fix(build): update nix flake to work with current NixOS unstable #152

ThinkChaos · 2023-11-28T17:40:41Z

Niv appears to work too, but I haven't tested that as much.

Changes (sorry single big commit, but this was hard enough as is):

don't use the overlay for nixpkgs since it's not used ATM
when using a flake, respect the given inputs instead of using Niv ones
update dependencies to Qt6 to match pyproject.toml
fix coredump on Wayland because of missing runtime dependency
fix build-system to use the newer poetry-core
update poetry.lock
make flake inputs and Niv sources poetry2nix versions match

Niv appears to work too, but I haven't tested that as much. Changes (sorry single big commit, but this was hard enough as is): - don't use the overlay for nixpkgs since it's not used ATM - when using a flake, respect the given inputs instead of using Niv ones - update dependencies to Qt6 to match `pyproject.toml` - fix coredump on Wayland because of missing runtime dependency - fix build-system to use the newer `poetry-core` - update poetry.lock - make flake inputs and Niv sources poetry2nix versions match

Example: "QApplication: invalid style override 'kvantum' passed, ignoring it."

unode · 2023-12-01T14:37:06Z

A big thank you for all this effort! As AnyConnect is far from usable on NixOS, this contribution is precious.

With this and given my first try resulted in an error, how are you using this recipe?

On NixOS-23.11 I'm seeing:

error:
       … while calling the 'head' builtin

         at /var/nixpkgs-channels/nixos-23.11/lib/attrsets.nix:850:11:

          849|         || pred here (elemAt values 1) (head values) then
          850|           head values
             |           ^
          851|         else

       … while evaluating the attribute 'value'

         at /var/nixpkgs-channels/nixos-23.11/lib/modules.nix:807:9:

          806|     in warnDeprecation opt //
          807|       { value = builtins.addErrorContext "while evaluating the option `${showOption loc}':" value;
             |         ^
          808|         inherit (res.defsFinal') highestPrio;

       (stack trace truncated; use '--show-trace' to show the full trace)

       error: poetry2nix is now maintained out-of-tree. Please use https://github.com/nix-community/poetry2nix/

when I enable the code in this PR via:

  nixpkgs.overlays = [
    (import "${builtins.fetchTarball https://github.com/ThinkChaos/openconnect-sso/archive/refs/heads/fix/nix-flake.tar.gz}/overlay.nix")
  ];

`prev.callPackage` auto-detects the given closure's args and sets them to `prev.${arg}`. So `poetry2nix` was getting overriden with `prev.poetry2nix` giving us the "poetry2nix is now maintained out-of-tree" error.

ThinkChaos · 2023-12-01T18:31:45Z

I pushed a fix for the overlay! Let me know if that works for you.

fix(build): don't override poetry2nix in overlay

prev.callPackage auto-detects the given closure's args and sets them
to prev.${arg}. So poetry2nix was getting overriden with
prev.poetry2nix giving us the "poetry2nix is now maintained out-of-tree"
error.

Not sure why that was using callPackage in the first place, seems like an oversight.

Just for reference, I'm using it via the flake so that all inputs are pinned. And if needed I can change openconnect-sso.inputs.nixpkgs.follows to point to an older nixpkgs than my system if it becomes incompatible again in the future.
I had that setup for a while but since the package used to depend on the wrong Qt libs, and not use propagatedBuildInputs it stopped working after a while. Hopefully with this PR it's truly self contained.

flake.nix:

inputs = {
    openconnect-sso = {
      url = github:ThinkChaos/openconnect-sso/fix/nix-flake;
      inputs.flake-utils.follows = "utils";
      inputs.nixpkgs.follows = "nixpkgs";
      inputs.systems.follows = "systems";
    };
}

configuration.nix:

environment.systemPackages = [
  inputs.openconnect-sso.packages.${config.nixpkgs.localSystem.system}.default
];

PhDyellow · 2023-12-27T07:42:46Z

I can confirm that this PR works when I use the flake. I tested it by accessing PDFs from major publishers that I can only access when I am inside my institution's VPN.

bast · 2024-01-06T12:57:13Z

Confirming that this works. It seems to be a good workaround/solution for my troubles in #156. Thank you!

