diff --git a/nixos/doc/manual/release-notes/rl-2505.section.md b/nixos/doc/manual/release-notes/rl-2505.section.md index 869eb3f0fda5..cbaf33c5ed40 100644 --- a/nixos/doc/manual/release-notes/rl-2505.section.md +++ b/nixos/doc/manual/release-notes/rl-2505.section.md @@ -8,7 +8,7 @@ Alongside many enhancements to NixOS modules and general system improvements, th - NixOS now has initial support for the [**COSMIC DE**](https://system76.com/cosmic) which is currently at **Alpha 7**. COSMIC is a Rust-based Desktop Environment by System76, makers of Pop!_OS. You can use COSMIC by enabling the greeter (login manager) with [](#opt-services.displayManager.cosmic-greeter.enable), and the DE itself by enabling [](#opt-services.desktopManager.cosmic.enable). The support in NixOS/Nixpkgs is stable but still considered experimental because of the recent the addition. The COSMIC maintainers will be waiting for one more release of NixOS to determine if the experimental tag should be removed or not. Until then, please report any issues to the [COSMIC DE tracker in Nixpkgs](https://github.com/NixOS/nixpkgs/issues/259641) instead of upstream. -- `nixos-rebuild-ng`, a full rewrite of `nixos-rebuild` in Python, is available for testing. You can enable it by setting [](#opt-system.rebuild.enableNg) in your configuration (this will replace the old `nixos-rebuild`), or by adding `nixos-rebuild-ng` to your `environment.systemPackages` (in this case, it will live side-by-side with `nixos-rebuild` as `nixos-rebuild-ng`). It is expected that the next major version of NixOS (25.11) will enable `system.rebuild.enableNg` by default. +- `nixos-rebuild-ng`, a full rewrite of `nixos-rebuild` in Python, is available for testing. You can enable it by setting {option}`system.rebuild.enableNg` in your configuration (this will replace the old `nixos-rebuild`), or by adding `nixos-rebuild-ng` to your `environment.systemPackages` (in this case, it will live side-by-side with `nixos-rebuild` as `nixos-rebuild-ng`). It is expected that the next major version of NixOS (25.11) will enable `system.rebuild.enableNg` by default. - A `nixos-rebuild build-image` sub-command has been added. It allows users to build platform-specific (disk) images from their NixOS configurations. `nixos-rebuild build-image` works similar to the popular [nix-community/nixos-generators](https://github.com/nix-community/nixos-generators) project. See new [section on image building in the NixOS manual](#sec-image-nixos-rebuild-build-image). It is also available for `nixos-rebuild-ng`. diff --git a/nixos/doc/manual/release-notes/rl-2511.section.md b/nixos/doc/manual/release-notes/rl-2511.section.md index 620b98f2f089..db03af70beec 100644 --- a/nixos/doc/manual/release-notes/rl-2511.section.md +++ b/nixos/doc/manual/release-notes/rl-2511.section.md @@ -22,7 +22,7 @@ - `networking.firewall` now has a `backend` option for choosing which backend to use. -- `nixos-rebuild-ng`, a full rewrite of `nixos-rebuild` in Python, is enabled by default from this release. You can disable it by setting [](#opt-system.rebuild.enableNg) to `false` in your configuration if you need, but please report any issues. It is expected that the next major version of NixOS (26.05) will remove the {option}`system.rebuild.enableNg` option. +- `nixos-rebuild-ng`, a full rewrite of `nixos-rebuild` in Python, is enabled by default from this release. You can disable it by setting {option}`system.rebuild.enableNg` to `false` in your configuration if you need, but please report any issues. It is expected that the next major version of NixOS (26.05) will remove the {option}`system.rebuild.enableNg` option. - `rEFInd`, a graphical boot manager for UEFI systems, can now be used through [](#opt-boot.loader.refind.enable). diff --git a/nixos/doc/manual/release-notes/rl-2605.section.md b/nixos/doc/manual/release-notes/rl-2605.section.md index 0011534ca895..4d5f7c6a9db7 100644 --- a/nixos/doc/manual/release-notes/rl-2605.section.md +++ b/nixos/doc/manual/release-notes/rl-2605.section.md @@ -41,6 +41,8 @@ of pulling the upstream container image from Docker Hub. If you want the old beh - Ethercalc and its associated module have been removed, as the package is unmaintained and cannot be installed from source with npm now. +- The Bash implementation of the `nixos-rebuild` program is removed. All switchable systems now use the Python rewrite. Any prior usage of `system.rebuild.enableNg` must now be removed. If you have any outstanding issues with the new implementation, please open an issue on GitHub. + ## Other Notable Changes {#sec-release-26.05-notable-changes} diff --git a/nixos/lib/test-driver/default.nix b/nixos/lib/test-driver/default.nix index cb3729941d0e..ed8eb2c8c771 100644 --- a/nixos/lib/test-driver/default.nix +++ b/nixos/lib/test-driver/default.nix @@ -1,41 +1,50 @@ { lib, - python3Packages, - enableOCR ? false, - qemu_pkg ? qemu_test, + + buildPythonApplication, + colorama, coreutils, imagemagick_light, - netpbm, - qemu_test, - socat, + ipython, + junit-xml, + mypy, + ptpython, + python, ruff, + remote-pdb, + + netpbm, + nixosTests, + qemu_pkg ? qemu_test, + qemu_test, + setuptools, + socat, tesseract4, vde2, + + enableOCR ? false, extraPythonPackages ? (_: [ ]), - nixosTests, }: -python3Packages.buildPythonApplication { +buildPythonApplication { pname = "nixos-test-driver"; version = "1.1"; pyproject = true; src = ./src; - build-system = with python3Packages; [ + build-system = [ setuptools ]; - dependencies = - with python3Packages; - [ - colorama - junit-xml - ptpython - ipython - remote-pdb - ] - ++ extraPythonPackages python3Packages; + dependencies = [ + colorama + ipython + junit-xml + ptpython + remote-pdb + ] + ++ extraPythonPackages python.pkgs; propagatedBuildInputs = [ coreutils @@ -55,7 +64,7 @@ python3Packages.buildPythonApplication { doCheck = true; - nativeCheckInputs = with python3Packages; [ + nativeCheckInputs = [ mypy ruff ]; diff --git a/nixos/lib/testing/driver.nix b/nixos/lib/testing/driver.nix index 9eb7f8b7e3e8..fa2ac2c6eef3 100644 --- a/nixos/lib/testing/driver.nix +++ b/nixos/lib/testing/driver.nix @@ -9,7 +9,7 @@ let # Reifies and correctly wraps the python test driver for # the respective qemu version and with or without ocr support - testDriver = hostPkgs.callPackage ../test-driver { + testDriver = hostPkgs.python3Packages.callPackage ../test-driver { inherit (config) enableOCR extraPythonPackages; qemu_pkg = config.qemu.package; imagemagick_light = hostPkgs.imagemagick_light.override { inherit (hostPkgs) libtiff; }; diff --git a/nixos/modules/installer/tools/tools.nix b/nixos/modules/installer/tools/tools.nix index bf8a27419ae2..fdaafc5f7070 100644 --- a/nixos/modules/installer/tools/tools.nix +++ b/nixos/modules/installer/tools/tools.nix @@ -68,11 +68,8 @@ let }; nixos-install = pkgs.nixos-install.override { }; - nixos-rebuild = pkgs.nixos-rebuild.override { nix = config.nix.package; }; nixos-rebuild-ng = pkgs.nixos-rebuild-ng.override { nix = config.nix.package; - withNgSuffix = false; - withReexec = true; }; defaultFlakeTemplate = '' @@ -279,14 +276,6 @@ in ''; }; - options.system.rebuild.enableNg = lib.mkEnableOption "" // { - default = true; - description = '' - Whether to use ‘nixos-rebuild-ng’ in place of ‘nixos-rebuild’, the - Python-based re-implementation of the original in Bash. - ''; - }; - imports = let mkToolModule = @@ -326,21 +315,19 @@ in name = "nixos-version"; package = nixos-version; }) + (lib.mkRemovedOptionModule [ "system" "rebuild" "enableNg" ] '' + The Bash implementation of nixos-rebuild has been removed in favor of the new Python implementation. + If you have any issues with the new implementation, please create an issue in GitHub and tag the maintainers of 'nixos-rebuild-ng'. + '') ]; config = { documentation.man.man-db.skipPackages = [ nixos-version ]; - warnings = lib.optional (!config.system.disableInstallerTools && !config.system.rebuild.enableNg) '' - The Bash implementation of nixos-rebuild will be deprecated and removed in the 26.05 release of NixOS. - Please migrate to the newer implementation by removing 'system.rebuild.enableNg = false' from your configuration. - If you are unable to migrate due to any issues with the new implementation, please create an issue and tag the maintainers of 'nixos-rebuild-ng'. - ''; - # These may be used in auxiliary scripts (ie not part of toplevel), so they are defined unconditionally. system.build = { inherit nixos-generate-config nixos-install; - nixos-rebuild = if config.system.rebuild.enableNg then nixos-rebuild-ng else nixos-rebuild; + nixos-rebuild = nixos-rebuild-ng; }; }; } diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix index fc153e0b4e40..3b28c61fee03 100644 --- a/nixos/tests/all-tests.nix +++ b/nixos/tests/all-tests.nix @@ -1087,25 +1087,12 @@ in nixos-generate-config = runTest ./nixos-generate-config.nix; nixos-rebuild-install-bootloader = handleTestOn [ "x86_64-linux" - ] ./nixos-rebuild-install-bootloader.nix { withNg = false; }; - nixos-rebuild-install-bootloader-ng = handleTestOn [ - "x86_64-linux" - ] ./nixos-rebuild-install-bootloader.nix { withNg = true; }; + ] ./nixos-rebuild-install-bootloader.nix { }; nixos-rebuild-specialisations = runTestOn [ "x86_64-linux" ] { imports = [ ./nixos-rebuild-specialisations.nix ]; - _module.args.withNg = false; - }; - nixos-rebuild-specialisations-ng = runTestOn [ "x86_64-linux" ] { - imports = [ ./nixos-rebuild-specialisations.nix ]; - _module.args.withNg = true; }; nixos-rebuild-target-host = runTest { imports = [ ./nixos-rebuild-target-host.nix ]; - _module.args.withNg = false; - }; - nixos-rebuild-target-host-ng = runTest { - imports = [ ./nixos-rebuild-target-host.nix ]; - _module.args.withNg = true; }; nixpkgs = pkgs.callPackage ../modules/misc/nixpkgs/test.nix { inherit evalMinimalConfig; }; nixseparatedebuginfod2 = runTest ./nixseparatedebuginfod2.nix; diff --git a/nixos/tests/installer.nix b/nixos/tests/installer.nix index d9df8f820ee7..cef75b350be5 100644 --- a/nixos/tests/installer.nix +++ b/nixos/tests/installer.nix @@ -726,10 +726,7 @@ let libxml2.bin libxslt.bin nixos-artwork.wallpapers.simple-dark-gray-bottom - (nixos-rebuild-ng.override { - withNgSuffix = false; - withReexec = true; - }) + nixos-rebuild-ng ntp perlPackages.ConfigIniFiles perlPackages.FileSlurp diff --git a/nixos/tests/nixos-rebuild-install-bootloader.nix b/nixos/tests/nixos-rebuild-install-bootloader.nix index 53b6d854905d..0641f9c64159 100644 --- a/nixos/tests/nixos-rebuild-install-bootloader.nix +++ b/nixos/tests/nixos-rebuild-install-bootloader.nix @@ -1,10 +1,5 @@ import ./make-test-python.nix ( - { - pkgs, - lib, - withNg ? false, - ... - }: + { pkgs, lib, ... }: { name = "nixos-rebuild-install-bootloader"; @@ -24,7 +19,6 @@ import ./make-test-python.nix ( }; system.includeBuildDependencies = true; - system.rebuild.enableNg = withNg; virtualisation = { cores = 2; @@ -52,7 +46,6 @@ import ./make-test-python.nix ( forceInstall = true; }; - system.rebuild.enableNg = ${lib.boolToString withNg}; documentation.enable = false; } ''; diff --git a/nixos/tests/nixos-rebuild-specialisations.nix b/nixos/tests/nixos-rebuild-specialisations.nix index 6c9172fe17bb..96ae337c8c58 100644 --- a/nixos/tests/nixos-rebuild-specialisations.nix +++ b/nixos/tests/nixos-rebuild-specialisations.nix @@ -1,9 +1,4 @@ -{ - hostPkgs, - lib, - withNg, - ... -}: +{ hostPkgs, ... }: { name = "nixos-rebuild-specialisations"; @@ -33,7 +28,6 @@ pkgs.grub2 ]; - system.rebuild.enableNg = withNg; system.switch.enable = true; virtualisation = { @@ -66,8 +60,6 @@ (pkgs.writeShellScriptBin "parent" "") ]; - system.rebuild.enableNg = ${lib.boolToString withNg}; - specialisation.foo = { inheritParentConfig = true; diff --git a/nixos/tests/nixos-rebuild-target-host.nix b/nixos/tests/nixos-rebuild-target-host.nix index 480963fa1bf1..3a160677fc52 100644 --- a/nixos/tests/nixos-rebuild-target-host.nix +++ b/nixos/tests/nixos-rebuild-target-host.nix @@ -1,9 +1,4 @@ -{ - hostPkgs, - lib, - withNg, - ... -}: +{ hostPkgs, ... }: { name = "nixos-rebuild-target-host"; @@ -26,20 +21,15 @@ connect-timeout = 1; }; - environment.systemPackages = [ pkgs.passh ]; - system.includeBuildDependencies = true; virtualisation = { cores = 2; - memorySize = 2048; + memorySize = 3072; }; system.build.privateKey = snakeOilPrivateKey; system.build.publicKey = snakeOilPublicKey; - # We don't switch on `deployer`, but we need it to have the dependencies - # available, to be picked up by system.includeBuildDependencies above. - system.rebuild.enableNg = withNg; system.switch.enable = true; }; @@ -130,19 +120,13 @@ forceInstall = true; }; - system.rebuild.enableNg = ${lib.boolToString withNg}; - - ${lib.optionalString withNg # nix - '' - nixpkgs.overlays = [ - (final: prev: { - # Set tmpdir inside nixos-rebuild-ng to test - # "Deploy works with very long TMPDIR" - nixos-rebuild-ng = prev.nixos-rebuild-ng.override { withTmpdir = "/tmp"; }; - }) - ]; - '' - } + nixpkgs.overlays = [ + (final: prev: { + # Set tmpdir inside nixos-rebuild-ng to test + # "Deploy works with very long TMPDIR" + nixos-rebuild-ng = prev.nixos-rebuild-ng.override { withTmpdir = "/tmp"; }; + }) + ]; # this will be asserted networking.hostName = "${hostname}"; @@ -163,7 +147,6 @@ deployer.copy_from_host("${configFile "config-1-deployed"}", "/root/configuration-1.nix") deployer.copy_from_host("${configFile "config-2-deployed"}", "/root/configuration-2.nix") - deployer.copy_from_host("${configFile "config-3-deployed"}", "/root/configuration-3.nix") deployer.copy_from_host("${targetNetworkJSON}", "/root/target-network.json") deployer.copy_from_host("${targetConfigJSON}", "/root/target-configuration.json") @@ -181,12 +164,6 @@ target_hostname = deployer.succeed("ssh alice@target cat /etc/hostname").rstrip() assert target_hostname == "config-2-deployed", f"{target_hostname=}" - with subtest("Deploy to bob@target with password based sudo"): - # TODO: investigate why --ask-sudo-password from nixos-rebuild-ng is not working here - deployer.succeed(r'${lib.optionalString withNg "NIX_SSHOPTS=-t "}passh -c 3 -C -p ${nodes.target.users.users.bob.password} -P "\[sudo\] password" nixos-rebuild switch -I nixos-config=/root/configuration-3.nix --target-host bob@target --sudo &>/dev/console') - target_hostname = deployer.succeed("ssh alice@target cat /etc/hostname").rstrip() - assert target_hostname == "config-3-deployed", f"{target_hostname=}" - with subtest("Deploy works with very long TMPDIR"): tmp_dir = "/var/folder/veryveryveryveryverylongpathnamethatdoesnotworkwithcontrolpath" deployer.succeed(f"mkdir -p {tmp_dir}") diff --git a/pkgs/by-name/bi/bind/package.nix b/pkgs/by-name/bi/bind/package.nix index 68b0f8f4f81f..208db30f4350 100644 --- a/pkgs/by-name/bi/bind/package.nix +++ b/pkgs/by-name/bi/bind/package.nix @@ -29,11 +29,11 @@ stdenv.mkDerivation (finalAttrs: { pname = "bind"; - version = "9.20.15"; + version = "9.20.16"; src = fetchurl { url = "https://downloads.isc.org/isc/bind9/${finalAttrs.version}/bind-${finalAttrs.version}.tar.xz"; - hash = "sha256-1is4+uSLqD/KYYERLQxxAY2LDyzihdx53GoDZ3Isyrs="; + hash = "sha256-A//Mek/LfDm4KzS+G6K1n2wZG8eVxZNVMNXr5jCjUtY="; }; outputs = [ diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/package.nix b/pkgs/by-name/ni/nixos-rebuild-ng/package.nix index 33f52e0e1c68..b62492b58b66 100644 --- a/pkgs/by-name/ni/nixos-rebuild-ng/package.nix +++ b/pkgs/by-name/ni/nixos-rebuild-ng/package.nix @@ -9,20 +9,15 @@ python3Packages, runCommand, scdoc, - withNgSuffix ? true, - withReexec ? false, withShellFiles ? true, # Very long tmp dirs lead to "too long for Unix domain socket" # SSH ControlPath errors. Especially macOS sets long TMPDIR paths. withTmpdir ? if stdenv.hostPlatform.isDarwin then "/tmp" else null, # passthru.tests nixosTests, - nixVersions, - lixPackageSets, - nixos-rebuild-ng, }: let - executable = if withNgSuffix then "nixos-rebuild-ng" else "nixos-rebuild"; + executable = "nixos-rebuild"; in python3Packages.buildPythonApplication rec { pname = "nixos-rebuild-ng"; @@ -55,11 +50,7 @@ python3Packages.buildPythonApplication rec { postPatch = '' substituteInPlace nixos_rebuild/constants.py \ --subst-var-by executable ${executable} \ - --subst-var-by withReexec ${lib.boolToString withReexec} \ --subst-var-by withShellFiles ${lib.boolToString withShellFiles} - - substituteInPlace pyproject.toml \ - --replace-fail nixos-rebuild ${executable} ''; postInstall = lib.optionalString withShellFiles '' @@ -103,32 +94,11 @@ python3Packages.buildPythonApplication rec { }; tests = { - with_reexec = nixos-rebuild-ng.override { - withReexec = true; - withNgSuffix = false; - }; - with_nix_latest = nixos-rebuild-ng.override { - nix = nixVersions.latest; - }; - with_nix_stable = nixos-rebuild-ng.override { - nix = nixVersions.stable; - }; - with_nix_2_28 = nixos-rebuild-ng.override { - # oldest supported version in nixpkgs - nix = nixVersions.nix_2_28; - }; - with_lix_latest = nixos-rebuild-ng.override { - nix = lixPackageSets.latest.lix; - }; - with_lix_stable = nixos-rebuild-ng.override { - nix = lixPackageSets.stable.lix; - }; - inherit (nixosTests) # FIXME: this test is disabled since it times out in @ofborg - # nixos-rebuild-install-bootloader-ng - nixos-rebuild-specialisations-ng - nixos-rebuild-target-host-ng + # nixos-rebuild-install-bootloader + nixos-rebuild-specialisations + nixos-rebuild-target-host ; repl = callPackage ./tests/repl.nix { }; # NOTE: this is a passthru test rather than a build-time test because we diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py index ce7108175f0c..e4fa5ef75a43 100644 --- a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py +++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py @@ -5,7 +5,7 @@ from subprocess import CalledProcessError, run from typing import Final, assert_never from . import nix, services -from .constants import EXECUTABLE, WITH_REEXEC, WITH_SHELL_FILES +from .constants import EXECUTABLE, WITH_SHELL_FILES from .models import Action, BuildAttr, Flake, GroupedNixArgs, Profile from .process import Remote from .utils import LogFormatter @@ -288,7 +288,7 @@ def execute(argv: list[str]) -> None: # Re-exec to a newer version of the script before building to ensure we get # the latest fixes - if WITH_REEXEC and can_run and not args.no_reexec: + if can_run and not args.no_reexec: services.reexec(argv, args, grouped_nix_args) profile = Profile.from_arg(args.profile_name) diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/constants.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/constants.py index 03d4bb79eb61..88f59111669f 100644 --- a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/constants.py +++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/constants.py @@ -7,5 +7,4 @@ from typing import Final EXECUTABLE: Final[str] = "@executable@" # Use either `== "true"` if the default (e.g.: `python -m nixos_rebuild`) is # `False` or `!= "false"` if the default is `True` -WITH_REEXEC: Final[bool] = "@withReexec@" == "true" WITH_SHELL_FILES: Final[bool] = "@withShellFiles@" == "true" diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/process.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/process.py index 1f57111a72ef..902797189c69 100644 --- a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/process.py +++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/process.py @@ -7,6 +7,7 @@ import shlex import subprocess from collections.abc import Sequence from dataclasses import dataclass +from ipaddress import AddressValueError, IPv6Address from typing import Final, Self, TypedDict, Unpack from . import tmpdir @@ -63,6 +64,23 @@ class Remote: "'--ask-sudo-password' option instead" ) + def ssh_host(self) -> str: + """Fix up host string for SSH. + + It returns an SSH-compatible host string if the host is using an + IPv6 address, otherwise it returns the passed host string unmodified. + """ + try: + host_split = self.host.split("@") + host_fixed = host_split[-1].strip("[]").replace("%25", "%") + IPv6Address(host_fixed) + if len(host_split) > 1: + return host_split[0] + "@" + host_fixed + else: + return host_fixed + except AddressValueError: + return self.host + # Not exhaustive, but we can always extend it later. class RunKwargs(TypedDict, total=False): @@ -112,7 +130,7 @@ def run_wrapper( "ssh", *remote.opts, *SSH_DEFAULT_OPTS, - remote.host, + remote.ssh_host(), "--", # SSH will join the parameters here and pass it to the shell, so we # need to quote it to avoid issues. @@ -187,7 +205,7 @@ def _kill_long_running_ssh_process(args: Args, remote: Remote) -> None: "ssh", *remote.opts, *SSH_DEFAULT_OPTS, - remote.host, + remote.ssh_host(), "--", "pkill", "--signal", diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_process.