From 54670c1df37974312f8c7229d7b4cc4535585774 Mon Sep 17 00:00:00 2001 From: t4ccer Date: Wed, 15 Oct 2025 00:38:44 -0230 Subject: [PATCH 01/83] qlcplus: 4.13.1 -> 5.0.0 --- pkgs/applications/misc/qlcplus/default.nix | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/pkgs/applications/misc/qlcplus/default.nix b/pkgs/applications/misc/qlcplus/default.nix index e93a3d61f028..b2f33e6d8af4 100644 --- a/pkgs/applications/misc/qlcplus/default.nix +++ b/pkgs/applications/misc/qlcplus/default.nix @@ -8,6 +8,7 @@ qtmultimedia, qtscript, qtserialport, + qtwebsockets, alsa-lib, ola, libftdi1, @@ -19,13 +20,13 @@ mkDerivation rec { pname = "qlcplus"; - version = "4.13.1"; + version = "5.0.0"; src = fetchFromGitHub { owner = "mcallegari"; repo = "qlcplus"; rev = "QLC+_${version}"; - sha256 = "sha256-AKmPxHOlMtea3q0NDULp3XfJ0JnYeF/iFUJw0dDOiio="; + hash = "sha256-gEwcTIJhY78Ts0lUn4MVciV7sPIBkqlxPMa9I1nTHO0="; }; nativeBuildInputs = [ @@ -38,6 +39,7 @@ mkDerivation rec { qtmultimedia qtscript qtserialport + qtwebsockets alsa-lib ola libftdi1 From 95c404410f42ab88260247e4c77a0459bc01c8eb Mon Sep 17 00:00:00 2001 From: Sergei Trofimovich Date: Mon, 22 Dec 2025 06:43:32 +0000 Subject: [PATCH 02/83] fheroes2: 1.1.11 -> 1.1.13 Changes: https://github.com/ihhub/fheroes2/releases/tag/1.1.13 --- pkgs/by-name/fh/fheroes2/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/fh/fheroes2/package.nix b/pkgs/by-name/fh/fheroes2/package.nix index f2fa31c4422b..8111c6370952 100644 --- a/pkgs/by-name/fh/fheroes2/package.nix +++ b/pkgs/by-name/fh/fheroes2/package.nix @@ -18,13 +18,13 @@ stdenv.mkDerivation rec { pname = "fheroes2"; - version = "1.1.11"; + version = "1.1.13"; src = fetchFromGitHub { owner = "ihhub"; repo = "fheroes2"; rev = version; - hash = "sha256-U8iJAhubMHGPXNph+kWhMzRDbh3e4bikgQKbPPeKqV8="; + hash = "sha256-ct58Rkc6ORXldINQZVzMuObMl0BMk6QG88oU4tT0WcE="; }; nativeBuildInputs = [ imagemagick ]; From dc34f21050a81d0a075f8216c97898bd1f2e2f05 Mon Sep 17 00:00:00 2001 From: Sergei Trofimovich Date: Tue, 23 Dec 2025 06:41:18 +0000 Subject: [PATCH 03/83] wesnoth: 1.18.5 -> 1.18.6, wesnoth-devel: 1.19.18 -> 1.19.19 Changes: - https://github.com/wesnoth/wesnoth/blob/1.18.6/changelog.md - https://github.com/wesnoth/wesnoth/blob/1.19.9/changelog.md --- pkgs/by-name/we/wesnoth/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/we/wesnoth/package.nix b/pkgs/by-name/we/wesnoth/package.nix index a382d09da84c..6df5bd7519a3 100644 --- a/pkgs/by-name/we/wesnoth/package.nix +++ b/pkgs/by-name/we/wesnoth/package.nix @@ -39,7 +39,7 @@ in stdenv.mkDerivation (finalAttrs: { pname = "wesnoth${suffix}"; - version = if enableDevel then "1.19.18" else "1.18.5"; + version = if enableDevel then "1.19.19" else "1.18.6"; src = fetchFromGitHub { owner = "wesnoth"; @@ -47,9 +47,9 @@ stdenv.mkDerivation (finalAttrs: { tag = finalAttrs.version; hash = if enableDevel then - "sha256-BZPS60MNg9w0nf/P+vwzp2voQ5Sb1imGJIjrpJm12R0=" + "sha256-9MExXXRnkjEWzOW7TPtNmwExoW7s0/u8w34n7DIS0YU=" else - "sha256-0VZJAmaCg12x4S07H1kl5s2NGMEo/NSVnzMniREmPJk="; + "sha256-y2ceN7rX8j+pNlaajw32ZxwFrUxqAuILADZvum03NhU="; }; nativeBuildInputs = [ From 7fd56fd8ca52a8e381886863bb813b84cd8692c9 Mon Sep 17 00:00:00 2001 From: Florian Klink Date: Sun, 28 Dec 2025 01:20:11 +0100 Subject: [PATCH 04/83] default-crate-overrides: aws-lc-sys: force cmake backend This fixes crate2nix builds using this crate as a transitive dependency, on Darwin. --- pkgs/build-support/rust/default-crate-overrides.nix | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/pkgs/build-support/rust/default-crate-overrides.nix b/pkgs/build-support/rust/default-crate-overrides.nix index 58bd218b68de..c28fe180c3e2 100644 --- a/pkgs/build-support/rust/default-crate-overrides.nix +++ b/pkgs/build-support/rust/default-crate-overrides.nix @@ -53,6 +53,12 @@ buildInputs = [ alsa-lib ]; }; + # Force using the cmake backend. At least on Darwin, the build else gets confused and fails. + aws-lc-sys = prev: { + nativeBuildInputs = [ cmake ]; + env.AWS_LC_SYS_CMAKE_BUILDER = 1; + }; + cairo-rs = attrs: { buildInputs = [ cairo ]; }; From 85f9e9d96ffa1662d33d3a01c391ccadbbeb324e Mon Sep 17 00:00:00 2001 From: nat Date: Sun, 4 Jan 2026 17:21:02 +0100 Subject: [PATCH 05/83] hujsonfmt: 0-unstable-2022-12-23 -> 0-unstable-2025-06-05 --- pkgs/by-name/hu/hujsonfmt/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/hu/hujsonfmt/package.nix b/pkgs/by-name/hu/hujsonfmt/package.nix index ca4b54453e38..1d34ef696e84 100644 --- a/pkgs/by-name/hu/hujsonfmt/package.nix +++ b/pkgs/by-name/hu/hujsonfmt/package.nix @@ -9,13 +9,13 @@ let in buildGoModule { pname = "hujsonfmt"; - version = "0-unstable-2022-12-23"; + version = "0-unstable-2025-06-05"; src = fetchFromGitHub { owner = "tailscale"; repo = "hujson"; - rev = "20486734a56a3455c47994bf4942974d6f9969a0"; - hash = "sha256-j2HRs5zZ0jTIqWIRhHheO9eaGzMMkNuKXuhboq9KpB4="; + rev = "992244df8c5ad853c10f498549e0eab54e515d13"; + hash = "sha256-5lEvWiCxU+5oKbBon8EvBUON9WtxDausRVFU1+q2TZE="; }; proxyVendor = true; From a9c61861062f6a0220cb1171d06be5ad2f5c73e7 Mon Sep 17 00:00:00 2001 From: ccicnce113424 Date: Sat, 10 Jan 2026 12:00:08 +0800 Subject: [PATCH 06/83] svt-av1-psy: move to an active fork svt-av1-psyex --- .../package.nix | 27 +++++++++---------- pkgs/top-level/aliases.nix | 1 + 2 files changed, 13 insertions(+), 15 deletions(-) rename pkgs/by-name/sv/{svt-av1-psy => svt-av1-psyex}/package.nix (69%) diff --git a/pkgs/by-name/sv/svt-av1-psy/package.nix b/pkgs/by-name/sv/svt-av1-psyex/package.nix similarity index 69% rename from pkgs/by-name/sv/svt-av1-psy/package.nix rename to pkgs/by-name/sv/svt-av1-psyex/package.nix index c722b55ecd78..3413c143ceaf 100644 --- a/pkgs/by-name/sv/svt-av1-psy/package.nix +++ b/pkgs/by-name/sv/svt-av1-psyex/package.nix @@ -3,22 +3,22 @@ stdenv, fetchFromGitHub, cmake, - nasm, + yasm, cpuinfo, libdovi, hdr10plus, - unstableGitUpdater, + nix-update-script, }: stdenv.mkDerivation (finalAttrs: { - pname = "svt-av1-psy"; - version = "3.0.2-unstable-2025-04-21"; + pname = "svt-av1-psyex"; + version = "3.0.2-B"; src = fetchFromGitHub { - owner = "psy-ex"; - repo = "svt-av1-psy"; - rev = "3745419c40267d294202b52f48f069aff56cdb78"; - hash = "sha256-iAw2FiEsBGB4giWqzo1EJZok26WSlq7brq9kJubnkAQ="; + owner = "BlueSwordM"; + repo = "svt-av1-psyex"; + tag = "v${finalAttrs.version}"; + hash = "sha256-klfrbow8UtpIPwIgt8tK7FP7Jp6In9nxfOZrdi1PsHo="; }; cmakeBuildType = "Release"; @@ -40,7 +40,7 @@ stdenv.mkDerivation (finalAttrs: { cmake ] ++ lib.optionals stdenv.hostPlatform.isx86_64 [ - nasm + yasm ]; buildInputs = [ @@ -51,17 +51,14 @@ stdenv.mkDerivation (finalAttrs: { cpuinfo ]; - passthru.updateScript = unstableGitUpdater { - branch = "master"; - tagPrefix = "v"; - }; + passthru.updateScript = nix-update-script { extraArgs = [ "--use-github-releases" ]; }; meta = { - homepage = "https://github.com/psy-ex/svt-av1-psy"; + homepage = "https://github.com/BlueSwordM/svt-av1-psyex"; description = "Scalable Video Technology AV1 Encoder and Decoder"; longDescription = '' - SVT-AV1-PSY is the Scalable Video Technology for AV1 (SVT-AV1 Encoder and Decoder) + SVT-AV1-PSYEX is the Scalable Video Technology for AV1 (SVT-AV1 Encoder and Decoder) with perceptual enhancements for psychovisually optimal AV1 encoding. The goal is to create the best encoding implementation for perceptual quality with AV1. ''; diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix index d4f5aad043eb..2e832d65c020 100644 --- a/pkgs/top-level/aliases.nix +++ b/pkgs/top-level/aliases.nix @@ -1582,6 +1582,7 @@ mapAliases { sumalibs = throw "'sumalibs' has been removed as it was archived upstream and broken with GCC 14"; # Added 2025-06-14 sumatra = throw "'sumatra' has been removed as it was archived upstream and broken with GCC 14"; # Added 2025-06-14 sumneko-lua-language-server = throw "'sumneko-lua-language-server' has been renamed to/replaced by 'lua-language-server'"; # Converted to throw 2025-10-27 + svt-av1-psy = warnAlias "'svt-av1-psy' has been replaced by 'svt-av1-psyex'" svt-av1-psyex; # Added 2026-01-10 swig4 = throw "'swig4' has been renamed to/replaced by 'swig'"; # Converted to throw 2025-10-27 swiProlog = throw "'swiProlog' has been renamed to/replaced by 'swi-prolog'"; # Converted to throw 2025-10-27 swiPrologWithGui = throw "'swiPrologWithGui' has been renamed to/replaced by 'swi-prolog-gui'"; # Converted to throw 2025-10-27 From bf28018005c0e7b5e036b0feca588c5952faa6da Mon Sep 17 00:00:00 2001 From: ccicnce113424 Date: Sat, 10 Jan 2026 12:00:43 +0800 Subject: [PATCH 07/83] svt-av1-psyex: add ccicnce113424 as a maintainer --- pkgs/by-name/sv/svt-av1-psyex/package.nix | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/pkgs/by-name/sv/svt-av1-psyex/package.nix b/pkgs/by-name/sv/svt-av1-psyex/package.nix index 3413c143ceaf..ebfb5017611b 100644 --- a/pkgs/by-name/sv/svt-av1-psyex/package.nix +++ b/pkgs/by-name/sv/svt-av1-psyex/package.nix @@ -68,7 +68,10 @@ stdenv.mkDerivation (finalAttrs: { bsd3 ]; platforms = lib.platforms.unix; - maintainers = with lib.maintainers; [ johnrtitor ]; + maintainers = with lib.maintainers; [ + johnrtitor + ccicnce113424 + ]; mainProgram = "SvtAv1EncApp"; }; }) From 699943e2beed45f1748d4eb9a329978c4b0ebe9b Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Sat, 10 Jan 2026 12:57:08 +0000 Subject: [PATCH 08/83] python3Packages.pyasyncore: 1.0.4 -> 1.0.5 --- pkgs/development/python-modules/pyasyncore/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/python-modules/pyasyncore/default.nix b/pkgs/development/python-modules/pyasyncore/default.nix index ce7f0919e1f3..3d90bccce7b1 100644 --- a/pkgs/development/python-modules/pyasyncore/default.nix +++ b/pkgs/development/python-modules/pyasyncore/default.nix @@ -7,14 +7,14 @@ buildPythonPackage rec { pname = "pyasyncore"; - version = "1.0.4"; + version = "1.0.5"; pyproject = true; src = fetchFromGitHub { owner = "simonrob"; repo = "pyasyncore"; tag = "v${version}"; - hash = "sha256-ptqOsbkY7XYZT5sh6vctfxZ7BZPX2eLjo6XwZfcmtgk="; + hash = "sha256-gpmsawbTf59EchoKixWw2wcBoOFElPDLg9zylvhA04U="; }; nativeBuildInputs = [ setuptools ]; From 7e321e3c63f872a08f6126811aad86312728769d Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Sat, 10 Jan 2026 19:40:58 +0000 Subject: [PATCH 09/83] linuxPackages.corefreq: 2.0.9 -> 2.1.0 --- pkgs/os-specific/linux/corefreq/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/os-specific/linux/corefreq/default.nix b/pkgs/os-specific/linux/corefreq/default.nix index bffc4c58793a..fc9adb9c3dc1 100644 --- a/pkgs/os-specific/linux/corefreq/default.nix +++ b/pkgs/os-specific/linux/corefreq/default.nix @@ -10,13 +10,13 @@ stdenv.mkDerivation rec { pname = "corefreq"; - version = "2.0.9"; + version = "2.1.0"; src = fetchFromGitHub { owner = "cyring"; repo = "CoreFreq"; rev = version; - hash = "sha256-SD3/3j8kIpxRA3Z0zxnkKczkBqJUzn40cTbllwIFrgc="; + hash = "sha256-tEfZ4vgSH8y4XBP2OMIwZNwAHRJpyq6q8NWtuXm2mRQ="; }; nativeBuildInputs = kernel.moduleBuildDependencies; From ac4e4b274a6ed6f890ea1a30d3c6ae21ee99f46f Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Mon, 12 Jan 2026 02:07:25 +0000 Subject: [PATCH 10/83] resvg: 0.45.1 -> 0.46.0 --- pkgs/by-name/re/resvg/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/re/resvg/package.nix b/pkgs/by-name/re/resvg/package.nix index 268f1fd82d62..ebd3752dbbf9 100644 --- a/pkgs/by-name/re/resvg/package.nix +++ b/pkgs/by-name/re/resvg/package.nix @@ -6,16 +6,16 @@ rustPlatform.buildRustPackage rec { pname = "resvg"; - version = "0.45.1"; + version = "0.46.0"; src = fetchFromGitHub { owner = "RazrFalcon"; repo = "resvg"; rev = "v${version}"; - hash = "sha256-sz1fAvg5HiBJpAgH7Vy0j5eAkvW8egcHyUXCsZzOWT8="; + hash = "sha256-kiE9Zv3PonRRq6pbRnqGz0LKlYSTFSuuqYaLDmC9I2Y="; }; - cargoHash = "sha256-jUq1BvHgs3tEI+ye04FykdunHcMMatE3Gamr3grNWQw="; + cargoHash = "sha256-dqqO+CPyBaUFBZGwhwXFRr8tnZWp27sF0606tmOm7ms="; cargoBuildFlags = [ "--package=resvg" From c723a64708689c686c73130c2b9b6b2d898f8dbb Mon Sep 17 00:00:00 2001 From: whispers Date: Tue, 2 Dec 2025 09:10:55 -0500 Subject: [PATCH 11/83] arti: 1.7.0 -> 1.9.0 Release announcement for 1.8.0: https://blog.torproject.org/arti_1_8_0_released/ Release announcement for 1.9.0: https://blog.torproject.org/arti_1_9_0_released/ Changelog: https://gitlab.torproject.org/tpo/core/arti/-/raw/arti-v1.9.0/CHANGELOG.md --- pkgs/by-name/ar/arti/package.nix | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/pkgs/by-name/ar/arti/package.nix b/pkgs/by-name/ar/arti/package.nix index e6dd7e667f31..ce6738fac47e 100644 --- a/pkgs/by-name/ar/arti/package.nix +++ b/pkgs/by-name/ar/arti/package.nix @@ -12,7 +12,7 @@ rustPlatform.buildRustPackage (finalAttrs: { pname = "arti"; - version = "1.7.0"; + version = "1.9.0"; src = fetchFromGitLab { domain = "gitlab.torproject.org"; @@ -20,10 +20,10 @@ rustPlatform.buildRustPackage (finalAttrs: { owner = "core"; repo = "arti"; tag = "arti-v${finalAttrs.version}"; - hash = "sha256-4Vx5ATVdE8AoMWjDKKkwGOFVOwI0Qhyfr8MiAo+7MNw="; + hash = "sha256-b5DWu38/iKwKcmp4BNgkeE5F522YRZZiev9gUZ/Rb1E="; }; - cargoHash = "sha256-x1Pws9XbvwZqxJTJmPHQd6qbNLgkHxCK3YIZbRylk2M="; + cargoHash = "sha256-SGxSZaY8//FHhySbarfgleafF5YEWJW/fUAwo3576NI="; nativeBuildInputs = lib.optionals stdenv.hostPlatform.isLinux [ pkg-config ]; @@ -54,12 +54,13 @@ rustPlatform.buildRustPackage (finalAttrs: { checkFlags = [ # problematic test that hangs the build "--skip=reload_cfg::test::watch_single_file" - - # some of the cli tests attempt to validate that the filesystem and build - # is securely configured, which is somewhat broken by the nix build sandbox - "--skip=cli_tests" ]; + # some of the CLI tests attempt to validate that the filesystem and runtime + # environment are securely configured, which breaks inside the nix build + # sandbox. this does NOT affect downstream users of Arti. + env.ARTI_FS_DISABLE_PERMISSION_CHECKS = 1; + nativeInstallCheckInputs = [ versionCheckHook ]; From 72f7ca68f30ea78b1a7ff9017a7432e8a5b5183e Mon Sep 17 00:00:00 2001 From: Thomas Gerbet Date: Tue, 13 Jan 2026 23:44:44 +0100 Subject: [PATCH 12/83] libnbd: 1.22.1 -> 1.22.5 Fixes CVE-2025-14946. https://lists.libguestfs.org/archives/list/guestfs@lists.libguestfs.org/message/WTUYQOUVHYQVGER3G2AFWN3IYSIU3KTO/ Fixes #479824. --- pkgs/by-name/li/libnbd/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/li/libnbd/package.nix b/pkgs/by-name/li/libnbd/package.nix index b53141bc3359..194734bcde90 100644 --- a/pkgs/by-name/li/libnbd/package.nix +++ b/pkgs/by-name/li/libnbd/package.nix @@ -18,11 +18,11 @@ stdenv.mkDerivation rec { pname = "libnbd"; - version = "1.22.1"; + version = "1.22.5"; src = fetchurl { url = "https://download.libguestfs.org/libnbd/${lib.versions.majorMinor version}-stable/${pname}-${version}.tar.gz"; - hash = "sha256-9oVJrU2YcXGnKaDf8SoHKGtG7vpH5355/DKIiYrchHI="; + hash = "sha256-y/Ria/R8jC+Zu5bHnlqM7JozNzyt6i/Bu/4E5uFbbjw="; }; nativeBuildInputs = [ From c0d1effd7ca2562b247b3f0a3bf4c56d47571ae9 Mon Sep 17 00:00:00 2001 From: Sigmanificient Date: Wed, 14 Jan 2026 00:44:17 +0100 Subject: [PATCH 13/83] python313Packages.tubes: remove unused dependency --- pkgs/development/python-modules/tubes/default.nix | 2 -- 1 file changed, 2 deletions(-) diff --git a/pkgs/development/python-modules/tubes/default.nix b/pkgs/development/python-modules/tubes/default.nix index 667863d985cb..34e6b395de89 100644 --- a/pkgs/development/python-modules/tubes/default.nix +++ b/pkgs/development/python-modules/tubes/default.nix @@ -3,7 +3,6 @@ buildPythonPackage, fetchFromGitHub, python, - characteristic, six, twisted, }: @@ -21,7 +20,6 @@ buildPythonPackage { }; propagatedBuildInputs = [ - characteristic six twisted ]; From fa0e9ffea09d9a72afb20dfb4fc94f87199c8f32 Mon Sep 17 00:00:00 2001 From: Sigmanificient Date: Wed, 14 Jan 2026 00:42:28 +0100 Subject: [PATCH 14/83] python313Packages.characteristic: drop --- .../python-modules/characteristic/default.nix | 26 ------------------- pkgs/top-level/python-aliases.nix | 1 + pkgs/top-level/python-packages.nix | 2 -- 3 files changed, 1 insertion(+), 28 deletions(-) delete mode 100644 pkgs/development/python-modules/characteristic/default.nix diff --git a/pkgs/development/python-modules/characteristic/default.nix b/pkgs/development/python-modules/characteristic/default.nix deleted file mode 100644 index 93e18a068244..000000000000 --- a/pkgs/development/python-modules/characteristic/default.nix +++ /dev/null @@ -1,26 +0,0 @@ -{ - buildPythonPackage, - fetchPypi, - pytest, -}: - -buildPythonPackage rec { - pname = "characteristic"; - version = "14.3.0"; - format = "setuptools"; - src = fetchPypi { - inherit pname version; - sha256 = "ded68d4e424115ed44e5c83c2a901a0b6157a959079d7591d92106ffd3ada380"; - }; - - nativeCheckInputs = [ pytest ]; - - postPatch = '' - substituteInPlace setup.cfg --replace "[pytest]" "[tool:pytest]" - ''; - - meta = { - description = "Python attributes without boilerplate"; - homepage = "https://characteristic.readthedocs.org"; - }; -} diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix index 0378e92e1de0..c074f3396bb6 100644 --- a/pkgs/top-level/python-aliases.nix +++ b/pkgs/top-level/python-aliases.nix @@ -95,6 +95,7 @@ mapAliases { can = throw "'can' has been renamed to/replaced by 'python-can'"; # Converted to throw 2025-10-29 casbin = pycasbin; # added 2025-06-12 cchardet = throw "'cchardet' has been renamed to/replaced by 'faust-cchardet'"; # Converted to throw 2025-10-29 + characteristic = throw "'characteristic' has been removed because it is no longer maintained upstream"; # Added 2026-01-14 cirq-rigetti = throw "cirq-rigetti was removed because it is no longer provided by upstream"; # added 2025-09-13 class-registry = throw "'class-registry' has been renamed to/replaced by 'phx-class-registry'"; # Converted to throw 2025-10-29 ColanderAlchemy = throw "'ColanderAlchemy' has been renamed to/replaced by 'colanderalchemy'"; # Converted to throw 2025-10-29 diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix index a2bbbc404c6b..44275d6dd740 100644 --- a/pkgs/top-level/python-packages.nix +++ b/pkgs/top-level/python-packages.nix @@ -2613,8 +2613,6 @@ self: super: with self; { character-encoding-utils = callPackage ../development/python-modules/character-encoding-utils { }; - characteristic = callPackage ../development/python-modules/characteristic { }; - chardet = callPackage ../development/python-modules/chardet { }; charset-normalizer = callPackage ../development/python-modules/charset-normalizer { }; From 37ebbc1336a1b5d31c559d2a5a61b85642dd3663 Mon Sep 17 00:00:00 2001 From: Sigmanificient Date: Wed, 14 Jan 2026 01:14:41 +0100 Subject: [PATCH 