Merge master into staging-nixos

.git-blame-ignore-revs

@@ -310,3 +310,6 @@ c283f32d296564fd649ef3ed268c1f1f7b199c49 # !autorebase nix-shell --run treefmt
 
 # treewide: clean up 'meta = with' pattern
 567e8dfd8eddc5468e6380fc563ab8a27422ab1d
+
+# nixfmt 1.2.0
+28096cc5e3d8334fbe1845925f000f8c8c5e0aac # !autorebase nix-shell --run treefmt

ci/OWNERS

@@ -434,7 +434,7 @@ pkgs/by-name/fo/forgejo/                @adamcstephens @bendlas @emilylange
 
 # Node.js
 /pkgs/build-support/node/build-npm-package      @winterqt
-/pkgs/build-support/node/fetch-npm-deps         @winterqt
+/pkgs/build-support/node/prefetch-npm-deps      @winterqt
 /doc/languages-frameworks/javascript.section.md @winterqt
 /pkgs/development/tools/pnpm                    @Scrumplex @gepbird
 /pkgs/build-support/node/fetch-pnpm-deps        @Scrumplex @gepbird

ci/default.nix

@@ -87,22 +87,30 @@ let
           "pkgs/development/haskell-modules/configuration-hackage2nix/transitive-broken.yaml"
         ];
 
-        programs.nixf-diagnose.enable = true;
-        settings.formatter.nixf-diagnose = {
-          # Ensure nixfmt cleans up after nixf-diagnose.
-          priority = -1;
-          options = [
-            "--auto-fix"
+        programs.nixf-diagnose = {
+          enable = true;
+          ignore = [
             # Rule names can currently be looked up here:
             # https://github.com/nix-community/nixd/blob/main/libnixf/src/Basic/diagnostic.py
             # TODO: Remove the following and fix things.
-            "--ignore=sema-unused-def-lambda-noarg-formal"
-            "--ignore=sema-unused-def-lambda-witharg-arg"
-            "--ignore=sema-unused-def-lambda-witharg-formal"
-            "--ignore=sema-unused-def-let"
+            "sema-unused-def-lambda-noarg-formal"
+            "sema-unused-def-lambda-witharg-arg"
+            "sema-unused-def-lambda-witharg-formal"
+            "sema-unused-def-let"
             # Keep this rule, because we have `lib.or`.
-            "--ignore=or-identifier"
+            "or-identifier"
+            # TODO: remove after outstanding prelude diagnostics issues are fixed:
+            # https://github.com/nix-community/nixd/issues/761
+            # https://github.com/nix-community/nixd/issues/762
+            "sema-primop-removed-prefix"
+            "sema-primop-overridden"
+            "sema-constant-overridden"
+            "sema-primop-unknown"
           ];
+        };
+        settings.formatter.nixf-diagnose = {
+          # Ensure nixfmt cleans up after nixf-diagnose.
+          priority = -1;
           excludes = [
             # Auto-generated; violates sema-extra-with
             # Can only sensibly be removed when --auto-fix supports multiple fixes at once:

ci/pinned.json

@@ -9,9 +9,9 @@
       },
       "branch": "nixpkgs-unstable",
       "submodules": false,
-      "revision": "ee09932cedcef15aaf476f9343d1dea2cb77e261",
-      "url": "https://github.com/NixOS/nixpkgs/archive/ee09932cedcef15aaf476f9343d1dea2cb77e261.tar.gz",
-      "hash": "1xz5pa6la2fyj5b1cfigmg3nmml11fyf9ah0rnr4zfgmnwimn2gn"
+      "revision": "bde09022887110deb780067364a0818e89258968",
+      "url": "https://github.com/NixOS/nixpkgs/archive/bde09022887110deb780067364a0818e89258968.tar.gz",
+      "hash": "13mi187zpa4rw680qbwp7pmykjia8cra3nwvjqmsjba3qhlzif5l"
     },
     "treefmt-nix": {
       "type": "Git",
@@ -22,9 +22,9 @@
       },
       "branch": "main",
       "submodules": false,
-      "revision": "5b4ee75aeefd1e2d5a1cc43cf6ba65eba75e83e4",
-      "url": "https://github.com/numtide/treefmt-nix/archive/5b4ee75aeefd1e2d5a1cc43cf6ba65eba75e83e4.tar.gz",
-      "hash": "0cr6aj9bk7n3y09lwmfjr7xg1f069332xf4q99z3kj1c1mp0wl82"
+      "revision": "e96d59dff5c0d7fddb9d113ba108f03c3ef99eca",
+      "url": "https://github.com/numtide/treefmt-nix/archive/e96d59dff5c0d7fddb9d113ba108f03c3ef99eca.tar.gz",
+      "hash": "02gqyxila3ghw8gifq3mns639x86jcq079kvfvjm42mibx7z5fzb"
     }
   },
   "version": 5

doc/hooks/udevCheckHook.section.md

@@ -10,7 +10,7 @@ The hook runs in `installCheckPhase`, requiring `doInstallCheck` is enabled for
   lib,
   stdenv,
   udevCheckHook,
-# ...
+  # ...
 }:
 
 stdenv.mkDerivation (finalAttrs: {

doc/hooks/versionCheckHook.section.md

@@ -9,7 +9,7 @@ You use it like this:
   lib,
   stdenv,
   versionCheckHook,
-# ...
+  # ...
 }:
 
 stdenv.mkDerivation (finalAttrs: {

doc/languages-frameworks/nim.section.md

@@ -112,7 +112,7 @@ For example, to propagate a dependency on SDL2 for lockfiles that select the Nim
   lib,
   # …
   SDL2,
-# …
+  # …
 }:
 
 {

lib/fileset/default.nix

@@ -191,7 +191,7 @@ in
       if isStringLike path then
         throw ''lib.fileset.maybeMissing: Argument ("${toString path}") is a string-like value, but it should be a path instead.''
       else
-        throw ''lib.fileset.maybeMissing: Argument is of type ${typeOf path}, but it should be a path instead.''
+        throw "lib.fileset.maybeMissing: Argument is of type ${typeOf path}, but it should be a path instead."
     else if !pathExists path then
       _emptyWithoutBase
     else
@@ -443,7 +443,7 @@ in
           lib.fileset.toSource: `root` (${toString root}) is a string-like value, but it should be a path instead.
               Paths in strings are not supported by `lib.fileset`, use `lib.sources` or derivations instead.''
       else
-        throw ''lib.fileset.toSource: `root` is of type ${typeOf root}, but it should be a path instead.''
+        throw "lib.fileset.toSource: `root` is of type ${typeOf root}, but it should be a path instead."
     # Currently all Nix paths have the same filesystem root, but this could change in the future.
     # See also ../path/README.md
     else if !fileset._internalIsEmptyWithoutBase && rootFilesystemRoot != filesetFilesystemRoot then
@@ -453,7 +453,7 @@ in
             `fileset`: Filesystem root is "${toString filesetFilesystemRoot}"
             Different filesystem roots are not supported.''
     else if !pathExists root then
-      throw ''lib.fileset.toSource: `root` (${toString root}) is a path that does not exist.''
+      throw "lib.fileset.toSource: `root` (${toString root}) is a path that does not exist."
     else if pathType root != "directory" then
       throw ''
         lib.fileset.toSource: `root` (${toString root}) is a file, but it should be a directory instead. Potential solutions:
@@ -619,7 +619,7 @@ in
   unions =
     filesets:
     if !isList filesets then
-      throw ''lib.fileset.unions: Argument is of type ${typeOf filesets}, but it should be a list instead.''
+      throw "lib.fileset.unions: Argument is of type ${typeOf filesets}, but it should be a list instead."
     else
       pipe filesets [
         # Annotate the elements with context, used by _coerceMany for better errors
@@ -808,16 +808,16 @@ in
   fileFilter =
     predicate: path:
     if !isFunction predicate then
-      throw ''lib.fileset.fileFilter: First argument is of type ${typeOf predicate}, but it should be a function instead.''
+      throw "lib.fileset.fileFilter: First argument is of type ${typeOf predicate}, but it should be a function instead."
     else if !isPath path then
       if path._type or "" == "fileset" then
         throw ''
           lib.fileset.fileFilter: Second argument is a file set, but it should be a path instead.
               If you need to filter files in a file set, use `intersection fileset (fileFilter pred ./.)` instead.''
       else
-        throw ''lib.fileset.fileFilter: Second argument is of type ${typeOf path}, but it should be a path instead.''
+        throw "lib.fileset.fileFilter: Second argument is of type ${typeOf path}, but it should be a path instead."
     else if !pathExists path then
-      throw ''lib.fileset.fileFilter: Second argument (${toString path}) is a path that does not exist.''
+      throw "lib.fileset.fileFilter: Second argument (${toString path}) is a path that does not exist."
     else
       _fileFilter predicate path;
 
