jiebi/CodeConvo huggingface dataset:
<ins> --- a/src/dummy.h	2016-12-17 23:02:53.396287041 +0100 +++ b/src/dummy.h	2016-12-17 23:03:30.319616550 +0100 @@ -51,6 +51,7 @@ /* options */ OptionInfoPtr Options; Bool swCursor; +    Bool constantDPI; /* proc pointer */ CloseScreenProcPtr CloseScreen; xf86CursorInfoPtr CursorInfo; --- a/src/dummy_driver.c	2016-12-14 21:54:20.000000000 +0100 +++ b/src/dummy_driver.c	2016-12-17 23:04:59.916416126 +0100 @@ -17,6 +17,12 @@ /* All drivers using the mi colormap manipulation need this */ #include "micmap.h" +#ifdef RANDR +#include "randrstr.h" +#endif + +#include "windowstr.h" + /* identifying atom needed by magnifiers */ #include <X11/Xatom.h> #include "property.h" @@ -115,11 +121,15 @@ }; typedef enum { -    OPTION_SW_CURSOR +    OPTION_SW_CURSOR, +    OPTION_CONSTANT_DPI } DUMMYOpts; static const OptionInfoRec DUMMYOptions[] = { { OPTION_SW_CURSOR,	"SWcursor",	OPTV_BOOLEAN,	{0}, FALSE }, +#ifdef RANDR +    { OPTION_CONSTANT_DPI,	"ConstantDPI",	OPTV_BOOLEAN,	{0}, FALSE }, +#endif { -1,                  NULL,           OPTV_NONE,	{0}, FALSE } }; @@ -359,6 +369,7 @@ xf86ProcessOptions(pScrn->scrnIndex, pScrn->options, dPtr->Options); xf86GetOptValBool(dPtr->Options, OPTION_SW_CURSOR,&dPtr->swCursor); +    xf86GetOptValBool(dPtr->Options, OPTION_CONSTANT_DPI, &dPtr->constantDPI); if (device->videoRam != 0) { pScrn->videoRam = device->videoRam; @@ -639,10 +650,45 @@ return TRUE; } +const char *XDPY_PROPERTY = "dummy-constant-xdpi"; +const char *YDPY_PROPERTY = "dummy-constant-ydpi"; +static int get_dpi_value(WindowPtr root, const char *property_name, int default_dpi) +{ +    PropertyPtr prop; +    Atom type_atom = MakeAtom("CARDINAL", 8, TRUE); +    Atom prop_atom = MakeAtom(property_name, strlen(property_name), FALSE); + +    for (prop = wUserProps(root); prop; prop = prop->next) { +       if (prop->propertyName == prop_atom && prop->type == type_atom && prop->data) { +           int v = (int) (*((CARD32 *) prop->data)); +           if ((v>0) && (v<4096)) { +               xf86DrvMsg(0, X_INFO, "get_constant_dpi_value() found property "%s" with value=%in", property_name, (int) v); +               return (int) v; +           } +           break; +       } +    } +    return default_dpi; +} + /* Mandatory */ Bool DUMMYSwitchMode(SWITCH_MODE_ARGS_DECL) { +    SCRN_INFO_PTR(arg); +#ifdef RANDR +    DUMMYPtr dPtr = DUMMYPTR(pScrn); +    if (dPtr->constantDPI) { +        int xDpi = get_dpi_value(pScrn->pScreen->root, XDPY_PROPERTY, pScrn->xDpi); +        int yDpi = get_dpi_value(pScrn->pScreen->root, YDPY_PROPERTY, pScrn->yDpi); +        //25.4 mm per inch: (254/10) +        pScrn->pScreen->mmWidth = mode->HDisplay * 254 / xDpi / 10; +        pScrn->pScreen->mmHeight = mode->VDisplay * 254 / yDpi / 10; +        xf86DrvMsg(pScrn->scrnIndex, X_INFO, "mm(dpi %ix%i)=%ix%in", xDpi, yDpi, pScrn->pScreen->mmWidth, pScrn->pScreen->mmHeight); +        RRScreenSizeNotify(pScrn->pScreen); +        RRTellChanged(pScrn->pScreen); +    } +#endif return TRUE; } </ins>
