Merge 71a32c3bcd into haskell-updates

.github/workflows/lint.yml

@@ -124,3 +124,30 @@ jobs:
             echo "If you're having trouble, ping @NixOS/nixpkgs-vet"
             exit "$exitCode"
           fi
+
+  commits:
+    # Only check commits if we have access to the pull_request context.
+    #
+    # Luckily there's no need to lint commit messages in the Merge Queue, because
+    # changes to the target branch can't change commit messages on the base branch.
+    if: ${{ github.event.pull_request.number }}
+    runs-on: ubuntu-slim
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          persist-credentials: false
+          path: trusted
+          sparse-checkout: |
+            ci/github-script
+      - name: Check commit messages
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        with:
+          script: |
+            const checkCommitMessages = require('./trusted/ci/github-script/lint-commits.js')
+
+            checkCommitMessages({
+              github,
+              context,
+              core,
+            })

ci/github-script/lint-commits.js

@@ -0,0 +1,89 @@
+// @ts-check
+const { classify } = require('../supportedBranches.js')
+
+/**
+ * @param {{
+ *  github: InstanceType<import('@actions/github/lib/utils').GitHub>,
+ *  context: import('@actions/github/lib/context').Context
+ *  core: import('@actions/core')
+ * }} CheckCommitMessagesProps
+ */
+async function checkCommitMessages({ github, context, core }) {
+  // This check should only be run when we have the pull_request context.
+  const pull_number = context.payload.pull_request?.number
+  if (!pull_number) {
+    core.info('This is not a pull request. Skipping checks.')
+    return
+  }
+
+  const pr = (
+    await github.rest.pulls.get({
+      ...context.repo,
+      pull_number,
+    })
+  ).data
+
+  const baseBranchType = classify(
+    pr.base.ref.replace(/^refs\/heads\//, ''),
+  ).type
+  const headBranchType = classify(
+    pr.head.ref.replace(/^refs\/heads\//, ''),
+  ).type
+
+  if (
+    baseBranchType.includes('development') &&
+    headBranchType.includes('development')
+  ) {
+    // This matches, for example, PRs from staging-next to master, or vice versa.
+    // Ignore them: we should only care about PRs introducing *new* commits.
+    core.info(
+      'This PR is from one development branch to another. Skipping checks.',
+    )
+    return
+  }
+
+  const commits = await github.paginate(github.rest.pulls.listCommits, {
+    ...context.repo,
+    pull_number,
+  })
+
+  const failures = new Set()
+
+  for (const commit of commits) {
+    const message = commit.commit.message
+    const firstLine = message.split('\n')[0]
+
+    const logMsgStart = `Commit ${commit.sha}'s message's subject ("${firstLine}")`
+
+    if (!firstLine.includes(':')) {
+      core.error(
+        `${logMsgStart} was detected as not meeting our guidelines because ` +
+          'it does not contain a colon. There are likely other issues as well.',
+      )
+      failures.add(commit.sha)
+    }
+
+    if (firstLine.endsWith('.')) {
+      core.error(
+        `${logMsgStart} was detected as not meeting our guidelines because ` +
+          'it ends in a period. There may be other issues as well.',
+      )
+      failures.add(commit.sha)
+    }
+
+    if (!failures.has(commit.sha)) {
+      core.info(`${logMsgStart} passed our automated checks!`)
+    }
+  }
+
+  if (failures.size !== 0) {
+    core.error(
+      'Please review the guidelines at ' +
+        'https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md#commit-conventions, ' +
+        'as well as the applicable area-specific guidelines linked there.',
+    )
+    core.setFailed('Committers: merging is discouraged.')
+  }
+}
+
+module.exports = checkCommitMessages

ci/github-script/run

@@ -94,4 +94,15 @@ program
     await run(getTeams, owner, repo, undefined, { ...options, outFile })
   })
 
+program
+  .command('lint-commits')
+  .description('Lint for common errors in commit messages')
+  .argument('<owner>', 'Owner of the GitHub repository to run on (Example: NixOS)')
+  .argument('<repo>', 'Name of the GitHub repository to run on (Example: nixpkgs)')
+  .argument('<pr>', 'Number of the Pull Request to run on')
+  .action(async (owner, repo, pr, options) => {
+    const checkCommitMessages = (await import('./lint-commits.js')).default
+    await run(checkCommitMessages, owner, repo, pr, options)
+  })
+
 await program.parse()

doc/languages-frameworks/javascript.section.md

@@ -327,16 +327,17 @@ See `node2nix` [docs](https://github.com/svanderburg/node2nix) for more info.
 
 ### pnpm {#javascript-pnpm}
 
-Pnpm is available as the top-level package `pnpm`. Additionally, there are variants pinned to certain major versions, like `pnpm_8` and `pnpm_9`, which support different sets of lock file versions.
+pnpm is available as the top-level package `pnpm`. Additionally, there are variants pinned to certain major versions, like `pnpm_8`, `pnpm_9` and `pnpm_10`, which support different sets of lock file versions.
 
-When packaging an application that includes a `pnpm-lock.yaml`, you need to fetch the pnpm store for that project using a fixed-output-derivation. The functions `pnpm_8.fetchDeps` and `pnpm_9.fetchDeps` can create this pnpm store derivation. In conjunction, the setup hooks `pnpm_8.configHook` and `pnpm_9.configHook` will prepare the build environment to install the pre-fetched dependencies store. Here is an example for a package that contains `package.json` and a `pnpm-lock.yaml` files using the above `pnpm_` attributes:
+When packaging an application that includes a `pnpm-lock.yaml`, you need to fetch the pnpm store for that project using a fixed-output-derivation. The function `fetchPnpmDeps` can create this pnpm store derivation. In conjunction, the setup hook `pnpmConfigHook` will prepare the build environment to install the pre-fetched dependencies store. Here is an example for a package that contains `package.json` and a `pnpm-lock.yaml` files using the fetcher and setup hook above:
 
 ```nix
 {
-  stdenv,
+  fetchPnpmDeps,
   nodejs,
-  # This is pinned as { pnpm = pnpm_9; }
   pnpm,
+  pnpmConfigHook,
+  stdenv,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -348,11 +349,12 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   nativeBuildInputs = [
-    nodejs
-    pnpm.configHook
+    nodejs # in case scripts are run outside of a pnpm call
+    pnpmConfigHook
+    pnpm # At least required by pnpmConfigHook, if not other (custom) phases
   ];
 
-  pnpmDeps = pnpm.fetchDeps {
+  pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
     fetcherVersion = 3;
     hash = "...";
@@ -360,33 +362,68 @@ stdenv.mkDerivation (finalAttrs: {
 })
 ```
 
-NOTE: It is highly recommended to use a pinned version of pnpm (i.e., `pnpm_8` or `pnpm_9`), to increase future reproducibility. It might also be required to use an older version if the package needs support for a certain lock file version.
+It is highly recommended to use a pinned version of pnpm (i.e., `pnpm_9` or `pnpm_10`), to increase future reproducibility. It might also be required to use an older version if the package needs support for a certain lock file version. To do so, you can pass the `pnpm` argument to `fetchPnpmDeps` and override the `pnpm` arg in `pnpmConfigHook`. Here are the changes in the example above to use a pinned pnpm version:
+
+<!-- TODO: Does splicing still work when overriding in nativeBuildInputs here? -->
+
+```diff
+ {
+   fetchPnpmDeps,
+   nodejs,
+-  pnpm,
++  pnpm_10,
+   pnpmConfigHook,
+   stdenv,
+ }:
++let
++  # Optionally override pnpm to use a custom nodejs version
++  # Make sure that the same nodejs version is referenced in nativeBuildInputs
++  # pnpm = pnpm_10.override { nodejs = nodejs_20; };
++in
+ stdenv.mkDerivation (finalAttrs: {
+   pname = "foo";
+   version = "0-unstable-1980-01-01";
+
+   src = {
+     #...
+   };
+
+   nativeBuildInputs = [
+     nodejs # in case scripts are run outside of a pnpm call
+     pnpmConfigHook
+-    pnpm # At least required by pnpmConfigHook, if not other (custom) phases
++    pnpm_10 # At least required by pnpmConfigHook, if not other (custom) phases
+   ];
+
+   pnpmDeps = fetchPnpmDeps {
+     inherit (finalAttrs) pname version src;
++    pnpm = pnpm_10;
+     fetcherVersion = 3;
+     hash = "...";
+   };
+ })
+```
 
 In case you are patching `package.json` or `pnpm-lock.yaml`, make sure to pass `finalAttrs.patches` to the function as well (i.e., `inherit (finalAttrs) patches`.
 
-`pnpm.configHook` supports adding additional `pnpm install` flags via `pnpmInstallFlags` which can be set to a Nix string array:
+`pnpmConfigHook` supports adding additional `pnpm install` flags via `pnpmInstallFlags` which can be set to a Nix string array:
 
 ```nix
-{ pnpm }:
-
-stdenv.mkDerivation (finalAttrs: {
-  pname = "foo";
-  version = "0-unstable-1980-01-01";
-
-  src = {
+{
+  # ...
+  pnpmDeps = fetchPnpmDeps {
     # ...
+    inherit (finalAttrs) pnpmInstallFlags;
   };
 
   pnpmInstallFlags = [ "--shamefully-hoist" ];
-
-  pnpmDeps = pnpm.fetchDeps { inherit (finalAttrs) pnpmInstallFlags; };
-})
+}
 ```
 
 #### Dealing with `sourceRoot` {#javascript-pnpm-sourceRoot}
 
-If the pnpm project is in a subdirectory, you can just define `sourceRoot` or `setSourceRoot` for `fetchDeps`.
-If `sourceRoot` is different between the parent derivation and `fetchDeps`, you will have to set `pnpmRoot` to effectively be the same location as it is in `fetchDeps`.
+If the pnpm project is in a subdirectory, you can just define `sourceRoot` or `setSourceRoot` for `fetchPnpmDeps`.
+If `sourceRoot` is different between the parent derivation and `fetchPnpmDeps`, you will have to set `pnpmRoot` to effectively be the same location as it is in `fetchPnpmDeps`.
 
 Assuming the following directory structure, we can define `sourceRoot` and `pnpmRoot` as follows:
 
@@ -402,7 +439,7 @@ Assuming the following directory structure, we can define `sourceRoot` and `pnpm
 ```nix
 {
   # ...
-  pnpmDeps = pnpm.fetchDeps {
+  pnpmDeps = fetchPnpmDeps {
     # ...
     sourceRoot = "${finalAttrs.src.name}/frontend";
   };
@@ -414,7 +451,7 @@ Assuming the following directory structure, we can define `sourceRoot` and `pnpm
 
 #### PNPM Workspaces {#javascript-pnpm-workspaces}
 
-If you need to use a PNPM workspace for your project, then set `pnpmWorkspaces = [ "<workspace project name 1>" "<workspace project name 2>" ]`, etc, in your `pnpm.fetchDeps` call,
+If you need to use a PNPM workspace for your project, then set `pnpmWorkspaces = [ "<workspace project name 1>" "<workspace project name 2>" ]`, etc, in your `fetchPnpmDeps` call,
 which will make PNPM only install dependencies for those workspace packages.
 
 For example:
@@ -423,14 +460,14 @@ For example:
 {
   # ...
   pnpmWorkspaces = [ "@astrojs/language-server" ];
-  pnpmDeps = pnpm.fetchDeps {
-    inherit (finalAttrs) pnpmWorkspaces;
+  pnpmDeps = fetchPnpmDeps {
     #...
+    inherit (finalAttrs) pnpmWorkspaces;
   };
 }
 ```
 
-The above would make `pnpm.fetchDeps` call only install dependencies for the `@astrojs/language-server` workspace package.
+The above would make `fetchPnpmDeps` call only install dependencies for the `@astrojs/language-server` workspace package.
 Note that you do not need to set `sourceRoot` to make this work.
 
 Usually, in such cases, you'd want to use `pnpm --filter=<pnpm workspace name> build` to build your project, as `npmHooks.npmBuildHook` probably won't work. A `buildPhase` based on the following example will probably fit most workspace projects:
@@ -457,23 +494,23 @@ set `prePnpmInstall` to the right commands to run. For example:
   prePnpmInstall = ''
     pnpm config set dedupe-peer-dependents false
   '';
-  pnpmDeps = pnpm.fetchDeps {
+  pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) prePnpmInstall;
     # ...
   };
 }
 ```
 
-In this example, `prePnpmInstall` will be run by both `pnpm.configHook` and by the `pnpm.fetchDeps` builder.
+In this example, `prePnpmInstall` will be run by both `pnpmConfigHook` and by the `fetchPnpmDeps` builder.
 
-#### PNPM `fetcherVersion` {#javascript-pnpm-fetcherVersion}
+#### pnpm `fetcherVersion` {#javascript-pnpm-fetcherVersion}
 
-This is the version of the output of `pnpm.fetchDeps`, if you haven't set it already, you can use `1` with your current hash:
+This is the version of the output of `fetchPnpmDeps`, if you haven't set it already, you can use `1` with your current hash:
 
 ```nix
 {
   # ...
-  pnpmDeps = pnpm.fetchDeps {
+  pnpmDeps = fetchPnpmDeps {
     # ...
     fetcherVersion = 1;
     hash = "..."; # you can use your already set hash here
@@ -486,7 +523,7 @@ After upgrading to a newer `fetcherVersion`, you need to regenerate the hash:
 ```nix
 {
   # ...
-  pnpmDeps = pnpm.fetchDeps {
+  pnpmDeps = fetchPnpmDeps {
     # ...
     fetcherVersion = 2;
     hash = "..."; # clear this hash and generate a new one
@@ -494,7 +531,7 @@ After upgrading to a newer `fetcherVersion`, you need to regenerate the hash:
 }
 ```
 
-This variable ensures that we can make changes to the output of `pnpm.fetchDeps` without breaking existing hashes.
+This variable ensures that we can make changes to the output of `fetchPnpmDeps` without breaking existing hashes.
 Changes can include workarounds or bug fixes to existing PNPM issues.
 
 ##### Version history {#javascript-pnpm-fetcherVersion-versionHistory}

doc/release-notes/rl-2605.section.md

@@ -54,6 +54,8 @@
   If your SQLite database is corrupted, the migration might fail and require [manual intervention](https://github.com/louislam/uptime-kuma/issues/5281).
   See the [migration guide](https://github.com/louislam/uptime-kuma/wiki/Migration-From-v1-To-v2) for more information.
 
+- `fetchPnpmDeps` and `pnpmConfigHook` were added as top-level attributes, replacing the now deprecated `pnpm.fetchDeps` and `pnpm.configHook` attributes.
+
 - Added `dell-bios-fan-control` package and service.
 
 - We now use the upstream wrapper script for Gradle, supporting both the `JAVA_HOME` and `GRADLE_OPTS` environment variables.

maintainers/maintainer-list.nix

@@ -4843,13 +4843,6 @@
     github = "Ciflire";
     githubId = 39668077;
   };
-  cig0 = {
-    name = "Martín Cigorraga";
-    email = "cig0.github@gmail.com";
-    github = "cig0";
-    githubId = 394089;
-    keys = [ { fingerprint = "1828 B459 DB9A 7EE2 03F4 7E6E AFBE ACC5 5D93 84A0"; } ];
-  };
   cigrainger = {
     name = "Christopher Grainger";
     email = "chris@amplified.ai";
@@ -7372,12 +7365,6 @@
     name = "Daniel Ebbert";
     keys = [ { fingerprint = "E765 FCA3 D9BF 7FDB 856E  AD73 47BC 1559 27CB B9C7"; } ];
   };
-  ebzzry = {
-    email = "ebzzry@ebzzry.io";
-    github = "ebzzry";
-    githubId = 7875;
-    name = "Rommel Martinez";
-  };
   ecklf = {
     email = "ecklf@icloud.com";
     github = "ecklf";
@@ -11557,12 +11544,6 @@
     github = "j0hax";
     githubId = 3802620;
   };
-  j0lol = {
-    name = "Jo";
-    email = "me@j0.lol";
-    github = "j0lol";
-    githubId = 24716467;
-  };
   j0xaf = {
     email = "j0xaf@j0xaf.de";
     name = "Jörn Gersdorf";
@@ -12761,6 +12742,12 @@
     name = "Jonas Wunderlich";
     matrix = "@matrix:03j.de";
   };
+  jonasfranke = {
+    name = "Jonas Franke";
+    email = "info@jonasfranke.xyz";
+    github = "JonasFranke";
+    githubId = 90050350;
+  };
   jonathanmarler = {
     email = "johnnymarler@gmail.com";
     github = "marler8997";

nixos/doc/manual/redirects.json

@@ -1185,6 +1185,12 @@
   "module-services-gitlab-maintenance-rake": [
     "index.html#module-services-gitlab-maintenance-rake"
   ],
+  "module-services-gitlab-runner": [
+    "index.html#module-services-gitlab-runner"
+  ],
+  "ex-gitlab-runner-podman": [
+    "index.html#ex-gitlab-runner-podman"
+  ],
   "module-forgejo": [
     "index.html#module-forgejo"
   ],

nixos/lib/test-driver/src/test_driver/machine/__init__.py

@@ -292,12 +292,18 @@ class Machine:
         return self.booted and self.connected
 
     def log(self, msg: str) -> None:
+        """
+        Log a message to console.
+        """
         self.logger.log(msg, {"machine": self.name})
 
     def log_serial(self, msg: str) -> None:
         self.logger.log_serial(msg, self.name)
 
     def nested(self, msg: str, attrs: dict[str, str] = {}) -> _GeneratorContextManager:
+        """
+        Get nested logger, optionally with extra attributes.
+        """
         my_attrs = {"machine": self.name}
         my_attrs.update(attrs)
         return self.logger.nested(msg, my_attrs)
@@ -357,6 +363,9 @@ class Machine:
             retry(check_active, timeout)
 
     def get_unit_info(self, unit: str, user: str | None = None) -> dict[str, str]:
+        """
+        Get a dictionary of systemd unit properties, as obtained via `systemctl show`.
+        """
         status, lines = self.systemctl(f'--no-pager show "{unit}"', user)
         if status != 0:
             raise RequestedAssertionFailed(
@@ -384,6 +393,9 @@ class Machine:
         property: str,
         user: str | None = None,
     ) -> str:
+        """
+        Get the string value of a single systemd unit property
+        """
         status, lines = self.systemctl(
             f'--no-pager show "{unit}" --property="{property}"',
             user,
@@ -431,6 +443,9 @@ class Machine:
         return self.execute(f"systemctl {q}")
 
     def require_unit_state(self, unit: str, require_state: str = "active") -> None:
+        """
+        Assert that the current state of a unit has a specific value. The default state is "active".
+        """
         with self.nested(
             f"checking if unit '{unit}' has reached state '{require_state}'"
         ):
@@ -648,6 +663,10 @@ class Machine:
             return output
 
     def wait_for_shutdown(self) -> None:
+        """
+        Wait for the VM to power off. This does *not* initiate a shutdown;
+        that's usually done via `shutdown()`.
+        """
         if not self.booted:
             return
 