15/83] python313Packages.nox: use attrs --- pkgs/by-name/no/nox/move-to-attrs.patch | 41 +++++++++++++++++++++++++ pkgs/by-name/no/nox/package.nix | 8 +++-- 2 files changed, 47 insertions(+), 2 deletions(-) create mode 100644 pkgs/by-name/no/nox/move-to-attrs.patch diff --git a/pkgs/by-name/no/nox/move-to-attrs.patch b/pkgs/by-name/no/nox/move-to-attrs.patch new file mode 100644 index 000000000000..3804f1ddc5bc --- /dev/null +++ b/pkgs/by-name/no/nox/move-to-attrs.patch @@ -0,0 +1,41 @@ +diff --git a/nox/update.py b/nox/update.py +index ea4425f..3101ab9 100644 +--- a/nox/update.py ++++ b/nox/update.py +@@ -1,3 +1,4 @@ ++import attrs + import click + import re + import subprocess +@@ -6,15 +7,17 @@ from enum import Enum + from bisect import bisect + from pkg_resources import parse_version + from pathlib import Path +-from characteristic import attributes + from collections import defaultdict + + def query(*args): + return subprocess.check_output(['nix-store', '--query'] + list(args), + universal_newlines=True) + +-@attributes(['full_name', 'path'], apply_with_init=False) ++@attrs.define(init=False) + class NixPath: ++ full_name: str = attrs.field(default=None) ++ path: str = attrs.field(default=None) ++ + def __init__(self, path): + self.path = path + self.is_drv = self.path.endswith('.drv') +diff --git a/requirements.txt b/requirements.txt +index a7bfc0e..4298b69 100644 +--- a/requirements.txt ++++ b/requirements.txt +@@ -1,4 +1,4 @@ ++attrs + click + dogpile.cache +-characteristic +-requests +\ No newline at end of file ++requests diff --git a/pkgs/by-name/no/nox/package.nix b/pkgs/by-name/no/nox/package.nix index 80d608fd122d..51c6876415c5 100644 --- a/pkgs/by-name/no/nox/package.nix +++ b/pkgs/by-name/no/nox/package.nix @@ -14,7 +14,11 @@ python3Packages.buildPythonApplication rec { sha256 = "1qcbhdnhdhhv7q6cqdgv0q55ic8fk18526zn2yb12x9r1s0lfp9z"; }; - patches = [ ./nox-review-wip.patch ]; + patches = [ + ./nox-review-wip.patch + # https://github.com/madjar/nox/pull/100 + ./move-to-attrs.patch + ]; build-system = with python3Packages; [ setuptools @@ -25,7 +29,7 @@ python3Packages.buildPythonApplication rec { dogpile-cache click requests - characteristic + attrs setuptools # pkg_resources is imported during runtime ]; From a9db26fbcdc57673813b2ce704f1b7fb95fdaa74 Mon Sep 17 00:00:00 2001 From: Sergei Trofimovich Date: Thu, 15 Jan 2026 06:38:09 +0000 Subject: [PATCH 16/83] dnsmasq: 2.91 -> 2.92 Changes: https://thekelleys.org.uk/dnsmasq/CHANGELOG --- pkgs/by-name/dn/dnsmasq/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/dn/dnsmasq/package.nix b/pkgs/by-name/dn/dnsmasq/package.nix index b27c574d7036..588a36e43dae 100644 --- a/pkgs/by-name/dn/dnsmasq/package.nix +++ b/pkgs/by-name/dn/dnsmasq/package.nix @@ -30,11 +30,11 @@ let in stdenv.mkDerivation rec { pname = "dnsmasq"; - version = "2.91"; + version = "2.92"; src = fetchurl { url = "https://www.thekelleys.org.uk/dnsmasq/${pname}-${version}.tar.xz"; - hash = "sha256-9iJoKEizNnetsratCCZGGKKuCgHaSGqT/YzZEYaz0VM="; + hash = "sha256-S/UMLBAY+fvCYDffUbkOzqDLc9RhYoRnY7kt8NbDpFg="; }; postPatch = lib.optionalString stdenv.hostPlatform.isLinux '' From 7709eaede566df817d2516d928eacdc15f849e2a Mon Sep 17 00:00:00 2001 From: Gliczy <129636582+Gliczy@users.noreply.github.com> Date: Fri, 9 Jan 2026 08:02:20 +0100 Subject: [PATCH 17/83] signal-desktop-bin: 7.83.0 -> 7.85.0 --- pkgs/by-name/si/signal-desktop-bin/signal-desktop.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/si/signal-desktop-bin/signal-desktop.nix b/pkgs/by-name/si/signal-desktop-bin/signal-desktop.nix index eddb873fc3d9..f1501f6c145a 100644 --- a/pkgs/by-name/si/signal-desktop-bin/signal-desktop.nix +++ b/pkgs/by-name/si/signal-desktop-bin/signal-desktop.nix @@ -1,12 +1,12 @@ { callPackage, commandLineArgs }: callPackage ./generic.nix { inherit commandLineArgs; } rec { pname = "signal-desktop-bin"; - version = "7.83.0"; + version = "7.85.0"; libdir = "opt/Signal"; bindir = libdir; extractPkg = "dpkg-deb -x $downloadedFile $out"; url = "https://updates.signal.org/desktop/apt/pool/s/signal-desktop/signal-desktop_${version}_amd64.deb"; - hash = "sha256-DhtOOve8dloIbTi78gLHWars/Y9Fv6YkLkHHpRK7OWY="; + hash = "sha256-5DJho9aYNwgasZsSuChEvoDK7N1H+n3RdDh7FMw73SA="; } From 0fa2a990ec4f12069cabdbde24cb35c45006532d Mon Sep 17 00:00:00 2001 From: Gliczy <129636582+Gliczy@users.noreply.github.com> Date: Fri, 9 Jan 2026 08:02:42 +0100 Subject: [PATCH 18/83] signal-desktop-bin(aarch64): 7.83.0 -> 7.85.0 --- .../si/signal-desktop-bin/signal-desktop-aarch64.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/si/signal-desktop-bin/signal-desktop-aarch64.nix b/pkgs/by-name/si/signal-desktop-bin/signal-desktop-aarch64.nix index bb7ddb0568c6..8f98f667594c 100644 --- a/pkgs/by-name/si/signal-desktop-bin/signal-desktop-aarch64.nix +++ b/pkgs/by-name/si/signal-desktop-bin/signal-desktop-aarch64.nix @@ -1,7 +1,7 @@ { callPackage, commandLineArgs }: callPackage ./generic.nix { inherit commandLineArgs; } { pname = "signal-desktop-bin"; - version = "7.83.0"; + version = "7.85.0"; libdir = "usr/lib64/signal-desktop"; bindir = "usr/bin"; @@ -10,6 +10,6 @@ callPackage ./generic.nix { inherit commandLineArgs; } { bsdtar -xf $downloadedFile -C "$out" ''; - url = "https://download.copr.fedorainfracloud.org/results/useidel/signal-desktop/fedora-42-aarch64/09932085-signal-desktop/signal-desktop-7.83.0-1.fc42.aarch64.rpm"; - hash = "sha256-OY+sHfAC/WTC2MkjFjlImYXLNflFNAw4VRcbQ/B3s10="; + url = "https://download.copr.fedorainfracloud.org/results/useidel/signal-desktop/fedora-43-aarch64/10010734-signal-desktop/signal-desktop-7.85.0-1.fc43.aarch64.rpm"; + hash = "sha256-ewjW5mwPph1xZXtqwYPishJ/zYjzpA/df+5WvdcEfWI="; } From fff7e5486473cd210fc68973e9859218f7603606 Mon Sep 17 00:00:00 2001 From: Gliczy <129636582+Gliczy@users.noreply.github.com> Date: Fri, 9 Jan 2026 08:02:56 +0100 Subject: [PATCH 19/83] signal-desktop-bin(darwin): 7.83.0 -> 7.85.0 --- pkgs/by-name/si/signal-desktop-bin/signal-desktop-darwin.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/si/signal-desktop-bin/signal-desktop-darwin.nix b/pkgs/by-name/si/signal-desktop-bin/signal-desktop-darwin.nix index f21bd88b7867..ce50656aab12 100644 --- a/pkgs/by-name/si/signal-desktop-bin/signal-desktop-darwin.nix +++ b/pkgs/by-name/si/signal-desktop-bin/signal-desktop-darwin.nix @@ -6,11 +6,11 @@ }: stdenv.mkDerivation (finalAttrs: { pname = "signal-desktop-bin"; - version = "7.83.0"; + version = "7.85.0"; src = fetchurl { url = "https://updates.signal.org/desktop/signal-desktop-mac-universal-${finalAttrs.version}.dmg"; - hash = "sha256-5W70xzjT5+PbzmDHBFIqAUdXn9N1L0aZm1rrdAPUXRw="; + hash = "sha256-oXt4MlSvpj4NHwULg8K0XukaMqnlsF2UPkvBGH3Htko="; }; sourceRoot = "."; From 2dd5ae341d33a0ef1f82a85da3449014147b5b0f Mon Sep 17 00:00:00 2001 From: arthsmn Date: Thu, 15 Jan 2026 12:02:00 -0300 Subject: [PATCH 20/83] scribus: refactoring --- pkgs/by-name/sc/scribus/package.nix | 20 +++++++++----------- 1 file changed, 9 insertions(+), 11 deletions(-) diff --git a/pkgs/by-name/sc/scribus/package.nix b/pkgs/by-name/sc/scribus/package.nix index 27f35267d259..5281a5fa0323 100644 --- a/pkgs/by-name/sc/scribus/package.nix +++ b/pkgs/by-name/sc/scribus/package.nix @@ -3,14 +3,15 @@ cairo, cmake, cups, - fetchurl, fetchpatch, + fetchurl, fontconfig, freetype, graphicsmagick, harfbuzzFull, hunspell, lcms2, + lib, libcdr, libfreehand, libjpeg, @@ -31,17 +32,9 @@ poppler, poppler_data, python3, - lib, - stdenv, qt6, + stdenv, }: - -let - pythonEnv = python3.withPackages (ps: [ - ps.pillow - ps.tkinter - ]); -in stdenv.mkDerivation (finalAttrs: { pname = "scribus"; @@ -85,7 +78,12 @@ stdenv.mkDerivation (finalAttrs: { podofo_0_10 poppler poppler_data - pythonEnv + (python3.withPackages ( + ps: with ps; [ + pillow + tkinter + ] + )) qt6.qt5compat qt6.qtbase qt6.qtdeclarative From 23b5ac11e2181d087c884c6426591d7fdeb0962b Mon Sep 17 00:00:00 2001 From: arthsmn Date: Thu, 15 Jan 2026 12:18:09 -0300 Subject: [PATCH 21/83] scribus: 1.7.0 -> 1.7.2 --- pkgs/by-name/sc/scribus/package.nix | 48 ++++++----------------------- 1 file changed, 10 insertions(+), 38 deletions(-) diff --git a/pkgs/by-name/sc/scribus/package.nix b/pkgs/by-name/sc/scribus/package.nix index 5281a5fa0323..b0c392d46904 100644 --- a/pkgs/by-name/sc/scribus/package.nix +++ b/pkgs/by-name/sc/scribus/package.nix @@ -3,11 +3,12 @@ cairo, cmake, cups, - fetchpatch, fetchurl, fontconfig, freetype, graphicsmagick, + gsettings-desktop-schemas, + gtk3, harfbuzzFull, hunspell, lcms2, @@ -38,11 +39,11 @@ stdenv.mkDerivation (finalAttrs: { pname = "scribus"; - version = "1.7.0"; + version = "1.7.2"; src = fetchurl { url = "mirror://sourceforge/scribus/scribus-devel/scribus-${finalAttrs.version}.tar.xz"; - hash = "sha256-+lnWIh/3z/qTcjV5l+hlcBYuHhiRNza3F2/RD0jCQ/Y="; + hash = "sha256-nY4RzGusLNlsVTnvvXGSIv9/cOHBhZcogNn7MFHhONA="; }; nativeBuildInputs = [ @@ -95,41 +96,12 @@ stdenv.mkDerivation (finalAttrs: { cmakeFlags = [ (lib.cmakeBool "WANT_GRAPHICSMAGICK" true) ]; - patches = [ - (fetchpatch { - url = "https://aur.archlinux.org/cgit/aur.git/plain/fix_build_with_qt_6.9.0.patch?h=scribus-unstable"; - hash = "sha256-hzd9XpoVVqbwvZ40QPGBqqWkIFXug/tSojf/Ikc4nn4="; - }) - (fetchpatch { - url = "https://aur.archlinux.org/cgit/aur.git/plain/fix_build_with_poppler_25.02.0.patch?h=scribus-unstable"; - hash = "sha256-t9xJA6KGMGAdUFyjI8OlTNilewyMr1FFM7vjHOM15Xg="; - }) - (fetchpatch { - name = "fix-build-poppler-25.06.0.patch"; - url = "https://github.com/scribusproject/scribus/commit/8dcf8d777bd85a0741c455961f2de382e3ed47ec.patch"; - hash = "sha256-JBHCgvEJnYrUdtLnFSXTfr1FFin4uUNUnddYwfRbn7k="; - }) - (fetchpatch { - name = "fix-build-poppler-25.07.0.patch"; - url = "https://github.com/scribusproject/scribus/commit/ff6c6abfa8683028e548a269dee6a859b6f63335.patch"; - hash = "sha256-N4jve5feehsX5H0RXdxR4ableKL+c/rTyqCwkEf37Dk="; - }) - (fetchpatch { - name = "fix-qt6.10-build.patch"; - url = "https://github.com/scribusproject/scribus/commit/13fc4f874354511e05bf91a48703b57b4c489715.patch"; - hash = "sha256-+pbQ77SaTh04QX55wmS6WeuZf3IGe5nq3pmrhk68tb8="; - }) - (fetchpatch { - name = "fix-build-poppler-25.09.0.patch"; - url = "https://github.com/scribusproject/scribus/commit/f0cfe30019a514bdaf38b78590451e2c5b9b5420.patch"; - hash = "sha256-ONQ3BzGhouO+0zqYUObuJC3NUCFi1PWq6qoRvuSZJws="; - }) - (fetchpatch { - name = "fix-build-poppler-25.10.0.patch"; - url = "https://github.com/scribusproject/scribus/commit/3c1fc34fae1aa26fceb65b6bdf631a7f00b03c3c.patch"; - hash = "sha256-xTwzbT3h4+5hb6Y/sNmzkfDN2LJGOLP1v/WBVsmZXkk="; - }) - ]; + preFixup = '' + qtWrapperArgs+=( + --prefix XDG_DATA_DIRS : "${gsettings-desktop-schemas}/share/gsettings-schemas/${gsettings-desktop-schemas.name}" + --prefix XDG_DATA_DIRS : "${gtk3}/share/gsettings-schemas/${gtk3.name}" + ) + ''; meta = { maintainers = with lib.maintainers; [ arthsmn ]; From 73195cf18e18b3d89ab358d460b6c2c4642644e8 Mon Sep 17 00:00:00 2001 From: Connor Baker Date: Thu, 15 Jan 2026 23:48:15 +0000 Subject: [PATCH 22/83] onetbb: always use hwloc built without CUDA support Signed-off-by: Connor Baker --- pkgs/by-name/on/onetbb/package.nix | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/pkgs/by-name/on/onetbb/package.nix b/pkgs/by-name/on/onetbb/package.nix index 34b43ec46047..d0d874f84998 100644 --- a/pkgs/by-name/on/onetbb/package.nix +++ b/pkgs/by-name/on/onetbb/package.nix @@ -1,15 +1,20 @@ -{ +args@{ lib, stdenv, fetchFromGitHub, - fetchpatch, cmake, - hwloc, + hwloc, # Purposefully shadowed below ninja, pkg-config, ctestCheckHook, }: - +let + # The behavior of OneTBB does not change if it is built with hwloc with support for CUDA. + # However, the derivation *does* change, causing rebuilds of packages like Nix. + # To avoid these pointless rebuilds, we make sure to always use a version of hwloc with CUDA + # support disabled. + hwloc = args.hwloc.override { enableCuda = false; }; +in stdenv.mkDerivation (finalAttrs: { pname = "onetbb"; version = "2022.3.0"; From 36dab76948f47bee1101f8180ce8e8a769a1317a Mon Sep 17 00:00:00 2001 From: phanirithvij Date: Fri, 16 Jan 2026 10:09:40 +0530 Subject: [PATCH 23/83] nest-cli: fix build on darwin Signed-off-by: phanirithvij --- pkgs/by-name/ne/nest-cli/package.nix | 20 ++++++++++++-------- 1 file changed, 12 insertions(+), 8 deletions(-) diff --git a/pkgs/by-name/ne/nest-cli/package.nix b/pkgs/by-name/ne/nest-cli/package.nix index 69ca8dd9c586..6cd92cddd5ad 100644 --- a/pkgs/by-name/ne/nest-cli/package.nix +++ b/pkgs/by-name/ne/nest-cli/package.nix @@ -1,18 +1,20 @@ { + lib, + stdenv, + python3, + clang_20, buildNpmPackage, fetchFromGitHub, - lib, - python3, }: -buildNpmPackage rec { +buildNpmPackage (finalAttrs: { pname = "nest-cli"; version = "11.0.15"; src = fetchFromGitHub { owner = "nestjs"; repo = "nest-cli"; - tag = version; + tag = finalAttrs.version; hash = "sha256-yUDlF5UyRE9UdGhw9HDLDpg1voUMQsIenUZZ4UPhBT4="; }; @@ -25,17 +27,19 @@ buildNpmPackage rec { nativeBuildInputs = [ python3 - ]; + ] + ++ lib.optionals (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64) [ clang_20 ]; # clang_21 breaks gyp builds meta = { - homepage = "https://nestjs.com"; + changelog = "https://github.com/nestjs/nest-cli/releases/tag/${finalAttrs.version}"; description = "CLI tool for Nest applications"; + downloadPage = "https://github.com/nestjs/nest-cli"; + homepage = "https://nestjs.com"; license = lib.licenses.mit; - changelog = "https://github.com/nestjs/nest-cli/releases/tag/${version}"; mainProgram = "nest"; maintainers = with lib.maintainers; [ ehllie phanirithvij ]; }; -} +}) From 8e17357b0a860c7b6c47b7d1c0b03659a4218593 Mon Sep 17 00:00:00 2001 From: Gon Solo Date: Thu, 8 Jan 2026 20:54:46 +0100 Subject: [PATCH 24/83] librelane: init at 3.0.0.dev47-unstable-2026-01-16 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: Mohamed Gaber Co-authored-by: Gaétan Lepage --- pkgs/by-name/li/librelane/package.nix | 96 +++++++++++++++++++++++++++ 1 file changed, 96 insertions(+) create mode 100644 pkgs/by-name/li/librelane/package.nix diff --git a/pkgs/by-name/li/librelane/package.nix b/pkgs/by-name/li/librelane/package.nix new file mode 100644 index 000000000000..e0dc5de554e7 --- /dev/null +++ b/pkgs/by-name/li/librelane/package.nix @@ -0,0 +1,96 @@ +{ + lib, + python3Packages, + fetchFromGitHub, + + # nativeBuildInputs + makeWrapper, + + # dependencies + pdk-ciel, + + # wrapper runtime dependencies + abc-verifier, + klayout, + magic-vlsi, + netgen-vlsi, + openroad, + ruby, + verilator, + yosys, +}: + +python3Packages.buildPythonApplication (finalAttrs: { + pname = "librelane"; + version = "3.0.0.dev47-unstable-2026-01-12"; + pyproject = true; + + src = fetchFromGitHub { + owner = "librelane"; + repo = "librelane"; + rev = "f1efecac3151f3275fa2ea7d656f8ea7e3225a9d"; + hash = "sha256-XZHypZ+Ht1Zbb0N9VBUmrZKwWuqYA0/w7DpZBOO9KU8="; + }; + + build-system = [ + python3Packages.poetry-core + ]; + + nativeBuildInputs = [ + makeWrapper + ]; + + pythonRelaxDeps = [ + "click" + ]; + + dependencies = with python3Packages; [ + click + cloup + deprecated + httpx + libparse-python + lxml + numpy + pandas + pdk-ciel + psutil + python3Packages.klayout + pyyaml + rapidfuzz + rich + semver + tkinter + yamlcore + ]; + + postInstall = '' + cp -r librelane/scripts $out/${python3Packages.python.sitePackages}/librelane/ + cp -r librelane/examples $out/${python3Packages.python.sitePackages}/librelane/ + ''; + + postFixup = '' + wrapProgram $out/bin/librelane \ + --suffix PYTHONPATH : "$PYTHONPATH" \ + --prefix PATH : ${ + lib.makeBinPath [ + abc-verifier + klayout + magic-vlsi + netgen-vlsi + openroad + ruby + verilator + yosys + ] + } + ''; + + meta = { + description = "ASIC implementation flow infrastructure"; + homepage = "https://github.com/librelane/librelane"; + license = lib.licenses.asl20; + maintainers = [ lib.maintainers.gonsolo ]; + mainProgram = "librelane"; + }; +}) From 0c813288455a2c3cee8176f48c0415b39308f65e Mon Sep 17 00:00:00 2001 From: teutat3s <10206665+teutat3s@users.noreply.github.com> Date: Fri, 16 Jan 2026 19:10:50 -0300 Subject: [PATCH 25/83] docker_29: 29.1.3 -> 29.1.5 https://docs.docker.com/engine/release-notes/29/ --- pkgs/applications/virtualization/docker/default.