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_process.py index 84eba633b21b..84b5c084bf38 100644 --- a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_process.py +++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_process.py @@ -140,3 +140,23 @@ def test_remote_from_name(monkeypatch: MonkeyPatch) -> None: opts=["-f", "foo", "-b", "bar", "-t"], sudo_password="password", ) + + +def test_ssh_host() -> None: + remotes = { + "user@[fe80::1%25eth0]": "user@fe80::1%eth0", + "[fe80::c98b%25enp4s0]": "fe80::c98b%enp4s0", + "user@[2001::5fce:a:198]": "user@2001::5fce:a:198", + "[2001::dead:beef]": "2001::dead:beef", + "root@192.168.178.1": "root@192.168.178.1", + "192.168.178.1": "192.168.178.1", + "user@localhost": "user@localhost", + "localhost": "localhost", + "user@example.org": "user@example.org", + "example.org": "example.org", + } + + for host_input, expected in remotes.items(): + remote = m.Remote.from_arg(host_input, None, False) + assert remote is not None + assert remote.ssh_host() == expected diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/tests/repl.nix b/pkgs/by-name/ni/nixos-rebuild-ng/tests/repl.nix index 1a614e8d8655..3408d95d2cdf 100644 --- a/pkgs/by-name/ni/nixos-rebuild-ng/tests/repl.nix +++ b/pkgs/by-name/ni/nixos-rebuild-ng/tests/repl.nix @@ -37,7 +37,7 @@ runCommand "test-nixos-rebuild-repl" nativeBuildInputs = [ expect nix - (nixos-rebuild-ng.override { withNgSuffix = false; }) + nixos-rebuild-ng ]; nixpkgs = if builtins.pathExists (path + "/.git") then lib.cleanSource path else path; diff --git a/pkgs/by-name/ru/ruff/package.nix b/pkgs/by-name/ru/ruff/package.nix index cc2c53592271..17ce5aa19ab4 100644 --- a/pkgs/by-name/ru/ruff/package.nix +++ b/pkgs/by-name/ru/ruff/package.nix @@ -16,18 +16,18 @@ rustPlatform.buildRustPackage (finalAttrs: { pname = "ruff"; - version = "0.14.8"; + version = "0.14.9"; src = fetchFromGitHub { owner = "astral-sh"; repo = "ruff"; tag = finalAttrs.version; - hash = "sha256-jL3zQS2F9pxsWolNKgw8Tn53DHragGwonNmNV8t8h80="; + hash = "sha256-2EuI11mdwxKry7d56Ua7ZEU7K0XMgIVHm1zSVoWLkzM="; }; cargoBuildFlags = [ "--package=ruff" ]; - cargoHash = "sha256-GEf/gU2DXz+u7kPHAB1NRqkmn0f7NV3M5U9u17adtkI="; + cargoHash = "sha256-db45h6I5tCcPMbPGa/dV3eJ9CxCwnGShmHdg92AUhv0="; nativeBuildInputs = [ installShellFiles ]; diff --git a/pkgs/by-name/sc/scdoc/package.nix b/pkgs/by-name/sc/scdoc/package.nix index 9324e1cef34a..9582a863a332 100644 --- a/pkgs/by-name/sc/scdoc/package.nix +++ b/pkgs/by-name/sc/scdoc/package.nix @@ -7,13 +7,13 @@ stdenv.mkDerivation (finalAttrs: { pname = "scdoc"; - version = "1.11.3"; + version = "1.11.4"; src = fetchFromSourcehut { owner = "~sircmpwn"; repo = "scdoc"; rev = finalAttrs.version; - hash = "sha256-MbLDhLn/JY6OcdOz9/mIPAQRp5TZ6IKuQ/FQ/R3wjGc="; + hash = "sha256-gldCHzLigeLKDFDcE3TYrNOEWoSt/uYIg9aTg6wwW54="; }; outputs = [ @@ -22,11 +22,6 @@ stdenv.mkDerivation (finalAttrs: { "dev" ]; - postPatch = '' - substituteInPlace Makefile \ - --replace "LDFLAGS+=-static" "LDFLAGS+=" - ''; - makeFlags = [ "PREFIX=${placeholder "out"}" ] diff --git a/pkgs/development/misc/resholve/test.nix b/pkgs/development/misc/resholve/test.nix index f97ab53efb12..99fdb817db2b 100644 --- a/pkgs/development/misc/resholve/test.nix +++ b/pkgs/development/misc/resholve/test.nix @@ -33,7 +33,6 @@ mount, ncurses, nixos-install-tools, - nixos-rebuild, procps, ps, # known consumers @@ -288,7 +287,6 @@ rec { ] ++ lib.optionals stdenv.hostPlatform.isLinux [ nixos-install-tools - nixos-rebuild ]; interpreter = "none"; execer = [ @@ -315,7 +313,6 @@ rec { '' + lib.optionalString stdenv.hostPlatform.isLinux '' nixos-generate-config fake args - nixos-rebuild fake args '' ); diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json index 1d10800b97de..1fc12f5f0ad8 100644 --- a/pkgs/os-specific/linux/kernel/kernels-org.json +++ b/pkgs/os-specific/linux/kernel/kernels-org.json @@ -25,18 +25,18 @@ "lts": true }, "6.12": { - "version": "6.12.61", - "hash": "sha256:0d8pbx0j5g2ag4im5k3dcqiwp5jxjja29p195zqpd1jj0m8p8s8s", + "version": "6.12.62", + "hash": "sha256:04rcnr7bgrqqfj62l31mxx553bjdalr5f46xjbcmvawgmj2wdqhk", "lts": true }, "6.17": { - "version": "6.17.11", - "hash": "sha256:0zi5mw6953iic9hwx78bjww81mcpb9y2sj5dgf819w9506pihjwk", + "version": "6.17.12", + "hash": "sha256:1mlqirjzyx3zvvm87gf7slj2d5gdpp13vw91dgbfk54iz6b08y22", "lts": false }, "6.18": { - "version": "6.18", - "hash": "sha256:0jzdvk3xdai1xsq0739hmf8rapw15dw5inarfvqizqx9bmha81li", + "version": "6.18.1", + "hash": "sha256:1m955svk1sfmhpw5wpkhg1dpnxmwsnpdqnivmw8alaniy3rqp9yh", "lts": false } } diff --git a/pkgs/os-specific/linux/nixos-rebuild/_nixos-rebuild b/pkgs/os-specific/linux/nixos-rebuild/_nixos-rebuild deleted file mode 100644 index bc026ef75ac9..000000000000 --- a/pkgs/os-specific/linux/nixos-rebuild/_nixos-rebuild +++ /dev/null @@ -1,166 +0,0 @@ -#!/usr/bin/env bash - -# We're faking a `nix build` command-line to re-use Nix's own completion -# for the few options passed through to Nix. -_nixos-rebuild_pretend-nix() { - COMP_LINE="nix build ${COMP_LINE}" - # number of prepended chars - (( COMP_POINT = COMP_POINT + 10)) - - COMP_WORDS=( - nix build - "${COMP_WORDS[@]}" - ) - # Add the amount of prepended words - (( COMP_CWORD = COMP_CWORD + 2)) - _complete_nix "nix" -} - -_nixos-rebuild() { - local curr="$2" - local prev="$3" - local subcommandGiven=0 - local word - local subcommand - - __load_completion nix - - # Arrays are re-ordered by the completion, so it's fine to sort them in logical chunks - local all_args=( - --verbose -v - - # nixos-rebuild options - --fast - --no-build-nix - --profile-name -p # name - --rollback - --specialisation -c # name - --sudo - --no-ssh-tty - --build-host # host - --target-host # host - # Used with list-generations - --json - - # generation switching options - --install-bootloader - - # nix-channel options - --upgrade - --upgrade-all - - # flakes options - --commit-lock-file - --flake -F # flake-uri - --override-input # input-name flake-uri - --recreate-lock-file - --update-input - --no-flake - --no-registries - --no-update-lock-file - --no-write-lock-file - - # Nix-copy options - --use-substitutes --substitute-on-destination -s - - # Nix options - --option - --impure - --builders # builder-spec - --show-trace - --keep-failed -K - --keep-going -k - --max-jobs -j # number - --log-format # format - -I # NIX_PATH - ) - - local all_subcommands=( - boot - build - build-vm - build-vm-with-bootloader - dry-activate - dry-build - edit - list-generations - switch - test - ) - - # Suggest arguments that can be consumed under some conditions only - for word in "${COMP_WORDS[@]}"; do - for subcommand in "${all_subcommands[@]}"; do - if [[ "$word" == "$subcommand" ]]; then - subcommandGiven=1 - fi - done - done - - # Fake out a way to complete the second arg to some options - case "${COMP_WORDS[COMP_CWORD-2]}" in - "--override-input") - prev="--override-input_2" - ;; - "--option") - prev="--option_2" - ;; - esac - - case "$prev" in - --max-jobs|-j) - COMPREPLY=( ) - ;; - - --profile-name|-p) - if [[ "$curr" == "" ]]; then - COMPREPLY=( /nix/var/nix/profiles/* ) - else - COMPREPLY=( "$curr"* ) - fi - ;; - - --build-host|--target-host|-t|-h) - _known_hosts_real "$curr" - ;; - - --specialisation|-c) - COMPREPLY=() - ;; - - -I) - _nixos-rebuild_pretend-nix - ;; - --builders) - _nixos-rebuild_pretend-nix - ;; - --flake) - _nixos-rebuild_pretend-nix - ;; - --override-input) - _nixos-rebuild_pretend-nix - ;; - --override-input_2) - _nixos-rebuild_pretend-nix - ;; - --log-format) - _nixos-rebuild_pretend-nix - ;; - --option) - _nixos-rebuild_pretend-nix - ;; - --option_2) - _nixos-rebuild_pretend-nix - ;; - - *) - if [[ "$curr" == -* ]] || (( subcommandGiven )); then - COMPREPLY=( $(compgen -W "${all_args[*]}" -- "$2") ) - else - COMPREPLY=( $(compgen -W "${all_subcommands[*]}" -- "$2") ) - fi - ;; - esac -} - -complete -F _nixos-rebuild nixos-rebuild diff --git a/pkgs/os-specific/linux/nixos-rebuild/default.nix b/pkgs/os-specific/linux/nixos-rebuild/default.nix deleted file mode 100644 index 13d0a6991133..000000000000 --- a/pkgs/os-specific/linux/nixos-rebuild/default.nix +++ /dev/null @@ -1,88 +0,0 @@ -{ - callPackage, - substitute, - runtimeShell, - coreutils, - gnused, - gnugrep, - jq, - util-linux, - nix, - lib, - nixosTests, - installShellFiles, - binlore, - nixos-rebuild, -}: -let - fallback = import ./../../../../nixos/modules/installer/tools/nix-fallback-paths.nix; -in -substitute { - name = "nixos-rebuild"; - src = ./nixos-rebuild.sh; - dir = "bin"; - isExecutable = true; - - substitutions = [ - "--subst-var-by" - "runtimeShell" - runtimeShell - "--subst-var-by" - "nix" - nix - "--subst-var-by" - "nix_x86_64_linux" - fallback.x86_64-linux - "--subst-var-by" - "nix_i686_linux" - fallback.i686-linux - "--subst-var-by" - "nix_aarch64_linux" - fallback.aarch64-linux - "--subst-var-by" - "path" - (lib.makeBinPath [ - coreutils - gnused - gnugrep - jq - util-linux - ]) - ]; - - nativeBuildInputs = [ - installShellFiles - ]; - - postInstall = '' - installManPage ${./nixos-rebuild.8} - - installShellCompletion \ - --bash ${./_nixos-rebuild} - ''; - - # run some a simple installer tests to make sure nixos-rebuild still works for them - passthru.tests = { - install-bootloader = nixosTests.nixos-rebuild-install-bootloader; - repl = callPackage ./test/repl.nix { }; - simple-installer = nixosTests.installer.simple; - specialisations = nixosTests.nixos-rebuild-specialisations; - target-host = nixosTests.nixos-rebuild-target-host; - }; - - # nixos-rebuild can’t execute its arguments - # (but it can run ssh with the with the options stored in $NIX_SSHOPTS, - # and ssh can execute its arguments...) - passthru.binlore.out = binlore.synthesize nixos-rebuild '' - execer cannot bin/nixos-rebuild - ''; - - meta = { - description = "Rebuild your NixOS configuration and switch to it, on local hosts and remote"; - homepage = "https://github.com/NixOS/nixpkgs/tree/master/pkgs/os-specific/linux/nixos-rebuild"; - license = lib.licenses.mit; - maintainers = [ lib.maintainers.Profpatsch ]; - teams = [ lib.teams.nixos-rebuild ]; - mainProgram = "nixos-rebuild"; - }; -} diff --git a/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.8 b/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.8 deleted file mode 100644 index 72ced00b81ef..000000000000 --- a/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.8 +++ /dev/null @@ -1,587 +0,0 @@ -.Dd January 1, 1980 -.Dt nixos-rebuild 8 -.Os -.Sh NAME -.Nm nixos-rebuild -.Nd reconfigure a NixOS machine -. -. -. -.Sh SYNOPSIS -.Nm -.Bro -.Cm switch | boot | test | build | dry-build | dry-activate | edit | repl | build-vm | build-vm-with-bootloader | build-image | list-generations Op Fl -json -.Brc -.br -.Op Fl -upgrade | -upgrade-all -.Op Fl -install-bootloader -.Op Fl -no-build-nix -.Op Fl -fast -.Op Fl -rollback -.br -.Op Fl -file | f Ar path -.Op Fl -attr | A Ar attrPath -.Op Fl -flake | F Ar flake-uri -.Op Fl -no-flake -.Op Fl -recreate-lock-file -.Op Fl -no-update-lock-file -.Op Fl -no-write-lock-file -.Op Fl -no-registries -.Op Fl -commit-lock-file -.Op Fl -update-input