@@ -687,6 +706,9 @@ class Machine:
                 raise TimeoutError
 
     def get_tty_text(self, tty: str) -> str:
+        """
+        Get the output printed to a given TTY.
+        """
         status, output = self.execute(
             f"fold -w$(stty -F /dev/tty{tty} size | awk '{{print $2}}') /dev/vcs{tty}"
         )
@@ -785,12 +807,22 @@ class Machine:
             retry(port_is_closed, timeout)
 
     def start_job(self, jobname: str, user: str | None = None) -> tuple[int, str]:
+        """
+        Start systemd service.
+        """
         return self.systemctl(f"start {jobname}", user)
 
     def stop_job(self, jobname: str, user: str | None = None) -> tuple[int, str]:
+        """
+        Stop systemd service.
+        """
         return self.systemctl(f"stop {jobname}", user)
 
     def connect(self) -> None:
+        """
+        Wait for a connection to the guest root shell
+        """
+
         def shell_ready(timeout_secs: int) -> bool:
             """We sent some data from the backdoor service running on the guest
             to indicate that the backdoor shell is ready.

nixos/modules/module-list.nix

@@ -502,7 +502,7 @@
   ./services/continuous-integration/buildkite-agents.nix
   ./services/continuous-integration/gitea-actions-runner.nix
   ./services/continuous-integration/github-runners.nix
-  ./services/continuous-integration/gitlab-runner.nix
+  ./services/continuous-integration/gitlab-runner/runner.nix
   ./services/continuous-integration/gocd-agent/default.nix
   ./services/continuous-integration/gocd-server/default.nix
   ./services/continuous-integration/hercules-ci-agent/default.nix

nixos/modules/services/computing/slurm/slurm.nix

@@ -336,31 +336,27 @@ in
 
   config =
     let
-      wrappedSlurm = pkgs.stdenv.mkDerivation {
-        name = "wrappedSlurm";
+      wrappedSlurm = pkgs.runCommand "wrappedSlurm" { } ''
+        mkdir -p $out/bin
+        find  ${lib.getBin cfg.package}/bin -type f -executable | while read EXE
+        do
+          exename="$(basename $EXE)"
+          wrappername="$out/bin/$exename"
+          cat > "$wrappername" <<EOT
+        #!/bin/sh
+        if [ -z "\$SLURM_CONF" ]
+        then
+          SLURM_CONF="${cfg.etcSlurm}/slurm.conf" "$EXE" "\$@"
+        else
+          "$EXE" "\$0"
+        fi
+        EOT
+          chmod +x "$wrappername"
+        done
 
-        builder = pkgs.writeText "builder.sh" ''
-          mkdir -p $out/bin
-          find  ${lib.getBin cfg.package}/bin -type f -executable | while read EXE
-          do
-            exename="$(basename $EXE)"
-            wrappername="$out/bin/$exename"
-            cat > "$wrappername" <<EOT
-          #!/bin/sh
-          if [ -z "$SLURM_CONF" ]
-          then
-            SLURM_CONF="${cfg.etcSlurm}/slurm.conf" "$EXE" "\$@"
-          else
-            "$EXE" "\$0"
-          fi
-          EOT
-            chmod +x "$wrappername"
-          done
-
-          mkdir -p $out/share
-          ln -s ${lib.getBin cfg.package}/share/man $out/share/man
-        '';
-      };
+        mkdir -p $out/share
+        ln -s ${lib.getBin cfg.package}/share/man $out/share/man
+      '';
 
     in
     lib.mkIf (cfg.enableStools || cfg.client.enable || cfg.server.enable || cfg.dbdserver.enable) {

nixos/modules/services/home-automation/home-assistant.nix

@@ -406,14 +406,15 @@ in
             http = {
               # https://www.home-assistant.io/integrations/http/
               server_host = mkOption {
-                type = types.either types.str (types.listOf types.str);
-                default = [
-                  "0.0.0.0"
-                  "::"
+                type = types.nullOr (types.either types.str (types.listOf types.str));
+                default = null;
+                example = [
+                  "::1"
+                  "127.0.0.1"
                 ];
-                example = "::1";
                 description = ''
-                  Only listen to incoming requests on specific IP/host. The default listed assumes support for IPv4 and IPv6.
+                  Only listen to incoming requests on specific IP/host.
+                  The option is unset by default, meaning that Home Assistant listens on all available addresses.
                 '';
               };
 

nixos/modules/services/misc/gitlab.md

@@ -10,6 +10,7 @@ configure a webserver to proxy HTTP requests to the socket.
 
 For instance, the following configuration could be used to use nginx as
 frontend proxy:
+
 ```nix
 {
   services.nginx = {
@@ -40,6 +41,7 @@ The default state dir is `/var/gitlab/state`. This is where
 all data like the repositories and uploads will be stored.
 
 A basic configuration with some custom settings could look like this:
+
 ```nix
 {
   services.gitlab = {
@@ -104,6 +106,7 @@ the [services.gitlab.backup.startAt](#opt-services.gitlab.backup.startAt)
 option to configure regular backups.
 
 To run a manual backup, start the `gitlab-backup` service:
+
 ```ShellSession
 $ systemctl start gitlab-backup.service
 ```
@@ -116,6 +119,116 @@ will have to run the command as the user that you configured to run
 GitLab with.
 
 A list of all available rake tasks can be obtained by running:
+
 ```ShellSession
 $ sudo -u git -H gitlab-rake -T
 ```
+
+## Runner {#module-services-gitlab-runner}
+
+GitLab Runner is a CI runner which is an executable which you can host yourself.
+A Gitlab pipeline runs operations over a Gitlab Runner. These can include
+building an executable, running a test suite, pushing a docker image, etc. The
+Gitlab Runner receives jobs from Gitlab which it then dispatches to the
+configured executors
+([`docker` (`podman`), or `shell` or `kubernetes`](https://docs.gitlab.com/runner/executors)).
+
+The
+[services.gitlab-runner.services](https://search.nixos.org/options?query=services.gitlab-runner.services)
+documents a number of typical setups to configure multiple runners with
+different executors.
+
+The [below example](#ex-gitlab-runner-podman) gives a **more elaborate** example how to
+configure a Gitlab Runner with caching and reasonably good security practices.
+
+::: {#ex-gitlab-runner-podman .example}
+
+## Example: Gitlab Runner with `podman` and Nix Store Caching
+
+The [VM tested `podman-runner`](https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/continuous-integration/gitlab-runner/runner.nix)
+(a NixOS module for reuse) configures an advanced Gitlab runner with the following features:
+
+- The executor is `podman` which gives you better additional safety than
+  `docker`. That means every job is run in a `podman` container.
+
+- The following container **images** are built with Nix:
+
+  **Container Images for Gitlab Jobs**:
+  - `local/alpine`: An image based on Alpine with a Nix installation
+    (attribute `jobImages.alpine`).
+  - `local/ubuntu`: An image based on Ubuntu with a Nix installation
+    (attribute `jobImages.ubuntu`).
+  - `local/nix`: An image based on Nix which only comes with `nix`
+    installed (attribute `jobImages.nix`).
+
+  **Images for VM Setup**:
+  - `local/nix-daemon-image`: An image with a Nix daemon which is
+    used to share the `/nix/store` across jobs (variable `nixDaemonImage`) setup with some essentials derivations `bootstrapPkgs`.
+  - `local/podman-daemon-image`: An image with `podman` running as a daemon which is
+    used to run `podman` inside the above job containers images
+    (variable `podmanDaemonImage`).
+
+- Every job container runs in a `podman` container instance based by default on
+  `jobImage.ubuntu`. A pipeline job can override this with `image: local/alpine`.
+  - Each job container will have the `/nix/store` mounted from the container
+    `nix-daemon-container` (see registration flags
+    `--docker-volumes-from "nix-daemon-container:ro"`).
+
+    The `nix-daemon-container` is a single container instance of a
+    `nixDaemonImage`. This enables caching of `/nix/store` paths across all jobs
+    in **all** runners. This makes **the host VM's `/nix/store` independent of the
+    Nix store used in the jobs**, which is good.
+
+    ::: {.note}
+    **Security:** If you don't want this you need multiple `nixDaemonImage`
+    containers for each registered runner (`gitlab-runner.services.<name>`).
+    :::
+
+  - Each job container will have the `/run/podman/podman.sock` socket mounted from the
+    `podman-daemon-container`.
+
+    The `podman-daemon-container` is a single container of a `podmanDaemonImage` which runs
+    `podman` as a daemon. Job containers can use this daemon to spawn nested containers as well (podman-in-podman).
+    **Keep in mind that `bind` mounts are local to the `podman-daemon-container`**
+    and can be be worked around with a `podman volume create <vol>` and manual copy-to/copy-from this volume `<vol>`.
+
+    If you only need to build containers you don't need this feature (`podman-daemon-container`), see below point.
+
+    Container configuration files (`auxRootFiles`) are copied to all containers to
+    ensure `podman` works consistently inside the job containers.
+
+  - The job containers do **not** mount the `podman` socket from the host (NixOS
+    VM) mounted for security reasons.
+
+    ::: {.note}
+    Building container images with `buildah` (stripped
+    `podman` for building images) inside a job which runs `jobImage.alpine`
+    is still possible.
+    :::
+
+  - **Cleanup Disk Space**:
+
+    With this setup its really easy to clean the `nix-daemon-container`
+    (e.g. if you run out of disk space), then reboot and have the runner in a clean state.
+    You can do the following to effectively clean everything and start with fresh volumes safely:
+
+    ```bash
+    # Stop the Gitlab runner.
+    systemctl stop gitlab-runner.service
+    # Stop `systemd`-managed containers, such that they get not recreated
+    # when deleting below.
+    systemctl stop podman-podman-daemon-container.service \
+                  podman-nix-daemon-container.service \
+                  podman-nix-container.service \
+                  podman-alpine-container.service \
+                  podman-ubuntu-container.service || true
+
+    podman container rm -f --all
+    podman image rm -f --all
+    podman volumes rm -f --all
+
+    reboot
+    # Systemd will restart all containers and create volumes etc.
+    ```
+
+:::

nixos/modules/services/web-apps/glance.nix

@@ -2,14 +2,13 @@
   config,
   lib,
   pkgs,
+  utils,
   ...
 }:
 let
   cfg = config.services.glance;
 
   inherit (lib)
-    catAttrs
-    concatMapStrings
     getExe
     mkEnableOption
     mkIf
@@ -18,17 +17,8 @@ let
     types
     ;
 
-  inherit (builtins)
-    concatLists
-    isAttrs
-    isList
-    attrNames
-    getAttr
-    ;
-
   settingsFormat = pkgs.formats.yaml { };
-  settingsFile = settingsFormat.generate "glance.yaml" cfg.settings;
-  mergedSettingsFile = "/run/glance/glance.yaml";
+  settingsFile = "/run/glance/glance.yaml";
 in
 {
   options.services.glance = {
@@ -180,41 +170,16 @@ in
       requires = [
         "nss-user-lookup.target"
       ];
-      path = [ pkgs.replace-secret ];
 
       serviceConfig = {
         ExecStartPre =
-          let
-            findSecrets =
-              data:
-              if isAttrs data then
-                if data ? _secret then
-                  [ data ]
-                else
-                  concatLists (map (attr: findSecrets (getAttr attr data)) (attrNames data))
-              else if isList data then
-                concatLists (map findSecrets data)
-              else
-                [ ];
-            secretPaths = catAttrs "_secret" (findSecrets cfg.settings);
-            mkSecretReplacement = secretPath: ''
-              replace-secret ${
-                lib.escapeShellArgs [
-                  "_secret: ${secretPath}"
-                  secretPath
-                  mergedSettingsFile
-                ]
-              }
-            '';
-            secretReplacements = concatMapStrings mkSecretReplacement secretPaths;
-          in
           # Use "+" to run as root because the secrets may not be accessible to glance
           "+"
           + pkgs.writeShellScript "glance-start-pre" ''
-            install -m 600 -o $USER ${settingsFile} ${mergedSettingsFile}
-            ${secretReplacements}
+            ${utils.genJqSecretsReplacementSnippet cfg.settings settingsFile}
+            chown $USER ${settingsFile}
           '';
-        ExecStart = "${getExe cfg.package} --config ${mergedSettingsFile}";
+        ExecStart = "${getExe cfg.package} --config ${settingsFile}";
         Restart = "on-failure";
         WorkingDirectory = "/var/lib/glance";
         EnvironmentFile = cfg.environmentFile;
@@ -245,5 +210,7 @@ in
   };
 
   meta.doc = ./glance.md;
-  meta.maintainers = [ ];
+  meta.maintainers = with lib.maintainers; [
+    gepbird
+  ];
 }

nixos/modules/tasks/filesystems/zfs.nix

@@ -24,10 +24,7 @@ let
     lib.filterAttrs (
       device: _:
       lib.any (
-        e:
-        e.fsType == "zfs"
-        && (utils.fsNeededForBoot e)
-        && (e.device == device || lib.hasPrefix "${device}/" e.device)
+        e: e.fsType == "zfs" && (e.device == device || lib.hasPrefix "${device}/" e.device)
       ) config.system.build.fileSystems
     ) config.boot.initrd.clevis.devices
   );
@@ -217,7 +214,7 @@ let
           if poolImported "${pool}"; then
           ${lib.optionalString config.boot.initrd.clevis.enable (
             lib.concatMapStringsSep "\n" (
-              elem: "clevis decrypt < /etc/clevis/${elem}.jwe | zfs load-key ${elem} || true "
+              elem: "clevis decrypt < /etc/clevis/${elem}.jwe | zfs load-key -L prompt ${elem} || true "
             ) (lib.filter (p: (lib.elemAt (lib.splitString "/" p) 0) == pool) clevisDatasets)
           )}
 

nixos/tests/all-tests.nix

@@ -643,7 +643,9 @@ in
   gitdaemon = runTest ./gitdaemon.nix;
   gitea = handleTest ./gitea.nix { giteaPackage = pkgs.gitea; };
   github-runner = runTest ./github-runner.nix;
-  gitlab = runTest ./gitlab.nix;
+  gitlab = import ./gitlab/default.nix {
+    inherit runTest;
+  };
   gitolite = runTest ./gitolite.nix;
   gitolite-fcgiwrap = runTest ./gitolite-fcgiwrap.nix;
   glance = runTest ./glance.nix;

nixos/tests/docker-tools-nix-shell.nix

@@ -17,7 +17,7 @@ in
       { ... }:
       {
         virtualisation = {
-          diskSize = 4000;
+          diskSize = 8000;
           docker.enable = true;
         };
       };

nixos/tests/gitlab/default.nix

@@ -0,0 +1,5 @@
+{ runTest }:
+{
+  gitlab = runTest ./gitlab.nix;
+  runner = runTest ./runner.nix;
+}

nixos/tests/gitlab/gitlab.nix

@@ -7,7 +7,7 @@
 # - Opening and closing issues.
 # - Downloading repository archives as tar.gz and tar.bz2
 # Run with
-# [nixpkgs]$ nix-build -A nixosTests.gitlab
+# [nixpkgs]$ nix-build -A nixosTests.gitlab.gitlab
 
 { pkgs, lib, ... }:
 

nixos/tests/gitlab/runner.nix

@@ -0,0 +1,178 @@
+# This test runs a gitlab-runner and performs the following tests in
+# two machines `gitlab` and `gitlab-runner`:
+# - Create runners in the `gitlab` machine for all runners in `./runner`.
+# - Inject the runner tokens into the `gitlab-runner.service` (machine `gitlab-runner`)
+#   which runs all runners:
+#     - Shell runner in `./runner/shell-runner`.
+# - Start the `gitlab-runner.service`.
+# - Check that all runners in `gitlab` are `active`.
+#
+# Run with
+# [nixpkgs]$ nix-build -A nixosTests.gitlab.runner
+
+{
+  pkgs,
+  lib,
+  ...
+}:
+
+let
+  initialRootPassword = "notproduction";
+
+  runnerTokenDir = "/run/secrets/gitlab-runner";
+
+  runnerConfigs = {
+    # The Gitlab runner where each job runs
+    # on the host (not containerized and very insecure).
+    shell = {
+      desc = "Shell runner (host NixOS shell, host Nix store)";
+      name = "shell";
+      tokenFile = "${runnerTokenDir}/token-shell.env";
+    };
+
+    # The Gitlab runner which uses the Docker runner (we use podman).
+    # Features:
+    #  - Daemonizes the Nix store into a container.
+    #  - All jobs run in an unprivileged container, e.g. with image
+    #    (`local/nix`, `local/alpine`, `local/ubuntu`)
+    podman = {
+      desc = "Podman runner (containers, shared containerized Nix store)";
+      name = "podman";
+      tokenFile = "${runnerTokenDir}/token-podman.env";
+    };
+  };
+in
+{
+  name = "gitlab-runner";
+  meta.maintainers = with lib.maintainers; [
+    gabyx
+  ];
+
+  nodes = {
+    gitlab-runner =
+      { ... }:
+      {
+        imports = [
+          ../common/user-account.nix
+          (import ./runner/shell-runner.nix {
+            runnerConfig = runnerConfigs.shell;
+          })
+        ]
+        # Only enable the podman runner on x86_64
+        # cause of built images.
+        ++ (lib.optional pkgs.stdenv.buildPlatform.isx86_64 (
+          import ./runner/podman-runner {
+            runnerConfig = runnerConfigs.podman;
+          }
+        ));
+
+        virtualisation = {
+          diskSize = 10000;
+        };
+
+        # Define the Gitlab Runner.
+        services.gitlab-runner = {
+          enable = true;
+
+          settings = {
+            log_level = "info";
+          };
+
+          gracefulTermination = false;
+        };
+      };
+    gitlab =
+      { config, ... }:
+      {
+        imports = [ ../common/user-account.nix ];
+
+        networking.firewall.allowedTCPPorts = [
+          config.services.nginx.defaultHTTPListenPort
+        ];
+
+        environment.systemPackages = with pkgs; [ git ];
+
+        virtualisation.memorySize = 6144;
+        virtualisation.cores = 4;
+
+        systemd.services.gitlab.serviceConfig.Restart = lib.mkForce "no";
+        systemd.services.gitlab-workhorse.serviceConfig.Restart = lib.mkForce "no";
+        systemd.services.gitaly.serviceConfig.Restart = lib.mkForce "no";
+        systemd.services.gitlab-sidekiq.serviceConfig.Restart = lib.mkForce "no";
+
+        services.nginx = {
+          enable = true;
+          recommendedProxySettings = true;
+          virtualHosts = {
+            localhost = {
+              locations."/".proxyPass = "http://unix:/run/gitlab/gitlab-workhorse.socket";
+            };
+          };
+        };
+
+        services.gitlab = {
+          enable = true;
+          databasePasswordFile = pkgs.writeText "dbPassword" "xo0daiF4";
+          initialRootPasswordFile = pkgs.writeText "rootPassword" initialRootPassword;
+          secrets = {
+            secretFile = pkgs.writeText "secret" "Aig5zaic";
+            otpFile = pkgs.writeText "otpsecret" "Riew9mue";
+            dbFile = pkgs.writeText "dbsecret" "we2quaeZ";
+            jwsFile = pkgs.runCommand "oidcKeyBase" { } "${pkgs.openssl}/bin/openssl genrsa 2048 > $out";
+            activeRecordPrimaryKeyFile = pkgs.writeText "arprimary" "vsaYPZjTRxcbG7W6gNr95AwBmzFUd4Eu";
+            activeRecordDeterministicKeyFile = pkgs.writeText "ardeterministic" "kQarv9wb2JVP7XzLTh5f6DFcMHms4nEC";
+            activeRecordSaltFile = pkgs.writeText "arsalt" "QkgR9CfFU3MXEWGqa7LbP24AntK5ZeYw";
+          };
+
+          # reduce memory usage
+          sidekiq.concurrency = 1;
+          puma.workers = 2;
+        };
+      };
+  };
+
+  testScript =
+    { nodes, ... }:
+    let
+      authPayload = pkgs.writeText "auth.json" (
+        builtins.toJSON {
+          grant_type = "password";
+          username = "root";
+          password = initialRootPassword;
+        }
+      );
+
+      runnerTokenEnv = pkgs.writeText "runner-token.env" ''
+        CI_SERVER_URL=http://gitlab
+        CI_SERVER_TOKEN=$token
+      '';
+
+      createRunnerPayload = pkgs.writeText "create-runner.json" (
+        builtins.toJSON {
+          runner_type = "instance_type";
+        }
+      );
+    in
+    # python
+    ''
+      # Define some globals for the python script below.
+      JQ_BINARY="${pkgs.jq}/bin/jq"
+      GITLAB_STATE_PATH="${nodes.gitlab.services.gitlab.statePath}"
+      RUNNER_TOKEN_ENV_FILE="${runnerTokenEnv}"
+      AUTH_PAYLOAD_FILE="${authPayload}"
+      CREATE_RUNNER_PAYLOAD_FILE="${createRunnerPayload}"
+
+      ${lib.readFile ./runner_test.py}
+
+      start_all()
+      wait_for_services()
+
+      # Run all tests.
+      test_connection()
+      test_register_runner(name="shell", tokenFile="${runnerConfigs.shell.tokenFile}")
+      test_register_runner(name="podman", tokenFile="${runnerConfigs.podman.tokenFile}")
+      restart_gitlab_runner_service(runnerConfigs)
+      test_runner_registered(runnerConfigs["shell"])
+      test_runner_registered(runnerConfigs["podman"])
+    '';
+}

