Question:
Project description Cryptomator is an application providing client-side encryption for cloud storage. Metadata homepage URL: source URL: license: GPLv3 platforms: linux, darwin
Source URL:
Hello, I'm a bot and I thank you in the name of the community for opening this issue. To help our human contributors focus on the most-relevant reports, I check up on old issues to see if they're still relevant. This issue has had no activity for 180 days, and so I marked it as stale, but you can rest assured it will never be closed by a non-human. The community would appreciate your effort in checking if the issue is still valid. If it isn't, please close it. If the issue persists, and you'd like to remove the stale label, you simply need to leave a comment. Your comment can be as simple as "still important to me". If you'd like it to get more attention, you can ask for help by searching for maintainers and people that previously touched related code and @ mention them in a comment. You can use or on the relevant files to find them. Lastly, you can always ask for help at or at .
This is still relevant to me. There is currently no way to get transparent encryption on any cloud-drive.
guys, whoever is interested in cryptomator testing/reviewing are welcome: we absolutely need it for darwin platform as well?
Let's first get it merged for linux, we can then base on that and check if we can get darwin working too.

<ins> { lib, stdenv, fetchFromGitHub , autoPatchelfHook , fuse, packer , maven, jdk, jre, makeWrapper, glib, wrapGAppsHook }: let pname = "cryptomator"; version = "1.5.13"; src = fetchFromGitHub { owner = "cryptomator"; repo = "cryptomator"; rev = version; sha256 = "1s9jl3nl6yfjzmilz9b8azk8592nd39xflzfdf38v6s4iiq86r8j"; }; icons = fetchFromGitHub { owner = "cryptomator"; repo = "cryptomator-linux"; rev = version; sha256 = "1x6h6wp6yxnj576874xj3d2jm8jmb7918wprqvlz4sryxhlcssa7"; }; # perform fake build to make a fixed-output derivation out of the files downloaded from maven central (120MB) deps = stdenv.mkDerivation { name = "cryptomator-${version}-deps"; inherit src; nativeBuildInputs = [ jdk maven ]; buildPhase = '' cd main while mvn -Prelease package -Dmaven.repo.local=$out/.m2 -Dmaven.wagon.rto=5000; [ $? = 1 ]; do echo "timeout, restart maven to continue downloading" done ''; # keep only *.{pom,jar,sha1,nbm} and delete all ephemeral files with lastModified timestamps inside installPhase = '' find $out/.m2 -type f -regex '.+(.lastUpdated|resolver-status.properties|_remote.repositories)' -delete find $out/.m2 -type f -iname '*.pom' -exec sed -i -e 's/r+$//' {} ; ''; outputHashAlgo = "sha256"; outputHashMode = "recursive"; outputHash = "06q8bqdz3c4i84wxl9z5861zwdsw8jzcvsbgxqrnh8rwi7500sa7"; }; in stdenv.mkDerivation rec { inherit pname version src; buildPhase = '' cd main mvn -Prelease package --offline -Dmaven.repo.local=$(cp -dpR ${deps}/.m2 ./ && chmod +w -R .m2 && pwd)/.m2 ''; installPhase = '' mkdir -p $out/bin/ $out/usr/share/cryptomator/libs/ cp buildkit/target/libs/* buildkit/target/linux-libs/* $out/usr/share/cryptomator/libs/ makeWrapper ${jre}/bin/java $out/bin/cryptomator  --add-flags "-classpath '$out/usr/share/cryptomator/libs/*'"  --add-flags "-Dcryptomator.settingsPath='~/.config/Cryptomator/settings.json'"  --add-flags "-Dcryptomator.ipcPortPath='~/.config/Cryptomator/ipcPort.bin'"  --add-flags "-Dcryptomator.logDir='~/.local/share/Cryptomator/logs'"  --add-flags "-Dcryptomator.mountPointsDir='~/.local/share/Cryptomator/mnt'"  --add-flags "-Djdk.gtk.version=3"  --add-flags "-Xss20m"  --add-flags "-Xmx512m"  --add-flags "org.cryptomator.launcher.Cryptomator"  --prefix PATH : "$out/usr/share/cryptomator/libs/:${lib.makeBinPath [ jre glib ]}"  --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ fuse ]}"  --set JAVA_HOME "${jre.home}" # install desktop entry and icons cp -r ${icons}/resources/appimage/AppDir/usr $out/ ''; nativeBuildInputs = [ autoPatchelfHook maven makeWrapper wrapGAppsHook jdk ]; buildInputs = [ fuse packer jre glib ]; meta = with lib; { description = "Free client-side encryption for your cloud files"; homepage = "https://cryptomator.org"; license = licenses.gpl3Plus; maintainers = with maintainers; [ bachp ]; platforms = platforms.linux; }; } </ins>


Question:
Project description Cryptomator is an application providing client-side encryption for cloud storage. Metadata homepage URL: source URL: license: GPLv3 platforms: linux, darwin
Source URL:
Hello, I'm a bot and I thank you in the name of the community for opening this issue. To help our human contributors focus on the most-relevant reports, I check up on old issues to see if they're still relevant. This issue has had no activity for 180 days, and so I marked it as stale, but you can rest assured it will never be closed by a non-human. The community would appreciate your effort in checking if the issue is still valid. If it isn't, please close it. If the issue persists, and you'd like to remove the stale label, you simply need to leave a comment. Your comment can be as simple as "still important to me". If you'd like it to get more attention, you can ask for help by searching for maintainers and people that previously touched related code and @ mention them in a comment. You can use or on the relevant files to find them. Lastly, you can always ask for help at or at .
This is still relevant to me. There is currently no way to get transparent encryption on any cloud-drive.
guys, whoever is interested in cryptomator testing/reviewing are welcome: we absolutely need it for darwin platform as well?
Let's first get it merged for linux, we can then base on that and check if we can get darwin working too.

criu = callPackage ../os-specific/linux/criu { }; <ins> cryptomator = callPackage ../tools/security/cryptomator { }; </ins> cryptsetup = callPackage ../os-specific/linux/cryptsetup { }; cramfsprogs = callPackage ../os-specific/linux/cramfsprogs { };


Question:
, CVSSv3=9.8 (nixos-19.03, nixos-19.09, nixos-unstable) Scanned versions: nixos-19.03: ; nixos-19.09: ; nixos-unstable: . May contain false positives.
03 is out of support - we don't backport security fixes there anymore.
But this was also about nixos-unstable.
This was a grave mistake from your side. See

<ins> diff -ur openslp-2.0.0.orig/common/slp_buffer.c openslp-2.0.0/common/slp_buffer.c --- openslp-2.0.0.orig/common/slp_buffer.c	2012-12-10 15:31:53.000000000 -0800 +++ openslp-2.0.0/common/slp_buffer.c	2019-11-26 21:54:20.000000000 -0800 @@ -30,6 +30,13 @@ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. *-------------------------------------------------------------------------*/ +/* Copyright (c) 2019 VMware, Inc. + * SPDX-License-Identifier: BSD-3-Clause + * This file is provided under the BSD-3-Clause license. + * See COPYING file for more details and other copyrights + * that may apply. + */ + /** Functions for managing SLP message buffers. * * This file provides a higher level abstraction over malloc and free that @@ -153,4 +160,20 @@ xfree(buf); } +/** Report remaining free buffer size in bytes. + * + * Check if buffer is allocated and if so return bytes left in a + * @c SLPBuffer object. + * + * @param[in] buf The SLPBuffer to be freed. + */ +size_t +RemainingBufferSpace(SLPBuffer buf) +{ +   if (buf->allocated == 0) { +      return 0; +   } +   return buf->end - buf->curpos; +} + /*=========================================================================*/ diff -ur openslp-2.0.0.orig/common/slp_buffer.h openslp-2.0.0/common/slp_buffer.h --- openslp-2.0.0.orig/common/slp_buffer.h	2012-11-28 09:07:04.000000000 -0800 +++ openslp-2.0.0/common/slp_buffer.h	2019-11-26 21:54:32.000000000 -0800 @@ -30,6 +30,13 @@ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. *-------------------------------------------------------------------------*/ +/* Copyright (c) 2019 VMware, Inc. + * SPDX-License-Identifier: BSD-3-Clause + * This file is provided under the BSD-3-Clause license. + * See COPYING file for more details and other copyrights + * that may apply. + */ + /** Header file that defines SLP message buffer management routines. * * Includes structures, constants and functions that used to handle memory @@ -78,6 +85,8 @@ SLPBuffer SLPBufferListAdd(SLPBuffer * list, SLPBuffer buf); +size_t RemainingBufferSpace(SLPBuffer buf); + /*! @} */ #endif /* SLP_BUFFER_H_INCLUDED */ diff -ur openslp-2.0.0.orig/slpd/slpd_process.c openslp-2.0.0/slpd/slpd_process.c --- openslp-2.0.0.orig/slpd/slpd_process.c	2012-12-12 09:38:54.000000000 -0800 +++ openslp-2.0.0/slpd/slpd_process.c	2019-11-26 21:55:10.000000000 -0800 @@ -30,6 +30,13 @@ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. *-------------------------------------------------------------------------*/ +/* Copyright (c) 2019 VMware, Inc. + * SPDX-License-Identifier: BSD-3-Clause + * This file is provided under the BSD-3-Clause license. + * See COPYING file for more details and other copyrights + * that may apply. + */ + /** Processes incoming SLP messages. * * @file       slpd_process.c @@ -514,13 +521,27 @@ { for (i = 0; i < db->urlcount; i++) { -         /* urlentry is the url from the db result */ urlentry = db->urlarray[i]; +         if (urlentry->opaque != NULL) { +            const int64_t newsize = size + urlentry->opaquelen; +            if (urlentry->opaquelen <= 0 || newsize > INT_MAX) +            { +               SLPDLog("Invalid opaquelen %d or sizeo of opaque url is too big, size=%dn", +                       urlentry->opaquelen, size); +               errorcode = SLP_ERROR_PARSE_ERROR; +               goto FINISHED; +            } +            size +=  urlentry->opaquelen; +         } +         else +         { +            /* urlentry is the url from the db result */ +            size += urlentry->urllen + 6; /*  1 byte for reserved  */ +                                          /*  2 bytes for lifetime */ +                                          /*  2 bytes for urllen   */ +                                          /*  1 byte for authcount */ +          } -         size += urlentry->urllen + 6; /*  1 byte for reserved  */ -                                       /*  2 bytes for lifetime */ -                                       /*  2 bytes for urllen   */ -                                       /*  1 byte for authcount */ #ifdef ENABLE_SLPv2_SECURITY /* make room to include the authblock that was asked for */ if (G_SlpdProperty.securityEnabled @@ -594,7 +615,7 @@ urlentry = db->urlarray[i]; #ifdef ENABLE_SLPv1 -         if (urlentry->opaque == 0) +         if (urlentry->opaque == NULL) { /* url-entry reserved */ *result->curpos++ = 0; @@ -606,8 +627,18 @@ PutUINT16(&result->curpos, urlentry->urllen); /* url-entry url */ -            memcpy(result->curpos, urlentry->url, urlentry->urllen); -            result->curpos += urlentry->urllen; +            if (RemainingBufferSpace(result) >= urlentry->urllen) +            { +               memcpy(result->curpos, urlentry->url, urlentry->urllen); +               result->curpos = result->curpos + urlentry->urllen; +            } +            else +            { +                SLPDLog("Url too big (ask: %d have %" PRId64 "), failing requestn", +                        urlentry->opaquelen, (int64_t) RemainingBufferSpace(result)); +                errorcode = SLP_ERROR_PARSE_ERROR; +                goto FINISHED; +            } /* url-entry auths */ *result->curpos++ = 0; @@ -621,8 +652,18 @@ /* TRICKY: Fix up the lifetime. */ TO_UINT16(urlentry->opaque + 1, urlentry->lifetime); -            memcpy(result->curpos, urlentry->opaque, urlentry->opaquelen); -            result->curpos += urlentry->opaquelen; +            if (RemainingBufferSpace(result) >= urlentry->opaquelen) +            { +               memcpy(result->curpos, urlentry->opaque, urlentry->opaquelen); +               result->curpos = result->curpos + urlentry->opaquelen; +             } +             else +             { +               SLPDLog("Opaque Url too big (ask: %d have %" PRId64 "), failing requestn", +                       urlentry->opaquelen, (int64_t) RemainingBufferSpace(result)); +               errorcode = SLP_ERROR_PARSE_ERROR; +               goto FINISHED; +             } } } } </ins>


