jiebi/CodeConvo huggingface dataset:
Change:
In line of the nextcloud nixos module the current default is nextcloud 19. On the one hand, this is not represented in the documentation. On the other, this yields the error that there are unpatched security issues.
Retroactively changing the default on 20.09 is not just a breaking change, but effectively breaks the upgrade path from 20.03: the problem with Nextcloud (and the main reason for this complex package-selection thing) is that they don't support upgrades across multiple major releases (i.e. you can't go from v18 to v20). The whole point of this option is that one can install an arbitrary Nextcloud version while we (as maintainers) can set "conservative" defaults for working upgrade paths. In your case it would be sufficient to set . Regarding CVE-2020-8259 and CVE-2020-8152: both vulnerabilities affect the encryption module which is turned off by default (IIRC it can only be enabled in the admin UI anyways). It's unfortunate that Nextcloud upstream doesn't care about older yet still active majors and rates security issues as "Low" even though the CVEs are rated as "High" by e.g. NIST, but that's where we are. In other words: if you don't use the affected features it's still OK to use (which can be allowed by setting .
I see your point, thanks. The issue is that I, as a user, install Nextcloud and see a security warning. Given the above, maybe the message could state that you may use the option and use nextcloud20. Would that be feasible? Or given the fact that 21.03 is 'around the corner' would it be worth it?
why did you mark this as security-relevant? Both CVEs in question are disclosed by upstream and will warn about them by default. This is merely an issue with documentation and helpful warnings IMHO.
The issue seems to be about undocumented path towards using nextcloud while staying secure
Yes, it's about documentation, no immediate action is pending to fix a security issue! Nextcloud versions with known vulnerabilities yield an evaluation error, this is primarily about suggesting what to do if one stumbles upon this.

Discussion:
<link linkend="opt-services.nextcloud.enable">services.nextcloud</link>. A desktop client is packaged at <literal>pkgs.nextcloud-client</literal>. </para> <ins> <para> The current default by NixOS is <package>nextcloud20</package> which is also the latest major version available. </para> </ins> <section xml:id="module-services-nextcloud-basic-usage"> <title>Basic usage</title>

nextcloud17 = generic { version = "17.0.x"; sha256 = "0000000000000000000000000000000000000000000000000000"; <del> insecure = true; </del> <ins> eol = true; </ins> }; }</programlisting> </para>

version = "19.0.6"; sha256 = "sha256-pqqIayE0OyTailtd2zeYi+G1APjv/YHqyO8jCpq7KJg="; extraVulnerabilities = [ <del> "Nextcloud 19 is still supported, but CVE-2020-8259 & CVE-2020-8152 are unfixed!" </del> <ins> "Nextcloud 19 is still supported, but CVE-2020-8259 & CVE-2020-8152 are unfixed! Please note that both CVEs only affect the file encryption module which is turned off by default. Alternatively, `pkgs.nextcloud20` can be used." </ins> ]; };
Change:
Context When you're doing photography you might shoot in raw format. A file which contains the raw data of the image sensor captured that image. The current problem is: When you insert an sd card with raw images you don't see any previews in (didn't checked kde file manager). Solution I'd like to have a NixOS option to enable raw thumbnail support. Normally is used to accomplish that task. Since the package is broken I started adding since it seems to be the (see ) I guess the part currently missing is to create a thumbnailer entry which could be used for nautilus to create these thumbnail previews which I'm currently unsure how to implement.
Fixed with To enable raw thumbnails just add to your . For you need to ensure that you increase the size thumbnails are created for.