XenGi · 2024-01-09T11:57:01Z

This needs an addition to configuration.nix:

nixpkgs.config.permittedInsecurePackages = [
  "electron-25.9.0"
];

But even then, this seems to not work anymore. I'm getting this when starting openconnect-sso:

$ env OPENSSL_CONF=$HOME/.openconnect-sso-openssl.cnf openconnect-sso --server "myvpn.com/my-vpn"
[info     ] Authenticating to VPN endpoint [openconnect_sso.app] address=myvpn.com/my-vpn name=
Traceback (most recent call last):
  File "/nix/store/9pv6l1ilz5fxmiixk4qy2b6h2b2c9sq9-python3.11-openconnect-sso-0.8.1/bin/.openconnect-sso-wrapped", line 9, in <module>
    sys.exit(main())
             ^^^^^^
  File "/nix/store/9pv6l1ilz5fxmiixk4qy2b6h2b2c9sq9-python3.11-openconnect-sso-0.8.1/lib/python3.11/site-packages/openconnect_sso/cli.py", line 175, in main
    return app.run(args)
           ^^^^^^^^^^^^^
  File "/nix/store/9pv6l1ilz5fxmiixk4qy2b6h2b2c9sq9-python3.11-openconnect-sso-0.8.1/lib/python3.11/site-packages/openconnect_sso/app.py", line 35, in run
    auth_response, selected_profile = asyncio.get_event_loop().run_until_complete(
                                      ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/nix/store/qp5zys77biz7imbk6yy85q5pdv7qk84j-python3-3.11.6/lib/python3.11/asyncio/base_events.py", line 653, in run_until_complete
    return future.result()
           ^^^^^^^^^^^^^^^
  File "/nix/store/9pv6l1ilz5fxmiixk4qy2b6h2b2c9sq9-python3.11-openconnect-sso-0.8.1/lib/python3.11/site-packages/openconnect_sso/app.py", line 152, in _run
    auth_response = await authenticate_to(
                    ^^^^^^^^^^^^^^^^^^^^^^
  File "/nix/store/9pv6l1ilz5fxmiixk4qy2b6h2b2c9sq9-python3.11-openconnect-sso-0.8.1/lib/python3.11/site-packages/openconnect_sso/authenticator.py", line 23, in authenticate
    response = self._start_authentication()
               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/nix/store/9pv6l1ilz5fxmiixk4qy2b6h2b2c9sq9-python3.11-openconnect-sso-0.8.1/lib/python3.11/site-packages/openconnect_sso/authenticator.py", line 68, in _start_authentication
    return parse_response(response)
           ^^^^^^^^^^^^^^^^^^^^^^^^
  File "/nix/store/9pv6l1ilz5fxmiixk4qy2b6h2b2c9sq9-python3.11-openconnect-sso-0.8.1/lib/python3.11/site-packages/openconnect_sso/authenticator.py", line 141, in parse_response
    return parse_auth_request_response(xml)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/nix/store/9pv6l1ilz5fxmiixk4qy2b6h2b2c9sq9-python3.11-openconnect-sso-0.8.1/lib/python3.11/site-packages/openconnect_sso/authenticator.py", line 147, in parse_auth_request_response
    assert xml.auth.get("id") == "main"
           ^^^^^^^^
  File "src/lxml/objectify.pyx", line 234, in lxml.objectify.ObjectifiedElement.__getattr__
  File "src/lxml/objectify.pyx", line 453, in lxml.objectify._lookupChildOrRaise
AttributeError: no such child: auth

The custom ssl config fixes the UNSAFE_LEGACY_RENEGOTIATION_DISABLED issue.

unode · 2024-01-09T13:49:03Z

Also confirming that the latest changes now solve the installation issue I mentioned above.

