From 4d636a2c3e0daaf506aac307f979fe4b12313e88 Mon Sep 17 00:00:00 2001 From: nikstur Date: Sat, 11 Apr 2026 14:19:21 +0200 Subject: [PATCH 1/9] systemd: remove unused inputs --- pkgs/os-specific/linux/systemd/default.nix | 3 --- 1 file changed, 3 deletions(-) diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix index 4291432ebffc..019234beb9a9 100644 --- a/pkgs/os-specific/linux/systemd/default.nix +++ b/pkgs/os-specific/linux/systemd/default.nix @@ -5,7 +5,6 @@ pkgsCross, testers, fetchFromGitHub, - fetchzip, buildPackages, makeBinaryWrapper, ninja, @@ -14,10 +13,8 @@ pkg-config, coreutils, gperf, - getent, glibcLocales, autoPatchelfHook, - fetchpatch, # glib is only used during tests (test-bus-gvariant, test-bus-marshal) glib, From db6719e99e72df9e613bdc44f49e25d7e184ff29 Mon Sep 17 00:00:00 2001 From: nikstur Date: Sat, 11 Apr 2026 14:19:45 +0200 Subject: [PATCH 2/9] systemd: remove gnutar systemd doesn't rely on tar anymore and instead uses libarchive for this. --- pkgs/os-specific/linux/systemd/default.nix | 27 ---------------------- 1 file changed, 27 deletions(-) diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix index 019234beb9a9..db61ced0f25e 100644 --- a/pkgs/os-specific/linux/systemd/default.nix +++ b/pkgs/os-specific/linux/systemd/default.nix @@ -38,7 +38,6 @@ libgpg-error, libidn2, curl, - gnutar, gnupg, zlib, xz, @@ -608,29 +607,6 @@ stdenv.mkDerivation (finalAttrs: { replacement = "\\\"${gnupg}/bin/gpg\\\""; where = [ "src/import/pull-common.c" ]; } - { - search = "\"tar\""; - replacement = "\\\"${gnutar}/bin/tar\\\""; - where = [ - "src/import/export-tar.c" - "src/import/import-tar.c" - ]; - ignore = [ - # occurrences here refer to the tar sub command - "src/sysupdate/sysupdate-resource.c" - "src/sysupdate/sysupdate-transfer.c" - "src/import/pull.c" - "src/import/export.c" - "src/import/import.c" - "src/import/importd.c" - # runs `tar` but also creates a temporary directory with the string - "src/import/pull-tar.c" - # pull-oci.c has tar references handled in postPatch - "src/import/pull-oci.c" - # tar referenced as file suffix - "src/shared/import-util.c" - ]; - } ] ++ lib.optionals withKmod [ { @@ -685,9 +661,6 @@ stdenv.mkDerivation (finalAttrs: { substituteInPlace src/libsystemd/sd-journal/catalog.c \ --replace /usr/lib/systemd/catalog/ $out/lib/systemd/catalog/ - - substituteInPlace src/import/pull-tar.c src/import/pull-oci.c \ - --replace 'wait_for_terminate_and_check("tar"' 'wait_for_terminate_and_check("${gnutar}/bin/tar"' ''; # These defines are overridden by CFLAGS and would trigger annoying From e3165357192a4275e0c4c542cf39465422fb13c1 Mon Sep 17 00:00:00 2001 From: nikstur Date: Sat, 11 Apr 2026 14:21:21 +0200 Subject: [PATCH 3/9] systemd: remove gnupg dependency gpg is read via PATH and thus doesn't need to be patched into the systemd source. Instead, we can override it via the module system. --- pkgs/os-specific/linux/systemd/default.nix | 8 -------- pkgs/top-level/all-packages.nix | 5 ----- 2 files changed, 13 deletions(-) diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix index db61ced0f25e..1d859a689af0 100644 --- a/pkgs/os-specific/linux/systemd/default.nix +++ b/pkgs/os-specific/linux/systemd/default.nix @@ -38,7 +38,6 @@ libgpg-error, libidn2, curl, - gnupg, zlib, xz, zstd, @@ -601,13 +600,6 @@ stdenv.mkDerivation (finalAttrs: { where = [ "man/systemd-fsck@.service.xml" ]; } ] - ++ lib.optionals withImportd [ - { - search = "\"gpg\""; - replacement = "\\\"${gnupg}/bin/gpg\\\""; - where = [ "src/import/pull-common.c" ]; - } - ] ++ lib.optionals withKmod [ { search = "ExecStart=-modprobe"; diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index 585a7e4cf9a8..81bb10d5e8f2 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -8786,11 +8786,6 @@ with pkgs; systemd = callPackage ../os-specific/linux/systemd { # break some cyclic dependencies util-linux = util-linuxMinimal; - # provide a super minimal gnupg used for systemd-machined - gnupg = gnupg.override { - enableMinimal = true; - guiSupport = false; - }; }; systemdMinimal = systemd.override { pname = "systemd-minimal"; From 74f9684a0a2f74257795a04190d95f9c64e1de01 Mon Sep 17 00:00:00 2001 From: nikstur Date: Sun, 12 Apr 2026 18:27:12 +0200 Subject: [PATCH 4/9] nixos/systemd: include gpg in path for relevant units Previously, this was patched directly into the systemd derivation. Now, this is done via the module system. To make building systemd and maintaining it simpler. --- nixos/modules/system/boot/systemd.nix | 5 ++++- nixos/modules/system/boot/systemd/sysupdate.nix | 5 ++++- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/nixos/modules/system/boot/systemd.nix b/nixos/modules/system/boot/systemd.nix index 711c75156920..53f002b9078d 100644 --- a/nixos/modules/system/boot/systemd.nix +++ b/nixos/modules/system/boot/systemd.nix @@ -804,7 +804,10 @@ in systemd.services.systemd-update-utmp.restartIfChanged = false; systemd.targets.local-fs.unitConfig.X-StopOnReconfiguration = true; systemd.targets.remote-fs.unitConfig.X-StopOnReconfiguration = true; - systemd.services.systemd-importd.environment = proxy_env; + systemd.services.systemd-importd = lib.mkIf cfg.package.withImportd { + environment = proxy_env; + path = [ pkgs.gnupg ]; + }; systemd.services.systemd-pstore.wantedBy = [ "sysinit.target" ]; # see #81138 # NixOS has kernel modules in a different location, so override that here. diff --git a/nixos/modules/system/boot/systemd/sysupdate.nix b/nixos/modules/system/boot/systemd/sysupdate.nix index 0f8bc2dd966b..3fa8dc212ea2 100644 --- a/nixos/modules/system/boot/systemd/sysupdate.nix +++ b/nixos/modules/system/boot/systemd/sysupdate.nix @@ -136,7 +136,10 @@ in "systemd-sysupdated.service" ]; - systemd.services.systemd-sysupdated.aliases = [ "dbus-org.freedesktop.sysupdate1.service" ]; + systemd.services.systemd-sysupdated = { + aliases = [ "dbus-org.freedesktop.sysupdate1.service" ]; + path = [ pkgs.gnupg ]; + }; systemd.timers = { "systemd-sysupdate" = { From 8a17f4b9720e7a5849aba135d0cf7fd9b5d4b191 Mon Sep 17 00:00:00 2001 From: nikstur Date: Sat, 11 Apr 2026 14:24:10 +0200 Subject: [PATCH 5/9] systemd: remove replacing modprobe This path is already correctly overriden via the module system on master and thus is unneeded. --- pkgs/os-specific/linux/systemd/default.nix | 7 ------- 1 file changed, 7 deletions(-) diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix index 1d859a689af0..eb1a51f58205 100644 --- a/pkgs/os-specific/linux/systemd/default.nix +++ b/pkgs/os-specific/linux/systemd/default.nix @@ -599,13 +599,6 @@ stdenv.mkDerivation (finalAttrs: { replacement = "$out/lib/systemd/systemd-fsck"; where = [ "man/systemd-fsck@.service.xml" ]; } - ] - ++ lib.optionals withKmod [ - { - search = "ExecStart=-modprobe"; - replacement = "ExecStart=-${lib.getBin kmod}/bin/modprobe"; - where = [ "units/modprobe@.service" ]; - } ]; # { replacement, search, where, ignore } -> List[str] From 62bfb23a26bd730af99518908fe8bb121b0060b5 Mon Sep 17 00:00:00 2001 From: nikstur Date: Sat, 11 Apr 2026 14:28:06 +0200 Subject: [PATCH 6/9] systemd: remove remaining binaryReplacements These were only replaying paths in man pages or tests. Since we do not run the tests (because they don't work yet on NixOS), this is just maintenance churn without being useful. Patching manpages is IMO also not useful because manpages that diverge from their canonical form are more confusing than helpful. --- pkgs/os-specific/linux/systemd/default.nix | 93 ++-------------------- 1 file changed, 5 insertions(+), 88 deletions(-) diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix index eb1a51f58205..5459706c6922 100644 --- a/pkgs/os-specific/linux/systemd/default.nix +++ b/pkgs/os-specific/linux/systemd/default.nix @@ -558,95 +558,12 @@ stdenv.mkDerivation (finalAttrs: { (lib.mesonBool "gshadow" false) (lib.mesonBool "idn" false) ]; - preConfigure = - let - # A list of all the runtime binaries referenced by the source code (plus - # scripts and unit files) of systemd executables, tests and libraries. - # As soon as a dependency is lo longer required we should remove it from - # the list. - # The `where` attribute for each of the replacement patterns must be - # exhaustive. If another (unhandled) case is found in the source code the - # build fails with an error message. - binaryReplacements = [ - { - search = "/sbin/mkswap"; - replacement = "${lib.getBin util-linux}/sbin/mkswap"; - where = [ - "man/systemd-makefs@.service.xml" - ]; - } - { - search = "/bin/echo"; - replacement = "${coreutils}/bin/echo"; - where = [ - "man/systemd-analyze.xml" - "man/systemd.service.xml" - "man/systemd-run.xml" - "src/analyze/test-verify.c" - "src/test/test-env-file.c" - "src/test/test-load-fragment.c" - ]; - } - { - search = "/bin/cat"; - replacement = "${coreutils}/bin/cat"; - where = [ - "test/test-execute/exec-noexecpaths-simple.service" - ]; - } - { - search = "/usr/lib/systemd/systemd-fsck"; - replacement = "$out/lib/systemd/systemd-fsck"; - where = [ "man/systemd-fsck@.service.xml" ]; - } - ]; + preConfigure = '' + mesonFlagsArray+=(-Dntp-servers="0.nixos.pool.ntp.org 1.nixos.pool.ntp.org 2.nixos.pool.ntp.org 3.nixos.pool.ntp.org") - # { replacement, search, where, ignore } -> List[str] - mkSubstitute = - { - replacement, - search, - where, - ignore ? [ ], - }: - map (path: "substituteInPlace ${path} --replace '${search}' \"${replacement}\"") where; - mkEnsureSubstituted = - { - replacement, - search, - where, - ignore ? [ ], - }: - let - ignore' = lib.concatStringsSep "|" ( - ignore - ++ [ - "^test" - "NEWS" - ] - ); - in - '' - set +e - search=$(grep '${search}' -r | grep -v "${replacement}" | grep -Ev "${ignore'}") - set -e - if [[ -n "$search" ]]; then - echo "Not all references to '${search}' have been replaced. Found the following matches:" - echo "$search" - exit 1 - fi - ''; - in - '' - mesonFlagsArray+=(-Dntp-servers="0.nixos.pool.ntp.org 1.nixos.pool.ntp.org 2.nixos.pool.ntp.org 3.nixos.pool.ntp.org") - export LC_ALL="en_US.UTF-8"; - - ${lib.concatStringsSep "\n" (lib.flatten (map mkSubstitute binaryReplacements))} - ${lib.concatMapStringsSep "\n" mkEnsureSubstituted binaryReplacements} - - substituteInPlace