Discussion:
"/share/kservicetypes5" "/share/kxmlgui5" "/share/systemd" <ins> "/share/thumbnailers" </ins> ]; system.path = pkgs.buildEnv {

<ins> { stdenv , fetchurl , lib , autoreconfHook , bzip2 , cfitsio , exiv2 , gettext , gtk2 , gtkimageview , lcms2 , lensfun , libjpeg , libtiff , perl , pkg-config , zlib , addThumbnailer ? false }: stdenv.mkDerivation rec { pname = "nufraw"; version = "0.43-3"; src = fetchurl { url = "mirror://sourceforge/nufraw/nufraw-${version}.tar.gz"; sha256 = "0b63qvw9r8kaqw36bk3a9zwxc41h8fr6498indkw4glrj0awqz9c"; }; nativeBuildInputs = [ autoreconfHook gettext perl pkg-config ]; buildInputs = [ bzip2 cfitsio exiv2 gtk2 gtkimageview lcms2 lensfun libjpeg libtiff zlib ]; configureFlags = [ "--enable-contrast" "--enable-dst-correction" ]; postInstall = lib.optionalString addThumbnailer '' mkdir -p $out/share/thumbnailers substituteAll ${./nufraw.thumbnailer} $out/share/thumbnailers/${pname}.thumbnailer ''; meta = with stdenv.lib; { homepage = "https://nufraw.sourceforge.io/"; description = "Utility to read and manipulate raw images from digital cameras"; longDescription = '' A new version of the popular raw digital images manipulator ufraw. Forks from the version 0.23 of ufraw (that's why the first nufraw version is the 0.24). Nufraw offers the same features (gimp plugin, batch, ecc) and the same quality of ufraw in a brand new improved user interface. ''; license = licenses.gpl2Plus; maintainers = with maintainers; [ asbachb ]; platforms   = [ "x86_64-linux" "i686-linux" ]; }; } </ins>

<ins> [Thumbnailer Entry] TryExec=@out@/bin/nufraw-batch Exec=@out@/bin/nufraw-batch --silent --size %s --out-type=png --noexif --output=%o --embedded-image %i MimeType=image/x-canon-cr2;image/x-canon-crw;image/x-minolta-mrw;image/x-nikon-nef;image/x-pentax-pef;image/x-panasonic-rw2;image/x-panasonic-raw2;image/x-samsung-srw;image/x-olympus-orf;image/x-sony-arw </ins>

muchsync = callPackage ../applications/networking/mailreaders/notmuch/muchsync.nix { }; <ins> nufraw = callPackage ../applications/graphics/nufraw/default.nix { }; nufraw-thumbnailer = callPackage ../applications/graphics/nufraw/default.nix { addThumbnailer = true; }; </ins> notmuch-addrlookup = callPackage ../applications/networking/mailreaders/notmuch-addrlookup { }; nova-filters =  callPackage ../applications/audio/nova-filters { };
Change:
Add XOAUTH2 plugin to cyrus sasl suite of auth mechanisms adding a plugin to cyrussasl Let's add for example this plugin to the list of authentication mechanisms. One example use case is to allow mbsync (isync) to authenticate against outlook office365's IMAP server, or Google's. As mentions: So there's a trick to make the plugin auto-discovered, I can see some options: “augment” the cyrussasl package with extra entries in the dev output (sort of clunky) create a stable entry under to group all plugin libs Metadata homepage URL: source URL: license: MIT platforms: linux, darwin, ...
Second this. A simple cannot do the trick because will look for . Can we override this with using, say, a patch to the original package?
In the meantime, I use the following hack to get plugin working for now: a copy of since it is a dependency of plugin plugin (I use ) an overlay of with libraries symlinking to : This hack is not ideal (has to build a separate just for building library). But it gets the job done.
~ do you have a link to a full setup? Or do you remember what are you using for~ ? edit: remove question add link
cyrus sasl has a SASL_PATH environment variable for specifying a colon separated list of directories to search for plugins. I don't know if this is the best way, but I've put the following in an overlay, and other than having to compile the cyrus-sasl-xoauth2 plugin, nothing else needs to be build:
looks to be working, I've used it to glue in XOAUTH2 plugin from to , so KMail can receive mail from Gmail: It probably should propagate somehow from .
Here's the full overlay i use, based on the example above, including compilation of : In combination with this enables in mbsync!
Hey I've been following this issue for a while but don't really see how I'd setup my config to use xoauth2 with the updates from Are there any docs/examples on using the new setup? Or another issue to follow?
I use this in a wrapper of /, as can be seen in . It would be good idea to integrate this directly into expression, as parameter. I'll look at that.

