@@ -26,22 +26,39 @@ TMP_FILE=$(mktemp)
2626sed " s/$CURRENT_VERSION_SHA1 /$NEW_UPSTREAM_SHA1 /;s/$CURRENT_TARBALL_HASH /$NEW_TARBALL_HASH /" " $NIXPKGS_PIN_FILE " > " $TMP_FILE "
2727mv " $TMP_FILE " " $NIXPKGS_PIN_FILE "
2828
29+ # === Update openssl-matrix.nix ===
30+ # When bumping the pin, we want to update the openssl-matrix.nix file to keep the list in sync nixpkgs
31+ # i.e. add newly added release lines, remove newly dropped release lines), and make sure the "openssl"
32+ # attribute still refers to the same release line as the bundled version in deps/openssl/.
33+
34+ OPENSSL_MAJOR=$( awk -F= ' /^MAJOR=[0-9]+$/ { print $2; exit }' " $BASE_DIR /deps/openssl/openssl/VERSION.dat" )
35+ OPENSSL_MINOR=$( awk -F= ' /^MINOR=[0-9]+$/ { print $2; exit }' " $BASE_DIR /deps/openssl/openssl/VERSION.dat" )
36+
2937nix-instantiate -I " nixpkgs=$NIXPKGS_PIN_FILE " "
3038 let
3139 pkgs = import <nixpkgs> {};
3240 opensslAttrs = builtins.filter
3341 (n: builtins.match \" openssl_[0-9]+(_[0-9]+)?\" n != null)
3442 (builtins.attrNames pkgs);
3543 extraMatrixAttrs = [ \" boringssl\" ];
44+ default = builtins.head (builtins.filter (n:
45+ let
46+ inherit (pkgs.lib) versions;
47+ t = builtins.tryEval pkgs.\$ {n};
48+ v = if t.success then builtins.tryEval t.value.version else t;
49+ majorVersion = pkgs.lib.optionalString v.success (versions.major v.value);
50+ minorVersion = pkgs.lib.optionalString v.success (versions.minor v.value);
51+ in
52+ majorVersion == ''$OPENSSL_MAJOR '' && minorVersion == ''$OPENSSL_MINOR '') opensslAttrs);
3653 attrs = builtins.filter
3754 (n:
3855 let t = builtins.tryEval pkgs.\$ {n}; in
39- t.success && (builtins.tryEval t.value.version).success
56+ n != default && t.success && (builtins.tryEval t.value.version).success
4057 )
4158 (opensslAttrs ++ extraMatrixAttrs);
4259 in
4360 {
44- inherit attrs;
61+ inherit attrs default ;
4562 permittedInsecurePackages = builtins.map (attr: pkgs.\$ {attr}.name) (
4663 builtins.filter (attr: (pkgs.\$ {attr}.meta.insecure)) attrs
4764 );
@@ -53,6 +70,10 @@ nix-instantiate -I "nixpkgs=$NIXPKGS_PIN_FILE" --eval --strict --json -E "
5370}:
5471
5572{
73+ # "default" OpenSSL release line, should be kept in sync with the bundled version:
74+ openssl = pkgs.\(.default);
75+
76+ # Other OpenSSL variants we want to test for:
5677 inherit (pkgs)
5778 \(.attrs | sort | join("\n "))
5879 ;
0 commit comments