@@ -896,9 +896,9 @@ in
           lib.fileset.fromSource: The source origin of the argument is a string-like value ("${toString path}"), but it should be a path instead.
               Sources created from paths in strings cannot be turned into file sets, use `lib.sources` or derivations instead.''
       else
-        throw ''lib.fileset.fromSource: The source origin of the argument is of type ${typeOf path}, but it should be a path instead.''
+        throw "lib.fileset.fromSource: The source origin of the argument is of type ${typeOf path}, but it should be a path instead."
     else if !pathExists path then
-      throw ''lib.fileset.fromSource: The source origin (${toString path}) of the argument is a path that does not exist.''
+      throw "lib.fileset.fromSource: The source origin (${toString path}) of the argument is a path that does not exist."
     else if isFiltered then
       _fromSourceFilter path source.filter
     else

lib/fileset/internal.nix

@@ -211,7 +211,7 @@ rec {
           ${context} ("${toString value}") is a string-like value, but it should be a file set or a path instead.
               Paths represented as strings are not supported by `lib.fileset`, use `lib.sources` or derivations instead.''
       else
-        error ''${context} is of type ${typeOf value}, but it should be a file set or a path instead.''
+        error "${context} is of type ${typeOf value}, but it should be a file set or a path instead."
     else if !pathExists value then
       error ''
         ${context} (${toString value}) is a path that does not exist.

lib/licenses.nix

@@ -742,6 +742,18 @@ lib.mapAttrs mkLicense (
       fullName = "Historical Permission Notice and Disclaimer - sell xserver variant with MIT disclaimer";
     };
 
+    hpndSellVariantSafetyClause = {
+      fullName = "HPND - sell variant with safety critical systems clause";
+      url = "https://gitlab.freedesktop.org/xorg/driver/xf86-video-voodoo/-/blob/68a5b6d98ae34749cca889f4373b4043d00bfe6a/src/voodoo_dga.c#L12-33";
+      # TODO: if the license gets accepted to spdx then
+      #   add spdxId
+      # else
+      #   remove license
+      #   && replace reference with whatever this license is supposed to be then
+      # https://github.com/spdx/license-list-XML/issues/2922
+      # spdxId = "HPND-sell-variant-safety-clause";
+    };
+
     hpndDec = {
       fullName = "Historical Permission Notice and Disclaimer - DEC variant";
       spdxId = "HPND-DEC";

lib/path/default.nix

@@ -239,7 +239,7 @@ in
     # The subpath string to append
     subpath:
     assert assertMsg (isPath path)
-      ''lib.path.append: The first argument is of type ${builtins.typeOf path}, but a path was expected'';
+      "lib.path.append: The first argument is of type ${builtins.typeOf path}, but a path was expected";
     assert assertMsg (isValid subpath) ''
       lib.path.append: Second argument is not a valid subpath string:
           ${subpathInvalidReason subpath}'';

lib/systems/platforms.nix

@@ -85,7 +85,6 @@ rec {
         BLK_DEV_DM m
         DM_CRYPT m
         MD y
-        REISERFS_FS m
         BTRFS_FS m
         XFS_FS m
         JFS_FS m
@@ -430,7 +429,6 @@ rec {
         BLK_DEV_DM m
         DM_CRYPT m
         MD y
-        REISERFS_FS m
         EXT4_FS m
         USB_STORAGE_CYPRESS_ATACB m
 
@@ -475,7 +473,6 @@ rec {
         FRAMEBUFFER_CONSOLE y
         EXT2_FS y
         EXT3_FS y
-        REISERFS_FS y
         MAGIC_SYSRQ y
 
         # The kernel doesn't boot at all, with FTRACE

lib/tests/checkAndMergeCompat.nix

@@ -331,7 +331,7 @@ in
     testAttrs = {
       expectedError = {
         type = "ThrownError";
-        msg = ''A definition for option `foo' is not of type `string or signed integer convertible to it.*'';
+        msg = "A definition for option `foo' is not of type `string or signed integer convertible to it.*";
       };
     };
   };

lib/tests/misc.nix

@@ -867,7 +867,7 @@ runTests {
 
   testEscapeNixIdentifierNoQuote = {
     expr = strings.escapeNixIdentifier "foo";
-    expected = ''foo'';
+    expected = "foo";
   };
 
   testEscapeNixIdentifierNumber = {
@@ -2634,7 +2634,7 @@ runTests {
       sections = {
       };
     };
-    expected = '''';
+    expected = "";
   };
 
   testToINIWithGlobalSectionGlobalEmptyIsTheSameAsToINI =
@@ -3002,12 +3002,12 @@ runTests {
 
   testToLuaEmptyAttrSet = {
     expr = generators.toLua { } { };
-    expected = ''{}'';
+    expected = "{}";
   };
 
   testToLuaEmptyList = {
     expr = generators.toLua { } [ ];
-    expected = ''{}'';
+    expected = "{}";
   };
 
   testToLuaListOfVariousTypes = {
@@ -3052,7 +3052,7 @@ runTests {
       41
       43
     ];
-    expected = ''{ 41, 43 }'';
+    expected = "{ 41, 43 }";
   };
 
   testToLuaEmptyBindings = {

lib/types.nix

@@ -1412,7 +1412,7 @@ rec {
         else if builtins.isBool v then
           boolToString v
         else
-          ''<${builtins.typeOf v}>'';
+          "<${builtins.typeOf v}>";
     in
     mkOptionType rec {
       name = "enum";

maintainers/maintainer-list.nix

@@ -4584,6 +4584,12 @@
     githubId = 52875777;
     name = "Channing He";
   };
+  chansuke = {
+    email = "chansuke0@gmail.com";
+    github = "chansuke";
+    githubId = 501052;
+    name = "chansuke";
+  };
   chaoflow = {
     email = "flo@chaoflow.net";
     github = "chaoflow";

maintainers/scripts/bootstrap-files/README.md

@@ -11,10 +11,53 @@ These are called "bootstrap files".
 
 Bootstrap files should always be fetched from hydra and uploaded to `tarballs.nixos.org` to guarantee that all the binaries were built from the code committed into `nixpkgs` repository.
 
-The uploads to `tarballs.nixos.org` are done by `@lovesegfault` today.
+The uploads to `tarballs.nixos.org` are done by `@NixOS/infra` team members who have S3 write access.
 
 This document describes the procedure of updating bootstrap files in `nixpkgs`.
 
+## How to upload bootstrap files (for infra team)
+
+When a PR updates bootstrap files, the commit message contains the upload commands.
+Infra team members with S3 access can upload as follows:
+
+1. Clone or navigate to the [nixos-infra](https://github.com/NixOS/nixos-infra) repository and enter the `terraform` directory:
+
+   ```
+   $ cd nixos-infra/terraform
+   ```
+
+2. Authenticate with AWS SSO:
+
+   ```
+   $ aws sso login
+   ```
+
+3. Realize the build output locally (fetch from hydra cache):
+
+   ```
+   $ nix-store --realize /nix/store/<hash>-stdenv-bootstrap-tools
+   ```
+
+4. Upload to S3 with public-read ACL:
+
+   ```
+   $ aws s3 cp --recursive --acl public-read \
+       /nix/store/<hash>-stdenv-bootstrap-tools/on-server/ \
+       s3://nixpkgs-tarballs/stdenv/<target>/<nixpkgs-revision>/
+   ```
+
+5. Verify the upload by downloading and checking hashes:
+
+   ```
+   $ aws s3 cp --recursive s3://nixpkgs-tarballs/stdenv/<target>/<nixpkgs-revision>/ ./
+   $ sha256sum bootstrap-tools.tar.xz busybox
+   $ sha256sum /nix/store/<hash>-stdenv-bootstrap-tools/on-server/*
+   ```
+
+   Compare these hashes with those shown in the PR's commit message.
+
+The exact paths and hashes are provided in each bootstrap update commit message generated by `refresh-tarballs.bash`.
+
 ## How to request the bootstrap seed update
 
 To get the tarballs updated let's use an example `i686-unknown-linux-gnu` target:
@@ -34,7 +77,7 @@ To get the tarballs updated let's use an example `i686-unknown-linux-gnu` target
    To validate cross-targets `binfmt` `NixOS` helper can be useful.
    For `riscv64-unknown-linux-gnu` the `/etc/nixos/configuration.nix` entry would be `boot.binfmt.emulatedSystems = [ "riscv64-linux" ]`.
 
-3. Propose the commit as a PR to update bootstrap tarballs, tag people who can help you test the updated architecture and once reviewed tag `@lovesegfault` to upload the tarballs.
+3. Propose the commit as a PR to update bootstrap tarballs, tag people who can help you test the updated architecture and once reviewed tag `@NixOS/infra-build` to upload the tarballs.
 
 ## How to add bootstrap files for a new target
 

modules/generic/meta-maintainers.nix

@@ -46,7 +46,7 @@ in
       maintainers = mkOption {
         type = listOfMaintainers;
         default = [ ];
-        example = lib.literalExpression ''[ lib.maintainers.alice lib.maintainers.bob ]'';
+        example = lib.literalExpression "[ lib.maintainers.alice lib.maintainers.bob ]";
         description = ''
           List of maintainers of each module.
           This option should be defined at most once per module.

nixos/README-modular-services.md

@@ -82,7 +82,7 @@ Example:
 {
   stdenv,
   nixosTests,
-# ...
+  # ...
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "example";

nixos/doc/manual/release-notes/rl-2605.section.md

@@ -126,3 +126,41 @@ of pulling the upstream container image from Docker Hub. If you want the old beh
 - `services.openssh` now supports generating host SSH keys by setting `services.openssh.generateHostKeys = true` while leaving `services.openssh.enable` disabled.  This is particularly useful for systems that have no need of an SSH daemon but want SSH host keys for other purposes such as using agenix or sops-nix.
 
