-
-
Notifications
You must be signed in to change notification settings - Fork 14.8k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
less: Fix withSecure regression #352298
less: Fix withSecure regression #352298
Conversation
b14efb9
to
551a917
Compare
The underlying issue seems to have been fixed in: gwsw/less#584. |
Please fetchpatch this: |
The patch does not apply clearly on less-668:
If maintaining patch backport is preferred, I'll leave it for other skilled people than me. |
I think we could just vendor the The resulting patch file would then be something like this: From 8fff6c56bfc833528b31ebdaee871f65fbe342b1 Mon Sep 17 00:00:00 2001
From: Mark Nudelman <[email protected]>
Date: Fri, 1 Nov 2024 18:46:59 -0700
Subject: [PATCH] Fix configure parameters --with-secure=no and
--without-secure.
configure.ac was invoking AC_ARG_WITH incorrectly. The third
parameter is the action to take when the --with-secure parameter
is present, even if its value is "no".
Related to ##584.
---
configure.ac | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/configure.ac b/configure.ac
index 3a24bdf7..379c53bc 100644
--- a/configure.ac
+++ b/configure.ac
@@ -351,10 +351,11 @@ fi
# Compile in secure mode?
AC_ARG_WITH(secure,
- [ --with-secure Compile in secure mode],
+ [ --with-secure Compile in secure mode])
+AS_IF([test "x$with_secure" = "xyes"],[
AC_DEFINE(SECURE_COMPILE, 1)
- AC_SUBST(SECURE_COMPILE,1), AC_DEFINE(SECURE_COMPILE, 0)
- AC_SUBST(SECURE_COMPILE,0))
+ AC_SUBST(SECURE_COMPILE,1)], [AC_DEFINE(SECURE_COMPILE, 0)
+ AC_SUBST(SECURE_COMPILE,0)])
# Checks for regular expression functions.
have_regex=no This applies cleanly on top of the |
You can use fetchpatch to fetch the patch, and pass it the file you want to patch in Something like: patches = [
(fetchpatch {
url = "...";
hash = "...";
includes = [
"configure.ac"
];
})
} |
551a917
to
45b788a
Compare
45b788a
to
63c7cab
Compare
Done.
Thanks. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM.
Feel free to ping me once ofborg is done evaluating, and we can merge this.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This triggers 419 rebuilds. Should we move this to staging?
Changes LGTM. withSecure
works as it should
Edit: I asked in the Staging matrix chat and this should be good to go!
@Scrumplex: 419 rebuilds? What's the source? I believe this rebuilds all of EDIT: I see ofBorg labels, so... I don't know. Anyway, I expect this isn't too urgent and we move it to EDIT2: for reference you can nix eval -f. haskellPackages.ghc.outPath --argstr system aarch64-darwin (and I came here by bisecting on the result of that) |
I ran I definitely remember seeing multiple electron applications, multiple components from KDE's PIM suite and some other larger rebuilds. But I don't remember seeing any Edit: I ran this on x86_64-linux Edit2:
That should be okay. |
On {x86_64,aarch64}-linux the haskell packages won't rebuild, apparently. No idea why the difference. |
I compare the 2 derivations on
Looks like
|
Derivation diff--- /tmp/a.json 2024-11-04 17:53:24.512231078 +0800
+++ /tmp/b.json 2024-11-04 17:53:10.748805508 +0800
@@ -1,5 +1,5 @@
{
