From 6d95c0c8b69e9cbc24f437e2d5da672ec9c0ef6d Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Mon, 24 Nov 2025 19:38:39 +0100 Subject: [PATCH 1/5] nginxQuic, angieQuic: retire > The ngx_http_v3_module module (1.25.0) provides experimental support > for HTTP/3. Yes, still experimental, at least in nginx. No mention in angie. > 0-RTT support requires the OpenSSL library version 3.5.1 or higher. > Alternatively, BoringSSL, LibreSSL, or QuicTLS libraries can be used to > build and run this module. But OpenSSL gets the first mention and our OpenSSL version right now is 3.6.0. That means we don't need two more packages to ship nginx built with QuicTLS which does not yet support PQ crypto right. --- .../manual/release-notes/rl-2511.section.md | 2 ++ .../services/web-servers/nginx/default.nix | 27 +---------------- nixos/tests/nginx-http3.nix | 4 +-- nixos/tests/nginx-variants.nix | 2 -- pkgs/servers/http/angie/default.nix | 17 ++++------- pkgs/servers/http/nginx/generic.nix | 1 + pkgs/servers/http/nginx/quic.nix | 15 ---------- pkgs/top-level/aliases.nix | 1 + pkgs/top-level/all-packages.nix | 29 ------------------- 9 files changed, 13 insertions(+), 85 deletions(-) delete mode 100644 pkgs/servers/http/nginx/quic.nix diff --git a/nixos/doc/manual/release-notes/rl-2511.section.md b/nixos/doc/manual/release-notes/rl-2511.section.md index 91cb788a4c53..4b0b58028e7b 100644 --- a/nixos/doc/manual/release-notes/rl-2511.section.md +++ b/nixos/doc/manual/release-notes/rl-2511.section.md @@ -290,6 +290,8 @@ - The `mime_types_file` setting is now set to `"${pkgs.mailcap}/etc/mime.types"` to prevent errors. For a complete list of changes, please see [their announcement](https://blog.prosody.im/prosody-13.0.0-released/). +- HTTP3 support has been enabled in in `nginx`, `openresty`, `angie` and `tengine`. The `nginxQuic` and `angieQuic` package flavors have been removed. + - The `yeahwm` package and `services.xserver.windowManager.yeahwm` module were removed due to the package being broken and unmaintained upstream. - `services.nixseparatedebuginfod.enable = true;` has been replaced by `services.nixseparatedebuginfod2.enable = true`. If you only use the official binary cache `https://cache.nixos.org` then no further configuration should be needed. If you have other https substituters, you can add them to `services.nixseparatedebuginfod2.subsituters`. SSH substituters are not supported by nixseparatedebuginfod2. Consider running nixseparatedebuginfod2 on the substituter instead, and pointing to it with the new option `environment.debuginfodServers`. diff --git a/nixos/modules/services/web-servers/nginx/default.nix b/nixos/modules/services/web-servers/nginx/default.nix index 54cf523f4df0..2ade07b09eca 100644 --- a/nixos/modules/services/web-servers/nginx/default.nix +++ b/nixos/modules/services/web-servers/nginx/default.nix @@ -573,10 +573,7 @@ let mkCertOwnershipAssertion = import ../../../security/acme/mk-cert-ownership-assertion.nix lib; - oldHTTP2 = ( - versionOlder cfg.package.version "1.25.1" - && !(cfg.package.pname == "angie" || cfg.package.pname == "angieQuic") - ); + oldHTTP2 = (versionOlder cfg.package.version "1.25.1" && !(cfg.package.pname == "angie")); in { @@ -778,7 +775,6 @@ in that the nginx team recommends to use the mainline version which available in nixpkgs as `nginxMainline`. Supported Nginx forks include `angie`, `openresty` and `tengine`. - For HTTP/3 support use `nginxQuic` or `angieQuic`. ''; }; @@ -1374,27 +1370,6 @@ in ''; } - { - assertion = - cfg.package.pname != "nginxQuic" && cfg.package.pname != "angieQuic" -> !