nathan/nixpkgs
1
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2026-10-30 16:10:36 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'master' into staging-next-26.05

Browse Source
This commit is contained in:
Michael Daniels
2026-05-14 19:52:48 -04:00
parent d9245b1404 3157d6d9eb
commit 5212ff992a
1159 changed files with 12692 additions and 11454 deletions
Download Patch File Download Diff File Expand all files Collapse all files

32
doc/README.md
View File

@@ -217,6 +217,38 @@ Not everything has been migrated to this format yet.
Please always use it for new content.
When changing existing content, update formatting if possible, but avoid excessive diffs.
### Examples first
Readers look at examples first: an example communicates what something does faster than a description.
Put examples before detailed explanations.
Prefer this structure for each documented item:
1. Title
2. Abstract (optional, one sentence max, the example often speaks for itself)
3. Example
4. Explanation (details, edge cases, types, defaults)
For instance:
````markdown
## `lib.toUpper`
Converts all characters in a string to uppercase.
:::{.example #ex-lib-toUpper}
# Converting a string to uppercase
```nix
lib.toUpper "hello"
=> "HELLO"
```
:::
Only acts on ASCII characters.
Unicode characters are passed through unchanged.
````
### Writing Function Documentation
Function documentation is *reference documentation*, for which

62
doc/languages-frameworks/javascript.section.md
View File

@@ -305,7 +305,7 @@ This package puts the corepack wrappers for pnpm and yarn in your PATH, and they
### pnpm {#javascript-pnpm}
pnpm is available as the top-level package `pnpm`. Additionally, there are variants pinned to certain major versions, like `pnpm_8`, `pnpm_9` and `pnpm_10`, which support different sets of lock file versions.
pnpm is available as the top-level package `pnpm`. Additionally, there are variants pinned to certain major versions, like `pnpm_8`, `pnpm_9`, `pnpm_10`, `pnpm_10_29_2` and `pnpm_11`, which support different sets of lock file versions.
When packaging an application that includes a `pnpm-lock.yaml`, you need to fetch the pnpm store for that project using a fixed-output-derivation. The function `fetchPnpmDeps` can create this pnpm store derivation. In conjunction, the setup hook `pnpmConfigHook` will prepare the build environment to install the pre-fetched dependencies store. Here is an example for a package that contains `package.json` and a `pnpm-lock.yaml` files using the fetcher and setup hook above:
@@ -313,11 +313,18 @@ When packaging an application that includes a `pnpm-lock.yaml`, you need to fetc
{
fetchPnpmDeps,
nodejs,
pnpm,
pnpm_11,
pnpmConfigHook,
stdenv,
}:
let
# It is recommended to pin pnpm to a major version, due to regular breaking changes in the store format
# The latest major version is always available under `pkgs.pnpm`
# Optionally override pnpm to use a custom nodejs version
# Make sure that the same nodejs version is referenced in nativeBuildInputs
# pnpm = pnpm_11.override { nodejs = nodejs_24; };
pnpm = pnpm_11;
in
stdenv.mkDerivation (finalAttrs: {
pname = "foo";
version = "0-unstable-1980-01-01";
@@ -334,54 +341,13 @@ stdenv.mkDerivation (finalAttrs: {
pnpmDeps = fetchPnpmDeps {
inherit (finalAttrs) pname version src;
inherit pnpm;
fetcherVersion = 3;
hash = "...";
};
})
```
It is highly recommended to use a pinned version of pnpm (i.e., `pnpm_9` or `pnpm_10`), to increase future reproducibility. It might also be required to use an older version if the package needs support for a certain lock file version. To do so, you can pass the `pnpm` argument to `fetchPnpmDeps` and override the `pnpm` arg in `pnpmConfigHook`. Here are the changes in the example above to use a pinned pnpm version:
<!-- TODO: Does splicing still work when overriding in nativeBuildInputs here? -->
```diff
{
fetchPnpmDeps,
nodejs,
- pnpm,
+ pnpm_10,
pnpmConfigHook,
stdenv,
}:
+let
+ # Optionally override pnpm to use a custom nodejs version
+ # Make sure that the same nodejs version is referenced in nativeBuildInputs
+ # pnpm = pnpm_10.override { nodejs = nodejs-slim_22; };
+in
stdenv.mkDerivation (finalAttrs: {
pname = "foo";
version = "0-unstable-1980-01-01";
src = {
#...
};
nativeBuildInputs = [
nodejs # in case scripts are run outside of a pnpm call
pnpmConfigHook
- pnpm # At least required by pnpmConfigHook, if not other (custom) phases
+ pnpm_10 # At least required by pnpmConfigHook, if not other (custom) phases
];
pnpmDeps = fetchPnpmDeps {
inherit (finalAttrs) pname version src;
+ pnpm = pnpm_10;
fetcherVersion = 3;
hash = "...";
};
})
```
In case you are patching `package.json` or `pnpm-lock.yaml`, make sure to pass `finalAttrs.patches` to the function as well (i.e., `inherit (finalAttrs) patches`.
`pnpmConfigHook` supports adding additional `pnpm install` flags via `pnpmInstallFlags` which can be set to a Nix string array:
@@ -503,9 +469,11 @@ Changes can include workarounds or bug fixes to existing PNPM issues.
##### Version history {#javascript-pnpm-fetcherVersion-versionHistory}
- 1: Initial version, nothing special. **Deprecated: Scheduled for removal in the 26.11 release.**. New packages must not use this value.
Version 3 is the recommended value for new packages. Versions 1 and 2 are deprecated and scheduled for removal in the 26.11 release; existing packages must migrate.
- 1: Initial version, nothing special.
- 2: [Ensure consistent permissions](https://github.com/NixOS/nixpkgs/pull/422975)
- 3: [Build a reproducible tarball](https://github.com/NixOS/nixpkgs/pull/469950). **Recommended**
- 3: [Build a reproducible tarball](https://github.com/NixOS/nixpkgs/pull/469950)
### Yarn {#javascript-yarn}

13
doc/release-notes/rl-2605.section.md
View File

@@ -290,6 +290,8 @@
- `spacefm` was removed because it appeared to be unmaintained upstream.
- `neofetch` has been removed because it was unmaintained upstream. Consider using the updated fork `neowofetch` provided by the `hyfetch` package or the alternative `fastfetch` instead.
- `vimPlugins.nvim-treesitter` has been updated to `main` branch, which is a full and incompatible rewrite. If you can't or don't want to update, you should use `vimPlugins.nvim-treesitter-legacy`.
- `services.taskchampion-sync-server` module have been added an option `services.taskchampion-sync-server.dynamicUser` to use systemd's DynamicUser feature. This is enabled by default when stateVersion is at least 26.05, and disabled otherwise. If you need this feature, you need to set `services.taskchampion-sync-server.dynamicUser` to `true` and migrate `/var/lib/taskchampion-sync-server` to `/var/lib/private/taskchampion-sync-server`.
@@ -332,11 +334,12 @@
- `fetchPnpmDeps` and `pnpmConfigHook` were added as top-level attributes, replacing the now deprecated `pnpm.fetchDeps` and `pnpm.configHook` attributes.
- `fetchPnpmDeps`' `fetcherVersion = 1` is deprecated and scheduled for removal
in the 26.11 release. A deprecation warning has been added. Packages still on
`fetcherVersion = 1` should migrate to `fetcherVersion = 3` and regenerate
their hashes. See the [pnpm `fetcherVersion`
section](#javascript-pnpm-fetcherVersion) of the manual for details.
- `fetchPnpmDeps`' `fetcherVersion = 1` and `fetcherVersion = 2` are deprecated
and scheduled for removal in the 26.11 release. A deprecation warning has
been added. Packages still on `fetcherVersion = 1` or `fetcherVersion = 2`
should migrate to `fetcherVersion = 3` and regenerate their hashes. See the
[pnpm `fetcherVersion` section](#javascript-pnpm-fetcherVersion) of the
manual for details.
- `buildNpmPackage` now supports `npmDepsFetcherVersion` (and `fetchNpmDeps` now supports `fetcherVersion`). Set to `2` to enable packument caching, which fixes builds for projects using npm workspaces.

4
doc/release-notes/rl-2611.section.md
View File

@@ -10,7 +10,9 @@
<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
- Create the first release note entry in this section!
- `pqos-wrapper` was removed
as it has been unmaintained since 2022
and not widely used.
## Other Notable Changes {#sec-nixpkgs-release-26.11-notable-changes}

35
lib/modules.nix
View File

@@ -1433,18 +1433,27 @@ let
filterOverrides = defs: (filterOverrides' defs).values;
filterOverrides' =
defs:
let
getPrio =
def: if def.value._type or "" == "override" then def.value.priority else defaultOverridePriority;
highestPrio = foldl' (prio: def: min (getPrio def) prio) 9999 defs;
strip =
def: if def.value._type or "" == "override" then def // { value = def.value.content; } else def;
in
{
values = map strip (filter (def: getPrio def == highestPrio) defs);
inherit highestPrio;
};
defs:
# Optimize for the singleton case, equivalent to the `else` clause.
if length defs == 1 then
{
values = map strip defs;
highestPrio = getPrio (head defs);
}
else
let
highestPrio = foldl' (prio: def: min (getPrio def) prio) 9999 defs;
in
{
values = concatMap (def: if getPrio def == highestPrio then [ (strip def) ] else [ ]) defs;
inherit highestPrio;
};
/**
Sort a list of properties. The sort priority of a property is
@@ -1717,11 +1726,21 @@ let
`from`
: 1\. Function argument
: The "from" option path as list of strings.
Option must not exist in the current module set.
`to`
: 2\. Function argument
: The "to" option path as list of strings.
Option must already exist in the current module set.
# Limitations
- The "to" option must already be declared.
- The "from" option should not be declared, as this function will declare it.
- "to" Options whose types don't support merging at any level of their structure (like `types.raw`,
or `types.attrsOf types.raw` where the attribute values can't merge) are not well-supported
because this function wraps aliased definitions in `mkMerge`.
*/
mkRenamedOptionModule =
from: to:

35
lib/systems/default.nix
View File

@@ -3,8 +3,6 @@
let
inherit (lib)
any
attrNames
filter
foldl
hasInfix
isAttrs
@@ -35,17 +33,31 @@ let
compare the value with a reconstruction of itself, e.g. with `f == a: f a`,
or perhaps calling `elaborate` twice, and one will see reflexivity fail as described.
Hence a custom equality test.
To solve this, the elaborated systems also store a version of their data
without any functions to be compared.
Note that this does not canonicalize the systems, so you'll want to make sure
both arguments have been `elaborate`-d.
*/
equals =
let
# System attrs are never __functor-style attrsets, so builtins.isFunction suffices.
removeFunctions = a: removeAttrs a (filter (n: builtins.isFunction a.${n}) (attrNames a));
in
a: b: removeFunctions a == removeFunctions b;
equals = a: b: a._withoutFunctions == b._withoutFunctions;
/**
The attribute names within an elaborated system that store functions.
Due to object identity semantics, `systems.equals` needs a way to compare
all non-function attributes. It does this by storing a version of itself
without any functions under the attribute name `_withoutFunctions`. The
attribute names that contain functions are exposed for regression testing.
*/
functionNames = [
"canExecute"
"emulator"
"emulatorAvailable"
"staticEmulatorAvailable"
];
# Avoiding infrec
ignoredNames = functionNames ++ [ "_withoutFunctions" ];
/**
List of all Nix system doubles the nixpkgs flake will expose the package set
@@ -107,6 +119,7 @@ let
null;
final = {
_withoutFunctions = removeAttrs final ignoredNames;
# Prefer to parse `config` as it is strictly more informative.
parsed = parse.mkSystemFromString (args.config or allArgs.system);
# This can be losslessly-extracted from `parsed` iff parsing succeeds.
@@ -131,9 +144,6 @@ let
)
);
isCompatible =
_:
throw "2022-05-23: isCompatible has been removed in favor of canExecute, refer to the 22.11 changelog for details";
# Derived meta-data
useLLVM = final.isFreeBSD || final.isOpenBSD;
@@ -698,6 +708,7 @@ in
equals
examples
flakeExposed
functionNames
inspect
parse
platforms

88
lib/tests/systems.nix
View File

@@ -226,10 +226,22 @@ lib.runTests (
expr = toLosslessStringMaybe (lib.systems.elaborate "x86_64-linux");
expected = "x86_64-linux";
};
test_toLosslessStringMaybe_fail = {
expr = toLosslessStringMaybe (lib.systems.elaborate "x86_64-linux" // { something = "extra"; });
expected = null;
};
test_toLosslessStringMaybe_fail = (
let
baseSystem = lib.systems.elaborate "x86_64-linux";
in
{
expr = toLosslessStringMaybe (
baseSystem
// {
_withoutFunctions = baseSystem._withoutFunctions // {
something = "extra";
};
}
);
expected = null;
}
);
test_elaborate_config_over_system = {
expr =
(lib.systems.elaborate {
@@ -255,36 +267,48 @@ lib.runTests (
expected = "i686";
};
}
// {
# equals.functionNames must list exactly the function-valued attrs of an
# elaborated system, so that _withoutFunctions stays correct without
# iterating.
test_equals_functionNames_in_sync =
let
sys = lib.systems.elaborate "x86_64-linux";
actual = lib.filter (n: builtins.isFunction sys.${n}) (builtins.attrNames sys);
expected = lib.sort lib.lessThan lib.systems.functionNames;
in
{
expr = lib.sort lib.lessThan actual;
inherit expected;
};
}
# Generate test cases to assert that a change in any non-function attribute makes a platform unequal
//
lib.concatMapAttrs
(platformAttrName: origValue: {
// (
let
# arbitrary choice, just to get all the elaborated attrNames
baseSystem = lib.systems.elaborate "x86_64-linux";
in
lib.concatMapAttrs (platformAttrName: origValue: {
${"test_equals_unequal_${platformAttrName}"} =
let
# lib.systems.equals only checks the subattrset
modified =
assert origValue != arbitraryValue;
baseSystem
// {
_withoutFunctions = baseSystem._withoutFunctions // {
${platformAttrName} = arbitraryValue;
};
};
arbitraryValue = x: "<<modified>>";
in
{
expr = lib.systems.equals baseSystem modified;
expected = false;
};
${"test_equals_unequal_${platformAttrName}"} =
let
modified =
assert origValue != arbitraryValue;
lib.systems.elaborate "x86_64-linux" // { ${platformAttrName} = arbitraryValue; };
arbitraryValue = x: "<<modified>>";
in
{
expr = lib.systems.equals (lib.systems.elaborate "x86_64-linux") modified;
expected =
{
# Changes in these attrs are not detectable because they're function.
# The functions should be derived from the data, so this is not a problem.
canExecute = null;
emulator = null;
emulatorAvailable = null;
staticEmulatorAvailable = null;
isCompatible = null;
} ? ${platformAttrName};
};
})
(
lib.systems.elaborate "x86_64-linux" # arbitrary choice, just to get all the elaborated attrNames
)
}) baseSystem
)
)

86
lib/types.nix
View File

@@ -4,8 +4,11 @@
let
inherit (lib)
all
elem
flip
hasContext
functionArgs
isAttrs
isBool
isDerivation
@@ -13,8 +16,10 @@ let
isFunction
isInt
isList
isString
isPath
isStorePath
isString
substring
throwIf
toDerivation
toList
@@ -22,7 +27,6 @@ let
;
inherit (lib.lists)
concatLists
count
elemAt
filter
foldl'
@@ -72,6 +76,7 @@ let
unions
empty
;
inherit (lib.path) hasStorePathPrefix;
inAttrPosSuffix =
v: name:
@@ -107,10 +112,15 @@ let
checkDefsForError =
check: loc: defs:
let
invalidDefs = filter (def: !check def.value) defs;
in
if invalidDefs != [ ] then { message = "Definition values: ${showDefs invalidDefs}"; } else null;
if all (def: check def.value) defs then
null
else
let
invalidDefs = filter (def: !check def.value) defs;
in
{
message = "Definition values: ${showDefs invalidDefs}";
};
# Check that a type with v2 merge has a coherent check attribute.
# Throws an error if the type uses an ad-hoc `type // { check }` override.
@@ -491,8 +501,8 @@ rec {
};
u8 = unsign 8 256;
u16 = unsign 16 65536;
# the biggest int Nix accepts is 2^63 - 1 (9223372036854775808)
# the smallest int Nix accepts is -2^63 (-9223372036854775807)
# the biggest int Nix accepts is 2^63 - 1 (9223372036854775807)
# the smallest int Nix accepts is -2^63 (-9223372036854775808)
u32 = unsign 32 4294967296;
# u64 = unsign 64 18446744073709551616;
@@ -653,10 +663,7 @@ rec {
let
res = mergeOneOption loc defs;
in
if builtins.isPath res || (builtins.isString res && !builtins.hasContext res) then
toDerivation res
else
res;
if isPath res || (isString res && !hasContext res) then toDerivation res else res;
};
shellPackage = package // {
@@ -714,15 +721,15 @@ rec {
check =
x:
let
isInStore = lib.path.hasStorePathPrefix (
if builtins.isPath x then
isInStore = hasStorePathPrefix (
if isPath x then
x
# Discarding string context is necessary to convert the value to
# a path and safe as the result is never used in any derivation.
else
/. + builtins.unsafeDiscardStringContext x
);
isAbsolute = builtins.substring 0 1 (toString x) == "/";
isAbsolute = substring 0 1 (toString x) == "/";
isExpectedType = (
if inStore == null || inStore then isStringLike x else isString x # Do not allow a true path, which could be copied to the store later on.
);
@@ -1078,14 +1085,14 @@ rec {
merge =
loc: defs:
let
nrNulls = count (def: def.value == null) defs;
nulls = filter (def: def.value == null) defs;
in
if nrNulls == length defs then
if nulls == [ ] then
elemType.merge loc defs
else if length nulls == length defs then
null
else if nrNulls != 0 then
throw "The option `${showOption loc}` is defined both null and not null, in ${showFiles (getFiles defs)}."
else
elemType.merge loc defs;
throw "The option `${showOption loc}` is defined both null and not null, in ${showFiles (getFiles defs)}.";
emptyValue = {
value = null;
};
@@ -1109,9 +1116,7 @@ rec {
check = isFunction;
merge = loc: defs: {
# An argument attribute has a default when it has a default in all definitions
__functionArgs = lib.zipAttrsWith (_: lib.all (x: x)) (
lib.map (fn: lib.functionArgs fn.value) defs
);
__functionArgs = zipAttrsWith (_: all (x: x)) (map (fn: functionArgs fn.value) defs);
__functor =
_: callerArgs:
(mergeDefinitions (loc ++ [ "<function body>" ]) elemType (
@@ -1513,11 +1518,11 @@ rec {
self: loc: defs:
(self.v2 { inherit loc defs; }).value;
v2 =
{ loc, defs }:
{ loc, defs }@args:
let
t1CheckedAndMerged =
if t1.merge ? v2 then
checkV2MergeCoherence loc t1 (t1.merge.v2 { inherit loc defs; })
checkV2MergeCoherence loc t1 (t1.merge.v2 args)
else
{
value = t1.merge loc defs;
@@ -1526,7 +1531,7 @@ rec {
};
t2CheckedAndMerged =
if t2.merge ? v2 then
checkV2MergeCoherence loc t2 (t2.merge.v2 { inherit loc defs; })
checkV2MergeCoherence loc t2 (t2.merge.v2 args)
else
{
value = t2.merge loc defs;
@@ -1560,7 +1565,7 @@ rec {
typeMerge =
f':
let
mt1 = t1.typeMerge (elemAt f'.payload.elemType 0).functor;
mt1 = t1.typeMerge (head f'.payload.elemType).functor;
mt2 = t2.typeMerge (elemAt f'.payload.elemType 1).functor;
in
if (name == f'.name) && (mt1 != null) && (mt2 != null) then functor.type mt1 mt2 else null;
@@ -1580,9 +1585,8 @@ rec {
let
head' =
if ts == [ ] then throw "types.oneOf needs to get at least one type in its argument" else head ts;
tail' = tail ts;
in
foldl' either head' tail';
foldl' either head' (tail ts);
# Either value of type `coercedType` or `finalType`, the former is
# converted to `finalType` using `coerceFunc`.
@@ -1613,19 +1617,15 @@ rec {
def
// {
value =
let
merged =
if coercedType.merge ? v2 then
checkV2MergeCoherence loc coercedType (
coercedType.merge.v2 {
inherit loc;
defs = [ def ];
}
)
else
null;
in
if coercedType.merge ? v2 then
let
merged = checkV2MergeCoherence loc coercedType (
coercedType.merge.v2 {
inherit loc;
defs = [ def ];
}
);
in
if merged.headError == null then coerceFunc def.value else def.value
else if coercedType.check def.value then
coerceFunc def.value
@@ -1683,9 +1683,9 @@ rec {
self: loc: defs:
(self.v2 { inherit loc defs; }).value;
v2 =
{ loc, defs }:
{ loc, defs }@args:
let
orig = checkV2MergeCoherence loc elemType (elemType.merge.v2 { inherit loc defs; });
orig = checkV2MergeCoherence loc elemType (elemType.merge.v2 args);
headError' = if orig.headError != null then orig.headError else checkDefsForError check loc defs;
in
orig

3
maintainers/github-teams.json
View File

@@ -292,7 +292,6 @@
"mdarocha": 11572618
},
"members": {
"GGG-KILLER": 5892127,
"IvarWithoutBones": 41924494,
"JamieMagee": 1358764,
"anpin": 6060545,
@@ -592,6 +591,8 @@
"7c6f434c": 1891350,
"Shados": 338268,
"khaneliman": 1778670,
"lolbinarycat": 19915050,
"mrcjkb": 12857160,
"spencerpogo": 34356756
},
"name": "lua"

68
maintainers/maintainer-list.nix
View File

@@ -1803,6 +1803,12 @@
matrix = "@andrewzah:matrix.abare.party";
keys = [ { fingerprint = "D87B D9DC F11B ACD6 CDB4 0CB2 1373 2FB1 3E61 E0BE"; } ];
};
andrinoff = {
name = "Drew Smirnoff";
email = "me@andrinoff.com";
github = "andrinoff";
githubId = 175145001;
};
Andy3153 = {
name = "Andrei Dobrete";
email = "andy3153@protonmail.com";
@@ -2336,6 +2342,13 @@
githubId = 14922630;
name = "Richard Smith";
};
artifycz = {
email = "richard@tichy.io";
github = "ArtifyCZ";
githubId = 57506608;
matrix = "@artify:artify.zone";
name = "Richard Tichy";
};
artturin = {
email = "artturin@artturin.com";
matrix = "@artturin:matrix.org";
@@ -5545,6 +5558,12 @@
githubId = 32609395;
name = "B YI";
};
coolcuber = {
email = "rpgeorg@clemson.edu";
github = "coolcuber";
githubId = 35880825;
name = "Ross George";
};
coolGi = {
email = "me@coolgi.dev";
github = "coolGi69";
@@ -9497,6 +9516,11 @@
name = "Faye Chun";
keys = [ { fingerprint = "ACB8 DB1F E88D A908 6332 BDB1 5A71 B010 2FD7 3FC0"; } ];
};
fxai = {
github = "fxai";
githubId = 44463990;
name = "fxai";
};
fxfactorial = {
email = "edgar.factorial@gmail.com";
github = "fxfactorial";
@@ -12611,7 +12635,7 @@
};
jfly = {
name = "Jeremy Fleischman";
email = "jeremyfleischman@gmail.com";
email = "me@jfly.fyi";
github = "jfly";
githubId = 277474;
keys = [ { fingerprint = "F1F1 3395 8E8E 9CC4 D9FC 9647 1931 9CD8 416A 642B"; } ];
@@ -16851,6 +16875,13 @@
githubId = 20665331;
name = "Mark";
};
Marker06 = {
email = "linuxenjoyerfi@proton.me";
github = "Marker06";
githubId = 148945811;
name = "Marcus";
matrix = "@marker06:matrix.org";
};
markus1189 = {
email = "markus1189@gmail.com";
github = "markus1189";
@@ -18287,12 +18318,6 @@
githubId = 104795;
name = "Marek Mahut";
};
mmai = {
email = "henri.bourcereau@gmail.com";
github = "mmai";
githubId = 117842;
name = "Henri Bourcereau";
};
mmesch = {
github = "MMesch";
githubId = 2597803;
@@ -19810,6 +19835,12 @@
name = "nixbitcoindev";
keys = [ { fingerprint = "577A 3452 7F3E 2A85 E80F E164 DD11 F9AD 5308 B3BA"; } ];
};
nixosclaw = {
email = "github@nixclaw.io";
github = "nixosclaw";
githubId = 283803283;
name = "NixClaw";
};
nixy = {
email = "nixy@nixy.moe";
github = "nixy";
@@ -24332,6 +24363,12 @@
githubId = 12882091;
name = "Sam L. Yes";
};
samooyo = {
email = "samidarnaud@gmail.com";
github = "samooyo";
githubId = 46531012;
name = "Sami Darnaud";
};
samrose = {
email = "samuel.rose@gmail.com";
github = "samrose";
@@ -28908,6 +28945,13 @@
githubId = 123554;
name = "Thibaut Smith";
};
viena = {
name = "Viena";
email = "theviena96@gmail.com";
github = "devnchill";
githubId = 169875752;
keys = [ { fingerprint = "BF79 8CD0 CA25 2106 99E1 ED9E F826 F032 DDDA 5560"; } ];
};
vieta = {
email = "vieta@4d2.org";
github = "yVieta";
@@ -29239,7 +29283,7 @@
name = "Johannes Mayrhofer";
};
vuks = {
email = "vuks@allthingslinux.org";
email = "vuks@vuks.dev";
github = "Vuks69";
githubId = 51289041;
name = "Vuks";
@@ -29731,7 +29775,7 @@
wolfram444 = {
name = "Xabibulloh To'xtayev";
email = "kamiltox2006@gmail.com";
github = "woolfram444";
github = "wolfram444";
githubId = 109225370;
};
womeier = {
@@ -30020,6 +30064,12 @@
githubId = 5629059;
name = "Xavier Lambein";
};
xmnlz = {
name = "xmnlz";
github = "xmnlz";
githubId = 63904972;
email = "lemmeq9+nixos@gmail.com";
};
xnaveira = {
email = "xnaveira@gmail.com";
github = "xnaveira";

2
maintainers/scripts/luarocks-packages.csv
View File

@@ -123,6 +123,8 @@ magick,,,,,5.1,donovanglover
markdown,,,,,,
md5,,,,,,
mediator_lua,,,,,,
mega.cmdparse,,,,,,
mega.logging,,,,,,
middleclass,,,,,,
mimetypes,,,,,,
mini.test,,,,,,
1 name rockspec ref server version luaversion maintainers
123 markdown
124 md5
125 mediator_lua
126 mega.cmdparse
127 mega.logging
128 middleclass
129 mimetypes
130 mini.test

20
nixos/doc/manual/configuration/ad-hoc-network-config.section.md
View File

@@ -1,14 +1,24 @@
# Ad-Hoc Configuration {#ad-hoc-network-config}
You can use [](#opt-networking.localCommands) to
specify shell commands to be run at the end of `network-setup.service`. This
is useful for doing network configuration not covered by the existing NixOS
modules. For instance, to statically configure an IPv6 address:
You can use [](#opt-networking.localCommands) to specify shell commands to be
run after the network interfaces have been created, but not necessarily fully
configured.
This is useful for doing network configuration not covered by the existing
NixOS modules. For example, you can create a network namespace and a pair
of virtual ethernet devices like this:
```nix
{
networking.localCommands = ''
ip -6 addr add 2001:610:685:1::1/64 dev eth0
ip netns add mynet
ip link add name veth-in type veth peer name veth-out
ip link set dev veth-out netns mynet
'';
}
```
::: {.note}
The commands should ideally be idempotent, so it's recommended to perform
cleanups of the state you create (e.g. virtual interfaces), or at least make
sure possible failures are handled.
:::

13
nixos/doc/manual/configuration/ipv4-config.section.md
View File

@@ -26,9 +26,16 @@ servers:
```
::: {.note}
Statically configured interfaces are set up by the systemd service
`interface-name-cfg.service`. The default gateway and name server
configuration is performed by `network-setup.service`.
Addresses and routes for statically configured interfaces and the default
gateway are set up by systemd services named
`network-addresses-<interface>.service`. The name servers configuration,
instead, is performed by `network-local-commands.service` using resolvconf.
:::
::: {.note}
If needed, for example if addresses/routes were added/removed,
you can reset the network configuration by running
`systemctl restart networking-scripted.target`
:::
The host name is set using [](#opt-networking.hostName):

