Merge release-24.11 into staging-next-24.11

2026-09-30 03:39:59 +00:00 · 2025-05-13 00:19:36 +00:00
parent f6e8047c3f 180a802f19
commit 0ffaa56d2c
19 changed files with 163 additions and 97 deletions
--- a/.github/workflows/eval.yml
+++ b/.github/workflows/eval.yml
@@ -19,54 +19,14 @@ jobs:
  get-merge-commit:
    uses: ./.github/workflows/get-merge-commit.yml

-  attrs:
-    name: Attributes
-    runs-on: ubuntu-24.04-arm
-    needs: get-merge-commit
-    if: needs.get-merge-commit.outputs.mergedSha
-    outputs:
-      targetSha: ${{ steps.targetSha.outputs.targetSha }}
-      systems: ${{ steps.systems.outputs.systems }}
-    steps:
-      - name: Check out the PR at the test merge commit
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          ref: ${{ needs.get-merge-commit.outputs.mergedSha }}
-          fetch-depth: 2
-          path: nixpkgs
-
-      - name: Determine target commit
-        if: github.event_name == 'pull_request_target'
-        id: targetSha
-        run: |
-          targetSha=$(git -C nixpkgs rev-parse HEAD^1)
-          echo "targetSha=$targetSha" >> "$GITHUB_OUTPUT"
-
-      - name: Install Nix
-        uses: cachix/install-nix-action@526118121621777ccd86f79b04685a9319637641 # v31
-        with:
-          extra_nix_config: sandbox = true
-
-      - name: Evaluate the list of all attributes and get the systems matrix
-        id: systems
-        run: |
-          nix-build nixpkgs/ci -A eval.attrpathsSuperset
-          echo "systems=$(<result/systems.json)" >> "$GITHUB_OUTPUT"
-
-      - name: Upload the list of all attributes
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
-        with:
-          name: paths
-          path: result/*
-
  outpaths:
    name: Outpaths
    runs-on: ubuntu-24.04-arm
-    needs: [ attrs, get-merge-commit ]
+    needs: [ get-merge-commit ]
    strategy:
      fail-fast: false
      matrix:
-        system: ${{ fromJSON(needs.attrs.outputs.systems) }}
+        system: ${{ fromJSON(needs.get-merge-commit.outputs.systems) }}
    steps:
      - name: Enable swap
        run: |
@@ -75,12 +35,6 @@ jobs:
          sudo mkswap /swap
          sudo swapon /swap

-      - name: Download the list of all attributes
-        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
-        with:
-          name: paths
-          path: paths
-
      - name: Check out the PR at the test merge commit
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
@@ -98,7 +52,6 @@ jobs:
        run: |
          nix-build nixpkgs/ci -A eval.singleSystem \
            --argstr evalSystem "$MATRIX_SYSTEM" \
-            --arg attrpathFile ./paths/paths.json \
            --arg chunkSize 10000
          # If it uses too much memory, slightly decrease chunkSize

@@ -111,7 +64,7 @@ jobs:
  process:
    name: Process
    runs-on: ubuntu-24.04-arm
-    needs: [ outpaths, attrs, get-merge-commit ]
+    needs: [ outpaths, get-merge-commit ]
    outputs:
      targetRunId: ${{ steps.targetRunId.outputs.targetRunId }}
    steps:
@@ -146,7 +99,7 @@ jobs:
          path: prResult/*

      - name: Get target run id
-        if: needs.attrs.outputs.targetSha
+        if: needs.get-merge-commit.outputs.targetSha
        id: targetRunId
        run: |
          # Get the latest eval.yml workflow run for the PR's target commit
@@ -175,7 +128,7 @@ jobs:
          echo "targetRunId=$runId" >> "$GITHUB_OUTPUT"
        env:
          REPOSITORY: ${{ github.repository }}
-          TARGET_SHA: ${{ needs.attrs.outputs.targetSha }}
+          TARGET_SHA: ${{ needs.get-merge-commit.outputs.targetSha }}
          GH_TOKEN: ${{ github.token }}

