NixOS · Jul 16, 2020 · Jul 21, 2020 · Jul 21, 2020 · Jul 21, 2020 · Jul 21, 2020
diff --git a/nixos/doc/manual/release-notes/rl-2009.xml b/nixos/doc/manual/release-notes/rl-2009.xml
@@ -525,6 +525,14 @@ systemd.services.nginx.serviceConfig.ReadWritePaths = [ "/var/www" ];
      automatically if <literal>stateVersion</literal> is 20.09 or higher.
     </para>
    </listitem>
+   <listitem>
+    <para>
+      <literal>udpt</literal> experienced a complete rewrite from C++ to rust. The configuration format changed from ini to toml.
+      The new configuration documentation can be found at
+      <link xlink:href="https://naim94a.github.io/udpt/config.html">the official website</link> and example
+      configuration is packaged in <literal>${udpt}/share/udpt/udpt.toml</literal>.
+    </para>
+   </listitem>
    <listitem>
     <para>
      We now have a unified <xref linkend="opt-services.xserver.displayManager.autoLogin"/> option interface

diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
@@ -814,6 +814,7 @@
   ./services/security/torsocks.nix
   ./services/security/usbguard.nix
   ./services/security/vault.nix
+  ./services/security/yubikey-agent.nix
   ./services/system/cloud-init.nix
   ./services/system/dbus.nix
   ./services/system/earlyoom.nix

diff --git a/nixos/modules/programs/gnupg.nix b/nixos/modules/programs/gnupg.nix
@@ -70,6 +70,7 @@ in
     agent.pinentryFlavor = mkOption {
       type = types.nullOr (types.enum pkgs.pinentry.flavors);
       example = "gnome3";
+      default = defaultPinentryFlavor;
       description = ''
         Which pinentry interface to use. If not null, the path to the
         pinentry binary will be passed to gpg-agent via commandline and
@@ -91,8 +92,6 @@ in
   };
 
   config = mkIf cfg.agent.enable {
-    programs.gnupg.agent.pinentryFlavor = mkDefault defaultPinentryFlavor;
-
     # This overrides the systemd user unit shipped with the gnupg package
     systemd.user.services.gpg-agent = mkIf (cfg.agent.pinentryFlavor != null) {
       serviceConfig.ExecStart = [ "" ''

