fprintd: 1.94.2 -> 1.94.3

Signed-off-by: Florian Brandes <florian.brandes@posteo.de>

.editorconfig

@@ -44,10 +44,6 @@ indent_size = 4
 indent_size = 2
 indent_style = space
 
-# Match package.json, which are generally pulled from upstream and accept them as they are
-[package.json]
-indent_style = unset
-
 # Disable file types or individual files
 # some of these files may be auto-generated and/or require significant changes
 

.git-blame-ignore-revs

@@ -135,27 +135,3 @@ f8c4a98e8e138e21353a2c33b90db3359f539b37
 acd0e3898feb321cb9a71a0fd376f1157d0f4553
 1b28414d2886c57343864326dbb745a634d3e37d
 6afb255d976f85f3359e4929abd6f5149c323a02
-
-# azure-cli: move to by-name, nixfmt #325950
-96cd538b68bd1d0a0a37979356d669abbba32ebc
-
-# poptracker: format with nixfmt-rfc-style (#326697)
-ff5c8f6cc3d1f2e017e86d50965c14b71f00567b
-
-# mangal: format with nixfmt-rfc-style #328284
-3bb5e993cac3a6e1c3056d2bc9bf43eb2c7a5951
-
-# pico-sdk: switch to finalAttrs (#329438)
-8946018b0391ae594d167f1e58497b18de068968
-
-# ollama: format with nixfmt-rfc-style (#329353)
-bdfde18037f8d9f9b641a4016c8ada4dc4cbf856
-
-# nixos/ollama: format with nixfmt-rfc-style (#329561)
-246d1ee533810ac1946d863bbd9de9b525818d56
-
-# nixos/nvidia: apply nixfmt-rfc-style (#313440)
-fbdcdde04a7caa007e825a8b822c75fab9adb2d6
-
-# step-cli: format package.nix with nixfmt (#331629)
-fc7a83f8b62e90de5679e993d4d49ca014ea013d

.github/CODEOWNERS

@@ -14,7 +14,7 @@
 # CI
 /.github/workflows @NixOS/Security @Mic92 @zowoq
 /.github/workflows/check-nix-format.yml @infinisil
-/ci @infinisil @NixOS/Security
+/ci @infinisil
 
 # Develompent support
 /.editorconfig @Mic92 @zowoq
@@ -267,9 +267,6 @@ pkgs/development/python-modules/buildcatrust/ @ajs124 @lukegb @mweinelt
 /pkgs/applications/editors/emacs                @adisbladis
 /pkgs/top-level/emacs-packages.nix              @adisbladis
 
-# Kakoune
-/pkgs/applications/editors/kakoune     @philiptaron
-
 # Neovim
 /pkgs/applications/editors/neovim      @figsoda @teto
 
@@ -307,11 +304,7 @@ pkgs/development/python-modules/buildcatrust/ @ajs124 @lukegb @mweinelt
 /pkgs/build-support/make-hardcode-gsettings-patch @jtojnar
 
 # Cinnamon
-/pkgs/by-name/ci/cinnamon-*    @mkg20001
-/pkgs/by-name/cj/cjs           @mkg20001
-/pkgs/by-name/mu/muffin        @mkg20001
-/pkgs/by-name/ne/nemo          @mkg20001
-/pkgs/by-name/ne/nemo-*        @mkg20001
+/pkgs/desktops/cinnamon @mkg20001
 
 # nim
 /pkgs/development/compilers/nim   @ehmry
@@ -377,6 +370,7 @@ nixos/tests/lxd/                        @adamcstephens
 pkgs/by-name/in/incus/                  @adamcstephens
 pkgs/by-name/lx/lxc*                    @adamcstephens
 pkgs/by-name/lx/lxd*                    @adamcstephens
+pkgs/os-specific/linux/lxc/             @adamcstephens
 
 # ExpidusOS, Flutter
 /pkgs/development/compilers/flutter @RossComputerGuy

.github/labeler.yml

@@ -12,14 +12,9 @@
   - any:
     - changed-files:
       - any-glob-to-any-file:
+        - pkgs/desktops/cinnamon/**/*
         - nixos/modules/services/x11/desktop-managers/cinnamon.nix
         - nixos/tests/cinnamon.nix
-        - nixos/tests/cinnamon-wayland.nix
-        - pkgs/by-name/ci/cinnamon-*/**/*
-        - pkgs/by-name/cj/cjs/**/*
-        - pkgs/by-name/mu/muffin/**/*
-        - pkgs/by-name/ne/nemo/**/*
-        - pkgs/by-name/ne/nemo-*/**/*
 
 "6.topic: dotnet":
   - any:
@@ -79,13 +74,6 @@
         - lib/systems/flake-systems.nix
         - nixos/modules/config/nix-flakes.nix
 
-"6.topic: flutter":
-  - any:
-    - changed-files:
-      - any-glob-to-any-file:
-        - pkgs/build-support/flutter/*.nix
-        - pkgs/development/compilers/flutter/**/*.nix
-
 "6.topic: GNOME":
   - any:
     - changed-files:
@@ -161,7 +149,7 @@
   - any:
     - changed-files:
       - any-glob-to-any-file:
-        - pkgs/development/compilers/llvm/**/*
+        - pkgs/development/compilers/llvm/*
 
 "6.topic: lua":
   - any:
@@ -350,7 +338,6 @@
         #       *developed in this repo*;
         #       - not individual tests
         #       - not packages for test frameworks
-        - pkgs/build-support/testers/**
         - nixos/lib/testing/**
         - nixos/lib/test-driver/**
         - nixos/tests/nixos-test-driver/**

.github/workflows/backport.yml

@@ -24,7 +24,7 @@ jobs:
         with:
           ref: ${{ github.event.pull_request.head.sha }}
       - name: Create backport PRs
-        uses: korthout/backport-action@bd410d37cdcae80be6d969823ff5a225fe5c833f # v3.0.2
+        uses: korthout/backport-action@ef20d86abccbac3ee3a73cb2efbdc06344c390e5 # v2.5.0
         with:
           # Config README: https://github.com/korthout/backport-action#backport-action
           copy_labels_pattern: 'severity:\ssecurity'

.github/workflows/basic-eval.yml

@@ -15,12 +15,11 @@ permissions:
 
 jobs:
   tests:
-    name: basic-eval-checks
     runs-on: ubuntu-latest
     # we don't limit this action to only NixOS repo since the checks are cheap and useful developer feedback
     steps:
     - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
-    - uses: cachix/install-nix-action@ba0dd844c9180cbf77aa72a116d6fbc515d0e87b # v27
+    - uses: cachix/install-nix-action@8887e596b4ee1134dae06b98d573bd674693f47c # v26
     - uses: cachix/cachix-action@ad2ddac53f961de1989924296a1f236fcfbaa4fc # v15
       with:
         # This cache is for the nixpkgs repo checks and should not be trusted or used elsewhere.

.github/workflows/check-by-name.yml

@@ -27,7 +27,6 @@ permissions: {}
 
 jobs:
   check:
-    name: pkgs-by-name-check
     # This needs to be x86_64-linux, because we depend on the tooling being pre-built in the GitHub releases
     runs-on: ubuntu-latest
     # This should take 1 minute at most, but let's be generous.
@@ -95,7 +94,7 @@ jobs:
           base=$(mktemp -d)
           git worktree add "$base" "$(git rev-parse HEAD^1)"
           echo "base=$base" >> "$GITHUB_ENV"
-      - uses: cachix/install-nix-action@ba0dd844c9180cbf77aa72a116d6fbc515d0e87b # v27
+      - uses: cachix/install-nix-action@8887e596b4ee1134dae06b98d573bd674693f47c # v26
         if: env.mergedSha
       - name: Fetching the pinned tool
         if: env.mergedSha

.github/workflows/check-cherry-picks.yml

@@ -10,7 +10,6 @@ permissions: {}
 
 jobs:
   check:
-    name: cherry-pick-check
     runs-on: ubuntu-latest
     if: github.repository_owner == 'NixOS'
     steps:

.github/workflows/check-maintainers-sorted.yaml

@@ -9,7 +9,6 @@ permissions:
 
 jobs:
   nixos:
-    name: maintainer-list-check
     runs-on: ubuntu-latest
     if: github.repository_owner == 'NixOS'
     steps:
@@ -21,7 +20,7 @@ jobs:
           sparse-checkout: |
             lib
             maintainers
-      - uses: cachix/install-nix-action@ba0dd844c9180cbf77aa72a116d6fbc515d0e87b # v27
+      - uses: cachix/install-nix-action@8887e596b4ee1134dae06b98d573bd674693f47c # v26
         with:
           # explicitly enable sandbox
           extra_nix_config: sandbox = true

.github/workflows/check-nix-format.yml

@@ -7,30 +7,18 @@ name: Check that Nix files are formatted
 
 on:
   pull_request_target:
-    # See the comment at the same location in ./check-by-name.yml
-    types: [opened, synchronize, reopened, edited]
 permissions:
   contents: read
 
 jobs:
   nixos:
-    name: nixfmt-check
     runs-on: ubuntu-latest
-    if: "!contains(github.event.pull_request.title, '[skip treewide]')"
+    if: github.repository_owner == 'NixOS'
     steps:
       - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
         with:
           # pull_request_target checks out the base branch by default
           ref: refs/pull/${{ github.event.pull_request.number }}/merge
-          # Fetches the merge commit and its parents
-          fetch-depth: 2
-      - name: Checking out base branch
-        run: |
-          base=$(mktemp -d)
-          baseRev=$(git rev-parse HEAD^1)
-          git worktree add "$base" "$baseRev"
-          echo "baseRev=$baseRev" >> "$GITHUB_ENV"
-          echo "base=$base" >> "$GITHUB_ENV"
       - name: Get Nixpkgs revision for nixfmt
         run: |
           # pin to a commit from nixpkgs-unstable to avoid e.g. building nixfmt
@@ -38,7 +26,7 @@ jobs:
           # This should not be a URL, because it would allow PRs to run arbitrary code in CI!
           rev=$(jq -r .rev ci/pinned-nixpkgs.json)
           echo "url=https://github.com/NixOS/nixpkgs/archive/$rev.tar.gz" >> "$GITHUB_ENV"
-      - uses: cachix/install-nix-action@ba0dd844c9180cbf77aa72a116d6fbc515d0e87b # v27
+      - uses: cachix/install-nix-action@8887e596b4ee1134dae06b98d573bd674693f47c # v26
         with:
           # explicitly enable sandbox
           extra_nix_config: sandbox = true
@@ -46,44 +34,43 @@ jobs:
       - name: Install nixfmt
         run: "nix-env -f '<nixpkgs>' -iAP nixfmt-rfc-style"
       - name: Check that Nix files are formatted according to the RFC style
+        # Each environment variable beginning with NIX_FMT_PATHS_ is a list of
+        # paths to check with nixfmt.
+        env:
+          NIX_FMT_PATHS_BSD: pkgs/os-specific/bsd
+          NIX_FMT_PATHS_MPVSCRIPTS: pkgs/applications/video/mpv/scripts
+          # Format paths related to the Nixpkgs CUDA ecosystem.
+          NIX_FMT_PATHS_CUDA: |-
+            pkgs/development/cuda-modules
+            pkgs/test/cuda
+            pkgs/top-level/cuda-packages.nix
+          NIX_FMT_PATHS_MAINTAINERS: |-
+            maintainers/maintainer-list.nix
+            maintainers/team-list.nix
+          NIX_FMT_PATHS_K3S: |-
+            nixos/modules/services/cluster/k3s
+            nixos/tests/k3s
+            pkgs/applications/networking/cluster/k3s
+          NIX_FMT_PATHS_VSCODE_EXTS: pkgs/applications/editors/vscode/extensions
+          NIX_FMT_PATHS_PHP_PACKAGES: pkgs/development/php-packages
+          NIX_FMT_PATHS_BUILD_SUPPORT_PHP: pkgs/build-support/php
+        # Iterate over all environment variables beginning with NIX_FMT_PATHS_.
         run: |
-          unformattedFiles=()
-
-          # TODO: Make this more parallel
-
-          # Loop through all Nix files touched by the PR
-          while readarray -d '' -n 2 entry && (( ${#entry[@]} != 0 )); do
-            type=${entry[0]}
-            file=${entry[1]}
-            case $type in
-              A*)
-                source=""
-                dest=$file
-                ;;
-              M*)
-                source=$file
-                dest=$file
-                ;;
-              C*|R*)
-                source=$file
-                read -r -d '' dest
-                ;;
-              *)
-                echo "Ignoring file $file with type $type"
-                continue
-            esac
-
-            # Ignore files that weren't already formatted
-            if [[ -n "$source" ]] && ! nixfmt --check ${{ env.base }}/"$source" 2>/dev/null; then
-              echo "Ignoring file $file because it's not formatted in the base commit"
-            elif ! nixfmt --check "$dest"; then
-              unformattedFiles+=("$dest")
+          unformattedPaths=()
+          for env_var in "${!NIX_FMT_PATHS_@}"; do
+            readarray -t paths <<< "${!env_var}"
+            if [[ "${paths[*]}" == "" ]]; then
+              echo "Error: $env_var is empty."
+              exit 1
             fi
-          done < <(git diff -z --name-status ${{ env.baseRev }} -- '*.nix')
-
-          if (( "${#unformattedFiles[@]}" > 0 )); then
-            echo "Some new/changed Nix files are not properly formatted"
+            echo "Checking paths: ${paths[@]}"
+            if ! nixfmt --check "${paths[@]}"; then
+              unformattedPaths+=("${paths[@]}")
+            fi
+          done
+          if (( "${#unformattedPaths[@]}" > 0 )); then
+            echo "Some required Nix files are not properly formatted"
             echo "Please run the following in \`nix-shell\`:"
-            echo "nixfmt ${unformattedFiles[*]@Q}"
+            echo "nixfmt ${unformattedPaths[*]@Q}"
             exit 1
           fi

.github/workflows/check-nixf-tidy.yml

@@ -1,129 +0,0 @@
-name: Check changed Nix files with nixf-tidy (experimental)
-
-on:
-  pull_request_target:
-    types: [opened, synchronize, reopened, edited]
-permissions:
-  contents: read
-
-jobs:
-  nixos:
-    name: exp-nixf-tidy-check
-    runs-on: ubuntu-latest
-    if: "!contains(github.event.pull_request.title, '[skip treewide]')"
-    steps:
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
-        with:
-          # pull_request_target checks out the base branch by default
-          ref: refs/pull/${{ github.event.pull_request.number }}/merge
-          # Fetches the merge commit and its parents
-          fetch-depth: 2
-      - name: Checking out base branch
-        run: |
-          base=$(mktemp -d)
-          baseRev=$(git rev-parse HEAD^1)
-          git worktree add "$base" "$baseRev"
-          echo "baseRev=$baseRev" >> "$GITHUB_ENV"
-          echo "base=$base" >> "$GITHUB_ENV"
-      - name: Get Nixpkgs revision for nixf
-        run: |
-          # pin to a commit from nixpkgs-unstable to avoid e.g. building nixf
-          # from staging
-          # This should not be a URL, because it would allow PRs to run arbitrary code in CI!
-          rev=$(jq -r .rev ci/pinned-nixpkgs.json)
-          echo "url=https://github.com/NixOS/nixpkgs/archive/$rev.tar.gz" >> "$GITHUB_ENV"
-      - uses: cachix/install-nix-action@ba0dd844c9180cbf77aa72a116d6fbc515d0e87b # v27
-        with:
-          # explicitly enable sandbox
-          extra_nix_config: sandbox = true
-          nix_path: nixpkgs=${{ env.url }}
-      - name: Install nixf and jq
-        # provided jq is incompatible with our expression
-        run: "nix-env -f '<nixpkgs>' -iAP nixf jq"
-      - name: Check that Nix files pass nixf-tidy
-        run: |
-          # Filtering error messages we don't like
-          nixf_wrapper(){
-            nixf-tidy --variable-lookup < "$1" | jq -r '
-              [
-                "sema-escaping-with"
-              ]
-              as $ignored_errors|[.[]|select(.sname as $s|$ignored_errors|index($s)|not)]
-            '
-          }
-
-          failedFiles=()
-
-          # Don't report errors to file overview
-          # to avoid duplicates when editing title and description
-          if [[ "${{ github.event.action }}" == 'edited' ]] && [[ -z "${{ github.event.edited.changes.base }}" ]]; then
-            DONT_REPORT_ERROR=1
-          else
-            DONT_REPORT_ERROR=
-          fi
-          # TODO: Make this more parallel
-
-          # Loop through all Nix files touched by the PR
-          while readarray -d '' -n 2 entry && (( ${#entry[@]} != 0 )); do
-            type=${entry[0]}
-            file=${entry[1]}
-            case $type in
-              A*)
-                source=""
-                dest=$file
-                ;;
-              M*)
-                source=$file
-                dest=$file
-                ;;
-              C*|R*)
-                source=$file
-                read -r -d '' dest
-                ;;
-              *)
-                echo "Ignoring file $file with type $type"
-                continue
-            esac
-
-            if [[ -n "$source" ]] && [[ "$(nixf_wrapper ${{ env.base }}/"$source")" != '[]' ]] 2>/dev/null; then
-              echo "Ignoring file $file because it doesn't pass nixf-tidy in the base commit"
-              echo # insert blank line
-            else
-              nixf_report="$(nixf_wrapper "$dest")"
-              if [[ "$nixf_report" != '[]' ]]; then
-                echo "$dest doesn't pass nixf-tidy. Reported by nixf-tidy:"
-                errors=$(echo "$nixf_report" | jq -r --arg dest "$dest" '
-                  def getLCur: "line=" + (.line+1|tostring) + ",col=" + (.column|tostring);
-                  def getRCur: "endLine=" + (.line+1|tostring) + ",endColumn=" + (.column|tostring);
-                  def getRange: "file=\($dest)," + (.lCur|getLCur) + "," + (.rCur|getRCur);
-                  def getBody: . as $top|(.range|getRange) + ",title="+ .sname + "::" +
-                    (.message|sub("{}" ; ($top.args.[]|tostring)));
-                  def getNote: "\n::notice " + (.|getBody);
-                  def getMessage: "::error " + (.|getBody) + (if (.notes|length)>0 then
-                    ([.notes.[]|getNote]|add) else "" end);
-                  .[]|getMessage
-                ')
-                if [[ -z "$DONT_REPORT_ERROR" ]]; then
-                  echo "$errors"
-                else
-                  # just print in plain text
-                  echo "$errors" | sed 's/^:://'
-                  echo # add one empty line
-                fi
-                failedFiles+=("$dest")
-              fi
-            fi
-          done < <(git diff -z --name-status ${{ env.baseRev }} -- '*.nix')
-
-          if [[ -n "$DONT_REPORT_ERROR" ]]; then
-            echo "Edited the PR but didn't change the base branch, only the description/title."
-            echo "Not reporting errors again to avoid duplication."
-            echo # add one empty line
-          fi
-
-          if (( "${#failedFiles[@]}" > 0 )); then
-            echo "Some new/changed Nix files don't pass nixf-tidy."
-            echo "See ${{ github.event.pull_request.html_url }}/files for reported errors."
-            echo "If you believe this is a false positive, ping @Aleksanaa and @inclyc in this PR."
-            exit 1
-          fi

.github/workflows/check-shell.yml

@@ -7,25 +7,23 @@ permissions: {}
 
 jobs:
   x86_64-linux:
-    name: shell-check-x86_64-linux
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
         with:
           # pull_request_target checks out the base branch by default
           ref: refs/pull/${{ github.event.pull_request.number }}/merge
-      - uses: cachix/install-nix-action@ba0dd844c9180cbf77aa72a116d6fbc515d0e87b # v27
+      - uses: cachix/install-nix-action@8887e596b4ee1134dae06b98d573bd674693f47c # v26
       - name: Build shell
         run: nix-build shell.nix
 
   aarch64-darwin:
-    name: shell-check-aarch64-darwin
     runs-on: macos-latest
     steps:
       - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
         with:
           # pull_request_target checks out the base branch by default
           ref: refs/pull/${{ github.event.pull_request.number }}/merge
-      - uses: cachix/install-nix-action@ba0dd844c9180cbf77aa72a116d6fbc515d0e87b # v27
+      - uses: cachix/install-nix-action@8887e596b4ee1134dae06b98d573bd674693f47c # v26
       - name: Build shell
         run: nix-build shell.nix

