public/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
222,667 Commits 1 Branch 0 Tags
Commit Graph

222667 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Michael Alan Dorman
d59d157ad9 cabal-install-parsers: update Cabal dependency 
This also unbreaks `haskell-ci`.
 2020-04-17 20:50:48 +02:00
Jappie Klooster
b95534aaea cut-the-crap: init at 1.0.0 2020-04-17 20:50:48 +02:00
Manuel Bärenz
a762316e72 haskell simple-affine-space: Disable test suite 2020-04-17 20:50:48 +02:00
Troels Henriksen
802dfc8bd7 futhark: stop wrapping the executable 2020-04-17 20:50:48 +02:00
(cdep)illabout
a0612c2a06 spago: 0.14.0 -> 0.15.1 2020-04-17 20:50:48 +02:00
Gabor Greif
7932fb22cb ghcHEAD: bump to 8.11.20200403 (#84217) 
* ghcHEAD: bump to 8.11.20200403

* ghcHead: reduce diff vs. 8.10.1

dontAddExtraLibs was removed by accident (IMO) in ea19a8ed1e3

* ghcHEAD: add ability to use system libffi

- enable nixpkgs' libffi
- minimise diffs against 8.10.1
- remove patching

* remove configure warning about --with-curses-includes

configure: WARNING: unrecognized options: --with-curses-includes
 2020-04-17 20:50:48 +02:00
Peter Simons
fd1103227d hackage-packages.nix: automatic Haskell package set update 
This update was generated by hackage2nix v2.15.1 from Hackage revision
fcda2563cd.
 2020-04-17 20:50:40 +02:00
Peter Simons
fd63776ff4 hackage2nix: update list of broken builds to fix evaluation errors 2020-04-17 20:50:26 +02:00
Remo
83d84e6233 hackage2nix: unbreak postgrest 2020-04-17 20:50:07 +02:00
Remo
629af9f518 hackage2nix: unbreak hasql-pool 2020-04-17 20:49:49 +02:00
Peter Simons
572e8f6008 LTS Haskell 15.8 2020-04-17 20:49:10 +02:00
Graham Christensen
be9cc04925
Merge pull request #85453 from bqv/patch-1 
sv-kalendar: fix meta
 2020-04-17 14:16:34 -04:00
Tony O
39b1de0fbf
sv-kalendar: fix meta 2020-04-17 19:03:26 +01:00
Maximilian Bosch
192485f8fa
neomutt: 20200320 -> 20200417 
https://github.com/neomutt/neomutt/releases/tag/20200417

To fix the tests, I had to copy the recently created
`neomutt-test-files`[1] repository into the build-environment.

Also applied a patch from master[2] which ensures that the
`change-folder` macro actually switches to the specified folder.

[1] https://github.com/neomutt/neomutt-test-files
[2] 9e7537cadd
 2020-04-17 19:35:20 +02:00
worldofpeace
40f3faedbd nixos/manual: 19.09 -> 20.03 2020-04-17 12:41:24 -04:00
Jan Tojnar
42f2d370a5
Merge pull request #81955 from r-ryantm/auto-update/poppler-glib 2020-04-17 18:38:20 +02:00
Michele Guerini Rocco
8afc0daa29
Merge pull request #85431 from rnhmjoj/vapoursynth 
vapoursynth: R48 -> R49
 2020-04-17 18:20:46 +02:00
Peter Simons
464d1861ee
Merge pull request #81307 from jabranham/r-pkgs 
R: Update R, CRAN, & Bioconductor
 2020-04-17 17:43:38 +02:00
Benjamin Hipple
ba8c116519 mesa-glu: use HTTPS instead of FTP 
FTP is often blocked by firewalls and is generally slower and less secure than HTTPS.

