daemon: Sanitize successful build outputs prior to exposing them.
There is currently a window of time between when the build outputs are exposed
and when their metadata is canonicalized.
* nix/libstore/build.cc (DerivationGoal::registerOutputs): wait until after
metadata canonicalization to move successful build outputs to the store.
Change-Id: Ia995136f3f965eaf7b0e1d92af964b816f3fb276
Signed-off-by: Ludovic Courtès <ludo@gnu.org>
daemon: Sanitize failed build outputs prior to exposing them.
The only thing keeping a rogue builder and a local user from collaborating to
usurp control over the builder's user during the build is the fact that
whatever files the builder may produce are not accessible to any other users
yet. If we're going to make them accessible, we should probably do some
sanity checking to ensure that sort of collaborating can't happen.
Currently this isn't happening when failed build outputs are moved from the
chroot as an aid to debugging.
* nix/libstore/build.cc (secureFilePerms): new function.
(DerivationGoal::buildDone): use it.
Change-Id: I9dce1e3d8813b31cabd87a0e3219bf9830d8be96
Signed-off-by: Ludovic Courtès <ludo@gnu.org>
gnu: Add linux-libre 6.11.4.
* gnu/packages/linux.scm (linux-libre-6.11-version, linux-libre-6.11-gnu-revision,
deblob-scripts-6.11, linux-libre-6.11-pristine-source, linux-libre-6.11-source,
linux-libre-headers-6.11, linux-libre-6.11): New variables.
* gnu/packages/aux-files/linux-libre/6.11-arm.conf,
gnu/packages/aux-files/linux-libre/6.11-arm64.conf,
gnu/packages/aux-files/linux-libre/6.11-i686.conf,
gnu/packages/aux-files/linux-libre/6.11-riscv.conf,
gnu/packages/aux-files/linux-libre/6.11-x86.conf: New files.
* Makefile.am (AUX_FILES): Add them.
Co-authored-by: Ahmad Draidi <a.r.draidi@redscript.org>
Change-Id: I35bad9fbea9f568e60e7f24c95f85c240ef96277
Signed-off-by: Leo Famulari <leo@famulari.name>
gnu: mudskipper: Build with cmake-minimal.
* gnu/packages/bioinformatics.scm (mudskipper)[native-inputs]: Replace
cmake with cmake-minimal.
Change-Id: I3af7ced7a0547900aa3f452d0b56ceac2e8d0a0c
gnu: circtools: Build with cmake-minimal.
* gnu/packages/bioinformatics.scm (circtools)[native-inputs]: Replace
cmake with cmake-minimal.
Change-Id: I4a7c49e88c3e820bfcaaea9c7bf2cff4b018a853
gnu: fyi: Update to 1.0.4.
* gnu/packages/xdisorg.scm (fyi): Update to 1.0.4.
Change-Id: I8c104e33bb91aba8bd9ec1e620dd132251ae1bee
gnu: timescaledb: Ignore failing tests.
* gnu/packages/databases.scm (timescaledb):
[arguments]<#:phases>: Add phase 'patch-failing-tests.
gnu: timescaledb: Update to 2.16.1. [security fixes]
This fixes CVE-2023-25149.
* gnu/packages/databases.scm (timescaledb): Update to 2.16.1.
[arguments]<#:phases>: Remove comment and symlink trick in
'prepare-tests phase.
gnu: unbound: Update to 1.22.0.
* gnu/packages/dns.scm (unbound): Update to 1.22.0.
Change-Id: I3af89323ddc0e0d85c82a9b7989bbf66eab56d0b
gnu: stklos: Update to 2.10.
* gnu/packages/scheme.scm (stklos): Update to 2.10.
[inputs]: Add gmp, libgc, pcre2, libffi, and readline.
[native-inputs]: Add pkg-config.
[arguments]<#:configure-flags>: set LDFLAGS flag.
Change-Id: Ife374dd60ef17129fa88b7a0940ab914e7b3c396
Co-authored-by: Zheng Junjie <zhengjunjie@iscas.ac.cn>
gnu: iverilog: Update to 12.0.
* gnu/packages/fpga.scm (iverilog): Update to 12.0.
[source]: Switch to git-fetch.
[arguments]: Use G-expressions.
Set #:bootstrap-scripts to #~(list "autoconf.sh").
Set #:test-target to "check".
[home-page]: Update to new home page.
[native-inputs]: Add autoconf, gperf, remove ghostscript and zlib.
Change-Id: I55c3142aa41b190fef79572576cac6fc02473645
doc: Do not use numeric values in readymedia extra-config.
* doc/guix.texi (Miscellaneous Services)[DLNA/UPnP Services]: Use string value
"60" instead of numeric value 60 in extra-config.
Change-Id: Iea05409bb2f36fc4d0caafa375f0307bfae64a08
doc: Fix typo in readymedia example configuration.
* doc/guix.texi (Miscellaneous Services)[DLNA/UPnP Services]: Change
media-directoriess to media-directories.
Change-Id: Iea05409bb2f36fc4d0caafa375f0307bfae64a08
services: readymedia: Add trailing newline after media_dir lines.
* gnu/services/upnp.scm (readymedia-configuration->config-file): Add trailing
newline after media_dir lines.
Change-Id: Ib2e584f22526f1969098b843c4be6ee386ed809c
Signed-off-by: Arun Isaac <arunisaac@systemreboot.net>
gnu: Add ibus-chewing.
* gnu/packages/ibus.scm (ibus-chewing): New variable.
Co-authored-by: Charles <charles@charje.net>.
Change-Id: I37c1ac836e5afd3101378d206e5c2056293cc182
Signed-off-by: jgart <jgart@dismail.de>
gnu: Add fcitx5-chewing.
* gnu/packages/fcitx5.scm (fcitx5-chewing): New variable.
Signed-off-by: Efraim Flashner <efraim@flashner.co.il>
Change-Id: I27cd2d9732ad12a387ecaa258a36f7342d438ab1
Signed-off-by: jgart <jgart@dismail.de>
gnu: libchewing: Update to 0.9.0.
* gnu/packages/language.scm (libchewing): Update to 0.9.0.
[build-system]: Switch to cargo-build-system.
[arguments]: Adjust for switch to cargo-build-system. Enable
parallel-tests. Add a phase to allow older versions of
rust-clap-mangen. Add the cmake version of 'configure after 'configure.
Use the cmake versions of 'build, 'check and 'install.
[native-inputs]: Add corrosion, cmake-minimal. Remove autoconf,
automake, libtool, perl, pkg-config, python-wrapper, texinfo.
Co-authored-by: Charles <charles@charje.net>
Change-Id: Ic11e38646fc47cfc2c575320f43b9355a1c83b39
Signed-off-by: jgart <jgart@dismail.de>
gnu: Add corrosion.
* gnu/packages/cmake.scm (corrosion): New variable.
Signed-off-by: Efraim Flashner <efraim@flashner.co.il>
Change-Id: I0bb56889722128b9946af495fab05d39beaaf65a
Signed-off-by: jgart <jgart@dismail.de>
gnu: trealla: Update to 2.56.13.
* gnu/packages/prolog.scm (trealla): Update to 2.56.13.
Change-Id: Id977e4c58398747ce9a1bfffa97837e29eab66cf