2.2.1/bin/podman --log-level debug inspect --format json --type container fedora-tool </details
I have it running! Hello from vim installed via dnf. It's blocked by my upstream patch which you can follow here: <img width="1278" alt="Screen Shot 2021-01-22 at 4 20 05 AM" src="https://user-"<img width="634" alt="Screen Shot 2021-01-22 at 4 21 13 AM" src="https://user-"
That's great I think toolbox is a great tool to have in NixOS.
Agreed! Please test the PR if you have time :) Thanks for your work!
Very happy to see your interest in Toolbox! I just wanted to point out that Toolbox doesn't actually need Flatpak proper. It's just the daemon which is a D-Bus session service that comes from but is completely separate from the rest of Flatpak. In fact, in Fedora, we ship it is a separate isolated sub-package. The purpose behind this daemon is to keep certain configuration files in the container's synchronized with their counterparts in the host. eg., , , etc.. Anyway, good news is that these days, since Toolbox 0.0.97, the daemon is no longer used for newly created containers, because the functionality has been absorbed into Toolbox itself. One big reason was to enable rootful Toolbox containers (ie., ). Older, preexisting containers will continue to use the daemon, though.
Just a minor note. The actual issue is See the related for an explanation on how we solved it. Ideas for better solutions welcome. :)
I marked this as stale due to inactivity. →
This issue is important to me.
Any update on this? Can this be merged to upstream and closed?
Is there anything that you need from the Toolbx project?
There are two remaining roadblocks. To clarify, I no longer use nixos and will probably not work on this (I still am an active toolbox user, just on Fedora :)) glibc updates. Any time the hash of glibc changes in the nix store, all toolbox containers will break (and need to be recreated). I'm sure there is a clever way around this, either a service that runs after a nix-rebuild that updates the bind mounts, or patching toolbox to update the bind mount on each toolbox enter. These seem very nix (or guix) specific) SDDM issue, there's nothing I think toolbox should do about this. Nixpkgs could consider carrying the sddm patches until merged upstream. Anyone is free to takeover , I won't be continuing it. The PR "works" with the caveat of point 1 not being handled, so you'll have to periodically recreate toolboxes.
after the container creation, it's possible to change the bind mounts and ports? Is there a file to edit?
I found this alternative to toolbox
There's no support for doing it easily through a Toolbx-specific configuration file at the moment. However, you can script something through one of the shell start-up scripts.

<ins> diff --git a/src/cmd/create.go b/src/cmd/create.go index 74e90b1..113ef80 100644 --- a/src/cmd/create.go +++ b/src/cmd/create.go @@ -423,6 +425,7 @@ func createContainer(container, image, release string, showCommandToEnter bool) "--volume", toolboxPathMountArg, "--volume", usrMountArg, "--volume", runtimeDirectoryMountArg, +		"--volume", "@glibc@:@glibc@:ro", }...) createArgs = append(createArgs, avahiSocketMount...) </ins>


Question:
Project description It's a tool to create pet-container using Podman. The container is fully mutable and maps your user home to the container. Metadata homepage URL: source URL: license: Apache-2.0 platforms: Linux
I took a brief look at this a couple of months ago after it was rewritten in go. I'll post what I had if I can find it. It uses meson/ninja as a build system which makes it kind of non-standard and a bit awkward to package compared to other go projects, might be easier to skip it and specify the build/install phases manually. IIRC it also needed completion/profile.d paths to be patched in, had issues trying to mount other paths on NixOS and it wanted flatpak for some reason.
I also took a shot at getting toolbox working a while back, and wrote a nix expression for building the package, but decided to try it out when podman is rolled out in a stable NixOS channel. Now that 20.09 is released, I'm trying it out but I get cryptic errors like the following: I might look into this further when I get the time, but people are welcome to look into this issue to try and fix it. Meanwhile, here's the nix expression to build it: Note that in order to use toolbox on NixOS, you seem to need the following config: People seem to be against usage of buildGoModule (see ), so if people are interested in seeing this in nixpkgs, someone probably needs to port this to buildGoPackage.
Hi , I modified a little your nix expression I a patch to check if exists (it not exists in my system for instance). I also changed to copy to and it's mapping this file inside the container. I'm having the same error. So I tried to start the container using podman, this way: Maybe the problem now is because o cgroups. I don't now.
I had to submit an upstream patch to fix an error introduced in newer builds with ownership of the toolboxRuntimeDirectory. I think this would be good to have, so I'm interested in carrying on the work. I was able to build toolbox (thanks for the derivation). The biggest issue seems to be this. Trying to start a container with yields: See this issue. Seems that the reported issue occured when host and container glibc don't match. The toolbox binary gets bind-mounted into the fedora container, which may cause issues without the requisite store paths also being mounted. See: Toolbox is kinda leaky by design, so this might be a problem. <details<summaryContainer info </summaryWARN[0000] Error initializing configured OCI runtime kata: no valid executable found for OCI runtime kata: invalid argument DEBU[0000] using runtime "/nix/store/jkg2hzkxc2g05gsbpkb8sybh34j78syh-nvidia-podman/bin/nvidia-container-runtime" INFO[0000] Setting parallel job count to 73 DEBU[0000] Called inspect.PersistentPostRunE(/nix/store/h9was55f3ir6b2sq5vc96cpgns3qbfz0-podman-2.2.1/bin/podman --log-level debug inspect --format json --type container fedora-tool </details
I have it running! Hello from vim installed via dnf. It's blocked by my upstream patch which you can follow here: <img width="1278" alt="Screen Shot 2021-01-22 at 4 20 05 AM" src="https://user-"<img width="634" alt="Screen Shot 2021-01-22 at 4 21 13 AM" src="https://user-"
That's great I think toolbox is a great tool to have in NixOS.
Agreed! Please test the PR if you have time :) Thanks for your work!
Very happy to see your interest in Toolbox! I just wanted to point out that Toolbox doesn't actually need Flatpak proper. It's just the daemon which is a D-Bus session service that comes from but is completely separate from the rest of Flatpak. In fact, in Fedora, we ship it is a separate isolated sub-package. The purpose behind this daemon is to keep certain configuration files in the container's synchronized with their counterparts in the host. eg., , , etc.. Anyway, good news is that these days, since Toolbox 0.0.97, the daemon is no longer used for newly created containers, because the functionality has been absorbed into Toolbox itself. One big reason was to enable rootful Toolbox containers (ie., ). Older, preexisting containers will continue to use the daemon, though.
Just a minor note. The actual issue is See the related for an explanation on how we solved it. Ideas for better solutions welcome. :)
I marked this as stale due to inactivity. →
This issue is important to me.
Any update on this? Can this be merged to upstream and closed?
Is there anything that you need from the Toolbx project?
There are two remaining roadblocks. To clarify, I no longer use nixos and will probably not work on this (I still am an active toolbox user, just on Fedora :)) glibc updates. Any time the hash of glibc changes in the nix store, all toolbox containers will break (and need to be recreated). I'm sure there is a clever way around this, either a service that runs after a nix-rebuild that updates the bind mounts, or patching toolbox to update the bind mount on each toolbox enter. These seem very nix (or guix) specific) SDDM issue, there's nothing I think toolbox should do about this. Nixpkgs could consider carrying the sddm patches until merged upstream. Anyone is free to takeover , I won't be continuing it. The PR "works" with the caveat of point 1 not being handled, so you'll have to periodically recreate toolboxes.
after the container creation, it's possible to change the bind mounts and ports? Is there a file to edit?
I found this alternative to toolbox
There's no support for doing it easily through a Toolbx-specific configuration file at the moment. However, you can script something through one of the shell start-up scripts.

