Permalink
Switch branches/tags
v206 v192 release-16.03-start last-glibc-2.13 black@2016-05-13 binary backups/0.12-release@15293 backups/0.11-release@9315 backups/0.10-release@6725 backups/0.9-release@4651 backups/0.8-release@2530 backups/0.7-release@2398 backups/0.6-release@1775 backups/0.5.1-release@996 backups/0.5-stable@34171 backups/0.5-release@989 backups/xorg-7.5@18179 backups/x86_64-darwin@34171 backups/x-updates@26704 backups/x-updates@22736 backups/usability@34170 backups/udev-173@28837 backups/stdenv-updates@34093 backups/stdenv-updates@32824 backups/stdenv-updates@19858 backups/stdenv-updates@18281 backups/stdenv-updates@15332 backups/stdenv-updates@12144 backups/stdenv-updates@10965 backups/stdenv-updates2@18282 backups/stdenv-updates2@18273 backups/stdenv-updates-merge@10849 backups/stdenv-bootstrap-20100825@23426 backups/stdenv-ada@26758 backups/pure-python@34174 backups/parallel-building-merger@34171 backups/one-click@2549 backups/nixos-pkgs@34170 backups/multitask-builds@34175 backups/multiple-outputs-sandbox@34172 backups/modular-python@26697 backups/master@10848 backups/master@59 backups/mass-update-01@31456 backups/martin@828 backups/martin2@34171 backups/logistics@34171 backups/libpng15@32782 backups/kmod-no-lib-modules@34172 backups/kmod-MODULE_DIR@33576 backups/kernel-config@19023 backups/kde-4.7@34170 backups/glib-2.30@32938 backups/glib-2.30-take2@33502 backups/freebsd-losser@34171 backups/drop-kde4.5@30929 backups/darwin-without-xcode@34172 backups/darwin-updates@34176 backups/cve-2010-3856@34170 backups/armv5tel-linux@18007 18.03 18.03-beta 17.09 17.09-beta 17.03 17.03-beta 16.09 16.09-beta 16.03 16.03-beta 15.09 15.09-beta 0.14 0.13 0.12 0.11 0.10 0.9 0.8 0.7 0.6 0.5.1 0.5 0.4 0.3 0.2 0.1
Nothing to show
Find file Copy path
Fetching contributors…
Cannot retrieve contributors at this time
818 lines (806 sloc) 22.3 KB
<section xmlns="http://docbook.org/ns/docbook"
xmlns:xlink="http://www.w3.org/1999/xlink"
xmlns:xi="http://www.w3.org/2001/XInclude"
version="5.0"
xml:id="sec-release-17.03">
<title>Release 17.03 (“Gorilla”, 2017/03/31)</title>
<section xmlns="http://docbook.org/ns/docbook"
xmlns:xlink="http://www.w3.org/1999/xlink"
xmlns:xi="http://www.w3.org/2001/XInclude"
version="5.0"
xml:id="sec-release-17.03-highlights">
<title>Highlights</title>
<para>
In addition to numerous new and upgraded packages, this release has the
following highlights:
</para>
<itemizedlist>
<listitem>
<para>
Nixpkgs is now extensible through overlays. See the
<link
xlink:href="https://nixos.org/nixpkgs/manual/#sec-overlays-install">Nixpkgs
manual</link> for more information.
</para>
</listitem>
<listitem>
<para>
This release is based on Glibc 2.25, GCC 5.4.0 and systemd 232. The
default Linux kernel is 4.9 and Nix is at 1.11.8.
</para>
</listitem>
<listitem>
<para>
The default desktop environment now is KDE's Plasma 5. KDE 4 has been
removed
</para>
</listitem>
<listitem>
<para>
The setuid wrapper functionality now supports setting capabilities.
</para>
</listitem>
<listitem>
<para>
X.org server uses branch 1.19. Due to ABI incompatibilities,
<literal>ati_unfree</literal> keeps forcing 1.17 and
<literal>amdgpu-pro</literal> starts forcing 1.18.
