With hardening, we need to go a bit further rather than just allowing
/nix/store being world-writable. We now use fakeroot to make sure the
VBoxExtPackHelperApp won't moan that the files are not owned by root.
They are, but only outside of the chrooted build process.
Another issue with using fakeroot is that it doesn't seem to cope well
with arguments that contain spaces. That's why I've piped the call into
${stdenv.shell}.
Now, the really gory and confusing part is the introduction of
VBOX_PATH_APP_PRIVATE_ARCH_TOP and the change of VBOX_PATH_APP_PRIVATE.
The VBOX_PATH_APP_PRIVATE_ARCH is *only* for modules and is checked by
the hardened implementation against whether things like VMMR0.r0 or
VBoxVMM.so reside in that directory. As a side note: I admit that the
whole libexec directory is quite polluted with stuff that shouldn't be
there, but for now we've broken enough things and will tear apart the
whole structure at some day in the future[TM].
For the confusing part we have VBOX_PATH_APP_PRIVATE_ARCH_TOP, which
_should_ be the same as VBOX_PATH_APP_PRIVATE_ARCH but unfortunately,
the hardened implementation is checking against this directory (in
IsValidBaseDir) for the extension pack(why!?).
Of course, we could put even that into the libexec directory, somewhat
similar as the official package, but after all, let's at least *try* to
separate things.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
We are already checking whether /nix/store has the sticky bit set, so if
it is world-writable as well it doesn't mean that the actual store path
is writable. Let alone the fact that it is only writable during the
build process.
This should fix installing the extension pack when enableExtensionPack
is used.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
VirtualBox with hardening support requires the main binaries to be
setuid root. Using VBOX_WITH_RUNPATH, we ensure that the RPATHs are
pointing to the libexec directory and we also need to unset
VBOX_WITH_ORIGIN to make sure that the build system is actually setting
those RPATHs.
The hardened.patch implements two things:
* Set the binary directory to the setuid-wrappers dir so that
VboxSVC calls them instead of the binaries from the store path. The
reason behind this is because nothing in the Nix store can have the
setuid flag.
* Excempt /nix/store from the group permission check, because while it
is group-writeable indeed it also has the sticky bit set (and also
the whole store is mounted read-only on most NixOS systems), so we're
checking on that as well.
Right now, the hardened.patch uses /nix/store and /var/setuid-wrappers
directly, so someone would ever want to change those on a NixOS system,
please provide a patch to set those paths on build time. However, for
simplicity, it's best to do it when we _really_ need it.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
Traversing the full source tree is unneccessary, because the calls are
only done within make files. Hence we only substitute make files now.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
Also, in case of collectd, the -lgcc_s shouldn't be needed anymore,
as the library is in ${glibc}/lib/ now, which is practically always on RPATH.
In case of seyren it was some stdenv change uncovering the mistake of
putting src into buildInputs.
Thanks to @iElectric for the notification, although I'm not really sure
whether this will fix the following failed Hydra build:
http://hydra.nixos.org/build/17609086/nixlog/1/raw
The reason is that this failure doesn't happen on every build, but let's
see whether it will happen again now.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
Says: #warning "_BSD_SOURCE and _SVID_SOURCE are deprecated, use _DEFAULT_SOURCE"
CC: #4803. There will likely appear more of these errors on Hydra in time.
This is a response to 1fdefd5562.
We are already using bundled protobuf for the beta and dev channels and
it also breaks regularly with about every new Chromium release, so let's
use bundled protobuf for all channels now.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
We now create Nix expressions within the plugin output path(s) which
then will be imported and incorporated into the wrapper. This makes it
easier for other plugins to provide configuration settings to the main
Chromium wrapper.
Of course, in order to allow for external plugins we need to allow
passing a list of plugins to the Chromium derivation, but right now we
keep it internal and only use it for things such as NaCl (as soon as we
support it, of course).
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
Basic functionality works. No plugins yet (TODO: GExiv2, pyICU, webkit,
osmgsmmap).
Gives error messages about errors in GTK installation regarding
localization. No impact other than the messages visible.
This introduces Chromium 39 as the new stable version along with a bunch
of fixes.
Fixes#2799, particularily the PDF plugin, which now is open source and
thus no longer an issue.
Also fixes#3219 and merges #2906, so we no longer get a crash while
trying to bring up the print preview dialog.
