summaryrefslogtreecommitdiffstats
path: root/pkgs
diff options
context:
space:
mode:
Diffstat (limited to 'pkgs')
-rw-r--r--pkgs/applications/office/elementary-planner/default.nix4
-rw-r--r--pkgs/data/misc/cacert/default.nix60
-rw-r--r--pkgs/data/misc/cacert/fix-unicode-ca-names.patch20
-rw-r--r--pkgs/development/interpreters/guile/setup-hook-2.0.sh10
-rw-r--r--pkgs/development/interpreters/guile/setup-hook-2.2.sh10
-rw-r--r--pkgs/development/ocaml-modules/eliom/default.nix4
6 files changed, 77 insertions, 31 deletions
diff --git a/pkgs/applications/office/elementary-planner/default.nix b/pkgs/applications/office/elementary-planner/default.nix
index 671613ddd32e..acade32d744d 100644
--- a/pkgs/applications/office/elementary-planner/default.nix
+++ b/pkgs/applications/office/elementary-planner/default.nix
@@ -21,13 +21,13 @@
stdenv.mkDerivation rec {
pname = "elementary-planner";
- version = "2.5.4";
+ version = "2.5.7";
src = fetchFromGitHub {
owner = "alainm23";
repo = "planner";
rev = version;
- sha256 = "0q5zmjh0d1mapgqb2a38spss280jkkc2n835kc7grzvs9jgq1k1k";
+ sha256 = "0s2f9q7i31c2splflfnaiqviwnxbsp2zvibr70xafhbhnkmzlrsk";
};
nativeBuildInputs = [
diff --git a/pkgs/data/misc/cacert/default.nix b/pkgs/data/misc/cacert/default.nix
index 34e0ec132a9f..0545c0e5efae 100644
--- a/pkgs/data/misc/cacert/default.nix
+++ b/pkgs/data/misc/cacert/default.nix
@@ -1,6 +1,10 @@
{ stdenv, fetchurl, nss, python3
, blacklist ? []
-, includeEmail ? false
+
+# Used for tests only
+, runCommand
+, cacert
+, openssl
}:
with stdenv.lib;
@@ -37,11 +41,6 @@ stdenv.mkDerivation {
EOF
cat ${certdata2pem} > certdata2pem.py
- patch -p1 < ${./fix-unicode-ca-names.patch}
- ${optionalString includeEmail ''
- # Disable CAs used for mail signing
- substituteInPlace certdata2pem.py --replace \[\'CKA_TRUST_EMAIL_PROTECTION\'\] '''
- ''}
'';
buildPhase = ''
@@ -66,12 +65,59 @@ stdenv.mkDerivation {
setupHook = ./setup-hook.sh;
passthru.updateScript = ./update.sh;
+ passthru.tests = {
+ # Test that building this derivation with a blacklist works, and that UTF-8 is supported.
+ blacklist-utf8 = let
+ blacklistCAToFingerprint = {
+ # "blacklist" uses the CA name from the NSS bundle, but we check for presence using the SHA256 fingerprint.
+ "CFCA EV ROOT" = "5C:C3:D7:8E:4E:1D:5E:45:54:7A:04:E6:87:3E:64:F9:0C:F9:53:6D:1C:CC:2E:F8:00:F3:55:C4:C5:FD:70:FD";
+ "NetLock Arany (Class Gold) Főtanúsítvány" = "6C:61:DA:C3:A2:DE:F0:31:50:6B:E0:36:D2:A6:FE:40:19:94:FB:D1:3D:F9:C8:D4:66:59:92:74:C4:46:EC:98";
+ };
+ mapBlacklist = f: concatStringsSep "\n" (mapAttrsToList f blacklistCAToFingerprint);
+ in runCommand "verify-the-cacert-filter-output" {
+ cacert = cacert.unbundled;
+ cacertWithExcludes = (cacert.override {
+ blacklist = builtins.attrNames blacklistCAToFingerprint;
+ }).unbundled;
+
+ nativeBuildInputs = [ openssl ];
+ } ''
+ isPresent() {
+ # isPresent <unbundled-dir> <ca name> <ca sha256 fingerprint>
+ for f in $1/etc/ssl/certs/*.crt; do
+ fingerprint="$(openssl x509 -in "$f" -noout -fingerprint -sha256 | cut -f2 -d=)"
+ if [[ "x$fingerprint" == "x$3" ]]; then
+ return 0
+ fi
+ done
+ return 1
+ }
+
+ # Ensure that each certificate is in the main "cacert".
+ ${mapBlacklist (caName: caFingerprint: ''
+ isPresent "$cacert" "${caName}" "${caFingerprint}" || ({
+ echo "CA fingerprint ${caFingerprint} (${caName}) is missing from the CA bundle. Consider picking a different CA for the blacklist test." >&2
+ exit 1
+ })
+ '')}
+
+ # Ensure that each certificate is NOT in the "cacertWithExcludes".
+ ${mapBlacklist (caName: caFingerprint: ''
+ isPresent "$cacertWithExcludes" "${caName}" "${caFingerprint}" && ({
+ echo "CA fingerprint ${caFingerprint} (${caName}) is present in the cacertWithExcludes bundle." >&2
+ exit 1
+ })
+ '')}
+
+ touch $out
+ '';
+ };
meta = {
homepage = "https://curl.haxx.se/docs/caextract.html";
description = "A bundle of X.509 certificates of public Certificate Authorities (CA)";
platforms = platforms.all;
- maintainers = with maintainers; [ fpletz ];
+ maintainers = with maintainers; [ andir fpletz lukegb ];
license = licenses.mpl20;
};
}
diff --git a/pkgs/data/misc/cacert/fix-unicode-ca-names.patch b/pkgs/data/misc/cacert/fix-unicode-ca-names.patch
deleted file mode 100644
index 07d3629196a7..000000000000
--- a/pkgs/data/misc/cacert/fix-unicode-ca-names.patch
+++ /dev/null
@@ -1,20 +0,0 @@
---- a/certdata2pem.py 2017-08-01 23:10:00.000000000 +0300
-+++ b/certdata2pem.py 2017-08-01 23:08:21.131297636 +0300
-@@ -88,7 +88,7 @@
- \# Read blacklist.