2
nixos/doc/manual/release-notes/rl-2405.section.md
View File

@@ -74,7 +74,7 @@ The pre-existing `services.ankisyncd` has been marked deprecated and will be dro
- [BenchExec](https://github.com/sosy-lab/benchexec), a framework for reliable benchmarking and resource measurement, available as [programs.benchexec](#opt-programs.benchexec.enable),
as well as related programs
[CPU Energy Meter](https://github.com/sosy-lab/cpu-energy-meter), available as [programs.cpu-energy-meter](#opt-programs.cpu-energy-meter.enable), and
[PQoS Wrapper](https://gitlab.com/sosy-lab/software/pqos-wrapper), available as [programs.pqos-wrapper](#opt-programs.pqos-wrapper.enable).
[PQoS Wrapper](https://gitlab.com/sosy-lab/software/pqos-wrapper), available as `programs.pqos-wrapper`.
- [Bluemap](https://bluemap.bluecolored.de/), a 3D minecraft map renderer. Available as [services.bluemap](#opt-services.bluemap.enable).

9
nixos/doc/manual/release-notes/rl-2605.section.md
View File

@@ -158,6 +158,8 @@
- [porxie](https://codeberg.org/Blooym/porxie), a correct and efficient ATProto blob proxy for secure content delivery. Available as [services.porxie](#opt-services.porxie.enable).
- [LogiOps](https://github.com/PixlOne/logiops), a unofficial userspace driver for HID++ Logitech devices. Available as [services.logiops](#opt-services.logiops.enable).
## Backward Incompatibilities {#sec-release-26.05-incompatibilities}
<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
@@ -324,6 +326,13 @@ See <https://github.com/NixOS/nixpkgs/issues/481673>.
Note for NetworkManager users: before these changes NetworkManager used to spawn its own wpa_supplicant daemon, but now it relies on `networking.wireless`. So, if you had `networking.wireless.enable = false` in your configuration, you should remove that line.
- Some implementation details of the NixOS network-interfaces module have been changed:
- In the "scripted" backend, `network-setup.service` has been removed and the network configuration services are now part of `network.target`, which is now directly pulled into `multi-user.target`.
- Interface addresses, routes and default gateways are now configured asynchronously as soon as the underlying network devices become available (fixes issue [#154737](https://github.com/NixOS/nixpkgs/issues/154737)).
- In both "networkd" and "scripted" backends, the configuration of name servers is now part of `network-local-commands.service` (fixes issue [#445496](https://github.com/NixOS/nixpkgs/issues/445496)).
- The issue that resulted in a completely unconfigured network if both `resolvconf` was disabled and no default gateway configured, has also been fixed.
- `kratos` has been updated from 1.3.1 to [25.4.0](https://github.com/ory/kratos/releases/tag/v25.4.0). Upstream switched to a new versioning scheme (year.major.minor). Notable breaking changes:
- The `migrate sql` CLI command is now `migrate sql up`

7
nixos/doc/manual/release-notes/rl-2611.section.md
View File

@@ -16,7 +16,12 @@
<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
- Create the first release note entry in this section!
- `programs.pqos-wrapper` module has been deleted
as the corresponding package has been dropped from nixpkgs.
- `programs.benchexec.enable = true`
no longer sets `programs.pqos-wrapper.enable = true`
as the corresponding module has been deleted.
## Other Notable Changes {#sec-release-26.11-notable-changes}

4
nixos/lib/make-multi-disk-zfs-image.nix
View File

@@ -221,12 +221,12 @@ let
};
}) mountable;
};
passAsFile = [ "filesystems" ];
__structuredAttrs = true;
}
''
(
echo "builtins.fromJSON '''"
jq . < "$filesystemsPath"
printf "%s" "$filesystems" | jq .
echo "'''"
) > $out

4
nixos/lib/make-single-disk-zfs-image.nix
View File

@@ -209,12 +209,12 @@ let
};
}) mountable;
};
passAsFile = [ "filesystems" ];
__structuredAttrs = true;
}
''
(
echo "builtins.fromJSON '''"
jq . < "$filesystemsPath"
printf "%s" "$filesystems" | jq .
echo "'''"
) > $out

1
nixos/lib/testing/nixos-test-base.nix
View File

@@ -8,6 +8,7 @@ in
{
imports = [
../../modules/testing/test-instrumentation.nix # !!! should only get added for automated test runs
../../modules/virtualisation/guest-networking-options.nix
{
key = "no-manual";
documentation.nixos.enable = false;

167
nixos/lib/testing/nodes.nix
View File

@@ -37,93 +37,94 @@ let
in
hostToGuest.${hostPlatform.system} or (throw message);
baseOS = import ../eval-config.nix {
inherit lib;
system = null; # use modularly defined system
inherit (config.node) specialArgs;
modules = [ config.defaults ];
baseModules = (import ../../modules/module-list.nix) ++ [
./nixos-test-base.nix
{
key = "nodes";
_module.args = {
inherit (config) containers;
nodes = config.nodesCompat;
};
}
(
{ options, ... }:
{
key = "nodes.nix-pkgs";
config = optionalAttrs (!config.node.pkgsReadOnly) (
mkIf (!options.nixpkgs.pkgs.isDefined) {
# TODO: switch to nixpkgs.hostPlatform and make sure containers-imperative test still evaluates.
nixpkgs.system = guestSystem;
baseOS =
extraBaseModules:
import ../eval-config.nix {
inherit lib;
system = null; # use modularly defined system
inherit (config.node) specialArgs;
modules = [ config.defaults ];
baseModules =
(import ../../modules/module-list.nix)
++ [
./nixos-test-base.nix
{
key = "nodes";
_module.args = {
inherit (config) containers;
nodes = config.nodesCompat;
};
}
(
{ options, ... }:
{
key = "nodes.nix-pkgs";
config = optionalAttrs (!config.node.pkgsReadOnly) (
mkIf (!options.nixpkgs.pkgs.isDefined) {
# TODO: switch to nixpkgs.hostPlatform and make sure containers-imperative test still evaluates.
nixpkgs.system = guestSystem;
}
);
}
);
}
)
testModuleArgs.config.extraBaseModules
];
};
baseQemuOS = baseOS.extendModules {
modules = [
../../modules/virtualisation/qemu-vm.nix
config.nodeDefaults
)
testModuleArgs.config.extraBaseModules
]
++ extraBaseModules;
};
baseQemuOS = baseOS [
../../modules/virtualisation/qemu-vm.nix
testModuleArgs.config.extraBaseNodeModules
config.nodeDefaults
{
key = "base-qemu";
virtualisation.qemu = {
inherit (testModuleArgs.config.qemu) package forceAccel;
};
virtualisation.host.pkgs = hostPkgs;
}
];
baseNspawnOS = baseOS [
../../modules/virtualisation/nspawn-container
config.containerDefaults
(
{ pkgs, ... }:
{
key = "base-qemu";
virtualisation.qemu = {
inherit (testModuleArgs.config.qemu) package forceAccel;
key = "base-nspawn";
# PAM requires setuid and doesn't work in the build sandbox.
# https://github.com/NixOS/nix/blob/959c244a1265f4048390f3ad21679219d7b27a99/src/libstore/unix/build/linux-derivation-builder.cc#L63
services.openssh.settings.UsePAM = false;
# Networking for tests is statically configured by default.
# dhcpcd times out after blocking for a long time, which slows down tests.
# See https://github.com/NixOS/nixpkgs/pull/478109#discussion_r2867570799
networking.useDHCP = lib.mkDefault false;
# Disable Info manual directory generation to prevent build failures.
#
# Context: 'install-info' (from texinfo) is triggered during system-path
# generation to index manuals, but it requires 'gzip' in the $PATH to
# decompress them.
# When 'networking.useDHCP' is set to false, transitive dependencies
# (like dhcpcd or other network tools) that normally pull 'gzip' into
# the system environment are removed. This leaves 'install-info'
# stranded without 'gzip', causing the 'system-path' derivation to fail.
# Since nspawn containers are typically minimal, disabling 'info'
# is a cleaner fix than explicitly adding 'gzip' to systemPackages.
documentation.info.enable = lib.mkDefault false;
# Gross, insecure hack to make login work. See above.
security.pam.services.login = {
text = ''
auth sufficient ${pkgs.linux-pam}/lib/security/pam_permit.so
account sufficient ${pkgs.linux-pam}/lib/security/pam_permit.so
password sufficient ${pkgs.linux-pam}/lib/security/pam_permit.so
session sufficient ${pkgs.linux-pam}/lib/security/pam_permit.so
'';
};
virtualisation.host.pkgs = hostPkgs;
}
testModuleArgs.config.extraBaseNodeModules
];
};
baseNspawnOS = baseOS.extendModules {
modules = [
../../modules/virtualisation/nspawn-container
config.containerDefaults
(
{ pkgs, ... }:
{
key = "base-nspawn";
# PAM requires setuid and doesn't work in the build sandbox.
# https://github.com/NixOS/nix/blob/959c244a1265f4048390f3ad21679219d7b27a99/src/libstore/unix/build/linux-derivation-builder.cc#L63
services.openssh.settings.UsePAM = false;
# Networking for tests is statically configured by default.
# dhcpcd times out after blocking for a long time, which slows down tests.
# See https://github.com/NixOS/nixpkgs/pull/478109#discussion_r2867570799
networking.useDHCP = lib.mkDefault false;
# Disable Info manual directory generation to prevent build failures.
#
# Context: 'install-info' (from texinfo) is triggered during system-path
# generation to index manuals, but it requires 'gzip' in the $PATH to
# decompress them.
# When 'networking.useDHCP' is set to false, transitive dependencies
# (like dhcpcd or other network tools) that normally pull 'gzip' into
# the system environment are removed. This leaves 'install-info'
# stranded without 'gzip', causing the 'system-path' derivation to fail.
# Since nspawn containers are typically minimal, disabling 'info'
# is a cleaner fix than explicitly adding 'gzip' to systemPackages.
documentation.info.enable = lib.mkDefault false;
# Gross, insecure hack to make login work. See above.
security.pam.services.login = {
text = ''
auth sufficient ${pkgs.linux-pam}/lib/security/pam_permit.so
account sufficient ${pkgs.linux-pam}/lib/security/pam_permit.so
password sufficient ${pkgs.linux-pam}/lib/security/pam_permit.so
session sufficient ${pkgs.linux-pam}/lib/security/pam_permit.so
'';
};
}
)
];
};
)
];
# TODO (lib): Dedup with run.nix, add to lib/options.nix
mkOneUp = opt: f: lib.mkOverride (opt.highestPrio - 1) (f opt.value);