Question:
, CVSSv3=9.8 (nixos-19.03, nixos-19.09, nixos-unstable) Scanned versions: nixos-19.03: ; nixos-19.09: ; nixos-unstable: . May contain false positives.
03 is out of support - we don't backport security fixes there anymore.
But this was also about nixos-unstable.
This was a grave mistake from your side. See

sha256 = "0zp61axx93b7nrbsyhn2x4dnw7n9y6g4rys21hyqxk4khrnc2yr9"; }) ./CVE-2016-4912.patch <ins> ./CVE-2019-5544.patch </ins> ]; meta = with lib; {


Question:
Describe the bug I have a NixOS installation with a very simple xserver configuration: When trying to rebuild with master I get an error: To Reproduce Steps to reproduce the behavior: my lines from the above Expected behavior The old configuration should continue to work unless I opt into Metadata Please run and paste the result. Maintainer information: This has to do with cc
Right, looks like there's a bug when constructing the legacy the session name from the legacy defaults. Specifically when only supplying a default for the window manager. Will fix.
IMHO, is only meant for mutable state like database schemata, that does not offer downgrade/rollback path. Abusing it for versioning option tree only adds complexity for little benefit, especially when we already employ other transition aids. Nevertheless, this was an oversight on my part. Something like this might fix it:
What is the proper way to update my configuration to the new system? Where should I look for that information? Are there release notes? I couldn't figure it out from
Yes, release notes are included in the pull request: Also the module system should give you upgrade instruction when we fix the oversight. Could you test the patch above?
Your patch fixes the issue for me.
Closing since this is fixed.
We still need to apply the patch to the nixpkgs.
Oops, thought this was
Yeah, I just looked up that one, but it actually predates me filing the issue and it's currently the latest commit for the file.

''; dmDefault = cfg.desktopManager.default; <ins> # fallback default for cases when only default wm is set dmFallbackDefault = if dmDefault != null then dmDefault else "none"; </ins> wmDefault = cfg.windowManager.default; <del> defaultSessionFromLegacyOptions = concatStringsSep "+" (filter (s: s != null) ([ dmDefault ] ++ optional (wmDefault != "none") wmDefault)); </del> <ins> defaultSessionFromLegacyOptions = dmFallbackDefault + optionalString (wmDefault != null && wmDefault != "none") "+${wmDefault}"; </ins> in


Question:
Describe the bug I have a NixOS installation with a very simple xserver configuration: When trying to rebuild with master I get an error: To Reproduce Steps to reproduce the behavior: my lines from the above Expected behavior The old configuration should continue to work unless I opt into Metadata Please run and paste the result. Maintainer information: This has to do with cc
Right, looks like there's a bug when constructing the legacy the session name from the legacy defaults. Specifically when only supplying a default for the window manager. Will fix.
IMHO, is only meant for mutable state like database schemata, that does not offer downgrade/rollback path. Abusing it for versioning option tree only adds complexity for little benefit, especially when we already employ other transition aids. Nevertheless, this was an oversight on my part. Something like this might fix it:
What is the proper way to update my configuration to the new system? Where should I look for that information? Are there release notes? I couldn't figure it out from
Yes, release notes are included in the pull request: Also the module system should give you upgrade instruction when we fix the oversight. Could you test the patch above?
Your patch fixes the issue for me.
Closing since this is fixed.
We still need to apply the patch to the nixpkgs.
Oops, thought this was
Yeah, I just looked up that one, but it actually predates me filing the issue and it's currently the latest commit for the file.

{ c = wmDefault; t = "- services.xserver.windowManager.default"; } ]))} Please use <del> services.xserver.displayManager.defaultSession = "${concatStringsSep "+" (filter (s: s != null) [ dmDefault wmDefault ])}"; </del> <ins> services.xserver.displayManager.defaultSession = "${defaultSessionFromLegacyOptions}"; </ins> instead. '' ];


Question: Describe the bug I just tried to update my system today. It updated Flexget from 3.0.31 to 3.1.11. Installation went smooth but flexget ultimatively crashes when running. To Reproduce Steps to reproduce the behavior: flexget it it Expected behavior No crash Actual behavior Metadata Please run and paste the result. system: host os: multi-user?: sandbox: version: channels(hyper): channels(root): nixpkgs: Maintainer information:

buildPythonPackage rec { pname = "loguru"; <del> version = "0.4.0"; </del> <ins> version = "0.4.1"; </ins> disabled = isPy27; src = fetchPypi { inherit pname version; <del> sha256 = "d5ddf363b7e0e562652f283f74a89bf35601baf16b70f2cd2736a2f8c6638748"; </del> <ins> sha256 = "a6101fd435ac89ba5205a105a26a6ede9e4ddbb4408a6e167852efca47806d11"; </ins> }; checkInputs = [ pytestCheckHook colorama ]; disabledTests = [ "test_time_rotation_reopening" "test_file_buffering" ] <del> ++ stdenv.lib.optionals stdenv.isDarwin [ "test_rotation_and_retention" "test_rotation_and_retention_timed_file" "test_renaming" ]; </del> <ins> ++ stdenv.lib.optionals stdenv.isDarwin [ "test_rotation_and_retention" "test_rotation_and_retention_timed_file" "test_renaming" "test_await_complete_inheritance" ]; </ins> meta = with stdenv.lib; { homepage = https://github.com/Delgan/loguru;


Question:
Describe the bug See This is because vmTools.diskImageFuns.debian9i386 doesn't build
Hello, I'm a bot and I thank you in the name of the community for opening this issue. To help our human contributors focus on the most-relevant reports, I check up on old issues to see if they're still relevant. This issue has had no activity for 180 days, and so I marked it as stale, but you can rest assured it will never be closed by a non-human. The community would appreciate your effort in checking if the issue is still valid. If it isn't, please close it. If the issue persists, and you'd like to remove the stale label, you simply need to leave a comment. Your comment can be as simple as "still important to me". If you'd like it to get more attention, you can ask for help by searching for maintainers and people that previously touched related code and @ mention them in a comment. You can use or on the relevant files to find them. Lastly, you can always ask for help at or at .
Closing since indicates that it fixed this.

hashed-mirrors = connect-timeout = 1 ''; <ins> # save some memory documentation.enable = false; </ins> }; # /etc/nixos/configuration.nix for the vm configFile = pkgs.writeText "configuration.nix"  ''


Question:
Describe the bug See This is because vmTools.diskImageFuns.debian9i386 doesn't build
Hello, I'm a bot and I thank you in the name of the community for opening this issue. To help our human contributors focus on the most-relevant reports, I check up on old issues to see if they're still relevant. This issue has had no activity for 180 days, and so I marked it as stale, but you can rest assured it will never be closed by a non-human. The community would appreciate your effort in checking if the issue is still valid. If it isn't, please close it. If the issue persists, and you'd like to remove the stale label, you simply need to leave a comment. Your comment can be as simple as "still important to me". If you'd like it to get more attention, you can ask for help by searching for maintainers and people that previously touched related code and @ mention them in a comment. You can use or on the relevant files to find them. Lastly, you can always ask for help at or at .
Closing since indicates that it fixed this.

name = "debian-9.8-stretch-i386"; fullName = "Debian 9.8 Stretch (i386)"; packagesList = fetchurl { <del> url = http://snapshot.debian.org/archive/debian/20190503T090946Z/dists/stretch/main/binary-i386/Packages.xz; sha256 = "1dr3skl35iyj85qlc33lq4whippbqf327vnbcyfqqrv6h86k68mw"; </del> <ins> url = http://snapshot.debian.org/archive/debian/20200301T030401Z/dists/stretch/main/binary-i386/Packages.xz; sha256 = "1jglr1d1jys3xddp8f7w9j05db39fah8xy4gfkpqbd1b5d2caslz"; </ins> }; urlPrefix = mirror://debian; packages = commonDebianPackages;


Question: The soundfont that is packaged in is no longer available. The URL in that file is , but that page says: "Sorry, this is a wrong download link.". No packages depend on this package.

name = "Fluid-3"; src = fetchurl { <del> url = "http://www.musescore.org/download/fluid-soundfont.tar.gz"; </del> <ins> url = "https://ftp.osuosl.org/pub/musescore/soundfont/fluid-soundfont.tar.gz"; </ins> sha256 = "1f96bi0y6rms255yr8dfk436azvwk66c99j6p43iavyq8jg7c5f8"; };


Question:
On current master (). Fails with See also the . Additional context The hscolour derivation mentioned here does not contain in its . It seems sufficient to make be a propagated build input for , after doing so I can build ghc itself. There's a lot of Metadata Maintainer information:
Can you send a PR fixing this?
Done, see
[ ] port to
Since this issue was opened the situation has changed. There's still no ghc on aarch64, but now it fails due to [the lack of aarch64 support][] in (aka ). [the lack of aarch64 support]:
After PR the default ghc builds for aarch64 (, ATM only in branch).

{ stdenv, substituteAll , fetchurl, perl, gcc, llvm , ncurses5, gmp, glibc, libiconv <ins> , llvmPackages </ins> }: # Prebuilt only does native assert stdenv.targetPlatform == stdenv.hostPlatform; let <ins> useLLVM = !stdenv.targetPlatform.isx86; </ins> libPath = stdenv.lib.makeLibraryPath ([ ncurses5 gmp ] ++ stdenv.lib.optional (stdenv.hostPlatform.isDarwin) libiconv);


Question:
On current master (). Fails with See also the . Additional context The hscolour derivation mentioned here does not contain in its . It seems sufficient to make be a propagated build input for , after doing so I can build ghc itself. There's a lot of Metadata Maintainer information:
Can you send a PR fixing this?
Done, see
[ ] port to
Since this issue was opened the situation has changed. There's still no ghc on aarch64, but now it fails due to [the lack of aarch64 support][] in (aka ). [the lack of aarch64 support]:
After PR the default ghc builds for aarch64 (, ATM only in branch).

or (throw "cannot bootstrap GHC on this platform")); nativeBuildInputs = [ perl ]; <del> buildInputs = stdenv.lib.optionals (stdenv.targetPlatform.isAarch32 || stdenv.targetPlatform.isAarch64) [ llvm ]; </del> <ins> propagatedBuildInputs = stdenv.lib.optionals useLLVM [ llvmPackages.llvm ]; </ins> # Cannot patchelf beforehand due to relative RPATHs that anticipate # the final install location/


Question:
Describe the bug The recent Haskell generic-builder changes for Darwin (in particular according to bisect) have broken . To Reproduce from a nixpkgs at or later on Darwin. This fails with . Additional context is a pure Haskell package, that depends on , which is what actually uses the C dynamic library. So the problem seems to be that fails to include the C library in its closure. Interestingly, this C library has filename not , even though it looks exactly like a dylib as far as I can tell (I'm not expert in macOS linking): So I can see why would fail to be included into by . However, I don't see why broke it. Nothing to do with the C or Haskell packages involved has changed for months. Updating the generic-builder to include as well as files does fix the problem for me, and seems benign, so I'll submit a PR for that. But I don't feel I understand everything going on here, so I'm opening the issue in case more qualified folks can identify a better root cause fix. Metadata system: host os: multi-user?: sandbox: version: channels(simon): nixpkgs: Maintainer information: Ping from the original changes - thanks for all your efforts!
Just noting here that there is some useful discussion .

done for d in $(grep '^dynamic-library-dirs:' "$packageConfDir"/* | cut -d' ' -f2- | tr ' ' 'n' | sort -u); do <del> for lib in "$d/"*.dylib; do </del> <ins> for lib in "$d/"*.{dylib,so}; do </ins> ln -s "$lib" "$dynamicLinksDir" done done


Question:
Describe the bug I have installed the du-dust package by attribute name (because if I install by name I get the wrong package), but when I run nix-env -u it gets swapped out for an entirely different dust package. To Reproduce Steps to reproduce the behavior: Expected behavior I would expect the du-dust package to be upgraded if a new version is available, no-op otherwise. Metadata Please run and paste the result. system: host os: multi-user?: sandbox: version: channels(frijters): nixpkgs: Maintainer information: Maybe ?
Thanks!

