From eed5d1b8600797072e9d5de84ab6a8f13abf4e30 Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Sun, 28 Jun 2026 02:40:25 +0200 Subject: [PATCH 1/6] openresty: add update script (cherry picked from commit 05f57a7e9c40dbb80390b79212232c79f63cc61d) --- pkgs/servers/http/openresty/default.nix | 38 +++++++++++++++++++++---- 1 file changed, 33 insertions(+), 5 deletions(-) diff --git a/pkgs/servers/http/openresty/default.nix b/pkgs/servers/http/openresty/default.nix index 8e60573f4a51..c58ddabc4ea3 100644 --- a/pkgs/servers/http/openresty/default.nix +++ b/pkgs/servers/http/openresty/default.nix @@ -7,17 +7,21 @@ libpq, nixosTests, withPostgres ? true, + curl, + jq, + nix-update, + writeShellApplication, ... }@args: callPackage ../nginx/generic.nix args rec { pname = "openresty"; - nginxVersion = "1.27.1"; - version = "${nginxVersion}.2"; + version = "1.27.1.2"; + nginxVersion = lib.concatStringsSep "." (lib.init (lib.splitString "." version)); src = fetchurl { url = "https://openresty.org/download/openresty-${version}.tar.gz"; - sha256 = "sha256-dPB29+NksqmabF+btTHCdhDHiYWr6Va0QrGSoilfdUg="; + hash = "sha256-dPB29+NksqmabF+btTHCdhDHiYWr6Va0QrGSoilfdUg="; }; # generic.nix applies fixPatch on top of every patch defined there. @@ -59,8 +63,32 @@ callPackage ../nginx/generic.nix args rec { ln -s $out/nginx/html $out/html ''; - passthru.tests = { - inherit (nixosTests) openresty-lua; + passthru = { + tests = { + inherit (nixosTests) openresty-lua; + }; + updateScript = lib.getExe (writeShellApplication { + name = "openresty-update"; + runtimeInputs = [ + curl + jq + nix-update + ]; + text = '' + version="$( + curl -fsSL https://api.github.com/repos/openresty/openresty/tags?per_page=1 | + jq -r '.[0].name' | + sed 's/^v//' + )" + echo "Local: ${version}" + echo "Latest: $version" + + nix-update \ + --override-filename="pkgs/servers/http/openresty/default.nix" \ + --version="''${version}" \ + openresty + ''; + }); }; meta = { From d1edc23f617f04c620bff66eee089dccf52de89d Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Sun, 28 Jun 2026 02:40:44 +0200 Subject: [PATCH 2/6] nginx: fix test and update script passthru Otherwise all nginx forks gain all of nginx' tests. (cherry picked from commit e9f301fcf7c34eca2691c6f321b2e6e3a349abe9) --- pkgs/servers/http/nginx/generic.nix | 45 +++++++++++++++-------------- 1 file changed, 23 insertions(+), 22 deletions(-) diff --git a/pkgs/servers/http/nginx/generic.nix b/pkgs/servers/http/nginx/generic.nix index 983b003d2748..e18c7d1ac2ef 100644 --- a/pkgs/servers/http/nginx/generic.nix +++ b/pkgs/servers/http/nginx/generic.nix @@ -46,9 +46,7 @@ outer@{ postInstall ? "", meta ? null, nginx-doc ? outer.nginx-doc, - passthru ? { - tests = { }; - }, + passthru ? { }, }: let @@ -281,25 +279,28 @@ stdenv.mkDerivation { passthru = { inherit modules; - tests = { - inherit (nixosTests) - nginx - nginx-auth - nginx-etag - nginx-etag-compression - nginx-globalredirect - nginx-http3 - nginx-proxyprotocol - nginx-pubhtml - nginx-sso - nginx-status-page - nginx-unix-socket - ; - variants = lib.recurseIntoAttrs nixosTests.nginx-variants; - acme-integration = nixosTests.acme.nginx; - acme-integration-without-reload = nixosTests.acme.nginx-without-reload; - } - // passthru.tests; + tests = + passthru.tests or { + inherit (nixosTests) + nginx + nginx-auth + nginx-etag + nginx-etag-compression + nginx-globalredirect + nginx-http3 + nginx-proxyprotocol + nginx-pubhtml + nginx-sso + nginx-status-page + nginx-unix-socket + ; + variants = lib.recurseIntoAttrs nixosTests.nginx-variants; + acme-integration = nixosTests.acme.nginx; + acme-integration-without-reload = nixosTests.acme.nginx-without-reload; + }; + } + // lib.optionalAttrs (passthru ? updateScript) { + inherit (passthru) updateScript; }; meta = From 2c74ee68e88dd5a44586c4a74404a51ef3a7de2d Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Sun, 28 Jun 2026 02:51:13 +0200 Subject: [PATCH 3/6] openresty: 