.github/workflows/editorconfig.yml

@@ -10,7 +10,6 @@ on:
 
 jobs:
   tests:
-    name: editorconfig-check
     runs-on: ubuntu-latest
     if: "github.repository_owner == 'NixOS' && !contains(github.event.pull_request.title, '[skip treewide]')"
     steps:
@@ -29,7 +28,7 @@ jobs:
       with:
         # pull_request_target checks out the base branch by default
         ref: refs/pull/${{ github.event.pull_request.number }}/merge
-    - uses: cachix/install-nix-action@ba0dd844c9180cbf77aa72a116d6fbc515d0e87b # v27
+    - uses: cachix/install-nix-action@8887e596b4ee1134dae06b98d573bd674693f47c # v26
       with:
         # nixpkgs commit is pinned so that it doesn't break
         # editorconfig-checker 2.4.0

.github/workflows/labels.yml

@@ -15,7 +15,6 @@ permissions:
 
 jobs:
   labels:
-    name: label-pr
     runs-on: ubuntu-latest
     if: "github.repository_owner == 'NixOS' && !contains(github.event.pull_request.title, '[skip treewide]')"
     steps:

.github/workflows/manual-nixos.yml

@@ -11,7 +11,6 @@ on:
 
 jobs:
   nixos:
-    name: nixos-manual-build
     runs-on: ubuntu-latest
     if: github.repository_owner == 'NixOS'
     steps:
@@ -19,7 +18,7 @@ jobs:
         with:
           # pull_request_target checks out the base branch by default
           ref: refs/pull/${{ github.event.pull_request.number }}/merge
-      - uses: cachix/install-nix-action@ba0dd844c9180cbf77aa72a116d6fbc515d0e87b # v27
+      - uses: cachix/install-nix-action@8887e596b4ee1134dae06b98d573bd674693f47c # v26
         with:
           # explicitly enable sandbox
           extra_nix_config: sandbox = true

.github/workflows/manual-nixpkgs.yml

@@ -13,7 +13,6 @@ on:
 
 jobs:
   nixpkgs:
-    name: nixpkgs-manual-build
     runs-on: ubuntu-latest
     if: github.repository_owner == 'NixOS'
     steps:
@@ -21,7 +20,7 @@ jobs:
         with:
           # pull_request_target checks out the base branch by default
           ref: refs/pull/${{ github.event.pull_request.number }}/merge
-      - uses: cachix/install-nix-action@ba0dd844c9180cbf77aa72a116d6fbc515d0e87b # v27
+      - uses: cachix/install-nix-action@8887e596b4ee1134dae06b98d573bd674693f47c # v26
         with:
           # explicitly enable sandbox
           extra_nix_config: sandbox = true

.github/workflows/nix-parse.yml

@@ -10,7 +10,6 @@ on:
 
 jobs:
   tests:
-    name: nix-files-parseable-check
     runs-on: ubuntu-latest
     if: "github.repository_owner == 'NixOS' && !contains(github.event.pull_request.title, '[skip treewide]')"
     steps:
@@ -30,7 +29,7 @@ jobs:
         # pull_request_target checks out the base branch by default
         ref: refs/pull/${{ github.event.pull_request.number }}/merge
       if: ${{ env.CHANGED_FILES && env.CHANGED_FILES != '' }}
-    - uses: cachix/install-nix-action@ba0dd844c9180cbf77aa72a116d6fbc515d0e87b # v27
+    - uses: cachix/install-nix-action@8887e596b4ee1134dae06b98d573bd674693f47c # v26
       with:
         nix_path: nixpkgs=channel:nixpkgs-unstable
     - name: Parse all changed or added nix files

.github/workflows/ofborg-pending.yml

@@ -16,7 +16,6 @@ permissions:
 
 jobs:
   action:
-    name: set-ofborg-pending
     if: github.repository_owner == 'NixOS'
     permissions:
       statuses: write

.github/workflows/update-terraform-providers.yml

@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
-      - uses: cachix/install-nix-action@ba0dd844c9180cbf77aa72a116d6fbc515d0e87b # v27
+      - uses: cachix/install-nix-action@8887e596b4ee1134dae06b98d573bd674693f47c # v26
         with:
           nix_path: nixpkgs=channel:nixpkgs-unstable
       - name: setup
@@ -46,7 +46,7 @@ jobs:
         run: |
           git clean -f
       - name: create PR
-        uses: peter-evans/create-pull-request@c5a7806660adbe173f04e3e038b0ccdcd758773c # v6.1.0
+        uses: peter-evans/create-pull-request@9153d834b60caba6d51c9b9510b087acf9f33f83 # v6.0.4
         with:
           body: |
             Automatic update by [update-terraform-providers](https://github.com/NixOS/nixpkgs/blob/master/.github/workflows/update-terraform-providers.yml) action.

.gitignore

@@ -7,7 +7,6 @@
 .idea/
 .nixos-test-history
 .vscode/
-.helix/
 outputs/
 result-*
 result
@@ -20,8 +19,6 @@ tags
 /doc/manual.pdf
 /source/
 .version-suffix
-.direnv
-.envrc
 
 .DS_Store
 .mypy_cache

CONTRIBUTING.md

@@ -379,12 +379,10 @@ See [this section][branch] to know when to use the release branches.
 [staging]: #staging
 
 The staging workflow exists to batch Hydra builds of many packages together.
-It is coordinated in the [Staging room](https://matrix.to/#/#staging:nixos.org) on Matrix.
 
 It works by directing commits that cause [mass rebuilds][mass-rebuild] to a separate `staging` branch that isn't directly built by Hydra.
 Regularly, the `staging` branch is _manually_ merged into a `staging-next` branch to be built by Hydra using the [`nixpkgs:staging-next` jobset](https://hydra.nixos.org/jobset/nixpkgs/staging-next).
-The `staging-next` branch should then only receive changes that fix Hydra builds;
-**for anything else, ask the [Staging room](https://matrix.to/#/#staging:nixos.org) first**.
+The `staging-next` branch should then only receive direct commits in order to fix Hydra builds.
 Once it is verified that there are no major regressions, it is merged into `master` using [a pull request](https://github.com/NixOS/nixpkgs/pulls?q=head%3Astaging-next).
 This is done manually in order to ensure it's a good use of Hydra's computing resources.
 By keeping the `staging-next` branch separate from `staging`, this batching does not block developers from merging changes into `staging`.
@@ -557,11 +555,138 @@ Names of files and directories should be in lowercase, with dashes between words
 
 ### Syntax
 
-- Set up [editorconfig](https://editorconfig.org/) for your editor, such that [the settings](./.editorconfig) are automatically applied.
+- Use 2 spaces of indentation per indentation level in Nix expressions, 4 spaces in shell scripts.
+
+- Do not use tab characters, i.e. configure your editor to use soft tabs. For instance, use `(setq-default indent-tabs-mode nil)` in Emacs. Everybody has different tab settings so it’s asking for trouble.
 
 - Use `lowerCamelCase` for variable names, not `UpperCamelCase`. Note, this rule does not apply to package attribute names, which instead follow the rules in [package naming](./pkgs/README.md#package-naming).
 
-- New files must be formatted by entering the `nix-shell` from the repository root and running `nixfmt`.
+- Function calls with attribute set arguments are written as
+
+  ```nix
+  foo {
+    arg = <...>;
+  }
+  ```
+
+  not
+
+  ```nix
+  foo
+  {
+    arg = <...>;
+  }
+  ```
+
+  Also fine is
+
+  ```nix
+  foo { arg = <...>; }
+  ```
+
+  if it's a short call.
+
+- In attribute sets or lists that span multiple lines, the attribute names or list elements should be aligned:
+
+  ```nix
+  {
+    # A long list.
+    list = [
+      elem1
+      elem2
+      elem3
+    ];
+
+    # A long attribute set.
+    attrs = {
+      attr1 = short_expr;
+      attr2 =
+        if true then big_expr else big_expr;
+    };
+
+    # Combined
+    listOfAttrs = [
+      {
+        attr1 = 3;
+        attr2 = "fff";
+      }
+      {
+        attr1 = 5;
+        attr2 = "ggg";
+      }
+    ];
+  }
+  ```
+
+- Short lists or attribute sets can be written on one line:
+
+  ```nix
+  {
+    # A short list.
+    list = [ elem1 elem2 elem3 ];
+
+    # A short set.
+    attrs = { x = 1280; y = 1024; };
+  }
+  ```
+
+- Breaking in the middle of a function argument can give hard-to-read code, like
+
+  ```nix
+  someFunction { x = 1280;
+    y = 1024; } otherArg
+    yetAnotherArg
+  ```
+
+  (especially if the argument is very large, spanning multiple lines).
+
+  Better:
+
+  ```nix
+  someFunction
+    { x = 1280; y = 1024; }
+    otherArg
+    yetAnotherArg
+  ```
+
+  or
+
+  ```nix
+  let res = { x = 1280; y = 1024; };
+  in someFunction res otherArg yetAnotherArg
+  ```
+
+- The bodies of functions, asserts, and withs are not indented to prevent a lot of superfluous indentation levels, i.e.
+
+  ```nix
+  { arg1, arg2 }:
+  assert system == "i686-linux";
+  stdenv.mkDerivation { /* ... */ }
+  ```
+
+  not
+
+  ```nix
+  { arg1, arg2 }:
+    assert system == "i686-linux";
+      stdenv.mkDerivation { /* ... */ }
+  ```
+
+- Function formal arguments are written as:
+
+  ```nix
+  { arg1, arg2, arg3 }: { /* ... */ }
+  ```
+
+  but if they don't fit on one line they're written as:
+
+  ```nix
+  { arg1, arg2, arg3
+  , arg4
+  # Some comment...
+  ,  argN
+  }: { }
+  ```
 
 - Functions should list their expected arguments as precisely as possible. That is, write
 

ci/pinned-nixpkgs.json

@@ -1,4 +1,4 @@
 {
-  "rev": "521d48afa9ae596930a95325529df27fa7135ff5",
-  "sha256": "0a1pa5azw990narsfipdli1wng4nc3vhvrp00hb8v1qfchcq7dc9"
+  "rev": "cfb89a95f19bea461fc37228dc4d07b22fe617c2",
+  "sha256": "1yhsacvry6j8r02lk70p9dphjpi8lpzgq2qay8hiy4nqlys0mrch"
 }

ci/update-pinned-nixpkgs.sh

@@ -10,8 +10,7 @@ repo=https://github.com/nixos/nixpkgs
 branch=nixpkgs-unstable
 file=$SCRIPT_DIR/pinned-nixpkgs.json
 
-defaultRev=$(git ls-remote "$repo" refs/heads/"$branch" | cut -f1)
-rev=${1:-$defaultRev}
+rev=$(git ls-remote "$repo" refs/heads/"$branch" | cut -f1)
 sha256=$(nix-prefetch-url --unpack "$repo/archive/$rev.tar.gz" --name source)
 
 jq -n --arg rev "$rev" --arg sha256 "$sha256" '$ARGS.named' | tee /dev/stderr > $file

doc/README.md

@@ -293,7 +293,7 @@ Though this is not shown in the rendered documentation on nixos.org.
 
 #### Figures
 
-To define a referenceable figure use the following fencing:
+To define a referencable figure use the following fencing:
 
 ```markdown
 ::: {.figure #nixos-logo}

doc/build-helpers/dev-shell-tools.chapter.md

@@ -27,49 +27,3 @@ devShellTools.valueToString (builtins.toFile "foo" "bar")
 devShellTools.valueToString false
 => ""
 ```
-
-:::
-
-## `devShellTools.unstructuredDerivationInputEnv` {#sec-devShellTools-unstructuredDerivationInputEnv}
-
-Convert a set of derivation attributes (as would be passed to [`derivation`]) to a set of environment variables that can be used in a shell script.
-This function does not support `__structuredAttrs`, but does support `passAsFile`.
-
-:::{.example}
-## `unstructuredDerivationInputEnv` usage example
-
-```nix
-devShellTools.unstructuredDerivationInputEnv {
-  drvAttrs = {
-    name = "foo";
-    buildInputs = [ hello figlet ];
-    builder = bash;
-    args = [ "-c" "${./builder.sh}" ];
-  };
-}
-=> {
-  name = "foo";
-  buildInputs = "/nix/store/...-hello /nix/store/...-figlet";
-  builder = "/nix/store/...-bash";
-}
-```
-
-Note that `args` is not included, because Nix does not added it to the builder process environment.
-
-:::
-
-## `devShellTools.derivationOutputEnv` {#sec-devShellTools-derivationOutputEnv}
-
-Takes the relevant parts of a derivation and returns a set of environment variables, that would be present in the derivation.
-
-:::{.example}
-## `derivationOutputEnv` usage example
-
-```nix
-let
-  pkg = hello;
-in
-devShellTools.derivationOutputEnv { outputList = pkg.outputs; outputMap = pkg; }
-```
-
-:::

doc/build-helpers/images/dockertools.section.md

@@ -185,19 +185,6 @@ Similarly, if you encounter errors similar to `Error_Protocol ("certificate has
   _Default value:_ `"gz"`.\
   _Possible values:_ `"none"`, `"gz"`, `"zstd"`.
 
-`includeNixDB` (Boolean; _optional_)
-
-: Populate the nix database in the image with the dependencies of `copyToRoot`.
-  The main purpose is to be able to use nix commands in the container.
-
-  :::{.caution}
-  Be careful since this doesn't work well in combination with `fromImage`. In particular, in a multi-layered image, only the Nix paths from the lower image will be in the database.
-
-  This also neglects to register the store paths that are pulled into the image as a dependency of one of the other values, but aren't a dependency of `copyToRoot`.
-  :::
-
-  _Default value:_ `false`.
-
 `contents` **DEPRECATED**
 
 : This attribute is deprecated, and users are encouraged to use `copyToRoot` instead.
@@ -587,19 +574,6 @@ This allows the function to produce reproducible images.
 
   _Default value:_ `true`
 
-`includeNixDB` (Boolean; _optional_)
-
-: Populate the nix database in the image with the dependencies of `copyToRoot`.
-  The main purpose is to be able to use nix commands in the container.
-
-  :::{.caution}
-  Be careful since this doesn't work well in combination with `fromImage`. In particular, in a multi-layered image, only the Nix paths from the lower image will be in the database.
-
-  This also neglects to register the store paths that are pulled into the image as a dependency of one of the other values, but aren't a dependency of `copyToRoot`.
-  :::
-
-  _Default value:_ `false`.
-
 `passthru` (Attribute Set; _optional_)
 
 : Use this to pass any attributes as [`passthru`](#chap-passthru) for the resulting derivation.

doc/build-helpers/testers.chapter.md

@@ -116,55 +116,6 @@ It has two modes:
 
 : The `lychee` package to use.
 
-## `shellcheck` {#tester-shellcheck}
-
-Runs files through `shellcheck`, a static analysis tool for shell scripts.
-
-:::{.example #ex-shellcheck}
-# Run `testers.shellcheck`
-
-A single script
-
-```nix
-testers.shellcheck {
-  name = "shellcheck";
-  src = ./script.sh;
-}
-```
-
-Multiple files
-
-```nix
-let
-  inherit (lib) fileset;
-in
-testers.shellcheck {
-  name = "shellcheck";
-  src = fileset.toSource {
-    root = ./.;
-    fileset = fileset.unions [
-      ./lib.sh
-      ./nixbsd-activate
-    ];
-  };
-}
-```
-
-:::
-
-### Inputs {#tester-shellcheck-inputs}
-
-[`src` (path or string)]{#tester-shellcheck-param-src}
-
-: The path to the shell script(s) to check.
-  This can be a single file or a directory containing shell files.
-  All files in `src` will be checked, so you may want to provide `fileset`-based source instead of a whole directory.
-
-### Return value {#tester-shellcheck-return}
-
-A derivation that runs `shellcheck` on the given script(s).
-The build will fail if `shellcheck` finds any issues.
-
 ## `testVersion` {#tester-testVersion}
 
 Checks that the output from running a command contains the specified version string in it as a whole word.

doc/build-helpers/trivial-build-helpers.chapter.md

@@ -241,7 +241,7 @@ Write a text file to the Nix store.
 `allowSubstitutes` (Bool, _optional_)
 
 : Whether to allow substituting from a binary cache.
-  Passed through to [`allowSubstitutes`](https://nixos.org/manual/nix/stable/language/advanced-attributes#adv-attr-allowSubstitutes) of the underlying call to `builtins.derivation`.
+  Passed through to [`allowSubsitutes`](https://nixos.org/manual/nix/stable/language/advanced-attributes#adv-attr-allowSubstitutes) of the underlying call to `builtins.derivation`.
 
   It defaults to `false`, as running the derivation's simple `builder` executable locally is assumed to be faster than network operations.
   Set it to true if the `checkPhase` step is expensive.
@@ -453,7 +453,7 @@ writeTextFile {
 
 ### `writeScriptBin` {#trivial-builder-writeScriptBin}
 
-Write a script within a `bin` subdirectory of a directory in the Nix store.
+Write a script within a `bin` subirectory of a directory in the Nix store.
 This is for consistency with the convention of software packages placing executables under `bin`.
 