{ stdenv, fetchFromGitHub, rustPlatform }: rustPlatform.buildRustPackage rec { <del> pname = "dust"; </del> <ins> pname = "du-dust"; </ins> version = "0.5.1"; src = fetchFromGitHub {


Question:
Describe the bug I have installed the du-dust package by attribute name (because if I install by name I get the wrong package), but when I run nix-env -u it gets swapped out for an entirely different dust package. To Reproduce Steps to reproduce the behavior: Expected behavior I would expect the du-dust package to be upgraded if a new version is available, no-op otherwise. Metadata Please run and paste the result. system: host os: multi-user?: sandbox: version: channels(frijters): nixpkgs: Maintainer information: Maybe ?
Thanks!

''; }; <del> cargoSha256 = "1sjzcawyg1xsi4xrx2zwnj8yavzph8k1wgxsffgp55wghzypafwl"; </del> <ins> cargoSha256 = "0s8z8cg9q0gfqm0ann8rkxwp5y25si97kgginh6b6lbnaai7y4fj"; </ins> doCheck = false;


Question: Describe the bug Attempting to start xpra fails with the following X server log: To Reproduce Steps to reproduce the behavior: run start :200

<ins> --- a/src/dummy.h	2016-12-17 23:02:53.396287041 +0100 +++ b/src/dummy.h	2016-12-17 23:03:30.319616550 +0100 @@ -51,6 +51,7 @@ /* options */ OptionInfoPtr Options; Bool swCursor; +    Bool constantDPI; /* proc pointer */ CloseScreenProcPtr CloseScreen; xf86CursorInfoPtr CursorInfo; --- a/src/dummy_driver.c	2016-12-14 21:54:20.000000000 +0100 +++ b/src/dummy_driver.c	2016-12-17 23:04:59.916416126 +0100 @@ -17,6 +17,12 @@ /* All drivers using the mi colormap manipulation need this */ #include "micmap.h" +#ifdef RANDR +#include "randrstr.h" +#endif + +#include "windowstr.h" + /* identifying atom needed by magnifiers */ #include <X11/Xatom.h> #include "property.h" @@ -115,11 +121,15 @@ }; typedef enum { -    OPTION_SW_CURSOR +    OPTION_SW_CURSOR, +    OPTION_CONSTANT_DPI } DUMMYOpts; static const OptionInfoRec DUMMYOptions[] = { { OPTION_SW_CURSOR,	"SWcursor",	OPTV_BOOLEAN,	{0}, FALSE }, +#ifdef RANDR +    { OPTION_CONSTANT_DPI,	"ConstantDPI",	OPTV_BOOLEAN,	{0}, FALSE }, +#endif { -1,                  NULL,           OPTV_NONE,	{0}, FALSE } }; @@ -359,6 +369,7 @@ xf86ProcessOptions(pScrn->scrnIndex, pScrn->options, dPtr->Options); xf86GetOptValBool(dPtr->Options, OPTION_SW_CURSOR,&dPtr->swCursor); +    xf86GetOptValBool(dPtr->Options, OPTION_CONSTANT_DPI, &dPtr->constantDPI); if (device->videoRam != 0) { pScrn->videoRam = device->videoRam; @@ -639,10 +650,45 @@ return TRUE; } +const char *XDPY_PROPERTY = "dummy-constant-xdpi"; +const char *YDPY_PROPERTY = "dummy-constant-ydpi"; +static int get_dpi_value(WindowPtr root, const char *property_name, int default_dpi) +{ +    PropertyPtr prop; +    Atom type_atom = MakeAtom("CARDINAL", 8, TRUE); +    Atom prop_atom = MakeAtom(property_name, strlen(property_name), FALSE); + +    for (prop = wUserProps(root); prop; prop = prop->next) { +       if (prop->propertyName == prop_atom && prop->type == type_atom && prop->data) { +           int v = (int) (*((CARD32 *) prop->data)); +           if ((v>0) && (v<4096)) { +               xf86DrvMsg(0, X_INFO, "get_constant_dpi_value() found property "%s" with value=%in", property_name, (int) v); +               return (int) v; +           } +           break; +       } +    } +    return default_dpi; +} + /* Mandatory */ Bool DUMMYSwitchMode(SWITCH_MODE_ARGS_DECL) { +    SCRN_INFO_PTR(arg); +#ifdef RANDR +    DUMMYPtr dPtr = DUMMYPTR(pScrn); +    if (dPtr->constantDPI) { +        int xDpi = get_dpi_value(pScrn->pScreen->root, XDPY_PROPERTY, pScrn->xDpi); +        int yDpi = get_dpi_value(pScrn->pScreen->root, YDPY_PROPERTY, pScrn->yDpi); +        //25.4 mm per inch: (254/10) +        pScrn->pScreen->mmWidth = mode->HDisplay * 254 / xDpi / 10; +        pScrn->pScreen->mmHeight = mode->VDisplay * 254 / yDpi / 10; +        xf86DrvMsg(pScrn->scrnIndex, X_INFO, "mm(dpi %ix%i)=%ix%in", xDpi, yDpi, pScrn->pScreen->mmWidth, pScrn->pScreen->mmHeight); +        RRScreenSizeNotify(pScrn->pScreen); +        RRTellChanged(pScrn->pScreen); +    } +#endif return TRUE; } </ins>


Question: Describe the bug Attempting to start xpra fails with the following X server log: To Reproduce Steps to reproduce the behavior: run start :200

<ins> --- xf86-video-dummy-0.3.6/src/dummy_driver.c	2014-11-05 19:24:02.668656601 +0700 +++ xf86-video-dummy-0.3.6.new/src/dummy_driver.c	2014-11-05 19:37:53.076061853 +0700 @@ -55,6 +55,9 @@ #include <X11/extensions/xf86dgaproto.h> #endif +/* Needed for fixing pointer limits on resize */ +#include "inputstr.h" + /* Mandatory functions */ static const OptionInfoRec *	DUMMYAvailableOptions(int chipid, int busid); static void     DUMMYIdentify(int flags); @@ -713,6 +716,26 @@ RRTellChanged(pScrn->pScreen); } #endif +    //ensure the screen dimensions are also updated: +    pScrn->pScreen->width = mode->HDisplay; +    pScrn->pScreen->height = mode->VDisplay; +    pScrn->virtualX = mode->HDisplay; +    pScrn->virtualY = mode->VDisplay; +    pScrn->frameX1 = mode->HDisplay; +    pScrn->frameY1 = mode->VDisplay; + +    //ensure the pointer uses the new limits too: +    DeviceIntPtr pDev; +    SpritePtr pSprite; +    for (pDev = inputInfo.devices; pDev; pDev = pDev->next) { +        if (pDev->spriteInfo!=NULL && pDev->spriteInfo->sprite!=NULL) { +            pSprite = pDev->spriteInfo->sprite; +            pSprite->hotLimits.x2 = mode->HDisplay; +            pSprite->hotLimits.y2 = mode->VDisplay; +            pSprite->physLimits.x2 = mode->HDisplay; +            pSprite->physLimits.y2 = mode->VDisplay; +        } +    } return TRUE; } </ins>


Question: Describe the bug Attempting to start xpra fails with the following X server log: To Reproduce Steps to reproduce the behavior: run start :200

<ins> --- a/src/dummy.h	2016-12-17 23:33:33.279533389 +0100 +++ b/src/dummy.h	2016-12-17 23:33:56.695739166 +0100 @@ -69,7 +69,7 @@ int overlay_offset; int videoKey; int interlace; -    dummy_colors colors[256]; +    dummy_colors colors[1024]; pointer* FBBase; Bool        (*CreateWindow)() ;     /* wrapped CreateWindow */ Bool prop; --- a/src/dummy_driver.c	2016-12-17 23:33:47.446657886 +0100 +++ b/src/dummy_driver.c	2016-12-17 23:33:56.696739175 +0100 @@ -317,6 +317,7 @@ case 15: case 16: case 24: +        case 30: break; default: xf86DrvMsg(pScrn->scrnIndex, X_ERROR, @@ -331,8 +332,8 @@ pScrn->rgbBits = 8; /* Get the depth24 pixmap format */ -    if (pScrn->depth == 24 && pix24bpp == 0) -	pix24bpp = xf86GetBppFromDepth(pScrn, 24); +    if (pScrn->depth >= 24 && pix24bpp == 0) +	pix24bpp = xf86GetBppFromDepth(pScrn, pScrn->depth); /* * This must happen after pScrn->display has been set because @@ -623,7 +624,7 @@ if(!miCreateDefColormap(pScreen)) return FALSE; -    if (!xf86HandleColormaps(pScreen, 256, pScrn->rgbBits, +    if (!xf86HandleColormaps(pScreen, 1024, pScrn->rgbBits, DUMMYLoadPalette, NULL, CMAP_PALETTED_TRUECOLOR | CMAP_RELOAD_ON_MODE_SWITCH)) </ins>


Question: Describe the bug Attempting to start xpra fails with the following X server log: To Reproduce Steps to reproduce the behavior: run start :200

<del> { stdenv, lib, fetchurl, callPackage, substituteAll, python3, pkgconfig </del> <ins> { stdenv, lib, fetchurl, callPackage, substituteAll, python3, pkgconfig, writeText </ins> , xorg, gtk3, glib, pango, cairo, gdk-pixbuf, atk , wrapGAppsHook, xorgserver, getopt, xauth, utillinux, which , ffmpeg_4, x264, libvpx, libwebp, x265


Question: Describe the bug Attempting to start xpra fails with the following X server log: To Reproduce Steps to reproduce the behavior: run start :200

let inherit (python3.pkgs) cython buildPythonApplication; <del> xf86videodummy = callPackage ./xf86videodummy { }; </del> <ins> xf86videodummy = xorg.xf86videodummy.overrideDerivation (p: { patches = [ ./0002-Constant-DPI.patch ./0003-fix-pointer-limits.patch ./0005-support-for-30-bit-depth-in-dummy-driver.patch ]; }); xorgModulePaths = writeText "module-paths" '' Section "Files" ModulePath "${xorgserver}/lib/xorg/modules" ModulePath "${xorgserver}/lib/xorg/modules/extensions" ModulePath "${xorgserver}/lib/xorg/modules/drivers" ModulePath "${xf86videodummy}/lib/xorg/modules/drivers" EndSection ''; </ins> in buildPythonApplication rec { pname = "xpra"; version = "3.0.7";


Question: Describe the bug Attempting to start xpra fails with the following X server log: To Reproduce Steps to reproduce the behavior: run start :200

) ''; <ins> # append module paths to xorg.conf postInstall = '' cat ${xorgModulePaths} >> $out/etc/xpra/xorg.conf ''; </ins> doCheck = false; enableParallelBuilding = true;


Question: Describe the bug Attempting to start xpra fails with the following X server log: To Reproduce Steps to reproduce the behavior: run start :200