Discussion:
<ins> { lib, stdenv, fetchFromGitHub, autoconf, libtool, automake, cyrus_sasl }: stdenv.mkDerivation rec { pname = "cyrus-sasl-xoauth2"; version = "0.2"; src = fetchFromGitHub { owner = "moriyoshi"; repo = "cyrus-sasl-xoauth2"; rev = "v${version}"; sha256 = "sha256-lI8uKtVxrziQ8q/Ss+QTgg1xTObZUTAzjL3MYmtwyd8="; }; nativeBuildInputs = [ autoconf libtool automake ]; buildInputs = [ cyrus_sasl ]; preConfigure = "./autogen.sh"; configureFlags = [ "--with-cyrus-sasl=${placeholder "out"}" ]; meta = with lib; { homepage = "https://github.com/moriyoshi/cyrus-sasl-xoauth2"; description = "XOAUTH2 mechanism plugin for cyrus-sasl"; platforms = platforms.unix; license = licenses.mit; maintainers = with lib.maintainers; [ wentasah ]; }; } </ins>

openssl = openssl_1_1; }; <ins> cyrus-sasl-xoauth2 = callPackage ../development/libraries/cyrus-sasl-xoauth2 { }; </ins> # Make bdb5 the default as it is the last release under the custom # bsd-like license db = db5;
Change:
Describe the bug Bash kernel for Jupyter does not build: To Reproduce Steps to reproduce the behavior: Notify maintainers Metadata Maintainer information:

Discussion:
buildPythonPackage rec { pname = "bash_kernel"; <del> version = "0.7.1"; </del> <ins> version = "0.7.2"; </ins> format = "flit"; disabled = isPy27; src = fetchPypi { inherit pname version; <del> sha256 = "1s2kc7m52kq28b4j1q3456g5ani6nmq4n0rpbqi3yvh7ks0rby19"; </del> <ins> sha256 = "0w0nbr3iqqsgpk83rgd0f5b02462bkyj2n0h6i9dwyc1vpnq9350"; </ins> }; patches = [
Change:
Describe the bug Here are the current assertion messages are all simple statement. They don't tell you why the assertion has been triggered and what to do. I'd prefer
I wasn't sure if someone else was already taking care of this, but it's a simple fix, so I submitted a PR for it.

Discussion:
assertions = [ { assertion = cfg.pulse.enable -> !config.hardware.pulseaudio.enable; <del> message = "PipeWire based PulseAudio server emulation replaces PulseAudio"; </del> <ins> message = "PipeWire based PulseAudio server emulation replaces PulseAudio. This option requires `hardware.pulseaudio.enable` to be set to false"; </ins> } { assertion = cfg.jack.enable -> !config.services.jack.jackd.enable; <del> message = "PipeWire based JACK emulation doesn't use the JACK service"; </del> <ins> message = "PipeWire based JACK emulation doesn't use the JACK service. This option requires `services.jack.jackd.enable` to be set to false"; </ins> } ];
Change:
EDIT: I am also getting this now trying to build in CI under Linux To Reproduce Screenshots Notify maintainers <!-- Please @ people who are in the list of the offending package or module. If in doubt, check for whoever last touched something. -- Metadata Maintainer information:
Looks like this is also similar to and and
As I mentioned in the audiofile ticket, my attempted workaround is this: However this doesn't appear to work because the .la files are not generated by the time of the preBuild hook. Can anyone help with this?
This issue has been mentioned on NixOS Discourse. There might be relevant details there:
I marked this as stale due to inactivity. &rarr;

Discussion:
}; enableParallelBuilding = true; <del> inherit enableMultilib; </del> <ins> inherit enableMultilib enableShared; </ins> inherit (stdenv) is64bit;

