ci-tools/vulnerability-scan

@@ -42,7 +42,7 @@ fi
 # (non-whitelisted errors).  3 indicates unexpected error so we let that
 # propagate.
 set +e
-nix-shell -p vulnix --run 'vulnix --json ./scan-target/' | tee "$OUTPUT"
+nix-shell -p vulnix --run "vulnix --json -R $(nix-store -qd $(nix-store -qR./scan-target/)| grep -v "unknown driver" | xargs)" | tee "$OUTPUT"
 vulnix_status=$?
 set -e
 

nixos/pkgs/default.nix

@@ -19,7 +19,8 @@ let
   };
 in
 {
-  zkapissuer = callPackage ./zkapissuer {};
+  leasereport = callPackage ./leasereport {};
   zkap-spending-service = callPackage ./zkap-spending-service {};
-  inherit (ourpkgs) privatestorage leasereport;
+  privatestorage = callPackage ./privatestorage.nix {};
+  zkapissuer = callPackage ./zkapissuer {};
 }

nixos/pkgs/leasereport/default.nix

+{ callPackage, fetchFromGitLab, lib }:
+let
+  repo-data = lib.importJSON ./repo.json;
+  repo = fetchFromGitLab (builtins.removeAttrs repo-data [ "branch" ]);
+  LeaseReport = (import "${repo}/nix").LeaseReport;
+in
+  LeaseReport.components.exes.LeaseReport
+

nixos/pkgs/leasereport/repo.json

+{
+  "owner": "tomprince",
+  "repo": "LeaseReport",
+  "branch": "strip",
+  "domain": "whetstone.privatestorage.io",
+  "rev": "5ed87e89541aabc7def748130a8b951ab7719512",
+  "outputHashAlgo": "sha512",
+  "outputHash": "09i27g54jvnjf016f0b46qni4ldzbb7lmrbcjim6f5gsw0a6bgc89xfpwxyis6hy3knrgr129cb9pgzcrfr0b7zalkskp5yvpz1cvbq"
+}

nixos/pkgs/privatestorage.nix

+{ pkgs, fetchFromGitHub, callPackage }:
+let
+  zkap-authorizer-src = fetchFromGitHub {
+    owner = "tp-la";
+    repo = "ZKAPAuthorizer";
+    # tomprince -- mach-nix branch
+    rev = "fb93400f4ffd4e8b86f4740de313c7ce783fc26f";
+    sha256 = "sha256-Q5tMWBNAue/D/CL0JdqU+kivG6UMSiNf8l5wsIp8PTg=";
+  };
+  zkap-authorizer = callPackage (zkap-authorizer-src + "/new.nix") {};
+in 
+  pkgs.python27.withPackages (_: [zkap-authorizer])

nixos/pkgs/zkapissuer/repo.nix

@@ -2,6 +2,6 @@
 fetchFromGitHub {
   owner = "PrivateStorageio";
   repo = "PaymentServer";
-  rev = "ff30e85c231a3b5ad76426bbf8801f8f76884367";
-  sha256 = "1spz19f5z96shmfpazj0rv6877xvchf3gl49a4xahjbbsz39x34x";
+  rev = "e185f33453938dee9d3824f88e18b868491a79c2";
+  hash = "sha256-r6YCTpnCRLkGGA39KTpWthMYFWoGDiR3xHJSYVXSqF8=";
 }

nixpkgs-2105.json

 {
   "name": "release2105",
-  "url": "https://releases.nixos.org/nixos/21.05/nixos-21.05.3367.fd8a7fd07da/nixexprs.tar.xz",
-  "sha256": "12p7v805xj5as2fbdh30i0b9iwy8y24sk256rgqfqylxj1784mn8"
+  "url": "https://releases.nixos.org/nixos/21.05/nixos-21.05.3443.ee90403e147/nixexprs.tar.xz",
+  "sha256": "1h29zmrp9wz88sil9vg8x6lfy5n1hxrcpjk9am2bnvz9ps5ggn3v"
 }