Thanks to @edwtjo for the CUPS version bump.
* chromium: Switch to use open-source PDF plugin.
* cups: bump 1.5.4 -> 1.7.5
* chromium: Allow env vars for passing plugin paths.
* chromium: Update all channels to latest versions.
* protobuf: Clean up and update to version 2.6.1.
The Chromium PDF plugin is now available as open source software and is
already included in the Chromium source tree in current stable, so there
is no need to extract it from the Chrome binary package anymore.
See release announcement at http://blog.foxitsoftware.com/?p=641
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
Introduces environment variables to set plugin base paths. The schema
for these is like NIX_CHROMIUM_PLUGIN_PATH_<N>. Where <N> is the path
type we want to change, the supported (full) variable names are:
* NIX_CHROMIUM_PLUGIN_PATH_ALL
* NIX_CHROMIUM_PLUGIN_PATH_PEPPERFLASH
* NIX_CHROMIUM_PLUGIN_PATH_FILEFLASH
* NIX_CHROMIUM_PLUGIN_PATH_PDF
* NIX_CHROMIUM_PLUGIN_PATH_FILE_EFFECTS
* NIX_CHROMIUM_PLUGIN_PATH_NACL
* NIX_CHROMIUM_PLUGIN_PATH_PNACL
* NIX_CHROMIUM_PLUGIN_PATH_WIDEVINE
Whereas NIX_CHROMIUM_PLUGIN_PATH_ALL is the plugin base path for every
path which is not set explicitly, so by setting ..._ALL and not setting
..._WIDEVINE, the widevine plugin will be searched in the directory
specified using ..._ALL.
Right now, the only plugin where this is used is widevine, and it still
doesn't properly work yet.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
With this commit, the following new upstream versions are introduced:
stable: 38.0.2125.101 -> 39.0.2171.65
beta: 39.0.2171.19 -> 40.0.2214.10
dev: 40.0.2182.3 -> 41.0.2224.3
We can now remove missing_alg_import.patch, because version 39 is nom
stable and thus fixes the missing include directive upstream.
However, starting with version 40, we hit a few bugs with system
protobuf, so we're disabling it for every version >=40 to avoid
runtime/startup errors.
Here is the stable channel announcement for version 39 on the official
blog:
http://googlechromereleases.blogspot.de/2014/11/stable-channel-update_18.html
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
This commit also removes the 5.2 branch in favor of 5.3. Several
components of KDE5 require Qt 5.3, so it doesn't make much sense to have
the rest of the system on an older version. Also, the application styles
may not be compatible because Qt breaks ABI compatibility between versions.
Adds the Tomahawk music player (https://www.tomahawk-player.org/) in
version 0.8.1 and all its required and optional dependencies.
* tomahawk:
tomahawk: Add new package, version 0.8.1.
libjreen: Add new package, version 1.2.0.
websocketpp: Add new package, version 0.4.0.
lucenepp: Add new package, version 3.0.6.
qtkeychain: Add new package, version 0.4.0.
libechonest: Add new package, version 2.3.0.
quazip: Use qt instead of qt5 for refering to Qt.
Although I've not tested the Tomahawk build on Mac OS X, it *should*
work on it, so I'm using platforms.all here.
Telepathy and KDE support are disabled by default in order to not get in
the way of users who want to use a more minimalistic window-manager-only
setup. But I'm not sure whether it matters in reality, we'll see once
more people are using Tomahawk.
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
Also adds OpenGL and WxGLCanvas to perlPackages..
OpenGL currently contains some pretty ugly hacks regarding OpenGL
feature-detection. Expect it to fail on different systems.
Since b23dbb1a5d, if buildInputs contains
a plain file it is used as a setup hook. The waf script which is used
here in mpv however isn't a setup hook and also shouldn't be included in
buildInputs as it was kind of a no-op before already.
Failed build log:
https://headcounter.org/hydra/build/582548/nixlog/1/raw
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
Bluefish is a powerful editor targeted towards programmers and
webdevelopers, with many options to write websites, scripts and
programming code.
Homepage: http://bluefish.openoffice.nl/
Without this, ImageMagick's configure script will generate code
specific to the machine building the package. This code may then fail
on other CPU types.
http://hydra.nixos.org/build/16564129
Signed-off-by: Domen Kožar <domen@dev.si>
