Merge master into staging-next

.git-blame-ignore-revs

@@ -238,3 +238,6 @@ e0fe216f4912dd88a021d12a44155fd2cfeb31c8
 
 # nixos/movim: format with nixfmt-rfc-style
 43c1654cae47cbf987cb63758c06245fa95c1e3b
+
+# nixos/iso-image.nix: nixfmt
+da9a092c34cef6947d7aee2b134f61df45171631

nixos/modules/installer/cd-dvd/installation-cd-graphical-calamares-gnome.nix

@@ -1,11 +1,11 @@
 # This module defines a NixOS installation CD that contains GNOME.
 
-{ pkgs, ... }:
+{ lib, pkgs, ... }:
 
 {
   imports = [ ./installation-cd-graphical-calamares.nix ];
 
-  isoImage.edition = "gnome";
+  isoImage.edition = lib.mkDefault "gnome";
 
   services.xserver.desktopManager.gnome = {
     # Add Firefox and other tools useful for installation to the launcher

nixos/modules/installer/cd-dvd/installation-cd-graphical-calamares-plasma5.nix

@@ -1,12 +1,12 @@
 # This module defines a NixOS installation CD that contains X11 and
 # Plasma 5.
 
-{ pkgs, ... }:
+{ lib, pkgs, ... }:
 
 {
   imports = [ ./installation-cd-graphical-calamares.nix ];
 
-  isoImage.edition = "plasma5";
+  isoImage.edition = lib.mkDefault "plasma5";
 
   services.xserver.desktopManager.plasma5 = {
     enable = true;

nixos/modules/installer/cd-dvd/installation-cd-graphical-calamares-plasma6.nix

@@ -1,11 +1,11 @@
 # This module defines a NixOS installation CD that contains Plasma 6.
 
-{ pkgs, ... }:
+{ lib, pkgs, ... }:
 
 {
   imports = [ ./installation-cd-graphical-calamares.nix ];
 
-  isoImage.edition = "plasma6";
+  isoImage.edition = lib.mkDefault "plasma6";
 
   services.desktopManager.plasma6.enable = true;
 

nixos/modules/installer/cd-dvd/installation-cd-graphical-combined.nix

@@ -0,0 +1,52 @@
+# This configuration uses a specialisation for each desired boot
+# configuration, and a common parent configuration for all of them
+# that's hidden. This allows users to import this module alongside
+# their own and get the full array of specialisations inheriting the
+# users' settings.
+
+{ lib, ... }:
+{
+  imports = [ ./installation-cd-base.nix ];
+  isoImage.edition = "graphical";
+  isoImage.showConfiguration = lib.mkDefault false;
+
+  specialisation = {
+    gnome.configuration =
+      { config, ... }:
+      {
+        imports = [ ./installation-cd-graphical-calamares-gnome.nix ];
+        isoImage.showConfiguration = true;
+        isoImage.configurationName = "GNOME (Linux LTS)";
+      };
+
+    gnome_latest_kernel.configuration =
+      { config, ... }:
+      {
+        imports = [
+          ./installation-cd-graphical-calamares-gnome.nix
+          ./latest-kernel.nix
+        ];
+        isoImage.showConfiguration = true;
+        isoImage.configurationName = "GNOME (Linux ${config.boot.kernelPackages.kernel.version})";
+      };
+
+    plasma.configuration =
+      { config, ... }:
+      {
+        imports = [ ./installation-cd-graphical-calamares-plasma6.nix ];
+        isoImage.showConfiguration = true;
+        isoImage.configurationName = "Plasma (Linux LTS)";
+      };
+
+    plasma_latest_kernel.configuration =
+      { config, ... }:
+      {
+        imports = [
+          ./installation-cd-graphical-calamares-plasma6.nix
+          ./latest-kernel.nix
+        ];
+        isoImage.showConfiguration = true;
+        isoImage.configurationName = "Plasma (Linux ${config.boot.kernelPackages.kernel.version})";
+      };
+  };
+}

nixos/modules/installer/cd-dvd/installation-cd-graphical-gnome.nix

@@ -1,11 +1,11 @@
 # This module defines a NixOS installation CD that contains GNOME.
 
-{ ... }:
+{ lib, ... }:
 
 {
   imports = [ ./installation-cd-graphical-base.nix ];
 
-  isoImage.edition = "gnome";
+  isoImage.edition = lib.mkDefault "gnome";
 
   services.xserver.desktopManager.gnome = {
     # Add Firefox and other tools useful for installation to the launcher

nixos/modules/installer/cd-dvd/installation-cd-graphical-plasma5.nix

@@ -1,12 +1,12 @@
 # This module defines a NixOS installation CD that contains X11 and
 # Plasma 5.
 
-{ pkgs, ... }:
+{ lib, pkgs, ... }:
 
 {
   imports = [ ./installation-cd-graphical-base.nix ];
 
-  isoImage.edition = "plasma5";
+  isoImage.edition = lib.mkDefault "plasma5";
 
   services.xserver.desktopManager.plasma5 = {
     enable = true;

nixos/modules/installer/cd-dvd/installation-cd-minimal-combined.nix

@@ -0,0 +1,14 @@
+{ lib, ... }:
+
+{
+  imports = [ ./installation-cd-minimal.nix ];
+
+  isoImage.configurationName = lib.mkDefault "(Linux LTS)";
+
+  specialisation.latest_kernel.configuration =
+    { config, ... }:
+    {
+      imports = [ ./latest-kernel.nix ];
+      isoImage.configurationName = "(Linux ${config.boot.kernelPackages.kernel.version})";
+    };
+}

nixos/modules/installer/cd-dvd/iso-image.nix

@@ -1,88 +1,133 @@
 # This module creates a bootable ISO image containing the given NixOS
 # configuration.  The derivation for the ISO image will be placed in
 # config.system.build.isoImage.
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 let
-  /**
+  # Builds a single menu entry
-   * Given a list of `options`, concats the result of mapping each options
-   * to a menuentry for use in grub.
-   *
-   *  * defaults: {name, image, params, initrd}
-   *  * options: [ option... ]
-   *  * option: {name, params, class}
-   */
   menuBuilderGrub2 =
-  defaults: options: lib.concatStrings
+    {
-    (
+      name,
-      map
+      class,
-      (option: ''
+      image,
-        menuentry '${defaults.name} ${
+      params,
-        # Name appended to menuentry defaults to params if no specific name given.
+      initrd,
-        option.name or (lib.optionalString (option ? params) "(${option.params})")
+    }:
-        }' ${lib.optionalString (option ? class) " --class ${option.class}"} {
+    ''
+      menuentry '${name}' --class ${class} {
         # Fallback to UEFI console for boot, efifb sometimes has difficulties.
         terminal_output console
 
-          linux ${defaults.image} \''${isoboot} ${defaults.params} ${
+        linux ${image} \''${isoboot} ${params}
-            option.params or ""
+        initrd ${initrd}
       }
-          initrd ${defaults.initrd}
+    '';
-        }
-      '')
-      options
-    )
-  ;
 
-  /**
+  # Builds all menu entries
-   * Builds the default options.
+  buildMenuGrub2 =
-   */
+    {
-  buildMenuGrub2 = buildMenuAdditionalParamsGrub2 "";
+      cfg ? config,
-
+      params ? [ ],
-  targetArch =
+    }:
-    if config.boot.loader.grub.forcei686 then
-      "ia32"
-    else
-      pkgs.stdenv.hostPlatform.efiArch;
-
-  /**
-   * Given params to add to `params`, build a set of default options.
-   * Use this one when creating a variant (e.g. hidpi)
-   */
-  buildMenuAdditionalParamsGrub2 = additional:
     let
-    finalCfg = {
+      menuConfig = {
-      name = "${config.isoImage.prependToMenuLabel}${config.system.nixos.distroName} ${config.system.nixos.label}${config.isoImage.appendToMenuLabel}";
+        name = lib.concatStrings [
-      params = "init=${config.system.build.toplevel}/init ${additional} ${toString config.boot.kernelParams}";
+          cfg.isoImage.prependToMenuLabel
-      image = "/boot/${config.system.boot.loader.kernelFile}";
+          cfg.system.nixos.distroName
-      initrd = "/boot/initrd";
+          " "
+          cfg.system.nixos.label
+          cfg.isoImage.appendToMenuLabel
+          (lib.optionalString (cfg.isoImage.configurationName != null) (" " + cfg.isoImage.configurationName))
+        ];
+        params = "init=${cfg.system.build.toplevel}/init ${toString cfg.boot.kernelParams} ${toString params}";
+        image = "/boot/${cfg.boot.kernelPackages.kernel + "/" + cfg.system.boot.loader.kernelFile}";
+        initrd = "/boot/${cfg.system.build.initialRamdisk + "/" + cfg.system.boot.loader.initrdFile}";
+        class = "installer";
       };
-
     in
-    menuBuilderGrub2
+    ''
-    finalCfg
+      ${lib.optionalString cfg.isoImage.showConfiguration (menuBuilderGrub2 menuConfig)}
-    [
+      ${lib.concatStringsSep "\n" (
-      { class = "installer"; }
+        lib.mapAttrsToList (
-      { class = "nomodeset"; params = "nomodeset"; }
+          specName:
-      { class = "copytoram"; params = "copytoram"; }
+          { configuration, ... }:
-      { class = "debug";     params = "debug"; }
+          buildMenuGrub2 {
-    ]
+            cfg = configuration;
-  ;
+            inherit params;
+          }
+        ) cfg.specialisation
+      )}
+    '';
+
+  targetArch = if config.boot.loader.grub.forcei686 then "ia32" else pkgs.stdenv.hostPlatform.efiArch;
 
   # Timeout in syslinux is in units of 1/10 of a second.
   # null means max timeout (35996, just under 1h in 1/10 seconds)
   # 0 means disable timeout
-  syslinuxTimeout = if config.boot.loader.timeout == null then
+  syslinuxTimeout =
-      35996
+    if config.boot.loader.timeout == null then 35996 else config.boot.loader.timeout * 10;
-    else
-      config.boot.loader.timeout * 10;
 
