Question: headers = "1v7ap1v520hhghw358k41aahpnaif54qbg6a9dwgmg1di0qwn735"; }; <del> electron_26-bin = mkElectron "26.1.0" { armv7l-linux = "4a4a6587bddce4554657f40fd9d39645ede03a375a1c42455c9b8d556698e5f5"; aarch64-linux = "1ed0996a06e97f5c23ceb8ae767873915c432c0aca5ffd4b37ab5fb1002d9d65"; x86_64-linux = "de78aed71ce17395675a29dcd20c1370473713eb234143dd0fa3e4c5a39504eb"; x86_64-darwin = "39a336baca218058011f39c4fa9a4275348ec7f411789262799d23c9669060d9"; aarch64-darwin = "f39aafcf480ef581161d3dc0b89a91c556dcaed45927ee0b612368016afe7b89"; headers = "134iqsjg6b80jwywccrhkhlrk6vj12d1nmfqbvlcl0d6cyqw6hys"; </del> <ins> electron_26-bin = mkElectron "26.2.1" { armv7l-linux = "27469331e1b19f732f67e4b3ae01bba527b2744e31efec1ef76748c45fe7f262"; aarch64-linux = "fe634b9095120d5b5d2c389ca016c378d1c3ba4f49b33912f9a6d8eb46f76163"; x86_64-linux = "be4ca43f4dbc82cacb4c48a04f3c4589fd560a80a77dbb9bdf6c81721c0064df"; x86_64-darwin = "007413187793c94cd248f52d3e00e2d95ed73b7a3b2c5a618f22eba7af94cd1a"; aarch64-darwin = "4e095994525a0e97e897aad9c1940c8160ce2c9aaf7b6792f31720abc3e04ee6"; headers = "02z604nzcm8iw29s5lsgjlzwn666h3ikxpdfjg2h0mffm82d0wfk"; </ins> }; }

the application has enabled the libwebp-sys2 'static' feature, then it will skip looking for the system one and build its own
Unsure how to deal with the libwebp-sys2 things, which would still be vulnerable for cross-compiling and pkgsStatic. Opened an upstream issue:
Hi! Sorry for just popping in randomly, are there any publicly available workarounds for this issue currently? I'm on , but it seems like firefox nor others have gotten their version bump on that branch.
Not really, and as noted in this issue's description relying on the browser's version number is misleading here (because nixpkgs doesn't use the vendored libwebp, so what matters is the version of the libwebp dependency). If someone wants to write instructions using I'll gladly add those to the issue description for future reference.
On the branch we're only missing a few thousand builds per platform right now, so I'd hope for to update tomorrow.
From the : So looks like this one is fine. I'd remove the vendored download to prevent confusion, but looks like this is automatically generated...
staging-next was merged to master, so users on nixos-unstable should have their browsers patched on the next channel bump.
Fixes for Tor Browser & Mullvad Browser:
Hi! I use the branch specifically in my flake, any ETA on when that branch will get the update pushed?
Depends on how fast stuff ends up rebuilding, I'd expect within 1-2 days at the latest. It's all in automation's hands at this point, unless there's somehow a breakage we didn't notice. You can switch to which already has it (but might require you to do more rebuilds from source), or follow for the status of the fix.
I think I might channel-switch for a bit for this fix, thanks for the help!


Question: headers = "1v7ap1v520hhghw358k41aahpnaif54qbg6a9dwgmg1di0qwn735"; }; <del> electron_26-bin = mkElectron "26.1.0" { armv7l-linux = "4a4a6587bddce4554657f40fd9d39645ede03a375a1c42455c9b8d556698e5f5"; aarch64-linux = "1ed0996a06e97f5c23ceb8ae767873915c432c0aca5ffd4b37ab5fb1002d9d65"; x86_64-linux = "de78aed71ce17395675a29dcd20c1370473713eb234143dd0fa3e4c5a39504eb"; x86_64-darwin = "39a336baca218058011f39c4fa9a4275348ec7f411789262799d23c9669060d9"; aarch64-darwin = "f39aafcf480ef581161d3dc0b89a91c556dcaed45927ee0b612368016afe7b89"; headers = "134iqsjg6b80jwywccrhkhlrk6vj12d1nmfqbvlcl0d6cyqw6hys"; </del> <ins> electron_26-bin = mkElectron "26.2.1" { armv7l-linux = "27469331e1b19f732f67e4b3ae01bba527b2744e31efec1ef76748c45fe7f262"; aarch64-linux = "fe634b9095120d5b5d2c389ca016c378d1c3ba4f49b33912f9a6d8eb46f76163"; x86_64-linux = "be4ca43f4dbc82cacb4c48a04f3c4589fd560a80a77dbb9bdf6c81721c0064df"; x86_64-darwin = "007413187793c94cd248f52d3e00e2d95ed73b7a3b2c5a618f22eba7af94cd1a"; aarch64-darwin = "4e095994525a0e97e897aad9c1940c8160ce2c9aaf7b6792f31720abc3e04ee6"; headers = "02z604nzcm8iw29s5lsgjlzwn666h3ikxpdfjg2h0mffm82d0wfk"; </ins> }; }

Additional packages which have a vendored libwebp that I found on my system via the that posted in Matrix: slack obs-studio (via ) openutau (via embedded , also oops this package is mine )
Same method as mentioned by Lily, found: android-studio discord idea-community vial (via ) joplin jetbrains-jdk-jcef (via ) qtimageformats (via )
I looked more into .NET apps that depend on Avalonia and I've also confirmed these vendor libwebp (all via ). I've not confirmed that any of them use the vulnerable version directly, but it seems highly likely they do given a new SkiaSharp release has still not been made since the release of the CVE fix: BeatSaberModManager alttpr-opentracker avalonia-ilspy denaro galaxy-buds-client git-credential-manager jellyfin mission-planner mqttmultimeter ryujinx scarab space-station-14-launcher wasabiwallet
same method as hexa and liliy
currently working on a betterbird update. Not sure about thunderbird and I don't really have the time to check it right now. edit
Also going to add onlyoffice-bin, libsForQt5.qt5.qtimageformats, libsForQt6.qt6.qtimageformats and remarkable{,2}-toolchain to the naughty vendoring list.
If it uses buildMozillaMach it uses our system package.
Got a match for "no memory during frame initialization." in : /nix/store/z613gjk28c3q0ypjsdch9vshdlydc9fm-vscodium-1.82.0./lib/vscode/codium
I've ran a grep on ~200K Nix store paths from a full Hydra evaluation - here are the results: Let's start categorizing that a bit and translating it into trackable tasks :) I've already listed all the SkiaSharp dependents. A few other categories I see: CEF users Vendored Electron users Qt libs Flutter Go binaries (e.g. mautrix-whatsapp, but not sure what package the dep is coming from)
For reference, I believe that all supported channels (6) have updated past the patching (the non-vendored one). This weekend turned out to be a pessimistic estimate.


Question: headers = "1v7ap1v520hhghw358k41aahpnaif54qbg6a9dwgmg1di0qwn735"; }; <del> electron_26-bin = mkElectron "26.1.0" { armv7l-linux = "4a4a6587bddce4554657f40fd9d39645ede03a375a1c42455c9b8d556698e5f5"; aarch64-linux = "1ed0996a06e97f5c23ceb8ae767873915c432c0aca5ffd4b37ab5fb1002d9d65"; x86_64-linux = "de78aed71ce17395675a29dcd20c1370473713eb234143dd0fa3e4c5a39504eb"; x86_64-darwin = "39a336baca218058011f39c4fa9a4275348ec7f411789262799d23c9669060d9"; aarch64-darwin = "f39aafcf480ef581161d3dc0b89a91c556dcaed45927ee0b612368016afe7b89"; headers = "134iqsjg6b80jwywccrhkhlrk6vj12d1nmfqbvlcl0d6cyqw6hys"; </del> <ins> electron_26-bin = mkElectron "26.2.1" { armv7l-linux = "27469331e1b19f732f67e4b3ae01bba527b2744e31efec1ef76748c45fe7f262"; aarch64-linux = "fe634b9095120d5b5d2c389ca016c378d1c3ba4f49b33912f9a6d8eb46f76163"; x86_64-linux = "be4ca43f4dbc82cacb4c48a04f3c4589fd560a80a77dbb9bdf6c81721c0064df"; x86_64-darwin = "007413187793c94cd248f52d3e00e2d95ed73b7a3b2c5a618f22eba7af94cd1a"; aarch64-darwin = "4e095994525a0e97e897aad9c1940c8160ce2c9aaf7b6792f31720abc3e04ee6"; headers = "02z604nzcm8iw29s5lsgjlzwn666h3ikxpdfjg2h0mffm82d0wfk"; </ins> }; }

golden-cheetah-bin: PR to mark insecure: Also reported upstream:
opencv seems like a relatively common package (with multiple versions). Maybe the maintainer could have a look?
High priority things that I think are still to be updated: Chat apps / browsers / mail clients: fluffychat (uses vendored flutter < v3.13.4, cc upstream has a commit in master which updates flutter to 3.13.4, but I don't think that's released yet. gitter (cc upstream seems unmaintained anyway, should be removed?) mautrix-whatsapp (vendored via some Go dep, cc signal-desktop-beta (cc who took care of Signal, can you maybe have a look?) threema-desktop (lib/threema/threema-web - is this even used? since we use nixpkgs electron, cc tutanota-desktop (opt/tutanota-desktop/tutanota-desktop - similar to threema-desktop, also cc
mattermost-desktop (share/mattermost-desktop/mattermost-desktop, cc
rocketchat-desktop (cc I think just needs a bump to 3.9.7 for
Yeah removing gutter seems fine
do you recommend moving FluffyChat from stable -a git commit temporarily? By the way, flutter itself seems to have a bad vendored version. Need to push out 3.13.4.
There's a mautrix-whatsapp bump here: , not sure how I can check whether this is fixed by that PR? Edit: looked into the upstream source, definitely not fixed by that PR. From what I can see mautrix-whatsapp uses libwebp in a vulnerable way. I'll try to work with upstream to get this resolved.
If cherry-picking the patch is an option it's probably less invasive, if upstream is planning a release in the next 2-3 days I think I wouldn't mind waiting too. If neither of these options apply (or if you don't mind bumping twice in rapid succession if upstream pushes a new release) going to an unstable version SGTM.
was updated and merged recently (). Would that count?
Looks like that new version contains which is a proper fix. Thanks for the pointer! Just needs backport to 23.05 now.
It was mentioned in the changelog, please read them when updating a package.


Question: headers = "1v7ap1v520hhghw358k41aahpnaif54qbg6a9dwgmg1di0qwn735"; }; <del> electron_26-bin = mkElectron "26.1.0" { armv7l-linux = "4a4a6587bddce4554657f40fd9d39645ede03a375a1c42455c9b8d556698e5f5"; aarch64-linux = "1ed0996a06e97f5c23ceb8ae767873915c432c0aca5ffd4b37ab5fb1002d9d65"; x86_64-linux = "de78aed71ce17395675a29dcd20c1370473713eb234143dd0fa3e4c5a39504eb"; x86_64-darwin = "39a336baca218058011f39c4fa9a4275348ec7f411789262799d23c9669060d9"; aarch64-darwin = "f39aafcf480ef581161d3dc0b89a91c556dcaed45927ee0b612368016afe7b89"; headers = "134iqsjg6b80jwywccrhkhlrk6vj12d1nmfqbvlcl0d6cyqw6hys"; </del> <ins> electron_26-bin = mkElectron "26.2.1" { armv7l-linux = "27469331e1b19f732f67e4b3ae01bba527b2744e31efec1ef76748c45fe7f262"; aarch64-linux = "fe634b9095120d5b5d2c389ca016c378d1c3ba4f49b33912f9a6d8eb46f76163"; x86_64-linux = "be4ca43f4dbc82cacb4c48a04f3c4589fd560a80a77dbb9bdf6c81721c0064df"; x86_64-darwin = "007413187793c94cd248f52d3e00e2d95ed73b7a3b2c5a618f22eba7af94cd1a"; aarch64-darwin = "4e095994525a0e97e897aad9c1940c8160ce2c9aaf7b6792f31720abc3e04ee6"; headers = "02z604nzcm8iw29s5lsgjlzwn666h3ikxpdfjg2h0mffm82d0wfk"; </ins> }; }

It will count once the backport to release-23.05 has happened.
I had already reported the issue to mautrix-whatsapp in private to lessen the chance of exploitation (they use the webp dependency to decode webp images and are thus vulnerable). I've had no response yet though.
Heh, I don't think there's much value in reporting this in private (and making coordination/tracking harder) given that it's a publicly disclosed vulnerability already. I noticed you said you'd talk to upstream but couldn't find any trace of that, so I went ahead and filed that bug... Sorry for stepping on your toes - it's hard for me to know exactly how actively maintainers are going to handle the remediation by themselves, so I've been proactive in making sure upstream issues are filed when I don't see one
Godot (godot3, godot_4, godot3-headless, godot3-server, godot3-export-templates): upstream has merged which I think is getting backported to the 3.x branch. But it also appears that, at least for 4.x, libwebp can be unvendored: I think that's what we should be doing while waiting for new releases, and this is likely true of many other dependencies that can be unvendored via the same mechanism. cc maintainers: (please cc me on any fix PR and make sure to backport to 23.05).
Fix for mautrix-whatsapp here: (backport here: )
Worth noting is vulnerable, upstream fix was in PR Kong/insomnia, though it hasn't gotten a release yet.
is a fix for signal-desktop-beta, thanks
:heart: to all who have contributed to this.
Explicitly pinging the maintainers for the remaining high-risk use cases: armcord still uses vulnerable Electron 26.1.0. Please get upstream to fix their security vulnerabilities. caprine-bin is presumably built by upstream from Electron 24.1.3 from 151 days ago. Please get upstream to fix their security vulnerabilities. (Additionnally, why is this a binary build instead of something we build from source?) - mailspring uses Electron 17, which is hopelessly out of date, EOL, and insecure. Please get upstream to fix their security vulnerabilities.