</para>
</listitem>
<listitem>
<para>
Cross compilation has been rewritten. See the nixpkgs manual for details.
The most obvious breaking change is that in derivations there is no
<literal>.nativeDrv</literal> nor <literal>.crossDrv</literal> are now
cross by default, not native.
</para>
</listitem>
<listitem>
<para>
The <literal>overridePackages</literal> function has been rewritten to be
replaced by
<link
xlink:href="https://nixos.org/nixpkgs/manual/#sec-overlays-install">
overlays</link>
</para>
</listitem>
<listitem>
<para>
Packages in nixpkgs can be marked as insecure through listed
vulnerabilities. See the
<link
xlink:href="https://nixos.org/nixpkgs/manual/#sec-allow-insecure">Nixpkgs
manual</link> for more information.
</para>
</listitem>
<listitem>
<para>
PHP now defaults to PHP 7.1
</para>
</listitem>
</itemizedlist>
</section>
<section xmlns="http://docbook.org/ns/docbook"
xmlns:xlink="http://www.w3.org/1999/xlink"
xmlns:xi="http://www.w3.org/2001/XInclude"
version="5.0"
xml:id="sec-release-17.03-new-services">
<title>New Services</title>
<para>
The following new services were added since the last release:
</para>
<itemizedlist>
<listitem>
<para>
<literal>hardware/ckb.nix</literal>
</para>
</listitem>
<listitem>
<para>
<literal>hardware/mcelog.nix</literal>
</para>
</listitem>
<listitem>
<para>
<literal>hardware/usb-wwan.nix</literal>
</para>
</listitem>
<listitem>
<para>
<literal>hardware/video/capture/mwprocapture.nix</literal>
</para>
</listitem>
<listitem>
<para>
<literal>programs/adb.nix</literal>
</para>
</listitem>
<listitem>
<para>
<literal>programs/chromium.nix</literal>
</para>
</listitem>
<listitem>
<para>
<literal>programs/gphoto2.nix</literal>
</para>
</listitem>
<listitem>
<para>
<literal>programs/java.nix</literal>
</para>
</listitem>
<listitem>
<para>
<literal>programs/mtr.nix</literal>
</para>
</listitem>
<listitem>
<para>
<literal>programs/oblogout.nix</literal>
</para>
</listitem>
<listitem>
<para>
<literal>programs/vim.nix</literal>
</para>
</listitem>
<listitem>
<para>
<literal>programs/wireshark.nix</literal>
</para>
</listitem>
<listitem>
<para>
<literal>security/dhparams.nix</literal>
</para>
</listitem>
<listitem>
<para>
<literal>services/audio/ympd.nix</literal>
</para>
</listitem>
<listitem>
<para>
<literal>services/computing/boinc/client.nix</literal>
</para>
</listitem>
<listitem>
<para>
<literal>services/continuous-integration/buildbot/master.nix</literal>
</para>
</listitem>
<listitem>
<para>
<literal>services/continuous-integration/buildbot/worker.nix</literal>
</para>
</listitem>
<listitem>
<para>
<literal>services/continuous-integration/gitlab-runner.nix</literal>
</para>
</listitem>
<listitem>
<para>
<literal>services/databases/riak-cs.nix</literal>
</para>
</listitem>
<listitem>
<para>
<literal>services/databases/stanchion.nix</literal>
</para>
</listitem>
<listitem>
<para>
<literal>services/desktops/gnome3/gnome-terminal-server.nix</literal>
</para>
</listitem>
<listitem>
<para>
<literal>services/editors/infinoted.nix</literal>
</para>
</listitem>
<listitem>
<para>
<literal>services/hardware/illum.nix</literal>
</para>
</listitem>
<listitem>
<para>
<literal>services/hardware/trezord.nix</literal>
</para>
</listitem>
<listitem>
<para>
<literal>services/logging/journalbeat.nix</literal>
</para>
</listitem>
<listitem>
<para>
<literal>services/mail/offlineimap.nix</literal>
</para>
</listitem>