   # Timeout in grub is in seconds.
   # null means max timeout (infinity)
   # 0 means disable timeout
-  grubEfiTimeout = if config.boot.loader.timeout == null then
+  grubEfiTimeout = if config.boot.loader.timeout == null then -1 else config.boot.loader.timeout;
-      -1
+
-    else
+  optionsSubMenus = [
-      config.boot.loader.timeout;
+    {
+      title = "Copy ISO Files to RAM";
+      class = "copytoram";
+      params = [ "copytoram" ];
+    }
+    {
+      title = "No modesetting";
+      class = "nomodeset";
+      params = [ "nomodeset" ];
+    }
+    {
+      title = "Debug Console Output";
+      class = "debug";
+      params = [ "debug" ];
+    }
+    # If we boot into a graphical environment where X is autoran
+    # and always crashes, it makes the media unusable. Allow the user
+    # to disable this.
+    {
+      title = "Disable display-manager";
+      class = "quirk-disable-displaymanager";
+      params = [
+        "systemd.mask=display-manager.service"
+        "plymouth.enable=0"
+      ];
+    }
+    # Some laptop and convertibles have the panel installed in an
+    # inconvenient way, rotated away from the keyboard.
+    # Those entries makes it easier to use the installer.
+    {
+      title = "Rotate framebuffer Clockwise";
+      class = "rotate-90cw";
+      params = [ "fbcon=rotate:1" ];
+    }
+    {
+      title = "Rotate framebuffer Upside-Down";
+      class = "rotate-180";
+      params = [ "fbcon=rotate:2" ];
+    }
+    {
+      title = "Rotate framebuffer Counter-Clockwise";
+      class = "rotate-90ccw";
+      params = [ "fbcon=rotate:3" ];
+    }
+    # Serial access is a must!
+    {
+      title = "Serial console=ttyS0,115200n8";
+      class = "serial";
+      params = [ "console=ttyS0,115200n8" ];
+    }
+  ];
 
   # The configuration file for syslinux.
 
@@ -97,6 +142,35 @@ let
   #   * COM32 entries (chainload, reboot, poweroff) are not recognized. They
   #     result in incorrect boot entries.
 
+  menuBuilderIsolinux =
+    {
+      cfg ? config,
+      label,
+      params ? [ ],
+    }:
+    ''
+      ${lib.optionalString cfg.isoImage.showConfiguration ''
+        LABEL ${label}
+        MENU LABEL ${cfg.isoImage.prependToMenuLabel}${cfg.system.nixos.distroName} ${cfg.system.nixos.label}${cfg.isoImage.appendToMenuLabel}${
+          lib.optionalString (cfg.isoImage.configurationName != null) (" " + cfg.isoImage.configurationName)
+        }
+        LINUX /boot/${cfg.boot.kernelPackages.kernel + "/" + cfg.system.boot.loader.kernelFile}
+        APPEND init=${cfg.system.build.toplevel}/init ${toString cfg.boot.kernelParams} ${toString params}
+        INITRD /boot/${cfg.system.build.initialRamdisk + "/" + cfg.system.boot.loader.initrdFile}
+      ''}
+
+      ${lib.concatStringsSep "\n\n" (
+        lib.mapAttrsToList (
+          name: specCfg:
+          menuBuilderIsolinux {
+            cfg = specCfg.configuration;
+            label = "${label}-${name}";
+            inherit params;
+          }
+        ) cfg.specialisation
+      )}
+    '';
+
   baseIsolinuxCfg = ''
     SERIAL 0 115200
     TIMEOUT ${builtins.toString syslinuxTimeout}
@@ -107,39 +181,27 @@ let
 
     DEFAULT boot
 
-    LABEL boot
+    ${menuBuilderIsolinux { label = "boot"; }}
-    MENU LABEL ${config.isoImage.prependToMenuLabel}${config.system.nixos.distroName} ${config.system.nixos.label}${config.isoImage.appendToMenuLabel}
-    LINUX /boot/${config.system.boot.loader.kernelFile}
-    APPEND init=${config.system.build.toplevel}/init ${toString config.boot.kernelParams}
-    INITRD /boot/${config.system.boot.loader.initrdFile}
 
-    # A variant to boot with 'nomodeset'
+    MENU BEGIN Options
-    LABEL boot-nomodeset
-    MENU LABEL ${config.isoImage.prependToMenuLabel}${config.system.nixos.distroName} ${config.system.nixos.label}${config.isoImage.appendToMenuLabel} (nomodeset)
-    LINUX /boot/${config.system.boot.loader.kernelFile}
-    APPEND init=${config.system.build.toplevel}/init ${toString config.boot.kernelParams} nomodeset
-    INITRD /boot/${config.system.boot.loader.initrdFile}
 
-    # A variant to boot with 'copytoram'
+    ${lib.concatMapStringsSep "\n" (
-    LABEL boot-copytoram
+      {
-    MENU LABEL ${config.isoImage.prependToMenuLabel}${config.system.nixos.distroName} ${config.system.nixos.label}${config.isoImage.appendToMenuLabel} (copytoram)
+        title,
-    LINUX /boot/${config.system.boot.loader.kernelFile}
+        class,
-    APPEND init=${config.system.build.toplevel}/init ${toString config.boot.kernelParams} copytoram
+        params,
-    INITRD /boot/${config.system.boot.loader.initrdFile}
+      }:
+      ''
+        MENU BEGIN ${title}
+        ${menuBuilderIsolinux {
+          label = "boot-${class}";
+          inherit params;
+        }}
+        MENU END
+      ''
+    ) optionsSubMenus}
 
-    # A variant to boot with verbose logging to the console
+    MENU END
-    LABEL boot-debug
-    MENU LABEL ${config.isoImage.prependToMenuLabel}${config.system.nixos.distroName} ${config.system.nixos.label}${config.isoImage.appendToMenuLabel} (debug)
-    LINUX /boot/${config.system.boot.loader.kernelFile}
-    APPEND init=${config.system.build.toplevel}/init ${toString config.boot.kernelParams} loglevel=7
-    INITRD /boot/${config.system.boot.loader.initrdFile}
-
-    # A variant to boot with a serial console enabled
-    LABEL boot-serial
-    MENU LABEL ${config.isoImage.prependToMenuLabel}${config.system.nixos.distroName} ${config.system.nixos.label}${config.isoImage.appendToMenuLabel} (serial console=ttyS0,115200n8)
-    LINUX /boot/${config.system.boot.loader.kernelFile}
-    APPEND init=${config.system.build.toplevel}/init ${toString config.boot.kernelParams} console=ttyS0,115200n8
-    INITRD /boot/${config.system.boot.loader.initrdFile}
   '';
 
   isolinuxMemtest86Entry = ''
@@ -149,10 +211,12 @@ let
     APPEND ${toString config.boot.loader.grub.memtest86.params}
   '';
 
-  isolinuxCfg = lib.concatStringsSep "\n"
+  isolinuxCfg = lib.concatStringsSep "\n" (
-    ([ baseIsolinuxCfg ] ++ lib.optional config.boot.loader.grub.memtest86.enable isolinuxMemtest86Entry);
+    [ baseIsolinuxCfg ] ++ lib.optional config.boot.loader.grub.memtest86.enable isolinuxMemtest86Entry
+  );
 
-  refindBinary = if targetArch == "x64" || targetArch == "aa64" then "refind_${targetArch}.efi" else null;
+  refindBinary =
+    if targetArch == "x64" || targetArch == "aa64" then "refind_${targetArch}.efi" else null;
 
   # Setup instructions for rEFInd.
   refind =
@@ -162,12 +226,13 @@ let
         cp -v ${pkgs.refind}/share/refind/${refindBinary} $out/EFI/BOOT/
       ''
     else
-      "# No refind for ${targetArch}"
+      "# No refind for ${targetArch}";
-  ;
 
   grubPkgs = if config.boot.loader.grub.forcei686 then pkgs.pkgsi686Linux else pkgs;
 
   grubMenuCfg = ''
+    set textmode=${lib.boolToString (config.isoImage.forceTextMode)}
+
     #
     # Menu configuration
     #
@@ -178,7 +243,8 @@ let
     insmod gfxterm
     insmod png
     set gfxpayload=keep
-    set gfxmode=${lib.concatStringsSep "," [
+    set gfxmode=${
+      lib.concatStringsSep "," [
         # GRUB will use the first valid mode listed here.
         # `auto` will sometimes choose the smallest valid mode it detects.
         # So instead we'll list a lot of possibly valid modes :/
@@ -194,7 +260,8 @@ let
         "800x1280"
         "800x600"
         "auto"
-    ]}
+      ]
+    }
 
     if [ "\$textmode" == "false" ]; then
       terminal_output gfxterm
@@ -207,13 +274,17 @@ let
       set menu_color_highlight=white/blue
     fi
 
-    ${ # When there is a theme configured, use it, otherwise use the background image.
+    ${
-    if config.isoImage.grubTheme != null then ''
+      # When there is a theme configured, use it, otherwise use the background image.
+      if config.isoImage.grubTheme != null then
+        ''
           # Sets theme.
           set theme=(\$root)/EFI/BOOT/grub-theme/theme.txt
           # Load theme fonts
           $(find ${config.isoImage.grubTheme} -iname '*.pf2' -printf "loadfont (\$root)/EFI/BOOT/grub-theme/%P\n")
-    '' else ''
+        ''
+      else
+        ''
           if background_image (\$root)/EFI/BOOT/efi-background.png; then
             # Black background means transparent background when there
             # is a background image set... This seems undocumented :(
@@ -224,6 +295,21 @@ let
             set menu_color_normal=cyan/blue
             set menu_color_highlight=white/blue
           fi
+        ''
+    }
+
+    hiddenentry 'Text mode' --hotkey 't' {
+      loadfont (\$root)/EFI/BOOT/unicode.pf2
+      set textmode=true
+      terminal_output console
+    }
+
+    ${lib.optionalString (config.isoImage.grubTheme != null) ''
+      hiddenentry 'GUI mode' --hotkey 'g' {
+        $(find ${config.isoImage.grubTheme} -iname '*.pf2' -printf "loadfont (\$root)/EFI/BOOT/grub-theme/%P\n")
+        set textmode=false
+        terminal_output gfxterm
+      }
     ''}
   '';
 
@@ -231,10 +317,13 @@ let
   # Notes about grub:
   #  * Yes, the grubMenuCfg has to be repeated in all submenus. Otherwise you
   #    will get white-on-black console-like text on sub-menus. *sigh*
-  efiDir = pkgs.runCommand "efi-directory" {
+  efiDir =
+    pkgs.runCommand "efi-directory"
+      {
         nativeBuildInputs = [ pkgs.buildPackages.grub2_efi ];
         strictDeps = true;
-  } ''
+      }
+      ''
         mkdir -p $out/EFI/BOOT
 