(cfg.enableQuicBPF); - message = '' - services.nginx.enableQuicBPF requires using nginxQuic package, - which can be achieved by setting `services.nginx.package = pkgs.nginxQuic;` or - `services.nginx.package = pkgs.angieQuic;`. - ''; - } - - { - assertion = - cfg.package.pname != "nginxQuic" && cfg.package.pname != "angieQuic" - -> all (host: !host.quic) (attrValues virtualHosts); - message = '' - services.nginx.service.virtualHosts..quic requires using nginxQuic or angie packages, - which can be achieved by setting `services.nginx.package = pkgs.nginxQuic;` or - `services.nginx.package = pkgs.angieQuic;`. - ''; - } - { # The idea is to understand whether there is a virtual host with a listen configuration # that requires ACME configuration but has no HTTP listener which will make deterministically fail diff --git a/nixos/tests/nginx-http3.nix b/nixos/tests/nginx-http3.nix index cd321d43d2e1..4545c77b293c 100644 --- a/nixos/tests/nginx-http3.nix +++ b/nixos/tests/nginx-http3.nix @@ -114,7 +114,7 @@ builtins.listToAttrs ( }; }) [ - pkgs.angieQuic - pkgs.nginxQuic + pkgs.angie + pkgs.nginx ] ) diff --git a/nixos/tests/nginx-variants.nix b/nixos/tests/nginx-variants.nix index 0e845b3414d4..6e43abae920b 100644 --- a/nixos/tests/nginx-variants.nix +++ b/nixos/tests/nginx-variants.nix @@ -25,10 +25,8 @@ builtins.listToAttrs ( }) [ "angie" - "angieQuic" "nginxStable" "nginxMainline" - "nginxQuic" "nginxShibboleth" "openresty" "tengine" diff --git a/pkgs/servers/http/angie/default.nix b/pkgs/servers/http/angie/default.nix index 6c0fb856ecb8..4fab1346b188 100644 --- a/pkgs/servers/http/angie/default.nix +++ b/pkgs/servers/http/angie/default.nix @@ -4,27 +4,22 @@ fetchurl, nixosTests, withAcme ? false, - withQuic ? false, ... }@args: callPackage ../nginx/generic.nix args rec { version = "1.10.2"; - pname = if withQuic then "angieQuic" else "angie"; + pname = "angie"; src = fetchurl { url = "https://download.angie.software/files/angie-${version}.tar.gz"; hash = "sha256-pcKrk33ySoDnhq9WOJIvRuqKc9FhQYPIyQKYrocwlLg="; }; - configureFlags = - lib.optionals withAcme [ - "--with-http_acme_module" - "--http-acme-client-path=/var/lib/nginx/acme" - ] - ++ lib.optionals withQuic [ - "--with-http_v3_module" - ]; + configureFlags = lib.optionals withAcme [ + "--with-http_acme_module" + "--http-acme-client-path=/var/lib/nginx/acme" + ]; preInstall = '' if [[ -e man/angie.8 ]]; then @@ -39,7 +34,7 @@ callPackage ../nginx/generic.nix args rec { passthru.tests = { angie = nixosTests.nginx-variants.angie; angie-api = nixosTests.angie-api; - angie-http3 = nixosTests.nginx-http3.angieQuic; + angie-http3 = nixosTests.nginx-http3.angie; }; meta = { diff --git a/pkgs/servers/http/nginx/generic.nix b/pkgs/servers/http/nginx/generic.nix index e3964c40f03d..ca8d9fb15ada 100644 --- a/pkgs/servers/http/nginx/generic.nix +++ b/pkgs/servers/http/nginx/generic.nix @@ -117,6 +117,7 @@ stdenv.mkDerivation { "--sbin-path=bin/nginx" "--with-http_ssl_module" "--with-http_v2_module" + "--with-http_v3_module" "--with-http_realip_module" "--with-http_addition_module" "--with-http_xslt_module" diff --git a/pkgs/servers/http/nginx/quic.nix b/pkgs/servers/http/nginx/quic.nix deleted file mode 100644 index a3db09f16bb8..000000000000 --- a/pkgs/servers/http/nginx/quic.nix +++ /dev/null @@ -1,15 +0,0 @@ -{ - callPackage, - nginxMainline, - ... -}@args: - -callPackage ./generic.nix args { - pname = "nginxQuic"; - - inherit (nginxMainline) src version; - - configureFlags = [ - "--with-http_v3_module" - ]; -} diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix index 85236e87a113..deb7bbbdf842 100644 --- a/pkgs/top-level/aliases.nix +++ b/pkgs/top-level/aliases.nix @@ -1128,6 +1128,7 @@ mapAliases { "; # Added 2025-09-25 nextcloud30Packages = throw "Nextcloud 30 is EOL!"; # Added 2025-09-25 nfstrace = throw "nfstrace has been removed, as it was broken"; # Added 2025-08-25 + nginxQuic = throw "'nginxQuic' has been removed. QUIC support is now available in the default nginx builds."; ngrid = throw "'ngrid' has been removed as it has been unmaintained upstream and broken"; # Added 2025-11-15 nix-direnv-flakes = throw "'nix-direnv-flakes' has been renamed to/replaced by 'nix-direnv'"; # Converted to throw 2025-10-27 nix-ld-rs = throw "'nix-ld-rs' has been renamed to/replaced by 'nix-ld'"; # Converted to throw 2025-10-27 diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index ac55d2e9af23..9093198ed9b5 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -1465,21 +1465,6 @@ with pkgs; ]; }; - angieQuic = callPackage ../servers/http/angie { - zlib-ng = zlib-ng.override { withZlibCompat = true; }; - withPerl = false; - withQuic = true; - # We don't use `with` statement here on purpose! - # See https://github.com/NixOS/nixpkgs/pull/10474#discussion_r42369334 - modules = [ - nginxModules.rtmp - nginxModules.dav - nginxModules.moreheaders - ]; - # Use latest quictls to allow http3 support - openssl = quictls; - }; - angie-console-light = callPackage ../servers/http/angie/console-light.nix { }; apk-tools = callPackage ../tools/package-management/apk-tools { @@ -9318,20 +9303,6 @@ with pkgs; nginx = nginxStable; - nginxQuic = callPackage ../servers/http/nginx/quic.nix { - zlib-ng = zlib-ng.override { withZlibCompat = true; }; - withPerl = false; - # We don't use `with` statement here on purpose! - # See https://github.com/NixOS/nixpkgs/pull/10474#discussion_r42369334 - modules = [ - nginxModules.rtmp - nginxModules.dav - nginxModules.moreheaders - ]; - # Use latest boringssl to allow http3 support - openssl = quictls; - }; - nginxStable = callPackage ../servers/http/nginx/stable.nix { zlib-ng = zlib-ng.override { withZlibCompat = true; }; withPerl = false; From 97d904551fd50a5a5d8b22989e682a48e3131b9f Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Mon, 24 Nov 2025 20:33:11 +0100 Subject: [PATCH 2/5] nixosTests.nginx-http3: fix test The network-online.target was never configured for the client. --- nixos/tests/nginx-http3.nix | 1 - 1 file changed, 1 deletion(-) diff --git a/nixos/tests/nginx-http3.nix b/nixos/tests/nginx-http3.nix index 4545c77b293c..17c3d215f029 100644 --- a/nixos/tests/nginx-http3.nix +++ b/nixos/tests/nginx-http3.nix @@ -90,7 +90,6 @@ builtins.listToAttrs ( server.wait_for_unit("nginx") server.wait_for_open_port(443) - client.wait_for_unit("network-online.target") # Check http connections client.succeed("curl --verbose --http3-only https://acme.test | grep 'Hello World!'") From 788e084c8525cd1037304f0a2cb4f5976a2d1f9d Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Sun, 23 Nov 2025 18:42:56 +0100 Subject: [PATCH 3/5] nixos/nginx: add support for PQ key exchanges in TLS1.3 The Mozilla Server-Side TLS guide is lagging quite a bit, because since OpenSSL 3.5.0 we can provide hybrid key exchanges, that hopefully protect against "store now, decrypt later" attacks, that could be applied once capable quantum computers eventually come into existance. --- nixos/modules/services/web-servers/nginx/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/nixos/modules/services/web-servers/nginx/default.nix