No change to `src` hash.
 2020-04-17 11:35:16 -04:00
Emily
2e31fb407e nixos/release-combined: add {,latestKernel.}hardened 
These now depend on an external patch set; add them to the release tests
to ensure that the build doesn't break silently as new kernel updates
are merged.
 2020-04-17 16:13:39 +01:00
Emily
e133e396df nixos/release-{small,combined}: add latestKernel.login 
Seems like a good idea to ensure that you can always use the latest
stable upstream kernel.
 2020-04-17 16:13:39 +01:00
Emily
fe031d07f8 nixos/tests/hardened: add latestKernel argument 2020-04-17 16:13:39 +01:00
Emily
b0d5032ee4 nixos/hardened: add emily to maintainers 2020-04-17 16:13:39 +01:00
Emily
ad9bfe2254 nixos/hardened: enable user namespaces for root 
linux-hardened sets kernel.unprivileged_userns_clone=0 by default; see
anthraxx/linux-hardened@104f44058f.

This allows the Nix sandbox to function while reducing the attack
surface posed by user namespaces, which allow unprivileged code to
exercise lots of root-only code paths and have lead to privilege
escalation vulnerabilities in the past.

We can safely leave user namespaces on for privileged users, as root
already has root privileges, but if you're not running builds on your
machine and really want to minimize the kernel attack surface then you
can set security.allowUserNamespaces to false.

Note that Chrome's sandbox requires either unprivileged CLONE_NEWUSER or
setuid, and Firefox's silently reduces the security level if it isn't
allowed (see about:support), so desktop users may want to set:

    boot.kernel.sysctl."kernel.unprivileged_userns_clone" = true;
 2020-04-17 16:13:39 +01:00
Emily
84f258bf09 nixos/hardened: don't set vm.unprivileged_userfaultfd 
Upstreamed in anthraxx/linux-hardened@a712392b88.
 2020-04-17 16:13:39 +01:00
Emily
cc28d51237 nixos/hardened: don't set vm.mmap_min_addr 
Upstreamed in anthraxx/linux-hardened@f1fe0a64dd.
 2020-04-17 16:13:39 +01:00
Emily
46d12cca56 nixos/hardened: don't set vm.mmap_rnd{,_compat}_bits 
Upstreamed in anthraxx/linux-hardened@ae6d85f437.
 2020-04-17 16:13:39 +01:00
Emily
af4f57b2c4 nixos/hardened: don't set net.core.bpf_jit_harden 
Upstreamed in anthraxx/linux-hardened@82e384401d.
 2020-04-17 16:13:39 +01:00
Emily
71bbd876b7 nixos/hardened: don't set kernel.unprivileged_bpf_disabled 
Upstreamed in anthraxx/linux-hardened@1a3e0c2830.
 2020-04-17 16:13:39 +01:00
Emily
9da578a78f nixos/hardened: don't set kernel.dmesg_restrict 
Upstreamed in anthraxx/linux-hardened@e3d3f13ffb.
 2020-04-17 16:13:39 +01:00
Emily
cf1bce6a7a nixos/hardened: don't set vsyscall=none 
Upstreamed in anthraxx/linux-hardened@d300b0fdad.
 2020-04-17 16:13:39 +01:00
Emily
3b32cd2a5b nixos/hardened: don't set slab_nomerge 
Upstreamed in anthraxx/linux-hardened@df29f9248c.
 2020-04-17 16:13:39 +01:00
Emily
7fdfe5381d linux_*_hardened: don't set FORTIFY_SOURCE 
Upstreamed in anthraxx/linux-hardened@d12c0d5f0c.
 2020-04-17 16:13:39 +01:00
Emily
ed89b5b3f1 linux_*_hardened: don't set PANIC_ON_OOPS 
Upstreamed in anthraxx/linux-hardened@366e0216f1.
 2020-04-17 16:13:39 +01:00
Emily
0d5f1697b7 linux_*_hardened: don't set SLAB_FREELIST_{RANDOM,HARDENED} 
Upstreamed in anthraxx/linux-hardened@786126f177,
anthraxx/linux-hardened@44822ebeb7.
 2020-04-17 16:13:39 +01:00
Emily
4fb796e341 linux_*_hardened: don't set HARDENED_USERCOPY_FALLBACK 
Upstreamed in anthraxx/linux-hardened@c1fe7a68e3,
anthraxx/linux-hardened@2c553a2bb1.
 2020-04-17 16:13:39 +01:00
Emily
3eeb5240ac linux_*_hardened: don't set DEBUG_LIST 
Upstreamed in anthraxx/linux-hardened@6b20124185.
 2020-04-17 16:13:39 +01:00
Emily
0611462e33 linux_*_hardened: don't set {,IO_}STRICT_DEVMEM 
STRICT_DEVMEM is on by default in upstream 5.6.2; IO_STRICT_DEVMEM is
turned on by anthraxx/linux-hardened@103d23cb66.