      - uses: actions/download-artifact@v4
@@ -189,8 +142,8 @@ jobs:
      - name: Compare against the target branch
        if: steps.targetRunId.outputs.targetRunId
        run: |
-          git -C nixpkgs worktree add ../target ${{ needs.attrs.outputs.targetSha }}
-          git -C nixpkgs diff --name-only ${{ needs.attrs.outputs.targetSha }} \
+          git -C nixpkgs worktree add ../target ${{ needs.get-merge-commit.outputs.targetSha }}
+          git -C nixpkgs diff --name-only ${{ needs.get-merge-commit.outputs.targetSha }} \
            | jq --raw-input --slurp 'split("\n")[:-1]' > touched-files.json

          # Use the target branch to get accurate maintainer info
@@ -213,7 +166,7 @@ jobs:
  tag:
    name: Tag
    runs-on: ubuntu-24.04-arm
-    needs: [ attrs, process ]
+    needs: [ process ]
    if: needs.process.outputs.targetRunId
    permissions:
      pull-requests: write
@@ -244,7 +197,7 @@ jobs:
      - name: Check out Nixpkgs at the base commit
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
-          ref: ${{ needs.attrs.outputs.targetSha }}
+          ref: ${{ needs.get-merge-commit.outputs.targetSha }}
          path: base
          sparse-checkout: ci

--- a/.github/workflows/get-merge-commit.yml
+++ b/.github/workflows/get-merge-commit.yml
@@ -6,6 +6,12 @@ on:
      mergedSha:
        description: "The merge commit SHA"
        value: ${{ jobs.resolve-merge-commit.outputs.mergedSha }}
+      targetSha:
+        description: "The target commit SHA"
+        value: ${{ jobs.resolve-merge-commit.outputs.targetSha }}
+      systems:
+        description: "The supported systems"
+        value: ${{ jobs.resolve-merge-commit.outputs.systems }}

 permissions: {}

@@ -14,6 +20,8 @@ jobs:
    runs-on: ubuntu-24.04-arm
    outputs:
      mergedSha: ${{ steps.merged.outputs.mergedSha }}
+      targetSha: ${{ steps.merged.outputs.targetSha }}
+      systems: ${{ steps.systems.outputs.systems }}
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
@@ -31,13 +39,17 @@ jobs:
              echo "mergedSha=${{ github.sha }}" >> "$GITHUB_OUTPUT"
              ;;
            pull_request_target)
-              if mergedSha=$(base/ci/get-merge-commit.sh ${{ github.repository }} ${{ github.event.number }}); then
-                echo "Checking the merge commit $mergedSha"
-                echo "mergedSha=$mergedSha" >> "$GITHUB_OUTPUT"
+              if commits=$(base/ci/get-merge-commit.sh ${{ github.repository }} ${{ github.event.number }}); then
+                echo "Checking the commits:\n$commits"
+                echo "$commits" >> "$GITHUB_OUTPUT"
              else
                # Skipping so that no notifications are sent
                echo "Skipping the rest..."
              fi
              ;;
          esac
-          rm -rf base
+
+      - name: Load supported systems
+        id: systems
+        run: |
+          echo "systems=$(jq -c <base/ci/supportedSystems.json)" >> "$GITHUB_OUTPUT"
--- a/ci/OWNERS
+++ b/ci/OWNERS
@@ -275,8 +275,8 @@ pkgs/development/python-modules/buildcatrust/ @ajs124 @lukegb @mweinelt
 /nixos/modules/services/web-servers/nginx/ @raitobezarius

 # Dhall
-/pkgs/development/dhall-modules      @Gabriella439 @Profpatsch @ehmry
-/pkgs/development/interpreters/dhall @Gabriella439 @Profpatsch @ehmry
+/pkgs/development/dhall-modules      @Gabriella439 @Profpatsch
+/pkgs/development/interpreters/dhall @Gabriella439 @Profpatsch

 # Idris
 /pkgs/development/idris-modules @Infinisil
@@ -347,11 +347,6 @@ pkgs/development/python-modules/buildcatrust/ @ajs124 @lukegb @mweinelt
 # Xfce
 /doc/hooks/xfce4-dev-tools.section.md @NixOS/xfce

-# nim
-/doc/languages-frameworks/nim.section.md  @ehmry
-/pkgs/build-support/build-nim-package.nix @ehmry
-/pkgs/top-level/nim-overrides.nix         @ehmry
-
 # terraform providers
 /pkgs/applications/networking/cluster/terraform-providers @zowoq