nixos/tests/gitlab/runner/podman-runner/default.nix

@@ -0,0 +1,442 @@
+{ runnerConfig }:
+# Gitlab Runner Module
+#
+# This module will add a Gitlab-Runner
+# configured similar to https://wiki.nixos.org/wiki/Gitlab_runner
+# with a nix-daemon running in a podman container `nix-daemon-container`.
+#
+# - The volumes from the `nix-daemon-container` will get mounted to
+#   each job container which Gitlab starts, which gives them access
+#   to a commonly shared Nix store.
+#
+#   - The `/nix/store` inside the job container
+#     (either image `alpineImage` or `ubuntuImage` or `nixImage`)
+#     will be read-only and nix can only store stuff into this path by using the
+#     `NIX_DAEMON` env. variable which lets it communicate through the
+#     mounted daemon socket.
+
+#   - The `bootstrapPkgs` derivation is copied into the job containers
+#     but without the Nix store paths cause they get provided by the
+#     `nix-daemon-store` volume.
+# I cannot denote these volumes because they overmount the
+# shit which is in the image.
+# TODO: make a systemd service which starts before
+# that and creates some volumes and inits these from the image.
+#
+# - The `podman-daemon-socket` volume gets mounted to the job container
+#   enabling it to use `podman`.
+#   Note: The job container instance is not using the system `podman` running in NixOS.
+#   Its a dedicated podman service `podmanDaemonContainer`
+#   running as `--privileged`
+#   [non-rootless container](https://rootlesscontaine.rs/#what-are-rootless-containers-and-what-are-not).
+#   (TODO: This podman daemon instance could be maybe run as rootless
+#   container under a user `ci` and a separated Gitlab Runner could
+#   run over this socket, effectively run only rootless containers.)
+#
+# - There is also a job runner prebuild script which is started on every job.
+#   See `scripts/prebuild.nix` to setup some missing stuff.
+#
+# Debugging on the VM:
+#
+# - You can use `journalclt -u gitlab-runner.service`.
+#
+# - To run a job container use:
+#   ```bash
+#      podman run --rm -it
+#      --volumes-from 'nix-daemon-container'
+#      -v "podman-daemon-socket:/run/podman"
+#      "local/alpine" \
+#      bash -c "export CI_PIPkELINE_ID=123456 && gitlab-runner-prebuild-script; echo hello"
+#   ```
+{
+  lib,
+  pkgs,
+  ...
+}:
+let
+  nixRepo = pkgs.fetchFromGitHub {
+    owner = "NixOS";
+    repo = "nix";
+    rev = "2.32.4";
+    hash = "sha256-8QYnRyGOTm3h/Dp8I6HCmQzlO7C009Odqyp28pTWgcY=";
+  };
+
+  # Either we use a Nix as the base image or Alpine.
+  imageNames = {
+    default = imageNames.alpine;
+
+    alpine = "local/alpine";
+    nix = "local/nix";
+    ubuntu = "local/ubuntu";
+
+    all = with imageNames; [
+      alpine
+      nix
+      ubuntu
+    ];
+  };
+
+  noPruneLabels = {
+    no-prune = "true";
+  };
+
+  # This derivation will contain a folder `/etc`
+  files = pkgs.callPackage ./files { };
+  preBuildScript = pkgs.callPackage ./scripts/prebuild.nix { };
+
+  # These derivations are Linked into the job images root dir.
+  bootstrapPkgs = [
+    pkgs.nix
+    # Runtime dependencies of nix.
+    pkgs.gnutar
+    pkgs.gzip
+    pkgs.openssh
+    pkgs.xz
+    pkgs.cacert
+
+    # Other stuff.
+    (lib.hiPrio pkgs.coreutils)
+    (lib.hiPrio pkgs.findutils)
+    pkgs.openssh
+    pkgs.bashInteractive
+    (lib.hiPrio pkgs.git)
+    pkgs.cachix
+
+    pkgs.just
+    pkgs.podman # For nested containers.
+
+    preBuildScript
+
+    files.containers
+    files.nixConfig
+  ];
+
+  # All these packages are added to the Nix daemon.
+  nixStorePkgs = bootstrapPkgs ++ [
+    # These files
+    files.basicRoot
+    files.fakeNixpkgs
+  ];
+
+  toEnvList = envs: lib.mapAttrsToList (k: v: "${k}=${v}") envs;
+
+  # This is the Nix base image.
+  nixImageBase = pkgs.callPackage (import (nixRepo + "/docker.nix")) {
+    name = "local/nix-base";
+    tag = "latest";
+
+    bundleNixpkgs = false;
+    maxLayers = 2;
+
+    # You can add here a user with uid,gid,uname,gname etc.
+    # We are using root.
+
+    extraPkgs = nixStorePkgs;
+
+    nixConf = {
+      cores = "0";
+      experimental-features = [
+        "nix-command"
+        "flakes"
+      ];
+    };
+  };
+
+  # This is the daemon image which provides the store
+  # as volumes.
+  nixDaemonImage = pkgs.dockerTools.buildLayeredImage {
+    fromImage = nixImageBase;
+    name = "local/nix-daemon";
+    tag = "latest";
+
+    config = {
+      Volumes = {
+        "/nix/store" = { };
+        "/nix/var/nix/db" = { };
+        "/nix/var/nix/daemon-socket" = { };
+      };
+      Labels = noPruneLabels;
+    };
+    maxLayers = 4;
+  };
+
+  # This is the podman daemon image which enables
+  # a job image to use `podman` internally.
+  podmanDaemonImage =
+    let
+      # Update with:
+      # ```shell
+      # nix run "github:nixos/nixpkgs/nixos-unstable#nix-prefetch-docker" -- \
+      #    --image-name quay.io/podman/stable --image-tag v5.6.0
+      # ```
+      base = pkgs.dockerTools.pullImage {
+        imageName = "quay.io/podman/stable";
+        imageDigest = "sha256:7c9381b9af167cf2218831c3af3135856c99f488b543b78435c8f18e19ad739a";
+        hash = "sha256-pXXCu13fB/RN9qx8iLhE5Kko6glTrFrRhR7fo2OS7V0=";
+        finalImageName = "quay.io/podman/stable";
+        finalImageTag = "v5.6.0";
+      };
+    in
+    pkgs.dockerTools.buildLayeredImage {
+      fromImage = base;
+      name = "local/podman-daemon";
+      tag = "latest";
+
+      config = {
+        Labels = noPruneLabels;
+      };
+    };
+
+  jobImages =
+    let
+      extraCommands = ''
+        set -eu
+        # Set missing Nix directories.
+        mkdir -p -m 0755 nix/var/log/nix/drvs
+        mkdir -p -m 0755 nix/var/nix/{gcroots,profiles,temproots,userpool}
+        mkdir -p -m 1777 nix/var/nix/{gcroots,profiles}/per-user
+        mkdir -p -m 0755 nix/var/nix/profiles/per-user/root
+
+        # Need a HOME.
+        mkdir -vp root
+        mkdir -p -m 0700 root/.nix-defexpr
+      '';
+    in
+    {
+      # The Nix image.
+      # Similar to https://github.com/nix-community/docker-nixpkgs/blob/main/images/nix/default.nix.
+      nix = pkgs.dockerTools.buildLayeredImage {
+        name = imageNames.nix;
+        tag = "latest";
+
+        extraCommands = extraCommands + ''
+          set -eu
+          # For `/usr/bin/env`.
+          mkdir -p usr && ln -s ../bin usr/bin
+        '';
+
+        contents = bootstrapPkgs ++ [ files.basicRoot ];
+        # No store paths are copied into. We provide them by mounting the
+        # /nix/store.
+        includeStorePaths = false;
+
+        config = {
+          Labels = noPruneLabels;
+          Env = toEnvList envs.nix;
+        };
+        maxLayers = 2;
+      };
+
+      # This is the analog image to `local/nix` but Alpine based.
+      alpine =
+        let
+          # Update with:
+          # ```shell
+          # nix run "github:nixos/nixpkgs/nixos-unstable#nix-prefetch-docker" -- --image-name alpine --image-tag latest
+          # ```
+          alpineBase = pkgs.dockerTools.pullImage {
+            imageName = "alpine";
+            imageDigest = "sha256:beefdbd8a1da6d2915566fde36db9db0b524eb737fc57cd1367effd16dc0d06d";
+            sha256 = "0gf7wbjp37zbni3pz8vdgq1mss6mz69wynms0gqhq7lsxfmg9xj9";
+            finalImageName = "alpine";
+            finalImageTag = "latest";
+          };
+        in
+        (pkgs.dockerTools.buildLayeredImage {
+          fromImage = alpineBase;
+          name = imageNames.alpine;
+          tag = "latest";
+
+          inherit extraCommands;
+
+          contents = bootstrapPkgs;
+          # No store paths are copied into. We provide them by mounting the
+          # /nix/store.
+          includeStorePaths = false;
+
+          config = {
+            Labels = noPruneLabels;
+            Env = toEnvList envs.nix;
+          };
+
+          # Only if `build buildLayeredImage`.
+          maxLayers = 3;
+        });
+
+      # This is the analog image to `local/nix` but Ubuntu based.
+      ubuntu =
+        let
+          # Update with:
+          # ```shell
+          # nix run "github:nixos/nixpkgs/nixos-unstable#nix-prefetch-docker" -- \
+          #   --image-name ubuntu --image-tag latest
+          # ```
+          ubuntuBase = pkgs.dockerTools.pullImage {
+            imageName = "ubuntu";
+            imageDigest = "sha256:1e622c5f073b4f6bfad6632f2616c7f59ef256e96fe78bf6a595d1dc4376ac02";
+            hash = "sha256-aC8SgxdcMSaaU89YMr/uwE022Yqey2frmeZqr+L1xEU=";
+            finalImageName = "ubuntu";
+            finalImageTag = "latest";
+          };
+        in
+        (pkgs.dockerTools.buildLayeredImage {
+          fromImage = ubuntuBase;
+          name = imageNames.ubuntu;
+          tag = "latest";
+
+          inherit extraCommands;
+
+          contents = bootstrapPkgs;
+          # No store paths are copied into. We provide them by mounting the
+          # /nix/store.
+          includeStorePaths = false;
+
+          config = {
+            Labels = noPruneLabels;
+            Env = toEnvList envs.ubuntu;
+          };
+
+          # Only if `build buildLayeredImage`.
+          maxLayers = 3;
+        });
+    };
+
+  nixDaemonContainer = {
+    imageFile = nixDaemonImage;
+    image = "local/nix-daemon:latest";
+
+    volumes = [
+      "nix-daemon-store:/nix/store"
+      "nix-daemon-db:/nix/var/nix/db"
+      "nix-daemon-socket:/nix/var/nix/daemon-socket"
+    ];
+    cmd = [
+      "nix"
+      "daemon"
+    ];
+  };
+
+  podmanDaemonContainer = {
+    imageFile = podmanDaemonImage;
+    image = "local/podman-daemon:latest";
+    volumes = [
+      "podman-daemon-socket:/run/podman"
+      "podman-cache:/var/lib/container"
+      # Shared images, currently not needed.
+      "podman-shared:/var/lib/shared:ro"
+    ];
+    privileged = true;
+    cmd = [
+      "podman"
+      "system"
+      "service"
+      "--time=0"
+      "unix:///run/podman/podman.sock"
+      "--log-level"
+      "info"
+    ];
+  };
+
+  # Environment variables for all job containers.
+  envs = rec {
+    common = {
+      # Access to the nix daemon.
+      NIX_REMOTE = "daemon";
+      # Access to podman.
+      CONTAINER_HOST = "unix:///run/podman/podman.sock";
+
+      USER = "root";
+      PATH = "/nix/var/nix/profiles/default/bin:/nix/var/nix/profiles/default/sbin:/bin:/sbin:/usr/bin:/usr/sbin";
+
+      SSL_CERT_FILE = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt";
+      NIX_SSL_CERT_FILE = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt";
+
+      # For shells, source this file.
+      ENV = "${pkgs.nix}/etc/profile.d/nix-daemon.sh";
+      BASH_ENV = "${pkgs.nix}/etc/profile.d/nix-daemon.sh";
+
+      # Make a fake nixpkgs which throws when using
+      # `nix repl -f <nixpkgs>` for example.
+      NIX_PATH = "nixpkgs=${files.fakeNixpkgs}";
+    };
+
+    nix = common // {
+      IMAGE_OS_DIST = "nix";
+    };
+
+    alpine = common // {
+      IMAGE_OS_DIST = "alpine";
+    };
+
+    ubuntu = common // {
+      IMAGE_OS_DIST = "ubuntu";
+    };
+  };
+
+  registrationFlags = [
+    "--docker-volumes"
+    "gitlab-runner-scratch:/scratch"
+
+    "--docker-volumes"
+    "podman-daemon-socket:/run/podman"
+
+    "--docker-volumes-from"
+    "nix-daemon-container:ro"
+
+    "--docker-pull-policy"
+    "if-not-present"
+
+    "--docker-allowed-pull-policies"
+    "if-not-present"
+
+    "--docker-host"
+    "unix:///var/run/podman/podman.sock"
+
+    "--docker-network-mode"
+    "host"
+  ];
+
+in
+{
+  imports = [ ./virtualization.nix ];
+
+  virtualisation.oci-containers = {
+    backend = "podman";
+
+    containers = {
+      nix-daemon-container = nixDaemonContainer;
+      podman-daemon-container = podmanDaemonContainer;
+    }
+    //
+      # Workaround to add the job images to the registry.
+      (lib.concatMapAttrs (name: image: {
+        "${name}-container" = {
+          imageFile = jobImages.${name};
+          image = "${imageNames.${name}}:latest";
+          extraOptions = [
+            "--volumes-from"
+            "nix-daemon-container:ro"
+          ];
+          dependsOn = [ "nix-daemon-container" ];
+          cmd = [ "true" ];
+        };
+      }) jobImages);
+  };
+
+  # Define the Gitlab Runner.
+  services.gitlab-runner.services.podman-runner = {
+    description = runnerConfig.desc;
+
+    inherit registrationFlags;
+
+    authenticationTokenConfigFile = runnerConfig.tokenFile;
+
+    executor = "docker";
+    dockerImage = imageNames.default;
+    dockerAllowedImages = [ ];
+    dockerPrivileged = false;
+    requestConcurrency = 4;
+
+    preBuildScript = "${preBuildScript}/bin/gitlab-runner-pre-build-script";
+  };
+}

nixos/tests/gitlab/runner/podman-runner/files/basicRoot/etc/group

@@ -0,0 +1,21 @@
+root:x:0:
+wheel:x:1:
+kmem:x:2:
+tty:x:3:
+messagebus:x:4:
+disk:x:6:
+audio:x:17:
+floppy:x:18:
+uucp:x:19:
+lp:x:20:
+cdrom:x:24:
+tape:x:25:
+video:x:26:
+dialout:x:27:
+utmp:x:29:
+adm:x:55:
+keys:x:96:
+users:x:100:
+input:x:174:
+nixbld:x:30000:nixbld1,nixbld10,nixbld11,nixbld12,nixbld13,nixbld14,nixbld15,nixbld16,nixbld17,nixbld18,nixbld19,nixbld2,nixbld20,nixbld21,nixbld22,nixbld23,nixbld24,nixbld25,nixbld26,nixbld27,nixbld28,nixbld29,nixbld3,nixbld30,nixbld31,nixbld32,nixbld4,nixbld5,nixbld6,nixbld7,nixbld8,nixbld9
+nogroup:x:65534:

nixos/tests/gitlab/runner/podman-runner/files/basicRoot/etc/nsswitch.conf

@@ -0,0 +1,11 @@
+passwd:    files mymachines systemd
+group:     files mymachines systemd
+shadow:    files
+
+hosts:     files mymachines dns myhostname
+networks:  files
+
+ethers:    files
+services:  files
+protocols: files
+rpc:       files

nixos/tests/gitlab/runner/podman-runner/files/basicRoot/etc/passwd

@@ -0,0 +1,34 @@
+root:x:0:0:System administrator:/root:/bin/bash
+nixbld1:x:30001:30000:Nix build user 1:/var/empty:/run/current-system/sw/bin/nologin
+nixbld2:x:30002:30000:Nix build user 2:/var/empty:/run/current-system/sw/bin/nologin
+nixbld3:x:30003:30000:Nix build user 3:/var/empty:/run/current-system/sw/bin/nologin
+nixbld4:x:30004:30000:Nix build user 4:/var/empty:/run/current-system/sw/bin/nologin
+nixbld5:x:30005:30000:Nix build user 5:/var/empty:/run/current-system/sw/bin/nologin
+nixbld6:x:30006:30000:Nix build user 6:/var/empty:/run/current-system/sw/bin/nologin
+nixbld7:x:30007:30000:Nix build user 7:/var/empty:/run/current-system/sw/bin/nologin
+nixbld8:x:30008:30000:Nix build user 8:/var/empty:/run/current-system/sw/bin/nologin
+nixbld9:x:30009:30000:Nix build user 9:/var/empty:/run/current-system/sw/bin/nologin
+nixbld10:x:30010:30000:Nix build user 10:/var/empty:/run/current-system/sw/bin/nologin
+nixbld11:x:30011:30000:Nix build user 11:/var/empty:/run/current-system/sw/bin/nologin
+nixbld12:x:30012:30000:Nix build user 12:/var/empty:/run/current-system/sw/bin/nologin
+nixbld13:x:30013:30000:Nix build user 13:/var/empty:/run/current-system/sw/bin/nologin
+nixbld14:x:30014:30000:Nix build user 14:/var/empty:/run/current-system/sw/bin/nologin
+nixbld15:x:30015:30000:Nix build user 15:/var/empty:/run/current-system/sw/bin/nologin
+nixbld16:x:30016:30000:Nix build user 16:/var/empty:/run/current-system/sw/bin/nologin
+nixbld17:x:30017:30000:Nix build user 17:/var/empty:/run/current-system/sw/bin/nologin
+nixbld18:x:30018:30000:Nix build user 18:/var/empty:/run/current-system/sw/bin/nologin
+nixbld19:x:30019:30000:Nix build user 19:/var/empty:/run/current-system/sw/bin/nologin
+nixbld20:x:30020:30000:Nix build user 20:/var/empty:/run/current-system/sw/bin/nologin
+nixbld21:x:30021:30000:Nix build user 21:/var/empty:/run/current-system/sw/bin/nologin
+nixbld22:x:30022:30000:Nix build user 22:/var/empty:/run/current-system/sw/bin/nologin
+nixbld23:x:30023:30000:Nix build user 23:/var/empty:/run/current-system/sw/bin/nologin
+nixbld24:x:30024:30000:Nix build user 24:/var/empty:/run/current-system/sw/bin/nologin
+nixbld25:x:30025:30000:Nix build user 25:/var/empty:/run/current-system/sw/bin/nologin
+nixbld26:x:30026:30000:Nix build user 26:/var/empty:/run/current-system/sw/bin/nologin
+nixbld27:x:30027:30000:Nix build user 27:/var/empty:/run/current-system/sw/bin/nologin
+nixbld28:x:30028:30000:Nix build user 28:/var/empty:/run/current-system/sw/bin/nologin
+nixbld29:x:30029:30000:Nix build user 29:/var/empty:/run/current-system/sw/bin/nologin
+nixbld30:x:30030:30000:Nix build user 30:/var/empty:/run/current-system/sw/bin/nologin
+nixbld31:x:30031:30000:Nix build user 31:/var/empty:/run/current-system/sw/bin/nologin
+nixbld32:x:30032:30000:Nix build user 32:/var/empty:/run/current-system/sw/bin/nologin
+nobody:x:65534:65534:Unprivileged account (don't use!):/var/empty:/run/current-system/sw/bin/nologin

nixos/tests/gitlab/runner/podman-runner/files/containers/etc/containers/containers.conf