 - `services.slurm` now supports slurmrestd usage through the `services.slurm.rest` NixOS options.
+
+- `glibc` has been updated to version 2.42.
+
+  This version no longer makes the stack executable when a shared library requires this. A symptom
+  is an error like
+
+  > cannot enable executable stack as shared object requires: Invalid argument
+
+  This is usually a bug. Please consider reporting it to the software maintainers.
+
+  In a lot of cases, the library requires the execstack by mistake only. The following workarounds exist:
+
+  * When building the shared library in question from source, use the following linker flags to force turning off the
+    executable flag:
+
+    ```nix
+    mkDerivation {
+      # …
+
+      env.NIX_LDFLAGS = "-z,noexecstack";
+    }
+    ```
+
+  * If the sources are not available, the execstack-flag can be cleared with `patchelf`:
+
+    ```
+    patchelf --clear-execstack binary-only.so
+    ```
+
+  * If the shared library to be loaded actually requires an executable stack and it isn't turned
+    on by the application loading it, you may force allowing that behavior by setting the
+    following environment variable:
+
+    ```
+    GLIBC_TUNABLES=glibc.rtld.execstack=2
+    ```
+
+    **Do not set this globally!** This makes your setup inherently less secure.

nixos/doc/manual/shell.nix

@@ -7,7 +7,7 @@ let
   common = import ./common.nix;
   inherit (common) outputPath indexPath;
   devmode = pkgs.devmode.override {
-    buildArgs = ''${toString ../../release.nix} -A manualHTML.${builtins.currentSystem}'';
+    buildArgs = "${toString ../../release.nix} -A manualHTML.${builtins.currentSystem}";
     open = "/${outputPath}/${indexPath}";
   };
   nixos-render-docs-redirects = pkgs.writeShellScriptBin "redirects" ''${pkgs.lib.getExe pkgs.nixos-render-docs-redirects} --file '${toString ./redirects.json}' "$@"'';

nixos/lib/make-multi-disk-zfs-image.nix

@@ -347,7 +347,7 @@ let
               --no-root-passwd \
               --system ${config.system.build.toplevel} \
               --substituters "" \
-              ${lib.optionalString includeChannel ''--channel ${channelSources}''}
+              ${lib.optionalString includeChannel "--channel ${channelSources}"}
 
             df -h
 

nixos/lib/make-single-disk-zfs-image.nix

@@ -330,7 +330,7 @@ let
               --no-root-passwd \
               --system ${config.system.build.toplevel} \
               --substituters "" \
-              ${lib.optionalString includeChannel ''--channel ${channelSources}''}
+              ${lib.optionalString includeChannel "--channel ${channelSources}"}
 
             df -h
 

nixos/lib/testing/nodes.nix

@@ -164,7 +164,7 @@ in
       '';
       type = types.bool;
       default = config.node.pkgs != null;
-      defaultText = literalExpression ''node.pkgs != null'';
+      defaultText = literalExpression "node.pkgs != null";
     };
 
     node.specialArgs = mkOption {

nixos/lib/utils.nix

@@ -410,7 +410,7 @@ let
           stringOrDefault (concatStringsSep " | " (
             imap1 (
               index: name:
-              ''${name} = ($ENV.secret${toString index}${optionalString (!secrets.${name}.quote) " | fromjson"})''
+              "${name} = ($ENV.secret${toString index}${optionalString (!secrets.${name}.quote) " | fromjson"})"
             ) (attrNames secrets)
           )) "."
         )

nixos/modules/config/users-groups.nix

@@ -62,9 +62,9 @@ let
       "*" # password unset
     ]);
 
-  overrideOrderMutable = ''{option}`initialHashedPassword` -> {option}`initialPassword` -> {option}`hashedPassword` -> {option}`password` -> {option}`hashedPasswordFile`'';
+  overrideOrderMutable = "{option}`initialHashedPassword` -> {option}`initialPassword` -> {option}`hashedPassword` -> {option}`password` -> {option}`hashedPasswordFile`";
 
-  overrideOrderImmutable = ''{option}`initialHashedPassword` -> {option}`hashedPassword` -> {option}`initialPassword` -> {option}`password` -> {option}`hashedPasswordFile`'';
+  overrideOrderImmutable = "{option}`initialHashedPassword` -> {option}`hashedPassword` -> {option}`initialPassword` -> {option}`password` -> {option}`hashedPasswordFile`";
 
   overrideOrderText = isMutable: ''
     If the option {option}`users.mutableUsers` is

nixos/modules/config/xdg/portal.nix

@@ -37,7 +37,7 @@ in
 
   options.xdg.portal = {
     enable =
-      mkEnableOption ''[xdg desktop integration](https://github.com/flatpak/xdg-desktop-portal)''
+      mkEnableOption "[xdg desktop integration](https://github.com/flatpak/xdg-desktop-portal)"
       // {
         default = false;
       };

nixos/modules/hardware/inputmodule.nix

@@ -6,7 +6,7 @@
 }:
 
 {
-  options.hardware.inputmodule.enable = lib.mkEnableOption ''Support for Framework input modules'';
+  options.hardware.inputmodule.enable = lib.mkEnableOption "Support for Framework input modules";
 
   config = lib.mkIf config.hardware.inputmodule.enable {
     environment.systemPackages = [ pkgs.inputmodule-control ];

nixos/modules/misc/nixpkgs.nix

@@ -228,7 +228,7 @@ in
           cfg.hostPlatform # make identical, so that `==` equality works; see https://github.com/NixOS/nixpkgs/issues/278001
         else
           elaborated;
-      defaultText = lib.literalExpression ''config.nixpkgs.hostPlatform'';
+      defaultText = lib.literalExpression "config.nixpkgs.hostPlatform";
       description = ''
         Specifies the platform on which NixOS should be built.
         By default, NixOS is built on the system where it runs, but you can
@@ -252,7 +252,7 @@ in
       # Make sure that the final value has all fields for sake of other modules
       # referring to this. TODO make `lib.systems` itself use the module system.
       apply = lib.systems.elaborate;
-      defaultText = lib.literalExpression ''config.nixpkgs.system'';
+      defaultText = lib.literalExpression "config.nixpkgs.system";
       description = ''
         Systems with a recently generated `hardware-configuration.nix`
         do not need to specify this option, unless cross-compiling, in which case

nixos/modules/misc/nixpkgs/read-only.nix

@@ -24,7 +24,7 @@ in
     nixpkgs = {
       pkgs = mkOption {
         type = lib.types.pkgs;
-        description = ''The pkgs module argument.'';
+        description = "The pkgs module argument.";
       };
       config = mkOption {
         internal = true;

nixos/modules/misc/version.nix

@@ -28,7 +28,7 @@ let
   escapeIfNecessary = s: if needsEscaping s then s else ''"${lib.escape [ "$" "\"" "\\" "`" ] s}"'';
   attrsToText =
     attrs:
-    concatStringsSep "\n" (mapAttrsToList (n: v: ''${n}=${escapeIfNecessary (toString v)}'') attrs)
+    concatStringsSep "\n" (mapAttrsToList (n: v: "${n}=${escapeIfNecessary (toString v)}") attrs)
     + "\n";
 
   osReleaseContents =

nixos/modules/module-list.nix

@@ -1931,7 +1931,6 @@
   ./tasks/filesystems/nfs.nix
   ./tasks/filesystems/ntfs.nix
   ./tasks/filesystems/overlayfs.nix
-  ./tasks/filesystems/reiserfs.nix
   ./tasks/filesystems/squashfs.nix
   ./tasks/filesystems/sshfs.nix
   ./tasks/filesystems/unionfs-fuse.nix

nixos/modules/programs/captive-browser.nix

@@ -27,15 +27,15 @@ let
     chromium:
     concatStringsSep " " [
       ''env XDG_CONFIG_HOME="$PREV_CONFIG_HOME"''
-      ''${chromium}/bin/chromium''
-      ''--user-data-dir=''${XDG_DATA_HOME:-$HOME/.local/share}/chromium-captive''
+      "${chromium}/bin/chromium"
+      "--user-data-dir=\${XDG_DATA_HOME:-$HOME/.local/share}/chromium-captive"
       ''--proxy-server="socks5://$PROXY"''
       ''--host-resolver-rules="MAP * ~NOTFOUND , EXCLUDE localhost"''
-      ''--no-first-run''
-      ''--new-window''
-      ''--incognito''
-      ''-no-default-browser-check''
-      ''http://cache.nixos.org/''
+      "--no-first-run"
+      "--new-window"
+      "--incognito"
+      "-no-default-browser-check"
+      "http://cache.nixos.org/"
     ];
 
   desktopItem = pkgs.makeDesktopItem {

nixos/modules/programs/nix-ld.nix

@@ -22,7 +22,7 @@ in
 {
   meta.maintainers = [ lib.maintainers.mic92 ];
   options.programs.nix-ld = {
-    enable = lib.mkEnableOption ''nix-ld, Documentation: <https://github.com/nix-community/nix-ld>'';
+    enable = lib.mkEnableOption "nix-ld, Documentation: <https://github.com/nix-community/nix-ld>";
     package = lib.mkPackageOption pkgs "nix-ld" { };
     libraries = lib.mkOption {
       type = lib.types.listOf lib.types.package;

nixos/modules/security/apparmor.nix

@@ -154,7 +154,7 @@ in
     ''
     + lib.concatMapStrings (p: "Include ${p}/etc/apparmor.d\n") cfg.packages;
     # For aa-logprof
-    environment.etc."apparmor/apparmor.conf".text = '''';
+    environment.etc."apparmor/apparmor.conf".text = "";
     # For aa-logprof
     environment.etc."apparmor/severity.db".source = pkgs.apparmor-utils + "/etc/apparmor/severity.db";
     environment.etc."apparmor/logprof.conf".source =

nixos/modules/security/polkit.nix

@@ -78,6 +78,8 @@ in
     ];
     systemd.services.polkit.stopIfChanged = false;
 
