diff --git a/lib/systems/platforms.nix b/lib/systems/platforms.nix index b10c787728a0..7c49b40e53d4 100644 --- a/lib/systems/platforms.nix +++ b/lib/systems/platforms.nix @@ -152,11 +152,6 @@ rec { DTB = true; autoModules = true; preferBuiltin = true; - extraConfig = '' - # The default (=y) forces us to have the XHCI firmware available in initrd, - # which our initrd builder can't currently do easily. - USB_XHCI_TEGRA m - ''; target = "Image"; }; gcc = { diff --git a/nixos/doc/manual/release-notes/rl-2611.section.md b/nixos/doc/manual/release-notes/rl-2611.section.md index fe8b342d5630..5d9cc78190ec 100644 --- a/nixos/doc/manual/release-notes/rl-2611.section.md +++ b/nixos/doc/manual/release-notes/rl-2611.section.md @@ -24,6 +24,8 @@ - Python 2 has been removed from the top-level package set, as it is long past end-of-life. The `python2`, `python27`, `python2Full`, `python27Full`, `python2Packages`, and `python27Packages` attributes, along with the legacy `python`, `pythonFull`, and `pythonPackages` aliases, now throw an error directing you to `python3`. The `isPy2` and `isPy27` package flags have been removed accordingly. The only remaining Python 2 interpreter is vendored inside the `resholve` package for its `oil` dependency and is not exposed for general use. +- `systemd.user.extraConfig` has been removed in favor of the structured [](#opt-systemd.user.settings.Manager) option. Use `systemd.user.settings.Manager` to set any `systemd-user.conf(5)` option directly. For example, replace `systemd.user.extraConfig = "DefaultTimeoutStartSec=60";` with `systemd.user.settings.Manager.DefaultTimeoutStartSec = 60;`. + - `services.timesyncd.extraConfig` has been removed in favor of the structured [](#opt-services.timesyncd.settings.Time) option. Use `services.timesyncd.settings.Time` to set any `timesyncd.conf(5)` option directly. For example, replace `services.timesyncd.extraConfig = "PollIntervalMaxSec=180";` with `services.timesyncd.settings.Time.PollIntervalMaxSec = 180;`. - `services.firezone.server.provision` has been removed due to it being unmaintanable. Remove all uses of provisioning and use the WebUI to configure firezone. diff --git a/nixos/lib/testing/driver.nix b/nixos/lib/testing/driver.nix index f740dd3cbdf6..7a4c7e31a0e1 100644 --- a/nixos/lib/testing/driver.nix +++ b/nixos/lib/testing/driver.nix @@ -14,7 +14,7 @@ let inherit (config) sshBackdoor; - inherit (hostPkgs.stdenv.hostPlatform) isLinux; + inherit (hostPkgs.stdenv.hostPlatform) isLinux isAarch64; # Reifies and correctly wraps the python test driver for # the respective qemu version and with or without ocr support @@ -256,6 +256,10 @@ in # # If needed, this can still be turned off. virtualisation.qemu.enableSharedMemory = lib.mkDefault isLinux; + # Needed for screenshots to work (in e.g `nixosTests.login`) + virtualisation.qemu.options = lib.optionals (isLinux && isAarch64) [ + "-device virtio-gpu-pci" + ]; assertions = [ { diff --git a/nixos/modules/config/users-groups.nix b/nixos/modules/config/users-groups.nix index 8291f55f37cb..c92872d26775 100644 --- a/nixos/modules/config/users-groups.nix +++ b/nixos/modules/config/users-groups.nix @@ -950,32 +950,8 @@ in }; }; - # Warn about user accounts with deprecated password hashing schemes - # This does not work when the users and groups are created by - # systemd-sysusers because the users are created too late then. - system.activationScripts.hashes = - if !config.systemd.sysusers.enable && !config.services.userborn.enable then - { - deps = [ "users" ]; - text = '' - users=() - while IFS=: read -r user hash _; do - if [[ "$hash" = "$"* && ! "$hash" =~ ^\''$${cryptSchemeIdPatternGroup}\$ ]]; then - users+=("$user") - fi - done _ file, or finally, /etc/nixos/system.nix. + Using this option disables automatic flake detection, same as + *--no-flake*. *--flake* _flake-uri[#name]_, *-F* _flake-uri[#name]_ Build the NixOS system from the specified flake. It defaults to the @@ -379,6 +382,10 @@ NIX_SSHOPTS NIX_SUDOOPTS Additional options to be passed to sudo on the command line. +NIXOS_REBUILD_NO_SYSTEMD_RUN + If set, then *nixos-rebuild* will run without the + _systemd-run_ wrapper. + # FILES /etc/nixos/system.nix diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py index c1ad2bde3d00..db0fe7a4ec5c 100644 --- a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py +++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py @@ -329,6 +329,10 @@ def parse_args( if args.flake and (args.file or args.attr): parser.error("--flake cannot be used with --file or --attr") + if (args.file or args.attr) and args.flake is None: + # Disable flake auto-detection when --file or --attr is used + args.flake = False + if args.store_path: if args.rollback: parser.error("--store-path and --rollback are mutually exclusive") diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py index c9d79868f8f4..4fbe7fbe2b9d 100644 --- a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py +++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py @@ -708,6 +708,8 @@ def switch_to_configuration( "not working in target host" ) cmd = [] + elif os.environ.get("NIXOS_REBUILD_NO_SYSTEMD_RUN"): + cmd = [] run_wrapper( [*cmd, path_to_config / "bin/switch-to-configuration", str(action)], diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_main.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_main.py index 1e0e5779ac90..12bacafba8d5 100644 --- a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_main.py +++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_main.py @@ -89,6 +89,22 @@ def test_parse_args() -> None: assert r_store_path.flake is False assert r_store_path.store_path == "/nix/store/foo" + # --file and --attr should disable flake auto-detection + r_file, _ = nr.parse_args(["nixos-rebuild", "switch", "--file", "foo.nix"]) + assert r_file.flake is False + assert r_file.file == "foo.nix" + + r_attr, _ = nr.parse_args(["nixos-rebuild", "switch", "--attr", "bar"]) + assert r_attr.flake is False + assert r_attr.attr == "bar" + + r_file_attr, _ = nr.parse_args( + ["nixos-rebuild", "switch", "--file", "foo.nix", "--attr", "bar"] + ) + assert r_file_attr.flake is False + assert r_file_attr.file == "foo.nix" + assert r_file_attr.attr == "bar" + r1, g1 = nr.parse_args( [ "nixos-rebuild", diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py index 