path: root/nixos/doc/manual/from_md/release-notes/rl-1703.section.xml

<section xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink" xml:id="sec-release-17.03">
  <title>Release 17.03 (<quote>Gorilla</quote>, 2017/03/31)</title>
  <section xml:id="sec-release-17.03-highlights">
    <title>Highlights</title>
    <para>
      In addition to numerous new and upgraded packages, this release
      has the following highlights:
    </para>
    <itemizedlist>
      <listitem>
        <para>
          Nixpkgs is now extensible through overlays. See the
          <link xlink:href="https://nixos.org/nixpkgs/manual/#sec-overlays-install">Nixpkgs
          manual</link> for more information.
        </para>
      </listitem>
      <listitem>
        <para>
          This release is based on Glibc 2.25, GCC 5.4.0 and systemd
          232. The default Linux kernel is 4.9 and Nix is at 1.11.8.
        </para>
      </listitem>
      <listitem>
        <para>
          The default desktop environment now is KDE's Plasma 5. KDE 4
          has been removed
        </para>
      </listitem>
      <listitem>
        <para>
          The setuid wrapper functionality now supports setting
          capabilities.
        </para>
      </listitem>
      <listitem>
        <para>
          X.org server uses branch 1.19. Due to ABI incompatibilities,
          <literal>ati_unfree</literal> keeps forcing 1.17 and
          <literal>amdgpu-pro</literal> starts forcing 1.18.
        </para>
      </listitem>
      <listitem>
        <para>
          Cross compilation has been rewritten. See the nixpkgs manual
          for details. The most obvious breaking change is that in
          derivations there is no <literal>.nativeDrv</literal> nor
          <literal>.crossDrv</literal> are now cross by default, not
          native.
        </para>
      </listitem>
      <listitem>
        <para>
          The <literal>overridePackages</literal> function has been
          rewritten to be replaced by
          <link xlink:href="https://nixos.org/nixpkgs/manual/#sec-overlays-install">
          overlays</link>
        </para>
      </listitem>
      <listitem>
        <para>
          Packages in nixpkgs can be marked as insecure through listed
          vulnerabilities. See the
          <link xlink:href="https://nixos.org/nixpkgs/manual/#sec-allow-insecure">Nixpkgs
          manual</link> for more information.
        </para>
      </listitem>
      <listitem>
        <para>
          PHP now defaults to PHP 7.1
        </para>
      </listitem>
    </itemizedlist>
  </section>
  <section xml:id="sec-release-17.03-new-services">
    <title>New Services</title>
    <para>
      The following new services were added since the last release:
    </para>
    <itemizedlist>
      <listitem>
        <para>
          <literal>hardware/ckb.nix</literal>
        </para>
      </listitem>
      <listitem>
        <para>
          <literal>hardware/mcelog.nix</literal>
        </para>
      </listitem>
      <listitem>
        <para>
          <literal>hardware/usb-wwan.nix</literal>
        </para>
      </listitem>
      <listitem>
        <para>
          <literal>hardware/video/capture/mwprocapture.nix</literal>
        </para>
      </listitem>
      <listitem>
        <para>
          <literal>programs/adb.nix</literal>
        </para>
      </listitem>
      <listitem>
        <para>
          <literal>programs/chromium.nix</literal>
        </para>
      </listitem>
      <listitem>
        <para>
          <literal>programs/gphoto2.nix</literal>
        </para>
      </listitem>
      <listitem>
        <para>
          <literal>programs/java.nix</literal>
        </para>
      </listitem>
      <listitem>
        <para>
          <literal>programs/mtr.nix</literal>
        </para>
      </listitem>
      <listitem>
        <para>
          <literal>programs/oblogout.nix</literal>
        </para>
      </listitem>
      <listitem>
        <para>
          <literal>programs/vim.nix</literal>
        </para>
      </listitem>
      <listitem>
        <para>
          <literal>programs/wireshark.nix</literal>
        </para>
      </listitem>
      <listitem>
        <para>
          <literal>security/dhparams.nix</literal>
        </para>
      </listitem>
      <listitem>
        <para>
          <literal>services/audio/ympd.nix</literal>
        </para>
      </listitem>
      <listitem>
        <para>
          <literal>services/computing/boinc/client.nix</literal>
        </para>
      </listitem>
      <listitem>
        <para>
          <literal>services/continuous-integration/buildbot/master.nix</literal>
        </para>
      </listitem>
      <listitem>
        <para>
          <literal>services/continuous-integration/buildbot/worker.nix</literal>
        </para>
      </listitem>
      <listitem>
