From 4959eee3f3b025333957e1162bced7ddd2746347 Mon Sep 17 00:00:00 2001 From: Jamie Magee Date: Sun, 3 May 2026 20:28:07 -0700 Subject: [PATCH 01/25] nixos/systemd/user: drop `with lib;` Drop the `with utils;`, `with systemdUtils.unitOptions;` and `with lib;` blocks and qualify all references with `lib.`, `utils.systemdUtils.lib.` and `utils.systemdUtils.types.` instead. No behavioural change. --- nixos/modules/system/boot/systemd/user.nix | 91 +++++++++++----------- 1 file changed, 44 insertions(+), 47 deletions(-) diff --git a/nixos/modules/system/boot/systemd/user.nix b/nixos/modules/system/boot/systemd/user.nix index 5161a5a2c2ff..baddfb1219ee 100644 --- a/nixos/modules/system/boot/systemd/user.nix +++ b/nixos/modules/system/boot/systemd/user.nix @@ -5,16 +5,13 @@ utils, ... }: -with utils; -with systemdUtils.unitOptions; -with lib; let cfg = config.systemd.user; systemd = config.systemd.package; - inherit (systemdUtils.lib) + inherit (utils.systemdUtils.lib) generateUnits targetToUnit serviceToUnit @@ -53,7 +50,7 @@ let user ? null, }: let - suffix = optionalString (user != null) "-${user}"; + suffix = lib.optionalString (user != null) "-${user}"; in pkgs.writeTextFile { name = "nixos-user-tmpfiles.d${suffix}"; @@ -61,15 +58,15 @@ let text = '' # This file is created automatically and should not be modified. # Please change the options ‘systemd.user.tmpfiles’ instead. - ${concatStringsSep "\n" rules} + ${lib.concatStringsSep "\n" rules} ''; }; in { options = { - systemd.user.extraConfig = mkOption { + systemd.user.extraConfig = lib.mkOption { default = ""; - type = types.lines; + type = lib.types.lines; example = "DefaultTimeoutStartSec=60"; description = '' Extra config options for systemd user instances. See {manpage}`systemd-user.conf(5)` for @@ -77,58 +74,58 @@ in ''; }; - systemd.user.units = mkOption { + systemd.user.units = lib.mkOption { description = "Definition of systemd per-user units."; default = { }; - type = systemdUtils.types.units; + type = utils.systemdUtils.types.units; }; - systemd.user.paths = mkOption { + systemd.user.paths = lib.mkOption { default = { }; - type = systemdUtils.types.paths; + type = utils.systemdUtils.types.paths; description = "Definition of systemd per-user path units."; }; - systemd.user.services = mkOption { + systemd.user.services = lib.mkOption { default = { }; - type = systemdUtils.types.services; + type = utils.systemdUtils.types.services; description = "Definition of systemd per-user service units."; }; - systemd.user.slices = mkOption { + systemd.user.slices = lib.mkOption { default = { }; - type = systemdUtils.types.slices; + type = utils.systemdUtils.types.slices; description = "Definition of systemd per-user slice units."; }; - systemd.user.sockets = mkOption { + systemd.user.sockets = lib.mkOption { default = { }; - type = systemdUtils.types.sockets; + type = utils.systemdUtils.types.sockets; description = "Definition of systemd per-user socket units."; }; - systemd.user.targets = mkOption { + systemd.user.targets = lib.mkOption { default = { }; - type = systemdUtils.types.targets; + type = utils.systemdUtils.types.targets; description = "Definition of systemd per-user target units."; }; - systemd.user.timers = mkOption { + systemd.user.timers = lib.mkOption { default = { }; - type = systemdUtils.types.timers; + type = utils.systemdUtils.types.timers; description = "Definition of systemd per-user timer units."; }; systemd.user.tmpfiles = { enable = - (mkEnableOption "systemd user units systemd-tmpfiles-setup.service and systemd-tmpfiles-clean.timer") + (lib.mkEnableOption "systemd user units systemd-tmpfiles-setup.service and systemd-tmpfiles-clean.timer") // { default = true; example = false; }; - rules = mkOption { - type = types.listOf types.str; + rules = lib.mkOption { + type = lib.types.listOf lib.types.str; default = [ ]; example = [ "D %C - - - 7d" ]; description = '' @@ -139,17 +136,17 @@ in ''; }; - users = mkOption { + users = lib.mkOption { description = '' Per-user rules for creation, deletion and cleaning of volatile and temporary files automatically. ''; default = { }; - type = types.attrsOf ( - types.submodule { + type = lib.types.attrsOf ( + lib.types.submodule { options = { - rules = mkOption { - type = types.listOf types.str; + rules = lib.mkOption { + type = lib.types.listOf lib.types.str; default = [ ]; example = [ "D %C - - - 7d" ]; description = '' @@ -165,8 +162,8 @@ in }; }; - systemd.user.generators = mkOption { - type = types.attrsOf types.path; + systemd.user.generators = lib.mkOption { + type = lib.types.attrsOf lib.types.path; default = { }; example = { systemd-gpt-auto-generator = "/dev/null"; @@ -179,9 +176,9 @@ in ''; }; - systemd.additionalUpstreamUserUnits = mkOption { + systemd.additionalUpstreamUserUnits = lib.mkOption { default = [ ]; - type = types.listOf types.str; + type = lib.types.listOf lib.types.str; example = [ ]; description = '' Additional units shipped with systemd that should be enabled for per-user systemd instances. @@ -210,22 +207,22 @@ in }; systemd.user.units = - mapAttrs' (n: v: nameValuePair "${n}.path" (pathToUnit v)) cfg.paths - // mapAttrs' (n: v: nameValuePair "${n}.service" (serviceToUnit v)) cfg.services - // mapAttrs' (n: v: nameValuePair "${n}.slice" (sliceToUnit v)) cfg.slices - // mapAttrs' (n: v: nameValuePair "${n}.socket" (socketToUnit v)) cfg.sockets - // mapAttrs' (n: v: nameValuePair "${n}.target" (targetToUnit v)) cfg.targets - // mapAttrs' (n: v: nameValuePair "${n}.timer" (timerToUnit v)) cfg.timers; + lib.mapAttrs' (n: v: lib.nameValuePair "${n}.path" (pathToUnit v)) cfg.paths + // lib.mapAttrs' (n: v: lib.nameValuePair "${n}.service" (serviceToUnit v)) cfg.services + // lib.mapAttrs' (n: v: lib.nameValuePair "${n}.slice" (sliceToUnit v)) cfg.slices + // lib.mapAttrs' (n: v: lib.nameValuePair "${n}.socket" (socketToUnit v)) cfg.sockets + // lib.mapAttrs' (n: v: lib.nameValuePair "${n}.target" (targetToUnit v)) cfg.targets + // lib.mapAttrs' (n: v: lib.nameValuePair "${n}.timer" (timerToUnit v)) cfg.timers; systemd.user.timers = { # enable systemd user tmpfiles - systemd-tmpfiles-clean.wantedBy = optional cfg.tmpfiles.enable "timers.target"; + systemd-tmpfiles-clean.wantedBy = lib.optional cfg.tmpfiles.enable "timers.target"; } # Generate timer units for all services that have a ‘startAt’ value. - // (mapAttrs (name: service: { + // (lib.mapAttrs (name: service: { wantedBy = [ "timers.target" ]; timerConfig.OnCalendar = service.startAt; - }) (filterAttrs (name: service: service.startAt != [ ]) cfg.services)); + }) (lib.filterAttrs (name: service: service.startAt != [ ]) cfg.services)); # Provide the systemd-user PAM service, required to run systemd # user instances. @@ -244,18 +241,18 @@ in systemd.services.systemd-user-sessions.restartIfChanged = false; # Restart kills all active sessions. # enable systemd user tmpfiles - systemd.user.services.systemd-tmpfiles-setup.wantedBy = optional cfg.tmpfiles.enable "basic.target"; + systemd.user.services.systemd-tmpfiles-setup.wantedBy = lib.optional cfg.tmpfiles.enable "basic.target"; # /run/current-system/sw/etc/xdg is in systemd's $XDG_CONFIG_DIRS so we can # write the tmpfiles.d rules for everyone there - environment.systemPackages = optional (cfg.tmpfiles.rules != [ ]) (writeTmpfiles { + environment.systemPackages = lib.optional (cfg.tmpfiles.rules != [ ]) (writeTmpfiles { inherit (cfg.tmpfiles) rules; }); # /etc/profiles/per-user/$USER/etc/xdg is in systemd's $XDG_CONFIG_DIRS so # we can write a single user's tmpfiles.d rules there - users.users = mapAttrs (user: cfg': { - packages = optional (cfg'.rules != [ ]) (writeTmpfiles { + users.users = lib.mapAttrs (user: cfg': { + packages = lib.optional (cfg'.rules != [ ]) (writeTmpfiles { inherit (cfg') rules; inherit user; }); From 0522a75d354be5d3de10291751d7d58fb4ab84a3 Mon Sep 17 00:00:00 2001 From: Jamie Magee Date: Sun, 3 May 2026 20:31:01 -0700 Subject: [PATCH 02/25] nixos/systemd/user: migrate to RFC 42-style settings Replace `systemd.user.extraConfig` with a freeform `systemd.user.settings.Manager` submodule, rendered via `utils.systemdUtils.lib.settingsToSections`. `extraConfig` is removed via `mkRemovedOptionModule`. Mirrors the existing `systemd.settings.Manager` migration of the system-side manager. Updates the two in-tree consumers (`nixos/modules/testing/test-instrumentation.nix` and `nixos/tests/systemd.nix`) to the new option. Adds `nixos/tests/systemd-user-settings` to assert the rendered `user.conf` contents. --- .../manual/release-notes/rl-2611.section.md | 2 ++ nixos/modules/system/boot/systemd/user.nix | 32 ++++++++++++------- .../modules/testing/test-instrumentation.nix | 8 ++--- nixos/tests/all-tests.nix | 1 + nixos/tests/systemd-user-settings.nix | 24 ++++++++++++++ nixos/tests/systemd.nix | 2 +- 6 files changed, 53 insertions(+), 16 deletions(-) create mode 100644 nixos/tests/systemd-user-settings.nix diff --git a/nixos/doc/manual/release-notes/rl-2611.section.md b/nixos/doc/manual/release-notes/rl-2611.section.md index 3d53f1f20930..354c12f4d63e 100644 --- a/nixos/doc/manual/release-notes/rl-2611.section.md +++ b/nixos/doc/manual/release-notes/rl-2611.section.md @@ -23,6 +23,8 @@ no longer sets `programs.pqos-wrapper.enable = true` as the corresponding module has been deleted. +- `systemd.user.extraConfig` has been removed in favor of the structured [](#opt-systemd.user.settings.Manager) option. Use `systemd.user.settings.Manager` to set any `systemd-user.conf(5)` option directly. For example, replace `systemd.user.extraConfig = "DefaultTimeoutStartSec=60";` with `systemd.user.settings.Manager.DefaultTimeoutStartSec = 60;`. + ## Other Notable Changes {#sec-release-26.11-notable-changes} diff --git a/nixos/modules/system/boot/systemd/user.nix b/nixos/modules/system/boot/systemd/user.nix index baddfb1219ee..6a5b2657446b 100644 --- a/nixos/modules/system/boot/systemd/user.nix +++ b/nixos/modules/system/boot/systemd/user.nix @@ -63,14 +63,26 @@ let }; in { + imports = [ + (lib.mkRemovedOptionModule [ + "systemd" + "user" + "extraConfig" + ] "Use systemd.user.settings.Manager instead.") + ]; + options = { - systemd.user.extraConfig = lib.mkOption { - default = ""; - type = lib.types.lines; - example = "DefaultTimeoutStartSec=60"; + systemd.user.settings.Manager = lib.mkOption { + default = { }; + type = lib.types.submodule { + freeformType = lib.types.attrsOf utils.systemdUtils.unitOptions.unitOption; + }; + example = { + DefaultTimeoutStartSec = 60; + }; description = '' - Extra config options for systemd user instances. See {manpage}`systemd-user.conf(5)` for - available options. + Settings for systemd user instances. See {manpage}`systemd-user.conf(5)` + for available options. ''; }; @@ -200,10 +212,7 @@ in upstreamWants = [ ]; }; - "systemd/user.conf".text = '' - [Manager] - ${cfg.extraConfig} - ''; + "systemd/user.conf".text = utils.systemdUtils.lib.settingsToSections cfg.settings; }; systemd.user.units = @@ -241,7 +250,8 @@ in systemd.services.systemd-user-sessions.restartIfChanged = false; # Restart kills all active sessions. # enable systemd user tmpfiles - systemd.user.services.systemd-tmpfiles-setup.wantedBy = lib.optional cfg.tmpfiles.enable "basic.target"; + systemd.user.services.systemd-tmpfiles-setup.wantedBy = + lib.optional cfg.tmpfiles.enable "basic.target"; # /run/current-system/sw/etc/xdg is in systemd's $XDG_CONFIG_DIRS so we can # write the tmpfiles.d rules for everyone there diff --git a/nixos/modules/testing/test-instrumentation.nix b/nixos/modules/testing/test-instrumentation.nix index d697a5197272..4d20b20090b4 100644 --- a/nixos/modules/testing/test-instrumentation.nix +++ b/nixos/modules/testing/test-instrumentation.nix @@ -238,11 +238,11 @@ in ''; systemd.settings.Manager = managerSettings; - systemd.user.extraConfig = '' + systemd.user.settings.Manager = { # Allow very slow start - DefaultTimeoutStartSec=300 - DefaultDeviceTimeoutSec=300 - ''; + DefaultTimeoutStartSec = 300; + DefaultDeviceTimeoutSec = 300; + }; boot.consoleLogLevel = 7; diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix index e653dc42b9c2..cab52851cf6d 100644 --- a/nixos/tests/all-tests.nix +++ b/nixos/tests/all-tests.nix @@ -1656,6 +1656,7 @@ in systemd-timesyncd-nscd-dnssec = runTest ./systemd-timesyncd-nscd-dnssec.nix; systemd-user-linger = runTest ./systemd-user-linger.nix; systemd-user-linger-purge = runTest ./systemd-user-linger-purge.nix; + systemd-user-settings = runTest ./systemd-user-settings.nix; systemd-user-tmpfiles-rules = runTest ./systemd-user-tmpfiles-rules.nix; systemd-userdbd = runTest ./systemd-userdbd.nix; systemtap = handleTest ./systemtap.nix { }; diff --git a/nixos/tests/systemd-user-settings.nix b/nixos/tests/systemd-user-settings.nix new file mode 100644 index 000000000000..8e70c07a8656 --- /dev/null +++ b/nixos/tests/systemd-user-settings.nix @@ -0,0 +1,24 @@ +{ + name = "systemd-user-settings"; + meta = { + maintainers = [ ]; + }; + + nodes.machine = + { lib, ... }: + { + systemd.user.settings.Manager = { + DefaultTimeoutStartSec = lib.mkForce "60"; + DefaultEnvironment = "FOO=bar"; + }; + }; + + testScript = '' + machine.wait_for_unit("multi-user.target") + + with subtest("settings.Manager renders user.conf"): + machine.succeed("grep -F '[Manager]' /etc/systemd/user.conf") + machine.succeed("grep -F 'DefaultTimeoutStartSec=60' /etc/systemd/user.conf") + machine.succeed("grep -F 'DefaultEnvironment=FOO=bar' /etc/systemd/user.conf") + ''; +} diff --git a/nixos/tests/systemd.nix b/nixos/tests/systemd.nix index 98cc88a0326f..2dcce9aec6b0 100644 --- a/nixos/tests/systemd.nix +++ b/nixos/tests/systemd.nix @@ -34,7 +34,7 @@ RebootWatchdogSec = "10min"; KExecWatchdogSec = "5min"; }; - systemd.user.extraConfig = "DefaultEnvironment=\"XXX_USER=bar\""; + systemd.user.settings.Manager.DefaultEnvironment = "\"XXX_USER=bar\""; services.journald.extraConfig = "Storage=volatile"; test-support.displayManager.auto.user = "alice"; From 5197842329d5153bc5a3ace63bd7e7d9dc97c83c Mon Sep 17 00:00:00 2001 From: r-vdp Date: Sun, 31 May 2026 20:08:04 +0300 Subject: [PATCH 03/25] nixos/systemd: ship time-set.target time-sync.target has Wants/After=time-set.target, every OnCalendar= timer gains an implicit After=time-set.target, and systemd.special(7) documents it as the hook for "system clock has been set from a local source". Without the unit file the target is not-found, so WantedBy=time-set.target on third-party units is silently ignored and the timer ordering is a no-op. --- nixos/modules/system/boot/systemd.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/nixos/modules/system/boot/systemd.nix b/nixos/modules/system/boot/systemd.nix index 7227ac4277e7..f48256a599a5 100644 --- a/nixos/modules/system/boot/systemd.nix +++ b/nixos/modules/system/boot/systemd.nix @@ -40,6 +40,7 @@ let "network-online.target" "nss-lookup.target" "nss-user-lookup.target" + "time-set.target" "time-sync.target" "first-boot-complete.target" ] From 2e1d60e197e2c5f5724424e2a24b58cca2631953 Mon Sep 17 00:00:00 2001 From: azuwis Date: Mon, 1 Jun 2026 20:05:16 +0800 Subject: [PATCH 04/25] nixos-rebuild-ng: disable flake auto-detection when --file or --attr is used When --file or --attr is explicitly passed, flake auto-detection should not override the user's intent to use a non-flake configuration. --- pkgs/by-name/ni/nixos-rebuild-ng/nixos-rebuild.8.scd | 5 ++++- .../ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py | 4 ++++ 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/nixos-rebuild.8.scd b/pkgs/by-name/ni/nixos-rebuild-ng/nixos-rebuild.8.scd index 7ec6def5ca21..48a0fb8312d1 100644 --- a/pkgs/by-name/ni/nixos-rebuild-ng/nixos-rebuild.8.scd +++ b/pkgs/by-name/ni/nixos-rebuild-ng/nixos-rebuild.8.scd @@ -314,13 +314,16 @@ It must be one of the following: be made using _nixos_ function in nixpkgs or importing and calling nixos/lib/eval-config.nix from nixpkgs. If specified without *--attr* option, builds the configuration from the top-level attribute set of the - file. + file. Using this option disables automatic flake detection, same as + *--no-flake*. *--attr* _attrPath_, *-A* _attrPath_ Build the NixOS system from a nix file and use the specified attribute path from the file specified by the *--file* option. If specified without *--file* option, uses _system.nix_ in current directory, the system-wide __ file, or finally, /etc/nixos/system.nix. + Using this option disables automatic flake detection, same as + *--no-flake*. *--flake* _flake-uri[#name]_, *-F* _flake-uri[#name]_ Build the NixOS system from the specified flake. It defaults to the diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py index c1ad2bde3d00..db0fe7a4ec5c 100644 --- a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py +++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py @@ -329,6 +329,10 @@ def parse_args( if args.flake and (args.file or args.attr): parser.error("--flake cannot be used with --file or --attr") + if (args.file or args.attr) and args.flake is None: + # Disable flake auto-detection when --file or --attr is used + args.flake = False + if args.store_path: if args.rollback: parser.error("--store-path and --rollback are mutually exclusive") From 5f567ce58ece474229a4d21e5e9d7133bb94a991 Mon Sep 17 00:00:00 2001 From: Jost Alemann Date: Mon, 1 Jun 2026 15:07:53 +0200 Subject: [PATCH 05/25] ty: 0.0.40 -> 0.0.42 Changelog: https://github.com/astral-sh/ty/releases/tag/0.0.42 Diff: https://github.com/astral-sh/ty/compare/0.0.40...0.0.42 --- pkgs/by-name/ty/ty/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/ty/ty/package.nix b/pkgs/by-name/ty/ty/package.nix index 8b1c65bf1be6..29f1b3196dc0 100644 --- a/pkgs/by-name/ty/ty/package.nix +++ b/pkgs/by-name/ty/ty/package.nix @@ -17,7 +17,7 @@ rustPlatform.buildRustPackage (finalAttrs: { pname = "ty"; - version = "0.0.40"; + version = "0.0.42"; __structuredAttrs = true; src = fetchFromGitHub { @@ -25,7 +25,7 @@ rustPlatform.buildRustPackage (finalAttrs: { repo = "ty"; tag = finalAttrs.version; fetchSubmodules = true; - hash = "sha256-kdfPnyQXYtf3BDrYCFGfX0bMoPGjRpyH3aUeRZBiUKY="; + hash = "sha256-PTyxx618J08eB1eH8vdmv+R9yU4/LMP9xfk3hvze0/M="; }; # For Darwin platforms, remove the integration test for file notifications, @@ -39,7 +39,7 @@ rustPlatform.buildRustPackage (finalAttrs: { cargoBuildFlags = [ "--package=ty" ]; - cargoHash = "sha256-yUbHTzUGNdpm3b1s/SkcpFGdp7WjN+xO+CVrPPwrh6A="; + cargoHash = "sha256-dYCt0GP4b5qL/acfNe8ufdqF24yTpm5MTsjplMMKClg="; nativeBuildInputs = [ installShellFiles ]; buildInputs = [ rust-jemalloc-sys ]; From 