From 06e1588e5752bc02b40361ca7146331baa0902f4 Mon Sep 17 00:00:00 2001 From: Marie Ramlow Date: Sun, 21 Sep 2025 10:55:06 +0200 Subject: [PATCH 01/12] gcc: drop libstdc++ patch This patch was introduced in 2010 to fix mingw compilers. See c548c084bbc009912673f8020298d698d2792e9d It no longer applies to gcc15 and all of our current gccs (13, 14 and 15) build fine without it. Tested the following cross-compilers: ```shell nix-build --expr 'with (import ./. { }).pkgsCross.mingwW64; hello.override { stdenv = gcc13Stdenv; }' \ --expr 'with (import ./. { }).pkgsCross.mingwW64; hello.override { stdenv = gcc14Stdenv; }' \ --expr 'with (import ./. { }).pkgsCross.mingwW64; hello.override { stdenv = gcc15Stdenv; }' \ --expr 'with (import ./. { }).pkgsCross.mingw32; hello.override { stdenv = gcc13Stdenv; }' \ --expr 'with (import ./. { }).pkgsCross.mingw32; hello.override { stdenv = gcc14Stdenv; }' \ --expr 'with (import ./. { }).pkgsCross.mingw32; hello.override { stdenv = gcc15Stdenv; }' ``` --- .../compilers/gcc/patches/default.nix | 5 +-- .../gcc/patches/libstdc++-target.patch | 32 ------------------- 2 files changed, 1 insertion(+), 36 deletions(-) delete mode 100644 pkgs/development/compilers/gcc/patches/libstdc++-target.patch diff --git a/pkgs/development/compilers/gcc/patches/default.nix b/pkgs/development/compilers/gcc/patches/default.nix index c75a960890f1..eb902364dee6 100644 --- a/pkgs/development/compilers/gcc/patches/default.nix +++ b/pkgs/development/compilers/gcc/patches/default.nix @@ -52,10 +52,7 @@ in ## 1. Patches relevant on every platform #################################### -[ ] -# Pass the path to a C++ compiler directly in the Makefile.in -++ optional (!lib.systems.equals targetPlatform hostPlatform) ./libstdc++-target.patch -++ optionals noSysDirs ( +optionals noSysDirs ( [ # Do not try looking for binaries and libraries in /lib and /usr/lib ./gcc-12-no-sys-dirs.patch diff --git a/pkgs/development/compilers/gcc/patches/libstdc++-target.patch b/pkgs/development/compilers/gcc/patches/libstdc++-target.patch deleted file mode 100644 index fb622b395806..000000000000 --- a/pkgs/development/compilers/gcc/patches/libstdc++-target.patch +++ /dev/null @@ -1,32 +0,0 @@ -Patch to make the target libraries 'configure' scripts find the proper CPP. -I noticed that building the mingw32 cross compiler. -Looking at the build script for mingw in archlinux, I think that only nixos -needs this patch. I don't know why. -diff --git a/Makefile.in b/Makefile.in -index 93f66b6..d691917 100644 ---- a/Makefile.in -+++ b/Makefile.in -@@ -266,6 +266,7 @@ BASE_TARGET_EXPORTS = \ - AR="$(AR_FOR_TARGET)"; export AR; \ - AS="$(COMPILER_AS_FOR_TARGET)"; export AS; \ - CC="$(CC_FOR_TARGET) $(XGCC_FLAGS_FOR_TARGET) $$TFLAGS"; export CC; \ -+ CPP="$(CC_FOR_TARGET) $(XGCC_FLAGS_FOR_TARGET) $$TFLAGS -E"; export CC; \ - CFLAGS="$(CFLAGS_FOR_TARGET)"; export CFLAGS; \ - CONFIG_SHELL="$(SHELL)"; export CONFIG_SHELL; \ - CPPFLAGS="$(CPPFLAGS_FOR_TARGET)"; export CPPFLAGS; \ -@@ -291,11 +292,13 @@ BASE_TARGET_EXPORTS = \ - RAW_CXX_TARGET_EXPORTS = \ - $(BASE_TARGET_EXPORTS) \ - CXX_FOR_TARGET="$(RAW_CXX_FOR_TARGET)"; export CXX_FOR_TARGET; \ -- CXX="$(RAW_CXX_FOR_TARGET) $(XGCC_FLAGS_FOR_TARGET) $$TFLAGS"; export CXX; -+ CXX="$(RAW_CXX_FOR_TARGET) $(XGCC_FLAGS_FOR_TARGET) $$TFLAGS"; export CXX; \ -+ CXXCPP="$(RAW_CXX_FOR_TARGET) $(XGCC_FLAGS_FOR_TARGET) $$TFLAGS -E"; export CXX; - - NORMAL_TARGET_EXPORTS = \ - $(BASE_TARGET_EXPORTS) \ -- CXX="$(CXX_FOR_TARGET) $(XGCC_FLAGS_FOR_TARGET) $$TFLAGS"; export CXX; -+ CXX="$(CXX_FOR_TARGET) $(XGCC_FLAGS_FOR_TARGET) $$TFLAGS"; export CXX; \ -+ CXXCPP="$(CXX_FOR_TARGET) $(XGCC_FLAGS_FOR_TARGET) $$TFLAGS -E"; export CXX; - - # Where to find GMP - HOST_GMPLIBS = @gmplibs@ From b68fa55000d75c48b607ca42ed5cefebbb6bd00d Mon Sep 17 00:00:00 2001 From: Maor Haimovitz Date: Tue, 7 Oct 2025 19:37:43 -0400 Subject: [PATCH 02/12] nixos/fontconfig: fix allowBitmaps option --- nixos/modules/config/fonts/fontconfig.nix | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/nixos/modules/config/fonts/fontconfig.nix b/nixos/modules/config/fonts/fontconfig.nix index 82bac6249d21..419de1a89fa8 100644 --- a/nixos/modules/config/fonts/fontconfig.nix +++ b/nixos/modules/config/fonts/fontconfig.nix @@ -219,6 +219,10 @@ let replaceDefaultConfig "11-lcdfilter-default.conf" "11-lcdfilter-${cfg.subpixel.lcdfilter}.conf" )} + ${lib.optionalString cfg.allowBitmaps '' + rm -f $dst/70-no-bitmaps-except-emoji.conf + ''} + # 00-nixos-cache.conf ln -s ${cacheConf} $dst/00-nixos-cache.conf From 62cf69dface826069cc90d5d532b63375e03756b Mon Sep 17 00:00:00 2001 From: David Flatz Date: Fri, 10 Oct 2025 11:01:53 +0200 Subject: [PATCH 03/12] nixos/fontconfig: add test for allowBitmaps --- nixos/tests/all-tests.nix | 1 + nixos/tests/fontconfig-bitmap-fonts.nix | 17 +++++++++++++++++ 2 files changed, 18 insertions(+) create mode 100644 nixos/tests/fontconfig-bitmap-fonts.nix diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix index d4270fc0ff31..80ce99b2c748 100644 --- a/nixos/tests/all-tests.nix +++ b/nixos/tests/all-tests.nix @@ -566,6 +566,7 @@ in fluent-bit = runTest ./fluent-bit.nix; fluentd = runTest ./fluentd.nix; fluidd = runTest ./fluidd.nix; + fontconfig-bitmap-fonts = runTest ./fontconfig-bitmap-fonts.nix; fontconfig-default-fonts = runTest ./fontconfig-default-fonts.nix; forgejo = import ./forgejo.nix { inherit runTest; diff --git a/nixos/tests/fontconfig-bitmap-fonts.nix b/nixos/tests/fontconfig-bitmap-fonts.nix new file mode 100644 index 000000000000..776b62e06f46 --- /dev/null +++ b/nixos/tests/fontconfig-bitmap-fonts.nix @@ -0,0 +1,17 @@ +{ lib, ... }: +{ + name = "fontconfig-bitmap-fonts"; + + nodes.machine = + { config, pkgs, ... }: + { + fonts.packages = [ + pkgs.terminus_font + ]; + fonts.fontconfig.allowBitmaps = true; + }; + + testScript = '' + machine.succeed("fc-list | grep Terminus") + ''; +} From e23110be0d07e39f5503a69676f1056f51629840 Mon Sep 17 00:00:00 2001 From: K900 Date: Mon, 13 Oct 2025 11:16:47 +0300 Subject: [PATCH 04/12] linux_testing: 6.17-rc7 -> 6.18-rc1 --- pkgs/os-specific/linux/kernel/kernels-org.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json index ba339f14a98c..da2716750099 100644 --- a/pkgs/os-specific/linux/kernel/kernels-org.json +++ b/pkgs/os-specific/linux/kernel/kernels-org.json @@ -1,7 +1,7 @@ { "testing": { - "version": "6.17-rc7", - "hash": "sha256:11bjz14ncfbnz3h9a4vk71av664xrx1kh28i22w7yg6g46hifq65", + "version": "6.18-rc1", + "hash": "sha256:1warfcvr86as1rcls3g5f9i4az6xqabjwmf6jxlx9dk2l523sl1l", "lts": false }, "6.1": { From e9b977bc41dc62f67dc7a10fa53dde68c532e656 Mon Sep 17 00:00:00 2001 From: K900 Date: Mon, 13 Oct 2025 11:39:21 +0300 Subject: [PATCH 05/12] linux/common-config: update for 6.18 --- pkgs/os-specific/linux/kernel/common-config.nix | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix index ae1070480681..fdb300836d80 100644 --- a/pkgs/os-specific/linux/kernel/common-config.nix +++ b/pkgs/os-specific/linux/kernel/common-config.nix @@ -550,7 +550,7 @@ let DRM_AMD_ISP = whenAtLeast "6.11" yes; # Enable new firmware (and by extension NVK) for compatible hardware on Nouveau - DRM_NOUVEAU_GSP_DEFAULT = whenAtLeast "6.8" yes; + DRM_NOUVEAU_GSP_DEFAULT = whenBetween "6.8" "6.18" yes; # Enable Nouveau shared virtual memory (used by OpenCL) DEVICE_PRIVATE = whenHasDevicePrivate yes; @@ -568,6 +568,11 @@ let # Intel GVT-g graphics virtualization supports 64-bit only DRM_I915_GVT = yes; DRM_I915_GVT_KVMGT = module; + # Enable Hyper-V guest stuff + HYPERV = lib.mkMerge [ + (whenOlder "6.18" module) + (whenAtLeast "6.18" yes) + ]; # Enable Hyper-V Synthetic DRM Driver DRM_HYPERV = whenAtLeast "5.14" module; # And disable the legacy framebuffer driver when we have the new one @@ -683,8 +688,8 @@ let EXT2_FS_POSIX_ACL = yes; EXT2_FS_SECURITY = yes; - EXT3_FS_POSIX_ACL = yes; - EXT3_FS_SECURITY = yes; + EXT3_FS_POSIX_ACL = option yes; + EXT3_FS_SECURITY = option yes; EXT4_FS_POSIX_ACL = yes; EXT4_FS_SECURITY = yes; @@ -1020,7 +1025,7 @@ let ZRAM_DEF_COMP_ZSTD = whenAtLeast "5.11" yes; ZSWAP = option yes; ZSWAP_COMPRESSOR_DEFAULT_ZSTD = whenAtLeast "5.7" (lib.mkOptionDefault yes); - ZPOOL = yes; + ZPOOL = whenOlder "6.18" yes; ZSMALLOC = option yes; }; @@ -1085,6 +1090,8 @@ let HID_BATTERY_STRENGTH = yes; # enabled by default in x86_64 but not arm64, so we do that here HIDRAW = yes; + # 6.18-rc1 fails to link otherwise, at least on aarch64 + HID_HAPTIC = whenAtLeast "6.18" yes; # Enable loading HID fixups as eBPF from userspace HID_BPF = whenAtLeast "6.3" (whenPlatformHasEBPFJit yes); From 7fe74bb8335f8fcca4f59585d43efc05812cdd53 Mon Sep 17 00:00:00 2001 From: nikstur Date: Sun, 12 Oct 2025 15:54:20 +0200 Subject: [PATCH 06/12] nixos/profiles/bashless: re-enable systemd-timesyncd systemd-timesyncd is now bashless and can thus re-enabled in the bashless profile. --- nixos/modules/profiles/bashless.nix | 2 -- 1 file changed, 2 deletions(-) diff --git a/nixos/modules/profiles/bashless.nix b/nixos/modules/profiles/bashless.nix index b6764a92f4f8..171a695809bf 100644 --- a/nixos/modules/profiles/bashless.nix +++ b/nixos/modules/profiles/bashless.nix @@ -36,8 +36,6 @@ systemd.shutdownRamfs.enable = lib.mkDefault false; # Relies on the gzip command which depends on bash services.logrotate.enable = lib.mkDefault false; - # Service relies on bash scripts - services.timesyncd.enable = lib.mkDefault false; # Check that the system does not contain a Nix store path that contains the # string "bash". From b9d0fd8be46d7a6ce24c13899ba07d5c3526f688 Mon Sep 17 00:00:00 2001 From: nikstur Date: Fri, 10 Oct 2025 23:18:06 +0200 Subject: [PATCH 07/12] nixos/systemd/shutdown: stricter sandboxing Copied the config from archlinux's mkinitcpio: https://github.com/archlinux/mkinitcpio/blob/318ae30f6a72dc5d256edbe23101fcffdba959ef/systemd/mkinitcpio-generate-shutdown-ramfs.service --- nixos/modules/system/boot/systemd/shutdown.nix | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/nixos/modules/system/boot/systemd/shutdown.nix b/nixos/modules/system/boot/systemd/shutdown.nix index b42aaf5a0d32..ef2491a2d7ca 100644 --- a/nixos/modules/system/boot/systemd/shutdown.nix +++ b/nixos/modules/system/boot/systemd/shutdown.nix @@ -71,9 +71,21 @@ in serviceConfig = { Type = "oneshot"; + ExecStart = "${pkgs.makeInitrdNGTool}/bin/make-initrd-ng ${ramfsContents} /run/initramfs"; + + # Sandboxing ProtectSystem = "strict"; ReadWritePaths = "/run/initramfs"; - ExecStart = "${pkgs.makeInitrdNGTool}/bin/make-initrd-ng ${ramfsContents} /run/initramfs"; + ProtectHome = true; + ProtectHostname = true; + ProtectClock = true; + ProtectKernelTunables = true; + ProtectKernelModules = true; + ProtectKernelLogs = true; + ProtectControlGroups = true; + PrivateNetwork = true; + LockPersonality = true; + MemoryDenyWriteExecute = true; }; }; }; From 653fd8c99590db1b83f96c52f70f31e5de239719 Mon Sep 17 00:00:00 2001 From: nikstur Date: Sat, 11 Oct 2025 00:53:17 +0200 Subject: [PATCH 08/12] nixos/systemd/shutdown: make shutdown ramfs bashless --- nixos/modules/profiles/bashless.nix | 2 -- .../modules/system/boot/systemd/shutdown.nix | 21 ++++++++++++++++++- nixos/tests/activation/bashless.nix | 8 +++++++ 3 files changed, 28 insertions(+), 3 deletions(-) diff --git a/nixos/modules/profiles/bashless.nix b/nixos/modules/profiles/bashless.nix index 171a695809bf..a658a5977709 100644 --- a/nixos/modules/profiles/bashless.nix +++ b/nixos/modules/profiles/bashless.nix @@ -32,8 +32,6 @@ boot.kexec.enable = lib.mkDefault false; # Relies on bash scripts powerManagement.enable = lib.mkDefault false; - # Has some bash inside - systemd.shutdownRamfs.enable = lib.mkDefault false; # Relies on the gzip command which depends on bash services.logrotate.enable = lib.mkDefault false; diff --git a/nixos/modules/system/boot/systemd/shutdown.nix b/nixos/modules/system/boot/systemd/shutdown.nix index ef2491a2d7ca..754e38b9714d 100644 --- a/nixos/modules/system/boot/systemd/shutdown.nix +++ b/nixos/modules/system/boot/systemd/shutdown.nix @@ -17,6 +17,7 @@ in enable = lib.mkEnableOption "pivoting back to an initramfs for shutdown" // { default = true; }; + contents = lib.mkOption { description = "Set of files that have to be linked into the shutdown ramfs"; example = lib.literalExpression '' @@ -34,6 +35,22 @@ in type = utils.systemdUtils.types.initrdStorePath; default = [ ]; }; + + shell.enable = lib.mkEnableOption "" // { + default = config.environment.shell.enable; + internal = true; + description = '' + Whether to enable a shell in the shutdown ramfs. + + In contrast to `environment.shell.enable`, this option actually + strictly disables all shells in the shutdown ramfs because they're not + copied into it anymore. Paths that use a shell (e.g. via the `script` + option), will break if this option is set. + + Only set this option if you're sure that you can recover from potential + issues. + ''; + }; }; config = lib.mkIf cfg.enable { @@ -43,9 +60,11 @@ in "/etc/os-release".source = config.environment.etc.os-release.source; }; systemd.shutdownRamfs.storePaths = [ - pkgs.runtimeShell "${pkgs.coreutils}/bin" ] + ++ lib.optionals cfg.shell.enable [ + pkgs.runtimeShell + ] ++ map (c: builtins.removeAttrs c [ "text" ]) (builtins.attrValues cfg.contents); systemd.mounts = [ diff --git a/nixos/tests/activation/bashless.nix b/nixos/tests/activation/bashless.nix index 06028a81db30..13a467293fc9 100644 --- a/nixos/tests/activation/bashless.nix +++ b/nixos/tests/activation/bashless.nix @@ -19,6 +19,7 @@ # work. environment.binsh = lib.mkForce null; boot.initrd.systemd.shell.enable = false; + systemd.shutdownRamfs.shell.enable = false; # This ensures that we only have the store paths of our closure in