diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS index a206164d6685..f8278d1cbe48 100644 --- a/.github/CODEOWNERS +++ b/.github/CODEOWNERS @@ -48,6 +48,8 @@ /pkgs/build-support/setup-hooks/auto-patchelf.sh @layus /pkgs/build-support/setup-hooks/auto-patchelf.py @layus /pkgs/pkgs-lib @infinisil +## Format generators/serializers +/pkgs/pkgs-lib/formats/libconfig @ckiee # pkgs/by-name /pkgs/test/nixpkgs-check-by-name @infinisil diff --git a/.github/ISSUE_TEMPLATE/unreproducible_package.md b/.github/ISSUE_TEMPLATE/unreproducible_package.md index 13988026f8d7..8046e809a214 100644 --- a/.github/ISSUE_TEMPLATE/unreproducible_package.md +++ b/.github/ISSUE_TEMPLATE/unreproducible_package.md @@ -7,25 +7,81 @@ assignees: '' --- -Building this package twice does not produce the bit-by-bit identical result each time, making it harder to detect CI breaches. You can read more about this at https://reproducible-builds.org/ . + + +Building this package multiple times does not yield bit-by-bit identical +results, complicating the detection of Continuous Integration (CI) breaches. For +more information on this issue, visit +[reproducible-builds.org](https://reproducible-builds.org/). + +Fixing bit-by-bit reproducibility also has additional advantages, such as +avoiding hard-to-reproduce bugs, making content-addressed storage more effective +and reducing rebuilds in such systems. ### Steps To Reproduce -``` -nix-build '' -A ... && nix-build '' -A ... --check --keep-failed -``` +In the following steps, replace `` with the canonical name of the +package. -If this command completes successfully, no differences where found. However, when it ends in `error: derivation '' may not be deterministic: output '' differs from ''`, you can use `diffoscope ` to analyze the differences in the output of the two builds. +#### 1. Build the package -To view the build log of the build that produced the artifact in the binary cache: +This step will build the package. Specific arguments are passed to the command +to keep the build artifacts so we can compare them in case of differences. + +Execute the following command: ``` -nix-store --read-log $(nix-instantiate '' -A ...) +nix-build '' -A && nix-build '' -A --check --keep-failed +``` + +Or using the new command line style: + +``` +nix build nixpkgs# && nix build nixpkgs# --rebuild --keep-failed +``` + +#### 2. Compare the build artifacts + +If the previous command completes successfully, no differences were found and +there's nothing to do, builds are reproducible. +If it terminates with the error message `error: derivation '' may not be +deterministic: output '' differs from ''`, use `diffoscope` to investigate +the discrepancies between the two build outputs. You may need to add the +`--exclude-directory-metadata recursive` option to ignore files and directories +metadata (*e.g. timestamp*) differences. + +``` +nix run nixpkgs#diffoscopeMinimal -- --exclude-directory-metadata recursive +``` + +#### 3. Examine the build log + +To examine the build log, use: + +``` +nix-store --read-log $(nix-instantiate '' -A ) +``` + +Or with the new command line style: + +``` +nix log $(nix path-info --derivation nixpkgs#) ``` ### Additional context -(please share the relevant fragment of the diffoscope output here, -and any additional analysis you may have done) +(please share the relevant fragment of the diffoscope output here, and any +additional analysis you may have done) diff --git a/lib/fixed-points.nix b/lib/fixed-points.nix index 3444e95e15ad..3b5fdc9e8ea1 100644 --- a/lib/fixed-points.nix +++ b/lib/fixed-points.nix @@ -45,7 +45,7 @@ rec { } ``` - This is where `fix` comes in, it contains the syntactic that's not in `f` anymore. + This is where `fix` comes in, it contains the syntactic recursion that's not in `f` anymore. ```nix nix-repl> fix = f: diff --git a/lib/meta.nix b/lib/meta.nix index 44730a71551e..2e817c42327d 100644 --- a/lib/meta.nix +++ b/lib/meta.nix @@ -162,5 +162,12 @@ rec { getExe' pkgs.imagemagick "convert" => "/nix/store/5rs48jamq7k6sal98ymj9l4k2bnwq515-imagemagick-7.1.1-15/bin/convert" */ - getExe' = x: y: "${lib.getBin x}/bin/${y}"; + getExe' = x: y: + assert lib.assertMsg (lib.isDerivation x) + "lib.meta.getExe': The first argument is of type ${builtins.typeOf x}, but it