ThinkChaos · 2024-01-09T15:35:47Z

@XenGi to the best of my knowledge both your issues are unrelated to this PR:

openconnect-sso doesn't depend on electron (the web view is Qt based). You can confirm that with nix derivation show -r github:ThinkChaos/openconnect-sso/20c0015c4264c72cc19ac272de0dc534309bd21b#openconnect-sso. I'm guessing another package you have installed is triggering this since you're updating your config's nixpkgs.
AttributeError: no such child: auth is openconnect-sso not getting the XML it expects. Simply searching for the error brings up a couple issues that seem related, please contribute there instead:
Error when trying to connect #17
Auth finish request not working if CSD is needed #35
Error on connection, help wanted to where start troubleshoot #47
Error on connection. Help needed to start investigating #56
azure sso completes, then login fails #57

XenGi · 2024-01-11T19:35:40Z

ah ok. Thx for checking. I wasn't sure about that. Then I'll check for some other explanation.

Applying vlaci#152

adminy · 2024-07-02T10:01:46Z

building '/nix/store/dxlmqg8p8m7gz3wmqmclp8gkwb4incra-python3.11-trio-0.25.0.drv'...
error: builder for '/nix/store/dxlmqg8p8m7gz3wmqmclp8gkwb4incra-python3.11-trio-0.25.0.drv' failed with exit code 1;
       last 10 log lines:
       > adding 'trio-0.25.0.dist-info/top_level.txt'
       > adding 'trio-0.25.0.dist-info/RECORD'
       > removing build/bdist.linux-x86_64/wheel
       > Successfully built trio-0.25.0-py3-none-any.whl
       > Finished creating a wheel...
       > Finished executing pypaBuildPhase
       > Running phase: pythonRuntimeDepsCheckHook
       > Executing pythonRuntimeDepsCheck
       > Checking runtime dependencies for trio-0.25.0-py3-none-any.whl
       >   - attrs>=23.2.0 not satisfied by version 23.1.0
       For full logs, run 'nix log /nix/store/dxlmqg8p8m7gz3wmqmclp8gkwb4incra-python3.11-trio-0.25.0.drv'.
error: 1 dependencies of derivation '/nix/store/c0c9af576nf8xqpfrnbxzn3nv2h9k3dw-python3.11-jeepney-0.8.0.drv' failed to build
error: 1 dependencies of derivation '/nix/store/az8p80zvg3dl16hx8x3wmyw3j4x8w25p-python3.11-keyring-23.13.1.drv' failed to build
error: 1 dependencies of derivation '/nix/store/gwapvssizki5b7zp4hm8m6c1j5nqwy61-python3.11-openconnect-sso-0.8.1.drv' failed to build
error: 1 dependencies of derivation '/nix/store/2f1y8gixqjag5fwsjii6ia2bm1fwy1aj-system-path.drv' failed to build
error: 1 dependencies of derivation '/nix/store/152lzb82a0z6hp7bnjii0hc31g14isla-nixos-system-box-24.11.20240605.437e3a2.drv' failed to build

In case anyone wants a working version, you can find it here also created a PR to address all these issues: #181

ThinkChaos · 2024-07-04T02:02:03Z

Thanks, I'll give it a shot!
I haven't bothered trying to update the derivation and am just using an old nixpkgs just for this flake.

Python dependency update is required to build with latest nixpkgs. Co-authored-by: adminy <[email protected]>

ThinkChaos · 2024-07-23T23:24:18Z

I updated the PR to use latest nixpkgs as now (2893f56de08021cffd9b6b6dfc70fd9ccd51eb60). Everything builds and works fine for me.

I didn't use all your changes @adminy since a lot of it seemed like separate concerns and not just fixing the build. I did add you as co-author though because I cherry-picked one hunk in nix/default.nix.
Also, please rebase your PR on mine, because using my work without attribution is not cool!

And make Nix package use the lxml from nixpkgs, to allow building with a more recent version.

ThinkChaos · 2024-08-21T23:35:09Z

Pushed a commit to fix building with more recent nixpkgs that updated lxml to 5.x.
Also just uses nixpkgs' version instead of rebuilding it.

adminy · 2024-09-13T22:17:49Z

So sorry, not sure what happened.

