NixOS · May 7, 2018 · May 25, 2018 · Jun 6, 2018 · Jun 6, 2018 · Jun 6, 2018
diff --git a/doc/default.nix b/doc/default.nix
@@ -44,5 +44,6 @@ pkgs.stdenv.mkDerivation {
 
     mkdir -p $out/nix-support/
     echo "doc manual $dest manual.html" >> $out/nix-support/hydra-build-products
+    echo "doc manual $dest nixpkgs-manual.epub" >> $out/nix-support/hydra-build-products
   '';
 }
diff --git a/nixos/doc/manual/release-notes/rl-1809.xml b/nixos/doc/manual/release-notes/rl-1809.xml
@@ -121,6 +121,15 @@ $ nix-instantiate -E '(import &lt;nixpkgsunstable&gt; {}).gitFull'
      <literal>gnucash24</literal>.
     </para>
    </listitem>
+   <listitem>
+    <para>
+      The GRUB specific option <option>boot.loader.grub.extraInitrd</option>
+      has been replaced with the generic option
+      <option>boot.initrd.secrets</option>. This option creates a secondary
+      initrd from the specified files, rather than using a manually created
+      initrd file.
+    </para>
+   </listitem>
   </itemizedlist>
  </section>
 

diff --git a/nixos/modules/system/boot/loader/grub/grub.nix b/nixos/modules/system/boot/loader/grub/grub.nix
@@ -35,6 +35,7 @@ let
     let
       efiSysMountPoint = if args.efiSysMountPoint == null then args.path else args.efiSysMountPoint;
       efiSysMountPoint' = replaceChars [ "/" ] [ "-" ] efiSysMountPoint;
+      initrdSecrets = config.boot.initrd.secrets != {};
     in
     pkgs.writeText "grub-config.xml" (builtins.toXML
     { splashImage = f cfg.splashImage;
@@ -49,12 +50,12 @@ let
       storePath = config.boot.loader.grub.storePath;
       bootloaderId = if args.efiBootloaderId == null then "NixOS${efiSysMountPoint'}" else args.efiBootloaderId;
       timeout = if config.boot.loader.timeout == null then -1 else config.boot.loader.timeout;
-      inherit efiSysMountPoint;
+      inherit efiSysMountPoint initrdSecrets;
       inherit (args) devices;
       inherit (efi) canTouchEfiVariables;
       inherit (cfg)
         version extraConfig extraPerEntryConfig extraEntries forceInstall useOSProber
-        extraEntriesBeforeNixOS extraPrepareConfig extraInitrd configurationLimit copyKernels
+        extraEntriesBeforeNixOS extraPrepareConfig configurationLimit copyKernels
         default fsIdentifier efiSupport efiInstallAsRemovable gfxmodeEfi gfxmodeBios;
       path = (makeBinPath ([
         pkgs.coreutils pkgs.gnused pkgs.gnugrep pkgs.findutils pkgs.diffutils pkgs.btrfs-progs
@@ -284,19 +285,6 @@ in
         '';
       };
 
-      extraInitrd = mkOption {
-        type = types.nullOr types.path;
-        default = null;
-        example = "/boot/extra_initramfs.gz";
-        description = ''
-          The path to a second initramfs to be supplied to the kernel.
-          This ramfs will not be copied to the store, so that it can
-          contain secrets such as LUKS keyfiles or ssh keys.
-          This implies that rolling back to a previous configuration
-          won't rollback the state of this file.
-        '';
-      };
-
       useOSProber = mkOption {
         default = false;
         type = types.bool;
@@ -541,6 +529,8 @@ in
         { path = "/boot"; inherit (cfg) devices; inherit (efi) efiSysMountPoint; }
       ];
 
+      boot.loader.supportsInitrdSecrets = true;
+
       system.build.installBootLoader =
         let
           install-grub-pl = pkgs.substituteAll {

diff --git a/nixos/modules/system/boot/loader/grub/install-grub.pl b/nixos/modules/system/boot/loader/grub/install-grub.pl
@@ -49,7 +49,7 @@ sub runCommand {
 my $extraPerEntryConfig = get("extraPerEntryConfig");
 my $extraEntries = get("extraEntries");
 my $extraEntriesBeforeNixOS = get("extraEntriesBeforeNixOS") eq "true";
-my $extraInitrd = get("extraInitrd");
+my $initrdSecrets = get("initrdSecrets");
 my $splashImage = get("splashImage");
 my $configurationLimit = int(get("configurationLimit"));
 my $copyKernels = get("copyKernels") eq "true";
@@ -228,13 +228,6 @@ sub GrubFs {
 if ($copyKernels == 0) {
     $grubStore = GrubFs($storePath);
 }
-my $extraInitrdPath;
-if ($extraInitrd) {
-    if (! -f $extraInitrd) {
-        print STDERR "Warning: the specified extraInitrd " . $extraInitrd . " doesn't exist. Your system won't boot without it.\n";
-    }
-    $extraInitrdPath = GrubFs($extraInitrd);
-}
 
