NixOS · Mar 7, 2018 · Mar 7, 2018 · Mar 9, 2018 · Mar 12, 2018 · Mar 29, 2018
diff --git a/nixos/modules/services/cluster/kubernetes/default.nix b/nixos/modules/services/cluster/kubernetes/default.nix
@@ -766,7 +766,7 @@ in {
           rm /opt/cni/bin/* || true
           ${concatMapStrings (package: ''
             echo "Linking cni package: ${package}"
-            ln -fs ${package.plugins}/* /opt/cni/bin
+            ln -fs ${package}/bin/* /opt/cni/bin
           '') cfg.kubelet.cni.packages}
         '';
         serviceConfig = {
@@ -828,7 +828,7 @@ in {
       };
 
       # Allways include cni plugins
-      services.kubernetes.kubelet.cni.packages = [pkgs.cni];
+      services.kubernetes.kubelet.cni.packages = [pkgs.cni-plugins];
 
       boot.kernelModules = ["br_netfilter"];
 

diff --git a/nixos/release.nix b/nixos/release.nix
@@ -311,7 +311,10 @@ in rec {
   tests.kernel-copperhead = callTest tests/kernel-copperhead.nix {};
   tests.kernel-latest = callTest tests/kernel-latest.nix {};
   tests.kernel-lts = callTest tests/kernel-lts.nix {};
-  tests.kubernetes = callSubTestsOnMatchingSystems ["x86_64-linux"] tests/kubernetes/default.nix {};
+  tests.kubernetes.dns = callSubTestsOnMatchingSystems ["x86_64-linux"] tests/kubernetes/dns.nix {};
+  ## kubernetes.e2e should eventually replace kubernetes.rbac when it works
+  #tests.kubernetes.e2e = callSubTestsOnMatchingSystems ["x86_64-linux"] tests/kubernetes/e2e.nix {};
+  tests.kubernetes.rbac = callSubTestsOnMatchingSystems ["x86_64-linux"] tests/kubernetes/rbac.nix {};
   tests.latestKernel.login = callTest tests/login.nix { latestKernel = true; };
   tests.ldap = callTest tests/ldap.nix {};
   #tests.lightdm = callTest tests/lightdm.nix {};

diff --git a/nixos/tests/kubernetes/certs.nix b/nixos/tests/kubernetes/certs.nix
@@ -6,29 +6,62 @@
   kubelets
 }:
 let
-  runWithCFSSL = name: cmd:
-    builtins.fromJSON (builtins.readFile (
-      pkgs.runCommand "${name}-cfss.json" {
-        buildInputs = [ pkgs.cfssl ];
-      } "cfssl ${cmd} > $out"
-    ));
-
-  writeCFSSL = content:
-    pkgs.runCommand content.name {
-      buildInputs = [ pkgs.cfssl ];
-    } ''
-      mkdir -p $out
-      cd $out
-      cat ${writeFile content} | cfssljson -bare ${content.name}
-    '';
+   runWithCFSSL = name: cmd:
+     let secrets = pkgs.runCommand "${name}-cfss.json" {
+         buildInputs = [ pkgs.cfssl pkgs.jq ];
+         outputs = [ "out" "cert" "key" "csr" ];
+       }
+       ''
+         (
+           echo "${cmd}"
+           cfssl ${cmd} > tmp
+           cat tmp | jq -r .key > $key
+           cat tmp | jq -r .cert > $cert
+           cat tmp | jq -r .csr > $csr
+
+           touch $out
+         ) 2>&1 | fold -w 80 -s
+       '';
+     in {
+       key = secrets.key;
+       cert = secrets.cert;
+       csr = secrets.csr;
+     };
+
+   writeCFSSL = content:
+     pkgs.runCommand content.name {
+      buildInputs = [ pkgs.cfssl pkgs.jq ];
+     } ''
+       mkdir -p $out
+       cd $out
+
+       json=${pkgs.lib.escapeShellArg (builtins.toJSON content)}
+
+       # for a given $field in the $json, treat the associated value as a
+       # file path and substitute the contents thereof into the $json
+       # object.
+       expandFileField() {
+         local field=$1
+         if jq -e --arg field "$field" 'has($field)'; then
+           local path="$(echo "$json" | jq -r ".$field")"
+           json="$(echo "$json" | jq --arg val "$(cat "$path")" ".$field = \$val")"
+         fi
+       }
+
+       expandFileField key
+       expandFileField ca
+       expandFileField cert
+
+       echo "$json" | cfssljson -bare ${content.name}
+     '';
 
   noCSR = content: pkgs.lib.filterAttrs (n: v: n != "csr") content;
   noKey = content: pkgs.lib.filterAttrs (n: v: n != "key") content;
 
