diff options
-rw-r--r-- | pkgs/applications/office/elementary-planner/default.nix | 4 | ||||
-rw-r--r-- | pkgs/data/misc/cacert/default.nix | 60 | ||||
-rw-r--r-- | pkgs/data/misc/cacert/fix-unicode-ca-names.patch | 20 | ||||
-rw-r--r-- | pkgs/development/interpreters/guile/setup-hook-2.0.sh | 10 | ||||
-rw-r--r-- | pkgs/development/interpreters/guile/setup-hook-2.2.sh | 10 | ||||
-rw-r--r-- | pkgs/development/ocaml-modules/eliom/default.nix | 4 |
6 files changed, 77 insertions, 31 deletions
diff --git a/pkgs/applications/office/elementary-planner/default.nix b/pkgs/applications/office/elementary-planner/default.nix index 671613ddd32e..acade32d744d 100644 --- a/pkgs/applications/office/elementary-planner/default.nix +++ b/pkgs/applications/office/elementary-planner/default.nix @@ -21,13 +21,13 @@ stdenv.mkDerivation rec { pname = "elementary-planner"; - version = "2.5.4"; + version = "2.5.7"; src = fetchFromGitHub { owner = "alainm23"; repo = "planner"; rev = version; - sha256 = "0q5zmjh0d1mapgqb2a38spss280jkkc2n835kc7grzvs9jgq1k1k"; + sha256 = "0s2f9q7i31c2splflfnaiqviwnxbsp2zvibr70xafhbhnkmzlrsk"; }; nativeBuildInputs = [ diff --git a/pkgs/data/misc/cacert/default.nix b/pkgs/data/misc/cacert/default.nix index 34e0ec132a9f..0545c0e5efae 100644 --- a/pkgs/data/misc/cacert/default.nix +++ b/pkgs/data/misc/cacert/default.nix @@ -1,6 +1,10 @@ { stdenv, fetchurl, nss, python3 , blacklist ? [] -, includeEmail ? false + +# Used for tests only +, runCommand +, cacert +, openssl }: with stdenv.lib; @@ -37,11 +41,6 @@ stdenv.mkDerivation { EOF cat ${certdata2pem} > certdata2pem.py - patch -p1 < ${./fix-unicode-ca-names.patch} - ${optionalString includeEmail '' - # Disable CAs used for mail signing - substituteInPlace certdata2pem.py --replace \[\'CKA_TRUST_EMAIL_PROTECTION\'\] ''' - ''} ''; buildPhase = '' @@ -66,12 +65,59 @@ stdenv.mkDerivation { setupHook = ./setup-hook.sh; passthru.updateScript = ./update.sh; + passthru.tests = { + # Test that building this derivation with a blacklist works, and that UTF-8 is supported. + blacklist-utf8 = let + blacklistCAToFingerprint = { + # "blacklist" uses the CA name from the NSS bundle, but we check for presence using the SHA256 fingerprint. + "CFCA EV ROOT" = "5C:C3:D7:8E:4E:1D:5E:45:54:7A:04:E6:87:3E:64:F9:0C:F9:53:6D:1C:CC:2E:F8:00:F3:55:C4:C5:FD:70:FD"; + "NetLock Arany (Class Gold) Főtanúsítvány" = "6C:61:DA:C3:A2:DE:F0:31:50:6B:E0:36:D2:A6:FE:40:19:94:FB:D1:3D:F9:C8:D4:66:59:92:74:C4:46:EC:98"; + }; + mapBlacklist = f: concatStringsSep "\n" (mapAttrsToList f blacklistCAToFingerprint); + in runCommand "verify-the-cacert-filter-output" { + cacert = cacert.unbundled; + cacertWithExcludes = (cacert.override { + blacklist = builtins.attrNames blacklistCAToFingerprint; + }).unbundled; + + nativeBuildInputs = [ openssl ]; + } '' + isPresent() { + # isPresent <unbundled-dir> <ca name> <ca sha256 fingerprint> + for f in $1/etc/ssl/certs/*.crt; do + fingerprint="$(openssl x509 -in "$f" -noout -fingerprint -sha256 | cut -f2 -d=)" + if [[ "x$fingerprint" == "x$3" ]]; then + return 0 + fi + done + return 1 + } + + # Ensure that each certificate is in the main "cacert". + ${mapBlacklist (caName: caFingerprint: '' + isPresent "$cacert" "${caName}" "${caFingerprint}" || ({ + echo "CA fingerprint ${caFingerprint} (${caName}) is missing from the CA bundle. Consider picking a different CA for the blacklist test." >&2 + exit 1 + }) + '')} + + # Ensure that each certificate is NOT in the "cacertWithExcludes". + ${mapBlacklist (caName: caFingerprint: '' + isPresent "$cacertWithExcludes" "${caName}" "${caFingerprint}" && ({ + echo "CA fingerprint ${caFingerprint} (${caName}) is present in the cacertWithExcludes bundle." >&2 + exit 1 + }) + '')} + + touch $out + ''; + }; meta = { homepage = "https://curl.haxx.se/docs/caextract.html"; description = "A bundle of X.509 