From db467c36ec3a8054fcc68777b5ab842f625057f7 Mon Sep 17 00:00:00 2001
From: Philip Taron <philip.taron@gmail.com>
Date: Wed, 17 Dec 2025 14:43:27 -0800
Subject: [PATCH 01/29] vmTools: use callPackage and fix rotted tests

---
 pkgs/build-support/vm/default.nix | 148 ++++++++++++++++++++----------
 pkgs/build-support/vm/test.nix    |  58 +++++-------
 pkgs/test/default.nix             |   2 +
 pkgs/top-level/all-packages.nix   |   5 +-
 4 files changed, 128 insertions(+), 85 deletions(-)

diff --git a/pkgs/build-support/vm/default.nix b/pkgs/build-support/vm/default.nix
index bb877c2a7ae3..0741ed1410cc 100644
--- a/pkgs/build-support/vm/default.nix
+++ b/pkgs/build-support/vm/default.nix
@@ -1,9 +1,38 @@
 {
   lib,
+  stdenv,
+  buildPackages,
+  bash,
+  bashInteractive,
+  busybox,
+  coreutils,
+  cpio,
+  dpkg,
+  e2fsprogs,
+  fetchurl,
+  glibc,
+  kmod,
+  linux,
+  makeInitrd,
+  makeModulesClosure,
+  mtdutils,
+  rpm,
+  runCommand,
+  util-linux,
+  virtiofsd,
+  writeScript,
+  writeText,
+  xz,
+  zstd,
   pkgs,
+
+  # ----------------------------
+  # The following  arguments form the "interface" of `pkgs.vmTools`.
+  # Note that `img` is a real package, but is set to this default in `all-packages.nix`.
+  # ----------------------------
   customQemu ? null,
-  kernel ? pkgs.linux,
-  img ? pkgs.stdenv.hostPlatform.linux-kernel.target,
+  kernel ? linux,
+  img ? stdenv.hostPlatform.linux-kernel.target,
   storeDir ? builtins.storeDir,
   rootModules ? [
     "virtio_pci"
@@ -18,30 +47,11 @@
 }:
 
 let
-  inherit (pkgs)
-    bash
-    bashInteractive
-    busybox
-    cpio
-    coreutils
-    e2fsprogs
-    fetchurl
-    kmod
-    rpm
-    stdenv
-    util-linux
-    buildPackages
-    writeScript
-    writeText
-    runCommand
-    ;
-in
-rec {
   qemu-common = import ../../../nixos/lib/qemu-common.nix { inherit lib pkgs; };
 
   qemu = buildPackages.qemu_kvm;
 
-  modulesClosure = pkgs.makeModulesClosure {
+  modulesClosure = makeModulesClosure {
     kernel = lib.getOutput "modules" kernel;
     inherit rootModules;
     firmware = kernel;
@@ -64,18 +74,18 @@ rec {
 
         # Copy what we need from Glibc.
         cp -p \
-          ${pkgs.stdenv.cc.libc}/lib/ld-*.so.? \
-          ${pkgs.stdenv.cc.libc}/lib/libc.so.* \
-          ${pkgs.stdenv.cc.libc}/lib/libm.so.* \
-          ${pkgs.stdenv.cc.libc}/lib/libresolv.so.* \
-          ${pkgs.stdenv.cc.libc}/lib/libpthread.so.* \
-          ${pkgs.zstd.out}/lib/libzstd.so.* \
-          ${pkgs.xz.out}/lib/liblzma.so.* \
+          ${stdenv.cc.libc}/lib/ld-*.so.? \
+          ${stdenv.cc.libc}/lib/libc.so.* \
+          ${stdenv.cc.libc}/lib/libm.so.* \
+          ${stdenv.cc.libc}/lib/libresolv.so.* \
+          ${stdenv.cc.libc}/lib/libpthread.so.* \
+          ${zstd.out}/lib/libzstd.so.* \
+          ${xz.out}/lib/liblzma.so.* \
           $out/lib
 
         # Copy BusyBox.
-        cp -pd ${pkgs.busybox}/bin/* $out/bin
-        cp -pd ${pkgs.kmod}/bin/* $out/bin
+        cp -pd ${busybox}/bin/* $out/bin
+        cp -pd ${kmod}/bin/* $out/bin
 
         # Run patchelf to make the programs refer to the copied libraries.
         for i in $out/bin/* $out/lib/*; do if ! test -L $i; then nuke-refs $i; fi; done
@@ -179,7 +189,7 @@ rec {
     exec switch_root /fs $command
   '';
 
-  initrd = pkgs.makeInitrd {
+  initrd = makeInitrd {
     contents = [
       {
         object = stage1Init;
@@ -294,8 +304,8 @@ rec {
       ''${diskImage:+diskImage=$diskImage}
       # GitHub Actions runners seems to not allow installing seccomp filter: https://github.com/rcambrj/nix-pi-loader/issues/1#issuecomment-2605497516
       # Since we are running in a sandbox already, the difference between seccomp and none is minimal
-      ${pkgs.virtiofsd}/bin/virtiofsd --xattr --socket-path virtio-store.sock --sandbox none --seccomp none --shared-dir "${storeDir}" &
-      ${pkgs.virtiofsd}/bin/virtiofsd --xattr --socket-path virtio-xchg.sock --sandbox none --seccomp none --shared-dir xchg &
+      ${virtiofsd}/bin/virtiofsd --xattr --socket-path virtio-store.sock --sandbox none --seccomp none --shared-dir "${storeDir}" &
+      ${virtiofsd}/bin/virtiofsd --xattr --socket-path virtio-xchg.sock --sandbox none --seccomp none --shared-dir xchg &
 
       # Wait until virtiofsd has created these sockets to avoid race condition.
       until [[ -e virtio-store.sock ]]; do ${coreutils}/bin/sleep 1; done
@@ -437,8 +447,8 @@ rec {
       stdenv.mkDerivation {
         name = "extract-file-mtd";
         buildInputs = [
-          pkgs.util-linux
-          pkgs.mtdutils
+          util-linux
+          mtdutils
         ];
         buildCommand = ''
           ln -s ${kernel}/lib /lib
@@ -729,9 +739,9 @@ rec {
 
             PATH=$PATH:${
               lib.makeBinPath [
-                pkgs.dpkg
-                pkgs.glibc
-                pkgs.xz
+                dpkg
+                glibc
+                xz
               ]
             }
 
@@ -1100,24 +1110,24 @@ rec {
     };
 
     debian13i386 = {
-      name = "debian-13.0-trixie-i386";
-      fullName = "Debian 13.0 Trixie (i386)";
+      name = "debian-13.2-trixie-i386";
+      fullName = "Debian 13.2 Trixie (i386)";
       packagesList = fetchurl {
-        url = "https://snapshot.debian.org/archive/debian/20250819T202603Z/dists/trixie/main/binary-i386/Packages.xz";
-        hash = "sha256-fXjhaG1Y+kn6iMEtqVZLwYN7lZ0cEQKVfMS3hSHJipY=";
+        url = "https://snapshot.debian.org/archive/debian/20251203T144617Z/dists/trixie/main/binary-i386/Packages.xz";
+        hash = "sha256-9zozvFZoWiv3wNe9rb+kPwSOgc5G5f4zmNpdoet5A78=";
       };
-      urlPrefix = "https://snapshot.debian.org/archive/debian/20250819T202603Z";
+      urlPrefix = "https://snapshot.debian.org/archive/debian/20251203T144617Z";
       packages = commonDebianPackages;
     };
 
     debian13x86_64 = {
-      name = "debian-13.0-trixie-amd64";
-      fullName = "Debian 13.0 Trixie (amd64)";
+      name = "debian-13.2-trixie-amd64";
+      fullName = "Debian 13.2 Trixie (amd64)";
       packagesList = fetchurl {
-        url = "https://snapshot.debian.org/archive/debian/20250819T202603Z/dists/trixie/main/binary-amd64/Packages.xz";
-        hash = "sha256-15cDoCcTv3m5fiZqP1hqWWnSG1BVUZSrm5YszTSKQs4=";
+        url = "https://snapshot.debian.org/archive/debian/20251203T144617Z/dists/trixie/main/binary-amd64/Packages.xz";
+        hash = "sha256-g7f+tKljUXAC4gxJfzSC8+j0GbiwRZjonv25tYuvxtU=";
       };
-      urlPrefix = "https://snapshot.debian.org/archive/debian/20250819T202603Z";
+      urlPrefix = "https://snapshot.debian.org/archive/debian/20251203T144617Z";
       packages = commonDebianPackages;
     };
   };
@@ -1284,5 +1294,43 @@ rec {
     `debDistros' sets.
   */
   diskImages = lib.mapAttrs (name: f: f { }) diskImageFuns;
-
+in
+{
+  inherit
+    buildRPM
+    commonCentOSPackages
+    commonDebPackages
+    commonDebianPackages
+    commonFedoraPackages
+    commonOpenSUSEPackages
+    commonRHELPackages
+    createEmptyImage
+    debClosureGenerator
+    debDistros
+    defaultCreateRootFS
+    diskImageExtraFuns
+    diskImageFuns
+    diskImages
+    extractFs
+    extractMTDfs
+    fillDiskWithDebs
+    fillDiskWithRPMs
+    hd
+    initrd
+    initrdUtils
+    makeImageFromDebDist
+    makeImageFromRPMDist
+    makeImageTestScript
+    modulesClosure
+    qemu
+    qemu-common
+    qemuCommandLinux
+    rpmClosureGenerator
+    rpmDistros
+    runInLinuxImage
+    runInLinuxVM
+    stage1Init
+    stage2Init
+    vmRunCommand
+    ;
 }
diff --git a/pkgs/build-support/vm/test.nix b/pkgs/build-support/vm/test.nix
index 313ca50e55f9..b99d4e5e7221 100644
--- a/pkgs/build-support/vm/test.nix
+++ b/pkgs/build-support/vm/test.nix
@@ -1,14 +1,12 @@
+{
+  hello,
+  patchelf,
+  pcmanfm,
+  stdenv,
+  vmTools,
+}:
 let
-  pkgs = import ../../.. { };
-
-  inherit (pkgs)
-    hello
-    patchelf
-    pcmanfm
-    stdenv
-    ;
-
-  inherit (pkgs.vmTools)
+  inherit (vmTools)
     buildRPM
     diskImages
     makeImageTestScript
@@ -18,9 +16,16 @@ let
 in
 
 {
-
-  # Run the PatchELF derivation in a VM.
   buildPatchelfInVM = runInLinuxVM patchelf;
+  buildPatchelfInDebian = runInLinuxImage (
+    stdenv.mkDerivation {
+      inherit (patchelf) pname version src;
+
+      diskImage = diskImages.debian13x86_64;
+      diskImageFormat = "qcow2";
+      memSize = 512;
+    }
+  );
 
   buildHelloInVM = runInLinuxVM hello;
   buildStructuredAttrsHelloInVM = runInLinuxVM (hello.overrideAttrs { __structuredAttrs = true; });
@@ -32,28 +37,15 @@ in
     })
   );
 
-  testRPMImage = makeImageTestScript diskImages.fedora27x86_64;
+  #testRPMImage = makeImageTestScript diskImages.fedora27x86_64;
 
-  buildPatchelfRPM = buildRPM {
-    name = "patchelf-rpm";
-    src = patchelf.src;
-    diskImage = diskImages.fedora27x86_64;
-    diskImageFormat = "qcow2";
-  };
+  #buildPatchelfRPM = buildRPM {
+  #  name = "patchelf-rpm";
+  #  src = patchelf.src;
+  #  diskImage = diskImages.fedora27x86_64;
+  #  diskImageFormat = "qcow2";
+  #};
 
-  testUbuntuImage = makeImageTestScript diskImages.ubuntu1804i386;
-
-  buildInDebian = runInLinuxImage (
-    stdenv.mkDerivation {
-      name = "deb-compile";
-      src = patchelf.src;
-      diskImage = diskImages.ubuntu1804i386;
-      diskImageFormat = "qcow2";
-      memSize = 512;
-      postHook = ''
-        dpkg-query --list
-      '';
-    }
-  );
+  testUbuntuImage = makeImageTestScript diskImages.ubuntu2404x86_64;
 
 }
diff --git a/pkgs/test/default.nix b/pkgs/test/default.nix
index cf49620be100..d1449a1f7f91 100644
--- a/pkgs/test/default.nix
+++ b/pkgs/test/default.nix
@@ -191,6 +191,8 @@ in
 
   trivial-builders = callPackage ../build-support/trivial-builders/test/default.nix { };
 
+  vmTools = callPackage ../build-support/vm/test.nix { };
+
   writers = callPackage ../build-support/writers/test.nix { };
 
   testers = callPackage ../build-support/testers/test/default.nix { };
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 45fda231747f..1ec7e29d56f1 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -830,8 +830,9 @@ with pkgs;
     inherit (darwin) signingUtils;
   };
 
-  # No callPackage.  In particular, we don't want `img` *package* in parameters.
-  vmTools = makeOverridable (import ../build-support/vm) { inherit pkgs lib; };
+  vmTools = callPackage ../build-support/vm {
+    img = stdenv.hostPlatform.linux-kernel.target;
+  };
 
   releaseTools = callPackage ../build-support/release { };
 

From 9d6ee212624c7b6a331945f49c4c7afc86bd26e2 Mon Sep 17 00:00:00 2001
From: Philip Taron <philip.taron@gmail.com>
Date: Wed, 17 Dec 2025 14:50:21 -0800
Subject: [PATCH 02/29] nixos: pass stdenv into qemu-common

We also don't export it from `vmTools` anymore.
---
 nixos/lib/qemu-common.nix                      | 10 +++++-----
 nixos/lib/testing/network.nix                  |  2 +-
 nixos/modules/testing/test-instrumentation.nix |  2 +-
 nixos/modules/virtualisation/qemu-vm.nix       |  2 +-
 nixos/tests/boot.nix                           |  2 +-
 nixos/tests/networking/router.nix              |  2 +-
 pkgs/build-support/vm/default.nix              |  5 +----
 7 files changed, 11 insertions(+), 14 deletions(-)

diff --git a/nixos/lib/qemu-common.nix b/nixos/lib/qemu-common.nix
index 5629b0b81d20..a43b624cdbce 100644
--- a/nixos/lib/qemu-common.nix
+++ b/nixos/lib/qemu-common.nix
@@ -1,5 +1,5 @@
 # QEMU-related utilities shared between various Nix expressions.
-{ lib, pkgs }:
+{ lib, stdenv }:
 
 let
   zeroPad =
@@ -17,19 +17,19 @@ rec {
   ];
 
   qemuSerialDevice =
-    if with pkgs.stdenv.hostPlatform; isx86 || isLoongArch64 || isMips64 || isRiscV then
+    if with stdenv.hostPlatform; isx86 || isLoongArch64 || isMips64 || isRiscV then
       "ttyS0"
-    else if (with pkgs.stdenv.hostPlatform; isAarch || isPower) then
+    else if (with stdenv.hostPlatform; isAarch || isPower) then
       "ttyAMA0"
     else
-      throw "Unknown QEMU serial device for system '${pkgs.stdenv.hostPlatform.system}'";
+      throw "Unknown QEMU serial device for system '${stdenv.hostPlatform.system}'";
 
   qemuBinary =
     qemuPkg:
     let
       hostStdenv = qemuPkg.stdenv;
       hostSystem = hostStdenv.system;
-      guestSystem = pkgs.stdenv.hostPlatform.system;
+      guestSystem = stdenv.hostPlatform.system;
 
       linuxHostGuestMatrix = {
         x86_64-linux = "${qemuPkg}/bin/qemu-system-x86_64 -machine accel=kvm:tcg -cpu max";
diff --git a/nixos/lib/testing/network.nix b/nixos/lib/testing/network.nix
index 1188e9bec505..e65767e7fb99 100644
--- a/nixos/lib/testing/network.nix
+++ b/nixos/lib/testing/network.nix
@@ -30,7 +30,7 @@ let
       ...
     }:
     let
-      qemu-common = import ../qemu-common.nix { inherit lib pkgs; };
+      qemu-common = import ../qemu-common.nix { inherit (pkgs) lib stdenv; };
 
       # Convert legacy VLANs to named interfaces and merge with explicit interfaces.
       vlansNumbered = forEach (zipLists config.virtualisation.vlans (range 1 255)) (v: {
diff --git a/nixos/modules/testing/test-instrumentation.nix b/nixos/modules/testing/test-instrumentation.nix
index 3ec4fdc0e2a0..dce59a0a93b7 100644
--- a/nixos/modules/testing/test-instrumentation.nix
+++ b/nixos/modules/testing/test-instrumentation.nix
@@ -14,7 +14,7 @@ with lib;
 let
   cfg = config.testing;
 