        <para>
          <literal>services/continuous-integration/gitlab-runner.nix</literal>
        </para>
      </listitem>
      <listitem>
        <para>
          <literal>services/databases/riak-cs.nix</literal>
        </para>
      </listitem>
      <listitem>
        <para>
          <literal>services/databases/stanchion.nix</literal>
        </para>
      </listitem>
      <listitem>
        <para>
          <literal>services/desktops/gnome3/gnome-terminal-server.nix</literal>
        </para>
      </listitem>
      <listitem>
        <para>
          <literal>services/editors/infinoted.nix</literal>
        </para>
      </listitem>
      <listitem>
        <para>
          <literal>services/hardware/illum.nix</literal>
        </para>
      </listitem>
      <listitem>
        <para>
          <literal>services/hardware/trezord.nix</literal>
        </para>
      </listitem>
      <listitem>
        <para>
          <literal>services/logging/journalbeat.nix</literal>
        </para>
      </listitem>
      <listitem>
        <para>
          <literal>services/mail/offlineimap.nix</literal>
        </para>
      </listitem>
      <listitem>
        <para>
          <literal>services/mail/postgrey.nix</literal>
        </para>
      </listitem>
      <listitem>
        <para>
          <literal>services/misc/couchpotato.nix</literal>
        </para>
      </listitem>
      <listitem>
        <para>
          <literal>services/misc/docker-registry.nix</literal>
        </para>
      </listitem>
      <listitem>
        <para>
          <literal>services/misc/errbot.nix</literal>
        </para>
      </listitem>
      <listitem>
        <para>
          <literal>services/misc/geoip-updater.nix</literal>
        </para>
      </listitem>
      <listitem>
        <para>
          <literal>services/misc/gogs.nix</literal>
        </para>
      </listitem>
      <listitem>
        <para>
          <literal>services/misc/leaps.nix</literal>
        </para>
      </listitem>
      <listitem>
        <para>
          <literal>services/misc/nix-optimise.nix</literal>
        </para>
      </listitem>
      <listitem>
        <para>
          <literal>services/misc/ssm-agent.nix</literal>
        </para>
      </listitem>
      <listitem>
        <para>
          <literal>services/misc/sssd.nix</literal>
        </para>
      </listitem>
      <listitem>
        <para>
          <literal>services/monitoring/arbtt.nix</literal>
        </para>
      </listitem>
      <listitem>
        <para>
          <literal>services/monitoring/netdata.nix</literal>
        </para>
      </listitem>
      <listitem>
        <para>
          <literal>services/monitoring/prometheus/default.nix</literal>
        </para>
      </listitem>
      <listitem>
        <para>
          <literal>services/monitoring/prometheus/alertmanager.nix</literal>
        </para>
      </listitem>
      <listitem>
        <para>
          <literal>services/monitoring/prometheus/blackbox-exporter.nix</literal>
        </para>
      </listitem>
      <listitem>
        <para>
          <literal>services/monitoring/prometheus/json-exporter.nix</literal>
        </para>
      </listitem>
      <listitem>
        <para>
          <literal>services/monitoring/prometheus/nginx-exporter.nix</literal>
        </para>
      </listitem>
      <listitem>
        <para>
          <literal>services/monitoring/prometheus/node-exporter.nix</literal>
        </para>
      </listitem>
      <listitem>
        <para>
          <literal>services/monitoring/prometheus/snmp-exporter.nix</literal>
        </para>
      </listitem>
      <listitem>
        <para>
          <literal>services/monitoring/prometheus/unifi-exporter.nix</literal>
        </para>
      </listitem>
      <listitem>
        <para>
          <literal>services/monitoring/prometheus/varnish-exporter.nix</literal>
        </para>
      </listitem>
      <listitem>
        <para>
          <literal>services/monitoring/sysstat.nix</literal>
        </para>
      </listitem>
      <listitem>
        <para>
          <literal>services/monitoring/telegraf.nix</literal>
        </para>
      </listitem>
      <listitem>
        <para>
          <literal>services/monitoring/vnstat.nix</literal>
        </para>
      </listitem>
      <listitem>
        <para>
          <literal>services/network-filesystems/cachefilesd.nix</literal>
        </para>
      </listitem>
      <listitem>
        <para>
          <literal>services/network-filesystems/glusterfs.nix</literal>
        </para>
      </listitem>
      <listitem>
        <para>
          <literal>services/network-filesystems/ipfs.nix</literal>
        </para>
      </listitem>
      <listitem>
        <para>
          <literal>services/networking/dante.nix</literal>
        </para>
      </listitem>
      <listitem>