todo = callPackage ../tools/misc/todo { }; <ins> toolbox = callPackage ../applications/virtualization/toolbox { }; </ins> tor = callPackage ../tools/security/tor { }; tor-browser-bundle-bin = callPackage ../applications/networking/browsers/tor-browser-bundle-bin { };


Question:
Project description cchat-gtk appears to be a generic chat frontend cchat-discord appears to be a discord-capable backend gtkcord3 was the predecessor and was quite nice, I'm excited to get this packaged. Metadata homepage URL: source URL: license: gpl3 platforms: linux
updated OP to reflect that we should package cchat-gtk/cchat-discord now instead of gtkcord3.
I marked this as stale due to inactivity. →
still important to me
I have this packaged in my own config:
I marked this as stale due to inactivity. →

<ins> { buildGoModule , cairo , fetchFromGitHub , gdk-pixbuf , glib , gobject-introspection , graphene , gtk4 , lib , pango , pkg-config }: buildGoModule rec { pname = "gtkcord4"; version = "0.0.6"; src = fetchFromGitHub { owner = "diamondburned"; repo = pname; rev = "v${version}"; hash = "sha256-uEG1pAHMQT+C/E5rKByflvL0NNkC8SeSPMAXanzvhE4="; }; nativeBuildInputs = [ gobject-introspection pkg-config ]; buildInputs = [ cairo gdk-pixbuf glib graphene gtk4 pango ]; vendorHash = "sha256-QZSjSk1xu5ZcrNEra5TxnUVvlQWb5/h31fm5Nc7WMoI="; meta = with lib; { description = "GTK4 Discord client in Go, attempt #4."; homepage = "https://github.com/diamondburned/gtkcord4"; license = licenses.gpl3Only; maintainers = with maintainers; [ urandom ]; }; } </ins>


Question:
Project description cchat-gtk appears to be a generic chat frontend cchat-discord appears to be a discord-capable backend gtkcord3 was the predecessor and was quite nice, I'm excited to get this packaged. Metadata homepage URL: source URL: license: gpl3 platforms: linux
updated OP to reflect that we should package cchat-gtk/cchat-discord now instead of gtkcord3.
I marked this as stale due to inactivity. →
still important to me
I have this packaged in my own config:
I marked this as stale due to inactivity. →

gspeech = callPackage ../applications/audio/gspeech { }; <ins> gtkcord4 = callPackage ../applications/audio/gtkcord4 {}; </ins> haruna = libsForQt5.callPackage ../applications/video/haruna { }; hdrmerge = libsForQt5.callPackage ../applications/graphics/hdrmerge { };


Question:
Describe the bug It's easiest to see in this picture: ! To Reproduce Steps to reproduce the behavior: system with nixpkgs at how init complains about /dev/fd/62 Expected behavior No error pertaining to /dev/fd/62. Screenshots See above. Additional context I don't actually remember when this started, because the boot logging scrolls so fast I missed it a few times (and I might have updated nixos-unstable-small at some point). The problematic line is: According to the blame, that hasn't been touched in 5 years, so I don't know why this would start cropping up now. Notify maintainers <!-- Please @ people who are in the list of the offending package or module. If in doubt, check for whoever last touched something. --Metadata system: host os: multi-user?: sandbox: version: channels(root): nixpkgs: Maintainer information:
Why I think we should block on this: there should be no scary pointless outputs in the init script in nixos. Same if the activation script was being loud and scary for no reason.
So, I attempted to bisect this, but due to build failures (and the size of some builds) I was unable to pinpoint. However, I've now set up a machine that I can use for those huge builds, and will try to go further sometime soon. For anybody interested, below is my ( and ):
OK, I re-bisected (by removing all the skipped commits and building them on a machine) and got this result: cc What are the chances this is an issue with the package/one of our patches and not with upstream? New bisect log, for the curious:
did this happen in a VM, or on your real machine as well? What's with the `chown: invalid user" in there? Is this related?
I can reproduce in a VM and on my machine. Ignore everything below the fd error -- screenshot was taken from another issue, before I was able to build a VM myself. (EDIT: I've uploaded my own screenshot sans the JSON and errors, to make things clearer.) I'm going to try to bisect systemd soon, but it'll probably take a while, especially given how many patches there are that could fail to apply :P
OK, maybe the stuff is a red herring? I d the entire call and got the following log: <details<summarystrace output</summary</detailsCan't interpret this now, but maybe it will give somebody an idea. Most interesting part to me:
Alright, thanks to my Google-fu, I found a diff that fixes the issue: According to , one of the articles that turned up, this might be caused by udev missing?

# Create device nodes in /dev. @preDeviceCommands@ echo "running udev..." <ins> ln -sfn /proc/self/fd /dev/fd </ins> mkdir -p /etc/systemd ln -sfn @linkUnits@ /etc/systemd/network mkdir -p /etc/udev


Question:
Describe the bug When trying to start a dynamic playlist, the user is greeted by an error banner stating the following: To Reproduce Steps to reproduce the behavior: Cantata dynamic playlist to play dynamic playlist Expected behavior I expected Cantata to start the dynamic playlist. Screenshots ! Additional context This is likely fallout from perl's removal in However, this exposed something impure about Cantata's packaging, so it's a good thing! I tried simply patching the shebang to point to (as well as changing this condition to never return true: ), but to no avail. EDIT: Even adding to my does nothing -- when I click on the play button by the dynamic playlist, it turns to the red stop button, and then back to the play button without ever playing or queuing any songs. Seems like this might need more work. Notify maintainers Metadata system: host os: multi-user?: sandbox: version: channels(root): nixpkgs: Maintainer information:
If you have the time to give it go, I think this should do the trick: And then add to .
Thanks for the tip. It was slightly more involved than that, but fixed in this PR:

{ mkDerivation, lib, fetchFromGitHub, cmake, pkgconfig <del> , qtbase, qtsvg, qttools </del> <ins> , qtbase, qtsvg, qttools, perl </ins> # Cantata doesn't build with cdparanoia enabled so we disable that # default for now until I (or someone else) figure it out.


Question:
Describe the bug When trying to start a dynamic playlist, the user is greeted by an error banner stating the following: To Reproduce Steps to reproduce the behavior: Cantata dynamic playlist to play dynamic playlist Expected behavior I expected Cantata to start the dynamic playlist. Screenshots ! Additional context This is likely fallout from perl's removal in However, this exposed something impure about Cantata's packaging, so it's a good thing! I tried simply patching the shebang to point to (as well as changing this condition to never return true: ), but to no avail. EDIT: Even adding to my does nothing -- when I click on the play button by the dynamic playlist, it turns to the red stop button, and then back to the play button without ever playing or queuing any songs. Seems like this might need more work. Notify maintainers Metadata system: host os: multi-user?: sandbox: version: channels(root): nixpkgs: Maintainer information:
If you have the time to give it go, I think this should do the trick: And then add to .
Thanks for the tip. It was slightly more involved than that, but fixed in this PR:

withUdisks = (withTaglib && withDevices); <ins> perl' = perl.withPackages (ppkgs: [ ppkgs.URI ]); </ins> in mkDerivation { name = "${pname}-${version}";