 `writeScriptBin` takes the following arguments:

doc/common.nix

@@ -0,0 +1,4 @@
+{
+  outputPath = "share/doc/nixpkgs";
+  indexPath = "manual.html";
+}

doc/default.nix

@@ -1,6 +1,196 @@
-{
-  pkgs ? (import ./.. { }),
-  nixpkgs ? { },
-}:
+{ pkgs ? (import ./.. { }), nixpkgs ? { }}:
+let
+  inherit (pkgs) lib;
+  inherit (lib) hasPrefix removePrefix;
+  fs = lib.fileset;
 
-pkgs.nixpkgs-manual.override { inherit nixpkgs; }
+  common = import ./common.nix;
+
+  lib-docs = import ./doc-support/lib-function-docs.nix {
+    inherit pkgs nixpkgs;
+    libsets = [
+      { name = "asserts"; description = "assertion functions"; }
+      { name = "attrsets"; description = "attribute set functions"; }
+      { name = "strings"; description = "string manipulation functions"; }
+      { name = "versions"; description = "version string functions"; }
+      { name = "trivial"; description = "miscellaneous functions"; }
+      { name = "fixedPoints"; baseName = "fixed-points"; description = "explicit recursion functions"; }
+      { name = "lists"; description = "list manipulation functions"; }
+      { name = "debug"; description = "debugging functions"; }
+      { name = "options"; description = "NixOS / nixpkgs option handling"; }
+      { name = "path"; description = "path functions"; }
+      { name = "filesystem"; description = "filesystem functions"; }
+      { name = "fileset"; description = "file set functions"; }
+      { name = "sources"; description = "source filtering functions"; }
+      { name = "cli"; description = "command-line serialization functions"; }
+      { name = "generators"; description = "functions that create file formats from nix data structures"; }
+      { name = "gvariant"; description = "GVariant formatted string serialization functions"; }
+      { name = "customisation"; description = "Functions to customise (derivation-related) functions, derivatons, or attribute sets"; }
+      { name = "meta"; description = "functions for derivation metadata"; }
+      { name = "derivations"; description = "miscellaneous derivation-specific functions"; }
+    ];
+  };
+
+  epub = pkgs.runCommand "manual.epub" {
+    nativeBuildInputs = with pkgs; [ libxslt zip ];
+
+    epub = ''
+      <book xmlns="http://docbook.org/ns/docbook"
+            xmlns:xlink="http://www.w3.org/1999/xlink"
+            version="5.0"
+            xml:id="nixpkgs-manual">
+        <info>
+          <title>Nixpkgs Manual</title>
+          <subtitle>Version ${pkgs.lib.version}</subtitle>
+        </info>
+        <chapter>
+          <title>Temporarily unavailable</title>
+          <para>
+            The Nixpkgs manual is currently not available in EPUB format,
+            please use the <link xlink:href="https://nixos.org/nixpkgs/manual">HTML manual</link>
+            instead.
+          </para>
+          <para>
+            If you've used the EPUB manual in the past and it has been useful to you, please
+            <link xlink:href="https://github.com/NixOS/nixpkgs/issues/237234">let us know</link>.
+          </para>
+        </chapter>
+      </book>
+    '';
+
+    passAsFile = [ "epub" ];
+  } ''
+    mkdir scratch
+    xsltproc \
+      --param chapter.autolabel 0 \
+      --nonet \
+      --output scratch/ \
+      ${pkgs.docbook_xsl_ns}/xml/xsl/docbook/epub/docbook.xsl \
+      $epubPath
+
+    echo "application/epub+zip" > mimetype
+    zip -0Xq "$out" mimetype
+    cd scratch && zip -Xr9D "$out" *
+  '';
+
+  # NB: This file describes the Nixpkgs manual, which happens to use module
+  #     docs infra originally developed for NixOS.
+  optionsDoc = pkgs.nixosOptionsDoc {
+    inherit (pkgs.lib.evalModules {
+      modules = [ ../pkgs/top-level/config.nix ];
+      class = "nixpkgsConfig";
+    }) options;
+    documentType = "none";
+    transformOptions = opt:
+      opt // {
+        declarations =
+          map
+            (decl:
+              if hasPrefix (toString ../..) (toString decl)
+              then
+                let subpath = removePrefix "/" (removePrefix (toString ../.) (toString decl));
+                in { url = "https://github.com/NixOS/nixpkgs/blob/master/${subpath}"; name = subpath; }
+              else decl)
+            opt.declarations;
+        };
+  };
+in pkgs.stdenv.mkDerivation {
+  name = "nixpkgs-manual";
+
+  nativeBuildInputs = with pkgs; [
+    nixos-render-docs
+  ];
+
+  src = fs.toSource {
+    root = ./.;
+    fileset = fs.unions [
+      (fs.fileFilter (file:
+        file.hasExt "md"
+        || file.hasExt "md.in"
+      ) ./.)
+      ./style.css
+      ./anchor-use.js
+      ./anchor.min.js
+      ./manpage-urls.json
+    ];
+  };
+
+  postPatch = ''
+    ln -s ${optionsDoc.optionsJSON}/share/doc/nixos/options.json ./config-options.json
+  '';
+
+  pythonInterpreterTable = pkgs.callPackage ./doc-support/python-interpreter-table.nix {};
+
+  passAsFile = [ "pythonInterpreterTable" ];
+
+  buildPhase = ''
+    substituteInPlace ./languages-frameworks/python.section.md --subst-var-by python-interpreter-table "$(<"$pythonInterpreterTablePath")"
+
+    cat \
+      ./functions/library.md.in \
+      ${lib-docs}/index.md \
+      > ./functions/library.md
+    substitute ./manual.md.in ./manual.md \
+      --replace-fail '@MANUAL_VERSION@' '${pkgs.lib.version}'
+
+    mkdir -p out/media
+
+    mkdir -p out/highlightjs
+    cp -t out/highlightjs \
+      ${pkgs.documentation-highlighter}/highlight.pack.js \
+      ${pkgs.documentation-highlighter}/LICENSE \
+      ${pkgs.documentation-highlighter}/mono-blue.css \
+      ${pkgs.documentation-highlighter}/loader.js
+
+    cp -t out ./style.css ./anchor.min.js ./anchor-use.js
+
+    nixos-render-docs manual html \
+      --manpage-urls ./manpage-urls.json \
+      --revision ${pkgs.lib.trivial.revisionWithDefault (pkgs.rev or "master")} \
+      --stylesheet style.css \
+      --stylesheet highlightjs/mono-blue.css \
+      --script ./highlightjs/highlight.pack.js \
+      --script ./highlightjs/loader.js \
+      --script ./anchor.min.js \
+      --script ./anchor-use.js \
+      --toc-depth 1 \
+      --section-toc-depth 1 \
+      manual.md \
+      out/index.html
+  '';
+
+  installPhase = ''
+    dest="$out/${common.outputPath}"
+    mkdir -p "$(dirname "$dest")"
+    mv out "$dest"
+    mv "$dest/index.html" "$dest/${common.indexPath}"
+
+    cp ${epub} "$dest/nixpkgs-manual.epub"
+
+    mkdir -p $out/nix-support/
+    echo "doc manual $dest ${common.indexPath}" >> $out/nix-support/hydra-build-products
+    echo "doc manual $dest nixpkgs-manual.epub" >> $out/nix-support/hydra-build-products
+  '';
+
+  passthru.tests.manpage-urls = with pkgs; testers.invalidateFetcherByDrvHash
+    ({ name ? "manual_check-manpage-urls"
+     , script
+     , urlsFile
+     }: runCommand name {
+      nativeBuildInputs = [
+        cacert
+        (python3.withPackages (p: with p; [
+          aiohttp
+          rich
+          structlog
+        ]))
+      ];
+      outputHash = "sha256-47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=";  # Empty output
+    } ''
+      python3 ${script} ${urlsFile}
+      touch $out
+    '') {
+      script = ./tests/manpage-urls.py;
+      urlsFile = ./manpage-urls.json;
+    };
+}

doc/doc-support/epub.nix

@@ -1,54 +0,0 @@
-# To build this derivation, run `nix-build -A nixpkgs-manual.epub`
-{
-  lib,
-  runCommand,
-  docbook_xsl_ns,
-  libxslt,
-  zip,
-}:
-runCommand "manual.epub"
-  {
-    nativeBuildInputs = [
-      libxslt
-      zip
-    ];
-
-    epub = ''
-      <book xmlns="http://docbook.org/ns/docbook"
-            xmlns:xlink="http://www.w3.org/1999/xlink"
-            version="5.0"
-            xml:id="nixpkgs-manual">
-        <info>
-          <title>Nixpkgs Manual</title>
-          <subtitle>Version ${lib.version}</subtitle>
-        </info>
-        <chapter>
-          <title>Temporarily unavailable</title>
-          <para>
-            The Nixpkgs manual is currently not available in EPUB format,
-            please use the <link xlink:href="https://nixos.org/nixpkgs/manual">HTML manual</link>
-            instead.
-          </para>
-          <para>
-            If you've used the EPUB manual in the past and it has been useful to you, please
-            <link xlink:href="https://github.com/NixOS/nixpkgs/issues/237234">let us know</link>.
-          </para>
-        </chapter>
-      </book>
-    '';
-
-    passAsFile = [ "epub" ];
-  }
-  ''
-    mkdir scratch
-    xsltproc \
-      --param chapter.autolabel 0 \
-      --nonet \
-      --output scratch/ \
-      ${docbook_xsl_ns}/xml/xsl/docbook/epub/docbook.xsl \
-      $epubPath
-
-    echo "application/epub+zip" > mimetype
-    zip -0Xq -b "$TMPDIR" "$out" mimetype
-    cd scratch && zip -Xr9D -b "$TMPDIR" "$out" *
-  ''

doc/doc-support/lib-function-docs.nix

@@ -1,122 +1,27 @@
 # Generates the documentation for library functions via nixdoc.
-# To build this derivation, run `nix-build -A nixpkgs-manual.lib-docs`
-{
-  lib,
-  stdenvNoCC,
-  nixdoc,
-  nix,
-  nixpkgs ? { },
-  libsets ? [
-    {
-      name = "asserts";
-      description = "assertion functions";
-    }
-    {
-      name = "attrsets";
-      description = "attribute set functions";
-    }
-    {
-      name = "strings";
-      description = "string manipulation functions";
-    }
-    {
-      name = "versions";
-      description = "version string functions";
-    }
-    {
-      name = "trivial";
-      description = "miscellaneous functions";
-    }
-    {
-      name = "fixedPoints";
-      baseName = "fixed-points";
-      description = "explicit recursion functions";
-    }
-    {
-      name = "lists";
-      description = "list manipulation functions";
-    }
-    {
-      name = "debug";
-      description = "debugging functions";
-    }
-    {
-      name = "options";
-      description = "NixOS / nixpkgs option handling";
-    }
-    {
-      name = "path";
-      description = "path functions";
-    }
-    {
-      name = "filesystem";
-      description = "filesystem functions";
-    }
-    {
-      name = "fileset";
-      description = "file set functions";
-    }
-    {
-      name = "sources";
-      description = "source filtering functions";
-    }
-    {
-      name = "cli";
-      description = "command-line serialization functions";
-    }
-    {
-      name = "generators";
-      description = "functions that create file formats from nix data structures";
-    }
-    {
-      name = "gvariant";
-      description = "GVariant formatted string serialization functions";
-    }
-    {
-      name = "customisation";
-      description = "Functions to customise (derivation-related) functions, derivatons, or attribute sets";
-    }
-    {
-      name = "meta";
-      description = "functions for derivation metadata";
-    }
-    {
-      name = "derivations";
-      description = "miscellaneous derivation-specific functions";
-    }
-  ],
-}:
 
-stdenvNoCC.mkDerivation {
+{ pkgs, nixpkgs, libsets }:
+
+with pkgs;
+
+let
+  locationsJSON = import ./lib-function-locations.nix { inherit pkgs nixpkgs libsets; };
+in
+stdenv.mkDerivation {
   name = "nixpkgs-lib-docs";
+  src = ../../lib;
 
-  src = lib.fileset.toSource {
-    root = ../..;
-    fileset = ../../lib;
-  };
-
-  buildInputs = [
-    nixdoc
-    nix
-  ];
-
+  buildInputs = [ nixdoc ];
   installPhase = ''
-    export NIX_STATE_DIR=$(mktemp -d)
-    nix-instantiate --eval --strict --json ${./lib-function-locations.nix} \
-      --arg nixpkgsPath "./." \
-      --argstr revision ${nixpkgs.rev or "master"} \
-      --argstr libsetsJSON ${lib.escapeShellArg (builtins.toJSON libsets)} \
-      > locations.json
-
     function docgen {
       name=$1
       baseName=$2
       description=$3
       # TODO: wrap lib.$name in <literal>, make nixdoc not escape it
-      if [[ -e "lib/$baseName.nix" ]]; then
-        nixdoc -c "$name" -d "lib.$name: $description" -l locations.json -f "lib/$baseName.nix" > "$out/$name.md"
+      if [[ -e "../lib/$baseName.nix" ]]; then
+        nixdoc -c "$name" -d "lib.$name: $description" -l ${locationsJSON} -f "$baseName.nix" > "$out/$name.md"
       else
-        nixdoc -c "$name" -d "lib.$name: $description" -l locations.json -f "lib/$baseName/default.nix" > "$out/$name.md"
+        nixdoc -c "$name" -d "lib.$name: $description" -l ${locationsJSON} -f "$baseName/default.nix" > "$out/$name.md"
       fi
       echo "$out/$name.md" >> "$out/index.md"
     }
@@ -127,16 +32,9 @@ stdenvNoCC.mkDerivation {
     ```{=include=} sections auto-id-prefix=auto-generated
     EOF
 
-    ${lib.concatMapStrings (
-      {
-        name,
-        baseName ? name,
-        description,
-      }:
-      ''
-        docgen ${name} ${baseName} ${lib.escapeShellArg description}
-      ''
-    ) libsets}
+    ${lib.concatMapStrings ({ name, baseName ? name, description }: ''
+      docgen ${name} ${baseName} ${lib.escapeShellArg description}
+    '') libsets}
 
     echo '```' >> "$out/index.md"
   '';

doc/doc-support/lib-function-locations.nix

@@ -1,14 +1,13 @@
-{ nixpkgsPath, revision, libsetsJSON }:
+{ pkgs, nixpkgs ? { }, libsets }:
 let
-  lib = import (nixpkgsPath + "/lib");
-  libsets = builtins.fromJSON libsetsJSON;
+  revision = pkgs.lib.trivial.revisionWithDefault (nixpkgs.rev or "master");
 
   libDefPos = prefix: set:
     builtins.concatMap
       (name: [{
         name = builtins.concatStringsSep "." (prefix ++ [name]);
         location = builtins.unsafeGetAttrPos name set;
-      }] ++ lib.optionals
+      }] ++ nixpkgsLib.optionals
         (builtins.length prefix == 0 && builtins.isAttrs set.${name})
         (libDefPos (prefix ++ [name]) set.${name})
       ) (builtins.attrNames set);
@@ -21,6 +20,8 @@ let
       })
       (builtins.map (x: x.name) libsets);
 
+  nixpkgsLib = pkgs.lib;
+
   flattenedLibSubset = { subsetname, functions }:
   builtins.map
     (fn: {
@@ -37,13 +38,13 @@ let
       substr = builtins.substring prefixLen filenameLen filename;
       in substr;
 
-  removeNixpkgs = removeFilenamePrefix (builtins.toString nixpkgsPath);
+  removeNixpkgs = removeFilenamePrefix (builtins.toString pkgs.path);
 
   liblocations =
     builtins.filter
       (elem: elem.value != null)
-      (lib.lists.flatten
-        (locatedlibsets lib));
+      (nixpkgsLib.lists.flatten
+        (locatedlibsets nixpkgsLib));
 
   fnLocationRelative = { name, value }:
     {
@@ -71,4 +72,4 @@ let
     relativeLocs);
 
 in
-jsonLocs
+pkgs.writeText "locations.json" (builtins.toJSON jsonLocs)

doc/doc-support/options-doc.nix

@@ -1,28 +0,0 @@
-# To build this derivation, run `nix-build -A nixpkgs-manual.optionsDoc`
-{ lib, nixosOptionsDoc }:
-
-let
-  modules = lib.evalModules {
-    modules = [ ../../pkgs/top-level/config.nix ];
-    class = "nixpkgsConfig";
-  };
-
-  root = toString ../..;
-
-  transformDeclaration =
-    decl:
-    let
-      declStr = toString decl;
-      subpath = lib.removePrefix "/" (lib.removePrefix root declStr);
-    in
-    assert lib.hasPrefix root declStr;
-    {
-      url = "https://github.com/NixOS/nixpkgs/blob/master/${subpath}";
-      name = subpath;
-    };
-in
-nixosOptionsDoc {
-  inherit (modules) options;
-  documentType = "none";
-  transformOptions = opt: opt // { declarations = map transformDeclaration opt.declarations; };
-}

doc/doc-support/package.nix

@@ -1,106 +0,0 @@
-# This file describes the Nixpkgs manual, which happens to use module docs infra originally
-# developed for NixOS. To build this derivation, run `nix-build -A nixpkgs-manual`.
-#
-{
-  lib,
-  stdenvNoCC,
-  callPackage,
-  documentation-highlighter,
-  nixos-render-docs,
-  nixpkgs ? { },
-}:
-
-stdenvNoCC.mkDerivation (
-  finalAttrs:
-  let
-    inherit (finalAttrs.finalPackage.optionsDoc) optionsJSON;
-    inherit (finalAttrs.finalPackage) epub lib-docs pythonInterpreterTable;
-  in
-  {
-    name = "nixpkgs-manual";
-
-    nativeBuildInputs = [ nixos-render-docs ];
-
-    src = lib.fileset.toSource {
-      root = ../.;
-      fileset = lib.fileset.unions [
-        (lib.fileset.fileFilter (file: file.hasExt "md" || file.hasExt "md.in") ../.)
-        ../style.css
-        ../anchor-use.js
-        ../anchor.min.js
-        ../manpage-urls.json
-      ];
-    };
-
-    postPatch = ''
-      ln -s ${optionsJSON}/share/doc/nixos/options.json ./config-options.json
-    '';
-
-    buildPhase = ''
-      substituteInPlace ./languages-frameworks/python.section.md \
-        --subst-var-by python-interpreter-table "$(<"${pythonInterpreterTable}")"
-
-      cat \
-        ./functions/library.md.in \
-        ${lib-docs}/index.md \
-        > ./functions/library.md
-      substitute ./manual.md.in ./manual.md \
-        --replace-fail '@MANUAL_VERSION@' '${lib.version}'
-
-      mkdir -p out/media
-
-      mkdir -p out/highlightjs
-      cp -t out/highlightjs \
-        ${documentation-highlighter}/highlight.pack.js \
-        ${documentation-highlighter}/LICENSE \
-        ${documentation-highlighter}/mono-blue.css \
-        ${documentation-highlighter}/loader.js
-
-      cp -t out ./style.css ./anchor.min.js ./anchor-use.js
-
-      nixos-render-docs manual html \
-        --manpage-urls ./manpage-urls.json \
-        --revision ${nixpkgs.rev or "master"} \
-        --stylesheet style.css \
-        --stylesheet highlightjs/mono-blue.css \
-        --script ./highlightjs/highlight.pack.js \
-        --script ./highlightjs/loader.js \
-        --script ./anchor.min.js \
-        --script ./anchor-use.js \
-        --toc-depth 1 \
-        --section-toc-depth 1 \
-        manual.md \
-        out/index.html
-    '';
-
-    installPhase = ''
-      dest="$out/share/doc/nixpkgs"
-      mkdir -p "$(dirname "$dest")"
-      mv out "$dest"
-      mv "$dest/index.html" "$dest/manual.html"
-
-      cp ${epub} "$dest/nixpkgs-manual.epub"
-
-      mkdir -p $out/nix-support/
-      echo "doc manual $dest manual.html" >> $out/nix-support/hydra-build-products
-      echo "doc manual $dest nixpkgs-manual.epub" >> $out/nix-support/hydra-build-products
-    '';
-
-    passthru = {
-      lib-docs = callPackage ./lib-function-docs.nix { inherit nixpkgs; };
-
-      epub = callPackage ./epub.nix { };
-
-      optionsDoc = callPackage ./options-doc.nix { };
-
-      pythonInterpreterTable = callPackage ./python-interpreter-table.nix { };
-
-      shell = callPackage ../../pkgs/tools/nix/web-devmode.nix {
-        buildArgs = "./.";
-        open = "/share/doc/nixpkgs/manual.html";
-      };
-
-      tests.manpage-urls = callPackage ../tests/manpage-urls.nix { };
-    };
-  }
-)

doc/doc-support/python-interpreter-table.nix

@@ -1,15 +1,14 @@
-# To build this derivation, run `nix-build -A nixpkgs-manual.pythonInterpreterTable`
-{
-  lib,
-  writeText,
-  pkgs,
-  pythonInterpreters,
-}:
+# For debugging, run in this directory:
+#     nix eval --impure --raw --expr 'import ./python-interpreter-table.nix {}'
+{ pkgs ? (import ../.. { config = { }; overlays = []; }) }:
 let
-  isPythonInterpreter =
-    name:
-    /*
-      NB: Package names that don't follow the regular expression:
+  lib = pkgs.lib;
+  inherit (lib.attrsets) attrNames filterAttrs;
+  inherit (lib.lists) elem filter map naturalSort reverseList;
+  inherit (lib.strings) concatStringsSep;
+
+  isPythonInterpreter = name:
+    /* NB: Package names that don't follow the regular expression:
       - `python-cosmopolitan` is not part of `pkgs.pythonInterpreters`.
       - `_prebuilt` interpreters are used for bootstrapping internally.
       - `python3Minimal` contains python packages, left behind conservatively.
@@ -17,8 +16,7 @@ let
     */
     (lib.strings.match "(pypy|python)([[:digit:]]*)" name) != null;
 
-  interpreterName =
-    pname:
+  interpreterName = pname:
     let
       cuteName = {
         cpython = "CPython";
@@ -28,16 +26,16 @@ let
     in
     "${cuteName.${interpreter.implementation}} ${interpreter.pythonVersion}";
 
-  interpreters = lib.reverseList (
-    lib.naturalSort (lib.filter isPythonInterpreter (lib.attrNames pythonInterpreters))
-  );
+  interpreters = reverseList (naturalSort (
+    filter isPythonInterpreter (attrNames pkgs.pythonInterpreters)
+  ));
 
-  aliases =
-    pname:
-    lib.attrNames (
-      lib.filterAttrs (
-        name: value:
-        isPythonInterpreter name && name != pname && interpreterName name == interpreterName pname
+  aliases = pname:
+    attrNames (
+      filterAttrs (name: value:
+        isPythonInterpreter name
+        && name != pname
+        && interpreterName name == interpreterName pname
       ) pkgs
     );
 
@@ -47,17 +45,18 @@ let
     interpreter = interpreterName pname;
   }) interpreters;
 
-  toMarkdown =
-    data:
+  toMarkdown = data:
     let
       line = package: ''
-        | ${package.pname} | ${lib.concatStringsSep ", " package.aliases or [ ]} | ${package.interpreter} |
+        | ${package.pname} | ${join ", " package.aliases or [ ]} | ${package.interpreter} |
       '';
     in
-    lib.concatStringsSep "" (map line data);
+    join "" (map line data);
+
+  join = lib.strings.concatStringsSep;
 
 in
-writeText "python-interpreter-table.md" ''
+''
   | Package | Aliases | Interpeter |
   |---------|---------|------------|
   ${toMarkdown result}

doc/hooks/installShellFiles.section.md

@@ -4,7 +4,7 @@ This hook helps with installing manpages and shell completion files. It exposes
 
 The `installManPage` function takes one or more paths to manpages to install. The manpages must have a section suffix, and may optionally be compressed (with `.gz` suffix). This function will place them into the correct `share/man/man<section>/` directory, in [`outputMan`](#outputman).
 