Question: headers = "1v7ap1v520hhghw358k41aahpnaif54qbg6a9dwgmg1di0qwn735"; }; <del> electron_26-bin = mkElectron "26.1.0" { armv7l-linux = "4a4a6587bddce4554657f40fd9d39645ede03a375a1c42455c9b8d556698e5f5"; aarch64-linux = "1ed0996a06e97f5c23ceb8ae767873915c432c0aca5ffd4b37ab5fb1002d9d65"; x86_64-linux = "de78aed71ce17395675a29dcd20c1370473713eb234143dd0fa3e4c5a39504eb"; x86_64-darwin = "39a336baca218058011f39c4fa9a4275348ec7f411789262799d23c9669060d9"; aarch64-darwin = "f39aafcf480ef581161d3dc0b89a91c556dcaed45927ee0b612368016afe7b89"; headers = "134iqsjg6b80jwywccrhkhlrk6vj12d1nmfqbvlcl0d6cyqw6hys"; </del> <ins> electron_26-bin = mkElectron "26.2.1" { armv7l-linux = "27469331e1b19f732f67e4b3ae01bba527b2744e31efec1ef76748c45fe7f262"; aarch64-linux = "fe634b9095120d5b5d2c389ca016c378d1c3ba4f49b33912f9a6d8eb46f76163"; x86_64-linux = "be4ca43f4dbc82cacb4c48a04f3c4589fd560a80a77dbb9bdf6c81721c0064df"; x86_64-darwin = "007413187793c94cd248f52d3e00e2d95ed73b7a3b2c5a618f22eba7af94cd1a"; aarch64-darwin = "4e095994525a0e97e897aad9c1940c8160ce2c9aaf7b6792f31720abc3e04ee6"; headers = "02z604nzcm8iw29s5lsgjlzwn666h3ikxpdfjg2h0mffm82d0wfk"; </ins> }; }

mattermost-desktop is out of date in nixpkgs. Their latest release is based on Electron 26.1.0, which is also insecure. Please get upstream to fix their security vulnerabilities. rocketchat-desktop also needs a bump in release-23.05. I've started the backport process via the master PR, please test it and let me know when it's ready to be merged. - Everything in this list that hasn't been updated by Friday 2023-09-29 00:00 UTC will be marked as insecure next weekend.
Also mentioned this on Matrix, but for posterity: SideQuest is also affected (and frequently loads untrusted content). It appears to use a bundled Electron 13, which has not received and will not receive a patch. I've e-mailed the upstream in the hopes that they can update to a newer Electron ASAP.
Using and then checking the output of by opening DevTools (Ctrl+Shift+I) : <- patched according to GH security advisory : <- patched according to GH security advisory : <- vulnerable? Tested on
Great, thanks for looking into it! Hopefully they'll roll out that update to the stable branch soon... I guess it's difficult for a small indie developer like them, it's only been 2 weeks since the fix was made available! :-)
just got updated in master so it's not in nixos-unstable yet. thanks for checking it out, I couldn't figure out a way to check the electron ver.
Thanks! I checked 0.0.30 (which is on master and 23.05 as of yesterday) and it seems to be on Electron 22.3.24. Marking as fixed
Thanks for pinning me. Just created an issue there: Because the source build failed the time I tried to package Caprine (some years ago). It's a pain to an build Electron app from source in Nixpkgs.
Regarding Mailspring there is , I will ask about their plans to move forwards
There should be a pre-release with electron 27 for armcord, will dig in tomorrow.
Currently we are not building koreader from source (see for some efforts).


Question: headers = "1v7ap1v520hhghw358k41aahpnaif54qbg6a9dwgmg1di0qwn735"; }; <del> electron_26-bin = mkElectron "26.1.0" { armv7l-linux = "4a4a6587bddce4554657f40fd9d39645ede03a375a1c42455c9b8d556698e5f5"; aarch64-linux = "1ed0996a06e97f5c23ceb8ae767873915c432c0aca5ffd4b37ab5fb1002d9d65"; x86_64-linux = "de78aed71ce17395675a29dcd20c1370473713eb234143dd0fa3e4c5a39504eb"; x86_64-darwin = "39a336baca218058011f39c4fa9a4275348ec7f411789262799d23c9669060d9"; aarch64-darwin = "f39aafcf480ef581161d3dc0b89a91c556dcaed45927ee0b612368016afe7b89"; headers = "134iqsjg6b80jwywccrhkhlrk6vj12d1nmfqbvlcl0d6cyqw6hys"; </del> <ins> electron_26-bin = mkElectron "26.2.1" { armv7l-linux = "27469331e1b19f732f67e4b3ae01bba527b2744e31efec1ef76748c45fe7f262"; aarch64-linux = "fe634b9095120d5b5d2c389ca016c378d1c3ba4f49b33912f9a6d8eb46f76163"; x86_64-linux = "be4ca43f4dbc82cacb4c48a04f3c4589fd560a80a77dbb9bdf6c81721c0064df"; x86_64-darwin = "007413187793c94cd248f52d3e00e2d95ed73b7a3b2c5a618f22eba7af94cd1a"; aarch64-darwin = "4e095994525a0e97e897aad9c1940c8160ce2c9aaf7b6792f31720abc3e04ee6"; headers = "02z604nzcm8iw29s5lsgjlzwn666h3ikxpdfjg2h0mffm82d0wfk"; </ins> }; }

Since the released upstream deb package has not fixed CVE-2023-4863 ( fixed it, but it is not released yet), we have to wait a while for a new koreader release.
To make it better, I reported them this like 2 weeks ago! They're still working on running the npm command on the stable branch, give them some time!
fluffychat and flutter updates have been backported now:
I made a draft PR that contains the caprine-bin update (), but the updated app turns out to be unusable (sindresorhus/caprine).
The above issue is resolved in Caprine 2.58.3. Please take a look at .
it was brought to my attention that the Darwin version for Discord was not bumped in 6 months, and is thus still vulnerable to this libwebp vuln. If nobody maintains this software can it be removed and/or marked as knownVulnerable? Thanks!
I'd say that after a bit of wait you mark packages as vulnerable and that is the main way of finding out whether someone is really willing to keep it alive.
I have bumped them in . The main issue is that r-ryantm isn't helping us out here, as there is no for the darwin packaging. Not sure if any of the other Discord maintainers are using Darwin, but I certainly don't and would need some assistance testing these.
is affected. I created mifi/lossless-cut to remind the LosslessCut upstream to make a new patch release, so that me can update .
is affected, fix:
All the packages I evaluated as being high-risk have now been taken care of (and most of them did actually get updates, woo! only marked 2 or 3 as insecure). Right now I don't think anyone has the bandwidth to try and track the rest. I'm going to close this bug - if someone does want to take over the remediation for the rest of the impacted packages, feel free to reopen and assign yourself. (Note however that there is a large overlap between vulnerable to this libwebp vuln and vulnerable to the recent libvpx vuln... so maybe just go help over there instead of reusing this bug.)
Unpinning due to closing
This issue has been mentioned on NixOS Discourse. There might be relevant details there:


Question: with python3Packages; buildPythonApplication rec { pname = "kitty"; <del> version = "0.34.0"; </del> <ins> version = "0.34.1"; </ins> format = "other"; src = fetchFromGitHub { owner = "kovidgoyal"; repo = "kitty"; rev = "refs/tags/v${version}"; <del> hash = "sha256-IP1CWMHiWnBSbt+78EQ6hfX2A9FDhlwt0KLthXtO4dA="; </del> <ins> hash = "sha256-r7KZcSqREILMp0F9ajeHS5sglq/o88h2t+4BgbABjOY="; </ins> }; goModules = (buildGo122Module {

Package name: kitty Latest released version: 0.34.1 <!-- Search your package here: --- Current version on the unstable channel: 0.34.0 Current version on the stable/release channel: 0.31.0 <!-- Type the name of your package and try to find an open pull request for the package If you find an open pull request, you can review it! There's a high chance that you'll have the new version right away while helping the community! --- Notify maintainers <!-- If the result shows no maintainers, tag the person that last updated the package. --Note for maintainers: Please tag this issue in your PR. Add a :+1: [reaction] to [issues you find important]. [reaction]: [issues you find important]:


Question: <ins> { lib , buildGoModule , fetchFromGitHub }: buildGoModule rec { pname = "virter"; version = "0.25.0"; src = fetchFromGitHub { owner = "LINBIT"; repo = "virter"; rev = "v${version}"; hash = "sha256-NIZBaPYFFH3MG2M7rF39TW8sLVR44SA37ZU3gOPwAFU="; }; vendorHash = "sha256-cVOxRrsDdtlDSJ3WRDNk8nqt7ztz4GSRIf6FDDBxvPc="; ldflags = [ "-s" "-w" "-X github.com/LINBIT/virter/cmd.version=${version}" "-X github.com/LINBIT/virter/cmd.builddate=builtByNix" "-X github.com/LINBIT/virter/cmd.githash=builtByNix" ]; # requires network access doCheck = false; meta = { description = "A command line tool for simple creation and cloning of virtual machines based on libvirt"; homepage = "https://github.com/LINBIT/virter"; license = lib.licenses.asl20; maintainers = with lib.maintainers; [ dit7ya ]; }; } </ins>

Project description Virter is a command line tool for simple creation and cloning of virtual machines based on libvirt Metadata homepage URL: source URL: Blogs: , license: Apache v2 platforms: Linux only written in: go Thanks a ton!


Question: { LOCATE_PATH = cfg.output; }; <del> warnings = optional (isMLocate && cfg.localuser != null) "mlocate does not support searching as user other than root" </del> <ins> warnings = optional (isMLocate && cfg.localuser != null) "mlocate does not support the services.locate.localuser option; updatedb will run as root. (Silence with services.locate.localuser = null.)" </ins> ++ optional (isFindutils && cfg.pruneNames != []) "findutils locate does not support pruning by directory component" ++ optional (isFindutils && cfg.pruneBindMounts) "findutils locate does not support skipping bind mounts";

prints The message seems misleading as everything works as expected, even as a regular user. = { enable = true; locate = pkgs.mlocate; }; System: (NixOS: ) Nix version: () Nixpkgs version: ()
This still happens, although its a correct warning
That's surprising since it works for me without root. I only experienced issues when the wrong binary is used. If I recall correctly has higher priority and causes this. Can you check the output of or paste whatever error you get?
Sorry hit the wrong button by accident.
The warning is correct, but the wording is misleading. What it’s trying to warn you is not that will only run as , but rather that will run as . You can prevent the warning from being shown (with no other effect) by explicitly requesting that run as with .
This is warning is still confusing to me. If I'm building an index of files, I'd expect that if I run it as a non privileged user many files will not be reachable and therefore these won't end up in the locate database/index. Given the way works, I'd also expect to have one database per system, not one per user. So from this my expectation is that can only successfully index everything if run as . In other words, I'm still not sure what is the purpose or goal of the message. Is it just that the command needs to run as ? is this bad in any way? why is this special given the purpose of the tool? Is it that the fact that it runs as is in some way a security concern? Is this to clarify that despite the existence of an group (and user?) these are not actually used for indexing, or is the point something else entirely. Do other tools work in such a different way that justifies the existence of this warning for ?
mlocate’s doesn’t have a option like findutils’ does. Therefore, the NixOS module ignores when using mlocate (). It prints a warning to indicate that your expectation has been violated. The group is there so that the mlocate binary can be setgid rather than setuid . Given that mlocate is designed with an that indexes everything and a that only shows you your own files, there doesn’t seem to be much point in running mlocate’s as another user.