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/applications/virtualization/docker/default.nix b/pkgs/applications/virtualization/docker/default.nix index 7abb812c99ef..645491049862 100644 --- a/pkgs/applications/virtualization/docker/default.nix +++ b/pkgs/applications/virtualization/docker/default.nix @@ -435,14 +435,14 @@ in docker_29 = let - version = "29.1.3"; + version = "29.1.5"; in callPackage dockerGen { inherit version; cliRev = "v${version}"; - cliHash = "sha256-8VpFDYn9mRFv7BnHek2+HvIu6jNPYNC1asozJvRX/A4="; + cliHash = "sha256-fg18lmJsMoy7lpL4hGkIhM0LKnhEY5nl5f0YuW8yg0A="; mobyRev = "docker-v${version}"; - mobyHash = "sha256-yB6FF4tzi6R+wH6U0JS8PMZGVRl1gWCY2Cjb/JR+62w="; + mobyHash = "sha256-iUoqJT0lIiVh5WaHzlw71QXxc3sEsSpQpADb0KveXNQ="; runcRev = "v1.3.4"; runcHash = "sha256-1IfY08sBoDpbLrwz1AKBRSTuCZyOgQzYPHTDUI6fOZ8="; containerdRev = "v2.2.0"; From da44607720c22458a504a2772da2874a1dec4c57 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Sat, 17 Jan 2026 13:06:16 +0000 Subject: [PATCH 26/83] qlementine-icons: 1.13.0 -> 1.14.0 --- pkgs/by-name/ql/qlementine-icons/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/ql/qlementine-icons/package.nix b/pkgs/by-name/ql/qlementine-icons/package.nix index 582b494787bd..2a907130eec3 100644 --- a/pkgs/by-name/ql/qlementine-icons/package.nix +++ b/pkgs/by-name/ql/qlementine-icons/package.nix @@ -8,13 +8,13 @@ }: stdenv.mkDerivation (finalAttrs: { pname = "qlementine-icons"; - version = "1.13.0"; + version = "1.14.0"; src = fetchFromGitHub { owner = "oclero"; repo = "qlementine-icons"; tag = "v${finalAttrs.version}"; - hash = "sha256-wXpFyVTFNHTVkGz2fQ2gQHdvCfZNs6Dx8hhonFRZytg="; + hash = "sha256-29XiD3t+KKEe8KRs5LwTN11gEFBJt/Ws6geq6bdH8KA="; }; nativeBuildInputs = [ cmake ]; From b952ae26189e8150e00b2a9f367bd626480bb534 Mon Sep 17 00:00:00 2001 From: Florian Klink Date: Sat, 17 Jan 2026 15:28:39 +0200 Subject: [PATCH 27/83] rspamd: 3.13.0 -> 3.14.2 --- pkgs/by-name/rs/rspamd/package.nix | 9 ++------- 1 file changed, 2 insertions(+), 7 deletions(-) diff --git a/pkgs/by-name/rs/rspamd/package.nix b/pkgs/by-name/rs/rspamd/package.nix index d45b0c864922..311316fbe4d7 100644 --- a/pkgs/by-name/rs/rspamd/package.nix +++ b/pkgs/by-name/rs/rspamd/package.nix @@ -2,7 +2,6 @@ stdenv, lib, fetchFromGitHub, - fetchpatch2, cmake, doctest, fmt, @@ -40,20 +39,16 @@ assert (!withHyperscan) || (!withVectorscan); stdenv.mkDerivation rec { pname = "rspamd"; - version = "3.13.0"; + version = "3.14.2"; src = fetchFromGitHub { owner = "rspamd"; repo = "rspamd"; rev = version; - hash = "sha256-0qX/rvcEXxzr/PGL2A59T18Mfcalrjz0KJpEWBKJsZg="; + hash = "sha256-XpCdjS6c9nLi1ngeSPBldmK3HmMFfDNW+tNpxdrUoKg="; }; patches = [ - (fetchpatch2 { - url = "https://github.com/rspamd/rspamd/commit/d808fd75ff1db1821b1dd817eb4ba9a118b31090.patch"; - hash = "sha256-v1Gn3dPxN/h92NYK3PTrZomnbwUcVkAWcYeQCFzQNyo="; - }) ]; nativeBuildInputs = [ From 5bf1a6f4c979046cdcba3d240b2d7a0ce773928f Mon Sep 17 00:00:00 2001 From: Marcin Serwin Date: Sat, 17 Jan 2026 17:48:38 +0100 Subject: [PATCH 28/83] signal-desktop: force 90 days expiration This should prevent issues like in the future. Signed-off-by: Marcin Serwin --- .../force-90-days-expiration.patch | 28 +++++++++++++++++++ pkgs/by-name/si/signal-desktop/package.nix | 5 +++- 2 files changed, 32 insertions(+), 1 deletion(-) create mode 100644 pkgs/by-name/si/signal-desktop/force-90-days-expiration.patch diff --git a/pkgs/by-name/si/signal-desktop/force-90-days-expiration.patch b/pkgs/by-name/si/signal-desktop/force-90-days-expiration.patch new file mode 100644 index 000000000000..982ed6eaac8e --- /dev/null +++ b/pkgs/by-name/si/signal-desktop/force-90-days-expiration.patch @@ -0,0 +1,28 @@ +diff --git a/ts/scripts/get-expire-time.node.ts b/ts/scripts/get-expire-time.node.ts +index 7938f74d3..9d427977d 100644 +--- a/ts/scripts/get-expire-time.node.ts ++++ b/ts/scripts/get-expire-time.node.ts +@@ -18,7 +18,7 @@ const buildCreation = unixTimestamp * 1000; + + // NB: Build expirations are also determined via users' auto-update settings; see + // getExpirationTimestamp +-const validDuration = isNotUpdatable(version) ? DAY * 30 : DAY * 90; ++const validDuration = DAY * 90; + const buildExpiration = buildCreation + validDuration; + + const localProductionPath = join( +diff --git a/ts/util/buildExpiration.std.ts b/ts/util/buildExpiration.std.ts +index 530443ec7..26cb03d7c 100644 +--- a/ts/util/buildExpiration.std.ts ++++ b/ts/util/buildExpiration.std.ts +@@ -70,9 +70,7 @@ export function hasBuildExpired({ + return true; + } + +- const safeExpirationMs = autoDownloadUpdate +- ? NINETY_ONE_DAYS +- : THIRTY_ONE_DAYS; ++ const safeExpirationMs = NINETY_ONE_DAYS; + + const buildExpirationDuration = buildExpirationTimestamp - now; + const tooFarIntoFuture = buildExpirationDuration > safeExpirationMs; diff --git a/pkgs/by-name/si/signal-desktop/package.nix b/pkgs/by-name/si/signal-desktop/package.nix index d07c3b5b51f6..dd52e08b0a4f 100644 --- a/pkgs/by-name/si/signal-desktop/package.nix +++ b/pkgs/by-name/si/signal-desktop/package.nix @@ -111,7 +111,10 @@ stdenv.mkDerivation (finalAttrs: { ]; buildInputs = (lib.optional (!withAppleEmojis) noto-fonts-color-emoji-png); - patches = lib.optional (!withAppleEmojis) ( + patches = [ + ./force-90-days-expiration.patch + ] + ++ lib.optional (!withAppleEmojis) ( replaceVars ./replace-apple-emoji-with-noto-emoji.patch { noto-emoji-pngs = "${noto-fonts-color-emoji-png}/share/noto-fonts-color-emoji-png"; } From dfb269fd19022cdc8a2047617b6c076512a20512 Mon Sep 17 00:00:00 2001 From: Andrew Benbow Date: Sat, 17 Jan 2026 16:12:10 -0500 Subject: [PATCH 29/83] drupal: 11.3.1 -> 11.3.2 --- pkgs/by-name/dr/drupal/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/dr/drupal/package.nix b/pkgs/by-name/dr/drupal/package.nix index 4eefb854808a..92810ea2aaaa 100644 --- a/pkgs/by-name/dr/drupal/package.nix +++ b/pkgs/by-name/dr/drupal/package.nix @@ -8,18 +8,18 @@ php.buildComposerProject2 (finalAttrs: { pname = "drupal"; - version = "11.3.1"; + version = "11.3.2"; src = fetchFromGitLab { domain = "git.drupalcode.org"; owner = "project"; repo = "drupal"; tag = finalAttrs.version; - hash = "sha256-dVCDIKqLbYHlVwv5wveXG0oHc2g3Zl6J6LG1/e8IIZw="; + hash = "sha256-RrBnVDjB6aKW6btmX604saXfPKo18oRka+SdlNmFqUo="; }; composerNoPlugins = false; - vendorHash = "sha256-7FwwkPTKc/miStdHv1wfLoZhV4Gku1KwNgSlWdpPG8g="; + vendorHash = "sha256-c3pqPnyeuSqpMhh1an1NAnDC+IyeRVUT+dCN19/nrMQ="; passthru = { tests = { From ae4911aca5921d1f5f98eefb121d756ed06f69a2 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Sun, 18 Jan 2026 08:14:54 +0000 Subject: [PATCH 30/83] embellish: 0.5.1 -> 0.6.0 --- pkgs/by-name/em/embellish/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/em/embellish/package.nix b/pkgs/by-name/em/embellish/package.nix index 6911f0fb0595..8345ef2be1c1 100644 --- a/pkgs/by-name/em/embellish/package.nix +++ b/pkgs/by-name/em/embellish/package.nix @@ -20,13 +20,13 @@ }: stdenv.mkDerivation (finalAttrs: { pname = "embellish"; - version = "0.5.1"; + version = "0.6.0"; src = fetchFromGitHub { owner = "getnf"; repo = "embellish"; tag = "v${finalAttrs.version}"; - hash = "sha256-Db7/vo9LVE7IeFFHx/BKs+qxzsvuB+6ZLRb7A1NHrxQ="; + hash = "sha256-2WPOXrEhnFP3NHE+MksREYlIoGN8AJE7Y2aw3ObVHeM="; }; nativeBuildInputs = [ From 769087c4119d91456156a18ca87a8faa19dcacae Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Sun, 18 Jan 2026 13:59:06 +0000 Subject: [PATCH 31/83] gallery-dl: 1.31.2 -> 1.31.3 --- pkgs/by-name/ga/gallery-dl/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/ga/gallery-dl/package.nix b/pkgs/by-name/ga/gallery-dl/package.nix index 16a1f24d074b..c1664c5f897f 100644 --- a/pkgs/by-name/ga/gallery-dl/package.nix +++ b/pkgs/by-name/ga/gallery-dl/package.nix @@ -8,7 +8,7 @@ let pname = "gallery-dl"; - version = "1.31.2"; + version = "1.31.3"; in python3Packages.buildPythonApplication { inherit pname version; @@ -18,7 +18,7 @@ python3Packages.buildPythonApplication { owner = "mikf"; repo = "gallery-dl"; tag = "v${version}"; - hash = "sha256-cKgfIJFSlUmZa3ovInI98Yw29QurXNAy7J1dUSPAUfQ="; + hash = "sha256-vheQA67lPeYt7wly/4AbiReDx9ZlUbgqxT5YTxI0gVo="; }; build-system = [ python3Packages.setuptools ]; From 927729c7a6e7669f17c064b671fdeab3ec9fbca9 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Sun, 18 Jan 2026 18:58:48 +0000 Subject: [PATCH 32/83] signalbackup-tools: 20260113 -> 20260118-1 --- pkgs/by-name/si/signalbackup-tools/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/si/signalbackup-tools/package.nix b/pkgs/by-name/si/signalbackup-tools/package.nix index fcd9cde46403..4eef7f0b3e08 100644 --- a/pkgs/by-name/si/signalbackup-tools/package.nix +++ b/pkgs/by-name/si/signalbackup-tools/package.nix @@ -14,13 +14,13 @@ stdenv.mkDerivation rec { pname = "signalbackup-tools"; - version = "20260113"; + version = "20260118-1"; src = fetchFromGitHub { owner = "bepaald"; repo = "signalbackup-tools"; tag = version; - hash = "sha256-vnmNiVMNXdSr2CYgNYIf+tzA86og3r7MeOVyo3bqfvA="; + hash = "sha256-3pwIRhTpYk3Vq0C4BNHle7/6QWrEuo0/hMqFRH6zw6A="; }; nativeBuildInputs = [ From 4f140ebe6634b4833b82de97ff58d274b47158a8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= Date: Sun, 18 Jan 2026 13:34:05 -0800 Subject: [PATCH 33/83] home-assistant-custom-components.volkswagencarnet: 5.4.0 -> 5.4.1 Diff: https://github.com/robinostlund/homeassistant-volkswagencarnet/compare/v5.4.0...v5.4.1 Changelog: https://github.com/robinostlund/homeassistant-volkswagencarnet/releases/tag/v5.4.1 --- .../custom-components/volkswagencarnet/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/servers/home-assistant/custom-components/volkswagencarnet/package.nix b/pkgs/servers/home-assistant/custom-components/volkswagencarnet/package.nix index f707cb19dd83..d4b236d96e60 100644 --- a/pkgs/servers/home-assistant/custom-components/volkswagencarnet/package.nix +++ b/pkgs/servers/home-assistant/custom-components/volkswagencarnet/package.nix @@ -10,13 +10,13 @@ buildHomeAssistantComponent rec { owner = "robinostlund"; domain = "volkswagencarnet"; - version = "5.4.0"; + version = "5.4.1"; src = fetchFromGitHub { owner = "robinostlund"; repo = "homeassistant-volkswagencarnet"; tag = "v${version}"; - hash = "sha256-uIsOuc+UXhLbPm4/koANQjzPFfRVwt/rMhYw6keVgYI="; + hash = "sha256-nlidbT5dILw4rin4uUDQ8OSqUijpQuoePk20UIl5Uvo="; }; postPatch = '' From de0cbdeeb85f548b432186ba81b9b64aa5853811 Mon Sep 17 00:00:00 2001 From: Fabian Affolter Date: Mon, 19 Jan 2026 00:59:54 +0100 Subject: [PATCH 34/83] gpsd: 3.27.3 -> 3.27.5 Changelog: https://gitlab.com/gpsd/gpsd/-/blob/release-3.27.5/NEWS --- pkgs/by-name/gp/gpsd/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/gp/gpsd/package.nix b/pkgs/by-name/gp/gpsd/package.nix index 028ab4931ba9..0171cedc5578 100644 --- a/pkgs/by-name/gp/gpsd/package.nix +++ b/pkgs/by-name/gp/gpsd/package.nix @@ -35,11 +35,11 @@ stdenv.mkDerivation rec { pname = "gpsd"; - version = "3.27.3"; + version = "3.27.5"; src = fetchurl { url = "mirror://savannah/${pname}/${pname}-${version}.tar.gz"; - sha256 = "sha256-pNhbZ3l1Iq6GEZWLX9oLtn5JIa/ia9U+HS/wpBWNrMs="; + sha256 = "sha256-QJhz9QSEYu8axBOlGrNcqotQsxvmKzNHvuHMKZTnxkk="; }; # TODO: render & install HTML documentation using asciidoctor From 89e8b4949af3c48575fdb6b7e0c804b35a6ee409 Mon Sep 17 00:00:00 2001 From: Fabian Affolter Date: Mon, 19 Jan 2026 01:04:34 +0100 Subject: [PATCH 35/83] gpsd: modernize --- pkgs/by-name/gp/gpsd/package.nix | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/pkgs/by-name/gp/gpsd/package.nix b/pkgs/by-name/gp/gpsd/package.nix index 0171cedc5578..9cdd4b352dc1 100644 --- a/pkgs/by-name/gp/gpsd/package.nix +++ b/pkgs/by-name/gp/gpsd/package.nix @@ -33,13 +33,13 @@ gpsdGroup ? "dialout", }: -stdenv.mkDerivation rec { +stdenv.mkDerivation (finalAttrs: { pname = "gpsd"; version = "3.27.5"; src = fetchurl { - url = "mirror://savannah/${pname}/${pname}-${version}.tar.gz"; - sha256 = "sha256-QJhz9QSEYu8axBOlGrNcqotQsxvmKzNHvuHMKZTnxkk="; + url = "mirror://savannah/${finalAttrs.pname}/${finalAttrs.pname}-${finalAttrs.version}.tar.gz"; + hash = "sha256-QJhz9QSEYu8axBOlGrNcqotQsxvmKzNHvuHMKZTnxkk="; }; # TODO: render & install HTML documentation using asciidoctor @@ -148,11 +148,11 @@ stdenv.mkDerivation rec { location-aware applications GPS/AIS logs for diagnostic purposes. ''; homepage = "https://gpsd.gitlab.io/gpsd/index.html"; - changelog = "https://gitlab.com/gpsd/gpsd/-/blob/release-${version}/NEWS"; + changelog = "https://gitlab.com/gpsd/gpsd/-/blob/release-${finalAttrs.version}/NEWS"; license = lib.licenses.bsd2; platforms = lib.platforms.unix; maintainers = with lib.maintainers; [ bjornfor ]; }; -} +}) From 4bd5482aa60b025be8d0fc56764bc1672fd1274e Mon Sep 17 00:00:00 2001 From: Jeremy Fleischman Date: Fri, 5 Dec 2025 17:04:01 -0800 Subject: [PATCH 36/83] nixos/nspawn-container: init a new nspawn-container profile This shares a lot in common with the infrastructure, but is designed to behave like our `qemu-vm.nix` profile (provides a lot of the same `virtualisation.*` options, produces a simple script you can run). This lays the groundwork to be able to rework the nixos test infrastructure to allow for containers as well as qemu nodes. That work isn't quite done yet, but if you want more context, you can see the followup work in . Credit due to the [Clan.lol](https://clan.lol/) team for first implementing this. I'm just cleaning it up and making it play nicely with upstream. To try it out, create a `demo.nix`: ```nix let pkgs = import ./. { }; mkContainer = { nodeNumber, vlans, }: pkgs.nixos ( { config, modulesPath, pkgs, lib, ... }: let interfaces = lib.attrValues config.virtualisation.allInterfaces; # Automatically assign IP addresses to requested interfaces. assignIPs = lib.filter (i: i.assignIP) interfaces; ipInterfaces = lib.forEach assignIPs ( i: lib.nameValuePair i.name { ipv4.addresses = [ { address = "192.168.${toString i.vlan}.${toString nodeNumber}"; prefixLength = 24; } ]; } ); in { imports = [ "${modulesPath}/virtualisation/nspawn-container" ]; users.users.root.password = ""; networking.hostName = "c${toString nodeNumber}"; virtualisation.vlans = vlans; networking.interfaces = lib.listToAttrs ipInterfaces; environment.systemPackages = [ pkgs.neovim ]; system.stateVersion = lib.trivial.release; } ); in { container1 = mkContainer { nodeNumber = 1; vlans = [ 1 ]; }; container2 = mkContainer { nodeNumber = 2; vlans = [ 2 ]; }; container12 = mkContainer { nodeNumber = 12; vlans = [ 1 2 ]; }; } ``` Build and run the machines in separate terminals (unfortunately, `systemd-nspawn` requires `sudo`): ```console $ sudo $(nix-build ./demo.nix -A container1.config.system.build.nspawn)/bin/run-c1-nspawn $ sudo $(nix-build ./demo.nix -A container2.config.system.build.nspawn)/bin/run-c2-nspawn $ sudo $(nix-build ./demo.nix -A container12.config.system.build.nspawn)/bin/run-c12-nspawn ``` You can log into this machines as `root`, and verify they can ping each other: `c1` can ping `c12`: ``` [root@c1:~]# ping 192.168.1.12 -c 1 PING 192.168.1.12 (192.168.1.12) 56(84) bytes of data. 64 bytes from 192.168.1.12: icmp_seq=1 ttl=64 time=0.164 ms ... ``` So can `c2`: ``` [root@c2:~]# ping 192.168.2.12 PING 192.168.2.12 (192.168.2.12) 56(84) bytes of data. 64 bytes from 192.168.2.12: icmp_seq=1 ttl=64 time=0.127 ms ``` --- nixos/lib/testing/network.nix | 16 +- .../nspawn-container/default.nix | 253 ++++++++++++++++++ .../nspawn-container/run-nspawn/default.nix | 6 + .../nspawn-container/run-nspawn/package.nix | 50 ++++ .../nspawn-container/run-nspawn/shell.nix | 4 + .../run-nspawn/src/pyproject.toml | 10 + .../run-nspawn/src/run_nspawn/__init__.py | 206 ++++++++++++++ nixos/modules/virtualisation/qemu-vm.nix | 104 +++++-- 8 files changed, 617 insertions(+), 32 deletions(-) create mode 100644 nixos/modules/virtualisation/nspawn-container/default.nix create mode 100644 nixos/modules/virtualisation/nspawn-container/run-nspawn/default.nix create mode 100644 nixos/modules/virtualisation/nspawn-container/run-nspawn/package.nix create mode 100644 nixos/modules/virtualisation/nspawn-container/run-nspawn/shell.nix create mode 100644 nixos/modules/virtualisation/nspawn-container/run-nspawn/src/pyproject.toml create mode 100644 nixos/modules/virtualisation/nspawn-container/run-nspawn/src/run_nspawn/__init__.py diff --git a/nixos/lib/testing/network.nix b/nixos/lib/testing/network.nix index e65767e7fb99..9a5facfc2433 100644 --- a/nixos/lib/testing/network.nix +++ b/nixos/lib/testing/network.nix @@ -32,14 +32,8 @@ let let qemu-common = import ../qemu-common.nix { inherit (pkgs) lib stdenv; }; - # Convert legacy VLANs to named interfaces and merge with explicit interfaces. - vlansNumbered = forEach (zipLists config.virtualisation.vlans (range 1 255)) (v: { - name = "eth${toString v.snd}"; - vlan = v.fst; - assignIP = true; - }); - explicitInterfaces = lib.mapAttrsToList (n: v: v // { name = n; }) config.virtualisation.interfaces; - interfaces = vlansNumbered ++ explicitInterfaces; + interfaces = lib.attrValues config.virtualisation.allInterfaces; + interfacesNumbered = zipLists interfaces (range 1 255); # Automatically assign IP addresses to requested interfaces. @@ -67,10 +61,10 @@ let { fst, snd }: qemu-common.qemuNICFlags snd fst.vlan config.virtualisation.test.nodeNumber ) ); - udevRules = forEach interfacesNumbered ( - { fst, snd }: + udevRules = forEach interfaces ( + interface: # MAC Addresses for QEMU network devices are lowercase, and udev string comparison is case-sensitive. - ''SUBSYSTEM=="net",ACTION=="add",ATTR{address}=="${toLower (qemu-common.qemuNicMac fst.vlan config.virtualisation.test.nodeNumber)}",NAME="${fst.name}"'' + ''SUBSYSTEM=="net",ACTION=="add",ATTR{address}=="${toLower (qemu-common.qemuNicMac interface.vlan config.virtualisation.test.nodeNumber)}",NAME="${interface.name}"'' ); networkConfig = { diff --git a/nixos/modules/virtualisation/nspawn-container/default.nix b/nixos/modules/virtualisation/nspawn-container/default.nix new file mode 100644 index 000000000000..cdcc68f4b98c --- /dev/null +++ b/nixos/modules/virtualisation/nspawn-container/default.nix @@ -0,0 +1,253 @@ +# This module creates a lightweight "container" from the NixOS configuration. +# Building the `config.system.build.nspawn` attribute gives you a command +# that starts a systemd-nspawn container running the NixOS configuration +# defined in `config`. By default, the Nix store is shared read-only with the +# host, which makes (re)building very efficient. +# This shares a lot in common with +# `nixos/modules/virtualisation/nixos-containers.nix`, but doesn't use systemd +# units. +# The networking options here match the options in +# `nixos/modules/virtualisation/nixos-containers.nix` which allows using these +# lightweight containers for nixos integration tests. + +{ + config, + pkgs, + lib, + ... +}: +let + inherit (lib) types; + cfg = config.virtualisation; + + interfaceType = types.submodule ( + { name, ... }: + { + options = { + name = lib.mkOption { + type = types.str; + default = name; + description = '' + Interface name + ''; + }; + + vlan = lib.mkOption { + type = types.ints.unsigned; + description = '' + VLAN to which the network interface is connected. + ''; + }; + + assignIP = lib.mkOption { + type = types.bool; + default = false; + description = '' + Automatically assign an IP address to the network interface using the same scheme as + virtualisation.vlans. + ''; + }; + }; + } + ); + + # Convert legacy VLANs to named interfaces. + vlansNumbered = lib.listToAttrs ( + lib.forEach (lib.zipLists cfg.vlans (lib.range 1 255)) ( + v: + let + name = "eth${toString v.snd}"; + in + lib.nameValuePair name { + inherit name; + vlan = v.fst; + assignIP = true; + } + ) + ); +in +{ + options = { + networking.primaryIPAddress = lib.mkOption { + type = types.str; + default = ""; + internal = true; + description = "Primary IP address used in /etc/hosts."; + }; + + networking.primaryIPv6Address = lib.mkOption { + type = types.str; + default = ""; + internal = true; + description = "Primary IPv6 address used in /etc/hosts."; + }; + + virtualisation.vlans = lib.mkOption { + type = types.listOf types.ints.unsigned; + default = if cfg.interfaces == { } then [ 1 ] else [ ]; + defaultText = lib.literalExpression ''if cfg.interfaces == {} then [ 1 ] else [ ]''; + example = [ + 1 + 2 + ]; + description = '' + Virtual networks to which the container is connected. Each number «N» in + this list causes the container to have a virtual Ethernet interface + attached to a separate virtual network on which it will be assigned IP + address `192.168.«N».