, profiledCompiler ? false , langJit ? false , staticCompiler ? false <del> , # N.B. the defult is intentionally not from an `isStatic`. See # https://gcc.gnu.org/install/configure.html - this is about target # platform libraries not host platform ones unlike normal. But since # we can't rebuild those without also rebuilding the compiler itself, # we opt to always build everything unlike our usual policy. enableShared ? true </del> <ins> , enableShared ? !stdenv.targetPlatform.isStatic </ins> , enableLTO ? !stdenv.hostPlatform.isStatic , texinfo ? null , perl ? null # optional, for texi2pod (then pod2man); required for Java

, profiledCompiler ? false , langJit ? false , staticCompiler ? false <del> , # N.B. the defult is intentionally not from an `isStatic`. See # https://gcc.gnu.org/install/configure.html - this is about target # platform libraries not host platform ones unlike normal. But since # we can't rebuild those without also rebuilding the compiler itself, # we opt to always build everything unlike our usual policy. enableShared ? true </del> <ins> , enableShared ? !stdenv.targetPlatform.isStatic </ins> , enableLTO ? !stdenv.hostPlatform.isStatic , texinfo ? null , flex

, profiledCompiler ? false , langJit ? false , staticCompiler ? false <del> , # N.B. the defult is intentionally not from an `isStatic`. See # https://gcc.gnu.org/install/configure.html - this is about target # platform libraries not host platform ones unlike normal. But since # we can't rebuild those without also rebuilding the compiler itself, # we opt to always build everything unlike our usual policy. enableShared ? true </del> <ins> , enableShared ? !stdenv.targetPlatform.isStatic </ins> , enableLTO ? !stdenv.hostPlatform.isStatic , texinfo ? null , perl ? null # optional, for texi2pod (then pod2man)

}; enableParallelBuilding = true; <del> inherit enableMultilib; </del> <ins> inherit enableShared enableMultilib; </ins> inherit (stdenv) is64bit;

moveToOutput "${targetConfig+$targetConfig/}lib/lib*.dll.a" "${!outputLib}" moveToOutput "share/gcc-*/python" "${!outputLib}" <ins> if [ -z "$enableShared" ]; then moveToOutput "${targetConfig+$targetConfig/}lib/lib*.a" "${!outputLib}" fi </ins> for i in "${!outputLib}/${targetConfig}"/lib/*.{la,py}; do substituteInPlace "$i" --replace "$out" "${!outputLib}" done
Change:
Describe the bug libbladeRF fails to build on the nixos-unstable channel and latest master: Notify maintainers <!-- Please @ people who are in the list of the offending package or module. If in doubt, check for whoever last touched something. --
Cannot reproduce this in master. I am on . Was this fixed in ?
I have just tried on , here is a full log:
Can also confirm that the build fails on .
This appears to me a genuine error in the source. Live bladerf1.c:841 (and also bladerf2.c:283) reference , but it should be . With , we stop the build on purpose. Luckily the typo is not of further consequence, since both values are numerically the same (both zero). I will try to report this to upstream.
Oh nice, this has already been fixed in upstream master (in from last May to be precise), but there isn't yet a new release containing a fix. I'll prepare a pull request cherrypicking this patch. Be aware though that I cannot test libbladeRF (in fact I don't even know what it is about :-)).
maybe also add . This options is meant for development where there is control over the compiler, but in nixpkgs we want to update gcc without breaking half the packages due to warnings.
I see, thank you for the suggestion! Generally I'm in favor of , but your argument is quite reasonable. I'll force-push in a second.