--- a/ci/README.md
+++ b/ci/README.md
@@ -44,14 +44,14 @@ Why not just build the tooling right from the PRs Nixpkgs version?
 ## `get-merge-commit.sh GITHUB_REPO PR_NUMBER`

 Check whether a PR is mergeable and return the test merge commit as
-[computed by GitHub](https://docs.github.com/en/rest/guides/using-the-rest-api-to-interact-with-your-git-database?apiVersion=2022-11-28#checking-mergeability-of-pull-requests).
+[computed by GitHub](https://docs.github.com/en/rest/guides/using-the-rest-api-to-interact-with-your-git-database?apiVersion=2022-11-28#checking-mergeability-of-pull-requests) and its parent.

 Arguments:
 - `GITHUB_REPO`: The repository of the PR, e.g. `NixOS/nixpkgs`
 - `PR_NUMBER`: The PR number, e.g. `1234`

 Exit codes:
- 0: The PR can be merged, the test merge commit hash is returned on stdout
+- 0: The PR can be merged, the hashes of the test merge commit and the target commit are returned on stdout
 - 1: The PR cannot be merged because it's not open anymore
 - 2: The PR cannot be merged because it has a merge conflict
 - 3: The merge commit isn't being computed, GitHub is likely having internal issues, unknown if the PR is mergeable
--- a/ci/eval/README.md
+++ b/ci/eval/README.md
@@ -11,7 +11,7 @@ nix-build ci -A eval.full \
  --arg evalSystems '["x86_64-linux" "aarch64-darwin"]'
 ```

- `--max-jobs`: The maximum number of derivations to run at the same time. Only each [supported system](../supportedSystems.nix) gets a separate derivation, so it doesn't make sense to set this higher than that number.
+- `--max-jobs`: The maximum number of derivations to run at the same time. Only each [supported system](../supportedSystems.json) gets a separate derivation, so it doesn't make sense to set this higher than that number.
 - `--cores`: The number of cores to use for each job. Recommended to set this to the amount of cores on your system divided by `--max-jobs`.
 - `chunkSize`: The number of attributes that are evaluated simultaneously on a single core. Lowering this decreases memory usage at the cost of increased evaluation time. If this is too high, there won't be enough chunks to process them in parallel, and will also increase evaluation time.
 - `evalSystems`: The set of systems for which `nixpkgs` should be evaluated. Defaults to the four official platforms (`x86_64-linux`, `aarch64-linux`, `x86_64-darwin` and `aarch64-darwin`).
--- a/ci/eval/default.nix
+++ b/ci/eval/default.nix
@@ -26,14 +26,14 @@ let
          "nixos"
          "pkgs"
          ".version"
-          "ci/supportedSystems.nix"
+          "ci/supportedSystems.json"
        ]
      );
    };

  nix = nixVersions.nix_2_24;

-  supportedSystems = import ../supportedSystems.nix;
+  supportedSystems = builtins.fromJSON (builtins.readFile ../supportedSystems.json);

  attrpathsSuperset =
    runCommand "attrpaths-superset.json"
@@ -43,8 +43,6 @@ let
          nix
          time
        ];
-        env.supportedSystems = builtins.toJSON supportedSystems;
-        passAsFile = [ "supportedSystems" ];
      }
      ''
        export NIX_STATE_DIR=$(mktemp -d)
@@ -58,7 +56,6 @@ let
            --option restrict-eval true \
            --option allow-import-from-derivation false \
            --arg enableWarnings false > $out/paths.json
-        mv "$supportedSystemsPath" $out/systems.json
      '';

  singleSystem =
@@ -68,7 +65,7 @@ let
      # because `--argstr system` would only be passed to the ci/default.nix file!
      evalSystem,
      # The path to the `paths.json` file from `attrpathsSuperset`
-      attrpathFile,
+      attrpathFile ? "${attrpathsSuperset}/paths.json",