@@ -0,0 +1,2 @@
+[engine]
+cgroup_manager = "cgroupfs"

nixos/tests/gitlab/runner/podman-runner/files/containers/etc/containers/mounts.conf

@@ -0,0 +1,2 @@
+/run/secrets/etc-pki-entitlement:/run/secrets/etc-pki-entitlement
+/run/secrets/rhsm:/run/secrets/rhsm

nixos/tests/gitlab/runner/podman-runner/files/containers/etc/containers/policy.json

@@ -0,0 +1,12 @@
+{
+  "default": [
+    {
+      "type": "insecureAcceptAnything"
+    }
+  ],
+  "transports": {
+    "docker-daemon": {
+      "": [{ "type": "insecureAcceptAnything" }]
+    }
+  }
+}

nixos/tests/gitlab/runner/podman-runner/files/containers/etc/containers/registries.conf

@@ -0,0 +1,2 @@
+unqualified-search-registries = ["registry.fedoraproject.org", "registry.access.redhat.com", "docker.io"]
+short-name-mode = "enforcing"

nixos/tests/gitlab/runner/podman-runner/files/containers/etc/containers/registries.conf.d/000-shortnames.conf

@@ -0,0 +1,5 @@
+[aliases]
+  "buildah" = "quay.io/buildah/stable"
+  "podman" = "quay.io/podman/stable"
+  "alpine" = "docker.io/library/alpine"
+  "ubuntu" = "docker.io/library/ubuntu"

nixos/tests/gitlab/runner/podman-runner/files/containers/etc/containers/registries.d/default.yaml

@@ -0,0 +1,27 @@
+# This is a default registries.d configuration file.  You may
+# add to this file or create additional files in registries.d/.
+#
+# lookaside: for reading/writing simple signing signatures
+# lookaside-staging: for writing simple signing signatures, preferred over lookaside
+#
+# lookaside and lookaside-staging take a value of the following:
+#   lookaside:  {schema}://location
+#
+# For reading signatures, schema may be http, https, or file.
+# For writing signatures, schema may only be file.
+
+# The default locations are built-in, for both reading and writing:
+# /var/lib/containers/sigstore for root, or
+# ~/.local/share/containers/sigstore for non-root users.
+default-docker:
+#  lookaside: https://…
+#  lookaside-staging: file:///…
+
+# The 'docker' indicator here is the start of the configuration
+# for docker registries.
+#
+# docker:
+#
+#   privateregistry.com:
+#    lookaside: https://privateregistry.com/sigstore/
+#    lookaside-staging: /mnt/nfs/privateregistry/sigstore

nixos/tests/gitlab/runner/podman-runner/files/containers/etc/containers/registries.d/registry.access.redhat.com.yaml

@@ -0,0 +1,3 @@
+docker:
+  registry.access.redhat.com:
+    lookaside: https://access.redhat.com/webassets/docker/content/sigstore

nixos/tests/gitlab/runner/podman-runner/files/containers/etc/containers/registries.d/registry.redhat.io.yaml

@@ -0,0 +1,3 @@
+docker:
+  registry.redhat.io:
+    lookaside: https://registry.redhat.io/containers/sigstore

nixos/tests/gitlab/runner/podman-runner/files/containers/etc/containers/storage.conf

@@ -0,0 +1,15 @@
+[storage]
+driver = "overlay"
+runroot = "/run/containers/storage"
+graphroot = "/var/lib/containers/storage"
+
+[storage.options]
+additionalimagestores = [
+"/var/lib/shared",
+"/usr/lib/containers/storage",
+]
+pull_options = {enable_partial_images = "true", use_hard_links = "false", ostree_repos=""}
+
+[storage.options.overlay]
+mount_program = "/usr/bin/fuse-overlayfs"
+mountopt = "nodev,fsync=0"

nixos/tests/gitlab/runner/podman-runner/files/default.nix

@@ -0,0 +1,46 @@
+# Specific files for the job images.
+#
+# - `basicRoot`: Some basic root files for the `jobImages.nix`.
+# - `fakeNixpkgs`: A fake Nixpkg directory which is set as `NIX_PATH=nixpkgs:<path>`
+#                  which throws on load.
+# - `nixConfig`: The Nix config with some options.
+# - `containers`:
+#   These are some files which are copied to the job images needed for
+#   `buildah` (`podman`):
+#
+#   ```bash
+#   podman create --name temp-buildah quay.io/buildah/stable:latest
+#   podman cp temp-buildah:/etc/containers ./etc/
+#   find ./etc -type d -empty -delete
+#   podman container rm temp-buildah
+#```
+#
+{ pkgs, ... }:
+let
+
+  # We need proper derivations to add it to the nixImageBase.
+  mkDrv =
+    name: src:
+    pkgs.stdenv.mkDerivation {
+      inherit name src;
+      installPhase = ''
+        mkdir -p $out
+        cp -r $src/* $out/
+      '';
+    };
+in
+{
+  basicRoot = mkDrv "basic-root-files" ./basicRoot;
+  containers = mkDrv "containers-files" ./containers;
+  fakeNixpkgs = mkDrv "fake-nixpkgs" ./fake-nixpkgs;
+
+  nixConfig = pkgs.writeTextFile {
+    name = "nix.conf";
+    destination = "/etc/nix/nix.conf";
+    text = ''
+      accept-flake-config = true
+      experimental-features = nix-command flakes
+      max-jobs = auto
+    '';
+  };
+}

nixos/tests/gitlab/runner/podman-runner/files/fake-nixpkgs/default.nix

@@ -0,0 +1,10 @@
+_:
+throw ''
+  This container doesn't include nixpkgs.
+
+  The best way to work around that is to pin your dependencies. See
+    https://nix.dev/tutorials/first-steps/towards-reproducibility-pinning-nixpkgs.html
+
+  Or if you must, override the NIX_PATH environment variable with eg:
+    "NIX_PATH=nixpkgs=channel:nixos-unstable"
+''

nixos/tests/gitlab/runner/podman-runner/scripts/prebuild.nix

@@ -0,0 +1,55 @@
+{ writeShellScriptBin, nix }:
+writeShellScriptBin "gitlab-runner-pre-build-script"
+  # bash
+  ''
+    set -e
+    set -u
+
+    function section_start() {
+        local name="$1"
+        shift
+        echo -e "\e[0Ksection_start:$(date +%s):$name[collapsed=true]\r\e[0K$*"
+    }
+
+    function section_end() {
+        local name="$1"
+        echo -e "\e[0Ksection_end:$(date +%s):$name\r\e[0K"
+    }
+
+    function setup() {
+        # We need to allow modification of nix config for cachix as
+        # otherwise it is link to the read only file in the store.
+        cp --remove-destination \
+            "$(readlink -f /etc/nix/nix.conf)" /etc/nix/nix.conf
+
+        # shellcheck disable=SC1091
+        . "${nix}/etc/profile.d/nix-daemon.sh"
+    }
+
+    function setup_pipeline_scratch_dir() {
+        scratch_dir="/scratch/$CI_PIPELINE_ID"
+
+        echo "Create scrtach directory for pipeline: $scratch_dir"
+        mkdir -p "$scratch_dir" || {
+            echo "Could not create scratch dir '$scratch_dir'." >&2
+            exit 1
+        }
+
+        export CI_CUSTOM_SCRATCH_DIR="$scratch_dir"
+    }
+
+    function print_info() {
+      echo "Nix version:"
+      nix --version
+    }
+
+    function main() {
+        print_info
+        setup
+        setup_pipeline_scratch_dir
+    }
+
+    section_start gitlab-runner-prebuild "Gitlab-Runner PreBuild Script"
+    main "$@"
+    section_end gitlab-runner-prebuild
+  ''

nixos/tests/gitlab/runner/podman-runner/virtualization.nix

@@ -0,0 +1,43 @@
+{ lib, ... }:
+{
+  virtualisation.docker = {
+    enable = lib.mkForce false;
+  };
+
+  virtualisation.podman = {
+    enable = true;
+
+    # Create a `docker` alias for podman, to use it as a drop-in replacement
+    # dockerCompat = true;
+    dockerSocket = {
+      enable = true;
+    };
+
+    # Required for containers under podman-compose to be able to talk to each other.
+    defaultNetwork.settings.dns_enabled = true;
+
+    autoPrune = {
+      dates = "weekly";
+      flags = [
+        "--filter"
+        "label!=no-prune"
+        "--volumes"
+        "--log-level"
+        "debug"
+      ];
+    };
+  };
+
+  virtualisation.containers.storage.settings = {
+    storage = {
+      driver = "overlay";
+      graphroot = "/var/lib/containers/storage";
+      runroot = "/run/containers/storage";
+
+      # Does not work currently.
+      options.overlay = {
+        mountopt = "nodev,metacopy=on";
+      };
+    };
+  };
+}

nixos/tests/gitlab/runner/shell-runner.nix

@@ -0,0 +1,12 @@
+{
+  runnerConfig,
+}:
+# This is the runner config for the `nixosConfiguration.services.gitlab-runner.services.X`
+{
+  services.gitlab-runner.services.shell-runner = {
+    description = runnerConfig.desc;
+    authenticationTokenConfigFile = runnerConfig.tokenFile;
+
+    executor = "shell";
+  };
+}

nixos/tests/gitlab/runner_test.py

@@ -0,0 +1,146 @@
+import json
+import os
+from dataclasses import dataclass
+from pathlib import Path
+from string import Template
+from typing import Any
+
+
+@dataclass
+class Runner:
+    name: str
+    tokenFile: str
+
+    id: str
+    token: str
+
+
+@dataclass
+class Machines:
+    gitlab: Any
+    gitlab_runner: Any
+
+
+@dataclass
+class Nix:
+    jq: str
+    gitlab_state_path: str
+    create_runner_payload_file: str
+    auth_payload_file: str
+    runner_token_env_file: str
+
+
+# Some global variables to work in the tests.
+out_dir = os.environ.get("out", os.getcwd())
+nix = Nix(
+    jq=JQ_BINARY,
+    gitlab_state_path=GITLAB_STATE_PATH,
+    auth_payload_file=AUTH_PAYLOAD_FILE,
+    create_runner_payload_file=CREATE_RUNNER_PAYLOAD_FILE,
+    runner_token_env_file=RUNNER_TOKEN_ENV_FILE,
+)
+vms = Machines(gitlab, gitlab_runner)
+runnerConfigs: dict[str, Runner] = {}
+
+
+def wait_for_services():
+    vms.gitlab.wait_for_unit("gitaly.service")
+    vms.gitlab.wait_for_unit("gitlab-workhorse.service")
+    vms.gitlab.wait_for_unit("gitlab.service")
+    vms.gitlab.wait_for_unit("gitlab-sidekiq.service")
+    vms.gitlab.wait_for_file(f"{nix.gitlab_state_path}/tmp/sockets/gitlab.socket")
+    vms.gitlab.wait_until_succeeds("curl -sSf http://gitlab/users/sign_in")
+
+
+def test_connection():
+    """
+    Test the connection to Gitlab and check if it is reachable from the runner VM.
+    """
+
+    print("==> Getting secrets and headers.")
+    vms.gitlab.succeed(
+        "cp /var/gitlab/state/config/secrets.yml /root/gitlab-secrets.yml"
+    )
+
+    vms.gitlab.succeed(
+        f"echo \"Authorization: Bearer $(curl -X POST -H 'Content-Type: application/json' -d @{nix.auth_payload_file} http://gitlab/oauth/token | {nix.jq} -r '.access_token')\" >/tmp/headers"
+    )
+
+    vms.gitlab.copy_from_vm("/tmp/headers")
+    out_dir = os.environ.get("out", os.getcwd())
+    vms.gitlab_runner.copy_from_host(str(Path(out_dir, "headers")), "/tmp/headers")
+
+    print("==> Testing connection.")
+    vms.gitlab_runner.succeed("curl -v -H @/tmp/headers http://gitlab/api/v4/version")
+
+
+def test_register_runner(name: str, tokenFile: str):
+    """
+    Register the runner in Gitlab and write the token file to be picked up by
+    the gitlab-runner service on the other VM.
+    """
+
+    r = Runner(
+        name=name,
+        tokenFile=tokenFile,
+        token="",
+        id="",
+    )
+    runnerConfigs[r.name] = r
+
+    print(f"==> Create Runner '{r.name}'")
+    resp = vms.gitlab.execute(
+        f"""
+    curl -s -X POST \
+        -H 'Content-Type: application/json' \
+        -H @/tmp/headers \
+        -d @{nix.create_runner_payload_file} \
+        http://gitlab/api/v4/user/runners
+    """
+    )[1]
+    obj = json.loads(resp)
+    r.id = obj["id"]
+    r.token = obj["token"]
+    print(f"==> Registered runner '{r.id}' with token '{r.token}'.")
+
+    # Push the token to the runner machine.
+    print("==> Push runner token to machine.")
+    tokenF = Path(out_dir, f"token-{r.name}.env")
+    with open(nix.runner_token_env_file, "r") as f:
+        tokenData = Template(f.read()).substitute({"token": r.token})
+    with open(tokenF, "w") as w:
+        w.write(tokenData)
+    vms.gitlab_runner.copy_from_host(str(tokenF), r.tokenFile)
+
+
+def restart_gitlab_runner_service(runnerConfigs):
+    print("==> Restart Gitlab Runner")
+
+    if any([n == "podman" for n in runnerConfigs.keys()]):
+        vms.gitlab_runner.wait_for_unit("podman-nix-daemon-container.service")
+        vms.gitlab_runner.wait_for_unit("podman-podman-daemon-container.service")
+
+    vms.gitlab_runner.systemctl("restart gitlab-runner.service")
+    vms.gitlab_runner.wait_for_unit("gitlab-runner.service")
+
+
+def test_runner_registered(r: Runner):
+    """
+    Test that the runner `r` is registered in Gitlab and its status is active.
+    """
+
+    print(f"==> Check that runner '{r.name}' is registered.")
+
+    resp = vms.gitlab.execute(
+        f"""
+        curl -s -X GET \
+        -H 'Content-Type: application/json' \
+        -H @/tmp/headers \
+        http://gitlab/api/v4/runners/{r.id}"""
+    )[1]
+    runnerStatus = json.loads(resp)
+
+    if not runnerStatus["active"]:
+        raise Exception(
+            f"Runner '{r.name}' [id: '{r.id}'] status is not active: {resp}"
+        )

nixos/tests/nixos-rebuild-target-host.nix

@@ -31,6 +31,8 @@
         system.build.privateKey = snakeOilPrivateKey;
         system.build.publicKey = snakeOilPublicKey;
         system.switch.enable = true;
+
+        services.getty.autologinUser = lib.mkForce "root";
       };
 
     target =
@@ -147,6 +149,7 @@
 
       deployer.copy_from_host("${configFile "config-1-deployed"}", "/root/configuration-1.nix")
       deployer.copy_from_host("${configFile "config-2-deployed"}", "/root/configuration-2.nix")
+      deployer.copy_from_host("${configFile "config-3-deployed"}", "/root/configuration-3.nix")
       deployer.copy_from_host("${targetNetworkJSON}", "/root/target-network.json")
       deployer.copy_from_host("${targetConfigJSON}", "/root/target-configuration.json")
 
@@ -164,6 +167,15 @@
         target_hostname = deployer.succeed("ssh alice@target cat /etc/hostname").rstrip()
         assert target_hostname == "config-2-deployed", f"{target_hostname=}"
 
+      with subtest("Deploy to bob@target with password-based sudo"):
+        deployer.wait_for_unit("multi-user.target")
+        deployer.send_chars("nixos-rebuild switch -I nixos-config=/root/configuration-3.nix --target-host bob@target --ask-sudo-password\n")
+        deployer.wait_until_tty_matches("1", "password for bob")
+        deployer.send_chars("${nodes.target.users.users.bob.password}\n")
+        deployer.wait_until_tty_matches("1", "Done. The new configuration is /nix/store/.*config-3-deployed")
+        target_hostname = deployer.succeed("ssh alice@target cat /etc/hostname").rstrip()
+        assert target_hostname == "config-3-deployed", f"{target_hostname=}"
+
       with subtest("Deploy works with very long TMPDIR"):
         tmp_dir = "/var/folder/veryveryveryveryverylongpathnamethatdoesnotworkwithcontrolpath"
         deployer.succeed(f"mkdir -p {tmp_dir}")

nixos/tests/vector/journald-clickhouse.nix

@@ -199,11 +199,11 @@ in
         )
 
       clickhouse.fail(
-        "cat ${selectQuery} | clickhouse-client --user vector --password helloclickhouseworld | grep 2"
+        "cat ${selectQuery} | clickhouse-client --user vector --password helloclickhouseworld | grep -v 0"
       )
 
       clickhouse.wait_until_succeeds(
-        "cat ${selectQuery} | clickhouse-client --user grafana --password helloclickhouseworld2 | grep 2"
+        "cat ${selectQuery} | clickhouse-client --user grafana --password helloclickhouseworld2 | grep -v 0"
       )
     '';
 }

nixos/tests/zfs.nix

@@ -209,6 +209,11 @@ in
     kernelPackages = pkgs.linuxPackages;
   };
 
