NixOS · Jul 30, 2020 · Jul 30, 2020 · Jul 31, 2020 · Jul 31, 2020 · Jul 31, 2020
diff --git a/.github/workflows/editorconfig.yml b/.github/workflows/editorconfig.yml
@@ -10,7 +10,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v2
-    - uses: technote-space/get-diff-action@v1.2.8
+    - uses: technote-space/get-diff-action@v2.0.2
     - name: editorconfig check
       env:
         VERSION: "2.0.4"

diff --git a/nixos/tests/docker-tools.nix b/nixos/tests/docker-tools.nix
@@ -79,6 +79,16 @@ import ./make-test-python.nix ({ pkgs, ... }: {
             "docker rmi ${examples.nix.imageName}",
         )
 
+    with subtest(
+        "Ensure (layered) nix store has correct permissions "
+        "and that the container starts when its process does not have uid 0"
+    ):
+        docker.succeed(
+            "docker load --input='${examples.bashLayeredWithUser}'",
+            "docker run -u somebody --rm ${examples.bashLayeredWithUser.imageName} ${pkgs.bash}/bin/bash -c 'test 555 == $(stat --format=%a /nix) && test 555 == $(stat --format=%a /nix/store)'",
+            "docker rmi ${examples.bashLayeredWithUser.imageName}",
+        )
+
     with subtest("The nix binary symlinks are intact"):
         docker.succeed(
             "docker load --input='${examples.nix}'",

diff --git a/pkgs/applications/audio/lmms/default.nix b/pkgs/applications/audio/lmms/default.nix
@@ -5,13 +5,13 @@
 
 mkDerivation rec {
   pname = "lmms";
-  version = "1.2.1";
+  version = "1.2.2";
 
   src = fetchFromGitHub {
     owner = "LMMS";
     repo = "lmms";
     rev = "v${version}";
-    sha256 = "08k2nfj0rw9mahr7pr90n79wviqmjmflrgcljc6y3x30v84wbp26";
+    sha256 = "006hwv1pbh3y5whsxkjk20hsbgwkzr4dawz43afq1gil69y7xpda";
     fetchSubmodules = true;
   };
 

diff --git a/pkgs/applications/audio/muse/default.nix b/pkgs/applications/audio/muse/default.nix
@@ -5,13 +5,13 @@
 
 stdenv.mkDerivation rec {
   pname = "muse-sequencer";
-  version = "3.1.0";
+  version = "3.1.1";
 
   src = fetchFromGitHub {
     owner = "muse-sequencer";
     repo = "muse";
     rev = "muse_${builtins.replaceStrings ["."] ["_"] version}";
-    sha256 = "08k25652w88xf2i79lw305x1phpk7idrww9jkqwcs8q6wzgmz8aq";
+    sha256 = "1rasp2v1ds2aw296lbf27rzw0l9fjl0cvbvw85d5ycvh6wkm301p";
   };
 
   sourceRoot = "source/muse3";

diff --git a/pkgs/applications/editors/nano/default.nix b/pkgs/applications/editors/nano/default.nix
@@ -20,11 +20,11 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "nano";
-  version = "4.9.3";
+  version = "5.0";
 
   src = fetchurl {
     url = "mirror://gnu/nano/${pname}-${version}.tar.xz";
-    sha256 = "1d2i3wvsq5lvpxxinq51dcvd58xx7j0d0c2csz9hgvd06gq3hd3f";
+    sha256 = "0dmagj4p1llb1a2w0iwdrqbd9cgp0bda4s18vwh6y1ndd6z983bw";
   };
 
   nativeBuildInputs = [ texinfo ] ++ optional enableNls gettext;

diff --git a/pkgs/applications/misc/pueue/default.nix b/pkgs/applications/misc/pueue/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "pueue";
-  version = "0.6.1";
+  version = "0.7.1";
 
   src = fetchFromGitHub {
     owner = "Nukesor";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0x8slqxpnk4pis834g11wzp8fqsxwhdf0xnssz1pkkww4dqzali0";
+    sha256 = "1ksks8c35q9aq5vnjxh480vqjyaa8c1fz1fb465vngnlyw762b22";
   };
 
