3
0
Fork 0
forked from mirrors/nixpkgs
Commit graph

479 commits

Author SHA1 Message Date
Graham Christensen a9c875fc2e
nixpkgs: allow packages to be marked insecure
If a package's meta has `knownVulnerabilities`, like so:

    stdenv.mkDerivation {
      name = "foobar-1.2.3";

      ...

      meta.knownVulnerabilities = [
        "CVE-0000-00000: remote code execution"
        "CVE-0000-00001: local privilege escalation"
      ];
    }

and a user attempts to install the package, they will be greeted with
a warning indicating that maybe they don't want to install it:

    error: Package ‘foobar-1.2.3’ in ‘...default.nix:20’ is marked as insecure, refusing to evaluate.

    Known issues:

     - CVE-0000-00000: remote code execution
     - CVE-0000-00001: local privilege escalation

    You can install it anyway by whitelisting this package, using the
    following methods:

    a) for `nixos-rebuild` you can add ‘foobar-1.2.3’ to
       `nixpkgs.config.permittedInsecurePackages` in the configuration.nix,
       like so:

         {
           nixpkgs.config.permittedInsecurePackages = [
             "foobar-1.2.3"
           ];
         }

    b) For `nix-env`, `nix-build`, `nix-shell` or any other Nix command you can add
    ‘foobar-1.2.3’ to `permittedInsecurePackages` in
    ~/.config/nixpkgs/config.nix, like so:

         {
           permittedInsecurePackages = [
             "foobar-1.2.3"
           ];
         }

Adding either of these configurations will permit this specific
version to be installed. A third option also exists:

  NIXPKGS_ALLOW_INSECURE=1 nix-build ...

though I specifically avoided having a global file-based toggle to
disable this check. This way, users don't disable it once in order to
get a single package, and then don't realize future packages are
insecure.
2017-02-24 07:41:05 -05:00
Franz Pletz 9b81dcfda2
nixos/release-notes: fix typos 2017-02-22 08:45:30 +01:00
Jörg Thalheim 27d4f8c717 Merge pull request #23046 from Zimmi48/patch-2
nixos/manual/networkmanager: add info on nm-applet
2017-02-22 01:40:50 +01:00
Jörg Thalheim 6a044f1841 Merge pull request #23045 from Zimmi48/patch-1
nixos/manual/xserver: propose more alternatives
2017-02-22 01:38:25 +01:00
Jörg Thalheim 5b14e91717 Merge pull request #22822 from Mic92/iputils
iputils: 20151218 -> 20161105
2017-02-22 00:37:13 +01:00
Jörg Thalheim 45719174c3
nixos/release-notes: mention iputils changes 2017-02-22 00:32:52 +01:00
Théo Zimmermann 0994d6af9d nixos/manual/networkmanager: add info on nm-applet 2017-02-21 15:20:10 +01:00
Théo Zimmermann 361d730f35 nixos/manual/xserver: propose more alternatives 2017-02-21 14:56:26 +01:00
Lorenzo Manacorda 2c4d9c9228
manual: Add link to config section (#22994)
Add link to "Configuration" chapter from "Changing the Configuration" section.

Also, fix grammar error.
(cherry picked from commit a585f987fa)
2017-02-20 14:32:49 +01:00
Graham Christensen 7483ba0932
Revert "nix-daemon: default useSandbox to true"
This reverts commit d0a086770a.
2017-02-14 14:13:39 -05:00
Graham Christensen 3be1388963 Merge pull request #22767 from grahamc/sandbox-by-default
nix-daemon: default useSandbox to true
2017-02-14 13:57:44 -05:00
Parnell Springmeyer fb6d13c01a
Addressing feedback and fixing a bug 2017-02-14 07:38:45 -06:00
Parnell Springmeyer 9e36a58649
Merging against upstream master 2017-02-13 17:16:28 -06:00
Graham Christensen d0a086770a
nix-daemon: default useSandbox to true 2017-02-13 18:06:01 -05:00
Robin Gloster 7e5424ac09
php: default to php71 2017-02-13 22:48:45 +01:00
Linus Heckemann b4cd251c54 Manual: document users.users.<name>.hashedPassword 2017-02-13 13:54:40 +01:00
Vladimír Čunát 3348905cde
xorg-server: major bump 1.18.4 -> 1.19.1
I encountered no problems with it.  Nvidia binary drivers are tested,
and AMD ones now both set `abiCompat` to use older server versions.
2017-02-12 13:24:44 +01:00
Vladimír Čunát d4bf624f96
nixos manual: add grub option to avoid #21830
Close #22659.  vcunat edited this slightly.
2017-02-11 12:47:15 +01:00
Graham Christensen d9ab783f58
nixos manual: correct reference to sddm 2017-02-10 22:52:08 -05:00
Graham Christensen b12564cc1b
nixos: update default cases from KDM/KDE4 to SDDM/KDE5 2017-02-09 21:52:00 -05:00
Edward Tjörnhammar 2f5fdaefec
nixos, doc: dictd dbs move 2017-02-09 22:23:11 +01:00
Edward Tjörnhammar 3c9d73f100
nixos, doc: named nylons 2017-02-09 21:18:57 +01:00
Vladimír Čunát 378662bbba
Merge #22491: Add documentation for Xfce 2017-02-09 18:39:36 +01:00
Vladimír Čunát a0505989c9
Xfce docs nitpicks
- fix validity
- XFCE -> Xfce, as that seems to be upstream preference
2017-02-09 18:38:01 +01:00
Nikolay Amiantov 504774e223 release notes: mention JRE changes and jre_headless 2017-02-08 21:36:22 +03:00
Matthias Beyer de592483d1 Add xfce documentation 2017-02-07 17:55:40 +01:00
Matthias Beyer bf56d17b2c fixup! Add documentation for XFCE 2017-02-06 09:17:52 +01:00
Matthias Beyer 4b5a230d1d Add documentation for XFCE 2017-02-06 09:10:05 +01:00
Nikolay Amiantov 52c7e647ab postfix service: don't empty local_recipient_maps
From Postfix documentation:

With this setting, the Postfix SMTP server will not reject mail with "User
unknown in local recipient table". Don't do this on systems that receive mail
directly from the Internet. With today's worms and viruses, Postfix will become
a backscatter source: it accepts mail for non-existent recipients and then
tries to return that mail as "undeliverable" to the often forged sender
address.
2017-02-06 01:41:27 +03:00
Nikolay Amiantov 5247140e57 Merge pull request #21875 from abbradar/gateway-interface
Allow specifying interface for default gateway
2017-02-03 02:26:31 +03:00
Nikolay Amiantov 4feb0a998a manual: mention needed options for IPv6 2017-02-02 01:53:00 +03:00
Parnell Springmeyer 6777e6f812
Merging with upstream 2017-01-29 05:54:01 -06:00
Parnell Springmeyer e92b8402b0
Addressing PR feedback 2017-01-28 20:48:03 -08:00
Frederik Rietdijk 46b1ea260a pythonPackages.ansible2: move 2.2 to separate file, make default
`pythonPackages.ansible_2_2` is now the default `ansible`.
2017-01-27 10:15:31 +01:00
Parnell Springmeyer a26a796d5c
Merging against master - updating smokingpig, rebase was going to be messy 2017-01-26 02:00:04 -08:00
Parnell Springmeyer 025555d7f1
More fixes and improvements 2017-01-26 00:05:40 -08:00
aszlig d01b9493c9
nixos/doc/installing: Fix typo in <literal/>
The tag wasn't properly closed which caused the manual build to fail.

Tested with: nix-build nixos/release.nix -A manual.x86_64-linux

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2017-01-25 21:40:07 +01:00
Pascal Bach a6968ad43c installing: document how to activate SSH during installation 2017-01-25 21:09:31 +01:00
Franz Pletz 8d5a4c53b8
nixos/release-notes: document conntrack helper changes 2017-01-25 01:14:05 +01:00
John Ericson 7dc4e43837 nixos doc: Mention cross overhaul in 17.03 release notes 2017-01-24 11:37:56 -05:00
Nicolas B. Pierron 0214d94b24 Remove extra "in" keyword from the release notes about overlays.
Thanks to @teh for reporting this issue on the pull request.
2017-01-17 21:24:44 +00:00
Nicolas B. Pierron 8366525cbf Fix release-notes compilation. 2017-01-16 01:17:33 +01:00
Nicolas B. Pierron 2d6532b330 Update overlay documentation by following nits from aneeshusa. 2017-01-16 01:17:33 +01:00
Nicolas B. Pierron ae7e893de1 Improve the realse notes with the upcoming documentation links, and a better example of how to convert overridePackages usage. 2017-01-16 01:17:33 +01:00
Nicolas B. Pierron 6a83c315ec Add missing line break in the release notes. 2017-01-16 01:17:33 +01:00
Nicolas B. Pierron f5dfe78a1e Add overlays mechanism to Nixpkgs.
This patch add a new argument to Nixpkgs default expression named "overlays".

By default, the value of the argument is either taken from the environment variable `NIXPKGS_OVERLAYS`,
or from the directory `~/.nixpkgs/overlays/`.  If the environment variable does not name a valid directory
then this mechanism would fallback on the home directory.  If the home directory does not exists it will
fallback on an empty list of overlays.

The overlays directory should contain the list of extra Nixpkgs stages which would be used to extend the
content of Nixpkgs, with additional set of packages.  The overlays, i-e directory, files, symbolic links
are used in alphabetical order.

The simplest overlay which extends Nixpkgs with nothing looks like:

```nix
self: super: {
}
```

More refined overlays can use `super` as the basis for building new packages, and `self` as a way to query
the final result of the fix-point.

An example of overlay which extends Nixpkgs with a small set of packages can be found at:
  https://github.com/nbp/nixpkgs-mozilla/blob/nixpkgs-overlay/moz-overlay.nix

To use this file, checkout the repository and add a symbolic link to
the `moz-overlay.nix` file in `~/.nixpkgs/overlays` directory.
2017-01-16 01:17:33 +01:00
John Ericson 0ef8b69d12 top-level: Modernize stdenv.overrides giving it self and super
Document breaking change in 17.03 release notes
2017-01-13 10:36:11 -05:00
Vladimír Čunát 2b8566f556
release notes: grammar nitpicks in an entry
/cc #21257.
2016-12-18 13:31:56 +01:00
Jörg Thalheim feb6dbc916 ntp: document new default ntp service in release notes 2016-12-18 12:25:46 +01:00
Théo Zimmermann fba6537341 doc: correct typo (#21176) 2016-12-15 17:13:44 +01:00