        <para>
          <literal>services/networking/dnscrypt-wrapper.nix</literal>
        </para>
      </listitem>
      <listitem>
        <para>
          <literal>services/networking/fakeroute.nix</literal>
        </para>
      </listitem>
      <listitem>
        <para>
          <literal>services/networking/flannel.nix</literal>
        </para>
      </listitem>
      <listitem>
        <para>
          <literal>services/networking/htpdate.nix</literal>
        </para>
      </listitem>
      <listitem>
        <para>
          <literal>services/networking/miredo.nix</literal>
        </para>
      </listitem>
      <listitem>
        <para>
          <literal>services/networking/nftables.nix</literal>
        </para>
      </listitem>
      <listitem>
        <para>
          <literal>services/networking/powerdns.nix</literal>
        </para>
      </listitem>
      <listitem>
        <para>
          <literal>services/networking/pdns-recursor.nix</literal>
        </para>
      </listitem>
      <listitem>
        <para>
          <literal>services/networking/quagga.nix</literal>
        </para>
      </listitem>
      <listitem>
        <para>
          <literal>services/networking/redsocks.nix</literal>
        </para>
      </listitem>
      <listitem>
        <para>
          <literal>services/networking/wireguard.nix</literal>
        </para>
      </listitem>
      <listitem>
        <para>
          <literal>services/system/cgmanager.nix</literal>
        </para>
      </listitem>
      <listitem>
        <para>
          <literal>services/torrent/opentracker.nix</literal>
        </para>
      </listitem>
      <listitem>
        <para>
          <literal>services/web-apps/atlassian/confluence.nix</literal>
        </para>
      </listitem>
      <listitem>
        <para>
          <literal>services/web-apps/atlassian/crowd.nix</literal>
        </para>
      </listitem>
      <listitem>
        <para>
          <literal>services/web-apps/atlassian/jira.nix</literal>
        </para>
      </listitem>
      <listitem>
        <para>
          <literal>services/web-apps/frab.nix</literal>
        </para>
      </listitem>
      <listitem>
        <para>
          <literal>services/web-apps/nixbot.nix</literal>
        </para>
      </listitem>
      <listitem>
        <para>
          <literal>services/web-apps/selfoss.nix</literal>
        </para>
      </listitem>
      <listitem>
        <para>
          <literal>services/web-apps/quassel-webserver.nix</literal>
        </para>
      </listitem>
      <listitem>
        <para>
          <literal>services/x11/unclutter-xfixes.nix</literal>
        </para>
      </listitem>
      <listitem>
        <para>
          <literal>services/x11/urxvtd.nix</literal>
        </para>
      </listitem>
      <listitem>
        <para>
          <literal>system/boot/systemd-nspawn.nix</literal>
        </para>
      </listitem>
      <listitem>
        <para>
          <literal>virtualisation/ecs-agent.nix</literal>
        </para>
      </listitem>
      <listitem>
        <para>
          <literal>virtualisation/lxcfs.nix</literal>
        </para>
      </listitem>
      <listitem>
        <para>
          <literal>virtualisation/openstack/keystone.nix</literal>
        </para>
      </listitem>
      <listitem>
        <para>
          <literal>virtualisation/openstack/glance.nix</literal>
        </para>
      </listitem>
    </itemizedlist>
  </section>
  <section xml:id="sec-release-17.03-incompatibilities">
    <title>Backward Incompatibilities</title>
    <para>
      When upgrading from a previous release, please be aware of the
      following incompatible changes:
    </para>
    <itemizedlist>
      <listitem>
        <para>
          Derivations have no <literal>.nativeDrv</literal> nor
          <literal>.crossDrv</literal> and are now cross by default, not
          native.
        </para>
      </listitem>
      <listitem>
        <para>
          <literal>stdenv.overrides</literal> is now expected to take
          <literal>self</literal> and <literal>super</literal>
          arguments. See <literal>lib.trivial.extends</literal> for what
          those parameters represent.
        </para>
      </listitem>
      <listitem>
        <para>
          <literal>ansible</literal> now defaults to ansible version 2
          as version 1 has been removed due to a serious
          <link xlink:href="https://www.computest.nl/advisories/CT-2017-0109_Ansible.txt">
          vulnerability</link> unpatched by upstream.
        </para>
      </listitem>
      <listitem>
        <para>
          <literal>gnome</literal> alias has been removed along with
          <literal>gtk</literal>, <literal>gtkmm</literal> and several
          others. Now you need to use versioned attributes, like
          <literal>gnome3</literal>.