      # The number of attributes per chunk, see ./README.md for more info.
      chunkSize,
      checkMeta ? true,
@@ -289,7 +286,6 @@ let
          name = evalSystem;
          path = singleSystem {
            inherit quickTest evalSystem chunkSize;
-            attrpathFile = attrpathsSuperset + "/paths.json";
          };
        }) evalSystems
      );
--- a/ci/get-merge-commit.sh
+++ b/ci/get-merge-commit.sh
@@ -55,7 +55,10 @@ done

 if [[ "$mergeable" == "true" ]]; then
    log "The PR can be merged"
-    jq -r .merge_commit_sha <<< "$prInfo"
+    mergedSha="$(jq -r .merge_commit_sha <<< "$prInfo")"
+    echo "mergedSha=$mergedSha"
+    targetSha="$(gh api "/repos/$repo/commits/$mergedSha" --jq '.parents[0].sha')"
+    echo "targetSha=$targetSha"
 else
    log "The PR has a merge conflict"
    exit 2
--- a/ci/supportedSystems.json
+++ b/ci/supportedSystems.json
@@ -0,0 +1,6 @@
+[
+  "aarch64-linux",
+  "aarch64-darwin",
+  "x86_64-linux",
+  "x86_64-darwin"
+]
--- a/ci/supportedSystems.nix
+++ b/ci/supportedSystems.nix
@@ -1,6 +0,0 @@
-[
-  "aarch64-linux"
-  "aarch64-darwin"
-  "x86_64-linux"
-  "x86_64-darwin"
-]
--- a/nixos/modules/services/misc/gitlab.nix
+++ b/nixos/modules/services/misc/gitlab.nix
@@ -913,6 +913,44 @@ in
        '';
      };

+      secrets.activeRecordPrimaryKeyFile = mkOption {
+        type = with types; nullOr path;
+        default = null;
+        description = ''
+          A file containing the secret used to encrypt some rails data
+          in the DB. This should not be the same as `services.gitlab.secrets.activeRecordDeterministicKeyFile`!
+          Make sure the secret is at ideally 32 characters and all random,
+          no regular words or you'll be exposed to dictionary attacks.
+          This should be a string, not a nix path, since nix paths are
+          copied into the world-readable nix store.
+        '';
+      };
+
+      secrets.activeRecordDeterministicKeyFile = mkOption {
+        type = with types; nullOr path;
+        default = null;
+        description = ''
+          A file containing the secret used to encrypt some rails data in a deterministic way
+          in the DB. This should not be the same as `services.gitlab.secrets.activeRecordPrimaryKeyFile`!
+          Make sure the secret is at ideally 32 characters and all random,
+          no regular words or you'll be exposed to dictionary attacks.
+          This should be a string, not a nix path, since nix paths are
+          copied into the world-readable nix store.
+        '';
+      };
+
+      secrets.activeRecordSaltFile = mkOption {
+        type = with types; nullOr path;
+        default = null;
+        description = ''
+          A file containing the salt for active record encryption in the DB.
+          Make sure the secret is at ideally 32 characters and all random,
+          no regular words or you'll be exposed to dictionary attacks.
+          This should be a string, not a nix path, since nix paths are
+          copied into the world-readable nix store.
+        '';
+      };
+
      extraShellConfig = mkOption {
        type = types.attrs;
        default = { };
@@ -1155,6 +1193,15 @@ in
          GitLab instances created or updated between versions [15.11.0, 15.11.2] have an incorrect database schema.
          Check the upstream documentation for a workaround: https://docs.gitlab.com/ee/update/versions/gitlab_16_changes.html#undefined-column-error-upgrading-to-162-or-later''
      )
+      (mkIf (cfg.secrets.activeRecordPrimaryKeyFile == null)