-The `installShellCompletion` function takes one or more paths to shell completion files. By default it will autodetect the shell type from the completion file extension, but you may also specify it by passing one of `--bash`, `--fish`, or `--zsh`. These flags apply to all paths listed after them (up until another shell flag is given). Each path may also have a custom installation name provided by providing a flag `--name NAME` before the path. If this flag is not provided, zsh completions will be renamed automatically such that `foobar.zsh` becomes `_foobar`. A root name may be provided for all paths using the flag `--cmd NAME`; this synthesizes the appropriate name depending on the shell (e.g. `--cmd foo` will synthesize the name `foo.bash` for bash and `_foo` for zsh).
+The `installShellCompletion` function takes one or more paths to shell completion files. By default it will autodetect the shell type from the completion file extension, but you may also specify it by passing one of `--bash`, `--fish`, or `--zsh`. These flags apply to all paths listed after them (up until another shell flag is given). Each path may also have a custom installation name provided by providing a flag `--name NAME` before the path. If this flag is not provided, zsh completions will be renamed automatically such that `foobar.zsh` becomes `_foobar`. A root name may be provided for all paths using the flag `--cmd NAME`; this synthesizes the appropriate name depending on the shell (e.g. `--cmd foo` will synthesize the name `foo.bash` for bash and `_foo` for zsh). The path may also be a fifo or named fd (such as produced by `<(cmd)`), in which case the shell and name must be provided.
 
 ```nix
 {
@@ -17,18 +17,6 @@ The `installShellCompletion` function takes one or more paths to shell completio
     installShellCompletion --zsh --name _foobar share/completions.zsh
     # implicit behavior
     installShellCompletion share/completions/foobar.{bash,fish,zsh}
-  '';
-}
-```
-
-The path may also be a fifo or named fd (such as produced by `<(cmd)`), in which case the shell and name must be provided (see below).
-
-If the destination shell completion file is not actually present or consists of zero bytes after calling `installShellCompletion` this is treated as a build failure. In particular, if completion files are not vendored but are generated by running an executable, this is likely to fail in cross compilation scenarios. The result will be a zero byte completion file and hence a build failure. To prevent this, guard the completion commands against this, e.g.
-
-```nix
-{
-  nativeBuildInputs = [ installShellFiles ];
-  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     # using named fd
     installShellCompletion --cmd foobar \
       --bash <($out/bin/foobar --bash-completion) \

doc/interoperability.md

@@ -1,5 +0,0 @@
-# Interoperability Standards {#part-interoperability}
-
-```{=include=} chapters
-interoperability/cyclonedx.md
-```

doc/interoperability/cyclonedx.md

@@ -1,79 +0,0 @@
-# CycloneDX {#chap-interop-cyclonedx}
-
-[OWASP](https://owasp.org/) [CycloneDX](https://cyclonedx.org/) is a Software [Bill of Materials](https://en.wikipedia.org/wiki/Bill_of_materials) (SBOM) standard.
-The standards described here are for including Nix specific information within SBOMs in a way that is interoperable with external SBOM tooling.
-
-## `nix` Namespace Property Taxonomy  {#sec-interop.cylonedx-nix}
-
-The following tables describe namespaces for [properties](https://cyclonedx.org/docs/1.6/json/#components_items_properties) that may be attached to components within SBOMs.
-Component properties are lists of name-value-pairs where values must be strings.
-Properties with the same name may appear more than once.
-Names and values are case-sensitive.
-
-| Property         | Description |
-|------------------|-------------|
-| `nix:store_path` | A Nix store path for the given component. This property should be contextualized by additional properties that describe the production of the store path, such as those from the `nix:narinfo:` and `nix:fod` namespaces. |
-
-
-| Namespace     | Description |
-|---------------|-------------|
-| [`nix:narinfo`](#sec-interop.cylonedx-narinfo) | Namespace for properties that are specific to how a component is stored as a [Nix archive](https://nixos.org/manual/nix/stable/glossary#gloss-nar) (NAR) in a [binary cache](https://nixos.org/manual/nix/stable/glossary#gloss-binary-cache). |
-| [`nix:fod`](#sec-interop.cylonedx-fod) | Namespace for properties that describe a [fixed-output derivation](https://nixos.org/manual/nix/stable/glossary#gloss-fixed-output-derivation). |
-
-
-### `nix:narinfo` {#sec-interop.cylonedx-narinfo}
-
-Narinfo properties describe component archives that may be available from binary caches.
-The `nix:narinfo` properties should be accompanied by a `nix:store_path` property within the same property list.
-
-| Property                  | Description |
-|---------------------------|-------------|
-| `nix:narinfo:store_path`  | Store path for the given store component. |
-| `nix:narinfo:url`         | URL path component. |
-| `nix:narinfo:nar_hash`    | Hash of the file system object part of the component when serialized as a Nix Archive. |
-| `nix:narinfo:nar_size`    | Size of the component when serialized as a Nix Archive. |
-| `nix:narinfo:compression` | The compression format that component archive is in. |
-| `nix:narinfo:file_hash`   | A digest for the compressed component archive itself, as opposed to the data contained within. |
-| `nix:narinfo:file_size`   | The size of the compressed component archive itself. |
-| `nix:narinfo:deriver`     | The path to the derivation from which this component is produced. |
-| `nix:narinfo:system`      | The hardware and software platform on which this component is produced. |
-| `nix:narinfo:sig`         | Signatures claiming that this component is what it claims to be. |
-| `nix:narinfo:ca`          | Content address of this store object's file system object, used to compute its store path. |
-| `nix:narinfo:references`  | A whitespace separated array of store paths that this component references. |
-
-### `nix:fod` {#sec-interop.cylonedx-fod}
-
-FOD properties describe a [fixed-output derivation](https://nixos.org/manual/nix/stable/glossary#gloss-fixed-output-derivation).
-The `nix:fod:method` property is required and must be accompanied by a `nix:store_path` property within the same property list.
-All other properties in this namespace are method-specific.
-To reproduce the build of a component the `nix:fod:method` value is resolved to an [appropriate function](#chap-pkgs-fetchers) within Nixpkgs whose arguments intersect with the given properties.
-When generating `nix:fod` properties the method selected should be a stable function with a minimal number arguments.
-For example, the `fetchFromGitHub` is commonly used within Nixpkgs but should be reduced to a call to the function by which it is implemented, `fetchzip`.
-
-| Property         | Description |
-|------------------|-------------|
-| `nix:fod:method` | Nixpkg function that produces this FOD. Required. Examples: `"fetchzip"`, `"fetchgit"` |
-| `nix:fod:name`   | Derivation name, present when method is `"fetchzip"` |
-| `nix:fod:ref`    | [Git ref](https://git-scm.com/docs/gitglossary#Documentation/gitglossary.txt-aiddefrefaref), present when method is `"fetchgit"` |
-| `nix:fod:rev`    | [Git rev](https://git-scm.com/docs/gitglossary#Documentation/gitglossary.txt-aiddefrevisionarevision), present when method is `"fetchgit"` |
-| `nix:fod:sha256` | FOD hash |
-| `nix:fod:url`    | URL to fetch |
-
-
-`nix:fod` properties may be extracted and evaluated to a derivation using code similar to the following, assuming a fictitious function `filterPropertiesToAttrs`:
-
-```nix
-{ pkgs, filterPropertiesToAttrs, properties }:
-let
-  fodProps = filterPropertiesToAttrs "nix:fod:" properties;
-
-  methods = {
-    fetchzip =
-      { name, url, sha256, ... }:
-      pkgs.fetchzip {
-        inherit name url sha256;
-      };
-  };
-
-in methods.${fodProps.method} fodProps
-```

doc/languages-frameworks/coq.section.md

@@ -84,7 +84,7 @@ mkCoqDerivation {
     [ mathcomp.ssreflect mathcomp.algebra mathcomp-finmap mathcomp-bigenough ];
 
   meta = {
-    description = "Coq/SSReflect Library for Monoidal Rings and Multinomials";
+    description = "A Coq/SSReflect Library for Monoidal Rings and Multinomials";
     license = lib.licenses.cecill-c;
   };
 }

doc/languages-frameworks/dotnet.section.md

@@ -98,13 +98,13 @@ To package Dotnet applications, you can use `buildDotnetModule`. This has simila
 For more detail about managing the `deps.nix` file, see [Generating and updating NuGet dependencies](#generating-and-updating-nuget-dependencies)
 :::
 
-* `packNupkg` is used to pack project as a `nupkg`, and installs it to `$out/share`. If set to `true`, the derivation can be used as a dependency for another dotnet project by adding it to `buildInputs`.
-* `buildInputs` can be used to resolve `ProjectReference` project items. Referenced projects can be packed with `buildDotnetModule` by setting the `packNupkg = true` attribute and passing a list of derivations to `buildInputs`. Since we are sharing referenced projects as NuGets they must be added to csproj/fsproj files as `PackageReference` as well.
+* `packNupkg` is used to pack project as a `nupkg`, and installs it to `$out/share`. If set to `true`, the derivation can be used as a dependency for another dotnet project by adding it to `projectReferences`.
+* `projectReferences` can be used to resolve `ProjectReference` project items. Referenced projects can be packed with `buildDotnetModule` by setting the `packNupkg = true` attribute and passing a list of derivations to `projectReferences`. Since we are sharing referenced projects as NuGets they must be added to csproj/fsproj files as `PackageReference` as well.
  For example, your project has a local dependency:
  ```xml
      <ProjectReference Include="../foo/bar.fsproj" />
  ```
- To enable discovery through `buildInputs` you would need to add:
+ To enable discovery through `projectReferences` you would need to add:
  ```xml
      <ProjectReference Include="../foo/bar.fsproj" />
      <PackageReference Include="bar" Version="*" Condition=" '$(ContinuousIntegrationBuild)'=='true' "/>
@@ -143,7 +143,7 @@ in buildDotnetModule rec {
   projectFile = "src/project.sln";
   nugetDeps = ./deps.nix; # see "Generating and updating NuGet dependencies" section for details
 
-  buildInputs = [ referencedProject ]; # `referencedProject` must contain `nupkg` in the folder structure.
+  projectReferences = [ referencedProject ]; # `referencedProject` must contain `nupkg` in the folder structure.
 
   dotnet-sdk = dotnetCorePackages.sdk_6_0;
   dotnet-runtime = dotnetCorePackages.runtime_6_0;

doc/languages-frameworks/go.section.md

@@ -66,25 +66,6 @@ The following is an example expression using `buildGoModule`:
 
 The function `buildGoPackage` builds legacy Go programs, not supporting Go modules.
 
-::: {.warning}
-`buildGoPackage` is deprecated and will be removed for the 25.05 release.
-:::
-
-### Migrating from `buildGoPackage` to `buildGoModule` {#buildGoPackage-migration}
-
-Go modules, released 6y ago, are now widely adopted in the ecosystem.
-Most upstream projects are using Go modules, and the tooling previously used for dependency management in Go is mostly deprecated, archived or at least unmaintained at this point.
-
-In case a project doesn't have external dependencies or dependencies are vendored in a way understood by `go mod init`, migration can be done with a few changes in the package.
-
-- Switch the builder from `buildGoPackage` to `buildGoModule`
-- Remove `goPackagePath` and other attributes specific to `buildGoPackage`
-- Set `vendorHash = null;`
-- Run `go mod init <module name>` in `postPatch`
-
-In case the package has external dependencies that aren't vendored or the build setup is more complex the upstream source might need to be patched.
-Examples for the migration can be found in the [issue tracking migration withing nixpkgs](https://github.com/NixOS/nixpkgs/issues/318069).
-
 ### Example for `buildGoPackage` {#example-for-buildgopackage}
 
 In the following is an example expression using `buildGoPackage`, the following arguments are of special significance to the function:

doc/languages-frameworks/gradle.section.md

@@ -1,189 +0,0 @@
-# Gradle {#gradle}
-
-Gradle is a popular build tool for Java/Kotlin. Gradle itself doesn't
-currently provide tools to make dependency resolution reproducible, so
-nixpkgs has a proxy designed for intercepting Gradle web requests to
-record dependencies so they can be restored in a reproducible fashion.
-
-## Building a Gradle package {#building-a-gradle-package}
-
-Here's how a typical derivation will look like:
-
-```nix
-stdenv.mkDerivation (finalAttrs: {
-  pname = "pdftk";
-  version = "3.3.3";
-
-  src = fetchFromGitLab {
-    owner = "pdftk-java";
-    repo = "pdftk";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-ciKotTHSEcITfQYKFZ6sY2LZnXGChBJy0+eno8B3YHY=";
-  };
-
-  nativeBuildInputs = [ gradle ];
-
-  # if the package has dependencies, mitmCache must be set
-  mitmCache = gradle.fetchDeps {
-    inherit (finalAttrs) pname;
-    data = ./deps.json;
-  };
-
-  # this is required for using mitm-cache on Darwin
-  __darwinAllowLocalNetworking = true;
-
-  gradleFlags = [ "-Dfile.encoding=utf-8" ];
-
-  # defaults to "assemble"
-  gradleBuildTask = "shadowJar";
-
-  # will run the gradleCheckTask (defaults to "test")
-  doCheck = true;
-
-  installPhase = ''
-    mkdir -p $out/{bin,share/pdftk}
-    cp build/libs/pdftk-all.jar $out/share/pdftk
-
-    makeWrapper ${jre}/bin/java $out/bin/pdftk \
-      --add-flags "-jar $out/share/pdftk/pdftk-all.jar"
-
-    cp ${finalAttrs.src}/pdftk.1 $out/share/man/man1
-  '';
-
-  meta.sourceProvenance = with lib.sourceTypes; [
-    fromSource
-    binaryBytecode # mitm cache
-  ];
-})
-```
-
-To update (or initialize) dependencies, run the update script via
-something like `$(nix-build -A <pname>.mitmCache.updateScript)`
-(`nix-build` builds the `updateScript`, `$(...)` runs the script at the
-path printed by `nix-build`).
-
-If your package can't be evaluated using a simple `pkgs.<pname>`
-expression (for example, if your package isn't located in nixpkgs, or if
-you want to override some of its attributes), you will usually have to
-pass `pkg` instead of `pname` to `gradle.fetchDeps`. There are two ways
-of doing it.
-
-The first is to add the derivation arguments required for getting the
-package. Using the pdftk example above:
-
-```nix
-{ lib
-, stdenv
-# ...
-, pdftk
-}:
-
-stdenv.mkDerivation (finalAttrs: {
-  # ...
-  mitmCache = gradle.fetchDeps {
-    pkg = pdftk;
-    data = ./deps.json;
-  };
-})
-```
-
-This allows you to `override` any arguments of the `pkg` used for
-the update script (for example, `pkg = pdftk.override { enableSomeFlag =
-true };`), so this is the preferred way.
-
-The second is to create a `let` binding for the package, like this:
-
-```nix
-let self = stdenv.mkDerivation {
-  # ...
-  mitmCache = gradle.fetchDeps {
-    pkg = self;
-    data = ./deps.json;
-  };
-}; in self
-```
-
-This is useful if you can't easily pass the derivation as its own
-argument, or if your `mkDerivation` call is responsible for building
-multiple packages.
-
-In the former case, the update script will stay the same even if the
-derivation is called with different arguments. In the latter case, the
-update script will change depending on the derivation arguments. It's up
-to you to decide which one would work best for your derivation.
-
-## Update Script {#gradle-update-script}
-
-The update script does the following:
-
-- Build the derivation's source via `pkgs.srcOnly`
-- Enter a `nix-shell` for the derivation in a `bwrap` sandbox (the
-  sandbox is only used on Linux)
-- Set the `IN_GRADLE_UPDATE_DEPS` environment variable to `1`
-- Run the derivation's `unpackPhase`, `patchPhase`, `configurePhase`
-- Run the derivation's `gradleUpdateScript` (the Gradle setup hook sets
-  a default value for it, which runs `preBuild`, `preGradleUpdate`
-  hooks, fetches the dependencies using `gradleUpdateTask`, and finally
-  runs the `postGradleUpdate` hook)
-- Finally, store all of the fetched files' hashes in the lockfile. They
-  may be `.jar`/`.pom` files from Maven repositories, or they may be
-  files otherwise used for building the package.
-
-`fetchDeps` takes the following arguments:
-
-- `attrPath` - the path to the package in nixpkgs (for example,
-  `"javaPackages.openjfx22"`). Used for update script metadata.
-- `pname` - an alias for `attrPath` for convenience. This is what you
-  will generally use instead of `pkg` or `attrPath`.
-- `pkg` - the package to be used for fetching the dependencies. Defaults
-  to `getAttrFromPath (splitString "." attrPath) pkgs`.
-- `bwrapFlags` - allows you to override bwrap flags (only relevant for
-  downstream, non-nixpkgs projects)
-- `data` - path to the dependencies lockfile (can be relative to the
-  package, can be absolute). In nixpkgs, it's discouraged to have the
-  lockfiles be named anything other `deps.json`, consider creating
-  subdirectories if your package requires multiple `deps.json` files.
-
-## Environment {#gradle-environment}
-
-The Gradle setup hook accepts the following environment variables:
-
-- `mitmCache` - the MITM proxy cache imported using `gradle.fetchDeps`
-- `gradleFlags` - command-line flags to be used for every Gradle
-  invocation (this simply registers a function that uses the necessary
-  flags).
-  - You can't use `gradleFlags` for flags that contain spaces, in that
-    case you must add `gradleFlagsArray+=("-flag with spaces")` to the
-    derivation's bash code instead.
-  - If you want to build the package using a specific Java version, you
-    can pass `"-Dorg.gradle.java.home=${jdk}"` as one of the flags.
-- `gradleBuildTask` - the Gradle task (or tasks) to be used for building
-  the package. Defaults to `assemble`.
-- `gradleCheckTask` - the Gradle task (or tasks) to be used for checking
-  the package if `doCheck` is set to `true`. Defaults to `test`.
-- `gradleUpdateTask` - the Gradle task (or tasks) to be used for
-  fetching all of the package's dependencies in
-  `mitmCache.updateScript`. Defaults to `nixDownloadDeps`.
-- `gradleUpdateScript` - the code to run for fetching all of the
-  package's dependencies in `mitmCache.updateScript`. Defaults to
-  running the `preBuild` and `preGradleUpdate` hooks, running the
-  `gradleUpdateTask`, and finally running the `postGradleUpdate` hook.
-- `gradleInitScript` - path to the `--init-script` to pass to Gradle. By
-  default, a simple init script that enables reproducible archive
-  creation is used.
-  - Note that reproducible archives might break some builds. One example
-    of an error caused by it is `Could not create task ':jar'. Replacing
-    an existing task that may have already been used by other plugins is
-    not supported`. If you get such an error, the easiest "fix" is
-    disabling reproducible archives altogether by setting
-    `gradleInitScript` to something like `writeText
-    "empty-init-script.gradle" ""`
-- `enableParallelBuilding` / `enableParallelChecking` /
-  `enableParallelUpdating` - pass `--parallel` to Gradle in the
-  build/check phase or in the update script. Defaults to true. If the
-  build fails for mysterious reasons, consider setting this to false.
-- `dontUseGradleConfigure` / `dontUseGradleBuild` / `dontUseGradleCheck`
-  \- force disable the Gradle setup hook for certain phases.
-  - Note that if you disable the configure hook, you may face issues
-    such as `Failed to load native library 'libnative-platform.so'`,
-    because the configure hook is responsible for initializing Gradle.

doc/languages-frameworks/index.md

@@ -90,7 +90,6 @@ qt.section.md
 r.section.md
 ruby.section.md
 rust.section.md
-scheme.section.md
 swift.section.md
 texlive.section.md
 titanium.section.md

doc/languages-frameworks/javascript.section.md

@@ -206,7 +206,7 @@ buildNpmPackage rec {
   NODE_OPTIONS = "--openssl-legacy-provider";
 
   meta = {
-    description = "Modern web UI for various torrent clients with a Node.js backend and React frontend";
+    description = "A modern web UI for various torrent clients with a Node.js backend and React frontend";
     homepage = "https://flood.js.org";
     license = lib.licenses.gpl3Only;
     maintainers = with lib.maintainers; [ winter ];
@@ -233,7 +233,7 @@ If these are not defined, `npm pack` may miss some files, and no binaries will b
 * `npmPruneFlags`: Flags to pass to `npm prune`. Defaults to the value of `npmInstallFlags`.
 * `makeWrapperArgs`: Flags to pass to `makeWrapper`, added to executable calling the generated `.js` with `node` as an interpreter. These scripts are defined in `package.json`.
 * `nodejs`: The `nodejs` package to build against, using the corresponding `npm` shipped with that version of `node`. Defaults to `pkgs.nodejs`.
-* `npmDeps`: The dependencies used to build the npm package. Especially useful to not have to recompute workspace dependencies.
+* `npmDeps`: The dependencies used to build the npm package. Especially useful to not have to recompute workspace depedencies.
 