b/nixos/modules/services/web-servers/nginx/default.nix index 2ade07b09eca..e557ee92f7a7 100644 --- a/nixos/modules/services/web-servers/nginx/default.nix +++ b/nixos/modules/services/web-servers/nginx/default.nix @@ -205,9 +205,9 @@ let ${optionalString (cfg.sslDhparam != null) "ssl_dhparam ${cfg.sslDhparam};"} ${optionalString cfg.recommendedTlsSettings '' - # Keep in sync with https://ssl-config.mozilla.org/#server=nginx&config=intermediate + # Consider https://ssl-config.mozilla.org/#server=nginx&config=intermediate as the lower bound - ssl_ecdh_curve X25519:prime256v1:secp384r1; + ssl_conf_command Groups "X25519MLKEM768:X25519:P-256:P-384"; ssl_session_timeout 1d; ssl_session_cache shared:SSL:10m; # Breaks forward secrecy: https://github.com/mozilla/server-side-tls/issues/135 From c557ebe0dba620cf9a29071fff5d9d6f65ab8df5 Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Tue, 25 Nov 2025 00:02:06 +0100 Subject: [PATCH 4/5] haproxy: remove quictls support QuicTLS was a fork of OpenSSL which ended development in April 2025 and is stuck at an OpenSSL 3.3.0 base commit. The resulting QUIC functionality has been merged into and released in OpenSSL 3.5.0. --- pkgs/by-name/ha/haproxy/package.nix | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/pkgs/by-name/ha/haproxy/package.nix b/pkgs/by-name/ha/haproxy/package.nix index 0998f1f775c6..67a6bbe0ffc9 100644 --- a/pkgs/by-name/ha/haproxy/package.nix +++ b/pkgs/by-name/ha/haproxy/package.nix @@ -2,18 +2,16 @@ useLua ? true, usePcre ? true, withPrometheusExporter ? true, - sslLibrary ? "quictls", + sslLibrary ? "openssl", stdenv, lib, fetchurl, - fetchpatch, nixosTests, zlib, libxcrypt, aws-lc, libressl, openssl, - quictls, wolfssl, lua5_4, pcre2, @@ -23,7 +21,6 @@ assert lib.assertOneOf "sslLibrary" sslLibrary [ "aws-lc" "libressl" "openssl" - "quictls" "wolfssl" ]; let @@ -32,7 +29,6 @@ let aws-lc libressl openssl - quictls ; wolfssl = wolfssl.override { variant = "haproxy"; From 6df31c1a4ca60708070690e0ea61523ecb0e3f70 Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Tue, 25 Nov 2025 00:06:44 +0100 Subject: [PATCH 5/5] quictls: drop This OpenSSL fork reached its end of life when QUIC support was merged upstream. Closes: #464720 --- .../development/libraries/quictls/default.nix | 208 ------------------ pkgs/top-level/aliases.nix | 1 + pkgs/top-level/all-packages.nix | 2 - 3 files changed, 1 insertion(+), 210 deletions(-) delete mode 100644 pkgs/development/libraries/quictls/default.nix diff --git a/pkgs/development/libraries/quictls/default.nix b/pkgs/development/libraries/quictls/default.nix deleted file mode 100644 index 7ee882f89445..000000000000 --- a/pkgs/development/libraries/quictls/default.nix +++ /dev/null @@ -1,208 +0,0 @@ -{ - buildPackages, - cryptodev, - enableSSL2 ? false, - enableSSL3 ? false, - fetchFromGitHub, - lib, - makeWrapper, - perl, - removeReferencesTo, - static ? stdenv.hostPlatform.isStatic, - stdenv, - withCryptodev ? false, -}: - -stdenv.mkDerivation rec { - pname = "quictls"; - version = "3.3.0-quic1"; - - src = fetchFromGitHub { - owner = "quictls"; - repo = "openssl"; - rev = "openssl-${version}"; - hash = "sha256-kBPwldTJbJSuvBVylJNcLSJvF/Hbqh0mfT4Ub5Xc6dk="; - }; - - patches = [ - ../openssl/3.0/nix-ssl-cert-file.patch - - # openssl will only compile in KTLS if the current kernel supports it. - # This patch disables build-time detection. - ../openssl/3.0/openssl-disable-kernel-detection.patch - - ( - if stdenv.hostPlatform.isDarwin then - ../openssl/3.5/use-etc-ssl-certs-darwin.patch - else - ../openssl/3.5/use-etc-ssl-certs.patch - ) - ]; - - postPatch = '' - patchShebangs Configure - '' - # config is a configure script which is not installed. - + '' - substituteInPlace config --replace '/usr/bin/env' '${buildPackages.coreutils}/bin/env' - '' - + lib.optionalString stdenv.hostPlatform.isMusl '' - substituteInPlace crypto/async/arch/async_posix.h \ - --replace '!defined(__ANDROID__) && !defined(__OpenBSD__)' \ - '!defined(__ANDROID__) && !defined(__OpenBSD__) && 0' - ''; - - nativeBuildInputs = [ - makeWrapper - perl - removeReferencesTo - ]; - - buildInputs = lib.optionals withCryptodev [ - cryptodev - ]; - - outputs = [ - "bin" - "dev" - "out" - "man" - "doc" - ]; - - setOutputFlags = false; - - separateDebugInfo = - !stdenv.hostPlatform.isDarwin && !(stdenv.hostPlatform.useLLVM or false) && stdenv.cc.isGNU; - - # TODO(@Ericson2314): Improve with mass rebuild - configurePlatforms = [ ]; - configureScript = - { - armv5tel-linux = "./Configure linux-armv4 -march=armv5te"; - armv6l-linux = "./Configure linux-armv4 -march=armv6"; - armv7l-linux = "./Configure linux-armv4 -march=armv7-a"; - x86_64-darwin = "./Configure darwin64-x86_64-cc"; - aarch64-darwin = "./Configure darwin64-arm64-cc"; - x86_64-linux = "./Configure linux-x86_64"; - x86_64-solaris = "./Configure solaris64-x86_64-gcc"; - riscv64-linux = "./Configure linux64-riscv64"; - mips64el-linux = - if stdenv.hostPlatform.isMips64n64 then - "./Configure linux64-mips64" - else if stdenv.hostPlatform.isMips64n32 then - "./Configure linux-mips64" - else - throw "unsupported ABI for ${stdenv.hostPlatform.system}"; - } - .${stdenv.hostPlatform.system} or ( - if stdenv.hostPlatform == stdenv.buildPlatform then - "./config" - else if stdenv.hostPlatform.isBSD && stdenv.hostPlatform.isx86_64 then - "./Configure BSD-x86_64" - else if stdenv.hostPlatform.isBSD && stdenv.hostPlatform.isx86_32 then - "./Configure BSD-x86" + lib.optionalString stdenv.hostPlatform.isElf "-elf" - else if stdenv.hostPlatform.isBSD then - "./Configure BSD-generic${toString stdenv.hostPlatform.parsed.cpu.bits}" - else if stdenv.hostPlatform.isMinGW then - "./Configure mingw${ - lib.optionalString (stdenv.hostPlatform.parsed.cpu.bits != 32) ( - toString stdenv.hostPlatform.parsed.cpu.bits - ) - }" - else if stdenv.hostPlatform.isLinux then - "./Configure linux-generic${toString stdenv.hostPlatform.parsed.cpu.bits}" - else if stdenv.hostPlatform.isiOS then - "./Configure ios${toString stdenv.hostPlatform.parsed.cpu.bits}-cross" - else - throw "Not sure what configuration to use for ${stdenv.hostPlatform.config}" - ); - - # OpenSSL doesn't like the `--enable-static` / `--disable-shared` flags. - dontAddStaticConfigureFlags = true; - - configureFlags = [ - "shared" # "shared" builds both shared and static libraries - "--libdir=lib" - "--openssldir=etc/ssl" - ] - ++ lib.optionals withCryptodev [ - "-DHAVE_CRYPTODEV" - "-DUSE_CRYPTODEV_DIGESTS" - ] - ++ lib.optional enableSSL2 "enable-ssl2" - ++ lib.optional enableSSL3 "enable-ssl3" - # We select KTLS here instead of the configure-time detection (which we patch out). - # KTLS should work on FreeBSD 13+ as well, so we could enable it if someone tests it. - ++ lib.optional (stdenv.hostPlatform.isLinux && lib.versionAtLeast version "3.0.0") "enable-ktls" - ++ lib.optional stdenv.hostPlatform.isAarch64 "no-afalgeng" - # OpenSSL needs a specific `no-shared` configure flag. - # See https://wiki.openssl.org/index.php/Compilation_and_Installation#Configure_Options - # for a comprehensive list of configuration options. - ++ lib.optional static "no-shared" - # This introduces a reference to the CTLOG_FILE which is undesired when - # trying to build binaries statically. - ++ lib.optional static "no-ct"; - - makeFlags = [ - "MANDIR=$(man)/share/man" - # This avoids conflicts between man pages of openssl subcommands (for - # example 'ts' and 'err') man pages and their equivalent top-level - # command in other packages (respectively man-pages and moreutils). - # This is done in ubuntu and archlinux, and possibly many other distros. - "MANSUFFIX=ssl" - ]; - - enableParallelBuilding = true; - - postInstall = - ( - if static then - '' - # OPENSSLDIR has a reference to self - ${removeReferencesTo}/bin/remove-references-to -t $out $out/lib/*.a - '' - else - '' - # If we're building dynamic libraries, then don't install static - # libraries. - if [ -n "$(echo $out/lib/*.so $out/lib/*.dylib $out/lib/*.dll)" ]; then - rm "$out/lib/"*.a - fi - '' - ) - + '' - mkdir -p $bin - mv $out/bin $bin/bin - - # c_rehash is a legacy perl script with the same functionality - # as `openssl rehash` - # this wrapper script is created to maintain backwards compatibility without - # depending on perl - makeWrapper $bin/bin/openssl $bin/bin/c_rehash \ - --add-flags "rehash" - - mkdir $dev - mv $out/include $dev/ - # remove dependency on Perl at runtime - rm -r $out/etc/ssl/misc - rmdir $out/etc/ssl/{certs,private} - ''; - - postFixup = lib.optionalString (!stdenv.hostPlatform.isWindows) '' - # Check to make sure the main output doesn't depend on perl - if grep -r '${buildPackages.perl}' $out; then - echo "Found an erroneous dependency on perl ^^^" >&2 - exit 1 - fi - ''; - - meta = { - changelog = "https://github.com/quictls/openssl/blob/openssl-${version}/CHANGES.md"; - description = "TLS/SSL and crypto library with QUIC APIs"; - homepage = "https://quictls.github.io"; - license = lib.licenses.openssl; - maintainers = with lib.maintainers; [ izorkin ]; - platforms = lib.platforms.all; - }; -} diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix index deb7bbbdf842..94e039e1413b 100644 --- a/pkgs/top-level/aliases.nix +++ b/pkgs/top-level/aliases.nix @@ -1348,6 +1348,7 @@ mapAliases { quaternion-qt5 = throw "'quaternion-qt5' has been removed as quaternion dropped Qt5 support with v0.0.97.1"; # Added 2025-05-24 qubes-core-vchan-xen = throw "'qubes-core-vchan-xen' has been removed because it has been marked as broken since at least November 2024."; # Added 2025-10-11 quicksynergy = throw "'quicksynergy' has been removed due to lack of maintenance upstream. Consider using 'deskflow' instead."; # Added 2025-06-18 + quictls = throw "'quictls' has been removed. QUIC support is now available in `openssl`."; quorum = throw "'quorum' has been removed as it was broken and unmaintained upstream"; # Added 2025-11-07 qv2ray = throw "'qv2ray' has been removed as it was unmaintained"; # Added 2025-06-03 ra-multiplex = lib.warnOnInstantiate "'ra-multiplex' has been renamed to/replaced by 'lspmux'" lspmux; # Added 2025-10-27 diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index 9093198ed9b5..5388804a31a7 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -3767,8 +3767,6 @@ with pkgs; qtspim = libsForQt5.callPackage ../development/tools/misc/qtspim { }; - quictls = callPackage ../development/libraries/quictls { }; - quota = if stdenv.hostPlatform.isLinux then linuxquota else unixtools.quota; radeon-profile = libsForQt5.callPackage ../tools/misc/radeon-profile { };