modules/rosenthal/packages/binaries.scm

@@ -166,8 +166,7 @@ a scalable, lightweight, low-cost, community-driven alternative covering all but
 the most niche uses.")
     (home-page "https://matrix-construct.github.io/tuwunel/")
     (license license:asl2.0)
-    (properties '((upstream-name . "tuwunel")
+    (properties '((disable-updater? . #t)))))
-                  (disable-updater? . #t)))))
 
 (define-public komga-bin
   (package
@@ -215,7 +214,8 @@ exec ~a -jar ~a $@~%"
 eBooks.")
    (supported-systems '("x86_64-linux"))
    (license license:expat)
-   (properties '((upstream-name . "komga")))))
+   (properties '((upstream-name . "komga")
+                 (disable-updater? . #t)))))
 
 (define-public navidrome-bin
   (package
@@ -241,7 +241,8 @@ eBooks.")
 manage their music collections.  It provides a web interface and is compatible
 with the Subsonic API.")
     (license license:expat)
-    (properties '((upstream-name . "navidrome")))))
+    (properties '((upstream-name . "navidrome")
+                  (disable-updater? . #t)))))
 
 (define-deprecated-package rclone-bin rclone)
 
@@ -273,7 +274,8 @@ with the Subsonic API.")
      "Shadow TLS is a proxy to expose real tls handshake to the @acronym{MITM,
 monster-in-the-middle}.")
     (license license:expat)
-    (properties '((upstream-name . "shadow-tls")))))
+    (properties '((upstream-name . "shadow-tls")
+                  (disable-updater? . #t)))))
 
 (define-public wakapi-bin
   (package
@@ -297,7 +299,8 @@ monster-in-the-middle}.")
      "This package provides @code{wakapi}, a WakaTime-compatible backend for
 coding statistics.")
     (license license:expat)
-    (properties '((upstream-name . "wakapi")))))
+    (properties '((upstream-name . "wakapi")
+                  (disable-updater? . #t)))))
 
 (define-public wakatime-cli-bin
   (package
@@ -323,7 +326,8 @@ coding statistics.")
      "This package provides @command{wakatime-cli}, the command line interface
 to WakaTime, which is used by all WakaTime text editor plugins.")
     (license license:bsd-3)
-    (properties '((upstream-name . "wakatime-cli")))))
+    (properties '((upstream-name . "wakatime-cli")
+                  (disable-updater? . #t)))))
 
 (define-public grafana-bin
   (package
@@ -413,14 +417,15 @@ multi-tenant, long-term storage for Prometheus.")
     (home-page "https://grafana.com/oss/mimir/")
     (license license:agpl3)
     (supported-systems '("x86_64-linux"))
-    (properties '((upstream-name . "mimir")))))
+    (properties '((upstream-name . "mimir")
+                  (disable-updater? . #t)))))
 
 (define-public loki-bin
   (package
     (name "loki-bin")
     (version "3.5.4")
     (source (origin
-              (method url-fetch)
+              (method url-fetch/zipbomb)
               (uri (string-append
                     "https://github.com/grafana/loki/releases/download/v"
                     version "/loki-linux-amd64.zip"))
@@ -431,7 +436,6 @@ multi-tenant, long-term storage for Prometheus.")
     (arguments
      (list #:install-plan
            #~'(("loki-linux-amd64" "bin/loki"))))
-    (native-inputs (list unzip))
     (synopsis "Log aggregation system")
     (description
      "Loki is a horizontally scalable, highly available, multi-tenant log
@@ -441,14 +445,15 @@ rather a set of labels for each log stream.")
     (home-page "https://grafana.com/oss/loki/")
     (license license:agpl3)
     (supported-systems '("x86_64-linux"))
-    (properties '((upstream-name . "loki")))))
+    (properties '((upstream-name . "loki")
+                  (disable-updater? . #t)))))
 
 (define-public alloy-bin
   (package
     (name "alloy-bin")
     (version "1.10.2")
     (source (origin
-              (method url-fetch)
+              (method url-fetch/zipbomb)
               (uri (string-append
                     "https://github.com/grafana/alloy/releases/download/v"
                     version "/alloy-linux-amd64.zip"))
@@ -468,7 +473,7 @@ rather a set of labels for each log stream.")
                          (ld.so (search-input-file inputs #$(glibc-dynamic-linker))))
                      (with-directory-excursion dest
                        (invoke "patchelf" "--set-interpreter" ld.so name))))))))
-    (native-inputs (list patchelf unzip))
+    (native-inputs (list patchelf))
     (synopsis
      "OpenTelemetry Collector distribution with programmable pipelines")
     (description
@@ -478,7 +483,8 @@ profiles.")
     (home-page "https://grafana.com/oss/alloy-opentelemetry-collector/")
     (license license:agpl3)
     (supported-systems '("x86_64-linux"))
-    (properties '((upstream-name . "alloy")))))
+    (properties '((upstream-name . "alloy")
+                  (disable-updater? . #t)))))
 