21
nixos/modules/config/console.nix
View File

@@ -24,10 +24,12 @@ let
'';
# Sadly, systemd-vconsole-setup doesn't support binary keymaps.
vconsoleConf = pkgs.writeText "vconsole.conf" ''
KEYMAP=${cfg.keyMap}
${lib.optionalString (cfg.font != null) "FONT=${cfg.font}"}
'';
vconsoleConf =
withFont:
pkgs.writeText "vconsole.conf" ''
KEYMAP=${cfg.keyMap}
${lib.optionalString (withFont && cfg.font != null) "FONT=${cfg.font}"}
'';
consoleEnv =
kbd:
@@ -165,7 +167,7 @@ in
# Let systemd-vconsole-setup.service do the work of setting up the
# virtual consoles. Skip when imperative so localectl can manage it.
environment.etc."vconsole.conf" = lib.mkIf (!i18nCfg.imperativeLocale) {
source = vconsoleConf;
source = vconsoleConf true;
};
# Provide kbd with additional packages.
environment.etc.kbd.source = "${consoleEnv pkgs.kbd}/share";
@@ -183,7 +185,7 @@ in
);
boot.initrd.systemd.contents = {
"/etc/vconsole.conf".source = vconsoleConf;
"/etc/vconsole.conf".source = vconsoleConf cfg.earlySetup;
# Add everything if we want full console setup...
"/etc/kbd" = lib.mkIf cfg.earlySetup {
source = "${consoleEnv config.boot.initrd.systemd.package.kbd}/share";
@@ -192,9 +194,6 @@ in
"/etc/kbd/keymaps" = lib.mkIf (!cfg.earlySetup) {
source = "${consoleEnv config.boot.initrd.systemd.package.kbd}/share/keymaps";
};
"/etc/kbd/consolefonts" = lib.mkIf (!cfg.earlySetup && cfg.font != null) {
source = "${consoleEnv config.boot.initrd.systemd.package.kbd}/share/consolefonts";
};
};
boot.initrd.systemd.additionalUpstreamUnits = [
"systemd-vconsole-setup.service"
@@ -204,7 +203,7 @@ in
"${config.boot.initrd.systemd.package.kbd}/bin/setfont"
"${config.boot.initrd.systemd.package.kbd}/bin/loadkeys"
]
++ lib.optionals (cfg.font != null && lib.hasPrefix builtins.storeDir cfg.font) [
++ lib.optionals (cfg.font != null && cfg.earlySetup && lib.hasPrefix builtins.storeDir cfg.font) [
"${cfg.font}"
]
++ lib.optionals (lib.hasPrefix builtins.storeDir cfg.keyMap) [
@@ -226,7 +225,7 @@ in
wantedBy = [ "multi-user.target" ];
restartTriggers =
lib.optionals (!i18nCfg.imperativeLocale) [
vconsoleConf
(config.environment.etc."vconsole.conf".source)
]
++ [
(consoleEnv pkgs.kbd)

2
nixos/modules/installer/tools/tools.nix
View File

@@ -76,7 +76,7 @@ let
{
inputs = {
# This is pointing to an unstable release.
# If you prefer a stable release instead, you can this to the latest number shown here: https://nixos.org/download
# If you prefer a stable release instead, you can change the word unstable to the latest number shown here: https://nixos.org/download
# i.e. nixos-24.11
# Use `nix flake update` to update the flake to the latest revision of the chosen release channel.
nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";

2
nixos/modules/module-list.nix
View File

@@ -296,7 +296,6 @@
./programs/pay-respects.nix
./programs/plotinus.nix
./programs/pmount.nix
./programs/pqos-wrapper.nix
./programs/projecteur.nix
./programs/proxychains.nix
./programs/pulseview.nix
@@ -688,6 +687,7 @@
./services/hardware/lcd.nix
./services/hardware/libinput.nix
./services/hardware/lirc.nix
./services/hardware/logiops.nix
./services/hardware/monado.nix
./services/hardware/nvidia-container-toolkit
./services/hardware/nvidia-optimus.nix

1
nixos/modules/programs/benchexec.nix
View File

@@ -85,7 +85,6 @@ in
# See <https://github.com/sosy-lab/benchexec/blob/3.18/doc/INSTALL.md#requirements>.
programs = {
cpu-energy-meter.enable = lib.mkDefault true;
pqos-wrapper.enable = lib.mkDefault true;
};
# See <https://github.com/sosy-lab/benchexec/blob/3.18/doc/INSTALL.md#kernel-requirements>.

28
nixos/modules/programs/pqos-wrapper.nix
View File

@@ -1,28 +0,0 @@
{
config,
lib,
pkgs,
...
}:
let
cfg = config.programs.pqos-wrapper;
in
{
options.programs.pqos-wrapper = {
enable = lib.mkEnableOption "PQoS Wrapper for BenchExec";
package = lib.mkPackageOption pkgs "pqos-wrapper" { };
};
config = lib.mkIf cfg.enable {
hardware.cpu.x86.msr.enable = true;
security.wrappers.${cfg.package.meta.mainProgram} = {
owner = "nobody";
group = config.hardware.cpu.x86.msr.group;
source = lib.getExe cfg.package;
capabilities = "cap_sys_rawio=eip";
};
};
meta.maintainers = with lib.maintainers; [ lorenzleutgeb ];
}

3
nixos/modules/programs/regreet.nix
View File

@@ -152,6 +152,9 @@ in
theme_name = cfg.theme.name;
};
# Needed to fetch accounts
services.accounts-daemon.enable = true;
services.greetd = {
enable = lib.mkDefault true;
settings.default_session.command = lib.mkDefault "${pkgs.dbus}/bin/dbus-run-session ${lib.getExe pkgs.cage} ${lib.escapeShellArgs cfg.cageArgs} -- ${lib.getExe cfg.package}";

12
nixos/modules/programs/starship.nix
View File

@@ -116,7 +116,7 @@ in
# config file. starship appears to use a hardcoded config location
# rather than one inside an XDG folder:
# https://github.com/starship/starship/blob/686bda1706e5b409129e6694639477a0f8a3f01b/src/configure.rs#L651
if [[ ! -f "$HOME/.config/starship.toml" ]]; then
if [[ ! -f "$${STARSHIP_CONFIG:-$HOME/.config/starship.toml}" ]]; then
export STARSHIP_CONFIG=${settingsFile}
fi
eval "$(${cfg.package}/bin/starship init bash --print-full-init)"
@@ -129,7 +129,8 @@ in
# config file. starship appears to use a hardcoded config location
# rather than one inside an XDG folder:
# https://github.com/starship/starship/blob/686bda1706e5b409129e6694639477a0f8a3f01b/src/configure.rs#L651
if not test -f "$HOME/.config/starship.toml";
set -q STARSHIP_CONFIG; or set STARSHIP_CONFIG "$HOME/.config/starship.toml"
if not test -f "$STARSHIP_CONFIG"
set -x STARSHIP_CONFIG ${settingsFile}
end
${lib.optionalString (!isNull cfg.transientPrompt.left) ''
@@ -153,7 +154,7 @@ in
# config file. starship appears to use a hardcoded config location
# rather than one inside an XDG folder:
# https://github.com/starship/starship/blob/686bda1706e5b409129e6694639477a0f8a3f01b/src/configure.rs#L651
if [[ ! -f "$HOME/.config/starship.toml" ]]; then
if [[ ! -f "$${STARSHIP_CONFIG:-$HOME/.config/starship.toml}" ]]; then
export STARSHIP_CONFIG=${settingsFile}
fi
eval "$(${cfg.package}/bin/starship init zsh)"
@@ -167,8 +168,11 @@ in
# config file. starship appears to use a hardcoded config location
# rather than one inside an XDG folder:
# https://github.com/starship/starship/blob/686bda1706e5b409129e6694639477a0f8a3f01b/src/configure.rs#L651
if not `$HOME/.config/starship.toml`:
import os as _os
_sc = _os.environ.get('STARSHIP_CONFIG', _os.path.join(_os.environ['HOME'], '.config/starship.toml'))
if not _os.path.isfile(_sc):
$STARSHIP_CONFIG = ('${settingsFile}')
del _os, _sc
execx($(${cfg.package}/bin/starship init xonsh))
'';
};

11
nixos/modules/programs/wayland/niri.nix
View File

@@ -40,6 +40,17 @@ in
systemd.packages = [ cfg.package ];
# Restarting the compositor kills the graphical session; same
# treatment as the display-manager modules.
systemd.user.services.niri = {
restartIfChanged = false;
# Defining the unit here generates a drop-in; without this it
# would carry the NixOS default Environment="PATH=coreutils:…",
# clobbering the PATH that niri-session imported into the user
# manager and breaking spawn actions that rely on it.
enableDefaultPath = false;
};
xdg.portal = {
enable = lib.mkDefault true;

4
nixos/modules/rename.nix
View File

@@ -82,6 +82,10 @@ in
"programs"
"gnome-documents"
] "The corresponding package was removed from nixpkgs.")
(mkRemovedOptionModule [
"programs"
"pqos-wrapper"
] "The corresponding package was removed from nixpkgs.") # added 2026-05-13
(mkRemovedOptionModule
[
"services"

27
nixos/modules/security/acme/default.nix
View File

@@ -441,18 +441,6 @@ let
chown -R ${user}:${data.group} "$fixpath"
fi
done
${lib.optionalString (data.webroot != null) ''
# Ensure the webroot exists. Fixing group is required in case configuration was changed between runs.
# Lego will fail if the webroot does not exist at all.
(
mkdir -p '${data.webroot}/.well-known/acme-challenge' \
&& chgrp '${data.group}' ${data.webroot}/.well-known/acme-challenge
) || (
echo 'Please ensure ${data.webroot}/.well-known/acme-challenge exists and is writable by acme:${data.group}' \
&& exit 1
)
''}
'';
};
@@ -1277,6 +1265,21 @@ in
) (lib.groupBy (conf: conf.accountHash) (lib.attrValues certConfigs));
in
accountTargets;
systemd.tmpfiles.settings."10-acme" =
lib.genAttrs
(lib.concatMap (dir: [
dir
(dir + "/.well-known")
(dir + "/.well-known/acme-challenge")
]) webroots)
(dir: {
"d" = {
inherit user;
group = "acme";
mode = "0755";
};
});
})
];

13
nixos/modules/services/continuous-integration/gitea-actions-runner.nix
View File

@@ -12,6 +12,7 @@ let
attrValues
concatStringsSep
escapeShellArg
getExe
hasInfix
hasSuffix
optionalAttrs
@@ -36,7 +37,7 @@ let
# Check whether any runner instance label requires a container runtime
# Empty label strings result in the upstream defined defaultLabels, which require docker
# https://gitea.com/gitea/act_runner/src/tag/v0.1.5/internal/app/cmd/register.go#L93-L98
# https://gitea.com/gitea/runner/src/tag/v0.1.5/internal/app/cmd/register.go#L93-L98
hasDockerScheme =
instance: instance.labels == [ ] || any (label: hasInfix ":docker:" label) instance.labels;
wantsContainerRuntime = any hasDockerScheme (attrValues cfg.instances);
@@ -53,7 +54,7 @@ let
|| (instance.token != null && instance.tokenFile == null);
in
{
meta.maintainers = [ ];
meta.maintainers = pkgs.gitea-actions-runner.meta.maintainers;
options.services.gitea-actions-runner = with types; {
package = mkPackageOption pkgs "gitea-actions-runner" { };
@@ -123,8 +124,8 @@ in
};
settings = mkOption {
description = ''
Configuration for `act_runner daemon`.
See <https://gitea.com/gitea/act_runner/src/branch/main/internal/pkg/config/config.example.yaml> for an example configuration
Configuration for gitea-runner daemon.
See <https://gitea.com/gitea/runner/src/branch/main/internal/pkg/config/config.example.yaml> for an example configuration
'';
type = types.submodule {
@@ -252,7 +253,7 @@ in
rm -v "$INSTANCE_DIR/.runner" || true
# perform the registration
${cfg.package}/bin/act_runner register --no-interactive \
${getExe cfg.package} register --no-interactive \
--instance ${escapeShellArg instance.url} \
--token "$TOKEN" \
--name ${escapeShellArg instance.name} \
@@ -266,7 +267,7 @@ in
'')
];
ExecStart = "${cfg.package}/bin/act_runner daemon --config ${configFile}";
ExecStart = "${getExe cfg.package} daemon --config ${configFile}";
SupplementaryGroups =
optionals wantsDocker [
"docker"

8
nixos/modules/services/desktops/crossmacro.nix
View File

@@ -64,9 +64,9 @@ in
// {
crossmacro = {
isSystemUser = true;
group = "input";
group = "crossmacro";
extraGroups = [
"crossmacro"
"input"
"uinput"
];
description = "CrossMacro Input Daemon User";
@@ -93,12 +93,12 @@ in
serviceConfig = {
Type = "notify";
User = "crossmacro";
Group = "input";
Group = "crossmacro";
ExecStart = lib.getExe cfg.daemonPackage;
Restart = "always";
RestartSec = 5;
RuntimeDirectory = "crossmacro";
RuntimeDirectoryMode = "0755";
RuntimeDirectoryMode = "0750";
CapabilityBoundingSet = [
"CAP_SYS_ADMIN"
"CAP_SETUID"

133
nixos/modules/services/hardware/keyd.nix
View File

@@ -5,62 +5,67 @@
...
}:
let
inherit (lib) types;
inherit (lib.attrsets) mapAttrs' mapAttrsToList nameValuePair;
inherit (lib.generators) toINI;
inherit (lib.modules) mkDefault mkIf mkRemovedOptionModule;
inherit (lib.options) literalExpression mkEnableOption mkOption;
inherit (lib.strings) concatStringsSep;
cfg = config.services.keyd;
keyboardOptions =
{ ... }:
{
options = {
ids = lib.mkOption {
type = lib.types.listOf lib.types.str;
default = [ "*" ];
example = [
"*"
"-0123:0456"
];
description = ''
Device identifiers, as shown by {manpage}`keyd(1)`.
'';
};
keyboardOptions = {
options = {
ids = mkOption {
type = with types; listOf str;
default = [ "*" ];
example = [
"*"
"-0123:0456"
];
description = ''
Device identifiers, as shown by {manpage}`keyd(1)`.
'';
};
settings = lib.mkOption {
type = (pkgs.formats.ini { }).type;
default = { };
example = {
main = {
capslock = "overload(control, esc)";
rightalt = "layer(rightalt)";
};
rightalt = {
j = "down";
k = "up";
h = "left";
l = "right";
};
settings = mkOption {
inherit (pkgs.formats.ini { }) type;
default = { };
example = {
main = {
capslock = "overload(control, esc)";
rightalt = "layer(rightalt)";
};
description = ''
Configuration, except `ids` section, that is written to {file}`/etc/keyd/<keyboard>.conf`.
Appropriate names can be used to write non-alpha keys, for example "equal" instead of "=" sign (see <https://github.com/NixOS/nixpkgs/issues/236622>).
See <https://github.com/rvaiya/keyd> how to configure.
'';
};
extraConfig = lib.mkOption {
type = lib.types.lines;
default = "";
example = ''
[control+shift]
h = left
'';
description = ''
Extra configuration that is appended to the end of the file.
**Do not** write `ids` section here, use a separate option for it.
You can use this option to define compound layers that must always be defined after the layer they are comprised.
'';
rightalt = {
j = "down";
k = "up";
h = "left";
l = "right";
};
};
description = ''
Configuration, except `ids` section, that is written to {file}`/etc/keyd/<keyboard>.conf`.
Appropriate names can be used to write non-alpha keys, for example "equal" instead of "=" sign (see <https://github.com/NixOS/nixpkgs/issues/236622>).
See <https://github.com/rvaiya/keyd> how to configure.
'';
};
extraConfig = mkOption {
type = types.lines;
default = "";
example = ''
[control+shift]
h = left
'';
description = ''
Extra configuration that is appended to the end of the file.
**Do not** write `ids` section here, use a separate option for it.
You can use this option to define compound layers that must always be defined after the layer they are comprised.
'';
};
};
};
in
{
imports = [
@@ -73,14 +78,14 @@ in
];
options.services.keyd = {
enable = lib.mkEnableOption "keyd, a key remapping daemon";
enable = mkEnableOption "keyd, a key remapping daemon";
package = lib.mkPackageOption pkgs "keyd" { };
keyboards = lib.mkOption {
type = lib.types.attrsOf (lib.types.submodule keyboardOptions);
keyboards = mkOption {
type = with types; attrsOf (submodule keyboardOptions);
default = { };
example = lib.literalExpression ''
example = literalExpression ''
{
default = {
ids = [ "*" ];
@@ -106,22 +111,22 @@ in
};
};
config = lib.mkIf cfg.enable {
config = mkIf cfg.enable {
# Creates separate files in the `/etc/keyd/` directory for each key in the dictionary
environment.etc = lib.mapAttrs' (
environment.etc = mapAttrs' (
name: options:
lib.nameValuePair "keyd/${name}.conf" {
nameValuePair "keyd/${name}.conf" {
text = ''
[ids]
${lib.concatStringsSep "\n" options.ids}
${concatStringsSep "\n" options.ids}
${lib.generators.toINI { } options.settings}
${toINI { } options.settings}
${options.extraConfig}
'';
}
) cfg.keyboards;
hardware.uinput.enable = lib.mkDefault true;
hardware.uinput.enable = mkDefault true;
systemd.services.keyd = {
description = "Keyd remapping daemon";
@@ -129,18 +134,12 @@ in
wantedBy = [ "multi-user.target" ];
restartTriggers = lib.mapAttrsToList (
name: options: config.environment.etc."keyd/${name}.conf".source
restartTriggers = mapAttrsToList (
name: _options: config.environment.etc."keyd/${name}.conf".source
) cfg.keyboards;
# this is configurable in 2.4.2, later versions seem to remove this option.
# post-2.4.2 may need to set makeFlags in the derivation:
#
# makeFlags = [ "SOCKET_PATH/run/keyd/keyd.socket" ];
environment.KEYD_SOCKET = "/run/keyd/keyd.sock";
serviceConfig = {
ExecStart = lib.getExe' cfg.package "keyd";
ExecStart = lib.getExe cfg.package;
Restart = "always";
# TODO investigate why it doesn't work propeprly with DynamicUser

61
nixos/modules/services/hardware/logiops.nix Normal file
View File

@@ -0,0 +1,61 @@
{
config,
lib,
pkgs,
...
}:
let
cfg = config.services.logiops;
configFormat = pkgs.formats.libconfig { };
configFile = configFormat.generate "logid.cfg" cfg.config;
in
{
options = {
services.logiops = {
enable = lib.mkEnableOption "LogiOps, a unofficial userspace driver for HID++ Logitech devices";
package = lib.mkPackageOption pkgs "logiops" { };
config = lib.mkOption {
type = configFormat.type;
default = { };
example = lib.literalExpression ''
devices = [
{
name = "Wireless Mouse MX Master";
dpi = 1000;
smartshift =
{
on = true;
threshold = 30;
torque = 50;
};
}
];
'';
description = ''
The standard libconfig-style config for LogiOps.
'';
};
};
};
config = lib.mkIf cfg.enable {
environment.systemPackages = [ cfg.package ];
services.dbus.packages = [ cfg.package ];
systemd = {
packages = [ cfg.package ];
services.logid = {
wantedBy = [ "graphical.target" ];
serviceConfig.ExecStart = [
""
"${lib.getExe cfg.package} -c ${configFile}"
];
};
};
};
meta.maintainers = with lib.maintainers; [ bokicoder ];
}

