From c718169b9e1680829c50e4ed9e8a10e70ac65b2b Mon Sep 17 00:00:00 2001 From: Markus Kowalewski Date: Sun, 5 Oct 2025 19:34:03 +0200 Subject: [PATCH 1/8] qgit: 2.11 -> 2.12 --- .../version-management/qgit/default.nix | 22 +++++++++++++------ pkgs/top-level/all-packages.nix | 2 +- 2 files changed, 16 insertions(+), 8 deletions(-) diff --git a/pkgs/applications/version-management/qgit/default.nix b/pkgs/applications/version-management/qgit/default.nix index 444adfbdab90..9955932b340a 100644 --- a/pkgs/applications/version-management/qgit/default.nix +++ b/pkgs/applications/version-management/qgit/default.nix @@ -1,25 +1,33 @@ { - mkDerivation, + stdenv, lib, fetchFromGitHub, cmake, qtbase, + qt5compat, + wrapQtAppsHook, }: -mkDerivation rec { +stdenv.mkDerivation rec { pname = "qgit"; - version = "2.11"; + version = "2.12"; src = fetchFromGitHub { owner = "tibirna"; repo = "qgit"; - rev = "${pname}-${version}"; - sha256 = "sha256-DmwxOy71mIklLQ7V/qMzi8qCMtKa9nWHlkjEr/9HJIU="; + rev = "qgit-${version}"; + hash = "sha256-q81nY9D/8riMTFP8gDRbY2PjVo+NwRu/XEN1Yn0P/pk="; }; - buildInputs = [ qtbase ]; + buildInputs = [ + qtbase + qt5compat + ]; - nativeBuildInputs = [ cmake ]; + nativeBuildInputs = [ + cmake + wrapQtAppsHook + ]; meta = with lib; { license = licenses.gpl2Only; diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index ba932e007ef6..f6c6376cb551 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -1261,7 +1261,7 @@ with pkgs; python3Packages.callPackage ../applications/version-management/pass-git-helper { }; - qgit = qt5.callPackage ../applications/version-management/qgit { }; + qgit = qt6Packages.callPackage ../applications/version-management/qgit { }; silver-platter = python3Packages.callPackage ../applications/version-management/silver-platter { }; From d36ea036bee6d2ae01b55e0571c17b9f155e178e Mon Sep 17 00:00:00 2001 From: Markus Kowalewski Date: Sun, 5 Oct 2025 19:35:25 +0200 Subject: [PATCH 2/8] qgit: refactor, cleanup --- .../version-management/qgit/default.nix | 22 +++++++++---------- 1 file changed, 11 insertions(+), 11 deletions(-) diff --git a/pkgs/applications/version-management/qgit/default.nix b/pkgs/applications/version-management/qgit/default.nix index 9955932b340a..cc946a3e78d1 100644 --- a/pkgs/applications/version-management/qgit/default.nix +++ b/pkgs/applications/version-management/qgit/default.nix @@ -8,36 +8,36 @@ wrapQtAppsHook, }: -stdenv.mkDerivation rec { +stdenv.mkDerivation (finalAttrs: { pname = "qgit"; version = "2.12"; src = fetchFromGitHub { owner = "tibirna"; repo = "qgit"; - rev = "qgit-${version}"; + rev = "qgit-${finalAttrs.version}"; hash = "sha256-q81nY9D/8riMTFP8gDRbY2PjVo+NwRu/XEN1Yn0P/pk="; }; - buildInputs = [ - qtbase - qt5compat - ]; - nativeBuildInputs = [ cmake wrapQtAppsHook ]; - meta = with lib; { - license = licenses.gpl2Only; + buildInputs = [ + qtbase + qt5compat + ]; + + meta = { + license = lib.licenses.gpl2Only; homepage = "https://github.com/tibirna/qgit"; description = "Graphical front-end to Git"; - maintainers = with maintainers; [ + maintainers = with lib.maintainers; [ peterhoeg markuskowa ]; inherit (qtbase.meta) platforms; mainProgram = "qgit"; }; -} +}) From 2b5981c5c79b351611c705b11d56f20bbb27c5fa Mon Sep 17 00:00:00 2001 From: Nicolas Benes Date: Mon, 21 Nov 2022 21:02:11 +0100 Subject: [PATCH 3/8] fetchgitlab: pass private tokens/passwords Allow the fetcher to authenticate with user name and password. Note: as of now, GitLab ignores the user name (it must be set, but the value does not matter) but this may change in the future: https://gitlab.com/gitlab-org/gitlab/-/issues/212953 Credentials can be passed to the nix-daemon, for example, via a read-protected `EnvironmentFile`: ```console $ ls -l /to/secrets.txt -rw------- 1 root root 100 Nov 1 10:42 /to/secrets.txt ``` In /to/secrets.txt: ``` # for `fetchFromGitLab { private=true; ... }` NIX_GITLAB_PRIVATE_USERNAME=whatever NIX_GITLAB_PRIVATE_PASSWORD=glpat-the-access-token # for `fetchFromGitLab { private=true; varPrefix="EXAMPLE"; ... }` NIX_EXAMPLE_GITLAB_PRIVATE_USERNAME=whatever NIX_EXAMPLE_GITLAB_PRIVATE_PASSWORD=glpat-another-access-token ``` In /etc/nixos/configuration.nix: ```nix { config, pkgs, ... }: { systemd.services.nix-daemon.serviceConfig.EnvironmentFile = "/to/secrets.txt"; } ``` GitLab supports HTTP Basic Authentication (credentials in `.netrc` file) only if accessed via Git. Access via the GitLab API requires a custom header (e.g. `PRIVATE-TOKEN`) instead. See: * https://docs.gitlab.com/ee/user/project/settings/project_access_tokens.html#project-access-tokens * https://docs.gitlab.com/ee/api/rest/authentication.html#personalprojectgroup-access-tokens --- pkgs/build-support/fetchgitlab/default.nix | 46 ++++++++++++++++++++++ 1 file changed, 46 insertions(+) diff --git a/pkgs/build-support/fetchgitlab/default.nix b/pkgs/build-support/fetchgitlab/default.nix index 822c3991fa29..8a2b0ffa31d6 100644 --- a/pkgs/build-support/fetchgitlab/default.nix +++ b/pkgs/build-support/fetchgitlab/default.nix @@ -21,6 +21,8 @@ lib.makeOverridable ( deepClone ? false, forceFetchGit ? false, sparseCheckout ? [ ], + private ? false, + varPrefix ? null, ... # For hash agility }@args: @@ -51,14 +53,57 @@ lib.makeOverridable ( "tag" "fetchSubmodules" "forceFetchGit" + "private" + "varPrefix" "leaveDotGit" "deepClone" ]; + varBase = "NIX${lib.optionalString (varPrefix != null) "_${varPrefix}"}_GITLAB_PRIVATE_"; useFetchGit = fetchSubmodules || leaveDotGit || deepClone || forceFetchGit || (sparseCheckout != [ ]); fetcher = if useFetchGit then fetchgit else fetchzip; + privateAttrs = lib.optionalAttrs private ( + lib.throwIfNot (protocol == "https") "private token login is only supported for https" { + netrcPhase = '' + if [ -z "''$${varBase}USERNAME" -o -z "''$${varBase}PASSWORD" ]; then + echo "Error: Private fetchFromGitLab requires the nix building process (nix-daemon in multi user mode) to have the ${varBase}USERNAME and ${varBase}PASSWORD env vars set." >&2 + exit 1 + fi + '' + + ( + if useFetchGit then + # GitLab supports HTTP Basic Authentication only when Git is used: + # https://docs.gitlab.com/ee/user/project/settings/project_access_tokens.html#project-access-tokens + '' + cat > netrc < private-token < Date: Wed, 22 Oct 2025 07:13:30 +0000 Subject: [PATCH 4/8] plantuml: 1.2025.8 -> 1.2025.9 --- pkgs/by-name/pl/plantuml/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/pl/plantuml/package.nix b/pkgs/by-name/pl/plantuml/package.nix index f7ac77e03407..129f45843867 100644 --- a/pkgs/by-name/pl/plantuml/package.nix +++ b/pkgs/by-name/pl/plantuml/package.nix @@ -11,11 +11,11 @@ stdenvNoCC.mkDerivation (finalAttrs: { pname = "plantuml"; - version = "1.2025.8"; + version = "1.2025.9"; src = fetchurl { url = "https://github.com/plantuml/plantuml/releases/download/v${finalAttrs.version}/plantuml-pdf-${finalAttrs.version}.jar"; - hash = "sha256-KYOy8hJ62IBrLx78S2JLAMR2wuL18Ww+afVgPeKgWgQ="; + hash = "sha256-sQeOboLmTsHeT5Gk/hSBs9IsMMqiYrjThv7OSAIvyNg="; }; nativeBuildInputs = [ From ea037e7187b6db5870b5b635433c940a5c639349 Mon Sep 17 00:00:00 2001 From: Ivy Pierlot Date: Thu, 23 Oct 2025 01:34:42 +1100 Subject: [PATCH 5/8] maintainers: add matrix account to auscyber --- maintainers/maintainer-list.