Question:
Describe the bug When trying to start a dynamic playlist, the user is greeted by an error banner stating the following: To Reproduce Steps to reproduce the behavior: Cantata dynamic playlist to play dynamic playlist Expected behavior I expected Cantata to start the dynamic playlist. Screenshots ! Additional context This is likely fallout from perl's removal in However, this exposed something impure about Cantata's packaging, so it's a good thing! I tried simply patching the shebang to point to (as well as changing this condition to never return true: ), but to no avail. EDIT: Even adding to my does nothing -- when I click on the play button by the dynamic playlist, it turns to the red stop button, and then back to the play button without ever playing or queuing any songs. Seems like this might need more work. Notify maintainers Metadata system: host os: multi-user?: sandbox: version: channels(root): nixpkgs: Maintainer information:
If you have the time to give it go, I think this should do the trick: And then add to .
Thanks for the tip. It was slightly more involved than that, but fixed in this PR:

sha256 = "0ix7xp352bziwz31mw79y7wxxmdn6060p8ry2px243ni1lz1qx1c"; }; <del> buildInputs = [ qtbase qtsvg ] </del> <ins> patches = [ # Cantata wants to check if perl is in the PATH at runtime, but we # patchShebangs the playlists scripts, making that unnecessary (perl will # always be available because it's a dependency) ./dont-check-for-perl-in-PATH.diff ]; postPatch = '' patchShebangs playlists ''; buildInputs = [ qtbase qtsvg perl' ] </ins> ++ lib.optionals withTaglib [ taglib taglib_extras ] ++ lib.optionals withReplaygain [ ffmpeg_3 speex mpg123 ] ++ lib.optional  withHttpStream qtmultimedia


Question:
Describe the bug When trying to start a dynamic playlist, the user is greeted by an error banner stating the following: To Reproduce Steps to reproduce the behavior: Cantata dynamic playlist to play dynamic playlist Expected behavior I expected Cantata to start the dynamic playlist. Screenshots ! Additional context This is likely fallout from perl's removal in However, this exposed something impure about Cantata's packaging, so it's a good thing! I tried simply patching the shebang to point to (as well as changing this condition to never return true: ), but to no avail. EDIT: Even adding to my does nothing -- when I click on the play button by the dynamic playlist, it turns to the red stop button, and then back to the play button without ever playing or queuing any songs. Seems like this might need more work. Notify maintainers Metadata system: host os: multi-user?: sandbox: version: channels(root): nixpkgs: Maintainer information:
If you have the time to give it go, I think this should do the trick: And then add to .
Thanks for the tip. It was slightly more involved than that, but fixed in this PR:

<ins> diff --git a/playlists/dynamicplaylists.cpp b/playlists/dynamicplaylists.cpp index 07b6dce3..6a3f97c9 100644 --- a/playlists/dynamicplaylists.cpp +++ b/playlists/dynamicplaylists.cpp @@ -211,11 +211,6 @@ void DynamicPlaylists::start(const QString &name) return; } -    if (Utils::findExe("perl").isEmpty()) { -        emit error(tr("You need to install "perl" on your system in order for Cantata's dynamic mode to function.")); -        return; -    } - QString fName(Utils::dataDir(rulesDir, false)+name+constExtension); if (!QFile::exists(fName)) { </ins>


Question:
Describe the bug It was left out being implemented in the initial PR , but it's a very useful feature for nixos development and endusers. I do understand it's nothing can't do, but it's a useful wrapper. cc
See for an attempt at adding support for this.

outputs = { self }: let jobs = import ./pkgs/top-level/release.nix { nixpkgs = self; };


Question:
Describe the bug It was left out being implemented in the initial PR , but it's a very useful feature for nixos development and endusers. I do understand it's nothing can't do, but it's a useful wrapper. cc
See for an attempt at adding support for this.

lib = lib.extend (final: prev: { nixosSystem = { modules, ... } @ args: import ./nixos/lib/eval-config.nix (args // { <del> modules = modules ++ [ { system.nixos.versionSuffix = </del> <ins> modules = let vmConfig = (import ./nixos/lib/eval-config.nix (args // { modules = modules ++ [ ./nixos/modules/virtualisation/qemu-vm.nix ]; })).config; vmWithBootLoaderConfig = (import ./nixos/lib/eval-config.nix (args // { modules = modules ++ [ ./nixos/modules/virtualisation/qemu-vm.nix { virtualisation.useBootLoader = true; } ]; })).config; in modules ++ [ { system.nixos.versionSuffix = </ins> ".${final.substring 0 8 (self.lastModifiedDate or self.lastModified)}.${self.shortRev or "dirty"}"; system.nixos.revision = final.mkIf (self ? rev) self.rev; <ins> system.build = { vm = vmConfig.system.build.vm; vmWithBootLoader = vmWithBootLoaderConfig.system.build.vm; }; </ins> } ]; });


Question:
Describe the bug It was left out being implemented in the initial PR , but it's a very useful feature for nixos development and endusers. I do understand it's nothing can't do, but it's a useful wrapper. cc
See for an attempt at adding support for this.

if [[ -z $flake ]]; then pathToConfig="$(nixBuild '<nixpkgs/nixos>' -A vm -k "${extraBuildFlags[@]}")" else <del> echo "$0: 'build-vm' is not supported with '--flake'" >&2 exit 1 </del> <ins> nix "${flakeFlags[@]}" build "$flake#$flakeAttr.config.system.build.vm"  "${extraBuildFlags[@]}" "${lockFlags[@]}" pathToConfig="$(readlink -f ./result)" </ins> fi elif [ "$action" = build-vm-with-bootloader ]; then if [[ -z $flake ]]; then pathToConfig="$(nixBuild '<nixpkgs/nixos>' -A vmWithBootLoader -k "${extraBuildFlags[@]}")" else <del> echo "$0: 'build-vm-with-bootloader' is not supported with '--flake'" >&2 exit 1 </del> <ins> nix "${flakeFlags[@]}" build "$flake#$flakeAttr.config.system.build.vmWithBootLoader"  "${extraBuildFlags[@]}" "${lockFlags[@]}" pathToConfig="$(readlink -f ./result)" </ins> fi else showSyntax


Question: ping It was agreed that should be removed before . It was generally accepted that an option isn't a great idea and was to the module temporarily for ease of testing. It is important to remove this because other people have seen this option and started believing this is an accepted design pattern for NixOS modules - we don't want people getting the wrong idea and having more options like this slip in. can you please file a PR removing this option and the entry from the release notes?

</listitem> <listitem> <para> <del> Add option <literal>services.nginx.enableSandbox</literal> to starting Nginx web server with additional sandbox/hardening options. By default, write access to <literal>services.nginx.stateDir</literal> is allowed. To allow writing to other folders, </del> <ins> Nginx web server now starting with additional sandbox/hardening options. By default, write access to <literal>services.nginx.stateDir</literal> is allowed. To allow writing to other folders, </ins> use <literal>systemd.services.nginx.serviceConfig.ReadWritePaths</literal> <programlisting> systemd.services.nginx.serviceConfig.ReadWritePaths = [ "/var/www" ];


Question: ping It was agreed that should be removed before . It was generally accepted that an option isn't a great idea and was to the module temporarily for ease of testing. It is important to remove this because other people have seen this option and started believing this is an accepted design pattern for NixOS modules - we don't want people getting the wrong idea and having more options like this slip in. can you please file a PR removing this option and the entry from the release notes?

''; }; <del> enableSandbox = mkOption { default = false; type = types.bool; description = '' Starting Nginx web server with additional sandbox/hardening options. ''; }; </del> user = mkOption { type = types.str; default = "nginx";


Question: ping It was agreed that should be removed before . It was generally accepted that an option isn't a great idea and was to the module temporarily for ease of testing. It is important to remove this because other people have seen this option and started believing this is an accepted design pattern for NixOS modules - we don't want people getting the wrong idea and having more options like this slip in. can you please file a PR removing this option and the entry from the release notes?

CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" "CAP_SYS_RESOURCE" ]; # Security NoNewPrivileges = true; <del> } // optionalAttrs cfg.enableSandbox { </del> # Sandboxing ProtectSystem = "strict"; ProtectHome = mkDefault true;


Question: ping It was agreed that should be removed before . It was generally accepted that an option isn't a great idea and was to the module temporarily for ease of testing. It is important to remove this because other people have seen this option and started believing this is an accepted design pattern for NixOS modules - we don't want people getting the wrong idea and having more options like this slip in. can you please file a PR removing this option and the entry from the release notes?

