From 0ac29a00424867c82d906e5600c6ad64ad19b403 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Kov=C3=A1cs=20B=C3=A1lint=20Hunor?= Date: Thu, 15 Oct 2026 23:57:37 +0300 Subject: [PATCH] Update the Nix flake to 0.1.0-alpha8 Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01BTZhMsNyJ6k4VC68CNb5WU --- .github/README.md | 2 +- docs/linux-port/packaging.md | 2 +- flake.nix | 6 +++--- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/README.md b/.github/README.md index c1d5d912fdc3..a12b5dd2215c 100644 --- a/.github/README.md +++ b/.github/README.md @@ -64,7 +64,7 @@ programs.linuxfiles = { }; ``` -This installs a patched helper, a matching polkit action and trusted deployment manifest, and enables the pkexec wrapper. A session authentication agent is required. The flake currently pins alpha7, which supports this opt-in; it will be updated to alpha8 after the release assets and hashes are published. A runtime-capability assertion rejects incompatible or unmarked package overrides. See [Nix packaging details](../docs/linux-port/packaging.md#nix-flake). +This installs a patched helper, a matching polkit action and trusted deployment manifest, and enables the pkexec wrapper. A session authentication agent is required. The flake pins alpha8, which supports this opt-in. A runtime-capability assertion rejects incompatible or unmarked package overrides. See [Nix packaging details](../docs/linux-port/packaging.md#nix-flake). ### AppImage diff --git a/docs/linux-port/packaging.md b/docs/linux-port/packaging.md index b6015ca85660..e1d5b86e250e 100644 --- a/docs/linux-port/packaging.md +++ b/docs/linux-port/packaging.md @@ -174,7 +174,7 @@ The module selects the package's `enableRootActions` variant, removes its disabl `pkexec` uses `/run/wrappers/bin` before the system profile and `/usr/bin`/`/bin`. The module enables `security.polkit.enablePkexecWrapper` when present; older nixpkgs uses `security.wrappers.pkexec`. Only pkexec is setuid, never the LinuxFiles helper. A session authentication agent and an administrator identity are still required. The narrow store exception accepts a root-owned sticky `/nix/store` with group write (1775), but rejects other write there, non-root ownership, and any writable entries beneath it. Native `/usr` helper/policy checks retain their existing restrictions. -**Release integration:** the current pin is `0.1.0-alpha7`; like alpha4 to alpha6, it includes deployment-manifest and Nix elevation-wrapper discovery. Its `passthru.supportsNixRootActions` marker is true, so the module accepts `rootActions = true`. Overrides with a false or missing marker are still rejected by the runtime-capability assertion. For future releases, verify that both runtime changes are present before retaining the compatible-runtime marker. +**Release integration:** the current pin is `0.1.0-alpha8`; like alpha4 to alpha7, it includes deployment-manifest and Nix elevation-wrapper discovery. Its `passthru.supportsNixRootActions` marker is true, so the module accepts `rootActions = true`. Overrides with a false or missing marker are still rejected by the runtime-capability assertion. For future releases, verify that both runtime changes are present before retaining the compatible-runtime marker. Per release (after CI has attached `SHA256SUMS`; the flake's tag is `linux-v`): diff --git a/flake.nix b/flake.nix index b327517d1d99..de8f074abc11 100644 --- a/flake.nix +++ b/flake.nix @@ -18,15 +18,15 @@ , icu, openssl, zlib, krb5, glib, enableRootActions ? false }: let # version and both hashes are rewritten by scripts/linux/update-nix-flake.sh - version = "0.1.0-alpha7"; + version = "0.1.0-alpha8"; base = "https://github.com/MemerGamer/LinuxFiles/releases/download/linux-v${version}"; app = fetchurl { url = "${base}/files-linux-x64.tar.gz"; - hash = "sha256-FNGHD+KmM98mw/ikmIeO44bel4Ts3fsFhZgFmreBXSk="; + hash = "sha256-cN0r4F7Mytw6tkLvcdyaMMB6/CcZnsFTfn6L7H133BA="; }; packaging = fetchurl { url = "${base}/files-packaging.tar.gz"; - hash = "sha256-GVfnUOPC2S0hEwAiaiRSpc3npSZSdrqhLpF5I9+GVTs="; + hash = "sha256-6KKT6JoYn+PZNlklz+4w7Eaf/R3OAeBp44FTJSoYpUc="; }; # Opened with dlopen at runtime, so autoPatchelf cannot discover them; added to every ELF file's runpath. runtimeLibs = [