-  qemu-common = import ../../lib/qemu-common.nix { inherit lib pkgs; };
+  qemu-common = import ../../lib/qemu-common.nix { inherit (pkgs) lib stdenv; };
 
   backdoorService = {
     requires = [
diff --git a/nixos/modules/virtualisation/qemu-vm.nix b/nixos/modules/virtualisation/qemu-vm.nix
index abded7525062..8a6c55cfc9fa 100644
--- a/nixos/modules/virtualisation/qemu-vm.nix
+++ b/nixos/modules/virtualisation/qemu-vm.nix
@@ -16,7 +16,7 @@ with lib;
 
 let
 
-  qemu-common = import ../../lib/qemu-common.nix { inherit lib pkgs; };
+  qemu-common = import ../../lib/qemu-common.nix { inherit (pkgs) lib stdenv; };
 
   cfg = config.virtualisation;
 
diff --git a/nixos/tests/boot.nix b/nixos/tests/boot.nix
index 863d80e41dac..d1ac1a8769fe 100644
--- a/nixos/tests/boot.nix
+++ b/nixos/tests/boot.nix
@@ -8,7 +8,7 @@ with import ../lib/testing-python.nix { inherit system pkgs; };
 
 let
   lib = pkgs.lib;
-  qemu-common = import ../lib/qemu-common.nix { inherit lib pkgs; };
+  qemu-common = import ../lib/qemu-common.nix { inherit (pkgs) lib stdenv; };
 
   mkStartCommand =
     {
diff --git a/nixos/tests/networking/router.nix b/nixos/tests/networking/router.nix
index 082f2bc7d227..ae9c64607a66 100644
--- a/nixos/tests/networking/router.nix
+++ b/nixos/tests/networking/router.nix
@@ -2,7 +2,7 @@
 { config, pkgs, ... }:
 let
   inherit (pkgs) lib;
-  qemu-common = import ../../lib/qemu-common.nix { inherit lib pkgs; };
+  qemu-common = import ../../lib/qemu-common.nix { inherit (pkgs) lib stdenv; };
   vlanIfs = lib.range 1 (lib.length config.virtualisation.vlans);
 in
 {
diff --git a/pkgs/build-support/vm/default.nix b/pkgs/build-support/vm/default.nix
index 0741ed1410cc..de0b589a37e6 100644
--- a/pkgs/build-support/vm/default.nix
+++ b/pkgs/build-support/vm/default.nix
@@ -24,7 +24,6 @@
   writeText,
   xz,
   zstd,
-  pkgs,
 
   # ----------------------------
   # The following  arguments form the "interface" of `pkgs.vmTools`.
@@ -47,7 +46,7 @@
 }:
 
 let
-  qemu-common = import ../../../nixos/lib/qemu-common.nix { inherit lib pkgs; };
+  qemu-common = import ../../../nixos/lib/qemu-common.nix { inherit lib stdenv; };
 
   qemu = buildPackages.qemu_kvm;
 
@@ -1323,8 +1322,6 @@ in
     makeImageTestScript
     modulesClosure
     qemu
-    qemu-common
-    qemuCommandLinux
     rpmClosureGenerator
     rpmDistros
     runInLinuxImage

From 5112cf457ad20ea6554efeeb507bd62b4e80fc69 Mon Sep 17 00:00:00 2001
From: Philip Taron <philip.taron@gmail.com>
Date: Wed, 17 Dec 2025 15:14:10 -0800
Subject: [PATCH 03/29] vmTools: update Debian 11 to snapshot 20251217T203845Z

---
 pkgs/build-support/vm/default.nix | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/pkgs/build-support/vm/default.nix b/pkgs/build-support/vm/default.nix
index de0b589a37e6..9524caccb312 100644
--- a/pkgs/build-support/vm/default.nix
+++ b/pkgs/build-support/vm/default.nix
@@ -1065,24 +1065,24 @@ let
     };
 
     debian11i386 = {
-      name = "debian-11.8-bullseye-i386";
-      fullName = "Debian 11.8 Bullseye (i386)";
+      name = "debian-11.11-bullseye-i386";
+      fullName = "Debian 11.11 Bullseye (i386)";
       packagesList = fetchurl {
-        url = "https://snapshot.debian.org/archive/debian/20231124T031419Z/dists/bullseye/main/binary-i386/Packages.xz";
-        hash = "sha256-0bKSLLPhEC7FB5D1NA2jaQP0wTe/Qp1ddiA/NDVjRaI=";
+        url = "https://snapshot.debian.org/archive/debian/20251217T203845Z/dists/bullseye/main/binary-i386/Packages.xz";
+        hash = "sha256-kUg1VBUO6co/5bKloxncta49191oCeF05Hm399+UuDA=";
       };
-      urlPrefix = "https://snapshot.debian.org/archive/debian/20231124T031419Z";
+      urlPrefix = "https://snapshot.debian.org/archive/debian/20251217T203845Z";
       packages = commonDebianPackages;
     };
 
     debian11x86_64 = {
-      name = "debian-11.8-bullseye-amd64";
-      fullName = "Debian 11.8 Bullseye (amd64)";
+      name = "debian-11.11-bullseye-amd64";
+      fullName = "Debian 11.11 Bullseye (amd64)";
       packagesList = fetchurl {
-        url = "https://snapshot.debian.org/archive/debian/20231124T031419Z/dists/bullseye/main/binary-amd64/Packages.xz";
-        hash = "sha256-CYPsGgQgJZkh3JmbcAQkYDWP193qrkOADOgrMETZIeo=";
+        url = "https://snapshot.debian.org/archive/debian/20251217T203845Z/dists/bullseye/main/binary-amd64/Packages.xz";
+        hash = "sha256-HDQFREKX6thkcRwY5kvOSBDbY7SDQKL52BGC2fI1rXE=";
       };
-      urlPrefix = "https://snapshot.debian.org/archive/debian/20231124T031419Z";
+      urlPrefix = "https://snapshot.debian.org/archive/debian/20251217T203845Z";
       packages = commonDebianPackages;
     };
 

From 0e2d64bbd03a58cb44d7e70605c93dcf96e58726 Mon Sep 17 00:00:00 2001
From: Philip Taron <philip.taron@gmail.com>
Date: Wed, 17 Dec 2025 15:15:31 -0800
Subject: [PATCH 04/29] vmTools: update Debian 12 to snapshot 20251217T203845Z

---
 pkgs/build-support/vm/default.nix | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/pkgs/build-support/vm/default.nix b/pkgs/build-support/vm/default.nix
index 9524caccb312..a1d0666a45a6 100644
--- a/pkgs/build-support/vm/default.nix
+++ b/pkgs/build-support/vm/default.nix
@@ -1087,24 +1087,24 @@ let
     };
 
     debian12i386 = {
-      name = "debian-12.2-bookworm-i386";
-      fullName = "Debian 12.2 Bookworm (i386)";
+      name = "debian-12.12-bookworm-i386";
+      fullName = "Debian 12.12 Bookworm (i386)";
       packagesList = fetchurl {
-        url = "https://snapshot.debian.org/archive/debian/20231124T031419Z/dists/bookworm/main/binary-i386/Packages.xz";
-        hash = "sha256-OeN9Q2HFM3GsPNhOa4VhM7qpwT66yUNwC+6Z8SbGEeQ=";
+        url = "https://snapshot.debian.org/archive/debian/20251217T203845Z/dists/bookworm/main/binary-i386/Packages.xz";
+        hash = "sha256-nIijsNoHUYkrL6eiwN4FCLHnJy/Bv/RMvnbMIHvieVI=";
       };
-      urlPrefix = "https://snapshot.debian.org/archive/debian/20231124T031419Z";
+      urlPrefix = "https://snapshot.debian.org/archive/debian/20251217T203845Z";
       packages = commonDebianPackages;
     };
 
     debian12x86_64 = {
-      name = "debian-12.2-bookworm-amd64";
-      fullName = "Debian 12.2 Bookworm (amd64)";
+      name = "debian-12.12-bookworm-amd64";
+      fullName = "Debian 12.12 Bookworm (amd64)";
       packagesList = fetchurl {
-        url = "https://snapshot.debian.org/archive/debian/20231124T031419Z/dists/bookworm/main/binary-amd64/Packages.xz";
-        hash = "sha256-SZDElRfe9BlBwDlajQB79Qdn08rv8whYoQDeVCveKVs=";
+        url = "https://snapshot.debian.org/archive/debian/20251217T203845Z/dists/bookworm/main/binary-amd64/Packages.xz";
+        hash = "sha256-PfjQeu3tXmXZhH7foSD6WyFrvY4PfwSN/v5pBeShIBE=";
       };
-      urlPrefix = "https://snapshot.debian.org/archive/debian/20231124T031419Z";
+      urlPrefix = "https://snapshot.debian.org/archive/debian/20251217T203845Z";
       packages = commonDebianPackages;
     };
 

From e327ca205502b4987bdcf7e74e0dd9819f19b708 Mon Sep 17 00:00:00 2001
From: Philip Taron <philip.taron@gmail.com>
Date: Wed, 17 Dec 2025 15:17:27 -0800
Subject: [PATCH 05/29] vmTools: update Debian 13 to snapshot 20251217T203845Z

---
 pkgs/build-support/vm/default.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/build-support/vm/default.nix b/pkgs/build-support/vm/default.nix
index a1d0666a45a6..574533c044da 100644
--- a/pkgs/build-support/vm/default.nix
+++ b/pkgs/build-support/vm/default.nix
@@ -1112,10 +1112,10 @@ let
       name = "debian-13.2-trixie-i386";
       fullName = "Debian 13.2 Trixie (i386)";
       packagesList = fetchurl {
-        url = "https://snapshot.debian.org/archive/debian/20251203T144617Z/dists/trixie/main/binary-i386/Packages.xz";
+        url = "https://snapshot.debian.org/archive/debian/20251217T203845Z/dists/trixie/main/binary-i386/Packages.xz";
         hash = "sha256-9zozvFZoWiv3wNe9rb+kPwSOgc5G5f4zmNpdoet5A78=";
       };
-      urlPrefix = "https://snapshot.debian.org/archive/debian/20251203T144617Z";
+      urlPrefix = "https://snapshot.debian.org/archive/debian/20251217T203845Z";
       packages = commonDebianPackages;
     };
 
@@ -1123,10 +1123,10 @@ let
       name = "debian-13.2-trixie-amd64";
       fullName = "Debian 13.2 Trixie (amd64)";
       packagesList = fetchurl {
-        url = "https://snapshot.debian.org/archive/debian/20251203T144617Z/dists/trixie/main/binary-amd64/Packages.xz";
+        url = "https://snapshot.debian.org/archive/debian/20251217T203845Z/dists/trixie/main/binary-amd64/Packages.xz";
         hash = "sha256-g7f+tKljUXAC4gxJfzSC8+j0GbiwRZjonv25tYuvxtU=";
       };
-      urlPrefix = "https://snapshot.debian.org/archive/debian/20251203T144617Z";
+      urlPrefix = "https://snapshot.debian.org/archive/debian/20251217T203845Z";
       packages = commonDebianPackages;
     };
   };

From 0b2d855f936ffeca9ebf87461652153b5d5ecc4f Mon Sep 17 00:00:00 2001
From: Philip Taron <philip.taron@gmail.com>
Date: Wed, 17 Dec 2025 15:25:49 -0800
Subject: [PATCH 06/29] vmTools: update Ubuntu versions to use the
 snapshot.ubuntu.com server

---
 pkgs/build-support/vm/default.nix | 32 ++++++++++++++++---------------
 1 file changed, 17 insertions(+), 15 deletions(-)

diff --git a/pkgs/build-support/vm/default.nix b/pkgs/build-support/vm/default.nix
index 574533c044da..6b3edfdd5cc2 100644
--- a/pkgs/build-support/vm/default.nix
+++ b/pkgs/build-support/vm/default.nix
@@ -1004,20 +1004,22 @@ let
   # The set of supported Dpkg-based distributions.
 
   debDistros = {
+    # Ubuntu's snapshot service returns the same data for 22.04 regardless of the timestamp in the
+    # URL. The hashes don't change between mirror://ubuntu and snapshot.ubuntu.com, so this is fine.
     ubuntu2204i386 = {
       name = "ubuntu-22.04-jammy-i386";
       fullName = "Ubuntu 22.04 Jammy (i386)";
       packagesLists = [
         (fetchurl {
-          url = "mirror://ubuntu/dists/jammy/main/binary-i386/Packages.xz";
-          sha256 = "sha256-iZBmwT0ep4v+V3sayybbOgZBOFFZwPGpOKtmuLMMVPQ=";
+          url = "https://snapshot.ubuntu.com/ubuntu/20251217T000000Z/dists/jammy/main/binary-i386/Packages.xz";
+          hash = "sha256-iZBmwT0ep4v+V3sayybbOgZBOFFZwPGpOKtmuLMMVPQ=";
         })
         (fetchurl {
-          url = "mirror://ubuntu/dists/jammy/universe/binary-i386/Packages.xz";
-          sha256 = "sha256-DO2LdpZ9rDDBhWj2gvDWd0TJJVZHxKsYTKTi6GXjm1E=";
+          url = "https://snapshot.ubuntu.com/ubuntu/20251217T000000Z/dists/jammy/universe/binary-i386/Packages.xz";
+          hash = "sha256-DO2LdpZ9rDDBhWj2gvDWd0TJJVZHxKsYTKTi6GXjm1E=";
         })
       ];
-      urlPrefix = "mirror://ubuntu";
+      urlPrefix = "https://snapshot.ubuntu.com/ubuntu/20251217T000000Z";
       packages = commonDebPackages ++ [
         "diffutils"
         "libc-bin"
@@ -1029,15 +1031,15 @@ let
       fullName = "Ubuntu 22.04 Jammy (amd64)";
       packagesLists = [
         (fetchurl {
-          url = "mirror://ubuntu/dists/jammy/main/binary-amd64/Packages.xz";
-          sha256 = "sha256-N8tX8VVMv6ccWinun/7hipqMF4K7BWjgh0t/9M6PnBE=";
+          url = "https://snapshot.ubuntu.com/ubuntu/20251217T000000Z/dists/jammy/main/binary-amd64/Packages.xz";
+          hash = "sha256-N8tX8VVMv6ccWinun/7hipqMF4K7BWjgh0t/9M6PnBE=";
         })
         (fetchurl {
-          url = "mirror://ubuntu/dists/jammy/universe/binary-amd64/Packages.xz";
-          sha256 = "sha256-0pyyTJP+xfQyVXBrzn60bUd5lSA52MaKwbsUpvNlXOI=";
+          url = "https://snapshot.ubuntu.com/ubuntu/20251217T000000Z/dists/jammy/universe/binary-amd64/Packages.xz";
+          hash = "sha256-0pyyTJP+xfQyVXBrzn60bUd5lSA52MaKwbsUpvNlXOI=";
         })
       ];
-      urlPrefix = "mirror://ubuntu";
+      urlPrefix = "https://snapshot.ubuntu.com/ubuntu/20251217T000000Z";
       packages = commonDebPackages ++ [
         "diffutils"
         "libc-bin"
@@ -1049,15 +1051,15 @@ let
       fullName = "Ubuntu 24.04 Noble (amd64)";
       packagesLists = [
         (fetchurl {
-          url = "mirror://ubuntu/dists/noble/main/binary-amd64/Packages.xz";
-          sha256 = "sha256-KmoZnhAxpcJ5yzRmRtWUmT81scA91KgqqgMjmA3ZJFE=";
+          url = "https://snapshot.ubuntu.com/ubuntu/20251217T000000Z/dists/noble/main/binary-amd64/Packages.xz";
+          hash = "sha256-KmoZnhAxpcJ5yzRmRtWUmT81scA91KgqqgMjmA3ZJFE=";
         })
         (fetchurl {
-          url = "mirror://ubuntu/dists/noble/universe/binary-amd64/Packages.xz";
-          sha256 = "sha256-upBX+huRQ4zIodJoCNAMhTif4QHQwUliVN+XI2QFWZo=";
+          url = "https://snapshot.ubuntu.com/ubuntu/20251217T000000Z/dists/noble/universe/binary-amd64/Packages.xz";
+          hash = "sha256-upBX+huRQ4zIodJoCNAMhTif4QHQwUliVN+XI2QFWZo=";
         })
       ];
-      urlPrefix = "mirror://ubuntu";
+      urlPrefix = "https://snapshot.ubuntu.com/ubuntu/20251217T000000Z";
       packages = commonDebPackages ++ [
         "diffutils"
         "libc-bin"