         # Add a marker so GRUB can find the filesystem.
@@ -317,7 +406,6 @@ let
 
         cat <<EOF > $out/EFI/BOOT/grub.cfg
 
-    set textmode=${lib.boolToString (config.isoImage.forceTextMode)}
         set timeout=${toString grubEfiTimeout}
 
         clear
@@ -330,20 +418,6 @@ let
 
         ${grubMenuCfg}
 
-    hiddenentry 'Text mode' --hotkey 't' {
-      loadfont (\$root)/EFI/BOOT/unicode.pf2
-      set textmode=true
-      terminal_output console
-    }
-
-    ${lib.optionalString (config.isoImage.grubTheme != null) ''
-    hiddenentry 'GUI mode' --hotkey 'g' {
-      $(find ${config.isoImage.grubTheme} -iname '*.pf2' -printf "loadfont (\$root)/EFI/BOOT/grub-theme/%P\n")
-      set textmode=false
-      terminal_output gfxterm
-    }
-    ''}
-
         # If the parameter iso_path is set, append the findiso parameter to the kernel
         # line. We need this to allow the nixos iso to be booted from grub directly.
         if [ \''${iso_path} ] ; then
@@ -354,56 +428,23 @@ let
         # Menu entries
         #
 
-    ${buildMenuGrub2}
+        ${buildMenuGrub2 { }}
-    submenu "HiDPI, Quirks and Accessibility" --class hidpi --class submenu {
+        submenu "Options" --class submenu --class hidpi {
           ${grubMenuCfg}
-      submenu "Suggests resolution @720p" --class hidpi-720p {
-        ${grubMenuCfg}
-        ${buildMenuAdditionalParamsGrub2 "video=1280x720@60"}
-      }
-      submenu "Suggests resolution @1080p" --class hidpi-1080p {
-        ${grubMenuCfg}
-        ${buildMenuAdditionalParamsGrub2 "video=1920x1080@60"}
-      }
 
-      # If we boot into a graphical environment where X is autoran
+          ${lib.concatMapStringsSep "\n" (
-      # and always crashes, it makes the media unusable. Allow the user
+            {
-      # to disable this.
+              title,
-      submenu "Disable display-manager" --class quirk-disable-displaymanager {
+              class,
+              params,
+            }:
+            ''
+              submenu "${title}" --class ${class} {
                 ${grubMenuCfg}
-        ${buildMenuAdditionalParamsGrub2 "systemd.mask=display-manager.service"}
+                ${buildMenuGrub2 { inherit params; }}
-      }
-
-      # Some laptop and convertibles have the panel installed in an
-      # inconvenient way, rotated away from the keyboard.
-      # Those entries makes it easier to use the installer.
-      submenu "" {return}
-      submenu "Rotate framebuffer Clockwise" --class rotate-90cw {
-        ${grubMenuCfg}
-        ${buildMenuAdditionalParamsGrub2 "fbcon=rotate:1"}
-      }
-      submenu "Rotate framebuffer Upside-Down" --class rotate-180 {
-        ${grubMenuCfg}
-        ${buildMenuAdditionalParamsGrub2 "fbcon=rotate:2"}
-      }
-      submenu "Rotate framebuffer Counter-Clockwise" --class rotate-90ccw {
-        ${grubMenuCfg}
-        ${buildMenuAdditionalParamsGrub2 "fbcon=rotate:3"}
-      }
-
-      # As a proof of concept, mainly. (Not sure it has accessibility merits.)
-      submenu "" {return}
-      submenu "Use black on white" --class accessibility-blakconwhite {
-        ${grubMenuCfg}
-        ${buildMenuAdditionalParamsGrub2 "vt.default_red=0xFF,0xBC,0x4F,0xB4,0x56,0xBC,0x4F,0x00,0xA1,0xCF,0x84,0xCA,0x8D,0xB4,0x84,0x68 vt.default_grn=0xFF,0x55,0xBA,0xBA,0x4D,0x4D,0xB3,0x00,0xA0,0x8F,0xB3,0xCA,0x88,0x93,0xA4,0x68 vt.default_blu=0xFF,0x58,0x5F,0x58,0xC5,0xBD,0xC5,0x00,0xA8,0xBB,0xAB,0x97,0xBD,0xC7,0xC5,0x68"}
-      }
-
-      # Serial access is a must!
-      submenu "" {return}
-      submenu "Serial console=ttyS0,115200n8" --class serial {
-        ${grubMenuCfg}
-        ${buildMenuAdditionalParamsGrub2 "console=ttyS0,115200n8"}
               }
+            ''
+          ) optionsSubMenus}
         }
 
         ${lib.optionalString (refindBinary != null) ''
@@ -434,8 +475,14 @@ let
         ${refind}
       '';
 
-  efiImg = pkgs.runCommand "efi-image_eltorito" {
+  efiImg =
-    nativeBuildInputs = [ pkgs.buildPackages.mtools pkgs.buildPackages.libfaketime pkgs.buildPackages.dosfstools ];
+    pkgs.runCommand "efi-image_eltorito"
+      {
+        nativeBuildInputs = [
+          pkgs.buildPackages.mtools
+          pkgs.buildPackages.libfaketime
+          pkgs.buildPackages.dosfstools
+        ];
         strictDeps = true;
       }
       # Be careful about determinism: du --apparent-size,
@@ -534,7 +581,9 @@ in
 
     isoImage.volumeID = lib.mkOption {
       # nixos-$EDITION-$RELEASE-$ARCH
-      default = "nixos${lib.optionalString (config.isoImage.edition != "") "-${config.isoImage.edition}"}-${config.system.nixos.release}-${pkgs.stdenv.hostPlatform.uname.processor}";
+      default = "nixos${
+        lib.optionalString (config.isoImage.edition != "") "-${config.isoImage.edition}"
+      }-${config.system.nixos.release}-${pkgs.stdenv.hostPlatform.uname.processor}";
       type = lib.types.str;
       description = ''
         Specifies the label or volume ID of the generated ISO image.
@@ -695,6 +744,19 @@ in
       '';
     };
 
+    isoImage.configurationName = lib.mkOption {
+      default = null;
+      type = lib.types.nullOr lib.types.str;
+      example = "GNOME";
+      description = ''
+        The name of the configuration in the title of the boot entry.
+      '';
+    };
+
+    isoImage.showConfiguration = lib.mkEnableOption "show this configuration in the menu" // {
+      default = true;
+    };
+
     isoImage.forceTextMode = lib.mkOption {
       default = false;
       type = lib.types.bool;
@@ -714,8 +776,7 @@ in
   # store them in lib so we can mkImageMediaOverride the
   # entire file system layout in installation media (only)
   config.lib.isoFileSystems = {
-    "/" = lib.mkImageMediaOverride
+    "/" = lib.mkImageMediaOverride {
-      {
       fsType = "tmpfs";
       options = [ "mode=0755" ];
     };
@@ -723,29 +784,31 @@ in
     # Note that /dev/root is a symlink to the actual root device
     # specified on the kernel command line, created in the stage 1
     # init script.
-    "/iso" = lib.mkImageMediaOverride
+    "/iso" = lib.mkImageMediaOverride {
-      { device = "/dev/root";
+      device = "/dev/root";
       neededForBoot = true;
       noCheck = true;
     };
 
     # In stage 1, mount a tmpfs on top of /nix/store (the squashfs
     # image) to make this a live CD.
-    "/nix/.ro-store" = lib.mkImageMediaOverride
+    "/nix/.ro-store" = lib.mkImageMediaOverride {
-      { fsType = "squashfs";
+      fsType = "squashfs";
       device = "/iso/nix-store.squashfs";
-        options = [ "loop" ] ++ lib.optional (config.boot.kernelPackages.kernel.kernelAtLeast "6.2") "threads=multi";
+      options = [
+        "loop"
+      ] ++ lib.optional (config.boot.kernelPackages.kernel.kernelAtLeast "6.2") "threads=multi";
       neededForBoot = true;
     };
 
-    "/nix/.rw-store" = lib.mkImageMediaOverride
+    "/nix/.rw-store" = lib.mkImageMediaOverride {
-      { fsType = "tmpfs";
+      fsType = "tmpfs";
       options = [ "mode=0755" ];
       neededForBoot = true;
     };
 
-    "/nix/store" = lib.mkImageMediaOverride
+    "/nix/store" = lib.mkImageMediaOverride {
-      { fsType = "overlay";
+      fsType = "overlay";
       device = "overlay";
       options = [
         "lowerdir=/nix/.ro-store"
@@ -771,22 +834,42 @@ in
         assertion = !(lib.stringLength config.isoImage.volumeID > 32);
         # https://wiki.osdev.org/ISO_9660#The_Primary_Volume_Descriptor
         # Volume Identifier can only be 32 bytes
-        message = let
+        message =
+          let
             length = lib.stringLength config.isoImage.volumeID;
             howmany = toString length;
             toomany = toString (length - 32);
           in
           "isoImage.volumeID ${config.isoImage.volumeID} is ${howmany} characters. That is ${toomany} characters longer than the limit of 32.";
       }
+      (
+        let
+          badSpecs = lib.filterAttrs (
+            specName: specCfg: specCfg.configuration.isoImage.volumeID != config.isoImage.volumeID
+          ) config.specialisation;
+        in
+        {
+          assertion = badSpecs == { };
+          message = ''
+            All specialisations must use the same 'isoImage.volumeID'.
+
+            Specialisations with different volumeIDs:
+
+            ${lib.concatMapStringsSep "\n" (specName: ''
+              - ${specName}
+            '') (builtins.attrNames badSpecs)}
+          '';
+        }
+      )
     ];
 
     # Don't build the GRUB menu builder script, since we don't need it
     # here and it causes a cyclic dependency.
     boot.loader.grub.enable = false;
 
-    environment.systemPackages =  [ grubPkgs.grub2 ]
+    environment.systemPackages = [
-      ++ lib.optional (config.isoImage.makeBiosBootable) pkgs.syslinux
+      grubPkgs.grub2
-    ;
+    ] ++ lib.optional (config.isoImage.makeBiosBootable) pkgs.syslinux;
     system.extraDependencies = [ grubPkgs.grub2_efi ];
 