+  series_2_4 = makeZfsTest {
+    zfsPackage = pkgs.zfs_2_4;
+    kernelPackages = pkgs.linuxPackages;
+  };
+
   unstable = makeZfsTest {
     zfsPackage = pkgs.zfs_unstable;
     kernelPackages = pkgs.linuxPackages;

pkgs/applications/audio/youtube-music/default.nix

@@ -7,11 +7,12 @@
   python3,
   copyDesktopItems,
   nodejs,
-  pnpm,
+  pnpm_10,
+  fetchPnpmDeps,
+  pnpmConfigHook,
   makeDesktopItem,
   nix-update-script,
 }:
-
 stdenv.mkDerivation (finalAttrs: {
   pname = "youtube-music";
   version = "3.11.0";
@@ -28,8 +29,9 @@ stdenv.mkDerivation (finalAttrs: {
     ./fix-mpris-desktop-entry.patch
   ];
 
-  pnpmDeps = pnpm.fetchDeps {
+  pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
+    pnpm = pnpm_10;
     fetcherVersion = 2;
     hash = "sha256-xZQ8rnLGD0ZxxUUPLHmNJ6mA+lnUHCTBvtJTiIPxaZU=";
   };
@@ -38,7 +40,8 @@ stdenv.mkDerivation (finalAttrs: {
     makeWrapper
     python3
     nodejs
-    pnpm.configHook
+    pnpmConfigHook
+    pnpm_10
   ]
   ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [ copyDesktopItems ];
 

pkgs/applications/editors/eclipse/default.nix

@@ -11,10 +11,8 @@
   zlib,
   glib,
   gtk3,
-  gtk2,
   libXtst,
   jdk,
-  jdk8,
   gsettings-desktop-schemas,
   webkitgtk_4_1 ? null, # for internal web browser
   buildEnv,
@@ -22,10 +20,12 @@
   callPackage,
 }:
 
-# use ./update.sh to help with updating for each quarterly release
+# ./update.sh fully automates updating for each quarterly release.  you can run
+# it manually, or wait for https://nix-community.github.io/nixpkgs-update/ to do
+# so.
 #
-# then, to test:
-# for e in cpp dsl embedcpp modeling platform sdk java jee committers rcp; do for s in pkgs pkgsCross.aarch64-multiplatform; do echo; echo $s $e; nix-build -A ${s}.eclipses.eclipse-${e} -o eclipse-${s}-${e}; done; done
+# then, to test (on x86_64):
+# for e in $(cat pkgs/applications/editors/eclipse/eclipses.json | jq '.eclipses | keys | .[] | ascii_downcase' -r); do for s in pkgs pkgsCross.aarch64-multiplatform; do echo; echo $s $e; nix-build -A ${s}.eclipses.eclipse-${e} -o eclipse-${s}-${e}; done; done
 
 let
   eclipses = lib.trivial.importJSON ./eclipses.json;

pkgs/applications/editors/eclipse/eclipses.json

@@ -1,90 +1,90 @@
 {
   "platform_major": "4",
-  "platform_minor": "37",
-  "version": "4.37",
+  "platform_minor": "38",
+  "version": "4.38",
   "year": "2025",
-  "month": "09",
-  "buildmonth": "09",
-  "dayHourMinute": "050730",
+  "month": "12",
+  "buildmonth": "12",
+  "dayHourMinute": "010920",
   "eclipses": {
     "cpp": {
       "description": "Eclipse IDE for C/C++ Developers",
       "dropUrl": false,
       "hashes": {
-        "x86_64": "sha256-La+sX7ouIfvgbXPNIlmkpDzwwiT5VJfkl4ma4eFKjqw=",
-        "aarch64": "sha256-U1kFulGX7apNrlY3WPeu/FqQqu3SoxfsHHErbAscFtE="
+        "x86_64": "sha256-wlYGwfxKnF26qMSrUl0fsTDbECgXIL+ZIAr1BzwnK1Y=",
+        "aarch64": "sha256-xuTi++OZzj+jh7edNi3WQN0ie0HJB0Zrg023MT3px/c="
       }
     },
     "dsl": {
       "description": "Eclipse IDE for Java and DSL Developers",
       "dropUrl": false,
       "hashes": {
-        "x86_64": "sha256-8zXSMxKKTPnL8rqW7YT+6Gtud1pyHFmcLKOSihJWjCA=",
-        "aarch64": "sha256-7nsn3iWBp9N/mdcpyPH7j5tfV+sL/jCTuhvpDHmKx8I="
+        "x86_64": "sha256-I6AcXthzv/uLlO5+Y27ZsbeftA3zzvUlApISsquS0sY=",
+        "aarch64": "sha256-j0gj5Tcfbyj3sQ6gHEexee6d4SNbOYMODTeZDbKbUBo="
       }
     },
     "embedcpp": {
       "description": "Eclipse IDE for Embedded C/C++ Developers",
       "dropUrl": false,
       "hashes": {
-        "x86_64": "sha256-48cEpt11ndShjxUCQDX2ObI+cx9frGloJ7EICjmErC8=",
-        "aarch64": "sha256-zSMDR+Y4JIdu+PoYFyk+FPNKcYbRiika2TeGg3g88pg="
+        "x86_64": "sha256-sPyqRadyBQ24oO38bEy4VP4dTj6V+FwMVjxyniyTn5o=",
+        "aarch64": "sha256-CahsB9yBC8bLzwdfOOaidsP1VXXiELoot+DN8Zz2QqU="
       }
     },
     "modeling": {
       "description": "Eclipse Modeling Tools",
       "dropUrl": false,
       "hashes": {
-        "x86_64": "sha256-9Qq5ziLa2vjX6bJjZ67qwF4nVNdqTQ80kz9GANtJCIw=",
-        "aarch64": "sha256-6//g6G3U1fC5mGgOci6Zgxx3YTJEZQ2pMBVjbJ9/mPE="
+        "x86_64": "sha256-jw1Ij7HG8J9usWT6cKXeZbZDxQTWp2pBZtG2BdU2Guw=",
+        "aarch64": "sha256-e4ieVltHzhBLGEh3NNKrKcfOyUQd0avIrhUB1CYbQls="
       }
     },
     "platform": {
       "description": "Eclipse Platform ${year}-${month}",
       "dropUrl": true,
       "hashes": {
-        "x86_64": "sha256-C8P9x7C0tMYFQwJiBlF5JycWvWcF71ZWsDEwXPl1K34=",
-        "aarch64": "sha256-8qpNqHpi1BEHQt3nkFbeLzQccPSwu0op2THyWulhnLU="
+        "x86_64": "sha256-gicPSSoWyisPTUQXu3ndWrcNiCTgIaCnVCZbTFWp6Cc=",
+        "aarch64": "sha256-WSs9Y7iwhd+Wd4RQ/DMFGqIR4RjlceJgPCE2BSa55so="
       }
     },
     "SDK": {
       "description": "Eclipse ${year}-${month} Classic",
       "dropUrl": true,
       "hashes": {
-        "x86_64": "sha256-Kx9WEpu4UbCeeKfmWV0iIyAd09xh9ffHm39dahlIlW8=",
-        "aarch64": "sha256-MWI2KpZQPTbw7Ro0+3Ab+nnIzbSTPGwqjhBfeu4tmE8="
+        "x86_64": "sha256-Vx8mnR81KpikZZikNwaHCz+KEfWd3Jvkzf9A6Chc0TE=",
+        "aarch64": "sha256-VMcPmucV+hZ88nnhdsklXqrrUFG5lrZLeYmC1XC5Wo4="
       }
     },
     "java": {
       "description": "Eclipse IDE for Java Developers",
       "dropUrl": false,
       "hashes": {
-        "x86_64": "sha256-L5vqC+jboYQAR+CtNAEXgDACxEG0r1rlx4ruc264cUc=",
-        "aarch64": "sha256-xxZjwmF24CbKeK7IQXkgylFTTGIHo1Wz6FnL/EUmCaQ="
+        "x86_64": "sha256-Us5HNoQOt9OaTVAhVlFPMqAXD8hZkLs0IGppSpj2UuY=",
+        "aarch64": "sha256-SHgHlicA30Q7W6yNTGUgaovMYXIHohbhksbJKIRSFGk="
       }
     },
     "jee": {
       "description": "Eclipse IDE for Enterprise Java and Web Developers",
       "dropUrl": false,
       "hashes": {
-        "x86_64": "sha256-bFCbFLRtltZ/GJwAoFd3MH/FknDF6hnvX9LQHQs9eKg=",
-        "aarch64": "sha256-DXw/dt4Gjz0e7szjJUaKB3wsUdnNj3wCX8cVpMlYkCc="
+        "x86_64": "sha256-z0nj/7dmlqjEE+PQEjJngf3GmTIc6O8F8TJm7yBFrQE=",
+        "aarch64": "sha256-MDBT9OJWBRd0twY5XoBukQaBTG1IP3xKE0g9kc86a/8="
       }
     },
     "committers": {
       "description": "Eclipse IDE for Eclipse Committers and Eclipse Platform Plugin Developers",
       "dropUrl": false,
       "hashes": {
-        "x86_64": "sha256-HF1RuiuDGFxwxFQrXXUcpssA4SnioTYGSjQrF0H/F2Q=",
-        "aarch64": "sha256-ZZ7Wy6Nua4sKPlFv/LaiM+pRrF23PEuUVK4I5rA40Sk="
+        "x86_64": "sha256-meelcKp5AgfVCi13scA0TbPgkK9XsPvtS8HkyAYcUZs=",
+        "aarch64": "sha256-c/FxP0Snx70bkhZ+owkg/DFXu3AWdJtrPCKyqIqKfPs="
       }
     },
     "rcp": {
       "description": "Eclipse IDE for RCP and RAP Developers",
       "dropUrl": false,
       "hashes": {
-        "x86_64": "sha256-jxLIw4MaLqAi+b6l6lf56cb9z7J8NBUJYbbxhv65uSc=",
-        "aarch64": "sha256-A+3dk2FZaXBO/pb9F/33imO0Fk6j4zszLfnDsP+znG4="
+        "x86_64": "sha256-0OgiJ11wMGeR1UjoLd3yoApDMhy3oZ1y4P2OxSJyRQA=",
+        "aarch64": "sha256-IywPOyQlZXTrJdjiRDVAKwlxMZ1+FvN/uxYYoJ++ez8="
       }
     }
   }

pkgs/applications/editors/eclipse/update.sh

@@ -58,8 +58,19 @@ for id in $(cat $ECLIPSES_JSON | jq -r '.eclipses | keys | .[]'); do
             url="https://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/technology/epp/downloads/release/${year}-${month}/R/eclipse-${id}-${year}-${month}-R-linux-gtk-${arch}.tar.gz";
         fi
 
-        echo "prefetching ${id} ${arch}";
-        h=$(nix store prefetch-file --json "$url" | jq -r .hash);
+        # sometimes a mirror is down; retrying a few times should eventually get us redirected to a working mirror
+        for try in $(seq 1 5); do
+            echo "prefetching ${id} ${arch} (try ${try})";
+            h=$(nix store prefetch-file --json "$url" | jq -r .hash);
+
+            if [ "$h" != "" ]; then break; fi
+        done
+
+        if [ "$h" == "" ]; then
+            echo "unable to prefetch and hash ${id} for ${arch} from ${url}";
+            echo "see above output for errors";
+            exit 1;
+        fi
 
         t=$(mktemp);
         cat $ECLIPSES_JSON | jq -r ".eclipses.${id}.hashes.${arch} = \"${h}\"" > $t;

pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix

@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "claude-code";
     publisher = "anthropic";
-    version = "2.0.72";
-    hash = "sha256-nfzcm8lEtZl3vD129rtpV4Oc5vKW7SKyZHfFg1jd8hU=";
+    version = "2.0.73";
+    hash = "sha256-JmhdWX0ukTjb45dydLmKF1UAX1RMc89izgvuMtmdiUI=";
   };
 
   meta = {

pkgs/applications/editors/vscode/extensions/eamodio.gitlens/default.nix

@@ -4,6 +4,8 @@
   stdenv,
   fetchFromGitHub,
   pnpm,
+  fetchPnpmDeps,
+  pnpmConfigHook,
   nodejs,
   vscode-utils,
   nix-update-script,
@@ -22,7 +24,7 @@ let
       hash = "sha256-9XEv50WIG1BJenY9MswES6d72Ead2VqW5dgBr7Eu8ek=";
     };
 
-    pnpmDeps = pnpm.fetchDeps {
+    pnpmDeps = fetchPnpmDeps {
       inherit (finalAttrs) pname version src;
       fetcherVersion = 2;
       hash = "sha256-QHITHoaz/lzZ3Th/YPlQayFMU9rtlnAZWEYkLyBuAkc=";
@@ -36,7 +38,7 @@ let
 
     nativeBuildInputs = [
       nodejs
-      pnpm.configHook
+      pnpmConfigHook
       pnpm
     ];
 

pkgs/applications/editors/vscode/extensions/kilocode.kilo-code/default.nix

@@ -3,6 +3,8 @@
   stdenvNoCC,
   fetchFromGitHub,
   pnpm,
+  fetchPnpmDeps,
+  pnpmConfigHook,
   nodejs,
   vscode-utils,
   nix-update-script,
@@ -21,7 +23,7 @@ let
       hash = "sha256-Dy0dd07pWsSbrO6BX7GEYf7CunXD0itaeIFRv9mQJks=";
     };
 
-    pnpmDeps = pnpm.fetchDeps {
+    pnpmDeps = fetchPnpmDeps {
       inherit (finalAttrs) pname version src;
       fetcherVersion = 2;
       hash = "sha256-hxgzmJD+Sl7E+ape1M1/Xl8XLtAhtht3AE45zHFctsQ=";
@@ -29,7 +31,7 @@ let
 
     nativeBuildInputs = [
       nodejs
-      pnpm.configHook
+      pnpmConfigHook
       pnpm
     ];
 

pkgs/applications/editors/vscode/extensions/rooveterinaryinc.roo-cline/default.nix

@@ -3,6 +3,8 @@
   stdenvNoCC,
   fetchFromGitHub,
   pnpm,
+  fetchPnpmDeps,
+  pnpmConfigHook,
   nodejs,
   vscode-utils,
   nix-update-script,
@@ -21,7 +23,7 @@ let
       hash = "sha256-YO3TxKcCDoIJeBoMGFFrHUp6lne1e84Tf1I2vHF6w1c=";
     };
 
-    pnpmDeps = pnpm.fetchDeps {
+    pnpmDeps = fetchPnpmDeps {
       inherit (finalAttrs) pname version src;
       fetcherVersion = 2;
       hash = "sha256-k6Bw6MlFDNPNPdaKJ7tW8wje2j9LJvREtlAWyySnOC0=";
@@ -29,7 +31,7 @@ let
 
     nativeBuildInputs = [
       nodejs
-      pnpm.configHook
+      pnpmConfigHook
       pnpm
     ];
 

pkgs/applications/editors/vscode/extensions/sourcegraph.amp/default.nix

@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     publisher = "sourcegraph";
     name = "amp";
-    version = "0.0.1765541481";
-    hash = "sha256-LE4IsnLa5fI5hdhrrMzqhdomvDa6gMpTPtQ+xkGSyWo=";
+    version = "0.0.1766080982";
+    hash = "sha256-bLW3jLXfTZTNJ8FENYSFSYk5lZCqX0F+zm9HyMWn8cg=";
   };
 
   meta = {

pkgs/applications/emulators/libretro/cores/mame2003-plus.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "mame2003-plus";
-  version = "0-unstable-2025-12-10";
+  version = "0-unstable-2025-12-13";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "mame2003-plus-libretro";
-    rev = "26cc26baf1357a581581ea5b3b6978391373d0a8";
-    hash = "sha256-J+EOHXdkPDYGgXgGJ4y4I6fRIv8lg4SqOCt14X6foTo=";
+    rev = "b235c48df0698bca32d941ecc0d046cfe6eb7eef";
+    hash = "sha256-/QFg5Ns6csHfGIHMm50x8j0Twq44/VETFavJd5WVKZU=";
   };
 
   makefile = "Makefile";

pkgs/applications/emulators/libretro/cores/mame2003.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "mame2003";
-  version = "0-unstable-2025-10-21";
+  version = "0-unstable-2025-12-13";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "mame2003-libretro";
-    rev = "3570605767a447c13b087a5946189bcbafe11e1d";
-    hash = "sha256-BcPiNYEi6uE8aSpPDNgZ8vmzSnZJUparEM3CEdexbPo=";
+    rev = "6c32fa9fc005d7e924909c6ff4684da9abb00ceb";
+    hash = "sha256-NPPwLruxafBUwKYy+DuLrTZa5QlbneWQSvCRN6ispdM=";
   };
 
   # Fix build with GCC 14

pkgs/applications/emulators/libretro/cores/ppsspp.nix

@@ -13,13 +13,13 @@
 }:
 mkLibretroCore {
   core = "ppsspp";
-  version = "0-unstable-2025-12-10";
+  version = "0-unstable-2025-12-16";
 
   src = fetchFromGitHub {
     owner = "hrydgard";
     repo = "ppsspp";
-    rev = "5a67eb5cc5e3b3248de513e95741ca47b87bedb4";
-    hash = "sha256-FH7Wp8CBKt/5G/sXZ7hSbCFRMopBoID0ho/XtS13400=";
+    rev = "dd112491db181114723fed270a1c45ffc1355539";
+    hash = "sha256-NMUpmJySZPcyo/niIohxbXG5MfkyKCdeEF9O8ZPKe8g=";
     fetchSubmodules = true;
   };
 

pkgs/applications/emulators/libretro/cores/twenty-fortyeight.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "2048";
-  version = "0-unstable-2024-12-27";
+  version = "0-unstable-2025-12-13";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "libretro-2048";
-    rev = "86e02d3c2dd76858db7370f5df1ccfc33b3abee1";
-    hash = "sha256-k3te3XZCw86NkqXpjZaYWi4twUvh9UBkiPyqposLTEs=";
+    rev = "e70c3f82d2b861c64943aaff7fcc29a63013997d";
+    hash = "sha256-ZNJUaXIQi9VnmmCikhCtXfhbTZ7rfJ1wm/582gaZCmk=";
   };
 
