NixDaemon

_overlay.nix (4284B)

---

 # modules/features/pentest/_overlay.nix — fixes this toolkit needs from nixpkgs
 # itself. Applied to both the system (nixpkgs.overlays) and the flake's
 # perSystem pkgs, so `nix flake check` and `nh os switch` agree.
 #
 # Keep every entry justified and dated: an overlay is a fork, and each one is a
 # thing to delete when nixpkgs catches up.
 final: prev:
 {
   # 2026-10-10 — ligolo-ng 0.9.1 -> 0.9.2 (upstream's current release). Done
   # here, for the whole system, rather than only in payloads.nix: the proxy
   # you run (pivot.nix) and the agents you drop (payloads.nix) must be the
   # same version, and an overlay is the one place both read. Same go.sum, so
   # the vendorHash is unchanged. Delete when nixpkgs reaches 0.9.2.
   ligolo-ng = prev.ligolo-ng.overrideAttrs (_: {
     version = "0.9.2";
     src = prev.fetchFromGitHub {
       owner = "nicocha30";
       repo = "ligolo-ng";
       tag = "v0.9.2";
       hash = "sha256-y7q4XhZpmzxQM/fKd3ReRxjMGtda9GUJPsT5az6G784=";
     };
   });
 
   # 2026-10-08 — anyio 4.14.2 fails 5 of 2596 tests on python 3.12 in nixpkgs:
   # tests/streams/test_tls.py::test_tls_connectable raises
   # ValueError('server_hostname can only be specified in client mode') on every
   # backend, and TestDropwhile::test_checkpoints_empty_results trips unraisable
   # warnings under uvloop. Both are test-harness problems, not library faults.
   #
   # Without this netexec cannot build at all — netexec -> certipy-ad/proxy-py ->
   # httpx -> httpcore -> anyio — and `nxc` is the most used tool in CPTS. The
   # deselect is narrow and named rather than a blanket doCheck = false, which
   # would hide a real regression.
   #
   # Two things about the mechanism, both learned the hard way:
   #
   #  1. It must be pythonPackagesExtensions, not
   #     `python312.override { packageOverrides = ... }`. netexec's own
   #     package.nix does its own `python312.override { packageOverrides = ... }`
   #     to pin impacket, and that REPLACES an overlay's packageOverrides rather
   #     than composing with it — the fix vanished silently and netexec's
   #     derivation came out byte-identical. Extensions are applied wherever a
   #     python package set is constructed, so they survive that.
   #
   #  2. It must be scoped to 3.12. An unscoped extension applies to every
   #     python set and invalidates the binary cache for everything downstream of
   #     anyio in all of them: the first attempt had python3.14-twisted
   #     rebuilding from source with its full test suite for no reason. Only
   #     3.12's anyio is broken; 3.14 (the default, used by impacket) is fine.
   pythonPackagesExtensions = prev.pythonPackagesExtensions ++ [
     # 2026-10-08 — masky dies the moment you run it with
     # "ModuleNotFoundError: No module named 'pkg_resources'". Installing
     # setuptools does NOT fix it: setuptools 83 (this nixpkgs) removed
     # pkg_resources altogether, so the module simply no longer exists for any
     # python here. masky has exactly one use of it — `resource_filename` to
     # locate its bundled Masky.exe — so it is rewritten to the importlib
     # equivalent, which is what upstream would do.
     #
     # Caught by the smokeBins run in _sets.nix. `command -v masky` always
     # succeeded, which is precisely why that run now exists.
     # Narrow: touches masky only.
     (
       pyfinal: pyprev:
       prev.lib.optionalAttrs (pyprev ? masky) {
         masky = pyprev.masky.overridePythonAttrs (o: {
           postPatch = (o.postPatch or "") + ''
             substituteInPlace masky/lib/smb.py \
               --replace-fail \
                 'from pkg_resources import resource_filename' \
                 'from importlib.resources import files as _ir_files' \
               --replace-fail \
                 'resource_filename("masky.bin", "Masky.exe")' \
                 'str(_ir_files("masky.bin") / "Masky.exe")'
           '';
         });
       }
     )
     (
       pyfinal: pyprev:
       prev.lib.optionalAttrs (pyprev ? anyio && (pyprev.python.pythonVersion or "") == "3.12") {
         anyio = pyprev.anyio.overridePythonAttrs (o: {
           disabledTests = (o.disabledTests or [ ]) ++ [
             "test_tls_connectable"
             "test_checkpoints_empty_results"
           ];
         });
       }
     )
   ];
 }