From 88ff500dfc4c205d2904decf29475fcfca5592f4 Mon Sep 17 00:00:00 2001 From: Ryan Yin Date: Sun, 1 Nov 2026 23:34:00 +0800 Subject: [PATCH] chore(wechat): use nixpkgs-master now that NixOS/nixpkgs#560225 is merged --- WORKAROUNDS.md | 32 +++++++++++++++++++------------- flake.lock | 6 +++--- flake.nix | 2 -- hardening/README.md | 2 +- hardening/nixpaks/default.nix | 3 +-- 5 files changed, 24 insertions(+), 21 deletions(-) diff --git a/WORKAROUNDS.md b/WORKAROUNDS.md index 2b225b28..d3f37676 100644 --- a/WORKAROUNDS.md +++ b/WORKAROUNDS.md @@ -16,17 +16,16 @@ obsolete workarounds get rolled back instead of lingering. A version or revision pinned for a reason that can go away. -| ID | What & where | Why | Removal condition | Added | Revisit | Status | -| ------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------- | ---------- | ------------------------------------- | ------ | -| WA-001 | smartctl_exporter pinned to upstream `6274decc`, which carries PR [#329](https://github.com/prometheus-community/smartctl_exporter/pull/329) — `overlays/smartctl-exporter/` | `/metrics` returns HTTP 500 once a device becomes readable after startup ([#305](https://github.com/prometheus-community/smartctl_exporter/issues/305), [#326](https://github.com/prometheus-community/smartctl_exporter/issues/326)) | Drop once nixpkgs provides a version containing the #329 fix | 2026-10-03 | next nixpkgs bump | active | -| WA-004 | `catppuccin` on `main` — `flake.nix` | `main` carries the nodejs→nodejs-slim deprecation fix, which is not in a release | Switch to a release tag once it includes the fix | 2026-09-25 | on catppuccin release | active | -| WA-005 | `tuios` input — `flake.nix`; `home/base/tui/tuios/` | nixpkgs lags behind upstream | Use nixpkgs' `tuios` once it is recent enough | 2026-10-03 | on nixpkgs bump | active | -| WA-006 | `nixpkgs-blender` — `flake.nix` | Blender 5.2 LTS + CUDA/OptiX pin; keeps `just up` from triggering a full source rebuild | Bump deliberately when needed; drop the pin if the current nixpkgs build is acceptable | 2026-07-24 | deliberate | active | -| WA-047 | WeChat from `nixpkgs-patched` carrying [NixOS/nixpkgs#560225](https://github.com/NixOS/nixpkgs/pull/560225) — `flake.nix`, `hardening/nixpaks/default.nix` | the PR switches WeChat from the AppImage/FHS wrapper to a native deb package and adds native Wayland support | Drop once #560225 merges (and use the normal nixpkgs package) | 2026-10-31 | on nixpkgs-patched or upstream merges | active | -| WA-020 | `fcitx5-vinput` pinned to release tag `v2.4.2` — `flake.nix`; consumer `home/linux/gui/base/vinput/default.nix` | Tracks a release tag instead of a branch, so `just up` stays on that release | Bump to a newer release tag when its changes are wanted | 2026-10-04 | on vinput release | active | -| WA-021 | `nix-x86-on-aarch64` input — our fork of rowanG077's patched FEX + muvm runtime — `flake.nix`; `hosts/12kingdoms-shoukei/game/` | FEX does not support 16K pages, so x86/x86_64 apps and games on shoukei need this pinned flake's 4K-page microVM runtime; our fork lets upstream changes be reviewed before use | Drop once FEX supports 16K pages directly, or nixpkgs/nixos-apple-silicon ships an equivalent runtime | 2026-10-07 | on FEX/nixpkgs/muvm update | active | -| WA-023 | `nix.package = pkgs.nixVersions.latest` — `modules/nixos/base/nix.nix` | NixOS is opted into Nix 2.35 (2.35.2), which nixpkgs ships as `nixVersions.latest`, while `nixVersions.stable` is still 2.34 | Drop the override and fall back to the default `pkgs.nix` once `nixVersions.stable` is 2.35 or newer | 2026-10-07 | next nixpkgs bump | active | -| WA-037 | `nixpkgs-npu` input pinned to `2ddccb854d89` — the `openvino-npu-compiler` branch of `ryan4yin/nixpkgs`, carrying [NixOS/nixpkgs#570230](https://github.com/NixOS/nixpkgs/pull/570230) — `flake.nix`; consumer `pkgs-npu` in `outputs/default.nix`, `hosts/idols-aquamarine/asr.nix` | The Intel NPU compiler, and the driver change that loads it, are unmerged, so the NPU driver the Whisper service needs comes from that branch | Drop the input and load `intel-npu-driver` from `nixos-unstable` once #570230 merges | 2026-10-17 | when #570230 merges | active | +| ID | What & where | Why | Removal condition | Added | Revisit | Status | +| ------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------- | ---------- | -------------------------- | ------ | +| WA-001 | smartctl_exporter pinned to upstream `6274decc`, which carries PR [#329](https://github.com/prometheus-community/smartctl_exporter/pull/329) — `overlays/smartctl-exporter/` | `/metrics` returns HTTP 500 once a device becomes readable after startup ([#305](https://github.com/prometheus-community/smartctl_exporter/issues/305), [#326](https://github.com/prometheus-community/smartctl_exporter/issues/326)) | Drop once nixpkgs provides a version containing the #329 fix | 2026-10-03 | next nixpkgs bump | active | +| WA-004 | `catppuccin` on `main` — `flake.nix` | `main` carries the nodejs→nodejs-slim deprecation fix, which is not in a release | Switch to a release tag once it includes the fix | 2026-09-25 | on catppuccin release | active | +| WA-005 | `tuios` input — `flake.nix`; `home/base/tui/tuios/` | nixpkgs lags behind upstream | Use nixpkgs' `tuios` once it is recent enough | 2026-10-03 | on nixpkgs bump | active | +| WA-006 | `nixpkgs-blender` — `flake.nix` | Blender 5.2 LTS + CUDA/OptiX pin; keeps `just up` from triggering a full source rebuild | Bump deliberately when needed; drop the pin if the current nixpkgs build is acceptable | 2026-07-24 | deliberate | active | +| WA-020 | `fcitx5-vinput` pinned to release tag `v2.4.2` — `flake.nix`; consumer `home/linux/gui/base/vinput/default.nix` | Tracks a release tag instead of a branch, so `just up` stays on that release | Bump to a newer release tag when its changes are wanted | 2026-10-04 | on vinput release | active | +| WA-021 | `nix-x86-on-aarch64` input — our fork of rowanG077's patched FEX + muvm runtime — `flake.nix`; `hosts/12kingdoms-shoukei/game/` | FEX does not support 16K pages, so x86/x86_64 apps and games on shoukei need this pinned flake's 4K-page microVM runtime; our fork lets upstream changes be reviewed before use | Drop once FEX supports 16K pages directly, or nixpkgs/nixos-apple-silicon ships an equivalent runtime | 2026-10-07 | on FEX/nixpkgs/muvm update | active | +| WA-023 | `nix.package = pkgs.nixVersions.latest` — `modules/nixos/base/nix.nix` | NixOS is opted into Nix 2.35 (2.35.2), which nixpkgs ships as `nixVersions.latest`, while `nixVersions.stable` is still 2.34 | Drop the override and fall back to the default `pkgs.nix` once `nixVersions.stable` is 2.35 or newer | 2026-10-07 | next nixpkgs bump | active | +| WA-037 | `nixpkgs-npu` input pinned to `2ddccb854d89` — the `openvino-npu-compiler` branch of `ryan4yin/nixpkgs`, carrying [NixOS/nixpkgs#570230](https://github.com/NixOS/nixpkgs/pull/570230) — `flake.nix`; consumer `pkgs-npu` in `outputs/default.nix`, `hosts/idols-aquamarine/asr.nix` | The Intel NPU compiler, and the driver change that loads it, are unmerged, so the NPU driver the Whisper service needs comes from that branch | Drop the input and load `intel-npu-driver` from `nixos-unstable` once #570230 merges | 2026-10-17 | when #570230 merges | active | ## Workarounds @@ -55,7 +54,14 @@ A setting that works around a bug or a hardware quirk. | WA-042 | Colmena nodes set `system.nixos.versionSuffix` and `revision` from the flake's lib — `outputs/default.nix` (`rawColmenaHive`) | Colmena evaluates each node with nixpkgs' `eval-config.nix` and plain lib, which reports `26.11pre-git`, so without the override a Colmena deploy differs from the `nixosConfigurations` toplevel; the `colmena-parity` eval test guards the match | Drop once Colmena evaluates nodes with the flake's lib or accepts `nixosConfigurations` directly, keeping `colmena-parity` green | 2026-10-21 | on a colmena bump | active | | WA-046 | xdg-desktop-portal-wlr pinned to 0.8.2 — `modules/nixos/desktop/xdg.nix` | niri's GNOME ScreenCast path exposes only DMA-BUF with modifiers, which Zoom 7.2.1 rejects; xdg-desktop-portal-wlr 0.8.2 provides the working SHM path, while 0.8.4 regresses Zoom's SelectSources. | Drop once niri's ScreenCast path works with Zoom or xdg-desktop-portal-wlr 0.8.4+ is fixed. | 2026-10-31 | on xdg-desktop-portal-wlr or Zoom updates | active | -| WA-048 | Nixpak GUI fontconfig comes from the host — `hardening/nixpaks/modules/desktop-base.nix` | Nixpak normally generates a standalone `/etc/fonts` and font package list for each sandbox; that bypasses the host `defaultFonts` and made browser chrome, Telegram, QQ and