certificates of public Certificate Authorities (CA)"; platforms = platforms.all; - maintainers = with maintainers; [ fpletz ]; + maintainers = with maintainers; [ andir fpletz lukegb ]; license = licenses.mpl20; }; } diff --git a/pkgs/data/misc/cacert/fix-unicode-ca-names.patch b/pkgs/data/misc/cacert/fix-unicode-ca-names.patch deleted file mode 100644 index 07d3629196a7..000000000000 --- a/pkgs/data/misc/cacert/fix-unicode-ca-names.patch +++ /dev/null @@ -1,20 +0,0 @@ ---- a/certdata2pem.py 2017-08-01 23:10:00.000000000 +0300 -+++ b/certdata2pem.py 2017-08-01 23:08:21.131297636 +0300 -@@ -88,7 +88,7 @@ - \# Read blacklist. - blacklist = [] - if os.path.exists('blacklist.txt'): -- for line in open('blacklist.txt', 'r'): -+ for line in io.open('blacklist.txt', 'r', encoding='utf-8'): - line = line.strip() - if line.startswith('#') or len(line) == 0: - continue -@@ -101,7 +101,7 @@ - if obj['CKA_CLASS'] != 'CKO_NSS_TRUST': - continue - if obj['CKA_LABEL'] in blacklist: -- print("Certificate %s blacklisted, ignoring." % obj['CKA_LABEL']) -+ print("Certificate %s blacklisted, ignoring." % unicode(obj['CKA_LABEL']).encode('utf-8')) - elif obj['CKA_TRUST_SERVER_AUTH'] == 'CKT_NSS_TRUSTED_DELEGATOR': - trust[obj['CKA_LABEL']] = True - elif obj['CKA_TRUST_EMAIL_PROTECTION'] == 'CKT_NSS_TRUSTED_DELEGATOR': diff --git a/pkgs/development/interpreters/guile/setup-hook-2.0.sh b/pkgs/development/interpreters/guile/setup-hook-2.0.sh index 6bb3910aaff4..288f7e242f98 100644 --- a/pkgs/development/interpreters/guile/setup-hook-2.0.sh +++ b/pkgs/development/interpreters/guile/setup-hook-2.0.sh @@ -8,6 +8,16 @@ addGuileLibPath () { export GUILE_LOAD_PATH="${GUILE_LOAD_PATH-}${GUILE_LOAD_PATH:+:}$1/share/guile/site" export GUILE_LOAD_COMPILED_PATH="${GUILE_LOAD_COMPILED_PATH-}${GUILE_LOAD_COMPILED_PATH:+:}$1/share/guile/site" fi + + if test -d "$1/lib/guile/2.0/ccache" + then + export GUILE_LOAD_COMPILED_PATH="${GUILE_LOAD_COMPILED_PATH-}${GUILE_LOAD_COMPILED_PATH:+:}$1/lib/guile/2.0/ccache" + fi + + if test -d "$1/lib/guile/2.0/site-ccache" + then + export GUILE_LOAD_COMPILED_PATH="${GUILE_LOAD_COMPILED_PATH-}${GUILE_LOAD_COMPILED_PATH:+:}$1/lib/guile/2.0/site-ccache" + fi } addEnvHooks "$hostOffset" addGuileLibPath diff --git a/pkgs/development/interpreters/guile/setup-hook-2.2.sh b/pkgs/development/interpreters/guile/setup-hook-2.2.sh index 4b3541fcc7f0..1430dbe07205 100644 --- a/pkgs/development/interpreters/guile/setup-hook-2.2.sh +++ b/pkgs/development/interpreters/guile/setup-hook-2.2.sh @@ -8,6 +8,16 @@ addGuileLibPath () { export GUILE_LOAD_PATH="${GUILE_LOAD_PATH-}${GUILE_LOAD_PATH:+:}$1/share/guile/site" export GUILE_LOAD_COMPILED_PATH="${GUILE_LOAD_COMPILED_PATH-}${GUILE_LOAD_COMPILED_PATH:+:}$1/share/guile/site" fi + + if test -d "$1/lib/guile/2.2/ccache" + then + export GUILE_LOAD_COMPILED_PATH="${GUILE_LOAD_COMPILED_PATH-}${GUILE_LOAD_COMPILED_PATH:+:}$1/lib/guile/2.2/ccache" + fi + + if test -d "$1/lib/guile/2.2/site-ccache" + then + export GUILE_LOAD_COMPILED_PATH="${GUILE_LOAD_COMPILED_PATH-}${GUILE_LOAD_COMPILED_PATH:+:}$1/lib/guile/2.2/site-ccache" + fi } addEnvHooks "$hostOffset" addGuileLibPath diff --git a/pkgs/development/ocaml-modules/eliom/default.nix b/pkgs/development/ocaml-modules/eliom/default.nix index 4734d83d55f7..de2955e57c92 100644 --- a/pkgs/development/ocaml-modules/eliom/default.nix +++ b/pkgs/development/ocaml-modules/eliom/default.nix @@ -14,11 +14,11 @@ else stdenv.mkDerivation rec { pname = "eliom"; - version = "6.12.1"; + version = "6.12.4"; src = fetchzip { url = "https://github.com/ocsigen/eliom/archive/${version}.tar.gz"; - sha256 = "04c1sz113015gyhj3w7flw7l4bv0v50q6n04kk8dybcravzy2xgx"; + sha256 = "00m6v2k4mg8705dy41934lznl6gj91i6dk7p1nkaccm51nna25kz"; }; buildInputs = [ ocaml which findlib js_of_ocaml-ocamlbuild js_of_ocaml-ppx_deriving_json opaline |