diff --git a/configs/security-fixes/cve-2026-109618.nix b/configs/security-fixes/cve-2026-109618.nix deleted file mode 100644 index 1774b588..00000000 --- a/configs/security-fixes/cve-2026-109618.nix +++ /dev/null @@ -1,56 +0,0 @@ -# CVE-2026-109618, CVE-2026-109619: PHP 8.5.12, nixos-unstable still ships 8.5.11. -{ config, lib, ... }: -let - # First releases fixing CVE-2026-109618/CVE-2026-109619 per PHP branch; unknown branches use the newest fix. - phpFixed = { - "8.3" = "8.3.36"; - "8.4" = "8.4.27"; - "8.5" = "8.5.12"; - }; -in -{ - # A lock update could roll PHP back to a vulnerable release. - assertions = lib.mapAttrsToList ( - name: pool: - let - phpVersion = pool.phpPackage.version; - in - { - assertion = - lib.versionAtLeast phpVersion - phpFixed.${lib.versions.majorMinor phpVersion} or phpFixed."8.5"; - message = "phpfpm pool ${name}: PHP ${phpVersion} is vulnerable to CVE-2026-109618/CVE-2026-109619"; - } - ) config.services.phpfpm.pools; - - nixpkgs.overlays = [ - (_final: prev: { - php85 = - assert lib.assertMsg (prev.php85.version == "8.5.11") - "nixpkgs now ships php85 ${prev.php85.version}; remove configs/security-fixes/cve-2026-109618.nix"; - (prev.php85.override { - version = "8.5.12"; - hash = "sha256-/7YO3EN87WO1E35JhNs3moERxQBJxxFRDYuVgnfvwag="; - }).withExtensions - ( - { enabled, ... }: - map ( - ext: - # The new oom_filter tests run php -n, which does not load the shared filter.so. - if ext.extensionName == "filter" then - ext.override { - postConfigure = '' - substituteInPlace \ - tests/oom_filter_input.phpt \ - tests/oom_filter_input_array.phpt \ - tests/oom_filter_default_encoded.phpt \ - --replace-fail "'-n'," "'-n', '-d', 'extension=$PWD/modules/filter.so'," - ''; - } - else - ext - ) enabled - ); - }) - ]; -} diff --git a/flake.lock b/flake.lock index 94ab7d2b..441ed124 100644 --- a/flake.lock +++ b/flake.lock @@ -105,11 +105,11 @@ }, "crane": { "locked": { - "lastModified": 1791754810, - "narHash": "sha256-cN0Mgk+sQtCJcGWs9H4M0CnLRAuC4I8aCwiBTcBJs6E=", + "lastModified": 1792350552, + "narHash": "sha256-292lvpvxTGKryKxh3/3tcIVi85CwYGdl4oOi113Sob8=", "owner": "ipetkov", "repo": "crane", - "rev": "bd63bf1d0a0f6dcacd7549c714a671ee63b0db6a", + "rev": "e675a36b7377bebe41d548388a2501cbb16d380d", "type": "github" }, "original": { @@ -313,11 +313,11 @@ "uv2nix": "uv2nix" }, "locked": { - "lastModified": 1792830527, - "narHash": "sha256-UnZ1/jMaMMRROx0e+x0DezLiKNQGRAJ8/WNkxjRhAhI=", + "lastModified": 1792979649, + "narHash": "sha256-3ktMoUvgWiF+FOijFEjjenbrl7oCtOu364Fyy9mNUsg=", "owner": "nousresearch", "repo": "hermes-agent", - "rev": "bac34e9e9946c9c6a9ce7ce64efadd47f8fa375b", + "rev": "749cb638ff43f9ce5333c186a1e4f67d473aa4f2", "type": "github" }, "original": { @@ -355,11 +355,11 @@ ] }, "locked": { - "lastModified": 1792806688, - "narHash": "sha256-kn2Nk6vkUhc7CyRWH3IpVBXyB+4FNzqPK+dV7kExSME=", + "lastModified": 