 #### prefetch-npm-deps {#javascript-buildNpmPackage-prefetch-npm-deps}
 
@@ -375,74 +375,8 @@ Assuming the following directory structure, we can define `sourceRoot` and `pnpm
   pnpmRoot = "frontend";
 ```
 
-### Yarn {#javascript-yarn}
-
-Yarn based projects use a `yarn.lock` file instead of a `package-lock.json` to pin dependencies. Nixpkgs provides the Nix function `fetchYarnDeps` which fetches an offline cache suitable for running `yarn install` before building the project. In addition, Nixpkgs provides the hooks:
-
-- `yarnConfigHook`: Fetches the dependencies from the offline cache and installs them into `node_modules`.
-- `yarnBuildHook`: Runs `yarn build` or a specified `yarn` command that builds the project.
-
-An example usage of the above attributes is:
-
-```nix
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  fetchYarnDeps,
-  yarnConfigHook,
-  yarnBuildHook,
-  nodejs,
-  npmHooks,
-}:
-
-stdenv.mkDerivation (finalAttrs: {
-  pname = "...";
-  version = "...";
-
-  src = fetchFromGitHub {
-    owner = "...";
-    repo = "...";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";
-  };
-
-  yarnOfflineCache = fetchYarnDeps {
-    yarnLock = finalAttrs.src + "/yarn.lock";
-    hash = "sha256-mo8urQaWIHu33+r0Y7mL9mJ/aSe/5CihuIetTeDHEUQ=";
-  };
-
-  nativeBuildInputs = [
-    yarnConfigHook
-    yarnBuildHook
-    # Needed for executing package.json scripts
-    nodejs
-    npmHooks.npmInstallHook
-  ];
-
-  meta = {
-    # ...
-  };
-})
-```
-
-Note that there is no setup hook for installing yarn based packages - `npmHooks.npmInstallHook` should fit most cases, but sometimes you may need to override the `installPhase` completely.
-
-#### `yarnConfigHook` arguments {#javascript-yarnconfighook}
-
-By default, `yarnConfigHook` relies upon the attribute `${yarnOfflineCache}` (or `${offlineCache}` if the former is not set) to find the location of the offline cache produced by `fetchYarnDeps`. To disable this phase, you can set `dontYarnInstallDeps = true` or override the `configurePhase`.
-
-#### `yarnBuildHook` arguments {#javascript-yarnbuildhook}
-
-This script by default runs `yarn --offline build`, and it relies upon the project's dependencies installed at `node_modules`. Below is a list of additional `mkDerivation` arguments read by this hook:
-
-- `yarnBuildScript`: Sets a different `yarn --offline` subcommand (defaults to `build`).
-- `yarnBuildFlags`: Single string list of additional flags to pass the above command, or a Nix list of such additional flags.
-
 ### yarn2nix {#javascript-yarn2nix}
 
-WARNING: The `yarn2nix` functions have been deprecated in favor of the new `yarnConfigHook` and `yarnBuildHook`. Documentation for them still appears here for the sake of the packages that still use them. See also a tracking issue [#324246](https://github.com/NixOS/nixpkgs/issues/324246).
-
 #### Preparation {#javascript-yarn2nix-preparation}
 
 You will need at least a `yarn.lock` file. If upstream does not have one you need to generate it and reference it in your package definition.

doc/languages-frameworks/nim.section.md

@@ -88,7 +88,7 @@ For example, to propagate a dependency on SDL2 for lockfiles that select the Nim
 }
 ```
 
-The annotations in the `nim-overrides.nix` set are functions that take two arguments and return a new attrset to be overlaid on the package being built.
+The annotations in the `nim-overrides.nix` set are functions that take two arguments and return a new attrset to be overlayed on the package being built.
 - lockAttrs: the attrset for this library from within a lockfile. This can be used to implement library version constraints, such as marking libraries as broken or insecure.
 - prevAttrs: the attrset produced by initial arguments to `buildNimPackage` and any preceding lockfile overlays.
 

doc/languages-frameworks/ocaml.section.md

@@ -113,7 +113,7 @@ buildDunePackage rec {
 
   meta = {
     homepage = "https://github.com/flowtype/ocaml-wtf8";
-    description = "WTF-8 is a superset of UTF-8 that allows unpaired surrogates";
+    description = "WTF-8 is a superset of UTF-8 that allows unpaired surrogates.";
     license = lib.licenses.mit;
     maintainers = [ lib.maintainers.eqyiel ];
   };

doc/languages-frameworks/perl.section.md

@@ -158,7 +158,7 @@ $ nix-generate-from-cpan XML::Simple
     };
     propagatedBuildInputs = [ XMLNamespaceSupport XMLSAX XMLSAXExpat ];
     meta = {
-      description = "API for simple XML files";
+      description = "An API for simple XML files";
       license = with lib.licenses; [ artistic1 gpl1Plus ];
     };
   };

doc/languages-frameworks/php.section.md

@@ -283,10 +283,7 @@ in {
   ];
 
   composerRepository = php.mkComposerRepository {
-    inherit (finalAttrs) pname version src;
-    composerNoDev = true;
-    composerNoPlugins = true;
-    composerNoScripts = true;
+    inherit (finalAttrs) src;
     # Specifying a custom composer.lock since it is not present in the sources.
     composerLock = ./composer.lock;
     # The composer vendor hash

doc/languages-frameworks/python.section.md

@@ -162,8 +162,7 @@ following are specific to `buildPythonPackage`:
 * `dontWrapPythonPrograms ? false`: Skip wrapping of Python programs.
 * `permitUserSite ? false`: Skip setting the `PYTHONNOUSERSITE` environment
   variable in wrapped programs.
-* `pyproject`: Whether the pyproject format should be used. As all other formats
-  are deprecated, you are recommended to set this to `true`. When you do so,
+* `pyproject`: Whether the pyproject format should be used. When set to `true`,
   `pypaBuildHook` will be used, and you can add the required build dependencies
   from `build-system.requires` to `build-system`. Note that the pyproject
   format falls back to using `setuptools`, so you can use `pyproject = true`
@@ -994,7 +993,7 @@ buildPythonPackage rec {
   meta = {
     changelog = "https://github.com/blaze/datashape/releases/tag/${version}";
     homepage = "https://github.com/ContinuumIO/datashape";
-    description = "Data description language";
+    description = "A data description language";
     license = lib.licenses.bsd2;
   };
 }
@@ -1119,7 +1118,7 @@ buildPythonPackage rec {
 
   meta = {
     changelog = "https://github.com/pyFFTW/pyFFTW/releases/tag/v${version}";
-    description = "Pythonic wrapper around FFTW, the FFT library, presenting a unified interface for all the supported transforms";
+    description = "A pythonic wrapper around FFTW, the FFT library, presenting a unified interface for all the supported transforms";
     homepage = "http://hgomersall.github.com/pyFFTW";
     license = with lib.licenses; [ bsd2 bsd3 ];
   };

doc/languages-frameworks/rust.section.md

@@ -38,24 +38,19 @@ rustPlatform.buildRustPackage rec {
   cargoHash = "sha256-jtBw4ahSl88L0iuCXxQgZVm1EcboWRJMNtjxLVTtzts=";
 
   meta = {
-    description = "Fast line-oriented regex search tool, similar to ag and ack";
+    description = "A fast line-oriented regex search tool, similar to ag and ack";
     homepage = "https://github.com/BurntSushi/ripgrep";
     license = lib.licenses.unlicense;
-    maintainers = [ ];
+    maintainers = [];
   };
 }
 ```
 
-`buildRustPackage` requires a `cargoHash` attribute, computed over all crate sources of this package.
-
-::: {.warning}
-`cargoSha256` is already deprecated, and is subject to removal in favor of
-`cargoHash` which supports [SRI](https://www.w3.org/TR/SRI/) hashes.
-
-If you are still using `cargoSha256`, you can simply replace it with
-`cargoHash` and recompute the hash, or convert the original sha256 to SRI
-hash using `nix-hash --to-sri --type sha256 "<original sha256>"`.
-:::
+`buildRustPackage` requires either a `cargoHash` (preferred) or a
+`cargoSha256` attribute, computed over all crate sources of this package.
+`cargoHash` supports [SRI](https://www.w3.org/TR/SRI/) hashes and should be
+preferred over `cargoSha256` which was used for traditional Nix SHA-256 hashes.
+For example:
 
 ```nix
 {
@@ -63,7 +58,7 @@ hash using `nix-hash --to-sri --type sha256 "<original sha256>"`.
 }
 ```
 
-Exception: If the application has cargo `git` dependencies, the `cargoHash`
+Exception: If the application has cargo `git` dependencies, the `cargoHash`/`cargoSha256`
 approach will not work, and you will need to copy the `Cargo.lock` file of the application
 to nixpkgs and continue with the next section for specifying the options of the `cargoLock`
 section.
@@ -81,6 +76,14 @@ then be taken from the failed build. A fake hash can be used for
 }
 ```
 
+For `cargoSha256` you can use:
+
+```nix
+{
+  cargoSha256 = lib.fakeSha256;
+}
+```
+
 Per the instructions in the [Cargo Book](https://doc.rust-lang.org/cargo/guide/cargo-toml-vs-cargo-lock.html)
 best practices guide, Rust applications should always commit the `Cargo.lock`
 file in git to ensure a reproducible build. However, a few packages do not, and
@@ -95,7 +98,7 @@ directory into a tar.gz archive.
 The tarball with vendored dependencies contains a directory with the
 package's `name`, which is normally composed of `pname` and
 `version`. This means that the vendored dependencies hash
-(`cargoHash`) is dependent on the package name and
+(`cargoHash`/`cargoSha256`) is dependent on the package name and
 version. The `cargoDepsName` attribute can be used to use another name
 for the directory of vendored dependencies. For example, the hash can
 be made invariant to the version by setting `cargoDepsName` to
@@ -120,7 +123,7 @@ rustPlatform.buildRustPackage rec {
 
 ### Importing a `Cargo.lock` file {#importing-a-cargo.lock-file}
 
-Using a vendored hash (`cargoHash`) is tedious when using
+Using a vendored hash (`cargoHash`/`cargoSha256`) is tedious when using
 `buildRustPackage` within a project, since it requires that the hash
 is updated after every change to `Cargo.lock`. Therefore,
 `buildRustPackage` also supports vendoring dependencies directly from
@@ -642,7 +645,6 @@ builds the `retworkx` Python package. `fetchCargoTarball` and
 buildPythonPackage rec {
   pname = "retworkx";
   version = "0.6.0";
-  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Qiskit";
@@ -657,6 +659,8 @@ buildPythonPackage rec {
     hash = "sha256-heOBK8qi2nuc/Ib+I/vLzZ1fUUD/G/KTw9d7M4Hz5O0=";
   };
 
+  format = "pyproject";
+
   nativeBuildInputs = with rustPlatform; [ cargoSetupHook maturinBuildHook ];
 
   # ...
@@ -996,7 +1000,7 @@ rustPlatform.buildRustPackage rec {
   doCheck = false;
 
   meta = {
-    description = "Fast line-oriented regex search tool, similar to ag and ack";
+    description = "A fast line-oriented regex search tool, similar to ag and ack";
     homepage = "https://github.com/BurntSushi/ripgrep";
     license = with lib.licenses; [ mit unlicense ];
     maintainers = with lib.maintainers; [];

doc/languages-frameworks/scheme.section.md

@@ -1,35 +0,0 @@
-# Scheme {#sec-scheme}
-
-## Package Management {#sec-scheme-package-management}
-
-### Akku {#sec-scheme-package-management-akku}
-
-About two hundred R6RS & R7RS libraries from [Akku](https://akkuscm.org/)
-(which also mirrors [snow-fort](https://snow-fort.org/pkg))
-are available inside the `akkuPackages` attrset, and the Akku executable
-itself is at the top level as `akku`. The packages could be used
-in a derivation's `buildInputs`, work inside of `nix-shell`, and
-are tested using [Chez](https://www.scheme.com/) &
-[Chibi](https://synthcode.com/wiki/chibi-scheme)
-Scheme during build time.
-
-Including a package as a build input is done in the typical Nix fashion.
-For example, to include
-[a bunch of SRFIs](https://akkuscm.org/packages/chez-srfi/)
-primarily for Chez Scheme in a derivation, one might write:
-
-```nix
-{
-  buildInputs = [
-    chez
-    akkuPackages.chez-srfi
-  ];
-}
-
-```
-
-The package index is located in `pkgs/tools/package-management/akku`
-as `deps.toml`, and should be updated occasionally by running `./update.sh`
-in the directory. Doing so will pull the source URLs for new packages and
-more recent versions, then write them to the TOML.
-

doc/languages-frameworks/texlive.section.md

@@ -183,7 +183,7 @@ let
     '';
 
     meta = {
-      description = "LaTeX2e class for overhead transparencies";
+      description = "A LaTeX2e class for overhead transparencies";
       license = lib.licenses.unfreeRedistributable;
       maintainers = with lib.maintainers; [ veprbl ];
       platforms = lib.platforms.all;

doc/languages-frameworks/vim.section.md

@@ -226,18 +226,18 @@ Some plugins require overrides in order to function properly. Overrides are plac
 }
 ```
 
-Sometimes plugins require an override that must be changed when the plugin is updated. This can cause issues when Vim plugins are auto-updated but the associated override isn't updated. For these plugins, the override should be written so that it specifies all information required to install the plugin, and running `nix-shell -p vimPluginsUpdater --run vim-plugins-updater` doesn't change the derivation for the plugin. Manually updating the override is required to update these types of plugins. An example of such a plugin is `LanguageClient-neovim`.
+Sometimes plugins require an override that must be changed when the plugin is updated. This can cause issues when Vim plugins are auto-updated but the associated override isn't updated. For these plugins, the override should be written so that it specifies all information required to install the plugin, and running `./update.py` doesn't change the derivation for the plugin. Manually updating the override is required to update these types of plugins. An example of such a plugin is `LanguageClient-neovim`.
 
-To add a new plugin, run `nix-shell -p vimPluginsUpdater --run 'vim-plugins-updater add "[owner]/[name]"'`. **NOTE**: This script automatically commits to your git repository. Be sure to check out a fresh branch before running.
+To add a new plugin, run `./update.py add "[owner]/[name]"`. **NOTE**: This script automatically commits to your git repository. Be sure to check out a fresh branch before running.
 
-Finally, there are some plugins that are also packaged in nodePackages because they have Javascript-related build steps, such as running webpack. Those plugins are not listed in `vim-plugin-names` or managed by `vimPluginsUpdater` at all, and are included separately in `overrides.nix`. Currently, all these plugins are related to the `coc.nvim` ecosystem of the Language Server Protocol integration with Vim/Neovim.
+Finally, there are some plugins that are also packaged in nodePackages because they have Javascript-related build steps, such as running webpack. Those plugins are not listed in `vim-plugin-names` or managed by `update.py` at all, and are included separately in `overrides.nix`. Currently, all these plugins are related to the `coc.nvim` ecosystem of the Language Server Protocol integration with Vim/Neovim.
 
 ## Updating plugins in nixpkgs {#updating-plugins-in-nixpkgs}
 
 Run the update script with a GitHub API token that has at least `public_repo` access. Running the script without the token is likely to result in rate-limiting (429 errors). For steps on creating an API token, please refer to [GitHub's token documentation](https://docs.github.com/en/free-pro-team@latest/github/authenticating-to-github/creating-a-personal-access-token).
 
 ```sh
-nix-shell -p vimPluginsUpdater --run 'vim-plugins-updater --github-token=mytoken' # or set GITHUB_API_TOKEN environment variable
+GITHUB_API_TOKEN=my_token ./pkgs/applications/editors/vim/plugins/update.py
 ```
 
 Alternatively, set the number of processes to a lower count to avoid rate-limiting.

doc/manual.md.in

@@ -12,5 +12,4 @@ stdenv.md
 build-helpers.md
 development.md
 contributing.md
-interoperability.md
 ```

doc/packages/ibus.section.md

@@ -11,8 +11,7 @@ On NixOS, you need to explicitly enable `ibus` with given engines before customi
 ```nix
 { pkgs, ... }: {
   i18n.inputMethod = {
-    enable = true;
-    type = "ibus";
+    enabled = "ibus";
     ibus.engines = with pkgs.ibus-engines; [ typing-booster ];
   };
 }

doc/packages/index.md

@@ -24,7 +24,6 @@ shell-helpers.section.md
 steam.section.md
 cataclysm-dda.section.md
 urxvt.section.md
-vcpkg.section.md
 weechat.section.md
 xorg.section.md
 ```

doc/packages/vcpkg.section.md

@@ -1,24 +0,0 @@
-# VCPKG {#sec-vcpkg}
-
-The `vcpkg-tool` package  has a wrapper around the `vcpkg` executable to avoid writing to the nix store.
-The wrapper will also be present in `vcpkg`, unless you specify `vcpkg.override { vcpkg-tool = vcpkg-tool-unwrapped; }`
-
-The wrapper has been made in a way so that it will provide default cli arguments, but tries not to interfere if the user provides the same arguments.
-The arguments also have corresponding environment variables that can be used as an alternative way of overriding these paths.
-
-Run the wrapper with the environment variable `NIX_VCPKG_DEBUG_PRINT_ENVVARS=true` to get a full list of corresponding environment variables.
-
-## Nix specific environment variables {#sec-vcpkg-nix-envvars}
-
-The wrapper also provides some new nix-specific environment variables that lets you control some of the wrapper functionality.
-
-- `NIX_VCPKG_WRITABLE_PATH = <path>`
-
-   Set this environment variable to specify the path where `vcpkg` will store buildtime artifacts.
-   This will become the base path for all of the other paths.
-
-- `NIX_VCPKG_DEBUG_PRINT_ENVVARS = true | false`
-
-   Set this to `true` for the wrapper to print the corresponding environment variables for the arguments that will be provided to the unwrapped executable.
-   The list of variables will be printed right before invoking `vcpkg`.
-   This can be useful if you suspect that the wrapper for some reason was unable to prioritize user-provided cli args over its default ones, or for fixing other issues like typos or unexpanded environment variables.