<ins> --- xf86-video-dummy-0.3.6/src/dummy_driver.c	2014-11-05 19:24:02.668656601 +0700 +++ xf86-video-dummy-0.3.6.new/src/dummy_driver.c	2014-11-05 19:37:53.076061853 +0700 @@ -55,6 +55,9 @@ #include <X11/extensions/xf86dgaproto.h> #endif +/* Needed for fixing pointer limits on resize */ +#include "inputstr.h" + /* Mandatory functions */ static const OptionInfoRec *	DUMMYAvailableOptions(int chipid, int busid); static void     DUMMYIdentify(int flags); @@ -713,6 +716,26 @@ RRTellChanged(pScrn->pScreen); } #endif +    //ensure the screen dimensions are also updated: +    pScrn->pScreen->width = mode->HDisplay; +    pScrn->pScreen->height = mode->VDisplay; +    pScrn->virtualX = mode->HDisplay; +    pScrn->virtualY = mode->VDisplay; +    pScrn->frameX1 = mode->HDisplay; +    pScrn->frameY1 = mode->VDisplay; + +    //ensure the pointer uses the new limits too: +    DeviceIntPtr pDev; +    SpritePtr pSprite; +    for (pDev = inputInfo.devices; pDev; pDev = pDev->next) { +        if (pDev->spriteInfo!=NULL && pDev->spriteInfo->sprite!=NULL) { +            pSprite = pDev->spriteInfo->sprite; +            pSprite->hotLimits.x2 = mode->HDisplay; +            pSprite->hotLimits.y2 = mode->VDisplay; +            pSprite->physLimits.x2 = mode->HDisplay; +            pSprite->physLimits.y2 = mode->VDisplay; +        } +    } return TRUE; } </ins>
<ins> --- a/src/dummy.h	2016-12-17 23:33:33.279533389 +0100 +++ b/src/dummy.h	2016-12-17 23:33:56.695739166 +0100 @@ -69,7 +69,7 @@ int overlay_offset; int videoKey; int interlace; -    dummy_colors colors[256]; +    dummy_colors colors[1024]; pointer* FBBase; Bool        (*CreateWindow)() ;     /* wrapped CreateWindow */ Bool prop; --- a/src/dummy_driver.c	2016-12-17 23:33:47.446657886 +0100 +++ b/src/dummy_driver.c	2016-12-17 23:33:56.696739175 +0100 @@ -317,6 +317,7 @@ case 15: case 16: case 24: +        case 30: break; default: xf86DrvMsg(pScrn->scrnIndex, X_ERROR, @@ -331,8 +332,8 @@ pScrn->rgbBits = 8; /* Get the depth24 pixmap format */ -    if (pScrn->depth == 24 && pix24bpp == 0) -	pix24bpp = xf86GetBppFromDepth(pScrn, 24); +    if (pScrn->depth >= 24 && pix24bpp == 0) +	pix24bpp = xf86GetBppFromDepth(pScrn, pScrn->depth); /* * This must happen after pScrn->display has been set because @@ -623,7 +624,7 @@ if(!miCreateDefColormap(pScreen)) return FALSE; -    if (!xf86HandleColormaps(pScreen, 256, pScrn->rgbBits, +    if (!xf86HandleColormaps(pScreen, 1024, pScrn->rgbBits, DUMMYLoadPalette, NULL, CMAP_PALETTED_TRUECOLOR | CMAP_RELOAD_ON_MODE_SWITCH)) </ins>
<del> { stdenv, lib, fetchurl, callPackage, substituteAll, python3, pkgconfig </del> <ins> { stdenv, lib, fetchurl, callPackage, substituteAll, python3, pkgconfig, writeText </ins> , xorg, gtk3, glib, pango, cairo, gdk-pixbuf, atk , wrapGAppsHook, xorgserver, getopt, xauth, utillinux, which , ffmpeg_4, x264, libvpx, libwebp, x265