1792970391, + "narHash": "sha256-Rrm04dqRoPYOnrRT1URAP1/0vRG3NlOrQWRyHe1+fE4=", "owner": "numtide", "repo": "iets", - "rev": "b13ee3292685b37190cea41510d93eda226353d9", + "rev": "c54fe5c094e82316e05d77f64b1b9353b01069ad", "type": "github" }, "original": { @@ -411,11 +411,11 @@ "treefmt-nix": "treefmt-nix_3" }, "locked": { - "lastModified": 1792827236, - "narHash": "sha256-IZOPKCAPqp4C6U1qQNdOlilP3wl7PD3T81/j8ygziH0=", + "lastModified": 1792971270, + "narHash": "sha256-pvkekz4R2bbObsKIKQlTkhSw7iEdDXtrfhILxBKLQaQ=", "owner": "numtide", "repo": "llm-agents.nix", - "rev": "9934bc184f4f1e2ad253e64e6739016aa4dead07", + "rev": "0784674971b3ee4681aea5b5e9641c75faf7e846", "type": "github" }, "original": { @@ -475,11 +475,11 @@ ] }, "locked": { - "lastModified": 1792309949, - "narHash": "sha256-2DAEMk8YkV8OF6N2uw9jQ016cYoNkcgnq50AShwWxNw=", + "lastModified": 1792915725, + "narHash": "sha256-v75hPw5NJ+mRRcwUzKi2OQtVSVv1hgq6ceAlPQB2kEE=", "owner": "nix-community", "repo": "nix-index-database", - "rev": "1b4d1758fa6053c5d6284254a793134fa602fbff", + "rev": "93696586f3463024cceb089353539be95a38ae2b", "type": "github" }, "original": { @@ -599,11 +599,11 @@ }, "nixpkgs_2": { "locked": { - "lastModified": 1792502884, - "narHash": "sha256-IoNisKcGbUjdd45qCqywGMCYmZ5EnkxezvLII0FWwNA=", + "lastModified": 1792773339, + "narHash": "sha256-rZLrzrC6i+jnTAlvPZHogKDulY7WWDEv9hJeHieO7Zw=", "owner": "nixos", "repo": "nixpkgs", - "rev": "02c087f3fe673c9e317f206a627cb6b910336dbe", + "rev": "3ec636362e1816bc2f0888fa0fa2c69f1bc9e504", "type": "github" }, "original": { diff --git a/flake.nix b/flake.nix index e601bb3e..28859cc1 100644 --- a/flake.nix +++ b/flake.nix @@ -251,12 +251,18 @@ ... }: { - # drop once clan-core splits its makeWrapperArgs - packages.clan-cli = clan-core.packages.${system}.clan-cli.overridePythonAttrs (o: { - makeWrapperArgs = lib.concatMap ( - a: if lib.hasPrefix "--unset " a then lib.splitString " " a else [ a ] - ) o.makeWrapperArgs; - }); + # drop the override once clan-core stops pinning nixVersions.nix_2_31 + # (removed from nixpkgs), the overridePythonAttrs once it splits its + # makeWrapperArgs + packages.clan-cli = + (clan-core.packages.${system}.clan-cli.override { + nix = pkgs.nixVersions.nix_2_34; + }).overridePythonAttrs + (o: { + makeWrapperArgs = lib.concatMap ( + a: if lib.hasPrefix "--unset " a then lib.splitString " " a else [ a ] + ) o.makeWrapperArgs; + }); # CI pushes its builds to cache.lassul.us with it (.github/niks3-push.sh) packages.niks3 = inputs.niks3.packages.${system}.niks3; # CI's eval job evaluates ciToplevels with it diff --git a/pkgs/noctalia-qs/package.nix b/pkgs/noctalia-qs/package.nix index d2ebafa0..ae8aa17a 100644 --- a/pkgs/noctalia-qs/package.nix +++ b/pkgs/noctalia-qs/package.nix @@ -1,9 +1,94 @@ -{ noctalia-qs }: -# noctalia-qs 0.0.12 fails against Qt 6.12 ("Meta Types must be fully -# defined" in the hyprland ipc mocs). qt-6.12.patch backports quickshell -# 5d5d49873f ("all: use MOC includes instead of opaque pointer -# definitions") to the fork, whose i3 getters are non-const. Drop this -# package