doc/shell.nix

@@ -1,7 +1,20 @@
 let
   pkgs = import ../. {
-    config = { };
-    overlays = [ ];
+    config = {};
+    overlays = [];
+  };
+
+  common = import ./common.nix;
+  inherit (common) outputPath indexPath;
+
+  web-devmode = import ../pkgs/tools/nix/web-devmode.nix {
+    inherit pkgs;
+    buildArgs = "./.";
+    open = "/${outputPath}/${indexPath}";
   };
 in
-pkgs.nixpkgs-manual.shell
+  pkgs.mkShell {
+    packages = [
+      web-devmode
+    ];
+  }

doc/stdenv/meta.chapter.md

@@ -5,7 +5,7 @@ Nix packages can declare *meta-attributes* that contain information about a pack
 ```nix
 {
   meta = {
-    description = "Program that produces a familiar, friendly greeting";
+    description = "A program that produces a familiar, friendly greeting";
     longDescription = ''
       GNU Hello is a program that prints "Hello, world!" when you run it.
       It is fully customizable.
@@ -81,12 +81,6 @@ The license, or licenses, for the package. One from the attribute set defined in
 
 For details, see [Licenses](#sec-meta-license).
 
-### `sourceProvenance` {#var-meta-sourceProvenance}
-
-A list containing the type or types of source inputs from which the package is built, e.g. original source code, pre-built binaries, etc.
-
-For details, see [Source provenance](#sec-meta-sourceProvenance).
-
 ### `maintainers` {#var-meta-maintainers}
 
 A list of the maintainers of this Nix expression. Maintainers are defined in [`nixpkgs/maintainers/maintainer-list.nix`](https://github.com/NixOS/nixpkgs/blob/master/maintainers/maintainer-list.nix). There is no restriction to becoming a maintainer, just add yourself to that list in a separate commit titled “maintainers: add alice” in the same pull request, and reference maintainers with `maintainers = with lib.maintainers; [ alice bob ]`.

doc/stdenv/stdenv.chapter.md

@@ -1527,11 +1527,7 @@ The following flags are disabled by default and should be enabled with `hardenin
 
 #### `pie` {#pie}
 
-This flag is disabled by default for normal `glibc` based NixOS package builds, but enabled by default for
-
-  - `musl`-based package builds, except on Aarch64 and Aarch32, where there are issues.
-
-  - Statically-linked for OpenBSD builds, where it appears to be required to get a working binary.
+This flag is disabled by default for normal `glibc` based NixOS package builds, but enabled by default for `musl` based package builds.
 
 Adds the `-fPIE` compiler and `-pie` linker options. Position Independent Executables are needed to take advantage of Address Space Layout Randomization, supported by modern kernel versions. While ASLR can already be enforced for data areas in the stack and heap (brk and mmap), the code areas must be compiled as position-independent. Shared libraries already do this with the `pic` flag, so they gain ASLR automatically, but binary .text regions need to be build with `pie` to gain ASLR. When this happens, ROP attacks are much harder since there are no static locations to bounce off of during a memory corruption attack.
 

doc/tests/manpage-urls.nix

@@ -1,32 +0,0 @@
-# To build this derivation, run `nix-build -A nixpkgs-manual.tests.manpage-urls`
-{
-  lib,
-  runCommand,
-  invalidateFetcherByDrvHash,
-  cacert,
-  python3,
-}:
-
-invalidateFetcherByDrvHash (
-  {
-    name ? "manual_check-manpage-urls",
-    script ? ./manpage-urls.py,
-    urlsFile ? ../manpage-urls.json,
-  }:
-  runCommand name
-    {
-      nativeBuildInputs = [
-        cacert
-        (python3.withPackages (p: [
-          p.aiohttp
-          p.rich
-          p.structlog
-        ]))
-      ];
-      outputHash = "sha256-47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU="; # Empty output
-    }
-    ''
-      python3 ${script} ${urlsFile}
-      touch $out
-    ''
-) { }

lib/attrsets.nix

@@ -1764,7 +1764,6 @@ rec {
   /**
     Get a package output.
     If no output is found, fallback to `.out` and then to the default.
-    The function is idempotent: `getOutput "b" (getOutput "a" p) == getOutput "a" p`.
 
 
     # Inputs
@@ -1780,7 +1779,7 @@ rec {
     # Type
 
     ```
-    getOutput :: String -> :: Derivation -> Derivation
+    getOutput :: String -> Derivation -> String
     ```
 
     # Examples
@@ -1788,7 +1787,7 @@ rec {
     ## `lib.attrsets.getOutput` usage example
 
     ```nix
-    "${getOutput "dev" pkgs.openssl}"
+    getOutput "dev" pkgs.openssl
     => "/nix/store/9rz8gxhzf8sw4kf2j2f1grr49w8zx5vj-openssl-1.0.1r-dev"
     ```
 
@@ -1799,49 +1798,6 @@ rec {
       then pkg.${output} or pkg.out or pkg
       else pkg;
 
-  /**
-    Get the first of the `outputs` provided by the package, or the default.
-    This function is alligned with `_overrideFirst()` from the `multiple-outputs.sh` setup hook.
-    Like `getOutput`, the function is idempotent.
-
-    # Inputs
-
-    `outputs`
-
-    : 1\. Function argument
-
-    `pkg`
-
-    : 2\. Function argument
-
-    # Type
-
-    ```
-    getFirstOutput :: [String] -> Derivation -> Derivation
-    ```
-
-    # Examples
-    :::{.example}
-    ## `lib.attrsets.getFirstOutput` usage example
-
-    ```nix
-    "${getFirstOutput [ "include" "dev" ] pkgs.openssl}"
-    => "/nix/store/00000000000000000000000000000000-openssl-1.0.1r-dev"
-    ```
-
-    :::
-  */
-  getFirstOutput =
-    candidates: pkg:
-    let
-      outputs = builtins.filter (name: hasAttr name pkg) candidates;
-      output = builtins.head outputs;
-    in
-    if pkg.outputSpecified or false || outputs == [ ] then
-      pkg
-    else
-      pkg.${output};
-
   /**
     Get a package's `bin` output.
     If the output does not exist, fallback to `.out` and then to the default.
@@ -1855,7 +1811,7 @@ rec {
     # Type
 
     ```
-    getBin :: Derivation -> Derivation
+    getBin :: Derivation -> String
     ```
 
     # Examples
@@ -1863,8 +1819,8 @@ rec {
     ## `lib.attrsets.getBin` usage example
 
     ```nix
-    "${getBin pkgs.openssl}"
-    => "/nix/store/00000000000000000000000000000000-openssl-1.0.1r"
+    getBin pkgs.openssl
+    => "/nix/store/9rz8gxhzf8sw4kf2j2f1grr49w8zx5vj-openssl-1.0.1r"
     ```
 
     :::
@@ -1885,7 +1841,7 @@ rec {
     # Type
 
     ```
-    getLib :: Derivation -> Derivation
+    getLib :: Derivation -> String
     ```
 
     # Examples
@@ -1893,7 +1849,7 @@ rec {
     ## `lib.attrsets.getLib` usage example
 
     ```nix
-    "${getLib pkgs.openssl}"
+    getLib pkgs.openssl
     => "/nix/store/9rz8gxhzf8sw4kf2j2f1grr49w8zx5vj-openssl-1.0.1r-lib"
     ```
 
@@ -1901,35 +1857,6 @@ rec {
   */
   getLib = getOutput "lib";
 
-  /**
-    Get a package's `static` output.
-    If the output does not exist, fallback to `.lib`, then to `.out`, and then to the default.
-
-    # Inputs
-
-    `pkg`
-
-    : The package whose `static` output will be retrieved.
-
-    # Type
-
-    ```
-    getStatic :: Derivation -> Derivation
-    ```
-
-    # Examples
-    :::{.example}
-    ## `lib.attrsets.getStatic` usage example
-
-    ```nix
-    "${lib.getStatic pkgs.glibc}"
-    => "/nix/store/00000000000000000000000000000000-glibc-2.39-52-static"
-    ```
-
-    :::
-  */
-  getStatic = getFirstOutput [ "static" "lib" "out" ];
-
 
   /**
     Get a package's `dev` output.
@@ -1944,7 +1871,7 @@ rec {
     # Type
 
     ```
-    getDev :: Derivation -> Derivation
+    getDev :: Derivation -> String
     ```
 
     # Examples
@@ -1952,7 +1879,7 @@ rec {
     ## `lib.attrsets.getDev` usage example
 
     ```nix
-    "${getDev pkgs.openssl}"
+    getDev pkgs.openssl
     => "/nix/store/9rz8gxhzf8sw4kf2j2f1grr49w8zx5vj-openssl-1.0.1r-dev"
     ```
 
@@ -1960,35 +1887,6 @@ rec {
   */
   getDev = getOutput "dev";
 
-  /**
-    Get a package's `include` output.
-    If the output does not exist, fallback to `.dev`, then to `.out`, and then to the default.
-
-    # Inputs
-
-    `pkg`
-
-    : The package whose `include` output will be retrieved.
-
-    # Type
-
-    ```
-    getInclude :: Derivation -> Derivation
-    ```
-
-    # Examples
-    :::{.example}
-    ## `lib.attrsets.getInclude` usage example
-
-    ```nix
-    "${getInclude pkgs.openssl}"
-    => "/nix/store/00000000000000000000000000000000-openssl-1.0.1r-dev"
-    ```
-
-    :::
-  */
-  getInclude = getFirstOutput [ "include" "dev" "out" ];
-
 
   /**
     Get a package's `man` output.
@@ -2003,7 +1901,7 @@ rec {
     # Type
 
     ```
-    getMan :: Derivation -> Derivation
+    getMan :: Derivation -> String
     ```
 
     # Examples
@@ -2011,7 +1909,7 @@ rec {
     ## `lib.attrsets.getMan` usage example
 
     ```nix
-    "${getMan pkgs.openssl}"
+    getMan pkgs.openssl
     => "/nix/store/9rz8gxhzf8sw4kf2j2f1grr49w8zx5vj-openssl-1.0.1r-man"
     ```
 
@@ -2031,7 +1929,7 @@ rec {
     # Type
 
     ```
-    chooseDevOutputs :: [Derivation] -> [Derivation]
+    chooseDevOutputs :: [Derivation] -> [String]
     ```
   */
   chooseDevOutputs = builtins.map getDev;

lib/default.nix

@@ -64,9 +64,6 @@ let
     # linux kernel configuration
     kernel = callLibs ./kernel.nix;
 
-    # network
-    network = callLibs ./network;
-
     # TODO: For consistency, all builtins should also be available from a sub-library;
     # these are the only ones that are currently not
     inherit (builtins) addErrorContext isPath trace typeOf unsafeGetAttrPos;
@@ -76,7 +73,7 @@ let
       info showWarnings nixpkgsVersion version isInOldestRelease
       mod compare splitByAndCompare seq deepSeq lessThan add sub
       functionArgs setFunctionArgs isFunction toFunction mirrorFunctionArgs
-      fromHexString toHexString toBaseDigits inPureEvalMode isBool isInt pathExists
+      toHexString toBaseDigits inPureEvalMode isBool isInt pathExists
       genericClosure readFile;
     inherit (self.fixedPoints) fix fix' converge extends composeExtensions
       composeManyExtensions makeExtensible makeExtensibleWithCustomName;
@@ -86,8 +83,8 @@ let
       mapAttrs' mapAttrsToList attrsToList concatMapAttrs mapAttrsRecursive
       mapAttrsRecursiveCond genAttrs isDerivation toDerivation optionalAttrs
       zipAttrsWithNames zipAttrsWith zipAttrs recursiveUpdateUntil
-      recursiveUpdate matchAttrs mergeAttrsList overrideExisting showAttrPath getOutput getFirstOutput
-      getBin getLib getStatic getDev getInclude getMan chooseDevOutputs zipWithNames zip
+      recursiveUpdate matchAttrs mergeAttrsList overrideExisting showAttrPath getOutput
+      getBin getLib getDev getMan chooseDevOutputs zipWithNames zip
       recurseIntoAttrs dontRecurseIntoAttrs cartesianProduct cartesianProductOfSets
       mapCartesianProduct updateManyAttrsByPath listToAttrs hasAttr getAttr isAttrs intersectAttrs removeAttrs;
     inherit (self.lists) singleton forEach map foldr fold foldl foldl' imap0 imap1
@@ -105,7 +102,7 @@ let
       hasInfix hasPrefix hasSuffix stringToCharacters stringAsChars escape
       escapeShellArg escapeShellArgs
       isStorePath isStringLike
-      isValidPosixName toShellVar toShellVars trim trimWith
+      isValidPosixName toShellVar toShellVars
       escapeRegex escapeURL escapeXML replaceChars lowerChars
       upperChars toLower toUpper addContextFrom splitString
       removePrefix removeSuffix versionOlder versionAtLeast
@@ -123,7 +120,7 @@ let
     inherit (self.derivations) lazyDerivation optionalDrvAttr;
     inherit (self.meta) addMetaAttrs dontDistribute setName updateName
       appendToName mapDerivationAttrset setPrio lowPrio lowPrioSet hiPrio
-      hiPrioSet getLicenseFromSpdxId getLicenseFromSpdxIdOr getExe getExe';
+      hiPrioSet getLicenseFromSpdxId getExe getExe';
     inherit (self.filesystem) pathType pathIsDirectory pathIsRegularFile
       packagesFromDirectoryRecursive;
     inherit (self.sources) cleanSourceFilter

lib/deprecated/misc.nix

@@ -29,10 +29,9 @@ let
     nameValuePair
     tail
     toList
-    warn
     ;
 
-  inherit (lib.attrsets) removeAttrs mapAttrsToList;
+  inherit (lib.attrsets) removeAttrs;
 
   # returns default if env var is not set
   maybeEnv = name: default:
@@ -213,7 +212,7 @@ let
     else closePropagationSlow;
 
   # calls a function (f attr value ) for each record item. returns a list
-  mapAttrsFlatten = warn "lib.misc.mapAttrsFlatten is deprecated, please use lib.attrsets.mapAttrsToList instead." mapAttrsToList;
+  mapAttrsFlatten = f: r: map (attr: f attr r.${attr}) (attrNames r);
 
   # attribute set containing one attribute
   nvs = name: value: listToAttrs [ (nameValuePair name value) ];

lib/fileset/README.md

@@ -236,7 +236,7 @@ File sets cannot add single files to the store, they can only import files under
 Arguments:
 - (+) There's no point in using this library for a single file, since you can't do anything other than add it to the store or not.
   And it would be unclear how the library should behave if the one file wouldn't be added to the store:
-  `toSource { root = ./file.nix; fileset = <empty>; }` has no reasonable result because returning an empty store path wouldn't match the file type, and there's no way to have an empty file store path, whatever that would mean.
+  `toSource { root = ./file.nix; fileset = <empty>; }` has no reasonable result because returing an empty store path wouldn't match the file type, and there's no way to have an empty file store path, whatever that would mean.
 
 ### `fileFilter` takes a path
 

lib/licenses.nix

@@ -1,29 +1,25 @@
 { lib }:
-let
-  inherit (lib) optionalAttrs;
 
-  mkLicense = lname: {
-    shortName ? lname,
-    # Most of our licenses are Free, explicitly declare unfree additions as such!
-    free ? true,
-    deprecated ? false,
-    spdxId ? null,
-    url ? null,
-    fullName ? null,
-    redistributable ? free
-  }@attrs: {
-    inherit shortName free deprecated redistributable;
-  } // optionalAttrs (attrs ? spdxId) {
-    inherit spdxId;
-    url = "https://spdx.org/licenses/${spdxId}.html";
-  } // optionalAttrs (attrs ? url) {
-    inherit url;
-  } // optionalAttrs (attrs ? fullName) {
-    inherit fullName;
+lib.mapAttrs (lname: lset: let
+  defaultLicense = {
+    shortName = lname;
+    free = true; # Most of our licenses are Free, explicitly declare unfree additions as such!
+    deprecated = false;
   };
 
-in
-lib.mapAttrs mkLicense ({
+  mkLicense = licenseDeclaration: let
+    applyDefaults = license: defaultLicense // license;
+    applySpdx = license:
+      if license ? spdxId
+      then license // { url = "https://spdx.org/licenses/${license.spdxId}.html"; }
+      else license;
+    applyRedistributable = license: { redistributable = license.free; } // license;
+  in lib.pipe licenseDeclaration [
+    applyDefaults
+    applySpdx
+    applyRedistributable
+  ];
+in mkLicense lset) ({
   /* License identifiers from spdx.org where possible.
    * If you cannot find your license here, then look for a similar license or
    * add it to this list. The URL mentioned above is a good source for inspiration.
@@ -321,12 +317,6 @@ lib.mapAttrs mkLicense ({
     free = false;
   };
 
-  cc-by-nd-40 = {
-    spdxId = "CC-BY-ND-4.0";
-    fullName = "Creative Commons Attribution-No Derivative Works v4.0";
-    free = false;
-  };
-
   cc-by-sa-10 = {
     spdxId = "CC-BY-SA-1.0";
     fullName = "Creative Commons Attribution Share Alike 1.0";
@@ -927,7 +917,7 @@ lib.mapAttrs mkLicense ({
 
   ncbiPd = {
     spdxId = "NCBI-PD";
-    fullName = "NCBI Public Domain Notice";
+    fullname = "NCBI Public Domain Notice";
     # Due to United States copyright law, anything with this "license" does not have a copyright in the
     # jurisdiction of the United States. However, other jurisdictions may assign the United States
     # government copyright to the work, and the license explicitly states that in such a case, no license
@@ -1099,11 +1089,6 @@ lib.mapAttrs mkLicense ({
     url = "https://qwt.sourceforge.io/qwtlicense.html";
   };
 
-  radiance = {
-    fullName = "The Radiance Software License, Version 2.0";
-    url = "https://github.com/LBNL-ETA/Radiance/blob/master/License.txt";
-  };
-
   ruby = {
     spdxId = "Ruby";
     fullName = "Ruby License";
@@ -1176,7 +1161,7 @@ lib.mapAttrs mkLicense ({
     shortName = "TSL";
     fullName = "Timescale License Agreegment";
     url = "https://github.com/timescale/timescaledb/blob/main/tsl/LICENSE-TIMESCALE";
-    free = false;
+    unfree = true;
   };
 
   tcltk = {
@@ -1312,7 +1297,7 @@ lib.mapAttrs mkLicense ({
 
   zsh = {
     url = "https://github.com/zsh-users/zsh/blob/master/LICENCE";
-    fullName = "Zsh License";
+    fulllName = "Zsh License";
   };
 
   zpl20 = {

lib/meta.nix

@@ -287,10 +287,10 @@ rec {
     all (elem: !platformMatch platform elem) (pkg.meta.badPlatforms or []);
 
   /**
-    Get the corresponding attribute in lib.licenses from the SPDX ID
-    or warn and fallback to `{ shortName = <license string>; }`.
-
-    For SPDX IDs, see https://spdx.org/licenses
+    Get the corresponding attribute in lib.licenses
+    from the SPDX ID.
+    For SPDX IDs, see
+    https://spdx.org/licenses
 
     # Type
 
@@ -315,56 +315,14 @@ rec {
     :::
   */
   getLicenseFromSpdxId =
-    licstr:
-      getLicenseFromSpdxIdOr licstr (
-        lib.warn "getLicenseFromSpdxId: No license matches the given SPDX ID: ${licstr}"
-        { shortName = licstr; }
-      );
-
-  /**
-    Get the corresponding attribute in lib.licenses from the SPDX ID
-    or fallback to the given default value.
-
-    For SPDX IDs, see https://spdx.org/licenses
-
-    # Inputs
-
-    `licstr`
-    : 1\. SPDX ID string to find a matching license
-
-    `default`
-    : 2\. Fallback value when a match is not found
-
-    # Type
-
-    ```
-    getLicenseFromSpdxIdOr :: str -> Any -> Any
-    ```
-
-    # Examples
-    :::{.example}
-    ## `lib.meta.getLicenseFromSpdxIdOr` usage example
-
-    ```nix
-    lib.getLicenseFromSpdxIdOr "MIT" null == lib.licenses.mit
-    => true
-    lib.getLicenseFromSpdxId "mIt" null == lib.licenses.mit