let inherit (python3.pkgs) cython buildPythonApplication; <del> xf86videodummy = callPackage ./xf86videodummy { }; </del> <ins> xf86videodummy = xorg.xf86videodummy.overrideDerivation (p: { patches = [ ./0002-Constant-DPI.patch ./0003-fix-pointer-limits.patch ./0005-support-for-30-bit-depth-in-dummy-driver.patch ]; }); xorgModulePaths = writeText "module-paths" '' Section "Files" ModulePath "${xorgserver}/lib/xorg/modules" ModulePath "${xorgserver}/lib/xorg/modules/extensions" ModulePath "${xorgserver}/lib/xorg/modules/drivers" ModulePath "${xf86videodummy}/lib/xorg/modules/drivers" EndSection ''; </ins> in buildPythonApplication rec { pname = "xpra"; version = "3.0.7";
<del> --- a/src/dummy.h	2016-12-17 23:02:53.396287041 +0100 +++ b/src/dummy.h	2016-12-17 23:03:30.319616550 +0100 @@ -51,6 +51,7 @@ /* options */ OptionInfoPtr Options; Bool swCursor; +    Bool constantDPI; /* proc pointer */ CloseScreenProcPtr CloseScreen; xf86CursorInfoPtr CursorInfo; --- a/src/dummy_driver.c	2016-12-14 21:54:20.000000000 +0100 +++ b/src/dummy_driver.c	2016-12-17 23:04:59.916416126 +0100 @@ -17,6 +17,12 @@ /* All drivers using the mi colormap manipulation need this */ #include "micmap.h" +#ifdef RANDR +#include "randrstr.h" +#endif + +#include "windowstr.h" + /* identifying atom needed by magnifiers */ #include <X11/Xatom.h> #include "property.h" @@ -115,11 +121,15 @@ }; typedef enum { -    OPTION_SW_CURSOR +    OPTION_SW_CURSOR, +    OPTION_CONSTANT_DPI } DUMMYOpts; static const OptionInfoRec DUMMYOptions[] = { { OPTION_SW_CURSOR,	"SWcursor",	OPTV_BOOLEAN,	{0}, FALSE }, +#ifdef RANDR +    { OPTION_CONSTANT_DPI,	"ConstantDPI",	OPTV_BOOLEAN,	{0}, FALSE }, +#endif { -1,                  NULL,           OPTV_NONE,	{0}, FALSE } }; @@ -359,6 +369,7 @@ xf86ProcessOptions(pScrn->scrnIndex, pScrn->options, dPtr->Options); xf86GetOptValBool(dPtr->Options, OPTION_SW_CURSOR,&dPtr->swCursor); +    xf86GetOptValBool(dPtr->Options, OPTION_CONSTANT_DPI, &dPtr->constantDPI); if (device->videoRam != 0) { pScrn->videoRam = device->videoRam; @@ -639,10 +650,45 @@ return TRUE; } +const char *XDPY_PROPERTY = "dummy-constant-xdpi"; +const char *YDPY_PROPERTY = "dummy-constant-ydpi"; +static int get_dpi_value(WindowPtr root, const char *property_name, int default_dpi) +{ +    PropertyPtr prop; +    Atom type_atom = MakeAtom("CARDINAL", 8, TRUE); +    Atom prop_atom = MakeAtom(property_name, strlen(property_name), FALSE); + +    for (prop = wUserProps(root); prop; prop = prop->next) { +       if (prop->propertyName == prop_atom && prop->type == type_atom && prop->data) { +           int v = (int) (*((CARD32 *) prop->data)); +           if ((v>0) && (v<4096)) { +               xf86DrvMsg(0, X_INFO, "get_constant_dpi_value() found property "%s" with value=%in", property_name, (int) v); +               return (int) v; +           } +           break; +       } +    } +    return default_dpi; +} + /* Mandatory */ Bool DUMMYSwitchMode(SWITCH_MODE_ARGS_DECL) { +    SCRN_INFO_PTR(arg); +#ifdef RANDR +    DUMMYPtr dPtr = DUMMYPTR(pScrn); +    if (dPtr->constantDPI) { +        int xDpi = get_dpi_value(pScrn->pScreen->root, XDPY_PROPERTY, pScrn->xDpi); +        int yDpi = get_dpi_value(pScrn->pScreen->root, YDPY_PROPERTY, pScrn->yDpi); +        //25.4 mm per inch: (254/10) +        pScrn->pScreen->mmWidth = mode->HDisplay * 254 / xDpi / 10; +        pScrn->pScreen->mmHeight = mode->VDisplay * 254 / yDpi / 10; +        xf86DrvMsg(pScrn->scrnIndex, X_INFO, "mm(dpi %ix%i)=%ix%in", xDpi, yDpi, pScrn->pScreen->mmWidth, pScrn->pScreen->mmHeight); +        RRScreenSizeNotify(pScrn->pScreen); +        RRTellChanged(pScrn->pScreen); +    } +#endif return TRUE; } </del>
<del> --- xf86-video-dummy-0.3.6/src/dummy_driver.c	2014-11-05 19:24:02.668656601 +0700 +++ xf86-video-dummy-0.3.6.new/src/dummy_driver.c	2014-11-05 19:37:53.076061853 +0700 @@ -55,6 +55,9 @@ #include <X11/extensions/xf86dgaproto.h> #endif +/* Needed for fixing pointer limits on resize */ +#include "inputstr.h" + /* Mandatory functions */ static const OptionInfoRec *	DUMMYAvailableOptions(int chipid, int busid); static void     DUMMYIdentify(int flags); @@ -713,6 +716,26 @@ RRTellChanged(pScrn->pScreen); } #endif +    //ensure the screen dimensions are also updated: +    pScrn->pScreen->width = mode->HDisplay; +    pScrn->pScreen->height = mode->VDisplay; +    pScrn->virtualX = mode->HDisplay; +    pScrn->virtualY = mode->VDisplay; +    pScrn->frameX1 = mode->HDisplay; +    pScrn->frameY1 = mode->VDisplay; + +    //ensure the pointer uses the new limits too: +    DeviceIntPtr pDev; +    SpritePtr pSprite; +    for (pDev = inputInfo.devices; pDev; pDev = pDev->next) { +        if (pDev->spriteInfo!=NULL && pDev->spriteInfo->sprite!=NULL) { +            pSprite = pDev->spriteInfo->sprite; +            pSprite->hotLimits.x2 = mode->HDisplay; +            pSprite->hotLimits.y2 = mode->VDisplay; +            pSprite->physLimits.x2 = mode->HDisplay; +            pSprite->physLimits.y2 = mode->VDisplay; +        } +    } return TRUE; } </del>
<del> --- a/src/dummy.h	2016-12-17 23:33:33.279533389 +0100 +++ b/src/dummy.h	2016-12-17 23:33:56.695739166 +0100 @@ -69,7 +69,7 @@ int overlay_offset; int videoKey; int interlace; -    dummy_colors colors[256]; +    dummy_colors colors[1024]; pointer* FBBase; Bool        (*CreateWindow)() ;     /* wrapped CreateWindow */ Bool prop; --- a/src/dummy_driver.c	2016-12-17 23:33:47.446657886 +0100 +++ b/src/dummy_driver.c	2016-12-17 23:33:56.696739175 +0100 @@ -317,6 +317,7 @@ case 15: case 16: case 24: +        case 30: break; default: xf86DrvMsg(pScrn->scrnIndex, X_ERROR, @@ -331,8 +332,8 @@ pScrn->rgbBits = 8; /* Get the depth24 pixmap format */ -    if (pScrn->depth == 24 && pix24bpp == 0) -	pix24bpp = xf86GetBppFromDepth(pScrn, 24); +    if (pScrn->depth >= 24 && pix24bpp == 0) +	pix24bpp = xf86GetBppFromDepth(pScrn, pScrn->depth); /* * This must happen after pScrn->display has been set because @@ -623,7 +624,7 @@ if(!miCreateDefColormap(pScreen)) return FALSE; -    if (!xf86HandleColormaps(pScreen, 256, pScrn->rgbBits, +    if (!xf86HandleColormaps(pScreen, 1024, pScrn->rgbBits, DUMMYLoadPalette, NULL, CMAP_PALETTED_TRUECOLOR | CMAP_RELOAD_ON_MODE_SWITCH)) </del>