<listitem>
<para>
<literal>services/mail/postgrey.nix</literal>
</para>
</listitem>
<listitem>
<para>
<literal>services/misc/couchpotato.nix</literal>
</para>
</listitem>
<listitem>
<para>
<literal>services/misc/docker-registry.nix</literal>
</para>
</listitem>
<listitem>
<para>
<literal>services/misc/errbot.nix</literal>
</para>
</listitem>
<listitem>
<para>
<literal>services/misc/geoip-updater.nix</literal>
</para>
</listitem>
<listitem>
<para>
<literal>services/misc/gogs.nix</literal>
</para>
</listitem>
<listitem>
<para>
<literal>services/misc/leaps.nix</literal>
</para>
</listitem>
<listitem>
<para>
<literal>services/misc/nix-optimise.nix</literal>
</para>
</listitem>
<listitem>
<para>
<literal>services/misc/ssm-agent.nix</literal>
</para>
</listitem>
<listitem>
<para>
<literal>services/misc/sssd.nix</literal>
</para>
</listitem>
<listitem>
<para>
<literal>services/monitoring/arbtt.nix</literal>
</para>
</listitem>
<listitem>
<para>
<literal>services/monitoring/netdata.nix</literal>
</para>
</listitem>
<listitem>
<para>
<literal>services/monitoring/prometheus/default.nix</literal>
</para>
</listitem>
<listitem>
<para>
<literal>services/monitoring/prometheus/alertmanager.nix</literal>
</para>
</listitem>
<listitem>
<para>
<literal>services/monitoring/prometheus/blackbox-exporter.nix</literal>
</para>
</listitem>
<listitem>
<para>
<literal>services/monitoring/prometheus/json-exporter.nix</literal>
</para>
</listitem>
<listitem>
<para>
<literal>services/monitoring/prometheus/nginx-exporter.nix</literal>
</para>
</listitem>
<listitem>
<para>
<literal>services/monitoring/prometheus/node-exporter.nix</literal>
</para>
</listitem>
<listitem>
<para>
<literal>services/monitoring/prometheus/snmp-exporter.nix</literal>
</para>
</listitem>
<listitem>
<para>
<literal>services/monitoring/prometheus/unifi-exporter.nix</literal>
</para>
</listitem>
<listitem>
<para>
<literal>services/monitoring/prometheus/varnish-exporter.nix</literal>
</para>
</listitem>
<listitem>
<para>
<literal>services/monitoring/sysstat.nix</literal>
</para>
</listitem>
<listitem>
<para>
<literal>services/monitoring/telegraf.nix</literal>
</para>
</listitem>
<listitem>
<para>
<literal>services/monitoring/vnstat.nix</literal>
</para>
</listitem>
<listitem>
<para>
<literal>services/network-filesystems/cachefilesd.nix</literal>
</para>
</listitem>
<listitem>
<para>
<literal>services/network-filesystems/glusterfs.nix</literal>
</para>
</listitem>
<listitem>
<para>
<literal>services/network-filesystems/ipfs.nix</literal>
</para>
</listitem>
<listitem>
<para>
<literal>services/networking/dante.nix</literal>
</para>
</listitem>
<listitem>
<para>
<literal>services/networking/dnscrypt-wrapper.nix</literal>
</para>
</listitem>
<listitem>
<para>
<literal>services/networking/fakeroute.nix</literal>
</para>
</listitem>
<listitem>
<para>
<literal>services/networking/flannel.nix</literal>
</para>
</listitem>
<listitem>
<para>
<literal>services/networking/htpdate.nix</literal>
</para>
</listitem>
<listitem>
<para>
<literal>services/networking/miredo.nix</literal>
</para>
</listitem>
<listitem>
<para>
<literal>services/networking/nftables.nix</literal>
</para>
</listitem>
<listitem>
<para>
<literal>services/networking/powerdns.nix</literal>
</para>
</listitem>
<listitem>
<para>
<literal>services/networking/pdns-recursor.nix</literal>
</para>
</listitem>
<listitem>
<para>
<literal>services/networking/quagga.nix</literal>
