jiebi/CodeConvo huggingface dataset:
Code change:
CapabilityBoundingSet = ""; # ProtectClock= adds DeviceAllow=char-rtc r DeviceAllow = ""; <del> LockPersonality = true; </del> NoNewPrivileges = true; PrivateDevices = true; PrivateMounts = true;

Related discussion:
text: I understand that NixOS developers are super keen on hardening, which is generally good, but for certain applications I just don't think it makes sense to go over the top... or even provide "curated" selections behind 'enableHardening' type flags. CI software is so broad I think we're providing more trouble and confusion than value here. My personal recommendation for this specific module is to follow what suggested as a reasonable default and let users decide any hardening they want for themselves. But I'm not the maintainer of this module in NixOS, just a user, so I defer to those who are volunteering their time to maintain this module :bowing_man:
PR to fix is here: Mentions do not generate notifications, just making a comment so that anyone subscribed to this issue gets a notification.
Code change:
owner = "iterative"; repo = "dvc"; rev = "refs/tags/${version}"; <del> hash = "sha256-YX65jAkM0LFFtKf+MX0w1BfhyR2Dzr5Vpwxl2jJ/GGw="; </del> <ins> hash = "sha256-tC1Uv0EQZc0G4Eub98c/0mOp+haQPiQFGErQiRK0Gcw="; </ins> }; pythonRelaxDeps = [

Related discussion:
text: Steps to reproduce the behavior: dvc actually it is hash problem. error from my nixos: Please run and paste the result. Add a :+1: [reaction] to [issues you find important]. [reaction]: [issues you find important]:
This happens not for the first time and probably not for the last time :cry:
Code change:
githubId = 38869148; name = "Alex Eyre"; }; <del> algorith = { email = "dries_van_daele@telenet.be"; name = "Dries Van Daele"; }; </del> alibabzo = { email = "alistair.bill@gmail.com"; github = "alibabzo";

Related discussion:
text: The mpccli package is missing bashcompletion, even though a bash completion file is in the upstream repo under contrib/mpc- . Steps to reproduce the behavior: the package a terminal and type It tries only to complete with the contents of the current directory mpc should be completed with the mpc subcomands like , , etc. On a regular system, the file would have to be installed under /etc/bashcompletion.d/ . I don't know whats the nix(os) equivalent to this.
First, I am not the maintainer of this package. Nonetheless I will review this. Second, in Nixpkgs we do "almost" the same: we use a special hook that installs those extra files at the . Now I need to sleep; please wait a bit more.
Code change:
<ins> diff --git a/src/plugins/controls/label-freetype/plugin.c b/src/plugins/controls/label-freetype/plugin.c index 917b04c0..83f2bec2 100644 --- a/src/plugins/controls/label-freetype/plugin.c +++ b/src/plugins/controls/label-freetype/plugin.c @@ -127,7 +127,7 @@ find_default_font_path (void) FILE *fp; static char fc_match_out[PATH_MAX]; -        fp = popen ("/usr/bin/fc-match -f %{file}", "r"); +        fp = popen ("@fcmatch@ -f %{file}", "r"); if (!fp) return FONT_FALLBACK; @@ -144,7 +144,7 @@ find_default_monospace_font_path (void) FILE *fp; static char fc_match_out[PATH_MAX]; -        fp = popen ("/usr/bin/fc-match -f %{file} monospace", "r"); +        fp = popen ("@fcmatch@ -f %{file} monospace", "r"); if (!fp) return MONOSPACE_FONT_FALLBACK; </ins>

Related discussion:
text: For a few days, when booting my amd computer with plymouth enabled I can't enter my passphrase anymore. Pushing keys multiple times eventually end up in one key-press being accepted. Booting with instead of suddenly has no more issues with keyboard entries. Steps to reproduce the behavior: NixOS Unstable to and with a LUKS/ZFS Passphrase -presses are omitted Every key I hit will be used. <!-- Please @ people who are in the list of the offending package or module. If in doubt, check for whoever last touched something. -- ? system: host os: multi-user?: sandbox: version: channels(pl): channels(root): nixpkgs: Add a :+1: [reaction] to [issues you find important]. [reaction]: [issues you find important]:
Upstream bug report Fixed in upstream already
Code change:
, fetchPypi , lib <del> # propagates </del> <ins> # propagates </ins> , click , dlib , face-recognition-models , numpy , pillow <del> # tests </del> <ins> # tests </ins> , pytestCheckHook <ins> , config , cudaSupport ? config.cudaSupport </ins> }: buildPythonPackage rec {