+    systemd.sockets."polkit-agent-helper".wantedBy = [ "sockets.target" ];
+
     # The polkit daemon reads action/rule files
     environment.pathsToLink = [ "/share/polkit-1" ];
 
@@ -94,19 +96,11 @@ in
 
     security.pam.services.polkit-1 = { };
 
-    security.wrappers = {
-      pkexec = {
-        setuid = true;
-        owner = "root";
-        group = "root";
-        source = "${cfg.package.bin}/bin/pkexec";
-      };
-      polkit-agent-helper-1 = {
-        setuid = true;
-        owner = "root";
-        group = "root";
-        source = "${cfg.package.out}/lib/polkit-1/polkit-agent-helper-1";
-      };
+    security.wrappers.pkexec = {
+      setuid = true;
+      owner = "root";
+      group = "root";
+      source = "${cfg.package.bin}/bin/pkexec";
     };
 
     systemd.tmpfiles.rules = [

nixos/modules/security/tpm2.nix

@@ -290,12 +290,12 @@ in
             ]
             (
               _:
-              ''${cfg.tctiEnvironment.interface}:${
+              "${cfg.tctiEnvironment.interface}:${
                 if cfg.tctiEnvironment.interface == "tabrmd" then
                   cfg.tctiEnvironment.tabrmdConf
                 else
                   cfg.tctiEnvironment.deviceConf
-              }''
+              }"
             )
         );
       }

nixos/modules/services/audio/mpd.nix

@@ -411,7 +411,7 @@ in
         lib.concatStringsSep "\n" (
           lib.imap0 (
             i: c:
-            ''${pkgs.replace-secret}/bin/replace-secret '{{password-${toString i}}}' '${c.passwordFile}' /run/mpd/mpd.conf''
+            "${pkgs.replace-secret}/bin/replace-secret '{{password-${toString i}}}' '${c.passwordFile}' /run/mpd/mpd.conf"
           ) cfg.credentials
         )
       );

nixos/modules/services/audio/mpdscribble.nix

@@ -64,7 +64,7 @@ let
     secretFile: placeholder: targetFile:
     lib.optionalString (
       secretFile != null
-    ) ''${pkgs.replace-secret}/bin/replace-secret '${placeholder}' '${secretFile}' '${targetFile}' '';
+    ) "${pkgs.replace-secret}/bin/replace-secret '${placeholder}' '${secretFile}' '${targetFile}' ";
 
   preStart = pkgs.writeShellScript "mpdscribble-pre-start" ''
     cp -f "${cfgTemplate}" "${cfgFile}"

nixos/modules/services/audio/pulseaudio.nix

@@ -35,7 +35,7 @@ let
         let
           a = cfg.tcp.anonymousClients.allowedIpRanges;
         in
-        lib.optional (a != [ ]) ''auth-ip-acl=${lib.concatStringsSep ";" a}'';
+        lib.optional (a != [ ]) "auth-ip-acl=${lib.concatStringsSep ";" a}";
       port = lib.optional (!(isNull cfg.tcp.port)) "port=${toString cfg.tcp.port}";
     in
     pkgs.writeTextFile {

nixos/modules/services/backup/restic.nix

@@ -255,7 +255,7 @@ in
             runCheck = lib.mkOption {
               type = lib.types.bool;
               default = builtins.length config.services.restic.backups.${name}.checkOpts > 0;
-              defaultText = lib.literalExpression ''builtins.length config.services.backups.${name}.checkOpts > 0'';
+              defaultText = lib.literalExpression "builtins.length config.services.backups.${name}.checkOpts > 0";
               description = "Whether to run the `check` command with the provided `checkOpts` options.";
               example = true;
             };

nixos/modules/services/backup/syncoid.nix

@@ -240,7 +240,7 @@ in
                 '';
               };
 
-              recursive = lib.mkEnableOption ''the transfer of child datasets'';
+              recursive = lib.mkEnableOption "the transfer of child datasets";
 
               sshKey = lib.mkOption {
                 type = with lib.types; nullOr (coercedTo path toString str);

nixos/modules/services/blockchain/ethereum/lighthouse.nix

@@ -246,8 +246,8 @@ in
           --datadir ${cfg.beacon.dataDir}/${cfg.network} \
           --execution-endpoint http://${cfg.beacon.execution.address}:${toString cfg.beacon.execution.port} \
           --execution-jwt ''${CREDENTIALS_DIRECTORY}/LIGHTHOUSE_JWT \
-          ${lib.optionalString cfg.beacon.http.enable ''--http --http-address ${cfg.beacon.http.address} --http-port ${toString cfg.beacon.http.port}''} \
-          ${lib.optionalString cfg.beacon.metrics.enable ''--metrics --metrics-address ${cfg.beacon.metrics.address} --metrics-port ${toString cfg.beacon.metrics.port}''} \
+          ${lib.optionalString cfg.beacon.http.enable "--http --http-address ${cfg.beacon.http.address} --http-port ${toString cfg.beacon.http.port}"} \
+          ${lib.optionalString cfg.beacon.metrics.enable "--metrics --metrics-address ${cfg.beacon.metrics.address} --metrics-port ${toString cfg.beacon.metrics.port}"} \
           ${cfg.extraArgs} ${cfg.beacon.extraArgs}
       '';
       serviceConfig = {
@@ -292,7 +292,7 @@ in
           --network ${cfg.network} \
           --beacon-nodes ${lib.concatStringsSep "," cfg.validator.beaconNodes} \
           --datadir ${cfg.validator.dataDir}/${cfg.network} \
-          ${lib.optionalString cfg.validator.metrics.enable ''--metrics --metrics-address ${cfg.validator.metrics.address} --metrics-port ${toString cfg.validator.metrics.port}''} \
+          ${lib.optionalString cfg.validator.metrics.enable "--metrics --metrics-address ${cfg.validator.metrics.address} --metrics-port ${toString cfg.validator.metrics.port}"} \
           ${cfg.extraArgs} ${cfg.validator.extraArgs}
       '';
 

nixos/modules/services/cluster/kubernetes/flannel.nix

@@ -17,7 +17,7 @@ in
     enable = lib.mkEnableOption "flannel networking";
 
     openFirewallPorts = lib.mkOption {
-      description = ''Whether to open the Flannel UDP ports in the firewall on all interfaces.'';
+      description = "Whether to open the Flannel UDP ports in the firewall on all interfaces.";
       type = lib.types.bool;
       default = true;
     };

nixos/modules/services/continuous-integration/buildbot/master.nix

@@ -116,7 +116,7 @@ in
         type = lib.types.path;
         description = "Optionally pass master.cfg path. Other options in this configuration will be ignored.";
         default = defaultMasterCfg;
-        defaultText = lib.literalMD ''generated configuration file'';
+        defaultText = lib.literalMD "generated configuration file";
         example = "/etc/nixos/buildbot/master.cfg";
       };
 

nixos/modules/services/continuous-integration/gitlab-runner/runner.nix

@@ -728,7 +728,7 @@ in
         mapAttrsToList
           (
             name: serviceConfig:
-            ''`services.gitlab-runner.services.${name}.protected` with runner authentication tokens has no effect and will be ignored. Please remove it from your configuration.''
+            "`services.gitlab-runner.services.${name}.protected` with runner authentication tokens has no effect and will be ignored. Please remove it from your configuration."
           )
           (
             filterAttrs (
@@ -740,7 +740,7 @@ in
         mapAttrsToList
           (
             name: serviceConfig:
-            ''`services.gitlab-runner.services.${name}.runUntagged` with runner authentication tokens has no effect and will be ignored. Please remove it from your configuration.''
+            "`services.gitlab-runner.services.${name}.runUntagged` with runner authentication tokens has no effect and will be ignored. Please remove it from your configuration."
           )
           (
             filterAttrs (
@@ -752,7 +752,7 @@ in
         mapAttrsToList
           (
             name: v:
-            ''`services.gitlab-runner.services.${name}.maximumTimeout` with runner authentication tokens has no effect and will be ignored. Please remove it from your configuration.''
+            "`services.gitlab-runner.services.${name}.maximumTimeout` with runner authentication tokens has no effect and will be ignored. Please remove it from your configuration."
           )
           (
             filterAttrs (
@@ -764,7 +764,7 @@ in
         mapAttrsToList
           (
             name: v:
-            ''`services.gitlab-runner.services.${name}.tagList` with runner authentication tokens has no effect and will be ignored. Please remove it from your configuration.''
+            "`services.gitlab-runner.services.${name}.tagList` with runner authentication tokens has no effect and will be ignored. Please remove it from your configuration."
           )
           (
             filterAttrs (

nixos/modules/services/continuous-integration/gocd-agent/default.nix

@@ -191,7 +191,7 @@ in
         // {
           NIX_REMOTE = "daemon";
           AGENT_WORK_DIR = cfg.workDir;
-          AGENT_STARTUP_ARGS = ''${lib.concatStringsSep " " cfg.startupOptions}'';
+          AGENT_STARTUP_ARGS = "${lib.concatStringsSep " " cfg.startupOptions}";
           LOG_DIR = cfg.workDir;
           LOG_FILE = "${cfg.workDir}/go-agent-start.log";
         }