<del> { stdenv, lib, fetchurl , xorgproto, xorgserver , pkgconfig }: with lib; stdenv.mkDerivation rec { version = "0.3.8"; suffix = "1"; name = "xpra-xf86videodummy-${version}-${suffix}"; builder = ../../../../servers/x11/xorg/builder.sh; src = fetchurl { url = "mirror://xorg/individual/driver/xf86-video-dummy-${version}.tar.bz2"; sha256 = "1fcm9vwgv8wnffbvkzddk4yxrh3kc0np6w65wj8k88q7jf3bn4ip"; }; patches = [ ./0002-Constant-DPI.patch ./0003-fix-pointer-limits.patch ./0005-support-for-30-bit-depth-in-dummy-driver.patch ]; nativeBuildInputs = [ pkgconfig ]; buildInputs = [ xorgproto xorgserver ]; meta = { description = "Dummy driver for Xorg with xpra patches"; homepage = https://xpra.org/trac/wiki/Xdummy; license = licenses.gpl2; platforms = platforms.unix; maintainers = with maintainers; [ numinit ]; }; } </del>
${stdenv.lib.optionalString enablePlayer '' --prefix LD_LIBRARY_PATH : ${vlc}/lib ''} <ins> mkdir -p $out/share/applications $out/share/icons $out/share/man/man1 cp $out/Tribler/Main/Build/Ubuntu/tribler.desktop $out/share/applications/tribler.desktop cp $out/Tribler/Main/Build/Ubuntu/tribler_big.xpm $out/share/icons/tribler.xpm cp $out/Tribler/Main/Build/Ubuntu/tribler.1 $out/share/man/man1/tribler.1 </ins> ''; meta = with stdenv.lib; {
}; }; <del> services.zfs.zed.settings = mkOption { type = with types; attrsOf (oneOf [ str int bool (listOf str) ]); example = literalExample '' { ZED_DEBUG_LOG = "/tmp/zed.debug.log"; </del> <ins> services.zfs.zed = { enableMail = mkEnableOption "ZED's ability to send emails" // { default = cfgZfs.package.enableMail; }; </ins> <del> ZED_EMAIL_ADDR = [ "root" ]; ZED_EMAIL_PROG = "mail"; ZED_EMAIL_OPTS = "-s '@SUBJECT@' @ADDRESS@"; </del> <ins> settings = mkOption { type = with types; attrsOf (oneOf [ str int bool (listOf str) ]); example = literalExample '' { ZED_DEBUG_LOG = "/tmp/zed.debug.log"; </ins> <del> ZED_NOTIFY_INTERVAL_SECS = 3600; ZED_NOTIFY_VERBOSE = false; </del> <ins> ZED_EMAIL_ADDR = [ "root" ]; ZED_EMAIL_PROG = "mail"; ZED_EMAIL_OPTS = "-s '@SUBJECT@' @ADDRESS@"; </ins> <del> ZED_USE_ENCLOSURE_LEDS = true; ZED_SCRUB_AFTER_RESILVER = false; } ''; description = '' ZFS Event Daemon /etc/zfs/zed.d/zed.rc content See <citerefentry><refentrytitle>zed</refentrytitle><manvolnum>8</manvolnum></citerefentry> for details on ZED and the scripts in /etc/zfs/zed.d to find the possible variables ''; </del> <ins> ZED_NOTIFY_INTERVAL_SECS = 3600; ZED_NOTIFY_VERBOSE = false; ZED_USE_ENCLOSURE_LEDS = true; ZED_SCRUB_AFTER_RESILVER = false; } ''; description = '' ZFS Event Daemon /etc/zfs/zed.d/zed.rc content See <citerefentry><refentrytitle>zed</refentrytitle><manvolnum>8</manvolnum></citerefentry> for details on ZED and the scripts in /etc/zfs/zed.d to find the possible variables ''; }; </ins> }; };