<del> --- a/src/dummy.h	2016-12-17 23:02:53.396287041 +0100 +++ b/src/dummy.h	2016-12-17 23:03:30.319616550 +0100 @@ -51,6 +51,7 @@ /* options */ OptionInfoPtr Options; Bool swCursor; +    Bool constantDPI; /* proc pointer */ CloseScreenProcPtr CloseScreen; xf86CursorInfoPtr CursorInfo; --- a/src/dummy_driver.c	2016-12-14 21:54:20.000000000 +0100 +++ b/src/dummy_driver.c	2016-12-17 23:04:59.916416126 +0100 @@ -17,6 +17,12 @@ /* All drivers using the mi colormap manipulation need this */ #include "micmap.h" +#ifdef RANDR +#include "randrstr.h" +#endif + +#include "windowstr.h" + /* identifying atom needed by magnifiers */ #include <X11/Xatom.h> #include "property.h" @@ -115,11 +121,15 @@ }; typedef enum { -    OPTION_SW_CURSOR +    OPTION_SW_CURSOR, +    OPTION_CONSTANT_DPI } DUMMYOpts; static const OptionInfoRec DUMMYOptions[] = { { OPTION_SW_CURSOR,	"SWcursor",	OPTV_BOOLEAN,	{0}, FALSE }, +#ifdef RANDR +    { OPTION_CONSTANT_DPI,	"ConstantDPI",	OPTV_BOOLEAN,	{0}, FALSE }, +#endif { -1,                  NULL,           OPTV_NONE,	{0}, FALSE } }; @@ -359,6 +369,7 @@ xf86ProcessOptions(pScrn->scrnIndex, pScrn->options, dPtr->Options); xf86GetOptValBool(dPtr->Options, OPTION_SW_CURSOR,&dPtr->swCursor); +    xf86GetOptValBool(dPtr->Options, OPTION_CONSTANT_DPI, &dPtr->constantDPI); if (device->videoRam != 0) { pScrn->videoRam = device->videoRam; @@ -639,10 +650,45 @@ return TRUE; } +const char *XDPY_PROPERTY = "dummy-constant-xdpi"; +const char *YDPY_PROPERTY = "dummy-constant-ydpi"; +static int get_dpi_value(WindowPtr root, const char *property_name, int default_dpi) +{ +    PropertyPtr prop; +    Atom type_atom = MakeAtom("CARDINAL", 8, TRUE); +    Atom prop_atom = MakeAtom(property_name, strlen(property_name), FALSE); + +    for (prop = wUserProps(root); prop; prop = prop->next) { +       if (prop->propertyName == prop_atom && prop->type == type_atom && prop->data) { +           int v = (int) (*((CARD32 *) prop->data)); +           if ((v>0) && (v<4096)) { +               xf86DrvMsg(0, X_INFO, "get_constant_dpi_value() found property "%s" with value=%in", property_name, (int) v); +               return (int) v; +           } +           break; +       } +    } +    return default_dpi; +} + /* Mandatory */ Bool DUMMYSwitchMode(SWITCH_MODE_ARGS_DECL) { +    SCRN_INFO_PTR(arg); +#ifdef RANDR +    DUMMYPtr dPtr = DUMMYPTR(pScrn); +    if (dPtr->constantDPI) { +        int xDpi = get_dpi_value(pScrn->pScreen->root, XDPY_PROPERTY, pScrn->xDpi); +        int yDpi = get_dpi_value(pScrn->pScreen->root, YDPY_PROPERTY, pScrn->yDpi); +        //25.4 mm per inch: (254/10) +        pScrn->pScreen->mmWidth = mode->HDisplay * 254 / xDpi / 10; +        pScrn->pScreen->mmHeight = mode->VDisplay * 254 / yDpi / 10; +        xf86DrvMsg(pScrn->scrnIndex, X_INFO, "mm(dpi %ix%i)=%ix%in", xDpi, yDpi, pScrn->pScreen->mmWidth, pScrn->pScreen->mmHeight); +        RRScreenSizeNotify(pScrn->pScreen); +        RRTellChanged(pScrn->pScreen); +    } +#endif return TRUE; } </del>


Question: Describe the bug Attempting to start xpra fails with the following X server log: To Reproduce Steps to reproduce the behavior: run start :200

<del> --- xf86-video-dummy-0.3.6/src/dummy_driver.c	2014-11-05 19:24:02.668656601 +0700 +++ xf86-video-dummy-0.3.6.new/src/dummy_driver.c	2014-11-05 19:37:53.076061853 +0700 @@ -55,6 +55,9 @@ #include <X11/extensions/xf86dgaproto.h> #endif +/* Needed for fixing pointer limits on resize */ +#include "inputstr.h" + /* Mandatory functions */ static const OptionInfoRec *	DUMMYAvailableOptions(int chipid, int busid); static void     DUMMYIdentify(int flags); @@ -713,6 +716,26 @@ RRTellChanged(pScrn->pScreen); } #endif +    //ensure the screen dimensions are also updated: +    pScrn->pScreen->width = mode->HDisplay; +    pScrn->pScreen->height = mode->VDisplay; +    pScrn->virtualX = mode->HDisplay; +    pScrn->virtualY = mode->VDisplay; +    pScrn->frameX1 = mode->HDisplay; +    pScrn->frameY1 = mode->VDisplay; + +    //ensure the pointer uses the new limits too: +    DeviceIntPtr pDev; +    SpritePtr pSprite; +    for (pDev = inputInfo.devices; pDev; pDev = pDev->next) { +        if (pDev->spriteInfo!=NULL && pDev->spriteInfo->sprite!=NULL) { +            pSprite = pDev->spriteInfo->sprite; +            pSprite->hotLimits.x2 = mode->HDisplay; +            pSprite->hotLimits.y2 = mode->VDisplay; +            pSprite->physLimits.x2 = mode->HDisplay; +            pSprite->physLimits.y2 = mode->VDisplay; +        } +    } return TRUE; } </del>


Question: Describe the bug Attempting to start xpra fails with the following X server log: To Reproduce Steps to reproduce the behavior: run start :200

<del> --- a/src/dummy.h	2016-12-17 23:33:33.279533389 +0100 +++ b/src/dummy.h	2016-12-17 23:33:56.695739166 +0100 @@ -69,7 +69,7 @@ int overlay_offset; int videoKey; int interlace; -    dummy_colors colors[256]; +    dummy_colors colors[1024]; pointer* FBBase; Bool        (*CreateWindow)() ;     /* wrapped CreateWindow */ Bool prop; --- a/src/dummy_driver.c	2016-12-17 23:33:47.446657886 +0100 +++ b/src/dummy_driver.c	2016-12-17 23:33:56.696739175 +0100 @@ -317,6 +317,7 @@ case 15: case 16: case 24: +        case 30: break; default: xf86DrvMsg(pScrn->scrnIndex, X_ERROR, @@ -331,8 +332,8 @@ pScrn->rgbBits = 8; /* Get the depth24 pixmap format */ -    if (pScrn->depth == 24 && pix24bpp == 0) -	pix24bpp = xf86GetBppFromDepth(pScrn, 24); +    if (pScrn->depth >= 24 && pix24bpp == 0) +	pix24bpp = xf86GetBppFromDepth(pScrn, pScrn->depth); /* * This must happen after pScrn->display has been set because @@ -623,7 +624,7 @@ if(!miCreateDefColormap(pScreen)) return FALSE; -    if (!xf86HandleColormaps(pScreen, 256, pScrn->rgbBits, +    if (!xf86HandleColormaps(pScreen, 1024, pScrn->rgbBits, DUMMYLoadPalette, NULL, CMAP_PALETTED_TRUECOLOR | CMAP_RELOAD_ON_MODE_SWITCH)) </del>


Question: Describe the bug Attempting to start xpra fails with the following X server log: To Reproduce Steps to reproduce the behavior: run start :200

<del> { stdenv, lib, fetchurl , xorgproto, xorgserver , pkgconfig }: with lib; stdenv.mkDerivation rec { version = "0.3.8"; suffix = "1"; name = "xpra-xf86videodummy-${version}-${suffix}"; builder = ../../../../servers/x11/xorg/builder.sh; src = fetchurl { url = "mirror://xorg/individual/driver/xf86-video-dummy-${version}.tar.bz2"; sha256 = "1fcm9vwgv8wnffbvkzddk4yxrh3kc0np6w65wj8k88q7jf3bn4ip"; }; patches = [ ./0002-Constant-DPI.patch ./0003-fix-pointer-limits.patch ./0005-support-for-30-bit-depth-in-dummy-driver.patch ]; nativeBuildInputs = [ pkgconfig ]; buildInputs = [ xorgproto xorgserver ]; meta = { description = "Dummy driver for Xorg with xpra patches"; homepage = https://xpra.org/trac/wiki/Xdummy; license = licenses.gpl2; platforms = platforms.unix; maintainers = with maintainers; [ numinit ]; }; } </del>


Question: Describe the bug Tribler does not have any desktop icons, and does not show up in any menus. There is a desktop file in But it's not being included by the desktop environment. Maintainer information:

${stdenv.lib.optionalString enablePlayer '' --prefix LD_LIBRARY_PATH : ${vlc}/lib ''} <ins> mkdir -p $out/share/applications $out/share/icons $out/share/man/man1 cp $out/Tribler/Main/Build/Ubuntu/tribler.desktop $out/share/applications/tribler.desktop cp $out/Tribler/Main/Build/Ubuntu/tribler_big.xpm $out/share/icons/tribler.xpm cp $out/Tribler/Main/Build/Ubuntu/tribler.1 $out/share/man/man1/tribler.1 </ins> ''; meta = with stdenv.lib; {


Question:
Describe the bug On a ZFS-enabled 20.03 system: IMHO zed does not need the ability to send email by default. Also mariadb-connector should have a separate -dev output so that its doesn't end up in the system closure.
cc
Hello, I'm a bot and I thank you in the name of the community for opening this issue. To help our human contributors focus on the most-relevant reports, I check up on old issues to see if they're still relevant. This issue has had no activity for 180 days, and so I marked it as stale, but you can rest assured it will never be closed by a non-human. The community would appreciate your effort in checking if the issue is still valid. If it isn't, please close it. If the issue persists, and you'd like to remove the stale label, you simply need to leave a comment. Your comment can be as simple as "still important to me". If you'd like it to get more attention, you can ask for help by searching for maintainers and people that previously touched related code and @ mention them in a comment. You can use or on the relevant files to find them. Lastly, you can always ask for help at or at .
Seems still important: And: And:
Adjusted to milestone 21.03. BTW, If someone wants to backport the fix it shouldn't cause any issues.
Took a stab at this in

}; }; <del> services.zfs.zed.settings = mkOption { type = with types; attrsOf (oneOf [ str int bool (listOf str) ]); example = literalExample '' { ZED_DEBUG_LOG = "/tmp/zed.debug.log"; </del> <ins> services.zfs.zed = { enableMail = mkEnableOption "ZED's ability to send emails" // { default = cfgZfs.package.enableMail; }; </ins> <del> ZED_EMAIL_ADDR = [ "root" ]; ZED_EMAIL_PROG = "mail"; ZED_EMAIL_OPTS = "-s '@SUBJECT@' @ADDRESS@"; </del> <ins> settings = mkOption { type = with types; attrsOf (oneOf [ str int bool (listOf str) ]); example = literalExample '' { ZED_DEBUG_LOG = "/tmp/zed.debug.log"; </ins> <del> ZED_NOTIFY_INTERVAL_SECS = 3600; ZED_NOTIFY_VERBOSE = false; </del> <ins> ZED_EMAIL_ADDR = [ "root" ]; ZED_EMAIL_PROG = "mail"; ZED_EMAIL_OPTS = "-s '@SUBJECT@' @ADDRESS@"; </ins> <del> ZED_USE_ENCLOSURE_LEDS = true; ZED_SCRUB_AFTER_RESILVER = false; } ''; description = '' ZFS Event Daemon /etc/zfs/zed.d/zed.rc content See <citerefentry><refentrytitle>zed</refentrytitle><manvolnum>8</manvolnum></citerefentry> for details on ZED and the scripts in /etc/zfs/zed.d to find the possible variables ''; </del> <ins> ZED_NOTIFY_INTERVAL_SECS = 3600; ZED_NOTIFY_VERBOSE = false; ZED_USE_ENCLOSURE_LEDS = true; ZED_SCRUB_AFTER_RESILVER = false; } ''; description = '' ZFS Event Daemon /etc/zfs/zed.d/zed.rc content See <citerefentry><refentrytitle>zed</refentrytitle><manvolnum>8</manvolnum></citerefentry> for details on ZED and the scripts in /etc/zfs/zed.d to find the possible variables ''; }; </ins> }; };