- "/nix/store/yfrvnvc8myn2sbz20shl4mw0r5jm6g28-ghc-9.6.6.drv": {
+ "/nix/store/ksqflmb9gwslk9503wpkjk0b2wi6hbc6-ghc-9.6.6.drv": {
"args": [
"-e",
"/nix/store/v6x3cs394jgqfbi0a42pam708flxaphh-default-builder.sh"
@@ -32,7 +32,7 @@
"disallowedReferences": "/nix/store/m167dc498j2pb21nnrgmadfph7bk9180-ghc-binary-9.2.4",
"doCheck": "",
"doInstallCheck": "",
- "doc": "/nix/store/bh8nqqfnls4ws2hwwxn5b0w0hcl8bs9w-ghc-9.6.6-doc",
+ "doc": "/nix/store/8xd2z24xbd1qsqf30xkfdsvnp7njdcqf-ghc-9.6.6-doc",
"dontAddExtraLibs": "1",
"dontStrip": "",
"enableParallelBuilding": "1",
@@ -43,13 +43,13 @@
"mesonFlags": "",
"name": "ghc-9.6.6",
"nativeBuildInputs": "/nix/store/7isk914abas0yr2cxgpsmyz2ihn8mf2n-perl-5.40.0 /nix/store/zi2ask1241f3a3888dybsljaav4rnzra-hadrian-9.6.6 /nix/store/3jmzqbmlczkj00ym2yygbrss3fkr2q48-alex-3.4.0.1 /nix/store/a6hd0b5aq6wyg89sz1arah66qcrgx5qg-happy-1.20.1.1 /nix/store/h9ll345c63m4ic1wxidqin1hddmrbvb7-hscolour-1.25 /nix/store/lkqaghqp1i4y268171sqxak1i2iz2nfl-autoconf-2.72 /nix/store/75msk7kfbc4pj297z8xyck0zjhybayqj-automake-1.16.5 /nix/store/kan0sc8ns3h9r8wp6q2c6hx0r2hv5ysf-gnum4-1.4.19 /nix/store/2djmffykchgm4q4j7ylv7xgkg441mp2j-python3-3.12.7 /nix/store/alwffgcv7hf1lb5nvlk2f6smbnggr4af-ghc-settings-edit-0.1.0 /nix/store/hisnblazif8adjrlq6g539b0d81z9z3l-auto-sign-darwin-binaries-hook /nix/store/0dj60gs9vgawh8h8fpf4fszij2av1q41-python3.12-sphinx-7.4.7",
- "out": "/nix/store/csvxck318zb6jhjjwa76i5sffc5gwfjv-ghc-9.6.6",
+ "out": "/nix/store/vdx9vnxr4z1fnzx5ynijyc5jqyvbxppk-ghc-9.6.6",
"outputs": "out doc",
"patches": "",
"pname": "ghc",
"postInstall": "# leave bindist directory\npopd\n\nsettingsFile=\"$out/lib/ghc-9.6.6/lib/settings\"\n\n# Make the installed GHC use the host->target tools.\nghc-settings-edit \"$settingsFile\" \\\n \"C compiler command\" \"/nix/store/700a0ayy1s1h7zg9dqiqy0xvmhfr26l6-clang-wrapper-16.0.6/bin/cc\" \\\n \"Haskell CPP command\" \"/nix/store/700a0ayy1s1h7zg9dqiqy0xvmhfr26l6-clang-wrapper-16.0.6/bin/cc\" \\\n \"C++ compiler command\" \"/nix/store/700a0ayy1s1h7zg9dqiqy0xvmhfr26l6-clang-wrapper-16.0.6/bin/c++\" \\\n \"ld command\" \"/nix/store/vnkvxq7wqxg180awsv2rmira5pvc875p-cctools-binutils-darwin-wrapper-1010.6/bin/ld\" \\\n \"Merge objects command\" \"/nix/store/vnkvxq7wqxg180awsv2rmira5pvc875p-cctools-binutils-darwin-wrapper-1010.6/bin/ld\" \\\n \"ar command\" \"/nix/store/vnkvxq7wqxg180awsv2rmira5pvc875p-cctools-binutils-darwin-wrapper-1010.6/bin/ar\" \\\n \"ranlib command\" \"/nix/store/vnkvxq7wqxg180awsv2rmira5pvc875p-cctools-binutils-darwin-wrapper-1010.6/bin/ranlib\"\nghc-settings-edit \"$settingsFile\" \\\n \"otool command\" \"/nix/store/wli7d4k9sh4c6fwarw3afc5g5axwbjm8-cctools-binutils-darwin-1010.6/bin/otool\" \\\n \"install_name_tool command\" \"/nix/store/wli7d4k9sh4c6fwarw3afc5g5axwbjm8-cctools-binutils-darwin-1010.6/bin/install_name_tool\"\n\n# Install the bash completion file.\ninstall -Dm 644 utils/completion/ghc.bash $out/share/bash-completion/completions/ghc\n",
"postPatch": "patchShebangs --build .\n",