(mkIf cfgZfs.enabled { assertions = [ { <ins> assertion = cfgZED.enableMail -> cfgZfs.package.enableMail; message = '' To allow ZED to send emails, ZFS needs to be configured to enable this. To do so, one must override the `zfs` package and set `enableMail` to true. ''; } { </ins> assertion = config.networking.hostId != null; message = "ZFS requires networking.hostId to be set"; }
''; postFixup = let <del> path = "PATH=${makeBinPath [ coreutils gawk gnused gnugrep util-linux smartmontools sysstat ]}:$PATH"; </del> <ins> path = "PATH=${makeBinPath [ coreutils gawk gnused gnugrep util-linux smartmon sysstat ]}:$PATH"; </ins> in '' for i in $out/libexec/zfs/zpool.d/*; do sed -i '2i${path}' $i
outputs = [ "out" ] ++ optionals buildUser [ "lib" "dev" ]; <del> passthru.tests = if isUnstable then [ nixosTests.zfs.unstable ] else [ nixosTests.zfs.installer nixosTests.zfs.stable ]; </del> <ins> passthru = { inherit enableMail; tests = if isUnstable then [ nixosTests.zfs.unstable ] else [ nixosTests.zfs.installer nixosTests.zfs.stable ]; }; </ins> meta = { description = "ZFS Filesystem Linux Kernel module";
postPatch = "cp -v ${driverdb} drivedb.h"; configureFlags = [ <del> "--with-scriptpath=${lib.makeBinPath [ mailutils inetutils ]}" </del> <ins> "--with-scriptpath=${lib.makeBinPath ([ inetutils ] ++ lib.optional enableMail mailutils)}" </ins> ]; nativeBuildInputs = [ autoreconfHook ];
<ins> commit 1b0d9bcc5f5cd78b0bb1357d6a11da5d616ad26f Author: Wout Mertens <Wout.Mertens@gmail.com> Date:   Thu Jun 11 18:08:13 2020 +0200 fix segfault when using ECDSA keys. Author: Marc Deslauriers <marc.deslauriers@canonical.com> Bug-Ubuntu: https://bugs.launchpad.net/bugs/1869512 diff --git a/ssh-ecdsa.c b/ssh-ecdsa.c index 5b13b30..5bf29cc 100644 --- a/ssh-ecdsa.c +++ b/ssh-ecdsa.c @@ -46,7 +46,7 @@ ssh_ecdsa_sign(const Key *key, u_char **sigp, u_int *lenp, u_int len, dlen; Buffer b, bb; #if OPENSSL_VERSION_NUMBER >= 0x10100005L -	BIGNUM *r, *s; +	BIGNUM *r = NULL, *s = NULL; #endif if (key == NULL || key->type != KEY_ECDSA || key->ecdsa == NULL) { @@ -137,20 +137,27 @@ ssh_ecdsa_verify(const Key *key, const u_char *signature, u_int signaturelen, /* parse signature */ if ((sig = ECDSA_SIG_new()) == NULL) -        pamsshagentauth_fatal("ssh_ecdsa_verify: DSA_SIG_new failed"); +        pamsshagentauth_fatal("ssh_ecdsa_verify: ECDSA_SIG_new failed"); pamsshagentauth_buffer_init(&b); pamsshagentauth_buffer_append(&b, sigblob, len); #if OPENSSL_VERSION_NUMBER < 0x10100005L if ((pamsshagentauth_buffer_get_bignum2_ret(&b, sig->r) == -1) || (pamsshagentauth_buffer_get_bignum2_ret(&b, sig->s) == -1)) +        pamsshagentauth_fatal("ssh_ecdsa_verify:" +            "pamsshagentauth_buffer_get_bignum2_ret failed"); #else -    DSA_SIG_get0(sig, &r, &s); +    if ((r = BN_new()) == NULL) +        pamsshagentauth_fatal("ssh_ecdsa_verify: BN_new failed"); +    if ((s = BN_new()) == NULL) +        pamsshagentauth_fatal("ssh_ecdsa_verify: BN_new failed"); if ((pamsshagentauth_buffer_get_bignum2_ret(&b, r) == -1) || (pamsshagentauth_buffer_get_bignum2_ret(&b, s) == -1)) -#endif pamsshagentauth_fatal("ssh_ecdsa_verify:" "pamsshagentauth_buffer_get_bignum2_ret failed"); +    if (ECDSA_SIG_set0(sig, r, s) != 1) +        pamsshagentauth_fatal("ssh_ecdsa_verify: ECDSA_SIG_set0 failed"); +#endif /* clean up */ memset(sigblob, 0, len); </ins>
