NixOS · Nov 19, 2019 · Nov 26, 2019 · Apr 3, 2020 · Apr 3, 2020 · Apr 3, 2020
diff --git a/nixos/modules/profiles/hardened.nix b/nixos/modules/profiles/hardened.nix
@@ -14,12 +14,17 @@ with lib;
 
   nix.allowedUsers = mkDefault [ "@users" ];
 
+  environment.memoryAllocator.provider = mkDefault "scudo";
+  environment.variables.SCUDO_OPTIONS = mkDefault "ZeroContents=1";
+
   security.hideProcessInformation = mkDefault true;
 
   security.lockKernelModules = mkDefault true;
 
   security.allowUserNamespaces = mkDefault false;
 
+  nix.useSandbox = mkDefault false;
+
   security.protectKernelImage = mkDefault true;
 
   security.allowSimultaneousMultithreading = mkDefault false;

diff --git a/pkgs/applications/networking/cluster/prow/13918-fix-go-sum.patch b/pkgs/applications/networking/cluster/prow/13918-fix-go-sum.patch
diff --git a/pkgs/applications/networking/cluster/prow/default.nix b/pkgs/applications/networking/cluster/prow/default.nix
@@ -2,56 +2,51 @@
 
 buildGoModule rec {
   pname = "prow-unstable";
-  version = "2019-08-14";
-  rev = "35a7744f5737bbc1c4e1256a9c9c5ad135c650e4";
+  version = "2020-04-01";
+  rev = "32e3b5ce7695fb622381421653db436cb57b47c5";
 
   src = fetchFromGitHub {
     inherit rev;
 
     owner = "kubernetes";
     repo = "test-infra";
-    sha256 = "07kdlzrj59xyaa73vlx4s50fpg0brrkb0h0cyjgx81a0hsc7s03k";
+    sha256 = "0mc3ynmbf3kidibdy8k3v3xjlvmxl8w7zm1z2m0skmhd0y4bpmk4";
   };
 
-  patches = [
-    # https://github.com/kubernetes/test-infra/pull/13918
-    ./13918-fix-go-sum.patch
-  ];
-
-  modSha256 = "06q1zvhm78k64aj475k1xl38h7nk83mysd0bja0wknja048ymgsq";
+  modSha256 = "1xajdg10a27icc7g1y3ym4pkgg64rp4afybbjlhbg3k3whir9xa1";
 
   subPackages = [
-    "./prow/cmd/admission"
-    "./prow/cmd/artifact-uploader"
-    "./prow/cmd/branchprotector"
-    "./prow/cmd/build"
-    "./prow/cmd/checkconfig"
-    "./prow/cmd/clonerefs"
-    "./prow/cmd/config-bootstrapper"
-    "./prow/cmd/crier"
-    "./prow/cmd/deck"
-    "./prow/cmd/entrypoint"
-    "./prow/cmd/gcsupload"
-    "./prow/cmd/gerrit"
-    "./prow/cmd/hook"
-    "./prow/cmd/horologium"
-    "./prow/cmd/initupload"
-    "./prow/cmd/jenkins-operator"
-    "./prow/cmd/mkbuild-cluster"
-    "./prow/cmd/mkpj"
-    "./prow/cmd/mkpod"
-    "./prow/cmd/peribolos"
-    "./prow/cmd/phaino"
-    "./prow/cmd/phony"
-    "./prow/cmd/pipeline"
-    "./prow/cmd/plank"
-    "./prow/cmd/sidecar"
-    "./prow/cmd/sinker"
-    "./prow/cmd/status-reconciler"
-    "./prow/cmd/sub"
-    "./prow/cmd/tackle"
-    "./prow/cmd/tide"
-    "./prow/cmd/tot"
+    "prow/cmd/admission"
+    "prow/cmd/branchprotector"
+    "prow/cmd/checkconfig"
+    "prow/cmd/clonerefs"
+    "prow/cmd/cm2kc"
+    "prow/cmd/config-bootstrapper"
+    "prow/cmd/crier"
+    "prow/cmd/deck"
+    "prow/cmd/entrypoint"
+    "prow/cmd/exporter"
+    "prow/cmd/gcsupload"
+    "prow/cmd/gerrit"
+    "prow/cmd/hook"
+    "prow/cmd/horologium"
+    "prow/cmd/initupload"
+    "prow/cmd/jenkins-operator"
+    "prow/cmd/mkbuild-cluster"
+    "prow/cmd/mkpj"
+    "prow/cmd/mkpod"
+    "prow/cmd/peribolos"
+    "prow/cmd/phaino"
+    "prow/cmd/phony"
+    "prow/cmd/pipeline"
+    "prow/cmd/plank"
+    "prow/cmd/sidecar"
+    "prow/cmd/sinker"
+    "prow/cmd/status-reconciler"
+    "prow/cmd/sub"
+    "prow/cmd/tackle"
+    "prow/cmd/tide"
+    "prow/cmd/tot"
   ];
 