«M»`, where «M» is the index of this container in + the list of containers. + ''; + }; + + virtualisation.interfaces = lib.mkOption { + default = { }; + example = { + enp1s0.vlan = 1; + }; + description = '' + Network interfaces to add to the container. + ''; + type = types.attrsOf interfaceType; + }; + + virtualisation.allInterfaces = lib.mkOption { + type = types.attrsOf interfaceType; + readOnly = true; + description = '' + All network interfaces for the VM. Combines + {option}`virtualisation.vlans` and {option}`virtualisation.interfaces`. + ''; + default = vlansNumbered // cfg.interfaces; + }; + + virtualisation.initArgs = lib.mkOption { + type = types.listOf types.str; + default = [ ]; + example = [ + "systemd.unit=rescue.target" + "systemd.log_level=debug" + "systemd.log_target=console" + ]; + description = '' + Command line arguments to pass to the init process (likely systemd). + Useful for debugging. + ''; + }; + + virtualisation.rootDir = lib.mkOption { + type = types.str; + default = "./${config.system.name}-root"; + defaultText = lib.literalExpression ''"./''${config.system.name}-root"''; + description = '' + Path to a directory for the root filesystem for the container. + The directory will be created on startup if it does not + exist. + ''; + }; + + virtualisation.systemd-nspawn = { + package = lib.mkPackageOption pkgs "systemd" { }; + options = lib.mkOption { + type = types.listOf types.str; + default = [ ]; + example = [ "--bind=/home:/home" ]; + description = '' + Options passed to systemd-nspawn. + See [systemd-nspawn docs](https://www.freedesktop.org/software/systemd/man/latest/systemd-nspawn.html) for a complete list. + ''; + }; + }; + }; + + config = { + assertions = [ + ( + let + conflictingKeys = lib.intersectAttrs vlansNumbered cfg.interfaces; + in + { + assertion = conflictingKeys == { }; + message = '' + `virtualisation.vlans` and `virtualisation.interfaces` have conflicting keys: ${lib.concatStringsSep "," (lib.attrNames conflictingKeys)} + ''; + } + ) + ( + let + allInterfaceNames = + (lib.mapAttrsToList (k: i: i.name) vlansNumbered) + ++ (lib.mapAttrsToList (k: i: i.name) cfg.interfaces); + in + { + assertion = lib.allUnique allInterfaceNames; + message = '' + `virtualisation.vlans` and `virtualisation.interfaces` have conflicting interface names: ${lib.concatStringsSep "," allInterfaceNames} + ''; + } + ) + ]; + + boot.isNspawnContainer = true; + + # Needed since nixpkgs 7fb2f407c01b017737eafc26b065d7f56434a992 removed the getty unit by default. + console.enable = true; + + virtualisation.systemd-nspawn.options = [ + "--private-network" + "--machine=${config.system.name}" + "--bind-ro=/nix/store:/nix/store" + + # systemd-nspawn does some cleverness to mount a procfs and sysfs in an + # unprivileged container, see + # . + # Unfortunately, this doesn't work in the Nix build sandbox as we do not + # have permission to mount filesystems of type `sysfs` nor `procfs`. + # Fortunately, the build sandbox does provide a `/proc` and `/sys` that + # we can just forward onto the container. + "--private-users=no" + "--bind=/proc:/run/host/proc" + "--bind=/sys:/run/host/sys" + + # From `man systemd-nspawn`: + # > Use --keep-unit and --register=no in combination to disable any + # > kind of unit allocation or registration with systemd-machined. + "--keep-unit" + "--register=no" + ]; + + system.build.nspawn = + let + toPythonStr = + s: + assert builtins.typeOf s == "string"; + # Hack: JSON strings are (AFAIK) valid Python expressions that + # represent the exact same string. + builtins.toJSON s; + + toPythonExpression = data: /* python */ "json.loads(${toPythonStr (builtins.toJSON data)})"; + in + pkgs.writers.writePython3Bin "run-${config.system.name}-nspawn" + { + libraries = ps: [ + (pkgs.callPackage ./run-nspawn { python3Packages = ps; }) + ]; + } + '' + import json + import os + import sys + from pathlib import Path + + import run_nspawn + + run_nspawn.run( + container_name=${toPythonStr config.system.name}, # noqa + root_dir_str=Path(os.environ.get("RUN_NSPAWN_ROOT_DIR", ${toPythonStr cfg.rootDir})), # noqa + interfaces=${toPythonExpression (lib.attrValues cfg.allInterfaces)}, # noqa + nspawn_options=${toPythonExpression config.virtualisation.systemd-nspawn.options} + sys.argv[1:], # noqa + init=${toPythonStr "${config.system.build.toplevel}/init"}, # noqa + init_args=${toPythonExpression cfg.initArgs}, # noqa + ) + ''; + }; +} diff --git a/nixos/modules/virtualisation/nspawn-container/run-nspawn/default.nix b/nixos/modules/virtualisation/nspawn-container/run-nspawn/default.nix new file mode 100644 index 000000000000..477f8179d34e --- /dev/null +++ b/nixos/modules/virtualisation/nspawn-container/run-nspawn/default.nix @@ -0,0 +1,6 @@ +{ python3Packages, systemd }: + +python3Packages.callPackage ./package.nix { + # We want `pkgs.systemd`, *not* `python3Packages.system`. + inherit systemd; +} diff --git a/nixos/modules/virtualisation/nspawn-container/run-nspawn/package.nix b/nixos/modules/virtualisation/nspawn-container/run-nspawn/package.nix new file mode 100644 index 000000000000..08b07c6b8cfa --- /dev/null +++ b/nixos/modules/virtualisation/nspawn-container/run-nspawn/package.nix @@ -0,0 +1,50 @@ +{ + buildPythonPackage, + e2fsprogs, + iproute2, + lib, + mypy, + ruff, + setuptools, + systemd, +}: + +buildPythonPackage { + pname = "run-nspawn"; + version = "1.0"; + pyproject = true; + + src = ./src; + + postPatch = '' + substituteInPlace run_nspawn/__init__.py \ + --replace-fail "@ip@" "${lib.getExe' iproute2 "ip"}" \ + --replace-fail "@systemd-nspawn@" "${lib.getExe' systemd "systemd-nspawn"}" \ + --replace-fail "@chattr@" "${lib.getExe' e2fsprogs "chattr"}" + ''; + + build-system = [ + setuptools + ]; + + propagatedBuildInputs = [ + systemd + iproute2 + ]; + + doCheck = true; + + nativeCheckInputs = [ + mypy + ruff + ]; + + checkPhase = '' + echo -e "\x1b[32m## run mypy\x1b[0m" + mypy run_nspawn + echo -e "\x1b[32m## run ruff check\x1b[0m" + ruff check . + echo -e "\x1b[32m## run ruff format\x1b[0m" + ruff format --check --diff . + ''; +} diff --git a/nixos/modules/virtualisation/nspawn-container/run-nspawn/shell.nix b/nixos/modules/virtualisation/nspawn-container/run-nspawn/shell.nix new file mode 100644 index 000000000000..ee8c77543238 --- /dev/null +++ b/nixos/modules/virtualisation/nspawn-container/run-nspawn/shell.nix @@ -0,0 +1,4 @@ +{ + pkgs ? import ../../../../.. { }, +}: +pkgs.callPackage ./default.nix { } diff --git a/nixos/modules/virtualisation/nspawn-container/run-nspawn/src/pyproject.toml b/nixos/modules/virtualisation/nspawn-container/run-nspawn/src/pyproject.toml new file mode 100644 index 000000000000..e67bb76c3c24 --- /dev/null +++ b/nixos/modules/virtualisation/nspawn-container/run-nspawn/src/pyproject.toml @@ -0,0 +1,10 @@ +[build-system] +requires = ["setuptools"] +build-backend = "setuptools.build_meta" + +[project] +name = "run-nspawn" +version = "0.0.0" + +[tool.setuptools.packages] +find = {} diff --git a/nixos/modules/virtualisation/nspawn-container/run-nspawn/src/run_nspawn/__init__.py b/nixos/modules/virtualisation/nspawn-container/run-nspawn/src/run_nspawn/__init__.py new file mode 100644 index 000000000000..76b1d414f732 --- /dev/null +++ b/nixos/modules/virtualisation/nspawn-container/run-nspawn/src/run_nspawn/__init__.py @@ -0,0 +1,206 @@ +import contextlib +import dataclasses +import fcntl +import logging +import os +import signal +import subprocess +import sys +import typing +from pathlib import Path + +logger = logging.getLogger() + + +# Install a SIGTERM handler so all our context managers get a chance to +# clean up. +signal.signal(signal.SIGTERM, lambda _signum, _frame: sys.exit(0)) + + +@dataclasses.dataclass +class Netns: + name: str + path: Path + + +def run_ip(*args: str) -> None: + subprocess.run( + ["@ip@", *args], + check=True, + ) + + +@contextlib.contextmanager +def mk_netns(name: str) -> typing.Generator[Netns, None, None]: + logger.info("creating netns %s", name) + run_ip("netns", "add", name) + try: + yield Netns(name=name, path=Path("/run/netns") / name) + finally: + logger.info("deleting netns %s", name) + run_ip("netns", "delete", name) + + +@contextlib.contextmanager +def vlan_lock(vlan: int) -> typing.Generator[None, None, None]: + lockfile = Path(f"/run/nixos-nspawn/vlan-{vlan}.lock") + lockfile.parent.mkdir(parents=True, exist_ok=True) + with lockfile.open("w") as f: + # Grab an exclusive lock. + fcntl.flock(f, fcntl.LOCK_EX) + try: + yield + finally: + # Release the exclusive lock. + fcntl.flock(f, fcntl.LOCK_UN) + + +@contextlib.contextmanager +def ensure_vlan_bridge(vlan: int) -> typing.Generator[str, None, None]: + """ + Ensure a bridge for the given vlan exists, and create one if it does not. + + Note that this bridge may get used by other containers, so we're careful + to not delete it unless we're sure nobody else is using it. + """ + # These IP addresses correspond to the static IP assignment logic in + # . + ipv4_addr = f"192.168.{vlan}.254/24" + ipv6_addr = f"2001:db8:{vlan}::fe/64" + + bridge_name = f"br{vlan}" + bridge_path = Path("/sys/class/net") / bridge_name + try: + # To avoid racing against other nspawn containers that also + # need this vlan, grab an exclusive lock. + with vlan_lock(vlan): + if not bridge_path.exists(): + logger.info("creating bridge %s", bridge_name) + run_ip("link", "add", bridge_name, "type", "bridge") + run_ip("link", "set", bridge_name, "up") + run_ip("addr", "add", ipv4_addr, "dev", bridge_name) + run_ip("addr", "add", ipv6_addr, "dev", bridge_name) + + yield bridge_name + finally: + # To avoid racing against other nspawn containers that also + # releasing this vlan, grab an exclusive lock. + with vlan_lock(vlan): + if bridge_path.exists(): + child_intf_count = len(list((bridge_path / "brif").iterdir())) + if child_intf_count == 0: + logger.info("deleting bridge %s", bridge_name) + run_ip("link", "delete", bridge_name) + + +@contextlib.contextmanager +def mk_veth( + container_name: str, + netns: Netns, + container_intf_name: str, + vlan: int, +) -> typing.Generator[None, None, None]: + host_intf_name = f"{container_name}-{container_intf_name}" + with ensure_vlan_bridge(vlan) as bridge_name: + logger.info("creating interface %s", host_intf_name) + run_ip( + "link", + "add", + host_intf_name, + "type", + "veth", + "peer", + "name", + container_intf_name, + "netns", + netns.name, + ) + try: + run_ip("link", "set", host_intf_name, "master", bridge_name) + run_ip("link", "set", host_intf_name, "up") + yield + finally: + logger.info("deleting interface %s", host_intf_name) + run_ip("link", "delete", host_intf_name) + + +def run( + container_name: str, + root_dir_str: str, + interfaces: dict, + nspawn_options: list[str], + init: str, + init_args: list[str], +) -> None: + logging.basicConfig( + format=f"nixos-nspawn({container_name}): %(message)s", + level=logging.WARNING, + ) + + assert os.geteuid() == 0, ( + f"systemd-nspawn requires root to work. You are {os.geteuid()}" + ) + + root_dir = Path(root_dir_str) + + root_dir.mkdir(parents=True, exist_ok=True) + root_dir.chmod(0o755) + + with ( + mk_netns(f"nixos-nspawn-{container_name}") as netns, + contextlib.ExitStack() as stack, + ): + for interface in interfaces: + stack.enter_context( + mk_veth( + container_name=container_name, + netns=netns, + container_intf_name=interface["name"], + vlan=interface["vlan"], + ) + ) + + def print_pid() -> None: + print( + f"systemd-nspawn's PID is {os.getpid()}", + # Need to flush stdout before systemd-nspawn gets exec-ed. + flush=True, + ) + + cp = subprocess.Popen( + [ + "@systemd-nspawn@", + *nspawn_options, + f"--directory={root_dir}", + f"--network-namespace-path={netns.path}", + init, + *init_args, + ], + preexec_fn=print_pid, + ) + + try: + exit_code = cp.wait() + finally: + # If we get interrupted for any reason (most likely a SIGTERM), + # be sure to kill our child process. + cp.terminate() + + # NixOS creates `/var/empty` with the immutable filesystem attribute [0]. + # This makes it difficult to clean up the machine's root directory + # (which the test driver does to ensure tests start fresh). + # We unset that bit here so others are less likely to run into this issue. + # Note: this may cause issues on filesystems that don't support + # "Linux file attributes". Please improve this if you run into this! + # + # [0]: https://github.com/NixOS/nixpkgs/blob/d1eff395720e1fe15838263642a2bc1dca1eea32/nixos/modules/system/activation/activation-script.nix#L281 + subprocess.run( + [ + "@chattr@", + "-i", + root_dir / "var/empty", + ], + check=True, + ) + + sys.exit(exit_code) diff --git a/nixos/modules/virtualisation/qemu-vm.nix b/nixos/modules/virtualisation/qemu-vm.nix index 3be38c02085d..a83f825de444 100644 --- a/nixos/modules/virtualisation/qemu-vm.nix +++ b/nixos/modules/virtualisation/qemu-vm.nix @@ -360,6 +360,53 @@ let copyChannel = false; OVMF = cfg.efi.OVMF; }; + + interfaceType = types.submodule ( + { name, ... }: + { + options = { + name = mkOption { + type = types.str; + default = name; + description = '' + Interface name + ''; + }; + + vlan = mkOption { + type = types.ints.unsigned; + description = '' + VLAN to which the network interface is connected. + ''; + }; + + assignIP = mkOption { + type = types.bool; + default = false; + description = '' + Automatically assign an IP address to the network interface using the same scheme as + virtualisation.vlans. + ''; + }; + }; + } + ); + + # Convert legacy VLANs to named interfaces. + vlansNumbered = lib.listToAttrs ( + lib.forEach (lib.zipLists cfg.vlans (lib.range 1 255)) ( + v: + let + name = "eth${toString v.snd}"; + in + lib.nameValuePair name { + inherit name; + vlan = v.fst; + assignIP = true; + } + ) + ); + in { imports = [ @@ -705,29 +752,20 @@ in enp1s0.vlan = 1; }; description = '' - Network interfaces to add to the VM. + Extra network interfaces to add to the VM in addition to the ones + created by {option}`virtualisation.vlans`. ''; - type = - with types; - attrsOf (submodule { - options = { - vlan = mkOption { - type = types.ints.unsigned; - description = '' - VLAN to which the network interface is connected. - ''; - }; + type = types.attrsOf interfaceType; + }; - assignIP = mkOption { - type = types.bool; - default = false; - description = '' - Automatically assign an IP address to the network interface using the same scheme as - virtualisation.vlans. - ''; - }; - }; - }); + virtualisation.allInterfaces = mkOption { + type = types.attrsOf interfaceType; + readOnly = true; + description = '' + All network interfaces for the VM. Combines + {option}`virtualisation.vlans` and {option}`virtualisation.interfaces`. + ''; + default = vlansNumbered // cfg.interfaces; }; virtualisation.writableStore = mkOption { @@ -1248,6 +1286,30 @@ in ) ) ++ [ + ( + let + conflictingKeys = lib.intersectAttrs vlansNumbered cfg.interfaces; + in + { + assertion = conflictingKeys == { }; + message = '' + `virtualisation.vlans` and `virtualisation.interfaces` have conflicting keys: ${lib.concatStringsSep "," (lib.attrNames conflictingKeys)} + ''; + } + ) + ( + let + allInterfaceNames = + (lib.mapAttrsToList (k: i: i.name) vlansNumbered) + ++ (lib.mapAttrsToList (k: i: i.name) cfg.interfaces); + in + { + assertion = lib.allUnique allInterfaceNames; + message = '' + `virtualisation.vlans` and `virtualisation.interfaces` have conflicting interface names: ${lib.concatStringsSep "," allInterfaceNames} + ''; + } + ) { assertion = pkgs.stdenv.hostPlatform.is32bit -> cfg.memorySize < 2047; message = '' From 40f2d0b242fd107904a79c28ac473070e556fe18 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Kier=C3=A1n=20Meinhardt?= Date: Mon, 5 Jan 2026 08:15:39 +0100 Subject: [PATCH 37/83] nixos/nspawn-container: fix typo in comment --- .../virtualisation/nspawn-container/run-nspawn/default.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nixos/modules/virtualisation/nspawn-container/run-nspawn/default.nix b/nixos/modules/virtualisation/nspawn-container/run-nspawn/default.nix index 477f8179d34e..3301e9a4d512 100644 --- a/nixos/modules/virtualisation/nspawn-container/run-nspawn/default.nix +++ b/nixos/modules/virtualisation/nspawn-container/run-nspawn/default.nix @@ -1,6 +1,6 @@ { python3Packages, systemd }: python3Packages.callPackage ./package.nix { - # We want `pkgs.systemd`, *not* `python3Packages.system`. + # We want `pkgs.systemd`, *not* `python3Packages.systemd`. inherit systemd; } From 46303ebf0931fb035ba905334af7d6ec8459b68d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Kier=C3=A1n=20Meinhardt?= Date: Mon, 5 Jan 2026 08:24:21 +0100 Subject: [PATCH 38/83] nixos/nspawn-container: fix typo in virtualisation.allInterfaces --- nixos/modules/virtualisation/nspawn-container/default.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nixos/modules/virtualisation/nspawn-container/default.nix b/nixos/modules/virtualisation/nspawn-container/default.nix index cdcc68f4b98c..a16351856c40 100644 --- a/nixos/modules/virtualisation/nspawn-container/default.nix +++ b/nixos/modules/virtualisation/nspawn-container/default.nix @@ -114,7 +114,7 @@ in type = types.attrsOf interfaceType; readOnly = true; description = '' - All network interfaces for the VM. Combines + All network interfaces for the container. Combines {option}`virtualisation.vlans` and {option}`virtualisation.interfaces`. ''; default = vlansNumbered // cfg.interfaces; From 835e38cf1ab166ff729b5a66932eac34cb9f3c9f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Kier=C3=A1n=20Meinhardt?= Date: Mon, 5 Jan 2026 08:25:29 +0100 Subject: [PATCH 39/83] nixos/nspawn-container: clarify format of virtualisation.systemd-nspawn option tree --- nixos/modules/virtualisation/nspawn-container/default.nix | 3 +++ 1 file changed, 3 insertions(+) diff --git a/nixos/modules/virtualisation/nspawn-container/default.nix b/nixos/modules/virtualisation/nspawn-container/default.nix index a16351856c40..a04120d277dd 100644 --- a/nixos/modules/virtualisation/nspawn-container/default.nix +++ b/nixos/modules/virtualisation/nspawn-container/default.nix @@ -146,7 +146,9 @@ in }; virtualisation.systemd-nspawn = { + package = lib.mkPackageOption pkgs "systemd" { }; + options = lib.mkOption { type = types.listOf types.str; default = [ ]; @@ -156,6 +158,7 @@ in See [systemd-nspawn docs](https://www.freedesktop.org/software/systemd/man/latest/systemd-nspawn.html) for a complete list. ''; }; + }; }; From 7ba279d21ece354fe6385eaf77e86268bf8c4c24 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Kier=C3=A1n=20Meinhardt?