gador/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge branch 'master' into current

Browse Source
This commit is contained in:
gador
2026-05-22 17:19:27 +02:00
parent 8066349637 1231198690
commit 4cba6d1cc6
5087 changed files with 92748 additions and 58742 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/ISSUE_TEMPLATE/01_bug_report.yml
+2
View File
@@ -121,6 +121,8 @@ body:
required: true
- label: "I assert that I have read the [NixOS Code of Conduct](https://github.com/NixOS/.github/blob/master/CODE_OF_CONDUCT.md) and agree to abide by it."
required: true
- label: "I assert that I have read the [automation/AI policy](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md#automationai-policy) and that this issue report complies with it."
required: true
- type: "markdown"
attributes:
value: |
.github/ISSUE_TEMPLATE/02_bug_report_darwin.yml
+2
View File
@@ -135,6 +135,8 @@ body:
required: true
- label: "I assert that I have read the [NixOS Code of Conduct](https://github.com/NixOS/.github/blob/master/CODE_OF_CONDUCT.md) and agree to abide by it."
required: true
- label: "I assert that I have read the [automation/AI policy](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md#automationai-policy) and that this issue report complies with it."
required: true
- type: "markdown"
attributes:
value: |
.github/ISSUE_TEMPLATE/03_bug_report_nixos.yml
+2
View File
@@ -125,6 +125,8 @@ body:
required: true
- label: "I assert that I have read the [NixOS Code of Conduct](https://github.com/NixOS/.github/blob/master/CODE_OF_CONDUCT.md) and agree to abide by it."
required: true
- label: "I assert that I have read the [automation/AI policy](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md#automationai-policy) and that this issue report complies with it."
required: true
- type: "markdown"
attributes:
value: |
.github/ISSUE_TEMPLATE/04_build_failure.yml
+2
View File
@@ -131,6 +131,8 @@ body:
required: true
- label: "I assert that I have read the [NixOS Code of Conduct](https://github.com/NixOS/.github/blob/master/CODE_OF_CONDUCT.md) and agree to abide by it."
required: true
- label: "I assert that I have read the [automation/AI policy](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md#automationai-policy) and that this issue report complies with it."
required: true
- type: "markdown"
attributes:
value: |
.github/ISSUE_TEMPLATE/05_update_request.yml
+2
View File
@@ -104,6 +104,8 @@ body:
required: true
- label: "I assert that I have read the [NixOS Code of Conduct](https://github.com/NixOS/.github/blob/master/CODE_OF_CONDUCT.md) and agree to abide by it."
required: true
- label: "I assert that I have read the [automation/AI policy](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md#automationai-policy) and that this issue report complies with it."
required: true
- type: "markdown"
attributes:
value: |
.github/ISSUE_TEMPLATE/06_module_request.yml
+2
View File
@@ -79,6 +79,8 @@ body:
required: true
- label: "I assert that I have read the [NixOS Code of Conduct](https://github.com/NixOS/.github/blob/master/CODE_OF_CONDUCT.md) and agree to abide by it."
required: true
- label: "I assert that I have read the [automation/AI policy](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md#automationai-policy) and that this issue report complies with it."
required: true
- type: "markdown"
attributes:
value: |
.github/ISSUE_TEMPLATE/07_backport_request.yml
+2
View File
@@ -85,6 +85,8 @@ body:
required: true
- label: "I assert that I have read the [NixOS Code of Conduct](https://github.com/NixOS/.github/blob/master/CODE_OF_CONDUCT.md) and agree to abide by it."
required: true
- label: "I assert that I have read the [automation/AI policy](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md#automationai-policy) and that this issue report complies with it."
required: true
- type: "markdown"
attributes:
value: |
.github/ISSUE_TEMPLATE/08_documentation_request.yml
+2
View File
@@ -67,6 +67,8 @@ body:
required: true
- label: "I assert that I have read the [NixOS Code of Conduct](https://github.com/NixOS/.github/blob/master/CODE_OF_CONDUCT.md) and agree to abide by it."
required: true
- label: "I assert that I have read the [automation/AI policy](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md#automationai-policy) and that this issue report complies with it."
required: true
- type: "markdown"
attributes:
value: |
.github/ISSUE_TEMPLATE/09_unreproducible_package.yml
+2
View File
@@ -137,6 +137,8 @@ body:
required: true
- label: "I assert that I have read the [NixOS Code of Conduct](https://github.com/NixOS/.github/blob/master/CODE_OF_CONDUCT.md) and agree to abide by it."
required: true
- label: "I assert that I have read the [automation/AI policy](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md#automationai-policy) and that this issue report complies with it."
required: true
- type: "markdown"
attributes:
value: |
.github/PULL_REQUEST_TEMPLATE.md
+2
View File
@@ -27,12 +27,14 @@ For new packages please briefly describe the package or provide a link to its ho
- [ ] Module addition: when adding a new NixOS module.
- [ ] Module update: when the change is significant.
- [ ] Fits [CONTRIBUTING.md], [pkgs/README.md], [maintainers/README.md] and other READMEs.
- [ ] Follows the [automation/AI policy].
[NixOS tests]: https://nixos.org/manual/nixos/unstable/index.html#sec-nixos-tests
[Package tests]: https://github.com/NixOS/nixpkgs/blob/master/pkgs/README.md#package-tests
[nixpkgs-review usage]: https://github.com/Mic92/nixpkgs-review#usage
[CONTRIBUTING.md]: https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md
[automation/AI policy]: https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md#automationai-policy
[lib/tests]: https://github.com/NixOS/nixpkgs/blob/master/lib/tests
[maintainers/README.md]: https://github.com/NixOS/nixpkgs/blob/master/maintainers/README.md
[nixos/tests]: https://github.com/NixOS/nixpkgs/blob/master/nixos/tests
.github/workflows/backport.yml
+16 -3
View File
@@ -11,7 +11,7 @@ on:
permissions:
contents: read
issues: write # adding the 'has: port to stable' label
issues: write # adding the 'has: port to stable' and 'has: backport failed' label
pull-requests: write # creating backport pull requests
defaults:
@@ -27,7 +27,7 @@ jobs:
steps:
# Use a GitHub App to create the PR so that CI gets triggered
# The App is scoped to Repository > Contents and Pull Requests: write for Nixpkgs
- uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
- uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
id: app-token
with:
app-id: ${{ vars.NIXPKGS_CI_APP_ID }}
@@ -49,7 +49,7 @@ jobs:
- name: Create backport PRs
id: backport
uses: korthout/backport-action@7c3f6cd5843cac11bc59a04a1b7699af93261670 # v4.5.0
uses: korthout/backport-action@66065406958f46e82238fd59546f5a99e69e22aa # v4.5.2
with:
# Config README: https://github.com/korthout/backport-action#backport-action
add_author_as_reviewer: true
@@ -82,3 +82,16 @@ jobs:
issue_number: context.payload.pull_request.number,
labels: [ '8.has: port to stable' ]
})
- name: "Add 'has: failed backport' label"
if: steps.backport.outputs.was_successful == 'false'
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
with:
# Not using the app on purpose to avoid triggering another workflow run after adding this label.
script: |
await github.rest.issues.addLabels({
owner: context.repo.owner,
repo: context.repo.repo,
issue_number: context.payload.pull_request.number,
labels: [ '8.has: failed backport' ]
})
.github/workflows/bot.yml
+5 -5
View File
@@ -53,10 +53,10 @@ jobs:
ci/github-script
- name: Install dependencies
run: npm install @actions/artifact@5.0.3 bottleneck@2.19.5
run: npm install @actions/artifact@6.2.1 bottleneck@2.19.5
# Use a GitHub App, because it has much higher rate limits: 12,500 instead of 5,000 req / hour.
- uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
- uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
if: github.event_name != 'pull_request' && vars.NIXPKGS_CI_APP_ID
id: app-token
with:
@@ -91,7 +91,7 @@ jobs:
GH_TOKEN: ${{ steps.app-token.outputs.token || github.token }}
run: gh api /rate_limit | jq
- uses: actions/labeler@634933edcd8ababfe52f92936142cc22ac488b1b # v6.0.1
- uses: actions/labeler@f27b608878404679385c85cfa523b85ccb86e213 # v6.1.0
name: Labels from touched files
if: |
github.event_name == 'pull_request_target' &&
@@ -101,7 +101,7 @@ jobs:
configuration-path: .github/labeler.yml # default
sync-labels: true
- uses: actions/labeler@634933edcd8ababfe52f92936142cc22ac488b1b # v6.0.1
- uses: actions/labeler@f27b608878404679385c85cfa523b85ccb86e213 # v6.1.0
name: Labels from touched files (no sync)
if: |
github.event_name == 'pull_request_target' &&
@@ -111,7 +111,7 @@ jobs:
configuration-path: .github/labeler-no-sync.yml
sync-labels: false
- uses: actions/labeler@634933edcd8ababfe52f92936142cc22ac488b1b # v6.0.1
- uses: actions/labeler@f27b608878404679385c85cfa523b85ccb86e213 # v6.1.0
name: Labels from touched files (development branches)
# Development branches like staging-next, haskell-updates and python-updates get special labels.
# This is to avoid the mass of labels there, which is mostly useless - and really annoying for
.github/workflows/build.yml
+5 -3
View File
@@ -62,12 +62,12 @@ jobs:
merged-as-untrusted-at: ${{ inputs.mergedSha }}
target-as-trusted-at: ${{ inputs.targetSha }}
- uses: cachix/install-nix-action@ab739621df7a23f52766f9ccc97f38da6b7af14f # v31.10.5
- uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3 # v31.10.6
with:
# Sandbox is disabled on MacOS by default.
extra_nix_config: sandbox = true
- uses: cachix/cachix-action@1eb2ef646ac0255473d23a5907ad7b04ce94065c # v17
- uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
continue-on-error: true
with:
# The nixpkgs-gha cache should not be trusted or used outside of Nixpkgs and its forks' CI.
@@ -85,7 +85,9 @@ jobs:
- name: Build NixOS manual
if: |
contains(matrix.builds, 'manual-nixos') && !cancelled() &&
contains(fromJSON(inputs.baseBranch).type, 'primary')
(contains(fromJSON(inputs.baseBranch).type, 'primary')
|| startsWith(fromJSON(inputs.baseBranch).branch, 'staging-nixos')
)
run: nix-build-uncached nixpkgs/untrusted/ci --arg nixpkgs ./nixpkgs/untrusted-pinned -A manual-nixos --out-link nixos-manual
- name: Build Nixpkgs manual
.github/workflows/check.yml
+4 -4
View File
@@ -53,7 +53,7 @@ jobs:
- name: Install dependencies
run: npm install bottleneck@2.19.5
- uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
- uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
if: github.event_name != 'pull_request' && vars.NIXPKGS_COMMIT_CHECK_CLIENT_ID
id: app-token
with:
@@ -102,7 +102,7 @@ jobs:
sparse-checkout: |
ci/github-script
- uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
- uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
if: github.event_name != 'pull_request' && vars.NIXPKGS_MANUAL_EDIT_CHECK_CLIENT_ID
id: app-token
with:
@@ -147,9 +147,9 @@ jobs:
merged-as-untrusted-at: ${{ inputs.mergedSha }}
target-as-trusted-at: ${{ inputs.targetSha }}
- uses: cachix/install-nix-action@ab739621df7a23f52766f9ccc97f38da6b7af14f # v31.10.5
- uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3 # v31.10.6
- uses: cachix/cachix-action@1eb2ef646ac0255473d23a5907ad7b04ce94065c # v17
- uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
continue-on-error: true
with:
# The nixpkgs-gha cache should not be trusted or used outside of Nixpkgs and its forks' CI.
.github/workflows/comment.yml
+1 -1
View File
@@ -30,7 +30,7 @@ jobs:
ci/github-script
# Use the GitHub App to make sure the reaction happens with the same user who will later merge.
- uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
- uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
if: github.event_name != 'pull_request' && vars.NIXPKGS_CI_APP_ID
id: app-token
with:
.github/workflows/edited.yml
+1 -1
View File
@@ -36,7 +36,7 @@ jobs:
# Use a GitHub App to create the PR so that CI gets triggered
# The App is scoped to Repository > Contents and Pull Requests: write for Nixpkgs
# We only need Pull Requests: write here, but the app is also used for backports.
- uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
- uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
id: app-token
with:
app-id: ${{ vars.NIXPKGS_CI_APP_ID }}
.github/workflows/eval.yml
+6 -6
View File
@@ -136,7 +136,7 @@ jobs:
core.info(`Found pinned.json commit: ${ciPinBumpCommit}`)
- name: Install Nix
uses: cachix/install-nix-action@ab739621df7a23f52766f9ccc97f38da6b7af14f # v31.10.5
uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3 # v31.10.6
- name: Load supported versions
id: versions
@@ -184,9 +184,9 @@ jobs:
target-as-trusted-at: ${{ inputs.targetSha }}
- name: Install Nix
uses: cachix/install-nix-action@ab739621df7a23f52766f9ccc97f38da6b7af14f # v31.10.5
uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3 # v31.10.6
- uses: cachix/cachix-action@1eb2ef646ac0255473d23a5907ad7b04ce94065c # v17
- uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
continue-on-error: true
with:
# The nixpkgs-gha cache should not be trusted or used outside of Nixpkgs and its forks' CI.
@@ -274,7 +274,7 @@ jobs:
merge-multiple: true
- name: Install Nix
uses: cachix/install-nix-action@ab739621df7a23f52766f9ccc97f38da6b7af14f # v31.10.5
uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3 # v31.10.6
- name: Combine all output paths and eval stats
run: |
@@ -354,7 +354,7 @@ jobs:
target_url
})
- uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
- uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
if: github.event_name == 'pull_request_target' && vars.NIXPKGS_BRANCH_CHECK_CLIENT_ID
id: app-token
with:
@@ -481,7 +481,7 @@ jobs:
merged-as-untrusted-at: ${{ inputs.mergedSha }}
- name: Install Nix
uses: cachix/install-nix-action@ab739621df7a23f52766f9ccc97f38da6b7af14f # v31.10.5
uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3 # v31.10.6
- name: Ensure flake outputs on all systems still evaluate
run: nix flake check --all-systems --no-build './nixpkgs/untrusted?shallow=1'
.github/workflows/lint.yml
+5 -5
View File
@@ -35,7 +35,7 @@ jobs:
with:
merged-as-untrusted-at: ${{ inputs.mergedSha }}
- uses: cachix/install-nix-action@ab739621df7a23f52766f9ccc97f38da6b7af14f # v31.10.5
- uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3 # v31.10.6
# TODO: Figure out how to best enable caching for the treefmt job. Cachix won't work well,
# because the cache would be invalidated on every commit - treefmt checks every file.
@@ -70,9 +70,9 @@ jobs:
with:
merged-as-untrusted-at: ${{ inputs.mergedSha }}
- uses: cachix/install-nix-action@ab739621df7a23f52766f9ccc97f38da6b7af14f # v31.10.5
- uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3 # v31.10.6
- uses: cachix/cachix-action@1eb2ef646ac0255473d23a5907ad7b04ce94065c # v17
- uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
continue-on-error: true
with:
# The nixpkgs-gha cache should not be trusted or used outside of Nixpkgs and its forks' CI.
@@ -100,9 +100,9 @@ jobs:
merged-as-untrusted-at: ${{ inputs.mergedSha }}
target-as-trusted-at: ${{ inputs.targetSha }}
- uses: cachix/install-nix-action@ab739621df7a23f52766f9ccc97f38da6b7af14f # v31.10.5
- uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3 # v31.10.6
- uses: cachix/cachix-action@1eb2ef646ac0255473d23a5907ad7b04ce94065c # v17
- uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
continue-on-error: true
with:
# The nixpkgs-gha cache should not be trusted or used outside of Nixpkgs and its forks' CI.
.github/workflows/periodic-merge-24h.yml
+4
View File
@@ -35,6 +35,10 @@ jobs:
into: staging-next-25.11
- from: staging-next-25.11
into: staging-25.11
- from: master
into: staging-next-26.05
- from: staging-next-26.05
into: staging-26.05
- name: merge-base(master,staging) → haskell-updates
from: master staging
into: haskell-updates
.github/workflows/periodic-merge.yml
+1 -1
View File
@@ -26,7 +26,7 @@ jobs:
steps:
# Use a GitHub App to create the PR so that CI gets triggered
# The App is scoped to Repository > Contents and Pull Requests: write for Nixpkgs
- uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
- uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
id: app-token
with:
app-id: ${{ vars.NIXPKGS_CI_APP_ID }}
.github/workflows/pull-request-target.yml
+2 -2
View File
@@ -45,8 +45,8 @@ jobs:
# It's fine to reuse this app in the 'eval / compare' job,
# because this job has to run before that one.
- uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
if: vars.NIXPKGS_BRANCH_CHECK_CLIENT_ID
- uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
if: vars.NIXPKGS_BRANCH_CHECK_CLIENT_ID && github.actor != 'dependabot[bot]'
id: app-token
with:
client-id: ${{ vars.NIXPKGS_BRANCH_CHECK_CLIENT_ID }}
.github/workflows/review.yml
+1 -1
View File
@@ -27,7 +27,7 @@ jobs:
ci/github-script
# Use the GitHub App to make sure the reaction happens with the same user who will later merge.
- uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
- uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
if: github.event_name != 'pull_request' && vars.NIXPKGS_CI_APP_ID
id: app-token
with:
.github/workflows/teams.yml
+1 -1
View File
@@ -19,7 +19,7 @@ jobs:
steps:
# Use a GitHub App to create the PR so that CI gets triggered and to
# request team member lists.
- uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
- uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
id: app-token
with:
app-id: ${{ vars.NIXPKGS_CI_APP_ID }}
.mailmap
+1
View File
@@ -22,6 +22,7 @@ Lin Jian <me@linj.tech> <75130626+jian-lin@users.noreply.github.com>
Martin Weinelt <hexa@darmstadt.ccc.de> <mweinelt@users.noreply.github.com>
Martin Häcker <spamfaenger@gmx.de> <spamfaenger@gmx.de>
moni <lythe1107@gmail.com> <lythe1107@icloud.com>
Noah Biewesch <dev@noahbiewesch.com> <90870942+trueNAHO@users.noreply.github.com>
quantenzitrone <nix@dev.quantenzitrone.eu>
quantenzitrone <nix@dev.quantenzitrone.eu> <74491719+Quantenzitrone@users.noreply.github.com>
quantenzitrone <nix@dev.quantenzitrone.eu> <74491719+quantenzitrone@users.noreply.github.com>
CONTRIBUTING.md
+75 -1
View File
@@ -206,7 +206,7 @@ For example, if you make a change to `texlive`, you probably would only check th
#### Meets Nixpkgs contribution standards
The last checkbox is about whether it fits the guidelines in this `CONTRIBUTING.md` file.
The last two checkboxes are about whether it fits the guidelines in this `CONTRIBUTING.md` file.
This document details our standards for commit messages, reviews, licensing of contributions, etc...
Everyone should read and understand these standards before submitting a pull request.
@@ -888,3 +888,77 @@ As mentioned previously, it is unfortunately perfectly normal for a PR to sit ar
Please don't blow up situations where progress is happening but is merely not going fast enough for your tastes.
Honking in a traffic jam will not make you go any faster.
# Automation/AI policy
Every contribution to Nixpkgs and related development venues, including code, documentation, and communication on GitHub and Matrix, must have a **responsible person in the loop** who is accountable for that contribution and reviews it before submission, and must **transparently disclose** any non‐trivial use of automation to produce it, including but not limited to LLM‐based AI tools.
The following sections give more detail.
## Scope
Any use of automated tools to generate non‐trivial amounts of output as part of a contribution, in whole or in part, verbatim or edited, is covered by this policy, except as listed in the Exemptions section.
Both LLM‐based AI tools and hand‐written automation are covered.
Contributions include code and documentation in commits, commit messages, pull request summaries and reviews, issue and vulnerability reports, GitHub comments, Matrix messages, and Discourse posts.
The covered venues are the GitHub repositories for Nixpkgs and [related projects](https://github.com/orgs/NixOS/teams/nixpkgs-core/repositories) under the jurisdiction of the Nixpkgs core team, Matrix rooms that are focused on development of those projects, and Discourse topics about Nixpkgs development.
## Accountability
Everyone who submits a contribution to Nixpkgs is responsible for it, regardless of the use of automated tooling.
Before submission, they must establish a reasonable level of understanding of the contribution and expectation of its correctness.
A contributor submitting a contribution intended for inclusion in Nixpkgs is also responsible for ensuring that it is [appropriately licensed](https://github.com/NixOS/nixpkgs/blob/master/COPYING) and credited, and not encumbered by any incompatible copyright.
When output from automated tooling is used in contributions, a contributor must establish confidence in that output.
This can be achieved by establishing confidence in the correctness of the tooling’s logic, manual review of the included output, or using further automation to verify the output (e.g. programmatically checking whether a refactor avoids causing rebuilds).
As the inner workings of LLM‐based AI tools cannot be sufficiently understood at present, only the latter two options are available when those are used; vibe coding without review is not permitted.
When automation is used to verify output, the verification tooling itself must be disclosed and reviewed in line with this policy.
This policy applies equally to any further discussion of a contribution.
Comments and reviews must separately satisfy the same requirements of understanding, review, and disclosure.
Contributors are expected to be able to answer questions about their contribution and respond to feedback appropriately, without simply forwarding messages back and forth to automated tools.
It is not permitted to submit automated contributions without any manual review or intervention, outside of standard community automation.
Automation without any manual review must not be used as the sole arbiter of whether to merge a change.
## Transparency
All covered use of automated tooling for a contribution must be disclosed as part of that contribution.
In the case of LLM‐based AI tooling used for commits, this **must** be in the form of an `Assisted-by:` Git commit trailer, including at least the tool name and the primary model name and version used for the contribution.
A `Co-authored-by:` trailer does not satisfy this policy.
Any adequate form of disclosure is permitted for other kinds of tooling and contribution.
Pull request summaries and review comments must be disclosed separately to commits.
## Exemptions
The following situations are fully or partially exempt:
* Use of standard deterministic editor/IDE/formatter/text transformation tooling to produce changes that the author manually reviews and understands is exempt, including inline “auto‐completion” (even if LLM‐based) of short, rote snippets of text that do not contribute anything beyond boilerplate the author would have written anyway.
* Use of standard community automation is exempt, such as `nix-update`, the official Nixpkgs CI bots, the @r-ryantm update bot, other maintainer‐approved bots that run update scripts, and the Nixpkgs security tracker bot.
* Use of AI tools for research, testing, debugging, or private review is out of scope, if no substantial amount of their output is included in the resulting contribution.
However, if these tools had a significant technical influence on your contribution, you are still responsible for it per the Accountability section, and are expected to disclose this where relevant.
* Use of machine translation is exempt from the requirement to understand the translated output.
However, the requirements of appropriate confidence in the original text, responsibility, and disclosure still apply, and you are encouraged to additionally include the original untranslated contribution.
* Use of automation in a contribution clearly marked as not being ready for merge (e.g. a draft pull request) is exempt from the requirement for full self‐review, as long as some amount of review has been done and it is expected that the requirements will be met by the time it is marked as ready.
This does not waive any other requirement.
* Use of automated tools to develop upstream software packaged inside Nixpkgs is not in scope.
## Enforcement
If you believe that someone is using automation without appropriate disclosure and review, you can politely ask them if that’s the case and point them to this policy as appropriate.
Please assume good faith and remain civil; it’s not always possible to determine, and it is more likely that someone overlooked this policy than deliberately violated it.
If you think someone is continuing to break the policy after this, please escalate to the [Nixpkgs core team](https://nixos.org/community/teams/nixpkgs-core/) rather than fighting over it.
If a contribution is clearly in violation of the policy (e.g. the contributor admits it was not followed, or there are AI tool attributions that do not meet our required format), it can be closed or hidden, preferably after informing the contributor of the policy and giving them a chance to address the violations.
Deliberate violations of this policy are considered to break the [Code of Conduct](https://github.com/NixOS/.github/blob/master/CODE_OF_CONDUCT.md) clause against “Wasting other people’s time with low quality contributions, including but not limited to LLM and bot spam”.
Repeated violations are grounds for further moderation action.
## Credits
This policy takes inspiration from similar policies in [LLVM](https://llvm.org/docs/AIToolPolicy.html), [Mesa](https://gitlab.freedesktop.org/mesa/mesa/-/blob/mesa-26.1.0-rc1/docs/submittingpatches.rst?ref_type=tags), [Fedora](https://docs.fedoraproject.org/en-US/council/policy/ai-contribution-policy/), and the [Linux kernel](https://docs.kernel.org/7.0/process/coding-assistants.html), along with [a proposal by the author of Anubis](https://xeiaso.net/notes/2025/assisted-by-footer/).
ci/OWNERS
+5 -5
View File
@@ -21,7 +21,7 @@
/ci/OWNERS @infinisil @philiptaron
# Development support
/.editorconfig @Mic92 @zowoq
/.editorconfig @Mic92
/shell.nix @infinisil @NixOS/Security
# Libraries
@@ -219,10 +219,10 @@ nixos/modules/installer/tools/nix-fallback-paths.nix @Artturin @Ericson2314 @lo
/pkgs/development/r-modules @jbedo
# Rust
/pkgs/development/compilers/rust @alyssais @Mic92 @zowoq @winterqt
/pkgs/build-support/rust @zowoq @winterqt
/pkgs/development/compilers/rust @alyssais @Mic92 @winterqt
/pkgs/build-support/rust @winterqt
/pkgs/build-support/rust/fetch-cargo-vendor* @TomaSajt
/doc/languages-frameworks/rust.section.md @zowoq @winterqt
/doc/languages-frameworks/rust.section.md @winterqt
# Tcl
/pkgs/development/interpreters/tcl @fgaz
@@ -505,7 +505,7 @@ pkgs/development/interpreters/elixir/ @NixOS/beam
pkgs/development/interpreters/lfe/ @NixOS/beam
# Authelia
pkgs/by-name/au/authelia/ @06kellyjac @dit7ya @nicomem
pkgs/by-name/au/authelia/ @06kellyjac @nicomem
# OctoDNS
pkgs/by-name/oc/octodns/ @anthonyroussel
ci/github-script/bot.js
+1 -1
View File
@@ -1,6 +1,6 @@
module.exports = async ({ github, context, core, dry }) => {
const path = require('node:path')
const { DefaultArtifactClient } = require('@actions/artifact')
const { DefaultArtifactClient } = await import('@actions/artifact')
const { readFile, writeFile } = require('node:fs/promises')
const withRateLimit = require('./withRateLimit.js')
const { classify } = require('../supportedBranches.js')
ci/github-script/check-target-branch.js
+6 -3
View File
@@ -105,7 +105,7 @@ async function checkTargetBranch({ github, context, core, dry }) {
// These should go to staging-nixos instead of master,
// but release-xx.xx (not staging-xx.xx) when backported
let isExemptKernelUpdate = false
if (prInfo.changed_files === 1 && base.startsWith('release-')) {
if (prInfo.changed_files === 1) {
const changedFiles = (
await github.rest.pulls.listFiles({
...context.repo,
@@ -114,8 +114,11 @@ async function checkTargetBranch({ github, context, core, dry }) {
).data
isExemptKernelUpdate =
changedFiles.length === 1 &&
changedFiles[0].filename ===
'pkgs/os-specific/linux/kernel/kernels-org.json'
(changedFiles[0].filename ===
'pkgs/os-specific/linux/kernel/xanmod-kernels.nix' ||
(base.startsWith('release-') &&
changedFiles[0].filename ===
'pkgs/os-specific/linux/kernel/kernels-org.json'))
}
// https://github.com/NixOS/nixpkgs/pull/483194#issuecomment-3793393218
ci/github-script/manual-file-edits.js
+22
View File
@@ -1,4 +1,5 @@
// @ts-check
const { classify } = require('../supportedBranches.js')
const { getCommitDetailsForPR } = require('./get-pr-commit-details')
/**
@@ -32,6 +33,27 @@ async function checkManualFileEdits({ github, context, core, repoPath, dry }) {
return
}
const baseBranchType = classify(
pr.base.ref.replace(/^refs\/heads\//, ''),
).type
const headBranchType = classify(
pr.head.ref.replace(/^refs\/heads\//, ''),
).type
if (
baseBranchType.includes('development') &&
headBranchType.includes('development') &&
pr.base.repo.id === pr.head.repo?.id
) {
// This matches, for example, PRs from NixOS:staging-next to NixOS:master, or vice versa.
// Ignore them: we should only care about PRs introducing *new* commits.
