jiebi/CodeConvo huggingface dataset:
Change:
"example.com" = { webroot = "/var/www/challenges/"; email = "foo@example.com"; <del> extraDomains = { "www.example.com" = null; "foo.example.com" = "/var/www/foo/"; }; </del> <ins> extraDomains = { "www.example.com" = null; "foo.example.com" = null; }; </ins> }; "bar.example.com" = { webroot = "/var/www/challenges/";

Discussion:
introduces DNS-01 challenge support, yet states only webroot verification is supported. We should update this file, and add a section explaining how to configure DNS-01 challenges. cc
I'll try and do that tonight
I ended up rewriting the whole doc for acme, it was badly outdated and not particularly helpful. Still need to build an example for DNS-01, will try do that tomorrow.
Change:
pleroma = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./pleroma.nix {}; plikd = handleTest ./plikd.nix {}; plotinus = handleTest ./plotinus.nix {}; <ins> podgrab = handleTest ./podgrab.nix {}; </ins> podman = handleTestOn ["x86_64-linux"] ./podman.nix {}; pomerium = handleTestOn ["x86_64-linux"] ./pomerium.nix {}; postfix = handleTest ./postfix.nix {};

Discussion:
Project description Podgrab is a is a self-hosted podcast manager which automatically downloads latest podcast episodes. It is a light-weight application built using GO. It works best if you already know which podcasts you want to monitor. However there is a podcast search system powered by iTunes built into Podgrab Metadata homepage URL: source URL: license: gpl3 (I think, see about a typo) platforms: unix, I think, it's a Go package
If I have some time this week-end, I might tackle this issue myself. The repo has and files so it should be pretty easy for a first contribution :-)
So I'm having issues with the package's tests, I have opened an upstream issue to discuss it.
Change:
- The Invoiceplane module now only accepts the structured `settings` option. `extraConfig` is now removed. <ins> - The `ollama` services replaces its `sandbox` toggle with options to configure a static `user` and `group`. The `writablePaths` option has been removed and the models directory is now always exempt from sandboxing. </ins> - Legacy package `stalwart-mail_0_6` was dropped, please note the [manual upgrade process](https://github.com/stalwartlabs/mail-server/blob/main/UPGRADING.md) before changing the package to `pkgs.stalwart-mail` in

Discussion:
this commit makes my NVIDIA GeForce RTX 3090 no longer visible to ollama: needs to be revisited, or add optional flag to disable hardening (which i don't really need since I dont expose ollama over internet). when running through systemd: when running :
Can you check , and try adding these strings, prefixed with to ? For me on NixOS 24.05 they show and the module currently allows the following device types:
Just upgraded to the unstable module and package and things are still looking fine. The only nvidia related config I have is
, will try later when I get back home. Not sure if related but I'm on nvidia as the newer versions are broken in one way or another (wayland/performance regressions/pytorch issues).
You can also try nuking the DevicePolicy altogether if the suggestions above do not work: = { DeviceAllow = lib.mkForce [ ]; DevicePolicy = lib.mkForce "auto"; };
was the missing piece: +
--------+ |-----------------------------------------+----------------------+----------------------+ +-----------------------------------------+----------------------+----------------------+
thanks for your support!
Feel free to send a PR to add it to the module. Thanks for looking into this!
some additional findings, nvidia device group names are definitely driver version dependent, this is what I get on 555 ( is gone):
Change:
"--without-ca-path" ] ++ lib.optionals (!gnutlsSupport && !opensslSupport && !wolfsslSupport && !rustlsSupport) [ "--without-ssl" <ins> ] ++ lib.optionals (gnutlsSupport && !stdenv.isDarwin) [ "--with-ca-path=/etc/ssl/certs" </ins> ]; CXX = "${stdenv.cc.targetPrefix}c++";