Question: { LOCATE_PATH = cfg.output; }; <del> warnings = optional (isMLocate && cfg.localuser != null) "mlocate does not support searching as user other than root" </del> <ins> warnings = optional (isMLocate && cfg.localuser != null) "mlocate does not support the services.locate.localuser option; updatedb will run as root. (Silence with services.locate.localuser = null.)" </ins> ++ optional (isFindutils && cfg.pruneNames != []) "findutils locate does not support pruning by directory component" ++ optional (isFindutils && cfg.pruneBindMounts) "findutils locate does not support skipping bind mounts";

If you want that, why not switch back to findutils?
I see, in this context, the above makes sense. I actually want the full system indexing. To me has always been a synonym of , except several times faster. Thanks for the clarification!
Hello, I'm a bot and I thank you in the name of the community for opening this issue. To help our human contributors focus on the most-relevant reports, I check up on old issues to see if they're still relevant. This issue has had no activity for 180 days, and so I marked it as stale, but you can rest assured it will never be closed by a non-human. The community would appreciate your effort in checking if the issue is still valid. If it isn't, please close it. If the issue persists, and you'd like to remove the stale label, you simply need to leave a comment. Your comment can be as simple as "still important to me". If you'd like it to get more attention, you can ask for help by searching for maintainers and people that previously touched related code and @ mention them in a comment. You can use or on the relevant files to find them. Lastly, you can always ask for help at or at .
Could you include your commit in a pull request? I think that's a good solution and we can close this issue.
It’s been in this whole time.
My bad, I read only the latest updates and the pull request was higher up. Did a bit of noise on the pull request. It's a harmless change so I was surprised to see it sitting there for this long.
To avoid , this is needed: it's needed because it creates the group. That error happens when using: with or without: and then doing something like . But if not using the (so only using the alone) then there's no error, because the service itself uses a different package's by default, it's from package. The source: EDIT: I made some mistakes initially, you can see post history for that.


Question: "--enable-gc" ] ++ lib.optionals (!enableDocumentation) [ "--disable-doc-gen" <del> ] ++ lib.optionals (!atLeast24) [ # option was removed in 2.4 "--disable-init-state" </del> ] ++ lib.optionals atLeast214 [ "CXXFLAGS=-I${lib.getDev rapidcheck}/extras/gtest/include" ] ++ lib.optionals stdenv.isLinux [

Package name: nix23 Latest released version: 2.3.17 (see ) Current version on the unstable channel: 2.3.16 Current version on the stable/release channel: 2.3.16 Notify maintainers Note for maintainers: Please tag this issue in your PR. See for context. The release script apparently doesn't upload source tarballs anymore, so 2.3.17 sources look more like the other ones. There's a bunch of expressions in that might need to be revisited.


Question: description = "Enterprise-class Open Source LDAP server for Linux"; license = licenses.gpl3Plus; platforms = platforms.linux; <del> knownVulnerabilities = [ "CVE-2021-3514" # https://nvd.nist.gov/vuln/detail/CVE-2021-3514 ]; </del> }; }

Project description Upgrade 389-ds-base Apparenty its new 1.4.4.4 release is a bit different. Metadata homepage URL: source URL:
I marked this as stale due to inactivity. →


Question: <del> { lib, stdenvNoCC, pijul }: </del> <ins> { lib, stdenvNoCC, pijul, cacert }: </ins> lib.makeOverridable ( { url

The pijul fetcher throws a certificate error when used, for example with the following command: Related: Steps to reproduce the behavior: fetchpijul (for example like in the command above) fails with above error Repository gets fetched successfully Please run and paste the result. Add a :+1: [reaction] to [issues you find important]. [reaction]: [issues you find important]:
Oh my, thanks for notifying, I'll make a PR to fix that ASAP!


Question: fingerprint = "92D8 A09D 03DD B774 AABD 53B9 E136 2F07 D750 DB5C"; }]; }; <ins> lilacious = { email = "yuchenhe126@gmail.com"; github = "Lilacious"; githubId = 101508537; name = "Yuchen He"; }; </ins> lillycham = { email = "lillycat332@gmail.com"; github = "lillycat332";

Project description Railway lets you look up travel information for many different railways, all without needing to navigate through different websites. Metadata homepage URL: source URL: license: gpl3 platforms: linux Add a :+1: [reaction] to [issues you find important]. [reaction]: [issues you find important]:


Question: stdenv.mkDerivation rec { name = "tsocks-${version}"; version = "1.8beta5"; src = fetchurl { url = "mirror://sourceforge/tsocks/${name}.tar.gz"; sha256 = "0ixkymiph771dcdzvssi9dr2pk1bzaw9zv85riv3xl40mzspx7c4"; }; <ins> patches = [ ./poll.patch ]; </ins> preConfigure = '' <del> export configureFlags="$configureFlags --libdir=$out/lib" </del> <ins> sed -i -e "s,/usr,"$(echo $out|sed -e "s,/,/,g")",g" tsocks substituteInPlace tsocks --replace /usr $out export configureFlags="$configureFlags --libdir=$out/lib" </ins> ''; meta = with stdenv.lib; {

The tsocks package creates a shell script () that can be used to run a command with set to the tsocks library. However, it is hard-coded to use . It should be changed to use .
Fixed by


Question: <del> { mkDerivation , lib , fetchFromGitHub , qtbase , cmake , qttools , qtsvg , nix-update-script , fetchpatch , kguiaddons }: mkDerivation rec { pname = "flameshot"; version = "12.1.0"; src = fetchFromGitHub { owner = "flameshot-org"; repo = "flameshot"; rev = "v${version}"; sha256 = "sha256-omyMN8d+g1uYsEw41KmpJCwOmVWLokEfbW19vIvG79w="; }; patches = [ # https://github.com/flameshot-org/flameshot/pull/3166 (fetchpatch { name = "10-fix-wayland.patch"; url = "https://github.com/flameshot-org/flameshot/commit/5fea9144501f7024344d6f29c480b000b2dcd5a6.patch"; sha256 = "sha256-SnjVbFMDKD070vR4vGYrwLw6scZAFaQA4b+MbI+0W9E="; }) ]; passthru = { updateScript = nix-update-script { }; }; cmakeFlags = [ (lib.cmakeBool "USE_WAYLAND_CLIPBOARD" true) ]; nativeBuildInputs = [ cmake qttools qtsvg ]; buildInputs = [ qtbase kguiaddons ]; meta = with lib; { description = "Powerful yet simple to use screenshot software"; homepage = "https://github.com/flameshot-org/flameshot"; mainProgram = "flameshot"; maintainers = with maintainers; [ scode oxalica ]; license = licenses.gpl3Plus; platforms = platforms.linux ++ platforms.darwin; }; } </del>

flameshot has two backends, one that works in KDE, and one that works in wlroots-based compositors, but the flag USEWAYLANDGRIM must be set in order to enable it. Steps to reproduce the behavior: to use flameshot in wlroots-based compositor like sway It works [nix-shell:~]$ env XDGCURRENTDESKTOP=sway XDGSESSIONDESKTOP=sway QTQPAPLATFORM=wayland flameshot gui flameshot: error: Unable to capture screen flameshot: error: Unable to capture screen Wayland does not support QWindow::requestActivate() flameshot: info: Screenshot aborted. Add any other context about the problem here. Please run and paste the result. Add a :+1: [reaction] to [issues you find important]. [reaction]: [issues you find important]:
The flag upstream:
It turns out that this flag is not yet available in a release. To use it, I created the following package override: and now flameshot works! For home-manager I also the following:
Not sure I'd call this a bug if there's no release with this code, though it seems like it will be some time before the next release:
I can confirm that the overlay above works for me. There's a small caveat: should be available in the PATH, otherwise the setup will be a little more janky.
Whether or not there's a release, it's still a bug. There were more attempts to fix this 2-3 years back, but as you can read in that linked issue, the authors are currently not working on updates. Since there's no official release, it might not make sense to issue an interim package update, but as long as I have my working flameshot, I'm happy. I just wanted to share this with others who run into the same problem
I hadn't noticed that... I've just updated buildInputs (to add grim) and removed grim from my default home-manager environment... I think that should take care of it, but I'll test to be sure.
After using for awhile, I can confirm. You need to add grim into your environment in order for this to work consistently.
I can't seem to get that to work on GNOME see
Yes, grim is for wlroots-based compositors, not mutter.
Unrelated to this issue then?


Question: <del> { mkDerivation , lib , fetchFromGitHub , qtbase , cmake , qttools , qtsvg , nix-update-script , fetchpatch , kguiaddons }: mkDerivation rec { pname = "flameshot"; version = "12.1.0"; src = fetchFromGitHub { owner = "flameshot-org"; repo = "flameshot"; rev = "v${version}"; sha256 = "sha256-omyMN8d+g1uYsEw41KmpJCwOmVWLokEfbW19vIvG79w="; }; patches = [ # https://github.com/flameshot-org/flameshot/pull/3166 (fetchpatch { name = "10-fix-wayland.patch"; url = "https://github.com/flameshot-org/flameshot/commit/5fea9144501f7024344d6f29c480b000b2dcd5a6.patch"; sha256 = "sha256-SnjVbFMDKD070vR4vGYrwLw6scZAFaQA4b+MbI+0W9E="; }) ]; passthru = { updateScript = nix-update-script { }; }; cmakeFlags = [ (lib.cmakeBool "USE_WAYLAND_CLIPBOARD" true) ]; nativeBuildInputs = [ cmake qttools qtsvg ]; buildInputs = [ qtbase kguiaddons ]; meta = with lib; { description = "Powerful yet simple to use screenshot software"; homepage = "https://github.com/flameshot-org/flameshot"; mainProgram = "flameshot"; maintainers = with maintainers; [ scode oxalica ]; license = licenses.gpl3Plus; platforms = platforms.linux ++ platforms.darwin; }; } </del>

-Krey, make a new issue?
Sure, but I don't know if upstream even supports mutter; doesn't seem like it based on , , etc.
For context it's currently broken, but it worked with the fix in until recently, so thought it was relevant to this.


Question: <ins> let tests = { wayland = { pkgs, ... }: { imports = [ ./common/wayland-cage.nix ]; services.cage.program = "${pkgs.freetube}/bin/freetube"; virtualisation.memorySize = 2047; environment.variables.NIXOS_OZONE_WL = "1"; environment.variables.DISPLAY = "do not use"; }; xorg = { pkgs, ... }: { imports = [ ./common/user-account.nix ./common/x11.nix ]; virtualisation.memorySize = 2047; services.xserver.enable = true; services.xserver.displayManager.sessionCommands = '' ${pkgs.freetube}/bin/freetube ''; test-support.displayManager.auto.user = "alice"; }; }; mkTest = name: machine: import ./make-test-python.nix ({ pkgs, ... }: { inherit name; nodes = { "${name}" = machine; }; meta.maintainers = with pkgs.lib.maintainers; [ kirillrdy ]; enableOCR = true; testScript = '' start_all() machine.wait_for_unit('graphical.target') machine.wait_for_text('Your Subscription list is currently empty') machine.send_key("ctrl-r") machine.wait_for_text('Your Subscription list is currently empty') machine.screenshot("main.png") machine.send_key("ctrl-comma") machine.wait_for_text('General Settings', timeout=30) machine.screenshot("preferences.png") ''; }); in builtins.mapAttrs (k: v: mkTest k v { }) tests </ins>

Steps to reproduce the behavior: system configuration with Freetube in it. See and for the exact same issue with Morgen. Electron version lock seems to have been introduced with . Upstream seems to be at Electron 27: . and
Maybe we could add the patches from It looks like they were waiting for a nixos user to test it and eventually gave up on us.
are you able to test ?
Looks good as far as I can tell.
fails on this branch, for whatever reason.