Ar input-path -.Op Fl -override-input Ar input-path flake-url -.br -.Op Fl -profile-name | p Ar name -.Op Fl -specialisation | c Ar name -.br -.Op Fl -image-variant Ar variant -.br -.Op Fl -build-host Va host -.Op Fl -target-host Va host -.Op Fl -sudo -.Op Fl -no-ssh-tty -.br -.Op Fl -verbose | v -.Op Fl -quiet -.Op Fl -log-format Ar format -.Op Fl -no-build-output | Q -.Op Fl -max-jobs | j Va number -.Op Fl -cores Va number -.Op Fl -keep-going | k -.Op Fl -keep-failed | K -.Op Fl -fallback -.Op Fl I Va NIX_PATH -.Op Fl -option Ar name value -.Op Fl -repair -.Op Fl -builders Va builder-spec -.Op Fl -accept-flake-config -.Op Fl -print-build-logs | L -.Op Fl -show-trace -.Op Fl -refresh -.Op Fl -impure -.Op Fl -offline -.Op Fl -no-net -. -. -. -.Sh DESCRIPTION -This command updates the system so that it corresponds to the -configuration specified in -.Pa /etc/nixos/configuration.nix Ns -, -.Pa /etc/nixos/flake.nix -or the file and attribute specified by the -.Fl -file -and/or -.Fl -attr -options. Thus, every time you modify the configuration or any other NixOS -module, you must run -.Nm -to make the changes take effect. It builds the new system in -.Pa /nix/store Ns -, runs its activation script, and stop and (re)starts any system services if -needed. Please note that user services need to be started manually as they -aren't detected by the activation script at the moment. -. -.Pp -This command has one required argument, which specifies the desired -operation. It must be one of the following: -.Bl -tag -width indent -.It Cm switch -Build and activate the new configuration, and make it the boot default. That -is, the configuration is added to the GRUB boot menu as the default -menu entry, so that subsequent reboots will boot the system into the new -configuration. Previous configurations activated with -.Ic nixos-rebuild switch -or -.Ic nixos-rebuild boot -remain available in the GRUB menu. -.Pp -Note that if you are using specializations, running just -.Ic nixos-rebuild switch -will switch you back to the unspecialized, base system \(em in that case, you -might want to use this instead: -.Bd -literal -offset indent -$ nixos-rebuild switch --specialisation your-specialisation-name -.Ed -.Pp -This command will build all specialisations and make them bootable just -like regular -.Ic nixos-rebuild switch -does \(em the only thing different is that it will switch to given -specialisation instead of the base system; it can be also used to switch from -the base system into a specialised one, or to switch between specialisations. -. -.It Cm boot -Build the new configuration and make it the boot default (as with -.Ic nixos-rebuild switch Ns -), but do not activate it. That is, the system continues to run the previous -configuration until the next reboot. -. -.It Cm test -Build and activate the new configuration, but do not add it to the GRUB -boot menu. Thus, if you reboot the system (or if it crashes), you will -automatically revert to the default configuration (i.e. the -configuration resulting from the last call to -.Ic nixos-rebuild switch -or -.Ic nixos-rebuild boot Ns -). -.Pp -Note that if you are using specialisations, running just -.Ic nixos-rebuild test -will activate the unspecialised, base system \(em in that case, you might want -to use this instead: -.Bd -literal -offset indent -$ nixos-rebuild test --specialisation your-specialisation-name -.Ed -.Pp -This command can be also used to switch from the base system into a -specialised one, or to switch between specialisations. -. -.It Cm build -Build the new configuration, but neither activate it nor add it to the -GRUB boot menu. It leaves a symlink named -.Pa result -in the current directory, which points to the output of the top-level -.Dq system -derivation. This is essentially the same as doing -.Bd -literal -offset indent -$ nix-build /path/to/nixpkgs/nixos -A system -.Ed -.Pp -Note that you do not need to be root to run -.Ic nixos-rebuild build Ns -\&. -. -.It Cm dry-build -Show what store paths would be built or downloaded by any of the -operations above, but otherwise do nothing. -. -.It Cm dry-activate -Build the new configuration, but instead of activating it, show what -changes would be performed by the activation (i.e. by -.Ic nixos-rebuild test Ns -). For instance, this command will print which systemd units would be restarted. -The list of changes is not guaranteed to be complete. -. -.It Cm edit -Opens -.Pa configuration.nix -in the default editor. -. -.It Cm repl -Opens the configuration in -.Ic nix repl Ns . -. -.It Cm build-vm -Build a script that starts a NixOS virtual machine with the desired -configuration. It leaves a symlink -.Pa result -in the current directory that points (under -.Ql result/bin/run\- Ns Va hostname Ns \-vm Ns -) -at the script that starts the VM. Thus, to test a NixOS configuration in -a virtual machine, you should do the following: -.Bd -literal -offset indent -$ nixos-rebuild build-vm -$ ./result/bin/run-*-vm -.Ed -.Pp -The VM is implemented using the -.Ql qemu -package. For best performance, you should load the -.Ql kvm-intel -or -.Ql kvm-amd -kernel modules to get hardware virtualisation. -.Pp -The VM mounts the Nix store of the host through the 9P file system. The -host Nix store is read-only, so Nix commands that modify the Nix store -will not work in the VM. This includes commands such as -.Nm Ns -; to change the VM’s configuration, you must halt the VM and re-run the commands -above. -.Pp -The VM has its own ext3 root file system, which is automatically created when -the VM is first started, and is persistent across reboots of the VM. It is -stored in -.Ql ./ Ns Va hostname Ns .qcow2 Ns -\&. -.\" The entire file system hierarchy of the host is available in -.\" the VM under -.\" .Pa /hostfs Ns -.\" . -. -.It Cm build-vm-with-bootloader -Like -.Cm build-vm Ns -, but boots using the regular boot loader of your configuration (e.g. GRUB 1 or -2), rather than booting directly into the kernel and initial ramdisk of the -system. This allows you to test whether the boot loader works correctly. \ -However, it does not guarantee that your NixOS configuration will boot -successfully on the host hardware (i.e., after running -.Ic nixos-rebuild switch Ns -), because the hardware and boot loader configuration in the VM are different. -The boot loader is installed on an automatically generated virtual disk -containing a -.Pa /boot -partition. -. -.It Cm build-image -Build a disk-image variant, pre-configured for the given platform/provider. -Select a variant with the -.Fl -image-variant -option or run without any options to get a list of available variants. - -.Bd -literal -offset indent -$ nixos-rebuild build-image --image-variant proxmox -.Ed -. -.It Cm list-generations Op Fl -json -List the available generations in a similar manner to the boot loader -menu. It shows the generation number, build date and time, NixOS version, -kernel version and the configuration revision. -There is also a json version of output available. -.El -. -. -. -.Sh OPTIONS -.Bl -tag -width indent -.It Fl -upgrade , -upgrade-all -Update the root user's channel named -.Ql nixos -before rebuilding the system. -.Pp -In addition to the -.Ql nixos -channel, the root user's channels which have a file named -.Ql .update-on-nixos-rebuild -in their base directory will also be updated. -.Pp -Passing -.Fl -upgrade-all -updates all of the root user's channels. -. -.It Fl -install-bootloader -Causes the boot loader to be (re)installed on the device specified by the -relevant configuration options. -. -.It Fl -no-build-nix -Normally, -.Nm -first builds the -.Ql nix -attribute in Nixpkgs, and uses the resulting instance of the Nix package manager -to build the new system configuration. This is necessary if the NixOS modules -use features not provided by the currently installed version of Nix. This option -disables building a new Nix. -. -.It Fl -fast -Equivalent to -.Fl -no-build-nix Ns -\&. This option is useful if you call -.Nm -frequently (e.g. if you’re hacking on a NixOS module). -. -.It Fl -rollback -Instead of building a new configuration as specified by -.Pa /etc/nixos/configuration.nix Ns -, roll back to the previous configuration. (The previous configuration is -defined as the one before the “current” generation of the Nix profile -.Pa /nix/var/nix/profiles/system Ns -\&.) -. -.It Fl -builders Ar builder-spec -Allow ad-hoc remote builders for building the new system. This requires -the user executing -.Nm -(usually root) to be configured as a trusted user in the Nix daemon. This can be -achieved by using the -.Va nix.settings.trusted-users -NixOS option. Examples values for that option are described in the -.Dq Remote builds -chapter in the Nix manual, (i.e. -.Ql --builders \(dqssh://bigbrother x86_64-linux\(dq Ns -). By specifying an empty string existing builders specified in -.Pa /etc/nix/machines -can be ignored: -.Ql --builders \(dq\(dq -for example when they are not reachable due to network connectivity. -. -.It Fl -profile-name Ar name , Fl p Ar name -Instead of using the Nix profile -.Pa /nix/var/nix/profiles/system -to keep track of the current and previous system configurations, use -.Pa /nix/var/nix/profiles/system-profiles/ Ns Va name Ns -\&. When you use GRUB 2, for every system profile created with this flag, NixOS -will create a submenu named -.Dq NixOS - Profile Va name -in GRUB’s boot menu, containing the current and previous configurations of this profile. -.Pp -For instance, if you want to test a configuration file named -.Pa test.nix -without affecting the default system profile, you would do: -.Bd -literal -offset indent -$ nixos-rebuild switch -p test -I nixos-config=./test.nix -.Ed -.Pp -The new configuration will appear in the GRUB 2 submenu -.Dq NixOS - Profile 'test' Ns -\&. -. -.It Fl -specialisation Ar name , Fl c Ar name -Activates given specialisation; when not specified, switching and testing -will activate the base, unspecialised system. -. -.It Fl -image-variant Ar variant -Selects an image variant to build from -the -.Va config.system.build.images -attribute of the given configuration. A list of variants is printed if this option remains unset. -. -.It Fl -build-host Ar host -Instead of building the new configuration locally, use the specified host -to perform the build. The host needs to be accessible with -.Ic ssh Ns , -and must be able to perform Nix builds. If the option -.Fl -target-host -is not set, the build will be copied back to the local machine when done. -.Pp -Note that, if -.Fl -no-build-nix -is not specified, Nix will be built both