4f55b18b6e618ee6f2f97cb2a828caf81d3d1cd2 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Tue, 2 Jun 2026 13:56:45 +0000 Subject: [PATCH 06/25] libslirp: 4.9.1 -> 4.9.3 --- pkgs/by-name/li/libslirp/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/li/libslirp/package.nix b/pkgs/by-name/li/libslirp/package.nix index ed2e91c3e706..bb7779cff8b6 100644 --- a/pkgs/by-name/li/libslirp/package.nix +++ b/pkgs/by-name/li/libslirp/package.nix @@ -10,14 +10,14 @@ stdenv.mkDerivation (finalAttrs: { pname = "libslirp"; - version = "4.9.1"; + version = "4.9.3"; src = fetchFromGitLab { domain = "gitlab.freedesktop.org"; owner = "slirp"; repo = "libslirp"; rev = "v${finalAttrs.version}"; - sha256 = "sha256-MKP3iBExaPQryiahI1l/4bTgVht5Vu8AxaDyMotqmMo="; + sha256 = "sha256-Spr3dO5ehuUlzx3EnJi8najANWOirwQcTsWTVRVXYuY="; }; separateDebugInfo = true; From 48995a6ef97c08b338838cb37578ef0aa0b46fd9 Mon Sep 17 00:00:00 2001 From: Doron Behar Date: Tue, 2 Jun 2026 17:29:05 +0300 Subject: [PATCH 07/25] nixos/virtualisation: (Aarch64) remove -device virtio-gpu-pci In 9e78baf, Aarch64 machines were added the `-device virtio-gpu-pci` argument, to mirror `-vga std` option that was added unconditionally to virtualised x86_64 machines. This also enabled screenshots on aarch64 machines to be taken in tests. Since then, in a7ca287, the `-vga std` option was removed, because that is the default value of this option embedded in QEMU since version 2.2. Removing it from the hard-coded list of qemu options makes it possible for the user to choose their own `-vga` value. Similarly, for Aarch virtualised machines, choosing unconditionally the `-device virtio-gpu-pci` option instead of e.g `-device virtio-gpu-gl-pci`, can be bothersome too - see: https://discourse.nixos.org/t/test-an-aarch64-linux-vm-wayland-compositor-from-an-x86-64-linux-host/77416/2 This commit is similar to 44c6c2ef166cc796b417d9885b966489b23a2bf9 which was reverted in #527048. --- nixos/lib/testing/driver.nix | 6 +++++- nixos/modules/virtualisation/qemu-vm.nix | 1 - 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/nixos/lib/testing/driver.nix b/nixos/lib/testing/driver.nix index f740dd3cbdf6..7a4c7e31a0e1 100644 --- a/nixos/lib/testing/driver.nix +++ b/nixos/lib/testing/driver.nix @@ -14,7 +14,7 @@ let inherit (config) sshBackdoor; - inherit (hostPkgs.stdenv.hostPlatform) isLinux; + inherit (hostPkgs.stdenv.hostPlatform) isLinux isAarch64; # Reifies and correctly wraps the python test driver for # the respective qemu version and with or without ocr support @@ -256,6 +256,10 @@ in # # If needed, this can still be turned off. virtualisation.qemu.enableSharedMemory = lib.mkDefault isLinux; + # Needed for screenshots to work (in e.g `nixosTests.login`) + virtualisation.qemu.options = lib.optionals (isLinux && isAarch64) [ + "-device virtio-gpu-pci" + ]; assertions = [ { diff --git a/nixos/modules/virtualisation/qemu-vm.nix b/nixos/modules/virtualisation/qemu-vm.nix index c6da8d9aaa6f..4fe5ed1e56c0 100644 --- a/nixos/modules/virtualisation/qemu-vm.nix +++ b/nixos/modules/virtualisation/qemu-vm.nix @@ -1379,7 +1379,6 @@ in "-device usb-tablet,bus=usb-bus.0" ]) (mkIf pkgs.stdenv.hostPlatform.isAarch [ - "-device virtio-gpu-pci" "-device usb-ehci,id=usb0" "-device usb-kbd" "-device usb-tablet" From 32861fa28b56f7a3906e1bb267f3264ebc85bc92 Mon Sep 17 00:00:00 2001 From: Pratham Patel Date: Thu, 4 Jun 2026 10:26:03 +0530 Subject: [PATCH 08/25] linux/common-config: enable ARM_SMMU_V3_SVA on aarch64 This makes CUDA compute work with the GB10 platform on my ASUS Ascent GX10. This wasn't enabled by `autoModules` because it is a boolean. Before: ``` $ llama-cli --list-devices 0.00.468.603 E ggml_cuda_init: failed to initialize CUDA: initialization error Available devices: $ zcat /proc/config.gz | grep CONFIG_ARM_SMMU_V3_SVA= $ echo $? 1 ``` After: ``` $ llama-cli --list-devices Available devices: CUDA0: NVIDIA GB10 (124534 MiB, 44410 MiB free) $ zcat /proc/config.gz | grep CONFIG_ARM_SMMU_V3_SVA= CONFIG_ARM_SMMU_V3_SVA=y ``` Here is the information about the GPU on the GB10 platform: ``` $ sudo lspci -vvv -s 000f:01:00.0 000f:01:00.0 VGA compatible controller: NVIDIA Corporation GB20B [GB10] (rev a1) (prog-if 00 [VGA controller]) Subsystem: NVIDIA Corporation Device 0000 Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx+ Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- SERR- Capabilities: [b0] MSI-X: Enable+ Count=9 Masked- Vector table: BAR=0 offset=00b90000 PBA: BAR=0 offset=00ba0000 Capabilities: [100 v1] Secondary PCI Express LnkCtl3: LnkEquIntrruptEn- PerformEqu- LaneErrStat: 0 Capabilities: [12c v1] Latency Tolerance Reporting Max snoop latency: 0ns Max no snoop latency: 0ns Capabilities: [14c v1] Data Link Feature Capabilities: [158 v1] Physical Layer 16.0 GT/s Phy16Sta: EquComplete- EquPhase1- EquPhase2- EquPhase3- LinkEquRequest- Capabilities: [188 v1] Physical Layer 32.0 GT/s Phy32Cap: EqualizationBypass+ NoEqualizationNeeded- ModTsMode0+ ModTsMode1- ModTsMode2- Phy32Ctl: EqualizationBypassDis- NoEqualizationNeededDis- Modified TS Usage Mode: PCI Express Phy32Sta: EquComplete- EquPhase1- EquPhase2- EquPhase3- LinkEquRequest- Received Enhanced Link Behavior Control: Full Equalization required ModTsRecv- TxPrecodeOn- TxPrecodeReq- NoEqualizationNeededRecv- Capabilities: [1b8 v2] Advanced Error Reporting UESta: DLP- SDES- TLP- FCP- CmpltTO- CmpltAbrt- UnxCmplt- RxOF- MalfTLP- ECRC- UnsupReq- ACSViol- UncorrIntErr- BlockedTLP- AtomicOpBlocked- TLPBlockedErr- PoisonTLPBlocked- DMWrReqBlocked- IDECheck- MisIDETLP- PCRC_CHECK- TLPXlatBlocked- UEMsk: DLP- SDES- TLP- FCP- CmpltTO- CmpltAbrt- UnxCmplt- RxOF- MalfTLP- ECRC- UnsupReq- ACSViol- UncorrIntErr+ BlockedTLP- AtomicOpBlocked- TLPBlockedErr- PoisonTLPBlocked- DMWrReqBlocked- IDECheck- MisIDETLP- PCRC_CHECK- TLPXlatBlocked- UESvrt: DLP+ SDES+ TLP- FCP+ CmpltTO- CmpltAbrt- UnxCmplt- RxOF+ MalfTLP+ ECRC- UnsupReq- ACSViol- UncorrIntErr+ BlockedTLP- AtomicOpBlocked- TLPBlockedErr- PoisonTLPBlocked- DMWrReqBlocked- IDECheck- MisIDETLP- PCRC_CHECK- TLPXlatBlocked- CESta: RxErr- BadTLP- BadDLLP- Rollover- Timeout- AdvNonFatalErr- CorrIntErr- HeaderOF- CEMsk: RxErr- BadTLP- BadDLLP- Rollover- Timeout- AdvNonFatalErr+ CorrIntErr+ HeaderOF+ AERCap: First Error Pointer: 00, ECRCGenCap- ECRCGenEn- ECRCChkCap- ECRCChkEn- MultHdrRecCap- MultHdrRecEn- TLPPfxPres- HdrLogCap- HeaderLog: 00000000 00000000 00000000 00000000 Capabilities: [200 v1] Lane Margining at the Receiver PortCap: Uses Driver+ PortSta: MargReady- MargSoftReady- Capabilities: [248 v1] Alternative Routing-ID Interpretation (ARI) ARICap: MFVC- ACS-, Next Function: 0 ARICtl: MFVC- ACS-, Function Group: 0 Capabilities: [290 v2] L1 PM Substates L1SubCap: PCI-PM_L1.2+ PCI-PM_L1.1+ ASPM_L1.2+ ASPM_L1.1+ L1_PM_Substates+ PortCommonModeRestoreTime=0us PortTPowerOnTime=10us L1SubCtl1: PCI-PM_L1.2- PCI-PM_L1.1- ASPM_L1.2- ASPM_L1.1- T_CommonMode=0us LTR1.2_Threshold=0ns L1SubCtl2: T_PwrOn=10us Capabilities: [2a4 v1] Vendor Specific Information: ID=0001 Rev=1 Len=014 Capabilities: [2c8 v1] Data Object Exchange DOECap: IntSup+ IntMsgNum 8 DOECtl: IntEn- DOESta: Busy+ IntSta+ Error+ ObjectReady- Capabilities: [2e0 v1] Address Translation Service (ATS) ATSCap: Invalidate Queue Depth: 00 ATSCtl: Enable+, Smallest Translation Unit: 00 Capabilities: [2e8 v1] Process Address Space ID (PASID) PASIDCap: Exec- Priv-, Max PASID Width: 14 PASIDCtl: Enable+ Exec- Priv- Capabilities: [2f0 v1] Device Serial Number 00-00-00-00-00-2d-b0-48 Kernel driver in use: nvidia Kernel modules: nvidiafb, nouveau, nvidia_drm, nvidia ``` --- pkgs/os-specific/linux/kernel/common-config.nix | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix index e5f06e7d481d..aada43eb08f3 100644 --- a/pkgs/os-specific/linux/kernel/common-config.nix +++ b/pkgs/os-specific/linux/kernel/common-config.nix @@ -248,6 +248,10 @@ let BOUNCE = option yes; }; + iommu = lib.optionalAttrs stdenv.hostPlatform.isAarch64 { + ARM_SMMU_V3_SVA = whenAtLeast "5.9" yes; + }; + memtest = { MEMTEST = yes; }; From 095fb1767671ffd83d05863feb30836c1115c199 Mon Sep 17 00:00:00 2001 From: zowoq <59103226+zowoq@users.noreply.github.com> Date: Sat, 30 May 2026 14:46:15 +1000 Subject: [PATCH 09/25] nixos-rebuild-ng: add env var to allow use without systemd-run useful if nixos-rebuild is already running under a systemd service, e.g. a pull deployment --- .../ni/nixos-rebuild-ng/nixos-rebuild.8.scd | 4 +++ .../nixos-rebuild-ng/src/nixos_rebuild/nix.py | 2 ++ .../ni/nixos-rebuild-ng/src/tests/test_nix.py | 32 +++++++++++++++++++ 3 files changed, 38 insertions(+) diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/nixos-rebuild.8.scd b/pkgs/by-name/ni/nixos-rebuild-ng/nixos-rebuild.8.scd index 7ec6def5ca21..84382292ce7c 100644 --- a/pkgs/by-name/ni/nixos-rebuild-ng/nixos-rebuild.8.scd +++ b/pkgs/by-name/ni/nixos-rebuild-ng/nixos-rebuild.8.scd @@ -379,6 +379,10 @@ NIX_SSHOPTS NIX_SUDOOPTS Additional options to be passed to sudo on the command line. +NIXOS_REBUILD_NO_SYSTEMD_RUN + If set, then *nixos-rebuild* will run without the + _systemd-run_ wrapper. + # FILES /etc/nixos/system.nix diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py index c9d79868f8f4..4fbe7fbe2b9d 100644 --- a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py +++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py @@ -708,6 +708,8 @@ def switch_to_configuration( "not working in target host" ) cmd = [] + elif os.environ.get("NIXOS_REBUILD_NO_SYSTEMD_RUN"): + cmd = [] run_wrapper( [*cmd, path_to_config / "bin/switch-to-configuration", str(action)], diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py index 8100f396cdb7..1cdccc9a874e 100644 --- a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py +++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py @@ -819,6 +819,38 @@ def test_switch_to_configuration_without_systemd_run( ) +@patch(get_qualified_name(n.run_wrapper, n), autospec=True) +def test_switch_to_configuration_without_systemd_run_env_var( + mock_run: Any, monkeypatch: MonkeyPatch +) -> None: + profile_path = Path("/path/to/profile") + mock_run.return_value = CompletedProcess([], 0) + + with monkeypatch.context() as mp: + mp.setenv("LOCALE_ARCHIVE", "") + mp.setenv("NIXOS_REBUILD_NO_SYSTEMD_RUN", "1") + + n.switch_to_configuration( + profile_path, + m.Action.SWITCH, + elevate=e.NO_ELEVATOR, + target_host=None, + specialisation=None, + install_bootloader=False, + ) + mock_run.assert_called_with( + [profile_path / "bin/switch-to-configuration", "switch"], + env={ + "LOCALE_ARCHIVE": e.PRESERVE_ENV, + "NIXOS_NO_CHECK": e.PRESERVE_ENV, + "NIXOS_INSTALL_BOOTLOADER": "0", + }, + elevate=e.NO_ELEVATOR, + remote=None, + stdout=sys.stderr, + ) + + @patch(get_qualified_name(n.run_wrapper, n), autospec=True) def test_switch_to_configuration_with_systemd_run( mock_run: Mock, monkeypatch: MonkeyPatch From b63a81166a10957b70d303c181adbec59c0f74f4 Mon Sep 17 00:00:00 2001 From: azuwis Date: Thu, 4 Jun 2026 20:01:07 +0800 Subject: [PATCH 10/25] nixos-rebuild-ng: add tests for --file/--attr disabling flake auto-detection --- .../ni/nixos-rebuild-ng/src/tests/test_main.py | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_main.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_main.py index 1e0e5779ac90..12bacafba8d5 100644 --- a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_main.py +++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_main.py @@ -89,6 +89,22 @@ def test_parse_args() -> None: assert r_store_path.flake is False assert r_store_path.store_path == "/nix/store/foo" + # --file and --attr should disable flake auto-detection + r_file, _ = nr.parse_args(["nixos-rebuild", "switch", "--file", "foo.nix"]) + assert r_file.flake is False + assert r_file.file == "foo.nix" + + r_attr, _ = nr.parse_args(["nixos-rebuild", "switch", "--attr", "bar"]) + assert r_attr.flake is False + assert r_attr.attr == "bar" + + r_file_attr, _ = nr.parse_args( + ["nixos-rebuild", "switch", "--file", "foo.nix", "--attr", "bar"] + ) + assert r_file_attr.flake is False + assert r_file_attr.file == "foo.nix" + assert r_file_attr.attr == "bar" + r1, g1 = nr.parse_args( [ "nixos-rebuild", From 691dc02df0111c320cd6697aacd4b113ba632e40 Mon Sep 17 00:00:00 2001 From: Yuriy Taraday Date: Tue, 26 May 2026 12:25:47 +0200 Subject: [PATCH 11/25] pkgs-lib/formats: Use .attrs.json where possible This expands on https://github.com/NixOS/nixpkgs/pull/498928 