</para>
</listitem>
<listitem>
<para>
<literal>services/networking/redsocks.nix</literal>
</para>
</listitem>
<listitem>
<para>
<literal>services/networking/wireguard.nix</literal>
</para>
</listitem>
<listitem>
<para>
<literal>services/system/cgmanager.nix</literal>
</para>
</listitem>
<listitem>
<para>
<literal>services/torrent/opentracker.nix</literal>
</para>
</listitem>
<listitem>
<para>
<literal>services/web-apps/atlassian/confluence.nix</literal>
</para>
</listitem>
<listitem>
<para>
<literal>services/web-apps/atlassian/crowd.nix</literal>
</para>
</listitem>
<listitem>
<para>
<literal>services/web-apps/atlassian/jira.nix</literal>
</para>
</listitem>
<listitem>
<para>
<literal>services/web-apps/frab.nix</literal>
</para>
</listitem>
<listitem>
<para>
<literal>services/web-apps/nixbot.nix</literal>
</para>
</listitem>
<listitem>
<para>
<literal>services/web-apps/selfoss.nix</literal>
</para>
</listitem>
<listitem>
<para>
<literal>services/web-apps/quassel-webserver.nix</literal>
</para>
</listitem>
<listitem>
<para>
<literal>services/x11/unclutter-xfixes.nix</literal>
</para>
</listitem>
<listitem>
<para>
<literal>services/x11/urxvtd.nix</literal>
</para>
</listitem>
<listitem>
<para>
<literal>system/boot/systemd-nspawn.nix</literal>
</para>
</listitem>
<listitem>
<para>
<literal>virtualisation/ecs-agent.nix</literal>
</para>
</listitem>
<listitem>
<para>
<literal>virtualisation/lxcfs.nix</literal>
</para>
</listitem>
<listitem>
<para>
<literal>virtualisation/openstack/keystone.nix</literal>
</para>
</listitem>
<listitem>
<para>
<literal>virtualisation/openstack/glance.nix</literal>
</para>
</listitem>
</itemizedlist>
</section>
<section xmlns="http://docbook.org/ns/docbook"
xmlns:xlink="http://www.w3.org/1999/xlink"
xmlns:xi="http://www.w3.org/2001/XInclude"
version="5.0"
xml:id="sec-release-17.03-incompatibilities">
<title>Backward Incompatibilities</title>
<para>
When upgrading from a previous release, please be aware of the following
incompatible changes:
</para>
<itemizedlist>
<listitem>
<para>
Derivations have no <literal>.nativeDrv</literal> nor
<literal>.crossDrv</literal> and are now cross by default, not native.
</para>
</listitem>
<listitem>
<para>
<literal>stdenv.overrides</literal> is now expected to take
<literal>self</literal> and <literal>super</literal> arguments. See
<literal>lib.trivial.extends</literal> for what those parameters
represent.
</para>
</listitem>
<listitem>
<para>
<literal>ansible</literal> now defaults to ansible version 2 as version 1
has been removed due to a serious
<link
xlink:href="https://www.computest.nl/advisories/CT-2017-0109_Ansible.txt">
vulnerability</link> unpatched by upstream.
</para>
</listitem>
<listitem>
<para>
<literal>gnome</literal> alias has been removed along with
<literal>gtk</literal>, <literal>gtkmm</literal> and several others. Now
you need to use versioned attributes, like <literal>gnome3</literal>.
</para>
</listitem>
<listitem>
<para>
The attribute name of the Radicale daemon has been changed from
<literal>pythonPackages.radicale</literal> to <literal>radicale</literal>.
</para>
</listitem>
<listitem>
<para>
The <literal>stripHash</literal> bash function in
<literal>stdenv</literal> changed according to its documentation; it now
outputs the stripped name to <literal>stdout</literal> instead of putting
it in the variable <literal>strippedName</literal>.
