NixOS · Jul 1, 2020 · Jul 5, 2020 · Jul 5, 2020 · Jul 5, 2020 · Jul 5, 2020
diff --git a/nixos/doc/manual/release-notes/rl-2009.xml b/nixos/doc/manual/release-notes/rl-2009.xml
@@ -682,6 +682,12 @@ systemd.services.nginx.serviceConfig.ReadWritePaths = [ "/var/www" ];
        behaviour and keep the same VM state between different test runs.
      </para>
    </listitem>
+   <listitem>
+    <para>
+     The <link linkend="opt-nix.buildMachines">nix.buildMachines</link> option is now type-checked.
+     There are no functional changes, however this may require updating some configurations to use correct types for all attributes.
+    </para>
+   </listitem>
   </itemizedlist>
  </section>
 </section>
diff --git a/nixos/modules/services/misc/nix-daemon.nix b/nixos/modules/services/misc/nix-daemon.nix
@@ -193,50 +193,111 @@ in
       };
 
       buildMachines = mkOption {
-        type = types.listOf types.attrs;
+        type = types.listOf (types.submodule ({
+          options = {
+            hostName = mkOption {
+              type = types.str;
+              example = "nixbuilder.example.org";
+              description = ''
+                The hostname of the build machine.
+              '';
+            };
+            system = mkOption {
+              type = types.nullOr types.str;
+              default = null;
+              example = "x86_64-linux";
+              description = ''
+                The system type the build machine can execute derivations on.
+                Either this attribute or <varname>systems</varname> must be
+                present, where <varname>system</varname> takes precedence if
+                both are set.
+              '';
+            };
+            systems = mkOption {
+              type = types.listOf types.str;
+              default = [];
+              example = [ "x86_64-linux" "aarch64-linux" ];
+              description = ''
+                The system types the build machine can execute derivations on.
+                Either this attribute or <varname>system</varname> must be
+                present, where <varname>system</varname> takes precedence if
+                both are set.
+              '';
+            };
+            sshUser = mkOption {
+              type = types.nullOr types.str;
+              default = null;
+              example = "builder";
+              description = ''
+                The username to log in as on the remote host. This user must be
+                able to log in and run nix commands non-interactively. It must
+                also be privileged to build derivations, so must be included in
+                <option>nix.trustedUsers</option>.
+              '';
+            };
+            sshKey = mkOption {
+              type = types.nullOr types.str;
+              default = null;
+              example = "/root/.ssh/id_buildhost_builduser";
+              description = ''
+                The path to the SSH private key with which to authenticate on
+                the build machine. The private key must not have a passphrase.
+                If null, the building user (root on NixOS machines) must have an
+                appropriate ssh configuration to log in non-interactively.
+
+                Note that for security reasons, this path must point to a file
+                in the local filesystem, *not* to the nix store.
+              '';
+            };
+            maxJobs = mkOption {
+              type = types.int;
+              default = 1;
+              description = ''
+                The number of concurrent jobs the build machine supports. The
+                build machine will enforce its own limits, but this allows hydra
+                to schedule better since there is no work-stealing between build
+                machines.
+              '';
+            };
+            speedFactor = mkOption {
+              type = types.int;
+              default = 1;
+              description = ''
+                The relative speed of this builder. This is an arbitrary integer
+                that indicates the speed of this builder, relative to other
+                builders. Higher is faster.
+              '';
+            };
+            mandatoryFeatures = mkOption {
+              type = types.listOf types.str;
+              default = [];
+              example = [ "big-parallel" ];
+              description = ''
+                A list of features mandatory for this builder. The builder will
+                be ignored for derivations that don't require all features in
+                this list. All mandatory features are automatically included in
+                <varname>supportedFeatures</varname>.
+              '';
+            };
+            supportedFeatures = mkOption {
+              type = types.listOf types.str;
+              default = [];
+              example = [ "kvm" "big-parallel" ];
+              description = ''
+                A list of features supported by this builder. The builder will
+                be ignored for derivations that require features not in this
+                list.
+              '';
+            };
+          };
+        }));
         default = [];
-        example = literalExample ''
-          [ { hostName = "voila.labs.cs.uu.nl";
-              sshUser = "nix";
-              sshKey = "/root/.ssh/id_buildfarm";
-              system = "powerpc-darwin";
-              maxJobs = 1;
-            }
-            { hostName = "linux64.example.org";
-              sshUser = "buildfarm";
-              sshKey = "/root/.ssh/id_buildfarm";
-              system = "x86_64-linux";
-              maxJobs = 2;
-              speedFactor = 2;
-              supportedFeatures = [ "kvm" ];
-              mandatoryFeatures = [ "perf" ];
-            }
-          ]
-        '';
         description = ''
-          This option lists the machines to be used if distributed
-          builds are enabled (see
-          <option>nix.distributedBuilds</option>).  Nix will perform
-          derivations on those machines via SSH by copying the inputs
-          to the Nix store on the remote machine, starting the build,
-          then copying the output back to the local Nix store.  Each
-          element of the list should be an attribute set containing
-          the machine's host name (<varname>hostname</varname>), the
-          user name to be used for the SSH connection
-          (<varname>sshUser</varname>), the Nix system type
-          (<varname>system</varname>, e.g.,
-          <literal>"i686-linux"</literal>), the maximum number of
-          jobs to be run in parallel on that machine
-          (<varname>maxJobs</varname>), the path to the SSH private
-          key to be used to connect (<varname>sshKey</varname>), a
-          list of supported features of the machine
-          (<varname>supportedFeatures</varname>) and a list of
-          mandatory features of the machine
-          (<varname>mandatoryFeatures</varname>). The SSH private key
-          should not have a passphrase, and the corresponding public
-          key should be added to
-          <filename>~<replaceable>sshUser</replaceable>/authorized_keys</filename>
-          on the remote machine.
+          This option lists the machines to be used if distributed builds are
+          enabled (see <option>nix.distributedBuilds</option>).
+          Nix will perform derivations on those machines via SSH by copying the
+          inputs to the Nix store on the remote machine, starting the build,
+          then copying the output back to the local Nix store.
         '';
       };
 