   meta = {

pkgs/applications/networking/browsers/chromium/info.json

@@ -813,7 +813,7 @@
     }
   },
   "ungoogled-chromium": {
-    "version": "143.0.7499.109",
+    "version": "143.0.7499.146",
     "deps": {
       "depot_tools": {
         "rev": "e2bb3cd55899346cc68bbfd5139e59c9d85a6984",
@@ -825,16 +825,16 @@
         "hash": "sha256-kIPhfuJBQSISdRjloe0N2JrqvuVrEkNijb92/9zSE9I="
       },
       "ungoogled-patches": {
-        "rev": "143.0.7499.109-1",
-        "hash": "sha256-IiIQqo6U0yqBxamrlQ56FSViQ0mPUoM1yGZkVAur8is="
+        "rev": "143.0.7499.146-1",
+        "hash": "sha256-GHJ/xdEaaNdXJzn3XdY9xoVPYH5HxH1T7kPgvrdi+9s="
       },
       "npmHash": "sha256-HF6B4abJJJ9JDVbovtAdaHIvqE1zHJZ2a+g2Cudx8Pw="
     },
     "DEPS": {
       "src": {
         "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "71a0dbd6672e2ccb6d1008376cbb7acd315cb8d6",
-        "hash": "sha256-K7HzC+M7WIMsyB4Wuy04WvGAX+QsTN5daOhkox1wxnA=",
+        "rev": "c1224fc40c96e7f17f0cdeb87a8f4c64b93c0d74",
+        "hash": "sha256-Sn4j7vs7g/D9GnL+BMCyg73iEeGn7Miq0k42mV6Z3hM=",
         "recompress": true
       },
       "src/third_party/clang-format/script": {
@@ -944,8 +944,8 @@
       },
       "src/third_party/dawn": {
         "url": "https://dawn.googlesource.com/dawn.git",
-        "rev": "e1ce227ebf75378c5f60a9d531579982bcdd93ee",
-        "hash": "sha256-RqGCh/InZagPemqMRnR/ziaxDm3ruS4dtnj87mBmIjc="
+        "rev": "479f62d2194fd6e44c37d07654ca6e41c42bd332",
+        "hash": "sha256-rzZn9l0EFcir6k8Xv2svIrhRPwe/rq48H7CX/3yfgFE="
       },
       "src/third_party/dawn/third_party/glfw": {
         "url": "https://chromium.googlesource.com/external/github.com/glfw/glfw",
@@ -1589,8 +1589,8 @@
       },
       "src/third_party/webrtc": {
         "url": "https://webrtc.googlesource.com/src.git",
-        "rev": "1788a81407183acc98163a4e1507c5c63fb175cc",
-        "hash": "sha256-7FIcH5MG7kNHmN2FE00Qyd1NlfYzb1xKmVDX7MCNyXQ="
+        "rev": "4e31d1a1ff41bb1b79609c83f998458a111a149c",
+        "hash": "sha256-3tfB6jNsTLYozYqBfAmYNmq94wQ3OFxBSlOfRaj6wxc="
       },
       "src/third_party/wuffs/src": {
         "url": "https://skia.googlesource.com/external/github.com/google/wuffs-mirror-release-c.git",
@@ -1619,8 +1619,8 @@
       },
       "src/v8": {
         "url": "https://chromium.googlesource.com/v8/v8.git",
-        "rev": "beee9f5cafde91bbd086077a11db16cb9768e62a",
-        "hash": "sha256-q1gVbNGls2izSDb3KZmteZQvcc6M0JyPuZFPfG4FIAs="
+        "rev": "326f5f8cad3f0e436c8ea8f82a6894936a32e860",
+        "hash": "sha256-crTEZnN5iWTXOxpAkvIDPQ6hyfF54F1/ImoKrdmO2K4="
       }
     }
   }

pkgs/applications/networking/browsers/firefox/packages/firefox.nix

@@ -9,10 +9,10 @@
 
 buildMozillaMach rec {
   pname = "firefox";
-  version = "146.0";
+  version = "146.0.1";
   src = fetchurl {
     url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-    sha512 = "db6664310cdcdede832b29dea533b345a3ac86f9df7813118d44b1ec2c4a32e4de2b6e98044385ca6f6026eb3a9994c486a1ddb8b6f4ae7589ed46b122c05630";
+    sha512 = "ae95b86e483febf8dfec8347748dd9048ed7d7f845250e07aa8048e2b351da61f6f3c5f83bb0d0c72e1a75ec61b60e59bbe69639f0f33532910ff8bf5ca07394";
   };
 
   meta = {

pkgs/applications/networking/cluster/terraform-providers/providers.json

@@ -1165,11 +1165,11 @@
     "vendorHash": "sha256-WDyULPLN+uZ5OaE/j3FgurHbXKRU93S3nbXk8mW5dc4="
   },
   "sap_btp": {
-    "hash": "sha256-TLMEHDmjdS9zqU+WdUc9YUt7IwYmEBr3pizVDxAH1YA=",
+    "hash": "sha256-jN/tvfzVnzJTLpAriT68F2HwAS5lxL+iMU1yGR6P8ww=",
     "homepage": "https://registry.terraform.io/providers/SAP/btp",
     "owner": "SAP",
     "repo": "terraform-provider-btp",
-    "rev": "v1.18.0",
+    "rev": "v1.18.1",
     "spdx": "Apache-2.0",
     "vendorHash": "sha256-f3b4NULINH8XworCn46fiz4GmBM31ROdAJy1j4GKkx4="
   },

pkgs/applications/networking/p2p/deluge/default.nix

@@ -106,9 +106,6 @@ let
         description = "Torrent client";
         homepage = "https://deluge-torrent.org";
         license = lib.licenses.gpl3Plus;
-        maintainers = with lib.maintainers; [
-          ebzzry
-        ];
         platforms = lib.platforms.all;
       };
     };

pkgs/applications/video/obs-studio/plugins/advanced-scene-switcher/default.nix

@@ -36,13 +36,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "advanced-scene-switcher";
-  version = "1.32.4";
+  version = "1.32.5";
 
   src = fetchFromGitHub {
     owner = "WarmUpTill";
     repo = "SceneSwitcher";
     rev = version;
-    hash = "sha256-OgvR37w7ol/8zCP6MLNYGYP4fq0upzbhfXYnOPCaE34=";
+    hash = "sha256-MoOakwxyDlhB4YFXWR5Q2jLb0k3wuj87tOO5f0Xy5Vg=";
   };
 
   nativeBuildInputs = [

pkgs/build-support/fetchgit/default.nix

@@ -83,6 +83,8 @@ lib.makeOverridable (
           # run operations between the checkout completing and deleting the .git
           # directory.
           preFetch ? "",
+          # Shell code executed after `git checkout` and before .git directory removal/sanitization.
+          postCheckout ? "",
           # Shell code executed after the file has been fetched
           # successfully. This can do things like check or transform the file.
           postFetch ? "",
@@ -191,6 +193,7 @@ lib.makeOverridable (
             deepClone
             branchName
             preFetch
+            postCheckout
             postFetch
             fetchTags
             rootDir
@@ -251,6 +254,10 @@ lib.makeOverridable (
 
           inherit preferLocalBuild meta;
 
+          env = {
+            NIX_PREFETCH_GIT_CHECKOUT_HOOK = finalAttrs.postCheckout;
+          };
+
           passthru = {
             gitRepoUrl = url;
           }

pkgs/build-support/fetchgit/nix-prefetch-git

@@ -12,6 +12,7 @@ fetchSubmodules=
 fetchLFS=
 builder=
 fetchTags=
+fetchTagsCompat=
 branchName=$NIX_PREFETCH_GIT_BRANCH_NAME
 
 # ENV params
@@ -116,11 +117,17 @@ for arg; do
     fi
 done
 
+# `deepClone` used to effectively imply `fetchTags`.
+# We avoid such behaviour to enhance the `postCheckout` reproducibility,
+# while keeping the old behaviour for `.git` for backward compatibility purposes.
+if [[ -n "$deepClone" ]] && [[ -z "$leaveDotGit" ]]; then
+    fetchTagsCompat=true
+fi
+
 if test -z "$url"; then
     usage
 fi
 
-
 init_remote(){
     local url=$1
     clean_git init --initial-branch=master
@@ -181,9 +188,30 @@ checkout_hash(){
         hash=$(hash_from_ref "$ref")
     fi
 
-    [[ -z "$deepClone" ]] && \
-    clean_git fetch ${builder:+--progress} --depth=1 origin "$hash" || \
-    clean_git fetch -t ${builder:+--progress} origin || return 1
+    local -a fetchTagsArgs
+    if [[ -n "$fetchTags" ]]; then
+        fetchTagsArgs=(--tags)
+    else
+        fetchTagsArgs=(--no-tags)
+    fi
+    local -a fetchTargetArgs
+    if [[ -n "$deepClone" ]]; then
+        fetchTargetArgs=(origin)
+    else
+        fetchTargetArgs=(--depth=1 origin "$hash")
+    fi
+    if ! clean_git fetch "${fetchTagsArgs[@]}" ${builder:+--progress} "${fetchTargetArgs[@]}"; then
+        echo "ERROR: \`git fetch' failed." >&2
+        # Git remotes using the "dumb" protocol does not support shallow fetch;
+        # fall back to deep fetch if shallow fetch failed.
+        # TODO(@ShamrockLee): Determine whether the transfer protocol is smart reliably.
+        if [[ -z "$deepClone" ]] || [[ -z "$fetchTags" ]]; then
+            echo "This might be due to the dumb transfer protocol not supporting shallow fetch or no-tag cloning. Trying with \`--tags' and without \`--depth=1'..." >&2
+            clean_git fetch --tags ${builder:+--progress} origin || return 1
+        else
+            return 1
+        fi
+    fi
 
     local object_type=$(git cat-file -t "$hash")
     if [[ "$object_type" == "commit" || "$object_type" == "tag" ]]; then
@@ -253,11 +281,19 @@ clone(){
     )
 
     # Fetch all tags if requested
-    if test -n "$fetchTags"; then
+    # The fetched tags are potentially non-reproducible, as tags are mutable parts of the Git tree.
+    if [[ -n "$fetchTags" ]] || [[ -n "$fetchTagsCompat" ]]; then
         echo "fetching all tags..." >&2
         clean_git fetch origin 'refs/tags/*:refs/tags/*' || echo "warning: failed to fetch some tags" >&2
     fi
 
+    # Name "$ref" to make `git describe` work reproducibly in `NIX_PREFETCH_GIT_CHECKOUT_HOOK`.
+    # Name only when not leaving `.git` for compatibility purposes.
+    if [[ -n "$ref" ]] && [[ -z "$leaveDotGit" ]]; then
+        echo "refer to FETCH_HEAD as its original name $ref"
+        clean_git update-ref "$ref" FETCH_HEAD
+    fi
+
     # Checkout linked sources.
     if test -n "$fetchSubmodules"; then
         init_submodules

pkgs/build-support/fetchgit/tests.nix

@@ -17,6 +17,33 @@
     sha256 = "sha256-7DszvbCNTjpzGRmpIVAWXk20P0/XTrWZ79KSOGLrUWY=";
   };
 
+  collect-rev = testers.invalidateFetcherByDrvHash fetchgit {
+    name = "collect-rev-nix-source";
+    url = "https://github.com/NixOS/nix";
+    rev = "9d9dbe6ed05854e03811c361a3380e09183f4f4a";
+    hash = "sha256-AUTX1K7J5+fojvKYJacXYVV5kio3hrWYz5MCekO6h68=";
+    postCheckout = ''
+      git -C "$out" rev-parse HEAD | tee "$out/revision.txt"
+    '';
+  };
+
+  simple-tag = testers.invalidateFetcherByDrvHash fetchgit {
+    name = "simple-tag-nix-source";
+    url = "https://github.com/NixOS/nix";
+    tag = "2.3.15";
+    hash = "sha256-7DszvbCNTjpzGRmpIVAWXk20P0/XTrWZ79KSOGLrUWY=";
+  };
+
+  describe-tag = testers.invalidateFetcherByDrvHash fetchgit {
+    name = "describe-tag-nix-source";
+    url = "https://github.com/NixOS/nix";
+    tag = "2.3.15";
+    hash = "sha256-y7l+46lVP2pzJwGON5qEV0EoxWofRoWAym5q9VXvpc8=";
+    postCheckout = ''
+      { git -C "$out" describe || echo "git describe failed"; } | tee "$out"/describe-output.txt
+    '';
+  };
+
   sparseCheckout = testers.invalidateFetcherByDrvHash fetchgit {
     name = "sparse-checkout-nix-source";
     url = "https://github.com/NixOS/nix";
@@ -77,6 +104,20 @@
     postFetch = "rm -r $out/.git";
   };
 
+  submodule-revision-count = testers.invalidateFetcherByDrvHash fetchgit {
+    name = "submodule-revision-count-source";
+    url = "https://github.com/pineapplehunter/nix-test-repo-with-submodule";
+    rev = "26473335b84ead88ee0a3b649b1c7fa4a91cfd4a";
+    hash = "sha256-ok1e6Pb0fII5TF8HXF8DXaRGSoq7kgRCoXqSEauh1wk=";
+    fetchSubmodules = true;
+    deepClone = true;
+    leaveDotGit = false;
+    postCheckout = ''
+      { git -C "$out" rev-list --count HEAD || echo "git rev-list failed"; } | tee "$out/revision_count.txt"
+      { git -C "$out/nix-test-repo-submodule" rev-list --count HEAD || echo "git rev-list failed"; } | tee "$out/nix-test-repo-submodule/revision_count.txt"
+    '';
+  };
+
   submodule-leave-git-deep = testers.invalidateFetcherByDrvHash fetchgit {
     name = "submodule-leave-git-deep-source";
     url = "https://github.com/pineapplehunter/nix-test-repo-with-submodule";

pkgs/build-support/fetchurl/builder.sh

@@ -1,6 +1,16 @@
 source "$NIX_ATTRS_SH_FILE"
 source $mirrorsFile
 
+# Normalize `curlOpts` as a string.
+# If defined as a list (deprecated), it would be a bash array.
+if [[ "$(declare -p curlOpts 2&>/dev/null || true)" =~ ^"declare -a" ]]; then
+    unset _temp
+    _temp="${curlOpts[*]}"
+    unset curlOpts
+    curlOpts=$_temp
+    unset _temp
+fi
+
 curlVersion=$(curl -V | head -1 | cut -d' ' -f2)
 
 # Curl flags to handle redirects, not use EPSV, handle cookies for
@@ -23,17 +33,23 @@ if ! [ -f "$SSL_CERT_FILE" ]; then
     curl+=(--insecure)
 fi
 
-curl+=("${curlOptsList[@]}")
+# NOTE:
+# `netrcPhase` should not attempt to access builder.sh implementation details (e.g., the `${curl[@]}` array),
+# The implementation detail could change in any Nixpkgs revision, including backports.
+if [[ -n "${netrcPhase-}" ]]; then
+    runPhase netrcPhase
+    curl+=(--netrc-file "$PWD/netrc")
+fi
 
 curl+=(
-    ${curlOpts[*]}
+    "${curlOptsList[@]}"
+    $curlOpts
     $NIX_CURL_FLAGS
 )
 
 downloadedFile="$out"
 if [ -n "$downloadToTemp" ]; then downloadedFile="$TMPDIR/file"; fi
 
-
 tryDownload() {
     local url="$1"
     local target="$2"

pkgs/build-support/fetchurl/default.nix

@@ -333,15 +333,6 @@ lib.extendMkDerivation {
 
       inherit preferLocalBuild;
 
-      postHook =
-        if netrcPhase == null then
-          null
-        else
-          ''
-            ${netrcPhase}
-            curlOpts="$curlOpts --netrc-file $PWD/netrc"
-          '';
-
       inherit meta;
       passthru = {
         inherit url resolvedUrl;

pkgs/build-support/fetchurl/tests.nix

@@ -1,11 +1,93 @@
 {
+  lib,
   testers,
   fetchurl,
+  writeShellScriptBin,
   jq,
   moreutils,
+  emptyFile,
   ...
 }:
+let
+  testFlagAppending =
+    args:
+    testers.invalidateFetcherByDrvHash
+      (fetchurl.override (previousArgs: {
+        curl = (
+          writeShellScriptBin "curl" ''
+            set -eu -o pipefail
+            hasFoo=
+            hasBar=
+            echo "curl-mock-expecting-flags: get flags: $*" >&2
+            for arg; do
+              case "$arg" in
+              -V|--version)
+                ${lib.getExe previousArgs.curl} "$arg"
+                exit "$?"
+                ;;
+              --foo)
+                echo "curl-mock-expecting-flags: \`--foo' found in the argument list passed to \`curl'." >&2
+                hasFoo=1
+                ;;
+              --bar)
+                echo "curl-mock-expecting-flags: \`--bar' found in the argument list passed to \`curl'." >&2
+                hasBar=1
+                ;;
+              esac
+            done
+            if [[ -z "$hasFoo" ]]; then
+              echo "ERROR: curl-mock-expecting-flags: \`--foo' missing in the argument list passed to \`curl'." >&2
+            fi
+            if [[ -z "$hasBar" ]]; then
+              echo "ERROR: curl-mock-expecting-flags: \`--bar' missing in the argument list passed to \`curl'." >&2
+            fi
+            if [[ -n "$hasFoo" ]] && [[ -n "$hasBar" ]]; then
+              touch $out
+            else
+              exit 1
+            fi
+          ''
+        );
+      }))
+      (
+        {
+          url = "https://www.example.com/source";
+          hash = emptyFile.outputHash;
+          recursiveHash = true; # aligned with emptyFile
+        }
+        // args
+      );
+in
 {
+  flag-appending-curlOpts = testFlagAppending {
+    name = "test-fetchurl-flag-appending-curlOpts";
+    curlOpts = "--foo --bar";
+  };
+
+  flag-appending-curlOptsList = testFlagAppending {
+    name = "test-fetchurl-flag-appending-curlOptsList";
+    curlOptsList = [
+      "--foo"
+      "--bar"
+    ];
+  };
+
+  flag-appending-netrcPhase-curlOpts = testFlagAppending {
+    name = "test-fetchurl-flag-appending-netrcPhase-curlOpts";
+    netrcPhase = ''
+      touch netrc
+      curlOpts="$curlOpts --foo --bar"
+    '';
+  };
+
+  flag-appending-netrcPhase-curlOptsList = testFlagAppending {
+    name = "test-fetchurl-flag-appending-netrcPhase-curlOptsList";
+    netrcPhase = ''
+      touch netrc
+      curlOptsList+=("--foo" "--bar")
+    '';
+  };
+
   # Tests that we can send custom headers with spaces in them
   header =
     let

pkgs/build-support/go/module.nix

@@ -223,18 +223,19 @@ lib.extendMkDerivation {
         GOTOOLCHAIN = "local";
 
         CGO_ENABLED = args.env.CGO_ENABLED or go.CGO_ENABLED;
-      };
 
-      GOFLAGS =
-        GOFLAGS
-        ++
-          lib.warnIf (lib.any (lib.hasPrefix "-mod=") GOFLAGS)
-            "use `proxyVendor` to control Go module/vendor behavior instead of setting `-mod=` in GOFLAGS"
-            (lib.optional (!finalAttrs.proxyVendor) "-mod=vendor")
-        ++
-          lib.warnIf (builtins.elem "-trimpath" GOFLAGS)
-            "`-trimpath` is added by default to GOFLAGS by buildGoModule when allowGoReference isn't set to true"
-            (lib.optional (!finalAttrs.allowGoReference) "-trimpath");
+        GOFLAGS = toString (
+          GOFLAGS
+          ++
+            lib.warnIf (lib.any (lib.hasPrefix "-mod=") GOFLAGS)
+              "use `proxyVendor` to control Go module/vendor behavior instead of setting `-mod=` in GOFLAGS"
+              (lib.optional (!finalAttrs.proxyVendor) "-mod=vendor")
+          ++
+            lib.warnIf (builtins.elem "-trimpath" GOFLAGS)
+              "`-trimpath` is added by default to GOFLAGS by buildGoModule when allowGoReference isn't set to true"
+              (lib.optional (!finalAttrs.allowGoReference) "-trimpath")
+        );
+      };
 
       inherit enableParallelBuilding;
 

pkgs/build-support/node/fetch-pnpm-deps/default.nix

@@ -10,9 +10,8 @@
   yq,
   zstd,
 }:
-
 let
-  pnpm' = pnpm;
+  pnpmLatest = pnpm;
 
   supportedFetcherVersions = [
     1 # First version. Here to preserve backwards compatibility
@@ -21,11 +20,11 @@ let
   ];
 in
 {
-  fetchDeps = lib.makeOverridable (
+  fetchPnpmDeps = lib.makeOverridable (
     {
       hash ? "",
       pname,
-      pnpm ? pnpm',
+      pnpm ? pnpmLatest,
       pnpmWorkspaces ? [ ],
       prePnpmInstall ? "",
       pnpmInstallFlags ? [ ],
@@ -50,15 +49,15 @@ in
     in
     # pnpmWorkspace was deprecated, so throw if it's used.
     assert (lib.throwIf (args ? pnpmWorkspace)
-      "pnpm.fetchDeps: `pnpmWorkspace` is no longer supported, please migrate to `pnpmWorkspaces`."
+      "fetchPnpmDeps: `pnpmWorkspace` is no longer supported, please migrate to `pnpmWorkspaces`."
     ) true;
 
     assert (lib.throwIf (fetcherVersion == null)
-      "pnpm.fetchDeps: `fetcherVersion` is not set, see https://nixos.org/manual/nixpkgs/stable/#javascript-pnpm-fetcherVersion."
+      "fetchPnpmDeps: `fetcherVersion` is not set, see https://nixos.org/manual/nixpkgs/stable/#javascript-pnpm-fetcherVersion."
     ) true;
 
     assert (lib.throwIf (!(builtins.elem fetcherVersion supportedFetcherVersions))
-      "pnpm.fetchDeps `fetcherVersion` is not set to a supported value (${lib.concatStringsSep ", " (map toString supportedFetcherVersions)}), see https://nixos.org/manual/nixpkgs/stable/#javascript-pnpm-fetcherVersion."
+      "fetchPnpmDeps `fetcherVersion` is not set to a supported value (${lib.concatStringsSep ", " (map toString supportedFetcherVersions)}), see https://nixos.org/manual/nixpkgs/stable/#javascript-pnpm-fetcherVersion."
     ) true;
 
     stdenvNoCC.mkDerivation (
@@ -72,12 +71,14 @@ in
             cacert
             jq
             moreutils
-            args.pnpm or pnpm'
+            pnpm # from args
             yq
             zstd
-          ];
+          ]
+          ++ args.nativeBuildInputs or [ ];
 