        </para>
      </listitem>
      <listitem>
        <para>
          The attribute name of the Radicale daemon has been changed
          from <literal>pythonPackages.radicale</literal> to
          <literal>radicale</literal>.
        </para>
      </listitem>
      <listitem>
        <para>
          The <literal>stripHash</literal> bash function in
          <literal>stdenv</literal> changed according to its
          documentation; it now outputs the stripped name to
          <literal>stdout</literal> instead of putting it in the
          variable <literal>strippedName</literal>.
        </para>
      </listitem>
      <listitem>
        <para>
          PHP now scans for extra configuration .ini files in /etc/php.d
          instead of /etc. This prevents accidentally loading non-PHP
          .ini files that may be in /etc.
        </para>
      </listitem>
      <listitem>
        <para>
          Two lone top-level dict dbs moved into
          <literal>dictdDBs</literal>. This affects:
          <literal>dictdWordnet</literal> which is now at
          <literal>dictdDBs.wordnet</literal> and
          <literal>dictdWiktionary</literal> which is now at
          <literal>dictdDBs.wiktionary</literal>
        </para>
      </listitem>
      <listitem>
        <para>
          Parsoid service now uses YAML configuration format.
          <literal>service.parsoid.interwikis</literal> is now called
          <literal>service.parsoid.wikis</literal> and is a list of
          either API URLs or attribute sets as specified in parsoid's
          documentation.
        </para>
      </listitem>
      <listitem>
        <para>
          <literal>Ntpd</literal> was replaced by
          <literal>systemd-timesyncd</literal> as the default service to
          synchronize system time with a remote NTP server. The old
          behavior can be restored by setting
          <literal>services.ntp.enable</literal> to
          <literal>true</literal>. Upstream time servers for all NTP
          implementations are now configured using
          <literal>networking.timeServers</literal>.
        </para>
      </listitem>
      <listitem>
        <para>
          <literal>service.nylon</literal> is now declared using named
          instances. As an example:
        </para>
        <programlisting language="bash">
{
  services.nylon = {
    enable = true;
    acceptInterface = &quot;br0&quot;;
    bindInterface = &quot;tun1&quot;;
    port = 5912;
  };
}
</programlisting>
        <para>
          should be replaced with:
        </para>
        <programlisting language="bash">
{
  services.nylon.myvpn = {
    enable = true;
    acceptInterface = &quot;br0&quot;;
    bindInterface = &quot;tun1&quot;;
    port = 5912;
  };
}
</programlisting>
        <para>
          this enables you to declare a SOCKS proxy for each uplink.
        </para>
      </listitem>
      <listitem>
        <para>
          <literal>overridePackages</literal> function no longer exists.
          It is replaced by
          <link xlink:href="https://nixos.org/nixpkgs/manual/#sec-overlays-install">
          overlays</link>. For example, the following code:
        </para>
        <programlisting language="bash">
let
  pkgs = import &lt;nixpkgs&gt; {};
in
  pkgs.overridePackages (self: super: ...)
</programlisting>
        <para>
          should be replaced by:
        </para>
        <programlisting language="bash">
let
  pkgs = import &lt;nixpkgs&gt; {};
in
  import pkgs.path { overlays = [(self: super: ...)]; }
</programlisting>
      </listitem>
      <listitem>
        <para>
          Autoloading connection tracking helpers is now disabled by
          default. This default was also changed in the Linux kernel and
          is considered insecure if not configured properly in your
          firewall. If you need connection tracking helpers (i.e. for
          active FTP) please enable
          <literal>networking.firewall.autoLoadConntrackHelpers</literal>
          and tune
          <literal>networking.firewall.connectionTrackingModules</literal>
          to suit your needs.
        </para>
      </listitem>
      <listitem>
        <para>
          <literal>local_recipient_maps</literal> is not set to empty
          value by Postfix service. It's an insecure default as stated
          by Postfix documentation. Those who want to retain this
          setting need to set it via
          <literal>services.postfix.extraConfig</literal>.
        </para>
      </listitem>
      <listitem>
        <para>
          Iputils no longer provide ping6 and traceroute6. The
          functionality of these tools has been integrated into ping and
          traceroute respectively. To enforce an address family the new
          flags <literal>-4</literal> and <literal>-6</literal> have
          been added. One notable incompatibility is that specifying an
          interface (for link-local IPv6 for instance) is no longer done
          with the <literal>-I</literal> flag, but by encoding the
          interface into the address
          (<literal>ping fe80::1%eth0</literal>).