+        "services.gitlab.secrets.activeRecordPrimaryKeyFile is null. Please set this key file to make this secret stable and avoid decryption errors."
+      )
+      (mkIf (cfg.secrets.activeRecordDeterministicKeyFile == null)
+        "services.gitlab.secrets.activeRecordDeterministicKeyFile is null. Please set this key file to make this secret stable and avoid decryption errors."
+      )
+      (mkIf (cfg.secrets.activeRecordSaltFile == null)
+        "services.gitlab.secrets.activeRecordSaltFile is null. Please set this key file to make this secret stable and avoid decryption errors."
+      )
    ];

    assertions = [
@@ -1487,10 +1534,25 @@ in
            otp="$(<'${cfg.secrets.otpFile}')"
            jws="$(<'${cfg.secrets.jwsFile}')"
            export secret db otp jws
+            ${lib.optionalString (cfg.secrets.activeRecordPrimaryKeyFile != null) ''
+              arprimary="$(<'${cfg.secrets.activeRecordPrimaryKeyFile}')"
+              export arprimary
+            ''}
+            ${lib.optionalString (cfg.secrets.activeRecordDeterministicKeyFile != null) ''
+              ardeterministic="$(<'${cfg.secrets.activeRecordDeterministicKeyFile}')"
+              export ardeterminstic
+            ''}
+            ${lib.optionalString (cfg.secrets.activeRecordSaltFile != null) ''
+              arsalt="$(<'${cfg.secrets.activeRecordSaltFile}')"
+              export arsalt
+            ''}
            jq -n '{production: {secret_key_base: $ENV.secret,
                    otp_key_base: $ENV.otp,
                    db_key_base: $ENV.db,
-                    openid_connect_signing_key: $ENV.jws}}' \
+                    openid_connect_signing_key: $ENV.jws,
+                    active_record_encryption_primary_key: $ENV.arprimary,
+                    active_record_encryption_deterministic_key: $ENV.ardeterministic,
+                    active_record_encryption_key_derivation_salt: $ENV.arsalt}}' \
               > '${cfg.statePath}/config/secrets.yml'
          )

--- a/pkgs/applications/editors/vscode/extensions/amazonwebservices.amazon-q-vscode/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/amazonwebservices.amazon-q-vscode/default.nix
@@ -0,0 +1,22 @@
+{
+  lib,
+  vscode-utils,
+}:
+
+vscode-utils.buildVscodeMarketplaceExtension (finalAttrs: {
+  mktplcRef = {
+    name = "amazon-q-vscode";
+    publisher = "AmazonWebServices";
+    version = "1.66.0";
+    hash = "sha256-EnNwlSmJWBcSfFCayxJS94qVUqgQlbX0RLCB4jJsn+4=";
+  };
+
+  meta = {
+    changelog = "https://github.com/aws/aws-toolkit-vscode/releases/tag/amazonq%2Fv${finalAttrs.version}";
+    description = "Amazon Q, CodeCatalyst, Local Lambda debug, SAM/CFN syntax, ECS Terminal, AWS resources";
+    downloadPage = "https://marketplace.visualstudio.com/items?itemName=AmazonWebServices.amazon-q-vscode";
+    homepage = "https://github.com/aws/aws-toolkit-vscode";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ drupol ];
+  };
+})
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -253,6 +253,8 @@ let
        };
      };

+      amazonwebservices.amazon-q-vscode = callPackage ./amazonwebservices.amazon-q-vscode { };
+
      angular.ng-template = buildVscodeMarketplaceExtension {
        mktplcRef = {
          name = "ng-template";
--- a/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
+++ b/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
@@ -93,8 +93,8 @@ rec {
  thunderbird-esr = thunderbird-128;

  thunderbird-128 = common {
-    version = "128.9.2esr";
-    sha512 = "3c8df53304611c1a7f8c02d50cfa1017f4d64c50a93fd6603ce0766cbb5d63c7bc5e0276f155c35817c3efa49f683c05583ddf24257bf8c25f585b67fd732cb5";
+    version = "128.10.0esr";