</para>
</listitem>
<listitem>
<para>
PHP now scans for extra configuration .ini files in /etc/php.d instead of
/etc. This prevents accidentally loading non-PHP .ini files that may be in
/etc.
</para>
</listitem>
<listitem>
<para>
Two lone top-level dict dbs moved into <literal>dictdDBs</literal>. This
affects: <literal>dictdWordnet</literal> which is now at
<literal>dictdDBs.wordnet</literal> and <literal>dictdWiktionary</literal>
which is now at <literal>dictdDBs.wiktionary</literal>
</para>
</listitem>
<listitem>
<para>
Parsoid service now uses YAML configuration format.
<literal>service.parsoid.interwikis</literal> is now called
<literal>service.parsoid.wikis</literal> and is a list of either API URLs
or attribute sets as specified in parsoid's documentation.
</para>
</listitem>
<listitem>
<para>
<literal>Ntpd</literal> was replaced by
<literal>systemd-timesyncd</literal> as the default service to synchronize
system time with a remote NTP server. The old behavior can be restored by
setting <literal>services.ntp.enable</literal> to <literal>true</literal>.
Upstream time servers for all NTP implementations are now configured using
<literal>networking.timeServers</literal>.
</para>
</listitem>
<listitem>
<para>
<literal>service.nylon</literal> is now declared using named instances. As
an example:
<programlisting>
services.nylon = {
enable = true;
acceptInterface = "br0";
bindInterface = "tun1";
port = 5912;
};
</programlisting>
should be replaced with:
<programlisting>
services.nylon.myvpn = {
enable = true;
acceptInterface = "br0";
bindInterface = "tun1";
port = 5912;
};
</programlisting>
this enables you to declare a SOCKS proxy for each uplink.
</para>
</listitem>
<listitem>
<para>
<literal>overridePackages</literal> function no longer exists. It is
replaced by
<link
xlink:href="https://nixos.org/nixpkgs/manual/#sec-overlays-install">
overlays</link>. For example, the following code:
<programlisting>
let
pkgs = import &lt;nixpkgs&gt; {};
in
pkgs.overridePackages (self: super: ...)
</programlisting>
should be replaced by:
<programlisting>
let
pkgs = import &lt;nixpkgs&gt; {};
in
import pkgs.path { overlays = [(self: super: ...)]; }
</programlisting>
</para>
</listitem>
<listitem>
<para>
Autoloading connection tracking helpers is now disabled by default. This
default was also changed in the Linux kernel and is considered insecure if
not configured properly in your firewall. If you need connection tracking
helpers (i.e. for active FTP) please enable
<literal>networking.firewall.autoLoadConntrackHelpers</literal> and tune
<literal>networking.firewall.connectionTrackingModules</literal> to suit
your needs.
</para>
</listitem>
<listitem>
<para>
<literal>local_recipient_maps</literal> is not set to empty value by
Postfix service. It's an insecure default as stated by Postfix
documentation. Those who want to retain this setting need to set it via
<literal>services.postfix.extraConfig</literal>.
</para>
</listitem>
<listitem>
<para>
Iputils no longer provide ping6 and traceroute6. The functionality of
these tools has been integrated into ping and traceroute respectively. To
enforce an address family the new flags <literal>-4</literal> and
<literal>-6</literal> have been added. One notable incompatibility is that
specifying an interface (for link-local IPv6 for instance) is no longer
done with the <literal>-I</literal> flag, but by encoding the interface
into the address (<literal>ping fe80::1%eth0</literal>).
</para>
</listitem>
<listitem>
<para>
The socket handling of the <literal>services.rmilter</literal> module has
been fixed and refactored. As rmilter doesn't support binding to more than
one socket, the options <literal>bindUnixSockets</literal> and
<literal>bindInetSockets</literal> have been replaced by
<literal>services.rmilter.bindSocket.*</literal>. The default is still a
unix socket in <literal>/run/rmilter/rmilter.sock</literal>. Refer to the
options documentation for more information.