other sandboxed apps choose a different CJK fallback from the host. The wrapper now disables Nixpak fonts and bind-mounts `/etc/static/fonts` at `/etc/fonts`, so sandboxed GUI apps reuse the host font packages and family preferences through the already-mounted `/nix/store`. | Drop once Nixpak can directly reuse the host fontconfig or no longer overrides `/etc/fonts`, then remove the bind and restore the library-supported configuration path | 2026-11-01 | on a nixpak update | active | +| WA-048 | Nixpak GUI fontconfig comes from the host — `hardening/nixpaks/modules/desktop-base.nix` +| Nixpak normally generates a standalone `/etc/fonts` and font package list for each sandbox; that +bypasses the host `defaultFonts` and made browser chrome, Telegram, QQ and other sandboxed apps +choose a different CJK fallback from the host. The wrapper now disables Nixpak fonts and bind-mounts +`/etc/static/fonts` at `/etc/fonts`, so sandboxed GUI apps reuse the host font packages and family +preferences through the already-mounted `/nix/store`. | Drop once Nixpak can directly reuse the host +fontconfig or no longer overrides `/etc/fonts`, then remove the bind and restore the +library-supported configuration path | 2026-11-01 | on a nixpak update | active | If WA-008 freezes recur, the fallback is to restore the parameters commented out in `hosts/idols-ai/hardware-configuration.nix` — @@ -97,6 +103,6 @@ An unfinished feature or gap. - Security architecture, threat model and audit status: [SECURITY.md](./SECURITY.md). - Unmerged **nixpkgs** PRs are carried via the `nixpkgs-patched` input and the [`.agents/skills/nixpkgs-patched`](./.agents/skills/nixpkgs-patched/SKILL.md) workflow (currently - WA-047). + none). - Routine version pins (colmena, agenix, disko, lanzaboote, haumea, home-manager, `nixpkgs-stable`, `nixpkgs-darwin`, …) are the versions in use, not workarounds, so they are not listed here. diff --git a/flake.lock b/flake.lock index b51a4c9d..977097a8 100644 --- a/flake.lock +++ b/flake.lock @@ -907,11 +907,11 @@ }, "nixpkgs-master": { "locked": { - "lastModified": 1793276362, - "narHash": "sha256-DusxEOidL1xE8vKwiHSeY/CYwjgD+f5tS9QrEN/O4mE=", + "lastModified": 1793545910, + "narHash": "sha256-7s8nz5lDuLTNUHwZ3PqeUvRyEIlBni6hJVD0OgaP0Tc=", "owner": "nixos", "repo": "nixpkgs", - "rev": "ceb48b970d5e3c98492ae6386187600c43ff2014", + "rev": "46549ad0c53f0b202fbe20193b5718b89988de39", "type": "github" }, "original": { diff --git a/flake.nix b/flake.nix index 8696d00d..09d1372f 100644 --- a/flake.nix +++ b/flake.nix @@ -29,8 +29,6 @@ nixpkgs-stable.url = "github:nixos/nixpkgs/nixos-26.05"; # ryan4yin/nixpkgs fork for the `.agents/skills/nixpkgs-patched` workflow. - # Carries NixOS/nixpkgs#560225 (WeChat native deb + Wayland support) until - # the PR merges; see WORKAROUNDS.md. nixpkgs-patched.url = "github:ryan4yin/nixpkgs/nixos-unstable-patched"; # get some latest packages from the master branch nixpkgs-master.url = "github:nixos/nixpkgs/master"; diff --git a/hardening/README.md b/hardening/README.md index 2284a008..ea4cd376 100644 --- a/hardening/README.md +++ b/hardening/README.md @@ -108,7 +108,7 @@ All browsers get read-only NSS certificates, printing, native notifications and and user workflows still need confirmation. - Chromium smoke test passed: renderer sandbox, environment clearing, bind scope, disposable-profile persistence and loopback policy. -- WeChat uses the native nixpkgs-patched package with nixpak as the only bwrap layer. Build/policy +- WeChat uses the native nixpkgs-master package with nixpak as the only bwrap layer. Build/policy pass; interactive Wayland validation is still pending. - Evidence and repeat commands: [runtime validation](tests/runtime-validation.md), [policy test](tests/policy.nix), which auto-loads every suite under [tests/policy](tests/policy/). diff --git a/hardening/nixpaks/default.nix b/hardening/nixpaks/default.nix index 3c8e1e62..4edbd84f 100644 --- a/hardening/nixpaks/default.nix +++ b/hardening/nixpaks/default.nix @@ -1,7 +1,6 @@ { pkgs, pkgs-master, - pkgs-patched, pkgs-stable, pkgs-blender, nixpak, @@ -39,7 +38,7 @@ in musescore = wrapper pkgs-stable ./musescore.nix; mpv = wrapper super ./mpv.nix; imv = wrapper super ./imv.nix; - wechat = wrapper pkgs-patched ./wechat.nix; + wechat = wrapper pkgs-master ./wechat.nix; }; }) ];