-  cargoSha256 = "0r110zlzpzg0j5cq9zg0kk46qigp6bzd0kzmpx3ddvhblhxvq5m5";
+  cargoSha256 = "0v1h4jhrzfb55zmpnbq18188rdvx7a7lvnjqh0w7cy90kvxssian";
 
   nativeBuildInputs = [ installShellFiles ];
 

diff --git a/pkgs/applications/networking/instant-messengers/discord/default.nix b/pkgs/applications/networking/instant-messengers/discord/default.nix
@@ -17,20 +17,20 @@ in {
     pname = "discord-ptb";
     binaryName = "DiscordPTB";
     desktopName = "Discord PTB";
-    version = "0.0.19";
+    version = "0.0.20";
     src = fetchurl {
       url = "https://dl-ptb.discordapp.net/apps/linux/${version}/discord-ptb-${version}.tar.gz";
-      sha256 = "0wixmm16qsmgbr0l9144vl5pc3s2p4jqhl7cnc6kmgy1y4ig56ib";
+      sha256 = "0wn2qdv0a4n59xl451y7fcq11klp2g63qwx40qkshllvnf5lzzsx";
     };
   };
   canary = callPackage ./base.nix rec {
     pname = "discord-canary";
     binaryName = "DiscordCanary";
     desktopName = "Discord Canary";
-    version = "0.0.104";
+    version = "0.0.105";
     src = fetchurl {
       url = "https://dl-canary.discordapp.net/apps/linux/${version}/discord-canary-${version}.tar.gz";
-      sha256 = "17np1hqqygjlbmlln0d1ba2qlbjykwj156w5dw7g4lg77kfxicfk";
+      sha256 = "1jc2zr8q33ras5mkifg19kcxpb84vsqx01rj66w62hsjw1nsbidg";
     };
   };
 }.${branch}
diff --git a/pkgs/build-support/docker/examples.nix b/pkgs/build-support/docker/examples.nix
@@ -382,4 +382,40 @@ rec {
     contents = pkgs.bashInteractive;
   };
 
+  # buildLayeredImage with non-root user
+  bashLayeredWithUser =
+  let
+    nonRootShadowSetup = { user, uid, gid ? uid }: with pkgs; [
+      (
+      writeTextDir "etc/shadow" ''
+        root:!x:::::::
+        ${user}:!:::::::
+      ''
+      )
+      (
+      writeTextDir "etc/passwd" ''
+        root:x:0:0::/root:${runtimeShell}
+        ${user}:x:${toString uid}:${toString gid}::/home/${user}:
+      ''
+      )
+      (
+      writeTextDir "etc/group" ''
+        root:x:0:
+        ${user}:x:${toString gid}:
+      ''
+      )
+      (
+      writeTextDir "etc/gshadow" ''
+        root:x::
+        ${user}:x::
+      ''
+      )
+    ];
+  in
+    pkgs.dockerTools.buildLayeredImage {
+      name = "bash-layered-with-user";
+      tag = "latest";
+      contents = [ pkgs.bash pkgs.coreutils (nonRootShadowSetup { uid = 999; user = "somebody"; }) ];
+    };
+
 }
diff --git a/pkgs/build-support/docker/stream_layered_image.py b/pkgs/build-support/docker/stream_layered_image.py
@@ -74,6 +74,10 @@ def apply_filters(ti):
         ti.gname = "root"
         return filter(ti)
 
+    def nix_root(ti):
+        ti.mode = 0o0555  # r-xr-xr-x
+        return ti
+
     def dir(path):
         ti = tarfile.TarInfo(path)
         ti.type = tarfile.DIRTYPE
@@ -84,8 +88,8 @@ def dir(path):
         # these directories first when building layer tarballs. But
         # we don't need them on the customisation layer.
         if add_nix:
-            tar.addfile(apply_filters(dir("/nix")))
-            tar.addfile(apply_filters(dir("/nix/store")))
+            tar.addfile(apply_filters(nix_root(dir("/nix"))))
+            tar.addfile(apply_filters(nix_root(dir("/nix/store"))))
 
         for path in paths:
             path = pathlib.Path(path)

diff --git a/pkgs/desktops/gnome-3/extensions/gsconnect/default.nix b/pkgs/desktops/gnome-3/extensions/gsconnect/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-shell-gsconnect";
-  version = "38";
+  version = "39";
 
   src = fetchFromGitHub {
     owner = "andyholmes";
     repo = "gnome-shell-extension-gsconnect";
     rev = "v${version}";
-    sha256 = "1z5wn3n1sqc2xdxiq0g3dkga7srz5ak41qdyjsh9pzb5x93dxzi5";
+    sha256 = "0d2wypf36p95v756arf06gfilpb48gp55i1xbqnqvcd10n3q4zc2";
   };
 
   patches = [

diff --git a/pkgs/development/libraries/mimetic/default.nix b/pkgs/development/libraries/mimetic/default.nix
@@ -11,6 +11,8 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ cutee ];
 