nixos/modules/services/databases/couchdb.nix

@@ -205,10 +205,10 @@ in
       '';
 
       environment = {
-        ERL_FLAGS = ''-couch_ini ${lib.concatStringsSep " " configFiles}'';
+        ERL_FLAGS = "-couch_ini ${lib.concatStringsSep " " configFiles}";
         # 5. the vm.args file
-        COUCHDB_ARGS_FILE = ''${cfg.argsFile}'';
-        HOME = ''${cfg.databaseDir}'';
+        COUCHDB_ARGS_FILE = "${cfg.argsFile}";
+        HOME = "${cfg.databaseDir}";
       };
 
       serviceConfig = {

nixos/modules/services/databases/influxdb2.nix

@@ -312,7 +312,7 @@ in
 
       settings = mkOption {
         default = { };
-        description = ''configuration options for influxdb2, see <https://docs.influxdata.com/influxdb/v2.0/reference/config-options> for details.'';
+        description = "configuration options for influxdb2, see <https://docs.influxdata.com/influxdb/v2.0/reference/config-options> for details.";
         type = format.type;
       };
 

nixos/modules/services/desktop-managers/gnome.nix

@@ -390,6 +390,10 @@ in
       systemd.packages = [
         pkgs.gnome-session
         pkgs.gnome-shell
+      ]
+      ++ removeExcluded [
+        pkgs.xdg-user-dirs # Update user dirs as described in https://freedesktop.org/wiki/Software/xdg-user-dirs/
+        pkgs.xdg-user-dirs-gtk # Used to create the default bookmarks
       ];
 
       services.udev.packages = [

nixos/modules/services/development/athens.nix

@@ -272,7 +272,7 @@ in
 
     filterFile = lib.mkOption {
       type = lib.types.nullOr lib.types.path;
-      description = ''Filename for the include exclude filter.'';
+      description = "Filename for the include exclude filter.";
       default = null;
       example = lib.literalExpression ''
         pkgs.writeText "filterFile" '''
@@ -285,7 +285,7 @@ in
 
     robotsFile = lib.mkOption {
       type = lib.types.nullOr lib.types.path;
-      description = ''Provides /robots.txt for net crawlers.'';
+      description = "Provides /robots.txt for net crawlers.";
       default = null;
       example = lib.literalExpression ''pkgs.writeText "robots.txt" "# my custom robots.txt ..."'';
     };
@@ -956,7 +956,7 @@ in
       serviceConfig = {
         Restart = "on-abnormal";
         Nice = 5;
-        ExecStart = ''${cfg.package}/bin/athens -config_file=${configFile}'';
+        ExecStart = "${cfg.package}/bin/athens -config_file=${configFile}";
 
         KillMode = "mixed";
         KillSignal = "SIGINT";

nixos/modules/services/games/freeciv.nix

@@ -47,7 +47,7 @@ in
 {
   options = {
     services.freeciv = {
-      enable = lib.mkEnableOption ''freeciv'';
+      enable = lib.mkEnableOption "freeciv";
       settings = lib.mkOption {
         description = ''
           Parameters of freeciv-server.

nixos/modules/services/hardware/actkbd.nix

@@ -17,9 +17,9 @@ let
         command,
         ...
       }:
-      ''${
+      "${
         lib.concatMapStringsSep "+" toString keys
-      }:${lib.concatStringsSep "," events}:${lib.concatStringsSep "," attributes}:${command}''
+      }:${lib.concatStringsSep "," events}:${lib.concatStringsSep "," attributes}:${command}"
     ) cfg.bindings}
     ${cfg.extraConfig}
   '';

nixos/modules/services/hardware/amdgpu.nix

@@ -23,7 +23,7 @@ in
     '';
 
     overdrive = {
-      enable = lib.mkEnableOption ''`amdgpu` overdrive mode for overclocking'';
+      enable = lib.mkEnableOption "`amdgpu` overdrive mode for overclocking";
 
       ppfeaturemask = lib.mkOption {
         type = lib.types.str;
@@ -39,7 +39,7 @@ in
       };
     };
 
-    opencl.enable = lib.mkEnableOption ''OpenCL support using ROCM runtime library'';
+    opencl.enable = lib.mkEnableOption "OpenCL support using ROCM runtime library";
   };
 
   config = {

nixos/modules/services/hardware/keyd.nix

@@ -65,10 +65,10 @@ in
 {
   imports = [
     (lib.mkRemovedOptionModule [ "services" "keyd" "ids" ]
-      ''Use keyboards.<filename>.ids instead. If you don't need a multi-file configuration, just add keyboards.default before the ids. See https://github.com/NixOS/nixpkgs/pull/243271.''
+      "Use keyboards.<filename>.ids instead. If you don't need a multi-file configuration, just add keyboards.default before the ids. See https://github.com/NixOS/nixpkgs/pull/243271."
     )
     (lib.mkRemovedOptionModule [ "services" "keyd" "settings" ]
-      ''Use keyboards.<filename>.settings instead. If you don't need a multi-file configuration, just add keyboards.default before the settings. See https://github.com/NixOS/nixpkgs/pull/243271.''
+      "Use keyboards.<filename>.settings instead. If you don't need a multi-file configuration, just add keyboards.default before the settings. See https://github.com/NixOS/nixpkgs/pull/243271."
     )
   ];
 

nixos/modules/services/hardware/nvidia-container-toolkit/default.nix

@@ -198,7 +198,7 @@
           assertion =
             ((builtins.length config.hardware.nvidia-container-toolkit.csv-files) > 0)
             -> config.hardware.nvidia-container-toolkit.discovery-mode == "csv";
-          message = ''When CSV files are provided, `config.hardware.nvidia-container-toolkit.discovery-mode` has to be set to `csv`.'';
+          message = "When CSV files are provided, `config.hardware.nvidia-container-toolkit.discovery-mode` has to be set to `csv`.";
         }
       ];
 

nixos/modules/services/hardware/triggerhappy.nix

@@ -18,7 +18,7 @@ let
         cmd,
         ...
       }:
-      ''${lib.concatMapStringsSep "+" (x: "KEY_" + x) keys} ${
+      "${lib.concatMapStringsSep "+" (x: "KEY_" + x) keys} ${
         toString
           {
             press = 1;
@@ -26,7 +26,7 @@ let
             release = 0;
           }
           .${event}
-      } ${cmd}''
+      } ${cmd}"
     ) cfg.bindings}
     ${cfg.extraConfig}
   '';

nixos/modules/services/mail/dovecot.nix

@@ -134,7 +134,7 @@ let
           ssl_cert = <${cfg.sslServerCert}
           ssl_key = <${cfg.sslServerKey}
           ${optionalString (cfg.sslCACert != null) ("ssl_ca = <" + cfg.sslCACert)}
-          ${optionalString cfg.enableDHE ''ssl_dh = <${config.security.dhparams.params.dovecot2.path}''}
+          ${optionalString cfg.enableDHE "ssl_dh = <${config.security.dhparams.params.dovecot2.path}"}
           disable_plaintext_auth = yes
         ''
     )

nixos/modules/services/mail/maddy.nix

@@ -176,7 +176,7 @@ in
       hostname = lib.mkOption {
         default = "localhost";
         type = with lib.types; uniq str;
-        example = ''example.com'';
+        example = "example.com";
         description = ''
           Hostname to use. It should be FQDN.
         '';
@@ -185,7 +185,7 @@ in
       primaryDomain = lib.mkOption {
         default = "localhost";
         type = with lib.types; uniq str;
-        example = ''mail.example.com'';
+        example = "mail.example.com";
         description = ''
           Primary MX domain to use. It should be FQDN.
         '';

nixos/modules/services/mail/postgrey.nix

@@ -202,9 +202,9 @@ in
           if cfg.socket ? path then
             "--unix=${cfg.socket.path} --socketmode=${cfg.socket.mode}"
           else
-            ''--inet=${
+            "--inet=${
               optionalString (cfg.socket.addr != null) (cfg.socket.addr + ":")
-            }${toString cfg.socket.port}'';
+            }${toString cfg.socket.port}";
       in
       {
         description = "Postfix Greylisting Service";

nixos/modules/services/matrix/mjolnir.nix

@@ -223,7 +223,7 @@ in
       wantedBy = [ "multi-user.target" ];
 
       serviceConfig = {
-        ExecStart = ''${pkgs.mjolnir}/bin/mjolnir --mjolnir-config ./config/default.yaml'';
+        ExecStart = "${pkgs.mjolnir}/bin/mjolnir --mjolnir-config ./config/default.yaml";
         ExecStartPre = [ generateConfig ];
         WorkingDirectory = cfg.dataPath;
         StateDirectory = "mjolnir";

nixos/modules/services/matrix/pantalaimon.nix

@@ -40,7 +40,7 @@ let
       wantedBy = [ "multi-user.target" ];
 
       serviceConfig = {
-        ExecStart = ''${pkgs.pantalaimon-headless}/bin/pantalaimon --config ${mkConfigFile name instanceConfig} --data-path ${instanceConfig.dataPath}'';
+        ExecStart = "${pkgs.pantalaimon-headless}/bin/pantalaimon --config ${mkConfigFile name instanceConfig} --data-path ${instanceConfig.dataPath}";
         Restart = "on-failure";
         DynamicUser = true;
         NoNewPrivileges = true;