   meta = with lib; {

diff --git a/pkgs/data/misc/hackage/default.nix b/pkgs/data/misc/hackage/default.nix
@@ -1,6 +1,6 @@
 { fetchurl }:
 
 fetchurl {
-  url = "https://github.com/commercialhaskell/all-cabal-hashes/archive/e0bc864e0b6edb5e5ce1ec4bfa763a442b343bf5.tar.gz";
-  sha256 = "1lmjxam58srrv9cjqajqz4bishx8hy99db3cx83i95qb3qiiiz6m";
+  url = "https://github.com/commercialhaskell/all-cabal-hashes/archive/90b24a91103dca4f0df6cb28cecb205a7d7ab650.tar.gz";
+  sha256 = "1zfj8c6s9icqg83ycfvd150s4jd07ccbjg2w2mn10rx5ng76mn53";
 }
diff --git a/pkgs/development/compilers/nim/default.nix b/pkgs/development/compilers/nim/default.nix
@@ -5,11 +5,11 @@
 
 stdenv.mkDerivation rec {
   pname = "nim";
-  version = "1.0.6";
+  version = "1.2.0";
 
   src = fetchurl {
     url = "https://nim-lang.org/download/${pname}-${version}.tar.xz";
-    sha256 = "1cv6bxc7w21455c0pv0r2h64ljyzw266jsk1fsgiiyk2rx8mfkhk";
+    sha256 = "TpRYOjc5ZYIYBeZl4KBfUvthCRZnbtsJFIlBQVY3xXU=";
   };
 
   enableParallelBuilding = true;

diff --git a/pkgs/development/haskell-modules/configuration-common.nix b/pkgs/development/haskell-modules/configuration-common.nix
@@ -37,9 +37,6 @@ self: super: {
   # compiled on Linux. We provide the name to avoid evaluation errors.
   unbuildable = throw "package depends on meta package 'unbuildable'";
 
-  # The test suite depends on old versions of tasty and QuickCheck.
-  hackage-security = dontCheck super.hackage-security;
-
   # enable using a local hoogle with extra packagages in the database
   # nix-shell -p "haskellPackages.hoogleLocal { packages = with haskellPackages; [ mtl lens ]; }"
   # $ hoogle server
@@ -86,7 +83,7 @@ self: super: {
       name = "git-annex-${super.git-annex.version}-src";
       url = "git://git-annex.branchable.com/";
       rev = "refs/tags/" + super.git-annex.version;
-      sha256 = "0y2qcjahi705c6nnypqpa5w3bzyzk4kqvbwfnpiaxzk5vna589gg";
+      sha256 = "1jjw6ar8ddcncwzksyx2xky50sm2jg1zjr7iiqk0vn8qq0fn2gwy";
     };
   }).override {
     dbus = if pkgs.stdenv.isLinux then self.dbus else null;
@@ -326,6 +323,7 @@ self: super: {
   hs2048 = dontCheck super.hs2048;
   hsbencher = dontCheck super.hsbencher;
   hsexif = dontCheck super.hsexif;
+  hspec-core = if pkgs.stdenv.isi686 then dontCheck super.hspec-core else super.hspec-core; # tests rely on `Int` being 64-bit; https://github.com/hspec/hspec/issues/431
   hspec-server = dontCheck super.hspec-server;
   HTF = dontCheck super.HTF;
   htsn = dontCheck super.htsn;
@@ -359,7 +357,6 @@ self: super: {
   optional = dontCheck super.optional;
   orgmode-parse = dontCheck super.orgmode-parse;
   os-release = dontCheck super.os-release;
-  pandoc-crossref = dontCheck super.pandoc-crossref;  # (most likely change when no longer 0.3.2.1) https://github.com/lierdakil/pandoc-crossref/issues/199
   persistent-redis = dontCheck super.persistent-redis;
   pipes-extra = dontCheck super.pipes-extra;
   pipes-websockets = dontCheck super.pipes-websockets;
@@ -1192,10 +1189,10 @@ self: super: {
   });
 