- "preConfigure": "for env in $(env | grep '^TARGET_' | sed -E 's|\\+?=.*||'); do\n export \"${env#TARGET_}=${!env}\"\ndone\n# No need for absolute paths since these tools only need to work during the build\nexport CC_STAGE0=\"$CC_FOR_BUILD\"\nexport LD_STAGE0=\"$LD_FOR_BUILD\"\nexport AR_STAGE0=\"$AR_FOR_BUILD\"\n\n# Stage0 (build->build) which builds stage 1\nexport GHC=\"/nix/store/m167dc498j2pb21nnrgmadfph7bk9180-ghc-binary-9.2.4/bin/ghc\"\n# GHC is a bit confused on its cross terminology, as these would normally be\n# the *host* tools.\nexport CC=\"/nix/store/700a0ayy1s1h7zg9dqiqy0xvmhfr26l6-clang-wrapper-16.0.6/bin/cc\"\nexport CXX=\"/nix/store/700a0ayy1s1h7zg9dqiqy0xvmhfr26l6-clang-wrapper-16.0.6/bin/c++\"\n# Use gold to work around https://sourceware.org/bugzilla/show_bug.cgi?id=16177\nexport LD=\"/nix/store/vnkvxq7wqxg180awsv2rmira5pvc875p-cctools-binutils-darwin-wrapper-1010.6/bin/ld\"\nexport AS=\"/nix/store/vnkvxq7wqxg180awsv2rmira5pvc875p-cctools-binutils-darwin-wrapper-1010.6/bin/as\"\nexport AR=\"/nix/store/vnkvxq7wqxg180awsv2rmira5pvc875p-cctools-binutils-darwin-wrapper-1010.6/bin/ar\"\nexport NM=\"/nix/store/vnkvxq7wqxg180awsv2rmira5pvc875p-cctools-binutils-darwin-wrapper-1010.6/bin/nm\"\nexport RANLIB=\"/nix/store/vnkvxq7wqxg180awsv2rmira5pvc875p-cctools-binutils-darwin-wrapper-1010.6/bin/ranlib\"\nexport READELF=\"/nix/store/vnkvxq7wqxg180awsv2rmira5pvc875p-cctools-binutils-darwin-wrapper-1010.6/bin/readelf\"\nexport STRIP=\"/nix/store/vnkvxq7wqxg180awsv2rmira5pvc875p-cctools-binutils-darwin-wrapper-1010.6/bin/strip\"\nexport OBJDUMP=\"/nix/store/vnkvxq7wqxg180awsv2rmira5pvc875p-cctools-binutils-darwin-wrapper-1010.6/bin/objdump\"\nexport OTOOL=\"/nix/store/wli7d4k9sh4c6fwarw3afc5g5axwbjm8-cctools-binutils-darwin-1010.6/bin/otool\"\nexport INSTALL_NAME_TOOL=\"/nix/store/wli7d4k9sh4c6fwarw3afc5g5axwbjm8-cctools-binutils-darwin-1010.6/bin/install_name_tool\"\nexport NIX_LDFLAGS+=\" -no_dtrace_dof\"\n\n# GHC tries the host xattr /usr/bin/xattr by default which fails since it expects python to be 2.7\nexport XATTR=/nix/store/z9awz7b4x5ym5c5sksf2nbgyf04if876-file_cmds-448.0.3-xattr/bin/xattr\nhadrianFlagsArray=(\n \"-j$NIX_BUILD_CORES\"\n \n)\n",
+ "preConfigure": "for env in $(env | grep '^TARGET_' | sed -E 's|\\+?=.*||'); do\n export \"${env#TARGET_}=${!env}\"\ndone\n# No need for absolute paths since these tools only need to work during the build\nexport CC_STAGE0=\"$CC_FOR_BUILD\"\nexport LD_STAGE0=\"$LD_FOR_BUILD\"\nexport AR_STAGE0=\"$AR_FOR_BUILD\"\n\n# Stage0 (build->build) which builds stage 1\nexport GHC=\"/nix/store/m167dc498j2pb21nnrgmadfph7bk9180-ghc-binary-9.2.4/bin/ghc\"\n# GHC is a bit confused on its cross terminology, as these would normally be\n# the *host* tools.\nexport CC=\"/nix/store/700a0ayy1s1h7zg9dqiqy0xvmhfr26l6-clang-wrapper-16.0.6/bin/cc\"\nexport CXX=\"/nix/store/700a0ayy1s1h7zg9dqiqy0xvmhfr26l6-clang-wrapper-16.0.6/bin/c++\"\n# Use gold to work around https://sourceware.org/bugzilla/show_bug.cgi?id=16177\nexport LD=\"/nix/store/vnkvxq7wqxg180awsv2rmira5pvc875p-cctools-binutils-darwin-wrapper-1010.6/bin/ld\"\nexport AS=\"/nix/store/vnkvxq7wqxg180awsv2rmira5pvc875p-cctools-binutils-darwin-wrapper-1010.6/bin/as\"\nexport AR=\"/nix/store/vnkvxq7wqxg180awsv2rmira5pvc875p-cctools-binutils-darwin-wrapper-1010.6/bin/ar\"\nexport