Related discussion:
text: When you set , although it sets the CMAKE flag correctly the resulting package isn't actually built correctly as cmake can't find cuda so it unsets the flag. This is due to the incorrect usage of instead of when building the cuda related packages. The correct usage can be seen in the package. It also tries to build with CUDA by default which is wrong. Dlib hasn't supported fftw since however there are leftover references to it in cmake which might lead people to think it does support fftw. fftw should be removed. As mentioned in this it makes more sense to have as an input into rather that so that people can override it with other BLAS implementations e.g more easily if they want to. The package was also missing lapack which should be . Steps to reproduce the behavior: Build the package, it tries to build with CUDA by default. I made an example with a fairly simple nix flake that let's you switch between my patch and the original package. I have created a which fixes these issues. For it to build with CUDA. How CMAKE fails ! For this simple c switching from my fix to the original bugged package on 23.11 before openblas was . ! Please run and paste the result. Add a :+1: [reaction] to [issues you find important]. [reaction]: [issues you find important]: Thanks!
Code change:
<ins> { stdenv, buildGoPackage, fetchFromGitHub, keybase }: buildGoPackage rec { pname = "kbfs"; inherit (keybase) src version; goPackagePath = "github.com/keybase/client"; subPackages = [ "go/kbfs/kbfsfuse" "go/kbfs/kbfsgit/git-remote-keybase" ]; dontRenameImports = true; buildFlags = [ "-tags production" ]; meta = with stdenv.lib; { homepage = "https://keybase.io/docs/kbfs"; description = "The Keybase filesystem"; platforms = platforms.unix; maintainers = with maintainers; [ rvolosatovs bennofs np ]; license = licenses.bsd3; }; } </ins>

Related discussion:
text: Hi, I'm a Keybase developer and some of our users reported that the Nix packages were out of date. Keybase 4.1.0 was released a while ago, so I believe these need to be updated: Additionally, the KBFS nix should point to the new remote, with , and be on the same version as the other packages (4.1.0). Please let me know if you have any questions, happy to answer! Thanks. N/A N/A
if the users are using the stable branch, then the update will need to be backported. Otherwise if they are unstable then it should be just a few short moments ;)
KBFS has not been updated as directed here.
Code change:
(substituteAll { src = ./fix-bubblewrap-paths.patch; inherit (builtins) storeDir; <ins> inherit (addOpenGLRunpath) driverLink; </ins> }) ./libglvnd-headers.patch ];

Related discussion:
text: Describe the bug Epiphany crashes on startup with a bind mount error. To Reproduce Steps to reproduce the behavior: epiphany Expected behavior The browser should startup Additional context Error: exists and opengl is enabled I bet is relevant Notify maintainers <!-- Please @ people who are in the list of the offending package or module. If in doubt, check for whoever last touched something. -- Metadata Maintainer information:
I can't reproduce this on my machine. Can you try running it with ?
Thanks for responding. I think this is the relevant part from :
Ah, this only shows that emits the error message. To trace what it actually does, could you try adding the flag?
I just piped it all into here:
The output got cut off there, unfortunately. Maybe you could just attach the text file directly to your reply?
Sorry about that, here is the file:
Thanks for the log! I think I've found the culprit. I've opened which seems to fix it - please try it out.
Code change:
goland = buildGoland rec { name = "goland-${version}"; <del> version = "2019.3.3"; /* updated by script */ </del> <ins> version = "2019.3.4"; /* updated by script */ </ins> description = "Up and Coming Go IDE"; license = stdenv.lib.licenses.unfree; src = fetchurl { url = "https://download.jetbrains.com/go/${name}.tar.gz"; <del> sha256 = "091ym7vyb0hxzz6a1jfb88x0lj499vjd04bq8swmw14m1akmk3lf"; /* updated by script */ </del> <ins> sha256 = "01dik4ppn4a6m1bmz6cmdnyrilh2v190lrys65n4nps03sjy2v0b"; /* updated by script */ </ins> }; wmClass = "jetbrains-goland"; update-channel = "GoLand RELEASE";

Related discussion:
text: Please update Goland to a current version. The Current Version is now 2020.1 Thx and Greetz
Code change:
sha256 = "f19fa66e656309825887171d84a462e64676b1cc36b62e4dd8679ff63926a469"; }; <ins> propagatedBuildInputs = with self; [ ofxclient ]; </ins> buildInputs = with self; [ <del> ofxclient </del> mock nose # Used at runtime to translate ofx entries to the ledger