that introduced __structuredAttrs here by actually using data in `.attrs.json` when it makes sense, instead of relying on environment variables. This leads to less temporary files, faster execution and nicer code. --- pkgs/pkgs-lib/formats.nix | 46 ++++++++++++++------------------------- 1 file changed, 16 insertions(+), 30 deletions(-) diff --git a/pkgs/pkgs-lib/formats.nix b/pkgs/pkgs-lib/formats.nix index 879b233bb670..288a2bc584d3 100644 --- a/pkgs/pkgs-lib/formats.nix +++ b/pkgs/pkgs-lib/formats.nix @@ -142,14 +142,12 @@ optionalAttrs allowAliases aliases runCommand name { nativeBuildInputs = [ jq ]; - value = builtins.toJSON value; + inherit value; preferLocalBuild = true; __structuredAttrs = true; } '' - valuePath="$TMPDIR/value" - printf "%s" "$value" > "$valuePath" - jq . "$valuePath" > $out + jq .value "$NIX_ATTRS_JSON_FILE" > $out '' ) { }; @@ -167,14 +165,12 @@ optionalAttrs allowAliases aliases runCommand name { nativeBuildInputs = [ remarshal_0_17 ]; - value = builtins.toJSON value; + inherit value; preferLocalBuild = true; __structuredAttrs = true; } '' - valuePath="$TMPDIR/value" - printf "%s" "$value" > "$valuePath" - json2yaml "$valuePath" "$out" + json2yaml --unwrap value "$NIX_ATTRS_JSON_FILE" "$out" '' ) { }; @@ -192,14 +188,12 @@ optionalAttrs allowAliases aliases runCommand name { nativeBuildInputs = [ remarshal ]; - value = builtins.toJSON value; + inherit value; preferLocalBuild = true; __structuredAttrs = true; } '' - valuePath="$TMPDIR/value" - printf "%s" "$value" > "$valuePath" - json2yaml "$valuePath" "$out" + json2yaml --unwrap value "$NIX_ATTRS_JSON_FILE" "$out" '' ) { }; @@ -940,8 +934,8 @@ optionalAttrs allowAliases aliases python3 black ]; - imports = builtins.toJSON (value._imports or [ ]); - value = builtins.toJSON (removeAttrs value [ "_imports" ]); + imports = value._imports or [ ]; + value = removeAttrs value [ "_imports" ]; pythonGen = pkgs.writeText "pythonGen" '' import json import os @@ -964,26 +958,20 @@ optionalAttrs allowAliases aliases else: return repr(value) - with open(os.environ["importsPath"], "r") as f: - imports = json.load(f) - if imports is not None: - for i in imports: + with open(os.environ["NIX_ATTRS_JSON_FILE"], "r") as f: + attrs = json.load(f) + if attrs["imports"] is not None: + for i in attrs["imports"]: print(f"import {i}") print() - with open(os.environ["valuePath"], "r") as f: - for key, value in json.load(f).items(): + for key, value in attrs["value"].items(): print(f"{key} = {recursive_repr(value)}") ''; preferLocalBuild = true; __structuredAttrs = true; } '' - export importsPath="$TMPDIR/imports" - printf "%s" "$imports" > "$importsPath" - export valuePath="$TMPDIR/value" - printf "%s" "$value" > "$valuePath" - cat "$valuePath" python3 "$pythonGen" > $out black $out '' @@ -1013,14 +1001,14 @@ optionalAttrs allowAliases aliases python3Packages.xmltodict libxml2Python ]; - value = builtins.toJSON value; + inherit value; pythonGen = pkgs.writeText "pythonGen" '' import json import os import xmltodict - with open(os.environ["valuePath"], "r") as f: - print(xmltodict.unparse(json.load(f), full_document=${ + with open(os.environ["NIX_ATTRS_JSON_FILE"], "r") as f: + print(xmltodict.unparse(json.load(f)["value"], full_document=${ if withHeader then "True" else "False" }, pretty=True, indent=" " * 2)) ''; @@ -1028,8 +1016,6 @@ optionalAttrs allowAliases aliases __structuredAttrs = true; } '' - export valuePath="$TMPDIR/value" - printf "%s" "$value" > "$valuePath" python3 "$pythonGen" > $out xmllint $out > /dev/null '' From 1087b3eb0809c7d67775e271b81e1e65c673d9b5 Mon Sep 17 00:00:00 2001 From: nikstur Date: Thu, 4 Jun 2026 15:37:22 +0200 Subject: [PATCH 12/25] gnupgMinimal: init This used to be a non-exposed part of the systemd derivation. However, in #509324 this was removed. Re-add this to use it for systemd-import and systemd-sysupdate to provide a minimal gnupg without bash. This fixes the bashless tests. --- pkgs/top-level/all-packages.nix | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index 0e2defb6566c..733d399f71dd 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -2358,6 +2358,10 @@ with pkgs; pinentry = if stdenv.hostPlatform.isDarwin then pinentry_mac else pinentry-gtk2; }; gnupg = gnupg24; + gnupgMinimal = gnupg.override { + enableMinimal = true; + guiSupport = false; + }; gnused = callPackage ../tools/text/gnused { }; From 603f171aa868b2281aed24fdca4f62be96052b96 Mon Sep 17 00:00:00 2001 From: nikstur Date: Thu, 4 Jun 2026 15:41:39 +0200 Subject: [PATCH 13/25] nixos/systemd: gnupg -> gnupgMinimal This fixes the bashless tests as gnupgMinimal doest not depend on bash. --- nixos/modules/system/boot/systemd.nix | 2 +- nixos/modules/system/boot/systemd/sysupdate.nix | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/nixos/modules/system/boot/systemd.nix b/nixos/modules/system/boot/systemd.nix index 7227ac4277e7..0220a052fdff 100644 --- a/nixos/modules/system/boot/systemd.nix +++ b/nixos/modules/system/boot/systemd.nix @@ -808,7 +808,7 @@ in systemd.targets.remote-fs.unitConfig.X-StopOnReconfiguration = true; systemd.services.systemd-importd = lib.mkIf cfg.package.withImportd { environment = proxy_env; - path = [ pkgs.gnupg ]; + path = [ pkgs.gnupgMinimal ]; }; systemd.services.systemd-pstore.wantedBy = [ "sysinit.target" ]; # see #81138 diff --git a/nixos/modules/system/boot/systemd/sysupdate.nix b/nixos/modules/system/boot/systemd/sysupdate.nix index 3fa8dc212ea2..91a165d7d5ab 100644 --- a/nixos/modules/system/boot/systemd/sysupdate.nix +++ b/nixos/modules/system/boot/systemd/sysupdate.nix @@ -138,7 +138,7 @@ in systemd.services.systemd-sysupdated = { aliases = [ "dbus-org.freedesktop.sysupdate1.service" ]; - path = [ pkgs.gnupg ]; + path = [ pkgs.gnupgMinimal ]; }; systemd.timers = { From be84ec22c5a24032337fc05652c0575dd293f807 Mon Sep 17 00:00:00 2001 From: Dmitry Voronin Date: Mon, 25 May 2026 15:18:49 +0300 Subject: [PATCH 14/25] systemd-logind: allow service reloads to apply new configuration --- nixos/modules/system/boot/systemd/logind.