// We still want to run on PRs from, e.g., Someone:master to NixOS:master, though.
core.info(
'This PR is from one development branch to another. Skipping checks.',
)
return
}
const details = await getCommitDetailsForPR({ core, pr, repoPath })
if (
ci/github-script/package-lock.json
Generated
+321 -324
View File
@@ -4,55 +4,107 @@
"requires": true,
"packages": {
"": {
"name": "github-script",
"dependencies": {
"@actions/artifact": "5.0.3",
"@actions/core": "1.11.1",
"@actions/github": "6.0.1",
"@actions/artifact": "6.2.1",
"@actions/core": "1.10.1",
"@actions/github": "9.1.0",
"bottleneck": "2.19.5",
"commander": "14.0.3"
}
},
"node_modules/@actions/artifact": {
"version": "5.0.3",
"resolved": "https://registry.npmjs.org/@actions/artifact/-/artifact-5.0.3.tgz",
"integrity": "sha512-FIEG8Kum0wABZnktJvFi1xuVPc31xrunhZwLCvjrCGISQOm0ifyo7cjqf6PHiEeqoWMa5HIGOsB+lGM4aKCseA==",
"version": "6.2.1",
"resolved": "https://registry.npmjs.org/@actions/artifact/-/artifact-6.2.1.tgz",
"integrity": "sha512-sJGH0mhEbEjBCw7o6SaLhUU66u27aFW8HTfkIb5Tk2/Wy0caUDc+oYQEgnuFN7a0HCpAbQyK0U6U7XUJDgDWrw==",
"license": "MIT",
"dependencies": {
"@actions/core": "^2.0.0",
"@actions/github": "^6.0.1",
"@actions/http-client": "^3.0.2",
"@azure/storage-blob": "^12.29.1",
"@octokit/core": "^5.2.1",
"@octokit/plugin-request-log": "^1.0.4",
"@octokit/plugin-retry": "^3.0.9",
"@octokit/request": "^8.4.1",
"@octokit/request-error": "^5.1.1",
"@actions/core": "^3.0.0",
"@actions/github": "^9.0.0",
"@actions/http-client": "^4.0.0",
"@azure/storage-blob": "^12.30.0",
"@octokit/core": "^7.0.6",
"@octokit/plugin-request-log": "^6.0.0",
"@octokit/plugin-retry": "^8.0.0",
"@octokit/request": "^10.0.7",
"@octokit/request-error": "^7.1.0",
"@protobuf-ts/plugin": "^2.2.3-alpha.1",
"@protobuf-ts/runtime": "^2.9.4",
"archiver": "^7.0.1",
"jwt-decode": "^3.1.2",
"jwt-decode": "^4.0.0",
"unzip-stream": "^0.3.1"
}
},
"node_modules/@actions/artifact/node_modules/@actions/core": {
"version": "2.0.3",
"resolved": "https://registry.npmjs.org/@actions/core/-/core-2.0.3.tgz",
"integrity": "sha512-Od9Thc3T1mQJYddvVPM4QGiLUewdh+3txmDYHHxoNdkqysR1MbCT+rFOtNUxYAz+7+6RIsqipVahY2GJqGPyxA==",
"version": "3.0.1",
"resolved": "https://registry.npmjs.org/@actions/core/-/core-3.0.1.tgz",
"integrity": "sha512-a6d/Nwahm9fliVGRhdhofo40HjHQasUPusmc7vBfyky+7Z+P2A1J68zyFVaNcEclc/Se+eO595oAr5nwEIoIUA==",
"license": "MIT",
"dependencies": {
"@actions/exec": "^2.0.0",
"@actions/http-client": "^3.0.2"
"@actions/exec": "^3.0.0",
"@actions/http-client": "^4.0.0"
}
},
"node_modules/@actions/artifact/node_modules/@actions/exec": {
"version": "2.0.0",
"resolved": "https://registry.npmjs.org/@actions/exec/-/exec-2.0.0.tgz",
"integrity": "sha512-k8ngrX2voJ/RIN6r9xB82NVqKpnMRtxDoiO+g3olkIUpQNqjArXrCQceduQZCQj3P3xm32pChRLqRrtXTlqhIw==",
"version": "3.0.0",
"resolved": "https://registry.npmjs.org/@actions/exec/-/exec-3.0.0.tgz",
"integrity": "sha512-6xH/puSoNBXb72VPlZVm7vQ+svQpFyA96qdDBvhB8eNZOE8LtPf9L4oAsfzK/crCL8YZ+19fKYVnM63Sl+Xzlw==",
"license": "MIT",
"dependencies": {
"@actions/io": "^2.0.0"
"@actions/io": "^3.0.2"
}
},
"node_modules/@actions/artifact/node_modules/@actions/http-client": {
"version": "4.0.1",
"resolved": "https://registry.npmjs.org/@actions/http-client/-/http-client-4.0.1.tgz",
"integrity": "sha512-+Nvd1ImaOZBSoPbsUtEhv+1z99H12xzncCkz0a3RuehINE81FZSe2QTj3uvAPTcJX/SCzUQHQ0D1GrPMbrPitg==",
"license": "MIT",
"dependencies": {
"tunnel": "^0.0.6",
"undici": "^6.23.0"
}
},
"node_modules/@actions/artifact/node_modules/@actions/io": {
"version": "3.0.2",
"resolved": "https://registry.npmjs.org/@actions/io/-/io-3.0.2.tgz",
"integrity": "sha512-nRBchcMM+QK1pdjO7/idu86rbJI5YHUKCvKs0KxnSYbVe3F51UfGxuZX4Qy/fWlp6l7gWFwIkrOzN+oUK03kfw==",
"license": "MIT"
},
"node_modules/@actions/artifact/node_modules/undici": {
"version": "6.25.0",
"resolved": "https://registry.npmjs.org/undici/-/undici-6.25.0.tgz",
"integrity": "sha512-ZgpWDC5gmNiuY9CnLVXEH8rl50xhRCuLNA97fAUnKi8RRuV4E6KG31pDTsLVUKnohJE0I3XDrTeEydAXRw47xg==",
"license": "MIT",
"engines": {
"node": ">=18.17"
}
},
"node_modules/@actions/core": {
"version": "1.10.1",
"resolved": "https://registry.npmjs.org/@actions/core/-/core-1.10.1.tgz",
"integrity": "sha512-3lBR9EDAY+iYIpTnTIXmWcNbX3T2kCkAEQGIQx4NVQ0575nk2k3GRZDTPQG+vVtS2izSLmINlxXf0uLtnrTP+g==",
"license": "MIT",
"dependencies": {
"@actions/http-client": "^2.0.1",
"uuid": "^8.3.2"
}
},
"node_modules/@actions/github": {
"version": "9.1.0",
"resolved": "https://registry.npmjs.org/@actions/github/-/github-9.1.0.tgz",
"integrity": "sha512-u0hDGQeCS+7VNoLA8hYG65RLdPLMaPGfka0sZ0up7P0AiShqfX6xcuXNteGkQ7X7Tod7AMNwHd4p7DS63i8zzA==",
"license": "MIT",
"dependencies": {
"@actions/http-client": "^3.0.2",
"@octokit/core": "^7.0.6",
"@octokit/plugin-paginate-rest": "^14.0.0",
"@octokit/plugin-rest-endpoint-methods": "^17.0.0",
"@octokit/request": "^10.0.7",
"@octokit/request-error": "^7.1.0",
"undici": "^6.23.0"
}
},
"node_modules/@actions/github/node_modules/@actions/http-client": {
"version": "3.0.2",
"resolved": "https://registry.npmjs.org/@actions/http-client/-/http-client-3.0.2.tgz",
"integrity": "sha512-JP38FYYpyqvUsz+Igqlc/JG6YO9PaKuvqjM3iGvaLqFnJ7TFmcLyy2IDrY0bI0qCQug8E9K+elv5ZNfw62ZJzA==",
@@ -62,115 +114,15 @@
"undici": "^6.23.0"
}
},
"node_modules/@actions/artifact/node_modules/@actions/io": {
"version": "2.0.0",
"resolved": "https://registry.npmjs.org/@actions/io/-/io-2.0.0.tgz",
"integrity": "sha512-Jv33IN09XLO+0HS79aaODsvIRyduiF7NY/F6LYeK5oeUmrsz7aFdRphQjFoESF4jS7lMauDOttKALcpapVDIAg==",
"license": "MIT"
},
"node_modules/@actions/artifact/node_modules/undici": {
"version": "6.23.0",
"resolved": "https://registry.npmjs.org/undici/-/undici-6.23.0.tgz",
"integrity": "sha512-VfQPToRA5FZs/qJxLIinmU59u0r7LXqoJkCzinq3ckNJp3vKEh7jTWN589YQ5+aoAC/TGRLyJLCPKcLQbM8r9g==",
"node_modules/@actions/github/node_modules/undici": {
"version": "6.25.0",
"resolved": "https://registry.npmjs.org/undici/-/undici-6.25.0.tgz",
"integrity": "sha512-ZgpWDC5gmNiuY9CnLVXEH8rl50xhRCuLNA97fAUnKi8RRuV4E6KG31pDTsLVUKnohJE0I3XDrTeEydAXRw47xg==",
"license": "MIT",
"engines": {
"node": ">=18.17"
}
},
"node_modules/@actions/core": {
"version": "1.11.1",
"resolved": "https://registry.npmjs.org/@actions/core/-/core-1.11.1.tgz",
"integrity": "sha512-hXJCSrkwfA46Vd9Z3q4cpEpHB1rL5NG04+/rbqW9d3+CSvtB1tYe8UTpAlixa1vj0m/ULglfEK2UKxMGxCxv5A==",
"license": "MIT",
"dependencies": {
"@actions/exec": "^1.1.1",
"@actions/http-client": "^2.0.1"
}
},
"node_modules/@actions/exec": {
"version": "1.1.1",
"resolved": "https://registry.npmjs.org/@actions/exec/-/exec-1.1.1.tgz",
"integrity": "sha512-+sCcHHbVdk93a0XT19ECtO/gIXoxvdsgQLzb2fE2/5sIZmWQuluYyjPQtrtTHdU1YzTZ7bAPN4sITq2xi1679w==",
"license": "MIT",
"dependencies": {
"@actions/io": "^1.0.1"
}
},
"node_modules/@actions/github": {
"version": "6.0.1",
"resolved": "https://registry.npmjs.org/@actions/github/-/github-6.0.1.tgz",
"integrity": "sha512-xbZVcaqD4XnQAe35qSQqskb3SqIAfRyLBrHMd/8TuL7hJSz2QtbDwnNM8zWx4zO5l2fnGtseNE3MbEvD7BxVMw==",
"license": "MIT",
"dependencies": {
"@actions/http-client": "^2.2.0",
"@octokit/core": "^5.0.1",
"@octokit/plugin-paginate-rest": "^9.2.2",
"@octokit/plugin-rest-endpoint-methods": "^10.4.0",
"@octokit/request": "^8.4.1",
"@octokit/request-error": "^5.1.1",
"undici": "^5.28.5"
}
},
"node_modules/@actions/github/node_modules/@octokit/plugin-paginate-rest": {
"version": "9.2.2",
"resolved": "https://registry.npmjs.org/@octokit/plugin-paginate-rest/-/plugin-paginate-rest-9.2.2.tgz",
"integrity": "sha512-u3KYkGF7GcZnSD/3UP0S7K5XUFT2FkOQdcfXZGZQPGv3lm4F2Xbf71lvjldr8c1H3nNbF+33cLEkWYbokGWqiQ==",
"license": "MIT",
"dependencies": {
"@octokit/types": "^12.6.0"
},
"engines": {
"node": ">= 18"
},
"peerDependencies": {
"@octokit/core": "5"
}
},
"node_modules/@actions/github/node_modules/@octokit/plugin-paginate-rest/node_modules/@octokit/openapi-types": {
"version": "20.0.0",
"resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-20.0.0.tgz",
"integrity": "sha512-EtqRBEjp1dL/15V7WiX5LJMIxxkdiGJnabzYx5Apx4FkQIFgAfKumXeYAqqJCj1s+BMX4cPFIFC4OLCR6stlnA==",
"license": "MIT"
},
"node_modules/@actions/github/node_modules/@octokit/plugin-paginate-rest/node_modules/@octokit/types": {
"version": "12.6.0",
"resolved": "https://registry.npmjs.org/@octokit/types/-/types-12.6.0.tgz",
"integrity": "sha512-1rhSOfRa6H9w4YwK0yrf5faDaDTb+yLyBUKOCV4xtCDB5VmIPqd/v9yr9o6SAzOAlRxMiRiCic6JVM1/kunVkw==",
"license": "MIT",
"dependencies": {
"@octokit/openapi-types": "^20.0.0"
}
},
"node_modules/@actions/github/node_modules/@octokit/plugin-rest-endpoint-methods": {
"version": "10.4.1",
"resolved": "https://registry.npmjs.org/@octokit/plugin-rest-endpoint-methods/-/plugin-rest-endpoint-methods-10.4.1.tgz",
"integrity": "sha512-xV1b+ceKV9KytQe3zCVqjg+8GTGfDYwaT1ATU5isiUyVtlVAO3HNdzpS4sr4GBx4hxQ46s7ITtZrAsxG22+rVg==",
"license": "MIT",
"dependencies": {
"@octokit/types": "^12.6.0"
},
"engines": {
"node": ">= 18"
},
"peerDependencies": {
"@octokit/core": "5"
}
},
"node_modules/@actions/github/node_modules/@octokit/plugin-rest-endpoint-methods/node_modules/@octokit/openapi-types": {
"version": "20.0.0",
"resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-20.0.0.tgz",
"integrity": "sha512-EtqRBEjp1dL/15V7WiX5LJMIxxkdiGJnabzYx5Apx4FkQIFgAfKumXeYAqqJCj1s+BMX4cPFIFC4OLCR6stlnA==",
"license": "MIT"
},
"node_modules/@actions/github/node_modules/@octokit/plugin-rest-endpoint-methods/node_modules/@octokit/types": {
"version": "12.6.0",
"resolved": "https://registry.npmjs.org/@octokit/types/-/types-12.6.0.tgz",
"integrity": "sha512-1rhSOfRa6H9w4YwK0yrf5faDaDTb+yLyBUKOCV4xtCDB5VmIPqd/v9yr9o6SAzOAlRxMiRiCic6JVM1/kunVkw==",
"license": "MIT",
"dependencies": {
"@octokit/openapi-types": "^20.0.0"
}
},
"node_modules/@actions/http-client": {
"version": "2.2.3",
"resolved": "https://registry.npmjs.org/@actions/http-client/-/http-client-2.2.3.tgz",
@@ -181,12 +133,6 @@
"undici": "^5.25.4"
}
},
"node_modules/@actions/io": {
"version": "1.1.3",
"resolved": "https://registry.npmjs.org/@actions/io/-/io-1.1.3.tgz",
"integrity": "sha512-wi9JjgKLYS7U/z8PPbco+PvTb/nRWjeoFlJ1Qer83k/3C5PHQi28hiVdeE2kHXmIL99mQFawx8qt/JPjZilJ8Q==",
"license": "MIT"
},
"node_modules/@azure/abort-controller": {
"version": "2.1.2",
"resolved": "https://registry.npmjs.org/@azure/abort-controller/-/abort-controller-2.1.2.tgz",
@@ -218,7 +164,6 @@
"resolved": "https://registry.npmjs.org/@azure/core-client/-/core-client-1.10.1.tgz",
"integrity": "sha512-Nh5PhEOeY6PrnxNPsEHRr9eimxLwgLlpmguQaHKBinFYA/RU9+kOYVOQqOrTsCL+KSxrLLl1gD8Dk5BFW/7l/w==",
"license": "MIT",
"peer": true,
"dependencies": {
"@azure/abort-controller": "^2.1.2",
"@azure/core-auth": "^1.10.0",
@@ -280,7 +225,6 @@
"resolved": "https://registry.npmjs.org/@azure/core-rest-pipeline/-/core-rest-pipeline-1.22.2.tgz",
"integrity": "sha512-MzHym+wOi8CLUlKCQu12de0nwcq9k9Kuv43j4Wa++CsCpJwps2eeBQwD2Bu8snkxTtDKDx4GwjuR9E8yC8LNrg==",
"license": "MIT",
"peer": true,
"dependencies": {
"@azure/abort-controller": "^2.1.2",
"@azure/core-auth": "^1.10.0",
@@ -447,197 +391,174 @@
"node": ">=12"
}
},
"node_modules/@nodable/entities": {
"version": "2.1.0",
"resolved": "https://registry.npmjs.org/@nodable/entities/-/entities-2.1.0.tgz",
"integrity": "sha512-nyT7T3nbMyBI/lvr6L5TyWbFJAI9FTgVRakNoBqCD+PmID8DzFrrNdLLtHMwMszOtqZa8PAOV24ZqDnQrhQINA==",
"funding": [
{
"type": "github",
"url": "https://github.com/sponsors/nodable"
}
],
"license": "MIT"
},
"node_modules/@octokit/auth-token": {
"version": "4.0.0",
"resolved": "https://registry.npmjs.org/@octokit/auth-token/-/auth-token-4.0.0.tgz",
"integrity": "sha512-tY/msAuJo6ARbK6SPIxZrPBms3xPbfwBrulZe0Wtr/DIY9lje2HeV1uoebShn6mx7SjCHif6EjMvoREj+gZ+SA==",
"version": "6.0.0",
"resolved": "https://registry.npmjs.org/@octokit/auth-token/-/auth-token-6.0.0.tgz",
"integrity": "sha512-P4YJBPdPSpWTQ1NU4XYdvHvXJJDxM6YwpS0FZHRgP7YFkdVxsWcpWGy/NVqlAA7PcPCnMacXlRm1y2PFZRWL/w==",
"license": "MIT",
"engines": {
"node": ">= 18"
"node": ">= 20"
}
},
"node_modules/@octokit/core": {
"version": "5.2.2",
"resolved": "https://registry.npmjs.org/@octokit/core/-/core-5.2.2.tgz",
"integrity": "sha512-/g2d4sW9nUDJOMz3mabVQvOGhVa4e/BN/Um7yca9Bb2XTzPPnfTWHWQg+IsEYO7M3Vx+EXvaM/I2pJWIMun1bg==",
"version": "7.0.6",
"resolved": "https://registry.npmjs.org/@octokit/core/-/core-7.0.6.tgz",
"integrity": "sha512-DhGl4xMVFGVIyMwswXeyzdL4uXD5OGILGX5N8Y+f6W7LhC1Ze2poSNrkF/fedpVDHEEZ+PHFW0vL14I+mm8K3Q==",
"license": "MIT",
"peer": true,
"dependencies": {
"@octokit/auth-token": "^4.0.0",
"@octokit/graphql": "^7.1.0",
"@octokit/request": "^8.4.1",
"@octokit/request-error": "^5.1.1",
"@octokit/types": "^13.0.0",
"before-after-hook": "^2.2.0",
"universal-user-agent": "^6.0.0"
"@octokit/auth-token": "^6.0.0",
"@octokit/graphql": "^9.0.3",
"@octokit/request": "^10.0.6",
"@octokit/request-error": "^7.0.2",
"@octokit/types": "^16.0.0",
"before-after-hook": "^4.0.0",
"universal-user-agent": "^7.0.0"
},
"engines": {
"node": ">= 18"
}
},
"node_modules/@octokit/core/node_modules/@octokit/openapi-types": {
"version": "24.2.0",
"resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-24.2.0.tgz",
"integrity": "sha512-9sIH3nSUttelJSXUrmGzl7QUBFul0/mB8HRYl3fOlgHbIWG+WnYDXU3v/2zMtAvuzZ/ed00Ei6on975FhBfzrg==",
"license": "MIT"
},
"node_modules/@octokit/core/node_modules/@octokit/types": {
"version": "13.10.0",
"resolved": "https://registry.npmjs.org/@octokit/types/-/types-13.10.0.tgz",
"integrity": "sha512-ifLaO34EbbPj0Xgro4G5lP5asESjwHracYJvVaPIyXMuiuXLlhic3S47cBdTb+jfODkTE5YtGCLt3Ay3+J97sA==",
"license": "MIT",
"dependencies": {
"@octokit/openapi-types": "^24.2.0"
"node": ">= 20"
}
},
"node_modules/@octokit/endpoint": {
"version": "9.0.6",
"resolved": "https://registry.npmjs.org/@octokit/endpoint/-/endpoint-9.0.6.tgz",
"integrity": "sha512-H1fNTMA57HbkFESSt3Y9+FBICv+0jFceJFPWDePYlR/iMGrwM5ph+Dd4XRQs+8X+PUFURLQgX9ChPfhJ/1uNQw==",
"version": "11.0.3",
"resolved": "https://registry.npmjs.org/@octokit/endpoint/-/endpoint-11.0.3.tgz",
"integrity": "sha512-FWFlNxghg4HrXkD3ifYbS/IdL/mDHjh9QcsNyhQjN8dplUoZbejsdpmuqdA76nxj2xoWPs7p8uX2SNr9rYu0Ag==",
"license": "MIT",
"dependencies": {
"@octokit/types": "^13.1.0",
"universal-user-agent": "^6.0.0"
"@octokit/types": "^16.0.0",
"universal-user-agent": "^7.0.2"
},
"engines": {
"node": ">= 18"
}
},
"node_modules/@octokit/endpoint/node_modules/@octokit/openapi-types": {
"version": "24.2.0",
"resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-24.2.0.tgz",
"integrity": "sha512-9sIH3nSUttelJSXUrmGzl7QUBFul0/mB8HRYl3fOlgHbIWG+WnYDXU3v/2zMtAvuzZ/ed00Ei6on975FhBfzrg==",
"license": "MIT"
},
"node_modules/@octokit/endpoint/node_modules/@octokit/types": {
"version": "13.10.0",
"resolved": "https://registry.npmjs.org/@octokit/types/-/types-13.10.0.tgz",
"integrity": "sha512-ifLaO34EbbPj0Xgro4G5lP5asESjwHracYJvVaPIyXMuiuXLlhic3S47cBdTb+jfODkTE5YtGCLt3Ay3+J97sA==",
"license": "MIT",
"dependencies": {
"@octokit/openapi-types": "^24.2.0"
"node": ">= 20"
}
},
"node_modules/@octokit/graphql": {
"version": "7.1.1",
"resolved": "https://registry.npmjs.org/@octokit/graphql/-/graphql-7.1.1.tgz",
"integrity": "sha512-3mkDltSfcDUoa176nlGoA32RGjeWjl3K7F/BwHwRMJUW/IteSa4bnSV8p2ThNkcIcZU2umkZWxwETSSCJf2Q7g==",
"version": "9.0.3",
"resolved": "https://registry.npmjs.org/@octokit/graphql/-/graphql-9.0.3.tgz",
"integrity": "sha512-grAEuupr/C1rALFnXTv6ZQhFuL1D8G5y8CN04RgrO4FIPMrtm+mcZzFG7dcBm+nq+1ppNixu+Jd78aeJOYxlGA==",
"license": "MIT",
"dependencies": {
"@octokit/request": "^8.4.1",
"@octokit/types": "^13.0.0",
"universal-user-agent": "^6.0.0"
"@octokit/request": "^10.0.6",
"@octokit/types": "^16.0.0",
"universal-user-agent": "^7.0.0"
},
"engines": {
"node": ">= 18"
}
},
"node_modules/@octokit/graphql/node_modules/@octokit/openapi-types": {
"version": "24.2.0",
"resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-24.2.0.tgz",
"integrity": "sha512-9sIH3nSUttelJSXUrmGzl7QUBFul0/mB8HRYl3fOlgHbIWG+WnYDXU3v/2zMtAvuzZ/ed00Ei6on975FhBfzrg==",
"license": "MIT"
},
"node_modules/@octokit/graphql/node_modules/@octokit/types": {
"version": "13.10.0",
"resolved": "https://registry.npmjs.org/@octokit/types/-/types-13.10.0.tgz",
"integrity": "sha512-ifLaO34EbbPj0Xgro4G5lP5asESjwHracYJvVaPIyXMuiuXLlhic3S47cBdTb+jfODkTE5YtGCLt3Ay3+J97sA==",
"license": "MIT",
"dependencies": {
"@octokit/openapi-types": "^24.2.0"
"node": ">= 20"
}
},
"node_modules/@octokit/openapi-types": {
"version": "12.11.0",
"resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-12.11.0.tgz",
"integrity": "sha512-VsXyi8peyRq9PqIz/tpqiL2w3w80OgVMwBHltTml3LmVvXiphgeqmY9mvBw9Wu7e0QWk/fqD37ux8yP5uVekyQ==",
"version": "27.0.0",
"resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-27.0.0.tgz",
"integrity": "sha512-whrdktVs1h6gtR+09+QsNk2+FO+49j6ga1c55YZudfEG+oKJVvJLQi3zkOm5JjiUXAagWK2tI2kTGKJ2Ys7MGA==",
"license": "MIT"
},
"node_modules/@octokit/plugin-request-log": {
"version": "1.0.4",
"resolved": "https://registry.npmjs.org/@octokit/plugin-request-log/-/plugin-request-log-1.0.4.tgz",
"integrity": "sha512-mLUsMkgP7K/cnFEw07kWqXGF5LKrOkD+lhCrKvPHXWDywAwuDUeDwWBpc69XK3pNX0uKiVt8g5z96PJ6z9xCFA==",
"node_modules/@octokit/plugin-paginate-rest": {
"version": "14.0.0",
"resolved": "https://registry.npmjs.org/@octokit/plugin-paginate-rest/-/plugin-paginate-rest-14.0.0.tgz",
"integrity": "sha512-fNVRE7ufJiAA3XUrha2omTA39M6IXIc6GIZLvlbsm8QOQCYvpq/LkMNGyFlB1d8hTDzsAXa3OKtybdMAYsV/fw==",
"license": "MIT",
"dependencies": {
"@octokit/types": "^16.0.0"
},
"engines": {
"node": ">= 20"
},
"peerDependencies": {
"@octokit/core": ">=3"
"@octokit/core": ">=6"
}
},
"node_modules/@octokit/plugin-request-log": {
"version": "6.0.0",
"resolved": "https://registry.npmjs.org/@octokit/plugin-request-log/-/plugin-request-log-6.0.0.tgz",
"integrity": "sha512-UkOzeEN3W91/eBq9sPZNQ7sUBvYCqYbrrD8gTbBuGtHEuycE4/awMXcYvx6sVYo7LypPhmQwwpUe4Yyu4QZN5Q==",
"license": "MIT",
"engines": {
"node": ">= 20"
},
"peerDependencies": {
"@octokit/core": ">=6"
}
},
"node_modules/@octokit/plugin-rest-endpoint-methods": {
"version": "17.0.0",
"resolved": "https://registry.npmjs.org/@octokit/plugin-rest-endpoint-methods/-/plugin-rest-endpoint-methods-17.0.0.tgz",
"integrity": "sha512-B5yCyIlOJFPqUUeiD0cnBJwWJO8lkJs5d8+ze9QDP6SvfiXSz1BF+91+0MeI1d2yxgOhU/O+CvtiZ9jSkHhFAw==",
"license": "MIT",
"dependencies": {
"@octokit/types": "^16.0.0"
},
"engines": {
"node": ">= 20"
},
"peerDependencies": {
"@octokit/core": ">=6"
}
},
"node_modules/@octokit/plugin-retry": {
"version": "3.0.9",
"resolved": "https://registry.npmjs.org/@octokit/plugin-retry/-/plugin-retry-3.0.9.tgz",
"integrity": "sha512-r+fArdP5+TG6l1Rv/C9hVoty6tldw6cE2pRHNGmFPdyfrc696R6JjrQ3d7HdVqGwuzfyrcaLAKD7K8TX8aehUQ==",
"version": "8.1.0",
"resolved": "https://registry.npmjs.org/@octokit/plugin-retry/-/plugin-retry-8.1.0.tgz",
"integrity": "sha512-O1FZgXeiGb2sowEr/hYTr6YunGdSAFWnr2fyW39Ah85H8O33ELASQxcvOFF5LE6Tjekcyu2ms4qAzJVhSaJxTw==",
"license": "MIT",
"dependencies": {
"@octokit/types": "^6.0.3",
"@octokit/request-error": "^7.0.2",
"@octokit/types": "^16.0.0",
"bottleneck": "^2.15.3"
},
"engines": {
"node": ">= 20"
},
"peerDependencies": {
"@octokit/core": ">=7"
}
},
"node_modules/@octokit/request": {
"version": "8.4.1",
"resolved": "https://registry.npmjs.org/@octokit/request/-/request-8.4.1.tgz",
"integrity": "sha512-qnB2+SY3hkCmBxZsR/MPCybNmbJe4KAlfWErXq+rBKkQJlbjdJeS85VI9r8UqeLYLvnAenU8Q1okM/0MBsAGXw==",
"version": "10.0.9",
"resolved": "https://registry.npmjs.org/@octokit/request/-/request-10.0.9.tgz",
"integrity": "sha512-o8Bi3f608eyM+7BmBiUWxFsdjLb3/ym1cQek5LZOv9KkZcxRrHCPhhRzm6xjO6HVZ85ItD6+sTsjxo821SVa/A==",
"license": "MIT",
"dependencies": {
"@octokit/endpoint": "^9.0.6",
"@octokit/request-error": "^5.1.1",
"@octokit/types": "^13.1.0",
"universal-user-agent": "^6.0.0"
"@octokit/endpoint": "^11.0.3",
"@octokit/request-error": "^7.0.2",
"@octokit/types": "^16.0.0",
"content-type": "^2.0.0",
"fast-content-type-parse": "^3.0.0",
"json-with-bigint": "^3.5.3",
"universal-user-agent": "^7.0.2"
},
"engines": {
