18·27 <Profpatsch> skarnet: would you recommend putting bearssl as the default backend for s6-networking?
18·27 <Profpatsch> uh, bearssl isn’t even packaged
18·27 <Profpatsch> yak shave
18·28 <Profpatsch> skarnet: The current backend uses libressl
18·29 <@skarnet> well at least CAFILE works
18·29 <@skarnet> but yes, I would recommend putting bearssl as the default backend
Includes the following version changes:
- skalibs: 2.10.0.1 -> 2.10.0.2
- execline: 2.7.0.0 -> 2.8.0.0
- s6-networking: 2.4.0.0 -> 2.4.1.0
- s6-linux-init: 1.0.6.0 -> 1.0.6.1
- s6: 2.10.0.0 -> 2.10.0.2
Upstream maintainer notes:
------------------------------------------------------------
Mon, 15 Feb 2021 19:50:14 +0000
Hello,
New versions of some of the skarnet.org packages are available.
skalibs-2.10.0.2: bugfixes
execline-2.8.0.0: major version bump, but few and low-impact changes
s6-2.10.0.2: bugfixes
s6-linux-init-1.0.6.1: bugfixes
s6-networking-2.4.1.0: minor version bump
Some details:
* execline-2.8.0.0
----------------
- The if program now propagates its child's exit code by default if it
exits.
- The backtick program's -i behaviour (exit on child failure or
presence of a null character in its output) is now the default. Other
behaviours in case of child failure can be obtained via -I, -x or -D
options; -x is the new one.
- These changes are compatible with all the common uses of if and
backtick, but break compatibility in edge cases, which is why a
major version bump is required. This has nothing in common with the
previous major version bump, which had massive changes all over the
place; this one should go smoothly, and will only impact very specific
uses of backtick.
execline now has man pages, thanks to the untiring flexibeast!
The repository can be found here:
https://github.com/flexibeast/execline-man-pages
Please allow some time for the man pages to be updated to reflect
the current HTML documentation. Currently, the man pages document
execline-2.7.0.1; they are accurate for 2.8.0.0 except for the if and
backtick changes.
* s6-linux-init-1.0.6.1
---------------------
- Bugfixes.
- When s6-linux-init is built with utmps, the default utmp user for
s6-linux-init-maker was set to "utmp". That was a bug: now, by default,
s6-linux-init-maker does not create the utmp services if the -U option
is not given. If you used s6-linux-init-maker without the -U option
and still need the utmps services, you should explicitly set "-U utmp".
https://skarnet.org/software/s6-linux-init/
git://git.skarnet.org/s6-linux-init
* s6-networking-2.4.1.0
---------------------
- Bugfixes (nothing security-related).
- It is now possible to define a maximum amount of time spent in the
TLS handshake no matter how s6-networking has been built. (The -K
option has been implemented for the libtls backend.)
- When SNI has been required, the TLS-related binaries now export
the SSL TLS SNI SERVERNAME option to their application; the variable
contains the relevant server name.
https://skarnet.org/software/s6-networking/
git://git.skarnet.org/s6-networking
s6-networking has man pages as well:
https://github.com/flexibeast/s6-networking-man-pages
Enjoy,
Bug-reports welcome.
--
Laurent
------------------------------------------------------------
Copied from: http://skarnet.org/cgi-bin/archive.cgi?1:mss:1535:202102:lpehbljhhcpaopbnkkbf
Maintainer notes
-----
The execline exec function interface changed quite drastically, and
backwards-compatibility to the old functions was dropped in-between
the last release and this one. Thus, downstream code might break.
At the end of this commit message is a compatibility interface.
-----
Release notes
-----
Hello,
Happy New Year to everyone!
New versions of the skarnet.org packages are available.
This is a major release. The skalibs major version number has been
bumped, which means that compatibility with previous versions is not
ensured. Other packages have been updated to build against the new
skalibs. If they only had their patch number increased, that's all
the modifications they had (save for possible bugfixes); but some
packages also received significant changes and underwent either a major
(compatibility not ensured) or minor (simple additions) release.
Support for the 2.9.* branch of skalibs, and associated versions of
the other packages, is still ensured for a while, but users are always
strongly encouraged to upgrade.