3
nixos/modules/services/mail/roundcube.nix
View File

@@ -190,7 +190,6 @@ in
priority = 1100;
extraConfig = ''
add_header Cache-Control 'public, max-age=604800, must-revalidate';
client_max_body_size ${toString cfg.maxAttachmentSize};
'';
};
locations."~ ^/(SQL|bin|config|logs|temp|vendor)/" = {
@@ -213,6 +212,8 @@ in
fastcgi_param PATH_INFO $fastcgi_path_info;
fastcgi_split_path_info ^(.+\.php)(/.+)$;
include ${config.services.nginx.package}/conf/fastcgi.conf;
client_max_body_size ${toString cfg.maxAttachmentSize};
'';
};
};

30
nixos/modules/services/misc/docker-registry.nix
View File

@@ -28,20 +28,6 @@ let
};
};
registryConfig.redis = lib.mkIf cfg.enableRedisCache {
addr = "${cfg.redisUrl}";
password = "${cfg.redisPassword}";
db = 0;
dialtimeout = "10ms";
readtimeout = "10ms";
writetimeout = "10ms";
pool = {
maxidle = 16;
maxactive = 64;
idletimeout = "300s";
};
};
configFile = cfg.configFile;
in
{
@@ -139,6 +125,22 @@ in
};
config = lib.mkIf cfg.enable {
services.dockerRegistry.extraConfig = lib.mkIf cfg.enableRedisCache {
redis = {
addr = "${cfg.redisUrl}";
password = "${cfg.redisPassword}";
db = 0;
dialtimeout = "10ms";
readtimeout = "10ms";
writetimeout = "10ms";
pool = {
maxidle = 16;
maxactive = 64;
idletimeout = "300s";
};
};
};
systemd.services.docker-registry = {
description = "Docker Container Registry";
wantedBy = [ "multi-user.target" ];

1
nixos/modules/services/monitoring/prometheus/exporters.nix
View File

@@ -119,6 +119,7 @@ let
"smartctl"
"smokeping"
"snmp"
"speedtest"
"sql"
"statsd"
"storagebox"

51
nixos/modules/services/monitoring/prometheus/exporters/speedtest.nix Normal file
View File

@@ -0,0 +1,51 @@
{
config,
lib,
pkgs,
...
}:
let
cfg = config.services.prometheus.exporters.speedtest;
inherit (lib)
mkOption
types
concatStringsSep
optionalString
;
in
{
port = 9798;
extraOpts = {
serverID = mkOption {
type = types.int;
default = -1;
description = ''
Speedtest.net server ID to run tests against.
-1 picks the closest server to your location.
'';
};
serverFallback = mkOption {
type = types.bool;
default = false;
description = ''
If the configured serverID is unavailable, fall back to the closest available server.
'';
};
};
serviceOpts = {
serviceConfig = {
ExecStart = ''
${pkgs.prometheus-speedtest-exporter}/bin/speedtest_exporter \
-listen-address ${cfg.listenAddress} \
-port ${toString cfg.port} \
-server_id ${toString cfg.serverID} \
${optionalString cfg.serverFallback "-server_fallback"} \
${concatStringsSep " \\\n " cfg.extraFlags}
'';
};
};
}

15
nixos/modules/services/torrent/transmission.nix
View File

@@ -393,7 +393,6 @@ in
};
serviceConfig = {
Type = "notify";
# Use "+" because credentialsFile may not be accessible to User= or Group=.
ExecStartPre = [
(
@@ -407,7 +406,6 @@ in
)
];
ExecStart = "${cfg.package}/bin/transmission-daemon -f -g ${cfg.home}/${settingsDir} ${escapeShellArgs cfg.extraFlags}";
ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
User = cfg.user;
Group = cfg.group;
# Create rootDir in the host's mount namespace.
@@ -513,7 +511,18 @@ in
"quotactl"
];
SystemCallArchitectures = "native";
};
}
// (
if lib.versionAtLeast cfg.package.version "4.1.1" then
{
Type = "notify-reload";
}
else
{
Type = "notify";
ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
}
);
};
# It's useful to have transmission in path, e.g. for remote control

2
nixos/modules/services/video/motioneye.nix
View File

@@ -15,7 +15,7 @@ in
packages = {
motioneye = lib.mkPackageOption pkgs "motioneye" { };
motion = lib.mkPackageOption pkgs "motion" { };
ffmpeg = lib.mkPackageOption pkgs "ffmpeg" { };
ffmpeg = lib.mkPackageOption pkgs "ffmpeg-headless" { };
};
user = lib.mkOption {

10
nixos/modules/services/web-apps/lasuite-docs.nix
View File

@@ -8,6 +8,7 @@
let
inherit (lib)
getExe
hasAttr
mapAttrs
match
mkEnableOption
@@ -362,6 +363,15 @@ in
config = mkIf cfg.enable {
environment.systemPackages = [ manage ];
# Some settings options in LaSuite has been renamed in 5.0.0
# Show warnings if those settings are not renamed
# TODO: remove it when the retrocompatibility options will be gone
warnings =
(optional (hasAttr "AI_API_KEY" cfg.settings) "AI_API_KEY has been renamed as OPENAI_SDK_API_KEY in LaSuite Docs")
++ (optional (hasAttr "AI_API_KEY_FILE" cfg.settings) "AI_API_KEY_FILE has been renamed as OPENAI_SDK_API_KEY_FILE in LaSuite Docs")
++ (optional (hasAttr "AI_BASE_URL" cfg.settings) "AI_BASE_URL has been renamed as OPENAI_SDK_BASE_URL in LaSuite Docs");
systemd.services.lasuite-docs-postgresql-setup = mkIf cfg.postgresql.createLocally {
wantedBy = [ "lasuite-docs.target" ];
requiredBy = [ "lasuite-docs.service" ];

2
nixos/modules/system/boot/systemd.nix
View File

@@ -143,6 +143,8 @@ let
"final.target"
"kexec.target"
"systemd-kexec.service"
"soft-reboot.target"
"systemd-soft-reboot.service"
]
++ lib.optional cfg.package.withUtmp "systemd-update-utmp.service"
++ [

19
nixos/modules/system/etc/etc-activation.nix
View File

@@ -1,7 +1,6 @@
{
config,
lib,
pkgs,
...
}:
@@ -51,6 +50,9 @@
];
boot.initrd.systemd = {
storePaths = lib.mkIf config.system.etc.overlay.mutable [
"${config.system.nixos-init.package}/bin/clear-etc-opaque"
];
mounts = [
{
where = "/run/nixos-etc-metadata";
@@ -131,13 +133,20 @@
before = [ "initrd-fs.target" ];
unitConfig = {
DefaultDependencies = false;
RequiresMountsFor = "/sysroot";
RequiresMountsFor = [
"/sysroot"
# Needed so we can clear stale opaque markers from the
# upperdir based on the contents of the new metadata layer
# before the overlay is mounted.
"/run/nixos-etc-metadata"
];
};
serviceConfig = {
Type = "oneshot";
ExecStart = ''
/bin/mkdir -p -m 0755 /sysroot/.rw-etc/upper /sysroot/.rw-etc/work
'';
ExecStart = [
"/bin/mkdir -p -m 0755 /sysroot/.rw-etc/upper /sysroot/.rw-etc/work"
"${config.system.nixos-init.package}/bin/clear-etc-opaque /run/nixos-etc-metadata /sysroot/.rw-etc/upper"
];
};
};
})

7
nixos/modules/system/etc/etc.nix
View File

@@ -285,6 +285,13 @@ in
tmpMetadataMount=$(TMPDIR="/run" mktemp --directory -t nixos-etc-metadata.XXXXXXXXXX)
mount --type erofs --options ro,nodev,nosuid ${config.system.build.etcMetadataImage} "$tmpMetadataMount"
${lib.optionalString config.system.etc.overlay.mutable ''
# Clear stale opaque markers from the upperdir so that lowerdir
# entries added by the new generation are not hidden.
# See https://github.com/NixOS/nixpkgs/issues/505475
${config.system.nixos-init.package}/bin/clear-etc-opaque "$tmpMetadataMount" /.rw-etc/upper
''}
# There was no previous /etc mounted. This happens when we're called
# directly without an initrd, like with nixos-enter.
if ! mountpoint -q /etc; then

328
nixos/modules/tasks/network-interfaces-scripted.nix
View File

@@ -51,6 +51,71 @@ let
(lib.concatStringsSep " ")
];
# Converts an IPv4 address literal to a list of bits
parseAddr.ipv4 =
addr:
let
pad = b: lib.replicate (8 - builtins.length b) 0 ++ b;
toBin = n: pad (lib.toBaseDigits 2 (lib.toInt n));
in
lib.concatMap toBin (builtins.splitVersion addr);
# Converts an IPv6 address literal to a list of bits
parseAddr.ipv6 =
addr:
let
pad = b: lib.replicate (16 - builtins.length b) 0 ++ b;
fromHex = n: (builtins.fromTOML "n = 0x${n}").n;
toBin = n: pad (lib.toBaseDigits 2 (fromHex n));
normal = (lib.network.ipv6.fromString addr).address;
in
lib.concatMap toBin (lib.splitString ":" normal);
# Checks if `addr` is part of the `net` subnet
inSubnet =
v: net: addr:
let
prefix = lib.take net.prefixLength (parseAddr.${v} net.address);
match = lib.zipListsWith (a: b: a == b) prefix (parseAddr.${v} addr);
in
lib.all lib.id match;
# Checks if the netmask of all addresses on interface `iface` includes
# the IP address of `gateway`
#
# Note: this is used to check whether networking.defaultGateway relies on
# the given interface, either explicitly, via the `interface` (optional),
# or explicitly, by using an address in a subnet of this interface.
#
# Configuration of the default gateway is then performed as part of that
# interface setup in `configureAddrs`, below.
isGateway =
v: gateway: iface:
lib.any lib.id (
[ (iface.name == gateway.interface) ]
++ map (net: inSubnet v net gateway.address) iface.${v}.addresses
);
# Checks if `gateway` uses an address from `iface` as default source
#
# Note: this is needed to delay the configuration of the gateway and default
# source until the right interfaces and address have been set up, otherwise
# the commands will fail.
hasSource =
v: gateway: iface:
builtins.elem gateway.source (map (i: i.address) iface.${v}.addresses);
# Interfaces corresponding to the default gateways
gateway4Iface = builtins.filter (isGateway "ipv4" cfg.defaultGateway) interfaces;
gateway6Iface = builtins.filter (isGateway "ipv6" cfg.defaultGateway6) interfaces;
# Interfaces corresponding to the default source addresses
#
# Note: the use of `head` here is safe because these expressions
# are evaluated only when `needsSourceIface`, see `configureAddrs` below.
source4Iface = builtins.head (builtins.filter (hasSource "ipv4" cfg.defaultGateway) interfaces);
source6Iface = builtins.head (builtins.filter (hasSource "ipv6" cfg.defaultGateway6) interfaces);
# warn that these attributes are deprecated (2017-2-2)
# Should be removed in the release after next
bondDeprecation = rec {
@@ -118,121 +183,71 @@ let
else
optional (!config.boot.isContainer) (subsystemDevice dev);
hasDefaultGatewaySet =
(cfg.defaultGateway != null && cfg.defaultGateway.address != "")
|| (cfg.enableIPv6 && cfg.defaultGateway6 != null && cfg.defaultGateway6.address != "");
needNetworkSetup =
cfg.resolvconf.enable || cfg.defaultGateway != null || cfg.defaultGateway6 != null;
networkLocalCommands = lib.mkIf needNetworkSetup {
after = [ "network-setup.service" ];
bindsTo = [ "network-setup.service" ];
};
networkSetup = lib.mkIf needNetworkSetup {
description = "Networking Setup";
after = [ "network-pre.target" ];
before = [
"network.target"
"shutdown.target"
];
wants = [ "network.target" ];
# exclude bridges from the partOf relationship to fix container networking bug #47210
partOf = map (i: "network-addresses-${i.name}.service") (
filter (i: !(hasAttr i.name cfg.bridges)) interfaces
);
conflicts = [ "shutdown.target" ];
wantedBy = [ "multi-user.target" ] ++ optional hasDefaultGatewaySet "network-online.target";
unitConfig.ConditionCapability = "CAP_NET_ADMIN";
path = [ pkgs.iproute2 ];
serviceConfig = {
Type = "oneshot";
RemainAfterExit = true;
};
unitConfig.DefaultDependencies = false;
script = ''
${optionalString config.networking.resolvconf.enable ''
# Set the static DNS configuration, if given.
${pkgs.openresolv}/sbin/resolvconf -m 1 -a static <<EOF
${optionalString (cfg.nameservers != [ ] && cfg.domain != null) ''
domain ${cfg.domain}
''}
${optionalString (cfg.search != [ ]) ("search " + concatStringsSep " " cfg.search)}
${flip concatMapStrings cfg.nameservers (ns: ''
nameserver ${ns}
'')}
EOF
''}
# Set the default gateway
${flip concatMapStrings
[
{
version = "-4";
gateway = cfg.defaultGateway;
}
{
version = "-6";
gateway = cfg.defaultGateway6;
}
]
(
{ version, gateway }:
optionalString (gateway != null && gateway.address != "") ''
${optionalString (gateway.interface != null) ''
ip ${version} route replace ${gateway.address} proto static ${
formatIpArgs {
metric = gateway.metric;
dev = gateway.interface;
}
}
''}
ip ${version} route replace default proto static ${
formatIpArgs {
metric = gateway.metric;
via = gateway.address;
window = cfg.defaultGatewayWindowSize;
dev = gateway.interface;
src = gateway.source;
}
}
''
)
}
'';
};
# For each interface <foo>, create a job ‘network-addresses-<foo>.service"
# that performs static address configuration. It has a "wants"
# dependency on ‘<foo>.service’, which is supposed to create
# the interface and need not exist (i.e. for hardware
# interfaces). It has a binds-to dependency on the actual
# network device, so it only gets started after the interface
# has appeared, and it's stopped when the interface
# disappears.
# For each interface <foo>, creates a network-addresses-<foo>.service
# job that performs static address configuration.
#
# It has a Wants dependency on <foo>-netdev.service, which creates
# create the interface, or on a device unit (for hardware interfaces).
# It also has a BindsTo dependency on the device unit: so, it only gets
# started after the interface has appeared and it's stopped when the
# interface disappears.
#
# Unless in a container, the job is not made part of network.target, so
# if an interface is not found (e.g. a USB interface not plugged in) it
# will not hang the boot sequence.
#
# If the interface is the default gateway, the job will also set the
# default gateway and delay network-online.target.
configureAddrs =
i:
let
ips = interfaceIps i;
isDefaultGateway4 = cfg.defaultGateway != null && builtins.elem i gateway4Iface;
isDefaultGateway6 = cfg.defaultGateway6 != null && builtins.elem i gateway6Iface;
needsSourceIface4 =
isDefaultGateway4 && cfg.defaultGateway.source != null && i.name != source4Iface.name;
needsSourceIface6 =
isDefaultGateway6 && cfg.defaultGateway6.source != null && i.name != source6Iface.name;
configureGateway =
version: gateway:
optionalString (gateway.address != "") ''
echo -n "setting ${i.name} as default IPv${version} gateway... "
${optionalString (gateway.interface != null) ''
ip -${version} route replace ${gateway.address} proto static ${
formatIpArgs {
metric = gateway.metric;
dev = gateway.interface;
}
}
''}
ip -${version} route replace default proto static ${
formatIpArgs {
metric = gateway.metric;
via = gateway.address;
window = cfg.defaultGatewayWindowSize;
dev = gateway.interface;
src = gateway.source;
}
}
echo "done"
'';
in
nameValuePair "network-addresses-${i.name}" {
description = "Address configuration of ${i.name}";
wantedBy = [
"network-setup.service"
"network.target"
];
# order before network-setup because the routes that are configured
# there may need ip addresses configured
before = [ "network-setup.service" ];
wantedBy =
deviceDependency i.name
++ optional config.boot.isContainer "network.target"
++ optional (isDefaultGateway4 || isDefaultGateway6) "network-online.target";
bindsTo = deviceDependency i.name;
after = [ "network-pre.target" ] ++ (deviceDependency i.name);
partOf = [ "networking-scripted.target" ];
after = [
"network-pre.target"
]
++ optional needsSourceIface4 "network-addresses-${source4Iface.name}.service"
++ optional needsSourceIface6 "network-addresses-${source6Iface.name}.service"
++ deviceDependency i.name;
serviceConfig.Type = "oneshot";
serviceConfig.RemainAfterExit = true;
# Restart rather than stop+start this unit to prevent the
@@ -284,6 +299,10 @@ let
fi
''
)}
# Set the default gateway
${optionalString isDefaultGateway4 (configureGateway "4" cfg.defaultGateway)}
${optionalString isDefaultGateway6 (configureGateway "6" cfg.defaultGateway6)}
'';
preStop = ''
state="/run/nixos/network/routes/${i.name}"
@@ -311,13 +330,13 @@ let
nameValuePair "${i.name}-netdev" {
description = "Virtual Network Interface ${i.name}";
bindsTo = optional (!config.boot.isContainer) "dev-net-tun.device";
partOf = [ "networking-scripted.target" ];
after = optional (!config.boot.isContainer) "dev-net-tun.device" ++ [ "network-pre.target" ];
wantedBy = [
"network.target"
"network-setup.service"
(subsystemDevice i.name)
];
before = [ "network-setup.service" ];
before = [ "network.target" ];
path = [ pkgs.iproute2 ];
serviceConfig = {
Type = "oneshot";
@@ -343,18 +362,21 @@ let
description = "Bridge Interface ${n}";
wantedBy = [
"network.target"
"network-setup.service"
(subsystemDevice n)
];
bindsTo = deps ++ optional v.rstp "mstpd.service";
partOf = [ "network-setup.service" ] ++ optional v.rstp "mstpd.service";
partOf = [
"network.target"
"networking-scripted.target"
]
++ optional v.rstp "mstpd.service";
after = [
"network-pre.target"
]
++ deps
++ optional v.rstp "mstpd.service"
++ map (i: "network-addresses-${i}.service") v.interfaces;
before = [ "network-setup.service" ];
before = [ "network.target" ];
serviceConfig.Type = "oneshot";
serviceConfig.RemainAfterExit = true;
path = [ pkgs.iproute2 ];
@@ -448,15 +470,14 @@ let
description = "Open vSwitch Interface ${n}";
wantedBy = [
"network.target"
"network-setup.service"
(subsystemDevice n)
]
++ internalConfigs;
# before = [ "network-setup.service" ];
# should work without internalConfigs dependencies because address/link configuration depends
# on the device, which is created by ovs-vswitchd with type=internal, but it does not...
before = [ "network-setup.service" ] ++ internalConfigs;
partOf = [ "network-setup.service" ]; # shutdown the bridge when network is shutdown
before = [ "network.target" ] ++ internalConfigs;
partOf = [
"network.target"
"networking-scripted.target"
]; # shutdown the bridge when network is shutdown
bindsTo = [ "ovs-vswitchd.service" ]; # requires ovs-vswitchd to be alive at all times
after = [
"network-pre.target"
@@ -521,12 +542,12 @@ let
description = "Bond Interface ${n}";
wantedBy = [
"network.target"
"network-setup.service"
(subsystemDevice n)
];
bindsTo = deps;
partOf = [ "networking-scripted.target" ];
after = [ "network-pre.target" ] ++ deps ++ map (i: "network-addresses-${i}.service") v.interfaces;
before = [ "network-setup.service" ];
before = [ "network.target" ];
serviceConfig.Type = "oneshot";
serviceConfig.RemainAfterExit = true;
path = [
@@ -570,12 +591,12 @@ let
description = "MACVLAN Interface ${n}";
wantedBy = [
"network.target"
"network-setup.service"
(subsystemDevice n)
];
bindsTo = deps;
partOf = [ "networking-scripted.target" ];
after = [ "network-pre.target" ] ++ deps;
before = [ "network-setup.service" ];
before = [ "network.target" ];
serviceConfig.Type = "oneshot";
serviceConfig.RemainAfterExit = true;
path = [ pkgs.iproute2 ];
@@ -602,12 +623,12 @@ let
description = "IPVLAN Interface ${n}";
wantedBy = [
"network.target"
"network-setup.service"
(subsystemDevice n)
];
bindsTo = deps;
partOf = [ "networking-scripted.target" ];
after = [ "network-pre.target" ] ++ deps;
before = [ "network-setup.service" ];
before = [ "network.target" ];
serviceConfig.Type = "oneshot";
serviceConfig.RemainAfterExit = true;
path = [ pkgs.iproute2 ];
@@ -647,12 +668,12 @@ let
description = "FOU endpoint ${n}";
wantedBy = [
"network.target"
"network-setup.service"
(subsystemDevice n)
];
bindsTo = deps;
partOf = [ "networking-scripted.target" ];
after = [ "network-pre.target" ] ++ deps;
before = [ "network-setup.service" ];
before = [ "network.target" ];
serviceConfig.Type = "oneshot";
serviceConfig.RemainAfterExit = true;
path = [ pkgs.iproute2 ];
@@ -677,12 +698,11 @@ let
description = "IPv6 in IPv4 Tunnel Interface ${n}";
wantedBy = [
"network.target"
"network-setup.service"
(subsystemDevice n)
];
bindsTo = deps;
after = [ "network-pre.target" ] ++ deps;
before = [ "network-setup.service" ];
before = [ "network.target" ];
serviceConfig.Type = "oneshot";
serviceConfig.RemainAfterExit = true;
path = [ pkgs.iproute2 ];
@@ -720,12 +740,12 @@ let
description = "IP in IP Tunnel Interface ${n}";
wantedBy = [
"network.target"
"network-setup.service"
(subsystemDevice n)
];
bindsTo = deps;
partOf = [ "networking-scripted.target" ];
after = [ "network-pre.target" ] ++ deps;
before = [ "network-setup.service" ];
before = [ "network.target" ];
serviceConfig.Type = "oneshot";
serviceConfig.RemainAfterExit = true;
path = [ pkgs.iproute2 ];
@@ -768,12 +788,12 @@ let
description = "GRE Tunnel Interface ${n}";
wantedBy = [
"network.target"
"network-setup.service"
(subsystemDevice n)
];
bindsTo = deps;
partOf = [ "networking-scripted.target" ];
after = [ "network-pre.target" ] ++ deps;
before = [ "network-setup.service" ];
before = [ "network.target" ];
serviceConfig.Type = "oneshot";
serviceConfig.RemainAfterExit = true;
path = [ pkgs.iproute2 ];
@@ -803,13 +823,15 @@ let
description = "VLAN Interface ${n}";
wantedBy = [
"network.target"
"network-setup.service"
(subsystemDevice n)
];
bindsTo = deps;
partOf = [ "network-setup.service" ];
partOf = [
"network.target"
"networking-scripted.target"
];
after = [ "network-pre.target" ] ++ deps;
before = [ "network-setup.service" ];
before = [ "network.target" ];
serviceConfig.Type = "oneshot";
serviceConfig.RemainAfterExit = true;
path = [ pkgs.iproute2 ];
@@ -845,13 +867,39 @@ let
// mapAttrs' createGreDevice cfg.greTunnels
// mapAttrs' createVlanDevice cfg.vlans
// {
network-setup = networkSetup;
network-local-commands = networkLocalCommands;
network-local-commands = {
after = [ "network-pre.target" ];
wantedBy = [ "network.target" ];
};
};
services.udev.extraRules = ''
KERNEL=="tun", TAG+="systemd"
'';
# Note: the scripted networking backend consistent of many
# independent services that are linked to the network.target.
# Since there is no daemon (e.g systemd-networkd) that is
# started as part of the system and pulls in network.target.
# Thus, to start these services we link network.target directly
# to multi-user.target, this has the same result.
systemd.targets.network.wantedBy = [ "multi-user.target" ];
# This target serves no purpose during the boot, but can be
# used to quickly reset the network configuration by running
# systemctl restart networking-scripted.target
systemd.targets.networking-scripted = {
description = "NixOS scripted networking setup";
};
services.udev.extraRules = lib.concatStringsSep "\n" (
[ ''KERNEL=="tun", TAG+="systemd"'' ]
# This creates a udev rule to start each service with a WantedBy
# dependency on a device unit. It's needed because if the service
# unit is loaded in stage 2 but its device was already up by
# stage 1, systemd will not automatically start it.
++ lib.forEach (lib.attrNames cfg.interfaces) (
iface:
''ACTION=="add", SUBSYSTEM=="net", KERNEL=="${iface}", ''
+ ''ENV{SYSTEMD_WANTS}="network-addresses-${iface}.service"''
)
);
};