From 57c1584110c1d8b980f9053c6829c0822e37c09e Mon Sep 17 00:00:00 2001
From: Philip Taron <philip.taron@gmail.com>
Date: Wed, 17 Dec 2025 15:32:06 -0800
Subject: [PATCH 07/29] vmTools: add in updates and security pockets for all
 Ubuntu distros

---
 pkgs/build-support/vm/default.nix | 48 +++++++++++++++++++++++++++++++
 1 file changed, 48 insertions(+)

diff --git a/pkgs/build-support/vm/default.nix b/pkgs/build-support/vm/default.nix
index 6b3edfdd5cc2..9fa1050c76ec 100644
--- a/pkgs/build-support/vm/default.nix
+++ b/pkgs/build-support/vm/default.nix
@@ -1018,6 +1018,22 @@ let
           url = "https://snapshot.ubuntu.com/ubuntu/20251217T000000Z/dists/jammy/universe/binary-i386/Packages.xz";
           hash = "sha256-DO2LdpZ9rDDBhWj2gvDWd0TJJVZHxKsYTKTi6GXjm1E=";
         })
+        (fetchurl {
+          url = "https://snapshot.ubuntu.com/ubuntu/20251217T000000Z/dists/jammy-updates/main/binary-i386/Packages.xz";
+          hash = "sha256-g95BtOoMxacZEHMBbcMes4a1P9HKf/QGOMOPr+OKayo=";
+        })
+        (fetchurl {
+          url = "https://snapshot.ubuntu.com/ubuntu/20251217T000000Z/dists/jammy-updates/universe/binary-i386/Packages.xz";
+          hash = "sha256-AW/XNsA1SblUhfkUP9pC/TLF6cerGI41gfSBCihgt7w=";
+        })
+        (fetchurl {
+          url = "https://snapshot.ubuntu.com/ubuntu/20251217T000000Z/dists/jammy-security/main/binary-i386/Packages.xz";
+          hash = "sha256-SkP4PqjUAbEMtktR5WQm/3jQl9O0T2VOVTP9QIYIVkQ=";
+        })
+        (fetchurl {
+          url = "https://snapshot.ubuntu.com/ubuntu/20251217T000000Z/dists/jammy-security/universe/binary-i386/Packages.xz";
+          hash = "sha256-citjk8LAGSRlXgOXgf3oe9vBCUC6/DJGhRJl/3ppN9c=";
+        })
       ];
       urlPrefix = "https://snapshot.ubuntu.com/ubuntu/20251217T000000Z";
       packages = commonDebPackages ++ [
@@ -1038,6 +1054,22 @@ let
           url = "https://snapshot.ubuntu.com/ubuntu/20251217T000000Z/dists/jammy/universe/binary-amd64/Packages.xz";
           hash = "sha256-0pyyTJP+xfQyVXBrzn60bUd5lSA52MaKwbsUpvNlXOI=";
         })
+        (fetchurl {
+          url = "https://snapshot.ubuntu.com/ubuntu/20251217T000000Z/dists/jammy-updates/main/binary-amd64/Packages.xz";
+          hash = "sha256-kFHg+DogK+deDx9Tbp7+SaIegnotE5ZofqR8J7S73n8=";
+        })
+        (fetchurl {
+          url = "https://snapshot.ubuntu.com/ubuntu/20251217T000000Z/dists/jammy-updates/universe/binary-amd64/Packages.xz";
+          hash = "sha256-WQbtqdAWbhfd8/fwct1uuJXHiZQGPMw3KKhmha4MeTs=";
+        })
+        (fetchurl {
+          url = "https://snapshot.ubuntu.com/ubuntu/20251217T000000Z/dists/jammy-security/main/binary-amd64/Packages.xz";
+          hash = "sha256-cifTPY1iyckkaLd7dp+VPRlF0viWKrWXhM8HVWaMuUw=";
+        })
+        (fetchurl {
+          url = "https://snapshot.ubuntu.com/ubuntu/20251217T000000Z/dists/jammy-security/universe/binary-amd64/Packages.xz";
+          hash = "sha256-LTSOGbzkv0KrF2JM6oVT1Ml2KQkySXMbKNMBb9AyfQM=";
+        })
       ];
       urlPrefix = "https://snapshot.ubuntu.com/ubuntu/20251217T000000Z";
       packages = commonDebPackages ++ [
@@ -1058,6 +1090,22 @@ let
           url = "https://snapshot.ubuntu.com/ubuntu/20251217T000000Z/dists/noble/universe/binary-amd64/Packages.xz";
           hash = "sha256-upBX+huRQ4zIodJoCNAMhTif4QHQwUliVN+XI2QFWZo=";
         })
+        (fetchurl {
+          url = "https://snapshot.ubuntu.com/ubuntu/20251217T000000Z/dists/noble-updates/main/binary-amd64/Packages.xz";
+          hash = "sha256-f6hiUH9S1Bh8/Ljr9AkZYlwHF1vT2bqKGH6TfWnzI7Q=";
+        })
+        (fetchurl {
+          url = "https://snapshot.ubuntu.com/ubuntu/20251217T000000Z/dists/noble-updates/universe/binary-amd64/Packages.xz";
+          hash = "sha256-ROG+WO5zssfFUblTZxQjIDshdLIZn3meEgTsv6qYi5o=";
+        })
+        (fetchurl {
+          url = "https://snapshot.ubuntu.com/ubuntu/20251217T000000Z/dists/noble-security/main/binary-amd64/Packages.xz";
+          hash = "sha256-TYs8ugCYqzOleH2OebdrpB8E68PfxB+7sRb+PlfANEo=";
+        })
+        (fetchurl {
+          url = "https://snapshot.ubuntu.com/ubuntu/20251217T000000Z/dists/noble-security/universe/binary-amd64/Packages.xz";
+          hash = "sha256-bK9R8CUjLQ1V4GP7/KqZooSnKHF5+T5SuBs0butC82M=";
+        })
       ];
       urlPrefix = "https://snapshot.ubuntu.com/ubuntu/20251217T000000Z";
       packages = commonDebPackages ++ [

From 8f9e96fd60bf4476e4b0e34f55cc97fa78dbdd8f Mon Sep 17 00:00:00 2001
From: Philip Taron <philip.taron@gmail.com>
Date: Wed, 17 Dec 2025 15:35:51 -0800
Subject: [PATCH 08/29] vmTools: add in backports packages for bookworm and
 trixie

---
 pkgs/build-support/vm/default.nix | 56 ++++++++++++++++++++++---------
 1 file changed, 40 insertions(+), 16 deletions(-)

diff --git a/pkgs/build-support/vm/default.nix b/pkgs/build-support/vm/default.nix
index 9fa1050c76ec..2335919d3d80 100644
--- a/pkgs/build-support/vm/default.nix
+++ b/pkgs/build-support/vm/default.nix
@@ -1139,10 +1139,16 @@ let
     debian12i386 = {
       name = "debian-12.12-bookworm-i386";
       fullName = "Debian 12.12 Bookworm (i386)";
-      packagesList = fetchurl {
-        url = "https://snapshot.debian.org/archive/debian/20251217T203845Z/dists/bookworm/main/binary-i386/Packages.xz";
-        hash = "sha256-nIijsNoHUYkrL6eiwN4FCLHnJy/Bv/RMvnbMIHvieVI=";
-      };
+      packagesLists = [
+        (fetchurl {
+          url = "https://snapshot.debian.org/archive/debian/20251217T203845Z/dists/bookworm/main/binary-i386/Packages.xz";
+          hash = "sha256-nIijsNoHUYkrL6eiwN4FCLHnJy/Bv/RMvnbMIHvieVI=";
+        })
+        (fetchurl {
+          url = "https://snapshot.debian.org/archive/debian/20251217T203845Z/dists/bookworm-backports/main/binary-i386/Packages.xz";
+          hash = "sha256-9WXnIg1CgzTGaUXnCTs/n/EhJ11aNcKn7rV9FDAi+U8=";
+        })
+      ];
       urlPrefix = "https://snapshot.debian.org/archive/debian/20251217T203845Z";
       packages = commonDebianPackages;
     };
@@ -1150,10 +1156,16 @@ let
     debian12x86_64 = {
       name = "debian-12.12-bookworm-amd64";
       fullName = "Debian 12.12 Bookworm (amd64)";
-      packagesList = fetchurl {
-        url = "https://snapshot.debian.org/archive/debian/20251217T203845Z/dists/bookworm/main/binary-amd64/Packages.xz";
-        hash = "sha256-PfjQeu3tXmXZhH7foSD6WyFrvY4PfwSN/v5pBeShIBE=";
-      };
+      packagesLists = [
+        (fetchurl {
+          url = "https://snapshot.debian.org/archive/debian/20251217T203845Z/dists/bookworm/main/binary-amd64/Packages.xz";
+          hash = "sha256-PfjQeu3tXmXZhH7foSD6WyFrvY4PfwSN/v5pBeShIBE=";
+        })
+        (fetchurl {
+          url = "https://snapshot.debian.org/archive/debian/20251217T203845Z/dists/bookworm-backports/main/binary-amd64/Packages.xz";
+          hash = "sha256-i897N1JzuixjtZcFW90X/UJLXfxQOIQoJV9SC/VHpUE=";
+        })
+      ];
       urlPrefix = "https://snapshot.debian.org/archive/debian/20251217T203845Z";
       packages = commonDebianPackages;
     };
@@ -1161,10 +1173,16 @@ let
     debian13i386 = {
       name = "debian-13.2-trixie-i386";
       fullName = "Debian 13.2 Trixie (i386)";
-      packagesList = fetchurl {
-        url = "https://snapshot.debian.org/archive/debian/20251217T203845Z/dists/trixie/main/binary-i386/Packages.xz";
-        hash = "sha256-9zozvFZoWiv3wNe9rb+kPwSOgc5G5f4zmNpdoet5A78=";
-      };
+      packagesLists = [
+        (fetchurl {
+          url = "https://snapshot.debian.org/archive/debian/20251217T203845Z/dists/trixie/main/binary-i386/Packages.xz";
+          hash = "sha256-9zozvFZoWiv3wNe9rb+kPwSOgc5G5f4zmNpdoet5A78=";
+        })
+        (fetchurl {
+          url = "https://snapshot.debian.org/archive/debian/20251217T203845Z/dists/trixie-backports/main/binary-i386/Packages.xz";
+          hash = "sha256-JdBVmdbD5LQhHbqIHnPeJiGnhrZbJoiYPWlh73A2/wA=";
+        })
+      ];
       urlPrefix = "https://snapshot.debian.org/archive/debian/20251217T203845Z";
       packages = commonDebianPackages;
     };
@@ -1172,10 +1190,16 @@ let
     debian13x86_64 = {
       name = "debian-13.2-trixie-amd64";
       fullName = "Debian 13.2 Trixie (amd64)";
-      packagesList = fetchurl {
-        url = "https://snapshot.debian.org/archive/debian/20251217T203845Z/dists/trixie/main/binary-amd64/Packages.xz";
-        hash = "sha256-g7f+tKljUXAC4gxJfzSC8+j0GbiwRZjonv25tYuvxtU=";
-      };
+      packagesLists = [
+        (fetchurl {
+          url = "https://snapshot.debian.org/archive/debian/20251217T203845Z/dists/trixie/main/binary-amd64/Packages.xz";
+          hash = "sha256-g7f+tKljUXAC4gxJfzSC8+j0GbiwRZjonv25tYuvxtU=";
+        })
+        (fetchurl {
+          url = "https://snapshot.debian.org/archive/debian/20251217T203845Z/dists/trixie-backports/main/binary-amd64/Packages.xz";
+          hash = "sha256-J7BcablKTswyfKmCIoWGlE32puSDFgcKQGNmhbvl+CY=";
+        })
+      ];
       urlPrefix = "https://snapshot.debian.org/archive/debian/20251217T203845Z";
       packages = commonDebianPackages;
     };

From b0bc31286904895184d0db1370ccae962586bc6a Mon Sep 17 00:00:00 2001
From: Philip Taron <philip.taron@gmail.com>
Date: Wed, 17 Dec 2025 16:02:53 -0800
Subject: [PATCH 09/29] vmTools: add in Fedora 42 support

---
 pkgs/build-support/vm/default.nix | 41 +++++++++++++++++++++++++++++--
 pkgs/build-support/vm/test.nix    | 20 +++++++--------
 2 files changed, 49 insertions(+), 12 deletions(-)

diff --git a/pkgs/build-support/vm/default.nix b/pkgs/build-support/vm/default.nix
index 2335919d3d80..68864c937986 100644
--- a/pkgs/build-support/vm/default.nix
+++ b/pkgs/build-support/vm/default.nix
@@ -836,12 +836,30 @@ let
         nativeBuildInputs = [
           buildPackages.perl
           buildPackages.perlPackages.XMLSimple
+          buildPackages.zstd
         ];
         inherit archs;
       }
       ''
         ${lib.concatImapStrings (i: pl: ''
-          gunzip < ${pl} > ./packages_${toString i}.xml
+          echo "decompressing ${pl}..."
+          case ${pl} in
+            *.zst)
+              zstd -d < ${pl} > ./packages_${toString i}.xml
+              ;;
+            *.xz | *.lzma)
+              xz -d < ${pl} > ./packages_${toString i}.xml
+              ;;
+            *.bz2)
+              bunzip2 < ${pl} > ./packages_${toString i}.xml
+              ;;
+            *.gz)
+              gunzip < ${pl} > ./packages_${toString i}.xml
+              ;;
+            *)
+              cp ${pl} ./packages_${toString i}.xml
+              ;;
+          esac
         '') packagesLists}
         perl -w ${rpm/rpm-closure.pl} \
           ${
@@ -999,7 +1017,23 @@ let
 
   # The set of supported RPM-based distributions.
 
-  rpmDistros = { };
+  rpmDistros = {
+    fedora42x86_64 = {
+      name = "fedora-42-x86_64";
+      fullName = "Fedora 42 (x86_64)";
+      packagesList = fetchurl {
+        url = "https://dl.fedoraproject.org/pub/fedora/linux/releases/42/Everything/x86_64/os/repodata/cd483b35df017d68b73a878a392bbf666a43d75db54c386e4720bc369eb5c3a3-primary.xml.zst";
+        hash = "sha256-zUg7Nd8BfWi3OoeKOSu/ZmpD1121TDhuRyC8Np61w6M=";
+      };
+      urlPrefix = "https://dl.fedoraproject.org/pub/fedora/linux/releases/42/Everything/x86_64/os";
+      archs = [
+        "noarch"
+        "x86_64"
+      ];
+      packages = commonFedoraPackages;
+      unifiedSystemDir = true;
+    };
+  };
 
   # The set of supported Dpkg-based distributions.
 
@@ -1207,6 +1241,7 @@ let
 
   # Common packages for Fedora images.
   commonFedoraPackages = [
+    "annobin-plugin-gcc"
     "autoconf"
     "automake"
     "basesystem"
@@ -1217,6 +1252,8 @@ let
     "findutils"
     "gawk"
     "gcc-c++"
+    "gcc-plugin-annobin"
+    "glibc-gconv-extra"
     "gzip"
     "make"
     "patch"
diff --git a/pkgs/build-support/vm/test.nix b/pkgs/build-support/vm/test.nix
index b99d4e5e7221..c312e3df1bbe 100644
--- a/pkgs/build-support/vm/test.nix
+++ b/pkgs/build-support/vm/test.nix
@@ -29,6 +29,15 @@ in
 
   buildHelloInVM = runInLinuxVM hello;
   buildStructuredAttrsHelloInVM = runInLinuxVM (hello.overrideAttrs { __structuredAttrs = true; });
+  buildHelloInFedora = runInLinuxImage (
+    stdenv.mkDerivation {
+      inherit (hello) pname version src;
+
+      diskImage = diskImages.fedora42x86_64;
+      diskImageFormat = "qcow2";
+      memSize = 512;
+    }
+  );
 
   buildPcmanrmInVM = runInLinuxVM (
     pcmanfm.overrideAttrs (old: {
@@ -37,15 +46,6 @@ in
     })
   );
 
-  #testRPMImage = makeImageTestScript diskImages.fedora27x86_64;
-
-  #buildPatchelfRPM = buildRPM {
-  #  name = "patchelf-rpm";
-  #  src = patchelf.src;
-  #  diskImage = diskImages.fedora27x86_64;
-  #  diskImageFormat = "qcow2";
-  #};
-
+  testFedoraImage = makeImageTestScript diskImages.fedora42x86_64;
   testUbuntuImage = makeImageTestScript diskImages.ubuntu2404x86_64;
-
 }

