Unverified Commit f2ebbabd authored by Leona Maroni's avatar Leona Maroni
Browse files

discourse: 3.3.2 -> 3.4.2 

https://meta.discourse.org/t/3-3-3-security-and-maintenance-release/343239
https://meta.discourse.org/t/3-3-4-security-and-maintenance-release/349301
https://blog.discourse.org/2025/02/unpacking-discourse-3-4/
https://meta.discourse.org/t/3-4-1-bug-fix-and-ux-release/353247
https://meta.discourse.org/t/3-4-2-security-and-bug-fix-release/358152
parent 9d02f876

nixos/doc/manual/release-notes/rl-2505.section.md

+1 −0
Original line number Diff line number Diff line
@@ -354,6 +354,7 @@ 




- `programs.clash-verge.tunMode` was deprecated and removed because now service mode is necessary to start program. Without `programs.clash-verge.enable`, clash-verge-rev will refuse to start.

- `services.discourse` now requires PostgreSQL 15 per default. Please update before upgrading.



- `services.netbird.tunnels` was renamed to [`services.netbird.clients`](#opt-services.netbird.clients),

  hardened (using dedicated less-privileged users) and significantly extended.

nixos/modules/services/web-apps/discourse.nix

+7 −2
Original line number Diff line number Diff line
@@ -13,8 +13,8 @@ let 
  cfg = config.services.discourse;

  opt = options.services.discourse;



  # Keep in sync with https://github.com/discourse/discourse_docker/blob/main/image/base/slim.Dockerfile#L5

  upstreamPostgresqlVersion = lib.getVersion pkgs.postgresql_13;

  # Keep in sync with https://github.com/discourse/discourse_docker/blob/main/image/base/Dockerfile PG_MAJOR

  upstreamPostgresqlVersion = lib.getVersion pkgs.postgresql_15;



  postgresqlPackage =

    if config.services.postgresql.enable then config.services.postgresql.package else pkgs.postgresql;
@@ -676,6 +676,8 @@ in 
      dns_query_timeout_secs = null;

      regex_timeout_seconds = 2;

      allow_impersonation = true;

      log_line_max_chars = 160000;

      yjit_enabled = false;

    };



    services.redis.servers.discourse =
@@ -901,6 +903,9 @@ in 
                  extraConfig

                  + ''

                    proxy_set_header X-Request-Start "t=''${msec}";

                    proxy_set_header X-Sendfile-Type "";

                    proxy_set_header X-Accel-Mapping "";

                    proxy_set_header Client-Ip "";

                  '';

              };

            cache = time: ''

nixos/tests/discourse.nix

+1 −1
Original line number Diff line number Diff line
@@ -59,7 +59,7 @@ import ./make-test-python.nix ( 


        environment.systemPackages = [ pkgs.jq ];



        services.postgresql.package = pkgs.postgresql_13;

        services.postgresql.package = pkgs.postgresql_15;



        services.discourse = {

          enable = true;

pkgs/servers/web-apps/discourse/default.nix

+22 −45
Original line number Diff line number Diff line
@@ -9,7 +9,7 @@ 
  bundlerEnv,

  callPackage,



  ruby_3_2,

  ruby_3_3,

  replace,

  gzip,

  gnutar,
@@ -34,11 +34,9 @@ 
  procps,

  rsync,

  icu,

  fetchYarnDeps,

  yarn,

  fixup-yarn-lock,

  pnpm_9,

  nodePackages,

  nodejs_18,

  nodejs,

  jq,

  moreutils,

  terser,
@@ -48,16 +46,16 @@ 
}@args:



let

  version = "3.3.2";

  version = "3.4.2";



  src = fetchFromGitHub {

    owner = "discourse";

    repo = "discourse";

    rev = "v${version}";

    sha256 = "sha256-FaPcUta5z/8oasw+9zGBRZnUVYD8eCo1t/XwwsFoSM8=";

    sha256 = "sha256-glTuY9aQ7wYvFZstOP579RkdSwKKh3q9mJt4wqg3zYk=";

  };



  ruby = ruby_3_2;

  ruby = ruby_3_3;



  runtimeDeps = [

    # For backups, themes and assets
@@ -67,7 +65,7 @@ let 
    gnutar

    git

    brotli

    nodejs_18

    nodejs



    # Misc required system utils

    which
@@ -189,9 +187,9 @@ let 
              cd ../..



              mkdir -p vendor/v8/${stdenv.hostPlatform.system}/libv8/obj/

              ln -s "${nodejs_18.libv8}/lib/libv8.a" vendor/v8/${stdenv.hostPlatform.system}/libv8/obj/libv8_monolith.a

              ln -s "${nodejs.libv8}/lib/libv8.a" vendor/v8/${stdenv.hostPlatform.system}/libv8/obj/libv8_monolith.a



              ln -s ${nodejs_18.libv8}/include vendor/v8/include

              ln -s ${nodejs.libv8}/include vendor/v8/include



              mkdir -p ext/libv8-node

              echo '--- !ruby/object:Libv8::Node::Location::Vendor {}' >ext/libv8-node/.location.yml
@@ -232,9 +230,10 @@ let 
    pname = "discourse-assets";

    inherit version src;



    yarnOfflineCache = fetchYarnDeps {

      yarnLock = src + "/yarn.lock";

      hash = "sha256-cSQofaULCmPuWGxS+hK4KlRq9lSkCPiYvhax9X6Dor8=";

    pnpmDeps = pnpm_9.fetchDeps {

      pname = "discourse-assets";

      inherit version src;

      hash = "sha256-WyRBnuKCl5NJLtqy3HK/sJcrpMkh0PjbasGPNDV6+7Y=";

