From 6365d72c410411179b5e2362b9bb593ea150bda6 Mon Sep 17 00:00:00 2001 From: poz Date: Sun, 11 Jan 2026 18:09:38 +0100 Subject: [PATCH 01/50] linuxPackages.ddcci-driver: 0.4.5-unstable-{2024-09-26 -> 2025-09-27} --- pkgs/os-specific/linux/ddcci/default.nix | 15 +++------------ 1 file changed, 3 insertions(+), 12 deletions(-) diff --git a/pkgs/os-specific/linux/ddcci/default.nix b/pkgs/os-specific/linux/ddcci/default.nix index 9e0fbb6894bd..fbef48622ac2 100644 --- a/pkgs/os-specific/linux/ddcci/default.nix +++ b/pkgs/os-specific/linux/ddcci/default.nix @@ -4,29 +4,20 @@ fetchFromGitLab, kernel, kernelModuleMakeFlags, - fetchpatch, }: stdenv.mkDerivation rec { pname = "ddcci-driver"; - version = "0.4.5-unstable-2024-09-26"; + version = "0.4.5-unstable-2025-09-27"; name = "${pname}-${kernel.version}-${version}"; src = fetchFromGitLab { owner = "${pname}-linux"; repo = "${pname}-linux"; - rev = "0233e1ee5eddb4b8a706464f3097bad5620b65f4"; - hash = "sha256-Osvojt8UE+cenOuMoSY+T+sODTAAKkvY/XmBa5bQX88="; + rev = "bbb7553373f815d78e93a4a9f071ce968563694a"; + hash = "sha256-fQjsDjbtFKhs0bUCFfKRgCg516TXdwIkhKEbIISjgs0="; }; - patches = [ - # See https://gitlab.com/ddcci-driver-linux/ddcci-driver-linux/-/merge_requests/17 - (fetchpatch { - url = "https://gitlab.com/ddcci-driver-linux/ddcci-driver-linux/-/commit/e0605c9cdff7bf3fe9587434614473ba8b7e5f63.patch"; - hash = "sha256-sTq03HtWQBd7Wy4o1XbdmMjXQE2dG+1jajx4HtwBHjM="; - }) - ]; - hardeningDisable = [ "pic" ]; nativeBuildInputs = kernel.moduleBuildDependencies; From 0a46e5c308757e23938f3dd3e2c26c0bc0600873 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Sat, 7 Feb 2026 11:54:03 +0000 Subject: [PATCH 02/50] warzone2100: 4.6.2 -> 4.6.3 --- pkgs/by-name/wa/warzone2100/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/wa/warzone2100/package.nix b/pkgs/by-name/wa/warzone2100/package.nix index 707e9a4872d4..0a31a210f429 100644 --- a/pkgs/by-name/wa/warzone2100/package.nix +++ b/pkgs/by-name/wa/warzone2100/package.nix @@ -50,11 +50,11 @@ in stdenv.mkDerivation (finalAttrs: { inherit pname; - version = "4.6.2"; + version = "4.6.3"; src = fetchurl { url = "mirror://sourceforge/project/warzone2100/releases/${finalAttrs.version}/warzone2100_src.tar.xz"; - hash = "sha256-hWIW2r6vLgOuj351jDlbJ9IYif6LX+RfOvznAP3n1x8="; + hash = "sha256-Qx/iQ2z/loeOLtTtxtBzlFOtYpPWQwtYMt6bUi/wsTo="; }; buildInputs = [ From 65ba7e7fc2c59a0cac1496165de6a0fc353e51e9 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Sat, 7 Feb 2026 17:42:59 +0000 Subject: [PATCH 03/50] subtitleedit: 4.0.14 -> 4.0.15 --- pkgs/by-name/su/subtitleedit/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/su/subtitleedit/package.nix b/pkgs/by-name/su/subtitleedit/package.nix index edf6f747cf73..316252bfe2af 100644 --- a/pkgs/by-name/su/subtitleedit/package.nix +++ b/pkgs/by-name/su/subtitleedit/package.nix @@ -19,13 +19,13 @@ stdenv.mkDerivation rec { pname = "subtitleedit"; - version = "4.0.14"; + version = "4.0.15"; src = fetchzip { url = "https://github.com/SubtitleEdit/subtitleedit/releases/download/${version}/SE${ lib.replaceStrings [ "." ] [ "" ] version }.zip"; - hash = "sha256-vaANk5xK8a3SQf5Qacxv3wj3HHtro5LLxZviaIKYkdI="; + hash = "sha256-MI74IN0idWSF5TrNodhj2t4GW39VyyDNl2eDEuvfEl0="; stripRoot = false; }; From 6023b79d1504fecb24a0f83b7324870bbf6f4d8b Mon Sep 17 00:00:00 2001 From: lordkekz Date: Sat, 7 Feb 2026 18:57:42 +0100 Subject: [PATCH 04/50] lucide: 0.544.0 -> 0.563.0 --- pkgs/by-name/lu/lucide/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/lu/lucide/package.nix b/pkgs/by-name/lu/lucide/package.nix index 635d4e5c08e2..a8baf2878bbf 100644 --- a/pkgs/by-name/lu/lucide/package.nix +++ b/pkgs/by-name/lu/lucide/package.nix @@ -1,10 +1,10 @@ { lib, fetchurl }: fetchurl rec { pname = "lucide"; - version = "0.544.0"; + version = "0.563.0"; url = "https://unpkg.com/lucide-static@${version}/font/Lucide.ttf"; - hash = "sha256-Cf4vv+f3ZUtXPED+PCHxvZZDMF5nWYa4iGFSDQtkquQ="; + hash = "sha256-dBE3gAmhffBsqZNp8rS4bzV8zIF538I1z/DRgk/oO2M="; downloadToTemp = true; recursiveHash = true; From 1a6cfe32e3170022864619a88a593b4162265e09 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Sat, 7 Feb 2026 18:00:19 +0000 Subject: [PATCH 05/50] collector: 0-unstable-2024-11-11 -> 0-unstable-2026-02-04 --- pkgs/by-name/co/collector/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/co/collector/package.nix b/pkgs/by-name/co/collector/package.nix index 27279ab40c8b..3c34cb813562 100644 --- a/pkgs/by-name/co/collector/package.nix +++ b/pkgs/by-name/co/collector/package.nix @@ -19,13 +19,13 @@ stdenv.mkDerivation (finalAttrs: { pname = "collector"; - version = "0-unstable-2024-11-11"; + version = "0-unstable-2026-02-04"; src = fetchFromGitHub { owner = "mijorus"; repo = "collector"; - rev = "54cf58e79066284e6c62fdabca2a4b444131ee09"; - hash = "sha256-V+FMpmI4vcqfBwgxnSxRm1RJ8If19yvSKAqrf+mI604="; + rev = "c5d0f547f6eb31f1f17490cf412d9bcaf7c30d43"; + hash = "sha256-ow228VINpSlIv1fVc/YqD7ZT84hNCOFFG0FAXQVDtRs="; }; nativeBuildInputs = [ From 1b2372f052e443b9d53b145a75e8720ca0ee4354 Mon Sep 17 00:00:00 2001 From: Jeremy Fleischman Date: Sat, 7 Feb 2026 13:53:32 -0800 Subject: [PATCH 06/50] pympress: remove workaround for pygobject < 3.51 This reverts 355ea90cdb8743a4b0925a1143db35d5b8364a15. As of 8d6735db2bb0cf27781006739384596bbe12dd8a, we now have a new enough version of pygobject3 that we can drop this workaround. --- .../issue-330-gprops-iter-actually-iterable.patch | 11 ----------- pkgs/by-name/py/pympress/package.nix | 7 ------- 2 files changed, 18 deletions(-) delete mode 100644 pkgs/by-name/py/pympress/issue-330-gprops-iter-actually-iterable.patch diff --git a/pkgs/by-name/py/pympress/issue-330-gprops-iter-actually-iterable.patch b/pkgs/by-name/py/pympress/issue-330-gprops-iter-actually-iterable.patch deleted file mode 100644 index 4449daeda189..000000000000 --- a/pkgs/by-name/py/pympress/issue-330-gprops-iter-actually-iterable.patch +++ /dev/null @@ -1,11 +0,0 @@ ---- i/pympress/builder.py -+++ w/pympress/builder.py -@@ -76,7 +76,7 @@ class Builder(Gtk.Builder): - Args: - a_widget (:class:`~GObject.Object`): an object built by the builder, usually a widget - """ -- for str_prop in (prop.name for prop in a_widget.props if prop.value_type == GObject.TYPE_STRING): -+ for str_prop in (prop.name for prop in list(a_widget.props) if prop.value_type == GObject.TYPE_STRING): - try: - str_val = getattr(a_widget.props, str_prop) - if str_val: diff --git a/pkgs/by-name/py/pympress/package.nix b/pkgs/by-name/py/pympress/package.nix index eb579444498a..321a03012a76 100644 --- a/pkgs/by-name/py/pympress/package.nix +++ b/pkgs/by-name/py/pympress/package.nix @@ -30,13 +30,6 @@ python3Packages.buildPythonApplication (finalAttrs: { babel ]; - patches = [ - # Workaround for a bug on Python >= 3.13+ and pygobject < 3.51. - # This can go away once nixpkgs is using pygobject >= 3.51. - # See for details. - ./issue-330-gprops-iter-actually-iterable.patch - ]; - dependencies = with python3Packages; [ From a456e4095d6203bf034573b82fa238d3229429f8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Micha=C5=82=20Chojnowski?= Date: Sat, 7 Feb 2026 10:54:37 +0100 Subject: [PATCH 07/50] vk-bootstrap: 0.7 -> 1.4.335 Motivation: the package is outdated by 3 years. Things done: 1. Bump the version (to match the current version of Vulkan headers in nixpkgs). 2. Update the catch2 dependency to catch2_3, following upstream. 3. Upstream uses FetchContent to fetch catch2 and glfw for testing. Patch CMakeLists.txt so that system packages are used instead. 4. Remove the [out, dev] split. It's pointless because this is a static library. 5. Enable checkPhase. Comment out a test which uses FetchContent. Fix CMAKE_PREFIX_PATH in one of the integration tests. --- .../0001-disable-fetch-content.patch | 14 +++++++ .../vk-bootstrap/0002-fix-install-tests.patch | 38 ++++++++++++++++++ pkgs/by-name/vk/vk-bootstrap/package.nix | 40 +++++++++---------- 3 files changed, 72 insertions(+), 20 deletions(-) create mode 100644 pkgs/by-name/vk/vk-bootstrap/0001-disable-fetch-content.patch create mode 100644 pkgs/by-name/vk/vk-bootstrap/0002-fix-install-tests.patch diff --git a/pkgs/by-name/vk/vk-bootstrap/0001-disable-fetch-content.patch b/pkgs/by-name/vk/vk-bootstrap/0001-disable-fetch-content.patch new file mode 100644 index 000000000000..803e0f449978 --- /dev/null +++ b/pkgs/by-name/vk/vk-bootstrap/0001-disable-fetch-content.patch @@ -0,0 +1,14 @@ +diff --git a/CMakeLists.txt b/CMakeLists.txt +index 7ec2d39..f52313d 100644 +--- a/CMakeLists.txt ++++ b/CMakeLists.txt +@@ -129,7 +128,8 @@ if(VK_BOOTSTRAP_TEST) + endif() + endif() + +- add_subdirectory(ext) ++ find_package(glfw3) ++ find_package(Catch2 3) + add_subdirectory(tests) + add_subdirectory(example) + endif () diff --git a/pkgs/by-name/vk/vk-bootstrap/0002-fix-install-tests.patch b/pkgs/by-name/vk/vk-bootstrap/0002-fix-install-tests.patch new file mode 100644 index 000000000000..a23bf2b783e2 --- /dev/null +++ b/pkgs/by-name/vk/vk-bootstrap/0002-fix-install-tests.patch @@ -0,0 +1,38 @@ +diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt +index 0b4f2e1..4dd1fe0 100644 +--- a/tests/CMakeLists.txt ++++ b/tests/CMakeLists.txt +@@ -58,14 +58,16 @@ list(APPEND CMAKE_MODULE_PATH ${Catch2_SOURCE_DIR}/extras) + include(Catch) + catch_discover_tests(vk-bootstrap-test) + +-# Test add_subdirectory support using fetch content vulkan headers +-add_test(NAME integration.add_subdirectory.fetch_content_vulkan_headers +- COMMAND ${CMAKE_CTEST_COMMAND} +- --build-and-test ${CMAKE_CURRENT_LIST_DIR}/integration +- ${CMAKE_CURRENT_BINARY_DIR}/add_subdirectory/fetch_content_vulkan_headers +- --build-generator ${CMAKE_GENERATOR} +- --build-options -DADD_SUBDIRECTORY_TESTING=ON -DVULKAN_HEADER_VERSION_GIT_TAG=${VK_BOOTSTRAP_SOURCE_HEADER_VERSION_GIT_TAG} +-) ++# Commented out for nixpkgs due to external dependencies. ++# ++# # Test add_subdirectory support using fetch content vulkan headers ++# add_test(NAME integration.add_subdirectory.fetch_content_vulkan_headers ++# COMMAND ${CMAKE_CTEST_COMMAND} ++# --build-and-test ${CMAKE_CURRENT_LIST_DIR}/integration ++# ${CMAKE_CURRENT_BINARY_DIR}/add_subdirectory/fetch_content_vulkan_headers ++# --build-generator ${CMAKE_GENERATOR} ++# --build-options -DADD_SUBDIRECTORY_TESTING=ON -DVULKAN_HEADER_VERSION_GIT_TAG=${VK_BOOTSTRAP_SOURCE_HEADER_VERSION_GIT_TAG} ++# ) + + get_target_property(vulkan_headers_include_dir Vulkan::Headers INTERFACE_INCLUDE_DIRECTORIES) + +@@ -105,7 +107,7 @@ if (VulkanHeaders_FOUND) + --build-and-test ${CMAKE_CURRENT_LIST_DIR}/integration + ${CMAKE_CURRENT_BINARY_DIR}/find_package/find_package_vulkan_headers + --build-generator ${CMAKE_GENERATOR} +- --build-options -DFIND_PACKAGE_TESTING=ON "-DCMAKE_PREFIX_PATH=${vulkan_headers_install_dir};${test_install_dir}" ++ --build-options -DFIND_PACKAGE_TESTING=ON "-DCMAKE_PREFIX_PATH=${vulkan_headers_install_dir};${test_install_dir};${CMAKE_INSTALL_PREFIX}" + ) + + set_tests_properties(integration.find_package.find_package_vulkan_headers PROPERTIES DEPENDS integration.install) diff --git a/pkgs/by-name/vk/vk-bootstrap/package.nix b/pkgs/by-name/vk/vk-bootstrap/package.nix index 64bbd45289cd..7952cc2c1063 100644 --- a/pkgs/by-name/vk/vk-bootstrap/package.nix +++ b/pkgs/by-name/vk/vk-bootstrap/package.nix @@ -5,40 +5,40 @@ cmake, vulkan-headers, glfw, - catch2, + catch2_3, }: stdenv.mkDerivation (finalAttrs: { pname = "vk-bootstrap"; - version = "0.7"; - outputs = [ - "out" - "dev" - ]; + version = "1.4.335"; src = fetchFromGitHub { owner = "charles-lunarg"; repo = "vk-bootstrap"; rev = "v${finalAttrs.version}"; - hash = "sha256-X3ANqfplrCF1R494+H5/plcwMH7rbW6zpLA4MZrYaoE="; + hash = "sha256-WFROoVAOl4HBNb/a8rx522Zz2LP4m2Zk03jckWxv7w0="; }; - postPatch = '' - # Upstream uses cmake FetchContent to resolve glfw and catch2 - # needed for examples and tests - sed -i 's=add_subdirectory(ext)==g' CMakeLists.txt - sed -i 's=Catch2==g' tests/CMakeLists.txt - ''; - - nativeBuildInputs = [ cmake ]; - buildInputs = [ - vulkan-headers - glfw - catch2 + patches = [ + ./0001-disable-fetch-content.patch + ./0002-fix-install-tests.patch ]; + nativeBuildInputs = [ cmake ]; + + buildInputs = [ + vulkan-headers + ]; + + checkInputs = [ + glfw + catch2_3 + ]; + + doCheck = true; + cmakeFlags = [ - "-DVK_BOOTSTRAP_VULKAN_HEADER_DIR=${vulkan-headers}/include" + "-DVK_BOOTSTRAP_INSTALL=1" ]; meta = { From 1b104d0427a0af0044a6446a34c07fdcc91d8c07 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Sun, 22 Feb 2026 12:23:21 +0000 Subject: [PATCH 08/50] python3Packages.tlsh: 4.12.1 -> 5.0.0 --- pkgs/development/python-modules/tlsh/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/python-modules/tlsh/default.nix b/pkgs/development/python-modules/tlsh/default.nix index 48ff6fc0fcaa..1c2c8aa8532a 100644 --- a/pkgs/development/python-modules/tlsh/default.nix +++ b/pkgs/development/python-modules/tlsh/default.nix @@ -8,14 +8,14 @@ buildPythonPackage rec { pname = "tlsh"; - version = "4.12.1"; + version = "5.0.0"; pyproject = true; src = fetchFromGitHub { owner = "trendmicro"; repo = "tlsh"; tag = version; - hash = "sha256-bR4598ZA7SDGInyxxjtBsttv+4XpZ+iqM7YAjlejdcU="; + hash = "sha256-cYvXZrd+8ZC5LfucguFFNlEX8FR+AkchmCFButYoiMg="; }; patches = [ From 0d111fbf08dbd2a481d6ab5f8141960e340cc903 Mon Sep 17 00:00:00 2001 From: Christopher Kaster Date: Thu, 6 Nov 2025 09:03:30 +0100 Subject: [PATCH 09/50] maintainers: add atomicptr --- maintainers/maintainer-list.nix | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix index 70b6c5dfd56a..8bb43fe63885 100644 --- a/maintainers/maintainer-list.nix +++ b/maintainers/maintainer-list.nix @@ -2567,6 +2567,14 @@ githubId = 706854; name = "Etienne Laurin"; }; + atomicptr = { + name = "Christopher Kaster"; + email = "me@atomicptr.de"; + github = "atomicptr"; + githubId = 674705; + matrix = "@atomicptr:matrix.org"; + keys = [ { fingerprint = "C461 E985 FBF3 4215 A43B 25D0 7930 ECC1 7FA0 A9FC"; } ]; + }; atry = { name = "Bo Yang"; email = "yang-bo@yang-bo.com"; From 87e650472cd042cc5560afd5ddc5e69cb0471cd1 Mon Sep 17 00:00:00 2001 From: Christopher Kaster Date: Mon, 23 Feb 2026 16:02:50 +0100 Subject: [PATCH 10/50] ols: 0-unstable-2025-11-02 -> dev-2026-02 --- pkgs/by-name/ol/ols/package.nix | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-) diff --git a/pkgs/by-name/ol/ols/package.nix b/pkgs/by-name/ol/ols/package.nix index 8588ba291228..4d5ea16bbc32 100644 --- a/pkgs/by-name/ol/ols/package.nix +++ b/pkgs/by-name/ol/ols/package.nix @@ -4,18 +4,17 @@ makeBinaryWrapper, odin, stdenv, - unstableGitUpdater, }: -stdenv.mkDerivation { +stdenv.mkDerivation (finalAttrs: { pname = "ols"; - version = "0-unstable-2025-11-06"; + version = "dev-2026-02"; src = fetchFromGitHub { owner = "DanielGavin"; repo = "ols"; - rev = "1bb943a0b5a4a418d880161d4801897b0e9af7f6"; - hash = "sha256-j19+DK83W9fq0r66hR7yz01CF3EJRCINKm2q8TFWdAM="; + tag = finalAttrs.version; + hash = "sha256-3UoVMQuUol7vfSM57mj644XZ1CKmTz7+VuDSETT9NSE="; }; postPatch = '' @@ -45,8 +44,6 @@ stdenv.mkDerivation { runHook postInstall ''; - passthru.updateScript = unstableGitUpdater { hardcodeZeroVersion = true; }; - meta = { inherit (odin.meta) platforms; description = "Language server for the Odin programming language"; @@ -54,7 +51,8 @@ stdenv.mkDerivation { license = lib.licenses.mit; maintainers = with lib.maintainers; [ astavie + atomicptr ]; mainProgram = "ols"; }; -} +}) From 8c7e3ab0b9be9872836c90cb39dd908c86850dea Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Thu, 26 Feb 2026 06:12:43 +0000 Subject: [PATCH 11/50] linuxPackages.nct6687d: 0-unstable-2026-01-16 -> 0-unstable-2026-02-19 --- pkgs/os-specific/linux/nct6687d/default.