From 052667f52590387c00e7d29a0a93777ca3defaa1 Mon Sep 17 00:00:00 2001
From: Philip Taron <philip.taron@gmail.com>
Date: Wed, 17 Dec 2025 17:20:51 -0800
Subject: [PATCH 10/29] vmTools: introduce Fedora 43

It uses unified sbin, which requires a slight tweak in the unifiedSystemDir setup
---
 pkgs/build-support/vm/default.nix        | 21 +++++++++++++++++++--
 pkgs/build-support/vm/rpm/rpm-closure.pl |  8 +++++++-
 pkgs/build-support/vm/test.nix           |  3 ++-
 3 files changed, 28 insertions(+), 4 deletions(-)

diff --git a/pkgs/build-support/vm/default.nix b/pkgs/build-support/vm/default.nix
index 68864c937986..68e83e2962c3 100644
--- a/pkgs/build-support/vm/default.nix
+++ b/pkgs/build-support/vm/default.nix
@@ -557,9 +557,10 @@ let
           # Newer distributions like Fedora 18 require /lib etc. to be
           # symlinked to /usr.
           ${lib.optionalString unifiedSystemDir ''
-            mkdir -p /mnt/usr/bin /mnt/usr/sbin /mnt/usr/lib /mnt/usr/lib64
+            mkdir -p /mnt/usr/bin /mnt/usr/lib /mnt/usr/lib64
             ln -s /usr/bin /mnt/bin
-            ln -s /usr/sbin /mnt/sbin
+            ln -s /usr/bin /mnt/sbin
+            ln -s /usr/bin /mnt/usr/sbin
             ln -s /usr/lib /mnt/lib
             ln -s /usr/lib64 /mnt/lib64
             ${util-linux}/bin/mount -t proc none /mnt/proc
@@ -1033,6 +1034,22 @@ let
       packages = commonFedoraPackages;
       unifiedSystemDir = true;
     };
+
+    fedora43x86_64 = {
+      name = "fedora-43-x86_64";
+      fullName = "Fedora 43 (x86_64)";
+      packagesList = fetchurl {
+        url = "https://dl.fedoraproject.org/pub/fedora/linux/releases/43/Everything/x86_64/os/repodata/fffa3e9f63fffd3d21b8ea5e9bb0fe349a7ed1d4e09777a618cec93a2bcc305f-primary.xml.zst";
+        hash = "sha256-//o+n2P//T0huOpem7D+NJp+0dTgl3emGM7JOivMMF8=";
+      };
+      urlPrefix = "https://dl.fedoraproject.org/pub/fedora/linux/releases/43/Everything/x86_64/os";
+      archs = [
+        "noarch"
+        "x86_64"
+      ];
+      packages = commonFedoraPackages ++ [ "gpgverify" ];
+      unifiedSystemDir = true;
+    };
   };
 
   # The set of supported Dpkg-based distributions.
diff --git a/pkgs/build-support/vm/rpm/rpm-closure.pl b/pkgs/build-support/vm/rpm/rpm-closure.pl
index 6442cd91a957..51ebfc9ade64 100644
--- a/pkgs/build-support/vm/rpm/rpm-closure.pl
+++ b/pkgs/build-support/vm/rpm/rpm-closure.pl
@@ -156,7 +156,13 @@ sub closePackage {
 
 
 foreach my $pkgName (@toplevelPkgs) {
-    closePackage $pkgName;
+    # If the package doesn't exist by name, check if something provides it
+    if (!defined $pkgs{$pkgName} && defined $provides{$pkgName}) {
+        print STDERR "package $pkgName is provided by $provides{$pkgName}\n";
+        closePackage $provides{$pkgName};
+    } else {
+        closePackage $pkgName;
+    }
 }
 
 
diff --git a/pkgs/build-support/vm/test.nix b/pkgs/build-support/vm/test.nix
index c312e3df1bbe..65bb49b18ef8 100644
--- a/pkgs/build-support/vm/test.nix
+++ b/pkgs/build-support/vm/test.nix
@@ -46,6 +46,7 @@ in
     })
   );
 
-  testFedoraImage = makeImageTestScript diskImages.fedora42x86_64;
+  testFedora42Image = makeImageTestScript diskImages.fedora42x86_64;
+  testFedora43Image = makeImageTestScript diskImages.fedora43x86_64;
   testUbuntuImage = makeImageTestScript diskImages.ubuntu2404x86_64;
 }

From 627a540b239bbefa0fefdea2f5c7875238c012bd Mon Sep 17 00:00:00 2001
From: Philip Taron <philip.taron@gmail.com>
Date: Wed, 17 Dec 2025 17:28:33 -0800
Subject: [PATCH 11/29] vmTools: introduce CentOS Stream 9

---
 pkgs/build-support/vm/default.nix | 50 +++++++++++++++++++++++++++++++
 pkgs/build-support/vm/test.nix    |  1 +
 2 files changed, 51 insertions(+)

diff --git a/pkgs/build-support/vm/default.nix b/pkgs/build-support/vm/default.nix
index 68e83e2962c3..333848f1bdca 100644
--- a/pkgs/build-support/vm/default.nix
+++ b/pkgs/build-support/vm/default.nix
@@ -1050,6 +1050,31 @@ let
       packages = commonFedoraPackages ++ [ "gpgverify" ];
       unifiedSystemDir = true;
     };
+
+    centosStream9x86_64 = {
+      name = "centos-stream-9-x86_64";
+      fullName = "CentOS Stream 9 (x86_64)";
+      packagesLists = [
+        (fetchurl {
+          url = "https://mirror.stream.centos.org/9-stream/BaseOS/x86_64/os/repodata/737e7bb91d5464e0cc258ff5ae5070a00d682c39fc2de0b9b55df671022ba732-primary.xml.gz";
+          hash = "sha256-c357uR1UZODMJY/1rlBwoA1oLDn8LeC5tV32cQIrpzI=";
+        })
+        (fetchurl {
+          url = "https://mirror.stream.centos.org/9-stream/AppStream/x86_64/os/repodata/9f0c1578e5df33e6479a1d3e5397b87ecaa1b5bac7fd34de6c837bddb3949fde-primary.xml.gz";
+          hash = "sha256-nwwVeOXfM+ZHmh0+U5e4fsqhtbrH/TTebIN73bOUn94=";
+        })
+      ];
+      urlPrefixes = [
+        "https://mirror.stream.centos.org/9-stream/BaseOS/x86_64/os"
+        "https://mirror.stream.centos.org/9-stream/AppStream/x86_64/os"
+      ];
+      archs = [
+        "noarch"
+        "x86_64"
+      ];
+      packages = commonCentOSStreamPackages;
+      unifiedSystemDir = true;
+    };
   };
 
   # The set of supported Dpkg-based distributions.
@@ -1304,6 +1329,31 @@ let
     "unzip"
   ];
 
+  commonCentOSStreamPackages = [
+    "annobin"
+    "autoconf"
+    "automake"
+    "basesystem"
+    "bzip2"
+    "curl"
+    "diffutils"
+    "centos-stream-release"
+    "findutils"
+    "gawk"
+    "gcc-c++"
+    "gcc-plugin-annobin"
+    "glibc-gconv-extra"
+    "gzip"
+    "make"
+    "patch"
+    "perl"
+    "pkgconf"
+    "rpm"
+    "rpm-build"
+    "tar"
+    "unzip"
+  ];
+
   commonRHELPackages = [
     "autoconf"
     "automake"
diff --git a/pkgs/build-support/vm/test.nix b/pkgs/build-support/vm/test.nix
index 65bb49b18ef8..6c4d7cb8b0dd 100644
--- a/pkgs/build-support/vm/test.nix
+++ b/pkgs/build-support/vm/test.nix
@@ -48,5 +48,6 @@ in
 
   testFedora42Image = makeImageTestScript diskImages.fedora42x86_64;
   testFedora43Image = makeImageTestScript diskImages.fedora43x86_64;
+  testCentOSStream9Image = makeImageTestScript diskImages.centosStream9x86_64;
   testUbuntuImage = makeImageTestScript diskImages.ubuntu2404x86_64;
 }

From c906fa0b6da4922b8898da8b1df0d83971eae1ce Mon Sep 17 00:00:00 2001
From: Philip Taron <philip.taron@gmail.com>
Date: Wed, 17 Dec 2025 17:46:26 -0800
Subject: [PATCH 12/29] vmTools: introduce CentOS Stream 10

---
 pkgs/build-support/vm/default.nix | 34 ++++++++++++++++++++++++++++---
 pkgs/build-support/vm/test.nix    |  1 +
 2 files changed, 32 insertions(+), 3 deletions(-)

diff --git a/pkgs/build-support/vm/default.nix b/pkgs/build-support/vm/default.nix
index 333848f1bdca..4d4965a9f7e2 100644
--- a/pkgs/build-support/vm/default.nix
+++ b/pkgs/build-support/vm/default.nix
@@ -1072,7 +1072,36 @@ let
         "noarch"
         "x86_64"
       ];
-      packages = commonCentOSStreamPackages;
+      packages = commonCentOSStreamPackages ++ [
+        "annobin"
+      ];
+      unifiedSystemDir = true;
+    };
+
+    centosStream10x86_64 = {
+      name = "centos-stream-10-x86_64";
+      fullName = "CentOS Stream 10 (x86_64)";
+      packagesLists = [
+        (fetchurl {
+          url = "https://mirror.stream.centos.org/10-stream/BaseOS/x86_64/os/repodata/b3bb8f59e9c3dfedf3439c8357dc6fb727dc3e6fd2e351ab5e1fb0cfbbf07381-primary.xml.gz";
+          hash = "sha256-s7uPWenD3+3zQ5yDV9xvtyfcPm/S41GrXh+wz7vwc4E=";
+        })
+        (fetchurl {
+          url = "https://mirror.stream.centos.org/10-stream/AppStream/x86_64/os/repodata/962343afafa14dcc36a6c054608ae9bbf700c8ead08d1ca8898b5b1a192e3106-primary.xml.gz";
+          hash = "sha256-liNDr6+hTcw2psBUYIrpu/cAyOrQjRyoiYtbGhkuMQY=";
+        })
+      ];
+      urlPrefixes = [
+        "https://mirror.stream.centos.org/10-stream/BaseOS/x86_64/os"
+        "https://mirror.stream.centos.org/10-stream/AppStream/x86_64/os"
+      ];
+      archs = [
+        "noarch"
+        "x86_64"
+      ];
+      packages = commonCentOSStreamPackages ++ [
+        "annobin-plugin-gcc"
+      ];
       unifiedSystemDir = true;
     };
   };
@@ -1330,14 +1359,13 @@ let
   ];
 
   commonCentOSStreamPackages = [
-    "annobin"
     "autoconf"
     "automake"
     "basesystem"
     "bzip2"
+    "centos-stream-release"
     "curl"
     "diffutils"
-    "centos-stream-release"
     "findutils"
     "gawk"
     "gcc-c++"
diff --git a/pkgs/build-support/vm/test.nix b/pkgs/build-support/vm/test.nix
index 6c4d7cb8b0dd..cebe45cc8a3d 100644
--- a/pkgs/build-support/vm/test.nix
+++ b/pkgs/build-support/vm/test.nix
@@ -49,5 +49,6 @@ in
   testFedora42Image = makeImageTestScript diskImages.fedora42x86_64;
   testFedora43Image = makeImageTestScript diskImages.fedora43x86_64;
   testCentOSStream9Image = makeImageTestScript diskImages.centosStream9x86_64;
+  testCentOSStream10Image = makeImageTestScript diskImages.centosStream10x86_64;
   testUbuntuImage = makeImageTestScript diskImages.ubuntu2404x86_64;
 }

From 686f52f7a33a4511cdbe9dc0a1b4fad632831087 Mon Sep 17 00:00:00 2001
From: Philip Taron <philip.taron@gmail.com>
Date: Wed, 17 Dec 2025 17:47:27 -0800
Subject: [PATCH 13/29] vmTools: remove unused commonCentOSPackages

---
 pkgs/build-support/vm/default.nix | 23 -----------------------
 1 file changed, 23 deletions(-)

diff --git a/pkgs/build-support/vm/default.nix b/pkgs/build-support/vm/default.nix
index 4d4965a9f7e2..67a2ecc2c7cc 100644
--- a/pkgs/build-support/vm/default.nix
+++ b/pkgs/build-support/vm/default.nix
@@ -1336,28 +1336,6 @@ let
     "unzip"
   ];
 
-  commonCentOSPackages = [
-    "autoconf"
-    "automake"
-    "basesystem"
-    "bzip2"
-    "curl"
-    "diffutils"
-    "centos-release"
-    "findutils"
-    "gawk"
-    "gcc-c++"
-    "gzip"
-    "make"
-    "patch"
-    "perl"
-    "pkgconfig"
-    "rpm"
-    "rpm-build"
-    "tar"
-    "unzip"
-  ];
-
   commonCentOSStreamPackages = [
     "autoconf"
     "automake"
@@ -1503,7 +1481,6 @@ in
 {
   inherit
     buildRPM
-    commonCentOSPackages
     commonDebPackages
     commonDebianPackages
     commonFedoraPackages

From 4664110a34fdb22f6019dac52d42d6f8636ae2a7 Mon Sep 17 00:00:00 2001
From: Philip Taron <philip.taron@gmail.com>
Date: Wed, 17 Dec 2025 18:30:11 -0800
Subject: [PATCH 14/29] vmTools: refactor in a baseRHELFamilyPackages

---
 pkgs/build-support/vm/default.nix | 86 +++++++++----------------------
 1 file changed, 24 insertions(+), 62 deletions(-)

diff --git a/pkgs/build-support/vm/default.nix b/pkgs/build-support/vm/default.nix
index 67a2ecc2c7cc..6c3e6ac21bc4 100644
--- a/pkgs/build-support/vm/default.nix
+++ b/pkgs/build-support/vm/default.nix
@@ -1310,76 +1310,39 @@ let
     };
   };
 
-  # Common packages for Fedora images.
-  commonFedoraPackages = [
+  # Base packages for all RHEL-family distros (Fedora, CentOS Stream, Rocky, Alma, etc.)
+  baseRHELFamilyPackages = [
+    "autoconf"
+    "automake"
+    "basesystem"
+    "bzip2"
+    "curl"
+    "diffutils"
+    "findutils"
+    "gawk"
+    "gcc-c++"
+    "glibc-gconv-extra"
+    "gzip"
+    "make"
+    "patch"
+    "perl"
+    "rpm"
+    "rpm-build"
+    "tar"
+    "unzip"
+  ];
+
+  commonFedoraPackages = baseRHELFamilyPackages ++ [
     "annobin-plugin-gcc"
-    "autoconf"
-    "automake"
-    "basesystem"
-    "bzip2"
-    "curl"
-    "diffutils"
     "fedora-release"
-    "findutils"
-    "gawk"
-    "gcc-c++"
     "gcc-plugin-annobin"
-    "glibc-gconv-extra"
-    "gzip"
-    "make"
-    "patch"
-    "perl"
     "pkgconf-pkg-config"
-    "rpm"
-    "rpm-build"
-    "tar"
-    "unzip"
   ];
 
-  commonCentOSStreamPackages = [
-    "autoconf"
-    "automake"
-    "basesystem"
-    "bzip2"
+  commonCentOSStreamPackages = baseRHELFamilyPackages ++ [
     "centos-stream-release"
-    "curl"
-    "diffutils"
-    "findutils"
-    "gawk"
-    "gcc-c++"
     "gcc-plugin-annobin"
-    "glibc-gconv-extra"
-    "gzip"
-    "make"
-    "patch"
-    "perl"
     "pkgconf"
-    "rpm"
-    "rpm-build"
-    "tar"
-    "unzip"
-  ];
-
-  commonRHELPackages = [
-    "autoconf"
-    "automake"
-    "basesystem"
-    "bzip2"
-    "curl"
-    "diffutils"
-    "findutils"
-    "gawk"
-    "gcc-c++"
-    "gzip"
-    "make"
-    "patch"
-    "perl"
-    "pkgconfig"
-    "procps-ng"
-    "rpm"
-    "rpm-build"
-    "tar"
-    "unzip"
   ];
 
   # Common packages for openSUSE images.
@@ -1485,7 +1448,6 @@ in
     commonDebianPackages
     commonFedoraPackages
     commonOpenSUSEPackages
-    commonRHELPackages
     createEmptyImage
     debClosureGenerator
     debDistros