nixos/modules/services/matrix/synapse-auto-compressor.nix

@@ -37,9 +37,9 @@ in
             args = synapseConfig.settings.database.args;
           in
           if synapseConfig.enable then
-            ''postgresql://${args.user}${lib.optionalString (args ? password) (":" + args.password)}@${
+            "postgresql://${args.user}${lib.optionalString (args ? password) (":" + args.password)}@${
               lib.escapeURL (if (args ? host) then args.host else "/run/postgresql")
-            }${lib.optionalString (args ? port) (":" + args.port)}/${args.database}''
+            }${lib.optionalString (args ? port) (":" + args.port)}/${args.database}"
           else
             null;
         defaultText = lib.literalExpression ''

nixos/modules/services/misc/anki-sync-server.nix

@@ -31,7 +31,7 @@ let
     # export passwords in environment variables in plaintext.
     ${concatMapStringsSep "\n" (
       x:
-      ''export SYNC_USER${toString x.i}=${escapeShellArg x.user.username}:${escapeShellArg x.user.password}''
+      "export SYNC_USER${toString x.i}=${escapeShellArg x.user.username}:${escapeShellArg x.user.password}"
     ) usersWithIndexesNoFile}
     exec ${lib.getExe cfg.package}
   '';

nixos/modules/services/misc/apache-kafka.nix

@@ -166,15 +166,15 @@ in
   imports = [
     (lib.mkRenamedOptionModule
       [ "services" "apache-kafka" "brokerId" ]
-      [ "services" "apache-kafka" "settings" ''broker.id'' ]
+      [ "services" "apache-kafka" "settings" "broker.id" ]
     )
     (lib.mkRenamedOptionModule
       [ "services" "apache-kafka" "logDirs" ]
-      [ "services" "apache-kafka" "settings" ''log.dirs'' ]
+      [ "services" "apache-kafka" "settings" "log.dirs" ]
     )
     (lib.mkRenamedOptionModule
       [ "services" "apache-kafka" "zookeeper" ]
-      [ "services" "apache-kafka" "settings" ''zookeeper.connect'' ]
+      [ "services" "apache-kafka" "settings" "zookeeper.connect" ]
     )
 
     (lib.mkRemovedOptionModule [

nixos/modules/services/misc/autosuspend.nix

@@ -136,7 +136,7 @@ in
               '';
             };
             wakeup_cmd = mkOption {
-              default = ''sh -c 'echo 0 > /sys/class/rtc/rtc0/wakealarm && echo {timestamp:.0f} > /sys/class/rtc/rtc0/wakealarm' '';
+              default = "sh -c 'echo 0 > /sys/class/rtc/rtc0/wakealarm && echo {timestamp:.0f} > /sys/class/rtc/rtc0/wakealarm' ";
               type = with types; str;
               description = ''
                 The command to execute for scheduling a wake up of the system. The given string is
@@ -232,7 +232,7 @@ in
       after = [ "network.target" ];
       path = flatten (attrValues (filterAttrs (n: _: hasCheck n) dependenciesForChecks));
       serviceConfig = {
-        ExecStart = ''${autosuspend}/bin/autosuspend -l ${autosuspend}/etc/autosuspend-logging.conf -c ${autosuspend-conf} daemon'';
+        ExecStart = "${autosuspend}/bin/autosuspend -l ${autosuspend}/etc/autosuspend-logging.conf -c ${autosuspend-conf} daemon";
       };
     };
 
@@ -242,7 +242,7 @@ in
       wantedBy = [ "sleep.target" ];
       after = [ "sleep.target" ];
       serviceConfig = {
-        ExecStart = ''${autosuspend}/bin/autosuspend -l ${autosuspend}/etc/autosuspend-logging.conf -c ${autosuspend-conf} presuspend'';
+        ExecStart = "${autosuspend}/bin/autosuspend -l ${autosuspend}/etc/autosuspend-logging.conf -c ${autosuspend-conf} presuspend";
       };
     };
   };

nixos/modules/services/misc/evdevremapkeys.nix

@@ -11,7 +11,7 @@ let
 in
 {
   options.services.evdevremapkeys = {
-    enable = lib.mkEnableOption ''evdevremapkeys, a daemon to remap events on linux input devices'';
+    enable = lib.mkEnableOption "evdevremapkeys, a daemon to remap events on linux input devices";
 
     settings = lib.mkOption {
       type = format.type;

nixos/modules/services/misc/jellyseerr.nix

@@ -11,19 +11,19 @@ in
   meta.maintainers = [ lib.maintainers.camillemndn ];
 
   options.services.jellyseerr = {
-    enable = lib.mkEnableOption ''Jellyseerr, a requests manager for Jellyfin'';
+    enable = lib.mkEnableOption "Jellyseerr, a requests manager for Jellyfin";
     package = lib.mkPackageOption pkgs "jellyseerr" { };
 
     openFirewall = lib.mkOption {
       type = lib.types.bool;
       default = false;
-      description = ''Open port in the firewall for the Jellyseerr web interface.'';
+      description = "Open port in the firewall for the Jellyseerr web interface.";
     };
 
     port = lib.mkOption {
       type = lib.types.port;
       default = 5055;
-      description = ''The port which the Jellyseerr web UI should listen to.'';
+      description = "The port which the Jellyseerr web UI should listen to.";
     };
 
     configDir = lib.mkOption {

nixos/modules/services/misc/nix-gc.nix

@@ -79,7 +79,7 @@ in
     assertions = [
       {
         assertion = cfg.automatic -> config.nix.enable;
-        message = ''nix.gc.automatic requires nix.enable'';
+        message = "nix.gc.automatic requires nix.enable";
       }
     ];
 

nixos/modules/services/misc/nix-optimise.nix

@@ -58,7 +58,7 @@ in
     assertions = [
       {
         assertion = cfg.automatic -> config.nix.enable;
-        message = ''nix.optimise.automatic requires nix.enable'';
+        message = "nix.optimise.automatic requires nix.enable";
       }
     ];
 

nixos/modules/services/misc/synergy.nix

@@ -109,9 +109,9 @@ in
         description = "Synergy client";
         wantedBy = lib.optional cfgC.autoStart "graphical-session.target";
         path = [ pkgs.synergy ];
-        serviceConfig.ExecStart = ''${pkgs.synergy}/bin/synergyc -f ${
+        serviceConfig.ExecStart = "${pkgs.synergy}/bin/synergyc -f ${
           lib.optionalString (cfgC.screenName != "") "-n ${cfgC.screenName}"
-        } ${cfgC.serverAddress}'';
+        } ${cfgC.serverAddress}";
         serviceConfig.Restart = "on-failure";
       };
     })
@@ -124,13 +124,13 @@ in
         description = "Synergy server";
         wantedBy = lib.optional cfgS.autoStart "graphical-session.target";
         path = [ pkgs.synergy ];
-        serviceConfig.ExecStart = ''${pkgs.synergy}/bin/synergys -c ${cfgS.configFile} -f${
+        serviceConfig.ExecStart = "${pkgs.synergy}/bin/synergys -c ${cfgS.configFile} -f${
           lib.optionalString (cfgS.address != "") " -a ${cfgS.address}"
         }${
           lib.optionalString (cfgS.screenName != "") " -n ${cfgS.screenName}"
         }${lib.optionalString cfgS.tls.enable " --enable-crypto"}${
           lib.optionalString (cfgS.tls.cert != null) " --tls-cert ${cfgS.tls.cert}"
-        }'';
+        }";
         serviceConfig.Restart = "on-failure";
       };
     })

nixos/modules/services/misc/weechat.nix

@@ -48,7 +48,9 @@ in
     users = {
       groups.weechat = { };
       users.weechat = {
+        createHome = true;
         group = "weechat";
+        home = cfg.root;
         isSystemUser = true;
       };
     };

nixos/modules/services/monitoring/nagios.nix

@@ -93,7 +93,7 @@ in
 
   options = {
     services.nagios = {
-      enable = lib.mkEnableOption ''[Nagios](https://www.nagios.org/) to monitor your system or network'';
+      enable = lib.mkEnableOption "[Nagios](https://www.nagios.org/) to monitor your system or network";
 
       objectDefs = lib.mkOption {
         description = ''

nixos/modules/services/monitoring/prometheus/exporters/mysqld.nix

@@ -63,7 +63,7 @@ in
         "${pkgs.prometheus-mysqld-exporter}/bin/mysqld_exporter"
         "--web.listen-address=${cfg.listenAddress}:${toString cfg.port}"
         "--web.telemetry-path=${cfg.telemetryPath}"
-        (optionalString (cfg.configFile != null) ''--config.my-cnf=''${CREDENTIALS_DIRECTORY}/config'')
+        (optionalString (cfg.configFile != null) "--config.my-cnf=\${CREDENTIALS_DIRECTORY}/config")
         (escapeShellArgs cfg.extraFlags)
       ];
       RestrictAddressFamilies = [

