Merge staging-nixos into staging-next

nixos/doc/manual/redirects.json

@@ -1466,6 +1466,24 @@
   "module-services-mailman-other-mtas": [
     "index.html#module-services-mailman-other-mtas"
   ],
+  "test-opt-requiredFeatures": [
+    "index.html#test-opt-requiredFeatures"
+  ],
+  "test-opt-requiredFeatures.apple-virt": [
+    "index.html#test-opt-requiredFeatures.apple-virt"
+  ],
+  "test-opt-requiredFeatures.devnet": [
+    "index.html#test-opt-requiredFeatures.devnet"
+  ],
+  "test-opt-requiredFeatures.kvm": [
+    "index.html#test-opt-requiredFeatures.kvm"
+  ],
+  "test-opt-requiredFeatures.nixos-test": [
+    "index.html#test-opt-requiredFeatures.nixos-test"
+  ],
+  "test-opt-requiredFeatures.uid-range": [
+    "index.html#test-opt-requiredFeatures.uid-range"
+  ],
   "trezor": [
     "index.html#trezor"
   ],

nixos/doc/manual/release-notes/rl-2605.section.md

@@ -42,6 +42,15 @@
 
 - The default kernel package has been updated from 6.12 to 6.18. All supported kernels remain available.
 
+- The default D-Bus implementation has been switched from `dbus` to `dbus-broker`. dbus-broker provides
+  higher performance and reliability while maintaining compatibility with the D-Bus reference implementation.
+
+  Note that changing `services.dbus.implementation` is a **switch inhibitor**: switching between
+  implementations requires a reboot rather than just `nixos-rebuild switch`, because restarting D-Bus
+  mid-session is unsafe.
+
+  Users who wish to keep the classic daemon can set: `services.dbus.implementation = "dbus";`
+
 ## New Modules {#sec-release-26.05-new-modules}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->

nixos/lib/testing/run.nix

@@ -3,6 +3,7 @@
   hostPkgs,
   lib,
   containers,
+  nodes,
   options,
   ...
 }:
@@ -28,9 +29,62 @@ let
     */
     f:
     lib.mkOverride (opt.highestPrio - 1) (f opt.value);
+
+  requiredFeaturesModuleType = {
+    freeformType = types.attrsOf types.bool;
+    options = {
+      devnet = mkOption {
+        type = types.bool;
+        default =
+          builtins.length (lib.attrNames containers) > 0 && builtins.length (lib.attrNames nodes) > 0;
+        defaultText = lib.literalMD "`true` if both VMs and containers are present.";
+        description = ''
+          This heuristic setting that assumes that the majority of tests requires VMs and containers
+          to communicate over network. To support such tests, adding "/dev/net" to `nix.settings.extra-sandbox-paths` is necessary.
+
+          Override this to `false` if the heuristic is wrong in some cases.
+        '';
+      };
+      nixos-test = mkOption {
+        type = types.bool;
+        default = true;
+        description = "Standard requirement for NixOS integration tests";
+      };
+      uid-range = mkOption {
+        type = types.bool;
+        default = builtins.length (lib.attrNames containers) > 0;
+        defaultText = lib.literalMD "`true` if containers are present.";
+        description = "Containers use systemd-nspawn, which requires pid 0 inside of the sandbox. `uid-range` enables that.";
+      };
+      kvm = mkOption {
+        type = types.bool;
+        default = isLinux;
+        defaultText = lib.literalMD "`true` if built to run on Linux.";
+        description = "Whether Linux KVM virtualization is required when running this test. Can be disabled to allow emulated execution.";
+      };
+      apple-virt = mkOption {
+        type = types.bool;
+        default = isDarwin;
+        defaultText = lib.literalMD "`true` if built to run on Darwin.";
+        description = "Whether Apple virtualization functionality is required for running this test.";
+      };
+    };
+  };
 in
 {
   options = {
+    requiredFeatures = mkOption {
+      description = "Builder features that are required for running this test.";
+      example = lib.literalExpression ''
+        {
+          cuda = true;
+          devnet = mkForce false;
+        }
+      '';
+      type = types.submodule requiredFeaturesModuleType;
+      default = { }; # this is necessary due to a bug in the module system.
+    };
+
     passthru = mkOption {
       type = types.lazyAttrsOf types.raw;
       description = ''
@@ -98,13 +152,7 @@ in
       {
         name = "vm-test-run-${config.name}";
 