-  writeFile = content: pkgs.writeText "content" (
-    if pkgs.lib.isAttrs content then builtins.toJSON content
-    else toString content
-  );
+  writeFile = content:
+    if pkgs.lib.isDerivation content
+    then content
+    else pkgs.writeText "content" (builtins.toJSON content);
 
   createServingCertKey = { ca, cn, hosts? [], size ? 2048, name ? cn }:
     noCSR (

diff --git a/nixos/tests/kubernetes/e2e.nix b/nixos/tests/kubernetes/e2e.nix
@@ -2,7 +2,7 @@
 with import ./base.nix { inherit system; };
 let
   domain = "my.zyx";
-  certs = import ./certs.nix { externalDomain = domain; };
+  certs = import ./certs.nix { externalDomain = domain; kubelets = ["machine1" "machine2"]; };
   kubeconfig = pkgs.writeText "kubeconfig.json" (builtins.toJSON {
     apiVersion = "v1";
     kind = "Config";

diff --git a/nixos/tests/kubernetes/rbac.nix b/nixos/tests/kubernetes/rbac.nix
@@ -12,7 +12,7 @@ let
   });
 
   roRoleBinding = pkgs.writeText "ro-role-binding.json" (builtins.toJSON {
-    apiVersion = "rbac.authorization.k8s.io/v1beta1";
+    apiVersion = "rbac.authorization.k8s.io/v1";
     kind = "RoleBinding";
     metadata = {
       name = "read-pods";
@@ -31,7 +31,7 @@ let
   });
 
   roRole = pkgs.writeText "ro-role.json" (builtins.toJSON {
-    apiVersion = "rbac.authorization.k8s.io/v1beta1";
+    apiVersion = "rbac.authorization.k8s.io/v1";
     kind = "Role";
     metadata = {
       name = "pod-reader";

diff --git a/nixos/tests/openldap.nix b/nixos/tests/openldap.nix
@@ -1,5 +1,5 @@
 import ./make-test.nix {
-  name = "dovecot";
+  name = "openldap";
 
   machine = { pkgs, ... }: {
     services.openldap = {

diff --git a/pkgs/applications/altcoins/monero-gui/default.nix b/pkgs/applications/altcoins/monero-gui/default.nix
@@ -12,13 +12,13 @@ with stdenv.lib;
 
 stdenv.mkDerivation rec {
   name = "monero-gui-${version}";
-  version = "2018-03-31";
+  version = "0.12.0.0";
 
   src = fetchFromGitHub {
     owner  = "monero-project";
     repo   = "monero-gui";
-    rev    = "fbe5ba831795008361f4de4347e7ecb6d868b4eb";
-    sha256 = "06cncwk4mxfw1rqwlwisasvangl73xyqwj4g6r9j85j5x4xy0k5s";
+    rev    = "v${version}";
+    sha256 = "1mg5ival8a2wdp14yib4wzqax4xyvd40zjy9anhszljds1439jhl";
   };
 
   nativeBuildInputs = [ qmake pkgconfig ];

diff --git a/pkgs/applications/altcoins/monero/default.nix b/pkgs/applications/altcoins/monero/default.nix
@@ -1,7 +1,7 @@
 { stdenv, fetchFromGitHub, cmake, pkgconfig, git
 , boost, miniupnpc, openssl, unbound, cppzmq
 , zeromq, pcsclite, readline
-, IOKit ? null
+, CoreData, IOKit, PCSC
 }:
 
 assert stdenv.isDarwin -> IOKit != null;
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
   buildInputs = [
     boost miniupnpc openssl unbound
     cppzmq zeromq pcsclite readline
-  ] ++ optional stdenv.isDarwin IOKit;
+  ] ++ optionals stdenv.isDarwin [ IOKit CoreData PCSC ];
 
   cmakeFlags = [
     "-DCMAKE_BUILD_TYPE=Release"

diff --git a/pkgs/applications/networking/cluster/cni/default.nix b/pkgs/applications/networking/cluster/cni/default.nix
@@ -13,17 +13,14 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ go ];
 