Discussion:
<del> { stdenv, lib, fetchFromGitHub, pkgconfig, cmake, git, doxygen, help2man, ncurses, tecla </del> <ins> { stdenv, lib, fetchFromGitHub, fetchpatch, pkgconfig, cmake, git, doxygen, help2man, ncurses, tecla </ins> , libusb1, udev }: let

sha256 = "0g89al4kwfbx1l3zjddgb9ay4mhr7zk0ndchca3sm1vq2j47nf4l"; }; <ins> # This patch is required for version 2.2.1. As the patch is already part of # upstream master, it will be incorporated into the next release. The patch # fixes a (well-justified) compiler warning which breaks the build because # we compile with -Werror. patches = [ (fetchpatch { url = "https://github.com/Nuand/bladeRF/commit/163425d48a3b7d8c100d7295220d3648c050d0dd.patch"; sha256 = "1swsymlyxm3yk2k8l71z1fv0a5k2rmab02f0c7xkrvk683mq6yxw"; }) ]; </ins> nativeBuildInputs = [ pkgconfig ]; # ncurses used due to https://github.com/Nuand/bladeRF/blob/ab4fc672c8bab4f8be34e8917d3f241b1d52d0b8/host/utilities/bladeRF-cli/CMakeLists.txt#L208 buildInputs = [ cmake git doxygen help2man tecla libusb1 ]
Change:
Describe the bug fails to build on latest master. Notify maintainers <!-- Please @ people who are in the list of the offending package or module. If in doubt, check for whoever last touched something. --
It seems like git-annex-metadata-gui is incompatible with the JSON interface of the most recent version of git-annex. You should file an upstream issue and then we could mark the package as broken in Nixpkgs. I doubt this will be fixed since is not working on git-annex-metadata-gui anymore.
Thanks for mentioning me, I wasn't aware. Looks like the tests broke again because they check git-annex behaviour too strictly, but things actually still work. Should be fixed with (pushed to master).
Thanks a lot

Discussion:
<del> { lib, stdenv, buildPythonPackage, isPy3k, fetchFromGitHub, substituteAll </del> <ins> { lib, stdenv, buildPythonPackage, isPy3k, fetchFromGitHub, fetchpatch, substituteAll </ins> , python, util-linux, pygit2, gitMinimal, git-annex, cacert }:

}; patches = [ <ins> # fix tests with recent versions of git-annex (fetchpatch { url = "https://github.com/alpernebbi/git-annex-adapter/commit/6c210d828e8a57b12c716339ad1bf15c31cd4a55.patch"; sha256 = "17kp7pnm9svq9av4q7hfic95xa1w3z02dnr8nmg14sjck2rlmqsi"; }) </ins> (substituteAll { src = ./git-annex-path.patch; gitAnnex = "${git-annex}/bin/git-annex";
Change:
Describe the bug nomad cannot currently be installed on darwin on nixpkgs-unstable To Reproduce Steps to reproduce the behavior: nixpkgs on darwin Expected behavior Nomad is installed Screenshots Notify maintainers <!-- Please @ people who are in the list of the offending package or module. If in doubt, check for whoever last touched something. --Metadata Please run and paste the result. system: host os: multi-user?: sandbox: version: channels(root): channels(sirn): nixpkgs: Maintainer information:

Discussion:
nomad_0_11 = callPackage ../applications/networking/cluster/nomad/0.11.nix { buildGoPackage = buildGo114Package; inherit (linuxPackages) nvidia_x11; <del> nvidiaGpuSupport = config.cudaSupport or (!stdenv.isLinux); </del> <ins> nvidiaGpuSupport = config.cudaSupport or false; </ins> }; nomad_0_12 = callPackage ../applications/networking/cluster/nomad/0.12.nix { buildGoPackage = buildGo114Package; inherit (linuxPackages) nvidia_x11; <del> nvidiaGpuSupport = config.cudaSupport or (!stdenv.isLinux); </del> <ins> nvidiaGpuSupport = config.cudaSupport or false; </ins> }; nomad_1_0 = callPackage ../applications/networking/cluster/nomad/1.0.nix { buildGoPackage = buildGo115Package; inherit (linuxPackages) nvidia_x11; <del> nvidiaGpuSupport = config.cudaSupport or (!stdenv.isLinux); </del> <ins> nvidiaGpuSupport = config.cudaSupport or false; </ins> }; notable = callPackage ../applications/misc/notable { };
Change:
Describe the bug tensorflow-bin_2 wants gast-3.2.0 due to but gast has been updated to 3.3.0 so tensorflow refuses to install: To Reproduce Notify maintainers Metadata Maintainer information:
There are also other dependencies that fail the version checks: scipy==1.4.1 and tensorflow-estimator<2.2.0,=2.1.0rc0.
This compiles i'll test it, any feedback appreciated
Got some issues
This issue has been mentioned on NixOS Discourse. There might be relevant details there:
Related .
It looks like fixes this.