* General
-------
- Some rarely-triggered build bugs have been fixed.
- -fno-stack-protector is not part of the default CFLAGS anymore;
stack protector policy now defaults to the compiler's settings.
* skalibs-2.10.0.0
----------------
- Bugfixes.
- Significant code cleanup.
- New sysdep: chroot.
- Lots of new functions, mostly to optimize the number of needed
fcntl() calls at open() time. Traces should generally be marginally
shorter than they were before.
- Removal of the DJBUNIX_FLAG_NB and DJBUNIX_FLAG_COE macros, replaced
by the POSIX O_NONBLOCK and O_CLOEXEC macros wherever they were used.
- Removal of the skalibs/webipc.h header, and better header separation.
- Complete revamping of the pathexec functions, now separated into
exec_* (simple execution) and mexec_* (execution with merging of the
environment first). In true skalibs fashion, there is a little code,
and 3 pages of convenience macros (the exec.h header).
- Complete rewrite of the locking functions, with a change of
underlying mechanisms. The skalibs locking primitives are now named
fd_lock(), fd_unlock() and fd_islocked().
The Unix locks primitive space is a horror show. flock() is not
POSIX and does not have a way to test for a lock without taking it.
The POSIX lockf() only has exclusive locks, not shared ones. The least
bad option is fcntl(), which has shared and exclusive locks *and* a way
to check for a lock without taking it, but does not allow taking a
shared lock via a O_WRONLY file descriptor. Of all inconveniences this
is the most minor one, so now skalibs uses fcntl().
https://skarnet.org/software/skalibs/
git://git.skarnet.org/skalibs
* nsss-0.1.0.0
------------
- New --enable-libc-includes configure option. Without this option,
the pwd.h, grp.h and shadow.h headers are not installed anymore, so
by default installing nsss on a FHS system does not overwrite the
libc headers.
https://skarnet.org/software/nsss/
git://git.skarnet.org/nsss
* utmps-0.1.0.0
-------------
- New --enable-libc-includes configure option. Without this option,
the utmpx.h header is not installed anymore, so by default installing
utmps on a FHS system does not overwrite the libc headers.
https://skarnet.org/software/utmps/
git://git.skarnet.org/utmps
* execline-2.7.0.0
----------------
- Bugfixes.
- The trap program has changed. The "timeout" directive has been
removed; a "default" directive has been added, to handle all signals
for which a specific directive has not been given. Subprograms are
now run with the SIGNAL environment variable set to the signal number
(in addition to ! always being set to the application's pid).
- The forstdin program has changed. It now exits 0 if it has read at
least one line, and 1 otherwise.
- The default list of delimiters for backtick, withstdinas, forstdin
and forbacktickx has been set to "\n", so by default those programs
will read and/or split on lines and only lines.
- The backtick, withstdinas, forstdin, forbacktickx, forx, getpid
and getcwd programs now have a -E option to activate autoimport.
(This saves the user from manually adding "importas var var" after
every use of these programs.)
https://skarnet.org/software/execline/
git://git.skarnet.org/execline
* s6-2.10.0.0
-----------
It is imperative to restart your supervision trees, by rebooting if
necessary, after upgrading s6 to the new version. Otherwise, new s6
binaries interacting with service directories maintained by old
s6-supervise binaries may not work.
If you are using s6-linux-init, it is necessary to upgrade to the
latest version of s6-linux-init at the same time as s6.
- Bugfixes.
- Significant code refactoring.
- The internal locking system of service directories has changed,
allowing for a cleaner permissions model and official support of
relaxed permissions.
- New binary to implement those relaxed permissions: s6-svperms.
- The "nosetsid" file is not supported anymore in service directories.
Services are now always started in a new session.
- s6-supervise now traps SIGINT: before dying, it sends a SIGINT to its
service's process group. This allows correct transmission of ^C when a
supervision tree is running in a terminal, even though every service
runs in its own session.
- s6-svc -X doesn't exist anymore. s6-supervise now always closes stdin
and stdout on the last execution of the service.
- The semantics of SIGHUP and SIGQUIT have changed for s6-supervise.
- The set of commands sent by s6-svscanctl and received by s6-svscan
has been cleaned up and made more logical.