@@ -461,14 +522,14 @@ in
       { enable = cfg.buildMachines != [];
         text =
           concatMapStrings (machine:
-            "${if machine ? sshUser then "${machine.sshUser}@" else ""}${machine.hostName} "
-            + machine.system or (concatStringsSep "," machine.systems)
-            + " ${machine.sshKey or "-"} ${toString machine.maxJobs or 1} "
-            + toString (machine.speedFactor or 1)
+            "${if machine.sshUser != null then "${machine.sshUser}@" else ""}${machine.hostName} "
+            + (if machine.system != null then machine.system else concatStringsSep "," machine.systems)
+            + " ${if machine.sshKey != null then machine.sshKey else "-"} ${toString machine.maxJobs} "
+            + toString (machine.speedFactor)
             + " "
-            + concatStringsSep "," (machine.mandatoryFeatures or [] ++ machine.supportedFeatures or [])
+            + concatStringsSep "," (machine.mandatoryFeatures ++ machine.supportedFeatures)
             + " "
-            + concatStringsSep "," machine.mandatoryFeatures or []
+            + concatStringsSep "," machine.mandatoryFeatures
             + "\n"
           ) cfg.buildMachines;
       };

diff --git a/pkgs/applications/misc/netsurf/libnsbmp/default.nix b/pkgs/applications/misc/netsurf/libnsbmp/default.nix
@@ -6,11 +6,11 @@ stdenv.mkDerivation rec {
 
   name = "netsurf-${libname}-${version}";
   libname = "libnsbmp";
-  version = "0.1.5";
+  version = "0.1.6";
 
   src = fetchurl {
     url = "http://download.netsurf-browser.org/libs/releases/${libname}-${version}-src.tar.gz";
-    sha256 = "0lib2m07d1i0k80m4blkwnj0g7rha4jbm5vrgd0wwbkyfa0hvk35";
+    sha256 = "0krjg69a2amxjsahdgm3wmy9ngnyr3gfs2a1zhdlbvb0z1jr7i3r";
   };
 
   nativeBuildInputs = [ pkgconfig ];

diff --git a/pkgs/applications/networking/browsers/firefox/packages.nix b/pkgs/applications/networking/browsers/firefox/packages.nix
@@ -35,10 +35,10 @@ rec {
 
   firefox-esr-68 = common rec {
     pname = "firefox-esr";
-    ffversion = "68.9.0esr";
+    ffversion = "68.10.0esr";
     src = fetchurl {
       url = "mirror://mozilla/firefox/releases/${ffversion}/source/firefox-${ffversion}.source.tar.xz";
-      sha512 = "mEMYANgPfGgK757t4p34IXgQkSoxmn9/jC5jfEPs1PTikiOkF6+ypjFegl+XlFP/bmtaV1ZJq6XMY85ZVjdbuA==";
+      sha512 = "xcGDNWA2SFHnz46lFlm8T7YCOblgElzbIP4x90LXV//a748xT4ANyRIU7o41gDPcKvlxwIu7pHTvYVixAYgWUw==";
     };
 