"node": ">= 18"
"node": ">= 20"
}
},
"node_modules/@octokit/request-error": {
"version": "5.1.1",
"resolved": "https://registry.npmjs.org/@octokit/request-error/-/request-error-5.1.1.tgz",
"integrity": "sha512-v9iyEQJH6ZntoENr9/yXxjuezh4My67CBSu9r6Ve/05Iu5gNgnisNWOsoJHTP6k0Rr0+HQIpnH+kyammu90q/g==",
"version": "7.1.0",
"resolved": "https://registry.npmjs.org/@octokit/request-error/-/request-error-7.1.0.tgz",
"integrity": "sha512-KMQIfq5sOPpkQYajXHwnhjCC0slzCNScLHs9JafXc4RAJI+9f+jNDlBNaIMTvazOPLgb4BnlhGJOTbnN0wIjPw==",
"license": "MIT",
"dependencies": {
"@octokit/types": "^13.1.0",
"deprecation": "^2.0.0",
"once": "^1.4.0"
"@octokit/types": "^16.0.0"
},
"engines": {
"node": ">= 18"
}
},
"node_modules/@octokit/request-error/node_modules/@octokit/openapi-types": {
"version": "24.2.0",
"resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-24.2.0.tgz",
"integrity": "sha512-9sIH3nSUttelJSXUrmGzl7QUBFul0/mB8HRYl3fOlgHbIWG+WnYDXU3v/2zMtAvuzZ/ed00Ei6on975FhBfzrg==",
"license": "MIT"
},
"node_modules/@octokit/request-error/node_modules/@octokit/types": {
"version": "13.10.0",
"resolved": "https://registry.npmjs.org/@octokit/types/-/types-13.10.0.tgz",
"integrity": "sha512-ifLaO34EbbPj0Xgro4G5lP5asESjwHracYJvVaPIyXMuiuXLlhic3S47cBdTb+jfODkTE5YtGCLt3Ay3+J97sA==",
"license": "MIT",
"dependencies": {
"@octokit/openapi-types": "^24.2.0"
}
},
"node_modules/@octokit/request/node_modules/@octokit/openapi-types": {
"version": "24.2.0",
"resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-24.2.0.tgz",
"integrity": "sha512-9sIH3nSUttelJSXUrmGzl7QUBFul0/mB8HRYl3fOlgHbIWG+WnYDXU3v/2zMtAvuzZ/ed00Ei6on975FhBfzrg==",
"license": "MIT"
},
"node_modules/@octokit/request/node_modules/@octokit/types": {
"version": "13.10.0",
"resolved": "https://registry.npmjs.org/@octokit/types/-/types-13.10.0.tgz",
"integrity": "sha512-ifLaO34EbbPj0Xgro4G5lP5asESjwHracYJvVaPIyXMuiuXLlhic3S47cBdTb+jfODkTE5YtGCLt3Ay3+J97sA==",
"license": "MIT",
"dependencies": {
"@octokit/openapi-types": "^24.2.0"
"node": ">= 20"
}
},
"node_modules/@octokit/types": {
"version": "6.41.0",
"resolved": "https://registry.npmjs.org/@octokit/types/-/types-6.41.0.tgz",
"integrity": "sha512-eJ2jbzjdijiL3B4PrSQaSjuF2sPEQPVCPzBvTHJD9Nz+9dw2SGH4K4xeQJ77YfTq5bRQ+bD8wT11JbeDPmxmGg==",
"version": "16.0.0",
"resolved": "https://registry.npmjs.org/@octokit/types/-/types-16.0.0.tgz",
"integrity": "sha512-sKq+9r1Mm4efXW1FCk7hFSeJo4QKreL/tTbR0rz/qx/r1Oa2VV83LTA/H/MuCOX7uCIJmQVRKBcbmWoySjAnSg==",
"license": "MIT",
"dependencies": {
"@octokit/openapi-types": "^12.11.0"
"@octokit/openapi-types": "^27.0.0"
}
},
"node_modules/@pkgjs/parseargs": {
@@ -845,9 +766,9 @@
"license": "MIT"
},
"node_modules/before-after-hook": {
"version": "2.2.3",
"resolved": "https://registry.npmjs.org/before-after-hook/-/before-after-hook-2.2.3.tgz",
"integrity": "sha512-NzUnlZexiaH/46WDhANlyR2bXRopNg4F/zuSA3OpZnllCUgRaOF2znDioDWrmbNVsuZk6l9pMquQB38cfBZwkQ==",
"version": "4.0.0",
"resolved": "https://registry.npmjs.org/before-after-hook/-/before-after-hook-4.0.0.tgz",
"integrity": "sha512-q6tR3RPqIB1pMiTRMFcZwuG5T8vwp+vUvEG0vuI6B+Rikh5BfPp2fQ82c925FOs+b0lcFQ8CFrL+KbilfZFhOQ==",
"license": "Apache-2.0"
},
"node_modules/binary": {
@@ -870,9 +791,9 @@
"license": "MIT"
},
"node_modules/brace-expansion": {
"version": "2.0.2",
"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.2.tgz",
"integrity": "sha512-Jt0vHyM+jmUBqojB7E1NIYadt0vI0Qxjxd2TErW94wDz+E2LAm5vKMXXwg6ZZBTHPuUlDgQHKXvjGBdfcF1ZDQ==",
"version": "2.1.0",
"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.0.tgz",
"integrity": "sha512-TN1kCZAgdgweJhWWpgKYrQaMNHcDULHkWwQIspdtjV4Y5aurRdZpjAqn6yX3FPqTA9ngHCc4hJxMAMgGfve85w==",
"license": "MIT",
"dependencies": {
"balanced-match": "^1.0.0"
@@ -974,6 +895,19 @@
"node": ">= 14"
}
},
"node_modules/content-type": {
"version": "2.0.0",
"resolved": "https://registry.npmjs.org/content-type/-/content-type-2.0.0.tgz",
"integrity": "sha512-j/O/d7GcZCyNl7/hwZAb606rzqkyvaDctLmckbxLzHvFBzTJHuGEdodATcP3yIRoDrLHkIATJuvzbFlp/ki2cQ==",
"license": "MIT",
"engines": {
"node": ">=18"
},
"funding": {
"type": "opencollective",
"url": "https://opencollective.com/express"
}
},
"node_modules/core-util-is": {
"version": "1.0.3",
"resolved": "https://registry.npmjs.org/core-util-is/-/core-util-is-1.0.3.tgz",
@@ -1036,12 +970,6 @@
}
}
},
"node_modules/deprecation": {
"version": "2.3.1",
"resolved": "https://registry.npmjs.org/deprecation/-/deprecation-2.3.1.tgz",
"integrity": "sha512-xmHIy4F3scKVwMsQ4WnVaS8bHOx0DmVwRywosKhaILI0ywMDWPtBSku2HNxRvF7jtwDRsoEwYQSfbxj8b7RlJQ==",
"license": "ISC"
},
"node_modules/eastasianwidth": {
"version": "0.2.0",
"resolved": "https://registry.npmjs.org/eastasianwidth/-/eastasianwidth-0.2.0.tgz",
@@ -1072,16 +1000,32 @@
"node": ">=0.8.x"
}
},
"node_modules/fast-content-type-parse": {
"version": "3.0.0",
"resolved": "https://registry.npmjs.org/fast-content-type-parse/-/fast-content-type-parse-3.0.0.tgz",
"integrity": "sha512-ZvLdcY8P+N8mGQJahJV5G4U88CSvT1rP8ApL6uETe88MBXrBHAkZlSEySdUlyztF7ccb+Znos3TFqaepHxdhBg==",
"funding": [
{
"type": "github",
"url": "https://github.com/sponsors/fastify"
},
{
"type": "opencollective",
"url": "https://opencollective.com/fastify"
}
],
"license": "MIT"
},
"node_modules/fast-fifo": {
"version": "1.3.2",
"resolved": "https://registry.npmjs.org/fast-fifo/-/fast-fifo-1.3.2.tgz",
"integrity": "sha512-/d9sfos4yxzpwkDkuN7k2SqFKtYNmCTzgfEpz82x34IM9/zc8KGxQoXg1liNC/izpRM/MBdt44Nmx41ZWqk+FQ==",
"license": "MIT"
},
"node_modules/fast-xml-parser": {
"version": "5.3.6",
"resolved": "https://registry.npmjs.org/fast-xml-parser/-/fast-xml-parser-5.3.6.tgz",
"integrity": "sha512-QNI3sAvSvaOiaMl8FYU4trnEzCwiRr8XMWgAHzlrWpTSj+QaCSvOf1h82OEP1s4hiAXhnbXSyFWCf4ldZzZRVA==",
"node_modules/fast-xml-builder": {
"version": "1.2.0",
"resolved": "https://registry.npmjs.org/fast-xml-builder/-/fast-xml-builder-1.2.0.tgz",
"integrity": "sha512-00aAWieqff+ZJhsXA4g1g7M8k+7AYoMUUHF+/zFb5U6Uv/P0Vl4QZo84/IcufzYalLuEj9928bXN9PbbFzMF0Q==",
"funding": [
{
"type": "github",
@@ -1090,7 +1034,27 @@
],
"license": "MIT",
"dependencies": {
"strnum": "^2.1.2"
"path-expression-matcher": "^1.5.0",
"xml-naming": "^0.1.0"
}
},
"node_modules/fast-xml-parser": {
"version": "5.8.0",
"resolved": "https://registry.npmjs.org/fast-xml-parser/-/fast-xml-parser-5.8.0.tgz",
"integrity": "sha512-6bIM7fsJxeo3uXv7OncQYsBAMPJ7V16Slahl/6M98C/i2q+vB1+4a0MtrvYwDFEUrwDSbAmeLDRXsOBwrL7yAg==",
"funding": [
{
"type": "github",
"url": "https://github.com/sponsors/NaturalIntelligence"
}
],
"license": "MIT",
"dependencies": {
"@nodable/entities": "^2.1.0",
"fast-xml-builder": "^1.2.0",
"path-expression-matcher": "^1.5.0",
"strnum": "^2.3.0",
"xml-naming": "^0.1.0"
},
"bin": {
"fxparser": "src/cli/cli.js"
@@ -1239,12 +1203,21 @@
"@pkgjs/parseargs": "^0.11.0"
}
},
"node_modules/jwt-decode": {
"version": "3.1.2",
"resolved": "https://registry.npmjs.org/jwt-decode/-/jwt-decode-3.1.2.tgz",
"integrity": "sha512-UfpWE/VZn0iP50d8cz9NrZLM9lSWhcJ+0Gt/nm4by88UL+J1SiKN8/5dkjMmbEzwL2CAe+67GsegCbIKtbp75A==",
"node_modules/json-with-bigint": {
"version": "3.5.8",
"resolved": "https://registry.npmjs.org/json-with-bigint/-/json-with-bigint-3.5.8.tgz",
"integrity": "sha512-eq/4KP6K34kwa7TcFdtvnftvHCD9KvHOGGICWwMFc4dOOKF5t4iYqnfLK8otCRCRv06FXOzGGyqE8h8ElMvvdw==",
"license": "MIT"
},
"node_modules/jwt-decode": {
"version": "4.0.0",
"resolved": "https://registry.npmjs.org/jwt-decode/-/jwt-decode-4.0.0.tgz",
"integrity": "sha512-+KJGIyHgkGuIq3IEBNftfhW/LfWhXUIY6OmyVWjliu5KH1y0fw7VQ8YndE2O4qZdMSd9SqbnC8GOcZEy0Om7sA==",
"license": "MIT",
"engines": {
"node": ">=18"
}
},
"node_modules/lazystream": {
"version": "1.0.1",
"resolved": "https://registry.npmjs.org/lazystream/-/lazystream-1.0.1.tgz",
@@ -1288,9 +1261,9 @@
}
},
"node_modules/lodash": {
"version": "4.17.23",
"resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.23.tgz",
"integrity": "sha512-LgVTMpQtIopCi79SJeDiP0TfWi5CNEc/L/aRdTh3yIvmZXTnheWpKjSZhnvMl8iXbC1tFg9gdHHDMLoV7CnG+w==",
"version": "4.18.1",
"resolved": "https://registry.npmjs.org/lodash/-/lodash-4.18.1.tgz",
"integrity": "sha512-dMInicTPVE8d1e5otfwmmjlxkZoUpiVLwyeTdUsi/Caj/gfzzblBcCE5sRHV/AsjuCmxWrte2TNGSYuCeCq+0Q==",
"license": "MIT"
},
"node_modules/lru-cache": {
@@ -1300,12 +1273,12 @@
"license": "ISC"
},
"node_modules/minimatch": {
"version": "9.0.5",
"resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.5.tgz",
"integrity": "sha512-G6T0ZX48xgozx7587koeX9Ys2NYy6Gmv//P89sEte9V9whIapMNF4idKxnW2QtCcLiTWlb/wfCabAtAFWhhBow==",
"version": "9.0.9",
"resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.9.tgz",
"integrity": "sha512-OBwBN9AL4dqmETlpS2zasx+vTeWclWzkblfZk7KTA5j3jeOONz/tRCnZomUyvNg83wL5Zv9Ss6HMJXAgL8R2Yg==",
"license": "ISC",
"dependencies": {
"brace-expansion": "^2.0.1"
"brace-expansion": "^2.0.2"
},
"engines": {
"node": ">=16 || 14 >=14.17"
@@ -1359,21 +1332,27 @@
"node": ">=0.10.0"
}
},
"node_modules/once": {
"version": "1.4.0",
"resolved": "https://registry.npmjs.org/once/-/once-1.4.0.tgz",
"integrity": "sha512-lNaJgI+2Q5URQBkccEKHTQOPaXdUxnZZElQTZY0MFUAuaEqe1E+Nyvgdz/aIyNi6Z9MzO5dv1H8n58/GELp3+w==",
"license": "ISC",
"dependencies": {
"wrappy": "1"
}
},
"node_modules/package-json-from-dist": {
"version": "1.0.1",
"resolved": "https://registry.npmjs.org/package-json-from-dist/-/package-json-from-dist-1.0.1.tgz",
"integrity": "sha512-UEZIS3/by4OC8vL3P2dTXRETpebLI2NiI5vIrjaD/5UtrkFX/tNbwjTSRAGC/+7CAo2pIcBaRgWmcBBHcsaCIw==",
"license": "BlueOak-1.0.0"
},
"node_modules/path-expression-matcher": {
"version": "1.5.0",
"resolved": "https://registry.npmjs.org/path-expression-matcher/-/path-expression-matcher-1.5.0.tgz",
"integrity": "sha512-cbrerZV+6rvdQrrD+iGMcZFEiiSrbv9Tfdkvnusy6y0x0GKBXREFg/Y65GhIfm0tnLntThhzCnfKwp1WRjeCyQ==",
"funding": [
{
"type": "github",
"url": "https://github.com/sponsors/NaturalIntelligence"
}
],
"license": "MIT",
"engines": {
"node": ">=14.0.0"
}
},
"node_modules/path-key": {
"version": "3.1.1",
"resolved": "https://registry.npmjs.org/path-key/-/path-key-3.1.1.tgz",
@@ -1440,9 +1419,9 @@
}
},
"node_modules/readdir-glob/node_modules/minimatch": {
"version": "5.1.6",
"resolved": "https://registry.npmjs.org/minimatch/-/minimatch-5.1.6.tgz",
"integrity": "sha512-lKwV/1brpG6mBUFHtb7NUmtABCb2WZZmm2wNiOA5hAb8VdCS4B3dtMWyvcoViccwAW/COERjXLt0zP1zXUN26g==",
"version": "5.1.9",
"resolved": "https://registry.npmjs.org/minimatch/-/minimatch-5.1.9.tgz",
"integrity": "sha512-7o1wEA2RyMP7Iu7GNba9vc0RWWGACJOCZBJX2GJWip0ikV+wcOsgVuY9uE8CPiyQhkGFSlhuSkZPavN7u1c2Fw==",
"license": "ISC",
"dependencies": {
"brace-expansion": "^2.0.1"
@@ -1623,9 +1602,9 @@
}
},
"node_modules/strnum": {
"version": "2.1.2",
"resolved": "https://registry.npmjs.org/strnum/-/strnum-2.1.2.tgz",
"integrity": "sha512-l63NF9y/cLROq/yqKXSLtcMeeyOfnSQlfMSlzFt/K73oIaD8DGaQWd7Z34X9GPiKqP5rbSh84Hl4bOlLcjiSrQ==",
"version": "2.3.0",
"resolved": "https://registry.npmjs.org/strnum/-/strnum-2.3.0.tgz",
"integrity": "sha512-ums3KNd42PGyx5xaoVTO1mjU1bH3NpY4vsrVlnv9PNGqQj8wd7rJ6nEypLrJ7z5vxK5RP0yMLo6J/Gsm62DI5Q==",
"funding": [
{
"type": "github",
@@ -1683,7 +1662,6 @@
"resolved": "https://registry.npmjs.org/typescript/-/typescript-3.9.10.tgz",
"integrity": "sha512-w6fIxVE/H1PkLKcCPsFqKE7Kv7QUwhU8qQY2MueZXWx5cPZdwFupLgKK3vntcK98BtNHZtAF4LA/yl2a7k8R6Q==",
"license": "Apache-2.0",
"peer": true,
"bin": {
"tsc": "bin/tsc",
"tsserver": "bin/tsserver"
@@ -1705,9 +1683,9 @@
}
},
"node_modules/universal-user-agent": {
"version": "6.0.1",
"resolved": "https://registry.npmjs.org/universal-user-agent/-/universal-user-agent-6.0.1.tgz",
"integrity": "sha512-yCzhz6FN2wU1NiiQRogkTQszlQSlpWaw8SvVegAc+bDxbzHgh1vX8uIe8OYyMH6DwH+sdTJsgMl36+mSMdRJIQ==",
"version": "7.0.3",
"resolved": "https://registry.npmjs.org/universal-user-agent/-/universal-user-agent-7.0.3.tgz",
"integrity": "sha512-TmnEAEAsBJVZM/AADELsK76llnwcf9vMKuPz8JflO1frO8Lchitr0fNaN9d+Ap0BjKtqWqd/J17qeDnXh8CL2A==",
"license": "ISC"
},
"node_modules/unzip-stream": {
@@ -1726,6 +1704,16 @@
"integrity": "sha512-EPD5q1uXyFxJpCrLnCc1nHnq3gOa6DZBocAIiI2TaSCA7VCJ1UJDMagCzIkXNsUYfD1daK//LTEQ8xiIbrHtcw==",
"license": "MIT"
},
"node_modules/uuid": {
"version": "8.3.2",
"resolved": "https://registry.npmjs.org/uuid/-/uuid-8.3.2.tgz",
"integrity": "sha512-+NYs2QeMWy+GWFOEm9xnn6HCDp0l7QBD7ml8zLUmJ+93Q5NF0NocErnwkTkXVFNiX3/fpC6afS8Dhb/gz7R7eg==",
"deprecated": "uuid@10 and below is no longer supported. For ESM codebases, update to uuid@latest. For CommonJS codebases, use uuid@11 (but be aware this version will likely be deprecated in 2028).",
"license": "MIT",
"bin": {
"uuid": "dist/bin/uuid"
}
},
"node_modules/which": {
"version": "2.0.2",
"resolved": "https://registry.npmjs.org/which/-/which-2.0.2.tgz",
@@ -1832,11 +1820,20 @@
"node": ">=8"
}
},
"node_modules/wrappy": {
"version": "1.0.2",
"resolved": "https://registry.npmjs.org/wrappy/-/wrappy-1.0.2.tgz",
"integrity": "sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ==",
"license": "ISC"
"node_modules/xml-naming": {
"version": "0.1.0",
"resolved": "https://registry.npmjs.org/xml-naming/-/xml-naming-0.1.0.tgz",
"integrity": "sha512-k8KO9hrMyNk6tUWqUfkTEZbezRRpONVOzUTnc97VnCvyj6Tf9lyUR9EDAIeiVLv56jsMcoXEwjW8Kv5yPY52lw==",
"funding": [
{
"type": "github",
"url": "https://github.com/sponsors/NaturalIntelligence"
}
],
"license": "MIT",
"engines": {
"node": ">=16.0.0"
}
},
"node_modules/zip-stream": {
"version": "6.0.1",
ci/github-script/package.json
+3 -3
View File
@@ -7,9 +7,9 @@
"`.github/workflows/bot.yml`."
],
"dependencies": {
"@actions/artifact": "5.0.3",
"@actions/core": "1.11.1",
"@actions/github": "6.0.1",
"@actions/artifact": "6.2.1",
"@actions/core": "1.10.1",
"@actions/github": "9.1.0",
"bottleneck": "2.19.5",
"commander": "14.0.3"
}
ci/github-script/prepare.js
+2 -2
View File
@@ -181,9 +181,9 @@ module.exports = async ({ github, context, core, dry }) => {
event: 'REQUEST_CHANGES',
reviewKey,
})
} else {
await dismissReviews({ github, context, core, dry, reviewKey })
}
} else {
await dismissReviews({ github, context, core, dry, reviewKey })
}
let mergedSha, targetSha
doc/README.md
+32
View File
@@ -217,6 +217,38 @@ Not everything has been migrated to this format yet.
Please always use it for new content.
When changing existing content, update formatting if possible, but avoid excessive diffs.
### Examples first
Readers look at examples first: an example communicates what something does faster than a description.
Put examples before detailed explanations.
Prefer this structure for each documented item:
1. Title
2. Abstract (optional, one sentence max, the example often speaks for itself)
3. Example
4. Explanation (details, edge cases, types, defaults)
For instance:
````markdown
## `lib.toUpper`
Converts all characters in a string to uppercase.
:::{.example #ex-lib-toUpper}
# Converting a string to uppercase
```nix
lib.toUpper "hello"
=> "HELLO"
```
:::
Only acts on ASCII characters.
Unicode characters are passed through unchanged.
````
### Writing Function Documentation
Function documentation is *reference documentation*, for which
doc/build-helpers/testers.chapter.md
+7
View File
@@ -129,6 +129,13 @@ It has two modes:
Example: `{ "include_verbatim" = true; }`
`extraArgs` (list of strings, optional) {#tester-lycheeLinkCheck-param-extraArgs}
: Extra command line arguments to pass to the `lychee` invocation.
These are passed in both the offline (build) and [`online`](#tester-lycheeLinkCheck-return) modes.
Example: `[ "--format" "json" ]`
`lychee` (derivation, optional) {#tester-lycheeLinkCheck-param-lychee}
: The `lychee` package to use.
doc/doc-support/epub.nix
+3 -3
View File
@@ -37,16 +37,16 @@ runCommand "manual.epub"
</book>
'';
passAsFile = [ "epub" ];
__structuredAttrs = true;
}
''
mkdir scratch
xsltproc \
printf "%s" "$epub" | xsltproc \
--param chapter.autolabel 0 \
--nonet \
--output scratch/ \
${docbook_xsl_ns}/xml/xsl/docbook/epub/docbook.xsl \
$epubPath
-
echo "application/epub+zip" > mimetype
zip -0Xq -b "$TMPDIR" "$out" mimetype
doc/languages-frameworks/android.section.md
+1 -1
View File
@@ -308,7 +308,7 @@ Ensure that your buildToolsVersion and ndkVersion match what is declared in andr
If you are using cmake, make sure its declared version is correct too.
Otherwise, you may get cryptic errors from aapt2 and the Android Gradle plugin warning
that it cannot install the build tools because the SDK directory is not writeable.
that it cannot install the build tools because the SDK directory is not writable.
```gradle
android {
doc/languages-frameworks/emscripten.section.md
+1 -1
View File
@@ -205,7 +205,7 @@ pkgs.buildEmscriptenPackage {
## Debugging {#declarative-debugging}
Use `nix-shell -I nixpkgs=/some/dir/nixpkgs -A emscriptenPackages.libz` and from there you can go trough the individual steps. This makes it easy to build a good `unit test` or list the files of the project.
Use `nix-shell -I nixpkgs=/some/dir/nixpkgs -A emscriptenPackages.libz` and from there you can go through the individual steps. This makes it easy to build a good `unit test` or list the files of the project.
1. `nix-shell -I nixpkgs=/some/dir/nixpkgs -A emscriptenPackages.libz`
2. `cd /tmp/`
doc/languages-frameworks/javascript.section.md
+16 -6
View File
@@ -305,7 +305,7 @@ This package puts the corepack wrappers for pnpm and yarn in your PATH, and they
### pnpm {#javascript-pnpm}
pnpm is available as the top-level package `pnpm`. Additionally, there are variants pinned to certain major versions, like `pnpm_8`, `pnpm_9` and `pnpm_10`, which support different sets of lock file versions.
pnpm is available as the top-level package `pnpm`. Additionally, there are variants pinned to certain major versions, like `pnpm_8`, `pnpm_9`, `pnpm_10`, `pnpm_10_29_2` and `pnpm_11`, which support different sets of lock file versions.
When packaging an application that includes a `pnpm-lock.yaml`, you need to fetch the pnpm store for that project using a fixed-output-derivation. The function `fetchPnpmDeps` can create this pnpm store derivation. In conjunction, the setup hook `pnpmConfigHook` will prepare the build environment to install the pre-fetched dependencies store. Here is an example for a package that contains `package.json` and a `pnpm-lock.yaml` files using the fetcher and setup hook above:
@@ -313,11 +313,18 @@ When packaging an application that includes a `pnpm-lock.yaml`, you need to fetc
{
fetchPnpmDeps,
nodejs,
pnpm,
pnpm_11,
pnpmConfigHook,
stdenv,
}:
let
# It is recommended to pin pnpm to a major version, due to regular breaking changes in the store format
# The latest major version is always available under `pkgs.pnpm`
# Optionally override pnpm to use a custom nodejs version
# Make sure that the same nodejs version is referenced in nativeBuildInputs
# pnpm = pnpm_11.override { nodejs = nodejs_24; };
pnpm = pnpm_11;
in
stdenv.mkDerivation (finalAttrs: {
pname = "foo";
version = "0-unstable-1980-01-01";
@@ -334,6 +341,7 @@ stdenv.mkDerivation (finalAttrs: {
pnpmDeps = fetchPnpmDeps {
inherit (finalAttrs) pname version src;
inherit pnpm;
fetcherVersion = 3;
hash = "...";
};
@@ -356,7 +364,7 @@ It is highly recommended to use a pinned version of pnpm (i.e., `pnpm_9` or `pnp
+let
+ # Optionally override pnpm to use a custom nodejs version
+ # Make sure that the same nodejs version is referenced in nativeBuildInputs
+ # pnpm = pnpm_10.override { nodejs = nodejs_20; };
+ # pnpm = pnpm_10.override { nodejs = nodejs-slim_22; };
+in
stdenv.mkDerivation (finalAttrs: {
pname = "foo";
@@ -503,9 +511,11 @@ Changes can include workarounds or bug fixes to existing PNPM issues.
##### Version history {#javascript-pnpm-fetcherVersion-versionHistory}
- 1: Initial version, nothing special. **Deprecated: Scheduled for removal in the 26.11 release.**. New packages must not use this value.
Version 3 is the recommended value for new packages. Versions 1 and 2 are deprecated and scheduled for removal in the 26.11 release; existing packages must migrate.
- 1: Initial version, nothing special.