21
nixos/modules/tasks/network-interfaces.nix
View File

@@ -747,10 +747,9 @@ in
default = "";
example = "text=anything; echo You can put $text here.";
description = ''
Shell commands to be executed at the end of the
`network-setup` systemd service. Note that if
you are using DHCP to obtain the network configuration,
interfaces may not be fully configured yet.
Shell commands to be executed after all the network
interfaces have been created, but not necessarily
fully configured.
'';
};
@@ -1853,6 +1852,20 @@ in
'';
};
};
networking.localCommands = lib.mkIf config.networking.resolvconf.enable ''
# Set the static DNS configuration, if given.
${pkgs.openresolv}/sbin/resolvconf -m 1 -a static <<EOF
${optionalString (cfg.nameservers != [ ] && cfg.domain != null) ''
domain ${cfg.domain}
''}
${optionalString (cfg.search != [ ]) ("search " + concatStringsSep " " cfg.search)}
${flip concatMapStrings cfg.nameservers (ns: ''
nameserver ${ns}
'')}
EOF
'';
services.mstpd = mkIf needsMstpd { enable = true; };
virtualisation.vswitch = mkIf (cfg.vswitches != { }) { enable = true; };

66
nixos/modules/virtualisation/docker.nix
View File

@@ -157,6 +157,14 @@ in
Whether to periodically prune Docker resources. If enabled, a
systemd timer will run `docker system prune -f`
as specified by the `dates` option.
NOTE: by default this does not prune volumes. Anonymous volumes
can be pruned by passing "--volumes" to [autoPrune.flags](#opt-virtualisation.docker.autoPrune.flags).
To prune all volumes (not just anonymous ones) [`autoPrune.allVolumes.enable`](#opt-virtualisation.docker.autoPrune.allVolumes.enable)
must be used.
See [upstream documentation](https://docs.docker.com/reference/cli/docker/system/prune/#description) for further information.
'';
};
@@ -206,6 +214,28 @@ in
system was powered down.
'';
};
allVolumes = {
enable = mkOption {
type = types.bool;
default = false;
description = ''
Whether to periodically prune all Docker volumes when auto pruning other docker resources
by running {command}`docker volume prune --force --all`
To prune only anonymous volumes, instead pass `--volumes` to `autoPrune.flags`
'';
};
flags = mkOption {
type = types.listOf types.str;
default = [ ];
example = [ "--filter=label=<label>" ];
description = ''
Any additional flags passed to {command}`docker volume prune --force --all`.
'';
};
};
};
package = mkPackageOption pkgs "docker" { };
@@ -312,15 +342,29 @@ in
serviceConfig = {
Type = "oneshot";
ExecStart = utils.escapeSystemdExecArgs (
[
(lib.getExe cfg.package)
"system"
"prune"
"-f"
]
++ cfg.autoPrune.flags
);
ExecStart = [
(utils.escapeSystemdExecArgs (
[
(lib.getExe cfg.package)
"system"
"prune"
"-f"
]
++ cfg.autoPrune.flags
))
]
++ (optionals cfg.autoPrune.allVolumes.enable [
(utils.escapeSystemdExecArgs (
[
(lib.getExe cfg.package)
"volume"
"prune"
"--force"
"--all"
]
++ cfg.autoPrune.allVolumes.flags
))
]);
};
startAt = optional cfg.autoPrune.enable cfg.autoPrune.dates;
@@ -342,6 +386,10 @@ in
-> config.hardware.graphics.enable32Bit or false;
message = "Option enableNvidia on x86_64 requires 32-bit support libraries";
}
{
assertion = cfg.autoPrune.allVolumes.enable -> cfg.autoPrune.enable;
message = "Option autoPrune.allVolumes.enable requires autoPrune.enable";
}
];
virtualisation.docker.daemon.settings = {

2
nixos/modules/virtualisation/nspawn-container/default.nix
View File

@@ -21,8 +21,6 @@ let
cfg = config.virtualisation;
in
{
imports = [ ../guest-networking-options.nix ];
options = {
virtualisation.cmdline = lib.mkOption {

1
nixos/modules/virtualisation/qemu-vm.nix
View File

@@ -399,7 +399,6 @@ in
imports = [
../profiles/qemu-guest.nix
./disk-size-option.nix
./guest-networking-options.nix
(mkRenamedOptionModule
[
"virtualisation"

40
nixos/tests/activation/etc-overlay-mutable.nix
View File

@@ -27,6 +27,12 @@
specialisation.new-generation.configuration = {
environment.etc."newgen".text = "newgen";
# Regression test for https://github.com/NixOS/nixpkgs/issues/505475:
# A symlink in a subdirectory that does not exist in the base generation's
# lowerdir. If something creates that subdirectory at runtime before
# switching (e.g. stage-2-init.sh creating /etc/nixos), overlayfs makes it
# opaque, hiding lowerdir content added by the new generation.
environment.etc."nixos/newlink".source = pkgs.emptyDirectory;
};
specialisation.newer-generation.configuration = {
environment.etc."newergen".text = "newergen";
@@ -53,6 +59,13 @@
machine.succeed("stat --format '%F' /etc/modetest2 | tee /dev/stderr | grep -Eq '^regular file$'")
machine.succeed("stat --format '%a' /etc/modetest2 | tee /dev/stderr | grep -Eq '^300$'")
with subtest("/etc/nixos created by stage-2-init is opaque in upperdir"):
# stage-2-init.sh unconditionally runs `install -d /etc/nixos`. Since
# /nixos is not in the lowerdir, overlayfs creates it as an opaque dir
# in the upperdir. Verify this precondition for the regression test below.
machine.succeed("test -d /.rw-etc/upper/nixos")
print(machine.succeed("getfattr -h -d -m 'trusted.overlay' /.rw-etc/upper/nixos 2>&1 || true"))
with subtest("switching to the same generation"):
machine.succeed("/run/current-system/bin/switch-to-configuration test")
@@ -77,6 +90,15 @@
assert machine.succeed("cat /etc/newgen") == "newgen"
assert machine.succeed("cat /etc/mutable") == "mutable"
# Regression test for https://github.com/NixOS/nixpkgs/issues/505475:
# The opaque /etc/nixos in the upperdir (created by stage-2-init.sh
# before /nixos existed in the lowerdir) must not hide lowerdir entries
# added by the new generation. The activation script must have cleared
# the stale opaque marker.
print(machine.succeed("ls -la /etc/nixos/"))
machine.succeed("test -L /etc/nixos/newlink")
machine.fail("getfattr -h -n trusted.overlay.opaque /.rw-etc/upper/nixos")
print(machine.succeed("findmnt /etc/mountpoint"))
print(machine.succeed("stat /etc/mountpoint/extra-file"))
print(machine.succeed("findmnt /etc/filemount"))
@@ -93,5 +115,23 @@
numOfMetaMounts = len(metaMounts.splitlines())
assert numOfTmpMounts == 0, f"Found {numOfTmpMounts} remaining tmpmounts"
assert numOfMetaMounts == 1, f"Found {numOfMetaMounts} remaining metamounts"
with subtest("stale opaque markers are cleared by initrd on boot (NixOS/nixpkgs#505475)"):
# Simulate the bug precondition: an opaque /pam.d in the upperdir.
# /pam.d is guaranteed to exist as a directory in the metadata layer.
machine.succeed("mkdir -p /.rw-etc/upper/pam.d")
machine.succeed("setfattr -h -n trusted.overlay.opaque -v y /.rw-etc/upper/pam.d")
machine.succeed("getfattr -h -n trusted.overlay.opaque /.rw-etc/upper/pam.d")
# Also create a non-opaque upperdir directory that exists in the
# metadata layer, to ensure clear-etc-opaque tolerates the
# already-clear case.
machine.succeed("mkdir -p /.rw-etc/upper/systemd")
# Reboot and verify the initrd rw-etc service cleared the opaque marker.
machine.shutdown()
machine.start()
machine.wait_for_unit("multi-user.target")
machine.fail("getfattr -h -n trusted.overlay.opaque /.rw-etc/upper/pam.d")
machine.succeed("test -e /etc/pam.d/login")
'';
}

1
nixos/tests/all-tests.nix
View File

@@ -468,6 +468,7 @@ in
dnsdist = import ./dnsdist.nix { inherit pkgs runTest; };
doas = runTest ./doas.nix;
docker = runTestOn [ "aarch64-linux" "x86_64-linux" ] ./docker.nix;
docker-autoprune = runTestOn [ "aarch64-linux" "x86_64-linux" ] ./docker-autoprune.nix;
docker-registry = runTest ./docker-registry.nix;
docker-rootless = runTestOn [ "aarch64-linux" "x86_64-linux" ] ./docker-rootless.nix;
docker-tools = runTestOn [ "x86_64-linux" ] ./docker-tools.nix;

3
nixos/tests/benchexec.nix
View File

@@ -43,7 +43,8 @@ in
--debug \
--read-only-dir / \
--hidden-dir /home \
'${test}' \
--no-container \
-- '${test}' \
'''')
benchexec.succeed("grep -s '${echo}' ${wd}/output.log")
benchexec.succeed("test \"$(grep -Ec '((start|wall|cpu)time|memory)=' ${stdout})\" = 4")

4
nixos/tests/caddy.nix
View File

@@ -72,8 +72,8 @@
specialisation.with-plugins.configuration = {
services.caddy = {
package = pkgs.caddy.withPlugins {
plugins = [ "github.com/caddyserver/replace-response@v0.0.0-20241211194404-3865845790a7" ];
hash = "sha256-Quib7+jFf2ElS4yvrJhuLiedX3lBNwxpEDskxxyVu+8=";
plugins = [ "github.com/caddyserver/replace-response@v0.0.0-20250618171559-80962887e4c6" ];
hash = "sha256-kKWXpxEAn23yud8tcgw7FFOaxLjoodZ/cuM1239TRoY=";
};
configFile = pkgs.writeText "Caddyfile" ''
{

57
nixos/tests/docker-autoprune.nix Normal file
View File

@@ -0,0 +1,57 @@
# This test validates the docker autoprune service, testing whether
# the default configuration cleans up images, while leaving volumes intact
# and whether the allVolumes option enables cleaning up volumes as well
{ pkgs, ... }:
{
name = "docker";
nodes = {
prune =
{ pkgs, ... }:
{
virtualisation.docker = {
enable = true;
package = pkgs.docker;
autoPrune = {
enable = true;
};
};
};
prunevolumes =
{ pkgs, ... }:
{
virtualisation.docker = {
enable = true;
package = pkgs.docker;
autoPrune = {
enable = true;
allVolumes.enable = true;
};
};
};
};
testScript = ''
start_all()
with subtest("Check whether autoPrune works. Volumes should be left unpruned."):
prune.wait_for_unit("sockets.target")
prune.succeed("docker network create testnetwork")
prune.succeed("docker network list --format json | grep testnetwork")
prune.succeed("docker volume create testvolume")
prune.succeed("docker volume list --format json | grep testvolume")
prune.succeed("systemctl start -v docker-prune")
prune.fail("docker network list --format json | grep testnetwork")
# the volume has been left alone
prune.succeed("docker volume list --format json | grep testvolume")
with subtest("Check whether autoPrune including volumes works"):
prunevolumes.wait_for_unit("sockets.target")
prunevolumes.succeed("docker volume create testvolume")
prunevolumes.succeed("docker volume list --format json | grep testvolume")
prunevolumes.succeed("systemctl start -v docker-prune")
prunevolumes.fail("docker volume list --format json | grep testvolume")
'';
}

2
nixos/tests/docker-registry.nix
View File

@@ -53,7 +53,7 @@
client2.succeed("docker images | grep scratch")
client2.succeed(
"curl -fsS -X DELETE registry:8080/v2/scratch/manifests/$(curl -fsS -I -H\"Accept: application/vnd.docker.distribution.manifest.v2+json\" registry:8080/v2/scratch/manifests/latest | grep Docker-Content-Digest | sed -e 's/Docker-Content-Digest: //' | tr -d '\\r')"
"curl -fsS -X DELETE registry:8080/v2/scratch/manifests/$(curl -fsS -I -H\"Accept: application/vnd.oci.image.manifest.v1+json\" registry:8080/v2/scratch/manifests/latest | grep Docker-Content-Digest | sed -e 's/Docker-Content-Digest: //' | tr -d '\\r')"
)
registry.systemctl("start docker-registry-garbage-collect.service")

47
nixos/tests/networking/networkd-and-scripted.nix
View File

@@ -44,17 +44,13 @@ let
defaultGateway6 = {
address = "fd00:1234:5678:1::1";
interface = "enp1s0";
source = "fd00:1234:5678:1::3";
source = "fd00:1234:5678:1::3"; # implicit dependency on enp2s0
};
interfaces.enp1s0.ipv6.addresses = [
{
address = "fd00:1234:5678:1::2";
prefixLength = 64;
}
{
address = "fd00:1234:5678:1::3";
prefixLength = 128;
}
];
interfaces.enp1s0.ipv4.addresses = [
{
@@ -76,6 +72,12 @@ let
prefixLength = 24;
}
];
interfaces.enp2s0.ipv6.addresses = [
{
address = "fd00:1234:5678:1::3";
prefixLength = 128;
}
];
};
};
testScript = ''
@@ -108,6 +110,41 @@ let
client.succeed("ip -6 route show default | grep -q 'src fd00:1234:5678:1::3'")
'';
};
dynamicInterface = {
name = "dynamicInterface";
nodes.machine = clientConfig {
networking.interfaces.usb0 = {
ipv6.addresses = lib.singleton {
address = "fd::1";
prefixLength = 127;
};
};
networking.defaultGateway6 = {
address = "fd::";
interface = "usb0";
source = "fd::1";
};
};
testScript = ''
with subtest("Network comes up without usb0"):
machine.wait_for_unit("network.target")
with subtest("multi-user.target does not hang"):
machine.require_unit_state("multi-user.target", "active")
with subtest("usb0 is configured when plugged in"):
machine.succeed("ip link add usb0 type sit local 1.2.3.4")
machine.wait_until_succeeds("ip addr show dev usb0 | grep -q fd::1")
with subtest("Network is now online"):
machine.systemctl("start network-online.target")
machine.require_unit_state("network-online.target", "active")
with subtest("Default gateway is now set"):
machine.succeed("ip -6 route show default | grep -q 'via fd::'")
machine.succeed("ip -6 route show default | grep -q 'src fd::1'")
'';
};
routeType = {
name = "RouteType";
nodes.client = clientConfig {

6
nixos/tests/nginx-etag.nix
View File

@@ -53,14 +53,18 @@
}
''
import os
import shutil
import time
from selenium.webdriver import Firefox
from selenium.webdriver.firefox.options import Options
from selenium.webdriver.firefox.service import Service
service = Service(shutil.which("geckodriver"))
options = Options()
options.add_argument('--headless')
driver = Firefox(options=options)
driver = Firefox(options=options, service=service)
driver.implicitly_wait(20)
driver.get('http://server/')