Question: meta = with lib; { description = "Markdown notes editor and manager designed for elementary OS" <del> + lib.optionalString withPantheon " - built with Contractor support"; </del> <ins> + lib.optionalString withPantheon " - built with Contractor support"; </ins> homepage = "https://github.com/Philip-Scott/Notes-up"; <del> license = licenses.gpl2; </del> <ins> license = licenses.gpl2Only; </ins> maintainers = with maintainers; [ davidak ]; platforms = platforms.linux; };

Describe the bug To Reproduce Steps to reproduce the behavior: Expected behavior no fail Additional context it seem to be fixed upstream, but no new release it made yet Notify maintainers Metadata system: host os: multi-user?: sandbox: version: channels(root): nixpkgs: Maintainer information:


Question: { stdenv, fetchurl, pkgconfig, bc, perl, perlPackages, pam, libXext, libXScrnSaver, libX11 , libXrandr, libXmu, libXxf86vm, libXrender, libXxf86misc, libjpeg, libGLU, libGL, gtk2 <del> , libxml2, libglade, intltool, xorg, makeWrapper, gle </del> <ins> , libxml2, libglade, intltool, xorg, makeWrapper, gle, gdk-pixbuf, gdk-pixbuf-xlib </ins> , forceInstallAllHacks ? false }:

Describe the bug xscreensaver-demo is both a way to preview individual screensavers and the frontend for configuring xscreensaver. It should be installed alongside all the other xscreensaver binaries; however, it isn't, although its man page is. To Reproduce Steps to reproduce the behavior: Expected behavior is available in . Notify maintainers (raskin) Metadata system: host os: multi-user?: sandbox: version: channels(root): nixpkgs: Maintainer information:


Question: s = # Generated upstream information rec { baseName="firejail"; <del> version="0.9.44.10"; </del> <ins> version="0.9.48"; </ins> name="${baseName}-${version}"; <del> hash="19wln3h54wcscqgcmkm8sprdh7vrn5k91rr0hagv055y1i52c7mj"; url="https://netix.dl.sourceforge.net/project/firejail/firejail/firejail-0.9.44.10.tar.xz"; sha256="19wln3h54wcscqgcmkm8sprdh7vrn5k91rr0hagv055y1i52c7mj"; </del> <ins> hash="02a74nx8p2gbpd6ffnr52p02pxxllw3yy5fy4083a77r3wia8zb3"; url="https://vorboss.dl.sourceforge.net/project/firejail/firejail/firejail-0.9.48.tar.xz"; sha256="02a74nx8p2gbpd6ffnr52p02pxxllw3yy5fy4083a77r3wia8zb3"; </ins> }; buildInputs = [ which

firejail bash . Error: cannot establish communication with the parent, exiting. . [milan ~]$ firejail --debug bash ~ Autoselecting /nix/store/fibk8jc2iwswn1q1d7aw98pcw2l3lzjf-bash-4.4-p12/bin/bash as shell Command name #bash# Attempting to find default.profile. Found default profile in /nix/store/y4ai4pgjizcanjahcfcd785i7n0h6r4q-firejail-0.9.44.8/etc/firejail directory Reading profile /nix/store/y4ai4pgjizcanjahcfcd785i7n0h6r4q-firejail-0.9.44.8/etc/firejail/default.profile Reading profile /nix/store/y4ai4pgjizcanjahcfcd785i7n0h6r4q-firejail-0.9.44.8/etc/firejail/disable- Reading profile /nix/store/y4ai4pgjizcanjahcfcd785i7n0h6r4q-firejail-0.9.44.8/etc/firejail/disable- Reading profile /nix/store/y4ai4pgjizcanjahcfcd785i7n0h6r4q-firejail-0.9.44.8/etc/firejail/disable- Note: you can use --noprofile to disable default.profile DISPLAY :0, 0 Using the local network stack Parent pid , child pid Initializing child process Host network configured PID namespace installed Mounting tmpfs on /run/firejail/mnt directory Mounting read-only /bin, /sbin, /lib, /lib32, /lib64, /usr, /etc, /var Mounting tmpfs on /var/lock Mounting tmpfs on /var/tmp Mounting tmpfs on /var/log Create the new utmp file Mount the new utmp file Cleaning /home directory Sanitizing /etc/passwd, UIDMIN 1000 Sanitizing /etc/group,


Question: s = # Generated upstream information rec { baseName="firejail"; <del> version="0.9.44.10"; </del> <ins> version="0.9.48"; </ins> name="${baseName}-${version}"; <del> hash="19wln3h54wcscqgcmkm8sprdh7vrn5k91rr0hagv055y1i52c7mj"; url="https://netix.dl.sourceforge.net/project/firejail/firejail/firejail-0.9.44.10.tar.xz"; sha256="19wln3h54wcscqgcmkm8sprdh7vrn5k91rr0hagv055y1i52c7mj"; </del> <ins> hash="02a74nx8p2gbpd6ffnr52p02pxxllw3yy5fy4083a77r3wia8zb3"; url="https://vorboss.dl.sourceforge.net/project/firejail/firejail/firejail-0.9.48.tar.xz"; sha256="02a74nx8p2gbpd6ffnr52p02pxxllw3yy5fy4083a77r3wia8zb3"; </ins> }; buildInputs = [ which

GIDMIN 1000 Disable /run/firejail/network Disable /run/firejail/bandwidth Disable /run/firejail/name Disable /run/firejail/x11 Remounting /proc and /proc/sys filesystems Remounting /sys directory Disable /sys/firmware Disable /sys/hypervisor Disable /sys/module Disable /sys/power Disable /sys/kernel/debug Disable /sys/kernel/vmcoreinfo Disable /proc/sys/fs/binfmtmisc Disable /proc/sys/kernel/corepattern Disable /proc/sys/kernel/modprobe Disable /proc/sysrq-trigger Disable /proc/sys/vm/paniconoom Disable /proc/irq Disable /proc/bus Disable Disable /proc/timerlist Disable /proc/timerstats Disable /proc/kcore Disable /proc/kallsyms Disable /boot Disable /dev/port Disable /dev/kmsg Disable /proc/kmsg Disable /home/milan/.gnuplothistory Disable /home/milan/.zshhistory Disable /home/milan/.bashhistory Mounting read-only Disable Error: cannot establish communication with the parent, exiting. [milan ~]$ System: (NixOS: , Ubuntu/Fedora: , .) (Hummingbird) Nix version: (run ) nix-env (Nix) 1.11.8 Nixpkgs version: (run ) ""
May be caused by . Does the same occur with , and not with ?
I'm having the same issue on Nixos 17.03. There at least it is exactly as you have described it, hence almost certainly the referenced issue.
Failure: [milan nixpkgs]$ firejail --noprofile -- firefox /etc/nixos/nixpkgs Parent pid , child pid Error: invalid whitelist path Error: cannot establish communication with the parent, exiting... Success: [milan nixpkgs]$ firejail --noprofile firefox /etc/nixos/nixpkgs Parent pid , child pid Child process initialized
Yep, that does look like it's that issue.


Question: <ins> diff --git a/tools/yabridgectl/src/config.rs b/tools/yabridgectl/src/config.rs index c1c89cf..d7bd822 100644 --- a/tools/yabridgectl/src/config.rs +++ b/tools/yabridgectl/src/config.rs @@ -23,6 +23,7 @@ use std::collections::{BTreeMap, BTreeSet}; use std::env; use std::fmt::Display; use std::fs; +use std::iter; use std::path::{Path, PathBuf}; use which::which; use xdg::BaseDirectories; @@ -216,34 +217,24 @@ impl Config { } } None => { -                // Search in the system library locations and in `~/.local/share/yabridge` if no -                // path was set explicitely. We'll also search through `/usr/local/lib` just in case -                // but since we advocate against installing yabridge there we won't list this path -                // in the error message when `libyabridge-vst2.so` can't be found. -                let system_path = Path::new("/usr/lib"); +                // Search through NIX_PROFILES & data home directory if no path was set explicitly. +                let nix_profiles = env::var("NIX_PROFILES"); let user_path = xdg_dirs.get_data_home(); -                let lib_directories = [ -                    system_path, -                    // Used on Debian based distros -                    Path::new("/usr/lib/x86_64-linux-gnu"), -                    // Used on Fedora -                    Path::new("/usr/lib64"), -                    Path::new("/usr/local/lib"), -                    Path::new("/usr/local/lib/x86_64-linux-gnu"), -                    Path::new("/usr/local/lib64"), -                    &user_path, -                ]; +                let lib_directories = nix_profiles.iter() +                    .flat_map(|profiles| profiles.split(' ') +                              .map(|profile| Path::new(profile).join("lib"))) +                    .chain(iter::once(user_path.clone())); + let mut candidates = lib_directories -                    .iter() .map(|directory| directory.join(LIBYABRIDGE_VST2_NAME)); + match candidates.find(|directory| directory.exists()) { Some(candidate) => candidate, _ => { return Err(anyhow!( -                            "Could not find '{}' in either '{}' or '{}'. You can override the  -                            default search path using 'yabridgectl set --path=<path>'.", +                            "Could not find '{}' through 'NIX_PROFILES' or '{}'. You can override the  +                             default search path using 'yabridgectl set --path=<path>'.", LIBYABRIDGE_VST2_NAME, -                            system_path.display(), user_path.display() )); } diff --git a/tools/yabridgectl/src/main.rs b/tools/yabridgectl/src/main.rs index 0db1bd4..221cdd0 100644 --- a/tools/yabridgectl/src/main.rs +++ b/tools/yabridgectl/src/main.rs @@ -102,7 +102,7 @@ fn main() -> Result<()> { .about("Path to the directory containing 'libyabridge-{vst2,vst3}.so'") .long_about( "Path to the directory containing 'libyabridge-{vst2,vst3}.so'. If this  -                             is not set, then yabridgectl will look in both '/usr/lib' and  +                             is not set, then yabridgectl will look through 'NIX_PROFILES' and  '~/.local/share/yabridge' by default.", ) .validator(validate_path) </ins>

Project description Yet Another way to use Windows VST plugins on Linux. Yabridge seamlessly supports using both 32-bit and 64-bit Windows VST2 and VST3 plugins in a 64-bit Linux VST host as if they were native VST2 and VST3 plugins, with optional support for plugin groups to enable inter-plugin communication for VST2 plugins and quick startup times. Its modern concurrent architecture and focus on transparency allows yabridge to be both fast and highly compatible, while also staying easy to debug and maintain. If I understand correctly, this provides similar functionality to the airwave package. I think the big plus to this package though is that it emulates as if they were native which means the build process doesn't need to require the user to go to the steinberg site and download the VST SDK (as airwave currently does). I used this on Arch with Reaper and it was extremely easy to get going. I had a much easier time using yabridge than trying to get carla set up and running. There are multiple AUR packages for installing from source or just pulling in the binaries. I've tried to package this myself but it's just a bit beyond my means. I think that if someone is more familiar with packaging wine related binaries or compiling with meson from source this would be a quick win. homepage URL: source URL: license: GPL 3.0 platforms: linux
I probably won't have time today, but I can take a look at this later. I'm pretty familiar with the nixpkgs wine build, and I've worked with the ZynAddSubFx build to add support for the Zyn-Fusion ui.
Amazing. I was able to take your PR and get Upright Piano working with Reaper as well. Thank you so much for the quick turn around, I really appreciate it.
Hi! I don't use NixOS myself, but if it helps, there's one person in the yabridge Discord currently using yabridge's master branch with NixOS. And I've also ran into another Nix build definition on GitHub in the past (but that one's pretty outdated by now).
I've just released with a lot of important new features, fixes and improvements including the first ever Linux <-Windows VST3 plugin bridge.