- 2: [Ensure consistent permissions](https://github.com/NixOS/nixpkgs/pull/422975)
- 3: [Build a reproducible tarball](https://github.com/NixOS/nixpkgs/pull/469950). **Recommended**
- 3: [Build a reproducible tarball](https://github.com/NixOS/nixpkgs/pull/469950)
### Yarn {#javascript-yarn}
doc/languages-frameworks/rust.section.md
+9
View File
@@ -871,6 +871,15 @@ general. A number of other parameters can be overridden:
(hello { }).override { extraRustcOpts = "-Z debuginfo=2"; }
```
- Extra arguments passed to `rustc` when the crate is a proc-macro,
replacing `extraRustcOpts`. Useful to keep instrumentation flags
(sanitizers, coverage) off host dylibs. Defaults to `null`, which
inherits `extraRustcOpts`:
```nix
(myProcMacro { }).override { extraRustcOptsForProcMacro = [ ]; }
```
- The lint level cap passed to `rustc`. Defaults to `null`, which
auto-resolves to `"allow"` (silences all lints) when `lints` is
empty, or `"forbid"` (no cap) when `lints` is set. Because `rustc`
doc/release-notes/rl-2605.section.md
+20 -9
View File
@@ -93,6 +93,8 @@
This update introduces several breaking changes: the Python plugin interface is now v5.0, the `PATH` plugin has been renamed to `Commandline`, and the QStylesheets-based widgets box model frontend has been removed.
For more information read the [changelog for 34.0.0](https://albertlauncher.github.io/2026/01/19/albert-v34.0.0-released/).
- `asciinema_3` is now renamed to `asciinema` and the old `asciinema` version 2.x.x written in python was removed.
- `sing-box` has been updated to 1.13.0, which has removed some deprecated options. See [upstream documentation](https://sing-box.sagernet.org/configuration/) for details and migration options.
- `cargo-codspeed` has been updated from `3.0.5` to `4.2.0`. Version `4.0.0` includes breaking changes. For more information read the [changelog for 4.0.0](https://github.com/CodSpeedHQ/codspeed-rust/releases/tag/v4.0.0).
@@ -113,7 +115,7 @@
- `nodePackages.browserify` has been removed, as it was unmaintained within nixpkgs.
- `command-not-found` package will be enabled by default if the source of nixpkgs contains the file `programs.sqlite`. This is the case if a nixpkgs tarball from https://channels.nixos.org is used. This usage will also make the database of `command-no-found` stateless.
- `command-not-found` package will be enabled by default if the source of nixpkgs contains the file `programs.sqlite`. This is the case if a nixpkgs tarball from https://channels.nixos.org is used. This usage will also make the database of `command-not-found` stateless.
- `nodePackages.sass` has been removed, as it was unmaintained within nixpkgs.
@@ -128,7 +130,7 @@
- Keycloak has been updated to 26.6.X, bringing a lot new features like federated client authentication, JWT authorization grants, workflows and the ability to do
zero-downtime patch releases. Read more about [all the exciting new capabilities in keycloak 26.6 here](https://github.com/keycloak/keycloak/releases/tag/26.6.0)
and [consult the migration guide to 26.6](https://www.keycloak.org/docs/latest/upgrading/index.html#migrating-to-26-6-0) to find out wether this is a breaking
and [consult the migration guide to 26.6](https://www.keycloak.org/docs/latest/upgrading/index.html#migrating-to-26-6-0) to find out whether this is a breaking
change for your keycloak instance.
- `elegant-sddm` has been updated to be Qt6 compatible. Themes for SDDM are slightly different so read the [wiki](https://wiki.nixos.org/wiki/SDDM_Themes) for more.
@@ -195,6 +197,8 @@
- `python3Packages.pikepdf` no longer builds with mupdf support by default, which may be nice in Jupyter and iPython. Build with `withMupdf = true` if this is required.
- `python3Packages.django-mdeditor` has been removed, as it was unmaintained upstream and the latest release was vulnerable to a [critical security vulnerability](https://github.com/NixOS/nixpkgs/issues/515462).
- `vicinae` has been updated to v0.20. This includes, among several other breaking changes, a complete overhaul of the configuration system. For update instructions, see the [upstream configuration documentation](https://docs.vicinae.com/config#migration-from-v0-16-x-to-v0-17-x).
- `percona-server_8_4` has been removed. Please update to `percona-server_8_0`, `mysql84` or `mariadb`.
@@ -249,6 +253,8 @@
- Ethercalc and its associated module have been removed, as the package is unmaintained and cannot be installed from source with npm now.
- The `services.avahi.wideArea` option now defaults to `false` as a mitigation against [`CVE-2024-52615`/`GHSA-x6vp-f33h-h32g`](https://github.com/avahi/avahi/security/advisories/GHSA-x6vp-f33h-h32g).
- `coreth` has been removed, as upstream has moved it into `avalanchego`.
- `nodePackages.prebuild-install` was removed because it appeared to be unmaintained upstream.
@@ -286,6 +292,8 @@
- `spacefm` was removed because it appeared to be unmaintained upstream.
- `neofetch` has been removed because it was unmaintained upstream. Consider using the updated fork `neowofetch` provided by the `hyfetch` package or the alternative `fastfetch` instead.
- `vimPlugins.nvim-treesitter` has been updated to `main` branch, which is a full and incompatible rewrite. If you can't or don't want to update, you should use `vimPlugins.nvim-treesitter-legacy`.
- `services.taskchampion-sync-server` module have been added an option `services.taskchampion-sync-server.dynamicUser` to use systemd's DynamicUser feature. This is enabled by default when stateVersion is at least 26.05, and disabled otherwise. If you need this feature, you need to set `services.taskchampion-sync-server.dynamicUser` to `true` and migrate `/var/lib/taskchampion-sync-server` to `/var/lib/private/taskchampion-sync-server`.
@@ -328,11 +336,12 @@
- `fetchPnpmDeps` and `pnpmConfigHook` were added as top-level attributes, replacing the now deprecated `pnpm.fetchDeps` and `pnpm.configHook` attributes.
- `fetchPnpmDeps`' `fetcherVersion = 1` is deprecated and scheduled for removal
in the 26.11 release. A deprecation warning has been added. Packages still on
`fetcherVersion = 1` should migrate to `fetcherVersion = 3` and regenerate
their hashes. See the [pnpm `fetcherVersion`
section](#javascript-pnpm-fetcherVersion) of the manual for details.
- `fetchPnpmDeps`' `fetcherVersion = 1` and `fetcherVersion = 2` are deprecated
and scheduled for removal in the 26.11 release. A deprecation warning has
been added. Packages still on `fetcherVersion = 1` or `fetcherVersion = 2`
should migrate to `fetcherVersion = 3` and regenerate their hashes. See the
[pnpm `fetcherVersion` section](#javascript-pnpm-fetcherVersion) of the
manual for details.
- `buildNpmPackage` now supports `npmDepsFetcherVersion` (and `fetchNpmDeps` now supports `fetcherVersion`). Set to `2` to enable packument caching, which fixes builds for projects using npm workspaces.
@@ -383,9 +392,9 @@ gnuradioMinimal.override {
### Breaking changes {#sec-nixpkgs-release-26.05-lib-breaking}
- The `nodejs_latest` alias now points to `nodejs_25` instead of `nodejs_24`.
- The `nodejs_latest` alias now points to `nodejs_26` instead of `nodejs_24`.
- `nodejs-slim` no longer exposes a `corepack` executable, it has been moved to an ad-hoc output; to restore the previous behavior, `nodejs-slim.corepack` must be explicitely included.
- `nodejs-slim` no longer exposes a `corepack` executable, it has been moved to an ad-hoc output; to restore the previous behavior, `nodejs-slim.corepack` must be explicitly included.
- `nodejs` is now a simple wrapper for `nodejs-slim`+`nodejs-slim.npm`+`nodejs-slim.corepack`, meaning it is no longer possible to reference or override its attributes or outputs (e.g. `nodejs.libv8` must be replaced with `nodejs-slim.libv8`, `nodejs.nativeBuildInputs` with `nodejs-slim.nativeBuildInputs`, etc.).
@@ -403,6 +412,8 @@ gnuradioMinimal.override {
- `fetchFromSavannah` is now deprecated and is expected to be fully removed in a future release. From now on, use `fetchgit` or a Savannah releases mirror when applicable.
- Using nested lists in build/runtime inputs in `mkDerivation` is now deprecated.
### Additions and Improvements {#sec-nixpkgs-release-26.05-lib-additions-improvements}
- The builder `php.buildComposerProject2` for PHP applications has been improved for better reliability and stability.
doc/release-notes/rl-2611.section.md
+40
View File
@@ -0,0 +1,40 @@
# Nixpkgs 26.11 (2026.11/??) {#sec-nixpkgs-release-26.11}
## Highlights {#sec-nixpkgs-release-26.11-highlights}
<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
- Create the first release note entry in this section!
## Backward Incompatibilities {#sec-nixpkgs-release-26.11-incompatibilities}
<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
- `pqos-wrapper` was removed
as it has been unmaintained since 2022
and not widely used.
## Other Notable Changes {#sec-nixpkgs-release-26.11-notable-changes}
<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
- Create the first release note entry in this section!
## Nixpkgs Library {#sec-nixpkgs-release-26.11-lib}
<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
### Breaking changes {#sec-nixpkgs-release-26.11-lib-breaking}
- Create the first release note entry in this section!
### Deprecations {#sec-nixpkgs-release-26.11-lib-deprecations}
- Create the first release note entry in this section!
### Additions and Improvements {#sec-nixpkgs-release-26.11-lib-additions-improvements}
- Create the first release note entry in this section!
doc/style.css
+3 -1
View File
@@ -325,8 +325,10 @@ div.appendix .important > :last-child {
div.book .note,
div.book .tip,
div.book .important,
div.appendix .note,
div.appendix .tip {
div.appendix .tip,
div.appendix .important {
color: var(--note-text-color);
background: var(--note-background);
}
doc/using/configuration.chapter.md
+16
View File
@@ -31,6 +31,22 @@ Unfree software is not tested or built in Nixpkgs continuous integration, and th
Most unfree licenses prohibit either executing or distributing the software.
:::
The `NIXPKGS_CONFIG` environment variable can override the configuration file location.
Nixpkgs resolves the config in this order:
1. `$NIXPKGS_CONFIG`, if set and the file exists.
2. `~/.config/nixpkgs/config.nix`, if it exists.
3. `~/.nixpkgs/config.nix` (legacy), if it exists.
4. Empty configuration.
On NixOS, `NIXPKGS_CONFIG` points to `/etc/nix/nixpkgs-config.nix` system-wide.
Drop a file there to apply configuration to `nix-env`, `nix-shell`, and other user-level commands.
NixOS does not create this file.
The [`nixpkgs.config`](https://nixos.org/manual/nixos/stable/options#opt-nixpkgs.config) option does not affect `nix-env`, `nix-shell`, or other user-level commands.
This lookup applies to non-flake usage like channels and `<nixpkgs>`.
Flakes ignore it; pass `config` directly when importing `nixpkgs`.
## Installing broken packages {#sec-allow-broken}
There are several ways to try compiling a package which has been marked as broken.
lib/customisation.nix
+19 -25
View File
@@ -30,7 +30,6 @@ let
flatten
deepSeq
extends
toFunction
id
;
inherit (lib.strings) levenshtein levenshteinAtMost;
@@ -842,14 +841,6 @@ rec {
:::
*/
extendMkDerivation =
let
extendsWithExclusion =
excludedNames: g: f: final:
let
previous = f final;
in
removeAttrs previous excludedNames // g final previous;
in
{
constructDrv,
excludeDrvArgNames ? [ ],
@@ -858,24 +849,27 @@ rec {
inheritFunctionArgs ? true,
transformDrv ? id,
}:
setFunctionArgs
{
# Adds the fixed-point style support
(
fpargs:
__functor =
self: fpargs:
transformDrv (
constructDrv (extendsWithExclusion excludeDrvArgNames extendDrvArgs (toFunction fpargs))
)
)
# Add __functionArgs
(
removeAttrs (
# Inherit the __functionArgs from the base build helper
optionalAttrs inheritFunctionArgs (removeAttrs (functionArgs constructDrv) excludeDrvArgNames)
# Recover the __functionArgs from the derived build helper
// functionArgs (extendDrvArgs { })
) excludeFunctionArgNames
)
// {
constructDrv (
final:
let
previous = if isFunction fpargs then fpargs final else fpargs;
in
removeAttrs previous excludeDrvArgNames // extendDrvArgs final previous
)
);
__functionArgs = removeAttrs (
# Inherit the __functionArgs from the base build helper
optionalAttrs inheritFunctionArgs (removeAttrs (functionArgs constructDrv) excludeDrvArgNames)
# Recover the __functionArgs from the derived build helper
// functionArgs (extendDrvArgs { })
) excludeFunctionArgNames;
inherit
# Expose to the result build helper.
constructDrv
lib/fetchers.nix
+40 -29
View File
@@ -1,16 +1,38 @@
# snippets that can be shared by multiple fetchers (pkgs/build-support)
{ lib }:
let
commonH = hashTypes: rec {
hashNames = [ "hash" ] ++ hashTypes;
hashSet = lib.genAttrs hashNames (lib.const { });
};
commonH =
let
defaultHashNames = [ "hash" ];
in
hashTypes: rec {
hashNames = defaultHashNames ++ hashTypes;
hashSet = genAttrs hashNames (const { });
};
fakeH = {
hash = lib.fakeHash;
sha256 = lib.fakeSha256;
sha512 = lib.fakeSha512;
};
defaultHashTypes = [ "sha256" ];
inherit (lib)
concatMapStringsSep
head
length
throwIf
;
inherit (lib.attrsets)
attrsToList
intersectAttrs
genAttrs
removeAttrs
optionalAttrs
;
inherit (lib.trivial) const functionArgs setFunctionArgs;
in
rec {
@@ -90,27 +112,14 @@ rec {
*/
normalizeHash =
{
hashTypes ? [ "sha256" ],
hashTypes ? defaultHashTypes,
required ? true,
}:
let
inherit (lib)
concatMapStringsSep
head
tail
throwIf
;
inherit (lib.attrsets)
attrsToList
intersectAttrs
removeAttrs
optionalAttrs
;
inherit (commonH hashTypes) hashNames hashSet;
in
args:
if args ? "outputHash" then
if args ? outputHash then
args
else
let
@@ -122,7 +131,7 @@ rec {
in
if hashesAsNVPairs == [ ] then
throwIf required "fetcher called without `hash`" null
else if tail hashesAsNVPairs != [ ] then
else if length hashesAsNVPairs != 1 then
throw "fetcher called with mutually-incompatible arguments: ${
concatMapStringsSep ", " (a: a.name) hashesAsNVPairs
}"
@@ -190,15 +199,20 @@ rec {
and is implemented somewhat more efficiently.
*/
withNormalizedHash =
let
removedAttributes = [
"outputHash"
"outputHashAlgo"
];
in
{
hashTypes ? [ "sha256" ],
hashTypes ? defaultHashTypes,
}:
let
inherit (commonH hashTypes) hashSet;
in
fetcher:
let
inherit (lib.attrsets) intersectAttrs removeAttrs;
inherit (lib.trivial) functionArgs setFunctionArgs;
inherit (commonH hashTypes) hashSet;
fArgs = functionArgs fetcher;
normalize = normalizeHash {
@@ -211,10 +225,7 @@ rec {
assert intersectAttrs fArgs hashSet == { };
setFunctionArgs (args: fetcher (normalize args)) (
removeAttrs fArgs [
"outputHash"
"outputHashAlgo"
]
removeAttrs fArgs removedAttributes
// {
hash = fArgs.outputHash;
}
lib/licenses/helpers.nix
+59 -24
View File
@@ -1,4 +1,23 @@
{ lib }:
let
inherit (lib) all any elem;
handleComplexProperty =
evaluateSubProperty: AND: OR: license:
if license.licenseType == "compound" then
if license.operator == "OR" then
OR evaluateSubProperty license.licenses
else if license.operator == "AND" then
AND evaluateSubProperty license.licenses
else
throw "Unknown license operator"
else if license.licenseType == "exception" then
evaluateSubProperty license.license && evaluateSubProperty license.exception
else if license.licenseType == "plus" then
evaluateSubProperty license.license
else
throw "Unknown license type or legacy license";
in
rec {
/**
Evaluate a license expression for a given predicate.
@@ -21,29 +40,45 @@ rec {
- [license] license expression to check
*/
evaluateProperty =
predicate: permissive: license:
predicate: permissive:
let
OR = if permissive then lib.any else lib.all;
AND = if permissive then lib.all else lib.any;
OR = if permissive then any else all;
AND = if permissive then all else any;
evaluateComplexProperty = handleComplexProperty (evaluateProperty predicate permissive) AND OR;
in
if license.licenseType == "simple" then
predicate license
else if license.licenseType == "compound" then
if license.operator == "OR" then
OR (x: evaluateProperty predicate permissive x) license.licenses
else if license.operator == "AND" then
AND (x: evaluateProperty predicate permissive x) license.licenses
else
throw "Unknown license operator"
else if license.licenseType == "exception" then
AND (x: evaluateProperty predicate permissive x) [
license.license
license.exception
]
else if license.licenseType == "plus" then
evaluateProperty predicate permissive license.license
else
throw "Unknown license type or legacy license";
license:
if license.licenseType == "simple" then predicate license else evaluateComplexProperty license;
/**
Evaluate a license expression for a given property name. The property must
be defined as a boolean attribute of all licenses passed.
# Example
```nix
evaluateNamedProperty "deprecated" true (with lib.licenses; AND [ ncsa (WITH asl20 llvm-exception) ])
```
# Type
```
evaluateProperty :: String -> Bool -> AttrSet -> Bool
```
# Arguments
- [name] name of the attribute to check
- [permissive] whether to apply checks permissive or reciprocal
- [license] license expression to check
*/
evaluateNamedProperty =
name: permissive:
let
OR = if permissive then any else all;
AND = if permissive then all else any;
evaluateComplexProperty = handleComplexProperty (evaluateNamedProperty name permissive) AND OR;
in
license:
if license.licenseType == "simple" then license.${name} else evaluateComplexProperty license;
/**
Check whether a license expression is free.
@@ -65,7 +100,7 @@ rec {
- [license] License expression to check if free
*/
isFree = evaluateProperty (x: x.free) true;
isFree = evaluateNamedProperty "free" true;
/**
Check whether a license expression is redistributable.
@@ -87,7 +122,7 @@ rec {
- [license] License expression to check if redistributable
*/
isRedistributable = evaluateProperty (x: x.redistributable) true;
isRedistributable = evaluateNamedProperty "redistributable" true;
/**
Check whether any of the given licenses is required in the license expression.
@@ -110,7 +145,7 @@ rec {
- [licenses] List of licenses to look
- [license] License expression to check
*/
containsLicenses = licenses: evaluateProperty (x: lib.lists.elem x licenses) false;
containsLicenses = licenses: evaluateProperty (x: elem x licenses) false;
/**
Convert a license expression to an SPDX license expression string.
lib/licenses/licenses.nix
+27 -20
View File
@@ -204,8 +204,8 @@ lib.mapAttrs mkLicense (
};
bola11 = {
url = "https://blitiri.com.ar/p/bola/";
fullName = "Buena Onda License Agreement 1.1";
spdxId = "BOLA-1.1";
fullName = "Buena Onda License Agreement v1.1";
};
boost = {
@@ -326,8 +326,8 @@ lib.mapAttrs mkLicense (
};
capec = {
fullName = "Common Attack Pattern Enumeration and Classification";
url = "https://capec.mitre.org/about/termsofuse.html";
fullName = "Common Attack Pattern Enumeration and Classification License";
spdxId = "CAPEC-tou";
};
clArtistic = {
@@ -475,6 +475,11 @@ lib.mapAttrs mkLicense (
fullName = "CeCILL-C Free Software License Agreement";
};
cfitsio = {
spdxId = "CFITSIO";
fullName = "CFITSIO License";
};
classpathException20 = {
spdxId = "Classpath-exception-2.0";
fullName = "Classpath exception 2.0";
@@ -527,6 +532,11 @@ lib.mapAttrs mkLicense (
fullName = "DOC License";
};
docBookDtd = {
spdxId = "DocBook-DTD";
fullName = "DocBook DTD License";
};
drl10 = {
spdxId = "DRL-1.0";
fullName = "Detection Rule License 1.0";
@@ -755,14 +765,7 @@ lib.mapAttrs mkLicense (
hpndSellVariantSafetyClause = {
fullName = "HPND - sell variant with safety critical systems clause";
url = "https://gitlab.freedesktop.org/xorg/driver/xf86-video-voodoo/-/blob/68a5b6d98ae34749cca889f4373b4043d00bfe6a/src/voodoo_dga.c#L12-33";
# TODO: if the license gets accepted to spdx then
# add spdxId
# else
# remove license
# && replace reference with whatever this license is supposed to be then
# https://github.com/spdx/license-list-XML/issues/2922
# spdxId = "HPND-sell-variant-safety-clause";
spdxId = "HPND-sell-variant-critical-systems";
};
hpndDec = {
@@ -865,6 +868,12 @@ lib.mapAttrs mkLicense (
fullName = "ISC License";
};
json = {
spdxId = "JSON";
fullName = "JSON License";
free = false;
};
databricks = {
fullName = "Databricks License";
url = "https://www.databricks.com/legal/db-license";
@@ -1246,8 +1255,8 @@ lib.mapAttrs mkLicense (
};
paratype = {
fullName = "ParaType Free Font Licensing Agreement";
url = "https://web.archive.org/web/20161209023955/http://www.paratype.ru/public/pt_openlicense_eng.asp";
spdxId = "ParaType-Free-Font-1.3";
fullName = "ParaType Free Font Licensing Agreement v1.3";
};
parity70 = {
@@ -1326,7 +1335,8 @@ lib.mapAttrs mkLicense (
# Gentoo seems to treat it as a license:
# https://gitweb.gentoo.org/repo/gentoo.git/tree/licenses/SGMLUG?id=7d999af4a47bf55e53e54713d98d145f935935c1
sgmlug = {
fullName = "SGML UG SGML Parser Materials license";
spdxId = "SGMLUG-PM";
fullName = "SGMLUG Parser Materials License";
};
sissl11 = {
@@ -1423,11 +1433,8 @@ lib.mapAttrs mkLicense (
};
tekHvcLicense = {
spdxId = "TekHVC";
fullName = "TekHVC License";
url = "https://gitlab.freedesktop.org/xorg/lib/libx11/-/blob/7f8305c779ac6948d7261764f5ffb8ae9aa975b1/COPYING#L138-171";
# TODO: add spdxId when it gets accepted to spdx
# https://tools.spdx.org/app/license_requests/458
# https://github.com/spdx/license-list-XML/issues/2757
};
torque11 = {
@@ -1448,8 +1455,8 @@ lib.mapAttrs mkLicense (
};
tost = {
spdxId = "Pixar";
fullName = "Tomorrow Open Source Technology License 1.0";
url = "https://github.com/PixarAnimationStudios/OpenUSD/blob/release/LICENSE.txt";
};
ubdlException = {
lib/modules.nix
+29 -9
View File
@@ -589,7 +589,8 @@ let
in
modulesPath: initialModules: args: {
modules = filterModules modulesPath (collectStructuredModules unknownModule "" initialModules args);
# Intentionally not shared with `modules` above: this allows `collected`
# Intentionally not shared with `modules` above: this allows
# the return value of `collectStructuredModules`
# to be garbage collected after `filterModules` returns.
graph = toGraph modulesPath (collectStructuredModules unknownModule "" initialModules args);
};
@@ -1432,18 +1433,27 @@ let
filterOverrides = defs: (filterOverrides' defs).values;
filterOverrides' =
defs:
let
getPrio =
def: if def.value._type or "" == "override" then def.value.priority else defaultOverridePriority;
highestPrio = foldl' (prio: def: min (getPrio def) prio) 9999 defs;
strip =
def: if def.value._type or "" == "override" then def // { value = def.value.content; } else def;
in
{
values = map strip (filter (def: getPrio def == highestPrio) defs);
inherit highestPrio;
};
defs:
# Optimize for the singleton case, equivalent to the `else` clause.
if length defs == 1 then
{
values = map strip defs;
highestPrio = getPrio (head defs);
}
else
let
highestPrio = foldl' (prio: def: min (getPrio def) prio) 9999 defs;
in
{
values = concatMap (def: if getPrio def == highestPrio then [ (strip def) ] else [ ]) defs;
inherit highestPrio;
};
/**
Sort a list of properties. The sort priority of a property is
@@ -1716,11 +1726,21 @@ let
`from`
: 1\. Function argument
: The "from" option path as list of strings.
Option must not exist in the current module set.
`to`
: 2\. Function argument
: The "to" option path as list of strings.
Option must already exist in the current module set.
# Limitations
- The "to" option must already be declared.
- The "from" option should not be declared, as this function will declare it.
- "to" Options whose types don't support merging at any level of their structure (like `types.raw`,
or `types.attrsOf types.raw` where the attribute values can't merge) are not well-supported
because this function wraps aliased definitions in `mkMerge`.
*/
mkRenamedOptionModule =
from: to:
lib/strings.nix
+1 -2
View File
@@ -337,7 +337,6 @@ rec {
/**
Concatenate a list of strings, adding a newline at the end of each one.
Defined as `concatMapStrings (s: s + "\n")`.
# Inputs
@@ -361,7 +360,7 @@ rec {
:::
*/
concatLines = concatMapStrings (s: s + "\n");
concatLines = lines: optionalString (lines != [ ]) (concatStringsSep "\n" lines + "\n");
/**
Given string `s`, replace every occurrence of the string `from` with the string `to`.
lib/systems/default.nix
+28 -16
View File
@@ -3,9 +3,7 @@
let
inherit (lib)
any
attrNames
filter
foldl
foldl'
hasInfix
isAttrs
isList
@@ -35,17 +33,31 @@ let
compare the value with a reconstruction of itself, e.g. with `f == a: f a`,
or perhaps calling `elaborate` twice, and one will see reflexivity fail as described.
Hence a custom equality test.
To solve this, the elaborated systems also store a version of their data
without any functions to be compared.
Note that this does not canonicalize the systems, so you'll want to make sure
both arguments have been `elaborate`-d.
*/
equals =
let
# System attrs are never __functor-style attrsets, so builtins.isFunction suffices.
removeFunctions = a: removeAttrs a (filter (n: builtins.isFunction a.${n}) (attrNames a));
in
a: b: removeFunctions a == removeFunctions b;
equals = a: b: a._withoutFunctions == b._withoutFunctions;
/**
The attribute names within an elaborated system that store functions.
Due to object identity semantics, `systems.equals` needs a way to compare
all non-function attributes. It does this by storing a version of itself
without any functions under the attribute name `_withoutFunctions`. The
attribute names that contain functions are exposed for regression testing.
