rocmPackages: 6.3.3 -> 6.4.x

doc/release-notes/rl-2511.section.md

@@ -67,6 +67,9 @@
 
 - `meta.mainProgram`: Changing this `meta` entry can lead to a package rebuild due to being used to determine the `NIX_MAIN_PROGRAM` environment variable.
 
+- `searx` was updated to use `envsubst` instead of `sed` for parsing secrets from environment variables.
+  If your previous configuration included a secret reference like `server.secret_key = "@SEARX_SECRET_KEY@"`, you must migrate to the new envsubst syntax: `server.secret_key = "$SEARX_SECRET_KEY"`.
+
 - `versionCheckHook`: Packages that previously relied solely on `pname` to locate the program used to version check, but have a differing `meta.mainProgram` entry, might now fail.
 
 

nixos/modules/services/mail/tlsrpt.nix

@@ -270,9 +270,17 @@ in
       };
     };
 
-    systemd.services.postfix.serviceConfig.SupplementaryGroups = mkIf (
-      config.services.postfix.enable && cfg.collectd.configurePostfix
-    ) [ "tlsrpt" ];
+    users.users.tlsrpt = {
+      isSystemUser = true;
+      group = "tlsrpt";
+    };
+    users.groups.tlsrpt = { };
+
+    users.users.postfix.extraGroups =
+      lib.mkIf (config.services.postfix.enable && cfg.collectd.configurePostfix)
+        [
+          "tlsrpt"
+        ];
 
     systemd.services.tlsrpt-collectd = {
       description = "TLSRPT datagram collector";

nixos/modules/services/networking/searx.nix

@@ -24,13 +24,8 @@ let
     # write NixOS settings as JSON
     (
       umask 077
-      cp --no-preserve=mode ${settingsFile} settings.yml
+      ${pkgs.envsubst}/bin/envsubst < ${settingsFile} > settings.yml
     )
-
-    # substitute environment variables
-    env -0 | while IFS='=' read -r -d ''' n v; do
-      sed "s#@$n@#$v#g" -i settings.yml
-    done
   '';
 
   settingType =
@@ -95,20 +90,20 @@ in
           {
             server.port = 8080;
             server.bind_address = "0.0.0.0";
-            server.secret_key = "@SEARX_SECRET_KEY@";
+            server.secret_key = "$SEARX_SECRET_KEY";
 
-            engines = lib.singleton {
+            engines = [ {
               name = "wolframalpha";
               shortcut = "wa";
-              api_key = "@WOLFRAM_API_KEY@";
+              api_key = "$WOLFRAM_API_KEY";
               engine = "wolframalpha_api";
-            };
+            } ];
           }
         '';
         description = ''
           Searx settings.
           These will be merged with (taking precedence over) the default configuration.
-          It's also possible to refer to environment variables (defined in [](#opt-services.searx.environmentFile)) using the syntax `@VARIABLE_NAME@`.
+          It's also possible to refer to environment variables (defined in [](#opt-services.searx.environmentFile)) using the syntax `$VARIABLE_NAME`.
 
           ::: {.note}
           For available settings, see the Searx [docs](https://docs.searxng.org/admin/settings/index.html).

nixos/tests/all-tests.nix

@@ -1061,7 +1061,7 @@ in
   ollama-cuda = runTestOn [ "x86_64-linux" "aarch64-linux" ] ./ollama-cuda.nix;
   ollama-rocm = runTestOn [ "x86_64-linux" "aarch64-linux" ] ./ollama-rocm.nix;
   ombi = runTest ./ombi.nix;
-  omnom = runTest ./omnom.nix;
+  omnom = runTest ./omnom;
   openarena = runTest ./openarena.nix;
   openbao = runTest ./openbao.nix;
   opencloud = runTest ./opencloud.nix;
@@ -1082,6 +1082,7 @@ in
   open-web-calendar = runTest ./web-apps/open-web-calendar.nix;
   ocsinventory-agent = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./ocsinventory-agent.nix { };
   orthanc = runTest ./orthanc.nix;
+  owi = runTest ./owi.nix;
   owncast = runTest ./owncast.nix;
   outline = runTest ./outline.nix;
   i18n = runTest ./i18n.nix;