]; services.nginx.enable = true; services.nginx.package = pkgs.nginx-lua; <del> services.nginx.enableSandbox = true; </del> services.nginx.virtualHosts.localhost = { extraConfig = '' location /test1-write {


Question:
Describe the bug I am trying to install (cli version) on macos from the unstable channel but I a getting the following error: To Reproduce Steps to reproduce the behavior: Expected behavior joplin should be installed correctly Screenshots N/A Additional context Notify maintainers Unfortunaltely maintainers are not specified :( Metadata system: host os: multi-user?: sandbox: version: channels(dbarrosop): nixpkgs:
I marked this as stale due to inactivity. →

libsecret self.node-gyp-build self.node-pre-gyp <ins> ] ++ lib.optionals stdenv.isDarwin [ darwin.apple_sdk.frameworks.AppKit darwin.apple_sdk.frameworks.Security </ins> ]; };


Question:
Describe the bug The file has this function: Since this is called for every dependency, we get quadratic complexity. This may cause a non-trivial slowdown - building digikam I noticed it takes a few seconds just to get to , but there might be other causes. It also causes huge amounts of debug output when you add a to (about 600 MB for digikam). We should use an associative array for this like stdenv does (see ). Notify maintainers
We also need to do this in the setup hook for paths seen by .
I marked this as stale due to inactivity. →
Not stale.
Fixed in .

"wallpapers" "applications" "desktop-directories" "mime" "appdata" "dbus-1"  ) <del> ecmHostPathSeen=( ) </del> <ins> # ecmHostPathsSeen is an associative array of the paths that have already been # seen by ecmHostPathHook. declare -gA ecmHostPathsSeen </ins> <del> ecmUnseenHostPath() { for pkg in "${ecmHostPathSeen[@]}" do if [ "${pkg:?}" == "$1" ] then return 1 fi done ecmHostPathSeen+=("$1") return 0 </del> <ins> ecmHostPathIsNotSeen() { if [[ -n "${ecmHostPathsSeen["$1"]:-}" ]]; then # The path has been seen before. return 1 else # The path has not been seen before. # Now it is seen, so record it. ecmHostPathsSeen["$1"]=1 return 0 fi </ins> } ecmHostPathHook() { <del> ecmUnseenHostPath "$1" || return 0 </del> <ins> ecmHostPathIsNotSeen "$1" || return 0 </ins> local xdgConfigDir="$1/etc/xdg" if [ -d "$xdgConfigDir" ]


Question: , CVSSv3=9.8 (nixos-20.03, nixos-20.09, nixos-unstable) Scanned versions: nixos-20.03: ; nixos-20.09: ; nixos-unstable: . Cc