*/
functionNames = [
"canExecute"
"emulator"
"emulatorAvailable"
"staticEmulatorAvailable"
];
# Avoiding infrec
ignoredNames = functionNames ++ [ "_withoutFunctions" ];
/**
List of all Nix system doubles the nixpkgs flake will expose the package set
@@ -73,11 +85,12 @@ let
let
allArgs = systemToAttrs systemOrArgs;
# Those two will always be derived from "config", if given, so they should NOT
# be overridden further down with "// args".
# These attributes are derived from other inputs, so they should NOT be
# overridden further down with "// args".
args = removeAttrs allArgs [
"parsed"
"system"
"_withoutFunctions"
];
# TODO: deprecate args.rustc in favour of args.rust after 23.05 is EOL.
@@ -107,6 +120,7 @@ let
null;
final = {
_withoutFunctions = removeAttrs final ignoredNames;
# Prefer to parse `config` as it is strictly more informative.
parsed = parse.mkSystemFromString (args.config or allArgs.system);
# This can be losslessly-extracted from `parsed` iff parsing succeeds.
@@ -131,9 +145,6 @@ let
)
);
isCompatible =
_:
throw "2022-05-23: isCompatible has been removed in favor of canExecute, refer to the 22.11 changelog for details";
# Derived meta-data
useLLVM = final.isFreeBSD || final.isOpenBSD;
@@ -682,7 +693,7 @@ let
};
in
assert final.useAndroidPrebuilt -> final.isAndroid;
assert foldl (pass: { assertion, message }: if assertion final then pass else throw message) true (
assert foldl' (pass: { assertion, message }: if assertion final then pass else throw message) true (
final.parsed.abi.assertions or [ ]
);
final;
@@ -698,6 +709,7 @@ in
equals
examples
flakeExposed
functionNames
inspect
parse
platforms
lib/tests/systems.nix
+72 -32
View File
@@ -226,10 +226,22 @@ lib.runTests (
expr = toLosslessStringMaybe (lib.systems.elaborate "x86_64-linux");
expected = "x86_64-linux";
};
test_toLosslessStringMaybe_fail = {
expr = toLosslessStringMaybe (lib.systems.elaborate "x86_64-linux" // { something = "extra"; });
expected = null;
};
test_toLosslessStringMaybe_fail = (
let
baseSystem = lib.systems.elaborate "x86_64-linux";
in
{
expr = toLosslessStringMaybe (
baseSystem
// {
_withoutFunctions = baseSystem._withoutFunctions // {
something = "extra";
};
}
);
expected = null;
}
);
test_elaborate_config_over_system = {
expr =
(lib.systems.elaborate {
@@ -254,37 +266,65 @@ lib.runTests (
}).parsed.cpu.arch;
expected = "i686";
};
test_equals_reelaborate_overridden_platform = {
expr =
let
base = lib.systems.elaborate "x86_64-linux";
in
lib.systems.equals base (
lib.systems.elaborate (
base
// {
useLLVM = true;
linker = "lld";
}
)
);
expected = false;
};
}
// {
# equals.functionNames must list exactly the function-valued attrs of an
# elaborated system, so that _withoutFunctions stays correct without
# iterating.
test_equals_functionNames_in_sync =
let
sys = lib.systems.elaborate "x86_64-linux";
actual = lib.filter (n: builtins.isFunction sys.${n}) (builtins.attrNames sys);
expected = lib.sort lib.lessThan lib.systems.functionNames;
in
{
expr = lib.sort lib.lessThan actual;
inherit expected;
};
}
# Generate test cases to assert that a change in any non-function attribute makes a platform unequal
//
lib.concatMapAttrs
(platformAttrName: origValue: {
// (
let
# arbitrary choice, just to get all the elaborated attrNames
baseSystem = lib.systems.elaborate "x86_64-linux";
in
lib.concatMapAttrs (platformAttrName: origValue: {
${"test_equals_unequal_${platformAttrName}"} =
let
# lib.systems.equals only checks the subattrset
modified =
assert origValue != arbitraryValue;
baseSystem
// {
_withoutFunctions = baseSystem._withoutFunctions // {
${platformAttrName} = arbitraryValue;
};
};
arbitraryValue = x: "<<modified>>";
in
{
expr = lib.systems.equals baseSystem modified;
expected = false;
};
${"test_equals_unequal_${platformAttrName}"} =
let
modified =
assert origValue != arbitraryValue;
lib.systems.elaborate "x86_64-linux" // { ${platformAttrName} = arbitraryValue; };
arbitraryValue = x: "<<modified>>";
in
{
expr = lib.systems.equals (lib.systems.elaborate "x86_64-linux") modified;
expected =
{
# Changes in these attrs are not detectable because they're function.
# The functions should be derived from the data, so this is not a problem.
canExecute = null;
emulator = null;
emulatorAvailable = null;
staticEmulatorAvailable = null;
isCompatible = null;
} ? ${platformAttrName};
};
})
(
lib.systems.elaborate "x86_64-linux" # arbitrary choice, just to get all the elaborated attrNames
)
}) baseSystem
)
)
lib/trivial.nix
+21 -13
View File
@@ -7,14 +7,16 @@ let
functionArgs
pathExists
release
setFunctionArgs
toBaseDigits
version
versionSuffix
warn
;
inherit (lib)
foldr
fromJSON
isString
readFile
;
in
{
@@ -789,7 +791,7 @@ in
importJSON :: Path -> Any
```
*/
importJSON = path: builtins.fromJSON (builtins.readFile path);
importJSON = path: fromJSON (readFile path);
/**
Reads a TOML file.
@@ -836,7 +838,7 @@ in
importTOML :: Path -> Any
```
*/
importTOML = path: fromTOML (builtins.readFile path);
importTOML = path: fromTOML (readFile path);
/**
`warn` *`message`* *`value`*
@@ -1046,7 +1048,7 @@ in
info = msg: builtins.trace "INFO: ${msg}";
showWarnings = warnings: res: lib.foldr (w: x: warn w x) res warnings;
showWarnings = warnings: res: foldr warn res warnings;
## Function annotations
@@ -1101,11 +1103,10 @@ in
```
*/
functionArgs =
f:
if f ? __functor then
f.__functionArgs or (functionArgs (f.__functor f))
else
builtins.functionArgs f;
let
functionArgs = builtins.functionArgs;
in
f: if f ? __functor then f.__functionArgs or (functionArgs (f.__functor f)) else functionArgs f;
/**
Check whether something is a function or something
@@ -1123,7 +1124,11 @@ in
isFunction : Any -> Bool
```
*/
isFunction = f: builtins.isFunction f || (f ? __functor && isFunction (f.__functor f));
isFunction =
let
isFunction = builtins.isFunction;
in
f: isFunction f || (f ? __functor && isFunction (f.__functor f));
/**
`mirrorFunctionArgs f g` creates a new function `g'` with the same behavior as `g` (`g' x == g x`)
@@ -1174,7 +1179,10 @@ in
let
fArgs = functionArgs f;
in
g: setFunctionArgs g fArgs;
g: {
__functor = self: g;
__functionArgs = fArgs;
};
/**
Turns any non-callable values into constant functions.
@@ -1322,11 +1330,11 @@ in
r = i - ((i / base) * base);
q = (i - r) / base;
in
[ r ] ++ go q;
go q ++ [ r ];
in
assert (isInt base);
assert (isInt i);
assert (base >= 2);
assert (i >= 0);
lib.reverseList (go i);
go i;
}
lib/types.nix
+43 -43
View File
@@ -4,8 +4,11 @@
let
inherit (lib)
all
elem
flip
hasContext
functionArgs
isAttrs
isBool
isDerivation
@@ -13,8 +16,10 @@ let
isFunction
isInt
isList
isString
isPath
isStorePath
isString
substring
throwIf
toDerivation
toList
@@ -22,7 +27,6 @@ let
;
inherit (lib.lists)
concatLists
count
elemAt
filter
foldl'
@@ -72,6 +76,7 @@ let
unions
empty
;
inherit (lib.path) hasStorePathPrefix;
inAttrPosSuffix =
v: name:
@@ -107,10 +112,15 @@ let
checkDefsForError =
check: loc: defs:
let
invalidDefs = filter (def: !check def.value) defs;
in
if invalidDefs != [ ] then { message = "Definition values: ${showDefs invalidDefs}"; } else null;
if all (def: check def.value) defs then
null
else
let
invalidDefs = filter (def: !check def.value) defs;
in
{
message = "Definition values: ${showDefs invalidDefs}";
};
# Check that a type with v2 merge has a coherent check attribute.
# Throws an error if the type uses an ad-hoc `type // { check }` override.
@@ -491,8 +501,8 @@ rec {
};
u8 = unsign 8 256;
u16 = unsign 16 65536;
# the biggest int Nix accepts is 2^63 - 1 (9223372036854775808)
# the smallest int Nix accepts is -2^63 (-9223372036854775807)
# the biggest int Nix accepts is 2^63 - 1 (9223372036854775807)
# the smallest int Nix accepts is -2^63 (-9223372036854775808)
u32 = unsign 32 4294967296;
# u64 = unsign 64 18446744073709551616;
@@ -653,10 +663,7 @@ rec {
let
res = mergeOneOption loc defs;
in
if builtins.isPath res || (builtins.isString res && !builtins.hasContext res) then
toDerivation res
else
res;
if isPath res || (isString res && !hasContext res) then toDerivation res else res;
};
shellPackage = package // {
@@ -714,15 +721,15 @@ rec {
check =
x:
let
isInStore = lib.path.hasStorePathPrefix (
if builtins.isPath x then
isInStore = hasStorePathPrefix (
if isPath x then
x
# Discarding string context is necessary to convert the value to
# a path and safe as the result is never used in any derivation.
else
/. + builtins.unsafeDiscardStringContext x
);
isAbsolute = builtins.substring 0 1 (toString x) == "/";
isAbsolute = substring 0 1 (toString x) == "/";
isExpectedType = (
if inStore == null || inStore then isStringLike x else isString x # Do not allow a true path, which could be copied to the store later on.
);
@@ -1078,14 +1085,14 @@ rec {
merge =
loc: defs:
let
nrNulls = count (def: def.value == null) defs;
nulls = filter (def: def.value == null) defs;
in
if nrNulls == length defs then
if nulls == [ ] then
elemType.merge loc defs
else if length nulls == length defs then
null
else if nrNulls != 0 then
throw "The option `${showOption loc}` is defined both null and not null, in ${showFiles (getFiles defs)}."
else
elemType.merge loc defs;
throw "The option `${showOption loc}` is defined both null and not null, in ${showFiles (getFiles defs)}.";
emptyValue = {
value = null;
};
@@ -1109,9 +1116,7 @@ rec {
check = isFunction;
merge = loc: defs: {
# An argument attribute has a default when it has a default in all definitions
__functionArgs = lib.zipAttrsWith (_: lib.all (x: x)) (
lib.map (fn: lib.functionArgs fn.value) defs
);
__functionArgs = zipAttrsWith (_: all (x: x)) (map (fn: functionArgs fn.value) defs);
__functor =
_: callerArgs:
(mergeDefinitions (loc ++ [ "<function body>" ]) elemType (
@@ -1513,11 +1518,11 @@ rec {
self: loc: defs:
(self.v2 { inherit loc defs; }).value;
v2 =
{ loc, defs }:
{ loc, defs }@args:
let
t1CheckedAndMerged =
if t1.merge ? v2 then
checkV2MergeCoherence loc t1 (t1.merge.v2 { inherit loc defs; })
checkV2MergeCoherence loc t1 (t1.merge.v2 args)
else
{
value = t1.merge loc defs;
@@ -1526,7 +1531,7 @@ rec {
};
t2CheckedAndMerged =
if t2.merge ? v2 then
checkV2MergeCoherence loc t2 (t2.merge.v2 { inherit loc defs; })
checkV2MergeCoherence loc t2 (t2.merge.v2 args)
else
{
value = t2.merge loc defs;
@@ -1560,7 +1565,7 @@ rec {
typeMerge =
f':
let
mt1 = t1.typeMerge (elemAt f'.payload.elemType 0).functor;
mt1 = t1.typeMerge (head f'.payload.elemType).functor;
mt2 = t2.typeMerge (elemAt f'.payload.elemType 1).functor;
in
if (name == f'.name) && (mt1 != null) && (mt2 != null) then functor.type mt1 mt2 else null;
@@ -1580,9 +1585,8 @@ rec {
let
head' =
if ts == [ ] then throw "types.oneOf needs to get at least one type in its argument" else head ts;
tail' = tail ts;
in
foldl' either head' tail';
foldl' either head' (tail ts);
# Either value of type `coercedType` or `finalType`, the former is
# converted to `finalType` using `coerceFunc`.
@@ -1613,19 +1617,15 @@ rec {
def
// {
value =
let
merged =
if coercedType.merge ? v2 then
checkV2MergeCoherence loc coercedType (
coercedType.merge.v2 {
inherit loc;
defs = [ def ];
}
)
else
null;
in
if coercedType.merge ? v2 then
let
merged = checkV2MergeCoherence loc coercedType (
coercedType.merge.v2 {
inherit loc;
defs = [ def ];
}
);
in
if merged.headError == null then coerceFunc def.value else def.value
else if coercedType.check def.value then
coerceFunc def.value
@@ -1683,9 +1683,9 @@ rec {
self: loc: defs:
(self.v2 { inherit loc defs; }).value;
v2 =
{ loc, defs }:
{ loc, defs }@args:
let
orig = checkV2MergeCoherence loc elemType (elemType.merge.v2 { inherit loc defs; });
orig = checkV2MergeCoherence loc elemType (elemType.merge.v2 args);
headError' = if orig.headError != null then orig.headError else checkDefsForError check loc defs;
in
orig
maintainers/github-teams.json
+2 -1
View File
@@ -292,7 +292,6 @@
"mdarocha": 11572618
},
"members": {
"GGG-KILLER": 5892127,
"IvarWithoutBones": 41924494,
"JamieMagee": 1358764,
"anpin": 6060545,
@@ -592,6 +591,8 @@
"7c6f434c": 1891350,
"Shados": 338268,
"khaneliman": 1778670,
"lolbinarycat": 19915050,
"mrcjkb": 12857160,
"spencerpogo": 34356756
},
"name": "lua"
maintainers/maintainer-list.nix
+293 -117
View File
@@ -862,6 +862,13 @@
githubId = 209175;
name = "Alesya Huzik";
};
Ai-Ya-Ya = {
email = "spg2500@gmail.com";
github = "Ai-Ya-Ya";
githubId = 72513839;
matrix = "aiya:catgirl.cloud";
name = "aiya";
};
aij = {
email = "aij+git@mrph.org";
github = "aij";
@@ -1796,6 +1803,12 @@
matrix = "@andrewzah:matrix.abare.party";
keys = [ { fingerprint = "D87B D9DC F11B ACD6 CDB4 0CB2 1373 2FB1 3E61 E0BE"; } ];
};
andrinoff = {
name = "Drew Smirnoff";
email = "me@andrinoff.com";
github = "andrinoff";
githubId = 175145001;
};
Andy3153 = {
name = "Andrei Dobrete";
email = "andy3153@protonmail.com";
@@ -1839,13 +1852,6 @@
githubId = 102513;
keys = [ { fingerprint = "B7B7 582E 564E 789B FCB8 71AB 0C6D FE2F B234 534A"; } ];
};
anhdle14 = {
name = "Le Anh Duc";
email = "anhdle14@icloud.com";
github = "anhdle14";
githubId = 9645992;
keys = [ { fingerprint = "AA4B 8EC3 F971 D350 482E 4E20 0299 AFF9 ECBB 5169"; } ];
};
anhduy = {
email = "vo@anhduy.io";
github = "voanhduy1512";
@@ -1961,12 +1967,6 @@
githubId = 14838767;
name = "Jacopo Scannella";
};
antoinerg = {
email = "roygobeil.antoine@gmail.com";
github = "antoinerg";
githubId = 301546;
name = "Antoine Roy-Gobeil";
};
anton-4 = {
name = "Anton";
github = "Anton-4";
@@ -2329,6 +2329,13 @@
githubId = 14922630;
name = "Richard Smith";
};
artifycz = {
email = "richard@tichy.io";
github = "ArtifyCZ";
githubId = 57506608;
matrix = "@artify:artify.zone";
name = "Richard Tichy";
};
artturin = {
email = "artturin@artturin.com";
matrix = "@artturin:matrix.org";
@@ -2454,6 +2461,12 @@
name = "Mariia Holovata";
keys = [ { fingerprint = "409D 201E 9450 8732 A49E D0FC 6BDA F874 0068 08DF"; } ];
};
asimpson = {
email = "adam@adamsimpson.net";
github = "asimpson";
githubId = 1048831;
name = "Adam Simpson";
};
asininemonkey = {
email = "nixpkgs@asininemonkey.com";
github = "asininemonkey";
@@ -2783,6 +2796,12 @@
github = "aware70";
githubId = 7832566;
};
awildleon = {
name = "Leon Hubrich";
github = "AWildLeon";
githubId = 114652332;
email = "git@leon-hubrich.de";
};
axertheaxe = {
email = "axertheaxe@proton.me";
github = "AxerTheAxe";
@@ -2881,6 +2900,12 @@
name = "Fabian Möller";
keys = [ { fingerprint = "6309 E212 29D4 DA30 AF24 BDED 754B 5C09 63C4 2C50"; } ];
};
baba = {
name = "Baba";
email = "babakinha@proton.me";
github = "Babakinha";
githubId = 59146844;
};
babbaj = {
name = "babbaj";
email = "babbaj45@gmail.com";
@@ -4430,12 +4455,6 @@
githubId = 289492;
name = "Philip Horger";
};
candeira = {
email = "javier@candeira.com";
github = "candeira";
githubId = 91694;
name = "Javier Candeira";
};
caniko = {
email = "gpg@rotas.mozmail.com";
github = "caniko";
@@ -4530,6 +4549,12 @@
githubId = 1945;
name = "Casey Rodarmor";
};
caseyavila = {
email = "casey@theavilas.org";
github = "caseyavila";
githubId = 53847249;
name = "Casey Avila";
};
catap = {
email = "kirill@korins.ky";
github = "catap";
@@ -4597,6 +4622,12 @@
githubId = 9086315;
name = "Connor Brewster";
};
cbrxyz = {
email = "me@cbrxyz.com";
github = "cbrxyz";
githubId = 52760912;
name = "Cameron Brown";
};
ccellado = {
email = "annplague@gmail.com";
github = "ccellado";
@@ -4815,11 +4846,6 @@
githubId = 18648043;
name = "Daniel Cartwright";
};
chewblacka = {
github = "chewblacka";
githubId = 18430320;
name = "John Garcia";
};
Chili-Man = {
email = "dr.elhombrechile@gmail.com";
name = "Diego Rodriguez";
@@ -5520,6 +5546,12 @@
githubId = 32609395;
name = "B YI";
};
coolcuber = {
email = "rpgeorg@clemson.edu";
github = "coolcuber";
githubId = 35880825;
name = "Ross George";
};
coolGi = {
email = "me@coolgi.dev";
github = "coolGi69";
@@ -5571,6 +5603,11 @@
githubId = 1573344;
name = "Andrey Pavlov";
};
couldbemathijs = {
github = "couldbemathijs";
githubId = 79464596;
name = "couldbemathijs";
};
cpages = {
email = "page@ruiec.cat";
github = "cpages";
@@ -6285,12 +6322,6 @@
githubId = 4347318;
email = "davinci42.cn@gmail.com";
};
davisrichard437 = {
email = "davisrichard437@gmail.com";
github = "davisrichard437";
githubId = 85075437;
name = "Richard Davis";
};
davorb = {
email = "davor@davor.se";
github = "davorb";
@@ -6940,12 +6971,6 @@
githubId = 40633781;
name = "Sergei S.";
};
dit7ya = {
email = "7rat13@gmail.com";
github = "dit7ya";
githubId = 14034137;
name = "Mostly Void";
};
ditsuke = {
name = "Tushar";
email = "hello@ditsuke.com";
@@ -7971,12 +7996,6 @@
github = "EmanuelM153";
githubId = 134736553;
};
emattiza = {
email = "nix@mattiza.dev";
github = "emattiza";
githubId = 11719476;
name = "Evan Mattiza";
};
embr = {
email = "hi@liclac.eu";
github = "liclac";
@@ -8499,9 +8518,9 @@
email = "evysgarden@protonmail.com";
};
ewok = {
email = "ewok@ewok.ru";
github = "ewok-old";
githubId = 454695;
email = "github@in.ewok.email";
github = "ewok";
githubId = 125148819;
name = "Artur Taranchiev";
};
ewuuwe = {
@@ -9211,6 +9230,12 @@
githubId = 119691;
name = "Michael Gough";
};
fraioveio = {
email = "francesco@vecchia.lol";
github = "FraioVeio";
githubId = 181361445;
name = "Francesco Vecchia";
};
franciscod = {
github = "franciscod";
githubId = 726447;
@@ -9467,6 +9492,11 @@
name = "Faye Chun";
keys = [ { fingerprint = "ACB8 DB1F E88D A908 6332 BDB1 5A71 B010 2FD7 3FC0"; } ];
};
fxai = {
github = "fxai";
githubId = 44463990;
name = "fxai";
};
fxfactorial = {
email = "edgar.factorial@gmail.com";
github = "fxfactorial";
@@ -11156,13 +11186,6 @@
githubId = 2332070;
name = "Serge Baltic";
};
hyshka = {
name = "Bryan Hyshka";
email = "bryan@hyshka.com";
github = "hyshka";
githubId = 2090758;
keys = [ { fingerprint = "24F4 1925 28C4 8797 E539 F247 DB2D 93D1 BFAA A6EA"; } ];
};
hythera = {
name = "Hythera";
github = "Hythera";
@@ -11236,6 +11259,12 @@
githubId = 1031119;
name = "Ian-Woo Kim";
};
ibbem = {
name = "ibbem";
github = "ibbem";
githubId = 61984399;
email = "ibbem@ibbem.net";
};
ibizaman = {
email = "ibizapeanut@gmail.com";
github = "ibizaman";
@@ -11333,6 +11362,12 @@
githubId = 12570166;
name = "Igor Ramazanov";
};
igorcafe = {
email = "igoracmelo@protonmail.com";
github = "igorcafe";
githubId = 85039990;
name = "Igor Melo";
};
igsha = {
email = "igor.sharonov@gmail.com";
github = "igsha";
@@ -11528,6 +11563,13 @@
name = "Noah Fontes";
keys = [ { fingerprint = "F5B2 BE1B 9AAD 98FE 2916 5597 3665 FFF7 9D38 7BAA"; } ];
};
implr = {
email = "bartoszstebel@gmail.com";
matrix = "@implr:hackerspace.pl";
github = "implr";
githubId = 2821175;
name = "Bartosz Stebel";
};
imrying = {
email = "philiprying@gmail.com";
github = "imrying";
@@ -11615,6 +11657,12 @@
name = "Silvan Mosberger";
keys = [ { fingerprint = "6C2B 55D4 4E04 8266 6B7D DA1A 422E 9EDA E015 7170"; } ];
};
iniw = {
email = "git@vini.cat";
github = "iniw";
githubId = 30220881;
name = "Vinicius Deolindo";
};
insipx = {
email = "github@andrewplaza.dev";
github = "insipx";
@@ -11898,6 +11946,11 @@
github = "j0xaf";
githubId = 932697;
};
j10ccc = {
name = "popWheat";
github = "j10ccc";
githubId = 49830650;
};
j1nxie = {
email = "rylie@rylie.moe";
name = "Nguyen Pham Quoc An";
@@ -12581,7 +12634,7 @@
};
jfly = {
name = "Jeremy Fleischman";
email = "jeremyfleischman@gmail.com";
email = "me@jfly.fyi";
github = "jfly";
githubId = 277474;
keys = [ { fingerprint = "F1F1 3395 8E8E 9CC4 D9FC 9647 1931 9CD8 416A 642B"; } ];
@@ -13090,6 +13143,13 @@
githubId = 168684553;
name = "João Marques";
};
joibel = {
email = "alan@clucas.org";
github = "Joibel";
githubId = 1827156;
name = "Alan Clucas";
keys = [ { fingerprint = "EBE6 85B9 4904 22E1 EC94 7B17 79C7 9CBD BAF6 4C13"; } ];
};
joinemm = {
email = "joonas@rautiola.co";
github = "joinemm";
@@ -14029,13 +14089,6 @@
github = "keller00";
githubId = 8452750;
};
kennyballou = {
email = "kb@devnulllabs.io";
github = "kennyballou";
githubId = 2186188;
name = "Kenny Ballou";
keys = [ { fingerprint = "932F 3E8E 1C0F 4A98 95D7 B8B8 B0CA A28A 0295 8308"; } ];
};
kenran = {
email = "johannes.maier@mailbox.org";
github = "kenranunderscore";
@@ -16012,6 +16065,12 @@
githubId = 83420438;
name = "Lewis";
};
luc65r = {
email = "lucas@ransan.fr";
github = "luc65r";
githubId = 59375051;
name = "Lucas Ransan";
};
LucaGuerra = {
email = "luca@guerra.sh";
github = "LucaGuerra";
@@ -16287,6 +16346,11 @@
githubId = 208297;
name = "Luz";
};
lvanasse = {
github = "lvanasse";
githubId = 12837376;
name = "Ludovic Vanasse";
};
lwb-2021 = {
email = "lwb-2021@qq.com";
github = "lwb-2021";
@@ -16828,6 +16892,18 @@
githubId = 20665331;
name = "Mark";
};
Marker06 = {
email = "linuxenjoyerfi@proton.me";
github = "Marker06";
githubId = 148945811;
name = "Marcus";
matrix = "@marker06:matrix.org";
};
markhakansson = {
name = "Mark Håkansson";
github = "markhakansson";
githubId = 44841869;
};
markus1189 = {
email = "markus1189@gmail.com";
github = "markus1189";
@@ -18264,12 +18340,6 @@
githubId = 104795;
name = "Marek Mahut";
};
mmai = {
email = "henri.bourcereau@gmail.com";
github = "mmai";
githubId = 117842;
name = "Henri Bourcereau";
};
mmesch = {
github = "MMesch";
githubId = 2597803;
@@ -18893,6 +18963,11 @@
githubId = 13910387;
keys = [ { fingerprint = "086E EF20 D54E D348 E5BA 6263 16E9 43E6 596F FB4E"; } ];
};
myul = {
github = "myul";
githubId = 27887735;
name = "myul";
};
myypo = {
email = "nikirsmcgl@gmail.com";
github = "myypo";
@@ -19021,12 +19096,6 @@
github = "nagymathev";
githubId = 49335802;
};
naho = {
github = "trueNAHO";
githubId = 90870942;
name = "Noah Pierre Biewesch";
keys = [ { fingerprint = "5FC6 088A FB1A 609D 4532 F919 0C1C 177B 3B64 68E0"; } ];
};
nalbyuites = {
email = "ashijit007@gmail.com";
github = "nalbyuites";
@@ -19066,6 +19135,12 @@
{ fingerprint = "5A1D C7CE 51DC 0A85 6DEA 41F7 31A8 CE0D 2E7D 30C3"; }
];
};
naomieow = {
name = "Naomi Roberts";
email = "mia@naomieow.xyz";
github = "naomieow";
githubId = 79906167;
};
naora = {
name = "Joris Gundermann";
email = "jorisgundermann@gmail.com";
@@ -19470,6 +19545,11 @@
githubId = 10180857;
name = "Anmol Sethi";
};
nhshah15 = {
github = "nhshah15";
githubId = 31825306;
name = "Neil Shah";
};
ni5arga = {
email = "hello@ni5arga.com";
github = "ni5arga";
@@ -19781,6 +19861,12 @@
name = "nixbitcoindev";
keys = [ { fingerprint = "577A 3452 7F3E 2A85 E80F E164 DD11 F9AD 5308 B3BA"; } ];
};
nixosclaw = {
email = "github@nixclaw.io";
github = "nixosclaw";
githubId = 283803283;
name = "NixClaw";
};
nixy = {
email = "nixy@nixy.moe";
github = "nixy";
@@ -19835,6 +19921,13 @@
github = "Noah765";
githubId = 99338019;
};
noahbiewesch = {
github = "trueNAHO";
githubId = 90870942;
name = "Noah Biewesch";
email = "nix@noahbiewesch.com";
keys = [ { fingerprint = "5FC6 088A FB1A 609D 4532 F919 0C1C 177B 3B64 68E0"; } ];
};
noahfraiture = {
name = "Noahcode";
email = "pro@noahcode.dev";
@@ -19894,6 +19987,12 @@
name = "Alessio Caiazza";
matrix = "@alessio:caiazza.info";
};
nomadium = {
email = "miguel@miguel.cc";
github = "nomadium";
githubId = 79817;
name = "Miguel Landaeta";
};
nomaterials = {
email = "nomaterials@gmail.com";
github = "no-materials";
@@ -20125,9 +20224,6 @@
github = "nukdokplex";
githubId = 25458915;
name = "Viktor Titov";
keys = [
{ fingerprint = "7CE2 4C42 942D 58EA 99F6 F00A A47E 7374 3EF6 FCC4"; }
];
};
nullcube = {
email = "nullcub3@gmail.com";
@@ -20166,11 +20262,13 @@
github = "numinit";
githubId = 369111;
keys = [
# >=2025, stays in one place
# SSH
{ fingerprint = "XX/0lMz82MpucPqf0KG+5EJoozzNRi8i/t59byD2kNo"; }
# GPG, >=2025, stays in one place
{ fingerprint = "FD28 F9C9 81C5 D78E 56E8 8311 5C3E B94D 198F 1491"; }
# >=2025, travels with me
# GPG, >=2025, travels with me
{ fingerprint = "C48F 475F 30A9 B192 3213 D5D5 C6E2 4809 77B2 F2F4"; }
# <=2024
# GPG, <=2024
{ fingerprint = "190B DA97 F616 DE35 6899 ED17 F819 F1AF 2FC1 C1FF"; }
];
};
@@ -20438,7 +20536,7 @@
name = "Erik Timan";
};
olduser101 = {
email = "nathan.j.gill@outlook.com";
email = "n@ngill.net";
github = "OldUser101";
githubId = 64069240;
matrix = "@olduser101:matrix.org";
@@ -20957,6 +21055,12 @@
githubId = 79252025;
name = "Nicolas Benes";
};
panicrune = {
email = "panicrune@tutamail.com";
github = "panicrune";
githubId = 161863235;
name = "panicrune";
};
panky = {
email = "dev@pankajraghav.com";
github = "Panky-codes";
@@ -23062,6 +23166,13 @@
githubId = 4196789;
name = "Nathan Ringo";
};
remidupre = {
email = "remi+nixpkgs@dupre.io";
github = "remi-dupre";
githubId = 1173464;
name = "Rémi Dupré";
keys = [ { fingerprint = "4762 C65B F8D8 6A33 65C1 D10A 4613 02CD 1249 4653"; } ];
};
remix7531 = {
email = "remix7531@mailbox.org";
github = "remix7531";
@@ -23592,6 +23703,13 @@
githubId = 53882428;
name = "Erik Rodriguez";
};
roehrijn = {
email = "jan.roehrich@loft.sh";
github = "roehrijn";
githubId = 2474078;
name = "Jan Roehrich";
keys = [ { fingerprint = "21C1 F506 455E 95B4 EB39 D566 BAE1 2FF6 0C8A 97F2"; } ];
};
rogarb = {
email = "rogarb@rgarbage.fr";
github = "rogarb";
@@ -24286,6 +24404,12 @@
githubId = 12882091;
name = "Sam L. Yes";
};
samooyo = {
email = "samidarnaud@gmail.com";
github = "samooyo";
githubId = 46531012;
name = "Sami Darnaud";
};
samrose = {