Question:
Describe the bug On a ZFS-enabled 20.03 system: IMHO zed does not need the ability to send email by default. Also mariadb-connector should have a separate -dev output so that its doesn't end up in the system closure.
cc
Hello, I'm a bot and I thank you in the name of the community for opening this issue. To help our human contributors focus on the most-relevant reports, I check up on old issues to see if they're still relevant. This issue has had no activity for 180 days, and so I marked it as stale, but you can rest assured it will never be closed by a non-human. The community would appreciate your effort in checking if the issue is still valid. If it isn't, please close it. If the issue persists, and you'd like to remove the stale label, you simply need to leave a comment. Your comment can be as simple as "still important to me". If you'd like it to get more attention, you can ask for help by searching for maintainers and people that previously touched related code and @ mention them in a comment. You can use or on the relevant files to find them. Lastly, you can always ask for help at or at .
Seems still important: And: And:
Adjusted to milestone 21.03. BTW, If someone wants to backport the fix it shouldn't cause any issues.
Took a stab at this in

(mkIf cfgZfs.enabled { assertions = [ { <ins> assertion = cfgZED.enableMail -> cfgZfs.package.enableMail; message = '' To allow ZED to send emails, ZFS needs to be configured to enable this. To do so, one must override the `zfs` package and set `enableMail` to true. ''; } { </ins> assertion = config.networking.hostId != null; message = "ZFS requires networking.hostId to be set"; }


Question:
Describe the bug On a ZFS-enabled 20.03 system: IMHO zed does not need the ability to send email by default. Also mariadb-connector should have a separate -dev output so that its doesn't end up in the system closure.
cc
Hello, I'm a bot and I thank you in the name of the community for opening this issue. To help our human contributors focus on the most-relevant reports, I check up on old issues to see if they're still relevant. This issue has had no activity for 180 days, and so I marked it as stale, but you can rest assured it will never be closed by a non-human. The community would appreciate your effort in checking if the issue is still valid. If it isn't, please close it. If the issue persists, and you'd like to remove the stale label, you simply need to leave a comment. Your comment can be as simple as "still important to me". If you'd like it to get more attention, you can ask for help by searching for maintainers and people that previously touched related code and @ mention them in a comment. You can use or on the relevant files to find them. Lastly, you can always ask for help at or at .
Seems still important: And: And:
Adjusted to milestone 21.03. BTW, If someone wants to backport the fix it shouldn't cause any issues.
Took a stab at this in

}; services.zfs.zed.settings = { <del> ZED_EMAIL_PROG = mkDefault "${pkgs.mailutils}/bin/mail"; </del> <ins> ZED_EMAIL_PROG = mkIf cfgZED.enableMail (mkDefault "${pkgs.mailutils}/bin/mail"); </ins> PATH = lib.makeBinPath [ cfgZfs.package pkgs.coreutils


Question:
Describe the bug On a ZFS-enabled 20.03 system: IMHO zed does not need the ability to send email by default. Also mariadb-connector should have a separate -dev output so that its doesn't end up in the system closure.
cc
Hello, I'm a bot and I thank you in the name of the community for opening this issue. To help our human contributors focus on the most-relevant reports, I check up on old issues to see if they're still relevant. This issue has had no activity for 180 days, and so I marked it as stale, but you can rest assured it will never be closed by a non-human. The community would appreciate your effort in checking if the issue is still valid. If it isn't, please close it. If the issue persists, and you'd like to remove the stale label, you simply need to leave a comment. Your comment can be as simple as "still important to me". If you'd like it to get more attention, you can ask for help by searching for maintainers and people that previously touched related code and @ mention them in a comment. You can use or on the relevant files to find them. Lastly, you can always ask for help at or at .
Seems still important: And: And:
Adjusted to milestone 21.03. BTW, If someone wants to backport the fix it shouldn't cause any issues.
Took a stab at this in

, libtirpc , nfs-utils , gawk, gnugrep, gnused, systemd <del> , smartmontools, sysstat, sudo , pkg-config </del> <ins> , smartmontools, enableMail ? false , sysstat, sudo, pkg-config </ins> # Kernel dependencies , kernel ? null


Question:
Describe the bug On a ZFS-enabled 20.03 system: IMHO zed does not need the ability to send email by default. Also mariadb-connector should have a separate -dev output so that its doesn't end up in the system closure.
cc
Hello, I'm a bot and I thank you in the name of the community for opening this issue. To help our human contributors focus on the most-relevant reports, I check up on old issues to see if they're still relevant. This issue has had no activity for 180 days, and so I marked it as stale, but you can rest assured it will never be closed by a non-human. The community would appreciate your effort in checking if the issue is still valid. If it isn't, please close it. If the issue persists, and you'd like to remove the stale label, you simply need to leave a comment. Your comment can be as simple as "still important to me". If you'd like it to get more attention, you can ask for help by searching for maintainers and people that previously touched related code and @ mention them in a comment. You can use or on the relevant files to find them. Lastly, you can always ask for help at or at .
Seems still important: And: And:
Adjusted to milestone 21.03. BTW, If someone wants to backport the fix it shouldn't cause any issues.
Took a stab at this in

with lib; let <ins> smartmon = smartmontools.override { inherit enableMail; }; </ins> buildKernel = any (n: n == configFile) [ "kernel" "all" ]; buildUser = any (n: n == configFile) [ "user" "all" ];


Question:
Describe the bug On a ZFS-enabled 20.03 system: IMHO zed does not need the ability to send email by default. Also mariadb-connector should have a separate -dev output so that its doesn't end up in the system closure.
cc
Hello, I'm a bot and I thank you in the name of the community for opening this issue. To help our human contributors focus on the most-relevant reports, I check up on old issues to see if they're still relevant. This issue has had no activity for 180 days, and so I marked it as stale, but you can rest assured it will never be closed by a non-human. The community would appreciate your effort in checking if the issue is still valid. If it isn't, please close it. If the issue persists, and you'd like to remove the stale label, you simply need to leave a comment. Your comment can be as simple as "still important to me". If you'd like it to get more attention, you can ask for help by searching for maintainers and people that previously touched related code and @ mention them in a comment. You can use or on the relevant files to find them. Lastly, you can always ask for help at or at .
Seems still important: And: And:
Adjusted to milestone 21.03. BTW, If someone wants to backport the fix it shouldn't cause any issues.
Took a stab at this in

''; postFixup = let <del> path = "PATH=${makeBinPath [ coreutils gawk gnused gnugrep util-linux smartmontools sysstat ]}:$PATH"; </del> <ins> path = "PATH=${makeBinPath [ coreutils gawk gnused gnugrep util-linux smartmon sysstat ]}:$PATH"; </ins> in '' for i in $out/libexec/zfs/zpool.d/*; do sed -i '2i${path}' $i


Question:
Describe the bug On a ZFS-enabled 20.03 system: IMHO zed does not need the ability to send email by default. Also mariadb-connector should have a separate -dev output so that its doesn't end up in the system closure.
cc
Hello, I'm a bot and I thank you in the name of the community for opening this issue. To help our human contributors focus on the most-relevant reports, I check up on old issues to see if they're still relevant. This issue has had no activity for 180 days, and so I marked it as stale, but you can rest assured it will never be closed by a non-human. The community would appreciate your effort in checking if the issue is still valid. If it isn't, please close it. If the issue persists, and you'd like to remove the stale label, you simply need to leave a comment. Your comment can be as simple as "still important to me". If you'd like it to get more attention, you can ask for help by searching for maintainers and people that previously touched related code and @ mention them in a comment. You can use or on the relevant files to find them. Lastly, you can always ask for help at or at .
Seems still important: And: And:
Adjusted to milestone 21.03. BTW, If someone wants to backport the fix it shouldn't cause any issues.
Took a stab at this in

outputs = [ "out" ] ++ optionals buildUser [ "lib" "dev" ]; <del> passthru.tests = if isUnstable then [ nixosTests.zfs.unstable ] else [ nixosTests.zfs.installer nixosTests.zfs.stable ]; </del> <ins> passthru = { inherit enableMail; tests = if isUnstable then [ nixosTests.zfs.unstable ] else [ nixosTests.zfs.installer nixosTests.zfs.stable ]; }; </ins> meta = { description = "ZFS Filesystem Linux Kernel module";


Question:
Describe the bug On a ZFS-enabled 20.03 system: IMHO zed does not need the ability to send email by default. Also mariadb-connector should have a separate -dev output so that its doesn't end up in the system closure.
cc
Hello, I'm a bot and I thank you in the name of the community for opening this issue. To help our human contributors focus on the most-relevant reports, I check up on old issues to see if they're still relevant. This issue has had no activity for 180 days, and so I marked it as stale, but you can rest assured it will never be closed by a non-human. The community would appreciate your effort in checking if the issue is still valid. If it isn't, please close it. If the issue persists, and you'd like to remove the stale label, you simply need to leave a comment. Your comment can be as simple as "still important to me". If you'd like it to get more attention, you can ask for help by searching for maintainers and people that previously touched related code and @ mention them in a comment. You can use or on the relevant files to find them. Lastly, you can always ask for help at or at .
Seems still important: And: And:
Adjusted to milestone 21.03. BTW, If someone wants to backport the fix it shouldn't cause any issues.
Took a stab at this in

{ lib, stdenv, fetchurl, autoreconfHook <del> , mailutils, inetutils </del> <ins> , mailutils, enableMail ? true , inetutils </ins> , IOKit, ApplicationServices }: let


Question:
Describe the bug On a ZFS-enabled 20.03 system: IMHO zed does not need the ability to send email by default. Also mariadb-connector should have a separate -dev output so that its doesn't end up in the system closure.
cc
Hello, I'm a bot and I thank you in the name of the community for opening this issue. To help our human contributors focus on the most-relevant reports, I check up on old issues to see if they're still relevant. This issue has had no activity for 180 days, and so I marked it as stale, but you can rest assured it will never be closed by a non-human. The community would appreciate your effort in checking if the issue is still valid. If it isn't, please close it. If the issue persists, and you'd like to remove the stale label, you simply need to leave a comment. Your comment can be as simple as "still important to me". If you'd like it to get more attention, you can ask for help by searching for maintainers and people that previously touched related code and @ mention them in a comment. You can use or on the relevant files to find them. Lastly, you can always ask for help at or at .
Seems still important: And: And:
Adjusted to milestone 21.03. BTW, If someone wants to backport the fix it shouldn't cause any issues.
Took a stab at this in

postPatch = "cp -v ${driverdb} drivedb.h"; configureFlags = [ <del> "--with-scriptpath=${lib.makeBinPath [ mailutils inetutils ]}" </del> <ins> "--with-scriptpath=${lib.makeBinPath ([ inetutils ] ++ lib.optional enableMail mailutils)}" </ins> ]; nativeBuildInputs = [ autoreconfHook ];


Question:
Describe the bug After upgrading to NixOS 20.03, sudo often (but not always) segfaults: From the logs: Disabling appears to have made this problem to away, so the problem may be in . Metadata NixOS 20.03..
Maybe the patch to use a not insecure openssl is the source of the issue for you
same issue here - the sourceforge repo is way old, there's a github mirror but not maintained either, and there's a fork of the mirror which includes fixes for openssl 1.1.1:
I marked this as stale due to inactivity. →
Hmm, kinda forgot about this
I missed the fact that the "supported" branch didn't actually include the patch to fix this.