nixos/modules/services/network-filesystems/openafs/client.nix

@@ -30,12 +30,12 @@ let
       sedExpr = '':x /^>\(${localCellsRegex}\) / { n; :y /^>/! { n; by }; bx }; p'';
       globalCommand =
         if cfg.cellServDB != { } then
-          ''sed -n -e ${lib.escapeShellArg sedExpr} ${cfg.globalCellServDBFile}''
+          "sed -n -e ${lib.escapeShellArg sedExpr} ${cfg.globalCellServDBFile}"
         else
-          ''cat ${cfg.globalCellServDBFile}'';
+          "cat ${cfg.globalCellServDBFile}";
     in
     pkgs.runCommand "CellServDB" { preferLocalBuild = true; } ''
-      ${lib.optionalString (cfg.globalCellServDBFile != null) ''${globalCommand} > $out''}
+      ${lib.optionalString (cfg.globalCellServDBFile != null) "${globalCommand} > $out"}
       cat ${clientServDB} >> $out
     '';
 

nixos/modules/services/networking/cloudflared.nix

@@ -395,7 +395,7 @@ in
         };
 
         environment = {
-          TUNNEL_ORIGIN_CERT = lib.mkIf (certFile != null) ''%d/cert.pem'';
+          TUNNEL_ORIGIN_CERT = lib.mkIf (certFile != null) "%d/cert.pem";
           TUNNEL_EDGE_IP_VERSION = tunnel.edgeIPVersion;
         };
       }

nixos/modules/services/networking/firezone/server.nix

@@ -110,12 +110,12 @@ let
     concatLines (
       forEach relevantSecrets (
         secret:
-        ''export ${secret}=$(< ${
+        "export ${secret}=$(< ${
           if cfg.settingsSecret.${secret} == null then
             "secrets/${secret}"
           else
             "\"$CREDENTIALS_DIRECTORY/${secret}\""
-        })''
+        })"
       )
     );
 

nixos/modules/services/networking/gns3-server.nix

@@ -31,7 +31,7 @@ in
           type = lib.types.nullOr lib.types.str;
           default = null;
           example = "gns3";
-          description = ''Username used to access the GNS3 Server.'';
+          description = "Username used to access the GNS3 Server.";
         };
 
         passwordFile = lib.mkOption {
@@ -68,7 +68,7 @@ in
         file = lib.mkOption {
           type = lib.types.nullOr lib.types.path;
           default = "/var/log/gns3/server.log";
-          description = ''Path of the file GNS3 Server should log to.'';
+          description = "Path of the file GNS3 Server should log to.";
         };
 
         debug = lib.mkEnableOption "debug logging";
@@ -96,17 +96,17 @@ in
       };
 
       dynamips = {
-        enable = lib.mkEnableOption ''Dynamips support'';
+        enable = lib.mkEnableOption "Dynamips support";
         package = lib.mkPackageOption pkgs "dynamips" { };
       };
 
       ubridge = {
-        enable = lib.mkEnableOption ''uBridge support'';
+        enable = lib.mkEnableOption "uBridge support";
         package = lib.mkPackageOption pkgs "ubridge" { };
       };
 
       vpcs = {
-        enable = lib.mkEnableOption ''VPCS support'';
+        enable = lib.mkEnableOption "VPCS support";
         package = lib.mkPackageOption pkgs "vpcs" { };
       };
     };

nixos/modules/services/networking/go-autoconfig.nix

@@ -56,7 +56,7 @@ in
         serviceConfig = {
           ExecStart = "${pkgs.go-autoconfig}/bin/go-autoconfig -config ${configFile}";
           Restart = "on-failure";
-          WorkingDirectory = ''${pkgs.go-autoconfig}/'';
+          WorkingDirectory = "${pkgs.go-autoconfig}/";
           DynamicUser = true;
         };
       };

nixos/modules/services/networking/hostapd.nix

@@ -1363,13 +1363,13 @@ in
           # see https://github.com/openwrt/openwrt/blob/539cb5389d9514c99ec1f87bd4465f77c7ed9b93/package/kernel/mac80211/files/lib/netifd/wireless/mac80211.sh#L158
           {
             assertion = length (filter (bss: bss == radio) (attrNames radioCfg.networks)) == 1;
-            message = ''hostapd radio ${radio}: Exactly one network must be named like the radio, for reasons internal to hostapd.'';
+            message = "hostapd radio ${radio}: Exactly one network must be named like the radio, for reasons internal to hostapd.";
           }
           {
             assertion =
               (radioCfg.wifi4.enable && builtins.elem "HT40-" radioCfg.wifi4.capabilities)
               -> radioCfg.channel != 0;
-            message = ''hostapd radio ${radio}: using ACS (channel = 0) together with HT40- (wifi4.capabilities) is unsupported by hostapd'';
+            message = "hostapd radio ${radio}: using ACS (channel = 0) together with HT40- (wifi4.capabilities) is unsupported by hostapd";
           }
         ]
         # BSS warnings
@@ -1391,42 +1391,42 @@ in
               }
               {
                 assertion = (length (attrNames radioCfg.networks) > 1) -> (bssCfg.bssid != null);
-                message = ''hostapd radio ${radio} bss ${bss}: bssid must be specified manually (for now) since this radio uses multiple BSS.'';
+                message = "hostapd radio ${radio} bss ${bss}: bssid must be specified manually (for now) since this radio uses multiple BSS.";
               }
               {
                 assertion = countWpaPasswordDefinitions <= 1;
-                message = ''hostapd radio ${radio} bss ${bss}: must use at most one WPA password option (wpaPassword, wpaPasswordFile, wpaPskFile)'';
+                message = "hostapd radio ${radio} bss ${bss}: must use at most one WPA password option (wpaPassword, wpaPasswordFile, wpaPskFile)";
               }
               {
                 assertion =
                   auth.wpaPassword != null
                   -> (stringLength auth.wpaPassword >= 8 && stringLength auth.wpaPassword <= 63);
-                message = ''hostapd radio ${radio} bss ${bss}: uses a wpaPassword of invalid length (must be in [8,63]).'';
+                message = "hostapd radio ${radio} bss ${bss}: uses a wpaPassword of invalid length (must be in [8,63]).";
               }
               {
                 assertion = auth.saePasswords == [ ] || auth.saePasswordsFile == null;
-                message = ''hostapd radio ${radio} bss ${bss}: must use only one SAE password option (saePasswords or saePasswordsFile)'';
+                message = "hostapd radio ${radio} bss ${bss}: must use only one SAE password option (saePasswords or saePasswordsFile)";
               }
               {
                 assertion = auth.mode == "wpa3-sae" -> (auth.saePasswords != [ ] || auth.saePasswordsFile != null);
-                message = ''hostapd radio ${radio} bss ${bss}: uses WPA3-SAE which requires defining a sae password option'';
+                message = "hostapd radio ${radio} bss ${bss}: uses WPA3-SAE which requires defining a sae password option";
               }
               {
                 assertion =
                   auth.mode == "wpa3-sae-transition"
                   -> (auth.saePasswords != [ ] || auth.saePasswordsFile != null) && countWpaPasswordDefinitions == 1;
-                message = ''hostapd radio ${radio} bss ${bss}: uses WPA3-SAE in transition mode requires defining both a wpa password option and a sae password option'';
+                message = "hostapd radio ${radio} bss ${bss}: uses WPA3-SAE in transition mode requires defining both a wpa password option and a sae password option";
               }
               {
                 assertion =
                   (auth.mode == "wpa2-sha1" || auth.mode == "wpa2-sha256") -> countWpaPasswordDefinitions == 1;
-                message = ''hostapd radio ${radio} bss ${bss}: uses WPA2-PSK which requires defining a wpa password option'';
+                message = "hostapd radio ${radio} bss ${bss}: uses WPA2-PSK which requires defining a wpa password option";
               }
             ]
             ++ optionals (auth.saePasswords != [ ]) (
               imap1 (i: entry: {
                 assertion = (entry.password == null) != (entry.passwordFile == null);
-                message = ''hostapd radio ${radio} bss ${bss} saePassword entry ${i}: must set exactly one of `password` or `passwordFile`'';
+                message = "hostapd radio ${radio} bss ${bss} saePassword entry ${i}: must set exactly one of `password` or `passwordFile`";
               }) auth.saePasswords
             )
           ) radioCfg.networks

nixos/modules/services/networking/inadyn.nix

@@ -221,7 +221,7 @@ in
         startAt = cfg.interval;
         serviceConfig = {
           Type = "oneshot";
-          ExecStart = ''${lib.getExe pkgs.inadyn} -f ${configFile} --cache-dir ''${CACHE_DIRECTORY} -1 --foreground -l ${cfg.logLevel}'';
+          ExecStart = "${lib.getExe pkgs.inadyn} -f ${configFile} --cache-dir \${CACHE_DIRECTORY} -1 --foreground -l ${cfg.logLevel}";
           LoadCredential = "config:${configFile}";
           CacheDirectory = "inadyn";
 

nixos/modules/services/networking/netbird.nix

@@ -301,7 +301,7 @@ in
               ui.enable = mkOption {
                 type = bool;
                 default = nixosConfig.services.netbird.ui.enable;
-                defaultText = literalExpression ''client.ui.enable'';
+                defaultText = literalExpression "client.ui.enable";
                 description = ''
                   Controls presence of `netbird-ui` wrapper for this NetBird client.
                 '';

nixos/modules/services/networking/nsd.nix

@@ -148,7 +148,7 @@ let
   '';
 
   maybeString = prefix: x: optionalString (x != null) ''${prefix} "${x}"'';
-  maybeToString = prefix: x: optionalString (x != null) ''${prefix} ${toString x}'';
+  maybeToString = prefix: x: optionalString (x != null) "${prefix} ${toString x}";
   forEach = pre: l: concatMapStrings (x: pre + x + "\n") l;
 