148
nixos/tests/spire.nix
View File

@@ -54,6 +54,66 @@ let
};
users.groups.workload = { };
};
tpmAgent =
{ pkgs, lib, ... }:
{
imports = [ agent ];
virtualisation = {
useEFIBoot = true;
tpm = {
enable = true;
# Provision the swtpm with an EK certificate signed by testCA so that
# the SPIRE server can verify the agent's identity.
provisioning = ''
export PATH=${
lib.makeBinPath [
pkgs.openssl
pkgs.tpm2-tools
]
}:$PATH
tpm2_createek -G rsa -u ek.pub -c ek.ctx -f pem
openssl x509 \
-extfile ${ekSignConf} \
-new -days 365 \
-subj "/CN=swtpm-ekcert" \
-extensions tpm_policy \
-CA ${./tpm-ek/ca.crt} -CAkey ${./tpm-ek/ca.priv} \
-out ekcert.der -outform der \
-force_pubkey ek.pub
tpm2_nvdefine 0x01c00002 \
-C o \
-a "ownerread|policyread|policywrite|ownerwrite|authread|authwrite" \
-s "$(wc -c < ekcert.der)"
tpm2_nvwrite 0x01c00002 -C o -i ekcert.der
'';
};
};
environment.systemPackages = [ pkgs.spire-tpm-plugin ];
services.spire.agent = {
enable = true;
settings = {
agent = {
trust_domain = trustDomain;
server_address = "server.${trustDomain}";
trust_bundle_format = "pem";
trust_bundle_path = "$CREDENTIALS_DIRECTORY/spire.trust_bundle";
};
plugins = {
KeyManager.memory.plugin_data = { };
NodeAttestor.tpm.plugin_data = { };
WorkloadAttestor.systemd.plugin_data = { };
WorkloadAttestor.unix.plugin_data = { };
};
};
};
};
in
{
name = "spire";
@@ -108,65 +168,8 @@ in
};
};
tpmAgent =
{ pkgs, lib, ... }:
{
imports = [ agent ];
virtualisation = {
useEFIBoot = true;
tpm = {
enable = true;
# Provision the swtpm with an EK certificate signed by testCA so that
# the SPIRE server can verify the agent's identity.
provisioning = ''
export PATH=${
lib.makeBinPath [
pkgs.openssl
pkgs.tpm2-tools
]
}:$PATH
tpm2_createek -G rsa -u ek.pub -c ek.ctx -f pem
openssl x509 \
-extfile ${ekSignConf} \
-new -days 365 \
-subj "/CN=swtpm-ekcert" \
-extensions tpm_policy \
-CA ${./tpm-ek/ca.crt} -CAkey ${./tpm-ek/ca.priv} \
-out ekcert.der -outform der \
-force_pubkey ek.pub
tpm2_nvdefine 0x01c00002 \
-C o \
-a "ownerread|policyread|policywrite|ownerwrite|authread|authwrite" \
-s "$(wc -c < ekcert.der)"
tpm2_nvwrite 0x01c00002 -C o -i ekcert.der
'';
};
};
environment.systemPackages = [ pkgs.spire-tpm-plugin ];
services.spire.agent = {
enable = true;
settings = {
agent = {
trust_domain = trustDomain;
server_address = "server.${trustDomain}";
trust_bundle_format = "pem";
trust_bundle_path = "$CREDENTIALS_DIRECTORY/spire.trust_bundle";
};
plugins = {
KeyManager.memory.plugin_data = { };
NodeAttestor.tpm.plugin_data = { };
WorkloadAttestor.systemd.plugin_data = { };
WorkloadAttestor.unix.plugin_data = { };
};
};
};
};
tpmAgent = tpmAgent;
tpmSelectorAgent = tpmAgent;
};
testScript =
@@ -175,8 +178,6 @@ in
adminSocket = nodes.server.services.spire.server.settings.server.socket_path;
in
''
spiffe_id = "spiffe://${trustDomain}/service/backdoor"
def provision_trust_bundle(agent):
# TODO: instead of trust bundle to talk to the spire-server, use an upstream CA?
bundle = server.succeed("spire-server bundle show -socketPath ${adminSocket}")
@@ -197,28 +198,34 @@ in
return f"spiffe://${trustDomain}/spire/agent/tpm/{ek_hash}"
def provision_tpm_selector(agent):
agent.wait_for_unit("tpm2.target")
alias_id = "spiffe://${trustDomain}/aliased-agent/tpm-model"
register_entry("spiffe://${trustDomain}/spire/server", "tpm:model:ST33HTPHAHD4", alias_id)
return alias_id
def register_entry(parent_id, selector, spiffe_id):
server.succeed(f"spire-server entry create -socketPath ${adminSocket} -selector '{selector}' -parentID '{parent_id}' -spiffeID '{spiffe_id}'")
def test_agent(name, agent_node, provision_fn):
workload_spiffe_id = f"spiffe://${trustDomain}/{name}/workload"
with subtest(f"Setup SPIRE agent with {name} attestation"):
provision_trust_bundle(agent_node)
parent_id = provision_fn(agent_node)
register_entry(parent_id, "systemd:id:backdoor.service", spiffe_id)
register_entry(parent_id, "unix:user:workload", "spiffe://${trustDomain}/workload")
register_entry(parent_id, "unix:user:workload", workload_spiffe_id)
agent_node.wait_for_unit("spire-agent.service")
agent_node.wait_until_succeeds("spire-agent healthcheck -socketPath $SPIFFE_ENDPOINT_SOCKET", timeout=90)
with subtest(f"Test certificate authentication from {name} agent"):
agent_node.wait_until_succeeds("spire-agent api fetch x509 -socketPath $SPIFFE_ENDPOINT_SOCKET -write .")
with subtest(f"Workload running as non-root, non-spire-agent user can reach Workload API ({name})"):
# SPIRE's security model relies on workload attestation, not unix
# permissions on the socket. Verify an unrelated user can connect.
agent_node.wait_until_succeeds(
with subtest(f"Workload user receives the {name} workload SVID"):
# Each agent node is fresh, so fetch returns "no identity issued"
# (non-zero) until exactly this entry's SVID is cached — content-aware
# retry isn't needed.
output = agent_node.wait_until_succeeds(
"su -s /bin/sh workload -c "
"'spire-agent api fetch x509 -socketPath \"$SPIFFE_ENDPOINT_SOCKET\"'"
)
# TODO: Add something to communicate with
t.assertIn(workload_spiffe_id, output)
with subtest("SPIRE server startup and health checks"):
@@ -228,6 +235,7 @@ in
test_agent("join_token", agent, provision_join_token)
test_agent("tpm", tpmAgent, provision_tpm)
test_agent("tpm-selector", tpmSelectorAgent, provision_tpm_selector)
'';
}

116
nixos/tests/tor.nix
View File

@@ -87,24 +87,42 @@ let
# Pre-generate keys for all directory authorities
daKeysets = lib.genAttrs daNames mkDAKeys;
# Read a fingerprint text file from a derivation output
readFP = keys: file: builtins.readFile "${keys}/${file}";
# Script that writes /run/tor/dirauth.conf by reading the DA fingerprints
# from the pre-generated key derivations at runtime. The ${daKeysets.<name>}
# interpolations resolve to store-path strings at evaluation time (the
# derivations become build dependencies of the node closure), but their
# contents are only read when the script runs on the VM, so no
# import-from-derivation is required.
#
# Written into /run/tor (tor's RuntimeDirectory, which systemd bind-mounts
# into the service's chroot at RootDirectory=/run/tor/root) so that tor
# can read the file despite ProtectSystem=strict.
torDirAuthExecStartPre = pkgs.writeShellScript "tor-dirauth-conf" ''
set -eu
{
${lib.concatMapStringsSep "\n" (name: ''
printf 'DirAuthority %s orport=9001 ipv6=[%s]:9001 v3ident=%s %s:80 %s\n' \
${name} \
'${nodeIPv6 name}' \
"$(tr -d '\n' < ${daKeysets.${name}}/v3ident)" \
'${nodeIP name}' \
"$(tr -d '\n' < ${daKeysets.${name}}/relay-fingerprint)"
'') daNames}
} > /run/tor/dirauth.conf
chown tor:tor /run/tor/dirauth.conf
chmod 0400 /run/tor/dirauth.conf
'';
# Build DirAuthority lines from the pre-generated keys.
# Format: nickname orport=PORT v3ident=V3IDENT ip:dirport RELAY_FINGERPRINT
dirAuthorityLines = lib.mapAttrsToList (
name: keys:
"${name} orport=9001 ipv6=[${nodeIPv6 name}]:9001 v3ident=${readFP keys "v3ident"} ${nodeIP name}:80 ${readFP keys "relay-fingerprint"}"
) daKeysets;
# Tor settings shared by all node types
# Tor settings shared by all node types. DirAuthority lines are loaded
# from /run/tor/dirauth.conf, written by torDirAuthExecStartPre before
# tor starts.
commonTorSettings = {
TestingTorNetwork = true;
AssumeReachable = true;
AssumeReachableIPv6 = true;
ControlPort = 9051;
CookieAuthentication = true;
DirAuthority = dirAuthorityLines;
"%include" = "/run/tor/dirauth.conf";
};
# Tor settings shared by non-DA nodes (relays and exits)
@@ -277,8 +295,10 @@ let
};
};
# Arti configuration
artiConfig = (pkgs.formats.toml { }).generate "arti.toml" {
# Arti configuration - static parts only. The tor_network section
# embeds fingerprints from the DA key derivations, so it is generated
# at service startup instead (see artiNetworkConfigScript) to avoid IFD.
artiStaticConfig = (pkgs.formats.toml { }).generate "arti.toml" {
proxy.socks_listen = 9150;
storage = {
@@ -308,34 +328,36 @@ let
guard-min-filtered-sample-size = 2;
guard-n-primary-guards-to-use = 2;
};
tor_network = {
authorities = {
v3idents = lib.mapAttrsToList (_: keys: readFP keys "v3ident") daKeysets;
uploads = lib.mapAttrsToList (name: _: [
"${nodeIP name}:80"
"[${nodeIPv6 name}]:80"
]) daKeysets;
downloads = lib.mapAttrsToList (name: _: [
"${nodeIP name}:80"
"[${nodeIPv6 name}]:80"
]) daKeysets;
votes = lib.mapAttrsToList (name: _: [
"${nodeIP name}:80"
"[${nodeIPv6 name}]:80"
]) daKeysets;
};
fallback_caches = lib.mapAttrsToList (name: keys: {
rsa_identity = readFP keys "relay-fingerprint";
ed_identity = readFP keys "ed25519-identity";
orports = [
"${nodeIP name}:9001"
"[${nodeIPv6 name}]:9001"
];
}) daKeysets;
};
};
# Emit the tor_network section of the arti config at service startup,
# reading fingerprints from the DA key derivations at runtime. The
# ${daKeysets.<name>} interpolations resolve to store paths at
# evaluation time (build dependencies), but their contents are only
# read by the shell when the script runs - no import-from-derivation.
artiNetworkConfigScript = pkgs.writeShellScript "arti-network-config" ''
set -eu
out=/run/arti/network.toml
daIpPorts='[["${nodeIP "da1"}:80", "[${nodeIPv6 "da1"}]:80"], ["${nodeIP "da2"}:80", "[${nodeIPv6 "da2"}]:80"], ["${nodeIP "da3"}:80", "[${nodeIPv6 "da3"}]:80"]]'
{
echo '[tor_network.authorities]'
printf 'v3idents = ["%s", "%s", "%s"]\n' \
"$(tr -d '\n' < ${daKeysets.da1}/v3ident)" \
"$(tr -d '\n' < ${daKeysets.da2}/v3ident)" \
"$(tr -d '\n' < ${daKeysets.da3}/v3ident)"
echo "uploads = $daIpPorts"
echo "downloads = $daIpPorts"
echo "votes = $daIpPorts"
${lib.concatMapStringsSep "\n" (name: ''
echo
echo '[[tor_network.fallback_caches]]'
printf 'rsa_identity = "%s"\n' "$(tr -d '\n' < ${daKeysets.${name}}/relay-fingerprint)"
printf 'ed_identity = "%s"\n' "$(tr -d '\n' < ${daKeysets.${name}}/ed25519-identity)"
echo 'orports = ["${nodeIP name}:9001", "[${nodeIPv6 name}]:9001"]'
'') daNames}
} > "$out"
'';
# Arti client node
mkArtiClientNode = {
environment.systemPackages = [ pkgs.curl ];
@@ -347,7 +369,9 @@ let
wantedBy = [ "multi-user.target" ];
serviceConfig = {
ExecStart = "${lib.getExe pkgs.arti} proxy -c ${artiConfig}";
RuntimeDirectory = "arti";
ExecStartPre = artiNetworkConfigScript;
ExecStart = "${lib.getExe pkgs.arti} proxy -c ${artiStaticConfig} -c /run/arti/network.toml";
DynamicUser = true;
StateDirectory = "arti";
CacheDirectory = "arti";
@@ -359,6 +383,18 @@ in
name = "tor";
meta.maintainers = with lib.maintainers; [ jpds ];
defaults =
{ config, ... }:
lib.mkIf config.services.tor.enable {
# Generate /run/tor/dirauth.conf before tor's own `--verify-config`
# ExecStartPre runs. The `+` prefix makes this run as root in the
# full system context so it can write into tor's RuntimeDirectory
# and chown the file to tor:tor.
systemd.services.tor.serviceConfig.ExecStartPre = lib.mkBefore [
"+${torDirAuthExecStartPre}"
];
};
nodes =
lib.genAttrs daNames mkDANode
// lib.genAttrs relayNames mkRelayNode

25
nixos/tests/zfs.nix
View File

@@ -226,8 +226,29 @@ in
enableSystemdStage1 = true;
};
installerBoot = (import ./installer.nix { inherit system; }).separateBootZfs;
installer = (import ./installer.nix { inherit system; }).zfsroot;
installerBoot =
(import ./installer.nix {
inherit system;
systemdStage1 = false;
}).separateBootZfs;
installer =
(import ./installer.nix {
inherit system;
systemdStage1 = false;
}).zfsroot;
installerBootWithSystemdStage1 =
(import ./installer.nix {
inherit system;
systemdStage1 = true;
}).separateBootZfs;
installerWithSystemdStage1 =
(import ./installer.nix {
inherit system;
systemdStage1 = true;
}).zfsroot;
expand-partitions = makeTest {
name = "multi-disk-zfs";

2
nixos/tests/zoom-us.nix
View File

@@ -14,5 +14,7 @@
machine.wait_for_x()
machine.execute("zoom >&2 &")
machine.wait_for_window("Zoom Workplace")
machine.sleep(20)
machine.wait_for_window("Zoom Workplace")
'';
}

1
pkgs/applications/editors/vim/plugins/aliases.nix
View File

@@ -69,6 +69,7 @@ mapAliases (
sparkup = throw "'vimPlugins.sparkup' was removed: the upstream repository got deleted"; # Added 2025-08-06
syntax-tree-surfer = throw "'vimPlugins.syntax-tree-surfer' has been archived"; # Added 2025-12-18
todo-nvim = throw "'vimPlugins.todo-nvim' has been removed: abandoned by upstream"; # Added 2023-08-23
vim-csharp = throw "'vimPlugins.vim-csharp' has been removed: repository deleted"; # Added 2026-05-12
vim-sourcetrail = throw "'vimPlugins.vim-sourcetrail' has been removed: abandoned by upstream"; # Added 2022-08-14
# keep-sorted end
}

754
pkgs/applications/editors/vim/plugins/generated.nix
View File

File diff suppressed because it is too large Load Diff

4
pkgs/applications/editors/vim/plugins/nvim-treesitter/overrides.nix
View File

@@ -37,8 +37,8 @@ let
}
''
mkdir -p "$out/queries"
if [ -d "${super.nvim-treesitter.src}/runtime/queries/${language}" ]; then
ln -s "${super.nvim-treesitter.src}/runtime/queries/${language}" "$out/queries/${language}"
if [ -d "${self.nvim-treesitter}/runtime/queries/${language}" ]; then
ln -s "${self.nvim-treesitter}/runtime/queries/${language}" "$out/queries/${language}"
else
echo "Error: there are no queries for ${language}."
exit 1

1
pkgs/applications/editors/vim/plugins/overrides.nix
View File

@@ -1352,6 +1352,7 @@ assertNoAdditions {
# Pickers, can use telescope, fzf-lua, or snacks
fzf-lua
telescope-nvim
neotest
];
};

5
pkgs/applications/editors/vim/plugins/vim-plugin-names
View File

@@ -552,7 +552,7 @@ https://github.com/Darazaki/indent-o-matic/,,
https://github.com/arsham/indent-tools.nvim/,,
https://github.com/Yggdroot/indentLine/,,
https://github.com/ciaranm/inkpot/,,
https://github.com/MysticalDevil/inlay-hints/,,
https://github.com/MysticalDevil/inlay-hints.nvim/,,
https://github.com/jbyuki/instant.nvim/,,
https://github.com/pta2002/intellitab.nvim/,,
https://github.com/parsonsmatt/intero-neovim/,,
@@ -1418,7 +1418,6 @@ https://github.com/octol/vim-cpp-enhanced-highlight/,,
https://github.com/mhinz/vim-crates/,,
https://github.com/vim-crystal/vim-crystal/,,
https://github.com/rbong/vim-crystalline/,,
https://github.com/OrangeT/vim-csharp/,,
https://github.com/ap/vim-css-color/,,
https://github.com/cue-lang/vim-cue/,,
https://github.com/itchyny/vim-cursorword/,,
@@ -1634,7 +1633,7 @@ https://github.com/justinj/vim-pico8-syntax/,,
https://github.com/junegunn/vim-plug/,,
https://github.com/powerman/vim-plugin-AnsiEsc/,,
https://github.com/hasundue/vim-pluto/,,
https://github.com/sheerun/vim-polyglot/,,
https://github.com/vim-polyglot/vim-polyglot/,,
https://github.com/jmcomets/vim-pony/,,
https://github.com/haya14busa/vim-poweryank/,,
https://github.com/prettier/vim-prettier/,,

10
pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix
View File

@@ -21,26 +21,26 @@ vscode-utils.buildVscodeMarketplaceExtension (finalAttrs: {
sources = {
"x86_64-linux" = {
arch = "linux-x64";
hash = "sha256-6mLUxHFQOlDRsNrmS8HoczrxhBxKMnku47SZzLCW87k=";
hash = "sha256-av844ENiMjenpHu5HOFHotAZ2OcZETpuxhfrKW/GYRk=";
};
"aarch64-linux" = {
arch = "linux-arm64";
hash = "sha256-x5HBuPHDH81gXoCAA0UhsyDfKmq37C7FauAMDTXsVv0=";
hash = "sha256-LKGZ2TWJWVhn2D6NmQFszB3B/kf3FJd6+PR6ZZ2r1Hc=";
};
"x86_64-darwin" = {
arch = "darwin-x64";
hash = "sha256-geBnM2AmZPSmxF6uHGNysRM7ujx3tluda6yYW5nzaXQ=";
hash = "sha256-n/wWN6SeRPUTX2X/0eXDRUy4UM0nYT3Yk8gVxy4wyXc=";
};
"aarch64-darwin" = {
arch = "darwin-arm64";
hash = "sha256-13LvDqpmzYmRi2EugJH1t7h6azzGcJAusOSMXcnXC40=";
hash = "sha256-oW16SY7D7q6/3PyWSBz04/JU1T8x6DnIkTe3+T/RSzY=";
};
};
in
{
name = "claude-code";
publisher = "anthropic";
version = "2.1.138";
version = "2.1.140";
}
// sources.${stdenvNoCC.hostPlatform.system}
or (throw "Unsupported system ${stdenvNoCC.hostPlatform.system}");