<ins> Description: patch for CVE-2020-14315 A memory corruption vulnerability is present in bspatch as shipped in Colin Percival’s bsdiff tools version 4.3. Insufficient checks when handling external inputs allows an attacker to bypass the sanity checks in place and write out of a dynamically allocated buffer boundaries. Source: https://svnweb.freebsd.org/base/head/usr.bin/bsdiff/bspatch/bspatch.c?revision=352742&view=co Author: tony mancill <tmancill@debian.org> Comment: The patch was created by comparing the Debian sources to the "Confirmed Patched Version" [1] documented in the X41 D-SEC GmbH Security Advisory: X41-2020-006 [2]. References to FreeBSD capsicum have been dropped.  Definitions for TYPE_MINIMUM and TYPE_MAXIMUM have been borrowed from the Debian coreutils package sources but originate in gnulib [3] and are used to define OFF_MIN and OFF_MAX (limits of off_t). Whitespace changes from the confirmed patched version are also included and keep the difference between the Debian sources and the confirmed patched version minimal. . [1] https://svnweb.freebsd.org/base/head/usr.bin/bsdiff/bspatch/bspatch.c?revision=352742&view=co [2] https://www.openwall.com/lists/oss-security/2020/07/09/2 [3] https://www.gnu.org/software/gnulib/ Last-Update: 2021-04-03 Forwarded: not-needed Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=964796 --- a/bspatch.c +++ b/bspatch.c @@ -1,4 +1,6 @@ /*- + * SPDX-License-Identifier: BSD-2-Clause-FreeBSD + * * Copyright 2003-2005 Colin Percival * All rights reserved * @@ -24,56 +26,148 @@ * POSSIBILITY OF SUCH DAMAGE. */ +#include <sys/cdefs.h> #if 0 -__FBSDID("$FreeBSD: src/usr.bin/bsdiff/bspatch/bspatch.c,v 1.1 2005/08/06 01:59:06 cperciva Exp $"); +__FBSDID("$FreeBSD$"); #endif #include <bzlib.h> -#include <stdlib.h> +#include <err.h> +#include <fcntl.h> +#include <libgen.h> +#include <limits.h> +#include <stdint.h> #include <stdio.h> +#include <stdlib.h> #include <string.h> -#include <err.h> #include <unistd.h> -#include <fcntl.h> + +#ifndef O_BINARY +#define O_BINARY 0 +#endif +#define HEADER_SIZE 32 + +/* TYPE_MINIMUM and TYPE_MAXIMUM taken from coreutils */ +#ifndef TYPE_MINIMUM +#define TYPE_MINIMUM(t)  +  ((t) ((t) 0 < (t) -1 ? (t) 0 : ~ TYPE_MAXIMUM (t))) +#endif +#ifndef TYPE_MAXIMUM +#define TYPE_MAXIMUM(t)  +  ((t) ((t) 0 < (t) -1  +        ? (t) -1  +        : ((((t) 1 << (sizeof (t) * CHAR_BIT - 2)) - 1) * 2 + 1))) +#endif + +#ifndef OFF_MAX +#define OFF_MAX TYPE_MAXIMUM(off_t) +#endif + +#ifndef OFF_MIN +#define OFF_MIN TYPE_MINIMUM(off_t) +#endif + +static char *newfile; +static int dirfd = -1; + +static void +exit_cleanup(void) +{ + +	if (dirfd != -1 && newfile != NULL) +		if (unlinkat(dirfd, newfile, 0)) +			warn("unlinkat"); +} + +static inline off_t +add_off_t(off_t a, off_t b) +{ +	off_t result; + +#if __GNUC__ >= 5 +	if (__builtin_add_overflow(a, b, &result)) +		errx(1, "Corrupt patch"); +#else +	if ((b > 0 && a > OFF_MAX - b) || (b < 0 && a < OFF_MIN - b)) +		errx(1, "Corrupt patch"); +	result = a + b; +#endif +	return result; +} static off_t offtin(u_char *buf) { off_t y; -	y=buf[7]&0x7F; -	y=y*256;y+=buf[6]; -	y=y*256;y+=buf[5]; -	y=y*256;y+=buf[4]; -	y=y*256;y+=buf[3]; -	y=y*256;y+=buf[2]; -	y=y*256;y+=buf[1]; -	y=y*256;y+=buf[0]; +	y = buf[7] & 0x7F; +	y = y * 256; y += buf[6]; +	y = y * 256; y += buf[5]; +	y = y * 256; y += buf[4]; +	y = y * 256; y += buf[3]; +	y = y * 256; y += buf[2]; +	y = y * 256; y += buf[1]; +	y = y * 256; y += buf[0]; -	if(buf[7]&0x80) y=-y; +	if (buf[7] & 0x80) +		y = -y; -	return y; +	return (y); } -int main(int argc,char * argv[]) +static void +usage(void) { -	FILE * f, * cpf, * dpf, * epf; -	BZFILE * cpfbz2, * dpfbz2, * epfbz2; + +	fprintf(stderr, "usage: bspatch oldfile newfile patchfilen"); +	exit(1); +} + +int main(int argc, char *argv[]) +{ +	FILE *f, *cpf, *dpf, *epf; +	BZFILE *cpfbz2, *dpfbz2, *epfbz2; +	char *directory, *namebuf; int cbz2err, dbz2err, ebz2err; -	int fd; -	ssize_t oldsize,newsize; -	ssize_t bzctrllen,bzdatalen; -	u_char header[32],buf[8]; +	int newfd, oldfd; +	off_t oldsize, newsize; +	off_t bzctrllen, bzdatalen; +	u_char header[HEADER_SIZE], buf[8]; u_char *old, *new; -	off_t oldpos,newpos; +	off_t oldpos, newpos; off_t ctrl[3]; -	off_t lenread; -	off_t i; +	off_t i, lenread, offset; -	if(argc!=4) errx(1,"usage: %s oldfile newfile patchfilen",argv[0]); +	if (argc != 4) +		usage(); /* Open patch file */ -	if ((f = fopen(argv[3], "r")) == NULL) +	if ((f = fopen(argv[3], "rb")) == NULL) +		err(1, "fopen(%s)", argv[3]); +	/* Open patch file for control block */ +	if ((cpf = fopen(argv[3], "rb")) == NULL) +		err(1, "fopen(%s)", argv[3]); +	/* open patch file for diff block */ +	if ((dpf = fopen(argv[3], "rb")) == NULL) err(1, "fopen(%s)", argv[3]); +	/* open patch file for extra block */ +	if ((epf = fopen(argv[3], "rb")) == NULL) +		err(1, "fopen(%s)", argv[3]); +	/* open oldfile */ +	if ((oldfd = open(argv[1], O_RDONLY | O_BINARY, 0)) < 0) +		err(1, "open(%s)", argv[1]); +	/* open directory where we'll write newfile */ +	if ((namebuf = strdup(argv[2])) == NULL || +	    (directory = dirname(namebuf)) == NULL || +	    (dirfd = open(directory, O_DIRECTORY)) < 0) +		err(1, "open %s", argv[2]); +	free(namebuf); +	if ((newfile = basename(argv[2])) == NULL) +		err(1, "basename"); +	/* open newfile */ +	if ((newfd = openat(dirfd, newfile, +	    O_CREAT | O_TRUNC | O_WRONLY | O_BINARY, 0666)) < 0) +		err(1, "open(%s)", argv[2]); +	atexit(exit_cleanup); /* File format: @@ -90,104 +185,104 @@ */ /* Read header */ -	if (fread(header, 1, 32, f) < 32) { +	if (fread(header, 1, HEADER_SIZE, f) < HEADER_SIZE) { if (feof(f)) -			errx(1, "Corrupt patchn"); +			errx(1, "Corrupt patch"); err(1, "fread(%s)", argv[3]); } /* Check for appropriate magic */ if (memcmp(header, "BSDIFF40", 8) != 0) -		errx(1, "Corrupt patchn"); +		errx(1, "Corrupt patch"); /* Read lengths from header */ -	bzctrllen=offtin(header+8); -	bzdatalen=offtin(header+16); -	newsize=offtin(header+24); -	if((bzctrllen<0) || (bzdatalen<0) || (newsize<0)) -		errx(1,"Corrupt patchn"); +	bzctrllen = offtin(header + 8); +	bzdatalen = offtin(header + 16); +	newsize = offtin(header + 24); +	if (bzctrllen < 0 || bzctrllen > OFF_MAX - HEADER_SIZE || +	    bzdatalen < 0 || bzctrllen + HEADER_SIZE > OFF_MAX - bzdatalen || +	    newsize < 0 || newsize > SSIZE_MAX) +		errx(1, "Corrupt patch"); /* Close patch file and re-open it via libbzip2 at the right places */ if (fclose(f)) err(1, "fclose(%s)", argv[3]); -	if ((cpf = fopen(argv[3], "r")) == NULL) -		err(1, "fopen(%s)", argv[3]); -	if (fseeko(cpf, 32, SEEK_SET)) -		err(1, "fseeko(%s, %lld)", argv[3], -		    (long long)32); +	offset = HEADER_SIZE; +	if (fseeko(cpf, offset, SEEK_SET)) +		err(1, "fseeko(%s, %jd)", argv[3], (intmax_t)offset); if ((cpfbz2 = BZ2_bzReadOpen(&cbz2err, cpf, 0, 0, NULL, 0)) == NULL) errx(1, "BZ2_bzReadOpen, bz2err = %d", cbz2err); -	if ((dpf = fopen(argv[3], "r")) == NULL) -		err(1, "fopen(%s)", argv[3]); -	if (fseeko(dpf, 32 + bzctrllen, SEEK_SET)) -		err(1, "fseeko(%s, %lld)", argv[3], -		    (long long)(32 + bzctrllen)); +	offset = add_off_t(offset, bzctrllen); +	if (fseeko(dpf, offset, SEEK_SET)) +		err(1, "fseeko(%s, %jd)", argv[3], (intmax_t)offset); if ((dpfbz2 = BZ2_bzReadOpen(&dbz2err, dpf, 0, 0, NULL, 0)) == NULL) errx(1, "BZ2_bzReadOpen, bz2err = %d", dbz2err); -	if ((epf = fopen(argv[3], "r")) == NULL) -		err(1, "fopen(%s)", argv[3]); -	if (fseeko(epf, 32 + bzctrllen + bzdatalen, SEEK_SET)) -		err(1, "fseeko(%s, %lld)", argv[3], -		    (long long)(32 + bzctrllen + bzdatalen)); +	offset = add_off_t(offset, bzdatalen); +	if (fseeko(epf, offset, SEEK_SET)) +		err(1, "fseeko(%s, %jd)", argv[3], (intmax_t)offset); if ((epfbz2 = BZ2_bzReadOpen(&ebz2err, epf, 0, 0, NULL, 0)) == NULL) errx(1, "BZ2_bzReadOpen, bz2err = %d", ebz2err); -	if(((fd=open(argv[1],O_RDONLY,0))<0) || -		((oldsize=lseek(fd,0,SEEK_END))==-1) || -		((old=malloc(oldsize+1))==NULL) || -		(lseek(fd,0,SEEK_SET)!=0) || -		(read(fd,old,oldsize)!=oldsize) || -		(close(fd)==-1)) err(1,"%s",argv[1]); -	if((new=malloc(newsize+1))==NULL) err(1,NULL); - -	oldpos=0;newpos=0; -	while(newpos<newsize) { +	if ((oldsize = lseek(oldfd, 0, SEEK_END)) == -1 || +	    oldsize > SSIZE_MAX || +	    (old = malloc(oldsize)) == NULL || +	    lseek(oldfd, 0, SEEK_SET) != 0 || +	    read(oldfd, old, oldsize) != oldsize || +	    close(oldfd) == -1) +		err(1, "%s", argv[1]); +	if ((new = malloc(newsize)) == NULL) +		err(1, NULL); + +	oldpos = 0; +	newpos = 0; +	while (newpos < newsize) { /* Read control data */ -		for(i=0;i<=2;i++) { +		for (i = 0; i <= 2; i++) { lenread = BZ2_bzRead(&cbz2err, cpfbz2, buf, 8); if ((lenread < 8) || ((cbz2err != BZ_OK) && (cbz2err != BZ_STREAM_END))) -				errx(1, "Corrupt patchn"); -			ctrl[i]=offtin(buf); -		}; +				errx(1, "Corrupt patch"); +			ctrl[i] = offtin(buf); +		} /* Sanity-check */ -		if ((ctrl[0] < 0) || (ctrl[1] < 0)) -			errx(1,"Corrupt patchn"); +		if (ctrl[0] < 0 || ctrl[0] > INT_MAX || +		    ctrl[1] < 0 || ctrl[1] > INT_MAX) +			errx(1, "Corrupt patch"); /* Sanity-check */ -		if(newpos+ctrl[0]>newsize) -			errx(1,"Corrupt patchn"); +		if (add_off_t(newpos, ctrl[0]) > newsize) +			errx(1, "Corrupt patch"); /* Read diff string */ lenread = BZ2_bzRead(&dbz2err, dpfbz2, new + newpos, ctrl[0]); if ((lenread < ctrl[0]) || ((dbz2err != BZ_OK) && (dbz2err != BZ_STREAM_END))) -			errx(1, "Corrupt patchn"); +			errx(1, "Corrupt patch"); /* Add old data to diff string */ -		for(i=0;i<ctrl[0];i++) -			if((oldpos+i>=0) && (oldpos+i<oldsize)) -				new[newpos+i]+=old[oldpos+i]; +		for (i = 0; i < ctrl[0]; i++) +			if (add_off_t(oldpos, i) < oldsize) +				new[newpos + i] += old[oldpos + i]; /* Adjust pointers */ -		newpos+=ctrl[0]; -		oldpos+=ctrl[0]; +		newpos = add_off_t(newpos, ctrl[0]); +		oldpos = add_off_t(oldpos, ctrl[0]); /* Sanity-check */ -		if(newpos+ctrl[1]>newsize) -			errx(1,"Corrupt patchn"); +		if (add_off_t(newpos, ctrl[1]) > newsize) +			errx(1, "Corrupt patch"); /* Read extra string */ lenread = BZ2_bzRead(&ebz2err, epfbz2, new + newpos, ctrl[1]); if ((lenread < ctrl[1]) || ((ebz2err != BZ_OK) && (ebz2err != BZ_STREAM_END))) -			errx(1, "Corrupt patchn"); +			errx(1, "Corrupt patch"); /* Adjust pointers */ -		newpos+=ctrl[1]; -		oldpos+=ctrl[2]; -	}; +		newpos = add_off_t(newpos, ctrl[1]); +		oldpos = add_off_t(oldpos, ctrl[2]); +	} /* Clean up the bzip2 reads */ BZ2_bzReadClose(&cbz2err, cpfbz2); @@ -197,12 +292,13 @@ err(1, "fclose(%s)", argv[3]); /* Write the new file */ -	if(((fd=open(argv[2],O_CREAT|O_TRUNC|O_WRONLY,0666))<0) || -		(write(fd,new,newsize)!=newsize) || (close(fd)==-1)) -		err(1,"%s",argv[2]); +	if (write(newfd, new, newsize) != newsize || close(newfd) == -1) +		err(1, "%s", argv[2]); +	/* Disable atexit cleanup */ +	newfile = NULL; free(new); free(old); -	return 0; +	return (0); } </ins>