-    => true
-    lib.getLicenseFromSpdxIdOr "MY LICENSE" lib.licenses.free == lib.licenses.free
-    => true
-    lib.getLicenseFromSpdxIdOr "MY LICENSE" null
-    => null
-    lib.getLicenseFromSpdxIdOr "MY LICENSE" (builtins.throw "No SPDX ID matches MY LICENSE")
-    => error: No SPDX ID matches MY LICENSE
-    ```
-    :::
-  */
-  getLicenseFromSpdxIdOr =
     let
       spdxLicenses = lib.mapAttrs (id: ls: assert lib.length ls == 1; builtins.head ls)
         (lib.groupBy (l: lib.toLower l.spdxId) (lib.filter (l: l ? spdxId) (lib.attrValues lib.licenses)));
-    in licstr: default:
-      spdxLicenses.${ lib.toLower licstr } or default;
+    in licstr:
+      spdxLicenses.${ lib.toLower licstr } or (
+        lib.warn "getLicenseFromSpdxId: No license matches the given SPDX ID: ${licstr}"
+        { shortName = licstr; }
+      );
 
   /**
     Get the path to the main program of a package based on meta.mainProgram

lib/network/default.nix

@@ -1,49 +0,0 @@
-{ lib }:
-let
-  inherit (import ./internal.nix { inherit lib; }) _ipv6;
-in
-{
-  ipv6 = {
-    /**
-      Creates an `IPv6Address` object from an IPv6 address as a string. If
-      the prefix length is omitted, it defaults to 64. The parser is limited
-      to the first two versions of IPv6 addresses addressed in RFC 4291.
-      The form "x:x:x:x:x:x:d.d.d.d" is not yet implemented. Addresses are
-      NOT compressed, so they are not always the same as the canonical text
-      representation of IPv6 addresses defined in RFC 5952.
-
-      # Type
-
-      ```
-      fromString :: String -> IPv6Address
-      ```
-
-      # Examples
-
-      ```nix
-      fromString "2001:DB8::ffff/32"
-      => {
-        address = "2001:db8:0:0:0:0:0:ffff";
-        prefixLength = 32;
-      }
-      ```
-
-      # Arguments
-
-      - [addr] An IPv6 address with optional prefix length.
-    */
-    fromString =
-      addr:
-      let
-        splittedAddr = _ipv6.split addr;
-
-        addrInternal = splittedAddr.address;
-        prefixLength = splittedAddr.prefixLength;
-
-        address = _ipv6.toStringFromExpandedIp addrInternal;
-      in
-      {
-        inherit address prefixLength;
-      };
-  };
-}

lib/network/internal.nix

@@ -1,209 +0,0 @@
-{
-  lib ? import ../.,
-}:
-let
-  inherit (builtins)
-    map
-    match
-    genList
-    length
-    concatMap
-    head
-    toString
-    ;
-
-  inherit (lib) lists strings trivial;
-
-  inherit (lib.lists) last;
-
-  /*
-    IPv6 addresses are 128-bit identifiers. The preferred form is 'x:x:x:x:x:x:x:x',
-    where the 'x's are one to four hexadecimal digits of the eight 16-bit pieces of
-    the address. See RFC 4291.
-  */
-  ipv6Bits = 128;
-  ipv6Pieces = 8; # 'x:x:x:x:x:x:x:x'
-  ipv6PieceBits = 16; # One piece in range from 0 to 0xffff.
-  ipv6PieceMaxValue = 65535; # 2^16 - 1
-in
-let
-  /**
-    Expand an IPv6 address by removing the "::" compression and padding them
-    with the necessary number of zeros. Converts an address from the string to
-    the list of strings which then can be parsed using `_parseExpanded`.
-    Throws an error when the address is malformed.
-
-    # Type: String -> [ String ]
-
-    # Example:
-
-    ```nix
-    expandIpv6 "2001:DB8::ffff"
-    => ["2001" "DB8" "0" "0" "0" "0" "0" "ffff"]
-    ```
-  */
-  expandIpv6 =
-    addr:
-    if match "^[0-9A-Fa-f:]+$" addr == null then
-      throw "${addr} contains malformed characters for IPv6 address"
-    else
-      let
-        pieces = strings.splitString ":" addr;
-        piecesNoEmpty = lists.remove "" pieces;
-        piecesNoEmptyLen = length piecesNoEmpty;
-        zeros = genList (_: "0") (ipv6Pieces - piecesNoEmptyLen);
-        hasPrefix = strings.hasPrefix "::" addr;
-        hasSuffix = strings.hasSuffix "::" addr;
-        hasInfix = strings.hasInfix "::" addr;
-      in
-      if addr == "::" then
-        zeros
-      else if
-        let
-          emptyCount = length pieces - piecesNoEmptyLen;
-          emptyExpected =
-            # splitString produces two empty pieces when "::" in the beginning
-            # or in the end, and only one when in the middle of an address.
-            if hasPrefix || hasSuffix then
-              2
-            else if hasInfix then
-              1
-            else
-              0;
-        in
-        emptyCount != emptyExpected
-        || (hasInfix && piecesNoEmptyLen >= ipv6Pieces) # "::" compresses at least one group of zeros.
-        || (!hasInfix && piecesNoEmptyLen != ipv6Pieces)
-      then
-        throw "${addr} is not a valid IPv6 address"
-      # Create a list of 8 elements, filling some of them with zeros depending
-      # on where the "::" was found.
-      else if hasPrefix then
-        zeros ++ piecesNoEmpty
-      else if hasSuffix then
-        piecesNoEmpty ++ zeros
-      else if hasInfix then
-        concatMap (piece: if piece == "" then zeros else [ piece ]) pieces
-      else
-        pieces;
-
-  /**
-    Parses an expanded IPv6 address (see `expandIpv6`), converting each part
-    from a string to an u16 integer. Returns an internal representation of IPv6
-    address (list of integers) that can be easily processed by other helper
-    functions.
-    Throws an error some element is not an u16 integer.
-
-    # Type: [ String ] -> IPv6
-
-    # Example:
-
-    ```nix
-    parseExpandedIpv6 ["2001" "DB8" "0" "0" "0" "0" "0" "ffff"]
-    => [8193 3512 0 0 0 0 0 65535]
-    ```
-  */
-  parseExpandedIpv6 =
-    addr:
-    assert lib.assertMsg (
-      length addr == ipv6Pieces
-    ) "parseExpandedIpv6: expected list of integers with ${ipv6Pieces} elements";
-    let
-      u16FromHexStr =
-        hex:
-        let
-          parsed = trivial.fromHexString hex;
-        in
-        if 0 <= parsed && parsed <= ipv6PieceMaxValue then
-          parsed
-        else
-          throw "0x${hex} is not a valid u16 integer";
-    in
-    map (piece: u16FromHexStr piece) addr;
-in
-let
-  /**
-    Parses an IPv6 address from a string to the internal representation (list
-    of integers).
-
-    # Type: String -> IPv6
-
-    # Example:
-
-    ```nix
-    parseIpv6FromString "2001:DB8::ffff"
-    => [8193 3512 0 0 0 0 0 65535]
-    ```
-  */
-  parseIpv6FromString = addr: parseExpandedIpv6 (expandIpv6 addr);
-in
-{
-  /*
-    Internally, an IPv6 address is stored as a list of 16-bit integers with 8
-    elements. Wherever you see `IPv6` in internal functions docs, it means that
-    it is a list of integers produced by one of the internal parsers, such as
-    `parseIpv6FromString`
-  */
-  _ipv6 = {
-    /**
-      Converts an internal representation of an IPv6 address (i.e, a list
-      of integers) to a string. The returned string is not a canonical
-      representation as defined in RFC 5952, i.e zeros are not compressed.
-
-      # Type: IPv6 -> String
-
-      # Example:
-
-      ```nix
-      parseIpv6FromString [8193 3512 0 0 0 0 0 65535]
-      => "2001:db8:0:0:0:0:0:ffff"
-      ```
-    */
-    toStringFromExpandedIp =
-      pieces: strings.concatMapStringsSep ":" (piece: strings.toLower (trivial.toHexString piece)) pieces;
-
-    /**
-      Extract an address and subnet prefix length from a string. The subnet
-      prefix length is optional and defaults to 128. The resulting address and
-      prefix length are validated and converted to an internal representation
-      that can be used by other functions.
-
-      # Type: String -> [ {address :: IPv6, prefixLength :: Int} ]
-
-      # Example:
-
-      ```nix
-      split "2001:DB8::ffff/32"
-      => {
-        address = [8193 3512 0 0 0 0 0 65535];
-        prefixLength = 32;
-      }
-      ```
-    */
-    split =
-      addr:
-      let
-        splitted = strings.splitString "/" addr;
-        splittedLength = length splitted;
-      in
-      if splittedLength == 1 then # [ ip ]
-        {
-          address = parseIpv6FromString addr;
-          prefixLength = ipv6Bits;
-        }
-      else if splittedLength == 2 then # [ ip subnet ]
-        {
-          address = parseIpv6FromString (head splitted);
-          prefixLength =
-            let
-              n = strings.toInt (last splitted);
-            in
-            if 1 <= n && n <= ipv6Bits then
-              n
-            else
-              throw "${addr} IPv6 subnet should be in range [1;${toString ipv6Bits}], got ${toString n}";
-        }
-      else
-        throw "${addr} is not a valid IPv6 address in CIDR notation";
-  };
-}

lib/systems/default.nix

@@ -323,7 +323,6 @@ let
             os =
               /**/ if rust ? platform then rust.platform.os or "none"
               else if final.isDarwin then "macos"
-              else if final.isWasm && !final.isWasi then "unknown" # Needed for {wasm32,wasm64}-unknown-unknown.
               else final.parsed.kernel.name;
 
             # https://doc.rust-lang.org/reference/conditional-compilation.html#target_family

lib/systems/flake-systems.nix

@@ -24,5 +24,6 @@
   # "armv5tel-linux" is excluded because it is not bootstrapped
   "powerpc64le-linux"
   "riscv64-linux"
-  "x86_64-freebsd"
+
+  # "x86_64-freebsd" is excluded because it is mostly broken
 ]

lib/tests/misc.nix

@@ -58,7 +58,6 @@ let
     genList
     getExe
     getExe'
-    getLicenseFromSpdxIdOr
     groupBy
     groupBy'
     hasAttrByPath
@@ -103,7 +102,6 @@ let
     testAllTrue
     toBaseDigits
     toHexString
-    fromHexString
     toInt
     toIntBase10
     toShellVars
@@ -288,21 +286,6 @@ runTests {
     expected = "FA";
   };
 
-  testFromHexStringFirstExample = {
-    expr = fromHexString "FF";
-    expected = 255;
-  };
-
-  testFromHexStringSecondExample = {
-    expr = fromHexString (builtins.hashString "sha256" "test");
-    expected = 9223372036854775807;
-  };
-
-  testFromHexStringWithPrefix = {
-    expr = fromHexString "0Xf";
-    expected = 15;
-  };
-
   testToBaseDigits = {
     expr = toBaseDigits 2 6;
     expected = [ 1 1 0 ];
@@ -369,72 +352,6 @@ runTests {
     expected = "hellohellohellohellohello";
   };
 
-  # Test various strings are trimmed correctly
-  testTrimString = {
-    expr =
-    let
-      testValues = f: mapAttrs (_: f) {
-        empty = "";
-        cr = "\r";
-        lf = "\n";
-        tab = "\t";
-        spaces = "   ";
-        leading = "  Hello, world";
-        trailing = "Hello, world   ";
-        mixed = " Hello, world ";
-        mixed-tabs = " \t\tHello, world \t \t ";
-        multiline = "  Hello,\n  world!  ";
-        multiline-crlf = "  Hello,\r\n  world!  ";
-      };
-    in
-      {
-        leading = testValues (strings.trimWith { start = true; });
-        trailing = testValues (strings.trimWith { end = true; });
-        both = testValues strings.trim;
-      };
-    expected = {
-      leading = {
-        empty = "";
-        cr = "";
-        lf = "";
-        tab = "";
-        spaces = "";
-        leading = "Hello, world";
-        trailing = "Hello, world   ";
-        mixed = "Hello, world ";
-        mixed-tabs = "Hello, world \t \t ";
-        multiline = "Hello,\n  world!  ";
-        multiline-crlf = "Hello,\r\n  world!  ";
-      };
-      trailing = {
-        empty = "";
-        cr = "";
-        lf = "";
-        tab = "";
-        spaces = "";
-        leading = "  Hello, world";
-        trailing = "Hello, world";
-        mixed = " Hello, world";
-        mixed-tabs = " \t\tHello, world";
-        multiline = "  Hello,\n  world!";
-        multiline-crlf = "  Hello,\r\n  world!";
-      };
-      both = {
-        empty = "";
-        cr = "";
-        lf = "";
-        tab = "";
-        spaces = "";
-        leading = "Hello, world";
-        trailing = "Hello, world";
-        mixed = "Hello, world";
-        mixed-tabs = "Hello, world";
-        multiline = "Hello,\n  world!";
-        multiline-crlf = "Hello,\r\n  world!";
-      };
-    };
-  };
-
   testSplitStringsSimple = {
     expr = strings.splitString "." "a.b.c.d";
     expected = [ "a" "b" "c" "d" ];
@@ -2390,25 +2307,6 @@ runTests {
     getExe' { type = "derivation"; } "dir/executable"
   );
 
-  testGetLicenseFromSpdxIdOrExamples = {
-    expr = [
-      (getLicenseFromSpdxIdOr "MIT" null)
-      (getLicenseFromSpdxIdOr "mIt" null)
-      (getLicenseFromSpdxIdOr "MY LICENSE" lib.licenses.free)
-      (getLicenseFromSpdxIdOr "MY LICENSE" null)
-    ];
-    expected = [
-      lib.licenses.mit
-      lib.licenses.mit
-      lib.licenses.free
-      null
-    ];
-  };
-
-  testGetLicenseFromSpdxIdOrThrow = testingThrow (
-    getLicenseFromSpdxIdOr "MY LICENSE" (throw "No SPDX ID matches MY LICENSE")
-  );
-
   testPlatformMatch = {
     expr = meta.platformMatch { system = "x86_64-linux"; } "x86_64-linux";
     expected = true;

lib/tests/modules/define-_module-args-custom.nix

@@ -1,4 +1,4 @@
-{ ... }:
+{ lib, ... }:
 
 {
   config = {

lib/tests/modules/define-enable-with-custom-arg.nix

@@ -1,4 +1,4 @@
-{ custom, ... }:
+{ lib, custom, ... }:
 
 {
   config = {

lib/tests/modules/disable-declare-enable.nix

@@ -1,4 +1,4 @@
-{ ... }:
+{ lib, ... }:
 
 {
   disabledModules = [ ./declare-enable.nix ];

lib/tests/modules/disable-define-enable-string-path.nix

@@ -1,4 +1,4 @@
-{ ... }:
+{ lib, ... }:
 
 {
   disabledModules = [ (toString ./define-enable.nix) ];

lib/tests/modules/disable-define-enable.nix

@@ -1,4 +1,4 @@
-{ ... }:
+{ lib, ... }:
 
 {
   disabledModules = [ ./define-enable.nix ];

lib/tests/modules/disable-enable-modules.nix

@@ -1,4 +1,4 @@
-{ ... }:
+{ lib, ... }:
 
 {
   disabledModules = [ "define-enable.nix" "declare-enable.nix" ];

lib/tests/modules/doRename-condition-enable.nix

@@ -1,4 +1,4 @@
-{ config, ... }:
+{ config, lib, ... }:
 {
   config = {
     services.foo.enable = true;

lib/tests/modules/doRename-condition-migrated.nix

@@ -1,4 +1,4 @@
-{ config, ... }:
+{ config, lib, ... }:
 {
   config = {
     services.foos."".bar = "baz";

lib/tests/modules/doRename-condition-no-enable.nix

@@ -1,4 +1,4 @@
-{ config, options, ... }:
+{ config, lib, options, ... }:
 {
   config = {
     result =

lib/tests/modules/import-from-store.nix

@@ -1,4 +1,4 @@
-{ ... }:
+{ lib, ... }:
 {
 
   imports = [

lib/tests/modules/merge-typeless-option.nix

@@ -1,4 +1,4 @@
-{ ... }:
+{ lib, ... }:
 
 let
   typeless =

lib/tests/network.sh

@@ -1,117 +0,0 @@
-#!/usr/bin/env bash
-
-# Tests lib/network.nix
-# Run:
-# [nixpkgs]$ lib/tests/network.sh
-# or:
-# [nixpkgs]$ nix-build lib/tests/release.nix
-
-set -euo pipefail
-shopt -s inherit_errexit
-
-if [[ -n "${TEST_LIB:-}" ]]; then
-  NIX_PATH=nixpkgs="$(dirname "$TEST_LIB")"
-else
-  NIX_PATH=nixpkgs="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.."; pwd)"
-fi
-export NIX_PATH
-
-die() {
-  echo >&2 "test case failed: " "$@"
-  exit 1
-}
-
-tmp="$(mktemp -d)"
-clean_up() {
-    rm -rf "$tmp"
-}
-trap clean_up EXIT SIGINT SIGTERM
-work="$tmp/work"
-mkdir "$work"
-cd "$work"
-
-prefixExpression='
-  let
-    lib = import <nixpkgs/lib>;
-    internal = import <nixpkgs/lib/network/internal.nix> {
-      inherit lib;
-    };
-  in
-  with lib;
-  with lib.network;
-'
-
-expectSuccess() {
-    local expr=$1
-    local expectedResult=$2
-    if ! result=$(nix-instantiate --eval --strict --json --show-trace \
-        --expr "$prefixExpression ($expr)"); then
-        die "$expr failed to evaluate, but it was expected to succeed"
-    fi
-    if [[ ! "$result" == "$expectedResult" ]]; then
-        die "$expr == $result, but $expectedResult was expected"
-    fi
-}
-
-expectSuccessRegex() {
-    local expr=$1
-    local expectedResultRegex=$2
-    if ! result=$(nix-instantiate --eval --strict --json --show-trace \
-        --expr "$prefixExpression ($expr)"); then
-        die "$expr failed to evaluate, but it was expected to succeed"
-    fi
-    if [[ ! "$result" =~ $expectedResultRegex ]]; then
-        die "$expr == $result, but $expectedResultRegex was expected"
-    fi
-}
-
-expectFailure() {
-    local expr=$1
-    local expectedErrorRegex=$2
-    if result=$(nix-instantiate --eval --strict --json --show-trace 2>"$work/stderr" \
-        --expr "$prefixExpression ($expr)"); then
-        die "$expr evaluated successfully to $result, but it was expected to fail"
-    fi
-    if [[ ! "$(<"$work/stderr")" =~ $expectedErrorRegex ]]; then
-        die "Error was $(<"$work/stderr"), but $expectedErrorRegex was expected"
-    fi
-}
-
-# Internal functions
-expectSuccess '(internal._ipv6.split "0:0:0:0:0:0:0:0").address'                         '[0,0,0,0,0,0,0,0]'
-expectSuccess '(internal._ipv6.split "000a:000b:000c:000d:000e:000f:ffff:aaaa").address' '[10,11,12,13,14,15,65535,43690]'
-expectSuccess '(internal._ipv6.split "::").address'                                      '[0,0,0,0,0,0,0,0]'
-expectSuccess '(internal._ipv6.split "::0000").address'                                  '[0,0,0,0,0,0,0,0]'
-expectSuccess '(internal._ipv6.split "::1").address'                                     '[0,0,0,0,0,0,0,1]'
-expectSuccess '(internal._ipv6.split "::ffff").address'                                  '[0,0,0,0,0,0,0,65535]'
-expectSuccess '(internal._ipv6.split "::000f").address'                                  '[0,0,0,0,0,0,0,15]'
-expectSuccess '(internal._ipv6.split "::1:1:1:1:1:1:1").address'                         '[0,1,1,1,1,1,1,1]'
-expectSuccess '(internal._ipv6.split "1::").address'                                     '[1,0,0,0,0,0,0,0]'
-expectSuccess '(internal._ipv6.split "1:1:1:1:1:1:1::").address'                         '[1,1,1,1,1,1,1,0]'
-expectSuccess '(internal._ipv6.split "1:1:1:1::1:1:1").address'                          '[1,1,1,1,0,1,1,1]'
-expectSuccess '(internal._ipv6.split "1::1").address'                                    '[1,0,0,0,0,0,0,1]'
-
-expectFailure 'internal._ipv6.split "0:0:0:0:0:0:0:-1"' "contains malformed characters for IPv6 address"
