From bef8d20bb140f9bc213b3fe987f8fc89af7d1f85 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Fri, 6 Mar 2026 16:41:53 +0000 Subject: [PATCH 01/59] kubo: 0.39.0 -> 0.40.1 --- pkgs/by-name/ku/kubo/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/ku/kubo/package.nix b/pkgs/by-name/ku/kubo/package.nix index 6f3265922f2d..d5aa4dd71cce 100644 --- a/pkgs/by-name/ku/kubo/package.nix +++ b/pkgs/by-name/ku/kubo/package.nix @@ -10,7 +10,7 @@ buildGoModule rec { pname = "kubo"; - version = "0.39.0"; # When updating, also check if the repo version changed and adjust repoVersion below + version = "0.40.1"; # When updating, also check if the repo version changed and adjust repoVersion below rev = "v${version}"; passthru.repoVersion = "18"; @@ -18,7 +18,7 @@ buildGoModule rec { # Kubo makes changes to its source tarball that don't match the git source. src = fetchurl { url = "https://github.com/ipfs/kubo/releases/download/${rev}/kubo-source.tar.gz"; - hash = "sha256-qGqJ2Gb0BYcY7yxunAFDguc8IgzDIP9680+tKrKFvsY="; + hash = "sha256-O6mSFDKj1DdTMGhg5Q6L0hiLW9CUyUq9uyFz9Xjmm4s="; }; # tarball contains multiple files/directories From fe0dfd7ab4d711a4c9390d9164c9b60bcb22f909 Mon Sep 17 00:00:00 2001 From: Michaili K Date: Mon, 16 Mar 2026 11:44:02 +0100 Subject: [PATCH 02/59] libtas: fix gcc15 build --- pkgs/by-name/li/libtas/package.nix | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/pkgs/by-name/li/libtas/package.nix b/pkgs/by-name/li/libtas/package.nix index f200e7a760e8..73b0593ae33b 100644 --- a/pkgs/by-name/li/libtas/package.nix +++ b/pkgs/by-name/li/libtas/package.nix @@ -3,6 +3,7 @@ stdenv, fetchFromGitHub, fetchurl, + fetchpatch2, autoreconfHook, pkg-config, SDL2, @@ -36,6 +37,11 @@ stdenv.mkDerivation (finalAttrs: { url = "https://github.com/clementgallet/libTAS/commit/779ff0fb0f3accfc62949680d85ecf96b28d18ef.patch"; hash = "sha256-xAaTWIXt8FkMu6GE5mBWtLypROFZ1aEqmBTtG+6rTWk="; }) + # Fix build with gcc15 + (fetchpatch2 { + url = "https://github.com/clementgallet/libTAS/commit/9699b158c522cf778bcdf626d0520fdd0a8b83aa.patch?full_index=1"; + hash = "sha256-vM1f6rvKIFyzEGJ7k+b/Zp4gAv8u6mdDUD5evV+hCJU="; + }) ]; nativeBuildInputs = [ From 7d6656fa54be82404c60af1b16cb1112b1d9f740 Mon Sep 17 00:00:00 2001 From: Xiangyan Sun Date: Wed, 18 Mar 2026 00:50:57 -0700 Subject: [PATCH 03/59] ardopc: fix build with gcc 15 --- pkgs/by-name/ar/ardopc/package.nix | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/pkgs/by-name/ar/ardopc/package.nix b/pkgs/by-name/ar/ardopc/package.nix index eb7ce91710ea..04e0d26530cf 100644 --- a/pkgs/by-name/ar/ardopc/package.nix +++ b/pkgs/by-name/ar/ardopc/package.nix @@ -22,6 +22,20 @@ stdenv.mkDerivation (finalAttrs: { sourceRoot = "${finalAttrs.src.name}/ARDOPC"; + postPatch = '' + substituteInPlace pktSession.c \ + --replace-fail 'VOID L2SENDCOMMAND();' 'VOID L2SENDCOMMAND(struct _LINKTABLE * LINK, int CMD);' \ + --replace-fail 'VOID CONNECTFAILED();' 'VOID CONNECTFAILED(struct _LINKTABLE * LINK);' + substituteInPlace ARDOPC.h \ + --replace-fail 'BOOL CheckForPktData();' 'BOOL CheckForPktData(int Channel);' + substituteInPlace ALSASound.c \ + --replace-fail 'void InitSound(BOOL Quiet)' 'void InitSound()' + substituteInPlace ARQ.c \ + --replace-fail 'SendData(FALSE);' 'SendData();' + substituteInPlace Modulate.c \ + --replace-fail 'SoundFlush(Number);' 'SoundFlush();' + ''; + nativeBuildInputs = [ makeWrapper pkg-config From 388d2251ee5b76cc488aafd630287b665f3abe9d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Na=C3=AFm=20Camille=20Favier?= Date: Mon, 23 Mar 2026 12:27:15 +0100 Subject: [PATCH 04/59] agda: skip eval errors in allPackages This fixes `agda.tests.allPackages`, which currently fails when aliases are enabled because `agdaPackages.generic` throws an evaluation error. --- pkgs/build-support/agda/lib.nix | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/pkgs/build-support/agda/lib.nix b/pkgs/build-support/agda/lib.nix index c11c17e668a9..f685b1e1bd39 100644 --- a/pkgs/build-support/agda/lib.nix +++ b/pkgs/build-support/agda/lib.nix @@ -21,5 +21,10 @@ Takes an arbitrary derivation and says whether it is an agda library package * that is not marked as broken. */ - isUnbrokenAgdaPackage = pkg: pkg.isAgdaDerivation or false && !pkg.meta.broken; + isUnbrokenAgdaPackage = + pkg: + let + r = builtins.tryEval (pkg.isAgdaDerivation or false && !pkg.meta.broken); + in + r.success && r.value; } From 8657ea0e7794535067593909aaed5fd2db7de72c Mon Sep 17 00:00:00 2001 From: Ivy Fan-Chiang Date: Mon, 23 Mar 2026 14:39:42 -0400 Subject: [PATCH 05/59] halloy: 2026.4 -> 2026.5 --- pkgs/by-name/ha/halloy/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/ha/halloy/package.nix b/pkgs/by-name/ha/halloy/package.nix index cbabbe87099a..55305f07c8e3 100644 --- a/pkgs/by-name/ha/halloy/package.nix +++ b/pkgs/by-name/ha/halloy/package.nix @@ -21,16 +21,16 @@ rustPlatform.buildRustPackage (finalAttrs: { pname = "halloy"; - version = "2026.4"; + version = "2026.5"; src = fetchFromGitHub { owner = "squidowl"; repo = "halloy"; tag = finalAttrs.version; - hash = "sha256-gWN+KcAoMTRySZObRleDCNfUukprGkNGFELD7xT/x/Q="; + hash = "sha256-K+kNn7GPNZWXkXS+hfOjdmaWEjina6Vy4FfAJGZ5cPE="; }; - cargoHash = "sha256-g9Q2YCjgC5MBX/Tv/dvRuHIxo7qq5J7hjsw3YeTn0jI="; + cargoHash = "sha256-ij08oI0IIihVoHY4RS1FGpkvsWLcjCv2fp8voAae+DI="; nativeBuildInputs = [ copyDesktopItems From 57c9bf43e2db14cba4927a5af5daf328347dec22 Mon Sep 17 00:00:00 2001 From: Guy Chronister Date: Sun, 22 Mar 2026 17:39:32 -0500 Subject: [PATCH 06/59] grub2,grub2_{efi,ieee1275,light,pvgrub_image,xen,xen_pvh}: migrate to by-name --- .../gr/grub2}/add-hidden-menu-entries.patch | 0 .../gr/grub2}/fix-bash-completion.patch | 0 .../gr/grub2/package.nix} | 0 pkgs/by-name/gr/grub2_efi/package.nix | 7 +++++ pkgs/by-name/gr/grub2_ieee1275/package.nix | 7 +++++ pkgs/by-name/gr/grub2_light/package.nix | 7 +++++ .../by-name/gr/grub2_pvgrub_image/package.nix | 7 +++++ pkgs/by-name/gr/grub2_xen/package.nix | 7 +++++ pkgs/by-name/gr/grub2_xen_pvh/package.nix | 7 +++++ pkgs/top-level/all-packages.nix | 26 ------------------- 10 files changed, 42 insertions(+), 26 deletions(-) rename pkgs/{tools/misc/grub => by-name/gr/grub2}/add-hidden-menu-entries.patch (100%) rename pkgs/{tools/misc/grub => by-name/gr/grub2}/fix-bash-completion.patch (100%) rename pkgs/{tools/misc/grub/default.nix => by-name/gr/grub2/package.nix} (100%) create mode 100644 pkgs/by-name/gr/grub2_efi/package.nix create mode 100644 pkgs/by-name/gr/grub2_ieee1275/package.nix create mode 100644 pkgs/by-name/gr/grub2_light/package.nix create mode 100644 pkgs/by-name/gr/grub2_pvgrub_image/package.nix create mode 100644 pkgs/by-name/gr/grub2_xen/package.nix create mode 100644 pkgs/by-name/gr/grub2_xen_pvh/package.nix diff --git a/pkgs/tools/misc/grub/add-hidden-menu-entries.patch b/pkgs/by-name/gr/grub2/add-hidden-menu-entries.patch similarity index 100% rename from pkgs/tools/misc/grub/add-hidden-menu-entries.patch rename to pkgs/by-name/gr/grub2/add-hidden-menu-entries.patch diff --git a/pkgs/tools/misc/grub/fix-bash-completion.patch b/pkgs/by-name/gr/grub2/fix-bash-completion.patch similarity index 100% rename from pkgs/tools/misc/grub/fix-bash-completion.patch rename to pkgs/by-name/gr/grub2/fix-bash-completion.patch diff --git a/pkgs/tools/misc/grub/default.nix b/pkgs/by-name/gr/grub2/package.nix similarity index 100% rename from pkgs/tools/misc/grub/default.nix rename to pkgs/by-name/gr/grub2/package.nix diff --git a/pkgs/by-name/gr/grub2_efi/package.nix b/pkgs/by-name/gr/grub2_efi/package.nix new file mode 100644 index 000000000000..20c46f1dda7c --- /dev/null +++ b/pkgs/by-name/gr/grub2_efi/package.nix @@ -0,0 +1,7 @@ +{ + grub2, +}: + +grub2.override { + efiSupport = true; +} diff --git a/pkgs/by-name/gr/grub2_ieee1275/package.nix b/pkgs/by-name/gr/grub2_ieee1275/package.nix new file mode 100644 index 000000000000..d23c9a3c27fa --- /dev/null +++ b/pkgs/by-name/gr/grub2_ieee1275/package.nix @@ -0,0 +1,7 @@ +{ + grub2, +}: + +grub2.override { + ieee1275Support = true; +} diff --git a/pkgs/by-name/gr/grub2_light/package.nix b/pkgs/by-name/gr/grub2_light/package.nix new file mode 100644 index 000000000000..b397c8f7ad72 --- /dev/null +++ b/pkgs/by-name/gr/grub2_light/package.nix @@ -0,0 +1,7 @@ +{ + grub2, +}: + +grub2.override { + zfsSupport = false; +} diff --git a/pkgs/by-name/gr/grub2_pvgrub_image/package.nix b/pkgs/by-name/gr/grub2_pvgrub_image/package.nix new file mode 100644 index 000000000000..032dfb81f0d7 --- /dev/null +++ b/pkgs/by-name/gr/grub2_pvgrub_image/package.nix @@ -0,0 +1,7 @@ +{ + grub2_pvhgrub_image, +}: + +grub2_pvhgrub_image.override { + grubPlatform = "xen"; +} diff --git a/pkgs/by-name/gr/grub2_xen/package.nix b/pkgs/by-name/gr/grub2_xen/package.nix new file mode 100644 index 000000000000..6f369bbcf131 --- /dev/null +++ b/pkgs/by-name/gr/grub2_xen/package.nix @@ -0,0 +1,7 @@ +{ + grub2, +}: + +grub2.override { + xenSupport = true; +} diff --git a/pkgs/by-name/gr/grub2_xen_pvh/package.nix b/pkgs/by-name/gr/grub2_xen_pvh/package.nix new file mode 100644 index 000000000000..8f8744c975fc --- /dev/null +++ b/pkgs/by-name/gr/grub2_xen_pvh/package.nix @@ -0,0 +1,7 @@ +{ + grub2, +}: + +grub2.override { + xenPvhSupport = true; +} diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index 9732092816f4..82b3e214bb62 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -2518,32 +2518,6 @@ with pkgs; withXorg = false; }; - grub2 = callPackage ../tools/misc/grub/default.nix { }; - - grub2_efi = grub2.override { - efiSupport = true; - }; - - grub2_ieee1275 = grub2.override { - ieee1275Support = true; - }; - - grub2_light = grub2.override { - zfsSupport = false; - }; - - grub2_xen = grub2.override { - xenSupport = true; - }; - - grub2_xen_pvh = grub2.override { - xenPvhSupport = true; - }; - - grub2_pvgrub_image = grub2_pvhgrub_image.override { - grubPlatform = "xen"; - }; - gruut = with python3.pkgs; toPythonApplication gruut; gruut-ipa = with python3.pkgs; toPythonApplication gruut-ipa; From 3ddc937bee84b47489978fc275d9b642c37ea8b3 Mon Sep 17 00:00:00 2001 From: Sizhe Zhao Date: Tue, 24 Mar 2026 12:03:12 +0800 Subject: [PATCH 07/59] nixos/firewalld: convert bool settings to yes/no --- .../services/networking/firewalld/settings.nix | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) diff --git a/nixos/modules/services/networking/firewalld/settings.nix b/nixos/modules/services/networking/firewalld/settings.nix index d47e56aac17d..4bfe864d25d3 100644 --- a/nixos/modules/services/networking/firewalld/settings.nix +++ b/nixos/modules/services/networking/firewalld/settings.nix @@ -1,20 +1,20 @@ { config, lib, - pkgs, ... }: let cfg = config.services.firewalld; - format = pkgs.formats.keyValue { }; inherit (lib) mkOption; inherit (lib.types) + attrsOf bool commas either enum nonEmptyStr + oneOf separatedString submodule ; @@ -27,7 +27,10 @@ in ''; default = { }; type = submodule { - freeformType = format.type; + freeformType = attrsOf (oneOf [ + bool + nonEmptyStr + ]); options = { DefaultZone = mkOption { type = nonEmptyStr; @@ -191,8 +194,8 @@ in } ]; - environment.etc."firewalld/firewalld.conf" = { - source = format.generate "firewalld.conf" cfg.settings; - }; + environment.etc."firewalld/firewalld.conf".text = lib.concatMapAttrsStringSep "\n" ( + k: v: "${k}=${if lib.isBool v then lib.boolToYesNo v else v}" + ) cfg.settings; }; } From 197b67a40d810e97f930e4dd87f7ad7ec2c640e4 Mon Sep 17 00:00:00 2001 From: Sizhe Zhao Date: Tue, 24 Mar 2026 14:36:14 +0800 Subject: [PATCH 08/59] code-cursor: 2.6.20 -> 2.6.21 --- pkgs/by-name/co/code-cursor/sources.json | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/pkgs/by-name/co/code-cursor/sources.json b/pkgs/by-name/co/code-cursor/sources.json index 260331c49cdf..1806a93f935f 100644 --- a/pkgs/by-name/co/code-cursor/sources.json +++ b/pkgs/by-name/co/code-cursor/sources.json @@ -1,22 +1,22 @@ { - "version": "2.6.20", + "version": "2.6.21", "vscodeVersion": "1.105.1", "sources": { "x86_64-linux": { - "url": "https://downloads.cursor.com/production/b29eb4ee5f9f6d1cb2afbc09070198d3ea6ad76f/linux/x64/Cursor-2.6.20-x86_64.AppImage", - "hash": "sha256-fEvDNnFdJ2WhFam6tw1rnDbNQEZmxsoraIuvrHuKy+w=" + "url": "https://downloads.cursor.com/production/fea2f546c979a0a4ad1deab23552a43568807592/linux/x64/Cursor-2.6.21-x86_64.AppImage", + "hash": "sha256-ZohAVWsde5fOac0JL9kc8ql/ZGohbc7S0yStARXQVSU=" }, "aarch64-linux": { - "url": "https://downloads.cursor.com/production/b29eb4ee5f9f6d1cb2afbc09070198d3ea6ad76f/linux/arm64/Cursor-2.6.20-aarch64.AppImage", - "hash": "sha256-SEiPNP1wZrLN+fW6q3ldniZYA7ndFf4p7OarPOvCxig=" + "url": "https://downloads.cursor.com/production/fea2f546c979a0a4ad1deab23552a43568807592/linux/arm64/Cursor-2.6.21-aarch64.AppImage", + "hash": "sha256-U1iWEcCeXwGQjX5Wc8mp1jfFp1eUDfida+n6Ahmay7s=" }, "x86_64-darwin": { - "url": "https://downloads.cursor.com/production/b29eb4ee5f9f6d1cb2afbc09070198d3ea6ad76f/darwin/x64/Cursor-darwin-x64.dmg", - "hash": "sha256-PWgoiEFLXJr3AIcPN485BUUuGeCxXr0yk3ROmOILOh4=" + "url": "https://downloads.cursor.com/production/fea2f546c979a0a4ad1deab23552a43568807592/darwin/x64/Cursor-darwin-x64.dmg", + "hash": "sha256-KhR7DnQMMbpbr8wPHMr75HDyoCOHRxsr/goeN3tAoTs=" }, "aarch64-darwin": { - "url": "https://downloads.cursor.com/production/b29eb4ee5f9f6d1cb2afbc09070198d3ea6ad76f/darwin/arm64/Cursor-darwin-arm64.dmg", - "hash": "sha256-WxJUezRquZglmjRzjFkBcqLeByAwGTuYSJFWCccuKXc=" + "url": "https://downloads.cursor.com/production/fea2f546c979a0a4ad1deab23552a43568807592/darwin/arm64/Cursor-darwin-arm64.dmg", + "hash": "sha256-1zPqim1x1x01p5FM8PmAtordVUKdtqEhqkqoAswF1OE=" } } } From 5bf2efb29d22a9c5bac5f48e12e15aff7d6957e1 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Tue, 24 Mar 2026 15:33:07 +0000 Subject: [PATCH 09/59] mirrord: 3.193.0 -> 3.194.0 --- pkgs/by-name/mi/mirrord/manifest.json | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/pkgs/by-name/mi/mirrord/manifest.json b/pkgs/by-name/mi/mirrord/manifest.json index a2134b3c53e6..a0a02995a897 100644 --- a/pkgs/by-name/mi/mirrord/manifest.json +++ b/pkgs/by-name/mi/mirrord/manifest.json @@ -1,21 +1,21 @@ { - "version": "3.193.0", + "version": "3.194.0", "assets": { "x86_64-linux": { - "url": "https://github.com/metalbear-co/mirrord/releases/download/3.193.0/mirrord_linux_x86_64", - "hash": "sha256-IeOilRMOzEYXEF0qbAwTSr4Y6zIz8dIzCiTzE4VadxI=" + "url": "https://github.com/metalbear-co/mirrord/releases/download/3.194.0/mirrord_linux_x86_64", + "hash": "sha256-6coP0EiDrTv0HNk+55C37d+eKhsOm25rQy42mRkoTy0=" }, "aarch64-linux": { - "url": "https://github.com/metalbear-co/mirrord/releases/download/3.193.0/mirrord_linux_aarch64", - "hash": "sha256-LOLf1q7vA/SZvOIxj0mAYZrPwccuU90Shghkk94xxPo=" + "url": "https://github.com/metalbear-co/mirrord/releases/download/3.194.0/mirrord_linux_aarch64", + "hash": "sha256-k8/kkhYYk+eHdekIwi2wFmn6mX7WiKuKtaOC3soBT6U=" }, "aarch64-darwin": { - "url": "https://github.com/metalbear-co/mirrord/releases/download/3.193.0/mirrord_mac_universal", - "hash": "sha256-oa5dJxSfZKaKub8WxuOZ8Nut1cIcvl3E/zT6xNQJy00=" + "url": "https://github.com/metalbear-co/mirrord/releases/download/3.194.0/mirrord_mac_universal", + "hash": "sha256-VwcqBf3Jq9H3wgNz5o/7oJ5Pz0nXBRkzDA7D51hIWe0=" }, "x86_64-darwin": { - "url": "https://github.com/metalbear-co/mirrord/releases/download/3.193.0/mirrord_mac_universal", - "hash": "sha256-oa5dJxSfZKaKub8WxuOZ8Nut1cIcvl3E/zT6xNQJy00=" + "url": "https://github.com/metalbear-co/mirrord/releases/download/3.194.0/mirrord_mac_universal", + "hash": "sha256-VwcqBf3Jq9H3wgNz5o/7oJ5Pz0nXBRkzDA7D51hIWe0=" } } } From 574cfbace7b37b2863b6f3488dc801aeed41043b Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Tue, 24 Mar 2026 16:23:22 +0000 Subject: [PATCH 10/59] vscode-extensions.nomicfoundation.hardhat-solidity: 0.8.28 -> 0.8.29 --- .../extensions/nomicfoundation.hardhat-solidity/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/applications/editors/vscode/extensions/nomicfoundation.hardhat-solidity/default.nix b/pkgs/applications/editors/vscode/extensions/nomicfoundation.hardhat-solidity/default.nix index f0b48aae3b8c..74e364bface9 100644 --- a/pkgs/applications/editors/vscode/extensions/nomicfoundation.hardhat-solidity/default.nix +++ b/pkgs/applications/editors/vscode/extensions/nomicfoundation.hardhat-solidity/default.nix @@ -4,8 +4,8 @@ vscode-utils.buildVscodeMarketplaceExtension { mktplcRef = { name = "hardhat-solidity"; publisher = "nomicfoundation"; - version = "0.8.28"; - hash = "sha256-IKJ0d/Da0haRmtR5r/bKvDNkDV58cDdARuPGoJ2mUqI="; + version = "0.8.29"; + hash = "sha256-0WC4MBCjY2TyZmeBtiCsKD95dudtCfo2HzvMWorWbOY="; }; meta = { From bbbf5bd268d017d8fd961df945381d4579f12b33 Mon Sep 17 00:00:00 2001 From: Philip Kannegaard Hayes Date: Wed, 25 Jun 2025 13:35:56 -0700 Subject: [PATCH 11/59] sgx-psw: 2.25 -> 2.27; nixos/aesmd: update --- nixos/modules/services/security/aesmd.nix | 38 +++++--- .../sgx/psw/cppmicroservices-compat.patch | 87 +++++++++++++++++++ pkgs/os-specific/linux/sgx/psw/default.nix | 21 +++-- .../linux/sgx/psw/disable-downloads.patch | 13 +-- pkgs/top-level/all-packages.nix | 2 +- 5 files changed, 132 insertions(+), 29 deletions(-) create mode 100644 pkgs/os-specific/linux/sgx/psw/cppmicroservices-compat.patch diff --git a/nixos/modules/services/security/aesmd.nix b/nixos/modules/services/security/aesmd.nix index 7a05fde7d3cb..d5ec33c0af6a 100644 --- a/nixos/modules/services/security/aesmd.nix +++ b/nixos/modules/services/security/aesmd.nix @@ -167,15 +167,25 @@ in ]; serviceConfig = { - ExecStartPre = pkgs.writeShellScript "copy-aesmd-data-files.sh" '' - set -euo pipefail - whiteListFile="${aesmDataFolder}/white_list_cert_to_be_verify.bin" - if [[ ! -f "$whiteListFile" ]]; then - ${pkgs.coreutils}/bin/install -m 644 -D \ - "${storeAesmFolder}/data/white_list_cert_to_be_verify.bin" \ - "$whiteListFile" - fi - ''; + ExecStartPre = + let + script = pkgs.writeShellScript "copy-aesmd-data-files.sh" '' + set -euo pipefail + + # For some reason systemd 257+ won't properly bind mount the + # StateDirectory with the aesmd DynamicUser owning it + chown -R aesmd:aesmd /var/opt/aesmd + + whiteListFile="${aesmDataFolder}/white_list_cert_to_be_verify.bin" + if [[ ! -f "$whiteListFile" ]]; then + install -m 644 -o aesmd -g aesmd -D \ + "${storeAesmFolder}/data/white_list_cert_to_be_verify.bin" \ + "$whiteListFile" + fi + ''; + # Run setup with elevated privileges + in + "+${script}"; ExecStart = "${sgx-psw}/bin/aesm_service --no-daemon"; ExecReload = ''${pkgs.coreutils}/bin/kill -SIGHUP "$MAINPID"''; @@ -196,10 +206,14 @@ in RuntimeDirectory = "aesmd"; RuntimeDirectoryMode = "0750"; - # Hardening + # --- Hardening --- + + # NOTE(phlip9): Starting with systemd-v257, enabling both + # `RootDirectory` (chroot) and `DynamicUser` prevents the service + # from locating the `aesmd` user: + # `XXX-copy-aesmd-data-files.sh: chown: invalid user: ‘aesmd:aesmd’` + # RootDirectory = "%t/aesmd"; - # chroot into the runtime directory - RootDirectory = "%t/aesmd"; BindReadOnlyPaths = [ builtins.storeDir # Hardcoded path AESM_CONFIG_FILE in psw/ae/aesm_service/source/utils/aesm_config.cpp diff --git a/pkgs/os-specific/linux/sgx/psw/cppmicroservices-compat.patch b/pkgs/os-specific/linux/sgx/psw/cppmicroservices-compat.patch new file mode 100644 index 000000000000..c0044c3292d6 --- /dev/null +++ b/pkgs/os-specific/linux/sgx/psw/cppmicroservices-compat.patch @@ -0,0 +1,87 @@ +diff --git a/external/CppMicroServices/CMakeLists.txt b/external/CppMicroServices/CMakeLists.txt +index 8d0aff3..44d45d9 100644 +--- a/external/CppMicroServices/CMakeLists.txt ++++ b/external/CppMicroServices/CMakeLists.txt +@@ -1,7 +1,7 @@ + # Extract the current version from the VERSION file + file(STRINGS VERSION _version LIMIT_COUNT 1) + +-set(US_CMAKE_MINIMUM_REQUIRED_VERSION 3.2) ++set(US_CMAKE_MINIMUM_REQUIRED_VERSION 3.10) + + cmake_minimum_required(VERSION ${US_CMAKE_MINIMUM_REQUIRED_VERSION}) + +diff --git a/external/CppMicroServices/framework/include/cppmicroservices/AnyMap.h b/external/CppMicroServices/framework/include/cppmicroservices/AnyMap.h +index 3f240f4..e8acef9 100644 +--- a/external/CppMicroServices/framework/include/cppmicroservices/AnyMap.h ++++ b/external/CppMicroServices/framework/include/cppmicroservices/AnyMap.h +@@ -25,6 +25,7 @@ + + #include "cppmicroservices/Any.h" + ++#include + #include + #include + +diff --git a/external/CppMicroServices/framework/include/cppmicroservices/BundleEvent.h b/external/CppMicroServices/framework/include/cppmicroservices/BundleEvent.h +index 9b36a9b..12894fa 100644 +--- a/external/CppMicroServices/framework/include/cppmicroservices/BundleEvent.h ++++ b/external/CppMicroServices/framework/include/cppmicroservices/BundleEvent.h +@@ -25,6 +25,7 @@ + + #include "cppmicroservices/FrameworkExport.h" + ++#include + #include + #include + +diff --git a/external/CppMicroServices/framework/include/cppmicroservices/Constants.h b/external/CppMicroServices/framework/include/cppmicroservices/Constants.h +index 590a890..cf60926 100644 +--- a/external/CppMicroServices/framework/include/cppmicroservices/Constants.h ++++ b/external/CppMicroServices/framework/include/cppmicroservices/Constants.h +@@ -25,6 +25,7 @@ + + #include "cppmicroservices/FrameworkConfig.h" + ++#include + #include + + namespace cppmicroservices { +diff --git a/external/CppMicroServices/framework/include/cppmicroservices/FrameworkEvent.h b/external/CppMicroServices/framework/include/cppmicroservices/FrameworkEvent.h +index 71caf1b..a29e87c 100644 +--- a/external/CppMicroServices/framework/include/cppmicroservices/FrameworkEvent.h ++++ b/external/CppMicroServices/framework/include/cppmicroservices/FrameworkEvent.h +@@ -25,6 +25,7 @@ + + #include "cppmicroservices/FrameworkExport.h" + ++#include + #include + #include + +diff --git a/external/CppMicroServices/framework/include/cppmicroservices/ServiceEvent.h b/external/CppMicroServices/framework/include/cppmicroservices/ServiceEvent.h +index 451cb82..da7c5f0 100644 +--- a/external/CppMicroServices/framework/include/cppmicroservices/ServiceEvent.h ++++ b/external/CppMicroServices/framework/include/cppmicroservices/ServiceEvent.h +@@ -25,6 +25,8 @@ + + #include "cppmicroservices/ServiceReference.h" + ++#include ++ + US_MSVC_PUSH_DISABLE_WARNING( + 4251) // 'identifier' : class 'type' needs to have dll-interface to be used by clients of class 'type2' + +diff --git a/psw/ae/aesm_service/source/CMakeLists.txt b/psw/ae/aesm_service/source/CMakeLists.txt +index 5728e9b..0169263 100644 +--- a/psw/ae/aesm_service/source/CMakeLists.txt ++++ b/psw/ae/aesm_service/source/CMakeLists.txt +@@ -30,7 +30,7 @@ + # + + # [proj-begin] +-cmake_minimum_required(VERSION 3.0.0) ++cmake_minimum_required(VERSION 3.10.0) + project(ModularAESM VERSION 0.1.0) + + diff --git a/pkgs/os-specific/linux/sgx/psw/default.nix b/pkgs/os-specific/linux/sgx/psw/default.nix index 2b3e97604f97..534a9e98f13d 100644 --- a/pkgs/os-specific/linux/sgx/psw/default.nix +++ b/pkgs/os-specific/linux/sgx/psw/default.nix @@ -20,15 +20,15 @@ stdenv.mkDerivation rec { pname = "sgx-psw"; # Version as given in se_version.h - version = "2.25.100.3"; + version = "2.27.100.1"; # Version as used in the Git tag - versionTag = "2.25"; + versionTag = "2.27"; src = fetchFromGitHub { owner = "intel"; repo = "linux-sgx"; rev = "sgx_${versionTag}"; - hash = "sha256-RR+vFTd9ZM6XUn3KgQeUM+xoj1Ava4zQzFYA/nfXyaw="; + hash = "sha256-hNmh4IgNJDNqt2xF8zBnD/x+saMyMk5hZLA3aOqzqEA="; fetchSubmodules = true; }; @@ -52,11 +52,11 @@ stdenv.mkDerivation rec { # Fetch the Data Center Attestation Primitives (DCAP) platform enclaves # and pre-built sgxssl. dcap = rec { - version = "1.22"; + version = "1.24"; filename = "prebuilt_dcap_${version}.tar.gz"; prebuilt = fetchurl { url = "https://download.01.org/intel-sgx/sgx-dcap/${version}/linux/${filename}"; - hash = "sha256-RTpJQ6epoAN8YQXSJUjJQ5mPaQIiQpStTWFsnspjjDQ="; + hash = "sha256-sc/eYIPdhwAyDk2Zh1HU6yuFlobqVy/4++m5OnQE3Bc="; }; }; in @@ -72,8 +72,8 @@ stdenv.mkDerivation rec { grep -q 'ae_file_name=${dcap.filename}' "$src/external/dcap_source/QuoteGeneration/download_prebuilt.sh" \ || (echo "Could not find expected prebuilt DCAP ${dcap.filename} in linux-sgx source" >&2 && exit 1) - tar -xzvf ${dcap.prebuilt} -C $sourceRoot/external/dcap_source ./prebuilt/ - tar -xzvf ${dcap.prebuilt} -C $sourceRoot/external/dcap_source/QuoteGeneration ./psw/ + tar -xzvf ${dcap.prebuilt} -C $sourceRoot/external/dcap_source prebuilt/ + tar -xzvf ${dcap.prebuilt} -C $sourceRoot/external/dcap_source/QuoteGeneration psw/ ''; patches = [ @@ -90,6 +90,13 @@ stdenv.mkDerivation rec { # binary. Without changes, the `aesm_service` will be different after every # build because the embedded zip file contents have different modified times. ./cppmicroservices-no-mtime.patch + + # CppMicroServices is failing to build with CMake 4 and GCC 15 + # PR: + # - CMake 4 dropped support for <3.5 and warns on <3.10, so bump the + # `cmake_minimum_required` to 3.10 + # - Various header files now need `#include ` to compile + ./cppmicroservices-compat.patch ]; postPatch = diff --git a/pkgs/os-specific/linux/sgx/psw/disable-downloads.patch b/pkgs/os-specific/linux/sgx/psw/disable-downloads.patch index fff31cb67ebe..cce1522b8af6 100644 --- a/pkgs/os-specific/linux/sgx/psw/disable-downloads.patch +++ b/pkgs/os-specific/linux/sgx/psw/disable-downloads.patch @@ -1,32 +1,27 @@ diff --git a/Makefile b/Makefile -index 19bc05a..6b1acd4 100644 +index 144f4e4..834c23e 100644 --- a/Makefile +++ b/Makefile -@@ -50,13 +50,13 @@ tips: +@@ -50,22 +50,17 @@ tips: preparation: # As SDK build needs to clone and patch openmp, we cannot support the mode that download the source from github as zip. # Only enable the download from git - git submodule update --init --recursive -+ # git submodule update --init --recursive cd external/dcap_source/external/jwt-cpp && git apply ../0001-Add-a-macro-to-disable-time-support-in-jwt-for-SGX.patch >/dev/null 2>&1 || \ git apply ../0001-Add-a-macro-to-disable-time-support-in-jwt-for-SGX.patch -R --check - ./external/dcap_source/QuoteVerification/prepare_sgxssl.sh nobuild -+ # ./external/dcap_source/QuoteVerification/prepare_sgxssl.sh nobuild cd external/openmp/openmp_code && git apply ../0001-Enable-OpenMP-in-SGX.patch >/dev/null 2>&1 || git apply ../0001-Enable-OpenMP-in-SGX.patch --check -R cd external/protobuf/protobuf_code && git apply ../sgx_protobuf.patch >/dev/null 2>&1 || git apply ../sgx_protobuf.patch --check -R + cd external/protobuf/protobuf_code && git apply ../0001-bumped-protobuf-to-1.33.0.patch >/dev/null 2>&1 || git apply ../0001-bumped-protobuf-to-1.33.0.patch --check -R - cd external/protobuf/protobuf_code && git submodule update --init --recursive && cd third_party/abseil-cpp && git apply ../../../sgx_abseil.patch>/dev/null 2>&1 || git apply ../../../sgx_abseil.patch --check -R -+ cd external/protobuf/protobuf_code && cd third_party/abseil-cpp && git apply ../../../sgx_abseil.patch>/dev/null 2>&1 || git apply ../../../sgx_abseil.patch --check -R ./external/sgx-emm/create_symlink.sh - cd external/mbedtls/mbedtls_code && git apply ../sgx_mbedtls.patch >/dev/null 2>&1 || git apply ../sgx_mbedtls.patch --check -R cd external/cbor && cp -r libcbor sgx_libcbor -@@ -64,8 +64,8 @@ preparation: + cd external/cbor/libcbor && git apply ../raw_cbor.patch >/dev/null 2>&1 || git apply ../raw_cbor.patch --check -R cd external/cbor/sgx_libcbor && git apply ../sgx_cbor.patch >/dev/null 2>&1 || git apply ../sgx_cbor.patch --check -R cd external/ippcp_internal/ipp-crypto && git apply ../0001-IPP-crypto-for-SGX.patch > /dev/null 2>&1 || git apply ../0001-IPP-crypto-for-SGX.patch --check -R cd external/ippcp_internal/ipp-crypto && mkdir -p build - ./download_prebuilt.sh - ./external/dcap_source/QuoteGeneration/download_prebuilt.sh -+ # ./download_prebuilt.sh -+ # ./external/dcap_source/QuoteGeneration/download_prebuilt.sh psw: $(MAKE) -C psw/ USE_OPT_LIBS=$(USE_OPT_LIBS) diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index 75de0d300208..22cdce6ac9f5 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -8799,7 +8799,7 @@ with pkgs; }; sgx-psw = callPackage ../os-specific/linux/sgx/psw { - protobuf = protobuf_21; + protobuf = protobuf_33; }; sinit = callPackage ../os-specific/linux/sinit { From 6e4fc8483ea7710891e36f4f13212bf9e707f511 Mon Sep 17 00:00:00 2001 From: Philip Kannegaard Hayes Date: Wed, 11 Feb 2026 15:39:31 +0900 Subject: [PATCH 12/59] sgx-azure-dcap-client: 1.12.3 -> 1.13.0-pre0 --- .../missing-includes.patch | 24 ++++++++++++ .../sg/sgx-azure-dcap-client/package.nix | 16 +++----- .../sg/sgx-azure-dcap-client/test-suite.nix | 4 ++ .../tests-cpp-version.patch | 39 +++++++++++++++++++ 4 files changed, 72 insertions(+), 11 deletions(-) create mode 100644 pkgs/by-name/sg/sgx-azure-dcap-client/missing-includes.patch create mode 100644 pkgs/by-name/sg/sgx-azure-dcap-client/tests-cpp-version.patch diff --git a/pkgs/by-name/sg/sgx-azure-dcap-client/missing-includes.patch b/pkgs/by-name/sg/sgx-azure-dcap-client/missing-includes.patch new file mode 100644 index 000000000000..c2f30e33236b --- /dev/null +++ b/pkgs/by-name/sg/sgx-azure-dcap-client/missing-includes.patch @@ -0,0 +1,24 @@ +diff --git a/src/Linux/curl_easy.h b/src/Linux/curl_easy.h +index 047f3e2..c9c5e83 100644 +--- a/src/Linux/curl_easy.h ++++ b/src/Linux/curl_easy.h +@@ -6,6 +6,7 @@ + #define CURL_EASY_H + + #define _CRT_SECURE_NO_WARNINGS // Use strncpy for portability. ++#include + #include + #include + #include +diff --git a/src/local_cache.h b/src/local_cache.h +index da86967..d9b0d3f 100644 +--- a/src/local_cache.h ++++ b/src/local_cache.h +@@ -5,6 +5,7 @@ + #ifndef LOCAL_CACHE_H + #define LOCAL_CACHE_H + ++#include + #include + #include + #include diff --git a/pkgs/by-name/sg/sgx-azure-dcap-client/package.nix b/pkgs/by-name/sg/sgx-azure-dcap-client/package.nix index 3be23a08d598..f43d216c0bad 100644 --- a/pkgs/by-name/sg/sgx-azure-dcap-client/package.nix +++ b/pkgs/by-name/sg/sgx-azure-dcap-client/package.nix @@ -1,7 +1,6 @@ { stdenv, fetchFromGitHub, - fetchpatch, lib, curl, nlohmann_json, @@ -36,23 +35,18 @@ let in stdenv.mkDerivation (finalAttrs: { pname = "azure-dcap-client"; - version = "1.12.3"; + version = "1.13.0-pre0"; src = fetchFromGitHub { owner = "microsoft"; repo = "azure-dcap-client"; - rev = finalAttrs.version; - hash = "sha256-zTDaICsSPXctgFRCZBiZwXV9dLk2pFL9kp5a8FkiTZA="; + rev = "839ac4a2acc11b90cb91a483fcfc0cf7ae6a75c7"; + hash = "sha256-dVO5cSOcpkOuxql06exS4aLJgvtRg+Oi6k8HBIjwPlg="; }; patches = [ - # Fix gcc-13 build: - # https://github.com/microsoft/Azure-DCAP-Client/pull/197 - (fetchpatch { - name = "gcc-13.patch"; - url = "https://github.com/microsoft/Azure-DCAP-Client/commit/fbcae7b3c8f1155998248cf5b5f4c1df979483f5.patch"; - hash = "sha256-ezEuQql3stn58N1ZPKMlhPpUOBkDpCcENpGwFAmWtHc="; - }) + # missing `#include ` + ./missing-includes.patch ]; nativeBuildInputs = [ diff --git a/pkgs/by-name/sg/sgx-azure-dcap-client/test-suite.nix b/pkgs/by-name/sg/sgx-azure-dcap-client/test-suite.nix index 5363efd55835..1ce647f72a6e 100644 --- a/pkgs/by-name/sg/sgx-azure-dcap-client/test-suite.nix +++ b/pkgs/by-name/sg/sgx-azure-dcap-client/test-suite.nix @@ -11,7 +11,11 @@ sgx-azure-dcap-client.overrideAttrs (old: { ]; patches = (old.patches or [ ]) ++ [ + # Missing `#include ` ./tests-missing-includes.patch + + # gtest no longer supports c++14. Use c++17. + ./tests-cpp-version.patch ]; buildFlags = [ diff --git a/pkgs/by-name/sg/sgx-azure-dcap-client/tests-cpp-version.patch b/pkgs/by-name/sg/sgx-azure-dcap-client/tests-cpp-version.patch new file mode 100644 index 000000000000..0fd03ba0ce95 --- /dev/null +++ b/pkgs/by-name/sg/sgx-azure-dcap-client/tests-cpp-version.patch @@ -0,0 +1,39 @@ +diff --git a/src/Linux/CMakeLists.txt b/src/Linux/CMakeLists.txt +index 8567253..0137a7a 100644 +--- a/src/Linux/CMakeLists.txt ++++ b/src/Linux/CMakeLists.txt +@@ -13,8 +13,8 @@ endif(__SERVICE_VM__) + + find_package(OpenSSL REQUIRED) + +-set(CMAKE_CXX_STANDARD 14) +-set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -std=c++14") ++set(CMAKE_CXX_STANDARD 17) ++set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -std=c++17") + + # Link runTests with what we want to test and the GTest and pthread library + add_executable(dcap_provider_utests ../UnitTest/test_local_cache.cpp ../UnitTest/test_quote_prov.cpp ../UnitTest/main.cpp ../Linux/local_cache.cpp) +diff --git a/src/Linux/Makefile.in b/src/Linux/Makefile.in +index 58a1c77..1ce6431 100644 +--- a/src/Linux/Makefile.in ++++ b/src/Linux/Makefile.in +@@ -8,15 +8,15 @@ DEBUG ?= 0 + SERVICE_VM ?= 0 + ifeq ($(DEBUG), 1) + ifeq ($(SERVICE_VM), 1) +- CFLAGS = -fPIC -std=c++14 -g -Wall -I /usr/local/include/gtest/ -Werror $(INCLUDES) -D__LINUX__ -D__SERVICE_VM__ -Wno-unknown-pragmas -pthread ++ CFLAGS = -fPIC -std=c++17 -g -Wall -I /usr/local/include/gtest/ -Werror $(INCLUDES) -D__LINUX__ -D__SERVICE_VM__ -Wno-unknown-pragmas -pthread + else +- CFLAGS = -fPIC -std=c++14 -g -Wall -I /usr/local/include/gtest/ -Werror $(INCLUDES) -D__LINUX__ -Wno-unknown-pragmas -pthread ++ CFLAGS = -fPIC -std=c++17 -g -Wall -I /usr/local/include/gtest/ -Werror $(INCLUDES) -D__LINUX__ -Wno-unknown-pragmas -pthread + endif + else + ifeq ($(SERVICE_VM), 1) +- CFLAGS = -fPIC -std=c++14 -Wall -I /usr/local/include/gtest/ -Werror $(INCLUDES) -D__LINUX__ -D__SERVICE_VM__ -Wno-unknown-pragmas -pthread ++ CFLAGS = -fPIC -std=c++17 -Wall -I /usr/local/include/gtest/ -Werror $(INCLUDES) -D__LINUX__ -D__SERVICE_VM__ -Wno-unknown-pragmas -pthread + else +- CFLAGS = -fPIC -std=c++14 -Wall -I /usr/local/include/gtest/ -Werror $(INCLUDES) -D__LINUX__ -Wno-unknown-pragmas -pthread ++ CFLAGS = -fPIC -std=c++17 -Wall -I /usr/local/include/gtest/ -Werror $(INCLUDES) -D__LINUX__ -Wno-unknown-pragmas -pthread + endif + endif + From c7beca362be42d9265ee82c6ae3b1c1b51dfdf13 Mon Sep 17 00:00:00 2001 From: Philip Kannegaard Hayes Date: Wed, 11 Feb 2026 18:12:05 +0900 Subject: [PATCH 13/59] sgx-sdk: drop This package has been broken and unmaintained since 2024-11, when it broke sometime around the nixos-24.11 release --- pkgs/by-name/sg/sgx-ssl/package.nix | 95 ------ pkgs/by-name/sg/sgx-ssl/tests.nix | 96 ------ .../os-specific/linux/sgx/samples/default.nix | 146 --------- .../sgx/sdk/cppmicroservices-no-mtime.patch | 26 -- pkgs/os-specific/linux/sgx/sdk/default.nix | 304 ------------------ .../linux/sgx/sdk/disable-downloads.patch | 28 -- pkgs/os-specific/linux/sgx/sdk/ipp-crypto.nix | 40 --- pkgs/top-level/aliases.nix | 2 + pkgs/top-level/all-packages.nix | 4 - 9 files changed, 2 insertions(+), 739 deletions(-) delete mode 100644 pkgs/by-name/sg/sgx-ssl/package.nix delete mode 100644 pkgs/by-name/sg/sgx-ssl/tests.nix delete mode 100644 pkgs/os-specific/linux/sgx/samples/default.nix delete mode 100644 pkgs/os-specific/linux/sgx/sdk/cppmicroservices-no-mtime.patch delete mode 100644 pkgs/os-specific/linux/sgx/sdk/default.nix delete mode 100644 pkgs/os-specific/linux/sgx/sdk/disable-downloads.patch delete mode 100644 pkgs/os-specific/linux/sgx/sdk/ipp-crypto.nix diff --git a/pkgs/by-name/sg/sgx-ssl/package.nix b/pkgs/by-name/sg/sgx-ssl/package.nix deleted file mode 100644 index cac1c5e28a75..000000000000 --- a/pkgs/by-name/sg/sgx-ssl/package.nix +++ /dev/null @@ -1,95 +0,0 @@ -{ - stdenv, - callPackage, - fetchFromGitHub, - fetchurl, - lib, - perl, - sgx-sdk, - which, - debug ? false, -}: -let - sgxVersion = sgx-sdk.versionTag; - opensslVersion = "3.0.13"; -in -stdenv.mkDerivation { - pname = "sgx-ssl" + lib.optionalString debug "-debug"; - version = "${sgxVersion}_${opensslVersion}"; - - src = fetchFromGitHub { - owner = "intel"; - repo = "intel-sgx-ssl"; - rev = "3.0_Rev2"; - hash = "sha256-dmLyaG6v+skjSa0KxLAfIfSBOxp9grrI7ds6WdGPe0I="; - }; - - postUnpack = - let - opensslSourceArchive = fetchurl { - url = "https://www.openssl.org/source/openssl-${opensslVersion}.tar.gz"; - hash = "sha256-iFJXU/edO+wn0vp8ZqoLkrOqlJja/ZPXz6SzeAza4xM="; - }; - in - '' - ln -s ${opensslSourceArchive} $sourceRoot/openssl_source/openssl-${opensslVersion}.tar.gz - ''; - - postPatch = '' - patchShebangs Linux/build_openssl.sh - - # Skip the tests. Build and run separately (see below). - substituteInPlace Linux/sgx/Makefile \ - --replace-fail '$(MAKE) -C $(TEST_DIR) all' \ - 'bash -c "true"' - ''; - - nativeBuildInputs = [ - perl - sgx-sdk - which - ]; - - makeFlags = [ - "-C Linux" - ] - ++ lib.optionals debug [ - "DEBUG=1" - ]; - - installFlags = [ - "DESTDIR=$(out)" - ]; - - # These tests build on any x86_64-linux but BOTH SIM and HW will only _run_ on - # real Intel hardware. Split these out so OfBorg doesn't choke on this pkg. - # - # ``` - # nix run .#sgx-ssl.tests.HW - # nix run .#sgx-ssl.tests.SIM - # ``` - passthru.tests = { - HW = callPackage ./tests.nix { - sgxMode = "HW"; - inherit opensslVersion; - }; - SIM = callPackage ./tests.nix { - sgxMode = "SIM"; - inherit opensslVersion; - }; - }; - - meta = { - description = "Cryptographic library for Intel SGX enclave applications based on OpenSSL"; - homepage = "https://github.com/intel/intel-sgx-ssl"; - maintainers = with lib.maintainers; [ - phlip9 - veehaitch - ]; - platforms = [ "x86_64-linux" ]; - license = with lib.licenses; [ - bsd3 - openssl - ]; - }; -} diff --git a/pkgs/by-name/sg/sgx-ssl/tests.nix b/pkgs/by-name/sg/sgx-ssl/tests.nix deleted file mode 100644 index 3b360f696525..000000000000 --- a/pkgs/by-name/sg/sgx-ssl/tests.nix +++ /dev/null @@ -1,96 +0,0 @@ -# This package _builds_ (but doesn't run!) the sgx-ssl test enclave + harness. -# The whole package effectively does: -# -# ``` -# SGX_MODE=${sgxMode} make -C Linux/sgx/test_app -# cp Linux/sgx/{TestApp,TestEnclave.signed.so} $out/bin -# ``` -# -# OfBorg fails to run these tests since they require real Intel HW. That -# includes the simulation mode! The tests appears to do something fancy with -# cpuid and exception trap handlers that make them very non-portable. -# -# These tests are split out from the parent pkg since recompiling the parent -# takes like 30 min : ) - -{ - lib, - openssl, - sgx-psw, - sgx-sdk, - sgx-ssl, - stdenv, - which, - opensslVersion ? throw "required parameter", - sgxMode ? throw "required parameter", # "SIM" or "HW" -}: -stdenv.mkDerivation { - inherit (sgx-ssl) postPatch src version; - pname = sgx-ssl.pname + "-tests-${sgxMode}"; - - postUnpack = sgx-ssl.postUnpack + '' - sourceRootAbs=$(readlink -e $sourceRoot) - packageDir=$sourceRootAbs/Linux/package - - # Do the inverse of 'make install' and symlink built artifacts back into - # '$src/Linux/package/' to avoid work. - mkdir $packageDir/lib $packageDir/lib64 - ln -s ${lib.getLib sgx-ssl}/lib/* $packageDir/lib/ - ln -s ${lib.getLib sgx-ssl}/lib64/* $packageDir/lib64/ - ln -sf ${lib.getDev sgx-ssl}/include/* $packageDir/include/ - - # test_app needs some internal openssl headers. - # See: tail end of 'Linux/build_openssl.sh' - tar -C $sourceRootAbs/openssl_source -xf $sourceRootAbs/openssl_source/openssl-${opensslVersion}.tar.gz - echo '#define OPENSSL_VERSION_STR "${opensslVersion}"' > $sourceRootAbs/Linux/sgx/osslverstr.h - ln -s $sourceRootAbs/openssl_source/openssl-${opensslVersion}/include/crypto $sourceRootAbs/Linux/sgx/test_app/enclave/ - ln -s $sourceRootAbs/openssl_source/openssl-${opensslVersion}/include/internal $sourceRootAbs/Linux/sgx/test_app/enclave/ - ''; - - nativeBuildInputs = [ - openssl.bin - sgx-sdk - which - ]; - - preBuild = '' - # Need to regerate the edl header - make -C Linux/sgx/libsgx_tsgxssl sgx_tsgxssl_t.c - ''; - - makeFlags = [ - "-C Linux/sgx/test_app" - "SGX_MODE=${sgxMode}" - ]; - - installPhase = '' - runHook preInstall - - # Enclaves can't be stripped after signing. - install -Dm 755 Linux/sgx/test_app/TestEnclave.signed.so -t $TMPDIR/enclaves - - install -Dm 755 Linux/sgx/test_app/TestApp -t $out/bin - - runHook postInstall - ''; - - postFixup = '' - # Move the enclaves where they actually belong. - mv $TMPDIR/enclaves/*.signed.so* $out/bin/ - - # HW SGX must runs against sgx-psw, not sgx-sdk. - if [[ "${sgxMode}" == "HW" ]]; then - patchelf \ - --set-rpath "$( \ - patchelf --print-rpath $out/bin/TestApp \ - | sed 's|${lib.getLib sgx-sdk}|${lib.getLib sgx-psw}|' \ - )" \ - $out/bin/TestApp - fi - ''; - - meta = { - platforms = [ "x86_64-linux" ]; - mainProgram = "TestApp"; - }; -} diff --git a/pkgs/os-specific/linux/sgx/samples/default.nix b/pkgs/os-specific/linux/sgx/samples/default.nix deleted file mode 100644 index 7b31a96240cd..000000000000 --- a/pkgs/os-specific/linux/sgx/samples/default.nix +++ /dev/null @@ -1,146 +0,0 @@ -{ - stdenv, - lib, - makeWrapper, - openssl, - sgx-sdk, - sgx-psw, - which, - # "SIM" or "HW" - sgxMode, -}: -let - isSimulation = sgxMode == "SIM"; - buildSample = - name: - stdenv.mkDerivation { - pname = name; - version = sgxMode; - - src = sgx-sdk.out; - sourceRoot = "${sgx-sdk.name}/share/SampleCode/${name}"; - - nativeBuildInputs = [ - makeWrapper - openssl - which - ]; - - buildInputs = [ - sgx-sdk - ]; - - # The samples don't have proper support for parallel building - # causing them to fail randomly. - enableParallelBuilding = false; - - buildFlags = [ - "SGX_MODE=${sgxMode}" - ]; - - installPhase = '' - runHook preInstall - - mkdir -p $out/{bin,lib} - install -m 755 app $out/bin - install *.so $out/lib - - wrapProgram "$out/bin/app" \ - --chdir "$out/lib" \ - ${lib.optionalString (!isSimulation) - ''--prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ sgx-psw ]}"'' - } - - runHook postInstall - ''; - - # Breaks the signature of the enclaves - dontFixup = true; - - # We don't have access to real SGX hardware during the build - doInstallCheck = isSimulation; - installCheckPhase = '' - runHook preInstallCheck - - pushd / - echo a | $out/bin/app - popd - - runHook preInstallCheck - ''; - }; -in -{ - cxx11SGXDemo = buildSample "Cxx11SGXDemo"; - cxx14SGXDemo = buildSample "Cxx14SGXDemo"; - cxx17SGXDemo = buildSample "Cxx17SGXDemo"; - localAttestation = (buildSample "LocalAttestation").overrideAttrs (old: { - installPhase = '' - runHook preInstall - - mkdir -p $out/{bin,lib} - install -m 755 bin/app* $out/bin - install bin/*.so $out/lib - - for bin in $out/bin/*; do - wrapProgram $bin \ - --chdir "$out/lib" \ - ${lib.optionalString (!isSimulation) - ''--prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ sgx-psw ]}"'' - } - done - - runHook postInstall - ''; - }); - powerTransition = buildSample "PowerTransition"; - protobufSGXDemo = buildSample "ProtobufSGXDemo"; - remoteAttestation = (buildSample "RemoteAttestation").overrideAttrs (old: { - # Makefile sets rpath to point to $TMPDIR - preFixup = '' - patchelf --remove-rpath $out/bin/app - ''; - - postInstall = '' - install sample_libcrypto/*.so $out/lib - ''; - }); - sampleEnclave = buildSample "SampleEnclave"; - sampleEnclaveGMIPP = buildSample "SampleEnclaveGMIPP"; - sampleMbedCrypto = buildSample "SampleMbedCrypto"; - sealUnseal = (buildSample "SealUnseal").overrideAttrs (old: { - prePatch = '' - substituteInPlace App/App.cpp \ - --replace '"sealed_data_blob.txt"' '"/tmp/sealed_data_blob.txt"' - ''; - }); - switchless = buildSample "Switchless"; - # # Requires SGX-patched openssl (sgxssl) build - # sampleAttestedTLS = buildSample "SampleAttestedTLS"; -} -// lib.optionalAttrs (!isSimulation) { - # # Requires kernel >= v6.2 && HW SGX - # sampleAEXNotify = buildSample "SampleAEXNotify"; - - # Requires HW SGX - sampleCommonLoader = (buildSample "SampleCommonLoader").overrideAttrs (old: { - nativeBuildInputs = [ sgx-psw ] ++ old.nativeBuildInputs; - - installPhase = '' - runHook preInstall - - mkdir -p $out/{bin,lib} - mv sample app - install -m 755 app $out/bin - - wrapProgram "$out/bin/app" \ - --chdir "$out/lib" \ - --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ sgx-psw ]}" - - runHook postInstall - ''; - }); - - # # SEGFAULTs in simulation mode? - # sampleEnclavePCL = buildSample "SampleEnclavePCL"; -} diff --git a/pkgs/os-specific/linux/sgx/sdk/cppmicroservices-no-mtime.patch b/pkgs/os-specific/linux/sgx/sdk/cppmicroservices-no-mtime.patch deleted file mode 100644 index 019f58927152..000000000000 --- a/pkgs/os-specific/linux/sgx/sdk/cppmicroservices-no-mtime.patch +++ /dev/null @@ -1,26 +0,0 @@ -diff --git a/external/CppMicroServices/framework/src/bundle/BundleResourceContainer.cpp b/external/CppMicroServices/framework/src/bundle/BundleResourceContainer.cpp -index aee499e9..13fa89d4 100644 ---- a/external/CppMicroServices/framework/src/bundle/BundleResourceContainer.cpp -+++ b/external/CppMicroServices/framework/src/bundle/BundleResourceContainer.cpp -@@ -105,7 +105,7 @@ bool BundleResourceContainer::GetStat(int index, - const_cast(&m_ZipArchive), index) - ? true - : false; -- stat.modifiedTime = zipStat.m_time; -+ stat.modifiedTime = 0; - stat.crc32 = zipStat.m_crc32; - // This will limit the size info from uint64 to uint32 on 32-bit - // architectures. We don't care because we assume resources > 2GB -diff --git a/external/CppMicroServices/third_party/miniz.c b/external/CppMicroServices/third_party/miniz.c -index 6b0ebd7a..fa2aebca 100644 ---- a/external/CppMicroServices/third_party/miniz.c -+++ b/external/CppMicroServices/third_party/miniz.c -@@ -170,7 +170,7 @@ - // If MINIZ_NO_TIME is specified then the ZIP archive functions will not be able to get the current time, or - // get/set file times, and the C run-time funcs that get/set times won't be called. - // The current downside is the times written to your archives will be from 1979. --//#define MINIZ_NO_TIME -+#define MINIZ_NO_TIME - - // Define MINIZ_NO_ARCHIVE_APIS to disable all ZIP archive API's. - //#define MINIZ_NO_ARCHIVE_APIS diff --git a/pkgs/os-specific/linux/sgx/sdk/default.nix b/pkgs/os-specific/linux/sgx/sdk/default.nix deleted file mode 100644 index b9cf66d2e283..000000000000 --- a/pkgs/os-specific/linux/sgx/sdk/default.nix +++ /dev/null @@ -1,304 +0,0 @@ -{ - lib, - stdenv, - fetchFromGitHub, - autoconf, - automake, - binutils, - callPackage, - cmake, - file, - gdb, - git, - libtool, - linkFarmFromDrvs, - ocamlPackages, - openssl, - perl, - python3, - texinfo, - validatePkgConfig, - writeShellApplication, - writeShellScript, - writeText, - debug ? false, -}: -stdenv.mkDerivation (finalAttrs: { - pname = "sgx-sdk"; - # Version as given in se_version.h - version = "2.24.100.3"; - # Version as used in the Git tag - versionTag = "2.24"; - - src = fetchFromGitHub { - owner = "intel"; - repo = "linux-sgx"; - rev = "sgx_${finalAttrs.versionTag}"; - hash = "sha256-1urEdfMKNUqqyJ3wQ10+tvtlRuAKELpaCWIOzjCbYKw="; - fetchSubmodules = true; - }; - - postUnpack = '' - # Make sure this is the right version of linux-sgx - grep -q '"${finalAttrs.version}"' "$src/common/inc/internal/se_version.h" \ - || (echo "Could not find expected version ${finalAttrs.version} in linux-sgx source" >&2 && exit 1) - ''; - - patches = [ - # There's a `make preparation` step that downloads some prebuilt binaries - # and applies some patches to the in-repo git submodules. This patch removes - # the parts that download things, since we can't do that inside the sandbox. - ./disable-downloads.patch - - # This patch disable mtime in bundled zip file for reproducible builds. - # - # Context: The `aesm_service` binary depends on a vendored library called - # `CppMicroServices`. At build time, this lib creates and then bundles - # service resources into a zip file and then embeds this zip into the - # binary. Without changes, the `aesm_service` will be different after every - # build because the embedded zip file contents have different modified times. - ./cppmicroservices-no-mtime.patch - ]; - - postPatch = '' - patchShebangs linux/installer/bin/build-installpkg.sh \ - linux/installer/common/sdk/createTarball.sh \ - linux/installer/common/sdk/install.sh \ - external/sgx-emm/create_symlink.sh - - make preparation - ''; - - # We need `cmake` as a build input but don't use it to kick off the build phase - dontUseCmakeConfigure = true; - - # SDK built with stackprotector produces broken enclaves which crash at runtime. - # Disable all to be safe, SDK build configures compiler mitigations manually. - hardeningDisable = [ "all" ]; - - nativeBuildInputs = [ - autoconf - automake - cmake - file - git - ocamlPackages.ocaml - ocamlPackages.ocamlbuild - perl - python3 - texinfo - validatePkgConfig - ]; - - buildInputs = [ - libtool - openssl - ]; - - env.BINUTILS_DIR = "${binutils}/bin"; - - # Build external/ippcp_internal first. The Makefile is rewritten to make the - # build faster by splitting different versions of ipp-crypto builds and to - # avoid patching the Makefile for reproducibility issues. - preBuild = - let - ipp-crypto-no_mitigation = callPackage ./ipp-crypto.nix { }; - - sgx-asm-pp = "python ${finalAttrs.src}/build-scripts/sgx-asm-pp.py --assembler=nasm"; - - nasm-load = writeShellScript "nasm-load" "${sgx-asm-pp} --MITIGATION-CVE-2020-0551=LOAD $@"; - ipp-crypto-cve_2020_0551_load = callPackage ./ipp-crypto.nix { - extraCmakeFlags = [ "-DCMAKE_ASM_NASM_COMPILER=${nasm-load}" ]; - }; - - nasm-cf = writeShellScript "nasm-cf" "${sgx-asm-pp} --MITIGATION-CVE-2020-0551=CF $@"; - ipp-crypto-cve_2020_0551_cf = callPackage ./ipp-crypto.nix { - extraCmakeFlags = [ "-DCMAKE_ASM_NASM_COMPILER=${nasm-cf}" ]; - }; - in - '' - echo "Setting up IPP crypto build artifacts" - - pushd 'external/ippcp_internal' - - install -D -m a+rw ${ipp-crypto-no_mitigation}/lib/intel64/libippcp.a \ - lib/linux/intel64/no_mitigation/libippcp.a - install -D -m a+rw ${ipp-crypto-cve_2020_0551_load}/lib/intel64/libippcp.a \ - lib/linux/intel64/cve_2020_0551_load/libippcp.a - install -D -m a+rw ${ipp-crypto-cve_2020_0551_cf}/lib/intel64/libippcp.a \ - lib/linux/intel64/cve_2020_0551_cf/libippcp.a - - cp -r ${ipp-crypto-no_mitigation}/include/* inc/ - - mkdir inc/ippcp - cp ${ipp-crypto-no_mitigation}/include/fips_cert.h inc/ippcp/ - - rm inc/ippcp.h - patch ${ipp-crypto-no_mitigation}/include/ippcp.h -i ./inc/ippcp21u11.patch -o ./inc/ippcp.h - - install -D ${ipp-crypto-no_mitigation.src}/LICENSE license/LICENSE - - popd - ''; - - buildFlags = [ - "sdk_install_pkg" - ] - ++ lib.optionals debug [ - "DEBUG=1" - ]; - - postBuild = '' - patchShebangs linux/installer/bin/sgx_linux_x64_sdk_${finalAttrs.version}.bin - ''; - - installPhase = '' - runHook preInstall - - installDir=$TMPDIR - ./linux/installer/bin/sgx_linux_x64_sdk_${finalAttrs.version}.bin -prefix $installDir - installDir=$installDir/sgxsdk - - echo "Move files created by installer" - - mkdir -p $out/bin - pushd $out - - mv $installDir/bin/sgx-gdb $out/bin - mkdir $out/bin/x64 - for file in $installDir/bin/x64/*; do - mv $file bin/ - ln -sr bin/$(basename $file) bin/x64/ - done - rmdir $installDir/bin/{x64,} - - # Move `lib64` to `lib` and symlink `lib64` - mv $installDir/lib64 lib - ln -s lib/ lib64 - - # Fixup the symlinks for libsgx_urts.so.* -> libsgx_urts.so - for file in lib/libsgx_urts.so.*; do - ln -srf lib/libsgx_urts.so $file - done - - mv $installDir/include/ . - - mkdir -p share/ - mv $installDir/{SampleCode,licenses} share/ - - mkdir -p share/bin - mv $installDir/{environment,buildenv.mk} share/bin/ - ln -s share/bin/{environment,buildenv.mk} . - - # pkgconfig should go to lib/ - mv $installDir/pkgconfig lib/ - ln -s lib/pkgconfig/ . - - # Also create the `sdk_libs` for compat. All the files - # link to libraries in `lib64/`, we shouldn't link the entire - # directory, however, as there seems to be some ambiguity between - # SDK and PSW libraries. - mkdir sdk_libs/ - for file in $installDir/sdk_libs/*; do - ln -sr lib/$(basename $file) sdk_libs/ - rm $file - done - rmdir $installDir/sdk_libs - - # No uninstall script required - rm $installDir/uninstall.sh - - # Create an `sgxsdk` symlink which points to `$out` for compat - ln -sr . sgxsdk - - # Make sure we didn't forget any files - rmdir $installDir || (echo "Error: The directory $installDir still contains unhandled files: $(ls -A $installDir)" >&2 && exit 1) - - popd - - runHook postInstall - ''; - - preFixup = '' - echo "Strip sgxsdk prefix" - for path in "$out/share/bin/environment" "$out/bin/sgx-gdb"; do - substituteInPlace $path --replace "$TMPDIR/sgxsdk" "$out" - done - - echo "Fixing pkg-config files" - sed -i "s|prefix=.*|prefix=$out|g" $out/lib/pkgconfig/*.pc - - echo "Fixing SGX_SDK default in samples" - substituteInPlace $out/share/SampleCode/LocalAttestation/buildenv.mk \ - --replace '/opt/intel/sgxsdk' "$out" - for file in $out/share/SampleCode/*/Makefile; do - substituteInPlace $file \ - --replace '/opt/intel/sgxsdk' "$out" - done - - echo "Fixing BINUTILS_DIR in buildenv.mk" - substituteInPlace $out/share/bin/buildenv.mk \ - --replace 'BINUTILS_DIR ?= /usr/local/bin' \ - 'BINUTILS_DIR ?= ${finalAttrs.env.BINUTILS_DIR}' - - echo "Fixing GDB path in bin/sgx-gdb" - substituteInPlace $out/bin/sgx-gdb --replace '/usr/local/bin/gdb' '${gdb}/bin/gdb' - ''; - - doInstallCheck = true; - - installCheckPhase = '' - runHook preInstallCheck - - # Make sure all symlinks are valid - output=$(find "$out" -type l -exec test ! -e {} \; -print) - if [[ -n "$output" ]]; then - echo "Broken symlinks:" - echo "$output" - exit 1 - fi - - runHook postInstallCheck - ''; - - setupHook = writeText "setup-hook.sh" '' - sgxsdk() { - export SGX_SDK=@out@ - } - - postHooks+=(sgxsdk) - ''; - - passthru.tests = callPackage ../samples { sgxMode = "SIM"; }; - - # Run tests in SGX hardware mode on an SGX-enabled machine - # $(nix-build -A sgx-sdk.runTestsHW)/bin/run-tests-hw - passthru.runTestsHW = - let - testsHW = lib.filterAttrs (_: v: v ? "name") (callPackage ../samples { sgxMode = "HW"; }); - testsHWLinked = linkFarmFromDrvs "sgx-samples-hw-bundle" (lib.attrValues testsHW); - in - writeShellApplication { - name = "run-tests-hw"; - text = '' - for test in ${testsHWLinked}/*; do - printf '*** Running test %s ***\n\n' "$(basename "$test")" - printf 'a\n' | "$test/bin/app" - printf '\n' - done - ''; - }; - - meta = { - description = "Intel SGX SDK for Linux built with IPP Crypto Library"; - homepage = "https://github.com/intel/linux-sgx"; - maintainers = with lib.maintainers; [ - phlip9 - sbellem - arturcygan - veehaitch - ]; - platforms = [ "x86_64-linux" ]; - license = [ lib.licenses.bsd3 ]; - }; -}) diff --git a/pkgs/os-specific/linux/sgx/sdk/disable-downloads.patch b/pkgs/os-specific/linux/sgx/sdk/disable-downloads.patch deleted file mode 100644 index c045606df144..000000000000 --- a/pkgs/os-specific/linux/sgx/sdk/disable-downloads.patch +++ /dev/null @@ -1,28 +0,0 @@ -diff --git a/Makefile b/Makefile -index 73502a7..f24bd11 100644 ---- a/Makefile -+++ b/Makefile -@@ -50,18 +50,18 @@ tips: - preparation: - # As SDK build needs to clone and patch openmp, we cannot support the mode that download the source from github as zip. - # Only enable the download from git -- git submodule update --init --recursive -- ./external/dcap_source/QuoteVerification/prepare_sgxssl.sh nobuild -+ # git submodule update --init --recursive -+ # ./external/dcap_source/QuoteVerification/prepare_sgxssl.sh nobuild - cd external/openmp/openmp_code && git apply ../0001-Enable-OpenMP-in-SGX.patch >/dev/null 2>&1 || git apply ../0001-Enable-OpenMP-in-SGX.patch --check -R - cd external/protobuf/protobuf_code && git apply ../sgx_protobuf.patch >/dev/null 2>&1 || git apply ../sgx_protobuf.patch --check -R -- cd external/protobuf/protobuf_code && git submodule update --init --recursive && cd third_party/abseil-cpp && git apply ../../../sgx_abseil.patch>/dev/null 2>&1 || git apply ../../../sgx_abseil.patch --check -R -+ cd external/protobuf/protobuf_code && cd third_party/abseil-cpp && git apply ../../../sgx_abseil.patch>/dev/null 2>&1 || git apply ../../../sgx_abseil.patch --check -R - ./external/sgx-emm/create_symlink.sh - cd external/mbedtls/mbedtls_code && git apply ../sgx_mbedtls.patch >/dev/null 2>&1 || git apply ../sgx_mbedtls.patch --check -R - cd external/cbor && cp -r libcbor sgx_libcbor - cd external/cbor/libcbor && git apply ../raw_cbor.patch >/dev/null 2>&1 || git apply ../raw_cbor.patch --check -R - cd external/cbor/sgx_libcbor && git apply ../sgx_cbor.patch >/dev/null 2>&1 || git apply ../sgx_cbor.patch --check -R -- ./download_prebuilt.sh -- ./external/dcap_source/QuoteGeneration/download_prebuilt.sh -+ # ./download_prebuilt.sh -+ # ./external/dcap_source/QuoteGeneration/download_prebuilt.sh - - psw: - $(MAKE) -C psw/ USE_OPT_LIBS=$(USE_OPT_LIBS) diff --git a/pkgs/os-specific/linux/sgx/sdk/ipp-crypto.nix b/pkgs/os-specific/linux/sgx/sdk/ipp-crypto.nix deleted file mode 100644 index 49ae08fb0df2..000000000000 --- a/pkgs/os-specific/linux/sgx/sdk/ipp-crypto.nix +++ /dev/null @@ -1,40 +0,0 @@ -{ - stdenv, - fetchFromGitHub, - cmake, - nasm, - openssl, - python3, - extraCmakeFlags ? [ ], -}: -stdenv.mkDerivation rec { - pname = "ipp-crypto"; - version = "2021.11.1"; - - src = fetchFromGitHub { - owner = "intel"; - repo = "ipp-crypto"; - rev = "ippcp_${version}"; - hash = "sha256-OgNrrPE8jFVD/hcv7A43Bno96r4Z/lb7/SE6TEL7RDI="; - }; - - cmakeFlags = [ - "-DARCH=intel64" - # sgx-sdk now requires FIPS-compliance mode turned on - "-DIPPCP_FIPS_MODE=on" - ] - ++ extraCmakeFlags; - - # Yes, it seems bad for a cryptography library to trigger this - # warning. We previously pinned an EOL GCC which avoided it, but this - # issue is present regardless of whether we use a compiler that flags - # it up or not; upstream just doesn’t test with modern compilers. - env.NIX_CFLAGS_COMPILE = "-Wno-error=stringop-overflow"; - - nativeBuildInputs = [ - cmake - nasm - openssl - python3 - ]; -} diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix index 9718610bf171..b35874eec9ab 100644 --- a/pkgs/top-level/aliases.nix +++ b/pkgs/top-level/aliases.nix @@ -1771,6 +1771,8 @@ mapAliases { serverless = throw "'serverless' has been removed because version 3.x is unmaintained upstream and vulnerable, and version 4.x lacks a suitable binary or source download."; # Added 2025-11-22 session-desktop-appimage = throw "'session-desktop-appimage' has been renamed to/replaced by 'session-desktop'"; # Converted to throw 2025-10-27 sexp = throw "'sexp' has been renamed to/replaced by 'sexpp'"; # Converted to throw 2025-10-27 + sgx-sdk = throw "'sgx-sdk' has been removed as it was unmaintained and broken"; # Added 2026-02-20 + sgx-ssl = throw "'sgx-ssl' has been removed as it was unmaintained and broken"; # Added 2026-02-20 shadered = throw "shadered has been removed because it has been marked as broken since at least November 2024."; # Added 2025-10-01 shades-of-gray-theme = throw "'shades-of-gray-theme' has been removed because upstream is a 404"; # Added 2025-12-20 shared_desktop_ontologies = throw "'shared_desktop_ontologies' has been removed as it had been abandoned upstream"; # Added 2025-11-09 diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index 22cdce6ac9f5..13bbd539c786 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -8794,10 +8794,6 @@ with pkgs; rfkill_udev = callPackage ../os-specific/linux/rfkill/udev.nix { }; - sgx-sdk = callPackage ../os-specific/linux/sgx/sdk { - ocamlPackages = ocaml-ng.ocamlPackages_5_3; - }; - sgx-psw = callPackage ../os-specific/linux/sgx/psw { protobuf = protobuf_33; }; From 29c30249c30eeddb3f53eb7674c7f0033e10b764 Mon Sep 17 00:00:00 2001 From: Philip Kannegaard Hayes Date: Sat, 28 Feb 2026 00:23:13 +0900 Subject: [PATCH 14/59] aesmd: fix failure on first run and clean up old DCAP compat On our prod machines, aesmd would always fail the first time after boot, with logs like: `XXX-copy-aesmd-data-files.sh[770]: chown: invalid user: 'aesmd:aesmd'`. Everything would be fine after the next restart, but blocking boot for 15 seconds is definitely annoying. It appears the issue was that we were trying to name the DynamicUser User and Group (aesmd/aesmd) during ExecStartPre, but systemd only creates these right before ExecStart. After playing around with the ExecStartPre script, I finally got it to work correctly. As a bonus, we can also re-add the RootDirectory/chroot hardening. I've also cleaned out the config for the old out-of-tree isgx driver and the old DCAP driver. The kernel has had in-kernel SGX support since 5.11 (~2021/02). --- nixos/modules/services/security/aesmd.nix | 56 +++++------------------ 1 file changed, 11 insertions(+), 45 deletions(-) diff --git a/nixos/modules/services/security/aesmd.nix b/nixos/modules/services/security/aesmd.nix index d5ec33c0af6a..04bd3c4bb10c 100644 --- a/nixos/modules/services/security/aesmd.nix +++ b/nixos/modules/services/security/aesmd.nix @@ -11,7 +11,6 @@ let literalExpression makeLibraryPath mkEnableOption - mkForce mkIf mkOption mkPackageOption @@ -129,11 +128,6 @@ in hardware.cpu.intel.sgx.provision.enable = true; - # Make sure the AESM service can find the SGX devices until - # https://github.com/intel/linux-sgx/issues/772 is resolved - # and updated in nixpkgs. - hardware.cpu.intel.sgx.enableDcapCompat = mkForce true; - systemd.services.aesmd = let storeAesmFolder = "${sgx-psw}/aesm"; @@ -156,36 +150,17 @@ in } // cfg.environment; - # Make sure any of the SGX application enclave devices is available - unitConfig.AssertPathExists = [ - # legacy out-of-tree driver - "|/dev/isgx" - # DCAP driver - "|/dev/sgx/enclave" - # in-tree driver - "|/dev/sgx_enclave" - ]; + # Ensure the SGX application enclave device is available + unitConfig.AssertPathExists = [ "/dev/sgx_enclave" ]; serviceConfig = { - ExecStartPre = - let - script = pkgs.writeShellScript "copy-aesmd-data-files.sh" '' - set -euo pipefail - - # For some reason systemd 257+ won't properly bind mount the - # StateDirectory with the aesmd DynamicUser owning it - chown -R aesmd:aesmd /var/opt/aesmd - - whiteListFile="${aesmDataFolder}/white_list_cert_to_be_verify.bin" - if [[ ! -f "$whiteListFile" ]]; then - install -m 644 -o aesmd -g aesmd -D \ - "${storeAesmFolder}/data/white_list_cert_to_be_verify.bin" \ - "$whiteListFile" - fi - ''; - # Run setup with elevated privileges - in - "+${script}"; + # Run with elevated privileges to create /var/opt/aesmd/... before + # dropping to DynamicUser. + ExecStartPre = '' + +${lib.getExe' pkgs.coreutils "install"} -m 644 -D \ + "${storeAesmFolder}/data/white_list_cert_to_be_verify.bin" \ + "${aesmDataFolder}/white_list_cert_to_be_verify.bin" + ''; ExecStart = "${sgx-psw}/bin/aesm_service --no-daemon"; ExecReload = ''${pkgs.coreutils}/bin/kill -SIGHUP "$MAINPID"''; @@ -208,12 +183,7 @@ in # --- Hardening --- - # NOTE(phlip9): Starting with systemd-v257, enabling both - # `RootDirectory` (chroot) and `DynamicUser` prevents the service - # from locating the `aesmd` user: - # `XXX-copy-aesmd-data-files.sh: chown: invalid user: ‘aesmd:aesmd’` - # RootDirectory = "%t/aesmd"; - + RootDirectory = "%t/aesmd"; BindReadOnlyPaths = [ builtins.storeDir # Hardcoded path AESM_CONFIG_FILE in psw/ae/aesm_service/source/utils/aesm_config.cpp @@ -229,10 +199,6 @@ in PrivateDevices = false; DevicePolicy = "closed"; DeviceAllow = [ - # legacy out-of-tree driver - "/dev/isgx rw" - # DCAP driver - "/dev/sgx rw" # in-tree driver "/dev/sgx_enclave rw" "/dev/sgx_provision rw" @@ -244,7 +210,7 @@ in RestrictAddressFamilies = [ # Allocates the socket /var/run/aesmd/aesm.socket "AF_UNIX" - # Uses the HTTP protocol to initialize some services + # Makes HTTPS requests to the Intel PCCS service (or a cache). "AF_INET" "AF_INET6" ]; From 7e2cac144834d4e75bbb687955a468eb3091a7dc Mon Sep 17 00:00:00 2001 From: SchweGELBin Date: Tue, 24 Mar 2026 19:19:13 +0100 Subject: [PATCH 15/59] catppuccin: unstable-2025-10-07 -> 0-unstable-2026-03-24 --- pkgs/by-name/ca/catppuccin/package.nix | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/pkgs/by-name/ca/catppuccin/package.nix b/pkgs/by-name/ca/catppuccin/package.nix index bc95ed1db7c3..e618992f5df5 100644 --- a/pkgs/by-name/ca/catppuccin/package.nix +++ b/pkgs/by-name/ca/catppuccin/package.nix @@ -125,8 +125,8 @@ let name = "kvantum"; owner = "catppuccin"; repo = "Kvantum"; - rev = "c7cb144b041395e83e4f510a62526b7adfb79911"; - hash = "sha256-YNUkri+no+rNLTJHf6cPdy4AmQLzPiRK1Jbp2o8e1LE="; + rev = "71105d224fef95dd023691303477ce3eea487457"; + hash = "sha256-gcvCVZjVbj5fRZWaM+mZTwH/g158MH36JmMuMgCBuqQ="; }; lazygit = fetchFromGitHub { @@ -149,16 +149,16 @@ let name = "palette"; owner = "catppuccin"; repo = "palette"; - rev = "0df7db6fe201b437d91e7288fa22807bb0e44701"; - hash = "sha256-R52Q1FVAclvBk7xNgj/Jl+GPCIbORNf6YbJ1nxH3Gzs="; + rev = "07d02aa110ef9eb7e7427afca5c73ba9cf7f8ebd"; + hash = "sha256-hsy+GhuM4MSjnwGq1YJSLBFIbVm67SSdPRgObP00mxw="; }; plymouth = fetchFromGitHub { name = "plymouth"; owner = "catppuccin"; repo = "plymouth"; - rev = "e0f58d6fcf3dbc2d35dfc4fec394217fbfa92666"; - hash = "sha256-He6ER1QNrJCUthFoBBGHBINouW/tozxQy3R79F5tsuo="; + rev = "da38011d25f6f36152f2409372dfadb11c8f047c"; + hash = "sha256-3JK4lX2ZmxysITDEEkhBLkyINUeCzvu5nUgrpvWZ+ZE="; }; qt5ct = fetchFromGitHub { @@ -222,7 +222,7 @@ lib.checkListOfEnum "${pname}: variant" validVariants [ variant ] lib.checkListO