+  patches = stdenv.lib.optional stdenv.isAarch64 ./narrowing.patch;
+
   meta = with stdenv.lib; {
     description = "MIME handling library";
     homepage    = "http://www.codesink.org/mimetic_mime_library.html";

diff --git a/pkgs/development/libraries/mimetic/narrowing.patch b/pkgs/development/libraries/mimetic/narrowing.patch
@@ -0,0 +1,32 @@
+diff -ru a/mimetic/codec/base64.cxx b/mimetic/codec/base64.cxx
+--- a/mimetic/codec/base64.cxx	2014-06-17 10:12:00.000000000 +0200
++++ b/mimetic/codec/base64.cxx	2020-07-30 20:54:10.212742011 +0200
+@@ -14,19 +14,19 @@
+     "0123456789+/=";
+
+ const char Base64::sDecTable[] = {
+-        -1,-1,-1,-1,-1,-1,-1,-1,-1,-1,
+-        -1,-1,-1,-1,-1,-1,-1,-1,-1,-1,
+-        -1,-1,-1,-1,-1,-1,-1,-1,-1,-1,
+-        -1,-1,-1,-1,-1,-1,-1,-1,-1,-1,
+-        -1,-1,-1,62,-1,-1,-1,63,52,53,
+-        54,55,56,57,58,59,60,61,-1,-1,
+-        -1, eq_sign, -1,-1,-1, 0, 1, 2, 3, 4, 
++        255,255,255,255,255,255,255,255,255,255,
++        255,255,255,255,255,255,255,255,255,255,
++        255,255,255,255,255,255,255,255,255,255,
++        255,255,255,255,255,255,255,255,255,255,
++        255,255,255,62,255,255,255,63,52,53,
++        54,55,56,57,58,59,60,61,255,255,
++        255, eq_sign, 255,255,255, 0, 1, 2, 3, 4, 
+          5, 6, 7, 8, 9,10,11,12,13,14,
+         15,16,17,18,19,20,21,22,23,24,
+-        25,-1,-1,-1,-1,-1,-1,26,27,28,
++        25,255,255,255,255,255,255,26,27,28,
+         29,30,31,32,33,34,35,36,37,38,
+         39,40,41,42,43,44,45,46,47,48,
+-        49,50,51,-1
++        49,50,51,255
+ };
+
+ const int Base64::sDecTableSz = sizeof(Base64::sDecTable) / sizeof(char);
diff --git a/pkgs/development/python-modules/chart-studio/default.nix b/pkgs/development/python-modules/chart-studio/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "chart-studio";
-  version = "1.0.0";
+  version = "1.1.0";
 
   # chart-studio was split from plotly
   src = fetchFromGitHub {
     owner = "plotly";
     repo = "plotly.py";
     rev = "${pname}-v${version}";
-    sha256 = "14lyqbjdffnlnkzlfnn60k7yxjd99vx3hfcs23apsiyinzipjlbf";
+    sha256 = "1q3j3ih5k0jhr8ilwffkfxp1nifpnjnx7862bzhxfg4d386hfg4i";
   };
 
   sourceRoot = "source/packages/python/chart-studio";

diff --git a/pkgs/development/python-modules/colorlog/default.nix b/pkgs/development/python-modules/colorlog/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "colorlog";
-  version = "4.1.0";
+  version = "4.2.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1lpk8zmfv8vz090h5d0hzb4n39wgasxdd3x3bpn3v1x1n9dfzaih";
+    sha256 = "066i7904vc7814gqnlprksf0ikz2dmviw93r2mr7sf53qci5irbm";
   };
 
   checkInputs = [ pytest ];

diff --git a/pkgs/development/python-modules/statsmodels/default.nix b/pkgs/development/python-modules/statsmodels/default.nix
@@ -14,6 +14,7 @@
 buildPythonPackage rec {
   pname = "statsmodels";
   version = "0.11.1";
+  disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;

diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
@@ -9640,6 +9640,8 @@ in
 
   dhall-json = haskell.lib.justStaticExecutables haskellPackages.dhall-json;
 
+  dhall-lsp-server = haskell.lib.justStaticExecutables haskellPackages.dhall-lsp-server;
+
   dhall-text = haskell.lib.justStaticExecutables haskellPackages.dhall-text;
 
   dhallPackages = callPackages ./dhall-packages.nix { };