Related discussion:
text: To make sure that we are on the same page: When I run ledger-autosync, it complains about a missing module. I expect it to run It prints:
Let me know if there is any other information you would like me to provide.
cc maintainer (btw, nlewo, your nick in is wrong)
Code change:
inherit (darwin.apple_sdk.frameworks) AVFoundation AudioToolbox ImageIO CoreMedia Foundation CoreGraphics MediaToolbox; }; <del> kbfs = callPackage ../tools/security/kbfs { }; </del> <ins> kbfs = callPackage ../tools/security/keybase/kbfs.nix { }; </ins> keybase-gui = callPackage ../tools/security/keybase/gui.nix { };

Related discussion:
text: Hi, I'm a Keybase developer and some of our users reported that the Nix packages were out of date. Keybase 4.1.0 was released a while ago, so I believe these need to be updated: Additionally, the KBFS nix should point to the new remote, with , and be on the same version as the other packages (4.1.0). Please let me know if you have any questions, happy to answer! Thanks. N/A N/A
if the users are using the stable branch, then the update will need to be backported. Otherwise if they are unstable then it should be just a few short moments ;)
KBFS has not been updated as directed here.
Code change:
subPackages = [ "cmd/grafana-agent" "cmd/grafana-agentctl" <ins> "web/ui" </ins> ]; <ins> preBuild = '' export HOME="$TMPDIR" pushd web/ui fixup_yarn_lock yarn.lock yarn config --offline set yarn-offline-mirror $frontendYarnOfflineCache yarn install --offline --frozen-lockfile --ignore-platform --ignore-scripts --no-progress --non-interactive patchShebangs node_modules yarn --offline run build popd ''; </ins> # uses go-systemd, which uses libsystemd headers # https://github.com/coreos/go-systemd/issues/351 env.NIX_CFLAGS_COMPILE = toString (lib.optionals stdenv.isLinux [ "-I${lib.getDev systemd}/include" ]);

Related discussion:
text: I started grafana-agent in flow mode, and tried to access the http API at http://localhost:. Unfortunately, instead of providing a web interface to debug the current list of components, I get a "404 page not found". Steps to reproduce the behavior: grafana-agent in flow mode. port via HTTP I'd expect grafana-agent to ship with the web interface. Please run and paste the result.
It looks like is what's building the frontend. Unfortunately, the web interface seems managed by yarn (and has a ), so we'd need to first provide a . I tried to have resolve the dependency, but it seems it's not able to:
I manually patched things in to bump to a more recent version, compatible with the react version that's mentioned in , but ugh, I'm not really sure why it's that way. I'll ask upstream.
yeah, sorry, I don't use flow mode (yet?) and the nixos module does not support it either, as far as I am aware. I can try looking into it as well, first, before you raise an issue upstream. While the nixos module might lack support for it (for now?), I believe we should try fix it nonetheless :)
Yeah, we should probably have a second NixOS module for flow mode, it's very different and the existing config structure doesn't make much sense - for now I just did ship my own custom systemd unit for it: But yeah, without the web ui it's quite annoying to debug, so we should probably get that sorted out first, before providing a module and getting more people to use it.
fyi
I tried to move it over, but still seems to be terribly slow when trying to resolve deps and not being able to, so I guess we should stay with yarn.
We should prefer yarn simply due to upstream having an instead of a :) ^
Code change:
webtest = buildPythonPackage rec { <del> version = "2.0.15"; </del> <ins> version = "2.0.20"; </ins> name = "webtest-${version}"; src = pkgs.fetchurl { <del> url = "http://pypi.python.org/packages/source/W/WebTest/WebTest-${version}.zip"; sha256 = "c320adc2cd862ea71ca9e2012e6157eb12f5f8d1632d1541f2eabf984aaa3ecc"; </del> <ins> url = "http://pypi.python.org/packages/source/W/WebTest/WebTest-${version}.tar.gz"; sha256 = "0bv0qhdjakdsdgj4sk21gnpp8xp8bga4x03p6gjb83ihrsb7n4xv"; </ins> }; preConfigure = ''