Question: <ins> diff --git a/tools/yabridgectl/src/config.rs b/tools/yabridgectl/src/config.rs index c1c89cf..d7bd822 100644 --- a/tools/yabridgectl/src/config.rs +++ b/tools/yabridgectl/src/config.rs @@ -23,6 +23,7 @@ use std::collections::{BTreeMap, BTreeSet}; use std::env; use std::fmt::Display; use std::fs; +use std::iter; use std::path::{Path, PathBuf}; use which::which; use xdg::BaseDirectories; @@ -216,34 +217,24 @@ impl Config { } } None => { -                // Search in the system library locations and in `~/.local/share/yabridge` if no -                // path was set explicitely. We'll also search through `/usr/local/lib` just in case -                // but since we advocate against installing yabridge there we won't list this path -                // in the error message when `libyabridge-vst2.so` can't be found. -                let system_path = Path::new("/usr/lib"); +                // Search through NIX_PROFILES & data home directory if no path was set explicitly. +                let nix_profiles = env::var("NIX_PROFILES"); let user_path = xdg_dirs.get_data_home(); -                let lib_directories = [ -                    system_path, -                    // Used on Debian based distros -                    Path::new("/usr/lib/x86_64-linux-gnu"), -                    // Used on Fedora -                    Path::new("/usr/lib64"), -                    Path::new("/usr/local/lib"), -                    Path::new("/usr/local/lib/x86_64-linux-gnu"), -                    Path::new("/usr/local/lib64"), -                    &user_path, -                ]; +                let lib_directories = nix_profiles.iter() +                    .flat_map(|profiles| profiles.split(' ') +                              .map(|profile| Path::new(profile).join("lib"))) +                    .chain(iter::once(user_path.clone())); + let mut candidates = lib_directories -                    .iter() .map(|directory| directory.join(LIBYABRIDGE_VST2_NAME)); + match candidates.find(|directory| directory.exists()) { Some(candidate) => candidate, _ => { return Err(anyhow!( -                            "Could not find '{}' in either '{}' or '{}'. You can override the  -                            default search path using 'yabridgectl set --path=<path>'.", +                            "Could not find '{}' through 'NIX_PROFILES' or '{}'. You can override the  +                             default search path using 'yabridgectl set --path=<path>'.", LIBYABRIDGE_VST2_NAME, -                            system_path.display(), user_path.display() )); } diff --git a/tools/yabridgectl/src/main.rs b/tools/yabridgectl/src/main.rs index 0db1bd4..221cdd0 100644 --- a/tools/yabridgectl/src/main.rs +++ b/tools/yabridgectl/src/main.rs @@ -102,7 +102,7 @@ fn main() -> Result<()> { .about("Path to the directory containing 'libyabridge-{vst2,vst3}.so'") .long_about( "Path to the directory containing 'libyabridge-{vst2,vst3}.so'. If this  -                             is not set, then yabridgectl will look in both '/usr/lib' and  +                             is not set, then yabridgectl will look through 'NIX_PROFILES' and  '~/.local/share/yabridge' by default.", ) .validator(validate_path) </ins>

I saw that the package created by for yabridge 2.2.1 has not been merged yet, but please let me know if you want to update the yabridge and yabridgectl packages for yabridge 3.0.0 and need any help! One additional dependency is now a patched version of the VST3 SDK which is patched to compile under winegcc and with support for Meson. I'm not quite sure how Nix packaging handles those things.
Thanks, I have it building right now. I'm just testing out vst3 plugins right now :smile:
:cry: For some reason neither the vst2 or vst3 plugins are working, even though they get synced. I think it might be an issue with my system installed wine. I'll submit my changes anyway so other people can test it out.
So they are found but yabridge fails to load them? Which Wine are your derivations using?
You can try running manually to see if that is the issue. A plain call should print: And should print:
I'm able to sync them with yabridgectl, but they fail to load in Reaper. I'm using (currently version 6.0) to build yabridge, but I have a custom build of wine staging 6.0 currently installed. seems to be working fine:
That indeed seems to work as expected, that's great news! If you start REAPER with and then take a look at after trying to scan/load a plugin then you'll probably be able to figure out what's wrong very quickly.
Hmm, apparently the path to the VST host is too long :stuckouttongue:
Huh I can't think of from the top of my head what would be throwing such an exception. That message printed after comes from a try-catch around the entire plugin startup that catches and prints any . Windows (and thus Wine, because it has to be compatible haha) has a path name limit of 255 characters, but none of those paths sound like they should come close to that.
Yeah, sorry. It was just a problem with my home environment. I was trying to test it without installing because I lost the nixpkgs commit I used to generate my home-manager environment.


Question: <ins> diff --git a/tools/yabridgectl/src/config.rs b/tools/yabridgectl/src/config.rs index c1c89cf..d7bd822 100644 --- a/tools/yabridgectl/src/config.rs +++ b/tools/yabridgectl/src/config.rs @@ -23,6 +23,7 @@ use std::collections::{BTreeMap, BTreeSet}; use std::env; use std::fmt::Display; use std::fs; +use std::iter; use std::path::{Path, PathBuf}; use which::which; use xdg::BaseDirectories; @@ -216,34 +217,24 @@ impl Config { } } None => { -                // Search in the system library locations and in `~/.local/share/yabridge` if no -                // path was set explicitely. We'll also search through `/usr/local/lib` just in case -                // but since we advocate against installing yabridge there we won't list this path -                // in the error message when `libyabridge-vst2.so` can't be found. -                let system_path = Path::new("/usr/lib"); +                // Search through NIX_PROFILES & data home directory if no path was set explicitly. +                let nix_profiles = env::var("NIX_PROFILES"); let user_path = xdg_dirs.get_data_home(); -                let lib_directories = [ -                    system_path, -                    // Used on Debian based distros -                    Path::new("/usr/lib/x86_64-linux-gnu"), -                    // Used on Fedora -                    Path::new("/usr/lib64"), -                    Path::new("/usr/local/lib"), -                    Path::new("/usr/local/lib/x86_64-linux-gnu"), -                    Path::new("/usr/local/lib64"), -                    &user_path, -                ]; +                let lib_directories = nix_profiles.iter() +                    .flat_map(|profiles| profiles.split(' ') +                              .map(|profile| Path::new(profile).join("lib"))) +                    .chain(iter::once(user_path.clone())); + let mut candidates = lib_directories -                    .iter() .map(|directory| directory.join(LIBYABRIDGE_VST2_NAME)); + match candidates.find(|directory| directory.exists()) { Some(candidate) => candidate, _ => { return Err(anyhow!( -                            "Could not find '{}' in either '{}' or '{}'. You can override the  -                            default search path using 'yabridgectl set --path=<path>'.", +                            "Could not find '{}' through 'NIX_PROFILES' or '{}'. You can override the  +                             default search path using 'yabridgectl set --path=<path>'.", LIBYABRIDGE_VST2_NAME, -                            system_path.display(), user_path.display() )); } diff --git a/tools/yabridgectl/src/main.rs b/tools/yabridgectl/src/main.rs index 0db1bd4..221cdd0 100644 --- a/tools/yabridgectl/src/main.rs +++ b/tools/yabridgectl/src/main.rs @@ -102,7 +102,7 @@ fn main() -> Result<()> { .about("Path to the directory containing 'libyabridge-{vst2,vst3}.so'") .long_about( "Path to the directory containing 'libyabridge-{vst2,vst3}.so'. If this  -                             is not set, then yabridgectl will look in both '/usr/lib' and  +                             is not set, then yabridgectl will look through 'NIX_PROFILES' and  '~/.local/share/yabridge' by default.", ) .validator(validate_path) </ins>

REAPER was just loading the old 2.2.1 yabridge- :woman_facepalming: I just finished rebuilding my home environment with a new nixpkgs commit, and it's working now :smile: .


Question: { stdenv, buildPythonPackage, fetchFromGitHub <del> , requests, decorator, flake8, mock, six, update_checker, pytestrunner, prawcore , pytest_3, betamax, betamax-serializers, betamax-matchers, requests_toolbelt </del> <ins> , betamax , betamax-serializers , betamax-matchers , mock , six , pytestrunner , prawcore , pytest , requests-toolbelt , update_checker , websocket_client </ins> }: buildPythonPackage rec { pname = "praw"; <del> version = "6.0.0"; </del> <ins> version = "6.3.1"; </ins> src = fetchFromGitHub { owner = "praw-dev"; repo = "praw"; rev = "v${version}"; <del> sha256 = "0y6nyz8vf98gl1qfmnznv3dbvlbzdl6mz99vk673nyfn3hbs451i"; </del> <ins> sha256 = "0by89aw7m803dvjcc33m9390msjm6v5v8g3k8ink9gfm421lw8ky"; </ins> }; <del> postPatch = '' # drop upper bound of prawcore requirement sed -ri "s/'(prawcore >=.+), <.+'/'1'/" setup.py ''; </del> <ins> nativeBuildInputs = [ pytestrunner ]; </ins> propagatedBuildInputs = [ <del> requests decorator flake8 </del> mock <del> six update_checker pytestrunner </del> prawcore <ins> update_checker websocket_client </ins> ]; checkInputs = [ <del> pytest_3 </del> betamax betamax-serializers betamax-matchers <del> requests_toolbelt </del> <ins> mock pytest requests-toolbelt six </ins> ]; meta = with stdenv.lib; { description = "Python Reddit API wrapper"; <del> homepage = https://praw.readthedocs.org/; license = licenses.gpl3; </del> <ins> homepage = "https://praw.readthedocs.org/"; license = licenses.bsd2; </ins> platforms = platforms.all; maintainers = with maintainers; [ ]; };

I had i3pystatus fail to build because of a pytest error with praw on unstable. I tried to bump praw from 6.0.0 to 6.3.1 but it requires a new dep websocket-client that doesn't look packaged thus I ended up ditching it from i3pystatus dependencies. Maybe we should do the same upstream and provide a leaner i3pystatus as it's not a core plugin anyway (and fails ). nix build -f channel:nixos-unstable system: host os: multi-user?: sandbox: version: channels(teto): channels(root): nixpkgs:
CC ? what do you think of removing it from i3pystatus default ?
Agree. A user can add manually by overriding of parameter.
is this still relevant now? or can it be closed?
I just removed praw it from i3pystatus default dependencies but itself still won't build. So it makes sense to keep the issue open even if I have no personal interest in praw.
it was irritating me, so i updated it.


Question: inherit (callPackage ../applications/virtualization/docker {}) docker_24 docker_25 docker_26 docker_27; <del> docker = docker_24; </del> <ins> docker = docker_27; </ins> docker-client = docker.override { clientOnly = true; }; docker-gc = callPackage ../applications/virtualization/docker/gc.nix { };

Today one of my containers wouldn't start after I updated the docker-compose file and it was due to the docker engine being too old to support a certain feature. Easy enough to fix in config but is there a specific reason the attribute points at rather than ? Last time the attr was touched was
The reason is basically this: Quoting a recent comment in that PR:


Question: for usage. ''); <del> scriptDir = mkOption { type = types.path; default = "/var/lib/networkd-dispatcher"; description = mdDoc '' This directory is used for keeping various scripts read and run by networkd-dispatcher. See [https://gitlab.com/craftyguy/networkd-dispatcher](upstream instructions) for directory structure and script usage. </del> <ins> rules = mkOption { default = {}; example = lib.literalExpression '' { "restart-tor" = { onState = ["routable" "off"]; script = ''' #!''${pkgs.runtimeShell} if [[ $IFACE == "wlan0" && $AdministrativeState == "configured" ]]; then echo "Restarting Tor ..." systemctl restart tor fi exit 0 '''; }; }; ''; description = lib.mdDoc '' Declarative configuration of networkd-dispatcher rules. See [https://gitlab.com/craftyguy/networkd-dispatcher](upstream instructions) for an introduction and example scripts. </ins> ''; <ins> type = types.attrsOf (types.submodule { options = { onState = mkOption { type = types.listOf (types.enum [ "routable" "dormant" "no-carrier" "off" "carrier" "degraded" "configuring" "configured" ]); default = null; description = lib.mdDoc '' List of names of the systemd-networkd operational states which should trigger the script. See <https://www.freedesktop.org/software/systemd/man/networkctl.html> for a description of the specific state type. ''; }; script = mkOption { type = types.lines; description = lib.mdDoc '' Shell commands executed on specified operational states. ''; }; }; }); </ins> }; };

refuses to work since it requires the directories containing the scripts to have mode 755, but the nixos module creates them with mode 750. Steps to reproduce the behavior: (re)-configure an interface (for example by unplugging and replugging a network cable) something like in the journal and that does not exist, i.e. the hook was never run. networkd-dispatcher works. <!-- Please @ people who are in the list of the offending package or module. If in doubt, check for whoever last touched something. -- Please run and paste the result.
Thank you for the report! I'm thinking about adding a rules option to the networkd-dispatcher module so this might solve your issue


Question: <ins> { lib , stdenv , fetchFromGitHub , pkg-config , gtk3 , curl , libxml2 }: stdenv.mkDerivation rec { pname = "smooth"; version = "0.9.6"; src = fetchFromGitHub { owner = "enzo1982"; repo = "smooth"; rev = "v${version}"; sha256 = "05j5gk6kz2089x8bcq2l0kjspfiiymxn69jcxl4dh9lw96blbadr"; }; nativeBuildInputs = [ pkg-config ]; makeFlags = [ "prefix=$(out)" ]; buildInputs = [ gtk3 curl libxml2 ]; meta = with lib; { description = "The smooth Class Library"; license = licenses.artistic2; homepage = "http://www.smooth-project.org/"; maintainers = with maintainers; [ shamilton ]; platforms = platforms.linux; }; } </ins>