     patches = [

diff --git a/pkgs/applications/science/chemistry/marvin/default.nix b/pkgs/applications/science/chemistry/marvin/default.nix
@@ -4,12 +4,12 @@ with stdenv.lib;
 
 stdenv.mkDerivation rec {
   pname = "marvin";
-  version = "20.13.0";
+  version = "20.15.0";
 
   src = fetchurl {
     name = "marvin-${version}.deb";
     url = "http://dl.chemaxon.com/marvin/${version}/marvin_linux_${versions.majorMinor version}.deb";
-    sha256 = "1mbbl7z215l6z4acwdrmqnvlvc2hv4znz4dmng9iw7rrqns3jjlv";
+    sha256 = "0wbk69cg8zsv4c64ilgngc78dggrclmi0iphnsd15cpzrwfgsrfa";
   };
 
   nativeBuildInputs = [ dpkg makeWrapper ];

diff --git a/pkgs/applications/version-management/mercurial/default.nix b/pkgs/applications/version-management/mercurial/default.nix
@@ -8,11 +8,11 @@ let
 
 in python3Packages.buildPythonApplication rec {
   pname = "mercurial";
-  version = "5.4.1";
+  version = "5.4.2";
 
   src = fetchurl {
     url = "https://mercurial-scm.org/release/mercurial-${version}.tar.gz";
-    sha256 = "1ilam0dz121nn4852jgkgyzyrvk3hn5cqnivy8gk1qg815mh4763";
+    sha256 = "0ls8nwx3nz26pibphw54fg8pxqb365zmmqx95lqrxqqyf3d972sw";
   };
 
   format = "other";

diff --git a/pkgs/development/libraries/ldb/default.nix b/pkgs/development/libraries/ldb/default.nix
@@ -16,11 +16,11 @@
 
 stdenv.mkDerivation rec {
   pname = "ldb";
-  version = "2.1.3";
+  version = "2.1.4";
 
   src = fetchurl {
     url = "mirror://samba/ldb/${pname}-${version}.tar.gz";
-    sha256 = "0xkps414ndb87abla7dlv44ndnfg5r5vwgmkm3ngcq9knbv1x6w7";
+    sha256 = "0kmzs2s7fvar9ksaxyiqlh8q8mbwc7bxrq9w1y91zlyb23p142wy";
   };
 
   outputs = [ "out" "dev" ];

diff --git a/pkgs/development/libraries/libwebsockets/default.nix b/pkgs/development/libraries/libwebsockets/default.nix
@@ -17,7 +17,7 @@ let
     nativeBuildInputs = [ cmake ];
 
     cmakeFlags = [ "-DLWS_WITH_PLUGINS=ON" ];
-    NIX_CFLAGS_COMPILE = "-Wno-error=unused-but-set-variable";
+    NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.cc.isGNU "-Wno-error=unused-but-set-variable";
 
     meta = with stdenv.lib; {
       description = "Light, portable C library for websockets";

diff --git a/pkgs/games/crispy-doom/default.nix b/pkgs/games/crispy-doom/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, autoreconfHook, pkgconfig, SDL2, SDL2_mixer, SDL2_net, fetchFromGitHub }:
+{ stdenv, autoreconfHook, pkgconfig, SDL2, SDL2_mixer, SDL2_net, fetchFromGitHub, fetchpatch }:
 
 stdenv.mkDerivation rec {
   pname = "crispy-doom";
@@ -11,6 +11,18 @@ stdenv.mkDerivation rec {
     sha256 = "1b6gn0dysv631jynh769whww9xcss1gms78sz3nrn855q1dsvcb4";
   };
 
+  patches = [
+    # Fixes CVE-2020-14983
+    (fetchpatch {
+      url = "https://github.com/chocolate-doom/chocolate-doom/commit/f1a8d991aa8a14afcb605cf2f65cd15fda204c56.diff";
+      sha256 = "1z6pxg9azcqq7g09hjc09d01knd803nhqilkw2kbx8648hil9mgn";
+    })
+    (fetchpatch {
+      url = "https://github.com/chocolate-doom/chocolate-doom/commit/54fb12eeaa7d527defbe65e7e00e37d5feb7c597.diff";
+      sha256 = "0ww21jn02ld73rkp06f7fqy92jqv8c9q4d1mvsryag1gmvy57znj";
+    })
+  ];
+
   postPatch = ''
     sed -e 's#/games#/bin#g' -i src{,/setup}/Makefile.am
   '';

diff --git a/pkgs/games/endgame-singularity/default.nix b/pkgs/games/endgame-singularity/default.nix
@@ -1,46 +1,38 @@
-{ stdenv, fetchurl, unzip, python2 }:
+{ stdenv
+, fetchurl
+, fetchFromGitHub
+, unzip
+, python3
+, enableDefaultMusicPack ? true
+}:
 