-expectFailure 'internal._ipv6.split "::0:"'              "is not a valid IPv6 address"
-expectFailure 'internal._ipv6.split ":0::"'              "is not a valid IPv6 address"
-expectFailure 'internal._ipv6.split "0::0:"'             "is not a valid IPv6 address"
-expectFailure 'internal._ipv6.split "0:0:"'              "is not a valid IPv6 address"
-expectFailure 'internal._ipv6.split "0:0:0:0:0:0:0:0:0"' "is not a valid IPv6 address"
-expectFailure 'internal._ipv6.split "0:0:0:0:0:0:0:0:"'  "is not a valid IPv6 address"
-expectFailure 'internal._ipv6.split "::0:0:0:0:0:0:0:0"' "is not a valid IPv6 address"
-expectFailure 'internal._ipv6.split "0::0:0:0:0:0:0:0"'  "is not a valid IPv6 address"
-expectFailure 'internal._ipv6.split "::10000"'           "0x10000 is not a valid u16 integer"
-
-expectSuccess '(internal._ipv6.split "::").prefixLength'     '128'
-expectSuccess '(internal._ipv6.split "::/1").prefixLength'   '1'
-expectSuccess '(internal._ipv6.split "::/128").prefixLength' '128'
-
-expectFailure '(internal._ipv6.split "::/0").prefixLength'   "IPv6 subnet should be in range \[1;128\], got 0"
-expectFailure '(internal._ipv6.split "::/129").prefixLength' "IPv6 subnet should be in range \[1;128\], got 129"
-expectFailure '(internal._ipv6.split "/::/").prefixLength'   "is not a valid IPv6 address in CIDR notation"
-
-# Library API
-expectSuccess 'lib.network.ipv6.fromString "2001:DB8::ffff/64"' '{"address":"2001:db8:0:0:0:0:0:ffff","prefixLength":64}'
-expectSuccess 'lib.network.ipv6.fromString "1234:5678:90ab:cdef:fedc:ba09:8765:4321/44"' '{"address":"1234:5678:90ab:cdef:fedc:ba09:8765:4321","prefixLength":44}'
-
-echo >&2 tests ok

lib/tests/test-with-nix.nix

@@ -65,9 +65,6 @@ pkgs.runCommand "nixpkgs-lib-tests-nix-${nix.version}" {
   echo "Running lib/tests/sources.sh"
   TEST_LIB=$PWD/lib bash lib/tests/sources.sh
 
-  echo "Running lib/tests/network.sh"
-  TEST_LIB=$PWD/lib bash lib/tests/network.sh
-
   echo "Running lib/fileset/tests.sh"
   TEST_LIB=$PWD/lib bash lib/fileset/tests.sh
 

lib/trivial.nix

@@ -12,9 +12,6 @@ let
     version
     versionSuffix
     warn;
-  inherit (lib)
-    isString
-    ;
 in {
 
   ## Simple (higher order) functions
@@ -721,97 +718,98 @@ in {
   importTOML = path:
     builtins.fromTOML (builtins.readFile path);
 
+  ## Warnings
+
+  # See https://github.com/NixOS/nix/issues/749. Eventually we'd like these
+  # to expand to Nix builtins that carry metadata so that Nix can filter out
+  # the INFO messages without parsing the message string.
+  #
+  # Usage:
+  # {
+  #   foo = lib.warn "foo is deprecated" oldFoo;
+  #   bar = lib.warnIf (bar == "") "Empty bar is deprecated" bar;
+  # }
+  #
+  # TODO: figure out a clever way to integrate location information from
+  # something like __unsafeGetAttrPos.
+
   /**
+    Print a warning before returning the second argument. This function behaves
+    like `builtins.trace`, but requires a string message and formats it as a
+    warning, including the `warning: ` prefix.
 
-    `warn` *`message`* *`value`*
-
-    Print a warning before returning the second argument.
-
-    See [`builtins.warn`](https://nix.dev/manual/nix/latest/language/builtins.html#builtins-warn) (Nix >= 2.23).
-    On older versions, the Nix 2.23 behavior is emulated with [`builtins.trace`](https://nix.dev/manual/nix/latest/language/builtins.html#builtins-warn), including the [`NIX_ABORT_ON_WARN`](https://nix.dev/manual/nix/latest/command-ref/conf-file#conf-abort-on-warn) behavior, but not the `nix.conf` setting or command line option.
+    To get a call stack trace and abort evaluation, set the environment variable
+    `NIX_ABORT_ON_WARN=true` and set the Nix options `--option pure-eval false --show-trace`
 
     # Inputs
 
-    *`message`* (String)
+    `msg`
 
-    : Warning message to print before evaluating *`value`*.
+    : Warning message to print.
 
-    *`value`* (any value)
+    `val`
 
     : Value to return as-is.
 
     # Type
 
     ```
-    String -> a -> a
+    string -> a -> a
     ```
   */
   warn =
-    # Since Nix 2.23, https://github.com/NixOS/nix/pull/10592
-    builtins.warn or (
-      let mustAbort = lib.elem (builtins.getEnv "NIX_ABORT_ON_WARN") ["1" "true" "yes"];
-      in
-        # Do not eta reduce v, so that we have the same strictness as `builtins.warn`.
-        msg: v:
-          # `builtins.warn` requires a string message, so we enforce that in our implementation, so that callers aren't accidentally incompatible with newer Nix versions.
-          assert isString msg;
-          if mustAbort
-          then builtins.trace "evaluation warning: ${msg}" (abort "NIX_ABORT_ON_WARN=true; warnings are treated as unrecoverable errors.")
-          else builtins.trace "evaluation warning: ${msg}" v
-    );
+    if lib.elem (builtins.getEnv "NIX_ABORT_ON_WARN") ["1" "true" "yes"]
+    then msg: builtins.trace "warning: ${msg}" (abort "NIX_ABORT_ON_WARN=true; warnings are treated as unrecoverable errors.")
+    else msg: builtins.trace "warning: ${msg}";
 
   /**
+    Like warn, but only warn when the first argument is `true`.
 
-    `warnIf` *`condition`* *`message`* *`value`*
-
-    Like `warn`, but only warn when the first argument is `true`.
 
     # Inputs
 
-    *`condition`* (Boolean)
+    `cond`
 
-    : `true` to trigger the warning before continuing with *`value`*.
+    : 1\. Function argument
 
-    *`message`* (String)
+    `msg`
 
-    : Warning message to print before evaluating
+    : 2\. Function argument
 
-    *`value`* (any value)
+    `val`
 
     : Value to return as-is.
 
     # Type
 
     ```
-    Bool -> String -> a -> a
+    bool -> string -> a -> a
     ```
   */
   warnIf = cond: msg: if cond then warn msg else x: x;
 
   /**
+    Like warnIf, but negated (warn if the first argument is `false`).
 
-    `warnIfNot` *`condition`* *`message`* *`value`*
-
-    Like `warnIf`, but negated: warn if the first argument is `false`.
 
     # Inputs
 
-    *`condition`*
+    `cond`
 
-    : `false` to trigger the warning before continuing with `val`.
+    : 1\. Function argument
 
-    *`message`*
+    `msg`
 
-    : Warning message to print before evaluating *`value`*.
+    : 2\. Function argument
 
-    *`value`*
+    `val`
 
     : Value to return as-is.
 
     # Type
 
     ```
-    Boolean -> String -> a -> a
+    bool -> string -> a -> a
     ```
   */
   warnIfNot = cond: msg: if cond then x: x else warn msg;
@@ -1076,32 +1074,6 @@ in {
     then v
     else k: v;
 
-  /**
-    Convert a hexadecimal string to it's integer representation.
-
-    # Type
-
-    ```
-    fromHexString :: String -> [ String ]
-    ```
-
-    # Examples
-
-    ```nix
-    fromHexString "FF"
-    => 255
-
-    fromHexString (builtins.hashString "sha256" "test")
-    => 9223372036854775807
-    ```
-  */
-  fromHexString = value:
-  let
-    noPrefix = lib.strings.removePrefix "0x" (lib.strings.toLower value);
-  in let
-    parsed = builtins.fromTOML "v=0x${noPrefix}";
-  in parsed.v;
-
   /**
     Convert the given positive integer to a string of its hexadecimal
     representation. For example:

maintainers/scripts/bootstrap-files/README.md

@@ -6,9 +6,9 @@ binaries (without the reliance on external inputs):
 - `bootstrap-tools`: an archive with the compiler toolchain and other
   helper tools enough to build the rest of the `nixpkgs`.
 - initial binaries needed to unpack `bootstrap-tools.*`. On `linux`
-  it's just `busybox`, on `darwin` and `freebsd` it is unpack.nar.xz
-  which contains the binaries and script needed to unpack the tools.
-  These binaries can be executed directly from the store.
+  it's just `busybox`, on `darwin` it is unpack.nar.xz which contains
+  the binaries and script needed to unpack the tools. These binaries
+  can be executed directly from the store.
 
 These are called "bootstrap files".
 

maintainers/scripts/bootstrap-files/refresh-tarballs.bash

@@ -95,7 +95,6 @@ CROSS_TARGETS=(
     powerpc64-unknown-linux-gnuabielfv2
     powerpc64le-unknown-linux-gnu
     riscv64-unknown-linux-gnu
-    x86_64-unknown-freebsd
 )
 
 is_cross() {
@@ -164,7 +163,6 @@ for target in "${targets[@]}"; do
     case "$target" in
         *linux*) nixpkgs_prefix="pkgs/stdenv/linux" ;;
         *darwin*) nixpkgs_prefix="pkgs/stdenv/darwin" ;;
-        *freebsd*) nixpkgs_prefix="pkgs/stdenv/freebsd" ;;
         *) die "don't know where to put '$target'" ;;
     esac
 

maintainers/scripts/convert-to-import-cargo-lock/shell.nix

@@ -1,17 +1,5 @@
-{
-  pkgs ? import ../../.. { },
-}:
-let
-  inherit (pkgs) lib stdenv mkShell;
-in
+with import ../../../. { };
+
 mkShell {
-  packages =
-    with pkgs;
-    [
-      rustc
-      cargo
-      clippy
-      rustfmt
-    ]
-    ++ lib.optional stdenv.isDarwin pkgs.libiconv;
+  packages = [ rustc cargo clippy rustfmt ] ++ lib.optional stdenv.isDarwin libiconv;
 }

maintainers/scripts/haskell/update-stackage.sh

@@ -63,7 +63,6 @@ sed -r \
     -e '/ language-nix /d' \
     -e '/ hackage-db /d' \
     -e '/ cabal-install /d' \
-    -e '/ cabal-install-solver /d' \
     -e '/ lsp /d' \
     -e '/ lsp-types /d' \
     -e '/ lsp-test /d' \

maintainers/scripts/luarocks-packages.csv

@@ -6,7 +6,6 @@ argparse,,,,,,
 basexx,,,,,,
 binaryheap,,,,,,vcunat
 busted,,,,,,
-busted-htest,,,,,,mrcjkb
 cassowary,,,,,,alerque
 cldr,,,,,,alerque
 compat53,,,,,,vcunat
@@ -35,7 +34,6 @@ ldoc,,,,,,
 lgi,,,,,,
 linenoise,https://raw.githubusercontent.com/hoelzro/lua-linenoise/master/linenoise-0.9-1.rockspec,,,,,
 ljsyscall,,,,,5.1,lblasc
-llscheck,,,,,,mrcjkb
 lmathx,,,,,5.3,alexshpilkin
 lmpfrlib,,,,,5.3,alexshpilkin
 loadkit,,,,,,alerque

maintainers/scripts/pluginupdate.py

@@ -142,7 +142,7 @@ class Repo:
         return loaded
 
     def prefetch(self, ref: Optional[str]) -> str:
-        print("Prefetching %s", self.uri)
+        print("Prefetching")
         loaded = self._prefetch(ref)
         return loaded["sha256"]
 
@@ -266,7 +266,6 @@ class PluginDesc:
 
     @staticmethod
     def load_from_csv(config: FetchConfig, row: Dict[str, str]) -> "PluginDesc":
-        log.debug("Loading row %s", row)
         branch = row["branch"]
         repo = make_repo(row["repo"], branch.strip())
         repo.token = config.github_token
@@ -329,7 +328,7 @@ def load_plugins_from_csv(
 
 
 
-def run_nix_expr(expr, nixpkgs: str, **args):
+def run_nix_expr(expr, nixpkgs: str):
     '''
     :param expr nix expression to fetch current plugins
     :param nixpkgs Path towards a nixpkgs checkout
@@ -348,7 +347,7 @@ def run_nix_expr(expr, nixpkgs: str, **args):
             nix_path,
         ]
         log.debug("Running command: %s", " ".join(cmd))
-        out = subprocess.check_output(cmd, **args)
+        out = subprocess.check_output(cmd, timeout=90)
         data = json.loads(out)
         return data
 
@@ -737,7 +736,6 @@ def rewrite_input(
     redirects: Redirects = {},
     append: List[PluginDesc] = [],
 ):
-    log.info("Rewriting input file %s", input_file)
     plugins = load_plugins_from_csv(
         config,
         input_file,
@@ -746,14 +744,10 @@ def rewrite_input(
     plugins.extend(append)
 
     if redirects:
-        log.debug("Dealing with deprecated plugins listed in %s", deprecated)
-
         cur_date_iso = datetime.now().strftime("%Y-%m-%d")
         with open(deprecated, "r") as f:
             deprecations = json.load(f)
-        # TODO parallelize this step
         for pdesc, new_repo in redirects.items():
-            log.info("Rewriting input file %s", input_file)
             new_pdesc = PluginDesc(new_repo, pdesc.branch, pdesc.alias)
             old_plugin, _ = prefetch_plugin(pdesc)
             new_plugin, _ = prefetch_plugin(new_pdesc)
@@ -797,7 +791,7 @@ def update_plugins(editor: Editor, args):
     start_time = time.time()
     redirects = update()
     duration = time.time() - start_time
-    print(f"The plugin update took {duration:.2f}s.")
+    print(f"The plugin update took {duration}s.")
     editor.rewrite_input(fetch_config, args.input_file, editor.deprecated, redirects)
 
     autocommit = not args.no_commit

maintainers/scripts/update.nix

@@ -13,7 +13,6 @@
 , include-overlays ? false
 , keep-going ? null
 , commit ? null
-, skip-prompt ? null
 }:
 
 let
@@ -185,10 +184,6 @@ let
     that support it by adding
 
         --argstr commit true
-
-    to skip prompt:
-
-        --argstr skip-prompt true
   '';
 
   /* Transform a matched package into an object for update.py.
@@ -209,8 +204,7 @@ let
   optionalArgs =
     lib.optional (max-workers != null) "--max-workers=${max-workers}"
     ++ lib.optional (keep-going == "true") "--keep-going"
-    ++ lib.optional (commit == "true") "--commit"
-    ++ lib.optional (skip-prompt == "true") "--skip-prompt";
+    ++ lib.optional (commit == "true") "--commit";
 
   args = [ packagesJson ] ++ optionalArgs;
 

maintainers/scripts/update.py

@@ -91,11 +91,9 @@ def make_worktree() -> Generator[Tuple[str, str], None, None]:
         target_directory = f'{wt}/nixpkgs'
 
         subprocess.run(['git', 'worktree', 'add', '-b', branch_name, target_directory])
-        try:
-            yield (target_directory, branch_name)
-        finally:
-            subprocess.run(['git', 'worktree', 'remove', '--force', target_directory])
-            subprocess.run(['git', 'branch', '-D', branch_name])
+        yield (target_directory, branch_name)
+        subprocess.run(['git', 'worktree', 'remove', '--force', target_directory])
+        subprocess.run(['git', 'branch', '-D', branch_name])
 
 async def commit_changes(name: str, merge_lock: asyncio.Lock, worktree: str, branch: str, changes: List[Dict]) -> None:
     for change in changes:
@@ -209,7 +207,7 @@ async def start_updates(max_workers: int, keep_going: bool, commit: bool, packag
             eprint(e)
             sys.exit(1)
 
-def main(max_workers: int, keep_going: bool, commit: bool, packages_path: str, skip_prompt: bool) -> None:
+def main(max_workers: int, keep_going: bool, commit: bool, packages_path: str) -> None:
     with open(packages_path) as f:
         packages = json.load(f)
 
@@ -219,8 +217,7 @@ def main(max_workers: int, keep_going: bool, commit: bool, packages_path: str, s
         eprint(f" - {package['name']}")
     eprint()
 
-    confirm = '' if skip_prompt else input('Press Enter key to continue...')
-
+    confirm = input('Press Enter key to continue...')
     if confirm == '':
         eprint()
         eprint('Running update for:')
@@ -239,13 +236,12 @@ parser.add_argument('--max-workers', '-j', dest='max_workers', type=int, help='N
 parser.add_argument('--keep-going', '-k', dest='keep_going', action='store_true', help='Do not stop after first failure')
 parser.add_argument('--commit', '-c', dest='commit', action='store_true', help='Commit the changes')
 parser.add_argument('packages', help='JSON file containing the list of package names and their update scripts')
-parser.add_argument('--skip-prompt', '-s', dest='skip_prompt', action='store_true', help='Do not stop for prompts')
 
 if __name__ == '__main__':
     args = parser.parse_args()
 
     try:
-        main(args.max_workers, args.keep_going, args.commit, args.packages, args.skip_prompt)
+        main(args.max_workers, args.keep_going, args.commit, args.packages)
     except KeyboardInterrupt as e:
         # Let’s cancel outside of the main loop too.
         sys.exit(130)

maintainers/team-list.nix

@@ -95,10 +95,7 @@ with lib.maintainers;
   };
 
   budgie = {
-    members = [
-      bobby285271
-      getchoo
-    ];
+    members = [ bobby285271 ];
     scope = "Maintain Budgie desktop environment";
     shortName = "Budgie";
   };
@@ -362,7 +359,6 @@ with lib.maintainers;
 
   geospatial = {
     members = [
-      autra
       imincik
       l0b0
       nh2
@@ -500,21 +496,6 @@ with lib.maintainers;
     shortName = "Jupyter";
   };
 
-  k3s = {
-    githubTeams = [ "k3s" ];
-    members = [
-      euank
-      marcusramberg
-      mic92
-      rorosen
-      superherointj
-      wrmilling
-      yajo
-    ];
-    scope = "Maintain K3s package, NixOS module, NixOS tests, update script";
-    shortName = "K3s";
-  };
-
   kubernetes = {
     members = [
       johanot
@@ -749,10 +730,7 @@ with lib.maintainers;
   };
 
   openstack = {
-    members = [
-      SuperSandro2000
-      anthonyroussel
-    ];
+    members = [ SuperSandro2000 ];
     scope = "Maintain the ecosystem around OpenStack";
     shortName = "OpenStack";
   };
@@ -944,27 +922,6 @@ with lib.maintainers;
     shortName = "Steam";
   };
 
-  stridtech = {
-    # Verify additions by approval of an already existing member of the team
-    members = [
-      superherointj
-      ulrikstrid
-    ];
-    scope = "Group registration for Strid Tech AB team members who collectively maintain packages";
-    shortName = "StridTech";
-  };
-
-  swift = {
-    members = [
-      dduan
-      stephank
-      trepetti
-      trundle
-    ];
-    scope = "Maintain Swift compiler suite for NixOS.";
-    shortName = "Swift";
-  };
-
   systemd = {
     members = [ ];
     githubTeams = [ "systemd" ];
@@ -1019,7 +976,10 @@ with lib.maintainers;
   };
 
   zig = {
-    members = [ figsoda ];
+    members = [
+      AndersonTorres
+      figsoda
+    ];
     scope = "Maintain the Zig compiler toolchain and nixpkgs integration.";
     shortName = "Zig";
     enableFeatureFreezePing = true;

nixos/doc/manual/configuration/luks-file-systems.section.md

@@ -90,7 +90,7 @@ as [Trezor](https://trezor.io/).
 
 ### systemd Stage 1 {#sec-luks-file-systems-fido2-systemd}
 
-If systemd stage 1 is enabled, it handles unlocking of LUKS-encrypted volumes
+If systemd stage 1 is enabled, it handles unlocking of LUKS-enrypted volumes
 during boot. The following example enables systemd stage1 and adds support for
 unlocking the existing LUKS2 volume `root` using any enrolled FIDO2 compatible
 tokens.