diff options
| author | Martin Weinelt <mweinelt@users.noreply.github.com> | 2021-06-02 15:47:27 +0200 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2021-06-02 15:47:27 +0200 |
| commit | 3308be986adb5fdbee6b671bb1d60bbbde366f3b (patch) | |
| tree | 32e2611eb1ca39944fbc9f0850f1d6a2ac5f3ddf | |
| parent | Merge pull request #125143 from NixOS/backport-124971-to-staging-21.05 (diff) | |
| parent | cacerts: Make updater script aware of the nss_latest attribute (diff) | |
| download | nixpkgs-3308be986adb5fdbee6b671bb1d60bbbde366f3b.tar.gz | |
Merge pull request #125344 from helsinki-systems/bkp/21.05/cacert
| -rw-r--r-- | pkgs/data/misc/cacert/default.nix | 4 | ||||
| -rwxr-xr-x | pkgs/data/misc/cacert/update.sh | 10 |
2 files changed, 11 insertions, 3 deletions
diff --git a/pkgs/data/misc/cacert/default.nix b/pkgs/data/misc/cacert/default.nix index 17bb30a54b85..b4a8ebc4ef27 100644 --- a/pkgs/data/misc/cacert/default.nix +++ b/pkgs/data/misc/cacert/default.nix @@ -10,7 +10,7 @@ with lib; let - version = "3.63"; + version = "3.66"; underscoreVersion = builtins.replaceStrings ["."] ["_"] version; in @@ -20,7 +20,7 @@ stdenv.mkDerivation { src = fetchurl { url = "mirror://mozilla/security/nss/releases/NSS_${underscoreVersion}_RTM/src/nss-${version}.tar.gz"; - sha256 = "0892xbjcaw6g4rd2rs4qa37nbda248cjrgxa4faaw0licbpjyb8q"; + sha256 = "1jfdnh5l4k57r2vb07s06hqi7m2qzk0d9x25lsdsrw3cflx9x9w9"; }; certdata2pem = fetchurl { diff --git a/pkgs/data/misc/cacert/update.sh b/pkgs/data/misc/cacert/update.sh index 7bf3d46cb02f..1c286dc6206f 100755 --- a/pkgs/data/misc/cacert/update.sh +++ b/pkgs/data/misc/cacert/update.sh @@ -12,6 +12,14 @@ # # As of this writing there are a few magnitudes more packages depending on # cacert than on nss. +# +# If the current nixpkgs revision contains the attribute `nss_latest` that will +# be used instead of `nss`. This is done to help the stable branch maintenance +# where (usually) after branch-off during the first Firefox upgrade that +# requries a new NSS version that attribute is introduced. +# By having this change in the unstable branch we can safely carry it from +# release to release without requiring more backport churn on those doing the +# stable maintenance. set -ex @@ -20,7 +28,7 @@ BASEDIR="$(dirname "$0")/../../../.." CURRENT_PATH=$(nix-build --no-out-link -A cacert.out) -PATCHED_PATH=$(nix-build --no-out-link -E "with import $BASEDIR {}; (cacert.overrideAttrs (_: { inherit (nss) src version; })).out") +PATCHED_PATH=$(nix-build --no-out-link -E "with import $BASEDIR {}; let nss_pkg = pkgs.nss_latest or pkgs.nss; in (cacert.overrideAttrs (_: { inherit (nss_pkg) src version; })).out") # Check the hash of the etc subfolder # We can't check the entire output as that contains the nix-support folder |