# Allow multiple colon-separated authorized keys files to be # specified in the file= option. ./multiple-key-files.patch <ins> ./edcsa-crash-fix.patch </ins> ]; configureFlags = [


Question:
Describe the bug After upgrading to NixOS 20.03, sudo often (but not always) segfaults: From the logs: Disabling appears to have made this problem to away, so the problem may be in . Metadata NixOS 20.03..
Maybe the patch to use a not insecure openssl is the source of the issue for you
same issue here - the sourceforge repo is way old, there's a github mirror but not maintained either, and there's a fork of the mirror which includes fixes for openssl 1.1.1:
I marked this as stale due to inactivity. →
Hmm, kinda forgot about this
I missed the fact that the "supported" branch didn't actually include the patch to fix this.

<ins> commit 1b0d9bcc5f5cd78b0bb1357d6a11da5d616ad26f Author: Wout Mertens <Wout.Mertens@gmail.com> Date:   Thu Jun 11 18:08:13 2020 +0200 fix segfault when using ECDSA keys. Author: Marc Deslauriers <marc.deslauriers@canonical.com> Bug-Ubuntu: https://bugs.launchpad.net/bugs/1869512 diff --git a/ssh-ecdsa.c b/ssh-ecdsa.c index 5b13b30..5bf29cc 100644 --- a/ssh-ecdsa.c +++ b/ssh-ecdsa.c @@ -46,7 +46,7 @@ ssh_ecdsa_sign(const Key *key, u_char **sigp, u_int *lenp, u_int len, dlen; Buffer b, bb; #if OPENSSL_VERSION_NUMBER >= 0x10100005L -	BIGNUM *r, *s; +	BIGNUM *r = NULL, *s = NULL; #endif if (key == NULL || key->type != KEY_ECDSA || key->ecdsa == NULL) { @@ -137,20 +137,27 @@ ssh_ecdsa_verify(const Key *key, const u_char *signature, u_int signaturelen, /* parse signature */ if ((sig = ECDSA_SIG_new()) == NULL) -        pamsshagentauth_fatal("ssh_ecdsa_verify: DSA_SIG_new failed"); +        pamsshagentauth_fatal("ssh_ecdsa_verify: ECDSA_SIG_new failed"); pamsshagentauth_buffer_init(&b); pamsshagentauth_buffer_append(&b, sigblob, len); #if OPENSSL_VERSION_NUMBER < 0x10100005L if ((pamsshagentauth_buffer_get_bignum2_ret(&b, sig->r) == -1) || (pamsshagentauth_buffer_get_bignum2_ret(&b, sig->s) == -1)) +        pamsshagentauth_fatal("ssh_ecdsa_verify:" +            "pamsshagentauth_buffer_get_bignum2_ret failed"); #else -    DSA_SIG_get0(sig, &r, &s); +    if ((r = BN_new()) == NULL) +        pamsshagentauth_fatal("ssh_ecdsa_verify: BN_new failed"); +    if ((s = BN_new()) == NULL) +        pamsshagentauth_fatal("ssh_ecdsa_verify: BN_new failed"); if ((pamsshagentauth_buffer_get_bignum2_ret(&b, r) == -1) || (pamsshagentauth_buffer_get_bignum2_ret(&b, s) == -1)) -#endif pamsshagentauth_fatal("ssh_ecdsa_verify:" "pamsshagentauth_buffer_get_bignum2_ret failed"); +    if (ECDSA_SIG_set0(sig, r, s) != 1) +        pamsshagentauth_fatal("ssh_ecdsa_verify: ECDSA_SIG_set0 failed"); +#endif /* clean up */ memset(sigblob, 0, len); </ins>


Question:
Describe the bug After upgrading to NixOS 20.03, sudo often (but not always) segfaults: From the logs: Disabling appears to have made this problem to away, so the problem may be in . Metadata NixOS 20.03..
Maybe the patch to use a not insecure openssl is the source of the issue for you
same issue here - the sourceforge repo is way old, there's a github mirror but not maintained either, and there's a fork of the mirror which includes fixes for openssl 1.1.1:
I marked this as stale due to inactivity. →
Hmm, kinda forgot about this
I missed the fact that the "supported" branch didn't actually include the patch to fix this.

<del> { stdenv, fetchpatch, fetchurl, pam, openssl, perl }: </del> <ins> { stdenv, fetchpatch, fetchFromGitHub, pam, openssl, perl }: </ins> stdenv.mkDerivation rec { <del> name = "pam_ssh_agent_auth-0.10.3"; </del> <ins> pname = "pam_ssh_agent_auth"; version = "0.10.4"; </ins> <del> src = fetchurl { url = "mirror://sourceforge/pamsshagentauth/${name}.tar.bz2"; sha256 = "0qx78x7nvqdscyp04hfijl4rgyf64xy03prr28hipvgasrcd6lrw"; </del> <ins> src = fetchFromGitHub { owner = "jbeverly"; repo = "pam_ssh_agent_auth"; rev = "pam_ssh_agent_auth-${version}"; sha256 = "YD1R8Cox0UoNiuWleKGzWSzxJ5lhDRCB2mZPp9OM6Cs="; </ins> }; <del> patches = [ # Allow multiple colon-separated authorized keys files to be # specified in the file= option. ./multiple-key-files.patch (fetchpatch { name = "openssl-1.1.1-1.patch"; url = "https://sources.debian.org/data/main/p/pam-ssh-agent-auth/0.10.3-3/debian/patches/openssl-1.1.1-1.patch"; sha256 = "1ndp5j4xfhzshhnl345gb4mkldx6vjfa7284xgng6ikhzpc6y7pf"; }) (fetchpatch { name = "openssl-1.1.1-2.patch"; url = "https://sources.debian.org/data/main/p/pam-ssh-agent-auth/0.10.3-3/debian/patches/openssl-1.1.1-2.patch"; sha256 = "0ksrs4xr417by8klf7862n3dircvnw30an1akq4pnsd3ichscmww"; }) ]; </del> <ins> ed25519-donna = fetchFromGitHub { owner = "floodyberry"; repo = "ed25519-donna"; rev = "8757bd4cd209cb032853ece0ce413f122eef212c"; sha256 = "ETFpIaWQnlYG8ZuDG2dNjUJddlvibB4ukHquTFn3NZM="; }; </ins> buildInputs = [ pam openssl perl ]; <del> # It's not clear to me why this is necessary, but without it, you see: # # checking OpenSSL header version... 1010104f (OpenSSL 1.1.1d  10 Sep 2019) # checking OpenSSL library version... 1010104f (OpenSSL 1.1.1d  10 Sep 2019) # checking whether OpenSSL's headers match the library... no # configure: WARNING: Your OpenSSL headers do not match your # library. Check config.log for details. # # ...despite the fact that clearly the values match configureFlags = [ "--without-openssl-header-check" ]; </del> <ins> patches = [ # Allow multiple colon-separated authorized keys files to be # specified in the file= option. ./multiple-key-files.patch ]; configureFlags = [ # It's not clear to me why this is necessary, but without it, you see: # # checking OpenSSL header version... 1010108f (OpenSSL 1.1.1h  22 Sep 2020) # checking OpenSSL library version... 1010108f (OpenSSL 1.1.1h  22 Sep 2020) # checking whether OpenSSL's headers match the library... no # configure: WARNING: Your OpenSSL headers do not match your # library. Check config.log for details. # # ...despite the fact that clearly the values match "--without-openssl-header-check" # Make sure it can find ed25519-donna "--with-cflags=-I$PWD" ]; prePatch = "cp -r ${ed25519-donna}/. ed25519-donna/."; </ins> enableParallelBuilding = true; meta = { <del> homepage = "http://pamsshagentauth.sourceforge.net/"; </del> <ins> homepage = "https://github.com/jbeverly/pam_ssh_agent_auth"; </ins> description = "PAM module for authentication through the SSH agent"; maintainers = [ stdenv.lib.maintainers.eelco ]; platforms = stdenv.lib.platforms.linux;


Question:
Describe the bug After upgrading to NixOS 20.03, sudo often (but not always) segfaults: From the logs: Disabling appears to have made this problem to away, so the problem may be in . Metadata NixOS 20.03..
Maybe the patch to use a not insecure openssl is the source of the issue for you
same issue here - the sourceforge repo is way old, there's a github mirror but not maintained either, and there's a fork of the mirror which includes fixes for openssl 1.1.1:
I marked this as stale due to inactivity. →
Hmm, kinda forgot about this
I missed the fact that the "supported" branch didn't actually include the patch to fix this.

/* * PAM_USER and PAM_RUSER do not necessarily have to get set by the calling application, and we may be unable to divine the latter. <del> @@ -187,16 +184,17 @@ </del> <ins> @@ -184,5 +181,5 @@ </ins> */ if(user && strlen(ruser) > 0) { -        pamsshagentauth_verbose("Attempting authentication: `%s' as `%s' using %s", ruser, user, authorized_keys_file); +        pamsshagentauth_verbose("Attempting authentication: `%s' as `%s' using %s", ruser, user, authorized_keys_file_input); <ins> @@ -201,3 +197,3 @@ retval = PAM_SUCCESS; -                pamsshagentauth_logit("Authenticated (sshd): `%s' as `%s' using %s", ruser, user, authorized_keys_file); +                pamsshagentauth_logit("Authenticated (sshd): `%s' as `%s' using %s", ruser, user, authorized_keys_file_input); @@ -211,11 +208,12 @@ </ins> /* * this pw_uid is used to validate the SSH_AUTH_SOCK, and so must be the uid of the ruser invoking the program, not the target-user */ -        if(pamsshagentauth_find_authorized_keys(user, ruser, servicename)) { /* getpwnam(ruser)->pw_uid)) { */ <del> -            pamsshagentauth_logit("Authenticated: `%s' as `%s' using %s", ruser, user, authorized_keys_file); </del> <ins> -            pamsshagentauth_logit("Authenticated (agent): `%s' as `%s' using %s", ruser, user, authorized_keys_file); </ins> +        const char *key_file; +        if((key_file = pamsshagentauth_find_authorized_keys(user, ruser, servicename))) { /* getpwnam(ruser)->pw_uid)) { */ <del> +            pamsshagentauth_logit("Authenticated: `%s' as `%s' using %s", ruser, user, key_file); </del> <ins> +            pamsshagentauth_logit("Authenticated (agent): `%s' as `%s' using %s", ruser, user, key_file); </ins> retval = PAM_SUCCESS; } else { -            pamsshagentauth_logit("Failed Authentication: `%s' as `%s' using %s", ruser, user, authorized_keys_file);


Question:
PR broke -- first discovered in Before that PR, the systemd service ran as , so the nginx master process ran as root, and then the worker processes ran as an unprivileged user ( , or by default if thta line is not given). Now the systemd service runs as , including the master process. When you change the default back to root (e.g. because your setup needs the master process to be root, or for replicate the setup as it was in 19.09) using , it does not work out of the box. That is because the module now assumes that nginx will run only as 1 user, and it sets file system permissions that way. But nginx running as root makes nginx drop privileges to or the configured , and the file system permissions are not set up correctly for that as shown in
FYI this is how I'm handling the situation with : The sysadmin should override and to set the master process user and group, while the and options set the effective user and group.
The way the tmpfile rules are currently written is that the group doesn't have write, only read access to . So it doesn't really work well with running the nginx master process as root, and then drop permissions to a regular user. I assume you also don't want to run worker processes as root either :laughing:… I'm not sure how to properly approach this problem. Can you elaborate a bit on what's your usecase as running the master process as root?
are you able to test this configuration out and report back: Please take special consideration to look over your directory (under ) and the permissions there. I'm not familiar on what user/group permissions the process assigns to log files when it runs with as the master process... possibly a minor tweak to the will be required, but let me know what happens with your test. If this works we need to simply add documentation on how to run with as the master process, as I have explained above.
This issue has been mentioned on NixOS Discourse. There might be relevant details there:
Just from the go/no-go meeting, I approved of changes being backported to 20.03
I've gone ahead and tested the above configuration snippet. I had to make a few tweaks and ended up with this as the required configuration to get to run with as the master process but as the child processes: can you please describe your requirement to run the master process as ? I'm not familiar with so I have a hard time judging whether your case is an edge case or not. depending on the answer from we need to make a decision about whether we need to simply improve documentation, or improve documentation and modify the module code to make this use case better supported. I'm currently leaning toward this being a documentation only thing, but let's wait to hear what has to say.
I think your suggestion is good, I will try it today for our setup and report back. If it works, then I agree that it is sufficient to document your approach in the release notes (and perhaps as a description in one of the config options (probably the one for is best). On my use case, it is: being able to configure nginx the same way it was running on 19.09 for smoother migration, also so that one can upgrade to 20.03 already before fixing all the other things one's nginx uses that may rely on the master running as root
NixOS does not complain when options on non-existent systemd services are set (should it?) -- that took a while to figure out :grin:
I have checked your approach now on my staging deployment; it works (with the typo removed). What we should add to the changelog:
glad to hear. Thanks! :tada:
PR: We should cherry-pick it on after merge.
Thanks for finding the best solution!