Project description fre:ac is a free audio converter and CD extractor for Microsoft Windows, Linux, macOS and FreeBSD, distributed under the GNU General Public License.[1] Besides extracting audio from compact discs (with various features including hidden track detection), fre:ac can also convert audio files from one format to another or to the same format but a lower bitrate. fre:ac is compatible with many audio formats such as Ogg Vorbis, FLAC, MP3, MP4/M4A, AAC, WAV, WMA and more.[2][3] fre:ac uses the CDex library to convert from CDs and uses freedb to retrieve artist/song information from the internet which is written to the files as various types of ID3 tags; this library supports cdparanoia which aims to improve audio quality.[4] The user interface is multilingual with 43 languages and is able to be a portable install on a USB drive. Metadata homepage URL: source URL: license: GNU General Public License v2.0 platforms: Windows, macOS, Linux, FreeBSD, HaikuOS
freac is already available on my nur repo If you want to avoid building it, it should be on my cachix https://scott- (for nixos-20.9, nixpkgs-unstable and nixos-unstable)


Question: # this fixes bundled ripgrep chmod +x resources/app/node_modules/@vscode/ripgrep/bin/rg <del> '' + lib.optionalString (lib.versionOlder version "1.78.0") '' </del> <ins> '' + lib.optionalString (lib.versionOlder version "1.78.0" && stdenv.isLinux) '' </ins> # see https://github.com/gentoo/gentoo/commit/4da5959 chmod +x resources/app/node_modules/node-pty/build/Release/spawn-helper '';

I'm using , and I'm trying to perform an update: The update works. (information found from )
What does have to do with ? Can you reproduce the problem with just & ?
Beginner here. I think that is using under the hood. I don't know how. Should I report this issue to instead?
Sounds like breaks vscodium darwin build :upsidedownface: I will do a PR


Question: <del> { lib , stdenv , buildPythonPackage , fetchPypi , pythonOlder # Build dependencies , glibcLocales # Test dependencies , nose , pygments # Runtime dependencies , jedi , decorator , pickleshare , traitlets , prompt_toolkit , pexpect , appnope , backcall , fetchpatch }: buildPythonPackage rec { pname = "ipython"; version = "7.9.0"; src = fetchPypi { inherit pname version; sha256 = "103jkw18z7fnwdal1mdbijjxi1fndzn31g887lmj7ddpf2r07lyz"; }; prePatch = lib.optionalString stdenv.isDarwin '' substituteInPlace setup.py --replace "'gnureadline'" " " ''; buildInputs = [ glibcLocales ]; checkInputs = [ nose pygments ]; propagatedBuildInputs = [ jedi decorator pickleshare traitlets prompt_toolkit pygments pexpect backcall ] ++ lib.optionals stdenv.isDarwin [appnope]; LC_ALL="en_US.UTF-8"; doCheck = false; # Circular dependency with ipykernel checkPhase = '' nosetests ''; pythonImportsCheck = [ "IPython" ]; meta = with lib; { description = "IPython: Productive Interactive Computing"; homepage = "http://ipython.org/"; license = licenses.bsd3; maintainers = with maintainers; [ bjornfor ]; }; } </del>

According to the 3.5 life-cycle () , the final release has already occurred and is now considered EOL. The jump from 3.5 to 3.6 has already happened in the majority of python packages and should not be a similar situation in which we had to extend python2's life long after its official EOL date.


Question: serviceConfig = { User         = pgmanage; Group        = pgmanage; <del> ExecStart    = "${pkgs.pgmanage}/sbin/pgmanage -c ${confFile}" + </del> <ins> ExecStart    = "${cfg.package}/sbin/pgmanage -c ${confFile}" + </ins> optionalString cfg.localOnly " --local-only=true"; }; };

defines a package option, but does not use it in the service definition. Steps to reproduce the behavior: an alternative package to use system is ignored As there is an option to set an alternative package, this setting should be honored. The current version of pkgs.pgmanage is broken, which was the motivation to actually use the package option.


Question: version = src.version; src = pkgs.invoiceplane; <del> patchPhase = '' </del> <ins> postPhase = '' </ins> # Patch index.php file to load additional config file substituteInPlace index.php  <del> --replace "require('vendor/autoload.php');" "require('vendor/autoload.php'); $dotenv = new DotenvDotenv(__DIR__, 'extraConfig.php'); $dotenv->load();"; </del> <ins> --replace "require('vendor/autoload.php');" "require('vendor/autoload.php'); $dotenv = DotenvDotenv::createImmutable(__DIR__, 'extraConfig.php'); $dotenv->load();"; </ins> ''; installPhase = ''

, CVSSv3=7.5 (nixos-unstable) CVSSv3=5.3 (nixos-unstable) CVSSv3=5.3 (nixos-unstable) In InvoicePlane 1.5.11 a misconfigured web server allows unauthenticated directory listing and file download. Allowing an attacker to directory traversal and download files suppose to be private without authentication. In InvoicePlane 1.5.11, the upload feature discloses the full path of the file upload directory. InvoicePlane 1.5.11 doesn't have any rate-limiting for password reset and the reset token is generated using a weak mechanism that is predictable. Scanned versions: nixos-unstable: . Cc


Question: (fetchNuGet { pname = "Microsoft.Extensions.Logging.Abstractions"; version = "8.0.0"; sha256 = "1klcqhg3hk55hb6vmjiq2wgqidsl81aldw0li2z98lrwx26msrr6"; }) (fetchNuGet { pname = "Microsoft.Extensions.Options"; version = "8.0.0"; sha256 = "0p50qn6zhinzyhq9sy5svnmqqwhw2jajs2pbjh9sah504wjvhscz"; }) (fetchNuGet { pname = "Microsoft.Extensions.Primitives"; version = "8.0.0"; sha256 = "0aldaz5aapngchgdr7dax9jw5wy7k7hmjgjpfgfv1wfif27jlkqm"; }) <del> (fetchNuGet { pname = "Microsoft.IdentityModel.Abstractions"; version = "7.0.3"; sha256 = "0njmg2lygnirnfjv9gck2f5lq4ly5rgws9cpf8qj3kwcwxfp0b9s"; }) (fetchNuGet { pname = "Microsoft.IdentityModel.JsonWebTokens"; version = "7.0.3"; sha256 = "1ayh85xqdq8rqjk2iqcn7iaczcl7d8qg6bxk0b4rgx59fmsmbqj7"; }) (fetchNuGet { pname = "Microsoft.IdentityModel.Logging"; version = "7.0.3"; sha256 = "13cjqmf59k895q6gkd5ycl89mnpalckda7rhsdl11jdyr32hsfnv"; }) (fetchNuGet { pname = "Microsoft.IdentityModel.Tokens"; version = "7.0.3"; sha256 = "1pmhd0imh9wlhvbvvwjrpjsqvzagi2ly22nddwr4r0pi234khyz1"; }) </del> <ins> (fetchNuGet { pname = "Microsoft.IdentityModel.Abstractions"; version = "7.3.0"; sha256 = "1x183b0gz1vcfiljggrn30g6jvixlwks0lfpl4hl9nnjbpg0fdvq"; }) (fetchNuGet { pname = "Microsoft.IdentityModel.JsonWebTokens"; version = "7.3.0"; sha256 = "03nnqmz0w42wiqgf5y0wkn6w0n3m93q8ihqmrrz7rdh85v06f999"; }) (fetchNuGet { pname = "Microsoft.IdentityModel.Logging"; version = "7.3.0"; sha256 = "1b24pf0ippwbdjc3k1wzr13lr1zqlcbymi2hpvfmxmk4i6vzn4mv"; }) (fetchNuGet { pname = "Microsoft.IdentityModel.Tokens"; version = "7.3.0"; sha256 = "1qdcqcnczaqfd0cii3bcymbc7rvkypm25idxgx7hfc81h9ysh79h"; }) </ins> (fetchNuGet { pname = "Microsoft.NET.ILLink.Tasks"; version = "8.0.1"; sha256 = "1drbgqdcvbpisjn8mqfgba1pwb6yri80qc4mfvyczqwrcsj5k2ja"; }) (fetchNuGet { pname = "Microsoft.NET.Test.Sdk"; version = "17.8.0"; sha256 = "1syvl3g0hbrcgfi9rq6pld8s8hqqww4dflf1lxn59ccddyyx0gmv"; }) (fetchNuGet { pname = "Microsoft.NETCore.Platforms"; version = "5.0.0"; sha256 = "0mwpwdflidzgzfx2dlpkvvnkgkr2ayaf0s80737h4wa35gaj11rc"; }) (fetchNuGet { pname = "Microsoft.OpenApi"; version = "1.2.3"; sha256 = "07b19k89whj69j87afkz86gp9b3iybw8jqwvlgcn43m7fb2y99rr"; }) <ins> (fetchNuGet { pname = "Microsoft.Testing.Extensions.Telemetry"; version = "1.0.0"; sha256 = "1b52s7z01wkg83dpkpyg7girjflm84zr65pacsfwm2hvhb9xa2w6"; }) (fetchNuGet { pname = "Microsoft.Testing.Extensions.TrxReport.Abstractions"; version = "1.0.0"; sha256 = "0pvr4yga99fqr4z8s8js9hxki5c92qy7scvpqwslws5mri625m38"; }) (fetchNuGet { pname = "Microsoft.Testing.Extensions.VSTestBridge"; version = "1.0.0"; sha256 = "0zzrwp5in56fhc2cdmn4i44v2jf13frbjwpb9v8s7fkr9ky4wh5w"; }) (fetchNuGet { pname = "Microsoft.Testing.Platform"; version = "1.0.0"; sha256 = "1qbf922frk4c0cam57d98f3d5q5226pgrgjm7pfcamwy5whvx5sh"; }) (fetchNuGet { pname = "Microsoft.Testing.Platform.MSBuild"; version = "1.0.0"; sha256 = "0my1fihyh86rckfzbrvl5kdcq34yp0ywl8azs2gx3c27sg4pjrp2"; }) (fetchNuGet { pname = "Microsoft.TestPlatform.ObjectModel"; version = "17.5.0"; sha256 = "0qkjyf3ky6xpjg5is2sdsawm99ka7fzgid2bvpglwmmawqgm8gls"; }) </ins> (fetchNuGet { pname = "Microsoft.TestPlatform.ObjectModel"; version = "17.8.0"; sha256 = "0b0i7lmkrcfvim8i3l93gwqvkhhhfzd53fqfnygdqvkg6np0cg7m"; }) (fetchNuGet { pname = "Microsoft.TestPlatform.TestHost"; version = "17.8.0"; sha256 = "0f5jah93kjkvxwmhwb78lw11m9pkkq9fvf135hpymmmpxqbdh97q"; }) (fetchNuGet { pname = "Microsoft.Win32.Registry"; version = "5.0.0"; sha256 = "102hvhq2gmlcbq8y2cb7hdr2dnmjzfp2k3asr1ycwrfacwyaak7n"; }) <del> (fetchNuGet { pname = "MSTest.TestAdapter"; version = "3.1.1"; sha256 = "0y3ic8jv5jhld6gan2qfa2wyk4z57f7y4y5a47njr0jvxxnarg2c"; }) (fetchNuGet { pname = "MSTest.TestFramework"; version = "3.1.1"; sha256 = "1lbgkrbrkmw4c54g61cwbmwc4zl8hyqmp283ymvj93lq7chbxasn"; }) </del> <ins> (fetchNuGet { pname = "MSTest.TestAdapter"; version = "3.2.0"; sha256 = "0n7iw8ppjyps4sg0rfh5pags4wq58yg1g9vnxfwa73z38jws2c10"; }) (fetchNuGet { pname = "MSTest.TestFramework"; version = "3.2.0"; sha256 = "0n9aab1cxf8w23dl4yw7rqpi47v7gd02csq3zisc5whsrb9i0xbq"; }) </ins> (fetchNuGet { pname = "Newtonsoft.Json"; version = "13.0.1"; sha256 = "0fijg0w6iwap8gvzyjnndds0q4b8anwxxvik7y8vgq97dram4srb"; }) (fetchNuGet { pname = "Newtonsoft.Json"; version = "13.0.3"; sha256 = "0xrwysmrn4midrjal8g2hr1bbg38iyisl0svamb11arqws4w2bw7"; }) (fetchNuGet { pname = "Newtonsoft.Json.Bson"; version = "1.0.2"; sha256 = "0c27bhy9x3c2n26inq32kmp6drpm71n6mqnmcr19wrlcaihglj35"; })