From 89def9fcce5f733e128f915dfc83fa256b6245a3 Mon Sep 17 00:00:00 2001
From: Philip Taron <philip.taron@gmail.com>
Date: Wed, 17 Dec 2025 18:35:40 -0800
Subject: [PATCH 15/29] vmTools: add Rocky Linux 9

---
 pkgs/build-support/vm/default.nix | 35 +++++++++++++++++++++++++++++++
 pkgs/build-support/vm/test.nix    |  1 +
 2 files changed, 36 insertions(+)

diff --git a/pkgs/build-support/vm/default.nix b/pkgs/build-support/vm/default.nix
index 6c3e6ac21bc4..fc8b44baf1a3 100644
--- a/pkgs/build-support/vm/default.nix
+++ b/pkgs/build-support/vm/default.nix
@@ -1104,6 +1104,35 @@ let
       ];
       unifiedSystemDir = true;
     };
+
+    # Rocky Linux's /pub/rocky/9/ URL is rolling and changes with each minor release. We use the
+    # vault instead, which provides stable URLs for specific minor versions.
+    rocky9x86_64 = {
+      name = "rocky-9.5-x86_64";
+      fullName = "Rocky Linux 9.5 (x86_64)";
+      packagesLists = [
+        (fetchurl {
+          url = "https://dl.rockylinux.org/vault/rocky/9.5/BaseOS/x86_64/os/repodata/554cd09406b7bf632fc7014d0a567094272d37ac08f75af955de96183425dfa8-primary.xml.gz";
+          hash = "sha256-VUzQlAa3v2MvxwFNClZwlCctN6wI91r5Vd6WGDQl36g=";
+        })
+        (fetchurl {
+          url = "https://dl.rockylinux.org/vault/rocky/9.5/AppStream/x86_64/os/repodata/db8f32057dd37687574ea660d322ff7a0b5dc01bfba42888818b48ef686837cd-primary.xml.gz";
+          hash = "sha256-248yBX3TdodXTqZg0yL/egtdwBv7pCiIgYtI72hoN80=";
+        })
+      ];
+      urlPrefixes = [
+        "https://dl.rockylinux.org/vault/rocky/9.5/BaseOS/x86_64/os"
+        "https://dl.rockylinux.org/vault/rocky/9.5/AppStream/x86_64/os"
+      ];
+      archs = [
+        "noarch"
+        "x86_64"
+      ];
+      packages = commonRockyPackages ++ [
+        "annobin"
+      ];
+      unifiedSystemDir = true;
+    };
   };
 
   # The set of supported Dpkg-based distributions.
@@ -1345,6 +1374,12 @@ let
     "pkgconf"
   ];
 
+  commonRockyPackages = baseRHELFamilyPackages ++ [
+    "gcc-plugin-annobin"
+    "pkgconf"
+    "rocky-release"
+  ];
+
   # Common packages for openSUSE images.
   commonOpenSUSEPackages = [
     "aaa_base"
diff --git a/pkgs/build-support/vm/test.nix b/pkgs/build-support/vm/test.nix
index cebe45cc8a3d..e308a5a58771 100644
--- a/pkgs/build-support/vm/test.nix
+++ b/pkgs/build-support/vm/test.nix
@@ -50,5 +50,6 @@ in
   testFedora43Image = makeImageTestScript diskImages.fedora43x86_64;
   testCentOSStream9Image = makeImageTestScript diskImages.centosStream9x86_64;
   testCentOSStream10Image = makeImageTestScript diskImages.centosStream10x86_64;
+  testRocky9Image = makeImageTestScript diskImages.rocky9x86_64;
   testUbuntuImage = makeImageTestScript diskImages.ubuntu2404x86_64;
 }

From 0101fa5e711fd129d51d659525cfafd487ac87ef Mon Sep 17 00:00:00 2001
From: Philip Taron <philip.taron@gmail.com>
Date: Wed, 17 Dec 2025 18:38:15 -0800
Subject: [PATCH 16/29] vmTools: add Rocky Linux 10

---
 pkgs/build-support/vm/default.nix | 29 +++++++++++++++++++++++++++++
 pkgs/build-support/vm/test.nix    |  1 +
 2 files changed, 30 insertions(+)

diff --git a/pkgs/build-support/vm/default.nix b/pkgs/build-support/vm/default.nix
index fc8b44baf1a3..c493248c61ff 100644
--- a/pkgs/build-support/vm/default.nix
+++ b/pkgs/build-support/vm/default.nix
@@ -1133,6 +1133,35 @@ let
       ];
       unifiedSystemDir = true;
     };
+
+    # Rocky Linux's /pub/rocky/10/ URL is rolling and changes with each minor release. We use the
+    # vault instead, which provides stable URLs for specific minor versions.
+    rocky10x86_64 = {
+      name = "rocky-10.0-x86_64";
+      fullName = "Rocky Linux 10.0 (x86_64)";
+      packagesLists = [
+        (fetchurl {
+          url = "https://dl.rockylinux.org/vault/rocky/10.0/BaseOS/x86_64/os/repodata/484d5c43cdb1058dd1328a6b891f45c85f1cb2620c528f2ef423d4b9feb9e2f0-primary.xml.gz";
+          hash = "sha256-SE1cQ82xBY3RMopriR9FyF8csmIMUo8u9CPUuf654vA=";
+        })
+        (fetchurl {
+          url = "https://dl.rockylinux.org/vault/rocky/10.0/AppStream/x86_64/os/repodata/32c93064142d89f3f19c11e92642c5abd8368418f7ab3f3bdd752e4afa9b5b23-primary.xml.gz";
+          hash = "sha256-MskwZBQtifPxnBHpJkLFq9g2hBj3qz873XUuSvqbWyM=";
+        })
+      ];
+      urlPrefixes = [
+        "https://dl.rockylinux.org/vault/rocky/10.0/BaseOS/x86_64/os"
+        "https://dl.rockylinux.org/vault/rocky/10.0/AppStream/x86_64/os"
+      ];
+      archs = [
+        "noarch"
+        "x86_64"
+      ];
+      packages = commonRockyPackages ++ [
+        "annobin-plugin-gcc"
+      ];
+      unifiedSystemDir = true;
+    };
   };
 
   # The set of supported Dpkg-based distributions.
diff --git a/pkgs/build-support/vm/test.nix b/pkgs/build-support/vm/test.nix
index e308a5a58771..c0c7ae41cd7a 100644
--- a/pkgs/build-support/vm/test.nix
+++ b/pkgs/build-support/vm/test.nix
@@ -51,5 +51,6 @@ in
   testCentOSStream9Image = makeImageTestScript diskImages.centosStream9x86_64;
   testCentOSStream10Image = makeImageTestScript diskImages.centosStream10x86_64;
   testRocky9Image = makeImageTestScript diskImages.rocky9x86_64;
+  testRocky10Image = makeImageTestScript diskImages.rocky10x86_64;
   testUbuntuImage = makeImageTestScript diskImages.ubuntu2404x86_64;
 }

From e2127eb5d0c3d67afab05ba2a36b06c5b1b944ce Mon Sep 17 00:00:00 2001
From: Philip Taron <philip.taron@gmail.com>
Date: Wed, 17 Dec 2025 19:25:38 -0800
Subject: [PATCH 17/29] vmTools: add Alma Linux 9 and 10

---
 pkgs/build-support/vm/default.nix | 60 +++++++++++++++++++++++++++++++
 pkgs/build-support/vm/test.nix    |  2 ++
 2 files changed, 62 insertions(+)

diff --git a/pkgs/build-support/vm/default.nix b/pkgs/build-support/vm/default.nix
index c493248c61ff..31a5a9e65054 100644
--- a/pkgs/build-support/vm/default.nix
+++ b/pkgs/build-support/vm/default.nix
@@ -1162,6 +1162,60 @@ let
       ];
       unifiedSystemDir = true;
     };
+
+    alma9x86_64 = {
+      name = "alma-9-x86_64";
+      fullName = "AlmaLinux 9 (x86_64)";
+      packagesLists = [
+        (fetchurl {
+          url = "https://repo.almalinux.org/almalinux/9/BaseOS/x86_64/os/repodata/e7e7e537062ffd6778b5190b7b6785086efab6647401014d1985c10a0d3de609-primary.xml.gz";
+          hash = "sha256-5+flNwYv/Wd4tRkLe2eFCG76tmR0AQFNGYXBCg095gk=";
+        })
+        (fetchurl {
+          url = "https://repo.almalinux.org/almalinux/9/AppStream/x86_64/os/repodata/e61f480b84cb0a671452c21cbd52930a6fa111e7fb3407ed75cabff71c1a07b7-primary.xml.gz";
+          hash = "sha256-5h9IC4TLCmcUUsIcvVKTCm+hEef7NAftdcq/9xwaB7c=";
+        })
+      ];
+      urlPrefixes = [
+        "https://repo.almalinux.org/almalinux/9/BaseOS/x86_64/os"
+        "https://repo.almalinux.org/almalinux/9/AppStream/x86_64/os"
+      ];
+      archs = [
+        "noarch"
+        "x86_64"
+      ];
+      packages = commonAlmaPackages ++ [
+        "annobin"
+      ];
+      unifiedSystemDir = true;
+    };
+
+    alma10x86_64 = {
+      name = "alma-10-x86_64";
+      fullName = "AlmaLinux 10 (x86_64)";
+      packagesLists = [
+        (fetchurl {
+          url = "https://repo.almalinux.org/almalinux/10/BaseOS/x86_64/os/repodata/e0a4a18c4f302fa3188b757197b81d606199eccddd8480602c378def572fabbf-primary.xml.gz";
+          hash = "sha256-4KShjE8wL6MYi3Vxl7gdYGGZ7M3dhIBgLDeN71cvq78=";
+        })
+        (fetchurl {
+          url = "https://repo.almalinux.org/almalinux/10/AppStream/x86_64/os/repodata/fb3e7acc93f1b0969c3c00dc3bc4364d4f5837d11274cae650c34cf71c0f80ae-primary.xml.gz";
+          hash = "sha256-+z56zJPxsJacPADcO8Q2TU9YN9ESdMrmUMNM9xwPgK4=";
+        })
+      ];
+      urlPrefixes = [
+        "https://repo.almalinux.org/almalinux/10/BaseOS/x86_64/os"
+        "https://repo.almalinux.org/almalinux/10/AppStream/x86_64/os"
+      ];
+      archs = [
+        "noarch"
+        "x86_64"
+      ];
+      packages = commonAlmaPackages ++ [
+        "annobin-plugin-gcc"
+      ];
+      unifiedSystemDir = true;
+    };
   };
 
   # The set of supported Dpkg-based distributions.
@@ -1409,6 +1463,12 @@ let
     "rocky-release"
   ];
 
+  commonAlmaPackages = baseRHELFamilyPackages ++ [
+    "almalinux-release"
+    "gcc-plugin-annobin"
+    "pkgconf"
+  ];
+
   # Common packages for openSUSE images.
   commonOpenSUSEPackages = [
     "aaa_base"
diff --git a/pkgs/build-support/vm/test.nix b/pkgs/build-support/vm/test.nix
index c0c7ae41cd7a..1d712c0650d2 100644
--- a/pkgs/build-support/vm/test.nix
+++ b/pkgs/build-support/vm/test.nix
@@ -52,5 +52,7 @@ in
   testCentOSStream10Image = makeImageTestScript diskImages.centosStream10x86_64;
   testRocky9Image = makeImageTestScript diskImages.rocky9x86_64;
   testRocky10Image = makeImageTestScript diskImages.rocky10x86_64;
+  testAlma9Image = makeImageTestScript diskImages.alma9x86_64;
+  testAlma10Image = makeImageTestScript diskImages.alma10x86_64;
   testUbuntuImage = makeImageTestScript diskImages.ubuntu2404x86_64;
 }

From 98b0461681f2355d3e8b2e115d0db56130f915d7 Mon Sep 17 00:00:00 2001
From: Philip Taron <philip.taron@gmail.com>
Date: Wed, 17 Dec 2025 20:25:28 -0800
Subject: [PATCH 18/29] vmTools: add Oracle Linux 9

---
 pkgs/build-support/vm/default.nix | 34 +++++++++++++++++++++++++++++++
 pkgs/build-support/vm/test.nix    |  1 +
 2 files changed, 35 insertions(+)

diff --git a/pkgs/build-support/vm/default.nix b/pkgs/build-support/vm/default.nix
index 31a5a9e65054..660b03c0b790 100644
--- a/pkgs/build-support/vm/default.nix
+++ b/pkgs/build-support/vm/default.nix
@@ -1216,6 +1216,34 @@ let
       ];
       unifiedSystemDir = true;
     };
+
+    oracle9x86_64 = {
+      name = "oracle-9-x86_64";
+      fullName = "Oracle Linux 9 (x86_64)";
+      packagesLists = [
+        (fetchurl {
+          url = "https://yum.oracle.com/repo/OracleLinux/OL9/baseos/latest/x86_64/repodata/edda5aa6dc1ad233cd5fe29838e535ef959cd291be343844e127e29c290f93ca-primary.xml.gz";
+          hash = "sha256-7dpaptwa0jPNX+KYOOU175Wc0pG+NDhE4SfinCkPk8o=";
+        })
+        (fetchurl {
+          url = "https://yum.oracle.com/repo/OracleLinux/OL9/appstream/x86_64/repodata/4d559ceb3228c2f734d1bcbc79079141e4ce1f2abd90ce77f7f8e31d1deb77b2-primary.xml.gz";
+          hash = "sha256-TVWc6zIowvc00by8eQeRQeTOHyq9kM539/jjHR3rd7I=";
+        })
+      ];
+      urlPrefixes = [
+        "https://yum.oracle.com/repo/OracleLinux/OL9/baseos/latest/x86_64"
+        "https://yum.oracle.com/repo/OracleLinux/OL9/appstream/x86_64"
+      ];
+      archs = [
+        "noarch"
+        "x86_64"
+      ];
+      packages = commonOraclePackages ++ [
+        "annobin"
+      ];
+      unifiedSystemDir = true;
+    };
+
   };
 
   # The set of supported Dpkg-based distributions.
@@ -1469,6 +1497,12 @@ let
     "pkgconf"
   ];
 
+  commonOraclePackages = baseRHELFamilyPackages ++ [
+    "gcc-plugin-annobin"
+    "oraclelinux-release"
+    "pkgconf"
+  ];
+
   # Common packages for openSUSE images.
   commonOpenSUSEPackages = [
     "aaa_base"
diff --git a/pkgs/build-support/vm/test.nix b/pkgs/build-support/vm/test.nix
index 1d712c0650d2..0320d86bb5be 100644
--- a/pkgs/build-support/vm/test.nix
+++ b/pkgs/build-support/vm/test.nix
@@ -54,5 +54,6 @@ in
   testRocky10Image = makeImageTestScript diskImages.rocky10x86_64;
   testAlma9Image = makeImageTestScript diskImages.alma9x86_64;
   testAlma10Image = makeImageTestScript diskImages.alma10x86_64;
+  testOracle9Image = makeImageTestScript diskImages.oracle9x86_64;
   testUbuntuImage = makeImageTestScript diskImages.ubuntu2404x86_64;
 }

From 921c93ffbc73b126c9d159ded35010690f224ecd Mon Sep 17 00:00:00 2001
From: Philip Taron <philip.taron@gmail.com>
Date: Wed, 17 Dec 2025 20:46:57 -0800
Subject: [PATCH 19/29] vmTools: add in Amazon Linux 2023

---
 pkgs/build-support/vm/default.nix        | 25 ++++++++++++++++++++++++
 pkgs/build-support/vm/rpm/rpm-closure.pl |  8 +++++++-
 pkgs/build-support/vm/test.nix           |  1 +
 3 files changed, 33 insertions(+), 1 deletion(-)

diff --git a/pkgs/build-support/vm/default.nix b/pkgs/build-support/vm/default.nix
index 660b03c0b790..fdce25d41ae0 100644
--- a/pkgs/build-support/vm/default.nix
+++ b/pkgs/build-support/vm/default.nix
@@ -836,6 +836,7 @@ let
       {
         nativeBuildInputs = [
           buildPackages.perl
+          buildPackages.perlPackages.URI
           buildPackages.perlPackages.XMLSimple
           buildPackages.zstd
         ];
@@ -1244,6 +1245,24 @@ let
       unifiedSystemDir = true;
     };
 