once nixpkgs' noctalia-qs builds again. -noctalia-qs.overrideAttrs (old: { - patches = (old.patches or [ ]) ++ [ ./qt-6.12.patch ]; +{ + lib, + stdenv, + fetchFromGitHub, + + pkg-config, + cmake, + ninja, + spirv-tools, + qt6, + breakpad, + jemalloc, + cli11, + wayland, + wayland-protocols, + wayland-scanner, + libxcb, + libdrm, + libgbm ? null, + vulkan-headers, + pipewire, + pam, + polkit, + glib, +}: +# The quickshell fork noctalia-shell 4.x runs on, kept here because nixpkgs +# dropped it in favour of noctalia v5. Drop this package once noctalia-shell +# (wrapperModules/noctalia-shell) moves to nixpkgs' noctalia. +stdenv.mkDerivation (finalAttrs: { + pname = "noctalia-qs"; + version = "0.0.12"; + + src = fetchFromGitHub { + owner = "noctalia-dev"; + repo = "noctalia-qs"; + tag = "v${finalAttrs.version}"; + hash = "sha256-79JP2QTdvp1jg7HGxAW+xzhzhLnlKUi8yGXq9nDCeH0="; + }; + + # 0.0.12 fails against Qt 6.12 ("Meta Types must be fully defined" in the + # hyprland ipc mocs). qt-6.12.patch backports quickshell 5d5d49873f ("all: + # use MOC includes instead of opaque pointer definitions") to the fork, + # whose i3 getters are non-const. + patches = [ ./qt-6.12.patch ]; + + nativeBuildInputs = [ + cmake + ninja + spirv-tools + pkg-config + qt6.qtwayland + qt6.wrapQtAppsHook + wayland-scanner + ]; + + buildInputs = [ + qt6.qtbase + qt6.qtdeclarative + qt6.qtwayland + qt6.qtsvg + cli11 + wayland + wayland-protocols + libdrm + libgbm + vulkan-headers + breakpad + jemalloc + libxcb + pam + pipewire + polkit + glib + ]; + + cmakeFlags = [ + (lib.cmakeFeature "DISTRIBUTOR" "Nixpkgs") + (lib.cmakeBool "DISTRIBUTOR_DEBUGINFO_AVAILABLE" true) + (lib.cmakeFeature "INSTALL_QML_PREFIX" qt6.qtbase.qtQmlPrefix) + (lib.cmakeFeature "GIT_REVISION" "tag-v${finalAttrs.version}") + (lib.cmakeBool "NIX_STORE_DIR_SKIP_WATCH" true) + (lib.cmakeFeature "NIX_STORE_DIR" builtins.storeDir) + ]; + + cmakeBuildType = "Release"; + + meta = { + homepage = "https://github.com/noctalia-dev/noctalia-qs"; + description = "Flexible QtQuick based desktop shell toolkit"; + license = lib.licenses.lgpl3Only; + platforms = lib.platforms.linux; + mainProgram = "quickshell"; + }; }) diff --git a/tools/noctalia-shell/flake-module.nix b/tools/noctalia-shell/flake-module.nix index f7228f2e..03c43b37 100644 --- a/tools/noctalia-shell/flake-module.nix +++ b/tools/noctalia-shell/flake-module.nix @@ -50,9 +50,8 @@ }; in { - # noctalia-qs is linux-only and left out of packages elsewhere (same - # availableOn check as pkgs/flake-module.nix). - packages = lib.optionalAttrs (lib.meta.availableOn pkgs.stdenv.hostPlatform pkgs.noctalia-qs) { + # noctalia-qs is linux-only and left out of packages elsewhere. + packages = lib.optionalAttrs pkgs.stdenv.hostPlatform.isLinux { noctalia-shell = noctalia.wrapper; }; }; diff --git a/wrapperModules/noctalia-shell/flake-module.nix b/wrapperModules/noctalia-shell/flake-module.nix index 9f4143e1..0dbd1ade 100644 --- a/wrapperModules/noctalia-shell/flake-module.nix +++ b/wrapperModules/noctalia-shell/flake-module.nix @@ -18,7 +18,7 @@ ${pkgs.sway}/bin/swaymsg "workspace $ws, move workspace to output $current_output" ''; - noctalia-shell = pkgs.noctalia-shell.override { inherit (config) noctalia-qs; }; + noctalia-shell = pkgs.callPackage ./noctalia-shell.nix { inherit (config) noctalia-qs; }; # Patch noctalia-shell for sway: # - Use workspace name instead of number (activate() sends @@ -104,8 +104,8 @@ noctalia-qs = lib.mkOption { type = lib.types.package; - default = pkgs.noctalia-qs; - defaultText = lib.literalExpression "pkgs.noctalia-qs"; + default = pkgs.callPackage ../../pkgs/noctalia-qs/package.nix { }; + defaultText = lib.literalExpression "pkgs.callPackage ../../pkgs/noctalia-qs/package.nix { }"; description = '' The quickshell fork the default package runs on. Ignored if you override `package`. diff --git a/wrapperModules/noctalia-shell/noctalia-shell.nix b/wrapperModules/noctalia-shell/noctalia-shell.nix new file mode 100644 index 00000000..eb7a3f37 --- /dev/null +++ b/wrapperModules/noctalia-shell/noctalia-shell.nix @@ -0,0 +1,91 @@ +{ + fetchFromGitHub, + lib, + stdenvNoCC, + + # build + qt6, + noctalia-qs, + + # runtime deps + bluez, + brightnessctl, + cliphist, + ddcutil, + wlsunset, + wl-clipboard, + wlr-randr, + imagemagick, + wget, + python3, + wayland-scanner, +}: +# noctalia-shell 4.x (QML on noctalia-qs), kept here because nixpkgs dropped +# it in favour of noctalia v5. Drop this file once the wrapper moves to +# nixpkgs' noctalia. +let + runtimeDeps = [ + wget + python3 + bluez + brightnessctl + cliphist + ddcutil + wlsunset + wl-clipboard + wlr-randr + imagemagick + ]; +in +stdenvNoCC.mkDerivation (finalAttrs: { + pname = "noctalia-shell"; + version = "4.7.7"; + + src = fetchFromGitHub { + owner = "noctalia-dev"; + repo = "noctalia"; + tag = "v${finalAttrs.version}"; + hash = "sha256-QszLpoDPD7JEv8B/w1U2u1ksBw/CYBDmwUTLhJrekF0="; + }; + + nativeBuildInputs = [ + qt6.wrapQtAppsHook + ]; + + buildInputs = [ + qt6.qtbase + qt6.qtmultimedia + ]; + + installPhase = '' + runHook preInstall + + mkdir -p $out/share/noctalia-shell $out/bin + ln -s ${noctalia-qs}/bin/qs $out/bin/noctalia-shell + + cp -R \ + Assets Commons CREDITS.md Helpers Modules Services Shaders Scripts Widgets shell.qml \ + $out/share/noctalia-shell + + rm -R $out/share/noctalia-shell/Assets/Screenshots + + runHook postInstall + ''; + + preFixup = '' + qtWrapperArgs+=( + --prefix PATH : ${lib.makeBinPath runtimeDeps} + --prefix XDG_DATA_DIRS : ${wayland-scanner}/share + --add-flags "-p $out/share/noctalia-shell" + ) + ''; + + meta = { + changelog = "https://github.com/noctalia-dev/noctalia/releases/tag/v${finalAttrs.version}"; + description = "Sleek and minimal desktop shell thoughtfully crafted for Wayland, built with Quickshell"; + homepage = "https://github.com/noctalia-dev/noctalia"; + license = lib.licenses.mit; + mainProgram = "noctalia-shell"; + platforms = noctalia-qs.meta.platforms; + }; +})