From 875f00ed4034d0c973b8194f7f0b958702d77839 Mon Sep 17 00:00:00 2001 From: Maximilian Bosch Date: Sat, 12 Oct 2024 10:34:27 +0200 Subject: [PATCH] gogs: remove Upstream development has stalled and several critical vulnerabilities that weren't addressed within a year[1][2]. Back then it was fair to mark it as insecure, but given nothing has happened since, it's time to remove it. [1] https://forgejo.org/2023-11-release-v1-20-5-1/ [2] https://github.com/gogs/gogs/issues/7777 --- .../manual/release-notes/rl-2411.section.md | 4 + nixos/modules/misc/ids.nix | 4 +- nixos/modules/module-list.nix | 1 - nixos/modules/services/misc/gogs.nix | 271 ------------------ .../version-management/gogs/default.nix | 54 ---- pkgs/top-level/aliases.nix | 6 + pkgs/top-level/all-packages.nix | 2 - 7 files changed, 12 insertions(+), 330 deletions(-) delete mode 100644 nixos/modules/services/misc/gogs.nix delete mode 100644 pkgs/applications/version-management/gogs/default.nix diff --git a/nixos/doc/manual/release-notes/rl-2411.section.md b/nixos/doc/manual/release-notes/rl-2411.section.md index 46fe89bff5a4..1223555261a1 100644 --- a/nixos/doc/manual/release-notes/rl-2411.section.md +++ b/nixos/doc/manual/release-notes/rl-2411.section.md @@ -207,6 +207,10 @@ - `deno` has been updated to v2 which has breaking changes. Upstream will be abandoning v1 soon but for now you can use `deno_1` if you are yet to migrate (will be removed prior to cutting a final 24.11 release). +- `gogs` has been removed. Upstream development has stalled and it has several + [critical vulnerabilities](https://github.com/gogs/gogs/issues/7777) that weren't addressed + within a year. Consider migrating to `forgejo` or `gitea`. + - `knot-dns` has been updated to version 3.4.x. Check the [migration guide](https://www.knot-dns.cz/docs/latest/html/migration.html#upgrade-3-3-x-to-3-4-x) for breaking changes. - `services.kubernetes.kubelet.clusterDns` now accepts a list of DNS resolvers rather than a single string, bringing the module more in line with the upstream Kubelet configuration schema. diff --git a/nixos/modules/misc/ids.nix b/nixos/modules/misc/ids.nix index ed016b552edc..8b0127dc29f7 100644 --- a/nixos/modules/misc/ids.nix +++ b/nixos/modules/misc/ids.nix @@ -296,7 +296,7 @@ in sickbeard = 265; headphones = 266; # couchpotato = 267; # unused, removed 2022-01-01 - gogs = 268; + # gogs = 268; # unused, removed in 2024-10-12 #pdns-recursor = 269; # dynamically allocated as of 2020-20-18 #kresd = 270; # switched to "knot-resolver" with dynamic ID rpc = 271; @@ -607,7 +607,7 @@ in sickbeard = 265; headphones = 266; # couchpotato = 267; # unused, removed 2022-01-01 - gogs = 268; + # gogs = 268; # unused, removed in 2024-10-12 #kresd = 270; # switched to "knot-resolver" with dynamic ID #rpc = 271; # unused #geoip = 272; # unused diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix index 6910458baf40..6f5357382dc5 100644 --- a/nixos/modules/module-list.nix +++ b/nixos/modules/module-list.nix @@ -759,7 +759,6 @@ ./services/misc/gitlab.nix ./services/misc/gitolite.nix ./services/misc/gitweb.nix - ./services/misc/gogs.nix ./services/misc/gollum.nix ./services/misc/gotenberg.nix ./services/misc/gpsd.nix diff --git a/nixos/modules/services/misc/gogs.nix b/nixos/modules/services/misc/gogs.nix deleted file mode 100644 index a2c1ad0779e1..000000000000 --- a/nixos/modules/services/misc/gogs.nix +++ /dev/null @@ -1,271 +0,0 @@ -{ config, lib, options, pkgs, ... }: -let - cfg = config.services.gogs; - opt = options.services.gogs; - configFile = pkgs.writeText "app.ini" '' - BRAND_NAME = ${cfg.appName} - RUN_USER = ${cfg.user} - RUN_MODE = prod - - [database] - TYPE = ${cfg.database.type} - HOST = ${cfg.database.host}:${toString cfg.database.port} - NAME = ${cfg.database.name} - USER = ${cfg.database.user} - PASSWORD = #dbpass# - PATH = ${cfg.database.path} - - [repository] - ROOT = ${cfg.repositoryRoot} - - [server] - DOMAIN = ${cfg.domain} - HTTP_ADDR = ${cfg.httpAddress} - HTTP_PORT = ${toString cfg.httpPort} - EXTERNAL_URL = ${cfg.rootUrl} - - [session] - COOKIE_NAME = session - COOKIE_SECURE = ${lib.boolToString cfg.cookieSecure} - - [security] - SECRET_KEY = #secretkey# - INSTALL_LOCK = true - - [log] - ROOT_PATH = ${cfg.stateDir}/log - - ${cfg.extraConfig} - ''; -in - -{ - options = { - services.gogs = { - enable = lib.mkOption { - default = false; - type = lib.types.bool; - description = "Enable Go Git Service."; - }; - - useWizard = lib.mkOption { - default = false; - type = lib.types.bool; - description = "Do not generate a configuration and use Gogs' installation wizard instead. The first registered user will be administrator."; - }; - - stateDir = lib.mkOption { - default = "/var/lib/gogs"; - type = lib.types.str; - description = "Gogs data directory."; - }; - - user = lib.mkOption { - type = lib.types.str; - default = "gogs"; - description = "User account under which Gogs runs."; - }; - - group = lib.mkOption { - type = lib.types.str; - default = "gogs"; - description = "Group account under which Gogs runs."; - }; - - database = { - type = lib.mkOption { - type = lib.types.enum [ "sqlite3" "mysql" "postgres" ]; - example = "mysql"; - default = "sqlite3"; - description = "Database engine to use."; - }; - - host = lib.mkOption { - type = lib.types.str; - default = "127.0.0.1"; - description = "Database host address."; - }; - - port = lib.mkOption { - type = lib.types.port; - default = 3306; - description = "Database host port."; - }; - - name = lib.mkOption { - type = lib.types.str; - default = "gogs"; - description = "Database name."; - }; - - user = lib.mkOption { - type = lib.types.str; - default = "gogs"; - description = "Database user."; - }; - - password = lib.mkOption { - type = lib.types.str; - default = ""; - description = '' - The password corresponding to {option}`database.user`. - Warning: this is stored in cleartext in the Nix store! - Use {option}`database.passwordFile` instead. - ''; - }; - - passwordFile = lib.mkOption { - type = lib.types.nullOr lib.types.path; - default = null; - example = "/run/keys/gogs-dbpassword"; - description = '' - A file containing the password corresponding to - {option}`database.user`. - ''; - }; - - path = lib.mkOption { - type = lib.types.str; - default = "${cfg.stateDir}/data/gogs.db"; - defaultText = lib.literalExpression ''"''${config.${opt.stateDir}}/data/gogs.db"''; - description = "Path to the sqlite3 database file."; - }; - }; - - appName = lib.mkOption { - type = lib.types.str; - default = "Gogs: Go Git Service"; - description = "Application name."; - }; - - repositoryRoot = lib.mkOption { - type = lib.types.str; - default = "${cfg.stateDir}/repositories"; - defaultText = lib.literalExpression ''"''${config.${opt.stateDir}}/repositories"''; - description = "Path to the git repositories."; - }; - - domain = lib.mkOption { - type = lib.types.str; - default = "localhost"; - description = "Domain name of your server."; - }; - - rootUrl = lib.mkOption { - type = lib.types.str; - default = "http://localhost:3000/"; - description = "Full public URL of Gogs server."; - }; - - httpAddress = lib.mkOption { - type = lib.types.str; - default = "0.0.0.0"; - description = "HTTP listen address."; - }; - - httpPort = lib.mkOption { - type = lib.types.port; - default = 3000; - description = "HTTP listen port."; - }; - - cookieSecure = lib.mkOption { - type = lib.types.bool; - default = false; - description = '' - Marks session cookies as "secure" as a hint for browsers to only send - them via HTTPS. This option is recommend, if Gogs is being served over HTTPS. - ''; - }; - - extraConfig = lib.mkOption { - type = lib.types.str; - default = ""; - description = "Configuration lines appended to the generated Gogs configuration file."; - }; - }; - }; - - config = lib.mkIf cfg.enable { - - systemd.services.gogs = { - description = "Gogs (Go Git Service)"; - after = [ "network.target" ]; - wantedBy = [ "multi-user.target" ]; - path = [ pkgs.gogs ]; - - preStart = let - runConfig = "${cfg.stateDir}/custom/conf/app.ini"; - secretKey = "${cfg.stateDir}/custom/conf/secret_key"; - in '' - mkdir -p ${cfg.stateDir} - - # copy custom configuration and generate a random secret key if needed - ${lib.optionalString (cfg.useWizard == false) '' - mkdir -p ${cfg.stateDir}/custom/conf - cp -f ${configFile} ${runConfig} - - if [ ! -e ${secretKey} ]; then - head -c 16 /dev/urandom | base64 > ${secretKey} - fi - - KEY=$(head -n1 ${secretKey}) - DBPASS=$(head -n1 ${cfg.database.passwordFile}) - sed -e "s,#secretkey#,$KEY,g" \ - -e "s,#dbpass#,$DBPASS,g" \ - -i ${runConfig} - ''} - - mkdir -p ${cfg.repositoryRoot} - # update all hooks' binary paths - HOOKS=$(find ${cfg.repositoryRoot} -mindepth 4 -maxdepth 4 -type f -wholename "*git/hooks/*") - if [ "$HOOKS" ] - then - sed -ri 's,/nix/store/[a-z0-9.