email = "samuel.rose@gmail.com";
github = "samrose";
@@ -24714,12 +24838,6 @@
name = "Sebastian Rutofski";
keys = [ { fingerprint = "F1D4 8061 2830 3AF6 42DC 3867 C37F 3374 2A95 C547"; } ];
};
sebtm = {
email = "mail@sebastian-sellmeier.de";
github = "SebTM";
githubId = 17243347;
name = "Sebastian Sellmeier";
};
secona = {
email = "secona00+nixpkgs@gmail.com";
github = "secona";
@@ -25492,12 +25610,6 @@
githubId = 74881555;
name = "Fofanov Sergey";
};
sitaaax = {
email = "johannes@kle1n.com";
github = "SitAAAx";
githubId = 74413170;
name = "Johannes Klein";
};
sith-lord-vader = {
email = "nixpkgs@xpertsre.rocks";
github = "sith-lord-vader";
@@ -25559,6 +25671,11 @@
github = "skohtv";
githubId = 101289702;
};
skonotopov = {
name = "Sergey Konotopov";
github = "kinkou";
githubId = 931329;
};
skovati = {
github = "skovati";
githubId = 49844593;
@@ -26476,6 +26593,13 @@
github = "supermarin";
githubId = 627285;
};
Superredstone = {
email = "patrickcanal3@gmail.com";
matrix = "@superredstone:matrix.org";
github = "Superredstone";
githubId = 56410215;
name = "Patrick Canal";
};
SuperSandro2000 = {
email = "sandro.jaeckel@gmail.com";
matrix = "@sandro:supersandro.de";
@@ -26572,12 +26696,6 @@
githubId = 120188;
name = "Scott W. Dunlop";
};
sweber = {
email = "sweber2342+nixpkgs@gmail.com";
github = "sweber83";
githubId = 19905904;
name = "Simon Weber";
};
sweenu = {
name = "sweenu";
email = "contact@sweenu.xyz";
@@ -26836,12 +26954,6 @@
}
];
};
taliyahwebb = {
email = "taliyahmail@proton.me";
github = "taliyahwebb";
githubId = 161863235;
name = "Taliyah Webb";
};
talkara = {
email = "taito.horiuchi@relexsolutions.com";
github = "talkara";
@@ -27385,6 +27497,12 @@
githubId = 79593869;
name = "Gramdalf";
};
therealhammer = {
email = "thierry.hammer@googlemail.com";
github = "therealhammer";
githubId = 32392096;
name = "Thierry Hammer";
};
therealr5 = {
email = "rouven@rfive.de";
github = "rouven0";
@@ -28136,12 +28254,6 @@
githubId = 16036882;
name = "Thibault Gagnaux";
};
trino = {
email = "muehlhans.hubert@ekodia.de";
github = "hmuehlhans";
githubId = 9870613;
name = "Hubert Mühlhans";
};
tris203 = {
email = "admin@snappeh.com";
github = "tris203";
@@ -28274,6 +28386,12 @@
githubId = 303489;
name = "Manuel Bärenz";
};
TurnrDev = {
email = "jaynicholasturner@gmail.com";
github = "TurnrDev";
githubId = 11667059;
name = "Jay Turner";
};
tuxinaut = {
email = "trash4you@tuxinaut.de";
github = "tuxinaut";
@@ -28584,6 +28702,12 @@
github = "usrfriendly";
githubId = 2502060;
};
usu171 = {
email = "usu171@proton.me";
github = "Usu171";
githubId = 52230991;
name = "Usu171";
};
utdemir = {
email = "me@utdemir.com";
github = "utdemir";
@@ -28850,6 +28974,13 @@
githubId = 123554;
name = "Thibaut Smith";
};
viena = {
name = "Viena";
email = "theviena96@gmail.com";
github = "devnchill";
githubId = 169875752;
keys = [ { fingerprint = "BF79 8CD0 CA25 2106 99E1 ED9E F826 F032 DDDA 5560"; } ];
};
vieta = {
email = "vieta@4d2.org";
github = "yVieta";
@@ -28966,12 +29097,6 @@
githubId = 59029586;
name = "Vitor Pavan";
};
vizanto = {
email = "danny@prime.vc";
github = "vizanto";
githubId = 326263;
name = "Danny Wilson";
};
vizid = {
email = "mail@vizqq.cc";
github = "ViZiD";
@@ -29070,6 +29195,13 @@
githubId = 5604643;
name = "Mikhail Volkhov";
};
vollate = {
name = "Vollate";
email = "uint44t@gmail.com";
github = "vollate";
githubId = 90166078;
keys = [ { fingerprint = "A5B9 B2C5 8C04 DCB6 A157 566A 9CDF DE55 0783 E7BB"; } ];
};
vonfry = {
email = "nixos@vonfry.name";
github = "Vonfry";
@@ -29174,7 +29306,7 @@
name = "Johannes Mayrhofer";
};
vuks = {
email = "vuks@allthingslinux.org";
email = "vuks@vuks.dev";
github = "Vuks69";
githubId = 51289041;
name = "Vuks";
@@ -29202,6 +29334,11 @@
githubId = 115360611;
name = "Wölfchen";
};
w1lldu = {
name = "William Du";
github = "w1lldu";
githubId = 70287641;
};
waelwindows = {
email = "waelwindows9922@gmail.com";
github = "Waelwindows";
@@ -29241,6 +29378,14 @@
github = "wamserma";
githubId = 60148;
};
wanderer = {
name = "Martin Becze";
email = "martin@becze.org";
matrix = "@null_radix:matrix.org";
github = "wanderer";
githubId = 158211;
keys = [ { fingerprint = "82CB 91F4 F3E4 04A5 DAB2 78E8 8B99 1293 8FF2 1020"; } ];
};
wariuccio = {
name = "Wariuccio";
github = "wariuccio";
@@ -29500,6 +29645,12 @@
githubId = 5185341;
name = "Will Cohen";
};
WillemToorenburgh = {
email = "willemtoorenburgh@gmail.com";
github = "willemtoorenburgh";
githubId = 50425141;
name = "Willem Toorenburgh";
};
willfish = {
email = "willfish@pescado.mozmail.com";
github = "willfish";
@@ -29666,7 +29817,7 @@
wolfram444 = {
name = "Xabibulloh To'xtayev";
email = "kamiltox2006@gmail.com";
github = "woolfram444";
github = "wolfram444";
githubId = 109225370;
};
womeier = {
@@ -29735,6 +29886,12 @@
{ fingerprint = "34DB 8D31 F782 2B61 FF06 9503 8B5C 43DC 9105 2999"; }
];
};
wrench-exile-legacy = {
email = "user@wrench-exile-legacy.site";
github = "wrench-exile-legacy";
githubId = 280737824;
name = "wrench";
};
wrmilling = {
name = "Winston R. Milling";
email = "Winston@Milli.ng";
@@ -29955,6 +30112,12 @@
githubId = 5629059;
name = "Xavier Lambein";
};
xmnlz = {
name = "xmnlz";
github = "xmnlz";
githubId = 63904972;
email = "lemmeq9+nixos@gmail.com";
};
xnaveira = {
email = "xnaveira@gmail.com";
github = "xnaveira";
@@ -30329,6 +30492,12 @@
githubId = 7040031;
name = "Yannik Sander";
};
ysnt-yes = {
name = "Yes";
github = "ysnt-yes";
githubId = 85800291;
email = "yes@ysnt.live";
};
yuannan = {
email = "brandon@emergence.ltd";
github = "yuannan";
@@ -30773,6 +30942,13 @@
githubId = 873857;
name = "Zack Newman";
};
Zocker1999NET = {
github = "Zocker1999NET";
githubId = 1645646;
name = "Felix Stupp";
email = "felix.stupp@banananet.work";
keys = [ { fingerprint = "73D0 9948 B239 2D68 8A45 DC83 93E1 BD26 F6B0 2FB7"; } ];
};
zodman = {
github = "zodman";
githubId = 44167;
maintainers/scripts/haskell/test-configurations.nix
+3 -1
View File
@@ -6,7 +6,7 @@
and builds all derivations (or at least a reasonable subset) affected by
these overrides.
By default, it checks `configuration-{common,nix,ghc-9.8.x}.nix`. You can
By default, it checks `configuration-{common,nix,ghc-9.10.x}.nix`. You can
invoke it like this:
nix-build maintainers/scripts/haskell/test-configurations.nix --keep-going
@@ -55,6 +55,8 @@
nixpkgsPath ? ../../..,
config ? {
allowBroken = true;
# TODO(@sternenseemann): better way to workaround throw-ing aliases?
allowAliases = false;
},
skipEvalErrors ? true,
skipBinaryGHCs ? true,
maintainers/scripts/haskell/update-stackage.sh
+1 -5
View File
@@ -104,6 +104,7 @@ sed -r \
-e '/ hledger-lib /d' \
-e '/ hledger-ui /d' \
-e '/ hledger-web /d' \
-e '/ spacecookie /d' \
< "${tmpfile_new}" >> $stackage_config
# Explanations:
# cabal2nix, distribution-nixpkgs, jailbreak-cabal, language-nix: These are our packages and we know what we are doing.
@@ -111,9 +112,4 @@ sed -r \
# ShellCheck: latest version of command-line dev tool.
# Agda: The Agda community is fast-moving; we strive to always include the newest versions of Agda and the Agda packages in nixpkgs.
# Work around Stackage LTS including a bogus version of cassava which has been deprecated on Hackage.
# See <https://github.com/haskell-hvr/cassava/issues/248>.
# TODO(@sternenseemann): drop this once the situation has been resolved in Stackage LTS
sed -e 's/cassava ==0.5.5.0/cassava >= 0.5.4.0 && (> 0.5.5.0 || < 0.5.5.0) && < 0.6.0.0/' -i "$stackage_config"
echo "$old_version -> $version"
maintainers/scripts/luarocks-packages.csv
+2
View File
@@ -123,6 +123,8 @@ magick,,,,,5.1,donovanglover
markdown,,,,,,
md5,,,,,,
mediator_lua,,,,,,
mega.cmdparse,,,,,,
mega.logging,,,,,,
middleclass,,,,,,
mimetypes,,,,,,
mini.test,,,,,,
1 name rockspec ref server version luaversion maintainers
123 markdown
124 md5
125 mediator_lua
126 mega.cmdparse
127 mega.logging
128 middleclass
129 mimetypes
130 mini.test
maintainers/team-list.nix
+1 -1
View File
@@ -358,7 +358,6 @@ with lib.maintainers;
home-assistant = {
members = [
dotlambda
fab
hexa
];
scope = "Maintain the Home Assistant ecosystem";
@@ -436,6 +435,7 @@ with lib.maintainers;
libretro = {
members = [
aanderse
igorcafe
thiagokokada
];
scope = "Maintain Libretro, RetroArch and related packages.";
nixos/doc/manual/configuration/ad-hoc-network-config.section.md
+15 -5
View File
@@ -1,14 +1,24 @@
# Ad-Hoc Configuration {#ad-hoc-network-config}
You can use [](#opt-networking.localCommands) to
specify shell commands to be run at the end of `network-setup.service`. This
is useful for doing network configuration not covered by the existing NixOS
modules. For instance, to statically configure an IPv6 address:
You can use [](#opt-networking.localCommands) to specify shell commands to be
run after the network interfaces have been created, but not necessarily fully
configured.
This is useful for doing network configuration not covered by the existing
NixOS modules. For example, you can create a network namespace and a pair
of virtual ethernet devices like this:
```nix
{
networking.localCommands = ''
ip -6 addr add 2001:610:685:1::1/64 dev eth0
ip netns add mynet
ip link add name veth-in type veth peer name veth-out
ip link set dev veth-out netns mynet
'';
}
```
::: {.note}
The commands should ideally be idempotent, so it's recommended to perform
cleanups of the state you create (e.g. virtual interfaces), or at least make
sure possible failures are handled.
:::
nixos/doc/manual/configuration/ipv4-config.section.md
+10 -3
View File
@@ -26,9 +26,16 @@ servers:
```
::: {.note}
Statically configured interfaces are set up by the systemd service
`interface-name-cfg.service`. The default gateway and name server
configuration is performed by `network-setup.service`.
Addresses and routes for statically configured interfaces and the default
gateway are set up by systemd services named
`network-addresses-<interface>.service`. The name servers configuration,
instead, is performed by `network-local-commands.service` using resolvconf.
:::
::: {.note}
If needed, for example if addresses/routes were added/removed,
you can reset the network configuration by running
`systemctl restart networking-scripted.target`
:::
The host name is set using [](#opt-networking.hostName):
nixos/doc/manual/configuration/renaming-interfaces.section.md
+1 -1
View File
@@ -22,7 +22,7 @@ to `false`.
In case there are multiple interfaces of the same type, it's better to
assign custom names based on the device hardware address. For example,
we assign the name `wan` to the interface with MAC address
`52:54:00:12:01:01` using a netword link unit:
`52:54:00:12:01:01` using a network link unit:
```nix
{
nixos/doc/manual/default.nix
+3 -3
View File
@@ -250,17 +250,17 @@ rec {
</chapter>
</book>
'';
passAsFile = [ "doc" ];
__structuredAttrs = true;
}
''
# Generate the epub manual.
dst=$out/${common.outputPath}
xsltproc \
printf "%s" "$doc" | xsltproc \
--param chapter.autolabel 0 \
--nonet --xinclude --output $dst/epub/ \
${docbook_xsl_ns}/xml/xsl/docbook/epub/docbook.xsl \
$docPath
-
echo "application/epub+zip" > mimetype
manual="$dst/nixos-manual.epub"
nixos/doc/manual/release-notes/rl-2105.section.md
+1 -1
View File
@@ -389,7 +389,7 @@ When upgrading from a previous release, please be aware of the following incompa
Additionally, `platform.kernelArch` moved to the top level as `linuxArch` to match the other `*Arch` variables.
The `platform` grouping of these things never meant anything, and was just a historial/implementation artifact that was overdue removal.
The `platform` grouping of these things never meant anything, and was just a historical/implementation artifact that was overdue removal.
- `services.restic` now uses a dedicated cache directory for every backup defined in `services.restic.backups`. The old global cache directory, `/root/.cache/restic`, is now unused and can be removed to free up disk space.
nixos/doc/manual/release-notes/rl-2111.section.md
+2 -2
View File
@@ -196,7 +196,7 @@ In addition to numerous new and upgraded packages, this release has the followin
# Provide languages as ISO 639-2 codes
# separated by a plus (+) sign.
# https://en.wikipedia.org/wiki/List_of_ISO_639-2_codes
PAPERLESS_OCR_LANGUAGE = "deu+eng+jpn"; # German & English & Japanse
PAPERLESS_OCR_LANGUAGE = "deu+eng+jpn"; # German & English & Japanese
};
}
```
@@ -436,7 +436,7 @@ In addition to numerous new and upgraded packages, this release has the followin
- `retroArchCores` has been removed. This means that using `nixpkgs.config.retroarch` to customize RetroArch cores is not supported anymore. Instead, use package overrides, for example: `retroarch.override { cores = with libretro; [ citra snes9x ]; };`. Also, `retroarchFull` derivation is available for those who want to have all RetroArch cores available.
- The Linux kernel for security reasons now restricts access to BPF syscalls via `BPF_UNPRIV_DEFAULT_OFF=y`. Unprivileged access can be reenabled via the `kernel.unprivileged_bpf_disabled` sysctl knob.
- The Linux kernel for security reasons now restricts access to BPF syscalls via `BPF_UNPRIV_DEFAULT_OFF=y`. Unprivileged access can be re-enabled via the `kernel.unprivileged_bpf_disabled` sysctl knob.
- `/usr` will always be included in the initial ramdisk. See the `fileSystems.<name>.neededForBoot` option.
If any files exist under `/usr` (which is not typical for NixOS), they will be included in the initial ramdisk, increasing its size to a possibly problematic extent.
nixos/doc/manual/release-notes/rl-2311.section.md
+4 -4
View File
@@ -293,7 +293,7 @@ Make sure to also check the many updates in the [Nixpkgs library](#sec-release-2
- `odoo` defaults to v16 now, updated from v15.
- `varnish` was upgraded from v7.2.x to v7.4.x. Refer to upgrade guides vor
- `varnish` was upgraded from v7.2.x to v7.4.x. Refer to upgrade guides for
[v7.3](https://varnish-cache.org/docs/7.3/whats-new/upgrading-7.3.html) and
[v7.4](https://varnish-cache.org/docs/7.4/whats-new/upgrading-7.4.html). The
current LTS version is still offered as `varnish60`.
@@ -692,7 +692,7 @@ Make sure to also check the many updates in the [Nixpkgs library](#sec-release-2
NixOS configuration.
- GNOME, Pantheon, Cinnamon modules no longer force Qt applications to use
Adwaita style. This implemantion was buggy and is no longer maintained
Adwaita style. This implementation was buggy and is no longer maintained
upstream. Specifically, Cinnamon defaults to the gtk2 style instead now,
following the default in Linux Mint). If you still want Adwaita used, you may
add the following options to your configuration. Please be aware, that it
@@ -799,7 +799,7 @@ Make sure to also check the many updates in the [Nixpkgs library](#sec-release-2
directly. Please upgrade to `nextcloud26` (or earlier) first. Nextcloud
prohibits skipping major versions while upgrading. You may upgrade by
declaring [`services.nextcloud.package =
pkgs.nextcloud26;`](options.html#opt-services.nextcloud.package) inbetween.
pkgs.nextcloud26;`](options.html#opt-services.nextcloud.package) in between.
- `postgresql_11` has been removed since it'll stop receiving fixes on November
9th 2023.
@@ -1131,7 +1131,7 @@ Make sure to also check the many updates in the [Nixpkgs library](#sec-release-2
network interface is irrelevant.
- `services.outline` can be configured to use local filesystem storage now.
Previously ony S3 storage was possible. This may be set using
Previously only S3 storage was possible. This may be set using
[services.outline.storage.storageType](#opt-services.outline.storage.storageType).
- `pkgs.openvpn3` optionally supports systemd-resolved now. `programs.openvpn3`
nixos/doc/manual/release-notes/rl-2405.section.md
+2 -2
View File
@@ -74,7 +74,7 @@ The pre-existing `services.ankisyncd` has been marked deprecated and will be dro
- [BenchExec](https://github.com/sosy-lab/benchexec), a framework for reliable benchmarking and resource measurement, available as [programs.benchexec](#opt-programs.benchexec.enable),
as well as related programs
[CPU Energy Meter](https://github.com/sosy-lab/cpu-energy-meter), available as [programs.cpu-energy-meter](#opt-programs.cpu-energy-meter.enable), and
[PQoS Wrapper](https://gitlab.com/sosy-lab/software/pqos-wrapper), available as [programs.pqos-wrapper](#opt-programs.pqos-wrapper.enable).
[PQoS Wrapper](https://gitlab.com/sosy-lab/software/pqos-wrapper), available as `programs.pqos-wrapper`.
- [Bluemap](https://bluemap.bluecolored.de/), a 3D minecraft map renderer. Available as [services.bluemap](#opt-services.bluemap.enable).
@@ -708,7 +708,7 @@ Use `services.pipewire.extraConfig` or `services.pipewire.configPackages` for Pi
The port can be specified in [`services.nextcloud.config.dbhost`](#opt-services.nextcloud.config.dbhost).
- `services.kavita` now uses the free-form option `services.kavita.settings` for the application settings file.
The options `services.kavita.ipAdresses` and `services.kavita.port` now exist at `services.kavita.settings.IpAddresses`
The options `services.kavita.ipAddresses` and `services.kavita.port` now exist at `services.kavita.settings.IpAddresses`
and `services.kavita.settings.IpAddresses`. The file at `services.kavita.tokenKeyFile` now needs to contain a secret with
512+ bits instead of 128+ bits.
nixos/doc/manual/release-notes/rl-2505.section.md
+1 -1
View File
@@ -283,7 +283,7 @@ Alongside many enhancements to NixOS modules and general system improvements, th
- The `virtualisation.hypervGuest.videoMode` option has been removed. Standard tooling can now be used to configure display modes for Hyper-V VMs.
- Nextcloud's default FPM pool settings have been increased according to upstream recommentations. It's advised
- Nextcloud's default FPM pool settings have been increased according to upstream recommendations. It's advised
to review the new defaults and description of
[](#opt-services.nextcloud.poolSettings).
nixos/doc/manual/release-notes/rl-2605.section.md
+43 -6
View File
@@ -14,7 +14,7 @@
- The `cryptsetup-askpass` program is not available; use `systemctl default` instead, which will prompt for passphrases as necessary. If you pipe password responses into SSH over stdin, use `ssh -o RequestTTY=force` to ensure `systemctl default` gets a TTY to prompt on.
- Many kernel parameters have been replaced with native systemd versions; see [](#sec-boot-problems).
- The system.nix file has been added has an alternative entry point to configuration.nix (and flake.nix) that allows to configure NixOS without using `nix-channel`.
- The system.nix file has been added as an alternative entry point to configuration.nix (and flake.nix) that allows to configure NixOS without using `nix-channel`.
This file must evaluate to a NixOS system derivation or an attribute set of such derivations, in which case the attribute to build has to be selected with the `--attr` option of `nixos-rebuild` or `nixos-install`.
For example,
```nix
@@ -23,11 +23,11 @@
# Pinned Nixpkgs archive
#
# Use `curl -I https://channels.nixos.org/nixos-26.05` to get the
# latest commit of the stable channel and `nix-prefetch-url --unpack`
# to compute its sha256 hash.
# latest commit of the stable channel and `nix --extra-experimental-features nix-command store prefetch-file --unpack`
# to compute its hash.
nixpkgs = builtins.fetchTarball {
url = "https://github.com/NixOS/nixpkgs/archive/c217913993d6.tar.gz";
sha256 = "026mprs324330pfazlgbw987qmsa8ligglarvqbcxzig2kgw0lqg";
hash = "sha256-D1PA3xQv/s4W3lnR9yJFSld8UOLr0a/cBWMQMXS+1Qg=";
};
in
import "${nixpkgs}/nixos" {
@@ -98,6 +98,8 @@
- [nohang](https://github.com/hakavlad/nohang), a daemon for Linux that prevents out of memory (OOM) situations from affecting system responsiveness. Available as [services.nohang](#opt-services.nohang.enable)
- [clevis-luks-askpass](https://github.com/latchset/clevis), automatic LUKS unlocking in initrd using clevis token bindings stored in LUKS headers. Available as [boot.initrd.clevisLuksAskpass](#opt-boot.initrd.clevisLuksAskpass.enable).
- [bentopdf](https://github.com/alam00000/bentopdf), a privacy-first PDF toolkit running completely in-browser. Available as [services.bentopdf](#opt-services.bentopdf.enable).
- [hyprwhspr-rs](https://github.com/better-slop/hyprwhspr-rs), a keybind activated speech-to-text voice dictation utility built for use with Hyprland. Available as `services.hyprwhspr-rs`
@@ -110,6 +112,8 @@
- [dsearch](https://github.com/AvengeMedia/danksearch), a fast filesystem search service with fuzzy matching. Available as [programs.dsearch](#opt-programs.dsearch.enable).
- [Rustical](https://github.com/lennart-k/rustical), a CalDav/CardDav server aiming to be simple, fast and passwordless. Available as [services.rustical](options.html#opt-services.rustical.enable).
- [Elephant](https://github.com/abenz1267/elephant), a data provider service and backend for building custom application launchers. Available as [services.elephant](#opt-services.elephant.enable).
- [Dunst](https://github.com/dunst-project/dunst), a lightweight and customizable notification daemon. Available as [services.dunst](#opt-services.dunst.enable).
@@ -156,12 +160,16 @@
- [porxie](https://codeberg.org/Blooym/porxie), a correct and efficient ATProto blob proxy for secure content delivery. Available as [services.porxie](#opt-services.porxie.enable).
- [LogiOps](https://github.com/PixlOne/logiops), a unofficial userspace driver for HID++ Logitech devices. Available as [services.logiops](#opt-services.logiops.enable).
## Backward Incompatibilities {#sec-release-26.05-incompatibilities}
<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
- `systemd.coredump.extraConfig` has been removed in favor of the structured [](#opt-systemd.coredump.settings.Coredump) option. Use `systemd.coredump.settings.Coredump` to set any `coredump.conf(5)` option directly. For example, replace `systemd.coredump.extraConfig = "Storage=journal";` with `systemd.coredump.settings.Coredump.Storage = "journal";`.
- `services.home-assistant.config.lovelace.mode` has been renamed to `lovelace.dashboards` and `lovelace.resource_mode` to match the [configuration format](https://www.home-assistant.io/dashboards/dashboards/) required by Home Assistant 2026.8. Users who explicitly set `lovelace.mode` should remove it; the module generates the correct entries automatically.
- `opentrack`, `slushload`, `synthesia`, `vtfedit`, `winbox`, `wineasio`, and `yabridge` use wineWow64Packages instead of wineWowPackages as wine versions >= 11.0 have deprecated wineWowPackages. As such, the prefixes for these packages are NOT backwards compatible and need to be regenerated with potential for data loss.
- []{#sec-release-26.05-incompatibilities-profiles-hardened-removed} `profiles/hardened` has been removed, because:
@@ -173,6 +181,8 @@
- `services.crabfit` was removed because its upstream packages are unmaintained and insecure.
- `services.opensnitch.settings.Rules.Path` now defaults to `/var/lib/opensnitch/rules` instead of the previous `/etc/opensnitchd/rules` because it contains mutable data.
- `services.mosquitto` now generates per-listener authentication and access control via the upstream `password-file` and `acl-file` plugins instead of the deprecated `password_file` and `acl_file` options. The plugins contain the same code, so behaviour is unchanged, but [](#opt-services.mosquitto.package) must now be at least version 2.1.
- `sing-box` has been updated to 1.13.0, which has removed some deprecated options. See [upstream documentation](https://sing-box.sagernet.org/configuration/) for details and migration options.
@@ -181,6 +191,17 @@
- `services.pyload` has been removed because the package it relies on does not exist anymore in nixpkgs due to vulnerabilities and being unmaintained.
- Removed the ability from systemd to start units installed via `nix-env -i`.
This feature is hardly used and most units do not work without NixOS specific
changes anyways. Removing this allows us to drop a custom systemd patch
improving systemd maintainability and update speed.
- Removed the ability from systemd to depend on open-yet-unformatted dm-crypt
devices as systemd device units. For example you cannot call systemd-makefs
on such devices. This was never implemented upstream but patched into
Nixpkgs's systemd. Removing this allows us to drop a custom systemd patch
improving systemd maintainability and update speed.
- `linux_hardened` kernel has been removed due to a lack of maintenance.
- `services.tandoor-recipes` now uses a sub-directory for media files by default starting with `26.05`. Existing setups should move media files out of the data directory and adjust `services.tandoor-recipes.extraConfig.MEDIA_ROOT` accordingly. See [Migrating media files for pre 26.05 installations](#module-services-tandoor-recipes-migrating-media).
@@ -247,6 +268,13 @@ of pulling the upstream container image from Docker Hub. If you want the old beh
- Ethercalc and its associated module have been removed, as the package is unmaintained and cannot be installed from source with npm now.