+    amazon2023x86_64 = {
+      name = "amazon-2023-x86_64";
+      fullName = "Amazon Linux 2023 (x86_64)";
+      packagesList = fetchurl {
+        url = "https://cdn.amazonlinux.com/al2023/core/guids/6fa961924efb4835a7e8de43c89726dca28a5cf5906f891262d8f78a31ea3aaf/x86_64/repodata/primary.xml.gz";
+        hash = "sha256-Ezdsc8a2aOIbyXvQ/nyanWe1fl089VgtfegaPcu2oo4=";
+      };
+      urlPrefix = "https://cdn.amazonlinux.com/al2023/core/guids/6fa961924efb4835a7e8de43c89726dca28a5cf5906f891262d8f78a31ea3aaf/x86_64";
+      archs = [
+        "noarch"
+        "x86_64"
+      ];
+      packages = commonAmazonPackages ++ [
+        "annobin-plugin-gcc"
+      ];
+      unifiedSystemDir = true;
+    };
+
   };
 
   # The set of supported Dpkg-based distributions.
@@ -1503,6 +1522,12 @@ let
     "pkgconf"
   ];
 
+  commonAmazonPackages = baseRHELFamilyPackages ++ [
+    "gcc-plugin-annobin"
+    "pkgconf"
+    "system-release"
+  ];
+
   # Common packages for openSUSE images.
   commonOpenSUSEPackages = [
     "aaa_base"
diff --git a/pkgs/build-support/vm/rpm/rpm-closure.pl b/pkgs/build-support/vm/rpm/rpm-closure.pl
index 51ebfc9ade64..a11adc27ac10 100644
--- a/pkgs/build-support/vm/rpm/rpm-closure.pl
+++ b/pkgs/build-support/vm/rpm/rpm-closure.pl
@@ -1,6 +1,7 @@
 use strict;
 use XML::Simple;
 use List::Util qw(min);
+use URI::Escape;
 
 my @packagesFiles = ();
 my @urlPrefixes = ();
@@ -174,8 +175,13 @@ print "[\n\n";
 
 foreach my $pkgName (@needed) {
     my $pkg = $pkgs{$pkgName};
+    # URL-encode each path segment separately to handle special characters like '+'
+    my $href = $pkg->{location}->{href};
+    my @segments = split('/', $href);
+    my @encoded_segments = map { uri_escape($_) } @segments;
+    my $encoded_href = join('/', @encoded_segments);
     print "  (fetchurl {\n";
-    print "    url = $pkg->{urlPrefix}/$pkg->{location}->{href};\n";
+    print "    url = \"$pkg->{urlPrefix}/$encoded_href\";\n";
     if ($pkg->{checksum}->{type} eq "sha") {
         print "    sha1 = \"$pkg->{checksum}->{content}\";\n";
     } elsif ($pkg->{checksum}->{type} eq "sha256") {
diff --git a/pkgs/build-support/vm/test.nix b/pkgs/build-support/vm/test.nix
index 0320d86bb5be..667f0c84103e 100644
--- a/pkgs/build-support/vm/test.nix
+++ b/pkgs/build-support/vm/test.nix
@@ -55,5 +55,6 @@ in
   testAlma9Image = makeImageTestScript diskImages.alma9x86_64;
   testAlma10Image = makeImageTestScript diskImages.alma10x86_64;
   testOracle9Image = makeImageTestScript diskImages.oracle9x86_64;
+  testAmazon2023Image = makeImageTestScript diskImages.amazon2023x86_64;
   testUbuntuImage = makeImageTestScript diskImages.ubuntu2404x86_64;
 }

From 2fec9598a863afdd6b56049d69235620fac2796d Mon Sep 17 00:00:00 2001
From: Philip Taron <philip.taron@gmail.com>
Date: Wed, 17 Dec 2025 21:33:21 -0800
Subject: [PATCH 20/29] vmTools: shore up the tests with each image

---
 pkgs/build-support/vm/test.nix | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/pkgs/build-support/vm/test.nix b/pkgs/build-support/vm/test.nix
index 667f0c84103e..7472e0f73226 100644
--- a/pkgs/build-support/vm/test.nix
+++ b/pkgs/build-support/vm/test.nix
@@ -46,6 +46,7 @@ in
     })
   );
 
+  # RPM-based distros
   testFedora42Image = makeImageTestScript diskImages.fedora42x86_64;
   testFedora43Image = makeImageTestScript diskImages.fedora43x86_64;
   testCentOSStream9Image = makeImageTestScript diskImages.centosStream9x86_64;
@@ -56,5 +57,15 @@ in
   testAlma10Image = makeImageTestScript diskImages.alma10x86_64;
   testOracle9Image = makeImageTestScript diskImages.oracle9x86_64;
   testAmazon2023Image = makeImageTestScript diskImages.amazon2023x86_64;
-  testUbuntuImage = makeImageTestScript diskImages.ubuntu2404x86_64;
+
+  # Debian-based distros
+  testDebian11i386Image = makeImageTestScript diskImages.debian11i386;
+  testDebian11x86_64Image = makeImageTestScript diskImages.debian11x86_64;
+  testDebian12i386Image = makeImageTestScript diskImages.debian12i386;
+  testDebian12x86_64Image = makeImageTestScript diskImages.debian12x86_64;
+  testDebian13i386Image = makeImageTestScript diskImages.debian13i386;
+  testDebian13x86_64Image = makeImageTestScript diskImages.debian13x86_64;
+  testUbuntu2204i386Image = makeImageTestScript diskImages.ubuntu2204i386;
+  testUbuntu2204x86_64Image = makeImageTestScript diskImages.ubuntu2204x86_64;
+  testUbuntu2404x86_64Image = makeImageTestScript diskImages.ubuntu2404x86_64;
 }

From 0f6e482a7faeccea25bdf5b8b858ba92c9ded145 Mon Sep 17 00:00:00 2001
From: Philip Taron <philip.taron@gmail.com>
Date: Thu, 18 Dec 2025 11:55:11 -0800
Subject: [PATCH 21/29] doc: update vmTools documentation based on the newly
 added disk images

---
 doc/build-helpers/special/vm-tools.section.md | 46 +++++++++----------
 1 file changed, 23 insertions(+), 23 deletions(-)

diff --git a/doc/build-helpers/special/vm-tools.section.md b/doc/build-helpers/special/vm-tools.section.md
index 142093274987..4e4de3e85b54 100644
--- a/doc/build-helpers/special/vm-tools.section.md
+++ b/doc/build-helpers/special/vm-tools.section.md
@@ -92,14 +92,14 @@ Generate a script that can be used to run an interactive session in the given im
 
 ### Examples {#vm-tools-makeImageTestScript-examples}
 
-Create a script for running a Fedora 27 VM:
+Create a script for running a Fedora 43 VM:
 ```nix
-{ pkgs }: with pkgs; with vmTools; makeImageTestScript diskImages.fedora27x86_64
+{ pkgs }: pkgs.vmTools.makeImageTestScript pkgs.vmTools.diskImages.fedora43x86_64
 ```
 
-Create a script for running an Ubuntu 20.04 VM:
+Create a script for running an Ubuntu 24.04 VM:
 ```nix
-{ pkgs }: with pkgs; with vmTools; makeImageTestScript diskImages.ubuntu2004x86_64
+{ pkgs }: pkgs.vmTools.makeImageTestScript pkgs.vmTools.diskImages.ubuntu2404x86_64
 ```
 
 ## `vmTools.diskImageFuns` {#vm-tools-diskImageFuns}
@@ -109,30 +109,32 @@ A set of functions that build a predefined set of minimal Linux distributions im
 ### Images {#vm-tools-diskImageFuns-images}
 
 * Fedora
-  * `fedora26x86_64`
-  * `fedora27x86_64`
-* CentOS
-  * `centos6i386`
-  * `centos6x86_64`
-  * `centos7x86_64`
+  * `fedora42x86_64`
+  * `fedora43x86_64`
+* CentOS Stream
+  * `centosStream9x86_64`
+  * `centosStream10x86_64`
+* Rocky Linux
+  * `rocky9x86_64`
+  * `rocky10x86_64`
+* AlmaLinux
+  * `alma9x86_64`
+  * `alma10x86_64`
+* Oracle Linux
+  * `oracle9x86_64`
+* Amazon Linux
+  * `amazon2023x86_64`
 * Ubuntu
-  * `ubuntu1404i386`
-  * `ubuntu1404x86_64`
-  * `ubuntu1604i386`
-  * `ubuntu1604x86_64`
-  * `ubuntu1804i386`
-  * `ubuntu1804x86_64`
-  * `ubuntu2004i386`
-  * `ubuntu2004x86_64`
   * `ubuntu2204i386`
   * `ubuntu2204x86_64`
+  * `ubuntu2404x86_64`
 * Debian
-  * `debian10i386`
-  * `debian10x86_64`
   * `debian11i386`
   * `debian11x86_64`
   * `debian12i386`
   * `debian12x86_64`
+  * `debian13i386`
+  * `debian13x86_64`
 