-  outputs = ["out" "plugins"];
-
   buildPhase = ''
     patchShebangs build.sh
     ./build.sh
   '';
 
   installPhase = ''
-    mkdir -p $out/bin $plugins
+    mkdir -p $out/bin
     mv bin/cnitool $out/bin
-    mv bin/* $plugins/
   '';
 
   meta = with stdenv.lib; {

diff --git a/pkgs/applications/networking/cluster/cni/plugins.nix b/pkgs/applications/networking/cluster/cni/plugins.nix
@@ -0,0 +1,33 @@
+{ stdenv, lib, fetchFromGitHub, go }:
+
+stdenv.mkDerivation rec {
+  name = "cni-plugins-${version}";
+  version = "0.7.0";
+
+  src = fetchFromGitHub {
+    owner = "containernetworking";
+    repo = "plugins";
+    rev = "v${version}";
+    sha256 = "0m885v76azs7lrk6m6n53rwh0xadwvdcr90h0l3bxpdv87sj2mnf";
+  };
+
+  buildInputs = [ go ];
+
+  buildPhase = ''
+    patchShebangs build.sh
+    ./build.sh
+  '';
+
+  installPhase = ''
+    mkdir -p $out/bin
+    mv bin/* $out/bin
+  '';
+
+  meta = with lib; {
+    description = "Some standard networking plugins, maintained by the CNI team";
+    homepage = https://github.com/containernetworking/plugins;
+    license = licenses.asl20;
+    platforms = [ "x86_64-linux" ];
+    maintainers = with maintainers; [ cstrahan ];
+  };
+}
diff --git a/pkgs/applications/networking/corebird/default.nix b/pkgs/applications/networking/corebird/default.nix
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     glib gtk3 json-glib sqlite libsoup gettext gnome3.dconf gnome3.gspell glib-networking
-  ] ++ (with gst_all_1; [ gstreamer gst-plugins-base gst-plugins-good (gst-plugins-bad.override { gtkSupport = true; }) gst-libav ]);
+  ] ++ (with gst_all_1; [ gstreamer gst-plugins-base gst-plugins-bad (gst-plugins-good.override { gtkSupport = true; }) gst-libav ]);
 
   postPatch = ''
     chmod +x data/meson_post_install.py # patchShebangs requires executable file

diff --git a/pkgs/applications/networking/syncthing/default.nix b/pkgs/applications/networking/syncthing/default.nix
@@ -3,14 +3,14 @@
 let
   common = { stname, target, patches ? [], postInstall ? "" }:
     stdenv.mkDerivation rec {
-      version = "0.14.45";
+      version = "0.14.46";
       name = "${stname}-${version}";
 
       src = fetchFromGitHub {
         owner  = "syncthing";
         repo   = "syncthing";
         rev    = "v${version}";
-        sha256 = "0hhldmvsbvkaj0x6af7c41zq5mbzcymv5xxmwvb4h5zbz49z9vzl";
+        sha256 = "0lv8n5id40iy2gfccy8g45fjzlnbnvi7nlvj25pri22dq2bd5svm";
       };
 
       inherit patches;

diff --git a/pkgs/development/compilers/llvm/3.4/llvm.nix b/pkgs/development/compilers/llvm/3.4/llvm.nix
@@ -90,6 +90,6 @@ in stdenv.mkDerivation rec {
     homepage    = http://llvm.org/;
     license     = stdenv.lib.licenses.ncsa;
     maintainers = with stdenv.lib.maintainers; [ lovek323 raskin viric ];
-    platforms = [ "i686-linux" "x86_64-linux" "x86_64-darwin"];
+    platforms = [ "i686-linux" "x86_64-linux" "x86_64-darwin" "armv7l-linux"];
   };
 }
diff --git a/pkgs/development/compilers/llvm/3.5/llvm.nix b/pkgs/development/compilers/llvm/3.5/llvm.nix
@@ -98,7 +98,7 @@ in stdenv.mkDerivation rec {
     homepage    = http://llvm.org/;
     license     = stdenv.lib.licenses.ncsa;
     maintainers = with stdenv.lib.maintainers; [ lovek323 raskin viric ];
-    platforms = [ "i686-linux" "x86_64-linux" "x86_64-darwin"];
+    platforms = [ "i686-linux" "x86_64-linux" "x86_64-darwin" "armv7l-linux"];
   };
 }
 
diff --git a/pkgs/development/libraries/dlib/default.nix b/pkgs/development/libraries/dlib/default.nix
@@ -3,14 +3,14 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "19.10";
+  version = "19.9";
   name = "dlib-${version}";
 
   src = fetchFromGitHub {
     owner = "davisking";
     repo = "dlib";
     rev ="v${version}";
-    sha256 = "0sgxblf4n33b8wgblyblmrkwydvy1yh7fzll1b6c4zgkz675w0m5";
+    sha256 = "0lc54r928j9dg7f2wn25m887z24d31wrc14v2hn6aknp1z084lrc";
   };
 
   postPatch = ''

