https://forgejo.org/docs/latest/user/authentication/#pam-pluggable-authentication-module
PAM support has to be enabled at compile time and upstream considers it
opt-in.
Official upstream binaries have it disabled.
We enabled it by default because we simply inherited most of it from
Gitea when the split in nixpkgs happened.
Reasons why it had been enabled in nixpkgs for Gitea are unknown.
See 9406f240a7.
There is reason to believe not a single Forgejo instance running on
NixOS uses this feature because it literally segfaults due to our
sandboxing.
`nix-update` is unable to detect that the hashes are in `packages.nix`
and `lts.nix` instead of `generic.nix` (where the `.src` attribute lies)
respectively.
`nix-update` provides a `--override-filename` flag to override that
heuristic, so we use that.
Additionally, scope `lts.nix` to the 7.x version series by using
`--version-regex`.
We cannot rely on `buildGoModule`'s default test selection if
`subPackages` is set:
~~~
Running phase: checkPhase
? code.gitea.io/gitea [no test files]
? code.gitea.io/gitea/contrib/environment-to-ini [no test files]
checkPhase completed in 53 seconds
~~~
So we override it in `preCheck` and skip some tests that fail in our
sandbox (e.g. because they require networking).
Note that this does slow down building the package quite a bit because
there are a lot of tests to run.
Still worth it IMHO.
This slipped through the 1.21.11-1 -> 7.0.0 bump in
6c359d6488.
Upstream made this a noop with a deprecation warning instead of a
hard fail in https://codeberg.org/forgejo/forgejo/pulls/2864.
Note: In that PR (it's commit) they link to nixpkgs as downstream
consumer of it (`build/merge-forgejo-locales.go`).
~~~
# Before
Running phase: buildPhase
NOT NEEDED: THIS IS A NOOP AS OF Forgejo 7.0 BUT KEPT FOR BACKWARD COMPATIBILITY
Building subPackage ./.
# After
Running phase: buildPhase
Building subPackage ./.
~~~
Upstream commit: 6647e4d53f