<del> { stdenv, fetchpatch, fetchurl, pam, openssl, perl }: </del> <ins> { stdenv, fetchpatch, fetchFromGitHub, pam, openssl, perl }: </ins> stdenv.mkDerivation rec { <del> name = "pam_ssh_agent_auth-0.10.3"; </del> <ins> pname = "pam_ssh_agent_auth"; version = "0.10.4"; </ins> <del> src = fetchurl { url = "mirror://sourceforge/pamsshagentauth/${name}.tar.bz2"; sha256 = "0qx78x7nvqdscyp04hfijl4rgyf64xy03prr28hipvgasrcd6lrw"; </del> <ins> src = fetchFromGitHub { owner = "jbeverly"; repo = "pam_ssh_agent_auth"; rev = "pam_ssh_agent_auth-${version}"; sha256 = "YD1R8Cox0UoNiuWleKGzWSzxJ5lhDRCB2mZPp9OM6Cs="; </ins> }; <del> patches = [ # Allow multiple colon-separated authorized keys files to be # specified in the file= option. ./multiple-key-files.patch (fetchpatch { name = "openssl-1.1.1-1.patch"; url = "https://sources.debian.org/data/main/p/pam-ssh-agent-auth/0.10.3-3/debian/patches/openssl-1.1.1-1.patch"; sha256 = "1ndp5j4xfhzshhnl345gb4mkldx6vjfa7284xgng6ikhzpc6y7pf"; }) (fetchpatch { name = "openssl-1.1.1-2.patch"; url = "https://sources.debian.org/data/main/p/pam-ssh-agent-auth/0.10.3-3/debian/patches/openssl-1.1.1-2.patch"; sha256 = "0ksrs4xr417by8klf7862n3dircvnw30an1akq4pnsd3ichscmww"; }) ]; </del> <ins> ed25519-donna = fetchFromGitHub { owner = "floodyberry"; repo = "ed25519-donna"; rev = "8757bd4cd209cb032853ece0ce413f122eef212c"; sha256 = "ETFpIaWQnlYG8ZuDG2dNjUJddlvibB4ukHquTFn3NZM="; }; </ins> buildInputs = [ pam openssl perl ]; <del> # It's not clear to me why this is necessary, but without it, you see: # # checking OpenSSL header version... 1010104f (OpenSSL 1.1.1d  10 Sep 2019) # checking OpenSSL library version... 1010104f (OpenSSL 1.1.1d  10 Sep 2019) # checking whether OpenSSL's headers match the library... no # configure: WARNING: Your OpenSSL headers do not match your # library. Check config.log for details. # # ...despite the fact that clearly the values match configureFlags = [ "--without-openssl-header-check" ]; </del> <ins> patches = [ # Allow multiple colon-separated authorized keys files to be # specified in the file= option. ./multiple-key-files.patch ]; configureFlags = [ # It's not clear to me why this is necessary, but without it, you see: # # checking OpenSSL header version... 1010108f (OpenSSL 1.1.1h  22 Sep 2020) # checking OpenSSL library version... 1010108f (OpenSSL 1.1.1h  22 Sep 2020) # checking whether OpenSSL's headers match the library... no # configure: WARNING: Your OpenSSL headers do not match your # library. Check config.log for details. # # ...despite the fact that clearly the values match "--without-openssl-header-check" # Make sure it can find ed25519-donna "--with-cflags=-I$PWD" ]; prePatch = "cp -r ${ed25519-donna}/. ed25519-donna/."; </ins> enableParallelBuilding = true; meta = { <del> homepage = "http://pamsshagentauth.sourceforge.net/"; </del> <ins> homepage = "https://github.com/jbeverly/pam_ssh_agent_auth"; </ins> description = "PAM module for authentication through the SSH agent"; maintainers = [ stdenv.lib.maintainers.eelco ]; platforms = stdenv.lib.platforms.linux;
