master ← novalkun:adopt-5-figsoda-packages
opened 12:49PM - 21 Sep 26 UTC
Part of #458096
Adopts samply, jotdown, typical, skate and python-launcher. All… five are already at their latest upstream release, so no version bump is included.
Adds nix-update-script to the four that did not have it yet.
I deliberately did not add versionCheckHook to python-launcher: the `py` launcher forwards `--version` to the selected Python interpreter, so `py --version` reports the interpreter version (e.g. `Python 3.13.15`) rather than the launcher's own, which would make a version check incorrect.
The branch was refreshed on top of current master; skate is now 1.1.0 there.
## AI disclosure
This change was prepared with opencode (deepseek-flash). The assistant inspected the five derivations, checked upstream release status via the GitHub API, and drafted the maintainer and update-script edits. I reviewed the diff, built each package, ran the binaries and ran nixpkgs-review myself before submitting.
## Things done
- Built on platform:
- [x] x86_64-linux
- [ ] aarch64-linux
- [ ] aarch64-darwin
- Tested, as applicable:
- [ ] [NixOS tests] in [nixos/tests].
- [ ] [Package tests] at `passthru.tests`.
- [ ] Tests in [lib/tests] or [pkgs/test] for functions and "core" functionality.
- [x] Ran `nixpkgs-review` on this PR. See [nixpkgs-review usage].
- [x] Tested basic functionality of all binary files, usually in `./result/bin/`.
- Nixpkgs Release Notes
- [ ] Package update: when the change is major or breaking.
- NixOS Release Notes
- [ ] Module addition: when adding a new NixOS module.
- [ ] Module update: when the change is significant.
- [x] Fits [CONTRIBUTING.md], [pkgs/README.md], [maintainers/README.md] and other READMEs.
- [x] Follows the [automation/AI policy].
Testing performed locally:
`nix-build -A samply -A jotdown -A typical -A skate -A python-launcher` succeeded on x86_64-linux.
`--version` was invoked on all five binaries; samply, jotdown and typical exercise versionCheckHook during their build.
[NixOS tests]: https://nixos.org/manual/nixos/unstable/index.html#sec-nixos-tests
[Package tests]: https://github.com/NixOS/nixpkgs/blob/master/pkgs/README.md#package-tests
[nixpkgs-review usage]: https://github.com/Mic92/nixpkgs-review#usage
[CONTRIBUTING.md]: https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md
[automation/AI policy]: https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md#automationai-policy
[lib/tests]: https://github.com/NixOS/nixpkgs/blob/master/lib/tests
[maintainers/README.md]: https://github.com/NixOS/nixpkgs/blob/master/maintainers/README.md
[nixos/tests]: https://github.com/NixOS/nixpkgs/blob/master/nixos/tests
[pkgs/README.md]: https://github.com/NixOS/nixpkgs/blob/master/pkgs/README.md
[pkgs/test]: https://github.com/NixOS/nixpkgs/blob/master/pkgs/test
[458096]: https://github.com/NixOS/nixpkgs/issues/458096
{samply, jotdown, typical, skate, python-launcher}: adopt. Approved, CI green, 0 rebuilds; ready to merge.
master ← novalkun:nordvpn-meshnet
opened 12:17AM - 19 Sep 26 UTC
## Background
The `nordvpn` package and module were originally written by `diff… erent-error`, whose GitHub account is currently suspended (a suspension they dispute). I ([@novalkun](https://github.com/novalkun)) took over maintainership at 5.4.0 and am picking up meshnet as unfinished work flagged from the module's first commit. This PR was reworked with techniques from `different-error`'s own parallel implementation, credited via `Co-authored-by`.
## What this does
Builds `nordvpn-linux` with the `telio`, `drop`, `cdnrc` Go tags (upstream's own public/FOSS build set; `moose`/`quench` stay out of scope, proprietary-only).
- New `libtelio/`, `libdrop/`: `buildRustPackage` derivations for meshnet and fileshare, GPLv3, built from source, tests on.
- `nordvpnd` gets a `--hosts-readonly` flag backed by a `NoopHostsSetter` (`hosts-readonly.patch`), so `/etc/hosts` is never written — meshnet works on stock immutable NixOS. Peer hostnames don't resolve as a result; connect by meshnet IP.
- Builds and installs `cmd/fileshare` as `nordfileshare`. Its and `norduserd`'s sockets are chowned to the `nordvpn` group so processes running as a different user than the unprivileged `nordvpnd` can reach them.
- Adds `CAP_NET_RAW` (libtelio needs it for ping) and `nordlynx` to `networking.firewall.trustedInterfaces`.
- Sets the `RemotePath` ldflag to upstream's documented default (`.env.sample`); without it, remote-config downloads gating the meshnet/libtelio feature flags 404 silently.
- `libtelio`/`libdrop` use `wrapProgram --prefix LD_LIBRARY_PATH` instead of `patchelf --add-rpath` (the latter corrupts these Go binaries' ELF layout).
## Verification
`nix build`, `nixosTests.nordvpn` (5 scenarios), and live testing on real hardware: meshnet connects (DERP relay, WireGuard), survives repeated off/on cycles, `/etc/hosts` stays untouched, fileshare's socket is reachable cross-user.
