open-policy-agent: 0.70.0 -> 1.0.1

[charlieegan3]

Hope this is the correct process, we released the new version of OPA at the end of last year and the bot doesn't seem to have picked it up - perhaps because it's a major version?

The release notes are here: https://github.com/open-policy-agent/opa/releases/tag/v1.0.0, this release's main changes are:

• makes the Rego v1 syntax the default. Users of v0 rego now need to use backwards compatibility mode.
• deprecated builtins have been removed.
• The OPA server now listens on loopback rather than all interfaces.
• The packages have been moved under v1 to allow v0 SDK use to not be distrupted. This requires a minor change in the package.nix file here to remove the same test in a new location.

Upgrade process is outlined here: https://www.openpolicyagent.org/docs/latest/v0-upgrade/

V0 compatible functionality outlined here: https://www.openpolicyagent.org/docs/latest/v0-compatibility/

Things done

• Built on platform(s)
  • x86_64-linux
  • aarch64-linux
  • x86_64-darwin
  • aarch64-darwin
• For non-Linux: Is sandboxing enabled in nix.conf? (See Nix manual)
  • sandbox = relaxed
  • sandbox = true
• Tested, as applicable:
  • NixOS test(s) (look inside nixos/tests)
  • and/or package tests
  • or, for functions and "core" functionality, tests in lib/tests or pkgs/test
  • made sure NixOS tests are linked to the relevant packages
• Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
• Tested basic functionality of all binary files (usually in ./result/bin/)
• 25.05 Release Notes (or backporting 24.11 and 25.05 Release notes)
  • (Package updates) Added a release notes entry if the change is major or breaking
  • (Module updates) Added a release notes entry if the change is significant
  • (Module addition) Added a release notes entry if adding a new NixOS module
• Fits CONTRIBUTING.md.

---

Add a 👍 reaction to pull requests you find important.

[Adda0]

It seems that the bot did pick it up, but there were some issues with the update. Feel free to have a look at the logs, if interested.

[charlieegan3]

Oh interesting, it looks like the matrix-authentication-service package is failing. I'll see what I can do about getting that updated.

[charlieegan3]

Hey @teutat3s! I opened this PR to get the OPA package updated, but it seems there's an issue with the matrix-authentication-service package too. (#369555 (comment)). Might you have some more familiarity with that project to dig into what might be wrong? I don't have a x86_64-linux laptop to replicate this easily. Please let me know if I can help with any of the OPA details 🙂!

[06kellyjac]

Hi @charlieegan3
Sorry for the delay. I'll take a quick look at the matrix-authentication-service issue since I have a fair few x86_64-linux boxes.

If you could make a couple of changes that'd be great:

• Please add a note about the breaking changes going from v0 to v1 in the 25.06 release notes. Doesn't have to be every detail but linking out to resources is helpful.
• Maybe bump to the new 1.0.1

[charlieegan3]

Thanks @06kellyjac! appreciate it. My guess is that some updates to that package will be required, happy to help there but just not had time to work out what's going on in the project yet. Happy to spend some time next week on it if needs be.

I've updated this PR to be 1.0.1 and added release note too. I left the note as v1.0.0+ since there might be some follow on minor releases before the nixpkgs release goes out.

[charlieegan3]

Unsure what to do about #369555 in the meantime.

[06kellyjac]

We can ignore the bot PR for now or draft it. 🙂

The build error is due to the v0 v1 migration.

We can either try pull the commits which move to v1 and see if that works

element-hq/matrix-authentication-service@881c6df

Or I can make a separte patch just based on the opa fmt --v0-v1 -w ./policies output. Or maybe attaching --v0-compatible to the build would work

[charlieegan3]

Cool, good that they've already done the upgrade to v1. That at least makes things a bit easier.

We can either try pull the commits which move to v1 and see if that works

If this is an option, it seems like a good one. Or we could encourage them to cut a release with those Rego changes too?

[06kellyjac]

Here's a standalone patch if you want: https://gist.github.com/06kellyjac/7038b3d0826f1a1dcae57044a4521260 . Up to you 🙂

Id say asking for a fresh release might be worth it but we could be waiting quite a long time & there could be other changes to account for in the package

[charlieegan3]

Ok, I think I've done the right thing in 35e6cb6 🙏 I've got to head but will check back in Monday if this is still needing attention. Thanks for the help here!