= Date: Mon, 5 Jan 2026 11:45:49 +0100 Subject: [PATCH 40/83] nixos/nspawn-container: rename initArgs to cmdline --- nixos/modules/virtualisation/nspawn-container/default.nix | 4 ++-- .../nspawn-container/run-nspawn/src/run_nspawn/__init__.py | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/nixos/modules/virtualisation/nspawn-container/default.nix b/nixos/modules/virtualisation/nspawn-container/default.nix index a04120d277dd..f7f7016289e0 100644 --- a/nixos/modules/virtualisation/nspawn-container/default.nix +++ b/nixos/modules/virtualisation/nspawn-container/default.nix @@ -120,7 +120,7 @@ in default = vlansNumbered // cfg.interfaces; }; - virtualisation.initArgs = lib.mkOption { + virtualisation.cmdline = lib.mkOption { type = types.listOf types.str; default = [ ]; example = [ @@ -249,7 +249,7 @@ in interfaces=${toPythonExpression (lib.attrValues cfg.allInterfaces)}, # noqa nspawn_options=${toPythonExpression config.virtualisation.systemd-nspawn.options} + sys.argv[1:], # noqa init=${toPythonStr "${config.system.build.toplevel}/init"}, # noqa - init_args=${toPythonExpression cfg.initArgs}, # noqa + cmdline=${toPythonExpression cfg.cmdline}, # noqa ) ''; }; diff --git a/nixos/modules/virtualisation/nspawn-container/run-nspawn/src/run_nspawn/__init__.py b/nixos/modules/virtualisation/nspawn-container/run-nspawn/src/run_nspawn/__init__.py index 76b1d414f732..333bd5634366 100644 --- a/nixos/modules/virtualisation/nspawn-container/run-nspawn/src/run_nspawn/__init__.py +++ b/nixos/modules/virtualisation/nspawn-container/run-nspawn/src/run_nspawn/__init__.py @@ -130,7 +130,7 @@ def run( interfaces: dict, nspawn_options: list[str], init: str, - init_args: list[str], + cmdline: list[str], ) -> None: logging.basicConfig( format=f"nixos-nspawn({container_name}): %(message)s", @@ -174,7 +174,7 @@ def run( f"--directory={root_dir}", f"--network-namespace-path={netns.path}", init, - *init_args, + *cmdline, ], preexec_fn=print_pid, ) From 1e3c78f75d1cba608d2a57c95859f8f5924f8c97 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Kier=C3=A1n=20Meinhardt?= Date: Mon, 5 Jan 2026 14:07:22 +0100 Subject: [PATCH 41/83] nixos/nspawn-container: run-nspawn as cli application --- .../nspawn-container/default.nix | 42 +++++------------ .../nspawn-container/run-nspawn/package.nix | 8 +++- .../run-nspawn/src/pyproject.toml | 5 +- .../run-nspawn/src/run_nspawn/__init__.py | 46 ++++++++++++++++++- 4 files changed, 66 insertions(+), 35 deletions(-) diff --git a/nixos/modules/virtualisation/nspawn-container/default.nix b/nixos/modules/virtualisation/nspawn-container/default.nix index f7f7016289e0..c3dc37f1f269 100644 --- a/nixos/modules/virtualisation/nspawn-container/default.nix +++ b/nixos/modules/virtualisation/nspawn-container/default.nix @@ -220,37 +220,17 @@ in system.build.nspawn = let - toPythonStr = - s: - assert builtins.typeOf s == "string"; - # Hack: JSON strings are (AFAIK) valid Python expressions that - # represent the exact same string. - builtins.toJSON s; - - toPythonExpression = data: /* python */ "json.loads(${toPythonStr (builtins.toJSON data)})"; + run-nspawn = pkgs.callPackage ./run-nspawn { }; + commandLineOptions = lib.cli.toCommandLineShellGNU { } { + container-name = config.system.name; + root-dir = cfg.rootDir; + interfaces-json = builtins.toJSON (lib.attrValues cfg.allInterfaces); + init = "${config.system.build.toplevel}/init"; + cmdline-json = builtins.toJSON cfg.cmdline; + }; in - pkgs.writers.writePython3Bin "run-${config.system.name}-nspawn" - { - libraries = ps: [ - (pkgs.callPackage ./run-nspawn { python3Packages = ps; }) - ]; - } - '' - import json - import os - import sys - from pathlib import Path - - import run_nspawn - - run_nspawn.run( - container_name=${toPythonStr config.system.name}, # noqa - root_dir_str=Path(os.environ.get("RUN_NSPAWN_ROOT_DIR", ${toPythonStr cfg.rootDir})), # noqa - interfaces=${toPythonExpression (lib.attrValues cfg.allInterfaces)}, # noqa - nspawn_options=${toPythonExpression config.virtualisation.systemd-nspawn.options} + sys.argv[1:], # noqa - init=${toPythonStr "${config.system.build.toplevel}/init"}, # noqa - cmdline=${toPythonExpression cfg.cmdline}, # noqa - ) - ''; + pkgs.writers.writeDashBin "run-${config.system.name}-nspawn" '' + exec ${lib.getExe run-nspawn} ${commandLineOptions} ${lib.escapeShellArgs config.virtualisation.systemd-nspawn.options} "$@" + ''; }; } diff --git a/nixos/modules/virtualisation/nspawn-container/run-nspawn/package.nix b/nixos/modules/virtualisation/nspawn-container/run-nspawn/package.nix index 08b07c6b8cfa..4f7a0e68748b 100644 --- a/nixos/modules/virtualisation/nspawn-container/run-nspawn/package.nix +++ b/nixos/modules/virtualisation/nspawn-container/run-nspawn/package.nix @@ -1,5 +1,5 @@ { - buildPythonPackage, + buildPythonApplication, e2fsprogs, iproute2, lib, @@ -9,7 +9,7 @@ systemd, }: -buildPythonPackage { +buildPythonApplication { pname = "run-nspawn"; version = "1.0"; pyproject = true; @@ -47,4 +47,8 @@ buildPythonPackage { echo -e "\x1b[32m## run ruff format\x1b[0m" ruff format --check --diff . ''; + + meta = { + mainProgram = "run-nspawn"; + }; } diff --git a/nixos/modules/virtualisation/nspawn-container/run-nspawn/src/pyproject.toml b/nixos/modules/virtualisation/nspawn-container/run-nspawn/src/pyproject.toml index e67bb76c3c24..6fb4fe4336dc 100644 --- a/nixos/modules/virtualisation/nspawn-container/run-nspawn/src/pyproject.toml +++ b/nixos/modules/virtualisation/nspawn-container/run-nspawn/src/pyproject.toml @@ -4,7 +4,10 @@ build-backend = "setuptools.build_meta" [project] name = "run-nspawn" -version = "0.0.0" +version = "1.0" + +[project.scripts] +run-nspawn = "run_nspawn:main" [tool.setuptools.packages] find = {} diff --git a/nixos/modules/virtualisation/nspawn-container/run-nspawn/src/run_nspawn/__init__.py b/nixos/modules/virtualisation/nspawn-container/run-nspawn/src/run_nspawn/__init__.py index 333bd5634366..99f50038fd7c 100644 --- a/nixos/modules/virtualisation/nspawn-container/run-nspawn/src/run_nspawn/__init__.py +++ b/nixos/modules/virtualisation/nspawn-container/run-nspawn/src/run_nspawn/__init__.py @@ -11,7 +11,6 @@ from pathlib import Path logger = logging.getLogger() - # Install a SIGTERM handler so all our context managers get a chance to # clean up. signal.signal(signal.SIGTERM, lambda _signum, _frame: sys.exit(0)) @@ -204,3 +203,48 @@ def run( ) sys.exit(exit_code) + + +def main(): + import argparse + import json + + arg_parser = argparse.ArgumentParser() + arg_parser.add_argument( + "--container-name", required=True, help="Name of the container" + ) + arg_parser.add_argument( + "--root-dir", + required=True, + help="Path to container root directory (overridable with RUN_NSPAWN_ROOT_DIR)", + ) + arg_parser.add_argument( + "--interfaces-json", + dest="interfaces", + type=json.loads, + required=True, + help="JSON-encoded list of interfaces, each with 'name' and 'vlan' fields", + ) + arg_parser.add_argument("--init", required=True, help="Path to init binary") + arg_parser.add_argument( + "--cmdline-json", + dest="cmdline", + type=json.loads, + default=[], + help="JSON-encoded list of command line arguments to pass to init", + ) + # Parse only known args to allow for extra args to be passed to systemd-nspawn. + args, nspawn_options = arg_parser.parse_known_args() + + run( + container_name=args.container_name, + root_dir_str=os.getenv("RUN_NSPAWN_ROOT_DIR", default=args.root_dir), + interfaces=args.interfaces, + nspawn_options=nspawn_options, + init=args.init, + cmdline=args.cmdline, + ) + + +if __name__ == "__main__": + main() From f4baee30bba470d7834e1ba29840f23263d2287d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Kier=C3=A1n=20Meinhardt?= Date: Mon, 5 Jan 2026 17:25:25 +0100 Subject: [PATCH 42/83] nixos/virtualisation: factor out common networking options between qemu-vm and nspawn-container --- .../guest-networking-options.nix | 138 ++++++++++++++++++ .../nspawn-container/default.nix | 126 +--------------- nixos/modules/virtualisation/qemu-vm.nix | 128 +--------------- 3 files changed, 141 insertions(+), 251 deletions(-) create mode 100644 nixos/modules/virtualisation/guest-networking-options.nix diff --git a/nixos/modules/virtualisation/guest-networking-options.nix b/nixos/modules/virtualisation/guest-networking-options.nix new file mode 100644 index 000000000000..fb450cfa09ba --- /dev/null +++ b/nixos/modules/virtualisation/guest-networking-options.nix @@ -0,0 +1,138 @@ +# This module defines networking options for virtual machines and containers. +# It is intended to be used with systemd-nspawn containers and QEMU virtual machines. +{ config, lib, ... }: +let + inherit (lib) types; + + interfaceType = types.submodule ( + { name, ... }: + { + options = { + name = lib.mkOption { + type = types.str; + default = name; + description = '' + Interface name + ''; + }; + + vlan = lib.mkOption { + type = types.ints.unsigned; + description = '' + VLAN to which the network interface is connected. + ''; + }; + + assignIP = lib.mkOption { + type = types.bool; + default = false; + description = '' + Automatically assign an IP address to the network interface using the same scheme as + virtualisation.vlans. + ''; + }; + }; + } + ); + + cfg = config.virtualisation; + + # Convert legacy VLANs to named interfaces. + vlansNumbered = lib.listToAttrs ( + lib.forEach (lib.zipLists cfg.vlans (lib.range 1 255)) ( + v: + let + name = "eth${toString v.snd}"; + in + lib.nameValuePair name { + inherit name; + vlan = v.fst; + assignIP = true; + } + ) + ); +in +{ + options = { + networking.primaryIPAddress = lib.mkOption { + type = types.str; + default = ""; + internal = true; + description = "Primary IP address used in /etc/hosts."; + }; + + networking.primaryIPv6Address = lib.mkOption { + type = types.str; + default = ""; + internal = true; + description = "Primary IPv6 address used in /etc/hosts."; + }; + + virtualisation.vlans = lib.mkOption { + type = types.listOf types.ints.unsigned; + default = if cfg.interfaces == { } then [ 1 ] else [ ]; + defaultText = lib.literalExpression ''if cfg.interfaces == {} then [ 1 ] else [ ]''; + example = [ + 1 + 2 + ]; + description = '' + Virtual networks to which the container or VM is connected. Each number «N» in + this list causes the container to have a virtual Ethernet interface + attached to a separate virtual network on which it will be assigned IP + address `192.168.«N».«M»`, where «M» is the index of this container in + the list of containers. + ''; + }; + + virtualisation.interfaces = lib.mkOption { + default = { }; + example = { + enp1s0.vlan = 1; + }; + description = '' + Extra network interfaces to add to the container or VM in addition to the ones + created by {option}`virtualisation.vlans`. + ''; + type = types.attrsOf interfaceType; + }; + + virtualisation.allInterfaces = lib.mkOption { + type = types.attrsOf interfaceType; + readOnly = true; + description = '' + All network interfaces for the container or VM. Combines + {option}`virtualisation.vlans` and {option}`virtualisation.interfaces`. + ''; + default = vlansNumbered // cfg.interfaces; + }; + }; + config = { + assertions = [ + ( + let + conflictingKeys = lib.intersectAttrs vlansNumbered cfg.interfaces; + in + { + assertion = conflictingKeys == { }; + message = '' + `virtualisation.vlans` and `virtualisation.interfaces` have conflicting keys: ${lib.concatStringsSep "," (lib.attrNames conflictingKeys)} + ''; + } + ) + ( + let + allInterfaceNames = + (lib.mapAttrsToList (k: i: i.name) vlansNumbered) + ++ (lib.mapAttrsToList (k: i: i.name) cfg.interfaces); + in + { + assertion = lib.allUnique allInterfaceNames; + message = '' + `virtualisation.vlans` and `virtualisation.interfaces` have conflicting interface names: ${lib.concatStringsSep "," allInterfaceNames} + ''; + } + ) + ]; + }; +} diff --git a/nixos/modules/virtualisation/nspawn-container/default.nix b/nixos/modules/virtualisation/nspawn-container/default.nix index c3dc37f1f269..c3ab6f1e4873 100644 --- a/nixos/modules/virtualisation/nspawn-container/default.nix +++ b/nixos/modules/virtualisation/nspawn-container/default.nix @@ -19,106 +19,11 @@ let inherit (lib) types; cfg = config.virtualisation; - - interfaceType = types.submodule ( - { name, ... }: - { - options = { - name = lib.mkOption { - type = types.str; - default = name; - description = '' - Interface name - ''; - }; - - vlan = lib.mkOption { - type = types.ints.unsigned; - description = '' - VLAN to which the network interface is connected. - ''; - }; - - assignIP = lib.mkOption { - type = types.bool; - default = false; - description = '' - Automatically assign an IP address to the network interface using the same scheme as - virtualisation.vlans. - ''; - }; - }; - } - ); - - # Convert legacy VLANs to named interfaces. - vlansNumbered = lib.listToAttrs ( - lib.forEach (lib.zipLists cfg.vlans (lib.range 1 255)) ( - v: - let - name = "eth${toString v.snd}"; - in - lib.nameValuePair name { - inherit name; - vlan = v.fst; - assignIP = true; - } - ) - ); in { + imports = [ ../guest-networking-options.nix ]; + options = { - networking.primaryIPAddress = lib.mkOption { - type = types.str; - default = ""; - internal = true; - description = "Primary IP address used in /etc/hosts."; - }; - - networking.primaryIPv6Address = lib.mkOption { - type = types.str; - default = ""; - internal = true; - description = "Primary IPv6 address used in /etc/hosts."; - }; - - virtualisation.vlans = lib.mkOption { - type = types.listOf types.ints.unsigned; - default = if cfg.interfaces == { } then [ 1 ] else [ ]; - defaultText = lib.literalExpression ''if cfg.interfaces == {} then [ 1 ] else [ ]''; - example = [ - 1 - 2 - ]; - description = '' - Virtual networks to which the container is connected. Each number «N» in - this list causes the container to have a virtual Ethernet interface - attached to a separate virtual network on which it will be assigned IP - address `192.168.«N».«M»`, where «M» is the index of this container in - the list of containers. - ''; - }; - - virtualisation.interfaces = lib.mkOption { - default = { }; - example = { - enp1s0.vlan = 1; - }; - description = '' - Network interfaces to add to the container. - ''; - type = types.attrsOf interfaceType; - }; - - virtualisation.allInterfaces = lib.mkOption { - type = types.attrsOf interfaceType; - readOnly = true; - description = '' - All network interfaces for the container. Combines - {option}`virtualisation.vlans` and {option}`virtualisation.interfaces`. - ''; - default = vlansNumbered // cfg.interfaces; - }; virtualisation.cmdline = lib.mkOption { type = types.listOf types.str; @@ -163,33 +68,6 @@ in }; config = { - assertions = [ - ( - let - conflictingKeys = lib.intersectAttrs vlansNumbered cfg.interfaces; - in - { - assertion = conflictingKeys == { }; - message = '' - `virtualisation.vlans` and `virtualisation.interfaces` have conflicting keys: ${lib.concatStringsSep "," (lib.attrNames conflictingKeys)} - ''; - } - ) - ( - let - allInterfaceNames = - (lib.mapAttrsToList (k: i: i.name) vlansNumbered) - ++ (lib.mapAttrsToList (k: i: i.name) cfg.interfaces); - in - { - assertion = lib.allUnique allInterfaceNames; - message = '' - `virtualisation.vlans` and `virtualisation.interfaces` have conflicting interface names: ${lib.concatStringsSep "," allInterfaceNames} - ''; - } - ) - ]; - boot.isNspawnContainer = true; # Needed since nixpkgs 7fb2f407c01b017737eafc26b065d7f56434a992 removed the getty unit by default. diff --git a/nixos/modules/virtualisation/qemu-vm.nix b/nixos/modules/virtualisation/qemu-vm.nix index a83f825de444..762349a39753 100644 --- a/nixos/modules/virtualisation/qemu-vm.nix +++ b/nixos/modules/virtualisation/qemu-vm.nix @@ -360,58 +360,12 @@ let copyChannel = false; OVMF = cfg.efi.OVMF; }; - - interfaceType = types.submodule ( - { name, ... }: - { - options = { - name = mkOption { - type = types.str; - default = name; - description = '' - Interface name - ''; - }; - - vlan = mkOption { - type = types.ints.unsigned; - description = '' - VLAN to which the network interface is connected. - ''; - }; - - assignIP = mkOption { - type = types.bool; - default = false; - description = '' - Automatically assign an IP address to the network interface using the same scheme as - virtualisation.vlans. - ''; - }; - }; - } - ); - - # Convert legacy VLANs to named interfaces. - vlansNumbered = lib.listToAttrs ( - lib.forEach (lib.zipLists cfg.vlans (lib.range 1 255)) ( - v: - let - name = "eth${toString v.snd}"; - in - lib.nameValuePair name { - inherit name; - vlan = v.fst; - assignIP = true; - } - ) - ); - in { imports = [ ../profiles/qemu-guest.nix ./disk-size-option.nix + ./guest-networking-options.nix (mkRenamedOptionModule [ "virtualisation" @@ -726,48 +680,6 @@ in ''; }; - virtualisation.vlans = mkOption { - type = types.listOf types.ints.unsigned; - default = if config.virtualisation.interfaces == { } then [ 1 ] else [ ]; - defaultText = lib.literalExpression ''if config.virtualisation.interfaces == {} then [ 1 ] else [ ]''; - example = [ - 1 - 2 - ]; - description = '' - Virtual networks to which the VM is connected. Each - number «N» in this list causes - the VM to have a virtual Ethernet interface attached to a - separate virtual network on which it will be assigned IP - address - `192.168.«N».«M»`, - where «M» is the index of this VM - in the list of VMs. - ''; - }; - - virtualisation.interfaces = mkOption { - default = { }; - example = { - enp1s0.vlan = 1; - }; - description = '' - Extra network interfaces to add to the VM in addition to the ones - created by {option}`virtualisation.vlans`. - ''; - type = types.attrsOf interfaceType; - }; - - virtualisation.allInterfaces = mkOption { - type = types.attrsOf interfaceType; - readOnly = true; - description = '' - All network interfaces for the VM. Combines - {option}`virtualisation.vlans` and {option}`virtualisation.interfaces`. - ''; - default = vlansNumbered // cfg.interfaces; - }; - virtualisation.writableStore = mkOption { type = types.bool; default = cfg.mountHostNixStore; @@ -790,20 +702,6 @@ in ''; }; - networking.primaryIPAddress = mkOption { - type = types.str; - default = ""; - internal = true; - description = "Primary IP address used in /etc/hosts."; - }; - - networking.primaryIPv6Address = mkOption { - type = types.str; - default = ""; - internal = true; - description = "Primary IPv6 address used in /etc/hosts."; - }; - virtualisation.host.pkgs = mkOption { type = options.nixpkgs.pkgs.type; default = pkgs; @@ -1286,30 +1184,6 @@ in ) ) ++ [ - ( - let - conflictingKeys = lib.intersectAttrs vlansNumbered cfg.interfaces; - in - { - assertion = conflictingKeys == { }; - message = '' - `virtualisation.vlans` and `virtualisation.interfaces` have conflicting keys: ${lib.concatStringsSep "," (lib.attrNames conflictingKeys)} - ''; - } - ) - ( - let - allInterfaceNames = - (lib.mapAttrsToList (k: i: i.name) vlansNumbered) - ++ (lib.mapAttrsToList (k: i: i.name) cfg.interfaces); - in - { - assertion = lib.allUnique allInterfaceNames; - message = '' - `virtualisation.vlans` and `virtualisation.interfaces` have conflicting interface names: ${lib.concatStringsSep "," allInterfaceNames} - ''; - } - ) { assertion = pkgs.stdenv.hostPlatform.is32bit -> cfg.memorySize < 2047; message = '' From be846f5e47b56f33d1e83a1c3a68d920938aa5b6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Kier=C3=A1n=20Meinhardt?