1.27.1.2 -> 1.31.1.1 https://openresty.org/en/changelog-1031001.html (1.31.x) https://openresty.org/en/changelog-1029002.html (1.29.x) Fixes: CVE-2026-1642 CVE-2026-9256 CVE-2026-27651 CVE-2026-27654 CVE-2026-27784 CVE-2026-28753 CVE-2026-28755 CVE-2026-32647 CVE-2026-40460 CVE-2026-40701 CVE-2026-42934 CVE-2026-42945 CVE-2026-42946 (cherry picked from commit e9f2aca3d1d2bcd255fec2f86fa10e5e93cd1528) --- pkgs/servers/http/openresty/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/servers/http/openresty/default.nix b/pkgs/servers/http/openresty/default.nix index c58ddabc4ea3..36e3acade7a8 100644 --- a/pkgs/servers/http/openresty/default.nix +++ b/pkgs/servers/http/openresty/default.nix @@ -16,12 +16,12 @@ callPackage ../nginx/generic.nix args rec { pname = "openresty"; - version = "1.27.1.2"; + version = "1.31.1.1"; nginxVersion = lib.concatStringsSep "." (lib.init (lib.splitString "." version)); src = fetchurl { url = "https://openresty.org/download/openresty-${version}.tar.gz"; - hash = "sha256-dPB29+NksqmabF+btTHCdhDHiYWr6Va0QrGSoilfdUg="; + hash = "sha256-ZbeLqt0/CYQFXeib8T9KGTLlv+nDGTIDehNOorGgzkI="; }; # generic.nix applies fixPatch on top of every patch defined there. From 4f30adc91333afe06750f96764b6bae8008f62d9 Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Sun, 28 Jun 2026 03:04:29 +0200 Subject: [PATCH 4/6] openresty: include nginx-variants test in passthru.tests (cherry picked from commit ad3a0656fb8beae4da9985a2de862f49391f5589) --- pkgs/servers/http/openresty/default.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/pkgs/servers/http/openresty/default.nix b/pkgs/servers/http/openresty/default.nix index 36e3acade7a8..a6dac861edca 100644 --- a/pkgs/servers/http/openresty/default.nix +++ b/pkgs/servers/http/openresty/default.nix @@ -66,6 +66,7 @@ callPackage ../nginx/generic.nix args rec { passthru = { tests = { inherit (nixosTests) openresty-lua; + inherit (nixosTests.nginx-variants) openresty; }; updateScript = lib.getExe (writeShellApplication { name = "openresty-update"; From 5486961d070902f1438ba9fa7297e3d7528dff79 Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Sun, 28 Jun 2026 03:47:25 +0200 Subject: [PATCH 5/6] openresty: wrap restydoc with groff Fixes: #416400 (cherry picked from commit b09918a07d4587bb36a8e097066b2813120494e7) --- pkgs/servers/http/openresty/default.nix | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/pkgs/servers/http/openresty/default.nix b/pkgs/servers/http/openresty/default.nix index a6dac861edca..27f0bd52ee89 100644 --- a/pkgs/servers/http/openresty/default.nix +++ b/pkgs/servers/http/openresty/default.nix @@ -3,8 +3,10 @@ runCommand, lib, fetchurl, + groff, perl, libpq, + makeWrapper, nixosTests, withPostgres ? true, curl, @@ -40,6 +42,7 @@ callPackage ../nginx/generic.nix args rec { nativeBuildInputs = [ libpq.pg_config + makeWrapper perl ]; @@ -61,6 +64,9 @@ callPackage ../nginx/generic.nix args rec { ln -s $out/nginx/bin/nginx $out/bin/nginx ln -s $out/nginx/conf $out/conf ln -s $out/nginx/html $out/html + + wrapProgram $out/bin/restydoc \ + --prefix PATH : ${groff}/bin ''; passthru = { From 6e94e93f4bfc0996958eacee114e73c130012064 Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Sun, 28 Jun 2026 03:54:03 +0200 Subject: [PATCH 6/6] openresty: fix nginx path in resty script Fixes: #383002 (cherry picked from commit 881a5eba9fa859a99ce3af1885adf492fa7b82db) --- pkgs/servers/http/openresty/default.nix | 3 +++ 1 file changed, 3 insertions(+) diff --git a/pkgs/servers/http/openresty/default.nix b/pkgs/servers/http/openresty/default.nix index 27f0bd52ee89..4910c45a196a 100644 --- a/pkgs/servers/http/openresty/default.nix +++ b/pkgs/servers/http/openresty/default.nix @@ -67,6 +67,9 @@ callPackage ../nginx/generic.nix args rec { wrapProgram $out/bin/restydoc \ --prefix PATH : ${groff}/bin + + substituteInPlace $out/bin/resty \ + --replace-fail "'bin/nginx'" "'$out/bin/nginx'" ''; passthru = {