 ### Attributes {#vm-tools-diskImageFuns-attributes}
 
@@ -144,9 +146,7 @@ A set of functions that build a predefined set of minimal Linux distributions im
 8GiB image containing Firefox in addition to the default packages:
 ```nix
 { pkgs }:
-with pkgs;
-with vmTools;
-diskImageFuns.ubuntu2004x86_64 {
+pkgs.vmTools.diskImageFuns.ubuntu2404x86_64 {
   extraPackages = [ "firefox" ];
   size = 8192;
 }

From 60e98283d2e33d2f24e2a238d7f677b306020979 Mon Sep 17 00:00:00 2001
From: Philip Taron <philip.taron@gmail.com>
Date: Fri, 19 Dec 2025 16:46:07 -0800
Subject: [PATCH 22/29] vmTools: use AlmaLinux vault URLs for stable package
 lists

The repo.almalinux.org URLs are rolling and change with each minor
release, causing hash mismatches. Switch to vault.almalinux.org which
provides stable URLs for specific versions.

- alma9x86_64: use vault 9.6
- alma10x86_64: use vault 10.0
---
 pkgs/build-support/vm/default.nix | 34 ++++++++++++++++---------------
 1 file changed, 18 insertions(+), 16 deletions(-)

diff --git a/pkgs/build-support/vm/default.nix b/pkgs/build-support/vm/default.nix
index fdce25d41ae0..4f9b1b8217cd 100644
--- a/pkgs/build-support/vm/default.nix
+++ b/pkgs/build-support/vm/default.nix
@@ -1164,22 +1164,24 @@ let
       unifiedSystemDir = true;
     };
 
+    # AlmaLinux's repo.almalinux.org URLs are rolling and change with each minor release.
+    # We use vault.almalinux.org instead, which provides stable URLs for specific versions.
     alma9x86_64 = {
-      name = "alma-9-x86_64";
-      fullName = "AlmaLinux 9 (x86_64)";
+      name = "alma-9.6-x86_64";
+      fullName = "AlmaLinux 9.6 (x86_64)";
       packagesLists = [
         (fetchurl {
-          url = "https://repo.almalinux.org/almalinux/9/BaseOS/x86_64/os/repodata/e7e7e537062ffd6778b5190b7b6785086efab6647401014d1985c10a0d3de609-primary.xml.gz";
-          hash = "sha256-5+flNwYv/Wd4tRkLe2eFCG76tmR0AQFNGYXBCg095gk=";
+          url = "https://vault.almalinux.org/9.6/BaseOS/x86_64/os/repodata/26d6cf944c86ef850773e61919e892a375ff10bb2254003e1d71673db9900b07-primary.xml.gz";
+          hash = "sha256-JtbPlEyG74UHc+YZGeiSo3X/ELsiVAA+HXFnPbmQCwc=";
         })
         (fetchurl {
-          url = "https://repo.almalinux.org/almalinux/9/AppStream/x86_64/os/repodata/e61f480b84cb0a671452c21cbd52930a6fa111e7fb3407ed75cabff71c1a07b7-primary.xml.gz";
-          hash = "sha256-5h9IC4TLCmcUUsIcvVKTCm+hEef7NAftdcq/9xwaB7c=";
+          url = "https://vault.almalinux.org/9.6/AppStream/x86_64/os/repodata/afb5d18b78d819d826d3d0e32ba439da7b9e0fd91d726dd833366496b1b8ca20-primary.xml.gz";
+          hash = "sha256-r7XRi3jYGdgm09DjK6Q52nueD9kdcm3YMzZklrG4yiA=";
         })
       ];
       urlPrefixes = [
-        "https://repo.almalinux.org/almalinux/9/BaseOS/x86_64/os"
-        "https://repo.almalinux.org/almalinux/9/AppStream/x86_64/os"
+        "https://vault.almalinux.org/9.6/BaseOS/x86_64/os"
+        "https://vault.almalinux.org/9.6/AppStream/x86_64/os"
       ];
       archs = [
         "noarch"
@@ -1192,21 +1194,21 @@ let
     };
 
     alma10x86_64 = {
-      name = "alma-10-x86_64";
-      fullName = "AlmaLinux 10 (x86_64)";
+      name = "alma-10.0-x86_64";
+      fullName = "AlmaLinux 10.0 (x86_64)";
       packagesLists = [
         (fetchurl {
-          url = "https://repo.almalinux.org/almalinux/10/BaseOS/x86_64/os/repodata/e0a4a18c4f302fa3188b757197b81d606199eccddd8480602c378def572fabbf-primary.xml.gz";
-          hash = "sha256-4KShjE8wL6MYi3Vxl7gdYGGZ7M3dhIBgLDeN71cvq78=";
+          url = "https://vault.almalinux.org/10.0/BaseOS/x86_64/os/repodata/4d88695fa7ccb6298897fa9682ac1ded4628df342ffe08312846225e4469e3e4-primary.xml.gz";
+          hash = "sha256-TYhpX6fMtimIl/qWgqwd7UYo3zQv/ggxKEYiXkRp4+Q=";
         })
         (fetchurl {
-          url = "https://repo.almalinux.org/almalinux/10/AppStream/x86_64/os/repodata/fb3e7acc93f1b0969c3c00dc3bc4364d4f5837d11274cae650c34cf71c0f80ae-primary.xml.gz";
-          hash = "sha256-+z56zJPxsJacPADcO8Q2TU9YN9ESdMrmUMNM9xwPgK4=";
+          url = "https://vault.almalinux.org/10.0/AppStream/x86_64/os/repodata/11ac32065bae6f2c2451803458690fc550e79f93a4ea9f438930f0c228964791-primary.xml.gz";
+          hash = "sha256-EawyBluubywkUYA0WGkPxVDnn5Ok6p9DiTDwwiiWR5E=";
         })
       ];
       urlPrefixes = [
-        "https://repo.almalinux.org/almalinux/10/BaseOS/x86_64/os"
-        "https://repo.almalinux.org/almalinux/10/AppStream/x86_64/os"
+        "https://vault.almalinux.org/10.0/BaseOS/x86_64/os"
+        "https://vault.almalinux.org/10.0/AppStream/x86_64/os"
       ];
       archs = [
         "noarch"

From b80421ae9066621943d35dc6cfef456912971f5c Mon Sep 17 00:00:00 2001
From: Philip Taron <philip.taron@gmail.com>
Date: Fri, 19 Dec 2025 17:14:08 -0800
Subject: [PATCH 23/29] vmTools: update Oracle Linux 9 package list hashes

Oracle provides versioned URLs for baseos but not appstream. Since we
can't mix versioned baseos with rolling appstream due to package version
dependencies (glibc mismatch), we keep using rolling URLs for both.

Add comment explaining this limitation.
---
 pkgs/build-support/vm/default.nix | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/pkgs/build-support/vm/default.nix b/pkgs/build-support/vm/default.nix
index 4f9b1b8217cd..8b185d5c8614 100644
--- a/pkgs/build-support/vm/default.nix
+++ b/pkgs/build-support/vm/default.nix
@@ -1220,17 +1220,20 @@ let
       unifiedSystemDir = true;
     };
 
+    # Oracle provides versioned URLs for baseos (e.g., OL9/7/baseos/base/) but not for appstream.
+    # We can't mix versioned baseos with rolling appstream due to package version dependencies,
+    # so we use rolling URLs for both. These may need hash updates when Oracle releases new versions.
     oracle9x86_64 = {
       name = "oracle-9-x86_64";
       fullName = "Oracle Linux 9 (x86_64)";
       packagesLists = [
         (fetchurl {
-          url = "https://yum.oracle.com/repo/OracleLinux/OL9/baseos/latest/x86_64/repodata/edda5aa6dc1ad233cd5fe29838e535ef959cd291be343844e127e29c290f93ca-primary.xml.gz";
-          hash = "sha256-7dpaptwa0jPNX+KYOOU175Wc0pG+NDhE4SfinCkPk8o=";
+          url = "https://yum.oracle.com/repo/OracleLinux/OL9/baseos/latest/x86_64/repodata/22683534c792aff59db7dc398a72291012dce25a2873843c004be83f85587822-primary.xml.gz";
+          hash = "sha256-Img1NMeSr/Wdt9w5inIpEBLc4looc4Q8AEvoP4VYeCI=";
         })
         (fetchurl {
-          url = "https://yum.oracle.com/repo/OracleLinux/OL9/appstream/x86_64/repodata/4d559ceb3228c2f734d1bcbc79079141e4ce1f2abd90ce77f7f8e31d1deb77b2-primary.xml.gz";
-          hash = "sha256-TVWc6zIowvc00by8eQeRQeTOHyq9kM539/jjHR3rd7I=";
+          url = "https://yum.oracle.com/repo/OracleLinux/OL9/appstream/x86_64/repodata/2a1fe56f0dabfcb0fcd6bcddbb5ca6052ac1a6ac124498d95578416c06162e0d-primary.xml.gz";
+          hash = "sha256-Kh/lbw2r/LD81rzdu1ymBSrBpqwSRJjZVXhBbAYWLg0=";
         })
       ];
       urlPrefixes = [

From 97e4caee70857e572329c2cd3986fe34308158bd Mon Sep 17 00:00:00 2001
From: Philip Taron <philip.taron@gmail.com>
Date: Fri, 19 Dec 2025 17:17:47 -0800
Subject: [PATCH 24/29] vmTools: add documentation for updating Amazon Linux
 2023 GUID

Amazon Linux 2023 uses GUID-based URLs that don't allow directory
listing, making updates non-trivial. Add a comment explaining how to
find the current GUID by either running an AL2023 container or checking
the docker-library/repo-info repository.
---
 pkgs/build-support/vm/default.nix | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/pkgs/build-support/vm/default.nix b/pkgs/build-support/vm/default.nix
index 8b185d5c8614..805ac8afb950 100644
--- a/pkgs/build-support/vm/default.nix
+++ b/pkgs/build-support/vm/default.nix
@@ -1250,6 +1250,14 @@ let
       unifiedSystemDir = true;
     };
 
+    # Amazon Linux 2023 uses GUID-based URLs that don't allow directory listing.
+    # To update: The GUID corresponds to a specific AL2023 release version. You can find the
+    # current GUID by either:
+    #   1. Running an AL2023 container: `docker run -it amazonlinux:2023 dnf repolist -v`
+    #      and extracting the GUID from the Repo-baseurl field
+    #   2. Checking https://github.com/docker-library/repo-info/blob/master/repos/amazonlinux/local/latest.md
+    #      which tracks the repository URLs from the official Docker image
+    # Release notes: https://docs.aws.amazon.com/linux/al2023/release-notes/relnotes.html
     amazon2023x86_64 = {
       name = "amazon-2023-x86_64";
       fullName = "Amazon Linux 2023 (x86_64)";

From 52fbdf3dee5cefc25c3858c5b9f74ca43a9d14b0 Mon Sep 17 00:00:00 2001
From: Philip Taron <philip.taron@gmail.com>
Date: Mon, 5 Jan 2026 10:32:30 -0800
Subject: [PATCH 25/29] vmTools: drop CentOS Stream

As @uninsane points out, these are designed to rot rapidly.
---
 doc/build-helpers/special/vm-tools.section.md |  3 -
 pkgs/build-support/vm/default.nix             | 62 +------------------
 pkgs/build-support/vm/test.nix                |  2 -
 3 files changed, 1 insertion(+), 66 deletions(-)

diff --git a/doc/build-helpers/special/vm-tools.section.md b/doc/build-helpers/special/vm-tools.section.md
index 4e4de3e85b54..47988eb3f4a1 100644
--- a/doc/build-helpers/special/vm-tools.section.md
+++ b/doc/build-helpers/special/vm-tools.section.md
@@ -111,9 +111,6 @@ A set of functions that build a predefined set of minimal Linux distributions im
 * Fedora
   * `fedora42x86_64`
   * `fedora43x86_64`
-* CentOS Stream
-  * `centosStream9x86_64`
-  * `centosStream10x86_64`
 * Rocky Linux
   * `rocky9x86_64`
   * `rocky10x86_64`
diff --git a/pkgs/build-support/vm/default.nix b/pkgs/build-support/vm/default.nix
index 805ac8afb950..ca5719ba6c31 100644
--- a/pkgs/build-support/vm/default.nix
+++ b/pkgs/build-support/vm/default.nix
@@ -1052,60 +1052,6 @@ let
       unifiedSystemDir = true;
     };
 
-    centosStream9x86_64 = {
-      name = "centos-stream-9-x86_64";
-      fullName = "CentOS Stream 9 (x86_64)";
-      packagesLists = [
-        (fetchurl {
-          url = "https://mirror.stream.centos.org/9-stream/BaseOS/x86_64/os/repodata/737e7bb91d5464e0cc258ff5ae5070a00d682c39fc2de0b9b55df671022ba732-primary.xml.gz";
-          hash = "sha256-c357uR1UZODMJY/1rlBwoA1oLDn8LeC5tV32cQIrpzI=";
-        })
-        (fetchurl {
-          url = "https://mirror.stream.centos.org/9-stream/AppStream/x86_64/os/repodata/9f0c1578e5df33e6479a1d3e5397b87ecaa1b5bac7fd34de6c837bddb3949fde-primary.xml.gz";
-          hash = "sha256-nwwVeOXfM+ZHmh0+U5e4fsqhtbrH/TTebIN73bOUn94=";
-        })
-      ];
-      urlPrefixes = [
-        "https://mirror.stream.centos.org/9-stream/BaseOS/x86_64/os"
-        "https://mirror.stream.centos.org/9-stream/AppStream/x86_64/os"
-      ];
-      archs = [
-        "noarch"
-        "x86_64"
-      ];
-      packages = commonCentOSStreamPackages ++ [
-        "annobin"
-      ];
-      unifiedSystemDir = true;
-    };
-
-    centosStream10x86_64 = {
-      name = "centos-stream-10-x86_64";
-      fullName = "CentOS Stream 10 (x86_64)";
-      packagesLists = [
-        (fetchurl {
-          url = "https://mirror.stream.centos.org/10-stream/BaseOS/x86_64/os/repodata/b3bb8f59e9c3dfedf3439c8357dc6fb727dc3e6fd2e351ab5e1fb0cfbbf07381-primary.xml.gz";
-          hash = "sha256-s7uPWenD3+3zQ5yDV9xvtyfcPm/S41GrXh+wz7vwc4E=";
-        })
-        (fetchurl {
-          url = "https://mirror.stream.centos.org/10-stream/AppStream/x86_64/os/repodata/962343afafa14dcc36a6c054608ae9bbf700c8ead08d1ca8898b5b1a192e3106-primary.xml.gz";
-          hash = "sha256-liNDr6+hTcw2psBUYIrpu/cAyOrQjRyoiYtbGhkuMQY=";
-        })
-      ];
-      urlPrefixes = [
-        "https://mirror.stream.centos.org/10-stream/BaseOS/x86_64/os"
-        "https://mirror.stream.centos.org/10-stream/AppStream/x86_64/os"
-      ];
-      archs = [
-        "noarch"
-        "x86_64"
-      ];
-      packages = commonCentOSStreamPackages ++ [
-        "annobin-plugin-gcc"
-      ];
-      unifiedSystemDir = true;
-    };
-
     # Rocky Linux's /pub/rocky/9/ URL is rolling and changes with each minor release. We use the
     # vault instead, which provides stable URLs for specific minor versions.
     rocky9x86_64 = {
@@ -1482,7 +1428,7 @@ let
     };
   };
 
-  # Base packages for all RHEL-family distros (Fedora, CentOS Stream, Rocky, Alma, etc.)
+  # Base packages for all RHEL-family distros (Fedora, Rocky, Alma, etc.)
   baseRHELFamilyPackages = [
     "autoconf"
     "automake"
@@ -1511,12 +1457,6 @@ let
     "pkgconf-pkg-config"
   ];
 
-  commonCentOSStreamPackages = baseRHELFamilyPackages ++ [
-    "centos-stream-release"
-    "gcc-plugin-annobin"
-    "pkgconf"
-  ];
-
   commonRockyPackages = baseRHELFamilyPackages ++ [
     "gcc-plugin-annobin"
     "pkgconf"
diff --git a/pkgs/build-support/vm/test.nix b/pkgs/build-support/vm/test.nix
index 7472e0f73226..3a7adcbd216e 100644
--- a/pkgs/build-support/vm/test.nix
+++ b/pkgs/build-support/vm/test.nix
@@ -49,8 +49,6 @@ in
   # RPM-based distros
   testFedora42Image = makeImageTestScript diskImages.fedora42x86_64;
   testFedora43Image = makeImageTestScript diskImages.fedora43x86_64;
-  testCentOSStream9Image = makeImageTestScript diskImages.centosStream9x86_64;
-  testCentOSStream10Image = makeImageTestScript diskImages.centosStream10x86_64;
   testRocky9Image = makeImageTestScript diskImages.rocky9x86_64;
   testRocky10Image = makeImageTestScript diskImages.rocky10x86_64;
   testAlma9Image = makeImageTestScript diskImages.alma9x86_64;

From f75aefb26efb211da2f192d7de8a474cc875054f Mon Sep 17 00:00:00 2001
From: Philip Taron <philip.taron@gmail.com>
Date: Mon, 5 Jan 2026 10:49:35 -0800
Subject: [PATCH 26/29] vmTools: update Rocky Linux 9.5 to 9.6

---
 pkgs/build-support/vm/default.nix | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/pkgs/build-support/vm/default.nix b/pkgs/build-support/vm/default.nix
index ca5719ba6c31..bd30b2fa7bec 100644
--- a/pkgs/build-support/vm/default.nix
+++ b/pkgs/build-support/vm/default.nix
@@ -1055,21 +1055,21 @@ let
     # Rocky Linux's /pub/rocky/9/ URL is rolling and changes with each minor release. We use the
     # vault instead, which provides stable URLs for specific minor versions.
     rocky9x86_64 = {
-      name = "rocky-9.5-x86_64";
-      fullName = "Rocky Linux 9.5 (x86_64)";
+      name = "rocky-9.6-x86_64";
+      fullName = "Rocky Linux 9.6 (x86_64)";
       packagesLists = [
         (fetchurl {
-          url = "https://dl.rockylinux.org/vault/rocky/9.5/BaseOS/x86_64/os/repodata/554cd09406b7bf632fc7014d0a567094272d37ac08f75af955de96183425dfa8-primary.xml.gz";
-          hash = "sha256-VUzQlAa3v2MvxwFNClZwlCctN6wI91r5Vd6WGDQl36g=";
+          url = "https://dl.rockylinux.org/vault/rocky/9.6/BaseOS/x86_64/os/repodata/9965e429a90787a87a07eed62872d046411fb7dded524b96d74c4ce1eade327a-primary.xml.gz";
+          hash = "sha256-mWXkKakHh6h6B+7WKHLQRkEft93tUkuW10xM4ereMno=";
         })
         (fetchurl {
-          url = "https://dl.rockylinux.org/vault/rocky/9.5/AppStream/x86_64/os/repodata/db8f32057dd37687574ea660d322ff7a0b5dc01bfba42888818b48ef686837cd-primary.xml.gz";
-          hash = "sha256-248yBX3TdodXTqZg0yL/egtdwBv7pCiIgYtI72hoN80=";
+          url = "https://dl.rockylinux.org/vault/rocky/9.6/AppStream/x86_64/os/repodata/8cc9f795679c3365c06b6135f685ebf4188a5863a5f52f09f8cabd4f09c4dfa1-primary.xml.gz";
+          hash = "sha256-jMn3lWecM2XAa2E19oXr9BiKWGOl9S8J+Mq9TwnE36E=";
         })
       ];
       urlPrefixes = [
-        "https://dl.rockylinux.org/vault/rocky/9.5/BaseOS/x86_64/os"
-        "https://dl.rockylinux.org/vault/rocky/9.5/AppStream/x86_64/os"
+        "https://dl.rockylinux.org/vault/rocky/9.6/BaseOS/x86_64/os"
+        "https://dl.rockylinux.org/vault/rocky/9.6/AppStream/x86_64/os"
       ];
       archs = [
         "noarch"

From 57dc89a966ddb86d065a7d358771b17f16dbac8f Mon Sep 17 00:00:00 2001
From: Philip Taron <philip.taron@gmail.com>
Date: Mon, 5 Jan 2026 10:50:27 -0800
Subject: [PATCH 27/29] vmTools: update Oracle Linux 9 package list hashes

---