     # In stage 1 of the boot, mount the CD as the root FS by label so
@@ -797,66 +880,99 @@ in
     # UUID of the USB stick.  It would be nicer to write
     # `root=/dev/disk/by-label/...' here, but UNetbootin doesn't
     # recognise that.
-    boot.kernelParams =
+    boot.kernelParams = [
-      [ "root=LABEL=${config.isoImage.volumeID}"
+      "root=LABEL=${config.isoImage.volumeID}"
       "boot.shell_on_fail"
     ];
 
     fileSystems = config.lib.isoFileSystems;
 
-    boot.initrd.availableKernelModules = [ "squashfs" "iso9660" "uas" "overlay" ];
+    boot.initrd.availableKernelModules = [
+      "squashfs"
+      "iso9660"
+      "uas"
+      "overlay"
+    ];
 
-    boot.initrd.kernelModules = [ "loop" "overlay" ];
+    boot.initrd.kernelModules = [
+      "loop"
+      "overlay"
+    ];
 
     # Closures to be copied to the Nix store on the CD, namely the init
     # script and the top-level system configuration directory.
     isoImage.storeContents =
-      [ config.system.build.toplevel ] ++
+      [ config.system.build.toplevel ]
-      lib.optional config.isoImage.includeSystemBuildDependencies
+      ++ lib.optional config.isoImage.includeSystemBuildDependencies config.system.build.toplevel.drvPath;
-        config.system.build.toplevel.drvPath;
 
     # Individual files to be included on the CD, outside of the Nix
     # store on the CD.
     isoImage.contents =
+      let
+        cfgFiles =
+          cfg:
+          lib.optionals cfg.isoImage.showConfiguration ([
+            {
+              source = cfg.boot.kernelPackages.kernel + "/" + cfg.system.boot.loader.kernelFile;
+              target = "/boot/" + cfg.boot.kernelPackages.kernel + "/" + cfg.system.boot.loader.kernelFile;
+            }
+            {
+              source = cfg.system.build.initialRamdisk + "/" + cfg.system.boot.loader.initrdFile;
+              target = "/boot/" + cfg.system.build.initialRamdisk + "/" + cfg.system.boot.loader.initrdFile;
+            }
+          ])
+          ++ lib.concatLists (
+            lib.mapAttrsToList (_: { configuration, ... }: cfgFiles configuration) cfg.specialisation
+          );
+      in
       [
-        { source = config.boot.kernelPackages.kernel + "/" + config.system.boot.loader.kernelFile;
+        {
-          target = "/boot/" + config.system.boot.loader.kernelFile;
+          source = pkgs.writeText "version" config.system.nixos.label;
-        }
-        { source = config.system.build.initialRamdisk + "/" + config.system.boot.loader.initrdFile;
-          target = "/boot/" + config.system.boot.loader.initrdFile;
-        }
-        { source = pkgs.writeText "version" config.system.nixos.label;
           target = "/version.txt";
         }
-      ] ++ lib.optionals (config.isoImage.makeBiosBootable) [
+      ]
-        { source = config.isoImage.splashImage;
+      ++ lib.unique (cfgFiles config)
+      ++ lib.optionals (config.isoImage.makeBiosBootable) [
+        {
+          source = config.isoImage.splashImage;
           target = "/isolinux/background.png";
         }
-        { source = pkgs.writeText "isolinux.cfg" isolinuxCfg;
+        {
+          source = pkgs.writeText "isolinux.cfg" isolinuxCfg;
           target = "/isolinux/isolinux.cfg";
         }
-        { source = "${pkgs.syslinux}/share/syslinux";
+        {
+          source = "${pkgs.syslinux}/share/syslinux";
           target = "/isolinux";
         }
-      ] ++ lib.optionals config.isoImage.makeEfiBootable [
+      ]
-        { source = efiImg;
+      ++ lib.optionals config.isoImage.makeEfiBootable [
+        {
+          source = efiImg;
           target = "/boot/efi.img";
         }
-        { source = "${efiDir}/EFI";
+        {
+          source = "${efiDir}/EFI";
           target = "/EFI";
         }
-        { source = (pkgs.writeTextDir "grub/loopback.cfg" "source /EFI/BOOT/grub.cfg") + "/grub";
+        {
+          source = (pkgs.writeTextDir "grub/loopback.cfg" "source /EFI/BOOT/grub.cfg") + "/grub";
           target = "/boot/grub";
         }
-        { source = config.isoImage.efiSplashImage;
+        {
+          source = config.isoImage.efiSplashImage;
           target = "/EFI/BOOT/efi-background.png";
         }
-      ] ++ lib.optionals (config.boot.loader.grub.memtest86.enable && config.isoImage.makeBiosBootable) [
+      ]
-        { source = "${pkgs.memtest86plus}/memtest.bin";
+      ++ lib.optionals (config.boot.loader.grub.memtest86.enable && config.isoImage.makeBiosBootable) [
+        {
+          source = "${pkgs.memtest86plus}/memtest.bin";
           target = "/boot/memtest.bin";
         }
-      ] ++ lib.optionals (config.isoImage.grubTheme != null) [
+      ]
-        { source = config.isoImage.grubTheme;
+      ++ lib.optionals (config.isoImage.grubTheme != null) [
+        {
+          source = config.isoImage.grubTheme;
           target = "/EFI/BOOT/grub-theme";
         }
       ];
@@ -866,9 +982,12 @@ in
     # Create the ISO image.
     image.extension = if config.isoImage.compressImage then "iso.zst" else "iso";
     image.filePath = "iso/${config.image.fileName}";
-    image.baseName = "nixos${lib.optionalString (config.isoImage.edition != "") "-${config.isoImage.edition}" }-${config.system.nixos.label}-${pkgs.stdenv.hostPlatform.system}";
+    image.baseName = "nixos${
+      lib.optionalString (config.isoImage.edition != "") "-${config.isoImage.edition}"
+    }-${config.system.nixos.label}-${pkgs.stdenv.hostPlatform.system}";
     system.build.image = config.system.build.isoImage;
-    system.build.isoImage = pkgs.callPackage ../../../lib/make-iso9660-image.nix ({
+    system.build.isoImage = pkgs.callPackage ../../../lib/make-iso9660-image.nix (
+      {
         inherit (config.isoImage) compressImage volumeID contents;
         isoName = "${config.image.baseName}.iso";
         bootable = config.isoImage.makeBiosBootable;
@@ -876,16 +995,18 @@ in
         syslinux = if config.isoImage.makeBiosBootable then pkgs.syslinux else null;
         squashfsContents = config.isoImage.storeContents;
         squashfsCompression = config.isoImage.squashfsCompression;
-    } // lib.optionalAttrs (config.isoImage.makeUsbBootable && config.isoImage.makeBiosBootable) {
+      }
+      // lib.optionalAttrs (config.isoImage.makeUsbBootable && config.isoImage.makeBiosBootable) {
         usbBootable = true;
         isohybridMbrImage = "${pkgs.syslinux}/share/syslinux/isohdpfx.bin";
-    } // lib.optionalAttrs config.isoImage.makeEfiBootable {
+      }
+      // lib.optionalAttrs config.isoImage.makeEfiBootable {
         efiBootable = true;
         efiBootImage = "boot/efi.img";
-    });
+      }
+    );
 
-    boot.postBootCommands =
+    boot.postBootCommands = ''
-      ''
       # After booting, register the contents of the Nix store on the
       # CD in the Nix database in the tmpfs.
       ${config.nix.package.out}/bin/nix-store --load-db < /nix/store/nix-path-registration

nixos/modules/installer/cd-dvd/latest-kernel.nix

@@ -0,0 +1,9 @@
+{ lib, pkgs, ... }:
+{
+  boot.kernelPackages = pkgs.linuxPackages_latest;
+  boot.supportedFilesystems.zfs = false;
+  environment.etc."nixos-generate-config.conf".text = ''
+    [Defaults]
+    Kernel=latest
+  '';
+}

nixos/modules/installer/tools/manpages/nixos-generate-config.8

@@ -13,6 +13,7 @@
 .Op Fl -root Ar root
 .Op Fl -dir Ar dir
 .Op Fl -flake
+.Op Fl -kernel Ar <lts|latest>
 .
 .
 .
@@ -66,6 +67,9 @@ instead of
 .Pa /etc/nixos Ns
 \&.
 .
+.It Fl -kernel Ar <lts|latest>
+Set the kernel in the generated configuration file.
+.
 .It Fl -force
 Overwrite
 .Pa /etc/nixos/configuration.nix

nixos/modules/installer/tools/nixos-generate-config.pl

@@ -7,6 +7,7 @@ use File::Path;
 use File::Basename;
 use File::Slurp;
 use File::stat;
+use Config::IniFiles;
 
 umask(0022);
 
@@ -37,6 +38,14 @@ my $force = 0;
 my $noFilesystems = 0;
 my $flake = 0;
 my $showHardwareConfig = 0;
+my $kernel = "lts";
+
+if (-e "/etc/nixos-generate-config.conf") {
+    my $cfg = new Config::IniFiles -file => "/etc/nixos-generate-config.conf";
+    $outDir = $cfg->val("Defaults", "Directory") // $outDir;
+    $rootDir = $cfg->val("Defaults", "RootDirectory") // $rootDir;
+    $kernel = $cfg->val("Defaults", "Kernel") // $kernel;
+}
 
 for (my $n = 0; $n < scalar @ARGV; $n++) {
     my $arg = $ARGV[$n];
@@ -53,8 +62,6 @@ for (my $n = 0; $n < scalar @ARGV; $n++) {
         $rootDir = $ARGV[$n];
         die "$0: ‘--root’ requires an argument\n" unless defined $rootDir;
         die "$0: no need to specify `/` with `--root`, it is the default\n" if $rootDir eq "/";
-        $rootDir =~ s/\/*$//; # remove trailing slashes
-        $rootDir = File::Spec->rel2abs($rootDir); # resolve absolute path
     }
     elsif ($arg eq "--force") {
         $force = 1;
@@ -68,11 +75,19 @@ for (my $n = 0; $n < scalar @ARGV; $n++) {
     elsif ($arg eq "--flake") {
         $flake = 1;
     }
+    elsif ($arg eq "--kernel") {
+        $n++;
+        $kernel = $ARGV[$n];
+        die "$0: ‘--kernel’ requires an argument\n" unless defined $kernel;
+    }
     else {
         die "$0: unrecognized argument ‘$arg’\n";
     }
 }
 
+$rootDir =~ s/\/*$//; # remove trailing slashes
+$rootDir = File::Spec->rel2abs($rootDir); # resolve absolute path
+die "$0: invalid kernel: '$kernel'" unless $kernel eq "lts" || $kernel eq "latest";
 
 my @attrs = ();
 my @kernelModules = ();
@@ -709,6 +724,14 @@ EOF
 EOF
         }
 
+        if ($kernel eq "latest") {
+            $bootLoaderConfig .= <<EOF;
+
+  # Use latest kernel.
+  boot.kernelPackages = pkgs.linuxPackages_latest;
+EOF
+        }
+
         my $networkingDhcpConfig = generateNetworkingDhcpConfig();
 
         my $xserverConfig = generateXserverConfig();

nixos/modules/installer/tools/tools.nix

@@ -1,10 +1,20 @@
 # This module generates nixos-install, nixos-rebuild,
 # nixos-generate-config, etc.
 