-          impureEnvVars = lib.fetchers.proxyImpureEnvVars ++ [ "NIX_NPM_REGISTRY" ];
+          impureEnvVars =
+            lib.fetchers.proxyImpureEnvVars ++ [ "NIX_NPM_REGISTRY" ] ++ args.impureEnvVars or [ ];
 
           installPhase = ''
             runHook preInstall
@@ -123,7 +124,7 @@ in
                 --registry="$NIX_NPM_REGISTRY" \
                 --frozen-lockfile
 
-            # Store newer fetcherVersion in case pnpm.configHook also needs it
+            # Store newer fetcherVersion in case pnpmConfigHook also needs it
             if [[ ${toString fetcherVersion} -gt 1 ]]; then
               echo ${toString fetcherVersion} > $out/.fetcher-version
             fi
@@ -173,10 +174,10 @@ in
             runHook postFixup
           '';
 
-          passthru = {
+          passthru = args.passthru or { } // {
             inherit fetcherVersion;
             serve = callPackage ./serve.nix {
-              pnpm = args.pnpm or pnpm';
+              inherit pnpm; # from args
               pnpmDeps = finalAttrs.finalPackage;
             };
           };
@@ -190,10 +191,9 @@ in
     )
   );
 
-  configHook = makeSetupHook {
+  pnpmConfigHook = makeSetupHook {
     name = "pnpm-config-hook";
     propagatedBuildInputs = [
-      pnpm
       zstd
     ];
     substitutions = {

pkgs/build-support/node/fetch-pnpm-deps/pnpm-config-hook.sh

@@ -12,6 +12,13 @@ pnpmConfigHook() {
       exit 1
     fi
 
+    if ! command -v "pnpm" &> /dev/null; then
+      echo "Error: 'pnpm' binary not found in PATH. Consider adding 'pkgs.pnpm' to 'nativeBuildInputs'." >&2
+      exit 1
+    fi
+
+    echo "Found 'pnpm' with version '$(pnpm --version)'"
+
     fetcherVersion=$(cat "${pnpmDeps}/.fetcher-version" || echo 1)
 
     echo "Using fetcherVersion: $fetcherVersion"

pkgs/build-support/ocaml/dune.nix

@@ -37,10 +37,10 @@ lib.extendMkDerivation {
     in
 
     if args ? minimalOCamlVersion && lib.versionOlder ocaml.version args.minimalOCamlVersion then
-      throw "${pname}-${version} is not available for OCaml ${ocaml.version}"
+      throw "${finalAttrs.pname}-${finalAttrs.version} is not available for OCaml ${ocaml.version}"
     else
       {
-        name = "ocaml${ocaml.version}-${pname}-${version}";
+        name = "ocaml${ocaml.version}-${finalAttrs.pname}-${finalAttrs.version}";
 
         strictDeps = true;
 
@@ -58,14 +58,14 @@ lib.extendMkDerivation {
         buildPhase =
           args.buildPhase or ''
             runHook preBuild
-            dune build -p ${pname} ''${enableParallelBuilding:+-j $NIX_BUILD_CORES}
+            dune build -p ${finalAttrs.pname} ''${enableParallelBuilding:+-j $NIX_BUILD_CORES}
             runHook postBuild
           '';
 
         installPhase =
           args.installPhase or ''
             runHook preInstall
-            dune install --prefix $out --libdir $OCAMLFIND_DESTDIR ${pname} \
+            dune install --prefix $out --libdir $OCAMLFIND_DESTDIR ${finalAttrs.pname} \
              ${
                if lib.versionAtLeast Dune.version "2.9" then
                  "--docdir $out/share/doc --mandir $out/share/man"
@@ -78,11 +78,15 @@ lib.extendMkDerivation {
         checkPhase =
           args.checkPhase or ''
             runHook preCheck
-            dune runtest -p ${pname} ''${enableParallelBuilding:+-j $NIX_BUILD_CORES}
+            dune runtest -p ${finalAttrs.pname} ''${enableParallelBuilding:+-j $NIX_BUILD_CORES}
             runHook postCheck
           '';
 
         meta = (args.meta or { }) // {
+          # TODO: ocaml.meta.platforms is where the compiler can run
+          # Package's meta.platforms are where the compiler can target.
+          #
+          # See: rustc.targetPlatforms
           platforms = args.meta.platforms or ocaml.meta.platforms;
         };
       };

pkgs/build-support/teleport/default.nix

@@ -11,6 +11,8 @@
   openssl,
   pkg-config,
   pnpm_10,
+  fetchPnpmDeps,
+  pnpmConfigHook,
   rustc,
   stdenv,
   xdg-utils,
@@ -73,8 +75,13 @@ let
       hash = cargoHash;
     };
 
-    pnpmDeps = pnpm_10.fetchDeps {
-      inherit src pname version;
+    pnpmDeps = fetchPnpmDeps {
+      inherit
+        src
+        pname
+        version
+        ;
+      pnpm = pnpm_10;
       fetcherVersion = 2;
       hash = pnpmHash;
     };
@@ -83,7 +90,8 @@ let
       binaryen
       cargo
       nodejs
-      pnpm_10.configHook
+      pnpmConfigHook
+      pnpm_10
       rustc
       rustc.llvmPackages.lld
       rustPlatform.cargoSetupHook

pkgs/by-name/ak/akkoma-admin-fe/package.nix

@@ -2,77 +2,51 @@
   lib,
   stdenv,
   fetchFromGitea,
-  fetchYarnDeps,
-  writableTmpDirAsHomeHook,
-  fixup-yarn-lock,
-  yarn,
+  yarn-berry_3,
   nodejs,
-  git,
   python3,
   pkg-config,
   libsass,
-  nix-update-script,
   xcbuild,
+  nix-update-script,
 }:
 
+let
+  yarn-berry = yarn-berry_3;
+in
 stdenv.mkDerivation (finalAttrs: {
   pname = "admin-fe";
-  version = "2.3.0-2-unstable-2024-04-27";
+  version = "2.3.0-2-unstable-2025-12-07";
 
   src = fetchFromGitea {
     domain = "akkoma.dev";
     owner = "AkkomaGang";
     repo = "admin-fe";
-    rev = "7e16abcbaab10efa6c2c4589660cf99f820a718d";
-    hash = "sha256-W/2Ay2dNeVQk88lgkyTzKwCNw0kLkfI6+Azlbp0oMm4=";
+    rev = "a0e3b95a75367d1b5e329963a3d54f67cf59dfca";
+    hash = "sha256-eEAM1itUvpR57B0BseeeRuV+ZjcYiJvbdln8vleRNcc=";
+
+    # upstream repository archive fetching is broken
+    forceFetchGit = true;
   };
 
-  offlineCache = fetchYarnDeps {
+  offlineCache = yarn-berry.fetchYarnBerryDeps {
     yarnLock = finalAttrs.src + "/yarn.lock";
-    hash = "sha256-acF+YuWXlMZMipD5+XJS+K9vVFRz3wB2fZqc3Hd0Bjc=";
+    hash = "sha256-YZlvIr27bHBgsQcBiayqEX07kjX6iH2Kh5wt+PQFq04=";
   };
 
   nativeBuildInputs = [
-    fixup-yarn-lock
-    writableTmpDirAsHomeHook
-    yarn
+    yarn-berry.yarnBerryConfigHook
+    yarn-berry
     nodejs
     pkg-config
     python3
-    git
     libsass
   ]
   ++ lib.optional stdenv.hostPlatform.isDarwin xcbuild;
 
-  configurePhase = ''
-    runHook preConfigure
-
-    yarn config --offline set yarn-offline-mirror ${lib.escapeShellArg finalAttrs.offlineCache}
-    fixup-yarn-lock yarn.lock
-    substituteInPlace yarn.lock \
-      --replace-fail '"git://github.com/adobe-webplatform/eve.git#eef80ed"' '"https://github.com/adobe-webplatform/eve.git#eef80ed"'
-
-    yarn install --offline --frozen-lockfile --ignore-platform --ignore-scripts --no-progress --non-interactive
-    patchShebangs node_modules/cross-env
-
-    mkdir -p "$HOME/.node-gyp/${nodejs.version}"
-    echo 9 >"$HOME/.node-gyp/${nodejs.version}/installVersion"
-    ln -sfv "${nodejs}/include" "$HOME/.node-gyp/${nodejs.version}"
-    export npm_config_nodedir=${nodejs}
-
-    runHook postConfigure
-  '';
-
   buildPhase = ''
     runHook preBuild
-
-    pushd node_modules/node-sass
-    LIBSASS_EXT=auto yarn run build --offline
-    popd
-
-    export NODE_OPTIONS="--openssl-legacy-provider"
     yarn run build:prod --offline
-
     runHook postBuild
   '';
 

pkgs/by-name/ak/akkoma-fe/package.nix

@@ -4,8 +4,8 @@
   fetchFromGitea,
   fetchYarnDeps,
   writableTmpDirAsHomeHook,
-  fixup-yarn-lock,
-  yarn,
+  yarnConfigHook,
+  yarnBuildHook,
   nodejs,
   jpegoptim,
   oxipng,
@@ -15,25 +15,28 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "akkoma-fe";
-  version = "3.15.0";
+  version = "3.12.0";
 
   src = fetchFromGitea {
     domain = "akkoma.dev";
     owner = "AkkomaGang";
     repo = "akkoma-fe";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-VKYeJwAc4pMpF1dWBnx5D39ffNk7eGpJI2es+GAxdow=";
+    hash = "sha256-DK+KLAcT/10qhwmB+GoHN/7nOKJEJ32zSao8/fjgW7E=";
+
+    # upstream repository archive fetching is broken
+    forceFetchGit = true;
   };
 
-  offlineCache = fetchYarnDeps {
+  yarnOfflineCache = fetchYarnDeps {
     yarnLock = finalAttrs.src + "/yarn.lock";
     hash = "sha256-QB523QZX8oBMHWBSFF7MpaWWXc+MgEUaw/2gsCPZ9a4=";
   };
 
   nativeBuildInputs = [
     writableTmpDirAsHomeHook
-    fixup-yarn-lock
-    yarn
+    yarnConfigHook
+    yarnBuildHook
     nodejs
     jpegoptim
     oxipng
@@ -48,27 +51,6 @@ stdenv.mkDerivation (finalAttrs: {
       build/webpack.prod.conf.js
   '';
 
-  configurePhase = ''
-    runHook preConfigure
-
-    yarn config --offline set yarn-offline-mirror ${lib.escapeShellArg finalAttrs.offlineCache}
-    fixup-yarn-lock yarn.lock
-
-    yarn install --offline --frozen-lockfile --ignore-platform --ignore-scripts --no-progress --non-interactive
-
-    runHook postConfigure
-  '';
-
-  buildPhase = ''
-    runHook preBuild
-
-    export NODE_ENV="production"
-    export NODE_OPTIONS="--openssl-legacy-provider"
-    yarn run build --offline
-
-    runHook postBuild
-  '';
-
   installPhase = ''
     runHook preInstall
 

pkgs/by-name/ak/akkoma/package.nix

@@ -10,14 +10,17 @@
 
 beamPackages.mixRelease rec {
   pname = "akkoma";
-  version = "3.15.2";
+  version = "3.17.0";
 
   src = fetchFromGitea {
     domain = "akkoma.dev";
     owner = "AkkomaGang";
     repo = "akkoma";
     tag = "v${version}";
-    hash = "sha256-GW86OyO/XPIrCS+cPKQ8LG8PdhhfA2rNH1FXFiuL6vM=";
+    hash = "sha256-RXKqeaS+cvOGQNMU/g2lbAk/V1JbkU2XXqITqv1U/wU=";
+
+    # upstream repository archive fetching is broken
+    forceFetchGit = true;
   };
 
   nativeBuildInputs = [ cmake ];
@@ -36,7 +39,7 @@ beamPackages.mixRelease rec {
   mixFodDeps = beamPackages.fetchMixDeps {
     pname = "mix-deps-${pname}";
     inherit src version;
-    hash = "sha256-ygRj0s9J2/nBXR5s9CE7eMRBxsRhKlV/IZrkwPpco14=";
+    hash = "sha256-DqSeMjom9UjgGjjfJomWCr7jQhXEkqVrDCvW3+pDtcQ=";
 
     postInstall = ''
       substituteInPlace "$out/http_signatures/mix.exs" \

pkgs/by-name/an/ants/package.nix

@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ANTs";
-  version = "2.6.3";
+  version = "2.6.4";
 
   src = fetchFromGitHub {
     owner = "ANTsX";
     repo = "ANTs";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-AaurwFIDVKhAp8+Gu3TUlGJP33ChQ6flPTYWe/cVK0w=";
+    hash = "sha256-c2a73OpRE/kCq8gq2DlwTQVZdTfKBuUQN/VeOZEkGIc=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ao/aonsoku/package.nix

@@ -5,6 +5,8 @@
   cargo-tauri,
   nodejs,
   pnpm_8,
+  fetchPnpmDeps,
+  pnpmConfigHook,
   pkg-config,
   wrapGAppsHook3,
   openssl,
@@ -12,7 +14,6 @@
   glib-networking,
   nix-update-script,
 }:
-
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "aonsoku";
   version = "0.9.1";
@@ -25,8 +26,9 @@ rustPlatform.buildRustPackage (finalAttrs: {
   };
 
   # lockfileVersion: '6.0' need old pnpm
-  pnpmDeps = pnpm_8.fetchDeps {
+  pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
+    pnpm = pnpm_8;
     fetcherVersion = 1;
     hash = "sha256-h1rcM+H2c0lk7bpGeQT5ue9bQIggrCFHkj4o7KxnH08=";
   };
@@ -40,7 +42,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   nativeBuildInputs = [
     nodejs
-    pnpm_8.configHook
+    pnpmConfigHook
+    pnpm_8
     cargo-tauri.hook
     pkg-config
     wrapGAppsHook3

pkgs/by-name/ap/apache-answer/package.nix

@@ -2,6 +2,8 @@
   buildGoModule,
   lib,
   fetchFromGitHub,
+  fetchPnpmDeps,
+  pnpmConfigHook,
   pnpm,
   nodejs,
   fetchpatch,
@@ -25,7 +27,7 @@ buildGoModule rec {
 
     sourceRoot = "${src.name}/ui";
 
-    pnpmDeps = pnpm.fetchDeps {
+    pnpmDeps = fetchPnpmDeps {
       inherit src version pname;
       sourceRoot = "${src.name}/ui";
       fetcherVersion = 1;
@@ -33,7 +35,8 @@ buildGoModule rec {
     };
 
     nativeBuildInputs = [
-      pnpm.configHook
+      pnpmConfigHook
+      pnpm
       nodejs
     ];
 

pkgs/by-name/ap/api-linter/package.nix

@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "api-linter";
-  version = "2.0.0";
+  version = "2.1.0";
 
   src = fetchFromGitHub {
     owner = "googleapis";
     repo = "api-linter";
     tag = "v${version}";
-    hash = "sha256-psyv/J1/7H8s34qqZD4s7Ls1mn2lht5VbNxZrXPC0iw=";
+    hash = "sha256-oaSWp1FmanCWMRYk3Dm1WZ+MnxooXqT9rom25JeFrTg=";
   };
 
-  vendorHash = "sha256-IpL9RIhO9ivXKHczca4m6R6jmcNEn5KXqNxWmtU30qE=";
+  vendorHash = "sha256-X5/UH8dX89nTPlYMbVuyG82WrDmU/dP7LiZfMoN6c4A=";
 
   subPackages = [ "cmd/api-linter" ];
 

pkgs/by-name/ar/arftracksat/package.nix

@@ -0,0 +1,53 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  curl,
+  nlohmann_json,
+  freeglut,
+  libGL,
+  libGLU,
+  curlpp,
+  glm,
+}:
+
+stdenv.mkDerivation {
+  pname = "arftracksat";
+  version = "unstable-2025-09-15";
+
+  src = fetchFromGitHub {
+    owner = "arf20";
+    repo = "arftracksat";
+    rev = "5c9b3866b6fcd95382ff56c68cdd38f3d08c1372";
+    hash = "sha256-inCgsxrJkBNGmdGPd28XnOJYCiatL35TxDcfvZjA2cY=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+  ];
+
+  postPatch = ''
+    substituteInPlace src/main.cpp --replace-fail '/usr/local' "$out"
+    substituteInPlace config.json --replace-fail '/usr/local' "$out"
+  '';
+
+  buildInputs = [
+    curl
+    nlohmann_json
+    freeglut
+    libGL
+    libGLU
+    curlpp
+    glm
+  ];
+
+  meta = {
+    description = "Satellite tracking software for linux";
+    homepage = "https://github.com/arf20/arftracksat";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ matthewcroughan ];
+    mainProgram = "arftracksat";
+    platforms = lib.platforms.all;
+  };
+}

pkgs/by-name/ar/artalk/package.nix

@@ -4,6 +4,8 @@
   fetchFromGitHub,
   nodejs,
   pnpm_9,
+  fetchPnpmDeps,
+  pnpmConfigHook,
   installShellFiles,
   versionCheckHook,
   stdenv,
@@ -28,11 +30,13 @@ let
 
     nativeBuildInputs = [
       nodejs
-      pnpm_9.configHook
+      pnpmConfigHook
+      pnpm_9
     ];
 