</para>
</listitem>
<listitem>
<para>
The <literal>fetch*</literal> functions no longer support md5, please use
sha256 instead.
</para>
</listitem>
<listitem>
<para>
The dnscrypt-proxy module interface has been streamlined around the
<option>extraArgs</option> option. Where possible, legacy option
declarations are mapped to <option>extraArgs</option> but will emit
warnings. The <option>resolverList</option> has been outright removed: to
use an unlisted resolver, use the <option>customResolver</option> option.
</para>
</listitem>
<listitem>
<para>
torbrowser now stores local state under
<filename>~/.local/share/tor-browser</filename> by default. Any browser
profile data from the old location, <filename>~/.torbrowser4</filename>,
must be migrated manually.
</para>
</listitem>
<listitem>
<para>
The ihaskell, monetdb, offlineimap and sitecopy services have been
removed.
</para>
</listitem>
</itemizedlist>
</section>
<section xmlns="http://docbook.org/ns/docbook"
xmlns:xlink="http://www.w3.org/1999/xlink"
xmlns:xi="http://www.w3.org/2001/XInclude"
version="5.0"
xml:id="sec-release-17.03-notable-changes">
<title>Other Notable Changes</title>
<itemizedlist>
<listitem>
<para>
Module type system have a new extensible option types feature that allow
to extend certain types, such as enum, through multiple option
declarations of the same option across multiple modules.
</para>
</listitem>
<listitem>
<para>
<literal>jre</literal> now defaults to GTK+ UI by default. This improves
visual consistency and makes Java follow system font style, improving the
situation on HighDPI displays. This has a cost of increased closure size;
for server and other headless workloads it's recommended to use
<literal>jre_headless</literal>.
</para>
</listitem>
<listitem>
<para>
Python 2.6 interpreter and package set have been removed.
</para>
</listitem>
<listitem>
<para>
The Python 2.7 interpreter does not use modules anymore. Instead, all
CPython interpreters now include the whole standard library except for
`tkinter`, which is available in the Python package set.
</para>
</listitem>
<listitem>
<para>
Python 2.7, 3.5 and 3.6 are now built deterministically and 3.4 mostly.
Minor modifications had to be made to the interpreters in order to
generate deterministic bytecode. This has security implications and is
relevant for those using Python in a <literal>nix-shell</literal>. See the
Nixpkgs manual for details.
</para>
</listitem>
<listitem>
<para>
The Python package sets now use a fixed-point combinator and the sets are
available as attributes of the interpreters.
</para>
</listitem>
<listitem>
<para>
The Python function <literal>buildPythonPackage</literal> has been
improved and can be used to build from Setuptools source, Flit source, and
precompiled Wheels.
</para>
</listitem>
<listitem>
<para>
When adding new or updating current Python libraries, the expressions
should be put in separate files in
<literal>pkgs/development/python-modules</literal> and called from
<literal>python-packages.nix</literal>.
</para>
</listitem>
<listitem>
<para>
The dnscrypt-proxy service supports synchronizing the list of public
resolvers without working DNS resolution. This fixes issues caused by the
resolver list becoming outdated. It also improves the viability of
DNSCrypt only configurations.
</para>
</listitem>
<listitem>
<para>
Containers using bridged networking no longer lose their connection after
changes to the host networking.
</para>
</listitem>
<listitem>
<para>
ZFS supports pool auto scrubbing.
</para>
</listitem>
<listitem>
<para>
The bind DNS utilities (e.g. dig) have been split into their own output
and are now also available in <literal>pkgs.dnsutils</literal> and it is
no longer necessary to pull in all of <literal>bind</literal> to use them.
</para>
</listitem>
<listitem>
<para>
Per-user configuration was moved from <filename>~/.nixpkgs</filename> to
<filename>~/.config/nixpkgs</filename>. The former is still valid for
<filename>config.nix</filename> for backwards compatibility.
</para>
</listitem>
</itemizedlist>
</section>
</section>