- blacklist = []
- if os.path.exists('blacklist.txt'):
-- for line in open('blacklist.txt', 'r'):
-+ for line in io.open('blacklist.txt', 'r', encoding='utf-8'):
- line = line.strip()
- if line.startswith('#') or len(line) == 0:
- continue
-@@ -101,7 +101,7 @@
- if obj['CKA_CLASS'] != 'CKO_NSS_TRUST':
- continue
- if obj['CKA_LABEL'] in blacklist:
-- print("Certificate %s blacklisted, ignoring." % obj['CKA_LABEL'])
-+ print("Certificate %s blacklisted, ignoring." % unicode(obj['CKA_LABEL']).encode('utf-8'))
- elif obj['CKA_TRUST_SERVER_AUTH'] == 'CKT_NSS_TRUSTED_DELEGATOR':
- trust[obj['CKA_LABEL']] = True
- elif obj['CKA_TRUST_EMAIL_PROTECTION'] == 'CKT_NSS_TRUSTED_DELEGATOR':
diff --git a/pkgs/development/interpreters/guile/setup-hook-2.0.sh b/pkgs/development/interpreters/guile/setup-hook-2.0.sh
index 6bb3910aaff4..288f7e242f98 100644
--- a/pkgs/development/interpreters/guile/setup-hook-2.0.sh
+++ b/pkgs/development/interpreters/guile/setup-hook-2.0.sh
@@ -8,6 +8,16 @@ addGuileLibPath () {
export GUILE_LOAD_PATH="${GUILE_LOAD_PATH-}${GUILE_LOAD_PATH:+:}$1/share/guile/site"
export GUILE_LOAD_COMPILED_PATH="${GUILE_LOAD_COMPILED_PATH-}${GUILE_LOAD_COMPILED_PATH:+:}$1/share/guile/site"
fi
+
+ if test -d "$1/lib/guile/2.0/ccache"
+ then
+ export GUILE_LOAD_COMPILED_PATH="${GUILE_LOAD_COMPILED_PATH-}${GUILE_LOAD_COMPILED_PATH:+:}$1/lib/guile/2.0/ccache"
+ fi
+
+ if test -d "$1/lib/guile/2.0/site-ccache"
+ then
+ export GUILE_LOAD_COMPILED_PATH="${GUILE_LOAD_COMPILED_PATH-}${GUILE_LOAD_COMPILED_PATH:+:}$1/lib/guile/2.0/site-ccache"
+ fi
}
addEnvHooks "$hostOffset" addGuileLibPath
diff --git a/pkgs/development/interpreters/guile/setup-hook-2.2.sh b/pkgs/development/interpreters/guile/setup-hook-2.2.sh
index 4b3541fcc7f0..1430dbe07205 100644
--- a/pkgs/development/interpreters/guile/setup-hook-2.2.sh
+++ b/pkgs/development/interpreters/guile/setup-hook-2.2.sh
@@ -8,6 +8,16 @@ addGuileLibPath () {
export GUILE_LOAD_PATH="${GUILE_LOAD_PATH-}${GUILE_LOAD_PATH:+:}$1/share/guile/site"
export GUILE_LOAD_COMPILED_PATH="${GUILE_LOAD_COMPILED_PATH-}${GUILE_LOAD_COMPILED_PATH:+:}$1/share/guile/site"
fi
+
+ if test -d "$1/lib/guile/2.2/ccache"
+ then
+ export GUILE_LOAD_COMPILED_PATH="${GUILE_LOAD_COMPILED_PATH-}${GUILE_LOAD_COMPILED_PATH:+:}$1/lib/guile/2.2/ccache"
+ fi
+
+ if test -d "$1/lib/guile/2.2/site-ccache"
+ then
+ export GUILE_LOAD_COMPILED_PATH="${GUILE_LOAD_COMPILED_PATH-}${GUILE_LOAD_COMPILED_PATH:+:}$1/lib/guile/2.2/site-ccache"
+ fi
}
addEnvHooks "$hostOffset" addGuileLibPath
diff --git a/pkgs/development/ocaml-modules/eliom/default.nix b/pkgs/development/ocaml-modules/eliom/default.nix
index 4734d83d55f7..de2955e57c92 100644
--- a/pkgs/development/ocaml-modules/eliom/default.nix
+++ b/pkgs/development/ocaml-modules/eliom/default.nix
@@ -14,11 +14,11 @@ else
stdenv.mkDerivation rec
{
pname = "eliom";
- version = "6.12.1";
+ version = "6.12.4";
src = fetchzip {
url = "https://github.com/ocsigen/eliom/archive/${version}.tar.gz";
- sha256 = "04c1sz113015gyhj3w7flw7l4bv0v50q6n04kk8dybcravzy2xgx";
+ sha256 = "00m6v2k4mg8705dy41934lznl6gj91i6dk7p1nkaccm51nna25kz";
};
buildInputs = [ ocaml which findlib js_of_ocaml-ocamlbuild js_of_ocaml-ppx_deriving_json opaline
generated by cgit v1.2.3 (git 2.25.1) at 2024-08-11 22:27:22 +0000