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/nixos/modules/system/boot/systemd/logind.nix b/nixos/modules/system/boot/systemd/logind.nix index f81baae8813e..bdf4ab4d4873 100644 --- a/nixos/modules/system/boot/systemd/logind.nix +++ b/nixos/modules/system/boot/systemd/logind.nix @@ -64,13 +64,13 @@ environment.etc."systemd/logind.conf".text = utils.systemdUtils.lib.settingsToSections config.services.logind.settings; - # Restarting systemd-logind breaks X11 + # Restarting systemd-logind breaks X11 and other user sessions. + # However, reloading the service seems to do the trick of loading new configuration without breaking anything. # - upstream commit: https://cgit.freedesktop.org/xorg/xserver/commit/?id=dc48bd653c7e101 # - systemd announcement: https://github.com/systemd/systemd/blob/22043e4317ecd2bc7834b48a6d364de76bb26d91/NEWS#L103-L112 # - this might be addressed in the future by xorg #systemd.services.systemd-logind.restartTriggers = [ config.environment.etc."systemd/logind.conf".source ]; - systemd.services.systemd-logind.restartIfChanged = false; - systemd.services.systemd-logind.stopIfChanged = false; + systemd.services.systemd-logind.reloadIfChanged = true; # The user-runtime-dir@ service is managed by systemd-logind we should not touch it or else we break the users' sessions. systemd.services."user-runtime-dir@".stopIfChanged = false; From dc965bdf7f16194a1d1ad5eafc23049321ff993f Mon Sep 17 00:00:00 2001 From: Jost Alemann Date: Thu, 4 Jun 2026 12:23:50 +0200 Subject: [PATCH 15/25] ty: 0.0.42 -> 0.0.44 Changelog: https://github.com/astral-sh/ty/releases/tag/0.0.44 Diff: https://github.com/astral-sh/ty/compare/0.0.42...0.0.44 --- pkgs/by-name/ty/ty/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/ty/ty/package.nix b/pkgs/by-name/ty/ty/package.nix index 29f1b3196dc0..fad959f944ae 100644 --- a/pkgs/by-name/ty/ty/package.nix +++ b/pkgs/by-name/ty/ty/package.nix @@ -17,7 +17,7 @@ rustPlatform.buildRustPackage (finalAttrs: { pname = "ty"; - version = "0.0.42"; + version = "0.0.44"; __structuredAttrs = true; src = fetchFromGitHub { @@ -25,7 +25,7 @@ rustPlatform.buildRustPackage (finalAttrs: { repo = "ty"; tag = finalAttrs.version; fetchSubmodules = true; - hash = "sha256-PTyxx618J08eB1eH8vdmv+R9yU4/LMP9xfk3hvze0/M="; + hash = "sha256-P19+C6u0mkIrR0H8M/l7Wn3r8JSY4Ul9p64oXaLdWCQ="; }; # For Darwin platforms, remove the integration test for file notifications, @@ -39,7 +39,7 @@ rustPlatform.buildRustPackage (finalAttrs: { cargoBuildFlags = [ "--package=ty" ]; - cargoHash = "sha256-dYCt0GP4b5qL/acfNe8ufdqF24yTpm5MTsjplMMKClg="; + cargoHash = "sha256-d2iV7iWf7lVhj1Bbaxxk5Zao4KK3oC7whppRvk0erzA="; nativeBuildInputs = [ installShellFiles ]; buildInputs = [ rust-jemalloc-sys ]; From 38e91d642391ae2fb7fb52c5b53a26440e7af8e7 Mon Sep 17 00:00:00 2001 From: Jost Alemann Date: Fri, 5 Jun 2026 21:17:44 +0200 Subject: [PATCH 16/25] ruff: 0.15.15 -> 0.15.16 Changelog: https://github.com/astral-sh/ruff/releases/tag/0.15.16 Diff: https://github.com/astral-sh/ruff/compare/0.15.15...0.15.16 --- pkgs/by-name/ru/ruff/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/ru/ruff/package.nix b/pkgs/by-name/ru/ruff/package.nix index 75992b42240e..8566e5251408 100644 --- a/pkgs/by-name/ru/ruff/package.nix +++ b/pkgs/by-name/ru/ruff/package.nix @@ -16,7 +16,7 @@ rustPlatform.buildRustPackage (finalAttrs: { pname = "ruff"; - version = "0.15.15"; + version = "0.15.16"; __structuredAttrs = true; @@ -24,12 +24,12 @@ rustPlatform.buildRustPackage (finalAttrs: { owner = "astral-sh"; repo = "ruff"; tag = finalAttrs.version; - hash = "sha256-WpjOOCYLZ1d8XPUx3qNHD+fuK6t65u/1/ZezABWpBD0="; + hash = "sha256-krmHCLijp+D4gBjKV9cdicPob4ry5I6QwB3MUz0z7zA="; }; cargoBuildFlags = [ "--package=ruff" ]; - cargoHash = "sha256-SfkoLl43Y1DNqIRW+HljVcEHWhedTS99SGhMvkQ4dmo="; + cargoHash = "sha256-d2iV7iWf7lVhj1Bbaxxk5Zao4KK3oC7whppRvk0erzA="; nativeBuildInputs = [ installShellFiles ]; From 5083b1377152b05e24edcc78f6e1c26575b39178 Mon Sep 17 00:00:00 2001 From: Stig Palmquist Date: Sat, 6 Jun 2026 11:34:51 +0200 Subject: [PATCH 17/25] perlPackages.DBI: 1.644 -> 1.648 --- pkgs/top-level/perl-packages.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix index a10771a65cb2..e88965bcac17 100644 --- a/pkgs/top-level/perl-packages.nix +++ b/pkgs/top-level/perl-packages.nix @@ -9997,11 +9997,11 @@ with self; DBI = buildPerlPackage { pname = "DBI"; - version = "1.644"; + version = "1.648"; src = fetchurl { - url = "mirror://cpan/authors/id/H/HM/HMBRAND/DBI-1.644.tar.gz"; - hash = "sha256-Ipe5neCeZwhmQLWQaZ4OmC+0adpjqT/ijcFHgtt6U8g="; + url = "mirror://cpan/authors/id/H/HM/HMBRAND/DBI-1.648.tgz"; + hash = "sha256-7yZqrWAQzi6rt+Rl69c8owILxYFQ9pib2Jwrj5usaoY="; }; env = lib.optionalAttrs stdenv.cc.isGNU { From 4df979114fc1d52911340b2bced583e5cbb0999d Mon Sep 17 00:00:00 2001 From: dramforever Date: Sun, 7 Jun 2026 13:18:53 +0800 Subject: [PATCH 18/25] linux/common-config: Use LIST_HARDENED instead on >= 6.6 According to the message in the patch that introduced LIST_HARDENED [1], DEBUG_LIST was not optimized for performance in production and presents a significant performance hit in hot paths in some workloads. Use the new LIST_HARDENED option instead on >= 6.6 for better performance. [1]: https://git.kernel.org/torvalds/c/aebc7b0d8d91bbc69e976909963046bc48bca4fd --- pkgs/os-specific/linux/kernel/common-config.nix | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix index e5f06e7d481d..245db6407280 100644 --- a/pkgs/os-specific/linux/kernel/common-config.nix +++ b/pkgs/os-specific/linux/kernel/common-config.nix @@ -798,7 +798,9 @@ let FORTIFY_SOURCE = option yes; # https://googleprojectzero.blogspot.com/2019/11/bad-binder-android-in-wild-exploit.html - DEBUG_LIST = yes; + DEBUG_LIST = whenOlder "6.6" yes; + # https://git.kernel.org/torvalds/c/aebc7b0d8d91bbc69e976909963046bc48bca4fd + LIST_HARDENED = whenAtLeast "6.6" yes; HARDENED_USERCOPY = yes; RANDOMIZE_BASE = option yes; From 5692c926f2733a4e53794b3ec1db00e57ce0d925 Mon Sep 17 00:00:00 2001 From: r-vdp Date: Sun, 7 Jun 2026 17:23:48 +0300 Subject: [PATCH 19/25] nixos/users-groups: drop the weak-hash activation warning The libxcrypt transition was in 23.05, so I think we've given people sufficient time to fix hashes of mutable users. Part of #475305. --- nixos/modules/config/users-groups.nix | 28 ++------------------------- 1 file changed, 2 insertions(+), 26 deletions(-) diff --git a/nixos/modules/config/users-groups.nix b/nixos/modules/config/users-groups.nix index 8291f55f37cb..c92872d26775 100644 --- a/nixos/modules/config/users-groups.nix +++ b/nixos/modules/config/users-groups.nix @@ -950,32 +950,8 @@ in }; }; - # Warn about user accounts with deprecated password hashing schemes - # This does not work when the users and groups are created by - # systemd-sysusers because the users are created too late then. - system.activationScripts.hashes = - if !config.systemd.sysusers.enable && !config.services.userborn.enable then - { - deps = [ "users" ]; - text = '' - users=() - while IFS=: read -r user hash _; do - if [[ "$hash" = "$"* && ! "$hash" =~ ^\''$${cryptSchemeIdPatternGroup}\$ ]]; then - users+=("$user") - fi - done Date: Sun, 7 Jun 2026 15:50:46 -0700 Subject: [PATCH 20/25] libslirp: add meta.changelog --- pkgs/by-name/li/libslirp/package.nix | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/li/libslirp/package.nix b/pkgs/by-name/li/libslirp/package.nix index bb7779cff8b6..a7984b9e5b66 100644 --- a/pkgs/by-name/li/libslirp/package.nix +++ b/pkgs/by-name/li/libslirp/package.nix @@ -16,8 +16,8 @@ stdenv.mkDerivation (finalAttrs: { domain = "gitlab.freedesktop.org"; owner = "slirp"; repo = "libslirp"; - rev = "v${finalAttrs.version}"; - sha256 = "sha256-Spr3dO5ehuUlzx3EnJi8najANWOirwQcTsWTVRVXYuY="; + tag = "v${finalAttrs.version}"; + hash = "sha256-Spr3dO5ehuUlzx3EnJi8najANWOirwQcTsWTVRVXYuY="; }; separateDebugInfo = true; @@ -35,6 +35,7 @@ stdenv.mkDerivation (finalAttrs: { ''; meta = { + changelog = "https://gitlab.freedesktop.org/slirp/libslirp/-/blob/${finalAttrs.src.tag}/CHANGELOG.md"; description = "General purpose TCP-IP emulator"; homepage = "https://gitlab.freedesktop.org/slirp/libslirp"; license = lib.licenses.bsd3; From 9497b712f6704c2ac3857df38464e81a328a5df1 Mon Sep 17 00:00:00 2001 From: zowoq <59103226+zowoq@users.noreply.github.com> Date: Mon, 8 Jun 2026 17:55:31 +1000 Subject: [PATCH 21/25] linux/common-config: move USB_XHCI_TEGRA from lib/systems aarch64-multiplatform Co-authored-by: Emily --- lib/systems/platforms.nix | 5 ----- pkgs/os-specific/linux/kernel/common-config.nix | 4 ++++ 2 files changed, 4 insertions(+), 5 deletions(-) diff --git a/lib/systems/platforms.nix b/lib/systems/platforms.nix index b10c787728a0..7c49b40e53d4 100644 --- a/lib/systems/platforms.nix +++ b/lib/systems/platforms.nix @@ -152,11 +152,6 @@ rec { DTB = true; autoModules = true; preferBuiltin = true; - extraConfig = '' - # The default (=y) forces us to have the XHCI firmware available in initrd, - # which our initrd builder can't currently do easily. - USB_XHCI_TEGRA m - ''; target = "Image"; }; gcc = { diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix index e5f06e7d481d..0eca336e62be 100644 --- a/pkgs/os-specific/linux/kernel/common-config.nix +++ b/pkgs/os-specific/linux/kernel/common-config.nix @@ -672,6 +672,10 @@ let USB_DWC3_DUAL_ROLE = yes; USB_XHCI_SIDEBAND = whenAtLeast "6.16" yes; # needed for audio offload + + # The default (=y) forces us to have the XHCI firmware available in initrd, + # which our initrd builder can't currently do easily. + USB_XHCI_TEGRA = lib.mkIf stdenv.hostPlatform.isAarch64 module; }; usb-serial = { From b027095b14fc863104b8c9d2a5440a44fe087d84 Mon Sep 17 00:00:00 2001 From: zowoq <59103226+zowoq@users.noreply.github.com> Date: Tue, 9 Jun 2026 10:56:39 +0000 Subject: [PATCH 22/25] linux_testing: 7.1-rc6 -> 7.1-rc7 --- pkgs/os-specific/linux/kernel/kernels-org.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json index f2e87f79b99c..d9d0a2f7d291 100644 --- a/pkgs/os-specific/linux/kernel/kernels-org.json +++ b/pkgs/os-specific/linux/kernel/kernels-org.json @@ -1,7 +1,7 @@ { "testing": { - "version": "7.1-rc6", - "hash": "sha256:1fmbsjhdrkzim6vzqc40raikv1szfw28q0lbvap8a1g77an0qi58", + "version": "7.1-rc7", + "hash": "sha256:1jncfqvbiwsvvhiqs23paiy7xvsbmqcpxj02jwvy0albp16kfxd7", "lts": false }, "6.1": { From a53339212cd0c317b9d2281ad7b54d45d2cdbdd6 Mon Sep 17 00:00:00 2001 From: zowoq <59103226+zowoq@users.noreply.github.com> Date: Tue, 9 Jun 2026 10:56:43 +0000 Subject: [PATCH 23/25] linux_7_0: 7.0.11 -> 7.0.12 --- pkgs/os-specific/linux/kernel/kernels-org.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json index d9d0a2f7d291..0113d950448b 100644 --- a/pkgs/os-specific/linux/kernel/kernels-org.json +++ b/pkgs/os-specific/linux/kernel/kernels-org.json @@ -35,8 +35,8 @@ "lts": true }, "7.0": { - "version": "7.0.11", - "hash": "sha256:012307ni1v555a1rgzsxsg99pj8fplrghvhw0jk3c4d0vmb86v75", + "version": "7.0.12", + "hash": "sha256:1nk5lans9qg1avmmcwyadfps43d3hyjz9a5gjyvsc77w3sjckvap", "lts": false } } From 4e8d7d7406b6870487a607098edf53714a31773f Mon Sep 17 00:00:00 2001 From: zowoq <59103226+zowoq@users.noreply.github.com> Date: Tue, 9 Jun 2026 10:56:46 +0000 Subject: [PATCH 24/25] linux_6_18: 6.18.34 -> 6.18.35 --- pkgs/os-specific/linux/kernel/kernels-org.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json index 0113d950448b..7830ae610cdd 100644 --- a/pkgs/os-specific/linux/kernel/kernels-org.json +++ b/pkgs/os-specific/linux/kernel/kernels-org.json @@ -30,8 +30,8 @@ "lts": true }, "6.18": { - "version": "6.18.34", - "hash": "sha256:0q6palsvwx0gnisjr658hlngfpvyzv0k5q4pvdk23122zcr4f334", + "version": "6.18.35", + "hash": "sha256:0dpjprjzc4w44kw49jcgx1ffrm6gxn2gsnsz3hhmw4hr4a9h51pp", "lts": true }, "7.0": { From 0088fcded687d698e958628a979f93914ad65944 Mon Sep 17 00:00:00 2001 From: zowoq <59103226+zowoq@users.noreply.github.com> Date: Tue, 9 Jun 2026 10:56:50 +0000 Subject: [PATCH 25/25] linux_6_12: 6.12.92 -> 6.12.93 --- pkgs/os-specific/linux/kernel/kernels-org.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json index 7830ae610cdd..a44bc74bacac 100644 --- a/pkgs/os-specific/linux/kernel/kernels-org.json +++ b/pkgs/os-specific/linux/kernel/kernels-org.json @@ -25,8 +25,8 @@ "lts": true }, "6.12": { - "version": "6.12.92", - "hash": "sha256:0gly5wld3x8l0f3zk9pspsw1q2d7zbjbx4c2ndb49b1wvfvpdqqg", + "version": "6.12.93", + "hash": "sha256:18sg154hqw8l98pfim2hjm1y604h5dwn9gj3gyncas8bgjl4h9j9", "lts": true }, "6.18": {