- `services.headplane` has been updated to 0.6.2, which introduces several changes to the configuration schema:
- `services.headplane.settings.oidc.redirect_uri` is deprecated. Use `services.headplane.settings.server.base_url` instead; the OIDC redirect URI is now automatically derived from it. Ensure `base_url` is the bare host URL without the `/admin` suffix.
- `services.headplane.settings.oidc.user_storage_file` is deprecated. Headplane 0.6.2 still accepts it to migrate the old JSON user database into the new internal SQL database.
- `services.headplane.settings.oidc.strict_validation` is deprecated and has no effect.
- `services.headplane.settings.oidc.token_endpoint_auth_method` now defaults to `null` (auto-detection), which typically falls back to `client_secret_basic`. Previous versions defaulted to `client_secret_post`.
- `services.headplane.settings.integration.agent.cache_ttl` is deprecated and has no effect in 0.6.2.
- `services.immich` no longer supports pgvecto.rs since the package has been removed from nixpkgs.
As a result, options `services.immich.database.enableVectors` and `services.immich.database.enableVectorchord` have been removed, and VectorChord is now always used.
If you have not completed the migration yet, ensure you completely remove the extension from your database before upgrading by following the [migration guide](https://github.com/NixOS/nixpkgs/blob/nixos-25.11/nixos/modules/services/web-apps/immich.md#migrating-from-pgvecto-rs-to-vectorchord-pre-2511-installations-module-services-immich-vectorchord-migration).
@@ -282,6 +310,8 @@ See <https://github.com/NixOS/nixpkgs/issues/481673>.
- support for `ecryptfs` in nixpkgs has been removed.
- `services.xserver.cmt` has been removed as the `xf86-input-cmt` package was broken and unmaintained upstream.
- `programs.light` was removed from nixpkgs due to the corresponding package being unmaintained upstream. `brightnessctl` and `programs.acpilight` offer replacements.
- `ceph` has been upgraded to v20. See the [Ceph "tentacle" release notes](https://docs.ceph.com/en/latest/releases/tentacle/#v20-2-0-tentacle) for details and recommended upgrade procedure.
@@ -302,6 +332,13 @@ See <https://github.com/NixOS/nixpkgs/issues/481673>.
Note for NetworkManager users: before these changes NetworkManager used to spawn its own wpa_supplicant daemon, but now it relies on `networking.wireless`. So, if you had `networking.wireless.enable = false` in your configuration, you should remove that line.
- Some implementation details of the NixOS network-interfaces module have been changed:
- In the "scripted" backend, `network-setup.service` has been removed and the network configuration services are now part of `network.target`, which is now directly pulled into `multi-user.target`.
- Interface addresses, routes and default gateways are now configured asynchronously as soon as the underlying network devices become available (fixes issue [#154737](https://github.com/NixOS/nixpkgs/issues/154737)).
- In both "networkd" and "scripted" backends, the configuration of name servers is now part of `network-local-commands.service` (fixes issue [#445496](https://github.com/NixOS/nixpkgs/issues/445496)).
- The issue that resulted in a completely unconfigured network if both `resolvconf` was disabled and no default gateway configured, has also been fixed.
- `kratos` has been updated from 1.3.1 to [25.4.0](https://github.com/ory/kratos/releases/tag/v25.4.0). Upstream switched to a new versioning scheme (year.major.minor). Notable breaking changes:
- The `migrate sql` CLI command is now `migrate sql up`
@@ -367,11 +404,11 @@ See <https://github.com/NixOS/nixpkgs/issues/481673>.
- `security.acme` now defaults to a dynamic renewal duration, if
[security.acme.defaults.validMinDays](#opt-security.acme.defaults.validMinDays)
remains unset. This accomodates certificates with different ACME profile:
remains unset. This accommodates certificates with different ACME profile:
- For certificates with a total validity at or above 10 days renewal will happen
after two thirds of the lifetime has passed (e.g. a certificate valid for 90
days renews once the validity falls below 30 days)
- For shortlived certificates with a total validty below 10 days renewal
- For shortlived certificates with a total validity below 10 days renewal
will happen after half of the total lifetime has passed
- The module for the Dovecot IMAP server, *services.dovecot*, now uses RFC-42-style settings, exposing a structured interface to write the configuration file.
nixos/doc/manual/release-notes/rl-2611.section.md
+30
View File
@@ -0,0 +1,30 @@
# Release 26.11 (2026.11/??) {#sec-release-26.11}
## Highlights {#sec-release-26.11-highlights}
<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
- Create the first release note entry in this section!
## New Modules {#sec-release-26.11-new-modules}
<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
- Create the first release note entry in this section!
## Backward Incompatibilities {#sec-release-26.11-incompatibilities}
<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
- `programs.pqos-wrapper` module has been deleted
as the corresponding package has been dropped from nixpkgs.
- `programs.benchexec.enable = true`
no longer sets `programs.pqos-wrapper.enable = true`
as the corresponding module has been deleted.
## Other Notable Changes {#sec-release-26.11-notable-changes}
<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
- Create the first release note entry in this section!
nixos/lib/make-multi-disk-zfs-image.nix
+2 -2
View File
@@ -221,12 +221,12 @@ let
};
}) mountable;
};
passAsFile = [ "filesystems" ];
__structuredAttrs = true;
}
''
(
echo "builtins.fromJSON '''"
jq . < "$filesystemsPath"
printf "%s" "$filesystems" | jq .
echo "'''"
) > $out
nixos/lib/make-single-disk-zfs-image.nix
+2 -2
View File
@@ -209,12 +209,12 @@ let
};
}) mountable;
};
passAsFile = [ "filesystems" ];
__structuredAttrs = true;
}
''
(
echo "builtins.fromJSON '''"
jq . < "$filesystemsPath"
printf "%s" "$filesystems" | jq .
echo "'''"
) > $out
nixos/lib/test-driver/src/test_driver/machine/__init__.py
+11
View File
@@ -1495,6 +1495,17 @@ class NspawnMachine(BaseMachine):
self.logger.info(f"kill NspawnMachine (pid {self.pid})")
assert self.process is not None
self.process.terminate()
# Wait for the wrapper to finish its context-manager cleanups
# (veth/bridge/netns teardown) before returning, so the driver's
# subsequent vlan teardown does not race against it.
try:
self.process.wait(timeout=30)
except subprocess.TimeoutExpired:
self.logger.error(
f"NspawnMachine {self.name} (pid {self.pid}) did not exit after SIGTERM; sending SIGKILL"
)
self.process.kill()
self.process.wait()
self.process = None
def is_up(self) -> bool:
nixos/lib/testing/nixos-test-base.nix
+1
View File
@@ -8,6 +8,7 @@ in
{
imports = [
../../modules/testing/test-instrumentation.nix # !!! should only get added for automated test runs
../../modules/virtualisation/guest-networking-options.nix
{
key = "no-manual";
documentation.nixos.enable = false;
nixos/lib/testing/nodes.nix
+84 -83
View File
@@ -37,93 +37,94 @@ let
in
hostToGuest.${hostPlatform.system} or (throw message);
baseOS = import ../eval-config.nix {
inherit lib;
system = null; # use modularly defined system
inherit (config.node) specialArgs;
modules = [ config.defaults ];
baseModules = (import ../../modules/module-list.nix) ++ [
./nixos-test-base.nix
{
key = "nodes";
_module.args = {
inherit (config) containers;
nodes = config.nodesCompat;
};
}
(
{ options, ... }:
{
key = "nodes.nix-pkgs";
config = optionalAttrs (!config.node.pkgsReadOnly) (
mkIf (!options.nixpkgs.pkgs.isDefined) {
# TODO: switch to nixpkgs.hostPlatform and make sure containers-imperative test still evaluates.
nixpkgs.system = guestSystem;
baseOS =
extraBaseModules:
import ../eval-config.nix {
inherit lib;
system = null; # use modularly defined system
inherit (config.node) specialArgs;
modules = [ config.defaults ];
baseModules =
(import ../../modules/module-list.nix)
++ [
./nixos-test-base.nix
{
key = "nodes";
_module.args = {
inherit (config) containers;
nodes = config.nodesCompat;
};
}
(
{ options, ... }:
{
key = "nodes.nix-pkgs";
config = optionalAttrs (!config.node.pkgsReadOnly) (
mkIf (!options.nixpkgs.pkgs.isDefined) {
# TODO: switch to nixpkgs.hostPlatform and make sure containers-imperative test still evaluates.
nixpkgs.system = guestSystem;
}
);
}
);
}
)
testModuleArgs.config.extraBaseModules
];
};
baseQemuOS = baseOS.extendModules {
modules = [
../../modules/virtualisation/qemu-vm.nix
config.nodeDefaults
)
testModuleArgs.config.extraBaseModules
]
++ extraBaseModules;
};
baseQemuOS = baseOS [
../../modules/virtualisation/qemu-vm.nix
testModuleArgs.config.extraBaseNodeModules
config.nodeDefaults
{
key = "base-qemu";
virtualisation.qemu = {
inherit (testModuleArgs.config.qemu) package forceAccel;
};
virtualisation.host.pkgs = hostPkgs;
}
];
baseNspawnOS = baseOS [
../../modules/virtualisation/nspawn-container
config.containerDefaults
(
{ pkgs, ... }:
{
key = "base-qemu";
virtualisation.qemu = {
inherit (testModuleArgs.config.qemu) package forceAccel;
key = "base-nspawn";
# PAM requires setuid and doesn't work in the build sandbox.
# https://github.com/NixOS/nix/blob/959c244a1265f4048390f3ad21679219d7b27a99/src/libstore/unix/build/linux-derivation-builder.cc#L63
services.openssh.settings.UsePAM = false;
# Networking for tests is statically configured by default.
# dhcpcd times out after blocking for a long time, which slows down tests.
# See https://github.com/NixOS/nixpkgs/pull/478109#discussion_r2867570799
networking.useDHCP = lib.mkDefault false;
# Disable Info manual directory generation to prevent build failures.
#
# Context: 'install-info' (from texinfo) is triggered during system-path
# generation to index manuals, but it requires 'gzip' in the $PATH to
# decompress them.
# When 'networking.useDHCP' is set to false, transitive dependencies
# (like dhcpcd or other network tools) that normally pull 'gzip' into
# the system environment are removed. This leaves 'install-info'
# stranded without 'gzip', causing the 'system-path' derivation to fail.
# Since nspawn containers are typically minimal, disabling 'info'
# is a cleaner fix than explicitly adding 'gzip' to systemPackages.
documentation.info.enable = lib.mkDefault false;
# Gross, insecure hack to make login work. See above.
security.pam.services.login = {
text = ''
auth sufficient ${pkgs.linux-pam}/lib/security/pam_permit.so
account sufficient ${pkgs.linux-pam}/lib/security/pam_permit.so
password sufficient ${pkgs.linux-pam}/lib/security/pam_permit.so
session sufficient ${pkgs.linux-pam}/lib/security/pam_permit.so
'';
};
virtualisation.host.pkgs = hostPkgs;
}
testModuleArgs.config.extraBaseNodeModules
];
};
baseNspawnOS = baseOS.extendModules {
modules = [
../../modules/virtualisation/nspawn-container
config.containerDefaults
(
{ pkgs, ... }:
{
key = "base-nspawn";
# PAM requires setuid and doesn't work in the build sandbox.
# https://github.com/NixOS/nix/blob/959c244a1265f4048390f3ad21679219d7b27a99/src/libstore/unix/build/linux-derivation-builder.cc#L63
services.openssh.settings.UsePAM = false;
# Networking for tests is statically configured by default.
# dhcpcd times out after blocking for a long time, which slows down tests.
# See https://github.com/NixOS/nixpkgs/pull/478109#discussion_r2867570799
networking.useDHCP = lib.mkDefault false;
# Disable Info manual directory generation to prevent build failures.
#
# Context: 'install-info' (from texinfo) is triggered during system-path
# generation to index manuals, but it requires 'gzip' in the $PATH to
# decompress them.
# When 'networking.useDHCP' is set to false, transitive dependencies
# (like dhcpcd or other network tools) that normally pull 'gzip' into
# the system environment are removed. This leaves 'install-info'
# stranded without 'gzip', causing the 'system-path' derivation to fail.
# Since nspawn containers are typically minimal, disabling 'info'
# is a cleaner fix than explicitly adding 'gzip' to systemPackages.
documentation.info.enable = lib.mkDefault false;
# Gross, insecure hack to make login work. See above.
security.pam.services.login = {
text = ''
auth sufficient ${pkgs.linux-pam}/lib/security/pam_permit.so
account sufficient ${pkgs.linux-pam}/lib/security/pam_permit.so
password sufficient ${pkgs.linux-pam}/lib/security/pam_permit.so
session sufficient ${pkgs.linux-pam}/lib/security/pam_permit.so
'';
};
}
)
];
};
)
];
# TODO (lib): Dedup with run.nix, add to lib/options.nix
mkOneUp = opt: f: lib.mkOverride (opt.highestPrio - 1) (f opt.value);
nixos/lib/testing/run.nix
+8 -1
View File
@@ -150,7 +150,14 @@ in
config.enableDebugHook -> isLinux
) "The debugging hook is not supported for macOS host systems!";
{
name = "vm-test-run-${config.name}";
name =
let
inherit (config.driverConfiguration) containers vms;
kind = lib.concatStringsSep "-and-" (
(lib.optional (containers != { }) "container") ++ (lib.optional (vms != { }) "vm")
);
in
"${kind}-test-run-${config.name}";
requiredSystemFeatures = lib.attrNames (lib.filterAttrs (_: v: v) config.requiredFeatures);
nixos/modules/config/console.nix
+26 -15
View File
@@ -6,6 +6,7 @@
}:
let
cfg = config.console;
i18nCfg = config.i18n;
makeColor = i: lib.concatMapStringsSep "," (x: "0x" + lib.substring (2 * i) 2 x);
@@ -23,10 +24,12 @@ let
'';
# Sadly, systemd-vconsole-setup doesn't support binary keymaps.
vconsoleConf = pkgs.writeText "vconsole.conf" ''
KEYMAP=${cfg.keyMap}
${lib.optionalString (cfg.font != null) "FONT=${cfg.font}"}
'';
vconsoleConf =
withFont:
pkgs.writeText "vconsole.conf" ''
KEYMAP=${cfg.keyMap}
${lib.optionalString (withFont && cfg.font != null) "FONT=${cfg.font}"}
'';
consoleEnv =
kbd:
@@ -162,8 +165,10 @@ in
environment.systemPackages = [ pkgs.kbd ];
# Let systemd-vconsole-setup.service do the work of setting up the
# virtual consoles.
environment.etc."vconsole.conf".source = vconsoleConf;
# virtual consoles. Skip when imperative so localectl can manage it.
environment.etc."vconsole.conf" = lib.mkIf (!i18nCfg.imperativeLocale) {
source = vconsoleConf true;
};
# Provide kbd with additional packages.
environment.etc.kbd.source = "${consoleEnv pkgs.kbd}/share";
@@ -180,7 +185,7 @@ in
);
boot.initrd.systemd.contents = {
"/etc/vconsole.conf".source = vconsoleConf;
"/etc/vconsole.conf".source = vconsoleConf cfg.earlySetup;
# Add everything if we want full console setup...
"/etc/kbd" = lib.mkIf cfg.earlySetup {
source = "${consoleEnv config.boot.initrd.systemd.package.kbd}/share";
@@ -189,9 +194,6 @@ in
"/etc/kbd/keymaps" = lib.mkIf (!cfg.earlySetup) {
source = "${consoleEnv config.boot.initrd.systemd.package.kbd}/share/keymaps";
};
"/etc/kbd/consolefonts" = lib.mkIf (!cfg.earlySetup && cfg.font != null) {
source = "${consoleEnv config.boot.initrd.systemd.package.kbd}/share/consolefonts";
};
};
boot.initrd.systemd.additionalUpstreamUnits = [
"systemd-vconsole-setup.service"
@@ -201,7 +203,7 @@ in
"${config.boot.initrd.systemd.package.kbd}/bin/setfont"
"${config.boot.initrd.systemd.package.kbd}/bin/loadkeys"
]
++ lib.optionals (cfg.font != null && lib.hasPrefix builtins.storeDir cfg.font) [
++ lib.optionals (cfg.font != null && cfg.earlySetup && lib.hasPrefix builtins.storeDir cfg.font) [
"${cfg.font}"
]
++ lib.optionals (lib.hasPrefix builtins.storeDir cfg.keyMap) [
@@ -212,13 +214,22 @@ in
"systemd-vconsole-setup.service"
];
# When imperative, seed /etc/vconsole.conf on first boot from declared
# defaults so the keymap isn't lost before localectl is ever used
systemd.tmpfiles.rules = lib.mkIf i18nCfg.imperativeLocale [
"C /etc/vconsole.conf - - - - ${vconsoleConf}"
];
systemd.services.reload-systemd-vconsole-setup = {
description = "Reset console on configuration changes";
wantedBy = [ "multi-user.target" ];
restartTriggers = [
vconsoleConf
(consoleEnv pkgs.kbd)
];
restartTriggers =
lib.optionals (!i18nCfg.imperativeLocale) [
(config.environment.etc."vconsole.conf".source)
]
++ [
(consoleEnv pkgs.kbd)
];
reloadIfChanged = true;
serviceConfig = {
RemainAfterExit = true;
nixos/modules/config/i18n.nix
+61 -28
View File
@@ -5,24 +5,29 @@
...
}:
let
cfg = config.i18n;
localeConf = pkgs.writeText "locale.conf" ''
LANG=${cfg.defaultLocale}
${lib.concatStringsSep "\n" (lib.mapAttrsToList (n: v: "${n}=${v}") cfg.extraLocaleSettings)}
'';
sanitizeUTF8Capitalization =
lang: (lib.replaceStrings [ "utf8" "utf-8" "UTF8" ] [ "UTF-8" "UTF-8" "UTF-8" ] lang);
aggregatedLocales =
lib.optionals (config.i18n.defaultLocale != "C") [
"${config.i18n.defaultLocale}/${config.i18n.defaultCharset}"
lib.optionals (cfg.defaultLocale != "C") [
"${cfg.defaultLocale}/${cfg.defaultCharset}"
]
++ lib.pipe config.i18n.extraLocaleSettings [
++ lib.pipe cfg.extraLocaleSettings [
# See description of extraLocaleSettings for why is this ignored here.
(x: lib.removeAttrs x [ "LANGUAGE" ])
(lib.mapAttrs (n: v: (sanitizeUTF8Capitalization v)))
# C locales are always installed
(lib.filterAttrs (n: v: v != "C"))
(lib.mapAttrsToList (LCRole: lang: lang + "/" + (config.i18n.localeCharsets.${LCRole} or "UTF-8")))
(lib.mapAttrsToList (LCRole: lang: lang + "/" + (cfg.localeCharsets.${LCRole} or "UTF-8")))
]
++ (map sanitizeUTF8Capitalization (
lib.optionals (builtins.isList config.i18n.extraLocales) config.i18n.extraLocales
lib.optionals (builtins.isList cfg.extraLocales) cfg.extraLocales
))
++ (lib.optional (builtins.isString config.i18n.extraLocales) config.i18n.extraLocales);
++ (lib.optional (builtins.isString cfg.extraLocales) cfg.extraLocales);
in
{
###### interface
@@ -31,16 +36,23 @@ in
i18n = {
glibcLocales = lib.mkOption {
type = lib.types.path;
default = pkgs.glibcLocales.override {
allLocales = lib.elem "all" config.i18n.supportedLocales;
locales = config.i18n.supportedLocales;
};
type = lib.types.nullOr lib.types.path;
default =
if pkgs.glibcLocales != null then
pkgs.glibcLocales.override {
allLocales = lib.elem "all" cfg.supportedLocales;
locales = cfg.supportedLocales;
}
else
null;
defaultText = lib.literalExpression ''
pkgs.glibcLocales.override {
allLocales = lib.elem "all" config.i18n.supportedLocales;
locales = config.i18n.supportedLocales;
}
if pkgs.glibcLocales != null then
pkgs.glibcLocales.override {
allLocales = lib.elem "all" config.i18n.supportedLocales;
locales = config.i18n.supportedLocales;
}
else
null
'';
example = lib.literalExpression "pkgs.glibcLocales";
description = ''
@@ -143,6 +155,16 @@ in
'';
};
imperativeLocale = lib.mkEnableOption ''
imperative locale and keyboard management via localectl.
When enabled, locale and keyboard settings can be changed at runtime
using `localectl set-locale` and `localectl set-keymap`.
When disabled (the default), these settings are managed declaratively
through {option}`i18n.defaultLocale`, {option}`i18n.extraLocaleSettings`,
and {option}`console.keyMap`.
'';
};
};
@@ -154,8 +176,8 @@ in
lib.optional
(
!(
(lib.subtractLists config.i18n.supportedLocales aggregatedLocales) == [ ]
|| lib.elem "all" config.i18n.supportedLocales
(lib.subtractLists cfg.supportedLocales aggregatedLocales) == [ ]
|| lib.elem "all" cfg.supportedLocales
)
)
''
@@ -171,25 +193,36 @@ in
environment.systemPackages =
# We increase the priority a little, so that plain glibc in systemPackages can't win.
lib.optional (config.i18n.supportedLocales != [ ]) (lib.setPrio (-1) config.i18n.glibcLocales);
lib.optional (cfg.glibcLocales != null && cfg.supportedLocales != [ ]) (
lib.setPrio (-1) cfg.glibcLocales
);
environment.sessionVariables = {
LANG = config.i18n.defaultLocale;
LOCALE_ARCHIVE = "/run/current-system/sw/lib/locale/locale-archive";
}
// config.i18n.extraLocaleSettings;
# When imperative, leave LANG/LC_* to pam_systemd so /etc/set-environment
# does not override what localectl wrote to /etc/locale.conf.
// lib.optionalAttrs (!cfg.imperativeLocale) (
{
LANG = cfg.defaultLocale;
}
// cfg.extraLocaleSettings
);
systemd.globalEnvironment = lib.mkIf (config.i18n.supportedLocales != [ ]) {
LOCALE_ARCHIVE = "${config.i18n.glibcLocales}/lib/locale/locale-archive";
systemd.globalEnvironment = lib.mkIf (cfg.glibcLocales != null && cfg.supportedLocales != [ ]) {
LOCALE_ARCHIVE = "${cfg.glibcLocales}/lib/locale/locale-archive";
};
# ‘/etc/locale.conf’ is used by systemd.
environment.etc."locale.conf".source = pkgs.writeText "locale.conf" ''
LANG=${config.i18n.defaultLocale}
${lib.concatStringsSep "\n" (
lib.mapAttrsToList (n: v: "${n}=${v}") config.i18n.extraLocaleSettings
)}
'';
# If imperative, see below
environment.etc."locale.conf" = lib.mkIf (!cfg.imperativeLocale) {
source = localeConf;
};
# When imperative, seed /etc/locale.conf on first boot from declared defaults
# so the system doesn’t fall back to C.UTF-8
systemd.tmpfiles.rules = lib.mkIf cfg.imperativeLocale [
"C /etc/locale.conf - - - - ${localeConf}"
];
};
}
nixos/modules/config/locale.nix
-4
View File
@@ -86,10 +86,6 @@ in
# This way services are restarted when tzdata changes.
systemd.globalEnvironment.TZDIR = tzdir;
systemd.services.systemd-timedated.environment = lib.optionalAttrs (config.time.timeZone != null) {
NIXOS_STATIC_TIMEZONE = "1";
};
environment.etc = {
zoneinfo.source = tzdir;
}
nixos/modules/config/system-environment.nix
+21 -20
View File
@@ -11,6 +11,23 @@ let
cfg = config.environment;
suffixedVariables = lib.flip lib.mapAttrs cfg.profileRelativeSessionVariables (
envVar: suffixes:
lib.flip lib.concatMap cfg.profiles (profile: map (suffix: "${profile}${suffix}") suffixes)
);
combinedSessionVars = lib.zipAttrsWith (n: lib.concatLists) [
# Make sure security wrappers are prioritized without polluting
# shell environments with an extra entry. Sessions which depend on
# pam for its environment will otherwise have eg. broken sudo. In
# particular Gnome Shell sometimes fails to source a proper
# environment from a shell.
{ PATH = [ config.security.wrapperDir ]; }
(lib.mapAttrs (n: lib.toList) cfg.sessionVariables)
suffixedVariables
];
in
{
@@ -73,13 +90,11 @@ in
};
config = {
environment.etc."environment.d/50-systemd-path.conf".text = ''
PATH="${lib.concatStringsSep ":" combinedSessionVars.PATH}"
'';
environment.etc."pam/environment".text =
let
suffixedVariables = lib.flip lib.mapAttrs cfg.profileRelativeSessionVariables (
envVar: suffixes:
lib.flip lib.concatMap cfg.profiles (profile: map (suffix: "${profile}${suffix}") suffixes)
);
# We're trying to use the same syntax for PAM variables and env variables.
# That means we need to map the env variables that people might use to their
# equivalent PAM variable.
@@ -88,21 +103,7 @@ in
pamVariable =
n: v: ''${n} DEFAULT="${lib.concatStringsSep ":" (map replaceEnvVars (lib.toList v))}"'';
pamVariables = lib.concatStringsSep "\n" (
lib.mapAttrsToList pamVariable (
lib.zipAttrsWith (n: lib.concatLists) [
# Make sure security wrappers are prioritized without polluting
# shell environments with an extra entry. Sessions which depend on
# pam for its environment will otherwise have eg. broken sudo. In
# particular Gnome Shell sometimes fails to source a proper
# environment from a shell.
{ PATH = [ config.security.wrapperDir ]; }
(lib.mapAttrs (n: lib.toList) cfg.sessionVariables)
suffixedVariables
]
)
);
pamVariables = lib.concatStringsSep "\n" (lib.mapAttrsToList pamVariable combinedSessionVars);
in
''
${pamVariables}
nixos/modules/config/xdg/portals/lxqt.nix
-1
View File
@@ -29,7 +29,6 @@ in
[
pkgs.libsForQt5.qtstyleplugin-kvantum
pkgs.breeze-qt5
pkgs.qtcurve
];
'';
description = ''
nixos/modules/hardware/i2c.nix
+1 -1
View File
@@ -38,7 +38,7 @@ in
name = "i2c-udev-rules";
text = ''
# allow group ${cfg.group} and users with a seat use of i2c devices
ACTION=="add", KERNEL=="i2c-[0-9]*", TAG+="uaccess", GROUP="${cfg.group}", MODE="660"
ACTION!="remove", KERNEL=="i2c-[0-9]*", TAG+="uaccess", GROUP="${cfg.group}", MODE="660"
'';
destination = "/etc/udev/rules.d/70-i2c.rules";
}
nixos/modules/installer/cd-dvd/installation-cd-graphical-calamares-cosmic.nix
+71
View File
@@ -0,0 +1,71 @@
{
config,
lib,
pkgs,
...