8100f396cdb7..1cdccc9a874e 100644 --- a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py +++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py @@ -819,6 +819,38 @@ def test_switch_to_configuration_without_systemd_run( ) +@patch(get_qualified_name(n.run_wrapper, n), autospec=True) +def test_switch_to_configuration_without_systemd_run_env_var( + mock_run: Any, monkeypatch: MonkeyPatch +) -> None: + profile_path = Path("/path/to/profile") + mock_run.return_value = CompletedProcess([], 0) + + with monkeypatch.context() as mp: + mp.setenv("LOCALE_ARCHIVE", "") + mp.setenv("NIXOS_REBUILD_NO_SYSTEMD_RUN", "1") + + n.switch_to_configuration( + profile_path, + m.Action.SWITCH, + elevate=e.NO_ELEVATOR, + target_host=None, + specialisation=None, + install_bootloader=False, + ) + mock_run.assert_called_with( + [profile_path / "bin/switch-to-configuration", "switch"], + env={ + "LOCALE_ARCHIVE": e.PRESERVE_ENV, + "NIXOS_NO_CHECK": e.PRESERVE_ENV, + "NIXOS_INSTALL_BOOTLOADER": "0", + }, + elevate=e.NO_ELEVATOR, + remote=None, + stdout=sys.stderr, + ) + + @patch(get_qualified_name(n.run_wrapper, n), autospec=True) def test_switch_to_configuration_with_systemd_run( mock_run: Mock, monkeypatch: MonkeyPatch diff --git a/pkgs/by-name/ru/ruff/package.nix b/pkgs/by-name/ru/ruff/package.nix index 75992b42240e..8566e5251408 100644 --- a/pkgs/by-name/ru/ruff/package.nix +++ b/pkgs/by-name/ru/ruff/package.nix @@ -16,7 +16,7 @@ rustPlatform.buildRustPackage (finalAttrs: { pname = "ruff"; - version = "0.15.15"; + version = "0.15.16"; __structuredAttrs = true; @@ -24,12 +24,12 @@ rustPlatform.buildRustPackage (finalAttrs: { owner = "astral-sh"; repo = "ruff"; tag = finalAttrs.version; - hash = "sha256-WpjOOCYLZ1d8XPUx3qNHD+fuK6t65u/1/ZezABWpBD0="; + hash = "sha256-krmHCLijp+D4gBjKV9cdicPob4ry5I6QwB3MUz0z7zA="; }; cargoBuildFlags = [ "--package=ruff" ]; - cargoHash = "sha256-SfkoLl43Y1DNqIRW+HljVcEHWhedTS99SGhMvkQ4dmo="; + cargoHash = "sha256-d2iV7iWf7lVhj1Bbaxxk5Zao4KK3oC7whppRvk0erzA="; nativeBuildInputs = [ installShellFiles ]; diff --git a/pkgs/by-name/ty/ty/package.nix b/pkgs/by-name/ty/ty/package.nix index 8b1c65bf1be6..fad959f944ae 100644 --- a/pkgs/by-name/ty/ty/package.nix +++ b/pkgs/by-name/ty/ty/package.nix @@ -17,7 +17,7 @@ rustPlatform.buildRustPackage (finalAttrs: { pname = "ty"; - version = "0.0.40"; + version = "0.0.44"; __structuredAttrs = true; src = fetchFromGitHub { @@ -25,7 +25,7 @@ rustPlatform.buildRustPackage (finalAttrs: { repo = "ty"; tag = finalAttrs.version; fetchSubmodules = true; - hash = "sha256-kdfPnyQXYtf3BDrYCFGfX0bMoPGjRpyH3aUeRZBiUKY="; + hash = "sha256-P19+C6u0mkIrR0H8M/l7Wn3r8JSY4Ul9p64oXaLdWCQ="; }; # For Darwin platforms, remove the integration test for file notifications, @@ -39,7 +39,7 @@ rustPlatform.buildRustPackage (finalAttrs: { cargoBuildFlags = [ "--package=ty" ]; - cargoHash = "sha256-yUbHTzUGNdpm3b1s/SkcpFGdp7WjN+xO+CVrPPwrh6A="; + cargoHash = "sha256-d2iV7iWf7lVhj1Bbaxxk5Zao4KK3oC7whppRvk0erzA="; nativeBuildInputs = [ installShellFiles ]; buildInputs = [ rust-jemalloc-sys ]; diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix index e5f06e7d481d..f46e25f2c6be 100644 --- a/pkgs/os-specific/linux/kernel/common-config.nix +++ b/pkgs/os-specific/linux/kernel/common-config.nix @@ -248,6 +248,10 @@ let BOUNCE = option yes; }; + iommu = lib.optionalAttrs stdenv.hostPlatform.isAarch64 { + ARM_SMMU_V3_SVA = whenAtLeast "5.9" yes; + }; + memtest = { MEMTEST = yes; }; @@ -672,6 +676,10 @@ let USB_DWC3_DUAL_ROLE = yes; USB_XHCI_SIDEBAND = whenAtLeast "6.16" yes; # needed for audio offload + + # The default (=y) forces us to have the XHCI firmware available in initrd, + # which our initrd builder can't currently do easily. + USB_XHCI_TEGRA = lib.mkIf stdenv.hostPlatform.isAarch64 module; }; usb-serial = { @@ -798,7 +806,9 @@ let FORTIFY_SOURCE = option yes; # https://googleprojectzero.blogspot.com/2019/11/bad-binder-android-in-wild-exploit.html - DEBUG_LIST = yes; + DEBUG_LIST = whenOlder "6.6" yes; + # https://git.kernel.org/torvalds/c/aebc7b0d8d91bbc69e976909963046bc48bca4fd + LIST_HARDENED = whenAtLeast "6.6" yes; HARDENED_USERCOPY = yes; RANDOMIZE_BASE = option yes; diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json index f2e87f79b99c..a44bc74bacac 100644 --- a/pkgs/os-specific/linux/kernel/kernels-org.json +++ b/pkgs/os-specific/linux/kernel/kernels-org.json @@ -1,7 +1,7 @@ { "testing": { - "version": "7.1-rc6", - "hash": "sha256:1fmbsjhdrkzim6vzqc40raikv1szfw28q0lbvap8a1g77an0qi58", + "version": "7.1-rc7", + "hash": "sha256:1jncfqvbiwsvvhiqs23paiy7xvsbmqcpxj02jwvy0albp16kfxd7", "lts": false }, "6.1": { @@ -25,18 +25,18 @@ "lts": true }, "6.12": { - "version": "6.12.92", - "hash": "sha256:0gly5wld3x8l0f3zk9pspsw1q2d7zbjbx4c2ndb49b1wvfvpdqqg", + "version": "6.12.93", + "hash": "sha256:18sg154hqw8l98pfim2hjm1y604h5dwn9gj3gyncas8bgjl4h9j9", "lts": true }, "6.18": { - "version": "6.18.34", - "hash": "sha256:0q6palsvwx0gnisjr658hlngfpvyzv0k5q4pvdk23122zcr4f334", + "version": "6.18.35", + "hash": "sha256:0dpjprjzc4w44kw49jcgx1ffrm6gxn2gsnsz3hhmw4hr4a9h51pp", "lts": true }, "7.0": { - "version": "7.0.11", - "hash": "sha256:012307ni1v555a1rgzsxsg99pj8fplrghvhw0jk3c4d0vmb86v75", + "version": "7.0.12", + "hash": "sha256:1nk5lans9qg1avmmcwyadfps43d3hyjz9a5gjyvsc77w3sjckvap", "lts": false } } diff --git a/pkgs/pkgs-lib/formats.nix b/pkgs/pkgs-lib/formats.nix index 2f3e5ad9d191..57517472e08f 100644 --- a/pkgs/pkgs-lib/formats.nix +++ b/pkgs/pkgs-lib/formats.nix @@ -142,14 +142,12 @@ optionalAttrs allowAliases aliases runCommand name { nativeBuildInputs = [ jq ]; - value = builtins.toJSON value; + inherit value; preferLocalBuild = true; __structuredAttrs = true; } '' - valuePath="$TMPDIR/value" - printf "%s" "$value" > "$valuePath" - jq . "$valuePath" > $out + jq .value "$NIX_ATTRS_JSON_FILE" > $out '' ) { }; @@ -167,14 +165,12 @@ optionalAttrs allowAliases aliases runCommand name { nativeBuildInputs = [ remarshal_0_17 ]; - value = builtins.toJSON value; + inherit value; preferLocalBuild = true; __structuredAttrs = true; } '' - valuePath="$TMPDIR/value" - printf "%s" "$value" > "$valuePath" - json2yaml "$valuePath" "$out" + json2yaml --unwrap value "$NIX_ATTRS_JSON_FILE" "$out" '' ) { }; @@ -192,14 +188,12 @@ optionalAttrs allowAliases aliases runCommand name { nativeBuildInputs = [ remarshal ]; - value = builtins.toJSON