Related discussion:
text: To make sure that we are on the same page: Kernel: System: Nix version: Nixpkgs version: broke legacy packages (only tested with the -set). Multiple options to solve this: revert the commit (an update will eventually have to be done) make sure no-one depends on sqlalchemy legacy versions (this would be the best choice, but can require a big amount of work) re-introduce an outdated version only used by legacy version (I’ll prepare a PR shortly that follows this path) cc
To be complete, the build problem is a test failure: I also checked, we cannot downgrade sqlite only for few pythonPackages, the entire python (and package set) have to be changed. Any preferred way to go?
(We should check if we still need this version, have it removed locally for virtmanager, virtinst as it isn't used, but haven't had the time to push that)
Yes, this is the preferred way to go. I began that but did not finish it yet, and it impacts some important parts (it causes xen to fail) I would prefer not to break because of unsufficient testing from me. This is in progress but could require some time to complete.
FYI xen already fails on
FYI: I switched away from sqlalchemy7 in yesterday.
Apart from virtinst, acd_cli, beaker, coilmq, and geeknote are the only revdeps of sqlalchemy7, as far as I can tell.
I openned to do some cleanup on sqlalchemy7. There still is that explicitly require . The same work will have to be done for and .
This should have remained open.
Using an older version of sqlite requires overriding the derivations of the interpreters.
See
Code change:
libDir = "lib64"; <del> deps = [ zlib glib libpng freetype xorg.libSM xorg.libICE xorg.libXrender openssl xorg.libXrandr xorg.libXfixes xorg.libXcursor xorg.libXinerama xorg.libxcb fontconfig xorg.libXext xorg.libX11 alsa-lib qtbase qtwebengine qtwebchannel qtsvg qtwebsockets libpulseaudio quazip llvmPackages.libcxx ]; </del> <ins> deps = [ zlib glib libpng freetype xorg.libSM xorg.libICE xorg.libXrender openssl xorg.libXrandr xorg.libXfixes xorg.libXcursor xorg.libXinerama xorg.libxcb fontconfig xorg.libXext xorg.libX11 alsa-lib qtbase qtwebengine qtwebchannel qtsvg qtwebsockets libpulseaudio quazip llvmPackages.libcxx ]; </ins> desktopItem = makeDesktopItem { name = "teamspeak";

Related discussion:
text: Steps to reproduce the behavior: try to install/build the package using nix-shell or nixos the Domain is no longer configured. Teamspeak Download Pages redirects to this place: Please run and paste the result. Add a :+1: [reaction] to [issues you find important]. [reaction]: [issues you find important]:
You might want to check out
Not merged yet
As a workaround, until this is fixed in nixpkgs: The file is still available at the Internet Archive. You can fetch it from there and write it into the store, with something like this:
Code change:
pkg-config glib wrapGAppsHook4 <ins> gobject-introspection </ins> ]; buildInputs = [ librsvg <del> gobject-introspection </del> libnotify libadwaita libportal

Related discussion:
text: crashes, even when installed into the system. Steps to reproduce the behavior: shell "nixpkgs#gnome-frog" -c frog Program doesn’t crash Please run and paste the result.
Interestingly, I was able to build and run the app in commit (I also rebuild it with just to double check). ! Though, it does fail to build and run in recent revisions (at least in ). It needs to apply to be able to build. Running it however gives me the following error: Not exactly familiar with GTK development but I'll see what I can do. Thank you for reporting!
Running it on my end gives me another error:
frog+main+Application' doesn't support property gobject-introspectionbuildInputsnativeBuildInputswrapGAppsHookGITYPELIB_PATH`, resulting in typelibs being picked up from the environment.
Thank you for the explanation, . Simply putting into did build and run the app (at least in the recent commits).
Code change:
inherit (llvmPackages) libcxx; } else <del> clangNoMarch; </del> <ins> swiftLlvmPackages.clang; </ins> # Overrides that create a useful environment for swift packages, allowing # packaging with `swiftPackages.callPackage`. These are similar to