locally and remotely. This is because -the configuration will always be evaluated locally even though the building -might be performed remotely. -.Pp -You can include a remote user name in the host name -.Ns ( Va user@host Ns -). You can also set ssh options by defining the -.Ev NIX_SSHOPTS -environment variable. -. -.It Fl -target-host Ar host -Specifies the NixOS target host. By setting this to something other than an -empty string, the system activation will happen on the remote host instead of -the local machine. The remote host needs to be accessible over -.Ic ssh Ns , -and for the commands -.Cm switch Ns -, -.Cm boot -and -.Cm test -you need root access. -.Pp -If -.Fl -build-host -is not explicitly specified or empty, building will take place locally. -.Pp -You can include a remote user name in the host name -.Ns ( Va user@host Ns -). You can also set ssh options by defining the -.Ev NIX_SSHOPTS -environment variable. -.Pp -Note that -.Nm -honors the -.Va nixpkgs.crossSystem -setting of the given configuration but disregards the true architecture of the -target host. Hence the -.Va nixpkgs.crossSystem -setting has to match the target platform or else activation will fail. -. -.It Fl -use-substitutes -When set, nixos-rebuild will add -.Fl -use-substitutes -to each invocation of nix-copy-closure. This will only affect the behavior of -nixos-rebuild if -.Fl -target-host -or -.Fl -build-host -is also set. This is useful when the target-host connection to cache.nixos.org -is faster than the connection between hosts. -. -.It Fl -sudo -When set, nixos-rebuild prefixes activation commands that run on the -.Fl -target-host -system with -.Ic sudo Ns -\&. Setting this option allows deploying as a non-root user. -. -.It Fl -no-ssh-tty -When set, nixos-rebuild will not request a tty when executing commands on the -.Fl -target-host -system with -.Ic ssh Ns -\&. This may help avoid corrupted terminal output when running multiple -nixos-rebuild commands in parallel, but may also prevent the remote -.Ic sudo -from working properly. -. -.It Fl -file Ar path , Fl f Ar path -Enable and build the NixOS system from the specified file. The file must -evaluate to an attribute set, and it must contain a valid NixOS configuration -at attribute -.Va attrPath Ns -\&. This is useful for building a NixOS system from a nix file that is not -a flake or a NixOS configuration module. Attribute set a with valid NixOS -configuration can be made using -.Va nixos -function in nixpkgs or importing and calling -.Pa nixos/lib/eval-config.nix -from nixpkgs. If specified without -.Fl -attr -option, builds the configuration from the top-level -attribute of the file. -. -.It Fl -attr Ar attrPath , Fl A Ar attrPath -Enable and build the NixOS system from nix file and use the specified attribute -path from file specified by the -.Fl -file -option. If specified without -.Fl -file -option, uses -.Pa default.nix -in current directory. -. -.It Fl -flake Va flake-uri Ns Op Va #name -Build the NixOS system from the specified flake. It defaults to the directory -containing the target of the symlink -.Pa /etc/nixos/flake.nix Ns -, if it exists. The flake must contain an output named -.Ql nixosConfigurations. Ns Va name Ns -\&. If -.Va name -is omitted, it default to the current host name. -. -.It Fl -no-flake -Do not imply -.Fl -flake -if -.Pa /etc/nixos/flake.nix -exists. With this option, it is possible to build non-flake NixOS configurations -even if the current NixOS systems uses flakes. -.El -.Pp -In addition, -.Nm -accepts following options from nix commands that the tool calls: -. -.Pp -flake-related options: -.Bd -offset indent -.Fl -recreate-lock-file Ns , -.Fl -no-update-lock-file Ns , -.Fl -no-write-lock-file Ns , -.Fl -no-registries Ns , -.Fl -commit-lock-file Ns , -.Fl -update-input Ar input-path Ns , -.Fl -override-input Ar input-path flake-url Ns -.Ed -. -.Pp -Builder options: -.Bd -offset indent -.Fl -verbose Ns , -.Fl v Ns , -.Fl -quiet Ns , -.Fl -log-format Ns , -.Fl -no-build-output Ns , -.Fl Q Ns , -.Fl -max-jobs Ns , -.Fl j Ns , -.Fl -cores Ns , -.Fl -keep-going Ns , -.Fl k Ns , -.Fl -keep-failed Ns , -.Fl K Ns , -.Fl -fallback Ns , -.Fl I Ns , -.Fl -option Ns , -.Fl -repair Ns , -.Fl -builders Ns , -.Fl -accept-flake-config Ns , -.Fl -print-build-logs Ns , -.Fl L Ns , -.Fl -show-trace Ns , -.Fl -refresh Ns , -.Fl -impure Ns , -.Fl -offline Ns , -.Fl -no-net Ns -.Ed -. -.Pp -See the Nix manual, -.Ic nix flake lock --help -or -.Ic nix-build --help -for details. -. -. -. -.Sh ENVIRONMENT -.Bl -tag -width indent -.It Ev NIXOS_CONFIG -Path to the main NixOS configuration module. Defaults to -.Pa /etc/nixos/configuration.nix Ns -\&. -. -.It Ev NIX_PATH -A colon-separated list of directories used to look up Nix expressions enclosed -in angle brackets (e.g. ). Example: -.Bd -literal -offset indent -nixpkgs=./my-nixpkgs -.Ed -. -.It Ev NIX_SSHOPTS -Additional options to be passed to -.Ic ssh -on the command line. -.Ed -. -.It Ev NIXOS_SWITCH_USE_DIRTY_ENV -Expose the the current environment variables to post activation scripts. Will -skip usage of -.Ic systemd-run -during system activation. Possibly dangerous, specially in remote environments -(e.g.: via SSH). Will be removed in the future. -.El -. -. -. -.Sh FILES -.Bl -tag -width indent -.It Pa /etc/nixos/flake.nix -If this file exists, then -.Nm -will use it as if the -.Fl -flake -option was given. This file may be a symlink to a -.Pa flake.nix -in an actual flake; thus -.Pa /etc/nixos -need not be a flake. -. -.It Pa /run/current-system -A symlink to the currently active system configuration in the Nix store. -. -.It Pa /nix/var/nix/profiles/system -The Nix profile that contains the current and previous system -configurations. Used to generate the GRUB boot menu. -.El -. -. -. -.Sh BUGS -This command should be renamed to something more descriptive. -. -. -. -.Sh AUTHORS -.An -nosplit -.An Eelco Dolstra -and -.An the Nixpkgs/NixOS contributors diff --git a/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh b/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh deleted file mode 100755 index 65b3de6f72a2..000000000000 --- a/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh +++ /dev/null @@ -1,996 +0,0 @@ -#! @runtimeShell@ -# shellcheck shell=bash - -if [ -x "@runtimeShell@" ]; then export SHELL="@runtimeShell@"; fi; - -set -e -set -o pipefail -shopt -s inherit_errexit - -export PATH=@path@:$PATH - -showSyntax() { - exec man nixos-rebuild - exit 1 -} - - -# Parse the command line. -origArgs=("$@") -copyFlags=() -extraBuildFlags=() -lockFlags=() -flakeFlags=(--extra-experimental-features 'nix-command flakes') -action= -buildNix=1 -fast= -rollback= -upgrade= -upgrade_all= -profile=/nix/var/nix/profiles/system -specialisation= -imageVariant= -buildHost= -targetHost= -useSudo= -noSSHTTY= -verboseScript= -noFlake= -attr= -buildFile=default.nix -buildingAttribute=1 -installBootloader= -json= - -# log the given argument to stderr -log() { - echo "$@" >&2 -} - -while [ "$#" -gt 0 ]; do - i="$1"; shift 1 - case "$i" in - --help) - showSyntax - ;; - switch|boot|test|build|edit|repl|dry-build|dry-run|dry-activate|build-vm|build-vm-with-bootloader|build-image|list-generations) - if [ "$i" = dry-run ]; then i=dry-build; fi - if [ "$i" = list-generations ]; then - buildNix= - fast=1 - fi - # exactly one action mandatory, bail out if multiple are given - if [ -n "$action" ]; then showSyntax; fi - action="$i" - ;; - --file|-f) - if [ -z "$1" ]; then - log "$0: '$i' requires an argument" - exit 1 - fi - buildFile="$1" - buildingAttribute= - shift 1 - ;; - --attr|-A) - if [ -z "$1" ]; then - log "$0: '$i' requires an argument" - exit 1 - fi - attr="$1" - buildingAttribute= - shift 1 - ;; - --install-grub) - log "$0: --install-grub deprecated, use --install-bootloader instead" - installBootloader=1 - ;; - --install-bootloader) - installBootloader=1 - ;; - --no-build-nix) - buildNix= - ;; - --rollback) - rollback=1 - ;; - --upgrade) - upgrade=1 - ;; - --upgrade-all) - upgrade=1 - upgrade_all=1 - ;; - --use-substitutes|--substitute-on-destination|-s) - copyFlags+=("-s") - ;; - -I|--builders) - j="$1"; shift 1 - extraBuildFlags+=("$i" "$j") - ;; - --max-jobs|-j|--cores|--log-format) - j="$1"; shift 1 - extraBuildFlags+=("$i" "$j") - copyFlags+=("$i" "$j") - ;; - --accept-flake-config|-j*|--quiet|--print-build-logs|-L|--no-build-output|-Q|--show-trace|--refresh|--impure|--offline|--no-net) - extraBuildFlags+=("$i") - ;; - --keep-going|-k|--keep-failed|-K|--fallback|--repair) - extraBuildFlags+=("$i") - copyFlags+=("$i") - ;; - --verbose|-v|-vv|-vvv|-vvvv|-vvvvv) - verboseScript="true" - extraBuildFlags+=("$i") - copyFlags+=("$i") - ;; - --option) - j="$1"; shift 1 - k="$1"; shift 1 - extraBuildFlags+=("$i" "$j" "$k") - copyFlags+=("$i" "$j" "$k") - ;; - --fast) - buildNix= - fast=1 - ;; - --profile-name|-p) - if [ -z "$1" ]; then - log "$0: ‘--profile-name’ requires an argument" - exit 1 - fi - if [ "$1" != system ]; then - profile="/nix/var/nix/profiles/system-profiles/$1" - (umask 022 && mkdir -p "$(dirname "$profile")") - fi - shift 1 - ;; - --specialisation|-c) - if [ -z "$1" ]; then - log "$0: ‘--specialisation’ requires an argument" - exit 1 - fi - specialisation="$1" - shift 1 - ;; - --image-variant) - if [ -z "$1" ]; then - log "$0: ‘--image-variant’ requires an argument" - exit 1 - fi - imageVariant="$1" - shift 1 - ;; - --build-host) - buildHost="$1" - shift 1 - ;; - --target-host) - targetHost="$1" - shift 1 - ;; - --sudo | --use-remote-sudo) - useSudo=1 - ;; - --no-ssh-tty) - noSSHTTY=1 - ;; - --flake|-F) - flake="$1" - shift 1 - ;; - --no-flake) - noFlake=1 - ;; - --recreate-lock-file|--no-update-lock-file|--no-write-lock-file|--no-registries|--commit-lock-file) - lockFlags+=("$i") - ;; - --update-input) - j="$1"; shift 1 - lockFlags+=("$i" "$j") - ;; - --override-input) - j="$1"; shift 1 - k="$1"; shift 1 - lockFlags+=("$i" "$j" "$k") - ;; - --json) - json=1 - ;; - *) - log "$0: unknown option \`$i'" - exit 1 - ;; - esac -done - -# log the given argument to stderr if verbose mode is on -logVerbose() { - if [ -n "$verboseScript" ]; then - echo "$@" >&2 - fi -} - -# Run a command, logging it first if verbose mode is on -runCmd() { - logVerbose "$" "$@" - "$@" -} - -buildHostCmd() { - local c - if [[ "${useSudo:-x}" = 1 ]]; then - c=("sudo") - else - c=() - fi - - if [ -z "$buildHost" ]; then - runCmd "$@" - elif [ -n "$remoteNix" ]; then - runCmd ssh $SSHOPTS "$buildHost" "${c[@]}" env PATH="$remoteNix":'$PATH' "$@" - else - runCmd ssh $SSHOPTS "$buildHost" "${c[@]}" "$@" - fi -} - -targetHostCmd() { - local c - if [[ "${withSudo:-x}" = 1 ]]; then - c=("sudo") - else - c=() - fi - - if [ -z "$targetHost" ]; then - runCmd "${c[@]}" "$@" - else - runCmd ssh $SSHOPTS "$targetHost" "${c[@]}" "$@" - fi -} - -targetHostSudoCmd() { - local t= - if [[ ! "${noSSHTTY:-x}" = 1 ]]; then - t="-t" - fi - - if [[ -n "$useSudo" ]]; then - withSudo=1 SSHOPTS="$SSHOPTS $t" targetHostCmd "$@" - else - # While a tty might not be necessary, we apply it to be consistent with - # sudo usage, and an experience that is more consistent with local deployment. - # But if the user really doesn't want it, don't do it. - SSHOPTS="$SSHOPTS $t" targetHostCmd "$@" - fi -} - -copyToTarget() { - if ! [ "$targetHost" = "$buildHost" ]; then - if [ -z "$targetHost" ]; then - logVerbose "Running nix-copy-closure with these NIX_SSHOPTS: $SSHOPTS" - NIX_SSHOPTS=$SSHOPTS runCmd nix-copy-closure "${copyFlags[@]}" --from "$buildHost" "$1" - elif [ -z "$buildHost" ]; then - logVerbose "Running nix-copy-closure with these NIX_SSHOPTS: $SSHOPTS" - NIX_SSHOPTS=$SSHOPTS runCmd nix-copy-closure "${copyFlags[@]}" --to "$targetHost" "$1" - else - buildHostCmd nix-copy-closure "${copyFlags[@]}" --to "$targetHost" "$1" - fi - fi -} - -nixBuild() { - logVerbose "Building in legacy (non-flake) mode." - if [ -z "$buildHost" ]; then - logVerbose "No --build-host given, running nix-build locally" - runCmd nix-build "$@" - else - logVerbose "buildHost set to \"$buildHost\", running nix-build remotely" - local instArgs=() - local buildArgs=() - local drv= - - while [ "$#" -gt 0 ]; do - local i="$1"; shift 1 - case "$i" in - -o) - local out="$1"; shift 1 - buildArgs+=("--add-root" "$out" "--indirect") - ;; - -A) - local j="$1"; shift 1 - instArgs+=("$i" "$j") - ;; - -I) # We don't want this in buildArgs - shift 1 - ;; - --no-out-link) # We don't want this in buildArgs - ;; - "<"*) # nix paths - instArgs+=("$i") - ;; - *) - buildArgs+=("$i") - ;; - esac - done - - if [[ -z $buildingAttribute ]]; then - instArgs+=("$buildFile") - fi - - drv="$(runCmd nix-instantiate "${instArgs[@]}" "${extraBuildFlags[@]}")" - if [ -a "$drv" ]; then - logVerbose "Running nix-copy-closure with these NIX_SSHOPTS: $SSHOPTS" - NIX_SSHOPTS=$SSHOPTS runCmd nix-copy-closure --to "$buildHost" "$drv" - buildHostCmd nix-store -r "$drv" "${buildArgs[@]}" - else - log "nix-instantiate failed" - exit 1 - fi - fi -} - -nixFlakeBuild() { - logVerbose "Building in flake mode." - if [[ -z "$buildHost" && -z "$targetHost" && "$action" != switch && "$action" != boot && "$action" != test && "$action" != dry-activate ]] - then - runCmd nix "${flakeFlags[@]}" build "$@" - readlink -f ./result - elif [ -z "$buildHost" ]; then - runCmd nix "${flakeFlags[@]}" build "$@" --out-link "${tmpDir}/result" - readlink -f "${tmpDir}/result" - else - local attr="$1" - shift 1 - local evalArgs=() - local buildArgs=() - local drv= - - while [ "$#" -gt 0 ]; do - local i="$1"; shift 1 - case "$i" in - --recreate-lock-file|--no-update-lock-file|--no-write-lock-file|--no-registries|--commit-lock-file) - evalArgs+=("$i") - ;; - --update-input) - local j="$1"; shift 1 - evalArgs+=("$i" "$j") - ;; - --override-input) - local j="$1"; shift 1 - local k="$1"; shift 1 - evalArgs+=("$i" "$j" "$k") - ;; - --impure) # We don't want this in buildArgs, it's only needed at evaluation time, and unsupported during realisation - ;; - *) - buildArgs+=("$i") - ;; - esac - done - - drv="$(runCmd nix "${flakeFlags[@]}" eval --raw "${attr}.drvPath" "${evalArgs[@]}" "${extraBuildFlags[@]}")" - if [ -a "$drv" ]; then - logVerbose "Running nix with these NIX_SSHOPTS: $SSHOPTS" - NIX_SSHOPTS=$SSHOPTS runCmd nix "${flakeFlags[@]}" copy "${copyFlags[@]}" --derivation --to "ssh://$buildHost" "$drv" - buildHostCmd nix-store -r "$drv" "${buildArgs[@]}" - else - log "nix eval failed" - exit 1 - fi - fi -} - - -if [ -z "$action" ]; then showSyntax; fi - -# Only run shell scripts from the Nixpkgs tree if the action is -# "switch", "boot", or "test". With other actions (such as "build"), -# the user may reasonably expect that no code from the Nixpkgs tree is -# executed, so it's safe to run nixos-rebuild against a potentially -# untrusted tree. -canRun= -if [[ "$action" = switch || "$action" = boot || "$action" = test ]]; then - canRun=1 -fi - -# Verify that user is not trying to use attribute building and flake -# at the same time -if [[ -z $buildingAttribute && -n $flake ]]; then - log "error: '--flake' cannot be used with '--file' or '--attr'" - exit 1 -fi - -# If ‘--upgrade’ or `--upgrade-all` is given, -# run ‘nix-channel --update nixos’. -if [[ -n $upgrade && -z $_NIXOS_REBUILD_REEXEC && -z $flake ]]; then - # If --upgrade-all is passed, or there are other channels that - # contain a file called ".update-on-nixos-rebuild", update them as - # well. Also upgrade the nixos channel. - - for channelpath in /nix/var/nix/profiles/per-user/root/channels/*; do - channel_name=$(basename "$channelpath") - - if [[ "$channel_name" == "nixos" ]]; then - runCmd nix-channel --update "$channel_name" - elif [ -e "$channelpath/.update-on-nixos-rebuild" ]; then - runCmd nix-channel --update "$channel_name" - elif [[ -n $upgrade_all ]] ; then - runCmd nix-channel --update "$channel_name" - fi - done -fi - -# Make sure that we use the Nix package we depend on, not something -# else from the PATH for nix-{env,instantiate,build}. This is -# important, because NixOS defaults the architecture of the rebuilt -# system to the architecture of the nix-* binaries used. So if on an -# amd64 system the user has an i686 Nix package in her PATH, then we -# would silently downgrade the whole system to be i686 NixOS on the -# next reboot. -if [ -z "$_NIXOS_REBUILD_REEXEC" ]; then - export PATH=@nix@/bin:$PATH -fi - -# Use /etc/nixos/flake.nix if it exists. It can be a symlink to the -# actual flake. -if [[ -z $flake && -e /etc/nixos/flake.nix && -z $noFlake ]]; then - flake="$(dirname "$(readlink -f /etc/nixos/flake.nix)")" -fi - -tmpDir=$(mktemp -t -d nixos-rebuild.XXXXXX) - -if [[ ${#tmpDir} -ge 60 ]]; then - # Very long tmp dirs lead to "too long for Unix domain socket" - # SSH ControlPath errors. Especially macOS sets long TMPDIR paths. - rmdir "$tmpDir" - tmpDir=$(TMPDIR= mktemp -t -d nixos-rebuild.XXXXXX) -fi - -cleanup() { - for ctrl in "$tmpDir"/ssh-*; do - ssh -o ControlPath="$ctrl" -O exit dummyhost 2>/dev/null || true - done - rm -rf "$tmpDir" -} -trap cleanup EXIT - -SSHOPTS="$NIX_SSHOPTS -o ControlMaster=auto -o ControlPath=$tmpDir/ssh-%n -o ControlPersist=60" - -# For convenience, use the hostname as the default configuration to -# build from the flake. -if [[ -n $flake ]]; then - if [[ $flake =~ ^(.*)\#([^\#\"]*)$ ]]; then - flake="${BASH_REMATCH[1]}" - flakeAttr="${BASH_REMATCH[2]}" - fi - if [[ -z $flakeAttr ]]; then - hostname="$(targetHostCmd cat /proc/sys/kernel/hostname)" - if [[ -z $hostname ]]; then - hostname=default - fi - flakeAttr="nixosConfigurations.\"$hostname\"" - else - flakeAttr="nixosConfigurations.\"$flakeAttr\"" - fi -fi - -if [[ ! -z "$specialisation" && ! "$action" = switch && ! "$action" = test ]]; then - log "error: ‘--specialisation’ can only be used with ‘switch’ and ‘test’" - exit 1 -fi - - -# Re-execute nixos-rebuild from the Nixpkgs tree. -if [[ -z $_NIXOS_REBUILD_REEXEC && -n $canRun && -z $fast ]]; then - if [[ -z $buildingAttribute ]]; then - p=$(runCmd nix-build --no-out-link $buildFile -A "${attr:+$attr.}config.system.build.nixos-rebuild" "${extraBuildFlags[@]}") - SHOULD_REEXEC=1 - elif [[ -z $flake ]]; then - if p=$(runCmd nix-build --no-out-link --expr 'with import {}; config.system.build.nixos-rebuild' "${extraBuildFlags[@]}"); then - SHOULD_REEXEC=1 - fi - else - runCmd nix "${flakeFlags[@]}" build --out-link "${tmpDir}/nixos-rebuild" "$flake#$flakeAttr.config.system.build.nixos-rebuild" "${extraBuildFlags[@]}" "${lockFlags[@]}" - if p=$(readlink -e "${tmpDir}/nixos-rebuild"); then - SHOULD_REEXEC=1 - fi - fi - - if [[ -n $SHOULD_REEXEC ]]; then - export _NIXOS_REBUILD_REEXEC=1 - # Manually call cleanup as the EXIT trap is not triggered when using exec - cleanup - runCmd exec "$p/bin/nixos-rebuild" "${origArgs[@]}" - exit 1 - fi -fi - -# Find configuration.nix and open editor instead of building. -if [ "$action" = edit ]; then - if [[ -z $buildingAttribute ]]; then - log "error: '--file' and '--attr' are not supported with 'edit'" - exit 1 - elif [[ -z $flake ]]; then - NIXOS_CONFIG=${NIXOS_CONFIG:-$(runCmd nix-instantiate --find-file nixos-config)} - if [[ -d $NIXOS_CONFIG ]]; then - NIXOS_CONFIG=$NIXOS_CONFIG/default.nix - fi - runCmd exec ${EDITOR:-nano} "$NIXOS_CONFIG" - else - runCmd exec nix "${flakeFlags[@]}" edit "${lockFlags[@]}" -- "$flake#$flakeAttr" - fi - exit 1 -fi - -# First build Nix, since NixOS may require a newer version than the -# current one. -if [[ -n "$rollback" || "$action" = dry-build ]]; then - buildNix= -fi - -nixSystem() { - machine="$(uname -m)" - if [[ "$machine" =~ i.86 ]]; then - machine=i686 - fi - echo $machine-linux -} - -prebuiltNix() { - machine="$1" - if [ "$machine" = x86_64 ]; then - echo @nix_x86_64_linux@ - elif [[ "$machine" =~ i.86 ]]; then - echo @nix_i686_linux@ - elif [[ "$machine" = aarch64 ]]; then - echo @nix_aarch64_linux@ - else - log "$0: unsupported platform" - exit 1 - fi -} - -getNixDrv() { - nixDrv= - - if [[ -z $buildingAttribute ]]; then - if nixDrv="$(runCmd nix-instantiate $buildFile --add-root "$tmpDir/nix.drv" --indirect -A ${attr:+$attr.}config.nix.package.out "${extraBuildFlags[@]}")"; then return; fi - fi - if nixDrv="$(runCmd nix-instantiate '' --add-root "$tmpDir/nix.drv" --indirect -A config.nix.package.out "${extraBuildFlags[@]}")"; then return; fi - if nixDrv="$(runCmd nix-instantiate '' --add-root "$tmpDir/nix.drv" --indirect -A nix "${extraBuildFlags[@]}")"; then return; fi - - if ! nixStorePath="$(runCmd nix-instantiate --eval '' -A "$(nixSystem)" | sed -e 's/^"//' -e 's/"$//')"; then - nixStorePath="$(prebuiltNix "$(uname -m)")" - fi - if ! runCmd nix-store -r "$nixStorePath" --add-root "${tmpDir}/nix" --indirect \ - --option extra-binary-caches https://cache.nixos.org/; then - log "warning: don't know how to get latest Nix" - fi - # Older version of nix-store -r don't support --add-root. - [ -e "$tmpDir/nix" ] || ln -sf "$nixStorePath" "$tmpDir/nix" - if [ -n "$buildHost" ]; then - remoteNixStorePath="$(runCmd prebuiltNix "$(buildHostCmd uname -m)")" - remoteNix="$remoteNixStorePath/bin" - if ! buildHostCmd nix-store -r "$remoteNixStorePath" \ - --option extra-binary-caches https://cache.nixos.org/ >/dev/null; then - remoteNix= - log "warning: don't know how to get latest Nix" - fi - fi -} - -getVersion() { - local dir="$1" - local rev= - local gitDir="$dir/.git" - if [ -e "$gitDir" ]; then - if [ -z "$(type -P git)" ]; then - echo "warning: Git not found; cannot figure out revision of $dir" >&2 - return - fi - cd "$dir" - rev=$(git --git-dir="$gitDir" rev-parse --short HEAD) - if git --git-dir="$gitDir" describe --always --dirty | grep -q dirty; then - rev+=M - fi - fi - - if [ -n "$rev" ]; then - echo ".git.$rev" - fi -} - - -if [[ -n $buildNix && -z $flake ]]; then - log "building Nix..." - getNixDrv - if [ -a "$nixDrv" ]; then - nix-store -r "$nixDrv"'!'"out" --add-root "$tmpDir/nix" --indirect >/dev/null - if [ -n "$buildHost" ]; then - nix-copy-closure "${copyFlags[@]}" --to "$buildHost" "$nixDrv" - # The nix build produces multiple outputs, we add them all to the remote path - for p in $(buildHostCmd nix-store -r "$(readlink "$nixDrv")" "${buildArgs[@]}"); do - remoteNix="$remoteNix${remoteNix:+:}$p/bin" - done - fi - fi - PATH="$tmpDir/nix/bin:$PATH" -fi - - -# Update the version suffix if we're building from Git (so that -# nixos-version shows something useful). -if [[ -n $canRun && -z $flake ]]; then - if nixpkgs=$(runCmd nix-instantiate --find-file nixpkgs "${extraBuildFlags[@]}"); then - suffix=$(getVersion "$nixpkgs" || true) - if [ -n "$suffix" ]; then - echo -n "$suffix" > "$nixpkgs/.version-suffix" || true - fi - fi -fi - - -if [ "$action" = dry-build ]; then - extraBuildFlags+=(--dry-run) -fi - -if [ "$action" = repl ]; then - # This is a very end user command, implemented using sub-optimal means. - # You should feel free to improve its behavior, as well as resolve tech - # debt in "breaking" ways. Humans adapt quite well. - if [[ -z $buildingAttribute ]]; then - exec nix repl --file $buildFile $attr "${extraBuildFlags[@]}" - elif [[ -z $flake ]]; then - exec nix repl --file '' "${extraBuildFlags[@]}" - else - if [[ -n "${lockFlags[0]}" ]]; then - # nix repl itself does not support locking flags - log "nixos-rebuild repl does not support locking flags yet" - exit 1 - fi - d='$' - q='"' - bold="$(echo -e '\033[1m')" - blue="$(echo -e '\033[34;1m')" - attention="$(echo -e '\033[35;1m')" - reset="$(echo -e '\033[0m')" - if [[ -e $flake ]]; then - flakePath=$(realpath "$flake") - else - flakePath=$flake - fi - # This nix repl invocation is impure, because usually the flakeref is. - # For a solution that preserves the motd and custom scope, we need - # something like https://github.com/NixOS/nix/issues/8679. - exec nix repl --impure --expr " - let flake = builtins.getFlake ''$flakePath''; - configuration = flake.$flakeAttr; - motd = '' - $d{$q\n$q} - Hello and welcome to the NixOS configuration - $flakeAttr - in $flake - - The following is loaded into nix repl's scope: - - - ${blue}config${reset} All option values - - ${blue}options${reset} Option data and metadata - - ${blue}pkgs${reset} Nixpkgs package set - - ${blue}lib${reset} Nixpkgs library functions - - other module arguments - - - ${blue}flake${reset} Flake outputs, inputs and source info of $flake - - Use tab completion to browse around ${blue}config${reset}. - - Use ${bold}:r${reset} to ${bold}reload${reset} everything after making a change in the flake. - (assuming $flake is a mutable flake ref) - - See ${bold}:?${reset} for more repl commands. - - ${attention}warning:${reset} nixos-rebuild repl does not currently enforce pure evaluation. - ''; - scope = - assert configuration._type or null == ''configuration''; - assert configuration.class or ''nixos'' == ''nixos''; - configuration._module.args // - configuration._module.specialArgs // - { - inherit (configuration) config options; - lib = configuration.lib or configuration.pkgs.lib; - inherit flake; - }; - in builtins.seq scope builtins.trace motd scope - " "${extraBuildFlags[@]}" - fi -fi - -if [ "$action" = list-generations ]; then - if [ ! -L "$profile" ]; then - log "No profile \`$(basename "$profile")' found" - exit 1 - fi - - generation_from_dir() { - generation_dir="$1" - generation_base="$(basename "$generation_dir")" # Has the format "system-123-link" for generation 123 - no_link_gen="${generation_base%-link}" # remove the "-link" - echo "${no_link_gen##*-}" # remove everything before the last dash - } - describe_generation(){ - generation_dir="$1" - generation_number="$(generation_from_dir "$generation_dir")" - nixos_version="$(cat "$generation_dir/nixos-version" 2> /dev/null || echo "Unknown")" - - kernel_dir="$(dirname "$(realpath "$generation_dir/kernel")")" - kernel_version="$(ls "$kernel_dir/lib/modules" || echo "Unknown")" - - configurationRevision="$("$generation_dir/sw/bin/nixos-version" --configuration-revision 2> /dev/null || true)" - - # Old nixos-version output ignored unknown flags and just printed the version - # therefore the following workaround is done not to show the default output - nixos_version_default="$("$generation_dir/sw/bin/nixos-version")" - if [ "$configurationRevision" == "$nixos_version_default" ]; then - configurationRevision="" - fi - - # jq automatically quotes the output => don't try to quote it in output! - build_date="$(stat "$generation_dir" --format=%W | jq 'todate')" - - pushd "$generation_dir/specialisation/" > /dev/null || : - specialisation_list=(*) - popd > /dev/null || : - - specialisations="$(jq --compact-output --null-input '$ARGS.positional' --args -- "${specialisation_list[@]}")" - - if [ "$(basename "$generation_dir")" = "$(readlink "$profile")" ]; then - current_generation_tag="true" - else - current_generation_tag="false" - fi - - # Escape userdefined strings - nixos_version="$(jq -aR <<< "$nixos_version")" - kernel_version="$(jq -aR <<< "$kernel_version")" - configurationRevision="$(jq -aR <<< "$configurationRevision")" - cat << EOF -{ - "generation": $generation_number, - "date": $build_date, - "nixosVersion": $nixos_version, - "kernelVersion": $kernel_version, - "configurationRevision": $configurationRevision, - "specialisations": $specialisations, - "current": $current_generation_tag -} -EOF - } - - find "$(dirname "$profile")" -regex "$profile-[0-9]+-link" | - sort -Vr | - while read -r generation_dir; do - describe_generation "$generation_dir" - done | - if [ -z "$json" ]; then - jq --slurp -r '.[] | [ - ([.generation, (if .current == true then "current" else "" end)] | join(" ")), - (.date | fromdate | strflocaltime("%Y-%m-%d %H:%M:%S")), - .nixosVersion, .kernelVersion, .configurationRevision, - (.specialisations | join(" ")) - ] | @tsv' | - column --separator $'\t' --table --table-columns "Generation,Build-date,NixOS version,Kernel,Configuration Revision,Specialisation" - else - jq --slurp . - fi - exit 0 -fi - - -# Either upgrade the configuration in the system profile (for "switch" -# or "boot"), or just build it and create a symlink "result" in the -# current directory (for "build" and "test"). -if [ -z "$rollback" ]; then - log "building the system configuration..." - if [[ "$action" = switch || "$action" = boot ]]; then - if [[ -z $buildingAttribute ]]; then - pathToConfig="$(nixBuild $buildFile -A "${attr:+$attr.}config.system.build.toplevel" "${extraBuildFlags[@]}")" - elif [[ -z $flake ]]; then - pathToConfig="$(nixBuild '' --no-out-link -A system "${extraBuildFlags[@]}")" - else - pathToConfig="$(nixFlakeBuild "$flake#$flakeAttr.config.system.build.toplevel" "${extraBuildFlags[@]}" "${lockFlags[@]}")" - fi - copyToTarget "$pathToConfig" - targetHostSudoCmd nix-env -p "$profile" --set "$pathToConfig" - elif [[ "$action" = test || "$action" = build || "$action" = dry-build || "$action" = dry-activate ]]; then - if [[ -z $buildingAttribute ]]; then - pathToConfig="$(nixBuild $buildFile -A "${attr:+$attr.}config.system.build.toplevel" "${extraBuildFlags[@]}")" - elif [[ -z $flake ]]; then - pathToConfig="$(nixBuild '' -A system -k "${extraBuildFlags[@]}")" - else - pathToConfig="$(nixFlakeBuild "$flake#$flakeAttr.config.system.build.toplevel" "${extraBuildFlags[@]}" "${lockFlags[@]}")" - fi - elif [ "$action" = build-vm ]; then - if [[ -z $buildingAttribute ]]; then - pathToConfig="$(nixBuild $buildFile -A "${attr:+$attr.}config.system.build.vm" "${extraBuildFlags[@]}")" - elif [[ -z $flake ]]; then - pathToConfig="$(nixBuild '' -A vm -k "${extraBuildFlags[@]}")" - else - pathToConfig="$(nixFlakeBuild "$flake#$flakeAttr.config.system.build.vm" "${extraBuildFlags[@]}" "${lockFlags[@]}")" - fi - elif [ "$action" = build-vm-with-bootloader ]; then - if [[ -z $buildingAttribute ]]; then - pathToConfig="$(nixBuild $buildFile -A "${attr:+$attr.}config.system.build.vmWithBootLoader" "${extraBuildFlags[@]}")" - elif [[ -z $flake ]]; then - pathToConfig="$(nixBuild '' -A vmWithBootLoader -k "${extraBuildFlags[@]}")" - else - pathToConfig="$(nixFlakeBuild "$flake#$flakeAttr.config.system.build.vmWithBootLoader" "${extraBuildFlags[@]}" "${lockFlags[@]}")" - fi - elif [ "$action" = build-image ]; then - if [[ -z $buildingAttribute ]]; then - variants="$( - runCmd nix-instantiate --eval --strict --json --expr \ - "let - value = import \"$(realpath $buildFile)\"; - set = if builtins.isFunction value then value {} else value; - in builtins.attrNames set.${attr:+$attr.}config.system.build.images" \ - "${extraBuildFlags[@]}" - )" - elif [[ -z $flake ]]; then - variants="$( - runCmd nix-instantiate --eval --strict --json --expr \ - "with import {}; builtins.attrNames config.system.build.images" \ - "${extraBuildFlags[@]}" - )" - else - variants="$( - runCmd nix "${flakeFlags[@]}" eval --json \ - "$flake#$flakeAttr.config.system.build.images" \ - --apply "builtins.attrNames" "${evalArgs[@]}" "${extraBuildFlags[@]}" - )" - fi - if ! echo "$variants" | jq -e --arg variant "$imageVariant" "any(. == \$variant)" > /dev/null; then - echo -e "Please specify one of the following supported image variants via --image-variant:\n" >&2 - echo "$variants" | jq -r 'join ("\n")' - exit 1 - fi - - if [[ -z $buildingAttribute ]]; then - imageName="$( - runCmd nix-instantiate --eval --strict --json --expr \ - "let - value = import \"$(realpath $buildFile)\"; - set = if builtins.isFunction value then value {} else value; - in set.${attr:+$attr.}config.system.build.images.$imageVariant.passthru.filePath" \ - "${extraBuildFlags[@]}" \ - | jq -r . - )" - elif [[ -z $flake ]]; then - imageName="$( - runCmd nix-instantiate --eval --strict --json --expr \ - "with import {}; config.system.build.images.$imageVariant.passthru.filePath" \ - "${extraBuildFlags[@]}" \ - | jq -r . - )" - else - imageName="$( - runCmd nix "${flakeFlags[@]}" eval --raw \ - "$flake#$flakeAttr.config.system.build.images.