diff --git a/pkgs/development/libraries/gstreamer/bad/default.nix b/pkgs/development/libraries/gstreamer/bad/default.nix
@@ -1,8 +1,8 @@
-{ stdenv, fetchurl, pkgconfig, python, gst-plugins-base, orc
+{ stdenv, fetchurl, fetchpatch, meson, ninja, gettext
+, pkgconfig, python, gst-plugins-base, orc
 , faacSupport ? false, faac ? null
-, gtkSupport ? false, gtk3 ? null
 , faad2, libass, libkate, libmms
-, libmodplug, mpeg2dec, mpg123
+, libmodplug, mpeg2dec
 , openjpeg, libopus, librsvg
 , wildmidi, fluidsynth, libvdpau, wayland
 , libwebp, xvidcore, gnutls, mjpegtools
@@ -11,7 +11,6 @@
 }:
 
 assert faacSupport -> faac != null;
-assert gtkSupport -> gtk3 != null;
 
 let
   inherit (stdenv.lib) optional optionalString;
@@ -23,7 +22,7 @@ let
 
 in
 stdenv.mkDerivation rec {
-  name = "gst-plugins-bad-1.12.3";
+  name = "gst-plugins-bad-1.14.0";
 
   meta = with stdenv.lib; {
     description = "Gstreamer Bad Plugins";
@@ -38,36 +37,38 @@ stdenv.mkDerivation rec {
     platforms   = platforms.linux ++ platforms.darwin;
   };
 
-  # TODO: Fix Cocoa build. The problem was ARC, which might be related to too
-  #       old version of Apple SDK's.
-  configureFlags = optional stdenv.isDarwin "--disable-cocoa";
-
-  patchPhase = ''
-    sed -i 's/openjpeg-2.2/openjpeg-${openJpegVersion}/' ext/openjpeg/*
+  preConfigure = ''
+    patchShebangs .
   '';
 
+  patches = [
+    (fetchpatch {
+        url = "https://bug794856.bugzilla-attachments.gnome.org/attachment.cgi?id=370409";
+        sha256 = "0hy0rcn35alq65yqwri4fqjz2hf3nyyg5c7rnndk51msmqjxpprk";
+    })
+    ./fix_pkgconfig_includedir.patch
+  ];
+
   src = fetchurl {
     url = "${meta.homepage}/src/gst-plugins-bad/${name}.tar.xz";
-    sha256 = "1v5z3i5ha20gmbb3r9dwsaaspv5fm1jfzlzwlzqx1gjj31v5kl1n";
+    sha256 = "17sgzgx1c54k5rzz7ljyz3is0n7yj56k74vv05h8z1gjnsnjnppd";
   };
 
   outputs = [ "out" "dev" ];
 
-  nativeBuildInputs = [ pkgconfig python ];
+  nativeBuildInputs = [ meson ninja pkgconfig python gettext ];
 
   buildInputs = [
     gst-plugins-base orc
-    faad2 gtk3 libass libkate libmms
-    libmodplug mpeg2dec mpg123
+    faad2 libass libkate libmms
+    libmodplug mpeg2dec
     openjpeg libopus librsvg
     fluidsynth libvdpau
     libwebp xvidcore gnutls libGLU_combined
     libgme openssl x265 libxml2
   ]
     ++ libintlOrEmpty
     ++ optional faacSupport faac
-    # for gtksink
-    ++ optional gtkSupport gtk3
     ++ optional stdenv.isLinux wayland
     # wildmidi requires apple's OpenAL
     # TODO: package apple's OpenAL, fix wildmidi, include on Darwin
@@ -76,6 +77,4 @@ stdenv.mkDerivation rec {
     ++ optional (!stdenv.isDarwin) mjpegtools;
 
   LDFLAGS = optionalString stdenv.isDarwin "-lintl";
-
-  enableParallelBuilding = true;
 }
diff --git a/pkgs/development/libraries/gstreamer/bad/fix_pkgconfig_includedir.patch b/pkgs/development/libraries/gstreamer/bad/fix_pkgconfig_includedir.patch
@@ -0,0 +1,15 @@
+diff --git a/pkgconfig/meson.build b/pkgconfig/meson.build
+index 271f327f3..7e2afa754 100644
+--- a/pkgconfig/meson.build
++++ b/pkgconfig/meson.build
+@@ -2,8 +2,8 @@ pkgconf = configuration_data()
+
+ pkgconf.set('prefix', join_paths(get_option('prefix')))
+ pkgconf.set('exec_prefix', '${prefix}')
+-pkgconf.set('libdir', '${prefix}/@0@'.format(get_option('libdir')))
+-pkgconf.set('includedir', '${prefix}/@0@'.format(get_option('includedir')))
++pkgconf.set('libdir', join_paths(get_option('prefix'), get_option('libdir')))
++pkgconf.set('includedir', join_paths(get_option('prefix'), get_option('includedir')))
+ pkgconf.set('GST_API_VERSION', api_version)
+ pkgconf.set('VERSION', gst_version)
+