= Date: Mon, 19 Jan 2026 08:38:52 +0100 Subject: [PATCH 43/83] nixos/nspawn-container: assign getty TODO to @arianvp Co-Authored-By: Arian van Putten --- nixos/modules/virtualisation/nspawn-container/default.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nixos/modules/virtualisation/nspawn-container/default.nix b/nixos/modules/virtualisation/nspawn-container/default.nix index c3ab6f1e4873..6f303eec16df 100644 --- a/nixos/modules/virtualisation/nspawn-container/default.nix +++ b/nixos/modules/virtualisation/nspawn-container/default.nix @@ -70,7 +70,7 @@ in config = { boot.isNspawnContainer = true; - # Needed since nixpkgs 7fb2f407c01b017737eafc26b065d7f56434a992 removed the getty unit by default. + # TODO(arianvp): Remove after https://github.com/NixOS/nixpkgs/pull/480686 is merged console.enable = true; virtualisation.systemd-nspawn.options = [ From ffc9c1bd487aaa41cea68ae6114542e546148a7b Mon Sep 17 00:00:00 2001 From: jopejoe1 Date: Thu, 24 Apr 2025 22:25:47 +0200 Subject: [PATCH 44/83] nixosTests.activation.test-forbiddenDependencies-{fail,succeed}: set stateVersion --- nixos/modules/system/activation/test.nix | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/nixos/modules/system/activation/test.nix b/nixos/modules/system/activation/test.nix index fe8acb708868..ca399e5aeb4a 100644 --- a/nixos/modules/system/activation/test.nix +++ b/nixos/modules/system/activation/test.nix @@ -6,7 +6,7 @@ }: let node-forbiddenDependencies-fail = nixos ( - { ... }: + { config, ... }: { system.forbiddenDependenciesRegexes = [ "-dev$" ]; environment.etc."dev-dependency" = { @@ -15,16 +15,22 @@ let documentation.enable = false; fileSystems."/".device = "ignore-root-device"; boot.loader.grub.enable = false; + + # Don't do this in an actual config + system.stateVersion = config.system.nixos.release; } ); node-forbiddenDependencies-succeed = nixos ( - { ... }: + { config, ... }: { system.forbiddenDependenciesRegexes = [ "-dev$" ]; system.extraDependencies = [ expect.dev ]; documentation.enable = false; fileSystems."/".device = "ignore-root-device"; boot.loader.grub.enable = false; + + # Don't do this in an actual config + system.stateVersion = config.system.nixos.release; } ); in From 0e2009336725af6c2e280496a98cc740b39244d9 Mon Sep 17 00:00:00 2001 From: jopejoe1 Date: Thu, 24 Apr 2025 22:27:13 +0200 Subject: [PATCH 45/83] nixosTests.vm-variant: set system and don't use pkgs.system --- nixos/tests/vm-variant.nix | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/nixos/tests/vm-variant.nix b/nixos/tests/vm-variant.nix index cc95a3e6ed69..cfd8ef50a46c 100644 --- a/nixos/tests/vm-variant.nix +++ b/nixos/tests/vm-variant.nix @@ -6,12 +6,13 @@ let evalConfig = import ../lib/eval-config.nix; nixos = evalConfig { + system = null; modules = [ { system.stateVersion = "25.05"; fileSystems."/".device = "/dev/null"; boot.loader.grub.device = "nodev"; - nixpkgs.hostPlatform = pkgs.system; + nixpkgs.hostPlatform = pkgs.stdenv.hostPlatform.system; virtualisation.vmVariant.networking.hostName = "vm"; virtualisation.vmVariantWithBootLoader.networking.hostName = "vm-w-bl"; } From 97f925962dff7028c473fc7cdf9016b6e54d24ca Mon Sep 17 00:00:00 2001 From: jopejoe1 Date: Sat, 13 Sep 2025 15:12:12 +0200 Subject: [PATCH 46/83] nixosTests.activation-lib: don't use fileset --- .../system/activation/{lib/test.nix => lib-test.nix} | 8 +------- nixos/tests/all-tests.nix | 2 +- 2 files changed, 2 insertions(+), 8 deletions(-) rename nixos/modules/system/activation/{lib/test.nix => lib-test.nix} (80%) diff --git a/nixos/modules/system/activation/lib/test.nix b/nixos/modules/system/activation/lib-test.nix similarity index 80% rename from nixos/modules/system/activation/lib/test.nix rename to nixos/modules/system/activation/lib-test.nix index 34d55e0bbe62..72039a6921a0 100644 --- a/nixos/modules/system/activation/lib/test.nix +++ b/nixos/modules/system/activation/lib-test.nix @@ -10,13 +10,7 @@ let runTests = stdenv.mkDerivation { name = "tests-activation-lib"; - src = fileset.toSource { - root = ./.; - fileset = fileset.unions [ - ./lib.sh - ./test.sh - ]; - }; + src = ./lib; buildPhase = ":"; doCheck = true; postUnpack = '' diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix index 3da2a4c24dc4..59e208317798 100644 --- a/nixos/tests/all-tests.nix +++ b/nixos/tests/all-tests.nix @@ -200,7 +200,7 @@ in activation-bashless-image = runTest ./activation/bashless-image.nix; activation-etc-overlay-immutable = runTest ./activation/etc-overlay-immutable.nix; activation-etc-overlay-mutable = runTest ./activation/etc-overlay-mutable.nix; - activation-lib = pkgs.callPackage ../modules/system/activation/lib/test.nix { }; + activation-lib = pkgs.callPackage ../modules/system/activation/lib-test.nix { }; activation-nix-channel = runTest ./activation/nix-channel.nix; activation-nixos-init = runTest ./activation/nixos-init.nix; activation-perlless = runTest ./activation/perlless.nix; From 12361457cb1c4171d999c3fba4f1176e485dbcb0 Mon Sep 17 00:00:00 2001 From: jopejoe1 Date: Thu, 9 Oct 2025 21:52:58 +0200 Subject: [PATCH 47/83] nixosTests.kanidm: use non deprecated package --- nixos/tests/kanidm.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nixos/tests/kanidm.nix b/nixos/tests/kanidm.nix index c9fd7bb2a083..dcbabe93cb71 100644 --- a/nixos/tests/kanidm.nix +++ b/nixos/tests/kanidm.nix @@ -21,7 +21,7 @@ in oddlama ]; - _module.args.kanidmPackage = pkgs.lib.mkDefault pkgs.kanidm; + _module.args.kanidmPackage = pkgs.lib.mkDefault pkgs.kanidm_1_7; nodes.server = { pkgs, ... }: From 64478451623c5df21c368801de8071d4984c5a01 Mon Sep 17 00:00:00 2001 From: jopejoe1 Date: Thu, 9 Oct 2025 22:09:00 +0200 Subject: [PATCH 48/83] nixosTests.kanidm-provisioning: don't use aliase --- nixos/tests/kanidm-provisioning.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nixos/tests/kanidm-provisioning.nix b/nixos/tests/kanidm-provisioning.nix index 1e6b39be7eba..1c6c6845a74d 100644 --- a/nixos/tests/kanidm-provisioning.nix +++ b/nixos/tests/kanidm-provisioning.nix @@ -18,7 +18,7 @@ in name = "kanidm-provisioning-${kanidmPackage.version}"; meta.maintainers = with pkgs.lib.maintainers; [ oddlama ]; - _module.args.kanidmPackage = pkgs.lib.mkDefault pkgs.kanidmWithSecretProvisioning; + _module.args.kanidmPackage = pkgs.lib.mkDefault pkgs.kanidmWithSecretProvisioning_1_7; nodes.provision = { pkgs, lib, ... }: From 89d91693897d56bbc6c5599fa44237732eab8c74 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=C3=A9clairevoyant?= <848000+eclairevoyant@users.noreply.github.com> Date: Mon, 19 Jan 2026 09:29:56 -0500 Subject: [PATCH 49/83] signal-desktop-bin: adopt by eclairevoyant --- pkgs/by-name/si/signal-desktop-bin/generic.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/pkgs/by-name/si/signal-desktop-bin/generic.nix b/pkgs/by-name/si/signal-desktop-bin/generic.nix index 12fe5dfde635..47902c4911cf 100644 --- a/pkgs/by-name/si/signal-desktop-bin/generic.nix +++ b/pkgs/by-name/si/signal-desktop-bin/generic.nix @@ -296,6 +296,7 @@ stdenv.mkDerivation rec { lib.licenses.mit # emoji-data ]; maintainers = with lib.maintainers; [ + eclairevoyant mic92 equirosa bkchr From 215f875a0c2dc905df056c9ed129fb605563e4b8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=C3=A9clairevoyant?= <848000+eclairevoyant@users.noreply.github.com> Date: Mon, 19 Jan 2026 09:30:02 -0500 Subject: [PATCH 50/83] signal-desktop: adopt by eclairevoyant --- pkgs/by-name/si/signal-desktop/package.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/pkgs/by-name/si/signal-desktop/package.nix b/pkgs/by-name/si/signal-desktop/package.nix index d07c3b5b51f6..9f11f5b4eb07 100644 --- a/pkgs/by-name/si/signal-desktop/package.nix +++ b/pkgs/by-name/si/signal-desktop/package.nix @@ -289,6 +289,7 @@ stdenv.mkDerivation (finalAttrs: { ] ++ lib.optional withAppleEmojis unfree; maintainers = with lib.maintainers; [ + eclairevoyant marcin-serwin teutat3s ]; From ec84470623b4251a7ceb503171a7a11eb4620aed Mon Sep 17 00:00:00 2001 From: Guilhem Saurel Date: Mon, 19 Jan 2026 20:51:20 +0100 Subject: [PATCH 51/83] itk: fix build with gcc 15 --- pkgs/development/libraries/itk/generic.nix | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/pkgs/development/libraries/itk/generic.nix b/pkgs/development/libraries/itk/generic.nix index c55c362c6d4f..44b971d50ad6 100644 --- a/pkgs/development/libraries/itk/generic.nix +++ b/pkgs/development/libraries/itk/generic.nix @@ -94,6 +94,18 @@ stdenv.mkDerivation { ln -sr ${itkAdaptiveDenoisingSrc} Modules/External/ITKAdaptiveDenoising ln -sr ${itkSimpleITKFiltersSrc} Modules/External/ITKSimpleITKFilters ln -sr ${rtkSrc} Modules/Remote/RTK + + # fix build with GCC 15 + substituteInPlace Modules/ThirdParty/GoogleTest/src/itkgoogletest/googletest/src/gtest-death-test.cc \ + --replace-fail \ + '#include ' \ + '#include + #include ' + substituteInPlace Modules/Core/Common/include/itkFloatingPointExceptions.h \ + --replace-fail \ + '#include "itkSingletonMacro.h"' \ + '#include "itkSingletonMacro.h" + #include ' ''; cmakeFlags = [ From 7c069b42e13e9ad018a1ed18ad04069f5fb9a0d1 Mon Sep 17 00:00:00 2001 From: Guilhem Saurel Date: Mon, 19 Jan 2026 21:17:41 +0100 Subject: [PATCH 52/83] otb: fix itk build with GCC 15 --- pkgs/by-name/ot/otb/package.nix | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/pkgs/by-name/ot/otb/package.nix b/pkgs/by-name/ot/otb/package.nix index f1b433ee31b0..18daaa405904 100644 --- a/pkgs/by-name/ot/otb/package.nix +++ b/pkgs/by-name/ot/otb/package.nix @@ -98,6 +98,17 @@ let postPatch = '' substituteInPlace Modules/ThirdParty/KWSys/src/KWSys/CMakeLists.txt \ --replace-fail 'cmake_minimum_required(VERSION 3.1 FATAL_ERROR)' 'cmake_minimum_required(VERSION 3.10)' + # fix build with GCC 15 + substituteInPlace Modules/ThirdParty/GoogleTest/src/itkgoogletest/googletest/src/gtest-death-test.cc \ + --replace-fail \ + '#include ' \ + '#include + #include ' + substituteInPlace Modules/Core/Common/include/itkFloatingPointExceptions.h \ + --replace-fail \ + '#include "itkSingletonMacro.h"' \ + '#include "itkSingletonMacro.h" + #include ' ''; # fix the CMake config files for ITK which contains double slashes From da3781eea6aa2de88d8036d97c639744ff623729 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Mon, 19 Jan 2026 22:35:06 +0000 Subject: [PATCH 53/83] codebuff: 1.0.581 -> 1.0.589 --- pkgs/by-name/co/codebuff/package-lock.json | 8 ++++---- pkgs/by-name/co/codebuff/package.nix | 6 +++--- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/pkgs/by-name/co/codebuff/package-lock.json b/pkgs/by-name/co/codebuff/package-lock.json index 23cee1899d55..fa1ae0d73236 100644 --- a/pkgs/by-name/co/codebuff/package-lock.json +++ b/pkgs/by-name/co/codebuff/package-lock.json @@ -5,7 +5,7 @@ "packages": { "": { "dependencies": { - "codebuff": "^1.0.581" + "codebuff": "^1.0.589" } }, "node_modules/chownr": { @@ -18,9 +18,9 @@ } }, "node_modules/codebuff": { - "version": "1.0.581", - "resolved": "https://registry.npmjs.org/codebuff/-/codebuff-1.0.581.tgz", - "integrity": "sha512-3lMaeo/TqALXwPWwPvwaIGaVlJcz7cXisEvEGqG4qjOUIFPd+mpiZBw1nF64U67fSxkjvll1/JNKk/mZTEAVng==", + "version": "1.0.589", + "resolved": "https://registry.npmjs.org/codebuff/-/codebuff-1.0.589.tgz", + "integrity": "sha512-e6Fxe49DgX9qx8itMEM7HBro73MhZZXUUYkbQh4+NBHQs9711bja1DN9PzqzKpluFJ3BmU/e67CG70uBrxmavA==", "cpu": [ "x64", "arm64" diff --git a/pkgs/by-name/co/codebuff/package.nix b/pkgs/by-name/co/codebuff/package.nix index d6411c2e88ed..a0aeb4dbf137 100644 --- a/pkgs/by-name/co/codebuff/package.nix +++ b/pkgs/by-name/co/codebuff/package.nix @@ -6,14 +6,14 @@ buildNpmPackage rec { pname = "codebuff"; - version = "1.0.581"; + version = "1.0.589"; src = fetchzip { url = "https://registry.npmjs.org/codebuff/-/codebuff-${version}.tgz"; - hash = "sha256-A5sEqkw9nm9ijyq7FT0vVNegbDl1LXQHI62dfdP/0WI="; + hash = "sha256-kW8I+Aw87O21g56Gy5Z8R+Snuxqr78fHVTckuIp31hQ="; }; - npmDepsHash = "sha256-CEoacNXow99r4i9cF2BUA5dNcgU1dCBc4dq0n0p7CBU="; + npmDepsHash = "sha256-8+u7/1oQ19ZnA1EZrAgrwppliOZWPb+PJ22xHr6WFKE="; postPatch = '' cp ${./package-lock.json} package-lock.json From 45ada2b554e826289801ebe75830289844f310fc Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Tue, 20 Jan 2026 01:34:54 +0000 Subject: [PATCH 54/83] saga: 9.11.0 -> 9.11.1 --- pkgs/by-name/sa/saga/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/sa/saga/package.nix b/pkgs/by-name/sa/saga/package.nix index 4cd982efbf3f..3b8259ddc95d 100644 --- a/pkgs/by-name/sa/saga/package.nix +++ b/pkgs/by-name/sa/saga/package.nix @@ -43,11 +43,11 @@ stdenv.mkDerivation (finalAttrs: { pname = "saga"; - version = "9.11.0"; + version = "9.11.1"; src = fetchurl { url = "mirror://sourceforge/saga-gis/saga-${finalAttrs.version}.tar.gz"; - hash = "sha256-KoSL1OnxK/dJxwlTxQGTiICyfEGpVMnojbWi0iZ6GV8="; + hash = "sha256-cNk6/IcgqLgOrw2LaeM97pydFwLmDL6Mr169pjBNYDE="; }; sourceRoot = "saga-${finalAttrs.version}/saga-gis"; From f6d13112f880014830578750c6918e095005688a Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Tue, 20 Jan 2026 03:53:48 +0000 Subject: [PATCH 55/83] tailscale: 1.92.5 -> 1.94.0 --- pkgs/by-name/ta/tailscale/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/ta/tailscale/package.nix b/pkgs/by-name/ta/tailscale/package.nix index 704ff4a1c306..31345c7f39cd 100644 --- a/pkgs/by-name/ta/tailscale/package.nix +++ b/pkgs/by-name/ta/tailscale/package.nix @@ -24,7 +24,7 @@ buildGoModule (finalAttrs: { pname = "tailscale"; - version = "1.92.5"; + version = "1.94.0"; outputs = [ "out" @@ -35,10 +35,10 @@ buildGoModule (finalAttrs: { owner = "tailscale"; repo = "tailscale"; tag = "v${finalAttrs.version}"; - hash = "sha256-S0aD+x8dUPHaNb5MdB41oeID/8eERB3FKKuuqlCqJkU="; + hash = "sha256-kwIWUKKXBz0rmiicLEaR4d3T94aA4VqiVrFFV9vk7g0="; }; - vendorHash = "sha256-jJSSXMyUqcJoZuqfSlBsKDQezyqS+jDkRglMMjG1K8g="; + vendorHash = "sha256-WeMTOkERj4hvdg4yPaZ1gRgKnhRIBXX55kUVbX/k/xM="; nativeBuildInputs = [ makeWrapper From a82514b182dacc35f39661b52f00051c35a8b169 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= Date: Mon, 19 Jan 2026 22:42:37 -0800 Subject: [PATCH 56/83] python3Packages.slowapi: disable fewer tests --- pkgs/development/python-modules/slowapi/default.nix | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) diff --git a/pkgs/development/python-modules/slowapi/default.nix b/pkgs/development/python-modules/slowapi/default.nix index 9130e2e22f17..bf4412ff471a 100644 --- a/pkgs/development/python-modules/slowapi/default.nix +++ b/pkgs/development/python-modules/slowapi/default.nix @@ -9,7 +9,6 @@ httpx, poetry-core, pytestCheckHook, - pythonAtLeast, redis, starlette, }: @@ -43,14 +42,10 @@ buildPythonPackage rec { ]; disabledTests = [ - # AssertionError: Regex pattern 'parameter `request` must be an instance of starlette.requests.Request' does not match 'This portal is not running'. - "test_endpoint_request_param_invalid" - "test_endpoint_response_param_invalid" # AssertionError: assert '1740326049.9886339' == '1740326049' "test_headers_no_breach" "test_headers_breach" - ] - ++ lib.optionals (pythonAtLeast "3.10") [ "test_multiple_decorators" ]; + ]; pythonImportsCheck = [ "slowapi" ]; From bf19c3104474a87adeff77a490b6bad5195ab25e Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Tue, 20 Jan 2026 06:45:57 +0000 Subject: [PATCH 57/83] redumper: 666 -> 686 --- pkgs/by-name/re/redumper/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/re/redumper/package.nix b/pkgs/by-name/re/redumper/package.nix index 5fc933afcd26..d629fc4d26b7 100644 --- a/pkgs/by-name/re/redumper/package.nix +++ b/pkgs/by-name/re/redumper/package.nix @@ -9,13 +9,13 @@ # redumper is using C++ modules, this requires latest C++20 compiler and build tools llvmPackages.libcxxStdenv.mkDerivation (finalAttrs: { pname = "redumper"; - version = "666"; + version = "686"; src = fetchFromGitHub { owner = "superg"; repo = "redumper"; tag = "b${finalAttrs.version}"; - hash = "sha256-B5c7ISlQhLBsRYcoCG18uLWkeODJUDGoRAd9n8EejNA="; + hash = "sha256-oyF8NLMgnNzUPgcwu7WvVoOFQt1qUuFMtzKxJqyOq9A="; }; nativeBuildInputs = [ From 7177b3f71ee12e16d0ec73e6bb37bc02fb3b1fcf Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Tue, 20 Jan 2026 07:25:14 +0000 Subject: [PATCH 58/83] photoqt: 5.0 -> 5.1 --- pkgs/by-name/ph/photoqt/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/ph/photoqt/package.nix b/pkgs/by-name/ph/photoqt/package.nix index 15aee4d2062e..c2817a7e0a75 100644 --- a/pkgs/by-name/ph/photoqt/package.nix +++ b/pkgs/by-name/ph/photoqt/package.nix @@ -17,11 +17,11 @@ stdenv.mkDerivation rec { pname = "photoqt"; - version = "5.0"; + version = "5.1"; src = fetchurl { url = "https://photoqt.org/downloads/source/photoqt-${version}.tar.gz"; - hash = "sha256-BSe95dwzBCVp5jHIX6xh9BZ4OgPl88YUxt0iTSTnx18="; + hash = "sha256-GQT0JDuhrtQh9u5R2DBIlYWEHsSJ8cvDp3+0s6I0iHY="; }; nativeBuildInputs = [ From e13bf4b83cd0bdc2cd97afd319ba2029e6381026 Mon Sep 17 00:00:00 2001 From: Gon Solo Date: Wed, 14 Jan 2026 16:23:52 +0100 Subject: [PATCH 59/83] yosys: 0.60 -> 0.61 --- pkgs/by-name/yo/yosys/package.nix | 70 +++++++++---------------------- 1 file changed, 20 insertions(+), 50 deletions(-) diff --git a/pkgs/by-name/yo/yosys/package.nix b/pkgs/by-name/yo/yosys/package.nix index c4e06f4131bc..c9170b3a1883 100644 --- a/pkgs/by-name/yo/yosys/package.nix +++ b/pkgs/by-name/yo/yosys/package.nix @@ -20,7 +20,6 @@ iverilog, # passthru - # plugins symlinkJoin, yosys, makeWrapper, @@ -31,33 +30,7 @@ enablePython ? true, # enable python binding }: -# NOTE: as of late 2020, yosys has switched to an automation robot that -# automatically tags their repository Makefile with a new build number every -# day when changes are committed. please MAKE SURE that the version number in -# the 'version' field exactly matches the YOSYS_VER field in the Yosys -# makefile! -# -# if a change in yosys isn't yet available under a build number like this (i.e. -# it was very recently merged, within an hour), wait a few hours for the -# automation robot to tag the new version, like so: -# -# https://github.com/YosysHQ/yosys/commit/71ca9a825309635511b64b3ec40e5e5e9b6ad49b -# -# note that while most nix packages for "unstable versions" use a date-based -# version scheme, synchronizing the nix package version here with the unstable -# yosys version number helps users report better bugs upstream, and is -# ultimately less confusing than using dates. - let - - # Provides a wrapper for creating a yosys with the specified plugins preloaded - # - # Example: - # - # my_yosys = yosys.withPlugins (with yosys.allPlugins; [ - # fasm - # bluespec - # ]); withPlugins = plugins: let @@ -87,30 +60,18 @@ let in stdenv.mkDerivation (finalAttrs: { pname = "yosys"; - version = "0.60"; + version = "0.61"; src = fetchFromGitHub { owner = "YosysHQ"; repo = "yosys"; tag = "v${finalAttrs.version}"; - hash = "sha256-BVrSq9nWbdu/PIXfwLW7ZkHTz6SrmsqJMSkVa6CsBm8="; + hash = "sha256-p7QewbeJtJRRkqYqWW1QzIe71OR5LD+0qsHHgl/cq2w="; fetchSubmodules = true; - leaveDotGit = true; - postFetch = '' - # set up git hashes as if we used the tarball - - pushd $out - git rev-parse HEAD > .gitcommit - cd $out/abc - git rev-parse HEAD > .gitcommit - popd - - # remove .git now that we are through with it - find "$out" -name .git -print0 | xargs -0 rm -rf - ''; }; enableParallelBuilding = true; + nativeBuildInputs = [ bison flex @@ -134,11 +95,23 @@ stdenv.mkDerivation (finalAttrs: { python3.pkgs.boost ]; - makeFlags = [ "PREFIX=${placeholder "out"}" ]; + makeFlags = [ + "PREFIX=${placeholder "out"}" + "YOSYS_VER=${finalAttrs.version}" + ]; postPatch = '' - substituteInPlace ./Makefile \ - --replace-fail 'echo UNKNOWN' 'echo ${builtins.substring 0 10 finalAttrs.src.rev}' + substituteInPlace Makefile \ + --replace-fail 'GIT_REV := $(shell GIT_DIR=$(YOSYS_SRC)/.git git rev-parse --short=9 HEAD || echo UNKNOWN)' 'GIT_REV := v${finalAttrs.version}' \ + --replace-fail 'GIT_DIRTY := $(shell GIT_DIR=$(YOSYS_SRC)/.git git diff --exit-code --quiet 2>/dev/null; if [ $$? -ne 0 ]; then echo "-dirty"; fi)' 'GIT_DIRTY := ""' + + substituteInPlace Makefile \ + --replace-fail "| check-git-abc" "" + + substituteInPlace Makefile \ + --replace-fail 'new=$$(cd abc 2>/dev/null && git rev-parse HEAD 2>/dev/null || echo none)' 'new=none' + + sed -i 's/^YOSYS_VER :=.