reqs

+#
+# This file is autogenerated by pip-compile
+# To update, run:
+#
+#    pip-compile --allow-unsafe --output-file=reqs /tmp/zshccaPWV
+#
+aniso8601==9.0.1
+    # via zero-knowledge-access-pass-authorizer
+appdirs==1.4.4
+    # via twisted
+argparse==1.4.0
+    # via zfec
+attrs==21.2.0
+    # via
+    #   automat
+    #   magic-wormhole
+    #   python-challenge-bypass-ristretto
+    #   service-identity
+    #   tahoe-lafs
+    #   treq
+    #   twisted
+    #   zero-knowledge-access-pass-authorizer
+autobahn[twisted]==19.11.2
+    # via
+    #   magic-wormhole
+    #   tahoe-lafs
+automat==20.2.0
+    # via
+    #   magic-wormhole
+    #   twisted
+    #   txtorcon
+bcrypt==3.1.7
+    # via twisted
+boltons==21.0.0
+    # via eliot
+certifi==2021.5.30
+    # via requests
+cffi==1.14.6
+    # via
+    #   bcrypt
+    #   cryptography
+    #   pynacl
+    #   python-challenge-bypass-ristretto
+chardet==4.0.0
+    # via requests
+click==7.1.2
+    # via magic-wormhole
+constantly==15.1.0
+    # via twisted
+cryptography==3.3.2
+    # via
+    #   autobahn
+    #   pyopenssl
+    #   service-identity
+    #   tahoe-lafs
+    #   twisted
+    #   txtorcon
+eliot==1.7.0
+    # via
+    #   tahoe-lafs
+    #   zero-knowledge-access-pass-authorizer
+enum34==1.1.10
+    # via cryptography
+foolscap==0.13.1
+    # via tahoe-lafs
+hkdf==0.0.3
+    # via
+    #   magic-wormhole
+    #   spake2
+humanize==1.0.0
+    # via magic-wormhole
+hyperlink==21.0.0
+    # via
+    #   treq
+    #   twisted
+idna==2.10
+    # via
+    #   hyperlink
+    #   requests
+    #   twisted
+incremental==21.3.0
+    # via
+    #   treq
+    #   twisted
+    #   txtorcon
+ipaddress==1.0.23
+    # via
+    #   cryptography
+    #   service-identity
+    #   txtorcon
+magic-wormhole==0.12.0
+    # via tahoe-lafs
+nevow==0.14.5
+    # via tahoe-lafs
+pyasn1-modules==0.2.8
+    # via service-identity
+pyasn1==0.4.8
+    # via
+    #   pyasn1-modules
+    #   service-identity
+    #   twisted
+pycparser==2.20
+    # via cffi
+pyhamcrest==1.10.1
+    # via twisted
+pynacl==1.4.0
+    # via magic-wormhole
+pyopenssl==20.0.1
+    # via
+    #   foolscap
+    #   twisted
+pyrsistent==0.16.1
+    # via eliot
+python-challenge-bypass-ristretto
+    # via zero-knowledge-access-pass-authorizer
+pyutil==3.3.0
+    # via zero-knowledge-access-pass-authorizer
+pyyaml==5.4.1
+    # via tahoe-lafs
+requests==2.26.0
+    # via treq
+service-identity==21.1.0
+    # via twisted
+six==1.16.0
+    # via
+    #   autobahn
+    #   automat
+    #   bcrypt
+    #   cryptography
+    #   eliot
+    #   magic-wormhole
+    #   pyhamcrest
+    #   pynacl
+    #   pyopenssl
+    #   pyrsistent
+    #   service-identity
+    #   tahoe-lafs
+    #   treq
+    #   txaio
+spake2==0.8
+    # via magic-wormhole
+tahoe-lafs==1.14.0
+    # via zero-knowledge-access-pass-authorizer
+tqdm==4.62.2
+    # via magic-wormhole
+treq==21.1.0
+    # via zero-knowledge-access-pass-authorizer
+twisted[conch,tls]==20.3.0
+    # via
+    #   autobahn
+    #   foolscap
+    #   magic-wormhole
+    #   nevow
+    #   tahoe-lafs
+    #   treq
+    #   txtorcon
+    #   zero-knowledge-access-pass-authorizer
+txaio==18.8.1
+    # via autobahn
+txtorcon==21.1.0
+    # via magic-wormhole
+typing==3.10.0.0
+    # via hyperlink
+urllib3==1.26.6
+    # via requests
+zfec==1.5.5
+    # via tahoe-lafs
+zope.interface==5.4.0
+    # via
+    #   autobahn
+    #   eliot
+    #   tahoe-lafs
+    #   twisted
+    #   txtorcon
+    #   zero-knowledge-access-pass-authorizer
+
+# The following packages are considered to be unsafe in a requirements file:
+setuptools==44.1.1
+    # via
+    #   tahoe-lafs
+    #   zope.interface