src/libsystemd/sd-journal/catalog.c \ - --replace /usr/lib/systemd/catalog/ $out/lib/systemd/catalog/ - ''; + substituteInPlace src/libsystemd/sd-journal/catalog.c \ + --replace /usr/lib/systemd/catalog/ $out/lib/systemd/catalog/ + ''; # These defines are overridden by CFLAGS and would trigger annoying # warning messages From 14694560509a50cb0a7db3c6486e4eab60bef371 Mon Sep 17 00:00:00 2001 From: nikstur Date: Sat, 11 Apr 2026 14:34:05 +0200 Subject: [PATCH 7/9] systemd: move ntp-server option to mesonOption This was the only instance left that didn't use mesonOption. --- pkgs/os-specific/linux/systemd/default.nix | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix index 5459706c6922..087d88493550 100644 --- a/pkgs/os-specific/linux/systemd/default.nix +++ b/pkgs/os-specific/linux/systemd/default.nix @@ -388,6 +388,7 @@ stdenv.mkDerivation (finalAttrs: { (lib.mesonOption "tty-gid" "3") # tty in NixOS has gid 3 (lib.mesonOption "pamconfdir" "${placeholder "out"}/etc/pam.d") (lib.mesonOption "shellprofiledir" "${placeholder "out"}/etc/profile.d") + (lib.mesonOption "ntp-servers" "0.nixos.pool.ntp.org 1.nixos.pool.ntp.org 2.nixos.pool.ntp.org 3.nixos.pool.ntp.org") # /bin/sh is also the upstream default. Explicitly set this so that we're # independent of upstream changes to the default. @@ -559,8 +560,6 @@ stdenv.mkDerivation (finalAttrs: { (lib.mesonBool "idn" false) ]; preConfigure = '' - mesonFlagsArray+=(-Dntp-servers="0.nixos.pool.ntp.org 1.nixos.pool.ntp.org 2.nixos.pool.ntp.org 3.nixos.pool.ntp.org") - substituteInPlace src/libsystemd/sd-journal/catalog.c \ --replace /usr/lib/systemd/catalog/ $out/lib/systemd/catalog/ ''; From a423c2b8b516ed9e2f80d365e1046c7af2553c37 Mon Sep 17 00:00:00 2001 From: nikstur Date: Sat, 11 Apr 2026 14:35:31 +0200 Subject: [PATCH 8/9] systemd: remove superfluous rm of rpm files We disable building the rpm artifacts via meson. This was accidentally left over and did nothing. --- pkgs/os-specific/linux/systemd/default.nix | 2 -- 1 file changed, 2 deletions(-) diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix index 087d88493550..4fc21be6e124 100644 --- a/pkgs/os-specific/linux/systemd/default.nix +++ b/pkgs/os-specific/linux/systemd/default.nix @@ -614,8 +614,6 @@ stdenv.mkDerivation (finalAttrs: { # For compatibility with dependents that use sbin instead of bin. ln -s bin "$out/sbin" - - rm -rf $out/etc/rpm '' + lib.optionalString (!withKernelInstall) '' # "kernel-install" shouldn't be used on NixOS. From 89335953f8106229a33455a421c31ae789c34522 Mon Sep 17 00:00:00 2001 From: nikstur Date: Sat, 11 Apr 2026 14:57:02 +0200 Subject: [PATCH 9/9] systemd: remove superfluous postInstall This is not needed because we already disable kernel-install via meson. --- pkgs/os-specific/linux/systemd/default.nix | 4 ---- 1 file changed, 4 deletions(-) diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix index 4fc21be6e124..46a4d10686dc 100644 --- a/pkgs/os-specific/linux/systemd/default.nix +++ b/pkgs/os-specific/linux/systemd/default.nix @@ -615,10 +615,6 @@ stdenv.mkDerivation (finalAttrs: { # For compatibility with dependents that use sbin instead of bin. ln -s bin "$out/sbin" '' - + lib.optionalString (!withKernelInstall) '' - # "kernel-install" shouldn't be used on NixOS. - find $out -name "*kernel-install*" -exec rm {} \; - '' + lib.optionalString (!withDocumentation) '' rm -rf $out/share/doc ''