Discussion:
Since 8.5.0, curl compiled with gnutls cannot resolve domains as it cannot find the certificate store. Steps to reproduce the behavior: (latest nixos-unstable) Verify certificates Works ok on 8.4.0 in nixpkgs. Last working on nixos-unstable. Add any other context about the problem here. This diff is a quick fix, but I'm not sure if this is the best solution. I didn't bisect curl but this appears to be the likely commit introduced in 8.5.0: <!-- Please @ people who are in the list of the offending package or module. If in doubt, check for whoever last touched something. --Please run and paste the result. Add a :+1: [reaction] to [issues you find important]. [reaction]: [issues you find important]:
Change:
outputs = [ "out" "dev" ]; src = fetchFromGitHub { <del> owner  = "intel"; repo   = "media-driver"; rev    = "intel-media-${version}"; </del> <ins> owner = "intel"; repo = "media-driver"; rev = "intel-media-${version}"; </ins> sha256 = "1ch1bvqg6p0i7ahblhy0h9c43y2mfhqb25v1s344iqsrywwcpzzr"; }; <ins> patches = [ # fix platform detection (fetchpatch { url = "https://salsa.debian.org/multimedia-team/intel-media-driver-non-free/-/raw/master/debian/patches/0002-Remove-settings-based-on-ARCH.patch"; sha256 = "sha256-f4M0CPtAVf5l2ZwfgTaoPw7sPuAP/Uxhm5JSHEGhKT0="; }) ]; </ins> cmakeFlags = [ "-DINSTALL_DRIVER_SYSCONF=OFF" "-DLIBVA_DRIVERS_PATH=${placeholder "out"}/lib/dri"

Discussion:
The build of fails on i686. Fails with: Found with Please run and paste the result. Maintainer information:
if you don't ping any maintainer likely nothing will happen ping
I think I never tried compiling intel-media-driver on i686 but only fixed an eval error in nixGL. The problem seems to be that it compiles 64 bit code on 32 bit.
I did a quick look what other distros do and found this helpful Debian patch () at least fixes. There are still some other compile errors that need fixing. Edit1: and with it compiles
Change:
meta = with stdenv.lib; { description = "An open source MQTT v3.1/3.1.1 broker"; <del> homepage = http://mosquitto.org/; </del> <ins> homepage = "https://mosquitto.org/"; </ins> license = licenses.epl10; maintainers = with maintainers; [ peterhoeg ]; platforms = platforms.unix;

Discussion:
libwebsockets 3.2.0 changed its behaviour in a way that breaks all versions of Mosquitto that use websockets, resulting in incoming connections being intermittent and very slow. It is fixed in their repository and will be in the next release presumably, but for now 3.2.0 is no good. If Mosquitto is the only other package using libwebsockets, I would suggest downgrading to 3.1.0, which behaves fine. Mosquitto 1.6.5, which should be released today, will refuse to compile with libwebsockets 3.2.0.
cc
mosquitto 1.6.5 fixes it - just haven't packaged it yet.
Mosquitto 1.6.5 does not fix this. There is a changelog entry which was written prior to this issue that is probably why you think it does have the fix. Sorry about that, I changed the changelog on the website post but not in the repo. The only fix for this is in libwebsockets itself.
it's pretty awesome having upstream providing proactive updates like this - much appreciated!
Change:
${pkgs.move-mount-beneath}/bin/move-mount --move --beneath $tmpEtcMount /etc # Unmount the top /etc mount to atomically reveal the new mount. <del> umount --recursive /etc </del> <ins> umount --lazy --recursive /etc </ins> fi '' else '' # Set up the statically computed bits of /etc.

