Fix greeter permissions

nixos/modules/services/display-managers/gdm.nix

@@ -43,6 +43,10 @@ let
   defaultSessionName = config.services.displayManager.defaultSession;
 
   setSessionScript = pkgs.callPackage ../x11/display-managers/account-service-util.nix { };
+
+  greeterEnvFile = pkgs.writeText "gdm-greeter-env" ''
+    DCONF_PROFILE=gdm
+  '';
 in
 
 {
@@ -102,6 +106,12 @@ in
       [ "services" "xserver" "displayManager" "gdm" "autoLogin" "delay" ]
       [ "services" "displayManager" "gdm" "autoLogin" "delay" ]
     )
+    (lib.mkRemovedOptionModule [
+      "services"
+      "displayManager"
+      "gdm"
+      "wayland"
+    ] "Disabling this option is no longer supported with GNOME 50.")
   ];
 
   meta = {
@@ -127,14 +137,6 @@ in
         '';
       };
 
-      wayland = lib.mkOption {
-        type = lib.types.bool;
-        default = true;
-        description = ''
-          Allow GDM to run on Wayland instead of Xserver.
-        '';
-      };
-
       autoSuspend = lib.mkOption {
         default = true;
         description = ''
@@ -244,15 +246,27 @@ in
     };
 
     systemd.tmpfiles.rules = [
-      "d /run/gdm/.config 0711 gdm gdm"
+      # GDM creates /run/gdm as root:root.  The greeter user needs to
+      # write to subdirectories (.config, .cache, .local) so we create
+      # them here with correct ownership.  All paths in the chain must
+      # be owned by the same user to avoid systemd-tmpfiles "unsafe
+      # path transition" errors.
+      "d /run/gdm/.config 0700 gdm-greeter gdm"
+      "d /run/gdm/.config/environment.d 0700 gdm-greeter gdm"
+      "f /run/gdm/.config/environment.d/10-dconf.conf 0644 gdm-greeter gdm - DCONF_PROFILE=gdm"
     ]
+    ++ lib.concatMap (i: [
+      "d /run/gdm-${toString i}/.config 0700 gdm-greeter-${toString i} gdm"
+      "d /run/gdm-${toString i}/.config/environment.d 0700 gdm-greeter-${toString i} gdm"
+      "f /run/gdm-${toString i}/.config/environment.d/10-dconf.conf 0644 gdm-greeter-${toString i} gdm - DCONF_PROFILE=gdm"
+    ]) [ 1 2 3 4 ]
     ++ lib.optionals config.services.pulseaudio.enable [
-      "d /run/gdm/.config/pulse 0711 gdm gdm"
+      "d /run/gdm/.config/pulse 0711 gdm-greeter gdm"
       "L+ /run/gdm/.config/pulse/${pulseConfig.name} - - - - ${pulseConfig}"
     ]
     ++ lib.optionals config.services.gnome.gnome-initial-setup.enable [
       # Create stamp file for gnome-initial-setup to prevent it starting in GDM.
-      "f /run/gdm/.config/gnome-initial-setup-done 0711 gdm gdm - yes"
+      "f /run/gdm/.config/gnome-initial-setup-done 0711 gdm-greeter gdm - yes"
     ];
 
     # Otherwise GDM will not be able to start correctly and display Wayland sessions
@@ -321,8 +335,14 @@ in
 
     systemd.user.services.dbus.wantedBy = [ "default.target" ];
 
-    programs.dconf.profiles.gdm.databases =
-      lib.optionals (!cfg.autoSuspend) [
+    programs.dconf.profiles.gdm.databases = [
+      {
+        settings."org/gnome/desktop/session" = {
+          session-name = "gnome-login";
+        };
+      }
+    ]
+    ++ lib.optionals (!cfg.autoSuspend) [
         {
           settings."org/gnome/settings-daemon/plugins/power" = {
             sleep-inactive-ac-type = "nothing";
@@ -347,7 +367,6 @@ in
     # presented and there's a little delay.
     services.displayManager.gdm.settings = {
       daemon = lib.mkMerge [
-        { WaylandEnable = cfg.wayland; }
         # nested if else didn't work
         (lib.mkIf (config.services.displayManager.autoLogin.enable && cfg.autoLogin.delay != 0) {
           TimedLoginEnable = true;
@@ -381,6 +400,7 @@ in
 
         session  required       pam_succeed_if.so audit quiet_success user ingroup gdm
         session  required       pam_env.so conffile=/etc/pam/environment readenv=0
+        session  required       pam_env.so envfile=${greeterEnvFile} readenv=0
         session  optional       ${config.systemd.package}/lib/security/pam_systemd.so
         session  optional       pam_keyinit.so force revoke
         session  optional       pam_permit.so

nixos/tests/gnome-extensions.nix

@@ -23,10 +23,9 @@
 
       # Configure GDM
       services.xserver.enable = true;
-      services.xserver.displayManager.gdm = {
+      services.displayManager.gdm = {
         enable = true;
         debug = true;
-        wayland = true;
       };
       services.displayManager.autoLogin = {
         enable = true;
@@ -38,7 +37,7 @@
       services.desktopManager.gnome.debug = true;
 
       systemd.user.services = {
-        "org.gnome.Shell@wayland" = {
+        "org.gnome.Shell@" = {
           serviceConfig = {
             ExecStart = [
               # Clear the list before overriding it.