-{ config, lib, pkgs, options, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  options,
+  ...
+}:
 
 let
-  makeProg = args: pkgs.replaceVarsWith (args // {
+  makeProg =
+    args:
+    pkgs.replaceVarsWith (
+      args
+      // {
         dir = "bin";
         isExecutable = true;
         nativeBuildInputs = [
@@ -13,13 +23,19 @@ let
         postInstall = ''
           installManPage ${args.manPage}
         '';
-  });
+      }
+    );
 
   nixos-generate-config = makeProg {
     name = "nixos-generate-config";
     src = ./nixos-generate-config.pl;
     replacements = {
-      perl = "${pkgs.perl.withPackages (p: [ p.FileSlurp ])}/bin/perl";
+      perl = "${
+        pkgs.perl.withPackages (p: [
+          p.FileSlurp
+          p.ConfigIniFiles
+        ])
+      }/bin/perl";
       hostPlatformSystem = pkgs.stdenv.hostPlatform.system;
       detectvirt = "${config.systemd.package}/bin/systemd-detect-virt";
       btrfs = "${pkgs.btrfs-progs}/bin/btrfs";
@@ -36,13 +52,17 @@ let
       inherit (pkgs) runtimeShell;
       inherit (config.system.nixos) version codeName revision;
       inherit (config.system) configurationRevision;
-      json = builtins.toJSON ({
+      json = builtins.toJSON (
+        {
           nixosVersion = config.system.nixos.version;
-      } // lib.optionalAttrs (config.system.nixos.revision != null) {
+        }
+        // lib.optionalAttrs (config.system.nixos.revision != null) {
           nixpkgsRevision = config.system.nixos.revision;
-      } // lib.optionalAttrs (config.system.configurationRevision != null) {
+        }
+        // lib.optionalAttrs (config.system.configurationRevision != null) {
           configurationRevision = config.system.configurationRevision;
-      });
+        }
+      );
     };
     manPage = ./manpages/nixos-version.8;
   };
@@ -266,10 +286,17 @@ in
     '';
   };
 
-  imports = let
+  imports =
-    mkToolModule = { name, package ? pkgs.${name} }: { config, ... }: {
+    let
+      mkToolModule =
+        {
+          name,
+          package ? pkgs.${name},
+        }:
+        { config, ... }:
+        {
           options.system.tools.${name}.enable = lib.mkEnableOption "${name} script" // {
-        default = config.nix.enable && ! config.system.disableInstallerTools;
+            default = config.nix.enable && !config.system.disableInstallerTools;
             defaultText = "config.nix.enable && !config.system.disableInstallerTools";
           };
 
@@ -277,14 +304,27 @@ in
             environment.systemPackages = [ package ];
           };
         };
-  in [
+    in
+    [
       (mkToolModule { name = "nixos-build-vms"; })
       (mkToolModule { name = "nixos-enter"; })
-    (mkToolModule { name = "nixos-generate-config"; package = config.system.build.nixos-generate-config; })
+      (mkToolModule {
-    (mkToolModule { name = "nixos-install"; package = config.system.build.nixos-install; })
+        name = "nixos-generate-config";
+        package = config.system.build.nixos-generate-config;
+      })
+      (mkToolModule {
+        name = "nixos-install";
+        package = config.system.build.nixos-install;
+      })
       (mkToolModule { name = "nixos-option"; })
-    (mkToolModule { name = "nixos-rebuild"; package = config.system.build.nixos-rebuild; })
+      (mkToolModule {
-    (mkToolModule { name = "nixos-version"; package = nixos-version; })
+        name = "nixos-rebuild";
+        package = config.system.build.nixos-rebuild;
+      })
+      (mkToolModule {
+        name = "nixos-version";
+        package = nixos-version;
+      })
     ];
 
   config = {
@@ -293,10 +333,7 @@ in
     # These may be used in auxiliary scripts (ie not part of toplevel), so they are defined unconditionally.
     system.build = {
       inherit nixos-generate-config nixos-install;
-      nixos-rebuild =
+      nixos-rebuild = if config.system.rebuild.enableNg then nixos-rebuild-ng else nixos-rebuild;
-        if config.system.rebuild.enableNg
-          then nixos-rebuild-ng
-          else nixos-rebuild;
       nixos-option = lib.warn "Accessing nixos-option through `config.system.build` is deprecated, use `pkgs.nixos-option` instead." pkgs.nixos-option;
       nixos-enter = lib.warn "Accessing nixos-enter through `config.system.build` is deprecated, use `pkgs.nixos-enter` instead." pkgs.nixos-enter;
     };

nixos/modules/profiles/base.nix

@@ -1,7 +1,12 @@
 # This module defines the software packages included in the "minimal"
 # installation CD. It might be useful elsewhere.
 
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 
 {
   # Include some utilities that are useful for installing or repairing
@@ -43,9 +48,19 @@
   ];
 
   # Include support for various filesystems and tools to create / manipulate them.
-  boot.supportedFilesystems =
+  boot.supportedFilesystems = lib.mkMerge [
-    [ "btrfs" "cifs" "f2fs" "ntfs" "vfat" "xfs" ] ++
+    [
-    lib.optional (lib.meta.availableOn pkgs.stdenv.hostPlatform config.boot.zfs.package) "zfs";
+      "btrfs"
+      "cifs"
+      "f2fs"
+      "ntfs"
+      "vfat"
+      "xfs"
+    ]
+    (lib.mkIf (lib.meta.availableOn pkgs.stdenv.hostPlatform config.boot.zfs.package) {
+      zfs = lib.mkDefault true;
+    })
+  ];
 
   # Configure host id for ZFS to work
   networking.hostId = lib.mkDefault "8425e349";

nixos/release-combined.nix

@@ -71,8 +71,7 @@ rec {
         (onFullSupported "nixos.dummy")
         (onAllSupported "nixos.iso_minimal")
         (onSystems [ "x86_64-linux" "aarch64-linux" ] "nixos.amazonImage")
-        (onFullSupported "nixos.iso_plasma6")
+        (onFullSupported "nixos.iso_graphical")
-        (onFullSupported "nixos.iso_gnome")
         (onFullSupported "nixos.manual")
         (onSystems [ "aarch64-linux" ] "nixos.sd_image")
         (onFullSupported "nixos.tests.acme.http01-builtin")

nixos/release.nix

@@ -164,42 +164,14 @@ in rec {
   });
 
   iso_minimal = forAllSystems (system: makeIso {
-    module = ./modules/installer/cd-dvd/installation-cd-minimal.nix;
+    module = ./modules/installer/cd-dvd/installation-cd-minimal-combined.nix;
     type = "minimal";
     inherit system;
   });
 
-  iso_plasma5 = forMatchingSystems supportedSystems (system: makeIso {
+  iso_graphical = forAllSystems (system: makeIso {
-    module = ./modules/installer/cd-dvd/installation-cd-graphical-calamares-plasma5.nix;
+    module = ./modules/installer/cd-dvd/installation-cd-graphical-combined.nix;
-    type = "plasma5";
+    type = "graphical";
-    inherit system;
-  });
-
-  iso_plasma6 = forMatchingSystems supportedSystems (system: makeIso {
-    module = ./modules/installer/cd-dvd/installation-cd-graphical-calamares-plasma6.nix;
-    type = "plasma6";
-    inherit system;
-  });
-
-  iso_gnome = forMatchingSystems supportedSystems (system: makeIso {
-    module = ./modules/installer/cd-dvd/installation-cd-graphical-calamares-gnome.nix;
-    type = "gnome";
-    inherit system;
-  });
-
-  # A variant with a more recent (but possibly less stable) kernel that might support more hardware.
-  # This variant keeps zfs support enabled, hoping it will build and work.
-  iso_minimal_new_kernel = forMatchingSystems [ "x86_64-linux" "aarch64-linux" ] (system: makeIso {
-    module = ./modules/installer/cd-dvd/installation-cd-minimal-new-kernel.nix;
-    type = "minimal-new-kernel";
-    inherit system;
-  });
-
-  # A variant with a more recent (but possibly less stable) kernel that might support more hardware.
-  # ZFS support disabled since it is unlikely to support the latest kernel.
-  iso_minimal_new_kernel_no_zfs = forMatchingSystems [ "x86_64-linux" "aarch64-linux" ] (system: makeIso {
-    module = ./modules/installer/cd-dvd/installation-cd-minimal-new-kernel-no-zfs.nix;
-    type = "minimal-new-kernel-no-zfs";
     inherit system;
   });
 

pkgs/applications/editors/vscode/extensions/tekumara.typos-vscode/default.nix

@@ -13,19 +13,19 @@ let
     {
       x86_64-linux = {
         arch = "linux-x64";
-        hash = "sha256-NdVSQQ5OeBPGSLbynUArNbfm+a2HCc/gwJMKfEDgzDM=";
+        hash = "sha256-M3m3fFsz/LPSmghyKVuLVcMgxtUf3iNvHDLjOptfs6I=";
       };
       aarch64-linux = {
         arch = "linux-arm64";
-        hash = "sha256-4FjA3mUz+DVBiMUJAlGkUbpDtZuDYuUHPWA4QUiqd5w=";
+        hash = "sha256-S3mMOtXYdVp5P8aKlzWyehVKCz7EjcNjYJqgSsNIS3g=";
       };
       x86_64-darwin = {
         arch = "darwin-x64";
-        hash = "sha256-aexe9hrUxb3ZnrgJrvEXu2PZPmxOGdkk9exrfDaXA7s=";
+        hash = "sha256-lIUM5W+lKL7OgcJVWJTJYsZNqpZ3MhSk7YnKsfWDX4U=";
       };
       aarch64-darwin = {
         arch = "darwin-arm64";
-        hash = "sha256-ijmKU+eU3R3mxeFxFr5AtVwGYVBuYWecD8W+0gHzP5w=";
+        hash = "sha256-Lc2W1SNdn1rcxeKgv1YzKRr+DPN39C1J6O1KZBeELWc=";
       };
     }
     .${system} or (throw "Unsupported system: ${system}");
@@ -37,7 +37,7 @@ vscode-utils.buildVscodeMarketplaceExtension {
     # Please update the corresponding binary (typos-lsp)
     # when updating this extension.
     # See pkgs/by-name/ty/typos-lsp/package.nix
-    version = "0.1.26";
+    version = "0.1.35";
     inherit (extInfo) hash arch;
   };
 