        </para>
      </listitem>
      <listitem>
        <para>
          The socket handling of the <literal>services.rmilter</literal>
          module has been fixed and refactored. As rmilter doesn't
          support binding to more than one socket, the options
          <literal>bindUnixSockets</literal> and
          <literal>bindInetSockets</literal> have been replaced by
          <literal>services.rmilter.bindSocket.*</literal>. The default
          is still a unix socket in
          <literal>/run/rmilter/rmilter.sock</literal>. Refer to the
          options documentation for more information.
        </para>
      </listitem>
      <listitem>
        <para>
          The <literal>fetch*</literal> functions no longer support md5,
          please use sha256 instead.
        </para>
      </listitem>
      <listitem>
        <para>
          The dnscrypt-proxy module interface has been streamlined
          around the <literal>extraArgs</literal> option. Where
          possible, legacy option declarations are mapped to
          <literal>extraArgs</literal> but will emit warnings. The
          <literal>resolverList</literal> has been outright removed: to
          use an unlisted resolver, use the
          <literal>customResolver</literal> option.
        </para>
      </listitem>
      <listitem>
        <para>
          torbrowser now stores local state under
          <literal>~/.local/share/tor-browser</literal> by default. Any
          browser profile data from the old location,
          <literal>~/.torbrowser4</literal>, must be migrated manually.
        </para>
      </listitem>
      <listitem>
        <para>
          The ihaskell, monetdb, offlineimap and sitecopy services have
          been removed.
        </para>
      </listitem>
    </itemizedlist>
  </section>
  <section xml:id="sec-release-17.03-notable-changes">
    <title>Other Notable Changes</title>
    <itemizedlist>
      <listitem>
        <para>
          Module type system have a new extensible option types feature
          that allow to extend certain types, such as enum, through
          multiple option declarations of the same option across
          multiple modules.
        </para>
      </listitem>
      <listitem>
        <para>
          <literal>jre</literal> now defaults to GTK UI by default. This
          improves visual consistency and makes Java follow system font
          style, improving the situation on HighDPI displays. This has a
          cost of increased closure size; for server and other headless
          workloads it's recommended to use
          <literal>jre_headless</literal>.
        </para>
      </listitem>
      <listitem>
        <para>
          Python 2.6 interpreter and package set have been removed.
        </para>
      </listitem>
      <listitem>
        <para>
          The Python 2.7 interpreter does not use modules anymore.
          Instead, all CPython interpreters now include the whole
          standard library except for `tkinter`, which is available in
          the Python package set.
        </para>
      </listitem>
      <listitem>
        <para>
          Python 2.7, 3.5 and 3.6 are now built deterministically and
          3.4 mostly. Minor modifications had to be made to the
          interpreters in order to generate deterministic bytecode. This
          has security implications and is relevant for those using
          Python in a <literal>nix-shell</literal>. See the Nixpkgs
          manual for details.
        </para>
      </listitem>
      <listitem>
        <para>
          The Python package sets now use a fixed-point combinator and
          the sets are available as attributes of the interpreters.
        </para>
      </listitem>
      <listitem>
        <para>
          The Python function <literal>buildPythonPackage</literal> has
          been improved and can be used to build from Setuptools source,
          Flit source, and precompiled Wheels.
        </para>
      </listitem>
      <listitem>
        <para>
          When adding new or updating current Python libraries, the
          expressions should be put in separate files in
          <literal>pkgs/development/python-modules</literal> and called
          from <literal>python-packages.nix</literal>.
        </para>
      </listitem>
      <listitem>
        <para>
          The dnscrypt-proxy service supports synchronizing the list of
          public resolvers without working DNS resolution. This fixes
          issues caused by the resolver list becoming outdated. It also
          improves the viability of DNSCrypt only configurations.
        </para>
      </listitem>
      <listitem>
        <para>
          Containers using bridged networking no longer lose their
          connection after changes to the host networking.
        </para>
      </listitem>
      <listitem>
        <para>
          ZFS supports pool auto scrubbing.
        </para>
      </listitem>
      <listitem>
        <para>
          The bind DNS utilities (e.g. dig) have been split into their
          own output and are now also available in
          <literal>pkgs.dnsutils</literal> and it is no longer necessary
          to pull in all of <literal>bind</literal> to use them.
        </para>
      </listitem>
      <listitem>
        <para>
          Per-user configuration was moved from
          <literal>~/.nixpkgs</literal> to
          <literal>~/.config/nixpkgs</literal>. The former is still
          valid for <literal>config.nix</literal> for backwards
          compatibility.
        </para>
      </listitem>
    </itemizedlist>
  </section>
</section>