50
pkgs/applications/editors/vscode/extensions/default.nix
View File

@@ -365,8 +365,8 @@ let
mktplcRef = {
name = "nix-env-selector";
publisher = "arrterian";
version = "1.2.0";
hash = "sha256-dvJmBoljMNS7I7c1DicIWW0t4GQvBFF9jAz2Z2v4lXw=";
version = "1.3.1";
hash = "sha256-dV1FkAOZkWgqlk6j6ppQSUz5N3AoGTPgPkep60gGeP8=";
};
meta = {
license = lib.licenses.mit;
@@ -1007,8 +1007,8 @@ let
mktplcRef = {
name = "coder-remote";
publisher = "coder";
version = "1.14.3";
hash = "sha256-W4VciZMvVtRcCibJP5UGTlHCrdF/AF167xlLvZs5BB4=";
version = "1.14.5";
hash = "sha256-08GsGOtgLhq5vLpQ9VDdVk/q5VSW6d7cXXflNQOpB50=";
};
meta = {
description = "Extension for Visual Studio Code to open any Coder workspace in VS Code with a single click";
@@ -1204,8 +1204,8 @@ let
mktplcRef = {
name = "dart-code";
publisher = "dart-code";
version = "3.132.0";
hash = "sha256-AWzHCg6N//+RmQ1I3Qq4c8Kk+e3gZpeqK9yWB8kfl6w=";
version = "3.134.0";
hash = "sha256-/tWH2uGfOuyvF8mfga2YdGK1ok2UYQchaOeCC2n+IHk=";
};
meta.license = lib.licenses.mit;
@@ -1215,8 +1215,8 @@ let
mktplcRef = {
name = "flutter";
publisher = "dart-code";
version = "3.132.0";
hash = "sha256-2R9SwNaJBKv39JLRy0IFm6/0J8Izj2DlEAat+yigIFk=";
version = "3.134.0";
hash = "sha256-wWANxBh9Tg3VkfbcrR0NgOIC8cpeZJCNfOevT7E4zKY=";
};
meta.license = lib.licenses.mit;
@@ -1260,8 +1260,8 @@ let
mktplcRef = {
name = "languagetool-linter";
publisher = "davidlday";
version = "0.25.7";
hash = "sha256-XLW49YkgDuojNEzqWRztK8mKWKbVU5OeGOjHl0heH/w=";
version = "0.25.8";
hash = "sha256-ddDxe0ZJgQjDUAKAQyboHEi0ZeVBeGE4Zx2peRbBGFA=";
};
meta = {
description = "LanguageTool integration for VS Code";
@@ -1346,8 +1346,8 @@ let
mktplcRef = {
publisher = "discloud";
name = "discloud";
version = "2.29.5";
hash = "sha256-oWrGDJHVQ8Gwjrh6vlQPKoFlBx3wxzLbMkH0gDFa5jg=";
version = "2.29.6";
hash = "sha256-CHpRetKZnGzShIePnbVUdR06/1AAO2I1RX7NiZ7GBNs=";
};
meta = {
changelog = "https://marketplace.visualstudio.com/items/discloud.discloud/changelog";
@@ -1998,8 +1998,8 @@ let
mktplcRef = {
name = "gitlab-workflow";
publisher = "gitlab";
version = "6.75.3";
hash = "sha256-UrcrHL46ZtQl6Zazec/2rkZLtnPK9BsmyT+9nhTncsA=";
version = "6.78.1";
hash = "sha256-N6M8HLSpnfUqMaPaWZuedWbA7ITwKhLS1n+uuwudpkU=";
};
meta = {
description = "GitLab extension for Visual Studio Code";
@@ -2570,8 +2570,8 @@ let
mktplcRef = {
publisher = "jnoortheen";
name = "nix-ide";
version = "0.5.5";
hash = "sha256-epdEMPAkSo0IXsd+ozicI8bjPPquDKIzB3ONRUYWwn8=";
version = "0.5.9";
hash = "sha256-hPOcp6Yksgfu1+In21/gJ3MthV8JUV5WaRpYHvo5GGk=";
};
meta = {
changelog = "https://marketplace.visualstudio.com/items/jnoortheen.nix-ide/changelog";
@@ -2918,8 +2918,8 @@ let
mktplcRef = {
name = "marp-vscode";
publisher = "marp-team";
version = "3.5.0";
hash = "sha256-BH+9HK08+G2hZTanOuBplxl/cYpGrIqrapFGjNIX4QA=";
version = "3.5.1";
hash = "sha256-t8ozV99HBHLiVMYMxh8bJ2QzMd/2PEeEDpzvqHavwPw=";
};
meta = {
license = lib.licenses.mit;
@@ -3707,6 +3707,8 @@ let
oracle.oracle-java = callPackage ./oracle.oracle-java { };
oxc.oxc-vscode = callPackage ./oxc.oxc-vscode { };
ph-hawkins.arc-plus = callPackage ./ph-hawkins.arc-plus { };
phind.phind = buildVscodeMarketplaceExtension {
@@ -3861,8 +3863,8 @@ let
mktplcRef = {
name = "ansible";
publisher = "redhat";
version = "26.4.6";
hash = "sha256-ckirgCt6+mdnWkvmLwpH7YwqOxQ+JEeRE0/NJGCi7rU=";
version = "26.5.0";
hash = "sha256-gKe+LC0OOZi5I1Tei64JtQUR1gpWyTex9MoLGT6jgWU=";
};
meta = {
description = "Ansible language support";
@@ -4357,8 +4359,8 @@ let
mktplcRef = {
publisher = "sonarsource";
name = "sonarlint-vscode";
version = "5.2.0";
hash = "sha256-Q9wP+PqjWVyqVh0FK8lx+k4bxacyQO7aLtZX98fRl7g=";
version = "5.2.3";
hash = "sha256-HSQjoYIQa8CVw6Fjb3H+et6U3urptNjrIT8HLgHirxA=";
};
meta.license = lib.licenses.lgpl3Only;
};
@@ -4807,8 +4809,8 @@ let
mktplcRef = {
name = "emacs-mcx";
publisher = "tuttieee";
version = "0.110.7";
hash = "sha256-9w78/6W/aqJxzoTBqSV7sek2zUf9gKlWFJ/0/XS9124=";
version = "0.110.9";
hash = "sha256-xHu8GvBoZKMag7BdHddXyjm2IReMujs9cggOn4h32t8=";
};
meta = {
changelog = "https://github.com/whitphx/vscode-emacs-mcx/blob/main/CHANGELOG.md";

5
pkgs/applications/editors/vscode/extensions/eamodio.gitlens/default.nix
View File

@@ -3,7 +3,7 @@
pkgs,
stdenv,
fetchFromGitHub,
pnpm,
pnpm_10,
fetchPnpmDeps,
pnpmConfigHook,
nodejs,
@@ -12,6 +12,8 @@
}:
let
pnpm = pnpm_10;
vsix = stdenv.mkDerivation (finalAttrs: {
name = "gitlens-${finalAttrs.version}.vsix";
pname = "gitlens-vsix";
@@ -26,6 +28,7 @@ let
pnpmDeps = fetchPnpmDeps {
inherit (finalAttrs) pname version src;
inherit pnpm;
fetcherVersion = 3;
hash = "sha256-Yuxuqr1BiviSw+dGNHLs2jAy8ADlBvRks6Kmy7FmCMw=";
};

4
pkgs/applications/editors/vscode/extensions/github.copilot-chat/default.nix
View File

@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
mktplcRef = {
publisher = "github";
name = "copilot-chat";
version = "0.44.2";
hash = "sha256-kjLpbA6zUta4K86yEDiLNWvy3kJ3AvF2fncCO/JVl6I=";
version = "0.45.1";
hash = "sha256-xxJ+h0/XyT8otXUzIYW9/KMxKLk5zoEE/fiqj4SZK+A=";
};
meta = {

4
pkgs/applications/editors/vscode/extensions/gplane.wasm-language-tools/default.nix
View File

@@ -14,8 +14,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
mktplcRef = {
publisher = "gplane";
name = "wasm-language-tools";
version = "1.16.0";
hash = "sha256-H2exVPaF8tYdpXBcooFi5bysp85OLOwxbKrB3HJes0Y=";
version = "1.20.0";
hash = "sha256-AXLwEp6uospVZwd2NxLEfABsNQOt1uRJTQ4HMTXbrJc=";
};
buildPhase = ''

4
pkgs/applications/editors/vscode/extensions/ms-python.mypy-type-checker/default.nix
View File

@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
mktplcRef = {
publisher = "ms-python";
name = "mypy-type-checker";
version = "2025.2.0";
hash = "sha256-VJ/XSC4cbIjgxKLsXxUxwko+HR0U59c8OrhYnKPJu4g=";
version = "2026.4.0";
hash = "sha256-N0zml16XSBwjGHzCR1L0W9WiSgqD/375VIQGpGfCkFE=";
};
meta = {

39
pkgs/applications/editors/vscode/extensions/oxc.oxc-vscode/default.nix Normal file
View File

@@ -0,0 +1,39 @@
{
lib,
vscode-utils,
jaq,
moreutils,
oxlint,
oxfmt,
}:
vscode-utils.buildVscodeMarketplaceExtension {
mktplcRef = {
publisher = "oxc";
name = "oxc-vscode";
version = "1.55.0";
hash = "sha256-QAuN9Qe1AErcGIbbqsYYO6kikgaEiX0Y3ddnNhuOB6Q=";
};
nativeBuildInputs = [
jaq
moreutils
];
postPatch = ''
jaq \
--arg oxlint "${lib.getExe oxlint}" \
--arg oxfmt "${lib.getExe oxfmt}" \
'
.contributes.configuration.properties."oxc.path.oxlint".default = $oxlint |
.contributes.configuration.properties."oxc.path.oxfmt".default = $oxfmt
' package.json | sponge package.json
'';
meta = {
description = "Oxlint and Oxfmt editor integration";
downloadPage = "https://marketplace.visualstudio.com/items?itemName=oxc.oxc-vscode";
homepage = "https://github.com/oxc-project/oxc-vscode";
license = lib.licenses.mit;
maintainers = [ lib.maintainers.drupol ];
};
}

5
pkgs/applications/editors/vscode/extensions/rooveterinaryinc.roo-cline/default.nix
View File

@@ -2,7 +2,7 @@
lib,
stdenvNoCC,
fetchFromGitHub,
pnpm,
pnpm_10,
fetchPnpmDeps,
pnpmConfigHook,
nodejs,
@@ -11,6 +11,8 @@
}:
let
pnpm = pnpm_10;
vsix = stdenvNoCC.mkDerivation (finalAttrs: {
name = "roo-code-${finalAttrs.version}.vsix";
pname = "roo-code-vsix";
@@ -25,6 +27,7 @@ let
pnpmDeps = fetchPnpmDeps {
inherit (finalAttrs) pname version src;
inherit pnpm;
fetcherVersion = 3;
hash = "sha256-t2sPuhn8xdk6hGfmViPGG+5TAhtBBOMYNoOb6DlPzws=";
};

6
pkgs/applications/editors/vscode/extensions/tekumara.typos-vscode/default.nix
View File

@@ -31,7 +31,7 @@ let
}
.${system} or (throw "Unsupported system: ${system}");
in
vscode-utils.buildVscodeMarketplaceExtension {
vscode-utils.buildVscodeMarketplaceExtension (finalAttrs: {
mktplcRef = {
name = "typos-vscode";
publisher = "tekumara";
@@ -57,7 +57,7 @@ vscode-utils.buildVscodeMarketplaceExtension {
passthru.updateScript = vscode-extension-update-script { };
meta = {
changelog = "https://marketplace.visualstudio.com/items/tekumara.typos-vscode/changelog";
changelog = "https://github.com/tekumara/typos-lsp/blob/v${finalAttrs.version}/CHANGELOG.md";
description = "VSCode extension for providing a low false-positive source code spell checker";
downloadPage = "https://marketplace.visualstudio.com/items?itemName=tekumara.typos-vscode";
homepage = "https://github.com/tekumara/typos-lsp";
@@ -70,4 +70,4 @@ vscode-utils.buildVscodeMarketplaceExtension {
];
maintainers = [ ];
};
}
})

10
pkgs/applications/editors/vscode/extensions/visualjj.visualjj/default.nix
View File

@@ -11,26 +11,26 @@ vscode-utils.buildVscodeMarketplaceExtension {
sources = {
"x86_64-linux" = {
arch = "linux-x64";
hash = "sha256-xtbI0mqkjF21pL/0R0DReHVMlsf32ys2iprxp6AsTao=";
hash = "sha256-YHerrkqMlLLHvbuM1fT6g4nBgO1DIkRBC+5ncw9ZA+I=";
};
"x86_64-darwin" = {
arch = "darwin-x64";
hash = "sha256-wpmx2RNAmGwwehBI/KpKNN3qxoWYFcESYKRRzc5pK/U=";
hash = "sha256-iXRw+07xkSi6Gxhx+iezBaGlAaZM2L0BmzZ5ZfFUEbc=";
};
"aarch64-linux" = {
arch = "linux-arm64";
hash = "sha256-zp3V8o9BDV29PA8xSlZ/RglnYkuc1rd+N5CuXIqd4ME=";
hash = "sha256-WkDu27TW1C+0UvNvNpWGKUhvqWo9rHMTWI9ro/gOYHs=";
};
"aarch64-darwin" = {
arch = "darwin-arm64";
hash = "sha256-7Scr8lumlZu5M1pGAWfQTMIpBXWU1/yp5kVE3LpFSVM=";
hash = "sha256-5RDH+TAfSkEYIleb2gb9vg+akWXp2JDcSUqyHZNJh/M=";
};
};
in
{
name = "visualjj";
publisher = "visualjj";
version = "0.28.1";
version = "0.28.3";
}
// sources.${stdenvNoCC.hostPlatform.system}
or (throw "Unsupported system ${stdenvNoCC.hostPlatform.system}");

6
pkgs/applications/emulators/libretro/cores/dosbox-pure.nix
View File

@@ -5,13 +5,13 @@
}:
mkLibretroCore {
core = "dosbox-pure";
version = "0-unstable-2026-04-17";
version = "0-unstable-2026-05-12";
src = fetchFromGitHub {
owner = "schellingb";
repo = "dosbox-pure";
rev = "93cf48bb22b30a9bc657511658cf4dbcd9a727eb";
hash = "sha256-QW1wIE4uuyCiI7eJjHsKh6PJd6QJwrBUQa4wkhPyRSE=";
rev = "3a5222c97456e8df90983eb546f4d866b0feb848";
hash = "sha256-FeT1VPOJsZaC9SZbJwbiC0fkVV/WOJ+rOcwf8g+wdeM=";
};
hardeningDisable = [ "format" ];

6
pkgs/applications/emulators/libretro/cores/fceumm.nix
View File

@@ -5,13 +5,13 @@
}:
mkLibretroCore {
core = "fceumm";
version = "0-unstable-2026-04-20";
version = "0-unstable-2026-05-06";
src = fetchFromGitHub {
owner = "libretro";
repo = "libretro-fceumm";
rev = "448a231618186b2af0bb9d6e37aeca05467e112f";
hash = "sha256-Kr3DEAk8dsFnUT73pOp5qwkCbcDItQwrRMI8hobrCuI=";
rev = "3a84a6fd0ba20dd4877c06b1d58741172148395f";
hash = "sha256-4+kEoN0+SWl284n7tIR76aysf0GlLdxELDXfpEK6mi8=";
};
meta = {

6
pkgs/applications/emulators/libretro/cores/genesis-plus-gx.nix
View File

@@ -5,13 +5,13 @@
}:
mkLibretroCore {
core = "genesis-plus-gx";
version = "0-unstable-2026-05-01";
version = "0-unstable-2026-05-08";
src = fetchFromGitHub {
owner = "libretro";
repo = "Genesis-Plus-GX";
rev = "252694adb9ebf2abcc7a1340d4078dce53d8954f";
hash = "sha256-mFij3fLDMvyby3ata47YJN7YuBKGv4/xphFQDiFKY3A=";
rev = "fa993f040d7150bda672b3e3ebe36c9bd2ea8904";
hash = "sha256-4igo4uwpDwbP6oTtlF6pwDF7+WZ0FgeFCtmPVNpULBo=";
};
meta = {

6
pkgs/applications/emulators/libretro/cores/pcsx2.nix
View File

@@ -11,13 +11,13 @@
}:
mkLibretroCore {
core = "pcsx2";
version = "0-unstable-2026-05-01";
version = "0-unstable-2026-05-13";
src = fetchFromGitHub {
owner = "libretro";
repo = "ps2";
rev = "1b048a1783263a0584e3f663fe46b1a6fd163ff9";
hash = "sha256-5me+ETLmJrVmpkGi1TJ5LWiPp+AKiwHPl7AlG0cp+8o=";
rev = "2b9768b58e743b2e7586051e28896c98dc05fa4e";
hash = "sha256-Du+Z0gF5y5a91/bCfSY7ohubSn4JaaWxB3fkO4aE6e8=";
fetchSubmodules = true;
};

6
pkgs/applications/emulators/libretro/cores/play.nix
View File

@@ -14,13 +14,13 @@
}:
mkLibretroCore {
core = "play";
version = "0-unstable-2026-04-23";
version = "0-unstable-2026-05-11";
src = fetchFromGitHub {
owner = "jpd002";
repo = "Play-";
rev = "158ec0cbdadc8778093016c9acbec9af45a9aab4";
hash = "sha256-UXvFsFwymGqk7GfI4qMyxEy71PqHLitV9E+C2iavud4=";
rev = "7a2b8d6058c7b89548283be5d380accc85e310a0";
hash = "sha256-AA6l4t+TDz2g/qQM4bVbSnJXsamEXzUqTL7VnvQ1mgc=";
fetchSubmodules = true;
};

6
pkgs/applications/emulators/libretro/cores/swanstation.nix
View File

@@ -6,13 +6,13 @@
}:
mkLibretroCore {
core = "swanstation";
version = "0-unstable-2026-04-10";
version = "0-unstable-2026-05-11";
src = fetchFromGitHub {
owner = "libretro";
repo = "swanstation";
rev = "0c263202fe29689113c3db63c8cd3fcacfc6ff37";
hash = "sha256-u+ZryM8CY4TTJ7YQdHMNREMbQ6gEd2Mz9h5s0CY4nEY=";
rev = "0f7757b3196ab472c3a8b279206b3ea19a3e5f2d";
hash = "sha256-5R+K0NpLdjajT6LV0os569vrgqRCtfXDqMnhM8z7dmk=";
};
extraNativeBuildInputs = [ cmake ];

6
pkgs/applications/emulators/libretro/cores/vba-next.nix
View File

@@ -5,13 +5,13 @@
}:
mkLibretroCore {
core = "vba-next";
version = "0-unstable-2026-04-20";
version = "0-unstable-2026-05-12";
src = fetchFromGitHub {
owner = "libretro";
repo = "vba-next";
rev = "82119ba97ee57c738a2eb1dc3a45cd2122ad2232";
hash = "sha256-On2O4WBVLmuj5FJZyaYUtgCEl1mEZffqAvGZpKz+Or8=";
rev = "f56ea99799b51fb107a4d3afe2a97a1364e8d806";
hash = "sha256-gbBurV2N6evLnZqvcxAZ2xfKMsybVeu+Nml0p0APTRE=";
};
meta = {