-        requiredSystemFeatures = [
-          "nixos-test"
-        ]
-        # Containers use systemd-nspawn, which requires pid 0 inside of the sandbox.
-        ++ lib.optional (builtins.length (lib.attrNames containers) > 0) "uid-range"
-        ++ lib.optional isLinux "kvm"
-        ++ lib.optional isDarwin "apple-virt";
+        requiredSystemFeatures = lib.attrNames (lib.filterAttrs (_: v: v) config.requiredFeatures);
 
         nativeBuildInputs = lib.optionals config.enableDebugHook [
           hostPkgs.openssh

nixos/modules/config/sysctl.nix

@@ -1,4 +1,9 @@
-{ config, lib, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 let
 
   sysctlOption = lib.mkOptionType {
@@ -87,6 +92,28 @@ in
       # the value below is used by default on several other distros.
       "fs.inotify.max_user_instances" = lib.mkDefault 524288;
       "fs.inotify.max_user_watches" = lib.mkDefault 524288;
+
+      # Maximise address space randomisation.
+      "vm.mmap_rnd_bits" = lib.mkMerge [
+        (lib.mkIf pkgs.stdenv.hostPlatform.isAarch64 (
+          let
+            kernel = config.boot.kernelPackages.kernel;
+            isYes = kernel.config.isYes or (_: false);
+          in
+          lib.mkDefault (
+            if isYes "ARM64_64K_PAGES" then
+              29
+            else if isYes "ARM64_16K_PAGES" then
+              31
+            else
+              33
+          )
+        ))
+        (lib.mkIf pkgs.stdenv.hostPlatform.isx86_64 (lib.mkDefault 32))
+      ];
+      "vm.mmap_rnd_compat_bits" = lib.mkIf (
+        pkgs.stdenv.hostPlatform.isx86_64 || pkgs.stdenv.hostPlatform.isAarch64
+      ) (lib.mkDefault 16);
     };
   };
 }

nixos/modules/services/system/dbus.nix

@@ -68,7 +68,7 @@ in
           "dbus"
           "broker"
         ];
-        default = "dbus";
+        default = "broker";
         description = ''
           The implementation to use for the message bus defined by the D-Bus specification.
           Can be either the classic dbus daemon or dbus-broker, which aims to provide high

pkgs/by-name/ty/ty/package.nix

@@ -14,14 +14,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ty";
-  version = "0.0.31";
+  version = "0.0.32";
 
   src = fetchFromGitHub {
     owner = "astral-sh";
     repo = "ty";
     tag = finalAttrs.version;
     fetchSubmodules = true;
-    hash = "sha256-TJGEI22hp+YZCxIvZgNc8BF2Dd+z/TzpnRW2pO1f3X0=";
+    hash = "sha256-534/xT6JfbgEboH1q4R4JTl2/gLKKs1wU9eqoZf0Asw=";
   };
 
   # For Darwin platforms, remove the integration test for file notifications,
@@ -35,7 +35,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   cargoBuildFlags = [ "--package=ty" ];
 
-  cargoHash = "sha256-JTE/zRf+VqBoLaoMaQ4ioVsr3Njm3OGkpMMnsPg3lsA=";
+  cargoHash = "sha256-uQkrvSmvQXJj+WlGLI+2fHNQeCd1eYJrJJ1z3OZSHbA=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/os-specific/linux/busybox/default.nix

@@ -167,6 +167,7 @@ stdenv.mkDerivation rec {
     1 a busybox() { '$out'/bin/busybox "$@"; }\
     logger() { '$out'/bin/logger "$@"; }\
     ' ${debianDispatcherScript} > ${outDispatchPath}
+    sed -i 's|/sbin/resolvconf|"$(busybox which resolvconf)"|g' ${outDispatchPath}
     chmod 555 ${outDispatchPath}
     HOST_PATH=$out/bin patchShebangs --host ${outDispatchPath}
   '';