*/YOSYS_VER := ${finalAttrs.version}/' Makefile patchShebangs tests ./misc/yosys-config.in ''; @@ -147,8 +120,8 @@ stdenv.mkDerivation (finalAttrs: { chmod -R u+w . make config-${if stdenv.cc.isClang or false then "clang" else "gcc"} - if ! grep -q "YOSYS_VER := $version" Makefile; then - echo "ERROR: yosys version in Makefile isn't equivalent to version of the nix package (allegedly ${finalAttrs.version}), failing." + if ! grep -q "YOSYS_VER := ${finalAttrs.version}" Makefile; then + echo "ERROR: yosys version in Makefile isn't equivalent to version of the nix package, failing." exit 1 fi '' @@ -160,9 +133,6 @@ stdenv.mkDerivation (finalAttrs: { ''; preCheck = '' - # autotest.sh automatically compiles a utility during startup if it's out of date. - # having N check jobs race to do that creates spurious codesigning failures on macOS. - # run it once without asking it to do anything so that compilation is done before the jobs start. tests/tools/autotest.sh ''; From ccc75da99b76619d16f02cf63298e28a44485422 Mon Sep 17 00:00:00 2001 From: Kenichi Kamiya Date: Tue, 20 Jan 2026 17:17:51 +0900 Subject: [PATCH 60/83] gh-copilot: drop The deprecation and the replacement repository are clarified at: https://github.com/github/gh-copilot/blob/98ba986c2ca3a606f47e081a97316523bf0ef473/README.md?plain=1#L1 --- pkgs/by-name/gh/gh-copilot/package.nix | 62 -------------------------- pkgs/by-name/gh/gh-copilot/update.sh | 43 ------------------ pkgs/top-level/aliases.nix | 1 + 3 files changed, 1 insertion(+), 105 deletions(-) delete mode 100644 pkgs/by-name/gh/gh-copilot/package.nix delete mode 100755 pkgs/by-name/gh/gh-copilot/update.sh diff --git a/pkgs/by-name/gh/gh-copilot/package.nix b/pkgs/by-name/gh/gh-copilot/package.nix deleted file mode 100644 index c9c609233d65..000000000000 --- a/pkgs/by-name/gh/gh-copilot/package.nix +++ /dev/null @@ -1,62 +0,0 @@ -{ - stdenv, - lib, - fetchurl, -}: -let - inherit (stdenv.hostPlatform) system; - throwSystem = throw "Unsupported system: ${system}"; - - systemToPlatform = { - "x86_64-linux" = { - name = "linux-amd64"; - hash = "sha256-WVb32g9eqoeQgvPUGOQ7r3oD+PerKYQWEh/PoZwVqkI="; - }; - "aarch64-linux" = { - name = "linux-arm64"; - hash = "sha256-nZg7u0BUIHOdu3dg28fydgm6ctr4jOOIZOA5ms3/E64="; - }; - "x86_64-darwin" = { - name = "darwin-amd64"; - hash = "sha256-A+FQ7AgjqS1/7LExhyKwXlCAwCveSgeyhbCNAjqQ770="; - }; - "aarch64-darwin" = { - name = "darwin-arm64"; - hash = "sha256-+Q1H9h1j1kusEu1HW3zHWQ8ReR50kwjj4kGC3g6Jzqc="; - }; - }; - platform = systemToPlatform.${system} or throwSystem; -in -stdenv.mkDerivation (finalAttrs: { - pname = "gh-copilot"; - version = "1.2.0"; - - src = fetchurl { - name = "gh-copilot"; - url = "https://github.com/github/gh-copilot/releases/download/v${finalAttrs.version}/${platform.name}"; - hash = platform.hash; - }; - - dontUnpack = true; - - installPhase = '' - runHook preInstall - - install -m755 -D $src $out/bin/gh-copilot - - runHook postInstall - ''; - - passthru.updateScript = ./update.sh; - - meta = { - changelog = "https://github.com/github/gh-copilot/releases/tag/v${finalAttrs.version}"; - description = "Ask for assistance right in your terminal"; - homepage = "https://github.com/github/gh-copilot"; - license = lib.licenses.unfree; - mainProgram = "gh-copilot"; - maintainers = with lib.maintainers; [ PerchunPak ]; - platforms = lib.attrNames systemToPlatform; - sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ]; - }; -}) diff --git a/pkgs/by-name/gh/gh-copilot/update.sh b/pkgs/by-name/gh/gh-copilot/update.sh deleted file mode 100755 index cca77cd367c0..000000000000 --- a/pkgs/by-name/gh/gh-copilot/update.sh +++ /dev/null @@ -1,43 +0,0 @@ -#!/usr/bin/env nix-shell -#!nix-shell -i bash -p curl jq common-updater-scripts nix-prefetch - -set -euo pipefail -set -x - -ROOT="$(dirname "$(readlink -f "$0")")" -NIX_DRV="$ROOT/package.nix" -if [ ! -f "$NIX_DRV" ]; then - echo "ERROR: cannot find gh-copilot in $ROOT" - exit 1 -fi - -fetch_arch() { - VER="$1"; ARCH="$2" - URL="https://github.com/github/gh-copilot/releases/download/v${VER}/${ARCH}"; - nix-prefetch "{ stdenv, fetchzip }: -stdenv.mkDerivation rec { - pname = \"vere\"; version = \"${VER}\"; - src = fetchurl { url = \"$URL\"; }; -} -" -} - -replace_sha() { - # https://stackoverflow.com/a/38470458/22235705 - sed -rziE "s@($1[^\n]*\n[^\n]*hash = )\"sha256-.{44}\";@\1\"$2\";@" "$NIX_DRV" -} - -VERE_VER=$(curl https://api.github.com/repos/github/gh-copilot/releases/latest | jq .tag_name) -VERE_VER=$(echo $VERE_VER | sed -e 's/^"v//' -e 's/"$//') # transform "v1.0.2" into 1.0.2 - -VERE_LINUX_X64_SHA256=$(fetch_arch "$VERE_VER" "linux-amd64") -VERE_LINUX_AARCH64_SHA256=$(fetch_arch "$VERE_VER" "linux-arm64") -VERE_DARWIN_X64_SHA256=$(fetch_arch "$VERE_VER" "darwin-amd64") -VERE_DARWIN_AARCH64_SHA256=$(fetch_arch "$VERE_VER" "darwin-arm64") - -sed -i "s/version = \".*\"/version = \"$VERE_VER\"/" "$NIX_DRV" - -replace_sha "linux-amd64" "$VERE_LINUX_X64_SHA256" -replace_sha "linux-arm64" "$VERE_LINUX_AARCH64_SHA256" -replace_sha "darwin-amd64" "$VERE_DARWIN_X64_SHA256" -replace_sha "darwin-arm64" "$VERE_DARWIN_AARCH64_SHA256" diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix index 479af8a8f89e..6a2b88fd775a 100644 --- a/pkgs/top-level/aliases.nix +++ b/pkgs/top-level/aliases.nix @@ -702,6 +702,7 @@ mapAliases { gfortran12 = throw "gfortran12 has been removed from Nixpkgs, as it is unmaintained and obsolete"; # Added 2025-08-08 gg = throw "'gg' has been renamed to/replaced by 'go-graft'"; # Converted to throw 2025-10-27 ggobi = throw "'ggobi' has been removed from Nixpkgs, as it is unmaintained and broken"; # Added 2025-05-18 + gh-copilot = throw "'gh-copilot' has been removed since it has been deprecated and archived upstream. Consider using 'github-copilot-cli' instead"; # Added 2026-01-20 gimp3 = gimp; # Added 2025-10-03 gimp3-with-plugins = gimp-with-plugins; # Added 2025-10-03 gimp3Plugins = gimpPlugins; # Added 2025-10-03 From 014d5dd8f1ba879ca4049ebae09c909486c33815 Mon Sep 17 00:00:00 2001 From: pvgoran Date: Tue, 20 Jan 2026 15:41:12 +0700 Subject: [PATCH 61/83] modules/acme: fix typo in documentation --- nixos/modules/security/acme/default.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nixos/modules/security/acme/default.md b/nixos/modules/security/acme/default.md index f976f28db552..af94d3390486 100644 --- a/nixos/modules/security/acme/default.md +++ b/nixos/modules/security/acme/default.md @@ -377,7 +377,7 @@ systemd-tmpfiles --create systemctl start acme-example.com.service ``` -## Ensuring dependencies for services that need to be reloaded when a certificate challenges {#module-security-acme-reload-dependencies} +## Ensuring dependencies for services that need to be reloaded when a certificate changes {#module-security-acme-reload-dependencies} Services that depend on ACME certificates and need to be reloaded can use one of two approaches to reload upon successfull certificate acquisition or renewal: From 979c7455f6f29e37cb23bff9a322f54fdeb64ae7 Mon Sep 17 00:00:00 2001 From: Defelo Date: Tue, 20 Jan 2026 08:55:19 +0000 Subject: [PATCH 62/83] radicle-ci-broker: 0.24.0 -> 0.25.0 Changelog: https://app.radicle.xyz/nodes/seed.radicle.xyz/rad:zwTxygwuz5LDGBq255RA2CbNGrz8/tree/NEWS.md --- pkgs/by-name/ra/radicle-ci-broker/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/ra/radicle-ci-broker/package.nix b/pkgs/by-name/ra/radicle-ci-broker/package.nix index 72c71b01b20d..07f74a9cb9c6 100644 --- a/pkgs/by-name/ra/radicle-ci-broker/package.nix +++ b/pkgs/by-name/ra/radicle-ci-broker/package.nix @@ -14,14 +14,14 @@ rustPlatform.buildRustPackage (finalAttrs: { pname = "radicle-ci-broker"; - version = "0.24.0"; + version = "0.25.0"; src = fetchFromRadicle { seed = "seed.radicle.xyz"; repo = "zwTxygwuz5LDGBq255RA2CbNGrz8"; node = "z6MkgEMYod7Hxfy9qCvDv5hYHkZ4ciWmLFgfvm3Wn1b2w2FV"; tag = "v${finalAttrs.version}"; - hash = "sha256-E9i5EhzI+9PX2Sm2nNyB5SMi6F/EmjifeD0futPBi6k="; + hash = "sha256-28PS85ME0Yg6+FnYw8GRNeo56z5efAqSE7FNk7wiTuI="; leaveDotGit = true; postFetch = '' git -C $out rev-parse --short HEAD > $out/.git_head @@ -29,7 +29,7 @@ rustPlatform.buildRustPackage (finalAttrs: { ''; }; - cargoHash = "sha256-RlqomX4XiKn/YuCdBh6H/y+8JFBwC06eDEAmhz71UXs="; + cargoHash = "sha256-v+ax8DmXZFxYGYL7WaX5W/UIByuYcvkAMQIqpb6Emyw="; postPatch = '' substituteInPlace build.rs \ From 9cda54312fccaab72e13379fb37137ccd10e662e Mon Sep 17 00:00:00 2001 From: Gaetan Lepage Date: Tue, 20 Jan 2026 08:33:44 +0000 Subject: [PATCH 63/83] iamb: 0.0.10 -> 0.0.11 Diff: https://github.com/ulyssa/iamb/compare/v0.0.10...v0.0.11 Changelog: https://github.com/ulyssa/iamb/releases/tag/v0.0.11 --- pkgs/by-name/ia/iamb/package.nix | 34 ++++++++++---------------------- 1 file changed, 10 insertions(+), 24 deletions(-) diff --git a/pkgs/by-name/ia/iamb/package.nix b/pkgs/by-name/ia/iamb/package.nix index 714c9c8f5f93..d4dc072cece4 100644 --- a/pkgs/by-name/ia/iamb/package.nix +++ b/pkgs/by-name/ia/iamb/package.nix @@ -1,42 +1,28 @@ { lib, - stdenv, rustPlatform, fetchFromGitHub, installShellFiles, + writableTmpDirAsHomeHook, versionCheckHook, nix-update-script, }: -rustPlatform.buildRustPackage rec { +rustPlatform.buildRustPackage (finalAttrs: { pname = "iamb"; - version = "0.0.10"; + version = "0.0.11"; src = fetchFromGitHub { owner = "ulyssa"; repo = "iamb"; - tag = "v${version}"; - hash = "sha256-cjBSWUBgfwdLnpneJ5XW2TdOFkNc+Rc/wyUp9arZzwg="; + tag = "v${finalAttrs.version}"; + hash = "sha256-nvEOtV1Y5K9E1Lj+bPnQ6k1AneDM9OT3RbV3Urm/1Qs="; }; - cargoHash = "sha256-fAre0jrpJ63adcg4AKCYzdQtCsd0MMMcWA0RsoHo6ig="; + cargoHash = "sha256-uWYNFNoCiqw6gYuHZWmZmZVs7lKNvhzjwEyxgcbvv+8="; - nativeBuildInputs = [ installShellFiles ]; - - preBuild = '' - export HOME=$(mktemp -d) - ''; - - checkFlags = lib.optionals stdenv.hostPlatform.isDarwin [ - # Attempted to create a NULL object. - "--skip=base::tests::test_complete_cmdbar" - "--skip=base::tests::test_complete_msgbar" - - # Attempted to create a NULL object. - "--skip=windows::room::scrollback::tests::test_cursorpos" - "--skip=windows::room::scrollback::tests::test_dirscroll" - "--skip=windows::room::scrollback::tests::test_movement" - "--skip=windows::room::scrollback::tests::test_search_messages" + nativeBuildInputs = [ + installShellFiles ]; postInstall = '' @@ -57,8 +43,8 @@ rustPlatform.buildRustPackage rec { description = "Matrix client for Vim addicts"; mainProgram = "iamb"; homepage = "https://github.com/ulyssa/iamb"; - changelog = "https://github.com/ulyssa/iamb/releases/tag/${src.tag}"; + changelog = "https://github.com/ulyssa/iamb/releases/tag/${finalAttrs.src.tag}"; license = lib.licenses.asl20; maintainers = with lib.maintainers; [ meain ]; }; -} +}) From 4a71042b62488993c149226ae50e0e2325998365 Mon Sep 17 00:00:00 2001 From: kuflierl <41301536+kuflierl@users.noreply.github.com> Date: Thu, 27 Nov 2025 10:40:51 +0100 Subject: [PATCH 64/83] cup-docker: 3.4.3 -> 3.5.1, enable finalAttr overrides Changelog: https://github.com/sergi0g/cup/releases --- pkgs/by-name/cu/cup-docker/package.nix | 32 +++++++++++--------------- 1 file changed, 13 insertions(+), 19 deletions(-) diff --git a/pkgs/by-name/cu/cup-docker/package.nix b/pkgs/by-name/cu/cup-docker/package.nix index 02645e5b6bd2..3722fe42553c 100644 --- a/pkgs/by-name/cu/cup-docker/package.nix +++ b/pkgs/by-name/cu/cup-docker/package.nix @@ -8,23 +8,25 @@ nix-update-script, withServer ? true, }: -let +rustPlatform.buildRustPackage (finalAttrs: { pname = "cup-docker"; - version = "3.4.3"; + version = "3.5.1"; + src = fetchFromGitHub { owner = "sergi0g"; repo = "cup"; - tag = "v${version}"; - hash = "sha256-RRhUSL9TR7qr93F5+fyhGW7j6VTs+yVvpni/JHmC5os="; + tag = "v${finalAttrs.version}"; + hash = "sha256-l7TQwCzQNwrsM+xRcRcQaxIsnd8SVzrqEMwIoZGVBR0="; }; - web = stdenvNoCC.mkDerivation (finalAttrs: { - pname = "${pname}-web"; - inherit version src; + + web = stdenvNoCC.mkDerivation (finalAttrsWeb: { + pname = "${finalAttrs.pname}-web"; + inherit (finalAttrs) version src; impureEnvVars = lib.fetchers.proxyImpureEnvVars ++ [ "GIT_PROXY_COMMAND" "SOCKS_SERVER" ]; - sourceRoot = "${finalAttrs.src.name}/web"; + sourceRoot = "${finalAttrsWeb.src.name}/web"; nativeBuildInputs = [ bun nodejs-slim_latest @@ -47,17 +49,10 @@ let cp -R ./dist $out runHook postInstall ''; - outputHash = "sha256-Ac1PJYmTQv9XrmhmF1p77vdXh8252hz0CUKxJA+VQR4="; + outputHash = "sha256-uLsWppRabaI7JSHYf3YsEvf0Y36kU/iuNXnDXd+6AXY="; outputHashAlgo = "sha256"; outputHashMode = "recursive"; }); -in -rustPlatform.buildRustPackage { - inherit - src - version - pname - ; cargoHash = "sha256-1VSbv6lDRRLZIu7hYrAqzQmvxcuhnPU0rcWfg7Upcm4="; @@ -70,11 +65,10 @@ rustPlatform.buildRustPackage { ]; preConfigure = lib.optionalString withServer '' - cp -r ${web}/dist src/static + cp -r ${finalAttrs.web}/dist src/static ''; passthru = { - inherit web; updateScript = nix-update-script { extraArgs = [ "--subpackage" @@ -94,4 +88,4 @@ rustPlatform.buildRustPackage { kuflierl ]; }; -} +}) From 2a1a868c03dd08cba50b69d0e07ab973b7c39fef Mon Sep 17 00:00:00 2001 From: Leona Maroni Date: Tue, 20 Jan 2026 10:28:25 +0100 Subject: [PATCH 65/83] nixos/release-combined: remove gitlab.runner test as release blocker We never agreed on adding the new GitLab runner test as release blocker and I don't want this relatively new test already blocking. Currently, it fails because of timeouts [1] and I don't feel we have the knowledge and time in the team to fix it fast enough when it blocks a channel. [1]: https://hydra.nixos.org/build/319565492 --- nixos/release-combined.nix | 1 - 1 file changed, 1 deletion(-) diff --git a/nixos/release-combined.nix b/nixos/release-combined.nix index f2bad26fcde8..ec2772470689 100644 --- a/nixos/release-combined.nix +++ b/nixos/release-combined.nix @@ -99,7 +99,6 @@ rec { (onFullSupported "nixos.tests.firewall") (onFullSupported "nixos.tests.fontconfig-default-fonts") (onFullSupported "nixos.tests.gitlab.gitlab") - (onFullSupported "nixos.tests.gitlab.runner") (onFullSupported "nixos.tests.gnome") (onSystems [ "x86_64-linux" ] "nixos.tests.hibernate") (onFullSupported "nixos.tests.i3wm") From 49d093f79d35bfbb17804315fa5fbafc04b724d7 Mon Sep 17 00:00:00 2001 From: a-kenji Date: Tue, 20 Jan 2026 10:58:30 +0100 Subject: [PATCH 66/83] flake-edit: 0.3.1 -> 0.3.3 --- pkgs/by-name/fl/flake-edit/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/fl/flake-edit/package.nix b/pkgs/by-name/fl/flake-edit/package.nix index c1332555a5b1..d098dc36f6e3 100644 --- a/pkgs/by-name/fl/flake-edit/package.nix +++ b/pkgs/by-name/fl/flake-edit/package.nix @@ -10,16 +10,16 @@ rustPlatform.buildRustPackage rec { pname = "flake-edit"; - version = "0.3.1"; + version = "0.3.3"; src = fetchFromGitHub { owner = "a-kenji"; repo = "flake-edit"; rev = "v${version}"; - hash = "sha256-Ptg/Wt8H6vOvk/V6juDmFd6Vzu/F3LzxDIGObuwySLA="; + hash = "sha256-CDz7iDOPearlxsqLuAuG+cmKneFavxJmdCbnWwEIvcU="; }; - cargoHash = "sha256-5i3wll3CdrRbwN8zsD4MQg62hvsMPESMW4YrtjPeySw="; + cargoHash = "sha256-IvBrJBSAMLfqefyUnS3Ex+JvHJAWJtVtkBVp2kFvA4s="; nativeBuildInputs = [ installShellFiles From 86fdab3243c7a2e14f89f1cac06496a773149e80 Mon Sep 17 00:00:00 2001 From: Zachary Arnaise <121795280+zacharyarnaise@users.noreply.github.com> Date: Tue, 20 Jan 2026 11:02:32 +0100 Subject: [PATCH 67/83] base16-schemes: 0-unstable-2025-06-04 -> 0-unstable-2026-01-15 --- pkgs/by-name/ba/base16-schemes/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/ba/base16-schemes/package.nix b/pkgs/by-name/ba/base16-schemes/package.nix index 687a7a6e3066..40e41babd10c 100644 --- a/pkgs/by-name/ba/base16-schemes/package.nix +++ b/pkgs/by-name/ba/base16-schemes/package.nix @@ -5,13 +5,13 @@ }: stdenv.mkDerivation (finalAttrs: { pname = "base16-schemes"; - version = "0-unstable-2025-11-08"; + version = "0-unstable-2026-01-15"; src = fetchFromGitHub { owner = "tinted-theming"; repo = "schemes"; - rev = "4ac26dc99141c1b2a26eb7fefe46e22e07eec77c"; - hash = "sha256-pr+RtDs+3qo0v7ZXfcSdtP0PoDDPU9EHw2Oe5EUwWtQ="; + rev = "43dd14f6466a782bd57419fdfb5f398c74d6ac53"; + hash = "sha256-AWTIYZ1tZab0YwAQwgt5yO4ucqZoc4iXX002Byy7pRY="; }; installPhase = '' From 945c01f70d5897e73d4d68afbe54980a85ba7845 Mon Sep 17 00:00:00 2001 From: Wim de With Date: Tue, 20 Jan 2026 11:27:06 +0100 Subject: [PATCH 68/83] freerdp: 3.20.2 -> 3.21.0 --- pkgs/by-name/fr/freerdp/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/fr/freerdp/package.nix b/pkgs/by-name/fr/freerdp/package.nix index b9aff2fc0a35..fe99c6c507e1 100644 --- a/pkgs/by-name/fr/freerdp/package.nix +++ b/pkgs/by-name/fr/freerdp/package.nix @@ -70,13 +70,13 @@ stdenv.mkDerivation (finalAttrs: { pname = "freerdp"; - version = "3.20.2"; + version = "3.21.0"; src = fetchFromGitHub { owner = "FreeRDP"; repo = "FreeRDP"; rev = finalAttrs.version; - hash = "sha256-IcEWlNh0AI3Vkqf2FzQYOIq64J6iWJxWlUfYkcBpGUU="; + hash = "sha256-oIws2HO2usOCtVDe6OTIdIDHYgb9tBIEctvCW6/Woxc="; }; postPatch = '' From e3db3ea537b33b58b61b43ceaf10a1e024fbb2ff Mon Sep 17 00:00:00 2001 From: Fabian Affolter Date: Tue, 20 Jan 2026 11:59:52 +0100 Subject: [PATCH 69/83] python313Packages.pyexploitdb: 0.3.9 -> 0.3.10 Changelog: https://github.com/Hackman238/pyExploitDb/blob/master/ChangeLog.md --- pkgs/development/python-modules/pyexploitdb/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/python-modules/pyexploitdb/default.nix b/pkgs/development/python-modules/pyexploitdb/default.nix index da4c6f686c32..e640a29a0713 100644 --- a/pkgs/development/python-modules/pyexploitdb/default.nix +++ b/pkgs/development/python-modules/pyexploitdb/default.nix @@ -9,12 +9,12 @@ buildPythonPackage (finalAttrs: { pname = "pyexploitdb"; - version = "0.3.9"; + version = "0.3.10"; pyproject = true; src = fetchPypi { inherit (finalAttrs) pname version; - hash = "sha256-ef4+I0xjYLfe4QPgfZNWLQB+0WAA4WUEn1W6uTSGkjU="; + hash = "sha256-EZX2eCNc46UuqbBEypjp6NcHOAI6C7SiFu+AZPXcSg8="; }; build-system = [ setuptools ]; From f25e73804a4c17ed77e82b1a20bc433df5ab4e0f Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Tue, 20 Jan 2026 11:14:07 +0000 Subject: [PATCH 70/83] zizmor: 1.21.0 -> 1.22.0 --- pkgs/by-name/zi/zizmor/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/zi/zizmor/package.nix b/pkgs/by-name/zi/zizmor/package.nix index 2c81e143894c..e1cad4928953 100644 --- a/pkgs/by-name/zi/zizmor/package.nix +++ b/pkgs/by-name/zi/zizmor/package.nix @@ -11,16 +11,16 @@ rustPlatform.buildRustPackage (finalAttrs: { pname = "zizmor"; - version = "1.21.0"; + version = "1.22.0"; src = fetchFromGitHub { owner = "zizmorcore"; repo = "zizmor"; tag = "v${finalAttrs.version}"; - hash = "sha256-cIwQSQcG8h4YtBPfl+meSpTkyNEwLsg3eG2SZs4PMDA="; + hash = "sha256-HRwtjke7kDq+mrTLwyWU0aEGxdgdbimcg42J1baDXhs="; }; - cargoHash = "sha256-dKgURNjvxqN7xlvdQtsylxNwYenNUgqrsecGyTtGpNI="; + cargoHash = "sha256-UuSBd+RppydP0+cG1iNarikbhBtoZZbIUxiwgq3EZaU="; buildInputs = [ rust-jemalloc-sys From 92f55159e93f7478de33506a25d36d584ca05293 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Tue, 20 Jan 2026 11:22:44 +0000 Subject: [PATCH 71/83] webdav: 5.10.2 -> 5.10.3 --- pkgs/by-name/we/webdav/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/we/webdav/package.nix b/pkgs/by-name/we/webdav/package.nix index 8ba464c2c51e..3522a29185d9 100644 --- a/pkgs/by-name/we/webdav/package.nix +++ b/pkgs/by-name/we/webdav/package.nix @@ -6,16 +6,16 @@ buildGoModule rec { pname = "webdav"; - version = "5.10.2"; + version = "5.10.3"; src = fetchFromGitHub { owner = "hacdias"; repo = "webdav"; tag = "v${version}"; - hash = "sha256-Z+r119dYAJO6HRKgRYtwYII4wSdWgNedZOA6n8h4udM="; + hash = "sha256-HARY25aOiDKkx2kZA+tckOx+320+tWxamLzRbXQIIBE="; }; - vendorHash = "sha256-BR7b59FC/UhQdgO5HcxZK8vEe4WXFCHBiKoRqNr4zNY="; + vendorHash = "sha256-yshwX898P9ZXxKkHLguEPV2h9dibIVaFOYWpONHzzY4="; __darwinAllowLocalNetworking = true; From faf43eb541a27fbb7639e530996b520dc1ecd154 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Tue, 20 Jan 2026 12:09:27 +0000 Subject: [PATCH 72/83] vimPlugins.avante-nvim: 0.0.27-unstable-2026-01-09 -> 0.0.27-unstable-2026-01-20 --- .../vim/plugins/non-generated/avante-nvim/default.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/applications/editors/vim/plugins/non-generated/avante-nvim/default.nix b/pkgs/applications/editors/vim/plugins/non-generated/avante-nvim/default.nix index 0d728b27c171..3baa3386f3d5 100644 --- a/pkgs/applications/editors/vim/plugins/non-generated/avante-nvim/default.nix +++ b/pkgs/applications/editors/vim/plugins/non-generated/avante-nvim/default.nix @@ -12,12 +12,12 @@ pkgs, }: let - version = "0.0.27-unstable-2026-01-09"; + version = "0.0.27-unstable-2026-01-20"; src = fetchFromGitHub { owner = "yetone"; repo = "avante.nvim"; - rev = "e89eb79abf5754645e20aa6074da10ed20bba33c"; - hash = "sha256-jxbDBvaVtgC0L/MSyoZjGjBxvRUdNofRsiUHwntab7c="; + rev = "08b202a5c5dc93959bfe7dc276adfcba84ecc5be"; + hash = "sha256-YDlxwAOimaTFo7mTICQBdb7EQCp8vrBnwjWwxmBImis="; }; avante-nvim-lib = rustPlatform.buildRustPackage { pname = "avante-nvim-lib"; From 21c25b0162c39661fd39576e0d15f0efe7b38be0 Mon Sep 17 00:00:00 2001 From: Ryan Horiguchi Date: Thu, 27 Nov 2025 02:12:20 +0100 Subject: [PATCH 73/83] nixos/headscale: add option to retrieve generated config file --- nixos/modules/services/networking/headscale.nix | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/nixos/modules/services/networking/headscale.nix b/nixos/modules/services/networking/headscale.nix index 4291eae7f4f8..a19e1bd7588b 100644 --- a/nixos/modules/services/networking/headscale.nix +++ b/nixos/modules/services/networking/headscale.nix @@ -19,8 +19,6 @@ let }; settingsFormat = pkgs.formats.yaml { }; - configFile = settingsFormat.generate "headscale.yaml" cfg.settings; - cliConfigFile = settingsFormat.generate "headscale.yaml" cliConfig; assertRemovedOption = option: message: { assertion = !lib.hasAttrByPath option cfg; @@ -35,6 +33,16 @@ in package = lib.mkPackageOption pkgs "headscale" { }; + configFile = lib.mkOption { + type = lib.types.path; + readOnly = true; + default = settingsFormat.generate "headscale.yaml" cfg.settings; + defaultText = lib.literalExpression ''(pkgs.formats.yaml { }).generate "headscale.yaml" config.services.headscale.settings''; + description = '' + Path to the configuration file of headscale. + ''; + }; + user = lib.mkOption { default = "headscale"; type = lib.types.str; @@ -621,7 +629,7 @@ in environment = { # Headscale CLI needs a minimal config to be able to locate the unix socket # to talk to the server instance. - etc."headscale/config.yaml".source = cliConfigFile; + etc."headscale/config.yaml".source = settingsFormat.generate "headscale.yaml" cliConfig; systemPackages = [ cfg.package ]; }; @@ -646,7 +654,7 @@ in export HEADSCALE_DATABASE_POSTGRES_PASS="$(head -n1 ${lib.escapeShellArg cfg.settings.database.postgres.password_file})" ''} - exec ${lib.getExe cfg.package} serve --config ${configFile} + exec ${lib.getExe cfg.package} serve --config ${cfg.configFile} ''; serviceConfig = From f0c9abd01234eef5d29f541d8211910a263490b9 Mon Sep 17 00:00:00 2001 From: Philip Taron Date: Tue, 20 Jan 2026 05:59:04 -0800 Subject: [PATCH 74/83] tailscale: skip TestDNSTrampleRecovery This test was introduced in v1.94.0 (commit 1dfdee852) and uses Go's testing/synctest package. However, it calls gonotify.NewDirWatcher() inside the synctest bubble, which spawns goroutines that block on inotify syscalls. These syscalls are outside synctest's control, causing the test to hang for 600 seconds before timing out. --- pkgs/by-name/ta/tailscale/package.nix | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/pkgs/by-name/ta/tailscale/package.nix b/pkgs/by-name/ta/tailscale/package.nix index 31345c7f39cd..81f74dbe0a5b 100644 --- a/pkgs/by-name/ta/tailscale/package.nix +++ b/pkgs/by-name/ta/tailscale/package.nix @@ -155,6 +155,10 @@ buildGoModule (finalAttrs: { # Fails because we vendor dependencies "TestLicenseHeaders" + + # Uses testing/synctest with gonotify.DirWatcher which spawns goroutines + # that block on inotify syscalls incompatible with synctest's bubble mechanism + "TestDNSTrampleRecovery" ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ # syscall default route interface en0 differs from netstat From 3b3def57c0f47460be36eb6b4914aee00cc698a9 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Tue, 20 Jan 2026 14:00:23 +0000 Subject: [PATCH 75/83] _1password-gui-beta: 8.11.22-26.BETA -> 8.12.0-11.BETA --- pkgs/by-name/_1/_1password-gui/sources.json | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/pkgs/by-name/_1/_1password-gui/sources.json b/pkgs/by-name/_1/_1password-gui/sources.json index 4e787ac11fcb..5fd35c38ce07 100644 --- a/pkgs/by-name/_1/_1password-gui/sources.json +++ b/pkgs/by-name/_1/_1password-gui/sources.json @@ -29,15 +29,15 @@ }, "beta": { "linux": { - "version": "8.11.22-26.BETA", + "version": "8.12.0-11.BETA", "sources": { "x86_64": { - "url": "https://downloads.1password.com/linux/tar/beta/x86_64/1password-8.11.22-26.BETA.x64.tar.gz", - "hash": "sha256-lkQypBqr1VX/+8yz5PhUULKG9ZpuXjeS/ZNLL1Qzdcs=" + "url": "https://downloads.1password.com/linux/tar/beta/x86_64/1password-8.12.0-11.BETA.x64.tar.gz", + "hash": "sha256-0PDkZAqlY/afocvc/rcly/nwZeSSbXdRyXH57aVPUoQ=" }, "aarch64": { - "url": "https://downloads.1password.com/linux/tar/beta/aarch64/1password-8.11.22-26.BETA.arm64.tar.gz", - "hash": "sha256-1PrkmOWBenPvQIiHlq4RAKzItYLVj5DkGD38eGFDlHM=" + "url": "https://downloads.1password.com/linux/tar/beta/aarch64/1password-8.12.0-11.BETA.arm64.tar.gz", + "hash": "sha256-0YDJKexCdOeU0/KPsJzI5rBUlbDEFW5N33LFXtDo3tg=" } } }, From 9acc4363fb15a11ce659be8f8ded53386e8c2d65 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Tue, 20 Jan 2026 14:26:25 +0000 Subject: [PATCH 76/83] ledger-live-desktop: 2.135.2 -> 2.137.0 --- pkgs/by-name/le/ledger-live-desktop/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/le/ledger-live-desktop/package.nix b/pkgs/by-name/le/ledger-live-desktop/package.nix index 65fb8ddb85fb..26b1d665be6e 100644 --- a/pkgs/by-name/le/ledger-live-desktop/package.nix +++ b/pkgs/by-name/le/ledger-live-desktop/package.nix @@ -8,11 +8,11 @@ let pname = "ledger-live-desktop"; - version = "2.135.2"; + version = "2.137.0"; src = fetchurl { url = "https://download.live.ledger.com/${pname}-${version}-linux-x86_64.AppImage"; - hash = "sha256-K74ILzYKvNccnJyUBvWoA6xijkcXWGFLuCfdaQtmvR8="; + hash = "sha256-G9wuefSt4OEFIM8rHLSyBY8t+jxgKPt4T+KQF6Jh3Tk="; }; appimageContents = appimageTools.extractType2 { From 27ee049a158a2682ba5b57a433b3f2411de25664 Mon Sep 17 00:00:00 2001 From: Romain Paquet Date: Thu, 15 Jan 2026 22:04:53 +0100 Subject: [PATCH 77/83] ocamlPackages.dns-client-miou-unix: init at 10.2.3 --- .../ocaml-modules/dns/client-miou-unix.nix | 32 +++++++++++++++++++ pkgs/top-level/ocaml-packages.nix | 2 ++ 2 files changed, 34 insertions(+) create mode 100644 pkgs/development/ocaml-modules/dns/client-miou-unix.nix diff --git a/pkgs/development/ocaml-modules/dns/client-miou-unix.nix b/pkgs/development/ocaml-modules/dns/client-miou-unix.nix new file mode 100644 index 000000000000..a9aec24a6469 --- /dev/null +++ b/pkgs/development/ocaml-modules/dns/client-miou-unix.nix @@ -0,0 +1,32 @@ +{ + buildDunePackage, + dns, + dns-client, + domain-name, + ipaddr, + miou, + tls-miou-unix, + happy-eyeballs, + happy-eyeballs-miou-unix, +}: + +buildDunePackage { + pname = "dns-client-miou-unix"; + inherit (dns) src version; + + propagatedBuildInputs = [ + dns-client + domain-name + ipaddr + miou + tls-miou-unix + happy-eyeballs + happy-eyeballs-miou-unix + ]; + + doCheck = true; + + meta = dns-client.meta // { + description = "DNS client API for Miou"; + }; +} diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix index fae503738479..7d636a8f1652 100644 --- a/pkgs/top-level/ocaml-packages.nix +++ b/pkgs/top-level/ocaml-packages.nix @@ -413,6 +413,8 @@ let dns-client-lwt = callPackage ../development/ocaml-modules/dns/client-lwt.nix { }; + dns-client-miou-unix = callPackage ../development/ocaml-modules/dns/client-miou-unix.nix { }; + dns-client-mirage = callPackage ../development/ocaml-modules/dns/client-mirage.nix { }; dns-mirage = callPackage ../development/ocaml-modules/dns/mirage.nix { }; From bf413ce1c211b033cc29becdf2870576df3aa0ce Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Tue, 20 Jan 2026 15:05:49 +0000 Subject: [PATCH 78/83] cnquery: 12.18.0 -> 12.19.0 --- pkgs/by-name/cn/cnquery/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/cn/cnquery/package.nix b/pkgs/by-name/cn/cnquery/package.nix index 360a813e8edf..1ee5799587d4 100644 --- a/pkgs/by-name/cn/cnquery/package.nix +++ b/pkgs/by-name/cn/cnquery/package.nix @@ -6,18 +6,18 @@ buildGoModule rec { pname = "cnquery"; - version = "12.18.0"; + version = "12.19.0"; src = fetchFromGitHub { owner = "mondoohq"; repo = "cnquery"; tag = "v${version}"; - hash = "sha256-aDpWVujFSKTRDZW764LzNmqJkb61tfdLPN/JT81NrZs="; + hash = "sha256-lFnXkBPokDO/eduWhg/lSqqjRhC8/5tGqkS/RZHhZnU="; }; subPackages = [ "apps/cnquery" ]; - vendorHash = "sha256-OliliGBpFPPJnYZ3wQ2q7t+9bsiN5ik0FJrNGlVxivo="; + vendorHash = "sha256-WnUCDiDfIC2Cl1LEpkZlT5tGFMaWb5htX8VFmJBEjbI="; ldflags = [ "-w" From 742b1081c520c11c0bebfc8b1a50dd46130fffd8 Mon Sep 17 00:00:00 2001 From: Emily Date: Tue, 20 Jan 2026 16:19:15 +0000 Subject: [PATCH 79/83] Revert "ci/github-script/bot: skip mergeability checks temporarily" MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Apparently any effects from this change haven’t shown up noticeably in GitHub’s metrics, to the point where they’re not sure if it was taking effect on the backend. Our contact is going to look at getting something into the API response to help debug whether it’s actually working or not, but agreed that we should just revert for now. Since they have apparently reduced replica sync issues further through other changes on their end, there shouldn’t be any urgent need to make any changes here anyway. This reverts commit 18b30c8ce1eed9ff2e86128036b674e9e3796aaa. --- ci/github-script/bot.js | 12 ------------ 1 file changed, 12 deletions(-) diff --git a/ci/github-script/bot.js b/ci/github-script/bot.js index ffa71892c1e8..f178b6028783 100644 --- a/ci/github-script/bot.js +++ b/ci/github-script/bot.js @@ -145,22 +145,10 @@ module.exports = async ({ github, context, core, dry }) => { // This API request is important for the merge-conflict label, because it triggers the // creation of a new test merge commit. This is needed to actually determine the state of a PR. - // - // NOTE (2025-12-15): Temporarily skipping mergeability checks here - // on GitHub’s request to measure the impact of the resulting ref - // writes on their internal metrics; merge conflicts resulting from - // changes to target branches will not have labels applied for the - // duration. The label should still be updated on pushes. - // - // TODO: Restore mergeability checks in some form after a few days - // or when we hear back from GitHub. const pull_request = ( await github.rest.pulls.get({ ...context.repo, pull_number, - // Undocumented parameter (as of 2025-12-15), added by GitHub - // for us; stability unclear. - skip_mergeability_checks: true, }) ).data From 8ec0bb95056fa2b1333b14afcef62ea9b5570b52 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Tue, 20 Jan 2026 16:52:27 +0000 Subject: [PATCH 80/83] ollama-cpu: 0.14.1 -> 0.14.2 --- pkgs/by-name/ol/ollama/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/ol/ollama/package.nix b/pkgs/by-name/ol/ollama/package.nix index 862438477fd9..450f71bbcb80 100644 --- a/pkgs/by-name/ol/ollama/package.nix +++ b/pkgs/by-name/ol/ollama/package.nix @@ -138,13 +138,13 @@ in goBuild (finalAttrs: { pname = "ollama"; # don't forget to invalidate all hashes each update - version = "0.14.1"; + version = "0.14.2"; src = fetchFromGitHub { owner = "ollama"; repo = "ollama"; tag = "v${finalAttrs.version}"; - hash = "sha256-r9Qwa1bAzLlr50mB+RLkRfuCFe6FUXtR9irqvU7PAvA="; + hash = "sha256-NDtXMRpglUG0XhkTJrd90kv1utpxXGNppMHOG3Zmt54="; }; vendorHash = "sha256-WdHAjCD20eLj0d9v1K6VYP8vJ+IZ8BEZ3CciYLLMtxc="; From 2e44c179920a7a0b975c7d3933f71e2a56bf6c2a Mon Sep 17 00:00:00 2001 From: Jared Baur Date: Fri, 9 Jan 2026 10:21:35 -0800 Subject: [PATCH 81/83] nixos/yggdrasil: ensure freeformType attrs are resolved `lib.types.attrs` is too lenient, allowing for invalid yggdrasil configuration to make it's way into the final config. Since this configuration ends up in a JSON file, changing the `freeformType` to use the type definition from `pkgs.formats.json` allows for the configuration to resolve correctly. --- nixos/modules/services/networking/yggdrasil.nix | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/nixos/modules/services/networking/yggdrasil.nix b/nixos/modules/services/networking/yggdrasil.nix index 3f2f0277f59a..5d2dc2b8cd41 100644 --- a/nixos/modules/services/networking/yggdrasil.nix +++ b/nixos/modules/services/networking/yggdrasil.nix @@ -13,7 +13,6 @@ let bool listOf str - attrs submodule ; cfg = config.services.yggdrasil; @@ -69,7 +68,7 @@ in settings = mkOption { type = submodule { - freeformType = attrs; + freeformType = (pkgs.formats.json { }).type; options = { PrivateKeyPath = mkOption { type = nullOr path; From 3918e6059139ab2be564f7c45b29afaf20aa6868 Mon Sep 17 00:00:00 2001 From: Defelo Date: Tue, 20 Jan 2026 17:05:39 +0000 Subject: [PATCH 82/83] radicle-native-ci: 0.11.1 -> 0.12.0 Changelog: https://app.radicle.xyz/nodes/seed.radicle.xyz/rad:z3qg5TKmN83afz2fj9z3fQjU8vaYE/tree/NEWS.md --- pkgs/by-name/ra/radicle-native-ci/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/ra/radicle-native-ci/package.nix b/pkgs/by-name/ra/radicle-native-ci/package.nix index c17da970c09a..cde2a8d630ef 100644 --- a/pkgs/by-name/ra/radicle-native-ci/package.nix +++ b/pkgs/by-name/ra/radicle-native-ci/package.nix @@ -10,17 +10,17 @@ rustPlatform.buildRustPackage (finalAttrs: { pname = "radicle-native-ci"; - version = "0.11.1"; + version = "0.12.0"; src = fetchFromRadicle { seed = "seed.radicle.xyz"; repo = "z3qg5TKmN83afz2fj9z3fQjU8vaYE"; node = "z6MkgEMYod7Hxfy9qCvDv5hYHkZ4ciWmLFgfvm3Wn1b2w2FV"; tag = "v${finalAttrs.version}"; - hash = "sha256-OjQBq4QopT4dr1/z73fqlGLjQIjUY51/II9m2qQMW1w="; + hash = "sha256-Hi5QdYVFSvP8AEKcH7yIA7PpaTSe0hBcF3vgCNilCKg="; }; - cargoHash = "sha256-zyEdlAXaooEkxD4aZ1poIUX3OwXtP4nFAyOWJDdw1p8="; + cargoHash = "sha256-N1XyMarKCctor5r7AePMuV/BzWiQwXphJFqye0cqO3k="; preCheck = '' git config --global user.name nixbld From 7f16276e9efb94b68b81e254d59550832ce1c25a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= Date: Tue, 20 Jan 2026 09:36:58 -0800 Subject: [PATCH 83/83] python3Packages.volkswagencarnet: 5.4.0 -> 5.4.1 Diff: https://github.com/robinostlund/volkswagencarnet/compare/v5.4.0...v5.4.1 Changelog: https://github.com/robinostlund/volkswagencarnet/releases/tag/v5.4.1 --- pkgs/development/python-modules/volkswagencarnet/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/python-modules/volkswagencarnet/default.nix b/pkgs/development/python-modules/volkswagencarnet/default.nix index 2c4953333851..1f50f904b9ef 100644 --- a/pkgs/development/python-modules/volkswagencarnet/default.nix +++ b/pkgs/development/python-modules/volkswagencarnet/default.nix @@ -14,14 +14,14 @@ buildPythonPackage rec { pname = "volkswagencarnet"; - version = "5.4.0"; + version = "5.4.1"; pyproject = true; src = fetchFromGitHub { owner = "robinostlund"; repo = "volkswagencarnet"; tag = "v${version}"; - hash = "sha256-9p01sCxXosaCPTo/QN1LJ4E5SvicqAjqpx7Wl7OsRtE="; + hash = "sha256-e7h8Dp/C4Q/0Y6viTeCTlzekr1aI5B0gAX5MZBenMCY="; }; postPatch = ''