Live testing also caught a real bug: `cargo test`'s dev-dependency feature unification was silently overwriting `libtelio.so` with one built against a mock adapter, making meshnet fail outright on real hardware despite passing `nix build` and the VM test. Fixed by snapshotting the release artifact before `checkPhase` runs.
## How to test
```nix
{
pkgs,
lib,
...
}:
{
boot.loader.systemd-boot.enable = true;
boot.loader.efi.canTouchEfiVariables = true;
networking.firewall.enable = true;
services.xserver.enable = true;
services.displayManager.gdm.enable = true;
services.desktopManager.plasma6.enable = true;
services.nordvpn.enable = true;
virtualisation.vmVariant.virtualisation = {
memorySize = 8192;
cores = 3;
};
users.users.alice = {
isNormalUser = true;
password = "alice";
extraGroups = [ "wheel" "nordvpn" ];
};
system.stateVersion = "24.11";
}
```
```
nixos-rebuild build-vm \
-I nixpkgs=https://github.com/NixOS/nixpkgs/archive/refs/pull/564752/head.tar.gz \
-I nixos-config=./configuration.nix
```
`nordvpn login`/`nordvpn set meshnet on` need a real NordVPN account to actually exercise meshnet; `nordvpn status` and the daemon/socket setup can be checked without one.
## Limitations
- nordwhisper stays unsupported (proprietary `quench`).
- No peer-hostname resolution, by design.
- Only tested on `x86_64-linux`; `nixpkgs-review` not run.
## AI disclosure (per [CONTRIBUTING.md § Automation/AI policy](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md#automationai-policy))
Prepared with Claude Code (Claude Sonnet 5 / `claude-sonnet-5`), disclosed via `Assisted-by:` trailer. I reviewed the diff and did the verification above myself.
## Things done
- Built on platform:
- [x] x86_64-linux
- [ ] aarch64-linux
- [ ] aarch64-darwin
- Tested, as applicable:
- [x] [NixOS tests] in [nixos/tests].
- [ ] [Package tests] at `passthru.tests`.
- [ ] Tests in [lib/tests] or [pkgs/test] for functions and "core" functionality.
- [ ] Ran `nixpkgs-review` on this PR. See [nixpkgs-review usage].
- [x] Tested basic functionality of all binary files, usually in `./result/bin/`.
- Nixpkgs Release Notes
- [ ] Package update: when the change is major or breaking.
- NixOS Release Notes
- [ ] Module addition: when adding a new NixOS module.
- [ ] Module update: when the change is significant.
- [x] Fits [CONTRIBUTING.md], [pkgs/README.md], [maintainers/README.md] and other READMEs.
- [x] Follows the [automation/AI policy].
[NixOS tests]: https://nixos.org/manual/nixos/unstable/index.html#sec-nixos-tests
[Package tests]: https://github.com/NixOS/nixpkgs/blob/master/pkgs/README.md#package-tests
[nixpkgs-review usage]: https://github.com/Mic92/nixpkgs-review#usage
[CONTRIBUTING.md]: https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md
[automation/AI policy]: https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md#automationai-policy
[lib/tests]: https://github.com/NixOS/nixpkgs/blob/master/lib/tests
[maintainers/README.md]: https://github.com/NixOS/nixpkgs/blob/master/maintainers/README.md
[nixos/tests]: https://github.com/NixOS/nixpkgs/blob/master/nixos/tests
[pkgs/README.md]: https://github.com/NixOS/nixpkgs/blob/master/pkgs/README.md
[pkgs/test]: https://github.com/NixOS/nixpkgs/blob/master/pkgs/test
master ← novalkun:nordvpn-security-fixes
opened 02:42PM - 29 Sep 26 UTC
Tighten `nordvpnd`'s systemd sandboxing and fix a couple of permission issues th… at predate the meshnet work in #564752.
Related to #547437, opened by the original maintainer @different-error, who has been unable to update it directly due to a disputed account suspension.
## Changes
- Explicitly load `tun`/`wireguard` kernel modules (previously relied on them being loaded some other way).
- Add `ProtectSystem = "strict"`, `RestrictNamespaces`, `RestrictAddressFamilies`, `NoNewPrivileges`, `ProtectControlGroups`, `DeviceAllow` to `nordvpnd`'s unit, and convert `AmbientCapabilities`/`CapabilityBoundingSet` to list form.
- Narrow `nordvpnd.socket`'s mode from `0770` to `0660` (group-writable is enough; world/other access was too broad).
- Start `norduserd` via `default.target` instead of `graphical-session.target`, since headless/non-graphical sessions were failing to get it started.
- Expand `nixosTests.nordvpn`: assert the exact capability bitmask on the running `nordvpnd` process (`/proc/<pid>/status`), verify polkit rules, kernel modules, TUN device access via the service's cgroup, and runtime/state directory ownership+permissions across all four user/group config combinations.
## How to test
```nix
{
pkgs,
lib,
...