Discussion:
I set and rebooted, all went fine. When rebuilding and switching though, I get this error and I still have the old etc: <!-- Please @ people who are in the list of the offending package or module. If in doubt, check for whoever last touched something. --Please run and paste the result. Add a :+1: [reaction] to [issues you find important]. [reaction]: [issues you find important]:
Change:
<del> { lib, stdenv, fetchurl, libgpgerror, enableCapabilities ? false, libcap }: </del> <ins> { stdenv, fetchurl, libgpgerror, enableCapabilities ? false, libcap }: </ins> assert enableCapabilities -> stdenv.isLinux;

Discussion:
Cannot build libgcrypt (or libgpg-error not quite sure which is to blame) on darwin due to optimization level -O2 on latest staging. This probably exists on other systems as well. Update to latest staging, try to nix-env -p libgcrypt. On 10.12 I get the following: I tried setting CFLAGS = "-O0" in the definition but I can't seem to get over what appears to be hardening flags setting -O2. I'm not sure how this could ever build in those circumstances. Curious how I can override CFLAGS for this package to work around this? System: (NixOS: , Ubuntu/Fedora: , ...) $ swvers ProductName: Mac OS X ProductVersion: 10.12.6 BuildVersion: 16G29 Nix version: (run ) nix-env (Nix) 1.11.9 Nixpkgs version: (run ) "17.09pre-git" Sandboxing enabled: (run ) n/a
Sounds like the hardening flags. I think should do it or something like that.
Yep, your suggestion in irc worked. Should I submit a pr for it to staging? Or should I constrain it only to darwin? I don't quite see how it would work on any other system given the pragma if -O2 is passed into the derivation.
Seems like an instance of
the way I read the error it's due to clang not understanding the pragma, i.e., it would work if you had used gcc.
probably but gcc doesn't always run/build on OSX. And if someone tried building things with clang on other platforms it presumably would trigger there as well. Perhaps a predicate of if not gcc disable hardening?
clang generally can handle hardening, too, this is a very niche case.
Maybe a patch like so (untested so far):
Change:
, glib-networking , libadwaita , appstream <ins> , blueprint-compiler </ins> }: python3.pkgs.buildPythonApplication rec { pname = "giara"; <del> version = "1.0"; </del> <ins> version = "1.0.1"; </ins> format = "other";

Discussion:
giara fails to start but merely prints a python backtrace. Steps to reproduce the behavior: $ or add "" to and rebuild the system $ giara Start up the graphical reddit client. Add any other context about the problem here.
Thanks for reporting and sorry for the answering delay. I have looked into it and there is no easy fix for version 1.0 and version 1.0.1 requires a new dependency which is not yet in nixpkgs. I'll take a second look at it when time allows.
Yeah, the package requires an older version of libadwaita. And 1.0.1 requires
Change:
(substituteAll { src = ./library-paths.patch; libgeos_c = GEOS_LIBRARY_PATH; <del> libc = "${stdenv.cc.libc}/lib/libc${stdenv.hostPlatform.extensions.sharedLibrary}" + stdenv.lib.optionalString (!stdenv.isDarwin) ".6"; </del> <ins> libc = stdenv.lib.optionalString (!stdenv.isDarwin) "${stdenv.cc.libc}/lib/libc${stdenv.hostPlatform.extensions.sharedLibrary}.6"; </ins> }) ];

Discussion:
Describe the bug python38Packages.shapely does not build for me on darwin. It looks like the previous release, 1.7.0, did build on hydra (). I'm not sure if this is a difference depending on the version of shapely or on the version of macosx. To Reproduce Failure It looks like this store path is specifically being by a nixpkgs patch, but that the patch refers to a file that doesn't exist. Additional context The're no here: Notify maintainers Metadata
Ah, it's broken on hydra too, so it's not just me:
I think it's possible that the regression is related to how interact with
Change:
systemd.services.update-locatedb = { description = "Update Locate Database"; path = mkIf (!isMLocate) [ pkgs.su ]; <ins> # mlocate's updatedb takes flags via a configuration file or # on the command line, but not by environment variable. </ins> script = <ins> if isMLocate then let toFlags = x: optional (cfg.${x} != []) "--${lib.toLower x} '${concatStringsSep " " cfg.${x}}'"; args = concatLists (map toFlags ["pruneFS" "pruneNames" "prunePaths"]); in '' exec ${cfg.locate}/bin/updatedb  --output ${toString cfg.output} ${concatStringsSep " " args}  --prune-bind-mounts ${if cfg.pruneBindMounts then "yes" else "no"}  ${concatStringsSep " " cfg.extraFlags} </ins> '' <ins> else '' </ins> exec ${cfg.locate}/bin/updatedb  ${optionalString (cfg.localuser != null && ! isMLocate) ''--localuser=${cfg.localuser}''}  --output=${toString cfg.output} ${concatStringsSep " " cfg.extraFlags} ''; <del> environment = { </del> <ins> environment = optionalAttrs (!isMLocate) { </ins> PRUNEFS = concatStringsSep " " cfg.pruneFS; PRUNEPATHS = concatStringsSep " " cfg.prunePaths; PRUNENAMES = concatStringsSep " " cfg.pruneNames;