- When told to exit normally (typically via s6-svscanctl -t), s6-svscan
now first waits for the whole supervision tree to die. The
.s6-svscan/finish script can now assume that all services are completely
down. (s6-svscanctl -b is an exception; it should not be used in normal
circumstances.)
- The -s and -S options to s6-svscan are not supported anymore. Signal
management in s6-svscan has been streamlined: signals have a default
handler that can be overridden by a corresponding executable
.s6-svscan/SIGfoo file.
- Default signal handlers for s6-svscan have more intuitive semantics.
- New binary to help with management of user-owned supervision trees:
s6-usertree-maker.
https://skarnet.org/software/s6/
git://git.skarnet.org/s6
s6 now has man pages! Thanks to flexibeast for performing the conversion
work. Please allow some time for the man pages to be updated to reflect
the current HTML documentation. The repository can be found here:
https://github.com/flexibeast/s6-man-pages
* s6-linux-init-1.0.6.0
---------------------
It *is necessary* to upgrade s6-linux-init at the same time as s6.
It *is recommended*, although not strictly necessary, to create your
run-image directory again via a s6-linux-init-maker invocation. Old
images will still boot, as long as you are using an upgraded version
of s6-linux-init; but they may incorrectly handle signals sent to init,
so for instance Ctrl-Alt-Del may not work anymore, until you run
s6-linux-init-maker again.
- New internal binary: s6-linux-init-nuke. This program is not meant
to be invoked by users directly: it simply removes a dependency to the
'kill' program in a rare case involving containers.
https://skarnet.org/software/s6-linux-init/
git://git.skarnet.org/s6-linux-init
* s6-dns-2.3.4.0
--------------
- New library function: s6dns_message_parse_question().
https://skarnet.org/software/s6-dns/
git://git.skarnet.org/s6-dns
* s6-networking-2.4.0.0
---------------------
- Important refactoring of the tls code. The crypto tunnel now runs
as a child of the application, instead of the other way around. It is
now isolated in a s6-tls[cd]-io binary; s6-tlsc is now a simple wrapper
around s6-tlsc-io, and s6-tlsd is a simple wrapper around s6-tlsd-io.
- New binaries: s6-ucspitlsc and s6-ucspitlsd. Those implement
opportunistic TLS via the UCSPI-TLS protocol.
- The -K option to the tls binaries has changed semantics: it now
enforces a timeout for the handshake instead of dropping the connection
after some inactivity. Note that this option is only useful with the
bearssl backend: the libtls backend always performs a synchronous
handshake, with no way of interrupting it after a timeout expires.
- The execline dependency is now optional. Disabling execline, however,
changes the behaviour of s6-tcpserver-access (which cannot support
exec files without it).
https://skarnet.org/software/s6-networking/
git://git.skarnet.org/s6-networking
It is now possible to build the s6-networking package against OpenSSL
instead of LibreSSL, thanks to the libretls project:
https://git.causal.agency/libretls/about/
* mdevd-0.1.3.0
-------------
- New -C option to the mdevd program. This option makes mdevd
automatically spawn a mdevd-coldplug program when it's ready, allowing
mdevd to be used as a drop-in mdev -d replacement. (Note that the
coldplug is also performed if mdevd restarts after being killed, so
this feature should not be used in place of a proper service startup
sequence with a mdevd-coldplug oneshot depending on the mdevd longrun.
It has only been added for convenience.)
https://skarnet.org/software/mdevd/
git://git.skarnet.org/mdevd
* Other packages
--------------
The following packages have received an update so they build with the
latest version of skalibs and other dependencies, but nothing has changed
except possibly some bugfixes, and hopefully not too many bug additions.
- s6-rc-0.5.2.1. (It is not necessary to recompile your service
database. However, it is necessary to upgrade s6-rc along with s6, and
to reboot the system ASAP after upgrading.)
- s6-portable-utils-2.2.3.1
- s6-linux-utils-2.5.1.4
- bcnm-0.0.1.2
Enjoy,
Bug-reports welcome.