diff --git a/nixos/modules/services/security/yubikey-agent.nix b/nixos/modules/services/security/yubikey-agent.nix
@@ -0,0 +1,61 @@
+# Global configuration for yubikey-agent.
+
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.yubikey-agent;
+
+  # reuse the pinentryFlavor option from the gnupg module
+  pinentryFlavor = config.programs.gnupg.agent.pinentryFlavor;
+in
+{
+  ###### interface
+
+  meta.maintainers = with maintainers; [ philandstuff rawkode ];
+
+  options = {
+
+    services.yubikey-agent = {
+      enable = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Whether to start yubikey-agent when you log in.  Also sets
+          SSH_AUTH_SOCK to point at yubikey-agent.
+
+          Note that yubikey-agent will use whatever pinentry is
+          specified in programs.gnupg.agent.pinentryFlavor.
+        '';
+      };
+
+      package = mkOption {
+        type = types.package;
+        default = pkgs.yubikey-agent;
+        defaultText = "pkgs.yubikey-agent";
+        description = ''
+          The package used for the yubikey-agent daemon.
+        '';
+      };
+    };
+  };
+
+  config = {
+    environment.systemPackages = [ cfg.package ];
+    systemd.packages = [ cfg.package ];
+
+    # This overrides the systemd user unit shipped with the
+    # yubikey-agent package
+    systemd.user.services.yubikey-agent = mkIf (pinentryFlavor != null) {
+      path = [ pkgs.pinentry.${pinentryFlavor} ];
+    };
+
+    environment.extraInit = optionalString cfg.enable
+      ''
+        if [ -z "$SSH_AUTH_SOCK" -a -n "$XDG_RUNTIME_DIR" ]; then
+          export SSH_AUTH_SOCK="$XDG_RUNTIME_DIR/yubikey-agent/yubikey-agent.sock"
+        fi
+      '';
+  };
+}
diff --git a/pkgs/applications/networking/cluster/terraform-compliance/default.nix b/pkgs/applications/networking/cluster/terraform-compliance/default.nix
@@ -0,0 +1,56 @@
+{ lib
+, GitPython
+, buildPythonApplication
+, emoji
+, fetchFromGitHub
+, filetype
+, ipython
+, junit-xml
+, lxml
+, mock
+, netaddr
+, pytestCheckHook
+, python3Packages
+, radish-bdd
+, semver
+}:
+
+buildPythonApplication rec {
+  pname = "terraform-compliance";
+  version = "1.2.11";
+
+  # No tests in Pypi package
+  src = fetchFromGitHub {
+    owner = "eerkunt";
+    repo = pname;
+    rev = version;
+    sha256 = "161mszmxqp3wypnda48ama2mmq8yjilkxahwc1mxjwzy1n19sn7v";
+  };
+
+  checkInputs = [ pytestCheckHook ];
+
+  disabledTests = [
+    "test_which_success"
+    "test_readable_plan_file_is_not_json"
+  ];
+
+  propagatedBuildInputs = [
+    GitPython
+    emoji
+    filetype
+    ipython
+    junit-xml
+    lxml
+    mock
+    netaddr
+    radish-bdd
+    semver
+  ];
+
+  meta = with lib; {
+    description = "BDD test framework for terraform";
+    homepage = https://github.com/eerkunt/terraform-compliance;
+    license = licenses.mit;
+    maintainers = with maintainers; [ kalbasit ];
+  };
+}
diff --git a/pkgs/development/libraries/oneDNN/default.nix b/pkgs/development/libraries/oneDNN/default.nix
@@ -24,6 +24,9 @@ stdenv.mkDerivation rec {
   preCheck = ''
     export LD_LIBRARY_PATH=$LD_LIBRARY_PATH''${LD_LIBRARY_PATH:+:}$PWD/src
     export DYLD_LIBRARY_PATH=$DYLD_LIBRARY_PATH''${DYLD_LIBRARY_PATH:+:}$PWD/src
+  '' + lib.optionalString stdenv.isx86_64 ''
+    # Use baseline SIMD in case CPU features get misdetected.
+    export DNNL_MAX_CPU_ISA=SSE41
   '';
 
