strongswan: 5.9.14 -> 6.0.0

[NickCao]

Things done

• Built on platform(s)
  • x86_64-linux
  • aarch64-linux
  • x86_64-darwin
  • aarch64-darwin
• For non-Linux: Is sandboxing enabled in nix.conf? (See Nix manual)
  • sandbox = relaxed
  • sandbox = true
• Tested, as applicable:
  • NixOS test(s) (look inside nixos/tests)
  • and/or package tests
  • or, for functions and "core" functionality, tests in lib/tests or pkgs/test
  • made sure NixOS tests are linked to the relevant packages
• Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
• Tested basic functionality of all binary files (usually in ./result/bin/)
• 25.05 Release Notes (or backporting 24.11 and 25.05 Release notes)
  • (Package updates) Added a release notes entry if the change is major or breaking
  • (Module updates) Added a release notes entry if the change is significant
  • (Module addition) Added a release notes entry if adding a new NixOS module
• Fits CONTRIBUTING.md.

---

Add a 👍 reaction to pull requests you find important.

[NickCao]

Replaces #361767 #361768 #361769

[johanot]

@NickCao at first glance, LGTM. But I have two suggestions:

1. Rename the current strongswan package to strongswan_5 or strongswan_5_9 and make "strongswan" a meta-package pointing to v5.9 (for now).
2. Parameterize the existing NixOS test for strongswan-swanctl to run tests for both 5.9 and 6.0

re 2) I tried manually hacking the current test-case to use strongswan_6 and it passes. So I believe it's just a matter of making actual support for package arg in the test.

[NickCao]

Let's do this in steps, first part: #372967

[NickCao]

@johanot After weeks of use I feel strongswan 6 is mostly backwards compatible with strongswan 5, maybe there isn't that much a need to keep strongswan 5 around?

[johanot]

Tbh I haven't really tried Strongswan 6 (yet) myself, which is partially why I wanted to improve the tests covering it (#370840). The code LGTM, I'd just like to be able to run the tests for all versions of the package (if we end up with more than one).

As for whether to drop 5.9: I don't know the lifecycle of strongswan. Is 5.9 EOL soon? Or is 5.9 supported long-term side by side with 6.0? In the former case, I would just go "strongswan: 5.9 -> 6.0". In the latter case, we might do nixpkgs a favor of keeping both versions around.

I promise to read up on the release cycle later, unless someone beats me to it here.

[NickCao]

As for whether to drop 5.9: I don't know the lifecycle of strongswan. Is 5.9 EOL soon? Or is 5.9 supported long-term side by side with 6.0?

I don't see the lifecycle/policy posted anywhere, let's just ask: strongswan/strongswan#2614

[NickCao]

Update: the answer is no.

[definfo]

I noticed that strongswan 5.x in nixpkgs does not enable EAP-PEAP. Should we add this flag before bringing it to v6 ?

[NickCao]

PEAP

Already enabled in this PR.