Package name: ArchiSteamFarm Latest released version: 5.5.2.3 <!-- Search your package here: --- Current version on the unstable channel: 5.5.0.11 Current version on the stable/release channel: 5.4.12.5 <!-- Type the name of your package and try to find an open pull request for the package If you find an open pull request, you can review it! There's a high chance that you'll have the new version right away while helping the community! --- Notify maintainers <!-- If the result shows no maintainers, tag the person that last updated the package. -- Note for maintainers: Please tag this issue in your PR. Add a :+1: [reaction] to [issues you find important]. [reaction]: [issues you find important]:
It helps if I also open the PR when doing the update


Question: meta = with lib; { homepage = "https://nicolargo.github.io/glances/"; description = "Cross-platform curses-based monitoring tool"; <del> changelog = "https://github.com/nicolargo/glances/releases/tag/v${version}"; </del> <ins> changelog = "https://github.com/nicolargo/glances/blob/v${version}/NEWS.rst"; </ins> license = licenses.lgpl3Only; maintainers = with maintainers; [ jonringer primeos koral ]; };

, CVSSv3=9.8 (nixos-21.05) The package glances before 3.2.1 are vulnerable to XML External Entity (XXE) Injection via the use of Fault to parse untrusted XML data, which is known to be vulnerable to XML attacks. Scanned versions: nixos-21.05: . Cc Cc Cc
This was resolved by


Question: let self = stdenv.mkDerivation rec { pname = "mysql"; <del> version = "5.7.27"; </del> <ins> version = "5.7.37"; </ins> src = fetchurl { url = "mirror://mysql/MySQL-5.7/${pname}-${version}.tar.gz"; <del> sha256 = "1fhv16zr46pxm1j8vb8x8mh3nwzglg01arz8gnazbmjqldr5idpq"; </del> <ins> sha256 = "sha256-qZqaqGNdJWbat2Sy3la+0XMDZdNg4guyf1Y5LOVOGL0="; </ins> }; preConfigure = lib.optionalString stdenv.isDarwin ''

, CVSSv3=5.5 (nixos-21.11, nixos-unstable) CVSSv3=4.9 (nixos-21.11, nixos-unstable) CVSSv3=4.9 (nixos-21.11, nixos-unstable) CVSSv3=4.9 (nixos-21.11, nixos-unstable) CVSSv3=4.9 (nixos-21.11, nixos-unstable) CVSSv3=4.3 (nixos-21.11, nixos-unstable) Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Compiling). Supported versions that are affected are 5.7.36 and prior and 8.0.27 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.1 Base Score 5.5 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H). Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Federated). Supported versions that are affected are 5.7.36 and prior and 8.0.27 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Stored Procedure). Supported versions that are affected are 5.7.36 and prior and 8.0.27 and prior.


Question: let self = stdenv.mkDerivation rec { pname = "mysql"; <del> version = "5.7.27"; </del> <ins> version = "5.7.37"; </ins> src = fetchurl { url = "mirror://mysql/MySQL-5.7/${pname}-${version}.tar.gz"; <del> sha256 = "1fhv16zr46pxm1j8vb8x8mh3nwzglg01arz8gnazbmjqldr5idpq"; </del> <ins> sha256 = "sha256-qZqaqGNdJWbat2Sy3la+0XMDZdNg4guyf1Y5LOVOGL0="; </ins> }; preConfigure = lib.optionalString stdenv.isDarwin ''

Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Parser). Supported versions that are affected are 5.7.36 and prior and 8.0.27 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are 5.7.36 and prior and 8.0.27 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected are 5.7.36 and prior and 8.0.27 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.1 Base Score 4.3 (Integrity impacts).


Question: let self = stdenv.mkDerivation rec { pname = "mysql"; <del> version = "5.7.27"; </del> <ins> version = "5.7.37"; </ins> src = fetchurl { url = "mirror://mysql/MySQL-5.7/${pname}-${version}.tar.gz"; <del> sha256 = "1fhv16zr46pxm1j8vb8x8mh3nwzglg01arz8gnazbmjqldr5idpq"; </del> <ins> sha256 = "sha256-qZqaqGNdJWbat2Sy3la+0XMDZdNg4guyf1Y5LOVOGL0="; </ins> }; preConfigure = lib.optionalString stdenv.isDarwin ''

CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N). Scanned versions: nixos-21.11: ; nixos-unstable: .
See also: , , , , , ,
Fixed: nixos-21.11: mysql-5.7.37, mysql-8.0.28 nixos-unstable: mysql-5.7.39, mysql-8.0.30


Question: ossfs = callPackage ../development/python-modules/ossfs { }; <ins> osxphotos = callPackage ../development/python-modules/osxphotos { }; </ins> ots-python = callPackage ../development/python-modules/ots-python { }; outcome = callPackage ../development/python-modules/outcome { };

Project description Python app to work with pictures and associated metadata from Apple Photos on macOS. Also includes a package to provide programmatic access to the Photos library, pictures, and metadata. Metadata homepage URL: source URL: license: mit platforms: unix, linux, darwin Add a :+1: [reaction] to [issues you find important]. [reaction]: [issues you find important]:
This was the most complex package i ever tried to write :sweat_smile:


Question: # - Package: ../modules/${pname}/releases/package.nix # FIXME: do this at the module system level <del> propagatePlatforms = lib.mapAttrs (platform: subset: map (r: r // { inherit platform; }) subset); </del> <ins> propagatePlatforms = lib.mapAttrs (redistArch: packages: map (p: { inherit redistArch; } // p) packages); </ins> # All releases across all platforms # See ../modules/${pname}/releases/releases.nix

should have only eliminated the s and removed some of the platform-based (adding new broken/non-buildable attrs), but instead has changed the actual logic. Since that commit, no longer resolves into but into (note the wrong cuda release), later leading to evaluation errors This currently breaks on Steps to reproduce the behavior: We should probably add some tests for the selection logic as well... A clear and concise description of what you expected to happen. If applicable, add screenshots to help explain your problem. Add any other context about the problem here. <!-- Please @ people who are in the list of the offending package or module. If in doubt, check for whoever last touched something. --Please run and paste the result. Add a :+1: [reaction] to [issues you find important]. [reaction]: [issues you find important]:


Question: systemd.packages = [ pkgs.tracker-miners ]; <ins> services.gnome.tracker.subcommandPackages = [ pkgs.tracker-miners ]; </ins> }; }

Pretty much all commands just show the "usage" output, regardless if the input is correct or not. For example, outputs: Steps to reproduce the behavior: , , , and many other commands incorrect output I expect to see the correct output, for example should show the current status of all miners.
How did you determine the commands? The printed help page does not list any of those as supported.
I got the commands from the Tracker documentation: You are right that they aren't listed in the help page. I do have manuals with usage for all those commands installed though.
This issue has been mentioned on NixOS Discourse. There might be relevant details there:


Question: githubId = 543055; name = "Shadaj Laddad"; }; <ins> shaddydc = { email = "nixpkgs@shaddy.dev"; github = "ShaddyDC"; githubId = 18403034; name = "Shaddy"; }; </ins> shadowrz = { email = "shadowrz+nixpkgs@disroot.org"; matrix = "@ShadowRZ:matrixim.cc";

Project description Universal Scene Description (USD) is an efficient, scalable system for authoring, reading, and streaming time-sampled scene description for interchange between graphics applications. OpenUSD is AFAIK the library to work with the USD format. Metadata homepage URL: source URL: license: Modified Apache 2.0 License platforms: unix, linux, darwin
I've got a working derivation, but I'm not sure if this is already in a state that is good enough for a PR. In particular, packaging the pyside tools properly didn't seem straightforward to me. AFAICT, it just copies some binaries from other QT parts and wraps them with extra arguments, so that's what I'm doing here. While the python package seems to be working properly, I ran into an issue before when trying to include the headers into a C++ project, and I believe it failed to find some python headers? Maybe that needs some extra buildInput? I haven't investigated more. Locally, I've just been using a version compiled with for that. The binaries, such as , are working by my testing, besides requiring on wayland. I'd be happy to make a PR for this if this is a good-enough state.


Question: cd ../.. <ins> # Symlink required sources mkdir -p sources cd sources ${if includeSources then stdenv.lib.concatMapStrings (platformVersion: if (builtins.hasAttr ("source_"+platformVersion) sources) then let source = builtins.getAttr ("source_"+platformVersion) sources; in "ln -s ${source}/* android-${platformVersion}n" else "") platformVersions else ""} cd .. </ins> # Symlink required platforms mkdir -p platforms

Currently, our Android SDK derivations contain only binary files. This is unfortunate during development, when one wants to jump to a definition of a particular symbol in the SDK and it is not found. For comparison, ArchLinux is doing this in their packages, e.g. System: 16.09pre-git (Flounder) Nix version: nix-env (Nix) 1.11.4 Nixpkgs version: "16.09beta335." /cc
Created PR .


Question: # package customization , enableNaCl ? false <del> , enableHotwording ? false </del> , enableWideVine ? false , gnomeSupport ? false, gnome ? null , gnomeKeyringSupport ? false, libgnome-keyring3 ? null

When building chromium with args like this and the gn args aren't known/accepted by chromium (like the above one actually is that is still given incorrectly in 18.03), it will print: but continue to build anyway, which can be super surprising when your build doesn't do what you expect. We should catch that when building. Unfortunately doesn't seem to have a feature to warn. But we can run to see the in stdout and grep for it: I have confirmed that only seems to work that way when giving a build target, like . CC
Suggestion: We switch to
PR
pull request was merged.


Question: # Fetchers {#chap-pkgs-fetchers} <del> When using Nix, you will frequently need to download source code and other files from the internet. Nixpkgs comes with a few helper functions that allow you to fetch fixed-output derivations in a structured way. </del> <ins> When using Nix, you will frequently need to download source code and other files from the internet. For this purpose, Nix provides the [_fixed output derivation_](https://nixos.org/manual/nix/stable/#fixed-output-drvs) feature and Nixpkgs provides various functions that implement the actual fetching from various protocols and services. </ins> <del> The two fetcher primitives are `fetchurl` and `fetchzip`. Both of these have two required arguments, a URL and a hash. The hash is typically `sha256`, although many more hash algorithms are supported. Nixpkgs contributors are currently recommended to use `sha256`. This hash will be used by Nix to identify your source. A typical usage of fetchurl is provided below. </del> <ins> ## Caveats Because fixed output derivations are _identified_ by their hash, a common mistake is to update a fetcher's URL or a version parameter, without updating the hash. **This will cause the old contents to be used.** So remember to always invalidate the hash argument. For those who develop and maintain fetcheres, a similar problem arises with changes to the implementation of a fetcher. These may cause a fixed output derivation to fail, but won't normally be caught by tests because the supposed output is already in the store or cache. For the purpose of testing, you can use a trick that is embodied by the [`invalidateFetcherByDrvHash`](#sec-pkgs-invalidateFetcherByDrvHash) function. It uses the derivation `name` to create a unique output path per fetcher implementation, defeating the caching precisely where it would be harmful. ## `fetchurl` and `fetchzip` {#fetchurl} Two basic fetchers are `fetchurl` and `fetchzip`. Both of these have two required arguments, a URL and a hash. The hash is typically `sha256`, although many more hash algorithms are supported. Nixpkgs contributors are currently recommended to use `sha256`. This hash will be used by Nix to identify your source. A typical usage of fetchurl is provided below. </ins> ```nix { stdenv, fetchurl }:

Fetchers are hard to test because when the output sha is verified, Nix won't download it again. This leads to confusion and PRs that are effectively untested because the others do not realize that they need to remove the store path before testing. Examples: Steps to reproduce the behavior: a fetcher -build the fetcher -build "success" but the fetcher is broken a PR effort The fetcher runs every time. This is expected but not realistic, because Nix can not guess what to re-fetch. Instead, we can make fetcher testing easier by adding fetcher tests following the pattern: So this uses IFD which is probably ok for ofborg? Regarding ; instead of somewhere, we'll have to use to set on the fetchers because they're functions. The salt may need to be passed externally in case of pure evaluation. We could make it a Nixpkgs parameter that defaults to . <!-- Please @ people who are in the list of the offending package or module. If in doubt, check for whoever last touched something. --Please run and paste the result. Maintainer information:
Workaround: Use followed by
Or we can just put the salt in the parameter. Nix isn't clever enough to find same-hash renames in the store :)
And the salt can be derived from the unsalted drv path, which is exactly what we want. See