nixos/tests/omnom/config.nix

@@ -0,0 +1,36 @@
+{ config, pkgs, ... }:
+{
+  services.omnom = {
+    enable = true;
+    openFirewall = true;
+
+    port = 9090;
+
+    settings = {
+      app = {
+        disable_signup = false; # restrict CLI user-creation
+        results_per_page = 50;
+      };
+      server.address = "0.0.0.0:${toString config.services.omnom.port}";
+    };
+  };
+
+  programs.firefox = {
+    enable = true;
+    # librewolf allows installations of unsigned extensions
+    package = pkgs.wrapFirefox pkgs.librewolf-unwrapped {
+      nixExtensions = [
+        (
+          let
+            # specified in manifest.json of the addon
+            extid = "{f0bca7ce-0cda-41dc-9ea8-126a50fed280}";
+          in
+          pkgs.runCommand "omnom" { passthru = { inherit extid; }; } ''
+            mkdir -p $out
+            cp ${pkgs.omnom}/share/addons/omnom_ext_firefox.zip $out/${extid}.xpi
+          ''
+        )
+      ];
+    };
+  };
+}

nixos/tests/omnom/default.nix

@@ -0,0 +1,105 @@
+{ config, pkgs, ... }:
+{
+  name = "Basic Omnom Test";
+  meta = {
+    inherit (pkgs.omnom.meta) maintainers;
+  };
+
+  nodes = {
+    server =
+      { pkgs, ... }:
+      {
+        imports = [
+          ../common/x11.nix
+          ./config.nix
+        ];
+
+        environment.systemPackages = [ pkgs.xdotool ];
+      };
+  };
+
+  testScript =
+    let
+      port = toString config.nodes.server.services.omnom.port;
+    in
+    # python
+    ''
+      import re
+
+      def open_omnom():
+        # Add-ons Manager
+        server.succeed("xdotool mousemove --sync 960 90 click 1")
+        server.sleep(10)
+        # omnom
+        server.succeed("xdotool mousemove --sync 700 190 click 1")
+        server.sleep(10)
+
+
+      service_url = "http://127.0.0.1:${toString port}"
+
+      server.start()
+      server.wait_for_unit("omnom.service")
+      server.wait_for_open_port(${toString port})
+      server.succeed(f"curl -sf '{service_url}'")
+
+      output = server.succeed("omnom create-user user [email protected]")
+      match = re.search(r"Visit (.+?) to sign in", output)
+      assert match is not None, "Login URL not found"
+      login_url = match[1].replace("0.0.0.0", "127.0.0.1")
+
+      output = server.succeed("omnom create-token user addon")
+      match = re.search(r"Token (.+?) created", output)
+      assert match is not None, "Addon token not found"
+      token = match[1]
+
+      server.wait_for_x()
+      server.succeed(f"librewolf --new-window '{login_url}' >&2 &")
+      server.wait_for_window("Omnom")
+
+      open_omnom()
+
+      # token
+      server.succeed("xdotool mousemove --sync 700 350 click 1")
+      server.succeed(f"xdotool type {token}")
+      server.sleep(10)
+
+      # url
+      server.succeed("xdotool mousemove --sync 700 470 click 1")
+      server.succeed(f"xdotool type '{service_url}'")
+      server.sleep(10)
+
+      # submit
+      server.succeed("xdotool mousemove --sync 900 520 click 1")
+      server.sleep(10)
+
+      open_omnom()
+
+      # save
+      server.succeed("xdotool mousemove --sync 900 520 click 1")
+      server.sleep(10)
+
+      # refresh
+      server.succeed("xdotool mousemove --sync 100 80 click 1")
+      server.sleep(10)
+
+      server.screenshot("home.png")
+
+      # view bookmarks
+      server.succeed("xdotool mousemove --sync 300 130 click 1")
+      server.sleep(10)
+
+      # view snapshot
+      server.succeed("xdotool mousemove --sync 970 230 click 1")
+      server.sleep(10)
+      server.succeed("xdotool mousemove --sync 160 340 click 1")
+      server.sleep(10)
+
+      server.screenshot("screenshot.png")
+
+      # view details
+      server.succeed("xdotool mousemove --sync 290 200 click 1")
+      server.sleep(10)
+
+      server.screenshot("snapshot_details.png")
+    '';
+}