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/os-specific/linux/nct6687d/default.nix b/pkgs/os-specific/linux/nct6687d/default.nix index 5602e5dd68f9..d1886342bcd4 100644 --- a/pkgs/os-specific/linux/nct6687d/default.nix +++ b/pkgs/os-specific/linux/nct6687d/default.nix @@ -9,13 +9,13 @@ stdenv.mkDerivation { pname = "nct6687d"; - version = "0-unstable-2026-01-16"; + version = "0-unstable-2026-02-19"; src = fetchFromGitHub { owner = "Fred78290"; repo = "nct6687d"; - rev = "01351faf8baa05db57630bb0a7aa9fa30fd3023a"; - hash = "sha256-oUQApLJEP9Fvkb6Z6WnLk3VyMluM7OTLoKw/RvAXq0k="; + rev = "03037dea69293d77d19e60afb6ff720157cd4672"; + hash = "sha256-iJjnk891BXArXX0oGxP4F+h5Dlv0CkXkYvgMGy49tFY="; }; setSourceRoot = '' From d2fc6631210277dbefad39a2bf2e1d875a3c9c7d Mon Sep 17 00:00:00 2001 From: sund3RRR Date: Sat, 7 Feb 2026 22:28:45 +0300 Subject: [PATCH 12/50] amnezia-vpn: 4.8.11.4 -> 4.8.14.1 --- pkgs/by-name/am/amnezia-vpn/package.nix | 83 ++++++++---------------- pkgs/by-name/am/amnezia-vpn/xray-lib.nix | 38 +++++++++++ 2 files changed, 66 insertions(+), 55 deletions(-) create mode 100644 pkgs/by-name/am/amnezia-vpn/xray-lib.nix diff --git a/pkgs/by-name/am/amnezia-vpn/package.nix b/pkgs/by-name/am/amnezia-vpn/package.nix index 1adc4f6dca7d..4dd29a00faa8 100644 --- a/pkgs/by-name/am/amnezia-vpn/package.nix +++ b/pkgs/by-name/am/amnezia-vpn/package.nix @@ -21,55 +21,42 @@ xray, nix-update-script, bash, + callPackage, }: let - awg-vendored = amneziawg-go.overrideAttrs ( + amneziawg' = amneziawg-go.overrideAttrs ( finalAttrs: prevAttrs: { name = "amneziawg-go"; - version = "0.2.13"; + version = "0.2.16"; src = fetchFromGitHub { owner = "amnezia-vpn"; repo = "amneziawg-go"; tag = "v${finalAttrs.version}"; - hash = "sha256-vXSPUGBMP37kXJ4Zn5TDLAzG8N+yO/IIj9nSKrZ+sFA="; + hash = "sha256-JGmWMPVgereSZmdHUHC7ZqWCwUNfxfj3xBf/XDDHhpo="; }; - vendorHash = "sha256-9OtIb3UQXpAA0OzPhDIdb9lXZQHHiYCcmjHAU+vCtpk="; + vendorHash = "sha256-ZO8sLOaEY3bii9RSxzXDTCcwlsQEYmZDI+X1WPXbE9c="; } ); - amnezia-tun2socks = tun2socks.overrideAttrs ( + tun2socks' = tun2socks.overrideAttrs ( finalAttrs: prevAttrs: { - pname = "amnezia-tun2socks"; - version = "2.5.4"; + pname = "tun2socks"; + version = "2.5.2-c8f8cb5"; src = fetchFromGitHub { - owner = "amnezia-vpn"; - repo = "amnezia-tun2socks"; - tag = "v${finalAttrs.version}"; - hash = "sha256-lHo7WtcqccBSHly6neuksh1gC7RCKxbFNX9KSKNNeK8="; + owner = "xjasonlyu"; + repo = "tun2socks"; + rev = "c8f8cb5caf6796039a08d3ebad5354767795628b"; + hash = "sha256-VF8Mm323w0dwhXyFAJVi67BWepury59sVq1+DDzBjU8="; }; - vendorHash = "sha256-VvOaTJ6dBFlbGZGxnHy2sCtds1tyhu6VsPewYpsDBiM="; + vendorHash = "sha256-fHwr/Hnqufgi3D93GLxd5lqNetJswWvQ0+MqPq3QxV4="; } ); - amnezia-xray = xray.overrideAttrs ( - finalAttrs: prevAttrs: { - pname = "amnezia-xray"; - version = "1.8.15"; - - src = fetchFromGitHub { - owner = "amnezia-vpn"; - repo = "amnezia-xray-core"; - tag = "v${finalAttrs.version}"; - hash = "sha256-3ZGkfGxYl9/yE7Q2CsJkFJ6xSGybBdq3DztQ0f4VsnY="; - }; - - vendorHash = "sha256-AimQsuBRhgpTY5rW8WRejCkx4s9Q9n+OuTf4XCrgpnE="; - } - ); + amnezia-xray = callPackage ./xray-lib.nix { }; amneziaPremiumConfig = fetchurl { url = "https://raw.githubusercontent.com/amnezia-vpn/amnezia-client-lite/f45d6b242c1ac635208a72914e8df76ccb3aa44c/macos-signed-build.sh"; @@ -81,35 +68,34 @@ let in stdenv.mkDerivation (finalAttrs: { pname = "amnezia-vpn"; - version = "4.8.11.4"; + version = "4.8.14.1"; src = fetchFromGitHub { owner = "amnezia-vpn"; repo = "amnezia-client"; tag = finalAttrs.version; - hash = "sha256-LNzXYNhW1fbQhEkailqmX69MgPGJfJAu6KhGh5oSlJc="; + hash = "sha256-NZku10mU6Psl03lT4ITYhjWDkKH70RAw+axUuKe22j0="; fetchSubmodules = true; }; postPatch = '' substituteInPlace client/platforms/linux/daemon/wireguardutilslinux.cpp \ - --replace-fail 'm_tunnel.start(appPath.filePath("../../client/bin/wireguard-go"), wgArgs);' 'm_tunnel.start("${awg-vendored}/bin/amneziawg-go", wgArgs);' + --replace-fail 'm_tunnel.start(appPath.filePath("../../client/bin/wireguard-go"), wgArgs);' 'm_tunnel.start("${amneziawg'}/bin/amneziawg-go", wgArgs);' substituteInPlace client/utilities.cpp \ --replace-fail 'return Utils::executable("../../client/bin/openvpn", true);' 'return Utils::executable("${openvpn}/bin/openvpn", false);' \ - --replace-fail 'return Utils::executable("../../client/bin/tun2socks", true);' 'return Utils::executable("${amnezia-tun2socks}/bin/amnezia-tun2socks", false);' \ + --replace-fail 'return Utils::executable("../../client/bin/tun2socks", true);' 'return Utils::executable("${tun2socks'}/bin/tun2socks", false);' \ --replace-fail 'return Utils::usrExecutable("wg-quick");' 'return Utils::executable("${wireguard-tools}/bin/wg-quick", false);' - substituteInPlace client/protocols/xrayprotocol.cpp \ - --replace-fail 'return Utils::executable(QString("xray"), true);' 'return Utils::executable(QString("${amnezia-xray}/bin/xray"), false);' substituteInPlace client/protocols/openvpnovercloakprotocol.cpp \ --replace-fail 'return Utils::executable(QString("/ck-client"), true);' 'return Utils::executable(QString("${cloak-pt}/bin/ck-client"), false);' substituteInPlace client/protocols/shadowsocksvpnprotocol.cpp \ --replace-fail 'return Utils::executable(QString("/ss-local"), true);' 'return Utils::executable(QString("${shadowsocks-rust}/bin/sslocal"), false);' substituteInPlace client/configurators/openvpn_configurator.cpp \ - --replace-fail ".arg(qApp->applicationDirPath());" ".arg(\"$out/libexec\");" + --replace-fail ".arg(qApp->applicationDirPath());" ".arg(\"$out/libexec\");" \ + --replace-fail "int nVersion = 1;" "int nVersion = 0;" substituteInPlace client/ui/qautostart.cpp \ --replace-fail "/usr/share/pixmaps/AmneziaVPN.png" "AmneziaVPN" substituteInPlace deploy/installer/config/AmneziaVPN.desktop.in \ - --replace-fail "/usr/share/pixmaps/AmneziaVPN.png" "$out/share/pixmaps/AmneziaVPN.png" + --replace-fail "/usr/share/pixmaps/AmneziaVPN.png" "$out/share/icons/hicolor/512x512/apps/AmneziaVPN.png" substituteInPlace deploy/data/linux/AmneziaVPN.service \ --replace-fail "ExecStart=/opt/AmneziaVPN/service/AmneziaVPN-service.sh" "ExecStart=$out/bin/AmneziaVPN-service" \ --replace-fail "Environment=LD_LIBRARY_PATH=/opt/AmneziaVPN/client/lib" "" @@ -123,7 +109,9 @@ stdenv.mkDerivation (finalAttrs: { substituteInPlace service/server/CMakeLists.txt \ --replace-fail 'set(OPENSSL_INCLUDE_DIR "''${OPENSSL_ROOT_DIR}/linux/include")' 'set(OPENSSL_INCLUDE_DIR "${openssl.dev}/include")' \ --replace-fail 'set(OPENSSL_LIB_CRYPTO_PATH "''${OPENSSL_ROOT_DIR}/linux/x86_64/libcrypto.a")' 'set(OPENSSL_LIB_CRYPTO_PATH "${openssl.out}/lib/libcrypto.so")' \ - --replace-fail 'set(OPENSSL_USE_STATIC_LIBS TRUE)' 'set(OPENSSL_USE_STATIC_LIBS FALSE)' + --replace-fail 'set(OPENSSL_USE_STATIC_LIBS TRUE)' 'set(OPENSSL_USE_STATIC_LIBS FALSE)' \ + --replace-fail 'set(AMNEZIA_XRAY_LIB_PATH "''${AMNEZIA_XRAY_ROOT_DIR}/linux/x86_64/amnezia_xray.a")' 'set(AMNEZIA_XRAY_LIB_PATH "${amnezia-xray}/lib/amnezia_xray.a")' \ + --replace-fail 'set(AMNEZIA_XRAY_INCLUDE_DIR "''${AMNEZIA_XRAY_ROOT_DIR}/linux/x86_64")' 'set(AMNEZIA_XRAY_INCLUDE_DIR "${amnezia-xray}/include")' ''; strictDeps = true; @@ -151,30 +139,15 @@ stdenv.mkDerivation (finalAttrs: { installPhase = '' runHook preInstall - mkdir -p $out/bin $out/libexec $out/share/applications $out/lib/systemd/system - install -m555 client/AmneziaVPN service/server/AmneziaVPN-service $out/bin/ - install -m555 ../deploy/data/linux/client/bin/update-resolv-conf.sh $out/libexec/ - install -m444 ../AppDir/AmneziaVPN.desktop $out/share/applications/ + install -Dm555 client/AmneziaVPN service/server/AmneziaVPN-service -t $out/bin/ + install -Dm555 ../deploy/data/linux/client/bin/update-resolv-conf.sh -t $out/libexec/ + install -Dm444 ../AppDir/AmneziaVPN.desktop -t $out/share/applications/ install -Dm444 ../deploy/data/linux/AmneziaVPN.png -t $out/share/icons/hicolor/512x512/apps - install -m444 ../deploy/data/linux/AmneziaVPN.service $out/lib/systemd/system/ + install -Dm444 ../deploy/data/linux/AmneziaVPN.service -t $out/lib/systemd/system/ runHook postInstall ''; - passthru = { - inherit amnezia-tun2socks amnezia-xray awg-vendored; - updateScript = nix-update-script { - extraArgs = [ - "--subpackage" - "amnezia-tun2socks" - "--subpackage" - "amnezia-xray" - "--subpackage" - "awg-vendored" - ]; - }; - }; - meta = { description = "Amnezia VPN Client"; downloadPage = "https://amnezia.org/en/downloads"; diff --git a/pkgs/by-name/am/amnezia-vpn/xray-lib.nix b/pkgs/by-name/am/amnezia-vpn/xray-lib.nix new file mode 100644 index 000000000000..b4f53602e556 --- /dev/null +++ b/pkgs/by-name/am/amnezia-vpn/xray-lib.nix @@ -0,0 +1,38 @@ +{ + fetchFromGitHub, + buildGo126Module, +}: + +buildGo126Module rec { + pname = "amnezia-xray"; + version = "1.1.0"; + + src = fetchFromGitHub { + owner = "amnezia-vpn"; + repo = "amnezia-xray-bindings"; + tag = "v${version}"; + hash = "sha256-HZ6qHHDMev8FoOIplWAaPOlCSfikpgKClvbxl+877S0="; + }; + + vendorHash = "sha256-ac+wJrwdTtLFJG+Ka1Ksb1P+3lI7sFwCh4Nr5+fPgq0="; + + env.CGO_ENABLED = 1; + + buildPhase = '' + runHook preBuild + + mkdir -p build + go build -buildmode=c-archive -trimpath -ldflags="-w -s" -o build/amnezia_xray.a . + + runHook postBuild + ''; + + installPhase = '' + runHook preInstall + + install -Dm444 build/amnezia_xray.a -t $out/lib/ + install -Dm444 build/amnezia_xray.h -t $out/include/ + + runHook postInstall + ''; +} From 385085d8f01673335b2be2d127098077c8d53b06 Mon Sep 17 00:00:00 2001 From: Arnout Engelen Date: Tue, 18 Nov 2025 19:46:12 +0100 Subject: [PATCH 13/50] nixos-rebuild-ng: use remote journalctl instead of pipe for logs Notably, `--pipe` would cause `nixos-rebuild-ng` to panic when stderr closes. That's especially painful when there's changes to the systemd unit that manages the network connection, since that wouldn't come back up. This materially improves the reliability of 'nixos-rebuild switch' and while it adds a bit of complexity it doesn't seem too bad. NixOS test coverage of nixos-rebuild is also pretty OK so that gives confidence it won't break too much, except for use cases that rely on passing information from the 'deployer' to the 'target' machine via stdin, which seems like an obscure pattern. Fixes #462179 --- .../nixos-rebuild-ng/src/nixos_rebuild/nix.py | 116 +++++++-- .../src/nixos_rebuild/process.py | 78 +++++- .../nixos-rebuild-ng/src/tests/test_main.py | 103 ++++++-- .../ni/nixos-rebuild-ng/src/tests/test_nix.py | 230 ++++++++++-------- 4 files changed, 369 insertions(+), 158 deletions(-) diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py index b1da9ef555dc..6598c69f259e 100644 --- a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py +++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py @@ -25,12 +25,14 @@ from .models import ( Profile, Remote, ) -from .process import PRESERVE_ENV, SSH_DEFAULT_OPTS, run_wrapper +from .process import PRESERVE_ENV, SSH_DEFAULT_OPTS, run_wrapper, run_wrapper_bg +from .process import Args as ProcessArgs from .utils import Args, dict_to_flags FLAKE_FLAGS: Final = ["--extra-experimental-features", "nix-command flakes"] FLAKE_REPL_TEMPLATE: Final = "repl.nix.template" -SWITCH_TO_CONFIGURATION_CMD_PREFIX: Final = [ +SYSTEMD_RUN_UNIT_PREFIX: Final = "nixos-rebuild-switch-to-configuration" +SYSTEMD_RUN_CMD_PREFIX: Final = [ "systemd-run", "-E", # Will be set to new value early in switch-to-configuration script, @@ -41,11 +43,10 @@ SWITCH_TO_CONFIGURATION_CMD_PREFIX: Final = [ "-E", "NIXOS_NO_CHECK", "--collect", + "--wait", "--no-ask-password", - "--pipe", "--quiet", "--service-type=exec", - "--unit=nixos-rebuild-switch-to-configuration", ] logger: Final = logging.getLogger(__name__) @@ -663,6 +664,78 @@ def set_profile( ) +def _has_systemd(target_host: Remote | None) -> bool: + r = run_wrapper( + ["test", "-d", "/run/systemd/system"], + remote=target_host, + check=False, + ) + return r.returncode == 0 + + +def _run_action( + action: Literal[Action.SWITCH, Action.BOOT, Action.TEST, Action.DRY_ACTIVATE], + path_to_config: Path, + install_bootloader: bool, + target_host: Remote | None, + sudo: bool, + prefix: ProcessArgs | None = None, +) -> None: + cmd: ProcessArgs = [path_to_config / "bin/switch-to-configuration", str(action)] + if prefix: + cmd = [*prefix, *cmd] + + run_wrapper( + cmd, + env={ + "LOCALE_ARCHIVE": PRESERVE_ENV, + "NIXOS_NO_CHECK": PRESERVE_ENV, + "NIXOS_INSTALL_BOOTLOADER": "1" if install_bootloader else "0", + }, + remote=target_host, + sudo=sudo, + ) + + +def _run_action_with_systemd( + action: Literal[Action.SWITCH, Action.BOOT, Action.TEST, Action.DRY_ACTIVATE], + path_to_config: Path, + install_bootloader: bool, + target_host: Remote | None, + sudo: bool, +) -> None: + unique_unit_name = SYSTEMD_RUN_UNIT_PREFIX + "-" + uuid.uuid4().hex[:8] + journalctl = run_wrapper_bg( + [ + "journalctl", + "-f", + f"--unit={unique_unit_name}", + "--output=cat", + ], + remote=target_host, + sudo=sudo, + ) + + try: + _run_action( + action, + path_to_config, + install_bootloader, + target_host, + sudo, + prefix=[*SYSTEMD_RUN_CMD_PREFIX, f"--unit={unique_unit_name}"], + ) + except KeyboardInterrupt: + run_wrapper( + ["systemctl", "stop", unique_unit_name], + remote=target_host, + sudo=sudo, + ) + raise + finally: + journalctl.terminate() + + def switch_to_configuration( path_to_config: Path, action: Literal[Action.SWITCH, Action.BOOT, Action.TEST, Action.DRY_ACTIVATE], @@ -686,29 +759,26 @@ def switch_to_configuration( if not path_to_config.exists(): raise NixOSRebuildError(f"specialisation not found: {specialisation}") - r = run_wrapper( - ["test", "-d", "/run/systemd/system"], - remote=target_host, - check=False, - ) - cmd = SWITCH_TO_CONFIGURATION_CMD_PREFIX - if r.returncode: + if _has_systemd(target_host): + _run_action_with_systemd( + action, + path_to_config, + install_bootloader, + target_host, + sudo, + ) + else: logger.debug( "skipping systemd-run to switch configuration since systemd is " "not working in target host" ) - cmd = [] - - run_wrapper( - [*cmd, path_to_config / "bin/switch-to-configuration", str(action)], - env={ - "LOCALE_ARCHIVE": PRESERVE_ENV, - "NIXOS_NO_CHECK": PRESERVE_ENV, - "NIXOS_INSTALL_BOOTLOADER": "1" if install_bootloader else "0", - }, - remote=target_host, - sudo=sudo, - ) + _run_action( + action, + path_to_config, + install_bootloader, + target_host, + sudo, + ) def upgrade_channels(all_channels: bool = False, sudo: bool = False) -> None: diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/process.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/process.py index ac83d92039f7..aa32a20a7fac 100644 --- a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/process.py +++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/process.py @@ -9,7 +9,7 @@ from collections.abc import Mapping, Sequence from dataclasses import dataclass from enum import Enum from ipaddress import AddressValueError, IPv6Address -from typing import Final, Literal, Self, TextIO, TypedDict, Unpack, override +from typing import Final, Literal, NamedTuple, Self, TextIO, TypedDict, Unpack, override from . import tmpdir @@ -117,16 +117,18 @@ def cleanup_ssh() -> None: atexit.register(cleanup_ssh) -def run_wrapper( +class _RunParams(NamedTuple): + args: Args + popen_env: dict[str, str] | None + process_input: str | None + + +def _build_run_params( args: Args, - *, - check: bool = True, - env: Mapping[str, EnvValue] | None = None, - remote: Remote | None = None, - sudo: bool = False, - **kwargs: Unpack[RunKwargs], -) -> subprocess.CompletedProcess[str]: - "Wrapper around `subprocess.run` that supports extra functionality." + env: Mapping[str, EnvValue] | None, + remote: Remote | None, + sudo: bool, +) -> _RunParams: process_input = None run_args: list[Arg] = list(args) final_args: list[Arg] @@ -188,9 +190,63 @@ def run_wrapper( final_args = run_args popen_env = None if env is None else resolved_env + return _RunParams(final_args, popen_env, process_input) + + +def run_wrapper_bg( + args: Args, + env: Mapping[str, EnvValue] | None = None, + remote: Remote | None = None, + sudo: bool = False, +) -> subprocess.Popen[str]: + "Wrapper around `subprocess.Popen` that supports extra functionality." + (final_args, popen_env, process_input) = _build_run_params(args, env, remote, sudo) + + logger.debug( + "calling Popen with args=%r", + _sanitize_env_run_args(list(final_args)), + ) + + if process_input: + stdin = subprocess.PIPE + else: + stdin = None + + r = subprocess.Popen( + final_args, + env=popen_env, + stdin=stdin, + # Hope nobody is using NixOS with non-UTF8 encodings, but + # "surrogateescape" should still work in those systems. + text=True, + errors="surrogateescape", + ) + + if r.stdin and process_input: + r.stdin.write(process_input) + r.stdin.write("\n") + r.stdin.close() + + return r + + +def run_wrapper( + args: Args, + *, + check: bool = True, + env: Mapping[str, EnvValue] | None = None, + remote: Remote | None = None, + sudo: bool = False, + **kwargs: Unpack[RunKwargs], +) -> subprocess.CompletedProcess[str]: + "Wrapper around `subprocess.run` that supports extra functionality." + (final_args, popen_env, process_input) = _build_run_params( + list(args), env, remote, sudo + ) + logger.debug( "calling run with args=%r, kwargs=%r, env=%r", - _sanitize_env_run_args(remote_run_args if remote else run_args), + _sanitize_env_run_args(list(final_args)), kwargs, env, ) diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_main.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_main.py index 7f51c09d7497..986f6883a42d 100644 --- a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_main.py +++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_main.py @@ -166,8 +166,15 @@ def test_parse_args() -> None: {"NIXOS_REBUILD_I_UNDERSTAND_THE_CONSEQUENCES_PLEASE_BREAK_MY_SYSTEM": "1"}, clear=True, ) +@patch("uuid.uuid4") @patch("subprocess.run", autospec=True) -def test_execute_nix_boot(mock_run: Mock, tmp_path: Path) -> None: +@patch("subprocess.Popen") +def test_execute_nix_boot( + mock_popen: Mock, mock_run: Mock, mock_uuid4: Mock, tmp_path: Path +) -> None: + test_uuid = uuid.UUID("58fe9784-f60a-42bc-aa94-eb8f1a7e5c17") + mock_uuid4.return_value = test_uuid + nixpkgs_path = tmp_path / "nixpkgs" (nixpkgs_path / ".git").mkdir(parents=True) config_path = tmp_path / "test" @@ -238,7 +245,8 @@ def test_execute_nix_boot(mock_run: Mock, tmp_path: Path) -> None: ), call( [ - *nr.nix.SWITCH_TO_CONFIGURATION_CMD_PREFIX, + *nr.nix.SYSTEMD_RUN_CMD_PREFIX, + f"--unit={nr.nix.SYSTEMD_RUN_UNIT_PREFIX}-{test_uuid.hex[:8]}", config_path / "bin/switch-to-configuration", "boot", ], @@ -259,7 +267,8 @@ def test_execute_nix_boot(mock_run: Mock, tmp_path: Path) -> None: # https://github.com/NixOS/nixpkgs/issues/437872 @patch.dict(os.environ, {}, clear=True) @patch("subprocess.run", autospec=True) -def test_execute_nix_build(mock_run: Mock, tmp_path: Path) -> None: +@patch("subprocess.Popen") +def test_execute_nix_build(mock_popen: Mock, mock_run: Mock, tmp_path: Path) -> None: config_path = tmp_path / "test" config_path.touch() @@ -301,7 +310,8 @@ def test_execute_nix_build(mock_run: Mock, tmp_path: Path) -> None: @patch.dict(os.environ, {}, clear=True) @patch("subprocess.run", autospec=True) -def test_execute_nix_build_vm(mock_run: Mock, tmp_path: Path) -> None: +@patch("subprocess.Popen") +def test_execute_nix_build_vm(mock_popen: Mock, mock_run: Mock, tmp_path: Path) -> None: config_path = tmp_path / "test" config_path.touch() @@ -350,7 +360,10 @@ def test_execute_nix_build_vm(mock_run: Mock, tmp_path: Path) -> None: @patch.dict(os.environ, {}, clear=True) @patch("subprocess.run", autospec=True) -def test_execute_nix_build_image_flake(mock_run: Mock, tmp_path: Path) -> None: +@patch("subprocess.Popen") +def test_execute_nix_build_image_flake( + mock_popen: Mock, mock_run: Mock, tmp_path: Path +) -> None: config_path = tmp_path / "test" config_path.touch() @@ -432,11 +445,18 @@ def test_execute_nix_build_image_flake(mock_run: Mock, tmp_path: Path) -> None: {"NIXOS_REBUILD_I_UNDERSTAND_THE_CONSEQUENCES_PLEASE_BREAK_MY_SYSTEM": "1"}, clear=True, ) +@patch("uuid.uuid4") @patch("subprocess.run", autospec=True) -def test_execute_nix_switch_flake(mock_run: Mock, tmp_path: Path) -> None: +@patch("subprocess.Popen") +def test_execute_nix_switch_flake( + mock_popen: Mock, mock_run: Mock, mock_uuid4: Mock, tmp_path: Path +) -> None: config_path = tmp_path / "test" config_path.touch() + test_uuid = uuid.UUID("58fe9784-f60a-42bc-aa94-eb8f1a7e5c17") + mock_uuid4.return_value = test_uuid + def run_side_effect(args: list[str], **kwargs: Any) -> CompletedProcess[str]: if args[0] == "nix": return CompletedProcess([], 0, str(config_path)) @@ -506,7 +526,8 @@ def test_execute_nix_switch_flake(mock_run: Mock, tmp_path: Path) -> None: "env", "-i", "NIXOS_INSTALL_BOOTLOADER=1", - *nr.nix.SWITCH_TO_CONFIGURATION_CMD_PREFIX, + *nr.nix.SYSTEMD_RUN_CMD_PREFIX, + f"--unit={nr.nix.SYSTEMD_RUN_UNIT_PREFIX}-{test_uuid.hex[:8]}", config_path / "bin/switch-to-configuration", "switch", ], @@ -523,11 +544,13 @@ def test_execute_nix_switch_flake(mock_run: Mock, tmp_path: Path) -> None: clear=True, ) @patch("subprocess.run", autospec=True) +@patch("subprocess.Popen") @patch("uuid.uuid4", autospec=True) @patch(get_qualified_name(nr.services.cleanup_ssh), autospec=True) def test_execute_nix_switch_build_target_host( mock_cleanup_ssh: Mock, mock_uuid4: Mock, + mock_popen: Mock, mock_run: Mock, tmp_path: Path, ) -> None: @@ -551,7 +574,8 @@ def test_execute_nix_switch_build_target_host( return CompletedProcess([], 0) mock_run.side_effect = run_side_effect - mock_uuid4.return_value = uuid.UUID(int=0) + test_uuid = uuid.UUID("58fe9784-f60a-42bc-aa94-eb8f1a7e5c17") + mock_uuid4.side_effect = [uuid.UUID(int=0), uuid.UUID(int=1), test_uuid] nr.execute( [ @@ -644,7 +668,7 @@ def test_execute_nix_switch_build_target_host( "--realise", str(config_path), "--add-root", - "/tmp/tmpdir/00000000000000000000000000000000", + "/tmp/tmpdir/00000000000000000000000000000001", ], check=True, stdout=PIPE, @@ -748,7 +772,8 @@ def test_execute_nix_switch_build_target_host( "-c", """'exec env -i PATH="${PATH-}" LOCALE_ARCHIVE="${LOCALE_ARCHIVE-}" NIXOS_NO_CHECK="${NIXOS_NO_CHECK-}" NIXOS_INSTALL_BOOTLOADER=0 "$@"'""", "sh", - *nr.nix.SWITCH_TO_CONFIGURATION_CMD_PREFIX, + *nr.nix.SYSTEMD_RUN_CMD_PREFIX, + f"--unit={nr.nix.SYSTEMD_RUN_UNIT_PREFIX}-{test_uuid.hex[:8]}", str(config_path / "bin/switch-to-configuration"), "switch", ], @@ -764,13 +789,20 @@ def test_execute_nix_switch_build_target_host( {"NIXOS_REBUILD_I_UNDERSTAND_THE_CONSEQUENCES_PLEASE_BREAK_MY_SYSTEM": "1"}, clear=True, ) +@patch("uuid.uuid4") @patch("subprocess.run", autospec=True) +@patch("subprocess.Popen") @patch(get_qualified_name(nr.services.cleanup_ssh), autospec=True) def test_execute_nix_switch_flake_target_host( mock_cleanup_ssh: Mock, + mock_popen: Mock, mock_run: Mock, + mock_uuid4: Mock, tmp_path: Path, ) -> None: + test_uuid = uuid.UUID("58fe9784-f60a-42bc-aa94-eb8f1a7e5c17") + mock_uuid4.return_value = test_uuid + config_path = tmp_path / "test" config_path.touch() @@ -865,7 +897,8 @@ def test_execute_nix_switch_flake_target_host( "-c", """'exec env -i PATH="${PATH-}" LOCALE_ARCHIVE="${LOCALE_ARCHIVE-}" NIXOS_NO_CHECK="${NIXOS_NO_CHECK-}" NIXOS_INSTALL_BOOTLOADER=0 "$@"'""", "sh", - *nr.nix.SWITCH_TO_CONFIGURATION_CMD_PREFIX, + *nr.nix.SYSTEMD_RUN_CMD_PREFIX, + f"--unit={nr.nix.SYSTEMD_RUN_UNIT_PREFIX}-{test_uuid.hex[:8]}", str(config_path / "bin/switch-to-configuration"), "switch", ], @@ -881,13 +914,20 @@ def test_execute_nix_switch_flake_target_host( {"NIXOS_REBUILD_I_UNDERSTAND_THE_CONSEQUENCES_PLEASE_BREAK_MY_SYSTEM": "1"}, clear=True, ) +@patch("uuid.uuid4") @patch("subprocess.run", autospec=True) +@patch("subprocess.Popen") @patch(get_qualified_name(nr.services.cleanup_ssh), autospec=True) def test_execute_nix_switch_flake_build_host( mock_cleanup_ssh: Mock, + mock_popen: Mock, mock_run: Mock, + mock_uuid4: Mock, tmp_path: Path, ) -> None: + test_uuid = uuid.UUID("58fe9784-f60a-42bc-aa94-eb8f1a7e5c17") + mock_uuid4.return_value = test_uuid + config_path = tmp_path / "test" config_path.touch() @@ -984,7 +1024,8 @@ def test_execute_nix_switch_flake_build_host( ), call( [ - *nr.nix.SWITCH_TO_CONFIGURATION_CMD_PREFIX, + *nr.nix.SYSTEMD_RUN_CMD_PREFIX, + f"--unit={nr.nix.SYSTEMD_RUN_UNIT_PREFIX}-{test_uuid.hex[:8]}", config_path / "bin/switch-to-configuration", "switch", ], @@ -996,7 +1037,10 @@ def test_execute_nix_switch_flake_build_host( @patch("subprocess.run", autospec=True) -def test_execute_switch_rollback(mock_run: Mock, tmp_path: Path) -> None: +@patch("subprocess.Popen") +def test_execute_switch_rollback( + mock_popen: Mock, mock_run: Mock, tmp_path: Path +) -> None: nixpkgs_path = tmp_path / "nixpkgs" (nixpkgs_path / ".git").mkdir(parents=True) @@ -1073,7 +1117,8 @@ def test_execute_switch_rollback(mock_run: Mock, tmp_path: Path) -> None: @patch("subprocess.run", autospec=True) -def test_execute_build(mock_run: Mock, tmp_path: Path) -> None: +@patch("subprocess.Popen") +def test_execute_build(mock_popen: Mock, mock_run: Mock, tmp_path: Path) -> None: config_path = tmp_path / "test" config_path.touch() mock_run.side_effect = [ @@ -1102,8 +1147,9 @@ def test_execute_build(mock_run: Mock, tmp_path: Path) -> None: @patch("subprocess.run", autospec=True) +@patch("subprocess.Popen") def test_execute_build_dry_run_build_and_target_remote( - mock_run: Mock, tmp_path: Path + mock_popen: Mock, mock_run: Mock, tmp_path: Path ) -> None: config_path = tmp_path / "test" config_path.touch() @@ -1174,7 +1220,8 @@ def test_execute_build_dry_run_build_and_target_remote( @patch("subprocess.run", autospec=True) -def test_execute_test_flake(mock_run: Mock, tmp_path: Path) -> None: +@patch("subprocess.Popen") +def test_execute_test_flake(mock_popen: Mock, mock_run: Mock, tmp_path: Path) -> None: config_path = tmp_path / "test" config_path.touch() @@ -1224,11 +1271,13 @@ def test_execute_test_flake(mock_run: Mock, tmp_path: Path) -> None: @patch("subprocess.run", autospec=True) +@patch("subprocess.Popen") @patch("pathlib.Path.exists", autospec=True, return_value=True) @patch("pathlib.Path.mkdir", autospec=True) def test_execute_test_rollback( mock_path_mkdir: Mock, mock_path_exists: Mock, + mock_popen: Mock, mock_run: Mock, ) -> None: def run_side_effect(args: list[str], **kwargs: Any) -> CompletedProcess[str]: @@ -1291,8 +1340,15 @@ def test_execute_test_rollback( {"NIXOS_REBUILD_I_UNDERSTAND_THE_CONSEQUENCES_PLEASE_BREAK_MY_SYSTEM": "1"}, clear=True, ) +@patch("uuid.uuid4", autospec=True) @patch("subprocess.run", autospec=True) -def test_execute_switch_store_path(mock_run: Mock, tmp_path: Path) -> None: +@patch("subprocess.Popen") +def test_execute_switch_store_path( + mock_popen: Mock, mock_run: Mock, mock_uuid4: Mock, tmp_path: Path +) -> None: + test_uuid = uuid.UUID("58fe9784-f60a-42bc-aa94-eb8f1a7e5c17") + mock_uuid4.return_value = test_uuid + config_path = tmp_path / "test-system" config_path.mkdir() @@ -1330,7 +1386,8 @@ def test_execute_switch_store_path(mock_run: Mock, tmp_path: Path) -> None: ), call( [ - *nr.nix.SWITCH_TO_CONFIGURATION_CMD_PREFIX, + *nr.nix.SYSTEMD_RUN_CMD_PREFIX, + f"--unit={nr.nix.SYSTEMD_RUN_UNIT_PREFIX}-{test_uuid.hex[:8]}", config_path / "bin/switch-to-configuration", "switch", ], @@ -1349,13 +1406,20 @@ def test_execute_switch_store_path(mock_run: Mock, tmp_path: Path) -> None: @patch.dict(os.environ, {}, clear=True) +@patch("uuid.uuid4") @patch("subprocess.run", autospec=True) @patch(get_qualified_name(nr.services.cleanup_ssh), autospec=True) +@patch("subprocess.Popen") def test_execute_switch_store_path_target_host( + mock_popen: Mock, mock_cleanup_ssh: Mock, mock_run: Mock, + mock_uuid4: Mock, tmp_path: Path, ) -> None: + test_uuid = uuid.UUID("58fe9784-f60a-42bc-aa94-eb8f1a7e5c17") + mock_uuid4.return_value = test_uuid + config_path = tmp_path / "test-system" config_path.mkdir() @@ -1448,7 +1512,8 @@ def test_execute_switch_store_path_target_host( "-c", """'exec env -i PATH="${PATH-}" LOCALE_ARCHIVE="${LOCALE_ARCHIVE-}" NIXOS_NO_CHECK="${NIXOS_NO_CHECK-}" NIXOS_INSTALL_BOOTLOADER=0 "$@"'""", "sh", - *nr.nix.SWITCH_TO_CONFIGURATION_CMD_PREFIX, + *nr.nix.SYSTEMD_RUN_CMD_PREFIX, + f"--unit={nr.nix.SYSTEMD_RUN_UNIT_PREFIX}-{test_uuid.hex[:8]}", str(config_path / "bin/switch-to-configuration"), "switch", ], diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py index 8a69fd89fad7..60c6afa59c9d 100644 --- a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py +++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py @@ -2,7 +2,7 @@ import sys import textwrap import uuid from pathlib import Path -from subprocess import PIPE, CompletedProcess +from subprocess import PIPE, CompletedProcess, Popen from typing import Any from unittest.mock import ANY, Mock, call, patch @@ -695,139 +695,159 @@ def test_set_profile(mock_run: Mock) -> None: @patch(get_qualified_name(n.run_wrapper, n), autospec=True) +@patch(get_qualified_name(n.run_wrapper_bg, n), autospec=True) def test_switch_to_configuration_without_systemd_run( - mock_run: Any, monkeypatch: MonkeyPatch + mock_run_bg: Mock, mock_run: Mock, monkeypatch: MonkeyPatch ) -> None: profile_path = Path("/path/to/profile") config_path = Path("/path/to/config") - mock_run.return_value = CompletedProcess([], 1) - with monkeypatch.context() as mp: - mp.setenv("LOCALE_ARCHIVE", "") + proc = Popen(["echo"]) + try: + mock_run_bg.return_value = p + mock_run.return_value = CompletedProcess([], 1) - n.switch_to_configuration( - profile_path, - m.Action.SWITCH, + with monkeypatch.context() as mp: + mp.setenv("LOCALE_ARCHIVE", "") + + n.switch_to_configuration( + profile_path, + m.Action.SWITCH, + sudo=False, + target_host=None, + specialisation=None, + install_bootloader=False, + ) + mock_run.assert_called_with( + [profile_path / "bin/switch-to-configuration", "switch"], + env={ + "LOCALE_ARCHIVE": p.PRESERVE_ENV, + "NIXOS_NO_CHECK": p.PRESERVE_ENV, + "NIXOS_INSTALL_BOOTLOADER": "0", + }, sudo=False, - target_host=None, - specialisation=None, - install_bootloader=False, + remote=None, ) - mock_run.assert_called_with( - [profile_path / "bin/switch-to-configuration", "switch"], - env={ - "LOCALE_ARCHIVE": p.PRESERVE_ENV, - "NIXOS_NO_CHECK": p.PRESERVE_ENV, - "NIXOS_INSTALL_BOOTLOADER": "0", - }, - sudo=False, - remote=None, - ) - with pytest.raises(m.NixOSRebuildError) as e: - n.switch_to_configuration( - config_path, - m.Action.BOOT, - sudo=False, - target_host=None, - specialisation="special", + with pytest.raises(m.NixOSRebuildError) as e: + n.switch_to_configuration( + config_path, + m.Action.BOOT, + sudo=False, + target_host=None, + specialisation="special", + ) + assert ( + str(e.value) + == "error: '--specialisation' can only be used with 'switch' and 'test'" ) - assert ( - str(e.value) - == "error: '--specialisation' can only be used with 'switch' and 'test'" - ) - target_host = m.Remote("user@localhost", [], None) - with monkeypatch.context() as mp: - mp.setenv("LOCALE_ARCHIVE", "/path/to/locale") - mp.setenv("PATH", "/path/to/bin") - mp.setattr(Path, Path.exists.__name__, lambda self: True) + target_host = m.Remote("user@localhost", [], None) + with monkeypatch.context() as mp: + mp.setenv("LOCALE_ARCHIVE", "/path/to/locale") + mp.setenv("PATH", "/path/to/bin") + mp.setattr(Path, Path.exists.__name__, lambda self: True) - n.switch_to_configuration( - Path("/path/to/config"), - m.Action.TEST, + n.switch_to_configuration( + Path("/path/to/config"), + m.Action.TEST, + sudo=True, + target_host=target_host, + install_bootloader=True, + specialisation="special", + ) + mock_run.assert_called_with( + [ + config_path / "specialisation/special/bin/switch-to-configuration", + "test", + ], + env={ + "LOCALE_ARCHIVE": p.PRESERVE_ENV, + "NIXOS_NO_CHECK": p.PRESERVE_ENV, + "NIXOS_INSTALL_BOOTLOADER": "1", + }, sudo=True, - target_host=target_host, - install_bootloader=True, - specialisation="special", + remote=target_host, ) - mock_run.assert_called_with( - [ - config_path / "specialisation/special/bin/switch-to-configuration", - "test", - ], - env={ - "LOCALE_ARCHIVE": p.PRESERVE_ENV, - "NIXOS_NO_CHECK": p.PRESERVE_ENV, - "NIXOS_INSTALL_BOOTLOADER": "1", - }, - sudo=True, - remote=target_host, - ) + finally: + proc.communicate(timeout=1) +@patch("uuid.uuid4") @patch(get_qualified_name(n.run_wrapper, n), autospec=True) +@patch(get_qualified_name(n.run_wrapper_bg, n), autospec=True) def test_switch_to_configuration_with_systemd_run( - mock_run: Mock, monkeypatch: MonkeyPatch + mock_run_bg: Mock, mock_run: Mock, mock_uuid4: Mock, monkeypatch: MonkeyPatch ) -> None: + test_uuid = uuid.UUID("58fe9784-f60a-42bc-aa94-eb8f1a7e5c17") + mock_uuid4.return_value = test_uuid + profile_path = Path("/path/to/profile") config_path = Path("/path/to/config") - mock_run.return_value = CompletedProcess([], 0) - with monkeypatch.context() as mp: - mp.setenv("LOCALE_ARCHIVE", "") + proc = Popen(["echo"]) + try: + mock_run_bg.return_value = proc + mock_run.return_value = CompletedProcess([], 0) - n.switch_to_configuration( - profile_path, - m.Action.SWITCH, + with monkeypatch.context() as mp: + mp.setenv("LOCALE_ARCHIVE", "") + + n.switch_to_configuration( + profile_path, + m.Action.SWITCH, + sudo=False, + target_host=None, + specialisation=None, + install_bootloader=False, + ) + mock_run.assert_called_with( + [ + *n.SYSTEMD_RUN_CMD_PREFIX, + f"--unit={n.SYSTEMD_RUN_UNIT_PREFIX}-{test_uuid.hex[:8]}", + profile_path / "bin/switch-to-configuration", + "switch", + ], + env={ + "LOCALE_ARCHIVE": p.PRESERVE_ENV, + "NIXOS_NO_CHECK": p.PRESERVE_ENV, + "NIXOS_INSTALL_BOOTLOADER": "0", + }, sudo=False, - target_host=None, - specialisation=None, - install_bootloader=False, + remote=None, ) - mock_run.assert_called_with( - [ - *n.SWITCH_TO_CONFIGURATION_CMD_PREFIX, - profile_path / "bin/switch-to-configuration", - "switch", - ], - env={ - "LOCALE_ARCHIVE": p.PRESERVE_ENV, - "NIXOS_NO_CHECK": p.PRESERVE_ENV, - "NIXOS_INSTALL_BOOTLOADER": "0", - }, - sudo=False, - remote=None, - ) - target_host = m.Remote("user@localhost", [], None) - with monkeypatch.context() as mp: - mp.setenv("LOCALE_ARCHIVE", "/path/to/locale") - mp.setenv("PATH", "/path/to/bin") - mp.setattr(Path, Path.exists.__name__, lambda self: True) + target_host = m.Remote("user@localhost", [], None) + with monkeypatch.context() as mp: + mp.setenv("LOCALE_ARCHIVE", "/path/to/locale") + mp.setenv("PATH", "/path/to/bin") + mp.setattr(Path, Path.exists.__name__, lambda self: True) - n.switch_to_configuration( - Path("/path/to/config"), - m.Action.TEST, + n.switch_to_configuration( + Path("/path/to/config"), + m.Action.TEST, + sudo=True, + target_host=target_host, + install_bootloader=True, + specialisation="special", + ) + mock_run.assert_called_with( + [ + *n.SYSTEMD_RUN_CMD_PREFIX, + f"--unit={n.SYSTEMD_RUN_UNIT_PREFIX}-{test_uuid.hex[:8]}", + config_path / "specialisation/special/bin/switch-to-configuration", + "test", + ], + env={ + "LOCALE_ARCHIVE": p.PRESERVE_ENV, + "NIXOS_NO_CHECK": p.PRESERVE_ENV, + "NIXOS_INSTALL_BOOTLOADER": "1", + }, sudo=True, - target_host=target_host, - install_bootloader=True, - specialisation="special", + remote=target_host, ) - mock_run.assert_called_with( - [ - *n.SWITCH_TO_CONFIGURATION_CMD_PREFIX, - config_path / "specialisation/special/bin/switch-to-configuration", - "test", - ], - env={ - "LOCALE_ARCHIVE": p.PRESERVE_ENV, - "NIXOS_NO_CHECK": p.PRESERVE_ENV, - "NIXOS_INSTALL_BOOTLOADER": "1", - }, - sudo=True, - remote=target_host, - ) + finally: + proc.communicate(timeout=1) @patch( From 15acaca6c64e3aa7328a286825f2091c82384c3b Mon Sep 17 00:00:00 2001 From: Arnout Engelen Date: Wed, 17 Dec 2025 17:42:33 +0100 Subject: [PATCH 14/50] nixos/tests/nixos-rebuild-target-host-interrupted: introduced Nixos test for the scenario that the connection breaks during the update --- nixos/tests/all-tests.nix | 3 + .../nixos-rebuild-target-host-interrupted.nix | 237 ++++++++++++++++++ 2 files changed, 240 insertions(+) create mode 100644 nixos/tests/nixos-rebuild-target-host-interrupted.nix diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix index 34cc5e601125..623400a21787 100644 --- a/nixos/tests/all-tests.nix +++ b/nixos/tests/all-tests.nix @@ -1128,6 +1128,9 @@ in nixos-rebuild-target-host = runTest { imports = [ ./nixos-rebuild-target-host.nix ]; }; + nixos-rebuild-target-host-interrupted = runTest { + imports = [ ./nixos-rebuild-target-host-interrupted.nix ]; + }; nixpkgs = pkgs.callPackage ../modules/misc/nixpkgs/test.nix { inherit evalMinimalConfig; }; nixpkgs-config-allow-unfree = pkgs.callPackage ../modules/misc/nixpkgs/test-nixpkgs-config-allow-unfree.nix diff --git a/nixos/tests/nixos-rebuild-target-host-interrupted.nix b/nixos/tests/nixos-rebuild-target-host-interrupted.nix new file mode 100644 index 000000000000..e780019cc68d --- /dev/null +++ b/nixos/tests/nixos-rebuild-target-host-interrupted.nix @@ -0,0 +1,237 @@ +{ hostPkgs, ... }: + +# This test recreates a remote deployment scenario where the connection +# between deployer and target is closed during the deployment - in this +# case because the connection goes over a 'reverse ssh' tunnel service +# that has changes that are being deployed. + +# This is not seamless (the deployer doesn't get to see the logs after +# the disconnect), but is a lot better than the old behaviour, where +# the switch was aborted and the connection never restored. + +{ + name = "nixos-rebuild-target-host-interrupted"; + + # TODO: remove overlay from nixos/modules/profiles/installation-device.nix + # make it a _small package instead, then remove pkgsReadOnly = false;. + node.pkgsReadOnly = false; + + nodes = { + deployer = + { + nodes, + lib, + pkgs, + ... + }: + let + inherit (import ./ssh-keys.nix pkgs) snakeOilPrivateKey snakeOilPublicKey; + in + { + imports = [ + ../modules/profiles/installation-device.nix + ]; + + nix.settings = { + substituters = lib.mkForce [ ]; + hashed-mirrors = null; + connect-timeout = 1; + }; + + system.includeBuildDependencies = true; + + virtualisation = { + cores = 2; + memorySize = 3072; + }; + + services.openssh.enable = true; + users.users.root.openssh.authorizedKeys.keys = [ nodes.target.system.build.publicKey ]; + system.extraDependencies = [ + # so that it doesn't need to be built inside the test + pkgs.nixVersions.latest + ]; + + system.build.privateKey = snakeOilPrivateKey; + system.build.publicKey = snakeOilPublicKey; + system.switch.enable = true; + + services.getty.autologinUser = lib.mkForce "root"; + }; + + target = + { + nodes, + lib, + pkgs, + ... + }: + let + inherit (import ./ssh-keys.nix pkgs) snakeOilPrivateKey snakeOilPublicKey; + targetConfig = { + documentation.enable = false; + services.openssh.enable = true; + system.build.privateKey = snakeOilPrivateKey; + system.build.publicKey = snakeOilPublicKey; + + users.users.root.openssh.authorizedKeys.keys = [ nodes.deployer.system.build.publicKey ]; + users.users.alice.openssh.authorizedKeys.keys = [ nodes.deployer.system.build.publicKey ]; + users.users.bob.openssh.authorizedKeys.keys = [ nodes.deployer.system.build.publicKey ]; + + users.users.alice.extraGroups = [ "wheel" ]; + users.users.bob.extraGroups = [ "wheel" ]; + + # Disable sudo for root to ensure sudo isn't called without `--sudo` + security.sudo.extraRules = lib.mkForce [ + { + groups = [ "wheel" ]; + commands = [ { command = "ALL"; } ]; + } + { + users = [ "alice" ]; + commands = [ + { + command = "ALL"; + options = [ "NOPASSWD" ]; + } + ]; + } + ]; + + nix.settings.trusted-users = [ "@wheel" ]; + + systemd.services."autossh-ng" = { + after = [ "network.target" ]; + wantedBy = [ "multi-user.target" ]; + serviceConfig = { + User = "root"; + Restart = "always"; + RestartSec = "10s"; + ExecStart = "${pkgs.openssh}/bin/ssh -o \"ServerAliveInterval 30\" -o \"ServerAliveCountMax 3\" -o ExitOnForwardFailure=yes -N -R2222:localhost:22 deployer"; + }; + }; + + }; + in + { + imports = [ ./common/user-account.nix ]; + + config = lib.mkMerge [ + targetConfig + { + system.build = { + inherit targetConfig; + }; + system.switch.enable = true; + + networking.hostName = "target"; + } + ]; + }; + }; + + testScript = + { nodes, ... }: + let + sshConfig = builtins.toFile "ssh.conf" '' + UserKnownHostsFile=/dev/null + StrictHostKeyChecking=no + ''; + + targetConfigJSON = hostPkgs.writeText "target-configuration.json" ( + builtins.toJSON nodes.target.system.build.targetConfig + ); + + targetNetworkJSON = hostPkgs.writeText "target-network.json" ( + builtins.toJSON nodes.target.system.build.networkConfig + ); + + configFile = + hostname: + hostPkgs.writeText "configuration.nix" # nix + '' + { lib, pkgs, modulesPath, ... }: { + imports = [ + (modulesPath + "/virtualisation/qemu-vm.nix") + (modulesPath + "/testing/test-instrumentation.nix") + (modulesPath + "/../tests/common/user-account.nix") + (lib.modules.importJSON ./target-configuration.json) + (lib.modules.importJSON ./target-network.json) + ./hardware-configuration.nix + ]; + + boot.loader.grub = { + enable = true; + device = "/dev/vda"; + forceInstall = true; + }; + + # needed to make NIX_SSHOPTS work for nix-copy-closure + nix.package = pkgs.nixVersions.latest; + + # We're changing the '-E' parameter to the new hostname here, + # not because we care about the logs, but because we want to + # force the scenario where the connection is broken during the + # deployment (because the autossh-ng service is stopped and + # started): + systemd.services."autossh-ng".serviceConfig.ExecStart = + lib.mkForce "''${pkgs.openssh}/bin/ssh -o \"ServerAliveInterval 30\" -o \"ServerAliveCountMax 3\" -o ExitOnForwardFailure=yes -N -R2222:localhost:22 -E ${hostname} deployer"; + + # this will be asserted to validate the switch happened: + networking.hostName = "${hostname}"; + } + ''; + in + # python + '' + start_all() + target.wait_for_open_port(22) + + deployer.wait_until_succeeds("ping -c1 target") + deployer.succeed("install -Dm 600 ${nodes.deployer.system.build.privateKey} ~root/.ssh/id_ecdsa") + deployer.succeed("install ${sshConfig} ~root/.ssh/config") + + target.succeed("nixos-generate-config") + target.succeed("install -Dm 600 ${nodes.target.system.build.privateKey} ~root/.ssh/id_ecdsa") + target.succeed("install ${sshConfig} ~root/.ssh/config") + deployer.succeed("scp alice@target:/etc/nixos/hardware-configuration.nix /root/hardware-configuration.nix") + target.wait_for_unit("autossh-ng.service") + + deployer.copy_from_host("${configFile "config-1-deployed"}", "/root/configuration-1.nix") + deployer.copy_from_host("${configFile "config-2-deployed"}", "/root/configuration-2.nix") + deployer.copy_from_host("${targetNetworkJSON}", "/root/target-network.json") + deployer.copy_from_host("${targetConfigJSON}", "/root/target-configuration.json") + + with subtest("Deploy to alice@target via reverse ssh"): + deployer.wait_for_unit("multi-user.target") + # Uses TTY/send_chars instead of deployer.succeed to set NIX_SSHOPTS + deployer.send_chars("NIX_SSHOPTS=\"-p 2222\" nixos-rebuild switch -I nixos-config=/root/configuration-1.nix --target-host alice@localhost --sudo\n") + + # the connection breaks, but the 'switch' should now continue in the background: + deployer.wait_until_tty_matches("1", "error: while running command with remote sudo") + + def deployed(last_try: bool) -> bool: + target_hostname = deployer.succeed("ssh alice@target cat /etc/hostname", timeout=20).rstrip() + if last_try: + print(f"Still seeing hostname {target_hostname}") + return target_hostname == "config-1-deployed" + retry(deployed) + + with subtest("Deploy to bob@target via reverse ssh with password-based sudo"): + deployer.wait_for_unit("multi-user.target") + # Uses TTY/send_chars instead of deployer.succeed to set NIX_SSHOPTS and for ask-sudo-password + deployer.send_chars("NIX_SSHOPTS=\"-p 2222\" nixos-rebuild switch -I nixos-config=/root/configuration-2.nix --target-host bob@localhost --ask-sudo-password\n") + deployer.wait_until_tty_matches("1", "password for bob") + deployer.send_chars("${nodes.target.users.users.bob.password}\n") + + # the connection breaks, but the 'switch' should now continue in the background: + deployer.wait_until_tty_matches("1", "error: while running command with remote sudo") + + def deployed(last_try: bool) -> bool: + target_hostname = deployer.succeed("ssh alice@target cat /etc/hostname", timeout=20).rstrip() + if last_try: + print(f"Still seeing hostname {target_hostname}") + return target_hostname == "config-2-deployed" + retry(deployed) + ''; +} From 683e587d5de51f4b54d085e0d99a08d77d7c43a1 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Mon, 2 Mar 2026 10:49:30 +0000 Subject: [PATCH 15/50] linux-wallpaperengine: 0-unstable-2026-01-25 -> 0-unstable-2026-03-01 --- pkgs/by-name/li/linux-wallpaperengine/package.nix | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/pkgs/by-name/li/linux-wallpaperengine/package.nix b/pkgs/by-name/li/linux-wallpaperengine/package.nix index 324684d1e879..89d7ac72506e 100644 --- a/pkgs/by-name/li/linux-wallpaperengine/package.nix +++ b/pkgs/by-name/li/linux-wallpaperengine/package.nix @@ -39,7 +39,7 @@ let cef = cef-binary.override { - version = "135.0.17"; # follow upstream. https://github.com/Almamu/linux-wallpaperengine/blob/ef986841e2c43f9a387afa5f96237a859ad61e75/CMakeLists.txt#L47 + version = "135.0.17"; # follow upstream. https://github.com/Almamu/linux-wallpaperengine/blob/7067d6ff9fd34e36eeccf44e15f86ad604244f26/CMakeLists.txt#L47 gitRevision = "cbc1c5b"; chromiumVersion = "135.0.7049.52"; @@ -51,14 +51,14 @@ let in stdenv.mkDerivation (finalAttrs: { pname = "linux-wallpaperengine"; - version = "0-unstable-2026-01-25"; + version = "0-unstable-2026-03-01"; src = fetchFromGitHub { owner = "Almamu"; repo = "linux-wallpaperengine"; - rev = "ef986841e2c43f9a387afa5f96237a859ad61e75"; + rev = "7067d6ff9fd34e36eeccf44e15f86ad604244f26"; fetchSubmodules = true; - hash = "sha256-VUhEEHid23l+z4fj8PoovE8nafSQLr//BMVUBoCDd+I="; + hash = "sha256-NjEcrytgD5KVpB4kS4Cwa2SpxSRL4Tgt2yz6Ygd2p5A="; }; nativeBuildInputs = [ From 426750caaa1725b2cb6ddcae9b515dfaf4bd99d1 Mon Sep 17 00:00:00 2001 From: Jost Alemann Date: Thu, 5 Mar 2026 23:36:53 +0100 Subject: [PATCH 16/50] ruff: 0.15.4 -> 0.15.5 Changelog: https://github.com/astral-sh/ruff/releases/tag/0.15.5 Diff: https://github.com/astral-sh/ruff/compare/0.15.4...0.15.5 --- pkgs/by-name/ru/ruff/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/ru/ruff/package.nix b/pkgs/by-name/ru/ruff/package.nix index 402fbe80d2d0..0ff8cbb186a7 100644 --- a/pkgs/by-name/ru/ruff/package.nix +++ b/pkgs/by-name/ru/ruff/package.nix @@ -16,18 +16,18 @@ rustPlatform.buildRustPackage (finalAttrs: { pname = "ruff"; - version = "0.15.4"; + version = "0.15.5"; src = fetchFromGitHub { owner = "astral-sh"; repo = "ruff"; tag = finalAttrs.version; - hash = "sha256-Vj/4Iod9aFuDK5B6cVe03/3VI5gltoWwWH/0NWrldaw="; + hash = "sha256-bemgVXV/Bkp0aXmWX+R6Aas2/naOx0XEGp0ofh+vyyM="; }; cargoBuildFlags = [ "--package=ruff" ]; - cargoHash = "sha256-yZeBev0vRsNXTdjQdLIkGAYIu66Yuzf6Pjct4xswXME="; + cargoHash = "sha256-NaWWX6EAVkEg/KQ+Up0t2fh/24fnTo6i5dDZoOWErjg="; nativeBuildInputs = [ installShellFiles ]; From e86e73534ac4d66bd6cc50cb6bc89da1b4aeeea9 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Fri, 6 Mar 2026 08:40:02 +0000 Subject: [PATCH 17/50] media-downloader: 5.4.8 -> 5.4.9 --- pkgs/by-name/me/media-downloader/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/me/media-downloader/package.nix b/pkgs/by-name/me/media-downloader/package.nix index cbfa8c5fd298..bd93a4d36eb6 100644 --- a/pkgs/by-name/me/media-downloader/package.nix +++ b/pkgs/by-name/me/media-downloader/package.nix @@ -16,13 +16,13 @@ stdenv.mkDerivation (finalAttrs: { pname = "media-downloader"; - version = "5.4.8"; + version = "5.4.9"; src = fetchFromGitHub { owner = "mhogomchungu"; repo = "media-downloader"; rev = finalAttrs.version; - hash = "sha256-LMgFCoMxLR9Diz0Fqke6J4aQy7cuEN1e7Umpo0/H0Bo="; + hash = "sha256-afQ3Tra7hUjrG3vs4XBfmvSOBrhG7k5fkEMDr6WF+Fo="; }; nativeBuildInputs = [ From b9270aba23f282ccf76000f37c04017e29ceb1bc Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Fri, 6 Mar 2026 17:59:03 +0000 Subject: [PATCH 18/50] hmcl: 3.11.1 -> 3.11.2 --- pkgs/by-name/hm/hmcl/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/hm/hmcl/package.nix b/pkgs/by-name/hm/hmcl/package.nix index 7936ab5ea391..66280fd8c2fe 100644 --- a/pkgs/by-name/hm/hmcl/package.nix +++ b/pkgs/by-name/hm/hmcl/package.nix @@ -49,13 +49,13 @@ let in stdenv.mkDerivation (finalAttrs: { pname = "hmcl"; - version = "3.11.1"; + version = "3.11.2"; src = fetchurl { # HMCL has built-in keys, such as the Microsoft OAuth secret and the CurseForge API key. # See https://github.com/HMCL-dev/HMCL/blob/refs/tags/release-3.6.12/.github/workflows/gradle.yml#L26-L28 url = "https://github.com/HMCL-dev/HMCL/releases/download/v${finalAttrs.version}/HMCL-${finalAttrs.version}.jar"; - hash = "sha256-nthmv/xvgQ4JFmtcwn4XkCHcdzC23hJ5McoAIl2g8A4="; + hash = "sha256-Db9ly87xt6+S6dgQ0bkVvKwY9t4pMPfnebMKPFrcbhc="; }; # - HMCL prompts users to download prebuilt Terracotta binary for From 45d6b680ece33c3f9d178d04e67573f5ecafdb1c Mon Sep 17 00:00:00 2001 From: Scandiravian Date: Wed, 18 Feb 2026 12:00:14 +0100 Subject: [PATCH 19/50] maintainers: add scandiravian --- maintainers/maintainer-list.nix | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix index 731e0b0c7967..ab118308b439 100644 --- a/maintainers/maintainer-list.nix +++ b/maintainers/maintainer-list.nix @@ -23952,6 +23952,12 @@ githubId = 15986681; name = "Simon Bruder"; }; + scandiravian = { + email = "nixos@scandiravian.com"; + github = "scandiravian"; + githubId = 13556969; + name = "Scandiravian"; + }; scd31 = { name = "scd31"; github = "scd31"; From 5b372639a62991e8b9ba74f52c500fea204db994 Mon Sep 17 00:00:00 2001 From: Scandiravian Date: Wed, 18 Feb 2026 11:56:30 +0100 Subject: [PATCH 20/50] mdbook-linkcheck2: init at 0.11 --- pkgs/by-name/md/mdbook-linkcheck2/package.nix | 34 +++++++++++++++++++ 1 file changed, 34 insertions(+) create mode 100644 pkgs/by-name/md/mdbook-linkcheck2/package.nix diff --git a/pkgs/by-name/md/mdbook-linkcheck2/package.nix b/pkgs/by-name/md/mdbook-linkcheck2/package.nix new file mode 100644 index 000000000000..d7375d7ded59 --- /dev/null +++ b/pkgs/by-name/md/mdbook-linkcheck2/package.nix @@ -0,0 +1,34 @@ +{ + lib, + fetchFromGitHub, + rustPlatform, + testers, + mdbook-linkcheck2, +}: +rustPlatform.buildRustPackage (finalAttrs: { + pname = "mdbook-linkcheck2"; + version = "0.12.0"; + + src = fetchFromGitHub { + owner = "marxin"; + repo = "mdbook-linkcheck2"; + tag = "v${finalAttrs.version}"; + sha256 = "sha256-SvheBEIWiL1zdYeMQalbBeAQC86DycqV1/PTA+0S7Gg="; + }; + + cargoHash = "sha256-s4nvVHl/bViIxZfqc4SxSnCCYIY/hxy0C7f2/9ztqts="; + + doCheck = false; # tries to access network to test broken web link functionality + + passthru.tests.version = testers.testVersion { package = mdbook-linkcheck2; }; + + meta = { + description = "Backend for mdbook which will check your links for you"; + mainProgram = "mdbook-linkcheck2"; + homepage = "https://github.com/marxin/mdbook-linkcheck2"; + license = lib.licenses.mit; + maintainers = with lib.maintainers; [ + scandiravian + ]; + }; +}) From 7cd7d7e116e56b62beeae4300d06da2706514b90 Mon Sep 17 00:00:00 2001 From: Christian Ravn Date: Tue, 3 Mar 2026 11:35:45 +0100 Subject: [PATCH 21/50] mdbook-linkcheck: drop As the package is unmaintained upstream and incompatible with the version 0.5+ of mdbook it has been dropped --- .../manual/release-notes/rl-2605.section.md | 2 + pkgs/by-name/md/mdbook-linkcheck/package.nix | 45 ------------------- pkgs/top-level/aliases.nix | 1 + 3 files changed, 3 insertions(+), 45 deletions(-) delete mode 100644 pkgs/by-name/md/mdbook-linkcheck/package.nix diff --git a/nixos/doc/manual/release-notes/rl-2605.section.md b/nixos/doc/manual/release-notes/rl-2605.section.md index 151f532bada9..12c8cd950c45 100644 --- a/nixos/doc/manual/release-notes/rl-2605.section.md +++ b/nixos/doc/manual/release-notes/rl-2605.section.md @@ -243,6 +243,8 @@ See . `component.settings`. The unix module now supports using SSH keys from Kanidm via `services.kanidm.unix.sshIntegration = true`. +- `mdbook-linkcheck` has been removed as it is unmaintained and incompatible with the latest version of `mdbook`. Users can instead migrate to `mdbook-linkcheck2`. + - `glibc` has been updated to version 2.42. This version no longer makes the stack executable when a shared library requires this. A symptom diff --git a/pkgs/by-name/md/mdbook-linkcheck/package.nix b/pkgs/by-name/md/mdbook-linkcheck/package.nix deleted file mode 100644 index 22e4c90ab63e..000000000000 --- a/pkgs/by-name/md/mdbook-linkcheck/package.nix +++ /dev/null @@ -1,45 +0,0 @@ -{ - lib, - stdenv, - fetchFromGitHub, - rustPlatform, - pkg-config, - openssl, - testers, - mdbook-linkcheck, -}: - -rustPlatform.buildRustPackage (finalAttrs: { - pname = "mdbook-linkcheck"; - version = "0.7.7"; - - src = fetchFromGitHub { - owner = "Michael-F-Bryan"; - repo = "mdbook-linkcheck"; - rev = "v${finalAttrs.version}"; - sha256 = "sha256-ZbraChBHuKAcUA62EVHZ1RygIotNEEGv24nhSPAEj00="; - }; - - cargoHash = "sha256-Tt7ljjWv2CMtP/ELZNgSH/ifmBk/42+E0r9ZXQEJNP8="; - - buildInputs = lib.optionals (!stdenv.hostPlatform.isDarwin) [ openssl ]; - - nativeBuildInputs = lib.optionals (!stdenv.hostPlatform.isDarwin) [ pkg-config ]; - - env.OPENSSL_NO_VENDOR = 1; - - doCheck = false; # tries to access network to test broken web link functionality - - passthru.tests.version = testers.testVersion { package = mdbook-linkcheck; }; - - meta = { - description = "Backend for `mdbook` which will check your links for you"; - mainProgram = "mdbook-linkcheck"; - homepage = "https://github.com/Michael-F-Bryan/mdbook-linkcheck"; - license = lib.licenses.mit; - maintainers = with lib.maintainers; [ - zhaofengli - matthiasbeyer - ]; - }; -}) diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix index b6dcba8642a3..e3bb2f39b4e9 100644 --- a/pkgs/top-level/aliases.nix +++ b/pkgs/top-level/aliases.nix @@ -1296,6 +1296,7 @@ mapAliases { matrix-synapse-tools.synadm = throw "'matrix-synapse-tools.synadm' has been renamed to/replaced by 'synadm'"; # Converted to throw 2025-10-27 mcomix3 = throw "'mcomix3' has been renamed to/replaced by 'mcomix'"; # Converted to throw 2025-10-27 mdbook-alerts = throw "'mdbook-alerts' has been removed because it is deprecated and natively supported by mdbook since version 0.5.0"; # Added 2026-01-07 + mdbook-linkcheck = throw "'mdbook-linkcheck' has been removed and replaced by 'mdbook-linkcheck2' due to incompatibility with mdbook version 0.5.0+"; # Added 2026-03-03 mdt = throw "'mdt' has been renamed to/replaced by 'md-tui'"; # Converted to throw 2025-10-27 mediastreamer = throw "'mediastreamer' has been moved to 'linphonePackages.mediastreamer2'"; # Added 2025-09-20 mediastreamer-openh264 = throw "'mediastreamer-openh264' has been moved to 'linphonePackages.msopenh264'"; # Added 2025-09-20 From 95578b12ec89daf1171668174d65cc26f1bba84a Mon Sep 17 00:00:00 2001 From: phaer Date: Wed, 4 Mar 2026 11:17:07 +0100 Subject: [PATCH 22/50] nix: drop mdbook-linkcheck dependency Upstream nix removed mdbook-linkcheck in commit 2636f50dd4. The mdbook-0.5-support patches applied to nix 2.28 and 2.30 already remove [output.linkcheck] from book.toml.in, so no linkcheck binary is needed on PATH. --- pkgs/tools/package-management/nix/common-meson.nix | 2 -- 1 file changed, 2 deletions(-) diff --git a/pkgs/tools/package-management/nix/common-meson.nix b/pkgs/tools/package-management/nix/common-meson.nix index 1524571859eb..4a5b765a4131 100644 --- a/pkgs/tools/package-management/nix/common-meson.nix +++ b/pkgs/tools/package-management/nix/common-meson.nix @@ -45,7 +45,6 @@ assert (hash == null) -> (src != null); meson, ninja, mdbook, - mdbook-linkcheck, nlohmann_json, nixosTests, openssl, @@ -116,7 +115,6 @@ stdenv.mkDerivation (finalAttrs: { ++ lib.optionals enableDocumentation [ (lib.getBin lowdown-unsandboxed) mdbook - mdbook-linkcheck ] ++ lib.optionals stdenv.hostPlatform.isLinux [ util-linuxMinimal From 8ddce743556b3f008e7be7cfd2df947fdbb4a7ca Mon Sep 17 00:00:00 2001 From: phaer Date: Wed, 4 Mar 2026 11:17:11 +0100 Subject: [PATCH 23/50] nix-manual: drop mdbook-linkcheck dependency Nix 2.31+ upstream already dropped [output.linkcheck] from book.toml, so the linkcheck binary is not invoked during the manual build. --- .../tools/package-management/nix/modular/doc/manual/package.nix | 2 -- 1 file changed, 2 deletions(-) diff --git a/pkgs/tools/package-management/nix/modular/doc/manual/package.nix b/pkgs/tools/package-management/nix/modular/doc/manual/package.nix index c8254f56afab..886911137bc8 100644 --- a/pkgs/tools/package-management/nix/modular/doc/manual/package.nix +++ b/pkgs/tools/package-management/nix/modular/doc/manual/package.nix @@ -6,7 +6,6 @@ ninja, lowdown-unsandboxed, mdbook, - mdbook-linkcheck, jq, python3, rsync, @@ -35,7 +34,6 @@ mkMesonDerivation (finalAttrs: { ninja (lib.getBin lowdown-unsandboxed) mdbook - mdbook-linkcheck jq python3 rsync From 2790cfc4dabe5d2bc2a00074fb948a8cc1b2c9fc Mon Sep 17 00:00:00 2001 From: phaer Date: Wed, 4 Mar 2026 11:17:17 +0100 Subject: [PATCH 24/50] lix: drop mdbook-linkcheck dependency Lix 2.93/2.94 still reference [output.linkcheck] in book.toml, but mdbook-linkcheck2 installs as binary 'mdbook-linkcheck2' which mdbook cannot discover via [output.linkcheck]. Substituting mdbook-linkcheck2 would not work due to this binary name mismatch. Dropping it entirely for now seems safe, lix upstream commented it out in 54df89f601b3. And the build still passes. --- pkgs/tools/package-management/lix/common-lix.nix | 2 -- 1 file changed, 2 deletions(-) diff --git a/pkgs/tools/package-management/lix/common-lix.nix b/pkgs/tools/package-management/lix/common-lix.nix index c111fb6e93d8..8fd3b27e3551 100644 --- a/pkgs/tools/package-management/lix/common-lix.nix +++ b/pkgs/tools/package-management/lix/common-lix.nix @@ -50,7 +50,6 @@ assert lib.assertMsg ( lsof, mercurial, mdbook, - mdbook-linkcheck, nlohmann_json, ninja, openssl, @@ -179,7 +178,6 @@ stdenv.mkDerivation (finalAttrs: { ++ lib.optionals enableDocumentation [ (lib.getBin lowdown-unsandboxed) mdbook - mdbook-linkcheck doxygen ] ++ lib.optionals (hasDtraceSupport && withDtrace) [ systemtap-sdt ] From 3182f86482d76cea4b86d9641cba6b8438eec0a7 Mon Sep 17 00:00:00 2001 From: Joost Nieuwenhuijse Date: Thu, 1 Jan 2026 18:46:45 +0100 Subject: [PATCH 25/50] sonic-visualiser: 4.5.1 -> 5.2.1 --- .../so/sonic-visualiser/fix-atomic-qt.patch | 63 +++++++++++++++++++ .../sonic-visualiser/fix-modifier-names.patch | 14 +++++ pkgs/by-name/so/sonic-visualiser/package.nix | 59 ++++++++--------- 3 files changed, 107 insertions(+), 29 deletions(-) create mode 100644 pkgs/by-name/so/sonic-visualiser/fix-atomic-qt.patch create mode 100644 pkgs/by-name/so/sonic-visualiser/fix-modifier-names.patch diff --git a/pkgs/by-name/so/sonic-visualiser/fix-atomic-qt.patch b/pkgs/by-name/so/sonic-visualiser/fix-atomic-qt.patch new file mode 100644 index 000000000000..c0bb05bfc2f6 --- /dev/null +++ b/pkgs/by-name/so/sonic-visualiser/fix-atomic-qt.patch @@ -0,0 +1,63 @@ +diff --git a/svcore/data/model/EditableDenseThreeDimensionalModel.cpp b/svcore/data/model/EditableDenseThreeDimensionalModel.cpp +index da5ff90..7a62163 100644 +--- a/svcore/data/model/EditableDenseThreeDimensionalModel.cpp ++++ b/svcore/data/model/EditableDenseThreeDimensionalModel.cpp +@@ -458,10 +458,10 @@ EditableDenseThreeDimensionalModel::toXml(QTextStream &out, + Model::toXml + (out, indent, + QString("type=\"dense\" dimensions=\"3\" windowSize=\"%1\" yBinCount=\"%2\" minimum=\"%3\" maximum=\"%4\" dataset=\"%5\" startFrame=\"%6\" %7") +- .arg(m_resolution) +- .arg(m_yBinCount) +- .arg(m_minimum) +- .arg(m_maximum) ++ .arg(m_resolution.load()) ++ .arg(m_yBinCount.load()) ++ .arg(m_minimum.load()) ++ .arg(m_maximum.load()) + .arg(getExportId()) + .arg(m_startFrame) + .arg(extraAttributes)); +diff --git a/svcore/data/model/NoteModel.h b/svcore/data/model/NoteModel.h +index 8c3a421..28e145c 100644 +--- a/svcore/data/model/NoteModel.h ++++ b/svcore/data/model/NoteModel.h +@@ -403,8 +403,8 @@ public: + .arg(m_events.getExportId()) + .arg(m_subtype == FLEXI_NOTE ? "flexinote" : "note") + .arg(m_valueQuantization) +- .arg(m_valueMinimum) +- .arg(m_valueMaximum) ++ .arg(m_valueMinimum.load()) ++ .arg(m_valueMaximum.load()) + .arg(encodeEntities(m_units)) + .arg(extraAttributes)); + +diff --git a/svcore/data/model/RegionModel.h b/svcore/data/model/RegionModel.h +index 916a047..db021ae 100644 +--- a/svcore/data/model/RegionModel.h ++++ b/svcore/data/model/RegionModel.h +@@ -335,8 +335,8 @@ public: + .arg(m_events.getExportId()) + .arg("region") + .arg(m_valueQuantization) +- .arg(m_valueMinimum) +- .arg(m_valueMaximum) ++ .arg(m_valueMinimum.load()) ++ .arg(m_valueMaximum.load()) + .arg(encodeEntities(m_units)) + .arg(extraAttributes)); + +diff --git a/svcore/data/model/SparseTimeValueModel.h b/svcore/data/model/SparseTimeValueModel.h +index fe6e70c..7033503 100644 +--- a/svcore/data/model/SparseTimeValueModel.h ++++ b/svcore/data/model/SparseTimeValueModel.h +@@ -342,8 +342,8 @@ public: + .arg("true") // always true after model reaches 100% - + // subsequent events are always notified + .arg(m_events.getExportId()) +- .arg(m_valueMinimum) +- .arg(m_valueMaximum) ++ .arg(m_valueMinimum.load()) ++ .arg(m_valueMaximum.load()) + .arg(encodeEntities(m_units)) + .arg(extraAttributes)); diff --git a/pkgs/by-name/so/sonic-visualiser/fix-modifier-names.patch b/pkgs/by-name/so/sonic-visualiser/fix-modifier-names.patch new file mode 100644 index 000000000000..ff8182d11ffb --- /dev/null +++ b/pkgs/by-name/so/sonic-visualiser/fix-modifier-names.patch @@ -0,0 +1,14 @@ +diff --git a/svgui/view/Pane.cpp b/svgui/view/Pane.cpp +index fb802c4..9a8124c 100644 +--- a/svgui/view/Pane.cpp ++++ b/svgui/view/Pane.cpp +@@ -1423,7 +1423,7 @@ modifierNames(Qt::KeyboardModifiers m) + if (m & Qt::GroupSwitchModifier) s << "GroupSwitch"; + m &= (~ (Qt::ShiftModifier | Qt::ControlModifier | Qt::AltModifier | + Qt::MetaModifier | Qt::KeypadModifier | Qt::GroupSwitchModifier)); +- if (m) s << QString(" (residue %1)").arg(m); ++ if (m) s << QString(" (residue %1)").arg(static_cast(m)); + if (s.empty()) return "(none)"; + else return s.join(" | "); + } + diff --git a/pkgs/by-name/so/sonic-visualiser/package.nix b/pkgs/by-name/so/sonic-visualiser/package.nix index 871f2893ca1f..1aef05fd357f 100644 --- a/pkgs/by-name/so/sonic-visualiser/package.nix +++ b/pkgs/by-name/so/sonic-visualiser/package.nix @@ -1,5 +1,3 @@ -# TODO add plugins having various licenses, see http://www.vamp-plugins.org/download.html - { lib, stdenv, @@ -29,53 +27,55 @@ opusfile, meson, ninja, - cmake, - libsForQt5, + qt6, }: stdenv.mkDerivation (finalAttrs: { pname = "sonic-visualiser"; - version = "4.5.1"; + version = "5.2.1"; src = fetchurl { - url = "https://code.soundsoftware.ac.uk/attachments/download/2841/sonic-visualiser-${finalAttrs.version}.tar.gz"; - hash = "sha256-WauIaCWQs739IwJIorDCNymH//navxsbHUCVAUYl7+k="; + url = "https://github.com/sonic-visualiser/sonic-visualiser/releases/download/sv_v${finalAttrs.version}/sonic-visualiser-${finalAttrs.version}.tar.gz"; + hash = "sha256-LzOK8CMekwU5xeXgTax8M4QleGbMKf2hEiFfjEEImMk="; }; nativeBuildInputs = [ meson ninja - cmake pkg-config - libsForQt5.wrapQtAppsHook + qt6.wrapQtAppsHook ]; + buildInputs = [ - libsndfile - libsForQt5.qtbase - libsForQt5.qtsvg + alsa-lib + bzip2 + capnproto fftw fftwFloat - bzip2 - lrdf - rubberband + libfishsound + libid3tag + libjack2 + liblo + libmad + liboggz + libpulseaudio libsamplerate - vamp-plugin-sdk - alsa-lib + libsndfile + libx11 + lrdf + opusfile + qt6.qtbase + qt6.qtsvg redland + rubberband serd sord - # optional - libjack2 - # portaudio - libpulseaudio - libmad - libfishsound - liblo - libx11 - capnproto - liboggz - libid3tag - opusfile + vamp-plugin-sdk + ]; + + patches = [ + ./fix-atomic-qt.patch + ./fix-modifier-names.patch ]; enableParallelBuilding = true; @@ -86,5 +86,6 @@ stdenv.mkDerivation (finalAttrs: { license = lib.licenses.gpl2Plus; maintainers = with lib.maintainers; [ marcweber ]; platforms = lib.platforms.linux; + mainProgram = "sonic-visualiser"; }; }) From f8e7597f4d26ca3dc7fe6f2950fb90b2bf78d316 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Sat, 7 Mar 2026 16:51:36 +0000 Subject: [PATCH 26/50] proto: 0.55.3 -> 0.55.4 --- pkgs/by-name/pr/proto/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/pr/proto/package.nix b/pkgs/by-name/pr/proto/package.nix index 7e8cc9ee845e..f7b059a48f2e 100644 --- a/pkgs/by-name/pr/proto/package.nix +++ b/pkgs/by-name/pr/proto/package.nix @@ -11,16 +11,16 @@ rustPlatform.buildRustPackage (finalAttrs: { pname = "proto"; - version = "0.55.3"; + version = "0.55.4"; src = fetchFromGitHub { owner = "moonrepo"; repo = "proto"; rev = "v${finalAttrs.version}"; - hash = "sha256-9iWETEDHwXdSI8u1MshQXBRZXhGGVQIR8GS3d/KD8dk="; + hash = "sha256-roaCQ2hPcYR6TFTVhfz7D5l9++UEB1blMCwB/dXb3hE="; }; - cargoHash = "sha256-API0sm3qOuQ64jn3H8ivWeaacHDBvIEHBwm7kgCBey8="; + cargoHash = "sha256-zBwuimKV2D78zJXOMxcRqWRdJW1GbZH56OEYHccZM3I="; buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ libiconv From 2262713c9b90985749490f6e7c8eea5fcd11ccc9 Mon Sep 17 00:00:00 2001 From: K900 Date: Sat, 7 Mar 2026 20:18:08 +0300 Subject: [PATCH 27/50] linux_testing: 6.19-rc8 -> 7.0-rc2 --- pkgs/os-specific/linux/kernel/kernels-org.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json index 51c85bacf3f6..bfbc16d95176 100644 --- a/pkgs/os-specific/linux/kernel/kernels-org.json +++ b/pkgs/os-specific/linux/kernel/kernels-org.json @@ -1,7 +1,7 @@ { "testing": { - "version": "6.19-rc8", - "hash": "sha256:1vwlhsk3cry48p9v2kqqxkmrsw2sjgspfylv3c7r5430yk7fhyg1", + "version": "7.0-rc2", + "hash": "sha256:11zw5rck5hg1w8jjjgc8hjmswzdv4k1wqnkg4zmzxg0ds447cd0b", "lts": false }, "6.1": { From 38123e3ea3018574b8906ca55e83d3cb51e6289a Mon Sep 17 00:00:00 2001 From: K900 Date: Sat, 7 Mar 2026 20:18:12 +0300 Subject: [PATCH 28/50] linux_6_12: 6.12.75 -> 6.12.76 --- pkgs/os-specific/linux/kernel/kernels-org.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json index bfbc16d95176..1d63ad45fc6a 100644 --- a/pkgs/os-specific/linux/kernel/kernels-org.json +++ b/pkgs/os-specific/linux/kernel/kernels-org.json @@ -25,8 +25,8 @@ "lts": true }, "6.12": { - "version": "6.12.75", - "hash": "sha256:0xy1q4x18z6ghaw481hqvkmnkcgxn00nb0n4224amwbgalkpkvh6", + "version": "6.12.76", + "hash": "sha256:15nq7agr492b9lh57xp10hs48dx9g7k253y2lm4vvrj69j1kxd5v", "lts": true }, "6.18": { From 8de310b1a984e9b2e678d0e66a058f7e9aaf8428 Mon Sep 17 00:00:00 2001 From: K900 Date: Sat, 7 Mar 2026 20:18:15 +0300 Subject: [PATCH 29/50] linux_6_6: 6.6.128 -> 6.6.129 --- pkgs/os-specific/linux/kernel/kernels-org.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json index 1d63ad45fc6a..4a13564ff155 100644 --- a/pkgs/os-specific/linux/kernel/kernels-org.json +++ b/pkgs/os-specific/linux/kernel/kernels-org.json @@ -20,8 +20,8 @@ "lts": true }, "6.6": { - "version": "6.6.128", - "hash": "sha256:0j4f6imsxm5pyqk2yn4snv47q272dwpzp0w8qcaiy0l0hjxk75k6", + "version": "6.6.129", + "hash": "sha256:12j42awg44w97zq8fzifpm300jm9q9ya7qkpn7xbnkr2480qz86a", "lts": true }, "6.12": { From b938d814da6b4e3ae249cdd25489206d5dfd1f02 Mon Sep 17 00:00:00 2001 From: K900 Date: Sat, 7 Mar 2026 20:18:18 +0300 Subject: [PATCH 30/50] linux_6_1: 6.1.165 -> 6.1.166 --- pkgs/os-specific/linux/kernel/kernels-org.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json index 4a13564ff155..eb6bfae41550 100644 --- a/pkgs/os-specific/linux/kernel/kernels-org.json +++ b/pkgs/os-specific/linux/kernel/kernels-org.json @@ -5,8 +5,8 @@ "lts": false }, "6.1": { - "version": "6.1.165", - "hash": "sha256:1x1fsaax7yd5p3vwcgp04hbcafmwfqiw1bz0qxsip45yy62730as", + "version": "6.1.166", + "hash": "sha256:0jcl12gjlfdf9pwqg1m84rzwnrj3grxxgk5blrq8zlaq45sgr3c1", "lts": true }, "5.15": { From b215ccdf1cc7a8d87167fb775097ffa738a888fe Mon Sep 17 00:00:00 2001 From: K900 Date: Sat, 7 Mar 2026 20:36:43 +0300 Subject: [PATCH 31/50] linux/common-config: update for 7.0, tweak preemption settings --- pkgs/os-specific/linux/kernel/common-config.nix | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix index 23b8aabf4e9a..66859facc6d9 100644 --- a/pkgs/os-specific/linux/kernel/common-config.nix +++ b/pkgs/os-specific/linux/kernel/common-config.nix @@ -575,7 +575,7 @@ let # Enable Hyper-V Synthetic DRM Driver DRM_HYPERV = whenAtLeast "5.14" module; # And disable the legacy framebuffer driver when we have the new one - FB_HYPERV = whenAtLeast "5.14" no; + FB_HYPERV = whenBetween "5.14" "7.0" no; } // lib.optionalAttrs (stdenv.hostPlatform.system == "x86_64-linux") { # Intel GVT-g graphics virtualization supports 64-bit only @@ -739,7 +739,9 @@ let NFS_FSCACHE = yes; NFS_SWAP = yes; NFS_V3_ACL = yes; - NFS_V4_1 = yes; # NFSv4.1 client support + # NFSv4.1 is enabled unconditionally on 7.0 and up + # see: https://github.com/torvalds/linux/commit/7537db24806fdc3d3ec4fef53babdc22c9219e75 + NFS_V4_1 = whenOlder "7.0" yes; NFS_V4_2 = yes; NFS_V4_SECURITY_LABEL = yes; NFS_LOCALIO = whenAtLeast "6.12" yes; @@ -1168,7 +1170,7 @@ let ACCESSIBILITY = yes; # Accessibility support AUXDISPLAY = yes; # Auxiliary Display support - HIPPI = yes; + HIPPI = whenOlder "7.0" yes; MTD_COMPLEX_MAPPINGS = yes; # needed for many devices SCSI_LOWLEVEL = yes; # enable lots of SCSI devices @@ -1378,8 +1380,14 @@ let HMM_MIRROR = yes; DRM_AMDGPU_USERPTR = yes; + # We want to prefer PREEMPT_LAZY when available, and fall back on PREEMPT_VOLUNTARY. + # It just so happens that kconfig asks for PREEMPT_LAZY first, so doing it like this + # does what we want. + # FIXME: This is stupid and bad. + # See: https://github.com/torvalds/linux/commit/7dadeaa6e851e7d67733f3e24fc53ee107781d0f PREEMPT = no; - PREEMPT_VOLUNTARY = yes; + PREEMPT_LAZY = option yes; + PREEMPT_VOLUNTARY = option yes; X86_AMD_PLATFORM_DEVICE = lib.mkIf stdenv.hostPlatform.isx86 yes; X86_PLATFORM_DRIVERS_DELL = lib.mkIf stdenv.hostPlatform.isx86 (whenAtLeast "5.12" yes); From b7cc58d4a6083c277fa85cad3bc11d94802afffb Mon Sep 17 00:00:00 2001 From: Maximilian Bosch Date: Sat, 7 Mar 2026 19:02:46 +0100 Subject: [PATCH 32/50] victoriatraces: 0.7.1 -> 0.8.0 ChangeLog: https://github.com/VictoriaMetrics/VictoriaTraces/releases/tag/v0.8.0 --- pkgs/by-name/vi/victoriatraces/package.nix | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/pkgs/by-name/vi/victoriatraces/package.nix b/pkgs/by-name/vi/victoriatraces/package.nix index 3e95d91af5a5..0f7fce9de6f6 100644 --- a/pkgs/by-name/vi/victoriatraces/package.nix +++ b/pkgs/by-name/vi/victoriatraces/package.nix @@ -1,6 +1,6 @@ { lib, - buildGoModule, + buildGo126Module, fetchFromGitHub, nix-update-script, nixosTests, @@ -11,15 +11,15 @@ withVtGen ? false, }: -buildGoModule (finalAttrs: { +buildGo126Module (finalAttrs: { pname = "VictoriaTraces"; - version = "0.7.1"; + version = "0.8.0"; src = fetchFromGitHub { owner = "VictoriaMetrics"; repo = "VictoriaTraces"; tag = "v${finalAttrs.version}"; - hash = "sha256-Hli0JNQ0XpLXI10ol5fdmhk35/SFSo1o/SiVmYVWlCs="; + hash = "sha256-bm1hF4LqbSxxEOMtz4jdgJHMwrahGI4VZ9nj/VscFdc="; }; vendorHash = null; From 9670057b93e59c3e412afd7f71d115f28c1d80e8 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Sat, 7 Mar 2026 20:22:10 +0000 Subject: [PATCH 33/50] sipvicious: 0.3.4 -> 0.3.5 --- pkgs/by-name/si/sipvicious/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/si/sipvicious/package.nix b/pkgs/by-name/si/sipvicious/package.nix index 6acf8028bff5..0371690eb668 100644 --- a/pkgs/by-name/si/sipvicious/package.nix +++ b/pkgs/by-name/si/sipvicious/package.nix @@ -7,14 +7,14 @@ python3.pkgs.buildPythonApplication (finalAttrs: { pname = "sipvicious"; - version = "0.3.4"; + version = "0.3.5"; pyproject = true; src = fetchFromGitHub { owner = "EnableSecurity"; repo = "sipvicious"; tag = "v${finalAttrs.version}"; - hash = "sha256-O8/9Vz/u8BoF1dfGceOJdzPPYLfkdBp2DkwA5WQ3dgo="; + hash = "sha256-jH5/rNGFbiPdSX52UuJCAq5M7Kco7tCAhtcCyZl5wEc="; }; build-system = [ From e66cbfc6768d33c4458fd8623ff1101fc74e4061 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Sat, 7 Mar 2026 20:45:29 +0000 Subject: [PATCH 34/50] python3Packages.troi: 2025.08.06.3 -> 2026.03.03.0 --- pkgs/development/python-modules/troi/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/python-modules/troi/default.nix b/pkgs/development/python-modules/troi/default.nix index 32367c46f539..f8186db275f4 100644 --- a/pkgs/development/python-modules/troi/default.nix +++ b/pkgs/development/python-modules/troi/default.nix @@ -26,14 +26,14 @@ buildPythonPackage rec { pname = "troi"; - version = "2025.08.06.3"; + version = "2026.03.03.0"; pyproject = true; src = fetchFromGitHub { owner = "metabrainz"; repo = "troi-recommendation-playground"; tag = "v${version}"; - hash = "sha256-qLnXaNb1Kon+XPJYCPe31EgXpukIfzTa+LADOzFjE9Q="; + hash = "sha256-G7w6VPxsj+7xxKw2sMzXJAHZVyu5mmMIwhbWdWUguKs="; }; build-system = [ From d545c6f969c15c56ff614b271536230a10001698 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Sat, 7 Mar 2026 21:28:49 +0000 Subject: [PATCH 35/50] greenmask: 0.2.16 -> 0.2.17 --- pkgs/by-name/gr/greenmask/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/gr/greenmask/package.nix b/pkgs/by-name/gr/greenmask/package.nix index b3909b3cfa85..5c33ad6cee71 100644 --- a/pkgs/by-name/gr/greenmask/package.nix +++ b/pkgs/by-name/gr/greenmask/package.nix @@ -7,13 +7,13 @@ buildGoModule (finalAttrs: { pname = "greenmask"; - version = "0.2.16"; + version = "0.2.17"; src = fetchFromGitHub { owner = "GreenmaskIO"; repo = "greenmask"; tag = "v${finalAttrs.version}"; - hash = "sha256-0XWVYkC5ltpJZ1VLG3G1gvTwGdgqY4nzmOvDDnbz0Ss="; + hash = "sha256-pH+e+CXC18jpAq/xLV5CE0BicxgPtLF7kBgUusebWDg="; }; vendorHash = "sha256-t2U65GAGBGdMRXPTkCQCuXfLuqohA6erTlvAN/xx/ek="; From 9848b0ed5f5d53b3596825d2fd7ccbc2b1cad729 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Sat, 7 Mar 2026 22:42:33 +0000 Subject: [PATCH 36/50] dbeaver-bin: 25.3.5 -> 26.0.0 --- pkgs/by-name/db/dbeaver-bin/package.nix | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/pkgs/by-name/db/dbeaver-bin/package.nix b/pkgs/by-name/db/dbeaver-bin/package.nix index ad0d6a2e6a60..f616f0634893 100644 --- a/pkgs/by-name/db/dbeaver-bin/package.nix +++ b/pkgs/by-name/db/dbeaver-bin/package.nix @@ -19,7 +19,7 @@ stdenvNoCC.mkDerivation (finalAttrs: { pname = "dbeaver-bin"; - version = "25.3.5"; + version = "26.0.0"; src = let @@ -32,10 +32,10 @@ stdenvNoCC.mkDerivation (finalAttrs: { aarch64-darwin = "macos-aarch64.dmg"; }; hash = selectSystem { - x86_64-linux = "sha256-pUjLM2tPIVuGiYpv0UgfUnINPRxzdbBvAPfeX4Vsrn8="; - aarch64-linux = "sha256-26RZrqpciHOgn6CGJhrxvyghxaIDojv1GkC7Df9KwyA="; - x86_64-darwin = "sha256-GWro2heKUny7psNym2bA8m8Hvk96GiDVhYDG9wgoJig="; - aarch64-darwin = "sha256-K2gjVHKYSLwAl0JuaZy5ZDLEXpsmHHLPfZUkuuTUoo4="; + x86_64-linux = "sha256-Q0ayo6iqdn6U/qR27SO/RXNVlal8T1dbC2HzSMhMrpc="; + aarch64-linux = "sha256-V+5lIGjJK6SPvrYdAgiFFEPB6Ymu+FAV4/kHYzIITFM="; + x86_64-darwin = "sha256-G1Xv4nucb0uCjboS1rvtfy6ri0oHPHZmu+jea9PC6Q4="; + aarch64-darwin = "sha256-WzHVhabcIXnodiXB/5fFCu97YcPibB6N21m/7T8/aqo="; }; in fetchurl { From 88f90197b6e10522f001718a19b33b8814618153 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Sat, 7 Mar 2026 23:51:33 +0000 Subject: [PATCH 37/50] python3Packages.losant-rest: 2.1.1 -> 2.1.3 --- pkgs/development/python-modules/losant-rest/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/python-modules/losant-rest/default.nix b/pkgs/development/python-modules/losant-rest/default.nix index 74755c3abfd6..e841c1b83c90 100644 --- a/pkgs/development/python-modules/losant-rest/default.nix +++ b/pkgs/development/python-modules/losant-rest/default.nix @@ -10,14 +10,14 @@ buildPythonPackage (finalAttrs: { pname = "losant-rest"; - version = "2.1.1"; + version = "2.1.3"; pyproject = true; src = fetchFromGitHub { owner = "Losant"; repo = "losant-rest-python"; tag = "v${finalAttrs.version}"; - hash = "sha256-B4r3ZCXt3jC/8vtBzct1HEBuMq9NpF2qOlmlhZk9a3Q="; + hash = "sha256-aIp1Rh91J78v6HoA8FPtI6xrr7Ld4sf1VRk/EP1Y5vg="; }; build-system = [ setuptools ]; From 0e073cbc7b130486c8e2e357a3727020258454b6 Mon Sep 17 00:00:00 2001 From: Gaetan Lepage Date: Sun, 8 Mar 2026 00:09:49 +0000 Subject: [PATCH 38/50] python3Packages.pytensor: 2.38.1 -> 2.38.2 Diff: https://github.com/pymc-devs/pytensor/compare/rel-2.38.1...rel-2.38.2 Changelog: https://github.com/pymc-devs/pytensor/releases/tag/rel-2.38.2 --- pkgs/development/python-modules/pytensor/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/python-modules/pytensor/default.nix b/pkgs/development/python-modules/pytensor/default.nix index c14440b5ae60..4b318865257d 100644 --- a/pkgs/development/python-modules/pytensor/default.nix +++ b/pkgs/development/python-modules/pytensor/default.nix @@ -33,7 +33,7 @@ buildPythonPackage (finalAttrs: { pname = "pytensor"; - version = "2.38.1"; + version = "2.38.2"; pyproject = true; src = fetchFromGitHub { @@ -43,7 +43,7 @@ buildPythonPackage (finalAttrs: { postFetch = '' sed -i 's/git_refnames = "[^"]*"/git_refnames = " (tag: ${finalAttrs.src.tag})"/' $out/pytensor/_version.py ''; - hash = "sha256-Ye88hXOLkUh/BVYvvDG9dB3hq+xO5bE5jU9IDdCyuv0="; + hash = "sha256-BKyaApIijxuJ0gNNXqahDOMW3rpF6+qgoCEpWj6Uz5g="; }; build-system = [ From 095771691fd560d0bf3b4f7e46a95403a34270fa Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Sun, 8 Mar 2026 01:12:24 +0000 Subject: [PATCH 39/50] python3Packages.rigour: 1.7.2 -> 1.7.4 --- pkgs/development/python-modules/rigour/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/python-modules/rigour/default.nix b/pkgs/development/python-modules/rigour/default.nix index d655c994d47d..ae5b8a296640 100644 --- a/pkgs/development/python-modules/rigour/default.nix +++ b/pkgs/development/python-modules/rigour/default.nix @@ -21,14 +21,14 @@ buildPythonPackage rec { pname = "rigour"; - version = "1.7.2"; + version = "1.7.4"; pyproject = true; src = fetchFromGitHub { owner = "opensanctions"; repo = "rigour"; tag = "v${version}"; - hash = "sha256-AiyAZaAQ3r4gJbtkuduU4t56BkP/KPxU2F3pcOqCJH8="; + hash = "sha256-YvxyKWkhiujVvrFpWd2JMf5+v81ugioCViHCt9AcNCM="; }; build-system = [ From 9dd862993434fae417aaae6e78c6c0d562f430f1 Mon Sep 17 00:00:00 2001 From: sudoforge Date: Sat, 7 Mar 2026 18:37:14 -0800 Subject: [PATCH 40/50] python3Packages.mdformat-toc: remove broken attribute This was set as broken due to a test failure in an mdformat plugin [0], which has now been fixed. [0]: https://github.com/KyleKing/mdformat-admon/issues/25 --- pkgs/development/python-modules/mdformat-toc/default.nix | 1 - 1 file changed, 1 deletion(-) diff --git a/pkgs/development/python-modules/mdformat-toc/default.nix b/pkgs/development/python-modules/mdformat-toc/default.nix index f1929b1191f7..1d58102fc581 100644 --- a/pkgs/development/python-modules/mdformat-toc/default.nix +++ b/pkgs/development/python-modules/mdformat-toc/default.nix @@ -35,6 +35,5 @@ buildPythonPackage rec { aldoborrero polarmutex ]; - broken = true; # broken test due to changes in mdformat; compare https://github.com/KyleKing/mdformat-admon/issues/25 }; } From 49a299baa19ff832f90251db649e7339022bd6e0 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Sun, 8 Mar 2026 03:58:50 +0000 Subject: [PATCH 41/50] terminal-toys: 0.6.0 -> 0.7.0 --- pkgs/by-name/te/terminal-toys/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/te/terminal-toys/package.nix b/pkgs/by-name/te/terminal-toys/package.nix index a17067709fda..c3c244ebc193 100644 --- a/pkgs/by-name/te/terminal-toys/package.nix +++ b/pkgs/by-name/te/terminal-toys/package.nix @@ -8,16 +8,16 @@ rustPlatform.buildRustPackage (finalAttrs: { pname = "terminal-toys"; - version = "0.6.0"; + version = "0.7.0"; src = fetchFromGitHub { owner = "Seebass22"; repo = "terminal-toys"; tag = "v${finalAttrs.version}"; - hash = "sha256-42NaTYEerkhexsmG6WEaC9uEC+YCJsShVlAsQFT4eJ0="; + hash = "sha256-WIgi1rW2FH+WfHqloSXD2qbz9x8AWLm/wuucTY/jPHQ="; }; - cargoHash = "sha256-/L0JQDyjn5xuWIrx4EM2+uTbQt6uuOTHE27xfhmUjjY="; + cargoHash = "sha256-QgwDRVzIS/pc5wb/M6asl6yjERCdDqh4VuyYI0eL+3g="; doInstallCheck = true; nativeInstallCheckInputs = [ versionCheckHook ]; From c77f9ff24e56e4e15b64bb3d3e76fafa78a0671f Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Sun, 8 Mar 2026 05:32:38 +0000 Subject: [PATCH 42/50] crush: 0.47.0 -> 0.47.2 --- pkgs/by-name/cr/crush/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/cr/crush/package.nix b/pkgs/by-name/cr/crush/package.nix index 1ddf73c7fed4..1ffea7aff27f 100644 --- a/pkgs/by-name/cr/crush/package.nix +++ b/pkgs/by-name/cr/crush/package.nix @@ -9,16 +9,16 @@ buildGo126Module (finalAttrs: { pname = "crush"; - version = "0.47.0"; + version = "0.47.2"; src = fetchFromGitHub { owner = "charmbracelet"; repo = "crush"; tag = "v${finalAttrs.version}"; - hash = "sha256-Gv1Z2Drtl9zFgGsAvr2YBRP/M4AN7wpr062zz6jCFJA="; + hash = "sha256-Lmp2DYrlzxVnll9x1jcnw/QgYjhA9RHpciQZ7mAUK5Y="; }; - vendorHash = "sha256-EpuGHLFi3B+8ZkQiJYGAUjHELz86YDuSE5OCRdie2B4="; + vendorHash = "sha256-pBZdmQRnPfvhz66+DGQx/ZMMiYeKBfWThybw4RXsjno="; ldflags = [ "-s" From 057aa8b485de23262ecc632a24dc7a55f77b83f1 Mon Sep 17 00:00:00 2001 From: "Peter H. Hoeg" Date: Sun, 8 Mar 2026 08:27:17 +0100 Subject: [PATCH 43/50] kdePackages.k{guiaddons,irigami,service}: 6.23.0 -> 6.23.1 Fixes for a number of crashing bugs in 6.23.0 --- pkgs/kde/generated/sources/frameworks.json | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/pkgs/kde/generated/sources/frameworks.json b/pkgs/kde/generated/sources/frameworks.json index dc5eed86612e..b9b2b1d48f9c 100644 --- a/pkgs/kde/generated/sources/frameworks.json +++ b/pkgs/kde/generated/sources/frameworks.json @@ -145,9 +145,9 @@ "hash": "sha256-V2AzDorrgVQsRMlMJsEJ90t4V8fGuVPWjTTnB5tt9ww=" }, "kguiaddons": { - "version": "6.23.0", - "url": "mirror://kde/stable/frameworks/6.23/kguiaddons-6.23.0.tar.xz", - "hash": "sha256-ucWtn9j9iu/yrgGxMXoNrTAR5CWeUOTy5Whf7gAEe0g=" + "version": "6.23.1", + "url": "mirror://kde/stable/frameworks/6.23/kguiaddons-6.23.1.tar.xz", + "hash": "sha256-ZSnIiUWrIWNU2pdepluYbakm3cgtaJVw3D7eA87a+/o=" }, "kholidays": { "version": "6.23.0", @@ -180,9 +180,9 @@ "hash": "sha256-Yp5Z8PAHuKGfxtr045pQQ7MPVl7rUBBIEmQiUG0065c=" }, "kirigami": { - "version": "6.23.0", - "url": "mirror://kde/stable/frameworks/6.23/kirigami-6.23.0.tar.xz", - "hash": "sha256-jcKNQGvgbTYNR+gBPhPWM7jCz7A2B/SQKbtF/9vSiRA=" + "version": "6.23.1", + "url": "mirror://kde/stable/frameworks/6.23/kirigami-6.23.1.tar.xz", + "hash": "sha256-X2E0q0wA50WtWifK7l+5pBedOv8Du5cqzAZ8WX9Z95Y=" }, "kitemmodels": { "version": "6.23.0", @@ -250,9 +250,9 @@ "hash": "sha256-oC2zDvjJh7rmf0Uo78iRdHPgtSFrkVQaK3QYao/mdE8=" }, "kservice": { - "version": "6.23.0", - "url": "mirror://kde/stable/frameworks/6.23/kservice-6.23.0.tar.xz", - "hash": "sha256-79Vr9o/i/rGTmgUFYuQD2WJKdOuV3HwmTDgGgAz7LVM=" + "version": "6.23.1", + "url": "mirror://kde/stable/frameworks/6.23/kservice-6.23.1.tar.xz", + "hash": "sha256-BRraRQrjNIQPbjb9gXKVk95qnXFSNy+sd7LXwCtYPc0=" }, "kstatusnotifieritem": { "version": "6.23.0", From aea4955c4401685aece2e839e25616c739b59d33 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Sun, 8 Mar 2026 08:37:38 +0000 Subject: [PATCH 44/50] python3Packages.pytest-check: 2.7.1 -> 2.7.6 --- pkgs/development/python-modules/pytest-check/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/python-modules/pytest-check/default.nix b/pkgs/development/python-modules/pytest-check/default.nix index 704ddf59e282..e87a8a366cb1 100644 --- a/pkgs/development/python-modules/pytest-check/default.nix +++ b/pkgs/development/python-modules/pytest-check/default.nix @@ -9,13 +9,13 @@ buildPythonPackage rec { pname = "pytest-check"; - version = "2.7.1"; + version = "2.7.6"; pyproject = true; src = fetchPypi { pname = "pytest_check"; inherit version; - hash = "sha256-7jTNoczFAF3inFP7ztPWXXFLtTbZD1aSdI8fFN+p90U="; + hash = "sha256-D3Rd9Jrsg9b4DVPrnTqRlba5lhNHeb8QWUvItG2X+Bg="; }; build-system = [ hatchling ]; From 3b60e6e630cd83c34b33a56782e24eaeeafeda51 Mon Sep 17 00:00:00 2001 From: Fabian Affolter Date: Sun, 8 Mar 2026 10:20:48 +0100 Subject: [PATCH 45/50] xnldorker: init at 4.1 Gather results of dorks across a number of search engines https://github.com/xnl-h4ck3r/xnldorker --- pkgs/by-name/xn/xnldorker/package.nix | 53 +++++++++++++++++++++++++++ 1 file changed, 53 insertions(+) create mode 100644 pkgs/by-name/xn/xnldorker/package.nix diff --git a/pkgs/by-name/xn/xnldorker/package.nix b/pkgs/by-name/xn/xnldorker/package.nix new file mode 100644 index 000000000000..44666da707b1 --- /dev/null +++ b/pkgs/by-name/xn/xnldorker/package.nix @@ -0,0 +1,53 @@ +{ + lib, + python3, + fetchFromGitHub, + writableTmpDirAsHomeHook, +}: + +python3.pkgs.buildPythonApplication (finalAttrs: { + pname = "xnldorker"; + version = "4.1"; + pyproject = true; + + src = fetchFromGitHub { + owner = "xnl-h4ck3r"; + repo = "xnldorker"; + tag = "v${finalAttrs.version}"; + hash = "sha256-k0nTY3n5g7cNsVVWDcdFpCjQVJCErPp/21iz2R/TTGs="; + }; + + pythonRemoveDeps = [ + # https://github.com/xnl-h4ck3r/xnldorker/pull/11 + "asyncio" + ]; + + build-system = with python3.pkgs; [ setuptools ]; + + nativeBuildInputs = [ writableTmpDirAsHomeHook ]; + + dependencies = with python3.pkgs; [ + beautifulsoup4 + playwright + pyyaml + requests + termcolor + tldextract + urllib3 + ]; + + # Project has no tests + doCheck = false; + + pythonImportsCheck = [ "xnldorker" ]; + + meta = { + description = "Gather results of dorks across a number of search engines"; + homepage = "https://github.com/xnl-h4ck3r/xnldorker"; + changelog = "https://github.com/xnl-h4ck3r/xnldorker/blob/${finalAttrs.src.rev}/CHANGELOG.md"; + # https://github.com/xnl-h4ck3r/xnldorker/issues/10 + license = lib.licenses.unfree; + maintainers = with lib.maintainers; [ fab ]; + mainProgram = "xnldorker"; + }; +}) From 322c6ae459b6179ebc51eed46ca8caced68d5137 Mon Sep 17 00:00:00 2001 From: Fabian Affolter Date: Fri, 6 Mar 2026 13:54:36 +0100 Subject: [PATCH 46/50] tlsanalyzer: init at 0.2.2 TLS/SSL security analyzer for quantum readiness assessment and CNSA 2.0 compliance https://github.com/csnp/tls-analyzer --- pkgs/by-name/tl/tlsanalyzer/package.nix | 44 +++++++++++++++++++++++++ 1 file changed, 44 insertions(+) create mode 100644 pkgs/by-name/tl/tlsanalyzer/package.nix diff --git a/pkgs/by-name/tl/tlsanalyzer/package.nix b/pkgs/by-name/tl/tlsanalyzer/package.nix new file mode 100644 index 000000000000..4eec25970fb5 --- /dev/null +++ b/pkgs/by-name/tl/tlsanalyzer/package.nix @@ -0,0 +1,44 @@ +{ + lib, + buildGoModule, + fetchFromGitHub, + versionCheckHook, +}: + +buildGoModule (finalAttrs: { + pname = "tlsanalyzer"; + version = "0.2.2"; + + src = fetchFromGitHub { + owner = "csnp"; + repo = "tls-analyzer"; + tag = "v${finalAttrs.version}"; + hash = "sha256-JrQqsDeucekAIc4gXGF5F2iq5UlHG3o6b43zwMdkzTs="; + }; + + vendorHash = "sha256-CPdAinTb3Yd7dPvDiTHrKk/xeJnO0aAYETWMkf34yWI="; + + ldflags = [ + "-s" + "-X=main.version=${finalAttrs.version}" + "-X=main.commit=${finalAttrs.src.rev}" + "-X=main.date=1970-01-01T00:00:00Z" + ]; + + nativeInstallCheckInputs = [ versionCheckHook ]; + + subPackages = [ "cmd/tlsanalyzer/" ]; + + doInstallCheck = true; + + versionCheckProgramArg = [ "version" ]; + + meta = { + description = "TLS/SSL security analyzer for quantum readiness assessment and CNSA 2.0 compliance"; + homepage = "https://github.com/csnp/tls-analyzer"; + changelog = "https://github.com/csnp/tls-analyzer/releases/tag/${finalAttrs.src.rev}"; + license = lib.licenses.mit; + maintainers = with lib.maintainers; [ fab ]; + mainProgram = "tlsanalyzer"; + }; +}) From 267664ed3b4329ede87755953828f5c210574d05 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Sun, 8 Mar 2026 09:27:24 +0000 Subject: [PATCH 47/50] python3Packages.python-roborock: 4.17.2 -> 4.18.1 --- pkgs/development/python-modules/python-roborock/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/python-modules/python-roborock/default.nix b/pkgs/development/python-modules/python-roborock/default.nix index 68ad8649ec4e..381a9992533e 100644 --- a/pkgs/development/python-modules/python-roborock/default.nix +++ b/pkgs/development/python-modules/python-roborock/default.nix @@ -23,14 +23,14 @@ buildPythonPackage (finalAttrs: { pname = "python-roborock"; - version = "4.17.2"; + version = "4.18.1"; pyproject = true; src = fetchFromGitHub { owner = "Python-roborock"; repo = "python-roborock"; tag = "v${finalAttrs.version}"; - hash = "sha256-u4By7GmCvFrAnVVkFeoJCRX3Pey3Z3OF6uM+u9RTi7E="; + hash = "sha256-5ckpRKwrLkjIAUJiXIRN2N9268pzjEjwVPVK/wSolgE="; }; pythonRelaxDeps = [ "pycryptodome" ]; From f6080789f022ca9be9a0b488cc92bbc2ca90b262 Mon Sep 17 00:00:00 2001 From: Fabian Affolter Date: Fri, 6 Mar 2026 13:18:06 +0100 Subject: [PATCH 48/50] cryptoscan: init at 1.3.0 Cryptographic Discovery Scanner https://github.com/csnp/cryptoscan --- pkgs/by-name/cr/cryptoscan/package.nix | 44 ++++++++++++++++++++++++++ 1 file changed, 44 insertions(+) create mode 100644 pkgs/by-name/cr/cryptoscan/package.nix diff --git a/pkgs/by-name/cr/cryptoscan/package.nix b/pkgs/by-name/cr/cryptoscan/package.nix new file mode 100644 index 000000000000..eb4744aaeb75 --- /dev/null +++ b/pkgs/by-name/cr/cryptoscan/package.nix @@ -0,0 +1,44 @@ +{ + lib, + buildGoModule, + fetchFromGitHub, + versionCheckHook, +}: + +buildGoModule (finalAttrs: { + pname = "cryptoscan"; + version = "1.3.0"; + + src = fetchFromGitHub { + owner = "csnp"; + repo = "cryptoscan"; + tag = "v${finalAttrs.version}"; + hash = "sha256-VHr3ZBYzmol3malv1fXQ22bChd4JF7iATp7OhJuLc24="; + }; + + vendorHash = "sha256-komX1AmHt2NoF1x6xsNa2RFkfVzOXfYEMPhT0zwMxjw="; + + ldflags = [ + "-s" + "-X=main.version=${finalAttrs.version}" + "-X=main.commit=${finalAttrs.src.rev}" + "-X=main.date=1970-01-01T00:00:00Z" + ]; + + nativeInstallCheckInputs = [ versionCheckHook ]; + + subPackages = [ "cmd/cryptoscan/" ]; + + doInstallCheck = true; + + versionCheckProgramArg = [ "version" ]; + + meta = { + description = "Cryptographic Discovery Scanner"; + homepage = "https://github.com/csnp/cryptoscan"; + changelog = "https://github.com/csnp/cryptoscan/releases/tag/${finalAttrs.src.rev}"; + license = lib.licenses.asl20; + maintainers = with lib.maintainers; [ fab ]; + mainProgram = "cryptoscan"; + }; +}) From 32e65f40a7f262131de919927e860ccd5f5175d4 Mon Sep 17 00:00:00 2001 From: Fabian Affolter Date: Fri, 6 Mar 2026 12:48:16 +0100 Subject: [PATCH 49/50] mini-pqc: init at 0.1.5-unstable-2025-09-17 Command-line tool that helps to assess quantum readiness https://github.com/oferzinger/mini-pqc-scanner --- pkgs/by-name/mi/mini-pqc/package.nix | 36 ++++++++++++++++++++++++++++ 1 file changed, 36 insertions(+) create mode 100644 pkgs/by-name/mi/mini-pqc/package.nix diff --git a/pkgs/by-name/mi/mini-pqc/package.nix b/pkgs/by-name/mi/mini-pqc/package.nix new file mode 100644 index 000000000000..fa5a0133c575 --- /dev/null +++ b/pkgs/by-name/mi/mini-pqc/package.nix @@ -0,0 +1,36 @@ +{ + lib, + buildGoModule, + fetchFromGitHub, +}: + +buildGoModule (finalAttrs: { + pname = "mini-pqc"; + version = "0.1.5-unstable-2025-09-17"; + + src = fetchFromGitHub { + owner = "oferzinger"; + repo = "mini-pqc-scanner"; + rev = "c9c730397109f8a5a73201b4ba958aa437571279"; + hash = "sha256-l+Wu4iDjjupMY4EFRdZfy7mZ6n6eKFvv16bs89FG2o8="; + }; + + vendorHash = "sha256-UO22uxPV8fqGix/8Nx5mLIQl8Y7fWE8ze7fbtoAehJE="; + + ldflags = [ + "-s" + "-X=main.version=${finalAttrs.version}" + ]; + + postInstall = '' + mv $out/bin/cmd $out/bin/$pname + ''; + + meta = { + description = "Command-line tool that helps to assess quantum readiness"; + homepage = "https://github.com/oferzinger/mini-pqc-scanner"; + license = lib.licenses.gpl3Only; + maintainers = with lib.maintainers; [ fab ]; + mainProgram = "mini-pqc"; + }; +}) From 975172926bbf00069d77bf26f5105aaba5e91e80 Mon Sep 17 00:00:00 2001 From: Fabian Affolter Date: Fri, 6 Mar 2026 12:34:08 +0100 Subject: [PATCH 50/50] trajan: init at 1.0.0 Multi-platform CI/CD vulnerability detection and attack automation tool https://github.com/praetorian-inc/trajan --- pkgs/by-name/tr/trajan/package.nix | 42 ++++++++++++++++++++++++++++++ 1 file changed, 42 insertions(+) create mode 100644 pkgs/by-name/tr/trajan/package.nix diff --git a/pkgs/by-name/tr/trajan/package.nix b/pkgs/by-name/tr/trajan/package.nix new file mode 100644 index 000000000000..0c15022131fb --- /dev/null +++ b/pkgs/by-name/tr/trajan/package.nix @@ -0,0 +1,42 @@ +{ + lib, + buildGoModule, + fetchFromGitHub, + versionCheckHook, +}: + +buildGoModule (finalAttrs: { + pname = "trajan"; + version = "1.0.0"; + + src = fetchFromGitHub { + owner = "praetorian-inc"; + repo = "trajan"; + tag = "v${finalAttrs.version}"; + hash = "sha256-ji4IkImpDRQr8BuJCIqRfxyEWFD3Ux99D5lP3ALt+OQ="; + }; + + vendorHash = "sha256-Vr9MkEJZOIrryhGOWrUq76J8B7+2bzf5BOV4omVDIY8="; + + nativeInstallCheckInputs = [ versionCheckHook ]; + + ldflags = [ + "-s" + "-X=main.Version=${finalAttrs.version}" + "-X=main.GitCommit=${finalAttrs.src.rev}" + "-X=main.BuildDate=1970-01-01T00:00:00Z" + ]; + + doInstallCheck = true; + + versionCheckProgramArg = [ "version" ]; + + meta = { + description = "Multi-platform CI/CD vulnerability detection and attack automation tool"; + homepage = "https://github.com/praetorian-inc/trajan"; + changelog = "https://github.com/praetorian-inc/trajan/releases/tag/v${finalAttrs.src.rev}"; + license = lib.licenses.asl20; + maintainers = with lib.maintainers; [ fab ]; + mainProgram = "trajan"; + }; +})