Conversation
ce046bd to
9f81ffe
Compare
|
One to go: Besides those, some maintainers should probably be pinged, because some of these packages appear maintained. My personal stance is that not everything needs to be in nixpkgs and if software depends on an openssl release that hasn't been maintained for years, it shouldn't be. For some packages, the dependency could probably be removed though, e.g. because it's only needed in the checkPhase. |
|
@NixOS/darwin-maintainers I tried updating |
|
cc @toonn |
|
This also would break some universities where the websites only allow TLS1.0. So this packages helps to create a socat proxy |
|
Openconnect requires this.
|
|
@ajs124 can you share what you did for the update? I may be able to play around... |
|
I've been looking into this. Tried more recent versions of network_cmds but none of them builds. I suspect network_cmds is more deeply tied into the system libraries than we'd like. I'm afraid we won't be able to update network_cmds without a complete SDK bump. However, I'm not sure the network_cmds from 10.13.6 will work with a more recent OpenSSL. It should be possible to get rid of openssl_1_0_2 for aarch64-darwin though IIUC, because that uses the 11.0 SDK. |
|
hmm, I'm on aarch64-darwin and I can't even build the aarch64 variant of network_cmds on master (can't build xnu in the first place). I can build the x86_64-darwin packages up to openconnect though. |
|
This branch has an attempt to bump network_cmds to 10.13.6 if you really want to look into it. Note that it bumps XNU so it's not really fit for merging into master probably. @kubukoz, were you building with openssl_1_0_2 or did you override the argument, for me it doesn't build with any other openssl? |
x86_64-darwin + openssl1.0.2 works. Any other combination doesn't. |
I'm getting this, I assume you have the same? I'm out of my depth here :/ Full log |
|
I don't get the same errors, no. Maybe this is because you're on aarch64-darwin? |
|
|
b277c24 to
8e6c9ba
Compare
|
@c0bw3b it still seems to depend on |
|
Ah yes indeed it does, I misread the diff of the package update. |
|
Still investigating but I think wapiti -> sslyze -> nassl may be a problem as it seems to be a security scanner that (I assume on purpose) depends on these old versions of openssl. |
8e6c9ba to
c42b52f
Compare
|
Result of 2 packages marked as broken and skipped:
16 packages failed to build:
|
To detect old issues, legacy openssl is often required. |
|
Result of 38 packages marked as broken and skipped:
12 packages failed to build:
|
b8a16b0 to
298b307
Compare
|
Result of 1 package marked as broken and skipped:
1 package failed to build:
3 packages built:
|
This reverts commit 0418760.
298b307 to
12efa7a
Compare
12efa7a to
49c51cd
Compare
|
Result of 1 package marked as broken and skipped:
4 packages built:
|
|
Please see #168977, this commit breaks Cc: @matthewbauer who maintains that package. |
Draft because there are still
git grep openssl_1_0|wc -l -> 13mentions ofopenssl_1_0_2to go.Motivation for this change
openssl_1_0_2has been marked as insecure as of #80746 and has been unsupported upstream since 2019, IMO it's time to get rid of it.I tried to keep software that is still maintained upstream, while dropping leaf packages that are dead upstream.
If something becomes active again or someone puts in the time to fix it, feel free to revert the relevant commit(s).
Everything dropped here can still be used from old nixpkgs checkouts or with an overlay or some other way, but carrying it in tree makes little sense IMO.
Things done
sandbox = trueset innix.conf? (See Nix manual)nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage./result/bin/)nixos/doc/manual/md-to-db.shto update generated release notes