}:
{
imports = [ ./installation-cd-graphical-calamares.nix ];
isoImage.edition = lib.mkDefault "cosmic";
isoImage.configurationName = "COSMIC (Linux LTS)";
environment.pathsToLink = [ "/share/calamares" ];
services = {
desktopManager.cosmic.enable = true;
displayManager = {
# Greeter needs to be enabled to handle an idle logout and login
cosmic-greeter.enable = true;
# No need to have a lockscreen on an installer ISO, enable autologin
autoLogin = {
enable = true;
user = "nixos";
};
};
};
systemd.tmpfiles.rules =
let
desktopDir = "/home/nixos/Desktop";
filesInHomePerms = "0644 nixos users -";
dirsInHomePerms = "0755 nixos users - -";
CosmicAppList_favorites = "${pkgs.writeText "favorites" ''
[
"calamares",
"firefox",
"gparted",
"com.system76.CosmicFiles",
"com.system76.CosmicEdit",
"com.system76.CosmicTerm",
"com.system76.CosmicSettings",
]''}";
in
[
# Need to create ${desktopDir} first or we get an ownership issue because
# otherwise ${desktopDir} gets the ownership of `root:root`.
"d ${desktopDir} ${dirsInHomePerms}"
"L+ ${desktopDir}/calamares.desktop ${filesInHomePerms} ${pkgs.calamares-nixos}/share/applications/calamares.desktop"
"L+ ${desktopDir}/firefox.desktop ${filesInHomePerms} ${pkgs.firefox}/share/applications/firefox.desktop"
"L+ ${desktopDir}/gparted.desktop ${filesInHomePerms} ${pkgs.gparted}/share/applications/gparted.desktop"
"L+ ${desktopDir}/nixos-manual.desktop ${filesInHomePerms} /run/current-system/sw/share/applications/nixos-manual.desktop"
# Same as ${desktopDir}, need to create all directories in the hierarchy
"d /home/nixos/.config ${dirsInHomePerms}"
"d /home/nixos/.config/cosmic ${dirsInHomePerms}"
"d /home/nixos/.config/cosmic/com.system76.CosmicAppList ${dirsInHomePerms}"
"d /home/nixos/.config/cosmic/com.system76.CosmicAppList/v1 ${dirsInHomePerms}"
"L+ /home/nixos/.config/cosmic/com.system76.CosmicAppList/v1/favorites ${filesInHomePerms} ${CosmicAppList_favorites}"
];
specialisation = {
cosmic_latest_kernel.configuration =
{ config, ... }:
{
imports = [ ./latest-kernel.nix ];
isoImage.configurationName = lib.mkForce "COSMIC (Linux ${config.boot.kernelPackages.kernel.version})";
};
};
}
nixos/modules/installer/cd-dvd/installation-cd-graphical-calamares-plasma6.nix
+4 -1
View File
@@ -7,7 +7,10 @@
isoImage.edition = lib.mkDefault "plasma6";
services.desktopManager.plasma6.enable = true;
services.desktopManager.plasma6 = {
enable = true;
enableQt5Integration = false;
};
# Automatically login as nixos.
services.displayManager = {
nixos/modules/installer/tools/tools.nix
+1 -1
View File
@@ -76,7 +76,7 @@ let
{
inputs = {
# This is pointing to an unstable release.
# If you prefer a stable release instead, you can this to the latest number shown here: https://nixos.org/download
# If you prefer a stable release instead, you can change the word unstable to the latest number shown here: https://nixos.org/download
# i.e. nixos-24.11
# Use `nix flake update` to update the flake to the latest revision of the chosen release channel.
nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
nixos/modules/module-list.nix
+4 -2
View File
@@ -296,7 +296,6 @@
./programs/pay-respects.nix
./programs/plotinus.nix
./programs/pmount.nix
./programs/pqos-wrapper.nix
./programs/projecteur.nix
./programs/proxychains.nix
./programs/pulseview.nix
@@ -688,6 +687,7 @@
./services/hardware/lcd.nix
./services/hardware/libinput.nix
./services/hardware/lirc.nix
./services/hardware/logiops.nix
./services/hardware/monado.nix
./services/hardware/nvidia-container-toolkit
./services/hardware/nvidia-optimus.nix
@@ -1366,6 +1366,7 @@
./services/networking/rdnssd.nix
./services/networking/realm.nix
./services/networking/redsocks.nix
./services/networking/reframe.nix
./services/networking/resilio.nix
./services/networking/robustirc-bridge.nix
./services/networking/rosenpass.nix
@@ -1768,6 +1769,7 @@
./services/web-apps/rimgo.nix
./services/web-apps/rss-bridge.nix
./services/web-apps/rsshub.nix
./services/web-apps/rustical.nix
./services/web-apps/rutorrent.nix
./services/web-apps/screego.nix
./services/web-apps/selfoss.nix
@@ -1855,7 +1857,6 @@
./services/x11/display-managers/xpra.nix
./services/x11/extra-layouts.nix
./services/x11/fractalart.nix
./services/x11/hardware/cmt.nix
./services/x11/hardware/digimend.nix
./services/x11/hardware/synaptics.nix
./services/x11/hardware/wacom.nix
@@ -1896,6 +1897,7 @@
./system/activation/switchable-system.nix
./system/activation/top-level.nix
./system/boot/binfmt.nix
./system/boot/clevis-luks-askpass.nix
./system/boot/clevis.nix
./system/boot/emergency-mode.nix
./system/boot/grow-partition.nix
nixos/modules/programs/benchexec.nix
-1
View File
@@ -85,7 +85,6 @@ in
# See <https://github.com/sosy-lab/benchexec/blob/3.18/doc/INSTALL.md#requirements>.
programs = {
cpu-energy-meter.enable = lib.mkDefault true;
pqos-wrapper.enable = lib.mkDefault true;
};
# See <https://github.com/sosy-lab/benchexec/blob/3.18/doc/INSTALL.md#kernel-requirements>.
nixos/modules/programs/nix-required-mounts.nix
+3
View File
@@ -70,7 +70,10 @@ let
zluda = {
onFeatures = [
"amd-gpu"
"cuda"
"gpu"
"opengl"
];
paths = [
pkgs.addDriverRunpath.driverLink
nixos/modules/programs/pqos-wrapper.nix
-28
View File
@@ -1,28 +0,0 @@
{
config,
lib,
pkgs,
...
}:
let
cfg = config.programs.pqos-wrapper;
in
{
options.programs.pqos-wrapper = {
enable = lib.mkEnableOption "PQoS Wrapper for BenchExec";
package = lib.mkPackageOption pkgs "pqos-wrapper" { };
};
config = lib.mkIf cfg.enable {
hardware.cpu.x86.msr.enable = true;
security.wrappers.${cfg.package.meta.mainProgram} = {
owner = "nobody";
group = config.hardware.cpu.x86.msr.group;
source = lib.getExe cfg.package;
capabilities = "cap_sys_rawio=eip";
};
};
meta.maintainers = with lib.maintainers; [ lorenzleutgeb ];
}
nixos/modules/programs/regreet.nix
+3
View File
@@ -152,6 +152,9 @@ in
theme_name = cfg.theme.name;
};
# Needed to fetch accounts
services.accounts-daemon.enable = true;
services.greetd = {
enable = lib.mkDefault true;
settings.default_session.command = lib.mkDefault "${pkgs.dbus}/bin/dbus-run-session ${lib.getExe pkgs.cage} ${lib.escapeShellArgs cfg.cageArgs} -- ${lib.getExe cfg.package}";
nixos/modules/programs/starship.nix
+8 -4
View File
@@ -116,7 +116,7 @@ in
# config file. starship appears to use a hardcoded config location
# rather than one inside an XDG folder:
# https://github.com/starship/starship/blob/686bda1706e5b409129e6694639477a0f8a3f01b/src/configure.rs#L651
if [[ ! -f "$HOME/.config/starship.toml" ]]; then
if [[ ! -f "$${STARSHIP_CONFIG:-$HOME/.config/starship.toml}" ]]; then
export STARSHIP_CONFIG=${settingsFile}
fi
eval "$(${cfg.package}/bin/starship init bash --print-full-init)"
@@ -129,7 +129,8 @@ in
# config file. starship appears to use a hardcoded config location
# rather than one inside an XDG folder:
# https://github.com/starship/starship/blob/686bda1706e5b409129e6694639477a0f8a3f01b/src/configure.rs#L651
if not test -f "$HOME/.config/starship.toml";
set -q STARSHIP_CONFIG; or set STARSHIP_CONFIG "$HOME/.config/starship.toml"
if not test -f "$STARSHIP_CONFIG"
set -x STARSHIP_CONFIG ${settingsFile}
end
${lib.optionalString (!isNull cfg.transientPrompt.left) ''
@@ -153,7 +154,7 @@ in
# config file. starship appears to use a hardcoded config location
# rather than one inside an XDG folder:
# https://github.com/starship/starship/blob/686bda1706e5b409129e6694639477a0f8a3f01b/src/configure.rs#L651
if [[ ! -f "$HOME/.config/starship.toml" ]]; then
if [[ ! -f "$${STARSHIP_CONFIG:-$HOME/.config/starship.toml}" ]]; then
export STARSHIP_CONFIG=${settingsFile}
fi
eval "$(${cfg.package}/bin/starship init zsh)"
@@ -167,8 +168,11 @@ in
# config file. starship appears to use a hardcoded config location
# rather than one inside an XDG folder:
# https://github.com/starship/starship/blob/686bda1706e5b409129e6694639477a0f8a3f01b/src/configure.rs#L651
if not `$HOME/.config/starship.toml`:
import os as _os
_sc = _os.environ.get('STARSHIP_CONFIG', _os.path.join(_os.environ['HOME'], '.config/starship.toml'))
if not _os.path.isfile(_sc):
$STARSHIP_CONFIG = ('${settingsFile}')
del _os, _sc
execx($(${cfg.package}/bin/starship init xonsh))
'';
};
nixos/modules/programs/wayland/hyprland.nix
+15 -1
View File
@@ -81,7 +81,21 @@ in
config = lib.mkIf cfg.enable (
lib.mkMerge [
{
environment.systemPackages = [ cfg.package ];
environment = {
systemPackages = [ cfg.package ];
# Allows lua stub file to be accessed from /run/current-system/sw/share/hypr
pathsToLink = [ "/share/hypr" ];
};
# Hyprland needs permissions to give itself SCHED_RR on startup:
# https://github.com/hyprwm/Hyprland/blob/main/src/init/initHelpers.cpp
security.wrappers.Hyprland = {
owner = "root";
group = "root";
capabilities = "cap_sys_nice+ep";
source = lib.getExe cfg.package;
};
xdg.portal = {
enable = true;
nixos/modules/programs/wayland/niri.nix
+11
View File
@@ -40,6 +40,17 @@ in
systemd.packages = [ cfg.package ];
# Restarting the compositor kills the graphical session; same
# treatment as the display-manager modules.
systemd.user.services.niri = {
restartIfChanged = false;
# Defining the unit here generates a drop-in; without this it
# would carry the NixOS default Environment="PATH=coreutils:…",
# clobbering the PATH that niri-session imported into the user
# manager and breaking spawn actions that rely on it.
enableDefaultPath = false;
};
xdg.portal = {
enable = lib.mkDefault true;
nixos/modules/rename.nix
+11
View File
@@ -82,6 +82,10 @@ in
"programs"
"gnome-documents"
] "The corresponding package was removed from nixpkgs.")
(mkRemovedOptionModule [
"programs"
"pqos-wrapper"
] "The corresponding package was removed from nixpkgs.") # added 2026-05-13
(mkRemovedOptionModule
[
"services"
@@ -386,6 +390,10 @@ in
as the underlying package isn't being maintained. Working alternatives are
libinput and synaptics.
'')
(mkRemovedOptionModule [ "services" "xserver" "windowManager" "ragnarwm" ] ''
The services.xserver.windowManager.ragnarwm module has been removed
because the corresponding package was removed from nixpkgs.
'')
(mkRemovedOptionModule [
"services"
"xmr-stak"
@@ -510,6 +518,9 @@ in
(mkRemovedOptionModule [ "services" "xtreemfs" ] ''
services.xtreemfs has been removed as it was broken and unmaintained upstream
'')
(mkRemovedOptionModule [ "services" "xserver" "cmt" ] ''
services.xserver.cmt has been removed as it was broken and unmaintained upstream
'')
# Do NOT add any option renames here, see top of the file
];
}
nixos/modules/security/acme/default.md
+1 -1
View File
@@ -379,7 +379,7 @@ systemctl start acme-example.com.service
## Ensuring dependencies for services that need to be reloaded when a certificate changes {#module-security-acme-reload-dependencies}
Services that depend on ACME certificates and need to be reloaded can use one of two approaches to reload upon successfull certificate acquisition or renewal:
Services that depend on ACME certificates and need to be reloaded can use one of two approaches to reload upon successful certificate acquisition or renewal:
1. **Using the `security.acme.certs.<name>.reloadServices` option**: This will cause `systemctl try-reload-or-restart` to be run for the listed services.
nixos/modules/security/acme/default.nix
+15 -12
View File
@@ -441,18 +441,6 @@ let
chown -R ${user}:${data.group} "$fixpath"
fi
done
${lib.optionalString (data.webroot != null) ''
# Ensure the webroot exists. Fixing group is required in case configuration was changed between runs.
# Lego will fail if the webroot does not exist at all.
(
mkdir -p '${data.webroot}/.well-known/acme-challenge' \
&& chgrp '${data.group}' ${data.webroot}/.well-known/acme-challenge
) || (
echo 'Please ensure ${data.webroot}/.well-known/acme-challenge exists and is writable by acme:${data.group}' \
&& exit 1
)
''}
'';
};
@@ -1277,6 +1265,21 @@ in
) (lib.groupBy (conf: conf.accountHash) (lib.attrValues certConfigs));
in
accountTargets;
systemd.tmpfiles.settings."10-acme" =
lib.genAttrs
(lib.concatMap (dir: [
dir
(dir + "/.well-known")
(dir + "/.well-known/acme-challenge")
]) webroots)
(dir: {
"d" = {
inherit user;
group = "acme";
mode = "0755";
};
});
})
];
nixos/modules/security/apparmor/includes.nix
+3 -1
View File
@@ -95,7 +95,9 @@ in
include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/base"
${pkgs.stdenv.cc.libc}/share/locale/** r,
${pkgs.stdenv.cc.libc}/share/locale.alias r,
${config.i18n.glibcLocales}/lib/locale/locale-archive r,
${lib.optionalString (
config.i18n.glibcLocales != null
) "${config.i18n.glibcLocales}/lib/locale/locale-archive r,"}
${etcRule "localtime"}
${pkgs.tzdata}/share/zoneinfo/** r,
${pkgs.stdenv.cc.libc}/share/i18n/** r,
nixos/modules/security/wrappers/default.nix
+143 -121
View File
@@ -245,134 +245,156 @@ in
};
###### implementation
config = lib.mkIf config.security.enableWrappers {
assertions = lib.mapAttrsToList (name: opts: {
assertion = opts.setuid || opts.setgid -> opts.capabilities == "";
message = ''
The security.wrappers.${name} wrapper is not valid:
setuid/setgid and capabilities are mutually exclusive.
config = lib.mkMerge [
{
warnings = lib.optional (wrappers != { } && !config.security.enableWrappers) ''
security.enableWrappers is set to false, but the following wrappers are still enabled and will be silently ignored: ${lib.concatStringsSep ", " (lib.attrNames wrappers)}. This might prevent fundamental functionalities, like PAM authentication. To avoid this warning, either set security.enableWrappers = true, or explicitly disable each wrapper with `enable = false`.
'';
}) wrappers;
assertions = [
{
assertion =
!(
!config.security.enableWrappers && lib.any (u: u.isNormalUser) (lib.attrValues config.users.users)
);
message = ''
security.enableWrappers is disabled but normal users are defined
(${
lib.concatStringsSep ", " (
lib.mapAttrsToList (n: _: n) (lib.filterAttrs (_: u: u.isNormalUser) config.users.users)
)
}). Without SUID wrappers, users cannot login. Either enable wrappers or remove all normal user accounts.
'';
}
];
}
(lib.mkIf config.security.enableWrappers {
assertions = lib.mapAttrsToList (name: opts: {
assertion = opts.setuid || opts.setgid -> opts.capabilities == "";
message = ''
The security.wrappers.${name} wrapper is not valid:
setuid/setgid and capabilities are mutually exclusive.
'';
}) wrappers;
security.wrappers =
let
mkSetuidRoot = source: {
setuid = true;
owner = "root";
group = "root";
inherit source;
security.wrappers =
let
mkSetuidRoot = source: {
setuid = true;
owner = "root";
group = "root";
inherit source;
};
in
{
# These are mount related wrappers that require the +s permission.
mount = mkSetuidRoot "${lib.getBin pkgs.util-linux}/bin/mount";
umount = mkSetuidRoot "${lib.getBin pkgs.util-linux}/bin/umount";
};
in
{
# These are mount related wrappers that require the +s permission.
mount = mkSetuidRoot "${lib.getBin pkgs.util-linux}/bin/mount";
umount = mkSetuidRoot "${lib.getBin pkgs.util-linux}/bin/umount";
# Make sure our wrapperDir exports to the PATH env variable when
# initializing the shell
environment.extraInit = ''
# Wrappers override other bin directories.
export PATH="${wrapperDir}:$PATH"
'';
security.apparmor.includes = lib.mapAttrs' (
wrapName: wrap:
lib.nameValuePair "nixos/security.wrappers/${wrapName}" ''
include "${
pkgs.apparmorRulesFromClosure { name = "security.wrappers.${wrapName}"; } [
(securityWrapper wrap.source)
]
}"
mrpx ${wrap.source},
''
) wrappers;
systemd.mounts = [
{
where = parentWrapperDir;
what = "tmpfs";
type = "tmpfs";
options = lib.concatStringsSep "," [
"nodev"
"mode=755"
"size=${config.security.wrapperDirSize}"
];
}
];
systemd.services.suid-sgid-wrappers = {
description = "Create SUID/SGID Wrappers";
wantedBy = [ "sysinit.target" ];
before = [
"sysinit.target"
"shutdown.target"
];
conflicts = [ "shutdown.target" ];
after = [ "systemd-sysusers.service" ];
unitConfig.DefaultDependencies = false;
unitConfig.RequiresMountsFor = [
"/nix/store"
"/run/wrappers"
];
serviceConfig.RestrictSUIDSGID = false;
serviceConfig.Type = "oneshot";
script = ''
chmod 755 "${parentWrapperDir}"
# We want to place the tmpdirs for the wrappers to the parent dir.
wrapperDir=$(mktemp --directory --tmpdir="${parentWrapperDir}" wrappers.XXXXXXXXXX)
chmod a+rx "$wrapperDir"
${lib.concatStringsSep "\n" mkWrappedPrograms}
if [ -L ${wrapperDir} ]; then
# Atomically replace the symlink
# See https://axialcorps.com/2013/07/03/atomically-replacing-files-and-directories/
old=$(readlink -f ${wrapperDir})
if [ -e "${wrapperDir}-tmp" ]; then
rm --force --recursive "${wrapperDir}-tmp"
fi
ln --symbolic --force --no-dereference "$wrapperDir" "${wrapperDir}-tmp"
mv --no-target-directory "${wrapperDir}-tmp" "${wrapperDir}"
rm --force --recursive "$old"
else
# For initial setup
ln --symbolic "$wrapperDir" "${wrapperDir}"
fi
'';
};
# Make sure our wrapperDir exports to the PATH env variable when
# initializing the shell
environment.extraInit = ''
# Wrappers override other bin directories.
export PATH="${wrapperDir}:$PATH"
'';
###### wrappers consistency checks
system.checks = lib.singleton (
pkgs.runCommand "ensure-all-wrappers-paths-exist"
{
preferLocalBuild = true;
}
''
# make sure we produce output
mkdir -p $out
security.apparmor.includes = lib.mapAttrs' (
wrapName: wrap:
lib.nameValuePair "nixos/security.wrappers/${wrapName}" ''
include "${
pkgs.apparmorRulesFromClosure { name = "security.wrappers.${wrapName}"; } [
(securityWrapper wrap.source)
]
}"
mrpx ${wrap.source},
''
) wrappers;
echo -n "Checking that Nix store paths of all wrapped programs exist... "
systemd.mounts = [
{
where = parentWrapperDir;
what = "tmpfs";
type = "tmpfs";
options = lib.concatStringsSep "," [
"nodev"
"mode=755"
"size=${config.security.wrapperDirSize}"
];
}
];
declare -A wrappers
${lib.concatStringsSep "\n" (lib.mapAttrsToList (n: v: "wrappers['${n}']='${v.source}'") wrappers)}
systemd.services.suid-sgid-wrappers = {
description = "Create SUID/SGID Wrappers";
wantedBy = [ "sysinit.target" ];
before = [
"sysinit.target"
"shutdown.target"
];
conflicts = [ "shutdown.target" ];
after = [ "systemd-sysusers.service" ];
unitConfig.DefaultDependencies = false;
unitConfig.RequiresMountsFor = [
"/nix/store"
"/run/wrappers"
];
serviceConfig.RestrictSUIDSGID = false;
serviceConfig.Type = "oneshot";
script = ''
chmod 755 "${parentWrapperDir}"
for name in "''${!wrappers[@]}"; do
path="''${wrappers[$name]}"
if [[ "$path" =~ /nix/store ]] && [ ! -e "$path" ]; then
test -t 1 && echo -ne '\033[1;31m'
echo "FAIL"
echo "The path $path does not exist!"
echo 'Please, check the value of `security.wrappers."'$name'".source`.'
test -t 1 && echo -ne '\033[0m'
exit 1
fi
done
# We want to place the tmpdirs for the wrappers to the parent dir.
wrapperDir=$(mktemp --directory --tmpdir="${parentWrapperDir}" wrappers.XXXXXXXXXX)
chmod a+rx "$wrapperDir"
${lib.concatStringsSep "\n" mkWrappedPrograms}
if [ -L ${wrapperDir} ]; then
# Atomically replace the symlink
# See https://axialcorps.com/2013/07/03/atomically-replacing-files-and-directories/
old=$(readlink -f ${wrapperDir})
if [ -e "${wrapperDir}-tmp" ]; then
rm --force --recursive "${wrapperDir}-tmp"
fi
ln --symbolic --force --no-dereference "$wrapperDir" "${wrapperDir}-tmp"
mv --no-target-directory "${wrapperDir}-tmp" "${wrapperDir}"
rm --force --recursive "$old"
else
# For initial setup
ln --symbolic "$wrapperDir" "${wrapperDir}"
fi
'';
};
###### wrappers consistency checks
system.checks = lib.singleton (
pkgs.runCommand "ensure-all-wrappers-paths-exist"
{
preferLocalBuild = true;
}
''
# make sure we produce output
mkdir -p $out
echo -n "Checking that Nix store paths of all wrapped programs exist... "
declare -A wrappers
${lib.concatStringsSep "\n" (lib.mapAttrsToList (n: v: "wrappers['${n}']='${v.source}'") wrappers)}
for name in "''${!wrappers[@]}"; do
path="''${wrappers[$name]}"
if [[ "$path" =~ /nix/store ]] && [ ! -e "$path" ]; then
test -t 1 && echo -ne '\033[1;31m'
echo "FAIL"
echo "The path $path does not exist!"
echo 'Please, check the value of `security.wrappers."'$name'".source`.'
test -t 1 && echo -ne '\033[0m'
exit 1
fi
done
echo "OK"
''
);
};
echo "OK"
''
);
})
];
}
nixos/modules/services/audio/navidrome.nix
+65 -3
View File
@@ -7,13 +7,18 @@
let
inherit (lib)
literalExpression
mkDefault
mkEnableOption
mkPackageOption
mkOption
maintainers
;
inherit (lib.types)
addCheck
bool
listOf
package
port
str
submodule
@@ -29,6 +34,37 @@ in
package = mkPackageOption pkgs "navidrome" { };
plugins = mkOption {
type = listOf (
addCheck package (p: p.isNavidromePlugin or false)
// {
name = "navidrome plugin";
description = "package that is a navidrome plugin";
}
);
default = [ ];
description = "List of Navidrome plugins";
example = literalExpression ''
with pkgs.navidromePlugins; [
listenbrainz-daily-playlist
];
'';
};
finalPackage = mkOption {
type = package;
readOnly = true;
default = cfg.package.override {
inherit (cfg) plugins;
};
defaultText = literalExpression ''
config.services.navidrome.package.override {
inherit (config.services.navidrome) plugins;
}
'';
description = "The final navidrome package including all selected plugins.";
};
settings = mkOption {
type = submodule {
freeformType = settingsFormat.type;
@@ -51,6 +87,29 @@ in
description = "Enable anonymous usage data collection, see <https://www.navidrome.org/docs/getting-started/insights/> for details.";
type = bool;
};
Plugins = {
Enabled = mkOption {
default = (builtins.length cfg.plugins) != 0;
defaultText = literalExpression "builtins.length \"\${config.services.navidrome.plugins != 0}\"";
description = ''
Enable plugin support in navidrome.
This is automatically enabled if {option}`services.navidrome.plugins` is used.
'';
};
Folder = mkOption {
default = "${cfg.finalPackage}/share/plugins";
description = ''
The folder containing navidrome plugins.
This directory is automatically created from plugins defined in {option}`services.navidrome.plugins`.
'';
readOnly = true;
type = str;
defaultText = literalExpression "\"\${config.services.navidrome.finalPackage}/share/plugins\"";
};
};
};
};
default = { };
@@ -78,7 +137,7 @@ in
description = "Whether to open the TCP port in the firewall";
};
environmentFile = lib.mkOption {
environmentFile = mkOption {
type = lib.types.nullOr lib.types.path;
default = null;
description = "Environment file, used to set any secret ND_* environment variables.";
@@ -114,7 +173,7 @@ in
wantedBy = [ "multi-user.target" ];
serviceConfig = {
ExecStart = ''
${getExe cfg.package} --configfile ${settingsFormat.generate "navidrome.json" cfg.settings}
${getExe cfg.finalPackage} --configfile ${settingsFormat.generate "navidrome.json" cfg.settings}
'';
EnvironmentFile = lib.mkIf (cfg.environmentFile != null) [ cfg.environmentFile ];
User = cfg.user;
@@ -180,5 +239,8 @@ in
networking.firewall.allowedTCPPorts = mkIf cfg.openFirewall [ cfg.settings.Port ];
};
meta.maintainers = with maintainers; [ fsnkty ];
meta.maintainers = with maintainers; [
fsnkty
tebriel
];
}
nixos/modules/services/continuous-integration/gitea-actions-runner.nix
+15 -10
View File
@@ -12,6 +12,7 @@ let
attrValues
concatStringsSep
escapeShellArg
getExe
hasInfix
hasSuffix
optionalAttrs
@@ -36,7 +37,7 @@ let
# Check whether any runner instance label requires a container runtime
# Empty label strings result in the upstream defined defaultLabels, which require docker
# https://gitea.com/gitea/act_runner/src/tag/v0.1.5/internal/app/cmd/register.go#L93-L98
# https://gitea.com/gitea/runner/src/tag/v0.1.5/internal/app/cmd/register.go#L93-L98
hasDockerScheme =
instance: instance.labels == [ ] || any (label: hasInfix ":docker:" label) instance.labels;
wantsContainerRuntime = any hasDockerScheme (attrValues cfg.instances);
@@ -53,7 +54,7 @@ let
|| (instance.token != null && instance.tokenFile == null);
in
{
meta.maintainers = [ ];
meta.maintainers = pkgs.gitea-actions-runner.meta.maintainers;
options.services.gitea-actions-runner = with types; {
package = mkPackageOption pkgs "gitea-actions-runner" { };
@@ -123,8 +124,8 @@ in
};
settings = mkOption {
description = ''
Configuration for `act_runner daemon`.
See <https://gitea.com/gitea/act_runner/src/branch/main/internal/pkg/config/config.example.yaml> for an example configuration
Configuration for gitea-runner daemon.
See <https://gitea.com/gitea/runner/src/branch/main/internal/pkg/config/config.example.yaml> for an example configuration
'';
type = types.submodule {
@@ -239,30 +240,34 @@ in
mkdir -vp "$INSTANCE_DIR"
cd "$INSTANCE_DIR"
# force reregistration on changed labels
# force reregistration on changed token or labels
export TOKEN_HASH_FILE="$INSTANCE_DIR/.token-hash"
export TOKEN_HASH_CURRENT="$(printf '%s' "$TOKEN" | sha256sum | cut -d' ' -f1)"
export TOKEN_HASH_STORED="$(cat "$TOKEN_HASH_FILE" 2>/dev/null || echo "")"
export LABELS_FILE="$INSTANCE_DIR/.labels"
export LABELS_WANTED="$(echo ${escapeShellArg (concatStringsSep "\n" instance.labels)} | sort)"
export LABELS_CURRENT="$(cat $LABELS_FILE 2>/dev/null || echo 0)"
if [ ! -e "$INSTANCE_DIR/.runner" ] || [ "$LABELS_WANTED" != "$LABELS_CURRENT" ]; then
# remove existing registration file, so that changing the labels forces a re-registration
if [ ! -e "$INSTANCE_DIR/.runner" ] || [ "$LABELS_WANTED" != "$LABELS_CURRENT" ] || [ "$TOKEN_HASH_CURRENT" != "$TOKEN_HASH_STORED" ]; then
# remove existing registration file, so that changing the token or labels forces a re-registration
rm -v "$INSTANCE_DIR/.runner" || true
# perform the registration
${cfg.package}/bin/act_runner register --no-interactive \
${getExe cfg.package} register --no-interactive \
--instance ${escapeShellArg instance.url} \
--token "$TOKEN" \
--name ${escapeShellArg instance.name} \
--labels ${escapeShellArg (concatStringsSep "," instance.labels)} \
--config ${configFile}
# and write back the configured labels
# and write back the configured labels and token hash
printf '%s' "$TOKEN_HASH_CURRENT" > "$TOKEN_HASH_FILE"
echo "$LABELS_WANTED" > "$LABELS_FILE"
fi
'')
];
ExecStart = "${cfg.package}/bin/act_runner daemon --config ${configFile}";
ExecStart = "${getExe cfg.package} daemon --config ${configFile}";
SupplementaryGroups =
optionals wantsDocker [
"docker"

Some files were not shown because too many files have changed in this diff Show More