 (define-public alloy-bin-aarch64-linux
   (package
@@ -486,7 +492,7 @@ profiles.")
     (name "alloy-bin-aarch64-linux")
     (version "1.10.2")
     (source (origin
-              (method url-fetch)
+              (method url-fetch/zipbomb)
               (uri (string-append
                     "https://github.com/grafana/alloy/releases/download/v"
                     version "/alloy-linux-arm64.zip"))

modules/rosenthal/packages/patches/guix-change-publish-cache-storage.patch

@@ -1,5 +1,5 @@
-From 93295096bbc36a79e0e9d738a98b503af260f047 Mon Sep 17 00:00:00 2001
+From 5c0b93219bf5def932dfe4de3288fd09ea557f69 Mon Sep 17 00:00:00 2001
-Message-ID: <93295096bbc36a79e0e9d738a98b503af260f047.1769256978.git.hako@ultrarare.space>
+Message-ID: <5c0b93219bf5def932dfe4de3288fd09ea557f69.1761666722.git.hako@ultrarare.space>
 From: Hilton Chain <hako@ultrarare.space>
 Date: Sat, 23 Aug 2025 14:07:19 +0800
 Subject: [PATCH] publish: Store cache in a layout identical to HTTP endpoints.
@@ -41,12 +41,12 @@ Modified layout:
 
 Change-Id: I07689f08eef23c5cd4494451678f4e1ad709f1b3
 ---
- guix/scripts/publish.scm | 20 ++++++-----------
+ guix/scripts/publish.scm | 17 +++++---------
  tests/publish.scm        | 48 ++++++++++++++++++++--------------------
- 2 files changed, 31 insertions(+), 37 deletions(-)
+ 2 files changed, 30 insertions(+), 35 deletions(-)
 
 diff --git a/guix/scripts/publish.scm b/guix/scripts/publish.scm
-index 1143cd29cfd..b8d0c5dc7b3 100644
+index 7638bcbd0e..a70a9b730f 100644
 --- a/guix/scripts/publish.scm
 +++ b/guix/scripts/publish.scm
 @@ -47,6 +47,7 @@ (define-module (guix scripts publish)
@@ -86,21 +86,18 @@ index 1143cd29cfd..b8d0c5dc7b3 100644
  
  (define (hash-part-mapping-cache-file directory hash)
    (string-append directory "/hashes/" hash))
-@@ -533,11 +529,8 @@ (define* (render-narinfo/cached store request hash
+@@ -533,9 +529,7 @@ (define* (render-narinfo/cached store request hash
  requested using POOL."
    (define (delete-entry narinfo)
      ;; Delete NARINFO and the corresponding nar from CACHE.
 -    (let* ((nar     (string-append (string-drop-right narinfo
 -                                                      (string-length ".narinfo"))
 -                                   ".nar"))
--           (base    (basename narinfo ".narinfo"))
--           (hash    (string-take base (string-index base #\-)))
 +    (let* ((nar     (uri-decode (assoc-ref (call-with-input-file narinfo recutils->alist) "URL")))
-+           (hash    (basename narinfo ".narinfo"))
+            (base    (basename narinfo ".narinfo"))
+            (hash    (string-take base (string-index base #\-)))
             (mapping (hash-part-mapping-cache-file cache hash)))
-       (delete-file* narinfo)
+@@ -1039,6 +1033,7 @@ (define (string->compression-type string)
-       (delete-file* nar)
-@@ -1044,6 +1037,7 @@ (define (string->compression-type string)
      ("gzip" 'gzip)
      ("lzip" 'lzip)
      ("zstd" 'zstd)
@@ -109,7 +106,7 @@ index 1143cd29cfd..b8d0c5dc7b3 100644
  
  (define (effective-compression requested-type compressions)
 diff --git a/tests/publish.scm b/tests/publish.scm
-index 3c80c50d515..52c6f6d10c4 100644
+index 3c80c50d51..52c6f6d10c 100644
 --- a/tests/publish.scm
 +++ b/tests/publish.scm
 @@ -173,7 +173,7 @@ (define %gzip-magic-bytes
@@ -256,7 +253,7 @@ index 3c80c50d515..52c6f6d10c4 100644
           ;; The first response used to be 500 and to terminate the daemon
           ;; connection as a side effect.
 
-base-commit: 5dbab32115de3276f582bcb801fd9f88abe0d397
+base-commit: 31a211f180fd8246dbf7efb4120236c837faffc8
 -- 
-2.52.0
+2.51.0