-python2.pkgs.buildPythonApplication rec {
+python3.pkgs.buildPythonApplication rec {
   pname = "endgame-singularity";
-  version = "0.30c";
-  format = "other";
+  version = "1.00";
 
   srcs = [
-    (fetchurl {
-      url = "http://www.emhsoft.com/singularity/singularity-${version}-src.tar.gz";
-      sha256 = "13zjhf67gmla67nkfpxb01rxs8j9n4hs0s4n9lnnq4zgb709yxgl";
+    (fetchFromGitHub {
+      owner = "singularity";
+      repo = "singularity";
+      rev = "v${version}";
+      sha256 = "0ndrnxwii8lag6vrjpwpf5n36hhv223bb46d431l9gsigbizv0hl";
     })
-    (fetchurl {
+  ] ++ stdenv.lib.optional enableDefaultMusicPack (
+    fetchurl {
       url = "http://www.emhsoft.com/singularity/endgame-singularity-music-007.zip";
       sha256 = "0vf2qaf66jh56728pq1zbnw50yckjz6pf6c6qw6dl7vk60kkqnpb";
-    })
-  ];
-  sourceRoot = ".";
+    }
+  );
+  sourceRoot = "source";
 
   nativeBuildInputs = [ unzip ]; # The music is zipped
-  propagatedBuildInputs = with python2.pkgs; [ pygame numpy ];
-
-  # This is not an error: it needs both compilation rounds
-  buildPhase = ''
-    ${python2.interpreter} -m compileall "singularity-${version}"
-    ${python2.interpreter} -O -m compileall "singularity-${version}"
-  '';
-
-  installPhase = ''
-    install -Dm755 "singularity-${version}/singularity.py"  "$out/share/singularity.py"
-    install -Dm644 "singularity-${version}/singularity.pyo" "$out/share/singularity.pyo"
-    install -Dm644 "singularity-${version}/singularity.pyc" "$out/share/singularity.pyc"
-    cp -R "singularity-${version}/code" "singularity-${version}/data" "$out/share/"
-    cp -R "endgame-singularity-music-007" "$out/share/music"
-  '';
+  propagatedBuildInputs = with python3.pkgs; [ pygame numpy polib ];
 
-  # Tell it where to find python libraries
-  # Also cd to the same directory as the code, since it uses relative paths
-  postFixup = ''
-    makeWrapper "${python2.interpreter}" "$out/bin/endgame-singularity" \
-          --set PYTHONPATH "$PYTHONPATH" \
-          --run "cd \"$out/share\"" \
-          --add-flags "$out/share/singularity.py"
+  # Add the music
+  postInstall = stdenv.lib.optionalString enableDefaultMusicPack ''
+    cp -R "../endgame-singularity-music-007" \
+          "$(echo $out/lib/python*/site-packages/singularity)/music"
+          # ↑ we cannot glob on [...]/music, it doesn't exist yet
   '';
 
   meta = {

diff --git a/pkgs/servers/mpd/clientlib.nix b/pkgs/servers/mpd/clientlib.nix
@@ -1,14 +1,14 @@
 { stdenv, fetchFromGitHub, meson, ninja, fixDarwinDylibNames }:
 
 stdenv.mkDerivation rec {
-  version = "2.18";
+  version = "2.19";
   pname = "libmpdclient";
 
   src = fetchFromGitHub {
     owner  = "MusicPlayerDaemon";
     repo   = "libmpdclient";
     rev    = "v${version}";
-    sha256 = "0p2dw3jwyl34azzvr9bm7q6ni8v4ix9qr5lig62xskvrrbjfc4a6";
+    sha256 = "01agvjscdxagw6jcfx0wg81c4b6p8rh0hp3slycmjs2b835kvmq2";
   };
 
   nativeBuildInputs = [ meson ninja ]

diff --git a/pkgs/tools/networking/network-manager/libnma/default.nix b/pkgs/tools/networking/network-manager/libnma/default.nix
@@ -23,13 +23,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libnma";
-  version = "1.8.28";
+  version = "1.8.30";
 
   outputs = [ "out" "dev" "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "09mp6k0hfam1vyyv9kcd8j4gb2r58i05ipx2nswb58ris599bxja";
+    sha256 = "1d5gzn7ss5vi0bhc8s4i5gsrck1ajslajam5jxfqazg094mffcys";
   };
 
   patches = [