Question: dontAutoPatchelf = true; postFixup = (attrs.postFixup or "") + optionalString (stdenv.isLinux) '' ( <del> cd $out/clion-${version} </del> <ins> cd $out/clion </ins> # bundled cmake does not find libc rm -rf bin/cmake/linux ln -s ${cmake} bin/cmake/linux

CLion 2021.3.3 derivation fails to build. Steps to reproduce the behavior: to system/user packages The system rebuilds. Seems the folder has been renamed to just : Please run and paste the result. system: host os: multi-user?: sandbox: version: channels(zane): channels(root): nixpkgs:
Same issues here, waiting for fix : (
cc


Question: postInstall = '' wrapProgram $out/bin/git-flow  <del> --set FLAGS_GETOPT_CMD ${pkgs.getopt}/bin/getopt  --suffix PATH : ${pkgs.git}/bin  --prefix PATH : ${pkgs.coreutils}/bin </del> <ins> --set FLAGS_GETOPT_CMD ${getopt}/bin/getopt  --suffix PATH : ${git}/bin  --prefix PATH : ${coreutils}/bin </ins> ''; meta = with lib; {

Describe the bug I need to list the out paths of cross compiled packages beforehand which causes an eval error. To Reproduce Steps to reproduce the behavior: Expected behavior List all out paths like `. Additional context I need this feature for nixpkgs-review when cross compiling. Notify maintainers <!-- Please @ people who are in the list of the offending package or module. If in doubt, check for whoever last touched something. --Metadata system: host os: multi-user?: sandbox: version: channels(user): nixpkgs: Maintainer information:
I think its because of the lack of splicing for perl-packages. Note however, that when that is fixed, other package sets will fail with the same issue. cc
Probably multiple issues. Have seen that problem with building xwayland for aarch64 too. Removing makeWrapper helps but probably breaks it :(. But the deps don't cross-build anyway so never got that far for now. Was thinking about opening an issue but got caught up trying to find the issue -- to no avail. Not currently at my machine, might post it later.
I marked this as stale due to inactivity. →
still important to me
Fix in


Question: { fetchurl }: rec { <del> version = "1.6.23"; </del> <ins> version = "1.6.24"; </ins> src = fetchurl { url = "http://www.openafs.org/dl/openafs/${version}/openafs-${version}-src.tar.bz2"; <del> sha256 = "1gy7a0jhagxif8av540xb1aa6cl7id08nsgjbgady54bnmb0viga"; </del> <ins> sha256 = "1dxzc1y5mmx3ap0m94sx80vfs3qxkckid3wc1xm0wr5i6fh7zn1h"; </ins> }; srcs = [ src (fetchurl { url = "http://www.openafs.org/dl/openafs/${version}/openafs-${version}-doc.tar.bz2"; <del> sha256 = "18my71s9mddy0k835852ksjzkza7xs73kyxavmdqflh5vkywb6y0"; </del> <ins> sha256 = "0aq9ipqpr2ksmk30h2dc4mlrkrqs16xnmspwfb6xj3rgr1pwszlx"; </ins> })]; }

, CVSSv3=7.5 (nixos-20.03, nixos-unstable) CVSSv3=7.5 (nixos-20.03, nixos-unstable) CVSSv3=5.9 (nixos-20.03, nixos-unstable) Scanned versions: nixos-20.03: ; nixos-unstable: . May contain false positives. Cc Cc
A security update 1.6.24 addressing the vulnerabilities exists. I'd suggest marking openafs-1.6 as broken, now, to enforce migration to openafs-1.8. I am unaware of plans to further maintain openafs-1.6 beyond 1.6.24. Edit: Maybe, we should do both, update to 1.6.24 and mark it broken. So, users have a secure version as of now and still get the hint to take action.
Alternative idea: Go with only openafs 1.8 on master and upgrade to openafs 1.6.24 on NixOS 20.03. This way, user must migrate to 1.8 when upgrading to NixOS 20.09 which is the only sensible action security wise.
This is fixed with the move to 1.6.24 for 20.09. Closed.


Question: crow-translate = libsForQt5.callPackage ../applications/misc/crow-translate { }; <del> cryptowatch-desktop = callPackage ../applications/finance/cryptowatch { }; </del> dae = callPackage ../tools/networking/dae { }; darling = callPackage ../applications/emulators/darling { };

Steps to reproduce the behavior: cryptowatch-desktop download url redirects to a blog Add a :+1: [reaction] to [issues you find important]. [reaction]: [issues you find important]:
As of September the 30th 2023, Cryptowatch was sunset and users were advised to use their parent companies offering Kraken Pro. I'll create a pull request to remove cryptowatch from nixpkgs as there aren't any archives available that contain it that are reliable


Question: local dst="$1" local wrapper="$2" export prog="$3" <del> export use_response_file_by_default=${if isClang then "1" else "0"} </del> <ins> export use_response_file_by_default=${if isClang && !isCcache then "1" else "0"} </ins> substituteAll "$wrapper" "$out/bin/$dst" chmod +x "$out/bin/$dst" }

Describe the bug hides clang arguments in a "response file" by default if is true, but ccache does not support this and responds with "no input files" instead. Additional context The following workaround can be used to disable response files in a result , fixing the issue: Notify maintainers Maintainer information:
I've run into this issue as well. Edit: my bad, that doesn't work; we need the env var to be set before the outer layer of stdenv wrapper machinery runs. By the time we're in the ccache wrapper it's too late. It's also not clear to me if this is a bug in or intended behavior (I was not able to find an issue for it upstream) but it's definitely reproducible:


Question: let pname = "ollama"; # don't forget to invalidate all hashes each update <del> version = "0.1.48"; </del> <ins> version = "0.2.1"; </ins> src = fetchFromGitHub { owner = "ollama"; repo = "ollama"; rev = "v${version}"; <del> hash = "sha256-rMStHUFC88TXIH/1c9bCOU0csnEZHOhWKBlLKarmCmE="; </del> <ins> hash = "sha256-hzB/sS+6vsMuJfCPZucTQerytnq+TBzTtiWwwd+H+bE="; </ins> fetchSubmodules = true; };

Package name: Ollama Latest released version: 0.2.1 <!-- Search your package here: --- Current version on the unstable channel: 0.1.48 Current version on the stable/release channel: 0.1.38 <!-- Type the name of your package and try to find an open pull request for the package If you find an open pull request, you can review it! There's a high chance that you'll have the new version right away while helping the community! --- Notify maintainers <!-- If the result shows no maintainers, tag the person that last updated the package. --Note for maintainers: Please tag this issue in your PR. Add a :+1: [reaction] to [issues you find important]. [reaction]: [issues you find important]:


Question: , ilmbase, gtk3, intltool, lcms2, lensfun, libX11, libexif, libgphoto2, libjpeg , libpng, librsvg, libtiff, openexr, osm-gps-map, pkgconfig, sqlite, libxslt , openjpeg, lua, pugixml, colord, colord-gtk, libwebp, libsecret, gnome3 <ins> , ocl-icd </ins> }: stdenv.mkDerivation rec {

Darktable can make use of OpenCL, but the nix package apparently isn't set up properly to allow this. Run : system: host os: multi-user?: sandbox: version: channels(root): channels(lukas): nixpkgs: OpenCL is set up properly on my system: cc darktable maintainers:
I'd been meaning to fix this for myself for awhile. Should be good now, pending review.
Thanks!
Sorry to revive this, but I am still having this problem in dartable 2.4.4 using intel OpenCL Neo driver. Should ti be already solved? Or the fix is still not present in 2.4.4? Thanks
Disregard (at least partially) my last comment. I was using the snap version in Ubuntu 18.10. Using the deb, OpenCl works. Where should I submit the bug for the snap version?


Question: then tag else lib.head (lib.strings.splitString "-" (baseNameOf result.outPath)); <del> # Docker can't be made to run darwin binaries meta.badPlatforms = lib.platforms.darwin; </del> } '' ${lib.optionalString (tag == null) '' outName="$(basename "$out")"

Using on macOS requires using . Steps to reproduce the behavior: a new nix file: it with error The derivation and the built docker image work fine, and should build correctly even without . I believe this might be due to , while it's true docker cannot run macOS binaries, nix can be used to build Linux binaries on macOS, either by downloading them from a binary cache or by cross compiling, and those binaries can be put in docker images. cc
The fix is as simple as you suggest. I don't expect any problems with . Some users already do what you're doing but with .


Question: executableName = "codium"; longName = "VSCodium"; <del> shortName = "Codium"; </del> <ins> shortName = "vscodium"; </ins> src = fetchurl { url = "https://github.com/VSCodium/vscodium/releases/download/${version}/VSCodium-${plat}-${version}.${archive_fmt}";

Describe the bug The desktop file packaged with VSCodium specifies the wrong StartupWMClass To Reproduce VSCodium on the started application Expected behavior Step 4 prints . Therefore step 5 should print one of those strings. But instead, the file contains . Additional context Those must match or else the application won't be linked to the .desktop file when started. Notify maintainers Metadata system: host os: multi-user?: sandbox: version: channels: nixpkgs: Maintainer information:
I'm surprised says that the is . After all, for it seems to be , as , and as I also just tested on my system: After all, the executable for vscode is and for vscodium it's . Nevertheless, I can reproduce your output. Since I don't know whether that could be changed, it's probably easier to simply change the file. Will push a PR in a moment.
I wish I could assign myself to this issue.
I had a quick look at the history of the and they had it this way since the beginning. So I think it's safe to assume this won't change anytime soon.


Question: Similarly [virtualisation.vmVariantWithBootloader](#opt-virtualisation.vmVariantWithBootLoader) was added. - The configuration portion of the `nix-daemon` module has been reworked and exposed as [nix.settings](options.html#opt-nix-settings): <del> * Legacy options have been mapped to the corresponding options under under [nix.settings](options.html#opt-nix.settings) but may be deprecated in the future. </del> <ins> * Legacy options have been mapped to the corresponding options under under [nix.settings](options.html#opt-nix.settings) and will be deprecated when NixOS 21.11 reaches end of life. </ins> * [nix.buildMachines.publicHostKey](options.html#opt-nix.buildMachines.publicHostKey) has been added. - The `writers.writePyPy2`/`writers.writePyPy3` and corresponding `writers.writePyPy2Bin`/`writers.writePyPy3Bin` convenience functions to create executable Python 2/3 scripts using the PyPy interpreter were added.

The current process for renames puts out-of-tree modules in a situation where users are confronted with warnings they can't solve, and neither can the maintainers. Steps to reproduce the behavior: one change, create the new option/package/..., create the alias with a deprecation warning that goes into effect immediately -of-tree modules, such as home-manager, nix-darwin, start emitting warnings reports warning -of-tree module maintainer can't do anything, because stable release does not have the new option All generated warnings can be resolved by the user. Suggested process: one change, create the new option/package/... and the alias but no deprecation warning 1-7 months pass. All current branches now support the new way. enable the warning on master (more on that) -of-tree modules, such as home-manager, nix-darwin, start emitting warnings warnings can now be fixed To facilitate the process, we can add an argument to functions like to indicate the first release that will support the change. We'll maintain two (hidden?) version numbers that we update during the NixOS release process. For example, at the time of writing, the only supported stable version is 21.11 and 22.05 has not been released yet. To enable warnings on , we only need to update . Interestingly, we'll be deprecating functions that deprecate without . Sounds meta, but it's not complicated. It just means that some old style deprecations will slip through the net for some more time. (also a big one, but no complaints yet)
This is also related to NixOS/rfcs, which was a previous attempt at establishing general such deprecation behaviors


Question: <ins> { yarn2nix-moretea , fetchFromGitHub }: yarn2nix-moretea.mkYarnPackage rec { name = "gotify-ui"; packageJSON = ./package.json; yarnNix = ./yarndeps.nix; version = "2.0.8"; src_all = fetchFromGitHub { owner = "gotify"; repo = "server"; rev = "v${version}"; sha256 = "17bxs3wcazrxippf3i9w7d2mq8lf0v5m4bn3nl2zb8v8dl3lsc9a"; }; src = "${src_all}/ui"; buildPhase = '' yarn build ''; } </ins>

Project description A simple server for sending and receiving messages in real-time per WebSocket. Includes a web UI, also has an Android client for receiving notifications and an optional CLI program (distributed separately) for sending notifications. Metadata homepage URL: source URL: license: MIT platforms: anything Go runs on
I started an attempt locally, however it failed due to some timeouts while fetching Go dependencies... will retry during this week :)
I think the main difficulty is the UI, which needs to be compiled with NPM. In essence, I think the build is three-staged: fetch UI dependencies, fetch Go dependencies, do the actual build.
You may want to take a look at .