PR is rebased.

I'm no longer using the vpn client. So any further changes I won't be able to test. Its all up to you now :)

ThinkChaos mentioned this pull request Nov 28, 2023

CVE-2023-32681 - outdated python3.10-requests-2.29.0 #144

Open

ThinkChaos added 2 commits November 28, 2023 20:13

squash! fix QT_STYLE_OVERRIDE warning at startup

d205ec9

Example: "QApplication: invalid style override 'kvantum' passed, ignoring it."

squash! fix duplicate flake inputs

f6670c7

ThinkChaos added 3 commits December 1, 2023 13:29

squash!: fix extraneous inputs.follows

9ccbc3b

squash!: fix flake indent

37409da

fix(build): don't override poetry2nix in overlay

20c0015

`prev.callPackage` auto-detects the given closure's args and sets them to `prev.${arg}`. So `poetry2nix` was getting overriden with `prev.poetry2nix` giving us the "poetry2nix is now maintained out-of-tree" error.

enadeau added a commit to enadeau/openconnect-sso that referenced this pull request Jun 20, 2024

Fix build issue

4cc35c2

Applying vlaci#152

adminy mentioned this pull request Jul 2, 2024

poetry2nix is now out of tree #180

Closed

adminy mentioned this pull request Jul 3, 2024

fix: nix & python packages upgrade, csd verify file #181

Closed

ThinkChaos and others added 4 commits July 23, 2024 19:19

chore: update flake inputs and python dependencies

1ded21f

Python dependency update is required to build with latest nixpkgs. Co-authored-by: adminy <[email protected]>

fix(nix): typo in niv output

867ce5b

style(nix): quote flake inputs

b57bbfa

chore: update niv sources

f269200

chore: allow building with lxml 5.x

94f1ddf

And make Nix package use the lxml from nixpkgs, to allow building with a more recent version.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(build): update nix flake to work with current NixOS unstable #152

fix(build): update nix flake to work with current NixOS unstable #152

ThinkChaos commented Nov 28, 2023 •

edited

Loading

unode commented Dec 1, 2023 •

edited

Loading

ThinkChaos commented Dec 1, 2023 •

edited

Loading

PhDyellow commented Dec 27, 2023

bast commented Jan 6, 2024

XenGi commented Jan 9, 2024 •

edited

Loading

unode commented Jan 9, 2024

ThinkChaos commented Jan 9, 2024 •

edited

Loading

XenGi commented Jan 11, 2024

adminy commented Jul 2, 2024 •

edited

Loading

ThinkChaos commented Jul 4, 2024

ThinkChaos commented Jul 23, 2024

ThinkChaos commented Aug 21, 2024

adminy commented Sep 13, 2024

fix(build): update nix flake to work with current NixOS unstable #152

Are you sure you want to change the base?

fix(build): update nix flake to work with current NixOS unstable #152

Conversation

ThinkChaos commented Nov 28, 2023 • edited Loading

unode commented Dec 1, 2023 • edited Loading

ThinkChaos commented Dec 1, 2023 • edited Loading

PhDyellow commented Dec 27, 2023

bast commented Jan 6, 2024

XenGi commented Jan 9, 2024 • edited Loading

unode commented Jan 9, 2024

ThinkChaos commented Jan 9, 2024 • edited Loading

XenGi commented Jan 11, 2024

adminy commented Jul 2, 2024 • edited Loading

ThinkChaos commented Jul 4, 2024

ThinkChaos commented Jul 23, 2024

ThinkChaos commented Aug 21, 2024

adminy commented Sep 13, 2024

ThinkChaos commented Nov 28, 2023 •

edited

Loading

unode commented Dec 1, 2023 •

edited

Loading

ThinkChaos commented Dec 1, 2023 •

edited

Loading

XenGi commented Jan 9, 2024 •

edited

Loading

ThinkChaos commented Jan 9, 2024 •

edited

Loading

adminy commented Jul 2, 2024 •

edited

Loading