Discussion:
It seems that has no effect, even when using . the following to and : to rebuild locatedb (assuming you have the nixpkgs repo somewher) Expected: Files in directories are pruned. Actual: Files in directories are present in the result. I was able to work around the issue by using instead of using ; that seems to work as expected. From brief experiments running directly, it seems that the env var doesn't do anything (contrary to the documentation), so this may be an upstream bug. System: 17.03.1820. (Gorilla) Nix version: nix-env (Nix) 1.11.14 Nixpkgs version: "17.03.1820." Sandboxing enabled: false
Change:
nvim-client luv coxpcall busted luafilesystem penlight inspect ] )); <ins> codegenLua = if lua.pkgs.isLuaJIT then let deterministicLuajit = lua.override { deterministicStringIds = true; self = deterministicLuajit; }; in deterministicLuajit.withPackages(ps: [ ps.mpack ps.lpeg ]) else lua; </ins> pyEnv = python3.withPackages(ps: with ps; [ pynvim msgpack ]); in

Discussion:
Building this package twice does not produce the bit-by-bit identical result each time, making it harder to detect CI breaches. You can read more about this at https://reproducible- . Fixing bit-by-bit reproducibility also has additional advantages, such as avoiding hard-to-reproduce bugs, making content-addressed storage more effective and reducing rebuilds in such systems. You can use to analyze the differences in the output of the two builds. To view the build log of the build that produced the artifact in the binary cache: Looks like symbol ordering differences:
Change:
{ mkXfceDerivation <ins> , gobject-introspection </ins> , dbus-glib , garcon , glib

Discussion:
Apparently there's a problem with wrapped command. When try to configure my screensaver (e.g. slideshow), it won't open. Opening it via terminal returns nothing. The command itself points to /nix/store/hash-xfce4-screensaver-version/bin/.xfce4-screensaver-configure-wrapped. Its a python script, but interpreter is set as #!/usr/bin/python3, which is obviously not available on nixos. Steps to reproduce the behavior: Configuration program should open ! strace output:
Does help?
Thanks, now it works. Shall i close the issue or wait for PR?
Change:
, python3 , qtxmlpatterns , qwt <ins> , wrapQtAppsHook </ins> }: let

Discussion:
Package name: gplates Latest released version: 2.4 Current version on the unstable channel: 2.3 Current version on the stable/release channel: 2.3 Notify maintainers Note for maintainers: Please tag this issue in your PR. Add a :+1: [reaction] to [issues you find important]. [reaction]: [issues you find important]:
Change:
''; environment.systemPackages = [ pkgs.nixos-container ]; <ins> boot.kernelModules = [ "bridge" "macvlan" "tap" "tun" ]; </ins> }); }