 # Generate the header.
 my $conf .= "# Automatically generated.  DO NOT EDIT THIS FILE!\n";
@@ -354,9 +347,23 @@ sub addEntry {
 
     my $kernel = copyToKernelsDir(Cwd::abs_path("$path/kernel"));
     my $initrd = copyToKernelsDir(Cwd::abs_path("$path/initrd"));
-    if ($extraInitrd) {
-        $initrd .= " " .$extraInitrdPath->path;
+
+    # Include second initrd with secrets
+    if ($initrdSecrets) {
+      # Get last element of path
+      $initrd =~ /\/([^\/]+)$/;
+      my $initrdSecretsPath = "$bootPath/kernels/$1-secrets";
+      $initrd .= " $initrd-secrets";
+      my $oldUmask = umask;
+      # Make sure initrd is not world readable (won't work if /boot is FAT)
+      umask 0137;
+      my $initrdSecretsPathTemp = File::Temp::mktemp("$initrdSecretsPath.XXXXXXXX");
+      system("$path/append-initrd-secrets", $initrdSecretsPathTemp) == 0 or die "failed to create initrd secrets\n";
+      rename $initrdSecretsPathTemp, $initrdSecretsPath or die "failed to move initrd secrets into place\n";
+      umask $oldUmask;
+      $copied{$initrdSecretsPath} = 1;
     }
+
     my $xen = -e "$path/xen.gz" ? copyToKernelsDir(Cwd::abs_path("$path/xen.gz")) : undef;
 
     # FIXME: $confName
@@ -379,9 +386,6 @@ sub addEntry {
         if ($copyKernels == 0) {
             $conf .= $grubStore->search . "\n";
         }
-        if ($extraInitrd) {
-            $conf .= $extraInitrdPath->search . "\n";
-        }
         $conf .= "  $extraPerEntryConfig\n" if $extraPerEntryConfig;
         $conf .= "  multiboot $xen $xenParams\n" if $xen;
         $conf .= "  " . ($xen ? "module" : "linux") . " $kernel $kernelParams\n";

diff --git a/nixos/release-combined.nix b/nixos/release-combined.nix
@@ -88,12 +88,14 @@ in rec {
         (all nixos.tests.env)
         (all nixos.tests.ipv6)
         (all nixos.tests.i3wm)
-        (all nixos.tests.keymap.azerty)
-        (all nixos.tests.keymap.colemak)
-        (all nixos.tests.keymap.dvorak)
-        (all nixos.tests.keymap.dvp)
-        (all nixos.tests.keymap.neo)
-        (all nixos.tests.keymap.qwertz)
+        # 2018-06-06: keymap tests temporarily removed from tested job
+        # since non-deterministic failure are blocking the channel (#41538)
+        #(all nixos.tests.keymap.azerty)
+        #(all nixos.tests.keymap.colemak)
+        #(all nixos.tests.keymap.dvorak)
+        #(all nixos.tests.keymap.dvp)
+        #(all nixos.tests.keymap.neo)
+        #(all nixos.tests.keymap.qwertz)
         (all nixos.tests.plasma5)
         #(all nixos.tests.lightdm)
         (all nixos.tests.login)

diff --git a/nixos/release.nix b/nixos/release.nix
@@ -305,6 +305,7 @@ in rec {
   tests.home-assistant = callTest tests/home-assistant.nix { };
   tests.hound = callTest tests/hound.nix {};
   tests.hocker-fetchdocker = callTest tests/hocker-fetchdocker {};
+  tests.hydra = callTest tests/hydra {};
   tests.i3wm = callTest tests/i3wm.nix {};
   tests.iftop = callTest tests/iftop.nix {};
   tests.initrd-network-ssh = callTest tests/initrd-network-ssh {};