   keyConfigFile = concatStrings (

nixos/modules/services/networking/pangolin.nix

@@ -554,7 +554,6 @@ in
 
   meta.maintainers = with lib.maintainers; [
     jackr
-    sigmasquadron
     water-sucks
   ];
 }

nixos/modules/services/networking/robustirc-bridge.nix

@@ -18,7 +18,7 @@ in
       extraFlags = mkOption {
         type = types.listOf types.str;
         default = [ ];
-        description = ''Extra flags passed to the {command}`robustirc-bridge` command. See [RobustIRC Documentation](https://robustirc.net/docs/adminguide.html#_bridge) or {manpage}`robustirc-bridge(1)` for details.'';
+        description = "Extra flags passed to the {command}`robustirc-bridge` command. See [RobustIRC Documentation](https://robustirc.net/docs/adminguide.html#_bridge) or {manpage}`robustirc-bridge(1)` for details.";
         example = [
           "-network robustirc.net"
         ];

nixos/modules/services/networking/ssh/sshd.nix

@@ -826,13 +826,13 @@ in
             "Banner ${if cfg.banner == null then "none" else pkgs.writeText "ssh_banner" cfg.banner}"
             "AddressFamily ${if config.networking.enableIPv6 then "any" else "inet"}"
           ]
-          ++ lib.map (port: ''Port ${toString port}'') cfg.ports
+          ++ lib.map (port: "Port ${toString port}") cfg.ports
           ++ lib.map (
             { port, addr, ... }:
-            ''ListenAddress ${addr}${lib.optionalString (port != null) (":" + toString port)}''
+            "ListenAddress ${addr}${lib.optionalString (port != null) (":" + toString port)}"
           ) cfg.listenAddresses
           ++ lib.optional cfgc.setXAuthLocation "XAuthLocation ${lib.getExe pkgs.xorg.xauth}"
-          ++ lib.optional cfg.allowSFTP ''Subsystem sftp ${cfg.sftpServerExecutable} ${lib.concatStringsSep " " cfg.sftpFlags}''
+          ++ lib.optional cfg.allowSFTP "Subsystem sftp ${cfg.sftpServerExecutable} ${lib.concatStringsSep " " cfg.sftpFlags}"
           ++ [
             "AuthorizedKeysFile ${toString cfg.authorizedKeysFiles}"
           ]
@@ -901,7 +901,7 @@ in
           in
           {
             assertion = lib.length duplicates == 0;
-            message = ''Duplicate sshd config key; does your capitalization match the option's? Duplicate keys: ${formattedDuplicates}'';
+            message = "Duplicate sshd config key; does your capitalization match the option's? Duplicate keys: ${formattedDuplicates}";
           }
         )
       ]

nixos/modules/services/printing/cups-pdf.nix

@@ -90,7 +90,7 @@ let
       type = with lib.types; nullOr path;
       default = lib.getExe pkgs.ghostscript;
       defaultText = lib.literalExpression "lib.getExe pkgs.ghostscript";
-      example = lib.literalExpression ''''${pkgs.ghostscript}/bin/ps2pdf'';
+      example = lib.literalExpression "\${pkgs.ghostscript}/bin/ps2pdf";
       description = "location of GhostScript binary";
     };
   };

nixos/modules/services/search/manticore.nix

@@ -26,7 +26,7 @@ let
           ${sectName} {
         ''
         + lib.generators.toKeyValue { inherit mkKeyValue listsAsDuplicateKeys; } sectValues
-        + ''}'';
+        + "}";
     in
     # map input to ini sections
     mapAttrsToStringsSep "\n" mkSection attrsOfAttrs;

nixos/modules/services/security/crowdsec-firewall-bouncer.nix

@@ -45,7 +45,7 @@ in
             instead.
           '';
           default = config.services.crowdsec.enable;
-          defaultText = lib.literalExpression ''config.services.crowdsec.enable'';
+          defaultText = lib.literalExpression "config.services.crowdsec.enable";
         };
         bouncerName = mkOption {
           type = types.nonEmptyStr;

nixos/modules/services/security/fail2ban.nix

@@ -442,7 +442,7 @@ in
           // {
             # Miscellaneous options
             inherit (cfg) banaction maxretry bantime;
-            ignoreip = ''127.0.0.1/8 ${lib.optionalString config.networking.enableIPv6 "::1"} ${lib.concatStringsSep " " cfg.ignoreIP}'';
+            ignoreip = "127.0.0.1/8 ${lib.optionalString config.networking.enableIPv6 "::1"} ${lib.concatStringsSep " " cfg.ignoreIP}";
             backend = "systemd";
             # Actions
             banaction_allports = cfg.banaction-allports;

nixos/modules/services/torrent/cross-seed.nix

@@ -107,7 +107,7 @@ in
           outputDir = mkOption {
             type = types.path;
             default = "${cfg.configDir}/output";
-            defaultText = ''''${cfg.configDir}/output'';
+            defaultText = "\${cfg.configDir}/output";
             description = "Directory where cross-seed will place torrent files it finds.";
           };
 

nixos/modules/services/web-apps/bookstack.nix

@@ -300,7 +300,7 @@ in
             type = lib.types.str;
             default =
               if cfg.hostname == "localhost" then "http://${cfg.hostname}" else "https://${cfg.hostname}";
-            defaultText = ''http(s)://''${config.services.bookstack.hostname}'';
+            defaultText = "http(s)://\${config.services.bookstack.hostname}";
             description = ''
               The root URL that you want to host BookStack on. All URLs in BookStack
               will be generated using this value. It is used to validate specific

nixos/modules/services/web-apps/davis.nix

@@ -134,8 +134,8 @@ in
       );
       default = { };
 
-      example = '''';
-      description = '''';
+      example = "";
+      description = "";
     };
 
     adminLogin = lib.mkOption {

nixos/modules/services/web-apps/dokuwiki.nix

@@ -556,7 +556,7 @@ in
             "/" = {
               priority = 1;
               index = "doku.php";
-              extraConfig = ''try_files $uri $uri/ @dokuwiki;'';
+              extraConfig = "try_files $uri $uri/ @dokuwiki;";
             };
 
             "@dokuwiki" = {

nixos/modules/services/web-apps/freshrss.nix

@@ -359,10 +359,10 @@ in
             let
               isUserAuth = cfg.authType == "form" || cfg.authType == "none";
 
-              userScriptArgs = ''--user ${cfg.defaultUser} ${
+              userScriptArgs = "--user ${cfg.defaultUser} ${
                 optionalString (cfg.authType == "form") ''--password "$(cat ${cfg.passwordFile})"''
-              }'';
-              mkUserScript = name: optionalString isUserAuth ''./cli/${name}.php ${userScriptArgs}'';
+              }";
+              mkUserScript = name: optionalString isUserAuth "./cli/${name}.php ${userScriptArgs}";
 
               updateUserScript = mkUserScript "update-user";
               createUserScript = mkUserScript "create-user";

nixos/modules/services/web-apps/jitsi-meet.nix

@@ -217,7 +217,7 @@ in
     excalidraw.port = mkOption {
       type = types.port;
       default = 3002;
-      description = ''The port which the Excalidraw backend for Jitsi should listen to.'';
+      description = "The port which the Excalidraw backend for Jitsi should listen to.";
     };
 
     secureDomain = {
@@ -225,7 +225,7 @@ in
       authentication = mkOption {
         type = types.str;
         default = "internal_hashed";
-        description = ''The authentication type to be used by jitsi'';
+        description = "The authentication type to be used by jitsi";
       };
     };
   };

nixos/modules/services/web-apps/lanraragi.nix

@@ -88,7 +88,7 @@ in
         {
           redis_address => "127.0.0.1:${toString cfg.redis.port}",
           redis_password => "${
-            lib.optionalString (cfg.redis.passwordFile != null) ''$(head -n1 ${cfg.redis.passwordFile})''
+            lib.optionalString (cfg.redis.passwordFile != null) "$(head -n1 ${cfg.redis.passwordFile})"
           }",
           redis_database => "0",
           redis_database_minion => "1",

nixos/modules/services/web-apps/mattermost.nix

@@ -411,7 +411,7 @@ in
         path = mkOption {
           type = types.path;
           default = "${cfg.dataDir}/mattermost.sock";
-          defaultText = ''''${config.mattermost.dataDir}/mattermost.sock'';
+          defaultText = "\${config.mattermost.dataDir}/mattermost.sock";
           description = ''
             Default location for the Mattermost control socket used by `mmctl`.
           '';

nixos/modules/services/web-apps/mediawiki.nix

@@ -473,7 +473,7 @@ in
 
       nginx.hostName = mkOption {
         type = types.str;
-        example = literalExpression ''wiki.example.com'';
+        example = literalExpression "wiki.example.com";
         default = "localhost";
         description = ''
           The hostname to use for the nginx virtual host.

nixos/modules/services/web-apps/peertube-runner.nix

@@ -188,7 +188,7 @@ in
                 --runner-name ${lib.escapeShellArg instance.runnerName} \
                 ${lib.optionalString (
                   instance.runnerDescription != null
-                ) ''--runner-description ${lib.escapeShellArg instance.runnerDescription}''}
+                ) "--runner-description ${lib.escapeShellArg instance.runnerDescription}"}
 
               # Kill the server
               kill $!