$imageVariant.passthru.filePath" \ - "${evalArgs[@]}" "${extraBuildFlags[@]}" - )" - fi - - if [[ -z $buildingAttribute ]]; then - pathToConfig="$(nixBuild $buildFile -A "${attr:+$attr.}config.system.build.images.${imageVariant}" "${extraBuildFlags[@]}")" - elif [[ -z $flake ]]; then - pathToConfig="$(nixBuild '' -A config.system.build.images.${imageVariant} -k "${extraBuildFlags[@]}")" - else - pathToConfig="$(nixFlakeBuild "$flake#$flakeAttr.config.system.build.images.${imageVariant}" "${extraBuildFlags[@]}" "${lockFlags[@]}")" - fi - else - showSyntax - fi - # Copy build to target host if we haven't already done it - if ! [[ "$action" = switch || "$action" = boot ]]; then - copyToTarget "$pathToConfig" - fi -else # [ -n "$rollback" ] - if [[ "$action" = switch || "$action" = boot ]]; then - targetHostSudoCmd nix-env --rollback -p "$profile" - pathToConfig="$profile" - elif [[ "$action" = test || "$action" = build ]]; then - systemNumber=$( - targetHostCmd nix-env -p "$profile" --list-generations | - sed -n '/current/ {g; p;}; s/ *\([0-9]*\).*/\1/; h' - ) - pathToConfig="$profile"-${systemNumber}-link - if [ -z "$targetHost" ]; then - ln -sT "$pathToConfig" ./result - fi - else - showSyntax - fi -fi - - -# If we're not just building, then make the new configuration the boot -# default and/or activate it now. -if [[ "$action" = switch || "$action" = boot || "$action" = test || "$action" = dry-activate ]]; then - # Using systemd-run here to protect against PTY failures/network - # disconnections during rebuild. - # See: https://github.com/NixOS/nixpkgs/issues/39118 - cmd=( - "systemd-run" - "-E" "LOCALE_ARCHIVE" # Will be set to new value early in switch-to-configuration script, but interpreter starts out with old value - "-E" "NIXOS_INSTALL_BOOTLOADER=$installBootloader" - "--collect" - "--no-ask-password" - "--pipe" - "--quiet" - "--service-type=exec" - "--unit=nixos-rebuild-switch-to-configuration" - "--wait" - ) - # Check if we have a working systemd-run. In chroot environments we may have - # a non-working systemd, so we fallback to not using systemd-run. - # You may also want to explicitly set NIXOS_SWITCH_USE_DIRTY_ENV environment - # variable, since systemd-run runs inside an isolated environment and - # this may break some post-switch scripts. However keep in mind that this - # may be dangerous in remote access (e.g. SSH). - if [[ -n "$NIXOS_SWITCH_USE_DIRTY_ENV" ]]; then - log "warning: skipping systemd-run since NIXOS_SWITCH_USE_DIRTY_ENV is set. This environment variable will be ignored in the future" - cmd=("env" "NIXOS_INSTALL_BOOTLOADER=$installBootloader") - elif ! targetHostSudoCmd "${cmd[@]}" true; then - logVerbose "Skipping systemd-run to switch configuration since it is not working in target host." - cmd=( - "env" - "-i" - "LOCALE_ARCHIVE=$LOCALE_ARCHIVE" - "NIXOS_INSTALL_BOOTLOADER=$installBootloader" - ) - else - logVerbose "Using systemd-run to switch configuration." - fi - if [[ -z "$specialisation" ]]; then - cmd+=("$pathToConfig/bin/switch-to-configuration") - else - cmd+=("$pathToConfig/specialisation/$specialisation/bin/switch-to-configuration") - - if [ -z "$targetHost" ]; then - specialisationExists=$(test -f "${cmd[-1]}") - else - specialisationExists=$(targetHostCmd test -f "${cmd[-1]}") - fi - - if ! $specialisationExists; then - log "error: specialisation not found: $specialisation" - exit 1 - fi - fi - - if ! targetHostSudoCmd "${cmd[@]}" "$action"; then - log "warning: error(s) occurred while switching to the new configuration" - exit 1 - else - echo -n "Done. The new configuration is " >&2 - echo "$pathToConfig" - fi -elif [[ "$action" = build ]]; then - echo -n "Done. The new configuration is " >&2 - echo "$pathToConfig" -fi - - -if [[ "$action" = build-vm || "$action" = build-vm-with-bootloader ]]; then - cat >&2 <&2 - echo "${pathToConfig}/${imageName}" -fi diff --git a/pkgs/os-specific/linux/nixos-rebuild/test/repl.nix b/pkgs/os-specific/linux/nixos-rebuild/test/repl.nix deleted file mode 100644 index 045f32958b7a..000000000000 --- a/pkgs/os-specific/linux/nixos-rebuild/test/repl.nix +++ /dev/null @@ -1,162 +0,0 @@ -{ - lib, - expect, - nix, - nixos-rebuild, - path, - runCommand, - stdenv, - writeText, -}: -let - # Arguably not true, but it holds up for now. - escapeExpect = lib.strings.escapeNixString; - - expectSetup = '' - set timeout 180 - proc expect_simple { pattern } { - puts "Expecting: $pattern" - expect { - timeout { - puts "\nTimeout waiting for: $pattern\n" - exit 1 - } - $pattern - } - } - ''; - - # In case we want/need to evaluate packages or the assertions or whatever, - # we want to have a linux system. - # TODO: make the non-flake test use thise. - linuxSystem = lib.replaceStrings [ "darwin" ] [ "linux" ] stdenv.hostPlatform.system; - -in -runCommand "test-nixos-rebuild-repl" - { - nativeBuildInputs = [ - expect - nix - nixos-rebuild - ]; - nixpkgs = if builtins.pathExists (path + "/.git") then lib.cleanSource path else path; - } - '' - export HOME=$(mktemp -d) - export TEST_ROOT=$PWD/test-tmp - - # Prepare for running Nix in sandbox - export NIX_BUILD_HOOK= - export NIX_CONF_DIR=$TEST_ROOT/etc - export NIX_LOCALSTATE_DIR=$TEST_ROOT/var - export NIX_LOG_DIR=$TEST_ROOT/var/log/nix - export NIX_STATE_DIR=$TEST_ROOT/var/nix - export NIX_STORE_DIR=$TEST_ROOT/store - export PAGER=cat - mkdir -p $TEST_ROOT $NIX_CONF_DIR - - echo General setup - ################## - - export NIX_PATH=nixpkgs=$nixpkgs:nixos-config=$HOME/configuration.nix - cat >> ~/configuration.nix < ~/hardware-configuration.nix - - - echo Test traditional NixOS configuration - ######################################### - - expect ${writeText "test-nixos-rebuild-repl-expect" '' - ${expectSetup} - spawn nixos-rebuild repl --fast - - expect "nix-repl> " - - send "config.networking.hostName\n" - expect "\"nixos\"" - ''} - - - echo Test flake based NixOS configuration - ######################################### - - # Switch to flake flavored environment - unset NIX_PATH - cat > $NIX_CONF_DIR/nix.conf < ~/hardware-configuration.nix - - cat >~/flake.nix <" - - send "config.networking.hostName\n" - expect_simple "itsme" - - expect_simple "nix-repl>" - send "lib.version\n" - expect_simple ${ - escapeExpect ( - # The version string is a bit different in the flake lib, so we expect a prefix and ignore the rest - # Furthermore, including the revision (suffix) would cause unnecessary rebuilds. - # Note that a length of 4 only matches e.g. "24. - lib.strings.substring 0 4 (lib.strings.escapeNixString lib.version) - ) - } - - # Make sure it's the right lib - should be the flake lib, not Nixpkgs lib. - expect_simple "nix-repl>" - send "lib?nixosSystem\n" - expect_simple "true" - expect_simple "nix-repl>" - send "lib?nixos\n" - expect_simple "true" - ''} - - pushd "$HOME" - expect ${writeText "test-nixos-rebuild-repl-relative-path-expect" '' - ${expectSetup} - spawn sh -c "nixos-rebuild repl --fast --flake .#testconf" - - expect_simple "nix-repl>" - - send "config.networking.hostName\n" - expect_simple "itsme" - ''} - popd - - echo - - ######### - echo Done - touch $out - '' diff --git a/pkgs/tools/misc/grub/default.nix b/pkgs/tools/misc/grub/default.nix index 497464af54e1..2c170c5fa8e4 100644 --- a/pkgs/tools/misc/grub/default.nix +++ b/pkgs/tools/misc/grub/default.nix @@ -510,6 +510,47 @@ stdenv.mkDerivation rec { url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=c448f511e74cb7c776b314fcb7943f98d3f22b6d"; hash = "sha256-64gMhCEW0aYHt46crX/qN/3Hj8MgvWLazgQlVXqe8LE="; }) + # https://lists.gnu.org/archive/html/grub-devel/2025-11/msg00155.html + (fetchpatch { + name = "1_commands_test_fix_error_in_recursion_depth_calculation.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=cc9d621dd06bfa12eac511b37b4ceda5bd2f8246"; + hash = "sha256-GpLpqTKr2ke/YaxnZIO1Kh9wpde44h2mvwcODcAL/nk="; + }) + (fetchpatch { + name = "2_CVE-2025-54771.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=c4fb4cbc941981894a00ba8e75d634a41967a27f"; + hash = "sha256-yWowlAMVXdfIyC+BiB00IZvTwIybvaPhxAyz0MPjQuY="; + }) + (fetchpatch { + name = "3_CVE-2025-54770.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=10e58a14db20e17d1b6a39abe38df01fef98e29d"; + hash = "sha256-1ROc5n7sApw7aGr+y8gygFqVkifLdgOD3RPaW9b8aQQ="; + }) + (fetchpatch { + name = "4_CVE-2025-61662.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=8ed78fd9f0852ab218cc1f991c38e5a229e43807"; + hash = "sha256-mG+vcZHbF4duY2YoYAzPBQRHfWvp5Fvgtm0XBk7JqqM="; + }) + (fetchpatch { + name = "5_CVE-2025-61663_CVE-2025-61664.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=05d3698b8b03eccc49e53491bbd75dba15f40917"; + hash = "sha256-kgtXhZmAQpassEf8+RzqkghAzLrCcRoRMMnfunF/0J8="; + }) + (fetchpatch { + name = "6_tests_lib_functional_test_unregister_commands_on_module_unload.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=9df1e693e70c5a274b6d60dc76efe2694b89c2fc"; + hash = "sha256-UzyYkpP7vivx2jzxi7BMP9h9OB2yraswrMW4g9UWsbI="; + }) + (fetchpatch { + name = "7_CVE-2025-61661.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=549a9cc372fd0b96a4ccdfad0e12140476cc62a3"; + hash = "sha256-2mlDoVXY7Upwx4QBeAMOHUtoUlyx1MDDmabnrwK1gEY="; + }) + (fetchpatch { + name = "8_commands_usbtest_ensure_string_length_is_sufficient_in_usb_string_processing.patch"; + url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=7debdce1e98907e65223a4b4c53a41345ac45e53"; + hash = "sha256-2ALvrmwxvpjQYjGNrQ0gyGotpk0kgmYlJXMF1xXrnEw="; + }) # Required to apply the GCC-15 patch (fetchpatch { name = "gnulib_Add_patch_to_allow_GRUB_w_GCC-15_compile_0_1.patch"; diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix index 0f7ec34ee472..55ae9d9c4cbc 100644 --- a/pkgs/top-level/aliases.nix +++ b/pkgs/top-level/aliases.nix @@ -1176,6 +1176,7 @@ mapAliases { else nixfmt; nixForLinking = throw "nixForLinking has been removed, use `nixVersions.nixComponents_` instead"; # Added 2025-08-14 + nixos-rebuild = nixos-rebuild-ng; # Added 2025-12-02 nixosTest = throw "'nixosTest' has been renamed to/replaced by 'testers.nixosTest'"; # Converted to throw 2025-10-27 nixStable = throw "'nixStable' has been renamed to/replaced by 'nixVersions.stable'"; # Converted to throw 2025-10-27 nm-tray = throw "'nm-tray' has been removed, as it only works with Plasma 5"; # Added 2025-08-30 diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index 0bcb0283f88f..b44a41637980 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -13959,8 +13959,6 @@ with pkgs; nixos-artwork = recurseIntoAttrs (callPackage ../data/misc/nixos-artwork { }); - nixos-rebuild = callPackage ../os-specific/linux/nixos-rebuild { }; - disnix = callPackage ../tools/package-management/disnix { }; dysnomia = callPackage ../tools/package-management/disnix/dysnomia (