+    sha512 = "b02582ea4fa0297a06d30eda1555bbf3ed79ae7a35a8993f2a70b0ec84af28a4d084cd7ebe1c73676e689ff9366e779cc5ef67a197638949bf232a40b740d1b6";

    updateScript = callPackage ./update.nix {
      attrPath = "thunderbirdPackages.thunderbird-128";
--- a/pkgs/by-name/bt/btrfs-progs/package.nix
+++ b/pkgs/by-name/bt/btrfs-progs/package.nix
@@ -96,6 +96,7 @@ stdenv.mkDerivation rec {
    homepage = "https://btrfs.readthedocs.io/en/latest/";
    changelog = "https://github.com/kdave/btrfs-progs/raw/v${version}/CHANGES";
    license = licenses.gpl2Only;
+    mainProgram = "btrfs";
    maintainers = with maintainers; [ raskin ];
    platforms = platforms.linux;
  };
--- a/pkgs/by-name/st/sta/package.nix
+++ b/pkgs/by-name/st/sta/package.nix
@@ -3,6 +3,7 @@
  lib,
  fetchFromGitHub,
  autoreconfHook,
+  cxxtest,
 }:

 stdenv.mkDerivation {
@@ -16,8 +17,28 @@ stdenv.mkDerivation {
    sha256 = "sha256-AiygCfBze7J1Emy6mc27Dim34eLR7VId9wodUZapIL4=";
  };

+  strictDeps = true;
+
  nativeBuildInputs = [ autoreconfHook ];

+  doCheck = true;
+  nativeCheckInputs = [ cxxtest ];
+  checkInputs = [ cxxtest ];
+
+  checkPhase = ''
+    runHook preCheck
+
+    pushd test
+
+    cxxtestgen --error-printer --have-std -o tests.cpp sta_test_1.h sta_test_2.h
+    ${stdenv.cc.targetPrefix}c++ -o tester tests.cpp
+    ./tester
+
+    popd
+
+    runHook postCheck
+  '';
+
  meta = with lib; {
    description = "Simple statistics from the command line interface (CLI), fast";
    longDescription = ''
@@ -31,7 +52,6 @@ stdenv.mkDerivation {
    homepage = "https://github.com/simonccarter/sta";
    maintainers = [ ];
    platforms = platforms.all;
-    badPlatforms = platforms.darwin;
    mainProgram = "sta";
  };
 }
--- a/pkgs/servers/http/tomcat/default.nix
+++ b/pkgs/servers/http/tomcat/default.nix
@@ -60,17 +60,17 @@ let
 in
 {
  tomcat9 = common {
-    version = "9.0.98";
-    hash = "sha256-HZoRBMLiNaW6/26cqOKL49hkgD+vxHj1wTwq5qXtPW8=";
+    version = "9.0.104";
+    hash = "sha256-+hl1HI+BspTd40atk1F73thPQIhcRC4KcTDamCoiq64=";
  };

  tomcat10 = common {
-    version = "10.1.34";
-    hash = "sha256-95lUE4C//ytnTO/YbFN20tfVZrOi58RXnStJHejsbDY=";
+    version = "10.1.40";
+    hash = "sha256-JfHmB/F+4vqZ4ynuwjtjk6ueE5CSnGzcsx90lXa5TY4=";
  };

  tomcat11 = common {
-    version = "11.0.2";
-    hash = "sha256-wbMaaYnTCnNEwaNlXadGec6fm0iicehkZHoUHeO3jLg=";
+    version = "11.0.6";
+    hash = "sha256-hkRY9ka/k40/61dzRWGZgZuR1SZw5NckuYZsz9R2HO8=";
  };
 }
--- a/pkgs/top-level/release-haskell.nix
+++ b/pkgs/top-level/release-haskell.nix
@@ -10,7 +10,7 @@
  $ hydra-eval-jobs -I . pkgs/top-level/release-haskell.nix
 */
 {
-  supportedSystems ? import ../../ci/supportedSystems.nix,
+  supportedSystems ? builtins.fromJSON (builtins.readFile ../../ci/supportedSystems.json),
 }:

 let
--- a/pkgs/top-level/release-outpaths.nix
+++ b/pkgs/top-level/release-outpaths.nix
@@ -13,7 +13,7 @@
  attrNamesOnly ? false,

  # Set this to `null` to build for builtins.currentSystem only
-  systems ? import ../../ci/supportedSystems.nix,
+  systems ? builtins.fromJSON (builtins.readFile ../../ci/supportedSystems.json),
 }:
 let
  lib = import (path + "/lib");
--- a/pkgs/top-level/release.nix
+++ b/pkgs/top-level/release.nix
@@ -19,7 +19,7 @@
  system ? builtins.currentSystem,
  officialRelease ? false,
  # The platform doubles for which we build Nixpkgs.
-  supportedSystems ? import ../../ci/supportedSystems.nix,
+  supportedSystems ? builtins.fromJSON (builtins.readFile ../../ci/supportedSystems.json),
  # The platform triples for which we build bootstrap tools.
  bootstrapConfigs ? [
    "aarch64-apple-darwin"