Merge master into staging-next (3b1652aa) · Commits · nix / nixpkgs

nixos/modules/hardware/cpu/amd-microcode.nix

+1 −1

Original line number	Diff line number	Diff line
		@@ -16,7 +16,7 @@
		###### implementation
		config = lib.mkIf config.hardware.cpu.amd.updateMicrocode {
		# Microcode updates must be the first item prepended in the initrd
		boot.initrd.prepend = lib.mkOrder 1 [ "${pkgs.microcodeAmd}/amd-ucode.img" ];
		boot.initrd.prepend = lib.mkOrder 1 [ "${pkgs.microcode-amd}/amd-ucode.img" ];
		};

		}

nixos/modules/hardware/cpu/intel-microcode.nix

+1 −1

Original line number	Diff line number	Diff line
		@@ -16,7 +16,7 @@
		###### implementation
		config = lib.mkIf config.hardware.cpu.intel.updateMicrocode {
		# Microcode updates must be the first item prepended in the initrd
		boot.initrd.prepend = lib.mkOrder 1 [ "${pkgs.microcodeIntel}/intel-ucode.img" ];
		boot.initrd.prepend = lib.mkOrder 1 [ "${pkgs.microcode-intel}/intel-ucode.img" ];
		};

		}

nixos/modules/security/acme/default.nix

+7 −7

Original line number	Diff line number	Diff line
		@@ -166,7 +166,7 @@ let
		# ensure all required lock files exist, but none more
		script = ''
		GLOBIGNORE="${lib.concatStringsSep ":" concurrencyLockfiles}"
		rm -f *
		rm -f -- *
		unset GLOBIGNORE

		xargs touch <<< "${toString concurrencyLockfiles}"
		@@ -323,11 +323,11 @@ let
		cat key.pem fullchain.pem > full.pem

		# Group might change between runs, re-apply it
		chown '${user}:${data.group}' *
		chown '${user}:${data.group}' -- *

		# Default permissions make the files unreadable by group + anon
		# Need to be readable by group
		chmod 640 *
		chmod 640 -- *
		'';
		};

		@@ -410,7 +410,7 @@ let

		expiration_line="$(
		set -euxo pipefail
		openssl x509 -noout -enddate <$pem \
		openssl x509 -noout -enddate <"$pem" \
		\| grep notAfter \
		\| sed -e 's/^notAfter=//'
		)"
		@@ -418,8 +418,8 @@ let

		expiration_date="$(date -d "$expiration_line" +%s)"
		now="$(date +%s)"
		expiration_s=$[expiration_date - now]
		expiration_days=$[expiration_s / (3600 * 24)] # rounds down
		expiration_s=$((expiration_date - now))
		expiration_days=$((expiration_s / (3600 * 24))) # rounds down

		[[ $expiration_days -gt ${toString data.validMinDays} ]]
		}
		@@ -441,7 +441,7 @@ let
		# Check if we can renew.
		# We can only renew if the list of domains has not changed.
		# We also need an account key. Avoids #190493
		if cmp -s domainhash.txt certificates/domainhash.txt && [ -e 'certificates/${keyName}.key' -a -e 'certificates/${keyName}.crt' -a -n "$(find accounts -name '${data.email}.key')" ]; then
		if cmp -s domainhash.txt certificates/domainhash.txt && [ -e 'certificates/${keyName}.key' ] && [ -e 'certificates/${keyName}.crt' ] && [ -n "$(find accounts -name '${data.email}.key')" ]; then

		# Even if a cert is not expired, it may be revoked by the CA.
		# Try to renew, and silently fail if the cert is not expired.

nixos/tests/atop.nix

+10 −1

Original line number	Diff line number	Diff line
		@@ -24,7 +24,7 @@ let assertions = rec {

		with subtest("binary should report the correct version"):
		pkgver = "${pkgs.atop.version}"
		ver = re.sub(r'(?s)^Version: (\d\.\d\.\d).*', r'\1', machine.succeed("atop -V"))
		ver = re.sub(r'(?s)^Version: (\d+\.\d+\.\d+).*', r'\1', machine.succeed("atop -V"))
		assert ver == pkgver, f"Version is `{ver}`, expected `{pkgver}`"
		'';
		atoprc = contents:
		@@ -103,6 +103,9 @@ let assertions = rec {
		machine.fail("type -p atopgpud")
		'';
		};
		meta = {
		timeout = 600;
		};
		in
		{
		justThePackage = makeTest {
		@@ -120,6 +123,7 @@ in
		(netatop false)
		(atopgpu false)
		];
		inherit meta;
		};
		defaults = makeTest {
		name = "atop-defaults";
		@@ -138,6 +142,7 @@ in
		(netatop false)
		(atopgpu false)
		];
		inherit meta;
		};
		minimal = makeTest {
		name = "atop-minimal";
		@@ -159,6 +164,7 @@ in
		(netatop false)
		(atopgpu false)
		];
		inherit meta;
		};
		netatop = makeTest {
		name = "atop-netatop";
		@@ -178,6 +184,7 @@ in
		(netatop true)
		(atopgpu false)
		];
		inherit meta;
		};
		atopgpu = makeTest {
		name = "atop-atopgpu";
		@@ -197,6 +204,7 @@ in
		(netatop false)
		(atopgpu true)
		];
		inherit meta;
		};
		everything = makeTest {
		name = "atop-everything";
		@@ -222,5 +230,6 @@ in
		(netatop true)
		(atopgpu true)
		];
		inherit meta;
		};
		}

nixos/tests/pleroma.nix

+6 −3

Original line number	Diff line number	Diff line
		@@ -32,7 +32,7 @@ import ./make-test-python.nix ({ pkgs, ... }:
		# system one. Overriding this pretty bad default behaviour.
		export REQUESTS_CA_BUNDLE=/etc/ssl/certs/ca-certificates.crt

		echo "jamy-password" \| toot login_cli -i "pleroma.nixos.test" -e "jamy@nixos.test"
		toot --debug login_cli -i "pleroma.nixos.test" -e "jamy@nixos.test" -p "jamy-password"
		echo "Login OK"

		# Send a toot then verify it's part of the public timeline
		@@ -182,7 +182,7 @@ import ./make-test-python.nix ({ pkgs, ... }:
		client = { nodes, pkgs, config, ... }: {
		security.pki.certificateFiles = [ "${tls-cert}/cert.pem" ];
		networking.extraHosts = hosts nodes;
		environment.systemPackages = with pkgs; [
		environment.systemPackages = [
		pkgs.toot
		send-toot
		];
		@@ -191,7 +191,7 @@ import ./make-test-python.nix ({ pkgs, ... }:
		security.pki.certificateFiles = [ "${tls-cert}/cert.pem" ];
		networking.extraHosts = hosts nodes;
		networking.firewall.enable = false;
		environment.systemPackages = with pkgs; [
		environment.systemPackages = [
		provision-db
		provision-secrets
		provision-user
		@@ -245,10 +245,13 @@ import ./make-test-python.nix ({ pkgs, ... }:
		testScript = { nodes, ... }: ''
		pleroma.wait_for_unit("postgresql.service")
		pleroma.succeed("provision-db")
		pleroma.wait_for_file("/var/lib/pleroma")
		pleroma.succeed("provision-secrets")
		pleroma.systemctl("restart pleroma.service")
		pleroma.wait_for_unit("pleroma.service")
		pleroma.succeed("provision-user")
		client.succeed("send-toot")
		'';

		meta.timeout = 600;
		})

Admin message