-]+/bin/gogs,${pkgs.gogs}/bin/gogs,g' $HOOKS - sed -ri 's,/nix/store/[a-z0-9.-]+/bin/env,${pkgs.coreutils}/bin/env,g' $HOOKS - sed -ri 's,/nix/store/[a-z0-9.-]+/bin/bash,${pkgs.bash}/bin/bash,g' $HOOKS - sed -ri 's,/nix/store/[a-z0-9.-]+/bin/perl,${pkgs.perl}/bin/perl,g' $HOOKS - fi - ''; - - serviceConfig = { - Type = "simple"; - User = cfg.user; - Group = cfg.group; - WorkingDirectory = cfg.stateDir; - ExecStart = "${pkgs.gogs}/bin/gogs web"; - Restart = "always"; - UMask = "0027"; - }; - - environment = { - USER = cfg.user; - HOME = cfg.stateDir; - GOGS_WORK_DIR = cfg.stateDir; - }; - }; - - users = lib.mkIf (cfg.user == "gogs") { - users.gogs = { - description = "Go Git Service"; - uid = config.ids.uids.gogs; - group = "gogs"; - home = cfg.stateDir; - createHome = true; - shell = pkgs.bash; - }; - groups.gogs.gid = config.ids.gids.gogs; - }; - - warnings = lib.optional (cfg.database.password != "") - ''config.services.gogs.database.password will be stored as plaintext - in the Nix store. Use database.passwordFile instead.''; - - # Create database passwordFile default when password is configured. - services.gogs.database.passwordFile = - (lib.mkDefault (toString (pkgs.writeTextFile { - name = "gogs-database-password"; - text = cfg.database.password; - }))); - }; -} diff --git a/pkgs/applications/version-management/gogs/default.nix b/pkgs/applications/version-management/gogs/default.nix deleted file mode 100644 index 5b7a986cf206..000000000000 --- a/pkgs/applications/version-management/gogs/default.nix +++ /dev/null @@ -1,54 +0,0 @@ -{ lib, buildGoModule, fetchFromGitHub, makeWrapper -, git, bash, gzip, openssh, pam -, sqliteSupport ? true -, pamSupport ? true -}: - -buildGoModule rec { - pname = "gogs"; - version = "0.13.0"; - - src = fetchFromGitHub { - owner = "gogs"; - repo = "gogs"; - rev = "v${version}"; - sha256 = "sha256-UfxE+NaqDr3XUXpvlV989Iwjq/lsAwpMTDAPkcOmma8="; - }; - - vendorHash = "sha256-ISJOEJ1DWO4nnMpDuZ36Nq528LhgekDh3XUF8adlj2w="; - - subPackages = [ "." ]; - - postPatch = '' - patchShebangs . - ''; - - nativeBuildInputs = [ makeWrapper openssh ]; - - buildInputs = lib.optional pamSupport pam; - - tags = - ( lib.optional sqliteSupport "sqlite" - ++ lib.optional pamSupport "pam"); - - postInstall = '' - - wrapProgram $out/bin/gogs \ - --prefix PATH : ${lib.makeBinPath [ bash git gzip openssh ]} - ''; - - meta = with lib; { - description = "Painless self-hosted Git service"; - homepage = "https://gogs.io"; - license = licenses.mit; - maintainers = [ maintainers.schneefux ]; - mainProgram = "gogs"; - knownVulnerabilities = [ '' - Gogs has known unpatched vulnerabilities and upstream maintainers appears to be unresponsive. - - More information can be found in forgejo's blogpost: https://forgejo.org/2023-11-release-v1-20-5-1/ - - You might want to consider migrating to Gitea or forgejo. - '' ]; - }; -} diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix index df8c9c50bc39..e9f08fe3c06e 100644 --- a/pkgs/top-level/aliases.nix +++ b/pkgs/top-level/aliases.nix @@ -561,6 +561,12 @@ mapAliases { gmtp = throw "'gmtp' has been removed due to lack of maintenance upstream. Consider using 'gnome-music' instead"; # Added 2024-09-14 gnome-latex = throw "'gnome-latex' has been superseded by 'enter-tex'"; # Added 2024-09-18 gnu-cobol = gnucobol; # Added 2024-09-17 + gogs = throw '' + Gogs development has stalled. Also, it has several unpatched, critical vulnerabilities that + weren't addressed within a year: https://github.com/gogs/gogs/issues/7777 + + Consider migrating to forgejo or gitea. + ''; # Added 2024-10-12 go-dependency-manager = throw "'go-dependency-manager' is unmaintained and the go community now uses 'go.mod' mostly instead"; # Added 2023-10-04 gotktrix = throw "'gotktrix' has been removed, as it was broken and unmaintained"; # Added 2023-12-06 git-backup = throw "git-backup has been removed, as it has been abandoned upstream. Consider using git-backup-go instead."; diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index d3903f1b5a3c..06f38792564c 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -7893,8 +7893,6 @@ with pkgs; gitqlient = libsForQt5.callPackage ../applications/version-management/gitqlient { }; - gogs = callPackage ../applications/version-management/gogs { }; - git-latexdiff = callPackage ../tools/typesetting/git-latexdiff { }; gokart = callPackage ../development/tools/gokart { };