    };



    nativeBuildInputs = runtimeDeps ++ [
@@ -242,10 +241,10 @@ let 
      redis

      uglify-js

      terser

      yarn

      jq

      moreutils

      fixup-yarn-lock

      nodejs

      pnpm_9.configHook

    ];



    outputs = [
@@ -281,31 +280,9 @@ let 
    # run. This means that Redis and PostgreSQL has to be running and

    # database migrations performed.

    preBuild = ''

      # Yarn wants a real home directory to write cache, config, etc to

      export HOME=$NIX_BUILD_TOP/fake_home



      yarn_install() {

        local offlineCache=$1 yarnLock=$2



        # Make yarn install packages from our offline cache, not the registry

        yarn config --offline set yarn-offline-mirror $offlineCache



        # Fixup "resolved"-entries in yarn.lock to match our offline cache

        fixup-yarn-lock $yarnLock



        # Install while ignoring hook scripts

        yarn --offline --ignore-scripts --cwd $(dirname $yarnLock) install

      }



      # Install runtime and devDependencies.

      # The dev deps are necessary for generating the theme-transpiler executed as dependent task

      # assets:precompile:theme_transpiler before db:migrate and unfortunately also in the runtime

      yarn_install $yarnOfflineCache yarn.lock



      # Patch before running postinstall hook script

      patchShebangs node_modules/

      patchShebangs --build app/assets/javascripts

      yarn --offline --cwd app/assets/javascripts run postinstall

      export SSL_CERT_FILE=${cacert}/etc/ssl/certs/ca-bundle.crt



      redis-server >/dev/null &
@@ -351,6 +328,10 @@ let 


      runHook postInstall

    '';



    # The node_modules output by design has broken symlinks, as it refers to the source code.

    # They are resolved in the primary discourse derivation.

    dontCheckForBrokenSymlinks = true;

  };



  discourse = stdenv.mkDerivation {
@@ -425,12 +406,11 @@ let 
      ln -sf /var/lib/discourse/tmp $out/share/discourse/tmp

      ln -sf /run/discourse/config $out/share/discourse/config

      ln -sf /run/discourse/public $out/share/discourse/public

      # This needs to be copied because of symlinks in node_modules

      # Also this needs to be full node_modules (including dev deps) because without loader.js it just throws 500

      cp -r ${assets.node_modules} $out/share/discourse/node_modules

      ln -sf ${assets.node_modules} $out/share/discourse/node_modules

      ln -sf ${assets} $out/share/discourse/public.dist/assets

      rm -r $out/share/discourse/app/assets/javascripts

      ln -sf ${assets.javascripts} $out/share/discourse/app/assets/javascripts

      # This needs to be copied because it contains symlinks to node_modules

      cp -r ${assets.javascripts} $out/share/discourse/app/assets/javascripts

      ${lib.concatMapStringsSep "\n" (

        p: "ln -sf ${p} $out/share/discourse/plugins/${p.pluginName or ""}"

      ) plugins}
@@ -466,9 +446,6 @@ let 
      maintainers = with maintainers; [ talyz ];

      license = licenses.gpl2Plus;

      description = "Discourse is an open source discussion platform";

      # fails to compile mini_racer:

      # mini_racer_v8.cc:316:45: error: no matching function for call to 'v8::ScriptOrigin::ScriptOrigin(v8::Local<v8::String>&)'

      broken = true;

    };

  };

in

pkgs/servers/web-apps/discourse/prebuild-theme-transpiler.patch

+18 −16
Original line number Diff line number Diff line 
diff --git a/lib/discourse_js_processor.rb b/lib/discourse_js_processor.rb

index 26d142fa4d..6040aba6f4 100644

index f1642386c5..5a672818da 100644

--- a/lib/discourse_js_processor.rb

+++ b/lib/discourse_js_processor.rb

@@ -68,7 +68,7 @@ class DiscourseJsProcessor

     TRANSPILER_PATH =

       (

         if Rails.env.production?

-          "tmp/theme-transpiler.js"

+          "app/assets/javascripts/theme-transpiler.js"

         else

           "tmp/theme-transpiler/#{Process.pid}.js"

@@ -54,7 +54,7 @@ class DiscourseJsProcessor

   end

@@ -87,6 +87,6 @@ class DiscourseJsProcessor

         "node",

         "app/assets/javascripts/theme-transpiler/build.js",

         TRANSPILER_PATH,

-      )

+      ) if !Rails.env.production? or !File.file?(TRANSPILER_PATH)



   class Transpiler

-    TRANSPILER_PATH = "tmp/theme-transpiler.js"

+    TRANSPILER_PATH = "app/assets/javascripts/theme-transpiler.js"



     @mutex = Mutex.new

     @ctx_init = Mutex.new

@@ -75,7 +75,9 @@ class DiscourseJsProcessor

     end



     def self.build_production_theme_transpiler

-      File.write(TRANSPILER_PATH, build_theme_transpiler)

+      if (!Rails.env.production? or !File.file?(TRANSPILER_PATH))

+        File.write(TRANSPILER_PATH, build_theme_transpiler)

+      end

       TRANSPILER_PATH

     end