"--enable-add-ons" "--sysconfdir=/etc" "--localedir=/var/run/current-system/sw/lib/locale" <ins> "libc_cv_ssp=no" </ins> (if kernelHeaders != null then "--with-headers=${kernelHeaders}/include" else "--without-headers")


Question:
PR broke -- first discovered in Before that PR, the systemd service ran as , so the nginx master process ran as root, and then the worker processes ran as an unprivileged user ( , or by default if thta line is not given). Now the systemd service runs as , including the master process. When you change the default back to root (e.g. because your setup needs the master process to be root, or for replicate the setup as it was in 19.09) using , it does not work out of the box. That is because the module now assumes that nginx will run only as 1 user, and it sets file system permissions that way. But nginx running as root makes nginx drop privileges to or the configured , and the file system permissions are not set up correctly for that as shown in
FYI this is how I'm handling the situation with : The sysadmin should override and to set the master process user and group, while the and options set the effective user and group.
The way the tmpfile rules are currently written is that the group doesn't have write, only read access to . So it doesn't really work well with running the nginx master process as root, and then drop permissions to a regular user. I assume you also don't want to run worker processes as root either :laughing:… I'm not sure how to properly approach this problem. Can you elaborate a bit on what's your usecase as running the master process as root?
are you able to test this configuration out and report back: Please take special consideration to look over your directory (under ) and the permissions there. I'm not familiar on what user/group permissions the process assigns to log files when it runs with as the master process... possibly a minor tweak to the will be required, but let me know what happens with your test. If this works we need to simply add documentation on how to run with as the master process, as I have explained above.
This issue has been mentioned on NixOS Discourse. There might be relevant details there:
Just from the go/no-go meeting, I approved of changes being backported to 20.03
I've gone ahead and tested the above configuration snippet. I had to make a few tweaks and ended up with this as the required configuration to get to run with as the master process but as the child processes: can you please describe your requirement to run the master process as ? I'm not familiar with so I have a hard time judging whether your case is an edge case or not. depending on the answer from we need to make a decision about whether we need to simply improve documentation, or improve documentation and modify the module code to make this use case better supported. I'm currently leaning toward this being a documentation only thing, but let's wait to hear what has to say.
I think your suggestion is good, I will try it today for our setup and report back. If it works, then I agree that it is sufficient to document your approach in the release notes (and perhaps as a description in one of the config options (probably the one for is best). On my use case, it is: being able to configure nginx the same way it was running on 19.09 for smoother migration, also so that one can upgrade to 20.03 already before fixing all the other things one's nginx uses that may rely on the master running as root
NixOS does not complain when options on non-existent systemd services are set (should it?) -- that took a while to figure out :grin:
I have checked your approach now on my staging deployment; it works (with the typo removed). What we should add to the changelog:
glad to hear. Thanks! :tada:
PR: We should cherry-pick it on after merge.
Thanks for finding the best solution!

<listitem> <para> The nginx web server previously started its master process as root <del> privileged, then ran worker processes as a less privileged identity user. </del> <ins> privileged, then ran worker processes as a less privileged identity user (the <literal>nginx</literal> user). </ins> This was changed to start all of nginx as a less privileged user (defined by <literal>services.nginx.user</literal> and <literal>services.nginx.group</literal>). As a consequence, all files that


Question:
PR broke -- first discovered in Before that PR, the systemd service ran as , so the nginx master process ran as root, and then the worker processes ran as an unprivileged user ( , or by default if thta line is not given). Now the systemd service runs as , including the master process. When you change the default back to root (e.g. because your setup needs the master process to be root, or for replicate the setup as it was in 19.09) using , it does not work out of the box. That is because the module now assumes that nginx will run only as 1 user, and it sets file system permissions that way. But nginx running as root makes nginx drop privileges to or the configured , and the file system permissions are not set up correctly for that as shown in
FYI this is how I'm handling the situation with : The sysadmin should override and to set the master process user and group, while the and options set the effective user and group.
The way the tmpfile rules are currently written is that the group doesn't have write, only read access to . So it doesn't really work well with running the nginx master process as root, and then drop permissions to a regular user. I assume you also don't want to run worker processes as root either :laughing:… I'm not sure how to properly approach this problem. Can you elaborate a bit on what's your usecase as running the master process as root?
are you able to test this configuration out and report back: Please take special consideration to look over your directory (under ) and the permissions there. I'm not familiar on what user/group permissions the process assigns to log files when it runs with as the master process... possibly a minor tweak to the will be required, but let me know what happens with your test. If this works we need to simply add documentation on how to run with as the master process, as I have explained above.
This issue has been mentioned on NixOS Discourse. There might be relevant details there:
Just from the go/no-go meeting, I approved of changes being backported to 20.03
I've gone ahead and tested the above configuration snippet. I had to make a few tweaks and ended up with this as the required configuration to get to run with as the master process but as the child processes: can you please describe your requirement to run the master process as ? I'm not familiar with so I have a hard time judging whether your case is an edge case or not. depending on the answer from we need to make a decision about whether we need to simply improve documentation, or improve documentation and modify the module code to make this use case better supported. I'm currently leaning toward this being a documentation only thing, but let's wait to hear what has to say.
I think your suggestion is good, I will try it today for our setup and report back. If it works, then I agree that it is sufficient to document your approach in the release notes (and perhaps as a description in one of the config options (probably the one for is best). On my use case, it is: being able to configure nginx the same way it was running on 19.09 for smoother migration, also so that one can upgrade to 20.03 already before fixing all the other things one's nginx uses that may rely on the master running as root
NixOS does not complain when options on non-existent systemd services are set (should it?) -- that took a while to figure out :grin:
I have checked your approach now on my staging deployment; it works (with the typo removed). What we should add to the changelog:
glad to hear. Thanks! :tada:
PR: We should cherry-pick it on after merge.
Thanks for finding the best solution!

certificates and keys, etc.) must now be readable by this less privileged user/group. </para> <ins> <para> To continue to use the old approach, you can configure: <programlisting> services.nginx.appendConfig = let cfg = config.services.nginx; in ''user ${cfg.user} ${cfg.group};''; systemd.services.nginx.serviceConfig.User = lib.mkForce "root"; </programlisting> </para> </ins> </listitem> <listitem> <para>


Question:
Project description An advanced menu editor that provides modern features in a clean, easy-to-use interface. MenuLibre is developed for users who want to manage their menus without ever needing to read the spec or use a text editor. Budgie, Cinnamon, GNOME, KDE (Plasma), LXDE, LXQt, MATE, Pantheon, Unity, and Xfce are all supported. Metadata homepage URL: source URL: license: gpl3 platforms: linux
This project now managed on GitHub: Code: Bugs: Translations: Wiki: Homepage:
There's a module helper function that can generate files. Not as easy to use as menulibre of course, but reproducible.
Thank you. I edited the description for it to be accurate
I marked this as stale due to inactivity. →
Well, it would be good to have a formula for this.
I marked this as stale due to inactivity. →
This would be really useful. I would write a derivation but I'm not confident in my Nix skills to do so.

<ins> { lib , fetchFromGitHub , python3Packages , gnome-menus , gtk3 , intltool , gobject-introspection , wrapGAppsHook , testers , menulibre }: python3Packages.buildPythonApplication rec { name = "menulibre"; version = "2.2.3"; src = fetchFromGitHub { owner = "bluesabre"; repo = "menulibre"; rev = "menulibre-${version}"; hash = "sha256-E0ukq3q4YaakOI2mDs3dh0ncZX/dqspCA+97r3JwWyA="; }; propagatedBuildInputs = with python3Packages; [ pygobject3 gnome-menus psutil distutils-extra ]; nativeBuildInputs = [ gtk3 intltool gobject-introspection wrapGAppsHook ]; postPatch = '' substituteInPlace setup.py  --replace-fail 'data_dir =' "data_dir = '$out/share/menulibre' #"  --replace-fail 'update_desktop_file(desktop_file, script_path)' "" ''; preBuild = '' export HOME=$TMPDIR ''; passthru.tests.version = testers.testVersion { package = menulibre; command = "HOME=$TMPDIR menulibre --version | cut -d' ' -f2"; }; meta = with lib; { description = "An advanced menu editor with an easy-to-use interface"; homepage = "https://bluesabre.org/projects/menulibre"; license = licenses.gpl3Plus; maintainers = with maintainers; [ lelgenio ]; mainProgram = "menulibre"; platforms = platforms.linux; }; } </ins>


Question:
Project description Code Intelligence for Vala Metadata homepage URL: source URL: license: LGPL2.1 platforms: unix, linux, darwin, ...
any relation to
There are some efforts to merge the two servers but otherwise they are independent.
Hello, I'm a bot and I thank you in the name of the community for opening this issue. To help our human contributors focus on the most-relevant reports, I check up on old issues to see if they're still relevant. This issue has had no activity for 180 days, and so I marked it as stale, but you can rest assured it will never be closed by a non-human. The community would appreciate your effort in checking if the issue is still valid. If it isn't, please close it. If the issue persists, and you'd like to remove the stale label, you simply need to leave a comment. Your comment can be as simple as "still important to me". If you'd like it to get more attention, you can ask for help by searching for maintainers and people that previously touched related code and @ mention them in a comment. You can use or on the relevant files to find them. Lastly, you can always ask for help at or at .

githubId = 69135; name = "Andrea Bedini"; }; <ins> andreasfelix = { email = "fandreas@physik.hu-berlin.de"; github = "andreasfelix"; githubId = 24651767; name = "Felix Andreas"; }; </ins> andres = { email = "ksnixos@andres-loeh.de"; github = "kosmikus";


Question:
Project description Code Intelligence for Vala Metadata homepage URL: source URL: license: LGPL2.1 platforms: unix, linux, darwin, ...
any relation to
There are some efforts to merge the two servers but otherwise they are independent.
Hello, I'm a bot and I thank you in the name of the community for opening this issue. To help our human contributors focus on the most-relevant reports, I check up on old issues to see if they're still relevant. This issue has had no activity for 180 days, and so I marked it as stale, but you can rest assured it will never be closed by a non-human. The community would appreciate your effort in checking if the issue is still valid. If it isn't, please close it. If the issue persists, and you'd like to remove the stale label, you simply need to leave a comment. Your comment can be as simple as "still important to me". If you'd like it to get more attention, you can ask for help by searching for maintainers and people that previously touched related code and @ mention them in a comment. You can use or on the relevant files to find them. Lastly, you can always ask for help at or at .