 pkgs/build-support/vm/default.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/build-support/vm/default.nix b/pkgs/build-support/vm/default.nix
index bd30b2fa7bec..dc4197754507 100644
--- a/pkgs/build-support/vm/default.nix
+++ b/pkgs/build-support/vm/default.nix
@@ -1174,12 +1174,12 @@ let
       fullName = "Oracle Linux 9 (x86_64)";
       packagesLists = [
         (fetchurl {
-          url = "https://yum.oracle.com/repo/OracleLinux/OL9/baseos/latest/x86_64/repodata/22683534c792aff59db7dc398a72291012dce25a2873843c004be83f85587822-primary.xml.gz";
-          hash = "sha256-Img1NMeSr/Wdt9w5inIpEBLc4looc4Q8AEvoP4VYeCI=";
+          url = "https://yum.oracle.com/repo/OracleLinux/OL9/baseos/latest/x86_64/repodata/bc292d67f73fc606db1872d5ba8804da06a514efe64523247035f0d3b678fb63-primary.xml.gz";
+          hash = "sha256-vCktZ/c/xgbbGHLVuogE2galFO/mRSMkcDXw07Z4+2M=";
         })
         (fetchurl {
-          url = "https://yum.oracle.com/repo/OracleLinux/OL9/appstream/x86_64/repodata/2a1fe56f0dabfcb0fcd6bcddbb5ca6052ac1a6ac124498d95578416c06162e0d-primary.xml.gz";
-          hash = "sha256-Kh/lbw2r/LD81rzdu1ymBSrBpqwSRJjZVXhBbAYWLg0=";
+          url = "https://yum.oracle.com/repo/OracleLinux/OL9/appstream/x86_64/repodata/6fabacadf7cdf22cbb21dc296f58e6b852d5b8ec9a927e214231477ef90083f9-primary.xml.gz";
+          hash = "sha256-b6usrffN8iy7Idwpb1jmuFLVuOyakn4hQjFHfvkAg/k=";
         })
       ];
       urlPrefixes = [

From a1e10daba4d107b4eacc683967b8e94b274995e0 Mon Sep 17 00:00:00 2001
From: Philip Taron <philip.taron@gmail.com>
Date: Mon, 5 Jan 2026 11:07:45 -0800
Subject: [PATCH 28/29] vmTools: update Debian snapshot timestamps to
 20260105T082626Z

---
 pkgs/build-support/vm/default.nix | 40 +++++++++++++++----------------
 1 file changed, 20 insertions(+), 20 deletions(-)

diff --git a/pkgs/build-support/vm/default.nix b/pkgs/build-support/vm/default.nix
index dc4197754507..fcaaac568d60 100644
--- a/pkgs/build-support/vm/default.nix
+++ b/pkgs/build-support/vm/default.nix
@@ -1341,10 +1341,10 @@ let
       name = "debian-11.11-bullseye-i386";
       fullName = "Debian 11.11 Bullseye (i386)";
       packagesList = fetchurl {
-        url = "https://snapshot.debian.org/archive/debian/20251217T203845Z/dists/bullseye/main/binary-i386/Packages.xz";
+        url = "https://snapshot.debian.org/archive/debian/20260105T082626Z/dists/bullseye/main/binary-i386/Packages.xz";
         hash = "sha256-kUg1VBUO6co/5bKloxncta49191oCeF05Hm399+UuDA=";
       };
-      urlPrefix = "https://snapshot.debian.org/archive/debian/20251217T203845Z";
+      urlPrefix = "https://snapshot.debian.org/archive/debian/20260105T082626Z";
       packages = commonDebianPackages;
     };
 
@@ -1352,10 +1352,10 @@ let
       name = "debian-11.11-bullseye-amd64";
       fullName = "Debian 11.11 Bullseye (amd64)";
       packagesList = fetchurl {
-        url = "https://snapshot.debian.org/archive/debian/20251217T203845Z/dists/bullseye/main/binary-amd64/Packages.xz";
+        url = "https://snapshot.debian.org/archive/debian/20260105T082626Z/dists/bullseye/main/binary-amd64/Packages.xz";
         hash = "sha256-HDQFREKX6thkcRwY5kvOSBDbY7SDQKL52BGC2fI1rXE=";
       };
-      urlPrefix = "https://snapshot.debian.org/archive/debian/20251217T203845Z";
+      urlPrefix = "https://snapshot.debian.org/archive/debian/20260105T082626Z";
       packages = commonDebianPackages;
     };
 
@@ -1364,15 +1364,15 @@ let
       fullName = "Debian 12.12 Bookworm (i386)";
       packagesLists = [
         (fetchurl {
-          url = "https://snapshot.debian.org/archive/debian/20251217T203845Z/dists/bookworm/main/binary-i386/Packages.xz";
+          url = "https://snapshot.debian.org/archive/debian/20260105T082626Z/dists/bookworm/main/binary-i386/Packages.xz";
           hash = "sha256-nIijsNoHUYkrL6eiwN4FCLHnJy/Bv/RMvnbMIHvieVI=";
         })
         (fetchurl {
-          url = "https://snapshot.debian.org/archive/debian/20251217T203845Z/dists/bookworm-backports/main/binary-i386/Packages.xz";
-          hash = "sha256-9WXnIg1CgzTGaUXnCTs/n/EhJ11aNcKn7rV9FDAi+U8=";
+          url = "https://snapshot.debian.org/archive/debian/20260105T082626Z/dists/bookworm-backports/main/binary-i386/Packages.xz";
+          hash = "sha256-/ja7+DNIKc2ZUIXiocTjLbaD2EPsfeyZcd5ndEMapp4=";
         })
       ];
-      urlPrefix = "https://snapshot.debian.org/archive/debian/20251217T203845Z";
+      urlPrefix = "https://snapshot.debian.org/archive/debian/20260105T082626Z";
       packages = commonDebianPackages;
     };
 
@@ -1381,15 +1381,15 @@ let
       fullName = "Debian 12.12 Bookworm (amd64)";
       packagesLists = [
         (fetchurl {
-          url = "https://snapshot.debian.org/archive/debian/20251217T203845Z/dists/bookworm/main/binary-amd64/Packages.xz";
+          url = "https://snapshot.debian.org/archive/debian/20260105T082626Z/dists/bookworm/main/binary-amd64/Packages.xz";
           hash = "sha256-PfjQeu3tXmXZhH7foSD6WyFrvY4PfwSN/v5pBeShIBE=";
         })
         (fetchurl {
-          url = "https://snapshot.debian.org/archive/debian/20251217T203845Z/dists/bookworm-backports/main/binary-amd64/Packages.xz";
-          hash = "sha256-i897N1JzuixjtZcFW90X/UJLXfxQOIQoJV9SC/VHpUE=";
+          url = "https://snapshot.debian.org/archive/debian/20260105T082626Z/dists/bookworm-backports/main/binary-amd64/Packages.xz";
+          hash = "sha256-S3NSvw1kX2zxzMh+WYhY58VUR7iLrTEIuXwwSK6itIs=";
         })
       ];
-      urlPrefix = "https://snapshot.debian.org/archive/debian/20251217T203845Z";
+      urlPrefix = "https://snapshot.debian.org/archive/debian/20260105T082626Z";
       packages = commonDebianPackages;
     };
 
@@ -1398,15 +1398,15 @@ let
       fullName = "Debian 13.2 Trixie (i386)";
       packagesLists = [
         (fetchurl {
-          url = "https://snapshot.debian.org/archive/debian/20251217T203845Z/dists/trixie/main/binary-i386/Packages.xz";
+          url = "https://snapshot.debian.org/archive/debian/20260105T082626Z/dists/trixie/main/binary-i386/Packages.xz";
           hash = "sha256-9zozvFZoWiv3wNe9rb+kPwSOgc5G5f4zmNpdoet5A78=";
         })
         (fetchurl {
-          url = "https://snapshot.debian.org/archive/debian/20251217T203845Z/dists/trixie-backports/main/binary-i386/Packages.xz";
-          hash = "sha256-JdBVmdbD5LQhHbqIHnPeJiGnhrZbJoiYPWlh73A2/wA=";
+          url = "https://snapshot.debian.org/archive/debian/20260105T082626Z/dists/trixie-backports/main/binary-i386/Packages.xz";
+          hash = "sha256-hEBAQ73Jnv8zp9YvNXWLEObyrSlQNBNBj/XoofJL7eI=";
         })
       ];
-      urlPrefix = "https://snapshot.debian.org/archive/debian/20251217T203845Z";
+      urlPrefix = "https://snapshot.debian.org/archive/debian/20260105T082626Z";
       packages = commonDebianPackages;
     };
 
@@ -1415,15 +1415,15 @@ let
       fullName = "Debian 13.2 Trixie (amd64)";
       packagesLists = [
         (fetchurl {
-          url = "https://snapshot.debian.org/archive/debian/20251217T203845Z/dists/trixie/main/binary-amd64/Packages.xz";
+          url = "https://snapshot.debian.org/archive/debian/20260105T082626Z/dists/trixie/main/binary-amd64/Packages.xz";
           hash = "sha256-g7f+tKljUXAC4gxJfzSC8+j0GbiwRZjonv25tYuvxtU=";
         })
         (fetchurl {
-          url = "https://snapshot.debian.org/archive/debian/20251217T203845Z/dists/trixie-backports/main/binary-amd64/Packages.xz";
-          hash = "sha256-J7BcablKTswyfKmCIoWGlE32puSDFgcKQGNmhbvl+CY=";
+          url = "https://snapshot.debian.org/archive/debian/20260105T082626Z/dists/trixie-backports/main/binary-amd64/Packages.xz";
+          hash = "sha256-9OoR36FsyK7MQMLHLFMRJ9O11WKq9JCfGwnprpztxNw=";
         })
       ];
-      urlPrefix = "https://snapshot.debian.org/archive/debian/20251217T203845Z";
+      urlPrefix = "https://snapshot.debian.org/archive/debian/20260105T082626Z";
       packages = commonDebianPackages;
     };
   };

From 63df4c8020403b4be663cdf47d55d35f5a4f1c25 Mon Sep 17 00:00:00 2001
From: Philip Taron <philip.taron@gmail.com>
Date: Mon, 5 Jan 2026 11:18:23 -0800
Subject: [PATCH 29/29] vmTools: update Ubuntu snapshot timestamps to
 20260101T000000Z

---
 pkgs/build-support/vm/default.nix | 52 +++++++++++++++----------------
 1 file changed, 26 insertions(+), 26 deletions(-)

diff --git a/pkgs/build-support/vm/default.nix b/pkgs/build-support/vm/default.nix
index fcaaac568d60..73325c0d81eb 100644
--- a/pkgs/build-support/vm/default.nix
+++ b/pkgs/build-support/vm/default.nix
@@ -1234,31 +1234,31 @@ let
       fullName = "Ubuntu 22.04 Jammy (i386)";
       packagesLists = [
         (fetchurl {
-          url = "https://snapshot.ubuntu.com/ubuntu/20251217T000000Z/dists/jammy/main/binary-i386/Packages.xz";
+          url = "https://snapshot.ubuntu.com/ubuntu/20260101T000000Z/dists/jammy/main/binary-i386/Packages.xz";
           hash = "sha256-iZBmwT0ep4v+V3sayybbOgZBOFFZwPGpOKtmuLMMVPQ=";
         })
         (fetchurl {
-          url = "https://snapshot.ubuntu.com/ubuntu/20251217T000000Z/dists/jammy/universe/binary-i386/Packages.xz";
+          url = "https://snapshot.ubuntu.com/ubuntu/20260101T000000Z/dists/jammy/universe/binary-i386/Packages.xz";
           hash = "sha256-DO2LdpZ9rDDBhWj2gvDWd0TJJVZHxKsYTKTi6GXjm1E=";
         })
         (fetchurl {
-          url = "https://snapshot.ubuntu.com/ubuntu/20251217T000000Z/dists/jammy-updates/main/binary-i386/Packages.xz";
+          url = "https://snapshot.ubuntu.com/ubuntu/20260101T000000Z/dists/jammy-updates/main/binary-i386/Packages.xz";
           hash = "sha256-g95BtOoMxacZEHMBbcMes4a1P9HKf/QGOMOPr+OKayo=";
         })
         (fetchurl {
-          url = "https://snapshot.ubuntu.com/ubuntu/20251217T000000Z/dists/jammy-updates/universe/binary-i386/Packages.xz";
-          hash = "sha256-AW/XNsA1SblUhfkUP9pC/TLF6cerGI41gfSBCihgt7w=";
+          url = "https://snapshot.ubuntu.com/ubuntu/20260101T000000Z/dists/jammy-updates/universe/binary-i386/Packages.xz";
+          hash = "sha256-VbazaDDJKSUyQchGmw5f+FYAr4PIXWZJSBF0WVC5j+0=";
         })
         (fetchurl {
-          url = "https://snapshot.ubuntu.com/ubuntu/20251217T000000Z/dists/jammy-security/main/binary-i386/Packages.xz";
+          url = "https://snapshot.ubuntu.com/ubuntu/20260101T000000Z/dists/jammy-security/main/binary-i386/Packages.xz";
           hash = "sha256-SkP4PqjUAbEMtktR5WQm/3jQl9O0T2VOVTP9QIYIVkQ=";
         })
         (fetchurl {
-          url = "https://snapshot.ubuntu.com/ubuntu/20251217T000000Z/dists/jammy-security/universe/binary-i386/Packages.xz";
+          url = "https://snapshot.ubuntu.com/ubuntu/20260101T000000Z/dists/jammy-security/universe/binary-i386/Packages.xz";
           hash = "sha256-citjk8LAGSRlXgOXgf3oe9vBCUC6/DJGhRJl/3ppN9c=";
         })
       ];
-      urlPrefix = "https://snapshot.ubuntu.com/ubuntu/20251217T000000Z";
+      urlPrefix = "https://snapshot.ubuntu.com/ubuntu/20260101T000000Z";
       packages = commonDebPackages ++ [
         "diffutils"
         "libc-bin"
@@ -1270,31 +1270,31 @@ let
       fullName = "Ubuntu 22.04 Jammy (amd64)";
       packagesLists = [
         (fetchurl {
-          url = "https://snapshot.ubuntu.com/ubuntu/20251217T000000Z/dists/jammy/main/binary-amd64/Packages.xz";
+          url = "https://snapshot.ubuntu.com/ubuntu/20260101T000000Z/dists/jammy/main/binary-amd64/Packages.xz";
           hash = "sha256-N8tX8VVMv6ccWinun/7hipqMF4K7BWjgh0t/9M6PnBE=";
         })
         (fetchurl {
-          url = "https://snapshot.ubuntu.com/ubuntu/20251217T000000Z/dists/jammy/universe/binary-amd64/Packages.xz";
+          url = "https://snapshot.ubuntu.com/ubuntu/20260101T000000Z/dists/jammy/universe/binary-amd64/Packages.xz";
           hash = "sha256-0pyyTJP+xfQyVXBrzn60bUd5lSA52MaKwbsUpvNlXOI=";
         })
         (fetchurl {
-          url = "https://snapshot.ubuntu.com/ubuntu/20251217T000000Z/dists/jammy-updates/main/binary-amd64/Packages.xz";
-          hash = "sha256-kFHg+DogK+deDx9Tbp7+SaIegnotE5ZofqR8J7S73n8=";
+          url = "https://snapshot.ubuntu.com/ubuntu/20260101T000000Z/dists/jammy-updates/main/binary-amd64/Packages.xz";
+          hash = "sha256-I57YuLZ458RljXfp1xFxqQLGNJh9uu8kQC0hc88XZro=";
         })
         (fetchurl {
-          url = "https://snapshot.ubuntu.com/ubuntu/20251217T000000Z/dists/jammy-updates/universe/binary-amd64/Packages.xz";
-          hash = "sha256-WQbtqdAWbhfd8/fwct1uuJXHiZQGPMw3KKhmha4MeTs=";
+          url = "https://snapshot.ubuntu.com/ubuntu/20260101T000000Z/dists/jammy-updates/universe/binary-amd64/Packages.xz";
+          hash = "sha256-ZXobWMi7tkakZ89GoyKpiRhRxMRXud0DOerSfzz5CPE=";
         })
         (fetchurl {
-          url = "https://snapshot.ubuntu.com/ubuntu/20251217T000000Z/dists/jammy-security/main/binary-amd64/Packages.xz";
+          url = "https://snapshot.ubuntu.com/ubuntu/20260101T000000Z/dists/jammy-security/main/binary-amd64/Packages.xz";
           hash = "sha256-cifTPY1iyckkaLd7dp+VPRlF0viWKrWXhM8HVWaMuUw=";
         })
         (fetchurl {
-          url = "https://snapshot.ubuntu.com/ubuntu/20251217T000000Z/dists/jammy-security/universe/binary-amd64/Packages.xz";
+          url = "https://snapshot.ubuntu.com/ubuntu/20260101T000000Z/dists/jammy-security/universe/binary-amd64/Packages.xz";
           hash = "sha256-LTSOGbzkv0KrF2JM6oVT1Ml2KQkySXMbKNMBb9AyfQM=";
         })
       ];
-      urlPrefix = "https://snapshot.ubuntu.com/ubuntu/20251217T000000Z";
+      urlPrefix = "https://snapshot.ubuntu.com/ubuntu/20260101T000000Z";
       packages = commonDebPackages ++ [
         "diffutils"
         "libc-bin"
@@ -1306,31 +1306,31 @@ let
       fullName = "Ubuntu 24.04 Noble (amd64)";
       packagesLists = [
         (fetchurl {
-          url = "https://snapshot.ubuntu.com/ubuntu/20251217T000000Z/dists/noble/main/binary-amd64/Packages.xz";
+          url = "https://snapshot.ubuntu.com/ubuntu/20260101T000000Z/dists/noble/main/binary-amd64/Packages.xz";
           hash = "sha256-KmoZnhAxpcJ5yzRmRtWUmT81scA91KgqqgMjmA3ZJFE=";
         })
         (fetchurl {
-          url = "https://snapshot.ubuntu.com/ubuntu/20251217T000000Z/dists/noble/universe/binary-amd64/Packages.xz";
+          url = "https://snapshot.ubuntu.com/ubuntu/20260101T000000Z/dists/noble/universe/binary-amd64/Packages.xz";
           hash = "sha256-upBX+huRQ4zIodJoCNAMhTif4QHQwUliVN+XI2QFWZo=";
         })
         (fetchurl {
-          url = "https://snapshot.ubuntu.com/ubuntu/20251217T000000Z/dists/noble-updates/main/binary-amd64/Packages.xz";
-          hash = "sha256-f6hiUH9S1Bh8/Ljr9AkZYlwHF1vT2bqKGH6TfWnzI7Q=";
+          url = "https://snapshot.ubuntu.com/ubuntu/20260101T000000Z/dists/noble-updates/main/binary-amd64/Packages.xz";
+          hash = "sha256-leBJ29a2C2qdIPdjSSuwkHKUSq8GEC9L0DgdxHWZ55s=";
         })
         (fetchurl {
-          url = "https://snapshot.ubuntu.com/ubuntu/20251217T000000Z/dists/noble-updates/universe/binary-amd64/Packages.xz";
-          hash = "sha256-ROG+WO5zssfFUblTZxQjIDshdLIZn3meEgTsv6qYi5o=";
+          url = "https://snapshot.ubuntu.com/ubuntu/20260101T000000Z/dists/noble-updates/universe/binary-amd64/Packages.xz";
+          hash = "sha256-CWYA0A4ytptWdClW3ACdIH4hKscblDh5OgxExP4VdJA=";
         })
         (fetchurl {
-          url = "https://snapshot.ubuntu.com/ubuntu/20251217T000000Z/dists/noble-security/main/binary-amd64/Packages.xz";
+          url = "https://snapshot.ubuntu.com/ubuntu/20260101T000000Z/dists/noble-security/main/binary-amd64/Packages.xz";
           hash = "sha256-TYs8ugCYqzOleH2OebdrpB8E68PfxB+7sRb+PlfANEo=";
         })
         (fetchurl {
-          url = "https://snapshot.ubuntu.com/ubuntu/20251217T000000Z/dists/noble-security/universe/binary-amd64/Packages.xz";
+          url = "https://snapshot.ubuntu.com/ubuntu/20260101T000000Z/dists/noble-security/universe/binary-amd64/Packages.xz";
           hash = "sha256-bK9R8CUjLQ1V4GP7/KqZooSnKHF5+T5SuBs0butC82M=";
         })
       ];
-      urlPrefix = "https://snapshot.ubuntu.com/ubuntu/20251217T000000Z";
+      urlPrefix = "https://snapshot.ubuntu.com/ubuntu/20260101T000000Z";
       packages = commonDebPackages ++ [
         "diffutils"
         "libc-bin"