}:
{
boot.loader.systemd-boot.enable = true;
boot.loader.efi.canTouchEfiVariables = true;
networking.firewall.enable = true;
services.xserver.enable = true;
services.displayManager.gdm.enable = true;
services.desktopManager.plasma6.enable = true;
services.nordvpn.enable = true;
virtualisation.vmVariant.virtualisation = {
memorySize = 8192;
cores = 3;
};
users.users.alice = {
isNormalUser = true;
password = "alice";
extraGroups = [ "wheel" "nordvpn" ];
};
system.stateVersion = "24.11";
}
```
```
nixos-rebuild build-vm \
-I nixpkgs=https://github.com/NixOS/nixpkgs/archive/refs/pull/568291/head.tar.gz \
-I nixos-config=./configuration.nix
```
## Things done
- Built on platform:
- [x] x86_64-linux
- [ ] aarch64-linux
- [ ] aarch64-darwin
- Tested, as applicable:
- [x] [NixOS tests] in [nixos/tests].
- [ ] [Package tests] at `passthru.tests`.
- [ ] Tests in [lib/tests] or [pkgs/test] for functions and "core" functionality.
- [ ] Ran `nixpkgs-review` on this PR. See [nixpkgs-review usage].
- [x] Tested basic functionality of all binary files, usually in `./result/bin/`.
- Nixpkgs Release Notes
- [ ] Package update: when the change is major or breaking.
- NixOS Release Notes
- [ ] Module addition: when adding a new NixOS module.
- [ ] Module update: when the change is significant.
- [x] Fits [CONTRIBUTING.md], [pkgs/README.md], [maintainers/README.md] and other READMEs.
- [x] Follows the [automation/AI policy].
[NixOS tests]: https://nixos.org/manual/nixos/unstable/index.html#sec-nixos-tests
[Package tests]: https://github.com/NixOS/nixpkgs/blob/master/pkgs/README.md#package-tests
[nixpkgs-review usage]: https://github.com/Mic92/nixpkgs-review#usage
[CONTRIBUTING.md]: https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md
[automation/AI policy]: https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md#automationai-policy
[lib/tests]: https://github.com/NixOS/nixpkgs/blob/master/lib/tests
[maintainers/README.md]: https://github.com/NixOS/nixpkgs/blob/master/maintainers/README.md
[nixos/tests]: https://github.com/NixOS/nixpkgs/blob/master/nixos/tests
[pkgs/test]: https://github.com/NixOS/nixpkgs/blob/master/pkgs/test
## AI disclosure
This PR description and parts of the commit were drafted with AI assistance (Claude Code, Sonnet 5). Code changes are adapted from @different-error's patch; I reviewed and verified them via local build and `nixosTests.nordvpn` before opening.
Also bumping these two. Review feedback addressed and they still need a reviewer.
One approval. Ready for merge.
master ← ccicnce113424:rayburst
opened 05:29PM - 24 Sep 26 UTC
https://github.com/AnInsomniacy/rayburst/releases/tag/v4.0.0
## Things done
…
- Built on platform:
- [x] x86_64-linux
- [ ] aarch64-linux
- [ ] aarch64-darwin
- Tested, as applicable:
- [ ] [NixOS tests] in [nixos/tests].
- [ ] [Package tests] at `passthru.tests`.
- [ ] Tests in [lib/tests] or [pkgs/test] for functions and "core" functionality.
- [ ] Ran `nixpkgs-review` on this PR. See [nixpkgs-review usage].
- [ ] Tested basic functionality of all binary files, usually in `./result/bin/`.
- Nixpkgs Release Notes
- [ ] Package update: when the change is major or breaking.
- NixOS Release Notes
- [ ] Module addition: when adding a new NixOS module.
- [ ] Module update: when the change is significant.
- [x] Fits [CONTRIBUTING.md], [pkgs/README.md], [maintainers/README.md] and other READMEs.
- [ ] Follows the [automation/AI policy].
[NixOS tests]: https://nixos.org/manual/nixos/unstable/index.html#sec-nixos-tests
[Package tests]: https://github.com/NixOS/nixpkgs/blob/master/pkgs/README.md#package-tests
[nixpkgs-review usage]: https://github.com/Mic92/nixpkgs-review#usage
[CONTRIBUTING.md]: https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md
[automation/AI policy]: https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md#automationai-policy
[lib/tests]: https://github.com/NixOS/nixpkgs/blob/master/lib/tests
[maintainers/README.md]: https://github.com/NixOS/nixpkgs/blob/master/maintainers/README.md
[nixos/tests]: https://github.com/NixOS/nixpkgs/blob/master/nixos/tests
[pkgs/README.md]: https://github.com/NixOS/nixpkgs/blob/master/pkgs/README.md
[pkgs/test]: https://github.com/NixOS/nixpkgs/blob/master/pkgs/test
Hi! Could someone review this new-package PR for sping 1.6.0, a Rust CLI for real-time connectivity diagnostics?
https://github.com/NixOS/nixpkgs/pull/569222
The PR was opened on October 1 and recently updated to 1.6.0.
I'd appreciate feedback on the packaging.
Thanks for your time!