NM=\"/nix/store/vnkvxq7wqxg180awsv2rmira5pvc875p-cctools-binutils-darwin-wrapper-1010.6/bin/nm\"\nexport RANLIB=\"/nix/store/vnkvxq7wqxg180awsv2rmira5pvc875p-cctools-binutils-darwin-wrapper-1010.6/bin/ranlib\"\nexport READELF=\"/nix/store/vnkvxq7wqxg180awsv2rmira5pvc875p-cctools-binutils-darwin-wrapper-1010.6/bin/readelf\"\nexport STRIP=\"/nix/store/vnkvxq7wqxg180awsv2rmira5pvc875p-cctools-binutils-darwin-wrapper-1010.6/bin/strip\"\nexport OBJDUMP=\"/nix/store/vnkvxq7wqxg180awsv2rmira5pvc875p-cctools-binutils-darwin-wrapper-1010.6/bin/objdump\"\nexport OTOOL=\"/nix/store/wli7d4k9sh4c6fwarw3afc5g5axwbjm8-cctools-binutils-darwin-1010.6/bin/otool\"\nexport INSTALL_NAME_TOOL=\"/nix/store/wli7d4k9sh4c6fwarw3afc5g5axwbjm8-cctools-binutils-darwin-1010.6/bin/install_name_tool\"\nexport NIX_LDFLAGS+=\" -no_dtrace_dof\"\n\n# GHC tries the host xattr /usr/bin/xattr by default which fails since it expects python to be 2.7\nexport XATTR=/nix/store/r87kqv68c32nfh8lnsahcz8hmsy6wnbp-file_cmds-448.0.3-xattr/bin/xattr\nhadrianFlagsArray=(\n \"-j$NIX_BUILD_CORES\"\n \n)\n",
"preInstall": "pushd _build/bindist/*\n\nexport InstallNameToolCmd=$INSTALL_NAME_TOOL\nexport OtoolCmd=$OTOOL\n$configureScript $configureFlags \"${configureFlagsArray[@]}\"\n",
"propagatedBuildInputs": "",
"propagatedNativeBuildInputs": "",
@@ -74,12 +74,6 @@
"out"
]
},
- "/nix/store/5bhpflsh4v55wnir77dll5x2znpp6w17-file_cmds-448.0.3.drv": {
- "dynamicOutputs": {},
- "outputs": [
- "xattr"
- ]
- },
"/nix/store/62sadwh9mwfgxmk6kx62yia20rd1j5w4-clang-wrapper-16.0.6.drv": {
"dynamicOutputs": {},
"outputs": [
@@ -210,6 +204,12 @@
"outputs": [
"out"
]
+ },
+ "/nix/store/zh57rrnv0ayvqg6fng59y8p6w57p5y0b-file_cmds-448.0.3.drv": {
+ "dynamicOutputs": {},
+ "outputs": [
+ "xattr"
+ ]
}
},
"inputSrcs": [
@@ -218,10 +218,10 @@
"name": "ghc-9.6.6",
"outputs": {
"doc": {
- "path": "/nix/store/bh8nqqfnls4ws2hwwxn5b0w0hcl8bs9w-ghc-9.6.6-doc"
+ "path": "/nix/store/8xd2z24xbd1qsqf30xkfdsvnp7njdcqf-ghc-9.6.6-doc"
},
"out": {
- "path": "/nix/store/csvxck318zb6jhjjwa76i5sffc5gwfjv-ghc-9.6.6"
+ "path": "/nix/store/vdx9vnxr4z1fnzx5ynijyc5jqyvbxppk-ghc-9.6.6"
}
},
"system": "aarch64-darwin"
|
Looks like this was moved to staging, which is what my recommendation would have been. I don’t know why ofborg thinks there are so few Darwin rebuilds if it will rebuild all of |
This pull request has been mentioned on NixOS Discourse. There might be relevant details there: https://discourse.nixos.org/t/less-not-using-lesspipe/56022/4 |
The regression was introduced by #350981.
You can tell if
less
is run in secure mode by:In secure mode, the status bar shows
Command not available (press RETURN)
.In non-secure mode,
less
will open the file with $EDITOR.Also configs in
~/.config/lesskey
does not work anymore, so home-manager optionprograms.less.keys
is broken.Things done
nix.conf
? (See Nix manual)sandbox = relaxed
sandbox = true
nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD"
. Note: all changes have to be committed, also see nixpkgs-review usage./result/bin/
)Add a 👍 reaction to pull requests you find important.