--
Laurent
-----
execline compat interface
-----
/* Compatibility */
#define pathexec_run(file, argv, envp) exec_ae(file, argv, envp)
#define pathexec0_run(file, argv, envp) exec0_ae(file, argv, envp)
#define xpathexec_run(file, argv, envp) xexec_ae(file, argv, envp)
#define xpathexec0_run(file, argv, envp) xexec0_ae(file, argv, envp)
#define pathexec_env(key, value) env_mexec(key, value)
#define pathexec_fromenv(argv, envp, envlen) mexec_f(argv, envp, envlen)
#define pathexec(argv) mexec(argv)
#define pathexec0(argv) mexec0(argv)
#define xpathexec_fromenv(argv, envp, envlen) xmexec_f(argv, envp, envlen)
#define xpathexec(argv) xmexec(argv)
#define xpathexec0(argv) xmexec0(argv)
#define pathexec_r_name(file, argv, envp, envlen, modif, modiflen) mexec_afm(file, argv, envp, envlen, modif, modiflen)
#define pathexec_r(argv, envp, envlen, modif, modiflen) mexec_fm(argv, envp, envlen, modif, modiflen)
#define xpathexec_r_name(file, argv, envp, envlen, modif, modiflen) xmexec_afm(file, argv, envp, envlen, modif, modiflen)
#define xpathexec_r(argv, envp, envlen, modif, modiflen) xmexec_fm(argv, envp, envlen, modif, modiflen)
#endif
copied from 18e4356557 (diff-69efbe5d997280a1430a6af2fa38e3f5105e706076a26fc751885c505ca598c6R140)
Hello,
New versions of all the skarnet.org packages are available.
This is mostly a bugfix release (there was an installation bug in
some circumstances with shared libraries) but some packages, notably
execline and s6, have new, useful features.
The new versions are the following:
skalibs-2.9.2.0
nsss-0.0.2.2
utmps-0.0.3.2
execline-2.6.0.0
s6-2.9.1.0
s6-rc-0.5.1.2
s6-linux-init-1.0.4.0
s6-dns-2.3.2.0
s6-networking-2.3.1.2
s6-portable-utils-2.2.2.2
s6-linux-utils-2.5.1.2
mdevd-0.1.1.2
bcnm-0.0.1.0
Here are details for the packages that have more than bugfixes:
* skalibs-2.9.2.0
---------------
- New header: skalibs/bigkv.h. It's a set of functions allowing
efficient lookups in a large set of strings (typically read from the
command line or the environment).
https://skarnet.org/software/skalibs/
git://git.skarnet.org/skalibs
* execline-2.6.0.0
----------------
- It's a major release because an API has been modified: dollarat.
Beforehand, dollarat's -0 option would always prevail over any -d
option. Now, dollarat has its conflicting -0 and -d options handled
in the conventional way, with rightmost priority.
- The runblock program now accepts a command line prefix, which is
given as runblock's own command line. This allows blocks to serve as
arguments to a new command, instead of having to be full command lines
by themselves.
- New binary: posix-umask.
- The former "cd" program is now named "execline-cd" and the former
"umask" program is named "execline-umask". When the=20
--enable-pedantic-posix
option is not given at configure time, "cd" and "umask" are symbolic
links created at installation time and pointing to execline-cd and
execline-umask respectively. When the --enable-pedantic-posix option is
given, the symbolic links point to posix-cd and posix-umask instead.
- With posix-cd and posix-umask (and the changes to wait done in the
previous version), execline is now fully POSIX-compliant when built with
the --enable-pedantic-posix option. This will certainly, without the
slightest hint of a doubt, change distributions' attitudes about it.
https://skarnet.org/software/execline/
git://git.skarnet.org/execline
* s6-2.9.1.0
----------
- A new '?' directive has been added to s6-log. It behaves exactly like
'!', except that it spawns the given processor with /bin/sh as an
interpreter instead of execlineb.
- execline support is now optional: it can be disabled by specifying
--disable-execline at configure time. Some functionality is unavailable
when execline support is disabled:
* s6-log's '!' directive
* s6-notifyoncheck's -c option
* s6-ipcserver-access's support for 'exec' directives in a ruleset
- A new -X option has been added to s6-svscan, to specify a descriptor
that will be passed as stderr to a service spawned by this s6-svscan and
named s6-svscan-log. This is used in the new s6-linux-init, to avoid
needing to hardcode the /dev/console name for the catch-all logger's
standard error.