nixos/tests/gnome.nix

@@ -9,8 +9,6 @@
     {
       imports = [ ./common/user-account.nix ];
 
-      services.xserver.enable = true;
-
       services.displayManager.gdm = {
         enable = true;
         debug = true;
@@ -25,7 +23,7 @@
       services.desktopManager.gnome.debug = true;
 
       systemd.user.services = {
-        "org.gnome.Shell@wayland" = {
+        "org.gnome.Shell@" = {
           serviceConfig = {
             ExecStart = [
               # Clear the list before overriding it.

pkgs/applications/networking/mailreaders/evolution/evolution/default.nix

@@ -49,7 +49,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "evolution";
-  version = "3.58.3";
+  version = "3.60.0";
 
   outputs = [
     "out"
@@ -58,7 +58,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://gnome/sources/evolution/${lib.versions.majorMinor finalAttrs.version}/evolution-${finalAttrs.version}.tar.xz";
-    hash = "sha256-XQG3mlvr3y06mHG2E1CTnPJQH26gPCQVQ/dEqShtTXk=";
+    hash = "sha256-D+10ikSTOnoROP5gJ5ZqvDZsbDLrWkHjDrYbjlQ5teU=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ad/adwaita-fonts/package.nix

@@ -9,11 +9,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "adwaita-fonts";
-  version = "49.0";
+  version = "50.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/adwaita-fonts/${lib.versions.major finalAttrs.version}/adwaita-fonts-${finalAttrs.version}.tar.xz";
-    hash = "sha256-MVfGIOtbcrJasVbRlKpOsiP5hw1Uf+g/298G0+e+yzc=";
+    hash = "sha256-TJJ/v+7BxQOAG6UQwslOAFTILFIs97oNO+XU1B/PXIY=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ad/adwaita-icon-theme/package.nix

@@ -14,11 +14,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "adwaita-icon-theme";
-  version = "49.0";
+  version = "50.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/adwaita-icon-theme/${lib.versions.major finalAttrs.version}/adwaita-icon-theme-${finalAttrs.version}.tar.xz";
-    hash = "sha256-ZRZkYdGyeKqUL1mqjQ/M8RCNccZfNyxiZuFyRJeRdVw=";
+    hash = "sha256-+sbgQB/KcUeAVhoIG49+J8O8HbNOvaTaF1CB8msk1GA=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/at/at-spi2-core/package.nix

@@ -29,7 +29,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "at-spi2-core";
-  version = "2.58.3";
+  version = "2.60.0";
 
   outputs = [
     "out"
@@ -39,7 +39,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://gnome/sources/at-spi2-core/${lib.versions.majorMinor finalAttrs.version}/at-spi2-core-${finalAttrs.version}.tar.xz";
-    hash = "sha256-sPq+psl0LtqMnGdfm4wdG6u6HagtoD6hEDcQIzcXwbA=";
+    hash = "sha256-gOUMGpfY/WYKP62wLKNYdt+IHCZtPWEI/FtMETYUy5k=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ba/baobab/package.nix

@@ -19,11 +19,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "baobab";
-  version = "49.1";
+  version = "50.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/baobab/${lib.versions.major finalAttrs.version}/baobab-${finalAttrs.version}.tar.xz";
-    hash = "sha256-YkPJIAK+fpH13s0klhL6zipKEtN0Kv2IsIapS4dd/+A=";
+    hash = "sha256-VzyE8V9fljpEBQD29DQSySisIzX2tp3LWPGh/lIBAks=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/bl/blueprint-compiler/package.nix

@@ -12,17 +12,18 @@
   testers,
   wrapGAppsNoGuiHook,
   xvfb-run,
+  gnome,
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "blueprint-compiler";
-  version = "0.18.0";
+  version = "0.20.4";
 
   src = fetchFromGitLab {
     domain = "gitlab.gnome.org";
     owner = "GNOME";
     repo = "blueprint-compiler";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-3vAFkP/psM/IsFtzVOIVSU77Z+RV4d3N70U7ggrDqfo=";
+    hash = "sha256-dA+FQTRmTz6rl5ToZJ8CXY1Zd7Em7VwvF3U3Qoyvu80=";
   };
 
   postPatch = ''
@@ -67,17 +68,22 @@ stdenv.mkDerivation (finalAttrs: {
     runHook postCheck
   '';
 
