rt: 4.4.4 -> 5.0.1

[ajs124]

Motivation for this change

Things done

• Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS linux)
• Built on platform(s)
  • NixOS
  • macOS
  • other Linux distributions
• Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
• Tested compilation of all pkgs that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review wip"
• Tested execution of all binary files (usually in ./result/bin/)
• Determined the impact on package closure size (by running nix path-info -S before and after)
• Ensured that relevant documentation is up to date
• Fits CONTRIBUTING.md.

[grahamc]

I'm quite skeptical about these patches you've applied, they don't seem to be relevant to NixOS as a whole. What's up?

[dasJ]

@ajs124 Would you mind adding yourself as a maintainer?

[ajs124]

I'm quite skeptical about these patches you've applied, they don't seem to be relevant to NixOS as a whole. What's up?

dont-check-users_groups.patch is needed for that script to work, most of the others can probably be dropped. Although I'm not sure why you'd want your rt to advertise it's version number on the login page or in every e-mail.

[grahamc]

What is the user/group patch fixing, is that run during build time?

[dasJ]

Yes, and there is no way to turn it off

[grahamc]

[stigtsp]

The patches included in this PR needs more details:
What are their purpose? Are they found in other distributions?

[dasJ]

They are probably not found in other distributions since I created some of them ;) Apart from the users-groups patch (which is needed to get it to "build" in the sandbox) the rest is to prevent RT from leaking its version all over the internet. May be a good choice so people don't find vulns for that specific version too easily

[stigtsp]

Does this mean that SQLite support is dropped? Does this have implications for existing installs?

[ajs124]

Hm. I'd be surprised if anyone is actually using this from nixpkgs right now. I see you fixed the build in 3e50e26. It has broken since. Trying to run the build from that commit doesn't work either, because the RT_SiteConfig.pm isn't writable.

[stigtsp]

Good points. The db-type change seems ok.

[stigtsp]

[..] the rest is to prevent RT from leaking its version all over the internet. May be a good choice so people don't find vulns for that specific version too easily

Thanks for providing more info, and for the work on the patches. :) I'd think patches that remove the RT version from misc places are more suited for upstream, imho.

[stigtsp]

LGTM apart from the version number stripping patches.

[ajs124]

Dropped the two version-stripping patches.
If there are no further objections, I'd merge this soonish, as ZHF (#122042) has started and this currently fails on master.

[jonringer]

LGTM, but not really familiar with perl

@stigtsp is happy with it

https://github.com/NixOS/nixpkgs/pull/120926

25 packages built:
perl530Packages.AlienBaseModuleBuild perl530Packages.AlienLibGumbo perl530Packages.CryptX509 perl530Packages.HTMLFormatExternal perl530Packages.HTMLGumbo perl530Packages.HTTPHeadersActionPack perl530Packages.MooXTypeTiny perl530Packages.PathDispatcher perl530Packages.ShellConfigGenerate perl530Packages.ShellGuess perl530Packages.TextWordDiff perl530Packages.WebMachine perl532Packages.AlienBaseModuleBuild perl532Packages.AlienLibGumbo perl532Packages.CryptX509 perl532Packages.HTMLFormatExternal perl532Packages.HTMLGumbo perl532Packages.HTTPHeadersActionPack perl532Packages.MooXTypeTiny perl532Packages.PathDispatcher perl532Packages.ShellConfigGenerate perl532Packages.ShellGuess perl532Packages.TextWordDiff perl532Packages.WebMachine rt

[sbourdeauducq]

Is there a NixOS module available for this? If not, could someone share the relevant parts of their configuration.nix to use this with a web server (preferably nginx)?

[ajs124]

@sbourdeauducq: https://gist.github.com/ajs124/ff04ab14435908d914cf5cedbc56a52e

It's probably not generic enough + I removed the postgres config, because that uses our own postgres module. Although scrolling over it, I forgot to remove the sandbox and apparmor parameters for the systemd services.
Maybe it will be useful to you, but I don't really plan on putting this into nixpkgs.

[sbourdeauducq]

@ajs124 thank you!