Note that anthraxx/linux-hardened@db1d27e10e
disables DEVMEM by default, so this is only relevant if that default is
overridden to turn it back on.
 2020-04-17 16:13:39 +01:00
Emily
303bb60fb1 linux_*_hardened: don't set DEBUG_WX 
Upstreamed in anthraxx/linux-hardened@55ee7417f3.
 2020-04-17 16:13:39 +01:00
Emily
33b94e5a44 linux_*_hardened: don't set BUG_ON_DATA_CORRUPTION 
Upstreamed in anthraxx/linux-hardened@3fcd15014c.
 2020-04-17 16:13:39 +01:00
Emily
db6b327508 linux_*_hardened: don't set LEGACY_VSYSCALL_NONE 
Upstreamed in anthraxx/linux-hardened@d300b0fdad.
 2020-04-17 16:13:39 +01:00
Emily
130f6812be linux_*_hardened: don't set RANDOMIZE_{BASE,MEMORY} 
These are on by default for x86 in upstream linux-5.6.2, and turned on
for arm64 by anthraxx/linux-hardened@90f9670bc3.
 2020-04-17 16:13:39 +01:00
Emily
8c68055432 linux_*_hardened: don't set MODIFY_LDT_SYSCALL 
Upstreamed in anthraxx/linux-hardened@05644876fa.
 2020-04-17 16:13:39 +01:00
Emily
8efe83c22e linux_*_hardened: don't set DEFAULT_MMAP_MIN_ADDR 
Upstreamed in anthraxx/linux-hardened@f1fe0a64dd.
 2020-04-17 16:13:39 +01:00
Emily
3d4c8ae901 linux_*_hardened: don't set VMAP_STACK 
This has been on by default upstream for as long as it's been an option.
 2020-04-17 16:13:39 +01:00
Emily
7d5352df31 linux_*_hardened: don't set X86_X32 
As far as I can tell, this has never defaulted to on upstream, and our
common kernel configuration doesn't turn it on, so the attack surface
reduction here is somewhat homeopathic.
 2020-04-17 16:13:39 +01:00
Emily
0d4f35efd4 linux_*_hardened: use linux-hardened patch set 
This is an updated version of the former upstream,
https://github.com/AndroidHardeningArchive/linux-hardened, and provides
a minimal set of additional hardening patches on top of upstream.

The patch already incorporates many of our hardened profile defaults,
and releases are timely (Linux 5.5.15 and 5.6.2 were released on
2020-04-02; linux-hardened patches for them came out on 2020-04-03 and
2020-04-04 respectively).
 2020-04-17 16:13:39 +01:00
Emily
3d01e802bd linux: explicitly enable SYSVIPC 
The linux-hardened patch set removes this default, probably because of
its original focus on Android kernel hardening.
 2020-04-17 16:12:29 +01:00
Emily
10dd3f3de0 graphene-hardened-malloc: enable on aarch64-linux 2020-04-17 16:12:29 +01:00
Peter Hoeg
6f8c2afadf pcsc-cyberjack: minor cleanups 2020-04-17 22:54:34 +08:00