<ins> { stdenv , fetchFromGitHub , nix-update-script , meson , ninja , pkg-config , scdoc , gnome-builder , gnused , glib , libgee , json-glib , jsonrpc-glib , vala }: stdenv.mkDerivation rec { pname = "vala-language-server"; version = "0.48.1"; src = fetchFromGitHub { owner = "benwaffle"; repo = pname; rev = version; sha256 = "12k095052jkvbiyz8gzkj6w7r7p16d5m18fyikl48yvh5nln8fw0"; }; passthru = { updateScript = nix-update-script { attrPath = pname; }; }; nativeBuildInputs = [ meson ninja pkg-config scdoc # GNOME Builder Plugin gnused gnome-builder ]; buildInputs = [ glib libgee json-glib jsonrpc-glib vala ]; meta = with stdenv.lib; { description = "Code Intelligence for Vala & Genie"; homepage = "https://github.com/benwaffle/vala-language-server"; license = licenses.lgpl21Plus; maintainers = with maintainers; [ andreasfelix worldofpeace ]; platforms = platforms.linux; }; } </ins>


Question:
Project description Code Intelligence for Vala Metadata homepage URL: source URL: license: LGPL2.1 platforms: unix, linux, darwin, ...
any relation to
There are some efforts to merge the two servers but otherwise they are independent.
Hello, I'm a bot and I thank you in the name of the community for opening this issue. To help our human contributors focus on the most-relevant reports, I check up on old issues to see if they're still relevant. This issue has had no activity for 180 days, and so I marked it as stale, but you can rest assured it will never be closed by a non-human. The community would appreciate your effort in checking if the issue is still valid. If it isn't, please close it. If the issue persists, and you'd like to remove the stale label, you simply need to leave a comment. Your comment can be as simple as "still important to me". If you'd like it to get more attention, you can ask for help by searching for maintainers and people that previously touched related code and @ mention them in a comment. You can use or on the relevant files to find them. Lastly, you can always ask for help at or at .

vagrant = callPackage ../development/tools/vagrant {}; <ins> vala-language-server = callPackage ../development/tools/vala-language-server {}; </ins> bashdb = callPackage ../development/tools/misc/bashdb { }; gdb = callPackage ../development/tools/misc/gdb {


Question:
Describe the bug addon in chromium does not work. After install addon show errors: "Failed to connect to the main process." "Verify the installation of the plasma-browser-integration package. The running environment of the Plasma desktop environment must be at least version 5.13." "Specified native messaging host not found." Manually run from console not help. To Reproduce Steps to reproduce the behavior: Add to : Expected behavior No errors. Additional context I found issue Everything looks like the same problem but in chromium Notify maintainers <!-- Please @ people who are in the list of the offending package or module. If in doubt, check for whoever last touched something. --Metadata Please run nix-shell -p nix-info --run "nix-info -m" and paste the result. system: host os: multi-user?: sandbox: version: channels(root): nixpkgs: Maintainer information:
Try adding the following line to your configuration:
now And also does not work. Maybe I need to reboot?
That issue is actually unrelated, it has to do with a patch only in our source build of firefox.
I make test with: in . The same error.
I can't reproduce this issue. I just tested in a vm using with this configuration: Are you using plasma5?
Yes plasma5. Looks like it worked for me too. Now all errors are gone. Thanks !
Why are we adding to systemPackages when using the chromium program module? It does this for you.
Just an oversight on my part. You're right, adding chromium to systemPackages is not necessary.
Hello, I'm a bot and I thank you in the name of the community for opening this issue. To help our human contributors focus on the most-relevant reports, I check up on old issues to see if they're still relevant. This issue has had no activity for 180 days, and so I marked it as stale, but you can rest assured it will never be closed by a non-human. The community would appreciate your effort in checking if the issue is still valid. If it isn't, please close it. If the issue persists, and you'd like to remove the stale label, you simply need to leave a comment. Your comment can be as simple as "still important to me". If you'd like it to get more attention, you can ask for help by searching for maintainers and people that previously touched related code and @ mention them in a comment. You can use or on the relevant files to find them. Lastly, you can always ask for help at or at .
Thanks - the fix worked for me! Can you please comment on what's the role of package that you install?
I marked this as stale due to inactivity. →
Proposed fix in

<del> { config, lib, ... }: </del> <ins> { config, lib, pkgs, ... }: </ins> with lib;


Question:
Describe the bug addon in chromium does not work. After install addon show errors: "Failed to connect to the main process." "Verify the installation of the plasma-browser-integration package. The running environment of the Plasma desktop environment must be at least version 5.13." "Specified native messaging host not found." Manually run from console not help. To Reproduce Steps to reproduce the behavior: Add to : Expected behavior No errors. Additional context I found issue Everything looks like the same problem but in chromium Notify maintainers <!-- Please @ people who are in the list of the offending package or module. If in doubt, check for whoever last touched something. --Metadata Please run nix-shell -p nix-info --run "nix-info -m" and paste the result. system: host os: multi-user?: sandbox: version: channels(root): nixpkgs: Maintainer information:
Try adding the following line to your configuration:
now And also does not work. Maybe I need to reboot?
That issue is actually unrelated, it has to do with a patch only in our source build of firefox.
I make test with: in . The same error.
I can't reproduce this issue. I just tested in a vm using with this configuration: Are you using plasma5?
Yes plasma5. Looks like it worked for me too. Now all errors are gone. Thanks !
Why are we adding to systemPackages when using the chromium program module? It does this for you.
Just an oversight on my part. You're right, adding chromium to systemPackages is not necessary.
Hello, I'm a bot and I thank you in the name of the community for opening this issue. To help our human contributors focus on the most-relevant reports, I check up on old issues to see if they're still relevant. This issue has had no activity for 180 days, and so I marked it as stale, but you can rest assured it will never be closed by a non-human. The community would appreciate your effort in checking if the issue is still valid. If it isn't, please close it. If the issue persists, and you'd like to remove the stale label, you simply need to leave a comment. Your comment can be as simple as "still important to me". If you'd like it to get more attention, you can ask for help by searching for maintainers and people that previously touched related code and @ mention them in a comment. You can use or on the relevant files to find them. Lastly, you can always ask for help at or at .
Thanks - the fix worked for me! Can you please comment on what's the role of package that you install?
I marked this as stale due to inactivity. →
Proposed fix in

programs.chromium = { enable = mkEnableOption (lib.mdDoc "{command}`chromium` policies"); <ins> enablePlasmaBrowserIntegration = mkEnableOption (lib.mdDoc "Native Messaging Host for Plasma Browser Integration"); plasmaBrowserIntegrationPackage = mkPackageOption pkgs "plasma5Packages.plasma-browser-integration" { }; </ins> extensions = mkOption { <del> type = types.listOf types.str; </del> <ins> type = with types; nullOr (listOf str); </ins> description = lib.mdDoc '' List of chromium extensions to install. For list of plugins ids see id in url of extensions on


Question:
Describe the bug addon in chromium does not work. After install addon show errors: "Failed to connect to the main process." "Verify the installation of the plasma-browser-integration package. The running environment of the Plasma desktop environment must be at least version 5.13." "Specified native messaging host not found." Manually run from console not help. To Reproduce Steps to reproduce the behavior: Add to : Expected behavior No errors. Additional context I found issue Everything looks like the same problem but in chromium Notify maintainers <!-- Please @ people who are in the list of the offending package or module. If in doubt, check for whoever last touched something. --Metadata Please run nix-shell -p nix-info --run "nix-info -m" and paste the result. system: host os: multi-user?: sandbox: version: channels(root): nixpkgs: Maintainer information:
Try adding the following line to your configuration:
now And also does not work. Maybe I need to reboot?
That issue is actually unrelated, it has to do with a patch only in our source build of firefox.
I make test with: in . The same error.
I can't reproduce this issue. I just tested in a vm using with this configuration: Are you using plasma5?
Yes plasma5. Looks like it worked for me too. Now all errors are gone. Thanks !
Why are we adding to systemPackages when using the chromium program module? It does this for you.
Just an oversight on my part. You're right, adding chromium to systemPackages is not necessary.
Hello, I'm a bot and I thank you in the name of the community for opening this issue. To help our human contributors focus on the most-relevant reports, I check up on old issues to see if they're still relevant. This issue has had no activity for 180 days, and so I marked it as stale, but you can rest assured it will never be closed by a non-human. The community would appreciate your effort in checking if the issue is still valid. If it isn't, please close it. If the issue persists, and you'd like to remove the stale label, you simply need to leave a comment. Your comment can be as simple as "still important to me". If you'd like it to get more attention, you can ask for help by searching for maintainers and people that previously touched related code and @ mention them in a comment. You can use or on the relevant files to find them. Lastly, you can always ask for help at or at .
Thanks - the fix worked for me! Can you please comment on what's the role of package that you install?
I marked this as stale due to inactivity. →
Proposed fix in

[ExtensionInstallForcelist](https://cloud.google.com/docs/chrome-enterprise/policies/?policy=ExtensionInstallForcelist) for additional details. ''; <del> default = []; </del> <ins> default = null; </ins> example = literalExpression '' [ "chlffgpmiacpedhhbkiomidkjlcfhogd" # pushbullet


Question:
Describe the bug addon in chromium does not work. After install addon show errors: "Failed to connect to the main process." "Verify the installation of the plasma-browser-integration package. The running environment of the Plasma desktop environment must be at least version 5.13." "Specified native messaging host not found." Manually run from console not help. To Reproduce Steps to reproduce the behavior: Add to : Expected behavior No errors. Additional context I found issue Everything looks like the same problem but in chromium Notify maintainers <!-- Please @ people who are in the list of the offending package or module. If in doubt, check for whoever last touched something. --Metadata Please run nix-shell -p nix-info --run "nix-info -m" and paste the result. system: host os: multi-user?: sandbox: version: channels(root): nixpkgs: Maintainer information:
Try adding the following line to your configuration:
now And also does not work. Maybe I need to reboot?
That issue is actually unrelated, it has to do with a patch only in our source build of firefox.
I make test with: in . The same error.
I can't reproduce this issue. I just tested in a vm using with this configuration: Are you using plasma5?
Yes plasma5. Looks like it worked for me too. Now all errors are gone. Thanks !
Why are we adding to systemPackages when using the chromium program module? It does this for you.
Just an oversight on my part. You're right, adding chromium to systemPackages is not necessary.
Hello, I'm a bot and I thank you in the name of the community for opening this issue. To help our human contributors focus on the most-relevant reports, I check up on old issues to see if they're still relevant. This issue has had no activity for 180 days, and so I marked it as stale, but you can rest assured it will never be closed by a non-human. The community would appreciate your effort in checking if the issue is still valid. If it isn't, please close it. If the issue persists, and you'd like to remove the stale label, you simply need to leave a comment. Your comment can be as simple as "still important to me". If you'd like it to get more attention, you can ask for help by searching for maintainers and people that previously touched related code and @ mention them in a comment. You can use or on the relevant files to find them. Lastly, you can always ask for help at or at .
Thanks - the fix worked for me! Can you please comment on what's the role of package that you install?
I marked this as stale due to inactivity. →
Proposed fix in

type = types.nullOr types.str; description = lib.mdDoc "Chromium default search provider url."; default = null; <del> example = "https://encrypted.google.com/search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}ie={inputEncoding}"; </del> <ins> example = "https://encrypted.google.com/search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}ie={inputEncoding}"; </ins> }; defaultSearchProviderSuggestURL = mkOption { type = types.nullOr types.str; description = lib.mdDoc "Chromium default search provider url for suggestions."; default = null; <del> example = "https://encrypted.google.com/complete/search?output=chrome&q={searchTerms}"; </del> <ins> example = "https://encrypted.google.com/complete/search?output=chrome&q={searchTerms}"; </ins> }; extraOpts = mkOption {