Discussion:
Container start fails with privateNetwork = true; Does start when sharing host network.
I cannot reproduce this on my system with same nixos revision and your container config from above. Container starts and networking looks fine. Does your system have any kind of special network setup?
Whole config below : Only things that look interesting to me are virtualbox and perhaps the rkt service.
Ok, found the cause, was the hardened profile. Perhaps bpf is needed for virtual ethernet, will investigate some more.
Thanks. I never tried containers with the hardened profile. Will look into it.
Don't understand why yet, but adding to the host config seems to fix it. Hardened profile sets this to by default. please check if this works for you.
confirmed after a reboot.
I think a better solution will be to have the container module load all kernel modules required for private networking at boot time. Let's keep the issue open while I give that a try.
ping ;)
Module locking is quite heavy-handed. Loading all required modules before the lock is engaged is indeed the correct fix, if locking is desired.
Adding seems to fix the issue. I see that at least and is working, but am not sure about other things.
makes sense to me. If you care to, I'd be happy to integrate a PR to that effect.
Hello ! I stumbled upon this issue while trying to add a container with a private network, so I'm not sure this issue is resolved: I still had to add as suggested, which fixed the container startup.
Same here, still...
Change:
, xmlschema , setuptools , packaging <ins> , cvss , google-cloud-sdk , pip , testers , cve-bin-tool # pinned packaging , pyparsing , fetchPypi , buildPythonPackage , pretend , pythonOlder </ins> }: <ins> let # pin packaging to < 22 until issue related to https://github.com/intel/cve-bin-tool/pull/2436 are resolved by upstream (post-3.2) packaging_21_3 = buildPythonPackage rec { inherit (packaging) pname passthru meta; version = "21.3"; format = "pyproject"; disabled = pythonOlder "3.6"; src = fetchPypi { inherit pname version; sha256 = "sha256-3UfEKSfYmrkR5gZRiQfMLTofOLvQJjhZcGQ/nFuOz+s="; }; nativeBuildInputs = [ setuptools ]; propagatedBuildInputs = [ pyparsing ]; nativeCheckInputs = [ pytestCheckHook pretend ]; doCheck = false; }; in </ins> buildPythonApplication rec { pname = "cve-bin-tool"; <del> version = "3.1.2"; </del> <ins> version = "3.2"; </ins> src = fetchFromGitHub { owner = "intel"; repo = "cve-bin-tool"; rev = "refs/tags/v${version}"; <del> sha256 = "sha256-P2GhGQxa6Y8BmMqFHXSfmqN58E1FbXD9Ndwwr+upK8Q="; </del> <ins> hash = "sha256-QOnWt6iit0/F6d/MfZ8qJqDuT3IHh0Qjs6BcJkI/CBw="; </ins> }; <ins> patches = [ # Not needed as python dependency, should just be on the PATH ./no-gsutil-python-dependency.patch # Already merged upstream, to be removed post-3.2 # https://github.com/intel/cve-bin-tool/pull/2524 (fetchpatch { name = "cve-bin-tool-version-success.patch"; url = "https://github.com/intel/cve-bin-tool/commit/6f9bd565219932c565c1443ac467fe4163408dd8.patch"; hash = "sha256-Glj6qiOvmvsuetXn4tysyiN/vrcOPFLORh+u3BoGzCI="; }) ]; </ins> # Wants to open a sqlite database, access the internet, etc doCheck = false; <ins> propagatedNativeBuildInputs = [ pip ]; </ins> propagatedBuildInputs = [ <ins> google-cloud-sdk </ins> jsonschema plotly beautifulsoup4

Discussion:
Trying to install (either with nix-env or nix-shell) fails. I'm not sure if this is a macOS only issue or not. Steps to reproduce the behavior: for install to fail with error: Relevant error logs: Please run and paste the result.
Change:
, qtwebengine , enableWideVine ? false , widevine-cdm <del> , enableVulkan ? stdenv.isLinux </del> <ins> # can cause issues on some graphics chips , enableVulkan ? false </ins> , vulkan-loader }:

Discussion:
Some critical graphics-related QtWebEngine problem arose after (), rendering the browser unusable (hangs completely shortly after start) on an unknown range of NixOS systems. Successfully worked it around for now with qutebrowser Reproduced on latest nixos-unstable () on a Vega 8 graphics laptop (therefore the driver is mesa's ). ! Under valgrind it crashes immediately.
I can reproduce the issue if using , but seems to work fine with . Running a 5700xt. I'd say should default to ? Otherwise lots of people will have broken setups (as I did).
This workaround in sorted it for me:
I wouldn't say mine is broken exactly, but it definitely has problems for me on i915 on Sway when Vulkan is enabled (copy/pasting freezes both qutebrowser and the app I was pasting to, right click takes a long time to register, I couldn't scroll some web pages with mouse any longer, etc) If enough other people are encountering issues, it should maybe default to false for now, but I may just be an outlier here, idk
I have all of the problems you mention. Setting seems to fix them. I'm also using sway and i915 on an i5-10210U.
Change:
{ lib , stdenv , fetchFromGitHub <ins> , fetchpatch </ins> , buildPythonPackage , rustPlatform , pkg-config

Discussion:
Ran on at . Was building my system running . While building , the dependency failed to build due to removing support for certain metadata fields in . Fix could be similar to , but I'm not well-versed in Python packaging. <!-- Please @ people who are in the list of the offending package or module. If in doubt, check for whoever last touched something. --
Change:
<listitem> <para> <emphasis>Small channels</emphasis>, such as <del> <link xlink:href="https://nixos.org/channels/nixos-22.05-small"><literal>nixos-22.11-small</literal></link> </del> <ins> <link xlink:href="https://nixos.org/channels/nixos-22.11-small"><literal>nixos-22.11-small</literal></link> </ins> or <link xlink:href="https://nixos.org/channels/nixos-unstable-small"><literal>nixos-unstable-small</literal></link>. These are identical to the stable and unstable channels

Discussion:
Note the mismatch between the text and url. [x] checked [latest Nixpkgs manual] ([source][nixpkgs-source]) and [latest NixOS manual] ([source][nixos-source]) [x] checked [open documentation issues] for possible duplicates [x] checked [open documentation pull requests] for possible solutions [latest Nixpkgs manual]: [latest NixOS manual]: [nixpkgs-source]: [nixos-source]: [open documentation issues]: [open documentation pull requests]: Change the link url to point to the channel.
Change:
<ins> diff --git a/library/grt/src/grt.h b/library/grt/src/grt.h index 47bfd63..59e664b 100644 --- a/library/grt/src/grt.h +++ b/library/grt/src/grt.h @@ -35,6 +35,7 @@ #include <stdexcept> #include <boost/function.hpp> #include <libxml/xmlmemory.h> +#include <libxml/tree.h> #include "base/threading.h" #include <string> #include <gmodule.h> diff --git a/library/grt/src/unserializer.cpp b/library/grt/src/unserializer.cpp index 6dda76d..a6f6a3c 100644 --- a/library/grt/src/unserializer.cpp +++ b/library/grt/src/unserializer.cpp @@ -401,7 +401,7 @@ ValueRef internal::Unserializer::unserialize_xmldata(const char *data, size_t si xmlDocPtr doc = xmlReadMemory(data, (int)size, NULL, NULL, XML_PARSE_NOENT); if (!doc) { -    xmlErrorPtr error = xmlGetLastError(); +    const xmlError* error = xmlGetLastError(); if (error) throw std::runtime_error(base::strfmt("Could not parse XML data. Line %d, %s", error->line, error->message)); </ins>

Discussion:
Steps to reproduce the behavior: Stumbled upon this when upgrading my NixOS flake from to No maintainers so I'll just ping the last person to touch this <!-- Please @ people who are in the list of the offending package or module. If in doubt, check for whoever last touched something. --Please run and paste the result. Add a :+1: [reaction] to [issues you find important]. [reaction]: [issues you find important]:
It broke in this PR merge Okay, the problem's with libxml2, which changed its interface a bit
Okay, I managed to fix the build, will open a PR shortly.
Thank you for writing the fix and creating the PR. Is something holding up the pull request? It's been open for over a week now.
I guess noone really reviewed the PR. I can maybe ask for a review.
I tried building mysql-workbench again today but it is still failing. Is it building properly for you? Or is it something on my end? output of
the pr that fixed this hasn't hit nixos-unstable yet, wait until it does. You can check here