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix index dd06cef1f75a..0948524fc6a4 100644 --- a/maintainers/maintainer-list.nix +++ b/maintainers/maintainer-list.nix @@ -2489,6 +2489,7 @@ github = "auscyber"; name = "Ivy Pierlot"; githubId = 12080502; + matrix = "@ivy:faggot.sh"; }; austin-artificial = { email = "austin.platt@artificial.io"; From f501cb862541485a6f7b3c2a63df5df66e32ce4b Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Wed, 22 Oct 2025 17:54:38 +0000 Subject: [PATCH 6/8] tpnote: 1.25.15 -> 1.25.16 --- pkgs/by-name/tp/tpnote/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/tp/tpnote/package.nix b/pkgs/by-name/tp/tpnote/package.nix index 5dc592333593..06f44f3036fc 100644 --- a/pkgs/by-name/tp/tpnote/package.nix +++ b/pkgs/by-name/tp/tpnote/package.nix @@ -13,16 +13,16 @@ rustPlatform.buildRustPackage (finalAttrs: { pname = "tpnote"; - version = "1.25.15"; + version = "1.25.16"; src = fetchFromGitHub { owner = "getreu"; repo = "tp-note"; tag = "v${finalAttrs.version}"; - hash = "sha256-vmHRpY2KvG6vxVQ6OVi/u6wpD8oqQFXn2IJOT0Nh/V0="; + hash = "sha256-gltzK1C+4qddJ49vv+OZ8AVuMeBWArwOZkL+v7cxFzw="; }; - cargoHash = "sha256-dltBOA6pxy2gLemVoX8l0Z+xkiJvhGWSmediWWnN1bc="; + cargoHash = "sha256-OH3aSQdcAGNRJWGmgQ4LNnD89hqCIEh+ieHosjFhAbk="; nativeBuildInputs = [ cmake From 6d564102b72c8fd3cb7e4d2971be1fb1067e43bc Mon Sep 17 00:00:00 2001 From: Wolfgang Walther Date: Wed, 22 Oct 2025 21:06:53 +0200 Subject: [PATCH 7/8] ci/eval/compare/maintainers: fix maintainer pings without meta.position In a recent change, the path matching was simplified in maintainers.nix. This revealed a pre-existing logic bug: Packages without `meta.position` would get an empty string as their file name. The change would then cause this empty string to always be matched, which lead to maintainer pings for these packages in seemingly random PRs, when some of their dependencies were changed. --- ci/eval/compare/maintainers.nix | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/ci/eval/compare/maintainers.nix b/ci/eval/compare/maintainers.nix index b3ebf6aee569..854c1f730bda 100644 --- a/ci/eval/compare/maintainers.nix +++ b/ci/eval/compare/maintainers.nix @@ -72,7 +72,8 @@ let (lib.unsafeGetAttrPos "src" drv) (lib.unsafeGetAttrPos "pname" drv) (lib.unsafeGetAttrPos "version" drv) - + ] + ++ lib.optionals (drv.meta.position or null != null) [ # Use ".meta.position" for cases when most of the package is # defined in a "common" section and the only place where # reference to the file with a derivation the "pos" @@ -82,7 +83,7 @@ let # "pkgs/tools/package-management/nix/default.nix:155" # We transform it to the following: # { file = "pkgs/tools/package-management/nix/default.nix"; } - { file = lib.head (lib.splitString ":" (drv.meta.position or "")); } + { file = lib.head (lib.splitString ":" drv.meta.position); } ] ) )); From cce0f3f3006853f9182c893df2e3b04a262aece2 Mon Sep 17 00:00:00 2001 From: Yueh-Shun Li Date: Fri, 20 Dec 2024 00:30:50 +0800 Subject: [PATCH 8/8] buildPython*: bring back buildPython*.override Fix `makeOverridablePythonPackage` in python-package-base.nix and unshadow `buildPython*.override`. This makes it possible to override the dependencies of buildPython*. E.g., `buildPythonPackage.override { unzip = unzip-custom; }` returns a derived version of `buildPythonPackage` with the `unzip` package overridden with `unzip-custom`. --- .../interpreters/python/python-packages-base.nix | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/pkgs/development/interpreters/python/python-packages-base.nix b/pkgs/development/interpreters/python/python-packages-base.nix index 66a7c823fecc..ca4e4fd89741 100644 --- a/pkgs/development/interpreters/python/python-packages-base.nix +++ b/pkgs/development/interpreters/python/python-packages-base.nix @@ -38,7 +38,12 @@ let } else result - ); + ) + // lib.optionalAttrs (f ? override) { + # Support overriding `f` itself, e.g. `buildPythonPackage.override { }`. + # Ensure `makeOverridablePythonPackage` is applied to the result. + override = lib.mirrorFunctionArgs f.override (fdrv: makeOverridablePythonPackage (f.override fdrv)); + }; mkPythonDerivation = if python.isPy3k then ./mk-python-derivation.nix else ./python2/mk-python-derivation.nix;