should be a derivation instead."; + assert lib.assertMsg (lib.isString y) + "lib.meta.getExe': The second argument is of type ${builtins.typeOf y}, but it should be a string instead."; + assert lib.assertMsg (builtins.length (lib.splitString "/" y) == 1) + "lib.meta.getExe': The second argument \"${y}\" is a nested path with a \"/\" character, but it should just be the name of the executable instead."; + "${lib.getBin x}/bin/${y}"; } diff --git a/lib/tests/misc.nix b/lib/tests/misc.nix index 2e7fda2b1f8b..47853f47278a 100644 --- a/lib/tests/misc.nix +++ b/lib/tests/misc.nix @@ -1906,4 +1906,32 @@ runTests { expr = (with types; either int (listOf (either bool str))).description; expected = "signed integer or list of (boolean or string)"; }; + +# Meta + testGetExe'Output = { + expr = getExe' { + type = "derivation"; + out = "somelonghash"; + bin = "somelonghash"; + } "executable"; + expected = "somelonghash/bin/executable"; + }; + + testGetExeOutput = { + expr = getExe { + type = "derivation"; + out = "somelonghash"; + bin = "somelonghash"; + meta.mainProgram = "mainProgram"; + }; + expected = "somelonghash/bin/mainProgram"; + }; + + testGetExe'FailureFirstArg = testingThrow ( + getExe' "not a derivation" "executable" + ); + + testGetExe'FailureSecondArg = testingThrow ( + getExe' { type = "derivation"; } "dir/executable" + ); } diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix index a9dcb0b64e47..343b75f6c0e2 100644 --- a/maintainers/maintainer-list.nix +++ b/maintainers/maintainer-list.nix @@ -5969,6 +5969,11 @@ githubId = 119691; name = "Michael Gough"; }; + franciscod = { + github = "franciscod"; + githubId = 726447; + name = "Francisco Demartino"; + }; franzmondlichtmann = { name = "Franz Schroepf"; email = "franz-schroepf@t-online.de"; @@ -6111,7 +6116,7 @@ }; fugi = { email = "me@fugi.dev"; - github = "FugiMuffi"; + github = "fugidev"; githubId = 21362942; name = "Fugi"; }; @@ -18862,6 +18867,13 @@ fingerprint = "47F7 009E 3AE3 1DA7 988E 12E1 8C9B 0A8F C0C0 D862"; }]; }; + wamirez = { + email = "wamirez@protonmail.com"; + matrix = "@wamirez:matrix.org"; + github = "wamirez"; + githubId = 24505474; + name = "Daniel Ramirez"; + }; wamserma = { name = "Markus S. Wamser"; email = "github-dev@mail2013.wamser.eu"; diff --git a/nixos/modules/image/repart.md b/nixos/doc/manual/installation/building-images-via-systemd-repart.chapter.md similarity index 100% rename from nixos/modules/image/repart.md rename to nixos/doc/manual/installation/building-images-via-systemd-repart.chapter.md diff --git a/nixos/doc/manual/installation/installation.md b/nixos/doc/manual/installation/installation.md index 140594256609..f3b1773d865c 100644 --- a/nixos/doc/manual/installation/installation.md +++ b/nixos/doc/manual/installation/installation.md @@ -8,4 +8,5 @@ installing.chapter.md changing-config.chapter.md upgrading.chapter.md building-nixos.chapter.md +building-images-via-systemd-repart.chapter.md ``` diff --git a/nixos/doc/manual/release-notes/rl-2311.section.md b/nixos/doc/manual/release-notes/rl-2311.section.md index 74d29ab1cf9c..ffe977bf33b1 100644 --- a/nixos/doc/manual/release-notes/rl-2311.section.md +++ b/nixos/doc/manual/release-notes/rl-2311.section.md @@ -38,6 +38,8 @@ true`. This is generally safe behavior, but for anyone needing to opt out from the check `users.users.${USERNAME}.ignoreShellProgramCheck = true` will do the job. +- Cassandra now defaults to 4.x, updated from 3.11.x. + ## New Services {#sec-release-23.11-new-services} - [MCHPRS](https://github.com/MCHPR/MCHPRS), a multithreaded Minecraft server built for redstone. Available as [services.mchprs](#opt-services.mchprs.enable). @@ -72,6 +74,8 @@ - [LibreNMS](https://www.librenms.org), a auto-discovering PHP/MySQL/SNMP based network monitoring. Available as [services.librenms](#opt-services.librenms.enable). +- [Livebook](https://livebook.dev/), an interactive notebook with support for Elixir, graphs, machine learning, and more. + - [sitespeed-io](https://sitespeed.io), a tool that can generate metrics (timings, diagnostics) for websites. Available as [services.sitespeed-io](#opt-services.sitespeed-io.enable). - [stalwart-mail](https://stalw.art), an all-in-one email server (SMTP, IMAP, JMAP). Available as [services.stalwart-mail](#opt-services.stalwart-mail.enable). @@ -337,6 +341,8 @@ - `service.borgmatic.settings.location` and `services.borgmatic.configurations..location` are deprecated, please move your options out of sections to the global scope. +- `privacyidea` (and the corresponding `privacyidea-ldap-proxy`) has been removed from nixpkgs because it has severely outdated dependencies that became unmaintainable with nixpkgs' python package-set. + - `dagger` was removed because using a package called `dagger` and packaging it from source violates their trademark policy. - `win-virtio` package was renamed to `virtio-win` to be consistent with the upstream package name. @@ -488,10 +494,14 @@ The module update takes care of the new config syntax and the data itself (user If you use this feature, updates to CoreDNS may require updating `vendorHash` by following these steps again. +- `postgresql_11` has been removed since it'll stop receiving fixes on November 9 2023. + - `ffmpeg` default upgraded from `ffmpeg_5` to `ffmpeg_6`. - `fusuma` now enables the following plugins: [appmatcher](https://github.com/iberianpig/fusuma-plugin-appmatcher), [keypress](https://github.com/iberianpig/fusuma-plugin-keypress), [sendkey](https://github.com/iberianpig/fusuma-plugin-sendkey), [tap](https://github.com/iberianpig/fusuma-plugin-tap) and [wmctrl](https://github.com/iberianpig/fusuma-plugin-wmctrl). +- `services.bitcoind` now properly respects the `enable` option. + ## Nixpkgs internals {#sec-release-23.11-nixpkgs-internals} - The use of `sourceRoot = "source";`, `sourceRoot = "source/subdir";`, and similar lines in package derivations using the default `unpackPhase` is deprecated as it requires `unpackPhase` to always produce a directory named "source". Use `sourceRoot = src.name`, `sourceRoot = "${src.name}/subdir";`, or `setSourceRoot = "sourceRoot=$(echo */subdir)";` or similar instead. diff --git a/nixos/lib/systemd-lib.nix b/nixos/lib/systemd-lib.nix index 5669aae0bc19..fc95ab01289f 100644 --- a/nixos/lib/systemd-lib.nix +++ b/nixos/lib/systemd-lib.nix @@ -21,11 +21,12 @@ in rec { { preferLocalBuild = true; allowSubstitutes = false; inherit (unit) text; + passAsFile = [ "text" ]; } '' name=${shellEscape name} mkdir -p "$out/$(dirname -- "$name")" - echo -n "$text" > "$out/$name" + mv "$textPath" "$out/$name" '' else pkgs.runCommand "unit-${mkPathSafeName name}-disabled" diff --git a/nixos/modules/config/nix-channel.nix b/nixos/modules/config/nix-channel.nix index 4abc846b0858..0565c9cc8dad 100644 --- a/nixos/modules/config/nix-channel.nix +++ b/nixos/modules/config/nix-channel.nix @@ -99,7 +99,7 @@ in systemd.tmpfiles.rules = lib.mkIf cfg.channel.enable [ "f /root/.nix-channels -" - ''w "/root/.nix-channels" - - - - "${config.system.defaultChannel} nixos\n"'' + ''w+ "/root/.nix-channels" - - - - ${config.system.defaultChannel} nixos\n'' ]; }; } diff --git a/nixos/modules/image/repart.nix b/nixos/modules/image/repart.nix index e567485c9d34..41e6110885b8 100644 --- a/nixos/modules/image/repart.nix +++ b/nixos/modules/image/repart.nix @@ -34,12 +34,13 @@ let }; }); default = { }; - example = lib.literalExpression '' { - "/EFI/BOOT/BOOTX64.EFI".source = - "''${pkgs.systemd}/lib/systemd/boot/efi/systemd-bootx64.efi"; + example = lib.literalExpression '' + { + "/EFI/BOOT/BOOTX64.EFI".source = + "''${pkgs.systemd}/lib/systemd/boot/efi/systemd-bootx64.efi"; - "/loader/entries/nixos.conf".source = systemdBootEntry; - } + "/loader/entries/nixos.conf".source = systemdBootEntry; + } ''; description = lib.mdDoc "The contents to end up in the filesystem image."; }; @@ -90,34 +91,33 @@ in package = lib.mkPackageOption pkgs "systemd-repart" { default = "systemd"; - example = lib.literalExpression '' - pkgs.systemdMinimal.override { withCryptsetup = true; } - ''; + example = "pkgs.systemdMinimal.override { withCryptsetup = true; }"; }; partitions = lib.mkOption { type = with lib.types; attrsOf (submodule partitionOptions); default = { }; - example = lib.literalExpression '' { - "10-esp" = { - contents = { - "/EFI/BOOT/BOOTX64.EFI".source = - "''${pkgs.systemd}/lib/systemd/boot/efi/systemd-bootx64.efi"; - } - repartConfig = { - Type = "esp"; - Format = "fat"; + example = lib.literalExpression '' + { + "10-esp" = { + contents = { + "/EFI/BOOT/BOOTX64.EFI".source = + "''${pkgs.systemd}/lib/systemd/boot/efi/systemd-bootx64.efi"; + } + repartConfig = { + Type = "esp"; + Format = "fat"; + }; + }; + "20-root" = { + storePaths = [ config.system.build.toplevel ]; + repartConfig = { + Type = "root"; + Format = "ext4"; + Minimize = "guess"; + }; }; }; - "20-root" = { - storePaths = [ config.system.build.toplevel ]; - repartConfig = { - Type = "root"; - Format = "ext4"; - Minimize = "guess"; - }; - }; - }; ''; description = lib.mdDoc '' Specify partitions as a set of the names of the partitions with their @@ -208,10 +208,7 @@ in | tee repart-output.json ''; - meta = { - maintainers = with lib.maintainers; [ nikstur ]; - doc = ./repart.md; - }; + meta.maintainers = with lib.maintainers; [ nikstur ]; }; } diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix index bfac651f5a81..2a6ca202024b 100644 --- a/nixos/modules/module-list.nix +++ b/nixos/modules/module-list.nix @@ -485,6 +485,7 @@ ./services/development/hoogle.nix ./services/development/jupyter/default.nix ./services/development/jupyterhub/default.nix + ./services/development/livebook.nix ./services/development/lorri.nix ./services/development/rstudio-server/default.nix ./services/development/zammad.nix @@ -1175,7 +1176,6 @@ ./services/security/opensnitch.nix ./services/security/pass-secret-service.nix ./services/security/physlock.nix - ./services/security/privacyidea.nix ./services/security/shibboleth-sp.nix ./services/security/sks.nix ./services/security/sshguard.nix @@ -1530,5 +1530,9 @@ ./virtualisation/waydroid.nix ./virtualisation/xe-guest-utilities.nix ./virtualisation/xen-dom0.nix - { documentation.nixos.extraModules = [ ./virtualisation/qemu-vm.nix ]; } + { documentation.nixos.extraModules = [ + ./virtualisation/qemu-vm.nix + ./image/repart.nix + ]; + } ] diff --git a/nixos/modules/programs/direnv.nix b/nixos/modules/programs/direnv.nix index 77a6568e73b8..2566fa7699bb 100644 --- a/nixos/modules/programs/direnv.nix +++ b/nixos/modules/programs/direnv.nix @@ -54,7 +54,7 @@ in { }; imports = [ - (lib.mkRemovedOptionModule ["programs" "direnv" "persistDerivations"] "persistDerivations was removed as it is on longer necessary") + (lib.mkRemovedOptionModule ["programs" "direnv" "persistDerivations"] "persistDerivations was removed as it is no longer necessary") ]; config = lib.mkIf cfg.enable { diff --git a/nixos/modules/services/backup/postgresql-wal-receiver.nix b/nixos/modules/services/backup/postgresql-wal-receiver.nix index 01fd57f5c506..773dc0ba447d 100644 --- a/nixos/modules/services/backup/postgresql-wal-receiver.nix +++ b/nixos/modules/services/backup/postgresql-wal-receiver.nix @@ -7,7 +7,7 @@ let options = { postgresqlPackage = mkOption { type = types.package; - example = literalExpression "pkgs.postgresql_11"; + example = literalExpression "pkgs.postgresql_15"; description = lib.mdDoc '' PostgreSQL package to use. ''; @@ -124,7 +124,7 @@ in { example = literalExpression '' { main = { - postgresqlPackage = pkgs.postgresql_11; + postgresqlPackage = pkgs.postgresql_15; directory = /mnt/pg_wal/main/; slot = "main_wal_receiver"; connection = "postgresql://user@somehost"; diff --git a/nixos/modules/services/databases/postgresql.md b/nixos/modules/services/databases/postgresql.md index 4d66ee38be42..e4b679a3eee0 100644 --- a/nixos/modules/services/databases/postgresql.md +++ b/nixos/modules/services/databases/postgresql.md @@ -17,9 +17,9 @@ PostgreSQL is an advanced, free relational database. To enable PostgreSQL, add the following to your {file}`configuration.nix`: ``` services.postgresql.enable = true; -services.postgresql.package = pkgs.postgresql_11; +services.postgresql.package = pkgs.postgresql_15; ``` -Note that you are required to specify the desired version of PostgreSQL (e.g. `pkgs.postgresql_11`). Since upgrading your PostgreSQL version requires a database dump and reload (see below), NixOS cannot provide a default value for [](#opt-services.postgresql.package) such as the most recent release of PostgreSQL. +Note that you are required to specify the desired version of PostgreSQL (e.g. `pkgs.postgresql_15`). Since upgrading your PostgreSQL version requires a database dump and reload (see below), NixOS cannot provide a default value for [](#opt-services.postgresql.package) such as the most recent release of PostgreSQL.