Discussion:
{ lib <ins> , stdenv </ins> , buildPythonPackage , fetchPypi , click

pytestCheckHook ]; <ins> disabledTests = lib.optionals stdenv.isDarwin [ "test_run_local_server" ]; </ins> meta = with lib; { description = "Google Authentication Library: oauthlib integration"; homepage = "https://github.com/GoogleCloudPlatform/google-auth-library-python-oauthlib";

<del> { lib </del> <ins> { stdenv , lib </ins> , buildPythonPackage , fetchpatch , fetchPypi

"google.oauth2" ]; <ins> disabledTests = lib.optionals stdenv.isDarwin [ "test_request_with_timeout_success" "test_request_with_timeout_failure" "test_request_headers" "test_request_error" "test_request_basic" ]; </ins> meta = with lib; { description = "Google Auth Python Library"; longDescription = ''

<del> { lib </del> <ins> { stdenv , lib </ins> , buildPythonPackage , fetchFromGitHub , isPy27

pytestCheckHook ]; <del> # Don't run tests for Python 2.7 doCheck = !isPy27; </del> <ins> # Don't run tests for Python 2.7 or Darwin # Nearly 50% of the test suite requires local network access # which isn't allowed on sandboxed Darwin builds doCheck = !(isPy27 || stdenv.isDarwin); </ins> pytestFlagsArray = [ "--ignore python2" ]; pythonImportsCheck = [ "httplib2" ];

# Unpack the wheel file. wheel unpack --dest unpacked ./*.whl <del> # Tensorflow has a hard dependency on gast==0.2.2, but we relax it to # gast==0.3.2. substituteInPlace ./unpacked/tensorflow*/tensorflow_core/tools/pip_package/setup.py --replace "gast == 0.2.2" "gast == 0.3.2" substituteInPlace ./unpacked/tensorflow*/tensorflow_*.dist-info/METADATA --replace "gast (==0.2.2)" "gast (==0.3.2)" </del> <ins> # Tensorflow wheels tightly constrain the versions of gast, tensorflow-estimator and scipy. # This code relaxes these requirements: substituteInPlace ./unpacked/tensorflow*/tensorflow_core/tools/pip_package/setup.py  --replace "tensorflow_estimator >= 2.1.0rc0, < 2.2.0" "tensorflow_estimator"  --replace "tensorboard >= 2.1.0, < 2.2.0" "tensorboard"  --replace "gast == 0.2.2" "gast"   --replace "scipy == 1.2.2" "scipy" substituteInPlace ./unpacked/tensorflow*/tensorflow*.dist-info/METADATA   --replace "gast (==0.2.2)" "gast"  --replace "tensorflow-estimator (<2.2.0,>=2.1.0rc0)" "tensorflow_estimator"  --replace "tensorboard (<2.2.0,>=2.1.0)" "tensorboard"  --replace "scipy (==1.4.1)" "scipy" </ins> # Pack the wheel file back up. wheel pack ./unpacked/tensorflow*
Change:
Describe the bug Trying to install libfprint from unstable cause the nixos build to fail. To Reproduce Steps to reproduce the behavior: unstable channel libfprint from the unstable channel Additional Context I the log as an attachment but I think the problem is here: Metadata system: host os: multi-user?: sandbox: version: channels(davide): channels(root): nixpkgs:

Discussion:
nss ]; <ins> NIX_CFLAGS_COMPILE = "-Wno-error=array-bounds"; </ins> mesonFlags = [ "-Dudev_rules_dir=${placeholder "out"}/lib/udev/rules.d" ];