-    pnpmDeps = pnpm_9.fetchDeps {
+    pnpmDeps = fetchPnpmDeps {
       inherit (finalAttrs) pname version src;
+      pnpm = pnpm_9;
       fetcherVersion = 1;
       hash = "sha256-QIfadS2gNPtH006O86EndY/Hx2ml2FoKfUXJF5qoluw=";
     };

pkgs/by-name/as/ast-grep/package.nix

@@ -11,13 +11,13 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ast-grep";
-  version = "0.40.0";
+  version = "0.40.3";
 
   src = fetchFromGitHub {
     owner = "ast-grep";
     repo = "ast-grep";
     tag = finalAttrs.version;
-    hash = "sha256-tbN8MiesWWIHew5/2STNhXu+3eXjMLRrcm8+9cZf+tM=";
+    hash = "sha256-kSaDSXhE5PDQj2taQnYUttEbc3dm9VlqwIelApPlpsI=";
   };
 
   # error: linker `aarch64-linux-gnu-gcc` not found
@@ -25,7 +25,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     rm .cargo/config.toml
   '';
 
-  cargoHash = "sha256-+wetHwdURcNPLa9TGZmS4HlyYcQHSpLnXbrNXS/JckM=";
+  cargoHash = "sha256-mz3+483vEL31kQ2oyM0GrwkFVxvPnORalQEaEBQ6/Js=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/by-name/as/astro-language-server/package.nix

@@ -3,10 +3,11 @@
   stdenv,
   fetchFromGitHub,
   pnpm_10,
+  fetchPnpmDeps,
+  pnpmConfigHook,
   nodejs,
   nix-update-script,
 }:
-
 stdenv.mkDerivation (finalAttrs: {
   pname = "astro-language-server";
   version = "2.16.2";
@@ -25,7 +26,7 @@ stdenv.mkDerivation (finalAttrs: {
     pnpm approve-builds @emmetio/css-parser
   '';
 
-  pnpmDeps = pnpm_10.fetchDeps {
+  pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs)
       pname
       version
@@ -33,13 +34,15 @@ stdenv.mkDerivation (finalAttrs: {
       pnpmWorkspaces
       prePnpmInstall
       ;
+    pnpm = pnpm_10;
     fetcherVersion = 2;
     hash = "sha256-M2Xef5yTEQCLPzzx7WGQYplTrND+DPMy1hyEuahK+kM=";
   };
 
   nativeBuildInputs = [
     nodejs
-    pnpm_10.configHook
+    pnpmConfigHook
+    pnpm_10
   ];
 
   buildInputs = [ nodejs ];

pkgs/by-name/at/atlantis/package.nix

@@ -7,13 +7,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "atlantis";
-  version = "0.37.1";
+  version = "0.38.0";
 
   src = fetchFromGitHub {
     owner = "runatlantis";
     repo = "atlantis";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Dv9vf4Ye5LEwJ19RW7wJUgAAPLDtRIAoZt0xTsxODYg=";
+    hash = "sha256-5V+2MgVcxq3DtMkBeA64mUaSL3zYG/+c1SbChaRbQ98=";
   };
 
   ldflags = [
@@ -21,7 +21,7 @@ buildGoModule (finalAttrs: {
     "-X=main.date=1970-01-01T00:00:00Z"
   ];
 
-  vendorHash = "sha256-ZJF+Q5SFn92mUMm7HhK5WyRYTvJEYThnSbv1FPeI4hk=";
+  vendorHash = "sha256-bdZn2cNSpmV1nngQWBFkf2G0uxlJF1UX50oMZYU7+i0=";
 
   subPackages = [ "." ];
 

pkgs/by-name/at/atuin-desktop/package.nix

@@ -9,6 +9,8 @@
   cargo-tauri,
   nodejs,
   pkg-config,
+  fetchPnpmDeps,
+  pnpmConfigHook,
   pnpm,
 
   alsa-lib,
@@ -19,27 +21,29 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "atuin-desktop";
-  version = "0.2.5";
+  # TODO When updating the version, check if the version-mismatch workaround in preBuild is still needed
+  version = "0.2.11";
 
   src = fetchFromGitHub {
     owner = "atuinsh";
     repo = "desktop";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-VDIC1BGgaFTiTnydJdEhVeUgVrH43MzpF4VkfgQ+Nas=";
+    hash = "sha256-tVIT3GUJ1qcv6HSvO+nqAz+VMfd8g9AjgaqE6+GSa+I=";
   };
 
   cargoRoot = "./.";
-  cargoHash = "sha256-gYYmtxMWst0ZB/YzJf/0FGOedoVpMgTq5qq+3m2R7T8=";
+  cargoHash = "sha256-T3cPvwph71lpqlGcugAO4Ua8Y5TNZSySbQatxcvoT4E=";
 
-  pnpmDeps = pnpm.fetchDeps {
+  pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
     fetcherVersion = 2;
-    hash = "sha256-Tdcdghhc4cH+cYIeUy3inChgPfb1i9E7F1mpxxWoW4Q=";
+    hash = "sha256-XqKGAx2Q9cWO1oG4mP1cKM2Y9Pib5haFYEaq0PAfAdQ=";
   };
 
   nativeBuildInputs = [
     cargo-tauri.hook
-    pnpm.configHook
+    pnpmConfigHook
+    pnpm
     rustPlatform.bindgenHook
 
     nodejs
@@ -68,6 +72,9 @@ rustPlatform.buildRustPackage (finalAttrs: {
     tauriBuildFlags+=(
       "--config"
       "$tauriConfPath"
+      # Skips the version mismatch check (and accepts the consequences)
+      # ref: https://github.com/atuinsh/desktop/issues/313
+      "--ignore-version-mismatches"
     )
   '';
 

pkgs/by-name/au/autobrr/package.nix

@@ -7,6 +7,8 @@
   nix-update-script,
   nodejs,
   pnpm_9,
+  fetchPnpmDeps,
+  pnpmConfigHook,
   typescript,
   versionCheckHook,
 }:
@@ -27,19 +29,21 @@ let
 
     nativeBuildInputs = [
       nodejs
-      pnpm_9.configHook
+      pnpmConfigHook
+      pnpm_9
       typescript
     ];
 
     sourceRoot = "${src.name}/web";
 
-    pnpmDeps = pnpm_9.fetchDeps {
+    pnpmDeps = fetchPnpmDeps {
       inherit (autobrr-web)
         pname
         version
         src
         sourceRoot
         ;
+      pnpm = pnpm_9;
       fetcherVersion = 1;
       hash = "sha256-LOY8fLGsX966MyH4w+pa9tm/5HS6LnGwd51cj8TG6Mk=";
     };

pkgs/by-name/au/autoprefixer/package.nix

@@ -3,6 +3,8 @@
   stdenv,
   nodejs,
   pnpm_9,
+  fetchPnpmDeps,
+  pnpmConfigHook,
   fetchFromGitHub,
   callPackage,
   nix-update-script,
@@ -20,11 +22,13 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [
     nodejs
-    pnpm_9.configHook
+    pnpmConfigHook
+    pnpm_9
   ];
 
-  pnpmDeps = pnpm_9.fetchDeps {
+  pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
+    pnpm = pnpm_9;
     fetcherVersion = 1;
     hash = "sha256-xPG67b54h+KmDrCgMmTVVVnBah9L6rgjh+EWnEzzI0w=";
   };

pkgs/by-name/ba/backrest/package.nix

@@ -7,6 +7,8 @@
   libredirect,
   nodejs,
   pnpm_9,
+  fetchPnpmDeps,
+  pnpmConfigHook,
   restic,
   stdenv,
   util-linux,
@@ -30,11 +32,13 @@ let
 
     nativeBuildInputs = [
       nodejs
-      pnpm_9.configHook
+      pnpmConfigHook
+      pnpm_9
     ];
 
-    pnpmDeps = pnpm_9.fetchDeps {
+    pnpmDeps = fetchPnpmDeps {
       inherit (finalAttrs) pname version src;
+      pnpm = pnpm_9;
       fetcherVersion = 1;
       hash = "sha256-vJgsU0OXyAKjUJsPOyIY8o3zfNW1BUZ5IL814wmJr3o=";
     };

pkgs/by-name/ba/bash-language-server/package.nix

@@ -3,12 +3,13 @@
   stdenvNoCC,
   fetchFromGitHub,
   pnpm_10,
+  fetchPnpmDeps,
+  pnpmConfigHook,
   nodejs,
   makeBinaryWrapper,
   shellcheck,
   versionCheckHook,
 }:
-
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "bash-language-server";
   version = "5.6.0";
@@ -21,20 +22,22 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   };
 
   pnpmWorkspaces = [ "bash-language-server" ];
-  pnpmDeps = pnpm_10.fetchDeps {
+  pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs)
       pname
       version
       src
       pnpmWorkspaces
       ;
+    pnpm = pnpm_10;
     fetcherVersion = 3;
     hash = "sha256-6i+1V3ZkjiJ/IXDun3JfwmfDOiemxCmAXMzS/rGT6ZU=";
   };
 
   nativeBuildInputs = [
     nodejs
-    pnpm_10.configHook
+    pnpmConfigHook
+    pnpm_10
     makeBinaryWrapper
     versionCheckHook
   ];

pkgs/by-name/bc/bcachefs-tools/package.nix

@@ -28,13 +28,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "bcachefs-tools";
-  version = "1.33.1";
+  version = "1.33.2";
 
   src = fetchFromGitHub {
     owner = "koverstreet";
     repo = "bcachefs-tools";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-t5dJSTkv12pfWH7TV/PKpgMdyML+Y7y3P30NmW2H7C8=";
+    hash = "sha256-L7Ir5oOKMxgHWxdRBhM9VVGWMu/ePmezkUy4pHoMB2M=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {

pkgs/by-name/bi/biome/package.nix

@@ -10,16 +10,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "biome";
-  version = "2.3.8";
+  version = "2.3.9";
 
   src = fetchFromGitHub {
     owner = "biomejs";
     repo = "biome";
     rev = "@biomejs/biome@${finalAttrs.version}";
-    hash = "sha256-pNWwFrI0EWY8HB8aCZdZ/Y+LJl3MS4vl0HhpYFEGUbY=";
+    hash = "sha256-2eW60IoEeh3pnnsnZLdS6paw0f6vf+2LBM95WyOKDwc=";
   };
 
-  cargoHash = "sha256-gafj1Gm3YUVpLgZXN5lMRvEFo6GEHbmWbNDm+0OTi8w=";
+  cargoHash = "sha256-WSl/OObiOXx4MJcnGQtvGVfM2i5k8lLIQoPy9s+GT/U=";
 
   nativeBuildInputs = [ pkg-config ];
 

pkgs/by-name/bi/bitwarden-desktop/package.nix

@@ -3,7 +3,7 @@
   buildNpmPackage,
   cargo,
   copyDesktopItems,
-  dart,
+  dart-sass,
   darwin,
   electron_37,
   fetchFromGitHub,
@@ -130,8 +130,13 @@ buildNpmPackage' rec {
       exit 1
     fi
 
+    # force our dart-sass executable
     substituteInPlace node_modules/sass-embedded/dist/lib/src/compiler-path.js \
-      --replace-fail "\''${compiler_module_1.compilerModule}/dart-sass/src/dart" "${lib.getExe' dart "dartaotruntime"}"
+      --replace-fail "dart-sass/src/sass.snapshot" "dart-sass/src/sass.snapshot.disabled"
+
+    for f in $(find node_modules/ -name sass -type f -executable); do
+      ln -sf ${lib.getExe dart-sass} $f
+    done
 
     pushd apps/desktop/desktop_native/napi
     npm run build

pkgs/by-name/bl/bluesky-pds/package.nix

@@ -5,6 +5,8 @@
   srcOnly,
   python3,
   pnpm_9,
+  fetchPnpmDeps,
+  pnpmConfigHook,
   fetchFromGitHub,
   nodejs,
   vips,
@@ -38,7 +40,8 @@ stdenv.mkDerivation (finalAttrs: {
     nodejs
     pythonEnv
     pkg-config
-    pnpm_9.configHook
+    pnpmConfigHook
+    pnpm_9
     removeReferencesTo
   ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [
@@ -48,13 +51,14 @@ stdenv.mkDerivation (finalAttrs: {
   # Required for `sharp` NPM dependency
   buildInputs = [ vips ];
 
-  pnpmDeps = pnpm_9.fetchDeps {
+  pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs)
       pname
       version
       src
       sourceRoot
       ;
+    pnpm = pnpm_9;
     fetcherVersion = 2;
     hash = "sha256-4qKWkINpUHzatiMa7ZNYp1NauU2641W0jHDjmRL9ipI=";
   };

pkgs/by-name/bo/boxflat/package.nix

@@ -14,14 +14,14 @@
 
 python3Packages.buildPythonPackage rec {
   pname = "boxflat";
-  version = "1.35.2";
+  version = "1.35.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Lawstorant";
     repo = "boxflat";
     tag = "v${version}";
-    hash = "sha256-7JIIFti8LHBIDBr+GywImlP2l3Ct/hq4pb5+2/q+F0k=";
+    hash = "sha256-ayreXC73OLNpnwNuJe0ImC/ch5W+O0lnkuD31ztTqso=";
   };
 
   build-system = [ python3Packages.setuptools ];

pkgs/by-name/br/brave/package.nix

@@ -3,24 +3,24 @@
 
 let
   pname = "brave";
-  version = "1.85.116";
+  version = "1.85.117";
 
   allArchives = {
     aarch64-linux = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_arm64.deb";
-      hash = "sha256-ZqlIWj3bn0cfpDgQE7d1ipRvVIyvH2R54sXei3DhD3k=";
+      hash = "sha256-cGqxB3dVYraCqf3DoO3Who2RFm+ZnSedUG5jb8D9Mk8=";
     };
     x86_64-linux = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_amd64.deb";
-      hash = "sha256-mMUtXJO7fAKWl79kLAsrujbwMT3Hc2ys7RV8BU2HSh4=";
+      hash = "sha256-ov0gwAv9tCX45EqZa3SBXIzgczBD1RwNS+N1L2vE3Uc=";
     };
     aarch64-darwin = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-v${version}-darwin-arm64.zip";
-      hash = "sha256-RJzyxK5PV/wGXKJzG/f6MXzNwIQaIC2gMFDZLxE1QoA=";
+      hash = "sha256-SFe2qX/BugI9Pumv2me5jfC1FpRUsSbtSm+Jl+gW03U=";
     };
     x86_64-darwin = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-v${version}-darwin-x64.zip";
-      hash = "sha256-acn5t+hE3ZpgAr9fFV/J3hXzyQcVlyDVRxMU7exvunE=";
+      hash = "sha256-Z0n+TqcgZXqjS1hBx9uznEC6/LftZfaE7k26RhsWI0I=";
     };
   };
 

pkgs/by-name/br/brev-cli/package.nix

@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "brev-cli";
-  version = "0.6.314";
+  version = "0.6.315";
 
   src = fetchFromGitHub {
     owner = "brevdev";
     repo = "brev-cli";
     rev = "v${version}";
-    sha256 = "sha256-/EzRKmpfQndZFL3c82u0w0V8EH/TFptU3zkHPvsIM6s=";
+    sha256 = "sha256-yh2swlPjBCwLKeND4bfCCNHWJSBQvjhIT16fHWVpDE4=";
   };
 
   vendorHash = "sha256-CzGuEbq4I1ygYQsoyyXC6gDBMLg21dKQTKkrbwpAR2U=";

pkgs/by-name/bu/bumpp/package.nix

@@ -3,14 +3,13 @@
   stdenv,
   fetchFromGitHub,
   nodejs,
-  pnpm_10,
+  fetchPnpmDeps,
+  pnpmConfigHook,
+  pnpm,
   npmHooks,
   versionCheckHook,
   nix-update-script,
 }:
-let
-  pnpm = pnpm_10;
-in
 stdenv.mkDerivation (finalAttrs: {
   pname = "bumpp";
   version = "10.3.2";
@@ -22,7 +21,7 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-1hGVLPogdeyWh/B2Yxfo/9YbJpFYl8ATh+QCa2VVyyk=";
   };
 
-  pnpmDeps = pnpm.fetchDeps {
+  pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
     fetcherVersion = 2;
     hash = "sha256-y7uHDtoOjsLnNF47r4aWHYXW0ui8shhn1M0cD2FpaCg=";
@@ -30,7 +29,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [
     nodejs
-    pnpm.configHook
+    pnpmConfigHook
+    pnpm
     npmHooks.npmInstallHook
   ];
 

pkgs/by-name/bu/bun/package.nix

@@ -17,7 +17,7 @@
 }:
 
 stdenvNoCC.mkDerivation rec {
-  version = "1.3.4";
+  version = "1.3.5";
   pname = "bun";
 
   src =
@@ -87,19 +87,19 @@ stdenvNoCC.mkDerivation rec {
     sources = {
       "aarch64-darwin" = fetchurl {
         url = "https://github.com/oven-sh/bun/releases/download/bun-v${version}/bun-darwin-aarch64.zip";
-        hash = "sha256-iAN3TkxsVcilF0ZMUI8Cgh5ttX+Uyhu1zCo59NIyalE=";
+        hash = "sha256-2xdYikrqiASFaCXUvq0/BeHzcnbKYG8342m09y810/s=";
       };
       "aarch64-linux" = fetchurl {
         url = "https://github.com/oven-sh/bun/releases/download/bun-v${version}/bun-linux-aarch64.zip";
-        hash = "sha256-xG6EH+2FNHUhkVsbOQTW0XXY4v2RXhjgHBETGCGRFaQ=";
+        hash = "sha256-7QEAD4W9l3hSKK0oRdySoYYLgFSFaCbXMXaQrI+O50s=";
       };
       "x86_64-darwin" = fetchurl {
         url = "https://github.com/oven-sh/bun/releases/download/bun-v${version}/bun-darwin-x64-baseline.zip";
-        hash = "sha256-D3lW1Rr+1BTIJaOk+OzJvGE/9k5IkBZ3XoUU21E3s18=";
+        hash = "sha256-NLmla4UQWNr6G8nWEjPyw4OqmWiJu6MLMYD1zMLP8bI=";
       };
       "x86_64-linux" = fetchurl {
         url = "https://github.com/oven-sh/bun/releases/download/bun-v${version}/bun-linux-x64.zip";
-        hash = "sha256-M8aZYEno036LgVlZsUsF5bb0lhITUr8RuufQRxk8KL8=";
+        hash = "sha256-cFHYapJK7+o+C5YhO1/Y95wHk/nK5lNCM+Yn5cPbRmk=";
       };
     };
     updateScript = writeShellScript "update-bun" ''

pkgs/by-name/ca/cargo-tauri/test-app.nix

@@ -8,15 +8,12 @@
   openssl,
   pkg-config,
   pnpm_9,
+  fetchPnpmDeps,
+  pnpmConfigHook,
   rustPlatform,
   webkitgtk_4_1,
   wrapGAppsHook4,
 }:
-
-let
-  pnpm = pnpm_9;
-in
-
 stdenv.mkDerivation (finalAttrs: {
   pname = "test-app";
   inherit (cargo-tauri) version src;
@@ -28,12 +25,13 @@ stdenv.mkDerivation (finalAttrs: {
 
   inherit (cargo-tauri) cargoDeps;
 
-  pnpmDeps = pnpm.fetchDeps {
+  pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs)
       pname
       version
       src
       ;
+    pnpm = pnpm_9;
 
     fetcherVersion = 1;
     hash = "sha256-gHniZv847JFrmKnTUZcgyWhFl/ovJ5IfKbbM5I21tZc=";
@@ -44,7 +42,8 @@ stdenv.mkDerivation (finalAttrs: {
 
     nodejs
     pkg-config
-    pnpm.configHook
+    pnpmConfigHook
+    pnpm_9
     rustPlatform.cargoCheckHook
     rustPlatform.cargoSetupHook
     wrapGAppsHook4