stdenvNoCC.mkDerivation { inherit pname; - version = "unstable-2025-10-07"; + version = "0-unstable-2026-03-24"; srcs = selectedSources; From 0882c52157003a93ade4ca7db4d3b9b67adcce2c Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Tue, 24 Mar 2026 18:28:17 +0000 Subject: [PATCH 16/59] wgsl-analyzer: 2025-11-14 -> 2026-03-13 --- pkgs/by-name/wg/wgsl-analyzer/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/wg/wgsl-analyzer/package.nix b/pkgs/by-name/wg/wgsl-analyzer/package.nix index ff9fc053cc11..14872174f4b7 100644 --- a/pkgs/by-name/wg/wgsl-analyzer/package.nix +++ b/pkgs/by-name/wg/wgsl-analyzer/package.nix @@ -7,16 +7,16 @@ rustPlatform.buildRustPackage (finalAttrs: { pname = "wgsl-analyzer"; - version = "2025-11-14"; + version = "2026-03-13"; src = fetchFromGitHub { owner = "wgsl-analyzer"; repo = "wgsl-analyzer"; tag = finalAttrs.version; - hash = "sha256-9oulnN2mjOVOo1Z1mHlSeBXzsET/vJGe1h6UuNSC/LU="; + hash = "sha256-a1H/QJhLdBiwjqiG3icsKrSMz079yBjdBKffGANgdTQ="; }; - cargoHash = "sha256-gUOoNa9BySZF/jfN39GrfoKN4t9h4dKq474d8fkwTOI="; + cargoHash = "sha256-UM8oEg8gpsq9lnoDpeArGTl36EE7Tn6YMHXEIagVGvI="; checkFlags = [ # Imports failures From 402eb53843f858f23a98d2939a0ef6d51fec99f9 Mon Sep 17 00:00:00 2001 From: Jamie Magee Date: Thu, 26 Feb 2026 11:22:41 -0800 Subject: [PATCH 17/59] python3Packages.pysaunum: init at 0.5.0 --- .../python-modules/pysaunum/default.nix | 43 +++++++++++++++++++ pkgs/top-level/python-packages.nix | 2 + 2 files changed, 45 insertions(+) create mode 100644 pkgs/development/python-modules/pysaunum/default.nix diff --git a/pkgs/development/python-modules/pysaunum/default.nix b/pkgs/development/python-modules/pysaunum/default.nix new file mode 100644 index 000000000000..9c97b665b580 --- /dev/null +++ b/pkgs/development/python-modules/pysaunum/default.nix @@ -0,0 +1,43 @@ +{ + lib, + buildPythonPackage, + fetchFromGitHub, + setuptools, + pymodbus, + pytestCheckHook, + pytest-asyncio, + pytest-timeout, +}: + +buildPythonPackage (finalAttrs: { + pname = "pysaunum"; + version = "0.5.0"; + pyproject = true; + + src = fetchFromGitHub { + owner = "mettolen"; + repo = "pysaunum"; + tag = "v${finalAttrs.version}"; + hash = "sha256-0O/U79265YCr3iauVxXL0NRjVy7TZhlfUV3idfYa3fc="; + }; + + build-system = [ setuptools ]; + + dependencies = [ pymodbus ]; + + nativeCheckInputs = [ + pytestCheckHook + pytest-asyncio + pytest-timeout + ]; + + pythonImportsCheck = [ "pysaunum" ]; + + meta = { + description = "Python library for controlling Saunum sauna controllers via Modbus TCP"; + homepage = "https://github.com/mettolen/pysaunum"; + changelog = "https://github.com/mettolen/pysaunum/releases/tag/v${finalAttrs.version}"; + license = lib.licenses.mit; + maintainers = [ lib.maintainers.jamiemagee ]; + }; +}) diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix index bffdd977ba0f..71251fef20f8 100644 --- a/pkgs/top-level/python-packages.nix +++ b/pkgs/top-level/python-packages.nix @@ -14839,6 +14839,8 @@ self: super: with self; { pysatochip = callPackage ../development/python-modules/pysatochip { }; + pysaunum = callPackage ../development/python-modules/pysaunum { }; + pysbd = callPackage ../development/python-modules/pysbd { }; pysc2 = callPackage ../development/python-modules/pysc2 { }; From 8102b2a23ba2a322396f95b1319b88fc1caec118 Mon Sep 17 00:00:00 2001 From: Jamie Magee Date: Thu, 26 Feb 2026 11:24:18 -0800 Subject: [PATCH 18/59] home-assistant: regenerate component-packages.nix --- pkgs/servers/home-assistant/component-packages.nix | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/pkgs/servers/home-assistant/component-packages.nix b/pkgs/servers/home-assistant/component-packages.nix index 34e3b668e27d..bc9b75a56b7d 100644 --- a/pkgs/servers/home-assistant/component-packages.nix +++ b/pkgs/servers/home-assistant/component-packages.nix @@ -5392,7 +5392,8 @@ ]; "saunum" = ps: with ps; [ - ]; # missing inputs: pysaunum + pysaunum + ]; "scene" = ps: with ps; [ ]; @@ -8013,6 +8014,7 @@ "samsungtv" "sanix" "satel_integra" + "saunum" "scene" "schedule" "schlage" From 2ef00e2d5266887d9db59394d5028332622b3c7e Mon Sep 17 00:00:00 2001 From: Jared Dunbar Date: Sun, 4 Jan 2026 11:28:29 -0500 Subject: [PATCH 19/59] nixos/virtualization/ec2: Adds IPv6 IMDS fetch capability Updates the EC2 IMDS metadata fetcher script to support IPv6 endpoints. If you start an instance in an IPv6 subnet, if the EC2 instance gets an IPv6 address before the IPv4 address (extremely common), systemd will trigger the IMDS fetcher script and fail to fetch your NixOS configuration, leaving you with a useless unconfigured EC2 instance. This at least allows the NixOS configuration to be fetched and applied. --- .../virtualisation/ec2-metadata-fetcher.sh | 37 +++++++++++++++---- 1 file changed, 29 insertions(+), 8 deletions(-) diff --git a/nixos/modules/virtualisation/ec2-metadata-fetcher.sh b/nixos/modules/virtualisation/ec2-metadata-fetcher.sh index 7a8232d14865..5b4cdb44386a 100644 --- a/nixos/modules/virtualisation/ec2-metadata-fetcher.sh +++ b/nixos/modules/virtualisation/ec2-metadata-fetcher.sh @@ -3,7 +3,12 @@ mkdir -p "$metaDir" chmod 0755 "$metaDir" rm -f "$metaDir/*" +IMDS_ENDPOINTS="http://169.254.169.254 http://[fd00:ec2::254]" +IMDS_BASE_URL="http://169.254.169.254" +IMDS_TOKEN="" + get_imds_token() { + endpoint=$1 # retry-delay of 1 selected to give the system a second to get going, # but not add a lot to the bootup time curl \ @@ -15,10 +20,11 @@ get_imds_token() { -X PUT \ --connect-timeout 1 \ -H "X-aws-ec2-metadata-token-ttl-seconds: 600" \ - http://169.254.169.254/latest/api/token + "$endpoint/latest/api/token" } preflight_imds_token() { + endpoint=$1 # retry-delay of 1 selected to give the system a second to get going, # but not add a lot to the bootup time curl \ @@ -30,13 +36,18 @@ preflight_imds_token() { --connect-timeout 1 \ -H "X-aws-ec2-metadata-token: $IMDS_TOKEN" \ -o /dev/null \ - http://169.254.169.254/1.0/meta-data/instance-id + "$endpoint/1.0/meta-data/instance-id" } try=1 while [ $try -le 3 ]; do echo "(attempt $try/3) getting an EC2 instance metadata service v2 token..." - IMDS_TOKEN=$(get_imds_token) && break + for endpoint in $IMDS_ENDPOINTS; do + IMDS_TOKEN=$(get_imds_token "$endpoint") && IMDS_BASE_URL=$endpoint && break + done + if [ -n "$IMDS_TOKEN" ]; then + break + fi try=$((try + 1)) sleep 1 done @@ -48,7 +59,17 @@ fi try=1 while [ $try -le 10 ]; do echo "(attempt $try/10) validating the EC2 instance metadata service v2 token..." - preflight_imds_token && break + preflight_ok="" + for endpoint in $IMDS_ENDPOINTS; do + if preflight_imds_token "$endpoint"; then + IMDS_BASE_URL=$endpoint + preflight_ok=1 + break + fi + done + if [ -n "$preflight_ok" ]; then + break + fi try=$((try + 1)) sleep 1 done @@ -85,7 +106,7 @@ try_decompress() { fi } -get_imds -o "$metaDir/ami-manifest-path" http://169.254.169.254/1.0/meta-data/ami-manifest-path -(umask 077 && get_imds -o "$metaDir/user-data" http://169.254.169.254/1.0/user-data && try_decompress "$metaDir/user-data") -get_imds -o "$metaDir/hostname" http://169.254.169.254/1.0/meta-data/hostname -get_imds -o "$metaDir/public-keys-0-openssh-key" http://169.254.169.254/1.0/meta-data/public-keys/0/openssh-key +get_imds -o "$metaDir/ami-manifest-path" "$IMDS_BASE_URL/1.0/meta-data/ami-manifest-path" +(umask 077 && get_imds -o "$metaDir/user-data" "$IMDS_BASE_URL/1.0/user-data" && try_decompress "$metaDir/user-data") +get_imds -o "$metaDir/hostname" "$IMDS_BASE_URL/1.0/meta-data/hostname" +get_imds -o "$metaDir/public-keys-0-openssh-key" "$IMDS_BASE_URL/1.0/meta-data/public-keys/0/openssh-key" From 81dce7843c69c2c42a337b2121ff8bcb6a657c13 Mon Sep 17 00:00:00 2001 From: Philip Taron Date: Tue, 24 Mar 2026 13:40:13 -0700 Subject: [PATCH 20/59] nixosTests.ec2-image: add IPv6 IMDS fallback subtest Tests that the EC2 metadata fetcher falls back to the IPv6 IMDS endpoint (fd00:ec2::254) when the IPv4 endpoint is unreachable. Works around QEMU guestfwd being IPv4-only by running socat + micro_httpd inside the guest on the IPv6 address, then blocking IPv4 IMDS with iptables and re-running the fetcher. --- nixos/tests/ec2-image.nix | 66 +++++++++++++++++++++++++++++++++++++++ 1 file changed, 66 insertions(+) diff --git a/nixos/tests/ec2-image.nix b/nixos/tests/ec2-image.nix index b3b78e298d01..6ea2c6016681 100644 --- a/nixos/tests/ec2-image.nix +++ b/nixos/tests/ec2-image.nix @@ -44,6 +44,13 @@ let ]; }; + # Packages needed for IPv6 IMDS fallback test + environment.systemPackages = [ + pkgs.socat + pkgs.micro-httpd + pkgs.iptables + ]; + nixpkgs.pkgs = pkgs; } ]; @@ -299,6 +306,65 @@ in ) test_userdata_decompression(machine, user_data_path, proc.stdout, "lzip") + with subtest("IPv6 IMDS fallback"): + # Save hostname fetched via IPv4 for later comparison + original_hostname = machine.succeed("cat /etc/ec2-metadata/hostname").strip() + + # Assign the EC2 IPv6 IMDS address to loopback + machine.succeed("ip -6 addr add fd00:ec2::254/128 dev lo") + + # Create metadata directory structure for the IPv6 endpoint + machine.succeed( + "mkdir -p /tmp/ipv6-metadata/1.0/meta-data/public-keys/0" + " && mkdir -p /tmp/ipv6-metadata/latest/api" + " && cp /etc/ec2-metadata/hostname /tmp/ipv6-metadata/1.0/meta-data/hostname" + " && cp /etc/ec2-metadata/ami-manifest-path /tmp/ipv6-metadata/1.0/meta-data/ami-manifest-path" + " && echo i-1234567890abcdef0 > /tmp/ipv6-metadata/1.0/meta-data/instance-id" + " && echo ipv6-test-token > /tmp/ipv6-metadata/latest/api/token" + " && touch /tmp/ipv6-metadata/1.0/user-data" + ) + machine.execute( + "test -f /etc/ec2-metadata/public-keys-0-openssh-key" + " && cp /etc/ec2-metadata/public-keys-0-openssh-key" + " /tmp/ipv6-metadata/1.0/meta-data/public-keys/0/openssh-key" + ) + + # Serve metadata on the IPv6 IMDS address via socat + micro_httpd (inetd-style) + machine.succeed( + "systemd-run --unit=ipv6-imds --" + " socat TCP6-LISTEN:80,bind=[fd00:ec2::254],fork,reuseaddr" + " SYSTEM:'${lib.getExe pkgs.micro-httpd} /tmp/ipv6-metadata'" + ) + + # Wait for IPv6 IMDS to become reachable + machine.wait_until_succeeds( + "curl -sf http://[fd00:ec2::254]/1.0/meta-data/hostname" + ) + + # Block IPv4 IMDS to force fallback to IPv6 + machine.succeed( + "iptables -I OUTPUT -d 169.254.169.254 -p tcp --dport 80 -j REJECT" + ) + + # Verify IPv4 IMDS is now unreachable + machine.fail( + "curl -sf --connect-timeout 2 http://169.254.169.254/1.0/meta-data/hostname" + ) + + # Clear fetched metadata and re-run the fetcher + machine.succeed("rm -f /etc/ec2-metadata/*") + machine.succeed("systemctl restart fetch-ec2-metadata") + + # Verify metadata was successfully re-fetched via IPv6 + hostname = machine.succeed("cat /etc/ec2-metadata/hostname").strip() + assert hostname == original_hostname, f"Expected '{original_hostname}', got '{hostname}'" + + # Clean up: restore IPv4 IMDS access + machine.succeed( + "iptables -D OUTPUT -d 169.254.169.254 -p tcp --dport 80 -j REJECT" + ) + machine.succeed("systemctl stop ipv6-imds") + finally: machine.shutdown() temp_dir.cleanup() From c66b3b2d55c9fe88ec2d479c4a45d2cf125fb4d4 Mon Sep 17 00:00:00 2001 From: Philip Taron Date: Tue, 24 Mar 2026 14:45:43 -0700 Subject: [PATCH 21/59] nixosTests.ec2-image: replace micro_httpd with IMDSv2-aware server micro_httpd returns 501 for PUT requests, so IMDSv2 token acquisition was never actually tested. Replace it with a minimal Python IMDS server that handles the full IMDSv2 flow: PUT for token, token validation on GET requests, and file serving from a metadata directory. This means the test now validates that: - The fetcher correctly obtains an IMDSv2 token via PUT - The token is passed on subsequent metadata GET requests - Requests without a valid token are rejected (401) --- nixos/tests/common/imds-server.py | 95 +++++++++++++++++++++++++++++++ nixos/tests/ec2-image.nix | 36 ++++++++---- 2 files changed, 119 insertions(+), 12 deletions(-) create mode 100644 nixos/tests/common/imds-server.py diff --git a/nixos/tests/common/imds-server.py b/nixos/tests/common/imds-server.py new file mode 100644 index 000000000000..3a96bcc92364 --- /dev/null +++ b/nixos/tests/common/imds-server.py @@ -0,0 +1,95 @@ +"""Minimal IMDSv2-compatible metadata server for NixOS EC2 tests. + +Runs in inetd mode: reads one HTTP request from stdin, writes the +response to stdout. Drop-in replacement for micro_httpd in QEMU +guestfwd and socat contexts. + +Usage: imds-server + +The metadata directory should contain: + latest/api/token - Token value (returned on PUT) + 1.0/meta-data/hostname - Instance hostname + 1.0/meta-data/ami-manifest-path - AMI manifest path + 1.0/meta-data/instance-id - Instance ID + 1.0/meta-data/public-keys/0/openssh-key - SSH public key + 1.0/user-data - User data +""" + +import os +import sys + + +def read_request(): + """Read and parse one HTTP request from stdin (inetd mode).""" + request_line = sys.stdin.readline() + if not request_line: + sys.exit(0) + + parts = request_line.strip().split() + method = parts[0] if parts else "" + path = parts[1] if len(parts) > 1 else "/" + + headers = {} + while True: + line = sys.stdin.readline() + if not line or line.strip() == "": + break + if ":" in line: + key, _, value = line.partition(":") + headers[key.strip().lower()] = value.strip() + + return method, path, headers + + +def respond(status, body): + """Write an HTTP response to stdout.""" + if isinstance(body, str): + body = body.encode() + header = ( + f"HTTP/1.1 {status}\r\n" + f"Content-Type: text/plain\r\n" + f"Content-Length: {len(body)}\r\n" + f"Connection: close\r\n" + f"\r\n" + ).encode() + sys.stdout.buffer.write(header + body) + sys.stdout.buffer.flush() + + +def main(): + base_dir = sys.argv[1] if len(sys.argv) > 1 else "." + + # Load expected token from file + token_path = os.path.join(base_dir, "latest", "api", "token") + if os.path.isfile(token_path): + with open(token_path) as f: + expected_token = f.read().strip() + else: + expected_token = "test-imdsv2-token" + + method, path, headers = read_request() + rel_path = path.lstrip("/") + + # PUT /latest/api/token — IMDSv2 token acquisition + if method == "PUT" and rel_path == "latest/api/token": + respond("200 OK", expected_token) + return + + # All other requests require a valid token + request_token = headers.get("x-aws-ec2-metadata-token", "") + if request_token != expected_token: + respond("401 Unauthorized", "Invalid or missing IMDSv2 token\n") + return + + # Serve file from the metadata directory + file_path = os.path.join(base_dir, rel_path) + if os.path.isfile(file_path): + with open(file_path, "rb") as f: + content = f.read() + respond("200 OK", content) + else: + respond("404 Not Found", f"Not found: {path}\n") + + +if __name__ == "__main__": + main() diff --git a/nixos/tests/ec2-image.nix b/nixos/tests/ec2-image.nix index 6ea2c6016681..9d8090a9cb52 100644 --- a/nixos/tests/ec2-image.nix +++ b/nixos/tests/ec2-image.nix @@ -13,6 +13,11 @@ let inherit (lib) mkAfter mkForce; pkgs = config.node.pkgs; + # Minimal IMDSv2-compatible metadata server (inetd-mode, drop-in for micro_httpd) + imdsServer = pkgs.writers.writePython3Bin "imds-server" { } ( + builtins.readFile ./common/imds-server.py + ); + # Build an EC2 image configuration imageCfg = (import ../lib/eval-config.nix { @@ -47,7 +52,7 @@ let # Packages needed for IPv6 IMDS fallback test environment.systemPackages = [ pkgs.socat - pkgs.micro-httpd + imdsServer pkgs.iptables ]; @@ -94,11 +99,8 @@ in # Instance Metadata Service (IMDSv2 with 1.0 metadata version) # TODO: Use 'latest' metadata version instead of '1.0' - # - Consider https://github.com/aws/amazon-ec2-metadata-mock - # - Blocked on https://github.com/aws/amazon-ec2-metadata-mock/issues/234 - # - Consider https://github.com/purpleclay/imds-mock - # - [Test matrix] also test providing the host key through IMDS - # - i.e. a test module argument to select between writing or reading the host key + # TODO: [Test matrix] also test providing the host key through IMDS + # - i.e. a test module argument to select between writing or reading the host key def create_ec2_metadata_dir(temp_dir, client_pubkey): """Create fake EC2 metadata directory structure with mock data""" metadata_dir = os.path.join(temp_dir.name, "ec2-metadata") @@ -178,7 +180,7 @@ in ) metadata_net = ( " -device virtio-net-pci,netdev=ec2meta" - + f" -netdev 'user,id=ec2meta,net=169.0.0.0/8,guestfwd=tcp:169.254.169.254:80-cmd:${pkgs.micro-httpd}/bin/micro_httpd {metadata_dir}'" + + f" -netdev 'user,id=ec2meta,net=169.0.0.0/8,guestfwd=tcp:169.254.169.254:80-cmd:${lib.getExe imdsServer} {metadata_dir}'" ) start_command = ( @@ -227,7 +229,16 @@ in machine_ip = "${config.nodes.machine.networking.primaryIPAddress}" with subtest("EC2 metadata service connectivity"): - hostname_response = machine.succeed("curl --fail -s http://169.254.169.254/1.0/meta-data/hostname") + # Obtain an IMDSv2 token, then use it to fetch metadata + imds_token = machine.succeed( + "curl -sf -X PUT -H 'X-aws-ec2-metadata-token-ttl-seconds: 600'" + " http://169.254.169.254/latest/api/token" + ).strip() + assert imds_token, "Failed to obtain IMDSv2 token" + hostname_response = machine.succeed( + f"curl -sf -H 'X-aws-ec2-metadata-token: {imds_token}'" + " http://169.254.169.254/1.0/meta-data/hostname" + ) assert "test-instance" in hostname_response, f"Expected 'test-instance', got: {hostname_response}" with subtest("SSH host key extraction from console"): @@ -329,16 +340,17 @@ in " /tmp/ipv6-metadata/1.0/meta-data/public-keys/0/openssh-key" ) - # Serve metadata on the IPv6 IMDS address via socat + micro_httpd (inetd-style) + # Serve metadata on the IPv6 IMDS address via socat + imds-server (inetd-style) machine.succeed( "systemd-run --unit=ipv6-imds --" " socat TCP6-LISTEN:80,bind=[fd00:ec2::254],fork,reuseaddr" - " SYSTEM:'${lib.getExe pkgs.micro-httpd} /tmp/ipv6-metadata'" + " SYSTEM:'${lib.getExe imdsServer} /tmp/ipv6-metadata'" ) - # Wait for IPv6 IMDS to become reachable + # Wait for IPv6 IMDS to become reachable (token endpoint doesn't require auth) machine.wait_until_succeeds( - "curl -sf http://[fd00:ec2::254]/1.0/meta-data/hostname" + "curl -sf -X PUT -H 'X-aws-ec2-metadata-token-ttl-seconds: 600'" + " http://[fd00:ec2::254]/latest/api/token" ) # Block IPv4 IMDS to force fallback to IPv6 From b1444cab3c34d726711512f1e7963d369dfda131 Mon Sep 17 00:00:00 2001 From: Philip Taron Date: Tue, 24 Mar 2026 15:06:06 -0700 Subject: [PATCH 22/59] nixos/virtualisation/ec2: fix preflight validation and variable scoping - Preflight validation now validates against the endpoint that issued the token (IMDS_BASE_URL) instead of re-scanning all endpoints. The previous behavior could silently switch to a different endpoint and wasted time retrying unreachable ones. - Add local keyword to endpoint variables in get_imds_token and preflight_imds_token to avoid polluting global scope. --- .../virtualisation/ec2-metadata-fetcher.sh | 16 +++------------- 1 file changed, 3 insertions(+), 13 deletions(-) diff --git a/nixos/modules/virtualisation/ec2-metadata-fetcher.sh b/nixos/modules/virtualisation/ec2-metadata-fetcher.sh index 5b4cdb44386a..b62839871318 100644 --- a/nixos/modules/virtualisation/ec2-metadata-fetcher.sh +++ b/nixos/modules/virtualisation/ec2-metadata-fetcher.sh @@ -8,7 +8,7 @@ IMDS_BASE_URL="http://169.254.169.254" IMDS_TOKEN="" get_imds_token() { - endpoint=$1 + local endpoint=$1 # retry-delay of 1 selected to give the system a second to get going, # but not add a lot to the bootup time curl \ @@ -24,7 +24,7 @@ get_imds_token() { } preflight_imds_token() { - endpoint=$1 + local endpoint=$1 # retry-delay of 1 selected to give the system a second to get going, # but not add a lot to the bootup time curl \ @@ -59,17 +59,7 @@ fi try=1 while [ $try -le 10 ]; do echo "(attempt $try/10) validating the EC2 instance metadata service v2 token..." - preflight_ok="" - for endpoint in $IMDS_ENDPOINTS; do - if preflight_imds_token "$endpoint"; then - IMDS_BASE_URL=$endpoint - preflight_ok=1 - break - fi - done - if [ -n "$preflight_ok" ]; then - break - fi + preflight_imds_token "$IMDS_BASE_URL" && break try=$((try + 1)) sleep 1 done From 7494e88f866d89390daee3f39cc6666ce542c98f Mon Sep 17 00:00:00 2001 From: Philip Taron Date: Tue, 24 Mar 2026 15:10:21 -0700 Subject: [PATCH 23/59] nixosTests: share IMDSv2 server across EC2 test infrastructure - Extract imds-server derivation into common/imds-server.nix so both ec2-image.nix and common/ec2.nix share the same definition. - Update common/ec2.nix (makeEc2Test) to use the IMDSv2 server instead of micro_httpd, and add token/instance-id to the metadata directory so the full IMDSv2 flow works. - Simplify ec2-image.nix to import from the shared definition. --- nixos/tests/common/ec2.nix | 10 +++++++++- nixos/tests/common/imds-server.nix | 4 ++++ nixos/tests/ec2-image.nix | 5 +---- 3 files changed, 14 insertions(+), 5 deletions(-) create mode 100644 nixos/tests/common/imds-server.nix diff --git a/nixos/tests/common/ec2.nix b/nixos/tests/common/ec2.nix index cb66009b5a83..df1a85638fde 100644 --- a/nixos/tests/common/ec2.nix +++ b/nixos/tests/common/ec2.nix @@ -2,7 +2,12 @@ with pkgs.lib; +let + imdsServer = import ./imds-server.nix { inherit pkgs; }; +in { + inherit imdsServer; + makeEc2Test = { name, @@ -18,9 +23,12 @@ with pkgs.lib; name = "metadata"; buildCommand = '' mkdir -p $out/1.0/meta-data + mkdir -p $out/latest/api ln -s ${pkgs.writeText "userData" userData} $out/1.0/user-data echo "${hostname}" > $out/1.0/meta-data/hostname echo "(unknown)" > $out/1.0/meta-data/ami-manifest-path + echo "i-1234567890abcdef0" > $out/1.0/meta-data/instance-id + echo "test-imdsv2-token" > $out/latest/api/token '' + optionalString (sshPublicKey != null) '' mkdir -p $out/1.0/meta-data/public-keys/0 @@ -67,7 +75,7 @@ with pkgs.lib; start_command = ( "qemu-kvm -m 1024" + " -device virtio-net-pci,netdev=vlan0" - + " -netdev 'user,id=vlan0,net=169.0.0.0/8,guestfwd=tcp:169.254.169.254:80-cmd:${pkgs.micro-httpd}/bin/micro_httpd ${metaData}'" + + " -netdev 'user,id=vlan0,net=169.0.0.0/8,guestfwd=tcp:169.254.169.254:80-cmd:${getExe imdsServer} ${metaData}'" + f" -drive file={disk_image},if=virtio,werror=report" + " $QEMU_OPTS" ) diff --git a/nixos/tests/common/imds-server.nix b/nixos/tests/common/imds-server.nix new file mode 100644 index 000000000000..4b867316d988 --- /dev/null +++ b/nixos/tests/common/imds-server.nix @@ -0,0 +1,4 @@ +# Minimal IMDSv2-compatible metadata server for NixOS EC2 tests. +# Runs in inetd mode (stdin/stdout), drop-in for micro_httpd in +# QEMU guestfwd and socat contexts. +{ pkgs }: pkgs.writers.writePython3Bin "imds-server" { } (builtins.readFile ./imds-server.py) diff --git a/nixos/tests/ec2-image.nix b/nixos/tests/ec2-image.nix index 9d8090a9cb52..0e0d5fde4a17 100644 --- a/nixos/tests/ec2-image.nix +++ b/nixos/tests/ec2-image.nix @@ -13,10 +13,7 @@ let inherit (lib) mkAfter mkForce; pkgs = config.node.pkgs; - # Minimal IMDSv2-compatible metadata server (inetd-mode, drop-in for micro_httpd) - imdsServer = pkgs.writers.writePython3Bin "imds-server" { } ( - builtins.readFile ./common/imds-server.py - ); + imdsServer = import ./common/imds-server.nix { inherit pkgs; }; # Build an EC2 image configuration imageCfg = From 4e9154173d7fccb7110ef642cc0a6a379643d6d3 Mon Sep 17 00:00:00 2001 From: Philip Taron Date: Tue, 24 Mar 2026 15:14:16 -0700 Subject: [PATCH 24/59] nixosTests.ec2-nixops: fix image.imageFile -> image.fileName The image.imageFile option was renamed to image.fileName. This broke the ec2-nixops test at evaluation time. --- nixos/tests/ec2.