Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

vanguards: init at 0.3.1 #345996

Open
wants to merge 2 commits into
base: master
Choose a base branch
from

Conversation

ForgottenBeast
Copy link

add derivation for vanguards, a set of scripts that increase security for tor hidden services by protecting against guard discovery attacks

resources:
https://github.com/mikeperry-tor/vanguards
https://spec.torproject.org/vanguards-spec/index.html?highlight=vanguards

Things done

  • Built on platform(s)
    • x86_64-linux
    • aarch64-linux
    • x86_64-darwin
    • aarch64-darwin
  • For non-Linux: Is sandboxing enabled in nix.conf? (See Nix manual)
    • sandbox = relaxed
    • sandbox = true
  • Tested, as applicable:
  • Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
  • Tested basic functionality of all binary files (usually in ./result/bin/)
  • 24.11 Release Notes (or backporting 23.11 and 24.05 Release notes)
    • (Package updates) Added a release notes entry if the change is major or breaking
    • (Module updates) Added a release notes entry if the change is significant
    • (Module addition) Added a release notes entry if adding a new NixOS module
  • Fits CONTRIBUTING.md.

Add a 👍 reaction to pull requests you find important.

Copy link
Member

@Frontear Frontear left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please follow the CONTRIBUTING.md guide for how to make a PR to nixpkgs. I admire your first attempt, however as it is this cannot be merged.

@@ -0,0 +1,37 @@
{ pkgs }:
let
vgpkgs = import (pkgs.fetchFromGitHub {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do not do this. If you have problems with the dependencies, please share that instead of trying to use a different revision

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you, I didn't quite know how to approach this issue. I know the exact version of the dependencies (before the breaking API changes that made them unusuable for the original vanguards code), should I repackage them as separate, ancillary derivations?

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Issues with ipaddress that made me use an older nixpkgs version:

"ipadress has been removed because it is no longer required since python 2.7"

pkgs/by-name/va/vanguards/package.nix Outdated Show resolved Hide resolved
pkgs/by-name/va/vanguards/package.nix Outdated Show resolved Hide resolved
pkgs/by-name/va/vanguards/package.nix Outdated Show resolved Hide resolved
pkgs/by-name/va/vanguards/package.nix Outdated Show resolved Hide resolved
Runs alongside tor and interacts with its control port
in order to protect and alert against guard node attacks on hidden services'';
};
doCheck = false;
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you explain why this is here?

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Because the vanguards test suite tries connecting to the internet making the evaluation fail

WARNING: Retrying (Retry(total=4, connect=None, read=None, redirect=None, status=None)) after connection broken by 'NewConnectionError('<pip._vendor.urllib3.connection.VerifiedHTTPSConnection object at 0x7ffff649add0>: Failed to establish a new connection: [Errno -2] Name or service not known',)': /simple/pytest/

rev = "c3961ac40ca0bce67f79bc76021f5817730033b8";
sha256 = "sha256-y5WwDLn2asYcA5hTl++UVeH5KZ8VRP4sMIjRv9y7GVE=";
};
propagatedBuildInputs = with vgpkgs; [
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why is this dangling on its own? This derivation is really hard to read.

Copy link
Author

@ForgottenBeast ForgottenBeast Oct 3, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I am not sure I understand what you mean by "dangling on its own". The source repository does not have a requirements list or poetry equivalent so I had to explicitly add both of those libraries this way.

If I remove this bit the build fails with the following error message (linked with the removal of ipaddress I should think)

ERROR: Could not find a version that satisfies the requirement ipaddress>=1.0.17; python_version < "3" (from vanguards==0.3.1) (from versions: none)
ERROR: No matching distribution found for ipaddress>=1.0.17; python_version < "3" (from vanguards==0.3.1)

I used nixfmt on the derivation file and I am trying my best to make it more readable, do you have specific, actionable advice to point me in the right direction in order to improve readability?

@ForgottenBeast
Copy link
Author

Please follow the CONTRIBUTING.md guide for how to make a PR to nixpkgs. I admire your first attempt, however as it is this cannot be merged.

Thank you for your time reviewing my PR and your feedback.

I tried sticking to both:

I see that I should have spent more time looking at other PRs from more experienced members and will start to do so.

add derivation for vanguards, a set of scripts that increase security
for tor hidden services by protecting against guard discovery attacks

resources:
https://github.com/mikeperry-tor/vanguards
https://spec.torproject.org/vanguards-spec/index.html?highlight=vanguards
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants