From aaba92e0cc6e37c4ef9eb951ac9b94bae9034ecf Mon Sep 17 00:00:00 2001 From: a-kenji Date: Fri, 19 Jun 2026 16:50:30 +0200 Subject: [PATCH 01/15] nixos-test-driver: reintroduce `--test-script` flag Restore the ability to pass a test script on the command line through: ``` --test-script [PATH] ``` which was possible prior to its removal in: f1bcb61731224bd8440510fc620d3c51f3e51c85 I have found the flag to be quite practical for NixOS test iteration and propose hereby to reintroduce it again. While it is still possible without this flag to pass an external test script, it now needs to be done through the indirection of a `--config` configuration file - which now has to have configuration which points towards the test script, which adds enough friction as to not make it ergonomic anymore. The `--test-script` flag overwrites the configuration from the test config. --- nixos/lib/test-driver/src/test_driver/__init__.py | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/nixos/lib/test-driver/src/test_driver/__init__.py b/nixos/lib/test-driver/src/test_driver/__init__.py index 62c2a6073e6c..3e0588bf7bce 100644 --- a/nixos/lib/test-driver/src/test_driver/__init__.py +++ b/nixos/lib/test-driver/src/test_driver/__init__.py @@ -88,6 +88,11 @@ def main() -> None: type=Path, required=True, ) + arg_parser.add_argument( + "--test-script", + help="path to a test script to run, taking precedence over the one defined in the config file", + type=Path, + ) arg_parser.add_argument( "--keep-vm-state", help=argparse.SUPPRESS, @@ -162,8 +167,12 @@ def main() -> None: if args.debug_hook_attach is not None: debugger = Debug(logger, args.debug_hook_attach) + config = load_driver_configuration(args.config) + if args.test_script is not None: + config.test_script = args.test_script + with Driver( - config=load_driver_configuration(args.config), + config=config, out_dir=output_directory, logger=logger, keep_machine_state=args.keep_machine_state, From 3d32e0705a3e04ef756b6852364ac273ff67b23f Mon Sep 17 00:00:00 2001 From: Grimmauld Date: Mon, 13 Jul 2026 19:45:58 +0200 Subject: [PATCH 02/15] nixos/pam: remove explicit hardcoded yescrypt Both `pam_unix.so` and `pam_unix_ng.so` look at `ENCRYPT_METHOD` in `/etc/login.defs` to determine the algorithm to use for password encryption: https://github.com/thkukuk/account-utils/blob/66fbd0382be49d99cb70410a4696c796684ffbf8/src/pam_unix_ng-common.c#L27-L62 If this is not set, both already default to `YESCRYPT`. The shadow module makes this configurable via `security.loginDefs.settings.ENCRYPT_METHOD`, which also defaults to `YESCRYPT`. Seeing as what was previously hardcoded is default anyways, with a global configuration option to change it, there is no point to keep this. --- nixos/modules/security/pam.nix | 1 - nixos/modules/services/display-managers/gdm.nix | 1 - nixos/modules/services/x11/display-managers/lightdm.nix | 1 - 3 files changed, 3 deletions(-) diff --git a/nixos/modules/security/pam.nix b/nixos/modules/security/pam.nix index 96fce08754c9..356aa3b8cbd2 100644 --- a/nixos/modules/security/pam.nix +++ b/nixos/modules/security/pam.nix @@ -1422,7 +1422,6 @@ let modulePath = config.security.pam.pam_unixModulePath; settings = { nullok = true; - yescrypt = lib.mkIf config.security.pam.enableLegacySettings true; }; } { diff --git a/nixos/modules/services/display-managers/gdm.nix b/nixos/modules/services/display-managers/gdm.nix index c6d5c9337e10..1b3705a2787a 100644 --- a/nixos/modules/services/display-managers/gdm.nix +++ b/nixos/modules/services/display-managers/gdm.nix @@ -577,7 +577,6 @@ in control = "requisite"; modulePath = "${config.security.pam.package}/lib/security/pam_unix.so"; settings.nullok = true; - settings.yescrypt = true; } ]; diff --git a/nixos/modules/services/x11/display-managers/lightdm.nix b/nixos/modules/services/x11/display-managers/lightdm.nix index 699a9a9a07f3..e1384e560e30 100644 --- a/nixos/modules/services/x11/display-managers/lightdm.nix +++ b/nixos/modules/services/x11/display-managers/lightdm.nix @@ -456,7 +456,6 @@ in control = "requisite"; modulePath = "${config.security.pam.package}/lib/security/pam_unix.so"; settings.nullok = true; - settings.yescrypt = true; } ]; From 56f89898daebb29e85eb6bd62329b8e9469e28c3 Mon Sep 17 00:00:00 2001 From: Grimmauld Date: Mon, 13 Jul 2026 20:10:25 +0200 Subject: [PATCH 03/15] nixos/tests/login{,-nosuid}: assert yescrypt password format --- nixos/tests/login-nosuid.nix | 1 + nixos/tests/login.nix | 1 + 2 files changed, 2 insertions(+) diff --git a/nixos/tests/login-nosuid.nix b/nixos/tests/login-nosuid.nix index 1f00c37d0886..69d11803387f 100644 --- a/nixos/tests/login-nosuid.nix +++ b/nixos/tests/login-nosuid.nix @@ -49,6 +49,7 @@ with subtest("create user"): machine.succeed("useradd -m alice") machine.succeed("(echo foobar; echo foobar) | passwd alice") + machine.succeed("grep -F 'alice:$y$' /etc/shadow") with subtest("Check whether switching VTs works"): machine.fail("pgrep -f 'agetty.*tty2'") diff --git a/nixos/tests/login.nix b/nixos/tests/login.nix index bd0d3b7bc005..0eb0f8bf6ee3 100644 --- a/nixos/tests/login.nix +++ b/nixos/tests/login.nix @@ -28,6 +28,7 @@ with subtest("create user"): machine.succeed("useradd -m alice") machine.succeed("(echo foobar; echo foobar) | passwd alice") + machine.succeed("grep -F 'alice:$y$' /etc/shadow") with subtest("Check whether switching VTs works"): machine.fail("pgrep -f 'agetty.*tty2'") From 00c97895aa823459f6326c3dd83e6da7bebcf5b8 Mon Sep 17 00:00:00 2001 From: Jacek Galowicz Date: Mon, 13 Jul 2026 09:47:36 +0200 Subject: [PATCH 04/15] qemu_test: Remove hostCpuOnly flag --- pkgs/top-level/all-packages.nix | 1 - 1 file changed, 1 deletion(-) diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index 73ab09a75de3..24cd14a30caa 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -8022,7 +8022,6 @@ with pkgs; qemu_test = lowPrio ( qemu.override { - hostCpuOnly = true; nixosTestRunner = true; } ); From 02b0484ccce67fd38a6e35529af79b94fac92895 Mon Sep 17 00:00:00 2001 From: Jacek Galowicz Date: Mon, 13 Jul 2026 16:58:38 +0200 Subject: [PATCH 05/15] nixos-test-driver: Add multi-arch test --- nixos/tests/all-tests.nix | 1 + .../nixos-test-driver/multi-arch-test.nix | 55 +++++++++++++++++++ 2 files changed, 56 insertions(+) create mode 100644 nixos/tests/nixos-test-driver/multi-arch-test.nix diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix index 7b5ce335f0bf..e08301831793 100644 --- a/nixos/tests/all-tests.nix +++ b/nixos/tests/all-tests.nix @@ -153,6 +153,7 @@ in console-log = runTest ./nixos-test-driver/console-log.nix; containers = runTest ./nixos-test-driver/containers.nix; nspawn-daemon-reexec-dbus = runTest ./nspawn-daemon-reexec-dbus.nix; + multi-arch-test = runTest ./nixos-test-driver/multi-arch-test.nix; skip-typecheck = runTest ./nixos-test-driver/skip-typecheck.nix; console-timeout = runTest ./nixos-test-driver/console-timeout.nix; options-doc-regression = import ./nixos-test-driver/options-doc-regression.nix { inherit pkgs; }; diff --git a/nixos/tests/nixos-test-driver/multi-arch-test.nix b/nixos/tests/nixos-test-driver/multi-arch-test.nix new file mode 100644 index 000000000000..33b9973c7f89 --- /dev/null +++ b/nixos/tests/nixos-test-driver/multi-arch-test.nix @@ -0,0 +1,55 @@ +{ pkgs, lib, ... }: +{ + name = "multi-arch-test"; + meta.maintainers = with pkgs.lib.maintainers; [ tfc ]; + + node.pkgsReadOnly = false; + + nodes = { + # Setting build = host platform because such standard VM setups + # are well-cached by the multi-arch build infrastructure of the + # project. + vmIntel = { + nixpkgs.buildPlatform = "x86_64-linux"; + nixpkgs.hostPlatform = "x86_64-linux"; + }; + vmArm = { + nixpkgs.buildPlatform = "aarch64-linux"; + nixpkgs.hostPlatform = "aarch64-linux"; + }; + }; + + defaults = { + # not needed for this test and shrinks the closure + # because we dont' need qemu for all architectures + virtualisation.qemu.guestAgent.enable = false; + + # the test is already very slow but we don't need DHCP anyway + networking.dhcpcd.enable = false; + + # fix the network-online target, otherwise it doesn't work + # properly as a synchronization mechanism. + systemd.network.wait-online.enable = true; + systemd.network.wait-online.anyInterface = true; + }; + + # slow due to SW emulation but shouldn't be slower than that + globalTimeout = 5 * 60; + + testScript = { nodes, ... }: /* python */ '' + start_all() + + vmIntel.systemctl("start network-online.target") + vmArm.systemctl("start network-online.target") + vmIntel.wait_for_unit("network-online.target") + vmArm.wait_for_unit("network-online.target") + + vmIntel.succeed("ping -c 1 vmArm") + vmArm.succeed("ping -c 1 vmIntel") + + archIntel = vmIntel.succeed("uname -m") + t.assertIn("${nodes.vmIntel.nixpkgs.hostPlatform.qemuArch}", archIntel, "machine1 is an intel VM") + archArm = vmArm.succeed("uname -m") + t.assertIn("${nodes.vmArm.nixpkgs.hostPlatform.qemuArch}", archArm, "machine1 is an ARM VM") + ''; +} From 7ba2995d80ad1bdf937062a6a177926170a03251 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Sat, 18 Jul 2026 07:39:17 +0000 Subject: [PATCH 06/15] btrfs-progs: 7.0 -> 7.1 --- pkgs/by-name/bt/btrfs-progs/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/bt/btrfs-progs/package.nix b/pkgs/by-name/bt/btrfs-progs/package.nix index e5034da09c2e..52d1d0bb827c 100644 --- a/pkgs/by-name/bt/btrfs-progs/package.nix +++ b/pkgs/by-name/bt/btrfs-progs/package.nix @@ -21,11 +21,11 @@ stdenv.mkDerivation (finalAttrs: { pname = "btrfs-progs"; - version = "7.0"; + version = "7.1"; src = fetchurl { url = "mirror://kernel/linux/kernel/people/kdave/btrfs-progs/btrfs-progs-v${finalAttrs.version}.tar.xz"; - hash = "sha256-wobWh2y81yMnoLQX5M/SgDU+wj43tUn9vNeACoMtmpk="; + hash = "sha256-0fVcwpcTmMkULqp50gPmPVhqO0uGf5VmZKHWgyLNTjQ="; }; nativeBuildInputs = [ From fc4bc79dcb83505409d0fb4904585cfe203e2750 Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Tue, 21 Jul 2026 00:02:10 +0200 Subject: [PATCH 07/15] openresolv: add changelog url pattern --- pkgs/by-name/op/openresolv/package.nix | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/op/openresolv/package.nix b/pkgs/by-name/op/openresolv/package.nix index b487493675ce..35922bde47ca 100644 --- a/pkgs/by-name/op/openresolv/package.nix +++ b/pkgs/by-name/op/openresolv/package.nix @@ -13,8 +13,8 @@ stdenv.mkDerivation (finalAttrs: { src = fetchFromGitHub { owner = "NetworkConfiguration"; repo = "openresolv"; - rev = "v${finalAttrs.version}"; - sha256 = "sha256-I86BHiSI3G4xlYRJC99elHw8RyUd3eHdkV5kiEGRXNE="; + tag = "v${finalAttrs.version}"; + hash = "sha256-I86BHiSI3G4xlYRJC99elHw8RyUd3eHdkV5kiEGRXNE="; }; nativeBuildInputs = [ makeWrapper ]; @@ -38,6 +38,7 @@ stdenv.mkDerivation (finalAttrs: { ''; meta = { + changelog = "https://github.com/NetworkConfiguration/openresolv/releases/tag/${finalAttrs.src.tag}"; description = "Program to manage /etc/resolv.conf"; mainProgram = "resolvconf"; homepage = "https://roy.marples.name/projects/openresolv"; From ea676ee75644d9c4e5f39ab92616779c6c6ace88 Mon Sep 17 00:00:00 2001 From: klea Date: Fri, 24 Jul 2026 14:28:46 +0000 Subject: [PATCH 08/15] replaceVarsWith: Allow using pname + version --- pkgs/build-support/replace-vars/replace-vars-with.nix | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/pkgs/build-support/replace-vars/replace-vars-with.nix b/pkgs/build-support/replace-vars/replace-vars-with.nix index abbb9a1cc1a0..d4e126157c7f 100644 --- a/pkgs/build-support/replace-vars/replace-vars-with.nix +++ b/pkgs/build-support/replace-vars/replace-vars-with.nix @@ -122,7 +122,8 @@ in stdenvNoCC.mkDerivation ( { - name = baseNameOf src; + name = + if (attrs ? pname && attrs ? version) then "${attrs.pname}-${attrs.version}" else baseNameOf src; } // optionalAttrs // forcedAttrs From 62a6469796b0f4dbeb575f2dd056197c92b7a12f Mon Sep 17 00:00:00 2001 From: K900 Date: Fri, 24 Jul 2026 18:53:11 +0300 Subject: [PATCH 09/15] linux_7_1: 7.1.4 -> 7.1.5 --- pkgs/os-specific/linux/kernel/kernels-org.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json index 08c27feddb44..47af1c6c6312 100644 --- a/pkgs/os-specific/linux/kernel/kernels-org.json +++ b/pkgs/os-specific/linux/kernel/kernels-org.json @@ -35,8 +35,8 @@ "lts": true }, "7.1": { - "version": "7.1.4", - "hash": "sha256:0blfl34vi6vlcdjxd7mbhskl2p7i0zpgdy707a7d6xcn24m94qqw", + "version": "7.1.5", + "hash": "sha256:1rs162gcf6hsafrrmp3y8k9myn20s3s62xdp4zf39pxw7imik812", "lts": false } } From 147b0344864368d1e0cab9e35c97cf629f41dfe7 Mon Sep 17 00:00:00 2001 From: K900 Date: Fri, 24 Jul 2026 18:53:16 +0300 Subject: [PATCH 10/15] linux_6_18: 6.18.39 -> 6.18.40 --- pkgs/os-specific/linux/kernel/kernels-org.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json index 47af1c6c6312..9a7c53788d3e 100644 --- a/pkgs/os-specific/linux/kernel/kernels-org.json +++ b/pkgs/os-specific/linux/kernel/kernels-org.json @@ -30,8 +30,8 @@ "lts": true }, "6.18": { - "version": "6.18.39", - "hash": "sha256:1c4c3wf00pb8x4kxxrmn46n7mgpnnm78sfi2jx0yg5cxmv9f79x7", + "version": "6.18.40", + "hash": "sha256:0cd42fb4390x73jdzbhacm9g9s0ji58whxhik2ndmr1rr0ggq4ip", "lts": true }, "7.1": { From ebb9d83237f7968dc61247e96001528057dc0fe9 Mon Sep 17 00:00:00 2001 From: K900 Date: Fri, 24 Jul 2026 18:53:37 +0300 Subject: [PATCH 11/15] linux_6_12: 6.12.96 -> 6.12.97 --- pkgs/os-specific/linux/kernel/kernels-org.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json index 9a7c53788d3e..2731e229d21c 100644 --- a/pkgs/os-specific/linux/kernel/kernels-org.json +++ b/pkgs/os-specific/linux/kernel/kernels-org.json @@ -25,8 +25,8 @@ "lts": true }, "6.12": { - "version": "6.12.96", - "hash": "sha256:1hapz6xz7plq56jc0drbzcsfcm1amlnphwbfhl0klsxkb9finbkx", + "version": "6.12.97", + "hash": "sha256:0vswyjh91x52ay99mqrdfhwnvd6nnzv4hpncywk908njpfixzgbc", "lts": true }, "6.18": { From fcc1ed358afb5bd00d2c7c87eb6fe0e81b2508ed Mon Sep 17 00:00:00 2001 From: K900 Date: Fri, 24 Jul 2026 18:53:55 +0300 Subject: [PATCH 12/15] linux_6_6: 6.6.144 -> 6.6.145 --- pkgs/os-specific/linux/kernel/kernels-org.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json index 2731e229d21c..8277b9463332 100644 --- a/pkgs/os-specific/linux/kernel/kernels-org.json +++ b/pkgs/os-specific/linux/kernel/kernels-org.json @@ -20,8 +20,8 @@ "lts": true }, "6.6": { - "version": "6.6.144", - "hash": "sha256:1hzcax2ypzhrjzmq4b0jyqyc4al0ncyfcj9pq36phl29gcqbh6gc", + "version": "6.6.145", + "hash": "sha256:09h1pzcai0i10pdyyfbsmq03rgk1x5wv2d937m5nz2xdv0rhw46y", "lts": true }, "6.12": { From 5f4b90832a6dd02a7559b5da56c16668813d42e8 Mon Sep 17 00:00:00 2001 From: K900 Date: Fri, 24 Jul 2026 18:54:03 +0300 Subject: [PATCH 13/15] linux_6_1: 6.1.177 -> 6.1.178 --- pkgs/os-specific/linux/kernel/kernels-org.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json index 8277b9463332..53c1179d3453 100644 --- a/pkgs/os-specific/linux/kernel/kernels-org.json +++ b/pkgs/os-specific/linux/kernel/kernels-org.json @@ -5,8 +5,8 @@ "lts": false }, "6.1": { - "version": "6.1.177", - "hash": "sha256:0c0ayz4nygcmz4865r7mcgmh7hic4fi7zysnj6vdlyj53bz9nlpn", + "version": "6.1.178", + "hash": "sha256:03vjdk7lk9zgydzamhwvrg066f8748vrfjggqqd2n0vmr9kzm0vx", "lts": true }, "5.15": { From ac51e3d00c178702f79b11c1a5b49402161621bd Mon Sep 17 00:00:00 2001 From: K900 Date: Fri, 24 Jul 2026 18:54:21 +0300 Subject: [PATCH 14/15] linux_5_15: 5.15.211 -> 5.15.212 --- pkgs/os-specific/linux/kernel/kernels-org.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json index 53c1179d3453..669fc387d985 100644 --- a/pkgs/os-specific/linux/kernel/kernels-org.json +++ b/pkgs/os-specific/linux/kernel/kernels-org.json @@ -10,8 +10,8 @@ "lts": true }, "5.15": { - "version": "5.15.211", - "hash": "sha256:0qfry534wl5sbm6b4hf6fxqrr6mzf1k9pa2435sqp4hp6vjm9fdy", + "version": "5.15.212", + "hash": "sha256:1zk51f3pv7ghz68hxkxhds9cjwmk35651pxbyyvyqyhcr7msx5n3", "lts": true }, "5.10": { From cdf7d7fb7fb2b079433f9a53fef1e79730a436a8 Mon Sep 17 00:00:00 2001 From: K900 Date: Fri, 24 Jul 2026 18:54:26 +0300 Subject: [PATCH 15/15] linux_5_10: 5.10.260 -> 5.10.261 --- pkgs/os-specific/linux/kernel/kernels-org.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json index 669fc387d985..df3b586a2b0f 100644 --- a/pkgs/os-specific/linux/kernel/kernels-org.json +++ b/pkgs/os-specific/linux/kernel/kernels-org.json @@ -15,8 +15,8 @@ "lts": true }, "5.10": { - "version": "5.10.260", - "hash": "sha256:113bka32apz5pfqjfnv97k9hf9arkn5asfcd6cw7snsh65qjka27", + "version": "5.10.261", + "hash": "sha256:1i6pzaib30r1nmyxsrhqmfsdxy1jvvlmzc9f8lxzv9a00q8a3751", "lts": true }, "6.6": {