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nixos/tests/ec2.nix b/nixos/tests/ec2.nix index 7a336445d793..ae9a79db5403 100644 --- a/nixos/tests/ec2.nix +++ b/nixos/tests/ec2.nix @@ -59,7 +59,7 @@ let } ]; }).config; - image = "${imageCfg.system.build.amazonImage}/${imageCfg.image.imageFile}"; + image = "${imageCfg.system.build.amazonImage}/${imageCfg.image.fileName}"; sshKeys = import ./ssh-keys.nix pkgs; snakeOilPrivateKey = sshKeys.snakeOilPrivateKey.text; From 8abc1f08262bc8d2a90691a0d14557b076c01201 Mon Sep 17 00:00:00 2001 From: Gaetan Lepage Date: Fri, 20 Mar 2026 09:29:39 +0000 Subject: [PATCH 25/59] python3Packages.jaxopt: use finalAttrs --- pkgs/development/python-modules/jaxopt/default.nix | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/pkgs/development/python-modules/jaxopt/default.nix b/pkgs/development/python-modules/jaxopt/default.nix index 8a71974ec02f..e1b8c30520b4 100644 --- a/pkgs/development/python-modules/jaxopt/default.nix +++ b/pkgs/development/python-modules/jaxopt/default.nix @@ -21,7 +21,7 @@ scikit-learn, }: -buildPythonPackage rec { +buildPythonPackage (finalAttrs: { pname = "jaxopt"; version = "0.8.5"; pyproject = true; @@ -29,7 +29,7 @@ buildPythonPackage rec { src = fetchFromGitHub { owner = "google"; repo = "jaxopt"; - tag = "jaxopt-v${version}"; + tag = "jaxopt-v${finalAttrs.version}"; hash = "sha256-vPXrs8J81O+27w9P/fEFr7w4xClKb8T0IASD+iNhztQ="; }; @@ -83,8 +83,8 @@ buildPythonPackage rec { meta = { homepage = "https://jaxopt.github.io"; description = "Hardware accelerated, batchable and differentiable optimizers in JAX"; - changelog = "https://github.com/google/jaxopt/releases/tag/jaxopt-v${version}"; + changelog = "https://github.com/google/jaxopt/releases/tag/${finalAttrs.src.tag}"; license = lib.licenses.asl20; maintainers = with lib.maintainers; [ bcdarwin ]; }; -} +}) From 87256fe0bfdc6aa0a538f16eb8e97e2ed9645084 Mon Sep 17 00:00:00 2001 From: Gaetan Lepage Date: Fri, 20 Mar 2026 09:29:29 +0000 Subject: [PATCH 26/59] python3Packages.jaxopt: fix build --- .../python-modules/jaxopt/default.nix | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/pkgs/development/python-modules/jaxopt/default.nix b/pkgs/development/python-modules/jaxopt/default.nix index e1b8c30520b4..9729adbe7a45 100644 --- a/pkgs/development/python-modules/jaxopt/default.nix +++ b/pkgs/development/python-modules/jaxopt/default.nix @@ -33,6 +33,23 @@ buildPythonPackage (finalAttrs: { hash = "sha256-vPXrs8J81O+27w9P/fEFr7w4xClKb8T0IASD+iNhztQ="; }; + postPatch = + # TypeError: LogisticRegression.__init__() got an unexpected keyword argument 'multi_class' + '' + substituteInPlace jaxopt/_src/test_util.py \ + --replace-fail "multi_class=multiclass," "" + '' + # AttributeError: jax.experimental.enable_x64 was removed in JAX v0.9.0; use jax.enable_x64(True) instead. + + '' + substituteInPlace \ + tests/zoom_linesearch_test.py \ + tests/lbfgsb_test.py \ + tests/lbfgs_test.py \ + --replace-fail \ + "jax.experimental.enable_x64()" \ + "jax.enable_x64(True)" + ''; + build-system = [ setuptools ]; dependencies = [ From 233926463bb8c5627c739b4025800f84c46a8b82 Mon Sep 17 00:00:00 2001 From: Gaetan Lepage Date: Tue, 20 Jan 2026 23:35:57 +0000 Subject: [PATCH 27/59] python3Packages.jax: 0.8.2 -> 0.9.0 Diff: https://github.com/jax-ml/jax/compare/jax-v0.8.2...jax-v0.9.0 Changelog: https://github.com/jax-ml/jax/releases/tag/jax-v0.9.0 --- .../jax-cuda12-pjrt/default.nix | 8 +++--- .../jax-cuda12-plugin/default.nix | 16 ++++++------ .../python-modules/jax/default.nix | 12 ++++----- .../development/python-modules/jaxlib/bin.nix | 26 +++++++++---------- 4 files changed, 31 insertions(+), 31 deletions(-) diff --git a/pkgs/development/python-modules/jax-cuda12-pjrt/default.nix b/pkgs/development/python-modules/jax-cuda12-pjrt/default.nix index bf3fe4463dbd..574e158f816d 100644 --- a/pkgs/development/python-modules/jax-cuda12-pjrt/default.nix +++ b/pkgs/development/python-modules/jax-cuda12-pjrt/default.nix @@ -31,7 +31,7 @@ let ); in -buildPythonPackage rec { +buildPythonPackage (finalAttrs: { pname = "jax-cuda12-pjrt"; inherit version; pyproject = false; @@ -50,8 +50,8 @@ buildPythonPackage rec { .${stdenv.hostPlatform.system}; hash = { - x86_64-linux = "sha256-47q0HKfEjkFj255+/ScbOqhfD+RfXtBwjWu+2TpZ+Xc="; - aarch64-linux = "sha256-cXobGWpkJAnOGV3fAxwgu+rcyIb1Xkmh0/SSc3Ou7a4="; + x86_64-linux = "sha256-vbPqvuQ1rJZ6/4su7aL3uc2B7QA/En301vHlX6XZRoQ="; + aarch64-linux = "sha256-I+V0uCdbYBUoV0JyDxrX28bw4VlcsJ47sh2HgXlTlT8="; } .${stdenv.hostPlatform.system}; }; @@ -102,4 +102,4 @@ buildPythonPackage rec { # https://jax.readthedocs.io/en/latest/installation.html#pip-installation-nvidia-gpu-cuda-installed-locally-harder broken = !(lib.versionAtLeast cudaPackages.cudnn.version "9.1"); }; -} +}) diff --git a/pkgs/development/python-modules/jax-cuda12-plugin/default.nix b/pkgs/development/python-modules/jax-cuda12-plugin/default.nix index 529692c72c0c..841eecbd0448 100644 --- a/pkgs/development/python-modules/jax-cuda12-plugin/default.nix +++ b/pkgs/development/python-modules/jax-cuda12-plugin/default.nix @@ -39,42 +39,42 @@ let "3.11-x86_64-linux" = getSrcFromPypi { platform = "manylinux_2_27_x86_64"; dist = "cp311"; - hash = "sha256-CwozBM5+SUrNjZxZNJDBEqMs22AQ/hr8WE2eQf2GMWc="; + hash = "sha256-iTh3d+FyGqq97aGKV3r8fP5O4KscN7MmG9Ryq43wcvc="; }; "3.11-aarch64-linux" = getSrcFromPypi { platform = "manylinux_2_27_aarch64"; dist = "cp311"; - hash = "sha256-cNMyIkhK1cN1uPg1e3wjysuET27Pw5Vn+N1H/eboeFg="; + hash = "sha256-ocPzEElPn3vmLyuEJXBcPEZvKmIbTk29v7Fa2aevvcA="; }; "3.12-x86_64-linux" = getSrcFromPypi { platform = "manylinux_2_27_x86_64"; dist = "cp312"; - hash = "sha256-IBZYYbPT5m67LA9jpUfR1e4X6kSsO+cVPHkIycqMiPM="; + hash = "sha256-NJNtd+1oWdoIwugYpRVMx++1hFHZ0Ew+zVtE02BfvfI="; }; "3.12-aarch64-linux" = getSrcFromPypi { platform = "manylinux_2_27_aarch64"; dist = "cp312"; - hash = "sha256-QD1eB3MbXNrDvZ+z9Ei9hIAGLLLAq2HqKtI/zQplR5o="; + hash = "sha256-3i6vpuutVBA/CccRAOTkb36gl+jRGUWe+R6OWxTLn6I="; }; "3.13-x86_64-linux" = getSrcFromPypi { platform = "manylinux_2_27_x86_64"; dist = "cp313"; - hash = "sha256-gsZ5i+Zr+MdzOGkY5MjlzYEZdT87+zyku8RoGCg3UMY="; + hash = "sha256-ZnkKIJR/f2RqKkqcXvghdW0sM/uZ3iqA5hKIwI3BeJo="; }; "3.13-aarch64-linux" = getSrcFromPypi { platform = "manylinux_2_27_aarch64"; dist = "cp313"; - hash = "sha256-Y3OH3DQIzSBFYmaFAvnpX3bG7d4KbS5I8FUWLcKuvw0="; + hash = "sha256-mNfwbW7TH/5Ug2A1gv/fyAsTG9fjl+YStiTiG/ad4uI="; }; "3.14-x86_64-linux" = getSrcFromPypi { platform = "manylinux_2_27_x86_64"; dist = "cp314"; - hash = "sha256-pYmLrB2KtgILVFRkQCVkCfLGa8u7OhCZykc8hIQ63a0="; + hash = "sha256-lELFh5/7QAfiU7p+cThmQls7pwg2PNuxoRM4KZwye70="; }; "3.14-aarch64-linux" = getSrcFromPypi { platform = "manylinux_2_27_aarch64"; dist = "cp314"; - hash = "sha256-WMUUc/xiLgMTgDWYX3QYM1ZNcKS9WiF49htizaoy/5Q="; + hash = "sha256-6pHYc/E6Y8QBwoOk9e6HC4EcsrgSLi9qp9Wr+iRBDzM="; }; }; in diff --git a/pkgs/development/python-modules/jax/default.nix b/pkgs/development/python-modules/jax/default.nix index d310e737c433..5332327123e3 100644 --- a/pkgs/development/python-modules/jax/default.nix +++ b/pkgs/development/python-modules/jax/default.nix @@ -39,17 +39,17 @@ let usingMKL = blas.implementation == "mkl" || lapack.implementation == "mkl"; in -buildPythonPackage rec { +buildPythonPackage (finalAttrs: { pname = "jax"; - version = "0.8.2"; + version = "0.9.0"; pyproject = true; src = fetchFromGitHub { owner = "google"; repo = "jax"; # google/jax contains tags for jax and jaxlib. Only use jax tags! - tag = "jax-v${version}"; - hash = "sha256-WKdFEhOxJPLjOXOChZbLRGcw0GFeg/TT/FT6M72C6bo="; + tag = "jax-v${finalAttrs.version}"; + hash = "sha256-XbwtXtozkCoQDiioqBmAWfmYuZOtBQGUr4JDNLu6RH0="; }; patches = [ @@ -73,7 +73,7 @@ buildPythonPackage rec { opt-einsum scipy ] - ++ lib.optionals cudaSupport optional-dependencies.cuda; + ++ lib.optionals cudaSupport finalAttrs.passthru.optional-dependencies.cuda; optional-dependencies = rec { cuda = [ jax-cuda12-plugin ]; @@ -194,4 +194,4 @@ buildPythonPackage rec { samuela ]; }; -} +}) diff --git a/pkgs/development/python-modules/jaxlib/bin.nix b/pkgs/development/python-modules/jaxlib/bin.nix index 42d80878bdf7..9ce41ccfb766 100644 --- a/pkgs/development/python-modules/jaxlib/bin.nix +++ b/pkgs/development/python-modules/jaxlib/bin.nix @@ -18,7 +18,7 @@ }: let - version = "0.8.2"; + version = "0.9.0"; inherit (python) pythonVersion; # As of 2023-06-06, google/jax upstream is no longer publishing CPU-only wheels to their GCS bucket. Instead the @@ -49,65 +49,65 @@ let "3.11-x86_64-linux" = getSrcFromPypi { platform = "manylinux_2_27_x86_64"; dist = "cp311"; - hash = "sha256-zPd9qReiCTUkfJkGkd7Py90Gwl7wrJTZFKBKrbIvcUw="; + hash = "sha256-n566AUWQQ1zsX6H2ryMQoaBduY1hMx0Y1rJ4/1QkzTM="; }; "3.11-aarch64-linux" = getSrcFromPypi { platform = "manylinux_2_27_aarch64"; dist = "cp311"; - hash = "sha256-u4m+RSsbgI0/iPwBxBWzZKJgvkzHrBIMA4AJ9hUKMtw="; + hash = "sha256-HyGRW0O3EfCrs8NdJjVr3NFqaCYdV/yP7+NwvG38q0o="; }; "3.11-aarch64-darwin" = getSrcFromPypi { platform = "macosx_11_0_arm64"; dist = "cp311"; - hash = "sha256-SQvwywKcc8ZclDESS4bNyVCC28H7dvxUnSTXXaM+VFQ="; + hash = "sha256-J3DiJQ55IxEfXiiBPlk0kv3j30AYW1C9yLxBuGa5mo4="; }; "3.12-x86_64-linux" = getSrcFromPypi { platform = "manylinux_2_27_x86_64"; dist = "cp312"; - hash = "sha256-K5eJvQj4sMxaXBKuiW/kMtWULjLkFwkbi1qWqab9XPE="; + hash = "sha256-kyWOi7+tOPkgemSXl+B79uf7MKjezmexSF+dVQxZEh8="; }; "3.12-aarch64-linux" = getSrcFromPypi { platform = "manylinux_2_27_aarch64"; dist = "cp312"; - hash = "sha256-OxblDFtzDJ3QpJ5V8az6pyKwCxrwUipZFVjcwEZCUvI="; + hash = "sha256-oZ4K03UWEZAHPRIiGzULPaKfl9nnKwvGQA0Nvxcc2l8="; }; "3.12-aarch64-darwin" = getSrcFromPypi { platform = "macosx_11_0_arm64"; dist = "cp312"; - hash = "sha256-Aj3m8/Vtoq9wN5cJllAFhjMf21C1MOy7VLlmbaYzvQA="; + hash = "sha256-PI0TvXSlX55UNVh3MLHuBnsX/EwpuJf0Z8CVADxjs30="; }; "3.13-x86_64-linux" = getSrcFromPypi { platform = "manylinux_2_27_x86_64"; dist = "cp313"; - hash = "sha256-G/vPbD3iIXhPpM22dloJ1xy0KYsVYms9BAmz382Khmc="; + hash = "sha256-aroYQYLEXkA7YtwmmgR0faVdoR2XWGJpcQGZIEJi1Ow="; }; "3.13-aarch64-linux" = getSrcFromPypi { platform = "manylinux_2_27_aarch64"; dist = "cp313"; - hash = "sha256-fDBPOgFpZbnR9SOaigOZpzkl9WBP6RTFymbs9zS/ZCI="; + hash = "sha256-fali/L38GAk+o3HPtUIPxwtR0xYNFb7wt4DmMSatJcA="; }; "3.13-aarch64-darwin" = getSrcFromPypi { platform = "macosx_11_0_arm64"; dist = "cp313"; - hash = "sha256-TQBtuWvgIMgWUhKhIWNy+KysT/T4+wZ3Q9aU7yswGs4="; + hash = "sha256-q89Qyp8PAV91YDX/AIA/XQT0KWR3X5NkINevvyO2HFw="; }; "3.14-x86_64-linux" = getSrcFromPypi { platform = "manylinux_2_27_x86_64"; dist = "cp314"; - hash = "sha256-5ql9+wIy7tmiu244KOT2gtusGn/qhAv9pXTK4tv1+vk="; + hash = "sha256-iB24QkNe1AZjwFB0X97PT3tIULFzinU4hQ0U6JR5gRU="; }; "3.14-aarch64-linux" = getSrcFromPypi { platform = "manylinux_2_27_aarch64"; dist = "cp314"; - hash = "sha256-aBCN/w3nStxGgBa+mhn4Dv5IxmDA1aEiKHCUtEsJKvw="; + hash = "sha256-trHqCQKTwuYt9kw/1NRvhfYLsYuCU7NYemLuU60UaQ8="; }; "3.14-aarch64-darwin" = getSrcFromPypi { platform = "macosx_11_0_arm64"; dist = "cp314"; - hash = "sha256-vv+wBOfutcmvskQ54rLPRaTuPj6K30XjVe3yr2Ks+Lg="; + hash = "sha256-MEYIFOhebP2hQnJv/LBtQhq2AJPKJIxyVsLs/RCoH9Y="; }; }; in From 8e747a6c0ae88a982ec176888cf66c9f89b9d4c6 Mon Sep 17 00:00:00 2001 From: Gaetan Lepage Date: Thu, 5 Feb 2026 20:13:35 +0000 Subject: [PATCH 28/59] python3Packages.jax: 0.9.0 -> 0.9.0.1 Diff: https://github.com/google/jax/compare/jax-v0.9.0...jax-v0.9.0.1 Changelog: https://docs.jax.dev/en/latest/changelog.html --- .../jax-cuda12-pjrt/default.nix | 4 +-- .../jax-cuda12-plugin/default.nix | 16 ++++++------ .../python-modules/jax/default.nix | 4 +-- .../development/python-modules/jaxlib/bin.nix | 26 +++++++++---------- 4 files changed, 25 insertions(+), 25 deletions(-) diff --git a/pkgs/development/python-modules/jax-cuda12-pjrt/default.nix b/pkgs/development/python-modules/jax-cuda12-pjrt/default.nix index 574e158f816d..1187bddb3704 100644 --- a/pkgs/development/python-modules/jax-cuda12-pjrt/default.nix +++ b/pkgs/development/python-modules/jax-cuda12-pjrt/default.nix @@ -50,8 +50,8 @@ buildPythonPackage (finalAttrs: { .${stdenv.hostPlatform.system}; hash = { - x86_64-linux = "sha256-vbPqvuQ1rJZ6/4su7aL3uc2B7QA/En301vHlX6XZRoQ="; - aarch64-linux = "sha256-I+V0uCdbYBUoV0JyDxrX28bw4VlcsJ47sh2HgXlTlT8="; + x86_64-linux = "sha256-nNvDxXNoWnJ0R8fItiimuDpZZS+2/0c+ehhjYEUWepY="; + aarch64-linux = "sha256-griB7iY3VWLtbknERLVLL5JNdiqslfUeW9eUy9H+oEQ="; } .${stdenv.hostPlatform.system}; }; diff --git a/pkgs/development/python-modules/jax-cuda12-plugin/default.nix b/pkgs/development/python-modules/jax-cuda12-plugin/default.nix index 841eecbd0448..b5c3f8eae966 100644 --- a/pkgs/development/python-modules/jax-cuda12-plugin/default.nix +++ b/pkgs/development/python-modules/jax-cuda12-plugin/default.nix @@ -39,42 +39,42 @@ let "3.11-x86_64-linux" = getSrcFromPypi { platform = "manylinux_2_27_x86_64"; dist = "cp311"; - hash = "sha256-iTh3d+FyGqq97aGKV3r8fP5O4KscN7MmG9Ryq43wcvc="; + hash = "sha256-0uHOs02KZ+MS2F5A5pqaI0Z1KffcagwsTRoY6x68tCk="; }; "3.11-aarch64-linux" = getSrcFromPypi { platform = "manylinux_2_27_aarch64"; dist = "cp311"; - hash = "sha256-ocPzEElPn3vmLyuEJXBcPEZvKmIbTk29v7Fa2aevvcA="; + hash = "sha256-oAxosFJqTpbx9tzJrwy+PkwwlpBq9+VLbY3JBkjAubs="; }; "3.12-x86_64-linux" = getSrcFromPypi { platform = "manylinux_2_27_x86_64"; dist = "cp312"; - hash = "sha256-NJNtd+1oWdoIwugYpRVMx++1hFHZ0Ew+zVtE02BfvfI="; + hash = "sha256-BE8rr9OR6CTQvt9AbVcpQ6zd8p3AZZw4T69Kim0HKsg="; }; "3.12-aarch64-linux" = getSrcFromPypi { platform = "manylinux_2_27_aarch64"; dist = "cp312"; - hash = "sha256-3i6vpuutVBA/CccRAOTkb36gl+jRGUWe+R6OWxTLn6I="; + hash = "sha256-TkEvqionVUPOFMn2AMRzOxvFHysNdlBgyF0EtV8hcFg="; }; "3.13-x86_64-linux" = getSrcFromPypi { platform = "manylinux_2_27_x86_64"; dist = "cp313"; - hash = "sha256-ZnkKIJR/f2RqKkqcXvghdW0sM/uZ3iqA5hKIwI3BeJo="; + hash = "sha256-3LeOJhu5Efvxds8xGBdsAwz5aqqlKO7HViEGJseO9oM="; }; "3.13-aarch64-linux" = getSrcFromPypi { platform = "manylinux_2_27_aarch64"; dist = "cp313"; - hash = "sha256-mNfwbW7TH/5Ug2A1gv/fyAsTG9fjl+YStiTiG/ad4uI="; + hash = "sha256-r1Jg0LnX1y+IvZGc7VR3+lEwUImbFvgQN35K5Oh2feg="; }; "3.14-x86_64-linux" = getSrcFromPypi { platform = "manylinux_2_27_x86_64"; dist = "cp314"; - hash = "sha256-lELFh5/7QAfiU7p+cThmQls7pwg2PNuxoRM4KZwye70="; + hash = "sha256-mq3bsTWgPJ6CbUfMoz+4rmHWi6wZyIGkM3TOqEIGNw8="; }; "3.14-aarch64-linux" = getSrcFromPypi { platform = "manylinux_2_27_aarch64"; dist = "cp314"; - hash = "sha256-6pHYc/E6Y8QBwoOk9e6HC4EcsrgSLi9qp9Wr+iRBDzM="; + hash = "sha256-t6cxqMF7nwpkD5TEI3k1ZdSK/m4of8nZ4K97Ei5CesE="; }; }; in diff --git a/pkgs/development/python-modules/jax/default.nix b/pkgs/development/python-modules/jax/default.nix index 5332327123e3..f3e1a52294a1 100644 --- a/pkgs/development/python-modules/jax/default.nix +++ b/pkgs/development/python-modules/jax/default.nix @@ -41,7 +41,7 @@ let in buildPythonPackage (finalAttrs: { pname = "jax"; - version = "0.9.0"; + version = "0.9.0.1"; pyproject = true; src = fetchFromGitHub { @@ -49,7 +49,7 @@ buildPythonPackage (finalAttrs: { repo = "jax"; # google/jax contains tags for jax and jaxlib. Only use jax tags! tag = "jax-v${finalAttrs.version}"; - hash = "sha256-XbwtXtozkCoQDiioqBmAWfmYuZOtBQGUr4JDNLu6RH0="; + hash = "sha256-6JFXDUeDPLKgl/+5O1WQm1LCvxmp8Kje9L647m9EtiM="; }; patches = [ diff --git a/pkgs/development/python-modules/jaxlib/bin.nix b/pkgs/development/python-modules/jaxlib/bin.nix index 9ce41ccfb766..e9ceb012fc48 100644 --- a/pkgs/development/python-modules/jaxlib/bin.nix +++ b/pkgs/development/python-modules/jaxlib/bin.nix @@ -18,7 +18,7 @@ }: let - version = "0.9.0"; + version = "0.9.0.1"; inherit (python) pythonVersion; # As of 2023-06-06, google/jax upstream is no longer publishing CPU-only wheels to their GCS bucket. Instead the @@ -49,65 +49,65 @@ let "3.11-x86_64-linux" = getSrcFromPypi { platform = "manylinux_2_27_x86_64"; dist = "cp311"; - hash = "sha256-n566AUWQQ1zsX6H2ryMQoaBduY1hMx0Y1rJ4/1QkzTM="; + hash = "sha256-3JXuMq4r1O2UetAhj9ZXa1CmDORbYHFNf/L9n6GV7Z4="; }; "3.11-aarch64-linux" = getSrcFromPypi { platform = "manylinux_2_27_aarch64"; dist = "cp311"; - hash = "sha256-HyGRW0O3EfCrs8NdJjVr3NFqaCYdV/yP7+NwvG38q0o="; + hash = "sha256-xKw8/XqqzDfzemozLuAJ3uOeO1CBu0tHP0EFg0Nr5VM="; }; "3.11-aarch64-darwin" = getSrcFromPypi { platform = "macosx_11_0_arm64"; dist = "cp311"; - hash = "sha256-J3DiJQ55IxEfXiiBPlk0kv3j30AYW1C9yLxBuGa5mo4="; + hash = "sha256-X/LFUNqyECeO06O5ZFSxkQigLgeVYlvlbcpaGByYM8k="; }; "3.12-x86_64-linux" = getSrcFromPypi { platform = "manylinux_2_27_x86_64"; dist = "cp312"; - hash = "sha256-kyWOi7+tOPkgemSXl+B79uf7MKjezmexSF+dVQxZEh8="; + hash = "sha256-4OSgok75jsAhuROZH72gmuuWSBsbwOUwCgM5qtIWsiY="; }; "3.12-aarch64-linux" = getSrcFromPypi { platform = "manylinux_2_27_aarch64"; dist = "cp312"; - hash = "sha256-oZ4K03UWEZAHPRIiGzULPaKfl9nnKwvGQA0Nvxcc2l8="; + hash = "sha256-Xqjr1iFltvGPibAvq3SeAvXFhMKhxwPwRZLU2AP56YE="; }; "3.12-aarch64-darwin" = getSrcFromPypi { platform = "macosx_11_0_arm64"; dist = "cp312"; - hash = "sha256-PI0TvXSlX55UNVh3MLHuBnsX/EwpuJf0Z8CVADxjs30="; + hash = "sha256-Nwe/ClhBDafAU8Fexu/uH+EucDYUFuBV5BCbgEH0EZs="; }; "3.13-x86_64-linux" = getSrcFromPypi { platform = "manylinux_2_27_x86_64"; dist = "cp313"; - hash = "sha256-aroYQYLEXkA7YtwmmgR0faVdoR2XWGJpcQGZIEJi1Ow="; + hash = "sha256-VN0tNMa+xPCZ+Iii94lQaaR8O6hqqnewt46cP575SPE="; }; "3.13-aarch64-linux" = getSrcFromPypi { platform = "manylinux_2_27_aarch64"; dist = "cp313"; - hash = "sha256-fali/L38GAk+o3HPtUIPxwtR0xYNFb7wt4DmMSatJcA="; + hash = "sha256-tzuF+SfZsAbwdiLVZ2CS6rkWZFxIBP7WVo2l+0pUHfw="; }; "3.13-aarch64-darwin" = getSrcFromPypi { platform = "macosx_11_0_arm64"; dist = "cp313"; - hash = "sha256-q89Qyp8PAV91YDX/AIA/XQT0KWR3X5NkINevvyO2HFw="; + hash = "sha256-6FfK/dEuGEk9ltSikO0xqp2ZoNwwVrS0KXTA80LJuww="; }; "3.14-x86_64-linux" = getSrcFromPypi { platform = "manylinux_2_27_x86_64"; dist = "cp314"; - hash = "sha256-iB24QkNe1AZjwFB0X97PT3tIULFzinU4hQ0U6JR5gRU="; + hash = "sha256-5h6IAy7rMTOccurZ7WDGFTzSIiUSYkyq3qZ8NQx4Qy4="; }; "3.14-aarch64-linux" = getSrcFromPypi { platform = "manylinux_2_27_aarch64"; dist = "cp314"; - hash = "sha256-trHqCQKTwuYt9kw/1NRvhfYLsYuCU7NYemLuU60UaQ8="; + hash = "sha256-gjSM7hUh1hIwOMTDvur6IHbI9K4pojO4q/+dbci0QUU="; }; "3.14-aarch64-darwin" = getSrcFromPypi { platform = "macosx_11_0_arm64"; dist = "cp314"; - hash = "sha256-MEYIFOhebP2hQnJv/LBtQhq2AJPKJIxyVsLs/RCoH9Y="; + hash = "sha256-QycuUuXInbxPAsfMtv+l1YegmsjbUWPLDEPhJbcHUSk="; }; }; in From af3bfc68cb71e43c432a5b238b1fee4421974e84 Mon Sep 17 00:00:00 2001 From: Gaetan Lepage Date: Wed, 4 Mar 2026 20:53:03 +0000 Subject: [PATCH 29/59] python3Packages.jax: 0.9.0.1 -> 0.9.1 Diff: https://github.com/google/jax/compare/jax-v0.9.0.1...jax-v0.9.1 Changelog: https://docs.jax.dev/en/latest/changelog.html --- .../jax-cuda12-plugin/default.nix | 16 ++++++------ .../python-modules/jax/default.nix | 4 +-- .../development/python-modules/jaxlib/bin.nix | 26 +++++++++---------- 3 files changed, 23 insertions(+), 23 deletions(-) diff --git a/pkgs/development/python-modules/jax-cuda12-plugin/default.nix b/pkgs/development/python-modules/jax-cuda12-plugin/default.nix index b5c3f8eae966..ab9db8737e42 100644 --- a/pkgs/development/python-modules/jax-cuda12-plugin/default.nix +++ b/pkgs/development/python-modules/jax-cuda12-plugin/default.nix @@ -39,42 +39,42 @@ let "3.11-x86_64-linux" = getSrcFromPypi { platform = "manylinux_2_27_x86_64"; dist = "cp311"; - hash = "sha256-0uHOs02KZ+MS2F5A5pqaI0Z1KffcagwsTRoY6x68tCk="; + hash = "sha256-qN7q6sJFY5tNyN5h4JYO+kMv9bDpXPda0ujWuAyayiU="; }; "3.11-aarch64-linux" = getSrcFromPypi { platform = "manylinux_2_27_aarch64"; dist = "cp311"; - hash = "sha256-oAxosFJqTpbx9tzJrwy+PkwwlpBq9+VLbY3JBkjAubs="; + hash = "sha256-OeCtsKTL0nwK35hweMYp+gR1QqJlgPuLJT8Ni6A7wdk="; }; "3.12-x86_64-linux" = getSrcFromPypi { platform = "manylinux_2_27_x86_64"; dist = "cp312"; - hash = "sha256-BE8rr9OR6CTQvt9AbVcpQ6zd8p3AZZw4T69Kim0HKsg="; + hash = "sha256-9MId5FB7HEQvThC+sSPkuRYFW/9MAQJymqKkny7Q/Ig="; }; "3.12-aarch64-linux" = getSrcFromPypi { platform = "manylinux_2_27_aarch64"; dist = "cp312"; - hash = "sha256-TkEvqionVUPOFMn2AMRzOxvFHysNdlBgyF0EtV8hcFg="; + hash = "sha256-KEPKQnhhehmfnwo9mS2GhPq+i+r5iP95PsGdg2vcrcQ="; }; "3.13-x86_64-linux" = getSrcFromPypi { platform = "manylinux_2_27_x86_64"; dist = "cp313"; - hash = "sha256-3LeOJhu5Efvxds8xGBdsAwz5aqqlKO7HViEGJseO9oM="; + hash = "sha256-OJyJYham1K94cJqPTKdZFqtP97v0sa9cCdzpgjwAO3M="; }; "3.13-aarch64-linux" = getSrcFromPypi { platform = "manylinux_2_27_aarch64"; dist = "cp313"; - hash = "sha256-r1Jg0LnX1y+IvZGc7VR3+lEwUImbFvgQN35K5Oh2feg="; + hash = "sha256-0b8zdIGciofpDfBLcUQnLlrAcnpeH8SHJTHFLjh8Djg="; }; "3.14-x86_64-linux" = getSrcFromPypi { platform = "manylinux_2_27_x86_64"; dist = "cp314"; - hash = "sha256-mq3bsTWgPJ6CbUfMoz+4rmHWi6wZyIGkM3TOqEIGNw8="; + hash = "sha256-VYiCVcMl+Yr5Yc9fZlyoIj0ONjY+tUT8AoYne+IyTo8="; }; "3.14-aarch64-linux" = getSrcFromPypi { platform = "manylinux_2_27_aarch64"; dist = "cp314"; - hash = "sha256-t6cxqMF7nwpkD5TEI3k1ZdSK/m4of8nZ4K97Ei5CesE="; + hash = "sha256-0ErFz/SNGPhJfZnCWibxW7LfO6KHpOXrhsYcifBYwvk="; }; }; in diff --git a/pkgs/development/python-modules/jax/default.nix b/pkgs/development/python-modules/jax/default.nix index f3e1a52294a1..524f767f7f11 100644 --- a/pkgs/development/python-modules/jax/default.nix +++ b/pkgs/development/python-modules/jax/default.nix @@ -41,7 +41,7 @@ let in buildPythonPackage (finalAttrs: { pname = "jax"; - version = "0.9.0.1"; + version = "0.9.1"; pyproject = true; src = fetchFromGitHub { @@ -49,7 +49,7 @@ buildPythonPackage (finalAttrs: { repo = "jax"; # google/jax contains tags for jax and jaxlib. Only use jax tags! tag = "jax-v${finalAttrs.version}"; - hash = "sha256-6JFXDUeDPLKgl/+5O1WQm1LCvxmp8Kje9L647m9EtiM="; + hash = "sha256-Q6pjHl102OIlGphRO4GwaWz0Kbj/4JAfIUoOdEKh8Zw="; }; patches = [ diff --git a/pkgs/development/python-modules/jaxlib/bin.nix b/pkgs/development/python-modules/jaxlib/bin.nix index e9ceb012fc48..1607d03585ac 100644 --- a/pkgs/development/python-modules/jaxlib/bin.nix +++ b/pkgs/development/python-modules/jaxlib/bin.nix @@ -18,7 +18,7 @@ }: let - version = "0.9.0.1"; + version = "0.9.1"; inherit (python) pythonVersion; # As of 2023-06-06, google/jax upstream is no longer publishing CPU-only wheels to their GCS bucket. Instead the @@ -49,65 +49,65 @@ let "3.11-x86_64-linux" = getSrcFromPypi { platform = "manylinux_2_27_x86_64"; dist = "cp311"; - hash = "sha256-3JXuMq4r1O2UetAhj9ZXa1CmDORbYHFNf/L9n6GV7Z4="; + hash = "sha256-lyOTSM2V1bM1b0dfqDdAjkyg3yZFVAnq7l+NQvREnHU="; }; "3.11-aarch64-linux" = getSrcFromPypi { platform = "manylinux_2_27_aarch64"; dist = "cp311"; - hash = "sha256-xKw8/XqqzDfzemozLuAJ3uOeO1CBu0tHP0EFg0Nr5VM="; + hash = "sha256-3BCFRQ39WC1khCamXlvYf38vFNrWamvaSqziZHH0UL8="; }; "3.11-aarch64-darwin" = getSrcFromPypi { platform = "macosx_11_0_arm64"; dist = "cp311"; - hash = "sha256-X/LFUNqyECeO06O5ZFSxkQigLgeVYlvlbcpaGByYM8k="; + hash = "sha256-KXawnDoLl0A5EuniqIiTxMbmYpl04pQZQ+mh/049sIw="; }; "3.12-x86_64-linux" = getSrcFromPypi { platform = "manylinux_2_27_x86_64"; dist = "cp312"; - hash = "sha256-4OSgok75jsAhuROZH72gmuuWSBsbwOUwCgM5qtIWsiY="; + hash = "sha256-4quMl74wNUo05k0XBm3w/OfR0PQPekjt7Rnp6DeJb10="; }; "3.12-aarch64-linux" = getSrcFromPypi { platform = "manylinux_2_27_aarch64"; dist = "cp312"; - hash = "sha256-Xqjr1iFltvGPibAvq3SeAvXFhMKhxwPwRZLU2AP56YE="; + hash = "sha256-+A6K6tNGFoNlcCfhToFOW90Avozo4FwKXbhkA9spfC4="; }; "3.12-aarch64-darwin" = getSrcFromPypi { platform = "macosx_11_0_arm64"; dist = "cp312"; - hash = "sha256-Nwe/ClhBDafAU8Fexu/uH+EucDYUFuBV5BCbgEH0EZs="; + hash = "sha256-zqf5ihpVj6tc+PVp5VZ6PCiGZ90iMmGtrrlkXDfkrYs="; }; "3.13-x86_64-linux" = getSrcFromPypi { platform = "manylinux_2_27_x86_64"; dist = "cp313"; - hash = "sha256-VN0tNMa+xPCZ+Iii94lQaaR8O6hqqnewt46cP575SPE="; + hash = "sha256-2mDZZ7SsIISj41Na2YI5KJTda995yaVpeKughASljII="; }; "3.13-aarch64-linux" = getSrcFromPypi { platform = "manylinux_2_27_aarch64"; dist = "cp313"; - hash = "sha256-tzuF+SfZsAbwdiLVZ2CS6rkWZFxIBP7WVo2l+0pUHfw="; + hash = "sha256-nojDUkizfVIZQj/43cpgxqVh5mXe1cT8vGHwdj4D8eM="; }; "3.13-aarch64-darwin" = getSrcFromPypi { platform = "macosx_11_0_arm64"; dist = "cp313"; - hash = "sha256-6FfK/dEuGEk9ltSikO0xqp2ZoNwwVrS0KXTA80LJuww="; + hash = "sha256-6ZFbyqn/79QM0/2wioOxa3nx88m6GHiE9bRCrSpH/9E="; }; "3.14-x86_64-linux" = getSrcFromPypi { platform = "manylinux_2_27_x86_64"; dist = "cp314"; - hash = "sha256-5h6IAy7rMTOccurZ7WDGFTzSIiUSYkyq3qZ8NQx4Qy4="; + hash = "sha256-IoehyJGxUsUuubc5JfV83gG+NdK6tNrZZz08g8WYLKg="; }; "3.14-aarch64-linux" = getSrcFromPypi { platform = "manylinux_2_27_aarch64"; dist = "cp314"; - hash = "sha256-gjSM7hUh1hIwOMTDvur6IHbI9K4pojO4q/+dbci0QUU="; + hash = "sha256-Ux3/n6566hREnuVEzBQViAzIo0apKH00fb0bK1HYqr0="; }; "3.14-aarch64-darwin" = getSrcFromPypi { platform = "macosx_11_0_arm64"; dist = "cp314"; - hash = "sha256-QycuUuXInbxPAsfMtv+l1YegmsjbUWPLDEPhJbcHUSk="; + hash = "sha256-MHG/ST9vSCB8VrHppb+JXirOvFvUD281RY5264vyEMc="; }; }; in From c12a54c9410210e916fc744d005662db048f7534 Mon Sep 17 00:00:00 2001 From: Gaetan Lepage Date: Fri, 20 Mar 2026 09:14:57 +0000 Subject: [PATCH 30/59] python3Packages.jax: 0.9.1 -> 0.9.2 Diff: https://github.com/google/jax/compare/jax-v0.9.1...jax-v0.9.2 Changelog: https://docs.jax.dev/en/latest/changelog.html --- .../jax-cuda12-pjrt/default.nix | 4 +-- .../jax-cuda12-plugin/default.nix | 16 ++++++------ .../python-modules/jax/default.nix | 4 +-- .../development/python-modules/jaxlib/bin.nix | 26 +++++++++---------- 4 files changed, 25 insertions(+), 25 deletions(-) diff --git a/pkgs/development/python-modules/jax-cuda12-pjrt/default.nix b/pkgs/development/python-modules/jax-cuda12-pjrt/default.nix index 1187bddb3704..c7826b24546f 100644 --- a/pkgs/development/python-modules/jax-cuda12-pjrt/default.nix +++ b/pkgs/development/python-modules/jax-cuda12-pjrt/default.nix @@ -50,8 +50,8 @@ buildPythonPackage (finalAttrs: { .${stdenv.hostPlatform.system}; hash = { - x86_64-linux = "sha256-nNvDxXNoWnJ0R8fItiimuDpZZS+2/0c+ehhjYEUWepY="; - aarch64-linux = "sha256-griB7iY3VWLtbknERLVLL5JNdiqslfUeW9eUy9H+oEQ="; + x86_64-linux = "sha256-U2owUpInbFdF77un61dXaEnFp8dzmKOp5h/TG69RAvA="; + aarch64-linux = "sha256-VvSifl8ZypFMD0QCU5RpqpLQG/cTNqzQ7Y/dwgqRvI0="; } .${stdenv.hostPlatform.system}; }; diff --git a/pkgs/development/python-modules/jax-cuda12-plugin/default.nix b/pkgs/development/python-modules/jax-cuda12-plugin/default.nix index ab9db8737e42..0ccf040f552f 100644 --- a/pkgs/development/python-modules/jax-cuda12-plugin/default.nix +++ b/pkgs/development/python-modules/jax-cuda12-plugin/default.nix @@ -39,42 +39,42 @@ let "3.11-x86_64-linux" = getSrcFromPypi { platform = "manylinux_2_27_x86_64"; dist = "cp311"; - hash = "sha256-qN7q6sJFY5tNyN5h4JYO+kMv9bDpXPda0ujWuAyayiU="; + hash = "sha256-1Vd82Ge9kmd2nkU7rYUNSAeoQ5a8l29jKlFe29d+SEs="; }; "3.11-aarch64-linux" = getSrcFromPypi { platform = "manylinux_2_27_aarch64"; dist = "cp311"; - hash = "sha256-OeCtsKTL0nwK35hweMYp+gR1QqJlgPuLJT8Ni6A7wdk="; + hash = "sha256-s5VfN10XkC8NJ+cFlnLNGWOlU0WVOkJpnk4HjOxyWtw="; }; "3.12-x86_64-linux" = getSrcFromPypi { platform = "manylinux_2_27_x86_64"; dist = "cp312"; - hash = "sha256-9MId5FB7HEQvThC+sSPkuRYFW/9MAQJymqKkny7Q/Ig="; + hash = "sha256-iKVZCNd1sG3akqjE9MAVd44lulw2BbV/hLAAUvZujvE="; }; "3.12-aarch64-linux" = getSrcFromPypi { platform = "manylinux_2_27_aarch64"; dist = "cp312"; - hash = "sha256-KEPKQnhhehmfnwo9mS2GhPq+i+r5iP95PsGdg2vcrcQ="; + hash = "sha256-sozPBbzAvHzLy9Mm2AKEZXTPbaA5FY52FHvZb1xvEYk="; }; "3.13-x86_64-linux" = getSrcFromPypi { platform = "manylinux_2_27_x86_64"; dist = "cp313"; - hash = "sha256-OJyJYham1K94cJqPTKdZFqtP97v0sa9cCdzpgjwAO3M="; + hash = "sha256-vX3+0Xv6nQ4wFvjCpnZ8dHnZHhvf33kW6ysHQ1zEZY4="; }; "3.13-aarch64-linux" = getSrcFromPypi { platform = "manylinux_2_27_aarch64"; dist = "cp313"; - hash = "sha256-0b8zdIGciofpDfBLcUQnLlrAcnpeH8SHJTHFLjh8Djg="; + hash = "sha256-uaJwhdiTzFnCsoaxeJdV+Rzz6rHeobW+nmMvTJc5og4="; }; "3.14-x86_64-linux" = getSrcFromPypi { platform = "manylinux_2_27_x86_64"; dist = "cp314"; - hash = "sha256-VYiCVcMl+Yr5Yc9fZlyoIj0ONjY+tUT8AoYne+IyTo8="; + hash = "sha256-U1F0LA/LIdqeCUoZZasg/eUlhih392kYpJCxtWZk1To="; }; "3.14-aarch64-linux" = getSrcFromPypi { platform = "manylinux_2_27_aarch64"; dist = "cp314"; - hash = "sha256-0ErFz/SNGPhJfZnCWibxW7LfO6KHpOXrhsYcifBYwvk="; + hash = "sha256-MyEmmeG7sb7V0q4Urp/3Kh7tLQkqUearzAJ4prK4KHQ="; }; }; in diff --git a/pkgs/development/python-modules/jax/default.nix b/pkgs/development/python-modules/jax/default.nix index 524f767f7f11..c68c1e516388 100644 --- a/pkgs/development/python-modules/jax/default.nix +++ b/pkgs/development/python-modules/jax/default.nix @@ -41,7 +41,7 @@ let in buildPythonPackage (finalAttrs: { pname = "jax"; - version = "0.9.1"; + version = "0.9.2"; pyproject = true; src = fetchFromGitHub { @@ -49,7 +49,7 @@ buildPythonPackage (finalAttrs: { repo = "jax"; # google/jax contains tags for jax and jaxlib. Only use jax tags! tag = "jax-v${finalAttrs.version}"; - hash = "sha256-Q6pjHl102OIlGphRO4GwaWz0Kbj/4JAfIUoOdEKh8Zw="; + hash = "sha256-/vLCTAF46M1H0Q64RLM7+IFMofmjZmZ4IFzvm/y7zkg="; }; patches = [ diff --git a/pkgs/development/python-modules/jaxlib/bin.nix b/pkgs/development/python-modules/jaxlib/bin.nix index 1607d03585ac..ef55de72ac84 100644 --- a/pkgs/development/python-modules/jaxlib/bin.nix +++ b/pkgs/development/python-modules/jaxlib/bin.nix @@ -18,7 +18,7 @@ }: let - version = "0.9.1"; + version = "0.9.2"; inherit (python) pythonVersion; # As of 2023-06-06, google/jax upstream is no longer publishing CPU-only wheels to their GCS bucket. Instead the @@ -49,65 +49,65 @@ let "3.11-x86_64-linux" = getSrcFromPypi { platform = "manylinux_2_27_x86_64"; dist = "cp311"; - hash = "sha256-lyOTSM2V1bM1b0dfqDdAjkyg3yZFVAnq7l+NQvREnHU="; + hash = "sha256-msmVtLoaru2uDWnzGZh9UV3K7NRQW2QrYxL54VQ5NR8="; }; "3.11-aarch64-linux" = getSrcFromPypi { platform = "manylinux_2_27_aarch64"; dist = "cp311"; - hash = "sha256-3BCFRQ39WC1khCamXlvYf38vFNrWamvaSqziZHH0UL8="; + hash = "sha256-MG3lSh3nOGyAbHI+NWzjMtkj73SPinLWdP77dIEh1Nw="; }; "3.11-aarch64-darwin" = getSrcFromPypi { platform = "macosx_11_0_arm64"; dist = "cp311"; - hash = "sha256-KXawnDoLl0A5EuniqIiTxMbmYpl04pQZQ+mh/049sIw="; + hash = "sha256-eF8XfD63jLfceXxV7VxLYxIUGEXJpoaVfkhLrL/OXog="; }; "3.12-x86_64-linux" = getSrcFromPypi { platform = "manylinux_2_27_x86_64"; dist = "cp312"; - hash = "sha256-4quMl74wNUo05k0XBm3w/OfR0PQPekjt7Rnp6DeJb10="; + hash = "sha256-iLJ2px9PIHGx/S6SKr/WfIfGl3pVGhA2/rzqeNXvfiI="; }; "3.12-aarch64-linux" = getSrcFromPypi { platform = "manylinux_2_27_aarch64"; dist = "cp312"; - hash = "sha256-+A6K6tNGFoNlcCfhToFOW90Avozo4FwKXbhkA9spfC4="; + hash = "sha256-/vAthGhjtybnJFKZOIOoWW6sMl8ioux+qSHaD7xVCbQ="; }; "3.12-aarch64-darwin" = getSrcFromPypi { platform = "macosx_11_0_arm64"; dist = "cp312"; - hash = "sha256-zqf5ihpVj6tc+PVp5VZ6PCiGZ90iMmGtrrlkXDfkrYs="; + hash = "sha256-l8L75Yy+5KJ9lMpzXXCdIxspmrbtizsQdfUthk39MsE="; }; "3.13-x86_64-linux" = getSrcFromPypi { platform = "manylinux_2_27_x86_64"; dist = "cp313"; - hash = "sha256-2mDZZ7SsIISj41Na2YI5KJTda995yaVpeKughASljII="; + hash = "sha256-ttUAPjrdXDRqNK6e3EcFjLwttgyO1cUAllIhdtrwHJ8="; }; "3.13-aarch64-linux" = getSrcFromPypi { platform = "manylinux_2_27_aarch64"; dist = "cp313"; - hash = "sha256-nojDUkizfVIZQj/43cpgxqVh5mXe1cT8vGHwdj4D8eM="; + hash = "sha256-vvYe7zbtOM7BBp6pc/iK+eAzNeiE9lAew/5/YiKhVVs="; }; "3.13-aarch64-darwin" = getSrcFromPypi { platform = "macosx_11_0_arm64"; dist = "cp313"; - hash = "sha256-6ZFbyqn/79QM0/2wioOxa3nx88m6GHiE9bRCrSpH/9E="; + hash = "sha256-UqADJQj4z1eRx6e+4UJTHucGw8BVGBF/sLbujV4X/ec="; }; "3.14-x86_64-linux" = getSrcFromPypi { platform = "manylinux_2_27_x86_64"; dist = "cp314"; - hash = "sha256-IoehyJGxUsUuubc5JfV83gG+NdK6tNrZZz08g8WYLKg="; + hash = "sha256-PXFRFApJNvMhiy0bE0PdI3vShlz1FEKIS22C/ohKPec="; }; "3.14-aarch64-linux" = getSrcFromPypi { platform = "manylinux_2_27_aarch64"; dist = "cp314"; - hash = "sha256-Ux3/n6566hREnuVEzBQViAzIo0apKH00fb0bK1HYqr0="; + hash = "sha256-vkYnxC1Erdf+F9KE71ef+NFZ48tpR/ZDd1jzQXfoeOY="; }; "3.14-aarch64-darwin" = getSrcFromPypi { platform = "macosx_11_0_arm64"; dist = "cp314"; - hash = "sha256-MHG/ST9vSCB8VrHppb+JXirOvFvUD281RY5264vyEMc="; + hash = "sha256-urFo0lVVRkRhvQdzI0hPaQxHHmnOiww5o5+4Gz46i/A="; }; }; in From 4201b149f86838313e2c8d0eb54be0dd1cec9f46 Mon Sep 17 00:00:00 2001 From: Gaetan Lepage Date: Wed, 21 Jan 2026 21:58:20 +0000 Subject: [PATCH 31/59] python3Packages.orbax-checkpoint: minor cleanup --- pkgs/development/python-modules/orbax-checkpoint/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/python-modules/orbax-checkpoint/default.nix b/pkgs/development/python-modules/orbax-checkpoint/default.nix index f2f43a81c987..e101000ed58b 100644 --- a/pkgs/development/python-modules/orbax-checkpoint/default.nix +++ b/pkgs/development/python-modules/orbax-checkpoint/default.nix @@ -149,6 +149,7 @@ buildPythonPackage (finalAttrs: { "orbax/checkpoint/_src/path/snapshot/snapshot_test.py" # Circular dependency flax + "orbax/checkpoint/_src/handlers/pytree_checkpoint_handler_test.py" "orbax/checkpoint/_src/metadata/empty_values_test.py" "orbax/checkpoint/_src/metadata/tree_rich_types_test.py" "orbax/checkpoint/_src/metadata/tree_test.py" @@ -159,13 +160,12 @@ buildPythonPackage (finalAttrs: { "orbax/checkpoint/checkpoint_manager_test.py" "orbax/checkpoint/single_host_test.py" "orbax/checkpoint/transform_utils_test.py" - "orbax/checkpoint/_src/handlers/pytree_checkpoint_handler_test.py" ]; meta = { description = "Orbax provides common utility libraries for JAX users"; homepage = "https://github.com/google/orbax/tree/main/checkpoint"; - changelog = "https://github.com/google/orbax/blob/v${finalAttrs.version}/checkpoint/CHANGELOG.md"; + changelog = "https://github.com/google/orbax/blob/${finalAttrs.src.tag}/checkpoint/CHANGELOG.md"; license = lib.licenses.asl20; maintainers = with lib.maintainers; [ fab ]; }; From 7eab8eab6d681d277dadf28edf7792f05a356f85 Mon Sep 17 00:00:00 2001 From: Gaetan Lepage Date: Sat, 24 Jan 2026 23:29:15 +0100 Subject: [PATCH 32/59] python3Packages.jaxtyping: 0.3.5 -> 0.3.9 Diff: https://github.com/patrick-kidger/jaxtyping/compare/v0.3.5...v0.3.9 Changelog: https://github.com/patrick-kidger/jaxtyping/releases/tag/v0.3.9 --- .../development/python-modules/jaxtyping/default.nix | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/pkgs/development/python-modules/jaxtyping/default.nix b/pkgs/development/python-modules/jaxtyping/default.nix index 8390583865b8..36735b912689 100644 --- a/pkgs/development/python-modules/jaxtyping/default.nix +++ b/pkgs/development/python-modules/jaxtyping/default.nix @@ -2,6 +2,7 @@ lib, buildPythonPackage, fetchFromGitHub, + pythonOlder, # build-system hatchling, @@ -16,8 +17,9 @@ jax, jaxlib, pytestCheckHook, - tensorflow, torch, + # python <= 3.12 only + tensorflow, # passthru jaxtyping, @@ -25,14 +27,14 @@ buildPythonPackage (finalAttrs: { pname = "jaxtyping"; - version = "0.3.5"; + version = "0.3.9"; pyproject = true; src = fetchFromGitHub { owner = "patrick-kidger"; repo = "jaxtyping"; tag = "v${finalAttrs.version}"; - hash = "sha256-0Vt6UD1xQkwve6yDVi5XQCoJ/IsJWHCkGesj66myQq4="; + hash = "sha256-Ex84xtns3wtIodXdpC6/88Kn0I+33B7ScHPIc9C5tuY="; }; build-system = [ hatchling ]; @@ -50,8 +52,10 @@ buildPythonPackage (finalAttrs: { jax jaxlib pytestCheckHook - tensorflow torch + ] + ++ lib.optionals (pythonOlder "3.13") [ + tensorflow ]; doCheck = false; From 61aeb276a9f38c1e214b935c3dcd66356351a190 Mon Sep 17 00:00:00 2001 From: Gaetan Lepage Date: Sun, 25 Jan 2026 00:16:11 +0100 Subject: [PATCH 33/59] python3Packages.equinox: skip failing test --- .../python-modules/equinox/default.nix | 18 +++++------------- 1 file changed, 5 insertions(+), 13 deletions(-) diff --git a/pkgs/development/python-modules/equinox/default.nix b/pkgs/development/python-modules/equinox/default.nix index 29337297d713..364f8c1366cc 100644 --- a/pkgs/development/python-modules/equinox/default.nix +++ b/pkgs/development/python-modules/equinox/default.nix @@ -1,6 +1,5 @@ { lib, - stdenv, buildPythonPackage, fetchFromGitHub, @@ -39,12 +38,6 @@ buildPythonPackage rec { --replace-fail "speed < 0.5" "speed < 1" \ --replace-fail "speed < 1" "speed < 20" \ --replace-fail "speed < 2" "speed < 20" - '' - # Fix jax 0.8.2 compat - # Fix submitted upstream: https://github.com/patrick-kidger/equinox/pull/1162 - + '' - substituteInPlace equinox/_ad.py equinox/internal/_primitive.py \ - --replace-fail "jax.core.get_aval(" "jax.typeof(" ''; build-system = [ hatchling ]; @@ -69,12 +62,11 @@ buildPythonPackage rec { ]; disabledTests = [ - # Failed: DID NOT WARN. No warnings of type (,) were emitted. - "test_jax_transform_warn" - ] - ++ lib.optionals stdenv.hostPlatform.isDarwin [ - # SystemError: nanobind::detail::nb_func_error_except(): exception could not be translated! - "test_filter" + # ValueError: The spec of NamedSharding passed to with_sharding_constraint can only refer to + # Auto axes of the mesh. + # https://github.com/patrick-kidger/equinox/issues/1171 + "test_sharding_no_inside_jit" + "test_sharding_only_inside_jit" ]; pythonImportsCheck = [ "equinox" ]; From 32258e246fe3eba7a91523b554981b02fd9dc371 Mon Sep 17 00:00:00 2001 From: Gaetan Lepage Date: Sun, 25 Jan 2026 01:47:00 +0100 Subject: [PATCH 34/59] python3Packages.equinox: 0.13.2 -> 0.13.6 Diff: https://github.com/patrick-kidger/equinox/compare/v0.13.2...v0.13.6 Changelog: https://github.com/patrick-kidger/equinox/releases/tag/v0.13.6 --- .../python-modules/equinox/default.nix | 28 +++++++++++-------- 1 file changed, 17 insertions(+), 11 deletions(-) diff --git a/pkgs/development/python-modules/equinox/default.nix b/pkgs/development/python-modules/equinox/default.nix index 364f8c1366cc..841e4f2858ab 100644 --- a/pkgs/development/python-modules/equinox/default.nix +++ b/pkgs/development/python-modules/equinox/default.nix @@ -19,16 +19,16 @@ pytestCheckHook, }: -buildPythonPackage rec { +buildPythonPackage (finalAttrs: { pname = "equinox"; - version = "0.13.2"; + version = "0.13.6"; pyproject = true; src = fetchFromGitHub { owner = "patrick-kidger"; repo = "equinox"; - tag = "v${version}"; - hash = "sha256-d7IqRuohcZ3IYpbjm76Ir6I33zI5dnHvX5eX2WjSJQk="; + tag = "v${finalAttrs.version}"; + hash = "sha256-OETWXAcCp945mMrpC8U4gSBvEeQX8RoUGZR4irBs7Ak="; }; # Relax speed constraints on tests that can fail on busy builders @@ -61,21 +61,27 @@ buildPythonPackage rec { "-Wignore::DeprecationWarning" ]; + disabledTestPaths = [ + # ValueError: not enough values to unpack (expected 2, got 0) + "tests/test_finalise_jaxpr.py" + ]; + disabledTests = [ - # ValueError: The spec of NamedSharding passed to with_sharding_constraint can only refer to - # Auto axes of the mesh. - # https://github.com/patrick-kidger/equinox/issues/1171 - "test_sharding_no_inside_jit" - "test_sharding_only_inside_jit" + # Failed: DID NOT WARN. No warnings of type (,) were emitted. + # Reported upstream: https://github.com/patrick-kidger/equinox/issues/1186 + "test_jax_transform_warn" + + # Flaky: AssertionError: Non-linear scaling detected + "test_speed_buffer_while" ]; pythonImportsCheck = [ "equinox" ]; meta = { description = "JAX library based around a simple idea: represent parameterised functions (such as neural networks) as PyTrees"; - changelog = "https://github.com/patrick-kidger/equinox/releases/tag/v${version}"; + changelog = "https://github.com/patrick-kidger/equinox/releases/tag/${finalAttrs.src.tag}"; homepage = "https://github.com/patrick-kidger/equinox"; license = lib.licenses.asl20; maintainers = with lib.maintainers; [ GaetanLepage ]; }; -} +}) From ba0656bc50e7d0e9b915381e34541731decae38b Mon Sep 17 00:00:00 2001 From: Gaetan Lepage Date: Wed, 28 Jan 2026 00:24:58 +0000 Subject: [PATCH 35/59] python3Packages.orbax-export: init at 0.0.8 --- .../python-modules/orbax-export/default.nix | 90 +++++++++++++++++++ pkgs/top-level/python-packages.nix | 2 + 2 files changed, 92 insertions(+) create mode 100644 pkgs/development/python-modules/orbax-export/default.nix diff --git a/pkgs/development/python-modules/orbax-export/default.nix b/pkgs/development/python-modules/orbax-export/default.nix new file mode 100644 index 000000000000..0bbeac1778ef --- /dev/null +++ b/pkgs/development/python-modules/orbax-export/default.nix @@ -0,0 +1,90 @@ +{ + lib, + buildPythonPackage, + fetchPypi, + + # build-system + flit-core, + + # dependencies + absl-py, + dataclasses-json, + etils, + jax, + jaxlib, + jaxtyping, + numpy, + orbax-checkpoint, + protobuf, + tensorflow, + + # tests + chex, + flax, + pytestCheckHook, + + # passthru + orbax-export, +}: + +buildPythonPackage (finalAttrs: { + pname = "orbax-export"; + version = "0.0.8"; + pyproject = true; + + # Tags on the GitHub repo don't match the Pypi releases for orbax-export + src = fetchPypi { + pname = "orbax_export"; + inherit (finalAttrs) version; + hash = "sha256-VE7vVk4qbxfNEbEWf+vjSLe3z1bZV13plKM9VhPdVoo="; + }; + + build-system = [ + flit-core + ]; + + dependencies = [ + absl-py + dataclasses-json + etils + jax + jaxlib + jaxtyping + numpy + orbax-checkpoint + protobuf + tensorflow + ]; + + pythonImportsCheck = [ + "orbax" + "orbax.export" + "orbax.export.bfloat16_toolkit.python" + ]; + + nativeCheckInputs = [ + chex + flax + pytestCheckHook + ]; + + preCheck = '' + cd orbax/export + rm -rf ./**/__init__.py + rm -rf typing + ''; + + # Circular dependency with flax + doCheck = false; + + passthru.tests.pytest = orbax-export.overridePythonAttrs { + doCheck = true; + }; + + meta = { + description = "Serialization library for JAX users, enabling the exporting of JAX models to the TensorFlow SavedModel format"; + homepage = "https://github.com/google/orbax/tree/main/export"; + license = lib.licenses.asl20; + maintainers = with lib.maintainers; [ GaetanLepage ]; + }; +}) diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix index 89c7e9406dd1..529cba15afd2 100644 --- a/pkgs/top-level/python-packages.nix +++ b/pkgs/top-level/python-packages.nix @@ -11823,6 +11823,8 @@ self: super: with self; { orbax-checkpoint = callPackage ../development/python-modules/orbax-checkpoint { }; + orbax-export = callPackage ../development/python-modules/orbax-export { }; + ordered-set = callPackage ../development/python-modules/ordered-set { }; orderedmultidict = callPackage ../development/python-modules/orderedmultidict { }; From 3de4582d9fd207e02a2aeb5f70e5163e4178c65a Mon Sep 17 00:00:00 2001 From: Gaetan Lepage Date: Tue, 27 Jan 2026 23:22:52 +0000 Subject: [PATCH 36/59] python3Packages.flax: 0.12.2 -> 0.12.6 Diff: https://github.com/google/flax/compare/v0.12.2...v0.12.6 Changelog: https://github.com/google/flax/releases/tag/v0.12.6 --- .../python-modules/flax/default.nix | 21 +++++++------------ 1 file changed, 8 insertions(+), 13 deletions(-) diff --git a/pkgs/development/python-modules/flax/default.nix b/pkgs/development/python-modules/flax/default.nix index 9e9a91f0fd70..119b841cde81 100644 --- a/pkgs/development/python-modules/flax/default.nix +++ b/pkgs/development/python-modules/flax/default.nix @@ -13,14 +13,12 @@ numpy, optax, orbax-checkpoint, + orbax-export, pyyaml, rich, tensorstore, typing-extensions, - # optional-dependencies - matplotlib, - # tests cloudpickle, keras, @@ -36,16 +34,16 @@ tomlq, }: -buildPythonPackage rec { +buildPythonPackage (finalAttrs: { pname = "flax"; - version = "0.12.2"; + version = "0.12.6"; pyproject = true; src = fetchFromGitHub { owner = "google"; repo = "flax"; - tag = "v${version}"; - hash = "sha256-Wdfc35/iah98C5WNYZWiAd2FJUJlyGLJ8xELpuYD3GU="; + tag = "v${finalAttrs.version}"; + hash = "sha256-rIDfF9W8cxF0njH4e4uhqURQ0C4N8Boe76u6meMgC34="; }; build-system = [ @@ -60,6 +58,7 @@ buildPythonPackage rec { numpy optax orbax-checkpoint + orbax-export pyyaml rich tensorstore @@ -67,10 +66,6 @@ buildPythonPackage rec { typing-extensions ]; - optional-dependencies = { - all = [ matplotlib ]; - }; - pythonImportsCheck = [ "flax" ]; nativeCheckInputs = [ @@ -132,8 +127,8 @@ buildPythonPackage rec { meta = { description = "Neural network library for JAX"; homepage = "https://github.com/google/flax"; - changelog = "https://github.com/google/flax/releases/tag/v${version}"; + changelog = "https://github.com/google/flax/releases/tag/${finalAttrs.src.tag}"; license = lib.licenses.asl20; maintainers = with lib.maintainers; [ ndl ]; }; -} +}) From b08427180737e96ce77e59257e6ebdff01a01202 Mon Sep 17 00:00:00 2001 From: Gaetan Lepage Date: Fri, 30 Jan 2026 14:27:50 +0000 Subject: [PATCH 37/59] python3Packages.lineax: 0.0.8 -> 0.1.0 Diff: https://github.com/patrick-kidger/lineax/compare/v0.0.8...v0.1.0 Changelog: https://github.com/patrick-kidger/lineax/releases/tag/v0.1.0 --- pkgs/development/python-modules/lineax/default.nix | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/pkgs/development/python-modules/lineax/default.nix b/pkgs/development/python-modules/lineax/default.nix index 3f31208364de..e61fdf039eea 100644 --- a/pkgs/development/python-modules/lineax/default.nix +++ b/pkgs/development/python-modules/lineax/default.nix @@ -18,16 +18,16 @@ python, }: -buildPythonPackage rec { +buildPythonPackage (finalAttrs: { pname = "lineax"; - version = "0.0.8"; + version = "0.1.0"; pyproject = true; src = fetchFromGitHub { owner = "patrick-kidger"; repo = "lineax"; - tag = "v${version}"; - hash = "sha256-VMTDCExgxfCcd/3UZAglfAxAFaSjzFJJuvSWJAx2tJs="; + tag = "v${finalAttrs.version}"; + hash = "sha256-oUqJRp4pge3t9g7o/9PCZTb7e4EPkBEGLclHMIdUqiw="; }; build-system = [ hatchling ]; @@ -59,8 +59,8 @@ buildPythonPackage rec { meta = { description = "Linear solvers in JAX and Equinox"; homepage = "https://github.com/patrick-kidger/lineax"; - changelog = "https://github.com/patrick-kidger/lineax/releases/tag/${src.tag}"; + changelog = "https://github.com/patrick-kidger/lineax/releases/tag/${finalAttrs.src.tag}"; license = lib.licenses.asl20; maintainers = with lib.maintainers; [ GaetanLepage ]; }; -} +}) From 5bc15312c7dde9fc0fcf1169d6daca7ea7d07c61 Mon Sep 17 00:00:00 2001 From: Gaetan Lepage Date: Fri, 20 Mar 2026 14:18:53 +0000 Subject: [PATCH 38/59] python3Packages.brax: 0.14.0 -> 0.14.2 Diff: https://github.com/google/brax/compare/v0.14.0...v0.14.2 --- .../python-modules/brax/default.nix | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-) diff --git a/pkgs/development/python-modules/brax/default.nix b/pkgs/development/python-modules/brax/default.nix index f5089aa16ece..e2609c149536 100644 --- a/pkgs/development/python-modules/brax/default.nix +++ b/pkgs/development/python-modules/brax/default.nix @@ -36,16 +36,16 @@ transforms3d, }: -buildPythonPackage rec { +buildPythonPackage (finalAttrs: { pname = "brax"; - version = "0.14.0"; + version = "0.14.2"; pyproject = true; src = fetchFromGitHub { owner = "google"; repo = "brax"; - tag = "v${version}"; - hash = "sha256-CkRXEYtlP8IhEZ7lVnpxlwiyLdICAfILwHfRUfuub08="; + tag = "v${finalAttrs.version}"; + hash = "sha256-/oznBa44xKl+9T1YrTVhCbuKZj16V1BTlnmCGRbF45g="; }; build-system = [ @@ -88,6 +88,11 @@ buildPythonPackage rec { "testModelEncoding1" "testTrain" "testTrainDomainRandomize" + + # ValueError: Error: no decoder found for mesh file 'meshes/pyramid.stl' + "test_convex_convex" + "test_dumps" + "test_dumps_invalidstate_raises" ] ++ lib.optionals stdenv.hostPlatform.isAarch64 [ # Flaky: @@ -100,9 +105,7 @@ buildPythonPackage rec { "brax/generalized/constraint_test.py" ]; - pythonImportsCheck = [ - "brax" - ]; + pythonImportsCheck = [ "brax" ]; meta = { description = "Massively parallel rigidbody physics simulation on accelerator hardware"; @@ -110,4 +113,4 @@ buildPythonPackage rec { license = lib.licenses.asl20; maintainers = with lib.maintainers; [ nim65s ]; }; -} +}) From 8e1622ad9fe08b30d3b7ea640d2631a2a75f8ac0 Mon Sep 17 00:00:00 2001 From: Gaetan Lepage Date: Sun, 22 Mar 2026 10:05:44 +0000 Subject: [PATCH 39/59] python3Packages.optax: 0.2.6 -> 0.2.8 Diff: https://github.com/deepmind/optax/compare/v0.2.6...v0.2.8 Changelog: https://github.com/deepmind/optax/releases/tag/v0.2.8 --- pkgs/development/python-modules/optax/default.nix | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-) diff --git a/pkgs/development/python-modules/optax/default.nix b/pkgs/development/python-modules/optax/default.nix index 3284c81b9214..d37345deeb20 100644 --- a/pkgs/development/python-modules/optax/default.nix +++ b/pkgs/development/python-modules/optax/default.nix @@ -8,7 +8,6 @@ # dependencies absl-py, - chex, jax, jaxlib, numpy, @@ -17,16 +16,16 @@ callPackage, }: -buildPythonPackage rec { +buildPythonPackage (finalAttrs: { pname = "optax"; - version = "0.2.6"; + version = "0.2.8"; pyproject = true; src = fetchFromGitHub { owner = "deepmind"; repo = "optax"; - tag = "v${version}"; - hash = "sha256-+9Q/Amb60m65ZiJsmH93e6tQmpJlMyzVUL0A7q3mS8Y="; + tag = "v${finalAttrs.version}"; + hash = "sha256-dVmMacQx6V5lv0z4nWUTlekuEDqtIZlxJazAeA9UR+E="; }; outputs = [ @@ -38,7 +37,6 @@ buildPythonPackage rec { dependencies = [ absl-py - chex jax jaxlib numpy @@ -61,8 +59,8 @@ buildPythonPackage rec { meta = { description = "Gradient processing and optimization library for JAX"; homepage = "https://github.com/deepmind/optax"; - changelog = "https://github.com/deepmind/optax/releases/tag/v${version}"; + changelog = "https://github.com/deepmind/optax/releases/tag/${finalAttrs.src.tag}"; license = lib.licenses.asl20; maintainers = with lib.maintainers; [ ndl ]; }; -} +}) From 5252199f7f95e43835d9403d6de7698f3a47d994 Mon Sep 17 00:00:00 2001 From: Gaetan Lepage Date: Sun, 22 Mar 2026 20:00:36 +0000 Subject: [PATCH 40/59] python3Packages.distrax: skip failing test --- pkgs/development/python-modules/distrax/default.nix | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/pkgs/development/python-modules/distrax/default.nix b/pkgs/development/python-modules/distrax/default.nix index 0cd673918890..340305fc63b2 100644 --- a/pkgs/development/python-modules/distrax/default.nix +++ b/pkgs/development/python-modules/distrax/default.nix @@ -20,7 +20,7 @@ pytestCheckHook, }: -buildPythonPackage rec { +buildPythonPackage (finalAttrs: { pname = "distrax"; version = "0.1.7"; pyproject = true; @@ -28,7 +28,7 @@ buildPythonPackage rec { src = fetchFromGitHub { owner = "google-deepmind"; repo = "distrax"; - tag = "v${version}"; + tag = "v${finalAttrs.version}"; hash = "sha256-R6rGGNzup3O6eZ2z4vygYWTjroE/Irt3aog8Op+0hco="; }; @@ -57,6 +57,9 @@ buildPythonPackage rec { pythonImportsCheck = [ "distrax" ]; disabledTests = [ + # execnet.gateway_base.DumpError: can't serialize + "test_raises_on_invalid_input_shape" + # Flaky: AssertionError: 1 not less than 0.7000000000000001 "test_von_mises_sample_uniform_ks_test" @@ -124,7 +127,7 @@ buildPythonPackage rec { meta = { description = "Probability distributions in JAX"; homepage = "https://github.com/deepmind/distrax"; - changelog = "https://github.com/google-deepmind/distrax/releases/tag/v${version}"; + changelog = "https://github.com/google-deepmind/distrax/releases/tag/${finalAttrs.src.tag}"; license = lib.licenses.asl20; maintainers = with lib.maintainers; [ onny ]; badPlatforms = [ @@ -132,4 +135,4 @@ buildPythonPackage rec { lib.systems.inspect.patterns.isDarwin ]; }; -} +}) From 753b206d16e0ac3e5cb01c411c879f454e25d896 Mon Sep 17 00:00:00 2001 From: Gaetan Lepage Date: Sun, 22 Mar 2026 20:05:24 +0000 Subject: [PATCH 41/59] python3Packages.flowmc: skip failing tests --- .../python-modules/flowmc/default.nix | 19 +++++++++++++++---- 1 file changed, 15 insertions(+), 4 deletions(-) diff --git a/pkgs/development/python-modules/flowmc/default.nix b/pkgs/development/python-modules/flowmc/default.nix index 5b49126b994e..cdc0398299e0 100644 --- a/pkgs/development/python-modules/flowmc/default.nix +++ b/pkgs/development/python-modules/flowmc/default.nix @@ -19,7 +19,7 @@ pytestCheckHook, }: -buildPythonPackage rec { +buildPythonPackage (finalAttrs: { pname = "flowmc"; version = "0.4.5"; pyproject = true; @@ -27,7 +27,7 @@ buildPythonPackage rec { src = fetchFromGitHub { owner = "kazewong"; repo = "flowMC"; - tag = "flowMC-${version}"; + tag = "flowMC-${finalAttrs.version}"; hash = "sha256-D3K9cvmUvwsVAjvXdSDgYlqrzTYXVlSVQbfx7TANz8A="; }; @@ -59,11 +59,22 @@ buildPythonPackage rec { nativeCheckInputs = [ pytestCheckHook ]; + disabledTestPaths = [ + # ValueError: Expected None, got JitTracer(bool[3,2]) + "test/integration/test_quickstart.py" + ]; + + disabledTests = [ + # ValueError: Expected None, got JitTracer(bool[3,2]) + "test_rqSpline" + "test_training" + ]; + meta = { description = "Normalizing-flow enhanced sampling package for probabilistic inference in Jax"; homepage = "https://github.com/kazewong/flowMC"; - changelog = "https://github.com/kazewong/flowMC/releases/tag/flowMC-${version}"; + changelog = "https://github.com/kazewong/flowMC/releases/tag/${finalAttrs.src.tag}"; license = lib.licenses.mit; maintainers = with lib.maintainers; [ GaetanLepage ]; }; -} +}) From 48dba940525ad19e28c52fe806b8438d2c9af982 Mon Sep 17 00:00:00 2001 From: Gaetan Lepage Date: Sun, 22 Mar 2026 21:33:52 +0000 Subject: [PATCH 42/59] python3Packages.blackjax: add missing test dependency --- pkgs/development/python-modules/blackjax/default.nix | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/pkgs/development/python-modules/blackjax/default.nix b/pkgs/development/python-modules/blackjax/default.nix index ea1e0aa9fae1..5077178f3b11 100644 --- a/pkgs/development/python-modules/blackjax/default.nix +++ b/pkgs/development/python-modules/blackjax/default.nix @@ -15,11 +15,12 @@ typing-extensions, # checks + chex, pytestCheckHook, pytest-xdist, }: -buildPythonPackage rec { +buildPythonPackage (finalAttrs: { pname = "blackjax"; version = "1.3"; pyproject = true; @@ -27,7 +28,7 @@ buildPythonPackage rec { src = fetchFromGitHub { owner = "blackjax-devs"; repo = "blackjax"; - tag = version; + tag = finalAttrs.version; hash = "sha256-ystvPfIsnMFYkC+LNtcRQsI19i/y/905SnPSApM8v4E="; }; @@ -46,6 +47,7 @@ buildPythonPackage rec { ]; nativeCheckInputs = [ + chex pytestCheckHook pytest-xdist ]; @@ -83,8 +85,8 @@ buildPythonPackage rec { meta = { homepage = "https://blackjax-devs.github.io/blackjax"; description = "Sampling library designed for ease of use, speed and modularity"; - changelog = "https://github.com/blackjax-devs/blackjax/releases/tag/${version}"; + changelog = "https://github.com/blackjax-devs/blackjax/releases/tag/${finalAttrs.src.tag}"; license = lib.licenses.asl20; maintainers = with lib.maintainers; [ bcdarwin ]; }; -} +}) From f1f441590857cb6c2d256a33ee4eadf99f0697d4 Mon Sep 17 00:00:00 2001 From: Gaetan Lepage Date: Sun, 22 Mar 2026 22:46:25 +0000 Subject: [PATCH 43/59] python3Packages.numpyro: skip failing tests --- pkgs/development/python-modules/numpyro/default.nix | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/pkgs/development/python-modules/numpyro/default.nix b/pkgs/development/python-modules/numpyro/default.nix index 45c0135317b7..cbdcd6f07edd 100644 --- a/pkgs/development/python-modules/numpyro/default.nix +++ b/pkgs/development/python-modules/numpyro/default.nix @@ -81,6 +81,12 @@ buildPythonPackage (finalAttrs: { ]; disabledTests = [ + # Failing with jax>=0.9.0 + # TypeError: Error interpreting argument to closed_call as a JAX value + "test_provenance_call" + "test_provenance_closed_call" + "test_numpyrooptim_no_double_jit" + # ValueError: Found unexpected Arrays on value of type in static attribute 'layers' # of Pytree type '.MLP'>'. # This is an error starting from Flax version 0.12.0. From 093d401c624d341074cffd5f46a7accc227a393d Mon Sep 17 00:00:00 2001 From: Gaetan Lepage Date: Mon, 23 Mar 2026 18:59:43 +0000 Subject: [PATCH 44/59] python3Packages.pytensor: skip crashing test --- pkgs/development/python-modules/pytensor/default.nix | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/pkgs/development/python-modules/pytensor/default.nix b/pkgs/development/python-modules/pytensor/default.nix index 4b318865257d..de922e034e3a 100644 --- a/pkgs/development/python-modules/pytensor/default.nix +++ b/pkgs/development/python-modules/pytensor/default.nix @@ -90,6 +90,10 @@ buildPythonPackage (finalAttrs: { # AssertionError: equal_computations failed "test_infer_shape_db_handles_xtensor_lowering" + + # Crashes with jax>=0.9.0 + # in .../jax/_src/compiler.py", line 362 in backend_compile_and_load + "test_higher_order_derivatives" ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ # Numerical assertion error From f79856aae4630f5e2063e37f6da86a201067decf Mon Sep 17 00:00:00 2001 From: Gaetan Lepage Date: Tue, 24 Mar 2026 08:01:18 +0000 Subject: [PATCH 45/59] python3Packages.clu: add missing chex test dependency --- pkgs/development/python-modules/clu/default.nix | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/pkgs/development/python-modules/clu/default.nix b/pkgs/development/python-modules/clu/default.nix index 459c30bc0691..9f6f4f966517 100644 --- a/pkgs/development/python-modules/clu/default.nix +++ b/pkgs/development/python-modules/clu/default.nix @@ -19,6 +19,7 @@ wrapt, # tests + chex, keras, pytestCheckHook, tensorflow, @@ -26,7 +27,7 @@ torch, }: -buildPythonPackage rec { +buildPythonPackage (finalAttrs: { pname = "clu"; version = "0.0.12"; pyproject = true; @@ -34,7 +35,7 @@ buildPythonPackage rec { src = fetchFromGitHub { owner = "google"; repo = "CommonLoopUtils"; - tag = "v${version}"; + tag = "v${finalAttrs.version}"; hash = "sha256-ntqRz3fCXMf0EDQsddT68Mdi105ECBVQpVsStzk2kvQ="; }; @@ -59,6 +60,7 @@ buildPythonPackage rec { pythonImportsCheck = [ "clu" ]; nativeCheckInputs = [ + chex keras pytestCheckHook tensorflow @@ -76,8 +78,8 @@ buildPythonPackage rec { meta = { description = "Common training loops in JAX"; homepage = "https://github.com/google/CommonLoopUtils"; - changelog = "https://github.com/google/CommonLoopUtils/blob/${src.tag}/CHANGELOG.md"; + changelog = "https://github.com/google/CommonLoopUtils/blob/${finalAttrs.src.tag}/CHANGELOG.md"; license = lib.licenses.asl20; maintainers = with lib.maintainers; [ GaetanLepage ]; }; -} +}) From 38cc1f1861cf74c67a1ff4924196e874339d7969 Mon Sep 17 00:00:00 2001 From: Gaetan Lepage Date: Tue, 24 Mar 2026 08:07:08 +0000 Subject: [PATCH 46/59] python3Packages.bambi: fix broken test --- pkgs/development/python-modules/bambi/default.nix | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/pkgs/development/python-modules/bambi/default.nix b/pkgs/development/python-modules/bambi/default.nix index 1c18a6c6bc9f..5f96a8f49cb1 100644 --- a/pkgs/development/python-modules/bambi/default.nix +++ b/pkgs/development/python-modules/bambi/default.nix @@ -36,6 +36,14 @@ buildPythonPackage (finalAttrs: { hash = "sha256-Vjv62cYDIuTLE7MxRt4Havy7DMOiMTyIixbs4LGFGGs="; }; + # TypeError: NDArray.record() missing 1 required keyword-only argument: 'in_warmup' + postPatch = '' + substituteInPlace bambi/backend/pymc.py \ + --replace-fail \ + "strace.record(point=dict(zip(varnames, value)))" \ + "strace.record(point=dict(zip(varnames, value)), in_warmup=False)" + ''; + build-system = [ setuptools setuptools-scm From d2dcbe90b81f6764dffda27e4ff744dd42017773 Mon Sep 17 00:00:00 2001 From: Gaetan Lepage Date: Tue, 24 Mar 2026 08:16:32 +0000 Subject: [PATCH 47/59] python3Packages.xformers: 0.0.30 -> 0.0.35 Diff: https://github.com/facebookresearch/xformers/compare/v0.0.30...v0.0.35 Changelog: https://github.com/facebookresearch/xformers/blob/0.0.35/CHANGELOG.md --- .../0001-fix-allow-building-without-git.patch | 25 -- .../python-modules/xformers/default.nix | 218 ++++++++++++------ 2 files changed, 151 insertions(+), 92 deletions(-) delete mode 100644 pkgs/development/python-modules/xformers/0001-fix-allow-building-without-git.patch diff --git a/pkgs/development/python-modules/xformers/0001-fix-allow-building-without-git.patch b/pkgs/development/python-modules/xformers/0001-fix-allow-building-without-git.patch deleted file mode 100644 index 54b79e3e2f69..000000000000 --- a/pkgs/development/python-modules/xformers/0001-fix-allow-building-without-git.patch +++ /dev/null @@ -1,25 +0,0 @@ -From 4c2b65c47d328c2f20cc74adcec2286fee6cb5de Mon Sep 17 00:00:00 2001 -From: Yaroslav Bolyukin -Date: Tue, 30 Jan 2024 18:18:35 +0100 -Subject: [PATCH] fix: allow building without git - ---- - setup.py | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/setup.py b/setup.py -index e01c008..92eca62 100644 ---- a/setup.py -+++ b/setup.py -@@ -71,7 +71,7 @@ def get_flash_version() -> str: - ["git", "describe", "--tags", "--always"], - cwd=flash_dir, - ).decode("ascii")[:-1] -- except subprocess.CalledProcessError: -+ except Exception: - version = flash_dir / "version.txt" - if version.is_file(): - return version.read_text().strip() --- -2.43.0 - diff --git a/pkgs/development/python-modules/xformers/default.nix b/pkgs/development/python-modules/xformers/default.nix index ddceea21ff0d..1ad3c89c05c3 100644 --- a/pkgs/development/python-modules/xformers/default.nix +++ b/pkgs/development/python-modules/xformers/default.nix @@ -3,75 +3,83 @@ stdenv, buildPythonPackage, fetchFromGitHub, - which, - setuptools, - # runtime dependencies - numpy, + + # build-system torch, - # check dependencies - pytestCheckHook, - pytest-cov-stub, - # , pytest-mpi - pytest-timeout, - # , pytorch-image-models - hydra-core, - fairscale, - scipy, - cmake, - ninja, - triton, - networkx, - #, apex - einops, - transformers, - timm, - #, flash-attn + setuptools, + + # buildInputs openmp, + + # dependencies + numpy, + pynvml, + + # tests + einops, + fairscale, + hydra-core, + networkx, + pytest-cov-stub, + pytest-timeout, + pytestCheckHook, + scipy, + timm, + transformers, + triton, + python, + + # passthru + xformers, + writableTmpDirAsHomeHook, }: let inherit (torch) cudaCapabilities cudaPackages cudaSupport; - # version 0.0.32.post2 was confirmed to break CUDA. - # Remove this note once the latest published revision "just works". - version = "0.0.30"; effectiveStdenv = if cudaSupport then cudaPackages.backendStdenv else stdenv; in -buildPythonPackage.override { stdenv = effectiveStdenv; } { +buildPythonPackage.override { stdenv = effectiveStdenv; } (finalAttrs: { pname = "xformers"; - inherit version; + version = "0.0.35"; pyproject = true; src = fetchFromGitHub { owner = "facebookresearch"; repo = "xformers"; - tag = "v${version}"; + tag = "v${finalAttrs.version}"; fetchSubmodules = true; - hash = "sha256-ozaw9z8qnGpZ28LQNtwmKeVnrn7KDWNeJKtT6g6Q/W0="; + hash = "sha256-UqpRHLN0INpW6sA8DbQCSeL8uhS+IoW60UPVUIh1NY0="; }; - patches = [ ./0001-fix-allow-building-without-git.patch ]; + # ModuleNotFoundError: No module named 'xformers.components' + postPatch = '' + touch xformers/components/__init__.py + touch xformers/components/attention/__init__.py + ''; - build-system = [ setuptools ]; + build-system = [ + setuptools + torch + ]; preBuild = '' - cat << EOF > ./xformers/version.py - # noqa: C801 - __version__ = "${version}" - EOF - export MAX_JOBS=$NIX_BUILD_CORES ''; env = lib.attrsets.optionalAttrs cudaSupport { - TORCH_CUDA_ARCH_LIST = "${lib.concatStringsSep ";" torch.cudaCapabilities}"; + # Don't silently fallback to a non-CUDA build + FORCE_CUDA = 1; + + TORCH_CUDA_ARCH_LIST = "${lib.concatStringsSep ";" cudaCapabilities}"; }; buildInputs = - lib.optional stdenv.hostPlatform.isDarwin openmp + lib.optionals stdenv.hostPlatform.isDarwin [ + openmp + ] ++ lib.optionals cudaSupport ( with cudaPackages; [ - # flash-attn build cuda_cudart # cuda_runtime_api.h libcusparse # cusparse.h cuda_cccl # nv/target @@ -81,51 +89,127 @@ buildPythonPackage.override { stdenv = effectiveStdenv; } { ] ); - nativeBuildInputs = [ - ninja - which - ] - ++ lib.optionals cudaSupport (with cudaPackages; [ cuda_nvcc ]) - ++ lib.optional stdenv.hostPlatform.isDarwin openmp.dev; + nativeBuildInputs = + lib.optionals cudaSupport [ + cudaPackages.cuda_nvcc + ] + ++ lib.optionals stdenv.hostPlatform.isDarwin [ + openmp.dev + ]; dependencies = [ numpy torch + ] + ++ lib.optionals cudaSupport [ + pynvml ]; - pythonImportsCheck = [ "xformers" ]; - - # Has broken 0.03 version: - # https://github.com/NixOS/nixpkgs/pull/285495#issuecomment-1920730720 - passthru.skipBulkUpdate = true; - - dontUseCmakeConfigure = true; - - # see commented out missing packages - doCheck = false; + pythonImportsCheck = [ + "xformers" + "xformers.components" + "xformers.components.attention" + ]; nativeCheckInputs = [ - pytestCheckHook + einops + fairscale + hydra-core + networkx pytest-cov-stub pytest-timeout - hydra-core - fairscale + pytestCheckHook scipy - cmake - networkx - triton - # apex - einops - transformers timm - # flash-attn + transformers + triton ]; + preCheck = + # Otherwise the CPP bindings are not available and the GPU tests fail with: + # `fa2F@2.5.7-pt` is not supported because: + # xFormers wasn't build with CUDA support: False + '' + rm -rf xformers + '' + # Display information about the installation + + '' + ${python.interpreter} -m xformers.info + ''; + + enabledTestPaths = [ + "tests" + ]; + + disabledTestPaths = [ + # Those tests require access to the GPU and should be tagged accordingly: + # https://github.com/facebookresearch/xformers/pull/1385 + "tests/test_fwbw_overlap.py" + ]; + + disabledTests = + # The following tests fail without cudaSupport + lib.optionals (!cudaSupport) [ + # AssertionError: Torch not compiled with CUDA enabled + "test_flash_gqa_wrong_strides" + "test_memeff_compile" + "test_paged_attention" + "test_paged_attention_flash" + "test_triton_splitk_decoder" + "test_triton_splitk_decoder_manyqueries" + "test_unsupported_dropout_combine_flash_cutlass" + + # AssertionError: Should use Flash-Decoding with BMHK MQA + "test_dispatch_decoding_bmhk" + + # AssertionError: Should use Flash-Decoding with MQA + "test_dispatch_decoding_bmghk" + ]; + + passthru.gpuCheck = xformers.overridePythonAttrs (old: { + requiredSystemFeatures = [ "cuda" ]; + + # Run all tests, including the ones that need a GPU + disabledTestPaths = [ ]; + + disabledTests = (old.disabledTests or [ ]) ++ [ + # `fa3F@0.0.0` is not supported because: + # operator wasn't built - see `python -m xformers.info` for more info + "test_merge_training" + + # Not enough GPU memory (on a 20G RTX 4000 SFF Ada) + # triton.runtime.errors.OutOfResources: out of resource: + # shared memory, Required: 147456, Hardware limit: 101376. + "test_consistency" + "test_forward" + "test_logsumexp" + "test_mqa_decoding" + "test_tree_attention" + + # Tolerance issues: + # AssertionError: cutlassF-pt+cutlassB-pt:key: out=4.65625 and ref=3.1875 + # (diff=0.251953125 > 0) at (np.int64(0), np.int64(0), np.int64(4)) + # of shape (1, 4, 8) / atol=0.9, rtol=0.1/ total failing elements: 1 (3.12%) + "test_backward" + + # AssertionError: Legacy CUDA profiling requires use_cpu=True + "test_profiler_dispatcher_stream_workaround" + + # RuntimeError: two_four_sgemm_cutlass, /build/source/xformers/csrc/sparse24/gemm.cu:190, + # Got CUTLASS error: Error Internal + "test_linearw24" + ]; + + nativeCheckInputs = old.nativeCheckInputs ++ [ + writableTmpDirAsHomeHook + ]; + }); + meta = { description = "Collection of composable Transformer building blocks"; homepage = "https://github.com/facebookresearch/xformers"; - changelog = "https://github.com/facebookresearch/xformers/blob/${version}/CHANGELOG.md"; + changelog = "https://github.com/facebookresearch/xformers/blob/${finalAttrs.src.tag}/CHANGELOG.md"; license = lib.licenses.bsd3; maintainers = with lib.maintainers; [ happysalada ]; }; -} +}) From 5df6a1bd2f89e8f040393e0e722de232a0458e99 Mon Sep 17 00:00:00 2001 From: Merikei <73759842+Merikei@users.noreply.github.com> Date: Fri, 28 Nov 2025 20:45:59 +0000 Subject: [PATCH 48/59] maintainers: add Merikei --- maintainers/maintainer-list.nix | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix index 49a4cbcb7956..c79cba377258 100644 --- a/maintainers/maintainer-list.nix +++ b/maintainers/maintainer-list.nix @@ -17325,6 +17325,11 @@ github = "Mephistophiles"; githubId = 4850908; }; + Merikei = { + name = "Merikei"; + github = "Merikei"; + githubId = 73759842; + }; merrkry = { email = "merrkry@tsubasa.moe"; name = "merrkry"; From 6049787a7b42415efa76cb8895ac57d4f22d5431 Mon Sep 17 00:00:00 2001 From: Sigmanificient Date: Wed, 25 Mar 2026 01:52:35 +0100 Subject: [PATCH 49/59] pyspread: add merikei to maintainers --- pkgs/by-name/py/pyspread/package.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkgs/by-name/py/pyspread/package.nix b/pkgs/by-name/py/pyspread/package.nix index 3e19974c4fe4..72f41255827f 100644 --- a/pkgs/by-name/py/pyspread/package.nix +++ b/pkgs/by-name/py/pyspread/package.nix @@ -83,6 +83,6 @@ python3.pkgs.buildPythonApplication (finalAttrs: { ''; license = with lib.licenses; [ gpl3Plus ]; mainProgram = "pyspread"; - maintainers = [ ]; + maintainers = with lib.maintainers; [ Merikei ]; }; }) From ef0107e328d4940a1930eec58522f235fd4c59bc Mon Sep 17 00:00:00 2001 From: Sigmanificient Date: Wed, 25 Mar 2026 01:56:27 +0100 Subject: [PATCH 50/59] pyspead: modernize --- pkgs/by-name/py/pyspread/package.nix | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) diff --git a/pkgs/by-name/py/pyspread/package.nix b/pkgs/by-name/py/pyspread/package.nix index 72f41255827f..2a44490d8706 100644 --- a/pkgs/by-name/py/pyspread/package.nix +++ b/pkgs/by-name/py/pyspread/package.nix @@ -1,6 +1,6 @@ { lib, - python3, + python3Packages, fetchPypi, copyDesktopItems, libsForQt5, @@ -13,16 +13,18 @@ let wrapQtAppsHook ; in -python3.pkgs.buildPythonApplication (finalAttrs: { - format = "setuptools"; +python3Packages.buildPythonApplication (finalAttrs: { pname = "pyspread"; version = "2.4"; + src = fetchPypi { pname = "pyspread"; inherit (finalAttrs) version; hash = "sha256-MZlR2Rap5oMRfCmswg9W//FYFkSEki7eyMNhLoGZgJM="; }; + pyproject = true; + nativeBuildInputs = [ copyDesktopItems wrapQtAppsHook @@ -32,20 +34,18 @@ python3.pkgs.buildPythonApplication (finalAttrs: { qtsvg ]; - propagatedBuildInputs = with python3.pkgs; [ + dependencies = with python3Packages; [ python-dateutil markdown2 matplotlib numpy pyenchant pyqt5 - setuptools ]; strictDeps = true; - doCheck = false; # it fails miserably with a core dump - + doCheck = true; pythonImportsCheck = [ "pyspread" ]; desktopItems = [ @@ -55,7 +55,7 @@ python3.pkgs.buildPythonApplication (finalAttrs: { icon = "pyspread"; desktopName = "Pyspread"; genericName = "Spreadsheet"; - comment = "A Python-oriented spreadsheet application"; + comment = "Python-oriented spreadsheet application"; categories = [ "Office" "Development" @@ -84,5 +84,6 @@ python3.pkgs.buildPythonApplication (finalAttrs: { license = with lib.licenses; [ gpl3Plus ]; mainProgram = "pyspread"; maintainers = with lib.maintainers; [ Merikei ]; + platforms = lib.platforms.linux; }; }) From dbeb746d5519aadfc46762dd80eee62db0dc33d4 Mon Sep 17 00:00:00 2001 From: Merikei <73759842+Merikei@users.noreply.github.com> Date: Fri, 28 Nov 2025 21:23:00 +0000 Subject: [PATCH 51/59] pyspread: fix dependencies Co-authored-by: Yohann Boniface --- pkgs/by-name/py/pyspread/package.nix | 39 ++++++++++++++++------------ 1 file changed, 22 insertions(+), 17 deletions(-) diff --git a/pkgs/by-name/py/pyspread/package.nix b/pkgs/by-name/py/pyspread/package.nix index 2a44490d8706..b1fb839f95df 100644 --- a/pkgs/by-name/py/pyspread/package.nix +++ b/pkgs/by-name/py/pyspread/package.nix @@ -2,17 +2,11 @@ lib, python3Packages, fetchPypi, + qt6, + R, copyDesktopItems, - libsForQt5, makeDesktopItem, }: - -let - inherit (libsForQt5) - qtsvg - wrapQtAppsHook - ; -in python3Packages.buildPythonApplication (finalAttrs: { pname = "pyspread"; version = "2.4"; @@ -26,21 +20,30 @@ python3Packages.buildPythonApplication (finalAttrs: { pyproject = true; nativeBuildInputs = [ + R copyDesktopItems - wrapQtAppsHook + qt6.wrapQtAppsHook ]; - buildInputs = [ - qtsvg - ]; + buildInputs = [ qt6.qtsvg ]; dependencies = with python3Packages; [ - python-dateutil - markdown2 - matplotlib + pyqt6 numpy - pyenchant - pyqt5 + markdown2 + + # Optional + matplotlib # data visualization + pyenchant # spellchecker bindings + pip # python package installer + python-dateutil # extensions to standard datetime module + rpy2 # interface to R + plotnine # data visualization + openpyxl # r/w Excel 2010 xlsx/xlsm files + + # Optional & not in nixpkgs + #py-moneyed # currency & money classes + #pycel # compile Excel spreadsheets to Python code ]; strictDeps = true; @@ -64,6 +67,8 @@ python3Packages.buildPythonApplication (finalAttrs: { }) ]; + makeWrapperArgs = [ "--set R_HOME ${lib.getLib R}/lib/R" ]; + preFixup = '' makeWrapperArgs+=("''${qtWrapperArgs[@]}") ''; From aa80ef70bb0d1af6a799004bd619633495efa0e4 Mon Sep 17 00:00:00 2001 From: Philip Taron Date: Tue, 24 Mar 2026 15:14:23 -0700 Subject: [PATCH 52/59] nixosTests.openstack-image: fix hardcoded image filename The test hardcoded "/nixos.qcow2" but the actual output filename is derived from image.baseName and image.extension (e.g. "nixos-image-...-x86_64-linux.qcow2"). Use image.fileName to get the correct path, matching the pattern in ec2-image.nix. Also make the IMDS server's token validation conditional: when no token file exists in the metadata directory, requests are served without authentication. This supports both EC2 (IMDSv2 with tokens) and OpenStack (plain GET) metadata fetchers. --- nixos/tests/common/ec2.nix | 2 -- nixos/tests/common/imds-server.py | 23 +++++++++++++++-------- nixos/tests/openstack-image.nix | 7 ++++--- 3 files changed, 19 insertions(+), 13 deletions(-) diff --git a/nixos/tests/common/ec2.nix b/nixos/tests/common/ec2.nix index df1a85638fde..504a2864fd5f 100644 --- a/nixos/tests/common/ec2.nix +++ b/nixos/tests/common/ec2.nix @@ -23,12 +23,10 @@ in name = "metadata"; buildCommand = '' mkdir -p $out/1.0/meta-data - mkdir -p $out/latest/api ln -s ${pkgs.writeText "userData" userData} $out/1.0/user-data echo "${hostname}" > $out/1.0/meta-data/hostname echo "(unknown)" > $out/1.0/meta-data/ami-manifest-path echo "i-1234567890abcdef0" > $out/1.0/meta-data/instance-id - echo "test-imdsv2-token" > $out/latest/api/token '' + optionalString (sshPublicKey != null) '' mkdir -p $out/1.0/meta-data/public-keys/0 diff --git a/nixos/tests/common/imds-server.py b/nixos/tests/common/imds-server.py index 3a96bcc92364..b190434f4535 100644 --- a/nixos/tests/common/imds-server.py +++ b/nixos/tests/common/imds-server.py @@ -59,27 +59,34 @@ def respond(status, body): def main(): base_dir = sys.argv[1] if len(sys.argv) > 1 else "." - # Load expected token from file + # Load expected token from file. If no token file exists, IMDSv2 + # authentication is disabled — requests are served without tokens. + # This supports both EC2 (IMDSv2 with tokens) and OpenStack (plain GET) + # metadata fetchers. token_path = os.path.join(base_dir, "latest", "api", "token") if os.path.isfile(token_path): with open(token_path) as f: expected_token = f.read().strip() else: - expected_token = "test-imdsv2-token" + expected_token = None method, path, headers = read_request() rel_path = path.lstrip("/") # PUT /latest/api/token — IMDSv2 token acquisition if method == "PUT" and rel_path == "latest/api/token": - respond("200 OK", expected_token) + if expected_token is not None: + respond("200 OK", expected_token) + else: + respond("404 Not Found", "IMDSv2 token endpoint not configured\n") return - # All other requests require a valid token - request_token = headers.get("x-aws-ec2-metadata-token", "") - if request_token != expected_token: - respond("401 Unauthorized", "Invalid or missing IMDSv2 token\n") - return + # Token validation (only when a token file is present) + if expected_token is not None: + request_token = headers.get("x-aws-ec2-metadata-token", "") + if request_token != expected_token: + respond("401 Unauthorized", "Invalid or missing IMDSv2 token\n") + return # Serve file from the metadata directory file_path = os.path.join(base_dir, rel_path) diff --git a/nixos/tests/openstack-image.nix b/nixos/tests/openstack-image.nix index 83c34fefef1f..0a2ff1f3b840 100644 --- a/nixos/tests/openstack-image.nix +++ b/nixos/tests/openstack-image.nix @@ -10,7 +10,7 @@ with pkgs.lib; with import common/ec2.nix { inherit makeTest pkgs; }; let - image = + imageCfg = (import ../lib/eval-config.nix { system = null; modules = [ @@ -26,8 +26,8 @@ let nixpkgs.pkgs = pkgs; } ]; - }).config.system.build.openstackImage - + "/nixos.qcow2"; + }).config; + image = "${imageCfg.system.build.openstackImage}/${imageCfg.image.fileName}"; sshKeys = import ./ssh-keys.nix pkgs; snakeOilPrivateKey = sshKeys.snakeOilPrivateKey.text; @@ -80,6 +80,7 @@ in userdata = makeEc2Test { name = "openstack-ec2-metadata"; + meta.broken = true; # amazon-init wants to download from the internet while building the system inherit image; sshPublicKey = snakeOilPublicKey; userData = '' From a35e3e977794dc75e66356e1a3e418097522634c Mon Sep 17 00:00:00 2001 From: Philip Taron Date: Tue, 24 Mar 2026 15:41:19 -0700 Subject: [PATCH 53/59] nixosTests.ec2-image: fix systemd start-limit-hit in decompression tests The decompression subtests restart fetch-ec2-metadata multiple times in quick succession, hitting systemd's rate limiter. Reset the failure counter before each restart. --- nixos/tests/ec2-image.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nixos/tests/ec2-image.nix b/nixos/tests/ec2-image.nix index 0e0d5fde4a17..b54b153bd52e 100644 --- a/nixos/tests/ec2-image.nix +++ b/nixos/tests/ec2-image.nix @@ -195,7 +195,7 @@ in test_marker = f"{format_name}-decompression-test" with open(user_data_path, "wb") as f: f.write(compressed_data) - machine.succeed("systemctl restart fetch-ec2-metadata") + machine.succeed("systemctl reset-failed fetch-ec2-metadata; systemctl restart fetch-ec2-metadata") result = machine.succeed("cat /etc/ec2-metadata/user-data") assert test_marker in result, f"Expected '{test_marker}' in decompressed {format_name} content, got: {result}" journal = machine.succeed("journalctl -u fetch-ec2-metadata --no-pager -b") From 7e454277c3bdd1fd1c4daa09887a0e09b6d299ae Mon Sep 17 00:00:00 2001 From: Philip Taron Date: Tue, 24 Mar 2026 16:31:55 -0700 Subject: [PATCH 54/59] openstack-image: use pkgs.stdenv.hostPlatform.system instead of deprecated pkgs.system pkgs.system is a deprecated alias that doesn't exist when allowAliases = false, causing evaluation failures in nixpkgs-review. --- nixos/maintainers/scripts/openstack/openstack-image.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nixos/maintainers/scripts/openstack/openstack-image.nix b/nixos/maintainers/scripts/openstack/openstack-image.nix index 65ce2fec2033..66837396bb90 100644 --- a/nixos/maintainers/scripts/openstack/openstack-image.nix +++ b/nixos/maintainers/scripts/openstack/openstack-image.nix @@ -31,7 +31,7 @@ in ; inherit (config.image) baseName; additionalSpace = "1024M"; - pkgs = import ../../../.. { inherit (pkgs) system; }; # ensure we use the regular qemu-kvm package + pkgs = import ../../../.. { inherit (pkgs.stdenv.hostPlatform) system; }; # ensure we use the regular qemu-kvm package configFile = pkgs.writeText "configuration.nix" '' { imports = [ ]; From cfaddae84dbca6b7b77d5f82b24d8dc86e25c901 Mon Sep 17 00:00:00 2001 From: Philip Taron Date: Tue, 24 Mar 2026 16:32:03 -0700 Subject: [PATCH 55/59] nixosTests: fix writeText warning when userData is null makeEc2Test's userData parameter is required but image-contents.nix passes null, triggering a deprecation warning from writeText. Make userData optional (defaulting to null) and create an empty user-data file when it's not provided. --- nixos/tests/common/ec2.nix | 7 +++++-- nixos/tests/image-contents.nix | 1 - 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/nixos/tests/common/ec2.nix b/nixos/tests/common/ec2.nix index 504a2864fd5f..864afc63cb8b 100644 --- a/nixos/tests/common/ec2.nix +++ b/nixos/tests/common/ec2.nix @@ -12,7 +12,7 @@ in { name, image, - userData, + userData ? null, script, hostname ? "ec2-instance", sshPublicKey ? null, @@ -23,7 +23,10 @@ in name = "metadata"; buildCommand = '' mkdir -p $out/1.0/meta-data - ln -s ${pkgs.writeText "userData" userData} $out/1.0/user-data + ${optionalString ( + userData != null + ) "ln -s ${pkgs.writeText "userData" userData} $out/1.0/user-data"} + ${optionalString (userData == null) "touch $out/1.0/user-data"} echo "${hostname}" > $out/1.0/meta-data/hostname echo "(unknown)" > $out/1.0/meta-data/ami-manifest-path echo "i-1234567890abcdef0" > $out/1.0/meta-data/instance-id diff --git a/nixos/tests/image-contents.nix b/nixos/tests/image-contents.nix index bfa4f08adc40..1f2dce786eec 100644 --- a/nixos/tests/image-contents.nix +++ b/nixos/tests/image-contents.nix @@ -51,7 +51,6 @@ in makeEc2Test { name = "image-contents"; inherit image; - userData = null; script = '' machine.start() # Test that if contents includes a file, it is copied to the target. From 189ca8e78b035dddf80bfa4a9d904a7c29a4aea4 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Wed, 25 Mar 2026 02:08:55 +0000 Subject: [PATCH 56/59] rasm: 3.0.8 -> 3.0.9 --- pkgs/by-name/ra/rasm/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/ra/rasm/package.nix b/pkgs/by-name/ra/rasm/package.nix index 106f5a5d7430..fa7e6302ef07 100644 --- a/pkgs/by-name/ra/rasm/package.nix +++ b/pkgs/by-name/ra/rasm/package.nix @@ -6,13 +6,13 @@ stdenv.mkDerivation (finalAttrs: { pname = "rasm"; - version = "3.0.8"; + version = "3.0.9"; src = fetchFromGitHub { owner = "EdouardBERGE"; repo = "rasm"; tag = "v${finalAttrs.version}"; - hash = "sha256-nBNJsqnz0PlwPAJ4T4CFBGr7UYy6u8VtklIkINaurvM="; + hash = "sha256-QlFdp/Cju28yOoqoQzM1JiZqRcxKjX7RgJPyz0VJYJ0="; }; # by default the EXEC variable contains `rasm.exe` From ce55533b716d3381ad1c17725b441ccb09d1f612 Mon Sep 17 00:00:00 2001 From: azban Date: Mon, 23 Mar 2026 18:00:24 -0600 Subject: [PATCH 57/59] steel: 0-unstable-2026-02-12 -> 0.8.2 --- pkgs/by-name/st/steel/package.nix | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) diff --git a/pkgs/by-name/st/steel/package.nix b/pkgs/by-name/st/steel/package.nix index d684e79391c4..a4a2417564f2 100644 --- a/pkgs/by-name/st/steel/package.nix +++ b/pkgs/by-name/st/steel/package.nix @@ -17,18 +17,18 @@ includeLSP ? true, includeForge ? true, }: -rustPlatform.buildRustPackage { +rustPlatform.buildRustPackage (finalAttrs: { pname = "steel"; - version = "0-unstable-2026-02-12"; + version = "0.8.2"; src = fetchFromGitHub { owner = "mattwparas"; repo = "steel"; - rev = "e9cb24fe9c6584f4a352c3cb43e7f0bd934e3277"; - hash = "sha256-9ZyAPqZNcAP1ObxVxjK+q87ZyKMPzaDno1v7JweU6z4="; + tag = "v${finalAttrs.version}"; + hash = "sha256-GZ0VeoAwVGnK/Px5IvBGIHlpEsAh2do/QPuYtLexLt4="; }; - cargoHash = "sha256-ss3S4eRoczvF0DlTpUS9mZ09pfMKgyLNAmjm3WWi8KQ="; + cargoHash = "sha256-Z5v+8bhIgBCB2pDB5AgX42vFiNkgqjU95gata0sLUrA="; nativeBuildInputs = [ curl @@ -103,7 +103,10 @@ rustPlatform.buildRustPackage { }; passthru.updateScript = nix-update-script { - extraArgs = [ "--version=branch" ]; + extraArgs = [ + "--version-regex" + "^v(.*)" + ]; }; meta = { @@ -118,4 +121,4 @@ rustPlatform.buildRustPackage { platforms = lib.platforms.unix; sourceProvenance = [ lib.sourceTypes.fromSource ]; }; -} +}) From c1ea6402290cbccea5431b3794ee6b7867262cf4 Mon Sep 17 00:00:00 2001 From: fsagbuya Date: Wed, 25 Mar 2026 10:50:38 +0800 Subject: [PATCH 58/59] python3Packages.pglive: relax pyqtgraph --- pkgs/development/python-modules/pglive/default.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/pkgs/development/python-modules/pglive/default.nix b/pkgs/development/python-modules/pglive/default.nix index 44bec1217873..73ac80cfce0a 100644 --- a/pkgs/development/python-modules/pglive/default.nix +++ b/pkgs/development/python-modules/pglive/default.nix @@ -33,6 +33,7 @@ buildPythonPackage rec { pythonRelaxDeps = [ "numpy" + "pyqtgraph" ]; passthru.optional-dependencies = { From a1d831ee98b3c6a559444b2c014f16d944d9d929 Mon Sep 17 00:00:00 2001 From: TheShadowEevee Date: Tue, 24 Mar 2026 22:55:39 -0400 Subject: [PATCH 59/59] dolphin-emu: 2603 -> 2603a --- pkgs/by-name/do/dolphin-emu/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/do/dolphin-emu/package.nix b/pkgs/by-name/do/dolphin-emu/package.nix index 9c5bac3af9e4..b6e282f5c851 100644 --- a/pkgs/by-name/do/dolphin-emu/package.nix +++ b/pkgs/by-name/do/dolphin-emu/package.nix @@ -55,13 +55,13 @@ stdenv.mkDerivation (finalAttrs: { pname = "dolphin-emu"; - version = "2603"; + version = "2603a"; src = fetchFromGitHub { owner = "dolphin-emu"; repo = "dolphin"; tag = finalAttrs.version; - hash = "sha256-9kB5hFAJwLkFi2y5c5ZavwcnXRDE5bxerg5E1hPAutY="; + hash = "sha256-+3/JtjKFsTEkKQa0LjycqNmDz0M8o2FndWQtw5R5/jQ="; fetchSubmodules = true; leaveDotGit = true; postFetch = ''