Question: , CVSSv3=9.8 (nixos-20.03, nixos-20.09, nixos-unstable) Scanned versions: nixos-20.03: ; nixos-20.09: ; nixos-unstable: . Cc

<del> { lib, stdenv, fetchurl, bzip2 }: </del> <ins> { lib, stdenv, fetchurl, fetchpatch, bzip2 }: </ins> stdenv.mkDerivation rec { pname = "bsdiff";


Question: , CVSSv3=9.8 (nixos-20.03, nixos-20.09, nixos-unstable) Scanned versions: nixos-20.03: ; nixos-20.09: ; nixos-unstable: . Cc

}; buildInputs = [ bzip2 ]; <del> patches = [ ./include-systypes.patch ]; </del> <ins> patches = [ (fetchpatch { url = "https://sources.debian.org/data/main/b/bsdiff/4.3-22/debian/patches/20-CVE-2014-9862.patch"; sha256 = "sha256-3UuUfNvShQ8fLqxCKUTb/n4BmjL4+Nl7aEqCxYrrERQ="; }) ./CVE-2020-14315.patch ./include-systypes.patch ] ++ lib.optional stdenv.hostPlatform.isLinux [ (fetchpatch { url = "https://sources.debian.org/data/main/b/bsdiff/4.3-22/debian/patches/30-bug-632585-mmap-src-file-instead-of-malloc-read-it.patch"; sha256 = "sha256-esbhz2/efUiuQDuF7LGfSeEn3/f1WbqCxQpTs2A0ulI="; }) (fetchpatch { url = "https://sources.debian.org/data/main/b/bsdiff/4.3-22/debian/patches/31-bug-632585-mmap-dst-file-instead-of-malloc-read-it.patch"; sha256 = "sha256-Of4aOcI0rsgdRzPqyw2VRn2p9wQuo3hdlgDTBdXGzoc="; }) (fetchpatch { url = "https://sources.debian.org/data/main/b/bsdiff/4.3-22/debian/patches/32-bug-632585-use-int32_t-instead-off_t-for-file-size.patch"; sha256 = "sha256-SooFnFK4uKNXvXQb/LEcH8GocnRtkryExI4b3BZTsAY="; }) ]; </ins> buildPhase = '' $CC -O3 -lbz2 bspatch.c -o bspatch


Question:
Describe the bug According to and , noto-fonts-cjk should have 14 ttc files, but noto-fonts-cjk in nixpkgs downloads from , this zip files doesn't include serif fonts. To Reproduce Steps to reproduce the behavior: -env -iA -list : family | grep 'Noto Serif CJK' Expected behavior It should output: Notify maintainers Metadata Please run and paste the result.
The nix file should download 14 .ttc files and install to target directory in a loop, it's a simple logic, but sorry I'm not familiar with Nix language yet. Mention more people involved in this file since 2020: hope this gets fixed soon, thanks!
As I recall, the issue with packaging it initially is there was no Super OTC version of the noto serif cjk font available. There still isn't a Super OTC in the repository. There is https://noto-website- from , but that URL doesn't look stable. I guess for now you could use , it is 99% the same font.
, thanks for your quick response! Although is almost same, fontconfig can’t assure it will alway be selected for document using , there are a few other popular cjk font such as Arphic PR UMing & UKai, WenQuanYi, GNU freefont, GNU unifont. Like Debian, Gentoo also packages separate ttc files. FreeBSD even packages separate otf font, I guess this can save some memory and time for applications to load a font subset. It’s a pity google doesn’t upload a single super otc file for noto serif cjk, but I guess the huge noto sans zip is uploaded to git by mistake, it’s kept there just to not break download url. So I suggest just packaging 14 separate ttc file, it’s convenient enough compared to those separate otf files. Another reminder, it’s better to also include a fontconfig configuration snippet like Debian and Gentoo.
Arch also packages separate ttc and include a fontconfig configuration file.
I marked this as stale due to inactivity. →
Still important to me.