value; + inherit value; preferLocalBuild = true; __structuredAttrs = true; } '' - valuePath="$TMPDIR/value" - printf "%s" "$value" > "$valuePath" - json2yaml "$valuePath" "$out" + json2yaml --unwrap value "$NIX_ATTRS_JSON_FILE" "$out" '' ) { }; @@ -938,8 +932,8 @@ optionalAttrs allowAliases aliases python3 black ]; - imports = builtins.toJSON (value._imports or [ ]); - value = builtins.toJSON (removeAttrs value [ "_imports" ]); + imports = value._imports or [ ]; + value = removeAttrs value [ "_imports" ]; pythonGen = pkgs.writeText "pythonGen" '' import json import os @@ -962,26 +956,20 @@ optionalAttrs allowAliases aliases else: return repr(value) - with open(os.environ["importsPath"], "r") as f: - imports = json.load(f) - if imports is not None: - for i in imports: + with open(os.environ["NIX_ATTRS_JSON_FILE"], "r") as f: + attrs = json.load(f) + if attrs["imports"] is not None: + for i in attrs["imports"]: print(f"import {i}") print() - with open(os.environ["valuePath"], "r") as f: - for key, value in json.load(f).items(): + for key, value in attrs["value"].items(): print(f"{key} = {recursive_repr(value)}") ''; preferLocalBuild = true; __structuredAttrs = true; } '' - export importsPath="$TMPDIR/imports" - printf "%s" "$imports" > "$importsPath" - export valuePath="$TMPDIR/value" - printf "%s" "$value" > "$valuePath" - cat "$valuePath" python3 "$pythonGen" > $out black $out '' @@ -1011,14 +999,14 @@ optionalAttrs allowAliases aliases python3Packages.xmltodict libxml2Python ]; - value = builtins.toJSON value; + inherit value; pythonGen = pkgs.writeText "pythonGen" '' import json import os import xmltodict - with open(os.environ["valuePath"], "r") as f: - print(xmltodict.unparse(json.load(f), full_document=${ + with open(os.environ["NIX_ATTRS_JSON_FILE"], "r") as f: + print(xmltodict.unparse(json.load(f)["value"], full_document=${ if withHeader then "True" else "False" }, pretty=True, indent=" " * 2)) ''; @@ -1026,8 +1014,6 @@ optionalAttrs allowAliases aliases __structuredAttrs = true; } '' - export valuePath="$TMPDIR/value" - printf "%s" "$value" > "$valuePath" python3 "$pythonGen" > $out xmllint $out > /dev/null '' diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index 9249274c6840..30674f248999 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -2258,6 +2258,10 @@ with pkgs; pinentry = if stdenv.hostPlatform.isDarwin then pinentry_mac else pinentry-gtk2; }; gnupg = gnupg24; + gnupgMinimal = gnupg.override { + enableMinimal = true; + guiSupport = false; + }; gnused = callPackage ../tools/text/gnused { }; diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix index 41af16474ddb..b58cd5bd0732 100644 --- a/pkgs/top-level/perl-packages.nix +++ b/pkgs/top-level/perl-packages.nix @@ -9997,11 +9997,11 @@ with self; DBI = buildPerlPackage { pname = "DBI"; - version = "1.644"; + version = "1.648"; src = fetchurl { - url = "mirror://cpan/authors/id/H/HM/HMBRAND/DBI-1.644.tar.gz"; - hash = "sha256-Ipe5neCeZwhmQLWQaZ4OmC+0adpjqT/ijcFHgtt6U8g="; + url = "mirror://cpan/authors/id/H/HM/HMBRAND/DBI-1.648.tgz"; + hash = "sha256-7yZqrWAQzi6rt+Rl69c8owILxYFQ9pib2Jwrj5usaoY="; }; env = lib.optionalAttrs stdenv.cc.isGNU {