diff --git a/nixos/tests/hydra.nix b/nixos/tests/hydra.nix
diff --git a/nixos/tests/hydra/create-trivial-project.sh b/nixos/tests/hydra/create-trivial-project.sh
@@ -0,0 +1,56 @@
+#!/usr/bin/env bash
+#
+# This script creates a project, a jobset with an input of type local
+# path. This local path is a directory that contains a Nix expression
+# to define a job.
+# The EXPR-PATH environment variable must be set with the local path.
+
+set -e
+
+URL=http://localhost:3000
+USERNAME="admin"
+PASSWORD="admin"
+PROJECT_NAME="trivial"
+JOBSET_NAME="trivial"
+EXPR_PATH=${EXPR_PATH:-}
+
+if [ -z $EXPR_PATH ]; then
+   echo "Environment variable EXPR_PATH must be set"
+   exit 1
+fi
+
+mycurl() {
+  curl --referer $URL -H "Accept: application/json" -H "Content-Type: application/json" $@
+}
+
+cat >data.json <<EOF
+{ "username": "$USERNAME", "password": "$PASSWORD" }
+EOF
+mycurl -X POST -d '@data.json' $URL/login -c hydra-cookie.txt
+
+cat >data.json <<EOF
+{
+  "displayname":"Trivial",
+  "enabled":"1"
+}
+EOF
+mycurl --silent -X PUT $URL/project/$PROJECT_NAME -d @data.json -b hydra-cookie.txt
+
+cat >data.json <<EOF
+{
+  "description": "Trivial",
+  "checkinterval": "60",
+  "enabled": "1",
+  "visible": "1",
+  "keepnr": "1",
+  "nixexprinput": "trivial",
+  "nixexprpath": "trivial.nix",
+  "inputs": {
+    "trivial": {
+      "value": "$EXPR_PATH",
+      "type": "path"
+    }
+  }
+}
+EOF
+mycurl --silent -X PUT $URL/jobset/$PROJECT_NAME/$JOBSET_NAME -d @data.json -b hydra-cookie.txt
diff --git a/nixos/tests/hydra/default.nix b/nixos/tests/hydra/default.nix
@@ -0,0 +1,78 @@
+import ../make-test.nix ({ pkgs, ...} :
+
+let
+   trivialJob = pkgs.writeTextDir "trivial.nix" ''
+     with import <nix/config.nix>;
+
+     { trivial = builtins.derivation {
+         name = "trivial";
+         system = "x86_64-linux";
+         PATH = coreutils;
+         builder = shell;
+         args = ["-c" "touch $out; exit 0"];
+       };
+     }
+   '';
+
+    createTrivialProject = pkgs.stdenv.mkDerivation {
+      name = "create-trivial-project";
+      unpackPhase = ":";
+      buildInputs = [ pkgs.makeWrapper ];
+      installPhase = "install -m755 -D ${./create-trivial-project.sh} $out/bin/create-trivial-project.sh";
+      postFixup = ''
+        wrapProgram "$out/bin/create-trivial-project.sh" --prefix PATH ":" ${pkgs.stdenv.lib.makeBinPath [ pkgs.curl ]} --set EXPR_PATH ${trivialJob}
+      '';
+    };
+
+in {
+  name = "hydra-init-localdb";
+  meta = with pkgs.stdenv.lib.maintainers; {
+    maintainers = [ pstn lewo ];
+  };
+
+  machine =
+    { config, pkgs, ... }:
+
+    {
+      virtualisation.memorySize = 1024;
+      time.timeZone = "UTC";
+
+      environment.systemPackages = [ createTrivialProject pkgs.jq ];
+      services.hydra = {
+        enable = true;
+
+        #Hydra needs those settings to start up, so we add something not harmfull.
+        hydraURL = "example.com";
+        notificationSender = "example@example.com";
+      };
+      nix = {
+        buildMachines = [{
+          hostName = "localhost";
+          systems = [ "x86_64-linux" ];
+        }];
+      };
+    };
+
+  testScript =
+    ''
+      # let the system boot up
+      $machine->waitForUnit("multi-user.target");
+      # test whether the database is running
+      $machine->succeed("systemctl status postgresql.service");
+      # test whether the actual hydra daemons are running
+      $machine->succeed("systemctl status hydra-queue-runner.service");
+      $machine->succeed("systemctl status hydra-init.service");
+      $machine->succeed("systemctl status hydra-evaluator.service");
+      $machine->succeed("systemctl status hydra-send-stats.service");
+
+      $machine->succeed("hydra-create-user admin --role admin --password admin");
+
+      # create a project with a trivial job
+      $machine->waitForOpenPort(3000);
+
+      # make sure the build as been successfully built
+      $machine->succeed("create-trivial-project.sh");
+
+      $machine->waitUntilSucceeds('curl -L -s http://localhost:3000/build/1 -H "Accept: application/json" |  jq .buildstatus | xargs test 0 -eq');
+     '';
+})
diff --git a/pkgs/applications/altcoins/default.nix b/pkgs/applications/altcoins/default.nix
@@ -85,7 +85,6 @@ rec {
   };
 
   parity = callPackage ./parity { };
-  parity-beta = callPackage ./parity/beta.nix { };
   parity-ui = callPackage ./parity-ui { };
 
   particl-core = callPackage ./particl/particl-core.nix { boost = boost165; miniupnpc = miniupnpc_2; withGui = false; };

diff --git a/pkgs/applications/altcoins/parity/beta.nix b/pkgs/applications/altcoins/parity/beta.nix
diff --git a/pkgs/applications/altcoins/parity/default.nix b/pkgs/applications/altcoins/parity/default.nix
@@ -1,7 +1,7 @@
 let
-  version     = "1.9.7";
-  sha256      = "1h9rmyqkdv2v83g12dadgqflq1n1qqgd5hrpy20ajha0qpbiv3ph";
-  cargoSha256 = "0ss5jw43850r8l34prai5vk1zd5d5fjyg4rcav1asbq6v683bww0";
-  patches     = [ ./patches/vendored-sources-1.9.patch ];
+  version     = "1.10.6";
+  sha256      = "1x2sm262z8fdkx8zin6r8nwbb7znziw9nm224pr6ap3p0jmv7fcq";
+  cargoSha256 = "1wf1lh32f9dlhv810gdcssv92g1yximx09lw63m0mxcjbn9813bs";
+  patches     = [ ./patches/vendored-sources-1.10.patch ];
 in
   import ./parity.nix { inherit version sha256 cargoSha256 patches; }