   # Remove unecessary constraint:
-  # https://github.com/agrafix/superbuffer/pull/2
-  superbuffer = overrideCabal super.superbuffer (drv: {
+  # https://github.com/haskell-infra/hackage-trustees/issues/258
+  data-accessor-template = overrideCabal super.data-accessor-template (drv: {
     postPatch = ''
-      sed -i 's#QuickCheck < 2.10#QuickCheck < 2.13#' superbuffer.cabal
+      sed -i 's#template-haskell >=2.11 && <2.15#template-haskell#' data-accessor-template.cabal
     '';
   });
 
@@ -1344,7 +1341,7 @@ self: super: {
   });
 
   # cabal-fmt requires Cabal3
-  cabal-fmt = super.cabal-fmt.override { Cabal = self.Cabal_3_0_0_0; };
+  cabal-fmt = super.cabal-fmt.override { Cabal = self.Cabal_3_2_0_0; };
 
   # Several gtk2hs-provided packages at v0.13.8.0 fail to build on Darwin
   # until we pick up https://github.com/gtk2hs/gtk2hs/pull/293 so apply that
@@ -1463,6 +1460,11 @@ self: super: {
   # haskell-ci-0.8 needs cabal-install-parsers ==0.1, but we have 0.2.
   haskell-ci = doJailbreak super.haskell-ci;
 
+  # Needs the latest version of vty.
+  matterhorn = super.matterhorn.overrideScope (self: super: {
+    vty = self.vty_5_28_2;
+  });
+
   persistent-mysql = dontCheck super.persistent-mysql;
 
   # Fix EdisonAPI and EdisonCore for GHC 8.8:
@@ -1488,4 +1490,16 @@ self: super: {
   # Needs a version that's newer than LTS-15.x provides.
   weeder = super.weeder.override { generic-lens = self.generic-lens_2_0_0_0;  };
 
+  polysemy-plugin = super.polysemy-plugin.override {
+    # polysemy-plugin 0.2.5.0 has constraint ghc-tcplugins-extra (==0.3.*)
+    # This upstream issue is relevant:
+    # https://github.com/polysemy-research/polysemy/issues/322
+    ghc-tcplugins-extra = self.ghc-tcplugins-extra_0_3_2;
+    # version of Polysemy the plugin goes with
+    polysemy = self.polysemy_1_3_0_0;
+  };
+
+  # Fixed at head, but hasn't cut a release in awhile.
+  darcs = doJailbreak super.darcs;
+
 } // import ./configuration-tensorflow.nix {inherit pkgs haskellLib;} self super
diff --git a/pkgs/development/haskell-modules/configuration-ghc-8.2.x.nix b/pkgs/development/haskell-modules/configuration-ghc-8.2.x.nix
@@ -44,7 +44,7 @@ self: super: {
   text = self.text_1_2_4_0;
 
   # Needs Cabal 3.0.x.
-  jailbreak-cabal = super.jailbreak-cabal.override { Cabal = self.Cabal_3_0_0_0; };
+  jailbreak-cabal = super.jailbreak-cabal.override { Cabal = self.Cabal_3_2_0_0; };
 
   # https://github.com/bmillwood/applicative-quoters/issues/6
   applicative-quoters = appendPatch super.applicative-quoters (pkgs.fetchpatch {

diff --git a/pkgs/development/haskell-modules/configuration-ghc-8.4.x.nix b/pkgs/development/haskell-modules/configuration-ghc-8.4.x.nix
@@ -40,9 +40,9 @@ self: super: {
   unix = null;
   xhtml = null;
 