pkgs/applications/editors/vscode/vscodium.nix

@@ -26,11 +26,11 @@ let
 
   hash =
     {
-      x86_64-linux = "sha256-+RHzGJ5Y6j93ojnqg9hSe+Zs0sewcSSfWu8qlxJEoWQ=";
+      x86_64-linux = "sha256-vzLyLOC/4SDlIrsbVKDXu42nx7QLgK7TWkzKC1/tSQo=";
-      x86_64-darwin = "sha256-Yaxb7cB/JADJ4i2PScYb9ovTKiClwd7TdQXbzg9ViSs=";
+      x86_64-darwin = "sha256-dLCepFyTht6hzdm1jZbhFKt6yNIbCZWlpxAkSfE9Fww=";
-      aarch64-linux = "sha256-CK4geEBeLc1M5z4wuRS3rrqsL9nG1ra5+e3PGEOrYHA=";
+      aarch64-linux = "sha256-Hiqrw6f7SWzdPQCV0s1d+cWwQ2u4PVDY8saL1Q+mZQg=";
-      aarch64-darwin = "sha256-S1XYikl1FzHvGBcudSD2xyuOH4gfsrYyEfwzL/csfSE=";
+      aarch64-darwin = "sha256-zy+oI6MEHpxF8vOnE9EdjVm3LBAfgMas593hAJsWNz4=";
-      armv7l-linux = "sha256-aAgCL6clX/lXWdBmCSin/60krW5Sbn2KZZovmS16CfI=";
+      armv7l-linux = "sha256-Z0qnKm+axJTAHq8E69wYWpZOF9FuFRkdJmap4rFhbTY=";
     }
     .${system} or throwSystem;
 
@@ -41,7 +41,7 @@ callPackage ./generic.nix rec {
 
   # Please backport all compatible updates to the stable release.
   # This is important for the extension ecosystem.
-  version = "1.98.1.25070";
+  version = "1.98.2.25072";
   pname = "vscodium";
 
   executableName = "codium";

pkgs/applications/virtualization/cri-o/default.nix

@@ -17,13 +17,13 @@
 
 buildGoModule rec {
   pname = "cri-o";
-  version = "1.32.0";
+  version = "1.32.2";
 
   src = fetchFromGitHub {
     owner = "cri-o";
     repo = "cri-o";
     rev = "v${version}";
-    hash = "sha256-bjZjmgIYFroyUdBeUbrRz7dD0yQOqc9TDsGxvle1PnE=";
+    hash = "sha256-oB3X59+v4VosY5Db0BUfKt/WTMCWhhJX+mWwp/6ifVI=";
   };
   vendorHash = null;
 

pkgs/by-name/aw/awscli2/package.nix

@@ -64,14 +64,14 @@ let
 in
 py.pkgs.buildPythonApplication rec {
   pname = "awscli2";
-  version = "2.24.22"; # N.B: if you change this, check if overrides are still up-to-date
+  version = "2.24.24"; # N.B: if you change this, check if overrides are still up-to-date
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = "aws-cli";
     tag = version;
-    hash = "sha256-cqDBUwc9E9TPN5E4CaCxc5sAZgCXalgl2ejGftyzV1k=";
+    hash = "sha256-v2SdbWE+pxDFEtbwDd3sdVvLWGyeNm+9pKlTzqbgJFU=";
   };
 
   postPatch = ''

pkgs/by-name/bu/buffybox/package.nix

@@ -15,15 +15,15 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "buffybox";
-  version = "3.2.0-unstable-2025-02-27";
+  version = "3.2.0-unstable-2025-03-12";
 
   src = fetchFromGitLab {
     domain = "gitlab.postmarketos.org";
     owner = "postmarketOS";
     repo = "buffybox";
     fetchSubmodules = true; # to use its vendored lvgl
-    rev = "6bf7a8406f3a3fa79831d2d151e519b703b9e135";
+    rev = "3196e47d519c78b56a8d4b75ad7a280c92c91d23";
-    hash = "sha256-q3TNYRv5Cim+WklXw2ZTW6Ico1h8Xxs9MhTFhHZUMW0=";
+    hash = "sha256-Zl/QmOJbY/lxoCYD6SpUHiiTTDOStUSn3+6xOuiGGBo=";
   };
 
   depsBuildBuild = [

pkgs/by-name/cf/cfonts/package.nix

@@ -5,15 +5,15 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "cfonts";
-  version = "1.1.3";
+  version = "1.2.0";
 
   src = fetchCrate {
     inherit pname version;
-    hash = "sha256-ixxDlHjx5Bi6Wl/kzJ/R7d+jgTDCAti25TV1RlXRPus=";
+    hash = "sha256-W5hN+b4R50tNfYb3WrM0z5Etm6ixa11pZWnzGC9bjSs=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-eJM3CS3I++p6Pk/K8vkD/H/RAmD+eQJ+//It/Jn5dX4=";
+  cargoHash = "sha256-MXUUvk7R1JdjNlZ7h3ymUAPOT/A0I8TOW3saBB4C94o=";
 
   meta = with lib; {
     homepage = "https://github.com/dominikwilkowski/cfonts";

pkgs/by-name/cl/claude-code/package-lock.json

@@ -5,13 +5,13 @@
   "packages": {
     "": {
       "dependencies": {
-        "@anthropic-ai/claude-code": "^0.2.41"
+        "@anthropic-ai/claude-code": "^0.2.45"
       }
     },
     "node_modules/@anthropic-ai/claude-code": {
-      "version": "0.2.41",
+      "version": "0.2.45",
-      "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-0.2.41.tgz",
+      "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-0.2.45.tgz",
-      "integrity": "sha512-tbzmDPsD+WQ/KnA92kKpxb3/PEYk1FDbpIMvbzXFuXDONXW66o4seTl4JcpBVtb9zk5wv6srTlB7M9Nn7Tel1A==",
+      "integrity": "sha512-r8uSA59wuNUHjlU+snwkZBHGsuv7z5+sxDFhLxI+1wz6PU9CU2/V37k26c7YpN9OFfeRmt9hk7gb3KaIlTH2ZA==",
       "hasInstallScript": true,
       "license": "SEE LICENSE IN README.md",
       "bin": {

pkgs/by-name/cl/claude-code/package.nix

@@ -6,14 +6,14 @@
 
 buildNpmPackage rec {
   pname = "claude-code";
-  version = "0.2.41";
+  version = "0.2.45";
 
   src = fetchzip {
     url = "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-${version}.tgz";
-    hash = "sha256-HxPdULdggaFeNkRnrqIU2Y7HC6F8UdqRLTl8QiLV8wg=";
+    hash = "sha256-N0ZJ+DxjT4Xtmd+zE/AXJTaj8c+RnR4umepgWUTh2XE=";
   };
 
-  npmDepsHash = "sha256-VcB39pBEVF0PFOPDZVS6FH2UpSrIATjGueoZAxb33DA=";
+  npmDepsHash = "sha256-agHCUnVCyqOF85x5tECPlQnV5wNmzIo5gipnVVMKnZE=";
 
   postPatch = ''
     cp ${./package-lock.json} package-lock.json

pkgs/by-name/co/cosmic-settings/package.nix

@@ -1,60 +1,69 @@
 {
   lib,
   stdenv,
+  stdenvAdapters,
   fetchFromGitHub,
   rustPlatform,
   cmake,
-  makeBinaryWrapper,
-  cosmic-icons,
-  cosmic-randr,
   just,
+  libcosmicAppHook,
   pkg-config,
-  libxkbcommon,
+  expat,
   libinput,
   fontconfig,
   freetype,
-  wayland,
+  pipewire,
-  expat,
+  pulseaudio,
   udev,
   util-linux,
-}:
+  cosmic-randr,
+  xkeyboard_config,
+  nix-update-script,
 
-rustPlatform.buildRustPackage rec {
+  withMoldLinker ? stdenv.targetPlatform.isLinux,
+}:
+let
+  libcosmicAppHook' = (libcosmicAppHook.__spliced.buildHost or libcosmicAppHook).override {
+    includeSettings = false;
+  };
+in
+rustPlatform.buildRustPackage.override
+  { stdenv = if withMoldLinker then stdenvAdapters.useMoldLinker stdenv else stdenv; }
+  (finalAttrs: {
     pname = "cosmic-settings";
-  version = "1.0.0-alpha.1";
+    version = "1.0.0-alpha.6";
 
     src = fetchFromGitHub {
       owner = "pop-os";
       repo = "cosmic-settings";
-    rev = "epoch-${version}";
+      tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-gTzZvhj7oBuL23dtedqfxUCT413eMoDc0rlNeqCeZ6E=";
+      hash = "sha256-UKg3TIpyaqtynk6wLFFPpv69F74hmqfMVPra2+iFbvE=";
     };
 
     useFetchCargoVendor = true;
-  cargoHash = "sha256-zMHJc6ytbOoi9E47Zsg6zhbQKObsaOtVHuPnLAu36I4=";
+    cargoHash = "sha256-mf/Cw3/RLrCYgsk7JKCU2+oPn1VPbD+4JzkUmbd47m8=";
-
-  postPatch = ''
-    substituteInPlace justfile --replace '#!/usr/bin/env' "#!$(command -v env)"
-  '';
 
     nativeBuildInputs = [
       cmake
       just
+      libcosmicAppHook'
       pkg-config
-    makeBinaryWrapper
+      rustPlatform.bindgenHook
-  ];
-  buildInputs = [
-    libxkbcommon
-    libinput
-    fontconfig
-    freetype
-    wayland
-    expat
-    udev
       util-linux
     ];
 