<literal>~/.local/share/polymc/polymc.cfg</literal>. </para> </listitem> <ins> <listitem> <para> <literal>pkgs.noto-fonts-cjk</literal> is now deprecated in favor of <literal>pkgs.noto-fonts-cjk-sans</literal> and <literal>pkgs.noto-fonts-cjk-serif</literal> because they each have different release schedules. To maintain compatibility with prior releases of Nixpkgs, <literal>pkgs.noto-fonts-cjk</literal> is currently an alias of <literal>pkgs.noto-fonts-cjk-sans</literal> and doesn’t include serif fonts. </para> </listitem> </ins> </itemizedlist> </section> <section xml:id="sec-release-22.05-notable-changes">


Question:
Describe the bug According to and , noto-fonts-cjk should have 14 ttc files, but noto-fonts-cjk in nixpkgs downloads from , this zip files doesn't include serif fonts. To Reproduce Steps to reproduce the behavior: -env -iA -list : family | grep 'Noto Serif CJK' Expected behavior It should output: Notify maintainers Metadata Please run and paste the result.
The nix file should download 14 .ttc files and install to target directory in a loop, it's a simple logic, but sorry I'm not familiar with Nix language yet. Mention more people involved in this file since 2020: hope this gets fixed soon, thanks!
As I recall, the issue with packaging it initially is there was no Super OTC version of the noto serif cjk font available. There still isn't a Super OTC in the repository. There is https://noto-website- from , but that URL doesn't look stable. I guess for now you could use , it is 99% the same font.
, thanks for your quick response! Although is almost same, fontconfig can’t assure it will alway be selected for document using , there are a few other popular cjk font such as Arphic PR UMing & UKai, WenQuanYi, GNU freefont, GNU unifont. Like Debian, Gentoo also packages separate ttc files. FreeBSD even packages separate otf font, I guess this can save some memory and time for applications to load a font subset. It’s a pity google doesn’t upload a single super otc file for noto serif cjk, but I guess the huge noto sans zip is uploaded to git by mistake, it’s kept there just to not break download url. So I suggest just packaging 14 separate ttc file, it’s convenient enough compared to those separate otf files. Another reminder, it’s better to also include a fontconfig configuration snippet like Debian and Gentoo.
Arch also packages separate ttc and include a fontconfig configuration file.
I marked this as stale due to inactivity. →
Still important to me.

- MultiMC has been replaced with the fork PolyMC due to upstream developers being hostile to 3rd party package maintainers. PolyMC removes all MultiMC branding and is aimed at providing proper 3rd party packages like the one contained in Nixpkgs. This change affects the data folder where game instances and other save and configuration files are stored. Users with existing installations should rename `~/.local/share/multimc` to `~/.local/share/polymc`. The main config file's path has also moved from `~/.local/share/multimc/multimc.cfg` to `~/.local/share/polymc/polymc.cfg`. <ins> - `pkgs.noto-fonts-cjk` is now deprecated in favor of `pkgs.noto-fonts-cjk-sans` and `pkgs.noto-fonts-cjk-serif` because they each have different release schedules. To maintain compatibility with prior releases of Nixpkgs, `pkgs.noto-fonts-cjk` is currently an alias of `pkgs.noto-fonts-cjk-sans` and doesn't include serif fonts. </ins> ## Other Notable Changes {#sec-release-22.05-notable-changes} - The option [services.redis.servers](#opt-services.redis.servers) was added


Question:
Describe the bug According to and , noto-fonts-cjk should have 14 ttc files, but noto-fonts-cjk in nixpkgs downloads from , this zip files doesn't include serif fonts. To Reproduce Steps to reproduce the behavior: -env -iA -list : family | grep 'Noto Serif CJK' Expected behavior It should output: Notify maintainers Metadata Please run and paste the result.
The nix file should download 14 .ttc files and install to target directory in a loop, it's a simple logic, but sorry I'm not familiar with Nix language yet. Mention more people involved in this file since 2020: hope this gets fixed soon, thanks!
As I recall, the issue with packaging it initially is there was no Super OTC version of the noto serif cjk font available. There still isn't a Super OTC in the repository. There is https://noto-website- from , but that URL doesn't look stable. I guess for now you could use , it is 99% the same font.
, thanks for your quick response! Although is almost same, fontconfig can’t assure it will alway be selected for document using , there are a few other popular cjk font such as Arphic PR UMing & UKai, WenQuanYi, GNU freefont, GNU unifont. Like Debian, Gentoo also packages separate ttc files. FreeBSD even packages separate otf font, I guess this can save some memory and time for applications to load a font subset. It’s a pity google doesn’t upload a single super otc file for noto serif cjk, but I guess the huge noto sans zip is uploaded to git by mistake, it’s kept there just to not break download url. So I suggest just packaging 14 separate ttc file, it’s convenient enough compared to those separate otf files. Another reminder, it’s better to also include a fontconfig configuration snippet like Debian and Gentoo.
Arch also packages separate ttc and include a fontconfig configuration file.
I marked this as stale due to inactivity. →
Still important to me.

, lib , fetchFromGitHub , fetchurl <del> , fetchzip </del> , cairo , python3 , pkg-config


Question:
Describe the bug According to and , noto-fonts-cjk should have 14 ttc files, but noto-fonts-cjk in nixpkgs downloads from , this zip files doesn't include serif fonts. To Reproduce Steps to reproduce the behavior: -env -iA -list : family | grep 'Noto Serif CJK' Expected behavior It should output: Notify maintainers Metadata Please run and paste the result.
The nix file should download 14 .ttc files and install to target directory in a loop, it's a simple logic, but sorry I'm not familiar with Nix language yet. Mention more people involved in this file since 2020: hope this gets fixed soon, thanks!
As I recall, the issue with packaging it initially is there was no Super OTC version of the noto serif cjk font available. There still isn't a Super OTC in the repository. There is https://noto-website- from , but that URL doesn't look stable. I guess for now you could use , it is 99% the same font.
, thanks for your quick response! Although is almost same, fontconfig can’t assure it will alway be selected for document using , there are a few other popular cjk font such as Arphic PR UMing & UKai, WenQuanYi, GNU freefont, GNU unifont. Like Debian, Gentoo also packages separate ttc files. FreeBSD even packages separate otf font, I guess this can save some memory and time for applications to load a font subset. It’s a pity google doesn’t upload a single super otc file for noto serif cjk, but I guess the huge noto sans zip is uploaded to git by mistake, it’s kept there just to not break download url. So I suggest just packaging 14 separate ttc file, it’s convenient enough compared to those separate otf files. Another reminder, it’s better to also include a fontconfig configuration snippet like Debian and Gentoo.
Arch also packages separate ttc and include a fontconfig configuration file.
I marked this as stale due to inactivity. →
Still important to me.

maintainers = with maintainers; [ mathnerd314 emily ]; }; }; <ins> mkNotoCJK = { typeface, version, rev, sha256 }: stdenvNoCC.mkDerivation { pname = "noto-fonts-cjk-${lib.toLower typeface}"; inherit version; src = fetchFromGitHub { owner = "googlefonts"; repo = "noto-cjk"; inherit rev sha256; }; installPhase = '' install -m444 -Dt $out/share/fonts/opentype/noto-cjk ${typeface}/Variable/OTC/*.otf.ttc ''; meta = with lib; { description = "Beautiful and free fonts for CJK languages"; homepage = "https://www.google.com/get/noto/help/cjk/"; longDescription = '' Noto ${typeface} CJK is a ${lib.toLower typeface} typeface designed as an intermediate style between the modern and traditional. It is intended to be a multi-purpose digital font for user interface designs, digital content, reading on laptops, mobile devices, and electronic books. Noto ${typeface} CJK comprehensively covers Simplified Chinese, Traditional Chinese, Japanese, and Korean in a unified font family. It supports regional variants of ideographic characters for each of the four languages. In addition, it supports Japanese kana, vertical forms, and variant characters (itaiji); it supports Korean hangeul — both contemporary and archaic. ''; license = licenses.ofl; platforms = platforms.all; maintainers = with maintainers; [ mathnerd314 emily ]; }; }; </ins> in {