Related discussion:
text: Since was merged into the master, swift cannot be built on aarch64. Steps to reproduce the behavior: reported in I'm not familiar with swift or clang, but I'm using the following overlay as a workaround until it's fixed. <!-- Please @ people who are in the list of the offending package or module. If in doubt, check for whoever last touched something. --Please run and paste the result. Add a :+1: [reaction] to [issues you find important]. [reaction]: [issues you find important]:
states that this only fixed the swift build but all downstream packages are still broken. re-opening.
Actually, it seems only dark-mode-notify is broken, others seem fine. Probably because it uses Cocoa or disables sandbox. I don't know for sure.
I noticed that my personal package does not build either. Maybe it's because of swift itself or swiftpm?
The above open PR seems to run into the same issue…
Code change:
PrivateNetwork = false; # Cannot be true due to Node MemoryDenyWriteExecute = false; <ins> # The more restrictive "pid" option makes `nix` commands in CI emit # "GC Warning: Couldn't read /proc/stat" # You may want to set this to "pid" if not using `nix` commands ProcSubset = "all"; # Coverage programs for compiled code such as `cargo-tarpaulin` disable # ASLR (address space layout randomization) which requires the # `personality` syscall # You may want to set this to `true` if not using coverage tooling on # compiled code LockPersonality = false; </ins> }; }; };

Related discussion:
text: introduced systemd syscall filtering which seems overly restrictive for common use cases. We use for coverage reports of our Rust projects which makes use of the ptrace(2) system call (denied by ). Android projects commonly rely on which uses chown(2) (denied by ). In my opinion, those use cases are too common and should work out of the box. Also, workflow failures are difficult to debug if syscall filtering (or any hardening) steps in. I'd suggest to revise the syscall filtering: Also, it might help with debugging or employing a custom hardening configuration if we add a module option which defaults to . Please run and paste the result.
I agree that if the hardening make github-runner not to work as expected or as "standard" installation, we should remove them or make them optional with new option Do you want it to default to ? Maybe better with so it work as expected out of box?
also noted problems with makefile workflows in that I have been able to reproduce. I am sorry I did not catch this when making the changes originally. My usecase was running binaries on uncommon targets (e.g. ) connected over USB; and I only had light testing for other usecases. I have since a makefile test to the runner I use for testing package/module updates and will add a coverage workflow now too. I am ok with removing the harderning entirely, or making it more permissive. I only this because at the time I thought it would be a sane default for majority of applications. I would prefer we keep some hardening. Most people probably do not want a CI process to change the clock, hostname, or reboot the system entirely. I have been working on this in the background since reported issues; this is what I have come up with so far, I have not tested it with yet (will do that later this weekend); but it does allow and debug related tools such as to function. In addition to changes should also be changed to so that nix does not emit warnings when running.
:+1: :+1: Yes, all this hardening is already available and entirely optional! Every user is free to add anything to that they want.
Code change:
PrivateNetwork = false; # Cannot be true due to Node MemoryDenyWriteExecute = false; <ins> # The more restrictive "pid" option makes `nix` commands in CI emit # "GC Warning: Couldn't read /proc/stat" # You may want to set this to "pid" if not using `nix` commands ProcSubset = "all"; # Coverage programs for compiled code such as `cargo-tarpaulin` disable # ASLR (address space layout randomization) which requires the # `personality` syscall # You may want to set this to `true` if not using coverage tooling on # compiled code LockPersonality = false; </ins> }; }; };

Related discussion:
text: I understand that NixOS developers are super keen on hardening, which is generally good, but for certain applications I just don't think it makes sense to go over the top... or even provide "curated" selections behind 'enableHardening' type flags. CI software is so broad I think we're providing more trouble and confusion than value here. My personal recommendation for this specific module is to follow what suggested as a reasonable default and let users decide any hardening they want for themselves. But I'm not the maintainer of this module in NixOS, just a user, so I defer to those who are volunteering their time to maintain this module :bowing_man:
PR to fix is here: Mentions do not generate notifications, just making a comment so that anyone subscribed to this issue gets a notification.
Code change:
setupHook = writeText "setupHook.sh" '' addCoqPath () { if test -d "''$1/lib/coq/${coq-version}/user-contrib"; then <del> export COQPATH="''${COQPATH}''${COQPATH:+:}''$1/lib/coq/${coq-version}/user-contrib/" </del> <ins> export COQPATH="''${COQPATH-}''${COQPATH:+:}''$1/lib/coq/${coq-version}/user-contrib/" </ins> fi }

Related discussion:
text: Describe the bug Shell with and will fail to start with a following message: This is an issue because depends on so they would be always included to the shell started by nix-review. I noticed this issue while reviewing . I suspect this is caused by . To Reproduce Steps to reproduce the behavior: This does not reproduce on release-19.09 Expected behavior Shell will start, shell prompt will appear. Metadata Please run and paste the result. Maintainer information: cc
I'm getting "CLASSPATH: unbound variable" since updating master an hour ago from last Sunday, and reports "JAVA_HOME: unbound variable" started happening while working on eleven hours ago.