   # The cmake install gets tripped up and installs a nix tree into $out, in

diff --git a/pkgs/development/python-modules/colorful/default.nix b/pkgs/development/python-modules/colorful/default.nix
@@ -0,0 +1,27 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "colorful";
+  version = "0.5.4";
+
+  # No tests in the Pypi package.
+  src = fetchFromGitHub {
+    owner = "timofurrer";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "1fcz5v8b318a3dsdha4c874jsf3wmcw3f25bv2csixclyzacli98";
+  };
+
+  checkInputs = [ pytestCheckHook ];
+
+  meta = with lib; {
+    description = "Terminal string styling done right, in Python.";
+    homepage = "http://github.com/timofurrer/colorful";
+    license = licenses.mit;
+    maintainers = with maintainers; [ kalbasit ];
+  };
+}
diff --git a/pkgs/development/python-modules/pysingleton/default.nix b/pkgs/development/python-modules/pysingleton/default.nix
@@ -0,0 +1,26 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+}:
+
+buildPythonPackage rec {
+  pname = "pysingleton";
+  version = "0.2.1";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "5776e7a4ba0bab26709da604f4e648c5814385fef34010723db3da0d41b0dbcc";
+  };
+
+  pythonImportsCheck = [ "singleton" ];
+
+  # No tests in the Pypi package.
+  doCheck = false;
+
+  meta = with lib; {
+    description = "Provides a decorator to create thread-safe singleton classes";
+    homepage = "https://github.com/timofurrer/pysingleton";
+    license = licenses.mit;
+    maintainers = with maintainers; [ kalbasit ];
+  };
+}
diff --git a/pkgs/development/python-modules/radish-bdd/default.nix b/pkgs/development/python-modules/radish-bdd/default.nix
@@ -0,0 +1,52 @@
+{ lib
+, buildPythonPackage
+, click
+, colorful
+, docopt
+, fetchFromGitHub
+, freezegun
+, humanize
+, lark-parser
+, parse-type
+, pysingleton
+, pytestCheckHook
+, pyyaml
+, tag-expressions
+, lxml
+, pytest-mock
+}:
+
+buildPythonPackage rec {
+  pname = "radish-bdd";
+  version = "0.13.2";
+
+  # Pypi package does not have necessary test fixtures.
+  src = fetchFromGitHub {
+    owner = pname;
+    repo = "radish";
+    rev = "v${version}";
+    sha256 = "1k7l0j8w221pa6k990x4rfm7km4asx5zy4zpzvh029lb9nw2pp8b";
+  };
+
+  propagatedBuildInputs = [
+    lark-parser
+    click
+    colorful
+    tag-expressions
+    parse-type
+    humanize
+    pyyaml
+    docopt
+    pysingleton
+  ];
+
+  checkInputs = [ freezegun lxml pytestCheckHook pytest-mock ];
+  disabledTests = [ "test_main_cli_calls" ];
+
+  meta = with lib; {
+    description = "Behaviour-Driven-Development tool for python";
+    homepage = "http://radish-bdd.io";
+    license = licenses.mit;
+    maintainers = with maintainers; [ kalbasit ];
+  };
+}
diff --git a/pkgs/development/python-modules/tag-expressions/default.nix b/pkgs/development/python-modules/tag-expressions/default.nix
@@ -0,0 +1,24 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "tag-expressions";
+  version = "1.1.0";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "1c0a49c3c0357976822b03c43db8d4a1c5548e16fb07ac939c10bbd5183f529d";
+  };
+
+  checkInputs = [ pytestCheckHook ];
+
+  meta = with lib; {
+    description = "Package to parse logical tag expressions";
+    homepage = "http://github.com/timofurrer/tag-expressions";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ kalbasit ];
+  };
+}
diff --git a/pkgs/development/tools/bazel-gazelle/default.nix b/pkgs/development/tools/bazel-gazelle/default.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "bazel-gazelle";
-  version = "0.20.0";
+  version = "0.21.1";
 
   src = fetchFromGitHub {
     owner = "bazelbuild";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1rw9zq8rmc0zr91kk70xl67dl6jx4dswwisv3bd1f16yncqgv2a1";
+    sha256 = "12ffrildgx4lah7bdnhr7i8z5jp05lll6gmmpzshmzz8dsgf39y4";
   };
 
   vendorSha256 = null;
@@ -28,4 +28,4 @@ buildGoModule rec {
     license = licenses.asl20;
     maintainers = with maintainers; [ kalbasit ];
   };
-}
+}
diff --git a/pkgs/development/tools/just/default.nix b/pkgs/development/tools/just/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "just";
-  version = "0.6.0";
+  version = "0.7.1";
 
   src = fetchFromGitHub {
     owner = "casey";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1sl235wr4fdsw0f0x7jynv6ljhvgis4d87xzpvjzajhdaappdp8d";
+    sha256 = "07fjixz8y5rxfwpyr1kiimnn27jhc20gacd17i0yvfcpy5qf8z5p";
   };
 
-  cargoSha256 = "0k3aqwvdm95403s279gkksklnikgyjpf5qvngsvsrm5xqda438jk";
+  cargoSha256 = "1zn0kiqi8p25lscjd661gczay631nwzadl36cfzqnbww6blayy1j";
 
   nativeBuildInputs = [ installShellFiles ];
 
@@ -40,16 +40,7 @@ rustPlatform.buildRustPackage rec {
 
   # Skip "edit" when running "cargo test",
   # since this test case needs "cat".
-  checkPhase = ''
-    runHook preCheck
-    echo "Running cargo test --
-        --skip edit
-        ''${checkFlags} ''${checkFlagsArray+''${checkFlagsArray[@]}}"
-    cargo test -- \
-        --skip edit \
-        ''${checkFlags} ''${checkFlagsArray+"''${checkFlagsArray[@]}"}
-    runHook postCheck
-  '';
+  checkFlagsArray = [ "--skip=edit" ];
 
   meta = with stdenv.lib; {
     description = "A handy way to save and run project-specific commands";