+    buildInputs = [
+      expat
+      fontconfig
+      freetype
+      libinput
+      pipewire
+      pulseaudio
+      udev
+    ];
+
     dontUseJustBuild = true;
+    dontUseJustCheck = true;
 
     justFlags = [
       "--set"
@@ -65,18 +74,35 @@ rustPlatform.buildRustPackage rec {
       "target/${stdenv.hostPlatform.rust.cargoShortTarget}/release/cosmic-settings"
     ];
 
-  postInstall = ''
+    env."CARGO_TARGET_${stdenv.hostPlatform.rust.cargoEnvVarTarget}_RUSTFLAGS" =
-    wrapProgram "$out/bin/cosmic-settings" \
+      lib.optionalString withMoldLinker "-C link-arg=-fuse-ld=mold";
-      --prefix PATH : ${lib.makeBinPath [ cosmic-randr ]} \
+
-      --suffix XDG_DATA_DIRS : "$out/share:${cosmic-icons}/share"
+    preFixup = ''
+      libcosmicAppWrapperArgs+=(
+        --prefix PATH : ${lib.makeBinPath [ cosmic-randr ]}
+        --set-default X11_BASE_RULES_XML ${xkeyboard_config}/share/X11/xkb/rules/base.xml
+        --set-default X11_BASE_EXTRA_RULES_XML ${xkeyboard_config}/share/X11/xkb/rules/extra.xml
+      )
     '';
 
-  meta = with lib; {
+    passthru.updateScript = nix-update-script {
-    homepage = "https://github.com/pop-os/cosmic-settings";
+      extraArgs = [
-    description = "Settings for the COSMIC Desktop Environment";
+        "--version"
-    license = licenses.gpl3Only;
+        "unstable"
-    maintainers = with maintainers; [ nyabinary ];
+        "--version-regex"
-    platforms = platforms.linux;
+        "epoch-(.*)"
-    mainProgram = "cosmic-settings";
+      ];
     };
-}
+
+    meta = {
+      description = "Settings for the COSMIC Desktop Environment";
+      homepage = "https://github.com/pop-os/cosmic-settings";
+      license = lib.licenses.gpl3Only;
+      mainProgram = "cosmic-settings";
+      maintainers = with lib.maintainers; [
+        nyabinary
+        HeitorAugustoLN
+      ];
+      platforms = lib.platforms.linux;
+    };
+  })

pkgs/by-name/ht/httplib/package.nix

@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "httplib";
-  version = "0.18.5";
+  version = "0.19.0";
 
   src = fetchFromGitHub {
     owner = "yhirose";
     repo = "cpp-httplib";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-d5b6WsqR9oTiWq9wED+7Ts0kjURutxAJVXbm1okNg8k=";
+    hash = "sha256-OLwD7mpwqG7BUugUca+CJpPMaabJzUMC0zYzJK9PBCg=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/by-name/le/lefthook/package.nix

@@ -7,7 +7,7 @@
 
 let
   pname = "lefthook";
-  version = "1.10.11";
+  version = "1.11.2";
 in
 buildGoModule {
   inherit pname version;
@@ -16,7 +16,7 @@ buildGoModule {
     owner = "evilmartians";
     repo = "lefthook";
     rev = "v${version}";
-    hash = "sha256-Ys9tvewWANpCgZsUtFlF8+Z+gKpH21iU3c9y61GY+NM=";
+    hash = "sha256-kh1U3w39C+6UewKRyKQc4EBgQmBNP7Ou8V54CeG5hlQ=";
   };
 
   vendorHash = "sha256-uvPpkSqfe1NvO78kIMo5cYdr87YTGozudeESmI0q+1E=";

pkgs/by-name/ma/mako/package.nix

@@ -20,13 +20,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "mako";
-  version = "1.9.0";
+  version = "1.10.0";
 
   src = fetchFromGitHub {
     owner = "emersion";
     repo = "mako";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-QtYtondP7E5QXLRnmcaOQlAm9fKXctfjxeUFqK6FnnE=";
+    hash = "sha256-O93KOXonfkgIKtlIZP4YlsEgXBcupNifoC/cN+ZAYEM=";
   };
 
   strictDeps = true;

pkgs/by-name/ma/manta/package.nix

@@ -1,37 +0,0 @@
-{ lib, stdenv, fetchFromGitHub, cmake, zlib, python2 }:
-
-stdenv.mkDerivation rec {
-  pname = "manta";
-  version = "1.6.0";
-
-  src = fetchFromGitHub {
-    owner = "Illumina";
-    repo = "manta";
-    rev = "v${version}";
-    sha256 = "1711xkcw8rpw9xv3bbm7v1aryjz4r341rkq5255192dg38sgq7w2";
-  };
-
-  nativeBuildInputs = [ cmake ];
-  buildInputs = [ zlib python2 ];
-  postFixup = ''
-    sed -i 's|/usr/bin/env python2|${python2.interpreter}|' $out/lib/python/makeRunScript.py
-    sed -i 's|/usr/bin/env python|${python2.interpreter}|' $out/lib/python/pyflow/pyflow.py
-    sed -i 's|/bin/bash|${stdenv.shell}|' $out/lib/python/pyflow/pyflowTaskWrapper.py
-  '';
-  doInstallCheck = true;
-  installCheckPhase = ''
-    rm $out/lib/python/**/*.pyc
-    PYTHONPATH=$out/lib/python:$PYTHONPATH python -c 'import makeRunScript'
-    PYTHONPATH=$out/lib/python/pyflow:$PYTHONPATH python -c 'import pyflowTaskWrapper; import pyflow'
-  '';
-
-  env.NIX_CFLAGS_COMPILE = "-Wno-error=array-bounds";
-
-  meta = with lib; {
-    description = "Structural variant caller";
-    license = licenses.gpl3;
-    homepage = "https://github.com/Illumina/manta";
-    maintainers = with maintainers; [ jbedo ];
-    platforms =  platforms.x86_64;
-  };
-}

pkgs/by-name/nf/nftrace/package.nix

@@ -0,0 +1,39 @@
+{
+  buildGoModule,
+  fetchFromGitHub,
+  lib,
+  nix-update-script,
+  versionCheckHook,
+}:
+
+buildGoModule rec {
+  pname = "nftrace";
+  version = "0.1.0";
+
+  src = fetchFromGitHub {
+    owner = "aojea";
+    repo = "nftrace";
+    tag = "v${version}";
+    hash = "sha256-MTLl3XLDIjcK5GymW7D3B8+/A6W+kQ4cz5bbrfo6fQc=";
+  };
+
+  vendorHash = "sha256-UrsvUMdLWGX2QRFLxBLvMW1B5vZdcWI/lpyKiNAtA2o=";
+
+  ldflags = [
+    "-s"
+    "-w"
+  ];
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Commodity tool to use nftables trace functionality";
+    homepage = "https://github.com/aojea/nftrace";
+    changelog = "https://github.com/aojea/nftrace/releases/tag/v${version}";
+    license = lib.licenses.asl20;
+    maintainers = [ lib.maintainers.jmbaur ];
+    mainProgram = "nftrace";
+  };
+}

pkgs/by-name/re/reindeer/package.nix

@@ -9,17 +9,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "reindeer";
-  version = "2025.02.24.00";
+  version = "2025.03.10.00";
 
   src = fetchFromGitHub {
     owner = "facebookincubator";
     repo = "reindeer";
     tag = "v${version}";
-    hash = "sha256-+uiVUEaBDO7c2QYo0NcCy9Ms+wz+09p6kD0muRAvOlo=";
+    hash = "sha256-yE1ARmsEbuG9OskipZfPKbA0c/4VBVBFHFEiy5nzwXg=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-G+NAljFX0R73+sj30KHHkU78AfQCg7e3PM5oOB9iTbE=";
+  cargoHash = "sha256-VU0mLaQ8pWQw/pFTB35/ZOKUnqEVEO9f1IKZ0gAmqj8=";
 
   nativeBuildInputs = [ pkg-config ];
 

pkgs/by-name/st/stu/package.nix

@@ -8,17 +8,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "stu";
-  version = "0.6.6";
+  version = "0.7.0";
 
   src = fetchFromGitHub {
     owner = "lusingander";
     repo = "stu";
     rev = "v${version}";
-    hash = "sha256-an/FNDwtP8EKPwuhu/Dkqj5hZym6wpySEfr66C21pvw=";
+    hash = "sha256-gZaSSKlKTtOb/zxVwj0PFk1BqDDswyKv+fIHDn/4n3I=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-BrRy0jTDA6SEikoQOzajBMKOPwK6AQRdehlK5rBZTgw=";
+  cargoHash = "sha256-hi3plLDMMft9jEo9whZrSBvZjLjezeWRmocQF0MlsfY=";
 
   passthru.tests.version = testers.testVersion { package = stu; };
 

pkgs/by-name/sy/syshud/package.nix

@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "syshud";
-  version = "0-unstable-2025-01-13";
+  version = "0-unstable-2025-03-11";
 
   src = fetchFromGitHub {
     owner = "System64fumo";
     repo = "syshud";
-    rev = "ca5c05145d440c7e96a3521af327da91bb1ac539";
+    rev = "6a90edad20437a1d933937a44a4e3553caeb248f";
-    hash = "sha256-mglmmIZz1bbRT15/Xr1vrYBy+PVgIaKpjRfAAFT5OcQ=";
+    hash = "sha256-Lmv75OaPOK+NxDe+7Xgf/NDvyms+zXn8tYThQJRxf9k=";
   };
 
   postPatch = ''

pkgs/by-name/te/terragrunt/package.nix

@@ -1,19 +1,23 @@
 {
   lib,
-  buildGoModule,
+  # Breaks with go 1.24 (see https://github.com/gruntwork-io/terragrunt/issues/4031)
+  # > 2025/03/17 13:30:44 internal error: package "bufio" without types was imported from "github.com/gruntwork-io/terragrunt/tf/getproviders"
+  # > tf/getproviders/lock.go:1: running "mockery": exit status 1
+  # > make: *** [Makefile:54: generate-mocks] Error 1
+  buildGo123Module,
   fetchFromGitHub,
   go-mockery,
 }:
 
-buildGoModule rec {
+buildGo123Module rec {
   pname = "terragrunt";
-  version = "0.73.15";
+  version = "0.75.10";
 
   src = fetchFromGitHub {
     owner = "gruntwork-io";
     repo = pname;
     tag = "v${version}";
-    hash = "sha256-ISo6r+mMuXiGTIALXA5+xCKNOzNTNFz8cdGtbWyQRNI=";
+    hash = "sha256-lnp1prffufVOG+XV7UAo9Rh3ALE//b87ioPgimgZ5S0=";
   };
 
   nativeBuildInputs = [ go-mockery ];
@@ -22,7 +26,7 @@ buildGoModule rec {
     make generate-mocks
   '';
 