-  passthru.tests = {
-    version = testers.testVersion {
-      package = finalAttrs.finalPackage;
+  passthru = {
+    tests = {
+      version = testers.testVersion {
+        package = finalAttrs.finalPackage;
+      };
+      # regression test that `blueprint-compiler` can be used in a standalone
+      # context outside of nix builds, and doesn't rely on the setup hooks of
+      # its propagated inputs for basic functionality.
+      # see https://github.com/NixOS/nixpkgs/pull/400415
+      standalone = runCommand "blueprint-compiler-test-standalone" { } ''
+        ${lib.getExe finalAttrs.finalPackage} --help && touch $out
+      '';
+    };
+    updateScript = gnome.updateScript {
+      packageName = "blueprint-compiler";
     };
-    # regression test that `blueprint-compiler` can be used in a standalone
-    # context outside of nix builds, and doesn't rely on the setup hooks of
-    # its propagated inputs for basic functionality.
-    # see https://github.com/NixOS/nixpkgs/pull/400415
-    standalone = runCommand "blueprint-compiler-test-standalone" { } ''
-      ${lib.getExe finalAttrs.finalPackage} --help && touch $out
-    '';
   };
 
   meta = {
@@ -89,6 +95,7 @@ stdenv.mkDerivation (finalAttrs: {
       benediktbroich
       ranfdev
     ];
+    teams = [ lib.teams.gnome ];
     platforms = lib.platforms.unix;
   };
 })

pkgs/by-name/ca/cambalache/package.nix

@@ -24,7 +24,7 @@
 
 python3.pkgs.buildPythonApplication (finalAttrs: {
   pname = "cambalache";
-  version = "0.99.3";
+  version = "1.0";
   pyproject = false;
 
   # Did not fetch submodule since it is only for tests we don't run.
@@ -33,7 +33,7 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
     owner = "jpu";
     repo = "cambalache";
     tag = finalAttrs.version;
-    hash = "sha256-1X7fXYSIXoj8qhQLIfz2gMrCnNBZ7OJCeMykBSpnYD4=";
+    hash = "sha256-V1xiw6oGOlmLR1JOy82REIdoOTGfzXYMBJAAtjDJtfM=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ca/casilda/package.nix

@@ -18,7 +18,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "casilda";
-  version = "1.2.0";
+  version = "1.2.1";
 
   outputs = [
     "out"
@@ -30,7 +30,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "jpu";
     repo = "casilda";
     tag = finalAttrs.version;
-    hash = "sha256-JaWHKKNYeeW7QKB6DpGrXowvufeBZUnc9pP0ZAAo3gU=";
+    hash = "sha256-3xJ0FC+/pQYakvdPMOrUNkI7kIq/FRdJIEYlOnWp0nE=";
   };
 
   depsBuildBuild = [ pkg-config ];

pkgs/by-name/d-/d-spy/package.nix

@@ -17,7 +17,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "d-spy";
-  version = "49.2";
+  version = "50.0";
 
   outputs = [
     "out"
@@ -26,7 +26,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://gnome/sources/d-spy/${lib.versions.major finalAttrs.version}/d-spy-${finalAttrs.version}.tar.xz";
-    hash = "sha256-uBT/J9goqrzacvLGLxtB1iA190PQb9mn48XJhsSHmmk=";
+    hash = "sha256-G93IbYos9ntPZS3EYczYNTES8Ih1NCADfHX1RU3qrRA=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/eo/eog/package.nix

@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchurl,
-  fetchpatch,
   meson,
   ninja,
   gettext,
@@ -34,7 +33,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "eog";
-  version = "49.1";
+  version = "50.0";
 
   outputs = [
     "out"
@@ -44,20 +43,14 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://gnome/sources/eog/${lib.versions.major finalAttrs.version}/eog-${finalAttrs.version}.tar.xz";
-    hash = "sha256-+t0S4UupzSvmmJ37zvQAAWRbY0QM7tjgSGewdYewZtw=";
+    hash = "sha256-XAIm0Qz6E1aa3iIY8DzmL3m43Fwoji4LEj0u9Rq9ywc=";
   };
 
   patches = [
     # Fix path to libeog.so in the gir file.
     # We patch gobject-introspection to hardcode absolute paths but
     # our Meson patch will only pass the info when install_dir is absolute as well.
     ./fix-gir-lib-path.patch
-
-    # Switch to girepository-2.0
-    (fetchpatch {
-      url = "https://src.fedoraproject.org/rpms/eog/raw/939eee56e5b72b02a8c0f4f867431cf6426adb9e/f/libpeas1_pygobject352.patch";
-      hash = "sha256-5QIkxxUvGKzb0cMCIcfuu7FX9XuY+RrKNunSvRDEDRc=";
-    })
   ];
 
   nativeBuildInputs = [

pkgs/by-name/ep/epiphany/package.nix

@@ -39,11 +39,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "epiphany";
-  version = "49.2";
+  version = "50.2";
 
   src = fetchurl {
     url = "mirror://gnome/sources/epiphany/${lib.versions.major finalAttrs.version}/epiphany-${finalAttrs.version}.tar.xz";
-    hash = "sha256-s7o9aCE+h/gfFzPoVQDDe4K1k4+QCeT+iZlJY9X7K44=";
+    hash = "sha256-OhA4+BzKqSvsorI7g3BK8CVFP7+YVep2WJEjxD05Vp4=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ev/evince/package.nix

@@ -138,6 +138,8 @@ stdenv.mkDerivation (finalAttrs: {
   passthru = {
     updateScript = gnome.updateScript {
       packageName = "evince";
+      # 49.alpha bumps API and breaks sushi.
+      freeze = true;
     };
   };