Question:
Describe the bug According to and , noto-fonts-cjk should have 14 ttc files, but noto-fonts-cjk in nixpkgs downloads from , this zip files doesn't include serif fonts. To Reproduce Steps to reproduce the behavior: -env -iA -list : family | grep 'Noto Serif CJK' Expected behavior It should output: Notify maintainers Metadata Please run and paste the result.
The nix file should download 14 .ttc files and install to target directory in a loop, it's a simple logic, but sorry I'm not familiar with Nix language yet. Mention more people involved in this file since 2020: hope this gets fixed soon, thanks!
As I recall, the issue with packaging it initially is there was no Super OTC version of the noto serif cjk font available. There still isn't a Super OTC in the repository. There is https://noto-website- from , but that URL doesn't look stable. I guess for now you could use , it is 99% the same font.
, thanks for your quick response! Although is almost same, fontconfig can’t assure it will alway be selected for document using , there are a few other popular cjk font such as Arphic PR UMing & UKai, WenQuanYi, GNU freefont, GNU unifont. Like Debian, Gentoo also packages separate ttc files. FreeBSD even packages separate otf font, I guess this can save some memory and time for applications to load a font subset. It’s a pity google doesn’t upload a single super otc file for noto serif cjk, but I guess the huge noto sans zip is uploaded to git by mistake, it’s kept there just to not break download url. So I suggest just packaging 14 separate ttc file, it’s convenient enough compared to those separate otf files. Another reminder, it’s better to also include a fontconfig configuration snippet like Debian and Gentoo.
Arch also packages separate ttc and include a fontconfig configuration file.
I marked this as stale due to inactivity. →
Still important to me.

weights = "{Black,Condensed,Extra,Medium,Semi,Thin}*"; }; <del> noto-fonts-cjk = let zip = fetchzip { url = let rev = "be6c059ac1587e556e2412b27f5155c8eb3ddbe6"; in "https://raw.githubusercontent.com/googlefonts/noto-cjk/${rev}/NotoSansCJK.ttc.zip"; # __MACOSX... stripRoot = false; sha256 = "0ik4z2b15i0pghskgfm3adzb0h35fr4gyzvz3bq49hhkhn9h85vi"; }; in stdenvNoCC.mkDerivation { pname = "noto-fonts-cjk"; version = "2.001"; buildCommand = '' install -m444 -Dt $out/share/fonts/opentype/noto-cjk ${zip}/*.ttc ''; </del> <ins> noto-fonts-cjk-sans = mkNotoCJK { typeface = "Sans"; version = "2.004"; rev = "9f7f3c38eab63e1d1fddd8d50937fe4f1eacdb1d"; sha256 = "sha256-BX4tcDcz+RGka8mtced1k3BopUJQ14t1BtAVqTjyPik="; }; </ins> <del> meta = with lib; { description = "Beautiful and free fonts for CJK languages"; homepage = "https://www.google.com/get/noto/help/cjk/"; longDescription = '' Noto Sans CJK is a sans serif typeface designed as an intermediate style between the modern and traditional. It is intended to be a multi-purpose digital font for user interface designs, digital content, reading on laptops, mobile devices, and electronic books. Noto Sans CJK comprehensively covers Simplified Chinese, Traditional Chinese, Japanese, and Korean in a unified font family. It supports regional variants of ideographic characters for each of the four languages. In addition, it supports Japanese kana, vertical forms, and variant characters (itaiji); it supports Korean hangeul — both contemporary and archaic. ''; license = licenses.ofl; platforms = platforms.all; maintainers = with maintainers; [ mathnerd314 emily ]; }; </del> <ins> noto-fonts-cjk-serif = mkNotoCJK { typeface = "Serif"; version = "2.000"; rev = "9f7f3c38eab63e1d1fddd8d50937fe4f1eacdb1d"; sha256 = "sha256-BX4tcDcz+RGka8mtced1k3BopUJQ14t1BtAVqTjyPik="; </ins> }; noto-fonts-emoji = let


Question:
Describe the bug According to and , noto-fonts-cjk should have 14 ttc files, but noto-fonts-cjk in nixpkgs downloads from , this zip files doesn't include serif fonts. To Reproduce Steps to reproduce the behavior: -env -iA -list : family | grep 'Noto Serif CJK' Expected behavior It should output: Notify maintainers Metadata Please run and paste the result.
The nix file should download 14 .ttc files and install to target directory in a loop, it's a simple logic, but sorry I'm not familiar with Nix language yet. Mention more people involved in this file since 2020: hope this gets fixed soon, thanks!
As I recall, the issue with packaging it initially is there was no Super OTC version of the noto serif cjk font available. There still isn't a Super OTC in the repository. There is https://noto-website- from , but that URL doesn't look stable. I guess for now you could use , it is 99% the same font.
, thanks for your quick response! Although is almost same, fontconfig can’t assure it will alway be selected for document using , there are a few other popular cjk font such as Arphic PR UMing & UKai, WenQuanYi, GNU freefont, GNU unifont. Like Debian, Gentoo also packages separate ttc files. FreeBSD even packages separate otf font, I guess this can save some memory and time for applications to load a font subset. It’s a pity google doesn’t upload a single super otc file for noto serif cjk, but I guess the huge noto sans zip is uploaded to git by mistake, it’s kept there just to not break download url. So I suggest just packaging 14 separate ttc file, it’s convenient enough compared to those separate otf files. Another reminder, it’s better to also include a fontconfig configuration snippet like Debian and Gentoo.
Arch also packages separate ttc and include a fontconfig configuration file.
I marked this as stale due to inactivity. →
Still important to me.

nmap-unfree = nmap; # added 2021-04-06 nologin = shadow; # added 2018-04-25 nordic-polar = throw "nordic-polar was removed on 2021-05-27, now integrated in nordic"; # added 2021-05-27 <ins> noto-fonts-cjk = noto-fonts-cjk-sans; # added 2021-12-16 </ins> now-cli = throw "now-cli has been replaced with nodePackages.vercel"; # added 2021-08-05 nxproxy = nx-libs; # added 2019-02-15 nylas-mail-bin = throw "nylas-mail-bin was deprecated on 2019-09-11: abandoned by upstream";


Question:
Describe the bug According to and , noto-fonts-cjk should have 14 ttc files, but noto-fonts-cjk in nixpkgs downloads from , this zip files doesn't include serif fonts. To Reproduce Steps to reproduce the behavior: -env -iA -list : family | grep 'Noto Serif CJK' Expected behavior It should output: Notify maintainers Metadata Please run and paste the result.
The nix file should download 14 .ttc files and install to target directory in a loop, it's a simple logic, but sorry I'm not familiar with Nix language yet. Mention more people involved in this file since 2020: hope this gets fixed soon, thanks!
As I recall, the issue with packaging it initially is there was no Super OTC version of the noto serif cjk font available. There still isn't a Super OTC in the repository. There is https://noto-website- from , but that URL doesn't look stable. I guess for now you could use , it is 99% the same font.
, thanks for your quick response! Although is almost same, fontconfig can’t assure it will alway be selected for document using , there are a few other popular cjk font such as Arphic PR UMing & UKai, WenQuanYi, GNU freefont, GNU unifont. Like Debian, Gentoo also packages separate ttc files. FreeBSD even packages separate otf font, I guess this can save some memory and time for applications to load a font subset. It’s a pity google doesn’t upload a single super otc file for noto serif cjk, but I guess the huge noto sans zip is uploaded to git by mistake, it’s kept there just to not break download url. So I suggest just packaging 14 separate ttc file, it’s convenient enough compared to those separate otf files. Another reminder, it’s better to also include a fontconfig configuration snippet like Debian and Gentoo.
Arch also packages separate ttc and include a fontconfig configuration file.
I marked this as stale due to inactivity. →
Still important to me.

nordzy-cursor-theme = callPackage ../data/icons/nordzy-cursor-theme { }; inherit (callPackages ../data/fonts/noto-fonts {}) <del> noto-fonts noto-fonts-cjk noto-fonts-emoji noto-fonts-emoji-blob-bin noto-fonts-extra; </del> <ins> noto-fonts noto-fonts-cjk-sans noto-fonts-cjk-serif noto-fonts-emoji noto-fonts-emoji-blob-bin noto-fonts-extra; </ins> nuclear = callPackage ../applications/audio/nuclear { };