- On systems that define SIGPWR and SIGWINCH, s6-svscan -s now diverts
those signals. This allows powerfail and kbrequest events to be handled
when s6-svscan runs as process 1.
https://skarnet.org/software/s6/
git://git.skarnet.org/s6
* s6-linux-init-1.0.4.0
---------------------
- New options have been added to s6-linux-init-maker: to support
running s6-linux-init without a catch-all logger, and to support running
it in a container.
- s6-linux-init-maker now adds a SIGPWR handler to the default image:
on receipt of a SIGPWR, the system's shutdown procedure is triggered.
- s6-linux-init now handles kbrequest, which triggers a SIGWINCH in
init when a special, configurable set of keys is pressed. By default,
no SIGWINCH handler is declared in the image, and no set of keys is
bound to kbrequest.
https://skarnet.org/software/s6-linux-init/
git://git.skarnet.org/s6-linux-init
* s6-dns-2.3.2.0
--------------
- New library: libdcache, implementing a clean cache structure
to contain DNS data. It's still not used at the moment.
https://skarnet.org/software/s6-dns/
git://git.skarnet.org/s6-dns
* bcnm-0.0.1.0
------------
- First numbered release, because the Ad=C3=A9lie Linux distribution,
which uses libwpactrl, needs an official release instead of pulling
from git.
- libwpactrl is a set of C functions helping control a wpa_supplicant
process.
- bcnm-waitif is a binary that waits for network interface state
events such as appearance/disappearance, up/down, running/not-running.
It is useful to avoid race conditions during a boot sequence, for
instance.
https://skarnet.org/software/bcnm/
git://git.skarnet.org/bcnm
Enjoy,
Bug-reports welcome.
--
Laurent
Introduce a `skawarePackages.buildPackage` function that contains the
common setup, removing a lot of duplication.
In particular, we require that the build directory has to be empty
after the `fixupPhase`, to make sure every relevant file is moved to
the outputs.
A next step would be to deduplicate the `configureFlags` attributes
and only require a `skawareInputs` field.
The configure scripts have been changed so that `--build` is now the
way to specify (non-cross compiling) build target, which is necessary
on darwin for binary compatibility across darwin versions.
execline: 2.1.4.5 -> 2.2.0.0
s6-dns: 2.0.0.7 -> 2.1.0.0
s6-linux-utils: 2.0.2.3 -> 2.2.0.0
s6-networking: 2.1.0.4 -> 2.2.1.0
s6-portable-utils: 2.1.0.0 -> 2.1.0.0 (no version change)
s6-rc: 0.0.2.1 -> 0.1.0.0
s6: 2.2.4.3 -> 2.4.0.0
skalibs: 2.3.9.0 -> 2.4.0.1
Also use new --enable-absolute-paths configure arg to correctly set
paths to runtime executables to point within the nix store rather than
relying on PATH resolution.
skalibs:
execline:
s6-dns:
s6-networking:
s6-portable-utils:
s6-rc:
s6:
The above software uses the target triplet from `cc -dumpmachine` as a
binary compatibility check. However, on darwin, the output includes the
darwin version number, which leads to build failures against a binary
skalibs package built a different version of darwin than the current
system.
Explicitly setting target ensures code can be compiled against a skalibs
binary built on a different version of darwin.
See http://www.skarnet.org/cgi-bin/archive.cgi?1:mss:623:heiodchokfjdkonfhdph
The website gives no indication that version 4.x is required to build
this package, and even it if were, then there should be an override in
all-packages.nix instead of referring to the 'gnumake40' attribute
directly in this expression.
New build system using configure script and GNU Make 4.0, and new
releases of the following using the new build system:
execline 2.0.0.0
s6 2.0.0.0
s6-dns 2.0.0.0
s6-linux-utils 2.0.0.0
s6-networking 2.0.0.0
s6-portable-utils 2.0.0.0
skalibs 2.0.0.0
s6-networking is a suite of small networking utilities for Unix systems
including UCSPI Unix and TCP tools, access control tools, and network
time management utilities.