the # in the guest. This is necessary so we can grep in the store. @@ -31,6 +32,7 @@ environment.systemPackages = [ pkgs.coreutils pkgs.gnugrep + pkgs.findutils ]; # Unset the regex because the tests instrumentation needs bash. @@ -43,6 +45,12 @@ with subtest("/bin/sh doesn't exist"): machine.fail("stat /bin/sh") + with subtest("shutdown ramfs is bashless"): + machine.systemctl("start generate-shutdown-ramfs.service") + shutdown_ramfs_bash_paths = machine.succeed("find /run/initramfs -type d,f -name '*bash*'") + print(shutdown_ramfs_bash_paths) + t.assertNotIn("bash", shutdown_ramfs_bash_paths) + bash_store_paths = machine.succeed("ls /nix/store | grep bash || true") print(bash_store_paths) ''; From 60a82b28e8304700b29bc3b44aa9cda212feaffe Mon Sep 17 00:00:00 2001 From: K900 Date: Wed, 15 Oct 2025 14:54:14 +0300 Subject: [PATCH 09/12] linux_6_17: 6.17.2 -> 6.17.3 --- pkgs/os-specific/linux/kernel/kernels-org.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json index da2716750099..b752cff7395f 100644 --- a/pkgs/os-specific/linux/kernel/kernels-org.json +++ b/pkgs/os-specific/linux/kernel/kernels-org.json @@ -40,8 +40,8 @@ "lts": false }, "6.17": { - "version": "6.17.2", - "hash": "sha256:0zzmcjkmxmcn45y20g8hz7dxs355rmczp9k8vjwc3xb5a03cpszx", + "version": "6.17.3", + "hash": "sha256:16cld01iwn6hhayxh6f0z71rph0z3p3m4bsd49szddd5v0cqdk1y", "lts": false } } From 60c3abd72894fa101f69a82db9f14ce7f3efea99 Mon Sep 17 00:00:00 2001 From: K900 Date: Wed, 15 Oct 2025 14:54:46 +0300 Subject: [PATCH 10/12] linux_6_12: 6.12.52 -> 6.12.53 --- pkgs/os-specific/linux/kernel/kernels-org.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json index b752cff7395f..b221633d4880 100644 --- a/pkgs/os-specific/linux/kernel/kernels-org.json +++ b/pkgs/os-specific/linux/kernel/kernels-org.json @@ -30,8 +30,8 @@ "lts": true }, "6.12": { - "version": "6.12.52", - "hash": "sha256:1ccyd9h9i3xia1gqq0mggis5yv04c9ys44xp707wfcm0f3v0r1dl", + "version": "6.12.53", + "hash": "sha256:1df0sahirxsby2imsbi04vcn2bimskl4l2r19v7sywz6ran0fdb6", "lts": true }, "6.16": { From 4941fc9a2e9bd6879d572b7f4157342587eaba50 Mon Sep 17 00:00:00 2001 From: K900 Date: Wed, 15 Oct 2025 14:55:16 +0300 Subject: [PATCH 11/12] linux_6_6: 6.6.111 -> 6.6.112 --- pkgs/os-specific/linux/kernel/kernels-org.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json index b221633d4880..27059b99ba30 100644 --- a/pkgs/os-specific/linux/kernel/kernels-org.json +++ b/pkgs/os-specific/linux/kernel/kernels-org.json @@ -25,8 +25,8 @@ "lts": true }, "6.6": { - "version": "6.6.111", - "hash": "sha256:1is6nrm5x54bw8zn8l5akp8ign185i19biks442yynfn63hp1i04", + "version": "6.6.112", + "hash": "sha256:08la2f8w5w2x0l9nmvzsmbwa951xyshhvdhwwhfyjmka66zr4zbc", "lts": true }, "6.12": { From 1bae076f237f231190ca3006c64b82bcda2310e7 Mon Sep 17 00:00:00 2001 From: K900 Date: Wed, 15 Oct 2025 14:55:18 +0300 Subject: [PATCH 12/12] linux_6_1: 6.1.155 -> 6.1.156 --- pkgs/os-specific/linux/kernel/kernels-org.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json index 27059b99ba30..e40d19fac90b 100644 --- a/pkgs/os-specific/linux/kernel/kernels-org.json +++ b/pkgs/os-specific/linux/kernel/kernels-org.json @@ -5,8 +5,8 @@ "lts": false }, "6.1": { - "version": "6.1.155", - "hash": "sha256:0wsw99h2jsrcx9fff59nqjx66l40vywj8qi3j6yvqpq8xsp8g4y2", + "version": "6.1.156", + "hash": "sha256:13i2l04pmba7dksz2p5kwxgr5bydc5lp7284d4wfsnjf425i9fyl", "lts": true }, "5.15": {