5
pkgs/applications/graphics/gimp/2.0/default.nix
View File

@@ -149,6 +149,11 @@ stdenv.mkDerivation (finalAttrs: {
url = "https://salsa.debian.org/gnome-team/gimp/-/raw/4cb293ec1a3b273281d5d9daf94b833c293797d7/debian/patches/CVE-2025-10934.patch";
hash = "sha256-MmYdh74cky/dF3UTHC0xpDW6+aa8Vzh+4ADHCDtIDzo=";
})
(fetchurl {
name = "c23.patch";
url = "https://gitlab.gnome.org/GNOME/gimp/-/commit/85bdad2b2ca7ba36a01bef945b1c4b193a2fa9d0.patch";
hash = "sha256-6g2Zhbx+WxX7lOCYAFII0yDbwILecExwFD22tZDED50=";
})
];
# error: possibly undefined macro: AM_NLS

4
pkgs/applications/misc/cubocore-packages/coreaction/default.nix
View File

@@ -11,13 +11,13 @@
stdenv.mkDerivation (finalAttrs: {
pname = "coreaction";
version = "5.0.0";
version = "5.0.1";
src = fetchFromGitLab {
owner = "cubocore/coreapps";
repo = "coreaction";
tag = "v${finalAttrs.version}";
hash = "sha256-R/pzudaxs85etbI4hh2NwHNtO7EqI+vgJALY/4rIvrs=";
hash = "sha256-93/1emCLXP3hHDGdzjF5horWkpG51yM5p68RUs1yoVg=";
};
nativeBuildInputs = [

4
pkgs/applications/misc/cubocore-packages/corearchiver/default.nix
View File

@@ -13,13 +13,13 @@
stdenv.mkDerivation (finalAttrs: {
pname = "corearchiver";
version = "5.0.0";
version = "5.0.1";
src = fetchFromGitLab {
owner = "cubocore/coreapps";
repo = "corearchiver";
tag = "v${finalAttrs.version}";
hash = "sha256-+XaBe1fNpAQf3cqXV+A1cZ1tPck3bCpgEDmFeF536q4=";
hash = "sha256-r2iXvc9KtRsB5IHvJxs/DxQIf7IiNWoM4h2wDgsXvZE=";
};
nativeBuildInputs = [

4
pkgs/applications/misc/cubocore-packages/coregarage/default.nix
View File

@@ -13,13 +13,13 @@
stdenv.mkDerivation (finalAttrs: {
pname = "coregarage";
version = "5.0.0";
version = "5.0.1";
src = fetchFromGitLab {
owner = "cubocore/coreapps";
repo = "coregarage";
tag = "v${finalAttrs.version}";
hash = "sha256-boe7z8KPnMaoWekBFS4g/Ay98rpREeLMAsHOr2olYws=";
hash = "sha256-aPBqlt/bL1cx6mLaf/gEFQB+NEvGQJioBJZ4QAxTwzw=";
};
nativeBuildInputs = [

4
pkgs/applications/misc/cubocore-packages/corehunt/default.nix
View File

@@ -11,13 +11,13 @@
stdenv.mkDerivation (finalAttrs: {
pname = "corehunt";
version = "5.0.0";
version = "5.0.1";
src = fetchFromGitLab {
owner = "cubocore/coreapps";
repo = "corehunt";
tag = "v${finalAttrs.version}";
hash = "sha256-QJJ+e+5UKka1Hbrtyn+agpJ7FLADHupZt41K8Mq8H4c=";
hash = "sha256-D3O1RnhXZmIGlk75OxfYvQI+8sytXTho2MvccI5Xyvg=";
};
nativeBuildInputs = [

4
pkgs/applications/misc/cubocore-packages/coreimage/default.nix
View File

@@ -11,13 +11,13 @@
stdenv.mkDerivation (finalAttrs: {
pname = "coreimage";
version = "5.0.0";
version = "5.0.1";
src = fetchFromGitLab {
owner = "cubocore/coreapps";
repo = "coreimage";
tag = "v${finalAttrs.version}";
hash = "sha256-sgOxDKACb9D/TvjjHz09JwBpFoE8eXA4HixcbN+0FoE=";
hash = "sha256-1P6dD0aHsv79s1jCghRhhxi5rZ6MmpyIrks9QnqFoaU=";
};
nativeBuildInputs = [

4
pkgs/applications/misc/cubocore-packages/coreinfo/default.nix
View File

@@ -14,13 +14,13 @@
stdenv.mkDerivation (finalAttrs: {
pname = "coreinfo";
version = "5.0.0";
version = "5.0.1";
src = fetchFromGitLab {
owner = "cubocore/coreapps";
repo = "coreinfo";
tag = "v${finalAttrs.version}";
hash = "sha256-/L69lrkJZh+SJRoNxvogdJ5KRIorwcBzm7WGxrNpexM=";
hash = "sha256-Ct/vAxtdFcXIxleaePhWD5L42d88go/3arYKSrw/c2c=";
};
nativeBuildInputs = [

4
pkgs/applications/misc/cubocore-packages/corekeyboard/default.nix
View File

@@ -13,13 +13,13 @@
stdenv.mkDerivation (finalAttrs: {
pname = "corekeyboard";
version = "5.0.0";
version = "5.0.1";
src = fetchFromGitLab {
owner = "cubocore/coreapps";
repo = "corekeyboard";
tag = "v${finalAttrs.version}";
hash = "sha256-n7QbvRPZFMeUl/P4XiGYZDglZCA8Ftf08s5uzPmSyIQ=";
hash = "sha256-HAkIhmQzicnOAws8M+Z8J7lCuGUqYkJeQl0H8P0EE3c=";
};
nativeBuildInputs = [

4
pkgs/applications/misc/cubocore-packages/corepad/default.nix
View File

@@ -11,13 +11,13 @@
stdenv.mkDerivation (finalAttrs: {
pname = "corepad";
version = "5.0.0";
version = "5.0.1";
src = fetchFromGitLab {
owner = "cubocore/coreapps";
repo = "corepad";
tag = "v${finalAttrs.version}";
hash = "sha256-oGF2N0bUuvc/ixmh2nefEJKh0kDipvcL/dwaXNxwo84=";
hash = "sha256-TA/gwI7ukuwChBRp2xsDbNbTblkzYgQ5YHwuI53cxc8=";
};
nativeBuildInputs = [

4
pkgs/applications/misc/cubocore-packages/corepaint/default.nix
View File

@@ -11,13 +11,13 @@
stdenv.mkDerivation (finalAttrs: {
pname = "corepaint";
version = "5.0.0";
version = "5.0.1";
src = fetchFromGitLab {
owner = "cubocore/coreapps";
repo = "corepaint";
tag = "v${finalAttrs.version}";
hash = "sha256-ARFyBtkGYFMKnUD1h93GcQiKV6mFXxJvLEVeSXlaHZI=";
hash = "sha256-qk2Fm/IhUU/0y+ErMK/qQKxnD/en14ZKoiIJoJwBnMc=";
};
nativeBuildInputs = [

4
pkgs/applications/misc/cubocore-packages/corepdf/default.nix
View File

@@ -13,13 +13,13 @@
stdenv.mkDerivation (finalAttrs: {
pname = "corepdf";
version = "5.0.0";
version = "5.0.1";
src = fetchFromGitLab {
owner = "cubocore/coreapps";
repo = "corepdf";
tag = "v${finalAttrs.version}";
hash = "sha256-fhEuMk15yCA6IUasD9rJPR8sB+h0tz8niOQtXFIe7Uc=";
hash = "sha256-6VLjOf/VZpBH8kIvdvObiyu10yiTYk26eKHFKIUMwN8=";
};
nativeBuildInputs = [

4
pkgs/applications/misc/cubocore-packages/corepins/default.nix
View File

@@ -11,13 +11,13 @@
stdenv.mkDerivation (finalAttrs: {
pname = "corepins";
version = "5.0.0";
version = "5.0.1";
src = fetchFromGitLab {
owner = "cubocore/coreapps";
repo = "corepins";
tag = "v${finalAttrs.version}";
hash = "sha256-noMdI2qk3cYc1FfRWd4rwpZBbeHiD557Z1T0ZxIhaTw=";
hash = "sha256-+cWhlqIK2Oqx4Zt1sRd7xvGwmbYOZbMMU+k5uNnkogk=";
};
nativeBuildInputs = [

4
pkgs/applications/misc/cubocore-packages/corerenamer/default.nix
View File

@@ -11,13 +11,13 @@
stdenv.mkDerivation (finalAttrs: {
pname = "corerenamer";
version = "5.0.0";
version = "5.0.1";
src = fetchFromGitLab {
owner = "cubocore/coreapps";
repo = "corerenamer";
tag = "v${finalAttrs.version}";
hash = "sha256-9e8Gm7h0zWVQeb7eFcUmp8uTdSboenLa7baZpKc3HEQ=";
hash = "sha256-94luETLmugQZuSI+q84DC9WyH5LtCqpjH6LYtv9R93Y=";
};
nativeBuildInputs = [

4
pkgs/applications/misc/cubocore-packages/corestats/default.nix
View File

@@ -12,13 +12,13 @@
stdenv.mkDerivation (finalAttrs: {
pname = "corestats";
version = "5.0.0";
version = "5.0.1";
src = fetchFromGitLab {
owner = "cubocore/coreapps";
repo = "corestats";
tag = "v${finalAttrs.version}";
hash = "sha256-0d03y3AYWxXh9DZrbPWqk34yq7iy5xUn/oMmJBu5GqQ=";
hash = "sha256-4wVBC/NeexJIFsDOjqHFC/u3Rapd/22fjH5yMVafWPY=";
};
nativeBuildInputs = [

62
pkgs/applications/networking/browsers/chromium/info.json
View File

@@ -1,10 +1,10 @@
{
"chromium": {
"version": "148.0.7778.96",
"version": "148.0.7778.167",
"chromedriver": {
"version": "147.0.7727.138",
"hash_darwin": "sha256-d2dEPcR2mlfkL6XGhzMsgH/OwAI+yLXdS0dF4luPRfM=",
"hash_darwin_aarch64": "sha256-6rguKqpJJd058DQbiLVKVd/t+E7yYe1FHHB6zlwD6bU="
"version": "148.0.7778.168",
"hash_darwin": "sha256-F24gaQI0JZkStM71KJDEn8EKBTw1UifMxYXDdUIVup4=",
"hash_darwin_aarch64": "sha256-WpAiIz3nXxJLkxAP5JSn6rSxDW0vvl7EHeJA5MD+nss="
},
"deps": {
"depot_tools": {
@@ -21,8 +21,8 @@
"DEPS": {
"src": {
"url": "https://chromium.googlesource.com/chromium/src.git",
"rev": "8625e066febc721e015ea99842da12901eb7ed73",
"hash": "sha256-coeBYfNPtiRRPuqoBRaxkTQI/a2pYNLI1slUdU1dZAc=",
"rev": "65db666ac2cf205fcc36db8bb5b9cd87f94808ac",
"hash": "sha256-Vda6y35lHYP3xK9FT5FdsnfTtL0MiY2m/auSq6NyL0U=",
"recompress": true
},
"src/third_party/clang-format/script": {
@@ -92,8 +92,8 @@
},
"src/third_party/angle": {
"url": "https://chromium.googlesource.com/angle/angle.git",
"rev": "cc0e3572e8789f4a184dd9714a04b3d98ae81015",
"hash": "sha256-3KVTEBcnQTn99ccdKzylzUvua2jlS4g8/nfIDdLk6ug="
"rev": "6c71c70ec7e838c5f1712974086c8bc33d07de14",
"hash": "sha256-35Zu8jSopO47pH1rNLtSq5I8QRsOkMMvTgtmD13Yw/Y="
},
"src/third_party/angle/third_party/glmark2/src": {
"url": "https://chromium.googlesource.com/external/github.com/glmark2/glmark2",
@@ -342,8 +342,8 @@
},
"src/third_party/harfbuzz/src": {
"url": "https://chromium.googlesource.com/external/github.com/harfbuzz/harfbuzz.git",
"rev": "4fc96139259ebc35f40118e0382ac8037d928e5c",
"hash": "sha256-/RT2OPWFiVwFqmNS4o+gE0JrcVO1cQDkCkgrSEe7BzE="
"rev": "f027b8e9039f73bf803eae684fee2eb2d30e4180",
"hash": "sha256-HWb3QbPl+RE2oI/Jwv5BjKwv9UnJ8VcJvk+uGy9cAqM="
},
"src/third_party/ink/src": {
"url": "https://chromium.googlesource.com/external/github.com/google/ink.git",
@@ -662,8 +662,8 @@
},
"src/third_party/skia": {
"url": "https://skia.googlesource.com/skia.git",
"rev": "afe8b760ada5128164f9826866b4381a3463df41",
"hash": "sha256-HsKHffZWTls362kjokxzdhaxb/xJD1g70VHGk9l6GVM="
"rev": "a2888b27a98e4ff30085d4d2dba8a1a99baf6dfb",
"hash": "sha256-eOjFuMmXr9YtZ0e4yDB8JMjTrNWEg5OlTkAMGuHZIWE="
},
"src/third_party/smhasher/src": {
"url": "https://chromium.googlesource.com/external/smhasher.git",
@@ -797,8 +797,8 @@
},
"src/third_party/webrtc": {
"url": "https://webrtc.googlesource.com/src.git",
"rev": "9600e77d854090669817d22aa2fc941ee92aaacd",
"hash": "sha256-jTJv53qt971Va5q6MaULysYiChBVmsFYxG9fzkcE0ak="
"rev": "9a7f650bcd14f241d20f88f4e1ea3b7300de72ac",
"hash": "sha256-k5cHE4XURJQrPURmXk4MMNV5k8+ryKfjmsVTzARRro4="
},
"src/third_party/wuffs/src": {
"url": "https://skia.googlesource.com/external/github.com/google/wuffs-mirror-release-c.git",
@@ -822,13 +822,13 @@
},
"src/v8": {
"url": "https://chromium.googlesource.com/v8/v8.git",
"rev": "ddc9a95905de5268332a8f0216dc2bc67d26e829",
"hash": "sha256-x2FGL3J+JaWO1m6jBrcayR7Vlz90fYEAuufm4PULYyM="
"rev": "e38030f4228c8d1405fe105fc5feaa5173559e25",
"hash": "sha256-VsJpsCfDGF6rlfYQXccgF+F/pBhY/ybUa9N5HnHJ2lU="
}
}
},
"ungoogled-chromium": {
"version": "148.0.7778.96",
"version": "148.0.7778.167",
"deps": {
"depot_tools": {
"rev": "41c40cfaec7ee3bf0423c59925d8b23982a601f1",
@@ -840,16 +840,16 @@
"hash": "sha256-BTPD8WM1pVAMkFDlHekMdWFGyf63KdhKkKwsqikqoBQ="
},
"ungoogled-patches": {
"rev": "148.0.7778.96-1",
"hash": "sha256-yuc51ursl3pNyqSuTT9391AAlytoTzEMeronxjsNM7g="
"rev": "148.0.7778.167-1",
"hash": "sha256-07mzJHDgWiEQm/8pPDDzT8r+6/bh95yBrZMm2jDqCus="
},
"npmHash": "sha256-JuVcY8iFRDWcPcP4Pg+qm5rnTXkiVfNsqSkXbDWqsE8="
},
"DEPS": {
"src": {
"url": "https://chromium.googlesource.com/chromium/src.git",
"rev": "8625e066febc721e015ea99842da12901eb7ed73",
"hash": "sha256-coeBYfNPtiRRPuqoBRaxkTQI/a2pYNLI1slUdU1dZAc=",
"rev": "65db666ac2cf205fcc36db8bb5b9cd87f94808ac",
"hash": "sha256-Vda6y35lHYP3xK9FT5FdsnfTtL0MiY2m/auSq6NyL0U=",
"recompress": true
},
"src/third_party/clang-format/script": {
@@ -919,8 +919,8 @@
},
"src/third_party/angle": {
"url": "https://chromium.googlesource.com/angle/angle.git",
"rev": "cc0e3572e8789f4a184dd9714a04b3d98ae81015",
"hash": "sha256-3KVTEBcnQTn99ccdKzylzUvua2jlS4g8/nfIDdLk6ug="
"rev": "6c71c70ec7e838c5f1712974086c8bc33d07de14",
"hash": "sha256-35Zu8jSopO47pH1rNLtSq5I8QRsOkMMvTgtmD13Yw/Y="
},
"src/third_party/angle/third_party/glmark2/src": {
"url": "https://chromium.googlesource.com/external/github.com/glmark2/glmark2",
@@ -1169,8 +1169,8 @@
},
"src/third_party/harfbuzz/src": {
"url": "https://chromium.googlesource.com/external/github.com/harfbuzz/harfbuzz.git",
"rev": "4fc96139259ebc35f40118e0382ac8037d928e5c",
"hash": "sha256-/RT2OPWFiVwFqmNS4o+gE0JrcVO1cQDkCkgrSEe7BzE="
"rev": "f027b8e9039f73bf803eae684fee2eb2d30e4180",
"hash": "sha256-HWb3QbPl+RE2oI/Jwv5BjKwv9UnJ8VcJvk+uGy9cAqM="
},
"src/third_party/ink/src": {
"url": "https://chromium.googlesource.com/external/github.com/google/ink.git",
@@ -1489,8 +1489,8 @@
},
"src/third_party/skia": {
"url": "https://skia.googlesource.com/skia.git",
"rev": "afe8b760ada5128164f9826866b4381a3463df41",
"hash": "sha256-HsKHffZWTls362kjokxzdhaxb/xJD1g70VHGk9l6GVM="
"rev": "a2888b27a98e4ff30085d4d2dba8a1a99baf6dfb",
"hash": "sha256-eOjFuMmXr9YtZ0e4yDB8JMjTrNWEg5OlTkAMGuHZIWE="
},
"src/third_party/smhasher/src": {
"url": "https://chromium.googlesource.com/external/smhasher.git",
@@ -1624,8 +1624,8 @@
},
"src/third_party/webrtc": {
"url": "https://webrtc.googlesource.com/src.git",
"rev": "9600e77d854090669817d22aa2fc941ee92aaacd",
"hash": "sha256-jTJv53qt971Va5q6MaULysYiChBVmsFYxG9fzkcE0ak="
"rev": "9a7f650bcd14f241d20f88f4e1ea3b7300de72ac",
"hash": "sha256-k5cHE4XURJQrPURmXk4MMNV5k8+ryKfjmsVTzARRro4="
},
"src/third_party/wuffs/src": {
"url": "https://skia.googlesource.com/external/github.com/google/wuffs-mirror-release-c.git",
@@ -1649,8 +1649,8 @@
},
"src/v8": {
"url": "https://chromium.googlesource.com/v8/v8.git",
"rev": "ddc9a95905de5268332a8f0216dc2bc67d26e829",
"hash": "sha256-x2FGL3J+JaWO1m6jBrcayR7Vlz90fYEAuufm4PULYyM="
"rev": "e38030f4228c8d1405fe105fc5feaa5173559e25",
"hash": "sha256-VsJpsCfDGF6rlfYQXccgF+F/pBhY/ybUa9N5HnHJ2lU="
}
}
}

1436
pkgs/applications/networking/browsers/firefox-bin/release_sources.nix
View File

File diff suppressed because it is too large Load Diff

4
pkgs/applications/networking/browsers/firefox/packages/firefox.nix
View File

@@ -9,10 +9,10 @@
buildMozillaMach rec {
pname = "firefox";
version = "150.0.2";
version = "150.0.3";
src = fetchurl {
url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
sha512 = "e22fc66f7faeb9bef4036d0a90af4c27dabc45a3dc59c7290536bfe46c7624d73388d29b36a8999e364065fa31a5fa167596632229b0af9bc1baf4135fa29a4d";
sha512 = "8452da61200f8ee66790d3fff230ca84b2ac9291af2b57e018486c50f938c53c6fb4943fe6cfe1e99b9783466fb00bf707fa006293753ac698618fc1e3b70a4a";
};
meta = {

Some files were not shown because too many files have changed in this diff Show More