-  vendorHash = "sha256-EO3zgqVqf994xB55twRmcGBQdffrNr2BejNq2jlkMSA=";
+  vendorHash = "sha256-UhOb1Djup9Cwrv9vYeD/DZe20dwSKYRpJa4V3ZCsPwQ=";
 
   doCheck = false;
 

pkgs/by-name/tw/twilio-cli/package.nix

@@ -8,11 +8,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "twilio-cli";
-  version = "5.22.11";
+  version = "5.23.0";
 
   src = fetchzip {
     url = "https://twilio-cli-prod.s3.amazonaws.com/twilio-v${finalAttrs.version}/twilio-v${finalAttrs.version}.tar.gz";
-    hash = "sha256-SeSv16lZ2Dmfngkq1TtvzlM3oIJkVPsdnkc1hRuSZU4=";
+    hash = "sha256-LTaQFRoXRBLPLWvyqwMbQc0OOC+wT+taLm78GL2mWBQ=";
   };
 
   buildInputs = [ nodejs-slim ];

pkgs/by-name/ty/typos-lsp/package.nix

@@ -6,17 +6,17 @@ rustPlatform.buildRustPackage rec {
   pname = "typos-lsp";
   # Please update the corresponding VSCode extension too.
   # See pkgs/applications/editors/vscode/extensions/tekumara.typos-vscode/default.nix
-  version = "0.1.34";
+  version = "0.1.35";
 
   src = fetchFromGitHub {
     owner = "tekumara";
     repo = "typos-lsp";
     tag = "v${version}";
-    hash = "sha256-WqICNpheCJJAmmbj5QIejFeUIW/7ghrhQRP73PLLMJ4=";
+    hash = "sha256-5B4xWYJJ2KQLxzRQf0EKakGuB0LLOg023AIt8G3uAew=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-tmBRUoBsNQlJY0JYtDknD5xeeFnokTE9cnHzktMIiBU=";
+  cargoHash = "sha256-Es/CdtyRtBghAeRoi5WrS0sdkm5flRlp3KXLs/nJ6UU=";
 
   # fix for compilation on aarch64
   # see https://github.com/NixOS/nixpkgs/issues/145726

pkgs/by-name/yn/ynetd/hardened.nix

@@ -0,0 +1,29 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "ctf-ynetd";
+  version = "2024.12.31";
+
+  src = fetchurl {
+    url = "https://hxp.io/assets/data/code/ctf-ynetd-2024.12.31.tar.xz";
+    hash = "sha256-hUEZZEulmaV3KfKOqE1wl7y4SRUn2/HoOjVDabk5+YA=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+    install -Dm755 ynetd $out/bin/ynetd
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Fork of ynetd hardened for CTFs with isolation using PID namespaces, minimal overhead proof-of-work checking, and strict resource limits via cgroups";
+    homepage = "https://hxp.io/code/";
+    license = lib.licenses.mit;
+    platforms = lib.platforms.linux;
+    maintainers = [ lib.maintainers.haylin ];
+    mainProgram = "ynetd";
+  };
+})

pkgs/by-name/yn/ynetd/package.nix

@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchurl,
+  callPackage,
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "ynetd";
@@ -22,6 +23,10 @@ stdenv.mkDerivation (finalAttrs: {
     runHook postInstall
   '';
 
+  # ctf-ynetd releases are based on the last stable ynetd version
+  # these should be kept in sync when possible
+  passthru.hardened = callPackage ./hardened.nix { };
+
   meta = {
     description = "Small server for binding programs to TCP ports";
     homepage = "https://yx7.cc/code/";

pkgs/development/python-modules/firecrawl-py/default.nix

@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "firecrawl-py";
-  version = "1.5.0";
+  version = "1.6.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "mendableai";
     repo = "firecrawl";
     tag = "v${version}";
-    hash = "sha256-6reo89L/f50pNdMEm1nknEotoCyZFO/RBu3ldNUQkhk=";
+    hash = "sha256-xr2curv7Inzav0wGOEfWwKn1XhBg8EIotJbwhXc+aBQ=";
   };
 
   sourceRoot = "${src.name}/apps/python-sdk";
@@ -42,7 +42,7 @@ buildPythonPackage rec {
   meta = {
     description = "Turn entire websites into LLM-ready markdown or structured data. Scrape, crawl and extract with a single API";
     homepage = "https://firecrawl.dev";
-    changelog = "https://github.com/mendableai/firecrawl/releases/tag/v${version}";
+    changelog = "https://github.com/mendableai/firecrawl/releases/tag/${src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ drupol ];
   };

pkgs/development/python-modules/rcssmin/default.nix

@@ -7,14 +7,14 @@
 
 buildPythonPackage rec {
   pname = "rcssmin";
-  version = "1.2.0";
+  version = "1.2.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-9DaHJBLPpvBP/5kMYyIkaxOqOJ9gMjuWNYPtYQLXyEw=";
+    hash = "sha256-s1wMic2sj8NWwrCYXz5TToXMGNGXHZAtHqx/5rT/Vmw=";
   };
 
   # The package does not ship tests, and the setup machinery confuses

pkgs/servers/jackett/default.nix

@@ -11,13 +11,13 @@
 
 buildDotnetModule rec {
   pname = "jackett";
-  version = "0.22.1447";
+  version = "0.22.1512";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    hash = "sha512-spmMAfyNZ0/RR1GExMnQCUL+ocr1Oj/NtEFc6lYmHoVkh/xMRn1QUh5ranKdsUGP5a7H3jq749MnA7w3ZrE2jA==";
+    hash = "sha512-gNsEDFBZPByRt2/twSCBvYZtZjXmqBMJPmBKSO4j/irxlhvWpq8SgeDgICpQ9Kf4S5eROPxcKH5V50doWBJndg==";
   };
 
   projectFile = "src/Jackett.Server/Jackett.Server.csproj";

pkgs/servers/radarr/default.nix

@@ -10,15 +10,15 @@ let
   }."${stdenv.hostPlatform.system}" or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
 
   hash = {
-    x64-linux_hash = "sha256-D0Np9Jz7E4/1dnWkFdHQIGthklCVc6yav2AAE9pFcu0=";
+    x64-linux_hash = "sha256-/NVosPx55kmbiUrEwqlCTFR9fyB5cbKaFZApafPDQL4=";
-    arm64-linux_hash = "sha256-cWQOddtAQqMvvWR8uFOs/w0iVnCSg8/nNtYuoUcEqAc=";
+    arm64-linux_hash = "sha256-4JgtHmNoJv9zURdFzRQaO0og07HpbVVOkBf+jViuM7E=";
-    x64-osx_hash = "sha256-8ReX8PrP6ZL1orhx8sMDMQ4WHx1WH9cyyrx2yQKFnmc=";
+    x64-osx_hash = "sha256-wfTGi8227Ggf0h2JyrdvM3yHG8lp5EktuHO37MprgZ4=";
-    arm64-osx_hash = "sha256-kH6gZ7PWIqrFnlRkqCO2KUvHX0L+xYIcR+NFuflBkFk=";
+    arm64-osx_hash = "sha256-VQ6o1XwT5MMS95e0AW6bgba+8iWvt1jKkxfIfkKiMlM=";
   }."${arch}-${os}_hash";
 
 in stdenv.mkDerivation rec {
   pname = "radarr";
-  version = "5.18.4.9674";
+  version = "5.19.3.9730";
 
   src = fetchurl {
     url = "https://github.com/Radarr/Radarr/releases/download/v${version}/Radarr.master.${version}.${os}-core-${arch}.tar.gz";

pkgs/tools/inputmethods/ibus-engines/ibus-typing-booster/default.nix

@@ -25,13 +25,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "ibus-typing-booster";
-  version = "2.27.27";
+  version = "2.27.29";
 
   src = fetchFromGitHub {
     owner = "mike-fabian";
     repo = "ibus-typing-booster";
     rev = version;
-    hash = "sha256-nh/dn71RFLuEHhkKWT5sZPUQxiG4pIJ8a3SXnW+A+Ts=";
+    hash = "sha256-0dyp7kNnmuw9YcYTH/5Eln+EzIbM2HTojXXC9NCA8vE=";
   };
 
   nativeBuildInputs = [

pkgs/tools/misc/steampipe-packages/steampipe-plugin-aws/default.nix

@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "steampipe-plugin-aws";
-  version = "1.6.0";
+  version = "1.9.0";
 
   src = fetchFromGitHub {
     owner = "turbot";
     repo = "steampipe-plugin-aws";
     tag = "v${version}";
-    hash = "sha256-kKJoEzudqNdVCmZpyB2Jaqjn01ZOnqqQ516DYnC0Qng=";
+    hash = "sha256-OpfusJAU2VzsvUjzwvd9xoUAsD4Pl/90mv3ADrVSY1A=";
   };
 
-  vendorHash = "sha256-76mIpOWpW4NgyKDzeVd7LkmiRhcikMvFaqt8qvh16+U=";
+  vendorHash = "sha256-eWoeC5MyU7Hs96DK53F0HOaqdT9TjfN2f8BW+oJ2pYY=";
 
   ldflags = [
     "-s"

pkgs/top-level/aliases.nix

@@ -939,6 +939,7 @@ mapAliases {
   mariadb-client = hiPrio mariadb.client; #added 2019.07.28
   maligned = throw "maligned was deprecated upstream in favor of x/tools/go/analysis/passes/fieldalignment"; # Added 20204-08-24
   manicode = throw "manicode has been renamed to codebuff"; # Added 2024-12-10
+  manta = throw "manta does not support python3, and development has been abandoned upstream"; # Added 2025-03-17
   marwaita-manjaro = lib.warnOnInstantiate "marwaita-manjaro has been renamed to marwaita-teal" marwaita-teal; # Added 2024-07-08
   marwaita-peppermint = lib.warnOnInstantiate "marwaita-peppermint has been renamed to marwaita-red" marwaita-red; # Added 2024-07-01
   marwaita-ubuntu = lib.warnOnInstantiate "marwaita-ubuntu has been renamed to marwaita-orange" marwaita-orange; # Added 2024-07-08