/* * PAM_USER and PAM_RUSER do not necessarily have to get set by the calling application, and we may be unable to divine the latter. <del> @@ -187,16 +184,17 @@ </del> <ins> @@ -184,5 +181,5 @@ </ins> */ if(user && strlen(ruser) > 0) { -        pamsshagentauth_verbose("Attempting authentication: `%s' as `%s' using %s", ruser, user, authorized_keys_file); +        pamsshagentauth_verbose("Attempting authentication: `%s' as `%s' using %s", ruser, user, authorized_keys_file_input); <ins> @@ -201,3 +197,3 @@ retval = PAM_SUCCESS; -                pamsshagentauth_logit("Authenticated (sshd): `%s' as `%s' using %s", ruser, user, authorized_keys_file); +                pamsshagentauth_logit("Authenticated (sshd): `%s' as `%s' using %s", ruser, user, authorized_keys_file_input); @@ -211,11 +208,12 @@ </ins> /* * this pw_uid is used to validate the SSH_AUTH_SOCK, and so must be the uid of the ruser invoking the program, not the target-user */ -        if(pamsshagentauth_find_authorized_keys(user, ruser, servicename)) { /* getpwnam(ruser)->pw_uid)) { */ <del> -            pamsshagentauth_logit("Authenticated: `%s' as `%s' using %s", ruser, user, authorized_keys_file); </del> <ins> -            pamsshagentauth_logit("Authenticated (agent): `%s' as `%s' using %s", ruser, user, authorized_keys_file); </ins> +        const char *key_file; +        if((key_file = pamsshagentauth_find_authorized_keys(user, ruser, servicename))) { /* getpwnam(ruser)->pw_uid)) { */ <del> +            pamsshagentauth_logit("Authenticated: `%s' as `%s' using %s", ruser, user, key_file); </del> <ins> +            pamsshagentauth_logit("Authenticated (agent): `%s' as `%s' using %s", ruser, user, key_file); </ins> retval = PAM_SUCCESS; } else { -            pamsshagentauth_logit("Failed Authentication: `%s' as `%s' using %s", ruser, user, authorized_keys_file);
<listitem> <para> The nginx web server previously started its master process as root <del> privileged, then ran worker processes as a less privileged identity user. </del> <ins> privileged, then ran worker processes as a less privileged identity user (the <literal>nginx</literal> user). </ins> This was changed to start all of nginx as a less privileged user (defined by <literal>services.nginx.user</literal> and <literal>services.nginx.group</literal>). As a consequence, all files that
certificates and keys, etc.) must now be readable by this less privileged user/group. </para> <ins> <para> To continue to use the old approach, you can configure: <programlisting> services.nginx.appendConfig = let cfg = config.services.nginx; in ''user ${cfg.user} ${cfg.group};''; systemd.services.nginx.serviceConfig.User = lib.mkForce "root"; </programlisting> </para> </ins> </listitem> <listitem> <para>