nixos/tests/owi.nix

@@ -0,0 +1,61 @@
+{
+  lib,
+  pkgs,
+  ...
+}:
+{
+  name = "owi";
+
+  meta.maintainers = with lib.maintainers; [ ethancedwards8 ];
+
+  nodes.machine = {
+    environment.systemPackages = with pkgs; [ owi ];
+
+    environment.etc."owipass.rs".source = pkgs.writeText "owi.rs" ''
+      use owi_sym::Symbolic;
+
+      fn mean_one(x: i32, y: i32) -> i32 {
+          (x + y)/2
+      }
+
+      fn mean_two(x: i32, y: i32) -> i32 {
+          (y + x)/2
+      }
+
+      fn main() {
+          let x = i32::symbol();
+          let y = i32::symbol();
+          // proving the commutative property of addition!
+          owi_sym::assert(mean_one(x, y) == mean_two(x, y))
+      }
+    '';
+
+    environment.etc."owifail.rs".source = pkgs.writeText "owi.rs" ''
+      use owi_sym::Symbolic;
+
+      fn mean_wrong(x: i32, y: i32) -> i32 {
+          (x + y) / 2
+      }
+
+      fn mean_correct(x: i32, y: i32) -> i32 {
+          (x & y) + ((x ^ y) >> 1)
+      }
+
+      fn main() {
+          let x = i32::symbol();
+          let y = i32::symbol();
+          owi_sym::assert(mean_wrong(x, y) == mean_correct(x, y))
+      }
+    '';
+  };
+
+  testScript =
+    { nodes, ... }:
+    ''
+      start_all()
+
+      # testing
+      machine.succeed("owi rust --fail-on-assertion-only /etc/owipass.rs")
+      machine.fail("owi rust --fail-on-assertion-only /etc/owifail.rs")
+    '';
+}

nixos/tests/searx.nix

@@ -28,7 +28,7 @@
         server = {
           port = "8080";
           bind_address = "0.0.0.0";
-          secret_key = "@SEARX_SECRET_KEY@";
+          secret_key = "$SEARX_SECRET_KEY";
         };
       };
     };

nixos/tests/tlsrpt.nix

@@ -35,7 +35,7 @@
 
     # Enabling postfix should put sendmail as the sendmail setting
     machine.succeed("grep -q sendmail_script=sendmail /etc/tlsrpt/reportd.cfg")
-    machine.succeed("systemctl show --property SupplementaryGroups postfix.service | grep tlsrpt")
+    machine.succeed("getent group tlsrpt | grep -q postfix")
 
     machine.log(machine.succeed("systemd-analyze security tlsrpt-collectd.service tlsrpt-reportd.service | grep -v ✓"))
   '';

pkgs/applications/editors/greenfoot/default.nix

@@ -41,7 +41,7 @@ stdenv.mkDerivation rec {
 
     makeWrapper ${openjdk}/bin/java $out/bin/greenfoot \
       "''${gappsWrapperArgs[@]}" \
-      --add-flags "-Dawt.useSystemAAFontSettings=on -Xmx512M \
+      --add-flags "-Dawt.useSystemAAFontSettings=gasp -Xmx512M \
                    --add-opens javafx.graphics/com.sun.glass.ui=ALL-UNNAMED \
                    -cp $out/share/greenfoot/boot.jar bluej.Boot \
                    -greenfoot=true -bluej.compiler.showunchecked=false \

pkgs/applications/editors/vscode/extensions/default.nix

@@ -2045,8 +2045,8 @@ let
         mktplcRef = {
           name = "gitlab-workflow";
           publisher = "gitlab";
-          version = "6.33.2";
-          hash = "sha256-28J1PxqJgULkbO49gjMyJf79pSlN1ZeN9vN5clJ2wYo=";
+          version = "6.35.0";
+          hash = "sha256-stSo+GHhEzIE1HevACEUmum9tNetMIfpz0t8330QlTI=";
         };
         meta = {
           description = "GitLab extension for Visual Studio Code";
@@ -4403,8 +4403,8 @@ let
         mktplcRef = {
           publisher = "sonarsource";
           name = "sonarlint-vscode";
-          version = "4.26.0";
-          hash = "sha256-Mru3dz0Dl/oDHd0tB/0Ixd+EselC+e70Cn7sdu1gkwk=";
+          version = "4.27.0";
+          hash = "sha256-0BqIJL9Vyccjsov1JQil3dRUdo9w8ecOUotVKzBlYGQ=";
         };
         meta.license = lib.licenses.lgpl3Only;
       };

pkgs/applications/graphics/processing/default.nix

@@ -131,11 +131,11 @@ stdenv.mkDerivation rec {
     makeWrapper $out/share/${pname}/processing $out/bin/processing \
       ''${gappsWrapperArgs[@]} \
       --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ libGL ]}" \
-      --prefix _JAVA_OPTIONS " " -Dawt.useSystemAAFontSettings=lcd
+      --prefix _JAVA_OPTIONS " " "-Dawt.useSystemAAFontSettings=gasp"
     makeWrapper $out/share/${pname}/processing-java $out/bin/processing-java \
       ''${gappsWrapperArgs[@]} \
       --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ libGL ]}" \
-      --prefix _JAVA_OPTIONS " " -Dawt.useSystemAAFontSettings=lcd
+      --prefix _JAVA_OPTIONS " " "-Dawt.useSystemAAFontSettings=gasp"
 
     runHook postInstall
   '';