-  # Needs Cabal 3.0.x.
-  cabal-install = super.cabal-install.overrideScope (self: super: { Cabal = self.Cabal_3_0_0_0; });
-  jailbreak-cabal = super.jailbreak-cabal.override { Cabal = self.Cabal_3_0_0_0; };
+  # Needs Cabal 3.2.x.
+  cabal-install = super.cabal-install.overrideScope (self: super: { Cabal = self.Cabal_3_2_0_0; });
+  jailbreak-cabal = super.jailbreak-cabal.override { Cabal = self.Cabal_3_2_0_0; };
 
   # Restricts aeson to <1.4
   # https://github.com/purescript/purescript/pull/3537

diff --git a/pkgs/development/haskell-modules/configuration-ghc-8.6.x.nix b/pkgs/development/haskell-modules/configuration-ghc-8.6.x.nix
@@ -42,8 +42,8 @@ self: super: {
   xhtml = null;
 
   # Needs Cabal 3.0.x.
-  cabal-install = super.cabal-install.overrideScope (self: super: { Cabal = self.Cabal_3_0_0_0; });
-  jailbreak-cabal = super.jailbreak-cabal.override { Cabal = self.Cabal_3_0_0_0; };
+  cabal-install = super.cabal-install.overrideScope (self: super: { Cabal = self.Cabal_3_2_0_0; });
+  jailbreak-cabal = super.jailbreak-cabal.override { Cabal = self.Cabal_3_2_0_0; };
 
   # https://github.com/tibbe/unordered-containers/issues/214
   unordered-containers = dontCheck super.unordered-containers;
@@ -76,12 +76,10 @@ self: super: {
 
   # cabal2nix needs the latest version of Cabal, and the one
   # hackage-db uses must match, so take the latest
-  cabal2nix = super.cabal2nix.overrideScope (self: super: {
-    Cabal = self.Cabal_3_0_0_0;
-  });
+  cabal2nix = super.cabal2nix.overrideScope (self: super: { Cabal = self.Cabal_3_2_0_0; });
 
   # cabal2spec needs a recent version of Cabal
-  cabal2spec = super.cabal2spec.overrideScope (self: super: { Cabal = self.Cabal_3_0_0_0; });
+  cabal2spec = super.cabal2spec.overrideScope (self: super: { Cabal = self.Cabal_3_2_0_0; });
 
   # Builds only with ghc-8.8.x and beyond.
   policeman = markBroken super.policeman;

diff --git a/pkgs/development/haskell-modules/configuration-ghc-8.8.x.nix b/pkgs/development/haskell-modules/configuration-ghc-8.8.x.nix
@@ -41,10 +41,13 @@ self: super: {
   unix = null;
   xhtml = null;
 
+  # These builds need Cabal 3.2.x.
+  cabal2spec = super.cabal2spec.override { Cabal = self.Cabal_3_2_0_0; };
+  cabal-install = super.cabal-install.overrideScope (self: super: { Cabal = self.Cabal_3_2_0_0; });
+
   # Ignore overly restrictive upper version bounds.
   aeson-diff = doJailbreak super.aeson-diff;
   async = doJailbreak super.async;
-  cabal-install = doJailbreak super.cabal-install;
   ChasingBottoms = doJailbreak super.ChasingBottoms;
   chell = doJailbreak super.chell;
   cryptohash-sha256 = doJailbreak super.cryptohash-sha256;
@@ -72,12 +75,6 @@ self: super: {
   time-compat = doJailbreak super.time-compat;
   http-media = doJailbreak super.http-media;
   servant-server = doJailbreak super.servant-server;
-
-  # These packages don't work and need patching and/or an update.
-  hackage-security = appendPatch (doJailbreak super.hackage-security) (pkgs.fetchpatch {
-    url = "https://raw.githubusercontent.com/hvr/head.hackage/master/patches/hackage-security-0.5.3.0.patch";
-    sha256 = "0l8x0pbsn18fj5ak5q0g5rva4xw1s9yc4d86a1pfyaz467b9i5a4";
-  });
   foundation = dontCheck super.foundation;
   vault = dontHaddock super.vault;